@autofleet/zehut 4.0.1-beta-5973b326.0 → 4.1.0

package/README.md

@@ -4,7 +4,38 @@ This package handles authorization and authentication for AutoFleet services.
 
 ## V4 migration
 
-When upgrading from V3 to V4, the tracing system has been de-duped to use outbreak v2. This means that the context of the trace is now spread onto the headers.
-Using `getUser` will keep working, but reading anything else from the context will work only if you read from the correct context (there are now 2: `context`, and `nonHeaderContext`).
+### Outbreak v2
+When upgrading from V3 to V4, the tracing system has been de-duped to use outbreak v2.
+Historically, `zehut` and `outbreak` both added a layer of `async_hooks`, which each had a context that could store data.
+The 2 had a nearly identical API, but did not communicate with each other, nor did they share data.
+This version removes the trace added by `zehut` and only uses the `outbreak` one. This means that the context of the trace is now spread onto the headers of any outgoing HTTP request.
+In order to allow keeping data in the context, without having `outbreak` add it to the headers, a new context has been added to the `outbreak` traces - `nonHeaderContext`.
+Using the `getUser` function will keep working regularly, but reading anything else from the context will work only if you read from the correct context.
 
-In addition, when calling the `enableTracing` function, you can now pass in the logger, and drop the call for `logger.addContextMiddleware`.
+```diff
+- const { context } = zehut.getCurrentPayload();
+- const user = context?.get('userObject');
++ const user = zehut.getUser();
+```
+
+If you need to read any other data from the context, you should now read and write to `nonHeaderContext`, unless you wish for the values to be sent through to the headers of any outgoing request/response.
+```diff
+const currentTrace = zehut.getCurrentPayload();
+-const dataFromContext = currentTrace?.context?.get('DATA_FROM_CONTEXT');
++const dataFromContext = currentTrace?.nonHeaderContext?.get('DATA_FROM_CONTEXT');
+```
+
+
+### Logger
+
+The tracing mechanism has been updated to reduce boilerplate code.
+Now, when calling the `enableTracing` function, you can now pass in the instance of the `logger`, and drop the call for `logger.addContextMiddleware`.
+
+```diff
+-zehut.enableTracing();
+-
+-logger.addContextMiddleware(() => ({
+-  traceId: zehut.outbreak.getCurrentContext()?.context?.get('x-trace-id'),
+-}));
++zehut.enableTracing({ logger });
+```

package/lib/index.cjs

@@ -1,3 +1,3 @@
-'use strict';Object.defineProperty(exports,'__esModule',{value:true});var y=require('@autofleet/outbreak'),re=require('jsonwebtoken'),le=require('node-cache'),ge=require('object-hash'),S=require('moment'),D=require('@autofleet/network');function _interopDefault(e){return e&&e.__esModule?e:{default:e}}function _interopNamespace(e){if(e&&e.__esModule)return e;var n=Object.create(null);if(e){Object.keys(e).forEach(function(k){if(k!=='default'){var d=Object.getOwnPropertyDescriptor(e,k);Object.defineProperty(n,k,d.get?d:{enumerable:true,get:function(){return e[k]}});}})}n.default=e;return Object.freeze(n)}var y__namespace=/*#__PURE__*/_interopNamespace(y);var re__namespace=/*#__PURE__*/_interopNamespace(re);var le__default=/*#__PURE__*/_interopDefault(le);var ge__default=/*#__PURE__*/_interopDefault(ge);var S__default=/*#__PURE__*/_interopDefault(S);var D__default=/*#__PURE__*/_interopDefault(D);var {DEPRECATED_JWT_SECRET:ie,JWT_NEW_SECRET:oe,DEPRECATED_REFRESH_JWT_SECRET:ne,REFRESH_JWT_SECRET:ae,DEPRECATION_UNIX_TIMESTAMP:ce}=process.env,_=(t,e,s)=>{let r=S__default.default(parseInt(ce,10)*1e3);try{let i;if(t){let{iat:o}=re__namespace.default.decode(t);i=S__default.default(o*1e3);}else i=S__default.default();return i.isBefore(r)?e:s}catch{return s}},de=t=>_(t,ne,ae),A=t=>_(t,ie,oe);var I=t=>t.replace("Bearer ",""),C=(t,e)=>{let s=I(t);return re__namespace.verify(s,A(s))};var ue="00000000-0000-0000-0000-000000000000",me="ffffffff-ffff-ffff-ffff-ffffffffffff",E="[0-9a-f]",pe="[1-8]",fe=new RegExp(`^(?:${E}{8}-${E}{4}-${pe}${E}{3}-[89ab]${E}{3}-${E}{12}|${ue}|${me})$`,"i");function L(t){return typeof t=="string"&&fe.test(t)}var M=10,k=process.env.API_GATEWAY_URL||"https://api.autofleet.io",b=new D__default.default({serviceName:"IDENTITY_MS",retries:3,retryCondition:()=>true,cache:process.env.NODE_ENV!=="test"?{maxAge:M*1e3}:undefined}),w=new D__default.default({baseURL:k,serviceUrl:k,retries:3,retryCondition:()=>true,cache:process.env.NODE_ENV!=="test"?{maxAge:M*1e3}:undefined});var g="x-af-elevated-permissions",U="x-af-context-ids",l=new le__default.default({stdTTL:10}),H=(t,e)=>{let s={...t,fleets:{...t?.fleets},businessModels:{...t?.businessModels},demandSources:{...t?.demandSources}};for(let r of e)Object.keys(r).forEach(i=>{s[i]??={},Object.entries(r[i]).forEach(([o,n])=>{s[i][o]=(s[i][o]||[]).concat(n);});});return s},m=class{constructor(e,s,r,i){this.id=e;this.accountType=s;this.contextIds=i;this.privateElevatedPermissionsHash=new Map;this.appPermission={};this.emptyUser=!!e,r&&this.privateElevatedPermissionsHash.set(Symbol("initial"),r);}async getUserPermissions(){if(!this.id)return;if(this.privatePermissions)return this.privatePermissions;let e=ge__default.default({id:this.id,contextIds:this.contextIds}),s=l.get(e);return s||({data:s}=await b.get(`/api/v1/users/${this.id}/authorization-payload`,{params:{contextIds:this.contextIds}}),l.set(e,s)),this.accountType=s.accountType,this.privatePermissions=s,this.privatePermissions}async useCustomPermissionLoader(e){if(!this.id)return;if(this.privatePermissions)return this.privatePermissions;let s=this.id,r=l.get(s);if(r)return this.privatePermissions=r,r;let i=await e(this.id);return l.set(s,i),this.privatePermissions=i,this.privatePermissions}get businessModels(){return this.getUserProperty("businessModels")}get fleets(){return this.getUserProperty("fleets")}get demandSources(){return this.getUserProperty("demandSources")}getUserProperty(e){if(!this.privatePermissions)throw new Error(`Cannot get ${e} without calling (async) getUserPermissions before`);return Object.keys(this.privatePermissions[e]||{})}get elevatedPermissions(){return H(undefined,this.privateElevatedPermissionsHash.values())}get permissions(){if(!this.privatePermissions)throw new Error("Cannot get permissions without calling (async) getUserPermissions before");return H(this.privatePermissions,this.privateElevatedPermissionsHash.values())}elevatePermissions(e){let s=Symbol();Object.values(e).forEach(n=>{Object.keys(n).forEach(a=>{if(!L(a))throw new Error(`Entity id on elevatePermissions is not a valid UUID, provided: ${a}`)});});let r=y.getCurrentContext();if(!r)throw new Error("Cannot find current user cross services trace");let i=JSON.parse(r.context[g]||"{}"),o=Object.assign(i,e);return this.privateElevatedPermissionsHash.set(s,o),r.context.set(g,JSON.stringify(this.elevatedPermissions)),()=>{this.privateElevatedPermissionsHash.delete(s),r.context.set(g,JSON.stringify(this.elevatedPermissions));}}async getUserPermissionsLegacy(){if(!this.id)return;if(this.privatePermissionsLegacy)return this.privatePermissionsLegacy;let{data:e}=await b.get(`/api/v1/users/${this.id}/authorization-payload-legacy`);return this.privatePermissionsLegacy=e,this.privatePermissionsLegacy}get permissionsLegacy(){if(!this.privatePermissionsLegacy)throw new Error("Cannot get permissionsLegacy without calling (async) getUserPermissionsLegacy before");return this.privatePermissionsLegacy}async getUserAppPermissions(e,s){if(!this.id||!e||!s)return;let r=this.appPermission[e];if(r)return r;let i=`${this.id}:${e}`,o=l.get(i);if(o)return this.appPermission[e]=o,o;let{data:n}=await w.post(`/api/v1/apps/${e}/get-user-payload`,{userId:this.id},{headers:{"x-autofleet-apps-secret":s}});return l.set(i,n),this.appPermission[e]=n,this.appPermission[e]}};var j=async(t,e)=>{let{data:s}=await w.post("/api/v1/auth",{bearer:t,appId:e});return s};var P=class extends Error{constructor(){super(...arguments);this.name="AppDoesNotExist";this.message="app does not exist";}};var Ee="identity-ms",Ue="accessToken",p="userObject",W="x-af-user-id",J="X-IAF-ORIGIN-SERVICE",R="x-af-user-permissions",xe=J.toLowerCase(),z=(t={})=>async(e,s,r)=>{try{if((e.headers[J]||e.headers[xe]||"").toLowerCase()===Ee)return r();let{eagerLoadUserPermissions:o,eagerLoadUserPermissionsLegacy:n,customPermissionLoader:a}=t,d=e.headers[W];if(!d)return r();let f=e.headers[g]?.length>0?JSON.parse(e.headers[g]):{},u=e.headers?.[U]?.split(","),c=new m(d,"user",f,u);return o&&(a?await c.useCustomPermissionLoader(a):await c.getUserPermissions()),n&&await c.getUserPermissionsLegacy(),e.user=c,y.getCurrentContext().nonHeaderContext?.set(p,c),e.headers[R]=c,r()}catch{return s.status(401),s.json({error:"cannot authenticate user"})}},F=(t={})=>async(e,s,r)=>{let{eagerLoadUserPermissions:i,eagerLoadUserPermissionsLegacy:o,returnErrorIfNoToken:n}=t,a;if(e.headers.authorization){try{a=await C(e.headers.authorization);}catch(c){c instanceof re.TokenExpiredError?(s.status(401),s.json({errors:["Access token expired"]})):c instanceof re.JsonWebTokenError?(s.status(400),s.json({errors:[c.message]})):(s.status(500),s.json({errors:["Server error while parsing token"]}));return}let d=a?.user?.id;d&&(e.headers[W]=d);let f=e.headers?.[U]?.split(","),u=new m(d,a?.user?.accountType,undefined,f);i&&await u.getUserPermissions(),o&&await u.getUserPermissionsLegacy(),e.user=u,y.getCurrentContext().nonHeaderContext?.set(p,u),e.headers[R]=u;}else if(n)return s.status(401),s.json({errors:["No token provided"]});return r()},G=t=>async(e,s,r)=>{let{appId:i,clientSecret:o}=t,n;if(!e.headers.authorization)return s.status(401),s.json({errors:["No token provided"]});try{if(n=await j(e.headers.authorization,i),!n)throw new P}catch(u){return u instanceof re.TokenExpiredError?s.status(401).json({errors:["Access token expired"]}):[re.JsonWebTokenError,P].some(c=>u instanceof c)?s.status(400).json({errors:[u.message]}):s.status(500).json({errors:["Server error while parsing token"]})}let a=n?.userId;a&&(e.headers[p]=a);let d=new m(a);i&&(e.headers["x-autofleet-apps-secret"]=o,await d.getUserAppPermissions(i,o)),e.user=d;let f=y.getCurrentContext().nonHeaderContext;return f?.set(p,d),f?.set(Ue,I(e.headers.authorization)),e.headers[R]=d,r()},X=async(t,e,s)=>(await t.user.getUserPermissions(),s()),V=t=>t.headers.authorization?C(t.headers.authorization):null,K=async(t,e)=>{let s=new m(e);await s.getUserPermissions(),t??=y.newTrace(y.traceTypes.RABBIT),t.nonHeaderContext.set(p,s);},Y=m;var h=()=>y.getCurrentContext().nonHeaderContext?.get(p),x=()=>h()?.id,Z=t=>!x()||Object.keys(h().permissions.fleets).includes(t),Q=t=>!x()||Object.keys(h().permissions.businessModels).includes(t),q=t=>!x()||Object.keys(h().permissions.demandSources).includes(t);var T=class extends Error{constructor(s=null,r="UnauthorizedAccessError"){super(r);this.user=s;this.name="UnauthorizedAccessError";}};var v={NONE:"NONE",BASIC:"BASIC",JWT:"JWT"},ee={[v.NONE]:()=>{},[v.BASIC]:t=>{let{username:e,password:s}=t;return `Basic ${Buffer.from(`${e}:${s}`).toString("base64")}`},[v.JWT]:t=>{let{secret:e}=t;if(e)return `Bearer ${re__namespace.sign({},e,{expiresIn:10})}`}},te=t=>{let e=t?.method;if(!(!e||!ee[e]))return ee[e](t)};var we=y__namespace.getCurrentContext,as=({outbreakOptions:t={},logger:e}={})=>{y__namespace.default({headersPrefix:"x-af",contextMiddlewareGetter:e?.addContextMiddleware,...t});},{traceTypes:Te,newTrace:Se}=y__namespace;var cs={traceTypes:Te,newTrace:Se,User:Y,middleware:z,middlewareWithDecode:F,eagerLoadPermissionsMiddleware:X,getCurrentPayload:we,getDecodedBearer:V,checkFleetPermission:Z,checkBusinessModelPermission:Q,checkDemandSourcePermission:q,isUserExist:x,getUser:h,UnauthorizedAccessError:T,appMiddleware:G,createOrSetRabbitTrace:K,outbreak:y__namespace,AUTHORIZATION_METHODS:v,getAuthorizationHeader:te,CONTEXTS_IDS_HEADER:U};
-exports.outbreak=y__namespace;exports.AUTHORIZATION_METHODS=v;exports.CONTEXTS_IDS_HEADER=U;exports.UnauthorizedAccessError=T;exports.User=Y;exports.appMiddleware=G;exports.checkBusinessModelPermission=Q;exports.checkDemandSourcePermission=q;exports.checkFleetPermission=Z;exports.createOrSetRabbitTrace=K;exports.default=cs;exports.eagerLoadPermissionsMiddleware=X;exports.enableTracing=as;exports.getAuthorizationHeader=te;exports.getCurrentPayload=we;exports.getDecodedBearer=V;exports.getRefreshTokenSecret=de;exports.getTokenSecret=A;exports.getUser=h;exports.isUserExist=x;exports.middleware=z;exports.middlewareWithDecode=F;exports.newTrace=Se;exports.traceTypes=Te;//# sourceMappingURL=index.cjs.map
+'use strict';Object.defineProperty(exports,'__esModule',{value:true});var g=require('@autofleet/outbreak'),S=require('jsonwebtoken'),Ue=require('node-cache'),xe=require('object-hash'),b=require('moment'),B=require('@autofleet/network');function _interopDefault(e){return e&&e.__esModule?e:{default:e}}function _interopNamespace(e){if(e&&e.__esModule)return e;var n=Object.create(null);if(e){Object.keys(e).forEach(function(k){if(k!=='default'){var d=Object.getOwnPropertyDescriptor(e,k);Object.defineProperty(n,k,d.get?d:{enumerable:true,get:function(){return e[k]}});}})}n.default=e;return Object.freeze(n)}var g__namespace=/*#__PURE__*/_interopNamespace(g);var S__namespace=/*#__PURE__*/_interopNamespace(S);var Ue__default=/*#__PURE__*/_interopDefault(Ue);var xe__default=/*#__PURE__*/_interopDefault(xe);var b__default=/*#__PURE__*/_interopDefault(b);var B__default=/*#__PURE__*/_interopDefault(B);var {DEPRECATED_JWT_SECRET:ue,JWT_NEW_SECRET:pe,DEPRECATED_REFRESH_JWT_SECRET:me,REFRESH_JWT_SECRET:fe,DEPRECATION_UNIX_TIMESTAMP:le}=process.env,k=(s,e,r)=>{let o=b__default.default(parseInt(le,10)*1e3);try{let t;if(s){let{iat:i}=S__namespace.default.decode(s);t=b__default.default(i*1e3);}else t=b__default.default();return t.isBefore(o)?e:r}catch{return r}},Ee=s=>k(s,me,fe),C=s=>k(s,ue,pe);var w=s=>s.replace("Bearer ",""),_=(s,e)=>{let r=w(s);return S__namespace.verify(r,C(r))};var Pe="00000000-0000-0000-0000-000000000000",ge="ffffffff-ffff-ffff-ffff-ffffffffffff",h="[0-9a-f]",ye="[1-8]",he=new RegExp(`^(?:${h}{8}-${h}{4}-${ye}${h}{3}-[89ab]${h}{3}-${h}{12}|${Pe}|${ge})$`,"i");function j(s){return typeof s=="string"&&he.test(s)}var $=10,F=process.env.API_GATEWAY_URL||"https://api.autofleet.io",O=new B__default.default({serviceName:"IDENTITY_MS",retries:3,retryCondition:()=>true,cache:process.env.NODE_ENV!=="test"?{maxAge:$*1e3}:void 0}),A=new B__default.default({baseURL:F,serviceUrl:F,retries:3,retryCondition:()=>true,cache:process.env.NODE_ENV!=="test"?{maxAge:$*1e3}:void 0});var l="x-af-elevated-permissions",E="x-af-context-ids",f=new Ue__default.default({stdTTL:10}),J=(s,e)=>{let r={...s,fleets:{...s?.fleets},businessModels:{...s?.businessModels},demandSources:{...s?.demandSources}};for(let o of e)Object.keys(o).forEach(t=>{r[t]??={},Object.entries(o[t]).forEach(([i,n])=>{r[t][i]=(r[t][i]||[]).concat(n);});});return r},u=class{constructor(e,r,o,t){this.id=e;this.accountType=r;this.contextIds=t;this.privateElevatedPermissionsHash=new Map;this.appPermission={};this.emptyUser=!!e,o&&this.privateElevatedPermissionsHash.set(Symbol("initial"),o);}async getUserPermissions(){if(!this.id)return;if(this.privatePermissions)return this.privatePermissions;let e=xe__default.default({id:this.id,contextIds:this.contextIds}),r=f.get(e);return r||({data:r}=await O.get(`/api/v1/users/${this.id}/authorization-payload`,{params:{contextIds:this.contextIds}}),f.set(e,r)),this.accountType=r.accountType,this.privatePermissions=r,this.privatePermissions}async useCustomPermissionLoader(e){if(!this.id)return;if(this.privatePermissions)return this.privatePermissions;let r=this.id,o=f.get(r);if(o)return this.privatePermissions=o,o;let t=await e(this.id);return f.set(r,t),this.privatePermissions=t,this.privatePermissions}get businessModels(){return this.getUserProperty("businessModels")}get fleets(){return this.getUserProperty("fleets")}get demandSources(){return this.getUserProperty("demandSources")}getUserProperty(e){if(!this.privatePermissions)throw new Error(`Cannot get ${e} without calling (async) getUserPermissions before`);return Object.keys(this.privatePermissions[e]||{})}get elevatedPermissions(){return J(void 0,this.privateElevatedPermissionsHash.values())}get permissions(){if(!this.privatePermissions)throw new Error("Cannot get permissions without calling (async) getUserPermissions before");return J(this.privatePermissions,this.privateElevatedPermissionsHash.values())}elevatePermissions(e){let r=Symbol();Object.values(e).forEach(n=>{Object.keys(n).forEach(a=>{if(!j(a))throw new Error(`Entity id on elevatePermissions is not a valid UUID, provided: ${a}`)});});let o=g.getCurrentContext();if(!o)throw new Error("Cannot find current user cross services trace");let t=JSON.parse(o.context[l]||"{}"),i=Object.assign(t,e);return this.privateElevatedPermissionsHash.set(r,i),o.context.set(l,JSON.stringify(this.elevatedPermissions)),()=>{this.privateElevatedPermissionsHash.delete(r),o.context.set(l,JSON.stringify(this.elevatedPermissions));}}async getUserPermissionsLegacy(){if(!this.id)return;if(this.privatePermissionsLegacy)return this.privatePermissionsLegacy;let{data:e}=await O.get(`/api/v1/users/${this.id}/authorization-payload-legacy`);return this.privatePermissionsLegacy=e,this.privatePermissionsLegacy}get permissionsLegacy(){if(!this.privatePermissionsLegacy)throw new Error("Cannot get permissionsLegacy without calling (async) getUserPermissionsLegacy before");return this.privatePermissionsLegacy}async getUserAppPermissions(e,r){if(!this.id||!e||!r)return;let o=this.appPermission[e];if(o)return o;let t=`${this.id}:${e}`,i=f.get(t);if(i)return this.appPermission[e]=i,i;let{data:n}=await A.post(`/api/v1/apps/${e}/get-user-payload`,{userId:this.id},{headers:{"x-autofleet-apps-secret":r}});return f.set(t,n),this.appPermission[e]=n,this.appPermission[e]}};var W=async(s,e)=>{let{data:r}=await A.post("/api/v1/auth",{bearer:s,appId:e});return r};var P=class extends Error{constructor(){super(...arguments);this.name="AppDoesNotExist";this.message="app does not exist";}};var G="identity-ms",z="accessToken",m="userObject",U="x-af-user-id",H="X-IAF-ORIGIN-SERVICE",I="x-af-user-permissions",X=H.toLowerCase(),V="x-autofleet-apps-secret";var T=async(s,e)=>{let r=e[H]||e[X]||"";if(!Array.isArray(r)&&r.toLowerCase()===G)return;let{eagerLoadUserPermissions:o,eagerLoadUserPermissionsLegacy:t,customPermissionLoader:i}=s,n=e[U];if(!n||Array.isArray(n))return;let a=e[l]?.length>0?JSON.parse(e[l]):{},c=e?.[E]?.split(","),d=new u(n,"user",a,c);return o&&(i?await d.useCustomPermissionLoader(i):await d.getUserPermissions()),t&&await d.getUserPermissionsLegacy(),g.getCurrentContext().nonHeaderContext?.set(m,d),d};var Y=(s={})=>async(e,r,o)=>{try{let t=await T(s,e.headers);t&&(e.user=t,e.headers[I]=t),o();}catch{r.status(401).json({error:"cannot authenticate user"});}},Z=(s={})=>async(e,r,o)=>{let{eagerLoadUserPermissions:t,eagerLoadUserPermissionsLegacy:i,returnErrorIfNoToken:n}=s,a;if(e.headers.authorization){try{a=await _(e.headers.authorization);}catch(y){y instanceof S__namespace.default.TokenExpiredError?r.status(401).json({errors:["Access token expired"]}):y instanceof S__namespace.default.JsonWebTokenError?r.status(400).json({errors:[y.message]}):r.status(500).json({errors:["Server error while parsing token"]});return}let c=a?.user?.id;c&&(e.headers[U]=c);let d=e.headers?.[E]?.split(","),p=new u(c,a?.user?.accountType,void 0,d);(t||i)&&await Promise.all([t&&p.getUserPermissions(),i&&p.getUserPermissionsLegacy()]),e.user=p,g.getCurrentContext().nonHeaderContext?.set(m,p),e.headers[I]=p;}else if(n){r.status(401).json({errors:["No token provided"]});return}o();},Q=s=>async(e,r,o)=>{let{appId:t,clientSecret:i}=s,n;if(!e.headers.authorization){r.status(401).json({errors:["No token provided"]});return}try{if(n=await W(e.headers.authorization,t),!n)throw new P}catch(p){if(p instanceof S__namespace.default.TokenExpiredError){r.status(401).json({errors:["Access token expired"]});return}if([S__namespace.default.JsonWebTokenError,P].some(y=>p instanceof y)){r.status(400).json({errors:[p.message]});return}r.status(500).json({errors:["Server error while parsing token"]});return}let a=n?.userId;a&&(e.headers[U]=a);let c=new u(a);t&&(e.headers[V]=i,await c.getUserAppPermissions(t,i)),e.user=c;let d=g.getCurrentContext().nonHeaderContext;d?.set(m,c),d?.set(z,w(e.headers.authorization)),e.headers[I]=c,o();},q=async(s,e,r)=>{await s.user.getUserPermissions(),r();},ee=s=>s.headers.authorization?_(s.headers.authorization):null,se=async(s,e)=>{let r=new u(e);await r.getUserPermissions(),s??=g.newTrace(g.traceTypes.RABBIT),s.nonHeaderContext.set(m,r);},re=u;var N=(s,e,r)=>{s.addHook("onRequest",async(o,t)=>{try{let i=await T(e,o.headers);i&&s.decorateRequest("user",i);}catch{t.status(401).send({error:"cannot authenticate user"});}}),r();};N[Symbol.for("skip-override")]=true;var v=()=>g.getCurrentContext().nonHeaderContext?.get(m),L=()=>v()?.id,D=(s,e)=>!L()||Object.hasOwn(v().permissions[e],s),te=s=>D(s,"fleets"),oe=s=>D(s,"businessModels"),ie=s=>D(s,"demandSources");var R=class extends Error{constructor(r=null,o="UnauthorizedAccessError"){super(o);this.user=r;this.name="UnauthorizedAccessError";}};var x={NONE:"NONE",BASIC:"BASIC",JWT:"JWT"},ne={[x.NONE]:()=>{},[x.BASIC]:s=>{let{username:e,password:r}=s;return `Basic ${Buffer.from(`${e}:${r}`).toString("base64")}`},[x.JWT]:s=>{let{secret:e}=s;if(e)return `Bearer ${S__namespace.sign({},e,{expiresIn:10})}`}},ce=s=>{let e=s?.method;if(!(!e||!ne[e]))return ne[e](s)};var Re=g__namespace.getCurrentContext,As=({outbreakOptions:s={},logger:e}={})=>{g__namespace.default({headersPrefix:"x-af",contextMiddlewareGetter:e?.addContextMiddleware,...s});},{traceTypes:be,newTrace:Ce}=g__namespace;var Is={traceTypes:be,newTrace:Ce,User:re,middleware:Y,middlewareWithDecode:Z,eagerLoadPermissionsMiddleware:q,getCurrentPayload:Re,getDecodedBearer:ee,checkFleetPermission:te,checkBusinessModelPermission:oe,checkDemandSourcePermission:ie,isUserExist:L,getUser:v,UnauthorizedAccessError:R,appMiddleware:Q,createOrSetRabbitTrace:se,outbreak:g__namespace,AUTHORIZATION_METHODS:x,getAuthorizationHeader:ce,CONTEXTS_IDS_HEADER:E,authFromUserIdHeaderPlugin:N};
+exports.outbreak=g__namespace;exports.AUTHORIZATION_METHODS=x;exports.CONTEXTS_IDS_HEADER=E;exports.UnauthorizedAccessError=R;exports.User=re;exports.appMiddleware=Q;exports.authFromUserIdHeaderPlugin=N;exports.checkBusinessModelPermission=oe;exports.checkDemandSourcePermission=ie;exports.checkFleetPermission=te;exports.createOrSetRabbitTrace=se;exports.default=Is;exports.eagerLoadPermissionsMiddleware=q;exports.enableTracing=As;exports.getAuthorizationHeader=ce;exports.getCurrentPayload=Re;exports.getDecodedBearer=ee;exports.getRefreshTokenSecret=Ee;exports.getTokenSecret=C;exports.getUser=v;exports.isUserExist=L;exports.middleware=Y;exports.middlewareWithDecode=Z;exports.newTrace=Ce;exports.traceTypes=be;//# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map

package/lib/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/secret-getter.ts","../src/utils.ts","../src/services.ts","../src/user/ApiUser.ts","../src/app-auth.ts","../src/exceptions/appDoesNotExist.ts","../src/user/index.ts","../src/check-permission.ts","../src/errors.ts","../src/authorization.ts","../src/index.ts"],"names":["DEPRECATED_JWT_SECRET","JWT_NEW_SECRET","DEPRECATED_REFRESH_JWT_SECRET","REFRESH_JWT_SECRET","DEPRECATION_UNIX_TIMESTAMP","getRelevantSecret","token","deprecatedSecret","newSecret","deprecationTime","moment","unixTime","iat","jwt","getRefreshTokenSecret","getTokenSecret","getAuthFromBearer","bearer","decodeBearer","appSecret","N","EMPTY_UUID","FULL_UUID","VALID_CHARS_REGEX","UUID_VERSION_REGEX","UUID_REGEX","validateUUID","uuid","CACHE_LIFETIME_IN_SEC","apiGwUrl","IdentityNetwork","Network","AutofleetApiNetwork","ELEVATED_PERMISSIONS_HEADER","CONTEXTS_IDS_HEADER","userCache","NodeCache","mergePermissions","target","sources","permissions","source","entityType","entityId","perms","ApiUser","id","accountType","elevatedPermissions","contextIds","cacheKey","objectHash","data","customPermissionLoader","cachedResult","key","addedPermissions","elevationId","entityIds","currentUserTrace","getCurrentContext","currentElevation","newElevation","appId","clientSecret","currentAppPermission","decodeAppBearer","decoded","AppDoesNotExist","IDENTITY_MS","ACCESS_TOKEN","USER_OBJECT","USER_TRACING_HEADER","ORIGIN_HEADER","USER_PERMISSIONS_HEADER","LOWER_CASE_ORIGIN_HEADER","middleware","options","req","res","next","eagerLoadUserPermissions","eagerLoadUserPermissionsLegacy","userId","elevatedPermissionsFromHeader","userObject","middlewareWithDecode","returnErrorIfNoToken","e","TokenExpiredError","JsonWebTokenError","appMiddleware","Err","currentTraceContext","eagerLoadPermissionsMiddleware","getDecodedBearer","createOrSetRabbitTrace","trace","newTrace","traceTypes","user_default","getUser","isUserExist","checkFleetPermission","fleetId","checkBusinessModelPermission","businessModelId","checkDemandSourcePermission","demandSourceId","UnauthorizedAccessError","user","message","AUTHORIZATION_METHODS","AUTHORIZATION_ACTIONS","authorizationSettings","username","password","secret","se","getAuthorizationHeader","authorizationMethod","getCurrentPayload","y","enableTracing","outbreakOptions","logger","outbreak","index_default"],"mappings":"y4BAGA,IAAM,CACJ,qBAAAA,CAAAA,EAAAA,CAAuB,eAAAC,EACvB,CAAA,6BAAA,CAAAC,GAA+B,kBAAAC,CAAAA,EAAAA,CAC/B,0BAAAC,CAAAA,EACF,CAAI,CAAA,OAAA,CAAQ,IAENC,CAAoB,CAAA,CAACC,EAA2BC,CAA0BC,CAAAA,CAAAA,GAA8B,CAC5G,IAAMC,CAAAA,CAAkBC,mBAAO,QAASN,CAAAA,EAAAA,CAA4B,EAAE,CAAI,CAAA,GAAI,EAC9E,GAAI,CACF,IAAIO,CACJ,CAAA,GAAIL,CAAO,CAAA,CACT,GAAM,CAAE,IAAAM,CAAI,CAAA,CAAIC,sBAAI,MAAOP,CAAAA,CAAK,EAChCK,CAAWD,CAAAA,kBAAAA,CAAOE,CAAM,CAAA,GAAI,EAC9B,CAAA,KACED,EAAWD,kBAAO,EAAA,CAEpB,OAAOC,CAAS,CAAA,QAAA,CAASF,CAAe,CAAIF,CAAAA,CAAAA,CAAmBC,CACjE,CAAA,KAAY,CACV,OAAOA,CACT,CACF,CAAA,CAEaM,GAAyBR,CAA2BD,EAAAA,CAAAA,CAAkBC,EAAOJ,EAA+BC,CAAAA,EAAkB,EAC9HY,CAAkBT,CAAAA,CAAAA,EAA2BD,EAAkBC,CAAON,CAAAA,EAAAA,CAAuBC,EAAc,ECfjH,IAAMe,EAAqBC,CAA2BA,EAAAA,CAAAA,CAAO,OAAQ,CAAA,SAAA,CAAW,EAAE,CAAA,CAE5EC,EAAe,CAACD,CAAAA,CAAgBE,IAA4B,CACvE,IAAMb,EAAQU,CAAkBC,CAAAA,CAAM,CAEtC,CAAA,OADoBG,aAAOd,CAAAA,MAAAA,CAAAA,CAAAA,CAAoBS,CAAeT,CAAAA,CAAK,CAAC,CAEtE,CAAA,CAyDA,IAAMe,EAAa,CAAA,sCAAA,CACbC,EAAY,CAAA,sCAAA,CACZC,CAAoB,CAAA,UAAA,CACpBC,GAAqB,OACrBC,CAAAA,EAAAA,CAAa,IAAI,MAAO,CAAA,CAAA,IAAA,EAAOF,CAAiB,CAAOA,IAAAA,EAAAA,CAAiB,CAAOC,IAAAA,EAAAA,EAAkB,CAAGD,EAAAA,CAAiB,aAAaA,CAAiB,CAAA,IAAA,EAAOA,CAAiB,CAAQF,KAAAA,EAAAA,EAAU,IAAIC,EAAS,CAAA,EAAA,CAAA,CAAM,GAAG,CAAA,CAClN,SAASI,CAAAA,CAAaC,EAA6B,CACxD,OAAO,OAAOA,CAAS,EAAA,QAAA,EAAYF,GAAW,IAAKE,CAAAA,CAAI,CACzD,CC/EA,IAAMC,CAAAA,CAAwB,GACxBC,CAAW,CAAA,OAAA,CAAQ,IAAI,eAAmB,EAAA,0BAAA,CAGnCC,CAAkB,CAAA,IAAIC,kBAAQ,CAAA,CACzC,YAAa,aACb,CAAA,OAAA,CAAS,EACT,cAAgB,CAAA,IAAM,KACtB,KAAO,CAAA,OAAA,CAAQ,IAAI,QAAa,GAAA,MAAA,CAAS,CACvC,MAAQH,CAAAA,CAAAA,CAAwB,GAClC,CAAI,CAAA,SACN,CAAC,CAEYI,CAAAA,CAAAA,CAAsB,IAAID,kBAAAA,CAAQ,CAC7C,OAAA,CAASF,EACT,UAAYA,CAAAA,CAAAA,CACZ,QAAS,CACT,CAAA,cAAA,CAAgB,IAAM,IACtB,CAAA,KAAA,CAAO,OAAQ,CAAA,GAAA,CAAI,QAAa,GAAA,MAAA,CAAS,CACvC,MAAQD,CAAAA,CAAAA,CAAwB,GAClC,CAAI,CAAA,SACN,CAAC,CCZM,CAAA,IAAMK,CAA8B,CAAA,2BAAA,CAC9BC,CAAsB,CAAA,kBAAA,CAuB7BC,EAAY,IAAIC,mBAAAA,CAAU,CAAE,MAAQ,CAAA,EAAG,CAAC,CAExCC,CAAAA,CAAAA,CAAmB,CAACC,CAAqBC,CAAAA,CAAAA,GAAuD,CACpG,IAAMC,CAAAA,CAA2B,CAC/B,GAAGF,CAAAA,CACH,OAAQ,CAAE,GAAGA,CAAQ,EAAA,MAAO,CAC5B,CAAA,cAAA,CAAgB,CAAE,GAAGA,CAAAA,EAAQ,cAAe,CAC5C,CAAA,aAAA,CAAe,CAAE,GAAGA,CAAAA,EAAQ,aAAc,CAE5C,CAGA,CAAA,IAAA,IAAWG,KAAUF,CACnB,CAAA,MAAA,CAAO,KAAKE,CAAM,CAAA,CAAE,QAASC,CAAe,EAAA,CAE1CF,CAAYE,CAAAA,CAAU,CAAM,GAAA,GAC5B,MAAO,CAAA,OAAA,CAAQD,EAAOC,CAAU,CAAE,EAAE,OAAQ,CAAA,CAAC,CAACC,CAAUC,CAAAA,CAAK,IAAM,CAEjEJ,CAAAA,CAAYE,CAAU,CAAEC,CAAAA,CAAQ,GAAKH,CAAYE,CAAAA,CAAU,CAAEC,CAAAA,CAAQ,CAAK,EAAA,IAAI,MAAOC,CAAAA,CAAK,EAC5F,CAAC,EACH,CAAC,CAGH,CAAA,OAAOJ,CACT,CAAA,CAEqBK,CAArB,CAAA,KAA6B,CAW3B,WAAmBC,CAAAA,CAAAA,CAAqBC,EAA2BC,CAAiDC,CAAAA,CAAAA,CAAuB,CAAxH,IAAAH,CAAAA,EAAAA,CAAAA,CAAAA,CAAqB,IAAAC,CAAAA,WAAAA,CAAAA,CAAAA,CAA4E,IAAAE,CAAAA,UAAAA,CAAAA,CAAAA,CARpH,KAAiB,8BAAiC,CAAA,IAAI,IAItD,IAAiB,CAAA,aAAA,CAAwC,EAKvD,CAAA,IAAA,CAAK,SAAY,CAAA,CAAC,CAACH,CAAAA,CACfE,GACF,IAAK,CAAA,8BAAA,CAA+B,IAAI,MAAO,CAAA,SAAS,EAAGA,CAAmB,EAElF,CAEA,MAAM,kBAA2C,EAAA,CAC/C,GAAI,CAAC,IAAA,CAAK,GACR,OAEF,GAAI,KAAK,kBACP,CAAA,OAAO,IAAK,CAAA,kBAAA,CAEd,IAAME,CAAAA,CAAWC,oBAAW,CAC1B,EAAA,CAAI,KAAK,EACT,CAAA,UAAA,CAAY,KAAK,UACnB,CAAC,CAEGC,CAAAA,CAAAA,CAAOjB,CAAU,CAAA,GAAA,CAAiBe,CAAQ,CAE9C,CAAA,OAAKE,IACF,CAAE,IAAA,CAAAA,CAAK,CAAI,CAAA,MAAMtB,EAAgB,GAAI,CAAA,CAAA,cAAA,EAAiB,KAAK,EAAE,CAAA,sBAAA,CAAA,CAA0B,CAAE,MAAQ,CAAA,CAAE,WAAY,IAAK,CAAA,UAAW,CAAE,CAAC,CACnIK,CAAAA,CAAAA,CAAU,IAAIe,CAAUE,CAAAA,CAAI,GAG9B,IAAK,CAAA,WAAA,CAAcA,EAAK,WACxB,CAAA,IAAA,CAAK,kBAAqBA,CAAAA,CAAAA,CACnB,IAAK,CAAA,kBACd,CAEA,MAAM,yBAAA,CAA0BC,EAAmD,CACjF,GAAI,CAAC,IAAK,CAAA,EAAA,CACR,OAEF,GAAI,IAAK,CAAA,kBAAA,CACP,OAAO,IAAK,CAAA,kBAAA,CAGd,IAAMH,CAAW,CAAA,IAAA,CAAK,GAEhBI,CAAenB,CAAAA,CAAAA,CAAU,IAAiBe,CAAQ,CAAA,CACxD,GAAII,CACF,CAAA,OAAA,IAAA,CAAK,mBAAqBA,CACnBA,CAAAA,CAAAA,CAGT,IAAMF,CAAO,CAAA,MAAMC,CAAuB,CAAA,IAAA,CAAK,EAAE,CAAA,CACjD,OAAAlB,CAAU,CAAA,GAAA,CAAIe,EAAUE,CAAI,CAAA,CAE5B,KAAK,kBAAqBA,CAAAA,CAAAA,CACnB,IAAK,CAAA,kBACd,CAEA,IAAI,gBAAuC,CACzC,OAAO,KAAK,eAAgB,CAAA,gBAAgB,CAC9C,CAEA,IAAI,MAA+B,EAAA,CACjC,OAAO,IAAA,CAAK,gBAAgB,QAAQ,CACtC,CAEA,IAAI,aAAA,EAAsC,CACxC,OAAO,IAAA,CAAK,gBAAgB,eAAe,CAC7C,CAEQ,eAAgBG,CAAAA,CAAAA,CAA8C,CACpE,GAAI,CAAC,KAAK,kBACR,CAAA,MAAM,IAAI,KAAA,CAAM,CAAcA,WAAAA,EAAAA,CAAG,oDAAoD,CAEvF,CAAA,OAAO,OAAO,IAAK,CAAA,IAAA,CAAK,mBAAmBA,CAAG,CAAA,EAAK,EAAE,CACvD,CAEA,IAAI,mBAAmC,EAAA,CACrC,OAAOlB,CAAiB,CAAA,SAAA,CAAW,KAAK,8BAA+B,CAAA,MAAA,EAAQ,CACjF,CAEA,IAAI,aAAuC,CACzC,GAAI,CAAC,IAAK,CAAA,kBAAA,CACR,MAAM,IAAI,KAAA,CAAM,0EAA0E,CAAA,CAG5F,OAAOA,CAAAA,CAAiB,KAAK,kBAAoB,CAAA,IAAA,CAAK,+BAA+B,MAAO,EAAC,CAC/F,CAEA,kBAAA,CAAmBmB,CAAkD,CAAA,CAGnE,IAAMC,CAAAA,CAAc,QAGpB,CAAA,MAAA,CAAO,OAAOD,CAAgB,CAAA,CAAE,QAASE,CAAc,EAAA,CACrD,MAAO,CAAA,IAAA,CAAKA,CAAS,CAAA,CAAE,QAASf,CAAa,EAAA,CAC3C,GAAI,CAACjB,CAAAA,CAAaiB,CAAQ,CACxB,CAAA,MAAM,IAAI,KAAA,CAAM,CAAkEA,+DAAAA,EAAAA,CAAQ,EAAE,CAEhG,CAAC,EACH,CAAC,CAAA,CAED,IAAMgB,CAAmBC,CAAAA,mBAAAA,GACzB,GAAI,CAACD,EACH,MAAM,IAAI,MAAM,+CAA+C,CAAA,CAGjE,IAAME,CAAmB,CAAA,IAAA,CAAK,KAAMF,CAAAA,CAAAA,CAAiB,OAAQ1B,CAAAA,CAA2B,GAAK,IAAI,CAAA,CAC3F6B,EAAe,MAAO,CAAA,MAAA,CAAOD,EAAkBL,CAAgB,CAAA,CACrE,OAAK,IAAA,CAAA,8BAAA,CAA+B,GAAIC,CAAAA,CAAAA,CAAaK,CAAY,CACjEH,CAAAA,CAAAA,CAAiB,QAAQ,GAAI1B,CAAAA,CAAAA,CAA6B,KAAK,SAAU,CAAA,IAAA,CAAK,mBAAmB,CAAC,CAC3F,CAAA,IAAM,CACX,IAAK,CAAA,8BAAA,CAA+B,OAAOwB,CAAW,CAAA,CACtDE,EAAiB,OAAQ,CAAA,GAAA,CAAI1B,EAA6B,IAAK,CAAA,SAAA,CAAU,KAAK,mBAAmB,CAAC,EACpG,CACF,CAEA,MAAM,wBAA2B,EAAA,CAC/B,GAAI,CAAC,IAAK,CAAA,EAAA,CACR,OAEF,GAAI,IAAA,CAAK,yBACP,OAAO,IAAA,CAAK,yBAEd,GAAM,CAAE,IAAAmB,CAAAA,CAAK,CAAI,CAAA,MAAMtB,EAAgB,GAAI,CAAA,CAAA,cAAA,EAAiB,KAAK,EAAE,CAAA,6BAAA,CAA+B,EAElG,OAAK,IAAA,CAAA,wBAAA,CAA2BsB,CACzB,CAAA,IAAA,CAAK,wBACd,CAEA,IAAI,iBAAyB,EAAA,CAC3B,GAAI,CAAC,IAAA,CAAK,yBACR,MAAM,IAAI,MAAM,sFAAsF,CAAA,CAExG,OAAO,IAAK,CAAA,wBACd,CAEA,MAAM,qBAAA,CAAsBW,EAAOC,CAAc,CAAA,CAC/C,GAAI,CAAC,IAAK,CAAA,EAAA,EAAM,CAACD,CAAS,EAAA,CAACC,EACzB,OAEF,IAAMC,EAAuB,IAAK,CAAA,aAAA,CAAcF,CAAK,CAAA,CAErD,GAAIE,CAAAA,CACF,OAAOA,CAGT,CAAA,IAAMf,EAAW,CAAG,EAAA,IAAA,CAAK,EAAE,CAAIa,CAAAA,EAAAA,CAAK,CAE9BT,CAAAA,CAAAA,CAAAA,CAAenB,CAAU,CAAA,GAAA,CAAiBe,CAAQ,CACxD,CAAA,GAAII,EACF,OAAK,IAAA,CAAA,aAAA,CAAcS,CAAK,CAAIT,CAAAA,CAAAA,CACrBA,CAGT,CAAA,GAAM,CAAE,IAAA,CAAAF,CAAK,CAAI,CAAA,MAAMpB,EAAoB,IAAK,CAAA,CAAA,aAAA,EAAgB+B,CAAK,CAAqB,iBAAA,CAAA,CAAA,CACxF,MAAQ,CAAA,IAAA,CAAK,EACf,CAAA,CAAG,CACD,OAAS,CAAA,CACP,0BAA2BC,CAC7B,CACF,CAAC,CAED,CAAA,OAAA7B,CAAU,CAAA,GAAA,CAAIe,CAAUE,CAAAA,CAAI,EAC5B,IAAK,CAAA,aAAA,CAAcW,CAAK,CAAIX,CAAAA,CAAAA,CACrB,KAAK,aAAcW,CAAAA,CAAK,CACjC,CACF,EC1OO,IAAMG,EAAkB,MAAOjD,CAAAA,CAAgB8C,IAAgC,CACpF,GAAM,CAAE,IAAMI,CAAAA,CAAQ,EAAI,MAAMnC,CAAAA,CAAoB,KAAK,cAAgB,CAAA,CAAE,OAAAf,CAAQ,CAAA,KAAA,CAAA8C,CAAM,CAAC,CAAA,CAC1F,OAAOI,CACT,CCLA,CAAA,IAAqBC,EAArB,cAA6C,KAAM,CAAnD,WACE,EAAA,CAAA,KAAA,CAAA,GAAA,SAAA,CAAA,CAAA,IAAA,CAAA,IAAA,CAAO,kBAEP,IAAU,CAAA,OAAA,CAAA,qBAAA,CACZ,CCGA,CAAA,IAAMC,EAAc,CAAA,aAAA,CACdC,GAAe,aACRC,CAAAA,CAAAA,CAAc,aACrBC,CAAsB,CAAA,cAAA,CACtBC,EAAgB,sBAChBC,CAAAA,CAAAA,CAA0B,uBAC1BC,CAAAA,EAAAA,CAA2BF,CAAc,CAAA,WAAA,GAElCG,CAAa,CAAA,CAACC,EAIvB,EAAC,GAAM,MAAOC,CAAKC,CAAAA,CAAAA,CAAKC,IAAuB,CACjD,GAAI,CAEF,GAD6BF,CAAAA,CAAAA,CAAI,QAAQL,CAAa,CAAA,EAAKK,EAAI,OAAQH,CAAAA,EAAwB,CAAK,EAAA,EAAA,EACnF,WAAY,EAAA,GAAMN,GACjC,OAAOW,CAAAA,GAET,GAAM,CACJ,yBAAAC,CACA,CAAA,8BAAA,CAAAC,CACA,CAAA,sBAAA,CAAA7B,CACF,CAAA,CAAIwB,EACEM,CAASL,CAAAA,CAAAA,CAAI,QAAQN,CAAmB,CAAA,CAC9C,GAAI,CAACW,CAAAA,CACH,OAAOH,CAAAA,EAGT,CAAA,IAAMI,EAAgCN,CAAI,CAAA,OAAA,CAAQ7C,CAA2B,CAAG,EAAA,MAAA,CAAS,EAAI,IAAK,CAAA,KAAA,CAAM6C,EAAI,OAAQ7C,CAAAA,CAA2B,CAAC,CAAI,CAAA,GAC9IgB,CAAc6B,CAAAA,CAAAA,CAAI,UAAU5C,CAAmB,CAAA,EAAc,KAAM,CAAA,GAAG,CAEtEmD,CAAAA,CAAAA,CAAa,IAAIxC,CAAQsC,CAAAA,CAAAA,CAAQ,OAAQC,CAA+BnC,CAAAA,CAAU,EACxF,OAAIgC,CAAAA,GACE5B,CACF,CAAA,MAAMgC,CAAW,CAAA,yBAAA,CAA0BhC,CAAsB,CAEjE,CAAA,MAAMgC,EAAW,kBAAmB,EAAA,CAAA,CAIpCH,GACF,MAAMG,CAAAA,CAAW,wBAAyB,EAAA,CAG5CP,CAAI,CAAA,IAAA,CAAOO,EACXzB,mBAAkB,EAAA,CAAE,kBAAkB,GAAIW,CAAAA,CAAAA,CAAac,CAAU,CAGjEP,CAAAA,CAAAA,CAAI,OAAQJ,CAAAA,CAAuB,CAAIW,CAAAA,CAAAA,CAEhCL,GACT,CAAA,KAAY,CACV,OAAAD,CAAAA,CAAI,OAAO,GAAG,CAAA,CACPA,CAAI,CAAA,IAAA,CAAK,CACd,KAAA,CAAO,0BACT,CAAC,CACH,CACF,CAEaO,CAAAA,CAAAA,CAAuB,CAACT,CAIjC,CAAA,EAAO,GAAA,MAAOC,CAAKC,CAAAA,CAAAA,CAAKC,IAAwB,CAClD,GAAM,CACJ,wBAAAC,CAAAA,CAAAA,CACA,+BAAAC,CACA,CAAA,oBAAA,CAAAK,CACF,CAAA,CAAIV,CACAV,CAAAA,CAAAA,CACJ,GAAIW,CAAI,CAAA,OAAA,CAAQ,cAAe,CAC7B,GAAI,CACFX,CAAU,CAAA,MAAMjD,EAAa4D,CAAI,CAAA,OAAA,CAAQ,aAAa,EACxD,CAAA,MAASU,EAAG,CACNA,CAAAA,YAAaC,sBACfV,CAAI,CAAA,MAAA,CAAO,GAAG,CAAA,CACdA,CAAI,CAAA,IAAA,CAAK,CACP,MAAQ,CAAA,CAAC,sBAAsB,CACjC,CAAC,GACQS,CAAaE,YAAAA,oBAAAA,EACtBX,CAAI,CAAA,MAAA,CAAO,GAAG,CAAA,CACdA,EAAI,IAAK,CAAA,CACP,OAAQ,CAACS,CAAAA,CAAE,OAAO,CACpB,CAAC,CAEDT,GAAAA,CAAAA,CAAI,MAAO,CAAA,GAAG,EACdA,CAAI,CAAA,IAAA,CAAK,CACP,MAAQ,CAAA,CAAC,kCAAkC,CAC7C,CAAC,GAEH,MACF,CACA,IAAMI,CAAShB,CAAAA,CAAAA,EAAS,MAAM,EAE1BgB,CAAAA,CAAAA,GACFL,EAAI,OAAQN,CAAAA,CAAmB,CAAIW,CAAAA,CAAAA,CAAAA,CAGrC,IAAMlC,CAAAA,CAAc6B,EAAI,OAAU5C,GAAAA,CAAmB,GAAc,KAAM,CAAA,GAAG,EACtEmD,CAAa,CAAA,IAAIxC,CAAQsC,CAAAA,CAAAA,CAAQhB,CAAS,EAAA,IAAA,EAAM,YAAa,SAAWlB,CAAAA,CAAU,EAEpFgC,CACF,EAAA,MAAMI,EAAW,kBAAmB,EAAA,CAGlCH,CACF,EAAA,MAAMG,CAAW,CAAA,wBAAA,GAGnBP,CAAI,CAAA,IAAA,CAAOO,EACXzB,mBAAkB,EAAA,CAAE,kBAAkB,GAAIW,CAAAA,CAAAA,CAAac,CAAU,CAGjEP,CAAAA,CAAAA,CAAI,QAAQJ,CAAuB,CAAA,CAAIW,EACzC,CAAWE,KAAAA,GAAAA,CAAAA,CACT,OAAAR,CAAI,CAAA,MAAA,CAAO,GAAG,CAAA,CACPA,CAAI,CAAA,IAAA,CAAK,CACd,MAAQ,CAAA,CAAC,mBAAmB,CAC9B,CAAC,EAEH,OAAOC,CAAAA,EACT,CAAA,CAEaW,CAAiBd,CAAAA,CAAAA,EAGxB,MAAOC,CAAKC,CAAAA,CAAAA,CAAKC,IAAwB,CAC7C,GAAM,CACJ,KAAAjB,CAAAA,CAAAA,CACA,YAAAC,CAAAA,CACF,CAAIa,CAAAA,CAAAA,CACAV,EAEJ,GAAI,CAACW,EAAI,OAAQ,CAAA,aAAA,CACf,OAAAC,CAAI,CAAA,MAAA,CAAO,GAAG,CAAA,CACPA,CAAI,CAAA,IAAA,CAAK,CACd,MAAQ,CAAA,CAAC,mBAAmB,CAC9B,CAAC,EAGH,GAAI,CAEF,GADAZ,CAAAA,CAAU,MAAMD,CAAAA,CAAgBY,EAAI,OAAQ,CAAA,aAAA,CAAef,CAAK,CAC5D,CAAA,CAACI,EACH,MAAM,IAAIC,CAEd,CAAA,MAASoB,CAAG,CAAA,CACV,OAAIA,CAAaC,YAAAA,oBAAAA,CACRV,EAAI,MAAO,CAAA,GAAG,EAAE,IAAK,CAAA,CAC1B,MAAQ,CAAA,CAAC,sBAAsB,CACjC,CAAC,CAEC,CAAA,CAACW,qBAAmBtB,CAAe,CAAA,CAAE,KAAMwB,CAAQJ,EAAAA,CAAAA,YAAaI,CAAG,CAC9Db,CAAAA,CAAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,CAC1B,MAAA,CAAQ,CAACS,CAAE,CAAA,OAAO,CACpB,CAAC,CAEIT,CAAAA,CAAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,CAC1B,MAAA,CAAQ,CAAC,kCAAkC,CAC7C,CAAC,CACH,CACA,IAAMI,EAAShB,CAAS,EAAA,MAAA,CACpBgB,IACFL,CAAI,CAAA,OAAA,CAAQP,CAAW,CAAIY,CAAAA,CAAAA,CAAAA,CAG7B,IAAME,CAAAA,CAAa,IAAIxC,CAAAA,CAAQsC,CAAM,CAEjCpB,CAAAA,CAAAA,GACFe,EAAI,OAAQ,CAAA,yBAAyB,EAAId,CAEzC,CAAA,MAAMqB,EAAW,qBAAsBtB,CAAAA,CAAAA,CAAOC,CAAY,CAG5Dc,CAAAA,CAAAA,CAAAA,CAAI,KAAOO,CACX,CAAA,IAAMQ,EAAsBjC,mBAAkB,EAAA,CAAE,gBAChD,CAAA,OAAAiC,CAAqB,EAAA,GAAA,CAAItB,EAAac,CAAU,CAAA,CAChDQ,GAAqB,GAAIvB,CAAAA,EAAAA,CAActD,EAAkB8D,CAAI,CAAA,OAAA,CAAQ,aAAa,CAAC,CAGnFA,CAAAA,CAAAA,CAAI,QAAQJ,CAAuB,CAAA,CAAIW,EAEhCL,CAAK,EACd,EAEac,CAAiC,CAAA,MAAOhB,CAAKC,CAAAA,CAAAA,CAAKC,CAC7D,IAAA,MAAMF,EAAI,IAAK,CAAA,kBAAA,GACRE,CAAK,EAAA,CAAA,CAGDe,EAAoBjB,CAC3BA,EAAAA,CAAAA,CAAI,QAAQ,aACP5D,CAAAA,CAAAA,CAAa4D,EAAI,OAAQ,CAAA,aAAa,EAGxC,IAGIkB,CAAAA,CAAAA,CAAyB,MAAOC,CAAgDd,CAAAA,CAAAA,GAA+B,CAC1H,IAAME,CAAa,CAAA,IAAIxC,EAAQsC,CAAM,CAAA,CAErC,MAAME,CAAW,CAAA,kBAAA,GAEjBY,CAAUC,GAAAA,UAAAA,CAASC,YAAW,CAAA,MAAM,CACpCF,CAAAA,CAAAA,CAAM,iBAAiB,GAAI1B,CAAAA,CAAAA,CAAac,CAAU,EACpD,CAAA,CAEOe,EAAQvD,ECjNR,IAAMwD,EAAU,IAA4BzC,mBAAAA,GAAoB,gBAAkB,EAAA,GAAA,CAAIW,CAAW,CAE3F+B,CAAAA,CAAAA,CAAc,IAAMD,CAAAA,EAAW,EAAA,EAAA,CAE/BE,EAAwBC,CAAoB,EAAA,CAACF,GAAiB,EAAA,MAAA,CAAO,KAAKD,CAAQ,EAAA,CAAG,WAAY,CAAA,MAAM,CAAE,CAAA,QAAA,CAASG,CAAO,CAEzHC,CAAAA,CAAAA,CAAgCC,GAA4B,CAACJ,CAAAA,IAAiB,MAAO,CAAA,IAAA,CAAKD,CAAQ,EAAA,CAAG,WAAY,CAAA,cAAc,EAAE,QAASK,CAAAA,CAAe,EAEzJC,CAA+BC,CAAAA,CAAAA,EAA2B,CAACN,CAAY,EAAA,EAAK,MAAO,CAAA,IAAA,CAAKD,CAAQ,EAAA,CAAG,YAAY,aAAa,CAAA,CAAE,SAASO,CAAc,MCTrJC,CAAN,CAAA,cAAsC,KAAM,CACjD,WAAA,CAAmBC,EAAuB,IAAMC,CAAAA,CAAAA,CAAU,0BAA2B,CACnF,KAAA,CAAMA,CAAO,CADI,CAAA,IAAA,CAAA,IAAA,CAAAD,CAEjB,CAAA,IAAA,CAAK,IAAO,CAAA,0BACd,CACF,ECNO,IAAME,EAAwB,CACnC,IAAA,CAAM,MACN,CAAA,KAAA,CAAO,OACP,CAAA,GAAA,CAAK,KACP,CAEMC,CAAAA,EAAAA,CAAwB,CAC5B,CAACD,CAAAA,CAAsB,IAAI,EAAG,IAAG,EACjC,CAAA,CAACA,CAAsB,CAAA,KAAK,EAAIE,CAA+B,EAAA,CAC7D,GAAM,CAAE,QAAA,CAAAC,EAAU,QAAAC,CAAAA,CAAS,EAAIF,CAE/B,CAAA,OAAO,SADoB,MAAO,CAAA,IAAA,CAAK,GAAGC,CAAQ,CAAA,CAAA,EAAIC,CAAQ,CAAE,CAAA,CAAA,CAAE,QAAS,CAAA,QAAQ,CACjD,CAAA,CACpC,EACA,CAACJ,CAAAA,CAAsB,GAAG,EAAIE,CAAAA,EAA+B,CAC3D,GAAM,CAAE,MAAAG,CAAAA,CAAO,CAAIH,CAAAA,CAAAA,CACnB,GAAIG,CACF,CAAA,OAAO,UAAcC,aAAK,CAAA,IAAA,CAAA,GAAID,CAAQ,CAAA,CAAE,SAAW,CAAA,EAAG,CAAC,CAAC,EAG5D,CACF,CAAA,CAEaE,GAA0BL,CAA8E,EAAA,CACnH,IAAMM,CAAsBN,CAAAA,CAAAA,EAAuB,OAEnD,GAAI,EAAA,CAACM,GAAuB,CAACP,EAAAA,CAAsBO,CAAmB,CAItE,CAAA,CAAA,OAAOP,GAAsBO,CAAmB,CAAA,CAAEN,CAAqB,CACzE,ECVA,IAAMO,GAA6BC,YAI7BC,CAAAA,iBAAAA,CAAAA,EAAAA,CAAgB,CAAC,CAAE,eAAA,CAAAC,EAAkB,EAAC,CAAG,MAAAC,CAAAA,CAAO,CAAiF,CAAA,KAAa,CACzIH,YAAA,CAAA,OAAA,CAAQ,CACf,aAAe,CAAA,MAAA,CACf,wBAAyBG,CAAQ,EAAA,oBAAA,CACjC,GAAGD,CACL,CAAC,EACH,EAEM,CAAE,UAAA,CAAAzB,GAAY,QAAAD,CAAAA,EAAS,EAAI4B,aA6BjC,IAAOC,EAAQ,CAAA,CACb,UAAA5B,CAAAA,EAAAA,CACA,SAAAD,EACA,CAAA,IAAA,CAAAE,EACA,UAAAxB,CAAAA,CAAAA,CACA,qBAAAU,CACA,CAAA,8BAAA,CAAAQ,CACA,CAAA,iBAAA,CAAA2B,EACA,CAAA,gBAAA,CAAA1B,EACA,oBAAAQ,CAAAA,CAAAA,CACA,6BAAAE,CACA,CAAA,2BAAA,CAAAE,EACA,WAAAL,CAAAA,CAAAA,CACA,OAAAD,CAAAA,CAAAA,CACA,uBAAAQ,CAAAA,CAAAA,CACA,cAAAlB,CACA,CAAA,sBAAA,CAAAK,EACA,QAAA8B,CAAAA,YAAAA,CACA,sBAAAd,CACA,CAAA,sBAAA,CAAAO,EACA,CAAA,mBAAA,CAAArF,CACF","file":"index.cjs","sourcesContent":["import jwt from 'jsonwebtoken';\nimport moment from 'moment';\n\nconst {\n  DEPRECATED_JWT_SECRET, JWT_NEW_SECRET,\n  DEPRECATED_REFRESH_JWT_SECRET, REFRESH_JWT_SECRET,\n  DEPRECATION_UNIX_TIMESTAMP,\n} = process.env;\n\nconst getRelevantSecret = (token: string | undefined, deprecatedSecret: string, newSecret: string): string => {\n  const deprecationTime = moment(parseInt(DEPRECATION_UNIX_TIMESTAMP, 10) * 1000);\n  try {\n    let unixTime: moment.Moment;\n    if (token) {\n      const { iat } = jwt.decode(token) as jwt.JwtPayload;\n      unixTime = moment(iat * 1000);\n    } else {\n      unixTime = moment();\n    }\n    return unixTime.isBefore(deprecationTime) ? deprecatedSecret : newSecret;\n  } catch (e) {\n    return newSecret;\n  }\n};\n\nexport const getRefreshTokenSecret = (token?: string): string => getRelevantSecret(token, DEPRECATED_REFRESH_JWT_SECRET, REFRESH_JWT_SECRET);\nexport const getTokenSecret = (token?: string): string => getRelevantSecret(token, DEPRECATED_JWT_SECRET, JWT_NEW_SECRET);\n","import type { UUID } from 'node:crypto';\nimport * as jwt from 'jsonwebtoken';\nimport { getTokenSecret } from './secret-getter';\n\nconst CONTEXT_PROPS = ['fleetId', 'businessModelId', 'demandSourceId'];\nconst CONTEXT_MAP_PROPS = {\n  fleet: 'fleets',\n  business: 'businessModels',\n  demand: 'demandSources',\n};\n\nexport const getAuthFromBearer = (bearer: string): string => bearer.replace('Bearer ', '');\n\nexport const decodeBearer = (bearer: string, appSecret?: string): any => {\n  const token = getAuthFromBearer(bearer);\n  const decoded = jwt.verify(token, appSecret || getTokenSecret(token));\n  return decoded;\n};\n\nexport const parsePermissions = (contextId, decodedToken): any => {\n  if (!decodedToken) { return []; }\n  const { contexts } = decodedToken;\n  const activeContext = contexts.find((context) => context.id === contextId);\n\n  const permissionsValue = `${activeContext.permissions?.map((cp) => `${cp},`)}`;\n\n  return {\n    key: activeContext.entityId,\n    value: permissionsValue,\n  };\n};\n\nexport const getEntitiesFromContext = (contextId: string, decodedToken: any): any => {\n  if (!decodedToken) { return []; }\n  let { contexts } = decodedToken;\n  if (contextId) {\n    contexts = contexts.filter((context) => context.id === contextId);\n  }\n\n  const attributes = {};\n  contexts.forEach((context) => {\n    const prop = CONTEXT_MAP_PROPS[context.subSystem || 'business'];\n\n    const permissions = parsePermissions(context.id, decodedToken);\n    // eslint-disable-next-line no-unused-expressions\n    attributes[prop]\n      ? attributes[prop][permissions.key] = permissions.value\n      : attributes[prop] = { [permissions.key]: permissions.value };\n  });\n\n  return attributes;\n};\n\nexport const getContextAttributes = (contextId: string, decodedToken: any): any => {\n  if (!decodedToken) { return []; }\n  let { contexts } = decodedToken;\n  if (contextId) {\n    contexts = contexts.filter((context) => context.id === contextId);\n  }\n  const attributes = {};\n  contexts.forEach((context) => {\n    CONTEXT_PROPS.forEach((prop) => {\n      if (context[prop]) {\n        const contextPropWrapped = [context[prop]];\n        // eslint-disable-next-line no-unused-expressions\n        attributes[prop]\n          ? attributes[prop] = attributes[prop].concat(contextPropWrapped)\n          : attributes[prop] = contextPropWrapped;\n      }\n    });\n  });\n  return attributes;\n};\n\nconst EMPTY_UUID = '00000000-0000-0000-0000-000000000000';\nconst FULL_UUID = 'ffffffff-ffff-ffff-ffff-ffffffffffff';\nconst VALID_CHARS_REGEX = '[0-9a-f]';\nconst UUID_VERSION_REGEX = '[1-8]';\nconst UUID_REGEX = new RegExp(`^(?:${VALID_CHARS_REGEX}{8}-${VALID_CHARS_REGEX}{4}-${UUID_VERSION_REGEX}${VALID_CHARS_REGEX}{3}-[89ab]${VALID_CHARS_REGEX}{3}-${VALID_CHARS_REGEX}{12}|${EMPTY_UUID}|${FULL_UUID})$`, 'i');\nexport function validateUUID(uuid: unknown): uuid is UUID {\n  return typeof uuid === 'string' && UUID_REGEX.test(uuid);\n}\n","import Network from '@autofleet/network';\n\nconst CACHE_LIFETIME_IN_SEC = 10;\nconst apiGwUrl = process.env.API_GATEWAY_URL || 'https://api.autofleet.io';\n\n// eslint-disable-next-line import/prefer-default-export\nexport const IdentityNetwork = new Network({\n  serviceName: 'IDENTITY_MS',\n  retries: 3,\n  retryCondition: () => true,\n  cache: process.env.NODE_ENV !== 'test' ? {\n    maxAge: CACHE_LIFETIME_IN_SEC * 1000,\n  } : undefined,\n});\n\nexport const AutofleetApiNetwork = new Network({\n  baseURL: apiGwUrl,\n  serviceUrl: apiGwUrl,\n  retries: 3,\n  retryCondition: () => true,\n  cache: process.env.NODE_ENV !== 'test' ? {\n    maxAge: CACHE_LIFETIME_IN_SEC * 1000,\n  } : undefined,\n});\n","import NodeCache from 'node-cache';\nimport objectHash from 'object-hash';\nimport { getCurrentContext } from '@autofleet/outbreak';\nimport { validateUUID } from '../utils';\nimport { AutofleetApiNetwork, IdentityNetwork } from '../services';\n\nexport type AccountType = 'client' | 'user' | 'service' | 'driver'\ninterface EntityPermissions {\n    [key: string]: string[];\n}\n\nexport const ELEVATED_PERMISSIONS_HEADER = 'x-af-elevated-permissions';\nexport const CONTEXTS_IDS_HEADER = 'x-af-context-ids';\n\nexport interface UserPayload {\n  businessModels: EntityPermissions;\n  fleets: EntityPermissions;\n  demandSources: EntityPermissions;\n  businessAccounts?: EntityPermissions;\n  accountType?: AccountType;\n  contexts?: EntityPermissions;\n  createdAt?: string;\n}\n\nexport interface PartialUserPayload {\n  businessModels?: EntityPermissions;\n  fleets?: EntityPermissions;\n  demandSources?: EntityPermissions;\n  vehicles?: EntityPermissions;\n  drivers?: EntityPermissions;\n  businessAccounts?: EntityPermissions;\n}\n\nexport type CustomPermissionLoader = (string) => Promise<UserPayload>;\n\nconst userCache = new NodeCache({ stdTTL: 10 });\n\nconst mergePermissions = (target: UserPayload, sources: Iterable<PartialUserPayload>): UserPayload => {\n  const permissions: UserPayload = {\n    ...target,\n    fleets: { ...target?.fleets },\n    businessModels: { ...target?.businessModels },\n    demandSources: { ...target?.demandSources },\n    // Clone other nested objects as needed\n  };\n\n  // eslint-disable-next-line no-restricted-syntax\n  for (const source of sources) {\n    Object.keys(source).forEach((entityType) => {\n      // eslint-disable-next-line no-param-reassign\n      permissions[entityType] ??= {};\n      Object.entries(source[entityType]!).forEach(([entityId, perms]) => {\n        // eslint-disable-next-line no-param-reassign\n        permissions[entityType][entityId] = (permissions[entityType][entityId] || []).concat(perms);\n      });\n    });\n  }\n\n  return permissions;\n};\n\nexport default class ApiUser {\n  private privatePermissions: UserPayload | undefined;\n\n  private readonly privateElevatedPermissionsHash = new Map<symbol, PartialUserPayload | undefined>();\n\n  private privatePermissionsLegacy: any;\n\n  private readonly appPermission: {[key: string]: any; } = {};\n\n  public readonly emptyUser: boolean;\n\n  constructor(public id? : string, public accountType?: AccountType, elevatedPermissions?: PartialUserPayload, public contextIds?: string[]) {\n    this.emptyUser = !!id;\n    if (elevatedPermissions) {\n      this.privateElevatedPermissionsHash.set(Symbol('initial'), elevatedPermissions);\n    }\n  }\n\n  async getUserPermissions(): Promise<UserPayload> {\n    if (!this.id) {\n      return undefined;\n    }\n    if (this.privatePermissions) {\n      return this.privatePermissions;\n    }\n    const cacheKey = objectHash({\n      id: this.id,\n      contextIds: this.contextIds,\n    });\n\n    let data = userCache.get<UserPayload>(cacheKey);\n\n    if (!data) {\n      ({ data } = await IdentityNetwork.get(`/api/v1/users/${this.id}/authorization-payload`, { params: { contextIds: this.contextIds } }));\n      userCache.set(cacheKey, data);\n    }\n\n    this.accountType = data.accountType;\n    this.privatePermissions = data;\n    return this.privatePermissions;\n  }\n\n  async useCustomPermissionLoader(customPermissionLoader: any): Promise<UserPayload> {\n    if (!this.id) {\n      return undefined;\n    }\n    if (this.privatePermissions) {\n      return this.privatePermissions;\n    }\n\n    const cacheKey = this.id;\n\n    const cachedResult = userCache.get<UserPayload>(cacheKey);\n    if (cachedResult) {\n      this.privatePermissions = cachedResult;\n      return cachedResult;\n    }\n\n    const data = await customPermissionLoader(this.id);\n    userCache.set(cacheKey, data);\n\n    this.privatePermissions = data;\n    return this.privatePermissions;\n  }\n\n  get businessModels(): string[] | undefined {\n    return this.getUserProperty('businessModels');\n  }\n\n  get fleets(): string[] | undefined {\n    return this.getUserProperty('fleets');\n  }\n\n  get demandSources(): string[] | undefined {\n    return this.getUserProperty('demandSources');\n  }\n\n  private getUserProperty(key: keyof UserPayload): string[] | undefined {\n    if (!this.privatePermissions) {\n      throw new Error(`Cannot get ${key} without calling (async) getUserPermissions before`);\n    }\n    return Object.keys(this.privatePermissions[key] || {});\n  }\n\n  get elevatedPermissions(): UserPayload {\n    return mergePermissions(undefined, this.privateElevatedPermissionsHash.values());\n  }\n\n  get permissions(): UserPayload | undefined {\n    if (!this.privatePermissions) {\n      throw new Error('Cannot get permissions without calling (async) getUserPermissions before');\n    }\n\n    return mergePermissions(this.privatePermissions, this.privateElevatedPermissionsHash.values());\n  }\n\n  elevatePermissions(addedPermissions: PartialUserPayload): () => void {\n    // @itayankri is concerned about memory consumption, so create a symbol with no description, to avoid assigning memory for the description string\n    // eslint-disable-next-line symbol-description\n    const elevationId = Symbol();\n\n    // Validate that the added permissions are valid UUIDs\n    Object.values(addedPermissions).forEach((entityIds) => {\n      Object.keys(entityIds).forEach((entityId) => {\n        if (!validateUUID(entityId)) {\n          throw new Error(`Entity id on elevatePermissions is not a valid UUID, provided: ${entityId}`);\n        }\n      });\n    });\n\n    const currentUserTrace = getCurrentContext();\n    if (!currentUserTrace) {\n      throw new Error('Cannot find current user cross services trace');\n    }\n\n    const currentElevation = JSON.parse(currentUserTrace.context[ELEVATED_PERMISSIONS_HEADER] || '{}');\n    const newElevation = Object.assign(currentElevation, addedPermissions);\n    this.privateElevatedPermissionsHash.set(elevationId, newElevation);\n    currentUserTrace.context.set(ELEVATED_PERMISSIONS_HEADER, JSON.stringify(this.elevatedPermissions));\n    return () => {\n      this.privateElevatedPermissionsHash.delete(elevationId);\n      currentUserTrace.context.set(ELEVATED_PERMISSIONS_HEADER, JSON.stringify(this.elevatedPermissions));\n    };\n  }\n\n  async getUserPermissionsLegacy() {\n    if (!this.id) {\n      return undefined;\n    }\n    if (this.privatePermissionsLegacy) {\n      return this.privatePermissionsLegacy;\n    }\n    const { data } = await IdentityNetwork.get(`/api/v1/users/${this.id}/authorization-payload-legacy`);\n\n    this.privatePermissionsLegacy = data;\n    return this.privatePermissionsLegacy;\n  }\n\n  get permissionsLegacy(): any {\n    if (!this.privatePermissionsLegacy) {\n      throw new Error('Cannot get permissionsLegacy without calling (async) getUserPermissionsLegacy before');\n    }\n    return this.privatePermissionsLegacy;\n  }\n\n  async getUserAppPermissions(appId, clientSecret) {\n    if (!this.id || !appId || !clientSecret) {\n      return undefined;\n    }\n    const currentAppPermission = this.appPermission[appId];\n\n    if (currentAppPermission) {\n      return currentAppPermission;\n    }\n\n    const cacheKey = `${this.id}:${appId}`;\n\n    const cachedResult = userCache.get<UserPayload>(cacheKey);\n    if (cachedResult) {\n      this.appPermission[appId] = cachedResult;\n      return cachedResult;\n    }\n\n    const { data } = await AutofleetApiNetwork.post(`/api/v1/apps/${appId}/get-user-payload`, {\n      userId: this.id,\n    }, {\n      headers: {\n        'x-autofleet-apps-secret': clientSecret,\n      },\n    });\n\n    userCache.set(cacheKey, data);\n    this.appPermission[appId] = data;\n    return this.appPermission[appId];\n  }\n}\n","import { AutofleetApiNetwork } from './services';\n\nexport const decodeAppBearer = async (bearer: string, appId: string): Promise<any> => {\n  const { data: decoded } = await AutofleetApiNetwork.post('/api/v1/auth', { bearer, appId });\n  return decoded;\n};\n\nexport const getClientSecret = async (appId: string): Promise<any> => {\n  const { data: secret } = await AutofleetApiNetwork.get(`/api/v1/auth/client-secret/${appId}`);\n  return secret;\n};\n","export default class AppDoesNotExist extends Error {\n  name = 'AppDoesNotExist';\n\n  message = 'app does not exist';\n}\n","import { getCurrentContext, newTrace, traceTypes } from '@autofleet/outbreak';\nimport { TokenExpiredError, JsonWebTokenError } from 'jsonwebtoken';\nimport ApiUser, { CONTEXTS_IDS_HEADER, CustomPermissionLoader, ELEVATED_PERMISSIONS_HEADER } from './ApiUser';\nimport { decodeAppBearer } from '../app-auth';\nimport AppDoesNotExist from '../exceptions/appDoesNotExist';\nimport { decodeBearer, getAuthFromBearer } from '../utils';\n\nconst IDENTITY_MS = 'identity-ms';\nconst ACCESS_TOKEN = 'accessToken';\nexport const USER_OBJECT = 'userObject';\nconst USER_TRACING_HEADER = 'x-af-user-id';\nconst ORIGIN_HEADER = 'X-IAF-ORIGIN-SERVICE';\nconst USER_PERMISSIONS_HEADER = 'x-af-user-permissions';\nconst LOWER_CASE_ORIGIN_HEADER = ORIGIN_HEADER.toLowerCase();\n\nexport const middleware = (options: {\n    eagerLoadUserPermissions?: boolean;\n    eagerLoadUserPermissionsLegacy?: boolean;\n    customPermissionLoader?: CustomPermissionLoader;\n} = {}) => async (req, res, next): Promise<any> => {\n  try {\n    const originHeader: string = req.headers[ORIGIN_HEADER] || req.headers[LOWER_CASE_ORIGIN_HEADER] || '';\n    if (originHeader.toLowerCase() === IDENTITY_MS) {\n      return next();\n    }\n    const {\n      eagerLoadUserPermissions,\n      eagerLoadUserPermissionsLegacy,\n      customPermissionLoader,\n    } = options;\n    const userId = req.headers[USER_TRACING_HEADER];\n    if (!userId) {\n      return next();\n    }\n\n    const elevatedPermissionsFromHeader = req.headers[ELEVATED_PERMISSIONS_HEADER]?.length > 0 ? JSON.parse(req.headers[ELEVATED_PERMISSIONS_HEADER]) : {};\n    const contextIds = (req.headers?.[CONTEXTS_IDS_HEADER] as string)?.split(',');\n\n    const userObject = new ApiUser(userId, 'user', elevatedPermissionsFromHeader, contextIds);\n    if (eagerLoadUserPermissions) {\n      if (customPermissionLoader) {\n        await userObject.useCustomPermissionLoader(customPermissionLoader);\n      } else {\n        await userObject.getUserPermissions();\n      }\n    }\n\n    if (eagerLoadUserPermissionsLegacy) {\n      await userObject.getUserPermissionsLegacy();\n    }\n\n    req.user = userObject;\n    getCurrentContext().nonHeaderContext?.set(USER_OBJECT, userObject);\n\n    // Added in order to support outbreak.\n    req.headers[USER_PERMISSIONS_HEADER] = userObject;\n\n    return next();\n  } catch (e) {\n    res.status(401);\n    return res.json({\n      error: 'cannot authenticate user',\n    });\n  }\n};\n\nexport const middlewareWithDecode = (options: {\n  eagerLoadUserPermissions?: boolean;\n  eagerLoadUserPermissionsLegacy?: boolean;\n  returnErrorIfNoToken?: boolean\n} = {}) => async (req, res, next): Promise<void> => {\n  const {\n    eagerLoadUserPermissions,\n    eagerLoadUserPermissionsLegacy,\n    returnErrorIfNoToken,\n  } = options;\n  let decoded;\n  if (req.headers.authorization) {\n    try {\n      decoded = await decodeBearer(req.headers.authorization);\n    } catch (e) {\n      if (e instanceof TokenExpiredError) {\n        res.status(401);\n        res.json({\n          errors: ['Access token expired'],\n        });\n      } else if (e instanceof JsonWebTokenError) {\n        res.status(400);\n        res.json({\n          errors: [e.message],\n        });\n      } else {\n        res.status(500);\n        res.json({\n          errors: ['Server error while parsing token'],\n        });\n      }\n      return undefined;\n    }\n    const userId = decoded?.user?.id;\n\n    if (userId) {\n      req.headers[USER_TRACING_HEADER] = userId;\n    }\n\n    const contextIds = (req.headers?.[CONTEXTS_IDS_HEADER] as string)?.split(',');\n    const userObject = new ApiUser(userId, decoded?.user?.accountType, undefined, contextIds);\n\n    if (eagerLoadUserPermissions) {\n      await userObject.getUserPermissions();\n    }\n\n    if (eagerLoadUserPermissionsLegacy) {\n      await userObject.getUserPermissionsLegacy();\n    }\n\n    req.user = userObject;\n    getCurrentContext().nonHeaderContext?.set(USER_OBJECT, userObject);\n\n    // Added in order to support outbreak.\n    req.headers[USER_PERMISSIONS_HEADER] = userObject;\n  } else if (returnErrorIfNoToken) {\n    res.status(401);\n    return res.json({\n      errors: ['No token provided'],\n    });\n  }\n  return next();\n};\n\nexport const appMiddleware = (options: {\n  appId: string,\n  clientSecret: string\n}) => async (req, res, next): Promise<void> => {\n  const {\n    appId,\n    clientSecret,\n  } = options;\n  let decoded;\n\n  if (!req.headers.authorization) {\n    res.status(401);\n    return res.json({\n      errors: ['No token provided'],\n    });\n  }\n\n  try {\n    decoded = await decodeAppBearer(req.headers.authorization, appId);\n    if (!decoded) {\n      throw new AppDoesNotExist();\n    }\n  } catch (e) {\n    if (e instanceof TokenExpiredError) {\n      return res.status(401).json({\n        errors: ['Access token expired'],\n      });\n    }\n    if ([JsonWebTokenError, AppDoesNotExist].some((Err) => e instanceof Err)) {\n      return res.status(400).json({\n        errors: [e.message],\n      });\n    }\n    return res.status(500).json({\n      errors: ['Server error while parsing token'],\n    });\n  }\n  const userId = decoded?.userId;\n  if (userId) {\n    req.headers[USER_OBJECT] = userId;\n  }\n\n  const userObject = new ApiUser(userId);\n\n  if (appId) {\n    req.headers['x-autofleet-apps-secret'] = clientSecret;\n    // Won't work until we find a better solution for identity ms\n    await userObject.getUserAppPermissions(appId, clientSecret);\n  }\n\n  req.user = userObject;\n  const currentTraceContext = getCurrentContext().nonHeaderContext;\n  currentTraceContext?.set(USER_OBJECT, userObject);\n  currentTraceContext?.set(ACCESS_TOKEN, getAuthFromBearer(req.headers.authorization));\n\n  // Added in order to support outbreak.\n  req.headers[USER_PERMISSIONS_HEADER] = userObject;\n\n  return next();\n};\n\nexport const eagerLoadPermissionsMiddleware = async (req, res, next) => {\n  await req.user.getUserPermissions();\n  return next();\n};\n\nexport const getDecodedBearer = (req) => {\n  if (req.headers.authorization) {\n    return decodeBearer(req.headers.authorization);\n  }\n\n  return null;\n};\n\nexport const createOrSetRabbitTrace = async (trace: ReturnType<typeof newTrace> | undefined, userId: string | undefined) => {\n  const userObject = new ApiUser(userId);\n\n  await userObject.getUserPermissions();\n  // eslint-disable-next-line no-param-reassign\n  trace ??= newTrace(traceTypes.RABBIT);\n  trace.nonHeaderContext.set(USER_OBJECT, userObject);\n};\n\nexport default ApiUser;\n","import { getCurrentContext } from '@autofleet/outbreak';\nimport ApiUser from './user/ApiUser';\nimport { USER_OBJECT } from './user';\n\nexport const getUser = () : ApiUser | undefined => getCurrentContext().nonHeaderContext?.get(USER_OBJECT) as ApiUser | undefined;\n\nexport const isUserExist = () => getUser()?.id;\n\nexport const checkFleetPermission = (fleetId: string) => !isUserExist() || Object.keys(getUser()!.permissions.fleets).includes(fleetId);\n\nexport const checkBusinessModelPermission = (businessModelId: string) => !isUserExist() || Object.keys(getUser()!.permissions.businessModels).includes(businessModelId);\n\nexport const checkDemandSourcePermission = (demandSourceId: string) => !isUserExist() || Object.keys(getUser()!.permissions.demandSources).includes(demandSourceId);\n","import type ApiUser from './user';\n\n// eslint-disable-next-line import/prefer-default-export\nexport class UnauthorizedAccessError extends Error {\n  constructor(public user: ApiUser | null = null, message = 'UnauthorizedAccessError') {\n    super(message);\n    this.name = 'UnauthorizedAccessError';\n  }\n}\n","import * as jwt from 'jsonwebtoken';\n\nexport const AUTHORIZATION_METHODS = {\n  NONE: 'NONE',\n  BASIC: 'BASIC',\n  JWT: 'JWT',\n};\n\nconst AUTHORIZATION_ACTIONS = {\n  [AUTHORIZATION_METHODS.NONE]: () => undefined,\n  [AUTHORIZATION_METHODS.BASIC]: (authorizationSettings: any) => {\n    const { username, password } = authorizationSettings;\n    const encodedCredentials = Buffer.from(`${username}:${password}`).toString('base64');\n    return `Basic ${encodedCredentials}`;\n  },\n  [AUTHORIZATION_METHODS.JWT]: (authorizationSettings: any) => {\n    const { secret } = authorizationSettings;\n    if (secret) {\n      return `Bearer ${jwt.sign({}, secret, { expiresIn: 10 })}`;\n    }\n    return undefined;\n  },\n};\n\nexport const getAuthorizationHeader = (authorizationSettings: { method: string } | undefined): string | undefined => {\n  const authorizationMethod = authorizationSettings?.method;\n\n  if (!authorizationMethod || !AUTHORIZATION_ACTIONS[authorizationMethod]) {\n    return undefined;\n  }\n\n  return AUTHORIZATION_ACTIONS[authorizationMethod](authorizationSettings);\n};\n","import type { LoggerInstanceManager } from '@autofleet/logger';\nimport * as outbreak from '@autofleet/outbreak';\nimport User, {\n  middleware,\n  eagerLoadPermissionsMiddleware,\n  middlewareWithDecode,\n  getDecodedBearer,\n  appMiddleware,\n  createOrSetRabbitTrace,\n} from './user';\nimport { type UserPayload, CONTEXTS_IDS_HEADER } from './user/ApiUser';\nimport {\n  checkFleetPermission,\n  checkBusinessModelPermission,\n  checkDemandSourcePermission,\n  isUserExist,\n  getUser,\n} from './check-permission';\nimport { UnauthorizedAccessError } from './errors';\nimport { getRefreshTokenSecret, getTokenSecret } from './secret-getter';\nimport { AUTHORIZATION_METHODS, getAuthorizationHeader } from './authorization';\n\nconst getCurrentPayload = outbreak.getCurrentContext;\n\ntype OutbreakOptions = Parameters<typeof outbreak.default>[0];\ntype LoggerWithContextMiddleware = Partial<Pick<LoggerInstanceManager, 'addContextMiddleware'>>;\nconst enableTracing = ({ outbreakOptions = {}, logger }: { outbreakOptions?: OutbreakOptions, logger?: LoggerWithContextMiddleware } = {}): void => {\n  outbreak.default({\n    headersPrefix: 'x-af',\n    contextMiddlewareGetter: logger?.addContextMiddleware,\n    ...outbreakOptions,\n  });\n};\n\nconst { traceTypes, newTrace } = outbreak;\n\nexport {\n  traceTypes,\n  newTrace,\n  enableTracing,\n  User,\n  middleware,\n  middlewareWithDecode,\n  eagerLoadPermissionsMiddleware,\n  getCurrentPayload,\n  getDecodedBearer,\n  checkFleetPermission,\n  checkBusinessModelPermission,\n  checkDemandSourcePermission,\n  isUserExist,\n  getUser,\n  getRefreshTokenSecret,\n  getTokenSecret,\n  UnauthorizedAccessError,\n  appMiddleware,\n  createOrSetRabbitTrace,\n  outbreak,\n  AUTHORIZATION_METHODS,\n  getAuthorizationHeader,\n  type UserPayload,\n  CONTEXTS_IDS_HEADER,\n};\n\nexport default {\n  traceTypes,\n  newTrace,\n  User,\n  middleware,\n  middlewareWithDecode,\n  eagerLoadPermissionsMiddleware,\n  getCurrentPayload,\n  getDecodedBearer,\n  checkFleetPermission,\n  checkBusinessModelPermission,\n  checkDemandSourcePermission,\n  isUserExist,\n  getUser,\n  UnauthorizedAccessError,\n  appMiddleware,\n  createOrSetRabbitTrace,\n  outbreak,\n  AUTHORIZATION_METHODS,\n  getAuthorizationHeader,\n  CONTEXTS_IDS_HEADER,\n};\n"]}
+{"version":3,"sources":["../src/secret-getter.ts","../src/utils.ts","../src/services.ts","../src/user/ApiUser.ts","../src/app-auth.ts","../src/exceptions/appDoesNotExist.ts","../src/user/const.ts","../src/user/common.ts","../src/user/index.ts","../src/user/fastify.ts","../src/check-permission.ts","../src/errors.ts","../src/authorization.ts","../src/index.ts"],"names":["DEPRECATED_JWT_SECRET","JWT_NEW_SECRET","DEPRECATED_REFRESH_JWT_SECRET","REFRESH_JWT_SECRET","DEPRECATION_UNIX_TIMESTAMP","getRelevantSecret","token","deprecatedSecret","newSecret","deprecationTime","moment","unixTime","iat","jwt","getRefreshTokenSecret","getTokenSecret","getAuthFromBearer","bearer","decodeBearer","appSecret","M","EMPTY_UUID","FULL_UUID","VALID_CHARS_REGEX","UUID_VERSION_REGEX","UUID_REGEX","validateUUID","uuid","CACHE_LIFETIME_IN_SEC","apiGwUrl","IdentityNetwork","Network","AutofleetApiNetwork","ELEVATED_PERMISSIONS_HEADER","CONTEXTS_IDS_HEADER","userCache","NodeCache","mergePermissions","target","sources","permissions","source","entityType","entityId","perms","ApiUser","id","accountType","elevatedPermissions","contextIds","cacheKey","objectHash","data","customPermissionLoader","cachedResult","key","addedPermissions","elevationId","entityIds","currentUserTrace","getCurrentContext","currentElevation","newElevation","appId","clientSecret","currentAppPermission","decodeAppBearer","decoded","AppDoesNotExist","IDENTITY_MS","ACCESS_TOKEN","USER_OBJECT","USER_TRACING_HEADER","ORIGIN_HEADER","USER_PERMISSIONS_HEADER","LOWER_CASE_ORIGIN_HEADER","AUTOFLEET_APPS_SECRET_HEADER","authFromUserIdHeader","options","headers","originHeader","eagerLoadUserPermissions","eagerLoadUserPermissionsLegacy","userId","elevatedPermissionsFromHeader","userObject","middleware","req","res","next","middlewareWithDecode","returnErrorIfNoToken","e","appMiddleware","Err","currentTraceContext","eagerLoadPermissionsMiddleware","getDecodedBearer","createOrSetRabbitTrace","trace","newTrace","traceTypes","user_default","authFromUserIdHeaderPlugin","fastify","done","request","reply","user","getUser","isUserExist","checkUserPermissions","checkFleetPermission","fleetId","checkBusinessModelPermission","businessModelId","checkDemandSourcePermission","demandSourceId","UnauthorizedAccessError","message","AUTHORIZATION_METHODS","AUTHORIZATION_ACTIONS","authorizationSettings","username","password","secret","ae","getAuthorizationHeader","authorizationMethod","getCurrentPayload","g","enableTracing","outbreakOptions","logger","outbreak","index_default"],"mappings":"s4BAGA,IAAM,CACJ,qBAAA,CAAAA,EAAuB,CAAA,cAAA,CAAAC,GACvB,6BAAAC,CAAAA,EAAAA,CAA+B,kBAAAC,CAAAA,EAAAA,CAC/B,0BAAAC,CAAAA,EACF,EAAI,OAAQ,CAAA,GAAA,CAENC,CAAoB,CAAA,CAACC,CAA2BC,CAAAA,CAAAA,CAA0BC,IAA8B,CAC5G,IAAMC,EAAkBC,kBAAO,CAAA,QAAA,CAASN,GAA4B,EAAE,CAAA,CAAI,GAAI,CAAA,CAC9E,GAAI,CACF,IAAIO,CACJ,CAAA,GAAIL,CAAO,CAAA,CACT,GAAM,CAAE,IAAAM,CAAI,CAAA,CAAIC,oBAAI,CAAA,MAAA,CAAOP,CAAK,CAAA,CAChCK,EAAWD,kBAAOE,CAAAA,CAAAA,CAAM,GAAI,EAC9B,CAAA,KACED,EAAWD,kBAAO,EAAA,CAEpB,OAAOC,CAAAA,CAAS,QAASF,CAAAA,CAAe,EAAIF,CAAmBC,CAAAA,CACjE,CAAY,KAAA,CACV,OAAOA,CACT,CACF,CAEaM,CAAAA,EAAAA,CAAyBR,CAA2BD,EAAAA,CAAAA,CAAkBC,CAAOJ,CAAAA,EAAAA,CAA+BC,EAAkB,CAC9HY,CAAAA,CAAAA,CAAkBT,GAA2BD,CAAkBC,CAAAA,CAAAA,CAAON,GAAuBC,EAAc,ECfjH,IAAMe,CAAAA,CAAqBC,CAA2BA,EAAAA,CAAAA,CAAO,QAAQ,SAAW,CAAA,EAAE,CAE5EC,CAAAA,CAAAA,CAAe,CAACD,CAAAA,CAAgBE,IAA4B,CACvE,IAAMb,CAAQU,CAAAA,CAAAA,CAAkBC,CAAM,CAAA,CAEtC,OADoBG,YAAOd,CAAAA,MAAAA,CAAAA,CAAAA,CAAoBS,CAAeT,CAAAA,CAAK,CAAC,CAEtE,CAAA,CAqDA,IAAMe,EAAAA,CAAa,sCACbC,CAAAA,EAAAA,CAAY,uCACZC,CAAoB,CAAA,UAAA,CACpBC,EAAqB,CAAA,OAAA,CACrBC,EAAa,CAAA,IAAI,OACrB,CAAOF,IAAAA,EAAAA,CAAiB,CAAOA,IAAAA,EAAAA,CAAiB,CAAOC,IAAAA,EAAAA,EAAkB,GAAGD,CAAiB,CAAA,UAAA,EAAaA,CAAiB,CAAOA,IAAAA,EAAAA,CAAiB,QAAQF,EAAU,CAAA,CAAA,EAAIC,EAAS,CAAA,EAAA,CAAA,CAClL,GACF,CAAA,CACO,SAASI,CAAaC,CAAAA,CAAAA,CAA6B,CACxD,OAAO,OAAOA,CAAAA,EAAS,UAAYF,EAAW,CAAA,IAAA,CAAKE,CAAI,CACzD,CC9EA,IAAMC,EAAwB,EACxBC,CAAAA,CAAAA,CAAW,QAAQ,GAAI,CAAA,eAAA,EAAmB,0BAGnCC,CAAAA,CAAAA,CAAkB,IAAIC,kBAAAA,CAAQ,CACzC,WAAa,CAAA,aAAA,CACb,OAAS,CAAA,CAAA,CACT,cAAgB,CAAA,IAAM,KACtB,KAAO,CAAA,OAAA,CAAQ,GAAI,CAAA,QAAA,GAAa,MAAS,CAAA,CACvC,OAAQH,CAAwB,CAAA,GAClC,EAAI,MACN,CAAC,EAEYI,CAAsB,CAAA,IAAID,kBAAQ,CAAA,CAC7C,OAASF,CAAAA,CAAAA,CACT,WAAYA,CACZ,CAAA,OAAA,CAAS,CACT,CAAA,cAAA,CAAgB,IAAM,IAAA,CACtB,MAAO,OAAQ,CAAA,GAAA,CAAI,QAAa,GAAA,MAAA,CAAS,CACvC,MAAA,CAAQD,EAAwB,GAClC,CAAA,CAAI,MACN,CAAC,CAAA,KCZYK,CAA8B,CAAA,2BAAA,CAC9BC,CAAsB,CAAA,kBAAA,CAqB7BC,CAAY,CAAA,IAAIC,oBAAU,CAAE,MAAA,CAAQ,EAAG,CAAC,CAExCC,CAAAA,CAAAA,CAAmB,CAACC,CAAqBC,CAAAA,CAAAA,GAAuD,CACpG,IAAMC,CAA2B,CAAA,CAC/B,GAAGF,CACH,CAAA,MAAA,CAAQ,CAAE,GAAGA,CAAAA,EAAQ,MAAO,CAC5B,CAAA,cAAA,CAAgB,CAAE,GAAGA,CAAQ,EAAA,cAAe,EAC5C,aAAe,CAAA,CAAE,GAAGA,CAAAA,EAAQ,aAAc,CAE5C,EAGA,IAAWG,IAAAA,CAAAA,IAAUF,CACnB,CAAA,MAAA,CAAO,IAAKE,CAAAA,CAAM,EAAE,OAASC,CAAAA,CAAAA,EAAe,CAE1CF,CAAYE,CAAAA,CAAU,IAAM,EAAC,CAC7B,MAAO,CAAA,OAAA,CAAQD,CAAOC,CAAAA,CAAU,CAAE,CAAE,CAAA,OAAA,CAAQ,CAAC,CAACC,CAAUC,CAAAA,CAAK,IAAM,CAEjEJ,CAAAA,CAAYE,CAAU,CAAA,CAAEC,CAAQ,CAAA,CAAA,CAAKH,EAAYE,CAAU,CAAA,CAAEC,CAAQ,CAAK,EAAA,IAAI,MAAOC,CAAAA,CAAK,EAC5F,CAAC,EACH,CAAC,EAGH,OAAOJ,CACT,CAEqBK,CAAAA,CAAAA,CAArB,KAA6B,CAW3B,YAAmBC,CAAqBC,CAAAA,CAAAA,CAA2BC,CAAiDC,CAAAA,CAAAA,CAAuB,CAAxH,IAAA,CAAA,EAAA,CAAAH,EAAqB,IAAAC,CAAAA,WAAAA,CAAAA,CAAAA,CAA4E,gBAAAE,CARpH,CAAA,IAAA,CAAiB,+BAAiC,IAAI,GAAA,CAItD,IAAiB,CAAA,aAAA,CAAwC,EAAC,CAKxD,KAAK,SAAY,CAAA,CAAC,CAACH,CAAAA,CACfE,CACF,EAAA,IAAA,CAAK,+BAA+B,GAAI,CAAA,MAAA,CAAO,SAAS,CAAA,CAAGA,CAAmB,EAElF,CAEA,MAAa,kBAAA,EAA2C,CACtD,GAAI,CAAC,KAAK,EACR,CAAA,OAEF,GAAI,IAAA,CAAK,kBACP,CAAA,OAAO,KAAK,kBAEd,CAAA,IAAME,CAAWC,CAAAA,mBAAAA,CAAW,CAC1B,EAAA,CAAI,KAAK,EACT,CAAA,UAAA,CAAY,IAAK,CAAA,UACnB,CAAC,CAAA,CAEGC,EAAOjB,CAAU,CAAA,GAAA,CAAiBe,CAAQ,CAE9C,CAAA,OAAKE,IACF,CAAE,IAAA,CAAAA,CAAK,CAAA,CAAI,MAAMtB,CAAAA,CAAgB,IAAiB,CAAiB,cAAA,EAAA,IAAA,CAAK,EAAE,CAAA,sBAAA,CAAA,CAA0B,CAAE,MAAA,CAAQ,CAAE,UAAY,CAAA,IAAA,CAAK,UAAW,CAAE,CAAC,CAAA,CAChJK,EAAU,GAAIe,CAAAA,CAAAA,CAAUE,CAAI,CAG9B,CAAA,CAAA,IAAA,CAAK,YAAcA,CAAK,CAAA,WAAA,CACxB,IAAK,CAAA,kBAAA,CAAqBA,CACnB,CAAA,IAAA,CAAK,kBACd,CAEA,MAAa,0BAA0BC,CAA0G,CAAA,CAC/I,GAAI,CAAC,IAAA,CAAK,EACR,CAAA,OAEF,GAAI,IAAA,CAAK,mBACP,OAAO,IAAA,CAAK,mBAGd,IAAMH,CAAAA,CAAW,KAAK,EAEhBI,CAAAA,CAAAA,CAAenB,CAAU,CAAA,GAAA,CAAiBe,CAAQ,CAAA,CACxD,GAAII,CACF,CAAA,OAAA,IAAA,CAAK,kBAAqBA,CAAAA,CAAAA,CACnBA,CAGT,CAAA,IAAMF,EAAO,MAAMC,CAAAA,CAAuB,IAAK,CAAA,EAAE,CACjD,CAAA,OAAAlB,EAAU,GAAIe,CAAAA,CAAAA,CAAUE,CAAI,CAE5B,CAAA,IAAA,CAAK,mBAAqBA,CACnB,CAAA,IAAA,CAAK,kBACd,CAEA,IAAW,cAAA,EAAuC,CAChD,OAAO,IAAA,CAAK,eAAgB,CAAA,gBAAgB,CAC9C,CAEA,IAAW,MAA+B,EAAA,CACxC,OAAO,IAAA,CAAK,eAAgB,CAAA,QAAQ,CACtC,CAEA,IAAW,eAAsC,CAC/C,OAAO,KAAK,eAAgB,CAAA,eAAe,CAC7C,CAEQ,eAAgBG,CAAAA,CAAAA,CAA8C,CACpE,GAAI,CAAC,IAAK,CAAA,kBAAA,CACR,MAAM,IAAI,MAAM,CAAcA,WAAAA,EAAAA,CAAG,CAAoD,kDAAA,CAAA,CAAA,CAEvF,OAAO,MAAA,CAAO,KAAK,IAAK,CAAA,kBAAA,CAAmBA,CAAG,CAAK,EAAA,EAAE,CACvD,CAEA,IAAW,mBAAA,EAAmC,CAC5C,OAAOlB,EAAiB,MAAW,CAAA,IAAA,CAAK,8BAA+B,CAAA,MAAA,EAAQ,CACjF,CAEA,IAAW,WAAA,EAAuC,CAChD,GAAI,CAAC,IAAA,CAAK,mBACR,MAAM,IAAI,MAAM,0EAA0E,CAAA,CAG5F,OAAOA,CAAiB,CAAA,IAAA,CAAK,kBAAoB,CAAA,IAAA,CAAK,8BAA+B,CAAA,MAAA,EAAQ,CAC/F,CAEO,kBAAmBmB,CAAAA,CAAAA,CAAkD,CAG1E,IAAMC,EAAc,MAAO,EAAA,CAG3B,MAAO,CAAA,MAAA,CAAOD,CAAgB,CAAA,CAAE,QAASE,CAAc,EAAA,CACrD,OAAO,IAAKA,CAAAA,CAAS,EAAE,OAASf,CAAAA,CAAAA,EAAa,CAC3C,GAAI,CAACjB,CAAAA,CAAaiB,CAAQ,CACxB,CAAA,MAAM,IAAI,KAAA,CAAM,CAAkEA,+DAAAA,EAAAA,CAAQ,EAAE,CAEhG,CAAC,EACH,CAAC,CAED,CAAA,IAAMgB,EAAmBC,mBAAkB,EAAA,CAC3C,GAAI,CAACD,CAAAA,CACH,MAAM,IAAI,KAAA,CAAM,+CAA+C,CAAA,CAGjE,IAAME,CAAAA,CAAmB,KAAK,KAAMF,CAAAA,CAAAA,CAAiB,OAAQ1B,CAAAA,CAA2B,CAAK,EAAA,IAAI,EAC3F6B,CAAe,CAAA,MAAA,CAAO,MAAOD,CAAAA,CAAAA,CAAkBL,CAAgB,CAAA,CACrE,YAAK,8BAA+B,CAAA,GAAA,CAAIC,EAAaK,CAAY,CAAA,CACjEH,EAAiB,OAAQ,CAAA,GAAA,CAAI1B,CAA6B,CAAA,IAAA,CAAK,SAAU,CAAA,IAAA,CAAK,mBAAmB,CAAC,CAAA,CAC3F,IAAM,CACX,IAAK,CAAA,8BAAA,CAA+B,OAAOwB,CAAW,CAAA,CACtDE,CAAiB,CAAA,OAAA,CAAQ,GAAI1B,CAAAA,CAAAA,CAA6B,KAAK,SAAU,CAAA,IAAA,CAAK,mBAAmB,CAAC,EACpG,CACF,CAEA,MAAa,wBAA2B,EAAA,CACtC,GAAI,CAAC,KAAK,EACR,CAAA,OAEF,GAAI,IAAA,CAAK,wBACP,CAAA,OAAO,KAAK,wBAEd,CAAA,GAAM,CAAE,IAAA,CAAAmB,CAAK,CAAA,CAAI,MAAMtB,CAAgB,CAAA,GAAA,CAAI,iBAAiB,IAAK,CAAA,EAAE,+BAA+B,CAElG,CAAA,OAAA,IAAA,CAAK,wBAA2BsB,CAAAA,CAAAA,CACzB,IAAK,CAAA,wBACd,CAEA,IAAW,iBAAA,EAAyB,CAClC,GAAI,CAAC,IAAA,CAAK,yBACR,MAAM,IAAI,KAAM,CAAA,sFAAsF,CAExG,CAAA,OAAO,KAAK,wBACd,CAEA,MAAa,qBAAsBW,CAAAA,CAAAA,CAAOC,EAAc,CACtD,GAAI,CAAC,IAAA,CAAK,EAAM,EAAA,CAACD,GAAS,CAACC,CAAAA,CACzB,OAEF,IAAMC,CAAuB,CAAA,IAAA,CAAK,cAAcF,CAAK,CAAA,CAErD,GAAIE,CAAAA,CACF,OAAOA,CAAAA,CAGT,IAAMf,CAAW,CAAA,CAAA,EAAG,KAAK,EAAE,CAAA,CAAA,EAAIa,CAAK,CAE9BT,CAAAA,CAAAA,CAAAA,CAAenB,CAAU,CAAA,GAAA,CAAiBe,CAAQ,CAAA,CACxD,GAAII,CACF,CAAA,OAAA,IAAA,CAAK,aAAcS,CAAAA,CAAK,CAAIT,CAAAA,CAAAA,CACrBA,EAGT,GAAM,CAAE,IAAAF,CAAAA,CAAK,CAAI,CAAA,MAAMpB,EAAoB,IAAkB,CAAA,CAAA,aAAA,EAAgB+B,CAAK,CAAqB,iBAAA,CAAA,CAAA,CACrG,OAAQ,IAAK,CAAA,EACf,CAAG,CAAA,CACD,OAAS,CAAA,CACP,0BAA2BC,CAC7B,CACF,CAAC,CAAA,CAED,OAAA7B,CAAAA,CAAU,IAAIe,CAAUE,CAAAA,CAAI,CAC5B,CAAA,IAAA,CAAK,aAAcW,CAAAA,CAAK,EAAIX,CACrB,CAAA,IAAA,CAAK,cAAcW,CAAK,CACjC,CACF,ECxOO,IAAMG,CAAkB,CAAA,MAAOjD,CAAgB8C,CAAAA,CAAAA,GAAgC,CACpF,GAAM,CAAE,IAAMI,CAAAA,CAAQ,CAAI,CAAA,MAAMnC,EAAoB,IAAK,CAAA,cAAA,CAAgB,CAAE,MAAA,CAAAf,CAAQ,CAAA,KAAA,CAAA8C,CAAM,CAAC,CAAA,CAC1F,OAAOI,CACT,CAAA,CCLA,IAAqBC,CAArB,CAAA,cAA6C,KAAM,CAAnD,WACE,EAAA,CAAA,KAAA,CAAA,GAAA,SAAA,CAAA,CAAA,IAAA,CAAA,IAAA,CAAO,kBAEP,IAAU,CAAA,OAAA,CAAA,qBAAA,CACZ,CCJO,CAAA,IAAMC,CAAc,CAAA,aAAA,CACdC,EAAe,aACfC,CAAAA,CAAAA,CAAc,YACdC,CAAAA,CAAAA,CAAsB,cACtBC,CAAAA,CAAAA,CAAgB,uBAChBC,CAA0B,CAAA,uBAAA,CAC1BC,EAA2BF,CAAc,CAAA,WAAA,GACzCG,CAA+B,CAAA,yBAAA,CCWrC,IAAMC,CAAuB,CAAA,MAAOC,EAAsCC,CAA+D,GAAA,CAC9I,IAAMC,CAAeD,CAAAA,CAAAA,CAAQN,CAAa,CAAA,EAAKM,CAAQJ,CAAAA,CAAwB,GAAK,EACpF,CAAA,GAAI,CAAC,KAAM,CAAA,OAAA,CAAQK,CAAY,CAAKA,EAAAA,CAAAA,CAAa,WAAY,EAAA,GAAMX,CACjE,CAAA,OAEF,GAAM,CACJ,wBAAA,CAAAY,CACA,CAAA,8BAAA,CAAAC,CACA,CAAA,sBAAA,CAAA7B,CACF,CAAIyB,CAAAA,CAAAA,CACEK,CAASJ,CAAAA,CAAAA,CAAQP,CAAmB,CAAA,CAC1C,GAAI,CAACW,CAAAA,EAAU,MAAM,OAAQA,CAAAA,CAAM,EACjC,OAGF,IAAMC,CAAgCL,CAAAA,CAAAA,CAAQ9C,CAA2B,CAAA,EAAG,OAAS,CAAI,CAAA,IAAA,CAAK,KAAM8C,CAAAA,CAAAA,CAAQ9C,CAA2B,CAAW,EAAI,EAAC,CACjJgB,CAAc8B,CAAAA,CAAAA,GAAU7C,CAAmB,CAAA,EAAc,MAAM,GAAG,CAAA,CAElEmD,EAAa,IAAIxC,CAAAA,CAAQsC,EAAQ,MAAQC,CAAAA,CAAAA,CAA+BnC,CAAU,CAAA,CACxF,OAAIgC,CAAAA,GACE5B,EACF,MAAMgC,CAAAA,CAAW,yBAA0BhC,CAAAA,CAAsB,CAEjE,CAAA,MAAMgC,EAAW,kBAAmB,EAAA,CAAA,CAIpCH,CACF,EAAA,MAAMG,CAAW,CAAA,wBAAA,GAGnBzB,mBAAkB,EAAA,CAAE,kBAAkB,GAAIW,CAAAA,CAAAA,CAAac,CAAU,CAC1DA,CAAAA,CACT,CC5BO,CAAA,IAAMC,CAAa,CAAA,CAACR,EAAuC,EAAC,GAAe,MAAOS,CAAAA,CAAKC,CAAKC,CAAAA,CAAAA,GAAuB,CACxH,GAAI,CACF,IAAMJ,CAAAA,CAAa,MAAMR,CAAAA,CAAqBC,EAASS,CAAI,CAAA,OAAO,EAC9DF,CACFE,GAAAA,CAAAA,CAAI,KAAOF,CAGXE,CAAAA,CAAAA,CAAI,OAAQb,CAAAA,CAAuB,CAAIW,CAAAA,CAAAA,CAAAA,CAGzCI,IACF,CAAA,KAAY,CACVD,CAAAA,CAAI,MAAO,CAAA,GAAG,EAAE,IAAK,CAAA,CAAE,KAAO,CAAA,0BAA2B,CAAC,EAC5D,CACF,CAEaE,CAAAA,CAAAA,CAAuB,CAACZ,CAIjC,CAAA,KAAgB,MAAOS,CAAAA,CAAKC,CAAKC,CAAAA,CAAAA,GAAwB,CAC3D,GAAM,CACJ,wBAAAR,CAAAA,CAAAA,CACA,8BAAAC,CAAAA,CAAAA,CACA,oBAAAS,CAAAA,CACF,EAAIb,CACAX,CAAAA,CAAAA,CACJ,GAAIoB,CAAAA,CAAI,OAAQ,CAAA,aAAA,CAAe,CAC7B,GAAI,CACFpB,EAAU,MAAMjD,CAAAA,CAAaqE,EAAI,OAAQ,CAAA,aAAa,EACxD,CAAA,MAASK,CAAG,CAAA,CACNA,aAAa/E,oBAAI,CAAA,iBAAA,CACnB2E,CAAI,CAAA,MAAA,CAAO,GAAG,CAAA,CAAE,KAAK,CAAE,MAAA,CAAQ,CAAC,sBAAsB,CAAE,CAAC,EAChDI,CAAa/E,YAAAA,oBAAAA,CAAI,kBAC1B2E,CAAI,CAAA,MAAA,CAAO,GAAG,CAAE,CAAA,IAAA,CAAK,CAAE,MAAA,CAAQ,CAACI,CAAAA,CAAE,OAAO,CAAE,CAAC,CAE5CJ,CAAAA,CAAAA,CAAI,MAAO,CAAA,GAAG,EAAE,IAAK,CAAA,CAAE,MAAQ,CAAA,CAAC,kCAAkC,CAAE,CAAC,CAEvE,CAAA,MACF,CACA,IAAML,CAAAA,CAAShB,GAAS,IAAM,EAAA,EAAA,CAE1BgB,CACFI,GAAAA,CAAAA,CAAI,OAAQf,CAAAA,CAAmB,EAAIW,CAGrC,CAAA,CAAA,IAAMlC,CAAcsC,CAAAA,CAAAA,CAAI,OAAUrD,GAAAA,CAAmB,GAAc,KAAM,CAAA,GAAG,CACtEmD,CAAAA,CAAAA,CAAa,IAAIxC,CAAAA,CAAQsC,EAAQhB,CAAS,EAAA,IAAA,EAAM,YAAa,MAAWlB,CAAAA,CAAU,GAEpFgC,CAA4BC,EAAAA,CAAAA,GAC9B,MAAM,OAAA,CAAQ,GAAI,CAAA,CAChBD,GAA4BI,CAAW,CAAA,kBAAA,EACvCH,CAAAA,CAAAA,EAAkCG,CAAW,CAAA,wBAAA,EAC/C,CAAC,CAAA,CAGHE,CAAI,CAAA,IAAA,CAAOF,CACXzB,CAAAA,mBAAAA,GAAoB,gBAAkB,EAAA,GAAA,CAAIW,EAAac,CAAU,CAAA,CAIjEE,EAAI,OAAQb,CAAAA,CAAuB,CAAIW,CAAAA,EACzC,CAAWM,KAAAA,GAAAA,CAAAA,CAAsB,CAC/BH,CAAI,CAAA,MAAA,CAAO,GAAG,CAAA,CAAE,IAAK,CAAA,CAAE,OAAQ,CAAC,mBAAmB,CAAE,CAAC,CACtD,CAAA,MACF,CACAC,CAAK,GACP,EAEaI,CAAiBf,CAAAA,CAAAA,EAGf,MAAOS,CAAKC,CAAAA,CAAAA,CAAKC,CAAwB,GAAA,CACtD,GAAM,CACJ,MAAA1B,CACA,CAAA,YAAA,CAAAC,CACF,CAAA,CAAIc,CACAX,CAAAA,CAAAA,CAEJ,GAAI,CAACoB,CAAAA,CAAI,OAAQ,CAAA,aAAA,CAAe,CAC9BC,CAAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,CAAE,MAAA,CAAQ,CAAC,mBAAmB,CAAE,CAAC,CAAA,CACtD,MACF,CAEA,GAAI,CAEF,GADArB,CAAU,CAAA,MAAMD,CAAgBqB,CAAAA,CAAAA,CAAI,QAAQ,aAAexB,CAAAA,CAAK,CAC5D,CAAA,CAACI,CACH,CAAA,MAAM,IAAIC,CAEd,CAAA,MAASwB,EAAG,CACV,GAAIA,aAAa/E,oBAAI,CAAA,iBAAA,CAAmB,CACtC2E,CAAAA,CAAI,MAAO,CAAA,GAAG,EAAE,IAAK,CAAA,CAAE,MAAQ,CAAA,CAAC,sBAAsB,CAAE,CAAC,CACzD,CAAA,MACF,CACA,GAAI,CAAC3E,oBAAAA,CAAI,kBAAmBuD,CAAe,CAAA,CAAE,KAAM0B,CAAQF,EAAAA,CAAAA,YAAaE,CAAG,CAAG,CAAA,CAC5EN,CAAI,CAAA,MAAA,CAAO,GAAG,CAAA,CAAE,KAAK,CAAE,MAAA,CAAQ,CAACI,CAAAA,CAAE,OAAO,CAAE,CAAC,CAC5C,CAAA,MACF,CACAJ,CAAAA,CAAI,MAAO,CAAA,GAAG,EAAE,IAAK,CAAA,CAAE,OAAQ,CAAC,kCAAkC,CAAE,CAAC,CAAA,CACrE,MACF,CACA,IAAML,CAAAA,CAAShB,GAAS,MACpBgB,CAAAA,CAAAA,GACFI,EAAI,OAAQf,CAAAA,CAAmB,EAAIW,CAGrC,CAAA,CAAA,IAAME,CAAa,CAAA,IAAIxC,CAAQsC,CAAAA,CAAM,EAEjCpB,CACFwB,GAAAA,CAAAA,CAAI,QAAQX,CAA4B,CAAA,CAAIZ,EAE5C,MAAMqB,CAAAA,CAAW,qBAAsBtB,CAAAA,CAAAA,CAAOC,CAAY,CAAA,CAAA,CAG5DuB,EAAI,IAAOF,CAAAA,CAAAA,CACX,IAAMU,CAAAA,CAAsBnC,mBAAkB,EAAA,CAAE,iBAChDmC,CAAqB,EAAA,GAAA,CAAIxB,CAAac,CAAAA,CAAU,CAChDU,CAAAA,CAAAA,EAAqB,IAAIzB,CAActD,CAAAA,CAAAA,CAAkBuE,EAAI,OAAQ,CAAA,aAAa,CAAC,CAInFA,CAAAA,CAAAA,CAAI,OAAQb,CAAAA,CAAuB,CAAIW,CAAAA,CAAAA,CAEvCI,IACF,CAAA,CAEaO,CAA0C,CAAA,MAAOT,CAAKC,CAAAA,CAAAA,CAAKC,IAAS,CAC/E,MAAMF,CAAI,CAAA,IAAA,CAAK,kBAAmB,EAAA,CAClCE,IACF,CAAA,CAEaQ,GAAoBV,CAC1BA,EAAAA,CAAAA,CAAI,QAAQ,aAGVrE,CAAAA,CAAAA,CAAaqE,CAAI,CAAA,OAAA,CAAQ,aAAa,CAAA,CAFpC,KAKEW,EAAyB,CAAA,MAAOC,CAAgDhB,CAAAA,CAAAA,GAA+B,CAC1H,IAAME,EAAa,IAAIxC,CAAAA,CAAQsC,CAAM,CAAA,CAErC,MAAME,CAAAA,CAAW,oBAEjBc,CAAAA,CAAAA,GAAUC,WAASC,YAAW,CAAA,MAAM,EACpCF,CAAM,CAAA,gBAAA,CAAiB,GAAI5B,CAAAA,CAAAA,CAAac,CAAU,EACpD,EAEOiB,EAAQzD,CAAAA,EC/JF0D,IAAAA,CAAAA,CAAiF,CAACC,CAAAA,CAAS1B,EAAS2B,CAAS,GAAA,CACxHD,CAAQ,CAAA,OAAA,CAAQ,WAAa,CAAA,MAAOE,EAASC,CAAU,GAAA,CACrD,GAAI,CACF,IAAMC,EAAO,MAAM/B,CAAAA,CAAqBC,CAAS4B,CAAAA,CAAAA,CAAQ,OAAO,CAAA,CAC5DE,GACFJ,CAAQ,CAAA,eAAA,CAAgB,MAAQI,CAAAA,CAAI,EAExC,CAAA,KAAY,CACVD,CAAM,CAAA,MAAA,CAAO,GAAG,CAAA,CAAE,IAAK,CAAA,CAAE,MAAO,0BAA2B,CAAC,EAC9D,CACF,CAAC,EAEDF,CAAK,GACP,EACAF,CAAAA,CAA2B,MAAO,CAAA,GAAA,CAAI,eAAe,CAAC,CAAA,CAAI,ICzB1D,CAIaM,IAAAA,CAAAA,CAAU,IAA4BjD,mBAAAA,EAAoB,CAAA,gBAAA,EAAkB,IAAIW,CAAW,CAAA,CAE3FuC,EAAc,IAAMD,CAAAA,IAAW,EAEtCE,CAAAA,CAAAA,CAAuB,CAC3BpE,CAAAA,CACAD,CACG,GAAA,CAACoE,GAAiB,EAAA,MAAA,CAAO,MAAOD,CAAAA,CAAAA,EAAW,CAAA,WAAA,CAAYnE,CAAU,CAAGC,CAAAA,CAAQ,CAEpEqE,CAAAA,EAAAA,CAAwBC,CAAoBF,EAAAA,CAAAA,CAAqBE,EAAS,QAAQ,CAAA,CAClFC,GAAgCC,CAA4BJ,EAAAA,CAAAA,CAAqBI,EAAiB,gBAAgB,CAAA,CAClHC,EAA+BC,CAAAA,CAAAA,EAA2BN,CAAqBM,CAAAA,CAAAA,CAAgB,eAAe,ECZpH,IAAMC,CAAN,CAAA,cAAsC,KAAM,CACjD,YAAmBV,CAAuB,CAAA,IAAA,CAAMW,CAAU,CAAA,yBAAA,CAA2B,CACnF,KAAA,CAAMA,CAAO,CADI,CAAA,IAAA,CAAA,IAAA,CAAAX,EAEjB,IAAK,CAAA,IAAA,CAAO,0BACd,CACF,ECNO,IAAMY,EAAwB,CACnC,IAAA,CAAM,MACN,CAAA,KAAA,CAAO,OACP,CAAA,GAAA,CAAK,KACP,CAEMC,CAAAA,EAAAA,CAAwB,CAC5B,CAACD,CAAsB,CAAA,IAAI,EAAG,IAAG,EAAA,CACjC,CAACA,CAAsB,CAAA,KAAK,EAAIE,CAA+B,EAAA,CAC7D,GAAM,CAAE,QAAAC,CAAAA,CAAAA,CAAU,SAAAC,CAAS,CAAA,CAAIF,CAE/B,CAAA,OAAO,CADoB,MAAA,EAAA,MAAA,CAAO,KAAK,CAAGC,EAAAA,CAAQ,CAAIC,CAAAA,EAAAA,CAAQ,CAAE,CAAA,CAAA,CAAE,SAAS,QAAQ,CACjD,EACpC,CACA,CAAA,CAACJ,EAAsB,GAAG,EAAIE,CAA+B,EAAA,CAC3D,GAAM,CAAE,OAAAG,CAAO,CAAA,CAAIH,CACnB,CAAA,GAAIG,CACF,CAAA,OAAO,UAAcC,YAAK,CAAA,IAAA,CAAA,EAAID,CAAAA,CAAAA,CAAQ,CAAE,SAAA,CAAW,EAAG,CAAC,CAAC,EAG5D,CACF,CAAA,CAEaE,GAA0BL,CAA8E,EAAA,CACnH,IAAMM,CAAAA,CAAsBN,CAAuB,EAAA,MAAA,CAEnD,GAAI,EAACM,CAAAA,CAAAA,EAAuB,CAACP,EAAAA,CAAsBO,CAAmB,CAAA,CAAA,CAItE,OAAOP,EAAsBO,CAAAA,CAAmB,CAAEN,CAAAA,CAAqB,CACzE,MCTMO,EAA6B,CAAAC,YAAA,CAAA,iBAAA,CAI7BC,GAAgB,CAAC,CAAE,gBAAAC,CAAkB,CAAA,EAAI,CAAA,MAAA,CAAAC,CAAO,CAAA,CAAiF,EAAa,GAAA,CACzIH,YAAQ,CAAA,OAAA,CAAA,CACf,aAAe,CAAA,MAAA,CACf,wBAAyBG,CAAQ,EAAA,oBAAA,CACjC,GAAGD,CACL,CAAC,EACH,EAEM,CAAE,UAAA,CAAA/B,GAAY,QAAAD,CAAAA,EAAS,EAAIkC,aA8BjC,IAAOC,EAAQ,CAAA,CACb,UAAAlC,CAAAA,EAAAA,CACA,SAAAD,EACA,CAAA,IAAA,CAAAE,EACA,CAAA,UAAA,CAAAhB,CACA,CAAA,oBAAA,CAAAI,EACA,8BAAAM,CAAAA,CAAAA,CACA,iBAAAiC,CAAAA,EAAAA,CACA,gBAAAhC,CAAAA,EAAAA,CACA,qBAAAe,EACA,CAAA,4BAAA,CAAAE,GACA,2BAAAE,CAAAA,EAAAA,CACA,YAAAN,CACA,CAAA,OAAA,CAAAD,CACA,CAAA,uBAAA,CAAAS,CACA,CAAA,aAAA,CAAAzB,EACA,sBAAAK,CAAAA,EAAAA,CACA,QAAAoC,CAAAA,YAAAA,CACA,qBAAAd,CAAAA,CAAAA,CACA,uBAAAO,EACA,CAAA,mBAAA,CAAA7F,CACA,CAAA,0BAAA,CAAAqE,CACF","file":"index.cjs","sourcesContent":["import jwt from 'jsonwebtoken';\nimport moment from 'moment';\n\nconst {\n  DEPRECATED_JWT_SECRET, JWT_NEW_SECRET,\n  DEPRECATED_REFRESH_JWT_SECRET, REFRESH_JWT_SECRET,\n  DEPRECATION_UNIX_TIMESTAMP,\n} = process.env;\n\nconst getRelevantSecret = (token: string | undefined, deprecatedSecret: string, newSecret: string): string => {\n  const deprecationTime = moment(parseInt(DEPRECATION_UNIX_TIMESTAMP, 10) * 1000);\n  try {\n    let unixTime: moment.Moment;\n    if (token) {\n      const { iat } = jwt.decode(token) as jwt.JwtPayload;\n      unixTime = moment(iat * 1000);\n    } else {\n      unixTime = moment();\n    }\n    return unixTime.isBefore(deprecationTime) ? deprecatedSecret : newSecret;\n  } catch (e) {\n    return newSecret;\n  }\n};\n\nexport const getRefreshTokenSecret = (token?: string): string => getRelevantSecret(token, DEPRECATED_REFRESH_JWT_SECRET, REFRESH_JWT_SECRET);\nexport const getTokenSecret = (token?: string): string => getRelevantSecret(token, DEPRECATED_JWT_SECRET, JWT_NEW_SECRET);\n","import type { UUID } from 'node:crypto';\nimport * as jwt from 'jsonwebtoken';\nimport { getTokenSecret } from './secret-getter';\n\nconst CONTEXT_PROPS = ['fleetId', 'businessModelId', 'demandSourceId'];\nconst CONTEXT_MAP_PROPS = {\n  fleet: 'fleets',\n  business: 'businessModels',\n  demand: 'demandSources',\n};\n\nexport const getAuthFromBearer = (bearer: string): string => bearer.replace('Bearer ', '');\n\nexport const decodeBearer = (bearer: string, appSecret?: string): any => {\n  const token = getAuthFromBearer(bearer);\n  const decoded = jwt.verify(token, appSecret || getTokenSecret(token));\n  return decoded;\n};\n\nexport const parsePermissions = (contextId, decodedToken): any => {\n  if (!decodedToken) { return []; }\n  const { contexts } = decodedToken;\n  const activeContext = contexts.find((context) => context.id === contextId);\n\n  const permissionsValue = `${activeContext.permissions?.map((cp) => `${cp},`)}`;\n\n  return {\n    key: activeContext.entityId,\n    value: permissionsValue,\n  };\n};\n\nexport const getEntitiesFromContext = (contextId: string, decodedToken: any): any => {\n  if (!decodedToken) { return []; }\n  let { contexts } = decodedToken;\n  if (contextId) {\n    contexts = contexts.filter((context) => context.id === contextId);\n  }\n\n  const attributes = {};\n  contexts.forEach((context) => {\n    const prop = CONTEXT_MAP_PROPS[context.subSystem || 'business'];\n\n    const permissions = parsePermissions(context.id, decodedToken);\n    attributes[prop] ||= {};\n    attributes[prop][permissions.key] = permissions.value;\n  });\n\n  return attributes;\n};\n\nexport const getContextAttributes = (contextId: string, decodedToken: any): any => {\n  if (!decodedToken) { return []; }\n  let { contexts } = decodedToken;\n  if (contextId) {\n    contexts = contexts.filter((context) => context.id === contextId);\n  }\n  const attributes = {};\n  contexts.forEach((context) => {\n    CONTEXT_PROPS.forEach((prop) => {\n      if (context[prop]) {\n        const contextPropWrapped = [context[prop]];\n        attributes[prop] ||= [];\n        attributes[prop] = attributes[prop].concat(contextPropWrapped);\n      }\n    });\n  });\n  return attributes;\n};\n\nconst EMPTY_UUID = '00000000-0000-0000-0000-000000000000';\nconst FULL_UUID = 'ffffffff-ffff-ffff-ffff-ffffffffffff';\nconst VALID_CHARS_REGEX = '[0-9a-f]';\nconst UUID_VERSION_REGEX = '[1-8]';\nconst UUID_REGEX = new RegExp(\n  `^(?:${VALID_CHARS_REGEX}{8}-${VALID_CHARS_REGEX}{4}-${UUID_VERSION_REGEX}${VALID_CHARS_REGEX}{3}-[89ab]${VALID_CHARS_REGEX}{3}-${VALID_CHARS_REGEX}{12}|${EMPTY_UUID}|${FULL_UUID})$`,\n  'i',\n);\nexport function validateUUID(uuid: unknown): uuid is UUID {\n  return typeof uuid === 'string' && UUID_REGEX.test(uuid);\n}\n","import Network from '@autofleet/network';\n\nconst CACHE_LIFETIME_IN_SEC = 10;\nconst apiGwUrl = process.env.API_GATEWAY_URL || 'https://api.autofleet.io';\n\n// eslint-disable-next-line import/prefer-default-export\nexport const IdentityNetwork = new Network({\n  serviceName: 'IDENTITY_MS',\n  retries: 3,\n  retryCondition: () => true,\n  cache: process.env.NODE_ENV !== 'test' ? {\n    maxAge: CACHE_LIFETIME_IN_SEC * 1000,\n  } : undefined,\n});\n\nexport const AutofleetApiNetwork = new Network({\n  baseURL: apiGwUrl,\n  serviceUrl: apiGwUrl,\n  retries: 3,\n  retryCondition: () => true,\n  cache: process.env.NODE_ENV !== 'test' ? {\n    maxAge: CACHE_LIFETIME_IN_SEC * 1000,\n  } : undefined,\n});\n","import NodeCache from 'node-cache';\nimport objectHash from 'object-hash';\nimport { getCurrentContext } from '@autofleet/outbreak';\nimport { validateUUID } from '../utils';\nimport { AutofleetApiNetwork, IdentityNetwork } from '../services';\n\nexport type AccountType = 'client' | 'user' | 'service' | 'driver'\ninterface EntityPermissions {\n    [key: string]: string[];\n}\n\nexport const ELEVATED_PERMISSIONS_HEADER = 'x-af-elevated-permissions';\nexport const CONTEXTS_IDS_HEADER = 'x-af-context-ids';\n\nexport interface UserPayload {\n  businessModels: EntityPermissions;\n  fleets: EntityPermissions;\n  demandSources: EntityPermissions;\n  businessAccounts?: EntityPermissions;\n  accountType?: AccountType;\n  contexts?: EntityPermissions;\n  createdAt?: string;\n}\n\nexport interface PartialUserPayload {\n  businessModels?: EntityPermissions;\n  fleets?: EntityPermissions;\n  demandSources?: EntityPermissions;\n  vehicles?: EntityPermissions;\n  drivers?: EntityPermissions;\n  businessAccounts?: EntityPermissions;\n}\n\nconst userCache = new NodeCache({ stdTTL: 10 });\n\nconst mergePermissions = (target: UserPayload, sources: Iterable<PartialUserPayload>): UserPayload => {\n  const permissions: UserPayload = {\n    ...target,\n    fleets: { ...target?.fleets },\n    businessModels: { ...target?.businessModels },\n    demandSources: { ...target?.demandSources },\n    // Clone other nested objects as needed\n  };\n\n  // eslint-disable-next-line no-restricted-syntax\n  for (const source of sources) {\n    Object.keys(source).forEach((entityType) => {\n      // eslint-disable-next-line no-param-reassign\n      permissions[entityType] ??= {};\n      Object.entries(source[entityType]!).forEach(([entityId, perms]) => {\n        // eslint-disable-next-line no-param-reassign\n        permissions[entityType][entityId] = (permissions[entityType][entityId] || []).concat(perms);\n      });\n    });\n  }\n\n  return permissions;\n};\n\nexport default class ApiUser {\n  private privatePermissions: UserPayload | undefined;\n\n  private readonly privateElevatedPermissionsHash = new Map<symbol, PartialUserPayload | undefined>();\n\n  private privatePermissionsLegacy: any;\n\n  private readonly appPermission: {[key: string]: any; } = {};\n\n  public readonly emptyUser: boolean;\n\n  constructor(public id? : string, public accountType?: AccountType, elevatedPermissions?: PartialUserPayload, public contextIds?: string[]) {\n    this.emptyUser = !!id;\n    if (elevatedPermissions) {\n      this.privateElevatedPermissionsHash.set(Symbol('initial'), elevatedPermissions);\n    }\n  }\n\n  public async getUserPermissions(): Promise<UserPayload> {\n    if (!this.id) {\n      return undefined;\n    }\n    if (this.privatePermissions) {\n      return this.privatePermissions;\n    }\n    const cacheKey = objectHash({\n      id: this.id,\n      contextIds: this.contextIds,\n    });\n\n    let data = userCache.get<UserPayload>(cacheKey);\n\n    if (!data) {\n      ({ data } = await IdentityNetwork.get<UserPayload>(`/api/v1/users/${this.id}/authorization-payload`, { params: { contextIds: this.contextIds } }));\n      userCache.set(cacheKey, data);\n    }\n\n    this.accountType = data.accountType;\n    this.privatePermissions = data;\n    return this.privatePermissions;\n  }\n\n  public async useCustomPermissionLoader(customPermissionLoader: (userId: string) => UserPayload | PromiseLike<UserPayload>): Promise<UserPayload> {\n    if (!this.id) {\n      return undefined;\n    }\n    if (this.privatePermissions) {\n      return this.privatePermissions;\n    }\n\n    const cacheKey = this.id;\n\n    const cachedResult = userCache.get<UserPayload>(cacheKey);\n    if (cachedResult) {\n      this.privatePermissions = cachedResult;\n      return cachedResult;\n    }\n\n    const data = await customPermissionLoader(this.id);\n    userCache.set(cacheKey, data);\n\n    this.privatePermissions = data;\n    return this.privatePermissions;\n  }\n\n  public get businessModels(): string[] | undefined {\n    return this.getUserProperty('businessModels');\n  }\n\n  public get fleets(): string[] | undefined {\n    return this.getUserProperty('fleets');\n  }\n\n  public get demandSources(): string[] | undefined {\n    return this.getUserProperty('demandSources');\n  }\n\n  private getUserProperty(key: keyof UserPayload): string[] | undefined {\n    if (!this.privatePermissions) {\n      throw new Error(`Cannot get ${key} without calling (async) getUserPermissions before`);\n    }\n    return Object.keys(this.privatePermissions[key] || {});\n  }\n\n  public get elevatedPermissions(): UserPayload {\n    return mergePermissions(undefined, this.privateElevatedPermissionsHash.values());\n  }\n\n  public get permissions(): UserPayload | undefined {\n    if (!this.privatePermissions) {\n      throw new Error('Cannot get permissions without calling (async) getUserPermissions before');\n    }\n\n    return mergePermissions(this.privatePermissions, this.privateElevatedPermissionsHash.values());\n  }\n\n  public elevatePermissions(addedPermissions: PartialUserPayload): () => void {\n    // @itayankri is concerned about memory consumption, so create a symbol with no description, to avoid assigning memory for the description string\n    // eslint-disable-next-line symbol-description\n    const elevationId = Symbol();\n\n    // Validate that the added permissions are valid UUIDs\n    Object.values(addedPermissions).forEach((entityIds) => {\n      Object.keys(entityIds).forEach((entityId) => {\n        if (!validateUUID(entityId)) {\n          throw new Error(`Entity id on elevatePermissions is not a valid UUID, provided: ${entityId}`);\n        }\n      });\n    });\n\n    const currentUserTrace = getCurrentContext();\n    if (!currentUserTrace) {\n      throw new Error('Cannot find current user cross services trace');\n    }\n\n    const currentElevation = JSON.parse(currentUserTrace.context[ELEVATED_PERMISSIONS_HEADER] || '{}');\n    const newElevation = Object.assign(currentElevation, addedPermissions);\n    this.privateElevatedPermissionsHash.set(elevationId, newElevation);\n    currentUserTrace.context.set(ELEVATED_PERMISSIONS_HEADER, JSON.stringify(this.elevatedPermissions));\n    return () => {\n      this.privateElevatedPermissionsHash.delete(elevationId);\n      currentUserTrace.context.set(ELEVATED_PERMISSIONS_HEADER, JSON.stringify(this.elevatedPermissions));\n    };\n  }\n\n  public async getUserPermissionsLegacy() {\n    if (!this.id) {\n      return undefined;\n    }\n    if (this.privatePermissionsLegacy) {\n      return this.privatePermissionsLegacy;\n    }\n    const { data } = await IdentityNetwork.get(`/api/v1/users/${this.id}/authorization-payload-legacy`);\n\n    this.privatePermissionsLegacy = data;\n    return this.privatePermissionsLegacy;\n  }\n\n  public get permissionsLegacy(): any {\n    if (!this.privatePermissionsLegacy) {\n      throw new Error('Cannot get permissionsLegacy without calling (async) getUserPermissionsLegacy before');\n    }\n    return this.privatePermissionsLegacy;\n  }\n\n  public async getUserAppPermissions(appId, clientSecret) {\n    if (!this.id || !appId || !clientSecret) {\n      return undefined;\n    }\n    const currentAppPermission = this.appPermission[appId];\n\n    if (currentAppPermission) {\n      return currentAppPermission;\n    }\n\n    const cacheKey = `${this.id}:${appId}`;\n\n    const cachedResult = userCache.get<UserPayload>(cacheKey);\n    if (cachedResult) {\n      this.appPermission[appId] = cachedResult;\n      return cachedResult;\n    }\n\n    const { data } = await AutofleetApiNetwork.post<UserPayload>(`/api/v1/apps/${appId}/get-user-payload`, {\n      userId: this.id,\n    }, {\n      headers: {\n        'x-autofleet-apps-secret': clientSecret,\n      },\n    });\n\n    userCache.set(cacheKey, data);\n    this.appPermission[appId] = data;\n    return this.appPermission[appId];\n  }\n}\n","import { AutofleetApiNetwork } from './services';\n\nexport const decodeAppBearer = async (bearer: string, appId: string): Promise<any> => {\n  const { data: decoded } = await AutofleetApiNetwork.post('/api/v1/auth', { bearer, appId });\n  return decoded;\n};\n\nexport const getClientSecret = async (appId: string): Promise<any> => {\n  const { data: secret } = await AutofleetApiNetwork.get(`/api/v1/auth/client-secret/${appId}`);\n  return secret;\n};\n","export default class AppDoesNotExist extends Error {\n  name = 'AppDoesNotExist';\n\n  message = 'app does not exist';\n}\n","export const IDENTITY_MS = 'identity-ms';\nexport const ACCESS_TOKEN = 'accessToken';\nexport const USER_OBJECT = 'userObject';\nexport const USER_TRACING_HEADER = 'x-af-user-id';\nexport const ORIGIN_HEADER = 'X-IAF-ORIGIN-SERVICE';\nexport const USER_PERMISSIONS_HEADER = 'x-af-user-permissions';\nexport const LOWER_CASE_ORIGIN_HEADER = ORIGIN_HEADER.toLowerCase();\nexport const AUTOFLEET_APPS_SECRET_HEADER = 'x-autofleet-apps-secret';\n","import type { IncomingHttpHeaders } from 'node:http';\nimport { getCurrentContext } from '@autofleet/outbreak';\nimport ApiUser, { CONTEXTS_IDS_HEADER, ELEVATED_PERMISSIONS_HEADER, type UserPayload } from './ApiUser';\nimport {\n  IDENTITY_MS,\n  USER_OBJECT,\n  USER_TRACING_HEADER,\n  ORIGIN_HEADER,\n  LOWER_CASE_ORIGIN_HEADER,\n} from './const';\n\nexport type CustomPermissionLoader = (userId: string) => Promise<UserPayload>;\nexport interface AuthFromUserIdHeaderOptions {\n  eagerLoadUserPermissions?: boolean;\n  eagerLoadUserPermissionsLegacy?: boolean;\n  customPermissionLoader?: CustomPermissionLoader;\n}\n\nexport const authFromUserIdHeader = async (options: AuthFromUserIdHeaderOptions, headers: IncomingHttpHeaders): Promise<ApiUser | undefined> => {\n  const originHeader = headers[ORIGIN_HEADER] || headers[LOWER_CASE_ORIGIN_HEADER] || '';\n  if (!Array.isArray(originHeader) && originHeader.toLowerCase() === IDENTITY_MS) {\n    return undefined;\n  }\n  const {\n    eagerLoadUserPermissions,\n    eagerLoadUserPermissionsLegacy,\n    customPermissionLoader,\n  } = options;\n  const userId = headers[USER_TRACING_HEADER] as string;\n  if (!userId || Array.isArray(userId)) {\n    return undefined;\n  }\n\n  const elevatedPermissionsFromHeader = headers[ELEVATED_PERMISSIONS_HEADER]?.length > 0 ? JSON.parse(headers[ELEVATED_PERMISSIONS_HEADER] as string) : {};\n  const contextIds = (headers?.[CONTEXTS_IDS_HEADER] as string)?.split(',');\n\n  const userObject = new ApiUser(userId, 'user', elevatedPermissionsFromHeader, contextIds);\n  if (eagerLoadUserPermissions) {\n    if (customPermissionLoader) {\n      await userObject.useCustomPermissionLoader(customPermissionLoader);\n    } else {\n      await userObject.getUserPermissions();\n    }\n  }\n\n  if (eagerLoadUserPermissionsLegacy) {\n    await userObject.getUserPermissionsLegacy();\n  }\n\n  getCurrentContext().nonHeaderContext?.set(USER_OBJECT, userObject);\n  return userObject;\n};\n","import type { Handler, Request } from 'express';\nimport { getCurrentContext, newTrace, traceTypes } from '@autofleet/outbreak';\nimport jwt from 'jsonwebtoken';\nimport ApiUser, { CONTEXTS_IDS_HEADER } from './ApiUser';\nimport { decodeAppBearer } from '../app-auth';\nimport AppDoesNotExist from '../exceptions/appDoesNotExist';\nimport { decodeBearer, getAuthFromBearer } from '../utils';\nimport {\n  ACCESS_TOKEN,\n  USER_OBJECT,\n  USER_TRACING_HEADER,\n  USER_PERMISSIONS_HEADER,\n  AUTOFLEET_APPS_SECRET_HEADER,\n} from './const';\nimport { authFromUserIdHeader, AuthFromUserIdHeaderOptions } from './common';\n\ndeclare module 'express-serve-static-core' {\n  // eslint-disable-next-line @typescript-eslint/no-shadow\n  interface Request {\n    user: ApiUser;\n  }\n}\n\nexport const middleware = (options: AuthFromUserIdHeaderOptions = {}): Handler => async (req, res, next): Promise<any> => {\n  try {\n    const userObject = await authFromUserIdHeader(options, req.headers);\n    if (userObject) {\n      req.user = userObject;\n      // Added in order to support outbreak.\n      // @ts-expect-error we are setting an object onto the request headers.\n      req.headers[USER_PERMISSIONS_HEADER] = userObject;\n    }\n\n    next();\n  } catch (e) {\n    res.status(401).json({ error: 'cannot authenticate user' });\n  }\n};\n\nexport const middlewareWithDecode = (options: {\n  eagerLoadUserPermissions?: boolean;\n  eagerLoadUserPermissionsLegacy?: boolean;\n  returnErrorIfNoToken?: boolean\n} = {}): Handler => async (req, res, next): Promise<void> => {\n  const {\n    eagerLoadUserPermissions,\n    eagerLoadUserPermissionsLegacy,\n    returnErrorIfNoToken,\n  } = options;\n  let decoded;\n  if (req.headers.authorization) {\n    try {\n      decoded = await decodeBearer(req.headers.authorization);\n    } catch (e) {\n      if (e instanceof jwt.TokenExpiredError) {\n        res.status(401).json({ errors: ['Access token expired'] });\n      } else if (e instanceof jwt.JsonWebTokenError) {\n        res.status(400).json({ errors: [e.message] });\n      } else {\n        res.status(500).json({ errors: ['Server error while parsing token'] });\n      }\n      return;\n    }\n    const userId = decoded?.user?.id;\n\n    if (userId) {\n      req.headers[USER_TRACING_HEADER] = userId;\n    }\n\n    const contextIds = (req.headers?.[CONTEXTS_IDS_HEADER] as string)?.split(',');\n    const userObject = new ApiUser(userId, decoded?.user?.accountType, undefined, contextIds);\n\n    if (eagerLoadUserPermissions || eagerLoadUserPermissionsLegacy) {\n      await Promise.all([\n        eagerLoadUserPermissions && userObject.getUserPermissions(),\n        eagerLoadUserPermissionsLegacy && userObject.getUserPermissionsLegacy(),\n      ]);\n    }\n\n    req.user = userObject;\n    getCurrentContext().nonHeaderContext?.set(USER_OBJECT, userObject);\n\n    // Added in order to support outbreak.\n    // @ts-expect-error we are setting an object onto the request headers.\n    req.headers[USER_PERMISSIONS_HEADER] = userObject;\n  } else if (returnErrorIfNoToken) {\n    res.status(401).json({ errors: ['No token provided'] });\n    return;\n  }\n  next();\n};\n\nexport const appMiddleware = (options: {\n  appId: string,\n  clientSecret: string\n}): Handler => async (req, res, next): Promise<void> => {\n  const {\n    appId,\n    clientSecret,\n  } = options;\n  let decoded;\n\n  if (!req.headers.authorization) {\n    res.status(401).json({ errors: ['No token provided'] });\n    return;\n  }\n\n  try {\n    decoded = await decodeAppBearer(req.headers.authorization, appId);\n    if (!decoded) {\n      throw new AppDoesNotExist();\n    }\n  } catch (e) {\n    if (e instanceof jwt.TokenExpiredError) {\n      res.status(401).json({ errors: ['Access token expired'] });\n      return;\n    }\n    if ([jwt.JsonWebTokenError, AppDoesNotExist].some((Err) => e instanceof Err)) {\n      res.status(400).json({ errors: [e.message] });\n      return;\n    }\n    res.status(500).json({ errors: ['Server error while parsing token'] });\n    return;\n  }\n  const userId = decoded?.userId;\n  if (userId) {\n    req.headers[USER_TRACING_HEADER] = userId;\n  }\n\n  const userObject = new ApiUser(userId);\n\n  if (appId) {\n    req.headers[AUTOFLEET_APPS_SECRET_HEADER] = clientSecret;\n    // Won't work until we find a better solution for identity ms\n    await userObject.getUserAppPermissions(appId, clientSecret);\n  }\n\n  req.user = userObject;\n  const currentTraceContext = getCurrentContext().nonHeaderContext;\n  currentTraceContext?.set(USER_OBJECT, userObject);\n  currentTraceContext?.set(ACCESS_TOKEN, getAuthFromBearer(req.headers.authorization));\n\n  // Added in order to support outbreak.\n  // @ts-expect-error we are setting an object onto the request headers.\n  req.headers[USER_PERMISSIONS_HEADER] = userObject;\n\n  next();\n};\n\nexport const eagerLoadPermissionsMiddleware: Handler = async (req, res, next) => {\n  await req.user.getUserPermissions();\n  next();\n};\n\nexport const getDecodedBearer = (req: Request) => {\n  if (!req.headers.authorization) {\n    return null;\n  }\n  return decodeBearer(req.headers.authorization);\n};\n\nexport const createOrSetRabbitTrace = async (trace: ReturnType<typeof newTrace> | undefined, userId: string | undefined) => {\n  const userObject = new ApiUser(userId);\n\n  await userObject.getUserPermissions();\n  // eslint-disable-next-line no-param-reassign\n  trace ??= newTrace(traceTypes.RABBIT);\n  trace.nonHeaderContext.set(USER_OBJECT, userObject);\n};\n\nexport default ApiUser;\n","import type { FastifyPluginCallback } from 'fastify';\nimport type ApiUser from './ApiUser';\nimport { AuthFromUserIdHeaderOptions, authFromUserIdHeader } from './common';\n\ndeclare module 'fastify' {\n  interface FastifyRequest {\n    user?: ApiUser;\n  }\n}\n\n// eslint-disable-next-line import/prefer-default-export\nexport const authFromUserIdHeaderPlugin: FastifyPluginCallback<AuthFromUserIdHeaderOptions> = (fastify, options, done) => {\n  fastify.addHook('onRequest', async (request, reply) => {\n    try {\n      const user = await authFromUserIdHeader(options, request.headers);\n      if (user) {\n        fastify.decorateRequest('user', user);\n      }\n    } catch (e) {\n      reply.status(401).send({ error: 'cannot authenticate user' });\n    }\n  });\n\n  done();\n};\nauthFromUserIdHeaderPlugin[Symbol.for('skip-override')] = true; // Prevent Fastify from overriding the plugin\n","import { getCurrentContext } from '@autofleet/outbreak';\nimport { USER_OBJECT } from './user/const';\nimport ApiUser, { type UserPayload } from './user/ApiUser';\n\nexport const getUser = () : ApiUser | undefined => getCurrentContext().nonHeaderContext?.get(USER_OBJECT) as ApiUser | undefined;\n\nexport const isUserExist = () => getUser()?.id;\n\nconst checkUserPermissions = (\n  entityId: string,\n  entityType: Exclude<keyof UserPayload, 'accountType' | 'createdAt'>,\n) => !isUserExist() || Object.hasOwn(getUser()!.permissions[entityType], entityId);\n\nexport const checkFleetPermission = (fleetId: string) => checkUserPermissions(fleetId, 'fleets');\nexport const checkBusinessModelPermission = (businessModelId: string) => checkUserPermissions(businessModelId, 'businessModels');\nexport const checkDemandSourcePermission = (demandSourceId: string) => checkUserPermissions(demandSourceId, 'demandSources');\n","import type ApiUser from './user';\n\n// eslint-disable-next-line import/prefer-default-export\nexport class UnauthorizedAccessError extends Error {\n  constructor(public user: ApiUser | null = null, message = 'UnauthorizedAccessError') {\n    super(message);\n    this.name = 'UnauthorizedAccessError';\n  }\n}\n","import * as jwt from 'jsonwebtoken';\n\nexport const AUTHORIZATION_METHODS = {\n  NONE: 'NONE',\n  BASIC: 'BASIC',\n  JWT: 'JWT',\n};\n\nconst AUTHORIZATION_ACTIONS = {\n  [AUTHORIZATION_METHODS.NONE]: () => undefined,\n  [AUTHORIZATION_METHODS.BASIC]: (authorizationSettings: any) => {\n    const { username, password } = authorizationSettings;\n    const encodedCredentials = Buffer.from(`${username}:${password}`).toString('base64');\n    return `Basic ${encodedCredentials}`;\n  },\n  [AUTHORIZATION_METHODS.JWT]: (authorizationSettings: any) => {\n    const { secret } = authorizationSettings;\n    if (secret) {\n      return `Bearer ${jwt.sign({}, secret, { expiresIn: 10 })}`;\n    }\n    return undefined;\n  },\n};\n\nexport const getAuthorizationHeader = (authorizationSettings: { method: string } | undefined): string | undefined => {\n  const authorizationMethod = authorizationSettings?.method;\n\n  if (!authorizationMethod || !AUTHORIZATION_ACTIONS[authorizationMethod]) {\n    return undefined;\n  }\n\n  return AUTHORIZATION_ACTIONS[authorizationMethod](authorizationSettings);\n};\n","import type { LoggerInstanceManager } from '@autofleet/logger';\nimport * as outbreak from '@autofleet/outbreak';\nimport User, {\n  middleware,\n  eagerLoadPermissionsMiddleware,\n  middlewareWithDecode,\n  getDecodedBearer,\n  appMiddleware,\n  createOrSetRabbitTrace,\n} from './user';\nimport { authFromUserIdHeaderPlugin } from './user/fastify';\nimport { type UserPayload, CONTEXTS_IDS_HEADER } from './user/ApiUser';\nimport {\n  checkFleetPermission,\n  checkBusinessModelPermission,\n  checkDemandSourcePermission,\n  isUserExist,\n  getUser,\n} from './check-permission';\nimport { UnauthorizedAccessError } from './errors';\nimport { getRefreshTokenSecret, getTokenSecret } from './secret-getter';\nimport { AUTHORIZATION_METHODS, getAuthorizationHeader } from './authorization';\n\nconst getCurrentPayload = outbreak.getCurrentContext;\n\ntype OutbreakOptions = Parameters<typeof outbreak.default>[0];\ntype LoggerWithContextMiddleware = Partial<Pick<LoggerInstanceManager, 'addContextMiddleware'>>;\nconst enableTracing = ({ outbreakOptions = {}, logger }: { outbreakOptions?: OutbreakOptions, logger?: LoggerWithContextMiddleware } = {}): void => {\n  outbreak.default({\n    headersPrefix: 'x-af',\n    contextMiddlewareGetter: logger?.addContextMiddleware,\n    ...outbreakOptions,\n  });\n};\n\nconst { traceTypes, newTrace } = outbreak;\n\nexport {\n  traceTypes,\n  newTrace,\n  enableTracing,\n  User,\n  middleware,\n  middlewareWithDecode,\n  eagerLoadPermissionsMiddleware,\n  getCurrentPayload,\n  getDecodedBearer,\n  checkFleetPermission,\n  checkBusinessModelPermission,\n  checkDemandSourcePermission,\n  isUserExist,\n  getUser,\n  getRefreshTokenSecret,\n  getTokenSecret,\n  UnauthorizedAccessError,\n  appMiddleware,\n  createOrSetRabbitTrace,\n  outbreak,\n  AUTHORIZATION_METHODS,\n  getAuthorizationHeader,\n  type UserPayload,\n  CONTEXTS_IDS_HEADER,\n  authFromUserIdHeaderPlugin,\n};\n\nexport default {\n  traceTypes,\n  newTrace,\n  User,\n  middleware,\n  middlewareWithDecode,\n  eagerLoadPermissionsMiddleware,\n  getCurrentPayload,\n  getDecodedBearer,\n  checkFleetPermission,\n  checkBusinessModelPermission,\n  checkDemandSourcePermission,\n  isUserExist,\n  getUser,\n  UnauthorizedAccessError,\n  appMiddleware,\n  createOrSetRabbitTrace,\n  outbreak,\n  AUTHORIZATION_METHODS,\n  getAuthorizationHeader,\n  CONTEXTS_IDS_HEADER,\n  authFromUserIdHeaderPlugin,\n};\n"]}

package/lib/index.d.cts

@@ -1,3 +1,7 @@
+import * as fastify from 'fastify';
+import { FastifyPluginCallback } from 'fastify';
+import * as express from 'express';
+import { Handler, Request } from 'express';
 import { LoggerInstanceManager } from '@autofleet/logger';
 import * as outbreak from '@autofleet/outbreak';
 import { newTrace as newTrace$1 } from '@autofleet/outbreak';
@@ -25,7 +29,6 @@ interface PartialUserPayload {
     drivers?: EntityPermissions;
     businessAccounts?: EntityPermissions;
 }
-type CustomPermissionLoader = (string: any) => Promise<UserPayload>;
 declare class ApiUser {
     id?: string;
     accountType?: AccountType;
@@ -37,7 +40,7 @@ declare class ApiUser {
     readonly emptyUser: boolean;
     constructor(id?: string, accountType?: AccountType, elevatedPermissions?: PartialUserPayload, contextIds?: string[]);
     getUserPermissions(): Promise<UserPayload>;
-    useCustomPermissionLoader(customPermissionLoader: any): Promise<UserPayload>;
+    useCustomPermissionLoader(customPermissionLoader: (userId: string) => UserPayload | PromiseLike<UserPayload>): Promise<UserPayload>;
     get businessModels(): string[] | undefined;
     get fleets(): string[] | undefined;
     get demandSources(): string[] | undefined;
@@ -50,24 +53,39 @@ declare class ApiUser {
     getUserAppPermissions(appId: any, clientSecret: any): Promise<any>;
 }
 
-declare const middleware: (options?: {
+type CustomPermissionLoader = (userId: string) => Promise<UserPayload>;
+interface AuthFromUserIdHeaderOptions {
     eagerLoadUserPermissions?: boolean;
     eagerLoadUserPermissionsLegacy?: boolean;
     customPermissionLoader?: CustomPermissionLoader;
-}) => (req: any, res: any, next: any) => Promise<any>;
+}
+
+declare module 'express-serve-static-core' {
+    interface Request {
+        user: ApiUser;
+    }
+}
+declare const middleware: (options?: AuthFromUserIdHeaderOptions) => Handler;
 declare const middlewareWithDecode: (options?: {
     eagerLoadUserPermissions?: boolean;
     eagerLoadUserPermissionsLegacy?: boolean;
     returnErrorIfNoToken?: boolean;
-}) => (req: any, res: any, next: any) => Promise<void>;
+}) => Handler;
 declare const appMiddleware: (options: {
     appId: string;
     clientSecret: string;
-}) => (req: any, res: any, next: any) => Promise<void>;
-declare const eagerLoadPermissionsMiddleware: (req: any, res: any, next: any) => Promise<any>;
-declare const getDecodedBearer: (req: any) => any;
+}) => Handler;
+declare const eagerLoadPermissionsMiddleware: Handler;
+declare const getDecodedBearer: (req: Request) => any;
 declare const createOrSetRabbitTrace: (trace: ReturnType<typeof newTrace$1> | undefined, userId: string | undefined) => Promise<void>;
 
+declare module 'fastify' {
+    interface FastifyRequest {
+        user?: ApiUser;
+    }
+}
+declare const authFromUserIdHeaderPlugin: FastifyPluginCallback<AuthFromUserIdHeaderOptions>;
+
 declare const getUser: () => ApiUser | undefined;
 declare const isUserExist: () => string;
 declare const checkFleetPermission: (fleetId: string) => boolean;
@@ -130,40 +148,31 @@ declare const _default: {
         readonly nonHeaderContext: Map<string, unknown>;
     };
     User: typeof ApiUser;
-    middleware: (options?: {
-        eagerLoadUserPermissions?: boolean;
-        eagerLoadUserPermissionsLegacy?: boolean;
-        customPermissionLoader?: CustomPermissionLoader;
-    }) => (req: any, res: any, next: any) => Promise<any>;
+    middleware: (options?: AuthFromUserIdHeaderOptions) => express.Handler;
     middlewareWithDecode: (options?: {
         eagerLoadUserPermissions?: boolean;
         eagerLoadUserPermissionsLegacy?: boolean;
         returnErrorIfNoToken?: boolean;
-    }) => (req: any, res: any, next: any) => Promise<void>;
-    eagerLoadPermissionsMiddleware: (req: any, res: any, next: any) => Promise<any>;
+    }) => express.Handler;
+    eagerLoadPermissionsMiddleware: express.Handler;
     getCurrentPayload: () => {
         type: "httpRequest" | "webSocket" | "rabbit" | "bull";
         readonly id: `${string}-${string}-${string}-${string}-${string}`;
         readonly context: Map<string, unknown>;
         readonly nonHeaderContext: Map<string, unknown>;
     } | Record<string, never>;
-    getDecodedBearer: (req: any) => any;
+    getDecodedBearer: (req: express.Request) => any;
     checkFleetPermission: (fleetId: string) => boolean;
     checkBusinessModelPermission: (businessModelId: string) => boolean;
     checkDemandSourcePermission: (demandSourceId: string) => boolean;
     isUserExist: () => string;
-    getUser: () => ApiUser;
+    getUser: () => ApiUser | undefined;
     UnauthorizedAccessError: typeof UnauthorizedAccessError;
     appMiddleware: (options: {
         appId: string;
         clientSecret: string;
-    }) => (req: any, res: any, next: any) => Promise<void>;
-    createOrSetRabbitTrace: (trace: {
-        type: "httpRequest" | "webSocket" | "rabbit" | "bull";
-        readonly id: `${string}-${string}-${string}-${string}-${string}`;
-        readonly context: Map<string, unknown>;
-        readonly nonHeaderContext: Map<string, unknown>;
-    }, userId: string) => Promise<void>;
+    }) => express.Handler;
+    createOrSetRabbitTrace: (trace: ReturnType<typeof outbreak.newTrace> | undefined, userId: string | undefined) => Promise<void>;
     outbreak: typeof outbreak;
     AUTHORIZATION_METHODS: {
         NONE: string;
@@ -172,8 +181,9 @@ declare const _default: {
     };
     getAuthorizationHeader: (authorizationSettings: {
         method: string;
-    }) => string;
+    } | undefined) => string | undefined;
     CONTEXTS_IDS_HEADER: string;
+    authFromUserIdHeaderPlugin: fastify.FastifyPluginCallback<AuthFromUserIdHeaderOptions>;
 };
 
-export { AUTHORIZATION_METHODS, CONTEXTS_IDS_HEADER, UnauthorizedAccessError, ApiUser as User, type UserPayload, appMiddleware, checkBusinessModelPermission, checkDemandSourcePermission, checkFleetPermission, createOrSetRabbitTrace, _default as default, eagerLoadPermissionsMiddleware, enableTracing, getAuthorizationHeader, getCurrentPayload, getDecodedBearer, getRefreshTokenSecret, getTokenSecret, getUser, isUserExist, middleware, middlewareWithDecode, newTrace, traceTypes };
+export { AUTHORIZATION_METHODS, CONTEXTS_IDS_HEADER, UnauthorizedAccessError, ApiUser as User, type UserPayload, appMiddleware, authFromUserIdHeaderPlugin, checkBusinessModelPermission, checkDemandSourcePermission, checkFleetPermission, createOrSetRabbitTrace, _default as default, eagerLoadPermissionsMiddleware, enableTracing, getAuthorizationHeader, getCurrentPayload, getDecodedBearer, getRefreshTokenSecret, getTokenSecret, getUser, isUserExist, middleware, middlewareWithDecode, newTrace, traceTypes };

package/lib/index.d.ts

@@ -1,3 +1,7 @@
+import * as fastify from 'fastify';
+import { FastifyPluginCallback } from 'fastify';
+import * as express from 'express';
+import { Handler, Request } from 'express';
 import { LoggerInstanceManager } from '@autofleet/logger';
 import * as outbreak from '@autofleet/outbreak';
 import { newTrace as newTrace$1 } from '@autofleet/outbreak';
@@ -25,7 +29,6 @@ interface PartialUserPayload {
     drivers?: EntityPermissions;
     businessAccounts?: EntityPermissions;
 }
-type CustomPermissionLoader = (string: any) => Promise<UserPayload>;
 declare class ApiUser {
     id?: string;
     accountType?: AccountType;
@@ -37,7 +40,7 @@ declare class ApiUser {
     readonly emptyUser: boolean;
     constructor(id?: string, accountType?: AccountType, elevatedPermissions?: PartialUserPayload, contextIds?: string[]);
     getUserPermissions(): Promise<UserPayload>;
-    useCustomPermissionLoader(customPermissionLoader: any): Promise<UserPayload>;
+    useCustomPermissionLoader(customPermissionLoader: (userId: string) => UserPayload | PromiseLike<UserPayload>): Promise<UserPayload>;
     get businessModels(): string[] | undefined;
     get fleets(): string[] | undefined;
     get demandSources(): string[] | undefined;
@@ -50,24 +53,39 @@ declare class ApiUser {
     getUserAppPermissions(appId: any, clientSecret: any): Promise<any>;
 }
 
-declare const middleware: (options?: {
+type CustomPermissionLoader = (userId: string) => Promise<UserPayload>;
+interface AuthFromUserIdHeaderOptions {
     eagerLoadUserPermissions?: boolean;
     eagerLoadUserPermissionsLegacy?: boolean;
     customPermissionLoader?: CustomPermissionLoader;
-}) => (req: any, res: any, next: any) => Promise<any>;
+}
+
+declare module 'express-serve-static-core' {
+    interface Request {
+        user: ApiUser;
+    }
+}
+declare const middleware: (options?: AuthFromUserIdHeaderOptions) => Handler;
 declare const middlewareWithDecode: (options?: {
     eagerLoadUserPermissions?: boolean;
     eagerLoadUserPermissionsLegacy?: boolean;
     returnErrorIfNoToken?: boolean;
-}) => (req: any, res: any, next: any) => Promise<void>;
+}) => Handler;
 declare const appMiddleware: (options: {
     appId: string;
     clientSecret: string;
-}) => (req: any, res: any, next: any) => Promise<void>;
-declare const eagerLoadPermissionsMiddleware: (req: any, res: any, next: any) => Promise<any>;
-declare const getDecodedBearer: (req: any) => any;
+}) => Handler;
+declare const eagerLoadPermissionsMiddleware: Handler;
+declare const getDecodedBearer: (req: Request) => any;
 declare const createOrSetRabbitTrace: (trace: ReturnType<typeof newTrace$1> | undefined, userId: string | undefined) => Promise<void>;
 
+declare module 'fastify' {
+    interface FastifyRequest {
+        user?: ApiUser;
+    }
+}
+declare const authFromUserIdHeaderPlugin: FastifyPluginCallback<AuthFromUserIdHeaderOptions>;
+
 declare const getUser: () => ApiUser | undefined;
 declare const isUserExist: () => string;
 declare const checkFleetPermission: (fleetId: string) => boolean;
@@ -130,40 +148,31 @@ declare const _default: {
         readonly nonHeaderContext: Map<string, unknown>;
     };
     User: typeof ApiUser;
-    middleware: (options?: {
-        eagerLoadUserPermissions?: boolean;
-        eagerLoadUserPermissionsLegacy?: boolean;
-        customPermissionLoader?: CustomPermissionLoader;
-    }) => (req: any, res: any, next: any) => Promise<any>;
+    middleware: (options?: AuthFromUserIdHeaderOptions) => express.Handler;
     middlewareWithDecode: (options?: {
         eagerLoadUserPermissions?: boolean;
         eagerLoadUserPermissionsLegacy?: boolean;
         returnErrorIfNoToken?: boolean;
-    }) => (req: any, res: any, next: any) => Promise<void>;
-    eagerLoadPermissionsMiddleware: (req: any, res: any, next: any) => Promise<any>;
+    }) => express.Handler;
+    eagerLoadPermissionsMiddleware: express.Handler;
     getCurrentPayload: () => {
         type: "httpRequest" | "webSocket" | "rabbit" | "bull";
         readonly id: `${string}-${string}-${string}-${string}-${string}`;
         readonly context: Map<string, unknown>;
         readonly nonHeaderContext: Map<string, unknown>;
     } | Record<string, never>;
-    getDecodedBearer: (req: any) => any;
+    getDecodedBearer: (req: express.Request) => any;
     checkFleetPermission: (fleetId: string) => boolean;
     checkBusinessModelPermission: (businessModelId: string) => boolean;
     checkDemandSourcePermission: (demandSourceId: string) => boolean;
     isUserExist: () => string;
-    getUser: () => ApiUser;
+    getUser: () => ApiUser | undefined;
     UnauthorizedAccessError: typeof UnauthorizedAccessError;
     appMiddleware: (options: {
         appId: string;
         clientSecret: string;
-    }) => (req: any, res: any, next: any) => Promise<void>;
-    createOrSetRabbitTrace: (trace: {
-        type: "httpRequest" | "webSocket" | "rabbit" | "bull";
-        readonly id: `${string}-${string}-${string}-${string}-${string}`;
-        readonly context: Map<string, unknown>;
-        readonly nonHeaderContext: Map<string, unknown>;
-    }, userId: string) => Promise<void>;
+    }) => express.Handler;
+    createOrSetRabbitTrace: (trace: ReturnType<typeof outbreak.newTrace> | undefined, userId: string | undefined) => Promise<void>;
     outbreak: typeof outbreak;
     AUTHORIZATION_METHODS: {
         NONE: string;
@@ -172,8 +181,9 @@ declare const _default: {
     };
     getAuthorizationHeader: (authorizationSettings: {
         method: string;
-    }) => string;
+    } | undefined) => string | undefined;
     CONTEXTS_IDS_HEADER: string;
+    authFromUserIdHeaderPlugin: fastify.FastifyPluginCallback<AuthFromUserIdHeaderOptions>;
 };
 
-export { AUTHORIZATION_METHODS, CONTEXTS_IDS_HEADER, UnauthorizedAccessError, ApiUser as User, type UserPayload, appMiddleware, checkBusinessModelPermission, checkDemandSourcePermission, checkFleetPermission, createOrSetRabbitTrace, _default as default, eagerLoadPermissionsMiddleware, enableTracing, getAuthorizationHeader, getCurrentPayload, getDecodedBearer, getRefreshTokenSecret, getTokenSecret, getUser, isUserExist, middleware, middlewareWithDecode, newTrace, traceTypes };
+export { AUTHORIZATION_METHODS, CONTEXTS_IDS_HEADER, UnauthorizedAccessError, ApiUser as User, type UserPayload, appMiddleware, authFromUserIdHeaderPlugin, checkBusinessModelPermission, checkDemandSourcePermission, checkFleetPermission, createOrSetRabbitTrace, _default as default, eagerLoadPermissionsMiddleware, enableTracing, getAuthorizationHeader, getCurrentPayload, getDecodedBearer, getRefreshTokenSecret, getTokenSecret, getUser, isUserExist, middleware, middlewareWithDecode, newTrace, traceTypes };

package/lib/index.js

@@ -1,3 +1,3 @@
-import*as y from'@autofleet/outbreak';import {getCurrentContext,newTrace,traceTypes}from'@autofleet/outbreak';export{y as outbreak };import*as re from'jsonwebtoken';import re__default,{TokenExpiredError,JsonWebTokenError}from'jsonwebtoken';import le from'node-cache';import ge from'object-hash';import S from'moment';import D from'@autofleet/network';var {DEPRECATED_JWT_SECRET:ie,JWT_NEW_SECRET:oe,DEPRECATED_REFRESH_JWT_SECRET:ne,REFRESH_JWT_SECRET:ae,DEPRECATION_UNIX_TIMESTAMP:ce}=process.env,_=(t,e,s)=>{let r=S(parseInt(ce,10)*1e3);try{let i;if(t){let{iat:o}=re__default.decode(t);i=S(o*1e3);}else i=S();return i.isBefore(r)?e:s}catch{return s}},de=t=>_(t,ne,ae),A=t=>_(t,ie,oe);var I=t=>t.replace("Bearer ",""),C=(t,e)=>{let s=I(t);return re.verify(s,A(s))};var ue="00000000-0000-0000-0000-000000000000",me="ffffffff-ffff-ffff-ffff-ffffffffffff",E="[0-9a-f]",pe="[1-8]",fe=new RegExp(`^(?:${E}{8}-${E}{4}-${pe}${E}{3}-[89ab]${E}{3}-${E}{12}|${ue}|${me})$`,"i");function L(t){return typeof t=="string"&&fe.test(t)}var M=10,k=process.env.API_GATEWAY_URL||"https://api.autofleet.io",b=new D({serviceName:"IDENTITY_MS",retries:3,retryCondition:()=>true,cache:process.env.NODE_ENV!=="test"?{maxAge:M*1e3}:undefined}),w=new D({baseURL:k,serviceUrl:k,retries:3,retryCondition:()=>true,cache:process.env.NODE_ENV!=="test"?{maxAge:M*1e3}:undefined});var g="x-af-elevated-permissions",U="x-af-context-ids",l=new le({stdTTL:10}),H=(t,e)=>{let s={...t,fleets:{...t?.fleets},businessModels:{...t?.businessModels},demandSources:{...t?.demandSources}};for(let r of e)Object.keys(r).forEach(i=>{s[i]??={},Object.entries(r[i]).forEach(([o,n])=>{s[i][o]=(s[i][o]||[]).concat(n);});});return s},m=class{constructor(e,s,r,i){this.id=e;this.accountType=s;this.contextIds=i;this.privateElevatedPermissionsHash=new Map;this.appPermission={};this.emptyUser=!!e,r&&this.privateElevatedPermissionsHash.set(Symbol("initial"),r);}async getUserPermissions(){if(!this.id)return;if(this.privatePermissions)return this.privatePermissions;let e=ge({id:this.id,contextIds:this.contextIds}),s=l.get(e);return s||({data:s}=await b.get(`/api/v1/users/${this.id}/authorization-payload`,{params:{contextIds:this.contextIds}}),l.set(e,s)),this.accountType=s.accountType,this.privatePermissions=s,this.privatePermissions}async useCustomPermissionLoader(e){if(!this.id)return;if(this.privatePermissions)return this.privatePermissions;let s=this.id,r=l.get(s);if(r)return this.privatePermissions=r,r;let i=await e(this.id);return l.set(s,i),this.privatePermissions=i,this.privatePermissions}get businessModels(){return this.getUserProperty("businessModels")}get fleets(){return this.getUserProperty("fleets")}get demandSources(){return this.getUserProperty("demandSources")}getUserProperty(e){if(!this.privatePermissions)throw new Error(`Cannot get ${e} without calling (async) getUserPermissions before`);return Object.keys(this.privatePermissions[e]||{})}get elevatedPermissions(){return H(undefined,this.privateElevatedPermissionsHash.values())}get permissions(){if(!this.privatePermissions)throw new Error("Cannot get permissions without calling (async) getUserPermissions before");return H(this.privatePermissions,this.privateElevatedPermissionsHash.values())}elevatePermissions(e){let s=Symbol();Object.values(e).forEach(n=>{Object.keys(n).forEach(a=>{if(!L(a))throw new Error(`Entity id on elevatePermissions is not a valid UUID, provided: ${a}`)});});let r=getCurrentContext();if(!r)throw new Error("Cannot find current user cross services trace");let i=JSON.parse(r.context[g]||"{}"),o=Object.assign(i,e);return this.privateElevatedPermissionsHash.set(s,o),r.context.set(g,JSON.stringify(this.elevatedPermissions)),()=>{this.privateElevatedPermissionsHash.delete(s),r.context.set(g,JSON.stringify(this.elevatedPermissions));}}async getUserPermissionsLegacy(){if(!this.id)return;if(this.privatePermissionsLegacy)return this.privatePermissionsLegacy;let{data:e}=await b.get(`/api/v1/users/${this.id}/authorization-payload-legacy`);return this.privatePermissionsLegacy=e,this.privatePermissionsLegacy}get permissionsLegacy(){if(!this.privatePermissionsLegacy)throw new Error("Cannot get permissionsLegacy without calling (async) getUserPermissionsLegacy before");return this.privatePermissionsLegacy}async getUserAppPermissions(e,s){if(!this.id||!e||!s)return;let r=this.appPermission[e];if(r)return r;let i=`${this.id}:${e}`,o=l.get(i);if(o)return this.appPermission[e]=o,o;let{data:n}=await w.post(`/api/v1/apps/${e}/get-user-payload`,{userId:this.id},{headers:{"x-autofleet-apps-secret":s}});return l.set(i,n),this.appPermission[e]=n,this.appPermission[e]}};var j=async(t,e)=>{let{data:s}=await w.post("/api/v1/auth",{bearer:t,appId:e});return s};var P=class extends Error{constructor(){super(...arguments);this.name="AppDoesNotExist";this.message="app does not exist";}};var Ee="identity-ms",Ue="accessToken",p="userObject",W="x-af-user-id",J="X-IAF-ORIGIN-SERVICE",R="x-af-user-permissions",xe=J.toLowerCase(),z=(t={})=>async(e,s,r)=>{try{if((e.headers[J]||e.headers[xe]||"").toLowerCase()===Ee)return r();let{eagerLoadUserPermissions:o,eagerLoadUserPermissionsLegacy:n,customPermissionLoader:a}=t,d=e.headers[W];if(!d)return r();let f=e.headers[g]?.length>0?JSON.parse(e.headers[g]):{},u=e.headers?.[U]?.split(","),c=new m(d,"user",f,u);return o&&(a?await c.useCustomPermissionLoader(a):await c.getUserPermissions()),n&&await c.getUserPermissionsLegacy(),e.user=c,getCurrentContext().nonHeaderContext?.set(p,c),e.headers[R]=c,r()}catch{return s.status(401),s.json({error:"cannot authenticate user"})}},F=(t={})=>async(e,s,r)=>{let{eagerLoadUserPermissions:i,eagerLoadUserPermissionsLegacy:o,returnErrorIfNoToken:n}=t,a;if(e.headers.authorization){try{a=await C(e.headers.authorization);}catch(c){c instanceof TokenExpiredError?(s.status(401),s.json({errors:["Access token expired"]})):c instanceof JsonWebTokenError?(s.status(400),s.json({errors:[c.message]})):(s.status(500),s.json({errors:["Server error while parsing token"]}));return}let d=a?.user?.id;d&&(e.headers[W]=d);let f=e.headers?.[U]?.split(","),u=new m(d,a?.user?.accountType,undefined,f);i&&await u.getUserPermissions(),o&&await u.getUserPermissionsLegacy(),e.user=u,getCurrentContext().nonHeaderContext?.set(p,u),e.headers[R]=u;}else if(n)return s.status(401),s.json({errors:["No token provided"]});return r()},G=t=>async(e,s,r)=>{let{appId:i,clientSecret:o}=t,n;if(!e.headers.authorization)return s.status(401),s.json({errors:["No token provided"]});try{if(n=await j(e.headers.authorization,i),!n)throw new P}catch(u){return u instanceof TokenExpiredError?s.status(401).json({errors:["Access token expired"]}):[JsonWebTokenError,P].some(c=>u instanceof c)?s.status(400).json({errors:[u.message]}):s.status(500).json({errors:["Server error while parsing token"]})}let a=n?.userId;a&&(e.headers[p]=a);let d=new m(a);i&&(e.headers["x-autofleet-apps-secret"]=o,await d.getUserAppPermissions(i,o)),e.user=d;let f=getCurrentContext().nonHeaderContext;return f?.set(p,d),f?.set(Ue,I(e.headers.authorization)),e.headers[R]=d,r()},X=async(t,e,s)=>(await t.user.getUserPermissions(),s()),V=t=>t.headers.authorization?C(t.headers.authorization):null,K=async(t,e)=>{let s=new m(e);await s.getUserPermissions(),t??=newTrace(traceTypes.RABBIT),t.nonHeaderContext.set(p,s);},Y=m;var h=()=>getCurrentContext().nonHeaderContext?.get(p),x=()=>h()?.id,Z=t=>!x()||Object.keys(h().permissions.fleets).includes(t),Q=t=>!x()||Object.keys(h().permissions.businessModels).includes(t),q=t=>!x()||Object.keys(h().permissions.demandSources).includes(t);var T=class extends Error{constructor(s=null,r="UnauthorizedAccessError"){super(r);this.user=s;this.name="UnauthorizedAccessError";}};var v={NONE:"NONE",BASIC:"BASIC",JWT:"JWT"},ee={[v.NONE]:()=>{},[v.BASIC]:t=>{let{username:e,password:s}=t;return `Basic ${Buffer.from(`${e}:${s}`).toString("base64")}`},[v.JWT]:t=>{let{secret:e}=t;if(e)return `Bearer ${re.sign({},e,{expiresIn:10})}`}},te=t=>{let e=t?.method;if(!(!e||!ee[e]))return ee[e](t)};var we=y.getCurrentContext,as=({outbreakOptions:t={},logger:e}={})=>{y.default({headersPrefix:"x-af",contextMiddlewareGetter:e?.addContextMiddleware,...t});},{traceTypes:Te,newTrace:Se}=y;var cs={traceTypes:Te,newTrace:Se,User:Y,middleware:z,middlewareWithDecode:F,eagerLoadPermissionsMiddleware:X,getCurrentPayload:we,getDecodedBearer:V,checkFleetPermission:Z,checkBusinessModelPermission:Q,checkDemandSourcePermission:q,isUserExist:x,getUser:h,UnauthorizedAccessError:T,appMiddleware:G,createOrSetRabbitTrace:K,outbreak:y,AUTHORIZATION_METHODS:v,getAuthorizationHeader:te,CONTEXTS_IDS_HEADER:U};
-export{v as AUTHORIZATION_METHODS,U as CONTEXTS_IDS_HEADER,T as UnauthorizedAccessError,Y as User,G as appMiddleware,Q as checkBusinessModelPermission,q as checkDemandSourcePermission,Z as checkFleetPermission,K as createOrSetRabbitTrace,cs as default,X as eagerLoadPermissionsMiddleware,as as enableTracing,te as getAuthorizationHeader,we as getCurrentPayload,V as getDecodedBearer,de as getRefreshTokenSecret,A as getTokenSecret,h as getUser,x as isUserExist,z as middleware,F as middlewareWithDecode,Se as newTrace,Te as traceTypes};//# sourceMappingURL=index.js.map
+import*as g from'@autofleet/outbreak';import {getCurrentContext,newTrace,traceTypes}from'@autofleet/outbreak';export{g as outbreak };import*as S from'jsonwebtoken';import S__default from'jsonwebtoken';import Ue from'node-cache';import xe from'object-hash';import b from'moment';import B from'@autofleet/network';var {DEPRECATED_JWT_SECRET:ue,JWT_NEW_SECRET:pe,DEPRECATED_REFRESH_JWT_SECRET:me,REFRESH_JWT_SECRET:fe,DEPRECATION_UNIX_TIMESTAMP:le}=process.env,k=(s,e,r)=>{let o=b(parseInt(le,10)*1e3);try{let t;if(s){let{iat:i}=S__default.decode(s);t=b(i*1e3);}else t=b();return t.isBefore(o)?e:r}catch{return r}},Ee=s=>k(s,me,fe),C=s=>k(s,ue,pe);var w=s=>s.replace("Bearer ",""),_=(s,e)=>{let r=w(s);return S.verify(r,C(r))};var Pe="00000000-0000-0000-0000-000000000000",ge="ffffffff-ffff-ffff-ffff-ffffffffffff",h="[0-9a-f]",ye="[1-8]",he=new RegExp(`^(?:${h}{8}-${h}{4}-${ye}${h}{3}-[89ab]${h}{3}-${h}{12}|${Pe}|${ge})$`,"i");function j(s){return typeof s=="string"&&he.test(s)}var $=10,F=process.env.API_GATEWAY_URL||"https://api.autofleet.io",O=new B({serviceName:"IDENTITY_MS",retries:3,retryCondition:()=>true,cache:process.env.NODE_ENV!=="test"?{maxAge:$*1e3}:void 0}),A=new B({baseURL:F,serviceUrl:F,retries:3,retryCondition:()=>true,cache:process.env.NODE_ENV!=="test"?{maxAge:$*1e3}:void 0});var l="x-af-elevated-permissions",E="x-af-context-ids",f=new Ue({stdTTL:10}),J=(s,e)=>{let r={...s,fleets:{...s?.fleets},businessModels:{...s?.businessModels},demandSources:{...s?.demandSources}};for(let o of e)Object.keys(o).forEach(t=>{r[t]??={},Object.entries(o[t]).forEach(([i,n])=>{r[t][i]=(r[t][i]||[]).concat(n);});});return r},u=class{constructor(e,r,o,t){this.id=e;this.accountType=r;this.contextIds=t;this.privateElevatedPermissionsHash=new Map;this.appPermission={};this.emptyUser=!!e,o&&this.privateElevatedPermissionsHash.set(Symbol("initial"),o);}async getUserPermissions(){if(!this.id)return;if(this.privatePermissions)return this.privatePermissions;let e=xe({id:this.id,contextIds:this.contextIds}),r=f.get(e);return r||({data:r}=await O.get(`/api/v1/users/${this.id}/authorization-payload`,{params:{contextIds:this.contextIds}}),f.set(e,r)),this.accountType=r.accountType,this.privatePermissions=r,this.privatePermissions}async useCustomPermissionLoader(e){if(!this.id)return;if(this.privatePermissions)return this.privatePermissions;let r=this.id,o=f.get(r);if(o)return this.privatePermissions=o,o;let t=await e(this.id);return f.set(r,t),this.privatePermissions=t,this.privatePermissions}get businessModels(){return this.getUserProperty("businessModels")}get fleets(){return this.getUserProperty("fleets")}get demandSources(){return this.getUserProperty("demandSources")}getUserProperty(e){if(!this.privatePermissions)throw new Error(`Cannot get ${e} without calling (async) getUserPermissions before`);return Object.keys(this.privatePermissions[e]||{})}get elevatedPermissions(){return J(void 0,this.privateElevatedPermissionsHash.values())}get permissions(){if(!this.privatePermissions)throw new Error("Cannot get permissions without calling (async) getUserPermissions before");return J(this.privatePermissions,this.privateElevatedPermissionsHash.values())}elevatePermissions(e){let r=Symbol();Object.values(e).forEach(n=>{Object.keys(n).forEach(a=>{if(!j(a))throw new Error(`Entity id on elevatePermissions is not a valid UUID, provided: ${a}`)});});let o=getCurrentContext();if(!o)throw new Error("Cannot find current user cross services trace");let t=JSON.parse(o.context[l]||"{}"),i=Object.assign(t,e);return this.privateElevatedPermissionsHash.set(r,i),o.context.set(l,JSON.stringify(this.elevatedPermissions)),()=>{this.privateElevatedPermissionsHash.delete(r),o.context.set(l,JSON.stringify(this.elevatedPermissions));}}async getUserPermissionsLegacy(){if(!this.id)return;if(this.privatePermissionsLegacy)return this.privatePermissionsLegacy;let{data:e}=await O.get(`/api/v1/users/${this.id}/authorization-payload-legacy`);return this.privatePermissionsLegacy=e,this.privatePermissionsLegacy}get permissionsLegacy(){if(!this.privatePermissionsLegacy)throw new Error("Cannot get permissionsLegacy without calling (async) getUserPermissionsLegacy before");return this.privatePermissionsLegacy}async getUserAppPermissions(e,r){if(!this.id||!e||!r)return;let o=this.appPermission[e];if(o)return o;let t=`${this.id}:${e}`,i=f.get(t);if(i)return this.appPermission[e]=i,i;let{data:n}=await A.post(`/api/v1/apps/${e}/get-user-payload`,{userId:this.id},{headers:{"x-autofleet-apps-secret":r}});return f.set(t,n),this.appPermission[e]=n,this.appPermission[e]}};var W=async(s,e)=>{let{data:r}=await A.post("/api/v1/auth",{bearer:s,appId:e});return r};var P=class extends Error{constructor(){super(...arguments);this.name="AppDoesNotExist";this.message="app does not exist";}};var G="identity-ms",z="accessToken",m="userObject",U="x-af-user-id",H="X-IAF-ORIGIN-SERVICE",I="x-af-user-permissions",X=H.toLowerCase(),V="x-autofleet-apps-secret";var T=async(s,e)=>{let r=e[H]||e[X]||"";if(!Array.isArray(r)&&r.toLowerCase()===G)return;let{eagerLoadUserPermissions:o,eagerLoadUserPermissionsLegacy:t,customPermissionLoader:i}=s,n=e[U];if(!n||Array.isArray(n))return;let a=e[l]?.length>0?JSON.parse(e[l]):{},c=e?.[E]?.split(","),d=new u(n,"user",a,c);return o&&(i?await d.useCustomPermissionLoader(i):await d.getUserPermissions()),t&&await d.getUserPermissionsLegacy(),getCurrentContext().nonHeaderContext?.set(m,d),d};var Y=(s={})=>async(e,r,o)=>{try{let t=await T(s,e.headers);t&&(e.user=t,e.headers[I]=t),o();}catch{r.status(401).json({error:"cannot authenticate user"});}},Z=(s={})=>async(e,r,o)=>{let{eagerLoadUserPermissions:t,eagerLoadUserPermissionsLegacy:i,returnErrorIfNoToken:n}=s,a;if(e.headers.authorization){try{a=await _(e.headers.authorization);}catch(y){y instanceof S__default.TokenExpiredError?r.status(401).json({errors:["Access token expired"]}):y instanceof S__default.JsonWebTokenError?r.status(400).json({errors:[y.message]}):r.status(500).json({errors:["Server error while parsing token"]});return}let c=a?.user?.id;c&&(e.headers[U]=c);let d=e.headers?.[E]?.split(","),p=new u(c,a?.user?.accountType,void 0,d);(t||i)&&await Promise.all([t&&p.getUserPermissions(),i&&p.getUserPermissionsLegacy()]),e.user=p,getCurrentContext().nonHeaderContext?.set(m,p),e.headers[I]=p;}else if(n){r.status(401).json({errors:["No token provided"]});return}o();},Q=s=>async(e,r,o)=>{let{appId:t,clientSecret:i}=s,n;if(!e.headers.authorization){r.status(401).json({errors:["No token provided"]});return}try{if(n=await W(e.headers.authorization,t),!n)throw new P}catch(p){if(p instanceof S__default.TokenExpiredError){r.status(401).json({errors:["Access token expired"]});return}if([S__default.JsonWebTokenError,P].some(y=>p instanceof y)){r.status(400).json({errors:[p.message]});return}r.status(500).json({errors:["Server error while parsing token"]});return}let a=n?.userId;a&&(e.headers[U]=a);let c=new u(a);t&&(e.headers[V]=i,await c.getUserAppPermissions(t,i)),e.user=c;let d=getCurrentContext().nonHeaderContext;d?.set(m,c),d?.set(z,w(e.headers.authorization)),e.headers[I]=c,o();},q=async(s,e,r)=>{await s.user.getUserPermissions(),r();},ee=s=>s.headers.authorization?_(s.headers.authorization):null,se=async(s,e)=>{let r=new u(e);await r.getUserPermissions(),s??=newTrace(traceTypes.RABBIT),s.nonHeaderContext.set(m,r);},re=u;var N=(s,e,r)=>{s.addHook("onRequest",async(o,t)=>{try{let i=await T(e,o.headers);i&&s.decorateRequest("user",i);}catch{t.status(401).send({error:"cannot authenticate user"});}}),r();};N[Symbol.for("skip-override")]=true;var v=()=>getCurrentContext().nonHeaderContext?.get(m),L=()=>v()?.id,D=(s,e)=>!L()||Object.hasOwn(v().permissions[e],s),te=s=>D(s,"fleets"),oe=s=>D(s,"businessModels"),ie=s=>D(s,"demandSources");var R=class extends Error{constructor(r=null,o="UnauthorizedAccessError"){super(o);this.user=r;this.name="UnauthorizedAccessError";}};var x={NONE:"NONE",BASIC:"BASIC",JWT:"JWT"},ne={[x.NONE]:()=>{},[x.BASIC]:s=>{let{username:e,password:r}=s;return `Basic ${Buffer.from(`${e}:${r}`).toString("base64")}`},[x.JWT]:s=>{let{secret:e}=s;if(e)return `Bearer ${S.sign({},e,{expiresIn:10})}`}},ce=s=>{let e=s?.method;if(!(!e||!ne[e]))return ne[e](s)};var Re=g.getCurrentContext,As=({outbreakOptions:s={},logger:e}={})=>{g.default({headersPrefix:"x-af",contextMiddlewareGetter:e?.addContextMiddleware,...s});},{traceTypes:be,newTrace:Ce}=g;var Is={traceTypes:be,newTrace:Ce,User:re,middleware:Y,middlewareWithDecode:Z,eagerLoadPermissionsMiddleware:q,getCurrentPayload:Re,getDecodedBearer:ee,checkFleetPermission:te,checkBusinessModelPermission:oe,checkDemandSourcePermission:ie,isUserExist:L,getUser:v,UnauthorizedAccessError:R,appMiddleware:Q,createOrSetRabbitTrace:se,outbreak:g,AUTHORIZATION_METHODS:x,getAuthorizationHeader:ce,CONTEXTS_IDS_HEADER:E,authFromUserIdHeaderPlugin:N};
+export{x as AUTHORIZATION_METHODS,E as CONTEXTS_IDS_HEADER,R as UnauthorizedAccessError,re as User,Q as appMiddleware,N as authFromUserIdHeaderPlugin,oe as checkBusinessModelPermission,ie as checkDemandSourcePermission,te as checkFleetPermission,se as createOrSetRabbitTrace,Is as default,q as eagerLoadPermissionsMiddleware,As as enableTracing,ce as getAuthorizationHeader,Re as getCurrentPayload,ee as getDecodedBearer,Ee as getRefreshTokenSecret,C as getTokenSecret,v as getUser,L as isUserExist,Y as middleware,Z as middlewareWithDecode,Ce as newTrace,be as traceTypes};//# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/secret-getter.ts","../src/utils.ts","../src/services.ts","../src/user/ApiUser.ts","../src/app-auth.ts","../src/exceptions/appDoesNotExist.ts","../src/user/index.ts","../src/check-permission.ts","../src/errors.ts","../src/authorization.ts","../src/index.ts"],"names":["DEPRECATED_JWT_SECRET","JWT_NEW_SECRET","DEPRECATED_REFRESH_JWT_SECRET","REFRESH_JWT_SECRET","DEPRECATION_UNIX_TIMESTAMP","getRelevantSecret","token","deprecatedSecret","newSecret","deprecationTime","moment","unixTime","iat","jwt","getRefreshTokenSecret","getTokenSecret","getAuthFromBearer","bearer","decodeBearer","appSecret","N","EMPTY_UUID","FULL_UUID","VALID_CHARS_REGEX","UUID_VERSION_REGEX","UUID_REGEX","validateUUID","uuid","CACHE_LIFETIME_IN_SEC","apiGwUrl","IdentityNetwork","Network","AutofleetApiNetwork","ELEVATED_PERMISSIONS_HEADER","CONTEXTS_IDS_HEADER","userCache","NodeCache","mergePermissions","target","sources","permissions","source","entityType","entityId","perms","ApiUser","id","accountType","elevatedPermissions","contextIds","cacheKey","objectHash","data","customPermissionLoader","cachedResult","key","addedPermissions","elevationId","entityIds","currentUserTrace","getCurrentContext","currentElevation","newElevation","appId","clientSecret","currentAppPermission","decodeAppBearer","decoded","AppDoesNotExist","IDENTITY_MS","ACCESS_TOKEN","USER_OBJECT","USER_TRACING_HEADER","ORIGIN_HEADER","USER_PERMISSIONS_HEADER","LOWER_CASE_ORIGIN_HEADER","middleware","options","req","res","next","eagerLoadUserPermissions","eagerLoadUserPermissionsLegacy","userId","elevatedPermissionsFromHeader","userObject","middlewareWithDecode","returnErrorIfNoToken","e","TokenExpiredError","JsonWebTokenError","appMiddleware","Err","currentTraceContext","eagerLoadPermissionsMiddleware","getDecodedBearer","createOrSetRabbitTrace","trace","newTrace","traceTypes","user_default","getUser","isUserExist","checkFleetPermission","fleetId","checkBusinessModelPermission","businessModelId","checkDemandSourcePermission","demandSourceId","UnauthorizedAccessError","user","message","AUTHORIZATION_METHODS","AUTHORIZATION_ACTIONS","authorizationSettings","username","password","secret","se","getAuthorizationHeader","authorizationMethod","getCurrentPayload","enableTracing","outbreakOptions","logger","outbreak","index_default"],"mappings":"+VAGA,IAAM,CACJ,qBAAAA,CAAAA,EAAAA,CAAuB,eAAAC,EACvB,CAAA,6BAAA,CAAAC,GAA+B,kBAAAC,CAAAA,EAAAA,CAC/B,0BAAAC,CAAAA,EACF,CAAI,CAAA,OAAA,CAAQ,IAENC,CAAoB,CAAA,CAACC,EAA2BC,CAA0BC,CAAAA,CAAAA,GAA8B,CAC5G,IAAMC,CAAAA,CAAkBC,EAAO,QAASN,CAAAA,EAAAA,CAA4B,EAAE,CAAI,CAAA,GAAI,EAC9E,GAAI,CACF,IAAIO,CACJ,CAAA,GAAIL,CAAO,CAAA,CACT,GAAM,CAAE,IAAAM,CAAI,CAAA,CAAIC,YAAI,MAAOP,CAAAA,CAAK,EAChCK,CAAWD,CAAAA,CAAAA,CAAOE,CAAM,CAAA,GAAI,EAC9B,CAAA,KACED,EAAWD,CAAO,EAAA,CAEpB,OAAOC,CAAS,CAAA,QAAA,CAASF,CAAe,CAAIF,CAAAA,CAAAA,CAAmBC,CACjE,CAAA,KAAY,CACV,OAAOA,CACT,CACF,CAAA,CAEaM,GAAyBR,CAA2BD,EAAAA,CAAAA,CAAkBC,EAAOJ,EAA+BC,CAAAA,EAAkB,EAC9HY,CAAkBT,CAAAA,CAAAA,EAA2BD,EAAkBC,CAAON,CAAAA,EAAAA,CAAuBC,EAAc,ECfjH,IAAMe,EAAqBC,CAA2BA,EAAAA,CAAAA,CAAO,OAAQ,CAAA,SAAA,CAAW,EAAE,CAAA,CAE5EC,EAAe,CAACD,CAAAA,CAAgBE,IAA4B,CACvE,IAAMb,EAAQU,CAAkBC,CAAAA,CAAM,CAEtC,CAAA,OADoBG,EAAOd,CAAAA,MAAAA,CAAAA,CAAAA,CAAoBS,CAAeT,CAAAA,CAAK,CAAC,CAEtE,CAAA,CAyDA,IAAMe,EAAa,CAAA,sCAAA,CACbC,EAAY,CAAA,sCAAA,CACZC,CAAoB,CAAA,UAAA,CACpBC,GAAqB,OACrBC,CAAAA,EAAAA,CAAa,IAAI,MAAO,CAAA,CAAA,IAAA,EAAOF,CAAiB,CAAOA,IAAAA,EAAAA,CAAiB,CAAOC,IAAAA,EAAAA,EAAkB,CAAGD,EAAAA,CAAiB,aAAaA,CAAiB,CAAA,IAAA,EAAOA,CAAiB,CAAQF,KAAAA,EAAAA,EAAU,IAAIC,EAAS,CAAA,EAAA,CAAA,CAAM,GAAG,CAAA,CAClN,SAASI,CAAAA,CAAaC,EAA6B,CACxD,OAAO,OAAOA,CAAS,EAAA,QAAA,EAAYF,GAAW,IAAKE,CAAAA,CAAI,CACzD,CC/EA,IAAMC,CAAAA,CAAwB,GACxBC,CAAW,CAAA,OAAA,CAAQ,IAAI,eAAmB,EAAA,0BAAA,CAGnCC,CAAkB,CAAA,IAAIC,CAAQ,CAAA,CACzC,YAAa,aACb,CAAA,OAAA,CAAS,EACT,cAAgB,CAAA,IAAM,KACtB,KAAO,CAAA,OAAA,CAAQ,IAAI,QAAa,GAAA,MAAA,CAAS,CACvC,MAAQH,CAAAA,CAAAA,CAAwB,GAClC,CAAI,CAAA,SACN,CAAC,CAEYI,CAAAA,CAAAA,CAAsB,IAAID,CAAAA,CAAQ,CAC7C,OAAA,CAASF,EACT,UAAYA,CAAAA,CAAAA,CACZ,QAAS,CACT,CAAA,cAAA,CAAgB,IAAM,IACtB,CAAA,KAAA,CAAO,OAAQ,CAAA,GAAA,CAAI,QAAa,GAAA,MAAA,CAAS,CACvC,MAAQD,CAAAA,CAAAA,CAAwB,GAClC,CAAI,CAAA,SACN,CAAC,CCZM,CAAA,IAAMK,CAA8B,CAAA,2BAAA,CAC9BC,CAAsB,CAAA,kBAAA,CAuB7BC,EAAY,IAAIC,EAAAA,CAAU,CAAE,MAAQ,CAAA,EAAG,CAAC,CAExCC,CAAAA,CAAAA,CAAmB,CAACC,CAAqBC,CAAAA,CAAAA,GAAuD,CACpG,IAAMC,CAAAA,CAA2B,CAC/B,GAAGF,CAAAA,CACH,OAAQ,CAAE,GAAGA,CAAQ,EAAA,MAAO,CAC5B,CAAA,cAAA,CAAgB,CAAE,GAAGA,CAAAA,EAAQ,cAAe,CAC5C,CAAA,aAAA,CAAe,CAAE,GAAGA,CAAAA,EAAQ,aAAc,CAE5C,CAGA,CAAA,IAAA,IAAWG,KAAUF,CACnB,CAAA,MAAA,CAAO,KAAKE,CAAM,CAAA,CAAE,QAASC,CAAe,EAAA,CAE1CF,CAAYE,CAAAA,CAAU,CAAM,GAAA,GAC5B,MAAO,CAAA,OAAA,CAAQD,EAAOC,CAAU,CAAE,EAAE,OAAQ,CAAA,CAAC,CAACC,CAAUC,CAAAA,CAAK,IAAM,CAEjEJ,CAAAA,CAAYE,CAAU,CAAEC,CAAAA,CAAQ,GAAKH,CAAYE,CAAAA,CAAU,CAAEC,CAAAA,CAAQ,CAAK,EAAA,IAAI,MAAOC,CAAAA,CAAK,EAC5F,CAAC,EACH,CAAC,CAGH,CAAA,OAAOJ,CACT,CAAA,CAEqBK,CAArB,CAAA,KAA6B,CAW3B,WAAmBC,CAAAA,CAAAA,CAAqBC,EAA2BC,CAAiDC,CAAAA,CAAAA,CAAuB,CAAxH,IAAAH,CAAAA,EAAAA,CAAAA,CAAAA,CAAqB,IAAAC,CAAAA,WAAAA,CAAAA,CAAAA,CAA4E,IAAAE,CAAAA,UAAAA,CAAAA,CAAAA,CARpH,KAAiB,8BAAiC,CAAA,IAAI,IAItD,IAAiB,CAAA,aAAA,CAAwC,EAKvD,CAAA,IAAA,CAAK,SAAY,CAAA,CAAC,CAACH,CAAAA,CACfE,GACF,IAAK,CAAA,8BAAA,CAA+B,IAAI,MAAO,CAAA,SAAS,EAAGA,CAAmB,EAElF,CAEA,MAAM,kBAA2C,EAAA,CAC/C,GAAI,CAAC,IAAA,CAAK,GACR,OAEF,GAAI,KAAK,kBACP,CAAA,OAAO,IAAK,CAAA,kBAAA,CAEd,IAAME,CAAAA,CAAWC,GAAW,CAC1B,EAAA,CAAI,KAAK,EACT,CAAA,UAAA,CAAY,KAAK,UACnB,CAAC,CAEGC,CAAAA,CAAAA,CAAOjB,CAAU,CAAA,GAAA,CAAiBe,CAAQ,CAE9C,CAAA,OAAKE,IACF,CAAE,IAAA,CAAAA,CAAK,CAAI,CAAA,MAAMtB,EAAgB,GAAI,CAAA,CAAA,cAAA,EAAiB,KAAK,EAAE,CAAA,sBAAA,CAAA,CAA0B,CAAE,MAAQ,CAAA,CAAE,WAAY,IAAK,CAAA,UAAW,CAAE,CAAC,CACnIK,CAAAA,CAAAA,CAAU,IAAIe,CAAUE,CAAAA,CAAI,GAG9B,IAAK,CAAA,WAAA,CAAcA,EAAK,WACxB,CAAA,IAAA,CAAK,kBAAqBA,CAAAA,CAAAA,CACnB,IAAK,CAAA,kBACd,CAEA,MAAM,yBAAA,CAA0BC,EAAmD,CACjF,GAAI,CAAC,IAAK,CAAA,EAAA,CACR,OAEF,GAAI,IAAK,CAAA,kBAAA,CACP,OAAO,IAAK,CAAA,kBAAA,CAGd,IAAMH,CAAW,CAAA,IAAA,CAAK,GAEhBI,CAAenB,CAAAA,CAAAA,CAAU,IAAiBe,CAAQ,CAAA,CACxD,GAAII,CACF,CAAA,OAAA,IAAA,CAAK,mBAAqBA,CACnBA,CAAAA,CAAAA,CAGT,IAAMF,CAAO,CAAA,MAAMC,CAAuB,CAAA,IAAA,CAAK,EAAE,CAAA,CACjD,OAAAlB,CAAU,CAAA,GAAA,CAAIe,EAAUE,CAAI,CAAA,CAE5B,KAAK,kBAAqBA,CAAAA,CAAAA,CACnB,IAAK,CAAA,kBACd,CAEA,IAAI,gBAAuC,CACzC,OAAO,KAAK,eAAgB,CAAA,gBAAgB,CAC9C,CAEA,IAAI,MAA+B,EAAA,CACjC,OAAO,IAAA,CAAK,gBAAgB,QAAQ,CACtC,CAEA,IAAI,aAAA,EAAsC,CACxC,OAAO,IAAA,CAAK,gBAAgB,eAAe,CAC7C,CAEQ,eAAgBG,CAAAA,CAAAA,CAA8C,CACpE,GAAI,CAAC,KAAK,kBACR,CAAA,MAAM,IAAI,KAAA,CAAM,CAAcA,WAAAA,EAAAA,CAAG,oDAAoD,CAEvF,CAAA,OAAO,OAAO,IAAK,CAAA,IAAA,CAAK,mBAAmBA,CAAG,CAAA,EAAK,EAAE,CACvD,CAEA,IAAI,mBAAmC,EAAA,CACrC,OAAOlB,CAAiB,CAAA,SAAA,CAAW,KAAK,8BAA+B,CAAA,MAAA,EAAQ,CACjF,CAEA,IAAI,aAAuC,CACzC,GAAI,CAAC,IAAK,CAAA,kBAAA,CACR,MAAM,IAAI,KAAA,CAAM,0EAA0E,CAAA,CAG5F,OAAOA,CAAAA,CAAiB,KAAK,kBAAoB,CAAA,IAAA,CAAK,+BAA+B,MAAO,EAAC,CAC/F,CAEA,kBAAA,CAAmBmB,CAAkD,CAAA,CAGnE,IAAMC,CAAAA,CAAc,QAGpB,CAAA,MAAA,CAAO,OAAOD,CAAgB,CAAA,CAAE,QAASE,CAAc,EAAA,CACrD,MAAO,CAAA,IAAA,CAAKA,CAAS,CAAA,CAAE,QAASf,CAAa,EAAA,CAC3C,GAAI,CAACjB,CAAAA,CAAaiB,CAAQ,CACxB,CAAA,MAAM,IAAI,KAAA,CAAM,CAAkEA,+DAAAA,EAAAA,CAAQ,EAAE,CAEhG,CAAC,EACH,CAAC,CAAA,CAED,IAAMgB,CAAmBC,CAAAA,iBAAAA,GACzB,GAAI,CAACD,EACH,MAAM,IAAI,MAAM,+CAA+C,CAAA,CAGjE,IAAME,CAAmB,CAAA,IAAA,CAAK,KAAMF,CAAAA,CAAAA,CAAiB,OAAQ1B,CAAAA,CAA2B,GAAK,IAAI,CAAA,CAC3F6B,EAAe,MAAO,CAAA,MAAA,CAAOD,EAAkBL,CAAgB,CAAA,CACrE,OAAK,IAAA,CAAA,8BAAA,CAA+B,GAAIC,CAAAA,CAAAA,CAAaK,CAAY,CACjEH,CAAAA,CAAAA,CAAiB,QAAQ,GAAI1B,CAAAA,CAAAA,CAA6B,KAAK,SAAU,CAAA,IAAA,CAAK,mBAAmB,CAAC,CAC3F,CAAA,IAAM,CACX,IAAK,CAAA,8BAAA,CAA+B,OAAOwB,CAAW,CAAA,CACtDE,EAAiB,OAAQ,CAAA,GAAA,CAAI1B,EAA6B,IAAK,CAAA,SAAA,CAAU,KAAK,mBAAmB,CAAC,EACpG,CACF,CAEA,MAAM,wBAA2B,EAAA,CAC/B,GAAI,CAAC,IAAK,CAAA,EAAA,CACR,OAEF,GAAI,IAAA,CAAK,yBACP,OAAO,IAAA,CAAK,yBAEd,GAAM,CAAE,IAAAmB,CAAAA,CAAK,CAAI,CAAA,MAAMtB,EAAgB,GAAI,CAAA,CAAA,cAAA,EAAiB,KAAK,EAAE,CAAA,6BAAA,CAA+B,EAElG,OAAK,IAAA,CAAA,wBAAA,CAA2BsB,CACzB,CAAA,IAAA,CAAK,wBACd,CAEA,IAAI,iBAAyB,EAAA,CAC3B,GAAI,CAAC,IAAA,CAAK,yBACR,MAAM,IAAI,MAAM,sFAAsF,CAAA,CAExG,OAAO,IAAK,CAAA,wBACd,CAEA,MAAM,qBAAA,CAAsBW,EAAOC,CAAc,CAAA,CAC/C,GAAI,CAAC,IAAK,CAAA,EAAA,EAAM,CAACD,CAAS,EAAA,CAACC,EACzB,OAEF,IAAMC,EAAuB,IAAK,CAAA,aAAA,CAAcF,CAAK,CAAA,CAErD,GAAIE,CAAAA,CACF,OAAOA,CAGT,CAAA,IAAMf,EAAW,CAAG,EAAA,IAAA,CAAK,EAAE,CAAIa,CAAAA,EAAAA,CAAK,CAE9BT,CAAAA,CAAAA,CAAAA,CAAenB,CAAU,CAAA,GAAA,CAAiBe,CAAQ,CACxD,CAAA,GAAII,EACF,OAAK,IAAA,CAAA,aAAA,CAAcS,CAAK,CAAIT,CAAAA,CAAAA,CACrBA,CAGT,CAAA,GAAM,CAAE,IAAA,CAAAF,CAAK,CAAI,CAAA,MAAMpB,EAAoB,IAAK,CAAA,CAAA,aAAA,EAAgB+B,CAAK,CAAqB,iBAAA,CAAA,CAAA,CACxF,MAAQ,CAAA,IAAA,CAAK,EACf,CAAA,CAAG,CACD,OAAS,CAAA,CACP,0BAA2BC,CAC7B,CACF,CAAC,CAED,CAAA,OAAA7B,CAAU,CAAA,GAAA,CAAIe,CAAUE,CAAAA,CAAI,EAC5B,IAAK,CAAA,aAAA,CAAcW,CAAK,CAAIX,CAAAA,CAAAA,CACrB,KAAK,aAAcW,CAAAA,CAAK,CACjC,CACF,EC1OO,IAAMG,EAAkB,MAAOjD,CAAAA,CAAgB8C,IAAgC,CACpF,GAAM,CAAE,IAAMI,CAAAA,CAAQ,EAAI,MAAMnC,CAAAA,CAAoB,KAAK,cAAgB,CAAA,CAAE,OAAAf,CAAQ,CAAA,KAAA,CAAA8C,CAAM,CAAC,CAAA,CAC1F,OAAOI,CACT,CCLA,CAAA,IAAqBC,EAArB,cAA6C,KAAM,CAAnD,WACE,EAAA,CAAA,KAAA,CAAA,GAAA,SAAA,CAAA,CAAA,IAAA,CAAA,IAAA,CAAO,kBAEP,IAAU,CAAA,OAAA,CAAA,qBAAA,CACZ,CCGA,CAAA,IAAMC,EAAc,CAAA,aAAA,CACdC,GAAe,aACRC,CAAAA,CAAAA,CAAc,aACrBC,CAAsB,CAAA,cAAA,CACtBC,EAAgB,sBAChBC,CAAAA,CAAAA,CAA0B,uBAC1BC,CAAAA,EAAAA,CAA2BF,CAAc,CAAA,WAAA,GAElCG,CAAa,CAAA,CAACC,EAIvB,EAAC,GAAM,MAAOC,CAAKC,CAAAA,CAAAA,CAAKC,IAAuB,CACjD,GAAI,CAEF,GAD6BF,CAAAA,CAAAA,CAAI,QAAQL,CAAa,CAAA,EAAKK,EAAI,OAAQH,CAAAA,EAAwB,CAAK,EAAA,EAAA,EACnF,WAAY,EAAA,GAAMN,GACjC,OAAOW,CAAAA,GAET,GAAM,CACJ,yBAAAC,CACA,CAAA,8BAAA,CAAAC,CACA,CAAA,sBAAA,CAAA7B,CACF,CAAA,CAAIwB,EACEM,CAASL,CAAAA,CAAAA,CAAI,QAAQN,CAAmB,CAAA,CAC9C,GAAI,CAACW,CAAAA,CACH,OAAOH,CAAAA,EAGT,CAAA,IAAMI,EAAgCN,CAAI,CAAA,OAAA,CAAQ7C,CAA2B,CAAG,EAAA,MAAA,CAAS,EAAI,IAAK,CAAA,KAAA,CAAM6C,EAAI,OAAQ7C,CAAAA,CAA2B,CAAC,CAAI,CAAA,GAC9IgB,CAAc6B,CAAAA,CAAAA,CAAI,UAAU5C,CAAmB,CAAA,EAAc,KAAM,CAAA,GAAG,CAEtEmD,CAAAA,CAAAA,CAAa,IAAIxC,CAAQsC,CAAAA,CAAAA,CAAQ,OAAQC,CAA+BnC,CAAAA,CAAU,EACxF,OAAIgC,CAAAA,GACE5B,CACF,CAAA,MAAMgC,CAAW,CAAA,yBAAA,CAA0BhC,CAAsB,CAEjE,CAAA,MAAMgC,EAAW,kBAAmB,EAAA,CAAA,CAIpCH,GACF,MAAMG,CAAAA,CAAW,wBAAyB,EAAA,CAG5CP,CAAI,CAAA,IAAA,CAAOO,EACXzB,iBAAkB,EAAA,CAAE,kBAAkB,GAAIW,CAAAA,CAAAA,CAAac,CAAU,CAGjEP,CAAAA,CAAAA,CAAI,OAAQJ,CAAAA,CAAuB,CAAIW,CAAAA,CAAAA,CAEhCL,GACT,CAAA,KAAY,CACV,OAAAD,CAAAA,CAAI,OAAO,GAAG,CAAA,CACPA,CAAI,CAAA,IAAA,CAAK,CACd,KAAA,CAAO,0BACT,CAAC,CACH,CACF,CAEaO,CAAAA,CAAAA,CAAuB,CAACT,CAIjC,CAAA,EAAO,GAAA,MAAOC,CAAKC,CAAAA,CAAAA,CAAKC,IAAwB,CAClD,GAAM,CACJ,wBAAAC,CAAAA,CAAAA,CACA,+BAAAC,CACA,CAAA,oBAAA,CAAAK,CACF,CAAA,CAAIV,CACAV,CAAAA,CAAAA,CACJ,GAAIW,CAAI,CAAA,OAAA,CAAQ,cAAe,CAC7B,GAAI,CACFX,CAAU,CAAA,MAAMjD,EAAa4D,CAAI,CAAA,OAAA,CAAQ,aAAa,EACxD,CAAA,MAASU,EAAG,CACNA,CAAAA,YAAaC,mBACfV,CAAI,CAAA,MAAA,CAAO,GAAG,CAAA,CACdA,CAAI,CAAA,IAAA,CAAK,CACP,MAAQ,CAAA,CAAC,sBAAsB,CACjC,CAAC,GACQS,CAAaE,YAAAA,iBAAAA,EACtBX,CAAI,CAAA,MAAA,CAAO,GAAG,CAAA,CACdA,EAAI,IAAK,CAAA,CACP,OAAQ,CAACS,CAAAA,CAAE,OAAO,CACpB,CAAC,CAEDT,GAAAA,CAAAA,CAAI,MAAO,CAAA,GAAG,EACdA,CAAI,CAAA,IAAA,CAAK,CACP,MAAQ,CAAA,CAAC,kCAAkC,CAC7C,CAAC,GAEH,MACF,CACA,IAAMI,CAAShB,CAAAA,CAAAA,EAAS,MAAM,EAE1BgB,CAAAA,CAAAA,GACFL,EAAI,OAAQN,CAAAA,CAAmB,CAAIW,CAAAA,CAAAA,CAAAA,CAGrC,IAAMlC,CAAAA,CAAc6B,EAAI,OAAU5C,GAAAA,CAAmB,GAAc,KAAM,CAAA,GAAG,EACtEmD,CAAa,CAAA,IAAIxC,CAAQsC,CAAAA,CAAAA,CAAQhB,CAAS,EAAA,IAAA,EAAM,YAAa,SAAWlB,CAAAA,CAAU,EAEpFgC,CACF,EAAA,MAAMI,EAAW,kBAAmB,EAAA,CAGlCH,CACF,EAAA,MAAMG,CAAW,CAAA,wBAAA,GAGnBP,CAAI,CAAA,IAAA,CAAOO,EACXzB,iBAAkB,EAAA,CAAE,kBAAkB,GAAIW,CAAAA,CAAAA,CAAac,CAAU,CAGjEP,CAAAA,CAAAA,CAAI,QAAQJ,CAAuB,CAAA,CAAIW,EACzC,CAAWE,KAAAA,GAAAA,CAAAA,CACT,OAAAR,CAAI,CAAA,MAAA,CAAO,GAAG,CAAA,CACPA,CAAI,CAAA,IAAA,CAAK,CACd,MAAQ,CAAA,CAAC,mBAAmB,CAC9B,CAAC,EAEH,OAAOC,CAAAA,EACT,CAAA,CAEaW,CAAiBd,CAAAA,CAAAA,EAGxB,MAAOC,CAAKC,CAAAA,CAAAA,CAAKC,IAAwB,CAC7C,GAAM,CACJ,KAAAjB,CAAAA,CAAAA,CACA,YAAAC,CAAAA,CACF,CAAIa,CAAAA,CAAAA,CACAV,EAEJ,GAAI,CAACW,EAAI,OAAQ,CAAA,aAAA,CACf,OAAAC,CAAI,CAAA,MAAA,CAAO,GAAG,CAAA,CACPA,CAAI,CAAA,IAAA,CAAK,CACd,MAAQ,CAAA,CAAC,mBAAmB,CAC9B,CAAC,EAGH,GAAI,CAEF,GADAZ,CAAAA,CAAU,MAAMD,CAAAA,CAAgBY,EAAI,OAAQ,CAAA,aAAA,CAAef,CAAK,CAC5D,CAAA,CAACI,EACH,MAAM,IAAIC,CAEd,CAAA,MAASoB,CAAG,CAAA,CACV,OAAIA,CAAaC,YAAAA,iBAAAA,CACRV,EAAI,MAAO,CAAA,GAAG,EAAE,IAAK,CAAA,CAC1B,MAAQ,CAAA,CAAC,sBAAsB,CACjC,CAAC,CAEC,CAAA,CAACW,kBAAmBtB,CAAe,CAAA,CAAE,KAAMwB,CAAQJ,EAAAA,CAAAA,YAAaI,CAAG,CAC9Db,CAAAA,CAAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,CAC1B,MAAA,CAAQ,CAACS,CAAE,CAAA,OAAO,CACpB,CAAC,CAEIT,CAAAA,CAAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,CAC1B,MAAA,CAAQ,CAAC,kCAAkC,CAC7C,CAAC,CACH,CACA,IAAMI,EAAShB,CAAS,EAAA,MAAA,CACpBgB,IACFL,CAAI,CAAA,OAAA,CAAQP,CAAW,CAAIY,CAAAA,CAAAA,CAAAA,CAG7B,IAAME,CAAAA,CAAa,IAAIxC,CAAAA,CAAQsC,CAAM,CAEjCpB,CAAAA,CAAAA,GACFe,EAAI,OAAQ,CAAA,yBAAyB,EAAId,CAEzC,CAAA,MAAMqB,EAAW,qBAAsBtB,CAAAA,CAAAA,CAAOC,CAAY,CAG5Dc,CAAAA,CAAAA,CAAAA,CAAI,KAAOO,CACX,CAAA,IAAMQ,EAAsBjC,iBAAkB,EAAA,CAAE,gBAChD,CAAA,OAAAiC,CAAqB,EAAA,GAAA,CAAItB,EAAac,CAAU,CAAA,CAChDQ,GAAqB,GAAIvB,CAAAA,EAAAA,CAActD,EAAkB8D,CAAI,CAAA,OAAA,CAAQ,aAAa,CAAC,CAGnFA,CAAAA,CAAAA,CAAI,QAAQJ,CAAuB,CAAA,CAAIW,EAEhCL,CAAK,EACd,EAEac,CAAiC,CAAA,MAAOhB,CAAKC,CAAAA,CAAAA,CAAKC,CAC7D,IAAA,MAAMF,EAAI,IAAK,CAAA,kBAAA,GACRE,CAAK,EAAA,CAAA,CAGDe,EAAoBjB,CAC3BA,EAAAA,CAAAA,CAAI,QAAQ,aACP5D,CAAAA,CAAAA,CAAa4D,EAAI,OAAQ,CAAA,aAAa,EAGxC,IAGIkB,CAAAA,CAAAA,CAAyB,MAAOC,CAAgDd,CAAAA,CAAAA,GAA+B,CAC1H,IAAME,CAAa,CAAA,IAAIxC,EAAQsC,CAAM,CAAA,CAErC,MAAME,CAAW,CAAA,kBAAA,GAEjBY,CAAUC,GAAAA,QAAAA,CAASC,UAAW,CAAA,MAAM,CACpCF,CAAAA,CAAAA,CAAM,iBAAiB,GAAI1B,CAAAA,CAAAA,CAAac,CAAU,EACpD,CAAA,CAEOe,EAAQvD,ECjNR,IAAMwD,EAAU,IAA4BzC,iBAAAA,GAAoB,gBAAkB,EAAA,GAAA,CAAIW,CAAW,CAE3F+B,CAAAA,CAAAA,CAAc,IAAMD,CAAAA,EAAW,EAAA,EAAA,CAE/BE,EAAwBC,CAAoB,EAAA,CAACF,GAAiB,EAAA,MAAA,CAAO,KAAKD,CAAQ,EAAA,CAAG,WAAY,CAAA,MAAM,CAAE,CAAA,QAAA,CAASG,CAAO,CAEzHC,CAAAA,CAAAA,CAAgCC,GAA4B,CAACJ,CAAAA,IAAiB,MAAO,CAAA,IAAA,CAAKD,CAAQ,EAAA,CAAG,WAAY,CAAA,cAAc,EAAE,QAASK,CAAAA,CAAe,EAEzJC,CAA+BC,CAAAA,CAAAA,EAA2B,CAACN,CAAY,EAAA,EAAK,MAAO,CAAA,IAAA,CAAKD,CAAQ,EAAA,CAAG,YAAY,aAAa,CAAA,CAAE,SAASO,CAAc,MCTrJC,CAAN,CAAA,cAAsC,KAAM,CACjD,WAAA,CAAmBC,EAAuB,IAAMC,CAAAA,CAAAA,CAAU,0BAA2B,CACnF,KAAA,CAAMA,CAAO,CADI,CAAA,IAAA,CAAA,IAAA,CAAAD,CAEjB,CAAA,IAAA,CAAK,IAAO,CAAA,0BACd,CACF,ECNO,IAAME,EAAwB,CACnC,IAAA,CAAM,MACN,CAAA,KAAA,CAAO,OACP,CAAA,GAAA,CAAK,KACP,CAEMC,CAAAA,EAAAA,CAAwB,CAC5B,CAACD,CAAAA,CAAsB,IAAI,EAAG,IAAG,EACjC,CAAA,CAACA,CAAsB,CAAA,KAAK,EAAIE,CAA+B,EAAA,CAC7D,GAAM,CAAE,QAAA,CAAAC,EAAU,QAAAC,CAAAA,CAAS,EAAIF,CAE/B,CAAA,OAAO,SADoB,MAAO,CAAA,IAAA,CAAK,GAAGC,CAAQ,CAAA,CAAA,EAAIC,CAAQ,CAAE,CAAA,CAAA,CAAE,QAAS,CAAA,QAAQ,CACjD,CAAA,CACpC,EACA,CAACJ,CAAAA,CAAsB,GAAG,EAAIE,CAAAA,EAA+B,CAC3D,GAAM,CAAE,MAAAG,CAAAA,CAAO,CAAIH,CAAAA,CAAAA,CACnB,GAAIG,CACF,CAAA,OAAO,UAAcC,EAAK,CAAA,IAAA,CAAA,GAAID,CAAQ,CAAA,CAAE,SAAW,CAAA,EAAG,CAAC,CAAC,EAG5D,CACF,CAAA,CAEaE,GAA0BL,CAA8E,EAAA,CACnH,IAAMM,CAAsBN,CAAAA,CAAAA,EAAuB,OAEnD,GAAI,EAAA,CAACM,GAAuB,CAACP,EAAAA,CAAsBO,CAAmB,CAItE,CAAA,CAAA,OAAOP,GAAsBO,CAAmB,CAAA,CAAEN,CAAqB,CACzE,ECVA,IAAMO,GAA6B,CAI7BC,CAAAA,iBAAAA,CAAAA,EAAAA,CAAgB,CAAC,CAAE,eAAA,CAAAC,EAAkB,EAAC,CAAG,MAAAC,CAAAA,CAAO,CAAiF,CAAA,KAAa,CACzI,CAAA,CAAA,OAAA,CAAQ,CACf,aAAe,CAAA,MAAA,CACf,wBAAyBA,CAAQ,EAAA,oBAAA,CACjC,GAAGD,CACL,CAAC,EACH,EAEM,CAAE,UAAA,CAAAxB,GAAY,QAAAD,CAAAA,EAAS,EAAI2B,EA6BjC,IAAOC,EAAQ,CAAA,CACb,UAAA3B,CAAAA,EAAAA,CACA,SAAAD,EACA,CAAA,IAAA,CAAAE,EACA,UAAAxB,CAAAA,CAAAA,CACA,qBAAAU,CACA,CAAA,8BAAA,CAAAQ,CACA,CAAA,iBAAA,CAAA2B,EACA,CAAA,gBAAA,CAAA1B,EACA,oBAAAQ,CAAAA,CAAAA,CACA,6BAAAE,CACA,CAAA,2BAAA,CAAAE,EACA,WAAAL,CAAAA,CAAAA,CACA,OAAAD,CAAAA,CAAAA,CACA,uBAAAQ,CAAAA,CAAAA,CACA,cAAAlB,CACA,CAAA,sBAAA,CAAAK,EACA,QAAA6B,CAAAA,CAAAA,CACA,sBAAAb,CACA,CAAA,sBAAA,CAAAO,EACA,CAAA,mBAAA,CAAArF,CACF","file":"index.js","sourcesContent":["import jwt from 'jsonwebtoken';\nimport moment from 'moment';\n\nconst {\n  DEPRECATED_JWT_SECRET, JWT_NEW_SECRET,\n  DEPRECATED_REFRESH_JWT_SECRET, REFRESH_JWT_SECRET,\n  DEPRECATION_UNIX_TIMESTAMP,\n} = process.env;\n\nconst getRelevantSecret = (token: string | undefined, deprecatedSecret: string, newSecret: string): string => {\n  const deprecationTime = moment(parseInt(DEPRECATION_UNIX_TIMESTAMP, 10) * 1000);\n  try {\n    let unixTime: moment.Moment;\n    if (token) {\n      const { iat } = jwt.decode(token) as jwt.JwtPayload;\n      unixTime = moment(iat * 1000);\n    } else {\n      unixTime = moment();\n    }\n    return unixTime.isBefore(deprecationTime) ? deprecatedSecret : newSecret;\n  } catch (e) {\n    return newSecret;\n  }\n};\n\nexport const getRefreshTokenSecret = (token?: string): string => getRelevantSecret(token, DEPRECATED_REFRESH_JWT_SECRET, REFRESH_JWT_SECRET);\nexport const getTokenSecret = (token?: string): string => getRelevantSecret(token, DEPRECATED_JWT_SECRET, JWT_NEW_SECRET);\n","import type { UUID } from 'node:crypto';\nimport * as jwt from 'jsonwebtoken';\nimport { getTokenSecret } from './secret-getter';\n\nconst CONTEXT_PROPS = ['fleetId', 'businessModelId', 'demandSourceId'];\nconst CONTEXT_MAP_PROPS = {\n  fleet: 'fleets',\n  business: 'businessModels',\n  demand: 'demandSources',\n};\n\nexport const getAuthFromBearer = (bearer: string): string => bearer.replace('Bearer ', '');\n\nexport const decodeBearer = (bearer: string, appSecret?: string): any => {\n  const token = getAuthFromBearer(bearer);\n  const decoded = jwt.verify(token, appSecret || getTokenSecret(token));\n  return decoded;\n};\n\nexport const parsePermissions = (contextId, decodedToken): any => {\n  if (!decodedToken) { return []; }\n  const { contexts } = decodedToken;\n  const activeContext = contexts.find((context) => context.id === contextId);\n\n  const permissionsValue = `${activeContext.permissions?.map((cp) => `${cp},`)}`;\n\n  return {\n    key: activeContext.entityId,\n    value: permissionsValue,\n  };\n};\n\nexport const getEntitiesFromContext = (contextId: string, decodedToken: any): any => {\n  if (!decodedToken) { return []; }\n  let { contexts } = decodedToken;\n  if (contextId) {\n    contexts = contexts.filter((context) => context.id === contextId);\n  }\n\n  const attributes = {};\n  contexts.forEach((context) => {\n    const prop = CONTEXT_MAP_PROPS[context.subSystem || 'business'];\n\n    const permissions = parsePermissions(context.id, decodedToken);\n    // eslint-disable-next-line no-unused-expressions\n    attributes[prop]\n      ? attributes[prop][permissions.key] = permissions.value\n      : attributes[prop] = { [permissions.key]: permissions.value };\n  });\n\n  return attributes;\n};\n\nexport const getContextAttributes = (contextId: string, decodedToken: any): any => {\n  if (!decodedToken) { return []; }\n  let { contexts } = decodedToken;\n  if (contextId) {\n    contexts = contexts.filter((context) => context.id === contextId);\n  }\n  const attributes = {};\n  contexts.forEach((context) => {\n    CONTEXT_PROPS.forEach((prop) => {\n      if (context[prop]) {\n        const contextPropWrapped = [context[prop]];\n        // eslint-disable-next-line no-unused-expressions\n        attributes[prop]\n          ? attributes[prop] = attributes[prop].concat(contextPropWrapped)\n          : attributes[prop] = contextPropWrapped;\n      }\n    });\n  });\n  return attributes;\n};\n\nconst EMPTY_UUID = '00000000-0000-0000-0000-000000000000';\nconst FULL_UUID = 'ffffffff-ffff-ffff-ffff-ffffffffffff';\nconst VALID_CHARS_REGEX = '[0-9a-f]';\nconst UUID_VERSION_REGEX = '[1-8]';\nconst UUID_REGEX = new RegExp(`^(?:${VALID_CHARS_REGEX}{8}-${VALID_CHARS_REGEX}{4}-${UUID_VERSION_REGEX}${VALID_CHARS_REGEX}{3}-[89ab]${VALID_CHARS_REGEX}{3}-${VALID_CHARS_REGEX}{12}|${EMPTY_UUID}|${FULL_UUID})$`, 'i');\nexport function validateUUID(uuid: unknown): uuid is UUID {\n  return typeof uuid === 'string' && UUID_REGEX.test(uuid);\n}\n","import Network from '@autofleet/network';\n\nconst CACHE_LIFETIME_IN_SEC = 10;\nconst apiGwUrl = process.env.API_GATEWAY_URL || 'https://api.autofleet.io';\n\n// eslint-disable-next-line import/prefer-default-export\nexport const IdentityNetwork = new Network({\n  serviceName: 'IDENTITY_MS',\n  retries: 3,\n  retryCondition: () => true,\n  cache: process.env.NODE_ENV !== 'test' ? {\n    maxAge: CACHE_LIFETIME_IN_SEC * 1000,\n  } : undefined,\n});\n\nexport const AutofleetApiNetwork = new Network({\n  baseURL: apiGwUrl,\n  serviceUrl: apiGwUrl,\n  retries: 3,\n  retryCondition: () => true,\n  cache: process.env.NODE_ENV !== 'test' ? {\n    maxAge: CACHE_LIFETIME_IN_SEC * 1000,\n  } : undefined,\n});\n","import NodeCache from 'node-cache';\nimport objectHash from 'object-hash';\nimport { getCurrentContext } from '@autofleet/outbreak';\nimport { validateUUID } from '../utils';\nimport { AutofleetApiNetwork, IdentityNetwork } from '../services';\n\nexport type AccountType = 'client' | 'user' | 'service' | 'driver'\ninterface EntityPermissions {\n    [key: string]: string[];\n}\n\nexport const ELEVATED_PERMISSIONS_HEADER = 'x-af-elevated-permissions';\nexport const CONTEXTS_IDS_HEADER = 'x-af-context-ids';\n\nexport interface UserPayload {\n  businessModels: EntityPermissions;\n  fleets: EntityPermissions;\n  demandSources: EntityPermissions;\n  businessAccounts?: EntityPermissions;\n  accountType?: AccountType;\n  contexts?: EntityPermissions;\n  createdAt?: string;\n}\n\nexport interface PartialUserPayload {\n  businessModels?: EntityPermissions;\n  fleets?: EntityPermissions;\n  demandSources?: EntityPermissions;\n  vehicles?: EntityPermissions;\n  drivers?: EntityPermissions;\n  businessAccounts?: EntityPermissions;\n}\n\nexport type CustomPermissionLoader = (string) => Promise<UserPayload>;\n\nconst userCache = new NodeCache({ stdTTL: 10 });\n\nconst mergePermissions = (target: UserPayload, sources: Iterable<PartialUserPayload>): UserPayload => {\n  const permissions: UserPayload = {\n    ...target,\n    fleets: { ...target?.fleets },\n    businessModels: { ...target?.businessModels },\n    demandSources: { ...target?.demandSources },\n    // Clone other nested objects as needed\n  };\n\n  // eslint-disable-next-line no-restricted-syntax\n  for (const source of sources) {\n    Object.keys(source).forEach((entityType) => {\n      // eslint-disable-next-line no-param-reassign\n      permissions[entityType] ??= {};\n      Object.entries(source[entityType]!).forEach(([entityId, perms]) => {\n        // eslint-disable-next-line no-param-reassign\n        permissions[entityType][entityId] = (permissions[entityType][entityId] || []).concat(perms);\n      });\n    });\n  }\n\n  return permissions;\n};\n\nexport default class ApiUser {\n  private privatePermissions: UserPayload | undefined;\n\n  private readonly privateElevatedPermissionsHash = new Map<symbol, PartialUserPayload | undefined>();\n\n  private privatePermissionsLegacy: any;\n\n  private readonly appPermission: {[key: string]: any; } = {};\n\n  public readonly emptyUser: boolean;\n\n  constructor(public id? : string, public accountType?: AccountType, elevatedPermissions?: PartialUserPayload, public contextIds?: string[]) {\n    this.emptyUser = !!id;\n    if (elevatedPermissions) {\n      this.privateElevatedPermissionsHash.set(Symbol('initial'), elevatedPermissions);\n    }\n  }\n\n  async getUserPermissions(): Promise<UserPayload> {\n    if (!this.id) {\n      return undefined;\n    }\n    if (this.privatePermissions) {\n      return this.privatePermissions;\n    }\n    const cacheKey = objectHash({\n      id: this.id,\n      contextIds: this.contextIds,\n    });\n\n    let data = userCache.get<UserPayload>(cacheKey);\n\n    if (!data) {\n      ({ data } = await IdentityNetwork.get(`/api/v1/users/${this.id}/authorization-payload`, { params: { contextIds: this.contextIds } }));\n      userCache.set(cacheKey, data);\n    }\n\n    this.accountType = data.accountType;\n    this.privatePermissions = data;\n    return this.privatePermissions;\n  }\n\n  async useCustomPermissionLoader(customPermissionLoader: any): Promise<UserPayload> {\n    if (!this.id) {\n      return undefined;\n    }\n    if (this.privatePermissions) {\n      return this.privatePermissions;\n    }\n\n    const cacheKey = this.id;\n\n    const cachedResult = userCache.get<UserPayload>(cacheKey);\n    if (cachedResult) {\n      this.privatePermissions = cachedResult;\n      return cachedResult;\n    }\n\n    const data = await customPermissionLoader(this.id);\n    userCache.set(cacheKey, data);\n\n    this.privatePermissions = data;\n    return this.privatePermissions;\n  }\n\n  get businessModels(): string[] | undefined {\n    return this.getUserProperty('businessModels');\n  }\n\n  get fleets(): string[] | undefined {\n    return this.getUserProperty('fleets');\n  }\n\n  get demandSources(): string[] | undefined {\n    return this.getUserProperty('demandSources');\n  }\n\n  private getUserProperty(key: keyof UserPayload): string[] | undefined {\n    if (!this.privatePermissions) {\n      throw new Error(`Cannot get ${key} without calling (async) getUserPermissions before`);\n    }\n    return Object.keys(this.privatePermissions[key] || {});\n  }\n\n  get elevatedPermissions(): UserPayload {\n    return mergePermissions(undefined, this.privateElevatedPermissionsHash.values());\n  }\n\n  get permissions(): UserPayload | undefined {\n    if (!this.privatePermissions) {\n      throw new Error('Cannot get permissions without calling (async) getUserPermissions before');\n    }\n\n    return mergePermissions(this.privatePermissions, this.privateElevatedPermissionsHash.values());\n  }\n\n  elevatePermissions(addedPermissions: PartialUserPayload): () => void {\n    // @itayankri is concerned about memory consumption, so create a symbol with no description, to avoid assigning memory for the description string\n    // eslint-disable-next-line symbol-description\n    const elevationId = Symbol();\n\n    // Validate that the added permissions are valid UUIDs\n    Object.values(addedPermissions).forEach((entityIds) => {\n      Object.keys(entityIds).forEach((entityId) => {\n        if (!validateUUID(entityId)) {\n          throw new Error(`Entity id on elevatePermissions is not a valid UUID, provided: ${entityId}`);\n        }\n      });\n    });\n\n    const currentUserTrace = getCurrentContext();\n    if (!currentUserTrace) {\n      throw new Error('Cannot find current user cross services trace');\n    }\n\n    const currentElevation = JSON.parse(currentUserTrace.context[ELEVATED_PERMISSIONS_HEADER] || '{}');\n    const newElevation = Object.assign(currentElevation, addedPermissions);\n    this.privateElevatedPermissionsHash.set(elevationId, newElevation);\n    currentUserTrace.context.set(ELEVATED_PERMISSIONS_HEADER, JSON.stringify(this.elevatedPermissions));\n    return () => {\n      this.privateElevatedPermissionsHash.delete(elevationId);\n      currentUserTrace.context.set(ELEVATED_PERMISSIONS_HEADER, JSON.stringify(this.elevatedPermissions));\n    };\n  }\n\n  async getUserPermissionsLegacy() {\n    if (!this.id) {\n      return undefined;\n    }\n    if (this.privatePermissionsLegacy) {\n      return this.privatePermissionsLegacy;\n    }\n    const { data } = await IdentityNetwork.get(`/api/v1/users/${this.id}/authorization-payload-legacy`);\n\n    this.privatePermissionsLegacy = data;\n    return this.privatePermissionsLegacy;\n  }\n\n  get permissionsLegacy(): any {\n    if (!this.privatePermissionsLegacy) {\n      throw new Error('Cannot get permissionsLegacy without calling (async) getUserPermissionsLegacy before');\n    }\n    return this.privatePermissionsLegacy;\n  }\n\n  async getUserAppPermissions(appId, clientSecret) {\n    if (!this.id || !appId || !clientSecret) {\n      return undefined;\n    }\n    const currentAppPermission = this.appPermission[appId];\n\n    if (currentAppPermission) {\n      return currentAppPermission;\n    }\n\n    const cacheKey = `${this.id}:${appId}`;\n\n    const cachedResult = userCache.get<UserPayload>(cacheKey);\n    if (cachedResult) {\n      this.appPermission[appId] = cachedResult;\n      return cachedResult;\n    }\n\n    const { data } = await AutofleetApiNetwork.post(`/api/v1/apps/${appId}/get-user-payload`, {\n      userId: this.id,\n    }, {\n      headers: {\n        'x-autofleet-apps-secret': clientSecret,\n      },\n    });\n\n    userCache.set(cacheKey, data);\n    this.appPermission[appId] = data;\n    return this.appPermission[appId];\n  }\n}\n","import { AutofleetApiNetwork } from './services';\n\nexport const decodeAppBearer = async (bearer: string, appId: string): Promise<any> => {\n  const { data: decoded } = await AutofleetApiNetwork.post('/api/v1/auth', { bearer, appId });\n  return decoded;\n};\n\nexport const getClientSecret = async (appId: string): Promise<any> => {\n  const { data: secret } = await AutofleetApiNetwork.get(`/api/v1/auth/client-secret/${appId}`);\n  return secret;\n};\n","export default class AppDoesNotExist extends Error {\n  name = 'AppDoesNotExist';\n\n  message = 'app does not exist';\n}\n","import { getCurrentContext, newTrace, traceTypes } from '@autofleet/outbreak';\nimport { TokenExpiredError, JsonWebTokenError } from 'jsonwebtoken';\nimport ApiUser, { CONTEXTS_IDS_HEADER, CustomPermissionLoader, ELEVATED_PERMISSIONS_HEADER } from './ApiUser';\nimport { decodeAppBearer } from '../app-auth';\nimport AppDoesNotExist from '../exceptions/appDoesNotExist';\nimport { decodeBearer, getAuthFromBearer } from '../utils';\n\nconst IDENTITY_MS = 'identity-ms';\nconst ACCESS_TOKEN = 'accessToken';\nexport const USER_OBJECT = 'userObject';\nconst USER_TRACING_HEADER = 'x-af-user-id';\nconst ORIGIN_HEADER = 'X-IAF-ORIGIN-SERVICE';\nconst USER_PERMISSIONS_HEADER = 'x-af-user-permissions';\nconst LOWER_CASE_ORIGIN_HEADER = ORIGIN_HEADER.toLowerCase();\n\nexport const middleware = (options: {\n    eagerLoadUserPermissions?: boolean;\n    eagerLoadUserPermissionsLegacy?: boolean;\n    customPermissionLoader?: CustomPermissionLoader;\n} = {}) => async (req, res, next): Promise<any> => {\n  try {\n    const originHeader: string = req.headers[ORIGIN_HEADER] || req.headers[LOWER_CASE_ORIGIN_HEADER] || '';\n    if (originHeader.toLowerCase() === IDENTITY_MS) {\n      return next();\n    }\n    const {\n      eagerLoadUserPermissions,\n      eagerLoadUserPermissionsLegacy,\n      customPermissionLoader,\n    } = options;\n    const userId = req.headers[USER_TRACING_HEADER];\n    if (!userId) {\n      return next();\n    }\n\n    const elevatedPermissionsFromHeader = req.headers[ELEVATED_PERMISSIONS_HEADER]?.length > 0 ? JSON.parse(req.headers[ELEVATED_PERMISSIONS_HEADER]) : {};\n    const contextIds = (req.headers?.[CONTEXTS_IDS_HEADER] as string)?.split(',');\n\n    const userObject = new ApiUser(userId, 'user', elevatedPermissionsFromHeader, contextIds);\n    if (eagerLoadUserPermissions) {\n      if (customPermissionLoader) {\n        await userObject.useCustomPermissionLoader(customPermissionLoader);\n      } else {\n        await userObject.getUserPermissions();\n      }\n    }\n\n    if (eagerLoadUserPermissionsLegacy) {\n      await userObject.getUserPermissionsLegacy();\n    }\n\n    req.user = userObject;\n    getCurrentContext().nonHeaderContext?.set(USER_OBJECT, userObject);\n\n    // Added in order to support outbreak.\n    req.headers[USER_PERMISSIONS_HEADER] = userObject;\n\n    return next();\n  } catch (e) {\n    res.status(401);\n    return res.json({\n      error: 'cannot authenticate user',\n    });\n  }\n};\n\nexport const middlewareWithDecode = (options: {\n  eagerLoadUserPermissions?: boolean;\n  eagerLoadUserPermissionsLegacy?: boolean;\n  returnErrorIfNoToken?: boolean\n} = {}) => async (req, res, next): Promise<void> => {\n  const {\n    eagerLoadUserPermissions,\n    eagerLoadUserPermissionsLegacy,\n    returnErrorIfNoToken,\n  } = options;\n  let decoded;\n  if (req.headers.authorization) {\n    try {\n      decoded = await decodeBearer(req.headers.authorization);\n    } catch (e) {\n      if (e instanceof TokenExpiredError) {\n        res.status(401);\n        res.json({\n          errors: ['Access token expired'],\n        });\n      } else if (e instanceof JsonWebTokenError) {\n        res.status(400);\n        res.json({\n          errors: [e.message],\n        });\n      } else {\n        res.status(500);\n        res.json({\n          errors: ['Server error while parsing token'],\n        });\n      }\n      return undefined;\n    }\n    const userId = decoded?.user?.id;\n\n    if (userId) {\n      req.headers[USER_TRACING_HEADER] = userId;\n    }\n\n    const contextIds = (req.headers?.[CONTEXTS_IDS_HEADER] as string)?.split(',');\n    const userObject = new ApiUser(userId, decoded?.user?.accountType, undefined, contextIds);\n\n    if (eagerLoadUserPermissions) {\n      await userObject.getUserPermissions();\n    }\n\n    if (eagerLoadUserPermissionsLegacy) {\n      await userObject.getUserPermissionsLegacy();\n    }\n\n    req.user = userObject;\n    getCurrentContext().nonHeaderContext?.set(USER_OBJECT, userObject);\n\n    // Added in order to support outbreak.\n    req.headers[USER_PERMISSIONS_HEADER] = userObject;\n  } else if (returnErrorIfNoToken) {\n    res.status(401);\n    return res.json({\n      errors: ['No token provided'],\n    });\n  }\n  return next();\n};\n\nexport const appMiddleware = (options: {\n  appId: string,\n  clientSecret: string\n}) => async (req, res, next): Promise<void> => {\n  const {\n    appId,\n    clientSecret,\n  } = options;\n  let decoded;\n\n  if (!req.headers.authorization) {\n    res.status(401);\n    return res.json({\n      errors: ['No token provided'],\n    });\n  }\n\n  try {\n    decoded = await decodeAppBearer(req.headers.authorization, appId);\n    if (!decoded) {\n      throw new AppDoesNotExist();\n    }\n  } catch (e) {\n    if (e instanceof TokenExpiredError) {\n      return res.status(401).json({\n        errors: ['Access token expired'],\n      });\n    }\n    if ([JsonWebTokenError, AppDoesNotExist].some((Err) => e instanceof Err)) {\n      return res.status(400).json({\n        errors: [e.message],\n      });\n    }\n    return res.status(500).json({\n      errors: ['Server error while parsing token'],\n    });\n  }\n  const userId = decoded?.userId;\n  if (userId) {\n    req.headers[USER_OBJECT] = userId;\n  }\n\n  const userObject = new ApiUser(userId);\n\n  if (appId) {\n    req.headers['x-autofleet-apps-secret'] = clientSecret;\n    // Won't work until we find a better solution for identity ms\n    await userObject.getUserAppPermissions(appId, clientSecret);\n  }\n\n  req.user = userObject;\n  const currentTraceContext = getCurrentContext().nonHeaderContext;\n  currentTraceContext?.set(USER_OBJECT, userObject);\n  currentTraceContext?.set(ACCESS_TOKEN, getAuthFromBearer(req.headers.authorization));\n\n  // Added in order to support outbreak.\n  req.headers[USER_PERMISSIONS_HEADER] = userObject;\n\n  return next();\n};\n\nexport const eagerLoadPermissionsMiddleware = async (req, res, next) => {\n  await req.user.getUserPermissions();\n  return next();\n};\n\nexport const getDecodedBearer = (req) => {\n  if (req.headers.authorization) {\n    return decodeBearer(req.headers.authorization);\n  }\n\n  return null;\n};\n\nexport const createOrSetRabbitTrace = async (trace: ReturnType<typeof newTrace> | undefined, userId: string | undefined) => {\n  const userObject = new ApiUser(userId);\n\n  await userObject.getUserPermissions();\n  // eslint-disable-next-line no-param-reassign\n  trace ??= newTrace(traceTypes.RABBIT);\n  trace.nonHeaderContext.set(USER_OBJECT, userObject);\n};\n\nexport default ApiUser;\n","import { getCurrentContext } from '@autofleet/outbreak';\nimport ApiUser from './user/ApiUser';\nimport { USER_OBJECT } from './user';\n\nexport const getUser = () : ApiUser | undefined => getCurrentContext().nonHeaderContext?.get(USER_OBJECT) as ApiUser | undefined;\n\nexport const isUserExist = () => getUser()?.id;\n\nexport const checkFleetPermission = (fleetId: string) => !isUserExist() || Object.keys(getUser()!.permissions.fleets).includes(fleetId);\n\nexport const checkBusinessModelPermission = (businessModelId: string) => !isUserExist() || Object.keys(getUser()!.permissions.businessModels).includes(businessModelId);\n\nexport const checkDemandSourcePermission = (demandSourceId: string) => !isUserExist() || Object.keys(getUser()!.permissions.demandSources).includes(demandSourceId);\n","import type ApiUser from './user';\n\n// eslint-disable-next-line import/prefer-default-export\nexport class UnauthorizedAccessError extends Error {\n  constructor(public user: ApiUser | null = null, message = 'UnauthorizedAccessError') {\n    super(message);\n    this.name = 'UnauthorizedAccessError';\n  }\n}\n","import * as jwt from 'jsonwebtoken';\n\nexport const AUTHORIZATION_METHODS = {\n  NONE: 'NONE',\n  BASIC: 'BASIC',\n  JWT: 'JWT',\n};\n\nconst AUTHORIZATION_ACTIONS = {\n  [AUTHORIZATION_METHODS.NONE]: () => undefined,\n  [AUTHORIZATION_METHODS.BASIC]: (authorizationSettings: any) => {\n    const { username, password } = authorizationSettings;\n    const encodedCredentials = Buffer.from(`${username}:${password}`).toString('base64');\n    return `Basic ${encodedCredentials}`;\n  },\n  [AUTHORIZATION_METHODS.JWT]: (authorizationSettings: any) => {\n    const { secret } = authorizationSettings;\n    if (secret) {\n      return `Bearer ${jwt.sign({}, secret, { expiresIn: 10 })}`;\n    }\n    return undefined;\n  },\n};\n\nexport const getAuthorizationHeader = (authorizationSettings: { method: string } | undefined): string | undefined => {\n  const authorizationMethod = authorizationSettings?.method;\n\n  if (!authorizationMethod || !AUTHORIZATION_ACTIONS[authorizationMethod]) {\n    return undefined;\n  }\n\n  return AUTHORIZATION_ACTIONS[authorizationMethod](authorizationSettings);\n};\n","import type { LoggerInstanceManager } from '@autofleet/logger';\nimport * as outbreak from '@autofleet/outbreak';\nimport User, {\n  middleware,\n  eagerLoadPermissionsMiddleware,\n  middlewareWithDecode,\n  getDecodedBearer,\n  appMiddleware,\n  createOrSetRabbitTrace,\n} from './user';\nimport { type UserPayload, CONTEXTS_IDS_HEADER } from './user/ApiUser';\nimport {\n  checkFleetPermission,\n  checkBusinessModelPermission,\n  checkDemandSourcePermission,\n  isUserExist,\n  getUser,\n} from './check-permission';\nimport { UnauthorizedAccessError } from './errors';\nimport { getRefreshTokenSecret, getTokenSecret } from './secret-getter';\nimport { AUTHORIZATION_METHODS, getAuthorizationHeader } from './authorization';\n\nconst getCurrentPayload = outbreak.getCurrentContext;\n\ntype OutbreakOptions = Parameters<typeof outbreak.default>[0];\ntype LoggerWithContextMiddleware = Partial<Pick<LoggerInstanceManager, 'addContextMiddleware'>>;\nconst enableTracing = ({ outbreakOptions = {}, logger }: { outbreakOptions?: OutbreakOptions, logger?: LoggerWithContextMiddleware } = {}): void => {\n  outbreak.default({\n    headersPrefix: 'x-af',\n    contextMiddlewareGetter: logger?.addContextMiddleware,\n    ...outbreakOptions,\n  });\n};\n\nconst { traceTypes, newTrace } = outbreak;\n\nexport {\n  traceTypes,\n  newTrace,\n  enableTracing,\n  User,\n  middleware,\n  middlewareWithDecode,\n  eagerLoadPermissionsMiddleware,\n  getCurrentPayload,\n  getDecodedBearer,\n  checkFleetPermission,\n  checkBusinessModelPermission,\n  checkDemandSourcePermission,\n  isUserExist,\n  getUser,\n  getRefreshTokenSecret,\n  getTokenSecret,\n  UnauthorizedAccessError,\n  appMiddleware,\n  createOrSetRabbitTrace,\n  outbreak,\n  AUTHORIZATION_METHODS,\n  getAuthorizationHeader,\n  type UserPayload,\n  CONTEXTS_IDS_HEADER,\n};\n\nexport default {\n  traceTypes,\n  newTrace,\n  User,\n  middleware,\n  middlewareWithDecode,\n  eagerLoadPermissionsMiddleware,\n  getCurrentPayload,\n  getDecodedBearer,\n  checkFleetPermission,\n  checkBusinessModelPermission,\n  checkDemandSourcePermission,\n  isUserExist,\n  getUser,\n  UnauthorizedAccessError,\n  appMiddleware,\n  createOrSetRabbitTrace,\n  outbreak,\n  AUTHORIZATION_METHODS,\n  getAuthorizationHeader,\n  CONTEXTS_IDS_HEADER,\n};\n"]}
+{"version":3,"sources":["../src/secret-getter.ts","../src/utils.ts","../src/services.ts","../src/user/ApiUser.ts","../src/app-auth.ts","../src/exceptions/appDoesNotExist.ts","../src/user/const.ts","../src/user/common.ts","../src/user/index.ts","../src/user/fastify.ts","../src/check-permission.ts","../src/errors.ts","../src/authorization.ts","../src/index.ts"],"names":["DEPRECATED_JWT_SECRET","JWT_NEW_SECRET","DEPRECATED_REFRESH_JWT_SECRET","REFRESH_JWT_SECRET","DEPRECATION_UNIX_TIMESTAMP","getRelevantSecret","token","deprecatedSecret","newSecret","deprecationTime","moment","unixTime","iat","jwt","getRefreshTokenSecret","getTokenSecret","getAuthFromBearer","bearer","decodeBearer","appSecret","M","EMPTY_UUID","FULL_UUID","VALID_CHARS_REGEX","UUID_VERSION_REGEX","UUID_REGEX","validateUUID","uuid","CACHE_LIFETIME_IN_SEC","apiGwUrl","IdentityNetwork","Network","AutofleetApiNetwork","ELEVATED_PERMISSIONS_HEADER","CONTEXTS_IDS_HEADER","userCache","NodeCache","mergePermissions","target","sources","permissions","source","entityType","entityId","perms","ApiUser","id","accountType","elevatedPermissions","contextIds","cacheKey","objectHash","data","customPermissionLoader","cachedResult","key","addedPermissions","elevationId","entityIds","currentUserTrace","getCurrentContext","currentElevation","newElevation","appId","clientSecret","currentAppPermission","decodeAppBearer","decoded","AppDoesNotExist","IDENTITY_MS","ACCESS_TOKEN","USER_OBJECT","USER_TRACING_HEADER","ORIGIN_HEADER","USER_PERMISSIONS_HEADER","LOWER_CASE_ORIGIN_HEADER","AUTOFLEET_APPS_SECRET_HEADER","authFromUserIdHeader","options","headers","originHeader","eagerLoadUserPermissions","eagerLoadUserPermissionsLegacy","userId","elevatedPermissionsFromHeader","userObject","middleware","req","res","next","middlewareWithDecode","returnErrorIfNoToken","e","appMiddleware","Err","currentTraceContext","eagerLoadPermissionsMiddleware","getDecodedBearer","createOrSetRabbitTrace","trace","newTrace","traceTypes","user_default","authFromUserIdHeaderPlugin","fastify","done","request","reply","user","getUser","isUserExist","checkUserPermissions","checkFleetPermission","fleetId","checkBusinessModelPermission","businessModelId","checkDemandSourcePermission","demandSourceId","UnauthorizedAccessError","message","AUTHORIZATION_METHODS","AUTHORIZATION_ACTIONS","authorizationSettings","username","password","secret","ae","getAuthorizationHeader","authorizationMethod","getCurrentPayload","enableTracing","outbreakOptions","logger","outbreak","index_default"],"mappings":"wTAGA,IAAM,CACJ,qBAAA,CAAAA,EAAuB,CAAA,cAAA,CAAAC,GACvB,6BAAAC,CAAAA,EAAAA,CAA+B,kBAAAC,CAAAA,EAAAA,CAC/B,0BAAAC,CAAAA,EACF,EAAI,OAAQ,CAAA,GAAA,CAENC,CAAoB,CAAA,CAACC,CAA2BC,CAAAA,CAAAA,CAA0BC,IAA8B,CAC5G,IAAMC,EAAkBC,CAAO,CAAA,QAAA,CAASN,GAA4B,EAAE,CAAA,CAAI,GAAI,CAAA,CAC9E,GAAI,CACF,IAAIO,CACJ,CAAA,GAAIL,CAAO,CAAA,CACT,GAAM,CAAE,IAAAM,CAAI,CAAA,CAAIC,UAAI,CAAA,MAAA,CAAOP,CAAK,CAAA,CAChCK,EAAWD,CAAOE,CAAAA,CAAAA,CAAM,GAAI,EAC9B,CAAA,KACED,EAAWD,CAAO,EAAA,CAEpB,OAAOC,CAAAA,CAAS,QAASF,CAAAA,CAAe,EAAIF,CAAmBC,CAAAA,CACjE,CAAY,KAAA,CACV,OAAOA,CACT,CACF,CAEaM,CAAAA,EAAAA,CAAyBR,CAA2BD,EAAAA,CAAAA,CAAkBC,CAAOJ,CAAAA,EAAAA,CAA+BC,EAAkB,CAC9HY,CAAAA,CAAAA,CAAkBT,GAA2BD,CAAkBC,CAAAA,CAAAA,CAAON,GAAuBC,EAAc,ECfjH,IAAMe,CAAAA,CAAqBC,CAA2BA,EAAAA,CAAAA,CAAO,QAAQ,SAAW,CAAA,EAAE,CAE5EC,CAAAA,CAAAA,CAAe,CAACD,CAAAA,CAAgBE,IAA4B,CACvE,IAAMb,CAAQU,CAAAA,CAAAA,CAAkBC,CAAM,CAAA,CAEtC,OADoBG,CAAOd,CAAAA,MAAAA,CAAAA,CAAAA,CAAoBS,CAAeT,CAAAA,CAAK,CAAC,CAEtE,CAAA,CAqDA,IAAMe,EAAAA,CAAa,sCACbC,CAAAA,EAAAA,CAAY,uCACZC,CAAoB,CAAA,UAAA,CACpBC,EAAqB,CAAA,OAAA,CACrBC,EAAa,CAAA,IAAI,OACrB,CAAOF,IAAAA,EAAAA,CAAiB,CAAOA,IAAAA,EAAAA,CAAiB,CAAOC,IAAAA,EAAAA,EAAkB,GAAGD,CAAiB,CAAA,UAAA,EAAaA,CAAiB,CAAOA,IAAAA,EAAAA,CAAiB,QAAQF,EAAU,CAAA,CAAA,EAAIC,EAAS,CAAA,EAAA,CAAA,CAClL,GACF,CAAA,CACO,SAASI,CAAaC,CAAAA,CAAAA,CAA6B,CACxD,OAAO,OAAOA,CAAAA,EAAS,UAAYF,EAAW,CAAA,IAAA,CAAKE,CAAI,CACzD,CC9EA,IAAMC,EAAwB,EACxBC,CAAAA,CAAAA,CAAW,QAAQ,GAAI,CAAA,eAAA,EAAmB,0BAGnCC,CAAAA,CAAAA,CAAkB,IAAIC,CAAAA,CAAQ,CACzC,WAAa,CAAA,aAAA,CACb,OAAS,CAAA,CAAA,CACT,cAAgB,CAAA,IAAM,KACtB,KAAO,CAAA,OAAA,CAAQ,GAAI,CAAA,QAAA,GAAa,MAAS,CAAA,CACvC,OAAQH,CAAwB,CAAA,GAClC,EAAI,MACN,CAAC,EAEYI,CAAsB,CAAA,IAAID,CAAQ,CAAA,CAC7C,OAASF,CAAAA,CAAAA,CACT,WAAYA,CACZ,CAAA,OAAA,CAAS,CACT,CAAA,cAAA,CAAgB,IAAM,IAAA,CACtB,MAAO,OAAQ,CAAA,GAAA,CAAI,QAAa,GAAA,MAAA,CAAS,CACvC,MAAA,CAAQD,EAAwB,GAClC,CAAA,CAAI,MACN,CAAC,CAAA,KCZYK,CAA8B,CAAA,2BAAA,CAC9BC,CAAsB,CAAA,kBAAA,CAqB7BC,CAAY,CAAA,IAAIC,GAAU,CAAE,MAAA,CAAQ,EAAG,CAAC,CAExCC,CAAAA,CAAAA,CAAmB,CAACC,CAAqBC,CAAAA,CAAAA,GAAuD,CACpG,IAAMC,CAA2B,CAAA,CAC/B,GAAGF,CACH,CAAA,MAAA,CAAQ,CAAE,GAAGA,CAAAA,EAAQ,MAAO,CAC5B,CAAA,cAAA,CAAgB,CAAE,GAAGA,CAAQ,EAAA,cAAe,EAC5C,aAAe,CAAA,CAAE,GAAGA,CAAAA,EAAQ,aAAc,CAE5C,EAGA,IAAWG,IAAAA,CAAAA,IAAUF,CACnB,CAAA,MAAA,CAAO,IAAKE,CAAAA,CAAM,EAAE,OAASC,CAAAA,CAAAA,EAAe,CAE1CF,CAAYE,CAAAA,CAAU,IAAM,EAAC,CAC7B,MAAO,CAAA,OAAA,CAAQD,CAAOC,CAAAA,CAAU,CAAE,CAAE,CAAA,OAAA,CAAQ,CAAC,CAACC,CAAUC,CAAAA,CAAK,IAAM,CAEjEJ,CAAAA,CAAYE,CAAU,CAAA,CAAEC,CAAQ,CAAA,CAAA,CAAKH,EAAYE,CAAU,CAAA,CAAEC,CAAQ,CAAK,EAAA,IAAI,MAAOC,CAAAA,CAAK,EAC5F,CAAC,EACH,CAAC,EAGH,OAAOJ,CACT,CAEqBK,CAAAA,CAAAA,CAArB,KAA6B,CAW3B,YAAmBC,CAAqBC,CAAAA,CAAAA,CAA2BC,CAAiDC,CAAAA,CAAAA,CAAuB,CAAxH,IAAA,CAAA,EAAA,CAAAH,EAAqB,IAAAC,CAAAA,WAAAA,CAAAA,CAAAA,CAA4E,gBAAAE,CARpH,CAAA,IAAA,CAAiB,+BAAiC,IAAI,GAAA,CAItD,IAAiB,CAAA,aAAA,CAAwC,EAAC,CAKxD,KAAK,SAAY,CAAA,CAAC,CAACH,CAAAA,CACfE,CACF,EAAA,IAAA,CAAK,+BAA+B,GAAI,CAAA,MAAA,CAAO,SAAS,CAAA,CAAGA,CAAmB,EAElF,CAEA,MAAa,kBAAA,EAA2C,CACtD,GAAI,CAAC,KAAK,EACR,CAAA,OAEF,GAAI,IAAA,CAAK,kBACP,CAAA,OAAO,KAAK,kBAEd,CAAA,IAAME,CAAWC,CAAAA,EAAAA,CAAW,CAC1B,EAAA,CAAI,KAAK,EACT,CAAA,UAAA,CAAY,IAAK,CAAA,UACnB,CAAC,CAAA,CAEGC,EAAOjB,CAAU,CAAA,GAAA,CAAiBe,CAAQ,CAE9C,CAAA,OAAKE,IACF,CAAE,IAAA,CAAAA,CAAK,CAAA,CAAI,MAAMtB,CAAAA,CAAgB,IAAiB,CAAiB,cAAA,EAAA,IAAA,CAAK,EAAE,CAAA,sBAAA,CAAA,CAA0B,CAAE,MAAA,CAAQ,CAAE,UAAY,CAAA,IAAA,CAAK,UAAW,CAAE,CAAC,CAAA,CAChJK,EAAU,GAAIe,CAAAA,CAAAA,CAAUE,CAAI,CAG9B,CAAA,CAAA,IAAA,CAAK,YAAcA,CAAK,CAAA,WAAA,CACxB,IAAK,CAAA,kBAAA,CAAqBA,CACnB,CAAA,IAAA,CAAK,kBACd,CAEA,MAAa,0BAA0BC,CAA0G,CAAA,CAC/I,GAAI,CAAC,IAAA,CAAK,EACR,CAAA,OAEF,GAAI,IAAA,CAAK,mBACP,OAAO,IAAA,CAAK,mBAGd,IAAMH,CAAAA,CAAW,KAAK,EAEhBI,CAAAA,CAAAA,CAAenB,CAAU,CAAA,GAAA,CAAiBe,CAAQ,CAAA,CACxD,GAAII,CACF,CAAA,OAAA,IAAA,CAAK,kBAAqBA,CAAAA,CAAAA,CACnBA,CAGT,CAAA,IAAMF,EAAO,MAAMC,CAAAA,CAAuB,IAAK,CAAA,EAAE,CACjD,CAAA,OAAAlB,EAAU,GAAIe,CAAAA,CAAAA,CAAUE,CAAI,CAE5B,CAAA,IAAA,CAAK,mBAAqBA,CACnB,CAAA,IAAA,CAAK,kBACd,CAEA,IAAW,cAAA,EAAuC,CAChD,OAAO,IAAA,CAAK,eAAgB,CAAA,gBAAgB,CAC9C,CAEA,IAAW,MAA+B,EAAA,CACxC,OAAO,IAAA,CAAK,eAAgB,CAAA,QAAQ,CACtC,CAEA,IAAW,eAAsC,CAC/C,OAAO,KAAK,eAAgB,CAAA,eAAe,CAC7C,CAEQ,eAAgBG,CAAAA,CAAAA,CAA8C,CACpE,GAAI,CAAC,IAAK,CAAA,kBAAA,CACR,MAAM,IAAI,MAAM,CAAcA,WAAAA,EAAAA,CAAG,CAAoD,kDAAA,CAAA,CAAA,CAEvF,OAAO,MAAA,CAAO,KAAK,IAAK,CAAA,kBAAA,CAAmBA,CAAG,CAAK,EAAA,EAAE,CACvD,CAEA,IAAW,mBAAA,EAAmC,CAC5C,OAAOlB,EAAiB,MAAW,CAAA,IAAA,CAAK,8BAA+B,CAAA,MAAA,EAAQ,CACjF,CAEA,IAAW,WAAA,EAAuC,CAChD,GAAI,CAAC,IAAA,CAAK,mBACR,MAAM,IAAI,MAAM,0EAA0E,CAAA,CAG5F,OAAOA,CAAiB,CAAA,IAAA,CAAK,kBAAoB,CAAA,IAAA,CAAK,8BAA+B,CAAA,MAAA,EAAQ,CAC/F,CAEO,kBAAmBmB,CAAAA,CAAAA,CAAkD,CAG1E,IAAMC,EAAc,MAAO,EAAA,CAG3B,MAAO,CAAA,MAAA,CAAOD,CAAgB,CAAA,CAAE,QAASE,CAAc,EAAA,CACrD,OAAO,IAAKA,CAAAA,CAAS,EAAE,OAASf,CAAAA,CAAAA,EAAa,CAC3C,GAAI,CAACjB,CAAAA,CAAaiB,CAAQ,CACxB,CAAA,MAAM,IAAI,KAAA,CAAM,CAAkEA,+DAAAA,EAAAA,CAAQ,EAAE,CAEhG,CAAC,EACH,CAAC,CAED,CAAA,IAAMgB,EAAmBC,iBAAkB,EAAA,CAC3C,GAAI,CAACD,CAAAA,CACH,MAAM,IAAI,KAAA,CAAM,+CAA+C,CAAA,CAGjE,IAAME,CAAAA,CAAmB,KAAK,KAAMF,CAAAA,CAAAA,CAAiB,OAAQ1B,CAAAA,CAA2B,CAAK,EAAA,IAAI,EAC3F6B,CAAe,CAAA,MAAA,CAAO,MAAOD,CAAAA,CAAAA,CAAkBL,CAAgB,CAAA,CACrE,YAAK,8BAA+B,CAAA,GAAA,CAAIC,EAAaK,CAAY,CAAA,CACjEH,EAAiB,OAAQ,CAAA,GAAA,CAAI1B,CAA6B,CAAA,IAAA,CAAK,SAAU,CAAA,IAAA,CAAK,mBAAmB,CAAC,CAAA,CAC3F,IAAM,CACX,IAAK,CAAA,8BAAA,CAA+B,OAAOwB,CAAW,CAAA,CACtDE,CAAiB,CAAA,OAAA,CAAQ,GAAI1B,CAAAA,CAAAA,CAA6B,KAAK,SAAU,CAAA,IAAA,CAAK,mBAAmB,CAAC,EACpG,CACF,CAEA,MAAa,wBAA2B,EAAA,CACtC,GAAI,CAAC,KAAK,EACR,CAAA,OAEF,GAAI,IAAA,CAAK,wBACP,CAAA,OAAO,KAAK,wBAEd,CAAA,GAAM,CAAE,IAAA,CAAAmB,CAAK,CAAA,CAAI,MAAMtB,CAAgB,CAAA,GAAA,CAAI,iBAAiB,IAAK,CAAA,EAAE,+BAA+B,CAElG,CAAA,OAAA,IAAA,CAAK,wBAA2BsB,CAAAA,CAAAA,CACzB,IAAK,CAAA,wBACd,CAEA,IAAW,iBAAA,EAAyB,CAClC,GAAI,CAAC,IAAA,CAAK,yBACR,MAAM,IAAI,KAAM,CAAA,sFAAsF,CAExG,CAAA,OAAO,KAAK,wBACd,CAEA,MAAa,qBAAsBW,CAAAA,CAAAA,CAAOC,EAAc,CACtD,GAAI,CAAC,IAAA,CAAK,EAAM,EAAA,CAACD,GAAS,CAACC,CAAAA,CACzB,OAEF,IAAMC,CAAuB,CAAA,IAAA,CAAK,cAAcF,CAAK,CAAA,CAErD,GAAIE,CAAAA,CACF,OAAOA,CAAAA,CAGT,IAAMf,CAAW,CAAA,CAAA,EAAG,KAAK,EAAE,CAAA,CAAA,EAAIa,CAAK,CAE9BT,CAAAA,CAAAA,CAAAA,CAAenB,CAAU,CAAA,GAAA,CAAiBe,CAAQ,CAAA,CACxD,GAAII,CACF,CAAA,OAAA,IAAA,CAAK,aAAcS,CAAAA,CAAK,CAAIT,CAAAA,CAAAA,CACrBA,EAGT,GAAM,CAAE,IAAAF,CAAAA,CAAK,CAAI,CAAA,MAAMpB,EAAoB,IAAkB,CAAA,CAAA,aAAA,EAAgB+B,CAAK,CAAqB,iBAAA,CAAA,CAAA,CACrG,OAAQ,IAAK,CAAA,EACf,CAAG,CAAA,CACD,OAAS,CAAA,CACP,0BAA2BC,CAC7B,CACF,CAAC,CAAA,CAED,OAAA7B,CAAAA,CAAU,IAAIe,CAAUE,CAAAA,CAAI,CAC5B,CAAA,IAAA,CAAK,aAAcW,CAAAA,CAAK,EAAIX,CACrB,CAAA,IAAA,CAAK,cAAcW,CAAK,CACjC,CACF,ECxOO,IAAMG,CAAkB,CAAA,MAAOjD,CAAgB8C,CAAAA,CAAAA,GAAgC,CACpF,GAAM,CAAE,IAAMI,CAAAA,CAAQ,CAAI,CAAA,MAAMnC,EAAoB,IAAK,CAAA,cAAA,CAAgB,CAAE,MAAA,CAAAf,CAAQ,CAAA,KAAA,CAAA8C,CAAM,CAAC,CAAA,CAC1F,OAAOI,CACT,CAAA,CCLA,IAAqBC,CAArB,CAAA,cAA6C,KAAM,CAAnD,WACE,EAAA,CAAA,KAAA,CAAA,GAAA,SAAA,CAAA,CAAA,IAAA,CAAA,IAAA,CAAO,kBAEP,IAAU,CAAA,OAAA,CAAA,qBAAA,CACZ,CCJO,CAAA,IAAMC,CAAc,CAAA,aAAA,CACdC,EAAe,aACfC,CAAAA,CAAAA,CAAc,YACdC,CAAAA,CAAAA,CAAsB,cACtBC,CAAAA,CAAAA,CAAgB,uBAChBC,CAA0B,CAAA,uBAAA,CAC1BC,EAA2BF,CAAc,CAAA,WAAA,GACzCG,CAA+B,CAAA,yBAAA,CCWrC,IAAMC,CAAuB,CAAA,MAAOC,EAAsCC,CAA+D,GAAA,CAC9I,IAAMC,CAAeD,CAAAA,CAAAA,CAAQN,CAAa,CAAA,EAAKM,CAAQJ,CAAAA,CAAwB,GAAK,EACpF,CAAA,GAAI,CAAC,KAAM,CAAA,OAAA,CAAQK,CAAY,CAAKA,EAAAA,CAAAA,CAAa,WAAY,EAAA,GAAMX,CACjE,CAAA,OAEF,GAAM,CACJ,wBAAA,CAAAY,CACA,CAAA,8BAAA,CAAAC,CACA,CAAA,sBAAA,CAAA7B,CACF,CAAIyB,CAAAA,CAAAA,CACEK,CAASJ,CAAAA,CAAAA,CAAQP,CAAmB,CAAA,CAC1C,GAAI,CAACW,CAAAA,EAAU,MAAM,OAAQA,CAAAA,CAAM,EACjC,OAGF,IAAMC,CAAgCL,CAAAA,CAAAA,CAAQ9C,CAA2B,CAAA,EAAG,OAAS,CAAI,CAAA,IAAA,CAAK,KAAM8C,CAAAA,CAAAA,CAAQ9C,CAA2B,CAAW,EAAI,EAAC,CACjJgB,CAAc8B,CAAAA,CAAAA,GAAU7C,CAAmB,CAAA,EAAc,MAAM,GAAG,CAAA,CAElEmD,EAAa,IAAIxC,CAAAA,CAAQsC,EAAQ,MAAQC,CAAAA,CAAAA,CAA+BnC,CAAU,CAAA,CACxF,OAAIgC,CAAAA,GACE5B,EACF,MAAMgC,CAAAA,CAAW,yBAA0BhC,CAAAA,CAAsB,CAEjE,CAAA,MAAMgC,EAAW,kBAAmB,EAAA,CAAA,CAIpCH,CACF,EAAA,MAAMG,CAAW,CAAA,wBAAA,GAGnBzB,iBAAkB,EAAA,CAAE,kBAAkB,GAAIW,CAAAA,CAAAA,CAAac,CAAU,CAC1DA,CAAAA,CACT,CC5BO,CAAA,IAAMC,CAAa,CAAA,CAACR,EAAuC,EAAC,GAAe,MAAOS,CAAAA,CAAKC,CAAKC,CAAAA,CAAAA,GAAuB,CACxH,GAAI,CACF,IAAMJ,CAAAA,CAAa,MAAMR,CAAAA,CAAqBC,EAASS,CAAI,CAAA,OAAO,EAC9DF,CACFE,GAAAA,CAAAA,CAAI,KAAOF,CAGXE,CAAAA,CAAAA,CAAI,OAAQb,CAAAA,CAAuB,CAAIW,CAAAA,CAAAA,CAAAA,CAGzCI,IACF,CAAA,KAAY,CACVD,CAAAA,CAAI,MAAO,CAAA,GAAG,EAAE,IAAK,CAAA,CAAE,KAAO,CAAA,0BAA2B,CAAC,EAC5D,CACF,CAEaE,CAAAA,CAAAA,CAAuB,CAACZ,CAIjC,CAAA,KAAgB,MAAOS,CAAAA,CAAKC,CAAKC,CAAAA,CAAAA,GAAwB,CAC3D,GAAM,CACJ,wBAAAR,CAAAA,CAAAA,CACA,8BAAAC,CAAAA,CAAAA,CACA,oBAAAS,CAAAA,CACF,EAAIb,CACAX,CAAAA,CAAAA,CACJ,GAAIoB,CAAAA,CAAI,OAAQ,CAAA,aAAA,CAAe,CAC7B,GAAI,CACFpB,EAAU,MAAMjD,CAAAA,CAAaqE,EAAI,OAAQ,CAAA,aAAa,EACxD,CAAA,MAASK,CAAG,CAAA,CACNA,aAAa/E,UAAI,CAAA,iBAAA,CACnB2E,CAAI,CAAA,MAAA,CAAO,GAAG,CAAA,CAAE,KAAK,CAAE,MAAA,CAAQ,CAAC,sBAAsB,CAAE,CAAC,EAChDI,CAAa/E,YAAAA,UAAAA,CAAI,kBAC1B2E,CAAI,CAAA,MAAA,CAAO,GAAG,CAAE,CAAA,IAAA,CAAK,CAAE,MAAA,CAAQ,CAACI,CAAAA,CAAE,OAAO,CAAE,CAAC,CAE5CJ,CAAAA,CAAAA,CAAI,MAAO,CAAA,GAAG,EAAE,IAAK,CAAA,CAAE,MAAQ,CAAA,CAAC,kCAAkC,CAAE,CAAC,CAEvE,CAAA,MACF,CACA,IAAML,CAAAA,CAAShB,GAAS,IAAM,EAAA,EAAA,CAE1BgB,CACFI,GAAAA,CAAAA,CAAI,OAAQf,CAAAA,CAAmB,EAAIW,CAGrC,CAAA,CAAA,IAAMlC,CAAcsC,CAAAA,CAAAA,CAAI,OAAUrD,GAAAA,CAAmB,GAAc,KAAM,CAAA,GAAG,CACtEmD,CAAAA,CAAAA,CAAa,IAAIxC,CAAAA,CAAQsC,EAAQhB,CAAS,EAAA,IAAA,EAAM,YAAa,MAAWlB,CAAAA,CAAU,GAEpFgC,CAA4BC,EAAAA,CAAAA,GAC9B,MAAM,OAAA,CAAQ,GAAI,CAAA,CAChBD,GAA4BI,CAAW,CAAA,kBAAA,EACvCH,CAAAA,CAAAA,EAAkCG,CAAW,CAAA,wBAAA,EAC/C,CAAC,CAAA,CAGHE,CAAI,CAAA,IAAA,CAAOF,CACXzB,CAAAA,iBAAAA,GAAoB,gBAAkB,EAAA,GAAA,CAAIW,EAAac,CAAU,CAAA,CAIjEE,EAAI,OAAQb,CAAAA,CAAuB,CAAIW,CAAAA,EACzC,CAAWM,KAAAA,GAAAA,CAAAA,CAAsB,CAC/BH,CAAI,CAAA,MAAA,CAAO,GAAG,CAAA,CAAE,IAAK,CAAA,CAAE,OAAQ,CAAC,mBAAmB,CAAE,CAAC,CACtD,CAAA,MACF,CACAC,CAAK,GACP,EAEaI,CAAiBf,CAAAA,CAAAA,EAGf,MAAOS,CAAKC,CAAAA,CAAAA,CAAKC,CAAwB,GAAA,CACtD,GAAM,CACJ,MAAA1B,CACA,CAAA,YAAA,CAAAC,CACF,CAAA,CAAIc,CACAX,CAAAA,CAAAA,CAEJ,GAAI,CAACoB,CAAAA,CAAI,OAAQ,CAAA,aAAA,CAAe,CAC9BC,CAAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,CAAE,MAAA,CAAQ,CAAC,mBAAmB,CAAE,CAAC,CAAA,CACtD,MACF,CAEA,GAAI,CAEF,GADArB,CAAU,CAAA,MAAMD,CAAgBqB,CAAAA,CAAAA,CAAI,QAAQ,aAAexB,CAAAA,CAAK,CAC5D,CAAA,CAACI,CACH,CAAA,MAAM,IAAIC,CAEd,CAAA,MAASwB,EAAG,CACV,GAAIA,aAAa/E,UAAI,CAAA,iBAAA,CAAmB,CACtC2E,CAAAA,CAAI,MAAO,CAAA,GAAG,EAAE,IAAK,CAAA,CAAE,MAAQ,CAAA,CAAC,sBAAsB,CAAE,CAAC,CACzD,CAAA,MACF,CACA,GAAI,CAAC3E,UAAAA,CAAI,kBAAmBuD,CAAe,CAAA,CAAE,KAAM0B,CAAQF,EAAAA,CAAAA,YAAaE,CAAG,CAAG,CAAA,CAC5EN,CAAI,CAAA,MAAA,CAAO,GAAG,CAAA,CAAE,KAAK,CAAE,MAAA,CAAQ,CAACI,CAAAA,CAAE,OAAO,CAAE,CAAC,CAC5C,CAAA,MACF,CACAJ,CAAAA,CAAI,MAAO,CAAA,GAAG,EAAE,IAAK,CAAA,CAAE,OAAQ,CAAC,kCAAkC,CAAE,CAAC,CAAA,CACrE,MACF,CACA,IAAML,CAAAA,CAAShB,GAAS,MACpBgB,CAAAA,CAAAA,GACFI,EAAI,OAAQf,CAAAA,CAAmB,EAAIW,CAGrC,CAAA,CAAA,IAAME,CAAa,CAAA,IAAIxC,CAAQsC,CAAAA,CAAM,EAEjCpB,CACFwB,GAAAA,CAAAA,CAAI,QAAQX,CAA4B,CAAA,CAAIZ,EAE5C,MAAMqB,CAAAA,CAAW,qBAAsBtB,CAAAA,CAAAA,CAAOC,CAAY,CAAA,CAAA,CAG5DuB,EAAI,IAAOF,CAAAA,CAAAA,CACX,IAAMU,CAAAA,CAAsBnC,iBAAkB,EAAA,CAAE,iBAChDmC,CAAqB,EAAA,GAAA,CAAIxB,CAAac,CAAAA,CAAU,CAChDU,CAAAA,CAAAA,EAAqB,IAAIzB,CAActD,CAAAA,CAAAA,CAAkBuE,EAAI,OAAQ,CAAA,aAAa,CAAC,CAInFA,CAAAA,CAAAA,CAAI,OAAQb,CAAAA,CAAuB,CAAIW,CAAAA,CAAAA,CAEvCI,IACF,CAAA,CAEaO,CAA0C,CAAA,MAAOT,CAAKC,CAAAA,CAAAA,CAAKC,IAAS,CAC/E,MAAMF,CAAI,CAAA,IAAA,CAAK,kBAAmB,EAAA,CAClCE,IACF,CAAA,CAEaQ,GAAoBV,CAC1BA,EAAAA,CAAAA,CAAI,QAAQ,aAGVrE,CAAAA,CAAAA,CAAaqE,CAAI,CAAA,OAAA,CAAQ,aAAa,CAAA,CAFpC,KAKEW,EAAyB,CAAA,MAAOC,CAAgDhB,CAAAA,CAAAA,GAA+B,CAC1H,IAAME,EAAa,IAAIxC,CAAAA,CAAQsC,CAAM,CAAA,CAErC,MAAME,CAAAA,CAAW,oBAEjBc,CAAAA,CAAAA,GAAUC,SAASC,UAAW,CAAA,MAAM,EACpCF,CAAM,CAAA,gBAAA,CAAiB,GAAI5B,CAAAA,CAAAA,CAAac,CAAU,EACpD,EAEOiB,EAAQzD,CAAAA,EC/JF0D,IAAAA,CAAAA,CAAiF,CAACC,CAAAA,CAAS1B,EAAS2B,CAAS,GAAA,CACxHD,CAAQ,CAAA,OAAA,CAAQ,WAAa,CAAA,MAAOE,EAASC,CAAU,GAAA,CACrD,GAAI,CACF,IAAMC,EAAO,MAAM/B,CAAAA,CAAqBC,CAAS4B,CAAAA,CAAAA,CAAQ,OAAO,CAAA,CAC5DE,GACFJ,CAAQ,CAAA,eAAA,CAAgB,MAAQI,CAAAA,CAAI,EAExC,CAAA,KAAY,CACVD,CAAM,CAAA,MAAA,CAAO,GAAG,CAAA,CAAE,IAAK,CAAA,CAAE,MAAO,0BAA2B,CAAC,EAC9D,CACF,CAAC,EAEDF,CAAK,GACP,EACAF,CAAAA,CAA2B,MAAO,CAAA,GAAA,CAAI,eAAe,CAAC,CAAA,CAAI,ICzB1D,CAIaM,IAAAA,CAAAA,CAAU,IAA4BjD,iBAAAA,EAAoB,CAAA,gBAAA,EAAkB,IAAIW,CAAW,CAAA,CAE3FuC,EAAc,IAAMD,CAAAA,IAAW,EAEtCE,CAAAA,CAAAA,CAAuB,CAC3BpE,CAAAA,CACAD,CACG,GAAA,CAACoE,GAAiB,EAAA,MAAA,CAAO,MAAOD,CAAAA,CAAAA,EAAW,CAAA,WAAA,CAAYnE,CAAU,CAAGC,CAAAA,CAAQ,CAEpEqE,CAAAA,EAAAA,CAAwBC,CAAoBF,EAAAA,CAAAA,CAAqBE,EAAS,QAAQ,CAAA,CAClFC,GAAgCC,CAA4BJ,EAAAA,CAAAA,CAAqBI,EAAiB,gBAAgB,CAAA,CAClHC,EAA+BC,CAAAA,CAAAA,EAA2BN,CAAqBM,CAAAA,CAAAA,CAAgB,eAAe,ECZpH,IAAMC,CAAN,CAAA,cAAsC,KAAM,CACjD,YAAmBV,CAAuB,CAAA,IAAA,CAAMW,CAAU,CAAA,yBAAA,CAA2B,CACnF,KAAA,CAAMA,CAAO,CADI,CAAA,IAAA,CAAA,IAAA,CAAAX,EAEjB,IAAK,CAAA,IAAA,CAAO,0BACd,CACF,ECNO,IAAMY,EAAwB,CACnC,IAAA,CAAM,MACN,CAAA,KAAA,CAAO,OACP,CAAA,GAAA,CAAK,KACP,CAEMC,CAAAA,EAAAA,CAAwB,CAC5B,CAACD,CAAsB,CAAA,IAAI,EAAG,IAAG,EAAA,CACjC,CAACA,CAAsB,CAAA,KAAK,EAAIE,CAA+B,EAAA,CAC7D,GAAM,CAAE,QAAAC,CAAAA,CAAAA,CAAU,SAAAC,CAAS,CAAA,CAAIF,CAE/B,CAAA,OAAO,CADoB,MAAA,EAAA,MAAA,CAAO,KAAK,CAAGC,EAAAA,CAAQ,CAAIC,CAAAA,EAAAA,CAAQ,CAAE,CAAA,CAAA,CAAE,SAAS,QAAQ,CACjD,EACpC,CACA,CAAA,CAACJ,EAAsB,GAAG,EAAIE,CAA+B,EAAA,CAC3D,GAAM,CAAE,OAAAG,CAAO,CAAA,CAAIH,CACnB,CAAA,GAAIG,CACF,CAAA,OAAO,UAAcC,CAAK,CAAA,IAAA,CAAA,EAAID,CAAAA,CAAAA,CAAQ,CAAE,SAAA,CAAW,EAAG,CAAC,CAAC,EAG5D,CACF,CAAA,CAEaE,GAA0BL,CAA8E,EAAA,CACnH,IAAMM,CAAAA,CAAsBN,CAAuB,EAAA,MAAA,CAEnD,GAAI,EAACM,CAAAA,CAAAA,EAAuB,CAACP,EAAAA,CAAsBO,CAAmB,CAAA,CAAA,CAItE,OAAOP,EAAsBO,CAAAA,CAAmB,CAAEN,CAAAA,CAAqB,CACzE,MCTMO,EAA6B,CAAA,CAAA,CAAA,iBAAA,CAI7BC,GAAgB,CAAC,CAAE,gBAAAC,CAAkB,CAAA,EAAI,CAAA,MAAA,CAAAC,CAAO,CAAA,CAAiF,EAAa,GAAA,CACzI,CAAQ,CAAA,OAAA,CAAA,CACf,aAAe,CAAA,MAAA,CACf,wBAAyBA,CAAQ,EAAA,oBAAA,CACjC,GAAGD,CACL,CAAC,EACH,EAEM,CAAE,UAAA,CAAA9B,GAAY,QAAAD,CAAAA,EAAS,EAAIiC,EA8BjC,IAAOC,EAAQ,CAAA,CACb,UAAAjC,CAAAA,EAAAA,CACA,SAAAD,EACA,CAAA,IAAA,CAAAE,EACA,CAAA,UAAA,CAAAhB,CACA,CAAA,oBAAA,CAAAI,EACA,8BAAAM,CAAAA,CAAAA,CACA,iBAAAiC,CAAAA,EAAAA,CACA,gBAAAhC,CAAAA,EAAAA,CACA,qBAAAe,EACA,CAAA,4BAAA,CAAAE,GACA,2BAAAE,CAAAA,EAAAA,CACA,YAAAN,CACA,CAAA,OAAA,CAAAD,CACA,CAAA,uBAAA,CAAAS,CACA,CAAA,aAAA,CAAAzB,EACA,sBAAAK,CAAAA,EAAAA,CACA,QAAAmC,CAAAA,CAAAA,CACA,qBAAAb,CAAAA,CAAAA,CACA,uBAAAO,EACA,CAAA,mBAAA,CAAA7F,CACA,CAAA,0BAAA,CAAAqE,CACF","file":"index.js","sourcesContent":["import jwt from 'jsonwebtoken';\nimport moment from 'moment';\n\nconst {\n  DEPRECATED_JWT_SECRET, JWT_NEW_SECRET,\n  DEPRECATED_REFRESH_JWT_SECRET, REFRESH_JWT_SECRET,\n  DEPRECATION_UNIX_TIMESTAMP,\n} = process.env;\n\nconst getRelevantSecret = (token: string | undefined, deprecatedSecret: string, newSecret: string): string => {\n  const deprecationTime = moment(parseInt(DEPRECATION_UNIX_TIMESTAMP, 10) * 1000);\n  try {\n    let unixTime: moment.Moment;\n    if (token) {\n      const { iat } = jwt.decode(token) as jwt.JwtPayload;\n      unixTime = moment(iat * 1000);\n    } else {\n      unixTime = moment();\n    }\n    return unixTime.isBefore(deprecationTime) ? deprecatedSecret : newSecret;\n  } catch (e) {\n    return newSecret;\n  }\n};\n\nexport const getRefreshTokenSecret = (token?: string): string => getRelevantSecret(token, DEPRECATED_REFRESH_JWT_SECRET, REFRESH_JWT_SECRET);\nexport const getTokenSecret = (token?: string): string => getRelevantSecret(token, DEPRECATED_JWT_SECRET, JWT_NEW_SECRET);\n","import type { UUID } from 'node:crypto';\nimport * as jwt from 'jsonwebtoken';\nimport { getTokenSecret } from './secret-getter';\n\nconst CONTEXT_PROPS = ['fleetId', 'businessModelId', 'demandSourceId'];\nconst CONTEXT_MAP_PROPS = {\n  fleet: 'fleets',\n  business: 'businessModels',\n  demand: 'demandSources',\n};\n\nexport const getAuthFromBearer = (bearer: string): string => bearer.replace('Bearer ', '');\n\nexport const decodeBearer = (bearer: string, appSecret?: string): any => {\n  const token = getAuthFromBearer(bearer);\n  const decoded = jwt.verify(token, appSecret || getTokenSecret(token));\n  return decoded;\n};\n\nexport const parsePermissions = (contextId, decodedToken): any => {\n  if (!decodedToken) { return []; }\n  const { contexts } = decodedToken;\n  const activeContext = contexts.find((context) => context.id === contextId);\n\n  const permissionsValue = `${activeContext.permissions?.map((cp) => `${cp},`)}`;\n\n  return {\n    key: activeContext.entityId,\n    value: permissionsValue,\n  };\n};\n\nexport const getEntitiesFromContext = (contextId: string, decodedToken: any): any => {\n  if (!decodedToken) { return []; }\n  let { contexts } = decodedToken;\n  if (contextId) {\n    contexts = contexts.filter((context) => context.id === contextId);\n  }\n\n  const attributes = {};\n  contexts.forEach((context) => {\n    const prop = CONTEXT_MAP_PROPS[context.subSystem || 'business'];\n\n    const permissions = parsePermissions(context.id, decodedToken);\n    attributes[prop] ||= {};\n    attributes[prop][permissions.key] = permissions.value;\n  });\n\n  return attributes;\n};\n\nexport const getContextAttributes = (contextId: string, decodedToken: any): any => {\n  if (!decodedToken) { return []; }\n  let { contexts } = decodedToken;\n  if (contextId) {\n    contexts = contexts.filter((context) => context.id === contextId);\n  }\n  const attributes = {};\n  contexts.forEach((context) => {\n    CONTEXT_PROPS.forEach((prop) => {\n      if (context[prop]) {\n        const contextPropWrapped = [context[prop]];\n        attributes[prop] ||= [];\n        attributes[prop] = attributes[prop].concat(contextPropWrapped);\n      }\n    });\n  });\n  return attributes;\n};\n\nconst EMPTY_UUID = '00000000-0000-0000-0000-000000000000';\nconst FULL_UUID = 'ffffffff-ffff-ffff-ffff-ffffffffffff';\nconst VALID_CHARS_REGEX = '[0-9a-f]';\nconst UUID_VERSION_REGEX = '[1-8]';\nconst UUID_REGEX = new RegExp(\n  `^(?:${VALID_CHARS_REGEX}{8}-${VALID_CHARS_REGEX}{4}-${UUID_VERSION_REGEX}${VALID_CHARS_REGEX}{3}-[89ab]${VALID_CHARS_REGEX}{3}-${VALID_CHARS_REGEX}{12}|${EMPTY_UUID}|${FULL_UUID})$`,\n  'i',\n);\nexport function validateUUID(uuid: unknown): uuid is UUID {\n  return typeof uuid === 'string' && UUID_REGEX.test(uuid);\n}\n","import Network from '@autofleet/network';\n\nconst CACHE_LIFETIME_IN_SEC = 10;\nconst apiGwUrl = process.env.API_GATEWAY_URL || 'https://api.autofleet.io';\n\n// eslint-disable-next-line import/prefer-default-export\nexport const IdentityNetwork = new Network({\n  serviceName: 'IDENTITY_MS',\n  retries: 3,\n  retryCondition: () => true,\n  cache: process.env.NODE_ENV !== 'test' ? {\n    maxAge: CACHE_LIFETIME_IN_SEC * 1000,\n  } : undefined,\n});\n\nexport const AutofleetApiNetwork = new Network({\n  baseURL: apiGwUrl,\n  serviceUrl: apiGwUrl,\n  retries: 3,\n  retryCondition: () => true,\n  cache: process.env.NODE_ENV !== 'test' ? {\n    maxAge: CACHE_LIFETIME_IN_SEC * 1000,\n  } : undefined,\n});\n","import NodeCache from 'node-cache';\nimport objectHash from 'object-hash';\nimport { getCurrentContext } from '@autofleet/outbreak';\nimport { validateUUID } from '../utils';\nimport { AutofleetApiNetwork, IdentityNetwork } from '../services';\n\nexport type AccountType = 'client' | 'user' | 'service' | 'driver'\ninterface EntityPermissions {\n    [key: string]: string[];\n}\n\nexport const ELEVATED_PERMISSIONS_HEADER = 'x-af-elevated-permissions';\nexport const CONTEXTS_IDS_HEADER = 'x-af-context-ids';\n\nexport interface UserPayload {\n  businessModels: EntityPermissions;\n  fleets: EntityPermissions;\n  demandSources: EntityPermissions;\n  businessAccounts?: EntityPermissions;\n  accountType?: AccountType;\n  contexts?: EntityPermissions;\n  createdAt?: string;\n}\n\nexport interface PartialUserPayload {\n  businessModels?: EntityPermissions;\n  fleets?: EntityPermissions;\n  demandSources?: EntityPermissions;\n  vehicles?: EntityPermissions;\n  drivers?: EntityPermissions;\n  businessAccounts?: EntityPermissions;\n}\n\nconst userCache = new NodeCache({ stdTTL: 10 });\n\nconst mergePermissions = (target: UserPayload, sources: Iterable<PartialUserPayload>): UserPayload => {\n  const permissions: UserPayload = {\n    ...target,\n    fleets: { ...target?.fleets },\n    businessModels: { ...target?.businessModels },\n    demandSources: { ...target?.demandSources },\n    // Clone other nested objects as needed\n  };\n\n  // eslint-disable-next-line no-restricted-syntax\n  for (const source of sources) {\n    Object.keys(source).forEach((entityType) => {\n      // eslint-disable-next-line no-param-reassign\n      permissions[entityType] ??= {};\n      Object.entries(source[entityType]!).forEach(([entityId, perms]) => {\n        // eslint-disable-next-line no-param-reassign\n        permissions[entityType][entityId] = (permissions[entityType][entityId] || []).concat(perms);\n      });\n    });\n  }\n\n  return permissions;\n};\n\nexport default class ApiUser {\n  private privatePermissions: UserPayload | undefined;\n\n  private readonly privateElevatedPermissionsHash = new Map<symbol, PartialUserPayload | undefined>();\n\n  private privatePermissionsLegacy: any;\n\n  private readonly appPermission: {[key: string]: any; } = {};\n\n  public readonly emptyUser: boolean;\n\n  constructor(public id? : string, public accountType?: AccountType, elevatedPermissions?: PartialUserPayload, public contextIds?: string[]) {\n    this.emptyUser = !!id;\n    if (elevatedPermissions) {\n      this.privateElevatedPermissionsHash.set(Symbol('initial'), elevatedPermissions);\n    }\n  }\n\n  public async getUserPermissions(): Promise<UserPayload> {\n    if (!this.id) {\n      return undefined;\n    }\n    if (this.privatePermissions) {\n      return this.privatePermissions;\n    }\n    const cacheKey = objectHash({\n      id: this.id,\n      contextIds: this.contextIds,\n    });\n\n    let data = userCache.get<UserPayload>(cacheKey);\n\n    if (!data) {\n      ({ data } = await IdentityNetwork.get<UserPayload>(`/api/v1/users/${this.id}/authorization-payload`, { params: { contextIds: this.contextIds } }));\n      userCache.set(cacheKey, data);\n    }\n\n    this.accountType = data.accountType;\n    this.privatePermissions = data;\n    return this.privatePermissions;\n  }\n\n  public async useCustomPermissionLoader(customPermissionLoader: (userId: string) => UserPayload | PromiseLike<UserPayload>): Promise<UserPayload> {\n    if (!this.id) {\n      return undefined;\n    }\n    if (this.privatePermissions) {\n      return this.privatePermissions;\n    }\n\n    const cacheKey = this.id;\n\n    const cachedResult = userCache.get<UserPayload>(cacheKey);\n    if (cachedResult) {\n      this.privatePermissions = cachedResult;\n      return cachedResult;\n    }\n\n    const data = await customPermissionLoader(this.id);\n    userCache.set(cacheKey, data);\n\n    this.privatePermissions = data;\n    return this.privatePermissions;\n  }\n\n  public get businessModels(): string[] | undefined {\n    return this.getUserProperty('businessModels');\n  }\n\n  public get fleets(): string[] | undefined {\n    return this.getUserProperty('fleets');\n  }\n\n  public get demandSources(): string[] | undefined {\n    return this.getUserProperty('demandSources');\n  }\n\n  private getUserProperty(key: keyof UserPayload): string[] | undefined {\n    if (!this.privatePermissions) {\n      throw new Error(`Cannot get ${key} without calling (async) getUserPermissions before`);\n    }\n    return Object.keys(this.privatePermissions[key] || {});\n  }\n\n  public get elevatedPermissions(): UserPayload {\n    return mergePermissions(undefined, this.privateElevatedPermissionsHash.values());\n  }\n\n  public get permissions(): UserPayload | undefined {\n    if (!this.privatePermissions) {\n      throw new Error('Cannot get permissions without calling (async) getUserPermissions before');\n    }\n\n    return mergePermissions(this.privatePermissions, this.privateElevatedPermissionsHash.values());\n  }\n\n  public elevatePermissions(addedPermissions: PartialUserPayload): () => void {\n    // @itayankri is concerned about memory consumption, so create a symbol with no description, to avoid assigning memory for the description string\n    // eslint-disable-next-line symbol-description\n    const elevationId = Symbol();\n\n    // Validate that the added permissions are valid UUIDs\n    Object.values(addedPermissions).forEach((entityIds) => {\n      Object.keys(entityIds).forEach((entityId) => {\n        if (!validateUUID(entityId)) {\n          throw new Error(`Entity id on elevatePermissions is not a valid UUID, provided: ${entityId}`);\n        }\n      });\n    });\n\n    const currentUserTrace = getCurrentContext();\n    if (!currentUserTrace) {\n      throw new Error('Cannot find current user cross services trace');\n    }\n\n    const currentElevation = JSON.parse(currentUserTrace.context[ELEVATED_PERMISSIONS_HEADER] || '{}');\n    const newElevation = Object.assign(currentElevation, addedPermissions);\n    this.privateElevatedPermissionsHash.set(elevationId, newElevation);\n    currentUserTrace.context.set(ELEVATED_PERMISSIONS_HEADER, JSON.stringify(this.elevatedPermissions));\n    return () => {\n      this.privateElevatedPermissionsHash.delete(elevationId);\n      currentUserTrace.context.set(ELEVATED_PERMISSIONS_HEADER, JSON.stringify(this.elevatedPermissions));\n    };\n  }\n\n  public async getUserPermissionsLegacy() {\n    if (!this.id) {\n      return undefined;\n    }\n    if (this.privatePermissionsLegacy) {\n      return this.privatePermissionsLegacy;\n    }\n    const { data } = await IdentityNetwork.get(`/api/v1/users/${this.id}/authorization-payload-legacy`);\n\n    this.privatePermissionsLegacy = data;\n    return this.privatePermissionsLegacy;\n  }\n\n  public get permissionsLegacy(): any {\n    if (!this.privatePermissionsLegacy) {\n      throw new Error('Cannot get permissionsLegacy without calling (async) getUserPermissionsLegacy before');\n    }\n    return this.privatePermissionsLegacy;\n  }\n\n  public async getUserAppPermissions(appId, clientSecret) {\n    if (!this.id || !appId || !clientSecret) {\n      return undefined;\n    }\n    const currentAppPermission = this.appPermission[appId];\n\n    if (currentAppPermission) {\n      return currentAppPermission;\n    }\n\n    const cacheKey = `${this.id}:${appId}`;\n\n    const cachedResult = userCache.get<UserPayload>(cacheKey);\n    if (cachedResult) {\n      this.appPermission[appId] = cachedResult;\n      return cachedResult;\n    }\n\n    const { data } = await AutofleetApiNetwork.post<UserPayload>(`/api/v1/apps/${appId}/get-user-payload`, {\n      userId: this.id,\n    }, {\n      headers: {\n        'x-autofleet-apps-secret': clientSecret,\n      },\n    });\n\n    userCache.set(cacheKey, data);\n    this.appPermission[appId] = data;\n    return this.appPermission[appId];\n  }\n}\n","import { AutofleetApiNetwork } from './services';\n\nexport const decodeAppBearer = async (bearer: string, appId: string): Promise<any> => {\n  const { data: decoded } = await AutofleetApiNetwork.post('/api/v1/auth', { bearer, appId });\n  return decoded;\n};\n\nexport const getClientSecret = async (appId: string): Promise<any> => {\n  const { data: secret } = await AutofleetApiNetwork.get(`/api/v1/auth/client-secret/${appId}`);\n  return secret;\n};\n","export default class AppDoesNotExist extends Error {\n  name = 'AppDoesNotExist';\n\n  message = 'app does not exist';\n}\n","export const IDENTITY_MS = 'identity-ms';\nexport const ACCESS_TOKEN = 'accessToken';\nexport const USER_OBJECT = 'userObject';\nexport const USER_TRACING_HEADER = 'x-af-user-id';\nexport const ORIGIN_HEADER = 'X-IAF-ORIGIN-SERVICE';\nexport const USER_PERMISSIONS_HEADER = 'x-af-user-permissions';\nexport const LOWER_CASE_ORIGIN_HEADER = ORIGIN_HEADER.toLowerCase();\nexport const AUTOFLEET_APPS_SECRET_HEADER = 'x-autofleet-apps-secret';\n","import type { IncomingHttpHeaders } from 'node:http';\nimport { getCurrentContext } from '@autofleet/outbreak';\nimport ApiUser, { CONTEXTS_IDS_HEADER, ELEVATED_PERMISSIONS_HEADER, type UserPayload } from './ApiUser';\nimport {\n  IDENTITY_MS,\n  USER_OBJECT,\n  USER_TRACING_HEADER,\n  ORIGIN_HEADER,\n  LOWER_CASE_ORIGIN_HEADER,\n} from './const';\n\nexport type CustomPermissionLoader = (userId: string) => Promise<UserPayload>;\nexport interface AuthFromUserIdHeaderOptions {\n  eagerLoadUserPermissions?: boolean;\n  eagerLoadUserPermissionsLegacy?: boolean;\n  customPermissionLoader?: CustomPermissionLoader;\n}\n\nexport const authFromUserIdHeader = async (options: AuthFromUserIdHeaderOptions, headers: IncomingHttpHeaders): Promise<ApiUser | undefined> => {\n  const originHeader = headers[ORIGIN_HEADER] || headers[LOWER_CASE_ORIGIN_HEADER] || '';\n  if (!Array.isArray(originHeader) && originHeader.toLowerCase() === IDENTITY_MS) {\n    return undefined;\n  }\n  const {\n    eagerLoadUserPermissions,\n    eagerLoadUserPermissionsLegacy,\n    customPermissionLoader,\n  } = options;\n  const userId = headers[USER_TRACING_HEADER] as string;\n  if (!userId || Array.isArray(userId)) {\n    return undefined;\n  }\n\n  const elevatedPermissionsFromHeader = headers[ELEVATED_PERMISSIONS_HEADER]?.length > 0 ? JSON.parse(headers[ELEVATED_PERMISSIONS_HEADER] as string) : {};\n  const contextIds = (headers?.[CONTEXTS_IDS_HEADER] as string)?.split(',');\n\n  const userObject = new ApiUser(userId, 'user', elevatedPermissionsFromHeader, contextIds);\n  if (eagerLoadUserPermissions) {\n    if (customPermissionLoader) {\n      await userObject.useCustomPermissionLoader(customPermissionLoader);\n    } else {\n      await userObject.getUserPermissions();\n    }\n  }\n\n  if (eagerLoadUserPermissionsLegacy) {\n    await userObject.getUserPermissionsLegacy();\n  }\n\n  getCurrentContext().nonHeaderContext?.set(USER_OBJECT, userObject);\n  return userObject;\n};\n","import type { Handler, Request } from 'express';\nimport { getCurrentContext, newTrace, traceTypes } from '@autofleet/outbreak';\nimport jwt from 'jsonwebtoken';\nimport ApiUser, { CONTEXTS_IDS_HEADER } from './ApiUser';\nimport { decodeAppBearer } from '../app-auth';\nimport AppDoesNotExist from '../exceptions/appDoesNotExist';\nimport { decodeBearer, getAuthFromBearer } from '../utils';\nimport {\n  ACCESS_TOKEN,\n  USER_OBJECT,\n  USER_TRACING_HEADER,\n  USER_PERMISSIONS_HEADER,\n  AUTOFLEET_APPS_SECRET_HEADER,\n} from './const';\nimport { authFromUserIdHeader, AuthFromUserIdHeaderOptions } from './common';\n\ndeclare module 'express-serve-static-core' {\n  // eslint-disable-next-line @typescript-eslint/no-shadow\n  interface Request {\n    user: ApiUser;\n  }\n}\n\nexport const middleware = (options: AuthFromUserIdHeaderOptions = {}): Handler => async (req, res, next): Promise<any> => {\n  try {\n    const userObject = await authFromUserIdHeader(options, req.headers);\n    if (userObject) {\n      req.user = userObject;\n      // Added in order to support outbreak.\n      // @ts-expect-error we are setting an object onto the request headers.\n      req.headers[USER_PERMISSIONS_HEADER] = userObject;\n    }\n\n    next();\n  } catch (e) {\n    res.status(401).json({ error: 'cannot authenticate user' });\n  }\n};\n\nexport const middlewareWithDecode = (options: {\n  eagerLoadUserPermissions?: boolean;\n  eagerLoadUserPermissionsLegacy?: boolean;\n  returnErrorIfNoToken?: boolean\n} = {}): Handler => async (req, res, next): Promise<void> => {\n  const {\n    eagerLoadUserPermissions,\n    eagerLoadUserPermissionsLegacy,\n    returnErrorIfNoToken,\n  } = options;\n  let decoded;\n  if (req.headers.authorization) {\n    try {\n      decoded = await decodeBearer(req.headers.authorization);\n    } catch (e) {\n      if (e instanceof jwt.TokenExpiredError) {\n        res.status(401).json({ errors: ['Access token expired'] });\n      } else if (e instanceof jwt.JsonWebTokenError) {\n        res.status(400).json({ errors: [e.message] });\n      } else {\n        res.status(500).json({ errors: ['Server error while parsing token'] });\n      }\n      return;\n    }\n    const userId = decoded?.user?.id;\n\n    if (userId) {\n      req.headers[USER_TRACING_HEADER] = userId;\n    }\n\n    const contextIds = (req.headers?.[CONTEXTS_IDS_HEADER] as string)?.split(',');\n    const userObject = new ApiUser(userId, decoded?.user?.accountType, undefined, contextIds);\n\n    if (eagerLoadUserPermissions || eagerLoadUserPermissionsLegacy) {\n      await Promise.all([\n        eagerLoadUserPermissions && userObject.getUserPermissions(),\n        eagerLoadUserPermissionsLegacy && userObject.getUserPermissionsLegacy(),\n      ]);\n    }\n\n    req.user = userObject;\n    getCurrentContext().nonHeaderContext?.set(USER_OBJECT, userObject);\n\n    // Added in order to support outbreak.\n    // @ts-expect-error we are setting an object onto the request headers.\n    req.headers[USER_PERMISSIONS_HEADER] = userObject;\n  } else if (returnErrorIfNoToken) {\n    res.status(401).json({ errors: ['No token provided'] });\n    return;\n  }\n  next();\n};\n\nexport const appMiddleware = (options: {\n  appId: string,\n  clientSecret: string\n}): Handler => async (req, res, next): Promise<void> => {\n  const {\n    appId,\n    clientSecret,\n  } = options;\n  let decoded;\n\n  if (!req.headers.authorization) {\n    res.status(401).json({ errors: ['No token provided'] });\n    return;\n  }\n\n  try {\n    decoded = await decodeAppBearer(req.headers.authorization, appId);\n    if (!decoded) {\n      throw new AppDoesNotExist();\n    }\n  } catch (e) {\n    if (e instanceof jwt.TokenExpiredError) {\n      res.status(401).json({ errors: ['Access token expired'] });\n      return;\n    }\n    if ([jwt.JsonWebTokenError, AppDoesNotExist].some((Err) => e instanceof Err)) {\n      res.status(400).json({ errors: [e.message] });\n      return;\n    }\n    res.status(500).json({ errors: ['Server error while parsing token'] });\n    return;\n  }\n  const userId = decoded?.userId;\n  if (userId) {\n    req.headers[USER_TRACING_HEADER] = userId;\n  }\n\n  const userObject = new ApiUser(userId);\n\n  if (appId) {\n    req.headers[AUTOFLEET_APPS_SECRET_HEADER] = clientSecret;\n    // Won't work until we find a better solution for identity ms\n    await userObject.getUserAppPermissions(appId, clientSecret);\n  }\n\n  req.user = userObject;\n  const currentTraceContext = getCurrentContext().nonHeaderContext;\n  currentTraceContext?.set(USER_OBJECT, userObject);\n  currentTraceContext?.set(ACCESS_TOKEN, getAuthFromBearer(req.headers.authorization));\n\n  // Added in order to support outbreak.\n  // @ts-expect-error we are setting an object onto the request headers.\n  req.headers[USER_PERMISSIONS_HEADER] = userObject;\n\n  next();\n};\n\nexport const eagerLoadPermissionsMiddleware: Handler = async (req, res, next) => {\n  await req.user.getUserPermissions();\n  next();\n};\n\nexport const getDecodedBearer = (req: Request) => {\n  if (!req.headers.authorization) {\n    return null;\n  }\n  return decodeBearer(req.headers.authorization);\n};\n\nexport const createOrSetRabbitTrace = async (trace: ReturnType<typeof newTrace> | undefined, userId: string | undefined) => {\n  const userObject = new ApiUser(userId);\n\n  await userObject.getUserPermissions();\n  // eslint-disable-next-line no-param-reassign\n  trace ??= newTrace(traceTypes.RABBIT);\n  trace.nonHeaderContext.set(USER_OBJECT, userObject);\n};\n\nexport default ApiUser;\n","import type { FastifyPluginCallback } from 'fastify';\nimport type ApiUser from './ApiUser';\nimport { AuthFromUserIdHeaderOptions, authFromUserIdHeader } from './common';\n\ndeclare module 'fastify' {\n  interface FastifyRequest {\n    user?: ApiUser;\n  }\n}\n\n// eslint-disable-next-line import/prefer-default-export\nexport const authFromUserIdHeaderPlugin: FastifyPluginCallback<AuthFromUserIdHeaderOptions> = (fastify, options, done) => {\n  fastify.addHook('onRequest', async (request, reply) => {\n    try {\n      const user = await authFromUserIdHeader(options, request.headers);\n      if (user) {\n        fastify.decorateRequest('user', user);\n      }\n    } catch (e) {\n      reply.status(401).send({ error: 'cannot authenticate user' });\n    }\n  });\n\n  done();\n};\nauthFromUserIdHeaderPlugin[Symbol.for('skip-override')] = true; // Prevent Fastify from overriding the plugin\n","import { getCurrentContext } from '@autofleet/outbreak';\nimport { USER_OBJECT } from './user/const';\nimport ApiUser, { type UserPayload } from './user/ApiUser';\n\nexport const getUser = () : ApiUser | undefined => getCurrentContext().nonHeaderContext?.get(USER_OBJECT) as ApiUser | undefined;\n\nexport const isUserExist = () => getUser()?.id;\n\nconst checkUserPermissions = (\n  entityId: string,\n  entityType: Exclude<keyof UserPayload, 'accountType' | 'createdAt'>,\n) => !isUserExist() || Object.hasOwn(getUser()!.permissions[entityType], entityId);\n\nexport const checkFleetPermission = (fleetId: string) => checkUserPermissions(fleetId, 'fleets');\nexport const checkBusinessModelPermission = (businessModelId: string) => checkUserPermissions(businessModelId, 'businessModels');\nexport const checkDemandSourcePermission = (demandSourceId: string) => checkUserPermissions(demandSourceId, 'demandSources');\n","import type ApiUser from './user';\n\n// eslint-disable-next-line import/prefer-default-export\nexport class UnauthorizedAccessError extends Error {\n  constructor(public user: ApiUser | null = null, message = 'UnauthorizedAccessError') {\n    super(message);\n    this.name = 'UnauthorizedAccessError';\n  }\n}\n","import * as jwt from 'jsonwebtoken';\n\nexport const AUTHORIZATION_METHODS = {\n  NONE: 'NONE',\n  BASIC: 'BASIC',\n  JWT: 'JWT',\n};\n\nconst AUTHORIZATION_ACTIONS = {\n  [AUTHORIZATION_METHODS.NONE]: () => undefined,\n  [AUTHORIZATION_METHODS.BASIC]: (authorizationSettings: any) => {\n    const { username, password } = authorizationSettings;\n    const encodedCredentials = Buffer.from(`${username}:${password}`).toString('base64');\n    return `Basic ${encodedCredentials}`;\n  },\n  [AUTHORIZATION_METHODS.JWT]: (authorizationSettings: any) => {\n    const { secret } = authorizationSettings;\n    if (secret) {\n      return `Bearer ${jwt.sign({}, secret, { expiresIn: 10 })}`;\n    }\n    return undefined;\n  },\n};\n\nexport const getAuthorizationHeader = (authorizationSettings: { method: string } | undefined): string | undefined => {\n  const authorizationMethod = authorizationSettings?.method;\n\n  if (!authorizationMethod || !AUTHORIZATION_ACTIONS[authorizationMethod]) {\n    return undefined;\n  }\n\n  return AUTHORIZATION_ACTIONS[authorizationMethod](authorizationSettings);\n};\n","import type { LoggerInstanceManager } from '@autofleet/logger';\nimport * as outbreak from '@autofleet/outbreak';\nimport User, {\n  middleware,\n  eagerLoadPermissionsMiddleware,\n  middlewareWithDecode,\n  getDecodedBearer,\n  appMiddleware,\n  createOrSetRabbitTrace,\n} from './user';\nimport { authFromUserIdHeaderPlugin } from './user/fastify';\nimport { type UserPayload, CONTEXTS_IDS_HEADER } from './user/ApiUser';\nimport {\n  checkFleetPermission,\n  checkBusinessModelPermission,\n  checkDemandSourcePermission,\n  isUserExist,\n  getUser,\n} from './check-permission';\nimport { UnauthorizedAccessError } from './errors';\nimport { getRefreshTokenSecret, getTokenSecret } from './secret-getter';\nimport { AUTHORIZATION_METHODS, getAuthorizationHeader } from './authorization';\n\nconst getCurrentPayload = outbreak.getCurrentContext;\n\ntype OutbreakOptions = Parameters<typeof outbreak.default>[0];\ntype LoggerWithContextMiddleware = Partial<Pick<LoggerInstanceManager, 'addContextMiddleware'>>;\nconst enableTracing = ({ outbreakOptions = {}, logger }: { outbreakOptions?: OutbreakOptions, logger?: LoggerWithContextMiddleware } = {}): void => {\n  outbreak.default({\n    headersPrefix: 'x-af',\n    contextMiddlewareGetter: logger?.addContextMiddleware,\n    ...outbreakOptions,\n  });\n};\n\nconst { traceTypes, newTrace } = outbreak;\n\nexport {\n  traceTypes,\n  newTrace,\n  enableTracing,\n  User,\n  middleware,\n  middlewareWithDecode,\n  eagerLoadPermissionsMiddleware,\n  getCurrentPayload,\n  getDecodedBearer,\n  checkFleetPermission,\n  checkBusinessModelPermission,\n  checkDemandSourcePermission,\n  isUserExist,\n  getUser,\n  getRefreshTokenSecret,\n  getTokenSecret,\n  UnauthorizedAccessError,\n  appMiddleware,\n  createOrSetRabbitTrace,\n  outbreak,\n  AUTHORIZATION_METHODS,\n  getAuthorizationHeader,\n  type UserPayload,\n  CONTEXTS_IDS_HEADER,\n  authFromUserIdHeaderPlugin,\n};\n\nexport default {\n  traceTypes,\n  newTrace,\n  User,\n  middleware,\n  middlewareWithDecode,\n  eagerLoadPermissionsMiddleware,\n  getCurrentPayload,\n  getDecodedBearer,\n  checkFleetPermission,\n  checkBusinessModelPermission,\n  checkDemandSourcePermission,\n  isUserExist,\n  getUser,\n  UnauthorizedAccessError,\n  appMiddleware,\n  createOrSetRabbitTrace,\n  outbreak,\n  AUTHORIZATION_METHODS,\n  getAuthorizationHeader,\n  CONTEXTS_IDS_HEADER,\n  authFromUserIdHeaderPlugin,\n};\n"]}

package/package.json

@@ -1,10 +1,9 @@
 {
   "name": "@autofleet/zehut",
-  "version": "4.0.1-beta-5973b326.0",
+  "version": "4.1.0",
   "description": "manage user's identity",
   "type": "module",
-  "main": "./lib/index.cjs",
-  "module": "./lib/index.js",
+  "main": "./lib/index.js",
   "types": "./lib/index.d.ts",
   "exports": {
     ".": {
@@ -31,7 +30,7 @@
   },
   "repository": {
     "type": "git",
-    "url": "git+ssh://git@gitlab.com/AutoFleet/zehut.git"
+    "url": "https://github.com/Autofleet/zehut.git"
   },
   "author": "",
   "license": "ISC",
@@ -54,17 +53,18 @@
     "@types/node": "^18.19.75",
     "@typescript-eslint/eslint-plugin": "^6.5.0",
     "@typescript-eslint/parser": "^6.5.0",
-    "@vitest/coverage-v8": "^3.0.5",
+    "@vitest/coverage-v8": "^3.0.6",
     "axios": "^0.29.0",
     "eslint": "^8.48.0",
     "eslint-config-airbnb-typescript": "^17.1.0",
     "eslint-plugin-import": "^2.28.1",
     "express": "^4.21.2",
+    "fastify": "^5.3.2",
     "nock": "^14.0.0",
     "supertest": "^7.0.0",
     "tsup": "^8.3.6",
-    "typescript": "^4.9.5",
-    "vitest": "^3.0.5"
+    "typescript": "^5.8.3",
+    "vitest": "^3.0.6"
   },
   "peerDependencies": {
     "@autofleet/shtinker": "^1.2.0"
@@ -74,9 +74,6 @@
       "optional": true
     }
   },
-  "optionalDependencies": {
-    "@rollup/rollup-linux-x64-gnu": "*"
-  },
   "files": [
     "lib/**/*"
   ]