@actuate-media/cms-core 0.37.0 → 0.39.0

package/dist/__tests__/api/ai-status.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ai-status.test.d.ts.map

package/dist/__tests__/api/ai-status.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-status.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/api/ai-status.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/api/ai-status.test.js

@@ -0,0 +1,110 @@
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { handleActuateAPI } from '../../api/index.js';
+import { initDB } from '../../db.js';
+import { generateApiKey } from '../../security/api-key-enhanced.js';
+/**
+ * Contract tests for GET /ai/status.
+ *
+ * The AI tab in the admin is read-only: AI is configured server-side via the
+ * plugin + environment variables, never from the dashboard. This endpoint
+ * powers an honest status panel, so it must:
+ *   - require an authenticated admin,
+ *   - return a `{ installed, configured, provider }` shape,
+ *   - only hint at which provider env var is present (never the key value).
+ */
+const VALID_SECRET = 'a'.repeat(48);
+function createMockDB(apiKey) {
+    return {
+        apiKey: {
+            findMany: async () => (apiKey ? [apiKey] : []),
+            findUnique: async ({ where }) => apiKey && apiKey.keyHash === where.keyHash ? apiKey : null,
+            update: async () => apiKey,
+        },
+        document: {
+            findFirst: async () => null,
+            findMany: async () => [],
+            count: async () => 0,
+        },
+        user: {
+            findMany: async () => [],
+            findUnique: async () => null,
+            count: async () => 1,
+        },
+        auditLog: { create: async () => ({ id: 'log1' }), count: async () => 0 },
+    };
+}
+async function makeKey(scopes) {
+    const { key, keyHash, keyPrefix } = await generateApiKey({ prefix: 'act_sk', scopes });
+    return {
+        key,
+        record: {
+            id: 'apikey-1',
+            keyHash,
+            keyPrefix,
+            userId: 'user-1',
+            scopes,
+            ipRestrictions: null,
+            expiresAt: null,
+            lastUsedAt: null,
+            revokedAt: null,
+        },
+    };
+}
+beforeEach(() => {
+    delete globalThis.__actuateConfig;
+    process.env.CMS_SECRET = VALID_SECRET;
+});
+afterEach(() => {
+    delete process.env.ANTHROPIC_API_KEY;
+    delete process.env.OPENAI_API_KEY;
+});
+describe('GET /ai/status', () => {
+    it('requires authentication', async () => {
+        const db = createMockDB();
+        initDB(db);
+        const handler = handleActuateAPI({ prismaClient: db, config: { collections: {} } });
+        const res = await handler(new Request('https://example.com/api/cms/ai/status'));
+        expect(res.status).toBe(401);
+    });
+    it('rejects non-admin API keys', async () => {
+        const { key, record } = await makeKey({ media: true });
+        const db = createMockDB(record);
+        initDB(db);
+        const handler = handleActuateAPI({ prismaClient: db, config: { collections: {} } });
+        const res = await handler(new Request('https://example.com/api/cms/ai/status', {
+            headers: { Authorization: `Bearer ${key}` },
+        }));
+        expect(res.status).toBe(403);
+    });
+    it('returns the status shape for an admin and never configures from the dashboard', async () => {
+        const { key, record } = await makeKey({ admin: true });
+        const db = createMockDB(record);
+        initDB(db);
+        const handler = handleActuateAPI({ prismaClient: db, config: { collections: {} } });
+        const res = await handler(new Request('https://example.com/api/cms/ai/status', {
+            headers: { Authorization: `Bearer ${key}` },
+        }));
+        expect(res.status).toBe(200);
+        const body = (await res.json());
+        expect(typeof body.data.installed).toBe('boolean');
+        // No provider is registered in the test process, so it must report unconfigured.
+        expect(body.data.configured).toBe(false);
+        expect(body.data.provider).toBeNull();
+    });
+    it('hints at the configured provider env var without exposing the secret', async () => {
+        process.env.ANTHROPIC_API_KEY = 'sk-ant-super-secret-value';
+        const { key, record } = await makeKey({ admin: true });
+        const db = createMockDB(record);
+        initDB(db);
+        const handler = handleActuateAPI({ prismaClient: db, config: { collections: {} } });
+        const res = await handler(new Request('https://example.com/api/cms/ai/status', {
+            headers: { Authorization: `Bearer ${key}` },
+        }));
+        expect(res.status).toBe(200);
+        const body = (await res.json());
+        expect(body.data.provider).toBe('anthropic');
+        // The hint must never include the actual key value.
+        expect(JSON.stringify(body)).not.toContain('sk-ant-super-secret-value');
+    });
+});
+//# sourceMappingURL=ai-status.test.js.map

package/dist/__tests__/api/ai-status.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-status.test.js","sourceRoot":"","sources":["../../../src/__tests__/api/ai-status.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAEpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAA;AAGnE;;;;;;;;;GASG;AACH,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;AAcnC,SAAS,YAAY,CAAC,MAAyB;IAC7C,OAAO;QACL,MAAM,EAAE;YACN,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,UAAU,EAAE,KAAK,EAAE,EAAE,KAAK,EAAkC,EAAE,EAAE,CAC9D,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;YAC5D,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM;SAC3B;QACD,QAAQ,EAAE;YACR,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;YAC3B,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE;YACxB,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;SACrB;QACD,IAAI,EAAE;YACJ,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE;YACxB,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;YAC5B,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;SACrB;QACD,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE;KAClE,CAAA;AACV,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,MAAmB;IACxC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,MAAM,cAAc,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;IACtF,OAAO;QACL,GAAG;QACH,MAAM,EAAE;YACN,EAAE,EAAE,UAAU;YACd,OAAO;YACP,SAAS;YACT,MAAM,EAAE,QAAQ;YAChB,MAAM;YACN,cAAc,EAAE,IAAI;YACpB,SAAS,EAAE,IAAI;YACf,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,IAAI;SAChB;KACF,CAAA;AACH,CAAC;AAED,UAAU,CAAC,GAAG,EAAE;IACd,OAAQ,UAAkB,CAAC,eAAe,CAAA;IAC1C,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,YAAY,CAAA;AACvC,CAAC,CAAC,CAAA;AAEF,SAAS,CAAC,GAAG,EAAE;IACb,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAA;IACpC,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,CAAA;AACnC,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,yBAAyB,EAAE,KAAK,IAAI,EAAE;QACvC,MAAM,EAAE,GAAG,YAAY,EAAE,CAAA;QACzB,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QACnF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,OAAO,CAAC,uCAAuC,CAAC,CAAC,CAAA;QAC/E,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;QAC1C,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACtD,MAAM,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,CAAA;QAC/B,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QACnF,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,uCAAuC,EAAE;YACnD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE;SAC5C,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;QAC7F,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACtD,MAAM,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,CAAA;QAC/B,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QACnF,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,uCAAuC,EAAE;YACnD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE;SAC5C,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAQ,CAAA;QACtC,MAAM,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAClD,iFAAiF;QACjF,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACxC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,OAAO,CAAC,GAAG,CAAC,iBAAiB,GAAG,2BAA2B,CAAA;QAC3D,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACtD,MAAM,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,CAAA;QAC/B,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QACnF,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,uCAAuC,EAAE;YACnD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE;SAC5C,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAQ,CAAA;QACtC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAC5C,oDAAoD;QACpD,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAA;IACzE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/api/totp-login.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=totp-login.test.d.ts.map

package/dist/__tests__/api/totp-login.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp-login.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/api/totp-login.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/api/totp-login.test.js

@@ -0,0 +1,115 @@
+import { beforeEach, describe, expect, it } from 'vitest';
+import { handleActuateAPI } from '../../api/index.js';
+import { initDB } from '../../db.js';
+import { encryptSecret, encryptStringArray } from '../../security/secret-storage.js';
+import { createMfaPendingToken, computeRequestFingerprint } from '../../auth/mfa-pending.js';
+import { generateTOTPSecret } from '../../auth/totp.js';
+/**
+ * Contract test for the backup-code recovery path of POST /auth/totp/login.
+ *
+ * Backup codes are generated and shown at enrollment but, before this, were
+ * never consumed anywhere — a lost authenticator meant permanent lockout. This
+ * proves a valid code signs the user in, is single-use (consumed on success),
+ * and that an unknown code is rejected.
+ */
+const SECRET = 'a'.repeat(48);
+const ENCRYPTION_KEY = 'b'.repeat(64); // 32 bytes hex
+const BACKUP_CODES = ['aaaa1111', 'bbbb2222', 'cccc3333'];
+async function createMockDB(state) {
+    const totpSecret = await encryptSecret(generateTOTPSecret());
+    return {
+        user: {
+            findUnique: async () => ({
+                id: 'user-1',
+                email: 'admin@example.com',
+                name: 'Admin',
+                role: 'ADMIN',
+                totpSecret,
+                totpEnabled: true,
+                backupCodes: await encryptStringArray(state.backupCodes),
+                isActive: true,
+            }),
+            update: async ({ data }) => {
+                // The handler re-encrypts the remaining codes; decrypt-by-count is
+                // enough for the assertion (we only check how many remain).
+                state.backupCodes = state.backupCodes.slice(0, data.backupCodes.length);
+                return { id: 'user-1' };
+            },
+        },
+        document: {
+            findFirst: async () => ({ data: {} }),
+        },
+        session: {
+            findMany: async () => [],
+            create: async () => ({ id: 'sess-1' }),
+            updateMany: async () => ({ count: 0 }),
+        },
+        auditLog: {
+            create: async () => ({ id: 'log-1' }),
+        },
+    };
+}
+async function makePendingToken(ip, userAgent) {
+    const fingerprint = await computeRequestFingerprint(ip, userAgent);
+    return createMfaPendingToken({ userId: 'user-1', fingerprint }, SECRET);
+}
+beforeEach(() => {
+    delete globalThis.__actuateConfig;
+    process.env.CMS_SECRET = SECRET;
+    process.env.CMS_ENCRYPTION_KEY = ENCRYPTION_KEY;
+});
+describe('POST /auth/totp/login — backup code recovery', () => {
+    it('signs in with a valid backup code and consumes it (single-use)', async () => {
+        const ip = '203.0.113.10';
+        const ua = 'vitest-agent';
+        const state = { backupCodes: [...BACKUP_CODES] };
+        const db = await createMockDB(state);
+        initDB(db);
+        const handler = handleActuateAPI({ prismaClient: db, config: { collections: {} } });
+        const token = await makePendingToken(ip, ua);
+        const res = await handler(new Request('https://example.com/api/cms/auth/totp/login', {
+            method: 'POST',
+            headers: { 'x-real-ip': ip, 'user-agent': ua, 'content-type': 'application/json' },
+            body: JSON.stringify({ mfaPendingToken: token, code: 'BBBB-2222' }),
+        }));
+        expect(res.status).toBe(200);
+        expect(res.headers.get('set-cookie')).toContain('actuate_session=');
+        // The used code was removed — one fewer remains.
+        expect(state.backupCodes).toHaveLength(BACKUP_CODES.length - 1);
+    });
+    it('rejects an unknown code', async () => {
+        const ip = '203.0.113.11';
+        const ua = 'vitest-agent';
+        const state = { backupCodes: [...BACKUP_CODES] };
+        const db = await createMockDB(state);
+        initDB(db);
+        const handler = handleActuateAPI({ prismaClient: db, config: { collections: {} } });
+        const token = await makePendingToken(ip, ua);
+        const res = await handler(new Request('https://example.com/api/cms/auth/totp/login', {
+            method: 'POST',
+            headers: { 'x-real-ip': ip, 'user-agent': ua, 'content-type': 'application/json' },
+            body: JSON.stringify({ mfaPendingToken: token, code: 'deadbeef' }),
+        }));
+        expect(res.status).toBe(401);
+        expect(state.backupCodes).toHaveLength(BACKUP_CODES.length);
+    });
+    it('rejects a stale pending token from a different device fingerprint', async () => {
+        const state = { backupCodes: [...BACKUP_CODES] };
+        const db = await createMockDB(state);
+        initDB(db);
+        const handler = handleActuateAPI({ prismaClient: db, config: { collections: {} } });
+        // Token minted for one device, redeemed from another (different UA).
+        const token = await makePendingToken('203.0.113.12', 'device-a');
+        const res = await handler(new Request('https://example.com/api/cms/auth/totp/login', {
+            method: 'POST',
+            headers: {
+                'x-real-ip': '203.0.113.12',
+                'user-agent': 'device-b',
+                'content-type': 'application/json',
+            },
+            body: JSON.stringify({ mfaPendingToken: token, code: 'aaaa1111' }),
+        }));
+        expect(res.status).toBe(401);
+    });
+});
+//# sourceMappingURL=totp-login.test.js.map

package/dist/__tests__/api/totp-login.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp-login.test.js","sourceRoot":"","sources":["../../../src/__tests__/api/totp-login.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAEzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAA;AACpF,OAAO,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAA;AAC5F,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAEvD;;;;;;;GAOG;AACH,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;AAC7B,MAAM,cAAc,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA,CAAC,eAAe;AAErD,MAAM,YAAY,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,CAAA;AAMzD,KAAK,UAAU,YAAY,CAAC,KAAoB;IAC9C,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,kBAAkB,EAAE,CAAC,CAAA;IAC5D,OAAO;QACL,IAAI,EAAE;YACJ,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;gBACvB,EAAE,EAAE,QAAQ;gBACZ,KAAK,EAAE,mBAAmB;gBAC1B,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,OAAO;gBACb,UAAU;gBACV,WAAW,EAAE,IAAI;gBACjB,WAAW,EAAE,MAAM,kBAAkB,CAAC,KAAK,CAAC,WAAW,CAAC;gBACxD,QAAQ,EAAE,IAAI;aACf,CAAC;YACF,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAuC,EAAE,EAAE;gBAC9D,mEAAmE;gBACnE,4DAA4D;gBAC5D,KAAK,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;gBACvE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAA;YACzB,CAAC;SACF;QACD,QAAQ,EAAE;YACR,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;SACtC;QACD,OAAO,EAAE;YACP,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE;YACxB,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;YACtC,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;SACvC;QACD,QAAQ,EAAE;YACR,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;SACtC;KACK,CAAA;AACV,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,EAAU,EAAE,SAAiB;IAC3D,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC,EAAE,EAAE,SAAS,CAAC,CAAA;IAClE,OAAO,qBAAqB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,MAAM,CAAC,CAAA;AACzE,CAAC;AAED,UAAU,CAAC,GAAG,EAAE;IACd,OAAQ,UAAkB,CAAC,eAAe,CAAA;IAC1C,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,MAAM,CAAA;IAC/B,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,cAAc,CAAA;AACjD,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,8CAA8C,EAAE,GAAG,EAAE;IAC5D,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,EAAE,GAAG,cAAc,CAAA;QACzB,MAAM,EAAE,GAAG,cAAc,CAAA;QACzB,MAAM,KAAK,GAAkB,EAAE,WAAW,EAAE,CAAC,GAAG,YAAY,CAAC,EAAE,CAAA;QAC/D,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,CAAA;QACpC,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QAEnF,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;QAC5C,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,6CAA6C,EAAE;YACzD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAClF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;SACpE,CAAC,CACH,CAAA;QAED,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAA;QACnE,iDAAiD;QACjD,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,YAAY,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IACjE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yBAAyB,EAAE,KAAK,IAAI,EAAE;QACvC,MAAM,EAAE,GAAG,cAAc,CAAA;QACzB,MAAM,EAAE,GAAG,cAAc,CAAA;QACzB,MAAM,KAAK,GAAkB,EAAE,WAAW,EAAE,CAAC,GAAG,YAAY,CAAC,EAAE,CAAA;QAC/D,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,CAAA;QACpC,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QAEnF,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;QAC5C,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,6CAA6C,EAAE;YACzD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAClF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;SACnE,CAAC,CACH,CAAA;QAED,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,YAAY,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;IAC7D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,KAAK,GAAkB,EAAE,WAAW,EAAE,CAAC,GAAG,YAAY,CAAC,EAAE,CAAA;QAC/D,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,CAAA;QACpC,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QAEnF,qEAAqE;QACrE,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,cAAc,EAAE,UAAU,CAAC,CAAA;QAChE,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,6CAA6C,EAAE;YACzD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,WAAW,EAAE,cAAc;gBAC3B,YAAY,EAAE,UAAU;gBACxB,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;SACnE,CAAC,CACH,CAAA;QAED,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/api/users-invite.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=users-invite.test.d.ts.map

package/dist/__tests__/api/users-invite.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"users-invite.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/api/users-invite.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/api/users-invite.test.js

@@ -0,0 +1,167 @@
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { handleActuateAPI } from '../../api/index.js';
+import { createSession } from '../../auth/session.js';
+import { generateToken as generateCsrfToken } from '../../security/csrf.js';
+import { initDB } from '../../db.js';
+import { setEmailSender } from '../../email/sender.js';
+/**
+ * Integration tests for `POST /api/cms/users/invite`.
+ *
+ * The endpoint provisions a user with an unusable password and a single-use
+ * reset token, then returns a set-password link (and/or emails it). It is
+ * admin-only — the only multi-user provisioning path in the product.
+ */
+const SECRET = 'test-secret-for-users-invite-routes-1234567890abc';
+function createMockDB(rows) {
+    const users = [...rows];
+    const tokens = [];
+    return {
+        _users: users,
+        _tokens: tokens,
+        session: { findUnique: async () => ({ revokedAt: null }) },
+        user: {
+            // hasModel() probes for findMany; the invite route never calls it.
+            findMany: async () => users,
+            findUnique: async ({ where }) => users.find((u) => u.id === where.id) ?? null,
+            findFirst: async ({ where }) => {
+                const target = String(where.email.equals).toLowerCase();
+                return users.find((u) => u.email.toLowerCase() === target) ?? null;
+            },
+            create: async ({ data }) => {
+                const u = { id: `u_${users.length + 1}`, ...data };
+                users.push(u);
+                return u;
+            },
+        },
+        passwordResetToken: {
+            create: async ({ data }) => {
+                const t = { id: `rt_${tokens.length + 1}`, ...data };
+                tokens.push(t);
+                return t;
+            },
+        },
+    };
+}
+async function roleHeaders(userId, role) {
+    const token = await createSession({ userId, role, sessionId: `session-${userId}` }, { secret: SECRET });
+    const csrf = await generateCsrfToken();
+    return {
+        cookie: `actuate_session=${token}; actuate_csrf=${csrf}`,
+        'x-csrf-token': csrf,
+        'content-type': 'application/json',
+    };
+}
+const adminHeaders = (userId) => roleHeaders(userId, 'ADMIN');
+const editorHeaders = (userId) => roleHeaders(userId, 'EDITOR');
+describe('POST /api/cms/users/invite', () => {
+    const original = {
+        CMS_SECRET: process.env.CMS_SECRET,
+        CMS_SESSION_SECRET: process.env.CMS_SESSION_SECRET,
+        NEXT_PUBLIC_SITE_URL: process.env.NEXT_PUBLIC_SITE_URL,
+    };
+    beforeEach(() => {
+        process.env.CMS_SECRET = SECRET;
+        delete process.env.CMS_SESSION_SECRET;
+        process.env.NEXT_PUBLIC_SITE_URL = 'https://cms.example.com';
+        setEmailSender(null);
+    });
+    afterEach(() => {
+        setEmailSender(null);
+        for (const [k, v] of Object.entries(original)) {
+            if (v === undefined)
+                delete process.env[k];
+            else
+                process.env[k] = v;
+        }
+    });
+    function makeHandler(rows = []) {
+        const db = createMockDB(rows);
+        initDB(db);
+        return { handler: handleActuateAPI({ prismaClient: db }), db };
+    }
+    function inviteRequest(headers, body) {
+        return new Request('https://cms.example.com/api/cms/users/invite', {
+            method: 'POST',
+            headers,
+            body: JSON.stringify(body),
+        });
+    }
+    it('rejects anonymous writes (401 from auth or 403 from CSRF)', async () => {
+        const { handler } = makeHandler();
+        const res = await handler(new Request('https://cms.example.com/api/cms/users/invite', {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ email: 'a@example.com', role: 'author' }),
+        }));
+        // CSRF runs before auth, so an anonymous POST without a token can return
+        // either — both prove the write was blocked.
+        expect([401, 403]).toContain(res.status);
+    });
+    it('rejects non-admin roles with 403', async () => {
+        const { handler, db } = makeHandler([
+            { id: 'editor-1', email: 'ed@example.com', name: 'Ed', role: 'EDITOR' },
+        ]);
+        const res = await handler(inviteRequest(await editorHeaders('editor-1'), { email: 'a@example.com', role: 'author' }));
+        expect(res.status).toBe(403);
+        expect(db._users).toHaveLength(1);
+    });
+    it('creates the user + token and returns a shareable link when email is unconfigured', async () => {
+        const { handler, db } = makeHandler([
+            { id: 'admin-1', email: 'admin@example.com', name: 'Admin', role: 'ADMIN' },
+        ]);
+        const res = await handler(inviteRequest(await adminHeaders('admin-1'), {
+            email: 'new@example.com',
+            name: 'New Person',
+            role: 'editor',
+        }));
+        expect(res.status).toBe(200);
+        const body = (await res.json());
+        expect(body.data.success).toBe(true);
+        expect(body.data.emailed).toBe(false);
+        expect(body.data.user.role).toBe('EDITOR');
+        expect(body.data.inviteUrl).toContain('/admin/reset-password?token=');
+        expect(db._tokens).toHaveLength(1);
+        // The created user is the second row (after the admin fixture).
+        expect(db._users.map((u) => u.email)).toContain('new@example.com');
+    });
+    it('emails the invite (and hides the link) when a sender is registered', async () => {
+        const sent = [];
+        setEmailSender({
+            send: async (o) => {
+                sent.push({ to: o.to });
+            },
+        });
+        const { handler } = makeHandler([
+            { id: 'admin-1', email: 'admin@example.com', name: 'Admin', role: 'ADMIN' },
+        ]);
+        const res = await handler(inviteRequest(await adminHeaders('admin-1'), { email: 'new@example.com', role: 'author' }));
+        const body = (await res.json());
+        expect(body.data.emailed).toBe(true);
+        expect(body.data.inviteUrl).toBeUndefined();
+        expect(sent).toEqual([{ to: 'new@example.com' }]);
+    });
+    it('rejects a duplicate email with 400', async () => {
+        const { handler, db } = makeHandler([
+            { id: 'admin-1', email: 'admin@example.com', name: 'Admin', role: 'ADMIN' },
+            { id: 'u-2', email: 'taken@example.com', name: 'Taken', role: 'AUTHOR' },
+        ]);
+        const res = await handler(inviteRequest(await adminHeaders('admin-1'), { email: 'Taken@Example.com', role: 'author' }));
+        expect(res.status).toBe(400);
+        expect(db._users).toHaveLength(2);
+    });
+    it('rejects an invalid role with 400', async () => {
+        const { handler } = makeHandler([
+            { id: 'admin-1', email: 'admin@example.com', name: 'Admin', role: 'ADMIN' },
+        ]);
+        const res = await handler(inviteRequest(await adminHeaders('admin-1'), { email: 'a@example.com', role: 'viewer' }));
+        expect(res.status).toBe(400);
+    });
+    it('requires an email', async () => {
+        const { handler } = makeHandler([
+            { id: 'admin-1', email: 'admin@example.com', name: 'Admin', role: 'ADMIN' },
+        ]);
+        const res = await handler(inviteRequest(await adminHeaders('admin-1'), { role: 'author' }));
+        expect(res.status).toBe(400);
+    });
+});
+//# sourceMappingURL=users-invite.test.js.map

package/dist/__tests__/api/users-invite.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"users-invite.test.js","sourceRoot":"","sources":["../../../src/__tests__/api/users-invite.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAEpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,EAAE,aAAa,IAAI,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAC3E,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAEtD;;;;;;GAMG;AAEH,MAAM,MAAM,GAAG,mDAAmD,CAAA;AASlE,SAAS,YAAY,CAAC,IAAe;IACnC,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,CAAA;IACvB,MAAM,MAAM,GAA8E,EAAE,CAAA;IAC5F,OAAO;QACL,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,MAAM;QACf,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,EAAE;QAC1D,IAAI,EAAE;YACJ,mEAAmE;YACnE,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK;YAC3B,UAAU,EAAE,KAAK,EAAE,EAAE,KAAK,EAAO,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC,IAAI,IAAI;YAClF,SAAS,EAAE,KAAK,EAAE,EAAE,KAAK,EAAO,EAAE,EAAE;gBAClC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAA;gBACvD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,IAAI,IAAI,CAAA;YACpE,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAO,EAAE,EAAE;gBAC9B,MAAM,CAAC,GAAG,EAAE,EAAE,EAAE,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,CAAA;gBAClD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;gBACb,OAAO,CAAC,CAAA;YACV,CAAC;SACF;QACD,kBAAkB,EAAE;YAClB,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAO,EAAE,EAAE;gBAC9B,MAAM,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,CAAA;gBACpD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;gBACd,OAAO,CAAC,CAAA;YACV,CAAC;SACF;KACF,CAAA;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,MAAc,EAAE,IAAwB;IACjE,MAAM,KAAK,GAAG,MAAM,aAAa,CAC/B,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,MAAM,EAAE,EAAE,EAChD,EAAE,MAAM,EAAE,MAAM,EAAE,CACnB,CAAA;IACD,MAAM,IAAI,GAAG,MAAM,iBAAiB,EAAE,CAAA;IACtC,OAAO;QACL,MAAM,EAAE,mBAAmB,KAAK,kBAAkB,IAAI,EAAE;QACxD,cAAc,EAAE,IAAI;QACpB,cAAc,EAAE,kBAAkB;KACnC,CAAA;AACH,CAAC;AAED,MAAM,YAAY,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AACrE,MAAM,aAAa,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;AAEvE,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IAC1C,MAAM,QAAQ,GAAG;QACf,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU;QAClC,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAClD,oBAAoB,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;KACvD,CAAA;IAED,UAAU,CAAC,GAAG,EAAE;QACd,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,MAAM,CAAA;QAC/B,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAA;QACrC,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,yBAAyB,CAAA;QAC5D,cAAc,CAAC,IAAI,CAAC,CAAA;IACtB,CAAC,CAAC,CAAA;IAEF,SAAS,CAAC,GAAG,EAAE;QACb,cAAc,CAAC,IAAI,CAAC,CAAA;QACpB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAC,GAAG,CAAC,CAA0B,CAAC,CAAA;;gBAC9D,OAAO,CAAC,GAAG,CAAC,CAA0B,CAAC,GAAG,CAAC,CAAA;QAClD,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,SAAS,WAAW,CAAC,OAAkB,EAAE;QACvC,MAAM,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;QAC7B,MAAM,CAAC,EAAW,CAAC,CAAA;QACnB,OAAO,EAAE,OAAO,EAAE,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAW,EAAE,CAAC,EAAE,EAAE,EAAE,CAAA;IACzE,CAAC;IAED,SAAS,aAAa,CAAC,OAA+B,EAAE,IAAa;QACnE,OAAO,IAAI,OAAO,CAAC,8CAA8C,EAAE;YACjE,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAA;IACJ,CAAC;IAED,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,EAAE,CAAA;QACjC,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,8CAA8C,EAAE;YAC1D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;SACjE,CAAC,CACH,CAAA;QACD,yEAAyE;QACzE,6CAA6C;QAC7C,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAC1C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;QAChD,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,WAAW,CAAC;YAClC,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE;SACxE,CAAC,CAAA;QACF,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,aAAa,CAAC,MAAM,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAC3F,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IACnC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;QAChG,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,WAAW,CAAC;YAClC,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE;SAC5E,CAAC,CAAA;QACF,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,aAAa,CAAC,MAAM,YAAY,CAAC,SAAS,CAAC,EAAE;YAC3C,KAAK,EAAE,iBAAiB;YACxB,IAAI,EAAE,YAAY;YAClB,IAAI,EAAE,QAAQ;SACf,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAE7B,CAAA;QACD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACpC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACrC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC1C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAA;QACrE,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QAClC,gEAAgE;QAChE,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAA;IACpE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,IAAI,GAA0B,EAAE,CAAA;QACtC,cAAc,CAAC;YACb,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBAChB,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;YACzB,CAAC;SACF,CAAC,CAAA;QACF,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC;YAC9B,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE;SAC5E,CAAC,CAAA;QACF,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,aAAa,CAAC,MAAM,YAAY,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAC3F,CAAA;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAuD,CAAA;QACrF,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACpC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,aAAa,EAAE,CAAA;QAC3C,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAA;IACnD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,WAAW,CAAC;YAClC,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE;YAC3E,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE;SACzE,CAAC,CAAA;QACF,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,aAAa,CAAC,MAAM,YAAY,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAC7F,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IACnC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;QAChD,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC;YAC9B,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE;SAC5E,CAAC,CAAA;QACF,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,aAAa,CAAC,MAAM,YAAY,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CACzF,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mBAAmB,EAAE,KAAK,IAAI,EAAE;QACjC,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC;YAC9B,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE;SAC5E,CAAC,CAAA;QACF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,MAAM,YAAY,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAA;QAC3F,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/auth/invite.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=invite.test.d.ts.map

package/dist/__tests__/auth/invite.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invite.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/auth/invite.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/auth/invite.test.js

@@ -0,0 +1,151 @@
+import { describe, it, expect, vi, afterEach } from 'vitest';
+import { createUserInvite, normalizeInviteRole } from '../../auth/invite.js';
+import { hashToken } from '../../auth/reset.js';
+import { setEmailSender } from '../../email/sender.js';
+function createFakeDb(initial = {}) {
+    const users = initial.users ?? [];
+    const tokens = [];
+    return {
+        users,
+        tokens,
+        user: {
+            findFirst: vi.fn(async ({ where }) => {
+                const target = where.email.equals.toLowerCase();
+                return users.find((u) => u.email.toLowerCase() === target) ?? null;
+            }),
+            create: vi.fn(async ({ data }) => {
+                const u = { id: `u_${users.length + 1}`, ...data };
+                users.push(u);
+                return u;
+            }),
+        },
+        passwordResetToken: {
+            create: vi.fn(async ({ data }) => {
+                const t = { id: `rt_${tokens.length + 1}`, ...data };
+                tokens.push(t);
+                return t;
+            }),
+        },
+    };
+}
+const BASE_CONFIG = { siteUrl: 'https://example.com', adminPath: '/admin' };
+afterEach(() => {
+    setEmailSender(null);
+});
+describe('normalizeInviteRole', () => {
+    it('upper-cases and validates known roles', () => {
+        expect(normalizeInviteRole('editor')).toBe('EDITOR');
+        expect(normalizeInviteRole('  Admin ')).toBe('ADMIN');
+        expect(normalizeInviteRole('AUTHOR')).toBe('AUTHOR');
+        expect(normalizeInviteRole('client')).toBe('CLIENT');
+    });
+    it('rejects unknown / empty roles', () => {
+        expect(normalizeInviteRole('viewer')).toBeNull();
+        expect(normalizeInviteRole('')).toBeNull();
+        expect(normalizeInviteRole(undefined)).toBeNull();
+    });
+});
+describe('createUserInvite', () => {
+    it('creates an active user with a valid role and an unusable random password', async () => {
+        const db = createFakeDb();
+        const result = await createUserInvite(db, { email: 'New@Example.com ', name: '  Jane  ', role: 'editor' }, BASE_CONFIG);
+        expect(result.success).toBe(true);
+        expect(db.user.create).toHaveBeenCalledOnce();
+        const created = db.users[0];
+        expect(created.email).toBe('new@example.com');
+        expect(created.name).toBe('Jane');
+        expect(created.role).toBe('EDITOR');
+        expect(created.isActive).toBe(true);
+        expect(created.isApproved).toBe(true);
+        expect(created.emailVerified).toBe(false);
+        // Password is a real hash (not blank/plaintext) so the account can't be
+        // logged into until the invitee sets their own password.
+        expect(created.passwordHash).toMatch(/^pbkdf2:/);
+    });
+    it('defaults the name to the email local-part when omitted', async () => {
+        const db = createFakeDb();
+        await createUserInvite(db, { email: 'sam@example.com', role: 'author' }, BASE_CONFIG);
+        expect(db.users[0].name).toBe('sam');
+    });
+    it('creates a single-use reset token and returns a shareable link when no email sender is set', async () => {
+        const db = createFakeDb();
+        const result = await createUserInvite(db, { email: 'a@example.com', role: 'author' }, BASE_CONFIG);
+        expect(result.emailed).toBe(false);
+        expect(result.inviteUrl).toContain('https://example.com/admin/reset-password?token=');
+        expect(db.passwordResetToken.create).toHaveBeenCalledOnce();
+        // The token in the link is the raw token; the DB stores only its hash.
+        const tokenInUrl = result.inviteUrl.match(/token=([0-9a-f]{64})/)?.[1];
+        expect(tokenInUrl).toBeDefined();
+        expect(hashToken(tokenInUrl)).toBe(db.tokens[0].tokenHash);
+        // ~7 day expiry
+        const ttl = db.tokens[0].expiresAt.getTime() - Date.now();
+        expect(ttl).toBeGreaterThan(6.9 * 24 * 60 * 60 * 1000);
+    });
+    it('emails the invite via the registered sender and hides the link from the result', async () => {
+        const send = vi.fn(async (_o) => { });
+        setEmailSender({ send });
+        const db = createFakeDb();
+        const result = await createUserInvite(db, { email: 'a@example.com', name: 'A', role: 'admin' }, { ...BASE_CONFIG, invitedByName: 'Boss', siteName: 'Acme' });
+        expect(result.success).toBe(true);
+        expect(result.emailed).toBe(true);
+        expect(result.inviteUrl).toBeUndefined();
+        expect(send).toHaveBeenCalledOnce();
+        const sent = send.mock.calls[0][0];
+        expect(sent.to).toBe('a@example.com');
+        expect(sent.html).toContain('/admin/reset-password?token=');
+    });
+    it('builds the link from the configured admin path', async () => {
+        const db = createFakeDb();
+        const result = await createUserInvite(db, { email: 'a@example.com', role: 'author' }, {
+            siteUrl: 'https://example.com/',
+            adminPath: '/securelogin',
+        });
+        expect(result.inviteUrl).toContain('https://example.com/securelogin/reset-password?token=');
+        expect(result.inviteUrl).not.toContain('//securelogin');
+    });
+    it('rejects a duplicate email (case-insensitive) without creating a user', async () => {
+        const db = createFakeDb({
+            users: [
+                {
+                    id: 'u_1',
+                    email: 'taken@example.com',
+                    name: 'Taken',
+                    role: 'EDITOR',
+                    passwordHash: 'pbkdf2:x',
+                    isActive: true,
+                    isApproved: true,
+                    emailVerified: true,
+                },
+            ],
+        });
+        const result = await createUserInvite(db, { email: 'Taken@Example.com', role: 'author' }, BASE_CONFIG);
+        expect(result.success).toBe(false);
+        expect(result.error).toMatch(/already exists/i);
+        expect(db.user.create).not.toHaveBeenCalled();
+    });
+    it('rejects an invalid email', async () => {
+        const db = createFakeDb();
+        const result = await createUserInvite(db, { email: 'not-an-email', role: 'author' }, BASE_CONFIG);
+        expect(result.success).toBe(false);
+        expect(db.user.create).not.toHaveBeenCalled();
+    });
+    it('rejects an invalid role', async () => {
+        const db = createFakeDb();
+        const result = await createUserInvite(db, { email: 'a@example.com', role: 'viewer' }, BASE_CONFIG);
+        expect(result.success).toBe(false);
+        expect(result.error).toMatch(/role/i);
+        expect(db.user.create).not.toHaveBeenCalled();
+    });
+    it('still succeeds when the email send throws (link returned for manual sharing)', async () => {
+        const send = vi.fn(async () => {
+            throw new Error('smtp down');
+        });
+        setEmailSender({ send });
+        const db = createFakeDb();
+        const result = await createUserInvite(db, { email: 'a@example.com', role: 'author' }, BASE_CONFIG);
+        expect(result.success).toBe(true);
+        expect(result.emailed).toBe(false);
+        expect(result.inviteUrl).toContain('/admin/reset-password?token=');
+    });
+});
+//# sourceMappingURL=invite.test.js.map

package/dist/__tests__/auth/invite.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invite.test.js","sourceRoot":"","sources":["../../../src/__tests__/auth/invite.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAA;AAC5D,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAC5E,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAatD,SAAS,YAAY,CAAC,UAAkC,EAAE;IACxD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAA;IACjC,MAAM,MAAM,GAA8E,EAAE,CAAA;IAE5F,OAAO;QACL,KAAK;QACL,MAAM;QACN,IAAI,EAAE;YACJ,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,KAAK,EAAO,EAAE,EAAE;gBACxC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,CAAA;gBAC/C,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,IAAI,IAAI,CAAA;YACpE,CAAC,CAAC;YACF,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,IAAI,EAAO,EAAE,EAAE;gBACpC,MAAM,CAAC,GAAa,EAAE,EAAE,EAAE,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,CAAA;gBAC5D,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;gBACb,OAAO,CAAC,CAAA;YACV,CAAC,CAAC;SACH;QACD,kBAAkB,EAAE;YAClB,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,IAAI,EAAO,EAAE,EAAE;gBACpC,MAAM,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,CAAA;gBACpD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;gBACd,OAAO,CAAC,CAAA;YACV,CAAC,CAAC;SACH;KACF,CAAA;AACH,CAAC;AAED,MAAM,WAAW,GAAG,EAAE,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAA;AAE3E,SAAS,CAAC,GAAG,EAAE;IACb,cAAc,CAAC,IAAI,CAAC,CAAA;AACtB,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACpD,MAAM,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACrD,MAAM,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACpD,MAAM,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACtD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;QAChD,MAAM,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;QAC1C,MAAM,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;IACnD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,MAAM,EAAE,GAAG,YAAY,EAAE,CAAA;QACzB,MAAM,MAAM,GAAG,MAAM,gBAAgB,CACnC,EAAE,EACF,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,EAC/D,WAAW,CACZ,CAAA;QAED,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACjC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,oBAAoB,EAAE,CAAA;QAC7C,MAAM,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAE,CAAA;QAC5B,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;QAC7C,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACjC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACnC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACnC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACrC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACzC,wEAAwE;QACxE,yDAAyD;QACzD,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;IAClD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,EAAE,GAAG,YAAY,EAAE,CAAA;QACzB,MAAM,gBAAgB,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,WAAW,CAAC,CAAA;QACrF,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2FAA2F,EAAE,KAAK,IAAI,EAAE;QACzG,MAAM,EAAE,GAAG,YAAY,EAAE,CAAA;QACzB,MAAM,MAAM,GAAG,MAAM,gBAAgB,CACnC,EAAE,EACF,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,EAC1C,WAAW,CACZ,CAAA;QAED,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAClC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,iDAAiD,CAAC,CAAA;QACrF,MAAM,CAAC,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,oBAAoB,EAAE,CAAA;QAE3D,uEAAuE;QACvE,MAAM,UAAU,GAAG,MAAM,CAAC,SAAU,CAAC,KAAK,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QACvE,MAAM,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAA;QAChC,MAAM,CAAC,SAAS,CAAC,UAAW,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,SAAS,CAAC,CAAA;QAC5D,gBAAgB;QAChB,MAAM,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAC1D,MAAM,CAAC,GAAG,CAAC,CAAC,eAAe,CAAC,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IACxD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;QAC9F,MAAM,IAAI,GAAG,EAAE,CAAC,EAAE,CAChB,KAAK,EAAE,EAAgE,EAAE,EAAE,GAAE,CAAC,CAC/E,CAAA;QACD,cAAc,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;QACxB,MAAM,EAAE,GAAG,YAAY,EAAE,CAAA;QAEzB,MAAM,MAAM,GAAG,MAAM,gBAAgB,CACnC,EAAE,EACF,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,EACpD,EAAE,GAAG,WAAW,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAC5D,CAAA;QAED,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACjC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACjC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,aAAa,EAAE,CAAA;QACxC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,EAAE,CAAA;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAA;QACnC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;QACrC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAA;IAC7D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,EAAE,GAAG,YAAY,EAAE,CAAA;QACzB,MAAM,MAAM,GAAG,MAAM,gBAAgB,CACnC,EAAE,EACF,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,EAC1C;YACE,OAAO,EAAE,sBAAsB;YAC/B,SAAS,EAAE,cAAc;SAC1B,CACF,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,uDAAuD,CAAC,CAAA;QAC3F,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,CAAA;IACzD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,MAAM,EAAE,GAAG,YAAY,CAAC;YACtB,KAAK,EAAE;gBACL;oBACE,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE,mBAAmB;oBAC1B,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,QAAQ;oBACd,YAAY,EAAE,UAAU;oBACxB,QAAQ,EAAE,IAAI;oBACd,UAAU,EAAE,IAAI;oBAChB,aAAa,EAAE,IAAI;iBACpB;aACF;SACF,CAAC,CAAA;QACF,MAAM,MAAM,GAAG,MAAM,gBAAgB,CACnC,EAAE,EACF,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,QAAQ,EAAE,EAC9C,WAAW,CACZ,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAClC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAA;QAC/C,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAA;IAC/C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE;QACxC,MAAM,EAAE,GAAG,YAAY,EAAE,CAAA;QACzB,MAAM,MAAM,GAAG,MAAM,gBAAgB,CACnC,EAAE,EACF,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,EACzC,WAAW,CACZ,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAClC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAA;IAC/C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yBAAyB,EAAE,KAAK,IAAI,EAAE;QACvC,MAAM,EAAE,GAAG,YAAY,EAAE,CAAA;QACzB,MAAM,MAAM,GAAG,MAAM,gBAAgB,CACnC,EAAE,EACF,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,EAC1C,WAAW,CACZ,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAClC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QACrC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAA;IAC/C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8EAA8E,EAAE,KAAK,IAAI,EAAE;QAC5F,MAAM,IAAI,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,CAAA;QAC9B,CAAC,CAAC,CAAA;QACF,cAAc,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;QACxB,MAAM,EAAE,GAAG,YAAY,EAAE,CAAA;QACzB,MAAM,MAAM,GAAG,MAAM,gBAAgB,CACnC,EAAE,EACF,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,EAC1C,WAAW,CACZ,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACjC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAClC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAA;IACpE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}