@atlasauth/backend 0.14.1 → 0.16.0

package/dist/oauth-resource.js

@@ -0,0 +1,469 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DPOP_PROOF_MAX_AGE_SECONDS = exports.ACCESS_TOKEN_CLOCK_SKEW_SECONDS = void 0;
+exports.memoryDpopNonceSource = memoryDpopNonceSource;
+exports.hmacDpopNonceSource = hmacDpopNonceSource;
+exports.memoryDpopReplayStore = memoryDpopReplayStore;
+exports.createIntrospector = createIntrospector;
+exports.buildWwwAuthenticate = buildWwwAuthenticate;
+exports.createAccessTokenVerifier = createAccessTokenVerifier;
+exports.verifyAccessToken = verifyAccessToken;
+exports.protectedResourceMetadata = protectedResourceMetadata;
+exports.protectedResourceMetadataPath = protectedResourceMetadataPath;
+const jose_1 = require("jose");
+const jwks_cache_1 = require("./jwks-cache");
+const algs_1 = require("./algs");
+/**
+ * Protecting YOUR API — or your own MCP server — with access tokens Atlas
+ * issues to OAuth clients (authorization code, device, client credentials,
+ * token exchange). Atlas is the authorization server; your API is the
+ * resource server. This module:
+ *  - verifies the access token locally against the instance JWKS (cached;
+ *    no call to Atlas on the hot path): signature, `iss`, `exp`/`nbf`, that it
+ *    IS an access token, and that its `aud` names your API (RFC 8707);
+ *  - enforces required scopes;
+ *  - enforces sender constraint: a DPoP-bound token (`cnf.jkt`) must arrive
+ *    with a valid DPoP proof for the same key (RFC 9449), and is never accepted
+ *    as a plain Bearer token;
+ *  - answers failures with the RFC 6750 / RFC 9728 `WWW-Authenticate`
+ *    challenge (`resource_metadata`, `insufficient_scope` + the scopes needed),
+ *    which is exactly what an MCP client needs to discover how to sign in;
+ *  - builds the RFC 9728 protected-resource metadata document to serve at
+ *    `/.well-known/oauth-protected-resource` on your API's host.
+ *  - accepts OPAQUE access tokens too (an API, client or instance set to the
+ *    `opaque` format): with `introspection` configured, a token that is not a
+ *    JWT is validated at Atlas's introspection endpoint (RFC 7662) with your
+ *    API's own client credentials, and the answer is cached briefly;
+ * Framework-agnostic: hand it any request with `method`, `url` and `headers`.
+ */
+/** Clock skew tolerated on `exp`/`nbf` and on DPoP proof `iat`. */
+exports.ACCESS_TOKEN_CLOCK_SKEW_SECONDS = 5;
+/** How old a DPoP proof may be. */
+exports.DPOP_PROOF_MAX_AGE_SECONDS = 300;
+const DPOP_ALGS = ['ES256', 'ES384', 'ES512', 'RS256', 'RS384', 'RS512', 'PS256', 'PS384', 'PS512', 'EdDSA'];
+const DEFAULT_NONCE_WINDOW_SECONDS = 300;
+/**
+ * An in-process nonce source: a random nonce per window; the current and the
+ * previous window's nonce are accepted. Use it when one process serves the API
+ * (or with sticky routing); behind several processes, use
+ * {@link hmacDpopNonceSource} with a shared secret.
+ */
+function memoryDpopNonceSource(options = {}) {
+    const window = (options.windowSeconds ?? DEFAULT_NONCE_WINDOW_SECONDS) * 1000;
+    const now = options.now ?? Date.now;
+    const issued = new Map();
+    const random = () => {
+        const bytes = crypto.getRandomValues(new Uint8Array(32));
+        let bin = '';
+        for (const b of bytes)
+            bin += String.fromCharCode(b);
+        return btoa(bin).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+    };
+    const at = (epoch) => {
+        let n = issued.get(epoch);
+        if (!n) {
+            n = random();
+            issued.set(epoch, n);
+            for (const e of issued.keys())
+                if (e < epoch - 1)
+                    issued.delete(e);
+        }
+        return n;
+    };
+    return {
+        current: () => at(Math.floor(now() / window)),
+        valid: (nonce) => {
+            const epoch = Math.floor(now() / window);
+            return nonce === at(epoch) || nonce === issued.get(epoch - 1);
+        },
+    };
+}
+/**
+ * A stateless nonce source shared by every process holding the same secret (at
+ * least 32 bytes): the nonce for a window is base64url(HMAC-SHA256(secret,
+ * "atlas-dpop-nonce:" ‖ uint64-BE(window number))). A nonce is good in the window
+ * it was issued in and the next one. The derivation is the same in every Atlas
+ * server SDK, so services in different languages sharing the secret agree.
+ */
+function hmacDpopNonceSource(secret, options = {}) {
+    const key = typeof secret === 'string' ? new TextEncoder().encode(secret) : secret;
+    if (key.length < 32)
+        throw new Error('The DPoP nonce secret must be at least 32 bytes.');
+    const window = (options.windowSeconds ?? DEFAULT_NONCE_WINDOW_SECONDS) * 1000;
+    const now = options.now ?? Date.now;
+    const imported = crypto.subtle.importKey('raw', key, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+    const at = async (epoch) => {
+        const prefix = new TextEncoder().encode('atlas-dpop-nonce:');
+        const msg = new Uint8Array(prefix.length + 8);
+        msg.set(prefix);
+        new DataView(msg.buffer).setBigUint64(prefix.length, BigInt(epoch));
+        const mac = new Uint8Array(await crypto.subtle.sign('HMAC', await imported, msg));
+        let bin = '';
+        for (const b of mac)
+            bin += String.fromCharCode(b);
+        return btoa(bin).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+    };
+    const epoch = () => Math.floor(now() / window);
+    return {
+        current: () => at(epoch()),
+        valid: async (nonce) => {
+            const e = epoch();
+            const [a, b] = await Promise.all([at(e), at(e - 1)]);
+            return constantTimeEqual(nonce, a) || constantTimeEqual(nonce, b);
+        },
+    };
+}
+function constantTimeEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++)
+        diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    return diff === 0;
+}
+function memoryDpopReplayStore(max = 10_000) {
+    const seen = new Map();
+    return {
+        claim(jti, expiresAt) {
+            const now = Date.now();
+            if ((seen.get(jti) ?? 0) > now)
+                return false;
+            seen.set(jti, expiresAt);
+            if (seen.size > max) {
+                for (const [k, v] of seen)
+                    if (v <= now)
+                        seen.delete(k);
+                while (seen.size > max)
+                    seen.delete(seen.keys().next().value);
+            }
+            return true;
+        },
+    };
+}
+/**
+ * RFC 7662 introspection with a small TTL cache keyed by the token's SHA-256
+ * (the token itself is never kept). Returns the claims of an active token, or
+ * null for an inactive one; throws when Atlas could not be reached.
+ */
+function createIntrospector(issuer, options, deps = {}) {
+    const endpoint = options.endpoint ?? `${issuer.replace(/\/+$/, '')}/oauth2/introspect`;
+    const now = deps.now ?? Date.now;
+    const doFetch = deps.fetchImpl ?? fetch;
+    const ttl = (options.cacheTtlSeconds ?? 60) * 1000;
+    const negativeTtl = (options.negativeCacheTtlSeconds ?? 10) * 1000;
+    const max = options.cacheMax ?? 10_000;
+    const cache = new Map();
+    const basic = `Basic ${btoa(`${encodeURIComponent(options.clientId)}:${encodeURIComponent(options.clientSecret)}`)}`;
+    return async (token) => {
+        const key = await sha256b64u(token);
+        const hit = cache.get(key);
+        if (hit && hit.until > now())
+            return hit.claims;
+        if (hit)
+            cache.delete(key);
+        const res = await doFetch(endpoint, {
+            method: 'POST',
+            headers: {
+                'content-type': 'application/x-www-form-urlencoded',
+                accept: 'application/json',
+                authorization: basic,
+            },
+            body: new URLSearchParams({ token, token_type_hint: 'access_token' }).toString(),
+        });
+        if (!res.ok)
+            throw new Error(`Introspection failed with HTTP ${res.status}.`);
+        const body = (await res.json());
+        const claims = body.active === true && body.token_use !== 'refresh_token' ? body : null;
+        const until = claims
+            ? Math.min(now() + ttl, typeof claims.exp === 'number' ? claims.exp * 1000 : now() + ttl)
+            : now() + negativeTtl;
+        if (until > now()) {
+            cache.set(key, { claims, until });
+            if (cache.size > max) {
+                for (const [k, v] of cache)
+                    if (v.until <= now())
+                        cache.delete(k);
+                while (cache.size > max)
+                    cache.delete(cache.keys().next().value);
+            }
+        }
+        return claims;
+    };
+}
+function header(req, name) {
+    const h = req.headers;
+    if (typeof h.get === 'function')
+        return h.get(name) ?? undefined;
+    const v = h[name] ?? h[name.toLowerCase()];
+    return Array.isArray(v) ? v[0] : v;
+}
+const quote = (v) => `"${v.replace(/["\\]/g, '\\$&')}"`;
+/**
+ * Build an RFC 6750 / RFC 9449 / RFC 9728 `WWW-Authenticate` challenge.
+ * Without an `error`, it is the bare "authentication required" challenge
+ * (no token was sent), as RFC 6750 §3.1 asks.
+ */
+function buildWwwAuthenticate(opts) {
+    const parts = [];
+    if (opts.realm)
+        parts.push(`realm=${quote(opts.realm)}`);
+    if (opts.error)
+        parts.push(`error=${quote(opts.error)}`);
+    if (opts.error && opts.description)
+        parts.push(`error_description=${quote(opts.description)}`);
+    if (opts.scope && opts.scope.length > 0)
+        parts.push(`scope=${quote(opts.scope.join(' '))}`);
+    if (opts.resourceMetadataUrl)
+        parts.push(`resource_metadata=${quote(opts.resourceMetadataUrl)}`);
+    if (opts.scheme === 'DPoP' && opts.dpopAlgs)
+        parts.push(`algs=${quote(opts.dpopAlgs.join(' '))}`);
+    return `${opts.scheme ?? 'Bearer'}${parts.length ? ` ${parts.join(', ')}` : ''}`;
+}
+async function sha256b64u(input) {
+    const digest = new Uint8Array(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(input)));
+    let bin = '';
+    for (const b of digest)
+        bin += String.fromCharCode(b);
+    return btoa(bin).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+/** Strip query + fragment (RFC 9449 §4.3 `htu` comparison). */
+function htuOf(url) {
+    try {
+        const u = new URL(url);
+        return `${u.protocol}//${u.host}${u.pathname}`;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * A reusable verifier (one JWKS cache for the life of the process). Call it per
+ * request; it never throws for a bad token — it returns the status + challenge.
+ */
+function createAccessTokenVerifier(options) {
+    if (!options.issuer)
+        throw new Error('createAccessTokenVerifier needs `issuer`.');
+    if (options.jwks && options.jwksUrl)
+        throw new Error('Pass `jwks` or `jwksUrl`, not both.');
+    const issuer = options.issuer.replace(/\/+$/, '');
+    const now = () => (options.now ?? Date.now)();
+    const jwks = new jwks_cache_1.JwksCache({
+        url: options.jwks ? undefined : (options.jwksUrl ?? `${issuer}/.well-known/jwks.json`),
+        staticJwks: options.jwks,
+        fetchImpl: options.fetchImpl,
+        now: options.now,
+    });
+    const audiences = options.audience === false ? null : typeof options.audience === 'string' ? [options.audience] : [...options.audience];
+    const replay = options.dpopReplayStore ?? memoryDpopReplayStore();
+    const introspect = options.introspection
+        ? createIntrospector(issuer, options.introspection, { fetchImpl: options.fetchImpl, now: options.now })
+        : null;
+    return async (request, extra) => {
+        const required = [...(options.requiredScopes ?? []), ...(extra?.requiredScopes ?? [])];
+        const scheme = options.requireDpop ? 'DPoP' : 'Bearer';
+        const nonce = options.dpopNonces ? await options.dpopNonces.current() : undefined;
+        const fail = (status, error, description, challengeScheme = scheme) => ({
+            ok: false,
+            status,
+            error,
+            description,
+            wwwAuthenticate: buildWwwAuthenticate({
+                scheme: challengeScheme,
+                realm: options.realm,
+                error,
+                description,
+                scope: error === 'insufficient_scope' || error === null ? required : undefined,
+                resourceMetadataUrl: options.resourceMetadataUrl,
+                dpopAlgs: DPOP_ALGS,
+            }),
+            ...(nonce ? { dpopNonce: nonce } : {}),
+        });
+        const authz = header(request, 'authorization');
+        if (!authz)
+            return fail(401, null, 'Authentication required.');
+        const m = /^(Bearer|DPoP)\s+([A-Za-z0-9\-._~+/]+=*)$/i.exec(authz.trim());
+        if (!m)
+            return fail(400, 'invalid_request', 'Malformed Authorization header.');
+        const presentedScheme = m[1].toLowerCase() === 'dpop' ? 'DPoP' : 'Bearer';
+        const token = m[2];
+        const isJwt = token.split('.').length === 3;
+        let claims;
+        if (!isJwt || (introspect && options.introspection?.introspectJwts)) {
+            // An opaque token (or a JWT the caller wants checked live) is validated by
+            // Atlas itself.
+            if (!introspect) {
+                return fail(401, 'invalid_token', 'The access token is not a JWT; configure `introspection` to accept opaque tokens.');
+            }
+            let active;
+            try {
+                active = await introspect(token);
+            }
+            catch {
+                return fail(401, 'invalid_token', 'The access token could not be validated right now.');
+            }
+            if (!active)
+                return fail(401, 'invalid_token', 'The access token is invalid or expired.');
+            if (active.iss !== undefined && String(active.iss).replace(/\/+$/, '') !== issuer) {
+                return fail(401, 'invalid_token', 'The access token was issued by another authorization server.');
+            }
+            if (typeof active.exp === 'number' && active.exp * 1000 + exports.ACCESS_TOKEN_CLOCK_SKEW_SECONDS * 1000 <= now()) {
+                return fail(401, 'invalid_token', 'The access token is invalid or expired.');
+            }
+            claims = active;
+        }
+        else {
+            const keys = await jwks.get((0, jwks_cache_1.readKid)(token));
+            if (!keys || keys.keys.length === 0)
+                return fail(401, 'invalid_token', 'No signing keys are available to verify the token.');
+            try {
+                const { payload } = await (0, jose_1.jwtVerify)(token, (0, jose_1.createLocalJWKSet)(keys), {
+                    issuer,
+                    algorithms: algs_1.ATLAS_SIGNING_ALGS,
+                    clockTolerance: exports.ACCESS_TOKEN_CLOCK_SKEW_SECONDS,
+                    currentDate: new Date(now()),
+                });
+                claims = payload;
+            }
+            catch {
+                return fail(401, 'invalid_token', 'The access token is invalid or expired.');
+            }
+        }
+        if (claims.token_use !== undefined && claims.token_use !== 'access_token') {
+            return fail(401, 'invalid_token', 'The token is not an access token.');
+        }
+        if (audiences) {
+            const aud = claims.aud === undefined ? [] : Array.isArray(claims.aud) ? claims.aud : [claims.aud];
+            if (!aud.some((a) => audiences.includes(a))) {
+                return fail(401, 'invalid_token', 'The access token was not issued for this resource.');
+            }
+        }
+        // Sender constraint (RFC 9449). A bound token is only ever a DPoP token.
+        const jkt = claims.cnf?.jkt;
+        if (jkt || options.requireDpop || presentedScheme === 'DPoP') {
+            if (!jkt)
+                return fail(401, 'invalid_token', 'This resource requires a DPoP-bound access token.', 'DPoP');
+            if (presentedScheme !== 'DPoP') {
+                return fail(401, 'invalid_token', 'A DPoP-bound access token must be sent with the DPoP scheme.', 'DPoP');
+            }
+            const proof = header(request, 'dpop');
+            if (!proof)
+                return fail(401, 'invalid_dpop_proof', 'A DPoP proof is required.', 'DPoP');
+            const proofError = await checkDpopProof(proof, {
+                token,
+                jkt,
+                method: (request.method ?? 'GET').toUpperCase(),
+                url: request.url ?? '',
+                publicOrigin: options.publicOrigin,
+                now: now(),
+                replay,
+                nonces: options.dpopNonces,
+            });
+            if (proofError)
+                return fail(401, proofError.code, proofError.message, 'DPoP');
+        }
+        const scopes = (claims.scope ?? '').split(' ').filter(Boolean);
+        const granted = new Set([...scopes, ...(claims.permissions ?? [])]);
+        const missing = required.filter((s) => !granted.has(s));
+        if (missing.length > 0) {
+            return fail(403, 'insufficient_scope', `The access token is missing the required scope(s): ${missing.join(' ')}.`);
+        }
+        return {
+            ok: true,
+            claims,
+            scopes,
+            subject: claims.sub,
+            clientId: (claims.client_id ?? claims.azp ?? null),
+            dpopBound: !!jkt,
+            ...(nonce ? { dpopNonce: nonce } : {}),
+        };
+    };
+}
+async function checkDpopProof(proof, ctx) {
+    const refuse = (message) => ({ code: 'invalid_dpop_proof', message });
+    let jwk;
+    let alg;
+    try {
+        const h = (0, jose_1.decodeProtectedHeader)(proof);
+        if (h.typ !== 'dpop+jwt')
+            return refuse('The DPoP proof must have typ dpop+jwt.');
+        if (!h.alg || !DPOP_ALGS.includes(h.alg))
+            return refuse('The DPoP proof uses an unsupported algorithm.');
+        if (!h.jwk || typeof h.jwk !== 'object')
+            return refuse('The DPoP proof must carry its public key.');
+        jwk = h.jwk;
+        if ('d' in jwk || 'k' in jwk)
+            return refuse('The DPoP proof key must be a public key.');
+        alg = h.alg;
+    }
+    catch {
+        return refuse('The DPoP proof is malformed.');
+    }
+    let payload;
+    try {
+        const key = await (0, jose_1.importJWK)(jwk, alg);
+        ({ payload } = await (0, jose_1.jwtVerify)(proof, key, { algorithms: [alg], typ: 'dpop+jwt', currentDate: new Date(ctx.now) }));
+    }
+    catch {
+        return refuse('The DPoP proof signature is invalid.');
+    }
+    if ((await (0, jose_1.calculateJwkThumbprint)(jwk, 'sha256')) !== ctx.jkt) {
+        return refuse('The DPoP proof key does not match the token binding.');
+    }
+    if (payload.htm !== ctx.method)
+        return refuse('The DPoP proof htm does not match the request method.');
+    const absolute = /^https?:\/\//i.test(ctx.url) ? ctx.url : ctx.publicOrigin ? new URL(ctx.url, ctx.publicOrigin).toString() : null;
+    const expected = absolute ? htuOf(absolute) : null;
+    if (!expected || typeof payload.htu !== 'string' || htuOf(payload.htu) !== expected) {
+        return refuse('The DPoP proof htu does not match the request URL.');
+    }
+    const iat = typeof payload.iat === 'number' ? payload.iat * 1000 : NaN;
+    if (!Number.isFinite(iat) ||
+        iat > ctx.now + exports.ACCESS_TOKEN_CLOCK_SKEW_SECONDS * 1000 ||
+        ctx.now - iat > exports.DPOP_PROOF_MAX_AGE_SECONDS * 1000) {
+        return refuse('The DPoP proof is too old or from the future.');
+    }
+    if (payload.ath !== (await sha256b64u(ctx.token)))
+        return refuse('The DPoP proof ath does not match the access token.');
+    if (typeof payload.jti !== 'string' || !payload.jti)
+        return refuse('The DPoP proof needs a jti.');
+    if (ctx.nonces) {
+        const nonce = typeof payload.nonce === 'string' ? payload.nonce : '';
+        if (!nonce || !(await ctx.nonces.valid(nonce))) {
+            return { code: 'use_dpop_nonce', message: 'The DPoP proof must carry the nonce from the DPoP-Nonce header.' };
+        }
+    }
+    if (!(await ctx.replay.claim(`${ctx.jkt}:${payload.jti}`, iat + exports.DPOP_PROOF_MAX_AGE_SECONDS * 1000))) {
+        return refuse('The DPoP proof has already been used.');
+    }
+    return null;
+}
+/** One-shot form of {@link createAccessTokenVerifier} (builds a fresh JWKS cache each call — prefer the factory). */
+function verifyAccessToken(request, options) {
+    return createAccessTokenVerifier(options)(request);
+}
+/**
+ * The RFC 9728 protected-resource metadata document for your API. Serve it as
+ * JSON at `https://<your api host>/.well-known/oauth-protected-resource` (and,
+ * for a resource with a path, at `/.well-known/oauth-protected-resource<path>`),
+ * and point `resourceMetadataUrl` at it. Atlas can also serve this document for
+ * you when the API is registered with metadata publishing turned on.
+ */
+function protectedResourceMetadata(opts) {
+    return {
+        resource: opts.resource,
+        authorization_servers: [opts.issuer.replace(/\/+$/, '')],
+        bearer_methods_supported: ['header'],
+        ...(opts.scopesSupported ? { scopes_supported: [...opts.scopesSupported] } : {}),
+        ...(opts.resourceName ? { resource_name: opts.resourceName } : {}),
+        ...(opts.resourceDocumentation ? { resource_documentation: opts.resourceDocumentation } : {}),
+        dpop_signing_alg_values_supported: DPOP_ALGS,
+        ...(opts.dpopBoundAccessTokensRequired ? { dpop_bound_access_tokens_required: true } : {}),
+    };
+}
+/** The RFC 9728 well-known path for a resource identifier (path-inserted form). */
+function protectedResourceMetadataPath(resource) {
+    const u = new URL(resource);
+    const path = u.pathname === '/' ? '' : u.pathname.replace(/\/+$/, '');
+    return `/.well-known/oauth-protected-resource${path}`;
+}
+//# sourceMappingURL=oauth-resource.js.map

package/dist/oauth-resource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-resource.js","sourceRoot":"","sources":["../src/oauth-resource.ts"],"names":[],"mappings":";;;AAwFA,sDA4BC;AASD,kDA4BC;AASD,sDAcC;AAwED,gDA4CC;AA6CD,oDAiBC;AAuBD,8DA0IC;AAoED,8CAKC;AASD,8DAqBC;AAGD,sEAIC;AAjnBD,+BAOc;AACd,6CAA6D;AAC7D,iCAA4C;AAE5C;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,mEAAmE;AACtD,QAAA,+BAA+B,GAAG,CAAC,CAAC;AACjD,mCAAmC;AACtB,QAAA,0BAA0B,GAAG,GAAG,CAAC;AAC9C,MAAM,SAAS,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAyC7G,MAAM,4BAA4B,GAAG,GAAG,CAAC;AAEzC;;;;;GAKG;AACH,SAAgB,qBAAqB,CACnC,UAA0D,EAAE;IAE5D,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,4BAA4B,CAAC,GAAG,IAAI,CAAC;IAC9E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,MAAM,MAAM,GAAG,GAAG,EAAE;QAClB,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QACzD,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,KAAK,MAAM,CAAC,IAAI,KAAK;YAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC9E,CAAC,CAAC;IACF,MAAM,EAAE,GAAG,CAAC,KAAa,EAAE,EAAE;QAC3B,IAAI,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,CAAC,GAAG,MAAM,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACrB,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE;gBAAE,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC;oBAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,OAAO;QACL,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC;QAC7C,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC;YACzC,OAAO,KAAK,KAAK,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,MAAM,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAChE,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,mBAAmB,CACjC,MAA2B,EAC3B,UAA0D,EAAE;IAE5D,MAAM,GAAG,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACnF,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACzF,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,4BAA4B,CAAC,GAAG,IAAI,CAAC;IAC9E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IACzG,MAAM,EAAE,GAAG,KAAK,EAAE,KAAa,EAAE,EAAE;QACjC,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC7D,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC9C,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAChB,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;QAClF,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,KAAK,MAAM,CAAC,IAAI,GAAG;YAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC9E,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC;IAC/C,OAAO;QACL,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QAC1B,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YACrB,MAAM,CAAC,GAAG,KAAK,EAAE,CAAC;YAClB,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACrD,OAAO,iBAAiB,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,iBAAiB,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACpE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAS,EAAE,CAAS;IAC7C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC7E,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,SAAgB,qBAAqB,CAAC,GAAG,GAAG,MAAM;IAChD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,OAAO;QACL,KAAK,CAAC,GAAG,EAAE,SAAS;YAClB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG;gBAAE,OAAO,KAAK,CAAC;YAC7C,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YACzB,IAAI,IAAI,CAAC,IAAI,GAAG,GAAG,EAAE,CAAC;gBACpB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI;oBAAE,IAAI,CAAC,IAAI,GAAG;wBAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBACxD,OAAO,IAAI,CAAC,IAAI,GAAG,GAAG;oBAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAe,CAAC,CAAC;YAC1E,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC;AAmED;;;;GAIG;AACH,SAAgB,kBAAkB,CAChC,MAAc,EACd,OAA6B,EAC7B,OAAyD,EAAE;IAE3D,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,oBAAoB,CAAC;IACvF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IACxC,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;IACnD,MAAM,WAAW,GAAG,CAAC,OAAO,CAAC,uBAAuB,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;IACnE,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC;IACvC,MAAM,KAAK,GAAG,IAAI,GAAG,EAA+D,CAAC;IACrF,MAAM,KAAK,GAAG,SAAS,IAAI,CAAC,GAAG,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,kBAAkB,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,CAAC;IAErH,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE;QACrB,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,GAAG,GAAG,EAAE;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC;QAChD,IAAI,GAAG;YAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAE3B,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE;YAClC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;gBACnD,MAAM,EAAE,kBAAkB;gBAC1B,aAAa,EAAE,KAAK;aACrB;YACD,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC,CAAC,QAAQ,EAAE;SACjF,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;QAC9E,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,IAAI,CAAC,SAAS,KAAK,eAAe,CAAC,CAAC,CAAE,IAA0B,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/G,MAAM,KAAK,GAAG,MAAM;YAClB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC;YACzF,CAAC,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC;QACxB,IAAI,KAAK,GAAG,GAAG,EAAE,EAAE,CAAC;YAClB,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAClC,IAAI,KAAK,CAAC,IAAI,GAAG,GAAG,EAAE,CAAC;gBACrB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK;oBAAE,IAAI,CAAC,CAAC,KAAK,IAAI,GAAG,EAAE;wBAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAClE,OAAO,KAAK,CAAC,IAAI,GAAG,GAAG;oBAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAe,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AA+BD,SAAS,MAAM,CAAC,GAAwB,EAAE,IAAY;IACpD,MAAM,CAAC,GAAG,GAAG,CAAC,OAAiG,CAAC;IAChH,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,UAAU;QAAE,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;IACjE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3C,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC;AAEhE;;;;GAIG;AACH,SAAgB,oBAAoB,CAAC,IAQpC;IACC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,IAAI,CAAC,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACzD,IAAI,IAAI,CAAC,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACzD,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,WAAW;QAAE,KAAK,CAAC,IAAI,CAAC,qBAAqB,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAC/F,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IAC5F,IAAI,IAAI,CAAC,mBAAmB;QAAE,KAAK,CAAC,IAAI,CAAC,qBAAqB,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;IACjG,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IAClG,OAAO,GAAG,IAAI,CAAC,MAAM,IAAI,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACnF,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,KAAa;IACrC,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACtG,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACtD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,+DAA+D;AAC/D,SAAS,KAAK,CAAC,GAAW;IACxB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,yBAAyB,CACvC,OAAmC;IAEnC,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAClF,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC5F,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAC9C,MAAM,IAAI,GAAG,IAAI,sBAAS,CAAC;QACzB,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,IAAI,GAAG,MAAM,wBAAwB,CAAC;QACtF,UAAU,EAAE,OAAO,CAAC,IAAI;QACxB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAC;IACH,MAAM,SAAS,GACb,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxH,MAAM,MAAM,GAAG,OAAO,CAAC,eAAe,IAAI,qBAAqB,EAAE,CAAC;IAClE,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa;QACtC,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;QACvG,CAAC,CAAC,IAAI,CAAC;IAET,OAAO,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC9B,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,EAAE,cAAc,IAAI,EAAE,CAAC,CAAC,CAAC;QACvF,MAAM,MAAM,GAAsB,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC1E,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAClF,MAAM,IAAI,GAAG,CACX,MAAuB,EACvB,KAAkC,EAClC,WAAmB,EACnB,kBAAqC,MAAM,EACxB,EAAE,CAAC,CAAC;YACvB,EAAE,EAAE,KAAK;YACT,MAAM;YACN,KAAK;YACL,WAAW;YACX,eAAe,EAAE,oBAAoB,CAAC;gBACpC,MAAM,EAAE,eAAe;gBACvB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,KAAK;gBACL,WAAW;gBACX,KAAK,EAAE,KAAK,KAAK,oBAAoB,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;gBAC9E,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;gBAChD,QAAQ,EAAE,SAAS;aACpB,CAAC;YACF,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvC,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,0BAA0B,CAAC,CAAC;QAC/D,MAAM,CAAC,GAAG,4CAA4C,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,iBAAiB,EAAE,iCAAiC,CAAC,CAAC;QAC/E,MAAM,eAAe,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC3E,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QACpB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;QAE5C,IAAI,MAAyB,CAAC;QAC9B,IAAI,CAAC,KAAK,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC,aAAa,EAAE,cAAc,CAAC,EAAE,CAAC;YACpE,2EAA2E;YAC3E,gBAAgB;YAChB,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,mFAAmF,CAAC,CAAC;YACzH,CAAC;YACD,IAAI,MAAgC,CAAC;YACrC,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;YACnC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,oDAAoD,CAAC,CAAC;YAC1F,CAAC;YACD,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,yCAAyC,CAAC,CAAC;YAC1F,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,MAAM,EAAE,CAAC;gBAClF,OAAO,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,8DAA8D,CAAC,CAAC;YACpG,CAAC;YACD,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,GAAG,IAAI,GAAG,uCAA+B,GAAG,IAAI,IAAI,GAAG,EAAE,EAAE,CAAC;gBAC1G,OAAO,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,yCAAyC,CAAC,CAAC;YAC/E,CAAC;YACD,MAAM,GAAG,MAAM,CAAC;QAClB,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAA,oBAAO,EAAC,KAAK,CAAC,CAAC,CAAC;YAC5C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,oDAAoD,CAAC,CAAC;YAC7H,IAAI,CAAC;gBACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,gBAAS,EAAC,KAAK,EAAE,IAAA,wBAAiB,EAAC,IAAa,CAAC,EAAE;oBAC3E,MAAM;oBACN,UAAU,EAAE,yBAAkB;oBAC9B,cAAc,EAAE,uCAA+B;oBAC/C,WAAW,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;iBAC7B,CAAC,CAAC;gBACH,MAAM,GAAG,OAA4B,CAAC;YACxC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,yCAAyC,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,cAAc,EAAE,CAAC;YAC1E,OAAO,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,mCAAmC,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAClG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5C,OAAO,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,oDAAoD,CAAC,CAAC;YAC1F,CAAC;QACH,CAAC;QAED,yEAAyE;QACzE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC;QAC5B,IAAI,GAAG,IAAI,OAAO,CAAC,WAAW,IAAI,eAAe,KAAK,MAAM,EAAE,CAAC;YAC7D,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,mDAAmD,EAAE,MAAM,CAAC,CAAC;YACzG,IAAI,eAAe,KAAK,MAAM,EAAE,CAAC;gBAC/B,OAAO,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,8DAA8D,EAAE,MAAM,CAAC,CAAC;YAC5G,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACtC,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,MAAM,CAAC,CAAC;YACxF,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE;gBAC7C,KAAK;gBACL,GAAG;gBACH,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE;gBAC/C,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,EAAE;gBACtB,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,GAAG,EAAE,GAAG,EAAE;gBACV,MAAM;gBACN,MAAM,EAAE,OAAO,CAAC,UAAU;aAC3B,CAAC,CAAC;YACH,IAAI,UAAU;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAChF,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACpE,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,GAAG,EAAE,oBAAoB,EAAE,sDAAsD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrH,CAAC;QACD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM;YACN,MAAM;YACN,OAAO,EAAE,MAAM,CAAC,GAAG;YACnB,QAAQ,EAAE,CAAC,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,GAAG,IAAI,IAAI,CAAkB;YACnE,SAAS,EAAE,CAAC,CAAC,GAAG;YAChB,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvC,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,KAAa,EACb,GASC;IAED,MAAM,MAAM,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,oBAA6B,EAAE,OAAO,EAAE,CAAC,CAAC;IACvF,IAAI,GAAQ,CAAC;IACb,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAA,4BAAqB,EAAC,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,CAAC,GAAG,KAAK,UAAU;YAAE,OAAO,MAAM,CAAC,wCAAwC,CAAC,CAAC;QAClF,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC;YAAE,OAAO,MAAM,CAAC,+CAA+C,CAAC,CAAC;QACzG,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC,2CAA2C,CAAC,CAAC;QACpG,GAAG,GAAG,CAAC,CAAC,GAAU,CAAC;QACnB,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG;YAAE,OAAO,MAAM,CAAC,0CAA0C,CAAC,CAAC;QACxF,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,8BAA8B,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAA,gBAAS,EAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACtC,CAAC,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,gBAAS,EAAC,KAAK,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACtH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,sCAAsC,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,CAAC,MAAM,IAAA,6BAAsB,EAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,KAAK,GAAG,CAAC,GAAG,EAAE,CAAC;QAC9D,OAAO,MAAM,CAAC,sDAAsD,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,KAAK,GAAG,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC,uDAAuD,CAAC,CAAC;IACvG,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACnI,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnD,IAAI,CAAC,QAAQ,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,QAAQ,EAAE,CAAC;QACpF,OAAO,MAAM,CAAC,oDAAoD,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;IACvE,IACE,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QACrB,GAAG,GAAG,GAAG,CAAC,GAAG,GAAG,uCAA+B,GAAG,IAAI;QACtD,GAAG,CAAC,GAAG,GAAG,GAAG,GAAG,kCAA0B,GAAG,IAAI,EACjD,CAAC;QACD,OAAO,MAAM,CAAC,+CAA+C,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC,qDAAqD,CAAC,CAAC;IACxH,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG;QAAE,OAAO,MAAM,CAAC,6BAA6B,CAAC,CAAC;IAClG,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC/C,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,iEAAiE,EAAE,CAAC;QAChH,CAAC;IACH,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,GAAG,kCAA0B,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC;QACpG,OAAO,MAAM,CAAC,uCAAuC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,qHAAqH;AACrH,SAAgB,iBAAiB,CAC/B,OAA4B,EAC5B,OAAmC;IAEnC,OAAO,yBAAyB,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,yBAAyB,CAAC,IAUzC;IACC,OAAO;QACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,qBAAqB,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACxD,wBAAwB,EAAE,CAAC,QAAQ,CAAC;QACpC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,GAAG,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,IAAI,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7F,iCAAiC,EAAE,SAAS;QAC5C,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,CAAC,EAAE,iCAAiC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3F,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,SAAgB,6BAA6B,CAAC,QAAgB;IAC5D,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACtE,OAAO,wCAAwC,IAAI,EAAE,CAAC;AACxD,CAAC"}

package/dist/oidc.d.ts

@@ -20,7 +20,7 @@ import { type JWTPayload } from 'jose';
  *    minute so a burst of callbacks cannot become an outbound request flood),
  *    the code exchange with the client's authentication method, and the JWKS
  *    (the package's rate-limited kid-miss cache).
- *  - ID-token verification with the algorithm PINNED to RS256 (so `alg: none`
+ *  - ID-token verification with the algorithm PINNED to RS256 or ES256 (so `alg: none`
  *    and HS* confusion are refused), `iss` exact, `aud` containing the client id
  *    (and `azp` equal to it when there are several audiences or an `azp` at all),
  *    `nonce` equal to the cookie's, `exp`/`iat` with a small tolerance, and

package/dist/oidc.js

@@ -10,6 +10,7 @@ exports.resetOidcCaches = resetOidcCaches;
 const jose_1 = require("jose");
 const handshake_1 = require("./handshake");
 const jwks_cache_1 = require("./jwks-cache");
+const algs_1 = require("./algs");
 class AtlasOidcError extends Error {
     code;
     /** The OAuth `error` value from the authorization or token endpoint, when there was one. */
@@ -247,8 +248,9 @@ async function verifyIdToken(idToken, discovery, opts) {
     if (!header)
         throw invalid('it is not a JWT');
     // Pinned before any key lookup, so `none` and HS* never get near a key.
-    if (header.alg !== 'RS256')
-        throw invalid(`its algorithm is ${String(header.alg)}, not RS256`);
+    if (typeof header.alg !== 'string' || !algs_1.ATLAS_SIGNING_ALGS.includes(header.alg)) {
+        throw invalid(`its algorithm is ${String(header.alg)}, not RS256 or ES256`);
+    }
     const keys = await jwksFor(discovery.jwks_uri, opts).get(typeof header.kid === 'string' ? header.kid : undefined);
     if (!keys || keys.keys.length === 0) {
         throw new AtlasOidcError('discovery_failed', `The issuer's signing keys could not be fetched from ${discovery.jwks_uri}.`);
@@ -256,7 +258,7 @@ async function verifyIdToken(idToken, discovery, opts) {
     let payload;
     try {
         ({ payload } = await (0, jose_1.jwtVerify)(idToken, (0, jose_1.createLocalJWKSet)(keys), {
-            algorithms: ['RS256'],
+            algorithms: algs_1.ATLAS_SIGNING_ALGS,
             issuer: discovery.issuer,
             audience: opts.clientId,
             clockTolerance: opts.clockToleranceSec,