@adonis-agora/flags 0.0.0-beta-20261112141227

package/dist/src/http/control_plane.js

@@ -0,0 +1,318 @@
+import { PassThrough } from 'node:stream';
+import { evaluate, } from '@adonis-agora/flags-core';
+import { parseEvents } from '../events/event.js';
+import { browserKey } from '../topology/browser_token.js';
+import { TENANT_SCOPES } from '../topology/token.js';
+const tenants = new Map();
+export function knownTenants() {
+    return [...tenants.values()].sort((a, b) => a.partition.localeCompare(b.partition));
+}
+function bearer(ctx) {
+    const header = ctx.request.header('authorization');
+    if (header && /^bearer\s+/i.test(header))
+        return header.replace(/^bearer\s+/i, '').trim();
+    return ctx.request.header('x-api-key') ?? undefined;
+}
+/**
+ * Serves tenants: the ruleset (ETag + SSE), event ingestion, declarations and usage, plus OFREP.
+ * Every request is authenticated by `verifyTenant`; the tenant identity and environment come from
+ * the verified token, never from the request body.
+ */
+export class ControlPlane {
+    runtime;
+    options;
+    browserSecret;
+    prefix;
+    #cache = new Map();
+    constructor(runtime, options, 
+    /** Set when `browser` is configured: tenants fetch their browser signing keys. */
+    browserSecret) {
+        this.runtime = runtime;
+        this.options = options;
+        this.browserSecret = browserSecret;
+        this.prefix = (options.prefix ?? '/_flags').replace(/\/$/, '');
+    }
+    async #auth(ctx, scope) {
+        const verified = await this.options.verifyTenant({
+            token: bearer(ctx),
+            tenant: ctx.request.header('x-flags-tenant') ?? undefined,
+        });
+        if (!verified) {
+            ctx.response.status(401).send({ error: 'unauthorized' });
+            return null;
+        }
+        if (verified.capabilities && !verified.capabilities.includes(scope)) {
+            ctx.response.status(403).send({ error: `token lacks the ${scope} scope` });
+            return null;
+        }
+        const environment = verified.environment ?? this.runtime.manager.environment;
+        const capabilities = (ctx.request.header('x-flags-capabilities') ?? '')
+            .split(',')
+            .filter(Boolean);
+        tenants.set(verified.tenant, {
+            ...tenants.get(verified.tenant),
+            partition: verified.tenant,
+            environment,
+            capabilities,
+            lastSeenAt: new Date().toISOString(),
+        });
+        return verified;
+    }
+    #environment(verified) {
+        return verified.environment ?? this.runtime.manager.environment;
+    }
+    /** The ruleset of an environment: the live one for ours, a version-checked cache for others. */
+    async ruleset(environment) {
+        if (environment === this.runtime.manager.environment)
+            return this.runtime.source.current();
+        const store = this.runtime.store;
+        const version = await store.version(environment);
+        const cached = this.#cache.get(environment);
+        if (cached && cached.version === version)
+            return cached;
+        const ruleset = await store.readRuleset(environment);
+        this.#cache.set(environment, ruleset);
+        return ruleset;
+    }
+    register(router) {
+        const p = this.prefix;
+        router.get(`${p}/v1/ruleset`, (ctx) => this.getRuleset(ctx)).as('flags.cp.ruleset');
+        router.get(`${p}/v1/ruleset/stream`, (ctx) => this.stream(ctx)).as('flags.cp.stream');
+        router.post(`${p}/v1/events`, (ctx) => this.events(ctx)).as('flags.cp.events');
+        router
+            .post(`${p}/v1/declarations`, (ctx) => this.declarations(ctx))
+            .as('flags.cp.declarations');
+        router.post(`${p}/v1/usage`, (ctx) => this.usage(ctx)).as('flags.cp.usage');
+        if (this.browserSecret) {
+            router.post(`${p}/v1/browser-key`, (ctx) => this.browserKey(ctx)).as('flags.cp.browserKey');
+        }
+        if (this.options.ofrep !== false) {
+            router.post('/ofrep/v1/evaluate/flags', (ctx) => this.ofrepBulk(ctx)).as('flags.ofrep.bulk');
+            router
+                .post('/ofrep/v1/evaluate/flags/:key', (ctx) => this.ofrepOne(ctx))
+                .as('flags.ofrep.one');
+            if (this.options.corsOrigins?.length && router.route) {
+                router.route('/ofrep/v1/evaluate/flags', ['OPTIONS'], (ctx) => this.#preflight(ctx));
+                router.route('/ofrep/v1/evaluate/flags/:key', ['OPTIONS'], (ctx) => this.#preflight(ctx));
+            }
+        }
+    }
+    /**
+     * A tenant's browser signing key, for its own partition and environment only. Requires the
+     * events scope: a browser token lets the browser send events in the tenant's name.
+     */
+    async browserKey(ctx) {
+        const verified = await this.#auth(ctx, TENANT_SCOPES.eventsWrite);
+        if (!verified)
+            return;
+        const environment = this.#environment(verified);
+        ctx.response.header('cache-control', 'no-store');
+        return ctx.response.json({
+            key: browserKey(this.browserSecret, verified.tenant, environment),
+            app: verified.tenant,
+            environment,
+        });
+    }
+    async getRuleset(ctx) {
+        const verified = await this.#auth(ctx, TENANT_SCOPES.rulesetRead);
+        if (!verified)
+            return;
+        const ruleset = await this.ruleset(this.#environment(verified));
+        const info = tenants.get(verified.tenant);
+        if (info)
+            info.lastRulesetVersion = ruleset.version;
+        const etag = `"${ruleset.version}"`;
+        ctx.response.header('etag', etag);
+        ctx.response.header('cache-control', 'no-cache');
+        if (ctx.request.header('if-none-match') === etag)
+            return ctx.response.status(304).send('');
+        return ctx.response.json(ruleset);
+    }
+    /** SSE: an `event: ruleset` message on every change; closes when the token expires. */
+    async stream(ctx) {
+        const verified = await this.#auth(ctx, TENANT_SCOPES.rulesetRead);
+        if (!verified)
+            return;
+        const environment = this.#environment(verified);
+        const body = new PassThrough();
+        const send = (chunk) => {
+            if (!body.writableEnded)
+                body.write(chunk);
+        };
+        let lastVersion = (await this.ruleset(environment)).version;
+        send(`event: ruleset\ndata: ${JSON.stringify({ version: lastVersion })}\n\n`);
+        const cleanups = [];
+        const close = () => {
+            for (const fn of cleanups.splice(0))
+                fn();
+            if (!body.writableEnded)
+                body.end();
+        };
+        if (environment === this.runtime.manager.environment) {
+            cleanups.push(this.runtime.source.onChange((ruleset) => {
+                lastVersion = ruleset.version;
+                send(`event: ruleset\ndata: ${JSON.stringify({ version: ruleset.version })}\n\n`);
+            }));
+        }
+        else {
+            const poll = setInterval(async () => {
+                try {
+                    const version = await this.runtime.store.version(environment);
+                    if (version !== lastVersion) {
+                        lastVersion = version;
+                        send(`event: ruleset\ndata: ${JSON.stringify({ version })}\n\n`);
+                    }
+                }
+                catch {
+                    // keep the stream; the tenant polls too
+                }
+            }, 5000);
+            cleanups.push(() => clearInterval(poll));
+        }
+        const heartbeat = setInterval(() => send(': ping\n\n'), 25_000);
+        cleanups.push(() => clearInterval(heartbeat));
+        if (verified.expiresAt) {
+            const expiry = setTimeout(close, Math.max(0, verified.expiresAt - Date.now()));
+            cleanups.push(() => clearTimeout(expiry));
+        }
+        ctx.request.request.once('close', close);
+        ctx.response.header('content-type', 'text/event-stream');
+        ctx.response.header('cache-control', 'no-cache, no-transform');
+        ctx.response.header('x-accel-buffering', 'no');
+        ctx.response.stream(body);
+    }
+    async events(ctx) {
+        const verified = await this.#auth(ctx, TENANT_SCOPES.eventsWrite);
+        if (!verified)
+            return;
+        let events;
+        try {
+            events = parseEvents(ctx.request.body().events, verified.tenant, this.#environment(verified));
+        }
+        catch (error) {
+            return ctx.response.status(400).send({ error: error.message });
+        }
+        if (events.length > 5000)
+            return ctx.response.status(413).send({ error: 'at most 5000 events per request' });
+        await this.runtime.transport.publish(events);
+        return ctx.response.status(202).send({ accepted: events.length });
+    }
+    async declarations(ctx) {
+        const verified = await this.#auth(ctx, TENANT_SCOPES.declarationsWrite);
+        if (!verified)
+            return;
+        const body = ctx.request.body();
+        if (!body.declarations || typeof body.declarations !== 'object') {
+            return ctx.response.status(400).send({ error: 'declarations must be an object' });
+        }
+        await this.runtime.store.saveDeclarations(verified.tenant, body.declarations);
+        return ctx.response.status(204).send('');
+    }
+    async usage(ctx) {
+        const verified = await this.#auth(ctx, TENANT_SCOPES.eventsWrite);
+        if (!verified)
+            return;
+        const rows = ctx.request.body().rows;
+        if (!Array.isArray(rows))
+            return ctx.response.status(400).send({ error: 'rows must be an array' });
+        const environment = this.#environment(verified);
+        await this.runtime.store.recordUsage(rows
+            .filter((r) => typeof r.flag === 'string' &&
+            /^\d{4}-\d{2}-\d{2}$/.test(r.day) &&
+            Number.isFinite(r.evaluations))
+            .map((r) => ({
+            environment,
+            flag: r.flag,
+            day: r.day,
+            evaluations: Math.max(0, Math.trunc(r.evaluations)),
+        })));
+        return ctx.response.status(204).send('');
+    }
+    // ── OFREP (OpenFeature Remote Evaluation Protocol) ─────────────────────────
+    #cors(ctx) {
+        const origin = ctx.request.header('origin');
+        if (origin && this.options.corsOrigins?.includes(origin)) {
+            ctx.response.header('access-control-allow-origin', origin);
+            ctx.response.header('vary', 'Origin');
+            ctx.response.header('access-control-expose-headers', 'ETag');
+        }
+    }
+    #preflight(ctx) {
+        this.#cors(ctx);
+        ctx.response.header('access-control-allow-methods', 'POST, OPTIONS');
+        ctx.response.header('access-control-allow-headers', 'authorization, content-type, if-none-match, x-api-key, x-flags-tenant');
+        return ctx.response.status(204).send('');
+    }
+    #ofrepContext(ctx) {
+        const body = ctx.request.body();
+        if (body.context === undefined)
+            return {};
+        if (typeof body.context !== 'object' || body.context === null || Array.isArray(body.context))
+            return null;
+        return body.context;
+    }
+    #ofrepResult(details) {
+        return {
+            key: details.flagKey,
+            value: details.value,
+            reason: details.reason,
+            ...(details.variant !== undefined ? { variant: details.variant } : {}),
+            metadata: details.flagMetadata,
+        };
+    }
+    async ofrepOne(ctx) {
+        this.#cors(ctx);
+        const verified = await this.#auth(ctx, TENANT_SCOPES.ofrepEvaluate);
+        if (!verified)
+            return;
+        const key = ctx.params.key;
+        const context = this.#ofrepContext(ctx);
+        if (!context) {
+            return ctx.response
+                .status(400)
+                .send({ key, errorCode: 'INVALID_CONTEXT', errorDetails: 'context must be an object' });
+        }
+        const ruleset = await this.ruleset(this.#environment(verified));
+        const details = evaluate(ruleset, key, null, context);
+        if (details.errorCode === 'FLAG_NOT_FOUND') {
+            return ctx.response
+                .status(404)
+                .send({ key, errorCode: 'FLAG_NOT_FOUND', errorDetails: details.errorMessage });
+        }
+        if (details.errorCode) {
+            return ctx.response
+                .status(400)
+                .send({ key, errorCode: details.errorCode, errorDetails: details.errorMessage });
+        }
+        return ctx.response.json(this.#ofrepResult(details));
+    }
+    async ofrepBulk(ctx) {
+        this.#cors(ctx);
+        const verified = await this.#auth(ctx, TENANT_SCOPES.ofrepEvaluate);
+        if (!verified)
+            return;
+        const context = this.#ofrepContext(ctx);
+        if (!context) {
+            return ctx.response
+                .status(400)
+                .send({ errorCode: 'INVALID_CONTEXT', errorDetails: 'context must be an object' });
+        }
+        const ruleset = await this.ruleset(this.#environment(verified));
+        // The ETag covers the ruleset AND the context: same rules + same context = same answers.
+        const { createHash } = await import('node:crypto');
+        const etag = `"${ruleset.version}-${createHash('sha1').update(JSON.stringify(context)).digest('hex').slice(0, 16)}"`;
+        ctx.response.header('etag', etag);
+        if (ctx.request.header('if-none-match') === etag)
+            return ctx.response.status(304).send('');
+        const flags = Object.keys(ruleset.flags)
+            .sort()
+            .map((key) => {
+            const details = evaluate(ruleset, key, null, context);
+            return details.errorCode
+                ? { key, errorCode: details.errorCode, errorDetails: details.errorMessage }
+                : this.#ofrepResult(details);
+        });
+        return ctx.response.json({ flags });
+    }
+}
+//# sourceMappingURL=control_plane.js.map

package/dist/src/http/control_plane.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"control_plane.js","sourceRoot":"","sources":["../../../src/http/control_plane.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAEL,QAAQ,GAGT,MAAM,0BAA0B,CAAC;AAIlC,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjD,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAmBrD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAsB,CAAC;AAE9C,MAAM,UAAU,YAAY;IAC1B,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;AACtF,CAAC;AAED,SAAS,MAAM,CAAC,GAAgB;IAC9B,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACnD,IAAI,MAAM,IAAI,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1F,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,YAAY;IAKJ,OAAO;IACP,OAAO;IAEP,aAAa;IAPvB,MAAM,CAAS;IACxB,MAAM,GAAG,IAAI,GAAG,EAAmB,CAAC;IAEpC,YACmB,OAAqB,EACrB,OAA4E;IAC7F,kFAAkF;IACjE,aAAsB;uBAHtB,OAAO;uBACP,OAAO;6BAEP,aAAa;QAE9B,IAAI,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAgB,EAAE,KAAa;QACzC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;YAC/C,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC;YAClB,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,SAAS;SAC1D,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YACzD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,QAAQ,CAAC,YAAY,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACpE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,KAAK,QAAQ,EAAE,CAAC,CAAC;YAC3E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,WAAW,GAAG,QAAQ,CAAC,WAAW,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC;QAC7E,MAAM,YAAY,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,sBAAsB,CAAC,IAAI,EAAE,CAAC;aACpE,KAAK,CAAC,GAAG,CAAC;aACV,MAAM,CAAC,OAAO,CAAC,CAAC;QACnB,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE;YAC3B,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC/B,SAAS,EAAE,QAAQ,CAAC,MAAM;YAC1B,WAAW;YACX,YAAY;YACZ,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACrC,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,YAAY,CAAC,QAAwB;QACnC,OAAO,QAAQ,CAAC,WAAW,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC;IAClE,CAAC;IAED,gGAAgG;IAChG,KAAK,CAAC,OAAO,CAAC,WAAmB;QAC/B,IAAI,WAAW,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAC3F,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAM,CAAC;QAClC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC5C,IAAI,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO;YAAE,OAAO,MAAM,CAAC;QACxD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACtC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,QAAQ,CAAC,MAAkB;QACzB,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;QACtB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC;QACpF,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC;QACtF,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC;QAC/E,MAAM;aACH,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;aAC7D,EAAE,CAAC,uBAAuB,CAAC,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC;QAC5E,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,qBAAqB,CAAC,CAAC;QAC9F,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;YACjC,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC;YAC7F,MAAM;iBACH,IAAI,CAAC,+BAA+B,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;iBAClE,EAAE,CAAC,iBAAiB,CAAC,CAAC;YACzB,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBACrD,MAAM,CAAC,KAAK,CAAC,0BAA0B,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;gBACrF,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;YAC5F,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,GAAgB;QAC/B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;QAClE,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAChD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACjD,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;YACvB,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC,aAAc,EAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;YAClE,GAAG,EAAE,QAAQ,CAAC,MAAM;YACpB,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,GAAgB;QAC/B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;QAClE,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;QAChE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,IAAI;YAAE,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC;QACpD,MAAM,IAAI,GAAG,IAAI,OAAO,CAAC,OAAO,GAAG,CAAC;QACpC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAClC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACjD,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,IAAI;YAAE,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3F,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,uFAAuF;IACvF,KAAK,CAAC,MAAM,CAAC,GAAgB;QAC3B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;QAClE,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,EAAE;YAC7B,IAAI,CAAC,IAAI,CAAC,aAAa;gBAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC7C,CAAC,CAAC;QACF,IAAI,WAAW,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC;QAC5D,IAAI,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC;QAE9E,MAAM,QAAQ,GAAsB,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,GAAG,EAAE;YACjB,KAAK,MAAM,EAAE,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;gBAAE,EAAE,EAAE,CAAC;YAC1C,IAAI,CAAC,IAAI,CAAC,aAAa;gBAAE,IAAI,CAAC,GAAG,EAAE,CAAC;QACtC,CAAC,CAAC;QACF,IAAI,WAAW,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;YACrD,QAAQ,CAAC,IAAI,CACX,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE;gBACvC,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;gBAC9B,IAAI,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;YACpF,CAAC,CAAC,CACH,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;gBAClC,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;oBAC/D,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;wBAC5B,WAAW,GAAG,OAAO,CAAC;wBACtB,IAAI,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;oBACnE,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,wCAAwC;gBAC1C,CAAC;YACH,CAAC,EAAE,IAAI,CAAC,CAAC;YACT,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;QAChE,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;QAC9C,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAC/E,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5C,CAAC;QACD,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAEzC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,mBAAmB,CAAC,CAAC;QACzD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC;QAC/D,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;QAC/C,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAgB;QAC3B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;QAClE,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,IAAI,MAAsC,CAAC;QAC3C,IAAI,CAAC;YACH,MAAM,GAAG,WAAW,CACjB,GAAG,CAAC,OAAO,CAAC,IAAI,EAA2B,CAAC,MAAM,EACnD,QAAQ,CAAC,MAAM,EACf,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAC5B,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,GAAG,IAAI;YACtB,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;QACrF,MAAM,IAAI,CAAC,OAAO,CAAC,SAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9C,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAgB;QACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,aAAa,CAAC,iBAAiB,CAAC,CAAC;QACxE,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAwD,CAAC;QACtF,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;YAChE,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,IAAI,CAAC,OAAO,CAAC,KAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAC/E,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAgB;QAC1B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;QAClE,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,MAAM,IAAI,GACR,GAAG,CAAC,OAAO,CAAC,IAAI,EACjB,CAAC,IAAI,CAAC;QACP,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YACtB,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC3E,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,IAAI,CAAC,OAAO,CAAC,KAAM,CAAC,WAAW,CACnC,IAAI;aACD,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CACJ,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;YAC1B,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;YACjC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CACjC;aACA,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACX,WAAW;YACX,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;SACpD,CAAC,CAAC,CACN,CAAC;QACF,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,8EAA8E;IAE9E,KAAK,CAAC,GAAgB;QACpB,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACzD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAC;YAC3D,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACtC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,+BAA+B,EAAE,MAAM,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,UAAU,CAAC,GAAgB;QACzB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChB,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,8BAA8B,EAAE,eAAe,CAAC,CAAC;QACrE,GAAG,CAAC,QAAQ,CAAC,MAAM,CACjB,8BAA8B,EAC9B,uEAAuE,CACxE,CAAC;QACF,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,aAAa,CAAC,GAAgB;QAC5B,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAA2B,CAAC;QACzD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;QAC1C,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;YAC1F,OAAO,IAAI,CAAC;QACd,OAAO,IAAI,CAAC,OAAkC,CAAC;IACjD,CAAC;IAED,YAAY,CAAC,OAA0B;QACrC,OAAO;YACL,GAAG,EAAE,OAAO,CAAC,OAAO;YACpB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,QAAQ,EAAE,OAAO,CAAC,YAAY;SAC/B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,GAAgB;QAC7B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;QACpE,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,GAAa,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,CAAC,QAAQ;iBAChB,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,iBAAiB,EAAE,YAAY,EAAE,2BAA2B,EAAE,CAAC,CAAC;QAC5F,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,IAAiB,EAAE,OAAO,CAAC,CAAC;QACnE,IAAI,OAAO,CAAC,SAAS,KAAK,gBAAgB,EAAE,CAAC;YAC3C,OAAO,GAAG,CAAC,QAAQ;iBAChB,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,gBAAgB,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACtB,OAAO,GAAG,CAAC,QAAQ;iBAChB,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAgB;QAC9B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;QACpE,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,CAAC,QAAQ;iBAChB,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,YAAY,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;QAChE,yFAAyF;QACzF,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,IAAI,OAAO,CAAC,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC;QACrH,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,IAAI;YAAE,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3F,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;aACrC,IAAI,EAAE;aACN,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YACX,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,IAAiB,EAAE,OAAO,CAAC,CAAC;YACnE,OAAO,OAAO,CAAC,SAAS;gBACtB,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE;gBAC3E,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QACL,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACtC,CAAC;CACF"}

package/dist/src/http/csrf.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Routes `@adonisjs/shield`'s CSRF check must skip: the flags API (`<prefix>/v1/*`) and OFREP
+ * (`/ofrep/v1/*`). They authenticate every request with a bearer token and never with cookies, so
+ * there is nothing for a cross-site request to forge — but left in, shield refuses their POSTs
+ * (browsers calling the flags API, tenants sending events to a control-plane).
+ *
+ * ```ts
+ * // config/shield.ts
+ * import { flagsCsrfExceptions } from '@adonis-agora/flags'
+ *
+ * csrf: {
+ *   enabled: true,
+ *   exceptRoutes: (ctx) => flagsCsrfExceptions(ctx.request.url()),
+ * }
+ * ```
+ *
+ * The console and the token endpoint stay protected: they run on the session cookie.
+ */
+export declare function flagsCsrfExceptions(url: string, options?: {
+    prefix?: string;
+}): boolean;
+//# sourceMappingURL=csrf.d.ts.map

package/dist/src/http/csrf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../../../src/http/csrf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAI3F"}

package/dist/src/http/csrf.js

@@ -0,0 +1,24 @@
+/**
+ * Routes `@adonisjs/shield`'s CSRF check must skip: the flags API (`<prefix>/v1/*`) and OFREP
+ * (`/ofrep/v1/*`). They authenticate every request with a bearer token and never with cookies, so
+ * there is nothing for a cross-site request to forge — but left in, shield refuses their POSTs
+ * (browsers calling the flags API, tenants sending events to a control-plane).
+ *
+ * ```ts
+ * // config/shield.ts
+ * import { flagsCsrfExceptions } from '@adonis-agora/flags'
+ *
+ * csrf: {
+ *   enabled: true,
+ *   exceptRoutes: (ctx) => flagsCsrfExceptions(ctx.request.url()),
+ * }
+ * ```
+ *
+ * The console and the token endpoint stay protected: they run on the session cookie.
+ */
+export function flagsCsrfExceptions(url, options = {}) {
+    const prefix = (options.prefix ?? '/_flags').replace(/\/$/, '');
+    const path = url.split('?')[0] ?? '';
+    return path.startsWith(`${prefix}/v1/`) || path.startsWith('/ofrep/v1/');
+}
+//# sourceMappingURL=csrf.js.map

package/dist/src/http/csrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.js","sourceRoot":"","sources":["../../../src/http/csrf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW,EAAE,OAAO,GAAwB,EAAE;IAChF,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAChE,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,MAAM,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AAC3E,CAAC"}

package/dist/src/http/edge_tag.d.ts

@@ -0,0 +1,55 @@
+/**
+ * `@flag` for Edge templates. Needs the `flags` the middleware shares with views.
+ *
+ * ```edge
+ * @flag('new_player')
+ *   @include('partials/new_player')
+ * @else
+ *   @include('partials/classic_player')
+ * @end
+ *
+ * @flag('checkout', 'one_page', 'two_page')
+ *   …
+ * @end
+ * ```
+ *
+ * It compiles to `if (await flags.matches(…)) { … }`, so `@else` works as with `@if`.
+ */
+export declare const flagTag: {
+    tagName: string;
+    block: boolean;
+    seekable: boolean;
+    compile(parser: EdgeParser, buffer: EdgeBuffer, token: EdgeToken): void;
+};
+interface EdgeToken {
+    filename: string;
+    loc: {
+        start: {
+            line: number;
+            col: number;
+        };
+        end: {
+            line: number;
+            col: number;
+        };
+    };
+    properties: {
+        jsArg: string;
+    };
+    children: unknown[];
+}
+interface EdgeParser {
+    utils: {
+        generateAST(expression: string, loc: EdgeToken['loc'], filename: string): unknown;
+        transformAst(ast: unknown, filename: string, parser: EdgeParser): unknown;
+        stringify(ast: unknown): string;
+    };
+    processToken(token: unknown, buffer: EdgeBuffer): void;
+}
+interface EdgeBuffer {
+    writeStatement(statement: string, filename: string, line: number): void;
+}
+/** Registers `@flag` on the app's Edge instance when `edge.js` is installed. */
+export declare function registerEdgeTag(): Promise<boolean>;
+export {};
+//# sourceMappingURL=edge_tag.d.ts.map

package/dist/src/http/edge_tag.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"edge_tag.d.ts","sourceRoot":"","sources":["../../../src/http/edge_tag.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,OAAO;IAClB,OAAO;IACP,KAAK;IACL,QAAQ;IACR,OAAO,SAAS,UAAU,UAAU,UAAU,SAAS,SAAS;CAkBjE,CAAC;AAEF,UAAU,SAAS;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE;QAAE,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,GAAG,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;IAClF,UAAU,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9B,QAAQ,EAAE,OAAO,EAAE,CAAC;CACrB;AAED,UAAU,UAAU;IAClB,KAAK,EAAE;QACL,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAClF,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC;QAC1E,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAAC;KACjC,CAAC;IACF,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CAAC;CACxD;AAED,UAAU,UAAU;IAClB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACzE;AAED,gFAAgF;AAChF,wBAAsB,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC,CAYxD"}

package/dist/src/http/edge_tag.js

@@ -0,0 +1,45 @@
+/**
+ * `@flag` for Edge templates. Needs the `flags` the middleware shares with views.
+ *
+ * ```edge
+ * @flag('new_player')
+ *   @include('partials/new_player')
+ * @else
+ *   @include('partials/classic_player')
+ * @end
+ *
+ * @flag('checkout', 'one_page', 'two_page')
+ *   …
+ * @end
+ * ```
+ *
+ * It compiles to `if (await flags.matches(…)) { … }`, so `@else` works as with `@if`.
+ */
+export const flagTag = {
+    tagName: 'flag',
+    block: true,
+    seekable: true,
+    compile(parser, buffer, token) {
+        const args = token.properties.jsArg.trim();
+        if (args.length === 0) {
+            throw new Error(`@flag needs a flag key (${token.filename}:${token.loc.start.line})`);
+        }
+        const ast = parser.utils.transformAst(parser.utils.generateAST(`await flags.matches(${args})`, token.loc, token.filename), token.filename, parser);
+        buffer.writeStatement(`if (${parser.utils.stringify(ast)}) {`, token.filename, token.loc.start.line);
+        for (const child of token.children)
+            parser.processToken(child, buffer);
+        buffer.writeStatement('}', token.filename, -1);
+    },
+};
+/** Registers `@flag` on the app's Edge instance when `edge.js` is installed. */
+export async function registerEdgeTag() {
+    try {
+        const edge = (await import('edge.js')).default;
+        edge.registerTag(flagTag);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=edge_tag.js.map

package/dist/src/http/edge_tag.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"edge_tag.js","sourceRoot":"","sources":["../../../src/http/edge_tag.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,OAAO,EAAE,MAAM;IACf,KAAK,EAAE,IAAI;IACX,QAAQ,EAAE,IAAI;IACd,OAAO,CAAC,MAAkB,EAAE,MAAkB,EAAE,KAAgB;QAC9D,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC3C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,2BAA2B,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CACnC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,uBAAuB,IAAI,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,EACnF,KAAK,CAAC,QAAQ,EACd,MAAM,CACP,CAAC;QACF,MAAM,CAAC,cAAc,CACnB,OAAO,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EACvC,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CACrB,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,QAAQ;YAAE,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACvE,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC;CACF,CAAC;AAsBF,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,IAAI,CAAC;QACH,MAAM,IAAI,GACR,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,CAGzB,CAAC,OAAO,CAAC;QACV,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/src/http/flag_middleware.d.ts

@@ -0,0 +1,27 @@
+import type { HttpContext } from '@adonisjs/core/http';
+import type { NextFn } from '@adonisjs/core/types/http';
+import type { FlagKey } from '../types.js';
+export interface FlagGuardOptions {
+    /** The flag that must be on (boolean) or serve one of `variants`. */
+    flag: FlagKey;
+    /** For multivariate flags: the variants allowed through. */
+    variants?: string[];
+    /** Status when the flag says no. Default 404 — a hidden feature should look absent. */
+    status?: number;
+}
+/**
+ * Route guard: lets the request through only when a flag allows it.
+ *
+ * ```ts
+ * // start/kernel.ts
+ * export const middleware = router.named({
+ *   flag: () => import('@adonis-agora/flags/flag_middleware'),
+ * })
+ * // start/routes.ts
+ * router.get('/checkout/new', [NewCheckoutController]).use(middleware.flag({ flag: 'new_checkout' }))
+ * ```
+ */
+export default class FlagMiddleware {
+    handle(ctx: HttpContext, next: NextFn, options: FlagGuardOptions): Promise<any>;
+}
+//# sourceMappingURL=flag_middleware.d.ts.map

package/dist/src/http/flag_middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flag_middleware.d.ts","sourceRoot":"","sources":["../../../src/http/flag_middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AAGxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,WAAW,gBAAgB;IAC/B,qEAAqE;IACrE,IAAI,EAAE,OAAO,CAAC;IACd,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,uFAAuF;IACvF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,OAAO,OAAO,cAAc;IAC3B,MAAM,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,gBAarE;CACF"}

package/dist/src/http/flag_middleware.js

@@ -0,0 +1,30 @@
+import { subjectResolver } from '../identity.js';
+import { getRuntime } from '../services/accessor.js';
+/**
+ * Route guard: lets the request through only when a flag allows it.
+ *
+ * ```ts
+ * // start/kernel.ts
+ * export const middleware = router.named({
+ *   flag: () => import('@adonis-agora/flags/flag_middleware'),
+ * })
+ * // start/routes.ts
+ * router.get('/checkout/new', [NewCheckoutController]).use(middleware.flag({ flag: 'new_checkout' }))
+ * ```
+ */
+export default class FlagMiddleware {
+    async handle(ctx, next, options) {
+        const runtime = getRuntime();
+        const scope = ctx.flags ??
+            runtime.manager.forLazy(() => subjectResolver(runtime.config)(ctx));
+        const details = await scope.details(options.flag);
+        const allowed = options.variants
+            ? details.variant !== undefined && options.variants.includes(details.variant)
+            : details.value === true;
+        if (!allowed) {
+            return ctx.response.status(options.status ?? 404).send({ message: 'Not found' });
+        }
+        return next();
+    }
+}
+//# sourceMappingURL=flag_middleware.js.map

package/dist/src/http/flag_middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"flag_middleware.js","sourceRoot":"","sources":["../../../src/http/flag_middleware.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAYrD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,OAAO,OAAO,cAAc;IACjC,KAAK,CAAC,MAAM,CAAC,GAAgB,EAAE,IAAY,EAAE,OAAyB;QACpE,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;QAC7B,MAAM,KAAK,GACR,GAA4B,CAAC,KAAK;YACnC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACtE,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ;YAC9B,CAAC,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;YAC7E,CAAC,CAAC,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC;QAC3B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;CACF"}

package/dist/src/http/flags_middleware.d.ts

@@ -0,0 +1,20 @@
+import type { HttpContext } from '@adonisjs/core/http';
+import type { NextFn } from '@adonisjs/core/types/http';
+import type { FlagsScope } from '../manager.js';
+declare module '@adonisjs/core/http' {
+    interface HttpContext {
+        /** Flags for this request's subject. Set by `@adonis-agora/flags/flags_middleware`. */
+        flags: FlagsScope;
+    }
+}
+/**
+ * Puts `ctx.flags` on every request, and shares it with Edge views as `flags`. The subject is
+ * resolved lazily — on the first flag read — so requests that never read a flag pay nothing, and
+ * the auth middleware may run before or after this one.
+ *
+ * Register it in `start/kernel.ts` (router middleware): `() => import('@adonis-agora/flags/flags_middleware')`.
+ */
+export default class FlagsMiddleware {
+    handle(ctx: HttpContext, next: NextFn): Promise<any>;
+}
+//# sourceMappingURL=flags_middleware.d.ts.map

package/dist/src/http/flags_middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flags_middleware.d.ts","sourceRoot":"","sources":["../../../src/http/flags_middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AAExD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAGhD,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,WAAW;QACnB,uFAAuF;QACvF,KAAK,EAAE,UAAU,CAAC;KACnB;CACF;AAED;;;;;;GAMG;AACH,MAAM,CAAC,OAAO,OAAO,eAAe;IAC5B,MAAM,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,gBAO1C;CACF"}

package/dist/src/http/flags_middleware.js

@@ -0,0 +1,20 @@
+import { subjectResolver } from '../identity.js';
+import { getRuntime } from '../services/accessor.js';
+/**
+ * Puts `ctx.flags` on every request, and shares it with Edge views as `flags`. The subject is
+ * resolved lazily — on the first flag read — so requests that never read a flag pay nothing, and
+ * the auth middleware may run before or after this one.
+ *
+ * Register it in `start/kernel.ts` (router middleware): `() => import('@adonis-agora/flags/flags_middleware')`.
+ */
+export default class FlagsMiddleware {
+    async handle(ctx, next) {
+        const runtime = getRuntime();
+        const resolve = subjectResolver(runtime.config);
+        ctx.flags = runtime.manager.forLazy(() => resolve(ctx));
+        const view = ctx.view;
+        view?.share({ flags: ctx.flags });
+        return next();
+    }
+}
+//# sourceMappingURL=flags_middleware.js.map

package/dist/src/http/flags_middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"flags_middleware.js","sourceRoot":"","sources":["../../../src/http/flags_middleware.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AASrD;;;;;;GAMG;AACH,MAAM,CAAC,OAAO,OAAO,eAAe;IAClC,KAAK,CAAC,MAAM,CAAC,GAAgB,EAAE,IAAY;QACzC,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAChD,GAAG,CAAC,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QACxD,MAAM,IAAI,GAAI,GAA4E,CAAC,IAAI,CAAC;QAChG,IAAI,EAAE,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;QAClC,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;CACF"}