@antasphere/chassis-server 1.0.0

package/dist/identity/demo-pass.d.ts

@@ -0,0 +1,159 @@
+import { type Db, type DbConn } from '@antasphere/chassis-db';
+import type { DemoPass } from '@antasphere/chassis-contract';
+/**
+ * The demo pass service (the demo pass spec, section 3): mint, list, revoke,
+ * look a secret up, and record a use. The secret is 32 random bytes in
+ * base64url (43 characters); only its sha256 hex is stored, looked up through
+ * the unique index. Nothing here logs, and nothing here returns the secret
+ * but `mint`, once, to the route that shows it once.
+ */
+/** The sha256 hex of a pass secret: the only form the database ever holds. */
+export declare function demoPassSecretHash(secret: string): string;
+/** A pass as the owner's routes speak it: the row plus its person's address and name. */
+interface PassWithPerson {
+    id: string;
+    userId: string;
+    email: string;
+    name: string;
+    targetPath: string;
+    createdBy: string | null;
+    createdAt: Date;
+    expiresAt: Date;
+    revokedAt: Date | null;
+    lastUsedAt: Date | null;
+    useCount: number;
+}
+export declare function demoPassToWire(p: PassWithPerson): DemoPass;
+/**
+ * The judge's answer on a request's session cookie (`judgeSession`): null for
+ * an ordinary session (or none), the pass and the session for a live pass's
+ * session, `ended` when the pass is dead and its sessions were just ended.
+ */
+export type DemoSessionVerdict = {
+    passId: string;
+    sessionId: string;
+} | 'ended' | null;
+/** What a redeem signs in: the pass and its person, every condition re-checked. */
+export interface RedeemablePass {
+    passId: string;
+    workspaceId: string;
+    targetPath: string;
+    expiresAt: Date;
+    user: {
+        id: string;
+        email: string;
+        name: string;
+    };
+}
+/** The mint found the person's membership gone or off inside its transaction: answered as `no_such_member`. */
+export declare class DemoPassMemberGoneError extends Error {
+    readonly code = "no_such_member";
+    constructor();
+}
+export declare class DemoPassService {
+    private readonly db;
+    constructor(db: Db);
+    /**
+     * Mint a pass. The caller (the owner's route) has already judged every
+     * refusal; this writes the row and hands the secret back, once.
+     *
+     * The person's membership is re-read inside the insert's transaction and
+     * held FOR SHARE (`holdLiveMembership`, the end-to-end verification,
+     * finding 5): the route's read ran before, outside any lock, and a pass
+     * minted after a removal committed would sit on the inactive row and open
+     * the account again the day the person is re-invited. A removal still
+     * running waits for this insert and revokes the pass in its second pass.
+     * Throws `DemoPassMemberGoneError` when the membership is gone or off: the
+     * route answers it as the `no_such_member` 404.
+     */
+    mint(input: {
+        workspaceId: string;
+        userId: string;
+        createdBy: string;
+        targetPath: string;
+        expiresInMinutes: number;
+    }): Promise<{
+        pass: PassWithPerson;
+        secret: string;
+    }>;
+    /** One pass of one workspace, or null (another workspace's pass is null too). */
+    get(workspaceId: string, id: string): Promise<PassWithPerson | null>;
+    /** The workspace's passes, newest first. */
+    list(workspaceId: string): Promise<PassWithPerson[]>;
+    /**
+     * Revoke a pass of this workspace. Idempotent: a revoked pass keeps its
+     * first revocation time and is answered again. Null when the workspace
+     * holds no such pass. The sessions the pass opened END with it, in the same
+     * transaction (`endSessions`, their session links included): a revoke that
+     * left them alive would stop the next click and nothing else, and the owner
+     * revokes to take the access back.
+     */
+    revoke(workspaceId: string, id: string): Promise<PassWithPerson | null>;
+    /**
+     * The redeem's lookup (spec section 4, step 2): the pass whose secret hashes
+     * to this, and only while EVERY condition still holds: not expired, not
+     * revoked, its person still there, still an ACTIVE member of the pass's
+     * workspace, the address still a demonstration address, no second factor
+     * enrolled since the mint, and the mint's own refusals judged again: not
+     * an owner now unless the pass is their own, not a guest, and no
+     * membership in any other workspace (`mintRefusal`). One statement for the
+     * pass, its person and the membership; null whatever the reason, so the
+     * caller has one answer to give.
+     */
+    redeemable(secret: string, extraDomains: ReadonlySet<string>): Promise<RedeemablePass | null>;
+    /** Record one use: the session it opened (the audit mark) and the counters, together. */
+    recordUse(passId: string, sessionId: string): Promise<void>;
+    /**
+     * The rule that makes a pass's lifetime the lifetime of what it opened: a
+     * session a pass opened lives only while its pass does. Judged once per
+     * request by the credential resolver, for session principals, while the
+     * switch is on. Three answers: null (an ordinary session, the person signed
+     * in themselves), the pass's id (the audit mark) with the session's id, or
+     * `ended`: the pass has expired or was revoked, every session it opened is
+     * ended here (`endSessions`) and the request goes on signed out. Without
+     * it a link valid one day would open a session the library keeps a year
+     * and renews on use.
+     *
+     * The session cookie is `<token>.<signature>` and only the token part is
+     * read, the signature unchecked: at the resolver it was already checked, and
+     * at the sign-in library's door it does not need to be, because the only
+     * thing this can do with a token is end the sessions of a pass that is
+     * already dead, or refuse that session a path, and the token is that
+     * session's own secret.
+     */
+    judgeSession(headers: Headers): Promise<DemoSessionVerdict>;
+    /**
+     * Pass sessions a revoke by this verified caller's session is about to delete (the library's revoke-session(s) paths).
+     *
+     * The library's own `/revoke-session`, `/revoke-sessions` and
+     * `/revoke-other-sessions` delete session rows and nothing else: a pass
+     * session a person's own session revokes would leave its OAuth tokens
+     * (their link to it set null, out of `endSessions`' reach) and its
+     * `demo_pass_sessions` row behind. The `/auth/*` middleware asks this first
+     * and ends those sessions the pass's way before the library runs. The
+     * caller is the library's verified session (the middleware resolves it
+     * through `auth.api.getSession`, the signature checked), so a forged or
+     * dead cookie ends nothing; a pass session never gets here (the middleware
+     * refuses it these paths). `/revoke-session`: the session whose token is
+     * the body's, the caller's own person's, and a pass's; `/revoke-sessions`:
+     * every pass session of that person; `/revoke-other-sessions`: the same,
+     * the caller's own session excepted. Any other path, or no session: none.
+     */
+    passSessionsRevokedBy(authPath: string, caller: {
+        sessionId: string;
+        userId: string;
+    }, bodyToken: string | null): Promise<string[]>;
+    /** The ids of the sessions a pass opened (its `demo_pass_sessions` rows). */
+    private sessionIdsOf;
+    /**
+     * End sessions a pass opened, and what they opened with them: the OAuth
+     * access and refresh tokens issued under them (deleted FIRST: their
+     * `session_id` is `on delete set null`, so deleting the session alone would
+     * leave them alive and unattached), the `demo_pass_sessions` links, then
+     * the `session` rows. In the caller's transaction when one is given, in
+     * its own otherwise.
+     */
+    endSessions(sessionIds: readonly string[], tx?: DbConn): Promise<void>;
+}
+export {};
+//# sourceMappingURL=demo-pass.d.ts.map

package/dist/identity/demo-pass.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"demo-pass.d.ts","sourceRoot":"","sources":["../../src/identity/demo-pass.ts"],"names":[],"mappings":"AAGA,OAAO,EAQL,KAAK,EAAE,EACP,KAAK,MAAM,EACZ,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAK7D;;;;;;GAMG;AAEH,8EAA8E;AAC9E,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,yFAAyF;AACzF,UAAU,cAAc;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,wBAAgB,cAAc,CAAC,CAAC,EAAE,cAAc,GAAG,QAAQ,CAc1D;AAED;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,GAAG,IAAI,CAAC;AAExF,mFAAmF;AACnF,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,IAAI,CAAC;IAChB,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACnD;AAgBD,+GAA+G;AAC/G,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,IAAI,oBAAoB;;CAKlC;AAED,qBAAa,eAAe;IACd,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,EAAE;IAEnC;;;;;;;;;;;;OAYG;IACG,IAAI,CAAC,KAAK,EAAE;QAChB,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;QACnB,gBAAgB,EAAE,MAAM,CAAC;KAC1B,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,cAAc,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAuBrD,iFAAiF;IAC3E,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAU1E,4CAA4C;IACtC,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAS1D;;;;;;;OAOG;IACG,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAe7E;;;;;;;;;;OAUG;IACG,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAyDnG,yFAAyF;IACnF,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUjE;;;;;;;;;;;;;;;;;OAiBG;IACG,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAwBjE;;;;;;;;;;;;;;;;OAgBG;IACG,qBAAqB,CACzB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAC7C,SAAS,EAAE,MAAM,GAAG,IAAI,GACvB,OAAO,CAAC,MAAM,EAAE,CAAC;IA2BpB,6EAA6E;YAC/D,YAAY;IAQ1B;;;;;;;OAOG;IACG,WAAW,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAY7E"}

package/dist/identity/demo-pass.js

@@ -0,0 +1,319 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { and, desc, eq, inArray, isNull, sql } from 'drizzle-orm';
+import { getSessionCookie } from 'better-auth/cookies';
+import { demoPasses, demoPassSessions, oauthAccessToken, oauthRefreshToken, session as sessionTable, user as userTable, workspaceMembers } from '@antasphere/chassis-db';
+import { mintRefusal } from '../accounts/mint-refusal.js';
+import { holdLiveMembership } from '../members/removal.js';
+import { isDemoAddress } from './demo-pass-rules.js';
+/**
+ * The demo pass service (the demo pass spec, section 3): mint, list, revoke,
+ * look a secret up, and record a use. The secret is 32 random bytes in
+ * base64url (43 characters); only its sha256 hex is stored, looked up through
+ * the unique index. Nothing here logs, and nothing here returns the secret
+ * but `mint`, once, to the route that shows it once.
+ */
+/** The sha256 hex of a pass secret: the only form the database ever holds. */
+export function demoPassSecretHash(secret) {
+    return createHash('sha256').update(secret, 'utf8').digest('hex');
+}
+export function demoPassToWire(p) {
+    return {
+        id: p.id,
+        userId: p.userId,
+        email: p.email,
+        name: p.name,
+        targetPath: p.targetPath,
+        createdBy: p.createdBy,
+        createdAt: p.createdAt.toISOString(),
+        expiresAt: p.expiresAt.toISOString(),
+        revokedAt: p.revokedAt?.toISOString() ?? null,
+        lastUsedAt: p.lastUsedAt?.toISOString() ?? null,
+        useCount: p.useCount
+    };
+}
+const passColumns = {
+    id: demoPasses.id,
+    userId: demoPasses.userId,
+    email: userTable.email,
+    name: userTable.name,
+    targetPath: demoPasses.targetPath,
+    createdBy: demoPasses.createdBy,
+    createdAt: demoPasses.createdAt,
+    expiresAt: demoPasses.expiresAt,
+    revokedAt: demoPasses.revokedAt,
+    lastUsedAt: demoPasses.lastUsedAt,
+    useCount: demoPasses.useCount
+};
+/** The mint found the person's membership gone or off inside its transaction: answered as `no_such_member`. */
+export class DemoPassMemberGoneError extends Error {
+    code = 'no_such_member';
+    constructor() {
+        super('No member of this workspace holds that address');
+        this.name = 'DemoPassMemberGoneError';
+    }
+}
+export class DemoPassService {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    /**
+     * Mint a pass. The caller (the owner's route) has already judged every
+     * refusal; this writes the row and hands the secret back, once.
+     *
+     * The person's membership is re-read inside the insert's transaction and
+     * held FOR SHARE (`holdLiveMembership`, the end-to-end verification,
+     * finding 5): the route's read ran before, outside any lock, and a pass
+     * minted after a removal committed would sit on the inactive row and open
+     * the account again the day the person is re-invited. A removal still
+     * running waits for this insert and revokes the pass in its second pass.
+     * Throws `DemoPassMemberGoneError` when the membership is gone or off: the
+     * route answers it as the `no_such_member` 404.
+     */
+    async mint(input) {
+        const secret = randomBytes(32).toString('base64url');
+        const expiresAt = new Date(Date.now() + input.expiresInMinutes * 60 * 1000);
+        const row = await this.db.transaction(async (tx) => {
+            if (!(await holdLiveMembership(tx, input.workspaceId, { userId: input.userId })))
+                return null;
+            const [inserted] = await tx
+                .insert(demoPasses)
+                .values({
+                workspaceId: input.workspaceId,
+                userId: input.userId,
+                targetPath: input.targetPath,
+                secretHash: demoPassSecretHash(secret),
+                createdBy: input.createdBy,
+                expiresAt
+            })
+                .returning({ id: demoPasses.id });
+            return inserted;
+        });
+        if (!row)
+            throw new DemoPassMemberGoneError();
+        const pass = await this.get(input.workspaceId, row.id);
+        return { pass: pass, secret };
+    }
+    /** One pass of one workspace, or null (another workspace's pass is null too). */
+    async get(workspaceId, id) {
+        const [row] = await this.db
+            .select(passColumns)
+            .from(demoPasses)
+            .innerJoin(userTable, eq(userTable.id, demoPasses.userId))
+            .where(and(eq(demoPasses.id, id), eq(demoPasses.workspaceId, workspaceId)))
+            .limit(1);
+        return row ?? null;
+    }
+    /** The workspace's passes, newest first. */
+    async list(workspaceId) {
+        return this.db
+            .select(passColumns)
+            .from(demoPasses)
+            .innerJoin(userTable, eq(userTable.id, demoPasses.userId))
+            .where(eq(demoPasses.workspaceId, workspaceId))
+            .orderBy(desc(demoPasses.createdAt), desc(demoPasses.id));
+    }
+    /**
+     * Revoke a pass of this workspace. Idempotent: a revoked pass keeps its
+     * first revocation time and is answered again. Null when the workspace
+     * holds no such pass. The sessions the pass opened END with it, in the same
+     * transaction (`endSessions`, their session links included): a revoke that
+     * left them alive would stop the next click and nothing else, and the owner
+     * revokes to take the access back.
+     */
+    async revoke(workspaceId, id) {
+        const found = await this.db.transaction(async (tx) => {
+            const updated = await tx
+                .update(demoPasses)
+                .set({ revokedAt: sql `coalesce(${demoPasses.revokedAt}, now())` })
+                .where(and(eq(demoPasses.id, id), eq(demoPasses.workspaceId, workspaceId)))
+                .returning({ id: demoPasses.id });
+            if (updated.length === 0)
+                return false;
+            await this.endSessions(await this.sessionIdsOf(id, tx), tx);
+            return true;
+        });
+        if (!found)
+            return null;
+        return this.get(workspaceId, id);
+    }
+    /**
+     * The redeem's lookup (spec section 4, step 2): the pass whose secret hashes
+     * to this, and only while EVERY condition still holds: not expired, not
+     * revoked, its person still there, still an ACTIVE member of the pass's
+     * workspace, the address still a demonstration address, no second factor
+     * enrolled since the mint, and the mint's own refusals judged again: not
+     * an owner now unless the pass is their own, not a guest, and no
+     * membership in any other workspace (`mintRefusal`). One statement for the
+     * pass, its person and the membership; null whatever the reason, so the
+     * caller has one answer to give.
+     */
+    async redeemable(secret, extraDomains) {
+        const [row] = await this.db
+            .select({
+            passId: demoPasses.id,
+            workspaceId: demoPasses.workspaceId,
+            targetPath: demoPasses.targetPath,
+            expiresAt: demoPasses.expiresAt,
+            createdBy: demoPasses.createdBy,
+            role: workspaceMembers.role,
+            origin: workspaceMembers.origin,
+            userId: userTable.id,
+            email: userTable.email,
+            name: userTable.name,
+            twoFactorEnabled: userTable.twoFactorEnabled
+        })
+            .from(demoPasses)
+            .innerJoin(userTable, eq(userTable.id, demoPasses.userId))
+            .innerJoin(workspaceMembers, and(eq(workspaceMembers.userId, demoPasses.userId), eq(workspaceMembers.workspaceId, demoPasses.workspaceId), eq(workspaceMembers.isActive, true)))
+            .where(and(eq(demoPasses.secretHash, demoPassSecretHash(secret)), isNull(demoPasses.revokedAt), sql `${demoPasses.expiresAt} > now()`))
+            .limit(1);
+        if (!row)
+            return null;
+        if (row.twoFactorEnabled)
+            return null;
+        if (!isDemoAddress(row.email, extraDomains))
+            return null;
+        if (row.role === 'owner' && row.userId !== row.createdBy)
+            return null;
+        // The message is the mint's; here only whether there is a refusal counts.
+        if (await mintRefusal(this.db, '', { workspaceId: row.workspaceId }, { userId: row.userId, origin: row.origin })) {
+            return null;
+        }
+        return {
+            passId: row.passId,
+            workspaceId: row.workspaceId,
+            targetPath: row.targetPath,
+            expiresAt: row.expiresAt,
+            user: { id: row.userId, email: row.email, name: row.name }
+        };
+    }
+    /** Record one use: the session it opened (the audit mark) and the counters, together. */
+    async recordUse(passId, sessionId) {
+        await this.db.transaction(async (tx) => {
+            await tx.insert(demoPassSessions).values({ sessionId, passId });
+            await tx
+                .update(demoPasses)
+                .set({ useCount: sql `${demoPasses.useCount} + 1`, lastUsedAt: sql `now()` })
+                .where(eq(demoPasses.id, passId));
+        });
+    }
+    /**
+     * The rule that makes a pass's lifetime the lifetime of what it opened: a
+     * session a pass opened lives only while its pass does. Judged once per
+     * request by the credential resolver, for session principals, while the
+     * switch is on. Three answers: null (an ordinary session, the person signed
+     * in themselves), the pass's id (the audit mark) with the session's id, or
+     * `ended`: the pass has expired or was revoked, every session it opened is
+     * ended here (`endSessions`) and the request goes on signed out. Without
+     * it a link valid one day would open a session the library keeps a year
+     * and renews on use.
+     *
+     * The session cookie is `<token>.<signature>` and only the token part is
+     * read, the signature unchecked: at the resolver it was already checked, and
+     * at the sign-in library's door it does not need to be, because the only
+     * thing this can do with a token is end the sessions of a pass that is
+     * already dead, or refuse that session a path, and the token is that
+     * session's own secret.
+     */
+    async judgeSession(headers) {
+        const cookie = getSessionCookie(headers);
+        if (!cookie)
+            return null;
+        const token = cookie.split('.')[0];
+        if (!token)
+            return null;
+        const [row] = await this.db
+            .select({
+            sessionId: sessionTable.id,
+            passId: demoPassSessions.passId,
+            live: sql `${demoPasses.revokedAt} is null and ${demoPasses.expiresAt} > now()`
+        })
+            .from(demoPassSessions)
+            .innerJoin(sessionTable, eq(sessionTable.id, demoPassSessions.sessionId))
+            .innerJoin(demoPasses, eq(demoPasses.id, demoPassSessions.passId))
+            .where(eq(sessionTable.token, token))
+            .limit(1);
+        if (!row)
+            return null;
+        if (row.live)
+            return { passId: row.passId, sessionId: row.sessionId };
+        // The pass is dead: every session it opened ends now, not only the one
+        // presented, so a second tab's session does not wait for its own request.
+        await this.db.transaction(async (tx) => this.endSessions(await this.sessionIdsOf(row.passId, tx), tx));
+        return 'ended';
+    }
+    /**
+     * Pass sessions a revoke by this verified caller's session is about to delete (the library's revoke-session(s) paths).
+     *
+     * The library's own `/revoke-session`, `/revoke-sessions` and
+     * `/revoke-other-sessions` delete session rows and nothing else: a pass
+     * session a person's own session revokes would leave its OAuth tokens
+     * (their link to it set null, out of `endSessions`' reach) and its
+     * `demo_pass_sessions` row behind. The `/auth/*` middleware asks this first
+     * and ends those sessions the pass's way before the library runs. The
+     * caller is the library's verified session (the middleware resolves it
+     * through `auth.api.getSession`, the signature checked), so a forged or
+     * dead cookie ends nothing; a pass session never gets here (the middleware
+     * refuses it these paths). `/revoke-session`: the session whose token is
+     * the body's, the caller's own person's, and a pass's; `/revoke-sessions`:
+     * every pass session of that person; `/revoke-other-sessions`: the same,
+     * the caller's own session excepted. Any other path, or no session: none.
+     */
+    async passSessionsRevokedBy(authPath, caller, bodyToken) {
+        if (authPath !== '/revoke-session' &&
+            authPath !== '/revoke-sessions' &&
+            authPath !== '/revoke-other-sessions') {
+            return [];
+        }
+        if (authPath === '/revoke-session') {
+            if (!bodyToken)
+                return [];
+            const rows = await this.db
+                .select({ id: sessionTable.id })
+                .from(sessionTable)
+                .innerJoin(demoPassSessions, eq(demoPassSessions.sessionId, sessionTable.id))
+                .where(and(eq(sessionTable.token, bodyToken), eq(sessionTable.userId, caller.userId)))
+                .limit(1);
+            return rows.map((r) => r.id);
+        }
+        const rows = await this.db
+            .select({ id: sessionTable.id })
+            .from(sessionTable)
+            .innerJoin(demoPassSessions, eq(demoPassSessions.sessionId, sessionTable.id))
+            .where(eq(sessionTable.userId, caller.userId));
+        const ids = rows.map((r) => r.id);
+        return authPath === '/revoke-other-sessions' ? ids.filter((id) => id !== caller.sessionId) : ids;
+    }
+    /** The ids of the sessions a pass opened (its `demo_pass_sessions` rows). */
+    async sessionIdsOf(passId, conn) {
+        const rows = await conn
+            .select({ id: demoPassSessions.sessionId })
+            .from(demoPassSessions)
+            .where(eq(demoPassSessions.passId, passId));
+        return rows.map((row) => row.id);
+    }
+    /**
+     * End sessions a pass opened, and what they opened with them: the OAuth
+     * access and refresh tokens issued under them (deleted FIRST: their
+     * `session_id` is `on delete set null`, so deleting the session alone would
+     * leave them alive and unattached), the `demo_pass_sessions` links, then
+     * the `session` rows. In the caller's transaction when one is given, in
+     * its own otherwise.
+     */
+    async endSessions(sessionIds, tx) {
+        if (sessionIds.length === 0)
+            return;
+        const ids = [...sessionIds];
+        const run = async (conn) => {
+            await conn.delete(oauthAccessToken).where(inArray(oauthAccessToken.sessionId, ids));
+            await conn.delete(oauthRefreshToken).where(inArray(oauthRefreshToken.sessionId, ids));
+            await conn.delete(demoPassSessions).where(inArray(demoPassSessions.sessionId, ids));
+            await conn.delete(sessionTable).where(inArray(sessionTable.id, ids));
+        };
+        if (tx)
+            return run(tx);
+        return this.db.transaction(async (own) => run(own));
+    }
+}
+//# sourceMappingURL=demo-pass.js.map

package/dist/identity/demo-pass.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"demo-pass.js","sourceRoot":"","sources":["../../src/identity/demo-pass.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,OAAO,IAAI,YAAY,EACvB,IAAI,IAAI,SAAS,EACjB,gBAAgB,EAGjB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD;;;;;;GAMG;AAEH,8EAA8E;AAC9E,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC;AAiBD,MAAM,UAAU,cAAc,CAAC,CAAiB;IAC9C,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE;QACpC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE;QACpC,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,IAAI;QAC7C,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,IAAI;QAC/C,QAAQ,EAAE,CAAC,CAAC,QAAQ;KACrB,CAAC;AACJ,CAAC;AAkBD,MAAM,WAAW,GAAG;IAClB,EAAE,EAAE,UAAU,CAAC,EAAE;IACjB,MAAM,EAAE,UAAU,CAAC,MAAM;IACzB,KAAK,EAAE,SAAS,CAAC,KAAK;IACtB,IAAI,EAAE,SAAS,CAAC,IAAI;IACpB,UAAU,EAAE,UAAU,CAAC,UAAU;IACjC,SAAS,EAAE,UAAU,CAAC,SAAS;IAC/B,SAAS,EAAE,UAAU,CAAC,SAAS;IAC/B,SAAS,EAAE,UAAU,CAAC,SAAS;IAC/B,SAAS,EAAE,UAAU,CAAC,SAAS;IAC/B,UAAU,EAAE,UAAU,CAAC,UAAU;IACjC,QAAQ,EAAE,UAAU,CAAC,QAAQ;CAC9B,CAAC;AAEF,+GAA+G;AAC/G,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACvC,IAAI,GAAG,gBAAgB,CAAC;IACjC;QACE,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACxD,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,MAAM,OAAO,eAAe;IACG;IAA7B,YAA6B,EAAM;QAAN,OAAE,GAAF,EAAE,CAAI;IAAG,CAAC;IAEvC;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,IAAI,CAAC,KAMV;QACC,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,gBAAgB,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC5E,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACjD,IAAI,CAAC,CAAC,MAAM,kBAAkB,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC9F,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;iBACxB,MAAM,CAAC,UAAU,CAAC;iBAClB,MAAM,CAAC;gBACN,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,UAAU,EAAE,kBAAkB,CAAC,MAAM,CAAC;gBACtC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,SAAS;aACV,CAAC;iBACD,SAAS,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;YACpC,OAAO,QAAS,CAAC;QACnB,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,uBAAuB,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACvD,OAAO,EAAE,IAAI,EAAE,IAAK,EAAE,MAAM,EAAE,CAAC;IACjC,CAAC;IAED,iFAAiF;IACjF,KAAK,CAAC,GAAG,CAAC,WAAmB,EAAE,EAAU;QACvC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACxB,MAAM,CAAC,WAAW,CAAC;aACnB,IAAI,CAAC,UAAU,CAAC;aAChB,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;aACzD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;aAC1E,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,GAAG,IAAI,IAAI,CAAC;IACrB,CAAC;IAED,4CAA4C;IAC5C,KAAK,CAAC,IAAI,CAAC,WAAmB;QAC5B,OAAO,IAAI,CAAC,EAAE;aACX,MAAM,CAAC,WAAW,CAAC;aACnB,IAAI,CAAC,UAAU,CAAC;aAChB,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;aACzD,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;aAC9C,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,MAAM,CAAC,WAAmB,EAAE,EAAU;QAC1C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACnD,MAAM,OAAO,GAAG,MAAM,EAAE;iBACrB,MAAM,CAAC,UAAU,CAAC;iBAClB,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,CAAA,YAAY,UAAU,CAAC,SAAS,UAAU,EAAE,CAAC;iBACjE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;iBAC1E,SAAS,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;YACpC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YACvC,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5D,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACnC,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,YAAiC;QAChE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACxB,MAAM,CAAC;YACN,MAAM,EAAE,UAAU,CAAC,EAAE;YACrB,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,IAAI,EAAE,gBAAgB,CAAC,IAAI;YAC3B,MAAM,EAAE,gBAAgB,CAAC,MAAM;YAC/B,MAAM,EAAE,SAAS,CAAC,EAAE;YACpB,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,gBAAgB,EAAE,SAAS,CAAC,gBAAgB;SAC7C,CAAC;aACD,IAAI,CAAC,UAAU,CAAC;aAChB,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;aACzD,SAAS,CACR,gBAAgB,EAChB,GAAG,CACD,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,EAC9C,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,UAAU,CAAC,WAAW,CAAC,EACxD,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,CACpC,CACF;aACA,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC,EACrD,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAC5B,GAAG,CAAA,GAAG,UAAU,CAAC,SAAS,UAAU,CACrC,CACF;aACA,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,IAAI,GAAG,CAAC,gBAAgB;YAAE,OAAO,IAAI,CAAC;QACtC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,YAAY,CAAC;YAAE,OAAO,IAAI,CAAC;QACzD,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QACtE,0EAA0E;QAC1E,IACE,MAAM,WAAW,CACf,IAAI,CAAC,EAAE,EACP,EAAE,EACF,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,EAChC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAC3C,EACD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO;YACL,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,IAAI,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE;SAC3D,CAAC;IACJ,CAAC;IAED,yFAAyF;IACzF,KAAK,CAAC,SAAS,CAAC,MAAc,EAAE,SAAiB;QAC/C,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACrC,MAAM,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;YAChE,MAAM,EAAE;iBACL,MAAM,CAAC,UAAU,CAAC;iBAClB,GAAG,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAA,GAAG,UAAU,CAAC,QAAQ,MAAM,EAAE,UAAU,EAAE,GAAG,CAAA,OAAO,EAAE,CAAC;iBAC1E,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,YAAY,CAAC,OAAgB;QACjC,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACxB,MAAM,CAAC;YACN,SAAS,EAAE,YAAY,CAAC,EAAE;YAC1B,MAAM,EAAE,gBAAgB,CAAC,MAAM;YAC/B,IAAI,EAAE,GAAG,CAAS,GAAG,UAAU,CAAC,SAAS,gBAAgB,UAAU,CAAC,SAAS,UAAU;SACxF,CAAC;aACD,IAAI,CAAC,gBAAgB,CAAC;aACtB,SAAS,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC;aACxE,SAAS,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC;aACjE,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;aACpC,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,IAAI,GAAG,CAAC,IAAI;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;QACtE,uEAAuE;QACvE,0EAA0E;QAC1E,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACvG,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,qBAAqB,CACzB,QAAgB,EAChB,MAA6C,EAC7C,SAAwB;QAExB,IACE,QAAQ,KAAK,iBAAiB;YAC9B,QAAQ,KAAK,kBAAkB;YAC/B,QAAQ,KAAK,wBAAwB,EACrC,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;YACnC,IAAI,CAAC,SAAS;gBAAE,OAAO,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;iBACvB,MAAM,CAAC,EAAE,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC;iBAC/B,IAAI,CAAC,YAAY,CAAC;iBAClB,SAAS,CAAC,gBAAgB,EAAE,EAAE,CAAC,gBAAgB,CAAC,SAAS,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC;iBAC5E,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;iBACrF,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/B,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,MAAM,CAAC,EAAE,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC;aAC/B,IAAI,CAAC,YAAY,CAAC;aAClB,SAAS,CAAC,gBAAgB,EAAE,EAAE,CAAC,gBAAgB,CAAC,SAAS,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC;aAC5E,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAClC,OAAO,QAAQ,KAAK,wBAAwB,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACnG,CAAC;IAED,6EAA6E;IACrE,KAAK,CAAC,YAAY,CAAC,MAAc,EAAE,IAAY;QACrD,MAAM,IAAI,GAAG,MAAM,IAAI;aACpB,MAAM,CAAC,EAAE,EAAE,EAAE,gBAAgB,CAAC,SAAS,EAAE,CAAC;aAC1C,IAAI,CAAC,gBAAgB,CAAC;aACtB,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACnC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,WAAW,CAAC,UAA6B,EAAE,EAAW;QAC1D,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACpC,MAAM,GAAG,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC;QAC5B,MAAM,GAAG,GAAG,KAAK,EAAE,IAAY,EAAE,EAAE;YACjC,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;YACpF,MAAM,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;YACtF,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;YACpF,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;QACvE,CAAC,CAAC;QACF,IAAI,EAAE;YAAE,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACtD,CAAC;CACF"}