@atproto/pds 0.5.52 → 0.5.56

package/dist/auth-verifier.js

@@ -3,13 +3,15 @@ import { secp256k1 } from '@noble/curves/secp256k1';
 import * as jose from 'jose';
 import { getVerificationMaterial } from '@atproto/common';
 import { getDidKeyFromMultibase } from '@atproto/identity';
-import { isDidString, } from '@atproto/lex';
+import { isDidString, } from '@atproto/lex-schema';
 import { OAuthError, WWWAuthenticateError, } from '@atproto/oauth-provider/errors';
 import { ScopePermissionsTransition, } from '@atproto/oauth-scopes';
 import { AuthRequiredError, ForbiddenError, InvalidRequestError, XRPCError, parseReqNsid, verifyJwt as verifyServiceJwt, } from '@atproto/xrpc-server';
 import { ACCESS_STANDARD, AuthScope, isAuthScope } from './auth-scope.js';
 import { softDeleted } from './db/index.js';
 import { appendVary } from './util/http.js';
+const ENTRYWAY_SERVICE_JWT_MAX_LIFETIME_SEC = 5 * 60;
+const ENTRYWAY_SERVICE_JWT_CLOCK_TOLERANCE_SEC = 30;
 export class AuthVerifier {
     constructor(accountManager, idResolver, oauthVerifier, opts) {
         this.accountManager = accountManager;
@@ -67,6 +69,42 @@ export class AuthVerifier {
                 return this.adminToken(ctx);
             }
         };
+        this.entrywayService = async (ctx) => {
+            setAuthHeaders(ctx.res);
+            const payload = await this.verifyEntrywayServiceJwt(ctx.req);
+            return {
+                credentials: {
+                    type: 'entryway_service',
+                    did: payload.iss,
+                },
+            };
+        };
+        this.entrywayServiceOptional = async (ctx) => {
+            if (extractAuthType(ctx.req) === AuthType.BEARER) {
+                return this.entrywayService(ctx);
+            }
+            this.assertEntrywayServiceAuthNotRequired(ctx.res);
+            return this.unauthenticated(ctx);
+        };
+        this.adminTokenOrEntrywayService = async (ctx) => {
+            if (!this._entrywayServiceAuth) {
+                return this.adminToken(ctx);
+            }
+            if (extractAuthType(ctx.req) === AuthType.BEARER) {
+                return this.entrywayService(ctx);
+            }
+            this.assertEntrywayServiceAuthNotRequired(ctx.res);
+            return this.adminToken(ctx);
+        };
+        this.moderatorOrEntrywayService = async (ctx) => {
+            if (extractAuthType(ctx.req) === AuthType.BEARER) {
+                return this.isEntrywayIssuedJwt(ctx.req)
+                    ? this.entrywayService(ctx)
+                    : this.modService(ctx);
+            }
+            this.assertEntrywayServiceAuthNotRequired(ctx.res);
+            return this.adminToken(ctx);
+        };
         this.userServiceAuth = async (ctx) => {
             setAuthHeaders(ctx.res);
             const payload = await this.verifyServiceJwt(ctx.req);
@@ -89,6 +127,7 @@ export class AuthVerifier {
         this._publicUrl = opts.publicUrl;
         this._jwtKey = opts.jwtKey;
         this._adminPass = opts.adminPass;
+        this._entrywayServiceAuth = opts.entrywayServiceAuth;
         this.dids = opts.dids;
     }
     access(options) {
@@ -357,6 +396,65 @@ export class AuthVerifier {
         }
         return payload;
     }
+    async verifyEntrywayServiceJwt(req) {
+        const entrywayDid = this.dids.entryway;
+        const didKey = this._entrywayServiceAuth?.didKey;
+        if (!entrywayDid || !didKey) {
+            throw new AuthRequiredError('Untrusted issuer', 'UntrustedIss');
+        }
+        const jwtStr = bearerTokenFromReq(req);
+        if (!jwtStr) {
+            throw new AuthRequiredError('missing jwt', 'MissingJwt');
+        }
+        // @NOTE Unlike this.verifyServiceJwt(), the key comes from config rather
+        // than the issuer's DID document, and the entryway is not an accepted
+        // audience: these tokens are minted for this PDS only.
+        const payload = await verifyServiceJwt(jwtStr, this.dids.pds, parseReqNsid(req), async (iss) => {
+            if (iss !== entrywayDid) {
+                throw new AuthRequiredError('Untrusted issuer', 'UntrustedIss');
+            }
+            return didKey;
+        });
+        // @NOTE xrpc-server's verifyJwt pins neither "alg" (an empty one skips its
+        // algorithm check) nor "typ", and does not bound token lifetime; the
+        // entryway token contract requires all three.
+        const { alg, typ } = jose.decodeProtectedHeader(jwtStr);
+        if (alg !== 'ES256K') {
+            throw new AuthRequiredError(`Invalid jwt algorithm "${alg}"`, 'BadJwtAlg');
+        }
+        if (typ !== 'JWT') {
+            throw new AuthRequiredError(`Invalid jwt type "${typ}"`, 'BadJwtType');
+        }
+        const { iat } = jose.decodeJwt(jwtStr);
+        if (typeof iat !== 'number' ||
+            iat > Date.now() / 1000 + ENTRYWAY_SERVICE_JWT_CLOCK_TOLERANCE_SEC) {
+            throw new AuthRequiredError('jwt iat is missing or invalid', 'BadJwtIat');
+        }
+        if (payload.exp - iat > ENTRYWAY_SERVICE_JWT_MAX_LIFETIME_SEC) {
+            throw new AuthRequiredError('jwt lifetime is too long', 'BadJwtLifetime');
+        }
+        return payload;
+    }
+    isEntrywayIssuedJwt(req) {
+        if (!this.dids.entryway || !this._entrywayServiceAuth)
+            return false;
+        const token = bearerTokenFromReq(req);
+        if (!token)
+            return false;
+        try {
+            return jose.decodeJwt(token).iss === this.dids.entryway;
+        }
+        catch {
+            // Malformed tokens are left to the fallback verifier to reject.
+            return false;
+        }
+    }
+    assertEntrywayServiceAuthNotRequired(res) {
+        if (this._entrywayServiceAuth?.required) {
+            setAuthHeaders(res);
+            throw new AuthRequiredError('Entryway service auth required');
+        }
+    }
 }
 // HELPERS
 // ---------

package/dist/auth-verifier.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-verifier.js","sourceRoot":"","sources":["../src/auth-verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,eAAe,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAE9E,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AACnD,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAC5B,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAA;AACzD,OAAO,EAAmB,sBAAsB,EAAE,MAAM,mBAAmB,CAAA;AAC3E,OAAO,EAGL,WAAW,GACZ,MAAM,cAAc,CAAA;AACrB,OAAO,EACL,UAAU,EACV,oBAAoB,GACrB,MAAM,gCAAgC,CAAA;AAKvC,OAAO,EAEL,0BAA0B,GAC3B,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,iBAAiB,EAEjB,cAAc,EACd,mBAAmB,EAInB,SAAS,EACT,YAAY,EACZ,SAAS,IAAI,gBAAgB,GAC9B,MAAM,sBAAsB,CAAA;AAY7B,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAiD3C,MAAM,OAAO,YAAY;IAMvB,YACS,cAA8B,EAC9B,UAAsB,EACtB,aAA4B,EACnC,IAAsB;QAHf,mBAAc,GAAd,cAAc,CAAgB;QAC9B,eAAU,GAAV,UAAU,CAAY;QACtB,kBAAa,GAAb,aAAa,CAAe;QASrC,0CAA0C;QAEnC,oBAAe,GAA8C,CAAC,GAAG,EAAE,EAAE;YAC1E,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAEvB,0EAA0E;YAC1E,2EAA2E;YAC3E,2EAA2E;YAC3E,uBAAuB;YACvB,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;gBACrC,MAAM,IAAI,iBAAiB,CAAC,8BAA8B,CAAC,CAAA;YAC7D,CAAC;YAED,OAAO;gBACL,WAAW,EAAE,IAAI;aAClB,CAAA;QACH,CAAC,CAAA;QAED,6DAA6D;QACtD,eAAU,GAAyC,KAAK,EAAE,GAAG,EAAE,EAAE;YACtE,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACvB,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACtC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,iBAAiB,EAAE,CAAA;YAC/B,CAAC;YACD,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAA;YACrC,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;gBACzD,MAAM,IAAI,iBAAiB,EAAE,CAAA;YAC/B,CAAC;YAED,OAAO,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,CAAA;QACjD,CAAC,CAAA;QAEM,eAAU,GAAyC,KAAK,EAAE,GAAG,EAAE,EAAE;YACtE,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACvB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;gBAC1B,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAA;YACjE,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE;gBACnD,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,kBAAkB,CAAC;aACvE,CAAC,CAAA;YACF,OAAO;gBACL,WAAW,EAAE;oBACX,IAAI,EAAE,aAAa;oBACnB,GAAG,EAAE,OAAO,CAAC,GAAG;iBACjB;aACF,CAAA;QACH,CAAC,CAAA;QAED,qGAAqG;QAC9F,cAAS,GACd,KAAK,EAAE,GAAG,EAAE,EAAE;YACZ,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACrC,IAAI,IAAI,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAC7B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;YAC7B,CAAC;iBAAM,CAAC;gBACN,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;YAC7B,CAAC;QACH,CAAC,CAAA;QAgJI,oBAAe,GAA8C,KAAK,EACvE,GAAG,EACH,EAAE;YACF,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACvB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACpD,OAAO;gBACL,WAAW,EAAE;oBACX,IAAI,EAAE,mBAAmB;oBACzB,GAAG,EAAE,OAAO,CAAC,GAAG;iBACjB;aACF,CAAA;QACH,CAAC,CAAA;QAEM,4BAAuB,GAE1B,KAAK,EAAE,GAAG,EAAE,EAAE;YAChB,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACrC,IAAI,IAAI,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAC7B,OAAO,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;YACxC,CAAC;iBAAM,CAAC;gBACN,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;YAClC,CAAC;QACH,CAAC,CAAA;QAtOC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAA;QAChC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,MAAM,CAAA;QAC1B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAA;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;IACvB,CAAC;IA8DS,MAAM,CACd,OAAqD;QAErD,MAAM,EAAE,MAAM,EAAE,GAAG,aAAa,EAAE,GAAG,OAAO,CAAA;QAE5C,MAAM,gBAAgB,GAA8B;YAClD,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG;YACvB,GAAG,EAAE,QAAQ;YACb,MAAM;YACJ,mEAAmE;YACnE,0BAA0B;YAC1B,aAAa,CAAC,aAAa,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAc,CAAC;gBACtE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,SAAS,CAAC;gBACjD,CAAC,CAAC,MAAM;SACb,CAAA;QAED,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAEvB,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CACpD,GAAG,CAAC,GAAG,EACP,gBAAgB,CACjB,CAAA;YAED,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;YAE3C,OAAO;gBACL,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE;aAC5C,CAAA;QACH,CAAC,CAAA;IACH,CAAC;IAEM,OAAO,CAAC,OAEd;QACC,MAAM,aAAa,GAA8C;YAC/D,cAAc,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;YAC5D,GAAG,EAAE,aAAa;YAClB,oDAAoD;YACpD,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YACjE,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC;SAC5B,CAAA;QAED,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;YAEjE,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAA;YAC1B,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,iBAAiB,CACzB,qCAAqC,EACrC,gBAAgB,CACjB,CAAA;YACH,CAAC;YAED,OAAO;gBACL,WAAW,EAAE;oBACX,IAAI,EAAE,SAAS;oBACf,GAAG,EAAE,MAAM,CAAC,GAAG;oBACf,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,OAAO;iBACR;aACF,CAAA;QACH,CAAC,CAAA;IACH,CAAC;IAEM,aAAa,CAAmB,EACrC,MAAM,GAAG,eAAe,EACxB,UAAU,GAAG,EAAE,EACf,GAAG,OAAO,EAIU;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YACzB,GAAG,OAAO;YACV,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,UAAU,CAAC;SACnC,CAAC,CAAA;QACF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAEjC,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAErC,IAAI,IAAI,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAC7B,OAAO,MAAM,CAAC,GAAG,CAAC,CAAA;YACpB,CAAC;YAED,IAAI,IAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAC3B,OAAO,KAAK,CAAC,GAAG,CAAC,CAAA;YACnB,CAAC;YAED,uEAAuE;YACvE,+CAA+C;YAC/C,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAEvB,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,mBAAmB,CAC3B,+BAA+B,EAC/B,cAAc,CACf,CAAA;YACH,CAAC;YAED,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAA;QACvD,CAAC,CAAA;IACH,CAAC;IAEM,yBAAyB,CAC9B,IAAiE;QAEjE,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;QAC9C,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;YACnC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;oBACrC,OAAO,aAAa,CAAC,GAAG,CAAC,CAAA;gBAC3B,CAAC;gBACD,MAAM,GAAG,CAAA;YACX,CAAC;QACH,CAAC,CAAA;IACH,CAAC;IAEM,iCAAiC,CACtC,IAAiE;QAKjE,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;QAC9C,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACrC,IAAI,IAAI,KAAK,QAAQ,CAAC,MAAM,IAAI,IAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACvD,OAAO,aAAa,CAAC,GAAG,CAAC,CAAA;YAC3B,CAAC;iBAAM,IAAI,IAAI,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACnC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;YAC7B,CAAC;iBAAM,CAAC;gBACN,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;YAClC,CAAC;QACH,CAAC,CAAA;IACH,CAAC;IA0BM,8BAA8B,CACnC,OAGsB;QAEtB,MAAM,qBAAqB,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;QACzD,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,IAAI,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACrC,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;YAClC,CAAC;iBAAM,CAAC;gBACN,OAAO,qBAAqB,CAAC,GAAG,CAAC,CAAA;YACnC,CAAC;QACH,CAAC,CAAA;IACH,CAAC;IAES,KAAK,CAAmB,EAChC,SAAS,EACT,GAAG,mBAAmB,EACiB;QAIvC,MAAM,kBAAkB,GAA8B;YACpD,QAAQ,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;YACzB,KAAK,EAAE,CAAC,SAAS,CAAC;SACnB,CAAA;QAED,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAEvB,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,CAAA;YAExB,4DAA4D;YAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,CAAA;YACpD,IAAI,SAAS,EAAE,CAAC;gBACd,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,SAAS,CAAC,CAAA;gBACtC,GAAG,CAAC,YAAY,CAAC,+BAA+B,EAAE,YAAY,CAAC,CAAA;YACjE,CAAC;YAED,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAA;YACrD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;YAEjD,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa;iBACjD,mBAAmB,CAClB,GAAG,CAAC,MAAM,IAAI,KAAK,EACnB,GAAG,EACH,GAAG,CAAC,OAAO,EACX,kBAAkB,CACnB;iBACA,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACb,mEAAmE;gBACnE,0DAA0D;gBAC1D,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;oBACxC,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,GAAG,CAAC,qBAAqB,CAAC,CAAA;oBAC5D,GAAG,CAAC,YAAY,CACd,+BAA+B,EAC/B,kBAAkB,CACnB,CAAA;gBACH,CAAC;gBAED,IAAI,GAAG,YAAY,UAAU,EAAE,CAAC;oBAC9B,MAAM,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,iBAAiB,EAAE,GAAG,CAAC,KAAK,CAAC,CAAA;gBACnE,CAAC;gBAED,MAAM,GAAG,CAAA;YACX,CAAC,CAAC,CAAA;YAEJ,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;YAClE,CAAC;YAED,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAA;YAEjD,MAAM,WAAW,GAAG,IAAI,0BAA0B,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;YAErE,sBAAsB;YACtB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBACvC,MAAM,IAAI,mBAAmB,CAC3B,2CAA2C,EAC3C,cAAc,CACf,CAAA;YACH,CAAC;YAED,MAAM,SAAS,CAAC,WAAW,EAAE,GAAG,CAAC,CAAA;YAEjC,OAAO;gBACL,WAAW,EAAE;oBACX,IAAI,EAAE,OAAO;oBACb,GAAG;oBACH,WAAW;iBACZ;aACF,CAAA;QACH,CAAC,CAAA;IACH,CAAC;IAES,KAAK,CAAC,YAAY,CAC1B,GAAc,EACd,OAAwB;QAExB,IAAI,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YACtD,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;QACtC,CAAC;IACH,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,WAAW,CACtB,WAA+B,EAC/B,OAAwB;QAExB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,WAAW,EAAE;YAChE,kBAAkB,EAAE,IAAI;YACxB,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAA;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,yEAAyE;YACzE,MAAM,IAAI,cAAc,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,OAAO,CAAC,aAAa,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,iBAAiB,CACzB,6BAA6B,EAC7B,iBAAiB,CAClB,CAAA;QACH,CAAC;QACD,IAAI,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YACtD,MAAM,IAAI,iBAAiB,CACzB,wBAAwB,EACxB,oBAAoB,CACrB,CAAA;QACH,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;IAED;;;OAGG;IACO,KAAK,CAAC,eAAe,CAC7B,GAAoB,EACpB,EAAE,MAAM,EAAE,GAAG,OAAO,EAA6B;QAEjD,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;QACrC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAA;QACvD,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI;aAC3B,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;aACvC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACf,IAAI,KAAK,YAAY,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;gBAC5C,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,EAAE,cAAc,EAAE;oBACjE,KAAK;iBACN,CAAC,CAAA;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,mBAAmB,CAC3B,6BAA6B,EAC7B,cAAc,EACd,EAAE,KAAK,EAAE,CACV,CAAA;YACH,CAAC;QACH,CAAC,CAAC,CAAA;QAEJ,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,OAAO,CAAA;QAElD,IAAI,OAAO,GAAG,KAAK,WAAW,EAAE,CAAC;YAC/B,sEAAsE;YACtE,yEAAyE;YACzE,+DAA+D;YAC/D,yEAAyE;YACzE,mBAAmB;YACnB,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,WAAW,EAAE,CAAC;YAC/B,wDAAwD;YACxD,8CAA8C;YAC9C,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,WAAW,EAAE,CAAC;YAC1D,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAY,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QAED,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,KAAU,EAAE,CAAA;IAC7C,CAAC;IAES,KAAK,CAAC,gBAAgB,CAC9B,GAAoB,EACpB,IAAyB;QAEzB,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,iBAAiB,CAAC,aAAa,EAAE,YAAY,CAAC,CAAA;QAC1D,CAAC;QAED,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;QAC9B,MAAM,OAAO,GAAG,MAAM,gBAAgB,CACpC,MAAM,EACN,IAAI,EACJ,IAAI,EACJ,KAAK,EAAE,GAAG,EAAE,YAAY,EAAE,EAAE;YAC1B,IAAI,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAA;YACjE,CAAC;YACD,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YACvC,MAAM,KAAK,GACT,SAAS,KAAK,iBAAiB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAA;YAC/D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;YACnE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,iBAAiB,CAAC,2BAA2B,CAAC,CAAA;YAC1D,CAAC;YACD,MAAM,SAAS,GAAG,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;YACxD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,iBAAiB,CAAC,+BAA+B,CAAC,CAAA;YAC9D,CAAC;YACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAA;YAChD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,iBAAiB,CAAC,+BAA+B,CAAC,CAAA;YAC9D,CAAC;YACD,OAAO,MAAM,CAAA;QACf,CAAC,CACF,CAAA;QACD,IACE,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG;YAC7B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAC3D,CAAC;YACD,MAAM,IAAI,iBAAiB,CACzB,yCAAyC,EACzC,gBAAgB,CACjB,CAAA;QACH,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;CACF;AAED,UAAU;AACV,YAAY;AAEZ,MAAM,UAAU,aAAa,CAC3B,IAA2E,EAC3E,GAAW;IAEX,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACtB,OAAO,KAAK,CAAA;IACd,CAAC;SAAM,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACnD,OAAO,IAAI,CAAA;IACb,CAAC;SAAM,CAAC;QACN,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,KAAK,GAAG,CAAA;IACrC,CAAC;AACH,CAAC;AAED,IAAK,QAIJ;AAJD,WAAK,QAAQ;IACX,2BAAe,CAAA;IACf,6BAAiB,CAAA;IACjB,yBAAa,CAAA;AACf,CAAC,EAJI,QAAQ,KAAR,QAAQ,QAIZ;AAED,MAAM,wBAAwB,GAAG,CAC/B,GAAoB,EAC4B,EAAE;IAClD,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAA;IAClD,IAAI,CAAC,aAAa;QAAE,OAAO,CAAC,IAAI,CAAC,CAAA;IAEjC,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACvC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,mBAAmB,CAC3B,gCAAgC,EAChC,cAAc,CACf,CAAA;IACH,CAAC;IAED,yCAAyC;IACzC,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;IAExC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC1E,IAAI,IAAI;QAAE,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;IAElC,MAAM,IAAI,mBAAmB,CAC3B,mCAAmC,MAAM,CAAC,CAAC,CAAC,EAAE,EAC9C,cAAc,CACf,CAAA;AACH,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,uBAAuB,GAAG,CAAC,GAAoB,EAAW,EAAE;IAChE,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;IACrC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAA;IACxB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IACrC,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,CAAA;AAC/B,CAAC,CAAA;AAED,MAAM,eAAe,GAAG,CAAC,GAAoB,EAAmB,EAAE;IAChE,MAAM,CAAC,IAAI,CAAC,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAA;IAC5C,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAoB,EAAE,EAAE;IACzD,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAA;IACnD,OAAO,IAAI,KAAK,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;AAChD,CAAC,CAAA;AAED,MAAM,cAAc,GAAG,CACrB,GAAoB,EAC2B,EAAE;IACjD,IAAI,CAAC;QACH,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAA;QACjD,IAAI,IAAI,KAAK,QAAQ,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QACxC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QAC3D,qEAAqE;QACrE,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAClC,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAA;QAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;QACzC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAA;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC,CAAA;AAED,OAAO,EAAkB,CAAA;AAEzB,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,MAAc,EAAa,EAAE;IACjE,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA;AAC7C,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,YAAoB,EAAa,EAAE;IACvE,2EAA2E;IAC3E,MAAM,KAAK,GACT,SAAS,CAAC,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;IACnE,OAAO,eAAe,CAAC;QACrB,MAAM,EAAE,KAAK;QACb,GAAG,EAAE;YACH,GAAG,EAAE,IAAI;YACT,GAAG,EAAE,WAAW;YAChB,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;YAC3D,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;SAC7D;KACF,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,SAAS,cAAc,CAAC,GAAmB;IACzC,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,SAAS,CAAC,CAAA;IACzC,UAAU,CAAC,GAAG,EAAE,eAAe,CAAC,CAAA;AAClC,CAAC","sourcesContent":["import { type KeyObject, createPublicKey, createSecretKey } from 'node:crypto'\nimport type { IncomingMessage, ServerResponse } from 'node:http'\nimport { secp256k1 } from '@noble/curves/secp256k1'\nimport * as jose from 'jose'\nimport { getVerificationMaterial } from '@atproto/common'\nimport { type IdResolver, getDidKeyFromMultibase } from '@atproto/identity'\nimport {\n  type AtIdentifierString,\n  type DidString,\n  isDidString,\n} from '@atproto/lex'\nimport {\n  OAuthError,\n  WWWAuthenticateError,\n} from '@atproto/oauth-provider/errors'\nimport type {\n  OAuthVerifier,\n  VerifyTokenPayloadOptions,\n} from '@atproto/oauth-provider/verifier'\nimport {\n  type ScopePermissions,\n  ScopePermissionsTransition,\n} from '@atproto/oauth-scopes'\nimport {\n  AuthRequiredError,\n  type Awaitable,\n  ForbiddenError,\n  InvalidRequestError,\n  type MethodAuthContext,\n  type MethodAuthVerifier,\n  type Params,\n  XRPCError,\n  parseReqNsid,\n  verifyJwt as verifyServiceJwt,\n} from '@atproto/xrpc-server'\nimport type { AccountManager } from './account-manager/account-manager.js'\nimport type { ActorAccount } from './account-manager/helpers/account.js'\nimport type {\n  AccessOutput,\n  AdminTokenOutput,\n  ModServiceOutput,\n  OAuthOutput,\n  RefreshOutput,\n  UnauthenticatedOutput,\n  UserServiceAuthOutput,\n} from './auth-output.js'\nimport { ACCESS_STANDARD, AuthScope, isAuthScope } from './auth-scope.js'\nimport { softDeleted } from './db/index.js'\nimport { appendVary } from './util/http.js'\nimport type { WithRequired } from './util/types.js'\n\nexport type VerifiedOptions = {\n  checkTakedown?: boolean\n  checkDeactivated?: boolean\n}\n\nexport type ScopedOptions<S extends AuthScope = AuthScope> = {\n  scopes?: readonly S[]\n}\n\nexport type ExtraScopedOptions<S extends AuthScope = AuthScope> = {\n  additional?: readonly S[]\n}\n\nexport type AuthorizedOptions<P extends Params = Params> = {\n  authorize: (\n    permissions: ScopePermissions,\n    ctx: MethodAuthContext<P>,\n  ) => Awaitable<void>\n}\n\nexport type AuthVerifierOpts = {\n  publicUrl: string\n  jwtKey: KeyObject\n  adminPass: string\n  dids: {\n    pds: string\n    entryway?: string\n    modService?: string\n  }\n}\n\nexport type VerifyBearerJwtOptions<S extends AuthScope = AuthScope> =\n  WithRequired<\n    Omit<jose.JWTVerifyOptions, 'scopes'> & {\n      scopes: readonly S[]\n    },\n    'audience' | 'typ'\n  >\n\nexport type VerifyBearerJwtResult<S extends AuthScope = AuthScope> = {\n  sub: DidString\n  aud: string\n  jti: string | undefined\n  scope: S\n}\n\nexport class AuthVerifier {\n  private _publicUrl: string\n  private _jwtKey: KeyObject\n  private _adminPass: string\n  public dids: AuthVerifierOpts['dids']\n\n  constructor(\n    public accountManager: AccountManager,\n    public idResolver: IdResolver,\n    public oauthVerifier: OAuthVerifier,\n    opts: AuthVerifierOpts,\n  ) {\n    this._publicUrl = opts.publicUrl\n    this._jwtKey = opts.jwtKey\n    this._adminPass = opts.adminPass\n    this.dids = opts.dids\n  }\n\n  // verifiers (arrow fns to preserve scope)\n\n  public unauthenticated: MethodAuthVerifier<UnauthenticatedOutput> = (ctx) => {\n    setAuthHeaders(ctx.res)\n\n    // @NOTE this auth method is typically used as fallback when no other auth\n    // method is applicable. This means that the presence of an \"authorization\"\n    // header means that that header is invalid (as it did not match any of the\n    // other auth methods).\n    if (ctx.req.headers['authorization']) {\n      throw new AuthRequiredError('Invalid authorization header')\n    }\n\n    return {\n      credentials: null,\n    }\n  }\n\n  /** @deprecated We are steering away from this auth method */\n  public adminToken: MethodAuthVerifier<AdminTokenOutput> = async (ctx) => {\n    setAuthHeaders(ctx.res)\n    const parsed = parseBasicAuth(ctx.req)\n    if (!parsed) {\n      throw new AuthRequiredError()\n    }\n    const { username, password } = parsed\n    if (username !== 'admin' || password !== this._adminPass) {\n      throw new AuthRequiredError()\n    }\n\n    return { credentials: { type: 'admin_token' } }\n  }\n\n  public modService: MethodAuthVerifier<ModServiceOutput> = async (ctx) => {\n    setAuthHeaders(ctx.res)\n    if (!this.dids.modService) {\n      throw new AuthRequiredError('Untrusted issuer', 'UntrustedIss')\n    }\n    const payload = await this.verifyServiceJwt(ctx.req, {\n      iss: [this.dids.modService, `${this.dids.modService}#atproto_labeler`],\n    })\n    return {\n      credentials: {\n        type: 'mod_service',\n        did: payload.iss,\n      },\n    }\n  }\n\n  /** @deprecated We are steering away from {@link adminToken} auth. Use {@link modService} instead. */\n  public moderator: MethodAuthVerifier<AdminTokenOutput | ModServiceOutput> =\n    async (ctx) => {\n      const type = extractAuthType(ctx.req)\n      if (type === AuthType.BEARER) {\n        return this.modService(ctx)\n      } else {\n        return this.adminToken(ctx)\n      }\n    }\n\n  protected access<S extends AuthScope>(\n    options: VerifiedOptions & Required<ScopedOptions<S>>,\n  ): MethodAuthVerifier<AccessOutput<S>> {\n    const { scopes, ...statusOptions } = options\n\n    const verifyJwtOptions: VerifyBearerJwtOptions<S> = {\n      audience: this.dids.pds,\n      typ: 'at+jwt',\n      scopes:\n        // @NOTE We can reject taken down credentials based on the scope if\n        // \"checkTakedown\" is set.\n        statusOptions.checkTakedown && scopes.includes(AuthScope.Takendown as S)\n          ? scopes.filter((s) => s !== AuthScope.Takendown)\n          : scopes,\n    }\n\n    return async (ctx) => {\n      setAuthHeaders(ctx.res)\n\n      const { sub: did, scope } = await this.verifyBearerJwt(\n        ctx.req,\n        verifyJwtOptions,\n      )\n\n      await this.verifyStatus(did, statusOptions)\n\n      return {\n        credentials: { type: 'access', did, scope },\n      }\n    }\n  }\n\n  public refresh(options?: {\n    allowExpired?: boolean\n  }): MethodAuthVerifier<RefreshOutput> {\n    const verifyOptions: VerifyBearerJwtOptions<AuthScope.Refresh> = {\n      clockTolerance: options?.allowExpired ? Infinity : undefined,\n      typ: 'refresh+jwt',\n      // when using entryway, proxying refresh credentials\n      audience: this.dids.entryway ? this.dids.entryway : this.dids.pds,\n      scopes: [AuthScope.Refresh],\n    }\n\n    return async (ctx) => {\n      setAuthHeaders(ctx.res)\n\n      const result = await this.verifyBearerJwt(ctx.req, verifyOptions)\n\n      const tokenId = result.jti\n      if (!tokenId) {\n        throw new AuthRequiredError(\n          'Unexpected missing refresh token id',\n          'MissingTokenId',\n        )\n      }\n\n      return {\n        credentials: {\n          type: 'refresh',\n          did: result.sub,\n          scope: result.scope,\n          tokenId,\n        },\n      }\n    }\n  }\n\n  public authorization<P extends Params>({\n    scopes = ACCESS_STANDARD,\n    additional = [],\n    ...options\n  }: VerifiedOptions &\n    ScopedOptions &\n    ExtraScopedOptions &\n    AuthorizedOptions<P>): MethodAuthVerifier<AccessOutput | OAuthOutput, P> {\n    const access = this.access({\n      ...options,\n      scopes: [...scopes, ...additional],\n    })\n    const oauth = this.oauth(options)\n\n    return async (ctx) => {\n      const type = extractAuthType(ctx.req)\n\n      if (type === AuthType.BEARER) {\n        return access(ctx)\n      }\n\n      if (type === AuthType.DPOP) {\n        return oauth(ctx)\n      }\n\n      // Auth headers are set through the access and oauth methods so we only\n      // need to set them here if we reach this point\n      setAuthHeaders(ctx.res)\n\n      if (type !== null) {\n        throw new InvalidRequestError(\n          'Unexpected authorization type',\n          'InvalidToken',\n        )\n      }\n\n      throw new AuthRequiredError(undefined, 'AuthMissing')\n    }\n  }\n\n  public authorizationOrModService<P extends Params>(\n    opts: VerifiedOptions & ExtraScopedOptions & AuthorizedOptions<P>,\n  ): MethodAuthVerifier<AccessOutput | OAuthOutput | ModServiceOutput, P> {\n    const authorization = this.authorization(opts)\n    return async (ctx) => {\n      try {\n        return await this.modService(ctx)\n      } catch (err) {\n        if (err instanceof AuthRequiredError) {\n          return authorization(ctx)\n        }\n        throw err\n      }\n    }\n  }\n\n  public authorizationOrAdminTokenOptional<P extends Params>(\n    opts: VerifiedOptions & ExtraScopedOptions & AuthorizedOptions<P>,\n  ): MethodAuthVerifier<\n    OAuthOutput | AccessOutput | AdminTokenOutput | UnauthenticatedOutput,\n    P\n  > {\n    const authorization = this.authorization(opts)\n    return async (ctx) => {\n      const type = extractAuthType(ctx.req)\n      if (type === AuthType.BEARER || type === AuthType.DPOP) {\n        return authorization(ctx)\n      } else if (type === AuthType.BASIC) {\n        return this.adminToken(ctx)\n      } else {\n        return this.unauthenticated(ctx)\n      }\n    }\n  }\n\n  public userServiceAuth: MethodAuthVerifier<UserServiceAuthOutput> = async (\n    ctx,\n  ) => {\n    setAuthHeaders(ctx.res)\n    const payload = await this.verifyServiceJwt(ctx.req)\n    return {\n      credentials: {\n        type: 'user_service_auth',\n        did: payload.iss,\n      },\n    }\n  }\n\n  public userServiceAuthOptional: MethodAuthVerifier<\n    UserServiceAuthOutput | UnauthenticatedOutput\n  > = async (ctx) => {\n    const type = extractAuthType(ctx.req)\n    if (type === AuthType.BEARER) {\n      return await this.userServiceAuth(ctx)\n    } else {\n      return this.unauthenticated(ctx)\n    }\n  }\n\n  public authorizationOrUserServiceAuth<P extends Params>(\n    options: VerifiedOptions &\n      ScopedOptions &\n      ExtraScopedOptions &\n      AuthorizedOptions<P>,\n  ): MethodAuthVerifier<UserServiceAuthOutput | OAuthOutput | AccessOutput, P> {\n    const authorizationVerifier = this.authorization(options)\n    return async (ctx) => {\n      if (isDefinitelyServiceAuth(ctx.req)) {\n        return this.userServiceAuth(ctx)\n      } else {\n        return authorizationVerifier(ctx)\n      }\n    }\n  }\n\n  protected oauth<P extends Params>({\n    authorize,\n    ...verifyStatusOptions\n  }: VerifiedOptions & AuthorizedOptions<P>): MethodAuthVerifier<\n    OAuthOutput,\n    P\n  > {\n    const verifyTokenOptions: VerifyTokenPayloadOptions = {\n      audience: [this.dids.pds],\n      scope: ['atproto'],\n    }\n\n    return async (ctx) => {\n      setAuthHeaders(ctx.res)\n\n      const { req, res } = ctx\n\n      // https://datatracker.ietf.org/doc/html/rfc9449#section-8.2\n      const dpopNonce = this.oauthVerifier.nextDpopNonce()\n      if (dpopNonce) {\n        res.setHeader('DPoP-Nonce', dpopNonce)\n        res.appendHeader('Access-Control-Expose-Headers', 'DPoP-Nonce')\n      }\n\n      const originalUrl = req.originalUrl || req.url || '/'\n      const url = new URL(originalUrl, this._publicUrl)\n\n      const { scope, sub: did } = await this.oauthVerifier\n        .authenticateRequest(\n          req.method || 'GET',\n          url,\n          req.headers,\n          verifyTokenOptions,\n        )\n        .catch((err) => {\n          // Make sure to include any WWW-Authenticate header in the response\n          // (particularly useful for DPoP's \"use_dpop_nonce\" error)\n          if (err instanceof WWWAuthenticateError) {\n            res.setHeader('WWW-Authenticate', err.wwwAuthenticateHeader)\n            res.appendHeader(\n              'Access-Control-Expose-Headers',\n              'WWW-Authenticate',\n            )\n          }\n\n          if (err instanceof OAuthError) {\n            throw new XRPCError(err.status, err.error_description, err.error)\n          }\n\n          throw err\n        })\n\n      if (!isDidString(did)) {\n        throw new InvalidRequestError('Malformed token', 'InvalidToken')\n      }\n\n      await this.verifyStatus(did, verifyStatusOptions)\n\n      const permissions = new ScopePermissionsTransition(scope?.split(' '))\n\n      // Should never happen\n      if (!permissions.scopes.has('atproto')) {\n        throw new InvalidRequestError(\n          'OAuth token does not have \"atproto\" scope',\n          'InvalidToken',\n        )\n      }\n\n      await authorize(permissions, ctx)\n\n      return {\n        credentials: {\n          type: 'oauth',\n          did,\n          permissions,\n        },\n      }\n    }\n  }\n\n  protected async verifyStatus(\n    did: DidString,\n    options: VerifiedOptions,\n  ): Promise<void> {\n    if (options.checkDeactivated || options.checkTakedown) {\n      await this.findAccount(did, options)\n    }\n  }\n\n  /**\n   * Finds an account by its handle or DID, returning possibly deactivated or\n   * taken down accounts (unless `options.checkDeactivated` or\n   * `options.checkTakedown` are set to true, respectively).\n   */\n  public async findAccount(\n    handleOrDid: AtIdentifierString,\n    options: VerifiedOptions,\n  ): Promise<ActorAccount> {\n    const account = await this.accountManager.getAccount(handleOrDid, {\n      includeDeactivated: true,\n      includeTakenDown: true,\n    })\n    if (!account) {\n      // will be turned into ExpiredToken for the client if proxied by entryway\n      throw new ForbiddenError('Account not found', 'AccountNotFound')\n    }\n    if (options.checkTakedown && softDeleted(account)) {\n      throw new AuthRequiredError(\n        'Account has been taken down',\n        'AccountTakedown',\n      )\n    }\n    if (options.checkDeactivated && account.deactivatedAt) {\n      throw new AuthRequiredError(\n        'Account is deactivated',\n        'AccountDeactivated',\n      )\n    }\n    return account\n  }\n\n  /**\n   * Wraps {@link jose.jwtVerify} into a function that also validates the token\n   * payload's type and wraps errors into {@link InvalidRequestError}.\n   */\n  protected async verifyBearerJwt<S extends AuthScope = AuthScope>(\n    req: IncomingMessage,\n    { scopes, ...options }: VerifyBearerJwtOptions<S>,\n  ): Promise<VerifyBearerJwtResult<S>> {\n    const token = bearerTokenFromReq(req)\n    if (!token) {\n      throw new AuthRequiredError(undefined, 'AuthMissing')\n    }\n\n    const { payload } = await jose\n      .jwtVerify(token, this._jwtKey, options)\n      .catch((cause) => {\n        if (cause instanceof jose.errors.JWTExpired) {\n          throw new InvalidRequestError('Token has expired', 'ExpiredToken', {\n            cause,\n          })\n        } else {\n          throw new InvalidRequestError(\n            'Token could not be verified',\n            'InvalidToken',\n            { cause },\n          )\n        }\n      })\n\n    const { sub, aud, scope, lxm, cnf, jti } = payload\n\n    if (typeof lxm !== 'undefined') {\n      // Service auth tokens should never make it to here. But since service\n      // auth tokens do not have a \"typ\" header, the \"typ\" check above will not\n      // catch them. This check here is mainly to protect against the\n      // hypothetical case in which a PDS would issue service auth tokens using\n      // its private key.\n      throw new InvalidRequestError('Malformed token', 'InvalidToken')\n    }\n    if (typeof cnf !== 'undefined') {\n      // Proof-of-Possession (PoP) tokens are not allowed here\n      // https://www.rfc-editor.org/rfc/rfc7800.html\n      throw new InvalidRequestError('Malformed token', 'InvalidToken')\n    }\n    if (typeof sub !== 'string' || !isDidString(sub)) {\n      throw new InvalidRequestError('Malformed token', 'InvalidToken')\n    }\n    if (typeof aud !== 'string' || !aud.startsWith('did:')) {\n      throw new InvalidRequestError('Malformed token', 'InvalidToken')\n    }\n    if (typeof jti !== 'string' && typeof jti !== 'undefined') {\n      throw new InvalidRequestError('Malformed token', 'InvalidToken')\n    }\n    if (!isAuthScope(scope) || !scopes.includes(scope as any)) {\n      throw new InvalidRequestError('Bad token scope', 'InvalidToken')\n    }\n\n    return { sub, aud, jti, scope: scope as S }\n  }\n\n  protected async verifyServiceJwt(\n    req: IncomingMessage,\n    opts?: { iss?: string[] },\n  ) {\n    const jwtStr = bearerTokenFromReq(req)\n    if (!jwtStr) {\n      throw new AuthRequiredError('missing jwt', 'MissingJwt')\n    }\n\n    const nsid = parseReqNsid(req)\n    const payload = await verifyServiceJwt(\n      jwtStr,\n      null,\n      nsid,\n      async (iss, forceRefresh) => {\n        if (opts?.iss && !opts.iss.includes(iss)) {\n          throw new AuthRequiredError('Untrusted issuer', 'UntrustedIss')\n        }\n        const [did, serviceId] = iss.split('#')\n        const keyId =\n          serviceId === 'atproto_labeler' ? 'atproto_label' : 'atproto'\n        const didDoc = await this.idResolver.did.resolve(did, forceRefresh)\n        if (!didDoc) {\n          throw new AuthRequiredError('could not resolve iss did')\n        }\n        const parsedKey = getVerificationMaterial(didDoc, keyId)\n        if (!parsedKey) {\n          throw new AuthRequiredError('missing or bad key in did doc')\n        }\n        const didKey = getDidKeyFromMultibase(parsedKey)\n        if (!didKey) {\n          throw new AuthRequiredError('missing or bad key in did doc')\n        }\n        return didKey\n      },\n    )\n    if (\n      payload.aud !== this.dids.pds &&\n      (!this.dids.entryway || payload.aud !== this.dids.entryway)\n    ) {\n      throw new AuthRequiredError(\n        'jwt audience does not match service did',\n        'BadJwtAudience',\n      )\n    }\n    return payload\n  }\n}\n\n// HELPERS\n// ---------\n\nexport function isUserOrAdmin(\n  auth: AccessOutput | OAuthOutput | AdminTokenOutput | UnauthenticatedOutput,\n  did: string,\n): boolean {\n  if (!auth.credentials) {\n    return false\n  } else if (auth.credentials.type === 'admin_token') {\n    return true\n  } else {\n    return auth.credentials.did === did\n  }\n}\n\nenum AuthType {\n  BASIC = 'Basic',\n  BEARER = 'Bearer',\n  DPOP = 'DPoP',\n}\n\nconst parseAuthorizationHeader = (\n  req: IncomingMessage,\n): [type: null] | [type: AuthType, token: string] => {\n  const authorization = req.headers['authorization']\n  if (!authorization) return [null]\n\n  const result = authorization.split(' ')\n  if (result.length !== 2) {\n    throw new InvalidRequestError(\n      'Malformed authorization header',\n      'InvalidToken',\n    )\n  }\n\n  // authorization type is case-insensitive\n  const authType = result[0].toUpperCase()\n\n  const type = Object.hasOwn(AuthType, authType) ? AuthType[authType] : null\n  if (type) return [type, result[1]]\n\n  throw new InvalidRequestError(\n    `Unsupported authorization type: ${result[0]}`,\n    'InvalidToken',\n  )\n}\n\n/**\n * @note Not all service auth tokens are guaranteed to have \"lxm\" claim, so this\n * function should not be used to verify service auth tokens. It is only used to\n * check if a token is definitely a service auth token.\n */\nconst isDefinitelyServiceAuth = (req: IncomingMessage): boolean => {\n  const token = bearerTokenFromReq(req)\n  if (!token) return false\n  const payload = jose.decodeJwt(token)\n  return payload['lxm'] != null\n}\n\nconst extractAuthType = (req: IncomingMessage): AuthType | null => {\n  const [type] = parseAuthorizationHeader(req)\n  return type\n}\n\nexport const bearerTokenFromReq = (req: IncomingMessage) => {\n  const [type, token] = parseAuthorizationHeader(req)\n  return type === AuthType.BEARER ? token : null\n}\n\nconst parseBasicAuth = (\n  req: IncomingMessage,\n): { username: string; password: string } | null => {\n  try {\n    const [type, b64] = parseAuthorizationHeader(req)\n    if (type !== AuthType.BASIC) return null\n    const decoded = Buffer.from(b64, 'base64').toString('utf8')\n    // We must not use split(':') because the password can contain colons\n    const colon = decoded.indexOf(':')\n    if (colon === -1) return null\n    const username = decoded.slice(0, colon)\n    const password = decoded.slice(colon + 1)\n    return { username, password }\n  } catch (err) {\n    return null\n  }\n}\n\nexport { type KeyObject }\n\nexport const createSecretKeyObject = (secret: string): KeyObject => {\n  return createSecretKey(Buffer.from(secret))\n}\n\nexport const createPublicKeyObject = (publicKeyHex: string): KeyObject => {\n  // accepts compressed or uncompressed keys; validates the point is on-curve\n  const point =\n    secp256k1.ProjectivePoint.fromHex(publicKeyHex).toRawBytes(false)\n  return createPublicKey({\n    format: 'jwk',\n    key: {\n      kty: 'EC',\n      crv: 'secp256k1',\n      x: Buffer.from(point.subarray(1, 33)).toString('base64url'),\n      y: Buffer.from(point.subarray(33, 65)).toString('base64url'),\n    },\n  })\n}\n\nfunction setAuthHeaders(res: ServerResponse) {\n  res.setHeader('Cache-Control', 'private')\n  appendVary(res, 'Authorization')\n}\n"]}
+{"version":3,"file":"auth-verifier.js","sourceRoot":"","sources":["../src/auth-verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,eAAe,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAE9E,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AACnD,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAC5B,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAA;AACzD,OAAO,EAAmB,sBAAsB,EAAE,MAAM,mBAAmB,CAAA;AAC3E,OAAO,EAGL,WAAW,GACZ,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,UAAU,EACV,oBAAoB,GACrB,MAAM,gCAAgC,CAAA;AAKvC,OAAO,EAEL,0BAA0B,GAC3B,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,iBAAiB,EAEjB,cAAc,EACd,mBAAmB,EAInB,SAAS,EACT,YAAY,EACZ,SAAS,IAAI,gBAAgB,GAC9B,MAAM,sBAAsB,CAAA;AAa7B,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAuC3C,MAAM,qCAAqC,GAAG,CAAC,GAAG,EAAE,CAAA;AACpD,MAAM,wCAAwC,GAAG,EAAE,CAAA;AAiBnD,MAAM,OAAO,YAAY;IAOvB,YACS,cAA8B,EAC9B,UAAsB,EACtB,aAA4B,EACnC,IAAsB;QAHf,mBAAc,GAAd,cAAc,CAAgB;QAC9B,eAAU,GAAV,UAAU,CAAY;QACtB,kBAAa,GAAb,aAAa,CAAe;QAUrC,0CAA0C;QAEnC,oBAAe,GAA8C,CAAC,GAAG,EAAE,EAAE;YAC1E,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAEvB,0EAA0E;YAC1E,2EAA2E;YAC3E,2EAA2E;YAC3E,uBAAuB;YACvB,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;gBACrC,MAAM,IAAI,iBAAiB,CAAC,8BAA8B,CAAC,CAAA;YAC7D,CAAC;YAED,OAAO;gBACL,WAAW,EAAE,IAAI;aAClB,CAAA;QACH,CAAC,CAAA;QAED,6DAA6D;QACtD,eAAU,GAAyC,KAAK,EAAE,GAAG,EAAE,EAAE;YACtE,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACvB,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACtC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,iBAAiB,EAAE,CAAA;YAC/B,CAAC;YACD,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAA;YACrC,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;gBACzD,MAAM,IAAI,iBAAiB,EAAE,CAAA;YAC/B,CAAC;YAED,OAAO,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,CAAA;QACjD,CAAC,CAAA;QAEM,eAAU,GAAyC,KAAK,EAAE,GAAG,EAAE,EAAE;YACtE,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACvB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;gBAC1B,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAA;YACjE,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE;gBACnD,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,kBAAkB,CAAC;aACvE,CAAC,CAAA;YACF,OAAO;gBACL,WAAW,EAAE;oBACX,IAAI,EAAE,aAAa;oBACnB,GAAG,EAAE,OAAO,CAAC,GAAG;iBACjB;aACF,CAAA;QACH,CAAC,CAAA;QAED,qGAAqG;QAC9F,cAAS,GACd,KAAK,EAAE,GAAG,EAAE,EAAE;YACZ,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACrC,IAAI,IAAI,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAC7B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;YAC7B,CAAC;iBAAM,CAAC;gBACN,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;YAC7B,CAAC;QACH,CAAC,CAAA;QAEI,oBAAe,GAA8C,KAAK,EACvE,GAAG,EACH,EAAE;YACF,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACvB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAC5D,OAAO;gBACL,WAAW,EAAE;oBACX,IAAI,EAAE,kBAAkB;oBACxB,GAAG,EAAE,OAAO,CAAC,GAAG;iBACjB;aACF,CAAA;QACH,CAAC,CAAA;QAEM,4BAAuB,GAE1B,KAAK,EAAE,GAAG,EAAE,EAAE;YAChB,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACjD,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;YAClC,CAAC;YACD,IAAI,CAAC,oCAAoC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAClD,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;QAClC,CAAC,CAAA;QAEM,gCAA2B,GAE9B,KAAK,EAAE,GAAG,EAAE,EAAE;YAChB,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC;gBAC/B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;YAC7B,CAAC;YACD,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACjD,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;YAClC,CAAC;YACD,IAAI,CAAC,oCAAoC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAClD,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;QAC7B,CAAC,CAAA;QAEM,+BAA0B,GAE7B,KAAK,EAAE,GAAG,EAAE,EAAE;YAChB,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACjD,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC;oBACtC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC;oBAC3B,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;YAC1B,CAAC;YACD,IAAI,CAAC,oCAAoC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAClD,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;QAC7B,CAAC,CAAA;QAgJM,oBAAe,GAA8C,KAAK,EACvE,GAAG,EACH,EAAE;YACF,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACvB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACpD,OAAO;gBACL,WAAW,EAAE;oBACX,IAAI,EAAE,mBAAmB;oBACzB,GAAG,EAAE,OAAO,CAAC,GAAG;iBACjB;aACF,CAAA;QACH,CAAC,CAAA;QAEM,4BAAuB,GAE1B,KAAK,EAAE,GAAG,EAAE,EAAE;YAChB,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACrC,IAAI,IAAI,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAC7B,OAAO,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;YACxC,CAAC;iBAAM,CAAC;gBACN,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;YAClC,CAAC;QACH,CAAC,CAAA;QAvRC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAA;QAChC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,MAAM,CAAA;QAC1B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAA;QAChC,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC,mBAAmB,CAAA;QACpD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;IACvB,CAAC;IA8GS,MAAM,CACd,OAAqD;QAErD,MAAM,EAAE,MAAM,EAAE,GAAG,aAAa,EAAE,GAAG,OAAO,CAAA;QAE5C,MAAM,gBAAgB,GAA8B;YAClD,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG;YACvB,GAAG,EAAE,QAAQ;YACb,MAAM;YACJ,mEAAmE;YACnE,0BAA0B;YAC1B,aAAa,CAAC,aAAa,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAc,CAAC;gBACtE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,SAAS,CAAC;gBACjD,CAAC,CAAC,MAAM;SACb,CAAA;QAED,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAEvB,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CACpD,GAAG,CAAC,GAAG,EACP,gBAAgB,CACjB,CAAA;YAED,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;YAE3C,OAAO;gBACL,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE;aAC5C,CAAA;QACH,CAAC,CAAA;IACH,CAAC;IAEM,OAAO,CAAC,OAEd;QACC,MAAM,aAAa,GAA8C;YAC/D,cAAc,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;YAC5D,GAAG,EAAE,aAAa;YAClB,oDAAoD;YACpD,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YACjE,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC;SAC5B,CAAA;QAED,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;YAEjE,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAA;YAC1B,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,iBAAiB,CACzB,qCAAqC,EACrC,gBAAgB,CACjB,CAAA;YACH,CAAC;YAED,OAAO;gBACL,WAAW,EAAE;oBACX,IAAI,EAAE,SAAS;oBACf,GAAG,EAAE,MAAM,CAAC,GAAG;oBACf,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,OAAO;iBACR;aACF,CAAA;QACH,CAAC,CAAA;IACH,CAAC;IAEM,aAAa,CAAmB,EACrC,MAAM,GAAG,eAAe,EACxB,UAAU,GAAG,EAAE,EACf,GAAG,OAAO,EAIU;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YACzB,GAAG,OAAO;YACV,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,UAAU,CAAC;SACnC,CAAC,CAAA;QACF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAEjC,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAErC,IAAI,IAAI,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAC7B,OAAO,MAAM,CAAC,GAAG,CAAC,CAAA;YACpB,CAAC;YAED,IAAI,IAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAC3B,OAAO,KAAK,CAAC,GAAG,CAAC,CAAA;YACnB,CAAC;YAED,uEAAuE;YACvE,+CAA+C;YAC/C,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAEvB,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,mBAAmB,CAC3B,+BAA+B,EAC/B,cAAc,CACf,CAAA;YACH,CAAC;YAED,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAA;QACvD,CAAC,CAAA;IACH,CAAC;IAEM,yBAAyB,CAC9B,IAAiE;QAEjE,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;QAC9C,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;YACnC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;oBACrC,OAAO,aAAa,CAAC,GAAG,CAAC,CAAA;gBAC3B,CAAC;gBACD,MAAM,GAAG,CAAA;YACX,CAAC;QACH,CAAC,CAAA;IACH,CAAC;IAEM,iCAAiC,CACtC,IAAiE;QAKjE,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;QAC9C,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACrC,IAAI,IAAI,KAAK,QAAQ,CAAC,MAAM,IAAI,IAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACvD,OAAO,aAAa,CAAC,GAAG,CAAC,CAAA;YAC3B,CAAC;iBAAM,IAAI,IAAI,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACnC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;YAC7B,CAAC;iBAAM,CAAC;gBACN,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;YAClC,CAAC;QACH,CAAC,CAAA;IACH,CAAC;IA0BM,8BAA8B,CACnC,OAGsB;QAEtB,MAAM,qBAAqB,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;QACzD,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,IAAI,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACrC,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;YAClC,CAAC;iBAAM,CAAC;gBACN,OAAO,qBAAqB,CAAC,GAAG,CAAC,CAAA;YACnC,CAAC;QACH,CAAC,CAAA;IACH,CAAC;IAES,KAAK,CAAmB,EAChC,SAAS,EACT,GAAG,mBAAmB,EACiB;QAIvC,MAAM,kBAAkB,GAA8B;YACpD,QAAQ,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;YACzB,KAAK,EAAE,CAAC,SAAS,CAAC;SACnB,CAAA;QAED,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAEvB,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,CAAA;YAExB,4DAA4D;YAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,CAAA;YACpD,IAAI,SAAS,EAAE,CAAC;gBACd,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,SAAS,CAAC,CAAA;gBACtC,GAAG,CAAC,YAAY,CAAC,+BAA+B,EAAE,YAAY,CAAC,CAAA;YACjE,CAAC;YAED,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAA;YACrD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;YAEjD,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa;iBACjD,mBAAmB,CAClB,GAAG,CAAC,MAAM,IAAI,KAAK,EACnB,GAAG,EACH,GAAG,CAAC,OAAO,EACX,kBAAkB,CACnB;iBACA,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACb,mEAAmE;gBACnE,0DAA0D;gBAC1D,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;oBACxC,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,GAAG,CAAC,qBAAqB,CAAC,CAAA;oBAC5D,GAAG,CAAC,YAAY,CACd,+BAA+B,EAC/B,kBAAkB,CACnB,CAAA;gBACH,CAAC;gBAED,IAAI,GAAG,YAAY,UAAU,EAAE,CAAC;oBAC9B,MAAM,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,iBAAiB,EAAE,GAAG,CAAC,KAAK,CAAC,CAAA;gBACnE,CAAC;gBAED,MAAM,GAAG,CAAA;YACX,CAAC,CAAC,CAAA;YAEJ,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;YAClE,CAAC;YAED,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAA;YAEjD,MAAM,WAAW,GAAG,IAAI,0BAA0B,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;YAErE,sBAAsB;YACtB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBACvC,MAAM,IAAI,mBAAmB,CAC3B,2CAA2C,EAC3C,cAAc,CACf,CAAA;YACH,CAAC;YAED,MAAM,SAAS,CAAC,WAAW,EAAE,GAAG,CAAC,CAAA;YAEjC,OAAO;gBACL,WAAW,EAAE;oBACX,IAAI,EAAE,OAAO;oBACb,GAAG;oBACH,WAAW;iBACZ;aACF,CAAA;QACH,CAAC,CAAA;IACH,CAAC;IAES,KAAK,CAAC,YAAY,CAC1B,GAAc,EACd,OAAwB;QAExB,IAAI,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YACtD,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;QACtC,CAAC;IACH,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,WAAW,CACtB,WAA+B,EAC/B,OAAwB;QAExB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,WAAW,EAAE;YAChE,kBAAkB,EAAE,IAAI;YACxB,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAA;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,yEAAyE;YACzE,MAAM,IAAI,cAAc,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,OAAO,CAAC,aAAa,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,iBAAiB,CACzB,6BAA6B,EAC7B,iBAAiB,CAClB,CAAA;QACH,CAAC;QACD,IAAI,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YACtD,MAAM,IAAI,iBAAiB,CACzB,wBAAwB,EACxB,oBAAoB,CACrB,CAAA;QACH,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;IAED;;;OAGG;IACO,KAAK,CAAC,eAAe,CAC7B,GAAoB,EACpB,EAAE,MAAM,EAAE,GAAG,OAAO,EAA6B;QAEjD,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;QACrC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAA;QACvD,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI;aAC3B,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;aACvC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACf,IAAI,KAAK,YAAY,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;gBAC5C,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,EAAE,cAAc,EAAE;oBACjE,KAAK;iBACN,CAAC,CAAA;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,mBAAmB,CAC3B,6BAA6B,EAC7B,cAAc,EACd,EAAE,KAAK,EAAE,CACV,CAAA;YACH,CAAC;QACH,CAAC,CAAC,CAAA;QAEJ,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,OAAO,CAAA;QAElD,IAAI,OAAO,GAAG,KAAK,WAAW,EAAE,CAAC;YAC/B,sEAAsE;YACtE,yEAAyE;YACzE,+DAA+D;YAC/D,yEAAyE;YACzE,mBAAmB;YACnB,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,WAAW,EAAE,CAAC;YAC/B,wDAAwD;YACxD,8CAA8C;YAC9C,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,WAAW,EAAE,CAAC;YAC1D,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAY,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QAED,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,KAAU,EAAE,CAAA;IAC7C,CAAC;IAES,KAAK,CAAC,gBAAgB,CAC9B,GAAoB,EACpB,IAAyB;QAEzB,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,iBAAiB,CAAC,aAAa,EAAE,YAAY,CAAC,CAAA;QAC1D,CAAC;QAED,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;QAC9B,MAAM,OAAO,GAAG,MAAM,gBAAgB,CACpC,MAAM,EACN,IAAI,EACJ,IAAI,EACJ,KAAK,EAAE,GAAG,EAAE,YAAY,EAAE,EAAE;YAC1B,IAAI,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAA;YACjE,CAAC;YACD,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YACvC,MAAM,KAAK,GACT,SAAS,KAAK,iBAAiB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAA;YAC/D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;YACnE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,iBAAiB,CAAC,2BAA2B,CAAC,CAAA;YAC1D,CAAC;YACD,MAAM,SAAS,GAAG,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;YACxD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,iBAAiB,CAAC,+BAA+B,CAAC,CAAA;YAC9D,CAAC;YACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAA;YAChD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,iBAAiB,CAAC,+BAA+B,CAAC,CAAA;YAC9D,CAAC;YACD,OAAO,MAAM,CAAA;QACf,CAAC,CACF,CAAA;QACD,IACE,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG;YAC7B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAC3D,CAAC;YACD,MAAM,IAAI,iBAAiB,CACzB,yCAAyC,EACzC,gBAAgB,CACjB,CAAA;QACH,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;IAES,KAAK,CAAC,wBAAwB,CAAC,GAAoB;QAC3D,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAA;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,oBAAoB,EAAE,MAAM,CAAA;QAChD,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,EAAE,CAAC;YAC5B,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAA;QACjE,CAAC;QAED,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,iBAAiB,CAAC,aAAa,EAAE,YAAY,CAAC,CAAA;QAC1D,CAAC;QAED,yEAAyE;QACzE,sEAAsE;QACtE,uDAAuD;QACvD,MAAM,OAAO,GAAG,MAAM,gBAAgB,CACpC,MAAM,EACN,IAAI,CAAC,IAAI,CAAC,GAAG,EACb,YAAY,CAAC,GAAG,CAAC,EACjB,KAAK,EAAE,GAAG,EAAE,EAAE;YACZ,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;gBACxB,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAA;YACjE,CAAC;YACD,OAAO,MAAM,CAAA;QACf,CAAC,CACF,CAAA;QAED,2EAA2E;QAC3E,qEAAqE;QACrE,8CAA8C;QAC9C,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAA;QACvD,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YACrB,MAAM,IAAI,iBAAiB,CAAC,0BAA0B,GAAG,GAAG,EAAE,WAAW,CAAC,CAAA;QAC5E,CAAC;QACD,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;YAClB,MAAM,IAAI,iBAAiB,CAAC,qBAAqB,GAAG,GAAG,EAAE,YAAY,CAAC,CAAA;QACxE,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;QACtC,IACE,OAAO,GAAG,KAAK,QAAQ;YACvB,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,wCAAwC,EAClE,CAAC;YACD,MAAM,IAAI,iBAAiB,CAAC,+BAA+B,EAAE,WAAW,CAAC,CAAA;QAC3E,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,GAAG,GAAG,GAAG,qCAAqC,EAAE,CAAC;YAC9D,MAAM,IAAI,iBAAiB,CAAC,0BAA0B,EAAE,gBAAgB,CAAC,CAAA;QAC3E,CAAC;QAED,OAAO,OAAO,CAAA;IAChB,CAAC;IAES,mBAAmB,CAAC,GAAoB;QAChD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,oBAAoB;YAAE,OAAO,KAAK,CAAA;QACnE,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;QACrC,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAA;QACxB,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAA;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,gEAAgE;YAChE,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAES,oCAAoC,CAAC,GAAmB;QAChE,IAAI,IAAI,CAAC,oBAAoB,EAAE,QAAQ,EAAE,CAAC;YACxC,cAAc,CAAC,GAAG,CAAC,CAAA;YACnB,MAAM,IAAI,iBAAiB,CAAC,gCAAgC,CAAC,CAAA;QAC/D,CAAC;IACH,CAAC;CACF;AAED,UAAU;AACV,YAAY;AAEZ,MAAM,UAAU,aAAa,CAC3B,IAA2E,EAC3E,GAAW;IAEX,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACtB,OAAO,KAAK,CAAA;IACd,CAAC;SAAM,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACnD,OAAO,IAAI,CAAA;IACb,CAAC;SAAM,CAAC;QACN,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,KAAK,GAAG,CAAA;IACrC,CAAC;AACH,CAAC;AAED,IAAK,QAIJ;AAJD,WAAK,QAAQ;IACX,2BAAe,CAAA;IACf,6BAAiB,CAAA;IACjB,yBAAa,CAAA;AACf,CAAC,EAJI,QAAQ,KAAR,QAAQ,QAIZ;AAED,MAAM,wBAAwB,GAAG,CAC/B,GAAoB,EAC4B,EAAE;IAClD,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAA;IAClD,IAAI,CAAC,aAAa;QAAE,OAAO,CAAC,IAAI,CAAC,CAAA;IAEjC,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACvC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,mBAAmB,CAC3B,gCAAgC,EAChC,cAAc,CACf,CAAA;IACH,CAAC;IAED,yCAAyC;IACzC,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;IAExC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC1E,IAAI,IAAI;QAAE,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;IAElC,MAAM,IAAI,mBAAmB,CAC3B,mCAAmC,MAAM,CAAC,CAAC,CAAC,EAAE,EAC9C,cAAc,CACf,CAAA;AACH,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,uBAAuB,GAAG,CAAC,GAAoB,EAAW,EAAE;IAChE,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;IACrC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAA;IACxB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IACrC,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,CAAA;AAC/B,CAAC,CAAA;AAED,MAAM,eAAe,GAAG,CAAC,GAAoB,EAAmB,EAAE;IAChE,MAAM,CAAC,IAAI,CAAC,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAA;IAC5C,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAoB,EAAE,EAAE;IACzD,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAA;IACnD,OAAO,IAAI,KAAK,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;AAChD,CAAC,CAAA;AAED,MAAM,cAAc,GAAG,CACrB,GAAoB,EAC2B,EAAE;IACjD,IAAI,CAAC;QACH,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAA;QACjD,IAAI,IAAI,KAAK,QAAQ,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QACxC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QAC3D,qEAAqE;QACrE,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAClC,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAA;QAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;QACzC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAA;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC,CAAA;AAED,OAAO,EAAkB,CAAA;AAEzB,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,MAAc,EAAa,EAAE;IACjE,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA;AAC7C,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,YAAoB,EAAa,EAAE;IACvE,2EAA2E;IAC3E,MAAM,KAAK,GACT,SAAS,CAAC,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;IACnE,OAAO,eAAe,CAAC;QACrB,MAAM,EAAE,KAAK;QACb,GAAG,EAAE;YACH,GAAG,EAAE,IAAI;YACT,GAAG,EAAE,WAAW;YAChB,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;YAC3D,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;SAC7D;KACF,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,SAAS,cAAc,CAAC,GAAmB;IACzC,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,SAAS,CAAC,CAAA;IACzC,UAAU,CAAC,GAAG,EAAE,eAAe,CAAC,CAAA;AAClC,CAAC","sourcesContent":["import { type KeyObject, createPublicKey, createSecretKey } from 'node:crypto'\nimport type { IncomingMessage, ServerResponse } from 'node:http'\nimport { secp256k1 } from '@noble/curves/secp256k1'\nimport * as jose from 'jose'\nimport { getVerificationMaterial } from '@atproto/common'\nimport { type IdResolver, getDidKeyFromMultibase } from '@atproto/identity'\nimport {\n  type AtIdentifierString,\n  type DidString,\n  isDidString,\n} from '@atproto/lex-schema'\nimport {\n  OAuthError,\n  WWWAuthenticateError,\n} from '@atproto/oauth-provider/errors'\nimport type {\n  OAuthVerifier,\n  VerifyTokenPayloadOptions,\n} from '@atproto/oauth-provider/verifier'\nimport {\n  type ScopePermissions,\n  ScopePermissionsTransition,\n} from '@atproto/oauth-scopes'\nimport {\n  AuthRequiredError,\n  type Awaitable,\n  ForbiddenError,\n  InvalidRequestError,\n  type MethodAuthContext,\n  type MethodAuthVerifier,\n  type Params,\n  XRPCError,\n  parseReqNsid,\n  verifyJwt as verifyServiceJwt,\n} from '@atproto/xrpc-server'\nimport type { AccountManager } from './account-manager/account-manager.js'\nimport type { ActorAccount } from './account-manager/helpers/account.js'\nimport type {\n  AccessOutput,\n  AdminTokenOutput,\n  EntrywayServiceOutput,\n  ModServiceOutput,\n  OAuthOutput,\n  RefreshOutput,\n  UnauthenticatedOutput,\n  UserServiceAuthOutput,\n} from './auth-output.js'\nimport { ACCESS_STANDARD, AuthScope, isAuthScope } from './auth-scope.js'\nimport { softDeleted } from './db/index.js'\nimport { appendVary } from './util/http.js'\nimport type { WithRequired } from './util/types.js'\n\nexport type VerifiedOptions = {\n  checkTakedown?: boolean\n  checkDeactivated?: boolean\n}\n\nexport type ScopedOptions<S extends AuthScope = AuthScope> = {\n  scopes?: readonly S[]\n}\n\nexport type ExtraScopedOptions<S extends AuthScope = AuthScope> = {\n  additional?: readonly S[]\n}\n\nexport type AuthorizedOptions<P extends Params = Params> = {\n  authorize: (\n    permissions: ScopePermissions,\n    ctx: MethodAuthContext<P>,\n  ) => Awaitable<void>\n}\n\nexport type AuthVerifierOpts = {\n  publicUrl: string\n  jwtKey: KeyObject\n  adminPass: string\n  dids: {\n    pds: string\n    entryway?: string\n    modService?: string\n  }\n  entrywayServiceAuth?: {\n    /** did:key form of the entryway's JWT verify key */\n    didKey: string\n    required: boolean\n  }\n}\n\nconst ENTRYWAY_SERVICE_JWT_MAX_LIFETIME_SEC = 5 * 60\nconst ENTRYWAY_SERVICE_JWT_CLOCK_TOLERANCE_SEC = 30\n\nexport type VerifyBearerJwtOptions<S extends AuthScope = AuthScope> =\n  WithRequired<\n    Omit<jose.JWTVerifyOptions, 'scopes'> & {\n      scopes: readonly S[]\n    },\n    'audience' | 'typ'\n  >\n\nexport type VerifyBearerJwtResult<S extends AuthScope = AuthScope> = {\n  sub: DidString\n  aud: string\n  jti: string | undefined\n  scope: S\n}\n\nexport class AuthVerifier {\n  private _publicUrl: string\n  private _jwtKey: KeyObject\n  private _adminPass: string\n  private _entrywayServiceAuth: AuthVerifierOpts['entrywayServiceAuth']\n  public dids: AuthVerifierOpts['dids']\n\n  constructor(\n    public accountManager: AccountManager,\n    public idResolver: IdResolver,\n    public oauthVerifier: OAuthVerifier,\n    opts: AuthVerifierOpts,\n  ) {\n    this._publicUrl = opts.publicUrl\n    this._jwtKey = opts.jwtKey\n    this._adminPass = opts.adminPass\n    this._entrywayServiceAuth = opts.entrywayServiceAuth\n    this.dids = opts.dids\n  }\n\n  // verifiers (arrow fns to preserve scope)\n\n  public unauthenticated: MethodAuthVerifier<UnauthenticatedOutput> = (ctx) => {\n    setAuthHeaders(ctx.res)\n\n    // @NOTE this auth method is typically used as fallback when no other auth\n    // method is applicable. This means that the presence of an \"authorization\"\n    // header means that that header is invalid (as it did not match any of the\n    // other auth methods).\n    if (ctx.req.headers['authorization']) {\n      throw new AuthRequiredError('Invalid authorization header')\n    }\n\n    return {\n      credentials: null,\n    }\n  }\n\n  /** @deprecated We are steering away from this auth method */\n  public adminToken: MethodAuthVerifier<AdminTokenOutput> = async (ctx) => {\n    setAuthHeaders(ctx.res)\n    const parsed = parseBasicAuth(ctx.req)\n    if (!parsed) {\n      throw new AuthRequiredError()\n    }\n    const { username, password } = parsed\n    if (username !== 'admin' || password !== this._adminPass) {\n      throw new AuthRequiredError()\n    }\n\n    return { credentials: { type: 'admin_token' } }\n  }\n\n  public modService: MethodAuthVerifier<ModServiceOutput> = async (ctx) => {\n    setAuthHeaders(ctx.res)\n    if (!this.dids.modService) {\n      throw new AuthRequiredError('Untrusted issuer', 'UntrustedIss')\n    }\n    const payload = await this.verifyServiceJwt(ctx.req, {\n      iss: [this.dids.modService, `${this.dids.modService}#atproto_labeler`],\n    })\n    return {\n      credentials: {\n        type: 'mod_service',\n        did: payload.iss,\n      },\n    }\n  }\n\n  /** @deprecated We are steering away from {@link adminToken} auth. Use {@link modService} instead. */\n  public moderator: MethodAuthVerifier<AdminTokenOutput | ModServiceOutput> =\n    async (ctx) => {\n      const type = extractAuthType(ctx.req)\n      if (type === AuthType.BEARER) {\n        return this.modService(ctx)\n      } else {\n        return this.adminToken(ctx)\n      }\n    }\n\n  public entrywayService: MethodAuthVerifier<EntrywayServiceOutput> = async (\n    ctx,\n  ) => {\n    setAuthHeaders(ctx.res)\n    const payload = await this.verifyEntrywayServiceJwt(ctx.req)\n    return {\n      credentials: {\n        type: 'entryway_service',\n        did: payload.iss,\n      },\n    }\n  }\n\n  public entrywayServiceOptional: MethodAuthVerifier<\n    EntrywayServiceOutput | UnauthenticatedOutput\n  > = async (ctx) => {\n    if (extractAuthType(ctx.req) === AuthType.BEARER) {\n      return this.entrywayService(ctx)\n    }\n    this.assertEntrywayServiceAuthNotRequired(ctx.res)\n    return this.unauthenticated(ctx)\n  }\n\n  public adminTokenOrEntrywayService: MethodAuthVerifier<\n    AdminTokenOutput | EntrywayServiceOutput\n  > = async (ctx) => {\n    if (!this._entrywayServiceAuth) {\n      return this.adminToken(ctx)\n    }\n    if (extractAuthType(ctx.req) === AuthType.BEARER) {\n      return this.entrywayService(ctx)\n    }\n    this.assertEntrywayServiceAuthNotRequired(ctx.res)\n    return this.adminToken(ctx)\n  }\n\n  public moderatorOrEntrywayService: MethodAuthVerifier<\n    AdminTokenOutput | ModServiceOutput | EntrywayServiceOutput\n  > = async (ctx) => {\n    if (extractAuthType(ctx.req) === AuthType.BEARER) {\n      return this.isEntrywayIssuedJwt(ctx.req)\n        ? this.entrywayService(ctx)\n        : this.modService(ctx)\n    }\n    this.assertEntrywayServiceAuthNotRequired(ctx.res)\n    return this.adminToken(ctx)\n  }\n\n  protected access<S extends AuthScope>(\n    options: VerifiedOptions & Required<ScopedOptions<S>>,\n  ): MethodAuthVerifier<AccessOutput<S>> {\n    const { scopes, ...statusOptions } = options\n\n    const verifyJwtOptions: VerifyBearerJwtOptions<S> = {\n      audience: this.dids.pds,\n      typ: 'at+jwt',\n      scopes:\n        // @NOTE We can reject taken down credentials based on the scope if\n        // \"checkTakedown\" is set.\n        statusOptions.checkTakedown && scopes.includes(AuthScope.Takendown as S)\n          ? scopes.filter((s) => s !== AuthScope.Takendown)\n          : scopes,\n    }\n\n    return async (ctx) => {\n      setAuthHeaders(ctx.res)\n\n      const { sub: did, scope } = await this.verifyBearerJwt(\n        ctx.req,\n        verifyJwtOptions,\n      )\n\n      await this.verifyStatus(did, statusOptions)\n\n      return {\n        credentials: { type: 'access', did, scope },\n      }\n    }\n  }\n\n  public refresh(options?: {\n    allowExpired?: boolean\n  }): MethodAuthVerifier<RefreshOutput> {\n    const verifyOptions: VerifyBearerJwtOptions<AuthScope.Refresh> = {\n      clockTolerance: options?.allowExpired ? Infinity : undefined,\n      typ: 'refresh+jwt',\n      // when using entryway, proxying refresh credentials\n      audience: this.dids.entryway ? this.dids.entryway : this.dids.pds,\n      scopes: [AuthScope.Refresh],\n    }\n\n    return async (ctx) => {\n      setAuthHeaders(ctx.res)\n\n      const result = await this.verifyBearerJwt(ctx.req, verifyOptions)\n\n      const tokenId = result.jti\n      if (!tokenId) {\n        throw new AuthRequiredError(\n          'Unexpected missing refresh token id',\n          'MissingTokenId',\n        )\n      }\n\n      return {\n        credentials: {\n          type: 'refresh',\n          did: result.sub,\n          scope: result.scope,\n          tokenId,\n        },\n      }\n    }\n  }\n\n  public authorization<P extends Params>({\n    scopes = ACCESS_STANDARD,\n    additional = [],\n    ...options\n  }: VerifiedOptions &\n    ScopedOptions &\n    ExtraScopedOptions &\n    AuthorizedOptions<P>): MethodAuthVerifier<AccessOutput | OAuthOutput, P> {\n    const access = this.access({\n      ...options,\n      scopes: [...scopes, ...additional],\n    })\n    const oauth = this.oauth(options)\n\n    return async (ctx) => {\n      const type = extractAuthType(ctx.req)\n\n      if (type === AuthType.BEARER) {\n        return access(ctx)\n      }\n\n      if (type === AuthType.DPOP) {\n        return oauth(ctx)\n      }\n\n      // Auth headers are set through the access and oauth methods so we only\n      // need to set them here if we reach this point\n      setAuthHeaders(ctx.res)\n\n      if (type !== null) {\n        throw new InvalidRequestError(\n          'Unexpected authorization type',\n          'InvalidToken',\n        )\n      }\n\n      throw new AuthRequiredError(undefined, 'AuthMissing')\n    }\n  }\n\n  public authorizationOrModService<P extends Params>(\n    opts: VerifiedOptions & ExtraScopedOptions & AuthorizedOptions<P>,\n  ): MethodAuthVerifier<AccessOutput | OAuthOutput | ModServiceOutput, P> {\n    const authorization = this.authorization(opts)\n    return async (ctx) => {\n      try {\n        return await this.modService(ctx)\n      } catch (err) {\n        if (err instanceof AuthRequiredError) {\n          return authorization(ctx)\n        }\n        throw err\n      }\n    }\n  }\n\n  public authorizationOrAdminTokenOptional<P extends Params>(\n    opts: VerifiedOptions & ExtraScopedOptions & AuthorizedOptions<P>,\n  ): MethodAuthVerifier<\n    OAuthOutput | AccessOutput | AdminTokenOutput | UnauthenticatedOutput,\n    P\n  > {\n    const authorization = this.authorization(opts)\n    return async (ctx) => {\n      const type = extractAuthType(ctx.req)\n      if (type === AuthType.BEARER || type === AuthType.DPOP) {\n        return authorization(ctx)\n      } else if (type === AuthType.BASIC) {\n        return this.adminToken(ctx)\n      } else {\n        return this.unauthenticated(ctx)\n      }\n    }\n  }\n\n  public userServiceAuth: MethodAuthVerifier<UserServiceAuthOutput> = async (\n    ctx,\n  ) => {\n    setAuthHeaders(ctx.res)\n    const payload = await this.verifyServiceJwt(ctx.req)\n    return {\n      credentials: {\n        type: 'user_service_auth',\n        did: payload.iss,\n      },\n    }\n  }\n\n  public userServiceAuthOptional: MethodAuthVerifier<\n    UserServiceAuthOutput | UnauthenticatedOutput\n  > = async (ctx) => {\n    const type = extractAuthType(ctx.req)\n    if (type === AuthType.BEARER) {\n      return await this.userServiceAuth(ctx)\n    } else {\n      return this.unauthenticated(ctx)\n    }\n  }\n\n  public authorizationOrUserServiceAuth<P extends Params>(\n    options: VerifiedOptions &\n      ScopedOptions &\n      ExtraScopedOptions &\n      AuthorizedOptions<P>,\n  ): MethodAuthVerifier<UserServiceAuthOutput | OAuthOutput | AccessOutput, P> {\n    const authorizationVerifier = this.authorization(options)\n    return async (ctx) => {\n      if (isDefinitelyServiceAuth(ctx.req)) {\n        return this.userServiceAuth(ctx)\n      } else {\n        return authorizationVerifier(ctx)\n      }\n    }\n  }\n\n  protected oauth<P extends Params>({\n    authorize,\n    ...verifyStatusOptions\n  }: VerifiedOptions & AuthorizedOptions<P>): MethodAuthVerifier<\n    OAuthOutput,\n    P\n  > {\n    const verifyTokenOptions: VerifyTokenPayloadOptions = {\n      audience: [this.dids.pds],\n      scope: ['atproto'],\n    }\n\n    return async (ctx) => {\n      setAuthHeaders(ctx.res)\n\n      const { req, res } = ctx\n\n      // https://datatracker.ietf.org/doc/html/rfc9449#section-8.2\n      const dpopNonce = this.oauthVerifier.nextDpopNonce()\n      if (dpopNonce) {\n        res.setHeader('DPoP-Nonce', dpopNonce)\n        res.appendHeader('Access-Control-Expose-Headers', 'DPoP-Nonce')\n      }\n\n      const originalUrl = req.originalUrl || req.url || '/'\n      const url = new URL(originalUrl, this._publicUrl)\n\n      const { scope, sub: did } = await this.oauthVerifier\n        .authenticateRequest(\n          req.method || 'GET',\n          url,\n          req.headers,\n          verifyTokenOptions,\n        )\n        .catch((err) => {\n          // Make sure to include any WWW-Authenticate header in the response\n          // (particularly useful for DPoP's \"use_dpop_nonce\" error)\n          if (err instanceof WWWAuthenticateError) {\n            res.setHeader('WWW-Authenticate', err.wwwAuthenticateHeader)\n            res.appendHeader(\n              'Access-Control-Expose-Headers',\n              'WWW-Authenticate',\n            )\n          }\n\n          if (err instanceof OAuthError) {\n            throw new XRPCError(err.status, err.error_description, err.error)\n          }\n\n          throw err\n        })\n\n      if (!isDidString(did)) {\n        throw new InvalidRequestError('Malformed token', 'InvalidToken')\n      }\n\n      await this.verifyStatus(did, verifyStatusOptions)\n\n      const permissions = new ScopePermissionsTransition(scope?.split(' '))\n\n      // Should never happen\n      if (!permissions.scopes.has('atproto')) {\n        throw new InvalidRequestError(\n          'OAuth token does not have \"atproto\" scope',\n          'InvalidToken',\n        )\n      }\n\n      await authorize(permissions, ctx)\n\n      return {\n        credentials: {\n          type: 'oauth',\n          did,\n          permissions,\n        },\n      }\n    }\n  }\n\n  protected async verifyStatus(\n    did: DidString,\n    options: VerifiedOptions,\n  ): Promise<void> {\n    if (options.checkDeactivated || options.checkTakedown) {\n      await this.findAccount(did, options)\n    }\n  }\n\n  /**\n   * Finds an account by its handle or DID, returning possibly deactivated or\n   * taken down accounts (unless `options.checkDeactivated` or\n   * `options.checkTakedown` are set to true, respectively).\n   */\n  public async findAccount(\n    handleOrDid: AtIdentifierString,\n    options: VerifiedOptions,\n  ): Promise<ActorAccount> {\n    const account = await this.accountManager.getAccount(handleOrDid, {\n      includeDeactivated: true,\n      includeTakenDown: true,\n    })\n    if (!account) {\n      // will be turned into ExpiredToken for the client if proxied by entryway\n      throw new ForbiddenError('Account not found', 'AccountNotFound')\n    }\n    if (options.checkTakedown && softDeleted(account)) {\n      throw new AuthRequiredError(\n        'Account has been taken down',\n        'AccountTakedown',\n      )\n    }\n    if (options.checkDeactivated && account.deactivatedAt) {\n      throw new AuthRequiredError(\n        'Account is deactivated',\n        'AccountDeactivated',\n      )\n    }\n    return account\n  }\n\n  /**\n   * Wraps {@link jose.jwtVerify} into a function that also validates the token\n   * payload's type and wraps errors into {@link InvalidRequestError}.\n   */\n  protected async verifyBearerJwt<S extends AuthScope = AuthScope>(\n    req: IncomingMessage,\n    { scopes, ...options }: VerifyBearerJwtOptions<S>,\n  ): Promise<VerifyBearerJwtResult<S>> {\n    const token = bearerTokenFromReq(req)\n    if (!token) {\n      throw new AuthRequiredError(undefined, 'AuthMissing')\n    }\n\n    const { payload } = await jose\n      .jwtVerify(token, this._jwtKey, options)\n      .catch((cause) => {\n        if (cause instanceof jose.errors.JWTExpired) {\n          throw new InvalidRequestError('Token has expired', 'ExpiredToken', {\n            cause,\n          })\n        } else {\n          throw new InvalidRequestError(\n            'Token could not be verified',\n            'InvalidToken',\n            { cause },\n          )\n        }\n      })\n\n    const { sub, aud, scope, lxm, cnf, jti } = payload\n\n    if (typeof lxm !== 'undefined') {\n      // Service auth tokens should never make it to here. But since service\n      // auth tokens do not have a \"typ\" header, the \"typ\" check above will not\n      // catch them. This check here is mainly to protect against the\n      // hypothetical case in which a PDS would issue service auth tokens using\n      // its private key.\n      throw new InvalidRequestError('Malformed token', 'InvalidToken')\n    }\n    if (typeof cnf !== 'undefined') {\n      // Proof-of-Possession (PoP) tokens are not allowed here\n      // https://www.rfc-editor.org/rfc/rfc7800.html\n      throw new InvalidRequestError('Malformed token', 'InvalidToken')\n    }\n    if (typeof sub !== 'string' || !isDidString(sub)) {\n      throw new InvalidRequestError('Malformed token', 'InvalidToken')\n    }\n    if (typeof aud !== 'string' || !aud.startsWith('did:')) {\n      throw new InvalidRequestError('Malformed token', 'InvalidToken')\n    }\n    if (typeof jti !== 'string' && typeof jti !== 'undefined') {\n      throw new InvalidRequestError('Malformed token', 'InvalidToken')\n    }\n    if (!isAuthScope(scope) || !scopes.includes(scope as any)) {\n      throw new InvalidRequestError('Bad token scope', 'InvalidToken')\n    }\n\n    return { sub, aud, jti, scope: scope as S }\n  }\n\n  protected async verifyServiceJwt(\n    req: IncomingMessage,\n    opts?: { iss?: string[] },\n  ) {\n    const jwtStr = bearerTokenFromReq(req)\n    if (!jwtStr) {\n      throw new AuthRequiredError('missing jwt', 'MissingJwt')\n    }\n\n    const nsid = parseReqNsid(req)\n    const payload = await verifyServiceJwt(\n      jwtStr,\n      null,\n      nsid,\n      async (iss, forceRefresh) => {\n        if (opts?.iss && !opts.iss.includes(iss)) {\n          throw new AuthRequiredError('Untrusted issuer', 'UntrustedIss')\n        }\n        const [did, serviceId] = iss.split('#')\n        const keyId =\n          serviceId === 'atproto_labeler' ? 'atproto_label' : 'atproto'\n        const didDoc = await this.idResolver.did.resolve(did, forceRefresh)\n        if (!didDoc) {\n          throw new AuthRequiredError('could not resolve iss did')\n        }\n        const parsedKey = getVerificationMaterial(didDoc, keyId)\n        if (!parsedKey) {\n          throw new AuthRequiredError('missing or bad key in did doc')\n        }\n        const didKey = getDidKeyFromMultibase(parsedKey)\n        if (!didKey) {\n          throw new AuthRequiredError('missing or bad key in did doc')\n        }\n        return didKey\n      },\n    )\n    if (\n      payload.aud !== this.dids.pds &&\n      (!this.dids.entryway || payload.aud !== this.dids.entryway)\n    ) {\n      throw new AuthRequiredError(\n        'jwt audience does not match service did',\n        'BadJwtAudience',\n      )\n    }\n    return payload\n  }\n\n  protected async verifyEntrywayServiceJwt(req: IncomingMessage) {\n    const entrywayDid = this.dids.entryway\n    const didKey = this._entrywayServiceAuth?.didKey\n    if (!entrywayDid || !didKey) {\n      throw new AuthRequiredError('Untrusted issuer', 'UntrustedIss')\n    }\n\n    const jwtStr = bearerTokenFromReq(req)\n    if (!jwtStr) {\n      throw new AuthRequiredError('missing jwt', 'MissingJwt')\n    }\n\n    // @NOTE Unlike this.verifyServiceJwt(), the key comes from config rather\n    // than the issuer's DID document, and the entryway is not an accepted\n    // audience: these tokens are minted for this PDS only.\n    const payload = await verifyServiceJwt(\n      jwtStr,\n      this.dids.pds,\n      parseReqNsid(req),\n      async (iss) => {\n        if (iss !== entrywayDid) {\n          throw new AuthRequiredError('Untrusted issuer', 'UntrustedIss')\n        }\n        return didKey\n      },\n    )\n\n    // @NOTE xrpc-server's verifyJwt pins neither \"alg\" (an empty one skips its\n    // algorithm check) nor \"typ\", and does not bound token lifetime; the\n    // entryway token contract requires all three.\n    const { alg, typ } = jose.decodeProtectedHeader(jwtStr)\n    if (alg !== 'ES256K') {\n      throw new AuthRequiredError(`Invalid jwt algorithm \"${alg}\"`, 'BadJwtAlg')\n    }\n    if (typ !== 'JWT') {\n      throw new AuthRequiredError(`Invalid jwt type \"${typ}\"`, 'BadJwtType')\n    }\n    const { iat } = jose.decodeJwt(jwtStr)\n    if (\n      typeof iat !== 'number' ||\n      iat > Date.now() / 1000 + ENTRYWAY_SERVICE_JWT_CLOCK_TOLERANCE_SEC\n    ) {\n      throw new AuthRequiredError('jwt iat is missing or invalid', 'BadJwtIat')\n    }\n    if (payload.exp - iat > ENTRYWAY_SERVICE_JWT_MAX_LIFETIME_SEC) {\n      throw new AuthRequiredError('jwt lifetime is too long', 'BadJwtLifetime')\n    }\n\n    return payload\n  }\n\n  protected isEntrywayIssuedJwt(req: IncomingMessage): boolean {\n    if (!this.dids.entryway || !this._entrywayServiceAuth) return false\n    const token = bearerTokenFromReq(req)\n    if (!token) return false\n    try {\n      return jose.decodeJwt(token).iss === this.dids.entryway\n    } catch {\n      // Malformed tokens are left to the fallback verifier to reject.\n      return false\n    }\n  }\n\n  protected assertEntrywayServiceAuthNotRequired(res: ServerResponse): void {\n    if (this._entrywayServiceAuth?.required) {\n      setAuthHeaders(res)\n      throw new AuthRequiredError('Entryway service auth required')\n    }\n  }\n}\n\n// HELPERS\n// ---------\n\nexport function isUserOrAdmin(\n  auth: AccessOutput | OAuthOutput | AdminTokenOutput | UnauthenticatedOutput,\n  did: string,\n): boolean {\n  if (!auth.credentials) {\n    return false\n  } else if (auth.credentials.type === 'admin_token') {\n    return true\n  } else {\n    return auth.credentials.did === did\n  }\n}\n\nenum AuthType {\n  BASIC = 'Basic',\n  BEARER = 'Bearer',\n  DPOP = 'DPoP',\n}\n\nconst parseAuthorizationHeader = (\n  req: IncomingMessage,\n): [type: null] | [type: AuthType, token: string] => {\n  const authorization = req.headers['authorization']\n  if (!authorization) return [null]\n\n  const result = authorization.split(' ')\n  if (result.length !== 2) {\n    throw new InvalidRequestError(\n      'Malformed authorization header',\n      'InvalidToken',\n    )\n  }\n\n  // authorization type is case-insensitive\n  const authType = result[0].toUpperCase()\n\n  const type = Object.hasOwn(AuthType, authType) ? AuthType[authType] : null\n  if (type) return [type, result[1]]\n\n  throw new InvalidRequestError(\n    `Unsupported authorization type: ${result[0]}`,\n    'InvalidToken',\n  )\n}\n\n/**\n * @note Not all service auth tokens are guaranteed to have \"lxm\" claim, so this\n * function should not be used to verify service auth tokens. It is only used to\n * check if a token is definitely a service auth token.\n */\nconst isDefinitelyServiceAuth = (req: IncomingMessage): boolean => {\n  const token = bearerTokenFromReq(req)\n  if (!token) return false\n  const payload = jose.decodeJwt(token)\n  return payload['lxm'] != null\n}\n\nconst extractAuthType = (req: IncomingMessage): AuthType | null => {\n  const [type] = parseAuthorizationHeader(req)\n  return type\n}\n\nexport const bearerTokenFromReq = (req: IncomingMessage) => {\n  const [type, token] = parseAuthorizationHeader(req)\n  return type === AuthType.BEARER ? token : null\n}\n\nconst parseBasicAuth = (\n  req: IncomingMessage,\n): { username: string; password: string } | null => {\n  try {\n    const [type, b64] = parseAuthorizationHeader(req)\n    if (type !== AuthType.BASIC) return null\n    const decoded = Buffer.from(b64, 'base64').toString('utf8')\n    // We must not use split(':') because the password can contain colons\n    const colon = decoded.indexOf(':')\n    if (colon === -1) return null\n    const username = decoded.slice(0, colon)\n    const password = decoded.slice(colon + 1)\n    return { username, password }\n  } catch (err) {\n    return null\n  }\n}\n\nexport { type KeyObject }\n\nexport const createSecretKeyObject = (secret: string): KeyObject => {\n  return createSecretKey(Buffer.from(secret))\n}\n\nexport const createPublicKeyObject = (publicKeyHex: string): KeyObject => {\n  // accepts compressed or uncompressed keys; validates the point is on-curve\n  const point =\n    secp256k1.ProjectivePoint.fromHex(publicKeyHex).toRawBytes(false)\n  return createPublicKey({\n    format: 'jwk',\n    key: {\n      kty: 'EC',\n      crv: 'secp256k1',\n      x: Buffer.from(point.subarray(1, 33)).toString('base64url'),\n      y: Buffer.from(point.subarray(33, 65)).toString('base64url'),\n    },\n  })\n}\n\nfunction setAuthHeaders(res: ServerResponse) {\n  res.setHeader('Cache-Control', 'private')\n  appendVary(res, 'Authorization')\n}\n"]}

package/dist/bsky-app-view.d.ts

@@ -1,4 +1,4 @@
-import { Client } from '@atproto/lex';
+import { Client } from '@atproto/lex-client';
 export type AppViewOptions = {
     url: string;
     did: string;

package/dist/bsky-app-view.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bsky-app-view.d.ts","sourceRoot":"","sources":["../src/bsky-app-view.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAErC,MAAM,MAAM,cAAc,GAAG;IAC3B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAC3B,CAAA;AAED,qBAAa,WAAW;IACf,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;IACrB,OAAO,CAAC,aAAa,CAAC,CAAQ;IAE9B,YAAY,OAAO,EAAE,cAAc,EAWlC;IAED,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEzE;CACF"}
+{"version":3,"file":"bsky-app-view.d.ts","sourceRoot":"","sources":["../src/bsky-app-view.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAE5C,MAAM,MAAM,cAAc,GAAG;IAC3B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAC3B,CAAA;AAED,qBAAa,WAAW;IACf,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;IACrB,OAAO,CAAC,aAAa,CAAC,CAAQ;IAE9B,YAAY,OAAO,EAAE,cAAc,EAWlC;IAED,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEzE;CACF"}

package/dist/bsky-app-view.js

@@ -1,5 +1,5 @@
 import { format } from 'node:util';
-import { Client } from '@atproto/lex';
+import { Client } from '@atproto/lex-client';
 export class BskyAppView {
     constructor(options) {
         this.did = options.did;

package/dist/bsky-app-view.js.map

@@ -1 +1 @@
-{"version":3,"file":"bsky-app-view.js","sourceRoot":"","sources":["../src/bsky-app-view.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AAClC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AASrC,MAAM,OAAO,WAAW;IAMtB,YAAY,OAAuB;QACjC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAA;QACtB,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAA;QACtB,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CACtB,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,EACxB;YACE,wBAAwB,EAAE,KAAK;YAC/B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,KAAK;SACpD,CACF,CAAA;QACD,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAA;IAC5C,CAAC;IAED,WAAW,CAAC,OAAe,EAAE,GAAW,EAAE,GAAW;QACnD,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IAC9E,CAAC;CACF","sourcesContent":["import { format } from 'node:util'\nimport { Client } from '@atproto/lex'\n\nexport type AppViewOptions = {\n  url: string\n  did: string\n  cdnUrlPattern?: string\n  validateResponse?: boolean\n}\n\nexport class BskyAppView {\n  public did: string\n  public url: string\n  public client: Client\n  private cdnUrlPattern?: string\n\n  constructor(options: AppViewOptions) {\n    this.did = options.did\n    this.url = options.url\n    this.client = new Client(\n      { service: options.url },\n      {\n        strictResponseProcessing: false,\n        validateResponse: options.validateResponse ?? false,\n      },\n    )\n    this.cdnUrlPattern = options.cdnUrlPattern\n  }\n\n  getImageUrl(pattern: string, did: string, cid: string): string | undefined {\n    if (this.cdnUrlPattern) return format(this.cdnUrlPattern, pattern, did, cid)\n  }\n}\n"]}
+{"version":3,"file":"bsky-app-view.js","sourceRoot":"","sources":["../src/bsky-app-view.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AAClC,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAS5C,MAAM,OAAO,WAAW;IAMtB,YAAY,OAAuB;QACjC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAA;QACtB,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAA;QACtB,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CACtB,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,EACxB;YACE,wBAAwB,EAAE,KAAK;YAC/B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,KAAK;SACpD,CACF,CAAA;QACD,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAA;IAC5C,CAAC;IAED,WAAW,CAAC,OAAe,EAAE,GAAW,EAAE,GAAW;QACnD,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IAC9E,CAAC;CACF","sourcesContent":["import { format } from 'node:util'\nimport { Client } from '@atproto/lex-client'\n\nexport type AppViewOptions = {\n  url: string\n  did: string\n  cdnUrlPattern?: string\n  validateResponse?: boolean\n}\n\nexport class BskyAppView {\n  public did: string\n  public url: string\n  public client: Client\n  private cdnUrlPattern?: string\n\n  constructor(options: AppViewOptions) {\n    this.did = options.did\n    this.url = options.url\n    this.client = new Client(\n      { service: options.url },\n      {\n        strictResponseProcessing: false,\n        validateResponse: options.validateResponse ?? false,\n      },\n    )\n    this.cdnUrlPattern = options.cdnUrlPattern\n  }\n\n  getImageUrl(pattern: string, did: string, cid: string): string | undefined {\n    if (this.cdnUrlPattern) return format(this.cdnUrlPattern, pattern, did, cid)\n  }\n}\n"]}

package/dist/config/config.d.ts

@@ -85,10 +85,21 @@ export type IdentityConfig = {
     enableDidDocWithSession: boolean;
 };
 export type EntrywayConfig = {
+    /**
+     * The entryway's public URL, which is also the OAuth issuer and the
+     * authorization server this PDS advertises.
+     */
     url: string;
+    /**
+     * Where this PDS sends its own requests to the entryway. Defaults to
+     * {@link url}; differs when those requests go through a local proxy, e.g.
+     * one that adds mTLS.
+     */
+    apiUrl: string;
     did: string;
     jwtPublicKeyHex: string;
     plcRotationKey: string;
+    requireServiceAuth: boolean;
 };
 export type FetchConfig = {
     disableSsrfProtection: boolean;

package/dist/config/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config/config.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,cAAc,EACd,cAAc,EACf,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,KAAK,SAAS,EAA8B,MAAM,iBAAiB,CAAA;AAE5E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAA;AAEjD,YAAY,EAAE,cAAc,EAAE,CAAA;AAK9B,eAAO,MAAM,QAAQ,QAAS,iBAAiB,KAAG,YA8VjD,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,aAAa,CAAA;IACtB,EAAE,EAAE,cAAc,CAAA;IAClB,UAAU,EAAE,gBAAgB,CAAA;IAC5B,SAAS,EAAE,iBAAiB,GAAG,mBAAmB,CAAA;IAClD,QAAQ,EAAE,cAAc,CAAA;IACxB,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAA;IAC/B,OAAO,EAAE,aAAa,CAAA;IACtB,KAAK,EAAE,WAAW,GAAG,IAAI,CAAA;IACzB,eAAe,EAAE,WAAW,GAAG,IAAI,CAAA;IACnC,YAAY,EAAE,kBAAkB,CAAA;IAChC,WAAW,EAAE,iBAAiB,GAAG,IAAI,CAAA;IACrC,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAA;IACnC,aAAa,EAAE,mBAAmB,GAAG,IAAI,CAAA;IACzC,KAAK,EAAE,kBAAkB,GAAG,IAAI,CAAA;IAChC,UAAU,EAAE,gBAAgB,CAAA;IAC5B,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,KAAK,EAAE,WAAW,CAAA;IAClB,KAAK,EAAE,WAAW,CAAA;IAClB,QAAQ,EAAE,cAAc,CAAA;IACxB,KAAK,EAAE,WAAW,CAAA;IAClB,OAAO,EAAE,qBAAqB,CAAA;CAC/B,CAAA;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,GAAG,EAAE,SAAS,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,gBAAgB,EAAE,OAAO,CAAA;IACzB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,eAAe,EAAE,MAAM,CAAA;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,OAAO,EAAE,OAAO,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,YAAY,EAAE,MAAM,CAAA;IACpB,cAAc,EAAE,MAAM,CAAA;IACtB,aAAa,EAAE,MAAM,CAAA;IACrB,wBAAwB,EAAE,OAAO,CAAA;CAClC,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,wBAAwB,EAAE,OAAO,CAAA;CAClC,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,EAAE,IAAI,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,WAAW,CAAC,EAAE;QACZ,WAAW,EAAE,MAAM,CAAA;QACnB,eAAe,EAAE,MAAM,CAAA;KACxB,CAAA;CACF,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd;;;;OAIG;IACH,eAAe,EAAE,MAAM,CAAA;IACvB,aAAa,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,oBAAoB,EAAE,MAAM,EAAE,CAAA;IAC9B,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAA;IAClC,uBAAuB,EAAE,OAAO,CAAA;CACjC,CAAA;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,eAAe,EAAE,MAAM,CAAA;IACvB,cAAc,EAAE,MAAM,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,qBAAqB,EAAE,OAAO,CAAA;IAC9B,eAAe,EAAE,MAAM,CAAA;CACxB,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,qBAAqB,EAAE,OAAO,CAAA;IAC9B,UAAU,EAAE,OAAO,CAAA;IACnB,cAAc,EAAE,MAAM,CAAA;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,eAAe,EAAE,MAAM,CAAA;IACvB,UAAU,EAAE,MAAM,CAAA;IAElB;;;;;;OAMG;IACH,gBAAgB,EAAE,OAAO,CAAA;CAC1B,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE;QACT,QAAQ,CAAC,EAAE,cAAc,CAAA;QACzB,QAAQ,EAAE,cAAc,CAAA;QACxB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;KAC1B,CAAA;CACF,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,YAAY,CAAC,EAAE,OAAO,MAAM,IAAI,MAAM,EAAE,CAAA;CACzC,CAAA;AAED,MAAM,MAAM,aAAa,GACrB;IACE,QAAQ,EAAE,IAAI,CAAA;IACd,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,KAAK,EAAE,MAAM,CAAA;CACd,GACD;IACE,QAAQ,EAAE,KAAK,CAAA;CAChB,CAAA;AAEL,MAAM,MAAM,WAAW,GAAG;IACxB,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,uBAAuB,EAAE,OAAO,CAAA;CACjC,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,mBAAmB,EAAE,MAAM,CAAA;CAC5B,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,gBAAgB,GACxB;IACE,OAAO,EAAE,IAAI,CAAA;IACb,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;CACrB,GACD;IAAE,OAAO,EAAE,KAAK,CAAA;CAAE,CAAA;AAEtB,MAAM,MAAM,iBAAiB,GAAG;IAC9B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;CACZ,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;CACZ,CAAA"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config/config.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,cAAc,EACd,cAAc,EACf,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,KAAK,SAAS,EAA8B,MAAM,iBAAiB,CAAA;AAE5E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAA;AAEjD,YAAY,EAAE,cAAc,EAAE,CAAA;AAK9B,eAAO,MAAM,QAAQ,QAAS,iBAAiB,KAAG,YAgWjD,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,aAAa,CAAA;IACtB,EAAE,EAAE,cAAc,CAAA;IAClB,UAAU,EAAE,gBAAgB,CAAA;IAC5B,SAAS,EAAE,iBAAiB,GAAG,mBAAmB,CAAA;IAClD,QAAQ,EAAE,cAAc,CAAA;IACxB,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAA;IAC/B,OAAO,EAAE,aAAa,CAAA;IACtB,KAAK,EAAE,WAAW,GAAG,IAAI,CAAA;IACzB,eAAe,EAAE,WAAW,GAAG,IAAI,CAAA;IACnC,YAAY,EAAE,kBAAkB,CAAA;IAChC,WAAW,EAAE,iBAAiB,GAAG,IAAI,CAAA;IACrC,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAA;IACnC,aAAa,EAAE,mBAAmB,GAAG,IAAI,CAAA;IACzC,KAAK,EAAE,kBAAkB,GAAG,IAAI,CAAA;IAChC,UAAU,EAAE,gBAAgB,CAAA;IAC5B,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,KAAK,EAAE,WAAW,CAAA;IAClB,KAAK,EAAE,WAAW,CAAA;IAClB,QAAQ,EAAE,cAAc,CAAA;IACxB,KAAK,EAAE,WAAW,CAAA;IAClB,OAAO,EAAE,qBAAqB,CAAA;CAC/B,CAAA;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,GAAG,EAAE,SAAS,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,gBAAgB,EAAE,OAAO,CAAA;IACzB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,eAAe,EAAE,MAAM,CAAA;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,OAAO,EAAE,OAAO,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,YAAY,EAAE,MAAM,CAAA;IACpB,cAAc,EAAE,MAAM,CAAA;IACtB,aAAa,EAAE,MAAM,CAAA;IACrB,wBAAwB,EAAE,OAAO,CAAA;CAClC,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,wBAAwB,EAAE,OAAO,CAAA;CAClC,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,EAAE,IAAI,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,WAAW,CAAC,EAAE;QACZ,WAAW,EAAE,MAAM,CAAA;QACnB,eAAe,EAAE,MAAM,CAAA;KACxB,CAAA;CACF,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd;;;;OAIG;IACH,eAAe,EAAE,MAAM,CAAA;IACvB,aAAa,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,oBAAoB,EAAE,MAAM,EAAE,CAAA;IAC9B,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAA;IAClC,uBAAuB,EAAE,OAAO,CAAA;CACjC,CAAA;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAA;IACX;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;IACX,eAAe,EAAE,MAAM,CAAA;IACvB,cAAc,EAAE,MAAM,CAAA;IACtB,kBAAkB,EAAE,OAAO,CAAA;CAC5B,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,qBAAqB,EAAE,OAAO,CAAA;IAC9B,eAAe,EAAE,MAAM,CAAA;CACxB,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,qBAAqB,EAAE,OAAO,CAAA;IAC9B,UAAU,EAAE,OAAO,CAAA;IACnB,cAAc,EAAE,MAAM,CAAA;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,eAAe,EAAE,MAAM,CAAA;IACvB,UAAU,EAAE,MAAM,CAAA;IAElB;;;;;;OAMG;IACH,gBAAgB,EAAE,OAAO,CAAA;CAC1B,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE;QACT,QAAQ,CAAC,EAAE,cAAc,CAAA;QACzB,QAAQ,EAAE,cAAc,CAAA;QACxB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;KAC1B,CAAA;CACF,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,YAAY,CAAC,EAAE,OAAO,MAAM,IAAI,MAAM,EAAE,CAAA;CACzC,CAAA;AAED,MAAM,MAAM,aAAa,GACrB;IACE,QAAQ,EAAE,IAAI,CAAA;IACd,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,KAAK,EAAE,MAAM,CAAA;CACd,GACD;IACE,QAAQ,EAAE,KAAK,CAAA;CAChB,CAAA;AAEL,MAAM,MAAM,WAAW,GAAG;IACxB,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,uBAAuB,EAAE,OAAO,CAAA;CACjC,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,mBAAmB,EAAE,MAAM,CAAA;CAC5B,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,gBAAgB,GACxB;IACE,OAAO,EAAE,IAAI,CAAA;IACb,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;CACrB,GACD;IAAE,OAAO,EAAE,KAAK,CAAA;CAAE,CAAA;AAEtB,MAAM,MAAM,iBAAiB,GAAG;IAC9B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;CACZ,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;CACZ,CAAA"}

package/dist/config/config.js

@@ -112,9 +112,11 @@ export const envToCfg = (env) => {
             env.entrywayDid, 'if entryway url is configured, must include all required entryway configuration');
         entrywayCfg = {
             url: env.entrywayUrl,
+            apiUrl: env.entrywayApiUrl ?? env.entrywayUrl,
             did: env.entrywayDid,
             jwtPublicKeyHex: env.entrywayJwtVerifyKeyK256PublicKeyHex,
             plcRotationKey: env.entrywayPlcRotationKey,
+            requireServiceAuth: env.entrywayRequireServiceAuth ?? false,
         };
     }
     // default to being required if left undefined

package/dist/config/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/config/config.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAA;AAChC,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAKnD,OAAO,EAAkB,cAAc,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5E,OAAO,GAAG,MAAM,oBAAoB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AAK1D,iCAAiC;AACjC,gEAAgE;AAEhE,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,GAAsB,EAAgB,EAAE;IAC/D,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,IAAI,CAAA;IAC7B,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,IAAI,WAAW,CAAA;IAC5C,MAAM,SAAS,GACb,QAAQ,KAAK,WAAW;QACtB,CAAC,CAAC,oBAAoB,IAAI,EAAE;QAC5B,CAAC,CAAC,WAAW,QAAQ,EAAE,CAAA;IAC3B,MAAM,GAAG,GAAG,GAAG,CAAC,UAAU,IAAI,WAAW,QAAQ,EAAE,CAAA;IAEnD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,EAAE,CAAC,CAAA;IAChD,CAAC;IAED,MAAM,UAAU,GAA4B;QAC1C,IAAI;QACJ,QAAQ;QACR,SAAS;QACT,GAAG;QACH,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO;QACnC,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;QACtC,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;QACxC,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;QAC5C,gBAAgB,EAAE,GAAG,CAAC,gBAAgB,IAAI,IAAI;QAC9C,aAAa,EAAE,GAAG,CAAC,aAAa;QAChC,eAAe,EAAE,GAAG,CAAC,eAAe,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,MAAM;QAC/D,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,KAAK;KAC9B,CAAA;IAED,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAE;QAC7B,OAAO,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACtE,CAAC,CAAA;IAED,MAAM,wBAAwB,GAAG,GAAG,CAAC,wBAAwB,IAAI,KAAK,CAAA;IAEtE,MAAM,KAAK,GAAuB;QAChC,YAAY,EAAE,GAAG,CAAC,iBAAiB,IAAI,KAAK,CAAC,gBAAgB,CAAC;QAC9D,cAAc,EAAE,GAAG,CAAC,mBAAmB,IAAI,KAAK,CAAC,kBAAkB,CAAC;QACpE,aAAa,EAAE,GAAG,CAAC,kBAAkB,IAAI,KAAK,CAAC,kBAAkB,CAAC;QAClE,wBAAwB;KACzB,CAAA;IAED,MAAM,aAAa,GAA+B;QAChD,SAAS,EAAE,GAAG,CAAC,mBAAmB,IAAI,KAAK,CAAC,QAAQ,CAAC;QACrD,SAAS,EAAE,GAAG,CAAC,mBAAmB,IAAI,GAAG;QACzC,wBAAwB;KACzB,CAAA;IAED,IAAI,YAAuC,CAAA;IAC3C,IAAI,GAAG,CAAC,iBAAiB,IAAI,GAAG,CAAC,qBAAqB,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;IACnE,CAAC;IACD,IAAI,GAAG,CAAC,iBAAiB,EAAE,CAAC;QAC1B,YAAY,GAAG;YACb,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,GAAG,CAAC,iBAAiB;YAC7B,eAAe,EAAE,GAAG,CAAC,0BAA0B,IAAI,KAAK;YACxD,gBAAgB,EAAE,GAAG,CAAC,2BAA2B;YACjD,MAAM,EAAE,GAAG,CAAC,iBAAiB;YAC7B,QAAQ,EAAE,GAAG,CAAC,mBAAmB;YACjC,cAAc,EAAE,GAAG,CAAC,yBAAyB;SAC9C,CAAA;QACD,IAAI,GAAG,CAAC,sBAAsB,IAAI,GAAG,CAAC,0BAA0B,EAAE,CAAC;YACjE,IAAI,CAAC,GAAG,CAAC,sBAAsB,IAAI,CAAC,GAAG,CAAC,0BAA0B,EAAE,CAAC;gBACnE,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAA;YACH,CAAC;YACD,YAAY,CAAC,WAAW,GAAG;gBACzB,WAAW,EAAE,GAAG,CAAC,sBAAsB;gBACvC,eAAe,EAAE,GAAG,CAAC,0BAA0B;aAChD,CAAA;QACH,CAAC;IACH,CAAC;SAAM,IAAI,GAAG,CAAC,qBAAqB,EAAE,CAAC;QACrC,YAAY,GAAG;YACb,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,GAAG,CAAC,qBAAqB;YACnC,YAAY,EAAE,GAAG,CAAC,wBAAwB;SAC3C,CAAA;IACH,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;IAC/D,CAAC;IAED,2FAA2F;IAC3F,IAAI,oBAA8B,CAAA;IAClC,IAAI,GAAG,CAAC,oBAAoB,IAAI,GAAG,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpE,oBAAoB,GAAG,GAAG,CAAC,oBAAoB,CAAA;IACjD,CAAC;SAAM,CAAC;QACN,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;YAC7B,oBAAoB,GAAG,CAAC,OAAO,CAAC,CAAA;QAClC,CAAC;aAAM,CAAC;YACN,oBAAoB,GAAG,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAA;QACzC,CAAC;IACH,CAAC;IACD,MAAM,aAAa,GAAG,oBAAoB,CAAC,IAAI,CAC7C,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CACzD,CAAA;IACD,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,0BAA0B,aAAa,EAAE,CAAC,CAAA;IAC5D,CAAC;IAED,MAAM,WAAW,GAA6B;QAC5C,MAAM,EAAE,GAAG,CAAC,SAAS,IAAI,uBAAuB;QAChD,WAAW,EAAE,GAAG,CAAC,cAAc,IAAI,GAAG;QACtC,aAAa,EAAE,GAAG,CAAC,gBAAgB,IAAI,IAAI;QAC3C,eAAe,EAAE,GAAG,CAAC,eAAe,IAAI,CAAC,GAAG,MAAM;QAClD,cAAc,EAAE,GAAG,CAAC,cAAc,IAAI,IAAI;QAC1C,oBAAoB;QACpB,uBAAuB,EAAE,GAAG,CAAC,uBAAuB;QACpD,uBAAuB,EAAE,CAAC,CAAC,GAAG,CAAC,uBAAuB;KACvD,CAAA;IAED,IAAI,WAAW,GAA6B,IAAI,CAAA;IAChD,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;QACpB,MAAM,CACJ,GAAG,CAAC,oCAAoC;YACtC,GAAG,CAAC,sBAAsB;YAC1B,GAAG,CAAC,WAAW,EACjB,iFAAiF,CAClF,CAAA;QACD,WAAW,GAAG;YACZ,GAAG,EAAE,GAAG,CAAC,WAAW;YACpB,GAAG,EAAE,GAAG,CAAC,WAAW;YACpB,eAAe,EAAE,GAAG,CAAC,oCAAoC;YACzD,cAAc,EAAE,GAAG,CAAC,sBAAsB;SAC3C,CAAA;IACH,CAAC;IAED,8CAA8C;IAC9C,MAAM,UAAU,GACd,GAAG,CAAC,cAAc,KAAK,KAAK;QAC1B,CAAC,CAAC;YACE,QAAQ,EAAE,KAAK;SAChB;QACH,CAAC,CAAC;YACE,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,GAAG,CAAC,cAAc,IAAI,IAAI;YACpC,KAAK,EAAE,GAAG,CAAC,WAAW,IAAI,CAAC;SAC5B,CAAA;IAEP,IAAI,QAA+B,CAAA;IACnC,IAAI,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;QAC/C,QAAQ,GAAG,IAAI,CAAA;IACjB,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAA;QACH,CAAC;QACD,QAAQ,GAAG;YACT,OAAO,EAAE,GAAG,CAAC,YAAY;YACzB,WAAW,EAAE,GAAG,CAAC,gBAAgB;YACjC,uBAAuB,EAAE,GAAG,CAAC,4BAA4B,IAAI,KAAK;SACnE,CAAA;IACH,CAAC;IAED,IAAI,kBAAmD,CAAA;IACvD,IAAI,CAAC,GAAG,CAAC,sBAAsB,IAAI,CAAC,GAAG,CAAC,sBAAsB,EAAE,CAAC;QAC/D,kBAAkB,GAAG,IAAI,CAAA;IAC3B,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,GAAG,CAAC,sBAAsB,IAAI,CAAC,GAAG,CAAC,sBAAsB,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CACb,kFAAkF,CACnF,CAAA;QACH,CAAC;QACD,kBAAkB,GAAG;YACnB,OAAO,EAAE,GAAG,CAAC,sBAAsB;YACnC,WAAW,EAAE,GAAG,CAAC,sBAAsB;YACvC,uBAAuB,EAAE,KAAK;SAC/B,CAAA;IACH,CAAC;IAED,MAAM,eAAe,GAAiC;QACpD,SAAS,EAAE,GAAG,CAAC,qBAAqB,IAAI,GAAG;QAC3C,mBAAmB,EAAE,GAAG,CAAC,mBAAmB,IAAI,GAAG;KACpD,CAAA;IAED,IAAI,cAAc,GAAgC,IAAI,CAAA;IACtD,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;QACvB,MAAM,CACJ,GAAG,CAAC,cAAc,EAClB,4EAA4E,CAC7E,CAAA;QACD,cAAc,GAAG;YACf,GAAG,EAAE,GAAG,CAAC,cAAc;YACvB,GAAG,EAAE,GAAG,CAAC,cAAc;YACvB,aAAa,EAAE,GAAG,CAAC,wBAAwB;SAC5C,CAAA;IACH,CAAC;IAED,IAAI,aAAa,GAA+B,IAAI,CAAA;IACpD,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;QACtB,MAAM,CACJ,GAAG,CAAC,aAAa,EACjB,mEAAmE,CACpE,CAAA;QACD,aAAa,GAAG;YACd,GAAG,EAAE,GAAG,CAAC,aAAa;YACtB,GAAG,EAAE,GAAG,CAAC,aAAa;SACvB,CAAA;IACH,CAAC;IAED,IAAI,gBAAgB,GAAkC,IAAI,CAAA;IAC1D,IAAI,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACzB,MAAM,CACJ,GAAG,CAAC,gBAAgB,EACpB,sEAAsE,CACvE,CAAA;QACD,gBAAgB,GAAG;YACjB,GAAG,EAAE,GAAG,CAAC,gBAAgB;YACzB,GAAG,EAAE,GAAG,CAAC,gBAAgB;SAC1B,CAAA;IACH,CAAC;IAED,2DAA2D;IAC3D,IAAI,aAAa,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACvC,gBAAgB,GAAG,aAAa,CAAA;IAClC,CAAC;IAED,MAAM,QAAQ,GAA0B,GAAG,CAAC,mBAAmB;QAC7D,CAAC,CAAC;YACE,OAAO,EAAE,GAAG,CAAC,mBAAmB;YAChC,QAAQ,EAAE,GAAG,CAAC,oBAAoB;SACnC;QACH,CAAC,CAAC,IAAI,CAAA;IAER,MAAM,aAAa,GAA+B,GAAG,CAAC,iBAAiB;QACrE,CAAC,CAAC;YACE,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,GAAG,CAAC,kBAAkB;YACjC,SAAS,EAAE,GAAG,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAClD,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAC/B;SACF;QACH,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;IAEtB,MAAM,WAAW,GAA6B,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAA;IAEhE,MAAM,QAAQ,GAA0B;QACtC,qBAAqB,EAAE,GAAG,CAAC,qBAAqB,IAAI,GAAG,CAAC,OAAO,IAAI,KAAK;QACxE,eAAe,EAAE,GAAG,CAAC,oBAAoB,IAAI,GAAG,GAAG,IAAI,EAAE,QAAQ;KAClE,CAAA;IAED,MAAM,QAAQ,GAA0B;QACtC,qBAAqB,EAAE,GAAG,CAAC,qBAAqB,IAAI,GAAG,CAAC,OAAO,IAAI,KAAK;QACxE,UAAU,EAAE,GAAG,CAAC,eAAe,IAAI,KAAK;QACxC,cAAc,EAAE,GAAG,CAAC,mBAAmB,IAAI,IAAI;QAC/C,WAAW,EAAE,GAAG,CAAC,gBAAgB,IAAI,IAAI;QACzC,eAAe,EAAE,GAAG,CAAC,oBAAoB,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,OAAO;QACtE,UAAU,EACR,GAAG,CAAC,eAAe,IAAI,IAAI,IAAI,GAAG,CAAC,eAAe,GAAG,CAAC;YACpD,CAAC,CAAC,GAAG,CAAC,eAAe;YACrB,CAAC,CAAC,CAAC;QACP,gBAAgB,EAAE,GAAG,CAAC,qBAAqB,IAAI,KAAK;KACrD,CAAA;IAED,MAAM,WAAW,GAAG;QAClB,IAAI,EAAE,GAAG,CAAC,WAAW,IAAI,GAAG,QAAQ,MAAM;QAC1C,IAAI,EAAE,GAAG,CAAC,OAAO;QACjB,MAAM,EAAE;YACN,OAAO,EAAE,GAAG,CAAC,YAAY;YAEzB,KAAK,EAAE,GAAG,CAAC,UAAU;YACrB,OAAO,EAAE,GAAG,CAAC,YAAY;YACzB,IAAI,EAAE,GAAG,CAAC,SAAS;YACnB,OAAO,EAAE,GAAG,CAAC,YAAY;SAC1B;QACD,UAAU,EAAE;YACV,KAAK,EAAE,GAAG,CAAC,kBAAkB;YAC7B,IAAI,EAAE,GAAG,CAAC,iBAAiB;SAC5B;QACD,KAAK,EAAE;YACL;gBACE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE;gBACpC,IAAI,EAAE,GAAG,CAAC,OAAO;gBACjB,GAAG,EAAE,WAAoB,EAAE,yCAAyC;aACrE;YACD;gBACE,KAAK,EAAE,EAAE,EAAE,EAAE,kBAAkB,EAAE;gBACjC,IAAI,EAAE,GAAG,CAAC,iBAAiB;gBAC3B,GAAG,EAAE,kBAA2B;aACjC;YACD;gBACE,KAAK,EAAE,EAAE,EAAE,EAAE,gBAAgB,EAAE;gBAC/B,IAAI,EAAE,GAAG,CAAC,gBAAgB;gBAC1B,GAAG,EAAE,gBAAyB;aAC/B;YACD;gBACE,KAAK,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE;gBACxB,IAAI,EAAE,GAAG,CAAC,UAAU;gBACpB,GAAG,EAAE,MAAe;aACrB;SACF,CAAC,MAAM,CACN,CAA8B,CAAI,EAA6B,EAAE,CAC/D,CAAC,CAAC,IAAI,IAAI,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,EAAE,CAClC;KACF,CAAA;IAED,MAAM,QAAQ,GAA0B,WAAW;QACjD,CAAC,CAAC;YACE,MAAM,EAAE,WAAW,CAAC,GAAG;YACvB,QAAQ,EAAE,SAAS;SACpB;QACH,CAAC,CAAC;YACE,MAAM,EAAE,UAAU,CAAC,SAAS;YAC5B,QAAQ,EAAE;gBACR,QAAQ,EACN,GAAG,CAAC,eAAe;oBACnB,GAAG,CAAC,iBAAiB;oBACrB,GAAG,CAAC,iBAAiB;oBACnB,CAAC,CAAC;wBACE,OAAO,EAAE,GAAG,CAAC,eAAe;wBAC5B,SAAS,EAAE,GAAG,CAAC,iBAAiB;wBAChC,SAAS,EAAE,GAAG,CAAC,iBAAiB;qBACjC;oBACH,CAAC,CAAC,SAAS;gBACf,QAAQ,EAAE,WAAW;gBACrB,cAAc,EAAE,GAAG,CAAC,mBAAmB;aACxC;SACF,CAAA;IAEL,MAAM,UAAU,GAA0B,EAAE,CAAA;IAE5C,IAAI,GAAG,CAAC,mBAAmB,IAAI,IAAI,EAAE,CAAC;QACpC,cAAc,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;QACvC,UAAU,CAAC,YAAY,GAAG,GAAG,CAAC,mBAAmB,CAAA;IACnD,CAAC;IAED,OAAO;QACL,OAAO,EAAE,UAAU;QACnB,EAAE,EAAE,KAAK;QACT,UAAU,EAAE,aAAa;QACzB,SAAS,EAAE,YAAY;QACvB,QAAQ,EAAE,WAAW;QACrB,QAAQ,EAAE,WAAW;QACrB,OAAO,EAAE,UAAU;QACnB,KAAK,EAAE,QAAQ;QACf,eAAe,EAAE,kBAAkB;QACnC,YAAY,EAAE,eAAe;QAC7B,WAAW,EAAE,cAAc;QAC3B,UAAU,EAAE,aAAa;QACzB,aAAa,EAAE,gBAAgB;QAC/B,KAAK,EAAE,QAAQ;QACf,UAAU,EAAE,aAAa;QACzB,QAAQ,EAAE,WAAW;QACrB,KAAK,EAAE,QAAQ;QACf,OAAO,EAAE,UAAU;QACnB,KAAK,EAAE,QAAQ;QACf,QAAQ,EAAE,WAAW;QACrB,KAAK,EAAE,QAAQ;KAChB,CAAA;AACH,CAAC,CAAA","sourcesContent":["import assert from 'node:assert'\nimport path from 'node:path'\nimport { DAY, HOUR, SECOND } from '@atproto/common'\nimport type {\n  BrandingConfig,\n  HcaptchaConfig,\n} from '@atproto/oauth-provider/provider'\nimport { type DidString, ensureValidDid, isValidDid } from '@atproto/syntax'\nimport pkg from '../../package.json' with { type: 'json' }\nimport type { ServerEnvironment } from './env.js'\n\nexport type { BrandingConfig }\n\n// off-config but still from env:\n// logging: LOG_LEVEL, LOG_SYSTEMS, LOG_ENABLED, LOG_DESTINATION\n\nexport const envToCfg = (env: ServerEnvironment): ServerConfig => {\n  const port = env.port ?? 2583\n  const hostname = env.hostname ?? 'localhost'\n  const publicUrl =\n    hostname === 'localhost'\n      ? `http://localhost:${port}`\n      : `https://${hostname}`\n  const did = env.serviceDid ?? `did:web:${hostname}`\n\n  if (!isValidDid(did)) {\n    throw new Error(`Invalid service DID: ${did}`)\n  }\n\n  const serviceCfg: ServerConfig['service'] = {\n    port,\n    hostname,\n    publicUrl,\n    did,\n    version: env.version || pkg.version,\n    privacyPolicyUrl: env.privacyPolicyUrl,\n    termsOfServiceUrl: env.termsOfServiceUrl,\n    contactEmailAddress: env.contactEmailAddress,\n    acceptingImports: env.acceptingImports ?? true,\n    maxImportSize: env.maxImportSize,\n    blobUploadLimit: env.blobUploadLimit ?? 5 * 1024 * 1024, // 5mb\n    devMode: env.devMode ?? false,\n  }\n\n  const dbLoc = (name: string) => {\n    return env.dataDirectory ? path.join(env.dataDirectory, name) : name\n  }\n\n  const disableWalAutoCheckpoint = env.disableWalAutoCheckpoint ?? false\n\n  const dbCfg: ServerConfig['db'] = {\n    accountDbLoc: env.accountDbLocation ?? dbLoc('account.sqlite'),\n    sequencerDbLoc: env.sequencerDbLocation ?? dbLoc('sequencer.sqlite'),\n    didCacheDbLoc: env.didCacheDbLocation ?? dbLoc('did_cache.sqlite'),\n    disableWalAutoCheckpoint,\n  }\n\n  const actorStoreCfg: ServerConfig['actorStore'] = {\n    directory: env.actorStoreDirectory ?? dbLoc('actors'),\n    cacheSize: env.actorStoreCacheSize ?? 100,\n    disableWalAutoCheckpoint,\n  }\n\n  let blobstoreCfg: ServerConfig['blobstore']\n  if (env.blobstoreS3Bucket && env.blobstoreDiskLocation) {\n    throw new Error('Cannot set both S3 and disk blobstore env vars')\n  }\n  if (env.blobstoreS3Bucket) {\n    blobstoreCfg = {\n      provider: 's3',\n      bucket: env.blobstoreS3Bucket,\n      uploadTimeoutMs: env.blobstoreS3UploadTimeoutMs || 20000,\n      requestTimeoutMs: env.blobstoreS3RequestTimeoutMs,\n      region: env.blobstoreS3Region,\n      endpoint: env.blobstoreS3Endpoint,\n      forcePathStyle: env.blobstoreS3ForcePathStyle,\n    }\n    if (env.blobstoreS3AccessKeyId || env.blobstoreS3SecretAccessKey) {\n      if (!env.blobstoreS3AccessKeyId || !env.blobstoreS3SecretAccessKey) {\n        throw new Error(\n          'Must specify both S3 access key id and secret access key blobstore env vars',\n        )\n      }\n      blobstoreCfg.credentials = {\n        accessKeyId: env.blobstoreS3AccessKeyId,\n        secretAccessKey: env.blobstoreS3SecretAccessKey,\n      }\n    }\n  } else if (env.blobstoreDiskLocation) {\n    blobstoreCfg = {\n      provider: 'disk',\n      location: env.blobstoreDiskLocation,\n      tempLocation: env.blobstoreDiskTmpLocation,\n    }\n  } else {\n    throw new Error('Must configure either S3 or disk blobstore')\n  }\n\n  // @NOTE when behind an entryway, this should be configured to match the entryway's domains\n  let serviceHandleDomains: string[]\n  if (env.serviceHandleDomains && env.serviceHandleDomains.length > 0) {\n    serviceHandleDomains = env.serviceHandleDomains\n  } else {\n    if (hostname === 'localhost') {\n      serviceHandleDomains = ['.test']\n    } else {\n      serviceHandleDomains = [`.${hostname}`]\n    }\n  }\n  const invalidDomain = serviceHandleDomains.find(\n    (domain) => domain.length < 1 || !domain.startsWith('.'),\n  )\n  if (invalidDomain) {\n    throw new Error(`Invalid handle domain: ${invalidDomain}`)\n  }\n\n  const identityCfg: ServerConfig['identity'] = {\n    plcUrl: env.didPlcUrl ?? 'https://plc.directory',\n    cacheMaxTTL: env.didCacheMaxTTL ?? DAY,\n    cacheStaleTTL: env.didCacheStaleTTL ?? HOUR,\n    resolverTimeout: env.resolverTimeout ?? 3 * SECOND,\n    recoveryDidKey: env.recoveryDidKey ?? null,\n    serviceHandleDomains,\n    handleBackupNameservers: env.handleBackupNameservers,\n    enableDidDocWithSession: !!env.enableDidDocWithSession,\n  }\n\n  let entrywayCfg: ServerConfig['entryway'] = null\n  if (env.entrywayUrl) {\n    assert(\n      env.entrywayJwtVerifyKeyK256PublicKeyHex &&\n        env.entrywayPlcRotationKey &&\n        env.entrywayDid,\n      'if entryway url is configured, must include all required entryway configuration',\n    )\n    entrywayCfg = {\n      url: env.entrywayUrl,\n      did: env.entrywayDid,\n      jwtPublicKeyHex: env.entrywayJwtVerifyKeyK256PublicKeyHex,\n      plcRotationKey: env.entrywayPlcRotationKey,\n    }\n  }\n\n  // default to being required if left undefined\n  const invitesCfg: ServerConfig['invites'] =\n    env.inviteRequired === false\n      ? {\n          required: false,\n        }\n      : {\n          required: true,\n          interval: env.inviteInterval ?? null,\n          epoch: env.inviteEpoch ?? 0,\n        }\n\n  let emailCfg: ServerConfig['email']\n  if (!env.emailFromAddress && !env.emailSmtpUrl) {\n    emailCfg = null\n  } else {\n    if (!env.emailFromAddress || !env.emailSmtpUrl) {\n      throw new Error(\n        'Partial email config, must set both emailFromAddress and emailSmtpUrl',\n      )\n    }\n    emailCfg = {\n      smtpUrl: env.emailSmtpUrl,\n      fromAddress: env.emailFromAddress,\n      disableConfirmationLink: env.emailDisableConfirmationLink ?? false,\n    }\n  }\n\n  let moderationEmailCfg: ServerConfig['moderationEmail']\n  if (!env.moderationEmailAddress && !env.moderationEmailSmtpUrl) {\n    moderationEmailCfg = null\n  } else {\n    if (!env.moderationEmailAddress || !env.moderationEmailSmtpUrl) {\n      throw new Error(\n        'Partial moderation email config, must set both emailFromAddress and emailSmtpUrl',\n      )\n    }\n    moderationEmailCfg = {\n      smtpUrl: env.moderationEmailSmtpUrl,\n      fromAddress: env.moderationEmailAddress,\n      disableConfirmationLink: false,\n    }\n  }\n\n  const subscriptionCfg: ServerConfig['subscription'] = {\n    maxBuffer: env.maxSubscriptionBuffer ?? 500,\n    repoBackfillLimitMs: env.repoBackfillLimitMs ?? DAY,\n  }\n\n  let bskyAppViewCfg: ServerConfig['bskyAppView'] = null\n  if (env.bskyAppViewUrl) {\n    assert(\n      env.bskyAppViewDid,\n      'if bsky appview service url is configured, must configure its did as well.',\n    )\n    bskyAppViewCfg = {\n      url: env.bskyAppViewUrl,\n      did: env.bskyAppViewDid,\n      cdnUrlPattern: env.bskyAppViewCdnUrlPattern,\n    }\n  }\n\n  let modServiceCfg: ServerConfig['modService'] = null\n  if (env.modServiceUrl) {\n    assert(\n      env.modServiceDid,\n      'if mod service url is configured, must configure its did as well.',\n    )\n    modServiceCfg = {\n      url: env.modServiceUrl,\n      did: env.modServiceDid,\n    }\n  }\n\n  let reportServiceCfg: ServerConfig['reportService'] = null\n  if (env.reportServiceUrl) {\n    assert(\n      env.reportServiceDid,\n      'if report service url is configured, must configure its did as well.',\n    )\n    reportServiceCfg = {\n      url: env.reportServiceUrl,\n      did: env.reportServiceDid,\n    }\n  }\n\n  // if there's a mod service, default report service into it\n  if (modServiceCfg && !reportServiceCfg) {\n    reportServiceCfg = modServiceCfg\n  }\n\n  const redisCfg: ServerConfig['redis'] = env.redisScratchAddress\n    ? {\n        address: env.redisScratchAddress,\n        password: env.redisScratchPassword,\n      }\n    : null\n\n  const rateLimitsCfg: ServerConfig['rateLimits'] = env.rateLimitsEnabled\n    ? {\n        enabled: true,\n        bypassKey: env.rateLimitBypassKey,\n        bypassIps: env.rateLimitBypassIps?.map((ipOrCidr) =>\n          ipOrCidr.split('/')[0]?.trim(),\n        ),\n      }\n    : { enabled: false }\n\n  const crawlersCfg: ServerConfig['crawlers'] = env.crawlers ?? []\n\n  const fetchCfg: ServerConfig['fetch'] = {\n    disableSsrfProtection: env.disableSsrfProtection ?? env.devMode ?? false,\n    maxResponseSize: env.fetchMaxResponseSize ?? 512 * 1024, // 512kb\n  }\n\n  const proxyCfg: ServerConfig['proxy'] = {\n    disableSsrfProtection: env.disableSsrfProtection ?? env.devMode ?? false,\n    allowHTTP2: env.proxyAllowHTTP2 ?? false,\n    headersTimeout: env.proxyHeadersTimeout ?? 10e3,\n    bodyTimeout: env.proxyBodyTimeout ?? 30e3,\n    maxResponseSize: env.proxyMaxResponseSize ?? 10 * 1024 * 1024, // 10mb\n    maxRetries:\n      env.proxyMaxRetries != null && env.proxyMaxRetries > 0\n        ? env.proxyMaxRetries\n        : 0,\n    preferCompressed: env.proxyPreferCompressed ?? false,\n  }\n\n  const brandingCfg = {\n    name: env.serviceName ?? `${hostname} PDS`,\n    logo: env.logoUrl,\n    colors: {\n      primary: env.primaryColor,\n\n      error: env.errorColor,\n      warning: env.warningColor,\n      info: env.infoColor,\n      success: env.successColor,\n    },\n    background: {\n      light: env.backgroundLightUrl,\n      dark: env.backgroundDarkUrl,\n    },\n    links: [\n      {\n        title: { en: 'Home', fr: 'Accueil' },\n        href: env.homeUrl,\n        rel: 'canonical' as const, // Prevents login page from being indexed\n      },\n      {\n        title: { en: 'Terms of Service' },\n        href: env.termsOfServiceUrl,\n        rel: 'terms-of-service' as const,\n      },\n      {\n        title: { en: 'Privacy Policy' },\n        href: env.privacyPolicyUrl,\n        rel: 'privacy-policy' as const,\n      },\n      {\n        title: { en: 'Support' },\n        href: env.supportUrl,\n        rel: 'help' as const,\n      },\n    ].filter(\n      <T extends { href?: string }>(f: T): f is T & { href: string } =>\n        f.href != null && f.href !== '',\n    ),\n  }\n\n  const oauthCfg: ServerConfig['oauth'] = entrywayCfg\n    ? {\n        issuer: entrywayCfg.url,\n        provider: undefined,\n      }\n    : {\n        issuer: serviceCfg.publicUrl,\n        provider: {\n          hcaptcha:\n            env.hcaptchaSiteKey &&\n            env.hcaptchaSecretKey &&\n            env.hcaptchaTokenSalt\n              ? {\n                  siteKey: env.hcaptchaSiteKey,\n                  secretKey: env.hcaptchaSecretKey,\n                  tokenSalt: env.hcaptchaTokenSalt,\n                }\n              : undefined,\n          branding: brandingCfg,\n          trustedClients: env.trustedOAuthClients,\n        },\n      }\n\n  const lexiconCfg: LexiconResolverConfig = {}\n\n  if (env.lexiconDidAuthority != null) {\n    ensureValidDid(env.lexiconDidAuthority)\n    lexiconCfg.didAuthority = env.lexiconDidAuthority\n  }\n\n  return {\n    service: serviceCfg,\n    db: dbCfg,\n    actorStore: actorStoreCfg,\n    blobstore: blobstoreCfg,\n    identity: identityCfg,\n    entryway: entrywayCfg,\n    invites: invitesCfg,\n    email: emailCfg,\n    moderationEmail: moderationEmailCfg,\n    subscription: subscriptionCfg,\n    bskyAppView: bskyAppViewCfg,\n    modService: modServiceCfg,\n    reportService: reportServiceCfg,\n    redis: redisCfg,\n    rateLimits: rateLimitsCfg,\n    crawlers: crawlersCfg,\n    fetch: fetchCfg,\n    lexicon: lexiconCfg,\n    proxy: proxyCfg,\n    branding: brandingCfg,\n    oauth: oauthCfg,\n  }\n}\n\nexport type ServerConfig = {\n  service: ServiceConfig\n  db: DatabaseConfig\n  actorStore: ActorStoreConfig\n  blobstore: S3BlobstoreConfig | DiskBlobstoreConfig\n  identity: IdentityConfig\n  entryway: EntrywayConfig | null\n  invites: InvitesConfig\n  email: EmailConfig | null\n  moderationEmail: EmailConfig | null\n  subscription: SubscriptionConfig\n  bskyAppView: BksyAppViewConfig | null\n  modService: ModServiceConfig | null\n  reportService: ReportServiceConfig | null\n  redis: RedisScratchConfig | null\n  rateLimits: RateLimitsConfig\n  crawlers: string[]\n  fetch: FetchConfig\n  proxy: ProxyConfig\n  branding: BrandingConfig\n  oauth: OAuthConfig\n  lexicon: LexiconResolverConfig\n}\n\nexport type ServiceConfig = {\n  port: number\n  hostname: string\n  publicUrl: string\n  did: DidString\n  version: string\n  privacyPolicyUrl?: string\n  termsOfServiceUrl?: string\n  acceptingImports: boolean\n  maxImportSize?: number\n  blobUploadLimit: number\n  contactEmailAddress?: string\n  devMode: boolean\n}\n\nexport type DatabaseConfig = {\n  accountDbLoc: string\n  sequencerDbLoc: string\n  didCacheDbLoc: string\n  disableWalAutoCheckpoint: boolean\n}\n\nexport type ActorStoreConfig = {\n  directory: string\n  cacheSize: number\n  disableWalAutoCheckpoint: boolean\n}\n\nexport type S3BlobstoreConfig = {\n  provider: 's3'\n  bucket: string\n  region?: string\n  endpoint?: string\n  forcePathStyle?: boolean\n  uploadTimeoutMs?: number\n  requestTimeoutMs?: number\n  credentials?: {\n    accessKeyId: string\n    secretAccessKey: string\n  }\n}\n\nexport type DiskBlobstoreConfig = {\n  provider: 'disk'\n  location: string\n  tempLocation?: string\n}\n\nexport type IdentityConfig = {\n  plcUrl: string\n  /**\n   * Bounds each individual identity resolution attempt. Note that\n   * `safeFetch`'s own 10s timeout acts as an upper backstop, so values above\n   * 10s are effectively capped.\n   */\n  resolverTimeout: number\n  cacheStaleTTL: number\n  cacheMaxTTL: number\n  recoveryDidKey: string | null\n  serviceHandleDomains: string[]\n  handleBackupNameservers?: string[]\n  enableDidDocWithSession: boolean\n}\n\nexport type EntrywayConfig = {\n  url: string\n  did: string\n  jwtPublicKeyHex: string\n  plcRotationKey: string\n}\n\nexport type FetchConfig = {\n  disableSsrfProtection: boolean\n  maxResponseSize: number\n}\n\nexport type ProxyConfig = {\n  disableSsrfProtection: boolean\n  allowHTTP2: boolean\n  headersTimeout: number\n  bodyTimeout: number\n  maxResponseSize: number\n  maxRetries: number\n\n  /**\n   * When proxying requests that might get intercepted (for read-after-write) we\n   * negotiate the encoding based on the client's preferences. We will however\n   * use or own weights in order to be able to better control if the PDS will\n   * need to perform content decoding. This settings allows to prefer compressed\n   * content over uncompressed one.\n   */\n  preferCompressed: boolean\n}\n\nexport type OAuthConfig = {\n  issuer: string\n  provider?: {\n    hcaptcha?: HcaptchaConfig\n    branding: BrandingConfig\n    trustedClients?: string[]\n  }\n}\n\nexport type LexiconResolverConfig = {\n  didAuthority?: `did:${string}:${string}`\n}\n\nexport type InvitesConfig =\n  | {\n      required: true\n      interval: number | null\n      epoch: number\n    }\n  | {\n      required: false\n    }\n\nexport type EmailConfig = {\n  smtpUrl: string\n  fromAddress: string\n  disableConfirmationLink: boolean\n}\n\nexport type SubscriptionConfig = {\n  maxBuffer: number\n  repoBackfillLimitMs: number\n}\n\nexport type RedisScratchConfig = {\n  address: string\n  password?: string\n}\n\nexport type RateLimitsConfig =\n  | {\n      enabled: true\n      bypassKey?: string\n      bypassIps?: string[]\n    }\n  | { enabled: false }\n\nexport type BksyAppViewConfig = {\n  url: string\n  did: string\n  cdnUrlPattern?: string\n}\n\nexport type ModServiceConfig = {\n  url: string\n  did: string\n}\n\nexport type ReportServiceConfig = {\n  url: string\n  did: string\n}\n"]}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/config/config.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAA;AAChC,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAKnD,OAAO,EAAkB,cAAc,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5E,OAAO,GAAG,MAAM,oBAAoB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AAK1D,iCAAiC;AACjC,gEAAgE;AAEhE,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,GAAsB,EAAgB,EAAE;IAC/D,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,IAAI,CAAA;IAC7B,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,IAAI,WAAW,CAAA;IAC5C,MAAM,SAAS,GACb,QAAQ,KAAK,WAAW;QACtB,CAAC,CAAC,oBAAoB,IAAI,EAAE;QAC5B,CAAC,CAAC,WAAW,QAAQ,EAAE,CAAA;IAC3B,MAAM,GAAG,GAAG,GAAG,CAAC,UAAU,IAAI,WAAW,QAAQ,EAAE,CAAA;IAEnD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,EAAE,CAAC,CAAA;IAChD,CAAC;IAED,MAAM,UAAU,GAA4B;QAC1C,IAAI;QACJ,QAAQ;QACR,SAAS;QACT,GAAG;QACH,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO;QACnC,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;QACtC,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;QACxC,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;QAC5C,gBAAgB,EAAE,GAAG,CAAC,gBAAgB,IAAI,IAAI;QAC9C,aAAa,EAAE,GAAG,CAAC,aAAa;QAChC,eAAe,EAAE,GAAG,CAAC,eAAe,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,MAAM;QAC/D,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,KAAK;KAC9B,CAAA;IAED,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAE;QAC7B,OAAO,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACtE,CAAC,CAAA;IAED,MAAM,wBAAwB,GAAG,GAAG,CAAC,wBAAwB,IAAI,KAAK,CAAA;IAEtE,MAAM,KAAK,GAAuB;QAChC,YAAY,EAAE,GAAG,CAAC,iBAAiB,IAAI,KAAK,CAAC,gBAAgB,CAAC;QAC9D,cAAc,EAAE,GAAG,CAAC,mBAAmB,IAAI,KAAK,CAAC,kBAAkB,CAAC;QACpE,aAAa,EAAE,GAAG,CAAC,kBAAkB,IAAI,KAAK,CAAC,kBAAkB,CAAC;QAClE,wBAAwB;KACzB,CAAA;IAED,MAAM,aAAa,GAA+B;QAChD,SAAS,EAAE,GAAG,CAAC,mBAAmB,IAAI,KAAK,CAAC,QAAQ,CAAC;QACrD,SAAS,EAAE,GAAG,CAAC,mBAAmB,IAAI,GAAG;QACzC,wBAAwB;KACzB,CAAA;IAED,IAAI,YAAuC,CAAA;IAC3C,IAAI,GAAG,CAAC,iBAAiB,IAAI,GAAG,CAAC,qBAAqB,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;IACnE,CAAC;IACD,IAAI,GAAG,CAAC,iBAAiB,EAAE,CAAC;QAC1B,YAAY,GAAG;YACb,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,GAAG,CAAC,iBAAiB;YAC7B,eAAe,EAAE,GAAG,CAAC,0BAA0B,IAAI,KAAK;YACxD,gBAAgB,EAAE,GAAG,CAAC,2BAA2B;YACjD,MAAM,EAAE,GAAG,CAAC,iBAAiB;YAC7B,QAAQ,EAAE,GAAG,CAAC,mBAAmB;YACjC,cAAc,EAAE,GAAG,CAAC,yBAAyB;SAC9C,CAAA;QACD,IAAI,GAAG,CAAC,sBAAsB,IAAI,GAAG,CAAC,0BAA0B,EAAE,CAAC;YACjE,IAAI,CAAC,GAAG,CAAC,sBAAsB,IAAI,CAAC,GAAG,CAAC,0BAA0B,EAAE,CAAC;gBACnE,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAA;YACH,CAAC;YACD,YAAY,CAAC,WAAW,GAAG;gBACzB,WAAW,EAAE,GAAG,CAAC,sBAAsB;gBACvC,eAAe,EAAE,GAAG,CAAC,0BAA0B;aAChD,CAAA;QACH,CAAC;IACH,CAAC;SAAM,IAAI,GAAG,CAAC,qBAAqB,EAAE,CAAC;QACrC,YAAY,GAAG;YACb,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,GAAG,CAAC,qBAAqB;YACnC,YAAY,EAAE,GAAG,CAAC,wBAAwB;SAC3C,CAAA;IACH,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;IAC/D,CAAC;IAED,2FAA2F;IAC3F,IAAI,oBAA8B,CAAA;IAClC,IAAI,GAAG,CAAC,oBAAoB,IAAI,GAAG,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpE,oBAAoB,GAAG,GAAG,CAAC,oBAAoB,CAAA;IACjD,CAAC;SAAM,CAAC;QACN,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;YAC7B,oBAAoB,GAAG,CAAC,OAAO,CAAC,CAAA;QAClC,CAAC;aAAM,CAAC;YACN,oBAAoB,GAAG,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAA;QACzC,CAAC;IACH,CAAC;IACD,MAAM,aAAa,GAAG,oBAAoB,CAAC,IAAI,CAC7C,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CACzD,CAAA;IACD,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,0BAA0B,aAAa,EAAE,CAAC,CAAA;IAC5D,CAAC;IAED,MAAM,WAAW,GAA6B;QAC5C,MAAM,EAAE,GAAG,CAAC,SAAS,IAAI,uBAAuB;QAChD,WAAW,EAAE,GAAG,CAAC,cAAc,IAAI,GAAG;QACtC,aAAa,EAAE,GAAG,CAAC,gBAAgB,IAAI,IAAI;QAC3C,eAAe,EAAE,GAAG,CAAC,eAAe,IAAI,CAAC,GAAG,MAAM;QAClD,cAAc,EAAE,GAAG,CAAC,cAAc,IAAI,IAAI;QAC1C,oBAAoB;QACpB,uBAAuB,EAAE,GAAG,CAAC,uBAAuB;QACpD,uBAAuB,EAAE,CAAC,CAAC,GAAG,CAAC,uBAAuB;KACvD,CAAA;IAED,IAAI,WAAW,GAA6B,IAAI,CAAA;IAChD,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;QACpB,MAAM,CACJ,GAAG,CAAC,oCAAoC;YACtC,GAAG,CAAC,sBAAsB;YAC1B,GAAG,CAAC,WAAW,EACjB,iFAAiF,CAClF,CAAA;QACD,WAAW,GAAG;YACZ,GAAG,EAAE,GAAG,CAAC,WAAW;YACpB,MAAM,EAAE,GAAG,CAAC,cAAc,IAAI,GAAG,CAAC,WAAW;YAC7C,GAAG,EAAE,GAAG,CAAC,WAAW;YACpB,eAAe,EAAE,GAAG,CAAC,oCAAoC;YACzD,cAAc,EAAE,GAAG,CAAC,sBAAsB;YAC1C,kBAAkB,EAAE,GAAG,CAAC,0BAA0B,IAAI,KAAK;SAC5D,CAAA;IACH,CAAC;IAED,8CAA8C;IAC9C,MAAM,UAAU,GACd,GAAG,CAAC,cAAc,KAAK,KAAK;QAC1B,CAAC,CAAC;YACE,QAAQ,EAAE,KAAK;SAChB;QACH,CAAC,CAAC;YACE,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,GAAG,CAAC,cAAc,IAAI,IAAI;YACpC,KAAK,EAAE,GAAG,CAAC,WAAW,IAAI,CAAC;SAC5B,CAAA;IAEP,IAAI,QAA+B,CAAA;IACnC,IAAI,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;QAC/C,QAAQ,GAAG,IAAI,CAAA;IACjB,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAA;QACH,CAAC;QACD,QAAQ,GAAG;YACT,OAAO,EAAE,GAAG,CAAC,YAAY;YACzB,WAAW,EAAE,GAAG,CAAC,gBAAgB;YACjC,uBAAuB,EAAE,GAAG,CAAC,4BAA4B,IAAI,KAAK;SACnE,CAAA;IACH,CAAC;IAED,IAAI,kBAAmD,CAAA;IACvD,IAAI,CAAC,GAAG,CAAC,sBAAsB,IAAI,CAAC,GAAG,CAAC,sBAAsB,EAAE,CAAC;QAC/D,kBAAkB,GAAG,IAAI,CAAA;IAC3B,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,GAAG,CAAC,sBAAsB,IAAI,CAAC,GAAG,CAAC,sBAAsB,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CACb,kFAAkF,CACnF,CAAA;QACH,CAAC;QACD,kBAAkB,GAAG;YACnB,OAAO,EAAE,GAAG,CAAC,sBAAsB;YACnC,WAAW,EAAE,GAAG,CAAC,sBAAsB;YACvC,uBAAuB,EAAE,KAAK;SAC/B,CAAA;IACH,CAAC;IAED,MAAM,eAAe,GAAiC;QACpD,SAAS,EAAE,GAAG,CAAC,qBAAqB,IAAI,GAAG;QAC3C,mBAAmB,EAAE,GAAG,CAAC,mBAAmB,IAAI,GAAG;KACpD,CAAA;IAED,IAAI,cAAc,GAAgC,IAAI,CAAA;IACtD,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;QACvB,MAAM,CACJ,GAAG,CAAC,cAAc,EAClB,4EAA4E,CAC7E,CAAA;QACD,cAAc,GAAG;YACf,GAAG,EAAE,GAAG,CAAC,cAAc;YACvB,GAAG,EAAE,GAAG,CAAC,cAAc;YACvB,aAAa,EAAE,GAAG,CAAC,wBAAwB;SAC5C,CAAA;IACH,CAAC;IAED,IAAI,aAAa,GAA+B,IAAI,CAAA;IACpD,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;QACtB,MAAM,CACJ,GAAG,CAAC,aAAa,EACjB,mEAAmE,CACpE,CAAA;QACD,aAAa,GAAG;YACd,GAAG,EAAE,GAAG,CAAC,aAAa;YACtB,GAAG,EAAE,GAAG,CAAC,aAAa;SACvB,CAAA;IACH,CAAC;IAED,IAAI,gBAAgB,GAAkC,IAAI,CAAA;IAC1D,IAAI,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACzB,MAAM,CACJ,GAAG,CAAC,gBAAgB,EACpB,sEAAsE,CACvE,CAAA;QACD,gBAAgB,GAAG;YACjB,GAAG,EAAE,GAAG,CAAC,gBAAgB;YACzB,GAAG,EAAE,GAAG,CAAC,gBAAgB;SAC1B,CAAA;IACH,CAAC;IAED,2DAA2D;IAC3D,IAAI,aAAa,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACvC,gBAAgB,GAAG,aAAa,CAAA;IAClC,CAAC;IAED,MAAM,QAAQ,GAA0B,GAAG,CAAC,mBAAmB;QAC7D,CAAC,CAAC;YACE,OAAO,EAAE,GAAG,CAAC,mBAAmB;YAChC,QAAQ,EAAE,GAAG,CAAC,oBAAoB;SACnC;QACH,CAAC,CAAC,IAAI,CAAA;IAER,MAAM,aAAa,GAA+B,GAAG,CAAC,iBAAiB;QACrE,CAAC,CAAC;YACE,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,GAAG,CAAC,kBAAkB;YACjC,SAAS,EAAE,GAAG,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAClD,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAC/B;SACF;QACH,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;IAEtB,MAAM,WAAW,GAA6B,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAA;IAEhE,MAAM,QAAQ,GAA0B;QACtC,qBAAqB,EAAE,GAAG,CAAC,qBAAqB,IAAI,GAAG,CAAC,OAAO,IAAI,KAAK;QACxE,eAAe,EAAE,GAAG,CAAC,oBAAoB,IAAI,GAAG,GAAG,IAAI,EAAE,QAAQ;KAClE,CAAA;IAED,MAAM,QAAQ,GAA0B;QACtC,qBAAqB,EAAE,GAAG,CAAC,qBAAqB,IAAI,GAAG,CAAC,OAAO,IAAI,KAAK;QACxE,UAAU,EAAE,GAAG,CAAC,eAAe,IAAI,KAAK;QACxC,cAAc,EAAE,GAAG,CAAC,mBAAmB,IAAI,IAAI;QAC/C,WAAW,EAAE,GAAG,CAAC,gBAAgB,IAAI,IAAI;QACzC,eAAe,EAAE,GAAG,CAAC,oBAAoB,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,OAAO;QACtE,UAAU,EACR,GAAG,CAAC,eAAe,IAAI,IAAI,IAAI,GAAG,CAAC,eAAe,GAAG,CAAC;YACpD,CAAC,CAAC,GAAG,CAAC,eAAe;YACrB,CAAC,CAAC,CAAC;QACP,gBAAgB,EAAE,GAAG,CAAC,qBAAqB,IAAI,KAAK;KACrD,CAAA;IAED,MAAM,WAAW,GAAG;QAClB,IAAI,EAAE,GAAG,CAAC,WAAW,IAAI,GAAG,QAAQ,MAAM;QAC1C,IAAI,EAAE,GAAG,CAAC,OAAO;QACjB,MAAM,EAAE;YACN,OAAO,EAAE,GAAG,CAAC,YAAY;YAEzB,KAAK,EAAE,GAAG,CAAC,UAAU;YACrB,OAAO,EAAE,GAAG,CAAC,YAAY;YACzB,IAAI,EAAE,GAAG,CAAC,SAAS;YACnB,OAAO,EAAE,GAAG,CAAC,YAAY;SAC1B;QACD,UAAU,EAAE;YACV,KAAK,EAAE,GAAG,CAAC,kBAAkB;YAC7B,IAAI,EAAE,GAAG,CAAC,iBAAiB;SAC5B;QACD,KAAK,EAAE;YACL;gBACE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE;gBACpC,IAAI,EAAE,GAAG,CAAC,OAAO;gBACjB,GAAG,EAAE,WAAoB,EAAE,yCAAyC;aACrE;YACD;gBACE,KAAK,EAAE,EAAE,EAAE,EAAE,kBAAkB,EAAE;gBACjC,IAAI,EAAE,GAAG,CAAC,iBAAiB;gBAC3B,GAAG,EAAE,kBAA2B;aACjC;YACD;gBACE,KAAK,EAAE,EAAE,EAAE,EAAE,gBAAgB,EAAE;gBAC/B,IAAI,EAAE,GAAG,CAAC,gBAAgB;gBAC1B,GAAG,EAAE,gBAAyB;aAC/B;YACD;gBACE,KAAK,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE;gBACxB,IAAI,EAAE,GAAG,CAAC,UAAU;gBACpB,GAAG,EAAE,MAAe;aACrB;SACF,CAAC,MAAM,CACN,CAA8B,CAAI,EAA6B,EAAE,CAC/D,CAAC,CAAC,IAAI,IAAI,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,EAAE,CAClC;KACF,CAAA;IAED,MAAM,QAAQ,GAA0B,WAAW;QACjD,CAAC,CAAC;YACE,MAAM,EAAE,WAAW,CAAC,GAAG;YACvB,QAAQ,EAAE,SAAS;SACpB;QACH,CAAC,CAAC;YACE,MAAM,EAAE,UAAU,CAAC,SAAS;YAC5B,QAAQ,EAAE;gBACR,QAAQ,EACN,GAAG,CAAC,eAAe;oBACnB,GAAG,CAAC,iBAAiB;oBACrB,GAAG,CAAC,iBAAiB;oBACnB,CAAC,CAAC;wBACE,OAAO,EAAE,GAAG,CAAC,eAAe;wBAC5B,SAAS,EAAE,GAAG,CAAC,iBAAiB;wBAChC,SAAS,EAAE,GAAG,CAAC,iBAAiB;qBACjC;oBACH,CAAC,CAAC,SAAS;gBACf,QAAQ,EAAE,WAAW;gBACrB,cAAc,EAAE,GAAG,CAAC,mBAAmB;aACxC;SACF,CAAA;IAEL,MAAM,UAAU,GAA0B,EAAE,CAAA;IAE5C,IAAI,GAAG,CAAC,mBAAmB,IAAI,IAAI,EAAE,CAAC;QACpC,cAAc,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;QACvC,UAAU,CAAC,YAAY,GAAG,GAAG,CAAC,mBAAmB,CAAA;IACnD,CAAC;IAED,OAAO;QACL,OAAO,EAAE,UAAU;QACnB,EAAE,EAAE,KAAK;QACT,UAAU,EAAE,aAAa;QACzB,SAAS,EAAE,YAAY;QACvB,QAAQ,EAAE,WAAW;QACrB,QAAQ,EAAE,WAAW;QACrB,OAAO,EAAE,UAAU;QACnB,KAAK,EAAE,QAAQ;QACf,eAAe,EAAE,kBAAkB;QACnC,YAAY,EAAE,eAAe;QAC7B,WAAW,EAAE,cAAc;QAC3B,UAAU,EAAE,aAAa;QACzB,aAAa,EAAE,gBAAgB;QAC/B,KAAK,EAAE,QAAQ;QACf,UAAU,EAAE,aAAa;QACzB,QAAQ,EAAE,WAAW;QACrB,KAAK,EAAE,QAAQ;QACf,OAAO,EAAE,UAAU;QACnB,KAAK,EAAE,QAAQ;QACf,QAAQ,EAAE,WAAW;QACrB,KAAK,EAAE,QAAQ;KAChB,CAAA;AACH,CAAC,CAAA","sourcesContent":["import assert from 'node:assert'\nimport path from 'node:path'\nimport { DAY, HOUR, SECOND } from '@atproto/common'\nimport type {\n  BrandingConfig,\n  HcaptchaConfig,\n} from '@atproto/oauth-provider/provider'\nimport { type DidString, ensureValidDid, isValidDid } from '@atproto/syntax'\nimport pkg from '../../package.json' with { type: 'json' }\nimport type { ServerEnvironment } from './env.js'\n\nexport type { BrandingConfig }\n\n// off-config but still from env:\n// logging: LOG_LEVEL, LOG_SYSTEMS, LOG_ENABLED, LOG_DESTINATION\n\nexport const envToCfg = (env: ServerEnvironment): ServerConfig => {\n  const port = env.port ?? 2583\n  const hostname = env.hostname ?? 'localhost'\n  const publicUrl =\n    hostname === 'localhost'\n      ? `http://localhost:${port}`\n      : `https://${hostname}`\n  const did = env.serviceDid ?? `did:web:${hostname}`\n\n  if (!isValidDid(did)) {\n    throw new Error(`Invalid service DID: ${did}`)\n  }\n\n  const serviceCfg: ServerConfig['service'] = {\n    port,\n    hostname,\n    publicUrl,\n    did,\n    version: env.version || pkg.version,\n    privacyPolicyUrl: env.privacyPolicyUrl,\n    termsOfServiceUrl: env.termsOfServiceUrl,\n    contactEmailAddress: env.contactEmailAddress,\n    acceptingImports: env.acceptingImports ?? true,\n    maxImportSize: env.maxImportSize,\n    blobUploadLimit: env.blobUploadLimit ?? 5 * 1024 * 1024, // 5mb\n    devMode: env.devMode ?? false,\n  }\n\n  const dbLoc = (name: string) => {\n    return env.dataDirectory ? path.join(env.dataDirectory, name) : name\n  }\n\n  const disableWalAutoCheckpoint = env.disableWalAutoCheckpoint ?? false\n\n  const dbCfg: ServerConfig['db'] = {\n    accountDbLoc: env.accountDbLocation ?? dbLoc('account.sqlite'),\n    sequencerDbLoc: env.sequencerDbLocation ?? dbLoc('sequencer.sqlite'),\n    didCacheDbLoc: env.didCacheDbLocation ?? dbLoc('did_cache.sqlite'),\n    disableWalAutoCheckpoint,\n  }\n\n  const actorStoreCfg: ServerConfig['actorStore'] = {\n    directory: env.actorStoreDirectory ?? dbLoc('actors'),\n    cacheSize: env.actorStoreCacheSize ?? 100,\n    disableWalAutoCheckpoint,\n  }\n\n  let blobstoreCfg: ServerConfig['blobstore']\n  if (env.blobstoreS3Bucket && env.blobstoreDiskLocation) {\n    throw new Error('Cannot set both S3 and disk blobstore env vars')\n  }\n  if (env.blobstoreS3Bucket) {\n    blobstoreCfg = {\n      provider: 's3',\n      bucket: env.blobstoreS3Bucket,\n      uploadTimeoutMs: env.blobstoreS3UploadTimeoutMs || 20000,\n      requestTimeoutMs: env.blobstoreS3RequestTimeoutMs,\n      region: env.blobstoreS3Region,\n      endpoint: env.blobstoreS3Endpoint,\n      forcePathStyle: env.blobstoreS3ForcePathStyle,\n    }\n    if (env.blobstoreS3AccessKeyId || env.blobstoreS3SecretAccessKey) {\n      if (!env.blobstoreS3AccessKeyId || !env.blobstoreS3SecretAccessKey) {\n        throw new Error(\n          'Must specify both S3 access key id and secret access key blobstore env vars',\n        )\n      }\n      blobstoreCfg.credentials = {\n        accessKeyId: env.blobstoreS3AccessKeyId,\n        secretAccessKey: env.blobstoreS3SecretAccessKey,\n      }\n    }\n  } else if (env.blobstoreDiskLocation) {\n    blobstoreCfg = {\n      provider: 'disk',\n      location: env.blobstoreDiskLocation,\n      tempLocation: env.blobstoreDiskTmpLocation,\n    }\n  } else {\n    throw new Error('Must configure either S3 or disk blobstore')\n  }\n\n  // @NOTE when behind an entryway, this should be configured to match the entryway's domains\n  let serviceHandleDomains: string[]\n  if (env.serviceHandleDomains && env.serviceHandleDomains.length > 0) {\n    serviceHandleDomains = env.serviceHandleDomains\n  } else {\n    if (hostname === 'localhost') {\n      serviceHandleDomains = ['.test']\n    } else {\n      serviceHandleDomains = [`.${hostname}`]\n    }\n  }\n  const invalidDomain = serviceHandleDomains.find(\n    (domain) => domain.length < 1 || !domain.startsWith('.'),\n  )\n  if (invalidDomain) {\n    throw new Error(`Invalid handle domain: ${invalidDomain}`)\n  }\n\n  const identityCfg: ServerConfig['identity'] = {\n    plcUrl: env.didPlcUrl ?? 'https://plc.directory',\n    cacheMaxTTL: env.didCacheMaxTTL ?? DAY,\n    cacheStaleTTL: env.didCacheStaleTTL ?? HOUR,\n    resolverTimeout: env.resolverTimeout ?? 3 * SECOND,\n    recoveryDidKey: env.recoveryDidKey ?? null,\n    serviceHandleDomains,\n    handleBackupNameservers: env.handleBackupNameservers,\n    enableDidDocWithSession: !!env.enableDidDocWithSession,\n  }\n\n  let entrywayCfg: ServerConfig['entryway'] = null\n  if (env.entrywayUrl) {\n    assert(\n      env.entrywayJwtVerifyKeyK256PublicKeyHex &&\n        env.entrywayPlcRotationKey &&\n        env.entrywayDid,\n      'if entryway url is configured, must include all required entryway configuration',\n    )\n    entrywayCfg = {\n      url: env.entrywayUrl,\n      apiUrl: env.entrywayApiUrl ?? env.entrywayUrl,\n      did: env.entrywayDid,\n      jwtPublicKeyHex: env.entrywayJwtVerifyKeyK256PublicKeyHex,\n      plcRotationKey: env.entrywayPlcRotationKey,\n      requireServiceAuth: env.entrywayRequireServiceAuth ?? false,\n    }\n  }\n\n  // default to being required if left undefined\n  const invitesCfg: ServerConfig['invites'] =\n    env.inviteRequired === false\n      ? {\n          required: false,\n        }\n      : {\n          required: true,\n          interval: env.inviteInterval ?? null,\n          epoch: env.inviteEpoch ?? 0,\n        }\n\n  let emailCfg: ServerConfig['email']\n  if (!env.emailFromAddress && !env.emailSmtpUrl) {\n    emailCfg = null\n  } else {\n    if (!env.emailFromAddress || !env.emailSmtpUrl) {\n      throw new Error(\n        'Partial email config, must set both emailFromAddress and emailSmtpUrl',\n      )\n    }\n    emailCfg = {\n      smtpUrl: env.emailSmtpUrl,\n      fromAddress: env.emailFromAddress,\n      disableConfirmationLink: env.emailDisableConfirmationLink ?? false,\n    }\n  }\n\n  let moderationEmailCfg: ServerConfig['moderationEmail']\n  if (!env.moderationEmailAddress && !env.moderationEmailSmtpUrl) {\n    moderationEmailCfg = null\n  } else {\n    if (!env.moderationEmailAddress || !env.moderationEmailSmtpUrl) {\n      throw new Error(\n        'Partial moderation email config, must set both emailFromAddress and emailSmtpUrl',\n      )\n    }\n    moderationEmailCfg = {\n      smtpUrl: env.moderationEmailSmtpUrl,\n      fromAddress: env.moderationEmailAddress,\n      disableConfirmationLink: false,\n    }\n  }\n\n  const subscriptionCfg: ServerConfig['subscription'] = {\n    maxBuffer: env.maxSubscriptionBuffer ?? 500,\n    repoBackfillLimitMs: env.repoBackfillLimitMs ?? DAY,\n  }\n\n  let bskyAppViewCfg: ServerConfig['bskyAppView'] = null\n  if (env.bskyAppViewUrl) {\n    assert(\n      env.bskyAppViewDid,\n      'if bsky appview service url is configured, must configure its did as well.',\n    )\n    bskyAppViewCfg = {\n      url: env.bskyAppViewUrl,\n      did: env.bskyAppViewDid,\n      cdnUrlPattern: env.bskyAppViewCdnUrlPattern,\n    }\n  }\n\n  let modServiceCfg: ServerConfig['modService'] = null\n  if (env.modServiceUrl) {\n    assert(\n      env.modServiceDid,\n      'if mod service url is configured, must configure its did as well.',\n    )\n    modServiceCfg = {\n      url: env.modServiceUrl,\n      did: env.modServiceDid,\n    }\n  }\n\n  let reportServiceCfg: ServerConfig['reportService'] = null\n  if (env.reportServiceUrl) {\n    assert(\n      env.reportServiceDid,\n      'if report service url is configured, must configure its did as well.',\n    )\n    reportServiceCfg = {\n      url: env.reportServiceUrl,\n      did: env.reportServiceDid,\n    }\n  }\n\n  // if there's a mod service, default report service into it\n  if (modServiceCfg && !reportServiceCfg) {\n    reportServiceCfg = modServiceCfg\n  }\n\n  const redisCfg: ServerConfig['redis'] = env.redisScratchAddress\n    ? {\n        address: env.redisScratchAddress,\n        password: env.redisScratchPassword,\n      }\n    : null\n\n  const rateLimitsCfg: ServerConfig['rateLimits'] = env.rateLimitsEnabled\n    ? {\n        enabled: true,\n        bypassKey: env.rateLimitBypassKey,\n        bypassIps: env.rateLimitBypassIps?.map((ipOrCidr) =>\n          ipOrCidr.split('/')[0]?.trim(),\n        ),\n      }\n    : { enabled: false }\n\n  const crawlersCfg: ServerConfig['crawlers'] = env.crawlers ?? []\n\n  const fetchCfg: ServerConfig['fetch'] = {\n    disableSsrfProtection: env.disableSsrfProtection ?? env.devMode ?? false,\n    maxResponseSize: env.fetchMaxResponseSize ?? 512 * 1024, // 512kb\n  }\n\n  const proxyCfg: ServerConfig['proxy'] = {\n    disableSsrfProtection: env.disableSsrfProtection ?? env.devMode ?? false,\n    allowHTTP2: env.proxyAllowHTTP2 ?? false,\n    headersTimeout: env.proxyHeadersTimeout ?? 10e3,\n    bodyTimeout: env.proxyBodyTimeout ?? 30e3,\n    maxResponseSize: env.proxyMaxResponseSize ?? 10 * 1024 * 1024, // 10mb\n    maxRetries:\n      env.proxyMaxRetries != null && env.proxyMaxRetries > 0\n        ? env.proxyMaxRetries\n        : 0,\n    preferCompressed: env.proxyPreferCompressed ?? false,\n  }\n\n  const brandingCfg = {\n    name: env.serviceName ?? `${hostname} PDS`,\n    logo: env.logoUrl,\n    colors: {\n      primary: env.primaryColor,\n\n      error: env.errorColor,\n      warning: env.warningColor,\n      info: env.infoColor,\n      success: env.successColor,\n    },\n    background: {\n      light: env.backgroundLightUrl,\n      dark: env.backgroundDarkUrl,\n    },\n    links: [\n      {\n        title: { en: 'Home', fr: 'Accueil' },\n        href: env.homeUrl,\n        rel: 'canonical' as const, // Prevents login page from being indexed\n      },\n      {\n        title: { en: 'Terms of Service' },\n        href: env.termsOfServiceUrl,\n        rel: 'terms-of-service' as const,\n      },\n      {\n        title: { en: 'Privacy Policy' },\n        href: env.privacyPolicyUrl,\n        rel: 'privacy-policy' as const,\n      },\n      {\n        title: { en: 'Support' },\n        href: env.supportUrl,\n        rel: 'help' as const,\n      },\n    ].filter(\n      <T extends { href?: string }>(f: T): f is T & { href: string } =>\n        f.href != null && f.href !== '',\n    ),\n  }\n\n  const oauthCfg: ServerConfig['oauth'] = entrywayCfg\n    ? {\n        issuer: entrywayCfg.url,\n        provider: undefined,\n      }\n    : {\n        issuer: serviceCfg.publicUrl,\n        provider: {\n          hcaptcha:\n            env.hcaptchaSiteKey &&\n            env.hcaptchaSecretKey &&\n            env.hcaptchaTokenSalt\n              ? {\n                  siteKey: env.hcaptchaSiteKey,\n                  secretKey: env.hcaptchaSecretKey,\n                  tokenSalt: env.hcaptchaTokenSalt,\n                }\n              : undefined,\n          branding: brandingCfg,\n          trustedClients: env.trustedOAuthClients,\n        },\n      }\n\n  const lexiconCfg: LexiconResolverConfig = {}\n\n  if (env.lexiconDidAuthority != null) {\n    ensureValidDid(env.lexiconDidAuthority)\n    lexiconCfg.didAuthority = env.lexiconDidAuthority\n  }\n\n  return {\n    service: serviceCfg,\n    db: dbCfg,\n    actorStore: actorStoreCfg,\n    blobstore: blobstoreCfg,\n    identity: identityCfg,\n    entryway: entrywayCfg,\n    invites: invitesCfg,\n    email: emailCfg,\n    moderationEmail: moderationEmailCfg,\n    subscription: subscriptionCfg,\n    bskyAppView: bskyAppViewCfg,\n    modService: modServiceCfg,\n    reportService: reportServiceCfg,\n    redis: redisCfg,\n    rateLimits: rateLimitsCfg,\n    crawlers: crawlersCfg,\n    fetch: fetchCfg,\n    lexicon: lexiconCfg,\n    proxy: proxyCfg,\n    branding: brandingCfg,\n    oauth: oauthCfg,\n  }\n}\n\nexport type ServerConfig = {\n  service: ServiceConfig\n  db: DatabaseConfig\n  actorStore: ActorStoreConfig\n  blobstore: S3BlobstoreConfig | DiskBlobstoreConfig\n  identity: IdentityConfig\n  entryway: EntrywayConfig | null\n  invites: InvitesConfig\n  email: EmailConfig | null\n  moderationEmail: EmailConfig | null\n  subscription: SubscriptionConfig\n  bskyAppView: BksyAppViewConfig | null\n  modService: ModServiceConfig | null\n  reportService: ReportServiceConfig | null\n  redis: RedisScratchConfig | null\n  rateLimits: RateLimitsConfig\n  crawlers: string[]\n  fetch: FetchConfig\n  proxy: ProxyConfig\n  branding: BrandingConfig\n  oauth: OAuthConfig\n  lexicon: LexiconResolverConfig\n}\n\nexport type ServiceConfig = {\n  port: number\n  hostname: string\n  publicUrl: string\n  did: DidString\n  version: string\n  privacyPolicyUrl?: string\n  termsOfServiceUrl?: string\n  acceptingImports: boolean\n  maxImportSize?: number\n  blobUploadLimit: number\n  contactEmailAddress?: string\n  devMode: boolean\n}\n\nexport type DatabaseConfig = {\n  accountDbLoc: string\n  sequencerDbLoc: string\n  didCacheDbLoc: string\n  disableWalAutoCheckpoint: boolean\n}\n\nexport type ActorStoreConfig = {\n  directory: string\n  cacheSize: number\n  disableWalAutoCheckpoint: boolean\n}\n\nexport type S3BlobstoreConfig = {\n  provider: 's3'\n  bucket: string\n  region?: string\n  endpoint?: string\n  forcePathStyle?: boolean\n  uploadTimeoutMs?: number\n  requestTimeoutMs?: number\n  credentials?: {\n    accessKeyId: string\n    secretAccessKey: string\n  }\n}\n\nexport type DiskBlobstoreConfig = {\n  provider: 'disk'\n  location: string\n  tempLocation?: string\n}\n\nexport type IdentityConfig = {\n  plcUrl: string\n  /**\n   * Bounds each individual identity resolution attempt. Note that\n   * `safeFetch`'s own 10s timeout acts as an upper backstop, so values above\n   * 10s are effectively capped.\n   */\n  resolverTimeout: number\n  cacheStaleTTL: number\n  cacheMaxTTL: number\n  recoveryDidKey: string | null\n  serviceHandleDomains: string[]\n  handleBackupNameservers?: string[]\n  enableDidDocWithSession: boolean\n}\n\nexport type EntrywayConfig = {\n  /**\n   * The entryway's public URL, which is also the OAuth issuer and the\n   * authorization server this PDS advertises.\n   */\n  url: string\n  /**\n   * Where this PDS sends its own requests to the entryway. Defaults to\n   * {@link url}; differs when those requests go through a local proxy, e.g.\n   * one that adds mTLS.\n   */\n  apiUrl: string\n  did: string\n  jwtPublicKeyHex: string\n  plcRotationKey: string\n  requireServiceAuth: boolean\n}\n\nexport type FetchConfig = {\n  disableSsrfProtection: boolean\n  maxResponseSize: number\n}\n\nexport type ProxyConfig = {\n  disableSsrfProtection: boolean\n  allowHTTP2: boolean\n  headersTimeout: number\n  bodyTimeout: number\n  maxResponseSize: number\n  maxRetries: number\n\n  /**\n   * When proxying requests that might get intercepted (for read-after-write) we\n   * negotiate the encoding based on the client's preferences. We will however\n   * use or own weights in order to be able to better control if the PDS will\n   * need to perform content decoding. This settings allows to prefer compressed\n   * content over uncompressed one.\n   */\n  preferCompressed: boolean\n}\n\nexport type OAuthConfig = {\n  issuer: string\n  provider?: {\n    hcaptcha?: HcaptchaConfig\n    branding: BrandingConfig\n    trustedClients?: string[]\n  }\n}\n\nexport type LexiconResolverConfig = {\n  didAuthority?: `did:${string}:${string}`\n}\n\nexport type InvitesConfig =\n  | {\n      required: true\n      interval: number | null\n      epoch: number\n    }\n  | {\n      required: false\n    }\n\nexport type EmailConfig = {\n  smtpUrl: string\n  fromAddress: string\n  disableConfirmationLink: boolean\n}\n\nexport type SubscriptionConfig = {\n  maxBuffer: number\n  repoBackfillLimitMs: number\n}\n\nexport type RedisScratchConfig = {\n  address: string\n  password?: string\n}\n\nexport type RateLimitsConfig =\n  | {\n      enabled: true\n      bypassKey?: string\n      bypassIps?: string[]\n    }\n  | { enabled: false }\n\nexport type BksyAppViewConfig = {\n  url: string\n  did: string\n  cdnUrlPattern?: string\n}\n\nexport type ModServiceConfig = {\n  url: string\n  did: string\n}\n\nexport type ReportServiceConfig = {\n  url: string\n  did: string\n}\n"]}

package/dist/config/env.d.ts

@@ -51,9 +51,11 @@ export declare function readEnv(): {
     handleBackupNameservers: string[];
     enableDidDocWithSession: boolean | undefined;
     entrywayUrl: string | undefined;
+    entrywayApiUrl: string | undefined;
     entrywayDid: string | undefined;
     entrywayJwtVerifyKeyK256PublicKeyHex: string | undefined;
     entrywayPlcRotationKey: string | undefined;
+    entrywayRequireServiceAuth: boolean | undefined;
     inviteRequired: boolean | undefined;
     inviteInterval: number | undefined;
     inviteEpoch: number | undefined;

package/dist/config/env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/config/env.ts"],"names":[],"mappings":"AAEA,wBAAgB,OAAO;IAGnB,IAAI;IACJ,QAAQ;IACR,UAAU;IACV,WAAW;IACX,OAAO;IACP,OAAO;IACP,OAAO;IACP,gBAAgB;IAChB,UAAU;IACV,iBAAiB;IACjB,mBAAmB;IACnB,gBAAgB;IAChB,aAAa;IACb,eAAe;IACf,OAAO;IAGP,eAAe;IACf,iBAAiB;IACjB,iBAAiB;IAGjB,mBAAmB;IAGnB,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,SAAS;IACT,YAAY;IAEZ,kBAAkB;IAClB,iBAAiB;IAGjB,aAAa;IACb,wBAAwB;IACxB,iBAAiB;IACjB,mBAAmB;IACnB,kBAAkB;IAGlB,mBAAmB;IACnB,mBAAmB;IAInB,iBAAiB;IACjB,iBAAiB;IACjB,mBAAmB;IACnB,yBAAyB;IACzB,sBAAsB;IACtB,0BAA0B;IAC1B,0BAA0B;IAC1B,2BAA2B;IAE3B,qBAAqB;IACrB,wBAAwB;IAGxB,SAAS;IACT,gBAAgB;IAChB,cAAc;IACd,eAAe;IACf,cAAc;IACd,oBAAoB;IACpB,uBAAuB;IACvB,uBAAuB;IAGvB,WAAW;IACX,WAAW;IACX,oCAAoC;IAGpC,sBAAsB;IAGtB,cAAc;IACd,cAAc;IACd,WAAW;IAGX,YAAY;IACZ,gBAAgB;IAChB,4BAA4B;IAG5B,sBAAsB;IACtB,sBAAsB;IAGtB,qBAAqB;IACrB,mBAAmB;IAGnB,cAAc;IACd,cAAc;IACd,wBAAwB;IAGxB,aAAa;IACb,aAAa;IAGb,gBAAgB;IAChB,gBAAgB;IAGhB,iBAAiB;IACjB,kBAAkB;IAClB,kBAAkB;IAGlB,mBAAmB;IACnB,oBAAoB;IAGpB,QAAQ;IAGR,UAAU;IACV,SAAS;IACT,aAAa;IACb,kBAAkB;IAGlB,sBAAsB;IAEtB,+BAA+B;IAK/B,qBAAqB;IAGrB,oBAAoB;IAGpB,eAAe;IACf,mBAAmB;IACnB,gBAAgB;IAChB,oBAAoB;IACpB,eAAe;IACf,qBAAqB;IAGrB,mBAAmB;EAEtB;AAED,MAAM,MAAM,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC,CAAA"}
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/config/env.ts"],"names":[],"mappings":"AAEA,wBAAgB,OAAO;IAGnB,IAAI;IACJ,QAAQ;IACR,UAAU;IACV,WAAW;IACX,OAAO;IACP,OAAO;IACP,OAAO;IACP,gBAAgB;IAChB,UAAU;IACV,iBAAiB;IACjB,mBAAmB;IACnB,gBAAgB;IAChB,aAAa;IACb,eAAe;IACf,OAAO;IAGP,eAAe;IACf,iBAAiB;IACjB,iBAAiB;IAGjB,mBAAmB;IAGnB,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,SAAS;IACT,YAAY;IAEZ,kBAAkB;IAClB,iBAAiB;IAGjB,aAAa;IACb,wBAAwB;IACxB,iBAAiB;IACjB,mBAAmB;IACnB,kBAAkB;IAGlB,mBAAmB;IACnB,mBAAmB;IAInB,iBAAiB;IACjB,iBAAiB;IACjB,mBAAmB;IACnB,yBAAyB;IACzB,sBAAsB;IACtB,0BAA0B;IAC1B,0BAA0B;IAC1B,2BAA2B;IAE3B,qBAAqB;IACrB,wBAAwB;IAGxB,SAAS;IACT,gBAAgB;IAChB,cAAc;IACd,eAAe;IACf,cAAc;IACd,oBAAoB;IACpB,uBAAuB;IACvB,uBAAuB;IAGvB,WAAW;IACX,cAAc;IACd,WAAW;IACX,oCAAoC;IAGpC,sBAAsB;IACtB,0BAA0B;IAG1B,cAAc;IACd,cAAc;IACd,WAAW;IAGX,YAAY;IACZ,gBAAgB;IAChB,4BAA4B;IAG5B,sBAAsB;IACtB,sBAAsB;IAGtB,qBAAqB;IACrB,mBAAmB;IAGnB,cAAc;IACd,cAAc;IACd,wBAAwB;IAGxB,aAAa;IACb,aAAa;IAGb,gBAAgB;IAChB,gBAAgB;IAGhB,iBAAiB;IACjB,kBAAkB;IAClB,kBAAkB;IAGlB,mBAAmB;IACnB,oBAAoB;IAGpB,QAAQ;IAGR,UAAU;IACV,SAAS;IACT,aAAa;IACb,kBAAkB;IAGlB,sBAAsB;IAEtB,+BAA+B;IAK/B,qBAAqB;IAGrB,oBAAoB;IAGpB,eAAe;IACf,mBAAmB;IACnB,gBAAgB;IAChB,oBAAoB;IACpB,eAAe;IACf,qBAAqB;IAGrB,mBAAmB;EAEtB;AAED,MAAM,MAAM,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC,CAAA"}

package/dist/config/env.js

@@ -64,9 +64,11 @@ export function readEnv() {
         enableDidDocWithSession: envBool('PDS_ENABLE_DID_DOC_WITH_SESSION'),
         // entryway
         entrywayUrl: envStr('PDS_ENTRYWAY_URL'),
+        entrywayApiUrl: envStr('PDS_ENTRYWAY_API_URL'),
         entrywayDid: envStr('PDS_ENTRYWAY_DID'),
         entrywayJwtVerifyKeyK256PublicKeyHex: envStr('PDS_ENTRYWAY_JWT_VERIFY_KEY_K256_PUBLIC_KEY_HEX'),
         entrywayPlcRotationKey: envStr('PDS_ENTRYWAY_PLC_ROTATION_KEY'),
+        entrywayRequireServiceAuth: envBool('PDS_ENTRYWAY_REQUIRE_SERVICE_AUTH'),
         // invites
         inviteRequired: envBool('PDS_INVITE_REQUIRED'),
         inviteInterval: envInt('PDS_INVITE_INTERVAL'),