arkos 1.6.3-canary.2 → 1.6.4-beta

package/dist/cjs/components/arkos-policy/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/components/arkos-policy/index.ts"],"names":[],"mappings":";;;;;AAuCA,kCAIC;AAnCD,mFAA0D;AA+B1D,SAAgB,WAAW,CACzB,QAAmB;IAEnB,OAAO,WAAW,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,WAAW,CAClB,QAAmB,EACnB,KAAsC;IAEtC,MAAM,IAAI,GAAG,CACX,MAAe,EACf,MAAuB,EAC2B,EAAE;QACpD,MAAM,QAAQ,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAChD,OAAO,WAAW,CAAgC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACxE,CAAC,CAAC;IAEF,MAAM,aAAa,GAAG,MAAM,CAAC,WAAW,CACtC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE;QACjD,MAAM,SAAS,GAA8C;YAC3D,QAAQ;YACR,MAAM;YACN,IAAI,EAAE,MAAM;SACb,CAAC;QAEF,MAAM,OAAO,GAAkB,sBAAW,CAAC,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE;YACtE,CAAC,MAAM,CAAC,EAAE,MAAM,IAAI,EAAE;SACvB,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAExE,OAAO;YACL,CAAC,MAAM,EAAE,SAAS,CAAC;YACnB,CAAC,MAAM,EAAE,OAAO,CAAC;SAClB,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;IAEF,OAAO;QACL,MAAM,EAAE,aAAsB;QAC9B,QAAQ;QACR,IAAI;QACJ,GAAG,aAAa;KACoC,CAAC;AACzD,CAAC","sourcesContent":["import { User } from \"../../types\";\nimport {\n  ArkosPolicyRule,\n  IArkosPolicy,\n  PolicyAuthEntry,\n  PolicyChecker,\n  PolicyWithActions,\n} from \"./types\";\nimport authService from \"../../modules/auth/auth.service\";\n\n/**\n * Creates a typed policy for a Prisma model resource.\n *\n * Each `.rule()` call registers an action and returns the policy\n * with a typed `can{Action}` permission checker and a typed `{Action}`\n * entry — both passable to the `authentication` field on `ArkosRouteHook`\n * and `ArkosRouter`, and callable for fine-grained permission checks.\n *\n * @param resource - The resource name in kebab-case (e.g. `\"user\"`, `\"blog-post\"`)\n *\n * @example\n * ```ts\n * const userPolicy = ArkosPolicy(\"user\")\n *   .rule(\"Create\", [\"Admin\", \"Editor\"])\n *   .rule(\"View\", \"*\")\n *   .rule(\"Delete\", [\"Admin\"]);\n *\n * // Pass to authentication field\n * userRouter.post({ path: \"/users\", authentication: userPolicy.Create });\n * userRouteHook.deleteOne({ authentication: userPolicy.Delete });\n *\n * // Fine-grained check\n * if (userPolicy.canCreate(req.user)) { ... }\n *\n * export default userPolicy;\n * ```\n *\n * @see {@link https://www.arkosjs.com/docs/api-referency/arkos-policy}\n */\nexport function ArkosPolicy<TResource extends string>(\n  resource: TResource\n): IArkosPolicy<TResource, never> {\n  return buildPolicy(resource, {});\n}\n\nfunction buildPolicy<TResource extends string, TActions extends string>(\n  resource: TResource,\n  store: Record<string, ArkosPolicyRule>\n): PolicyWithActions<TResource, TActions> {\n  const rule = <TAction extends string>(\n    action: TAction,\n    config: ArkosPolicyRule\n  ): PolicyWithActions<TResource, TActions | TAction> => {\n    const newStore = { ...store, [action]: config };\n    return buildPolicy<TResource, TActions | TAction>(resource, newStore);\n  };\n\n  const actionEntries = Object.fromEntries(\n    Object.entries(store).flatMap(([action, config]) => {\n      const authEntry: PolicyAuthEntry<TResource, typeof action> = {\n        resource,\n        action,\n        rule: config,\n      };\n\n      const checker: PolicyChecker = authService.permission(action, resource, {\n        [action]: config || {},\n      });\n\n      const canKey = `can${action.charAt(0).toUpperCase()}${action.slice(1)}`;\n\n      return [\n        [action, authEntry],\n        [canKey, checker],\n      ];\n    })\n  );\n\n  return {\n    __type: \"ArkosPolicy\" as const,\n    resource,\n    rule,\n    ...actionEntries,\n  } as unknown as PolicyWithActions<TResource, TActions>;\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/components/arkos-policy/index.ts"],"names":[],"mappings":";;;;;AAsCA,kCAIC;AAnCD,mFAA0D;AA+B1D,SAAgB,WAAW,CACzB,QAAmB;IAEnB,OAAO,WAAW,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,WAAW,CAClB,QAAmB,EACnB,KAAsC;IAEtC,MAAM,IAAI,GAAG,CACX,MAAe,EACf,MAAuB,EAC2B,EAAE;QACpD,MAAM,QAAQ,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAChD,OAAO,WAAW,CAAgC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACxE,CAAC,CAAC;IAEF,MAAM,aAAa,GAAG,MAAM,CAAC,WAAW,CACtC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE;QACjD,MAAM,SAAS,GAA8C;YAC3D,QAAQ;YACR,MAAM;YACN,IAAI,EAAE,MAAM;SACb,CAAC;QAEF,MAAM,OAAO,GAAkB,sBAAW,CAAC,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE;YACtE,CAAC,MAAM,CAAC,EAAE,MAAM,IAAI,EAAE;SACvB,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAExE,OAAO;YACL,CAAC,MAAM,EAAE,SAAS,CAAC;YACnB,CAAC,MAAM,EAAE,OAAO,CAAC;SAClB,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;IAEF,OAAO;QACL,MAAM,EAAE,aAAsB;QAC9B,QAAQ;QACR,IAAI;QACJ,GAAG,aAAa;KACoC,CAAC;AACzD,CAAC","sourcesContent":["import {\n  ArkosPolicyRule,\n  IArkosPolicy,\n  PolicyAuthEntry,\n  PolicyChecker,\n  PolicyWithActions,\n} from \"./types\";\nimport authService from \"../../modules/auth/auth.service\";\n\n/**\n * Creates a typed policy for a Prisma model resource.\n *\n * Each `.rule()` call registers an action and returns the policy\n * with a typed `can{Action}` permission checker and a typed `{Action}`\n * entry — both passable to the `authentication` field on `ArkosRouteHook`\n * and `ArkosRouter`, and callable for fine-grained permission checks.\n *\n * @param resource - The resource name in kebab-case (e.g. `\"user\"`, `\"blog-post\"`)\n *\n * @example\n * ```ts\n * const userPolicy = ArkosPolicy(\"user\")\n *   .rule(\"Create\", [\"Admin\", \"Editor\"])\n *   .rule(\"View\", \"*\")\n *   .rule(\"Delete\", [\"Admin\"]);\n *\n * // Pass to authentication field\n * userRouter.post({ path: \"/users\", authentication: userPolicy.Create });\n * userRouteHook.deleteOne({ authentication: userPolicy.Delete });\n *\n * // Fine-grained check\n * if (userPolicy.canCreate(req.user)) { ... }\n *\n * export default userPolicy;\n * ```\n *\n * @see {@link https://www.arkosjs.com/docs/api-referency/arkos-policy}\n */\nexport function ArkosPolicy<TResource extends string>(\n  resource: TResource\n): IArkosPolicy<TResource, never> {\n  return buildPolicy(resource, {});\n}\n\nfunction buildPolicy<TResource extends string, TActions extends string>(\n  resource: TResource,\n  store: Record<string, ArkosPolicyRule>\n): PolicyWithActions<TResource, TActions> {\n  const rule = <TAction extends string>(\n    action: TAction,\n    config: ArkosPolicyRule\n  ): PolicyWithActions<TResource, TActions | TAction> => {\n    const newStore = { ...store, [action]: config };\n    return buildPolicy<TResource, TActions | TAction>(resource, newStore);\n  };\n\n  const actionEntries = Object.fromEntries(\n    Object.entries(store).flatMap(([action, config]) => {\n      const authEntry: PolicyAuthEntry<TResource, typeof action> = {\n        resource,\n        action,\n        rule: config,\n      };\n\n      const checker: PolicyChecker = authService.permission(action, resource, {\n        [action]: config || {},\n      });\n\n      const canKey = `can${action.charAt(0).toUpperCase()}${action.slice(1)}`;\n\n      return [\n        [action, authEntry],\n        [canKey, checker],\n      ];\n    })\n  );\n\n  return {\n    __type: \"ArkosPolicy\" as const,\n    resource,\n    rule,\n    ...actionEntries,\n  } as unknown as PolicyWithActions<TResource, TActions>;\n}\n"]}

package/dist/cjs/modules/auth/auth.service.js

@@ -265,7 +265,7 @@ class AuthService {
         if (!accessControl &&
             dynamic_loader_1.appModules.some((appModule) => (0, utils_1.kebabCase)(appModule) === (0, utils_1.kebabCase)(resource)))
             accessControl = (0, dynamic_loader_1.getModuleComponents)(resource)?.authConfigs?.accessControl;
-        auth_action_service_1.default.add(action, resource, accessControl);
+        const authAction = auth_action_service_1.default.add(action, resource, accessControl);
         return (0, catch_async_1.default)(async (req, _, next) => {
             if (req.user) {
                 const user = req.user;
@@ -274,7 +274,7 @@ class AuthService {
                     next();
                     return;
                 }
-                const notEnoughPermissionsError = new app_error_1.default("You do not have permission to perfom this action", 403, "NotEnoughPermissions");
+                const notEnoughPermissionsError = new app_error_1.default(authAction.errorMessage, 403, "NotEnoughPermissions");
                 if (configs?.authentication?.mode === "dynamic") {
                     const hasPermission = await this.checkDynamicAccessControl(user.id, action, resource);
                     if (!hasPermission)
@@ -328,7 +328,9 @@ class AuthService {
         return user;
     }
     authorize(action, resource, rule) {
-        auth_action_service_1.default.add(action, resource, { [action]: rule });
+        const authAction = auth_action_service_1.default.add(action, resource, {
+            [action]: rule,
+        });
         return (0, catch_async_1.default)(async (req, _, next) => {
             const hooks = (0, server_1.getArkosConfig)()?.authentication?.hooks?.authorize;
             const before = await this.runHooks(hooks?.before, req, {
@@ -354,7 +356,7 @@ class AuthService {
                         const user = req.user;
                         const configs = (0, server_1.getArkosConfig)();
                         if (!user.isSuperUser) {
-                            const notEnoughPermissionsError = new app_error_1.default("You do not have permission to perform this action", 403, "NotEnoughPermissions");
+                            const notEnoughPermissionsError = new app_error_1.default(authAction.errorMessage, 403, "NotEnoughPermissions");
                             if (configs?.authentication?.mode === "dynamic") {
                                 const hasPermission = await this.checkDynamicAccessControl(user.id, action, resource);
                                 if (!hasPermission)

package/dist/cjs/modules/auth/auth.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.service.js","sourceRoot":"","sources":["../../../../src/modules/auth/auth.service.ts"],"names":[],"mappings":";;;;;;AAAA,gEAAgD;AAChD,wDAA8B;AAE9B,qFAA4D;AAC5D,iFAAwD;AACxD,+DAAoD;AACpD,yCAA8C;AAC9C,sEAA6C;AAC7C,uEAAuE;AAevE,qFAA2E;AAC3E,+DAA6E;AAC7E,+CAAgD;AAChD,mEAGoC;AACpC,+FAAqE;AACrE,mFAGkD;AAclD,MAAa,WAAW;IAAxB;QAIE,uBAAkB,GAAgC,EAAE,CAAC;QAqnBrD,iBAAY,GAAG,IAAA,qBAAU,EACvB,KAAK,EAAE,GAAiB,EAAE,CAAgB,EAAE,IAAuB,EAAE,EAAE;YACrE,MAAM,KAAK,GAAG,IAAA,uBAAc,GAAE,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,CAAC;YAEpE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;YACvD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBACjB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CACtC,KAAK,EAAE,OAAO,EACd,MAAM,CAAC,KAAK,EACZ,GAAG,CACJ,CAAC;gBACF,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;oBACpB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;oBAC1D,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAClD,CAAC;gBACD,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC7B,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,IAAI,CAAC;oBACH,IAAI,IAAA,8CAAuB,GAAE,EAAE,CAAC;wBAC9B,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAS,CAAC;wBAC5D,IAAI,CAAC,IAAI;4BAAE,MAAM,uCAAkB,CAAC;wBACpC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;oBAClB,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;oBACnE,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;wBACpB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;wBAC1D,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;oBAClD,CAAC;oBACD,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBAC7B,CAAC;YACH,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;YAC1D,IAAI,KAAK,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAE1C,IAAI,EAAE,CAAC;QACT,CAAC,CACF,CAAC;IA6NJ,CAAC;IA/2BS,KAAK,CAAC,QAAQ,CACpB,KAKa,EACb,GAAiB,EACjB,GAIC;QAED,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAEtC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAEzD,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,IAAI,UAAU,GAAG,KAAK,CAAC;YAEvB,IAAI,CAAC;gBACH,MAAO,IAAY,CAAC;oBAClB,GAAG;oBACH,IAAI,EAAE,GAAG,EAAE;wBACT,UAAU,GAAG,IAAI,CAAC;oBACpB,CAAC;oBACD,GAAG,GAAG;iBACP,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;YACxC,CAAC;YAED,IAAI,UAAU;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3C,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAUO,KAAK,CAAC,aAAa,CACzB,KAKa,EACb,GAAiB,EACjB,GAIC;QAED,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,CAAC;QAEtB,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAEzD,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAO,IAAY,CAAC,EAAE,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;YACvC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;YACxB,CAAC;QACH,CAAC;QAED,OAAO,EAAE,CAAC;IACZ,CAAC;IAWO,KAAK,CAAC,aAAa,CACzB,KAKa,EACb,KAAc,EACd,GAAiB,EACjB,GAIC;QAED,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAE7C,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAEzD,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,IAAI,UAAU,GAAG,KAAK,CAAC;YAEvB,IAAI,CAAC;gBACH,MAAO,IAAY,CAAC;oBAClB,GAAG;oBACH,KAAK;oBACL,IAAI,EAAE,GAAG,EAAE;wBACT,UAAU,GAAG,IAAI,CAAC;oBACpB,CAAC;oBACD,GAAG,GAAG;iBACP,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;YACxC,CAAC;YAED,IAAI,UAAU;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3C,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACnC,CAAC;IASD,YAAY,CACV,EAAmB,EACnB,SAA+B,EAC/B,MAAe;QAEf,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,IAAA,uBAAc,GAAE,CAAC;QAErD,IACE,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,MAAM;YAClC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU;YACvB,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM;YAErB,MAAM,IAAI,mBAAQ,CAChB,mCAAmC,EACnC,GAAG,EACH,wBAAwB,CACzB,CAAC;QAEJ,MAAM;YACJ,MAAM;gBACN,OAAO,EAAE,GAAG,EAAE,MAAM;gBACpB,OAAO,CAAC,GAAG,CAAC,UAAU;gBACtB,mBAAQ,CAAC,UAAU,CAAC;QAEtB,SAAS,GAAG,CAAC,SAAS;YACpB,OAAO,EAAE,GAAG,EAAE,SAAS;YACvB,OAAO,CAAC,GAAG,CAAC,cAAc;YAC1B,mBAAQ,CAAC,cAAc,CAAmC,CAAC;QAE7D,OAAO,sBAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;YAC9B,SAAS,EAAE,SAAuB;SACnC,CAAC,CAAC;IACL,CAAC;IAoBD,mBAAmB,CAAC,GAAiB;QACnC,MAAM,WAAW,GAAG,IAAA,uBAAc,GAAE,CAAC;QACrC,MAAM,WAAW,GAAG,WAAW,EAAE,cAAc,CAAC;QAEhD,IAAI,CAAC,GAAG;YACN,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QAExE,MAAM,QAAQ,GACZ,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ;YACjC,OAAO,CAAC,GAAG,CAAC,oBAIC;YACd,KAAK,CAAC;QAER,OAAO;YACL,OAAO,EAAE,IAAI,IAAI,CACf,IAAI,CAAC,GAAG,EAAE;gBACR,MAAM,CACJ,IAAA,8BAAI,EACF,WAAW,EAAE,GAAG,EAAE,SAAS;oBACxB,OAAO,CAAC,GAAG,CAAC,cAA6B;oBACzC,mBAAQ,CAAC,cAA6B,CAC1C,CACF,CACJ;YACD,QAAQ,EACN,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ;gBAClC,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,SAAS;oBAC7C,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,MAAM;oBAC7C,CAAC,CAAC,SAAS,CAAC;gBACd,IAAI;YACN,MAAM,EAAE,CAAC,GAAG,EAAE;gBACZ,IAAI,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,KAAK,SAAS;oBAChD,OAAO,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC;qBACrC,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,SAAS;oBAClD,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,MAAM,CAAC;;oBAC7C,OAAO,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,OAAO,CAAC;YACzE,CAAC,CAAC,EAAE;YACJ,QAAQ;YACR,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB;YACzE,GAAG,WAAW,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM;SAC3B,CAAC;IACrB,CAAC;IAaD,gBAAgB,CAAC,QAAgB;QAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,CAAC;IASD,KAAK,CAAC,iBAAiB,CACrB,iBAAyB,EACzB,YAAoB;QAEpB,OAAO,MAAM,kBAAM,CAAC,OAAO,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;IAC/D,CAAC;IAQD,KAAK,CAAC,YAAY,CAAC,QAAgB;QACjC,OAAO,MAAM,kBAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACzC,CAAC;IAmBM,gBAAgB,CAAC,QAAgB;QACtC,MAAM,eAAe,GAAG,IAAA,uBAAc,GAAE,EAAE,cAAc,CAAC;QAEzD,MAAM,mBAAmB,GACvB,eAAe,EAAE,kBAAkB,EAAE,KAAK;YAC1C,oCAAoC,CAAC;QACvC,OAAO,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IASD,wBAAwB,CAAC,IAAU,EAAE,YAAoB;QACvD,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3B,MAAM,kBAAkB,GAAG,QAAQ,CACjC,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,EACzD,EAAE,CACH,CAAC;YAEF,OAAO,YAAY,GAAG,kBAAkB,CAAC;QAC3C,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAUD,KAAK,CAAC,cAAc,CAClB,KAAa,EACb,MAAe;QAEf,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,IAAA,uBAAc,GAAE,CAAC;QAErD,IACE,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,MAAM;YAClC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU;YACvB,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM;YAErB,MAAM,IAAI,mBAAQ,CAChB,kCAAkC,EAClC,GAAG,EACH,8BAA8B,CAC/B,CAAC;QAEJ,MAAM;YACJ,MAAM;gBACN,OAAO,EAAE,GAAG,EAAE,MAAM;gBACpB,OAAO,CAAC,GAAG,CAAC,UAAU;gBACtB,mBAAQ,CAAC,UAAU,CAAC;QAEtB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE;gBACzC,IAAI,GAAG;oBAAE,MAAM,CAAC,GAAG,CAAC,CAAC;;oBAChB,OAAO,CAAC,OAAyB,CAAC,CAAC;YAC1C,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,gBAAgB,CAAC,MAA2B;QAClD,OAAO,MAAM,KAAK,GAAG,CAAC;IACxB,CAAC;IAEO,UAAU,CAAC,MAA2B;QAC5C,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAEO,aAAa,CACnB,MAA2B;QAE3B,OAAO,CACL,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CACxE,CAAC;IACJ,CAAC;IAEO,oBAAoB,CAC1B,IAA4D;QAE5D,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,CAAC;QACrB,IAAI,IAAI,KAAK,GAAG;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACrC,OAAO,IAAI,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IAEO,sBAAsB,CAC5B,MAAoB,EACpB,aAAkC;QAElC,IAAI,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACvD,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC;YAAE,OAAO,aAAa,CAAC;QACzD,IAAI,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC;YACnC,OAAO,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1D,OAAO,EAAE,CAAC;IACZ,CAAC;IAYS,wBAAwB,CAChC,IAAU,EACV,MAAc,EACd,aAAkC;QAElC,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK;YAC5B,MAAM,KAAK,CACT,qHAAqH,CACtH,CAAC;QAEJ,IAAI,eAAe,GAAG,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QAEzE,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAExE,OAAO,CACL,eAAe,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG;YAC5B,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CACnE,CAAC;IACJ,CAAC;IAWS,KAAK,CAAC,yBAAyB,CACvC,MAAc,EACd,MAAc,EACd,QAAgB;QAEhB,MAAM,MAAM,GAAG,IAAA,kCAAiB,GAAE,CAAC;QACnC,OAAO,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;YACxC,KAAK,EAAE;gBACL,MAAM;gBACN,IAAI,EAAE;oBACJ,WAAW,EAAE;wBACX,IAAI,EAAE;4BACJ,QAAQ;4BACR,MAAM;yBACP;qBACF;iBACF;aACF;YACD,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;SACrB,CAAC,CAAC,CAAC;IACN,CAAC;IAYD,mBAAmB,CACjB,MAAoB,EACpB,QAAgB,EAChB,aAAmC;QAEnC,IACE,CAAC,aAAa;YACd,2BAAU,CAAC,IAAI,CACb,CAAC,SAAS,EAAE,EAAE,CAAC,IAAA,iBAAS,EAAC,SAAS,CAAC,KAAK,IAAA,iBAAS,EAAC,QAAQ,CAAC,CAC5D;YAED,aAAa,GAAG,IAAA,oCAAmB,EAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,aAAa,CAAC;QAE5E,6BAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;QAEvD,OAAO,IAAA,qBAAU,EACf,KAAK,EAAE,GAAiB,EAAE,CAAgB,EAAE,IAAuB,EAAE,EAAE;YACrE,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;gBACb,MAAM,IAAI,GAAG,GAAG,CAAC,IAAY,CAAC;gBAC9B,MAAM,OAAO,GAAG,IAAA,uBAAc,GAAE,CAAC;gBAEjC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;oBACrB,IAAI,EAAE,CAAC;oBACP,OAAO;gBACT,CAAC;gBAED,MAAM,yBAAyB,GAAG,IAAI,mBAAQ,CAC5C,kDAAkD,EAClD,GAAG,EACH,sBAAsB,CACvB,CAAC;gBAEF,IAAI,OAAO,EAAE,cAAc,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;oBAChD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,yBAAyB,CACxD,IAAI,CAAC,EAAE,EACP,MAAM,EACN,QAAQ,CACT,CAAC;oBAEF,IAAI,CAAC,aAAa;wBAAE,OAAO,IAAI,CAAC,yBAAyB,CAAC,CAAC;gBAC7D,CAAC;qBAAM,IAAI,OAAO,EAAE,cAAc,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACtD,IAAI,CAAC,aAAa;wBAAE,OAAO,IAAI,CAAC,yBAAyB,CAAC,CAAC;oBAE3D,MAAM,aAAa,GAAG,IAAI,CAAC,wBAAwB,CACjD,IAAI,EACJ,MAAM,EACN,aAAa,CACd,CAAC;oBAEF,IAAI,CAAC,aAAa;wBAAE,OAAO,IAAI,CAAC,yBAAyB,CAAC,CAAC;gBAC7D,CAAC;YACH,CAAC;YAED,IAAI,EAAE,CAAC;QACT,CAAC,CACF,CAAC;IACJ,CAAC;IAQD,KAAK,CAAC,oBAAoB,CAAC,GAAiB;QAC1C,IAAI,CAAC,IAAA,8CAAuB,GAAE;YAC5B,MAAM,KAAK,CACT,oGAAoG,CACrG,CAAC;QAEJ,MAAM,MAAM,GAAG,IAAA,kCAAiB,GAAE,CAAC;QAEnC,IAAI,KAAyB,CAAC;QAE9B,IACE,GAAG,EAAE,OAAO,EAAE,aAAa;YAC3B,GAAG,EAAE,OAAO,EAAE,aAAa,CAAC,UAAU,CAAC,QAAQ,CAAC;YAChD,GAAG,EAAE,OAAO,EAAE,aAAa,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YAE7C,KAAK,GAAG,GAAG,EAAE,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAEpD,IACE,CAAC,KAAK;YACN,GAAG,EAAE,OAAO,EAAE,kBAAkB,KAAK,UAAU;YAC/C,GAAG,CAAC,OAAO,EACX,CAAC;YACD,KAAK,GAAG,GAAG,EAAE,OAAO,EAAE,kBAAkB,CAAC;QAC3C,CAAC;QAED,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,IAAI,OAAmC,CAAC;QAExC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,yCAAoB,CAAC;QAC7B,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,EAAE;YAAE,MAAM,yCAAoB,CAAC;QAC7C,MAAM,IAAI,GAAe,MAAO,MAAc,CAAC,IAAI,CAAC,UAAU,CAAC;YAC7D,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE;SAClC,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI;YACP,MAAM,IAAI,mBAAQ,CAChB,wDAAwD,EACxD,GAAG,EACH,oBAAoB,CACrB,CAAC;QAEJ,IACE,IAAI,CAAC,wBAAwB,CAAC,IAAI,EAAE,OAAO,CAAC,GAAI,CAAC;YACjD,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC;YAE/B,MAAM,IAAI,mBAAQ,CAChB,sDAAsD,EACtD,GAAG,EACH,iBAAiB,CAClB,CAAC;QAEJ,GAAG,CAAC,WAAW,GAAG,KAAK,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAkHD,SAAS,CACP,MAAoB,EACpB,QAAgB,EAChB,IAAiD;QAEjD,6BAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAE5D,OAAO,IAAA,qBAAU,EACf,KAAK,EAAE,GAAiB,EAAE,CAAgB,EAAE,IAAuB,EAAE,EAAE;YACrE,MAAM,KAAK,GAAG,IAAA,uBAAc,GAAE,EAAE,cAAc,EAAE,KAAK,EAAE,SAAS,CAAC;YAEjE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE;gBACrD,MAAM;gBACN,QAAQ;gBACR,IAAI;aACL,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBACjB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CACtC,KAAK,EAAE,OAAO,EACd,MAAM,CAAC,KAAK,EACZ,GAAG,EACH,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAC3B,CAAC;gBACF,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;oBACpB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE;wBACxD,MAAM;wBACN,QAAQ;wBACR,IAAI;qBACL,CAAC,CAAC;oBACH,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAClD,CAAC;gBACD,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC7B,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,IAAI,CAAC;oBACH,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;wBACb,MAAM,IAAI,GAAG,GAAG,CAAC,IAAY,CAAC;wBAC9B,MAAM,OAAO,GAAG,IAAA,uBAAc,GAAE,CAAC;wBAEjC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;4BACtB,MAAM,yBAAyB,GAAG,IAAI,mBAAQ,CAC5C,mDAAmD,EACnD,GAAG,EACH,sBAAsB,CACvB,CAAC;4BAEF,IAAI,OAAO,EAAE,cAAc,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;gCAChD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,yBAAyB,CACxD,IAAI,CAAC,EAAE,EACP,MAAM,EACN,QAAQ,CACT,CAAC;gCACF,IAAI,CAAC,aAAa;oCAAE,MAAM,yBAAyB,CAAC;4BACtD,CAAC;iCAAM,IAAI,OAAO,EAAE,cAAc,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;gCACtD,MAAM,aAAa,GAAG,IAAI,CAAC,wBAAwB,CACjD,IAAI,EACJ,MAAM,EACN,EAAE,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CACnB,CAAC;gCACF,IAAI,CAAC,aAAa;oCAAE,MAAM,yBAAyB,CAAC;4BACtD,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE;wBACjE,MAAM;wBACN,QAAQ;wBACR,IAAI;qBACL,CAAC,CAAC;oBACH,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;wBACpB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE;4BACxD,MAAM;4BACN,QAAQ;4BACR,IAAI;yBACL,CAAC,CAAC;wBACH,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;oBAClD,CAAC;oBACD,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBAC7B,CAAC;YACH,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE;gBACxD,MAAM;gBACN,QAAQ;gBACR,IAAI;aACL,CAAC,CAAC;YACH,IAAI,KAAK,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAE1C,IAAI,EAAE,CAAC;QACT,CAAC,CACF,CAAC;IACJ,CAAC;IAWD,2BAA2B,CACzB,MAAoB,EACpB,qBAA+D;QAE/D,IAAI,qBAAqB,IAAI,OAAO,qBAAqB,KAAK,QAAQ,EAAE,CAAC;YACvE,IAAI,qBAAqB,CAAC,MAAM,CAAC,KAAK,KAAK;gBAAE,OAAO,2BAAQ,CAAC;iBACxD,IAAI,qBAAqB,CAAC,MAAM,CAAC,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC,YAAY,CAAC;QAC5E,CAAC;;YAAM,OAAO,IAAI,CAAC,YAAY,CAAC;QAEhC,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAyBD,UAAU,CACR,MAAc,EACd,QAAgB,EAChB,aAAmC;QAGnC,MAAM,KAAK,GAAG,IAAI,KAAK,EAAE,CAAC,KAAK,CAAC;QAEhC,IAAI,KAAK,EAAE,QAAQ,CAAC,0CAA0C,CAAC;YAC7D,MAAM,IAAI,KAAK,CACb,oFAAoF,CACrF,CAAC;QAEJ,6BAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;QAEvD,OAAO,KAAK,EAAE,IAAsB,EAAoB,EAAE;YAExD,MAAM,OAAO,GAAG,IAAA,uBAAc,GAAE,CAAC;YAEjC,IAAI,CAAC,IAAA,4CAAqB,GAAE;gBAC1B,MAAM,KAAK,CACT,2FAA2F,CAC5F,CAAC;YAEJ,IAAI,CAAC,IAAA,8CAAuB,GAAE;gBAAE,OAAO,KAAK,CAAC;YAC7C,IAAI,CAAC,IAAI;gBAAE,MAAM,uCAAkB,CAAC;YACpC,IAAI,IAAI,EAAE,WAAW;gBAAE,OAAO,IAAI,CAAC;YAEnC,IAAI,OAAO,EAAE,cAAc,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;gBAChD,OAAO,MAAM,IAAI,CAAC,yBAAyB,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC1E,CAAC;iBAAM,IAAI,OAAO,EAAE,cAAc,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtD,IAAI,CAAC,aAAa,IAAI,2BAAU,CAAC,QAAQ,CAAC,IAAA,iBAAS,EAAC,QAAQ,CAAC,CAAC;oBAC5D,aAAa,GAAG,IAAA,oCAAmB,EAAC,IAAA,iBAAS,EAAC,QAAQ,CAAC,CAAC,EAAE,WAAW;wBACnE,EAAE,aAAa,CAAC;gBAEpB,OAAO,CACL,CAAC,CAAC,aAAa;oBACf,IAAI,CAAC,wBAAwB,CAAC,IAAW,EAAE,MAAM,EAAE,aAAa,CAAC,CAClE,CAAC;YACJ,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;IACJ,CAAC;CACF;AA93BD,kCA83BC;AAKD,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;AAEtC,kBAAe,WAAW,CAAC","sourcesContent":["import jwt, { SignOptions } from \"jsonwebtoken\";\nimport bcrypt from \"bcryptjs\";\nimport { User } from \"../../types\";\nimport catchAsync from \"../error-handler/utils/catch-async\";\nimport AppError from \"../error-handler/utils/app-error\";\nimport { callNext } from \"../base/base.middlewares\";\nimport { getArkosConfig } from \"../../server\";\nimport arkosEnv from \"../../utils/arkos-env\";\nimport { getPrismaInstance } from \"../../utils/helpers/prisma.helpers\";\nimport {\n  ArkosRequest,\n  ArkosResponse,\n  ArkosNextFunction,\n  ArkosRequestHandler,\n} from \"../../types\";\nimport {\n  AuthJwtPayload,\n  AccessAction,\n  AccessControlConfig,\n  AuthenticationControlConfig,\n  AccessControlRules,\n  DetailedAccessControlRule,\n} from \"../../types/auth\";\nimport { MsDuration, toMs } from \"./utils/helpers/auth.controller.helpers\";\nimport { appModules, getModuleComponents } from \"../../utils/dynamic-loader\";\nimport { kebabCase } from \"../../exports/utils\";\nimport {\n  invaliAuthTokenError,\n  loginRequiredError,\n} from \"./utils/auth-error-objects\";\nimport authActionService from \"./utils/services/auth-action.service\";\nimport {\n  isAuthenticationEnabled,\n  isUsingAuthentication,\n} from \"../../utils/helpers/arkos-config.helpers\";\nimport {\n  AuthenticateHookHandler,\n  AuthenticateAfterHookHandler,\n  AuthenticateErrorHookHandler,\n  AuthorizeHookHandler,\n  AuthorizeAfterHookHandler,\n  AuthorizeErrorHookHandler,\n} from \"../../types/arkos-config/utils\";\nimport { CookieOptions } from \"express\";\n\n/**\n * Handles various authentication-related tasks such as JWT signing, password hashing, and verifying user credentials.\n */\nexport class AuthService {\n  /**\n   * Object containing a combination of actions per resource, tracked by each set of calls of `authService.handleAccessControl`, this can be accessed through the `authService` object or through the endpoint\n   */\n  actionsPerResource: Record<string, Set<string>> = {};\n\n  /**\n   * Runs a chain of `before` hooks in sequence.\n   *\n   * - If a hook throws — chain aborts, error is forwarded to `onError` hooks.\n   * - If a hook calls `skip()` — chain stops, core logic is bypassed, jumps to `after` hooks.\n   * - If a hook returns — next hook in chain runs.\n   *\n   * @returns Promise resolving to `{ skipped, error? }`\n   */\n  private async runHooks(\n    hooks:\n      | AuthenticateHookHandler\n      | AuthenticateHookHandler[]\n      | AuthorizeHookHandler\n      | AuthorizeHookHandler[]\n      | undefined,\n    req: ArkosRequest,\n    ctx?: {\n      action?: AccessAction;\n      resource?: string;\n      rule?: string[] | DetailedAccessControlRule | \"*\";\n    }\n  ): Promise<{ skipped: boolean; error?: unknown }> {\n    if (!hooks) return { skipped: false };\n\n    const hookArray = Array.isArray(hooks) ? hooks : [hooks];\n\n    for (const hook of hookArray) {\n      let skipCalled = false;\n\n      try {\n        await (hook as any)({\n          req,\n          skip: () => {\n            skipCalled = true;\n          },\n          ...ctx,\n        });\n      } catch (err) {\n        return { skipped: false, error: err };\n      }\n\n      if (skipCalled) return { skipped: true };\n    }\n\n    return { skipped: false };\n  }\n\n  /**\n   * Runs a chain of `after` hooks in sequence.\n   *\n   * - If a hook throws — chain aborts, error is forwarded to the global error handler.\n   * - If a hook returns — next hook in chain runs.\n   *\n   * @returns Promise resolving to `{ error? }`\n   */\n  private async runAfterHooks(\n    hooks:\n      | AuthenticateAfterHookHandler\n      | AuthenticateAfterHookHandler[]\n      | AuthorizeAfterHookHandler\n      | AuthorizeAfterHookHandler[]\n      | undefined,\n    req: ArkosRequest,\n    ctx?: {\n      action?: AccessAction;\n      resource?: string;\n      rule?: string[] | DetailedAccessControlRule | \"*\";\n    }\n  ): Promise<{ error?: unknown }> {\n    if (!hooks) return {};\n\n    const hookArray = Array.isArray(hooks) ? hooks : [hooks];\n\n    for (const hook of hookArray) {\n      try {\n        await (hook as any)({ req, ...ctx });\n      } catch (err) {\n        return { error: err };\n      }\n    }\n\n    return {};\n  }\n\n  /**\n   * Runs a chain of `onError` hooks in sequence.\n   *\n   * - If a hook throws — chain aborts, error is forwarded to the global error handler.\n   * - If a hook calls `skip()` — suppresses the error and jumps to `after` hooks.\n   * - If a hook returns — next hook in chain runs.\n   *\n   * @returns Promise resolving to `{ skipped, error? }`\n   */\n  private async runErrorHooks(\n    hooks:\n      | AuthenticateErrorHookHandler\n      | AuthenticateErrorHookHandler[]\n      | AuthorizeErrorHookHandler\n      | AuthorizeErrorHookHandler[]\n      | undefined,\n    error: unknown,\n    req: ArkosRequest,\n    ctx?: {\n      action?: AccessAction;\n      resource?: string;\n      rule?: string[] | DetailedAccessControlRule | \"*\";\n    }\n  ): Promise<{ skipped: boolean; error?: unknown }> {\n    if (!hooks) return { skipped: false, error };\n\n    const hookArray = Array.isArray(hooks) ? hooks : [hooks];\n\n    for (const hook of hookArray) {\n      let skipCalled = false;\n\n      try {\n        await (hook as any)({\n          req,\n          error,\n          skip: () => {\n            skipCalled = true;\n          },\n          ...ctx,\n        });\n      } catch (err) {\n        return { skipped: false, error: err };\n      }\n\n      if (skipCalled) return { skipped: true };\n    }\n\n    return { skipped: false, error };\n  }\n  /**\n   * Signs a JWT token for the user.\n   *\n   * @param {number | string} id - The unique identifier of the user to generate the token for.\n   * @param {string | number} [expiresIn] - The expiration time for the token. Defaults to environment variable `JWT_EXPIRES_IN`.\n   * @param {string} [secret] - The secret key used to sign the token. Defaults to environment variable `JWT_SECRET`.\n   * @returns {string} The signed JWT token.\n   */\n  signJwtToken(\n    id: number | string,\n    expiresIn?: MsDuration | number,\n    secret?: string\n  ): string {\n    const { authentication: configs } = getArkosConfig();\n\n    if (\n      process.env.ARKOS_BUILD === \"true\" &&\n      !process.env.JWT_SECRET &&\n      !configs?.jwt?.secret\n    )\n      throw new AppError(\n        \"Missing JWT secret on production!\",\n        500,\n        \"MissingJWTOnProduction\"\n      );\n\n    secret =\n      secret ||\n      configs?.jwt?.secret ||\n      process.env.JWT_SECRET ||\n      arkosEnv.JWT_SECRET;\n\n    expiresIn = (expiresIn ||\n      configs?.jwt?.expiresIn ||\n      process.env.JWT_EXPIRES_IN ||\n      arkosEnv.JWT_EXPIRES_IN) as keyof SignOptions[\"expiresIn\"];\n\n    return jwt.sign({ id }, secret, {\n      expiresIn: expiresIn as MsDuration,\n    });\n  }\n\n  /**\n   * Retrieves cookie configuration options for JWT authentication.\n   *\n   * Merges configuration from multiple sources in order of precedence:\n   * 1. Arkos configuration file\n   * 2. Environment variables\n   * 3. Request properties (for secure flag)\n   * 4. Default fallback values\n   *\n   * @param req - ArkosRequest object used to determine if the connection is secure\n   * @returns Cookie options object with expires, httpOnly, secure, and sameSite properties\n   *\n   * @example\n   * ```typescript\n   * const cookieOptions = authService.getJwtCookieOptions(req);\n   * res.cookie('jwt', token, cookieOptions);\n   * ```\n   */\n  getJwtCookieOptions(req: ArkosRequest) {\n    const arkosConfig = getArkosConfig();\n    const authConfigs = arkosConfig?.authentication;\n\n    if (!req)\n      throw new Error(\"Missing req object in order get jwt cookie options\");\n\n    const sameSite =\n      authConfigs?.jwt?.cookie?.sameSite ||\n      (process.env.JWT_COOKIE_SAME_SITE as\n        | \"none\"\n        | \"lax\"\n        | \"strict\"\n        | undefined) ||\n      \"lax\";\n\n    return {\n      expires: new Date(\n        Date.now() +\n          Number(\n            toMs(\n              authConfigs?.jwt?.expiresIn ||\n                (process.env.JWT_EXPIRES_IN as MsDuration) ||\n                (arkosEnv.JWT_EXPIRES_IN as MsDuration)\n            )\n          )\n      ),\n      httpOnly:\n        authConfigs?.jwt?.cookie?.httpOnly ??\n        (process.env.JWT_COOKIE_HTTP_ONLY !== undefined\n          ? process.env.JWT_COOKIE_HTTP_ONLY === \"true\"\n          : undefined) ??\n        true,\n      secure: (() => {\n        if (authConfigs?.jwt?.cookie?.secure !== undefined)\n          return authConfigs?.jwt?.cookie?.secure;\n        else if (process.env.JWT_COOKIE_SECURE !== undefined)\n          return process.env.JWT_COOKIE_SECURE === \"true\";\n        else return req.secure || req.headers[\"x-forwarded-proto\"] === \"https\";\n      })(),\n      sameSite,\n      domain: authConfigs?.jwt?.cookie?.domain || process.env.JWT_COOKIE_DOMAIN,\n      ...arkosConfig?.authentication?.jwt?.cookie,\n    } as CookieOptions;\n  }\n\n  /**\n   * Is used by default internally by Arkos under `BaseService` class to check if the password is already hashed.\n   *\n   * This was just added to prevent unwanted errors when someone just forgets that the `BaseService` class will automatically hash the password field using `authService.hashPassword` by default.\n   *\n   * So now before `BaseService` hashes it will test it.\n   *\n   *\n   * @param password The password to be tested if is hashed\n   * @returns\n   */\n  isPasswordHashed(password: string) {\n    return !Number.isNaN(bcrypt.getRounds(password) * 1);\n  }\n\n  /**\n   * Compares a candidate password with the stored user password to check if they match.\n   *\n   * @param {string} candidatePassword - The password provided by the user during login.\n   * @param {string} userPassword - The password stored in the database.\n   * @returns {Promise<boolean>} Returns true if the passwords match, otherwise false.\n   */\n  async isCorrectPassword(\n    candidatePassword: string,\n    userPassword: string\n  ): Promise<boolean> {\n    return await bcrypt.compare(candidatePassword, userPassword);\n  }\n\n  /**\n   * Hashes a plain text password using bcrypt.\n   *\n   * @param {string} password - The password to be hashed.\n   * @returns {Promise<string>} Returns the hashed password.\n   */\n  async hashPassword(password: string): Promise<string> {\n    return await bcrypt.hash(password, 12);\n  }\n\n  /**\n   * Checks if a password is strong, requiring uppercase, lowercase, and numeric characters as the default.\n   *\n   * **NB**: You must pay attention when using custom validation with zod or class-validator, try to use the same regex always.\n   *\n   * **Note**: You can define it when calling arkos.init()\n   * ```ts\n   * arkos.init({\n   *  authentication: {\n   *    passwordValidation:{ regex: /your-desired-regex/, message: 'password must contain...'}\n   *  }\n   * })\n   * ```\n   *\n   * @param {string} password - The password to check.\n   * @returns {boolean} Returns true if the password meets the strength criteria, otherwise false.\n   */\n  public isPasswordStrong(password: string): boolean {\n    const initAuthConfigs = getArkosConfig()?.authentication;\n\n    const strongPasswordRegex =\n      initAuthConfigs?.passwordValidation?.regex ||\n      /^(?=.*[A-Z])(?=.*[a-z])(?=.*\\d).+$/;\n    return strongPasswordRegex.test(password);\n  }\n\n  /**\n   * Checks if a user has changed their password after the JWT was issued.\n   *\n   * @param {User} user - The user object containing the passwordChangedAt field.\n   * @param {number} JWTTimestamp - The timestamp when the JWT was issued.\n   * @returns {boolean} Returns true if the user changed their password after the JWT was issued, otherwise false.\n   */\n  userChangedPasswordAfter(user: User, JWTTimestamp: number): boolean {\n    if (user.passwordChangedAt) {\n      const convertedTimestamp = parseInt(\n        String(new Date(user.passwordChangedAt).getTime() / 1000),\n        10\n      );\n\n      return JWTTimestamp < convertedTimestamp;\n    }\n    return false;\n  }\n\n  /**\n   * Verifies the authenticity of a JWT token.\n   *\n   * @param {string} token - The JWT token to verify.\n   * @param {string} [secret] - The secret key used to verify the token. Defaults to environment variable `JWT_SECRET`.\n   * @returns {Promise<AuthJwtPayload>} Returns the decoded JWT payload if the token is valid.\n   * @throws {Error} Throws an error if the token is invalid or expired.\n   */\n  async verifyJwtToken(\n    token: string,\n    secret?: string\n  ): Promise<AuthJwtPayload> {\n    const { authentication: configs } = getArkosConfig();\n\n    if (\n      process.env.ARKOS_BUILD === \"true\" &&\n      !process.env.JWT_SECRET &&\n      !configs?.jwt?.secret\n    )\n      throw new AppError(\n        \"Missing JWT secret in production\",\n        500,\n        \"MissingJWTSecretInProduction\"\n      );\n\n    secret =\n      secret ||\n      configs?.jwt?.secret ||\n      process.env.JWT_SECRET ||\n      arkosEnv.JWT_SECRET;\n\n    return new Promise((resolve, reject) => {\n      jwt.verify(token, secret, (err, decoded) => {\n        if (err) reject(err);\n        else resolve(decoded as AuthJwtPayload);\n      });\n    });\n  }\n\n  private isWildcardAccess(config: AccessControlConfig): config is \"*\" {\n    return config === \"*\";\n  }\n\n  private isRoleList(config: AccessControlConfig): config is string[] {\n    return Array.isArray(config);\n  }\n\n  private isAccessRules(\n    config: AccessControlConfig\n  ): config is Partial<AccessControlRules> {\n    return (\n      typeof config === \"object\" && config !== null && !Array.isArray(config)\n    );\n  }\n\n  private normalizeRuleToRoles(\n    rule: string[] | DetailedAccessControlRule | \"*\" | undefined\n  ): string[] {\n    if (!rule) return [];\n    if (rule === \"*\") return [\"*\"];\n    if (Array.isArray(rule)) return rule;\n    return rule.roles === \"*\" ? [\"*\"] : (rule.roles ?? []);\n  }\n\n  private resolveAuthorizedRoles(\n    action: AccessAction,\n    accessControl: AccessControlConfig\n  ): string[] {\n    if (this.isWildcardAccess(accessControl)) return [\"*\"];\n    if (this.isRoleList(accessControl)) return accessControl;\n    if (this.isAccessRules(accessControl))\n      return this.normalizeRuleToRoles(accessControl[action]);\n    return [];\n  }\n\n  /**\n   * Checks if a user has permission for a specific action using static access control rules.\n   * Validates user roles against predefined access control configuration.\n   *\n   * @param user - The user object containing role or roles field\n   * @param action - The action being performed\n   * @param accessControl - Access control configuration (array of roles or object with action-role mappings)\n   * @returns True if user has permission, false otherwise\n   * @throws Error if user doesn't have role/roles field\n   */\n  protected checkStaticAccessControl(\n    user: User,\n    action: string,\n    accessControl: AccessControlConfig\n  ) {\n    if (!user?.role && !user.roles)\n      throw Error(\n        \"Validation Error: In order to use static authentication user needs at least role field or roles for multiple roles.\"\n      );\n\n    let authorizedRoles = this.resolveAuthorizedRoles(action, accessControl);\n\n    const userRoles = Array.isArray(user?.roles) ? user.roles : [user.role];\n\n    return (\n      authorizedRoles?.[0] === \"*\" ||\n      !!userRoles.some((role: string) => authorizedRoles.includes(role))\n    );\n  }\n\n  /**\n   * Checks if a user has permission for a specific action and resource using dynamic access control.\n   * Queries the database to verify user's role permissions.\n   *\n   * @param userId - The unique identifier of the user\n   * @param action - The action being performed\n   * @param resource - The resource being accessed\n   * @returns Promise resolving to true if user has permission, false otherwise\n   */\n  protected async checkDynamicAccessControl(\n    userId: string,\n    action: string,\n    resource: string\n  ) {\n    const prisma = getPrismaInstance();\n    return !!(await prisma.userRole.findFirst({\n      where: {\n        userId,\n        role: {\n          permissions: {\n            some: {\n              resource,\n              action,\n            },\n          },\n        },\n      },\n      select: { id: true },\n    }));\n  }\n\n  /**\n   * Middleware function to handle access control based on user roles and permissions.\n   *\n   * @param {AccessAction} action - The action being performed (e.g., create, update, delete, view).\n   * @param {string} resource - The resource name that the action is being performed on (e.g., \"User\", \"Post\").\n   * @param {AccessControlConfig} accessControl - The access control configuration.\n   * @returns {ArkosRequestHandler} The middleware function that checks if the user has permission to perform the action.\n   *\n   * @deprecated Will be removed on v2.0, use AuthService.authorize instead\n   */\n  handleAccessControl(\n    action: AccessAction,\n    resource: string,\n    accessControl?: AccessControlConfig\n  ): ArkosRequestHandler {\n    if (\n      !accessControl &&\n      appModules.some(\n        (appModule) => kebabCase(appModule) === kebabCase(resource)\n      )\n    )\n      accessControl = getModuleComponents(resource)?.authConfigs?.accessControl;\n\n    authActionService.add(action, resource, accessControl);\n\n    return catchAsync(\n      async (req: ArkosRequest, _: ArkosResponse, next: ArkosNextFunction) => {\n        if (req.user) {\n          const user = req.user as User;\n          const configs = getArkosConfig();\n\n          if (user.isSuperUser) {\n            next();\n            return;\n          }\n\n          const notEnoughPermissionsError = new AppError(\n            \"You do not have permission to perfom this action\",\n            403,\n            \"NotEnoughPermissions\"\n          );\n\n          if (configs?.authentication?.mode === \"dynamic\") {\n            const hasPermission = await this.checkDynamicAccessControl(\n              user.id,\n              action,\n              resource\n            );\n\n            if (!hasPermission) return next(notEnoughPermissionsError);\n          } else if (configs?.authentication?.mode === \"static\") {\n            if (!accessControl) return next(notEnoughPermissionsError);\n\n            const hasPermission = this.checkStaticAccessControl(\n              user,\n              action,\n              accessControl\n            );\n\n            if (!hasPermission) return next(notEnoughPermissionsError);\n          }\n        }\n\n        next();\n      }\n    );\n  }\n\n  /**\n   * Processes the cookies or authoriation token and returns the user.\n   * @param req\n   * @returns {Promise<User | null>} - if authentication is turned off in arkosConfig it returns null\n   * @throws {AppError} Throws an error if the token is invalid or the user is not logged in.\n   */\n  async getAuthenticatedUser(req: ArkosRequest): Promise<User | null> {\n    if (!isAuthenticationEnabled())\n      throw Error(\n        \"ValidationError: Trying to call AuthService.getAuthenticatedUser without setting up authentication\"\n      );\n\n    const prisma = getPrismaInstance();\n\n    let token: string | undefined;\n\n    if (\n      req?.headers?.authorization &&\n      req?.headers?.authorization.startsWith(\"Bearer\") &&\n      req?.headers?.authorization.split?.(\" \")?.[1]\n    )\n      token = req?.headers?.authorization.split(\" \")[1];\n\n    if (\n      !token &&\n      req?.cookies?.arkos_access_token !== \"no-token\" &&\n      req.cookies\n    ) {\n      token = req?.cookies?.arkos_access_token;\n    }\n\n    if (!token) return null;\n\n    let decoded: AuthJwtPayload | undefined;\n\n    try {\n      decoded = await this.verifyJwtToken(token);\n    } catch (err) {\n      throw invaliAuthTokenError;\n    }\n\n    if (!decoded?.id) throw invaliAuthTokenError;\n    const user: any | null = await (prisma as any).user.findUnique({\n      where: { id: String(decoded.id) },\n    });\n\n    if (!user)\n      throw new AppError(\n        \"The user belonging to this token does no longer exists\",\n        401,\n        \"UserNoLongerExists\"\n      );\n\n    if (\n      this.userChangedPasswordAfter(user, decoded.iat!) &&\n      !req.path?.includes?.(\"logout\")\n    )\n      throw new AppError(\n        \"User recently changed password! Please log in again.\",\n        401,\n        \"PasswordChanged\"\n      );\n\n    req.accessToken = token;\n    return user;\n  }\n\n  /**\n   * Middleware to authenticate the request by extracting and verifying the JWT token and setting `req.user`.\n   *\n   * Runs `authentication.hooks.authenticate` before/after the authentication logic.\n   *\n   * Hook execution flow:\n   * - `before` hooks run first — call `ctx.skip()` to bypass core logic and jump to `after` hooks,\n   *   call `ctx.next()` to stop the chain early, or return without calling anything to continue.\n   * - Core logic runs — extracts and verifies the JWT token, sets `req.user`.\n   * - `after` hooks run — call `ctx.next(err)` to abort or return without calling anything to continue.\n   * - `onError` hooks run if core logic throws — call `ctx.skip()` to suppress the error and jump to\n   *   `after` hooks, or call `ctx.next(err)` to forward it to the global error handler.\n   *\n   * On custom routes, hooks defined in `arkosConfig` still apply since they are baked into this method.\n   *\n   * @example\n   * ```ts\n   * // custom route - hooks still run\n   * router.get(\"/custom\", authService.authenticate, handler);\n   * ```\n   *\n   * @example\n   * ```ts\n   * // skip built-in auth from a before hook\n   * before: (ctx) => {\n   *   ctx.req.user = myCustomAuth(ctx.req);\n   *   ctx.skip();\n   * }\n   * ```\n   *\n   * @see {@link https://www.arkosjs.com/docs/core-concepts/authentication/hooks}\n   */\n  authenticate = catchAsync(\n    async (req: ArkosRequest, _: ArkosResponse, next: ArkosNextFunction) => {\n      const hooks = getArkosConfig()?.authentication?.hooks?.authenticate;\n\n      const before = await this.runHooks(hooks?.before, req);\n      if (before.error) {\n        const onError = await this.runErrorHooks(\n          hooks?.onError,\n          before.error,\n          req\n        );\n        if (onError.skipped) {\n          const after = await this.runAfterHooks(hooks?.after, req);\n          return after.error ? next(after.error) : next();\n        }\n        return next(onError.error);\n      }\n\n      if (!before.skipped) {\n        try {\n          if (isAuthenticationEnabled()) {\n            const user = (await this.getAuthenticatedUser(req)) as User;\n            if (!user) throw loginRequiredError;\n            req.user = user;\n          }\n        } catch (err) {\n          const onError = await this.runErrorHooks(hooks?.onError, err, req);\n          if (onError.skipped) {\n            const after = await this.runAfterHooks(hooks?.after, req);\n            return after.error ? next(after.error) : next();\n          }\n          return next(onError.error);\n        }\n      }\n\n      const after = await this.runAfterHooks(hooks?.after, req);\n      if (after.error) return next(after.error);\n\n      next();\n    }\n  );\n\n  /**\n   * Middleware to authorize the authenticated user for a given action on a resource.\n   *\n   * Runs `authentication.hooks.authorize` before/after the authorization logic.\n   *\n   * Hook execution flow:\n   * - `before` hooks run first — call `ctx.skip()` to bypass core logic and jump to `after` hooks,\n   *   call `ctx.next()` to stop the chain early, or return without calling anything to continue.\n   * - Core logic runs — checks user role/permissions against the access control rules.\n   * - `after` hooks run — call `ctx.next(err)` to abort or return without calling anything to continue.\n   * - `onError` hooks run if authorization fails — call `ctx.skip()` to suppress the error and jump to\n   *   `after` hooks, or call `ctx.next(err)` to forward it to the global error handler.\n   *\n   * @param resource - The resource being accessed, in kebabCase (e.g. `\"product\"`, `\"cart-item\"`)\n   * @param action - The action being performed (e.g. `\"View\"`, `\"Create\"`, `\"Delete\"`)\n   * @param rule - Access control rules for this action. Accepts a role list, a wildcard, or a `DetailedAccessControlRule`.\n   *\n   * @example\n   * ```ts\n   * router.delete(\"/products/:id\",\n   *   authService.authenticate,\n   *   authService.authorize(\"product\", \"Delete\", [\"admin\"]),\n   *   handler\n   * );\n   * ```\n   *\n   * @example\n   * ```ts\n   * // skip built-in authorization from a before hook\n   * before: (ctx) => {\n   *   ctx.req.user.role = myCustomRoleResolver(ctx.req);\n   *   ctx.skip();\n   * }\n   * ```\n   *\n   * @see {@link https://www.arkosjs.com/docs/core-concepts/authentication/hooks#authorize}\n   * @since v1.6.0-beta\n   */\n  authorize(\n    action: AccessAction,\n    resource: string,\n    rule?: string[] | DetailedAccessControlRule | \"*\"\n  ): ArkosRequestHandler {\n    authActionService.add(action, resource, { [action]: rule });\n\n    return catchAsync(\n      async (req: ArkosRequest, _: ArkosResponse, next: ArkosNextFunction) => {\n        const hooks = getArkosConfig()?.authentication?.hooks?.authorize;\n\n        const before = await this.runHooks(hooks?.before, req, {\n          action,\n          resource,\n          rule,\n        });\n        if (before.error) {\n          const onError = await this.runErrorHooks(\n            hooks?.onError,\n            before.error,\n            req,\n            { action, resource, rule }\n          );\n          if (onError.skipped) {\n            const after = await this.runAfterHooks(hooks?.after, req, {\n              action,\n              resource,\n              rule,\n            });\n            return after.error ? next(after.error) : next();\n          }\n          return next(onError.error);\n        }\n\n        if (!before.skipped) {\n          try {\n            if (req.user) {\n              const user = req.user as User;\n              const configs = getArkosConfig();\n\n              if (!user.isSuperUser) {\n                const notEnoughPermissionsError = new AppError(\n                  \"You do not have permission to perform this action\",\n                  403,\n                  \"NotEnoughPermissions\"\n                );\n\n                if (configs?.authentication?.mode === \"dynamic\") {\n                  const hasPermission = await this.checkDynamicAccessControl(\n                    user.id,\n                    action,\n                    resource\n                  );\n                  if (!hasPermission) throw notEnoughPermissionsError;\n                } else if (configs?.authentication?.mode === \"static\") {\n                  const hasPermission = this.checkStaticAccessControl(\n                    user,\n                    action,\n                    { [action]: rule }\n                  );\n                  if (!hasPermission) throw notEnoughPermissionsError;\n                }\n              }\n            }\n          } catch (err) {\n            const onError = await this.runErrorHooks(hooks?.onError, err, req, {\n              action,\n              resource,\n              rule,\n            });\n            if (onError.skipped) {\n              const after = await this.runAfterHooks(hooks?.after, req, {\n                action,\n                resource,\n                rule,\n              });\n              return after.error ? next(after.error) : next();\n            }\n            return next(onError.error);\n          }\n        }\n\n        const after = await this.runAfterHooks(hooks?.after, req, {\n          action,\n          resource,\n          rule,\n        });\n        if (after.error) return next(after.error);\n\n        next();\n      }\n    );\n  }\n\n  /**\n   * Handles authentication control by checking the `authenticationControl` configuration in the `authConfigs`.\n   *\n   * @param {ControllerActions} action - The action being performed (e.g., create, update, delete, view).\n   * @param {AuthenticationControlConfig} authenticationControl - The authentication configuration object.\n   * @returns {ArkosRequestHandler} The middleware function that checks if authentication is required.\n   *\n   * @deprecated Will be removed on v2.0, use AuthService.authenticate instead\n   */\n  handleAuthenticationControl(\n    action: AccessAction,\n    authenticationControl?: AuthenticationControlConfig | undefined\n  ): ArkosRequestHandler {\n    if (authenticationControl && typeof authenticationControl === \"object\") {\n      if (authenticationControl[action] === false) return callNext;\n      else if (authenticationControl[action] === true) return this.authenticate;\n    } else return this.authenticate;\n\n    return this.authenticate;\n  }\n\n  /**\n   * Creates a permission checker function for a specific action and resource.\n   *\n   * PS: This method should be called during application initialization to build permission validators.\n   *\n   * @see {@link https://www.arkosjs.com/docs/advanced-guide/fine-grained-access-control}\n   *\n   * @param action - The action to check permission for (e.g., 'View', 'Create', 'Delete')\n   * @param resource - The resource being accessed, must be in kebabCase (e.g., 'user', 'cart-item', 'order')\n   * @param accessControl - Access control rules (required for static authentication mode), and it is automatically loaded for known modules such as all prisma models, auth and file-upload.\n   * @returns A function that takes a user object and returns a boolean indicating permission status\n   *\n   * @example\n   * ```typescript\n   * const hasViewProductPermission = await authService.permission('View', 'product');\n   *\n   * // Later in handler:\n   * const canAccess = await hasViewProductPermission(user);\n   * if (canAccess) {\n   *   // User has permission\n   * }\n   * ```\n   */\n  permission(\n    action: string,\n    resource: string,\n    accessControl?: AccessControlConfig\n  ) {\n    // Check if called during request handling (deep call stack indicates handler execution)\n    const stack = new Error().stack;\n\n    if (stack?.includes(\"node_modules/express/lib/router/index.js\"))\n      throw new Error(\n        \"authService.permission() should be called during application initialization level.\"\n      );\n\n    authActionService.add(action, resource, accessControl);\n\n    return async (user: User | undefined): Promise<boolean> => {\n      // getArkosConfig must not be called the same time as arkos.init()\n      const configs = getArkosConfig();\n\n      if (!isUsingAuthentication())\n        throw Error(\n          \"Validation Error: Trying to use authService.permission without setting up authentication.\"\n        );\n\n      if (!isAuthenticationEnabled()) return false;\n      if (!user) throw loginRequiredError;\n      if (user?.isSuperUser) return true;\n\n      if (configs?.authentication?.mode === \"dynamic\") {\n        return await this.checkDynamicAccessControl(user?.id, action, resource);\n      } else if (configs?.authentication?.mode === \"static\") {\n        if (!accessControl && appModules.includes(kebabCase(resource)))\n          accessControl = getModuleComponents(kebabCase(resource))?.authConfigs\n            ?.accessControl;\n\n        return (\n          !!accessControl &&\n          this.checkStaticAccessControl(user as any, action, accessControl)\n        );\n      }\n      return false;\n    };\n  }\n}\n\n/**\n * Handles various authentication-related tasks such as JWT signing, password hashing, and verifying user credentials.\n */\nconst authService = new AuthService();\n\nexport default authService;\n"]}
+{"version":3,"file":"auth.service.js","sourceRoot":"","sources":["../../../../src/modules/auth/auth.service.ts"],"names":[],"mappings":";;;;;;AAAA,gEAAgD;AAChD,wDAA8B;AAE9B,qFAA4D;AAC5D,iFAAwD;AACxD,+DAAoD;AACpD,yCAA8C;AAC9C,sEAA6C;AAC7C,uEAAuE;AAevE,qFAA2E;AAC3E,+DAA6E;AAC7E,+CAAgD;AAChD,mEAGoC;AACpC,+FAAqE;AACrE,mFAGkD;AAclD,MAAa,WAAW;IAAxB;QAIE,uBAAkB,GAAgC,EAAE,CAAC;QAqnBrD,iBAAY,GAAG,IAAA,qBAAU,EACvB,KAAK,EAAE,GAAiB,EAAE,CAAgB,EAAE,IAAuB,EAAE,EAAE;YACrE,MAAM,KAAK,GAAG,IAAA,uBAAc,GAAE,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,CAAC;YAEpE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;YACvD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBACjB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CACtC,KAAK,EAAE,OAAO,EACd,MAAM,CAAC,KAAK,EACZ,GAAG,CACJ,CAAC;gBACF,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;oBACpB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;oBAC1D,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAClD,CAAC;gBACD,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC7B,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,IAAI,CAAC;oBACH,IAAI,IAAA,8CAAuB,GAAE,EAAE,CAAC;wBAC9B,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAS,CAAC;wBAC5D,IAAI,CAAC,IAAI;4BAAE,MAAM,uCAAkB,CAAC;wBACpC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;oBAClB,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;oBACnE,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;wBACpB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;wBAC1D,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;oBAClD,CAAC;oBACD,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBAC7B,CAAC;YACH,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;YAC1D,IAAI,KAAK,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAE1C,IAAI,EAAE,CAAC;QACT,CAAC,CACF,CAAC;IA+NJ,CAAC;IAj3BS,KAAK,CAAC,QAAQ,CACpB,KAKa,EACb,GAAiB,EACjB,GAIC;QAED,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAEtC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAEzD,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,IAAI,UAAU,GAAG,KAAK,CAAC;YAEvB,IAAI,CAAC;gBACH,MAAO,IAAY,CAAC;oBAClB,GAAG;oBACH,IAAI,EAAE,GAAG,EAAE;wBACT,UAAU,GAAG,IAAI,CAAC;oBACpB,CAAC;oBACD,GAAG,GAAG;iBACP,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;YACxC,CAAC;YAED,IAAI,UAAU;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3C,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAUO,KAAK,CAAC,aAAa,CACzB,KAKa,EACb,GAAiB,EACjB,GAIC;QAED,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,CAAC;QAEtB,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAEzD,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAO,IAAY,CAAC,EAAE,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;YACvC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;YACxB,CAAC;QACH,CAAC;QAED,OAAO,EAAE,CAAC;IACZ,CAAC;IAWO,KAAK,CAAC,aAAa,CACzB,KAKa,EACb,KAAc,EACd,GAAiB,EACjB,GAIC;QAED,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAE7C,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAEzD,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,IAAI,UAAU,GAAG,KAAK,CAAC;YAEvB,IAAI,CAAC;gBACH,MAAO,IAAY,CAAC;oBAClB,GAAG;oBACH,KAAK;oBACL,IAAI,EAAE,GAAG,EAAE;wBACT,UAAU,GAAG,IAAI,CAAC;oBACpB,CAAC;oBACD,GAAG,GAAG;iBACP,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;YACxC,CAAC;YAED,IAAI,UAAU;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3C,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACnC,CAAC;IASD,YAAY,CACV,EAAmB,EACnB,SAA+B,EAC/B,MAAe;QAEf,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,IAAA,uBAAc,GAAE,CAAC;QAErD,IACE,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,MAAM;YAClC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU;YACvB,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM;YAErB,MAAM,IAAI,mBAAQ,CAChB,mCAAmC,EACnC,GAAG,EACH,wBAAwB,CACzB,CAAC;QAEJ,MAAM;YACJ,MAAM;gBACN,OAAO,EAAE,GAAG,EAAE,MAAM;gBACpB,OAAO,CAAC,GAAG,CAAC,UAAU;gBACtB,mBAAQ,CAAC,UAAU,CAAC;QAEtB,SAAS,GAAG,CAAC,SAAS;YACpB,OAAO,EAAE,GAAG,EAAE,SAAS;YACvB,OAAO,CAAC,GAAG,CAAC,cAAc;YAC1B,mBAAQ,CAAC,cAAc,CAAmC,CAAC;QAE7D,OAAO,sBAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;YAC9B,SAAS,EAAE,SAAuB;SACnC,CAAC,CAAC;IACL,CAAC;IAoBD,mBAAmB,CAAC,GAAiB;QACnC,MAAM,WAAW,GAAG,IAAA,uBAAc,GAAE,CAAC;QACrC,MAAM,WAAW,GAAG,WAAW,EAAE,cAAc,CAAC;QAEhD,IAAI,CAAC,GAAG;YACN,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QAExE,MAAM,QAAQ,GACZ,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ;YACjC,OAAO,CAAC,GAAG,CAAC,oBAIC;YACd,KAAK,CAAC;QAER,OAAO;YACL,OAAO,EAAE,IAAI,IAAI,CACf,IAAI,CAAC,GAAG,EAAE;gBACR,MAAM,CACJ,IAAA,8BAAI,EACF,WAAW,EAAE,GAAG,EAAE,SAAS;oBACxB,OAAO,CAAC,GAAG,CAAC,cAA6B;oBACzC,mBAAQ,CAAC,cAA6B,CAC1C,CACF,CACJ;YACD,QAAQ,EACN,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ;gBAClC,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,SAAS;oBAC7C,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,MAAM;oBAC7C,CAAC,CAAC,SAAS,CAAC;gBACd,IAAI;YACN,MAAM,EAAE,CAAC,GAAG,EAAE;gBACZ,IAAI,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,KAAK,SAAS;oBAChD,OAAO,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC;qBACrC,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,SAAS;oBAClD,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,MAAM,CAAC;;oBAC7C,OAAO,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,OAAO,CAAC;YACzE,CAAC,CAAC,EAAE;YACJ,QAAQ;YACR,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB;YACzE,GAAG,WAAW,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM;SAC3B,CAAC;IACrB,CAAC;IAaD,gBAAgB,CAAC,QAAgB;QAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,CAAC;IASD,KAAK,CAAC,iBAAiB,CACrB,iBAAyB,EACzB,YAAoB;QAEpB,OAAO,MAAM,kBAAM,CAAC,OAAO,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;IAC/D,CAAC;IAQD,KAAK,CAAC,YAAY,CAAC,QAAgB;QACjC,OAAO,MAAM,kBAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACzC,CAAC;IAmBM,gBAAgB,CAAC,QAAgB;QACtC,MAAM,eAAe,GAAG,IAAA,uBAAc,GAAE,EAAE,cAAc,CAAC;QAEzD,MAAM,mBAAmB,GACvB,eAAe,EAAE,kBAAkB,EAAE,KAAK;YAC1C,oCAAoC,CAAC;QACvC,OAAO,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IASD,wBAAwB,CAAC,IAAU,EAAE,YAAoB;QACvD,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3B,MAAM,kBAAkB,GAAG,QAAQ,CACjC,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,EACzD,EAAE,CACH,CAAC;YAEF,OAAO,YAAY,GAAG,kBAAkB,CAAC;QAC3C,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAUD,KAAK,CAAC,cAAc,CAClB,KAAa,EACb,MAAe;QAEf,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,IAAA,uBAAc,GAAE,CAAC;QAErD,IACE,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,MAAM;YAClC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU;YACvB,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM;YAErB,MAAM,IAAI,mBAAQ,CAChB,kCAAkC,EAClC,GAAG,EACH,8BAA8B,CAC/B,CAAC;QAEJ,MAAM;YACJ,MAAM;gBACN,OAAO,EAAE,GAAG,EAAE,MAAM;gBACpB,OAAO,CAAC,GAAG,CAAC,UAAU;gBACtB,mBAAQ,CAAC,UAAU,CAAC;QAEtB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE;gBACzC,IAAI,GAAG;oBAAE,MAAM,CAAC,GAAG,CAAC,CAAC;;oBAChB,OAAO,CAAC,OAAyB,CAAC,CAAC;YAC1C,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,gBAAgB,CAAC,MAA2B;QAClD,OAAO,MAAM,KAAK,GAAG,CAAC;IACxB,CAAC;IAEO,UAAU,CAAC,MAA2B;QAC5C,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAEO,aAAa,CACnB,MAA2B;QAE3B,OAAO,CACL,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CACxE,CAAC;IACJ,CAAC;IAEO,oBAAoB,CAC1B,IAA4D;QAE5D,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,CAAC;QACrB,IAAI,IAAI,KAAK,GAAG;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACrC,OAAO,IAAI,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IAEO,sBAAsB,CAC5B,MAAoB,EACpB,aAAkC;QAElC,IAAI,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACvD,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC;YAAE,OAAO,aAAa,CAAC;QACzD,IAAI,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC;YACnC,OAAO,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1D,OAAO,EAAE,CAAC;IACZ,CAAC;IAYS,wBAAwB,CAChC,IAAU,EACV,MAAc,EACd,aAAkC;QAElC,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK;YAC5B,MAAM,KAAK,CACT,qHAAqH,CACtH,CAAC;QAEJ,IAAI,eAAe,GAAG,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QAEzE,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAExE,OAAO,CACL,eAAe,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG;YAC5B,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CACnE,CAAC;IACJ,CAAC;IAWS,KAAK,CAAC,yBAAyB,CACvC,MAAc,EACd,MAAc,EACd,QAAgB;QAEhB,MAAM,MAAM,GAAG,IAAA,kCAAiB,GAAE,CAAC;QACnC,OAAO,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;YACxC,KAAK,EAAE;gBACL,MAAM;gBACN,IAAI,EAAE;oBACJ,WAAW,EAAE;wBACX,IAAI,EAAE;4BACJ,QAAQ;4BACR,MAAM;yBACP;qBACF;iBACF;aACF;YACD,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;SACrB,CAAC,CAAC,CAAC;IACN,CAAC;IAYD,mBAAmB,CACjB,MAAoB,EACpB,QAAgB,EAChB,aAAmC;QAEnC,IACE,CAAC,aAAa;YACd,2BAAU,CAAC,IAAI,CACb,CAAC,SAAS,EAAE,EAAE,CAAC,IAAA,iBAAS,EAAC,SAAS,CAAC,KAAK,IAAA,iBAAS,EAAC,QAAQ,CAAC,CAC5D;YAED,aAAa,GAAG,IAAA,oCAAmB,EAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,aAAa,CAAC;QAE5E,MAAM,UAAU,GAAG,6BAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;QAE1E,OAAO,IAAA,qBAAU,EACf,KAAK,EAAE,GAAiB,EAAE,CAAgB,EAAE,IAAuB,EAAE,EAAE;YACrE,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;gBACb,MAAM,IAAI,GAAG,GAAG,CAAC,IAAY,CAAC;gBAC9B,MAAM,OAAO,GAAG,IAAA,uBAAc,GAAE,CAAC;gBAEjC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;oBACrB,IAAI,EAAE,CAAC;oBACP,OAAO;gBACT,CAAC;gBAED,MAAM,yBAAyB,GAAG,IAAI,mBAAQ,CAC5C,UAAU,CAAC,YAAY,EACvB,GAAG,EACH,sBAAsB,CACvB,CAAC;gBAEF,IAAI,OAAO,EAAE,cAAc,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;oBAChD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,yBAAyB,CACxD,IAAI,CAAC,EAAE,EACP,MAAM,EACN,QAAQ,CACT,CAAC;oBAEF,IAAI,CAAC,aAAa;wBAAE,OAAO,IAAI,CAAC,yBAAyB,CAAC,CAAC;gBAC7D,CAAC;qBAAM,IAAI,OAAO,EAAE,cAAc,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACtD,IAAI,CAAC,aAAa;wBAAE,OAAO,IAAI,CAAC,yBAAyB,CAAC,CAAC;oBAE3D,MAAM,aAAa,GAAG,IAAI,CAAC,wBAAwB,CACjD,IAAI,EACJ,MAAM,EACN,aAAa,CACd,CAAC;oBAEF,IAAI,CAAC,aAAa;wBAAE,OAAO,IAAI,CAAC,yBAAyB,CAAC,CAAC;gBAC7D,CAAC;YACH,CAAC;YAED,IAAI,EAAE,CAAC;QACT,CAAC,CACF,CAAC;IACJ,CAAC;IAQD,KAAK,CAAC,oBAAoB,CAAC,GAAiB;QAC1C,IAAI,CAAC,IAAA,8CAAuB,GAAE;YAC5B,MAAM,KAAK,CACT,oGAAoG,CACrG,CAAC;QAEJ,MAAM,MAAM,GAAG,IAAA,kCAAiB,GAAE,CAAC;QAEnC,IAAI,KAAyB,CAAC;QAE9B,IACE,GAAG,EAAE,OAAO,EAAE,aAAa;YAC3B,GAAG,EAAE,OAAO,EAAE,aAAa,CAAC,UAAU,CAAC,QAAQ,CAAC;YAChD,GAAG,EAAE,OAAO,EAAE,aAAa,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YAE7C,KAAK,GAAG,GAAG,EAAE,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAEpD,IACE,CAAC,KAAK;YACN,GAAG,EAAE,OAAO,EAAE,kBAAkB,KAAK,UAAU;YAC/C,GAAG,CAAC,OAAO,EACX,CAAC;YACD,KAAK,GAAG,GAAG,EAAE,OAAO,EAAE,kBAAkB,CAAC;QAC3C,CAAC;QAED,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,IAAI,OAAmC,CAAC;QAExC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,yCAAoB,CAAC;QAC7B,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,EAAE;YAAE,MAAM,yCAAoB,CAAC;QAC7C,MAAM,IAAI,GAAe,MAAO,MAAc,CAAC,IAAI,CAAC,UAAU,CAAC;YAC7D,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE;SAClC,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI;YACP,MAAM,IAAI,mBAAQ,CAChB,wDAAwD,EACxD,GAAG,EACH,oBAAoB,CACrB,CAAC;QAEJ,IACE,IAAI,CAAC,wBAAwB,CAAC,IAAI,EAAE,OAAO,CAAC,GAAI,CAAC;YACjD,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC;YAE/B,MAAM,IAAI,mBAAQ,CAChB,sDAAsD,EACtD,GAAG,EACH,iBAAiB,CAClB,CAAC;QAEJ,GAAG,CAAC,WAAW,GAAG,KAAK,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAkHD,SAAS,CACP,MAAoB,EACpB,QAAgB,EAChB,IAAiD;QAEjD,MAAM,UAAU,GAAG,6BAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE;YACzD,CAAC,MAAM,CAAC,EAAE,IAAI;SACf,CAAC,CAAC;QAEH,OAAO,IAAA,qBAAU,EACf,KAAK,EAAE,GAAiB,EAAE,CAAgB,EAAE,IAAuB,EAAE,EAAE;YACrE,MAAM,KAAK,GAAG,IAAA,uBAAc,GAAE,EAAE,cAAc,EAAE,KAAK,EAAE,SAAS,CAAC;YAEjE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE;gBACrD,MAAM;gBACN,QAAQ;gBACR,IAAI;aACL,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBACjB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CACtC,KAAK,EAAE,OAAO,EACd,MAAM,CAAC,KAAK,EACZ,GAAG,EACH,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAC3B,CAAC;gBACF,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;oBACpB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE;wBACxD,MAAM;wBACN,QAAQ;wBACR,IAAI;qBACL,CAAC,CAAC;oBACH,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAClD,CAAC;gBACD,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC7B,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,IAAI,CAAC;oBACH,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;wBACb,MAAM,IAAI,GAAG,GAAG,CAAC,IAAY,CAAC;wBAC9B,MAAM,OAAO,GAAG,IAAA,uBAAc,GAAE,CAAC;wBAEjC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;4BACtB,MAAM,yBAAyB,GAAG,IAAI,mBAAQ,CAC5C,UAAU,CAAC,YAAY,EACvB,GAAG,EACH,sBAAsB,CACvB,CAAC;4BAEF,IAAI,OAAO,EAAE,cAAc,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;gCAChD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,yBAAyB,CACxD,IAAI,CAAC,EAAE,EACP,MAAM,EACN,QAAQ,CACT,CAAC;gCACF,IAAI,CAAC,aAAa;oCAAE,MAAM,yBAAyB,CAAC;4BACtD,CAAC;iCAAM,IAAI,OAAO,EAAE,cAAc,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;gCACtD,MAAM,aAAa,GAAG,IAAI,CAAC,wBAAwB,CACjD,IAAI,EACJ,MAAM,EACN,EAAE,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CACnB,CAAC;gCACF,IAAI,CAAC,aAAa;oCAAE,MAAM,yBAAyB,CAAC;4BACtD,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE;wBACjE,MAAM;wBACN,QAAQ;wBACR,IAAI;qBACL,CAAC,CAAC;oBACH,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;wBACpB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE;4BACxD,MAAM;4BACN,QAAQ;4BACR,IAAI;yBACL,CAAC,CAAC;wBACH,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;oBAClD,CAAC;oBACD,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBAC7B,CAAC;YACH,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE;gBACxD,MAAM;gBACN,QAAQ;gBACR,IAAI;aACL,CAAC,CAAC;YACH,IAAI,KAAK,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAE1C,IAAI,EAAE,CAAC;QACT,CAAC,CACF,CAAC;IACJ,CAAC;IAWD,2BAA2B,CACzB,MAAoB,EACpB,qBAA+D;QAE/D,IAAI,qBAAqB,IAAI,OAAO,qBAAqB,KAAK,QAAQ,EAAE,CAAC;YACvE,IAAI,qBAAqB,CAAC,MAAM,CAAC,KAAK,KAAK;gBAAE,OAAO,2BAAQ,CAAC;iBACxD,IAAI,qBAAqB,CAAC,MAAM,CAAC,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC,YAAY,CAAC;QAC5E,CAAC;;YAAM,OAAO,IAAI,CAAC,YAAY,CAAC;QAEhC,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAyBD,UAAU,CACR,MAAc,EACd,QAAgB,EAChB,aAAmC;QAGnC,MAAM,KAAK,GAAG,IAAI,KAAK,EAAE,CAAC,KAAK,CAAC;QAEhC,IAAI,KAAK,EAAE,QAAQ,CAAC,0CAA0C,CAAC;YAC7D,MAAM,IAAI,KAAK,CACb,oFAAoF,CACrF,CAAC;QAEJ,6BAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;QAEvD,OAAO,KAAK,EAAE,IAAsB,EAAoB,EAAE;YAExD,MAAM,OAAO,GAAG,IAAA,uBAAc,GAAE,CAAC;YAEjC,IAAI,CAAC,IAAA,4CAAqB,GAAE;gBAC1B,MAAM,KAAK,CACT,2FAA2F,CAC5F,CAAC;YAEJ,IAAI,CAAC,IAAA,8CAAuB,GAAE;gBAAE,OAAO,KAAK,CAAC;YAC7C,IAAI,CAAC,IAAI;gBAAE,MAAM,uCAAkB,CAAC;YACpC,IAAI,IAAI,EAAE,WAAW;gBAAE,OAAO,IAAI,CAAC;YAEnC,IAAI,OAAO,EAAE,cAAc,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;gBAChD,OAAO,MAAM,IAAI,CAAC,yBAAyB,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC1E,CAAC;iBAAM,IAAI,OAAO,EAAE,cAAc,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtD,IAAI,CAAC,aAAa,IAAI,2BAAU,CAAC,QAAQ,CAAC,IAAA,iBAAS,EAAC,QAAQ,CAAC,CAAC;oBAC5D,aAAa,GAAG,IAAA,oCAAmB,EAAC,IAAA,iBAAS,EAAC,QAAQ,CAAC,CAAC,EAAE,WAAW;wBACnE,EAAE,aAAa,CAAC;gBAEpB,OAAO,CACL,CAAC,CAAC,aAAa;oBACf,IAAI,CAAC,wBAAwB,CAAC,IAAW,EAAE,MAAM,EAAE,aAAa,CAAC,CAClE,CAAC;YACJ,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;IACJ,CAAC;CACF;AAh4BD,kCAg4BC;AAKD,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;AAEtC,kBAAe,WAAW,CAAC","sourcesContent":["import jwt, { SignOptions } from \"jsonwebtoken\";\nimport bcrypt from \"bcryptjs\";\nimport { User } from \"../../types\";\nimport catchAsync from \"../error-handler/utils/catch-async\";\nimport AppError from \"../error-handler/utils/app-error\";\nimport { callNext } from \"../base/base.middlewares\";\nimport { getArkosConfig } from \"../../server\";\nimport arkosEnv from \"../../utils/arkos-env\";\nimport { getPrismaInstance } from \"../../utils/helpers/prisma.helpers\";\nimport {\n  ArkosRequest,\n  ArkosResponse,\n  ArkosNextFunction,\n  ArkosRequestHandler,\n} from \"../../types\";\nimport {\n  AuthJwtPayload,\n  AccessAction,\n  AccessControlConfig,\n  AuthenticationControlConfig,\n  AccessControlRules,\n  DetailedAccessControlRule,\n} from \"../../types/auth\";\nimport { MsDuration, toMs } from \"./utils/helpers/auth.controller.helpers\";\nimport { appModules, getModuleComponents } from \"../../utils/dynamic-loader\";\nimport { kebabCase } from \"../../exports/utils\";\nimport {\n  invaliAuthTokenError,\n  loginRequiredError,\n} from \"./utils/auth-error-objects\";\nimport authActionService from \"./utils/services/auth-action.service\";\nimport {\n  isAuthenticationEnabled,\n  isUsingAuthentication,\n} from \"../../utils/helpers/arkos-config.helpers\";\nimport {\n  AuthenticateHookHandler,\n  AuthenticateAfterHookHandler,\n  AuthenticateErrorHookHandler,\n  AuthorizeHookHandler,\n  AuthorizeAfterHookHandler,\n  AuthorizeErrorHookHandler,\n} from \"../../types/arkos-config/utils\";\nimport { CookieOptions } from \"express\";\n\n/**\n * Handles various authentication-related tasks such as JWT signing, password hashing, and verifying user credentials.\n */\nexport class AuthService {\n  /**\n   * Object containing a combination of actions per resource, tracked by each set of calls of `authService.handleAccessControl`, this can be accessed through the `authService` object or through the endpoint\n   */\n  actionsPerResource: Record<string, Set<string>> = {};\n\n  /**\n   * Runs a chain of `before` hooks in sequence.\n   *\n   * - If a hook throws — chain aborts, error is forwarded to `onError` hooks.\n   * - If a hook calls `skip()` — chain stops, core logic is bypassed, jumps to `after` hooks.\n   * - If a hook returns — next hook in chain runs.\n   *\n   * @returns Promise resolving to `{ skipped, error? }`\n   */\n  private async runHooks(\n    hooks:\n      | AuthenticateHookHandler\n      | AuthenticateHookHandler[]\n      | AuthorizeHookHandler\n      | AuthorizeHookHandler[]\n      | undefined,\n    req: ArkosRequest,\n    ctx?: {\n      action?: AccessAction;\n      resource?: string;\n      rule?: string[] | DetailedAccessControlRule | \"*\";\n    }\n  ): Promise<{ skipped: boolean; error?: unknown }> {\n    if (!hooks) return { skipped: false };\n\n    const hookArray = Array.isArray(hooks) ? hooks : [hooks];\n\n    for (const hook of hookArray) {\n      let skipCalled = false;\n\n      try {\n        await (hook as any)({\n          req,\n          skip: () => {\n            skipCalled = true;\n          },\n          ...ctx,\n        });\n      } catch (err) {\n        return { skipped: false, error: err };\n      }\n\n      if (skipCalled) return { skipped: true };\n    }\n\n    return { skipped: false };\n  }\n\n  /**\n   * Runs a chain of `after` hooks in sequence.\n   *\n   * - If a hook throws — chain aborts, error is forwarded to the global error handler.\n   * - If a hook returns — next hook in chain runs.\n   *\n   * @returns Promise resolving to `{ error? }`\n   */\n  private async runAfterHooks(\n    hooks:\n      | AuthenticateAfterHookHandler\n      | AuthenticateAfterHookHandler[]\n      | AuthorizeAfterHookHandler\n      | AuthorizeAfterHookHandler[]\n      | undefined,\n    req: ArkosRequest,\n    ctx?: {\n      action?: AccessAction;\n      resource?: string;\n      rule?: string[] | DetailedAccessControlRule | \"*\";\n    }\n  ): Promise<{ error?: unknown }> {\n    if (!hooks) return {};\n\n    const hookArray = Array.isArray(hooks) ? hooks : [hooks];\n\n    for (const hook of hookArray) {\n      try {\n        await (hook as any)({ req, ...ctx });\n      } catch (err) {\n        return { error: err };\n      }\n    }\n\n    return {};\n  }\n\n  /**\n   * Runs a chain of `onError` hooks in sequence.\n   *\n   * - If a hook throws — chain aborts, error is forwarded to the global error handler.\n   * - If a hook calls `skip()` — suppresses the error and jumps to `after` hooks.\n   * - If a hook returns — next hook in chain runs.\n   *\n   * @returns Promise resolving to `{ skipped, error? }`\n   */\n  private async runErrorHooks(\n    hooks:\n      | AuthenticateErrorHookHandler\n      | AuthenticateErrorHookHandler[]\n      | AuthorizeErrorHookHandler\n      | AuthorizeErrorHookHandler[]\n      | undefined,\n    error: unknown,\n    req: ArkosRequest,\n    ctx?: {\n      action?: AccessAction;\n      resource?: string;\n      rule?: string[] | DetailedAccessControlRule | \"*\";\n    }\n  ): Promise<{ skipped: boolean; error?: unknown }> {\n    if (!hooks) return { skipped: false, error };\n\n    const hookArray = Array.isArray(hooks) ? hooks : [hooks];\n\n    for (const hook of hookArray) {\n      let skipCalled = false;\n\n      try {\n        await (hook as any)({\n          req,\n          error,\n          skip: () => {\n            skipCalled = true;\n          },\n          ...ctx,\n        });\n      } catch (err) {\n        return { skipped: false, error: err };\n      }\n\n      if (skipCalled) return { skipped: true };\n    }\n\n    return { skipped: false, error };\n  }\n  /**\n   * Signs a JWT token for the user.\n   *\n   * @param {number | string} id - The unique identifier of the user to generate the token for.\n   * @param {string | number} [expiresIn] - The expiration time for the token. Defaults to environment variable `JWT_EXPIRES_IN`.\n   * @param {string} [secret] - The secret key used to sign the token. Defaults to environment variable `JWT_SECRET`.\n   * @returns {string} The signed JWT token.\n   */\n  signJwtToken(\n    id: number | string,\n    expiresIn?: MsDuration | number,\n    secret?: string\n  ): string {\n    const { authentication: configs } = getArkosConfig();\n\n    if (\n      process.env.ARKOS_BUILD === \"true\" &&\n      !process.env.JWT_SECRET &&\n      !configs?.jwt?.secret\n    )\n      throw new AppError(\n        \"Missing JWT secret on production!\",\n        500,\n        \"MissingJWTOnProduction\"\n      );\n\n    secret =\n      secret ||\n      configs?.jwt?.secret ||\n      process.env.JWT_SECRET ||\n      arkosEnv.JWT_SECRET;\n\n    expiresIn = (expiresIn ||\n      configs?.jwt?.expiresIn ||\n      process.env.JWT_EXPIRES_IN ||\n      arkosEnv.JWT_EXPIRES_IN) as keyof SignOptions[\"expiresIn\"];\n\n    return jwt.sign({ id }, secret, {\n      expiresIn: expiresIn as MsDuration,\n    });\n  }\n\n  /**\n   * Retrieves cookie configuration options for JWT authentication.\n   *\n   * Merges configuration from multiple sources in order of precedence:\n   * 1. Arkos configuration file\n   * 2. Environment variables\n   * 3. Request properties (for secure flag)\n   * 4. Default fallback values\n   *\n   * @param req - ArkosRequest object used to determine if the connection is secure\n   * @returns Cookie options object with expires, httpOnly, secure, and sameSite properties\n   *\n   * @example\n   * ```typescript\n   * const cookieOptions = authService.getJwtCookieOptions(req);\n   * res.cookie('jwt', token, cookieOptions);\n   * ```\n   */\n  getJwtCookieOptions(req: ArkosRequest) {\n    const arkosConfig = getArkosConfig();\n    const authConfigs = arkosConfig?.authentication;\n\n    if (!req)\n      throw new Error(\"Missing req object in order get jwt cookie options\");\n\n    const sameSite =\n      authConfigs?.jwt?.cookie?.sameSite ||\n      (process.env.JWT_COOKIE_SAME_SITE as\n        | \"none\"\n        | \"lax\"\n        | \"strict\"\n        | undefined) ||\n      \"lax\";\n\n    return {\n      expires: new Date(\n        Date.now() +\n          Number(\n            toMs(\n              authConfigs?.jwt?.expiresIn ||\n                (process.env.JWT_EXPIRES_IN as MsDuration) ||\n                (arkosEnv.JWT_EXPIRES_IN as MsDuration)\n            )\n          )\n      ),\n      httpOnly:\n        authConfigs?.jwt?.cookie?.httpOnly ??\n        (process.env.JWT_COOKIE_HTTP_ONLY !== undefined\n          ? process.env.JWT_COOKIE_HTTP_ONLY === \"true\"\n          : undefined) ??\n        true,\n      secure: (() => {\n        if (authConfigs?.jwt?.cookie?.secure !== undefined)\n          return authConfigs?.jwt?.cookie?.secure;\n        else if (process.env.JWT_COOKIE_SECURE !== undefined)\n          return process.env.JWT_COOKIE_SECURE === \"true\";\n        else return req.secure || req.headers[\"x-forwarded-proto\"] === \"https\";\n      })(),\n      sameSite,\n      domain: authConfigs?.jwt?.cookie?.domain || process.env.JWT_COOKIE_DOMAIN,\n      ...arkosConfig?.authentication?.jwt?.cookie,\n    } as CookieOptions;\n  }\n\n  /**\n   * Is used by default internally by Arkos under `BaseService` class to check if the password is already hashed.\n   *\n   * This was just added to prevent unwanted errors when someone just forgets that the `BaseService` class will automatically hash the password field using `authService.hashPassword` by default.\n   *\n   * So now before `BaseService` hashes it will test it.\n   *\n   *\n   * @param password The password to be tested if is hashed\n   * @returns\n   */\n  isPasswordHashed(password: string) {\n    return !Number.isNaN(bcrypt.getRounds(password) * 1);\n  }\n\n  /**\n   * Compares a candidate password with the stored user password to check if they match.\n   *\n   * @param {string} candidatePassword - The password provided by the user during login.\n   * @param {string} userPassword - The password stored in the database.\n   * @returns {Promise<boolean>} Returns true if the passwords match, otherwise false.\n   */\n  async isCorrectPassword(\n    candidatePassword: string,\n    userPassword: string\n  ): Promise<boolean> {\n    return await bcrypt.compare(candidatePassword, userPassword);\n  }\n\n  /**\n   * Hashes a plain text password using bcrypt.\n   *\n   * @param {string} password - The password to be hashed.\n   * @returns {Promise<string>} Returns the hashed password.\n   */\n  async hashPassword(password: string): Promise<string> {\n    return await bcrypt.hash(password, 12);\n  }\n\n  /**\n   * Checks if a password is strong, requiring uppercase, lowercase, and numeric characters as the default.\n   *\n   * **NB**: You must pay attention when using custom validation with zod or class-validator, try to use the same regex always.\n   *\n   * **Note**: You can define it when calling arkos.init()\n   * ```ts\n   * arkos.init({\n   *  authentication: {\n   *    passwordValidation:{ regex: /your-desired-regex/, message: 'password must contain...'}\n   *  }\n   * })\n   * ```\n   *\n   * @param {string} password - The password to check.\n   * @returns {boolean} Returns true if the password meets the strength criteria, otherwise false.\n   */\n  public isPasswordStrong(password: string): boolean {\n    const initAuthConfigs = getArkosConfig()?.authentication;\n\n    const strongPasswordRegex =\n      initAuthConfigs?.passwordValidation?.regex ||\n      /^(?=.*[A-Z])(?=.*[a-z])(?=.*\\d).+$/;\n    return strongPasswordRegex.test(password);\n  }\n\n  /**\n   * Checks if a user has changed their password after the JWT was issued.\n   *\n   * @param {User} user - The user object containing the passwordChangedAt field.\n   * @param {number} JWTTimestamp - The timestamp when the JWT was issued.\n   * @returns {boolean} Returns true if the user changed their password after the JWT was issued, otherwise false.\n   */\n  userChangedPasswordAfter(user: User, JWTTimestamp: number): boolean {\n    if (user.passwordChangedAt) {\n      const convertedTimestamp = parseInt(\n        String(new Date(user.passwordChangedAt).getTime() / 1000),\n        10\n      );\n\n      return JWTTimestamp < convertedTimestamp;\n    }\n    return false;\n  }\n\n  /**\n   * Verifies the authenticity of a JWT token.\n   *\n   * @param {string} token - The JWT token to verify.\n   * @param {string} [secret] - The secret key used to verify the token. Defaults to environment variable `JWT_SECRET`.\n   * @returns {Promise<AuthJwtPayload>} Returns the decoded JWT payload if the token is valid.\n   * @throws {Error} Throws an error if the token is invalid or expired.\n   */\n  async verifyJwtToken(\n    token: string,\n    secret?: string\n  ): Promise<AuthJwtPayload> {\n    const { authentication: configs } = getArkosConfig();\n\n    if (\n      process.env.ARKOS_BUILD === \"true\" &&\n      !process.env.JWT_SECRET &&\n      !configs?.jwt?.secret\n    )\n      throw new AppError(\n        \"Missing JWT secret in production\",\n        500,\n        \"MissingJWTSecretInProduction\"\n      );\n\n    secret =\n      secret ||\n      configs?.jwt?.secret ||\n      process.env.JWT_SECRET ||\n      arkosEnv.JWT_SECRET;\n\n    return new Promise((resolve, reject) => {\n      jwt.verify(token, secret, (err, decoded) => {\n        if (err) reject(err);\n        else resolve(decoded as AuthJwtPayload);\n      });\n    });\n  }\n\n  private isWildcardAccess(config: AccessControlConfig): config is \"*\" {\n    return config === \"*\";\n  }\n\n  private isRoleList(config: AccessControlConfig): config is string[] {\n    return Array.isArray(config);\n  }\n\n  private isAccessRules(\n    config: AccessControlConfig\n  ): config is Partial<AccessControlRules> {\n    return (\n      typeof config === \"object\" && config !== null && !Array.isArray(config)\n    );\n  }\n\n  private normalizeRuleToRoles(\n    rule: string[] | DetailedAccessControlRule | \"*\" | undefined\n  ): string[] {\n    if (!rule) return [];\n    if (rule === \"*\") return [\"*\"];\n    if (Array.isArray(rule)) return rule;\n    return rule.roles === \"*\" ? [\"*\"] : (rule.roles ?? []);\n  }\n\n  private resolveAuthorizedRoles(\n    action: AccessAction,\n    accessControl: AccessControlConfig\n  ): string[] {\n    if (this.isWildcardAccess(accessControl)) return [\"*\"];\n    if (this.isRoleList(accessControl)) return accessControl;\n    if (this.isAccessRules(accessControl))\n      return this.normalizeRuleToRoles(accessControl[action]);\n    return [];\n  }\n\n  /**\n   * Checks if a user has permission for a specific action using static access control rules.\n   * Validates user roles against predefined access control configuration.\n   *\n   * @param user - The user object containing role or roles field\n   * @param action - The action being performed\n   * @param accessControl - Access control configuration (array of roles or object with action-role mappings)\n   * @returns True if user has permission, false otherwise\n   * @throws Error if user doesn't have role/roles field\n   */\n  protected checkStaticAccessControl(\n    user: User,\n    action: string,\n    accessControl: AccessControlConfig\n  ) {\n    if (!user?.role && !user.roles)\n      throw Error(\n        \"Validation Error: In order to use static authentication user needs at least role field or roles for multiple roles.\"\n      );\n\n    let authorizedRoles = this.resolveAuthorizedRoles(action, accessControl);\n\n    const userRoles = Array.isArray(user?.roles) ? user.roles : [user.role];\n\n    return (\n      authorizedRoles?.[0] === \"*\" ||\n      !!userRoles.some((role: string) => authorizedRoles.includes(role))\n    );\n  }\n\n  /**\n   * Checks if a user has permission for a specific action and resource using dynamic access control.\n   * Queries the database to verify user's role permissions.\n   *\n   * @param userId - The unique identifier of the user\n   * @param action - The action being performed\n   * @param resource - The resource being accessed\n   * @returns Promise resolving to true if user has permission, false otherwise\n   */\n  protected async checkDynamicAccessControl(\n    userId: string,\n    action: string,\n    resource: string\n  ) {\n    const prisma = getPrismaInstance();\n    return !!(await prisma.userRole.findFirst({\n      where: {\n        userId,\n        role: {\n          permissions: {\n            some: {\n              resource,\n              action,\n            },\n          },\n        },\n      },\n      select: { id: true },\n    }));\n  }\n\n  /**\n   * Middleware function to handle access control based on user roles and permissions.\n   *\n   * @param {AccessAction} action - The action being performed (e.g., create, update, delete, view).\n   * @param {string} resource - The resource name that the action is being performed on (e.g., \"User\", \"Post\").\n   * @param {AccessControlConfig} accessControl - The access control configuration.\n   * @returns {ArkosRequestHandler} The middleware function that checks if the user has permission to perform the action.\n   *\n   * @deprecated Will be removed on v2.0, use AuthService.authorize instead\n   */\n  handleAccessControl(\n    action: AccessAction,\n    resource: string,\n    accessControl?: AccessControlConfig\n  ): ArkosRequestHandler {\n    if (\n      !accessControl &&\n      appModules.some(\n        (appModule) => kebabCase(appModule) === kebabCase(resource)\n      )\n    )\n      accessControl = getModuleComponents(resource)?.authConfigs?.accessControl;\n\n    const authAction = authActionService.add(action, resource, accessControl);\n\n    return catchAsync(\n      async (req: ArkosRequest, _: ArkosResponse, next: ArkosNextFunction) => {\n        if (req.user) {\n          const user = req.user as User;\n          const configs = getArkosConfig();\n\n          if (user.isSuperUser) {\n            next();\n            return;\n          }\n\n          const notEnoughPermissionsError = new AppError(\n            authAction.errorMessage,\n            403,\n            \"NotEnoughPermissions\"\n          );\n\n          if (configs?.authentication?.mode === \"dynamic\") {\n            const hasPermission = await this.checkDynamicAccessControl(\n              user.id,\n              action,\n              resource\n            );\n\n            if (!hasPermission) return next(notEnoughPermissionsError);\n          } else if (configs?.authentication?.mode === \"static\") {\n            if (!accessControl) return next(notEnoughPermissionsError);\n\n            const hasPermission = this.checkStaticAccessControl(\n              user,\n              action,\n              accessControl\n            );\n\n            if (!hasPermission) return next(notEnoughPermissionsError);\n          }\n        }\n\n        next();\n      }\n    );\n  }\n\n  /**\n   * Processes the cookies or authoriation token and returns the user.\n   * @param req\n   * @returns {Promise<User | null>} - if authentication is turned off in arkosConfig it returns null\n   * @throws {AppError} Throws an error if the token is invalid or the user is not logged in.\n   */\n  async getAuthenticatedUser(req: ArkosRequest): Promise<User | null> {\n    if (!isAuthenticationEnabled())\n      throw Error(\n        \"ValidationError: Trying to call AuthService.getAuthenticatedUser without setting up authentication\"\n      );\n\n    const prisma = getPrismaInstance();\n\n    let token: string | undefined;\n\n    if (\n      req?.headers?.authorization &&\n      req?.headers?.authorization.startsWith(\"Bearer\") &&\n      req?.headers?.authorization.split?.(\" \")?.[1]\n    )\n      token = req?.headers?.authorization.split(\" \")[1];\n\n    if (\n      !token &&\n      req?.cookies?.arkos_access_token !== \"no-token\" &&\n      req.cookies\n    ) {\n      token = req?.cookies?.arkos_access_token;\n    }\n\n    if (!token) return null;\n\n    let decoded: AuthJwtPayload | undefined;\n\n    try {\n      decoded = await this.verifyJwtToken(token);\n    } catch (err) {\n      throw invaliAuthTokenError;\n    }\n\n    if (!decoded?.id) throw invaliAuthTokenError;\n    const user: any | null = await (prisma as any).user.findUnique({\n      where: { id: String(decoded.id) },\n    });\n\n    if (!user)\n      throw new AppError(\n        \"The user belonging to this token does no longer exists\",\n        401,\n        \"UserNoLongerExists\"\n      );\n\n    if (\n      this.userChangedPasswordAfter(user, decoded.iat!) &&\n      !req.path?.includes?.(\"logout\")\n    )\n      throw new AppError(\n        \"User recently changed password! Please log in again.\",\n        401,\n        \"PasswordChanged\"\n      );\n\n    req.accessToken = token;\n    return user;\n  }\n\n  /**\n   * Middleware to authenticate the request by extracting and verifying the JWT token and setting `req.user`.\n   *\n   * Runs `authentication.hooks.authenticate` before/after the authentication logic.\n   *\n   * Hook execution flow:\n   * - `before` hooks run first — call `ctx.skip()` to bypass core logic and jump to `after` hooks,\n   *   call `ctx.next()` to stop the chain early, or return without calling anything to continue.\n   * - Core logic runs — extracts and verifies the JWT token, sets `req.user`.\n   * - `after` hooks run — call `ctx.next(err)` to abort or return without calling anything to continue.\n   * - `onError` hooks run if core logic throws — call `ctx.skip()` to suppress the error and jump to\n   *   `after` hooks, or call `ctx.next(err)` to forward it to the global error handler.\n   *\n   * On custom routes, hooks defined in `arkosConfig` still apply since they are baked into this method.\n   *\n   * @example\n   * ```ts\n   * // custom route - hooks still run\n   * router.get(\"/custom\", authService.authenticate, handler);\n   * ```\n   *\n   * @example\n   * ```ts\n   * // skip built-in auth from a before hook\n   * before: (ctx) => {\n   *   ctx.req.user = myCustomAuth(ctx.req);\n   *   ctx.skip();\n   * }\n   * ```\n   *\n   * @see {@link https://www.arkosjs.com/docs/core-concepts/authentication/hooks}\n   */\n  authenticate = catchAsync(\n    async (req: ArkosRequest, _: ArkosResponse, next: ArkosNextFunction) => {\n      const hooks = getArkosConfig()?.authentication?.hooks?.authenticate;\n\n      const before = await this.runHooks(hooks?.before, req);\n      if (before.error) {\n        const onError = await this.runErrorHooks(\n          hooks?.onError,\n          before.error,\n          req\n        );\n        if (onError.skipped) {\n          const after = await this.runAfterHooks(hooks?.after, req);\n          return after.error ? next(after.error) : next();\n        }\n        return next(onError.error);\n      }\n\n      if (!before.skipped) {\n        try {\n          if (isAuthenticationEnabled()) {\n            const user = (await this.getAuthenticatedUser(req)) as User;\n            if (!user) throw loginRequiredError;\n            req.user = user;\n          }\n        } catch (err) {\n          const onError = await this.runErrorHooks(hooks?.onError, err, req);\n          if (onError.skipped) {\n            const after = await this.runAfterHooks(hooks?.after, req);\n            return after.error ? next(after.error) : next();\n          }\n          return next(onError.error);\n        }\n      }\n\n      const after = await this.runAfterHooks(hooks?.after, req);\n      if (after.error) return next(after.error);\n\n      next();\n    }\n  );\n\n  /**\n   * Middleware to authorize the authenticated user for a given action on a resource.\n   *\n   * Runs `authentication.hooks.authorize` before/after the authorization logic.\n   *\n   * Hook execution flow:\n   * - `before` hooks run first — call `ctx.skip()` to bypass core logic and jump to `after` hooks,\n   *   call `ctx.next()` to stop the chain early, or return without calling anything to continue.\n   * - Core logic runs — checks user role/permissions against the access control rules.\n   * - `after` hooks run — call `ctx.next(err)` to abort or return without calling anything to continue.\n   * - `onError` hooks run if authorization fails — call `ctx.skip()` to suppress the error and jump to\n   *   `after` hooks, or call `ctx.next(err)` to forward it to the global error handler.\n   *\n   * @param resource - The resource being accessed, in kebabCase (e.g. `\"product\"`, `\"cart-item\"`)\n   * @param action - The action being performed (e.g. `\"View\"`, `\"Create\"`, `\"Delete\"`)\n   * @param rule - Access control rules for this action. Accepts a role list, a wildcard, or a `DetailedAccessControlRule`.\n   *\n   * @example\n   * ```ts\n   * router.delete(\"/products/:id\",\n   *   authService.authenticate,\n   *   authService.authorize(\"product\", \"Delete\", [\"admin\"]),\n   *   handler\n   * );\n   * ```\n   *\n   * @example\n   * ```ts\n   * // skip built-in authorization from a before hook\n   * before: (ctx) => {\n   *   ctx.req.user.role = myCustomRoleResolver(ctx.req);\n   *   ctx.skip();\n   * }\n   * ```\n   *\n   * @see {@link https://www.arkosjs.com/docs/core-concepts/authentication/hooks#authorize}\n   * @since v1.6.0-beta\n   */\n  authorize(\n    action: AccessAction,\n    resource: string,\n    rule?: string[] | DetailedAccessControlRule | \"*\"\n  ): ArkosRequestHandler {\n    const authAction = authActionService.add(action, resource, {\n      [action]: rule,\n    });\n\n    return catchAsync(\n      async (req: ArkosRequest, _: ArkosResponse, next: ArkosNextFunction) => {\n        const hooks = getArkosConfig()?.authentication?.hooks?.authorize;\n\n        const before = await this.runHooks(hooks?.before, req, {\n          action,\n          resource,\n          rule,\n        });\n        if (before.error) {\n          const onError = await this.runErrorHooks(\n            hooks?.onError,\n            before.error,\n            req,\n            { action, resource, rule }\n          );\n          if (onError.skipped) {\n            const after = await this.runAfterHooks(hooks?.after, req, {\n              action,\n              resource,\n              rule,\n            });\n            return after.error ? next(after.error) : next();\n          }\n          return next(onError.error);\n        }\n\n        if (!before.skipped) {\n          try {\n            if (req.user) {\n              const user = req.user as User;\n              const configs = getArkosConfig();\n\n              if (!user.isSuperUser) {\n                const notEnoughPermissionsError = new AppError(\n                  authAction.errorMessage,\n                  403,\n                  \"NotEnoughPermissions\"\n                );\n\n                if (configs?.authentication?.mode === \"dynamic\") {\n                  const hasPermission = await this.checkDynamicAccessControl(\n                    user.id,\n                    action,\n                    resource\n                  );\n                  if (!hasPermission) throw notEnoughPermissionsError;\n                } else if (configs?.authentication?.mode === \"static\") {\n                  const hasPermission = this.checkStaticAccessControl(\n                    user,\n                    action,\n                    { [action]: rule }\n                  );\n                  if (!hasPermission) throw notEnoughPermissionsError;\n                }\n              }\n            }\n          } catch (err) {\n            const onError = await this.runErrorHooks(hooks?.onError, err, req, {\n              action,\n              resource,\n              rule,\n            });\n            if (onError.skipped) {\n              const after = await this.runAfterHooks(hooks?.after, req, {\n                action,\n                resource,\n                rule,\n              });\n              return after.error ? next(after.error) : next();\n            }\n            return next(onError.error);\n          }\n        }\n\n        const after = await this.runAfterHooks(hooks?.after, req, {\n          action,\n          resource,\n          rule,\n        });\n        if (after.error) return next(after.error);\n\n        next();\n      }\n    );\n  }\n\n  /**\n   * Handles authentication control by checking the `authenticationControl` configuration in the `authConfigs`.\n   *\n   * @param {ControllerActions} action - The action being performed (e.g., create, update, delete, view).\n   * @param {AuthenticationControlConfig} authenticationControl - The authentication configuration object.\n   * @returns {ArkosRequestHandler} The middleware function that checks if authentication is required.\n   *\n   * @deprecated Will be removed on v2.0, use AuthService.authenticate instead\n   */\n  handleAuthenticationControl(\n    action: AccessAction,\n    authenticationControl?: AuthenticationControlConfig | undefined\n  ): ArkosRequestHandler {\n    if (authenticationControl && typeof authenticationControl === \"object\") {\n      if (authenticationControl[action] === false) return callNext;\n      else if (authenticationControl[action] === true) return this.authenticate;\n    } else return this.authenticate;\n\n    return this.authenticate;\n  }\n\n  /**\n   * Creates a permission checker function for a specific action and resource.\n   *\n   * PS: This method should be called during application initialization to build permission validators.\n   *\n   * @see {@link https://www.arkosjs.com/docs/advanced-guide/fine-grained-access-control}\n   *\n   * @param action - The action to check permission for (e.g., 'View', 'Create', 'Delete')\n   * @param resource - The resource being accessed, must be in kebabCase (e.g., 'user', 'cart-item', 'order')\n   * @param accessControl - Access control rules (required for static authentication mode), and it is automatically loaded for known modules such as all prisma models, auth and file-upload.\n   * @returns A function that takes a user object and returns a boolean indicating permission status\n   *\n   * @example\n   * ```typescript\n   * const hasViewProductPermission = await authService.permission('View', 'product');\n   *\n   * // Later in handler:\n   * const canAccess = await hasViewProductPermission(user);\n   * if (canAccess) {\n   *   // User has permission\n   * }\n   * ```\n   */\n  permission(\n    action: string,\n    resource: string,\n    accessControl?: AccessControlConfig\n  ) {\n    // Check if called during request handling (deep call stack indicates handler execution)\n    const stack = new Error().stack;\n\n    if (stack?.includes(\"node_modules/express/lib/router/index.js\"))\n      throw new Error(\n        \"authService.permission() should be called during application initialization level.\"\n      );\n\n    authActionService.add(action, resource, accessControl);\n\n    return async (user: User | undefined): Promise<boolean> => {\n      // getArkosConfig must not be called the same time as arkos.init()\n      const configs = getArkosConfig();\n\n      if (!isUsingAuthentication())\n        throw Error(\n          \"Validation Error: Trying to use authService.permission without setting up authentication.\"\n        );\n\n      if (!isAuthenticationEnabled()) return false;\n      if (!user) throw loginRequiredError;\n      if (user?.isSuperUser) return true;\n\n      if (configs?.authentication?.mode === \"dynamic\") {\n        return await this.checkDynamicAccessControl(user?.id, action, resource);\n      } else if (configs?.authentication?.mode === \"static\") {\n        if (!accessControl && appModules.includes(kebabCase(resource)))\n          accessControl = getModuleComponents(kebabCase(resource))?.authConfigs\n            ?.accessControl;\n\n        return (\n          !!accessControl &&\n          this.checkStaticAccessControl(user as any, action, accessControl)\n        );\n      }\n      return false;\n    };\n  }\n}\n\n/**\n * Handles various authentication-related tasks such as JWT signing, password hashing, and verifying user credentials.\n */\nconst authService = new AuthService();\n\nexport default authService;\n"]}

package/dist/cjs/modules/auth/utils/services/auth-action.service.js

@@ -12,7 +12,7 @@ class AuthActionService {
                 resource: "auth-action",
                 name: "View auth action",
                 description: "View an auth action",
-                errorMessage: "You do not have permission to perform this operation",
+                errorMessage: "You cannot perform view for auth action",
             },
         ];
     }
@@ -23,7 +23,7 @@ class AuthActionService {
             const inconsistencies = [];
             const defaultName = `${(0, text_helpers_1.capitalize)((0, utils_1.kebabCase)(action).replace(/-/g, " "))} ${(0, text_helpers_1.capitalize)((0, utils_1.kebabCase)(resource).replace(/-/g, " "))}`;
             const defaultDescription = `${(0, text_helpers_1.capitalize)((0, utils_1.kebabCase)(action).replace(/-/g, " "))} ${(0, text_helpers_1.capitalize)((0, utils_1.kebabCase)(resource).replace(/-/g, " "))}`;
-            const defaultErrorMessage = "You do not have permission to perform this operation";
+            const defaultErrorMessage = `You cannot perform ${(0, utils_1.sentenceCase)(action).toLowerCase()} for ${(0, utils_1.sentenceCase)(resource).toLowerCase()}`;
             const isNonDefault = (value, defaultValue) => {
                 return value !== undefined && value !== defaultValue;
             };
@@ -67,12 +67,14 @@ class AuthActionService {
             };
             this.remove(action, resource);
             this.authActions.push(merged);
+            return merged;
         }
         else {
             if (transformedAction.roles) {
                 transformedAction.roles = [...transformedAction.roles].sort();
             }
             this.authActions.push(transformedAction);
+            return transformedAction;
         }
     }
     remove(action, resource) {
@@ -100,7 +102,7 @@ class AuthActionService {
             resource,
             name: `${(0, text_helpers_1.capitalize)((0, utils_1.kebabCase)(action).replace(/-/g, " "))} ${(0, text_helpers_1.capitalize)((0, utils_1.kebabCase)(resource).replace(/-/g, " "))}`,
             description: `${(0, text_helpers_1.capitalize)((0, utils_1.kebabCase)(action).replace(/-/g, " "))} ${(0, text_helpers_1.capitalize)((0, utils_1.kebabCase)(resource).replace(/-/g, " "))}`,
-            errorMessage: `You do not have permission to perform this operation`,
+            errorMessage: `You cannot perform ${(0, utils_1.sentenceCase)(action).toLowerCase()} for ${(0, utils_1.sentenceCase)(resource).toLowerCase()}`,
         };
         const config = (0, arkos_config_helpers_1.getArkosConfig)();
         if (config?.authentication?.mode === "dynamic")

package/dist/cjs/modules/auth/utils/services/auth-action.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-action.service.js","sourceRoot":"","sources":["../../../../../../src/modules/auth/utils/services/auth-action.service.ts"],"names":[],"mappings":";;AAAA,qDAAsD;AAKtD,yFAAgF;AAChF,yEAAoE;AAWpE,MAAM,iBAAiB;IAAvB;QACE,gBAAW,GAAiB;YAC1B;gBACE,KAAK,EAAE,EAAE;gBACT,MAAM,EAAE,MAAM;gBACd,QAAQ,EAAE,aAAa;gBACvB,IAAI,EAAE,kBAAkB;gBACxB,WAAW,EAAE,qBAAqB;gBAClC,YAAY,EAAE,sDAAsD;aACrE;SACF,CAAC;IAoMJ,CAAC;IAlMC,GAAG,CAAC,MAAc,EAAE,QAAgB,EAAE,aAAmC;QACvE,MAAM,iBAAiB,GAAG,IAAI,CAAC,uCAAuC,CACpE,MAAM,EACN,QAAQ,EACR,aAAa,CACd,CAAC;QACF,MAAM,kBAAkB,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAEzD,IAAI,kBAAkB,EAAE,CAAC;YACvB,MAAM,eAAe,GAAa,EAAE,CAAC;YAErC,MAAM,WAAW,GAAG,GAAG,IAAA,yBAAU,EAAC,IAAA,iBAAS,EAAC,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,IAAA,yBAAU,EAAC,IAAA,iBAAS,EAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;YAChI,MAAM,kBAAkB,GAAG,GAAG,IAAA,yBAAU,EAAC,IAAA,iBAAS,EAAC,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,IAAA,yBAAU,EAAC,IAAA,iBAAS,EAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;YACvI,MAAM,mBAAmB,GACvB,sDAAsD,CAAC;YAEzD,MAAM,YAAY,GAAG,CACnB,KAAyB,EACzB,YAAoB,EACX,EAAE;gBACX,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,YAAY,CAAC;YACvD,CAAC,CAAC;YAEF,IACE,YAAY,CAAC,kBAAkB,CAAC,IAAI,EAAE,WAAW,CAAC;gBAClD,YAAY,CAAC,iBAAiB,CAAC,IAAI,EAAE,WAAW,CAAC;gBACjD,kBAAkB,CAAC,IAAI,KAAK,iBAAiB,CAAC,IAAI,EAClD,CAAC;gBACD,eAAe,CAAC,IAAI,CAClB,cAAc,kBAAkB,CAAC,IAAI,SAAS,iBAAiB,CAAC,IAAI,GAAG,CACxE,CAAC;YACJ,CAAC;YAED,IACE,YAAY,CAAC,kBAAkB,CAAC,WAAW,EAAE,kBAAkB,CAAC;gBAChE,YAAY,CAAC,iBAAiB,CAAC,WAAW,EAAE,kBAAkB,CAAC;gBAC/D,kBAAkB,CAAC,WAAW,KAAK,iBAAiB,CAAC,WAAW,EAChE,CAAC;gBACD,eAAe,CAAC,IAAI,CAClB,qBAAqB,kBAAkB,CAAC,WAAW,SAAS,iBAAiB,CAAC,WAAW,GAAG,CAC7F,CAAC;YACJ,CAAC;YAED,IACE,YAAY,CAAC,kBAAkB,CAAC,YAAY,EAAE,mBAAmB,CAAC;gBAClE,YAAY,CAAC,iBAAiB,CAAC,YAAY,EAAE,mBAAmB,CAAC;gBACjE,kBAAkB,CAAC,YAAY,KAAK,iBAAiB,CAAC,YAAY,EAClE,CAAC;gBACD,eAAe,CAAC,IAAI,CAClB,sBAAsB,kBAAkB,CAAC,YAAY,SAAS,iBAAiB,CAAC,YAAY,GAAG,CAChG,CAAC;YACJ,CAAC;YACD,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CACb,yCAAyC,MAAM,IAAI,QAAQ,KAAK;oBAC9D,gFAAgF;oBAChF,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;oBAC1B,yCAAyC,MAAM,IAAI,QAAQ,6DAA6D,CAC3H,CAAC;YACJ,CAAC;YAED,MAAM,WAAW,GACf,kBAAkB,CAAC,KAAK,IAAI,iBAAiB,CAAC,KAAK;gBACjD,CAAC,CAAC;oBACE,GAAG,CAAC,kBAAkB,CAAC,KAAK,IAAI,EAAE,CAAC;oBACnC,GAAG,CAAC,iBAAiB,CAAC,KAAK,IAAI,EAAE,CAAC;iBACnC;gBACH,CAAC,CAAC,SAAS,CAAC;YAEhB,MAAM,WAAW,GAAG,WAAW;gBAC7B,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE;gBAClC,CAAC,CAAC,SAAS,CAAC;YAEd,MAAM,MAAM,GAAe;gBACzB,MAAM,EAAE,kBAAkB,CAAC,MAAM;gBACjC,QAAQ,EAAE,kBAAkB,CAAC,QAAQ;gBACrC,KAAK,EAAE,WAAW;gBAClB,IAAI,EAAE,kBAAkB,CAAC,IAAI,IAAI,iBAAiB,CAAC,IAAI;gBACvD,WAAW,EACT,kBAAkB,CAAC,WAAW,IAAI,iBAAiB,CAAC,WAAW;gBACjE,YAAY,EACV,kBAAkB,CAAC,YAAY,IAAI,iBAAiB,CAAC,YAAY;aACpE,CAAC;YAEF,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC9B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;aAAM,CAAC;YACN,IAAI,iBAAiB,CAAC,KAAK,EAAE,CAAC;gBAC5B,iBAAiB,CAAC,KAAK,GAAG,CAAC,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;YAChE,CAAC;YACD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,MAAM,CAAC,MAAc,EAAE,QAAgB;QACrC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CACxC,CAAC,UAAU,EAAE,EAAE,CACb,CAAC,CAAC,UAAU,CAAC,MAAM,KAAK,MAAM,IAAI,UAAU,CAAC,QAAQ,KAAK,QAAQ,CAAC,CACtE,CAAC;IACJ,CAAC;IAED,MAAM;QACJ,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED,MAAM,CAAC,MAAc,EAAE,QAAgB;QACrC,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAC1B,CAAC,UAAU,EAAE,EAAE,CACb,UAAU,CAAC,MAAM,KAAK,MAAM,IAAI,UAAU,CAAC,QAAQ,KAAK,QAAQ,CACnE,CAAC;IACJ,CAAC;IAEO,uCAAuC,CAC7C,MAAc,EACd,QAAgB,EAChB,aAAmC;QAEnC,MAAM,cAAc,GAAe;YACjC,KAAK,EACH,CAAC,aAAa;gBACZ,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;oBAC3B,CAAC,CAAC,aAAa;oBACf,CAAC,CAAC,OAAO,aAAa,KAAK,QAAQ;wBACjC,CAAC,CAAC,CAAC,aAAa,CAAC;wBACjB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;4BAC5C,CAAC,CAAE,aAAa,CAAC,MAAM,CAAc;4BACrC,CAAC,CAAE,aAAa,CAAC,MAAM,CAA+B;gCAClD,EAAE,KAAK,CAAC,CAAC;gBACrB,EAAE;YACJ,MAAM;YACN,QAAQ;YACR,IAAI,EAAE,GAAG,IAAA,yBAAU,EAAC,IAAA,iBAAS,EAAC,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,IAAA,yBAAU,EAAC,IAAA,iBAAS,EAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,EAAE;YACjH,WAAW,EAAE,GAAG,IAAA,yBAAU,EAAC,IAAA,iBAAS,EAAC,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,IAAA,yBAAU,EAAC,IAAA,iBAAS,EAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,EAAE;YACxH,YAAY,EAAE,sDAAsD;SACrE,CAAC;QAEF,MAAM,MAAM,GAAG,IAAA,qCAAc,GAAE,CAAC;QAEhC,IAAI,MAAM,EAAE,cAAc,EAAE,IAAI,KAAK,SAAS;YAAE,OAAO,cAAc,CAAC,KAAK,CAAC;QAE5E,IAAI,CAAC,aAAa;YAAE,OAAO,cAAc,CAAC;QAE1C,IAAI,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;YAAE,OAAO,cAAc,CAAC;QAExD,MAAM,UAAU,GACb,aAAqB,KAAK,GAAG;YAC5B,CAAC,CAAE,aAAqB,CAAC,MAAM,CAAC;YAChC,CAAC,CAAC,SAAS,CAAC;QAEhB,IAAI,MAAM,EAAE,cAAc,EAAE,IAAI,KAAK,QAAQ;YAAE,OAAO,cAAc,CAAC,KAAK,CAAC;QAE3E,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC9B,OAAO,cAAc,CAAC;YACxB,CAAC;iBAAM,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;gBAC1C,OAAO;oBACL,GAAG,cAAc;oBACjB,IAAI,EAAE,UAAU,CAAC,IAAI,IAAI,cAAc,CAAC,IAAI;oBAC5C,WAAW,EAAE,UAAU,EAAE,WAAW,IAAI,cAAc,CAAC,WAAW;oBAClE,YAAY,EAAE,UAAU,EAAE,YAAY,IAAI,cAAc,CAAC,YAAY;iBACtE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,gBAAgB;QACd,OAAO;YACL,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;SACpE,CAAC;IACJ,CAAC;IAED,kBAAkB;QAChB,OAAO;YACL,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;SACtE,CAAC;IACJ,CAAC;IAED,aAAa,CAAC,QAAgB;QAC5B,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAC5B,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,KAAK,QAAQ,CACjD,CAAC;IACJ,CAAC;IAED,WAAW,CAAC,MAAc;QACxB,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAC5B,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,KAAK,MAAM,CAC7C,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,MAAc,EAAE,QAAgB;QACrC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACzC,CAAC;CACF;AAED,MAAM,iBAAiB,GAAG,IAAI,iBAAiB,EAAE,CAAC;AAElD,kBAAe,iBAAiB,CAAC","sourcesContent":["import { kebabCase } from \"../../../../exports/utils\";\nimport {\n  AccessControlConfig,\n  DetailedAccessControlRule,\n} from \"../../../../types/auth\";\nimport { getArkosConfig } from \"../../../../utils/helpers/arkos-config.helpers\";\nimport { capitalize } from \"../../../../utils/helpers/text.helpers\";\n\ninterface AuthAction {\n  roles?: string[] | \"*\";\n  action: string;\n  resource: string;\n  name?: string;\n  description?: string;\n  errorMessage?: string;\n}\n\nclass AuthActionService {\n  authActions: AuthAction[] = [\n    {\n      roles: [],\n      action: \"View\",\n      resource: \"auth-action\",\n      name: \"View auth action\",\n      description: \"View an auth action\",\n      errorMessage: \"You do not have permission to perform this operation\",\n    },\n  ];\n\n  add(action: string, resource: string, accessControl?: AccessControlConfig) {\n    const transformedAction = this.transformAccessControlToValidAuthAction(\n      action,\n      resource,\n      accessControl\n    );\n    const existingAuthAction = this.getOne(action, resource);\n\n    if (existingAuthAction) {\n      const inconsistencies: string[] = [];\n\n      const defaultName = `${capitalize(kebabCase(action).replace(/-/g, \" \"))} ${capitalize(kebabCase(resource).replace(/-/g, \" \"))}`;\n      const defaultDescription = `${capitalize(kebabCase(action).replace(/-/g, \" \"))} ${capitalize(kebabCase(resource).replace(/-/g, \" \"))}`;\n      const defaultErrorMessage =\n        \"You do not have permission to perform this operation\";\n\n      const isNonDefault = (\n        value: string | undefined,\n        defaultValue: string\n      ): boolean => {\n        return value !== undefined && value !== defaultValue;\n      };\n\n      if (\n        isNonDefault(existingAuthAction.name, defaultName) &&\n        isNonDefault(transformedAction.name, defaultName) &&\n        existingAuthAction.name !== transformedAction.name\n      ) {\n        inconsistencies.push(\n          `  - name: \"${existingAuthAction.name}\" vs \"${transformedAction.name}\"`\n        );\n      }\n\n      if (\n        isNonDefault(existingAuthAction.description, defaultDescription) &&\n        isNonDefault(transformedAction.description, defaultDescription) &&\n        existingAuthAction.description !== transformedAction.description\n      ) {\n        inconsistencies.push(\n          `  - description: \"${existingAuthAction.description}\" vs \"${transformedAction.description}\"`\n        );\n      }\n\n      if (\n        isNonDefault(existingAuthAction.errorMessage, defaultErrorMessage) &&\n        isNonDefault(transformedAction.errorMessage, defaultErrorMessage) &&\n        existingAuthAction.errorMessage !== transformedAction.errorMessage\n      ) {\n        inconsistencies.push(\n          `  - errorMessage: \"${existingAuthAction.errorMessage}\" vs \"${transformedAction.errorMessage}\"`\n        );\n      }\n      if (inconsistencies.length > 0) {\n        throw new Error(\n          `Inconsistent metadata for permission \"${action}:${resource}\". ` +\n            `The same action+resource combination is being defined with different values:\\n` +\n            inconsistencies.join(\"\\n\") +\n            `\\n\\nPlease ensure all definitions of \"${action}:${resource}\" have the same name, description, and errorMessage values.`\n        );\n      }\n\n      const mergedRoles =\n        existingAuthAction.roles || transformedAction.roles\n          ? [\n              ...(existingAuthAction.roles || []),\n              ...(transformedAction.roles || []),\n            ]\n          : undefined;\n\n      const uniqueRoles = mergedRoles\n        ? [...new Set(mergedRoles)].sort()\n        : undefined;\n\n      const merged: AuthAction = {\n        action: existingAuthAction.action,\n        resource: existingAuthAction.resource,\n        roles: uniqueRoles,\n        name: existingAuthAction.name ?? transformedAction.name,\n        description:\n          existingAuthAction.description ?? transformedAction.description,\n        errorMessage:\n          existingAuthAction.errorMessage ?? transformedAction.errorMessage,\n      };\n\n      this.remove(action, resource);\n      this.authActions.push(merged);\n    } else {\n      if (transformedAction.roles) {\n        transformedAction.roles = [...transformedAction.roles].sort();\n      }\n      this.authActions.push(transformedAction);\n    }\n  }\n\n  remove(action: string, resource: string) {\n    this.authActions = this.authActions.filter(\n      (authAction) =>\n        !(authAction.action === action && authAction.resource === resource)\n    );\n  }\n\n  getAll(): AuthAction[] {\n    return this.authActions;\n  }\n\n  getOne(action: string, resource: string): AuthAction | undefined {\n    return this.authActions.find(\n      (authAction) =>\n        authAction.action === action && authAction.resource === resource\n    );\n  }\n\n  private transformAccessControlToValidAuthAction(\n    action: string,\n    resource: string,\n    accessControl?: AccessControlConfig\n  ): AuthAction {\n    const baseAuthAction: AuthAction = {\n      roles:\n        (accessControl &&\n          (Array.isArray(accessControl)\n            ? accessControl\n            : typeof accessControl === \"string\"\n              ? [accessControl]\n              : Array.isArray(accessControl?.[action] || {})\n                ? (accessControl[action] as string[])\n                : (accessControl[action] as DetailedAccessControlRule)\n                    ?.roles)) ||\n        [],\n      action,\n      resource,\n      name: `${capitalize(kebabCase(action).replace(/-/g, \" \"))} ${capitalize(kebabCase(resource).replace(/-/g, \" \"))}`,\n      description: `${capitalize(kebabCase(action).replace(/-/g, \" \"))} ${capitalize(kebabCase(resource).replace(/-/g, \" \"))}`,\n      errorMessage: `You do not have permission to perform this operation`,\n    };\n\n    const config = getArkosConfig();\n\n    if (config?.authentication?.mode === \"dynamic\") delete baseAuthAction.roles;\n\n    if (!accessControl) return baseAuthAction;\n\n    if (Array.isArray(accessControl)) return baseAuthAction;\n\n    const actionRule =\n      (accessControl as any) !== \"*\"\n        ? (accessControl as any)[action]\n        : undefined;\n\n    if (config?.authentication?.mode !== \"static\") delete baseAuthAction.roles;\n\n    if (actionRule) {\n      if (Array.isArray(actionRule)) {\n        return baseAuthAction;\n      } else if (typeof actionRule === \"object\") {\n        return {\n          ...baseAuthAction,\n          name: actionRule.name || baseAuthAction.name,\n          description: actionRule?.description || baseAuthAction.description,\n          errorMessage: actionRule?.errorMessage || baseAuthAction.errorMessage,\n        };\n      }\n    }\n\n    return baseAuthAction;\n  }\n\n  getUniqueActions(): string[] {\n    return [\n      ...new Set(this.authActions.map((authAction) => authAction.action)),\n    ];\n  }\n\n  getUniqueResources(): string[] {\n    return [\n      ...new Set(this.authActions.map((authAction) => authAction.resource)),\n    ];\n  }\n\n  getByResource(resource: string): AuthAction[] | undefined {\n    return this.authActions.filter(\n      (authAction) => authAction.resource === resource\n    );\n  }\n\n  getByAction(action: string): AuthAction[] {\n    return this.authActions.filter(\n      (authAction) => authAction.action === action\n    );\n  }\n\n  exists(action: string, resource: string): boolean {\n    return !!this.getOne(action, resource);\n  }\n}\n\nconst authActionService = new AuthActionService();\n\nexport default authActionService;\n"]}
+{"version":3,"file":"auth-action.service.js","sourceRoot":"","sources":["../../../../../../src/modules/auth/utils/services/auth-action.service.ts"],"names":[],"mappings":";;AAAA,qDAAoE;AAKpE,yFAAgF;AAChF,yEAAoE;AAWpE,MAAM,iBAAiB;IAAvB;QACE,gBAAW,GAAiB;YAC1B;gBACE,KAAK,EAAE,EAAE;gBACT,MAAM,EAAE,MAAM;gBACd,QAAQ,EAAE,aAAa;gBACvB,IAAI,EAAE,kBAAkB;gBACxB,WAAW,EAAE,qBAAqB;gBAClC,YAAY,EAAE,yCAAyC;aACxD;SACF,CAAC;IA2MJ,CAAC;IAzMC,GAAG,CACD,MAAc,EACd,QAAgB,EAChB,aAAmC;QAEnC,MAAM,iBAAiB,GAAG,IAAI,CAAC,uCAAuC,CACpE,MAAM,EACN,QAAQ,EACR,aAAa,CACd,CAAC;QACF,MAAM,kBAAkB,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAEzD,IAAI,kBAAkB,EAAE,CAAC;YACvB,MAAM,eAAe,GAAa,EAAE,CAAC;YAErC,MAAM,WAAW,GAAG,GAAG,IAAA,yBAAU,EAAC,IAAA,iBAAS,EAAC,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,IAAA,yBAAU,EAAC,IAAA,iBAAS,EAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;YAChI,MAAM,kBAAkB,GAAG,GAAG,IAAA,yBAAU,EAAC,IAAA,iBAAS,EAAC,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,IAAA,yBAAU,EAAC,IAAA,iBAAS,EAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;YACvI,MAAM,mBAAmB,GAAG,sBAAsB,IAAA,oBAAY,EAAC,MAAM,CAAC,CAAC,WAAW,EAAE,QAAQ,IAAA,oBAAY,EAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YAEnI,MAAM,YAAY,GAAG,CACnB,KAAyB,EACzB,YAAoB,EACX,EAAE;gBACX,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,YAAY,CAAC;YACvD,CAAC,CAAC;YAEF,IACE,YAAY,CAAC,kBAAkB,CAAC,IAAI,EAAE,WAAW,CAAC;gBAClD,YAAY,CAAC,iBAAiB,CAAC,IAAI,EAAE,WAAW,CAAC;gBACjD,kBAAkB,CAAC,IAAI,KAAK,iBAAiB,CAAC,IAAI,EAClD,CAAC;gBACD,eAAe,CAAC,IAAI,CAClB,cAAc,kBAAkB,CAAC,IAAI,SAAS,iBAAiB,CAAC,IAAI,GAAG,CACxE,CAAC;YACJ,CAAC;YAED,IACE,YAAY,CAAC,kBAAkB,CAAC,WAAW,EAAE,kBAAkB,CAAC;gBAChE,YAAY,CAAC,iBAAiB,CAAC,WAAW,EAAE,kBAAkB,CAAC;gBAC/D,kBAAkB,CAAC,WAAW,KAAK,iBAAiB,CAAC,WAAW,EAChE,CAAC;gBACD,eAAe,CAAC,IAAI,CAClB,qBAAqB,kBAAkB,CAAC,WAAW,SAAS,iBAAiB,CAAC,WAAW,GAAG,CAC7F,CAAC;YACJ,CAAC;YAED,IACE,YAAY,CAAC,kBAAkB,CAAC,YAAY,EAAE,mBAAmB,CAAC;gBAClE,YAAY,CAAC,iBAAiB,CAAC,YAAY,EAAE,mBAAmB,CAAC;gBACjE,kBAAkB,CAAC,YAAY,KAAK,iBAAiB,CAAC,YAAY,EAClE,CAAC;gBACD,eAAe,CAAC,IAAI,CAClB,sBAAsB,kBAAkB,CAAC,YAAY,SAAS,iBAAiB,CAAC,YAAY,GAAG,CAChG,CAAC;YACJ,CAAC;YACD,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CACb,yCAAyC,MAAM,IAAI,QAAQ,KAAK;oBAC9D,gFAAgF;oBAChF,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;oBAC1B,yCAAyC,MAAM,IAAI,QAAQ,6DAA6D,CAC3H,CAAC;YACJ,CAAC;YAED,MAAM,WAAW,GACf,kBAAkB,CAAC,KAAK,IAAI,iBAAiB,CAAC,KAAK;gBACjD,CAAC,CAAC;oBACE,GAAG,CAAC,kBAAkB,CAAC,KAAK,IAAI,EAAE,CAAC;oBACnC,GAAG,CAAC,iBAAiB,CAAC,KAAK,IAAI,EAAE,CAAC;iBACnC;gBACH,CAAC,CAAC,SAAS,CAAC;YAEhB,MAAM,WAAW,GAAG,WAAW;gBAC7B,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE;gBAClC,CAAC,CAAC,SAAS,CAAC;YAEd,MAAM,MAAM,GAAyB;gBACnC,MAAM,EAAE,kBAAkB,CAAC,MAAM;gBACjC,QAAQ,EAAE,kBAAkB,CAAC,QAAQ;gBACrC,KAAK,EAAE,WAAW;gBAClB,IAAI,EAAE,kBAAkB,CAAC,IAAI,IAAI,iBAAiB,CAAC,IAAI;gBACvD,WAAW,EACT,kBAAkB,CAAC,WAAW,IAAI,iBAAiB,CAAC,WAAW;gBACjE,YAAY,EACV,kBAAkB,CAAC,YAAY,IAAI,iBAAiB,CAAC,YAAY;aAC7D,CAAC;YAET,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC9B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC9B,OAAO,MAAM,CAAC;QAChB,CAAC;aAAM,CAAC;YACN,IAAI,iBAAiB,CAAC,KAAK,EAAE,CAAC;gBAC5B,iBAAiB,CAAC,KAAK,GAAG,CAAC,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;YAChE,CAAC;YACD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YACzC,OAAO,iBAAiB,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,MAAM,CAAC,MAAc,EAAE,QAAgB;QACrC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CACxC,CAAC,UAAU,EAAE,EAAE,CACb,CAAC,CAAC,UAAU,CAAC,MAAM,KAAK,MAAM,IAAI,UAAU,CAAC,QAAQ,KAAK,QAAQ,CAAC,CACtE,CAAC;IACJ,CAAC;IAED,MAAM;QACJ,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED,MAAM,CAAC,MAAc,EAAE,QAAgB;QACrC,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAC1B,CAAC,UAAU,EAAE,EAAE,CACb,UAAU,CAAC,MAAM,KAAK,MAAM,IAAI,UAAU,CAAC,QAAQ,KAAK,QAAQ,CACnE,CAAC;IACJ,CAAC;IAEO,uCAAuC,CAC7C,MAAc,EACd,QAAgB,EAChB,aAAmC;QAEnC,MAAM,cAAc,GAAyB;YAC3C,KAAK,EACH,CAAC,aAAa;gBACZ,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;oBAC3B,CAAC,CAAC,aAAa;oBACf,CAAC,CAAC,OAAO,aAAa,KAAK,QAAQ;wBACjC,CAAC,CAAC,CAAC,aAAa,CAAC;wBACjB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;4BAC5C,CAAC,CAAE,aAAa,CAAC,MAAM,CAAc;4BACrC,CAAC,CAAE,aAAa,CAAC,MAAM,CAA+B;gCAClD,EAAE,KAAK,CAAC,CAAC;gBACrB,EAAE;YACJ,MAAM;YACN,QAAQ;YACR,IAAI,EAAE,GAAG,IAAA,yBAAU,EAAC,IAAA,iBAAS,EAAC,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,IAAA,yBAAU,EAAC,IAAA,iBAAS,EAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,EAAE;YACjH,WAAW,EAAE,GAAG,IAAA,yBAAU,EAAC,IAAA,iBAAS,EAAC,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,IAAA,yBAAU,EAAC,IAAA,iBAAS,EAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,EAAE;YACxH,YAAY,EAAE,sBAAsB,IAAA,oBAAY,EAAC,MAAM,CAAC,CAAC,WAAW,EAAE,QAAQ,IAAA,oBAAY,EAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,EAAE;SACrH,CAAC;QAEF,MAAM,MAAM,GAAG,IAAA,qCAAc,GAAE,CAAC;QAEhC,IAAI,MAAM,EAAE,cAAc,EAAE,IAAI,KAAK,SAAS;YAC5C,OAAQ,cAAsB,CAAC,KAAK,CAAC;QAEvC,IAAI,CAAC,aAAa;YAAE,OAAO,cAAc,CAAC;QAE1C,IAAI,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;YAAE,OAAO,cAAc,CAAC;QAExD,MAAM,UAAU,GACb,aAAqB,KAAK,GAAG;YAC5B,CAAC,CAAE,aAAqB,CAAC,MAAM,CAAC;YAChC,CAAC,CAAC,SAAS,CAAC;QAEhB,IAAI,MAAM,EAAE,cAAc,EAAE,IAAI,KAAK,QAAQ;YAC3C,OAAQ,cAAsB,CAAC,KAAK,CAAC;QAEvC,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC9B,OAAO,cAAc,CAAC;YACxB,CAAC;iBAAM,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;gBAC1C,OAAO;oBACL,GAAG,cAAc;oBACjB,IAAI,EAAE,UAAU,CAAC,IAAI,IAAI,cAAc,CAAC,IAAI;oBAC5C,WAAW,EAAE,UAAU,EAAE,WAAW,IAAI,cAAc,CAAC,WAAW;oBAClE,YAAY,EAAE,UAAU,EAAE,YAAY,IAAI,cAAc,CAAC,YAAY;iBACtE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,gBAAgB;QACd,OAAO;YACL,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;SACpE,CAAC;IACJ,CAAC;IAED,kBAAkB;QAChB,OAAO;YACL,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;SACtE,CAAC;IACJ,CAAC;IAED,aAAa,CAAC,QAAgB;QAC5B,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAC5B,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,KAAK,QAAQ,CACjD,CAAC;IACJ,CAAC;IAED,WAAW,CAAC,MAAc;QACxB,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAC5B,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,KAAK,MAAM,CAC7C,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,MAAc,EAAE,QAAgB;QACrC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACzC,CAAC;CACF;AAED,MAAM,iBAAiB,GAAG,IAAI,iBAAiB,EAAE,CAAC;AAElD,kBAAe,iBAAiB,CAAC","sourcesContent":["import { kebabCase, sentenceCase } from \"../../../../exports/utils\";\nimport {\n  AccessControlConfig,\n  DetailedAccessControlRule,\n} from \"../../../../types/auth\";\nimport { getArkosConfig } from \"../../../../utils/helpers/arkos-config.helpers\";\nimport { capitalize } from \"../../../../utils/helpers/text.helpers\";\n\ninterface AuthAction {\n  roles?: string[] | \"*\";\n  action: string;\n  resource: string;\n  name?: string;\n  description?: string;\n  errorMessage?: string;\n}\n\nclass AuthActionService {\n  authActions: AuthAction[] = [\n    {\n      roles: [],\n      action: \"View\",\n      resource: \"auth-action\",\n      name: \"View auth action\",\n      description: \"View an auth action\",\n      errorMessage: \"You cannot perform view for auth action\",\n    },\n  ];\n\n  add(\n    action: string,\n    resource: string,\n    accessControl?: AccessControlConfig\n  ): Required<AuthAction> {\n    const transformedAction = this.transformAccessControlToValidAuthAction(\n      action,\n      resource,\n      accessControl\n    );\n    const existingAuthAction = this.getOne(action, resource);\n\n    if (existingAuthAction) {\n      const inconsistencies: string[] = [];\n\n      const defaultName = `${capitalize(kebabCase(action).replace(/-/g, \" \"))} ${capitalize(kebabCase(resource).replace(/-/g, \" \"))}`;\n      const defaultDescription = `${capitalize(kebabCase(action).replace(/-/g, \" \"))} ${capitalize(kebabCase(resource).replace(/-/g, \" \"))}`;\n      const defaultErrorMessage = `You cannot perform ${sentenceCase(action).toLowerCase()} for ${sentenceCase(resource).toLowerCase()}`;\n\n      const isNonDefault = (\n        value: string | undefined,\n        defaultValue: string\n      ): boolean => {\n        return value !== undefined && value !== defaultValue;\n      };\n\n      if (\n        isNonDefault(existingAuthAction.name, defaultName) &&\n        isNonDefault(transformedAction.name, defaultName) &&\n        existingAuthAction.name !== transformedAction.name\n      ) {\n        inconsistencies.push(\n          `  - name: \"${existingAuthAction.name}\" vs \"${transformedAction.name}\"`\n        );\n      }\n\n      if (\n        isNonDefault(existingAuthAction.description, defaultDescription) &&\n        isNonDefault(transformedAction.description, defaultDescription) &&\n        existingAuthAction.description !== transformedAction.description\n      ) {\n        inconsistencies.push(\n          `  - description: \"${existingAuthAction.description}\" vs \"${transformedAction.description}\"`\n        );\n      }\n\n      if (\n        isNonDefault(existingAuthAction.errorMessage, defaultErrorMessage) &&\n        isNonDefault(transformedAction.errorMessage, defaultErrorMessage) &&\n        existingAuthAction.errorMessage !== transformedAction.errorMessage\n      ) {\n        inconsistencies.push(\n          `  - errorMessage: \"${existingAuthAction.errorMessage}\" vs \"${transformedAction.errorMessage}\"`\n        );\n      }\n      if (inconsistencies.length > 0) {\n        throw new Error(\n          `Inconsistent metadata for permission \"${action}:${resource}\". ` +\n            `The same action+resource combination is being defined with different values:\\n` +\n            inconsistencies.join(\"\\n\") +\n            `\\n\\nPlease ensure all definitions of \"${action}:${resource}\" have the same name, description, and errorMessage values.`\n        );\n      }\n\n      const mergedRoles =\n        existingAuthAction.roles || transformedAction.roles\n          ? [\n              ...(existingAuthAction.roles || []),\n              ...(transformedAction.roles || []),\n            ]\n          : undefined;\n\n      const uniqueRoles = mergedRoles\n        ? [...new Set(mergedRoles)].sort()\n        : undefined;\n\n      const merged: Required<AuthAction> = {\n        action: existingAuthAction.action,\n        resource: existingAuthAction.resource,\n        roles: uniqueRoles,\n        name: existingAuthAction.name ?? transformedAction.name,\n        description:\n          existingAuthAction.description ?? transformedAction.description,\n        errorMessage:\n          existingAuthAction.errorMessage ?? transformedAction.errorMessage,\n      } as any;\n\n      this.remove(action, resource);\n      this.authActions.push(merged);\n      return merged;\n    } else {\n      if (transformedAction.roles) {\n        transformedAction.roles = [...transformedAction.roles].sort();\n      }\n      this.authActions.push(transformedAction);\n      return transformedAction;\n    }\n  }\n\n  remove(action: string, resource: string) {\n    this.authActions = this.authActions.filter(\n      (authAction) =>\n        !(authAction.action === action && authAction.resource === resource)\n    );\n  }\n\n  getAll(): AuthAction[] {\n    return this.authActions;\n  }\n\n  getOne(action: string, resource: string): AuthAction | undefined {\n    return this.authActions.find(\n      (authAction) =>\n        authAction.action === action && authAction.resource === resource\n    );\n  }\n\n  private transformAccessControlToValidAuthAction(\n    action: string,\n    resource: string,\n    accessControl?: AccessControlConfig\n  ): Required<AuthAction> {\n    const baseAuthAction: Required<AuthAction> = {\n      roles:\n        (accessControl &&\n          (Array.isArray(accessControl)\n            ? accessControl\n            : typeof accessControl === \"string\"\n              ? [accessControl]\n              : Array.isArray(accessControl?.[action] || {})\n                ? (accessControl[action] as string[])\n                : (accessControl[action] as DetailedAccessControlRule)\n                    ?.roles)) ||\n        [],\n      action,\n      resource,\n      name: `${capitalize(kebabCase(action).replace(/-/g, \" \"))} ${capitalize(kebabCase(resource).replace(/-/g, \" \"))}`,\n      description: `${capitalize(kebabCase(action).replace(/-/g, \" \"))} ${capitalize(kebabCase(resource).replace(/-/g, \" \"))}`,\n      errorMessage: `You cannot perform ${sentenceCase(action).toLowerCase()} for ${sentenceCase(resource).toLowerCase()}`,\n    };\n\n    const config = getArkosConfig();\n\n    if (config?.authentication?.mode === \"dynamic\")\n      delete (baseAuthAction as any).roles;\n\n    if (!accessControl) return baseAuthAction;\n\n    if (Array.isArray(accessControl)) return baseAuthAction;\n\n    const actionRule =\n      (accessControl as any) !== \"*\"\n        ? (accessControl as any)[action]\n        : undefined;\n\n    if (config?.authentication?.mode !== \"static\")\n      delete (baseAuthAction as any).roles;\n\n    if (actionRule) {\n      if (Array.isArray(actionRule)) {\n        return baseAuthAction;\n      } else if (typeof actionRule === \"object\") {\n        return {\n          ...baseAuthAction,\n          name: actionRule.name || baseAuthAction.name,\n          description: actionRule?.description || baseAuthAction.description,\n          errorMessage: actionRule?.errorMessage || baseAuthAction.errorMessage,\n        };\n      }\n    }\n\n    return baseAuthAction;\n  }\n\n  getUniqueActions(): string[] {\n    return [\n      ...new Set(this.authActions.map((authAction) => authAction.action)),\n    ];\n  }\n\n  getUniqueResources(): string[] {\n    return [\n      ...new Set(this.authActions.map((authAction) => authAction.resource)),\n    ];\n  }\n\n  getByResource(resource: string): AuthAction[] | undefined {\n    return this.authActions.filter(\n      (authAction) => authAction.resource === resource\n    );\n  }\n\n  getByAction(action: string): AuthAction[] {\n    return this.authActions.filter(\n      (authAction) => authAction.action === action\n    );\n  }\n\n  exists(action: string, resource: string): boolean {\n    return !!this.getOne(action, resource);\n  }\n}\n\nconst authActionService = new AuthActionService();\n\nexport default authActionService;\n"]}

package/dist/cjs/modules/email/email.service.js

@@ -39,6 +39,7 @@ class EmailService {
             });
         }
         return {
+            ...emailConfigs,
             host,
             port: port || 465,
             secure: secure !== undefined ? secure : true,

package/dist/cjs/modules/email/email.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"email.service.js","sourceRoot":"","sources":["../../../../src/modules/email/email.service.ts"],"names":[],"mappings":";;;;;;AAAA,4DAAsE;AACtE,+CAAuC;AACvC,yCAA8C;AAC9C,iFAAwD;AAiCxD,MAAa,YAAY;IAUvB,YAAY,MAA8B;QAT1C,gBAAW,GAAuB,IAAI,CAAC;QAC/B,iBAAY,GAAiC,IAAI,CAAC;QASxD,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC;QAC7B,CAAC;IACH,CAAC;IAUO,cAAc;QACpB,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC,YAAY,CAAC;QAC3B,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,IAAA,uBAAc,GAAE,CAAC;QACjD,MAAM,IAAI,GAAG,YAAY,EAAE,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QAC1D,MAAM,IAAI,GACR,YAAY,EAAE,IAAI;YAClB,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC1E,MAAM,MAAM,GACV,YAAY,EAAE,MAAM,KAAK,SAAS;YAChC,CAAC,CAAC,YAAY,CAAC,MAAM;YACrB,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY;gBACxB,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,MAAM;gBACrC,CAAC,CAAC,SAAS,CAAC;QAClB,MAAM,IAAI,GAAG,YAAY,EAAE,IAAI,EAAE,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QAChE,MAAM,IAAI,GAAG,YAAY,EAAE,IAAI,EAAE,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QACpE,MAAM,IAAI,GAAG,YAAY,EAAE,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QAE1D,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,MAAM,IAAI,mBAAQ,CAChB,2EAA2E;gBACzE,6GAA6G,EAC/G,GAAG,EACH;gBACE,IAAI,EAAE,mFAAmF;aAC1F,CACF,CAAC;QACJ,CAAC;QAED,OAAO;YACL,IAAI;YACJ,IAAI,EAAE,IAAI,IAAI,GAAG;YACjB,MAAM,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;YAC5C,IAAI,EAAE;gBACJ,IAAI;gBACJ,IAAI;aACL;YACD,IAAI;SACL,CAAC;IACJ,CAAC;IAOO,cAAc,CAAC,YAAoC;QACzD,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,GAAG,YAAY,CAAC;YACzC,OAAO,oBAAU,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAC5C,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;YACxD,IAAI,CAAC,WAAW,GAAG,oBAAU,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAWM,KAAK,CAAC,IAAI,CACf,OAAuC,EACvC,iBAAyC,EACzC,mBAA4B,IAAI;QAEhC,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACrC,MAAM,WAAW,GAAG,iBAAiB;YACnC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAAC;YACxC,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;QAE1B,MAAM,WAAW,GACf,OAAO,CAAC,IAAI,IAAI,iBAAiB,EAAE,IAAI,EAAE,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC;QAErE,IAAI,iBAAiB,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3C,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAC7D,IAAI,CAAC,WAAW;gBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC;YACtC,GAAG,OAAO;YACV,IAAI,EAAE,WAAW;YACjB,IAAI,EACF,OAAO,EAAE,IAAI;gBACb,CAAC,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI;oBAC/C,CAAC,CAAC,IAAA,sBAAO,EAAC,OAAO,CAAC,IAAc,CAAC;oBACjC,CAAC,CAAC,SAAS,CAAC;SACjB,CAAC,CAAC;QAEH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;IACpC,CAAC;IAOM,KAAK,CAAC,gBAAgB,CAC3B,mBAAiC;QAEjC,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,mBAAmB,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACjE,MAAM,WAAW,CAAC,MAAM,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;YACvD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAMM,YAAY,CAAC,MAA6B;QAC/C,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC;QAC3B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IAC1B,CAAC;IAOM,MAAM,CAAC,MAAM,CAAC,MAA6B;QAChD,OAAO,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;CACF;AAhKD,oCAgKC;AAED,MAAM,YAAY,GAAG,IAAI,YAAY,EAAE,CAAC;AAExC,kBAAe,YAAY,CAAC","sourcesContent":["import nodemailer, { SendMailOptions, Transporter } from \"nodemailer\";\nimport { convert } from \"html-to-text\";\nimport { getArkosConfig } from \"../../server\";\nimport AppError from \"../error-handler/utils/app-error\";\n\n/**\n * Defines the options for sending an email.\n */\nexport type EmailOptions = {\n  subject: string;\n} & SendMailOptions;\n\n/**\n * Defines the authentication options for SMTP.\n */\nexport type SMTPAuthOptions = {\n  user: string;\n  pass: string;\n};\n\n/**\n * Defines the connection options for SMTP server.\n */\nexport type SMTPConnectionOptions = {\n  host?: string;\n  port?: number;\n  secure?: boolean;\n  auth?: SMTPAuthOptions;\n  name?: string;\n};\n\n/**\n * A service class to handle email-related tasks, including sending emails.\n *\n * See the api reference [www.arkosjs.com/docs/reference/the-email-service-class](https://www.arkosjs.com/docs/reference/the-email-service-class)\n */\nexport class EmailService {\n  transporter: Transporter | null = null;\n  private customConfig: SMTPConnectionOptions | null = null;\n\n  /**\n   * Creates an instance of the EmailService class.\n   *\n   * @param {SMTPConnectionOptions} [config] - Optional custom SMTP configuration.\n   * If provided, these settings will be used instead of the Arkos config.\n   */\n  constructor(config?: SMTPConnectionOptions) {\n    if (config) {\n      this.customConfig = config;\n    }\n  }\n\n  /**\n   * Gets the email configuration from multiple sources with priority:\n   * 1. Constructor customConfig\n   * 2. ArkosConfig\n   * 3. Environment variables\n   * @returns Configuration object with host, port, and auth details\n   * @throws AppError if required email configuration is not set\n   */\n  private getEmailConfig(): SMTPConnectionOptions {\n    if (this.customConfig) {\n      return this.customConfig;\n    }\n\n    const { email: emailConfigs } = getArkosConfig();\n    const host = emailConfigs?.host || process.env.EMAIL_HOST;\n    const port =\n      emailConfigs?.port ||\n      (process.env.EMAIL_PORT ? parseInt(process.env.EMAIL_PORT) : undefined);\n    const secure =\n      emailConfigs?.secure !== undefined\n        ? emailConfigs.secure\n        : process.env.EMAIL_SECURE\n          ? process.env.EMAIL_SECURE === \"true\"\n          : undefined;\n    const user = emailConfigs?.auth?.user || process.env.EMAIL_USER;\n    const pass = emailConfigs?.auth?.pass || process.env.EMAIL_PASSWORD;\n    const name = emailConfigs?.name || process.env.EMAIL_NAME;\n\n    if (!host || !user || !pass) {\n      throw new AppError(\n        \"You are trying to use emailService without setting email configurations. \" +\n          \"Please configure either arkosConfig.email or environment variables (EMAIL_HOST, EMAIL_USER, EMAIL_PASSWORD)\",\n        500,\n        {\n          docs: \"Read more about emailService at https://www.arkosjs.com/docs/guides/email-service\",\n        }\n      );\n    }\n\n    return {\n      host,\n      port: port || 465,\n      secure: secure !== undefined ? secure : true,\n      auth: {\n        user,\n        pass,\n      },\n      name,\n    };\n  }\n\n  /**\n   * Gets or creates a transporter using the email configuration\n   * @param customConfig Optional override connection settings (takes full priority if provided)\n   * @returns A configured nodemailer transporter\n   */\n  private getTransporter(customConfig?: SMTPConnectionOptions): Transporter {\n    if (customConfig) {\n      const { name, ...config } = customConfig;\n      return nodemailer.createTransport(config);\n    }\n\n    if (!this.transporter) {\n      const { name, ...config } = this.getEmailConfig() || {};\n      this.transporter = nodemailer.createTransport(config);\n    }\n    return this.transporter;\n  }\n\n  /**\n   * Sends an email with the provided options.\n   * Can use either the default configuration or custom connection options.\n   *\n   * @param {EmailOptions} options - The options for the email to be sent.\n   * @param {SMTPConnectionOptions} [connectionOptions] - Optional custom connection settings.\n   * @param {boolean} [skipVerification=false] - Whether to skip connection verification.\n   * @returns {Promise<{ success: boolean; messageId?: string } & Record<string, any>>} Result with message ID on success.\n   */\n  public async send(\n    options: EmailOptions & SendMailOptions,\n    connectionOptions?: SMTPConnectionOptions,\n    skipVerification: boolean = true\n  ): Promise<{ success: boolean; messageId?: string } & Record<string, any>> {\n    const config = this.getEmailConfig();\n    const transporter = connectionOptions\n      ? this.getTransporter(connectionOptions)\n      : this.getTransporter();\n\n    const fromAddress =\n      options.from || connectionOptions?.auth?.user || config.auth?.user;\n\n    if (connectionOptions || !skipVerification) {\n      const isConnected = await this.verifyConnection(transporter);\n      if (!isConnected) throw new Error(\"Failed to connect to email server\");\n    }\n\n    const info = await transporter.sendMail({\n      ...options,\n      from: fromAddress,\n      text:\n        options?.text ||\n        (typeof options.html === \"string\" && options.html\n          ? convert(options.html as string)\n          : undefined),\n    });\n\n    return { success: true, ...info };\n  }\n\n  /**\n   * Verifies the connection to the email server.\n   * @param {Transporter} [transporterToVerify] - Optional transporter to verify.\n   * @returns {Promise<boolean>} A promise that resolves to true if connection is valid.\n   */\n  public async verifyConnection(\n    transporterToVerify?: Transporter\n  ): Promise<boolean> {\n    try {\n      const transporter = transporterToVerify || this.getTransporter();\n      await transporter.verify();\n      return true;\n    } catch (error) {\n      console.error(\"Email Server Connection Failed\", error);\n      return false;\n    }\n  }\n\n  /**\n   * Updates the custom configuration for this email service instance.\n   * @param {SMTPConnectionOptions} config - The new connection options.\n   */\n  public updateConfig(config: SMTPConnectionOptions): void {\n    this.customConfig = config;\n    this.transporter = null; // Reset transporter so it will be recreated with new config\n  }\n\n  /**\n   * Creates a new instance of EmailService with custom configuration.\n   * @param {SMTPConnectionOptions} config - The connection options for the new instance.\n   * @returns {EmailService} A new EmailService instance.\n   */\n  public static create(config: SMTPConnectionOptions): EmailService {\n    return new EmailService(config);\n  }\n}\n\nconst emailService = new EmailService();\n\nexport default emailService;\n"]}
+{"version":3,"file":"email.service.js","sourceRoot":"","sources":["../../../../src/modules/email/email.service.ts"],"names":[],"mappings":";;;;;;AAAA,4DAAsE;AACtE,+CAAuC;AACvC,yCAA8C;AAC9C,iFAAwD;AAiCxD,MAAa,YAAY;IAUvB,YAAY,MAA8B;QAT1C,gBAAW,GAAuB,IAAI,CAAC;QAC/B,iBAAY,GAAiC,IAAI,CAAC;QASxD,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC;QAC7B,CAAC;IACH,CAAC;IAUO,cAAc;QACpB,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC,YAAY,CAAC;QAC3B,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,IAAA,uBAAc,GAAE,CAAC;QACjD,MAAM,IAAI,GAAG,YAAY,EAAE,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QAC1D,MAAM,IAAI,GACR,YAAY,EAAE,IAAI;YAClB,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC1E,MAAM,MAAM,GACV,YAAY,EAAE,MAAM,KAAK,SAAS;YAChC,CAAC,CAAC,YAAY,CAAC,MAAM;YACrB,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY;gBACxB,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,MAAM;gBACrC,CAAC,CAAC,SAAS,CAAC;QAClB,MAAM,IAAI,GAAG,YAAY,EAAE,IAAI,EAAE,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QAChE,MAAM,IAAI,GAAG,YAAY,EAAE,IAAI,EAAE,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QACpE,MAAM,IAAI,GAAG,YAAY,EAAE,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QAE1D,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,MAAM,IAAI,mBAAQ,CAChB,2EAA2E;gBACzE,6GAA6G,EAC/G,GAAG,EACH;gBACE,IAAI,EAAE,mFAAmF;aAC1F,CACF,CAAC;QACJ,CAAC;QAED,OAAO;YACL,GAAG,YAAY;YACf,IAAI;YACJ,IAAI,EAAE,IAAI,IAAI,GAAG;YACjB,MAAM,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;YAC5C,IAAI,EAAE;gBACJ,IAAI;gBACJ,IAAI;aACL;YACD,IAAI;SACL,CAAC;IACJ,CAAC;IAOO,cAAc,CAAC,YAAoC;QACzD,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,GAAG,YAAY,CAAC;YACzC,OAAO,oBAAU,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAC5C,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;YACxD,IAAI,CAAC,WAAW,GAAG,oBAAU,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAWM,KAAK,CAAC,IAAI,CACf,OAAuC,EACvC,iBAAyC,EACzC,mBAA4B,IAAI;QAEhC,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACrC,MAAM,WAAW,GAAG,iBAAiB;YACnC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAAC;YACxC,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;QAE1B,MAAM,WAAW,GACf,OAAO,CAAC,IAAI,IAAI,iBAAiB,EAAE,IAAI,EAAE,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC;QAErE,IAAI,iBAAiB,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3C,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAC7D,IAAI,CAAC,WAAW;gBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC;YACtC,GAAG,OAAO;YACV,IAAI,EAAE,WAAW;YACjB,IAAI,EACF,OAAO,EAAE,IAAI;gBACb,CAAC,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI;oBAC/C,CAAC,CAAC,IAAA,sBAAO,EAAC,OAAO,CAAC,IAAc,CAAC;oBACjC,CAAC,CAAC,SAAS,CAAC;SACjB,CAAC,CAAC;QAEH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;IACpC,CAAC;IAOM,KAAK,CAAC,gBAAgB,CAC3B,mBAAiC;QAEjC,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,mBAAmB,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACjE,MAAM,WAAW,CAAC,MAAM,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;YACvD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAMM,YAAY,CAAC,MAA6B;QAC/C,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC;QAC3B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IAC1B,CAAC;IAOM,MAAM,CAAC,MAAM,CAAC,MAA6B;QAChD,OAAO,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;CACF;AAjKD,oCAiKC;AAED,MAAM,YAAY,GAAG,IAAI,YAAY,EAAE,CAAC;AAExC,kBAAe,YAAY,CAAC","sourcesContent":["import nodemailer, { SendMailOptions, Transporter } from \"nodemailer\";\nimport { convert } from \"html-to-text\";\nimport { getArkosConfig } from \"../../server\";\nimport AppError from \"../error-handler/utils/app-error\";\n\n/**\n * Defines the options for sending an email.\n */\nexport type EmailOptions = {\n  subject: string;\n} & SendMailOptions;\n\n/**\n * Defines the authentication options for SMTP.\n */\nexport type SMTPAuthOptions = {\n  user: string;\n  pass: string;\n};\n\n/**\n * Defines the connection options for SMTP server.\n */\nexport type SMTPConnectionOptions = {\n  host?: string;\n  port?: number;\n  secure?: boolean;\n  auth?: SMTPAuthOptions;\n  name?: string;\n};\n\n/**\n * A service class to handle email-related tasks, including sending emails.\n *\n * See the api reference [www.arkosjs.com/docs/reference/the-email-service-class](https://www.arkosjs.com/docs/reference/the-email-service-class)\n */\nexport class EmailService {\n  transporter: Transporter | null = null;\n  private customConfig: SMTPConnectionOptions | null = null;\n\n  /**\n   * Creates an instance of the EmailService class.\n   *\n   * @param {SMTPConnectionOptions} [config] - Optional custom SMTP configuration.\n   * If provided, these settings will be used instead of the Arkos config.\n   */\n  constructor(config?: SMTPConnectionOptions) {\n    if (config) {\n      this.customConfig = config;\n    }\n  }\n\n  /**\n   * Gets the email configuration from multiple sources with priority:\n   * 1. Constructor customConfig\n   * 2. ArkosConfig\n   * 3. Environment variables\n   * @returns Configuration object with host, port, and auth details\n   * @throws AppError if required email configuration is not set\n   */\n  private getEmailConfig(): SMTPConnectionOptions {\n    if (this.customConfig) {\n      return this.customConfig;\n    }\n\n    const { email: emailConfigs } = getArkosConfig();\n    const host = emailConfigs?.host || process.env.EMAIL_HOST;\n    const port =\n      emailConfigs?.port ||\n      (process.env.EMAIL_PORT ? parseInt(process.env.EMAIL_PORT) : undefined);\n    const secure =\n      emailConfigs?.secure !== undefined\n        ? emailConfigs.secure\n        : process.env.EMAIL_SECURE\n          ? process.env.EMAIL_SECURE === \"true\"\n          : undefined;\n    const user = emailConfigs?.auth?.user || process.env.EMAIL_USER;\n    const pass = emailConfigs?.auth?.pass || process.env.EMAIL_PASSWORD;\n    const name = emailConfigs?.name || process.env.EMAIL_NAME;\n\n    if (!host || !user || !pass) {\n      throw new AppError(\n        \"You are trying to use emailService without setting email configurations. \" +\n          \"Please configure either arkosConfig.email or environment variables (EMAIL_HOST, EMAIL_USER, EMAIL_PASSWORD)\",\n        500,\n        {\n          docs: \"Read more about emailService at https://www.arkosjs.com/docs/guides/email-service\",\n        }\n      );\n    }\n\n    return {\n      ...emailConfigs,\n      host,\n      port: port || 465,\n      secure: secure !== undefined ? secure : true,\n      auth: {\n        user,\n        pass,\n      },\n      name,\n    };\n  }\n\n  /**\n   * Gets or creates a transporter using the email configuration\n   * @param customConfig Optional override connection settings (takes full priority if provided)\n   * @returns A configured nodemailer transporter\n   */\n  private getTransporter(customConfig?: SMTPConnectionOptions): Transporter {\n    if (customConfig) {\n      const { name, ...config } = customConfig;\n      return nodemailer.createTransport(config);\n    }\n\n    if (!this.transporter) {\n      const { name, ...config } = this.getEmailConfig() || {};\n      this.transporter = nodemailer.createTransport(config);\n    }\n    return this.transporter;\n  }\n\n  /**\n   * Sends an email with the provided options.\n   * Can use either the default configuration or custom connection options.\n   *\n   * @param {EmailOptions} options - The options for the email to be sent.\n   * @param {SMTPConnectionOptions} [connectionOptions] - Optional custom connection settings.\n   * @param {boolean} [skipVerification=false] - Whether to skip connection verification.\n   * @returns {Promise<{ success: boolean; messageId?: string } & Record<string, any>>} Result with message ID on success.\n   */\n  public async send(\n    options: EmailOptions & SendMailOptions,\n    connectionOptions?: SMTPConnectionOptions,\n    skipVerification: boolean = true\n  ): Promise<{ success: boolean; messageId?: string } & Record<string, any>> {\n    const config = this.getEmailConfig();\n    const transporter = connectionOptions\n      ? this.getTransporter(connectionOptions)\n      : this.getTransporter();\n\n    const fromAddress =\n      options.from || connectionOptions?.auth?.user || config.auth?.user;\n\n    if (connectionOptions || !skipVerification) {\n      const isConnected = await this.verifyConnection(transporter);\n      if (!isConnected) throw new Error(\"Failed to connect to email server\");\n    }\n\n    const info = await transporter.sendMail({\n      ...options,\n      from: fromAddress,\n      text:\n        options?.text ||\n        (typeof options.html === \"string\" && options.html\n          ? convert(options.html as string)\n          : undefined),\n    });\n\n    return { success: true, ...info };\n  }\n\n  /**\n   * Verifies the connection to the email server.\n   * @param {Transporter} [transporterToVerify] - Optional transporter to verify.\n   * @returns {Promise<boolean>} A promise that resolves to true if connection is valid.\n   */\n  public async verifyConnection(\n    transporterToVerify?: Transporter\n  ): Promise<boolean> {\n    try {\n      const transporter = transporterToVerify || this.getTransporter();\n      await transporter.verify();\n      return true;\n    } catch (error) {\n      console.error(\"Email Server Connection Failed\", error);\n      return false;\n    }\n  }\n\n  /**\n   * Updates the custom configuration for this email service instance.\n   * @param {SMTPConnectionOptions} config - The new connection options.\n   */\n  public updateConfig(config: SMTPConnectionOptions): void {\n    this.customConfig = config;\n    this.transporter = null; // Reset transporter so it will be recreated with new config\n  }\n\n  /**\n   * Creates a new instance of EmailService with custom configuration.\n   * @param {SMTPConnectionOptions} config - The connection options for the new instance.\n   * @returns {EmailService} A new EmailService instance.\n   */\n  public static create(config: SMTPConnectionOptions): EmailService {\n    return new EmailService(config);\n  }\n}\n\nconst emailService = new EmailService();\n\nexport default emailService;\n"]}

package/dist/cjs/modules/swagger/swagger.router.js

@@ -14,6 +14,7 @@ const deepmerge_helper_1 = __importDefault(require("../../utils/helpers/deepmerg
 const auth_service_1 = __importDefault(require("../auth/auth.service.js"));
 const app_error_1 = __importDefault(require("../error-handler/utils/app-error.js"));
 const get_open_api_login_html_1 = __importDefault(require("./utils/get-open-api-login-html.js"));
+const arkos_config_helpers_1 = require("../../utils/helpers/arkos-config.helpers.js");
 const swaggerRouter = (0, express_1.Router)();
 function getSwaggerRouter(arkosConfig, app) {
     const pathsFromCustomArkosRouters = (0, arkos_router_1.generateOpenAPIFromApp)(app);
@@ -22,7 +23,9 @@ function getSwaggerRouter(arkosConfig, app) {
         ...getSystemJsonSchemaPaths(),
     });
     const swaggerConfigs = (0, deepmerge_helper_1.default)(defaultSwaggerConfig, arkosConfig.swagger || {});
-    if (arkosConfig.swagger?.options?.definition?.servers && swaggerConfigs) {
+    if (arkosConfig.swagger?.options?.definition?.servers &&
+        swaggerConfigs &&
+        (0, arkos_config_helpers_1.isProduction)()) {
         swaggerConfigs.options.definition.servers =
             arkosConfig.swagger.options.definition.servers;
         swaggerConfigs.options.definition.servers.push(defaultSwaggerConfig.options.definition.servers[0]);

package/dist/cjs/modules/swagger/swagger.router.js.map

@@ -1 +1 @@
-{"version":3,"file":"swagger.router.js","sourceRoot":"","sources":["../../../../src/modules/swagger/swagger.router.ts"],"names":[],"mappings":";;;;;AAoBA,4CA8FC;AAED,4CA2BC;AA/ID,qCAAiC;AACjC,kEAAyC;AACzC,8GAAkF;AAClF,uEAAyF;AACzF,2DAAkE;AAOlE,4FAA6D;AAC7D,wEAA+C;AAC/C,iFAAwD;AACxD,8FAAkE;AAIlE,MAAM,aAAa,GAAG,IAAA,gBAAM,GAAE,CAAC;AAE/B,SAAgB,gBAAgB,CAAC,WAAwB,EAAE,GAAU;IACnE,MAAM,2BAA2B,GAAG,IAAA,qCAAsB,EAAC,GAAG,CAAC,CAAC;IAChE,MAAM,oBAAoB,GAAG,IAAA,qCAAuB,EAAC;QACnD,GAAG,2BAA2B;QAC9B,GAAG,wBAAwB,EAAE;KAC9B,CAAE,CAAC;IAEJ,MAAM,cAAc,GAAG,IAAA,0BAAS,EAC9B,oBAAoB,EACpB,WAAW,CAAC,OAAO,IAAI,EAAE,CACA,CAAC;IAE5B,IAAI,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,IAAI,cAAc,EAAE,CAAC;QACxE,cAAe,CAAC,OAAQ,CAAC,UAAW,CAAC,OAAO;YAC1C,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;QAEjD,cAAe,CAAC,OAAQ,CAAC,UAAW,CAAC,OAAO,CAAC,IAAI,CAC/C,oBAAoB,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CACnD,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,EAAE,GAAG,cAAc,EAAE,OAAQ,CAAC;IAC5D,MAAM,oBAAoB,GAAG,IAAA,uBAAY,EAAC;QACxC,UAAU,EAAE,UAA4C;QACxD,GAAG,OAAO;KACX,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,cAAe,CAAC,QAAS,CAAC;IAE3C,MAAM,WAAW,GAAG,WAAW,EAAE,OAAO,CAAC;IACzC,MAAM,YAAY,GAAG,WAAW,EAAE,YAAY,KAAK,KAAK,CAAC;IAEzD,IAAI,YAAY,EAAE,CAAC;QACjB,aAAa,CAAC,GAAG,CACf,QAAQ,EACR,CAAC,GAAiB,EAAE,CAAgB,EAAE,IAAuB,EAAE,EAAE;YAC/D,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,OAAO,IAAI,EAAE,CAAC;YAC9C,IAAI,CAAC,OAAO,CAAC,CAAC;QAChB,CAAC,CACF,CAAC;QAEF,aAAa,CAAC,GAAG,CACf,QAAQ,EACR,sBAAW,CAAC,YAAY,EACxB,CAAC,GAAiB,EAAE,CAAgB,EAAE,IAAuB,EAAE,EAAE;YAC/D,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW;gBACxB,OAAO,IAAI,CACT,IAAI,mBAAQ,CACV,8DAA8D,EAC9D,GAAG,EACH,mBAAmB,CACpB,CACF,CAAC;YACJ,IAAI,EAAE,CAAC;QACT,CAAC,EACD,CACE,GAAa,EACb,GAAiB,EACjB,GAAkB,EAClB,IAAuB,EACvB,EAAE;YACF,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,OAAO,IAAI,EAAE,CAAC;YAC9C,MAAM,OAAO,GAAG,kBAAkB,CAChC,GAAG,EAAE,OAAO,IAAI,0BAA0B,CAC3C,CAAC;YACF,OAAO,GAAG,CAAC,QAAQ,CACjB,GAAG,WAAW,CAAC,YAAY,GAAG,QAAQ,6BAA6B,OAAO,EAAE,CAC7E,CAAC;QACJ,CAAC,CACF,CAAC;IACJ,CAAC;IAED,aAAa,CAAC,GAAG,CACf,GAAG,QAAQ,aAAa,EACxB,CAAC,CAAe,EAAE,GAAkB,EAAE,EAAE;QACtC,GAAG,CAAC,IAAI,CAAC,IAAA,iCAAmB,GAAE,CAAC,CAAC;IAClC,CAAC,CACF,CAAC;IAEF,aAAa,CAAC,GAAG,CACf,GAAG,QAAQ,eAAe,EAC1B,CAAC,CAAe,EAAE,GAAkB,EAAE,EAAE;QACtC,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACjC,CAAC,CACF,CAAC;IAEF,IAAI,aAAa,GAAQ,IAAI,CAAC;IAE9B,aAAa,CAAC,GAAG,CACf,QAAQ,EACR,gBAAgB,CAAC,aAAa,EAAE,oBAAoB,EAAE,cAAc,CAAC,CACtE,CAAC;IAEF,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,SAAgB,gBAAgB,CAC9B,aAAkB,EAClB,oBAA4B,EAC5B,cAAmB;IAEnB,IAAI,aAAa,GAAyB,IAAI,CAAC;IAE/C,OAAO,KAAK,EACV,GAAiB,EACjB,GAAkB,EAClB,IAAuB,EACvB,EAAE;QACF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,aAAa,GAAG,IAAA,oDAAmC,EACjD,+BAA+B,CAChC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;oBAChB,aAAa,GAAG,MAAM,CAAC,YAAY,CAAC;wBAClC,OAAO,EAAE,oBAAoB;wBAC7B,GAAG,cAAc,EAAE,+BAA+B;qBACnD,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;YACL,CAAC;YACD,MAAM,aAAa,CAAC;QACtB,CAAC;QACD,OAAO,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB;IAC/B,MAAM,KAAK,GAA0B,EAAE,CAAC;IAExC,KAAK,CAAC,0BAA0B,CAAC,GAAG;QAClC,GAAG,EAAE;YACH,IAAI,EAAE,CAAC,QAAQ,CAAC;YAChB,OAAO,EAAE,yBAAyB;YAClC,WAAW,EACT,sEAAsE;YACxE,WAAW,EAAE,uBAAuB;YACpC,SAAS,EAAE;gBACT,KAAK,EAAE;oBACL,WAAW,EAAE,oDAAoD;oBACjE,OAAO,EAAE;wBACP,kBAAkB,EAAE;4BAClB,MAAM,EAAE;gCACN,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE;oCACV,IAAI,EAAE;wCACJ,IAAI,EAAE,OAAO;wCACb,KAAK,EAAE;4CACL,IAAI,EAAE,QAAQ;yCACf;wCACD,WAAW,EAAE,uCAAuC;qCACrD;iCACF;6BACF;yBACF;qBACF;iBACF;aACF;SACF;KACF,CAAC;IAEF,OAAO,KAAK,CAAC;AACf,CAAC","sourcesContent":["import { Router } from \"express\";\nimport swaggerJsdoc from \"swagger-jsdoc\";\nimport getSwaggerDefaultConfig from \"./utils/helpers/get-swagger-default-configs\";\nimport { importEsmPreventingTsTransformation } from \"../../utils/helpers/global.helpers\";\nimport { generateOpenAPIFromApp } from \"../../utils/arkos-router\";\nimport {\n  ArkosConfig,\n  ArkosNextFunction,\n  ArkosRequest,\n  ArkosResponse,\n} from \"../../exports\";\nimport deepmerge from \"../../utils/helpers/deepmerge.helper\";\nimport authService from \"../auth/auth.service\";\nimport AppError from \"../error-handler/utils/app-error\";\nimport getOpenApiLoginHtml from \"./utils/get-open-api-login-html\";\nimport { Arkos } from \"../../types/arkos\";\nimport { OpenAPIV3 } from \"openapi-types\";\n\nconst swaggerRouter = Router();\n\nexport function getSwaggerRouter(arkosConfig: ArkosConfig, app: Arkos): Router {\n  const pathsFromCustomArkosRouters = generateOpenAPIFromApp(app);\n  const defaultSwaggerConfig = getSwaggerDefaultConfig({\n    ...pathsFromCustomArkosRouters,\n    ...getSystemJsonSchemaPaths(),\n  })!;\n\n  const swaggerConfigs = deepmerge(\n    defaultSwaggerConfig,\n    arkosConfig.swagger || {}\n  ) as ArkosConfig[\"swagger\"];\n\n  if (arkosConfig.swagger?.options?.definition?.servers && swaggerConfigs) {\n    swaggerConfigs!.options!.definition!.servers =\n      arkosConfig.swagger.options.definition.servers;\n\n    swaggerConfigs!.options!.definition!.servers.push(\n      defaultSwaggerConfig.options.definition.servers[0]\n    );\n  }\n\n  const { definition, ...options } = swaggerConfigs?.options!;\n  const swaggerSpecification = swaggerJsdoc({\n    definition: definition as swaggerJsdoc.SwaggerDefinition,\n    ...options,\n  });\n\n  const endpoint = swaggerConfigs!.endpoint!;\n\n  const swaggerAuth = arkosConfig?.swagger;\n  const authenticate = swaggerAuth?.authenticate !== false;\n\n  if (authenticate) {\n    swaggerRouter.use(\n      endpoint,\n      (req: ArkosRequest, _: ArkosResponse, next: ArkosNextFunction) => {\n        if (req.path.includes(\"/auth\")) return next();\n        next(\"route\"); // skip to auth chain below\n      }\n    );\n\n    swaggerRouter.use(\n      endpoint,\n      authService.authenticate,\n      (req: ArkosRequest, _: ArkosResponse, next: ArkosNextFunction) => {\n        if (!req.user?.isSuperUser)\n          return next(\n            new AppError(\n              \"Only super users can access API documentation in production.\",\n              403,\n              \"SuperUserRequired\"\n            )\n          );\n        next();\n      },\n      (\n        err: AppError,\n        req: ArkosRequest,\n        res: ArkosResponse,\n        next: ArkosNextFunction\n      ) => {\n        if (req.path.includes(\"/auth\")) return next();\n        const message = encodeURIComponent(\n          err?.message || \"Authentication required.\"\n        );\n        return res.redirect(\n          `${arkosConfig.globalPrefix}${endpoint}/auth/login?error-message=${message}`\n        );\n      }\n    );\n  }\n\n  swaggerRouter.get(\n    `${endpoint}/auth/login`,\n    (_: ArkosRequest, res: ArkosResponse) => {\n      res.send(getOpenApiLoginHtml());\n    }\n  );\n\n  swaggerRouter.get(\n    `${endpoint}/openapi.json`,\n    (_: ArkosRequest, res: ArkosResponse) => {\n      res.json(swaggerSpecification);\n    }\n  );\n\n  let scalarHandler: any = null;\n\n  swaggerRouter.use(\n    endpoint,\n    scalarMiddleware(scalarHandler, swaggerSpecification, swaggerConfigs)\n  );\n\n  return swaggerRouter;\n}\n\nexport function scalarMiddleware(\n  scalarHandler: any,\n  swaggerSpecification: object,\n  swaggerConfigs: any\n) {\n  let scalarLoading: Promise<void> | null = null;\n\n  return async (\n    req: ArkosRequest,\n    res: ArkosResponse,\n    next: ArkosNextFunction\n  ) => {\n    if (!scalarHandler) {\n      if (!scalarLoading) {\n        scalarLoading = importEsmPreventingTsTransformation(\n          \"@scalar/express-api-reference\"\n        ).then((scalar) => {\n          scalarHandler = scalar.apiReference({\n            content: swaggerSpecification,\n            ...swaggerConfigs?.scalarApiReferenceConfiguration,\n          });\n        });\n      }\n      await scalarLoading;\n    }\n    return scalarHandler(req, res, next);\n  };\n}\n\nfunction getSystemJsonSchemaPaths() {\n  const paths: OpenAPIV3.PathsObject = {};\n\n  paths[\"/api/available-resources\"] = {\n    get: {\n      tags: [\"System\"],\n      summary: \"Get available resources\",\n      description:\n        \"Returns a comprehensive list of all available API resource endpoints\",\n      operationId: \"getAvailableResources\",\n      responses: {\n        \"200\": {\n          description: \"List of available resources retrieved successfully\",\n          content: {\n            \"application/json\": {\n              schema: {\n                type: \"object\",\n                properties: {\n                  data: {\n                    type: \"array\",\n                    items: {\n                      type: \"string\",\n                    },\n                    description: \"Array of available resource endpoints\",\n                  },\n                },\n              },\n            },\n          },\n        },\n      },\n    },\n  };\n\n  return paths;\n}\n"]}
+{"version":3,"file":"swagger.router.js","sourceRoot":"","sources":["../../../../src/modules/swagger/swagger.router.ts"],"names":[],"mappings":";;;;;AAqBA,4CAkGC;AAED,4CA2BC;AApJD,qCAAiC;AACjC,kEAAyC;AACzC,8GAAkF;AAClF,uEAAyF;AACzF,2DAAkE;AAOlE,4FAA6D;AAC7D,wEAA+C;AAC/C,iFAAwD;AACxD,8FAAkE;AAGlE,mFAAwE;AAExE,MAAM,aAAa,GAAG,IAAA,gBAAM,GAAE,CAAC;AAE/B,SAAgB,gBAAgB,CAAC,WAAwB,EAAE,GAAU;IACnE,MAAM,2BAA2B,GAAG,IAAA,qCAAsB,EAAC,GAAG,CAAC,CAAC;IAChE,MAAM,oBAAoB,GAAG,IAAA,qCAAuB,EAAC;QACnD,GAAG,2BAA2B;QAC9B,GAAG,wBAAwB,EAAE;KAC9B,CAAE,CAAC;IAEJ,MAAM,cAAc,GAAG,IAAA,0BAAS,EAC9B,oBAAoB,EACpB,WAAW,CAAC,OAAO,IAAI,EAAE,CACA,CAAC;IAE5B,IACE,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO;QACjD,cAAc;QACd,IAAA,mCAAY,GAAE,EACd,CAAC;QACD,cAAe,CAAC,OAAQ,CAAC,UAAW,CAAC,OAAO;YAC1C,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;QAEjD,cAAe,CAAC,OAAQ,CAAC,UAAW,CAAC,OAAO,CAAC,IAAI,CAC/C,oBAAoB,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CACnD,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,EAAE,GAAG,cAAc,EAAE,OAAQ,CAAC;IAC5D,MAAM,oBAAoB,GAAG,IAAA,uBAAY,EAAC;QACxC,UAAU,EAAE,UAA4C;QACxD,GAAG,OAAO;KACX,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,cAAe,CAAC,QAAS,CAAC;IAE3C,MAAM,WAAW,GAAG,WAAW,EAAE,OAAO,CAAC;IACzC,MAAM,YAAY,GAAG,WAAW,EAAE,YAAY,KAAK,KAAK,CAAC;IAEzD,IAAI,YAAY,EAAE,CAAC;QACjB,aAAa,CAAC,GAAG,CACf,QAAQ,EACR,CAAC,GAAiB,EAAE,CAAgB,EAAE,IAAuB,EAAE,EAAE;YAC/D,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,OAAO,IAAI,EAAE,CAAC;YAC9C,IAAI,CAAC,OAAO,CAAC,CAAC;QAChB,CAAC,CACF,CAAC;QAEF,aAAa,CAAC,GAAG,CACf,QAAQ,EACR,sBAAW,CAAC,YAAY,EACxB,CAAC,GAAiB,EAAE,CAAgB,EAAE,IAAuB,EAAE,EAAE;YAC/D,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW;gBACxB,OAAO,IAAI,CACT,IAAI,mBAAQ,CACV,8DAA8D,EAC9D,GAAG,EACH,mBAAmB,CACpB,CACF,CAAC;YACJ,IAAI,EAAE,CAAC;QACT,CAAC,EACD,CACE,GAAa,EACb,GAAiB,EACjB,GAAkB,EAClB,IAAuB,EACvB,EAAE;YACF,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,OAAO,IAAI,EAAE,CAAC;YAC9C,MAAM,OAAO,GAAG,kBAAkB,CAChC,GAAG,EAAE,OAAO,IAAI,0BAA0B,CAC3C,CAAC;YACF,OAAO,GAAG,CAAC,QAAQ,CACjB,GAAG,WAAW,CAAC,YAAY,GAAG,QAAQ,6BAA6B,OAAO,EAAE,CAC7E,CAAC;QACJ,CAAC,CACF,CAAC;IACJ,CAAC;IAED,aAAa,CAAC,GAAG,CACf,GAAG,QAAQ,aAAa,EACxB,CAAC,CAAe,EAAE,GAAkB,EAAE,EAAE;QACtC,GAAG,CAAC,IAAI,CAAC,IAAA,iCAAmB,GAAE,CAAC,CAAC;IAClC,CAAC,CACF,CAAC;IAEF,aAAa,CAAC,GAAG,CACf,GAAG,QAAQ,eAAe,EAC1B,CAAC,CAAe,EAAE,GAAkB,EAAE,EAAE;QACtC,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACjC,CAAC,CACF,CAAC;IAEF,IAAI,aAAa,GAAQ,IAAI,CAAC;IAE9B,aAAa,CAAC,GAAG,CACf,QAAQ,EACR,gBAAgB,CAAC,aAAa,EAAE,oBAAoB,EAAE,cAAc,CAAC,CACtE,CAAC;IAEF,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,SAAgB,gBAAgB,CAC9B,aAAkB,EAClB,oBAA4B,EAC5B,cAAmB;IAEnB,IAAI,aAAa,GAAyB,IAAI,CAAC;IAE/C,OAAO,KAAK,EACV,GAAiB,EACjB,GAAkB,EAClB,IAAuB,EACvB,EAAE;QACF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,aAAa,GAAG,IAAA,oDAAmC,EACjD,+BAA+B,CAChC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;oBAChB,aAAa,GAAG,MAAM,CAAC,YAAY,CAAC;wBAClC,OAAO,EAAE,oBAAoB;wBAC7B,GAAG,cAAc,EAAE,+BAA+B;qBACnD,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;YACL,CAAC;YACD,MAAM,aAAa,CAAC;QACtB,CAAC;QACD,OAAO,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB;IAC/B,MAAM,KAAK,GAA0B,EAAE,CAAC;IAExC,KAAK,CAAC,0BAA0B,CAAC,GAAG;QAClC,GAAG,EAAE;YACH,IAAI,EAAE,CAAC,QAAQ,CAAC;YAChB,OAAO,EAAE,yBAAyB;YAClC,WAAW,EACT,sEAAsE;YACxE,WAAW,EAAE,uBAAuB;YACpC,SAAS,EAAE;gBACT,KAAK,EAAE;oBACL,WAAW,EAAE,oDAAoD;oBACjE,OAAO,EAAE;wBACP,kBAAkB,EAAE;4BAClB,MAAM,EAAE;gCACN,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE;oCACV,IAAI,EAAE;wCACJ,IAAI,EAAE,OAAO;wCACb,KAAK,EAAE;4CACL,IAAI,EAAE,QAAQ;yCACf;wCACD,WAAW,EAAE,uCAAuC;qCACrD;iCACF;6BACF;yBACF;qBACF;iBACF;aACF;SACF;KACF,CAAC;IAEF,OAAO,KAAK,CAAC;AACf,CAAC","sourcesContent":["import { Router } from \"express\";\nimport swaggerJsdoc from \"swagger-jsdoc\";\nimport getSwaggerDefaultConfig from \"./utils/helpers/get-swagger-default-configs\";\nimport { importEsmPreventingTsTransformation } from \"../../utils/helpers/global.helpers\";\nimport { generateOpenAPIFromApp } from \"../../utils/arkos-router\";\nimport {\n  ArkosConfig,\n  ArkosNextFunction,\n  ArkosRequest,\n  ArkosResponse,\n} from \"../../exports\";\nimport deepmerge from \"../../utils/helpers/deepmerge.helper\";\nimport authService from \"../auth/auth.service\";\nimport AppError from \"../error-handler/utils/app-error\";\nimport getOpenApiLoginHtml from \"./utils/get-open-api-login-html\";\nimport { Arkos } from \"../../types/arkos\";\nimport { OpenAPIV3 } from \"openapi-types\";\nimport { isProduction } from \"../../utils/helpers/arkos-config.helpers\";\n\nconst swaggerRouter = Router();\n\nexport function getSwaggerRouter(arkosConfig: ArkosConfig, app: Arkos): Router {\n  const pathsFromCustomArkosRouters = generateOpenAPIFromApp(app);\n  const defaultSwaggerConfig = getSwaggerDefaultConfig({\n    ...pathsFromCustomArkosRouters,\n    ...getSystemJsonSchemaPaths(),\n  })!;\n\n  const swaggerConfigs = deepmerge(\n    defaultSwaggerConfig,\n    arkosConfig.swagger || {}\n  ) as ArkosConfig[\"swagger\"];\n\n  if (\n    arkosConfig.swagger?.options?.definition?.servers &&\n    swaggerConfigs &&\n    isProduction()\n  ) {\n    swaggerConfigs!.options!.definition!.servers =\n      arkosConfig.swagger.options.definition.servers;\n\n    swaggerConfigs!.options!.definition!.servers.push(\n      defaultSwaggerConfig.options.definition.servers[0]\n    );\n  }\n\n  const { definition, ...options } = swaggerConfigs?.options!;\n  const swaggerSpecification = swaggerJsdoc({\n    definition: definition as swaggerJsdoc.SwaggerDefinition,\n    ...options,\n  });\n\n  const endpoint = swaggerConfigs!.endpoint!;\n\n  const swaggerAuth = arkosConfig?.swagger;\n  const authenticate = swaggerAuth?.authenticate !== false;\n\n  if (authenticate) {\n    swaggerRouter.use(\n      endpoint,\n      (req: ArkosRequest, _: ArkosResponse, next: ArkosNextFunction) => {\n        if (req.path.includes(\"/auth\")) return next();\n        next(\"route\"); // skip to auth chain below\n      }\n    );\n\n    swaggerRouter.use(\n      endpoint,\n      authService.authenticate,\n      (req: ArkosRequest, _: ArkosResponse, next: ArkosNextFunction) => {\n        if (!req.user?.isSuperUser)\n          return next(\n            new AppError(\n              \"Only super users can access API documentation in production.\",\n              403,\n              \"SuperUserRequired\"\n            )\n          );\n        next();\n      },\n      (\n        err: AppError,\n        req: ArkosRequest,\n        res: ArkosResponse,\n        next: ArkosNextFunction\n      ) => {\n        if (req.path.includes(\"/auth\")) return next();\n        const message = encodeURIComponent(\n          err?.message || \"Authentication required.\"\n        );\n        return res.redirect(\n          `${arkosConfig.globalPrefix}${endpoint}/auth/login?error-message=${message}`\n        );\n      }\n    );\n  }\n\n  swaggerRouter.get(\n    `${endpoint}/auth/login`,\n    (_: ArkosRequest, res: ArkosResponse) => {\n      res.send(getOpenApiLoginHtml());\n    }\n  );\n\n  swaggerRouter.get(\n    `${endpoint}/openapi.json`,\n    (_: ArkosRequest, res: ArkosResponse) => {\n      res.json(swaggerSpecification);\n    }\n  );\n\n  let scalarHandler: any = null;\n\n  swaggerRouter.use(\n    endpoint,\n    scalarMiddleware(scalarHandler, swaggerSpecification, swaggerConfigs)\n  );\n\n  return swaggerRouter;\n}\n\nexport function scalarMiddleware(\n  scalarHandler: any,\n  swaggerSpecification: object,\n  swaggerConfigs: any\n) {\n  let scalarLoading: Promise<void> | null = null;\n\n  return async (\n    req: ArkosRequest,\n    res: ArkosResponse,\n    next: ArkosNextFunction\n  ) => {\n    if (!scalarHandler) {\n      if (!scalarLoading) {\n        scalarLoading = importEsmPreventingTsTransformation(\n          \"@scalar/express-api-reference\"\n        ).then((scalar) => {\n          scalarHandler = scalar.apiReference({\n            content: swaggerSpecification,\n            ...swaggerConfigs?.scalarApiReferenceConfiguration,\n          });\n        });\n      }\n      await scalarLoading;\n    }\n    return scalarHandler(req, res, next);\n  };\n}\n\nfunction getSystemJsonSchemaPaths() {\n  const paths: OpenAPIV3.PathsObject = {};\n\n  paths[\"/api/available-resources\"] = {\n    get: {\n      tags: [\"System\"],\n      summary: \"Get available resources\",\n      description:\n        \"Returns a comprehensive list of all available API resource endpoints\",\n      operationId: \"getAvailableResources\",\n      responses: {\n        \"200\": {\n          description: \"List of available resources retrieved successfully\",\n          content: {\n            \"application/json\": {\n              schema: {\n                type: \"object\",\n                properties: {\n                  data: {\n                    type: \"array\",\n                    items: {\n                      type: \"string\",\n                    },\n                    description: \"Array of available resource endpoints\",\n                  },\n                },\n              },\n            },\n          },\n        },\n      },\n    },\n  };\n\n  return paths;\n}\n"]}