@10x-media/impersonation 0.1.0-beta.0

package/dist/auth/tenantCookie.js

@@ -0,0 +1,74 @@
+import { expireCookie, writeCookie } from "./cookies.js";
+import { defaultClearOnSwitch } from "../plugin/constants.js";
+import { parseCookies } from "payload/shared";
+//#region src/auth/tenantCookie.ts
+/** Same charset Payload tenant ids use (ObjectId, int, uuid). Rejects cookie injection. */
+const TENANT_COOKIE_VALUE = /^[\w.-]{1,128}$/;
+const tenantCookieName = (cookiePrefix) => defaultClearOnSwitch(cookiePrefix)[0];
+const isManagedTenantCookie = (clearOnSwitch, cookiePrefix) => clearOnSwitch.includes(tenantCookieName(cookiePrefix));
+const clearOnSwitchWithoutTenant = (clearOnSwitch, cookiePrefix) => clearOnSwitch.filter((name) => name !== tenantCookieName(cookiePrefix));
+const readTenantCookie = (headers, cookiePrefix) => {
+	const raw = parseCookies(headers).get(tenantCookieName(cookiePrefix));
+	return raw && TENANT_COOKIE_VALUE.test(raw) ? raw : void 0;
+};
+const setTenantCookie = ({ authConfig, cookiePrefix, value }) => writeCookie({
+	authConfig,
+	httpOnly: false,
+	name: tenantCookieName(cookiePrefix),
+	value
+});
+const expireTenantCookie = ({ authConfig, cookiePrefix }) => expireCookie({
+	authConfig,
+	httpOnly: false,
+	name: tenantCookieName(cookiePrefix)
+});
+const idsFrom = (value) => {
+	if (value == null) return [];
+	if (Array.isArray(value)) return value.flatMap(idsFrom);
+	if (typeof value === "string" || typeof value === "number") {
+		const id = String(value);
+		return TENANT_COOKIE_VALUE.test(id) ? [id] : [];
+	}
+	if (typeof value === "object") {
+		if ("id" in value) return idsFrom(value.id);
+		if ("value" in value) return idsFrom(value.value);
+	}
+	return [];
+};
+/**
+* `@payloadcms/plugin-multi-tenant` puts assignments on `tenants` (hasMany) and
+* sometimes a single `tenant`. Only a unique readable id is safe to write as the selector.
+*/
+const uniqueAssignedTenantId = (user) => {
+	const ids = [...new Set([...idsFrom(user.tenants), ...idsFrom(user.tenant)])];
+	return ids.length === 1 ? ids[0] : void 0;
+};
+const startTenantCookies = ({ authConfig, cookiePrefix, mode, options, target }) => {
+	if (!isManagedTenantCookie(options.cookies.clearOnSwitch, cookiePrefix) || mode === "parallel") return [];
+	const assigned = uniqueAssignedTenantId(target);
+	if (assigned) return [setTenantCookie({
+		authConfig,
+		cookiePrefix,
+		value: assigned
+	})];
+	return [expireTenantCookie({
+		authConfig,
+		cookiePrefix
+	})];
+};
+const exitTenantCookies = ({ authConfig, cookiePrefix, mode, options, snapshot }) => {
+	if (!isManagedTenantCookie(options.cookies.clearOnSwitch, cookiePrefix) || mode === "parallel") return [];
+	if (snapshot && TENANT_COOKIE_VALUE.test(snapshot)) return [setTenantCookie({
+		authConfig,
+		cookiePrefix,
+		value: snapshot
+	})];
+	return [expireTenantCookie({
+		authConfig,
+		cookiePrefix
+	})];
+};
+//#endregion
+export { clearOnSwitchWithoutTenant, exitTenantCookies, readTenantCookie, startTenantCookies };
+
+//# sourceMappingURL=tenantCookie.js.map

package/dist/auth/tenantCookie.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenantCookie.js","names":[],"sources":["../../src/auth/tenantCookie.ts"],"sourcesContent":["import type { SanitizedCollectionConfig } from 'payload'\nimport { parseCookies } from 'payload/shared'\n\nimport { defaultClearOnSwitch } from '../plugin/constants'\nimport type { ImpersonationMode, ResolvedOptions } from '../types'\nimport { expireCookie, writeCookie } from './cookies'\n\ntype AuthConfig = SanitizedCollectionConfig['auth']\n\n/** Same charset Payload tenant ids use (ObjectId, int, uuid). Rejects cookie injection. */\nconst TENANT_COOKIE_VALUE = /^[\\w.-]{1,128}$/\n\nexport const tenantCookieName = (cookiePrefix: string): string =>\n\tdefaultClearOnSwitch(cookiePrefix)[0] as string\n\nexport const isManagedTenantCookie = (clearOnSwitch: string[], cookiePrefix: string): boolean =>\n\tclearOnSwitch.includes(tenantCookieName(cookiePrefix))\n\nexport const clearOnSwitchWithoutTenant = (\n\tclearOnSwitch: string[],\n\tcookiePrefix: string\n): string[] => clearOnSwitch.filter((name) => name !== tenantCookieName(cookiePrefix))\n\nexport const readTenantCookie = (headers: Headers, cookiePrefix: string): string | undefined => {\n\tconst raw = parseCookies(headers).get(tenantCookieName(cookiePrefix))\n\treturn raw && TENANT_COOKIE_VALUE.test(raw) ? raw : undefined\n}\n\nexport const setTenantCookie = ({\n\tauthConfig,\n\tcookiePrefix,\n\tvalue,\n}: {\n\tauthConfig: AuthConfig\n\tcookiePrefix: string\n\tvalue: string\n}): string =>\n\twriteCookie({\n\t\tauthConfig,\n\t\thttpOnly: false,\n\t\tname: tenantCookieName(cookiePrefix),\n\t\tvalue,\n\t})\n\nexport const expireTenantCookie = ({\n\tauthConfig,\n\tcookiePrefix,\n}: {\n\tauthConfig: AuthConfig\n\tcookiePrefix: string\n}): string =>\n\texpireCookie({\n\t\tauthConfig,\n\t\thttpOnly: false,\n\t\tname: tenantCookieName(cookiePrefix),\n\t})\n\nconst idsFrom = (value: unknown): string[] => {\n\tif (value == null) {\n\t\treturn []\n\t}\n\tif (Array.isArray(value)) {\n\t\treturn value.flatMap(idsFrom)\n\t}\n\tif (typeof value === 'string' || typeof value === 'number') {\n\t\tconst id = String(value)\n\t\treturn TENANT_COOKIE_VALUE.test(id) ? [id] : []\n\t}\n\tif (typeof value === 'object') {\n\t\tif ('id' in value) {\n\t\t\treturn idsFrom((value as { id: unknown }).id)\n\t\t}\n\t\tif ('value' in value) {\n\t\t\treturn idsFrom((value as { value: unknown }).value)\n\t\t}\n\t}\n\treturn []\n}\n\n/**\n * `@payloadcms/plugin-multi-tenant` puts assignments on `tenants` (hasMany) and\n * sometimes a single `tenant`. Only a unique readable id is safe to write as the selector.\n */\nexport const uniqueAssignedTenantId = (user: Record<string, unknown>): string | undefined => {\n\tconst ids = [...new Set([...idsFrom(user.tenants), ...idsFrom(user.tenant)])]\n\treturn ids.length === 1 ? ids[0] : undefined\n}\n\nexport const startTenantCookies = ({\n\tauthConfig,\n\tcookiePrefix,\n\tmode,\n\toptions,\n\ttarget,\n}: {\n\tauthConfig: AuthConfig\n\tcookiePrefix: string\n\tmode: ImpersonationMode\n\toptions: ResolvedOptions\n\ttarget: Record<string, unknown>\n}): string[] => {\n\tif (!isManagedTenantCookie(options.cookies.clearOnSwitch, cookiePrefix) || mode === 'parallel') {\n\t\treturn []\n\t}\n\tconst assigned = uniqueAssignedTenantId(target)\n\tif (assigned) {\n\t\treturn [setTenantCookie({ authConfig, cookiePrefix, value: assigned })]\n\t}\n\treturn [expireTenantCookie({ authConfig, cookiePrefix })]\n}\n\nexport const exitTenantCookies = ({\n\tauthConfig,\n\tcookiePrefix,\n\tmode,\n\toptions,\n\tsnapshot,\n}: {\n\tauthConfig: AuthConfig\n\tcookiePrefix: string\n\tmode: ImpersonationMode\n\toptions: ResolvedOptions\n\tsnapshot?: null | string\n}): string[] => {\n\tif (!isManagedTenantCookie(options.cookies.clearOnSwitch, cookiePrefix) || mode === 'parallel') {\n\t\treturn []\n\t}\n\tif (snapshot && TENANT_COOKIE_VALUE.test(snapshot)) {\n\t\treturn [setTenantCookie({ authConfig, cookiePrefix, value: snapshot })]\n\t}\n\treturn [expireTenantCookie({ authConfig, cookiePrefix })]\n}\n"],"mappings":";;;;;AAUA,MAAM,sBAAsB;AAE5B,MAAa,oBAAoB,iBAChC,qBAAqB,YAAY,EAAE;AAEpC,MAAa,yBAAyB,eAAyB,iBAC9D,cAAc,SAAS,iBAAiB,YAAY,CAAC;AAEtD,MAAa,8BACZ,eACA,iBACc,cAAc,QAAQ,SAAS,SAAS,iBAAiB,YAAY,CAAC;AAErF,MAAa,oBAAoB,SAAkB,iBAA6C;CAC/F,MAAM,MAAM,aAAa,OAAO,EAAE,IAAI,iBAAiB,YAAY,CAAC;CACpE,OAAO,OAAO,oBAAoB,KAAK,GAAG,IAAI,MAAM,KAAA;AACrD;AAEA,MAAa,mBAAmB,EAC/B,YACA,cACA,YAMA,YAAY;CACX;CACA,UAAU;CACV,MAAM,iBAAiB,YAAY;CACnC;AACD,CAAC;AAEF,MAAa,sBAAsB,EAClC,YACA,mBAKA,aAAa;CACZ;CACA,UAAU;CACV,MAAM,iBAAiB,YAAY;AACpC,CAAC;AAEF,MAAM,WAAW,UAA6B;CAC7C,IAAI,SAAS,MACZ,OAAO,CAAC;CAET,IAAI,MAAM,QAAQ,KAAK,GACtB,OAAO,MAAM,QAAQ,OAAO;CAE7B,IAAI,OAAO,UAAU,YAAY,OAAO,UAAU,UAAU;EAC3D,MAAM,KAAK,OAAO,KAAK;EACvB,OAAO,oBAAoB,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC;CAC/C;CACA,IAAI,OAAO,UAAU,UAAU;EAC9B,IAAI,QAAQ,OACX,OAAO,QAAS,MAA0B,EAAE;EAE7C,IAAI,WAAW,OACd,OAAO,QAAS,MAA6B,KAAK;CAEpD;CACA,OAAO,CAAC;AACT;;;;;AAMA,MAAa,0BAA0B,SAAsD;CAC5F,MAAM,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,QAAQ,KAAK,OAAO,GAAG,GAAG,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC;CAC5E,OAAO,IAAI,WAAW,IAAI,IAAI,KAAK,KAAA;AACpC;AAEA,MAAa,sBAAsB,EAClC,YACA,cACA,MACA,SACA,aAOe;CACf,IAAI,CAAC,sBAAsB,QAAQ,QAAQ,eAAe,YAAY,KAAK,SAAS,YACnF,OAAO,CAAC;CAET,MAAM,WAAW,uBAAuB,MAAM;CAC9C,IAAI,UACH,OAAO,CAAC,gBAAgB;EAAE;EAAY;EAAc,OAAO;CAAS,CAAC,CAAC;CAEvE,OAAO,CAAC,mBAAmB;EAAE;EAAY;CAAa,CAAC,CAAC;AACzD;AAEA,MAAa,qBAAqB,EACjC,YACA,cACA,MACA,SACA,eAOe;CACf,IAAI,CAAC,sBAAsB,QAAQ,QAAQ,eAAe,YAAY,KAAK,SAAS,YACnF,OAAO,CAAC;CAET,IAAI,YAAY,oBAAoB,KAAK,QAAQ,GAChD,OAAO,CAAC,gBAAgB;EAAE;EAAY;EAAc,OAAO;CAAS,CAAC,CAAC;CAEvE,OAAO,CAAC,mBAAmB;EAAE;EAAY;CAAa,CAAC,CAAC;AACzD"}

package/dist/endpoints/codes.d.ts

@@ -0,0 +1,6 @@
+//#region src/endpoints/codes.d.ts
+declare const FAILURE_CODES: readonly ["alreadyImpersonating", "failed", "forbidden", "impersonatorGone", "impersonatorSessionExpired", "invalidBody", "notImpersonating", "origin", "reasonRequired", "selfTarget", "targetNotFound", "targetTrashed", "targetUnverified", "unsupportedAuth", "unsupportedCollection"];
+type FailureCode = (typeof FAILURE_CODES)[number];
+//#endregion
+export { FailureCode };
+//# sourceMappingURL=codes.d.ts.map

package/dist/endpoints/current.js

@@ -0,0 +1,66 @@
+import { isPastAbsoluteExpiry, resolveCurrent } from "../session/resolve.js";
+import { absoluteExpiryCookies } from "../auth/expiryCookies.js";
+import { closeAndRevoke } from "../session/close.js";
+import { boundSid } from "../types.js";
+import { statusFromRow } from "../getImpersonation.js";
+import { getOptions, json } from "./shared.js";
+//#region src/endpoints/current.ts
+const currentHandler = async (req) => {
+	const options = getOptions(req);
+	const user = req.user;
+	const sid = boundSid(user, options.session.binding);
+	if (!user || !sid) return json({
+		body: { active: false },
+		req,
+		status: 200
+	});
+	const row = await resolveCurrent({
+		headers: req.headers,
+		options,
+		payload: req.payload,
+		req,
+		sid
+	});
+	if (!row || isPastAbsoluteExpiry(row)) {
+		if (row && isPastAbsoluteExpiry(row)) {
+			await closeAndRevoke({
+				endedBy: "expired",
+				options,
+				payload: req.payload,
+				record: row,
+				req
+			});
+			return json({
+				body: { active: false },
+				cookies: await absoluteExpiryCookies({
+					options,
+					payload: req.payload,
+					row,
+					sid,
+					user
+				}),
+				req,
+				status: 200
+			});
+		}
+		return json({
+			body: { active: false },
+			req,
+			status: 200
+		});
+	}
+	return json({
+		body: statusFromRow(row, sid),
+		req,
+		status: 200
+	});
+};
+const currentEndpoint = (path) => ({
+	handler: currentHandler,
+	method: "get",
+	path
+});
+//#endregion
+export { currentEndpoint };
+
+//# sourceMappingURL=current.js.map

package/dist/endpoints/current.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"current.js","names":[],"sources":["../../src/endpoints/current.ts"],"sourcesContent":["import type { Endpoint, PayloadRequest } from 'payload'\n\nimport { absoluteExpiryCookies } from '../auth/expiryCookies'\nimport { statusFromRow } from '../getImpersonation'\nimport { closeAndRevoke } from '../session/close'\nimport { isPastAbsoluteExpiry, resolveCurrent } from '../session/resolve'\nimport { boundSid } from '../types'\nimport { getOptions, json } from './shared'\n\nexport const currentHandler = async (req: PayloadRequest): Promise<Response> => {\n\tconst options = getOptions(req)\n\tconst user = req.user\n\tconst sid = boundSid(user, options.session.binding)\n\tif (!user || !sid) {\n\t\treturn json({ body: { active: false }, req, status: 200 })\n\t}\n\n\tconst row = await resolveCurrent({\n\t\theaders: req.headers,\n\t\toptions,\n\t\tpayload: req.payload,\n\t\treq,\n\t\tsid,\n\t})\n\tif (!row || isPastAbsoluteExpiry(row)) {\n\t\tif (row && isPastAbsoluteExpiry(row)) {\n\t\t\tawait closeAndRevoke({\n\t\t\t\tendedBy: 'expired',\n\t\t\t\toptions,\n\t\t\t\tpayload: req.payload,\n\t\t\t\trecord: row,\n\t\t\t\treq,\n\t\t\t})\n\t\t\tconst cookies = await absoluteExpiryCookies({\n\t\t\t\toptions,\n\t\t\t\tpayload: req.payload,\n\t\t\t\trow,\n\t\t\t\tsid,\n\t\t\t\tuser,\n\t\t\t})\n\t\t\treturn json({ body: { active: false }, cookies, req, status: 200 })\n\t\t}\n\t\treturn json({ body: { active: false }, req, status: 200 })\n\t}\n\n\treturn json({\n\t\tbody: statusFromRow(row, sid),\n\t\treq,\n\t\tstatus: 200,\n\t})\n}\n\nexport const currentEndpoint = (path: string): Endpoint => ({\n\thandler: currentHandler,\n\tmethod: 'get',\n\tpath,\n})\n"],"mappings":";;;;;;;AASA,MAAa,iBAAiB,OAAO,QAA2C;CAC/E,MAAM,UAAU,WAAW,GAAG;CAC9B,MAAM,OAAO,IAAI;CACjB,MAAM,MAAM,SAAS,MAAM,QAAQ,QAAQ,OAAO;CAClD,IAAI,CAAC,QAAQ,CAAC,KACb,OAAO,KAAK;EAAE,MAAM,EAAE,QAAQ,MAAM;EAAG;EAAK,QAAQ;CAAI,CAAC;CAG1D,MAAM,MAAM,MAAM,eAAe;EAChC,SAAS,IAAI;EACb;EACA,SAAS,IAAI;EACb;EACA;CACD,CAAC;CACD,IAAI,CAAC,OAAO,qBAAqB,GAAG,GAAG;EACtC,IAAI,OAAO,qBAAqB,GAAG,GAAG;GACrC,MAAM,eAAe;IACpB,SAAS;IACT;IACA,SAAS,IAAI;IACb,QAAQ;IACR;GACD,CAAC;GAQD,OAAO,KAAK;IAAE,MAAM,EAAE,QAAQ,MAAM;IAAG,SAAA,MAPjB,sBAAsB;KAC3C;KACA,SAAS,IAAI;KACb;KACA;KACA;IACD,CAAC;IAC+C;IAAK,QAAQ;GAAI,CAAC;EACnE;EACA,OAAO,KAAK;GAAE,MAAM,EAAE,QAAQ,MAAM;GAAG;GAAK,QAAQ;EAAI,CAAC;CAC1D;CAEA,OAAO,KAAK;EACX,MAAM,cAAc,KAAK,GAAG;EAC5B;EACA,QAAQ;CACT,CAAC;AACF;AAEA,MAAa,mBAAmB,UAA4B;CAC3D,SAAS;CACT,QAAQ;CACR;AACD"}

package/dist/endpoints/exit.js

@@ -0,0 +1,242 @@
+import { collectionBySlug } from "../ids.js";
+import { findOpenBySid, relationOf } from "../session/resolve.js";
+import { expireCookie, expireCookies, expirePayloadCookie } from "../auth/cookies.js";
+import { isolatedCookieNameFor } from "../auth/mode.js";
+import { closeAndRevoke } from "../session/close.js";
+import { boundSid } from "../types.js";
+import { callerSid, fail, getOptions, isApiKeyStrategy, json, prepareMutation, rejectGate } from "./shared.js";
+import { resignSession } from "../auth/issue.js";
+import { clearOnSwitchWithoutTenant, exitTenantCookies } from "../auth/tenantCookie.js";
+import { releaseLocks } from "../session/locks.js";
+//#region src/endpoints/exit.ts
+const exitHandler = async (req) => {
+	const gate = await prepareMutation(req);
+	if (gate) return rejectGate(req, gate);
+	const options = getOptions(req);
+	const user = req.user;
+	if (!user) return fail({
+		error: "forbidden",
+		req,
+		status: 403
+	});
+	if (isApiKeyStrategy(user) || !callerSid(user)) return fail({
+		error: "unsupportedAuth",
+		req,
+		status: 403
+	});
+	const sid = boundSid(user, options.session.binding);
+	if (!sid) return fail({
+		error: "unsupportedAuth",
+		req,
+		status: 403
+	});
+	const row = await findOpenBySid({
+		options,
+		payload: req.payload,
+		req,
+		sid
+	});
+	if (!row) return fail({
+		error: "notImpersonating",
+		req,
+		status: 409
+	});
+	const impersonator = relationOf(row.impersonator);
+	const target = relationOf(row.target);
+	const authConfig = (target ? collectionBySlug(req.payload, target.collection) : void 0)?.config.auth ?? collectionBySlug(req.payload, req.payload.config.admin.user)?.config.auth;
+	if (!authConfig) return fail({
+		error: "failed",
+		req,
+		status: 500
+	});
+	const cookiePrefix = req.payload.config.cookiePrefix;
+	const extraClearOnSwitch = clearOnSwitchWithoutTenant(options.cookies.clearOnSwitch, cookiePrefix);
+	const expireHintAndClear = expireCookies({
+		authConfig,
+		cookiePrefix,
+		names: [...extraClearOnSwitch, options.hintCookieName]
+	});
+	if (!impersonator || !collectionBySlug(req.payload, impersonator.collection)) {
+		await closeAndRevoke({
+			endedBy: "impersonatorGone",
+			options,
+			payload: req.payload,
+			record: row,
+			req
+		});
+		await releaseLocks({
+			payload: req.payload,
+			record: row,
+			req
+		});
+		return fail({
+			cookies: [expirePayloadCookie({
+				authConfig,
+				cookiePrefix
+			}), ...expireHintAndClear],
+			error: "impersonatorGone",
+			req,
+			status: 409
+		});
+	}
+	let impersonatorDoc = null;
+	try {
+		impersonatorDoc = await req.payload.findByID({
+			id: impersonator.id,
+			collection: impersonator.collection,
+			depth: 0,
+			overrideAccess: true,
+			req
+		});
+	} catch {
+		impersonatorDoc = null;
+	}
+	if (!impersonatorDoc || impersonatorDoc.deletedAt) {
+		await closeAndRevoke({
+			endedBy: "impersonatorGone",
+			options,
+			payload: req.payload,
+			record: row,
+			req
+		});
+		await releaseLocks({
+			payload: req.payload,
+			record: row,
+			req
+		});
+		return fail({
+			cookies: [expirePayloadCookie({
+				authConfig,
+				cookiePrefix
+			}), ...expireHintAndClear],
+			error: "impersonatorGone",
+			req,
+			status: 409
+		});
+	}
+	if (row.mode === "parallel") {
+		const closed = await closeAndRevoke({
+			endedBy: "exit",
+			options,
+			payload: req.payload,
+			record: row,
+			req
+		});
+		await releaseLocks({
+			payload: req.payload,
+			record: closed,
+			req
+		});
+		let isolatedName;
+		if (target) {
+			const targetUser = await req.payload.db.findOne({
+				collection: target.collection,
+				req,
+				where: { id: { equals: target.id } }
+			});
+			if (targetUser) {
+				targetUser.collection = target.collection;
+				isolatedName = await isolatedCookieNameFor({
+					collection: target.collection,
+					payload: req.payload,
+					user: targetUser
+				});
+			}
+		}
+		return json({
+			body: { ok: true },
+			cookies: [
+				...isolatedName ? [expireCookie({
+					authConfig,
+					name: isolatedName
+				})] : [],
+				expireCookie({
+					authConfig,
+					name: options.hintCookieName
+				}),
+				...expireCookies({
+					authConfig,
+					cookiePrefix,
+					names: extraClearOnSwitch
+				})
+			],
+			req,
+			status: 200
+		});
+	}
+	const restored = await resignSession({
+		collection: impersonator.collection,
+		payload: req.payload,
+		req,
+		sid: row.impersonatorSid,
+		userId: impersonator.id
+	});
+	if (!restored) {
+		await closeAndRevoke({
+			endedBy: "expired",
+			options,
+			payload: req.payload,
+			record: row,
+			req
+		});
+		await releaseLocks({
+			payload: req.payload,
+			record: row,
+			req
+		});
+		return fail({
+			cookies: [expirePayloadCookie({
+				authConfig,
+				cookiePrefix
+			}), ...expireHintAndClear],
+			error: "impersonatorSessionExpired",
+			req,
+			status: 409
+		});
+	}
+	const closed = await closeAndRevoke({
+		endedBy: "exit",
+		options,
+		payload: req.payload,
+		record: row,
+		req
+	});
+	await releaseLocks({
+		payload: req.payload,
+		record: closed,
+		req
+	});
+	return json({
+		body: { ok: true },
+		cookies: [
+			restored.cookie,
+			expireCookie({
+				authConfig,
+				name: options.hintCookieName
+			}),
+			...exitTenantCookies({
+				authConfig,
+				cookiePrefix,
+				mode: closed.mode,
+				options,
+				snapshot: row.impersonatorTenantCookie
+			}),
+			...expireCookies({
+				authConfig,
+				cookiePrefix,
+				names: extraClearOnSwitch
+			})
+		],
+		req,
+		status: 200
+	});
+};
+const exitEndpoint = (path) => ({
+	handler: exitHandler,
+	method: "post",
+	path
+});
+//#endregion
+export { exitEndpoint };
+
+//# sourceMappingURL=exit.js.map

package/dist/endpoints/exit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exit.js","names":[],"sources":["../../src/endpoints/exit.ts"],"sourcesContent":["import type { CollectionSlug, Endpoint, PayloadRequest } from 'payload'\n\nimport { expireCookie, expireCookies, expirePayloadCookie } from '../auth/cookies'\nimport { resignSession } from '../auth/issue'\nimport { isolatedCookieNameFor } from '../auth/mode'\nimport { clearOnSwitchWithoutTenant, exitTenantCookies } from '../auth/tenantCookie'\nimport { collectionBySlug } from '../ids'\nimport { closeAndRevoke } from '../session/close'\nimport { releaseLocks } from '../session/locks'\nimport { findOpenBySid, relationOf } from '../session/resolve'\nimport { boundSid } from '../types'\nimport {\n\tcallerSid,\n\tfail,\n\tgetOptions,\n\tisApiKeyStrategy,\n\tjson,\n\tprepareMutation,\n\trejectGate,\n} from './shared'\n\nexport const exitHandler = async (req: PayloadRequest): Promise<Response> => {\n\tconst gate = await prepareMutation(req)\n\tif (gate) {\n\t\treturn rejectGate(req, gate)\n\t}\n\n\tconst options = getOptions(req)\n\tconst user = req.user\n\tif (!user) {\n\t\treturn fail({ error: 'forbidden', req, status: 403 })\n\t}\n\tif (isApiKeyStrategy(user) || !callerSid(user)) {\n\t\treturn fail({ error: 'unsupportedAuth', req, status: 403 })\n\t}\n\n\tconst sid = boundSid(user, options.session.binding)\n\tif (!sid) {\n\t\treturn fail({ error: 'unsupportedAuth', req, status: 403 })\n\t}\n\n\tconst row = await findOpenBySid({ options, payload: req.payload, req, sid })\n\tif (!row) {\n\t\treturn fail({ error: 'notImpersonating', req, status: 409 })\n\t}\n\n\tconst impersonator = relationOf(row.impersonator)\n\tconst target = relationOf(row.target)\n\tconst targetCollection = target ? collectionBySlug(req.payload, target.collection) : undefined\n\tconst authConfig =\n\t\ttargetCollection?.config.auth ??\n\t\tcollectionBySlug(req.payload, req.payload.config.admin.user)?.config.auth\n\tif (!authConfig) {\n\t\treturn fail({ error: 'failed', req, status: 500 })\n\t}\n\n\tconst cookiePrefix = req.payload.config.cookiePrefix\n\tconst extraClearOnSwitch = clearOnSwitchWithoutTenant(options.cookies.clearOnSwitch, cookiePrefix)\n\tconst expireHintAndClear = expireCookies({\n\t\tauthConfig,\n\t\tcookiePrefix,\n\t\tnames: [...extraClearOnSwitch, options.hintCookieName],\n\t})\n\n\tif (!impersonator || !collectionBySlug(req.payload, impersonator.collection)) {\n\t\tawait closeAndRevoke({\n\t\t\tendedBy: 'impersonatorGone',\n\t\t\toptions,\n\t\t\tpayload: req.payload,\n\t\t\trecord: row,\n\t\t\treq,\n\t\t})\n\t\tawait releaseLocks({ payload: req.payload, record: row, req })\n\t\treturn fail({\n\t\t\tcookies: [\n\t\t\t\texpirePayloadCookie({\n\t\t\t\t\tauthConfig,\n\t\t\t\t\tcookiePrefix,\n\t\t\t\t}),\n\t\t\t\t...expireHintAndClear,\n\t\t\t],\n\t\t\terror: 'impersonatorGone',\n\t\t\treq,\n\t\t\tstatus: 409,\n\t\t})\n\t}\n\n\tlet impersonatorDoc: { deletedAt?: string; lockUntil?: Date | string } | null = null\n\ttry {\n\t\timpersonatorDoc = (await req.payload.findByID({\n\t\t\tid: impersonator.id,\n\t\t\tcollection: impersonator.collection as CollectionSlug,\n\t\t\tdepth: 0,\n\t\t\toverrideAccess: true,\n\t\t\treq,\n\t\t})) as { deletedAt?: string; lockUntil?: Date | string }\n\t} catch {\n\t\timpersonatorDoc = null\n\t}\n\n\tif (!impersonatorDoc || impersonatorDoc.deletedAt) {\n\t\tawait closeAndRevoke({\n\t\t\tendedBy: 'impersonatorGone',\n\t\t\toptions,\n\t\t\tpayload: req.payload,\n\t\t\trecord: row,\n\t\t\treq,\n\t\t})\n\t\tawait releaseLocks({ payload: req.payload, record: row, req })\n\t\treturn fail({\n\t\t\tcookies: [\n\t\t\t\texpirePayloadCookie({\n\t\t\t\t\tauthConfig,\n\t\t\t\t\tcookiePrefix,\n\t\t\t\t}),\n\t\t\t\t...expireHintAndClear,\n\t\t\t],\n\t\t\terror: 'impersonatorGone',\n\t\t\treq,\n\t\t\tstatus: 409,\n\t\t})\n\t}\n\n\tif (row.mode === 'parallel') {\n\t\tconst closed = await closeAndRevoke({\n\t\t\tendedBy: 'exit',\n\t\t\toptions,\n\t\t\tpayload: req.payload,\n\t\t\trecord: row,\n\t\t\treq,\n\t\t})\n\t\tawait releaseLocks({ payload: req.payload, record: closed, req })\n\t\tlet isolatedName: string | undefined\n\t\tif (target) {\n\t\t\tconst targetUser = (await req.payload.db.findOne({\n\t\t\t\tcollection: target.collection as CollectionSlug,\n\t\t\t\treq,\n\t\t\t\twhere: { id: { equals: target.id } },\n\t\t\t})) as { collection?: string } | null\n\t\t\tif (targetUser) {\n\t\t\t\ttargetUser.collection = target.collection\n\t\t\t\tisolatedName = await isolatedCookieNameFor({\n\t\t\t\t\tcollection: target.collection as CollectionSlug,\n\t\t\t\t\tpayload: req.payload,\n\t\t\t\t\tuser: targetUser as never,\n\t\t\t\t})\n\t\t\t}\n\t\t}\n\t\treturn json({\n\t\t\tbody: { ok: true },\n\t\t\tcookies: [\n\t\t\t\t...(isolatedName ? [expireCookie({ authConfig, name: isolatedName })] : []),\n\t\t\t\texpireCookie({ authConfig, name: options.hintCookieName }),\n\t\t\t\t...expireCookies({\n\t\t\t\t\tauthConfig,\n\t\t\t\t\tcookiePrefix,\n\t\t\t\t\tnames: extraClearOnSwitch,\n\t\t\t\t}),\n\t\t\t],\n\t\t\treq,\n\t\t\tstatus: 200,\n\t\t})\n\t}\n\n\tconst restored = await resignSession({\n\t\tcollection: impersonator.collection as CollectionSlug,\n\t\tpayload: req.payload,\n\t\treq,\n\t\tsid: row.impersonatorSid,\n\t\tuserId: impersonator.id,\n\t})\n\n\tif (!restored) {\n\t\tawait closeAndRevoke({\n\t\t\tendedBy: 'expired',\n\t\t\toptions,\n\t\t\tpayload: req.payload,\n\t\t\trecord: row,\n\t\t\treq,\n\t\t})\n\t\tawait releaseLocks({ payload: req.payload, record: row, req })\n\t\treturn fail({\n\t\t\tcookies: [\n\t\t\t\texpirePayloadCookie({\n\t\t\t\t\tauthConfig,\n\t\t\t\t\tcookiePrefix,\n\t\t\t\t}),\n\t\t\t\t...expireHintAndClear,\n\t\t\t],\n\t\t\terror: 'impersonatorSessionExpired',\n\t\t\treq,\n\t\t\tstatus: 409,\n\t\t})\n\t}\n\n\tconst closed = await closeAndRevoke({\n\t\tendedBy: 'exit',\n\t\toptions,\n\t\tpayload: req.payload,\n\t\trecord: row,\n\t\treq,\n\t})\n\tawait releaseLocks({ payload: req.payload, record: closed, req })\n\n\treturn json({\n\t\tbody: { ok: true },\n\t\tcookies: [\n\t\t\trestored.cookie,\n\t\t\texpireCookie({ authConfig, name: options.hintCookieName }),\n\t\t\t...exitTenantCookies({\n\t\t\t\tauthConfig,\n\t\t\t\tcookiePrefix,\n\t\t\t\tmode: closed.mode,\n\t\t\t\toptions,\n\t\t\t\tsnapshot: row.impersonatorTenantCookie,\n\t\t\t}),\n\t\t\t...expireCookies({\n\t\t\t\tauthConfig,\n\t\t\t\tcookiePrefix,\n\t\t\t\tnames: extraClearOnSwitch,\n\t\t\t}),\n\t\t],\n\t\treq,\n\t\tstatus: 200,\n\t})\n}\n\nexport const exitEndpoint = (path: string): Endpoint => ({\n\thandler: exitHandler,\n\tmethod: 'post',\n\tpath,\n})\n"],"mappings":";;;;;;;;;;;AAqBA,MAAa,cAAc,OAAO,QAA2C;CAC5E,MAAM,OAAO,MAAM,gBAAgB,GAAG;CACtC,IAAI,MACH,OAAO,WAAW,KAAK,IAAI;CAG5B,MAAM,UAAU,WAAW,GAAG;CAC9B,MAAM,OAAO,IAAI;CACjB,IAAI,CAAC,MACJ,OAAO,KAAK;EAAE,OAAO;EAAa;EAAK,QAAQ;CAAI,CAAC;CAErD,IAAI,iBAAiB,IAAI,KAAK,CAAC,UAAU,IAAI,GAC5C,OAAO,KAAK;EAAE,OAAO;EAAmB;EAAK,QAAQ;CAAI,CAAC;CAG3D,MAAM,MAAM,SAAS,MAAM,QAAQ,QAAQ,OAAO;CAClD,IAAI,CAAC,KACJ,OAAO,KAAK;EAAE,OAAO;EAAmB;EAAK,QAAQ;CAAI,CAAC;CAG3D,MAAM,MAAM,MAAM,cAAc;EAAE;EAAS,SAAS,IAAI;EAAS;EAAK;CAAI,CAAC;CAC3E,IAAI,CAAC,KACJ,OAAO,KAAK;EAAE,OAAO;EAAoB;EAAK,QAAQ;CAAI,CAAC;CAG5D,MAAM,eAAe,WAAW,IAAI,YAAY;CAChD,MAAM,SAAS,WAAW,IAAI,MAAM;CAEpC,MAAM,cADmB,SAAS,iBAAiB,IAAI,SAAS,OAAO,UAAU,IAAI,KAAA,IAElE,OAAO,QACzB,iBAAiB,IAAI,SAAS,IAAI,QAAQ,OAAO,MAAM,IAAI,GAAG,OAAO;CACtE,IAAI,CAAC,YACJ,OAAO,KAAK;EAAE,OAAO;EAAU;EAAK,QAAQ;CAAI,CAAC;CAGlD,MAAM,eAAe,IAAI,QAAQ,OAAO;CACxC,MAAM,qBAAqB,2BAA2B,QAAQ,QAAQ,eAAe,YAAY;CACjG,MAAM,qBAAqB,cAAc;EACxC;EACA;EACA,OAAO,CAAC,GAAG,oBAAoB,QAAQ,cAAc;CACtD,CAAC;CAED,IAAI,CAAC,gBAAgB,CAAC,iBAAiB,IAAI,SAAS,aAAa,UAAU,GAAG;EAC7E,MAAM,eAAe;GACpB,SAAS;GACT;GACA,SAAS,IAAI;GACb,QAAQ;GACR;EACD,CAAC;EACD,MAAM,aAAa;GAAE,SAAS,IAAI;GAAS,QAAQ;GAAK;EAAI,CAAC;EAC7D,OAAO,KAAK;GACX,SAAS,CACR,oBAAoB;IACnB;IACA;GACD,CAAC,GACD,GAAG,kBACJ;GACA,OAAO;GACP;GACA,QAAQ;EACT,CAAC;CACF;CAEA,IAAI,kBAA4E;CAChF,IAAI;EACH,kBAAmB,MAAM,IAAI,QAAQ,SAAS;GAC7C,IAAI,aAAa;GACjB,YAAY,aAAa;GACzB,OAAO;GACP,gBAAgB;GAChB;EACD,CAAC;CACF,QAAQ;EACP,kBAAkB;CACnB;CAEA,IAAI,CAAC,mBAAmB,gBAAgB,WAAW;EAClD,MAAM,eAAe;GACpB,SAAS;GACT;GACA,SAAS,IAAI;GACb,QAAQ;GACR;EACD,CAAC;EACD,MAAM,aAAa;GAAE,SAAS,IAAI;GAAS,QAAQ;GAAK;EAAI,CAAC;EAC7D,OAAO,KAAK;GACX,SAAS,CACR,oBAAoB;IACnB;IACA;GACD,CAAC,GACD,GAAG,kBACJ;GACA,OAAO;GACP;GACA,QAAQ;EACT,CAAC;CACF;CAEA,IAAI,IAAI,SAAS,YAAY;EAC5B,MAAM,SAAS,MAAM,eAAe;GACnC,SAAS;GACT;GACA,SAAS,IAAI;GACb,QAAQ;GACR;EACD,CAAC;EACD,MAAM,aAAa;GAAE,SAAS,IAAI;GAAS,QAAQ;GAAQ;EAAI,CAAC;EAChE,IAAI;EACJ,IAAI,QAAQ;GACX,MAAM,aAAc,MAAM,IAAI,QAAQ,GAAG,QAAQ;IAChD,YAAY,OAAO;IACnB;IACA,OAAO,EAAE,IAAI,EAAE,QAAQ,OAAO,GAAG,EAAE;GACpC,CAAC;GACD,IAAI,YAAY;IACf,WAAW,aAAa,OAAO;IAC/B,eAAe,MAAM,sBAAsB;KAC1C,YAAY,OAAO;KACnB,SAAS,IAAI;KACb,MAAM;IACP,CAAC;GACF;EACD;EACA,OAAO,KAAK;GACX,MAAM,EAAE,IAAI,KAAK;GACjB,SAAS;IACR,GAAI,eAAe,CAAC,aAAa;KAAE;KAAY,MAAM;IAAa,CAAC,CAAC,IAAI,CAAC;IACzE,aAAa;KAAE;KAAY,MAAM,QAAQ;IAAe,CAAC;IACzD,GAAG,cAAc;KAChB;KACA;KACA,OAAO;IACR,CAAC;GACF;GACA;GACA,QAAQ;EACT,CAAC;CACF;CAEA,MAAM,WAAW,MAAM,cAAc;EACpC,YAAY,aAAa;EACzB,SAAS,IAAI;EACb;EACA,KAAK,IAAI;EACT,QAAQ,aAAa;CACtB,CAAC;CAED,IAAI,CAAC,UAAU;EACd,MAAM,eAAe;GACpB,SAAS;GACT;GACA,SAAS,IAAI;GACb,QAAQ;GACR;EACD,CAAC;EACD,MAAM,aAAa;GAAE,SAAS,IAAI;GAAS,QAAQ;GAAK;EAAI,CAAC;EAC7D,OAAO,KAAK;GACX,SAAS,CACR,oBAAoB;IACnB;IACA;GACD,CAAC,GACD,GAAG,kBACJ;GACA,OAAO;GACP;GACA,QAAQ;EACT,CAAC;CACF;CAEA,MAAM,SAAS,MAAM,eAAe;EACnC,SAAS;EACT;EACA,SAAS,IAAI;EACb,QAAQ;EACR;CACD,CAAC;CACD,MAAM,aAAa;EAAE,SAAS,IAAI;EAAS,QAAQ;EAAQ;CAAI,CAAC;CAEhE,OAAO,KAAK;EACX,MAAM,EAAE,IAAI,KAAK;EACjB,SAAS;GACR,SAAS;GACT,aAAa;IAAE;IAAY,MAAM,QAAQ;GAAe,CAAC;GACzD,GAAG,kBAAkB;IACpB;IACA;IACA,MAAM,OAAO;IACb;IACA,UAAU,IAAI;GACf,CAAC;GACD,GAAG,cAAc;IAChB;IACA;IACA,OAAO;GACR,CAAC;EACF;EACA;EACA,QAAQ;CACT,CAAC;AACF;AAEA,MAAa,gBAAgB,UAA4B;CACxD,SAAS;CACT,QAAQ;CACR;AACD"}

package/dist/endpoints/shared.js

@@ -0,0 +1,76 @@
+import { getRegistry } from "../plugin/registry.js";
+import { asAuthUser } from "../types.js";
+import { isJsonContentType, verifyMutationOrigin } from "../auth/origin.js";
+import { addDataAndFileToRequest, headersWithCors } from "payload";
+//#region src/endpoints/shared.ts
+const NO_STORE = { "Cache-Control": "no-store" };
+const json = ({ body, cookies = [], req, status }) => {
+	const headers = headersWithCors({
+		headers: new Headers(NO_STORE),
+		req
+	});
+	for (const cookie of cookies) headers.append("Set-Cookie", cookie);
+	return Response.json(body, {
+		headers,
+		status
+	});
+};
+const fail = ({ cookies, error, req, status }) => json({
+	body: { error },
+	cookies,
+	req,
+	status
+});
+const rejectGate = (req, gate) => fail({
+	error: gate,
+	req,
+	status: gate === "invalidBody" ? 400 : 403
+});
+const getOptions = (req) => {
+	const options = getRegistry(req.payload.config);
+	if (!options) throw new Error("@10x-media/impersonation: plugin options were not registered");
+	return options;
+};
+const callerSid = (user) => {
+	if (!user) return;
+	return asAuthUser(user)._sid;
+};
+const isApiKeyStrategy = (user) => {
+	const strategy = asAuthUser(user)._strategy;
+	return typeof strategy === "string" && strategy.endsWith("-api-key");
+};
+const prepareMutation = async (req) => {
+	const options = getOptions(req);
+	if (!verifyMutationOrigin({
+		headers: req.headers,
+		options,
+		payload: req.payload
+	})) return "origin";
+	if (!isJsonContentType(req.headers)) return "invalidBody";
+	await addDataAndFileToRequest(req);
+	return null;
+};
+/** Only the literal `true` allows. A Payload `Where` object is deny, never allow-all. */
+const isLiteralTrue = (value) => value === true;
+const safeRedirect = (value, fallback) => {
+	if (typeof value !== "string" || !value.startsWith("/") || value.startsWith("//")) return fallback;
+	try {
+		if (new URL(value, "http://x").origin !== "http://x") return fallback;
+	} catch {
+		return fallback;
+	}
+	return value;
+};
+const trimReason = (value, maxLength) => {
+	if (typeof value !== "string") return;
+	const trimmed = value.trim().slice(0, maxLength);
+	return trimmed.length > 0 ? trimmed : void 0;
+};
+const defaultRedirect = (req, collection) => {
+	if (collection === req.payload.config.admin.user) return req.payload.config.routes.admin;
+	return "/";
+};
+//#endregion
+export { callerSid, defaultRedirect, fail, getOptions, isApiKeyStrategy, isLiteralTrue, json, prepareMutation, rejectGate, safeRedirect, trimReason };
+
+//# sourceMappingURL=shared.js.map

package/dist/endpoints/shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared.js","names":[],"sources":["../../src/endpoints/shared.ts"],"sourcesContent":["import {\n\taddDataAndFileToRequest,\n\theadersWithCors,\n\ttype PayloadRequest,\n\ttype TypedUser,\n} from 'payload'\n\nimport { isJsonContentType, verifyMutationOrigin } from '../auth/origin'\nimport { getRegistry } from '../plugin/registry'\nimport { asAuthUser, type FailureCode, type ResolvedOptions } from '../types'\n\nexport const NO_STORE = { 'Cache-Control': 'no-store' }\n\nexport const json = ({\n\tbody,\n\tcookies = [],\n\treq,\n\tstatus,\n}: {\n\tbody: unknown\n\tcookies?: string[]\n\treq: PayloadRequest\n\tstatus: number\n}): Response => {\n\tconst headers = headersWithCors({ headers: new Headers(NO_STORE), req })\n\tfor (const cookie of cookies) {\n\t\theaders.append('Set-Cookie', cookie)\n\t}\n\treturn Response.json(body, { headers, status })\n}\n\nexport const fail = ({\n\tcookies,\n\terror,\n\treq,\n\tstatus,\n}: {\n\tcookies?: string[]\n\terror: FailureCode\n\treq: PayloadRequest\n\tstatus: number\n}): Response => json({ body: { error }, cookies, req, status })\n\nexport const rejectGate = (req: PayloadRequest, gate: FailureCode): Response =>\n\tfail({ error: gate, req, status: gate === 'invalidBody' ? 400 : 403 })\n\nexport const getOptions = (req: PayloadRequest): ResolvedOptions => {\n\tconst options = getRegistry(req.payload.config)\n\tif (!options) {\n\t\tthrow new Error('@10x-media/impersonation: plugin options were not registered')\n\t}\n\treturn options\n}\n\nexport const callerSid = (user: null | TypedUser | undefined): string | undefined => {\n\tif (!user) {\n\t\treturn undefined\n\t}\n\treturn asAuthUser(user)._sid\n}\n\nexport const isApiKeyStrategy = (user: TypedUser): boolean => {\n\tconst strategy = asAuthUser(user)._strategy\n\treturn typeof strategy === 'string' && strategy.endsWith('-api-key')\n}\n\nexport const prepareMutation = async (req: PayloadRequest): Promise<FailureCode | null> => {\n\tconst options = getOptions(req)\n\tif (!verifyMutationOrigin({ headers: req.headers, options, payload: req.payload })) {\n\t\treturn 'origin'\n\t}\n\tif (!isJsonContentType(req.headers)) {\n\t\treturn 'invalidBody'\n\t}\n\tawait addDataAndFileToRequest(req)\n\treturn null\n}\n\n/** Only the literal `true` allows. A Payload `Where` object is deny, never allow-all. */\nexport const isLiteralTrue = (value: unknown): value is true => value === true\n\nexport const safeRedirect = (value: unknown, fallback: string): string => {\n\tif (typeof value !== 'string' || !value.startsWith('/') || value.startsWith('//')) {\n\t\treturn fallback\n\t}\n\ttry {\n\t\tif (new URL(value, 'http://x').origin !== 'http://x') {\n\t\t\treturn fallback\n\t\t}\n\t} catch {\n\t\treturn fallback\n\t}\n\treturn value\n}\n\nexport const trimReason = (value: unknown, maxLength: number): string | undefined => {\n\tif (typeof value !== 'string') {\n\t\treturn undefined\n\t}\n\tconst trimmed = value.trim().slice(0, maxLength)\n\treturn trimmed.length > 0 ? trimmed : undefined\n}\n\nexport const defaultRedirect = (req: PayloadRequest, collection: string): string => {\n\tconst adminCollection = req.payload.config.admin.user\n\tif (collection === adminCollection) {\n\t\treturn req.payload.config.routes.admin\n\t}\n\treturn '/'\n}\n"],"mappings":";;;;;AAWA,MAAa,WAAW,EAAE,iBAAiB,WAAW;AAEtD,MAAa,QAAQ,EACpB,MACA,UAAU,CAAC,GACX,KACA,aAMe;CACf,MAAM,UAAU,gBAAgB;EAAE,SAAS,IAAI,QAAQ,QAAQ;EAAG;CAAI,CAAC;CACvE,KAAK,MAAM,UAAU,SACpB,QAAQ,OAAO,cAAc,MAAM;CAEpC,OAAO,SAAS,KAAK,MAAM;EAAE;EAAS;CAAO,CAAC;AAC/C;AAEA,MAAa,QAAQ,EACpB,SACA,OACA,KACA,aAMe,KAAK;CAAE,MAAM,EAAE,MAAM;CAAG;CAAS;CAAK;AAAO,CAAC;AAE9D,MAAa,cAAc,KAAqB,SAC/C,KAAK;CAAE,OAAO;CAAM;CAAK,QAAQ,SAAS,gBAAgB,MAAM;AAAI,CAAC;AAEtE,MAAa,cAAc,QAAyC;CACnE,MAAM,UAAU,YAAY,IAAI,QAAQ,MAAM;CAC9C,IAAI,CAAC,SACJ,MAAM,IAAI,MAAM,8DAA8D;CAE/E,OAAO;AACR;AAEA,MAAa,aAAa,SAA2D;CACpF,IAAI,CAAC,MACJ;CAED,OAAO,WAAW,IAAI,EAAE;AACzB;AAEA,MAAa,oBAAoB,SAA6B;CAC7D,MAAM,WAAW,WAAW,IAAI,EAAE;CAClC,OAAO,OAAO,aAAa,YAAY,SAAS,SAAS,UAAU;AACpE;AAEA,MAAa,kBAAkB,OAAO,QAAqD;CAC1F,MAAM,UAAU,WAAW,GAAG;CAC9B,IAAI,CAAC,qBAAqB;EAAE,SAAS,IAAI;EAAS;EAAS,SAAS,IAAI;CAAQ,CAAC,GAChF,OAAO;CAER,IAAI,CAAC,kBAAkB,IAAI,OAAO,GACjC,OAAO;CAER,MAAM,wBAAwB,GAAG;CACjC,OAAO;AACR;;AAGA,MAAa,iBAAiB,UAAkC,UAAU;AAE1E,MAAa,gBAAgB,OAAgB,aAA6B;CACzE,IAAI,OAAO,UAAU,YAAY,CAAC,MAAM,WAAW,GAAG,KAAK,MAAM,WAAW,IAAI,GAC/E,OAAO;CAER,IAAI;EACH,IAAI,IAAI,IAAI,OAAO,UAAU,EAAE,WAAW,YACzC,OAAO;CAET,QAAQ;EACP,OAAO;CACR;CACA,OAAO;AACR;AAEA,MAAa,cAAc,OAAgB,cAA0C;CACpF,IAAI,OAAO,UAAU,UACpB;CAED,MAAM,UAAU,MAAM,KAAK,EAAE,MAAM,GAAG,SAAS;CAC/C,OAAO,QAAQ,SAAS,IAAI,UAAU,KAAA;AACvC;AAEA,MAAa,mBAAmB,KAAqB,eAA+B;CAEnF,IAAI,eADoB,IAAI,QAAQ,OAAO,MAAM,MAEhD,OAAO,IAAI,QAAQ,OAAO,OAAO;CAElC,OAAO;AACR"}