@aglyn/tenant-data-admin 1.0.0-beta.143

package/src/lib/server/media-download-tokens.d.ts

@@ -0,0 +1,161 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/** The custom-metadata key Firebase reads the raw download token from. */
+export declare const DOWNLOAD_TOKEN_METADATA_KEY = "firebaseStorageDownloadTokens";
+/**
+ * Per-prefix object cap. Well past any real library; a scope somehow larger
+ * rotates this many and reports `truncated` rather than running unbounded
+ * inside a request.
+ */
+export declare const MAX_ROTATED_OBJECTS = 5000;
+/** Wall-clock budget per prefix, comfortably inside the route's own limit. */
+export declare const ROTATION_BUDGET_MS = 20000;
+export interface DownloadTokenRotationResult {
+    /** Storage prefix scanned, e.g. `orgs/acme/`. */
+    prefix: string;
+    /** Objects listed under the prefix. */
+    scanned: number;
+    /** Objects that carried a token and got a new one. */
+    rotated: number;
+    /** Objects that carried a token and whose rewrite failed. */
+    failed: number;
+    /** Whether a bound stopped the scan before the prefix was exhausted. */
+    truncated: boolean;
+    ok: boolean;
+    reason: string;
+}
+/**
+ * Does this lock revoke raw download URLs?
+ *
+ * Deliberately a pure predicate over the lock's own two fields, exported so
+ * the lockdown core and its specs test the SAME rule rather than two copies
+ * that can drift. See narrowing (1) above for why the answer is this narrow.
+ */
+export declare function lockRotatesDownloadTokens(lock: {
+    reason?: string;
+    mode?: 'full' | 'read-only';
+}): boolean;
+/**
+ * Rewrite the download token on every already-tokened object under one
+ * Storage prefix.
+ *
+ * Fail-soft per object: one 403 on one file must not abandon the rest of a
+ * security revocation. Failures are counted and reported, never thrown —
+ * the caller (a lock that has already been applied) has nothing useful to
+ * do with an exception, but the audit row wants the number.
+ */
+export declare function rotateDownloadTokensUnderPrefix(options: {
+    prefix: string;
+    /** Injectable for tests; defaults to the configured media bucket. */
+    bucket?: any;
+    maxObjects?: number;
+    budgetMs?: number;
+    now?: () => number;
+}): Promise<DownloadTokenRotationResult>;
+/** What happened to ONE object's token. See {@link rotateDownloadTokenForObject}. */
+export interface ObjectTokenRotation {
+    /** The token was rewritten, so the published raw URL is now dead. */
+    rotated: boolean;
+    /**
+     * Why not, when it was not. `no-token` is the common and CORRECT case —
+     * the object had no raw URL to revoke. `error` and `not-configured` are
+     * infrastructure; `no-path` is a document with no object behind it.
+     */
+    reason: 'rotated' | 'no-token' | 'no-path' | 'not-configured' | 'error';
+}
+/**
+ * Revoke ONE object's raw download URL (AGL-1615).
+ *
+ * The per-asset counterpart to the prefix scan above, for asset quarantine
+ * rather than a scope lockdown — and it closes a hole that is not a caching
+ * residual but an un-gated origin.
+ *
+ * `serveMediaCdn` consults the quarantine deny list because that route is
+ * ours. The media document's `url` field is not: it points at
+ * `firebasestorage.googleapis.com`, where no code of ours runs, and the
+ * console DAM and `GET /api/v1/media` both fall back to it whenever an asset
+ * has no `cdnPath` — every free-tier workspace, every private asset, every
+ * upload predating AGL-829. For those, a quarantine was not slow; it was
+ * never consulted, and a DMCA'd file kept serving to anyone holding the link.
+ *
+ * Same three narrowings as the prefix scan, for the same reasons, and one
+ * addition:
+ *
+ *  * **Only an object that ALREADY carries a token is touched.** Writing one
+ *    where none existed would MINT a public raw URL for a file that never
+ *    had one — creating the exposure this exists to remove.
+ *  * **The existing custom-metadata map is read and respread**, because
+ *    `setMetadata` replaces the whole map and a takedown must not also be a
+ *    silent erasure of customer-set metadata.
+ *  * **Fail soft.** A Storage outage must not become a takedown outage: the
+ *    deny-list entry is the primary control and lands regardless. The caller
+ *    reports what actually happened rather than assuming success.
+ *  * **There is no un-rotate, and none is offered.** Releasing a quarantine
+ *    does not mint a fresh token: that would hand back a WORKING raw URL
+ *    under a new value while every embed of the old one stays broken — it
+ *    helps nobody and re-publishes the bytes. The irreversibility is real
+ *    and is stated to the operator before they act, not discovered after.
+ */
+export declare function rotateDownloadTokenForObject(options: {
+    storagePath?: string | null;
+    /** Injectable for tests; defaults to the configured media bucket. */
+    bucket?: any;
+}): Promise<ObjectTokenRotation>;
+/**
+ * The object's CURRENT raw download URL, rebuilt from the token it already
+ * carries (AGL-1881).
+ *
+ * The publish half of `POST /api/media/folders {action:'set-private'}`.
+ * Turning an asset private now rotates its download token and drops the
+ * media document's `url`, so publishing it again has to put a working `url`
+ * back — for a free-tier workspace, or any asset predating AGL-829, that
+ * field is the ONLY delivery path, and leaving it deleted would make
+ * "Publish" a one-way door.
+ *
+ * **This mints nothing.** It reads the token the object already has and
+ * reassembles the URL from it, so:
+ *
+ *  * every URL handed out before the asset went private stays dead — the
+ *    rotation is not undone, only re-read;
+ *  * an object that never carried a token still does not get one, which is
+ *    the same narrowing {@link rotateDownloadTokenForObject} makes and for
+ *    the same reason: writing one would MINT a public URL for a file that
+ *    never had one.
+ *
+ * Returns `null` when there is nothing to rebuild, so the caller writes no
+ * `url` rather than an empty one.
+ */
+export declare function currentDownloadUrlForObject(options: {
+    storagePath?: string | null;
+    /** Injectable for tests; defaults to the configured media bucket. */
+    bucket?: any;
+}): Promise<string | null>;
+/**
+ * Rotate across every prefix a lock scope owns.
+ *
+ * An ORG lock passes `orgs/{orgId}/` AND `hosts/{hostId}/` for each of its
+ * sites: org-scope and host-scope libraries are separate Storage trees
+ * (`MediaScope.base`), and a lock that cleaned only the org tree would
+ * leave every site's own assets serving — which is most of them.
+ */
+export declare function rotateScopeDownloadTokens(options: {
+    prefixes: readonly string[];
+    bucket?: any;
+    maxObjects?: number;
+    budgetMs?: number;
+    now?: () => number;
+}): Promise<DownloadTokenRotationResult[]>;

package/src/lib/server/media-download-tokens.js

@@ -0,0 +1,386 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * Raw-download-URL revocation for a security lockdown (AGL-1526).
+ *
+ * THE HOLE THIS CLOSES. AGL-1520 put a lockdown gate on the media CDN
+ * (`mediaCdnServeBlock`), and that gate works because the CDN path runs OUR
+ * code: a locked scope gets a 410. But a media object can also be addressed
+ * directly at Google's edge:
+ *
+ *     https://firebasestorage.googleapis.com/v0/b/{bucket}/o/{path}
+ *       ?alt=media&token={firebaseStorageDownloadTokens}
+ *
+ * That URL is the free-tier / legacy delivery path — every upload route
+ * still mints one and stores it on the media doc's `url`. **No code of ours
+ * runs on that origin.** A lock cannot refuse it, a revalidation cannot
+ * evict it, and the tenant middleware never sees it. It serves the locked
+ * org's bytes to anyone holding the link until the token dies.
+ *
+ * The only thing that kills it is the token itself, which lives in the
+ * object's custom metadata. Rewrite that entry and Google's edge starts
+ * answering the old URL with 403 — immediately, with no cache of ours in
+ * the path and nothing to revalidate.
+ *
+ * KNOWN CONSEQUENCE, not a bug: the media doc's own `url` field still holds
+ * the OLD raw URL after rotation, so it is stale-by-design for the duration
+ * of the lock — which is the intent — and stays stale after an unlock. The
+ * console DAM and the public `GET /api/v1/media` both fall back to `url`
+ * when an asset has no `cdnPath` (free tier, private assets, pre-AGL-829
+ * uploads), so those surfaces will show broken images for a rotated org
+ * once it is unlocked. Rewriting every media doc's `url` is a second,
+ * Firestore-wide pass that deliberately is NOT done here: during the lock
+ * the dead link is the point, and a repair pass that ran at lock time would
+ * be handing back a working URL. See the AGL-1526 thread.
+ *
+ * WHAT THIS DOES NOT DO (AGL-1615, honestly). Rotation kills the URL, not
+ * the bytes. Anything that already fetched them — a browser cache, a
+ * downstream CDN, a scraper's disk, an archive.org snapshot — keeps what it
+ * has. Like quarantine and like the CDN gate, this stops only NEW origin
+ * fetches. It is the strongest control available on a path we do not serve,
+ * and it is not a recall.
+ *
+ * THREE DELIBERATE NARROWINGS:
+ *
+ *  1. **`security` reason only, `full` mode only.** Rotation is
+ *     IRREVERSIBLE for embeds: the new token is a new URL, so every raw URL
+ *     already pasted into a screen, an email or a customer's site stays
+ *     dead after the lock is lifted. The stable CDN URL (AGL-829) survives
+ *     and is the supported reference, but pre-AGL-829 content that still
+ *     embeds raw URLs will visibly break. That price is worth paying to cut
+ *     off an org serving malware or CSAM; it is NOT worth paying because an
+ *     invoice failed. `billing` and `maintenance` therefore never rotate,
+ *     and neither does a read-only lock — a read-only lock's whole promise
+ *     is that the sites keep serving.
+ *
+ *  2. **Only objects that ALREADY carry a token are touched.** An object
+ *     with no `firebaseStorageDownloadTokens` entry has no raw URL to kill,
+ *     so rotating it would be pure cost — and worse, WRITING a token where
+ *     none existed would MINT a public raw URL for an object that never had
+ *     one. The scan skips them. This is why the result reports `scanned`
+ *     and `rotated` separately.
+ *
+ *  3. **Bounded, and awaited anyway.** AGL-1526 suggested firing this off
+ *     async so the lock write does not wait on it. It is awaited instead,
+ *     under an object cap and a wall-clock budget, because an unawaited
+ *     promise in a serverless invocation is frozen the moment the response
+ *     is returned — the classic shape of a control that exists and never
+ *     runs. A bounded rotation that provably ran beats an unbounded one
+ *     that provably did not; when a bound is hit the result says
+ *     `truncated` so the audit row records an incomplete revocation rather
+ *     than implying a clean one.
+ */ import { randomUUID } from "node:crypto";
+import { firebaseAdmin } from "./firebase-admin.js";
+/** The custom-metadata key Firebase reads the raw download token from. */ export const DOWNLOAD_TOKEN_METADATA_KEY = 'firebaseStorageDownloadTokens';
+/**
+ * Per-prefix object cap. Well past any real library; a scope somehow larger
+ * rotates this many and reports `truncated` rather than running unbounded
+ * inside a request.
+ */ export const MAX_ROTATED_OBJECTS = 5000;
+/** Wall-clock budget per prefix, comfortably inside the route's own limit. */ export const ROTATION_BUDGET_MS = 20000;
+/** Objects listed per Storage page. */ const PAGE_SIZE = 500;
+/** In-flight `setMetadata` calls; the bucket is the bottleneck, not us. */ const ROTATE_CONCURRENCY = 8;
+/**
+ * The admin app is initialized without a default storageBucket, so every
+ * bucket access must name it explicitly (same as `erase.ts` and the media
+ * routes).
+ */ function storageBucket() {
+    const name = process.env['NEXT_PUBLIC_FIREBASE_STORAGE_BUCKET'];
+    return firebaseAdmin.app().storage().bucket(name || undefined);
+}
+/**
+ * Does this lock revoke raw download URLs?
+ *
+ * Deliberately a pure predicate over the lock's own two fields, exported so
+ * the lockdown core and its specs test the SAME rule rather than two copies
+ * that can drift. See narrowing (1) above for why the answer is this narrow.
+ */ export function lockRotatesDownloadTokens(lock) {
+    if (!lock) return false;
+    if (lock.mode === 'read-only') return false;
+    return lock.reason === 'security';
+}
+/**
+ * Rewrite the download token on every already-tokened object under one
+ * Storage prefix.
+ *
+ * Fail-soft per object: one 403 on one file must not abandon the rest of a
+ * security revocation. Failures are counted and reported, never thrown —
+ * the caller (a lock that has already been applied) has nothing useful to
+ * do with an exception, but the audit row wants the number.
+ */ export async function rotateDownloadTokensUnderPrefix(options) {
+    var _options_maxObjects, _options_budgetMs, _options_now;
+    const { prefix } = options;
+    const maxObjects = (_options_maxObjects = options.maxObjects) != null ? _options_maxObjects : MAX_ROTATED_OBJECTS;
+    const budgetMs = (_options_budgetMs = options.budgetMs) != null ? _options_budgetMs : ROTATION_BUDGET_MS;
+    const now = (_options_now = options.now) != null ? _options_now : ()=>Date.now();
+    const startedAt = now();
+    const result = {
+        prefix,
+        scanned: 0,
+        rotated: 0,
+        failed: 0,
+        truncated: false,
+        ok: true,
+        reason: 'ok'
+    };
+    if (!prefix) return _extends({}, result, {
+        ok: false,
+        reason: 'no-prefix'
+    });
+    let bucket;
+    try {
+        var _options_bucket;
+        bucket = (_options_bucket = options.bucket) != null ? _options_bucket : storageBucket();
+    } catch (error) {
+        console.error('[lockdown] storage bucket unavailable', prefix, error);
+        return _extends({}, result, {
+            ok: false,
+            reason: 'not-configured'
+        });
+    }
+    if (!bucket) return _extends({}, result, {
+        ok: false,
+        reason: 'not-configured'
+    });
+    let pageToken;
+    try {
+        do {
+            const [files, nextQuery] = await bucket.getFiles(_extends({
+                prefix,
+                maxResults: PAGE_SIZE,
+                autoPaginate: false
+            }, pageToken ? {
+                pageToken
+            } : {}));
+            const batch = Array.isArray(files) ? files : [];
+            result.scanned += batch.length;
+            for(let index = 0; index < batch.length; index += ROTATE_CONCURRENCY){
+                await Promise.all(batch.slice(index, index + ROTATE_CONCURRENCY).map((file)=>rotateOne(file, result)));
+            }
+            pageToken = nextQuery == null ? void 0 : nextQuery.pageToken;
+            if (result.scanned >= maxObjects && pageToken) {
+                result.truncated = true;
+                result.reason = 'object-cap';
+                break;
+            }
+            if (now() - startedAt >= budgetMs && pageToken) {
+                result.truncated = true;
+                result.reason = 'time-budget';
+                break;
+            }
+        }while (pageToken)
+    } catch (error) {
+        console.error('[lockdown] download-token rotation failed', prefix, error);
+        return _extends({}, result, {
+            ok: false,
+            reason: 'error'
+        });
+    }
+    return result;
+}
+/**
+ * One object's rewrite.
+ *
+ * The existing custom-metadata map is READ AND RESPREAD rather than
+ * replaced with a lone token key, because `setMetadata` overwrites the
+ * whole custom map (the same trap `POST /api/media/folders` documents at
+ * its move path). Dropping the map here would silently erase every
+ * customer-set metadata pair on a locked org's library — a lock is not a
+ * data-loss event.
+ */ async function rotateOne(file, result) {
+    var _ref;
+    var _file_metadata;
+    const existing = (_ref = file == null ? void 0 : (_file_metadata = file.metadata) == null ? void 0 : _file_metadata.metadata) != null ? _ref : {};
+    // Narrowing (2): no token, no raw URL, nothing to revoke — and minting
+    // one here would CREATE the exposure this function exists to remove.
+    if (!existing[DOWNLOAD_TOKEN_METADATA_KEY]) return;
+    try {
+        await file.setMetadata({
+            metadata: _extends({}, existing, {
+                [DOWNLOAD_TOKEN_METADATA_KEY]: randomUUID()
+            })
+        });
+        result.rotated += 1;
+    } catch (error) {
+        console.error('[lockdown] token rewrite failed', file == null ? void 0 : file.name, error);
+        result.failed += 1;
+    }
+}
+/**
+ * Revoke ONE object's raw download URL (AGL-1615).
+ *
+ * The per-asset counterpart to the prefix scan above, for asset quarantine
+ * rather than a scope lockdown — and it closes a hole that is not a caching
+ * residual but an un-gated origin.
+ *
+ * `serveMediaCdn` consults the quarantine deny list because that route is
+ * ours. The media document's `url` field is not: it points at
+ * `firebasestorage.googleapis.com`, where no code of ours runs, and the
+ * console DAM and `GET /api/v1/media` both fall back to it whenever an asset
+ * has no `cdnPath` — every free-tier workspace, every private asset, every
+ * upload predating AGL-829. For those, a quarantine was not slow; it was
+ * never consulted, and a DMCA'd file kept serving to anyone holding the link.
+ *
+ * Same three narrowings as the prefix scan, for the same reasons, and one
+ * addition:
+ *
+ *  * **Only an object that ALREADY carries a token is touched.** Writing one
+ *    where none existed would MINT a public raw URL for a file that never
+ *    had one — creating the exposure this exists to remove.
+ *  * **The existing custom-metadata map is read and respread**, because
+ *    `setMetadata` replaces the whole map and a takedown must not also be a
+ *    silent erasure of customer-set metadata.
+ *  * **Fail soft.** A Storage outage must not become a takedown outage: the
+ *    deny-list entry is the primary control and lands regardless. The caller
+ *    reports what actually happened rather than assuming success.
+ *  * **There is no un-rotate, and none is offered.** Releasing a quarantine
+ *    does not mint a fresh token: that would hand back a WORKING raw URL
+ *    under a new value while every embed of the old one stays broken — it
+ *    helps nobody and re-publishes the bytes. The irreversibility is real
+ *    and is stated to the operator before they act, not discovered after.
+ */ export async function rotateDownloadTokenForObject(options) {
+    var _ref;
+    const storagePath = String((_ref = options == null ? void 0 : options.storagePath) != null ? _ref : '').trim();
+    if (!storagePath) return {
+        rotated: false,
+        reason: 'no-path'
+    };
+    let bucket;
+    try {
+        var _options_bucket;
+        bucket = (_options_bucket = options.bucket) != null ? _options_bucket : storageBucket();
+    } catch (error) {
+        console.error('[quarantine] storage bucket unavailable', storagePath, error);
+        return {
+            rotated: false,
+            reason: 'not-configured'
+        };
+    }
+    if (!bucket) return {
+        rotated: false,
+        reason: 'not-configured'
+    };
+    try {
+        var _ref1;
+        const file = bucket.file(storagePath);
+        // FETCHED, not read off the handle (AGL-1881). `bucket.file(path)`
+        // constructs a File whose `.metadata` is `{}` until something populates
+        // it — the prefix scan above gets it free because `bucket.getFiles()`
+        // returns hydrated handles, and this function never called anything that
+        // does. So `existing[DOWNLOAD_TOKEN_METADATA_KEY]` was always undefined
+        // and this returned `no-token` for every object, including the ones that
+        // carried a live raw URL. `no-token` is also the CORRECT benign answer,
+        // which is why nothing looked wrong: a takedown reported "no raw URL to
+        // revoke" and the operator had no way to tell that apart from a
+        // revocation that ran. A control that exists, is wired, and silently
+        // never fires.
+        const [fetched] = await file.getMetadata();
+        const existing = (_ref1 = fetched == null ? void 0 : fetched.metadata) != null ? _ref1 : {};
+        if (!existing[DOWNLOAD_TOKEN_METADATA_KEY]) {
+            return {
+                rotated: false,
+                reason: 'no-token'
+            };
+        }
+        await file.setMetadata({
+            metadata: _extends({}, existing, {
+                [DOWNLOAD_TOKEN_METADATA_KEY]: randomUUID()
+            })
+        });
+        return {
+            rotated: true,
+            reason: 'rotated'
+        };
+    } catch (error) {
+        console.error('[quarantine] token revocation failed', storagePath, error);
+        return {
+            rotated: false,
+            reason: 'error'
+        };
+    }
+}
+/**
+ * The object's CURRENT raw download URL, rebuilt from the token it already
+ * carries (AGL-1881).
+ *
+ * The publish half of `POST /api/media/folders {action:'set-private'}`.
+ * Turning an asset private now rotates its download token and drops the
+ * media document's `url`, so publishing it again has to put a working `url`
+ * back — for a free-tier workspace, or any asset predating AGL-829, that
+ * field is the ONLY delivery path, and leaving it deleted would make
+ * "Publish" a one-way door.
+ *
+ * **This mints nothing.** It reads the token the object already has and
+ * reassembles the URL from it, so:
+ *
+ *  * every URL handed out before the asset went private stays dead — the
+ *    rotation is not undone, only re-read;
+ *  * an object that never carried a token still does not get one, which is
+ *    the same narrowing {@link rotateDownloadTokenForObject} makes and for
+ *    the same reason: writing one would MINT a public URL for a file that
+ *    never had one.
+ *
+ * Returns `null` when there is nothing to rebuild, so the caller writes no
+ * `url` rather than an empty one.
+ */ export async function currentDownloadUrlForObject(options) {
+    var _ref;
+    const storagePath = String((_ref = options == null ? void 0 : options.storagePath) != null ? _ref : '').trim();
+    if (!storagePath) return null;
+    let bucket;
+    try {
+        var _options_bucket;
+        bucket = (_options_bucket = options.bucket) != null ? _options_bucket : storageBucket();
+    } catch (error) {
+        console.error('[media] storage bucket unavailable', storagePath, error);
+        return null;
+    }
+    if (!bucket) return null;
+    try {
+        var _ref1;
+        const file = bucket.file(storagePath);
+        const [fetched] = await file.getMetadata();
+        const token = ((_ref1 = fetched == null ? void 0 : fetched.metadata) != null ? _ref1 : {})[DOWNLOAD_TOKEN_METADATA_KEY];
+        if (!token) return null;
+        return `https://firebasestorage.googleapis.com/v0/b/${bucket.name}/o/` + `${encodeURIComponent(storagePath)}?alt=media&token=${String(token)}`;
+    } catch (error) {
+        console.error('[media] download url read failed', storagePath, error);
+        return null;
+    }
+}
+/**
+ * Rotate across every prefix a lock scope owns.
+ *
+ * An ORG lock passes `orgs/{orgId}/` AND `hosts/{hostId}/` for each of its
+ * sites: org-scope and host-scope libraries are separate Storage trees
+ * (`MediaScope.base`), and a lock that cleaned only the org tree would
+ * leave every site's own assets serving — which is most of them.
+ */ export async function rotateScopeDownloadTokens(options) {
+    var _options_prefixes;
+    const results = [];
+    for (const prefix of (_options_prefixes = options.prefixes) != null ? _options_prefixes : []){
+        results.push(await rotateDownloadTokensUnderPrefix({
+            prefix,
+            bucket: options.bucket,
+            maxObjects: options.maxObjects,
+            budgetMs: options.budgetMs,
+            now: options.now
+        }));
+    }
+    return results;
+}
+
+//# sourceMappingURL=media-download-tokens.js.map

package/src/lib/server/media-download-tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/media-download-tokens.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Raw-download-URL revocation for a security lockdown (AGL-1526).\n *\n * THE HOLE THIS CLOSES. AGL-1520 put a lockdown gate on the media CDN\n * (`mediaCdnServeBlock`), and that gate works because the CDN path runs OUR\n * code: a locked scope gets a 410. But a media object can also be addressed\n * directly at Google's edge:\n *\n *     https://firebasestorage.googleapis.com/v0/b/{bucket}/o/{path}\n *       ?alt=media&token={firebaseStorageDownloadTokens}\n *\n * That URL is the free-tier / legacy delivery path — every upload route\n * still mints one and stores it on the media doc's `url`. **No code of ours\n * runs on that origin.** A lock cannot refuse it, a revalidation cannot\n * evict it, and the tenant middleware never sees it. It serves the locked\n * org's bytes to anyone holding the link until the token dies.\n *\n * The only thing that kills it is the token itself, which lives in the\n * object's custom metadata. Rewrite that entry and Google's edge starts\n * answering the old URL with 403 — immediately, with no cache of ours in\n * the path and nothing to revalidate.\n *\n * KNOWN CONSEQUENCE, not a bug: the media doc's own `url` field still holds\n * the OLD raw URL after rotation, so it is stale-by-design for the duration\n * of the lock — which is the intent — and stays stale after an unlock. The\n * console DAM and the public `GET /api/v1/media` both fall back to `url`\n * when an asset has no `cdnPath` (free tier, private assets, pre-AGL-829\n * uploads), so those surfaces will show broken images for a rotated org\n * once it is unlocked. Rewriting every media doc's `url` is a second,\n * Firestore-wide pass that deliberately is NOT done here: during the lock\n * the dead link is the point, and a repair pass that ran at lock time would\n * be handing back a working URL. See the AGL-1526 thread.\n *\n * WHAT THIS DOES NOT DO (AGL-1615, honestly). Rotation kills the URL, not\n * the bytes. Anything that already fetched them — a browser cache, a\n * downstream CDN, a scraper's disk, an archive.org snapshot — keeps what it\n * has. Like quarantine and like the CDN gate, this stops only NEW origin\n * fetches. It is the strongest control available on a path we do not serve,\n * and it is not a recall.\n *\n * THREE DELIBERATE NARROWINGS:\n *\n *  1. **`security` reason only, `full` mode only.** Rotation is\n *     IRREVERSIBLE for embeds: the new token is a new URL, so every raw URL\n *     already pasted into a screen, an email or a customer's site stays\n *     dead after the lock is lifted. The stable CDN URL (AGL-829) survives\n *     and is the supported reference, but pre-AGL-829 content that still\n *     embeds raw URLs will visibly break. That price is worth paying to cut\n *     off an org serving malware or CSAM; it is NOT worth paying because an\n *     invoice failed. `billing` and `maintenance` therefore never rotate,\n *     and neither does a read-only lock — a read-only lock's whole promise\n *     is that the sites keep serving.\n *\n *  2. **Only objects that ALREADY carry a token are touched.** An object\n *     with no `firebaseStorageDownloadTokens` entry has no raw URL to kill,\n *     so rotating it would be pure cost — and worse, WRITING a token where\n *     none existed would MINT a public raw URL for an object that never had\n *     one. The scan skips them. This is why the result reports `scanned`\n *     and `rotated` separately.\n *\n *  3. **Bounded, and awaited anyway.** AGL-1526 suggested firing this off\n *     async so the lock write does not wait on it. It is awaited instead,\n *     under an object cap and a wall-clock budget, because an unawaited\n *     promise in a serverless invocation is frozen the moment the response\n *     is returned — the classic shape of a control that exists and never\n *     runs. A bounded rotation that provably ran beats an unbounded one\n *     that provably did not; when a bound is hit the result says\n *     `truncated` so the audit row records an incomplete revocation rather\n *     than implying a clean one.\n */\n\nimport { randomUUID } from 'node:crypto'\nimport { firebaseAdmin } from './firebase-admin'\n\n/** The custom-metadata key Firebase reads the raw download token from. */\nexport const DOWNLOAD_TOKEN_METADATA_KEY = 'firebaseStorageDownloadTokens'\n\n/**\n * Per-prefix object cap. Well past any real library; a scope somehow larger\n * rotates this many and reports `truncated` rather than running unbounded\n * inside a request.\n */\nexport const MAX_ROTATED_OBJECTS = 5000\n/** Wall-clock budget per prefix, comfortably inside the route's own limit. */\nexport const ROTATION_BUDGET_MS = 20_000\n/** Objects listed per Storage page. */\nconst PAGE_SIZE = 500\n/** In-flight `setMetadata` calls; the bucket is the bottleneck, not us. */\nconst ROTATE_CONCURRENCY = 8\n\nexport interface DownloadTokenRotationResult {\n  /** Storage prefix scanned, e.g. `orgs/acme/`. */\n  prefix: string\n  /** Objects listed under the prefix. */\n  scanned: number\n  /** Objects that carried a token and got a new one. */\n  rotated: number\n  /** Objects that carried a token and whose rewrite failed. */\n  failed: number\n  /** Whether a bound stopped the scan before the prefix was exhausted. */\n  truncated: boolean\n  ok: boolean\n  reason: string\n}\n\n/**\n * The admin app is initialized without a default storageBucket, so every\n * bucket access must name it explicitly (same as `erase.ts` and the media\n * routes).\n */\nfunction storageBucket(): any {\n  const name = process.env['NEXT_PUBLIC_FIREBASE_STORAGE_BUCKET']\n  return firebaseAdmin.app().storage().bucket(name || undefined)\n}\n\n/**\n * Does this lock revoke raw download URLs?\n *\n * Deliberately a pure predicate over the lock's own two fields, exported so\n * the lockdown core and its specs test the SAME rule rather than two copies\n * that can drift. See narrowing (1) above for why the answer is this narrow.\n */\nexport function lockRotatesDownloadTokens(lock: {\n  reason?: string\n  mode?: 'full' | 'read-only'\n}): boolean {\n  if (!lock) return false\n  if (lock.mode === 'read-only') return false\n  return lock.reason === 'security'\n}\n\n/**\n * Rewrite the download token on every already-tokened object under one\n * Storage prefix.\n *\n * Fail-soft per object: one 403 on one file must not abandon the rest of a\n * security revocation. Failures are counted and reported, never thrown —\n * the caller (a lock that has already been applied) has nothing useful to\n * do with an exception, but the audit row wants the number.\n */\nexport async function rotateDownloadTokensUnderPrefix(options: {\n  prefix: string\n  /** Injectable for tests; defaults to the configured media bucket. */\n  bucket?: any\n  maxObjects?: number\n  budgetMs?: number\n  now?: () => number\n}): Promise<DownloadTokenRotationResult> {\n  const { prefix } = options\n  const maxObjects = options.maxObjects ?? MAX_ROTATED_OBJECTS\n  const budgetMs = options.budgetMs ?? ROTATION_BUDGET_MS\n  const now = options.now ?? (() => Date.now())\n  const startedAt = now()\n  const result: DownloadTokenRotationResult = {\n    prefix,\n    scanned: 0,\n    rotated: 0,\n    failed: 0,\n    truncated: false,\n    ok: true,\n    reason: 'ok',\n  }\n  if (!prefix) return { ...result, ok: false, reason: 'no-prefix' }\n\n  let bucket: any\n  try {\n    bucket = options.bucket ?? storageBucket()\n  } catch (error) {\n    console.error('[lockdown] storage bucket unavailable', prefix, error)\n    return { ...result, ok: false, reason: 'not-configured' }\n  }\n  if (!bucket) return { ...result, ok: false, reason: 'not-configured' }\n\n  let pageToken: string | undefined\n  try {\n    do {\n      const [files, nextQuery] = await bucket.getFiles({\n        prefix,\n        maxResults: PAGE_SIZE,\n        autoPaginate: false,\n        ...(pageToken ? { pageToken } : {}),\n      })\n      const batch: any[] = Array.isArray(files) ? files : []\n      result.scanned += batch.length\n\n      for (let index = 0; index < batch.length; index += ROTATE_CONCURRENCY) {\n        await Promise.all(\n          batch\n            .slice(index, index + ROTATE_CONCURRENCY)\n            .map((file: any) => rotateOne(file, result)),\n        )\n      }\n\n      pageToken = nextQuery?.pageToken\n      if (result.scanned >= maxObjects && pageToken) {\n        result.truncated = true\n        result.reason = 'object-cap'\n        break\n      }\n      if (now() - startedAt >= budgetMs && pageToken) {\n        result.truncated = true\n        result.reason = 'time-budget'\n        break\n      }\n    } while (pageToken)\n  } catch (error) {\n    console.error('[lockdown] download-token rotation failed', prefix, error)\n    return { ...result, ok: false, reason: 'error' }\n  }\n\n  return result\n}\n\n/**\n * One object's rewrite.\n *\n * The existing custom-metadata map is READ AND RESPREAD rather than\n * replaced with a lone token key, because `setMetadata` overwrites the\n * whole custom map (the same trap `POST /api/media/folders` documents at\n * its move path). Dropping the map here would silently erase every\n * customer-set metadata pair on a locked org's library — a lock is not a\n * data-loss event.\n */\nasync function rotateOne(\n  file: any,\n  result: DownloadTokenRotationResult,\n): Promise<void> {\n  const existing = (file?.metadata?.metadata ?? {}) as Record<string, unknown>\n  // Narrowing (2): no token, no raw URL, nothing to revoke — and minting\n  // one here would CREATE the exposure this function exists to remove.\n  if (!existing[DOWNLOAD_TOKEN_METADATA_KEY]) return\n  try {\n    await file.setMetadata({\n      metadata: { ...existing, [DOWNLOAD_TOKEN_METADATA_KEY]: randomUUID() },\n    })\n    result.rotated += 1\n  } catch (error) {\n    console.error('[lockdown] token rewrite failed', file?.name, error)\n    result.failed += 1\n  }\n}\n\n/** What happened to ONE object's token. See {@link rotateDownloadTokenForObject}. */\nexport interface ObjectTokenRotation {\n  /** The token was rewritten, so the published raw URL is now dead. */\n  rotated: boolean\n  /**\n   * Why not, when it was not. `no-token` is the common and CORRECT case —\n   * the object had no raw URL to revoke. `error` and `not-configured` are\n   * infrastructure; `no-path` is a document with no object behind it.\n   */\n  reason: 'rotated' | 'no-token' | 'no-path' | 'not-configured' | 'error'\n}\n\n/**\n * Revoke ONE object's raw download URL (AGL-1615).\n *\n * The per-asset counterpart to the prefix scan above, for asset quarantine\n * rather than a scope lockdown — and it closes a hole that is not a caching\n * residual but an un-gated origin.\n *\n * `serveMediaCdn` consults the quarantine deny list because that route is\n * ours. The media document's `url` field is not: it points at\n * `firebasestorage.googleapis.com`, where no code of ours runs, and the\n * console DAM and `GET /api/v1/media` both fall back to it whenever an asset\n * has no `cdnPath` — every free-tier workspace, every private asset, every\n * upload predating AGL-829. For those, a quarantine was not slow; it was\n * never consulted, and a DMCA'd file kept serving to anyone holding the link.\n *\n * Same three narrowings as the prefix scan, for the same reasons, and one\n * addition:\n *\n *  * **Only an object that ALREADY carries a token is touched.** Writing one\n *    where none existed would MINT a public raw URL for a file that never\n *    had one — creating the exposure this exists to remove.\n *  * **The existing custom-metadata map is read and respread**, because\n *    `setMetadata` replaces the whole map and a takedown must not also be a\n *    silent erasure of customer-set metadata.\n *  * **Fail soft.** A Storage outage must not become a takedown outage: the\n *    deny-list entry is the primary control and lands regardless. The caller\n *    reports what actually happened rather than assuming success.\n *  * **There is no un-rotate, and none is offered.** Releasing a quarantine\n *    does not mint a fresh token: that would hand back a WORKING raw URL\n *    under a new value while every embed of the old one stays broken — it\n *    helps nobody and re-publishes the bytes. The irreversibility is real\n *    and is stated to the operator before they act, not discovered after.\n */\nexport async function rotateDownloadTokenForObject(options: {\n  storagePath?: string | null\n  /** Injectable for tests; defaults to the configured media bucket. */\n  bucket?: any\n}): Promise<ObjectTokenRotation> {\n  const storagePath = String(options?.storagePath ?? '').trim()\n  if (!storagePath) return { rotated: false, reason: 'no-path' }\n\n  let bucket: any\n  try {\n    bucket = options.bucket ?? storageBucket()\n  } catch (error) {\n    console.error('[quarantine] storage bucket unavailable', storagePath, error)\n    return { rotated: false, reason: 'not-configured' }\n  }\n  if (!bucket) return { rotated: false, reason: 'not-configured' }\n\n  try {\n    const file = bucket.file(storagePath)\n    // FETCHED, not read off the handle (AGL-1881). `bucket.file(path)`\n    // constructs a File whose `.metadata` is `{}` until something populates\n    // it — the prefix scan above gets it free because `bucket.getFiles()`\n    // returns hydrated handles, and this function never called anything that\n    // does. So `existing[DOWNLOAD_TOKEN_METADATA_KEY]` was always undefined\n    // and this returned `no-token` for every object, including the ones that\n    // carried a live raw URL. `no-token` is also the CORRECT benign answer,\n    // which is why nothing looked wrong: a takedown reported \"no raw URL to\n    // revoke\" and the operator had no way to tell that apart from a\n    // revocation that ran. A control that exists, is wired, and silently\n    // never fires.\n    const [fetched] = await file.getMetadata()\n    const existing = (fetched?.metadata ?? {}) as Record<string, unknown>\n    if (!existing[DOWNLOAD_TOKEN_METADATA_KEY]) {\n      return { rotated: false, reason: 'no-token' }\n    }\n    await file.setMetadata({\n      metadata: { ...existing, [DOWNLOAD_TOKEN_METADATA_KEY]: randomUUID() },\n    })\n    return { rotated: true, reason: 'rotated' }\n  } catch (error) {\n    console.error('[quarantine] token revocation failed', storagePath, error)\n    return { rotated: false, reason: 'error' }\n  }\n}\n\n/**\n * The object's CURRENT raw download URL, rebuilt from the token it already\n * carries (AGL-1881).\n *\n * The publish half of `POST /api/media/folders {action:'set-private'}`.\n * Turning an asset private now rotates its download token and drops the\n * media document's `url`, so publishing it again has to put a working `url`\n * back — for a free-tier workspace, or any asset predating AGL-829, that\n * field is the ONLY delivery path, and leaving it deleted would make\n * \"Publish\" a one-way door.\n *\n * **This mints nothing.** It reads the token the object already has and\n * reassembles the URL from it, so:\n *\n *  * every URL handed out before the asset went private stays dead — the\n *    rotation is not undone, only re-read;\n *  * an object that never carried a token still does not get one, which is\n *    the same narrowing {@link rotateDownloadTokenForObject} makes and for\n *    the same reason: writing one would MINT a public URL for a file that\n *    never had one.\n *\n * Returns `null` when there is nothing to rebuild, so the caller writes no\n * `url` rather than an empty one.\n */\nexport async function currentDownloadUrlForObject(options: {\n  storagePath?: string | null\n  /** Injectable for tests; defaults to the configured media bucket. */\n  bucket?: any\n}): Promise<string | null> {\n  const storagePath = String(options?.storagePath ?? '').trim()\n  if (!storagePath) return null\n  let bucket: any\n  try {\n    bucket = options.bucket ?? storageBucket()\n  } catch (error) {\n    console.error('[media] storage bucket unavailable', storagePath, error)\n    return null\n  }\n  if (!bucket) return null\n  try {\n    const file = bucket.file(storagePath)\n    const [fetched] = await file.getMetadata()\n    const token = (fetched?.metadata ?? {})[DOWNLOAD_TOKEN_METADATA_KEY]\n    if (!token) return null\n    return (\n      `https://firebasestorage.googleapis.com/v0/b/${bucket.name}/o/` +\n      `${encodeURIComponent(storagePath)}?alt=media&token=${String(token)}`\n    )\n  } catch (error) {\n    console.error('[media] download url read failed', storagePath, error)\n    return null\n  }\n}\n\n/**\n * Rotate across every prefix a lock scope owns.\n *\n * An ORG lock passes `orgs/{orgId}/` AND `hosts/{hostId}/` for each of its\n * sites: org-scope and host-scope libraries are separate Storage trees\n * (`MediaScope.base`), and a lock that cleaned only the org tree would\n * leave every site's own assets serving — which is most of them.\n */\nexport async function rotateScopeDownloadTokens(options: {\n  prefixes: readonly string[]\n  bucket?: any\n  maxObjects?: number\n  budgetMs?: number\n  now?: () => number\n}): Promise<DownloadTokenRotationResult[]> {\n  const results: DownloadTokenRotationResult[] = []\n  for (const prefix of options.prefixes ?? []) {\n    results.push(\n      await rotateDownloadTokensUnderPrefix({\n        prefix,\n        bucket: options.bucket,\n        maxObjects: options.maxObjects,\n        budgetMs: options.budgetMs,\n        now: options.now,\n      }),\n    )\n  }\n  return results\n}\n"],"names":["randomUUID","firebaseAdmin","DOWNLOAD_TOKEN_METADATA_KEY","MAX_ROTATED_OBJECTS","ROTATION_BUDGET_MS","PAGE_SIZE","ROTATE_CONCURRENCY","storageBucket","name","process","env","app","storage","bucket","undefined","lockRotatesDownloadTokens","lock","mode","reason","rotateDownloadTokensUnderPrefix","options","prefix","maxObjects","budgetMs","now","Date","startedAt","result","scanned","rotated","failed","truncated","ok","error","console","pageToken","files","nextQuery","getFiles","maxResults","autoPaginate","batch","Array","isArray","length","index","Promise","all","slice","map","file","rotateOne","existing","metadata","setMetadata","rotateDownloadTokenForObject","storagePath","String","trim","fetched","getMetadata","currentDownloadUrlForObject","token","encodeURIComponent","rotateScopeDownloadTokens","results","prefixes","push"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqEC,GAED,SAASA,UAAU,QAAQ,cAAa;AACxC,SAASC,aAAa,QAAQ,sBAAkB;AAEhD,wEAAwE,GACxE,OAAO,MAAMC,8BAA8B,gCAA+B;AAE1E;;;;CAIC,GACD,OAAO,MAAMC,sBAAsB,KAAI;AACvC,4EAA4E,GAC5E,OAAO,MAAMC,qBAAqB,MAAM;AACxC,qCAAqC,GACrC,MAAMC,YAAY;AAClB,yEAAyE,GACzE,MAAMC,qBAAqB;AAiB3B;;;;CAIC,GACD,SAASC;IACP,MAAMC,OAAOC,QAAQC,GAAG,CAAC,sCAAsC;IAC/D,OAAOT,cAAcU,GAAG,GAAGC,OAAO,GAAGC,MAAM,CAACL,QAAQM;AACtD;AAEA;;;;;;CAMC,GACD,OAAO,SAASC,0BAA0BC,IAGzC;IACC,IAAI,CAACA,MAAM,OAAO;IAClB,IAAIA,KAAKC,IAAI,KAAK,aAAa,OAAO;IACtC,OAAOD,KAAKE,MAAM,KAAK;AACzB;AAEA;;;;;;;;CAQC,GACD,OAAO,eAAeC,gCAAgCC,OAOrD;QAEoBA,qBACFA,mBACLA;IAHZ,MAAM,EAAEC,MAAM,EAAE,GAAGD;IACnB,MAAME,cAAaF,sBAAAA,QAAQE,UAAU,YAAlBF,sBAAsBjB;IACzC,MAAMoB,YAAWH,oBAAAA,QAAQG,QAAQ,YAAhBH,oBAAoBhB;IACrC,MAAMoB,OAAMJ,eAAAA,QAAQI,GAAG,YAAXJ,eAAgB,IAAMK,KAAKD,GAAG;IAC1C,MAAME,YAAYF;IAClB,MAAMG,SAAsC;QAC1CN;QACAO,SAAS;QACTC,SAAS;QACTC,QAAQ;QACRC,WAAW;QACXC,IAAI;QACJd,QAAQ;IACV;IACA,IAAI,CAACG,QAAQ,OAAO,aAAKM;QAAQK,IAAI;QAAOd,QAAQ;;IAEpD,IAAIL;IACJ,IAAI;YACOO;QAATP,UAASO,kBAAAA,QAAQP,MAAM,YAAdO,kBAAkBb;IAC7B,EAAE,OAAO0B,OAAO;QACdC,QAAQD,KAAK,CAAC,yCAAyCZ,QAAQY;QAC/D,OAAO,aAAKN;YAAQK,IAAI;YAAOd,QAAQ;;IACzC;IACA,IAAI,CAACL,QAAQ,OAAO,aAAKc;QAAQK,IAAI;QAAOd,QAAQ;;IAEpD,IAAIiB;IACJ,IAAI;QACF,GAAG;YACD,MAAM,CAACC,OAAOC,UAAU,GAAG,MAAMxB,OAAOyB,QAAQ,CAAC;gBAC/CjB;gBACAkB,YAAYlC;gBACZmC,cAAc;eACVL,YAAY;gBAAEA;YAAU,IAAI,CAAC;YAEnC,MAAMM,QAAeC,MAAMC,OAAO,CAACP,SAASA,QAAQ,EAAE;YACtDT,OAAOC,OAAO,IAAIa,MAAMG,MAAM;YAE9B,IAAK,IAAIC,QAAQ,GAAGA,QAAQJ,MAAMG,MAAM,EAAEC,SAASvC,mBAAoB;gBACrE,MAAMwC,QAAQC,GAAG,CACfN,MACGO,KAAK,CAACH,OAAOA,QAAQvC,oBACrB2C,GAAG,CAAC,CAACC,OAAcC,UAAUD,MAAMvB;YAE1C;YAEAQ,YAAYE,6BAAAA,UAAWF,SAAS;YAChC,IAAIR,OAAOC,OAAO,IAAIN,cAAca,WAAW;gBAC7CR,OAAOI,SAAS,GAAG;gBACnBJ,OAAOT,MAAM,GAAG;gBAChB;YACF;YACA,IAAIM,QAAQE,aAAaH,YAAYY,WAAW;gBAC9CR,OAAOI,SAAS,GAAG;gBACnBJ,OAAOT,MAAM,GAAG;gBAChB;YACF;QACF,QAASiB,UAAU;IACrB,EAAE,OAAOF,OAAO;QACdC,QAAQD,KAAK,CAAC,6CAA6CZ,QAAQY;QACnE,OAAO,aAAKN;YAAQK,IAAI;YAAOd,QAAQ;;IACzC;IAEA,OAAOS;AACT;AAEA;;;;;;;;;CASC,GACD,eAAewB,UACbD,IAAS,EACTvB,MAAmC;;QAEjBuB;IAAlB,MAAME,mBAAYF,yBAAAA,iBAAAA,KAAMG,QAAQ,qBAAdH,eAAgBG,QAAQ,mBAAI,CAAC;IAC/C,uEAAuE;IACvE,qEAAqE;IACrE,IAAI,CAACD,QAAQ,CAAClD,4BAA4B,EAAE;IAC5C,IAAI;QACF,MAAMgD,KAAKI,WAAW,CAAC;YACrBD,UAAU,aAAKD;gBAAU,CAAClD,4BAA4B,EAAEF;;QAC1D;QACA2B,OAAOE,OAAO,IAAI;IACpB,EAAE,OAAOI,OAAO;QACdC,QAAQD,KAAK,CAAC,mCAAmCiB,wBAAAA,KAAM1C,IAAI,EAAEyB;QAC7DN,OAAOG,MAAM,IAAI;IACnB;AACF;AAcA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgCC,GACD,OAAO,eAAeyB,6BAA6BnC,OAIlD;;IACC,MAAMoC,cAAcC,eAAOrC,2BAAAA,QAASoC,WAAW,mBAAI,IAAIE,IAAI;IAC3D,IAAI,CAACF,aAAa,OAAO;QAAE3B,SAAS;QAAOX,QAAQ;IAAU;IAE7D,IAAIL;IACJ,IAAI;YACOO;QAATP,UAASO,kBAAAA,QAAQP,MAAM,YAAdO,kBAAkBb;IAC7B,EAAE,OAAO0B,OAAO;QACdC,QAAQD,KAAK,CAAC,2CAA2CuB,aAAavB;QACtE,OAAO;YAAEJ,SAAS;YAAOX,QAAQ;QAAiB;IACpD;IACA,IAAI,CAACL,QAAQ,OAAO;QAAEgB,SAAS;QAAOX,QAAQ;IAAiB;IAE/D,IAAI;;QACF,MAAMgC,OAAOrC,OAAOqC,IAAI,CAACM;QACzB,mEAAmE;QACnE,wEAAwE;QACxE,sEAAsE;QACtE,yEAAyE;QACzE,wEAAwE;QACxE,yEAAyE;QACzE,wEAAwE;QACxE,wEAAwE;QACxE,gEAAgE;QAChE,qEAAqE;QACrE,eAAe;QACf,MAAM,CAACG,QAAQ,GAAG,MAAMT,KAAKU,WAAW;QACxC,MAAMR,oBAAYO,2BAAAA,QAASN,QAAQ,oBAAI,CAAC;QACxC,IAAI,CAACD,QAAQ,CAAClD,4BAA4B,EAAE;YAC1C,OAAO;gBAAE2B,SAAS;gBAAOX,QAAQ;YAAW;QAC9C;QACA,MAAMgC,KAAKI,WAAW,CAAC;YACrBD,UAAU,aAAKD;gBAAU,CAAClD,4BAA4B,EAAEF;;QAC1D;QACA,OAAO;YAAE6B,SAAS;YAAMX,QAAQ;QAAU;IAC5C,EAAE,OAAOe,OAAO;QACdC,QAAQD,KAAK,CAAC,wCAAwCuB,aAAavB;QACnE,OAAO;YAAEJ,SAAS;YAAOX,QAAQ;QAAQ;IAC3C;AACF;AAEA;;;;;;;;;;;;;;;;;;;;;;;CAuBC,GACD,OAAO,eAAe2C,4BAA4BzC,OAIjD;;IACC,MAAMoC,cAAcC,eAAOrC,2BAAAA,QAASoC,WAAW,mBAAI,IAAIE,IAAI;IAC3D,IAAI,CAACF,aAAa,OAAO;IACzB,IAAI3C;IACJ,IAAI;YACOO;QAATP,UAASO,kBAAAA,QAAQP,MAAM,YAAdO,kBAAkBb;IAC7B,EAAE,OAAO0B,OAAO;QACdC,QAAQD,KAAK,CAAC,sCAAsCuB,aAAavB;QACjE,OAAO;IACT;IACA,IAAI,CAACpB,QAAQ,OAAO;IACpB,IAAI;;QACF,MAAMqC,OAAOrC,OAAOqC,IAAI,CAACM;QACzB,MAAM,CAACG,QAAQ,GAAG,MAAMT,KAAKU,WAAW;QACxC,MAAME,QAAQ,UAACH,2BAAAA,QAASN,QAAQ,oBAAI,CAAC,EAAE,CAACnD,4BAA4B;QACpE,IAAI,CAAC4D,OAAO,OAAO;QACnB,OACE,CAAC,4CAA4C,EAAEjD,OAAOL,IAAI,CAAC,GAAG,CAAC,GAC/D,GAAGuD,mBAAmBP,aAAa,iBAAiB,EAAEC,OAAOK,QAAQ;IAEzE,EAAE,OAAO7B,OAAO;QACdC,QAAQD,KAAK,CAAC,oCAAoCuB,aAAavB;QAC/D,OAAO;IACT;AACF;AAEA;;;;;;;CAOC,GACD,OAAO,eAAe+B,0BAA0B5C,OAM/C;QAEsBA;IADrB,MAAM6C,UAAyC,EAAE;IACjD,KAAK,MAAM5C,WAAUD,oBAAAA,QAAQ8C,QAAQ,YAAhB9C,oBAAoB,EAAE,CAAE;QAC3C6C,QAAQE,IAAI,CACV,MAAMhD,gCAAgC;YACpCE;YACAR,QAAQO,QAAQP,MAAM;YACtBS,YAAYF,QAAQE,UAAU;YAC9BC,UAAUH,QAAQG,QAAQ;YAC1BC,KAAKJ,QAAQI,GAAG;QAClB;IAEJ;IACA,OAAOyC;AACT"}