@atproto/oauth-provider 0.8.0 → 0.9.0

package/dist/oauth-provider.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OAuthProvider = exports.Keyset = exports.AccessTokenMode = void 0;
+const node_crypto_1 = require("node:crypto");
+const zod_1 = require("zod");
 const jwk_1 = require("@atproto/jwk");
 Object.defineProperty(exports, "Keyset", { enumerable: true, get: function () { return jwk_1.Keyset; } });
 const oauth_types_1 = require("@atproto/oauth-types");
@@ -10,7 +12,6 @@ const access_token_mode_js_1 = require("./access-token/access-token-mode.js");
 Object.defineProperty(exports, "AccessTokenMode", { enumerable: true, get: function () { return access_token_mode_js_1.AccessTokenMode; } });
 const account_manager_js_1 = require("./account/account-manager.js");
 const account_store_js_1 = require("./account/account-store.js");
-const client_auth_js_1 = require("./client/client-auth.js");
 const client_manager_js_1 = require("./client/client-manager.js");
 const client_store_js_1 = require("./client/client-store.js");
 const constants_js_1 = require("./constants.js");
@@ -20,8 +21,9 @@ const device_store_js_1 = require("./device/device-store.js");
 const access_denied_error_js_1 = require("./errors/access-denied-error.js");
 const account_selection_required_error_js_1 = require("./errors/account-selection-required-error.js");
 const consent_required_error_js_1 = require("./errors/consent-required-error.js");
+const invalid_dpop_key_binding_error_js_1 = require("./errors/invalid-dpop-key-binding-error.js");
+const invalid_dpop_proof_error_js_1 = require("./errors/invalid-dpop-proof-error.js");
 const invalid_grant_error_js_1 = require("./errors/invalid-grant-error.js");
-const invalid_parameters_error_js_1 = require("./errors/invalid-parameters-error.js");
 const invalid_request_error_js_1 = require("./errors/invalid-request-error.js");
 const login_required_error_js_1 = require("./errors/login-required-error.js");
 const date_js_1 = require("./lib/util/date.js");
@@ -31,8 +33,6 @@ const oauth_verifier_js_1 = require("./oauth-verifier.js");
 const replay_store_js_1 = require("./replay/replay-store.js");
 const code_js_1 = require("./request/code.js");
 const request_manager_js_1 = require("./request/request-manager.js");
-const request_store_memory_js_1 = require("./request/request-store-memory.js");
-const request_store_redis_js_1 = require("./request/request-store-redis.js");
 const request_store_js_1 = require("./request/request-store.js");
 const request_uri_js_1 = require("./request/request-uri.js");
 const token_manager_js_1 = require("./token/token-manager.js");
@@ -49,11 +49,11 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
     tokenManager;
     constructor({ 
     // OAuthProviderConfig
-    authenticationMaxAge = constants_js_1.AUTHENTICATION_MAX_AGE, tokenMaxAge = constants_js_1.TOKEN_MAX_AGE, accessTokenMode = access_token_mode_js_1.AccessTokenMode.stateless, metadata, safeFetch = (0, fetch_node_1.safeFetchWrap)(), redis, store, // compound store implementation
+    authenticationMaxAge = constants_js_1.AUTHENTICATION_MAX_AGE, tokenMaxAge = constants_js_1.TOKEN_MAX_AGE, accessTokenMode = access_token_mode_js_1.AccessTokenMode.stateless, metadata, safeFetch = (0, fetch_node_1.safeFetchWrap)(), store, // compound store implementation
     // Requires stores
-    accountStore = (0, account_store_js_1.asAccountStore)(store), deviceStore = (0, device_store_js_1.asDeviceStore)(store), tokenStore = (0, token_store_js_1.asTokenStore)(store), 
+    accountStore = (0, account_store_js_1.asAccountStore)(store), deviceStore = (0, device_store_js_1.asDeviceStore)(store), tokenStore = (0, token_store_js_1.asTokenStore)(store), requestStore = (0, request_store_js_1.asRequestStore)(store), 
     // These are optional
-    clientStore = (0, client_store_js_1.ifClientStore)(store), replayStore = (0, replay_store_js_1.ifReplayStore)(store), requestStore = (0, request_store_js_1.ifRequestStore)(store), clientJwksCache = new simple_store_memory_1.SimpleStoreMemory({
+    clientStore = (0, client_store_js_1.ifClientStore)(store), replayStore = (0, replay_store_js_1.ifReplayStore)(store), clientJwksCache = new simple_store_memory_1.SimpleStoreMemory({
         maxSize: 50_000_000,
         ttl: 600e3,
     }), clientMetadataCache = new simple_store_memory_1.SimpleStoreMemory({
@@ -77,10 +77,7 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
         // @NOTE: validation of super params (if we wanted to implement it) should
         // be the responsibility of the super class.
         const superOptions = rest;
-        super({ replayStore, redis, ...superOptions });
-        requestStore ??= redis
-            ? new request_store_redis_js_1.RequestStoreRedis({ redis })
-            : new request_store_memory_js_1.RequestStoreMemory();
+        super({ replayStore, ...superOptions });
         this.accessTokenMode = accessTokenMode;
         this.authenticationMaxAge = authenticationMaxAge;
         this.metadata = (0, build_metadata_js_1.buildMetadata)(this.issuer, this.keyset, metadata);
@@ -116,69 +113,91 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
         const authAge = Date.now() - deviceAccount.updatedAt.getTime();
         return authAge > this.authenticationMaxAge;
     }
-    async authenticateClient(credentials) {
-        const client = await this.clientManager.getClient(credentials.client_id);
-        const { clientAuth, nonce } = await client.verifyCredentials(credentials, {
-            audience: this.issuer,
-        });
-        if (client.metadata.application_type === 'native' &&
-            clientAuth.method !== 'none') {
-            // https://datatracker.ietf.org/doc/html/rfc8252#section-8.4
-            //
-            // > Except when using a mechanism like Dynamic Client Registration
-            // > [RFC7591] to provision per-instance secrets, native apps are
-            // > classified as public clients, as defined by Section 2.1 of OAuth 2.0
-            // > [RFC6749]; they MUST be registered with the authorization server as
-            // > such. Authorization servers MUST record the client type in the client
-            // > registration details in order to identify and process requests
-            // > accordingly.
-            throw new invalid_grant_error_js_1.InvalidGrantError('Native clients must authenticate using "none" method');
+    async authenticateClient(clientCredentials, dpopProof, options) {
+        const client = await this.clientManager.getClient(clientCredentials.client_id);
+        if (client.metadata.dpop_bound_access_tokens &&
+            !dpopProof &&
+            !options?.allowMissingDpopProof) {
+            throw new invalid_dpop_proof_error_js_1.InvalidDpopProofError('DPoP proof required');
+        }
+        if (dpopProof && !client.metadata.dpop_bound_access_tokens) {
+            throw new invalid_dpop_proof_error_js_1.InvalidDpopProofError('DPoP proof not allowed for this client');
         }
-        if (nonce != null) {
-            const unique = await this.replayManager.uniqueAuth(nonce, client.id);
+        const clientAuth = await client.authenticate(clientCredentials, {
+            authorizationServerIdentifier: this.issuer,
+        });
+        if (clientAuth.method === 'private_key_jwt') {
+            // Clients MUST NOT use their client assertion key to sign DPoP proofs
+            if (dpopProof && clientAuth.jkt === dpopProof.jkt) {
+                throw new invalid_request_error_js_1.InvalidRequestError('The DPoP proof must be signed with a different key than the client assertion');
+            }
+            // https://www.rfc-editor.org/rfc/rfc7523.html#section-3
+            // > 7.  [...] The authorization server MAY ensure that JWTs are not
+            // >     replayed by maintaining the set of used "jti" values for the
+            // >     length of time for which the JWT would be considered valid based
+            // >     on the applicable "exp" instant.
+            const unique = await this.replayManager.uniqueAuth(clientAuth.jti, client.id, clientAuth.exp);
             if (!unique) {
                 throw new invalid_grant_error_js_1.InvalidGrantError(`${clientAuth.method} jti reused`);
             }
         }
-        return [client, clientAuth];
+        return { client, clientAuth };
     }
     async decodeJAR(client, input) {
-        const result = await client.decodeRequestObject(input.request);
-        const payload = oauth_types_1.oauthAuthorizationRequestParametersSchema.parse(result.payload);
-        if (!result.payload.jti) {
-            throw new invalid_parameters_error_js_1.InvalidParametersError(payload, 'Request object must contain a jti claim');
-        }
-        if (!(await this.replayManager.uniqueJar(result.payload.jti, client.id))) {
-            throw new invalid_parameters_error_js_1.InvalidParametersError(payload, 'Request object jti is not unique');
-        }
-        if ('protectedHeader' in result) {
-            if (!result.protectedHeader.kid) {
-                throw new invalid_parameters_error_js_1.InvalidParametersError(payload, 'Missing "kid" in header');
-            }
-            return {
-                jkt: await (0, client_auth_js_1.authJwkThumbprint)(result.key),
-                payload,
-                protectedHeader: result.protectedHeader,
-            };
+        const { payload } = await client.decodeRequestObject(input.request, this.issuer);
+        const { jti } = payload;
+        if (!jti) {
+            throw new invalid_request_error_js_1.InvalidRequestError('Request object payload must contain a "jti" claim');
         }
-        if ('header' in result) {
-            return {
-                payload,
-            };
+        if (!(await this.replayManager.uniqueJar(jti, client.id))) {
+            throw new invalid_request_error_js_1.InvalidRequestError('Request object was replayed');
         }
-        // Should never happen
-        throw new Error('Invalid request object');
+        const parameters = await oauth_types_1.oauthAuthorizationRequestParametersSchema
+            .parseAsync(payload)
+            .catch((err) => {
+            const message = err instanceof zod_1.ZodError
+                ? `Invalid request parameters: ${err.message}`
+                : `Invalid "request" object`;
+            throw invalid_request_error_js_1.InvalidRequestError.from(err, message);
+        });
+        return parameters;
     }
     /**
      * @see {@link https://datatracker.ietf.org/doc/html/rfc9126}
      */
     async pushedAuthorizationRequest(credentials, authorizationRequest, dpopProof) {
         try {
-            const [client, clientAuth] = await this.authenticateClient(credentials);
-            const { payload: parameters } = 'request' in authorizationRequest // Handle JAR
+            const { client, clientAuth } = await this.authenticateClient(credentials, dpopProof, 
+            // Allow missing DPoP header for PAR requests as rfc9449 allows it
+            // (though the dpop_jkt parameter must be present in that case, see
+            // check bellow).
+            { allowMissingDpopProof: true });
+            const parameters = 'request' in authorizationRequest // Handle JAR
                 ? await this.decodeJAR(client, authorizationRequest)
-                : { payload: authorizationRequest };
-            const { uri, expiresAt } = await this.requestManager.createAuthorizationRequest(client, clientAuth, parameters, null, dpopProof);
+                : authorizationRequest;
+            if (!parameters.dpop_jkt) {
+                if (client.metadata.dpop_bound_access_tokens) {
+                    if (dpopProof)
+                        parameters.dpop_jkt = dpopProof.jkt;
+                    else {
+                        // @NOTE When both PAR and DPoP are used, either the DPoP header, or
+                        // the dpop_jkt parameter must be present. We do not enforce this
+                        // for legacy reasons.
+                        // https://datatracker.ietf.org/doc/html/rfc9449#section-10.1
+                    }
+                }
+            }
+            else {
+                if (!client.metadata.dpop_bound_access_tokens) {
+                    throw new invalid_request_error_js_1.InvalidRequestError('DPoP bound access tokens are not enabled for this client');
+                }
+                // Proof is optional if the dpop_jkt is provided, but if it is provided,
+                // it must match the DPoP proof JKT.
+                if (dpopProof && dpopProof.jkt !== parameters.dpop_jkt) {
+                    throw new invalid_dpop_key_binding_error_js_1.InvalidDpopKeyBindingError();
+                }
+            }
+            const { uri, expiresAt } = await this.requestManager.createAuthorizationRequest(client, clientAuth, parameters, null);
             return {
                 request_uri: uri,
                 expires_in: (0, date_js_1.dateToRelativeSeconds)(expiresAt),
@@ -196,6 +215,7 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
         }
     }
     async processAuthorizationRequest(client, deviceId, query) {
+        // PAR
         if ('request_uri' in query) {
             const requestUri = await request_uri_js_1.requestUriSchema
                 .parseAsync(query.request_uri, { path: ['query', 'request_uri'] })
@@ -204,22 +224,24 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
             });
             return this.requestManager.get(requestUri, deviceId, client.id);
         }
+        // JAR
         if ('request' in query) {
-            const requestObject = await this.decodeJAR(client, query);
-            if ('protectedHeader' in requestObject && requestObject.protectedHeader) {
-                // Allow using signed JAR during "/authorize" as client authentication.
-                // This allows clients to skip PAR to initiate trusted sessions.
-                const clientAuth = {
-                    method: oauth_types_1.CLIENT_ASSERTION_TYPE_JWT_BEARER,
-                    kid: requestObject.protectedHeader.kid,
-                    alg: requestObject.protectedHeader.alg,
-                    jkt: requestObject.jkt,
-                };
-                return this.requestManager.createAuthorizationRequest(client, clientAuth, requestObject.payload, deviceId, null);
-            }
-            return this.requestManager.createAuthorizationRequest(client, { method: 'none' }, requestObject.payload, deviceId, null);
+            // @NOTE Since JAR are signed with the client's private key, a JAR *could*
+            // technically be used to authenticate the client when requests are
+            // created without PAR (i.e. created on the fly by the authorize
+            // endpoint). This implementation actually used to support this
+            // (un-spec'd) behavior. That support was removed:
+            // - Because it was not actually used
+            // - Because it was not part of any standard
+            // - Because it makes extending the client authentication mechanism more
+            //   complex since any extension would not only need to affect the
+            //   "private_key_jwt" auth method but also the JAR "request" object.
+            const parameters = await this.decodeJAR(client, query);
+            return this.requestManager.createAuthorizationRequest(client, null, parameters, deviceId);
         }
-        return this.requestManager.createAuthorizationRequest(client, { method: 'none' }, query, deviceId, null);
+        // "Regular" authorization request (created on the fly by directing the user
+        // to the authorization endpoint with all the parameters in the url).
+        return this.requestManager.createAuthorizationRequest(client, null, query, deviceId);
     }
     /**
      * @see {@link https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-11#section-4.1.1}
@@ -325,7 +347,7 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
         }));
     }
     async token(clientCredentials, clientMetadata, request, dpopProof) {
-        const [client, clientAuth] = await this.authenticateClient(clientCredentials);
+        const { client, clientAuth } = await this.authenticateClient(clientCredentials, dpopProof);
         if (!this.metadata.grant_types_supported?.includes(request.grant_type)) {
             throw new invalid_grant_error_js_1.InvalidGrantError(`Grant type "${request.grant_type}" is not supported by the server`);
         }
@@ -333,77 +355,201 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
             throw new invalid_grant_error_js_1.InvalidGrantError(`"${request.grant_type}" grant type is not allowed for this client`);
         }
         if (request.grant_type === 'authorization_code') {
-            return this.codeGrant(client, clientAuth, clientMetadata, request, dpopProof);
+            return this.authorizationCodeGrant(client, clientAuth, clientMetadata, request, dpopProof);
         }
         if (request.grant_type === 'refresh_token') {
             return this.refreshTokenGrant(client, clientAuth, clientMetadata, request, dpopProof);
         }
         throw new invalid_grant_error_js_1.InvalidGrantError(`Grant type "${request.grant_type}" not supported`);
     }
-    async codeGrant(client, clientAuth, clientMetadata, input, dpopProof) {
-        const code = code_js_1.codeSchema.parse(input.code);
-        try {
-            const { sub, deviceId, parameters } = await this.requestManager.findCode(client, clientAuth, code);
-            // the following check prevents re-use of PKCE challenges, enforcing the
-            // clients to generate a new challenge for each authorization request. The
-            // replay manager typically prevents replay over a certain time frame,
-            // which might not cover the entire lifetime of the token (depending on
-            // the implementation of the replay store). For this reason, we should
-            // ideally ensure that the code_challenge was not already used by any
-            // existing token or any other pending request.
-            //
-            // The current implementation will cause client devs not issuing a new
-            // code challenge for each authorization request to fail, which should be
-            // a good enough incentive to follow the best practices, until we have a
-            // better implementation.
-            //
-            // @TODO Use tokenManager to ensure uniqueness of code_challenge
-            if (parameters.code_challenge) {
-                const unique = await this.replayManager.uniqueCodeChallenge(parameters.code_challenge);
-                if (!unique) {
-                    throw new invalid_grant_error_js_1.InvalidGrantError('Code challenge already used');
-                }
+    async compareClientAuth(client, clientAuth, dpopProof, initial) {
+        // Fool proofing, ensure that the client is authenticating using the right method
+        if (clientAuth.method !== client.metadata.token_endpoint_auth_method) {
+            throw new invalid_grant_error_js_1.InvalidGrantError(`Client authentication method mismatch (expected ${client.metadata.token_endpoint_auth_method}, got ${clientAuth.method})`);
+        }
+        if (initial.clientId !== client.id) {
+            throw new invalid_grant_error_js_1.InvalidGrantError(`Token was not issued to this client`);
+        }
+        const { parameters } = initial;
+        if (parameters.dpop_jkt) {
+            if (!dpopProof) {
+                throw new invalid_grant_error_js_1.InvalidGrantError(`DPoP proof is required for this request`);
+            }
+            else if (parameters.dpop_jkt !== dpopProof.jkt) {
+                throw new invalid_grant_error_js_1.InvalidGrantError(`DPoP proof does not match the expected JKT`);
             }
-            const { account } = await this.accountManager.getAccount(sub);
-            return await this.tokenManager.create(client, clientAuth, clientMetadata, account, deviceId, parameters, input, dpopProof);
         }
-        catch (err) {
-            // If a token is replayed, requestManager.findCode will throw. In that
-            // case, we need to revoke any token that was issued for this code.
+        if (!initial.clientAuth) {
+            // If the client did not use PAR, it was not authenticated when the request
+            // was initially created (see authorize() method in OAuthProvider). Since
+            // PAR is not mandatory, and since the token exchange currently taking place
+            // *is* authenticated (`clientAuth`), we allow "upgrading" the
+            // authentication method (the token created will be bound to the current
+            // clientAuth).
+            return;
+        }
+        switch (initial.clientAuth.method) {
+            case oauth_types_1.CLIENT_ASSERTION_TYPE_JWT_BEARER: // LEGACY
+            case 'private_key_jwt':
+                if (clientAuth.method !== 'private_key_jwt') {
+                    throw new invalid_grant_error_js_1.InvalidGrantError(`Client authentication method mismatch (expected ${initial.clientAuth.method})`);
+                }
+                if (clientAuth.kid !== initial.clientAuth.kid ||
+                    clientAuth.alg !== initial.clientAuth.alg ||
+                    clientAuth.jkt !== initial.clientAuth.jkt) {
+                    throw new invalid_grant_error_js_1.InvalidGrantError(`The session was initiated with a different key than the client assertion currently used`);
+                }
+                break;
+            case 'none':
+                // @NOTE We allow the client to "upgrade" to a confidential client if
+                // the session was initially created without client authentication.
+                break;
+            default:
+                throw new invalid_grant_error_js_1.InvalidGrantError(
+                // @ts-expect-error (future proof, backwards compatibility)
+                `Invalid method "${initial.clientAuth.method}"`);
+        }
+    }
+    async authorizationCodeGrant(client, clientAuth, clientMetadata, input, dpopProof) {
+        const code = await code_js_1.codeSchema
+            .parseAsync(input.code, { path: ['code'] })
+            .catch((err) => {
+            throw invalid_grant_error_js_1.InvalidGrantError.from(err, err instanceof zod_1.ZodError
+                ? `Invalid code: ${err.message}`
+                : `Invalid code`);
+        });
+        const data = await this.requestManager
+            .consumeCode(code)
+            .catch(async (err) => {
+            // Code not found in request manager: check for replays
             const tokenInfo = await this.tokenManager.findByCode(code);
             if (tokenInfo) {
-                await this.tokenManager.deleteToken(tokenInfo.id);
-                //  As an additional security measure, we also sign the device out, so
-                // that the device cannot be used to access the account anymore without
-                // a new authentication.
-                const { deviceId, sub } = tokenInfo.data;
-                if (deviceId) {
-                    await this.accountManager.removeDeviceAccount(deviceId, sub);
+                // try/finally to ensure that both code path get executed (sequentially)
+                try {
+                    // "code" was replayed, delete existing session
+                    await this.tokenManager.deleteToken(tokenInfo.id);
+                }
+                finally {
+                    // As an additional security measure, we also sign the device out,
+                    // so that the device cannot be used to access the account anymore
+                    // without a new authentication.
+                    const { deviceId, sub } = tokenInfo.data;
+                    if (deviceId) {
+                        await this.accountManager.removeDeviceAccount(deviceId, sub);
+                    }
                 }
             }
-            throw err;
+            throw invalid_grant_error_js_1.InvalidGrantError.from(err, `Invalid code`);
+        });
+        // @NOTE at this point, the request data was removed from the store and only
+        // exists in memory here (in the "data" variable). Because of this, any
+        // error thrown after this point will permanently cause the request data to
+        // be lost.
+        await this.compareClientAuth(client, clientAuth, dpopProof, data);
+        // If the DPoP proof was not provided earlier (PAR / authorize), let's add
+        // it now.
+        const parameters = dpopProof &&
+            client.metadata.dpop_bound_access_tokens &&
+            !data.parameters.dpop_jkt
+            ? { ...data.parameters, dpop_jkt: dpopProof.jkt }
+            : data.parameters;
+        await this.validateCodeGrant(parameters, input);
+        const { account } = await this.accountManager.getAccount(data.sub);
+        return this.tokenManager.createToken(client, clientAuth, clientMetadata, account, data.deviceId, parameters, code);
+    }
+    async validateCodeGrant(parameters, input) {
+        if (parameters.redirect_uri !== input.redirect_uri) {
+            throw new invalid_grant_error_js_1.InvalidGrantError('The redirect_uri parameter must match the one used in the authorization request');
+        }
+        if (parameters.code_challenge) {
+            if (!input.code_verifier) {
+                throw new invalid_grant_error_js_1.InvalidGrantError('code_verifier is required');
+            }
+            if (input.code_verifier.length < 43) {
+                throw new invalid_grant_error_js_1.InvalidGrantError('code_verifier too short');
+            }
+            switch (parameters.code_challenge_method) {
+                case undefined: // default is "plain"
+                case 'plain':
+                    if (parameters.code_challenge !== input.code_verifier) {
+                        throw new invalid_grant_error_js_1.InvalidGrantError('Invalid code_verifier');
+                    }
+                    break;
+                case 'S256': {
+                    const inputChallenge = Buffer.from(parameters.code_challenge, 'base64');
+                    const computedChallenge = (0, node_crypto_1.createHash)('sha256')
+                        .update(input.code_verifier)
+                        .digest();
+                    if (inputChallenge.compare(computedChallenge) !== 0) {
+                        throw new invalid_grant_error_js_1.InvalidGrantError('Invalid code_verifier');
+                    }
+                    break;
+                }
+                default:
+                    // Should never happen (because request validation should catch this)
+                    throw new Error(`Unsupported code_challenge_method`);
+            }
+            const unique = await this.replayManager.uniqueCodeChallenge(parameters.code_challenge);
+            if (!unique) {
+                throw new invalid_grant_error_js_1.InvalidGrantError('Code challenge already used');
+            }
+        }
+        else if (input.code_verifier !== undefined) {
+            throw new invalid_request_error_js_1.InvalidRequestError("code_challenge parameter wasn't provided");
         }
     }
     async refreshTokenGrant(client, clientAuth, clientMetadata, input, dpopProof) {
-        return this.tokenManager.refresh(client, clientAuth, clientMetadata, input, dpopProof);
+        const refreshToken = await token_store_js_1.refreshTokenSchema
+            .parseAsync(input.refresh_token, { path: ['refresh_token'] })
+            .catch((err) => {
+            throw invalid_grant_error_js_1.InvalidGrantError.from(err, `Invalid refresh token`);
+        });
+        const tokenInfo = await this.tokenManager.consumeRefreshToken(refreshToken);
+        try {
+            const { data } = tokenInfo;
+            await this.compareClientAuth(client, clientAuth, dpopProof, data);
+            await this.validateRefreshGrant(client, clientAuth, data);
+            return await this.tokenManager.rotateToken(client, clientAuth, clientMetadata, tokenInfo);
+        }
+        catch (err) {
+            await this.tokenManager.deleteToken(tokenInfo.id);
+            throw err;
+        }
+    }
+    async validateRefreshGrant(client, clientAuth, data) {
+        const [sessionLifetime, refreshLifetime] = clientAuth.method !== 'none' || client.info.isFirstParty
+            ? [
+                constants_js_1.CONFIDENTIAL_CLIENT_SESSION_LIFETIME,
+                constants_js_1.CONFIDENTIAL_CLIENT_REFRESH_LIFETIME,
+            ]
+            : [constants_js_1.PUBLIC_CLIENT_SESSION_LIFETIME, constants_js_1.PUBLIC_CLIENT_REFRESH_LIFETIME];
+        const sessionAge = Date.now() - data.createdAt.getTime();
+        if (sessionAge > sessionLifetime) {
+            throw new invalid_grant_error_js_1.InvalidGrantError(`Session expired`);
+        }
+        const refreshAge = Date.now() - data.updatedAt.getTime();
+        if (refreshAge > refreshLifetime) {
+            throw new invalid_grant_error_js_1.InvalidGrantError(`Refresh token expired`);
+        }
     }
     /**
      * @see {@link https://datatracker.ietf.org/doc/html/rfc7009#section-2.1 rfc7009}
      */
-    async revoke(credentials, { token }) {
+    async revoke(clientCredentials, { token }, dpopProof) {
         // > The authorization server first validates the client credentials (in
         // > case of a confidential client)
-        const [client, clientAuth] = await this.authenticateClient(credentials);
+        const { client, clientAuth } = await this.authenticateClient(clientCredentials, dpopProof);
         const tokenInfo = await this.tokenManager.findToken(token);
-        // > [...] and then verifies whether the token was issued to the client
-        // > making the revocation request. If this validation fails, the request is
-        // > refused and the client is informed of the error by the authorization
-        // > server as described below.
-        await this.tokenManager.validateAccess(client, clientAuth, tokenInfo);
-        // > In the next step, the authorization server invalidates the token. The
-        // > invalidation takes place immediately, and the token cannot be used
-        // > again after the revocation.
-        await this.tokenManager.deleteToken(tokenInfo.id);
+        if (tokenInfo) {
+            // > [...] and then verifies whether the token was issued to the client
+            // > making the revocation request.
+            const { data } = tokenInfo;
+            await this.compareClientAuth(client, clientAuth, dpopProof, data);
+            // > In the next step, the authorization server invalidates the token. The
+            // > invalidation takes place immediately, and the token cannot be used
+            // > again after the revocation.
+            await this.tokenManager.deleteToken(tokenInfo.id);
+        }
     }
     async verifyToken(tokenType, token, dpopProof, verifyOptions) {
         if (this.accessTokenMode === access_token_mode_js_1.AccessTokenMode.stateless) {

package/dist/oauth-provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-provider.js","sourceRoot":"","sources":["../src/oauth-provider.ts"],"names":[],"mappings":";;;AACA,sCAA2C;AA8FjB,uFA9FX,YAAM,OA8FW;AA5FhC,sDAoB6B;AAC7B,yDAAwD;AAExD,2EAAqE;AACrE,8EAAqE;AAoE5D,gGApEA,sCAAe,OAoEA;AAnExB,qEAA6D;AAC7D,iEAKmC;AACnC,4DAAuE;AAEvE,kEAGmC;AACnC,8DAAqE;AAErE,iDAAsE;AAEtE,uEAIyC;AAEzC,kEAImC;AACnC,8DAAqE;AACrE,4EAAmE;AACnE,sGAA4F;AAC5F,kFAAyE;AACzE,4EAAmE;AACnE,sFAA6E;AAC7E,gFAAuE;AACvE,8EAAqE;AAGrE,gDAA0D;AAE1D,0DAAgE;AAChE,oEAA4E;AAE5E,2DAI4B;AAC5B,8DAAqE;AACrE,+CAA8C;AAE9C,qEAA6D;AAC7D,+EAAsE;AACtE,6EAAoE;AACpE,iEAAyE;AACzE,6DAA2D;AAK3D,+DAAuD;AACvD,2DAAiE;AAoIjE,MAAa,aAAc,SAAQ,iCAAa;IAC3B,eAAe,CAAiB;IAEnC,QAAQ,CAAkC;IAC1C,aAAa,CAAe;IAE5B,oBAAoB,CAAQ;IAE5B,cAAc,CAAgB;IAC9B,aAAa,CAAe;IAC5B,aAAa,CAAe;IAC5B,cAAc,CAAgB;IAC9B,YAAY,CAAc;IAE1C,YAAmB;IACjB,sBAAsB;IACtB,oBAAoB,GAAG,qCAAsB,EAC7C,WAAW,GAAG,4BAAa,EAC3B,eAAe,GAAG,sCAAe,CAAC,SAAS,EAE3C,QAAQ,EAER,SAAS,GAAG,IAAA,0BAAa,GAAE,EAC3B,KAAK,EACL,KAAK,EAAE,gCAAgC;IAEvC,kBAAkB;IAClB,YAAY,GAAG,IAAA,iCAAc,EAAC,KAAK,CAAC,EACpC,WAAW,GAAG,IAAA,+BAAa,EAAC,KAAK,CAAC,EAClC,UAAU,GAAG,IAAA,6BAAY,EAAC,KAAK,CAAC;IAEhC,qBAAqB;IACrB,WAAW,GAAG,IAAA,+BAAa,EAAC,KAAK,CAAC,EAClC,WAAW,GAAG,IAAA,+BAAa,EAAC,KAAK,CAAC,EAClC,YAAY,GAAG,IAAA,iCAAc,EAAC,KAAK,CAAC,EAEpC,eAAe,GAAG,IAAI,uCAAiB,CAAC;QACtC,OAAO,EAAE,UAAU;QACnB,GAAG,EAAE,KAAK;KACX,CAAC,EACF,mBAAmB,GAAG,IAAI,uCAAiB,CAAC;QAC1C,OAAO,EAAE,UAAU;QACnB,GAAG,EAAE,KAAK;KACX,CAAC,EAEF,gBAAgB,GAAG,2CAA6B;IAEhD,eAAe;IACf,yBAAyB;IACzB,yBAAyB;IACzB,gBAAgB;IAChB,GAAG,IAAI,EACc;QACrB,MAAM,oBAAoB,GACxB,8CAA0B,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAExC,wEAAwE;QACxE,2EAA2E;QAC3E,uEAAuE;QACvE,0EAA0E;QAC1E,wEAAwE;QACxE,4EAA4E;QAC5E,8BAA8B;QAC9B,MAAM,KAAK,GAAe,IAAI,CAAA;QAE9B,0EAA0E;QAC1E,4CAA4C;QAC5C,MAAM,YAAY,GAAyB,IAAI,CAAA;QAE/C,KAAK,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,YAAY,EAAE,CAAC,CAAA;QAE9C,YAAY,KAAK,KAAK;YACpB,CAAC,CAAC,IAAI,0CAAiB,CAAC,EAAE,KAAK,EAAE,CAAC;YAClC,CAAC,CAAC,IAAI,4CAAkB,EAAE,CAAA;QAE5B,IAAI,CAAC,eAAe,GAAG,eAAe,CAAA;QACtC,IAAI,CAAC,oBAAoB,GAAG,oBAAoB,CAAA;QAChD,IAAI,CAAC,QAAQ,GAAG,IAAA,iCAAa,EAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QACjE,IAAI,CAAC,aAAa,GAAG,sCAAmB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAEpD,IAAI,CAAC,aAAa,GAAG,IAAI,iCAAa,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAA;QACzE,IAAI,CAAC,cAAc,GAAG,IAAI,mCAAc,CACtC,IAAI,CAAC,MAAM,EACX,YAAY,EACZ,KAAK,EACL,IAAI,CAAC,aAAa,CACnB,CAAA;QACD,IAAI,CAAC,aAAa,GAAG,IAAI,iCAAa,CACpC,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,MAAM,EACX,KAAK,EACL,WAAW,IAAI,IAAI,EACnB,gBAAgB,IAAI,IAAI,EACxB,SAAS,EACT,eAAe,EACf,mBAAmB,CACpB,CAAA;QACD,IAAI,CAAC,cAAc,GAAG,IAAI,mCAAc,CACtC,YAAY,EACZ,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,QAAQ,EACb,KAAK,CACN,CAAA;QACD,IAAI,CAAC,YAAY,GAAG,IAAI,+BAAY,CAClC,UAAU,EACV,IAAI,CAAC,MAAM,EACX,KAAK,EACL,IAAI,CAAC,eAAe,EACpB,WAAW,CACZ,CAAA;IACH,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,CAAA;IAC/B,CAAC;IAED;;OAEG;IACI,oBAAoB,CACzB,UAA+C,EAC/C,UAAiC;QAEjC,qCAAqC;QACrC,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAA;QAE5B,sCAAsC;QACtC,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,CAAA;QAEhD,uEAAuE;QACvE,MAAM,eAAe,GAAG,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAA;QACpD,IAAI,eAAe,IAAI,IAAI;YAAE,OAAO,KAAK,CAAA;QAEzC,0EAA0E;QAC1E,MAAM,EAAE,gBAAgB,EAAE,GAAG,UAAU,CAAA;QACvC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;IAC5E,CAAC;IAEM,kBAAkB,CAAC,aAA4B;QACpD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC,SAAS,CAAC,OAAO,EAAE,CAAA;QAC9D,OAAO,OAAO,GAAG,IAAI,CAAC,oBAAoB,CAAA;IAC5C,CAAC;IAES,KAAK,CAAC,kBAAkB,CAChC,WAAmC;QAEnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,WAAW,CAAC,SAAS,CAAC,CAAA;QACxE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,WAAW,EAAE;YACxE,QAAQ,EAAE,IAAI,CAAC,MAAM;SACtB,CAAC,CAAA;QAEF,IACE,MAAM,CAAC,QAAQ,CAAC,gBAAgB,KAAK,QAAQ;YAC7C,UAAU,CAAC,MAAM,KAAK,MAAM,EAC5B,CAAC;YACD,4DAA4D;YAC5D,EAAE;YACF,mEAAmE;YACnE,iEAAiE;YACjE,yEAAyE;YACzE,wEAAwE;YACxE,0EAA0E;YAC1E,mEAAmE;YACnE,iBAAiB;YAEjB,MAAM,IAAI,0CAAiB,CACzB,sDAAsD,CACvD,CAAA;QACH,CAAC;QAED,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;YAClB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,CAAA;YACpE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,0CAAiB,CAAC,GAAG,UAAU,CAAC,MAAM,aAAa,CAAC,CAAA;YAChE,CAAC;QACH,CAAC;QAED,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;IAC7B,CAAC;IAES,KAAK,CAAC,SAAS,CACvB,MAAc,EACd,KAAmC;QAWnC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC9D,MAAM,OAAO,GAAG,uDAAyC,CAAC,KAAK,CAC7D,MAAM,CAAC,OAAO,CACf,CAAA;QAED,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YACxB,MAAM,IAAI,oDAAsB,CAC9B,OAAO,EACP,yCAAyC,CAC1C,CAAA;QACH,CAAC;QAED,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YACzE,MAAM,IAAI,oDAAsB,CAC9B,OAAO,EACP,kCAAkC,CACnC,CAAA;QACH,CAAC;QAED,IAAI,iBAAiB,IAAI,MAAM,EAAE,CAAC;YAChC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,EAAE,CAAC;gBAChC,MAAM,IAAI,oDAAsB,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAA;YACtE,CAAC;YAED,OAAO;gBACL,GAAG,EAAE,MAAM,IAAA,kCAAiB,EAAC,MAAM,CAAC,GAAG,CAAC;gBACxC,OAAO;gBACP,eAAe,EAAE,MAAM,CAAC,eAGvB;aACF,CAAA;QACH,CAAC;QAED,IAAI,QAAQ,IAAI,MAAM,EAAE,CAAC;YACvB,OAAO;gBACL,OAAO;aACR,CAAA;QACH,CAAC;QAED,sBAAsB;QACtB,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAA;IAC3C,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,0BAA0B,CACrC,WAAmC,EACnC,oBAAkD,EAClD,SAA2B;QAE3B,IAAI,CAAC;YACH,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAA;YAEvE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAC3B,SAAS,IAAI,oBAAoB,CAAC,aAAa;gBAC7C,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,oBAAoB,CAAC;gBACpD,CAAC,CAAC,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAA;YAEvC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,GACtB,MAAM,IAAI,CAAC,cAAc,CAAC,0BAA0B,CAClD,MAAM,EACN,UAAU,EACV,UAAU,EACV,IAAI,EACJ,SAAS,CACV,CAAA;YAEH,OAAO;gBACL,WAAW,EAAE,GAAG;gBAChB,UAAU,EAAE,IAAA,+BAAqB,EAAC,SAAS,CAAC;aAC7C,CAAA;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,8DAA8D;YAC9D,0EAA0E;YAC1E,oEAAoE;YACpE,8DAA8D;YAC9D,IAAI,GAAG,YAAY,0CAAiB,EAAE,CAAC;gBACrC,MAAM,IAAI,8CAAmB,CAAC,GAAG,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAA;YAC3D,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,2BAA2B,CACvC,MAAc,EACd,QAAkB,EAClB,KAAqC;QAErC,IAAI,aAAa,IAAI,KAAK,EAAE,CAAC;YAC3B,MAAM,UAAU,GAAG,MAAM,iCAAgB;iBACtC,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,CAAC;iBACjE,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACb,MAAM,IAAI,8CAAmB,CAC3B,IAAA,qCAAsB,EAAC,GAAG,CAAC,IAAI,wBAAwB,EACvD,GAAG,CACJ,CAAA;YACH,CAAC,CAAC,CAAA;YAEJ,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,CAAA;QACjE,CAAC;QAED,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;YACvB,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;YAEzD,IAAI,iBAAiB,IAAI,aAAa,IAAI,aAAa,CAAC,eAAe,EAAE,CAAC;gBACxE,uEAAuE;gBACvE,gEAAgE;gBAChE,MAAM,UAAU,GAAe;oBAC7B,MAAM,EAAE,8CAAgC;oBACxC,GAAG,EAAE,aAAa,CAAC,eAAe,CAAC,GAAG;oBACtC,GAAG,EAAE,aAAa,CAAC,eAAe,CAAC,GAAG;oBACtC,GAAG,EAAE,aAAa,CAAC,GAAG;iBACvB,CAAA;gBAED,OAAO,IAAI,CAAC,cAAc,CAAC,0BAA0B,CACnD,MAAM,EACN,UAAU,EACV,aAAa,CAAC,OAAO,EACrB,QAAQ,EACR,IAAI,CACL,CAAA;YACH,CAAC;YAED,OAAO,IAAI,CAAC,cAAc,CAAC,0BAA0B,CACnD,MAAM,EACN,EAAE,MAAM,EAAE,MAAM,EAAE,EAClB,aAAa,CAAC,OAAO,EACrB,QAAQ,EACR,IAAI,CACL,CAAA;QACH,CAAC;QAED,OAAO,IAAI,CAAC,cAAc,CAAC,0BAA0B,CACnD,MAAM,EACN,EAAE,MAAM,EAAE,MAAM,EAAE,EAClB,KAAK,EACL,QAAQ,EACR,IAAI,CACL,CAAA;IACH,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,SAAS,CACpB,iBAA6C,EAC7C,KAAqC,EACrC,QAAkB,EAClB,cAA+B;QAE/B,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;QAEvB,oEAAoE;QACpE,oDAAoD;QACpD,MAAM,mBAAmB,GACvB,cAAc,IAAI,KAAK;YACrB,CAAC,CAAC,CAAC,GAAY,EAAS,EAAE;gBACtB,iFAAiF;gBACjF,MAAM,0CAAiB,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAA;YAC7D,CAAC;YACH,CAAC,CAAC,IAAI,CAAA;QAEV,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa;aACpC,SAAS,CAAC,iBAAiB,CAAC,SAAS,CAAC;aACtC,KAAK,CAAC,mBAAmB,CAAC,CAAA;QAE7B,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAChE,MAAM,EACN,QAAQ,EACR,KAAK,CACN,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAA;QAE5B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAA;YAExE,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBACjC,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAA;gBACzD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC3B,MAAM,IAAI,mEAA6B,CAAC,UAAU,CAAC,CAAA;gBACrD,CAAC;gBACD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC3B,MAAM,IAAI,4CAAkB,CAAC,UAAU,CAAC,CAAA;gBAC1C,CAAC;gBAED,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAE,CAAA;gBAClC,IAAI,UAAU,CAAC,aAAa,EAAE,CAAC;oBAC7B,MAAM,IAAI,4CAAkB,CAAC,UAAU,CAAC,CAAA;gBAC1C,CAAC;gBACD,IAAI,UAAU,CAAC,eAAe,EAAE,CAAC;oBAC/B,MAAM,IAAI,gDAAoB,CAAC,UAAU,CAAC,CAAA;gBAC5C,CAAC;gBAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAClD,GAAG,EACH,MAAM,EACN,UAAU,CAAC,OAAO,EAClB,QAAQ,EACR,cAAc,CACf,CAAA;gBAED,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,CAAA;YACnD,CAAC;YAED,wCAAwC;YACxC,IAAI,UAAU,CAAC,MAAM,IAAI,IAAI,IAAI,UAAU,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;gBAC/D,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAA;gBACzD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC7B,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAE,CAAA;oBAClC,IAAI,CAAC,UAAU,CAAC,aAAa,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,CAAC;wBAC7D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAClD,GAAG,EACH,MAAM,EACN,UAAU,CAAC,OAAO,EAClB,QAAQ,EACR,cAAc,CACf,CAAA;wBAED,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,CAAA;oBACnD,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO;gBACL,MAAM;gBACN,MAAM;gBACN,UAAU;gBACV,GAAG;gBACH,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;oBACnC,uEAAuE;oBACvE,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,aAAa,EAAE,OAAO,CAAC,aAAa;oBACpC,eAAe,EAAE,OAAO,CAAC,eAAe;iBACzC,CAAC,CAAC;gBACH,YAAY,EAAE,UAAU,CAAC,KAAK;oBAC5B,EAAE,KAAK,CAAC,KAAK,CAAC;qBACb,MAAM,CAAC,OAAO,CAAC;qBACf,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;qBAClC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;oBACf,KAAK;oBACL,wDAAwD;oBACxD,gBAAgB;oBAChB,WAAW,EAAE,SAAS;iBACvB,CAAC,CAAC;aACN,CAAA;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,uDAAuD;gBACvD,EAAE;gBACF,+DAA+D;gBAC/D,+BAA+B;YACjC,CAAC;YAED,oEAAoE;YACpE,8DAA8D;YAC9D,MAAM,0CAAiB,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,cAAc,CAAC,CAAA;QAC/D,CAAC;IACH,CAAC;IAES,KAAK,CAAC,WAAW,CACzB,QAAkB,EAClB,QAAkB,EAClB,UAA+C;QAY/C,MAAM,cAAc,GAClB,MAAM,IAAI,CAAC,cAAc,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAA;QAExD,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,CAAA;QAClC,MAAM,WAAW,GAAG,CAAC,OAAgB,EAAW,EAAE,CAChD,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC;YACvC,CAAC,CAAC,CAAC,OAAO,CAAC,kBAAkB,IAAI,OAAO,CAAC,kBAAkB,KAAK,IAAI,CAAC,CAAA;QAEvE,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;YAC5C,OAAO,EAAE,aAAa,CAAC,OAAO;YAE9B,QAAQ,EACN,UAAU,CAAC,MAAM,KAAK,gBAAgB;gBACtC,WAAW,CAAC,aAAa,CAAC,OAAO,CAAC;YACpC,mEAAmE;YACnE,iEAAiE;YACjE,aAAa,EACX,UAAU,CAAC,MAAM,KAAK,OAAO,IAAI,IAAI,CAAC,kBAAkB,CAAC,aAAa,CAAC;YACzE,eAAe,EAAE,IAAI,CAAC,oBAAoB,CACxC,UAAU,EACV,aAAa,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAC9C;YAED,WAAW,EAAE,IAAI,IAAI,IAAI,IAAI,WAAW,CAAC,aAAa,CAAC,OAAO,CAAC;SAChE,CAAC,CAAC,CAAA;IACL,CAAC;IAEM,KAAK,CAAC,KAAK,CAChB,iBAAyC,EACzC,cAA+B,EAC/B,OAA0B,EAC1B,SAA2B;QAE3B,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GACxB,MAAM,IAAI,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAA;QAElD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,qBAAqB,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACvE,MAAM,IAAI,0CAAiB,CACzB,eAAe,OAAO,CAAC,UAAU,kCAAkC,CACpE,CAAA;QACH,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,0CAAiB,CACzB,IAAI,OAAO,CAAC,UAAU,6CAA6C,CACpE,CAAA;QACH,CAAC;QAED,IAAI,OAAO,CAAC,UAAU,KAAK,oBAAoB,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC,SAAS,CACnB,MAAM,EACN,UAAU,EACV,cAAc,EACd,OAAO,EACP,SAAS,CACV,CAAA;QACH,CAAC;QAED,IAAI,OAAO,CAAC,UAAU,KAAK,eAAe,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC,iBAAiB,CAC3B,MAAM,EACN,UAAU,EACV,cAAc,EACd,OAAO,EACP,SAAS,CACV,CAAA;QACH,CAAC;QAED,MAAM,IAAI,0CAAiB,CACzB,eAAe,OAAO,CAAC,UAAU,iBAAiB,CACnD,CAAA;IACH,CAAC;IAES,KAAK,CAAC,SAAS,CACvB,MAAc,EACd,UAAsB,EACtB,cAA+B,EAC/B,KAA8C,EAC9C,SAA2B;QAE3B,MAAM,IAAI,GAAG,oBAAU,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACzC,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CACtE,MAAM,EACN,UAAU,EACV,IAAI,CACL,CAAA;YAED,wEAAwE;YACxE,0EAA0E;YAC1E,sEAAsE;YACtE,uEAAuE;YACvE,sEAAsE;YACtE,qEAAqE;YACrE,+CAA+C;YAC/C,EAAE;YACF,sEAAsE;YACtE,yEAAyE;YACzE,wEAAwE;YACxE,yBAAyB;YACzB,EAAE;YACF,gEAAgE;YAChE,IAAI,UAAU,CAAC,cAAc,EAAE,CAAC;gBAC9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,mBAAmB,CACzD,UAAU,CAAC,cAAc,CAC1B,CAAA;gBACD,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,IAAI,0CAAiB,CAAC,6BAA6B,CAAC,CAAA;gBAC5D,CAAC;YACH,CAAC;YAED,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;YAE7D,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CACnC,MAAM,EACN,UAAU,EACV,cAAc,EACd,OAAO,EACP,QAAQ,EACR,UAAU,EACV,KAAK,EACL,SAAS,CACV,CAAA;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,sEAAsE;YACtE,mEAAmE;YAEnE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;YAC1D,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;gBAEjD,sEAAsE;gBACtE,uEAAuE;gBACvE,wBAAwB;gBACxB,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,SAAS,CAAC,IAAI,CAAA;gBACxC,IAAI,QAAQ,EAAE,CAAC;oBACb,MAAM,IAAI,CAAC,cAAc,CAAC,mBAAmB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;gBAC9D,CAAC;YACH,CAAC;YAED,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,MAAc,EACd,UAAsB,EACtB,cAA+B,EAC/B,KAAyC,EACzC,SAA2B;QAE3B,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAC9B,MAAM,EACN,UAAU,EACV,cAAc,EACd,KAAK,EACL,SAAS,CACV,CAAA;IACH,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,MAAM,CACjB,WAAmC,EACnC,EAAE,KAAK,EAA4B;QAEnC,wEAAwE;QACxE,mCAAmC;QACnC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAA;QAEvE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;QAE1D,uEAAuE;QACvE,4EAA4E;QAC5E,yEAAyE;QACzE,+BAA+B;QAC/B,MAAM,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,CAAA;QAErE,0EAA0E;QAC1E,uEAAuE;QACvE,gCAAgC;QAChC,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;IACnD,CAAC;IAEkB,KAAK,CAAC,WAAW,CAClC,SAAyB,EACzB,KAAuB,EACvB,SAA2B,EAC3B,aAAwC;QAExC,IAAI,IAAI,CAAC,eAAe,KAAK,sCAAe,CAAC,SAAS,EAAE,CAAC;YACvD,OAAO,KAAK,CAAC,WAAW,CAAC,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,aAAa,CAAC,CAAA;QACtE,CAAC;QAED,IAAI,IAAI,CAAC,eAAe,KAAK,sCAAe,CAAC,KAAK,EAAE,CAAC;YACnD,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,KAAK,CAAC,WAAW,CAC7C,SAAS,EACT,KAAK,EACL,SAAS;YACT,kEAAkE;YAClE,4DAA4D;YAC5D,SAAS,CACV,CAAA;YAED,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAA;YAE/B,0EAA0E;YAC1E,mEAAmE;YACnE,mCAAmC;YACnC,OAAO,IAAI,CAAC,YAAY,CAAC,WAAW,CAClC,KAAK,EACL,SAAS,EACT,OAAO,EACP,SAAS,EACT,aAAa,CACd,CAAA;QACH,CAAC;QAED,aAAa;QACb,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;IAC9C,CAAC;CACF;AArrBD,sCAqrBC"}
+{"version":3,"file":"oauth-provider.js","sourceRoot":"","sources":["../src/oauth-provider.ts"],"names":[],"mappings":";;;AAAA,6CAAwC;AAExC,6BAA8B;AAC9B,sCAA2C;AAwGjB,uFAxGX,YAAM,OAwGW;AAtGhC,sDAoB6B;AAC7B,yDAAwD;AAExD,2EAAqE;AACrE,8EAAqE;AA8E5D,gGA9EA,sCAAe,OA8EA;AA7ExB,qEAA6D;AAC7D,iEAKmC;AAGnC,kEAGmC;AACnC,8DAAqE;AAErE,iDAOuB;AAEvB,uEAIyC;AAEzC,kEAImC;AACnC,8DAAqE;AACrE,4EAAmE;AACnE,sGAA4F;AAC5F,kFAAyE;AACzE,kGAAuF;AACvF,sFAA4E;AAC5E,4EAAmE;AACnE,gFAAuE;AACvE,8EAAqE;AAGrE,gDAA0D;AAE1D,0DAAgE;AAChE,oEAA4E;AAE5E,2DAI4B;AAC5B,8DAAqE;AACrE,+CAA8C;AAC9C,qEAA6D;AAC7D,iEAAyE;AACzE,6DAA2D;AAM3D,+DAAuD;AACvD,2DAI+B;AAoI/B,MAAa,aAAc,SAAQ,iCAAa;IAC3B,eAAe,CAAiB;IAEnC,QAAQ,CAAkC;IAC1C,aAAa,CAAe;IAE5B,oBAAoB,CAAQ;IAE5B,cAAc,CAAgB;IAC9B,aAAa,CAAe;IAC5B,aAAa,CAAe;IAC5B,cAAc,CAAgB;IAC9B,YAAY,CAAc;IAE1C,YAAmB;IACjB,sBAAsB;IACtB,oBAAoB,GAAG,qCAAsB,EAC7C,WAAW,GAAG,4BAAa,EAC3B,eAAe,GAAG,sCAAe,CAAC,SAAS,EAE3C,QAAQ,EAER,SAAS,GAAG,IAAA,0BAAa,GAAE,EAC3B,KAAK,EAAE,gCAAgC;IAEvC,kBAAkB;IAClB,YAAY,GAAG,IAAA,iCAAc,EAAC,KAAK,CAAC,EACpC,WAAW,GAAG,IAAA,+BAAa,EAAC,KAAK,CAAC,EAClC,UAAU,GAAG,IAAA,6BAAY,EAAC,KAAK,CAAC,EAChC,YAAY,GAAG,IAAA,iCAAc,EAAC,KAAK,CAAC;IAEpC,qBAAqB;IACrB,WAAW,GAAG,IAAA,+BAAa,EAAC,KAAK,CAAC,EAClC,WAAW,GAAG,IAAA,+BAAa,EAAC,KAAK,CAAC,EAElC,eAAe,GAAG,IAAI,uCAAiB,CAAC;QACtC,OAAO,EAAE,UAAU;QACnB,GAAG,EAAE,KAAK;KACX,CAAC,EACF,mBAAmB,GAAG,IAAI,uCAAiB,CAAC;QAC1C,OAAO,EAAE,UAAU;QACnB,GAAG,EAAE,KAAK;KACX,CAAC,EAEF,gBAAgB,GAAG,2CAA6B;IAEhD,eAAe;IACf,yBAAyB;IACzB,yBAAyB;IACzB,gBAAgB;IAChB,GAAG,IAAI,EACc;QACrB,MAAM,oBAAoB,GACxB,8CAA0B,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAExC,wEAAwE;QACxE,2EAA2E;QAC3E,uEAAuE;QACvE,0EAA0E;QAC1E,wEAAwE;QACxE,4EAA4E;QAC5E,8BAA8B;QAC9B,MAAM,KAAK,GAAe,IAAI,CAAA;QAE9B,0EAA0E;QAC1E,4CAA4C;QAC5C,MAAM,YAAY,GAAyB,IAAI,CAAA;QAE/C,KAAK,CAAC,EAAE,WAAW,EAAE,GAAG,YAAY,EAAE,CAAC,CAAA;QAEvC,IAAI,CAAC,eAAe,GAAG,eAAe,CAAA;QACtC,IAAI,CAAC,oBAAoB,GAAG,oBAAoB,CAAA;QAChD,IAAI,CAAC,QAAQ,GAAG,IAAA,iCAAa,EAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QACjE,IAAI,CAAC,aAAa,GAAG,sCAAmB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAEpD,IAAI,CAAC,aAAa,GAAG,IAAI,iCAAa,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAA;QACzE,IAAI,CAAC,cAAc,GAAG,IAAI,mCAAc,CACtC,IAAI,CAAC,MAAM,EACX,YAAY,EACZ,KAAK,EACL,IAAI,CAAC,aAAa,CACnB,CAAA;QACD,IAAI,CAAC,aAAa,GAAG,IAAI,iCAAa,CACpC,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,MAAM,EACX,KAAK,EACL,WAAW,IAAI,IAAI,EACnB,gBAAgB,IAAI,IAAI,EACxB,SAAS,EACT,eAAe,EACf,mBAAmB,CACpB,CAAA;QACD,IAAI,CAAC,cAAc,GAAG,IAAI,mCAAc,CACtC,YAAY,EACZ,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,QAAQ,EACb,KAAK,CACN,CAAA;QACD,IAAI,CAAC,YAAY,GAAG,IAAI,+BAAY,CAClC,UAAU,EACV,IAAI,CAAC,MAAM,EACX,KAAK,EACL,IAAI,CAAC,eAAe,EACpB,WAAW,CACZ,CAAA;IACH,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,CAAA;IAC/B,CAAC;IAED;;OAEG;IACI,oBAAoB,CACzB,UAA+C,EAC/C,UAAiC;QAEjC,qCAAqC;QACrC,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAA;QAE5B,sCAAsC;QACtC,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,CAAA;QAEhD,uEAAuE;QACvE,MAAM,eAAe,GAAG,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAA;QACpD,IAAI,eAAe,IAAI,IAAI;YAAE,OAAO,KAAK,CAAA;QAEzC,0EAA0E;QAC1E,MAAM,EAAE,gBAAgB,EAAE,GAAG,UAAU,CAAA;QACvC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;IAC5E,CAAC;IAEM,kBAAkB,CAAC,aAA4B;QACpD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC,SAAS,CAAC,OAAO,EAAE,CAAA;QAC9D,OAAO,OAAO,GAAG,IAAI,CAAC,oBAAoB,CAAA;IAC5C,CAAC;IAES,KAAK,CAAC,kBAAkB,CAChC,iBAAyC,EACzC,SAA2B,EAC3B,OAEC;QAKD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAC/C,iBAAiB,CAAC,SAAS,CAC5B,CAAA;QAED,IACE,MAAM,CAAC,QAAQ,CAAC,wBAAwB;YACxC,CAAC,SAAS;YACV,CAAC,OAAO,EAAE,qBAAqB,EAC/B,CAAC;YACD,MAAM,IAAI,mDAAqB,CAAC,qBAAqB,CAAC,CAAA;QACxD,CAAC;QAED,IAAI,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,wBAAwB,EAAE,CAAC;YAC3D,MAAM,IAAI,mDAAqB,CAAC,wCAAwC,CAAC,CAAA;QAC3E,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,iBAAiB,EAAE;YAC9D,6BAA6B,EAAE,IAAI,CAAC,MAAM;SAC3C,CAAC,CAAA;QAEF,IAAI,UAAU,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;YAC5C,sEAAsE;YACtE,IAAI,SAAS,IAAI,UAAU,CAAC,GAAG,KAAK,SAAS,CAAC,GAAG,EAAE,CAAC;gBAClD,MAAM,IAAI,8CAAmB,CAC3B,8EAA8E,CAC/E,CAAA;YACH,CAAC;YAED,wDAAwD;YACxD,oEAAoE;YACpE,qEAAqE;YACrE,yEAAyE;YACzE,yCAAyC;YAEzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAChD,UAAU,CAAC,GAAG,EACd,MAAM,CAAC,EAAE,EACT,UAAU,CAAC,GAAG,CACf,CAAA;YACD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,0CAAiB,CAAC,GAAG,UAAU,CAAC,MAAM,aAAa,CAAC,CAAA;YAChE,CAAC;QACH,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;IAC/B,CAAC;IAES,KAAK,CAAC,SAAS,CACvB,MAAc,EACd,KAAmC;QAEnC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAClD,KAAK,CAAC,OAAO,EACb,IAAI,CAAC,MAAM,CACZ,CAAA;QAED,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAA;QACvB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,8CAAmB,CAC3B,mDAAmD,CACpD,CAAA;QACH,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,8CAAmB,CAAC,6BAA6B,CAAC,CAAA;QAC9D,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,uDAAyC;aAC/D,UAAU,CAAC,OAAO,CAAC;aACnB,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,MAAM,OAAO,GACX,GAAG,YAAY,cAAQ;gBACrB,CAAC,CAAC,+BAA+B,GAAG,CAAC,OAAO,EAAE;gBAC9C,CAAC,CAAC,0BAA0B,CAAA;YAChC,MAAM,8CAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;QAC9C,CAAC,CAAC,CAAA;QAEJ,OAAO,UAAU,CAAA;IACnB,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,0BAA0B,CACrC,WAAmC,EACnC,oBAAkD,EAClD,SAA2B;QAE3B,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAC1D,WAAW,EACX,SAAS;YACT,kEAAkE;YAClE,mEAAmE;YACnE,iBAAiB;YACjB,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAChC,CAAA;YAED,MAAM,UAAU,GACd,SAAS,IAAI,oBAAoB,CAAC,aAAa;gBAC7C,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,oBAAoB,CAAC;gBACpD,CAAC,CAAC,oBAAoB,CAAA;YAE1B,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;gBACzB,IAAI,MAAM,CAAC,QAAQ,CAAC,wBAAwB,EAAE,CAAC;oBAC7C,IAAI,SAAS;wBAAE,UAAU,CAAC,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAA;yBAC7C,CAAC;wBACJ,oEAAoE;wBACpE,iEAAiE;wBACjE,sBAAsB;wBACtB,6DAA6D;oBAC/D,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,wBAAwB,EAAE,CAAC;oBAC9C,MAAM,IAAI,8CAAmB,CAC3B,0DAA0D,CAC3D,CAAA;gBACH,CAAC;gBAED,wEAAwE;gBACxE,oCAAoC;gBACpC,IAAI,SAAS,IAAI,SAAS,CAAC,GAAG,KAAK,UAAU,CAAC,QAAQ,EAAE,CAAC;oBACvD,MAAM,IAAI,8DAA0B,EAAE,CAAA;gBACxC,CAAC;YACH,CAAC;YAED,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,GACtB,MAAM,IAAI,CAAC,cAAc,CAAC,0BAA0B,CAClD,MAAM,EACN,UAAU,EACV,UAAU,EACV,IAAI,CACL,CAAA;YAEH,OAAO;gBACL,WAAW,EAAE,GAAG;gBAChB,UAAU,EAAE,IAAA,+BAAqB,EAAC,SAAS,CAAC;aAC7C,CAAA;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,8DAA8D;YAC9D,0EAA0E;YAC1E,oEAAoE;YACpE,8DAA8D;YAC9D,IAAI,GAAG,YAAY,0CAAiB,EAAE,CAAC;gBACrC,MAAM,IAAI,8CAAmB,CAAC,GAAG,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAA;YAC3D,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,2BAA2B,CACvC,MAAc,EACd,QAAkB,EAClB,KAAqC;QAErC,MAAM;QACN,IAAI,aAAa,IAAI,KAAK,EAAE,CAAC;YAC3B,MAAM,UAAU,GAAG,MAAM,iCAAgB;iBACtC,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,CAAC;iBACjE,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACb,MAAM,IAAI,8CAAmB,CAC3B,IAAA,qCAAsB,EAAC,GAAG,CAAC,IAAI,wBAAwB,EACvD,GAAG,CACJ,CAAA;YACH,CAAC,CAAC,CAAA;YAEJ,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,CAAA;QACjE,CAAC;QAED,MAAM;QACN,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;YACvB,0EAA0E;YAC1E,mEAAmE;YACnE,gEAAgE;YAChE,+DAA+D;YAC/D,kDAAkD;YAClD,qCAAqC;YACrC,4CAA4C;YAC5C,wEAAwE;YACxE,kEAAkE;YAClE,qEAAqE;YACrE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;YAEtD,OAAO,IAAI,CAAC,cAAc,CAAC,0BAA0B,CACnD,MAAM,EACN,IAAI,EACJ,UAAU,EACV,QAAQ,CACT,CAAA;QACH,CAAC;QAED,4EAA4E;QAC5E,qEAAqE;QACrE,OAAO,IAAI,CAAC,cAAc,CAAC,0BAA0B,CACnD,MAAM,EACN,IAAI,EACJ,KAAK,EACL,QAAQ,CACT,CAAA;IACH,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,SAAS,CACpB,iBAA6C,EAC7C,KAAqC,EACrC,QAAkB,EAClB,cAA+B;QAE/B,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;QAEvB,oEAAoE;QACpE,oDAAoD;QACpD,MAAM,mBAAmB,GACvB,cAAc,IAAI,KAAK;YACrB,CAAC,CAAC,CAAC,GAAY,EAAS,EAAE;gBACtB,iFAAiF;gBACjF,MAAM,0CAAiB,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAA;YAC7D,CAAC;YACH,CAAC,CAAC,IAAI,CAAA;QAEV,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa;aACpC,SAAS,CAAC,iBAAiB,CAAC,SAAS,CAAC;aACtC,KAAK,CAAC,mBAAmB,CAAC,CAAA;QAE7B,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAChE,MAAM,EACN,QAAQ,EACR,KAAK,CACN,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAA;QAE5B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAA;YAExE,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBACjC,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAA;gBACzD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC3B,MAAM,IAAI,mEAA6B,CAAC,UAAU,CAAC,CAAA;gBACrD,CAAC;gBACD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC3B,MAAM,IAAI,4CAAkB,CAAC,UAAU,CAAC,CAAA;gBAC1C,CAAC;gBAED,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAE,CAAA;gBAClC,IAAI,UAAU,CAAC,aAAa,EAAE,CAAC;oBAC7B,MAAM,IAAI,4CAAkB,CAAC,UAAU,CAAC,CAAA;gBAC1C,CAAC;gBACD,IAAI,UAAU,CAAC,eAAe,EAAE,CAAC;oBAC/B,MAAM,IAAI,gDAAoB,CAAC,UAAU,CAAC,CAAA;gBAC5C,CAAC;gBAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAClD,GAAG,EACH,MAAM,EACN,UAAU,CAAC,OAAO,EAClB,QAAQ,EACR,cAAc,CACf,CAAA;gBAED,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,CAAA;YACnD,CAAC;YAED,wCAAwC;YACxC,IAAI,UAAU,CAAC,MAAM,IAAI,IAAI,IAAI,UAAU,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;gBAC/D,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAA;gBACzD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC7B,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAE,CAAA;oBAClC,IAAI,CAAC,UAAU,CAAC,aAAa,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,CAAC;wBAC7D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAClD,GAAG,EACH,MAAM,EACN,UAAU,CAAC,OAAO,EAClB,QAAQ,EACR,cAAc,CACf,CAAA;wBAED,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,CAAA;oBACnD,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO;gBACL,MAAM;gBACN,MAAM;gBACN,UAAU;gBACV,GAAG;gBACH,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;oBACnC,uEAAuE;oBACvE,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,aAAa,EAAE,OAAO,CAAC,aAAa;oBACpC,eAAe,EAAE,OAAO,CAAC,eAAe;iBACzC,CAAC,CAAC;gBACH,YAAY,EAAE,UAAU,CAAC,KAAK;oBAC5B,EAAE,KAAK,CAAC,KAAK,CAAC;qBACb,MAAM,CAAC,OAAO,CAAC;qBACf,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;qBAClC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;oBACf,KAAK;oBACL,wDAAwD;oBACxD,gBAAgB;oBAChB,WAAW,EAAE,SAAS;iBACvB,CAAC,CAAC;aACN,CAAA;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,uDAAuD;gBACvD,EAAE;gBACF,+DAA+D;gBAC/D,+BAA+B;YACjC,CAAC;YAED,oEAAoE;YACpE,8DAA8D;YAC9D,MAAM,0CAAiB,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,cAAc,CAAC,CAAA;QAC/D,CAAC;IACH,CAAC;IAES,KAAK,CAAC,WAAW,CACzB,QAAkB,EAClB,QAAkB,EAClB,UAA+C;QAY/C,MAAM,cAAc,GAClB,MAAM,IAAI,CAAC,cAAc,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAA;QAExD,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,CAAA;QAClC,MAAM,WAAW,GAAG,CAAC,OAAgB,EAAW,EAAE,CAChD,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC;YACvC,CAAC,CAAC,CAAC,OAAO,CAAC,kBAAkB,IAAI,OAAO,CAAC,kBAAkB,KAAK,IAAI,CAAC,CAAA;QAEvE,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;YAC5C,OAAO,EAAE,aAAa,CAAC,OAAO;YAE9B,QAAQ,EACN,UAAU,CAAC,MAAM,KAAK,gBAAgB;gBACtC,WAAW,CAAC,aAAa,CAAC,OAAO,CAAC;YACpC,mEAAmE;YACnE,iEAAiE;YACjE,aAAa,EACX,UAAU,CAAC,MAAM,KAAK,OAAO,IAAI,IAAI,CAAC,kBAAkB,CAAC,aAAa,CAAC;YACzE,eAAe,EAAE,IAAI,CAAC,oBAAoB,CACxC,UAAU,EACV,aAAa,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAC9C;YAED,WAAW,EAAE,IAAI,IAAI,IAAI,IAAI,WAAW,CAAC,aAAa,CAAC,OAAO,CAAC;SAChE,CAAC,CAAC,CAAA;IACL,CAAC;IAEM,KAAK,CAAC,KAAK,CAChB,iBAAyC,EACzC,cAA+B,EAC/B,OAA0B,EAC1B,SAA2B;QAE3B,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAC1D,iBAAiB,EACjB,SAAS,CACV,CAAA;QAED,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,qBAAqB,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACvE,MAAM,IAAI,0CAAiB,CACzB,eAAe,OAAO,CAAC,UAAU,kCAAkC,CACpE,CAAA;QACH,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,0CAAiB,CACzB,IAAI,OAAO,CAAC,UAAU,6CAA6C,CACpE,CAAA;QACH,CAAC;QAED,IAAI,OAAO,CAAC,UAAU,KAAK,oBAAoB,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC,sBAAsB,CAChC,MAAM,EACN,UAAU,EACV,cAAc,EACd,OAAO,EACP,SAAS,CACV,CAAA;QACH,CAAC;QAED,IAAI,OAAO,CAAC,UAAU,KAAK,eAAe,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC,iBAAiB,CAC3B,MAAM,EACN,UAAU,EACV,cAAc,EACd,OAAO,EACP,SAAS,CACV,CAAA;QACH,CAAC;QAED,MAAM,IAAI,0CAAiB,CACzB,eAAe,OAAO,CAAC,UAAU,iBAAiB,CACnD,CAAA;IACH,CAAC;IAES,KAAK,CAAC,iBAAiB,CAC/B,MAAc,EACd,UAAsB,EACtB,SAA2B,EAC3B,OAIC;QAED,iFAAiF;QACjF,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,CAAC,QAAQ,CAAC,0BAA0B,EAAE,CAAC;YACrE,MAAM,IAAI,0CAAiB,CACzB,mDAAmD,MAAM,CAAC,QAAQ,CAAC,0BAA0B,SAAS,UAAU,CAAC,MAAM,GAAG,CAC3H,CAAA;QACH,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC;YACnC,MAAM,IAAI,0CAAiB,CAAC,qCAAqC,CAAC,CAAA;QACpE,CAAC;QAED,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAA;QAC9B,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;YACxB,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,0CAAiB,CAAC,yCAAyC,CAAC,CAAA;YACxE,CAAC;iBAAM,IAAI,UAAU,CAAC,QAAQ,KAAK,SAAS,CAAC,GAAG,EAAE,CAAC;gBACjD,MAAM,IAAI,0CAAiB,CACzB,4CAA4C,CAC7C,CAAA;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YACxB,2EAA2E;YAC3E,yEAAyE;YACzE,4EAA4E;YAC5E,8DAA8D;YAC9D,wEAAwE;YACxE,eAAe;YACf,OAAM;QACR,CAAC;QAED,QAAQ,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YAClC,KAAK,8CAAgC,CAAC,CAAC,SAAS;YAChD,KAAK,iBAAiB;gBACpB,IAAI,UAAU,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;oBAC5C,MAAM,IAAI,0CAAiB,CACzB,mDAAmD,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,CAChF,CAAA;gBACH,CAAC;gBACD,IACE,UAAU,CAAC,GAAG,KAAK,OAAO,CAAC,UAAU,CAAC,GAAG;oBACzC,UAAU,CAAC,GAAG,KAAK,OAAO,CAAC,UAAU,CAAC,GAAG;oBACzC,UAAU,CAAC,GAAG,KAAK,OAAO,CAAC,UAAU,CAAC,GAAG,EACzC,CAAC;oBACD,MAAM,IAAI,0CAAiB,CACzB,yFAAyF,CAC1F,CAAA;gBACH,CAAC;gBACD,MAAK;YACP,KAAK,MAAM;gBACT,qEAAqE;gBACrE,mEAAmE;gBACnE,MAAK;YACP;gBACE,MAAM,IAAI,0CAAiB;gBACzB,2DAA2D;gBAC3D,mBAAmB,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,CAChD,CAAA;QACL,CAAC;IACH,CAAC;IAES,KAAK,CAAC,sBAAsB,CACpC,MAAc,EACd,UAAsB,EACtB,cAA+B,EAC/B,KAA8C,EAC9C,SAA2B;QAE3B,MAAM,IAAI,GAAG,MAAM,oBAAU;aAC1B,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;aAC1C,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,MAAM,0CAAiB,CAAC,IAAI,CAC1B,GAAG,EACH,GAAG,YAAY,cAAQ;gBACrB,CAAC,CAAC,iBAAiB,GAAG,CAAC,OAAO,EAAE;gBAChC,CAAC,CAAC,cAAc,CACnB,CAAA;QACH,CAAC,CAAC,CAAA;QAEJ,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc;aACnC,WAAW,CAAC,IAAI,CAAC;aACjB,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,uDAAuD;YACvD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;YAC1D,IAAI,SAAS,EAAE,CAAC;gBACd,wEAAwE;gBACxE,IAAI,CAAC;oBACH,+CAA+C;oBAC/C,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;gBACnD,CAAC;wBAAS,CAAC;oBACT,kEAAkE;oBAClE,kEAAkE;oBAClE,gCAAgC;oBAChC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,SAAS,CAAC,IAAI,CAAA;oBACxC,IAAI,QAAQ,EAAE,CAAC;wBACb,MAAM,IAAI,CAAC,cAAc,CAAC,mBAAmB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;oBAC9D,CAAC;gBACH,CAAC;YACH,CAAC;YAED,MAAM,0CAAiB,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;QACnD,CAAC,CAAC,CAAA;QAEJ,4EAA4E;QAC5E,uEAAuE;QACvE,2EAA2E;QAC3E,WAAW;QAEX,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;QAEjE,0EAA0E;QAC1E,UAAU;QACV,MAAM,UAAU,GACd,SAAS;YACT,MAAM,CAAC,QAAQ,CAAC,wBAAwB;YACxC,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ;YACvB,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,CAAC,GAAG,EAAE;YACjD,CAAC,CAAC,IAAI,CAAC,UAAU,CAAA;QAErB,MAAM,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;QAE/C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAElE,OAAO,IAAI,CAAC,YAAY,CAAC,WAAW,CAClC,MAAM,EACN,UAAU,EACV,cAAc,EACd,OAAO,EACP,IAAI,CAAC,QAAQ,EACb,UAAU,EACV,IAAI,CACL,CAAA;IACH,CAAC;IAES,KAAK,CAAC,iBAAiB,CAC/B,UAA+C,EAC/C,KAA8C;QAE9C,IAAI,UAAU,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,EAAE,CAAC;YACnD,MAAM,IAAI,0CAAiB,CACzB,iFAAiF,CAClF,CAAA;QACH,CAAC;QAED,IAAI,UAAU,CAAC,cAAc,EAAE,CAAC;YAC9B,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;gBACzB,MAAM,IAAI,0CAAiB,CAAC,2BAA2B,CAAC,CAAA;YAC1D,CAAC;YACD,IAAI,KAAK,CAAC,aAAa,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;gBACpC,MAAM,IAAI,0CAAiB,CAAC,yBAAyB,CAAC,CAAA;YACxD,CAAC;YACD,QAAQ,UAAU,CAAC,qBAAqB,EAAE,CAAC;gBACzC,KAAK,SAAS,CAAC,CAAC,qBAAqB;gBACrC,KAAK,OAAO;oBACV,IAAI,UAAU,CAAC,cAAc,KAAK,KAAK,CAAC,aAAa,EAAE,CAAC;wBACtD,MAAM,IAAI,0CAAiB,CAAC,uBAAuB,CAAC,CAAA;oBACtD,CAAC;oBACD,MAAK;gBAEP,KAAK,MAAM,CAAC,CAAC,CAAC;oBACZ,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAChC,UAAU,CAAC,cAAc,EACzB,QAAQ,CACT,CAAA;oBACD,MAAM,iBAAiB,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC;yBAC3C,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC;yBAC3B,MAAM,EAAE,CAAA;oBACX,IAAI,cAAc,CAAC,OAAO,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;wBACpD,MAAM,IAAI,0CAAiB,CAAC,uBAAuB,CAAC,CAAA;oBACtD,CAAC;oBACD,MAAK;gBACP,CAAC;gBAED;oBACE,qEAAqE;oBACrE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;YACxD,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,mBAAmB,CACzD,UAAU,CAAC,cAAc,CAC1B,CAAA;YACD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,0CAAiB,CAAC,6BAA6B,CAAC,CAAA;YAC5D,CAAC;QACH,CAAC;aAAM,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YAC7C,MAAM,IAAI,8CAAmB,CAAC,0CAA0C,CAAC,CAAA;QAC3E,CAAC;IACH,CAAC;IAES,KAAK,CAAC,iBAAiB,CAC/B,MAAc,EACd,UAAsB,EACtB,cAA+B,EAC/B,KAAyC,EACzC,SAA2B;QAE3B,MAAM,YAAY,GAAG,MAAM,mCAAkB;aAC1C,UAAU,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC;aAC5D,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,MAAM,0CAAiB,CAAC,IAAI,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAA;QAC5D,CAAC,CAAC,CAAA;QAEJ,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAA;QAE3E,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,GAAG,SAAS,CAAA;YAC1B,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;YACjE,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,CAAA;YAEzD,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CACxC,MAAM,EACN,UAAU,EACV,cAAc,EACd,SAAS,CACV,CAAA;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;YAEjD,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAES,KAAK,CAAC,oBAAoB,CAClC,MAAc,EACd,UAAsB,EACtB,IAAe;QAEf,MAAM,CAAC,eAAe,EAAE,eAAe,CAAC,GACtC,UAAU,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY;YACtD,CAAC,CAAC;gBACE,mDAAoC;gBACpC,mDAAoC;aACrC;YACH,CAAC,CAAC,CAAC,6CAA8B,EAAE,6CAA8B,CAAC,CAAA;QAEtE,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAA;QACxD,IAAI,UAAU,GAAG,eAAe,EAAE,CAAC;YACjC,MAAM,IAAI,0CAAiB,CAAC,iBAAiB,CAAC,CAAA;QAChD,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAA;QACxD,IAAI,UAAU,GAAG,eAAe,EAAE,CAAC;YACjC,MAAM,IAAI,0CAAiB,CAAC,uBAAuB,CAAC,CAAA;QACtD,CAAC;IACH,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,MAAM,CACjB,iBAAyC,EACzC,EAAE,KAAK,EAA4B,EACnC,SAA2B;QAE3B,wEAAwE;QACxE,mCAAmC;QACnC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAC1D,iBAAiB,EACjB,SAAS,CACV,CAAA;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;QAC1D,IAAI,SAAS,EAAE,CAAC;YACd,uEAAuE;YACvE,mCAAmC;YACnC,MAAM,EAAE,IAAI,EAAE,GAAG,SAAS,CAAA;YAC1B,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;YAEjE,0EAA0E;YAC1E,uEAAuE;YACvE,gCAAgC;YAChC,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;QACnD,CAAC;IACH,CAAC;IAEkB,KAAK,CAAC,WAAW,CAClC,SAAyB,EACzB,KAAuB,EACvB,SAA2B,EAC3B,aAAwC;QAExC,IAAI,IAAI,CAAC,eAAe,KAAK,sCAAe,CAAC,SAAS,EAAE,CAAC;YACvD,OAAO,KAAK,CAAC,WAAW,CAAC,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,aAAa,CAAC,CAAA;QACtE,CAAC;QAED,IAAI,IAAI,CAAC,eAAe,KAAK,sCAAe,CAAC,KAAK,EAAE,CAAC;YACnD,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,KAAK,CAAC,WAAW,CAC7C,SAAS,EACT,KAAK,EACL,SAAS;YACT,kEAAkE;YAClE,4DAA4D;YAC5D,SAAS,CACV,CAAA;YAED,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAA;YAE/B,0EAA0E;YAC1E,mEAAmE;YACnE,mCAAmC;YACnC,OAAO,IAAI,CAAC,YAAY,CAAC,WAAW,CAClC,KAAK,EACL,SAAS,EACT,OAAO,EACP,SAAS,EACT,aAAa,CACd,CAAA;QACH,CAAC;QAED,aAAa;QACb,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;IAC9C,CAAC;CACF;AAj3BD,sCAi3BC"}

package/dist/replay/replay-manager.d.ts

@@ -3,7 +3,7 @@ import { ReplayStore } from './replay-store.js';
 export declare class ReplayManager {
     protected readonly replayStore: ReplayStore;
     constructor(replayStore: ReplayStore);
-    uniqueAuth(jti: string, clientId: ClientId): Promise<boolean>;
+    uniqueAuth(jti: string, clientId: ClientId, exp?: number): Promise<boolean>;
     uniqueJar(jti: string, clientId: ClientId): Promise<boolean>;
     uniqueDpop(jti: string, clientId?: ClientId): Promise<boolean>;
     uniqueCodeChallenge(challenge: string): Promise<boolean>;

package/dist/replay/replay-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"replay-manager.d.ts","sourceRoot":"","sources":["../../src/replay/replay-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAA;AAOjD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAK/C,qBAAa,aAAa;IACZ,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,WAAW;gBAAxB,WAAW,EAAE,WAAW;IAEjD,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAQ7D,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAQ5D,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAQ9D,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAO/D"}
+{"version":3,"file":"replay-manager.d.ts","sourceRoot":"","sources":["../../src/replay/replay-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAA;AAOjD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAK/C,qBAAa,aAAa;IACZ,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,WAAW;gBAAxB,WAAW,EAAE,WAAW;IAEjD,UAAU,CACd,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,QAAQ,EAClB,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,OAAO,CAAC;IAQb,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAQ5D,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAQ9D,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAO/D"}

package/dist/replay/replay-manager.js

@@ -9,8 +9,11 @@ class ReplayManager {
     constructor(replayStore) {
         this.replayStore = replayStore;
     }
-    async uniqueAuth(jti, clientId) {
-        return this.replayStore.unique(`Auth@${clientId}`, jti, asTimeFrame(constants_js_1.CLIENT_ASSERTION_MAX_AGE));
+    async uniqueAuth(jti, clientId, exp) {
+        const timeFrame = exp == null
+            ? asTimeFrame(constants_js_1.CLIENT_ASSERTION_MAX_AGE)
+            : exp * 1000 - Date.now();
+        return this.replayStore.unique(`Auth@${clientId}`, jti, timeFrame);
     }
     async uniqueJar(jti, clientId) {
         return this.replayStore.unique(`JAR@${clientId}`, jti, asTimeFrame(constants_js_1.JAR_MAX_AGE));