@webda/core 4.0.0-beta.3 → 4.0.0-beta.5

package/lib/services/iauthentication.d.ts

@@ -1,9 +1,202 @@
-import { Context } from "../contexts/icontext.js";
-import { Service } from "./service.js";
+import type { EventWithContext } from "../events/events.js";
+import type { Ident } from "../models/ident.model.js";
+import type { User } from "../models/user.model.js";
+import type { Service } from "./service.js";
+import type { IssuedTokens } from "./token.service.js";
+/**
+ * Describe an authentication provider exposed by an authentication service
+ */
+export interface ProviderInfo {
+    /**
+     * Provider name
+     */
+    name: string;
+    /**
+     * Provider type
+     */
+    type: "password" | "oauth" | "passwordless";
+    /**
+     * URL to start the authentication flow (oauth, passwordless)
+     */
+    startUrl?: string;
+}
+/**
+ * Identity resolved by a provider, before being linked to a user
+ */
+export interface ResolvedIdentity {
+    /**
+     * Provider name
+     */
+    provider: string;
+    /**
+     * Unique identifier of the identity within the provider
+     */
+    providerUid: string;
+    /**
+     * Email if known
+     */
+    email?: string;
+    /**
+     * Whether the provider verified the email
+     */
+    emailVerified: boolean;
+    /**
+     * Provider profile
+     */
+    profile?: any;
+    /**
+     * Provider tokens
+     */
+    tokens?: any;
+    /**
+     * Authentication methods references
+     */
+    amr: string[];
+    /**
+     * User already resolved if any
+     */
+    user?: User;
+}
+/**
+ * Result of an authentication completion
+ */
+export type AuthResult = ({
+    status: "ok";
+    user: any;
+} & IssuedTokens) | {
+    status: "mfa_required";
+    methods: string[];
+};
 /**
  * Authentication service interface
  */
 export interface IAuthenticationService extends Service {
-    onIdentLogin(ctx: Context, provider: string, identId: string, profile: any, tokens?: any): Promise<void>;
+    /**
+     * Complete the authentication of a resolved identity within the current context
+     * @param identity resolved by a provider
+     */
+    complete(identity: ResolvedIdentity): Promise<AuthResult>;
+    /**
+     * Logout the current session
+     */
+    logout(): Promise<void>;
+    /**
+     * List the providers available
+     */
+    getProviders(): ProviderInfo[];
+}
+/**
+ * Emitted when the /me route is called
+ */
+export interface EventAuthenticationGetMe<T extends User = User> extends EventWithContext {
+    /**
+     * Current user
+     */
+    user: T;
+}
+/**
+ * Emitted when new user registered
+ */
+export interface EventAuthenticationRegister<T extends User = User> extends EventAuthenticationGetMe<T> {
+    /**
+     * Registration data
+     */
+    data: any;
+    /**
+     * Ident identifier
+     */
+    identId: string;
+    /**
+     * Identity used to register
+     */
+    identity?: ResolvedIdentity;
+}
+/**
+ * Emitted when user logout
+ */
+export interface EventAuthenticationLogout extends EventWithContext {
 }
+/**
+ * Sent when a user update his password
+ */
+export interface EventAuthenticationPasswordUpdate<T extends User = User> extends EventAuthenticationGetMe<T> {
+    /**
+     * New password
+     */
+    password: string;
+}
+/**
+ * Emitted when user login
+ */
+export interface EventAuthenticationLogin<T extends User = User> extends EventWithContext {
+    /**
+     * User identifier
+     */
+    userId: string;
+    /**
+     * User if loaded
+     */
+    user?: T;
+    /**
+     * Ident identifier
+     */
+    identId: string;
+    /**
+     * Ident used
+     */
+    ident: any;
+    /**
+     * Provider used
+     */
+    provider: string;
+    /**
+     * Identity used to login
+     */
+    identity?: ResolvedIdentity;
+}
+/**
+ * Emitted when a user failed to authenticate
+ */
+export interface EventAuthenticationLoginFailed<T extends User = User> extends EventAuthenticationGetMe<T> {
+}
+/**
+ * Emitted when an ident is linked to a user
+ */
+export interface EventAuthenticationLinked<T extends User = User> extends EventWithContext {
+    /**
+     * User
+     */
+    user: T;
+    /**
+     * Ident linked
+     */
+    ident: Ident;
+}
+/**
+ * Emitted when an ident is unlinked from a user
+ */
+export interface EventAuthenticationUnlinked<T extends User = User> extends EventWithContext {
+    /**
+     * User
+     */
+    user: T;
+    /**
+     * Ident unlinked
+     */
+    ident: Ident;
+}
+/**
+ * Authentication events map
+ */
+export type AuthenticationEvents = {
+    "Authentication.GetMe": EventAuthenticationGetMe;
+    "Authentication.Register": EventAuthenticationRegister;
+    "Authentication.PasswordUpdate": EventAuthenticationPasswordUpdate;
+    "Authentication.PasswordCreate": EventAuthenticationPasswordUpdate;
+    "Authentication.Logout": EventAuthenticationLogout;
+    "Authentication.Login": EventAuthenticationLogin;
+    "Authentication.LoginFailed": EventAuthenticationLoginFailed;
+    "Authentication.Linked": EventAuthenticationLinked;
+    "Authentication.Unlinked": EventAuthenticationUnlinked;
+};
 //# sourceMappingURL=iauthentication.d.ts.map

package/lib/services/iauthentication.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"iauthentication.d.ts","sourceRoot":"","sources":["../../src/services/iauthentication.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC;;GAEG;AACH,MAAM,WAAW,sBAAuB,SAAQ,OAAO;IACrD,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1G"}
+{"version":3,"file":"iauthentication.d.ts","sourceRoot":"","sources":["../../src/services/iauthentication.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,IAAI,EAAE,UAAU,GAAG,OAAO,GAAG,cAAc,CAAC;IAC5C;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,aAAa,EAAE,OAAO,CAAC;IACvB;;OAEG;IACH,OAAO,CAAC,EAAE,GAAG,CAAC;IACd;;OAEG;IACH,MAAM,CAAC,EAAE,GAAG,CAAC;IACb;;OAEG;IACH,GAAG,EAAE,MAAM,EAAE,CAAC;IACd;;OAEG;IACH,IAAI,CAAC,EAAE,IAAI,CAAC;CACb;AAED;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,CAAC;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,GAAG,CAAA;CAAE,GAAG,YAAY,CAAC,GAAG;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAEtH;;GAEG;AACH,MAAM,WAAW,sBAAuB,SAAQ,OAAO;IACrD;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1D;;OAEG;IACH,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB;;OAEG;IACH,YAAY,IAAI,YAAY,EAAE,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB,CAAC,CAAC,SAAS,IAAI,GAAG,IAAI,CAAE,SAAQ,gBAAgB;IACvF;;OAEG;IACH,IAAI,EAAE,CAAC,CAAC;CACT;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B,CAAC,CAAC,SAAS,IAAI,GAAG,IAAI,CAAE,SAAQ,wBAAwB,CAAC,CAAC,CAAC;IACrG;;OAEG;IACH,IAAI,EAAE,GAAG,CAAC;IACV;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,yBAA0B,SAAQ,gBAAgB;CAAG;AAEtE;;GAEG;AACH,MAAM,WAAW,iCAAiC,CAAC,CAAC,SAAS,IAAI,GAAG,IAAI,CAAE,SAAQ,wBAAwB,CAAC,CAAC,CAAC;IAC3G;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB,CAAC,CAAC,SAAS,IAAI,GAAG,IAAI,CAAE,SAAQ,gBAAgB;IACvF;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,IAAI,CAAC,EAAE,CAAC,CAAC;IACT;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,KAAK,EAAE,GAAG,CAAC;IACX;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,8BAA8B,CAAC,CAAC,SAAS,IAAI,GAAG,IAAI,CAAE,SAAQ,wBAAwB,CAAC,CAAC,CAAC;CAAG;AAE7G;;GAEG;AACH,MAAM,WAAW,yBAAyB,CAAC,CAAC,SAAS,IAAI,GAAG,IAAI,CAAE,SAAQ,gBAAgB;IACxF;;OAEG;IACH,IAAI,EAAE,CAAC,CAAC;IACR;;OAEG;IACH,KAAK,EAAE,KAAK,CAAC;CACd;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B,CAAC,CAAC,SAAS,IAAI,GAAG,IAAI,CAAE,SAAQ,gBAAgB;IAC1F;;OAEG;IACH,IAAI,EAAE,CAAC,CAAC;IACR;;OAEG;IACH,KAAK,EAAE,KAAK,CAAC;CACd;AAED;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,sBAAsB,EAAE,wBAAwB,CAAC;IACjD,yBAAyB,EAAE,2BAA2B,CAAC;IACvD,+BAA+B,EAAE,iCAAiC,CAAC;IACnE,+BAA+B,EAAE,iCAAiC,CAAC;IACnE,uBAAuB,EAAE,yBAAyB,CAAC;IACnD,sBAAsB,EAAE,wBAAwB,CAAC;IACjD,4BAA4B,EAAE,8BAA8B,CAAC;IAC7D,uBAAuB,EAAE,yBAAyB,CAAC;IACnD,yBAAyB,EAAE,2BAA2B,CAAC;CACxD,CAAC"}

package/lib/services/servicecommands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"servicecommands.d.ts","sourceRoot":"","sources":["../../src/services/servicecommands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAqB,MAAM,iBAAiB,CAAC;AAC/E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAGrD;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IACb,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,8CAA8C;IAC9C,WAAW,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IACjC,oDAAoD;IACpD,IAAI,EAAE;QAAE,CAAC,IAAI,EAAE,MAAM,GAAG,oBAAoB,CAAA;KAAE,CAAC;IAC/C,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB;;;;;;;;;OASG;IACH,MAAM,EAAE,KAAK,CAAC,UAAU,GAAG,aAAa,GAAG,SAAS,CAAC,CAAC;CACvD;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,WAAW,GAAG;IAAE,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,CAAA;CAAE,CAoC/F;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,kBAAkB,EAC3B,IAAI,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;CAAE,EAC5B,QAAQ,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,CAAA;CAAE,EAC5C,aAAa,CAAC,EAAE,MAAM,EAAE,GACvB,OAAO,CAAC,MAAM,CAAC,CA0EjB"}
+{"version":3,"file":"servicecommands.d.ts","sourceRoot":"","sources":["../../src/services/servicecommands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAqB,MAAM,iBAAiB,CAAC;AAC/E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAGrD;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IACb,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,8CAA8C;IAC9C,WAAW,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IACjC,oDAAoD;IACpD,IAAI,EAAE;QAAE,CAAC,IAAI,EAAE,MAAM,GAAG,oBAAoB,CAAA;KAAE,CAAC;IAC/C,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB;;;;;;;;;OASG;IACH,MAAM,EAAE,KAAK,CAAC,UAAU,GAAG,aAAa,GAAG,SAAS,CAAC,CAAC;CACvD;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,WAAW,GAAG;IAAE,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,CAAA;CAAE,CAoC/F;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,kBAAkB,EAC3B,IAAI,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;CAAE,EAC5B,QAAQ,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,CAAA;CAAE,EAC5C,aAAa,CAAC,EAAE,MAAM,EAAE,GACvB,OAAO,CAAC,MAAM,CAAC,CA8EjB"}

package/lib/services/servicecommands.js

@@ -86,15 +86,10 @@ export function collectServiceCommands(app) {
  * ```
  */
 export async function executeServiceCommand(cmdName, cmdInfo, args, services, serviceFilter) {
-    // Filter services if requested
-    let targetServices = cmdInfo.services;
-    if (serviceFilter && serviceFilter.length > 0) {
-        targetServices = targetServices.filter(s => serviceFilter.some(f => s.name.endsWith(f) || s.name === f));
-        if (targetServices.length === 0) {
-            useLog("ERROR", `No services match filter '${serviceFilter.join(",")}' for command '${cmdName}'`);
-            return 1;
-        }
-    }
+    // Filter services if requested, by type (e.g. "HttpServer") or by instance name (e.g. a deployment unit)
+    const filtered = serviceFilter && serviceFilter.length > 0;
+    const typeMatches = (svc) => !filtered || serviceFilter.some(f => svc.name.endsWith(f) || svc.name === f);
+    const instanceMatches = (service) => filtered && typeof service.getName === "function" && serviceFilter.includes(service.getName());
     // Build positional args from command arg definitions; an omitted argument keeps
     // its slot as undefined so the following ones stay in position
     const commandArgs = Object.keys(cmdInfo.args).map(argName => args[argName] !== undefined ? args[argName] : cmdInfo.args[argName].default);
@@ -106,8 +101,9 @@ export async function executeServiceCommand(cmdName, cmdInfo, args, services, se
     // Execute each matching service handler. A single target type can map to
     // multiple configured instances (e.g. two HttpServer services on different
     // ports); dispatch to every instance whose constructor matches the type.
-    for (const svc of targetServices) {
-        const matches = [];
+    let filterMatched = !filtered;
+    for (const svc of cmdInfo.services) {
+        let matches = [];
         // Direct lookup — works when the modda name is used verbatim as service key
         if (services[svc.name])
             matches.push(services[svc.name]);
@@ -120,6 +116,12 @@ export async function executeServiceCommand(cmdName, cmdInfo, args, services, se
                 matches.push(instanceService);
             }
         }
+        if (!typeMatches(svc)) {
+            matches = matches.filter(instanceMatches);
+            if (matches.length === 0)
+                continue;
+        }
+        filterMatched = true;
         if (matches.length === 0) {
             useLog("WARN", `Service '${svc.name}' not found, skipping`);
             continue;
@@ -140,6 +142,10 @@ export async function executeServiceCommand(cmdName, cmdInfo, args, services, se
             executed++;
         }
     }
+    if (!filterMatched) {
+        useLog("ERROR", `No services match filter '${serviceFilter.join(",")}' for command '${cmdName}'`);
+        return 1;
+    }
     if (executed === 0) {
         useLog("ERROR", `No service instance found to run command '${cmdName}'`);
         return 1;

package/lib/services/servicecommands.js.map

@@ -1 +1 @@
-{"version":3,"file":"servicecommands.js","sourceRoot":"","sources":["../../src/services/servicecommands.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAuCxC;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAgB;IACrD,MAAM,QAAQ,GAA2C,EAAE,CAAC;IAC5D,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC;IAEjC,KAAK,MAAM,OAAO,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,WAAW,CAAU,EAAE,CAAC;QAChE,KAAK,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC1E,IAAI,CAAC,QAAQ,CAAC,QAAQ;gBAAE,SAAS;YACjC,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAClE,QAAQ,CAAC,OAAO,CAAC,KAAK;oBACpB,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,QAAQ,EAAE,EAAE;oBACZ,IAAI,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE;oBACxB,QAAQ,EAAE,EAAE;oBACZ,MAAM,EAAE,EAAE;iBACX,CAAC;gBACF,QAAQ,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAC9B,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,IAAI,EAAE,QAAQ;iBACf,CAAC,CAAC;gBACH,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC5C,+DAA+D;gBAC/D,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC5D,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC;gBAC7C,CAAC;gBACD,wCAAwC;gBACxC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;oBACxC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;wBAC9C,QAAQ,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACvC,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAe,EACf,OAA2B,EAC3B,IAA4B,EAC5B,QAA4C,EAC5C,aAAwB;IAExB,+BAA+B;IAC/B,IAAI,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC;IACtC,IAAI,aAAa,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,cAAc,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CACzC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAC5D,CAAC;QACF,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,CAAC,OAAO,EAAE,6BAA6B,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,OAAO,GAAG,CAAC,CAAC;YAClG,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IAED,gFAAgF;IAChF,+DAA+D;IAC/D,MAAM,WAAW,GAAU,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CACjE,IAAI,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,CAC5E,CAAC;IAEF,kFAAkF;IAClF,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,+EAA+E;IAC/E,6EAA6E;IAC7E,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,yEAAyE;IACzE,2EAA2E;IAC3E,yEAAyE;IACzE,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;QACjC,MAAM,OAAO,GAAsB,EAAE,CAAC;QACtC,4EAA4E;QAC5E,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QACzD,yDAAyD;QACzD,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QAC5C,KAAK,MAAM,CAAC,EAAE,eAAe,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3D,IAAI,CAAC,eAAe,IAAI,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;gBAAE,SAAS;YACpE,IAAI,eAAe,CAAC,WAAW,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;gBACpD,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,CAAC,MAAM,EAAE,YAAY,GAAG,CAAC,IAAI,uBAAuB,CAAC,CAAC;YAC5D,SAAS;QACX,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,OAAO,EAAE,CAAC;YAC9B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzB,MAAM,YAAY,GAAG,OAAO,OAAO,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;gBAC1F,MAAM,CAAC,OAAO,EAAE,WAAW,GAAG,CAAC,MAAM,2BAA2B,YAAY,GAAG,CAAC,CAAC;gBACjF,OAAO,CAAC,CAAC;YACX,CAAC;YACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC;YACnD,IAAI,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACvB,CAAC;iBAAM,CAAC;gBACN,MAAM,MAAM,CAAC;YACf,CAAC;YACD,QAAQ,EAAE,CAAC;QACb,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,CAAC,OAAO,EAAE,6CAA6C,OAAO,GAAG,CAAC,CAAC;QACzE,OAAO,CAAC,CAAC;IACX,CAAC;IACD,sEAAsE;IACtE,MAAM,OAAO,CAAC,GAAG,CACf,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CACd,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;QAC7B,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;YACxB,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CACH,CACF,CAAC;IACF,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,MAAW;IAC/B,OAAO,OAAO,MAAM,EAAE,IAAI,KAAK,UAAU,IAAI,OAAO,MAAM,EAAE,MAAM,KAAK,UAAU,CAAC;AACpF,CAAC"}
+{"version":3,"file":"servicecommands.js","sourceRoot":"","sources":["../../src/services/servicecommands.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAuCxC;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAgB;IACrD,MAAM,QAAQ,GAA2C,EAAE,CAAC;IAC5D,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC;IAEjC,KAAK,MAAM,OAAO,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,WAAW,CAAU,EAAE,CAAC;QAChE,KAAK,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC1E,IAAI,CAAC,QAAQ,CAAC,QAAQ;gBAAE,SAAS;YACjC,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAClE,QAAQ,CAAC,OAAO,CAAC,KAAK;oBACpB,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,QAAQ,EAAE,EAAE;oBACZ,IAAI,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE;oBACxB,QAAQ,EAAE,EAAE;oBACZ,MAAM,EAAE,EAAE;iBACX,CAAC;gBACF,QAAQ,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAC9B,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,IAAI,EAAE,QAAQ;iBACf,CAAC,CAAC;gBACH,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC5C,+DAA+D;gBAC/D,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC5D,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC;gBAC7C,CAAC;gBACD,wCAAwC;gBACxC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;oBACxC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;wBAC9C,QAAQ,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACvC,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAe,EACf,OAA2B,EAC3B,IAA4B,EAC5B,QAA4C,EAC5C,aAAwB;IAExB,yGAAyG;IACzG,MAAM,QAAQ,GAAG,aAAa,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC;IAC3D,MAAM,WAAW,GAAG,CAAC,GAAyB,EAAE,EAAE,CAAC,CAAC,QAAQ,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC;IAChI,MAAM,eAAe,GAAG,CAAC,OAAwB,EAAE,EAAE,CACnD,QAAQ,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,UAAU,IAAI,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAEjG,gFAAgF;IAChF,+DAA+D;IAC/D,MAAM,WAAW,GAAU,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CACjE,IAAI,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,CAC5E,CAAC;IAEF,kFAAkF;IAClF,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,+EAA+E;IAC/E,6EAA6E;IAC7E,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,yEAAyE;IACzE,2EAA2E;IAC3E,yEAAyE;IACzE,IAAI,aAAa,GAAG,CAAC,QAAQ,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACnC,IAAI,OAAO,GAAsB,EAAE,CAAC;QACpC,4EAA4E;QAC5E,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QACzD,yDAAyD;QACzD,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QAC5C,KAAK,MAAM,CAAC,EAAE,eAAe,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3D,IAAI,CAAC,eAAe,IAAI,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;gBAAE,SAAS;YACpE,IAAI,eAAe,CAAC,WAAW,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;gBACpD,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YAC1C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;QACrC,CAAC;QACD,aAAa,GAAG,IAAI,CAAC;QACrB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,CAAC,MAAM,EAAE,YAAY,GAAG,CAAC,IAAI,uBAAuB,CAAC,CAAC;YAC5D,SAAS;QACX,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,OAAO,EAAE,CAAC;YAC9B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzB,MAAM,YAAY,GAAG,OAAO,OAAO,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;gBAC1F,MAAM,CAAC,OAAO,EAAE,WAAW,GAAG,CAAC,MAAM,2BAA2B,YAAY,GAAG,CAAC,CAAC;gBACjF,OAAO,CAAC,CAAC;YACX,CAAC;YACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC;YACnD,IAAI,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACvB,CAAC;iBAAM,CAAC;gBACN,MAAM,MAAM,CAAC;YACf,CAAC;YACD,QAAQ,EAAE,CAAC;QACb,CAAC;IACH,CAAC;IAED,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,CAAC,OAAO,EAAE,6BAA6B,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,OAAO,GAAG,CAAC,CAAC;QAClG,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,CAAC,OAAO,EAAE,6CAA6C,OAAO,GAAG,CAAC,CAAC;QACzE,OAAO,CAAC,CAAC;IACX,CAAC;IACD,sEAAsE;IACtE,MAAM,OAAO,CAAC,GAAG,CACf,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CACd,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;QAC7B,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;YACxB,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CACH,CACF,CAAC;IACF,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,MAAW;IAC/B,OAAO,OAAO,MAAM,EAAE,IAAI,KAAK,UAAU,IAAI,OAAO,MAAM,EAAE,MAAM,KAAK,UAAU,CAAC;AACpF,CAAC"}

package/lib/services/token.service.d.ts

@@ -0,0 +1,95 @@
+import * as WebdaError from "../errors/errors.js";
+import { Service } from "./service.js";
+import { ServiceParameters } from "./serviceparameters.js";
+import { MfaState, Session } from "../session/session.js";
+/** Raised for unknown, expired, revoked or reused tokens (403 TOKEN_INVALID) */
+export declare class TokenInvalid extends WebdaError.HttpError {
+    /** @param message - error message */
+    constructor(message?: string);
+}
+/** Tokens returned by a successful login or refresh */
+export interface IssuedTokens {
+    accessToken: string;
+    refreshToken: string;
+    expiresIn: number;
+}
+/** Claims carried by an access token */
+export interface AccessClaims {
+    sub: string;
+    ident: string;
+    provider?: string;
+    amr: string[];
+    roles?: string[];
+    fam: string;
+    mfa: MfaState;
+    /** When the session was authenticated (ms): checked against the user's last password change */
+    authAt?: number;
+}
+/** TokenService parameters */
+export declare class TokenServiceParameters extends ServiceParameters {
+    /**
+     * Access token lifetime in seconds
+     * @default 900
+     */
+    accessTtl: number;
+    /**
+     * Refresh token lifetime in seconds
+     * @default 2592000
+     */
+    refreshTtl: number;
+    /**
+     * @param params - raw parameters
+     * @returns this
+     */
+    load(params?: any): this;
+}
+/**
+ * Issues access tokens (JWT) and rotating refresh tokens
+ * @WebdaModda TokenService
+ */
+export declare class TokenService<T extends TokenServiceParameters = TokenServiceParameters> extends Service<T> {
+    /**
+     * @param token - raw refresh token
+     * @returns SHA-256 hex
+     */
+    protected hash(token: string): string;
+    /**
+     * Issue an access + refresh token pair for a logged session
+     *
+     * Roles are not persisted: refreshed access tokens carry no roles until they are re-derived.
+     * @param session - logged session (must not be anonymous nor pending MFA)
+     * @param family - existing family when rotating
+     * @returns the tokens
+     */
+    issue(session: Session, family?: string): Promise<IssuedTokens>;
+    /**
+     * @param token - access token
+     * @returns claims, or undefined when invalid/expired
+     */
+    verifyAccess(token: string): Promise<AccessClaims | undefined>;
+    /**
+     * Exchange a refresh token (rotation with reuse detection)
+     *
+     * The token is only ever looked up by its hash, so an access token or any
+     * arbitrary string simply does not match a stored record.
+     * @param refreshToken - raw refresh token
+     * @returns new tokens and the rebuilt session
+     */
+    refresh(refreshToken: string): Promise<IssuedTokens & {
+        session: Session;
+    }>;
+    /**
+     * @param err - error thrown by a conditional write
+     * @returns true if the error is a failed write condition
+     */
+    protected isConditionFailure(err: any): boolean;
+    /**
+     * @param family - family to revoke
+     */
+    revokeFamily(family: string): Promise<void>;
+    /**
+     * @param userId - user whose tokens are revoked
+     */
+    revokeUser(userId: string): Promise<void>;
+}
+//# sourceMappingURL=token.service.d.ts.map

package/lib/services/token.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.service.d.ts","sourceRoot":"","sources":["../../src/services/token.service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,UAAU,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAG3D,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAI1D,gFAAgF;AAChF,qBAAa,YAAa,SAAQ,UAAU,CAAC,SAAS;IACpD,qCAAqC;IACrC,YAAY,OAAO,GAAE,MAAwB,EAE5C;CACF;AAED,uDAAuD;AACvD,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wCAAwC;AACxC,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,QAAQ,CAAC;IACd,+FAA+F;IAC/F,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,8BAA8B;AAC9B,qBAAa,sBAAuB,SAAQ,iBAAiB;IAC3D;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,IAAI,CAAC,MAAM,GAAE,GAAQ,GAAG,IAAI,CAK3B;CACF;AAED;;;GAGG;AACH,qBAAa,YAAY,CAAC,CAAC,SAAS,sBAAsB,GAAG,sBAAsB,CAAE,SAAQ,OAAO,CAAC,CAAC,CAAC;IACrG;;;OAGG;IACH,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpC;IAED;;;;;;;OAOG;IACG,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,GAAE,MAA0B,GAAG,OAAO,CAAC,YAAY,CAAC,CAiCvF;IAED;;;OAGG;IACG,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAMnE;IAED;;;;;;;OAOG;IACG,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CA0ChF;IAED;;;OAGG;IACH,SAAS,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAE9C;IAED;;OAEG;IACG,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAIhD;IAED;;OAEG;IACG,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAI9C;CACF"}

package/lib/services/token.service.js

@@ -0,0 +1,182 @@
+import { createHash, randomBytes } from "node:crypto";
+import { getUuid } from "@webda/utils";
+import * as WebdaError from "../errors/errors.js";
+import { Service } from "./service.js";
+import { ServiceParameters } from "./serviceparameters.js";
+import { useCrypto } from "./cryptoservice.service.js";
+import { RefreshToken } from "../models/refreshtoken.model.js";
+import { Session } from "../session/session.js";
+const ACCESS_AUDIENCE = "webda-access";
+/** Raised for unknown, expired, revoked or reused tokens (403 TOKEN_INVALID) */
+export class TokenInvalid extends WebdaError.HttpError {
+    /** @param message - error message */
+    constructor(message = "Invalid token") {
+        super(message, 403);
+    }
+}
+/** TokenService parameters */
+export class TokenServiceParameters extends ServiceParameters {
+    /**
+     * Access token lifetime in seconds
+     * @default 900
+     */
+    accessTtl;
+    /**
+     * Refresh token lifetime in seconds
+     * @default 2592000
+     */
+    refreshTtl;
+    /**
+     * @param params - raw parameters
+     * @returns this
+     */
+    load(params = {}) {
+        super.load(params);
+        this.accessTtl ??= 900;
+        this.refreshTtl ??= 2592000;
+        return this;
+    }
+}
+/**
+ * Issues access tokens (JWT) and rotating refresh tokens
+ * @WebdaModda TokenService
+ */
+export class TokenService extends Service {
+    /**
+     * @param token - raw refresh token
+     * @returns SHA-256 hex
+     */
+    hash(token) {
+        return createHash("sha256").update(token).digest("hex");
+    }
+    /**
+     * Issue an access + refresh token pair for a logged session
+     *
+     * Roles are not persisted: refreshed access tokens carry no roles until they are re-derived.
+     * @param session - logged session (must not be anonymous nor pending MFA)
+     * @param family - existing family when rotating
+     * @returns the tokens
+     */
+    async issue(session, family = getUuid("base64")) {
+        if (!session.isLogged()) {
+            throw new TokenInvalid("Session is not fully authenticated");
+        }
+        const refreshToken = randomBytes(32).toString("base64url");
+        await RefreshToken.create({
+            hash: this.hash(refreshToken),
+            userId: session.userId,
+            identId: session.identUsed,
+            provider: session.provider,
+            amr: session.amr ?? [],
+            mfa: session.mfa ?? "none",
+            family,
+            expiresAt: Date.now() + this.parameters.refreshTtl * 1000
+        });
+        session.refreshFamily = family;
+        // A refreshed session is re-authenticated by its (unrevoked) refresh token
+        session.authAt ??= Date.now();
+        const claims = {
+            sub: session.userId,
+            ident: session.identUsed,
+            provider: session.provider,
+            amr: session.amr ?? [],
+            roles: session.roles,
+            fam: family,
+            mfa: session.mfa ?? "none",
+            authAt: session.authAt
+        };
+        const accessToken = await useCrypto().jwtSign(claims, {
+            audience: ACCESS_AUDIENCE,
+            expiresIn: this.parameters.accessTtl
+        });
+        return { accessToken, refreshToken, expiresIn: this.parameters.accessTtl };
+    }
+    /**
+     * @param token - access token
+     * @returns claims, or undefined when invalid/expired
+     */
+    async verifyAccess(token) {
+        try {
+            return await useCrypto().jwtVerify(token, { audience: ACCESS_AUDIENCE });
+        }
+        catch {
+            return undefined;
+        }
+    }
+    /**
+     * Exchange a refresh token (rotation with reuse detection)
+     *
+     * The token is only ever looked up by its hash, so an access token or any
+     * arbitrary string simply does not match a stored record.
+     * @param refreshToken - raw refresh token
+     * @returns new tokens and the rebuilt session
+     */
+    async refresh(refreshToken) {
+        if (typeof refreshToken !== "string" || !refreshToken) {
+            throw new TokenInvalid();
+        }
+        const ref = RefreshToken.ref({ hash: this.hash(refreshToken) });
+        if (!(await ref.exists())) {
+            throw new TokenInvalid();
+        }
+        const stored = await ref.get();
+        if (stored.revokedAt || stored.expiresAt < Date.now()) {
+            throw new TokenInvalid();
+        }
+        if (stored.rotatedAt) {
+            await this.revokeFamily(stored.family);
+            throw new TokenInvalid("Refresh token reused");
+        }
+        // Compare-and-set: only one caller can move rotatedAt from undefined to a value
+        try {
+            await ref.patch({ rotatedAt: Date.now() }, "rotatedAt", undefined);
+        }
+        catch (err) {
+            if (!this.isConditionFailure(err)) {
+                throw err;
+            }
+            // Lost the race: treat as reuse and kill the family
+            await this.revokeFamily(stored.family);
+            throw new TokenInvalid("Refresh token reused");
+        }
+        const session = new Session();
+        session.login(stored.userId, stored.identId, {
+            provider: stored.provider,
+            amr: stored.amr,
+            mfa: stored.mfa ?? "none"
+        });
+        const tokens = await this.issue(session, stored.family);
+        // A revocation may have run between our read and the issue: its scan would have missed the new record
+        for await (const _ of RefreshToken.iterate("family = ? AND revokedAt IS NOT NULL LIMIT 1", [stored.family])) {
+            await RefreshToken.ref({ hash: this.hash(tokens.refreshToken) }).patch({
+                revokedAt: Date.now()
+            });
+            throw new TokenInvalid("Refresh token revoked");
+        }
+        return { ...tokens, session };
+    }
+    /**
+     * @param err - error thrown by a conditional write
+     * @returns true if the error is a failed write condition
+     */
+    isConditionFailure(err) {
+        return /condition/i.test(`${err?.name} ${err?.message}`);
+    }
+    /**
+     * @param family - family to revoke
+     */
+    async revokeFamily(family) {
+        for await (const token of RefreshToken.iterate("family = ? AND revokedAt IS NULL", [family])) {
+            await token.ref().patch({ revokedAt: Date.now() });
+        }
+    }
+    /**
+     * @param userId - user whose tokens are revoked
+     */
+    async revokeUser(userId) {
+        for await (const token of RefreshToken.iterate("userId = ? AND revokedAt IS NULL", [userId])) {
+            await token.ref().patch({ revokedAt: Date.now() });
+        }
+    }
+}
+//# sourceMappingURL=token.service.js.map

package/lib/services/token.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.service.js","sourceRoot":"","sources":["../../src/services/token.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,KAAK,UAAU,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAC/D,OAAO,EAAY,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAE1D,MAAM,eAAe,GAAG,cAAc,CAAC;AAEvC,gFAAgF;AAChF,MAAM,OAAO,YAAa,SAAQ,UAAU,CAAC,SAAS;IACpD,qCAAqC;IACrC,YAAY,OAAO,GAAW,eAAe;QAC3C,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACtB,CAAC;CACF;AAsBD,8BAA8B;AAC9B,MAAM,OAAO,sBAAuB,SAAQ,iBAAiB;IAC3D;;;OAGG;IACH,SAAS,CAAS;IAClB;;;OAGG;IACH,UAAU,CAAS;IAEnB;;;OAGG;IACH,IAAI,CAAC,MAAM,GAAQ,EAAE;QACnB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,IAAI,CAAC,SAAS,KAAK,GAAG,CAAC;QACvB,IAAI,CAAC,UAAU,KAAK,OAAO,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,YAAwE,SAAQ,OAAU;IACrG;;;OAGG;IACO,IAAI,CAAC,KAAa;QAC1B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1D,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,KAAK,CAAC,OAAgB,EAAE,MAAM,GAAW,OAAO,CAAC,QAAQ,CAAC;QAC9D,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,YAAY,CAAC,oCAAoC,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,YAAY,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC3D,MAAM,YAAY,CAAC,MAAM,CAAC;YACxB,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC;YAC7B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,OAAO,EAAE,OAAO,CAAC,SAAS;YAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,EAAE;YACtB,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,MAAM;YAC1B,MAAM;YACN,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,GAAG,IAAI;SACnD,CAAC,CAAC;QACV,OAAO,CAAC,aAAa,GAAG,MAAM,CAAC;QAC/B,2EAA2E;QAC3E,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAiB;YAC3B,GAAG,EAAE,OAAO,CAAC,MAAM;YACnB,KAAK,EAAE,OAAO,CAAC,SAAS;YACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,EAAE;YACtB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,GAAG,EAAE,MAAM;YACX,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,MAAM;YAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC;QACF,MAAM,WAAW,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE;YACpD,QAAQ,EAAE,eAAe;YACzB,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,SAAS;SACrC,CAAC,CAAC;QACH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;IAC7E,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,CAAC,KAAa;QAC9B,IAAI,CAAC;YACH,OAAO,MAAM,SAAS,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC;QAC3E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,CAAC,YAAoB;QAChC,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;YACtD,MAAM,IAAI,YAAY,EAAE,CAAC;QAC3B,CAAC;QACD,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,EAAS,CAAC,CAAC;QACvE,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,YAAY,EAAE,CAAC;QAC3B,CAAC;QACD,MAAM,MAAM,GAAiB,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC;QAC7C,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACtD,MAAM,IAAI,YAAY,EAAE,CAAC;QAC3B,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACvC,MAAM,IAAI,YAAY,CAAC,sBAAsB,CAAC,CAAC;QACjD,CAAC;QACD,gFAAgF;QAChF,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAS,EAAE,WAAkB,EAAE,SAAS,CAAC,CAAC;QACnF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClC,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,oDAAoD;YACpD,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACvC,MAAM,IAAI,YAAY,CAAC,sBAAsB,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;QAC9B,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE;YAC3C,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,GAAG,EAAE,MAAM,CAAC,GAAG,IAAI,MAAM;SAC1B,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACxD,sGAAsG;QACtG,IAAI,KAAK,EAAE,MAAM,CAAC,IAAI,YAAY,CAAC,OAAO,CAAC,8CAA8C,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAC5G,MAAM,YAAY,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,EAAS,CAAC,CAAC,KAAK,CAAC;gBAC5E,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACf,CAAC,CAAC;YACV,MAAM,IAAI,YAAY,CAAC,uBAAuB,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,CAAC;IAChC,CAAC;IAED;;;OAGG;IACO,kBAAkB,CAAC,GAAQ;QACnC,OAAO,YAAY,CAAC,IAAI,CAAC,GAAG,GAAG,EAAE,IAAI,IAAI,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAAC,MAAc;QAC/B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,YAAY,CAAC,OAAO,CAAC,kCAAkC,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAC7F,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAS,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CAAC,MAAc;QAC7B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,YAAY,CAAC,OAAO,CAAC,kCAAkC,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAC7F,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAS,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;CACF"}

package/lib/session/manager.model.d.ts

@@ -21,6 +21,22 @@ export declare abstract class SessionManager<T extends ServiceParameters = Servi
      * @param session
      */
     abstract save(context: Context, session: Session): Promise<void>;
+    /**
+     * Build a stateless session from an access token (any transport)
+     * @param context - the context
+     * @param token - access token
+     * @returns the session, anonymous when the token is invalid
+     */
+    loadFromToken(context: Context, token: string): Promise<Session>;
+    /**
+     * Whether the user of an authenticated session changed their password after the session was authenticated
+     *
+     * Costs one user read (through the registered user resolver) per load of a session carrying `authAt`. A failing
+     * read counts as outdated: the session is then anonymous for that request.
+     * @param session - loaded session
+     * @returns true when the session must be treated as anonymous
+     */
+    protected isOutdated(session: Session): Promise<boolean>;
 }
 /** Persistent session data stored in a model with a TTL */
 export declare class SessionModel extends UuidModel {

package/lib/session/manager.model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manager.model.d.ts","sourceRoot":"","sources":["../../src/session/manager.model.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAC3D,OAAO,EAAU,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EAAE,aAAa,EAAgB,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,OAAO,EAAgB,MAAM,yBAAyB,CAAC;AAEhE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,KAAK,UAAU,EAAE,KAAK,UAAU,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE5E;;GAEG;AACH,8BAAsB,cAAc,CAAC,CAAC,SAAS,iBAAiB,GAAG,iBAAiB,CAAE,SAAQ,OAAO,CAAC,CAAC,CAAC;IACtG;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClD;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClE;AAED,2DAA2D;AAC3D,qBAAa,YAAa,SAAQ,SAAS;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,GAAG,CAAC;IACb;;OAEG;IACH,YAAY,IAAI,EAAE,GAAG,EAIpB;CACF;AAED,sDAAsD;AACtD,qBAAa,uBAAwB,SAAQ,iBAAiB;IAC5D;;OAEG;IACH,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB;;OAEG;IACH,MAAM,CAAC,EAAE,aAAa,CAAC;IAEvB;;;;OAIG;IACH,IAAI,CAAC,MAAM,GAAE,GAAQ,GAAG,IAAI,CAI3B;CACF;AAED;;;;;;;GAOG;AACH,qBAAa,oBAAoB,CAC/B,CAAC,SAAS,uBAAuB,GAAG,uBAAuB,CAC3D,SAAQ,cAAc,CAAC,CAAC,CAAC;IAEzB,aAAa,EAAE,aAAa,CAAC;IAE7B,YAAY,EAAE,UAAU,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;IAEnD;;OAEG;IACG,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAgB7C;IAED;;OAEG;IACG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,iBA6B5C;CACF"}
+{"version":3,"file":"manager.model.d.ts","sourceRoot":"","sources":["../../src/session/manager.model.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAC3D,OAAO,EAAU,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EAAE,aAAa,EAAgB,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,OAAO,EAAgB,MAAM,yBAAyB,CAAC;AAEhE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAGvC,OAAO,EAAE,KAAK,UAAU,EAAE,KAAK,UAAU,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE5E;;GAEG;AACH,8BAAsB,cAAc,CAAC,CAAC,SAAS,iBAAiB,GAAG,iBAAiB,CAAE,SAAQ,OAAO,CAAC,CAAC,CAAC;IACtG;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClD;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjE;;;;;OAKG;IACG,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAcrE;IAED;;;;;;;OAOG;IACH,UAAgB,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAY7D;CACF;AAED,2DAA2D;AAC3D,qBAAa,YAAa,SAAQ,SAAS;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,GAAG,CAAC;IACb;;OAEG;IACH,YAAY,IAAI,EAAE,GAAG,EAIpB;CACF;AAED,sDAAsD;AACtD,qBAAa,uBAAwB,SAAQ,iBAAiB;IAC5D;;OAEG;IACH,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB;;OAEG;IACH,MAAM,CAAC,EAAE,aAAa,CAAC;IAEvB;;;;OAIG;IACH,IAAI,CAAC,MAAM,GAAE,GAAQ,GAAG,IAAI,CAI3B;CACF;AAED;;;;;;;GAOG;AACH,qBAAa,oBAAoB,CAC/B,CAAC,SAAS,uBAAuB,GAAG,uBAAuB,CAC3D,SAAQ,cAAc,CAAC,CAAC,CAAC;IAEzB,aAAa,EAAE,aAAa,CAAC;IAE7B,YAAY,EAAE,UAAU,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;IAEnD;;OAEG;IACG,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAyB7C;IAED;;OAEG;IACG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,iBAgC5C;CACF"}