@trokky/trokky 3.5.0 → 3.5.2

package/dist/core/security/oauth2/authorization-server.js

@@ -9,7 +9,22 @@
  * - External web applications (authorization code flow)
  */
 import { randomBytes, createHash, timingSafeEqual } from 'crypto';
-import { SCOPE_TO_PERMISSIONS, BUILTIN_CLI_CLIENT as CLI_CLIENT } from '../../types/oauth2.js';
+import { SCOPE_TO_PERMISSIONS, ALL_OAUTH2_SCOPES, BUILTIN_CLIENTS } from '../../types/oauth2.js';
+import { saveAuthFlowState, getAuthFlowState, consumeAuthFlowState } from '../auth-flow-store.js';
+const inProcessFlowStore = {
+    save: state => saveAuthFlowState(null, state),
+    get: (id, kind) => getAuthFlowState(null, id, kind),
+    consume: (id, kind) => consumeAuthFlowState(null, id, kind)
+};
+// Record ids. A device code is found by its hash when the device polls, and by its short
+// user code when a person approves it, so it is stored under the first and indexed by the
+// second.
+const deviceId = (deviceCodeHash) => `dev-${deviceCodeHash}`;
+const userCodeId = (userCode) => `usr-${normalizeUserCode(userCode)}`;
+const authCodeId = (codeHash) => `code-${codeHash}`;
+function normalizeUserCode(userCode) {
+    return userCode.replace(/-/g, '').toUpperCase().replace(/[^A-Z0-9]/g, '');
+}
 /**
  * OAuth2 Authorization Server
  *
@@ -18,12 +33,8 @@ import { SCOPE_TO_PERMISSIONS, BUILTIN_CLI_CLIENT as CLI_CLIENT } from '../../ty
 export class OAuth2AuthorizationServer {
     config;
     externalClients;
-    // In-memory stores (should be replaced with persistent storage in production)
-    deviceCodes = new Map();
-    authorizationCodes = new Map();
+    store;
     clients = new Map();
-    // Cleanup interval
-    cleanupInterval = null;
     constructor(config) {
         this.config = {
             issuer: config.issuer,
@@ -36,23 +47,20 @@ export class OAuth2AuthorizationServer {
             pollingInterval: config.pollingInterval ?? 5
         };
         this.externalClients = config.clients || [];
+        this.store = config.flowStore ?? inProcessFlowStore;
         // Register built-in CLI client
         this.registerBuiltInClient();
         // Register external clients from config
         this.registerExternalClients();
-        // Start cleanup interval
-        this.startCleanup();
     }
     /**
      * Register the built-in CLI client
      */
     registerBuiltInClient() {
         const now = new Date().toISOString();
-        this.clients.set(CLI_CLIENT.id, {
-            ...CLI_CLIENT,
-            createdAt: now,
-            updatedAt: now
-        });
+        for (const client of BUILTIN_CLIENTS) {
+            this.clients.set(client.id, { ...client, createdAt: now, updatedAt: now });
+        }
     }
     /**
      * Register external OAuth2 clients from config
@@ -67,11 +75,11 @@ export class OAuth2AuthorizationServer {
                 type: clientConfig.type || 'public',
                 secretHash: clientConfig.secret ? this.hashSecret(clientConfig.secret) : undefined,
                 redirectUris: clientConfig.redirectUris,
-                allowedScopes: (clientConfig.allowedScopes || [
-                    'openid', 'profile', 'content:read', 'content:write',
-                    'content:delete', 'media:read', 'media:write', 'offline_access'
-                ]),
+                allowedScopes: (clientConfig.allowedScopes || [...ALL_OAUTH2_SCOPES]),
                 grantTypes: (clientConfig.grantTypes || ['authorization_code', 'refresh_token']),
+                // Never the CLI: a config entry may override the built-in client (a site narrowing its
+                // scopes does), but making every CLI login act as the full user must not be one line away
+                trusted: clientConfig.trusted === true && !BUILTIN_CLIENTS.some(builtIn => builtIn.id === clientConfig.id),
                 isActive: true,
                 createdAt: now,
                 updatedAt: now
@@ -82,32 +90,11 @@ export class OAuth2AuthorizationServer {
     /**
      * Start periodic cleanup of expired codes
      */
-    startCleanup() {
-        this.cleanupInterval = setInterval(() => {
-            const now = Date.now();
-            // Clean expired device codes
-            for (const [key, state] of this.deviceCodes) {
-                if (state.expiresAt < now) {
-                    this.deviceCodes.delete(key);
-                }
-            }
-            // Clean expired authorization codes
-            for (const [key, state] of this.authorizationCodes) {
-                if (state.expiresAt < now) {
-                    this.authorizationCodes.delete(key);
-                }
-            }
-        }, 60000); // Run every minute
-    }
     /**
-     * Stop cleanup interval (for testing/shutdown)
+     * Kept for callers that stop the server on shutdown. Codes now expire in the flow store,
+     * which sweeps on request, so there is no timer to stop.
      */
-    stopCleanup() {
-        if (this.cleanupInterval) {
-            clearInterval(this.cleanupInterval);
-            this.cleanupInterval = null;
-        }
-    }
+    stopCleanup() { }
     // ============================================
     // Client Management
     // ============================================
@@ -162,7 +149,7 @@ export class OAuth2AuthorizationServer {
      * Start device authorization flow
      * Returns device_code, user_code, and verification URI
      */
-    startDeviceAuthorization(clientId, requestedScopes) {
+    async startDeviceAuthorization(clientId, requestedScopes) {
         // Validate client
         const client = this.getClient(clientId);
         if (!client) {
@@ -200,18 +187,17 @@ export class OAuth2AuthorizationServer {
         const deviceCode = this.generateDeviceCode();
         const userCode = this.generateUserCode();
         const deviceCodeHash = this.hashSecret(deviceCode);
-        // Store device code state
-        const state = {
+        const expiresAt = new Date(Date.now() + this.config.deviceCodeTtl * 1000).toISOString();
+        const record = {
             deviceCodeHash,
             userCode,
             clientId,
             scopes,
-            expiresAt: Date.now() + (this.config.deviceCodeTtl * 1000),
             interval: this.config.pollingInterval,
             status: 'pending'
         };
-        // Store by user code for lookup during verification
-        this.deviceCodes.set(userCode, state);
+        await this.store.save({ id: deviceId(deviceCodeHash), kind: 'oauth2_device', data: { ...record }, expiresAt });
+        await this.store.save({ id: userCodeId(userCode), kind: 'oauth2_device', data: { deviceCodeHash }, expiresAt });
         // Build verification URIs
         // Studio serves the approval page under its own mount; the default assumes /studio.
         const verificationUri = this.config.verificationUri;
@@ -228,86 +214,97 @@ export class OAuth2AuthorizationServer {
             }
         };
     }
+    /** The device record behind a user code, with its expiry, or null. */
+    async findByUserCode(userCode) {
+        if (normalizeUserCode(userCode).length !== 8)
+            return null;
+        const index = await this.store.get(userCodeId(userCode), 'oauth2_device');
+        const deviceCodeHash = index?.data.deviceCodeHash;
+        if (typeof deviceCodeHash !== 'string')
+            return null;
+        const stored = await this.store.get(deviceId(deviceCodeHash), 'oauth2_device');
+        if (!stored)
+            return null;
+        return { record: stored.data, expiresAt: stored.expiresAt };
+    }
     /**
      * Get device code state by user code (for verification page)
      */
-    getDeviceCodeByUserCode(userCode) {
-        // Normalize user code (remove dashes, uppercase)
-        const normalizedCode = userCode.replace(/-/g, '').toUpperCase();
-        const formattedCode = `${normalizedCode.slice(0, 4)}-${normalizedCode.slice(4)}`;
-        return this.deviceCodes.get(formattedCode) ?? null;
+    async getDeviceCodeByUserCode(userCode) {
+        const found = await this.findByUserCode(userCode);
+        if (!found)
+            return null;
+        return { ...found.record, expiresAt: new Date(found.expiresAt).getTime() };
     }
     /**
-     * Authorize a device code (called when user approves in Studio)
+     * Authorize a device code (called when user approves in Studio).
+     *
+     * `approvedScopes` is what the person left ticked on the consent screen. It can only
+     * narrow the request: anything not requested is ignored, and approving nothing is refused.
      */
-    authorizeDeviceCode(userCode, userId) {
-        const state = this.getDeviceCodeByUserCode(userCode);
-        if (!state) {
-            return false;
-        }
-        if (state.status !== 'pending') {
-            return false;
-        }
-        if (state.expiresAt < Date.now()) {
-            state.status = 'expired';
-            return false;
-        }
-        state.status = 'authorized';
-        state.userId = userId;
-        state.decidedAt = Date.now();
-        return true;
+    async authorizeDeviceCode(userCode, userId, approvedScopes) {
+        return this.decide(userCode, record => {
+            const scopes = approvedScopes
+                ? record.scopes.filter(scope => approvedScopes.includes(scope))
+                : record.scopes;
+            // Approving nothing is not an approval; the code stays pending
+            if (scopes.length === 0)
+                return null;
+            return { ...record, scopes, status: 'authorized', userId, decidedAt: Date.now() };
+        });
     }
     /**
      * Deny a device code (called when user denies in Studio)
      */
-    denyDeviceCode(userCode) {
-        const state = this.getDeviceCodeByUserCode(userCode);
-        if (!state) {
+    async denyDeviceCode(userCode) {
+        return this.decide(userCode, record => ({ ...record, status: 'denied', decidedAt: Date.now() }));
+    }
+    /**
+     * Record one decision on a pending code.
+     *
+     * Taking the user-code index is the lock: of two decisions racing (two clicks, an approve
+     * and a deny), exactly one gets it, and the other is refused rather than both reporting
+     * success while the last write wins. The index goes back afterwards so the approval page
+     * can still show that this code was already handled.
+     */
+    async decide(userCode, apply) {
+        if (normalizeUserCode(userCode).length !== 8)
             return false;
-        }
-        if (state.status !== 'pending') {
+        const index = await this.store.consume(userCodeId(userCode), 'oauth2_device');
+        const deviceCodeHash = index?.data.deviceCodeHash;
+        if (typeof deviceCodeHash !== 'string')
             return false;
+        const stored = await this.store.get(deviceId(deviceCodeHash), 'oauth2_device');
+        if (!stored)
+            return false;
+        let decided = false;
+        const record = stored.data;
+        if (record.status === 'pending') {
+            const next = apply(record);
+            if (next) {
+                await this.store.save({ id: deviceId(deviceCodeHash), kind: 'oauth2_device', data: { ...next }, expiresAt: stored.expiresAt });
+                decided = true;
+            }
         }
-        state.status = 'denied';
-        state.decidedAt = Date.now();
-        return true;
+        await this.store.save({ id: userCodeId(userCode), kind: 'oauth2_device', data: { deviceCodeHash }, expiresAt: stored.expiresAt });
+        return decided;
     }
     /**
      * Poll for device token (called by CLI)
      */
-    pollDeviceToken(deviceCode, clientId, generateToken) {
-        return this.checkDeviceCodeAndGenerateToken(deviceCode, clientId, generateToken);
-    }
-    async checkDeviceCodeAndGenerateToken(deviceCode, clientId, generateToken) {
-        const deviceCodeHash = this.hashSecret(deviceCode);
-        // Find the state by iterating (in production, use proper indexing)
-        let foundState = null;
-        let foundKey = null;
-        for (const [key, state] of this.deviceCodes) {
-            if (state.deviceCodeHash === deviceCodeHash && state.clientId === clientId) {
-                foundState = state;
-                foundKey = key;
-                break;
-            }
-        }
-        if (!foundState || !foundKey) {
-            return {
-                success: false,
-                error: 'invalid_grant',
-                error_description: 'Invalid device code'
-            };
-        }
-        // Check expiration
-        if (foundState.expiresAt < Date.now()) {
-            this.deviceCodes.delete(foundKey);
-            return {
-                success: false,
-                error: 'expired_token',
-                error_description: 'Device code has expired'
-            };
-        }
-        // Check status
-        switch (foundState.status) {
+    async pollDeviceToken(deviceCode, clientId, generateToken) {
+        const id = deviceId(this.hashSecret(deviceCode));
+        const stored = await this.store.get(id, 'oauth2_device');
+        // The store drops expired codes, so an unknown code and an expired one look alike here.
+        // Report expiry: a client that polls past its code's lifetime is told to start over.
+        if (!stored) {
+            return { success: false, error: 'expired_token', error_description: 'Device code is unknown or has expired' };
+        }
+        const record = stored.data;
+        if (record.clientId !== clientId) {
+            return { success: false, error: 'invalid_grant', error_description: 'Invalid device code' };
+        }
+        switch (record.status) {
             case 'pending':
                 return {
                     success: false,
@@ -315,41 +312,28 @@ export class OAuth2AuthorizationServer {
                     error_description: 'The authorization request is still pending'
                 };
             case 'denied':
-                this.deviceCodes.delete(foundKey);
+                await this.store.consume(id, 'oauth2_device');
                 return {
                     success: false,
                     error: 'access_denied',
                     error_description: 'The user denied the authorization request'
                 };
-            case 'expired':
-                this.deviceCodes.delete(foundKey);
-                return {
-                    success: false,
-                    error: 'expired_token',
-                    error_description: 'Device code has expired'
-                };
-            case 'authorized':
-                if (!foundState.userId) {
-                    return {
-                        success: false,
-                        error: 'server_error',
-                        error_description: 'User ID not found for authorized request'
-                    };
+            case 'authorized': {
+                // Taking the record is what makes the code single use: two concurrent polls cannot
+                // both receive tokens, because only one of them gets it back.
+                const taken = await this.store.consume(id, 'oauth2_device');
+                const approved = taken?.data;
+                if (!approved || approved.status !== 'authorized' || !approved.userId) {
+                    return { success: false, error: 'invalid_grant', error_description: 'Device code was already used' };
                 }
-                // Generate tokens
-                const tokenResponse = await generateToken(foundState.userId, foundState.scopes, foundState.clientId);
-                // Remove used device code
-                this.deviceCodes.delete(foundKey);
                 return {
                     success: true,
-                    response: tokenResponse
+                    response: await generateToken(approved.userId, approved.scopes, approved.clientId)
                 };
+            }
             default:
-                return {
-                    success: false,
-                    error: 'server_error',
-                    error_description: 'Unknown device code status'
-                };
+                await this.store.consume(id, 'oauth2_device');
+                return { success: false, error: 'expired_token', error_description: 'Device code has expired' };
         }
     }
     // ============================================
@@ -427,7 +411,7 @@ export class OAuth2AuthorizationServer {
     /**
      * Generate authorization code after user approval
      */
-    generateAuthorizationCode(clientId, redirectUri, scopes, codeChallenge, userId) {
+    async generateAuthorizationCode(clientId, redirectUri, scopes, codeChallenge, userId) {
         const code = randomBytes(32).toString('base64url');
         const codeHash = this.hashSecret(code);
         const state = {
@@ -439,15 +423,52 @@ export class OAuth2AuthorizationServer {
             userId,
             expiresAt: Date.now() + (this.config.authCodeTtl * 1000)
         };
-        this.authorizationCodes.set(codeHash, state);
+        await this.store.save({
+            id: authCodeId(codeHash),
+            kind: 'oauth2_code',
+            data: { ...state },
+            expiresAt: new Date(state.expiresAt).toISOString()
+        });
         return code;
     }
+    /**
+     * Check an approval posted from the consent screen before issuing a code for it.
+     *
+     * The approval arrives as a fresh request, so everything the authorization request was
+     * checked for is checked again: the client, its grant, the redirect URI, the PKCE
+     * challenge, and scopes the client may have. The person may have unticked scopes, but the
+     * result must still be within what the client is allowed.
+     */
+    validateApproval(params) {
+        const client = this.getClient(params.client_id);
+        if (!client || !client.isActive || !client.grantTypes.includes('authorization_code')) {
+            return { valid: false, error_description: 'Unknown or inactive client' };
+        }
+        if (!client.redirectUris.includes(params.redirect_uri)) {
+            return { valid: false, error_description: 'Invalid redirect_uri' };
+        }
+        if (params.denial) {
+            return { valid: true, scopes: [] };
+        }
+        if (typeof params.code_challenge !== 'string' || params.code_challenge.length < 43) {
+            return { valid: false, error_description: 'Invalid code_challenge' };
+        }
+        if (!Array.isArray(params.scopes) || !params.scopes.every(scope => typeof scope === 'string')) {
+            return { valid: false, error_description: 'scopes must be a list' };
+        }
+        const scopes = this.validateScopes(params.scopes, client.allowedScopes);
+        if (scopes.length === 0 || scopes.length !== params.scopes.length) {
+            return { valid: false, error_description: 'scopes must be a non-empty subset of what the client may request' };
+        }
+        return { valid: true, scopes };
+    }
     /**
      * Exchange authorization code for tokens
      */
     async exchangeAuthorizationCode(code, clientId, redirectUri, codeVerifier, generateToken) {
-        const codeHash = this.hashSecret(code);
-        const state = this.authorizationCodes.get(codeHash);
+        // Taken, not read: a code is single use even when two exchanges race
+        const taken = await this.store.consume(authCodeId(this.hashSecret(code)), 'oauth2_code');
+        const state = taken?.data;
         if (!state) {
             return {
                 success: false,
@@ -455,8 +476,6 @@ export class OAuth2AuthorizationServer {
                 error_description: 'Invalid authorization code'
             };
         }
-        // Remove code immediately (single use)
-        this.authorizationCodes.delete(codeHash);
         // Validate expiration
         if (state.expiresAt < Date.now()) {
             return {
@@ -547,16 +566,7 @@ export class OAuth2AuthorizationServer {
             token_endpoint: `${this.config.issuer}/auth/token`,
             device_authorization_endpoint: `${this.config.issuer}/auth/device`,
             revocation_endpoint: `${this.config.issuer}/auth/revoke`,
-            scopes_supported: [
-                'openid',
-                'profile',
-                'content:read',
-                'content:write',
-                'content:delete',
-                'media:read',
-                'media:write',
-                'offline_access'
-            ],
+            scopes_supported: [...ALL_OAUTH2_SCOPES],
             response_types_supported: ['code'],
             grant_types_supported: [
                 'authorization_code',

package/dist/core/security/oauth2/authorization-server.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorization-server.js","sourceRoot":"","sources":["../../../../src/core/security/oauth2/authorization-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAA;AAYjE,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,IAAI,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAgD9F;;;;GAIG;AACH,MAAM,OAAO,yBAAyB;IAC5B,MAAM,CAA+C;IACrD,eAAe,CAAsB;IAE7C,8EAA8E;IACtE,WAAW,GAAiC,IAAI,GAAG,EAAE,CAAA;IACrD,kBAAkB,GAAwC,IAAI,GAAG,EAAE,CAAA;IACnE,OAAO,GAA8B,IAAI,GAAG,EAAE,CAAA;IAEtD,mBAAmB;IACX,eAAe,GAA0B,IAAI,CAAA;IAErD,YAAY,MAA0B;QACpC,IAAI,CAAC,MAAM,GAAG;YACZ,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,IAAI;YAC7C,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,OAAO;YAClD,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,GAAG;YAC1C,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,GAAG,MAAM,CAAC,MAAM,qBAAqB;YAChF,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,GAAG;YACtC,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,CAAC;SAC7C,CAAA;QACD,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAA;QAE3C,+BAA+B;QAC/B,IAAI,CAAC,qBAAqB,EAAE,CAAA;QAE5B,wCAAwC;QACxC,IAAI,CAAC,uBAAuB,EAAE,CAAA;QAE9B,yBAAyB;QACzB,IAAI,CAAC,YAAY,EAAE,CAAA;IACrB,CAAC;IAED;;OAEG;IACK,qBAAqB;QAC3B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QACpC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE;YAC9B,GAAG,UAAU;YACb,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;SACf,CAAC,CAAA;IACJ,CAAC;IAED;;OAEG;IACK,uBAAuB;QAC7B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QACpC,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YAChD,MAAM,MAAM,GAAiB;gBAC3B,EAAE,EAAE,YAAY,CAAC,EAAE;gBACnB,IAAI,EAAE,YAAY,CAAC,IAAI;gBACvB,WAAW,EAAE,YAAY,CAAC,WAAW;gBACrC,IAAI,EAAE,YAAY,CAAC,IAAI,IAAI,QAAQ;gBACnC,UAAU,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;gBAClF,YAAY,EAAE,YAAY,CAAC,YAAY;gBACvC,aAAa,EAAE,CAAC,YAAY,CAAC,aAAa,IAAI;oBAC5C,QAAQ,EAAE,SAAS,EAAE,cAAc,EAAE,eAAe;oBACpD,gBAAgB,EAAE,YAAY,EAAE,aAAa,EAAE,gBAAgB;iBAChE,CAAkB;gBACnB,UAAU,EAAE,CAAC,YAAY,CAAC,UAAU,IAAI,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAsB;gBACrG,QAAQ,EAAE,IAAI;gBACd,SAAS,EAAE,GAAG;gBACd,SAAS,EAAE,GAAG;aACf,CAAA;YACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QACrC,CAAC;IACH,CAAC;IAED;;OAEG;IACK,YAAY;QAClB,IAAI,CAAC,eAAe,GAAG,WAAW,CAAC,GAAG,EAAE;YACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;YAEtB,6BAA6B;YAC7B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC5C,IAAI,KAAK,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;oBAC1B,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;gBAC9B,CAAC;YACH,CAAC;YAED,oCAAoC;YACpC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACnD,IAAI,KAAK,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;oBAC1B,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;gBACrC,CAAC;YACH,CAAC;QACH,CAAC,EAAE,KAAK,CAAC,CAAA,CAAC,mBAAmB;IAC/B,CAAC;IAED;;OAEG;IACI,WAAW;QAChB,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;YACnC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAA;QAC7B,CAAC;IACH,CAAC;IAED,+CAA+C;IAC/C,oBAAoB;IACpB,+CAA+C;IAE/C;;OAEG;IACI,SAAS,CAAC,QAAgB;QAC/B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAA;IAC3C,CAAC;IAED;;OAEG;IACI,oBAAoB,CAAC,MAAoB,EAAE,MAAc;QAC9D,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YACzD,OAAO,KAAK,CAAA;QACd,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;QAC1C,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;QAC1D,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;QAEnD,OAAO,eAAe,CAAC,YAAY,EAAE,YAAY,CAAC,CAAA;IACpD,CAAC;IAED;;OAEG;IACK,UAAU,CAAC,MAAc;QAC/B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC1D,CAAC;IAED,+CAA+C;IAC/C,uCAAuC;IACvC,+CAA+C;IAE/C;;OAEG;IACK,gBAAgB;QACtB,mFAAmF;QACnF,MAAM,KAAK,GAAG,iCAAiC,CAAA;QAC/C,IAAI,IAAI,GAAG,EAAE,CAAA;QACb,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;QAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAA;QACxC,CAAC;QACD,sCAAsC;QACtC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;IAC/C,CAAC;IAED;;OAEG;IACK,kBAAkB;QACxB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IAC9C,CAAC;IAED;;;OAGG;IACI,wBAAwB,CAC7B,QAAgB,EAChB,eAAyB;QASzB,kBAAkB;QAClB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;QACvC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,gBAAgB;gBACvB,iBAAiB,EAAE,mBAAmB;aACvC,CAAA;QACH,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,gBAAgB;gBACvB,iBAAiB,EAAE,sBAAsB;aAC1C,CAAA;QACH,CAAC;QAED,uCAAuC;QACvC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,8CAA8C,CAAC,EAAE,CAAC;YAChF,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,qBAAqB;gBAC5B,iBAAiB,EAAE,yDAAyD;aAC7E,CAAA;QACH,CAAC;QAED,6BAA6B;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,MAAM,CAAC,aAAa,CAAC,CAAA;QACzE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,eAAe;gBACtB,iBAAiB,EAAE,0DAA0D;aAC9E,CAAA;QACH,CAAC;QAED,iBAAiB;QACjB,MAAM,UAAU,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAA;QAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAA;QACxC,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;QAElD,0BAA0B;QAC1B,MAAM,KAAK,GAAoB;YAC7B,cAAc;YACd,QAAQ;YACR,QAAQ;YACR,MAAM;YACN,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC;YAC1D,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe;YACrC,MAAM,EAAE,SAAS;SAClB,CAAA;QAED,oDAAoD;QACpD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;QAErC,0BAA0B;QAC1B,oFAAoF;QACpF,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,CAAA;QACnD,MAAM,uBAAuB,GAAG,GAAG,eAAe,SAAS,QAAQ,EAAE,CAAA;QAErE,OAAO;YACL,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE;gBACR,WAAW,EAAE,UAAU;gBACvB,SAAS,EAAE,QAAQ;gBACnB,gBAAgB,EAAE,eAAe;gBACjC,yBAAyB,EAAE,uBAAuB;gBAClD,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa;gBACrC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe;aACtC;SACF,CAAA;IACH,CAAC;IAED;;OAEG;IACI,uBAAuB,CAAC,QAAgB;QAC7C,iDAAiD;QACjD,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;QAC/D,MAAM,aAAa,GAAG,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;QAEhF,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,IAAI,CAAA;IACpD,CAAC;IAED;;OAEG;IACI,mBAAmB,CAAC,QAAgB,EAAE,MAAc;QACzD,MAAM,KAAK,GAAG,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAA;QACpD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAA;QACd,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAA;QACd,CAAC;QAED,IAAI,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACjC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAA;YACxB,OAAO,KAAK,CAAA;QACd,CAAC;QAED,KAAK,CAAC,MAAM,GAAG,YAAY,CAAA;QAC3B,KAAK,CAAC,MAAM,GAAG,MAAM,CAAA;QACrB,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAE5B,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;OAEG;IACI,cAAc,CAAC,QAAgB;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAA;QACpD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAA;QACd,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAA;QACd,CAAC;QAED,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAA;QACvB,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAE5B,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;OAEG;IACI,eAAe,CACpB,UAAkB,EAClB,QAAgB,EAChB,aAAkG;QAKlG,OAAO,IAAI,CAAC,+BAA+B,CAAC,UAAU,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAA;IAClF,CAAC;IAEO,KAAK,CAAC,+BAA+B,CAC3C,UAAkB,EAClB,QAAgB,EAChB,aAAkG;QAKlG,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;QAElD,mEAAmE;QACnE,IAAI,UAAU,GAA2B,IAAI,CAAA;QAC7C,IAAI,QAAQ,GAAkB,IAAI,CAAA;QAElC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YAC5C,IAAI,KAAK,CAAC,cAAc,KAAK,cAAc,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC3E,UAAU,GAAG,KAAK,CAAA;gBAClB,QAAQ,GAAG,GAAG,CAAA;gBACd,MAAK;YACP,CAAC;QACH,CAAC;QAED,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC7B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,eAAe;gBACtB,iBAAiB,EAAE,qBAAqB;aACzC,CAAA;QACH,CAAC;QAED,mBAAmB;QACnB,IAAI,UAAU,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACtC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;YACjC,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,eAAe;gBACtB,iBAAiB,EAAE,yBAAyB;aAC7C,CAAA;QACH,CAAC;QAED,eAAe;QACf,QAAQ,UAAU,CAAC,MAAM,EAAE,CAAC;YAC1B,KAAK,SAAS;gBACZ,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,uBAAuB;oBAC9B,iBAAiB,EAAE,4CAA4C;iBAChE,CAAA;YAEH,KAAK,QAAQ;gBACX,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;gBACjC,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,eAAe;oBACtB,iBAAiB,EAAE,2CAA2C;iBAC/D,CAAA;YAEH,KAAK,SAAS;gBACZ,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;gBACjC,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,eAAe;oBACtB,iBAAiB,EAAE,yBAAyB;iBAC7C,CAAA;YAEH,KAAK,YAAY;gBACf,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;oBACvB,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE,cAAc;wBACrB,iBAAiB,EAAE,0CAA0C;qBAC9D,CAAA;gBACH,CAAC;gBAED,kBAAkB;gBAClB,MAAM,aAAa,GAAG,MAAM,aAAa,CACvC,UAAU,CAAC,MAAM,EACjB,UAAU,CAAC,MAAM,EACjB,UAAU,CAAC,QAAQ,CACpB,CAAA;gBAED,0BAA0B;gBAC1B,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;gBAEjC,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,QAAQ,EAAE,aAAa;iBACxB,CAAA;YAEH;gBACE,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,cAAc;oBACrB,iBAAiB,EAAE,4BAA4B;iBAChD,CAAA;QACL,CAAC;IACH,CAAC;IAED,+CAA+C;IAC/C,oCAAoC;IACpC,+CAA+C;IAE/C;;OAEG;IACI,4BAA4B,CAAC,MAQnC;QACC,yBAAyB;QACzB,IAAI,MAAM,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;YACpC,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,iBAAiB;gBACxB,iBAAiB,EAAE,8BAA8B;aAClD,CAAA;QACH,CAAC;QAED,kBAAkB;QAClB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAC/C,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YAChC,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,gBAAgB;gBACvB,iBAAiB,EAAE,4BAA4B;aAChD,CAAA;QACH,CAAC;QAED,mDAAmD;QACnD,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;YACtD,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,qBAAqB;gBAC5B,iBAAiB,EAAE,uDAAuD;aAC3E,CAAA;QACH,CAAC;QAED,wBAAwB;QACxB,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;YACvD,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,iBAAiB;gBACxB,iBAAiB,EAAE,sBAAsB;aAC1C,CAAA;QACH,CAAC;QAED,gBAAgB;QAChB,IAAI,MAAM,CAAC,qBAAqB,KAAK,MAAM,EAAE,CAAC;YAC5C,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,iBAAiB;gBACxB,iBAAiB,EAAE,sCAAsC;aAC1D,CAAA;QACH,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAChE,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,iBAAiB;gBACxB,iBAAiB,EAAE,wBAAwB;aAC5C,CAAA;QACH,CAAC;QAED,iBAAiB;QACjB,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7C,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,iBAAiB;gBACxB,iBAAiB,EAAE,+DAA+D;aACnF,CAAA;QACH,CAAC;QAED,6BAA6B;QAC7B,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QACnE,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,MAAM,CAAC,aAAa,CAAC,CAAA;QAEzE,OAAO;YACL,KAAK,EAAE,IAAI;YACX,MAAM;YACN,MAAM;SACP,CAAA;IACH,CAAC;IAED;;OAEG;IACI,yBAAyB,CAC9B,QAAgB,EAChB,WAAmB,EACnB,MAAqB,EACrB,aAAqB,EACrB,MAAc;QAEd,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;QAEtC,MAAM,KAAK,GAA2B;YACpC,QAAQ;YACR,QAAQ;YACR,WAAW;YACX,MAAM;YACN,aAAa;YACb,MAAM;YACN,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC;SACzD,CAAA;QAED,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;QAE5C,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,yBAAyB,CACpC,IAAY,EACZ,QAAgB,EAChB,WAAmB,EACnB,YAAoB,EACpB,aAAkG;QAKlG,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAEnD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,eAAe;gBACtB,iBAAiB,EAAE,4BAA4B;aAChD,CAAA;QACH,CAAC;QAED,uCAAuC;QACvC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;QAExC,sBAAsB;QACtB,IAAI,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACjC,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,eAAe;gBACtB,iBAAiB,EAAE,gCAAgC;aACpD,CAAA;QACH,CAAC;QAED,qBAAqB;QACrB,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAChC,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,eAAe;gBACtB,iBAAiB,EAAE,0BAA0B;aAC9C,CAAA;QACH,CAAC;QAED,wBAAwB;QACxB,IAAI,KAAK,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;YACtC,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,eAAe;gBACtB,iBAAiB,EAAE,6BAA6B;aACjD,CAAA;QACH,CAAC;QAED,4BAA4B;QAC5B,MAAM,aAAa,GAAG,UAAU,CAAC,QAAQ,CAAC;aACvC,MAAM,CAAC,YAAY,CAAC;aACpB,MAAM,CAAC,WAAW,CAAC,CAAA;QAEtB,IAAI,aAAa,KAAK,KAAK,CAAC,aAAa,EAAE,CAAC;YAC1C,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,eAAe;gBACtB,iBAAiB,EAAE,uBAAuB;aAC3C,CAAA;QACH,CAAC;QAED,kBAAkB;QAClB,MAAM,aAAa,GAAG,MAAM,aAAa,CACvC,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,QAAQ,CACf,CAAA;QAED,OAAO;YACL,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,aAAa;SACxB,CAAA;IACH,CAAC;IAED,+CAA+C;IAC/C,kBAAkB;IAClB,+CAA+C;IAE/C;;OAEG;IACK,cAAc,CAAC,SAAmB,EAAE,OAAsB;QAChE,MAAM,WAAW,GAAkB,EAAE,CAAA;QAErC,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;YAC9B,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAoB,CAAC,EAAE,CAAC;gBAC3C,WAAW,CAAC,IAAI,CAAC,KAAoB,CAAC,CAAA;YACxC,CAAC;QACH,CAAC;QAED,gDAAgD;QAChD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvD,2CAA2C;YAC3C,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAAE,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC1D,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAAE,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAC9D,CAAC;QAED,OAAO,WAAW,CAAA;IACpB,CAAC;IAED;;OAEG;IACI,mBAAmB,CAAC,MAAqB;QAC9C,MAAM,WAAW,GAAG,IAAI,GAAG,EAAc,CAAA;QAEzC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAA;YACpD,IAAI,gBAAgB,EAAE,CAAC;gBACrB,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;oBACpC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;gBACvB,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IAChC,CAAC;IAED;;OAEG;IACI,iBAAiB;QACtB,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;YAC1B,sBAAsB,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,iBAAiB;YAC9D,cAAc,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,aAAa;YAClD,6BAA6B,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,cAAc;YAClE,mBAAmB,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,cAAc;YACxD,gBAAgB,EAAE;gBAChB,QAAQ;gBACR,SAAS;gBACT,cAAc;gBACd,eAAe;gBACf,gBAAgB;gBAChB,YAAY;gBACZ,aAAa;gBACb,gBAAgB;aACjB;YACD,wBAAwB,EAAE,CAAC,MAAM,CAAC;YAClC,qBAAqB,EAAE;gBACrB,oBAAoB;gBACpB,8CAA8C;gBAC9C,eAAe;aAChB;YACD,gCAAgC,EAAE,CAAC,MAAM,CAAC;YAC1C,qCAAqC,EAAE,CAAC,MAAM,EAAE,oBAAoB,CAAC;SACtE,CAAA;IACH,CAAC;CACF"}
+{"version":3,"file":"authorization-server.js","sourceRoot":"","sources":["../../../../src/core/security/oauth2/authorization-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAA;AAYjE,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAEhG,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACrB,MAAM,uBAAuB,CAAA;AAgB9B,MAAM,kBAAkB,GAAoB;IAC1C,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC;IAC7C,GAAG,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC;IACnD,OAAO,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC;CAC5D,CAAA;AAID,yFAAyF;AACzF,0FAA0F;AAC1F,UAAU;AACV,MAAM,QAAQ,GAAG,CAAC,cAAsB,EAAU,EAAE,CAAC,OAAO,cAAc,EAAE,CAAA;AAC5E,MAAM,UAAU,GAAG,CAAC,QAAgB,EAAU,EAAE,CAAC,OAAO,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAA;AACrF,MAAM,UAAU,GAAG,CAAC,QAAgB,EAAU,EAAE,CAAC,QAAQ,QAAQ,EAAE,CAAA;AAEnE,SAAS,iBAAiB,CAAC,QAAgB;IACzC,OAAO,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAA;AAC3E,CAAC;AAwDD;;;;GAIG;AACH,MAAM,OAAO,yBAAyB;IAC5B,MAAM,CAA6D;IACnE,eAAe,CAAsB;IACrC,KAAK,CAAiB;IACtB,OAAO,GAA8B,IAAI,GAAG,EAAE,CAAA;IAEtD,YAAY,MAA0B;QACpC,IAAI,CAAC,MAAM,GAAG;YACZ,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,IAAI;YAC7C,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,OAAO;YAClD,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,GAAG;YAC1C,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,GAAG,MAAM,CAAC,MAAM,qBAAqB;YAChF,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,GAAG;YACtC,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,CAAC;SAC7C,CAAA;QACD,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAA;QAC3C,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,SAAS,IAAI,kBAAkB,CAAA;QAEnD,+BAA+B;QAC/B,IAAI,CAAC,qBAAqB,EAAE,CAAA;QAE5B,wCAAwC;QACxC,IAAI,CAAC,uBAAuB,EAAE,CAAA;IAChC,CAAC;IAED;;OAEG;IACK,qBAAqB;QAC3B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QACpC,KAAK,MAAM,MAAM,IAAI,eAAe,EAAE,CAAC;YACrC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAA;QAC5E,CAAC;IACH,CAAC;IAED;;OAEG;IACK,uBAAuB;QAC7B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QACpC,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YAChD,MAAM,MAAM,GAAiB;gBAC3B,EAAE,EAAE,YAAY,CAAC,EAAE;gBACnB,IAAI,EAAE,YAAY,CAAC,IAAI;gBACvB,WAAW,EAAE,YAAY,CAAC,WAAW;gBACrC,IAAI,EAAE,YAAY,CAAC,IAAI,IAAI,QAAQ;gBACnC,UAAU,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;gBAClF,YAAY,EAAE,YAAY,CAAC,YAAY;gBACvC,aAAa,EAAE,CAAC,YAAY,CAAC,aAAa,IAAI,CAAC,GAAG,iBAAiB,CAAC,CAAkB;gBACtF,UAAU,EAAE,CAAC,YAAY,CAAC,UAAU,IAAI,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAsB;gBACrG,uFAAuF;gBACvF,0FAA0F;gBAC1F,OAAO,EAAE,YAAY,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,YAAY,CAAC,EAAE,CAAC;gBAC1G,QAAQ,EAAE,IAAI;gBACd,SAAS,EAAE,GAAG;gBACd,SAAS,EAAE,GAAG;aACf,CAAA;YACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QACrC,CAAC;IACH,CAAC;IAED;;OAEG;IACH;;;OAGG;IACI,WAAW,KAAU,CAAC;IAE7B,+CAA+C;IAC/C,oBAAoB;IACpB,+CAA+C;IAE/C;;OAEG;IACI,SAAS,CAAC,QAAgB;QAC/B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAA;IAC3C,CAAC;IAED;;OAEG;IACI,oBAAoB,CAAC,MAAoB,EAAE,MAAc;QAC9D,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YACzD,OAAO,KAAK,CAAA;QACd,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;QAC1C,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;QAC1D,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;QAEnD,OAAO,eAAe,CAAC,YAAY,EAAE,YAAY,CAAC,CAAA;IACpD,CAAC;IAED;;OAEG;IACK,UAAU,CAAC,MAAc;QAC/B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC1D,CAAC;IAED,+CAA+C;IAC/C,uCAAuC;IACvC,+CAA+C;IAE/C;;OAEG;IACK,gBAAgB;QACtB,mFAAmF;QACnF,MAAM,KAAK,GAAG,iCAAiC,CAAA;QAC/C,IAAI,IAAI,GAAG,EAAE,CAAA;QACb,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;QAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAA;QACxC,CAAC;QACD,sCAAsC;QACtC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;IAC/C,CAAC;IAED;;OAEG;IACK,kBAAkB;QACxB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IAC9C,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,wBAAwB,CACnC,QAAgB,EAChB,eAAyB;QASzB,kBAAkB;QAClB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;QACvC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,gBAAgB;gBACvB,iBAAiB,EAAE,mBAAmB;aACvC,CAAA;QACH,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,gBAAgB;gBACvB,iBAAiB,EAAE,sBAAsB;aAC1C,CAAA;QACH,CAAC;QAED,uCAAuC;QACvC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,8CAA8C,CAAC,EAAE,CAAC;YAChF,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,qBAAqB;gBAC5B,iBAAiB,EAAE,yDAAyD;aAC7E,CAAA;QACH,CAAC;QAED,6BAA6B;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,MAAM,CAAC,aAAa,CAAC,CAAA;QACzE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,eAAe;gBACtB,iBAAiB,EAAE,0DAA0D;aAC9E,CAAA;QACH,CAAC;QAED,iBAAiB;QACjB,MAAM,UAAU,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAA;QAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAA;QACxC,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;QAClD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAA;QAEvF,MAAM,MAAM,GAAiB;YAC3B,cAAc;YACd,QAAQ;YACR,QAAQ;YACR,MAAM;YACN,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe;YACrC,MAAM,EAAE,SAAS;SAClB,CAAA;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAA;QAC9G,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,EAAE,SAAS,EAAE,CAAC,CAAA;QAE/G,0BAA0B;QAC1B,oFAAoF;QACpF,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,CAAA;QACnD,MAAM,uBAAuB,GAAG,GAAG,eAAe,SAAS,QAAQ,EAAE,CAAA;QAErE,OAAO;YACL,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE;gBACR,WAAW,EAAE,UAAU;gBACvB,SAAS,EAAE,QAAQ;gBACnB,gBAAgB,EAAE,eAAe;gBACjC,yBAAyB,EAAE,uBAAuB;gBAClD,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa;gBACrC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe;aACtC;SACF,CAAA;IACH,CAAC;IAED,sEAAsE;IAC9D,KAAK,CAAC,cAAc,CAAC,QAAgB;QAC3C,IAAI,iBAAiB,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QACzD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,eAAe,CAAC,CAAA;QACzE,MAAM,cAAc,GAAG,KAAK,EAAE,IAAI,CAAC,cAAc,CAAA;QACjD,IAAI,OAAO,cAAc,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAA;QACnD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,eAAe,CAAC,CAAA;QAC9E,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QACxB,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,IAA+B,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAA;IACxF,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,uBAAuB,CAAC,QAAgB;QACnD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAA;QACjD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QACvB,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,CAAA;IAC5E,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,mBAAmB,CAAC,QAAgB,EAAE,MAAc,EAAE,cAAyB;QAC1F,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE;YACpC,MAAM,MAAM,GAAG,cAAc;gBAC3B,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAC/D,CAAC,CAAC,MAAM,CAAC,MAAM,CAAA;YACjB,+DAA+D;YAC/D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAA;YACpC,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAA;QACnF,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,cAAc,CAAC,QAAgB;QAC1C,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAA;IAClG,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,MAAM,CAAC,QAAgB,EAAE,KAAoD;QACzF,IAAI,iBAAiB,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAA;QAC1D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,eAAe,CAAC,CAAA;QAC7E,MAAM,cAAc,GAAG,KAAK,EAAE,IAAI,CAAC,cAAc,CAAA;QACjD,IAAI,OAAO,cAAc,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAA;QAEpD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,eAAe,CAAC,CAAA;QAC9E,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAA;QAEzB,IAAI,OAAO,GAAG,KAAK,CAAA;QACnB,MAAM,MAAM,GAAG,MAAM,CAAC,IAA+B,CAAA;QACrD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAA;YAC1B,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAA;gBAC9H,OAAO,GAAG,IAAI,CAAA;YAChB,CAAC;QACH,CAAC;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAA;QACjI,OAAO,OAAO,CAAA;IAChB,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,eAAe,CAC1B,UAAkB,EAClB,QAAgB,EAChB,aAAkG;QAKlG,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAA;QAChD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,eAAe,CAAC,CAAA;QAExD,wFAAwF;QACxF,qFAAqF;QACrF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,uCAAuC,EAAE,CAAA;QAC/G,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,IAA+B,CAAA;QACrD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,CAAA;QAC7F,CAAC;QAED,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC;YACtB,KAAK,SAAS;gBACZ,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,uBAAuB;oBAC9B,iBAAiB,EAAE,4CAA4C;iBAChE,CAAA;YAEH,KAAK,QAAQ;gBACX,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,eAAe,CAAC,CAAA;gBAC7C,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,eAAe;oBACtB,iBAAiB,EAAE,2CAA2C;iBAC/D,CAAA;YAEH,KAAK,YAAY,CAAC,CAAC,CAAC;gBAClB,mFAAmF;gBACnF,8DAA8D;gBAC9D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,eAAe,CAAC,CAAA;gBAC3D,MAAM,QAAQ,GAAG,KAAK,EAAE,IAA2C,CAAA;gBACnE,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,YAAY,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;oBACtE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,8BAA8B,EAAE,CAAA;gBACtG,CAAC;gBACD,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,QAAQ,EAAE,MAAM,aAAa,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC;iBACnF,CAAA;YACH,CAAC;YAED;gBACE,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,eAAe,CAAC,CAAA;gBAC7C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,CAAA;QACnG,CAAC;IACH,CAAC;IAED,+CAA+C;IAC/C,oCAAoC;IACpC,+CAA+C;IAE/C;;OAEG;IACI,4BAA4B,CAAC,MAQnC;QACC,yBAAyB;QACzB,IAAI,MAAM,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;YACpC,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,iBAAiB;gBACxB,iBAAiB,EAAE,8BAA8B;aAClD,CAAA;QACH,CAAC;QAED,kBAAkB;QAClB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAC/C,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YAChC,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,gBAAgB;gBACvB,iBAAiB,EAAE,4BAA4B;aAChD,CAAA;QACH,CAAC;QAED,mDAAmD;QACnD,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;YACtD,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,qBAAqB;gBAC5B,iBAAiB,EAAE,uDAAuD;aAC3E,CAAA;QACH,CAAC;QAED,wBAAwB;QACxB,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;YACvD,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,iBAAiB;gBACxB,iBAAiB,EAAE,sBAAsB;aAC1C,CAAA;QACH,CAAC;QAED,gBAAgB;QAChB,IAAI,MAAM,CAAC,qBAAqB,KAAK,MAAM,EAAE,CAAC;YAC5C,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,iBAAiB;gBACxB,iBAAiB,EAAE,sCAAsC;aAC1D,CAAA;QACH,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAChE,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,iBAAiB;gBACxB,iBAAiB,EAAE,wBAAwB;aAC5C,CAAA;QACH,CAAC;QAED,iBAAiB;QACjB,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7C,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,iBAAiB;gBACxB,iBAAiB,EAAE,+DAA+D;aACnF,CAAA;QACH,CAAC;QAED,6BAA6B;QAC7B,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QACnE,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,MAAM,CAAC,aAAa,CAAC,CAAA;QAEzE,OAAO;YACL,KAAK,EAAE,IAAI;YACX,MAAM;YACN,MAAM;SACP,CAAA;IACH,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,yBAAyB,CACpC,QAAgB,EAChB,WAAmB,EACnB,MAAqB,EACrB,aAAqB,EACrB,MAAc;QAEd,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;QAEtC,MAAM,KAAK,GAA2B;YACpC,QAAQ;YACR,QAAQ;YACR,WAAW;YACX,MAAM;YACN,aAAa;YACb,MAAM;YACN,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC;SACzD,CAAA;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;YACpB,EAAE,EAAE,UAAU,CAAC,QAAQ,CAAC;YACxB,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,EAAE,GAAG,KAAK,EAAE;YAClB,SAAS,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;SACnD,CAAC,CAAA;QAEF,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;;;;;;OAOG;IACI,gBAAgB,CAAC,MAOvB;QACC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAC/C,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;YACrF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,4BAA4B,EAAE,CAAA;QAC1E,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;YACvD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,CAAA;QACpE,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;QACpC,CAAC;QACD,IAAI,OAAO,MAAM,CAAC,cAAc,KAAK,QAAQ,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YACnF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,CAAA;QACtE,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,EAAE,CAAC;YAC9F,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,CAAA;QACrE,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,MAAkB,EAAE,MAAM,CAAC,aAAa,CAAC,CAAA;QACnF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YAClE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,kEAAkE,EAAE,CAAA;QAChH,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;IAChC,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,yBAAyB,CACpC,IAAY,EACZ,QAAgB,EAChB,WAAmB,EACnB,YAAoB,EACpB,aAAkG;QAKlG,qEAAqE;QACrE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,aAAa,CAAC,CAAA;QACxF,MAAM,KAAK,GAAG,KAAK,EAAE,IAAqD,CAAA;QAE1E,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,eAAe;gBACtB,iBAAiB,EAAE,4BAA4B;aAChD,CAAA;QACH,CAAC;QAED,sBAAsB;QACtB,IAAI,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACjC,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,eAAe;gBACtB,iBAAiB,EAAE,gCAAgC;aACpD,CAAA;QACH,CAAC;QAED,qBAAqB;QACrB,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAChC,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,eAAe;gBACtB,iBAAiB,EAAE,0BAA0B;aAC9C,CAAA;QACH,CAAC;QAED,wBAAwB;QACxB,IAAI,KAAK,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;YACtC,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,eAAe;gBACtB,iBAAiB,EAAE,6BAA6B;aACjD,CAAA;QACH,CAAC;QAED,4BAA4B;QAC5B,MAAM,aAAa,GAAG,UAAU,CAAC,QAAQ,CAAC;aACvC,MAAM,CAAC,YAAY,CAAC;aACpB,MAAM,CAAC,WAAW,CAAC,CAAA;QAEtB,IAAI,aAAa,KAAK,KAAK,CAAC,aAAa,EAAE,CAAC;YAC1C,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,eAAe;gBACtB,iBAAiB,EAAE,uBAAuB;aAC3C,CAAA;QACH,CAAC;QAED,kBAAkB;QAClB,MAAM,aAAa,GAAG,MAAM,aAAa,CACvC,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,QAAQ,CACf,CAAA;QAED,OAAO;YACL,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,aAAa;SACxB,CAAA;IACH,CAAC;IAED,+CAA+C;IAC/C,kBAAkB;IAClB,+CAA+C;IAE/C;;OAEG;IACK,cAAc,CAAC,SAAmB,EAAE,OAAsB;QAChE,MAAM,WAAW,GAAkB,EAAE,CAAA;QAErC,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;YAC9B,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAoB,CAAC,EAAE,CAAC;gBAC3C,WAAW,CAAC,IAAI,CAAC,KAAoB,CAAC,CAAA;YACxC,CAAC;QACH,CAAC;QAED,gDAAgD;QAChD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvD,2CAA2C;YAC3C,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAAE,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC1D,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAAE,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAC9D,CAAC;QAED,OAAO,WAAW,CAAA;IACpB,CAAC;IAED;;OAEG;IACI,mBAAmB,CAAC,MAAqB;QAC9C,MAAM,WAAW,GAAG,IAAI,GAAG,EAAc,CAAA;QAEzC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAA;YACpD,IAAI,gBAAgB,EAAE,CAAC;gBACrB,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;oBACpC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;gBACvB,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IAChC,CAAC;IAED;;OAEG;IACI,iBAAiB;QACtB,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;YAC1B,sBAAsB,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,iBAAiB;YAC9D,cAAc,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,aAAa;YAClD,6BAA6B,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,cAAc;YAClE,mBAAmB,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,cAAc;YACxD,gBAAgB,EAAE,CAAC,GAAG,iBAAiB,CAAC;YACxC,wBAAwB,EAAE,CAAC,MAAM,CAAC;YAClC,qBAAqB,EAAE;gBACrB,oBAAoB;gBACpB,8CAA8C;gBAC9C,eAAe;aAChB;YACD,gCAAgC,EAAE,CAAC,MAAM,CAAC;YAC1C,qCAAqC,EAAE,CAAC,MAAM,EAAE,oBAAoB,CAAC;SACtE,CAAA;IACH,CAAC;CACF"}

package/dist/core/security/oauth2/scoped-permissions.d.ts

@@ -0,0 +1,15 @@
+/**
+ * What an OAuth2 access token may do: the lesser of what its scopes allow and what the user
+ * who granted it may do.
+ *
+ * Neither side alone is enough. The scopes are what the user agreed to hand the client, so a
+ * token must never exceed them, even for an admin. The user's permissions are the ceiling, so
+ * a scope must never lend a user something they could not do themselves.
+ */
+import type { Permission, UserRole } from '../../../types/auth.js';
+export declare function scopesToPermissionSet(scopes: string[]): Permission[];
+export declare function scopedPermissions(user: {
+    role: UserRole;
+    permissions?: Permission[];
+}, scopes: string[]): Permission[];
+//# sourceMappingURL=scoped-permissions.d.ts.map

package/dist/core/security/oauth2/scoped-permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scoped-permissions.d.ts","sourceRoot":"","sources":["../../../../src/core/security/oauth2/scoped-permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAA;AAKlE,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,EAAE,CAQpE;AAED,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,WAAW,CAAC,EAAE,UAAU,EAAE,CAAA;CAAE,EACpD,MAAM,EAAE,MAAM,EAAE,GACf,UAAU,EAAE,CA+Bd"}

package/dist/core/security/oauth2/scoped-permissions.js

@@ -0,0 +1,53 @@
+/**
+ * What an OAuth2 access token may do: the lesser of what its scopes allow and what the user
+ * who granted it may do.
+ *
+ * Neither side alone is enough. The scopes are what the user agreed to hand the client, so a
+ * token must never exceed them, even for an admin. The user's permissions are the ceiling, so
+ * a scope must never lend a user something they could not do themselves.
+ */
+import { ROLE_PERMISSIONS } from '../../types/user.js';
+import { SCOPE_TO_PERMISSIONS } from '../../../types/oauth2.js';
+/** Resources that are not content collections, so `<name>:<action>` is not a schema permission */
+const NON_CONTENT_RESOURCES = new Set(['content', 'media', 'users', 'settings', 'studio', 'tokens', 'webhooks']);
+export function scopesToPermissionSet(scopes) {
+    const permissions = new Set();
+    for (const scope of scopes) {
+        for (const permission of SCOPE_TO_PERMISSIONS[scope] ?? []) {
+            permissions.add(permission);
+        }
+    }
+    return [...permissions];
+}
+export function scopedPermissions(user, scopes) {
+    const granted = scopesToPermissionSet(scopes);
+    if (user.role === 'admin') {
+        return granted;
+    }
+    // Stored permissions are a snapshot from creation; the role's current defaults count too,
+    // as they do everywhere else a user's permissions are judged
+    const held = new Set([...(user.permissions ?? []), ...(ROLE_PERMISSIONS[user.role] ?? [])]);
+    const holds = (permission) => held.has(permission) || held.has(`${permission.split(':')[0]}:*`);
+    const result = new Set();
+    for (const permission of granted) {
+        if (holds(permission)) {
+            result.add(permission);
+            continue;
+        }
+        // A user limited to some collections (`posts:write`) keeps exactly those under a
+        // site-wide content scope (`content:write`)
+        const [resource, action] = permission.split(':');
+        if (resource !== 'content')
+            continue;
+        for (const own of held) {
+            const [ownResource, ownAction] = own.split(':');
+            if (!ownResource || NON_CONTENT_RESOURCES.has(ownResource))
+                continue;
+            if (ownAction === action || ownAction === '*') {
+                result.add(`${ownResource}:${action}`);
+            }
+        }
+    }
+    return [...result];
+}
+//# sourceMappingURL=scoped-permissions.js.map

package/dist/core/security/oauth2/scoped-permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scoped-permissions.js","sourceRoot":"","sources":["../../../../src/core/security/oauth2/scoped-permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AAI/D,kGAAkG;AAClG,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAA;AAEhH,MAAM,UAAU,qBAAqB,CAAC,MAAgB;IACpD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAc,CAAA;IACzC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,KAAK,MAAM,UAAU,IAAI,oBAAoB,CAAC,KAAoB,CAAC,IAAI,EAAE,EAAE,CAAC;YAC1E,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QAC7B,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,WAAW,CAAC,CAAA;AACzB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,IAAoD,EACpD,MAAgB;IAEhB,MAAM,OAAO,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAA;IAC7C,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,0FAA0F;IAC1F,6DAA6D;IAC7D,MAAM,IAAI,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;IACnG,MAAM,KAAK,GAAG,CAAC,UAAkB,EAAW,EAAE,CAC5C,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;IAEnE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAc,CAAA;IACpC,KAAK,MAAM,UAAU,IAAI,OAAO,EAAE,CAAC;QACjC,IAAI,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;YACtB,SAAQ;QACV,CAAC;QACD,iFAAiF;QACjF,4CAA4C;QAC5C,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAChD,IAAI,QAAQ,KAAK,SAAS;YAAE,SAAQ;QACpC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC/C,IAAI,CAAC,WAAW,IAAI,qBAAqB,CAAC,GAAG,CAAC,WAAW,CAAC;gBAAE,SAAQ;YACpE,IAAI,SAAS,KAAK,MAAM,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;gBAC9C,MAAM,CAAC,GAAG,CAAC,GAAG,WAAW,IAAI,MAAM,EAAgB,CAAC,CAAA;YACtD,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,CAAA;AACpB,CAAC"}

package/dist/core/services/auth-service.d.ts

@@ -12,6 +12,8 @@ export interface AuthServiceDependencies {
     getUser: (id: string) => Promise<User | null>;
     getUserByUsername: (username: string) => Promise<User | null>;
     updateUser: (id: string, userData: UpdateUserData) => Promise<User>;
+    /** Whether the grant an OAuth2 token was issued under still stands (not revoked, not lapsed) */
+    isOAuth2GrantLive?: (user: User, grantId: string) => Promise<boolean>;
     /** Conditional update, present only when the data adapter supports saveUserIf */
     updateUserIf?: (id: string, userData: Partial<UpdateUserData>, condition: {
         passwordHash: string;
@@ -21,6 +23,8 @@ export interface AuthServiceDependencies {
         appToken?: AppToken;
         error?: string;
     }>;
+    /** Whether an OAuth2 client is configured as trusted (first-party) */
+    isTrustedOAuth2Client?: (clientId: string) => boolean;
     logAuditEvent: (event: AuditEvent) => void;
     checkMFARequired: (userId: string) => Promise<MFARequirement>;
     isDeviceTrusted: (userId: string, deviceId: string) => Promise<boolean>;

package/dist/core/services/auth-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-service.d.ts","sourceRoot":"","sources":["../../../src/core/services/auth-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AAC3D,OAAO,KAAK,EACV,QAAQ,EACR,oBAAoB,EACpB,2BAA2B,EAC3B,aAAa,EACb,YAAY,EACZ,aAAa,EACb,cAAc,EACd,IAAI,EACJ,WAAW,EACZ,MAAM,mBAAmB,CAAA;AAE1B,MAAM,WAAW,uBAAuB;IACtC,aAAa,EAAE,aAAa,CAAA;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,YAAY,CAAA;IACpB,MAAM,EAAE,YAAY,CAAA;IACpB,OAAO,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAA;IAC7C,iBAAiB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAA;IAC7D,UAAU,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnE,iFAAiF;IACjF,YAAY,CAAC,EAAE,CACb,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,OAAO,CAAC,cAAc,CAAC,EACjC,SAAS,EAAE;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,KAChC,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAA;IACzB,gBAAgB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACrG,aAAa,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAA;IAC1C,gBAAgB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAA;IAC7D,eAAe,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IACvE,WAAW,EAAE,CACX,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,KACjD,OAAO,CAAC,aAAa,CAAC,CAAA;IAC3B,cAAc,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,KAAK,WAAW,CAAA;CACjD;AAED;;;GAGG;AACH,qBAAa,WAAW;IACV,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,uBAAuB;IAG7C,cAAc,CAAC,aAAa,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAI5F;;;OAGG;IACU,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIrD,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;IAgDnE,iBAAiB,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,GAAE,MAAc,EAAE,UAAU,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAY/F,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IA2CxE;;;OAGG;IACU,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAyBvE;;OAEG;IACU,gBAAgB,CAC3B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAO,GACxD,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAkKvC;;OAEG;IACU,eAAe,CAC1B,IAAI,EAAE,IAAI,EACV,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACrC,OAAO,CAAC,2BAA2B,CAAC;IA0CvC;;OAEG;IACU,uBAAuB,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAU3F;;OAEG;IACU,qBAAqB,CAAC,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAUhG;;;OAGG;IACU,yBAAyB,CACpC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAO,GACpG,OAAO,CAAC,2BAA2B,GAAG,IAAI,CAAC;IAsC9C;;OAEG;IACU,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;QAC5D,MAAM,EAAE,MAAM,CAAA;QACd,QAAQ,EAAE,MAAM,CAAA;QAChB,cAAc,EAAE,aAAa,EAAE,CAAA;KAChC,GAAG,IAAI,CAAC;IAuBT;;OAEG;IACU,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAClD,IAAI,EAAE,aAAa,GAAG,WAAW,CAAA;QACjC,MAAM,EAAE,MAAM,CAAA;QACd,QAAQ,EAAE,MAAM,CAAA;QAChB,UAAU,CAAC,EAAE,aAAa,EAAE,CAAA;QAC5B,cAAc,CAAC,EAAE,aAAa,EAAE,CAAA;KACjC,GAAG,IAAI,CAAC;IA+BT;;;OAGG;IACU,wBAAwB,CACnC,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACrC,OAAO,CAAC,2BAA2B,GAAG,IAAI,CAAC;IA0C9C;;;OAGG;IACU,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QACnE,KAAK,EAAE,OAAO,CAAA;QACd,cAAc,EAAE,MAAM,EAAE,CAAA;KACzB,CAAC;IA2BW,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CA6C5I"}
+{"version":3,"file":"auth-service.d.ts","sourceRoot":"","sources":["../../../src/core/services/auth-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAEzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AAC3D,OAAO,KAAK,EACV,QAAQ,EACR,oBAAoB,EACpB,2BAA2B,EAC3B,aAAa,EACb,YAAY,EACZ,aAAa,EACb,cAAc,EACd,IAAI,EACJ,WAAW,EACZ,MAAM,mBAAmB,CAAA;AAE1B,MAAM,WAAW,uBAAuB;IACtC,aAAa,EAAE,aAAa,CAAA;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,YAAY,CAAA;IACpB,MAAM,EAAE,YAAY,CAAA;IACpB,OAAO,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAA;IAC7C,iBAAiB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAA;IAC7D,UAAU,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnE,gGAAgG;IAChG,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IACrE,iFAAiF;IACjF,YAAY,CAAC,EAAE,CACb,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,OAAO,CAAC,cAAc,CAAC,EACjC,SAAS,EAAE;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,KAChC,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAA;IACzB,gBAAgB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACrG,sEAAsE;IACtE,qBAAqB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAA;IACrD,aAAa,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAA;IAC1C,gBAAgB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAA;IAC7D,eAAe,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IACvE,WAAW,EAAE,CACX,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,KACjD,OAAO,CAAC,aAAa,CAAC,CAAA;IAC3B,cAAc,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,KAAK,WAAW,CAAA;CACjD;AAED;;;GAGG;AACH,qBAAa,WAAW;IACV,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,uBAAuB;IAG7C,cAAc,CAAC,aAAa,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAI5F;;;OAGG;IACU,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIrD,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;IAgDnE,iBAAiB,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,GAAE,MAAc,EAAE,UAAU,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAY/F,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAqGxE;;;OAGG;IACU,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IA4BvE;;OAEG;IACU,gBAAgB,CAC3B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAO,GACxD,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAkKvC;;OAEG;IACU,eAAe,CAC1B,IAAI,EAAE,IAAI,EACV,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACrC,OAAO,CAAC,2BAA2B,CAAC;IA0CvC;;OAEG;IACU,uBAAuB,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAU3F;;OAEG;IACU,qBAAqB,CAAC,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAUhG;;;OAGG;IACU,yBAAyB,CACpC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAO,GACpG,OAAO,CAAC,2BAA2B,GAAG,IAAI,CAAC;IAsC9C;;OAEG;IACU,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;QAC5D,MAAM,EAAE,MAAM,CAAA;QACd,QAAQ,EAAE,MAAM,CAAA;QAChB,cAAc,EAAE,aAAa,EAAE,CAAA;KAChC,GAAG,IAAI,CAAC;IAuBT;;OAEG;IACU,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAClD,IAAI,EAAE,aAAa,GAAG,WAAW,CAAA;QACjC,MAAM,EAAE,MAAM,CAAA;QACd,QAAQ,EAAE,MAAM,CAAA;QAChB,UAAU,CAAC,EAAE,aAAa,EAAE,CAAA;QAC5B,cAAc,CAAC,EAAE,aAAa,EAAE,CAAA;KACjC,GAAG,IAAI,CAAC;IA+BT;;;OAGG;IACU,wBAAwB,CACnC,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACrC,OAAO,CAAC,2BAA2B,GAAG,IAAI,CAAC;IA0C9C;;;OAGG;IACU,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QACnE,KAAK,EAAE,OAAO,CAAA;QACd,cAAc,EAAE,MAAM,EAAE,CAAA;KACzB,CAAC;IA2BW,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CA+C5I"}