@xemahq/identity-client 0.3.2

package/dist/nestjs/identity-bootstrap.service.js

@@ -0,0 +1,474 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var IdentityBootstrapService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IdentityBootstrapService = exports.IDENTITY_BOOTSTRAP_CONFIG = void 0;
+const common_1 = require("@nestjs/common");
+const client_1 = require("../client");
+const types_1 = require("../types");
+exports.IDENTITY_BOOTSTRAP_CONFIG = Symbol('IDENTITY_BOOTSTRAP_CONFIG');
+let IdentityBootstrapService = class IdentityBootstrapService {
+    static { IdentityBootstrapService_1 = this; }
+    config;
+    logger = new common_1.Logger(IdentityBootstrapService_1.name);
+    client;
+    clientId = null;
+    clientSecret = null;
+    tokenEndpoint = null;
+    keycloakBaseUrl = null;
+    allowedRealms = [];
+    primaryRealm = null;
+    registrationTokenScope = types_1.InternalTokenScope.ALL_REALMS_NAMESPACE;
+    accessToken = null;
+    tokenExpiresAt = 0;
+    tokenRefreshPromise = null;
+    lastCredentialFetchAt = 0;
+    static RECOVERY_DEBOUNCE_MS = 30_000;
+    static DISTRIBUTED_RECOVERY_DEBOUNCE_MS = 45_000;
+    userTokenCache = new Map();
+    userTokenInflight = new Map();
+    registrationStarted = false;
+    registrationAttempts = 0;
+    registrationTimer = null;
+    maxRegistrationAttempts;
+    baseRetryDelay;
+    maxRetryDelay;
+    readyResolve = null;
+    readyPromise;
+    isReady = false;
+    constructor(config) {
+        this.config = config;
+        this.client = new client_1.IdentityApiClient({
+            baseUrl: config.identityApiUrl,
+            internalToken: config.identityApiInternalToken,
+        });
+        this.maxRegistrationAttempts = config.maxRegistrationAttempts ?? Infinity;
+        this.baseRetryDelay = config.baseRetryDelay ?? 5000;
+        this.maxRetryDelay = config.maxRetryDelay ?? 300_000;
+        this.readyPromise = new Promise((resolve) => {
+            this.readyResolve = resolve;
+        });
+    }
+    async onModuleInit() {
+        if (this.config.clientId && this.config.clientSecret && this.config.tokenEndpoint) {
+            this.registrationStarted = true;
+            this.clientId = this.config.clientId;
+            this.clientSecret = this.config.clientSecret;
+            this.clientSecretWasSelfRegistered = false;
+            this.tokenEndpoint = this.config.tokenEndpoint;
+            this.keycloakBaseUrl = this.config.keycloakUrl ?? null;
+            this.allowedRealms = this.config.keycloakRealm ? [this.config.keycloakRealm] : [];
+            this.primaryRealm = this.config.keycloakRealm ?? null;
+            this.registrationTokenScope = types_1.InternalTokenScope.SINGLE_REALM;
+            try {
+                await this.refreshToken();
+                this.logger.log('Service account token obtained (pre-configured credentials)');
+                this.resolveReady(true);
+                return;
+            }
+            catch (error) {
+                const msg = error instanceof Error ? error.message : String(error);
+                throw new Error(`Pre-configured service account credentials are invalid: ${msg}. ` +
+                    'Fix clientId, clientSecret, and tokenEndpoint configuration.');
+            }
+        }
+        this.startBackgroundRegistration();
+    }
+    onModuleDestroy() {
+        if (this.registrationTimer) {
+            clearTimeout(this.registrationTimer);
+            this.registrationTimer = null;
+        }
+    }
+    async getAccessToken() {
+        if (this.accessToken && Date.now() < this.tokenExpiresAt - 30_000) {
+            return this.accessToken;
+        }
+        if (!this.clientId || !this.clientSecret || !this.tokenEndpoint) {
+            const ready = await this.waitForReady(30_000);
+            if (!ready || !this.clientId || !this.clientSecret || !this.tokenEndpoint) {
+                throw new Error('Service account credentials not available — identity-api registration may have failed');
+            }
+        }
+        if (this.tokenRefreshPromise) {
+            return this.tokenRefreshPromise;
+        }
+        this.tokenRefreshPromise = this.refreshToken();
+        try {
+            return await this.tokenRefreshPromise;
+        }
+        finally {
+            this.tokenRefreshPromise = null;
+        }
+    }
+    async getUserAccessToken(params) {
+        const realm = this.resolveUserTokenRealm(params.realm);
+        const cacheKey = `${realm}|${params.orgId}|${params.userId}|${params.audience ?? ''}`;
+        const cached = this.userTokenCache.get(cacheKey);
+        if (cached && Date.now() < cached.expiresAt - 30_000) {
+            return cached.token;
+        }
+        const inflight = this.userTokenInflight.get(cacheKey);
+        if (inflight) {
+            return inflight;
+        }
+        const promise = this.mintUserAccessToken(params, cacheKey, realm).finally(() => {
+            this.userTokenInflight.delete(cacheKey);
+        });
+        this.userTokenInflight.set(cacheKey, promise);
+        return promise;
+    }
+    async mintUserAccessToken(params, cacheKey, realm) {
+        if (!this.isReady) {
+            const ready = await this.waitForReady(30_000);
+            if (!ready) {
+                throw new Error('IdentityBootstrapService is not ready — cannot mint on-behalf-of token');
+            }
+        }
+        const request = {
+            userId: params.userId,
+            orgId: params.orgId,
+            realm: params.realm ?? realm,
+        };
+        if (params.audience !== undefined) {
+            request.audience = params.audience;
+        }
+        const response = await this.client.mintOnBehalfOfToken(request);
+        const expiresInMs = Math.max(response.expiresIn * 900, 30_000);
+        this.userTokenCache.set(cacheKey, {
+            token: response.accessToken,
+            expiresAt: Date.now() + expiresInMs,
+        });
+        return response.accessToken;
+    }
+    async waitForReady(timeoutMs = 60_000) {
+        if (this.isReady)
+            return true;
+        if (!this.registrationStarted) {
+            this.logger.warn('waitForReady called before onModuleInit — starting registration now');
+            this.startBackgroundRegistration();
+        }
+        return Promise.race([
+            this.readyPromise,
+            new Promise((resolve) => setTimeout(() => resolve(false), timeoutMs)),
+        ]);
+    }
+    hasCredentials() {
+        return this.isReady && this.clientId !== null && this.clientSecret !== null;
+    }
+    getClientId() {
+        return this.clientId;
+    }
+    getKeycloakBaseUrl() {
+        return this.keycloakBaseUrl;
+    }
+    getAllowedRealms() {
+        return this.allowedRealms;
+    }
+    async isMember(orgId, userId, realm) {
+        if (!this.isReady) {
+            const ready = await this.waitForReady(30_000);
+            if (!ready) {
+                throw new Error('IdentityBootstrapService is not ready — cannot verify membership');
+            }
+        }
+        const resolvedRealm = realm ?? this.resolveUserTokenRealm();
+        const response = await this.client.verifyMembership(userId, orgId, resolvedRealm);
+        return response.isMember;
+    }
+    async listOrgIds() {
+        if (!this.isReady) {
+            const ready = await this.waitForReady(30_000);
+            if (!ready) {
+                throw new Error('Identity bootstrap not ready after 30s — cannot list org IDs');
+            }
+        }
+        if (!this.allowedRealms.length) {
+            throw new Error('No allowed realms available — service registration may have failed');
+        }
+        const allIds = new Set();
+        for (const realm of this.allowedRealms) {
+            const ids = await this.client.listOrgIds(realm);
+            for (const id of ids) {
+                allIds.add(id);
+            }
+        }
+        return [...allIds];
+    }
+    startBackgroundRegistration() {
+        if (this.registrationStarted)
+            return;
+        this.registrationStarted = true;
+        this.logger.log({
+            message: 'Starting background identity-api registration',
+            serviceName: this.config.serviceName,
+        });
+        this.attemptRegistration();
+    }
+    async attemptRegistration() {
+        if (this.isReady)
+            return;
+        try {
+            const response = await this.client.registerServiceFull({
+                name: this.config.serviceName,
+                displayName: this.config.serviceDisplayName,
+                description: this.config.serviceDescription,
+                serviceType: 'BACKEND',
+                regenerateSecret: false,
+                ...(this.config.keycloakRealm ? { realm: this.config.keycloakRealm } : {}),
+            });
+            this.clientId = response.id;
+            this.tokenEndpoint = response.tokenEndpoint;
+            const registrationMetadata = this.requireRegistrationMetadata(response.keycloakBaseUrl, response.allowedRealms, response.primaryRealm, response.internalTokenScope);
+            this.keycloakBaseUrl = registrationMetadata.keycloakBaseUrl;
+            this.allowedRealms = registrationMetadata.allowedRealms;
+            this.primaryRealm = registrationMetadata.primaryRealm;
+            this.registrationTokenScope = registrationMetadata.internalTokenScope;
+            if (!response.clientSecret) {
+                throw new Error(`identity-api registration response missing required clientSecret ` +
+                    `(alreadyExisted=${response.alreadyExisted}). Server is on an ` +
+                    `older version that does not return existing secrets idempotently.`);
+            }
+            this.clientSecret = response.clientSecret;
+            this.clientSecretWasSelfRegistered = true;
+            await this.refreshToken();
+            this.logger.log({
+                message: 'Identity-api registration successful',
+                serviceName: this.config.serviceName,
+                clientId: this.clientId,
+                attempts: this.registrationAttempts + 1,
+            });
+            this.registrationAttempts = 0;
+            this.lastCredentialFetchAt = Date.now();
+            this.resolveReady(true);
+        }
+        catch (error) {
+            this.scheduleRetry(error);
+        }
+    }
+    requireRegistrationMetadata(keycloakBaseUrl, allowedRealms, primaryRealm, internalTokenScope) {
+        if (!keycloakBaseUrl) {
+            throw new Error('identity-api registration response missing required field: keycloakBaseUrl');
+        }
+        if (!allowedRealms || allowedRealms.length === 0) {
+            throw new Error('identity-api registration response missing required field: allowedRealms');
+        }
+        return {
+            keycloakBaseUrl,
+            allowedRealms,
+            primaryRealm: primaryRealm ?? null,
+            internalTokenScope: internalTokenScope ?? types_1.InternalTokenScope.ALL_REALMS_NAMESPACE,
+        };
+    }
+    resolveUserTokenRealm(explicitRealm) {
+        if (explicitRealm) {
+            return explicitRealm;
+        }
+        if (this.registrationTokenScope === types_1.InternalTokenScope.SINGLE_REALM) {
+            if (!this.primaryRealm) {
+                throw new Error('Identity registration indicates SINGLE_REALM scope but no primary realm is available');
+            }
+            return this.primaryRealm;
+        }
+        throw new Error(`Realm is required for on-behalf-of token mint when token scope is ${this.registrationTokenScope}`);
+    }
+    scheduleRetry(error) {
+        this.registrationAttempts++;
+        const errorMessage = error instanceof client_1.IdentityApiError
+            ? `${error.message} (status: ${error.statusCode})`
+            : error instanceof Error
+                ? error.message
+                : String(error);
+        if (this.registrationAttempts >= this.maxRegistrationAttempts) {
+            this.logger.error({
+                message: 'Identity-api registration failed — max attempts reached',
+                attempts: this.registrationAttempts,
+                error: errorMessage,
+            });
+            this.resolveReady(false);
+            return;
+        }
+        const delay = Math.min(this.baseRetryDelay * Math.pow(2, this.registrationAttempts - 1), this.maxRetryDelay);
+        this.logger.warn({
+            message: 'Identity-api registration failed, will retry',
+            attempt: this.registrationAttempts,
+            nextRetryInSeconds: Math.round(delay / 1000),
+            error: errorMessage,
+        });
+        this.registrationTimer = setTimeout(() => {
+            this.attemptRegistration();
+        }, delay);
+    }
+    clientSecretWasSelfRegistered = false;
+    async refreshToken() {
+        return this.refreshTokenWithRecovery(false);
+    }
+    async refreshTokenWithRecovery(recoveryAttempted) {
+        if (!this.clientId || !this.clientSecret || !this.tokenEndpoint) {
+            throw new Error('Cannot refresh token — credentials not available');
+        }
+        const response = await fetch(this.tokenEndpoint, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: new URLSearchParams({
+                grant_type: 'client_credentials',
+                client_id: this.clientId,
+                client_secret: this.clientSecret,
+            }).toString(),
+        });
+        if (response.status === 401 && !recoveryAttempted && this.clientSecretWasSelfRegistered) {
+            const text = await response.text().catch(() => '');
+            const sinceLastLocalFetch = Date.now() - this.lastCredentialFetchAt;
+            if (sinceLastLocalFetch < IdentityBootstrapService_1.RECOVERY_DEBOUNCE_MS) {
+                throw new Error(`Token request failed: 401 ${response.statusText} — credentials ` +
+                    `were just refreshed ${sinceLastLocalFetch}ms ago; not refetching to ` +
+                    `avoid storm. Server response: ${text.slice(0, 300)}`);
+            }
+            try {
+                const serverState = await this.checkCredentialRecoveryState();
+                if (serverState && serverState.shouldSkipRecovery) {
+                    throw new Error(`Token request failed: 401 ${response.statusText} — another replica ` +
+                        `fetched credentials ${serverState.timeSinceLastRecovery}ms ago; ` +
+                        `waiting for ${serverState.waitTimeMs}ms before retrying. ` +
+                        `Server response: ${text.slice(0, 300)}`);
+                }
+            }
+            catch (stateCheckError) {
+                if (stateCheckError instanceof Error && stateCheckError.message.includes('should skip')) {
+                    throw stateCheckError;
+                }
+                this.logger.warn({
+                    message: 'Failed to check distributed recovery state, proceeding with local coordination',
+                    error: stateCheckError instanceof Error ? stateCheckError.message : String(stateCheckError),
+                });
+            }
+            this.logger.warn({
+                message: 'Token request returned 401 — Keycloak client secret was rotated ' +
+                    'out of band; fetching current secret from identity-api',
+                clientId: this.clientId,
+                responseBody: text.slice(0, 300),
+            });
+            this.accessToken = null;
+            this.tokenExpiresAt = 0;
+            await this.fetchCurrentCredentials();
+            return this.refreshTokenWithRecovery(true);
+        }
+        if (!response.ok) {
+            const text = await response.text().catch(() => '');
+            throw new Error(`Token request failed: ${response.status} ${response.statusText} — ${text}`);
+        }
+        const data = (await response.json());
+        this.accessToken = data.access_token;
+        const expiresIn = data.expires_in || 60;
+        const jitterFraction = 0.8 + Math.random() * 0.15;
+        this.tokenExpiresAt = Date.now() + expiresIn * 1000 * jitterFraction;
+        return this.accessToken;
+    }
+    async fetchCurrentCredentials() {
+        const response = await this.client.registerServiceFull({
+            name: this.config.serviceName,
+            displayName: this.config.serviceDisplayName,
+            description: this.config.serviceDescription,
+            serviceType: 'BACKEND',
+            regenerateSecret: false,
+            ...(this.config.keycloakRealm ? { realm: this.config.keycloakRealm } : {}),
+        });
+        if (!response.clientSecret) {
+            throw new Error('identity-api did not return clientSecret on idempotent re-register ' +
+                '— server is on an older version that does not echo existing secrets');
+        }
+        this.clientId = response.id;
+        this.clientSecret = response.clientSecret;
+        this.tokenEndpoint = response.tokenEndpoint;
+        const metadata = this.requireRegistrationMetadata(response.keycloakBaseUrl, response.allowedRealms, response.primaryRealm, response.internalTokenScope);
+        this.keycloakBaseUrl = metadata.keycloakBaseUrl;
+        this.allowedRealms = metadata.allowedRealms;
+        this.primaryRealm = metadata.primaryRealm;
+        this.registrationTokenScope = metadata.internalTokenScope;
+        this.lastCredentialFetchAt = Date.now();
+        try {
+            await this.recordCredentialRecovery();
+        }
+        catch (error) {
+            this.logger.warn({
+                message: 'Failed to record credential recovery in distributed state',
+                error: error instanceof Error ? error.message : String(error),
+            });
+        }
+    }
+    async checkCredentialRecoveryState() {
+        try {
+            const response = await fetch(`${this.config.identityApiUrl}/internal/services/recovery-state/${encodeURIComponent(this.config.serviceName)}`, {
+                method: 'GET',
+                headers: {
+                    'Authorization': `Bearer ${this.config.identityApiInternalToken}`,
+                },
+            });
+            if (!response.ok) {
+                if (response.status === 404) {
+                    return null;
+                }
+                return null;
+            }
+            const data = (await response.json());
+            return data;
+        }
+        catch (error) {
+            this.logger.debug({
+                message: 'Failed to check distributed recovery state (network error)',
+                error: error instanceof Error ? error.message : String(error),
+            });
+            return null;
+        }
+    }
+    async recordCredentialRecovery() {
+        try {
+            const response = await fetch(`${this.config.identityApiUrl}/internal/services/record-recovery/${encodeURIComponent(this.config.serviceName)}`, {
+                method: 'POST',
+                headers: {
+                    'Authorization': `Bearer ${this.config.identityApiInternalToken}`,
+                    'Content-Type': 'application/json',
+                },
+                body: JSON.stringify({}),
+            });
+            if (!response.ok) {
+                this.logger.warn({
+                    message: 'Failed to record credential recovery on server',
+                    status: response.status,
+                    statusText: response.statusText,
+                });
+            }
+        }
+        catch (error) {
+            this.logger.debug({
+                message: 'Failed to record credential recovery (network error)',
+                error: error instanceof Error ? error.message : String(error),
+            });
+        }
+    }
+    resolveReady(success) {
+        this.isReady = success;
+        if (this.readyResolve) {
+            this.readyResolve(success);
+            this.readyResolve = null;
+        }
+    }
+};
+exports.IdentityBootstrapService = IdentityBootstrapService;
+exports.IdentityBootstrapService = IdentityBootstrapService = IdentityBootstrapService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(exports.IDENTITY_BOOTSTRAP_CONFIG)),
+    __metadata("design:paramtypes", [Object])
+], IdentityBootstrapService);
+//# sourceMappingURL=identity-bootstrap.service.js.map

package/dist/nestjs/identity-bootstrap.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-bootstrap.service.js","sourceRoot":"","sources":["../../src/nestjs/identity-bootstrap.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAMwB;AACxB,sCAAgE;AAChE,oCAA8C;AAIjC,QAAA,yBAAyB,GAAG,MAAM,CAAC,2BAA2B,CAAC,CAAC;AAiEtE,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;;IAuDhB;IAtDF,MAAM,GAAG,IAAI,eAAM,CAAC,0BAAwB,CAAC,IAAI,CAAC,CAAC;IACnD,MAAM,CAAoB;IAGnC,QAAQ,GAAkB,IAAI,CAAC;IAC/B,YAAY,GAAkB,IAAI,CAAC;IACnC,aAAa,GAAkB,IAAI,CAAC;IAGpC,eAAe,GAAkB,IAAI,CAAC;IACtC,aAAa,GAAa,EAAE,CAAC;IAC7B,YAAY,GAAkB,IAAI,CAAC;IACnC,sBAAsB,GAC5B,0BAAkB,CAAC,oBAAoB,CAAC;IAGlC,WAAW,GAAkB,IAAI,CAAC;IAClC,cAAc,GAAG,CAAC,CAAC;IACnB,mBAAmB,GAA2B,IAAI,CAAC;IAOnD,qBAAqB,GAAG,CAAC,CAAC;IAC1B,MAAM,CAAU,oBAAoB,GAAG,MAAM,CAAC;IAC9C,MAAM,CAAU,gCAAgC,GAAG,MAAM,CAAC;IAMjD,cAAc,GAAG,IAAI,GAAG,EAGtC,CAAC;IACa,iBAAiB,GAAG,IAAI,GAAG,EAA2B,CAAC;IAGhE,mBAAmB,GAAG,KAAK,CAAC;IAC5B,oBAAoB,GAAG,CAAC,CAAC;IACzB,iBAAiB,GAAyC,IAAI,CAAC;IACtD,uBAAuB,CAAS;IAChC,cAAc,CAAS;IACvB,aAAa,CAAS;IAG/B,YAAY,GAAsC,IAAI,CAAC;IAC9C,YAAY,CAAmB;IACxC,OAAO,GAAG,KAAK,CAAC;IAExB,YAEmB,MAA+B;QAA/B,WAAM,GAAN,MAAM,CAAyB;QAEhD,IAAI,CAAC,MAAM,GAAG,IAAI,0BAAiB,CAAC;YAClC,OAAO,EAAE,MAAM,CAAC,cAAc;YAC9B,aAAa,EAAE,MAAM,CAAC,wBAAwB;SAC/C,CAAC,CAAC;QAEH,IAAI,CAAC,uBAAuB,GAAG,MAAM,CAAC,uBAAuB,IAAI,QAAQ,CAAC;QAC1E,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,IAAI,CAAC;QACpD,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,OAAO,CAAC;QAErD,IAAI,CAAC,YAAY,GAAG,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,EAAE;YACnD,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC;QAC9B,CAAC,CAAC,CAAC;IACL,CAAC;IAID,KAAK,CAAC,YAAY;QAEhB,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;YAClF,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;YAChC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;YACrC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;YAC7C,IAAI,CAAC,6BAA6B,GAAG,KAAK,CAAC;YAC3C,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;YAC/C,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,IAAI,CAAC;YACvD,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAClF,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,IAAI,CAAC;YACtD,IAAI,CAAC,sBAAsB,GAAG,0BAAkB,CAAC,YAAY,CAAC;YAE9D,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC1B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAC;gBAC/E,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;gBACxB,OAAO;YACT,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACnE,MAAM,IAAI,KAAK,CACb,2DAA2D,GAAG,IAAI;oBAClE,8DAA8D,CAC/D,CAAC;YACJ,CAAC;QACH,CAAC;QAGD,IAAI,CAAC,2BAA2B,EAAE,CAAC;IACrC,CAAC;IAED,eAAe;QACb,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3B,YAAY,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YACrC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAChC,CAAC;IACH,CAAC;IAeD,KAAK,CAAC,cAAc;QAElB,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,cAAc,GAAG,MAAM,EAAE,CAAC;YAClE,OAAO,IAAI,CAAC,WAAW,CAAC;QAC1B,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YAEhE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;YAC9C,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;gBAC1E,MAAM,IAAI,KAAK,CACb,uFAAuF,CACxF,CAAC;YACJ,CAAC;QACH,CAAC;QAGD,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,mBAAmB,CAAC;QAClC,CAAC;QAED,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAC/C,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,mBAAmB,CAAC;QACxC,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;QAClC,CAAC;IACH,CAAC;IAwBD,KAAK,CAAC,kBAAkB,CAAC,MAKxB;QACC,MAAM,KAAK,GAAG,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,GAAG,KAAK,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QAEtF,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,MAAM,EAAE,CAAC;YACrD,OAAO,MAAM,CAAC,KAAK,CAAC;QACtB,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtD,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YAC7E,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC9C,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAC/B,MAA4E,EAC5E,QAAgB,EAChB,KAAa;QAKb,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;YAC9C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CACb,wEAAwE,CACzE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAKT;YACF,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,KAAK;SAC7B,CAAC;QACF,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QACrC,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAGhE,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,GAAG,GAAG,EAAE,MAAM,CAAC,CAAC;QAC/D,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE;YAChC,KAAK,EAAE,QAAQ,CAAC,WAAW;YAC3B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW;SACpC,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,WAAW,CAAC;IAC9B,CAAC;IAOD,KAAK,CAAC,YAAY,CAAC,SAAS,GAAG,MAAM;QACnC,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAK9B,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,qEAAqE,CACtE,CAAC;YACF,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACrC,CAAC;QAED,OAAO,OAAO,CAAC,IAAI,CAAC;YAClB,IAAI,CAAC,YAAY;YACjB,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,EAAE,CAC/B,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,CAC5C;SACF,CAAC,CAAC;IACL,CAAC;IAKD,cAAc;QACZ,OAAO,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC;IAC9E,CAAC;IAKD,WAAW;QACT,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAMD,kBAAkB;QAChB,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAMD,gBAAgB;QACd,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAoBD,KAAK,CAAC,QAAQ,CACZ,KAAa,EACb,MAAc,EACd,KAAc;QAEd,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;YAC9C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,aAAa,GAAG,KAAK,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC5D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,CACjD,MAAM,EACN,KAAK,EACL,aAAa,CACd,CAAC;QACF,OAAO,QAAQ,CAAC,QAAQ,CAAC;IAC3B,CAAC;IASD,KAAK,CAAC,UAAU;QACd,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;YAC9C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CACb,8DAA8D,CAC/D,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,oEAAoE,CACrE,CAAC;QACJ,CAAC;QAGD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;QACjC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAChD,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;gBACrB,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACjB,CAAC;QACH,CAAC;QACD,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC;IACrB,CAAC;IAIO,2BAA2B;QACjC,IAAI,IAAI,CAAC,mBAAmB;YAAE,OAAO;QACrC,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;YACd,OAAO,EAAE,+CAA+C;YACxD,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;SACrC,CAAC,CAAC;QACH,IAAI,CAAC,mBAAmB,EAAE,CAAC;IAC7B,CAAC;IAEO,KAAK,CAAC,mBAAmB;QAC/B,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QAEzB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC;gBACrD,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;gBAC7B,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB;gBAC3C,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB;gBAC3C,WAAW,EAAE,SAAS;gBACtB,gBAAgB,EAAE,KAAK;gBACvB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3E,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC,EAAE,CAAC;YAC5B,IAAI,CAAC,aAAa,GAAG,QAAQ,CAAC,aAAa,CAAC;YAC5C,MAAM,oBAAoB,GAAG,IAAI,CAAC,2BAA2B,CAC3D,QAAQ,CAAC,eAAe,EACxB,QAAQ,CAAC,aAAa,EACtB,QAAQ,CAAC,YAAY,EACrB,QAAQ,CAAC,kBAAkB,CAC5B,CAAC;YACF,IAAI,CAAC,eAAe,GAAG,oBAAoB,CAAC,eAAe,CAAC;YAC5D,IAAI,CAAC,aAAa,GAAG,oBAAoB,CAAC,aAAa,CAAC;YACxD,IAAI,CAAC,YAAY,GAAG,oBAAoB,CAAC,YAAY,CAAC;YACtD,IAAI,CAAC,sBAAsB,GAAG,oBAAoB,CAAC,kBAAkB,CAAC;YAOtE,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CACb,mEAAmE;oBACnE,mBAAmB,QAAQ,CAAC,cAAc,qBAAqB;oBAC/D,mEAAmE,CACpE,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,YAAY,GAAG,QAAQ,CAAC,YAAY,CAAC;YAC1C,IAAI,CAAC,6BAA6B,GAAG,IAAI,CAAC;YAG1C,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YAE1B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;gBACd,OAAO,EAAE,sCAAsC;gBAC/C,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;gBACpC,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,QAAQ,EAAE,IAAI,CAAC,oBAAoB,GAAG,CAAC;aACxC,CAAC,CAAC;YAEH,IAAI,CAAC,oBAAoB,GAAG,CAAC,CAAC;YAC9B,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACxC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAEO,2BAA2B,CACjC,eAAmC,EACnC,aAAmC,EACnC,YAAuC,EACvC,kBAAkD;QAOlD,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,4EAA4E,CAC7E,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,aAAa,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CACb,0EAA0E,CAC3E,CAAC;QACJ,CAAC;QAED,OAAO;YACL,eAAe;YACf,aAAa;YACb,YAAY,EAAE,YAAY,IAAI,IAAI;YAClC,kBAAkB,EAChB,kBAAkB,IAAI,0BAAkB,CAAC,oBAAoB;SAChE,CAAC;IACJ,CAAC;IAEO,qBAAqB,CAAC,aAAsB;QAClD,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,aAAa,CAAC;QACvB,CAAC;QAED,IAAI,IAAI,CAAC,sBAAsB,KAAK,0BAAkB,CAAC,YAAY,EAAE,CAAC;YACpE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CACb,sFAAsF,CACvF,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,CAAC,YAAY,CAAC;QAC3B,CAAC;QAED,MAAM,IAAI,KAAK,CACb,qEAAqE,IAAI,CAAC,sBAAsB,EAAE,CACnG,CAAC;IACJ,CAAC;IAEO,aAAa,CAAC,KAAc;QAClC,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAE5B,MAAM,YAAY,GAChB,KAAK,YAAY,yBAAgB;YAC/B,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,aAAa,KAAK,CAAC,UAAU,GAAG;YAClD,CAAC,CAAC,KAAK,YAAY,KAAK;gBACtB,CAAC,CAAC,KAAK,CAAC,OAAO;gBACf,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAEtB,IAAI,IAAI,CAAC,oBAAoB,IAAI,IAAI,CAAC,uBAAuB,EAAE,CAAC;YAC9D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;gBAChB,OAAO,EAAE,yDAAyD;gBAClE,QAAQ,EAAE,IAAI,CAAC,oBAAoB;gBACnC,KAAK,EAAE,YAAY;aACpB,CAAC,CAAC;YACH,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;YACzB,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CACpB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,oBAAoB,GAAG,CAAC,CAAC,EAChE,IAAI,CAAC,aAAa,CACnB,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACf,OAAO,EAAE,8CAA8C;YACvD,OAAO,EAAE,IAAI,CAAC,oBAAoB;YAClC,kBAAkB,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC;YAC5C,KAAK,EAAE,YAAY;SACpB,CAAC,CAAC;QAEH,IAAI,CAAC,iBAAiB,GAAG,UAAU,CAAC,GAAG,EAAE;YACvC,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC7B,CAAC,EAAE,KAAK,CAAC,CAAC;IACZ,CAAC;IAUO,6BAA6B,GAAG,KAAK,CAAC;IAEtC,KAAK,CAAC,YAAY;QACxB,OAAO,IAAI,CAAC,wBAAwB,CAAwB,KAAK,CAAC,CAAC;IACrE,CAAC;IAEO,KAAK,CAAC,wBAAwB,CACpC,iBAA0B;QAE1B,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QAGD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE;YAC/C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,oBAAoB;gBAChC,SAAS,EAAE,IAAI,CAAC,QAAQ;gBACxB,aAAa,EAAE,IAAI,CAAC,YAAY;aACjC,CAAC,CAAC,QAAQ,EAAE;SACd,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,6BAA6B,EAAE,CAAC;YAmBxF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAGnD,MAAM,mBAAmB,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,qBAAqB,CAAC;YACpE,IAAI,mBAAmB,GAAG,0BAAwB,CAAC,oBAAoB,EAAE,CAAC;gBACxE,MAAM,IAAI,KAAK,CACb,6BAA6B,QAAQ,CAAC,UAAU,iBAAiB;oBACjE,uBAAuB,mBAAmB,4BAA4B;oBACtE,iCAAiC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CACtD,CAAC;YACJ,CAAC;YAGD,IAAI,CAAC;gBACH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,4BAA4B,EAAE,CAAC;gBAC9D,IAAI,WAAW,IAAI,WAAW,CAAC,kBAAkB,EAAE,CAAC;oBAClD,MAAM,IAAI,KAAK,CACb,6BAA6B,QAAQ,CAAC,UAAU,qBAAqB;wBACrE,uBAAuB,WAAW,CAAC,qBAAqB,UAAU;wBAClE,eAAe,WAAW,CAAC,UAAU,sBAAsB;wBAC3D,oBAAoB,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CACzC,CAAC;gBACJ,CAAC;YACH,CAAC;YAAC,OAAO,eAAe,EAAE,CAAC;gBAEzB,IAAI,eAAe,YAAY,KAAK,IAAI,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;oBACxF,MAAM,eAAe,CAAC;gBACxB,CAAC;gBAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,OAAO,EAAE,gFAAgF;oBACzF,KAAK,EAAE,eAAe,YAAY,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC;iBAC5F,CAAC,CAAC;YACL,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACf,OAAO,EACL,kEAAkE;oBAClE,wDAAwD;gBAC1D,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;aACjC,CAAC,CAAC;YACH,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YACxB,IAAI,CAAC,cAAc,GAAG,CAAC,CAAC;YACxB,MAAM,IAAI,CAAC,uBAAuB,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC,wBAAwB,CAAwB,IAAI,CAAC,CAAC;QACpE,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACnD,MAAM,IAAI,KAAK,CACb,yBAAyB,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,MAAM,IAAI,EAAE,CAC5E,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAkB,CAAC;QACtD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC;QAMrC,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC;QACxC,MAAM,cAAc,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC;QAClD,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,GAAG,cAAc,CAAC;QAErE,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAWO,KAAK,CAAC,uBAAuB;QACnC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC;YACrD,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;YAC7B,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB;YAC3C,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB;YAC3C,WAAW,EAAE,SAAS;YACtB,gBAAgB,EAAE,KAAK;YACvB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3E,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,qEAAqE;gBACrE,qEAAqE,CACtE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC,YAAY,GAAG,QAAQ,CAAC,YAAY,CAAC;QAC1C,IAAI,CAAC,aAAa,GAAG,QAAQ,CAAC,aAAa,CAAC;QAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,2BAA2B,CAC/C,QAAQ,CAAC,eAAe,EACxB,QAAQ,CAAC,aAAa,EACtB,QAAQ,CAAC,YAAY,EACrB,QAAQ,CAAC,kBAAkB,CAC5B,CAAC;QACF,IAAI,CAAC,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;QAChD,IAAI,CAAC,aAAa,GAAG,QAAQ,CAAC,aAAa,CAAC;QAC5C,IAAI,CAAC,YAAY,GAAG,QAAQ,CAAC,YAAY,CAAC;QAC1C,IAAI,CAAC,sBAAsB,GAAG,QAAQ,CAAC,kBAAkB,CAAC;QAC1D,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAGxC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAC;QACxC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACf,OAAO,EAAE,2DAA2D;gBACpE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;QAEL,CAAC;IACH,CAAC;IAQO,KAAK,CAAC,4BAA4B;QAKxC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,qCAAqC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,EAC/G;gBACE,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE;oBACP,eAAe,EAAE,UAAU,IAAI,CAAC,MAAM,CAAC,wBAAwB,EAAE;iBAClE;aACF,CACF,CAAC;YAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAE5B,OAAO,IAAI,CAAC;gBACd,CAAC;gBAED,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAIlC,CAAC;YAEF,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;gBAChB,OAAO,EAAE,4DAA4D;gBACrE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAMO,KAAK,CAAC,wBAAwB;QACpC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,sCAAsC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,EAChH;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,eAAe,EAAE,UAAU,IAAI,CAAC,MAAM,CAAC,wBAAwB,EAAE;oBACjE,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;aACzB,CACF,CAAC;YAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,OAAO,EAAE,gDAAgD;oBACzD,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;iBAChC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;gBAChB,OAAO,EAAE,sDAAsD;gBAC/D,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAIO,YAAY,CAAC,OAAgB;QACnC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YAC3B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QAC3B,CAAC;IACH,CAAC;;AAzxBU,4DAAwB;mCAAxB,wBAAwB;IADpC,IAAA,mBAAU,GAAE;IAuDR,WAAA,IAAA,eAAM,EAAC,iCAAyB,CAAC,CAAA;;GAtDzB,wBAAwB,CA0xBpC"}

package/dist/nestjs/index.d.ts

@@ -0,0 +1,3 @@
+export { IdentityBootstrapModule, IdentityBootstrapModuleAsyncOptions, } from './identity-bootstrap.module';
+export { IdentityBootstrapService, IdentityBootstrapConfig, IDENTITY_BOOTSTRAP_CONFIG, } from './identity-bootstrap.service';
+export { OrgAuthModule, OrgAdminGuard, ORG_AUTH_CONFIG, type OrgAuthConfig, type OrgAuthModuleAsyncOptions, } from './org-auth';

package/dist/nestjs/index.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ORG_AUTH_CONFIG = exports.OrgAdminGuard = exports.OrgAuthModule = exports.IDENTITY_BOOTSTRAP_CONFIG = exports.IdentityBootstrapService = exports.IdentityBootstrapModule = void 0;
+var identity_bootstrap_module_1 = require("./identity-bootstrap.module");
+Object.defineProperty(exports, "IdentityBootstrapModule", { enumerable: true, get: function () { return identity_bootstrap_module_1.IdentityBootstrapModule; } });
+var identity_bootstrap_service_1 = require("./identity-bootstrap.service");
+Object.defineProperty(exports, "IdentityBootstrapService", { enumerable: true, get: function () { return identity_bootstrap_service_1.IdentityBootstrapService; } });
+Object.defineProperty(exports, "IDENTITY_BOOTSTRAP_CONFIG", { enumerable: true, get: function () { return identity_bootstrap_service_1.IDENTITY_BOOTSTRAP_CONFIG; } });
+var org_auth_1 = require("./org-auth");
+Object.defineProperty(exports, "OrgAuthModule", { enumerable: true, get: function () { return org_auth_1.OrgAuthModule; } });
+Object.defineProperty(exports, "OrgAdminGuard", { enumerable: true, get: function () { return org_auth_1.OrgAdminGuard; } });
+Object.defineProperty(exports, "ORG_AUTH_CONFIG", { enumerable: true, get: function () { return org_auth_1.ORG_AUTH_CONFIG; } });
+//# sourceMappingURL=index.js.map

package/dist/nestjs/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/nestjs/index.ts"],"names":[],"mappings":";;;AAAA,yEAGqC;AAFnC,oIAAA,uBAAuB,OAAA;AAGzB,2EAIsC;AAHpC,sIAAA,wBAAwB,OAAA;AAExB,uIAAA,yBAAyB,OAAA;AAE3B,uCAMoB;AALlB,yGAAA,aAAa,OAAA;AACb,yGAAA,aAAa,OAAA;AACb,2GAAA,eAAe,OAAA"}

package/dist/nestjs/org-auth/index.d.ts

@@ -0,0 +1,3 @@
+export { OrgAuthModule } from './org-auth.module';
+export { OrgAdminGuard } from './org-admin.guard';
+export { ORG_AUTH_CONFIG, type OrgAuthConfig, type OrgAuthModuleAsyncOptions, } from './org-auth.types';

package/dist/nestjs/org-auth/index.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ORG_AUTH_CONFIG = exports.OrgAdminGuard = exports.OrgAuthModule = void 0;
+var org_auth_module_1 = require("./org-auth.module");
+Object.defineProperty(exports, "OrgAuthModule", { enumerable: true, get: function () { return org_auth_module_1.OrgAuthModule; } });
+var org_admin_guard_1 = require("./org-admin.guard");
+Object.defineProperty(exports, "OrgAdminGuard", { enumerable: true, get: function () { return org_admin_guard_1.OrgAdminGuard; } });
+var org_auth_types_1 = require("./org-auth.types");
+Object.defineProperty(exports, "ORG_AUTH_CONFIG", { enumerable: true, get: function () { return org_auth_types_1.ORG_AUTH_CONFIG; } });
+//# sourceMappingURL=index.js.map

package/dist/nestjs/org-auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/nestjs/org-auth/index.ts"],"names":[],"mappings":";;;AAAA,qDAAkD;AAAzC,gHAAA,aAAa,OAAA;AACtB,qDAAkD;AAAzC,gHAAA,aAAa,OAAA;AACtB,mDAI0B;AAHxB,iHAAA,eAAe,OAAA"}

package/dist/nestjs/org-auth/org-admin.guard.d.ts

@@ -0,0 +1,13 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import type { OrgAuthConfig } from './org-auth.types';
+export declare class OrgAdminGuard implements CanActivate {
+    private readonly logger;
+    private readonly identityClient;
+    private readonly cacheTtlMs;
+    private readonly cache;
+    constructor(config: OrgAuthConfig);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+    private resolveOrgRole;
+    private extractContext;
+    private evictExpiredEntries;
+}

package/dist/nestjs/org-auth/org-admin.guard.js

@@ -0,0 +1,103 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var OrgAdminGuard_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OrgAdminGuard = void 0;
+const common_1 = require("@nestjs/common");
+const client_1 = require("../../client");
+const types_1 = require("../../types");
+const org_auth_types_1 = require("./org-auth.types");
+const DEFAULT_CACHE_TTL_MS = 5 * 60 * 1000;
+const MAX_CACHE_SIZE = 10_000;
+let OrgAdminGuard = OrgAdminGuard_1 = class OrgAdminGuard {
+    logger = new common_1.Logger(OrgAdminGuard_1.name);
+    identityClient;
+    cacheTtlMs;
+    cache = new Map();
+    constructor(config) {
+        this.identityClient = new client_1.IdentityApiClient({
+            baseUrl: config.identityApiUrl,
+            internalToken: config.identityApiInternalToken,
+        });
+        this.cacheTtlMs = config.cacheTtlMs ?? DEFAULT_CACHE_TTL_MS;
+    }
+    async canActivate(context) {
+        const request = context.switchToHttp().getRequest();
+        const ctx = this.extractContext(request);
+        if (!ctx) {
+            throw new common_1.ForbiddenException('Request context not available');
+        }
+        if (ctx.roles.includes('platform_admin')) {
+            return true;
+        }
+        const { orgId, actorId } = ctx;
+        if (!orgId || !actorId) {
+            throw new common_1.ForbiddenException('Organization context required');
+        }
+        const role = await this.resolveOrgRole(orgId, actorId, ctx.realmId);
+        if (!role || !types_1.ORG_ADMIN_ROLES.has(role)) {
+            this.logger.warn(`Org admin access denied for actor ${actorId} in org ${orgId} (role: ${role ?? 'none'})`);
+            throw new common_1.ForbiddenException('Organization administrator privileges required');
+        }
+        return true;
+    }
+    async resolveOrgRole(orgId, actorId, realm) {
+        const cacheKey = `${orgId}:${actorId}`;
+        const cached = this.cache.get(cacheKey);
+        if (cached && cached.expiresAt > Date.now()) {
+            return cached.response.role;
+        }
+        try {
+            const response = await this.identityClient.verifyMembership(actorId, orgId, realm);
+            this.cache.set(cacheKey, {
+                response,
+                expiresAt: Date.now() + this.cacheTtlMs,
+            });
+            if (this.cache.size > MAX_CACHE_SIZE) {
+                this.evictExpiredEntries();
+            }
+            return response.role;
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : 'Unknown error';
+            this.logger.error(`Failed to verify org membership for actor ${actorId} in org ${orgId}: ${message}`);
+            throw new common_1.ServiceUnavailableException('Unable to verify organization membership. Please try again.');
+        }
+    }
+    extractContext(request) {
+        const symbols = Object.getOwnPropertySymbols(request);
+        for (const sym of symbols) {
+            if (sym.description === 'REQUEST_CONTEXT') {
+                const ctx = request[sym];
+                return ctx;
+            }
+        }
+        return undefined;
+    }
+    evictExpiredEntries() {
+        const now = Date.now();
+        for (const [key, entry] of this.cache) {
+            if (entry.expiresAt <= now) {
+                this.cache.delete(key);
+            }
+        }
+    }
+};
+exports.OrgAdminGuard = OrgAdminGuard;
+exports.OrgAdminGuard = OrgAdminGuard = OrgAdminGuard_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(org_auth_types_1.ORG_AUTH_CONFIG)),
+    __metadata("design:paramtypes", [Object])
+], OrgAdminGuard);
+//# sourceMappingURL=org-admin.guard.js.map