@wildo-ai/saas-backend-lib 1.0.1

package/dist/esm/security/authentications/services/auth-methods/auth-method-management.backend.service.js

@@ -0,0 +1,459 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import 'reflect-metadata';
+import { inject, injectable } from 'inversify';
+import { SAAS_SERVICE_TYPES } from '../../../../inject/models/service-types.js';
+import { ErrorBuilderBackendService } from '../../../../errors/services/error-builder.backend.service.js';
+import { AuthCredentialVerifierBackendService } from '../../../../security/authentications/services/auth-credential-verifier.backend.service.js';
+import { AppConfigurationService } from '../../../../config/services/app-configuration.backend.service.js';
+import { AuditLogsBackendService } from '../../../../compliance/audit-trails/services/audit-logs.backend.service.js';
+import { ConsumableTokenBackendService } from '../../../../security/consumable-tokens/services/consumable-token.backend.service.js';
+import { AuthTokenIssuerBackendService } from '../../../../security/authentications/services/auth-token-issuer.backend.service.js';
+import { AuthUserLookupBackendService } from '../../../../security/authentications/services/utils/auth-user-lookup.backend.service.js';
+import { LoggerService } from '../../../../monitoring/logger/services/logger.service.js';
+import { CoreResourceType, ErrorType, ErrorCustomMessageReference, isWildoBackendError, AuthMethod, CoreConsumableTokenTypes, ConsumableToken_ConsumptionMode, } from '@wildo-ai/saas-models';
+import { DurationUnit } from '@wildo-ai/zod-decorators';
+let AuthMethodManagementBackendService = class AuthMethodManagementBackendService {
+    logger;
+    errorBuilder;
+    servicesRegistryHandler;
+    credentialVerifier;
+    appConfigService;
+    auditLogsService;
+    consumableTokenService;
+    tokenIssuer;
+    userLookup;
+    logDebug;
+    constructor(logger, errorBuilder, servicesRegistryHandler, credentialVerifier, appConfigService, auditLogsService, consumableTokenService, tokenIssuer, userLookup) {
+        this.logger = logger;
+        this.errorBuilder = errorBuilder;
+        this.servicesRegistryHandler = servicesRegistryHandler;
+        this.credentialVerifier = credentialVerifier;
+        this.appConfigService = appConfigService;
+        this.auditLogsService = auditLogsService;
+        this.consumableTokenService = consumableTokenService;
+        this.tokenIssuer = tokenIssuer;
+        this.userLookup = userLookup;
+        this.logDebug = this.logger.debugByType('AuthMethodManagementBackendService');
+        this.logger.setDebugTypeLogging('AuthMethodManagementBackendService', true);
+    }
+    // ==========================================================================
+    // INTERNAL HELPERS
+    // ==========================================================================
+    maskPhone(phone) {
+        if (!phone || phone.length < 4)
+            return '****';
+        return `***${phone.slice(-4)}`;
+    }
+    /**
+     * W6.8 + AUTH-14: Resolve effective auth policy for a user, including org override merging.
+     * Falls back to null if the user or user type is not found.
+     */
+    async _resolveUserTypePolicy(ec, userId) {
+        try {
+            const user = await this.servicesRegistryHandler.read(CoreResourceType.USERS, ec, { _id: userId });
+            if (user?.userTypes?.length) {
+                return this.userLookup.resolveEffectiveAuthPolicy(ec, userId, user.userTypes[0]);
+            }
+        }
+        catch {
+            // Suppress — non-fatal, will use defaults
+        }
+        return null;
+    }
+    async enforceUserMethodRemovalAllowed(ec, userId) {
+        const policy = await this._resolveUserTypePolicy(ec, userId);
+        const methodManagement = policy?.methodManagement;
+        if (methodManagement && !methodManagement.allowUserMethodRemoval) {
+            throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {
+                customMessageReference: ErrorCustomMessageReference.AUTHORIZATION,
+                context: { reason: 'User-initiated auth method removal is disabled by policy' },
+            });
+        }
+    }
+    // ==========================================================================
+    // PASSWORD MANAGEMENT
+    // ==========================================================================
+    async changePassword(ec, userId, currentPassword, newPassword, ipAddress, userAgent) {
+        try {
+            const credentials = await this.credentialVerifier.resolveCredentials(ec, userId);
+            if (!credentials || !credentials.passwordHash) {
+                throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {
+                    customMessageReference: ErrorCustomMessageReference.VALIDATION,
+                    context: { reason: 'No password set. Use /auth/password/set instead' },
+                });
+            }
+            const isCurrentValid = await this.credentialVerifier.verifyPassword(credentials.passwordHash, currentPassword);
+            if (!isCurrentValid) {
+                throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {
+                    customMessageReference: ErrorCustomMessageReference.VALIDATION,
+                    context: { reason: 'Current password is incorrect' },
+                });
+            }
+            const userTypePolicy = await this._resolveUserTypePolicy(ec, userId);
+            const passwordPolicy = userTypePolicy?.passwordPolicy;
+            const policyResult = this.credentialVerifier.validatePasswordPolicy(newPassword, passwordPolicy);
+            if (!policyResult.valid) {
+                throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {
+                    customMessageReference: ErrorCustomMessageReference.VALIDATION_PASSWORD_POLICY_VIOLATION,
+                    context: { violations: policyResult.violations, minLength: passwordPolicy?.minLength, maxLength: passwordPolicy?.maxLength },
+                });
+            }
+            const newPasswordHash = await this.credentialVerifier.hashPassword(newPassword, this.appConfigService.config.auth.passwordHashing);
+            await this.tokenIssuer.invalidateAllTokensForUser(userId);
+            await this.credentialVerifier.updatePasswordHash(ec, userId, newPasswordHash);
+            await this.auditLogsService.logUserPasswordChanged({ userId: userId, ipAddress, userAgent });
+        }
+        catch (error) {
+            if (isWildoBackendError(error))
+                throw error;
+            throw this.errorBuilder.buildError(ErrorType.INTERNAL, undefined, {
+                context: { reason: 'Failed to change password', error: String(error) },
+            });
+        }
+    }
+    async setPassword(ec, userId, newPassword, ipAddress, userAgent) {
+        try {
+            const credentials = await this.credentialVerifier.resolveCredentials(ec, userId);
+            if (credentials?.passwordHash) {
+                throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {
+                    customMessageReference: ErrorCustomMessageReference.VALIDATION,
+                    context: { reason: 'Password already set. Use /auth/password/change instead' },
+                });
+            }
+            const userTypePolicy = await this._resolveUserTypePolicy(ec, userId);
+            const passwordPolicy = userTypePolicy?.passwordPolicy;
+            const policyResult = this.credentialVerifier.validatePasswordPolicy(newPassword, passwordPolicy);
+            if (!policyResult.valid) {
+                throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {
+                    customMessageReference: ErrorCustomMessageReference.VALIDATION_PASSWORD_POLICY_VIOLATION,
+                    context: { violations: policyResult.violations, minLength: passwordPolicy?.minLength, maxLength: passwordPolicy?.maxLength },
+                });
+            }
+            const newPasswordHash = await this.credentialVerifier.hashPassword(newPassword, this.appConfigService.config.auth.passwordHashing);
+            await this.credentialVerifier.updatePasswordHash(ec, userId, newPasswordHash);
+            await this.auditLogsService.logUserPasswordSet({ userId: userId, ipAddress, userAgent });
+        }
+        catch (error) {
+            if (isWildoBackendError(error))
+                throw error;
+            throw this.errorBuilder.buildError(ErrorType.INTERNAL, undefined, {
+                context: { reason: 'Failed to set password', error: String(error) },
+            });
+        }
+    }
+    // ==========================================================================
+    // TOTP MANAGEMENT
+    // ==========================================================================
+    async disableTotp(ec, userId, reAuthToken, ipAddress, userAgent) {
+        try {
+            await this.enforceUserMethodRemovalAllowed(ec, userId);
+            const userTypePolicy = await this._resolveUserTypePolicy(ec, userId);
+            if (userTypePolicy?.methodManagement?.requireReauthForMethodChanges) {
+                if (!reAuthToken) {
+                    throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {
+                        context: { reason: 'Re-authentication is required for this action' },
+                    });
+                }
+                try {
+                    await this.consumableTokenService.validateToken(reAuthToken, [CoreConsumableTokenTypes.REAUTH]);
+                    const token = await this.consumableTokenService.consumeToken(reAuthToken);
+                    if (token.userId !== userId) {
+                        throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {
+                            context: { reason: 'Re-authentication token does not belong to this user' },
+                        });
+                    }
+                }
+                catch (error) {
+                    if (isWildoBackendError(error))
+                        throw error;
+                    throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {
+                        context: { reason: 'Invalid or expired re-authentication token' },
+                    });
+                }
+            }
+            const credentials = await this.credentialVerifier.resolveCredentials(ec, userId);
+            if (!credentials?.totpVerified) {
+                throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {
+                    customMessageReference: ErrorCustomMessageReference.VALIDATION,
+                    context: { reason: 'TOTP is not enabled' },
+                });
+            }
+            const mfaRequired = !!userTypePolicy?.mfaPolicy?.requireMFA;
+            if (mfaRequired) {
+                const hasOtherMFA = (credentials.passkeyCredentials?.length ?? 0) > 0 ||
+                    credentials.phoneNumberVerified === true;
+                if (!hasOtherMFA) {
+                    throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {
+                        customMessageReference: ErrorCustomMessageReference.VALIDATION,
+                        context: { reason: 'Cannot disable your only MFA method while MFA is required' },
+                    });
+                }
+            }
+            await this.servicesRegistryHandler.update(CoreResourceType.USER_CREDENTIALS, ec, { userId: userId }, {
+                secretBase32: null,
+                totpVerified: false,
+                backupCodesHashed: [],
+                totpVerifiedAt: null,
+            });
+            await this.auditLogsService.logUserTOTPDisabled({ userId: userId, ipAddress, userAgent });
+        }
+        catch (error) {
+            if (isWildoBackendError(error))
+                throw error;
+            throw this.errorBuilder.buildError(ErrorType.INTERNAL, undefined, {
+                context: { reason: 'Failed to disable TOTP', error: String(error) },
+            });
+        }
+    }
+    // ==========================================================================
+    // METHOD INTROSPECTION
+    // ==========================================================================
+    async getMyMethods(ec, userId) {
+        try {
+            const credentials = await this.credentialVerifier.resolveCredentials(ec, userId);
+            const identityLinks = await this.servicesRegistryHandler.list(CoreResourceType.USER_IDENTITY_LINKS, ec, { userId }, undefined, { paginated: false }) ?? [];
+            const userTypePolicy = await this._resolveUserTypePolicy(ec, userId);
+            const authMethodsEnabled = userTypePolicy?.authMethodsEnabled;
+            const allMethods = [];
+            const shouldInclude = (method) => {
+                if (!authMethodsEnabled)
+                    return true;
+                return !!authMethodsEnabled[method];
+            };
+            if (shouldInclude(AuthMethod.PASSWORD)) {
+                allMethods.push({
+                    method: AuthMethod.PASSWORD,
+                    enrolled: !!credentials?.passwordHash,
+                });
+            }
+            if (shouldInclude(AuthMethod.TOTP)) {
+                allMethods.push({
+                    method: AuthMethod.TOTP,
+                    enrolled: credentials?.totpVerified === true,
+                    enrolledAt: credentials?.totpVerifiedAt ?? undefined,
+                });
+            }
+            if (shouldInclude(AuthMethod.PASSKEY)) {
+                allMethods.push({
+                    method: AuthMethod.PASSKEY,
+                    enrolled: (credentials?.passkeyCredentials?.length ?? 0) > 0,
+                    details: { passkeyCount: credentials?.passkeyCredentials?.length ?? 0 },
+                });
+            }
+            if (shouldInclude(AuthMethod.SMS_OTP)) {
+                allMethods.push({
+                    method: AuthMethod.SMS_OTP,
+                    enrolled: credentials?.phoneNumberVerified === true,
+                    details: credentials?.phoneNumberVerified
+                        ? { phoneNumber: this.maskPhone(credentials.phoneNumber) }
+                        : undefined,
+                });
+            }
+            if (shouldInclude(AuthMethod.EMAIL_OTP)) {
+                allMethods.push({
+                    method: AuthMethod.EMAIL_OTP,
+                    enrolled: true,
+                });
+            }
+            if (shouldInclude(AuthMethod.MAGIC_LINK)) {
+                allMethods.push({
+                    method: AuthMethod.MAGIC_LINK,
+                    enrolled: true,
+                });
+            }
+            if (shouldInclude(AuthMethod.EXTERNAL_OAUTH2)) {
+                const socialLinks = identityLinks.filter((l) => l.connectionType === 'social');
+                allMethods.push({
+                    method: AuthMethod.EXTERNAL_OAUTH2,
+                    enrolled: socialLinks.length > 0,
+                    details: socialLinks.length > 0
+                        ? { providerName: socialLinks[0]?.providerRef }
+                        : undefined,
+                });
+            }
+            if (shouldInclude(AuthMethod.ORG_SAML)) {
+                allMethods.push({
+                    method: AuthMethod.ORG_SAML,
+                    enrolled: identityLinks.some((l) => l.connectionType === 'enterprise' && (l.protocol === 'SAML' || l.providerRef?.includes('saml'))),
+                });
+            }
+            if (shouldInclude(AuthMethod.ORG_OPENID_CONNECT)) {
+                allMethods.push({
+                    method: AuthMethod.ORG_OPENID_CONNECT,
+                    enrolled: identityLinks.some((l) => l.connectionType === 'enterprise' && (l.protocol === 'OIDC' || l.providerRef?.includes('oidc'))),
+                });
+            }
+            return { methods: allMethods };
+        }
+        catch (error) {
+            if (isWildoBackendError(error))
+                throw error;
+            throw this.errorBuilder.buildError(ErrorType.INTERNAL, undefined, {
+                context: { reason: 'Failed to get auth methods', error: String(error) },
+            });
+        }
+    }
+    // ==========================================================================
+    // IDENTITY LINKS
+    // ==========================================================================
+    async getIdentityLinks(ec, userId) {
+        try {
+            const rawLinks = await this.servicesRegistryHandler.list(CoreResourceType.USER_IDENTITY_LINKS, ec, { userId }, undefined, { paginated: false }) ?? [];
+            const links = rawLinks.map((link) => ({
+                _id: link._id,
+                connectionType: link.connectionType,
+                providerRef: link.providerRef,
+                providerEmail: link.providerEmail,
+                providerDisplayName: link.providerDisplayName,
+                linkedAt: link.createdAt,
+                lastUsedAt: link.updatedAt,
+            }));
+            return { links };
+        }
+        catch (error) {
+            if (isWildoBackendError(error))
+                throw error;
+            throw this.errorBuilder.buildError(ErrorType.INTERNAL, undefined, {
+                context: { reason: 'Failed to get identity links', error: String(error) },
+            });
+        }
+    }
+    async unlinkIdentityLink(ec, userId, linkId, ipAddress, userAgent) {
+        try {
+            await this.enforceUserMethodRemovalAllowed(ec, userId);
+            const link = await this.servicesRegistryHandler.read(CoreResourceType.USER_IDENTITY_LINKS, ec, { _id: linkId });
+            if (!link) {
+                throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {
+                    context: { reason: 'Identity link not found' },
+                });
+            }
+            if (link.userId !== userId) {
+                throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {
+                    context: { reason: 'Identity link not found' },
+                });
+            }
+            const authMethodCounts = await this.countAuthMethods(ec, userId);
+            if (authMethodCounts.total <= 1) {
+                throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {
+                    customMessageReference: ErrorCustomMessageReference.VALIDATION,
+                    context: { reason: 'Cannot remove your only authentication method' },
+                });
+            }
+            await this.servicesRegistryHandler.delete(CoreResourceType.USER_IDENTITY_LINKS, ec, linkId);
+            await this.auditLogsService.logUserIdentityLinkRemoved({
+                userId: userId,
+                linkId,
+                providerRef: link.providerRef,
+                ipAddress,
+                userAgent,
+            });
+        }
+        catch (error) {
+            if (isWildoBackendError(error))
+                throw error;
+            throw this.errorBuilder.buildError(ErrorType.INTERNAL, undefined, {
+                context: { reason: 'Failed to unlink identity link', error: String(error) },
+            });
+        }
+    }
+    // ==========================================================================
+    // RE-AUTHENTICATION
+    // ==========================================================================
+    async reAuthenticate(ec, userId, method, password, passkeyResponse, ipAddress, userAgent) {
+        try {
+            if (method === 'PASSWORD') {
+                if (!password) {
+                    throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {
+                        context: { reason: 'Password is required for password re-authentication' },
+                    });
+                }
+                const credentials = await this.credentialVerifier.resolveCredentials(ec, userId);
+                if (!credentials?.passwordHash) {
+                    throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {
+                        context: { reason: 'No password set for this account' },
+                    });
+                }
+                const isValid = await this.credentialVerifier.verifyPassword(credentials.passwordHash, password);
+                if (!isValid) {
+                    throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {
+                        context: { reason: 'Invalid password' },
+                    });
+                }
+            }
+            else if (method === 'PASSKEY') {
+                throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {
+                    context: { reason: 'Passkey re-authentication is not yet supported' },
+                });
+            }
+            else {
+                throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {
+                    context: { reason: `Unsupported re-authentication method: ${method}` },
+                });
+            }
+            const token = await this.consumableTokenService.createToken({
+                tokenType: CoreConsumableTokenTypes.REAUTH,
+                consumptionMode: ConsumableToken_ConsumptionMode.SINGLE_USE,
+                expiresIn: { value: 5, unit: DurationUnit.MINUTES },
+                userId: userId,
+                resourceIdentifier: CoreResourceType.USERS,
+                relatedId: userId,
+            });
+            return { reAuthToken: token.token };
+        }
+        catch (error) {
+            if (isWildoBackendError(error))
+                throw error;
+            throw this.errorBuilder.buildError(ErrorType.INTERNAL, undefined, {
+                context: { reason: 'Failed to re-authenticate', error: String(error) },
+            });
+        }
+    }
+    // ==========================================================================
+    // AUTH METHOD COUNTING (D9 Safety Check)
+    // ==========================================================================
+    async countAuthMethods(ec, userId) {
+        const credentials = await this.credentialVerifier.resolveCredentials(ec, userId);
+        const passwordCount = credentials?.passwordHash ? 1 : 0;
+        const passkeyCount = credentials?.passkeyCredentials?.length ?? 0;
+        const identityLinks = await this.servicesRegistryHandler.list(CoreResourceType.USER_IDENTITY_LINKS, ec, { userId }, undefined, { paginated: false }) ?? [];
+        const identityLinkCount = identityLinks.length;
+        return {
+            passwordCount,
+            passkeyCount,
+            identityLinkCount,
+            total: passwordCount + passkeyCount + identityLinkCount,
+        };
+    }
+};
+AuthMethodManagementBackendService = __decorate([
+    injectable(),
+    __param(0, inject(SAAS_SERVICE_TYPES.Logger)),
+    __param(1, inject(SAAS_SERVICE_TYPES.ErrorBuilderService)),
+    __param(2, inject(SAAS_SERVICE_TYPES.ServicesRegistryHandlerService)),
+    __param(3, inject(SAAS_SERVICE_TYPES.AuthCredentialVerifier)),
+    __param(4, inject(SAAS_SERVICE_TYPES.AppConfigService)),
+    __param(5, inject(SAAS_SERVICE_TYPES.AuditLogsService)),
+    __param(6, inject(SAAS_SERVICE_TYPES.ConsumableTokenService)),
+    __param(7, inject(SAAS_SERVICE_TYPES.AuthTokenIssuer)),
+    __param(8, inject(SAAS_SERVICE_TYPES.AuthUserLookupService)),
+    __metadata("design:paramtypes", [LoggerService,
+        ErrorBuilderBackendService, Function, AuthCredentialVerifierBackendService,
+        AppConfigurationService,
+        AuditLogsBackendService,
+        ConsumableTokenBackendService,
+        AuthTokenIssuerBackendService,
+        AuthUserLookupBackendService])
+], AuthMethodManagementBackendService);
+export { AuthMethodManagementBackendService };
+//# sourceMappingURL=auth-method-management.backend.service.js.map

package/dist/esm/security/authentications/services/auth-methods/auth-method-management.backend.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-method-management.backend.service.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/auth-methods/auth-method-management.backend.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAE9G,OAAO,EAAE,oCAAoC,EAAE,MAAM,+FAA+F,CAAC;AACrJ,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AACzH,OAAO,EAAE,6BAA6B,EAAE,MAAM,yFAAyF,CAAC;AACxI,OAAO,EAAE,6BAA6B,EAAE,MAAM,wFAAwF,CAAC;AACvI,OAAO,EAAE,4BAA4B,EAAE,MAAM,6FAA6F,CAAC;AAC3I,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EACL,gBAAgB,EAChB,SAAS,EACT,2BAA2B,EAC3B,mBAAmB,EACnB,UAAU,EACV,wBAAwB,EACxB,+BAA+B,GAChC,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAIjD,IAAM,kCAAkC,GAAxC,MAAM,kCAAkC;IAIS;IACa;IACW;IACR;IACN;IACA;IACM;IACP;IACM;IAXpD,QAAQ,CAA+D;IAExF,YACsD,MAAqB,EACR,YAAwC,EAC7B,uBAA8D,EACtE,kBAAwD,EAC9D,gBAAyC,EACzC,gBAAyC,EACnC,sBAAqD,EAC5D,WAA0C,EACpC,UAAwC;QARvD,WAAM,GAAN,MAAM,CAAe;QACR,iBAAY,GAAZ,YAAY,CAA4B;QAC7B,4BAAuB,GAAvB,uBAAuB,CAAuC;QACtE,uBAAkB,GAAlB,kBAAkB,CAAsC;QAC9D,qBAAgB,GAAhB,gBAAgB,CAAyB;QACzC,qBAAgB,GAAhB,gBAAgB,CAAyB;QACnC,2BAAsB,GAAtB,sBAAsB,CAA+B;QAC5D,gBAAW,GAAX,WAAW,CAA+B;QACpC,eAAU,GAAV,UAAU,CAA8B;QAE3G,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,oCAAoC,CAAC,CAAC;QAC9E,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,oCAAoC,EAAE,IAAI,CAAC,CAAC;IAC9E,CAAC;IAED,6EAA6E;IAC7E,mBAAmB;IACnB,6EAA6E;IAErE,SAAS,CAAC,KAAa;QAC7B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,MAAM,CAAC;QAC9C,OAAO,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjC,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,sBAAsB,CAAC,EAAyB,EAAE,MAAc;QAC5E,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAA2B,gBAAgB,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5H,IAAI,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAC,UAAU,CAAC,0BAA0B,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;YACnF,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,0CAA0C;QAC5C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,KAAK,CAAC,+BAA+B,CAAC,EAAyB,EAAE,MAAc;QACpF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC7D,MAAM,gBAAgB,GAAG,MAAM,EAAE,gBAAgB,CAAC;QAClD,IAAI,gBAAgB,IAAI,CAAC,gBAAgB,CAAC,sBAAsB,EAAE,CAAC;YACjE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE,EAAE,MAAM,EAAE,0DAA0D,EAAE;aAChF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,sBAAsB;IACtB,6EAA6E;IAEtE,KAAK,CAAC,cAAc,CACzB,EAAyB,EACzB,MAAc,EACd,eAAuB,EACvB,WAAmB,EACnB,SAAiB,EACjB,SAAiB;QAEjB,IAAI,CAAC;YAEH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAEjF,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;gBAC9C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;oBAC9D,OAAO,EAAE,EAAE,MAAM,EAAE,iDAAiD,EAAE;iBACvE,CAAC,CAAC;YACL,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,cAAc,CACjE,WAAW,CAAC,YAAY,EAAE,eAAe,CAC1C,CAAC;YACF,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;oBAC9D,OAAO,EAAE,EAAE,MAAM,EAAE,+BAA+B,EAAE;iBACrD,CAAC,CAAC;YACL,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACrE,MAAM,cAAc,GAAG,cAAc,EAAE,cAAc,CAAC;YACtD,MAAM,YAAY,GAAG,IAAI,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;YACjG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;gBACxB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EAAE,2BAA2B,CAAC,oCAAoC;oBACxF,OAAO,EAAE,EAAE,UAAU,EAAE,YAAY,CAAC,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE;iBAC7H,CAAC,CAAC;YACL,CAAC;YAED,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACnI,MAAM,IAAI,CAAC,WAAW,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC;YAC1D,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;YAE9E,MAAM,IAAI,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;QAC/F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE;gBAChE,OAAO,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE;aACvE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,WAAW,CACtB,EAAyB,EACzB,MAAc,EACd,WAAmB,EACnB,SAAiB,EACjB,SAAiB;QAEjB,IAAI,CAAC;YAEH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAEjF,IAAI,WAAW,EAAE,YAAY,EAAE,CAAC;gBAC9B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;oBAC9D,OAAO,EAAE,EAAE,MAAM,EAAE,yDAAyD,EAAE;iBAC/E,CAAC,CAAC;YACL,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACrE,MAAM,cAAc,GAAG,cAAc,EAAE,cAAc,CAAC;YACtD,MAAM,YAAY,GAAG,IAAI,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;YACjG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;gBACxB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EAAE,2BAA2B,CAAC,oCAAoC;oBACxF,OAAO,EAAE,EAAE,UAAU,EAAE,YAAY,CAAC,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE;iBAC7H,CAAC,CAAC;YACL,CAAC;YAED,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACnI,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;YAE9E,MAAM,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;QAC3F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE;gBAChE,OAAO,EAAE,EAAE,MAAM,EAAE,wBAAwB,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE;aACpE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,kBAAkB;IAClB,6EAA6E;IAEtE,KAAK,CAAC,WAAW,CACtB,EAAyB,EACzB,MAAc,EACd,WAA+B,EAC/B,SAAiB,EACjB,SAAiB;QAEjB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,+BAA+B,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAEvD,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAErE,IAAI,cAAc,EAAE,gBAAgB,EAAE,6BAA6B,EAAE,CAAC;gBACpE,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,OAAO,EAAE,EAAE,MAAM,EAAE,+CAA+C,EAAE;qBACrE,CAAC,CAAC;gBACL,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,sBAAsB,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC;oBAChG,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;oBAC1E,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;wBAC5B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;4BACrE,OAAO,EAAE,EAAE,MAAM,EAAE,sDAAsD,EAAE;yBAC5E,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;wBAAE,MAAM,KAAK,CAAC;oBAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,OAAO,EAAE,EAAE,MAAM,EAAE,4CAA4C,EAAE;qBAClE,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAEjF,IAAI,CAAC,WAAW,EAAE,YAAY,EAAE,CAAC;gBAC/B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;oBAC9D,OAAO,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE;iBAC3C,CAAC,CAAC;YACL,CAAC;YAED,MAAM,WAAW,GAAG,CAAC,CAAC,cAAc,EAAE,SAAS,EAAE,UAAU,CAAC;YAC5D,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,WAAW,GACf,CAAC,WAAW,CAAC,kBAAkB,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;oBACjD,WAAW,CAAC,mBAAmB,KAAK,IAAI,CAAC;gBAE3C,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;wBAClE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;wBAC9D,OAAO,EAAE,EAAE,MAAM,EAAE,2DAA2D,EAAE;qBACjF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;gBACnG,YAAY,EAAE,IAAI;gBAClB,YAAY,EAAE,KAAK;gBACnB,iBAAiB,EAAE,EAAE;gBACrB,cAAc,EAAE,IAAI;aACrB,CAAC,CAAC;YAEH,MAAM,IAAI,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;QAC5F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE;gBAChE,OAAO,EAAE,EAAE,MAAM,EAAE,wBAAwB,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE;aACpE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,uBAAuB;IACvB,6EAA6E;IAEtE,KAAK,CAAC,YAAY,CACvB,EAAyB,EACzB,MAAc;QAEd,IAAI,CAAC;YAEH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAEjF,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,gBAAgB,CAAC,mBAAmB,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAU,IAAI,EAAE,CAAC;YAEpK,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACrE,MAAM,kBAAkB,GAAG,cAAc,EAAE,kBAAkB,CAAC;YAE9D,MAAM,UAAU,GAAuG,EAAE,CAAC;YAE1H,MAAM,aAAa,GAAG,CAAC,MAAkB,EAAW,EAAE;gBACpD,IAAI,CAAC,kBAAkB;oBAAE,OAAO,IAAI,CAAC;gBACrC,OAAO,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;YACtC,CAAC,CAAC;YAEF,IAAI,aAAa,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvC,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,QAAQ;oBAC3B,QAAQ,EAAE,CAAC,CAAC,WAAW,EAAE,YAAY;iBACtC,CAAC,CAAC;YACL,CAAC;YAED,IAAI,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnC,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,IAAI;oBACvB,QAAQ,EAAE,WAAW,EAAE,YAAY,KAAK,IAAI;oBAC5C,UAAU,EAAE,WAAW,EAAE,cAAc,IAAI,SAAS;iBACrD,CAAC,CAAC;YACL,CAAC;YAED,IAAI,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtC,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,OAAO;oBAC1B,QAAQ,EAAE,CAAC,WAAW,EAAE,kBAAkB,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;oBAC5D,OAAO,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,IAAI,CAAC,EAAE;iBACxE,CAAC,CAAC;YACL,CAAC;YAED,IAAI,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtC,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,OAAO;oBAC1B,QAAQ,EAAE,WAAW,EAAE,mBAAmB,KAAK,IAAI;oBACnD,OAAO,EAAE,WAAW,EAAE,mBAAmB;wBACvC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,WAAY,CAAC,EAAE;wBAC3D,CAAC,CAAC,SAAS;iBACd,CAAC,CAAC;YACL,CAAC;YAED,IAAI,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBACxC,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,SAAS;oBAC5B,QAAQ,EAAE,IAAI;iBACf,CAAC,CAAC;YACL,CAAC;YAED,IAAI,aAAa,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBACzC,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,UAAU;oBAC7B,QAAQ,EAAE,IAAI;iBACf,CAAC,CAAC;YACL,CAAC;YAED,IAAI,aAAa,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;gBAC9C,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC;gBACpF,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,eAAe;oBAClC,QAAQ,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC;oBAChC,OAAO,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC;wBAC7B,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE;wBAC/C,CAAC,CAAC,SAAS;iBACd,CAAC,CAAC;YACL,CAAC;YAED,IAAI,aAAa,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvC,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,QAAQ;oBAC3B,QAAQ,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CACtC,CAAC,CAAC,cAAc,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAChG;iBACF,CAAC,CAAC;YACL,CAAC;YAED,IAAI,aAAa,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBACjD,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,kBAAkB;oBACrC,QAAQ,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CACtC,CAAC,CAAC,cAAc,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAChG;iBACF,CAAC,CAAC;YACL,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE;gBAChE,OAAO,EAAE,EAAE,MAAM,EAAE,4BAA4B,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE;aACxE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,iBAAiB;IACjB,6EAA6E;IAEtE,KAAK,CAAC,gBAAgB,CAC3B,EAAyB,EACzB,MAAc;QAEd,IAAI,CAAC;YAEH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,gBAAgB,CAAC,mBAAmB,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAU,IAAI,EAAE,CAAC;YAE/J,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAS,EAAE,EAAE,CAAC,CAAC;gBACzC,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;gBAC7C,QAAQ,EAAE,IAAI,CAAC,SAAS;gBACxB,UAAU,EAAE,IAAI,CAAC,SAAS;aAC3B,CAAC,CAAC,CAAC;YAEJ,OAAO,EAAE,KAAK,EAAE,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE;gBAChE,OAAO,EAAE,EAAE,MAAM,EAAE,8BAA8B,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE;aAC1E,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,kBAAkB,CAC7B,EAAyB,EACzB,MAAc,EACd,MAAc,EACd,SAAiB,EACjB,SAAiB;QAEjB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,+BAA+B,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAEvD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAM,gBAAgB,CAAC,mBAAmB,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;YAErH,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;oBACjE,OAAO,EAAE,EAAE,MAAM,EAAE,yBAAyB,EAAE;iBAC/C,CAAC,CAAC;YACL,CAAC;YAED,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC3B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;oBACjE,OAAO,EAAE,EAAE,MAAM,EAAE,yBAAyB,EAAE;iBAC/C,CAAC,CAAC;YACL,CAAC;YAED,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACjE,IAAI,gBAAgB,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;gBAChC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;oBAC9D,OAAO,EAAE,EAAE,MAAM,EAAE,+CAA+C,EAAE;iBACrE,CAAC,CAAC;YACL,CAAC;YAED,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,gBAAgB,CAAC,mBAAmB,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;YAE5F,MAAM,IAAI,CAAC,gBAAgB,CAAC,0BAA0B,CAAC;gBACrD,MAAM,EAAE,MAAM;gBACd,MAAM;gBACN,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,SAAS;gBACT,SAAS;aACV,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE;gBAChE,OAAO,EAAE,EAAE,MAAM,EAAE,gCAAgC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE;aAC5E,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,oBAAoB;IACpB,6EAA6E;IAEtE,KAAK,CAAC,cAAc,CACzB,EAAyB,EACzB,MAAc,EACd,MAAc,EACd,QAAiB,EACjB,eAAqB,EACrB,SAAkB,EAClB,SAAkB;QAElB,IAAI,CAAC;YAEH,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;gBAC1B,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;wBAClE,OAAO,EAAE,EAAE,MAAM,EAAE,qDAAqD,EAAE;qBAC3E,CAAC,CAAC;gBACL,CAAC;gBAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;gBAEjF,IAAI,CAAC,WAAW,EAAE,YAAY,EAAE,CAAC;oBAC/B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,OAAO,EAAE,EAAE,MAAM,EAAE,kCAAkC,EAAE;qBACxD,CAAC,CAAC;gBACL,CAAC;gBAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAC1D,WAAW,CAAC,YAAY,EAAE,QAAQ,CACnC,CAAC;gBACF,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;qBACxC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;iBAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,OAAO,EAAE,EAAE,MAAM,EAAE,gDAAgD,EAAE;iBACtE,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,OAAO,EAAE,EAAE,MAAM,EAAE,yCAAyC,MAAM,EAAE,EAAE;iBACvE,CAAC,CAAC;YACL,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC;gBAC1D,SAAS,EAAE,wBAAwB,CAAC,MAAM;gBAC1C,eAAe,EAAE,+BAA+B,CAAC,UAAU;gBAC3D,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE;gBACnD,MAAM,EAAE,MAAM;gBACd,kBAAkB,EAAE,gBAAgB,CAAC,KAAK;gBAC1C,SAAS,EAAE,MAAM;aAClB,CAAC,CAAC;YAEH,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QACtC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE;gBAChE,OAAO,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE;aACvE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,yCAAyC;IACzC,6EAA6E;IAEtE,KAAK,CAAC,gBAAgB,CAC3B,EAAyB,EACzB,MAAc;QAEd,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAEjF,MAAM,aAAa,GAAG,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,MAAM,YAAY,GAAG,WAAW,EAAE,kBAAkB,EAAE,MAAM,IAAI,CAAC,CAAC;QAElE,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,gBAAgB,CAAC,mBAAmB,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAU,IAAI,EAAE,CAAC;QACpK,MAAM,iBAAiB,GAAG,aAAa,CAAC,MAAM,CAAC;QAE/C,OAAO;YACL,aAAa;YACb,YAAY;YACZ,iBAAiB;YACjB,KAAK,EAAE,aAAa,GAAG,YAAY,GAAG,iBAAiB;SACxD,CAAC;IACJ,CAAC;CACF,CAAA;AAzfY,kCAAkC;IAD9C,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IACzD,WAAA,MAAM,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,CAAA;IACjD,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,CAAA;IACjD,WAAA,MAAM,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAA;IAC1C,WAAA,MAAM,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,CAAA;qCARW,aAAa;QACM,0BAA0B,YAEjB,oCAAoC;QAC5C,uBAAuB;QACvB,uBAAuB;QACX,6BAA6B;QAC/C,6BAA6B;QACxB,4BAA4B;GAZlG,kCAAkC,CAyf9C"}

package/dist/esm/security/authentications/services/auth-methods/auth-mfa.backend.service.d.ts

@@ -0,0 +1,44 @@
+import 'reflect-metadata';
+import { LoggerService } from '../../../../monitoring/logger/services/logger.service.js';
+import { ErrorBuilderBackendService } from '../../../../errors/services/error-builder.backend.service.js';
+import { AppConfigurationService } from '../../../../config/services/app-configuration.backend.service.js';
+import { AuditLogsBackendService } from '../../../../compliance/audit-trails/services/audit-logs.backend.service.js';
+import { AuthUserLookupBackendService } from '../../../../security/authentications/services/utils/auth-user-lookup.backend.service.js';
+import { AuthCredentialOpsBackendService } from '../../../../security/authentications/services/utils/auth-credential-ops.backend.service.js';
+import type { ExecutionContext } from '../../../../runtime/models/execution-context.backend.schemas.js';
+export interface TotpSetupResult {
+    secret: string;
+    qrCodeUri: string;
+    backupCodes: string[];
+}
+export interface TotpSetupParams {
+    userId: string;
+    email: string;
+    ipAddress: string;
+    userAgent: string;
+}
+export interface TotpVerifySetupParams {
+    userId: string;
+    code: string;
+    ipAddress: string;
+    userAgent: string;
+}
+/**
+ * TOTP enrollment — setup and verify-setup.
+ * Uses static `otpauth` import (cleanup from dynamic import in controller).
+ */
+export declare class AuthMfaBackendService {
+    private readonly logger;
+    private readonly errorBuilder;
+    private readonly appConfigService;
+    private readonly auditLogsService;
+    private readonly credentialOps;
+    private readonly userLookup;
+    private readonly logDebug;
+    constructor(logger: LoggerService, errorBuilder: ErrorBuilderBackendService, appConfigService: AppConfigurationService, auditLogsService: AuditLogsBackendService, credentialOps: AuthCredentialOpsBackendService, userLookup: AuthUserLookupBackendService);
+    setupTOTP(ec: ExecutionContext<any>, params: TotpSetupParams): Promise<TotpSetupResult>;
+    verifyTOTPSetup(ec: ExecutionContext<any>, params: TotpVerifySetupParams): Promise<{
+        verified: boolean;
+    }>;
+}
+//# sourceMappingURL=auth-mfa.backend.service.d.ts.map

package/dist/esm/security/authentications/services/auth-methods/auth-mfa.backend.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-mfa.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/auth-methods/auth-mfa.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAK1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AACzH,OAAO,EAAE,4BAA4B,EAAE,MAAM,6FAA6F,CAAC;AAC3I,OAAO,EAAE,+BAA+B,EAAE,MAAM,gGAAgG,CAAC;AAEjJ,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAE5G,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,qBACa,qBAAqB;IAIK,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IAChC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACzB,OAAO,CAAC,QAAQ,CAAC,aAAa;IACjC,OAAO,CAAC,QAAQ,CAAC,UAAU;IAR/E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EAC3C,gBAAgB,EAAE,uBAAuB,EACzC,gBAAgB,EAAE,uBAAuB,EACjC,aAAa,EAAE,+BAA+B,EACjD,UAAU,EAAE,4BAA4B;IAMvG,SAAS,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;IAoDvF,eAAe,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC;CAkChH"}