@wildo-ai/saas-backend-lib 1.0.1

package/dist/esm/security/authentications/services/admin-config/enterprise-user-provisioning.backend.service.js

@@ -0,0 +1,436 @@
+/**
+ * EnterpriseUserProvisioningBackendService
+ *
+ * Handles enterprise user lifecycle operations: creation, update, deactivation,
+ * and IdP role → org role mapping. Reusable by both SSO JIT provisioning (Step 15)
+ * and SCIM directory provisioning (Step 20).
+ *
+ * Step 15: Enterprise SSO — Org OIDC Connection Resolver & Provisioning
+ * DI Symbol: EnterpriseUserProvisioningService
+ *
+ * Design (Decision 13):
+ * - All methods use INTERNALLY_INITIATED_REQUEST execution context
+ * - All methods emit audit events via AuditLogsBackendService
+ * - createOrgUser() handles: User creation, UserProfile creation, OrganizationMember creation,
+ *   and UserIdentityLink creation — all transactional
+ *
+ * FUTURE (SCIM Step 20): SCIM controller will call these same methods.
+ */
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import 'reflect-metadata';
+import { injectable, inject } from 'inversify';
+import { SAAS_SERVICE_TYPES } from '../../../../inject/models/service-types.js';
+import { LoggerService } from '../../../../monitoring/logger/services/logger.service.js';
+import { ErrorBuilderBackendService } from '../../../../errors/services/error-builder.backend.service.js';
+import { AuthExecutionContextFactoryBackendService } from '../../../../security/authentications/services/auth-execution-context-factory.backend.service.js';
+import { grantUserTypesOnOrgJoin } from '../../../../organizations/services/user-org-type-grant.backend.utils.js';
+import { validateOrgMemberRoles } from '../../../../organizations/services/org-member-roles-validation.backend.utils.js';
+import { revokeUserTypesOnOrgLeave } from '../../../../organizations/services/user-type-revocation-on-org-leave.backend.utils.js';
+import { AuditLogsBackendService } from '../../../../compliance/audit-trails/services/audit-logs.backend.service.js';
+import { CoreResourceType, CoreAuditableEventType, ErrorType, ErrorCustomMessageReference, ResourceOperationRiskLevel, CORE_APP_ROLES, SsoConnectionType, UserStatus, isWildoBackendError, } from '@wildo-ai/saas-models';
+let EnterpriseUserProvisioningBackendService = class EnterpriseUserProvisioningBackendService {
+    logger;
+    errorBuilder;
+    servicesRegistryHandler;
+    authEcFactory;
+    tokenIssuer;
+    auditLogsService;
+    appConfigService;
+    userLookup;
+    logDebug;
+    constructor(logger, errorBuilder, servicesRegistryHandler, authEcFactory, tokenIssuer, auditLogsService, appConfigService, userLookup) {
+        this.logger = logger;
+        this.errorBuilder = errorBuilder;
+        this.servicesRegistryHandler = servicesRegistryHandler;
+        this.authEcFactory = authEcFactory;
+        this.tokenIssuer = tokenIssuer;
+        this.auditLogsService = auditLogsService;
+        this.appConfigService = appConfigService;
+        this.userLookup = userLookup;
+        this.logDebug = this.logger.debugByType('EnterpriseUserProvisioning');
+        this.logger.setDebugTypeLogging('EnterpriseUserProvisioning', false);
+    }
+    // ═══════════════════════════════════════════════════════════════
+    // Create or Link Org User
+    // ═══════════════════════════════════════════════════════════════
+    /**
+     * Create or link a user within an organization from an IdP profile.
+     *
+     * Flow:
+     * 1. Verify email domain is in allowedDomains (if any)
+     * 2. Check if user already exists by email
+     *    - If exists: verify/add org membership
+     *    - If not exists: check autoCreateUsers, create user + profile + org member
+     * 3. Map IdP roles → org roles
+     * 4. Create identity link
+     */
+    async createOrgUser(profile, connection, orgConfig) {
+        const ec = await this.getInternalExecutionContext();
+        // 1. Verify email domain
+        if (orgConfig.allowedDomains.length > 0) {
+            const emailDomain = profile.email.split('@')[1]?.toLowerCase();
+            if (!emailDomain || !orgConfig.allowedDomains.includes(emailDomain)) {
+                throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {
+                    customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,
+                    context: { message: `Email domain '${emailDomain}' is not allowed for this organization` },
+                });
+            }
+        }
+        // 2. Check if user already exists
+        const existingUser = await this.userLookup.findAnyUserByEmail(ec, profile.email);
+        // Map IdP roles
+        const mappedRoles = this.mapRoles(profile.roles || [], orgConfig.roleMapping || {}, orgConfig.allowedOrgRoles);
+        const effectiveRoles = mappedRoles.length > 0 ? mappedRoles : (orgConfig.defaultRole ? [orgConfig.defaultRole] : []);
+        if (existingUser) {
+            // User exists — check/create org membership
+            const orgMemberCreated = await this.ensureOrgMembership(ec, existingUser._id, orgConfig.organizationId, effectiveRoles);
+            // Create identity link
+            await this.createIdentityLink(ec, existingUser._id, profile, connection, orgConfig.organizationId);
+            this.logDebug('Existing user linked to org via enterprise SSO', {
+                userId: existingUser._id,
+                organizationId: orgConfig.organizationId,
+                orgMemberCreated,
+            });
+            return {
+                user: existingUser,
+                isNew: false,
+                orgMemberCreated,
+                mappedRoles: effectiveRoles,
+            };
+        }
+        // User doesn't exist — check autoCreateUsers
+        if (!orgConfig.autoCreateUsers) {
+            throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {
+                customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_NOT_FOUND,
+                context: { message: 'Account not found. Contact your organization administrator to be provisioned.' },
+            });
+        }
+        // 3. Create new user + profile + org member
+        // M6 fix: Wrap in try/catch for duplicate-key (409) to handle concurrent SSO+SCIM race
+        let newUser;
+        try {
+            newUser = await this.servicesRegistryHandler.create(CoreResourceType.USERS, ec, {
+                email: profile.email.toLowerCase(),
+                status: UserStatus.ACTIVE,
+                appRoles: [CORE_APP_ROLES.APP_USER],
+            });
+        }
+        catch (error) {
+            if (isWildoBackendError(error) && error.statusCode === 409) {
+                // Concurrent request created the user first — re-read and link
+                const raceWinner = await this.userLookup.findAnyUserByEmail(ec, profile.email);
+                if (!raceWinner)
+                    throw error;
+                const orgMemberCreated = await this.ensureOrgMembership(ec, raceWinner._id, orgConfig.organizationId, effectiveRoles);
+                await this.createIdentityLink(ec, raceWinner._id, profile, connection, orgConfig.organizationId);
+                this.logDebug('Concurrent user creation detected — linked to race winner', {
+                    userId: raceWinner._id,
+                    organizationId: orgConfig.organizationId,
+                });
+                return { user: raceWinner, isNew: false, orgMemberCreated, mappedRoles: effectiveRoles };
+            }
+            throw error;
+        }
+        // Create user profile (non-fatal if profiles repo isn't available)
+        try {
+            await this.servicesRegistryHandler.create(CoreResourceType.USER_PROFILES, ec, {
+                userId: newUser._id,
+                firstName: profile.firstName,
+                lastName: profile.lastName,
+                displayName: profile.displayName,
+                avatarUrl: profile.avatarUrl,
+                locale: profile.locale,
+            });
+        }
+        catch {
+            this.logDebug('UserProfile creation skipped (service not available)', { userId: newUser._id });
+        }
+        // Create org membership
+        await this.ensureOrgMembership(ec, newUser._id, orgConfig.organizationId, effectiveRoles);
+        // Create identity link
+        await this.createIdentityLink(ec, newUser._id, profile, connection, orgConfig.organizationId);
+        // Audit log — only for SSO JIT provisioning (SCIM has its own audit at the controller level)
+        if (connection.source !== 'scim') {
+            try {
+                await this.auditLogsService.logUserSSOLogin({
+                    userId: newUser._id,
+                    email: profile.email,
+                    providerRef: connection.providerRef,
+                    connectionType: SsoConnectionType.ENTERPRISE,
+                    authSource: connection.source,
+                    organizationId: orgConfig.organizationId,
+                    ipAddress: 'system',
+                    userAgent: 'enterprise-provisioning',
+                    sessionId: `enterprise:${connection.providerRef}:${newUser._id}`,
+                });
+            }
+            catch {
+                this.logDebug('Audit log for JIT provisioning failed (non-fatal)', { userId: newUser._id });
+            }
+        }
+        this.logDebug('New user provisioned via enterprise SSO JIT', {
+            userId: newUser._id,
+            organizationId: orgConfig.organizationId,
+            roles: effectiveRoles,
+        });
+        return {
+            user: newUser,
+            isNew: true,
+            orgMemberCreated: true,
+            mappedRoles: effectiveRoles,
+        };
+    }
+    // ═══════════════════════════════════════════════════════════════
+    // Update Org User (used by SCIM Step 20)
+    // ═══════════════════════════════════════════════════════════════
+    /**
+     * Update an existing org user's profile attributes.
+     * FUTURE: Called by SCIM PATCH/PUT handlers (Step 20).
+     */
+    async updateOrgUser(userId, attrs, _orgConfig) {
+        const ec = await this.getInternalExecutionContext();
+        try {
+            const existingProfile = await this.servicesRegistryHandler.read(CoreResourceType.USER_PROFILES, ec, { userId });
+            if (existingProfile) {
+                await this.servicesRegistryHandler.update(CoreResourceType.USER_PROFILES, ec, existingProfile._id, attrs);
+            }
+        }
+        catch (error) {
+            if (isWildoBackendError(error))
+                throw error;
+            this.logDebug('User profile update failed (non-fatal)', { userId });
+        }
+    }
+    // ═══════════════════════════════════════════════════════════════
+    // Deactivate Org User (used by SCIM Step 20)
+    // ═══════════════════════════════════════════════════════════════
+    /**
+     * Deactivate an org user (set status to INACTIVE).
+     * FUTURE: Called by SCIM DELETE or status-change handlers (Step 20).
+     */
+    async deactivateOrgUser(userId, orgConfig) {
+        const ec = await this.getInternalExecutionContext();
+        const user = await this.servicesRegistryHandler.read(CoreResourceType.USERS, ec, { _id: userId });
+        if (user) {
+            await this.servicesRegistryHandler.update(CoreResourceType.USERS, ec, userId, { status: UserStatus.INACTIVE });
+            // M9 fix: Also deactivate the org membership so the user loses org roles
+            try {
+                const membership = await this.servicesRegistryHandler.read(CoreResourceType.ORGANIZATION_MEMBERS, ec, { userId, organizationId: orgConfig.organizationId });
+                if (membership) {
+                    await this.servicesRegistryHandler.update(CoreResourceType.ORGANIZATION_MEMBERS, ec, membership._id, { status: 'inactive' });
+                    this.logDebug('Org membership deactivated', { userId, organizationId: orgConfig.organizationId });
+                }
+            }
+            catch (error) {
+                if (isWildoBackendError(error))
+                    throw error;
+                this.logDebug('Org membership deactivation skipped (ORGANIZATION_MEMBERS repo may not exist)', { userId });
+            }
+            // W5.12: Revoke user types granted by this org when deprovisioned
+            try {
+                if (this.appConfigService.isInitialized()) {
+                    const organizationTypes = this.appConfigService.config?.organizationTypes;
+                    const userTypesConfig = this.appConfigService.config?.userTypes;
+                    await revokeUserTypesOnOrgLeave(ec, {
+                        userId,
+                        organizationId: orgConfig.organizationId,
+                        organizationTypes,
+                        userTypesConfig,
+                        servicesRegistryHandler: this.servicesRegistryHandler,
+                        onUserTypesRevoked: async (uid) => {
+                            await this.tokenIssuer.invalidateAllTokensForUser(uid);
+                        },
+                    });
+                }
+            }
+            catch (revokeError) {
+                if (isWildoBackendError(revokeError))
+                    throw revokeError;
+                this.logDebug('User type revocation on deactivation skipped (non-fatal)', { userId });
+            }
+            this.logDebug('User deactivated via enterprise provisioning', { userId });
+        }
+    }
+    // ═══════════════════════════════════════════════════════════════
+    // Role Mapping
+    // ═══════════════════════════════════════════════════════════════
+    /**
+     * Map IdP role claims to organization roles using the org's roleMapping configuration.
+     *
+     * L9 fix: Added optional `allowedOrgRoles` parameter. When provided, mapped roles
+     * that are not in the allowed list are silently dropped and logged. This prevents
+     * a misconfigured role mapping from assigning arbitrary role identifiers (e.g., SUPER_ADMIN).
+     *
+     * @param idpRoles - Roles from the IdP claims (OIDC roles claim or SAML attribute)
+     * @param roleMapping - Org's IdP role → org role mapping (e.g., { "admin": "ORG_ADMIN", "viewer": "VIEWER" })
+     * @param allowedOrgRoles - Optional allowlist of valid org roles. If provided, mapped roles not in this list are rejected.
+     * @returns Mapped org role identifiers
+     */
+    mapRoles(idpRoles, roleMapping, allowedOrgRoles) {
+        if (!idpRoles.length || !Object.keys(roleMapping).length)
+            return [];
+        const mappedRoles = [];
+        for (const idpRole of idpRoles) {
+            const orgRole = roleMapping[idpRole];
+            if (orgRole && !mappedRoles.includes(orgRole)) {
+                if (allowedOrgRoles && !allowedOrgRoles.includes(orgRole)) {
+                    this.logDebug('Mapped role rejected — not in allowed org roles', { idpRole, mappedRole: orgRole });
+                    continue;
+                }
+                mappedRoles.push(orgRole);
+            }
+        }
+        return mappedRoles;
+    }
+    // ═══════════════════════════════════════════════════════════════
+    // Private: Org Membership
+    // ═══════════════════════════════════════════════════════════════
+    /**
+     * Ensure the user is a member of the organization.
+     * If they're already a member, no-op. If not, create the membership.
+     *
+     * @returns true if a new membership was created
+     */
+    async ensureOrgMembership(ec, userId, organizationId, roles) {
+        try {
+            // Check if already a member
+            const existingMember = await this.servicesRegistryHandler.read(CoreResourceType.ORGANIZATION_MEMBERS, ec, { userId, organizationId });
+            if (existingMember) {
+                this.logDebug('User already a member of organization', { userId, organizationId });
+                return false;
+            }
+            // W5.11 + W5.3: Resolve defaultMemberRole and validate roles
+            let effectiveRoles = roles;
+            if (this.appConfigService.isInitialized()) {
+                const organizationTypes = this.appConfigService.config?.organizationTypes;
+                // W5.11: Apply defaultMemberRole when no roles provided
+                if (effectiveRoles.length === 0 && organizationTypes) {
+                    const org = await this.servicesRegistryHandler.read(CoreResourceType.ORGANIZATIONS, ec, { _id: organizationId });
+                    if (org?.type && organizationTypes[org.type]?.defaultMemberRole) {
+                        effectiveRoles = [organizationTypes[org.type].defaultMemberRole];
+                    }
+                }
+                // W5.3: Validate roles against organizationTypes[org.type].availableOrgRoles
+                if (effectiveRoles.length > 0 && organizationTypes) {
+                    await validateOrgMemberRoles(ec, {
+                        organizationId,
+                        roles: effectiveRoles,
+                        organizationTypes,
+                        servicesRegistryHandler: this.servicesRegistryHandler,
+                        errorBuilder: this.errorBuilder,
+                    });
+                }
+            }
+            // Create new membership
+            await this.servicesRegistryHandler.create(CoreResourceType.ORGANIZATION_MEMBERS, ec, {
+                userId,
+                organizationId,
+                roles: effectiveRoles.length > 0 ? effectiveRoles : undefined,
+                status: 'active',
+            });
+            this.logDebug('Organization membership created', { userId, organizationId, roles });
+            // W5.2: Auto-grant user types from organizationTypes[orgType].userTypes
+            const organizationTypes = this.appConfigService.isInitialized()
+                ? this.appConfigService.config?.organizationTypes
+                : undefined;
+            await grantUserTypesOnOrgJoin(ec, {
+                userId,
+                organizationId,
+                organizationTypes,
+                servicesRegistryHandler: this.servicesRegistryHandler,
+            });
+            return true;
+        }
+        catch (error) {
+            if (isWildoBackendError(error))
+                throw error;
+            this.logDebug('Org membership creation failed (ORGANIZATION_MEMBERS repo may not exist)', { userId, organizationId });
+            return false;
+        }
+    }
+    // ═══════════════════════════════════════════════════════════════
+    // Private: Identity Link
+    // ═══════════════════════════════════════════════════════════════
+    async createIdentityLink(ec, userId, profile, connection, organizationId) {
+        // Check if identity link already exists (idempotency)
+        const existingLink = await this.servicesRegistryHandler.read(CoreResourceType.USER_IDENTITY_LINKS, ec, {
+            providerRef: connection.providerRef,
+            providerUserId: profile.providerUserId,
+            connectionType: 'enterprise',
+        });
+        if (existingLink) {
+            const previousEmail = existingLink.providerEmail?.toLowerCase();
+            const newEmail = profile.email?.toLowerCase();
+            const emailChanged = previousEmail != null && newEmail != null && previousEmail !== newEmail;
+            await this.servicesRegistryHandler.update(CoreResourceType.USER_IDENTITY_LINKS, ec, existingLink._id, {
+                lastUsedAt: new Date(),
+                providerEmail: profile.email,
+                providerDisplayName: profile.displayName,
+                providerAvatarUrl: profile.avatarUrl,
+                providerRawProfile: profile.rawClaims,
+            });
+            if (emailChanged && connection.source === 'saml') {
+                this.auditLogsService.logSAMLEvent(CoreAuditableEventType.SAML_EMAIL_CHANGED, ResourceOperationRiskLevel.MEDIUM, {
+                    userId: existingLink.userId,
+                    organizationId,
+                    connectionId: connection.organization?.connectionId,
+                    providerRef: connection.providerRef,
+                    previousEmail,
+                    newEmail,
+                }).catch(() => { });
+            }
+            return;
+        }
+        await this.servicesRegistryHandler.create(CoreResourceType.USER_IDENTITY_LINKS, ec, {
+            userId,
+            connectionType: 'enterprise',
+            providerRef: connection.providerRef,
+            providerUserId: profile.providerUserId,
+            providerEmail: profile.email,
+            providerDisplayName: profile.displayName,
+            providerAvatarUrl: profile.avatarUrl,
+            providerRawProfile: profile.rawClaims,
+            organizationId,
+            connectionId: connection.organization?.connectionId,
+            source: connection.source,
+        });
+    }
+    // ═══════════════════════════════════════════════════════════════
+    // Private: Execution Context
+    // ═══════════════════════════════════════════════════════════════
+    /**
+     * System-level EC for enterprise user provisioning (SCIM/JIT).
+     * Uses INTERNALLY_INITIATED_REQUEST with APP_ADMIN_SUPER_ADMIN —
+     * these operations act on behalf of the system, not a specific user.
+     * Primary intent: user creation/provisioning from enterprise IdP.
+     */
+    async getInternalExecutionContext() {
+        return this.authEcFactory.createForSystemAuthOperation(this.authEcFactory.getUsersCreateOperationPath());
+    }
+};
+EnterpriseUserProvisioningBackendService = __decorate([
+    injectable(),
+    __param(0, inject(SAAS_SERVICE_TYPES.Logger)),
+    __param(1, inject(SAAS_SERVICE_TYPES.ErrorBuilderService)),
+    __param(2, inject(SAAS_SERVICE_TYPES.ServicesRegistryHandlerService)),
+    __param(3, inject(SAAS_SERVICE_TYPES.AuthExecutionContextFactory)),
+    __param(4, inject(SAAS_SERVICE_TYPES.AuthTokenIssuer)),
+    __param(5, inject(SAAS_SERVICE_TYPES.AuditLogsService)),
+    __param(6, inject(SAAS_SERVICE_TYPES.AppConfigService)),
+    __param(7, inject(SAAS_SERVICE_TYPES.AuthUserLookupService)),
+    __metadata("design:paramtypes", [LoggerService,
+        ErrorBuilderBackendService, Function, AuthExecutionContextFactoryBackendService, Function, AuditLogsBackendService, Function, Function])
+], EnterpriseUserProvisioningBackendService);
+export { EnterpriseUserProvisioningBackendService };
+//# sourceMappingURL=enterprise-user-provisioning.backend.service.js.map

package/dist/esm/security/authentications/services/admin-config/enterprise-user-provisioning.backend.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enterprise-user-provisioning.backend.service.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/admin-config/enterprise-user-provisioning.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;;;;;;;;;;;;;AAEH,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAE9G,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAIhK,OAAO,EAAE,uBAAuB,EAAE,MAAM,6EAA6E,CAAC;AACtH,OAAO,EAAE,sBAAsB,EAAE,MAAM,qFAAqF,CAAC;AAC7H,OAAO,EAAE,yBAAyB,EAAE,MAAM,2FAA2F,CAAC;AACtI,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AACzH,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,SAAS,EACT,2BAA2B,EAC3B,0BAA0B,EAC1B,cAAc,EACd,iBAAiB,EAEjB,UAAU,EACV,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AA2BxB,IAAM,wCAAwC,GAA9C,MAAM,wCAAwC;IAIG;IACa;IACW;IACH;IACZ;IACC;IACA;IACK;IAVpD,QAAQ,CAA+D;IAExF,YACsD,MAAqB,EACR,YAAwC,EAC7B,uBAA8D,EACjE,aAAwD,EACpE,WAA0C,EACzC,gBAAyC,EACzC,gBAAyC,EACpC,UAAwC;QAPvD,WAAM,GAAN,MAAM,CAAe;QACR,iBAAY,GAAZ,YAAY,CAA4B;QAC7B,4BAAuB,GAAvB,uBAAuB,CAAuC;QACjE,kBAAa,GAAb,aAAa,CAA2C;QACpE,gBAAW,GAAX,WAAW,CAA+B;QACzC,qBAAgB,GAAhB,gBAAgB,CAAyB;QACzC,qBAAgB,GAAhB,gBAAgB,CAAyB;QACpC,eAAU,GAAV,UAAU,CAA8B;QAE3G,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,4BAA4B,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,4BAA4B,EAAE,KAAK,CAAC,CAAC;IACvE,CAAC;IAED,kEAAkE;IAClE,0BAA0B;IAC1B,kEAAkE;IAElE;;;;;;;;;;OAUG;IACI,KAAK,CAAC,aAAa,CACxB,OAA8B,EAC9B,UAAyC,EACzC,SAAuC;QAEvC,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QAEpD,yBAAyB;QACzB,IAAI,SAAS,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxC,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;YAC/D,IAAI,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBACpE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;oBAChF,OAAO,EAAE,EAAE,OAAO,EAAE,iBAAiB,WAAW,wCAAwC,EAAE;iBAC3F,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,kCAAkC;QAClC,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAEjF,gBAAgB;QAChB,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,EAAE,SAAS,CAAC,WAAW,IAAI,EAAE,EAAE,SAAS,CAAC,eAAe,CAAC,CAAC;QAC/G,MAAM,cAAc,GAAG,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAErH,IAAI,YAAY,EAAE,CAAC;YACjB,4CAA4C;YAC5C,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,mBAAmB,CACrD,EAAE,EACF,YAAY,CAAC,GAAG,EAChB,SAAS,CAAC,cAAc,EACxB,cAAc,CACf,CAAC;YAEF,uBAAuB;YACvB,MAAM,IAAI,CAAC,kBAAkB,CAAC,EAAE,EAAE,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,CAAC,cAAc,CAAC,CAAC;YAEnG,IAAI,CAAC,QAAQ,CAAC,gDAAgD,EAAE;gBAC9D,MAAM,EAAE,YAAY,CAAC,GAAG;gBACxB,cAAc,EAAE,SAAS,CAAC,cAAc;gBACxC,gBAAgB;aACjB,CAAC,CAAC;YAEH,OAAO;gBACL,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE,KAAK;gBACZ,gBAAgB;gBAChB,WAAW,EAAE,cAAc;aAC5B,CAAC;QACJ,CAAC;QAED,6CAA6C;QAC7C,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE,CAAC;YAC/B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;gBACjF,OAAO,EAAE,EAAE,OAAO,EAAE,+EAA+E,EAAE;aACtG,CAAC,CAAC;QACL,CAAC;QAED,4CAA4C;QAC5C,uFAAuF;QACvF,IAAI,OAAa,CAAC;QAClB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAO,gBAAgB,CAAC,KAAK,EAAE,EAAE,EAAE;gBACpF,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE;gBAClC,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,QAAQ,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;aACpC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;gBAC3D,+DAA+D;gBAC/D,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;gBAC/E,IAAI,CAAC,UAAU;oBAAE,MAAM,KAAK,CAAC;gBAC7B,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,EAAE,EAAE,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;gBACtH,MAAM,IAAI,CAAC,kBAAkB,CAAC,EAAE,EAAE,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,CAAC,cAAc,CAAC,CAAC;gBACjG,IAAI,CAAC,QAAQ,CAAC,2DAA2D,EAAE;oBACzE,MAAM,EAAE,UAAU,CAAC,GAAG;oBACtB,cAAc,EAAE,SAAS,CAAC,cAAc;iBACzC,CAAC,CAAC;gBACH,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;YAC3F,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,mEAAmE;QACnE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,EAAE,EAAE;gBAC5E,MAAM,EAAE,OAAO,CAAC,GAAG;gBACnB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,QAAQ,CAAC,sDAAsD,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACjG,CAAC;QAED,wBAAwB;QACxB,MAAM,IAAI,CAAC,mBAAmB,CAAC,EAAE,EAAE,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;QAE1F,uBAAuB;QACvB,MAAM,IAAI,CAAC,kBAAkB,CAAC,EAAE,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,CAAC,cAAc,CAAC,CAAC;QAE9F,6FAA6F;QAC7F,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,gBAAgB,CAAC,eAAe,CAAC;oBAC1C,MAAM,EAAE,OAAO,CAAC,GAAG;oBACnB,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,WAAW,EAAE,UAAU,CAAC,WAAW;oBACnC,cAAc,EAAE,iBAAiB,CAAC,UAAU;oBAC5C,UAAU,EAAE,UAAU,CAAC,MAAM;oBAC7B,cAAc,EAAE,SAAS,CAAC,cAAc;oBACxC,SAAS,EAAE,QAAQ;oBACnB,SAAS,EAAE,yBAAyB;oBACpC,SAAS,EAAE,cAAc,UAAU,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE;iBACjE,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC,QAAQ,CAAC,mDAAmD,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;YAC9F,CAAC;QACH,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,6CAA6C,EAAE;YAC3D,MAAM,EAAE,OAAO,CAAC,GAAG;YACnB,cAAc,EAAE,SAAS,CAAC,cAAc;YACxC,KAAK,EAAE,cAAc;SACtB,CAAC,CAAC;QAEH,OAAO;YACL,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,IAAI;YACX,gBAAgB,EAAE,IAAI;YACtB,WAAW,EAAE,cAAc;SAC5B,CAAC;IACJ,CAAC;IAED,kEAAkE;IAClE,yCAAyC;IACzC,kEAAkE;IAElE;;;OAGG;IACI,KAAK,CAAC,aAAa,CACxB,MAAc,EACd,KAA+F,EAC/F,UAAwC;QAExC,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QAEpD,IAAI,CAAC;YACH,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YAChH,IAAI,eAAe,EAAE,CAAC;gBACpB,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,EAAE,EAAG,eAAuB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACrH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,IAAI,CAAC,QAAQ,CAAC,wCAAwC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,6CAA6C;IAC7C,kEAAkE;IAElE;;;OAGG;IACI,KAAK,CAAC,iBAAiB,CAC5B,MAAc,EACd,SAAuC;QAEvC,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QAEpD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAO,gBAAgB,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QACxG,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;YAE/G,yEAAyE;YACzE,IAAI,CAAC;gBACH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,SAAS,CAAC,cAAc,EAAE,CAAC,CAAC;gBAC5J,IAAI,UAAU,EAAE,CAAC;oBACf,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,gBAAgB,CAAC,oBAAoB,EAAE,EAAE,EAAG,UAAkB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;oBACtI,IAAI,CAAC,QAAQ,CAAC,4BAA4B,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,SAAS,CAAC,cAAc,EAAE,CAAC,CAAC;gBACpG,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;oBAAE,MAAM,KAAK,CAAC;gBAC5C,IAAI,CAAC,QAAQ,CAAC,+EAA+E,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YAC7G,CAAC;YAED,kEAAkE;YAClE,IAAI,CAAC;gBACH,IAAI,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE,EAAE,CAAC;oBAC1C,MAAM,iBAAiB,GAAI,IAAI,CAAC,gBAAgB,CAAC,MAA2E,EAAE,iBAAiB,CAAC;oBAChJ,MAAM,eAAe,GAAI,IAAI,CAAC,gBAAgB,CAAC,MAA6F,EAAE,SAAS,CAAC;oBACxJ,MAAM,yBAAyB,CAAC,EAAE,EAAE;wBAClC,MAAM;wBACN,cAAc,EAAE,SAAS,CAAC,cAAc;wBACxC,iBAAiB;wBACjB,eAAe;wBACf,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;wBACrD,kBAAkB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;4BAChC,MAAM,IAAI,CAAC,WAAW,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC;wBACzD,CAAC;qBACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAAC,OAAO,WAAW,EAAE,CAAC;gBACrB,IAAI,mBAAmB,CAAC,WAAW,CAAC;oBAAE,MAAM,WAAW,CAAC;gBACxD,IAAI,CAAC,QAAQ,CAAC,0DAA0D,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YACxF,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,8CAA8C,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,eAAe;IACf,kEAAkE;IAElE;;;;;;;;;;;OAWG;IACI,QAAQ,CAAC,QAAkB,EAAE,WAAmC,EAAE,eAA0B;QACjG,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM;YAAE,OAAO,EAAE,CAAC;QAEpE,MAAM,WAAW,GAAa,EAAE,CAAC;QACjC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9C,IAAI,eAAe,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC1D,IAAI,CAAC,QAAQ,CAAC,iDAAiD,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;oBACnG,SAAS;gBACX,CAAC;gBACD,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,kEAAkE;IAClE,0BAA0B;IAC1B,kEAAkE;IAElE;;;;;OAKG;IACK,KAAK,CAAC,mBAAmB,CAC/B,EAAyB,EACzB,MAAc,EACd,cAAsB,EACtB,KAAe;QAEf,IAAI,CAAC;YACH,4BAA4B;YAC5B,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;YACtI,IAAI,cAAc,EAAE,CAAC;gBACnB,IAAI,CAAC,QAAQ,CAAC,uCAAuC,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;gBACnF,OAAO,KAAK,CAAC;YACf,CAAC;YAED,6DAA6D;YAC7D,IAAI,cAAc,GAAG,KAAK,CAAC;YAC3B,IAAI,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE,EAAE,CAAC;gBAC1C,MAAM,iBAAiB,GAAI,IAAI,CAAC,gBAAgB,CAAC,MAA2H,EAAE,iBAAiB,CAAC;gBAEhM,wDAAwD;gBACxD,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,iBAAiB,EAAE,CAAC;oBACrD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,cAAc,EAAE,CAA6B,CAAC;oBAC7I,IAAI,GAAG,EAAE,IAAI,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,iBAAiB,EAAE,CAAC;wBAChE,cAAc,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,iBAAkB,CAAC,CAAC;oBACpE,CAAC;gBACH,CAAC;gBAED,6EAA6E;gBAC7E,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,iBAAiB,EAAE,CAAC;oBACnD,MAAM,sBAAsB,CAAC,EAAE,EAAE;wBAC/B,cAAc;wBACd,KAAK,EAAE,cAAc;wBACrB,iBAAiB;wBACjB,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;wBACrD,YAAY,EAAE,IAAI,CAAC,YAAY;qBAChC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,wBAAwB;YACxB,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,gBAAgB,CAAC,oBAAoB,EAAE,EAAE,EAAE;gBACnF,MAAM;gBACN,cAAc;gBACd,KAAK,EAAE,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;gBAC7D,MAAM,EAAE,QAAQ;aACjB,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,iCAAiC,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;YAEpF,wEAAwE;YACxE,MAAM,iBAAiB,GAAG,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE;gBAC7D,CAAC,CAAE,IAAI,CAAC,gBAAgB,CAAC,MAA2E,EAAE,iBAAiB;gBACvH,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,uBAAuB,CAAC,EAAE,EAAE;gBAChC,MAAM;gBACN,cAAc;gBACd,iBAAiB;gBACjB,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;aACtD,CAAC,CAAC;YAEH,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,IAAI,CAAC,QAAQ,CAAC,0EAA0E,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;YACtH,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,yBAAyB;IACzB,kEAAkE;IAE1D,KAAK,CAAC,kBAAkB,CAC9B,EAAyB,EACzB,MAAc,EACd,OAA8B,EAC9B,UAAyC,EACzC,cAAsB;QAEtB,sDAAsD;QACtD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAmB,gBAAgB,CAAC,mBAAmB,EAAE,EAAE,EAAE;YACvH,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,cAAc,EAAE,YAAY;SAC7B,CAAC,CAAC;QAEH,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,aAAa,GAAG,YAAY,CAAC,aAAa,EAAE,WAAW,EAAE,CAAC;YAChE,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC;YAC9C,MAAM,YAAY,GAAG,aAAa,IAAI,IAAI,IAAI,QAAQ,IAAI,IAAI,IAAI,aAAa,KAAK,QAAQ,CAAC;YAE7F,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,gBAAgB,CAAC,mBAAmB,EAAE,EAAE,EAAE,YAAY,CAAC,GAAG,EAAE;gBACpG,UAAU,EAAE,IAAI,IAAI,EAAE;gBACtB,aAAa,EAAE,OAAO,CAAC,KAAK;gBAC5B,mBAAmB,EAAE,OAAO,CAAC,WAAW;gBACxC,iBAAiB,EAAE,OAAO,CAAC,SAAS;gBACpC,kBAAkB,EAAE,OAAO,CAAC,SAAS;aACtC,CAAC,CAAC;YAEH,IAAI,YAAY,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBACjD,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAChC,sBAAsB,CAAC,kBAAkB,EACzC,0BAA0B,CAAC,MAAM,EACjC;oBACE,MAAM,EAAE,YAAY,CAAC,MAAM;oBAC3B,cAAc;oBACd,YAAY,EAAE,UAAU,CAAC,YAAY,EAAE,YAAY;oBACnD,WAAW,EAAE,UAAU,CAAC,WAAW;oBACnC,aAAa;oBACb,QAAQ;iBACT,CACF,CAAC,KAAK,CAAC,GAAG,EAAE,GAAyB,CAAC,CAAC,CAAC;YAC3C,CAAC;YACD,OAAO;QACT,CAAC;QAED,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,gBAAgB,CAAC,mBAAmB,EAAE,EAAE,EAAE;YAClF,MAAM;YACN,cAAc,EAAE,YAAY;YAC5B,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,aAAa,EAAE,OAAO,CAAC,KAAK;YAC5B,mBAAmB,EAAE,OAAO,CAAC,WAAW;YACxC,iBAAiB,EAAE,OAAO,CAAC,SAAS;YACpC,kBAAkB,EAAE,OAAO,CAAC,SAAS;YACrC,cAAc;YACd,YAAY,EAAE,UAAU,CAAC,YAAY,EAAE,YAAY;YACnD,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,kEAAkE;IAClE,6BAA6B;IAC7B,kEAAkE;IAElE;;;;;OAKG;IACK,KAAK,CAAC,2BAA2B;QACvC,OAAO,IAAI,CAAC,aAAa,CAAC,4BAA4B,CAAC,IAAI,CAAC,aAAa,CAAC,2BAA2B,EAAE,CAAC,CAAC;IAC3G,CAAC;CACF,CAAA;AArbY,wCAAwC;IADpD,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IACzD,WAAA,MAAM,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,CAAA;IACtD,WAAA,MAAM,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAA;IAC1C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,CAAA;qCAPW,aAAa;QACM,0BAA0B,YAEjB,yCAAyC,YAEjD,uBAAuB;GAT9F,wCAAwC,CAqbpD"}

package/dist/esm/security/authentications/services/admin-config/oidc-discovery.backend.service.d.ts

@@ -0,0 +1,67 @@
+/**
+ * OIDCDiscoveryBackendService
+ *
+ * Fetches and caches OIDC discovery documents (.well-known/openid-configuration).
+ * Also handles template variable resolution for enterprise OIDC connections
+ * (e.g., Microsoft {tenant} substitution in URLs).
+ *
+ * Step 13: Enterprise SSO — OIDC Discovery Service
+ * DI Symbol: OIDCDiscoveryService
+ * Used by: Step 15 enterprise resolver (resolveEnterpriseConnection)
+ */
+import 'reflect-metadata';
+import { LoggerService } from '../../../../monitoring/logger/services/logger.service.js';
+import { ErrorBuilderBackendService } from '../../../../errors/services/error-builder.backend.service.js';
+import { RedisService } from '../../../../databases/services/redis.service.js';
+/** Parsed OIDC discovery document — standard fields from RFC 8414 / OpenID Connect Discovery 1.0 */
+export interface OIDCDiscoveryDocument {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    userinfo_endpoint?: string;
+    jwks_uri: string;
+    end_session_endpoint?: string;
+    scopes_supported?: string[];
+    response_types_supported?: string[];
+    grant_types_supported?: string[];
+    token_endpoint_auth_methods_supported?: string[];
+    subject_types_supported?: string[];
+    id_token_signing_alg_values_supported?: string[];
+}
+export declare class OIDCDiscoveryBackendService {
+    private readonly logger;
+    private readonly errorBuilder;
+    private readonly redis;
+    private readonly logDebug;
+    constructor(logger: LoggerService, errorBuilder: ErrorBuilderBackendService, redis: RedisService);
+    /**
+     * Discover OIDC endpoints from an issuer's .well-known/openid-configuration.
+     * Results are cached in Redis for 24 hours to avoid repeated HTTP calls.
+     *
+     * @param issuerUrl - The OIDC issuer URL (e.g., https://accounts.google.com)
+     * @returns Parsed OIDC discovery document
+     */
+    discoverEndpoints(issuerUrl: string): Promise<OIDCDiscoveryDocument>;
+    /**
+     * Invalidate the cached discovery document for an issuer.
+     * Useful when an admin updates their IdP configuration.
+     */
+    invalidateCache(issuerUrl: string): Promise<void>;
+    /**
+     * Apply template variable substitution to a URL.
+     * Replaces `{variableName}` placeholders with values from the overrides map.
+     *
+     * Example: Microsoft's authorization URL
+     *   https://login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize
+     *   + templateOverrides: { tenant: 'acme-corp-tenant-id' }
+     *   = https://login.microsoftonline.com/acme-corp-tenant-id/oauth2/v2.0/authorize
+     */
+    resolveTemplateUrl(urlTemplate: string, templateOverrides: Record<string, string>): string;
+    /**
+     * Apply template variable substitution to all extra auth params.
+     * Used to substitute values like `hd={domain}` for Google domain hint.
+     */
+    resolveTemplateParams(params: Record<string, string>, templateOverrides: Record<string, string>): Record<string, string>;
+    private validateDiscoveryDocument;
+}
+//# sourceMappingURL=oidc-discovery.backend.service.d.ts.map

package/dist/esm/security/authentications/services/admin-config/oidc-discovery.backend.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-discovery.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/admin-config/oidc-discovery.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,kBAAkB,CAAC;AAG1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AAOnF,oGAAoG;AACpG,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,sBAAsB,EAAE,MAAM,CAAC;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAC;IACpC,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC,qCAAqC,CAAC,EAAE,MAAM,EAAE,CAAC;IACjD,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAC;IACnC,qCAAqC,CAAC,EAAE,MAAM,EAAE,CAAC;CAClD;AAQD,qBACa,2BAA2B;IAID,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IACpC,OAAO,CAAC,QAAQ,CAAC,KAAK;IALjE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EAC/C,KAAK,EAAE,YAAY;IAU/E;;;;;;OAMG;IACU,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IA8DjF;;;OAGG;IACU,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAW9D;;;;;;;;OAQG;IACI,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM;IAQjG;;;OAGG;IACI,qBAAqB,CAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACxC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAYzB,OAAO,CAAC,yBAAyB;CAkElC"}