@andrewheberle/serverless-ssh-ca 0.24.3 → 0.25.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (19) hide show
  1. package/README.md +28 -3
  2. package/dist/node/env.d.ts +1 -0
  3. package/dist/node/env.d.ts.map +1 -1
  4. package/dist/node/env.js +1 -0
  5. package/dist/node/env.js.map +1 -1
  6. package/dist/types.d.ts +7 -0
  7. package/dist/types.d.ts.map +1 -1
  8. package/dist/userinfo.d.ts +47 -0
  9. package/dist/userinfo.d.ts.map +1 -0
  10. package/dist/userinfo.js +112 -0
  11. package/dist/userinfo.js.map +1 -0
  12. package/dist/utils.d.ts.map +1 -1
  13. package/dist/utils.js +29 -0
  14. package/dist/utils.js.map +1 -1
  15. package/package.json +1 -1
  16. package/src/node/env.ts +1 -0
  17. package/src/types.ts +7 -0
  18. package/src/userinfo.ts +128 -0
  19. package/src/utils.ts +31 -0
package/README.md CHANGED
@@ -351,15 +351,40 @@ The `openid` and `email` scopes are required, with enabling of refresh tokens
351
351
  (the `offline_access` scope) being optional, but recommended.
352
352
 
353
353
  `JWT_AUD` must be set to the audience the IdP issues tokens for this
354
- application with (for Cloudflare Access, the application's AUD tag). Both the
355
- access token and the identity token must be issued for this audience, so
354
+ application with (for Cloudflare Access, the application's client ID). Both
355
+ the access token and the identity token must be issued for this audience, so
356
356
  tokens the IdP issues for other applications are not accepted. If the IdP
357
357
  issues access tokens with a different audience to identity tokens, set
358
358
  `JWT_ACCESS_TOKEN_AUD` to the audience of the access token. Either value may
359
359
  be a comma separated list. If `JWT_AUD` is not set, requests that need a
360
360
  token fail with a `500` error.
361
361
 
362
- The `email` claim of the access token must be an email address. It is used as
362
+ Cloudflare Access issues access tokens for the client's redirect URL (for
363
+ example `http://localhost:3000/auth/callback`), so set `JWT_ACCESS_TOKEN_AUD`
364
+ to it. This is safe because the issuer of an Access application includes its
365
+ client ID, so tokens for other applications fail the `JWT_ISSUER` check. With
366
+ IdPs where every application shares an issuer, `JWT_ACCESS_TOKEN_AUD` must be
367
+ an audience that only tokens for this application are issued for.
368
+
369
+ #### Opaque Access Tokens
370
+
371
+ Some IdPs (such as Google) issue access tokens that are not JWTs, so they
372
+ cannot be verified by the CA itself. For these IdPs set `OIDC_USERINFO_URL` to
373
+ the IdP's OIDC userinfo endpoint (the `userinfo_endpoint` of its
374
+ `/.well-known/openid-configuration`). Every access token is then sent to this
375
+ endpoint, which returns the claims of the user the token was issued to,
376
+ instead of being verified as a JWT, and `JWT_ACCESS_TOKEN_AUD` is not used.
377
+
378
+ The userinfo endpoint does not say which application an access token was
379
+ issued to, so with this method an access token is bound to the CA only by its
380
+ `sub` claim matching that of the identity token, which is still verified as a
381
+ JWT issued for `JWT_AUD`. Each certificate request makes a request to the
382
+ userinfo endpoint. A token the endpoint does not accept is refused with a
383
+ `400` error, and if the endpoint cannot be reached or does not respond with a
384
+ JSON object the request fails with a `500` error and the cause is logged.
385
+
386
+ The `email` claim of the access token (or of the userinfo response) must be an
387
+ email address. It is used as
363
388
  the key ID of user certificates, and with `SSH_CERTIFICATE_INCLUDE_SELF` its
364
389
  local part (before the `@`) is added as a principal. If the IdP includes the
365
390
  `email_verified` claim it must be `true`, so tokens for an address the IdP has
package/dist/node/env.d.ts CHANGED
@@ -24,6 +24,7 @@ export declare const EnvSchema: z.ZodObject<{
24
24
  JWT_JWKS_URL: z.ZodURL;
25
25
  JWT_AUD: z.ZodString;
26
26
  JWT_ACCESS_TOKEN_AUD: z.ZodOptional<z.ZodString>;
27
+ OIDC_USERINFO_URL: z.ZodOptional<z.ZodURL>;
27
28
  JWT_ISSUER: z.ZodString;
28
29
  JWT_ALGORITHMS: z.ZodString;
29
30
  JWT_SSH_CERTIFICATE_PRINCIPALS_CLAIM: z.ZodString;
package/dist/node/env.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/node/env.ts"],"names":[],"mappings":"AACA,OAAO,CAAC,MAAM,KAAK,CAAA;AACnB,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAY9F;;;GAGG;AACH,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAuBpB,CAAA;AAEF;;GAEG;AACH,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAA;AAE7C;;GAEG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;IACnD,YAAY,OAAO,EAAE,MAAM,EAK1B;CACD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,eAAe,aACjB;IAAE,EAAE,EAAE,UAAU,CAAC;IAAC,WAAW,EAAE,QAAQ,CAAC;IAAC,YAAY,CAAC,EAAE,aAAa,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,WAC1F,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,KACxC,aAOF,CAAA"}
1
+ {"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/node/env.ts"],"names":[],"mappings":"AACA,OAAO,CAAC,MAAM,KAAK,CAAA;AACnB,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAY9F;;;GAGG;AACH,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAwBpB,CAAA;AAEF;;GAEG;AACH,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAA;AAE7C;;GAEG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;IACnD,YAAY,OAAO,EAAE,MAAM,EAK1B;CACD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,eAAe,aACjB;IAAE,EAAE,EAAE,UAAU,CAAC;IAAC,WAAW,EAAE,QAAQ,CAAC;IAAC,YAAY,CAAC,EAAE,aAAa,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,WAC1F,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,KACxC,aAOF,CAAA"}
package/dist/node/env.js CHANGED
@@ -29,6 +29,7 @@ export const EnvSchema = z.object({
29
29
  JWT_JWKS_URL: z.url({ protocol: /^https?$/, message: "must be an http or https URL" }),
30
30
  JWT_AUD: required,
31
31
  JWT_ACCESS_TOKEN_AUD: z.string().optional(),
32
+ OIDC_USERINFO_URL: z.url({ protocol: /^https?$/, message: "must be an http or https URL" }).optional(),
32
33
  JWT_ISSUER: required,
33
34
  JWT_ALGORITHMS: required,
34
35
  JWT_SSH_CERTIFICATE_PRINCIPALS_CLAIM: required,
package/dist/node/env.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/node/env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,CAAC,MAAM,KAAK,CAAA;AAGnB,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAA;AAErE,qEAAqE;AACrE,MAAM,QAAQ,GAAG,CAAC,IAA4B,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;IACtE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IACpB,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;AAC/D,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,2CAA2C,CAAC,CAAC,CAAC,kDAAkD,EAAE,CAAC,CAAA;AAElI,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC,CAAA;AAEvF;;;GAGG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,wBAAwB,EAAE,CAAC,CAAC,KAAK,CAAC;QACjC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;QACrB,wDAAwD;QACxD,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,0DAA0D,CAAC;KAC5E,EAAE,EAAE,OAAO,EAAE,qDAAqD,EAAE,CAAC;IACtE,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE;IACtC,wBAAwB,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACxD,4BAA4B,EAAE,OAAO,CAAC,QAAQ,EAAE;IAChD,kCAAkC,EAAE,OAAO,CAAC,QAAQ,EAAE;IACtD,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjD,6BAA6B,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC7D,mCAAmC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1D,kCAAkC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzD,SAAS,EAAE,QAAQ;IACnB,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;IACtF,OAAO,EAAE,QAAQ;IACjB,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3C,UAAU,EAAE,QAAQ;IACpB,cAAc,EAAE,QAAQ;IACxB,oCAAoC,EAAE,QAAQ;IAC9C,iCAAiC,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAChE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3E,CAAC,CAAA;AAOF;;GAEG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACnD,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAA;QAEvC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,yBAAyB,CAAC,SAAS,CAAC,CAAA;IACjE,CAAC;CACD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAC9B,QAAkG,EAClG,MAAM,GAAuC,OAAO,CAAC,GAAG,EACxC,EAAE;IAClB,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IAC1C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,yBAAyB,CAAC,2BAA2B,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAChG,CAAC;IAED,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAA;AAC1I,CAAC,CAAA"}
1
+ {"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/node/env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,CAAC,MAAM,KAAK,CAAA;AAGnB,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAA;AAErE,qEAAqE;AACrE,MAAM,QAAQ,GAAG,CAAC,IAA4B,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;IACtE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IACpB,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;AAC/D,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,2CAA2C,CAAC,CAAC,CAAC,kDAAkD,EAAE,CAAC,CAAA;AAElI,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC,CAAA;AAEvF;;;GAGG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,wBAAwB,EAAE,CAAC,CAAC,KAAK,CAAC;QACjC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;QACrB,wDAAwD;QACxD,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,0DAA0D,CAAC;KAC5E,EAAE,EAAE,OAAO,EAAE,qDAAqD,EAAE,CAAC;IACtE,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE;IACtC,wBAAwB,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACxD,4BAA4B,EAAE,OAAO,CAAC,QAAQ,EAAE;IAChD,kCAAkC,EAAE,OAAO,CAAC,QAAQ,EAAE;IACtD,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjD,6BAA6B,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC7D,mCAAmC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1D,kCAAkC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzD,SAAS,EAAE,QAAQ;IACnB,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;IACtF,OAAO,EAAE,QAAQ;IACjB,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3C,iBAAiB,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtG,UAAU,EAAE,QAAQ;IACpB,cAAc,EAAE,QAAQ;IACxB,oCAAoC,EAAE,QAAQ;IAC9C,iCAAiC,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAChE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3E,CAAC,CAAA;AAOF;;GAEG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACnD,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAA;QAEvC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,yBAAyB,CAAC,SAAS,CAAC,CAAA;IACjE,CAAC;CACD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAC9B,QAAkG,EAClG,MAAM,GAAuC,OAAO,CAAC,GAAG,EACxC,EAAE;IAClB,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IAC1C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,yBAAyB,CAAC,2BAA2B,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAChG,CAAC;IAED,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAA;AAC1I,CAAC,CAAA"}
package/dist/types.d.ts CHANGED
@@ -125,6 +125,13 @@ export interface SshCaBindings {
125
125
  JWT_AUD: string | string[];
126
126
  /** The audience the access token must be issued for, when it differs from {@link SshCaBindings.JWT_AUD} */
127
127
  JWT_ACCESS_TOKEN_AUD?: string | string[];
128
+ /**
129
+ * The URL of the IdP's OIDC userinfo endpoint. When set, access tokens are
130
+ * verified by sending them to this endpoint instead of as JWTs, so IdPs
131
+ * that issue opaque access tokens can be used. The access token's audience
132
+ * is not checked, so {@link SshCaBindings.JWT_ACCESS_TOKEN_AUD} is not used.
133
+ */
134
+ OIDC_USERINFO_URL?: string;
128
135
  JWT_ISSUER: string;
129
136
  JWT_JWKS_URL: string;
130
137
  JWT_SSH_CERTIFICATE_PRINCIPALS_CLAIM: string;
package/dist/types.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAA;AAGjC,MAAM,MAAM,wBAAwB,GAAG;IACnC,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,yBAAyB,GAAG;IACpC,WAAW,EAAE,MAAM,CAAA;CACtB,CAAA;AAGD,MAAM,MAAM,4BAA4B,GAAG;IACvC,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;IACX,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,CAAA;CACnC,GAAG,UAAU,CAAA;AAEd;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC7B,kDAAkD;IAClD,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,CAAC,EAAE;QACH,kDAAkD;QAClD,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,yCAAyC;QACzC,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,6DAA6D;QAC7D,QAAQ,CAAC,EAAE,MAAM,CAAA;KACpB,CAAA;CACJ;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAsB,SAAQ,gBAAgB;IAC3D,iEAAiE;IACjE,OAAO,EAAE,OAAO,EAAE,CAAA;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAChC,yEAAyE;IACzE,IAAI,CAAC,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,mBAAmB,CAAA;IAC/C,gDAAgD;IAChD,GAAG,IAAI,OAAO,CAAC,qBAAqB,CAAC,CAAA;IACrC,mDAAmD;IACnD,GAAG,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAAA;CACnC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,UAAU;IACvB,yEAAyE;IACzE,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,mBAAmB,CAAA;IAC3C,kFAAkF;IAClF,KAAK,CAAC,UAAU,EAAE,mBAAmB,EAAE,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAA;IACrE,4DAA4D;IAC5D,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACxC;AAED;;;;GAIG;AACH,MAAM,WAAW,QAAQ;IACrB,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;CACzB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC1B;;;;;OAKG;IACH,KAAK,CAAC,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;CACjE;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,OAAO;IACpB,4DAA4D;IAC5D,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IACxC,+EAA+E;IAC/E,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACvF;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC7B,iCAAiC,EAAE,MAAM,CAAA;IACzC,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACjC,yIAAyI;IACzI,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC1B,2GAA2G;IAC3G,oBAAoB,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACxC,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,oCAAoC,EAAE,MAAM,CAAA;IAC5C,SAAS,CAAC,EAAE,MAAM,CAAA;IACf,wBAAwB,EAAE,MAAM,CAAA;IAChC,EAAE,EAAE,UAAU,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,QAAQ,CAAA;IACrB;;;OAGG;IACH,YAAY,CAAC,EAAE,aAAa,CAAA;IAC5B;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,0BAA0B,EAAE,MAAM,CAAA;IAClC,kCAAkC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IACrD,4BAA4B,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IAC/C,wBAAwB,EAAE,MAAM,CAAA;IAChC,0BAA0B,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC9C,mCAAmC,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACvD,kCAAkC,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACtD,6BAA6B,EAAE,MAAM,CAAA;CACxC"}
1
+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAA;AAGjC,MAAM,MAAM,wBAAwB,GAAG;IACnC,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,yBAAyB,GAAG;IACpC,WAAW,EAAE,MAAM,CAAA;CACtB,CAAA;AAGD,MAAM,MAAM,4BAA4B,GAAG;IACvC,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;IACX,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,CAAA;CACnC,GAAG,UAAU,CAAA;AAEd;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC7B,kDAAkD;IAClD,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,CAAC,EAAE;QACH,kDAAkD;QAClD,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,yCAAyC;QACzC,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,6DAA6D;QAC7D,QAAQ,CAAC,EAAE,MAAM,CAAA;KACpB,CAAA;CACJ;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAsB,SAAQ,gBAAgB;IAC3D,iEAAiE;IACjE,OAAO,EAAE,OAAO,EAAE,CAAA;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAChC,yEAAyE;IACzE,IAAI,CAAC,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,mBAAmB,CAAA;IAC/C,gDAAgD;IAChD,GAAG,IAAI,OAAO,CAAC,qBAAqB,CAAC,CAAA;IACrC,mDAAmD;IACnD,GAAG,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAAA;CACnC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,UAAU;IACvB,yEAAyE;IACzE,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,mBAAmB,CAAA;IAC3C,kFAAkF;IAClF,KAAK,CAAC,UAAU,EAAE,mBAAmB,EAAE,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAA;IACrE,4DAA4D;IAC5D,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACxC;AAED;;;;GAIG;AACH,MAAM,WAAW,QAAQ;IACrB,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;CACzB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC1B;;;;;OAKG;IACH,KAAK,CAAC,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;CACjE;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,OAAO;IACpB,4DAA4D;IAC5D,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IACxC,+EAA+E;IAC/E,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACvF;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC7B,iCAAiC,EAAE,MAAM,CAAA;IACzC,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACjC,yIAAyI;IACzI,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC1B,2GAA2G;IAC3G,oBAAoB,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACxC;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,oCAAoC,EAAE,MAAM,CAAA;IAC5C,SAAS,CAAC,EAAE,MAAM,CAAA;IACf,wBAAwB,EAAE,MAAM,CAAA;IAChC,EAAE,EAAE,UAAU,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,QAAQ,CAAA;IACrB;;;OAGG;IACH,YAAY,CAAC,EAAE,aAAa,CAAA;IAC5B;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,0BAA0B,EAAE,MAAM,CAAA;IAClC,kCAAkC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IACrD,4BAA4B,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IAC/C,wBAAwB,EAAE,MAAM,CAAA;IAChC,0BAA0B,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC9C,mCAAmC,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACvD,kCAAkC,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACtD,6BAA6B,EAAE,MAAM,CAAA;CACxC"}
package/dist/userinfo.d.ts ADDED
@@ -0,0 +1,47 @@
1
+ /**
2
+ * Thrown by {@link userInfoIdentity} when the userinfo endpoint does not
3
+ * accept the access token, as the token is invalid, expired or revoked.
4
+ */
5
+ export declare class UserInfoRejectedError extends Error {
6
+ /** The HTTP status of the response */
7
+ readonly status: number;
8
+ /** The `WWW-Authenticate` header of the response, which says why the token was not accepted */
9
+ readonly authenticate: string | null;
10
+ constructor(status: number, authenticate: string | null);
11
+ }
12
+ /**
13
+ * Thrown by {@link userInfoIdentity} when the claims returned by the userinfo
14
+ * endpoint cannot be used to issue a certificate.
15
+ */
16
+ export declare class UserInfoClaimsError extends Error {
17
+ constructor(message: string);
18
+ }
19
+ /**
20
+ * Thrown by {@link userInfoIdentity} when the userinfo endpoint could not be
21
+ * reached or did not respond as an OIDC userinfo endpoint should.
22
+ */
23
+ export declare class UserInfoUnavailableError extends Error {
24
+ constructor(message: string, cause?: unknown);
25
+ }
26
+ /**
27
+ * Returns the subject and email address of the user an access token was
28
+ * issued to, as returned by the IdP's OIDC userinfo endpoint.
29
+ *
30
+ * This allows access tokens that are not JWTs (opaque tokens) to be used, as
31
+ * the IdP is asked whether the token is valid instead of its signature being
32
+ * checked. The userinfo endpoint does not say which client a token was issued
33
+ * to, so the subject must be checked against an identity token that was
34
+ * verified to be issued for this CA.
35
+ *
36
+ * @param url The URL of the IdP's userinfo endpoint
37
+ * @param token The access token, without the `Bearer ` prefix
38
+ * @returns The `sub` and `email` claims of the user
39
+ * @throws {@link UserInfoRejectedError} when the endpoint does not accept the token
40
+ * @throws {@link UserInfoClaimsError} when the claims returned cannot be used
41
+ * @throws {@link UserInfoUnavailableError} when the endpoint cannot be reached or its response is not valid
42
+ */
43
+ export declare const userInfoIdentity: (url: string, token: string) => Promise<{
44
+ sub: string;
45
+ email: string;
46
+ }>;
47
+ //# sourceMappingURL=userinfo.d.ts.map
package/dist/userinfo.d.ts.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"userinfo.d.ts","sourceRoot":"","sources":["../src/userinfo.ts"],"names":[],"mappings":"AAKA;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAC/C,sCAAsC;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,+FAA+F;IAC/F,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAEpC,YAAY,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,EAOtD;CACD;AAED;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC7C,YAAY,OAAO,EAAE,MAAM,EAK1B;CACD;AAED;;;GAGG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;IAClD,YAAY,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,EAK3C;CACD;AAaD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,gBAAgB,QAAe,MAAM,SAAS,MAAM,KAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAgDzG,CAAA"}
package/dist/userinfo.js ADDED
@@ -0,0 +1,112 @@
1
+ import z from "zod";
2
+ // how long the userinfo endpoint is given to respond
3
+ const UserInfoTimeout = 10_000;
4
+ /**
5
+ * Thrown by {@link userInfoIdentity} when the userinfo endpoint does not
6
+ * accept the access token, as the token is invalid, expired or revoked.
7
+ */
8
+ export class UserInfoRejectedError extends Error {
9
+ /** The HTTP status of the response */
10
+ status;
11
+ /** The `WWW-Authenticate` header of the response, which says why the token was not accepted */
12
+ authenticate;
13
+ constructor(status, authenticate) {
14
+ super(`the userinfo endpoint did not accept the access token (status ${status})`);
15
+ this.name = "UserInfoRejectedError";
16
+ this.status = status;
17
+ this.authenticate = authenticate;
18
+ Object.setPrototypeOf(this, UserInfoRejectedError.prototype);
19
+ }
20
+ }
21
+ /**
22
+ * Thrown by {@link userInfoIdentity} when the claims returned by the userinfo
23
+ * endpoint cannot be used to issue a certificate.
24
+ */
25
+ export class UserInfoClaimsError extends Error {
26
+ constructor(message) {
27
+ super(message);
28
+ this.name = "UserInfoClaimsError";
29
+ Object.setPrototypeOf(this, UserInfoClaimsError.prototype);
30
+ }
31
+ }
32
+ /**
33
+ * Thrown by {@link userInfoIdentity} when the userinfo endpoint could not be
34
+ * reached or did not respond as an OIDC userinfo endpoint should.
35
+ */
36
+ export class UserInfoUnavailableError extends Error {
37
+ constructor(message, cause) {
38
+ super(message, { cause });
39
+ this.name = "UserInfoUnavailableError";
40
+ Object.setPrototypeOf(this, UserInfoUnavailableError.prototype);
41
+ }
42
+ }
43
+ // a userinfo response is a JSON object of claims (OpenID Connect Core 1.0, section 5.3.2)
44
+ const UserInfoResponseSchema = z.record(z.string(), z.unknown());
45
+ // the claims of a userinfo response that a certificate is issued for. As for
46
+ // an access token, email_verified is optional but must be true when included.
47
+ const UserInfoClaimsSchema = z.object({
48
+ sub: z.string().min(1),
49
+ email: z.email(),
50
+ email_verified: z.boolean().optional(),
51
+ });
52
+ /**
53
+ * Returns the subject and email address of the user an access token was
54
+ * issued to, as returned by the IdP's OIDC userinfo endpoint.
55
+ *
56
+ * This allows access tokens that are not JWTs (opaque tokens) to be used, as
57
+ * the IdP is asked whether the token is valid instead of its signature being
58
+ * checked. The userinfo endpoint does not say which client a token was issued
59
+ * to, so the subject must be checked against an identity token that was
60
+ * verified to be issued for this CA.
61
+ *
62
+ * @param url The URL of the IdP's userinfo endpoint
63
+ * @param token The access token, without the `Bearer ` prefix
64
+ * @returns The `sub` and `email` claims of the user
65
+ * @throws {@link UserInfoRejectedError} when the endpoint does not accept the token
66
+ * @throws {@link UserInfoClaimsError} when the claims returned cannot be used
67
+ * @throws {@link UserInfoUnavailableError} when the endpoint cannot be reached or its response is not valid
68
+ */
69
+ export const userInfoIdentity = async (url, token) => {
70
+ let response;
71
+ try {
72
+ response = await fetch(url, {
73
+ headers: {
74
+ "Authorization": `Bearer ${token}`,
75
+ "Accept": "application/json",
76
+ },
77
+ signal: AbortSignal.timeout(UserInfoTimeout),
78
+ });
79
+ }
80
+ catch (err) {
81
+ throw new UserInfoUnavailableError("the userinfo endpoint could not be reached", err);
82
+ }
83
+ if (response.status === 401 || response.status === 403) {
84
+ throw new UserInfoRejectedError(response.status, response.headers.get("WWW-Authenticate"));
85
+ }
86
+ if (!response.ok) {
87
+ throw new UserInfoUnavailableError(`the userinfo endpoint responded with status ${response.status}`);
88
+ }
89
+ let body;
90
+ try {
91
+ body = await response.json();
92
+ }
93
+ catch (err) {
94
+ throw new UserInfoUnavailableError("the userinfo endpoint did not respond with JSON", err);
95
+ }
96
+ const claims = UserInfoResponseSchema.safeParse(body);
97
+ if (!claims.success) {
98
+ throw new UserInfoUnavailableError("the userinfo endpoint did not respond with a JSON object");
99
+ }
100
+ if (claims.data.email === undefined) {
101
+ throw new UserInfoClaimsError("the userinfo response was missing required email claim");
102
+ }
103
+ const parsed = UserInfoClaimsSchema.safeParse(claims.data);
104
+ if (!parsed.success) {
105
+ throw new UserInfoClaimsError("the sub, email or email_verified claim of the userinfo response was not valid");
106
+ }
107
+ if (parsed.data.email_verified === false) {
108
+ throw new UserInfoClaimsError("the email address in the userinfo response has not been verified by the IdP");
109
+ }
110
+ return { sub: parsed.data.sub, email: parsed.data.email };
111
+ };
112
+ //# sourceMappingURL=userinfo.js.map
package/dist/userinfo.js.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"userinfo.js","sourceRoot":"","sources":["../src/userinfo.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAA;AAEnB,qDAAqD;AACrD,MAAM,eAAe,GAAG,MAAM,CAAA;AAE9B;;;GAGG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC/C,sCAAsC;IAC7B,MAAM,CAAQ;IACvB,+FAA+F;IACtF,YAAY,CAAe;IAEpC,YAAY,MAAc,EAAE,YAA2B;QACtD,KAAK,CAAC,iEAAiE,MAAM,GAAG,CAAC,CAAA;QACjF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAA;QACnC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,IAAI,CAAC,YAAY,GAAG,YAAY,CAAA;QAEhC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,qBAAqB,CAAC,SAAS,CAAC,CAAA;IAC7D,CAAC;CACD;AAED;;;GAGG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC7C,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;QAEjC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,mBAAmB,CAAC,SAAS,CAAC,CAAA;IAC3D,CAAC;CACD;AAED;;;GAGG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IAClD,YAAY,OAAe,EAAE,KAAe;QAC3C,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;QACzB,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAA;QAEtC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,wBAAwB,CAAC,SAAS,CAAC,CAAA;IAChE,CAAC;CACD;AAED,0FAA0F;AAC1F,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAA;AAEhE,6EAA6E;AAC7E,8EAA8E;AAC9E,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;IAChB,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAA;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EAAE,GAAW,EAAE,KAAa,EAA2C,EAAE;IAC7G,IAAI,QAAkB,CAAA;IACtB,IAAI,CAAC;QACJ,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,OAAO,EAAE;gBACR,eAAe,EAAE,UAAU,KAAK,EAAE;gBAClC,QAAQ,EAAE,kBAAkB;aAC5B;YACD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC;SAC5C,CAAC,CAAA;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,IAAI,wBAAwB,CAAC,4CAA4C,EAAE,GAAG,CAAC,CAAA;IACtF,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACxD,MAAM,IAAI,qBAAqB,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAA;IAC3F,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,wBAAwB,CAAC,+CAA+C,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;IACrG,CAAC;IAED,IAAI,IAAa,CAAA;IACjB,IAAI,CAAC;QACJ,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,IAAI,wBAAwB,CAAC,iDAAiD,EAAE,GAAG,CAAC,CAAA;IAC3F,CAAC;IAED,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IACrD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,wBAAwB,CAAC,0DAA0D,CAAC,CAAA;IAC/F,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,IAAI,mBAAmB,CAAC,wDAAwD,CAAC,CAAA;IACxF,CAAC;IAED,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAC1D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,mBAAmB,CAAC,+EAA+E,CAAC,CAAA;IAC/G,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,KAAK,KAAK,EAAE,CAAC;QAC1C,MAAM,IAAI,mBAAmB,CAAC,6EAA6E,CAAC,CAAA;IAC7G,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAA;AAC1D,CAAC,CAAA"}
package/dist/utils.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAE/C,OAAO,EAAyB,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC5E,OAAO,EAAqD,SAAS,EAAc,mBAAmB,EAAE,KAAK,UAAU,EAAE,MAAM,eAAe,CAAA;AAC9I,OAAO,CAAC,MAAM,KAAK,CAAA;AAEnB,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAA;AACzD,OAAO,EAAE,wBAAwB,EAAE,iBAAiB,EAAwB,MAAM,YAAY,CAAA;AAC9F,OAAO,KAAK,EAAE,SAAS,IAAI,WAAW,EAAE,MAAM,eAAe,CAAA;AAK7D,OAAO,EAAE,mBAAmB,EAAE,CAAA;AAE9B,eAAO,MAAM,UAAU,QAAS,CAAC,CAAC,aAAa,WAAW,MAAM,OAAO,OAAO,UAQ7E,CAAA;AAED,eAAO,MAAM,0BAA0B,QAAS,aAAa,OAAO,MAAM,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAG,iBAAiB,GAAG,KA0BpI,CAAA;AAED,KAAK,WAAW,GAAG;IAClB,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;CACX,CAAA;AAED;;;GAGG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IACzC,YAAY,OAAO,EAAE,MAAM,EAK1B;CACD;AAID;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,YAAa;IAAE,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,KAAG,MAOzD,CAAA;AAcD;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,YAAa,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAerH,CAAA;AASD,eAAO,MAAM,4BAA4B,QAAe,aAAa,OAAO,MAAM,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,WAAW,GAAG,KAAK,CAuDrI,CAAA;AAOD;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,QAAS,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,aAAa,KAAG,SAAS,GAAG,KA6B5G,CAAA;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,QAAS,SAAS,KAAG,MAAM,GAAG,SAOzD,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,gBAAgB,QAAS,SAAS,OAAO,CAAC,CAAC,aAAa,KAAG,IAKvE,CAAA;AAED;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAC9C,YAAY,OAAO,EAAE,MAAM,EAK1B;CACD;AAID,eAAO,MAAM,kBAAkB,QAAS,aAAa,WAAW,4BAA4B,UAAU,MAAM,KAAG,MAAM,EAsCpH,CAAA;AAED,KAAK,aAAa,GAAG;IACpB,GAAG,EAAE,MAAM,CAAA;IACX,UAAU,EAAE,MAAM,EAAE,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,aAAa,QAAe,aAAa,OAAO,MAAM,GAAG,SAAS,UAAU,MAAM,KAAG,OAAO,CAAC,aAAa,CActH,CAAA;AAED,eAAO,MAAM,sBAAsB,QAAe,aAAa,OAAO,MAAM,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,aAAa,GAAG,KAAK,CAqBjI,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,QAAS,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,aAAa,KAAG,cAAc,GAAG,KA6BnH,CAAA;AAED,KAAK,wBAAwB,GAAG;IAC/B,KAAK,EAAE,iBAAiB,CAAA;IACxB,UAAU,EAAE,SAAS,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,aAAa,CAAA;IACvB,UAAU,EAAE,MAAM,EAAE,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,wBAAwB,QAAe,aAAa,OAAO,wBAAwB,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CAmBrI,CAAA;AAED,eAAO,MAAM,iCAAiC,QAAS,aAAa,OAAO,MAAM,OAAO,CAAC,CAAC,aAAa,KAAG,wBAAwB,GAAG,KAYpI,CAAA;AAED,KAAK,sBAAsB,GAAG;IAC7B,UAAU,EAAE,SAAS,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;CAChB,CAAA;AAED,KAAK,4BAA4B,GAAG;IACnC,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,KAAK,EAAE,iBAAiB,CAAA;CACxB,GAAG,sBAAsB,CAAA;AAE1B,eAAO,MAAM,4BAA4B,QAAe,aAAa,OAAO,4BAA4B,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CA4B7I,CAAA;AAQD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kBAAkB,cAAe,MAAM,KAAG,MAAM,GAAG,SAc/D,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,mBAAmB,QAAS,MAAM,OAAO,CAAC,CAAC,aAAa,KAAG,IAKvE,CAAA;AAED,KAAK,4BAA4B,GAAG;IACnC,WAAW,EAAE,cAAc,CAAA;IAC3B,KAAK,EAAE,wBAAwB,CAAA;CAC/B,GAAG,sBAAsB,CAAA;AAE1B;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,QAAe,aAAa,aAAa,OAAO,WAAW,eAAe,cAAc,KAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CA8C1J,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,0BAA0B,QAAe,aAAa,aAAa,OAAO,WAAW,OAAO;IAAE,WAAW,EAAE,cAAc,CAAA;CAAE,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CAkB7K,CAAA;AAED,eAAO,MAAM,4BAA4B,QAAe,aAAa,aAAa,OAAO,WAAW,OAAO,4BAA4B,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CA6B5K,CAAA;AAED,KAAK,uBAAuB,GAAG;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,SAAS,CAAA;IACrB,KAAK,EAAE,iBAAiB,CAAA;CACxB,CAAA;AAED,eAAO,MAAM,uBAAuB,QAAe,aAAa,OAAO,uBAAuB,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CAmBnI,CAAA;AAED,eAAO,MAAM,KAAK,OAAQ,MAAM,GAAG,MAAM,EAAE,KAAG,MAAM,EAQnD,CAAA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,QAAe,aAAa,KAAG,OAAO,CAAC,UAAU,CAK1E,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,SAAS,QAAe,aAAa,QAAQ,UAAU,KAAG,OAAO,CAAC,SAAS,CAMvF,CAAA"}
1
+ {"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAE/C,OAAO,EAAyB,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC5E,OAAO,EAAqD,SAAS,EAAc,mBAAmB,EAAE,KAAK,UAAU,EAAE,MAAM,eAAe,CAAA;AAC9I,OAAO,CAAC,MAAM,KAAK,CAAA;AAEnB,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAA;AACzD,OAAO,EAAE,wBAAwB,EAAE,iBAAiB,EAAwB,MAAM,YAAY,CAAA;AAC9F,OAAO,KAAK,EAAE,SAAS,IAAI,WAAW,EAAE,MAAM,eAAe,CAAA;AAM7D,OAAO,EAAE,mBAAmB,EAAE,CAAA;AAE9B,eAAO,MAAM,UAAU,QAAS,CAAC,CAAC,aAAa,WAAW,MAAM,OAAO,OAAO,UAQ7E,CAAA;AAED,eAAO,MAAM,0BAA0B,QAAS,aAAa,OAAO,MAAM,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAG,iBAAiB,GAAG,KA0BpI,CAAA;AAED,KAAK,WAAW,GAAG;IAClB,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;CACX,CAAA;AAED;;;GAGG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IACzC,YAAY,OAAO,EAAE,MAAM,EAK1B;CACD;AAID;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,YAAa;IAAE,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,KAAG,MAOzD,CAAA;AAcD;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,YAAa,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAerH,CAAA;AAgCD,eAAO,MAAM,4BAA4B,QAAe,aAAa,OAAO,MAAM,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,WAAW,GAAG,KAAK,CA8DrI,CAAA;AAOD;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,QAAS,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,aAAa,KAAG,SAAS,GAAG,KA6B5G,CAAA;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,QAAS,SAAS,KAAG,MAAM,GAAG,SAOzD,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,gBAAgB,QAAS,SAAS,OAAO,CAAC,CAAC,aAAa,KAAG,IAKvE,CAAA;AAED;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAC9C,YAAY,OAAO,EAAE,MAAM,EAK1B;CACD;AAID,eAAO,MAAM,kBAAkB,QAAS,aAAa,WAAW,4BAA4B,UAAU,MAAM,KAAG,MAAM,EAsCpH,CAAA;AAED,KAAK,aAAa,GAAG;IACpB,GAAG,EAAE,MAAM,CAAA;IACX,UAAU,EAAE,MAAM,EAAE,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,aAAa,QAAe,aAAa,OAAO,MAAM,GAAG,SAAS,UAAU,MAAM,KAAG,OAAO,CAAC,aAAa,CActH,CAAA;AAED,eAAO,MAAM,sBAAsB,QAAe,aAAa,OAAO,MAAM,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,aAAa,GAAG,KAAK,CAqBjI,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,QAAS,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,aAAa,KAAG,cAAc,GAAG,KA6BnH,CAAA;AAED,KAAK,wBAAwB,GAAG;IAC/B,KAAK,EAAE,iBAAiB,CAAA;IACxB,UAAU,EAAE,SAAS,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,aAAa,CAAA;IACvB,UAAU,EAAE,MAAM,EAAE,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,wBAAwB,QAAe,aAAa,OAAO,wBAAwB,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CAmBrI,CAAA;AAED,eAAO,MAAM,iCAAiC,QAAS,aAAa,OAAO,MAAM,OAAO,CAAC,CAAC,aAAa,KAAG,wBAAwB,GAAG,KAYpI,CAAA;AAED,KAAK,sBAAsB,GAAG;IAC7B,UAAU,EAAE,SAAS,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;CAChB,CAAA;AAED,KAAK,4BAA4B,GAAG;IACnC,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,KAAK,EAAE,iBAAiB,CAAA;CACxB,GAAG,sBAAsB,CAAA;AAE1B,eAAO,MAAM,4BAA4B,QAAe,aAAa,OAAO,4BAA4B,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CA4B7I,CAAA;AAQD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kBAAkB,cAAe,MAAM,KAAG,MAAM,GAAG,SAc/D,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,mBAAmB,QAAS,MAAM,OAAO,CAAC,CAAC,aAAa,KAAG,IAKvE,CAAA;AAED,KAAK,4BAA4B,GAAG;IACnC,WAAW,EAAE,cAAc,CAAA;IAC3B,KAAK,EAAE,wBAAwB,CAAA;CAC/B,GAAG,sBAAsB,CAAA;AAE1B;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,QAAe,aAAa,aAAa,OAAO,WAAW,eAAe,cAAc,KAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CA8C1J,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,0BAA0B,QAAe,aAAa,aAAa,OAAO,WAAW,OAAO;IAAE,WAAW,EAAE,cAAc,CAAA;CAAE,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CAkB7K,CAAA;AAED,eAAO,MAAM,4BAA4B,QAAe,aAAa,aAAa,OAAO,WAAW,OAAO,4BAA4B,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CA6B5K,CAAA;AAED,KAAK,uBAAuB,GAAG;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,SAAS,CAAA;IACrB,KAAK,EAAE,iBAAiB,CAAA;CACxB,CAAA;AAED,eAAO,MAAM,uBAAuB,QAAe,aAAa,OAAO,uBAAuB,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CAmBnI,CAAA;AAED,eAAO,MAAM,KAAK,OAAQ,MAAM,GAAG,MAAM,EAAE,KAAG,MAAM,EAQnD,CAAA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,QAAe,aAAa,KAAG,OAAO,CAAC,UAAU,CAK1E,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,SAAS,QAAe,aAAa,QAAQ,UAAU,KAAG,OAAO,CAAC,SAAS,CAMvF,CAAA"}
package/dist/utils.js CHANGED
@@ -5,6 +5,7 @@ import z from "zod";
5
5
  import { MissingAudienceError, verifyJWT } from "./verify.js";
6
6
  import { RenewalProofOfPossession, ProofOfPossession, PossessionParseError } from "./proof.js";
7
7
  import { logger } from "./logger.js";
8
+ import { UserInfoClaimsError, userInfoIdentity, UserInfoRejectedError } from "./userinfo.js";
8
9
  import { ms } from "itty-time";
9
10
  import { InternalServerErrorException } from "chanfana";
10
11
  export { UnsupportedKeyError };
@@ -106,6 +107,28 @@ export const tokenEmail = (payload) => {
106
107
  const claimValidationAttributes = (err) => {
107
108
  return ["claim", err.claim, "reason", err.reason, "value", err.payload[err.claim]];
108
109
  };
110
+ // verifies an access token with the IdP's userinfo endpoint, for IdPs that
111
+ // issue access tokens that are not JWTs
112
+ const userInfoAccessToken = async (env, url, token, val, ctx) => {
113
+ const l = logger(env);
114
+ try {
115
+ return await userInfoIdentity(url, token);
116
+ }
117
+ catch (err) {
118
+ switch (true) {
119
+ case (err instanceof UserInfoRejectedError):
120
+ l.warn(err.message, "in", "transformAuthorizationHeader", "status", err.status, "authenticate", err.authenticate);
121
+ return fatalIssue(ctx, "the access token was not accepted by the userinfo endpoint", val);
122
+ case (err instanceof UserInfoClaimsError):
123
+ l.warn(err.message, "in", "transformAuthorizationHeader");
124
+ return fatalIssue(ctx, err.message, val);
125
+ default:
126
+ // the IdP being unavailable is a server error, not a validation failure
127
+ l.error("the access token could not be verified with the userinfo endpoint", "in", "transformAuthorizationHeader", "error", err);
128
+ throw new InternalServerErrorException("the access token could not be verified with the userinfo endpoint");
129
+ }
130
+ }
131
+ };
109
132
  export const transformAuthorizationHeader = async (env, val, ctx) => {
110
133
  if (!val.startsWith("Bearer ") || val.length <= 7) {
111
134
  return fatalIssue(ctx, "authorization header must be a Bearer token", val);
@@ -115,6 +138,12 @@ export const transformAuthorizationHeader = async (env, val, ctx) => {
115
138
  if (jwt === "") {
116
139
  return fatalIssue(ctx, "request did not contain a JWT", val);
117
140
  }
141
+ // when a userinfo endpoint is configured every access token is verified
142
+ // with it, rather than only those that are not JWTs, so a token cannot
143
+ // avoid the checks of either method by its format
144
+ if (env.OIDC_USERINFO_URL !== undefined && env.OIDC_USERINFO_URL !== "") {
145
+ return userInfoAccessToken(env, env.OIDC_USERINFO_URL, jwt, val, ctx);
146
+ }
118
147
  try {
119
148
  // verify jwt, which must be issued for this CA
120
149
  const aud = split(env.JWT_ACCESS_TOKEN_AUD).length > 0 ? env.JWT_ACCESS_TOKEN_AUD : env.JWT_AUD;
package/dist/utils.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"utils.js","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,8BAA8B,EAAE,wBAAwB,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACnJ,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC5E,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,eAAe,EAAE,SAAS,EAAE,UAAU,EAAE,mBAAmB,EAAmB,MAAM,eAAe,CAAA;AAC9I,OAAO,CAAC,MAAM,KAAK,CAAA;AACnB,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAE7D,OAAO,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAE9F,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,EAAE,EAAE,MAAM,WAAW,CAAA;AAC9B,OAAO,EAAE,4BAA4B,EAAE,MAAM,UAAU,CAAA;AAEvD,OAAO,EAAE,mBAAmB,EAAE,CAAA;AAE9B,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,GAAoB,EAAE,OAAe,EAAE,GAAY,EAAE,EAAE;IACjF,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;QACf,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,OAAO;QAChB,KAAK,EAAE,GAAG;KACV,CAAC,CAAA;IAEF,OAAO,CAAC,CAAC,KAAK,CAAA;AACf,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,GAAkB,EAAE,GAAW,EAAE,GAAkC,EAA6B,EAAE;IAC5I,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,CAAC;QACJ,MAAM,KAAK,GAAG,IAAI,iBAAiB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,iCAAiC,CAAC,EAAE,CAAC,CAAA;QAExG,OAAO,KAAK,CAAA;IACb,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,CAAC,CAAC,KAAK,CAAC,mCAAmC,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QAC1D,QAAQ,IAAI,EAAE,CAAC;YACd,KAAK,CAAC,GAAG,YAAY,oBAAoB,CAAC;gBACzC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;gBACF,MAAK;YACN;gBACC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,+CAA+C;oBACxD,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;AACF,CAAC,CAAA;AAOD;;;GAGG;AACH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACzC,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAA;QAE7B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,eAAe,CAAC,SAAS,CAAC,CAAA;IACvD,CAAC;CACD;AAED,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;AAE5C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAA0B,EAAU,EAAE;IAClE,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACxD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,eAAe,CAAC,qDAAqD,CAAC,CAAA;IACjF,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAA;AACnB,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;IAChB,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAA;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,OAAgC,EAA8D,EAAE;IAC1H,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,uDAAuD,EAAE,CAAA;IACrF,CAAC;IAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;IACnD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sEAAsE,EAAE,CAAA;IACpG,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,KAAK,KAAK,EAAE,CAAC;QAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yEAAyE,EAAE,CAAA;IACvG,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAA;AAC9C,CAAC,CAAA;AAED,gFAAgF;AAChF,2EAA2E;AAC3E,6EAA6E;AAC7E,MAAM,yBAAyB,GAAG,CAAC,GAA6B,EAAa,EAAE;IAC9E,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;AACnF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,EAAE,GAAkB,EAAE,GAAW,EAAE,GAAoB,EAAgC,EAAE;IACzI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACnD,OAAO,UAAU,CAAC,GAAG,EAAE,6CAA6C,EAAE,GAAG,CAAC,CAAA;IAC3E,CAAC;IAED,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;IACtC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IAErB,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QAChB,OAAO,UAAU,CAAC,GAAG,EAAE,+BAA+B,EAAE,GAAG,CAAC,CAAA;IAC7D,CAAC;IAED,IAAI,CAAC;QACJ,+CAA+C;QAC/C,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAA;QAC/F,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;QAElD,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAA;QACjC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACf,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,8BAA8B,CAAC,CAAA;YACzD,OAAO,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;QACzC,CAAC;QAED,OAAO;YACN,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,GAAG,EAAE,YAAY,CAAC,OAAO,CAAC;SAC1B,CAAA;IACF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,QAAQ,IAAI,EAAE,CAAC;YACd,KAAK,CAAC,GAAG,YAAY,oBAAoB,CAAC;gBACzC,iEAAiE;gBACjE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,8BAA8B,CAAC,CAAA;gBAC1D,MAAM,IAAI,4BAA4B,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACpD,KAAK,CAAC,GAAG,YAAY,eAAe,CAAC;gBACpC,OAAO,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;YACzC,KAAK,CAAC,GAAG,YAAY,UAAU,CAAC;gBAC/B,OAAO,UAAU,CAAC,GAAG,EAAE,8BAA8B,EAAE,GAAG,CAAC,CAAA;YAC5D,KAAK,CAAC,GAAG,YAAY,UAAU,CAAC;gBAC/B,OAAO,UAAU,CAAC,GAAG,EAAE,sCAAsC,EAAE,GAAG,CAAC,CAAA;YACpE,KAAK,CAAC,GAAG,YAAY,UAAU,CAAC;gBAC/B,OAAO,UAAU,CAAC,GAAG,EAAE,kCAAkC,EAAE,GAAG,CAAC,CAAA;YAChE,KAAK,CAAC,GAAG,YAAY,WAAW,CAAC;gBAChC,OAAO,UAAU,CAAC,GAAG,EAAE,mCAAmC,EAAE,GAAG,CAAC,CAAA;YACjE,KAAK,CAAC,GAAG,YAAY,wBAAwB,CAAC;gBAC7C,CAAC,CAAC,IAAI,CAAC,6CAA6C,EAAE,IAAI,EAAE,8BAA8B,EAAE,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAA;gBAC9H,OAAO,UAAU,CAAC,GAAG,EAAE,oCAAoC,EAAE,GAAG,CAAC,CAAA;YAClE,KAAK,CAAC,GAAG,YAAY,UAAU,CAAC;gBAC/B,OAAO,UAAU,CAAC,GAAG,EAAE,8BAA8B,EAAE,GAAG,CAAC,CAAA;YAC5D,KAAK,CAAC,GAAG,YAAY,8BAA8B,CAAC;gBACnD,OAAO,UAAU,CAAC,GAAG,EAAE,gDAAgD,EAAE,GAAG,CAAC,CAAA;YAC9E;gBACC,CAAC,CAAC,KAAK,CAAC,yCAAyC,EAAE,IAAI,EAAE,8BAA8B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;gBACtG,OAAO,UAAU,CAAC,GAAG,EAAE,yCAAyC,EAAE,GAAG,CAAC,CAAA;QACxE,CAAC;IACF,CAAC;AACF,CAAC,CAAA;AAED,oFAAoF;AACpF,MAAM,UAAU,GAAG,CAAC,GAAqC,EAAU,EAAE;IACpE,OAAO,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;AAClG,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAqC,EAAE,GAAoB,EAAqB,EAAE;IACpH,IAAI,CAAC;QACJ,OAAO,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,QAAQ,IAAI,EAAE,CAAC;YACd,KAAK,CAAC,GAAG,YAAY,SAAS,CAAC;gBAC9B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;gBACF,MAAK;YACN,KAAK,CAAC,GAAG,YAAY,aAAa,CAAC;gBAClC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;gBACF,MAAK;YACN;gBACC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,oCAAoC;oBAC7C,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;AACF,CAAC,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,GAAc,EAAsB,EAAE;IACrE,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAA;IAC5B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,GAAG,iBAAiB,EAAE,CAAC;QACpD,OAAO,6BAA6B,iBAAiB,cAAc,IAAI,EAAE,CAAA;IAC1E,CAAC;IAED,OAAO,SAAS,CAAA;AACjB,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,GAAc,EAAE,GAAoB,EAAQ,EAAE;IAC9E,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;IAClC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,UAAU,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAA;IACvC,CAAC;AACF,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC9C,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAA;QAElC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,oBAAoB,CAAC,SAAS,CAAC,CAAA;IAC5D,CAAC;CACD;AAED,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAA;AAElF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAkB,EAAE,OAAqC,EAAE,KAAc,EAAY,EAAE;IACzH,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,KAAK,GAAG,GAAG,CAAC,oCAAoC,CAAA;IACjD,CAAC;IAED,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IAErB,6DAA6D;IAC7D,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAA;IAC9D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,CAAC,CAAC,IAAI,CAAC,+CAA+C,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QACvE,MAAM,IAAI,oBAAoB,CAAC,OAAO,KAAK,gDAAgD,CAAC,CAAA;IAC7F,CAAC;IAEA,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAA;IAEtB,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;QACrB,CAAC,CAAC,IAAI,CAAC,kDAAkD,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QAC1E,OAAO,EAAE,CAAA;IACV,CAAC;IAED,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QAChB,CAAC,CAAC,IAAI,CAAC,gCAAgC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QACxD,OAAO,EAAE,CAAA;IACV,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;QACd,CAAC,CAAC,IAAI,CAAC,2CAA2C,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QACnE,OAAO,EAAE,CAAA;IACV,CAAC;IAED,0EAA0E;IAC1E,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACjD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;IAE7C,CAAC,CAAC,KAAK,CAAC,oCAAoC,EAAE,YAAY,EAAE,UAAU,CAAC,CAAA;IAEvE,OAAO,UAAU,CAAA;AAClB,CAAC,CAAA;AAOD,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,GAAkB,EAAE,GAAuB,EAAE,KAAc,EAA0B,EAAE;IAC1H,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAA;IAC1C,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;IAE1D,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA;IACjC,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;IAE1D,OAAO;QACN,GAAG,EAAE,GAAG;QACR,UAAU,EAAE,UAAU;KACtB,CAAA;AACF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,EAAE,GAAkB,EAAE,GAAW,EAAE,GAAoB,EAAkC,EAAE;IACrI,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,oCAAoC,CAAC,CAAA;QAExF,OAAO,QAAQ,CAAA;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,iEAAiE;QACjE,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;YACzC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,wBAAwB,CAAC,CAAA;YAC9D,MAAM,IAAI,4BAA4B,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACpD,CAAC;QACD,IAAI,GAAG,YAAY,wBAAwB,EAAE,CAAC;YAC7C,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,+CAA+C,EAAE,IAAI,EAAE,wBAAwB,EAAE,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAA;QACrI,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,GAAG,YAAY,oBAAoB,IAAI,GAAG,YAAY,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,gCAAgC;YAC/H,KAAK,EAAE,GAAG;SACV,CAAC,CAAA;QACF,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;AACF,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,GAAqC,EAAE,GAAoB,EAA0B,EAAE;IAC3H,IAAI,CAAC;QACJ,OAAO,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;IAC7C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,QAAQ,IAAI,EAAE,CAAC;YACd,KAAK,CAAC,GAAG,YAAY,SAAS,CAAC;gBAC9B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;gBACF,MAAK;YACN,KAAK,CAAC,GAAG,YAAY,qBAAqB,CAAC;gBAC1C,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;gBACF,MAAK;YACN;gBACC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,qCAAqC;oBAC9C,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;AACF,CAAC,CAAA;AAUD,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,EAAE,GAAkB,EAAE,GAA6B,EAAE,GAAoB,EAAkB,EAAE;IACzI,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,CAAC;QACJ,2DAA2D;QAC3D,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACxC,OAAO,UAAU,CAAC,GAAG,EAAE,0DAA0D,EAAE,GAAG,CAAC,CAAA;QACxF,CAAC;QAED,uCAAuC;QACvC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,OAAO,UAAU,CAAC,GAAG,EAAE,iDAAiD,EAAE,GAAG,CAAC,CAAA;QAC/E,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,CAAC,CAAC,KAAK,CAAC,kDAAkD,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QAC3G,OAAO,UAAU,CAAC,GAAG,EAAE,kDAAkD,EAAE,GAAG,CAAC,CAAA;IAChF,CAAC;AACF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,GAAkB,EAAE,GAAW,EAAE,GAAoB,EAAoC,EAAE;IAC5I,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,CAAC;QACJ,OAAO,IAAI,wBAAwB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,iCAAiC,CAAC,EAAE,CAAC,CAAA;IACzG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;YACzC,OAAO,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QACzC,CAAC;QAED,CAAC,CAAC,KAAK,CAAC,kDAAkD,EAAE,IAAI,EAAE,mCAAmC,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QACpH,OAAO,UAAU,CAAC,GAAG,EAAE,+CAA+C,EAAE,GAAG,CAAC,CAAA;IAC7E,CAAC;AACF,CAAC,CAAA;AAYD,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,EAAE,GAAkB,EAAE,GAAiC,EAAE,GAAoB,EAAkB,EAAE;IACjJ,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,8BAA8B,CAAC,CAAA;IAEhE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IAElB,IAAI,CAAC;QACJ,2DAA2D;QAC3D,CAAC,CAAC,KAAK,CAAC,8BAA8B,EAAE,YAAY,EAAE,GAAG,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACxC,CAAC,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAA;YAClE,OAAO,UAAU,CAAC,GAAG,EAAE,0DAA0D,EAAE,GAAG,CAAC,CAAA;QACxF,CAAC;QAED,uCAAuC;QACvC,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAA;QACnC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,CAAC,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAA;YACzD,OAAO,UAAU,CAAC,GAAG,EAAE,iDAAiD,EAAE,GAAG,CAAC,CAAA;QAC/E,CAAC;QAED,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAEf,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,CAAC,CAAC,KAAK,CAAC,kDAAkD,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QACzE,OAAO,UAAU,CAAC,GAAG,EAAE,kDAAkD,EAAE,GAAG,CAAC,CAAA;IAChF,CAAC;AACF,CAAC,CAAA;AAED,sEAAsE;AACtE,qEAAqE;AACrE,MAAM,yBAAyB,GAAG,QAAQ,CAAA;AAC1C,iEAAiE;AACjE,MAAM,yBAAyB,GAAG,aAAa,CAAA;AAE/C;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,SAAiB,EAAsB,EAAE;IAC3E,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QACtB,OAAO,+CAA+C,CAAA;IACvD,CAAC;IAED,IAAI,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/C,OAAO,8BAA8B,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,iEAAiE,CAAA;IAChI,CAAC;IAED,IAAI,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/C,OAAO,8BAA8B,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,oDAAoD,CAAA;IACnH,CAAC;IAED,OAAO,SAAS,CAAA;AACjB,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,GAAW,EAAE,GAAoB,EAAQ,EAAE;IAC9E,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;IACrC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,UAAU,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,CAAA;IAC5B,CAAC;AACF,CAAC,CAAA;AAOD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,EAAE,GAAkB,EAAE,SAA6B,EAAE,WAA2B,EAA+B,EAAE;IAC9J,qCAAqC;IACrC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAA;IACnC,IAAI,CAAC,MAAM,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3C,OAAO,oDAAoD,CAAA;IAC5D,CAAC;IAED,sEAAsE;IACtE,wDAAwD;IACxD,IAAI,WAAW,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACjC,OAAO,oDAAoD,CAAA;IAC5D,CAAC;IAED,sEAAsE;IACtE,6CAA6C;IAC7C,MAAM,QAAQ,GAAG,eAAe,CAAC,WAAW,CAAC,SAAS,CAAC,CAAA;IACvD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,+CAA+C,QAAQ,EAAE,CAAA;IACjE,CAAC;IAED,wEAAwE;IACxE,uDAAuD;IACvD,KAAK,MAAM,SAAS,IAAI,WAAW,CAAC,UAAU,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAA;QAC3C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,+CAA+C,KAAK,EAAE,CAAA;QAC9D,CAAC;IACF,CAAC;IAED,sEAAsE;IACtE,mEAAmE;IACnE,8CAA8C;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACtB,IAAI,GAAG,IAAI,WAAW,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9C,OAAO,qCAAqC,CAAA;IAC7C,CAAC;IACD,IAAI,WAAW,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,iCAAiC,CAAC,EAAE,CAAC;QACxF,OAAO,2CAA2C,CAAA;IACnD,CAAC;IAED,0DAA0D;IAC1D,IAAI,MAAM,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9C,OAAO,qCAAqC,CAAA;IAC7C,CAAC;IAED,OAAO,SAAS,CAAA;AACjB,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,KAAK,EAAE,GAAkB,EAAE,SAA6B,EAAE,GAAoC,EAAE,GAAoB,EAAkB,EAAE;IACjL,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,WAAW,CAAC,CAAA;QAC/E,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,CAAA;QACpC,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,qEAAqE;QACrE,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;YACxC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,4BAA4B,CAAC,CAAA;YACxD,MAAM,IAAI,4BAA4B,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACpD,CAAC;QACD,CAAC,CAAC,KAAK,CAAC,2CAA2C,EAAE,IAAI,EAAE,4BAA4B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QACtG,OAAO,UAAU,CAAC,GAAG,EAAE,2CAA2C,EAAE,GAAG,CAAC,CAAA;IACzE,CAAC;AACF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,EAAE,GAAkB,EAAE,SAA6B,EAAE,GAAiC,EAAE,GAAoB,EAAkB,EAAE;IAChL,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,WAAW,CAAC,CAAA;QAC/E,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,CAAA;QACpC,CAAC;QAED,uFAAuF;QACvF,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;YACnE,OAAO,UAAU,CAAC,GAAG,EAAE,8EAA8E,EAAE,GAAG,CAAC,CAAA;QAC5G,CAAC;QAED,uCAAuC;QACvC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,OAAO,UAAU,CAAC,GAAG,EAAE,iDAAiD,EAAE,GAAG,CAAC,CAAA;QAC/E,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,qEAAqE;QACrE,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;YACxC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,8BAA8B,CAAC,CAAA;YAC1D,MAAM,IAAI,4BAA4B,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACpD,CAAC;QACD,CAAC,CAAC,KAAK,CAAC,kDAAkD,EAAE,IAAI,EAAE,8BAA8B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QAC/G,OAAO,UAAU,CAAC,GAAG,EAAE,kDAAkD,EAAE,GAAG,CAAC,CAAA;IAChF,CAAC;AACF,CAAC,CAAA;AAQD,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,EAAE,GAAkB,EAAE,GAA4B,EAAE,GAAoB,EAAkB,EAAE;IACvI,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,CAAC;QACJ,2DAA2D;QAC3D,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACxC,OAAO,UAAU,CAAC,GAAG,EAAE,0DAA0D,EAAE,GAAG,CAAC,CAAA;QACxF,CAAC;QAED,uCAAuC;QACvC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,OAAO,UAAU,CAAC,GAAG,EAAE,iDAAiD,EAAE,GAAG,CAAC,CAAA;QAC/E,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,CAAC,CAAC,KAAK,CAAC,kDAAkD,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QAC1G,OAAO,UAAU,CAAC,GAAG,EAAE,kDAAkD,EAAE,GAAG,CAAC,CAAA;IAChF,CAAC;AACF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAqB,EAAY,EAAE;IACxD,OAAO,CAAC,KAAK,SAAS;QACrB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ;YACtB,CAAC,CAAC,CAAC,KAAK,EAAE;gBACT,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;YACf,CAAC,CAAC,CAAC,CAAA;AACN,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,GAAkB,EAAuB,EAAE;IAC9E,qCAAqC;IACrC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,WAAW,CAAC,GAAG,EAAE,CAAA;IAE1C,OAAO,eAAe,CAAC,MAAM,CAAC,CAAA;AAC/B,CAAC,CAAA;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,EAAE,GAAkB,EAAE,GAAgB,EAAsB,EAAE;IAC3F,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACvB,GAAG,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAA;IAC/B,CAAC;IAED,OAAO,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;AAChD,CAAC,CAAA"}
1
+ {"version":3,"file":"utils.js","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,8BAA8B,EAAE,wBAAwB,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACnJ,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC5E,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,eAAe,EAAE,SAAS,EAAE,UAAU,EAAE,mBAAmB,EAAmB,MAAM,eAAe,CAAA;AAC9I,OAAO,CAAC,MAAM,KAAK,CAAA;AACnB,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAE7D,OAAO,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAE9F,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAA;AAC5F,OAAO,EAAE,EAAE,EAAE,MAAM,WAAW,CAAA;AAC9B,OAAO,EAAE,4BAA4B,EAAE,MAAM,UAAU,CAAA;AAEvD,OAAO,EAAE,mBAAmB,EAAE,CAAA;AAE9B,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,GAAoB,EAAE,OAAe,EAAE,GAAY,EAAE,EAAE;IACjF,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;QACf,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,OAAO;QAChB,KAAK,EAAE,GAAG;KACV,CAAC,CAAA;IAEF,OAAO,CAAC,CAAC,KAAK,CAAA;AACf,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,GAAkB,EAAE,GAAW,EAAE,GAAkC,EAA6B,EAAE;IAC5I,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,CAAC;QACJ,MAAM,KAAK,GAAG,IAAI,iBAAiB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,iCAAiC,CAAC,EAAE,CAAC,CAAA;QAExG,OAAO,KAAK,CAAA;IACb,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,CAAC,CAAC,KAAK,CAAC,mCAAmC,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QAC1D,QAAQ,IAAI,EAAE,CAAC;YACd,KAAK,CAAC,GAAG,YAAY,oBAAoB,CAAC;gBACzC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;gBACF,MAAK;YACN;gBACC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,+CAA+C;oBACxD,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;AACF,CAAC,CAAA;AAOD;;;GAGG;AACH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACzC,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAA;QAE7B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,eAAe,CAAC,SAAS,CAAC,CAAA;IACvD,CAAC;CACD;AAED,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;AAE5C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAA0B,EAAU,EAAE;IAClE,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACxD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,eAAe,CAAC,qDAAqD,CAAC,CAAA;IACjF,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAA;AACnB,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;IAChB,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAA;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,OAAgC,EAA8D,EAAE;IAC1H,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,uDAAuD,EAAE,CAAA;IACrF,CAAC;IAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;IACnD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sEAAsE,EAAE,CAAA;IACpG,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,KAAK,KAAK,EAAE,CAAC;QAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yEAAyE,EAAE,CAAA;IACvG,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAA;AAC9C,CAAC,CAAA;AAED,gFAAgF;AAChF,2EAA2E;AAC3E,6EAA6E;AAC7E,MAAM,yBAAyB,GAAG,CAAC,GAA6B,EAAa,EAAE;IAC9E,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;AACnF,CAAC,CAAA;AAED,2EAA2E;AAC3E,wCAAwC;AACxC,MAAM,mBAAmB,GAAG,KAAK,EAAE,GAAkB,EAAE,GAAW,EAAE,KAAa,EAAE,GAAW,EAAE,GAAoB,EAAgC,EAAE;IACrJ,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IAErB,IAAI,CAAC;QACJ,OAAO,MAAM,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,QAAQ,IAAI,EAAE,CAAC;YACd,KAAK,CAAC,GAAG,YAAY,qBAAqB,CAAC;gBAC1C,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,8BAA8B,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,GAAG,CAAC,YAAY,CAAC,CAAA;gBACjH,OAAO,UAAU,CAAC,GAAG,EAAE,4DAA4D,EAAE,GAAG,CAAC,CAAA;YAC1F,KAAK,CAAC,GAAG,YAAY,mBAAmB,CAAC;gBACxC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,8BAA8B,CAAC,CAAA;gBACzD,OAAO,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;YACzC;gBACC,wEAAwE;gBACxE,CAAC,CAAC,KAAK,CAAC,mEAAmE,EAAE,IAAI,EAAE,8BAA8B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;gBAChI,MAAM,IAAI,4BAA4B,CAAC,mEAAmE,CAAC,CAAA;QAC7G,CAAC;IACF,CAAC;AACF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,EAAE,GAAkB,EAAE,GAAW,EAAE,GAAoB,EAAgC,EAAE;IACzI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACnD,OAAO,UAAU,CAAC,GAAG,EAAE,6CAA6C,EAAE,GAAG,CAAC,CAAA;IAC3E,CAAC;IAED,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;IACtC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IAErB,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QAChB,OAAO,UAAU,CAAC,GAAG,EAAE,+BAA+B,EAAE,GAAG,CAAC,CAAA;IAC7D,CAAC;IAED,wEAAwE;IACxE,uEAAuE;IACvE,kDAAkD;IAClD,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS,IAAI,GAAG,CAAC,iBAAiB,KAAK,EAAE,EAAE,CAAC;QACzE,OAAO,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,iBAAiB,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IACtE,CAAC;IAED,IAAI,CAAC;QACJ,+CAA+C;QAC/C,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAA;QAC/F,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;QAElD,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAA;QACjC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACf,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,8BAA8B,CAAC,CAAA;YACzD,OAAO,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;QACzC,CAAC;QAED,OAAO;YACN,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,GAAG,EAAE,YAAY,CAAC,OAAO,CAAC;SAC1B,CAAA;IACF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,QAAQ,IAAI,EAAE,CAAC;YACd,KAAK,CAAC,GAAG,YAAY,oBAAoB,CAAC;gBACzC,iEAAiE;gBACjE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,8BAA8B,CAAC,CAAA;gBAC1D,MAAM,IAAI,4BAA4B,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACpD,KAAK,CAAC,GAAG,YAAY,eAAe,CAAC;gBACpC,OAAO,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;YACzC,KAAK,CAAC,GAAG,YAAY,UAAU,CAAC;gBAC/B,OAAO,UAAU,CAAC,GAAG,EAAE,8BAA8B,EAAE,GAAG,CAAC,CAAA;YAC5D,KAAK,CAAC,GAAG,YAAY,UAAU,CAAC;gBAC/B,OAAO,UAAU,CAAC,GAAG,EAAE,sCAAsC,EAAE,GAAG,CAAC,CAAA;YACpE,KAAK,CAAC,GAAG,YAAY,UAAU,CAAC;gBAC/B,OAAO,UAAU,CAAC,GAAG,EAAE,kCAAkC,EAAE,GAAG,CAAC,CAAA;YAChE,KAAK,CAAC,GAAG,YAAY,WAAW,CAAC;gBAChC,OAAO,UAAU,CAAC,GAAG,EAAE,mCAAmC,EAAE,GAAG,CAAC,CAAA;YACjE,KAAK,CAAC,GAAG,YAAY,wBAAwB,CAAC;gBAC7C,CAAC,CAAC,IAAI,CAAC,6CAA6C,EAAE,IAAI,EAAE,8BAA8B,EAAE,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAA;gBAC9H,OAAO,UAAU,CAAC,GAAG,EAAE,oCAAoC,EAAE,GAAG,CAAC,CAAA;YAClE,KAAK,CAAC,GAAG,YAAY,UAAU,CAAC;gBAC/B,OAAO,UAAU,CAAC,GAAG,EAAE,8BAA8B,EAAE,GAAG,CAAC,CAAA;YAC5D,KAAK,CAAC,GAAG,YAAY,8BAA8B,CAAC;gBACnD,OAAO,UAAU,CAAC,GAAG,EAAE,gDAAgD,EAAE,GAAG,CAAC,CAAA;YAC9E;gBACC,CAAC,CAAC,KAAK,CAAC,yCAAyC,EAAE,IAAI,EAAE,8BAA8B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;gBACtG,OAAO,UAAU,CAAC,GAAG,EAAE,yCAAyC,EAAE,GAAG,CAAC,CAAA;QACxE,CAAC;IACF,CAAC;AACF,CAAC,CAAA;AAED,oFAAoF;AACpF,MAAM,UAAU,GAAG,CAAC,GAAqC,EAAU,EAAE;IACpE,OAAO,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;AAClG,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAqC,EAAE,GAAoB,EAAqB,EAAE;IACpH,IAAI,CAAC;QACJ,OAAO,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,QAAQ,IAAI,EAAE,CAAC;YACd,KAAK,CAAC,GAAG,YAAY,SAAS,CAAC;gBAC9B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;gBACF,MAAK;YACN,KAAK,CAAC,GAAG,YAAY,aAAa,CAAC;gBAClC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;gBACF,MAAK;YACN;gBACC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,oCAAoC;oBAC7C,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;AACF,CAAC,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,GAAc,EAAsB,EAAE;IACrE,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAA;IAC5B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,GAAG,iBAAiB,EAAE,CAAC;QACpD,OAAO,6BAA6B,iBAAiB,cAAc,IAAI,EAAE,CAAA;IAC1E,CAAC;IAED,OAAO,SAAS,CAAA;AACjB,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,GAAc,EAAE,GAAoB,EAAQ,EAAE;IAC9E,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;IAClC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,UAAU,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAA;IACvC,CAAC;AACF,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC9C,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAA;QAElC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,oBAAoB,CAAC,SAAS,CAAC,CAAA;IAC5D,CAAC;CACD;AAED,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAA;AAElF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAkB,EAAE,OAAqC,EAAE,KAAc,EAAY,EAAE;IACzH,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,KAAK,GAAG,GAAG,CAAC,oCAAoC,CAAA;IACjD,CAAC;IAED,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IAErB,6DAA6D;IAC7D,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAA;IAC9D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,CAAC,CAAC,IAAI,CAAC,+CAA+C,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QACvE,MAAM,IAAI,oBAAoB,CAAC,OAAO,KAAK,gDAAgD,CAAC,CAAA;IAC7F,CAAC;IAEA,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAA;IAEtB,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;QACrB,CAAC,CAAC,IAAI,CAAC,kDAAkD,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QAC1E,OAAO,EAAE,CAAA;IACV,CAAC;IAED,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QAChB,CAAC,CAAC,IAAI,CAAC,gCAAgC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QACxD,OAAO,EAAE,CAAA;IACV,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;QACd,CAAC,CAAC,IAAI,CAAC,2CAA2C,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QACnE,OAAO,EAAE,CAAA;IACV,CAAC;IAED,0EAA0E;IAC1E,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACjD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;IAE7C,CAAC,CAAC,KAAK,CAAC,oCAAoC,EAAE,YAAY,EAAE,UAAU,CAAC,CAAA;IAEvE,OAAO,UAAU,CAAA;AAClB,CAAC,CAAA;AAOD,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,GAAkB,EAAE,GAAuB,EAAE,KAAc,EAA0B,EAAE;IAC1H,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAA;IAC1C,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;IAE1D,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA;IACjC,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;IAE1D,OAAO;QACN,GAAG,EAAE,GAAG;QACR,UAAU,EAAE,UAAU;KACtB,CAAA;AACF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,EAAE,GAAkB,EAAE,GAAW,EAAE,GAAoB,EAAkC,EAAE;IACrI,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,oCAAoC,CAAC,CAAA;QAExF,OAAO,QAAQ,CAAA;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,iEAAiE;QACjE,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;YACzC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,wBAAwB,CAAC,CAAA;YAC9D,MAAM,IAAI,4BAA4B,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACpD,CAAC;QACD,IAAI,GAAG,YAAY,wBAAwB,EAAE,CAAC;YAC7C,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,+CAA+C,EAAE,IAAI,EAAE,wBAAwB,EAAE,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAA;QACrI,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,GAAG,YAAY,oBAAoB,IAAI,GAAG,YAAY,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,gCAAgC;YAC/H,KAAK,EAAE,GAAG;SACV,CAAC,CAAA;QACF,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;AACF,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,GAAqC,EAAE,GAAoB,EAA0B,EAAE;IAC3H,IAAI,CAAC;QACJ,OAAO,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;IAC7C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,QAAQ,IAAI,EAAE,CAAC;YACd,KAAK,CAAC,GAAG,YAAY,SAAS,CAAC;gBAC9B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;gBACF,MAAK;YACN,KAAK,CAAC,GAAG,YAAY,qBAAqB,CAAC;gBAC1C,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;gBACF,MAAK;YACN;gBACC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,qCAAqC;oBAC9C,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;AACF,CAAC,CAAA;AAUD,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,EAAE,GAAkB,EAAE,GAA6B,EAAE,GAAoB,EAAkB,EAAE;IACzI,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,CAAC;QACJ,2DAA2D;QAC3D,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACxC,OAAO,UAAU,CAAC,GAAG,EAAE,0DAA0D,EAAE,GAAG,CAAC,CAAA;QACxF,CAAC;QAED,uCAAuC;QACvC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,OAAO,UAAU,CAAC,GAAG,EAAE,iDAAiD,EAAE,GAAG,CAAC,CAAA;QAC/E,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,CAAC,CAAC,KAAK,CAAC,kDAAkD,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QAC3G,OAAO,UAAU,CAAC,GAAG,EAAE,kDAAkD,EAAE,GAAG,CAAC,CAAA;IAChF,CAAC;AACF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,GAAkB,EAAE,GAAW,EAAE,GAAoB,EAAoC,EAAE;IAC5I,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,CAAC;QACJ,OAAO,IAAI,wBAAwB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,iCAAiC,CAAC,EAAE,CAAC,CAAA;IACzG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;YACzC,OAAO,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QACzC,CAAC;QAED,CAAC,CAAC,KAAK,CAAC,kDAAkD,EAAE,IAAI,EAAE,mCAAmC,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QACpH,OAAO,UAAU,CAAC,GAAG,EAAE,+CAA+C,EAAE,GAAG,CAAC,CAAA;IAC7E,CAAC;AACF,CAAC,CAAA;AAYD,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,EAAE,GAAkB,EAAE,GAAiC,EAAE,GAAoB,EAAkB,EAAE;IACjJ,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,8BAA8B,CAAC,CAAA;IAEhE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IAElB,IAAI,CAAC;QACJ,2DAA2D;QAC3D,CAAC,CAAC,KAAK,CAAC,8BAA8B,EAAE,YAAY,EAAE,GAAG,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACxC,CAAC,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAA;YAClE,OAAO,UAAU,CAAC,GAAG,EAAE,0DAA0D,EAAE,GAAG,CAAC,CAAA;QACxF,CAAC;QAED,uCAAuC;QACvC,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAA;QACnC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,CAAC,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAA;YACzD,OAAO,UAAU,CAAC,GAAG,EAAE,iDAAiD,EAAE,GAAG,CAAC,CAAA;QAC/E,CAAC;QAED,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAEf,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,CAAC,CAAC,KAAK,CAAC,kDAAkD,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QACzE,OAAO,UAAU,CAAC,GAAG,EAAE,kDAAkD,EAAE,GAAG,CAAC,CAAA;IAChF,CAAC;AACF,CAAC,CAAA;AAED,sEAAsE;AACtE,qEAAqE;AACrE,MAAM,yBAAyB,GAAG,QAAQ,CAAA;AAC1C,iEAAiE;AACjE,MAAM,yBAAyB,GAAG,aAAa,CAAA;AAE/C;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,SAAiB,EAAsB,EAAE;IAC3E,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QACtB,OAAO,+CAA+C,CAAA;IACvD,CAAC;IAED,IAAI,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/C,OAAO,8BAA8B,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,iEAAiE,CAAA;IAChI,CAAC;IAED,IAAI,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/C,OAAO,8BAA8B,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,oDAAoD,CAAA;IACnH,CAAC;IAED,OAAO,SAAS,CAAA;AACjB,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,GAAW,EAAE,GAAoB,EAAQ,EAAE;IAC9E,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;IACrC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,UAAU,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,CAAA;IAC5B,CAAC;AACF,CAAC,CAAA;AAOD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,EAAE,GAAkB,EAAE,SAA6B,EAAE,WAA2B,EAA+B,EAAE;IAC9J,qCAAqC;IACrC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAA;IACnC,IAAI,CAAC,MAAM,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3C,OAAO,oDAAoD,CAAA;IAC5D,CAAC;IAED,sEAAsE;IACtE,wDAAwD;IACxD,IAAI,WAAW,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACjC,OAAO,oDAAoD,CAAA;IAC5D,CAAC;IAED,sEAAsE;IACtE,6CAA6C;IAC7C,MAAM,QAAQ,GAAG,eAAe,CAAC,WAAW,CAAC,SAAS,CAAC,CAAA;IACvD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,+CAA+C,QAAQ,EAAE,CAAA;IACjE,CAAC;IAED,wEAAwE;IACxE,uDAAuD;IACvD,KAAK,MAAM,SAAS,IAAI,WAAW,CAAC,UAAU,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAA;QAC3C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,+CAA+C,KAAK,EAAE,CAAA;QAC9D,CAAC;IACF,CAAC;IAED,sEAAsE;IACtE,mEAAmE;IACnE,8CAA8C;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACtB,IAAI,GAAG,IAAI,WAAW,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9C,OAAO,qCAAqC,CAAA;IAC7C,CAAC;IACD,IAAI,WAAW,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,iCAAiC,CAAC,EAAE,CAAC;QACxF,OAAO,2CAA2C,CAAA;IACnD,CAAC;IAED,0DAA0D;IAC1D,IAAI,MAAM,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9C,OAAO,qCAAqC,CAAA;IAC7C,CAAC;IAED,OAAO,SAAS,CAAA;AACjB,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,KAAK,EAAE,GAAkB,EAAE,SAA6B,EAAE,GAAoC,EAAE,GAAoB,EAAkB,EAAE;IACjL,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,WAAW,CAAC,CAAA;QAC/E,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,CAAA;QACpC,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,qEAAqE;QACrE,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;YACxC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,4BAA4B,CAAC,CAAA;YACxD,MAAM,IAAI,4BAA4B,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACpD,CAAC;QACD,CAAC,CAAC,KAAK,CAAC,2CAA2C,EAAE,IAAI,EAAE,4BAA4B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QACtG,OAAO,UAAU,CAAC,GAAG,EAAE,2CAA2C,EAAE,GAAG,CAAC,CAAA;IACzE,CAAC;AACF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,EAAE,GAAkB,EAAE,SAA6B,EAAE,GAAiC,EAAE,GAAoB,EAAkB,EAAE;IAChL,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,WAAW,CAAC,CAAA;QAC/E,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,CAAA;QACpC,CAAC;QAED,uFAAuF;QACvF,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;YACnE,OAAO,UAAU,CAAC,GAAG,EAAE,8EAA8E,EAAE,GAAG,CAAC,CAAA;QAC5G,CAAC;QAED,uCAAuC;QACvC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,OAAO,UAAU,CAAC,GAAG,EAAE,iDAAiD,EAAE,GAAG,CAAC,CAAA;QAC/E,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,qEAAqE;QACrE,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;YACxC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,8BAA8B,CAAC,CAAA;YAC1D,MAAM,IAAI,4BAA4B,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACpD,CAAC;QACD,CAAC,CAAC,KAAK,CAAC,kDAAkD,EAAE,IAAI,EAAE,8BAA8B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QAC/G,OAAO,UAAU,CAAC,GAAG,EAAE,kDAAkD,EAAE,GAAG,CAAC,CAAA;IAChF,CAAC;AACF,CAAC,CAAA;AAQD,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,EAAE,GAAkB,EAAE,GAA4B,EAAE,GAAoB,EAAkB,EAAE;IACvI,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,CAAC;QACJ,2DAA2D;QAC3D,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACxC,OAAO,UAAU,CAAC,GAAG,EAAE,0DAA0D,EAAE,GAAG,CAAC,CAAA;QACxF,CAAC;QAED,uCAAuC;QACvC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,OAAO,UAAU,CAAC,GAAG,EAAE,iDAAiD,EAAE,GAAG,CAAC,CAAA;QAC/E,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,CAAC,CAAC,KAAK,CAAC,kDAAkD,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QAC1G,OAAO,UAAU,CAAC,GAAG,EAAE,kDAAkD,EAAE,GAAG,CAAC,CAAA;IAChF,CAAC;AACF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAqB,EAAY,EAAE;IACxD,OAAO,CAAC,KAAK,SAAS;QACrB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ;YACtB,CAAC,CAAC,CAAC,KAAK,EAAE;gBACT,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;YACf,CAAC,CAAC,CAAC,CAAA;AACN,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,GAAkB,EAAuB,EAAE;IAC9E,qCAAqC;IACrC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,WAAW,CAAC,GAAG,EAAE,CAAA;IAE1C,OAAO,eAAe,CAAC,MAAM,CAAC,CAAA;AAC/B,CAAC,CAAA;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,EAAE,GAAkB,EAAE,GAAgB,EAAsB,EAAE;IAC3F,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACvB,GAAG,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAA;IAC/B,CAAC;IAED,OAAO,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;AAChD,CAAC,CAAA"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@andrewheberle/serverless-ssh-ca",
3
- "version": "0.24.3",
3
+ "version": "0.25.0",
4
4
  "description": "A serverless SSH CA built for Cloudflare Workers that can also run on Node.js",
5
5
  "type": "module",
6
6
  "types": "./dist/index.d.ts",
package/src/node/env.ts CHANGED
@@ -34,6 +34,7 @@ export const EnvSchema = z.object({
34
34
  JWT_JWKS_URL: z.url({ protocol: /^https?$/, message: "must be an http or https URL" }),
35
35
  JWT_AUD: required,
36
36
  JWT_ACCESS_TOKEN_AUD: z.string().optional(),
37
+ OIDC_USERINFO_URL: z.url({ protocol: /^https?$/, message: "must be an http or https URL" }).optional(),
37
38
  JWT_ISSUER: required,
38
39
  JWT_ALGORITHMS: required,
39
40
  JWT_SSH_CERTIFICATE_PRINCIPALS_CLAIM: required,
package/src/types.ts CHANGED
@@ -132,6 +132,13 @@ export interface SshCaBindings {
132
132
  JWT_AUD: string | string[]
133
133
  /** The audience the access token must be issued for, when it differs from {@link SshCaBindings.JWT_AUD} */
134
134
  JWT_ACCESS_TOKEN_AUD?: string | string[]
135
+ /**
136
+ * The URL of the IdP's OIDC userinfo endpoint. When set, access tokens are
137
+ * verified by sending them to this endpoint instead of as JWTs, so IdPs
138
+ * that issue opaque access tokens can be used. The access token's audience
139
+ * is not checked, so {@link SshCaBindings.JWT_ACCESS_TOKEN_AUD} is not used.
140
+ */
141
+ OIDC_USERINFO_URL?: string
135
142
  JWT_ISSUER: string
136
143
  JWT_JWKS_URL: string
137
144
  JWT_SSH_CERTIFICATE_PRINCIPALS_CLAIM: string
package/src/userinfo.ts ADDED
@@ -0,0 +1,128 @@
1
+ import z from "zod"
2
+
3
+ // how long the userinfo endpoint is given to respond
4
+ const UserInfoTimeout = 10_000
5
+
6
+ /**
7
+ * Thrown by {@link userInfoIdentity} when the userinfo endpoint does not
8
+ * accept the access token, as the token is invalid, expired or revoked.
9
+ */
10
+ export class UserInfoRejectedError extends Error {
11
+ /** The HTTP status of the response */
12
+ readonly status: number
13
+ /** The `WWW-Authenticate` header of the response, which says why the token was not accepted */
14
+ readonly authenticate: string | null
15
+
16
+ constructor(status: number, authenticate: string | null) {
17
+ super(`the userinfo endpoint did not accept the access token (status ${status})`)
18
+ this.name = "UserInfoRejectedError"
19
+ this.status = status
20
+ this.authenticate = authenticate
21
+
22
+ Object.setPrototypeOf(this, UserInfoRejectedError.prototype)
23
+ }
24
+ }
25
+
26
+ /**
27
+ * Thrown by {@link userInfoIdentity} when the claims returned by the userinfo
28
+ * endpoint cannot be used to issue a certificate.
29
+ */
30
+ export class UserInfoClaimsError extends Error {
31
+ constructor(message: string) {
32
+ super(message)
33
+ this.name = "UserInfoClaimsError"
34
+
35
+ Object.setPrototypeOf(this, UserInfoClaimsError.prototype)
36
+ }
37
+ }
38
+
39
+ /**
40
+ * Thrown by {@link userInfoIdentity} when the userinfo endpoint could not be
41
+ * reached or did not respond as an OIDC userinfo endpoint should.
42
+ */
43
+ export class UserInfoUnavailableError extends Error {
44
+ constructor(message: string, cause?: unknown) {
45
+ super(message, { cause })
46
+ this.name = "UserInfoUnavailableError"
47
+
48
+ Object.setPrototypeOf(this, UserInfoUnavailableError.prototype)
49
+ }
50
+ }
51
+
52
+ // a userinfo response is a JSON object of claims (OpenID Connect Core 1.0, section 5.3.2)
53
+ const UserInfoResponseSchema = z.record(z.string(), z.unknown())
54
+
55
+ // the claims of a userinfo response that a certificate is issued for. As for
56
+ // an access token, email_verified is optional but must be true when included.
57
+ const UserInfoClaimsSchema = z.object({
58
+ sub: z.string().min(1),
59
+ email: z.email(),
60
+ email_verified: z.boolean().optional(),
61
+ })
62
+
63
+ /**
64
+ * Returns the subject and email address of the user an access token was
65
+ * issued to, as returned by the IdP's OIDC userinfo endpoint.
66
+ *
67
+ * This allows access tokens that are not JWTs (opaque tokens) to be used, as
68
+ * the IdP is asked whether the token is valid instead of its signature being
69
+ * checked. The userinfo endpoint does not say which client a token was issued
70
+ * to, so the subject must be checked against an identity token that was
71
+ * verified to be issued for this CA.
72
+ *
73
+ * @param url The URL of the IdP's userinfo endpoint
74
+ * @param token The access token, without the `Bearer ` prefix
75
+ * @returns The `sub` and `email` claims of the user
76
+ * @throws {@link UserInfoRejectedError} when the endpoint does not accept the token
77
+ * @throws {@link UserInfoClaimsError} when the claims returned cannot be used
78
+ * @throws {@link UserInfoUnavailableError} when the endpoint cannot be reached or its response is not valid
79
+ */
80
+ export const userInfoIdentity = async (url: string, token: string): Promise<{ sub: string, email: string }> => {
81
+ let response: Response
82
+ try {
83
+ response = await fetch(url, {
84
+ headers: {
85
+ "Authorization": `Bearer ${token}`,
86
+ "Accept": "application/json",
87
+ },
88
+ signal: AbortSignal.timeout(UserInfoTimeout),
89
+ })
90
+ } catch (err) {
91
+ throw new UserInfoUnavailableError("the userinfo endpoint could not be reached", err)
92
+ }
93
+
94
+ if (response.status === 401 || response.status === 403) {
95
+ throw new UserInfoRejectedError(response.status, response.headers.get("WWW-Authenticate"))
96
+ }
97
+
98
+ if (!response.ok) {
99
+ throw new UserInfoUnavailableError(`the userinfo endpoint responded with status ${response.status}`)
100
+ }
101
+
102
+ let body: unknown
103
+ try {
104
+ body = await response.json()
105
+ } catch (err) {
106
+ throw new UserInfoUnavailableError("the userinfo endpoint did not respond with JSON", err)
107
+ }
108
+
109
+ const claims = UserInfoResponseSchema.safeParse(body)
110
+ if (!claims.success) {
111
+ throw new UserInfoUnavailableError("the userinfo endpoint did not respond with a JSON object")
112
+ }
113
+
114
+ if (claims.data.email === undefined) {
115
+ throw new UserInfoClaimsError("the userinfo response was missing required email claim")
116
+ }
117
+
118
+ const parsed = UserInfoClaimsSchema.safeParse(claims.data)
119
+ if (!parsed.success) {
120
+ throw new UserInfoClaimsError("the sub, email or email_verified claim of the userinfo response was not valid")
121
+ }
122
+
123
+ if (parsed.data.email_verified === false) {
124
+ throw new UserInfoClaimsError("the email address in the userinfo response has not been verified by the IdP")
125
+ }
126
+
127
+ return { sub: parsed.data.sub, email: parsed.data.email }
128
+ }
package/src/utils.ts CHANGED
@@ -8,6 +8,7 @@ import { CertificateRequestJWTPayload } from "./types.js"
8
8
  import { RenewalProofOfPossession, ProofOfPossession, PossessionParseError } from "./proof.js"
9
9
  import type { isRevoked as IsRevokedFn } from "./db/index.js"
10
10
  import { logger } from "./logger.js"
11
+ import { UserInfoClaimsError, userInfoIdentity, UserInfoRejectedError } from "./userinfo.js"
11
12
  import { ms } from "itty-time"
12
13
  import { InternalServerErrorException } from "chanfana"
13
14
 
@@ -131,6 +132,29 @@ const claimValidationAttributes = (err: JWTClaimValidationFailed): unknown[] =>
131
132
  return ["claim", err.claim, "reason", err.reason, "value", err.payload[err.claim]]
132
133
  }
133
134
 
135
+ // verifies an access token with the IdP's userinfo endpoint, for IdPs that
136
+ // issue access tokens that are not JWTs
137
+ const userInfoAccessToken = async (env: SshCaBindings, url: string, token: string, val: string, ctx: z.RefinementCtx): Promise<AccessToken | never> => {
138
+ const l = logger(env)
139
+
140
+ try {
141
+ return await userInfoIdentity(url, token)
142
+ } catch (err) {
143
+ switch (true) {
144
+ case (err instanceof UserInfoRejectedError):
145
+ l.warn(err.message, "in", "transformAuthorizationHeader", "status", err.status, "authenticate", err.authenticate)
146
+ return fatalIssue(ctx, "the access token was not accepted by the userinfo endpoint", val)
147
+ case (err instanceof UserInfoClaimsError):
148
+ l.warn(err.message, "in", "transformAuthorizationHeader")
149
+ return fatalIssue(ctx, err.message, val)
150
+ default:
151
+ // the IdP being unavailable is a server error, not a validation failure
152
+ l.error("the access token could not be verified with the userinfo endpoint", "in", "transformAuthorizationHeader", "error", err)
153
+ throw new InternalServerErrorException("the access token could not be verified with the userinfo endpoint")
154
+ }
155
+ }
156
+ }
157
+
134
158
  export const transformAuthorizationHeader = async (env: SshCaBindings, val: string, ctx: z.RefinementCtx): Promise<AccessToken | never> => {
135
159
  if (!val.startsWith("Bearer ") || val.length <= 7) {
136
160
  return fatalIssue(ctx, "authorization header must be a Bearer token", val)
@@ -143,6 +167,13 @@ export const transformAuthorizationHeader = async (env: SshCaBindings, val: stri
143
167
  return fatalIssue(ctx, "request did not contain a JWT", val)
144
168
  }
145
169
 
170
+ // when a userinfo endpoint is configured every access token is verified
171
+ // with it, rather than only those that are not JWTs, so a token cannot
172
+ // avoid the checks of either method by its format
173
+ if (env.OIDC_USERINFO_URL !== undefined && env.OIDC_USERINFO_URL !== "") {
174
+ return userInfoAccessToken(env, env.OIDC_USERINFO_URL, jwt, val, ctx)
175
+ }
176
+
146
177
  try {
147
178
  // verify jwt, which must be issued for this CA
148
179
  const aud = split(env.JWT_ACCESS_TOKEN_AUD).length > 0 ? env.JWT_ACCESS_TOKEN_AUD : env.JWT_AUD