npm - @wildo-ai/saas-backend-lib - Versions diffs - 1.1.1 → 1.1.3 - Mend

@wildo-ai/saas-backend-lib 1.1.1 → 1.1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (972) hide show

package/dist/esm/security/authentications/services/auth-methods/auth-method-management.backend.service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"auth-method-management.backend.service.js","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/auth-methods/auth-method-management.backend.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAG9G,OAAO,EAAE,oCAAoC,EAAE,MAAM,+FAA+F,CAAC;AACrJ,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AACzH,OAAO,EAAE,6BAA6B,EAAE,MAAM,yFAAyF,CAAC;AACxI,OAAO,EAAE,6BAA6B,EAAE,MAAM,wFAAwF,CAAC;AACvI,OAAO,EAAE,4BAA4B,EAAE,MAAM,6FAA6F,CAAC;AAC3I,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EACL,gBAAgB,EAChB,SAAS,EACT,2BAA2B,EAC3B,mBAAmB,EACnB,UAAU,EACV,wBAAwB,EACxB,+BAA+B,EAC/B,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4FAA4F,CAAC;AACnI,OAAO,EAAE,6BAA6B,EAAE,sBAAsB,EAAE,MAAM,4FAA4F,CAAC;AAe5J,IAAM,kCAAkC,GAAxC,MAAM,kCAAkC;IAIS;IACa;IACW;IACR;IACN;IACA;IACM;IACP;IACM;IAMF;IAIL;IAEC;IAvB9C,QAAQ,CAA+D;IAExF,YACsD,MAAqB,EACR,YAAwC,EAC7B,uBAA8D,EACtE,kBAAwD,EAC9D,gBAAyC,EACzC,gBAAyC,EACnC,sBAAqD,EAC5D,WAA0C,EACpC,UAAwC,EAM1C,mBAA+C,EAIpD,cAAqC,EAEpC,eAAuC;QApBhD,WAAM,GAAN,MAAM,CAAe;QACR,iBAAY,GAAZ,YAAY,CAA4B;QAC7B,4BAAuB,GAAvB,uBAAuB,CAAuC;QACtE,uBAAkB,GAAlB,kBAAkB,CAAsC;QAC9D,qBAAgB,GAAhB,gBAAgB,CAAyB;QACzC,qBAAgB,GAAhB,gBAAgB,CAAyB;QACnC,2BAAsB,GAAtB,sBAAsB,CAA+B;QAC5D,gBAAW,GAAX,WAAW,CAA+B;QACpC,eAAU,GAAV,UAAU,CAA8B;QAM1C,wBAAmB,GAAnB,mBAAmB,CAA4B;QAIpD,mBAAc,GAAd,cAAc,CAAuB;QAEpC,oBAAe,GAAf,eAAe,CAAwB;QAEpG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,oCAAoC,CAAC,CAAC;QAC9E,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,oCAAoC,EAAE,IAAI,CAAC,CAAC;IAC9E,CAAC;IAED,6EAA6E;IAC7E,mBAAmB;IACnB,6EAA6E;IAErE,SAAS,CAAC,KAAa;QAC7B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,MAAM,CAAC;QAC9C,OAAO,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjC,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,sBAAsB,CAAC,EAAyB,EAAE,MAAc;QAC5E,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAA2B,gBAAgB,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5H,IAAI,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAC,UAAU,CAAC,0BAA0B,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;YACnF,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,0CAA0C;QAC5C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,KAAK,CAAC,+BAA+B,CAAC,EAAyB,EAAE,MAAc;QACpF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC7D,MAAM,gBAAgB,GAAG,MAAM,EAAE,gBAAgB,CAAC;QAClD,IAAI,gBAAgB,IAAI,CAAC,gBAAgB,CAAC,sBAAsB,EAAE,CAAC;YACjE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE,EAAE,MAAM,EAAE,0DAA0D,EAAE;aAChF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,sBAAsB;IACtB,6EAA6E;IAEtE,KAAK,CAAC,cAAc,CACzB,EAAyB,EACzB,MAAc,EACd,eAAuB,EACvB,WAAmB,EACnB,SAAiB,EACjB,SAAiB;QAEjB,IAAI,CAAC;YAEH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAEjF,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;gBAC9C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;oBAC9D,OAAO,EAAE,EAAE,MAAM,EAAE,iDAAiD,EAAE;iBACvE,CAAC,CAAC;YACL,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,cAAc,CACjE,WAAW,CAAC,YAAY,EAAE,eAAe,CAC1C,CAAC;YACF,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;oBAC9D,OAAO,EAAE,EAAE,MAAM,EAAE,+BAA+B,EAAE;iBACrD,CAAC,CAAC;YACL,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACrE,MAAM,cAAc,GAAG,cAAc,EAAE,cAAc,CAAC;YACtD,MAAM,YAAY,GAAG,IAAI,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;YACjG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;gBACxB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EAAE,2BAA2B,CAAC,oCAAoC;oBACxF,OAAO,EAAE,EAAE,UAAU,EAAE,YAAY,CAAC,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE;iBAC7H,CAAC,CAAC;YACL,CAAC;YAED,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACnI,MAAM,IAAI,CAAC,WAAW,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC;YAC1D,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;YAE9E,MAAM,IAAI,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QACnG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC/D,OAAO,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE;aACjD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,WAAW,CACtB,EAAyB,EACzB,MAAc,EACd,WAAmB,EACnB,SAAiB,EACjB,SAAiB;QAEjB,IAAI,CAAC;YAEH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAEjF,IAAI,WAAW,EAAE,YAAY,EAAE,CAAC;gBAC9B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;oBAC9D,OAAO,EAAE,EAAE,MAAM,EAAE,yDAAyD,EAAE;iBAC/E,CAAC,CAAC;YACL,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACrE,MAAM,cAAc,GAAG,cAAc,EAAE,cAAc,CAAC;YACtD,MAAM,YAAY,GAAG,IAAI,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;YACjG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;gBACxB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EAAE,2BAA2B,CAAC,oCAAoC;oBACxF,OAAO,EAAE,EAAE,UAAU,EAAE,YAAY,CAAC,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE;iBAC7H,CAAC,CAAC;YACL,CAAC;YAED,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACnI,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;YAE9E,MAAM,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC/D,OAAO,EAAE,EAAE,MAAM,EAAE,wBAAwB,EAAE;aAC9C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,kBAAkB;IAClB,6EAA6E;IAEtE,KAAK,CAAC,WAAW,CACtB,EAAyB,EACzB,MAAc,EACd,WAA+B,EAC/B,SAAiB,EACjB,SAAiB;QAEjB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,+BAA+B,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAEvD,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAErE,IAAI,cAAc,EAAE,gBAAgB,EAAE,6BAA6B,EAAE,CAAC;gBACpE,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,OAAO,EAAE,EAAE,MAAM,EAAE,+CAA+C,EAAE;qBACrE,CAAC,CAAC;gBACL,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,sBAAsB,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC;oBAChG,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;oBAC1E,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;wBAC5B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;4BACrE,OAAO,EAAE,EAAE,MAAM,EAAE,sDAAsD,EAAE;yBAC5E,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;wBAAE,MAAM,KAAK,CAAC;oBAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,OAAO,EAAE,EAAE,MAAM,EAAE,4CAA4C,EAAE;qBAClE,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAEjF,IAAI,CAAC,WAAW,EAAE,YAAY,EAAE,CAAC;gBAC/B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;oBAC9D,OAAO,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE;iBAC3C,CAAC,CAAC;YACL,CAAC;YAED,MAAM,WAAW,GAAG,CAAC,CAAC,cAAc,EAAE,SAAS,EAAE,UAAU,CAAC;YAC5D,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,WAAW,GACf,CAAC,WAAW,CAAC,kBAAkB,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;oBACjD,WAAW,CAAC,mBAAmB,KAAK,IAAI,CAAC;gBAE3C,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;wBAClE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;wBAC9D,OAAO,EAAE,EAAE,MAAM,EAAE,2DAA2D,EAAE;qBACjF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,4EAA4E;YAC5E,4EAA4E;YAC5E,gFAAgF;YAChF,8EAA8E;YAC9E,+BAA+B;YAC/B,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,EAAE;gBAC3F,YAAY,EAAE,IAAI;gBAClB,YAAY,EAAE,KAAK;gBACnB,iBAAiB,EAAE,EAAE;gBACrB,cAAc,EAAE,IAAI;aACrB,CAAC,CAAC;YAEH,MAAM,IAAI,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QAChG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC/D,OAAO,EAAE,EAAE,MAAM,EAAE,wBAAwB,EAAE;aAC9C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,uBAAuB;IACvB,6EAA6E;IAEtE,KAAK,CAAC,YAAY,CACvB,EAAyB,EACzB,MAAc;QAEd,IAAI,CAAC;YAEH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAEjF,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAC3D,gBAAgB,CAAC,mBAAmB,EACpC,EAAE,EACF,EAAE,MAAM,EAAE,EACV,SAAS,EACT,EAAE,SAAS,EAAE,KAAK,EAAE,CACC,IAAI,EAAE,CAAC;YAE9B,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACrE,MAAM,kBAAkB,GAAG,cAAc,EAAE,kBAAkB,CAAC;YAE9D,MAAM,UAAU,GAA2G,EAAE,CAAC;YAE9H,MAAM,aAAa,GAAG,CAAC,MAAkB,EAAW,EAAE;gBACpD,IAAI,CAAC,kBAAkB;oBAAE,OAAO,IAAI,CAAC;gBACrC,OAAO,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;YACtC,CAAC,CAAC;YAEF,IAAI,aAAa,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvC,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,QAAQ;oBAC3B,QAAQ,EAAE,CAAC,CAAC,WAAW,EAAE,YAAY;iBACtC,CAAC,CAAC;YACL,CAAC;YAED,IAAI,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnC,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,IAAI;oBACvB,QAAQ,EAAE,WAAW,EAAE,YAAY,KAAK,IAAI;oBAC5C,UAAU,EAAE,WAAW,EAAE,cAAc,IAAI,SAAS;iBACrD,CAAC,CAAC;YACL,CAAC;YAED,IAAI,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtC,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,OAAO;oBAC1B,QAAQ,EAAE,CAAC,WAAW,EAAE,kBAAkB,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;oBAC5D,OAAO,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,IAAI,CAAC,EAAE;iBACxE,CAAC,CAAC;YACL,CAAC;YAED,IAAI,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtC,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,OAAO;oBAC1B,QAAQ,EAAE,WAAW,EAAE,mBAAmB,KAAK,IAAI;oBACnD,OAAO,EAAE,WAAW,EAAE,mBAAmB;wBACvC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,WAAY,CAAC,EAAE;wBAC3D,CAAC,CAAC,SAAS;iBACd,CAAC,CAAC;YACL,CAAC;YAED,IAAI,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBACxC,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,SAAS;oBAC5B,QAAQ,EAAE,IAAI;iBACf,CAAC,CAAC;YACL,CAAC;YAED,IAAI,aAAa,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBACzC,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,UAAU;oBAC7B,QAAQ,EAAE,IAAI;iBACf,CAAC,CAAC;YACL,CAAC;YAED,IAAI,aAAa,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;gBAC9C,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,CACtC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,KAAK,iBAAiB,CAAC,MAAM,CAC3D,CAAC;gBACF,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,eAAe;oBAClC,QAAQ,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC;iBACjC,CAAC,CAAC;YACL,CAAC;YAED,IAAI,aAAa,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvC,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,QAAQ;oBAC3B,QAAQ,EAAE,aAAa,CAAC,IAAI,CAC1B,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,cAAc,KAAK,iBAAiB,CAAC,UAAU;2BACjD,IAAI,CAAC,MAAM,KAAK,sBAAsB,CAAC,IAAI,CACjD;iBACF,CAAC,CAAC;YACL,CAAC;YAED,IAAI,aAAa,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBACjD,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,kBAAkB;oBACrC,QAAQ,EAAE,aAAa,CAAC,IAAI,CAC1B,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,cAAc,KAAK,iBAAiB,CAAC,UAAU;2BACjD,IAAI,CAAC,MAAM,KAAK,sBAAsB,CAAC,IAAI,CACjD;iBACF,CAAC,CAAC;YACL,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC/D,OAAO,EAAE,EAAE,MAAM,EAAE,4BAA4B,EAAE;aAClD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,iBAAiB;IACjB,6EAA6E;IAEtE,KAAK,CAAC,gBAAgB,CAC3B,EAAyB,EACzB,MAAc;QAEd,IAAI,CAAC;YAEH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CACtD,gBAAgB,CAAC,mBAAmB,EACpC,EAAE,EACF,EAAE,MAAM,EAAE,EACV,SAAS,EACT,EAAE,SAAS,EAAE,KAAK,EAAE,CACC,CAAC;YAExB,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBACpC,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,CAAC,CAAC,CAAC;YAEJ,OAAO,EAAE,KAAK,EAAE,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC/D,OAAO,EAAE,EAAE,MAAM,EAAE,8BAA8B,EAAE;aACpD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,kBAAkB,CAC7B,EAAyB,EACzB,MAAc,EACd,MAAc,EACd,SAAiB,EACjB,SAAiB;QAEjB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,+BAA+B,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAEvD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAClD,gBAAgB,CAAC,mBAAmB,EACpC,EAAE,EACF,EAAE,GAAG,EAAE,MAAM,EAAE,CAChB,CAAC;YAEF,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;oBACjE,OAAO,EAAE,EAAE,MAAM,EAAE,yBAAyB,EAAE;iBAC/C,CAAC,CAAC;YACL,CAAC;YAED,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC3B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;oBACjE,OAAO,EAAE,EAAE,MAAM,EAAE,yBAAyB,EAAE;iBAC/C,CAAC,CAAC;YACL,CAAC;YAED,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACjE,IAAI,gBAAgB,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;gBAChC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;oBAC9D,OAAO,EAAE,EAAE,MAAM,EAAE,+CAA+C,EAAE;iBACrE,CAAC,CAAC;YACL,CAAC;YAED,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,gBAAgB,CAAC,mBAAmB,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;YAE5F,MAAM,IAAI,CAAC,gBAAgB,CAAC,0BAA0B,CAAC;gBACrD,MAAM,EAAE,MAAM;gBACd,MAAM;gBACN,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,SAAS;gBACT,SAAS;aACV,EAAE,EAAE,CAAC,CAAC;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC/D,OAAO,EAAE,EAAE,MAAM,EAAE,gCAAgC,EAAE;aACtD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,oBAAoB;IACpB,6EAA6E;IAE7E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACI,KAAK,CAAC,cAAc,CACzB,EAAyB,EACzB,MAAc,EACd,MAAkB,EAClB,QAAiB,EACjB,eAAyB,EACzB,SAAkB,EAClB,SAAkB;IAClB;;;OAGG;IACH,QAAiB;QAEjB,IAAI,CAAC;YAEH,IAAI,MAAM,KAAK,UAAU,CAAC,IAAI,EAAE,CAAC;gBAC/B,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;wBAClE,OAAO,EAAE,EAAE,MAAM,EAAE,+CAA+C,EAAE;qBACrE,CAAC,CAAC;gBACL,CAAC;gBAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,0BAA0B,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAEhG,IAAI,YAAY,CAAC,WAAW,EAAE,CAAC;oBAC7B,wFAAwF;oBACxF,4EAA4E;oBAC5E,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,OAAO,EAAE,EAAE,MAAM,EAAE,4CAA4C,EAAE;qBAClE,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;oBACxB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,OAAO,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE;qBACpC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;iBAAM,IAAI,MAAM,KAAK,UAAU,CAAC,QAAQ,EAAE,CAAC;gBAC1C,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;wBAClE,OAAO,EAAE,EAAE,MAAM,EAAE,qDAAqD,EAAE;qBAC3E,CAAC,CAAC;gBACL,CAAC;gBAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;gBAEjF,IAAI,CAAC,WAAW,EAAE,YAAY,EAAE,CAAC;oBAC/B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,OAAO,EAAE,EAAE,MAAM,EAAE,kCAAkC,EAAE;qBACxD,CAAC,CAAC;gBACL,CAAC;gBAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAC1D,WAAW,CAAC,YAAY,EAAE,QAAQ,CACnC,CAAC;gBACF,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;qBACxC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;iBAAM,IAAI,MAAM,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC;gBACzC,IAAI,CAAC,eAAe,EAAE,CAAC;oBACrB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;wBAClE,OAAO,EAAE,EAAE,MAAM,EAAE,+DAA+D,EAAE;qBACrF,CAAC,CAAC;gBACL,CAAC;gBAED,6FAA6F;gBAC7F,4FAA4F;gBAC5F,oDAAoD;gBACpD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,4BAA4B,CAC1E,EAAE,EACF,MAAM,EACN,eAA6C,EAC7C,6BAA6B,CAAC,OAAO,CACtC,CAAC;gBAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,oFAAoF;oBACpF,yFAAyF;oBACzF,0FAA0F;oBAC1F,sBAAsB;oBACtB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,OAAO,EAAE,EAAE,MAAM,EAAE,kCAAkC,EAAE;qBACxD,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,OAAO,EAAE,EAAE,MAAM,EAAE,yCAAyC,MAAM,EAAE,EAAE;iBACvE,CAAC,CAAC;YACL,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC;gBAC1D,SAAS,EAAE,wBAAwB,CAAC,MAAM;gBAC1C,eAAe,EAAE,+BAA+B,CAAC,UAAU;gBAC3D,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE;gBACnD,MAAM,EAAE,MAAM;gBACd,kBAAkB,EAAE,gBAAgB,CAAC,KAAK;gBAC1C,SAAS,EAAE,MAAM;aAClB,CAAC,CAAC;YAEH,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QACtC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC/D,OAAO,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE;aACjD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,yCAAyC;IACzC,6EAA6E;IAEtE,KAAK,CAAC,gBAAgB,CAC3B,EAAyB,EACzB,MAAc;QAEd,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAEjF,MAAM,aAAa,GAAG,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,MAAM,YAAY,GAAG,WAAW,EAAE,kBAAkB,EAAE,MAAM,IAAI,CAAC,CAAC;QAElE,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAC3D,gBAAgB,CAAC,mBAAmB,EACpC,EAAE,EACF,EAAE,MAAM,EAAE,EACV,SAAS,EACT,EAAE,SAAS,EAAE,KAAK,EAAE,CACC,CAAC;QACxB,MAAM,iBAAiB,GAAG,aAAa,CAAC,MAAM,CAAC;QAE/C,OAAO;YACL,aAAa;YACb,YAAY;YACZ,iBAAiB;YACjB,KAAK,EAAE,aAAa,GAAG,YAAY,GAAG,iBAAiB;SACxD,CAAC;IACJ,CAAC;CACF,CAAA;AApnBY,kCAAkC;IAD9C,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IACzD,WAAA,MAAM,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,CAAA;IACjD,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,CAAA;IACjD,WAAA,MAAM,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAA;IAC1C,WAAA,MAAM,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,CAAA;IAMhD,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAI9C,YAAA,MAAM,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA;IAEzC,YAAA,MAAM,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAA;qCApBiB,aAAa;QACM,0BAA0B,YAEjB,oCAAoC;QAC5C,uBAAuB;QACvB,uBAAuB;QACX,6BAA6B;QAC/C,6BAA6B;QACxB,4BAA4B,YAU/B,qBAAqB;QAEnB,sBAAsB;GAxB3F,kCAAkC,CAonB9C","sourcesContent":["import 'reflect-metadata';\nimport { inject, injectable } from 'inversify';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport type { ServicesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/services/services-registry-handler.backend.service';\nimport type { SystemAccessBackendService } from '~wildo-backend-lib/base-classes/services/services/system-access.backend.service';\nimport { AuthCredentialVerifierBackendService } from '~wildo-backend-lib/security/authentications/services/auth-credential-verifier.backend.service';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { AuditLogsBackendService } from '~wildo-backend-lib/compliance/audit-trails/services/audit-logs.backend.service';\nimport { ConsumableTokenBackendService } from '~wildo-backend-lib/security/consumable-tokens/services/consumable-token.backend.service';\nimport { AuthTokenIssuerBackendService } from '~wildo-backend-lib/security/authentications/services/auth-token-issuer.backend.service';\nimport { AuthUserLookupBackendService } from '~wildo-backend-lib/security/authentications/services/utils/auth-user-lookup.backend.service';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport {\n CoreResourceType,\n ErrorType,\n ErrorCustomMessageReference,\n isWildoBackendError,\n AuthMethod,\n CoreConsumableTokenTypes,\n ConsumableToken_ConsumptionMode,\n ExternalIdentitySource,\n SsoConnectionType,\n} from '@wildo-ai/saas-models';\nimport type {\n UserIdentityLink,\n UserTypeAuthPolicy,\n} from '@wildo-ai/saas-models';\nimport { DurationUnit } from '@wildo-ai/zod-decorators';\nimport { AuthMfaBackendService } from '~wildo-backend-lib/security/authentications/services/auth-methods/auth-mfa.backend.service';\nimport { PasskeyAuthenticationCeremony, WebAuthnBackendService } from '~wildo-backend-lib/security/authentications/services/auth-methods/webauthn.backend.service';\nimport type { AuthenticationResponseJSON } from '@simplewebauthn/server';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\n\ninterface IdentityLinkSummary {\n _id: string;\n connectionType: SsoConnectionType;\n source: ExternalIdentitySource;\n providerRef: string;\n providerEmail: string;\n linkedAt: Date;\n lastUsedAt: Date;\n}\n\n@injectable()\nexport class AuthMethodManagementBackendService {\n private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n @inject(SAAS_SERVICE_TYPES.ServicesRegistryHandlerService) private readonly servicesRegistryHandler: ServicesRegistryHandlerBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthCredentialVerifier) private readonly credentialVerifier: AuthCredentialVerifierBackendService,\n @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n @inject(SAAS_SERVICE_TYPES.AuditLogsService) private readonly auditLogsService: AuditLogsBackendService,\n @inject(SAAS_SERVICE_TYPES.ConsumableTokenService) private readonly consumableTokenService: ConsumableTokenBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthTokenIssuer) private readonly tokenIssuer: AuthTokenIssuerBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthUserLookupService) private readonly userLookup: AuthUserLookupBackendService,\n // TOTP-disable clears `secretBase32` + `backupCodesHashed` (both `.isBackendOnly()`),\n // which a plain handler update strips → the secret and backup codes would silently\n // survive a \"disable\". `updateAsSystem` re-attaches the cleared values after the\n // strict parse, fail-closed behind USER_CREDENTIALS' `systemAccessPolicy.update`.\n // Appended LAST to keep the positional test construction stable.\n @inject(SAAS_SERVICE_TYPES.SystemAccessService) private readonly systemAccessService: SystemAccessBackendService,\n // Appended LAST for the same reason as the parameter above — keeps positional test\n // construction stable. Supplies the enrolled-second-factor authority `reAuthenticate` uses for\n // `AuthMethod.TOTP`, shared with the login second-factor step.\n @inject(SAAS_SERVICE_TYPES.AuthMfaService) private readonly authMfaService: AuthMfaBackendService,\n // Appended LAST, same reason as the two above. Supplies the STEP_UP passkey ceremony.\n @inject(SAAS_SERVICE_TYPES.WebAuthnService) private readonly webAuthnService: WebAuthnBackendService,\n ) {\n this.logDebug = this.logger.debugByType('AuthMethodManagementBackendService');\n this.logger.setDebugTypeLogging('AuthMethodManagementBackendService', true);\n }\n\n // ==========================================================================\n // INTERNAL HELPERS\n // ==========================================================================\n\n private maskPhone(phone: string): string {\n if (!phone \|\| phone.length < 4) return '**';\n return `${phone.slice(-4)}`;\n }\n\n /\n W6.8 + AUTH-14: Resolve effective auth policy for a user, including org override merging.\n * Falls back to null if the user or user type is not found.\n /\n private async _resolveUserTypePolicy(ec: ExecutionContext<any>, userId: string): Promise<UserTypeAuthPolicy \| null> {\n try {\n const user = await this.servicesRegistryHandler.read<{ userTypes?: string[] }>(CoreResourceType.USERS, ec, { _id: userId });\n if (user?.userTypes?.length) {\n return this.userLookup.resolveEffectiveAuthPolicy(ec, userId, user.userTypes[0]);\n }\n } catch {\n // Suppress — non-fatal, will use defaults\n }\n return null;\n }\n\n public async enforceUserMethodRemovalAllowed(ec: ExecutionContext<any>, userId: string): Promise<void> {\n const policy = await this._resolveUserTypePolicy(ec, userId);\n const methodManagement = policy?.methodManagement;\n if (methodManagement && !methodManagement.allowUserMethodRemoval) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHORIZATION,\n context: { reason: 'User-initiated auth method removal is disabled by policy' },\n });\n }\n }\n\n // ==========================================================================\n // PASSWORD MANAGEMENT\n // ==========================================================================\n\n public async changePassword(\n ec: ExecutionContext<any>,\n userId: string,\n currentPassword: string,\n newPassword: string,\n ipAddress: string,\n userAgent: string,\n ): Promise<void> {\n try {\n\n const credentials = await this.credentialVerifier.resolveCredentials(ec, userId);\n\n if (!credentials \|\| !credentials.passwordHash) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION,\n context: { reason: 'No password set. Use /auth/password/set instead' },\n });\n }\n\n const isCurrentValid = await this.credentialVerifier.verifyPassword(\n credentials.passwordHash, currentPassword,\n );\n if (!isCurrentValid) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION,\n context: { reason: 'Current password is incorrect' },\n });\n }\n\n const userTypePolicy = await this._resolveUserTypePolicy(ec, userId);\n const passwordPolicy = userTypePolicy?.passwordPolicy;\n const policyResult = this.credentialVerifier.validatePasswordPolicy(newPassword, passwordPolicy);\n if (!policyResult.valid) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION_PASSWORD_POLICY_VIOLATION,\n context: { violations: policyResult.violations, minLength: passwordPolicy?.minLength, maxLength: passwordPolicy?.maxLength },\n });\n }\n\n const newPasswordHash = await this.credentialVerifier.hashPassword(newPassword, this.appConfigService.config.auth.passwordHashing);\n await this.tokenIssuer.invalidateAllTokensForUser(userId);\n await this.credentialVerifier.updatePasswordHash(ec, userId, newPasswordHash);\n\n await this.auditLogsService.logUserPasswordChanged({ userId: userId, ipAddress, userAgent }, ec);\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n throw this.errorBuilder.buildFromStandardError(error, undefined, {\n context: { reason: 'Failed to change password' },\n });\n }\n }\n\n public async setPassword(\n ec: ExecutionContext<any>,\n userId: string,\n newPassword: string,\n ipAddress: string,\n userAgent: string,\n ): Promise<void> {\n try {\n\n const credentials = await this.credentialVerifier.resolveCredentials(ec, userId);\n\n if (credentials?.passwordHash) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION,\n context: { reason: 'Password already set. Use /auth/password/change instead' },\n });\n }\n\n const userTypePolicy = await this._resolveUserTypePolicy(ec, userId);\n const passwordPolicy = userTypePolicy?.passwordPolicy;\n const policyResult = this.credentialVerifier.validatePasswordPolicy(newPassword, passwordPolicy);\n if (!policyResult.valid) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION_PASSWORD_POLICY_VIOLATION,\n context: { violations: policyResult.violations, minLength: passwordPolicy?.minLength, maxLength: passwordPolicy?.maxLength },\n });\n }\n\n const newPasswordHash = await this.credentialVerifier.hashPassword(newPassword, this.appConfigService.config.auth.passwordHashing);\n await this.credentialVerifier.updatePasswordHash(ec, userId, newPasswordHash);\n\n await this.auditLogsService.logUserPasswordSet({ userId: userId, ipAddress, userAgent }, ec);\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n throw this.errorBuilder.buildFromStandardError(error, undefined, {\n context: { reason: 'Failed to set password' },\n });\n }\n }\n\n // ==========================================================================\n // TOTP MANAGEMENT\n // ==========================================================================\n\n public async disableTotp(\n ec: ExecutionContext<any>,\n userId: string,\n reAuthToken: string \| undefined,\n ipAddress: string,\n userAgent: string,\n ): Promise<void> {\n try {\n await this.enforceUserMethodRemovalAllowed(ec, userId);\n\n const userTypePolicy = await this._resolveUserTypePolicy(ec, userId);\n\n if (userTypePolicy?.methodManagement?.requireReauthForMethodChanges) {\n if (!reAuthToken) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n context: { reason: 'Re-authentication is required for this action' },\n });\n }\n try {\n await this.consumableTokenService.validateToken(reAuthToken, [CoreConsumableTokenTypes.REAUTH]);\n const token = await this.consumableTokenService.consumeToken(reAuthToken);\n if (token.userId !== userId) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n context: { reason: 'Re-authentication token does not belong to this user' },\n });\n }\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n context: { reason: 'Invalid or expired re-authentication token' },\n });\n }\n }\n\n const credentials = await this.credentialVerifier.resolveCredentials(ec, userId);\n\n if (!credentials?.totpVerified) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION,\n context: { reason: 'TOTP is not enabled' },\n });\n }\n\n const mfaRequired = !!userTypePolicy?.mfaPolicy?.requireMFA;\n if (mfaRequired) {\n const hasOtherMFA =\n (credentials.passkeyCredentials?.length ?? 0) > 0 \|\|\n credentials.phoneNumberVerified === true;\n\n if (!hasOtherMFA) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION,\n context: { reason: 'Cannot disable your only MFA method while MFA is required' },\n });\n }\n }\n\n // Trusted system write: clearing `secretBase32` + `backupCodesHashed` (both\n // backendOnly) must survive the strict parse, otherwise the TOTP secret and\n // backup codes silently persist after a \"disable\". `updateAsSystem` re-attaches\n // the cleared values; `totpVerified`/`totpVerifiedAt` are plain fields parsed\n // normally, exactly as before.\n await this.systemAccessService.updateAsSystem(CoreResourceType.USER_CREDENTIALS, { userId }, {\n secretBase32: null,\n totpVerified: false,\n backupCodesHashed: [],\n totpVerifiedAt: null,\n });\n\n await this.auditLogsService.logUserTOTPDisabled({ userId: userId, ipAddress, userAgent }, ec);\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n throw this.errorBuilder.buildFromStandardError(error, undefined, {\n context: { reason: 'Failed to disable TOTP' },\n });\n }\n }\n\n // ==========================================================================\n // METHOD INTROSPECTION\n // ==========================================================================\n\n public async getMyMethods(\n ec: ExecutionContext<any>,\n userId: string,\n ): Promise<{ methods: Array<{ method: AuthMethod; enrolled: boolean; enrolledAt?: Date; details?: Record<string, unknown> }> }> {\n try {\n\n const credentials = await this.credentialVerifier.resolveCredentials(ec, userId);\n\n const identityLinks = await this.servicesRegistryHandler.list<UserIdentityLink>(\n CoreResourceType.USER_IDENTITY_LINKS,\n ec,\n { userId },\n undefined,\n { paginated: false },\n ) as UserIdentityLink[] ?? [];\n\n const userTypePolicy = await this._resolveUserTypePolicy(ec, userId);\n const authMethodsEnabled = userTypePolicy?.authMethodsEnabled;\n\n const allMethods: Array<{ method: AuthMethod; enrolled: boolean; enrolledAt?: Date; details?: Record<string, unknown> }> = [];\n\n const shouldInclude = (method: AuthMethod): boolean => {\n if (!authMethodsEnabled) return true;\n return !!authMethodsEnabled[method];\n };\n\n if (shouldInclude(AuthMethod.PASSWORD)) {\n allMethods.push({\n method: AuthMethod.PASSWORD,\n enrolled: !!credentials?.passwordHash,\n });\n }\n\n if (shouldInclude(AuthMethod.TOTP)) {\n allMethods.push({\n method: AuthMethod.TOTP,\n enrolled: credentials?.totpVerified === true,\n enrolledAt: credentials?.totpVerifiedAt ?? undefined,\n });\n }\n\n if (shouldInclude(AuthMethod.PASSKEY)) {\n allMethods.push({\n method: AuthMethod.PASSKEY,\n enrolled: (credentials?.passkeyCredentials?.length ?? 0) > 0,\n details: { passkeyCount: credentials?.passkeyCredentials?.length ?? 0 },\n });\n }\n\n if (shouldInclude(AuthMethod.SMS_OTP)) {\n allMethods.push({\n method: AuthMethod.SMS_OTP,\n enrolled: credentials?.phoneNumberVerified === true,\n details: credentials?.phoneNumberVerified\n ? { phoneNumber: this.maskPhone(credentials.phoneNumber!) }\n : undefined,\n });\n }\n\n if (shouldInclude(AuthMethod.EMAIL_OTP)) {\n allMethods.push({\n method: AuthMethod.EMAIL_OTP,\n enrolled: true,\n });\n }\n\n if (shouldInclude(AuthMethod.MAGIC_LINK)) {\n allMethods.push({\n method: AuthMethod.MAGIC_LINK,\n enrolled: true,\n });\n }\n\n if (shouldInclude(AuthMethod.EXTERNAL_OAUTH2)) {\n const socialLinks = identityLinks.filter(\n (link) => link.connectionType === SsoConnectionType.SOCIAL,\n );\n allMethods.push({\n method: AuthMethod.EXTERNAL_OAUTH2,\n enrolled: socialLinks.length > 0,\n });\n }\n\n if (shouldInclude(AuthMethod.ORG_SAML)) {\n allMethods.push({\n method: AuthMethod.ORG_SAML,\n enrolled: identityLinks.some(\n (link) =>\n link.connectionType === SsoConnectionType.ENTERPRISE\n && link.source === ExternalIdentitySource.SAML,\n ),\n });\n }\n\n if (shouldInclude(AuthMethod.ORG_OPENID_CONNECT)) {\n allMethods.push({\n method: AuthMethod.ORG_OPENID_CONNECT,\n enrolled: identityLinks.some(\n (link) =>\n link.connectionType === SsoConnectionType.ENTERPRISE\n && link.source === ExternalIdentitySource.OIDC,\n ),\n });\n }\n\n return { methods: allMethods };\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n throw this.errorBuilder.buildFromStandardError(error, undefined, {\n context: { reason: 'Failed to get auth methods' },\n });\n }\n }\n\n // ==========================================================================\n // IDENTITY LINKS\n // ==========================================================================\n\n public async getIdentityLinks(\n ec: ExecutionContext<any>,\n userId: string,\n ): Promise<{ links: IdentityLinkSummary[] }> {\n try {\n\n const rawLinks = await this.servicesRegistryHandler.list<UserIdentityLink>(\n CoreResourceType.USER_IDENTITY_LINKS,\n ec,\n { userId },\n undefined,\n { paginated: false },\n ) as UserIdentityLink[];\n\n const links = rawLinks.map((link) => ({\n _id: link._id,\n connectionType: link.connectionType,\n source: link.source,\n providerRef: link.providerRef,\n providerEmail: link.providerEmail,\n linkedAt: link.linkedAt,\n lastUsedAt: link.lastUsedAt,\n }));\n\n return { links };\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n throw this.errorBuilder.buildFromStandardError(error, undefined, {\n context: { reason: 'Failed to get identity links' },\n });\n }\n }\n\n public async unlinkIdentityLink(\n ec: ExecutionContext<any>,\n userId: string,\n linkId: string,\n ipAddress: string,\n userAgent: string,\n ): Promise<void> {\n try {\n await this.enforceUserMethodRemovalAllowed(ec, userId);\n\n const link = await this.servicesRegistryHandler.read<UserIdentityLink>(\n CoreResourceType.USER_IDENTITY_LINKS,\n ec,\n { _id: linkId },\n );\n\n if (!link) {\n throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {\n context: { reason: 'Identity link not found' },\n });\n }\n\n if (link.userId !== userId) {\n throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {\n context: { reason: 'Identity link not found' },\n });\n }\n\n const authMethodCounts = await this.countAuthMethods(ec, userId);\n if (authMethodCounts.total <= 1) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION,\n context: { reason: 'Cannot remove your only authentication method' },\n });\n }\n\n await this.servicesRegistryHandler.delete(CoreResourceType.USER_IDENTITY_LINKS, ec, linkId);\n\n await this.auditLogsService.logUserIdentityLinkRemoved({\n userId: userId,\n linkId,\n providerRef: link.providerRef,\n ipAddress,\n userAgent,\n }, ec);\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n throw this.errorBuilder.buildFromStandardError(error, undefined, {\n context: { reason: 'Failed to unlink identity link' },\n });\n }\n }\n\n // ==========================================================================\n // RE-AUTHENTICATION\n // ==========================================================================\n\n /\n Prove the caller is still themselves, and mint a single-use `REAUTH` token on success.\n \n # Which factors are accepted, and why TOTP had to be one of them\n \n `requiresStepUpAuthentication` operations are cleared ONLY by the token this method mints, so\n * the factor list here decides who can perform them at all. While it was PASSWORD-only, two\n * populations were structurally locked out of every gated verb:\n \n - user types whose `authMethodsEnabled` excludes `PASSWORD` (SSO-only, passkey-only) — also\n * reachable through a per-ORGANIZATION `authMethodsEnabled` override;\n * - directory-managed (SCIM) users, whose `passwordHash` AND passkeys the framework\n * deliberately destroys so a local first factor cannot survive IdP deprovisioning\n * (`_reconcileLocalCredentialsForDirectoryManaged`).\n \n That second group is not an edge case: once tenant teardown split into `request_deletion` +\n * purge, an ORG_ADMIN of a directory-managed tenant could not start even the NORMAL teardown.\n * TOTP is the right remedy precisely because the same reconciliation leaves it INTACT — it is a\n * second factor sitting on top of the IdP first factor, so it survives deprovisioning by design.\n \n `TOTP` here means \"an enrolled second factor\": a TOTP code or one of the principal's backup\n * codes, verified through the single shared authority\n * ({@link AuthMfaBackendService.verifyEnrolledSecondFactor}) that login uses — including its\n * anti-replay. The anti-replay is load-bearing for step-up specifically: without it a code\n * observed during login would still be valid moments later, and step-up would authorize a\n * destructive operation on a credential the caller never freshly proved.\n \n `PASSKEY` remains explicitly refused rather than silently unsupported.\n \n assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-proof of identity before a\n * high-impact action, over any factor the principal actually holds.\n /\n public async reAuthenticate(\n ec: ExecutionContext<any>,\n userId: string,\n method: AuthMethod,\n password?: string,\n passkeyResponse?: unknown,\n ipAddress?: string,\n userAgent?: string,\n /\n The enrolled-second-factor code for `method === TOTP` (a TOTP code or a backup code).\n * Appended LAST so every existing positional caller keeps its meaning.\n */\n totpCode?: string,\n ): Promise<{ reAuthToken: string }> {\n try {\n\n if (method === AuthMethod.TOTP) {\n if (!totpCode) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n context: { reason: 'A code is required for TOTP re-authentication' },\n });\n }\n\n const verification = await this.authMfaService.verifyEnrolledSecondFactor(ec, userId, totpCode);\n\n if (verification.notEnrolled) {\n // Distinct from a wrong code on purpose: this account has NO enrolled second factor, so\n // retrying cannot help. The caller needs a different factor, or enrollment.\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n context: { reason: 'No enrolled second factor for this account' },\n });\n }\n\n if (!verification.valid) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n context: { reason: 'Invalid code' },\n });\n }\n } else if (method === AuthMethod.PASSWORD) {\n if (!password) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n context: { reason: 'Password is required for password re-authentication' },\n });\n }\n\n const credentials = await this.credentialVerifier.resolveCredentials(ec, userId);\n\n if (!credentials?.passwordHash) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n context: { reason: 'No password set for this account' },\n });\n }\n\n const isValid = await this.credentialVerifier.verifyPassword(\n credentials.passwordHash, password,\n );\n if (!isValid) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n context: { reason: 'Invalid password' },\n });\n }\n } else if (method === AuthMethod.PASSKEY) {\n if (!passkeyResponse) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n context: { reason: 'A passkey assertion is required for passkey re-authentication' },\n });\n }\n\n // STEP_UP ceremony, NOT login: it reads a separate challenge (so an assertion produced for a\n // login cannot be redeemed here) and demands user verification even where the app policy is\n // `preferred`. See `PasskeyAuthenticationCeremony`.\n const { verified } = await this.webAuthnService.verifyAuthenticationResponse(\n ec,\n userId,\n passkeyResponse as AuthenticationResponseJSON,\n PasskeyAuthenticationCeremony.STEP_UP,\n );\n\n if (!verified) {\n // Deliberately ONE refusal for every failure mode below the verifier — no challenge\n // outstanding, wrong credential, absent user verification, bad signature. Distinguishing\n // them here would tell an attacker which half of the ceremony to attack; the service logs\n // the specific cause.\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n context: { reason: 'Passkey re-authentication failed' },\n });\n }\n } else {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n context: { reason: `Unsupported re-authentication method: ${method}` },\n });\n }\n\n const token = await this.consumableTokenService.createToken({\n tokenType: CoreConsumableTokenTypes.REAUTH,\n consumptionMode: ConsumableToken_ConsumptionMode.SINGLE_USE,\n expiresIn: { value: 5, unit: DurationUnit.MINUTES },\n userId: userId,\n resourceIdentifier: CoreResourceType.USERS,\n relatedId: userId,\n });\n\n return { reAuthToken: token.token };\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n throw this.errorBuilder.buildFromStandardError(error, undefined, {\n context: { reason: 'Failed to re-authenticate' },\n });\n }\n }\n\n // ==========================================================================\n // AUTH METHOD COUNTING (D9 Safety Check)\n // ==========================================================================\n\n public async countAuthMethods(\n ec: ExecutionContext<any>,\n userId: string,\n ): Promise<{ passwordCount: number; passkeyCount: number; identityLinkCount: number; total: number }> {\n const credentials = await this.credentialVerifier.resolveCredentials(ec, userId);\n\n const passwordCount = credentials?.passwordHash ? 1 : 0;\n const passkeyCount = credentials?.passkeyCredentials?.length ?? 0;\n\n const identityLinks = await this.servicesRegistryHandler.list<UserIdentityLink>(\n CoreResourceType.USER_IDENTITY_LINKS,\n ec,\n { userId },\n undefined,\n { paginated: false },\n ) as UserIdentityLink[];\n const identityLinkCount = identityLinks.length;\n\n return {\n passwordCount,\n passkeyCount,\n identityLinkCount,\n total: passwordCount + passkeyCount + identityLinkCount,\n };\n }\n}\n"]}
1	+ {"version":3,"file":"auth-method-management.backend.service.js","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/auth-methods/auth-method-management.backend.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAG9G,OAAO,EAAE,oCAAoC,EAAE,MAAM,+FAA+F,CAAC;AACrJ,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AACzH,OAAO,EAAE,6BAA6B,EAAE,MAAM,yFAAyF,CAAC;AACxI,OAAO,EAAE,6BAA6B,EAAE,MAAM,wFAAwF,CAAC;AACvI,OAAO,EAAE,4BAA4B,EAAE,MAAM,6FAA6F,CAAC;AAC3I,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EACL,gBAAgB,EAChB,SAAS,EACT,2BAA2B,EAC3B,mBAAmB,EACnB,UAAU,EACV,wBAAwB,EACxB,+BAA+B,EAC/B,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4FAA4F,CAAC;AACnI,OAAO,EAAE,6BAA6B,EAAE,sBAAsB,EAAE,MAAM,4FAA4F,CAAC;AAe5J,IAAM,kCAAkC,GAAxC,MAAM,kCAAkC;IAIS;IACa;IACW;IACR;IACN;IACA;IACM;IACP;IACM;IAMF;IAIL;IAEC;IAvB9C,QAAQ,CAA+D;IAExF,YACsD,MAAqB,EACR,YAAwC,EAC7B,uBAA8D,EACtE,kBAAwD,EAC9D,gBAAyC,EACzC,gBAAyC,EACnC,sBAAqD,EAC5D,WAA0C,EACpC,UAAwC,EAM1C,mBAA+C,EAIpD,cAAqC,EAEpC,eAAuC;QApBhD,WAAM,GAAN,MAAM,CAAe;QACR,iBAAY,GAAZ,YAAY,CAA4B;QAC7B,4BAAuB,GAAvB,uBAAuB,CAAuC;QACtE,uBAAkB,GAAlB,kBAAkB,CAAsC;QAC9D,qBAAgB,GAAhB,gBAAgB,CAAyB;QACzC,qBAAgB,GAAhB,gBAAgB,CAAyB;QACnC,2BAAsB,GAAtB,sBAAsB,CAA+B;QAC5D,gBAAW,GAAX,WAAW,CAA+B;QACpC,eAAU,GAAV,UAAU,CAA8B;QAM1C,wBAAmB,GAAnB,mBAAmB,CAA4B;QAIpD,mBAAc,GAAd,cAAc,CAAuB;QAEpC,oBAAe,GAAf,eAAe,CAAwB;QAEpG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,oCAAoC,CAAC,CAAC;QAC9E,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,oCAAoC,EAAE,IAAI,CAAC,CAAC;IAC9E,CAAC;IAED,6EAA6E;IAC7E,mBAAmB;IACnB,6EAA6E;IAErE,SAAS,CAAC,KAAa;QAC7B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,MAAM,CAAC;QAC9C,OAAO,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjC,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,sBAAsB,CAAC,EAAyB,EAAE,MAAc;QAC5E,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAA2B,gBAAgB,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5H,IAAI,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAC,UAAU,CAAC,0BAA0B,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;YACnF,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,0CAA0C;QAC5C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,KAAK,CAAC,+BAA+B,CAAC,EAAyB,EAAE,MAAc;QACpF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC7D,MAAM,gBAAgB,GAAG,MAAM,EAAE,gBAAgB,CAAC;QAClD,IAAI,gBAAgB,IAAI,CAAC,gBAAgB,CAAC,sBAAsB,EAAE,CAAC;YACjE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE,EAAE,MAAM,EAAE,0DAA0D,EAAE;aAChF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,sBAAsB;IACtB,6EAA6E;IAEtE,KAAK,CAAC,cAAc,CACzB,EAAyB,EACzB,MAAc,EACd,eAAuB,EACvB,WAAmB,EACnB,SAAiB,EACjB,SAAiB;QAEjB,IAAI,CAAC;YAEH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAEjF,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;gBAC9C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;oBAC9D,OAAO,EAAE,EAAE,MAAM,EAAE,iDAAiD,EAAE;iBACvE,CAAC,CAAC;YACL,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,cAAc,CACjE,WAAW,CAAC,YAAY,EAAE,eAAe,CAC1C,CAAC;YACF,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;oBAC9D,OAAO,EAAE,EAAE,MAAM,EAAE,+BAA+B,EAAE;iBACrD,CAAC,CAAC;YACL,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACrE,MAAM,cAAc,GAAG,cAAc,EAAE,cAAc,CAAC;YACtD,MAAM,YAAY,GAAG,IAAI,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;YACjG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;gBACxB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EAAE,2BAA2B,CAAC,oCAAoC;oBACxF,OAAO,EAAE,EAAE,UAAU,EAAE,YAAY,CAAC,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE;iBAC7H,CAAC,CAAC;YACL,CAAC;YAED,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACnI,MAAM,IAAI,CAAC,WAAW,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC;YAC1D,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;YAE9E,MAAM,IAAI,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QACnG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC/D,OAAO,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE;aACjD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,WAAW,CACtB,EAAyB,EACzB,MAAc,EACd,WAAmB,EACnB,SAAiB,EACjB,SAAiB;QAEjB,IAAI,CAAC;YAEH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAEjF,IAAI,WAAW,EAAE,YAAY,EAAE,CAAC;gBAC9B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;oBAC9D,OAAO,EAAE,EAAE,MAAM,EAAE,yDAAyD,EAAE;iBAC/E,CAAC,CAAC;YACL,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACrE,MAAM,cAAc,GAAG,cAAc,EAAE,cAAc,CAAC;YACtD,MAAM,YAAY,GAAG,IAAI,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;YACjG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;gBACxB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EAAE,2BAA2B,CAAC,oCAAoC;oBACxF,OAAO,EAAE,EAAE,UAAU,EAAE,YAAY,CAAC,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE;iBAC7H,CAAC,CAAC;YACL,CAAC;YAED,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACnI,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;YAE9E,MAAM,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC/D,OAAO,EAAE,EAAE,MAAM,EAAE,wBAAwB,EAAE;aAC9C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,kBAAkB;IAClB,6EAA6E;IAEtE,KAAK,CAAC,WAAW,CACtB,EAAyB,EACzB,MAAc,EACd,WAA+B,EAC/B,SAAiB,EACjB,SAAiB;QAEjB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,+BAA+B,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAEvD,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAErE,IAAI,cAAc,EAAE,gBAAgB,EAAE,6BAA6B,EAAE,CAAC;gBACpE,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,OAAO,EAAE,EAAE,MAAM,EAAE,+CAA+C,EAAE;qBACrE,CAAC,CAAC;gBACL,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,sBAAsB,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC;oBAChG,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;oBAC1E,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;wBAC5B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;4BACrE,OAAO,EAAE,EAAE,MAAM,EAAE,sDAAsD,EAAE;yBAC5E,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;wBAAE,MAAM,KAAK,CAAC;oBAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,OAAO,EAAE,EAAE,MAAM,EAAE,4CAA4C,EAAE;qBAClE,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAEjF,IAAI,CAAC,WAAW,EAAE,YAAY,EAAE,CAAC;gBAC/B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;oBAC9D,OAAO,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE;iBAC3C,CAAC,CAAC;YACL,CAAC;YAED,MAAM,WAAW,GAAG,CAAC,CAAC,cAAc,EAAE,SAAS,EAAE,UAAU,CAAC;YAC5D,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,WAAW,GACf,CAAC,WAAW,CAAC,kBAAkB,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;oBACjD,WAAW,CAAC,mBAAmB,KAAK,IAAI,CAAC;gBAE3C,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;wBAClE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;wBAC9D,OAAO,EAAE,EAAE,MAAM,EAAE,2DAA2D,EAAE;qBACjF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,4EAA4E;YAC5E,4EAA4E;YAC5E,gFAAgF;YAChF,8EAA8E;YAC9E,+BAA+B;YAC/B,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,EAAE;gBAC3F,YAAY,EAAE,IAAI;gBAClB,YAAY,EAAE,KAAK;gBACnB,iBAAiB,EAAE,EAAE;gBACrB,cAAc,EAAE,IAAI;aACrB,CAAC,CAAC;YAEH,MAAM,IAAI,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QAChG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC/D,OAAO,EAAE,EAAE,MAAM,EAAE,wBAAwB,EAAE;aAC9C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,uBAAuB;IACvB,6EAA6E;IAEtE,KAAK,CAAC,YAAY,CACvB,EAAyB,EACzB,MAAc;QAEd,IAAI,CAAC;YAEH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAEjF,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAC3D,gBAAgB,CAAC,mBAAmB,EACpC,EAAE,EACF,EAAE,MAAM,EAAE,EACV,SAAS,EACT,EAAE,SAAS,EAAE,KAAK,EAAE,CACC,IAAI,EAAE,CAAC;YAE9B,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACrE,MAAM,kBAAkB,GAAG,cAAc,EAAE,kBAAkB,CAAC;YAE9D,MAAM,UAAU,GAA2G,EAAE,CAAC;YAE9H,MAAM,aAAa,GAAG,CAAC,MAAkB,EAAW,EAAE;gBACpD,IAAI,CAAC,kBAAkB;oBAAE,OAAO,IAAI,CAAC;gBACrC,OAAO,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;YACtC,CAAC,CAAC;YAEF,IAAI,aAAa,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvC,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,QAAQ;oBAC3B,QAAQ,EAAE,CAAC,CAAC,WAAW,EAAE,YAAY;iBACtC,CAAC,CAAC;YACL,CAAC;YAED,IAAI,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnC,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,IAAI;oBACvB,QAAQ,EAAE,WAAW,EAAE,YAAY,KAAK,IAAI;oBAC5C,UAAU,EAAE,WAAW,EAAE,cAAc,IAAI,SAAS;iBACrD,CAAC,CAAC;YACL,CAAC;YAED,IAAI,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtC,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,OAAO;oBAC1B,QAAQ,EAAE,CAAC,WAAW,EAAE,kBAAkB,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;oBAC5D,OAAO,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,IAAI,CAAC,EAAE;iBACxE,CAAC,CAAC;YACL,CAAC;YAED,IAAI,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtC,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,OAAO;oBAC1B,QAAQ,EAAE,WAAW,EAAE,mBAAmB,KAAK,IAAI;oBACnD,OAAO,EAAE,WAAW,EAAE,mBAAmB;wBACvC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,WAAY,CAAC,EAAE;wBAC3D,CAAC,CAAC,SAAS;iBACd,CAAC,CAAC;YACL,CAAC;YAED,IAAI,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBACxC,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,SAAS;oBAC5B,QAAQ,EAAE,IAAI;iBACf,CAAC,CAAC;YACL,CAAC;YAED,IAAI,aAAa,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBACzC,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,UAAU;oBAC7B,QAAQ,EAAE,IAAI;iBACf,CAAC,CAAC;YACL,CAAC;YAED,IAAI,aAAa,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;gBAC9C,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,CACtC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,KAAK,iBAAiB,CAAC,MAAM,CAC3D,CAAC;gBACF,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,eAAe;oBAClC,QAAQ,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC;iBACjC,CAAC,CAAC;YACL,CAAC;YAED,IAAI,aAAa,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvC,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,QAAQ;oBAC3B,QAAQ,EAAE,aAAa,CAAC,IAAI,CAC1B,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,cAAc,KAAK,iBAAiB,CAAC,UAAU;2BACjD,IAAI,CAAC,MAAM,KAAK,sBAAsB,CAAC,IAAI,CACjD;iBACF,CAAC,CAAC;YACL,CAAC;YAED,IAAI,aAAa,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBACjD,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,kBAAkB;oBACrC,QAAQ,EAAE,aAAa,CAAC,IAAI,CAC1B,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,cAAc,KAAK,iBAAiB,CAAC,UAAU;2BACjD,IAAI,CAAC,MAAM,KAAK,sBAAsB,CAAC,IAAI,CACjD;iBACF,CAAC,CAAC;YACL,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC/D,OAAO,EAAE,EAAE,MAAM,EAAE,4BAA4B,EAAE;aAClD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,iBAAiB;IACjB,6EAA6E;IAEtE,KAAK,CAAC,gBAAgB,CAC3B,EAAyB,EACzB,MAAc;QAEd,IAAI,CAAC;YAEH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CACtD,gBAAgB,CAAC,mBAAmB,EACpC,EAAE,EACF,EAAE,MAAM,EAAE,EACV,SAAS,EACT,EAAE,SAAS,EAAE,KAAK,EAAE,CACC,CAAC;YAExB,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBACpC,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,CAAC,CAAC,CAAC;YAEJ,OAAO,EAAE,KAAK,EAAE,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC/D,OAAO,EAAE,EAAE,MAAM,EAAE,8BAA8B,EAAE;aACpD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,kBAAkB,CAC7B,EAAyB,EACzB,MAAc,EACd,MAAc,EACd,SAAiB,EACjB,SAAiB;QAEjB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,+BAA+B,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAEvD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAClD,gBAAgB,CAAC,mBAAmB,EACpC,EAAE,EACF,EAAE,GAAG,EAAE,MAAM,EAAE,CAChB,CAAC;YAEF,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;oBACjE,OAAO,EAAE,EAAE,MAAM,EAAE,yBAAyB,EAAE;iBAC/C,CAAC,CAAC;YACL,CAAC;YAED,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC3B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;oBACjE,OAAO,EAAE,EAAE,MAAM,EAAE,yBAAyB,EAAE;iBAC/C,CAAC,CAAC;YACL,CAAC;YAED,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACjE,IAAI,gBAAgB,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;gBAChC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;oBAC9D,OAAO,EAAE,EAAE,MAAM,EAAE,+CAA+C,EAAE;iBACrE,CAAC,CAAC;YACL,CAAC;YAED,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,gBAAgB,CAAC,mBAAmB,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;YAE5F,MAAM,IAAI,CAAC,gBAAgB,CAAC,0BAA0B,CAAC;gBACrD,MAAM,EAAE,MAAM;gBACd,MAAM;gBACN,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,SAAS;gBACT,SAAS;aACV,EAAE,EAAE,CAAC,CAAC;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC/D,OAAO,EAAE,EAAE,MAAM,EAAE,gCAAgC,EAAE;aACtD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,oBAAoB;IACpB,6EAA6E;IAE7E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAuCG;IACI,KAAK,CAAC,cAAc,CACzB,EAAyB,EACzB,MAAc,EACd,MAAkB,EAClB,QAAiB,EACjB,eAAyB,EACzB,SAAkB,EAClB,SAAkB;IAClB;;;OAGG;IACH,QAAiB;QAEjB,IAAI,CAAC;YACH;;;;;;;;;;;;;;;;;;;;;;;;;;eA0BG;YACH,MAAM,UAAU,GAAG,EAAE,CAAC,cAAc;gBAClC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,EAAE,CAAC,cAAc,CAAC,EAAE,UAAU;gBAC5E,CAAC,CAAC,SAAS,CAAC;YACd,IAAI,UAAU,EAAE,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,EAAE;oBAC/D,OAAO,EAAE;wBACP,MAAM,EAAE,gFAAgF;wBACxF,eAAe,EAAE,MAAM;wBACvB,eAAe,EAAE,UAAU,CAAC,OAAO;qBACpC;iBACF,CAAC,CAAC;YACL,CAAC;YAED,IAAI,MAAM,KAAK,UAAU,CAAC,IAAI,EAAE,CAAC;gBAC/B,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;wBAClE,OAAO,EAAE,EAAE,MAAM,EAAE,+CAA+C,EAAE;qBACrE,CAAC,CAAC;gBACL,CAAC;gBAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,0BAA0B,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAEhG,IAAI,YAAY,CAAC,WAAW,EAAE,CAAC;oBAC7B,wFAAwF;oBACxF,4EAA4E;oBAC5E,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,OAAO,EAAE,EAAE,MAAM,EAAE,4CAA4C,EAAE;qBAClE,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;oBACxB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,OAAO,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE;qBACpC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;iBAAM,IAAI,MAAM,KAAK,UAAU,CAAC,QAAQ,EAAE,CAAC;gBAC1C,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;wBAClE,OAAO,EAAE,EAAE,MAAM,EAAE,qDAAqD,EAAE;qBAC3E,CAAC,CAAC;gBACL,CAAC;gBAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;gBAEjF,IAAI,CAAC,WAAW,EAAE,YAAY,EAAE,CAAC;oBAC/B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,OAAO,EAAE,EAAE,MAAM,EAAE,kCAAkC,EAAE;qBACxD,CAAC,CAAC;gBACL,CAAC;gBAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAC1D,WAAW,CAAC,YAAY,EAAE,QAAQ,CACnC,CAAC;gBACF,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;qBACxC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;iBAAM,IAAI,MAAM,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC;gBACzC,IAAI,CAAC,eAAe,EAAE,CAAC;oBACrB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;wBAClE,OAAO,EAAE,EAAE,MAAM,EAAE,+DAA+D,EAAE;qBACrF,CAAC,CAAC;gBACL,CAAC;gBAED,6FAA6F;gBAC7F,4FAA4F;gBAC5F,oDAAoD;gBACpD,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,4BAA4B,CAC1F,EAAE,EACF,MAAM,EACN,eAA6C,EAC7C,6BAA6B,CAAC,OAAO,CACtC,CAAC;gBAEF;;;;;;;;;;;;;mBAaG;gBACH,IAAI,cAAc,EAAE,CAAC;oBACnB,MAAM,IAAI,CAAC,gBAAgB,CAAC,4BAA4B,CAAC;wBACvD,MAAM;wBACN,YAAY,EAAE,cAAc,CAAC,YAAY;wBACzC,aAAa,EAAE,cAAc,CAAC,aAAa;wBAC3C,eAAe,EAAE,cAAc,CAAC,eAAe;wBAC/C,oBAAoB,EAAE,cAAc,CAAC,oBAAoB;wBACzD,kBAAkB,EAAE,cAAc,CAAC,kBAAkB;wBACrD,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACnE,QAAQ,EAAE,cAAc,CAAC,QAAQ;wBACjC,SAAS,EAAE,SAAS,IAAI,SAAS;wBACjC,SAAS,EAAE,SAAS,IAAI,SAAS;qBAClC,EAAE,EAAE,CAAC,CAAC;gBACT,CAAC;gBAED,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,oFAAoF;oBACpF,yFAAyF;oBACzF,0FAA0F;oBAC1F,sBAAsB;oBACtB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,OAAO,EAAE,EAAE,MAAM,EAAE,kCAAkC,EAAE;qBACxD,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,OAAO,EAAE,EAAE,MAAM,EAAE,yCAAyC,MAAM,EAAE,EAAE;iBACvE,CAAC,CAAC;YACL,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC;gBAC1D,SAAS,EAAE,wBAAwB,CAAC,MAAM;gBAC1C,eAAe,EAAE,+BAA+B,CAAC,UAAU;gBAC3D,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE;gBACnD,MAAM,EAAE,MAAM;gBACd,kBAAkB,EAAE,gBAAgB,CAAC,KAAK;gBAC1C,SAAS,EAAE,MAAM;aAClB,CAAC,CAAC;YAEH,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QACtC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC/D,OAAO,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE;aACjD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,yCAAyC;IACzC,6EAA6E;IAEtE,KAAK,CAAC,gBAAgB,CAC3B,EAAyB,EACzB,MAAc;QAEd,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAEjF,MAAM,aAAa,GAAG,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,MAAM,YAAY,GAAG,WAAW,EAAE,kBAAkB,EAAE,MAAM,IAAI,CAAC,CAAC;QAElE,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAC3D,gBAAgB,CAAC,mBAAmB,EACpC,EAAE,EACF,EAAE,MAAM,EAAE,EACV,SAAS,EACT,EAAE,SAAS,EAAE,KAAK,EAAE,CACC,CAAC;QACxB,MAAM,iBAAiB,GAAG,aAAa,CAAC,MAAM,CAAC;QAE/C,OAAO;YACL,aAAa;YACb,YAAY;YACZ,iBAAiB;YACjB,KAAK,EAAE,aAAa,GAAG,YAAY,GAAG,iBAAiB;SACxD,CAAC;IACJ,CAAC;CACF,CAAA;AAhsBY,kCAAkC;IAD9C,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IACzD,WAAA,MAAM,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,CAAA;IACjD,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,CAAA;IACjD,WAAA,MAAM,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAA;IAC1C,WAAA,MAAM,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,CAAA;IAMhD,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAI9C,YAAA,MAAM,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA;IAEzC,YAAA,MAAM,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAA;qCApBiB,aAAa;QACM,0BAA0B,YAEjB,oCAAoC;QAC5C,uBAAuB;QACvB,uBAAuB;QACX,6BAA6B;QAC/C,6BAA6B;QACxB,4BAA4B,YAU/B,qBAAqB;QAEnB,sBAAsB;GAxB3F,kCAAkC,CAgsB9C","sourcesContent":["import 'reflect-metadata';\nimport { inject, injectable } from 'inversify';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport type { ServicesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/services/services-registry-handler.backend.service';\nimport type { SystemAccessBackendService } from '~wildo-backend-lib/base-classes/services/services/system-access.backend.service';\nimport { AuthCredentialVerifierBackendService } from '~wildo-backend-lib/security/authentications/services/auth-credential-verifier.backend.service';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { AuditLogsBackendService } from '~wildo-backend-lib/compliance/audit-trails/services/audit-logs.backend.service';\nimport { ConsumableTokenBackendService } from '~wildo-backend-lib/security/consumable-tokens/services/consumable-token.backend.service';\nimport { AuthTokenIssuerBackendService } from '~wildo-backend-lib/security/authentications/services/auth-token-issuer.backend.service';\nimport { AuthUserLookupBackendService } from '~wildo-backend-lib/security/authentications/services/utils/auth-user-lookup.backend.service';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport {\n CoreResourceType,\n ErrorType,\n ErrorCustomMessageReference,\n isWildoBackendError,\n AuthMethod,\n CoreConsumableTokenTypes,\n ConsumableToken_ConsumptionMode,\n ExternalIdentitySource,\n SsoConnectionType,\n} from '@wildo-ai/saas-models';\nimport type {\n UserIdentityLink,\n UserTypeAuthPolicy,\n} from '@wildo-ai/saas-models';\nimport { DurationUnit } from '@wildo-ai/zod-decorators';\nimport { AuthMfaBackendService } from '~wildo-backend-lib/security/authentications/services/auth-methods/auth-mfa.backend.service';\nimport { PasskeyAuthenticationCeremony, WebAuthnBackendService } from '~wildo-backend-lib/security/authentications/services/auth-methods/webauthn.backend.service';\nimport type { AuthenticationResponseJSON } from '@simplewebauthn/server';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\n\ninterface IdentityLinkSummary {\n _id: string;\n connectionType: SsoConnectionType;\n source: ExternalIdentitySource;\n providerRef: string;\n providerEmail: string;\n linkedAt: Date;\n lastUsedAt: Date;\n}\n\n@injectable()\nexport class AuthMethodManagementBackendService {\n private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n @inject(SAAS_SERVICE_TYPES.ServicesRegistryHandlerService) private readonly servicesRegistryHandler: ServicesRegistryHandlerBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthCredentialVerifier) private readonly credentialVerifier: AuthCredentialVerifierBackendService,\n @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n @inject(SAAS_SERVICE_TYPES.AuditLogsService) private readonly auditLogsService: AuditLogsBackendService,\n @inject(SAAS_SERVICE_TYPES.ConsumableTokenService) private readonly consumableTokenService: ConsumableTokenBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthTokenIssuer) private readonly tokenIssuer: AuthTokenIssuerBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthUserLookupService) private readonly userLookup: AuthUserLookupBackendService,\n // TOTP-disable clears `secretBase32` + `backupCodesHashed` (both `.isBackendOnly()`),\n // which a plain handler update strips → the secret and backup codes would silently\n // survive a \"disable\". `updateAsSystem` re-attaches the cleared values after the\n // strict parse, fail-closed behind USER_CREDENTIALS' `systemAccessPolicy.update`.\n // Appended LAST to keep the positional test construction stable.\n @inject(SAAS_SERVICE_TYPES.SystemAccessService) private readonly systemAccessService: SystemAccessBackendService,\n // Appended LAST for the same reason as the parameter above — keeps positional test\n // construction stable. Supplies the enrolled-second-factor authority `reAuthenticate` uses for\n // `AuthMethod.TOTP`, shared with the login second-factor step.\n @inject(SAAS_SERVICE_TYPES.AuthMfaService) private readonly authMfaService: AuthMfaBackendService,\n // Appended LAST, same reason as the two above. Supplies the STEP_UP passkey ceremony.\n @inject(SAAS_SERVICE_TYPES.WebAuthnService) private readonly webAuthnService: WebAuthnBackendService,\n ) {\n this.logDebug = this.logger.debugByType('AuthMethodManagementBackendService');\n this.logger.setDebugTypeLogging('AuthMethodManagementBackendService', true);\n }\n\n // ==========================================================================\n // INTERNAL HELPERS\n // ==========================================================================\n\n private maskPhone(phone: string): string {\n if (!phone \|\| phone.length < 4) return '**';\n return `${phone.slice(-4)}`;\n }\n\n /\n W6.8 + AUTH-14: Resolve effective auth policy for a user, including org override merging.\n * Falls back to null if the user or user type is not found.\n /\n private async _resolveUserTypePolicy(ec: ExecutionContext<any>, userId: string): Promise<UserTypeAuthPolicy \| null> {\n try {\n const user = await this.servicesRegistryHandler.read<{ userTypes?: string[] }>(CoreResourceType.USERS, ec, { _id: userId });\n if (user?.userTypes?.length) {\n return this.userLookup.resolveEffectiveAuthPolicy(ec, userId, user.userTypes[0]);\n }\n } catch {\n // Suppress — non-fatal, will use defaults\n }\n return null;\n }\n\n public async enforceUserMethodRemovalAllowed(ec: ExecutionContext<any>, userId: string): Promise<void> {\n const policy = await this._resolveUserTypePolicy(ec, userId);\n const methodManagement = policy?.methodManagement;\n if (methodManagement && !methodManagement.allowUserMethodRemoval) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHORIZATION,\n context: { reason: 'User-initiated auth method removal is disabled by policy' },\n });\n }\n }\n\n // ==========================================================================\n // PASSWORD MANAGEMENT\n // ==========================================================================\n\n public async changePassword(\n ec: ExecutionContext<any>,\n userId: string,\n currentPassword: string,\n newPassword: string,\n ipAddress: string,\n userAgent: string,\n ): Promise<void> {\n try {\n\n const credentials = await this.credentialVerifier.resolveCredentials(ec, userId);\n\n if (!credentials \|\| !credentials.passwordHash) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION,\n context: { reason: 'No password set. Use /auth/password/set instead' },\n });\n }\n\n const isCurrentValid = await this.credentialVerifier.verifyPassword(\n credentials.passwordHash, currentPassword,\n );\n if (!isCurrentValid) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION,\n context: { reason: 'Current password is incorrect' },\n });\n }\n\n const userTypePolicy = await this._resolveUserTypePolicy(ec, userId);\n const passwordPolicy = userTypePolicy?.passwordPolicy;\n const policyResult = this.credentialVerifier.validatePasswordPolicy(newPassword, passwordPolicy);\n if (!policyResult.valid) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION_PASSWORD_POLICY_VIOLATION,\n context: { violations: policyResult.violations, minLength: passwordPolicy?.minLength, maxLength: passwordPolicy?.maxLength },\n });\n }\n\n const newPasswordHash = await this.credentialVerifier.hashPassword(newPassword, this.appConfigService.config.auth.passwordHashing);\n await this.tokenIssuer.invalidateAllTokensForUser(userId);\n await this.credentialVerifier.updatePasswordHash(ec, userId, newPasswordHash);\n\n await this.auditLogsService.logUserPasswordChanged({ userId: userId, ipAddress, userAgent }, ec);\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n throw this.errorBuilder.buildFromStandardError(error, undefined, {\n context: { reason: 'Failed to change password' },\n });\n }\n }\n\n public async setPassword(\n ec: ExecutionContext<any>,\n userId: string,\n newPassword: string,\n ipAddress: string,\n userAgent: string,\n ): Promise<void> {\n try {\n\n const credentials = await this.credentialVerifier.resolveCredentials(ec, userId);\n\n if (credentials?.passwordHash) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION,\n context: { reason: 'Password already set. Use /auth/password/change instead' },\n });\n }\n\n const userTypePolicy = await this._resolveUserTypePolicy(ec, userId);\n const passwordPolicy = userTypePolicy?.passwordPolicy;\n const policyResult = this.credentialVerifier.validatePasswordPolicy(newPassword, passwordPolicy);\n if (!policyResult.valid) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION_PASSWORD_POLICY_VIOLATION,\n context: { violations: policyResult.violations, minLength: passwordPolicy?.minLength, maxLength: passwordPolicy?.maxLength },\n });\n }\n\n const newPasswordHash = await this.credentialVerifier.hashPassword(newPassword, this.appConfigService.config.auth.passwordHashing);\n await this.credentialVerifier.updatePasswordHash(ec, userId, newPasswordHash);\n\n await this.auditLogsService.logUserPasswordSet({ userId: userId, ipAddress, userAgent }, ec);\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n throw this.errorBuilder.buildFromStandardError(error, undefined, {\n context: { reason: 'Failed to set password' },\n });\n }\n }\n\n // ==========================================================================\n // TOTP MANAGEMENT\n // ==========================================================================\n\n public async disableTotp(\n ec: ExecutionContext<any>,\n userId: string,\n reAuthToken: string \| undefined,\n ipAddress: string,\n userAgent: string,\n ): Promise<void> {\n try {\n await this.enforceUserMethodRemovalAllowed(ec, userId);\n\n const userTypePolicy = await this._resolveUserTypePolicy(ec, userId);\n\n if (userTypePolicy?.methodManagement?.requireReauthForMethodChanges) {\n if (!reAuthToken) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n context: { reason: 'Re-authentication is required for this action' },\n });\n }\n try {\n await this.consumableTokenService.validateToken(reAuthToken, [CoreConsumableTokenTypes.REAUTH]);\n const token = await this.consumableTokenService.consumeToken(reAuthToken);\n if (token.userId !== userId) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n context: { reason: 'Re-authentication token does not belong to this user' },\n });\n }\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n context: { reason: 'Invalid or expired re-authentication token' },\n });\n }\n }\n\n const credentials = await this.credentialVerifier.resolveCredentials(ec, userId);\n\n if (!credentials?.totpVerified) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION,\n context: { reason: 'TOTP is not enabled' },\n });\n }\n\n const mfaRequired = !!userTypePolicy?.mfaPolicy?.requireMFA;\n if (mfaRequired) {\n const hasOtherMFA =\n (credentials.passkeyCredentials?.length ?? 0) > 0 \|\|\n credentials.phoneNumberVerified === true;\n\n if (!hasOtherMFA) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION,\n context: { reason: 'Cannot disable your only MFA method while MFA is required' },\n });\n }\n }\n\n // Trusted system write: clearing `secretBase32` + `backupCodesHashed` (both\n // backendOnly) must survive the strict parse, otherwise the TOTP secret and\n // backup codes silently persist after a \"disable\". `updateAsSystem` re-attaches\n // the cleared values; `totpVerified`/`totpVerifiedAt` are plain fields parsed\n // normally, exactly as before.\n await this.systemAccessService.updateAsSystem(CoreResourceType.USER_CREDENTIALS, { userId }, {\n secretBase32: null,\n totpVerified: false,\n backupCodesHashed: [],\n totpVerifiedAt: null,\n });\n\n await this.auditLogsService.logUserTOTPDisabled({ userId: userId, ipAddress, userAgent }, ec);\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n throw this.errorBuilder.buildFromStandardError(error, undefined, {\n context: { reason: 'Failed to disable TOTP' },\n });\n }\n }\n\n // ==========================================================================\n // METHOD INTROSPECTION\n // ==========================================================================\n\n public async getMyMethods(\n ec: ExecutionContext<any>,\n userId: string,\n ): Promise<{ methods: Array<{ method: AuthMethod; enrolled: boolean; enrolledAt?: Date; details?: Record<string, unknown> }> }> {\n try {\n\n const credentials = await this.credentialVerifier.resolveCredentials(ec, userId);\n\n const identityLinks = await this.servicesRegistryHandler.list<UserIdentityLink>(\n CoreResourceType.USER_IDENTITY_LINKS,\n ec,\n { userId },\n undefined,\n { paginated: false },\n ) as UserIdentityLink[] ?? [];\n\n const userTypePolicy = await this._resolveUserTypePolicy(ec, userId);\n const authMethodsEnabled = userTypePolicy?.authMethodsEnabled;\n\n const allMethods: Array<{ method: AuthMethod; enrolled: boolean; enrolledAt?: Date; details?: Record<string, unknown> }> = [];\n\n const shouldInclude = (method: AuthMethod): boolean => {\n if (!authMethodsEnabled) return true;\n return !!authMethodsEnabled[method];\n };\n\n if (shouldInclude(AuthMethod.PASSWORD)) {\n allMethods.push({\n method: AuthMethod.PASSWORD,\n enrolled: !!credentials?.passwordHash,\n });\n }\n\n if (shouldInclude(AuthMethod.TOTP)) {\n allMethods.push({\n method: AuthMethod.TOTP,\n enrolled: credentials?.totpVerified === true,\n enrolledAt: credentials?.totpVerifiedAt ?? undefined,\n });\n }\n\n if (shouldInclude(AuthMethod.PASSKEY)) {\n allMethods.push({\n method: AuthMethod.PASSKEY,\n enrolled: (credentials?.passkeyCredentials?.length ?? 0) > 0,\n details: { passkeyCount: credentials?.passkeyCredentials?.length ?? 0 },\n });\n }\n\n if (shouldInclude(AuthMethod.SMS_OTP)) {\n allMethods.push({\n method: AuthMethod.SMS_OTP,\n enrolled: credentials?.phoneNumberVerified === true,\n details: credentials?.phoneNumberVerified\n ? { phoneNumber: this.maskPhone(credentials.phoneNumber!) }\n : undefined,\n });\n }\n\n if (shouldInclude(AuthMethod.EMAIL_OTP)) {\n allMethods.push({\n method: AuthMethod.EMAIL_OTP,\n enrolled: true,\n });\n }\n\n if (shouldInclude(AuthMethod.MAGIC_LINK)) {\n allMethods.push({\n method: AuthMethod.MAGIC_LINK,\n enrolled: true,\n });\n }\n\n if (shouldInclude(AuthMethod.EXTERNAL_OAUTH2)) {\n const socialLinks = identityLinks.filter(\n (link) => link.connectionType === SsoConnectionType.SOCIAL,\n );\n allMethods.push({\n method: AuthMethod.EXTERNAL_OAUTH2,\n enrolled: socialLinks.length > 0,\n });\n }\n\n if (shouldInclude(AuthMethod.ORG_SAML)) {\n allMethods.push({\n method: AuthMethod.ORG_SAML,\n enrolled: identityLinks.some(\n (link) =>\n link.connectionType === SsoConnectionType.ENTERPRISE\n && link.source === ExternalIdentitySource.SAML,\n ),\n });\n }\n\n if (shouldInclude(AuthMethod.ORG_OPENID_CONNECT)) {\n allMethods.push({\n method: AuthMethod.ORG_OPENID_CONNECT,\n enrolled: identityLinks.some(\n (link) =>\n link.connectionType === SsoConnectionType.ENTERPRISE\n && link.source === ExternalIdentitySource.OIDC,\n ),\n });\n }\n\n return { methods: allMethods };\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n throw this.errorBuilder.buildFromStandardError(error, undefined, {\n context: { reason: 'Failed to get auth methods' },\n });\n }\n }\n\n // ==========================================================================\n // IDENTITY LINKS\n // ==========================================================================\n\n public async getIdentityLinks(\n ec: ExecutionContext<any>,\n userId: string,\n ): Promise<{ links: IdentityLinkSummary[] }> {\n try {\n\n const rawLinks = await this.servicesRegistryHandler.list<UserIdentityLink>(\n CoreResourceType.USER_IDENTITY_LINKS,\n ec,\n { userId },\n undefined,\n { paginated: false },\n ) as UserIdentityLink[];\n\n const links = rawLinks.map((link) => ({\n _id: link._id,\n connectionType: link.connectionType,\n source: link.source,\n providerRef: link.providerRef,\n providerEmail: link.providerEmail,\n linkedAt: link.linkedAt,\n lastUsedAt: link.lastUsedAt,\n }));\n\n return { links };\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n throw this.errorBuilder.buildFromStandardError(error, undefined, {\n context: { reason: 'Failed to get identity links' },\n });\n }\n }\n\n public async unlinkIdentityLink(\n ec: ExecutionContext<any>,\n userId: string,\n linkId: string,\n ipAddress: string,\n userAgent: string,\n ): Promise<void> {\n try {\n await this.enforceUserMethodRemovalAllowed(ec, userId);\n\n const link = await this.servicesRegistryHandler.read<UserIdentityLink>(\n CoreResourceType.USER_IDENTITY_LINKS,\n ec,\n { _id: linkId },\n );\n\n if (!link) {\n throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {\n context: { reason: 'Identity link not found' },\n });\n }\n\n if (link.userId !== userId) {\n throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {\n context: { reason: 'Identity link not found' },\n });\n }\n\n const authMethodCounts = await this.countAuthMethods(ec, userId);\n if (authMethodCounts.total <= 1) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION,\n context: { reason: 'Cannot remove your only authentication method' },\n });\n }\n\n await this.servicesRegistryHandler.delete(CoreResourceType.USER_IDENTITY_LINKS, ec, linkId);\n\n await this.auditLogsService.logUserIdentityLinkRemoved({\n userId: userId,\n linkId,\n providerRef: link.providerRef,\n ipAddress,\n userAgent,\n }, ec);\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n throw this.errorBuilder.buildFromStandardError(error, undefined, {\n context: { reason: 'Failed to unlink identity link' },\n });\n }\n }\n\n // ==========================================================================\n // RE-AUTHENTICATION\n // ==========================================================================\n\n /\n Prove the caller is still themselves, and mint a single-use `REAUTH` token on success.\n \n # Which factors are accepted, and why TOTP had to be one of them\n \n `requiresStepUpAuthentication` operations are cleared ONLY by the token this method mints, so\n * the factor list here decides who can perform them at all. While it was PASSWORD-only, two\n * populations were structurally locked out of every gated verb:\n \n - user types whose `authMethodsEnabled` excludes `PASSWORD` (SSO-only, passkey-only) — also\n * reachable through a per-ORGANIZATION `authMethodsEnabled` override;\n * - directory-managed (SCIM) users, whose `passwordHash` AND passkeys the framework\n * deliberately destroys so a local first factor cannot survive IdP deprovisioning\n * (`_reconcileLocalCredentialsForDirectoryManaged`).\n \n That second group is not an edge case: once tenant teardown split into `request_deletion` +\n * purge, an ORG_ADMIN of a directory-managed tenant could not start even the NORMAL teardown.\n * TOTP is the right remedy precisely because the same reconciliation leaves it INTACT — it is a\n * second factor sitting on top of the IdP first factor, so it survives deprovisioning by design.\n \n `TOTP` here means \"an enrolled second factor\": a TOTP code or one of the principal's backup\n * codes, verified through the single shared authority\n * ({@link AuthMfaBackendService.verifyEnrolledSecondFactor}) that login uses — including its\n * anti-replay. The anti-replay is load-bearing for step-up specifically: without it a code\n * observed during login would still be valid moments later, and step-up would authorize a\n * destructive operation on a credential the caller never freshly proved.\n \n `PASSKEY` is SUPPORTED, through a dedicated two-legged ceremony rather than the one call\n * password and TOTP take: `POST /auth/reauth/passkey/options` then `POST /auth/reauth` with the\n * assertion, because WebAuthn is challenge-response. It is a re-proof rather than a possession\n * check — the branch below verifies under `PasskeyAuthenticationCeremony.STEP_UP`, which reads a\n * SEPARATE challenge (so an assertion minted for a login cannot be redeemed here) and demands\n * user verification even where the app policy is `preferred`.\n \n Any other `AuthMethod` is refused explicitly by the trailing `else`, rather than silently\n * unsupported.\n \n assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-proof of identity before a\n * high-impact action, over any factor the principal actually holds.\n /\n public async reAuthenticate(\n ec: ExecutionContext<any>,\n userId: string,\n method: AuthMethod,\n password?: string,\n passkeyResponse?: unknown,\n ipAddress?: string,\n userAgent?: string,\n /\n The enrolled-second-factor code for `method === TOTP` (a TOTP code or a backup code).\n * Appended LAST so every existing positional caller keeps its meaning.\n /\n totpCode?: string,\n ): Promise<{ reAuthToken: string }> {\n try {\n /\n * The user type's step-up policy decides WHICH FACTORS may satisfy a step-up (#422).\n \n `stepUpAuth.methods` was read only by a startup warning: the gate in\n * `services-registry-handler.backend.service.ts` consumed any `REAUTH` token whose `userId`\n * matched, whatever produced it. So a policy naming WebAuthn was satisfied by a password\n * re-authentication, and an operator who configured a phishing-resistant factor got a\n * password prompt and NO error — the same shape as an OIDC `acrValues` that is never sent.\n \n Enforced at MINT rather than at the gate, deliberately:\n * - the factor is known here and is NOT recorded on the token, so gate-time enforcement\n * would need a token-payload change and a migration for tokens already in flight;\n * - a refusal here names the allowed factors while the person is still choosing one,\n * instead of accepting their proof and refusing the operation afterwards;\n * - it makes the wrong token UNMINTABLE rather than merely rejected, so the gate keeps its\n * single question (\"is there a valid REAUTH token for this user?\") and cannot drift from\n * the policy.\n \n NO ENROLMENT FALLBACK, and that is the decision rather than an oversight. A user whose only\n * enrolled factor is outside the policy cannot mint a token and is told to enrol. Falling back\n * to an unnamed factor would reopen exactly the hole this closes — a policy that names a\n * factor and accepts a weaker one is what the defect was.\n \n The residual, stated: a token minted under one policy and redeemed after the policy narrows\n * is still accepted. REAUTH tokens live five minutes and are single-use, so the window is that\n * long; closing it entirely is the token-payload change rejected above.\n /\n const stepUpAuth = ec.activeUserType\n ? this.appConfigService.getUserTypeAuthPolicy(ec.activeUserType)?.stepUpAuth\n : undefined;\n if (stepUpAuth?.enabled && !stepUpAuth.methods.includes(method)) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, ec, {\n context: {\n reason: 'This factor is not accepted for step-up re-authentication by this account type',\n requestedMethod: method,\n acceptedMethods: stepUpAuth.methods,\n },\n });\n }\n\n if (method === AuthMethod.TOTP) {\n if (!totpCode) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n context: { reason: 'A code is required for TOTP re-authentication' },\n });\n }\n\n const verification = await this.authMfaService.verifyEnrolledSecondFactor(ec, userId, totpCode);\n\n if (verification.notEnrolled) {\n // Distinct from a wrong code on purpose: this account has NO enrolled second factor, so\n // retrying cannot help. The caller needs a different factor, or enrollment.\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n context: { reason: 'No enrolled second factor for this account' },\n });\n }\n\n if (!verification.valid) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n context: { reason: 'Invalid code' },\n });\n }\n } else if (method === AuthMethod.PASSWORD) {\n if (!password) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n context: { reason: 'Password is required for password re-authentication' },\n });\n }\n\n const credentials = await this.credentialVerifier.resolveCredentials(ec, userId);\n\n if (!credentials?.passwordHash) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n context: { reason: 'No password set for this account' },\n });\n }\n\n const isValid = await this.credentialVerifier.verifyPassword(\n credentials.passwordHash, password,\n );\n if (!isValid) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n context: { reason: 'Invalid password' },\n });\n }\n } else if (method === AuthMethod.PASSKEY) {\n if (!passkeyResponse) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n context: { reason: 'A passkey assertion is required for passkey re-authentication' },\n });\n }\n\n // STEP_UP ceremony, NOT login: it reads a separate challenge (so an assertion produced for a\n // login cannot be redeemed here) and demands user verification even where the app policy is\n // `preferred`. See `PasskeyAuthenticationCeremony`.\n const { verified, cloneSuspicion } = await this.webAuthnService.verifyAuthenticationResponse(\n ec,\n userId,\n passkeyResponse as AuthenticationResponseJSON,\n PasskeyAuthenticationCeremony.STEP_UP,\n );\n\n /\n * A verified assertion whose signature counter did not advance is the cloned-authenticator\n * signal, and it gets the same CRITICAL row here as at the login door — a regression met\n * while re-proving identity for a privileged action is if anything the more interesting of\n * the two. It is reachable only after signature verification, so it cannot be forged by\n * someone who merely knows a credential id.\n \n It does NOT change the refusal below: this branch already produces the deliberately\n * uniform `Passkey re-authentication failed`. Until 2026-09-08 a counter regression escaped\n * that uniformity — the library threw before the verifier returned, and the catch at the\n * end of this method wrapped it through `buildFromStandardError` as a generic error rather\n * than an AUTHENTICATION refusal. Returning `verified: false` instead of throwing is what\n * put it back on this path.\n */\n if (cloneSuspicion) {\n await this.auditLogsService.logUserPasskeyCloneSuspected({\n userId,\n credentialId: cloneSuspicion.credentialId,\n storedCounter: cloneSuspicion.storedCounter,\n receivedCounter: cloneSuspicion.receivedCounter,\n credentialDeviceType: cloneSuspicion.credentialDeviceType,\n credentialBackedUp: cloneSuspicion.credentialBackedUp,\n ...(cloneSuspicion.aaguid ? { aaguid: cloneSuspicion.aaguid } : {}),\n ceremony: cloneSuspicion.ceremony,\n ipAddress: ipAddress \|\| 'unknown',\n userAgent: userAgent \|\| 'unknown',\n }, ec);\n }\n\n if (!verified) {\n // Deliberately ONE refusal for every failure mode below the verifier — no challenge\n // outstanding, wrong credential, absent user verification, bad signature. Distinguishing\n // them here would tell an attacker which half of the ceremony to attack; the service logs\n // the specific cause.\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n context: { reason: 'Passkey re-authentication failed' },\n });\n }\n } else {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n context: { reason: `Unsupported re-authentication method: ${method}` },\n });\n }\n\n const token = await this.consumableTokenService.createToken({\n tokenType: CoreConsumableTokenTypes.REAUTH,\n consumptionMode: ConsumableToken_ConsumptionMode.SINGLE_USE,\n expiresIn: { value: 5, unit: DurationUnit.MINUTES },\n userId: userId,\n resourceIdentifier: CoreResourceType.USERS,\n relatedId: userId,\n });\n\n return { reAuthToken: token.token };\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n throw this.errorBuilder.buildFromStandardError(error, undefined, {\n context: { reason: 'Failed to re-authenticate' },\n });\n }\n }\n\n // ==========================================================================\n // AUTH METHOD COUNTING (D9 Safety Check)\n // ==========================================================================\n\n public async countAuthMethods(\n ec: ExecutionContext<any>,\n userId: string,\n ): Promise<{ passwordCount: number; passkeyCount: number; identityLinkCount: number; total: number }> {\n const credentials = await this.credentialVerifier.resolveCredentials(ec, userId);\n\n const passwordCount = credentials?.passwordHash ? 1 : 0;\n const passkeyCount = credentials?.passkeyCredentials?.length ?? 0;\n\n const identityLinks = await this.servicesRegistryHandler.list<UserIdentityLink>(\n CoreResourceType.USER_IDENTITY_LINKS,\n ec,\n { userId },\n undefined,\n { paginated: false },\n ) as UserIdentityLink[];\n const identityLinkCount = identityLinks.length;\n\n return {\n passwordCount,\n passkeyCount,\n identityLinkCount,\n total: passwordCount + passkeyCount + identityLinkCount,\n };\n }\n}\n"]}

package/dist/esm/security/authentications/services/auth-methods/auth-mfa.backend.service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"auth-mfa.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/auth-methods/auth-mfa.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAK1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AACzH,OAAO,EAAE,4BAA4B,EAAE,MAAM,6FAA6F,CAAC;AAC3I,OAAO,EAAE,+BAA+B,EAAE,MAAM,gGAAgG,CAAC;AACjJ,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AAGnF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAE5G,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,oGAAoG;IACpG,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;CAC/B;AAED;;;GAGG;AACH,qBACa,qBAAqB;IAIK,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IAChC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACzB,OAAO,CAAC,QAAQ,CAAC,aAAa;IACjC,OAAO,CAAC,QAAQ,CAAC,UAAU;IAGpC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAXxE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EAC3C,gBAAgB,EAAE,uBAAuB,EACzC,gBAAgB,EAAE,uBAAuB,EACjC,aAAa,EAAE,+BAA+B,EACjD,UAAU,EAAE,4BAA4B,EAGjD,YAAY,EAAE,YAAY;IAMtF;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACU,0BAA0B,CACrC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,gCAAgC,CAAC;IAqDtC,SAAS,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;~~IAoDvF~~,eAAe,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC;CAkChH"}
1	+ {"version":3,"file":"auth-mfa.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/auth-methods/auth-mfa.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAK1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AACzH,OAAO,EAAE,4BAA4B,EAAE,MAAM,6FAA6F,CAAC;AAC3I,OAAO,EAAE,+BAA+B,EAAE,MAAM,gGAAgG,CAAC;AACjJ,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AAGnF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAE5G,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,oGAAoG;IACpG,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;CAC/B;AAED;;;GAGG;AACH,qBACa,qBAAqB;IAIK,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IAChC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACzB,OAAO,CAAC,QAAQ,CAAC,aAAa;IACjC,OAAO,CAAC,QAAQ,CAAC,UAAU;IAGpC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAXxE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EAC3C,gBAAgB,EAAE,uBAAuB,EACzC,gBAAgB,EAAE,uBAAuB,EACjC,aAAa,EAAE,+BAA+B,EACjD,UAAU,EAAE,4BAA4B,EAGjD,YAAY,EAAE,YAAY;IAMtF;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACU,0BAA0B,CACrC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,gCAAgC,CAAC;IAqDtC,SAAS,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;IAsDvF,eAAe,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC;CAkChH"}

package/dist/esm/security/authentications/services/auth-methods/auth-mfa.backend.service.js CHANGED Viewed

@@ -23,7 +23,7 @@ import { AuthUserLookupBackendService } from '../../../../security/authenticatio
 import { AuthCredentialOpsBackendService } from '../../../../security/authentications/services/utils/auth-credential-ops.backend.service.js';
 import { RedisService } from '../../../../databases/services/redis.service.js';
 import { AUTH_REDIS_KEYS } from '../../../../security/authentications/models/auth-constants.backend.js';
-import { ErrorType, ErrorCustomMessageReference } from '@wildo-ai/saas-models';
+import { ErrorType, ErrorCustomMessageReference, MFA_BACKUP_CODE_CONTRACT } from '@wildo-ai/saas-models';
 /**
  * TOTP enrollment — setup and verify-setup.
  * Uses static `otpauth` import (cleanup from dynamic import in controller).
@@ -150,8 +150,10 @@ let AuthMfaBackendService = class AuthMfaBackendService {
         const qrCodeUri = totp.toString();
         const backupCodes = [];
         const backupCodesHashed = [];
-        for (let i = 0; i < 10; i++) {
-            const code = crypto.randomBytes(4).toString('hex');
+        // Count and length come from `MFA_BACKUP_CODE_CONTRACT`, which the customer documentation also
+        // projects: what a person is told they receive is what this loop issues.
+        for (let i = 0; i < MFA_BACKUP_CODE_CONTRACT.codeCount; i++) {
+            const code = crypto.randomBytes(MFA_BACKUP_CODE_CONTRACT.codeRandomBytes).toString('hex');
             backupCodes.push(code);
             backupCodesHashed.push(crypto.createHash('sha256').update(code).digest('hex'));
         }

package/dist/esm/security/authentications/services/auth-methods/auth-mfa.backend.service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"auth-mfa.backend.service.js","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/auth-methods/auth-mfa.backend.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AACzH,OAAO,EAAE,4BAA4B,EAAE,MAAM,6FAA6F,CAAC;AAC3I,OAAO,EAAE,+BAA+B,EAAE,MAAM,gGAAgG,CAAC;AACjJ,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,eAAe,EAAE,MAAM,2EAA2E,CAAC;AAC5G,OAAO,EAAE,SAAS,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAqC/E;;;GAGG;AAEI,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IAIsB;IACa;IACH;IACA;IACQ;IACH;IAGT;IAX3C,QAAQ,CAA+D;IAExF,YACsD,MAAqB,EACR,YAAwC,EAC3C,gBAAyC,EACzC,gBAAyC,EACjC,aAA8C,EACjD,UAAwC,EAGjD,YAA0B;QARhC,WAAM,GAAN,MAAM,CAAe;QACR,iBAAY,GAAZ,YAAY,CAA4B;QAC3C,qBAAgB,GAAhB,gBAAgB,CAAyB;QACzC,qBAAgB,GAAhB,gBAAgB,CAAyB;QACjC,kBAAa,GAAb,aAAa,CAAiC;QACjD,eAAU,GAAV,UAAU,CAA8B;QAGjD,iBAAY,GAAZ,YAAY,CAAc;QAEpF,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACpD,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACI,KAAK,CAAC,0BAA0B,CACrC,EAAyB,EACzB,MAAc,EACd,KAAa;QAEb,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAE/D,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACtD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;QACpE,CAAC;QAED,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC;QAChG,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAEhF,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/C,IAAI,WAAW,GAAG,KAAK,KAAK,IAAI,CAAC;QAEjC,+FAA+F;QAC/F,4EAA4E;QAC5E,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC;YACjE,MAAM,YAAY,GAAG,eAAe,GAAG,KAAM,CAAC;YAC9C,MAAM,SAAS,GAAG,GAAG,eAAe,CAAC,SAAS,GAAG,MAAM,EAAE,CAAC;YAC1D,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAS,SAAS,CAAC,CAAC;YACpE,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,IAAI,QAAQ,CAAC,YAAsB,EAAE,EAAE,CAAC,EAAE,CAAC;gBAClF,WAAW,GAAG,KAAK,CAAC;YACtB,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC;QAED,IAAI,WAAW;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;QAEnF,IAAI,IAAI,CAAC,iBAAiB,EAAE,MAAM,GAAG,CAAC,EAAE,CAAC;YACvC,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1E,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YAE/C,IAAI,UAAU,GAAG,CAAC,CAAC,CAAC;YACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACvD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;gBAChE,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,IAAI,MAAM,CAAC,eAAe,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;oBACxF,UAAU,GAAG,CAAC,CAAC;oBACf,yFAAyF;gBAC3F,CAAC;YACH,CAAC;YAED,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;gBACpB,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC,CAAC;gBACjD,YAAY,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;gBACnC,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;gBACvE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;YACnE,CAAC;QACH,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,EAAyB,EAAE,MAAuB;QAChE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;QAEhD,IAAI,CAAC,QAAQ,CAAC,0BAA0B,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAEtD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAE/D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;gBACjE,sBAAsB,EAAE,2BAA2B,CAAC,yCAAyC;aAC9F,CAAC,CAAC;QACL,CAAC;QAED,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;gBAClE,sBAAsB,EAAE,2BAA2B,CAAC,yBAAyB;aAC9E,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QAC5B,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC;QACrE,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,IAAI,OAAO,CAAC;QAEhG,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC;QAC7E,MAAM,KAAK,GAAG,UAAU,CAAC,oBAAoB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC;QAE1E,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC;YACpB,MAAM;YACN,KAAK;YACL,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,MAAM;SACP,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAElC,MAAM,WAAW,GAAa,EAAE,CAAC;QACjC,MAAM,iBAAiB,GAAa,EAAE,CAAC;QACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACnD,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvB,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACjF,CAAC;QAED,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAE1G,IAAI,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC9H,IAAI,CAAC,QAAQ,CAAC,6DAA6D,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAEzF,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,EAAyB,EAAE,MAA6B;QAC5E,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;QAEtD,IAAI,CAAC,QAAQ,CAAC,iCAAiC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAE7D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAE/D,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACrD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;gBACjE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;aACjF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC;QACrE,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC;YACpB,MAAM,EAAE,IAAI,CAAC,YAAY;YACzB,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QACxE,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,qBAAqB;aAC1E,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QAExD,IAAI,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAChI,IAAI,CAAC,QAAQ,CAAC,kCAAkC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAE9D,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC5B,CAAC;CACF,CAAA;AA5LY,qBAAqB;IADjC,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,CAAA;IACnD,WAAA,MAAM,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,CAAA;IAGhD,WAAA,MAAM,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAA;qCARoB,aAAa;QACM,0BAA0B;QACzB,uBAAuB;QACvB,uBAAuB;QAClB,+BAA+B;QACrC,4BAA4B;QAGnC,YAAY;GAZ3E,qBAAqB,CA4LjC","sourcesContent":["import 'reflect-metadata';\nimport crypto from 'crypto';\nimport { injectable, inject } from 'inversify';\nimport { TOTP, Secret } from 'otpauth';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { AuditLogsBackendService } from '~wildo-backend-lib/compliance/audit-trails/services/audit-logs.backend.service';\nimport { AuthUserLookupBackendService } from '~wildo-backend-lib/security/authentications/services/utils/auth-user-lookup.backend.service';\nimport { AuthCredentialOpsBackendService } from '~wildo-backend-lib/security/authentications/services/utils/auth-credential-ops.backend.service';\nimport { RedisService } from '~wildo-backend-lib/databases/services/redis.service';\nimport { AUTH_REDIS_KEYS } from '~wildo-backend-lib/security/authentications/models/auth-constants.backend';\nimport { ErrorType, ErrorCustomMessageReference } from '@wildo-ai/saas-models';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\n\nexport interface TotpSetupResult {\n secret: string;\n qrCodeUri: string;\n backupCodes: string[];\n}\n\nexport interface TotpSetupParams {\n userId: string;\n email: string;\n ipAddress: string;\n userAgent: string;\n}\n\nexport interface TotpVerifySetupParams {\n userId: string;\n code: string;\n ipAddress: string;\n userAgent: string;\n}\n\n/*\n Outcome of {@link AuthMfaBackendService.verifyEnrolledSecondFactor}.\n \n `usedBackupCode` is reported rather than folded into `valid` because a consumed backup code is a\n * materially different event from a TOTP success: it is single-use, it depletes a finite reserve,\n * and callers surface it (login returns it as `challengeData`).\n /\nexport interface EnrolledSecondFactorVerification {\n readonly valid: boolean;\n readonly usedBackupCode: boolean;\n /* Set when the principal has no usable enrolled second factor at all (no verified TOTP secret). /\n readonly notEnrolled: boolean;\n}\n\n/\n TOTP enrollment — setup and verify-setup.\n * Uses static `otpauth` import (cleanup from dynamic import in controller).\n /\n@injectable()\nexport class AuthMfaBackendService {\n private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n @inject(SAAS_SERVICE_TYPES.AuditLogsService) private readonly auditLogsService: AuditLogsBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthCredentialOpsService) private readonly credentialOps: AuthCredentialOpsBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthUserLookupService) private readonly userLookup: AuthUserLookupBackendService,\n // Appended LAST on purpose: a constructor parameter inserted in the middle silently re-binds\n // every following injection in this service's DI signature.\n @inject(SAAS_SERVICE_TYPES.RedisService) private readonly redisService: RedisService,\n ) {\n this.logDebug = this.logger.debugByType('AuthMfa');\n this.logger.setDebugTypeLogging('AuthMfa', false);\n }\n\n /\n Verify an ALREADY-ENROLLED second factor: a TOTP code, or one of the principal's backup codes.\n \n # Why this is a shared primitive rather than per-caller logic\n \n Two callers need exactly this question answered — the login second-factor step\n * (`authentication-orchestrator`) and step-up re-authentication\n * (`auth-method-management.reAuthenticate`) — and the answer carries three protections that a\n * naive `totp.validate()` does not:\n \n - Anti-replay (RFC 6238 §5.2). A TOTP code stays valid for a whole time step plus the\n * configured drift window, so without this a code observed once can be presented again inside\n * that window. The absolute time step is recorded in Redis and anything at or below it is\n * refused. This is precisely what makes step-up worth having: a code shoulder-surfed during\n * login must NOT also authorize a destructive operation moments later.\n * - Backup-code fallback with constant-time comparison, iterating every stored hash so a\n * match position cannot leak through timing, and consuming the code on success.\n * - The enrollment guard — an unverified or absent secret is `notEnrolled`, distinct from a\n * wrong code, so callers can tell \"you have no second factor\" from \"that code is wrong\".\n \n Duplicating any of this per caller would create a second, weaker door onto the same credential.\n * Callers own their own reactions (session attempt counting, audit events, error shapes); this\n * method owns only the cryptographic and replay question and NEVER throws for a bad code.\n \n assurance-control: WILDO.IDENTITY.MULTI_FACTOR — one verification authority for enrolled second\n * factors, replay-resistant and timing-safe.\n /\n public async verifyEnrolledSecondFactor(\n ec: ExecutionContext<any>,\n userId: string,\n token: string,\n ): Promise<EnrolledSecondFactorVerification> {\n const cred = await this.credentialOps.readByUserId(ec, userId);\n\n if (!cred \|\| !cred.totpVerified \|\| !cred.secretBase32) {\n return { valid: false, usedBackupCode: false, notEnrolled: true };\n }\n\n const { algorithm, digits, period, window } = this.appConfigService.config.auth.totpOperational;\n const totp = new TOTP({ secret: cred.secretBase32, algorithm, digits, period });\n\n const delta = totp.validate({ token, window });\n let isValidTOTP = delta !== null;\n\n // Anti-replay: store the ABSOLUTE time step (current period + delta), not the relative delta —\n // a relative value stops being comparable the moment the period rolls over.\n if (isValidTOTP) {\n const currentTimeStep = Math.floor(Date.now() / (period 1000));\n const absoluteStep = currentTimeStep + delta!;\n const replayKey = `${AUTH_REDIS_KEYS.TOTP_USED}${userId}`;\n const lastUsedStep = await this.redisService.get<string>(replayKey);\n if (lastUsedStep !== null && absoluteStep <= parseInt(lastUsedStep as string, 10)) {\n isValidTOTP = false;\n } else {\n await this.redisService.set(replayKey, String(absoluteStep), { ttl: 90 });\n }\n }\n\n if (isValidTOTP) return { valid: true, usedBackupCode: false, notEnrolled: false };\n\n if (cred.backupCodesHashed?.length > 0) {\n const inputHash = crypto.createHash('sha256').update(token).digest('hex');\n const inputBuf = Buffer.from(inputHash, 'hex');\n\n let matchIndex = -1;\n for (let i = 0; i < cred.backupCodesHashed.length; i++) {\n const storedBuf = Buffer.from(cred.backupCodesHashed[i], 'hex');\n if (inputBuf.length === storedBuf.length && crypto.timingSafeEqual(inputBuf, storedBuf)) {\n matchIndex = i;\n // Deliberately NO `break` — always compare every hash so the match position cannot leak.\n }\n }\n\n if (matchIndex >= 0) {\n const updatedCodes = [...cred.backupCodesHashed];\n updatedCodes.splice(matchIndex, 1);\n await this.credentialOps.updateBackupCodes(ec, cred._id, updatedCodes);\n return { valid: true, usedBackupCode: true, notEnrolled: false };\n }\n }\n\n return { valid: false, usedBackupCode: false, notEnrolled: false };\n }\n\n async setupTOTP(ec: ExecutionContext<any>, params: TotpSetupParams): Promise<TotpSetupResult> {\n const { userId, ipAddress, userAgent } = params;\n\n this.logDebug('MFA TOTP setup requested', { userId });\n\n const cred = await this.credentialOps.readByUserId(ec, userId);\n\n if (!cred) {\n throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_CREDENTIALS_NOT_FOUND,\n });\n }\n\n if (cred.totpVerified) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.MFA_TOTP_ALREADY_ENROLLED,\n });\n }\n\n const secret = new Secret();\n const totpConfig = this.appConfigService.config.auth.totpOperational;\n const issuer = totpConfig.issuer \|\| this.appConfigService.config.appIdentity.appName \|\| 'Wildo';\n\n const accountName = await this.userLookup.getUserEmail(ec, userId) \|\| userId;\n const label = totpConfig.includeIssuerInLabel ? accountName : accountName;\n\n const totp = new TOTP({\n issuer,\n label,\n algorithm: totpConfig.algorithm,\n digits: totpConfig.digits,\n period: totpConfig.period,\n secret,\n });\n const qrCodeUri = totp.toString();\n\n const backupCodes: string[] = [];\n const backupCodesHashed: string[] = [];\n for (let i = 0; i < 10; i++) {\n const code = crypto.randomBytes(4).toString('hex');\n backupCodes.push(code);\n backupCodesHashed.push(crypto.createHash('sha256').update(code).digest('hex'));\n }\n\n await this.credentialOps.writeTotpSetup(ec, cred._id, { secretBase32: secret.base32, backupCodesHashed });\n\n this.auditLogsService.logUserMFASetupStarted({ userId: userId, mfaMethod: 'totp', ipAddress, userAgent }, ec).catch(() => {});\n this.logDebug('TOTP secret generated on credentials, awaiting verification', { userId });\n\n return { secret: secret.base32, qrCodeUri, backupCodes };\n }\n\n async verifyTOTPSetup(ec: ExecutionContext<any>, params: TotpVerifySetupParams): Promise<{ verified: boolean }> {\n const { userId, code, ipAddress, userAgent } = params;\n\n this.logDebug('MFA TOTP verify-setup requested', { userId });\n\n const cred = await this.credentialOps.readByUserId(ec, userId);\n\n if (!cred \|\| !cred.secretBase32 \|\| cred.totpVerified) {\n throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {\n customMessageReference: ErrorCustomMessageReference.MFA_TOTP_SETUP_NOT_INITIATED,\n });\n }\n\n const totpConfig = this.appConfigService.config.auth.totpOperational;\n const totp = new TOTP({\n secret: cred.secretBase32,\n algorithm: totpConfig.algorithm,\n digits: totpConfig.digits,\n period: totpConfig.period,\n });\n const delta = totp.validate({ token: code, window: totpConfig.window });\n if (delta === null) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.MFA_TOTP_CODE_INVALID,\n });\n }\n\n await this.credentialOps.confirmTotpSetup(ec, cred._id);\n\n this.auditLogsService.logUserMFASetupCompleted({ userId: userId, mfaMethod: 'totp', ipAddress, userAgent }, ec).catch(() => {});\n this.logDebug('TOTP setup verified successfully', { userId });\n\n return { verified: true };\n }\n}\n"]}
1	+ {"version":3,"file":"auth-mfa.backend.service.js","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/auth-methods/auth-mfa.backend.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AACzH,OAAO,EAAE,4BAA4B,EAAE,MAAM,6FAA6F,CAAC;AAC3I,OAAO,EAAE,+BAA+B,EAAE,MAAM,gGAAgG,CAAC;AACjJ,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,eAAe,EAAE,MAAM,2EAA2E,CAAC;AAC5G,OAAO,EAAE,SAAS,EAAE,2BAA2B,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAqCzG;;;GAGG;AAEI,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IAIsB;IACa;IACH;IACA;IACQ;IACH;IAGT;IAX3C,QAAQ,CAA+D;IAExF,YACsD,MAAqB,EACR,YAAwC,EAC3C,gBAAyC,EACzC,gBAAyC,EACjC,aAA8C,EACjD,UAAwC,EAGjD,YAA0B;QARhC,WAAM,GAAN,MAAM,CAAe;QACR,iBAAY,GAAZ,YAAY,CAA4B;QAC3C,qBAAgB,GAAhB,gBAAgB,CAAyB;QACzC,qBAAgB,GAAhB,gBAAgB,CAAyB;QACjC,kBAAa,GAAb,aAAa,CAAiC;QACjD,eAAU,GAAV,UAAU,CAA8B;QAGjD,iBAAY,GAAZ,YAAY,CAAc;QAEpF,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACpD,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACI,KAAK,CAAC,0BAA0B,CACrC,EAAyB,EACzB,MAAc,EACd,KAAa;QAEb,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAE/D,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACtD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;QACpE,CAAC;QAED,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC;QAChG,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAEhF,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/C,IAAI,WAAW,GAAG,KAAK,KAAK,IAAI,CAAC;QAEjC,+FAA+F;QAC/F,4EAA4E;QAC5E,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC;YACjE,MAAM,YAAY,GAAG,eAAe,GAAG,KAAM,CAAC;YAC9C,MAAM,SAAS,GAAG,GAAG,eAAe,CAAC,SAAS,GAAG,MAAM,EAAE,CAAC;YAC1D,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAS,SAAS,CAAC,CAAC;YACpE,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,IAAI,QAAQ,CAAC,YAAsB,EAAE,EAAE,CAAC,EAAE,CAAC;gBAClF,WAAW,GAAG,KAAK,CAAC;YACtB,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC;QAED,IAAI,WAAW;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;QAEnF,IAAI,IAAI,CAAC,iBAAiB,EAAE,MAAM,GAAG,CAAC,EAAE,CAAC;YACvC,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1E,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YAE/C,IAAI,UAAU,GAAG,CAAC,CAAC,CAAC;YACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACvD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;gBAChE,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,IAAI,MAAM,CAAC,eAAe,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;oBACxF,UAAU,GAAG,CAAC,CAAC;oBACf,yFAAyF;gBAC3F,CAAC;YACH,CAAC;YAED,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;gBACpB,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC,CAAC;gBACjD,YAAY,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;gBACnC,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;gBACvE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;YACnE,CAAC;QACH,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,EAAyB,EAAE,MAAuB;QAChE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;QAEhD,IAAI,CAAC,QAAQ,CAAC,0BAA0B,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAEtD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAE/D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;gBACjE,sBAAsB,EAAE,2BAA2B,CAAC,yCAAyC;aAC9F,CAAC,CAAC;QACL,CAAC;QAED,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;gBAClE,sBAAsB,EAAE,2BAA2B,CAAC,yBAAyB;aAC9E,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QAC5B,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC;QACrE,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,IAAI,OAAO,CAAC;QAEhG,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC;QAC7E,MAAM,KAAK,GAAG,UAAU,CAAC,oBAAoB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC;QAE1E,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC;YACpB,MAAM;YACN,KAAK;YACL,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,MAAM;SACP,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAElC,MAAM,WAAW,GAAa,EAAE,CAAC;QACjC,MAAM,iBAAiB,GAAa,EAAE,CAAC;QACvC,+FAA+F;QAC/F,yEAAyE;QACzE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,wBAAwB,CAAC,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5D,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,wBAAwB,CAAC,eAAe,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC1F,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvB,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACjF,CAAC;QAED,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAE1G,IAAI,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC9H,IAAI,CAAC,QAAQ,CAAC,6DAA6D,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAEzF,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,EAAyB,EAAE,MAA6B;QAC5E,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;QAEtD,IAAI,CAAC,QAAQ,CAAC,iCAAiC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAE7D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAE/D,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACrD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;gBACjE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;aACjF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC;QACrE,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC;YACpB,MAAM,EAAE,IAAI,CAAC,YAAY;YACzB,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QACxE,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,qBAAqB;aAC1E,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QAExD,IAAI,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAChI,IAAI,CAAC,QAAQ,CAAC,kCAAkC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAE9D,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC5B,CAAC;CACF,CAAA;AA9LY,qBAAqB;IADjC,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,CAAA;IACnD,WAAA,MAAM,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,CAAA;IAGhD,WAAA,MAAM,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAA;qCARoB,aAAa;QACM,0BAA0B;QACzB,uBAAuB;QACvB,uBAAuB;QAClB,+BAA+B;QACrC,4BAA4B;QAGnC,YAAY;GAZ3E,qBAAqB,CA8LjC","sourcesContent":["import 'reflect-metadata';\nimport crypto from 'crypto';\nimport { injectable, inject } from 'inversify';\nimport { TOTP, Secret } from 'otpauth';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { AuditLogsBackendService } from '~wildo-backend-lib/compliance/audit-trails/services/audit-logs.backend.service';\nimport { AuthUserLookupBackendService } from '~wildo-backend-lib/security/authentications/services/utils/auth-user-lookup.backend.service';\nimport { AuthCredentialOpsBackendService } from '~wildo-backend-lib/security/authentications/services/utils/auth-credential-ops.backend.service';\nimport { RedisService } from '~wildo-backend-lib/databases/services/redis.service';\nimport { AUTH_REDIS_KEYS } from '~wildo-backend-lib/security/authentications/models/auth-constants.backend';\nimport { ErrorType, ErrorCustomMessageReference, MFA_BACKUP_CODE_CONTRACT } from '@wildo-ai/saas-models';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\n\nexport interface TotpSetupResult {\n secret: string;\n qrCodeUri: string;\n backupCodes: string[];\n}\n\nexport interface TotpSetupParams {\n userId: string;\n email: string;\n ipAddress: string;\n userAgent: string;\n}\n\nexport interface TotpVerifySetupParams {\n userId: string;\n code: string;\n ipAddress: string;\n userAgent: string;\n}\n\n/*\n Outcome of {@link AuthMfaBackendService.verifyEnrolledSecondFactor}.\n \n `usedBackupCode` is reported rather than folded into `valid` because a consumed backup code is a\n * materially different event from a TOTP success: it is single-use, it depletes a finite reserve,\n * and callers surface it (login returns it as `challengeData`).\n /\nexport interface EnrolledSecondFactorVerification {\n readonly valid: boolean;\n readonly usedBackupCode: boolean;\n /* Set when the principal has no usable enrolled second factor at all (no verified TOTP secret). /\n readonly notEnrolled: boolean;\n}\n\n/\n TOTP enrollment — setup and verify-setup.\n * Uses static `otpauth` import (cleanup from dynamic import in controller).\n /\n@injectable()\nexport class AuthMfaBackendService {\n private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n @inject(SAAS_SERVICE_TYPES.AuditLogsService) private readonly auditLogsService: AuditLogsBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthCredentialOpsService) private readonly credentialOps: AuthCredentialOpsBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthUserLookupService) private readonly userLookup: AuthUserLookupBackendService,\n // Appended LAST on purpose: a constructor parameter inserted in the middle silently re-binds\n // every following injection in this service's DI signature.\n @inject(SAAS_SERVICE_TYPES.RedisService) private readonly redisService: RedisService,\n ) {\n this.logDebug = this.logger.debugByType('AuthMfa');\n this.logger.setDebugTypeLogging('AuthMfa', false);\n }\n\n /\n Verify an ALREADY-ENROLLED second factor: a TOTP code, or one of the principal's backup codes.\n \n # Why this is a shared primitive rather than per-caller logic\n \n Two callers need exactly this question answered — the login second-factor step\n * (`authentication-orchestrator`) and step-up re-authentication\n * (`auth-method-management.reAuthenticate`) — and the answer carries three protections that a\n * naive `totp.validate()` does not:\n \n - Anti-replay (RFC 6238 §5.2). A TOTP code stays valid for a whole time step plus the\n * configured drift window, so without this a code observed once can be presented again inside\n * that window. The absolute time step is recorded in Redis and anything at or below it is\n * refused. This is precisely what makes step-up worth having: a code shoulder-surfed during\n * login must NOT also authorize a destructive operation moments later.\n * - Backup-code fallback with constant-time comparison, iterating every stored hash so a\n * match position cannot leak through timing, and consuming the code on success.\n * - The enrollment guard — an unverified or absent secret is `notEnrolled`, distinct from a\n * wrong code, so callers can tell \"you have no second factor\" from \"that code is wrong\".\n \n Duplicating any of this per caller would create a second, weaker door onto the same credential.\n * Callers own their own reactions (session attempt counting, audit events, error shapes); this\n * method owns only the cryptographic and replay question and NEVER throws for a bad code.\n \n assurance-control: WILDO.IDENTITY.MULTI_FACTOR — one verification authority for enrolled second\n * factors, replay-resistant and timing-safe.\n /\n public async verifyEnrolledSecondFactor(\n ec: ExecutionContext<any>,\n userId: string,\n token: string,\n ): Promise<EnrolledSecondFactorVerification> {\n const cred = await this.credentialOps.readByUserId(ec, userId);\n\n if (!cred \|\| !cred.totpVerified \|\| !cred.secretBase32) {\n return { valid: false, usedBackupCode: false, notEnrolled: true };\n }\n\n const { algorithm, digits, period, window } = this.appConfigService.config.auth.totpOperational;\n const totp = new TOTP({ secret: cred.secretBase32, algorithm, digits, period });\n\n const delta = totp.validate({ token, window });\n let isValidTOTP = delta !== null;\n\n // Anti-replay: store the ABSOLUTE time step (current period + delta), not the relative delta —\n // a relative value stops being comparable the moment the period rolls over.\n if (isValidTOTP) {\n const currentTimeStep = Math.floor(Date.now() / (period 1000));\n const absoluteStep = currentTimeStep + delta!;\n const replayKey = `${AUTH_REDIS_KEYS.TOTP_USED}${userId}`;\n const lastUsedStep = await this.redisService.get<string>(replayKey);\n if (lastUsedStep !== null && absoluteStep <= parseInt(lastUsedStep as string, 10)) {\n isValidTOTP = false;\n } else {\n await this.redisService.set(replayKey, String(absoluteStep), { ttl: 90 });\n }\n }\n\n if (isValidTOTP) return { valid: true, usedBackupCode: false, notEnrolled: false };\n\n if (cred.backupCodesHashed?.length > 0) {\n const inputHash = crypto.createHash('sha256').update(token).digest('hex');\n const inputBuf = Buffer.from(inputHash, 'hex');\n\n let matchIndex = -1;\n for (let i = 0; i < cred.backupCodesHashed.length; i++) {\n const storedBuf = Buffer.from(cred.backupCodesHashed[i], 'hex');\n if (inputBuf.length === storedBuf.length && crypto.timingSafeEqual(inputBuf, storedBuf)) {\n matchIndex = i;\n // Deliberately NO `break` — always compare every hash so the match position cannot leak.\n }\n }\n\n if (matchIndex >= 0) {\n const updatedCodes = [...cred.backupCodesHashed];\n updatedCodes.splice(matchIndex, 1);\n await this.credentialOps.updateBackupCodes(ec, cred._id, updatedCodes);\n return { valid: true, usedBackupCode: true, notEnrolled: false };\n }\n }\n\n return { valid: false, usedBackupCode: false, notEnrolled: false };\n }\n\n async setupTOTP(ec: ExecutionContext<any>, params: TotpSetupParams): Promise<TotpSetupResult> {\n const { userId, ipAddress, userAgent } = params;\n\n this.logDebug('MFA TOTP setup requested', { userId });\n\n const cred = await this.credentialOps.readByUserId(ec, userId);\n\n if (!cred) {\n throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_CREDENTIALS_NOT_FOUND,\n });\n }\n\n if (cred.totpVerified) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.MFA_TOTP_ALREADY_ENROLLED,\n });\n }\n\n const secret = new Secret();\n const totpConfig = this.appConfigService.config.auth.totpOperational;\n const issuer = totpConfig.issuer \|\| this.appConfigService.config.appIdentity.appName \|\| 'Wildo';\n\n const accountName = await this.userLookup.getUserEmail(ec, userId) \|\| userId;\n const label = totpConfig.includeIssuerInLabel ? accountName : accountName;\n\n const totp = new TOTP({\n issuer,\n label,\n algorithm: totpConfig.algorithm,\n digits: totpConfig.digits,\n period: totpConfig.period,\n secret,\n });\n const qrCodeUri = totp.toString();\n\n const backupCodes: string[] = [];\n const backupCodesHashed: string[] = [];\n // Count and length come from `MFA_BACKUP_CODE_CONTRACT`, which the customer documentation also\n // projects: what a person is told they receive is what this loop issues.\n for (let i = 0; i < MFA_BACKUP_CODE_CONTRACT.codeCount; i++) {\n const code = crypto.randomBytes(MFA_BACKUP_CODE_CONTRACT.codeRandomBytes).toString('hex');\n backupCodes.push(code);\n backupCodesHashed.push(crypto.createHash('sha256').update(code).digest('hex'));\n }\n\n await this.credentialOps.writeTotpSetup(ec, cred._id, { secretBase32: secret.base32, backupCodesHashed });\n\n this.auditLogsService.logUserMFASetupStarted({ userId: userId, mfaMethod: 'totp', ipAddress, userAgent }, ec).catch(() => {});\n this.logDebug('TOTP secret generated on credentials, awaiting verification', { userId });\n\n return { secret: secret.base32, qrCodeUri, backupCodes };\n }\n\n async verifyTOTPSetup(ec: ExecutionContext<any>, params: TotpVerifySetupParams): Promise<{ verified: boolean }> {\n const { userId, code, ipAddress, userAgent } = params;\n\n this.logDebug('MFA TOTP verify-setup requested', { userId });\n\n const cred = await this.credentialOps.readByUserId(ec, userId);\n\n if (!cred \|\| !cred.secretBase32 \|\| cred.totpVerified) {\n throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {\n customMessageReference: ErrorCustomMessageReference.MFA_TOTP_SETUP_NOT_INITIATED,\n });\n }\n\n const totpConfig = this.appConfigService.config.auth.totpOperational;\n const totp = new TOTP({\n secret: cred.secretBase32,\n algorithm: totpConfig.algorithm,\n digits: totpConfig.digits,\n period: totpConfig.period,\n });\n const delta = totp.validate({ token: code, window: totpConfig.window });\n if (delta === null) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.MFA_TOTP_CODE_INVALID,\n });\n }\n\n await this.credentialOps.confirmTotpSetup(ec, cred._id);\n\n this.auditLogsService.logUserMFASetupCompleted({ userId: userId, mfaMethod: 'totp', ipAddress, userAgent }, ec).catch(() => {});\n this.logDebug('TOTP setup verified successfully', { userId });\n\n return { verified: true };\n }\n}\n"]}

package/dist/esm/security/authentications/services/auth-methods/auth-registration.backend.service.d.ts CHANGED Viewed

@@ -18,6 +18,7 @@ import { AuthenticationOrchestratorBackendService } from '../../../../security/a
 import type { EmailVerificationInitiatorBackendService } from '../../../../security/authentications/services/email-verification-initiator.backend.service';
 import type { WebAuthnBackendService } from '../../../../security/authentications/services/auth-methods/webauthn.backend.service';
 import type { PublicKeyCredentialCreationOptionsJSON } from '@simplewebauthn/server';
+import { AuthMethod } from '@wildo-ai/saas-models';
 import type { AuthInvitationInfoResponse, InvitationAcceptCredentialMethod } from '@wildo-ai/saas-models';
 import type { ExecutionContext } from '../../../../runtime/models/execution-context.backend.schemas';
 export interface RegisterUserParams {
@@ -27,6 +28,14 @@ export interface RegisterUserParams {
     password?: string;
     /** W5.5: Org name provided during registration when orgNameSource is 'ask'. */
     organizationName?: string;
+    /**
+     * How the registrant will authenticate afterwards. Absent ⇒ {@link AuthMethod.PASSWORD}, which is
+     * what every caller meant before there was a choice (#463).
+     *
+     * Only a method the user type lists in `registration.allowedMethods` is accepted, and only
+     * PASSWORD, MAGIC_LINK and PASSKEY have a public-signup implementation.
+     */
+    method?: AuthMethod;
 }
 export interface RegisterUserContext {
     frontendUrl: string;
@@ -178,6 +187,38 @@ export declare class AuthRegistrationBackendService {
     /**
      * User registration.
      * Returns generic success on email collision (anti-enumeration).
+     *
+     * ## Password-less registration, and the three questions it owed (#463)
+     *
+     * `params.method` selects how the registrant will authenticate afterwards. PASSWORD is unchanged
+     * and is the default. MAGIC_LINK and PASSKEY create the account with NO credential and hand back a
+     * magic link; there is no session at signup, because nothing has been proven yet.
+     *
+     * **Verification.** The link IS the proof — clicking it establishes both the address and the first
+     * session, so a magic-link registration cannot reach an authenticated state without verifying. For
+     * PASSKEY this is the only available proof: a passkey attests possession of an authenticator and
+     * says nothing whatsoever about an email address, and enrolling one needs a session bound to a
+     * user, which public signup has no invitation token to stand in for. So a public passkey signup
+     * necessarily routes through the link.
+     *
+     * **Anti-enumeration.** Unchanged and load-bearing: an address already in use returns the same
+     * success response and sends nothing. The observable a magic-link signup adds — whether a mail
+     * arrives — is exactly the one the existing password flow already exposes through its verification
+     * mail, so the surface is not widened. No `userId` is returned for a password-less registration,
+     * which the password path does return under DEFERRED: handing an unauthenticated caller an
+     * identifier for an account they have not shown they own would be a new disclosure.
+     *
+     * **Recovery — the question this issue said to settle first, and the design answers it.** A
+     * passkey-only account that loses its authenticator is NOT locked out, because the account always
+     * has a proven address and the magic link is a standing way in. The registrant requests a link,
+     * signs in, and enrolls a replacement passkey through the authenticated route. No separate recovery
+     * mechanism was needed, and none was invented — which is the strongest form the answer could take,
+     * because a recovery path that exists only for one method is a path nobody maintains.
+     *
+     * The corollary is worth stating so it is not weakened later: **a passkey-only account must keep a
+     * usable email address**, and anything that would let an application disable magic links for a user
+     * type while allowing passkey registration would recreate the lockout. That pairing belongs in
+     * `registration.allowedMethods` validation the day such a switch exists.
      */
     registerUser(ec: ExecutionContext<any>, params: RegisterUserParams, ctx: RegisterUserContext): Promise<{
         messageRef: string;

package/dist/esm/security/authentications/services/auth-methods/auth-registration.backend.service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"auth-registration.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/auth-methods/auth-registration.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAK1B,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,yEAAyE,CAAC;AAC/H,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,6BAA6B,EAAE,MAAM,yFAAyF,CAAC;AACxI,OAAO,KAAK,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AACrK,OAAO,EAAE,oCAAoC,EAAE,MAAM,+FAA+F,CAAC;AACrJ,OAAO,EAAE,6BAA6B,EAAE,MAAM,wFAAwF,CAAC;AACvI,OAAO,EAAE,4BAA4B,EAAE,MAAM,6FAA6F,CAAC;AAC3I,OAAO,EAAE,gCAAgC,EAAE,MAAM,iGAAiG,CAAC;AAEnJ,OAAO,EAAE,+BAA+B,EAAE,MAAM,wGAAwG,CAAC;AACzJ,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AACzH,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,6FAA6F,CAAC;AACzJ,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAClI,OAAO,KAAK,EAAE,2CAA2C,EAAE,MAAM,yFAAyF,CAAC;AAiB3J,OAAO,EAAE,wCAAwC,EAAE,MAAM,kGAAkG,CAAC;AAC5J,OAAO,KAAK,EAAE,wCAAwC,EAAE,MAAM,mGAAmG,CAAC;AAClK,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4FAA4F,CAAC;AACzI,OAAO,KAAK,EAAE,sCAAsC,EAAE,MAAM,wBAAwB,CAAC;~~AA6BrF~~,OAAO,KAAK,EAA4B,0BAA0B,EAAmB,gCAAgC,EAAE,MAAM,uBAAuB,CAAC;AAErJ,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAE5G,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,gBAAgB,CAAC,EAAE,MAAM,CAAC;~~CAC3B~~;AAED,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,uIAAuI;IACvI,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,sBAAsB;IACrC,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2FAA2F;IAC3F,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,gCAAgC,CAAC;CACrD;AAED;;;;;GAKG;AACH,oBAAY,uBAAuB;IACjC,mGAAmG;IACnG,OAAO,YAAY;IACnB,uEAAuE;IACvE,eAAe,oBAAoB;CACpC;AAED,wEAAwE;AACxE,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,uBAAuB,CAAC,OAAO,CAAC;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,0BAA0B,CAAC,EAAE,MAAM,EAAE,CAAC;IACtC;;;;;OAKG;IACH,0BAA0B,CAAC,EAAE,sCAAsC,CAAC;CACrE;AAED;;;;;GAKG;AACH,MAAM,WAAW,+BAA+B;IAC9C,OAAO,EAAE,uBAAuB,CAAC,eAAe,CAAC;IACjD,iBAAiB,EAAE;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;CACH;AAED,MAAM,MAAM,sBAAsB,GAAG,6BAA6B,GAAG,+BAA+B,CAAC;AAErG,0FAA0F;AAC1F,MAAM,WAAW,mBAAmB;IAClC,wFAAwF;IACxF,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qBACa,8BAA8B;IAIJ,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IAChC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IACvC,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IAC1C,OAAO,CAAC,QAAQ,CAAC,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,UAAU;IACvB,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACpC,OAAO,CAAC,QAAQ,CAAC,YAAY;IACrC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACnB,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IACrC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAK/C,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IAM5B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAI1C,OAAO,CAAC,QAAQ,CAAC,eAAe;IAId,OAAO,CAAC,QAAQ,CAAC,0BAA0B;IAIpD,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAEvF,OAAO,CAAC,QAAQ,CAAC,6BAA6B;IAvChD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EAC3C,gBAAgB,EAAE,uBAAuB,EACnC,sBAAsB,EAAE,6BAA6B,EACrD,kBAAkB,EAAE,oCAAoC,EAC/D,WAAW,EAAE,6BAA6B,EACpC,UAAU,EAAE,4BAA4B,EACpC,kBAAkB,EAAE,gCAAgC,EACrD,YAAY,EAAE,+BAA+B,EACrD,gBAAgB,EAAE,uBAAuB,EAC3B,uBAAuB,EAAE,qCAAqC,EAC3D,gBAAgB,EAAE,wCAAwC,EAKxE,mBAAmB,EAAE,0BAA0B,EAMvC,aAAa,EAAE,yCAAyC,EAIpE,eAAe,EAAE,sBAAsB,EAIrB,0BAA0B,EAAE,wCAAwC,EAI7E,iBAAiB,EAAE,+BAA+B,EAEvG,6BAA6B,EAC5C,2CAA2C;IAM/C;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACG,iBAAiB,CACrB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,0BAA0B,CAAC;IA4ItC~~;;;OAGG~~;IACG,YAAY,CAChB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,kBAAkB,EAC1B,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;~~IA8ZzO~~;;;;;OAKG;IACG,WAAW,CACf,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC;QACT,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,0BAA0B,CAAC,EAAE,MAAM,EAAE,CAAC;QACtC,gBAAgB,CAAC,EAAE,OAAO,CAAC;KAC5B,CAAC;IAmHF;;OAEG;IACG,uBAAuB,CAC3B,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,wBAAwB,GAC/B,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAiCnD;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACG,gBAAgB,CACpB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,sBAAsB,GAC7B,OAAO,CAAC,sBAAsB,CAAC;IAolBlC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;YACW,uBAAuB;IAkCrC;;;;;;;;;OASG;IACH,OAAO,CAAC,wCAAwC;~~IAiChD~~;;;;;;OAMG;YACW,mCAAmC;IAajD;;;;;;OAMG;IACG,gBAAgB,CACpB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE;QACN,eAAe,EAAE,MAAM,CAAC;QACxB,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,GACA,OAAO,CAAC;QAAE,QAAQ,EAAE,IAAI,CAAA;KAAE,CAAC;IAwE9B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;YACW,4BAA4B;IA0B1C;;;;;;;;;;;;;OAaG;IACG,wBAAwB,CAC5B,GAAG,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAC1B,MAAM,EAAE;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,GAC/B,OAAO,CAAC,mBAAmB,EAAE,CAAC;IA+BjC;;;;;OAKG;IACG,kBAAkB,CACtB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,GACrD,OAAO,CAAC;QAAE,QAAQ,EAAE,IAAI,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IA0DtD;;;;;OAKG;IACG,kBAAkB,CACtB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/E,OAAO,CAAC;QAAE,QAAQ,EAAE,IAAI,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IAQtD;;;;;;;;;OASG;YACW,0BAA0B;IAgCxC;;;;OAIG;IACG,qBAAqB,CACzB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE;QACN,SAAS,EAAE,MAAM,CAAC;QAClB,gBAAgB,EAAE,MAAM,CAAC;KAC1B,GACA,OAAO,CAAC;QACT,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;CA6BH"}
1	+ {"version":3,"file":"auth-registration.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/auth-methods/auth-registration.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAK1B,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,yEAAyE,CAAC;AAC/H,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,6BAA6B,EAAE,MAAM,yFAAyF,CAAC;AACxI,OAAO,KAAK,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AACrK,OAAO,EAAE,oCAAoC,EAAE,MAAM,+FAA+F,CAAC;AACrJ,OAAO,EAAE,6BAA6B,EAAE,MAAM,wFAAwF,CAAC;AACvI,OAAO,EAAE,4BAA4B,EAAE,MAAM,6FAA6F,CAAC;AAC3I,OAAO,EAAE,gCAAgC,EAAE,MAAM,iGAAiG,CAAC;AAEnJ,OAAO,EAAE,+BAA+B,EAAE,MAAM,wGAAwG,CAAC;AACzJ,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AACzH,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,6FAA6F,CAAC;AACzJ,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAClI,OAAO,KAAK,EAAE,2CAA2C,EAAE,MAAM,yFAAyF,CAAC;AAiB3J,OAAO,EAAE,wCAAwC,EAAE,MAAM,kGAAkG,CAAC;AAC5J,OAAO,KAAK,EAAE,wCAAwC,EAAE,MAAM,mGAAmG,CAAC;AAClK,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4FAA4F,CAAC;AACzI,OAAO,KAAK,EAAE,sCAAsC,EAAE,MAAM,wBAAwB,CAAC;AAErF,OAAO,EAUL,UAAU,EAgBX,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAA4B,0BAA0B,EAAmB,gCAAgC,EAAE,MAAM,uBAAuB,CAAC;AAErJ,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAE5G,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,uIAAuI;IACvI,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,sBAAsB;IACrC,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2FAA2F;IAC3F,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,gCAAgC,CAAC;CACrD;AAED;;;;;GAKG;AACH,oBAAY,uBAAuB;IACjC,mGAAmG;IACnG,OAAO,YAAY;IACnB,uEAAuE;IACvE,eAAe,oBAAoB;CACpC;AAED,wEAAwE;AACxE,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,uBAAuB,CAAC,OAAO,CAAC;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,0BAA0B,CAAC,EAAE,MAAM,EAAE,CAAC;IACtC;;;;;OAKG;IACH,0BAA0B,CAAC,EAAE,sCAAsC,CAAC;CACrE;AAED;;;;;GAKG;AACH,MAAM,WAAW,+BAA+B;IAC9C,OAAO,EAAE,uBAAuB,CAAC,eAAe,CAAC;IACjD,iBAAiB,EAAE;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;CACH;AAED,MAAM,MAAM,sBAAsB,GAAG,6BAA6B,GAAG,+BAA+B,CAAC;AAErG,0FAA0F;AAC1F,MAAM,WAAW,mBAAmB;IAClC,wFAAwF;IACxF,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qBACa,8BAA8B;IAIJ,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IAChC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IACvC,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IAC1C,OAAO,CAAC,QAAQ,CAAC,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,UAAU;IACvB,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACpC,OAAO,CAAC,QAAQ,CAAC,YAAY;IACrC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACnB,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IACrC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAK/C,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IAM5B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAI1C,OAAO,CAAC,QAAQ,CAAC,eAAe;IAId,OAAO,CAAC,QAAQ,CAAC,0BAA0B;IAIpD,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAEvF,OAAO,CAAC,QAAQ,CAAC,6BAA6B;IAvChD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EAC3C,gBAAgB,EAAE,uBAAuB,EACnC,sBAAsB,EAAE,6BAA6B,EACrD,kBAAkB,EAAE,oCAAoC,EAC/D,WAAW,EAAE,6BAA6B,EACpC,UAAU,EAAE,4BAA4B,EACpC,kBAAkB,EAAE,gCAAgC,EACrD,YAAY,EAAE,+BAA+B,EACrD,gBAAgB,EAAE,uBAAuB,EAC3B,uBAAuB,EAAE,qCAAqC,EAC3D,gBAAgB,EAAE,wCAAwC,EAKxE,mBAAmB,EAAE,0BAA0B,EAMvC,aAAa,EAAE,yCAAyC,EAIpE,eAAe,EAAE,sBAAsB,EAIrB,0BAA0B,EAAE,wCAAwC,EAI7E,iBAAiB,EAAE,+BAA+B,EAEvG,6BAA6B,EAC5C,2CAA2C;IAM/C;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACG,iBAAiB,CACrB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,0BAA0B,CAAC;IA4ItC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCG;IACG,YAAY,CAChB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,kBAAkB,EAC1B,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAuhBzO;;;;;OAKG;IACG,WAAW,CACf,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC;QACT,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,0BAA0B,CAAC,EAAE,MAAM,EAAE,CAAC;QACtC,gBAAgB,CAAC,EAAE,OAAO,CAAC;KAC5B,CAAC;IAmHF;;OAEG;IACG,uBAAuB,CAC3B,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,wBAAwB,GAC/B,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAiCnD;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACG,gBAAgB,CACpB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,sBAAsB,GAC7B,OAAO,CAAC,sBAAsB,CAAC;IAolBlC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;YACW,uBAAuB;IAkCrC;;;;;;;;;OASG;IACH,OAAO,CAAC,wCAAwC;IAkEhD;;;;;;OAMG;YACW,mCAAmC;IAajD;;;;;;OAMG;IACG,gBAAgB,CACpB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE;QACN,eAAe,EAAE,MAAM,CAAC;QACxB,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,GACA,OAAO,CAAC;QAAE,QAAQ,EAAE,IAAI,CAAA;KAAE,CAAC;IAwE9B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;YACW,4BAA4B;IA0B1C;;;;;;;;;;;;;OAaG;IACG,wBAAwB,CAC5B,GAAG,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAC1B,MAAM,EAAE;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,GAC/B,OAAO,CAAC,mBAAmB,EAAE,CAAC;IA+BjC;;;;;OAKG;IACG,kBAAkB,CACtB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,GACrD,OAAO,CAAC;QAAE,QAAQ,EAAE,IAAI,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IA0DtD;;;;;OAKG;IACG,kBAAkB,CACtB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/E,OAAO,CAAC;QAAE,QAAQ,EAAE,IAAI,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IAQtD;;;;;;;;;OASG;YACW,0BAA0B;IAgCxC;;;;OAIG;IACG,qBAAqB,CACzB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE;QACN,SAAS,EAAE,MAAM,CAAC;QAClB,gBAAgB,EAAE,MAAM,CAAC;KAC1B,GACA,OAAO,CAAC;QACT,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;CA6BH"}