@attraccess/plugin-rabbitmq 0.1.0-alpha.0

package/dist/index.js

@@ -0,0 +1,1108 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var __decorateClass = (decorators, target, key, kind) => {
+  var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
+  for (var i = decorators.length - 1, decorator; i >= 0; i--)
+    if (decorator = decorators[i])
+      result = (kind ? decorator(target, key, result) : decorator(result)) || result;
+  if (kind && result) __defProp(target, key, result);
+  return result;
+};
+var __decorateParam = (index, decorator) => (target, key) => decorator(target, key, index);
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+
+// backend/plugin.ts
+var plugin_exports = {};
+__export(plugin_exports, {
+  default: () => plugin_default
+});
+module.exports = __toCommonJS(plugin_exports);
+var import_plugins_backend_sdk3 = require("@attraccess/plugins-backend-sdk");
+var import_common7 = require("@nestjs/common");
+
+// backend/rabbitmq-detection.controller.ts
+var import_plugins_backend_sdk = require("@attraccess/plugins-backend-sdk");
+var import_common2 = require("@nestjs/common");
+
+// backend/rabbitmq-detection.service.ts
+var import_common = require("@nestjs/common");
+var import_node_crypto2 = require("node:crypto");
+
+// backend/rabbitmq-management-transport.ts
+var import_node_crypto = require("node:crypto");
+var import_node_https = require("node:https");
+var import_node_net = require("node:net");
+var TrustConfigurationError = class extends Error {
+};
+function managementApiBase(config) {
+  const host = (0, import_node_net.isIP)(config.host) === 6 ? `[${config.host}]` : config.host;
+  const port = config.managementPort ?? (config.useTls ? 15671 : 15672);
+  return `${config.useTls ? "https" : "http"}://${host}:${port}`;
+}
+function trustOptions(config) {
+  if (config.tlsInsecure) {
+    throw new TrustConfigurationError(
+      "RabbitMQ management requires certificate verification. Disable tlsInsecure and configure a trusted CA certificate."
+    );
+  }
+  const servername = config.tlsServername === "" ? void 0 : config.tlsServername;
+  if (servername != null && (typeof servername !== "string" || servername.length > 253 || !servername.split(".").every((label) => /^[a-z\d](?:[a-z\d-]{0,61}[a-z\d])?$/i.test(label)) || (0, import_node_net.isIP)(servername))) {
+    throw new TrustConfigurationError(
+      "TLS server name must be a DNS hostname matching the management certificate, without a scheme or port."
+    );
+  }
+  const caCert = config.caCert === "" ? void 0 : config.caCert;
+  if (caCert != null) {
+    try {
+      const pem = caCert;
+      const certificates = typeof pem === "string" ? pem.match(/-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g) : null;
+      if (!certificates?.length || pem.replace(/-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g, "").trim()) {
+        throw new Error();
+      }
+      for (const certificate of certificates) new import_node_crypto.X509Certificate(certificate);
+    } catch {
+      throw new TrustConfigurationError(
+        "Invalid CA certificate. Configure a PEM certificate or PEM certificate bundle."
+      );
+    }
+  }
+  return {
+    rejectUnauthorized: true,
+    ...caCert != null ? { ca: caCert } : {},
+    ...servername != null ? { servername } : {}
+  };
+}
+async function managementRequest(config, url, method, body, timeoutMs) {
+  const headers = { accept: "application/json" };
+  if (config.username !== null) {
+    headers.authorization = `Basic ${Buffer.from(`${config.username}:${config.password ?? ""}`, "utf8").toString("base64")}`;
+  }
+  const payload = body === void 0 ? void 0 : JSON.stringify(body);
+  if (payload !== void 0) headers["content-type"] = "application/json";
+  if (!config.useTls) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+      return await fetch(url, { method, headers, body: payload, signal: controller.signal });
+    } finally {
+      clearTimeout(timeout);
+    }
+  }
+  const options = trustOptions(config);
+  if (new URL(url).protocol !== "https:") {
+    throw new TrustConfigurationError("TLS is enabled: the RabbitMQ management endpoint must use HTTPS.");
+  }
+  return new Promise((resolve, reject) => {
+    const req = (0, import_node_https.request)(url, { ...options, agent: false, method, headers }, (res) => {
+      const chunks = [];
+      let bytes = 0;
+      const maximumBytes = 8 * 1024 * 1024;
+      res.on("data", (chunk) => {
+        bytes += chunk.length;
+        if (bytes > maximumBytes) {
+          chunks.length = 0;
+          req.destroy(Object.assign(new Error(), { code: "RESPONSE_TOO_LARGE" }));
+          return;
+        }
+        chunks.push(Buffer.from(chunk));
+      });
+      res.on("error", reject);
+      res.on("aborted", () => reject(new Error("Response aborted")));
+      res.on("end", () => {
+        if (bytes > maximumBytes) return;
+        const status = res.statusCode ?? 502;
+        try {
+          if (status < 200 || status > 599) throw new Error();
+          resolve(
+            new Response([204, 205, 304].includes(status) ? null : Buffer.concat(chunks).toString("utf8"), { status })
+          );
+        } catch {
+          reject(Object.assign(new Error(), { code: "INVALID_RESPONSE_STATUS" }));
+        }
+      });
+    });
+    const timeout = setTimeout(() => req.destroy(Object.assign(new Error(), { code: "ETIMEDOUT" })), timeoutMs);
+    req.on("error", reject);
+    req.on("close", () => clearTimeout(timeout));
+    req.end(payload);
+  });
+}
+function describeManagementError(error, timeoutMs) {
+  if (error instanceof TrustConfigurationError) return error.message;
+  const outer = error;
+  const code = outer?.cause?.code ?? outer?.code;
+  if (outer?.name === "AbortError" || code === "ETIMEDOUT")
+    return `Management API did not respond within ${timeoutMs}ms.`;
+  switch (code) {
+    case "RESPONSE_TOO_LARGE":
+      return "Management API response exceeded the 8 MiB limit.";
+    case "INVALID_RESPONSE_STATUS":
+      return "Management API returned an invalid HTTP status.";
+    case "CERT_HAS_EXPIRED":
+    case "CERT_NOT_YET_VALID":
+      return "TLS certificate is expired or not yet valid. Check the Attraccess host clock and the certificate validity dates; renew the certificate if necessary.";
+    case "ERR_TLS_CERT_ALTNAME_INVALID":
+      return "TLS certificate hostname mismatch. Configure tlsServername to match the management certificate DNS name or correct the certificate.";
+    case "DEPTH_ZERO_SELF_SIGNED_CERT":
+    case "SELF_SIGNED_CERT_IN_CHAIN":
+    case "UNABLE_TO_VERIFY_LEAF_SIGNATURE":
+    case "UNABLE_TO_GET_ISSUER_CERT":
+    case "UNABLE_TO_GET_ISSUER_CERT_LOCALLY":
+      return "TLS certificate is not trusted. Configure the issuing CA PEM bundle and ensure the management server sends its intermediate certificates.";
+    case "ECONNREFUSED":
+      return "Management connection refused. Check the management listener and port.";
+    case "ENOTFOUND":
+    case "EAI_AGAIN":
+      return "Management hostname could not be resolved. Check DNS and the configured host.";
+    default:
+      return "Failed to reach the RabbitMQ management API. Check connectivity and, for HTTPS, the CA, certificate validity, host clock, and TLS server name.";
+  }
+}
+
+// backend/rabbitmq-detection.service.ts
+var PLUGIN_CONTEXT = /* @__PURE__ */ Symbol.for("attraccess.plugin.context");
+var CACHE_TTL_MS = 6e4;
+var PROBE_TIMEOUT_MS = 5e3;
+var RabbitmqDetectionService = class {
+  constructor(context) {
+    __publicField(this, "context", context);
+    // Verdicts keyed by MQTT server id. In-memory only; a restart re-probes.
+    __publicField(this, "cache", /* @__PURE__ */ new Map());
+  }
+  // Returns a cached verdict when fresh, otherwise probes. `forceRefresh`
+  // bypasses the cache (used by the UI's manual refresh).
+  async detect(mqttServerId, forceRefresh = false) {
+    const config = await this.context.getMqttServerConfig(mqttServerId);
+    const configKey = (0, import_node_crypto2.createHash)("sha256").update(JSON.stringify(config ?? null)).digest("hex");
+    if (!forceRefresh) {
+      const cached = this.cache.get(mqttServerId);
+      if (cached && cached.configKey === configKey && cached.expiresAt > this.now()) {
+        return cached.result;
+      }
+    }
+    const result = await this.probe(mqttServerId, config);
+    this.cache.set(mqttServerId, { result, configKey, expiresAt: this.now() + CACHE_TTL_MS });
+    return result;
+  }
+  async probe(mqttServerId, config) {
+    const checkedAt = this.nowIso();
+    if (!config) {
+      return {
+        mqttServerId,
+        isRabbitMQ: false,
+        reachable: false,
+        authOk: false,
+        rabbitmqVersion: null,
+        managementVersion: null,
+        managementApi: "",
+        checkedAt,
+        error: "MQTT server not found."
+      };
+    }
+    const managementApi = this.managementApiBase(config);
+    let response;
+    try {
+      response = await this.fetchOverview(managementApi, config);
+    } catch (error) {
+      return {
+        mqttServerId,
+        isRabbitMQ: false,
+        reachable: false,
+        authOk: false,
+        rabbitmqVersion: null,
+        managementVersion: null,
+        managementApi,
+        checkedAt,
+        error: this.describeError(error)
+      };
+    }
+    if (response.status === 401) {
+      return {
+        mqttServerId,
+        isRabbitMQ: true,
+        reachable: true,
+        authOk: false,
+        rabbitmqVersion: null,
+        managementVersion: null,
+        managementApi,
+        checkedAt,
+        error: "Authentication failed (401) against the RabbitMQ management API."
+      };
+    }
+    if (!response.ok) {
+      return {
+        mqttServerId,
+        isRabbitMQ: false,
+        reachable: true,
+        authOk: false,
+        rabbitmqVersion: null,
+        managementVersion: null,
+        managementApi,
+        checkedAt,
+        error: `Unexpected response (HTTP ${response.status}) \u2014 not a RabbitMQ management API.`
+      };
+    }
+    const overview = await this.parseOverview(response);
+    const isRabbitMQ = overview !== null && typeof overview.rabbitmq_version === "string";
+    return {
+      mqttServerId,
+      isRabbitMQ,
+      reachable: true,
+      authOk: isRabbitMQ,
+      rabbitmqVersion: overview?.rabbitmq_version ?? null,
+      managementVersion: overview?.management_version ?? null,
+      managementApi,
+      checkedAt,
+      error: isRabbitMQ ? null : "Reachable, but the response is not a RabbitMQ management API."
+    };
+  }
+  // Builds the management API base URL from the generic MQTT config. The
+  // management API uses its configured port or the provider default, independently
+  // of the MQTT port. The scheme still comes from useTls.
+  managementApiBase(config) {
+    return managementApiBase(config);
+  }
+  async fetchOverview(managementApi, config) {
+    return managementRequest(config, `${managementApi}/api/overview`, "GET", void 0, PROBE_TIMEOUT_MS);
+  }
+  async parseOverview(response) {
+    try {
+      return await response.json();
+    } catch {
+      return null;
+    }
+  }
+  describeError(error) {
+    return describeManagementError(error, PROBE_TIMEOUT_MS);
+  }
+  now() {
+    return Date.now();
+  }
+  nowIso() {
+    return (/* @__PURE__ */ new Date()).toISOString();
+  }
+};
+RabbitmqDetectionService = __decorateClass([
+  (0, import_common.Injectable)(),
+  __decorateParam(0, (0, import_common.Inject)(PLUGIN_CONTEXT))
+], RabbitmqDetectionService);
+
+// backend/rabbitmq-detection.controller.ts
+var RabbitmqDetectionController = class {
+  // esbuild does not emit decorator metadata, so Nest cannot infer constructor
+  // types for injection — always inject by an explicit token.
+  constructor(detection) {
+    __publicField(this, "detection", detection);
+  }
+  detect(mqttServerId, refresh) {
+    return this.detection.detect(mqttServerId, refresh === "true");
+  }
+};
+__decorateClass([
+  (0, import_common2.Get)("detection/:mqttServerId"),
+  __decorateParam(0, (0, import_common2.Param)("mqttServerId", import_common2.ParseIntPipe)),
+  __decorateParam(1, (0, import_common2.Query)("refresh"))
+], RabbitmqDetectionController.prototype, "detect", 1);
+RabbitmqDetectionController = __decorateClass([
+  (0, import_plugins_backend_sdk.Auth)("resources.update"),
+  (0, import_common2.Controller)("rabbitmq"),
+  __decorateParam(0, (0, import_common2.Inject)(RabbitmqDetectionService))
+], RabbitmqDetectionController);
+
+// backend/rabbitmq-management-client.ts
+var import_common3 = require("@nestjs/common");
+var REQUEST_TIMEOUT_MS = 1e4;
+var RabbitmqManagementClient = class {
+  // Builds the management API base URL from the generic MQTT config (same
+  // convention as RabbitmqDetectionService).
+  managementApiBase(config) {
+    return managementApiBase(config);
+  }
+  // Performs one management API request. `path` is relative to `/api`, with
+  // every variable segment already URL-encoded by the caller. Returns the
+  // parsed JSON body (or null for empty responses, e.g. 201/204).
+  async request(config, method, path, body) {
+    const base = this.managementApiBase(config);
+    let response;
+    try {
+      response = await managementRequest(config, `${base}/api${path}`, method, body, REQUEST_TIMEOUT_MS);
+    } catch (error) {
+      throw new import_common3.HttpException(
+        `Cannot reach the RabbitMQ management API at ${base}: ${describeManagementError(error, REQUEST_TIMEOUT_MS)}`,
+        import_common3.HttpStatus.BAD_GATEWAY
+      );
+    }
+    if (!response.ok) {
+      throw await this.toHttpException(response);
+    }
+    return this.parseBody(response);
+  }
+  // Maps an upstream error response to an exception with an actionable
+  // message. Auth failures surface as 502 (not 401/403) so the host frontend
+  // doesn't mistake them for an expired Attraccess session.
+  async toHttpException(response) {
+    const upstream = await this.parseErrorBody(response);
+    const reason = upstream?.reason || upstream?.error || "";
+    if (response.status === 401) {
+      return new import_common3.HttpException(
+        "The RabbitMQ management API rejected the configured MQTT server credentials (401). Check the username/password configured for this MQTT server.",
+        import_common3.HttpStatus.BAD_GATEWAY
+      );
+    }
+    if (response.status === 403 || /not.?authori[sz]ed/i.test(reason)) {
+      return new import_common3.HttpException(
+        'The configured MQTT server user lacks management privileges on RabbitMQ. User management requires a user with the "administrator" tag.',
+        import_common3.HttpStatus.BAD_GATEWAY
+      );
+    }
+    if (response.status === 404) {
+      return new import_common3.HttpException("Not found on the RabbitMQ side.", import_common3.HttpStatus.NOT_FOUND);
+    }
+    if (response.status === 400) {
+      return new import_common3.HttpException("RabbitMQ rejected the request.", import_common3.HttpStatus.BAD_REQUEST);
+    }
+    return new import_common3.HttpException(
+      `RabbitMQ management API request failed (HTTP ${response.status}).`,
+      import_common3.HttpStatus.BAD_GATEWAY
+    );
+  }
+  async parseBody(response) {
+    const text = await response.text();
+    if (text.length === 0) {
+      return null;
+    }
+    try {
+      return JSON.parse(text);
+    } catch {
+      throw new import_common3.HttpException(
+        "The RabbitMQ management API returned a response that is not valid JSON.",
+        import_common3.HttpStatus.BAD_GATEWAY
+      );
+    }
+  }
+  async parseErrorBody(response) {
+    try {
+      return await response.json();
+    } catch {
+      return null;
+    }
+  }
+};
+RabbitmqManagementClient = __decorateClass([
+  (0, import_common3.Injectable)()
+], RabbitmqManagementClient);
+
+// backend/rabbitmq-users.controller.ts
+var import_plugins_backend_sdk2 = require("@attraccess/plugins-backend-sdk");
+var import_common5 = require("@nestjs/common");
+
+// backend/rabbitmq-users.service.ts
+var import_common4 = require("@nestjs/common");
+var PLUGIN_CONTEXT2 = /* @__PURE__ */ Symbol.for("attraccess.plugin.context");
+var RabbitmqUsersService = class {
+  constructor(context, client) {
+    __publicField(this, "context", context);
+    __publicField(this, "client", client);
+  }
+  // Lists all users with their per-vhost permissions, plus the vhost list for
+  // the UI's vhost choices. Three management calls, joined here.
+  async listUsers(mqttServerId) {
+    const config = await this.requireConfig(mqttServerId);
+    const [rawUsers, rawPermissions, rawVhosts] = await Promise.all([
+      this.client.request(config, "GET", "/users"),
+      this.client.request(config, "GET", "/permissions"),
+      this.client.request(config, "GET", "/vhosts")
+    ]);
+    const permissionsByUser = /* @__PURE__ */ new Map();
+    for (const permission of rawPermissions ?? []) {
+      const list = permissionsByUser.get(permission.user) ?? [];
+      list.push({
+        vhost: permission.vhost,
+        configure: permission.configure,
+        write: permission.write,
+        read: permission.read
+      });
+      permissionsByUser.set(permission.user, list);
+    }
+    const users = (rawUsers ?? []).map((user) => ({
+      name: user.name,
+      tags: this.normalizeTags(user.tags),
+      permissions: permissionsByUser.get(user.name) ?? []
+    }));
+    users.sort((a, b) => a.name.localeCompare(b.name));
+    return {
+      mqttServerId,
+      users,
+      vhosts: (rawVhosts ?? []).map((vhost) => vhost.name).sort((a, b) => a.localeCompare(b))
+    };
+  }
+  // Creates or updates one user, optionally applying per-vhost permissions in
+  // the same operation (used by the create form's "default MQTT permissions").
+  async upsertUser(mqttServerId, username, dto) {
+    this.assertValidName(username, "Username");
+    const config = await this.requireConfig(mqttServerId);
+    const existing = await this.findUser(config, username);
+    const password = dto.password?.length ? dto.password : void 0;
+    if (!existing && !password) {
+      throw new import_common4.HttpException("Password is required when creating a new user.", import_common4.HttpStatus.BAD_REQUEST);
+    }
+    const body = { tags: (dto.tags ?? this.normalizeTags(existing?.tags)).join(",") };
+    if (password) {
+      body.password = password;
+    } else if (existing?.password_hash) {
+      body.password_hash = existing.password_hash;
+      if (existing.hashing_algorithm) {
+        body.hashing_algorithm = existing.hashing_algorithm;
+      }
+    }
+    await this.client.request(config, "PUT", `/users/${encodeURIComponent(username)}`, body);
+    for (const permission of dto.permissions ?? []) {
+      await this.putPermission(config, username, permission);
+    }
+  }
+  async deleteUser(mqttServerId, username) {
+    this.assertValidName(username, "Username");
+    const config = await this.requireConfig(mqttServerId);
+    if (config.username !== null && config.username === username) {
+      throw new import_common4.HttpException(
+        "Refusing to delete the user the MQTT server connection is configured with.",
+        import_common4.HttpStatus.BAD_REQUEST
+      );
+    }
+    await this.client.request(config, "DELETE", `/users/${encodeURIComponent(username)}`);
+  }
+  async setPermissions(mqttServerId, username, dto) {
+    this.assertValidName(username, "Username");
+    this.assertValidName(dto.vhost, "Vhost");
+    const config = await this.requireConfig(mqttServerId);
+    await this.putPermission(config, username, dto);
+  }
+  async clearPermissions(mqttServerId, username, vhost) {
+    this.assertValidName(username, "Username");
+    this.assertValidName(vhost, "Vhost");
+    const config = await this.requireConfig(mqttServerId);
+    await this.client.request(
+      config,
+      "DELETE",
+      `/permissions/${encodeURIComponent(vhost)}/${encodeURIComponent(username)}`
+    );
+  }
+  async putPermission(config, username, permission) {
+    await this.client.request(
+      config,
+      "PUT",
+      `/permissions/${encodeURIComponent(permission.vhost)}/${encodeURIComponent(username)}`,
+      {
+        configure: permission.configure ?? "",
+        write: permission.write ?? "",
+        read: permission.read ?? ""
+      }
+    );
+  }
+  // Reads one user; null when the broker doesn't know the name.
+  async findUser(config, username) {
+    try {
+      return await this.client.request(config, "GET", `/users/${encodeURIComponent(username)}`);
+    } catch (error) {
+      if (error instanceof import_common4.HttpException && error.getStatus() === import_common4.HttpStatus.NOT_FOUND) {
+        return null;
+      }
+      throw error;
+    }
+  }
+  async requireConfig(mqttServerId) {
+    const config = await this.context.getMqttServerConfig(mqttServerId);
+    if (!config) {
+      throw new import_common4.HttpException("MQTT server not found.", import_common4.HttpStatus.NOT_FOUND);
+    }
+    return config;
+  }
+  normalizeTags(tags) {
+    if (Array.isArray(tags)) {
+      return tags.filter((tag) => tag.length > 0);
+    }
+    if (typeof tags === "string" && tags.length > 0) {
+      return tags.split(",").map((tag) => tag.trim()).filter((tag) => tag.length > 0);
+    }
+    return [];
+  }
+  assertValidName(value, label) {
+    if (typeof value !== "string" || value.trim().length === 0) {
+      throw new import_common4.HttpException(`${label} must not be empty.`, import_common4.HttpStatus.BAD_REQUEST);
+    }
+    if (value.length > 255) {
+      throw new import_common4.HttpException(`${label} must be at most 255 characters.`, import_common4.HttpStatus.BAD_REQUEST);
+    }
+  }
+};
+RabbitmqUsersService = __decorateClass([
+  (0, import_common4.Injectable)(),
+  __decorateParam(0, (0, import_common4.Inject)(PLUGIN_CONTEXT2)),
+  __decorateParam(1, (0, import_common4.Inject)(RabbitmqManagementClient))
+], RabbitmqUsersService);
+
+// backend/rabbitmq-users.controller.ts
+var RabbitmqUsersController = class {
+  // esbuild does not emit decorator metadata, so Nest cannot infer constructor
+  // types for injection — always inject by an explicit token.
+  constructor(users) {
+    __publicField(this, "users", users);
+  }
+  list(mqttServerId) {
+    return this.users.listUsers(mqttServerId);
+  }
+  upsert(mqttServerId, username, dto) {
+    return this.users.upsertUser(mqttServerId, username, dto ?? {});
+  }
+  remove(mqttServerId, username) {
+    return this.users.deleteUser(mqttServerId, username);
+  }
+  setPermissions(mqttServerId, username, dto) {
+    if (!dto || typeof dto.vhost !== "string") {
+      throw new import_common5.HttpException("A vhost is required.", import_common5.HttpStatus.BAD_REQUEST);
+    }
+    return this.users.setPermissions(mqttServerId, username, dto);
+  }
+  clearPermissions(mqttServerId, username, vhost) {
+    if (typeof vhost !== "string" || vhost.length === 0) {
+      throw new import_common5.HttpException("A vhost query parameter is required.", import_common5.HttpStatus.BAD_REQUEST);
+    }
+    return this.users.clearPermissions(mqttServerId, username, vhost);
+  }
+};
+__decorateClass([
+  (0, import_common5.Get)("users/:mqttServerId"),
+  __decorateParam(0, (0, import_common5.Param)("mqttServerId", import_common5.ParseIntPipe))
+], RabbitmqUsersController.prototype, "list", 1);
+__decorateClass([
+  (0, import_common5.Put)("users/:mqttServerId/:username"),
+  __decorateParam(0, (0, import_common5.Param)("mqttServerId", import_common5.ParseIntPipe)),
+  __decorateParam(1, (0, import_common5.Param)("username")),
+  __decorateParam(2, (0, import_common5.Body)())
+], RabbitmqUsersController.prototype, "upsert", 1);
+__decorateClass([
+  (0, import_common5.Delete)("users/:mqttServerId/:username"),
+  __decorateParam(0, (0, import_common5.Param)("mqttServerId", import_common5.ParseIntPipe)),
+  __decorateParam(1, (0, import_common5.Param)("username"))
+], RabbitmqUsersController.prototype, "remove", 1);
+__decorateClass([
+  (0, import_common5.Put)("users/:mqttServerId/:username/permissions"),
+  __decorateParam(0, (0, import_common5.Param)("mqttServerId", import_common5.ParseIntPipe)),
+  __decorateParam(1, (0, import_common5.Param)("username")),
+  __decorateParam(2, (0, import_common5.Body)())
+], RabbitmqUsersController.prototype, "setPermissions", 1);
+__decorateClass([
+  (0, import_common5.Delete)("users/:mqttServerId/:username/permissions"),
+  __decorateParam(0, (0, import_common5.Param)("mqttServerId", import_common5.ParseIntPipe)),
+  __decorateParam(1, (0, import_common5.Param)("username")),
+  __decorateParam(2, (0, import_common5.Query)("vhost"))
+], RabbitmqUsersController.prototype, "clearPermissions", 1);
+RabbitmqUsersController = __decorateClass([
+  (0, import_plugins_backend_sdk2.Auth)("resources.update"),
+  (0, import_common5.Controller)("rabbitmq"),
+  __decorateParam(0, (0, import_common5.Inject)(RabbitmqUsersService))
+], RabbitmqUsersController);
+
+// backend/rabbitmq-credential-provisioning.provider.ts
+var import_crypto = require("crypto");
+var import_common6 = require("@nestjs/common");
+
+// ../../../node_modules/.pnpm/async-mutex@0.5.0/node_modules/async-mutex/index.mjs
+var E_TIMEOUT = new Error("timeout while waiting for mutex to become available");
+var E_ALREADY_LOCKED = new Error("mutex already locked");
+var E_CANCELED = new Error("request for lock canceled");
+var __awaiter$2 = function(thisArg, _arguments, P, generator) {
+  function adopt(value) {
+    return value instanceof P ? value : new P(function(resolve) {
+      resolve(value);
+    });
+  }
+  return new (P || (P = Promise))(function(resolve, reject) {
+    function fulfilled(value) {
+      try {
+        step(generator.next(value));
+      } catch (e) {
+        reject(e);
+      }
+    }
+    function rejected(value) {
+      try {
+        step(generator["throw"](value));
+      } catch (e) {
+        reject(e);
+      }
+    }
+    function step(result) {
+      result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected);
+    }
+    step((generator = generator.apply(thisArg, _arguments || [])).next());
+  });
+};
+var Semaphore = class {
+  constructor(_value, _cancelError = E_CANCELED) {
+    this._value = _value;
+    this._cancelError = _cancelError;
+    this._queue = [];
+    this._weightedWaiters = [];
+  }
+  acquire(weight = 1, priority = 0) {
+    if (weight <= 0)
+      throw new Error(`invalid weight ${weight}: must be positive`);
+    return new Promise((resolve, reject) => {
+      const task = { resolve, reject, weight, priority };
+      const i = findIndexFromEnd(this._queue, (other) => priority <= other.priority);
+      if (i === -1 && weight <= this._value) {
+        this._dispatchItem(task);
+      } else {
+        this._queue.splice(i + 1, 0, task);
+      }
+    });
+  }
+  runExclusive(callback_1) {
+    return __awaiter$2(this, arguments, void 0, function* (callback, weight = 1, priority = 0) {
+      const [value, release] = yield this.acquire(weight, priority);
+      try {
+        return yield callback(value);
+      } finally {
+        release();
+      }
+    });
+  }
+  waitForUnlock(weight = 1, priority = 0) {
+    if (weight <= 0)
+      throw new Error(`invalid weight ${weight}: must be positive`);
+    if (this._couldLockImmediately(weight, priority)) {
+      return Promise.resolve();
+    } else {
+      return new Promise((resolve) => {
+        if (!this._weightedWaiters[weight - 1])
+          this._weightedWaiters[weight - 1] = [];
+        insertSorted(this._weightedWaiters[weight - 1], { resolve, priority });
+      });
+    }
+  }
+  isLocked() {
+    return this._value <= 0;
+  }
+  getValue() {
+    return this._value;
+  }
+  setValue(value) {
+    this._value = value;
+    this._dispatchQueue();
+  }
+  release(weight = 1) {
+    if (weight <= 0)
+      throw new Error(`invalid weight ${weight}: must be positive`);
+    this._value += weight;
+    this._dispatchQueue();
+  }
+  cancel() {
+    this._queue.forEach((entry) => entry.reject(this._cancelError));
+    this._queue = [];
+  }
+  _dispatchQueue() {
+    this._drainUnlockWaiters();
+    while (this._queue.length > 0 && this._queue[0].weight <= this._value) {
+      this._dispatchItem(this._queue.shift());
+      this._drainUnlockWaiters();
+    }
+  }
+  _dispatchItem(item) {
+    const previousValue = this._value;
+    this._value -= item.weight;
+    item.resolve([previousValue, this._newReleaser(item.weight)]);
+  }
+  _newReleaser(weight) {
+    let called = false;
+    return () => {
+      if (called)
+        return;
+      called = true;
+      this.release(weight);
+    };
+  }
+  _drainUnlockWaiters() {
+    if (this._queue.length === 0) {
+      for (let weight = this._value; weight > 0; weight--) {
+        const waiters = this._weightedWaiters[weight - 1];
+        if (!waiters)
+          continue;
+        waiters.forEach((waiter) => waiter.resolve());
+        this._weightedWaiters[weight - 1] = [];
+      }
+    } else {
+      const queuedPriority = this._queue[0].priority;
+      for (let weight = this._value; weight > 0; weight--) {
+        const waiters = this._weightedWaiters[weight - 1];
+        if (!waiters)
+          continue;
+        const i = waiters.findIndex((waiter) => waiter.priority <= queuedPriority);
+        (i === -1 ? waiters : waiters.splice(0, i)).forEach(((waiter) => waiter.resolve()));
+      }
+    }
+  }
+  _couldLockImmediately(weight, priority) {
+    return (this._queue.length === 0 || this._queue[0].priority < priority) && weight <= this._value;
+  }
+};
+function insertSorted(a, v) {
+  const i = findIndexFromEnd(a, (other) => v.priority <= other.priority);
+  a.splice(i + 1, 0, v);
+}
+function findIndexFromEnd(a, predicate) {
+  for (let i = a.length - 1; i >= 0; i--) {
+    if (predicate(a[i])) {
+      return i;
+    }
+  }
+  return -1;
+}
+var __awaiter$1 = function(thisArg, _arguments, P, generator) {
+  function adopt(value) {
+    return value instanceof P ? value : new P(function(resolve) {
+      resolve(value);
+    });
+  }
+  return new (P || (P = Promise))(function(resolve, reject) {
+    function fulfilled(value) {
+      try {
+        step(generator.next(value));
+      } catch (e) {
+        reject(e);
+      }
+    }
+    function rejected(value) {
+      try {
+        step(generator["throw"](value));
+      } catch (e) {
+        reject(e);
+      }
+    }
+    function step(result) {
+      result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected);
+    }
+    step((generator = generator.apply(thisArg, _arguments || [])).next());
+  });
+};
+var Mutex = class {
+  constructor(cancelError) {
+    this._semaphore = new Semaphore(1, cancelError);
+  }
+  acquire() {
+    return __awaiter$1(this, arguments, void 0, function* (priority = 0) {
+      const [, releaser] = yield this._semaphore.acquire(1, priority);
+      return releaser;
+    });
+  }
+  runExclusive(callback, priority = 0) {
+    return this._semaphore.runExclusive(() => callback(), 1, priority);
+  }
+  isLocked() {
+    return this._semaphore.isLocked();
+  }
+  waitForUnlock(priority = 0) {
+    return this._semaphore.waitForUnlock(1, priority);
+  }
+  release() {
+    if (this._semaphore.isLocked())
+      this._semaphore.release();
+  }
+  cancel() {
+    return this._semaphore.cancel();
+  }
+};
+
+// backend/rabbitmq-credential-provisioning.provider.ts
+var _RabbitmqCredentialProvisioningProvider = class _RabbitmqCredentialProvisioningProvider {
+  constructor(context) {
+    __publicField(this, "context", context);
+    __publicField(this, "id", "rabbitmq");
+    __publicField(this, "displayName", "RabbitMQ Management API");
+    __publicField(this, "client", new RabbitmqManagementClient());
+    __publicField(this, "detection");
+    this.detection = new RabbitmqDetectionService(context);
+  }
+  async supports(config) {
+    return (await this.detection.detect(config.id)).isRabbitMQ;
+  }
+  provision(request2) {
+    return this.writeCredential(request2);
+  }
+  rotate(request2) {
+    return this.writeCredential(request2);
+  }
+  async revoke(request2) {
+    this.assertName(request2.username, "Username");
+    const config = await this.requireConfig(request2.mqttServerId);
+    this.assertNotManagementUser(config, request2.username);
+    try {
+      await this.client.request(config, "DELETE", `/users/${encodeURIComponent(request2.username)}`);
+    } catch (error) {
+      if (error instanceof import_common6.HttpException && error.getStatus() === import_common6.HttpStatus.NOT_FOUND) return;
+      throw error;
+    }
+  }
+  async writeCredential(request2) {
+    this.assertRequest(request2);
+    const config = await this.requireConfig(request2.mqttServerId);
+    this.assertNotManagementUser(config, request2.username);
+    const lockKey = `${config.id}:${request2.vhost}`;
+    let lock = _RabbitmqCredentialProvisioningProvider.vhostLocks.get(lockKey);
+    if (!lock) {
+      lock = { mutex: new Mutex(), users: 0 };
+      _RabbitmqCredentialProvisioningProvider.vhostLocks.set(lockKey, lock);
+    }
+    lock.users += 1;
+    try {
+      return await lock.mutex.runExclusive(() => this.writeCredentialLocked(request2, config));
+    } finally {
+      lock.users -= 1;
+      if (lock.users === 0 && _RabbitmqCredentialProvisioningProvider.vhostLocks.get(lockKey) === lock) {
+        _RabbitmqCredentialProvisioningProvider.vhostLocks.delete(lockKey);
+      }
+    }
+  }
+  async writeCredentialLocked(request2, config) {
+    const password = (0, import_crypto.randomBytes)(24).toString("base64url");
+    const vhost = encodeURIComponent(request2.vhost);
+    const username = encodeURIComponent(request2.username);
+    const existing = await this.userExists(config, username);
+    const vhostExisted = await this.exists(config, `/vhosts/${vhost}`);
+    await this.client.request(config, "PUT", `/vhosts/${vhost}`);
+    let previousPermissions = null;
+    let previousTopicPermissions = null;
+    let permissionsCaptured = false;
+    try {
+      if (existing) {
+        previousPermissions = await this.getPermissions(config, vhost, username);
+        previousTopicPermissions = await this.getTopicPermissions(config, vhost, username);
+        permissionsCaptured = true;
+        await this.writePermissions(config, request2, vhost, username);
+        await this.client.request(config, "PUT", `/users/${username}`, { password, tags: "" });
+      } else {
+        await this.client.request(config, "PUT", `/users/${username}`, { password, tags: "" });
+        await this.writePermissions(config, request2, vhost, username);
+      }
+    } catch (error) {
+      const rollback = [
+        ...existing && permissionsCaptured ? [() => this.restorePermissions(config, vhost, username, previousPermissions, previousTopicPermissions)] : !existing ? [() => this.client.request(config, "DELETE", `/users/${username}`)] : [],
+        ...!vhostExisted ? [() => this.client.request(config, "DELETE", `/vhosts/${vhost}`)] : []
+      ];
+      await this.failAfterRollback(error, rollback);
+    }
+    return {
+      providerId: this.id,
+      identity: request2.identity,
+      username: request2.username,
+      vhost: request2.vhost,
+      password
+    };
+  }
+  async writePermissions(config, request2, vhost, username) {
+    const subscriptionQueue = `mqtt-subscription-${escapeRegex(request2.identity)}.*`;
+    await this.client.request(config, "PUT", `/permissions/${vhost}/${username}`, {
+      configure: `^${subscriptionQueue}$`,
+      write: `^(amq\\.topic|${subscriptionQueue})$`,
+      read: `^(amq\\.topic|${subscriptionQueue})$`
+    });
+    await this.client.request(config, "PUT", `/topic-permissions/${vhost}/${username}`, {
+      exchange: "amq.topic",
+      write: mqttFiltersToRegex(request2.topicPolicy.publish),
+      read: mqttFiltersToRegex(request2.topicPolicy.subscribe)
+    });
+  }
+  async userExists(config, username) {
+    return this.exists(config, `/users/${username}`);
+  }
+  async exists(config, path) {
+    try {
+      await this.client.request(config, "GET", path);
+      return true;
+    } catch (error) {
+      if (error instanceof import_common6.HttpException && error.getStatus() === import_common6.HttpStatus.NOT_FOUND) {
+        return false;
+      }
+      throw error;
+    }
+  }
+  async getPermissions(config, vhost, username) {
+    return this.getOptional(config, `/permissions/${vhost}/${username}`);
+  }
+  async getTopicPermissions(config, vhost, username) {
+    return this.getOptional(config, `/topic-permissions/${vhost}/${username}`);
+  }
+  async getOptional(config, path) {
+    try {
+      return await this.client.request(config, "GET", path);
+    } catch (error) {
+      if (error instanceof import_common6.HttpException && error.getStatus() === import_common6.HttpStatus.NOT_FOUND) {
+        return null;
+      }
+      throw error;
+    }
+  }
+  async restorePermissions(config, vhost, username, permissions, topicPermissions) {
+    const results = await Promise.allSettled([
+      this.restorePermission(config, `/permissions/${vhost}/${username}`, permissions),
+      this.restorePermission(config, `/topic-permissions/${vhost}/${username}`, topicPermissions)
+    ]);
+    const failures = results.filter((result) => result.status === "rejected").map((result) => result.reason);
+    if (failures.length > 0) {
+      throw new AggregateError(failures, "Failed to restore RabbitMQ permissions.");
+    }
+  }
+  async restorePermission(config, path, permissions) {
+    await this.client.request(config, permissions ? "PUT" : "DELETE", path, permissions ?? void 0);
+  }
+  async failAfterRollback(error, rollback) {
+    const results = await Promise.allSettled(rollback.map((operation) => operation()));
+    const failures = results.filter((result) => result.status === "rejected").map((result) => result.reason);
+    if (failures.length > 0) {
+      throw new AggregateError([error, ...failures], "Credential provisioning failed and rollback was incomplete.");
+    }
+    throw error;
+  }
+  async requireConfig(mqttServerId) {
+    const config = await this.context.getMqttServerConfig(mqttServerId);
+    if (!config) {
+      throw new import_common6.BadRequestException("MQTT server not found.");
+    }
+    return config;
+  }
+  assertRequest(request2) {
+    this.assertName(request2.identity, "Identity");
+    this.assertName(request2.username, "Username");
+    this.assertName(request2.vhost, "Vhost");
+    if (!Array.isArray(request2.topicPolicy.publish) || !Array.isArray(request2.topicPolicy.subscribe)) {
+      throw new import_common6.BadRequestException("Publish and subscribe topic policies must be arrays.");
+    }
+    for (const filter of [...request2.topicPolicy.publish, ...request2.topicPolicy.subscribe]) {
+      if (typeof filter !== "string" || filter.length === 0 || filter.length > 1024) {
+        throw new import_common6.BadRequestException("MQTT topic filters must be non-empty strings no longer than 1024 characters.");
+      }
+      this.assertTopicFilter(filter);
+    }
+  }
+  assertTopicFilter(filter) {
+    if (filter.includes(".")) {
+      throw new import_common6.BadRequestException("RabbitMQ MQTT topic policies cannot contain dots.");
+    }
+    const segments = filter.split("/");
+    for (const [index, segment] of segments.entries()) {
+      if (segment.includes("+") && segment !== "+" || segment.includes("#") && (segment !== "#" || index !== segments.length - 1)) {
+        throw new import_common6.BadRequestException(
+          "MQTT wildcards must occupy a complete topic level, and # must be the final level."
+        );
+      }
+    }
+  }
+  assertName(value, label) {
+    if (typeof value !== "string" || value.trim().length === 0 || value.length > 255) {
+      throw new import_common6.BadRequestException(`${label} must be a non-empty string no longer than 255 characters.`);
+    }
+  }
+  assertNotManagementUser(config, username) {
+    if (config.username === username) {
+      throw new import_common6.BadRequestException("Refusing to modify the MQTT server management identity.");
+    }
+  }
+};
+__publicField(_RabbitmqCredentialProvisioningProvider, "vhostLocks", /* @__PURE__ */ new Map());
+var RabbitmqCredentialProvisioningProvider = _RabbitmqCredentialProvisioningProvider;
+function mqttFiltersToRegex(filters) {
+  if (filters.length === 0) {
+    return "$(?!)";
+  }
+  return `^(?:${filters.map(mqttFilterToRegex).join("|")})$`;
+}
+function mqttFilterToRegex(filter) {
+  const terminalMultiLevel = filter.endsWith("/#");
+  const prefix = terminalMultiLevel ? filter.slice(0, -2) : filter;
+  const translated = prefix.split("/").map((segment) => {
+    if (segment === "+") {
+      return "[^.]+";
+    }
+    if (segment === "#") {
+      return ".*";
+    }
+    return segment.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  }).join("\\.");
+  return terminalMultiLevel ? `${translated}(?:\\..*)?` : translated;
+}
+function escapeRegex(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+// backend/plugin.ts
+var PLUGIN_CONTEXT3 = /* @__PURE__ */ Symbol.for("attraccess.plugin.context");
+var RabbitmqService = class {
+  constructor(context) {
+    __publicField(this, "context", context);
+  }
+  onModuleInit() {
+    this.context.logger.log("RabbitMQ plugin loaded \u2014 MQTT-server RabbitMQ detection active.");
+  }
+  getStatus() {
+    return { plugin: "rabbitmq", status: "ok" };
+  }
+};
+RabbitmqService = __decorateClass([
+  (0, import_common7.Injectable)(),
+  __decorateParam(0, (0, import_common7.Inject)(PLUGIN_CONTEXT3))
+], RabbitmqService);
+var RabbitmqController = class {
+  // esbuild does not emit decorator metadata, so Nest cannot infer constructor
+  // types for injection — always inject by an explicit token.
+  constructor(service) {
+    __publicField(this, "service", service);
+  }
+  status() {
+    return this.service.getStatus();
+  }
+};
+__decorateClass([
+  (0, import_common7.Get)("status")
+], RabbitmqController.prototype, "status", 1);
+RabbitmqController = __decorateClass([
+  (0, import_plugins_backend_sdk3.Auth)("resources.update"),
+  (0, import_common7.Controller)("rabbitmq"),
+  __decorateParam(0, (0, import_common7.Inject)(RabbitmqService))
+], RabbitmqController);
+var RabbitmqPluginModule = class {
+};
+var plugin = {
+  credentialProvisioningProvider(context) {
+    return new RabbitmqCredentialProvisioningProvider(context);
+  },
+  register(context) {
+    return {
+      module: RabbitmqPluginModule,
+      controllers: [RabbitmqController, RabbitmqDetectionController, RabbitmqUsersController],
+      providers: [
+        { provide: PLUGIN_CONTEXT3, useValue: context },
+        RabbitmqService,
+        RabbitmqDetectionService,
+        RabbitmqManagementClient,
+        RabbitmqUsersService
+      ]
+    };
+  }
+};
+var plugin_default = plugin;