@backstage/plugin-auth-backend 0.24.5-next.2 → 0.25.0-next.0

package/dist/providers/providers.cjs.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"providers.cjs.js","sources":["../../src/providers/providers.ts"],"sourcesContent":["/*\n * Copyright 2022 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { atlassian } from './atlassian';\nimport { auth0 } from './auth0';\nimport { awsAlb } from './aws-alb';\nimport { bitbucket } from './bitbucket';\nimport { cfAccess } from './cloudflare-access';\nimport { gcpIap } from './gcp-iap';\nimport { github } from './github';\nimport { gitlab } from './gitlab';\nimport { google } from './google';\nimport { microsoft } from './microsoft';\nimport { oauth2 } from './oauth2';\nimport { oauth2Proxy } from './oauth2-proxy';\nimport { oidc } from './oidc';\nimport { okta } from './okta';\nimport { onelogin } from './onelogin';\nimport { saml } from './saml';\nimport { bitbucketServer } from './bitbucketServer';\nimport { easyAuth } from './azure-easyauth';\nimport { AuthProviderFactory } from '@backstage/plugin-auth-node';\n\n/**\n * All built-in auth provider integrations.\n *\n * @public\n * @deprecated Migrate the auth plugin to the new backend system https://backstage.io/docs/backend-system/building-backends/migrating#the-auth-plugin\n */\nexport const providers = Object.freeze({\n  atlassian,\n  auth0,\n  awsAlb,\n  bitbucket,\n  bitbucketServer,\n  cfAccess,\n  gcpIap,\n  github,\n  gitlab,\n  google,\n  microsoft,\n  oauth2,\n  oauth2Proxy,\n  oidc,\n  okta,\n  onelogin,\n  saml,\n  easyAuth,\n});\n\n/**\n * All auth provider factories that are installed by default.\n *\n * @public\n * @deprecated Migrate the auth plugin to the new backend system https://backstage.io/docs/backend-system/building-backends/migrating#the-auth-plugin\n */\nexport const defaultAuthProviderFactories: {\n  [providerId: string]: AuthProviderFactory;\n} = {\n  google: google.create(),\n  github: github.create(),\n  gitlab: gitlab.create(),\n  saml: saml.create(),\n  okta: okta.create(),\n  auth0: auth0.create(),\n  microsoft: microsoft.create(),\n  easyAuth: easyAuth.create(),\n  oauth2: oauth2.create(),\n  oidc: oidc.create(),\n  onelogin: onelogin.create(),\n  awsalb: awsAlb.create(),\n  bitbucket: bitbucket.create(),\n  bitbucketServer: bitbucketServer.create(),\n  atlassian: atlassian.create(),\n};\n"],"names":["atlassian","auth0","awsAlb","bitbucket","bitbucketServer","cfAccess","gcpIap","github","gitlab","google","microsoft","oauth2","oauth2Proxy","oidc","okta","onelogin","saml","easyAuth"],"mappings":";;;;;;;;;;;;;;;;;;;;;AA0Ca,MAAA,SAAA,GAAY,OAAO,MAAO,CAAA;AAAA,aACrCA,oBAAA;AAAA,SACAC,gBAAA;AAAA,UACAC,iBAAA;AAAA,aACAC,oBAAA;AAAA,mBACAC,0BAAA;AAAA,YACAC,mBAAA;AAAA,UACAC,iBAAA;AAAA,UACAC,iBAAA;AAAA,UACAC,iBAAA;AAAA,UACAC,eAAA;AAAA,aACAC,oBAAA;AAAA,UACAC,iBAAA;AAAA,eACAC,sBAAA;AAAA,QACAC,eAAA;AAAA,QACAC,eAAA;AAAA,YACAC,mBAAA;AAAA,QACAC,eAAA;AAAA,YACAC;AACF,CAAC;AAQM,MAAM,4BAET,GAAA;AAAA,EACF,MAAA,EAAQR,gBAAO,MAAO,EAAA;AAAA,EACtB,MAAA,EAAQF,kBAAO,MAAO,EAAA;AAAA,EACtB,MAAA,EAAQC,kBAAO,MAAO,EAAA;AAAA,EACtB,IAAA,EAAMQ,gBAAK,MAAO,EAAA;AAAA,EAClB,IAAA,EAAMF,gBAAK,MAAO,EAAA;AAAA,EAClB,KAAA,EAAOb,iBAAM,MAAO,EAAA;AAAA,EACpB,SAAA,EAAWS,qBAAU,MAAO,EAAA;AAAA,EAC5B,QAAA,EAAUO,oBAAS,MAAO,EAAA;AAAA,EAC1B,MAAA,EAAQN,kBAAO,MAAO,EAAA;AAAA,EACtB,IAAA,EAAME,gBAAK,MAAO,EAAA;AAAA,EAClB,QAAA,EAAUE,oBAAS,MAAO,EAAA;AAAA,EAC1B,MAAA,EAAQb,kBAAO,MAAO,EAAA;AAAA,EACtB,SAAA,EAAWC,qBAAU,MAAO,EAAA;AAAA,EAC5B,eAAA,EAAiBC,2BAAgB,MAAO,EAAA;AAAA,EACxC,SAAA,EAAWJ,qBAAU,MAAO;AAC9B;;;;;"}

package/dist/providers/resolvers.cjs.js

@@ -1,27 +0,0 @@
-'use strict';
-
-const commonByEmailLocalPartResolver = async (info, ctx) => {
-  const { profile } = info;
-  if (!profile.email) {
-    throw new Error("Login failed, user profile does not contain an email");
-  }
-  const [localPart] = profile.email.split("@");
-  return ctx.signInWithCatalogUser({
-    entityRef: { name: localPart }
-  });
-};
-const commonByEmailResolver = async (info, ctx) => {
-  const { profile } = info;
-  if (!profile.email) {
-    throw new Error("Login failed, user profile does not contain an email");
-  }
-  return ctx.signInWithCatalogUser({
-    filter: {
-      "spec.profile.email": profile.email
-    }
-  });
-};
-
-exports.commonByEmailLocalPartResolver = commonByEmailLocalPartResolver;
-exports.commonByEmailResolver = commonByEmailResolver;
-//# sourceMappingURL=resolvers.cjs.js.map

package/dist/providers/resolvers.cjs.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"resolvers.cjs.js","sources":["../../src/providers/resolvers.ts"],"sourcesContent":["/*\n * Copyright 2022 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { SignInResolver } from '@backstage/plugin-auth-node';\n\n/**\n * A common sign-in resolver that looks up the user using the local part of\n * their email address as the entity name.\n */\nexport const commonByEmailLocalPartResolver: SignInResolver<unknown> = async (\n  info,\n  ctx,\n) => {\n  const { profile } = info;\n\n  if (!profile.email) {\n    throw new Error('Login failed, user profile does not contain an email');\n  }\n  const [localPart] = profile.email.split('@');\n\n  return ctx.signInWithCatalogUser({\n    entityRef: { name: localPart },\n  });\n};\n\n/**\n * A common sign-in resolver that looks up the user using their email address\n * as email of the entity.\n */\nexport const commonByEmailResolver: SignInResolver<unknown> = async (\n  info,\n  ctx,\n) => {\n  const { profile } = info;\n\n  if (!profile.email) {\n    throw new Error('Login failed, user profile does not contain an email');\n  }\n\n  return ctx.signInWithCatalogUser({\n    filter: {\n      'spec.profile.email': profile.email,\n    },\n  });\n};\n"],"names":[],"mappings":";;AAsBa,MAAA,8BAAA,GAA0D,OACrE,IAAA,EACA,GACG,KAAA;AACH,EAAM,MAAA,EAAE,SAAY,GAAA,IAAA;AAEpB,EAAI,IAAA,CAAC,QAAQ,KAAO,EAAA;AAClB,IAAM,MAAA,IAAI,MAAM,sDAAsD,CAAA;AAAA;AAExE,EAAA,MAAM,CAAC,SAAS,CAAA,GAAI,OAAQ,CAAA,KAAA,CAAM,MAAM,GAAG,CAAA;AAE3C,EAAA,OAAO,IAAI,qBAAsB,CAAA;AAAA,IAC/B,SAAA,EAAW,EAAE,IAAA,EAAM,SAAU;AAAA,GAC9B,CAAA;AACH;AAMa,MAAA,qBAAA,GAAiD,OAC5D,IAAA,EACA,GACG,KAAA;AACH,EAAM,MAAA,EAAE,SAAY,GAAA,IAAA;AAEpB,EAAI,IAAA,CAAC,QAAQ,KAAO,EAAA;AAClB,IAAM,MAAA,IAAI,MAAM,sDAAsD,CAAA;AAAA;AAGxE,EAAA,OAAO,IAAI,qBAAsB,CAAA;AAAA,IAC/B,MAAQ,EAAA;AAAA,MACN,sBAAsB,OAAQ,CAAA;AAAA;AAChC,GACD,CAAA;AACH;;;;;"}

package/dist/providers/saml/provider.cjs.js

@@ -1,121 +0,0 @@
-'use strict';
-
-var passportSaml = require('@node-saml/passport-saml');
-var PassportStrategyHelper = require('../../lib/passport/PassportStrategyHelper.cjs.js');
-var authFlowHelpers = require('../../lib/flow/authFlowHelpers.cjs.js');
-var createAuthProviderIntegration = require('../createAuthProviderIntegration.cjs.js');
-var errors = require('@backstage/errors');
-var prepareBackstageIdentityResponse = require('../prepareBackstageIdentityResponse.cjs.js');
-
-class SamlAuthProvider {
-  strategy;
-  signInResolver;
-  authHandler;
-  resolverContext;
-  appUrl;
-  constructor(options) {
-    this.appUrl = options.appUrl;
-    this.signInResolver = options.signInResolver;
-    this.authHandler = options.authHandler;
-    this.resolverContext = options.resolverContext;
-    const verifier = (profile, done) => {
-      done(null, { fullProfile: profile });
-    };
-    this.strategy = new passportSaml.Strategy(options, verifier, verifier);
-  }
-  async start(req, res) {
-    const { url } = await PassportStrategyHelper.executeRedirectStrategy(req, this.strategy, {});
-    res.redirect(url);
-  }
-  async frameHandler(req, res) {
-    try {
-      const { result } = await PassportStrategyHelper.executeFrameHandlerStrategy(
-        req,
-        this.strategy
-      );
-      const { profile } = await this.authHandler(result, this.resolverContext);
-      const response = {
-        profile,
-        providerInfo: {}
-      };
-      if (this.signInResolver) {
-        const signInResponse = await this.signInResolver(
-          {
-            result,
-            profile
-          },
-          this.resolverContext
-        );
-        response.backstageIdentity = prepareBackstageIdentityResponse.prepareBackstageIdentityResponse(signInResponse);
-      }
-      return authFlowHelpers.postMessageResponse(res, this.appUrl, {
-        type: "authorization_response",
-        response
-      });
-    } catch (error) {
-      const { name, message } = errors.isError(error) ? error : new Error("Encountered invalid error");
-      return authFlowHelpers.postMessageResponse(res, this.appUrl, {
-        type: "authorization_response",
-        error: { name, message }
-      });
-    }
-  }
-  async logout(_req, res) {
-    res.end();
-  }
-}
-const saml = createAuthProviderIntegration.createAuthProviderIntegration({
-  create(options) {
-    return ({ providerId, globalConfig, config, resolverContext }) => {
-      const authHandler = options?.authHandler ? options.authHandler : async ({ fullProfile }) => ({
-        profile: {
-          email: fullProfile.email,
-          displayName: fullProfile.displayName
-        }
-      });
-      return new SamlAuthProvider({
-        callbackUrl: `${globalConfig.baseUrl}/${providerId}/handler/frame`,
-        entryPoint: config.getString("entryPoint"),
-        logoutUrl: config.getOptionalString("logoutUrl"),
-        audience: config.getString("audience"),
-        issuer: config.getString("issuer"),
-        idpCert: config.getString("cert"),
-        privateKey: config.getOptionalString("privateKey"),
-        authnContext: config.getOptionalStringArray("authnContext"),
-        identifierFormat: config.getOptionalString("identifierFormat"),
-        decryptionPvk: config.getOptionalString("decryptionPvk"),
-        signatureAlgorithm: config.getOptionalString("signatureAlgorithm"),
-        digestAlgorithm: config.getOptionalString("digestAlgorithm"),
-        acceptedClockSkewMs: config.getOptionalNumber("acceptedClockSkewMs"),
-        wantAuthnResponseSigned: config.getOptionalBoolean(
-          "wantAuthnResponseSigned"
-        ),
-        wantAssertionsSigned: config.getOptionalBoolean("wantAssertionsSigned"),
-        appUrl: globalConfig.appUrl,
-        authHandler,
-        signInResolver: options?.signIn?.resolver,
-        resolverContext
-      });
-    };
-  },
-  resolvers: {
-    /**
-     * Looks up the user by matching their nameID to the entity name.
-     */
-    nameIdMatchingUserEntityName() {
-      return async (info, ctx) => {
-        const id = info.result.fullProfile.nameID;
-        if (!id) {
-          throw new errors.AuthenticationError("No nameID found in SAML response");
-        }
-        return ctx.signInWithCatalogUser({
-          entityRef: { name: id }
-        });
-      };
-    }
-  }
-});
-
-exports.SamlAuthProvider = SamlAuthProvider;
-exports.saml = saml;
-//# sourceMappingURL=provider.cjs.js.map

package/dist/providers/saml/provider.cjs.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"provider.cjs.js","sources":["../../../src/providers/saml/provider.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport express from 'express';\nimport { SamlConfig, VerifiedCallback } from '@node-saml/passport-saml';\nimport {\n  Strategy as SamlStrategy,\n  Profile as SamlProfile,\n  VerifyWithoutRequest,\n} from '@node-saml/passport-saml';\nimport {\n  executeFrameHandlerStrategy,\n  executeRedirectStrategy,\n} from '../../lib/passport';\nimport { AuthHandler } from '../types';\nimport { postMessageResponse } from '../../lib/flow';\nimport { createAuthProviderIntegration } from '../createAuthProviderIntegration';\nimport { AuthenticationError, isError } from '@backstage/errors';\nimport { prepareBackstageIdentityResponse } from '../prepareBackstageIdentityResponse';\nimport {\n  AuthProviderRouteHandlers,\n  AuthResolverContext,\n  ClientAuthResponse,\n  SignInResolver,\n} from '@backstage/plugin-auth-node';\n\n/**\n * @public\n * @deprecated Migrate the auth plugin to the new backend system https://backstage.io/docs/backend-system/building-backends/migrating#the-auth-plugin\n */\nexport type SamlAuthResult = {\n  fullProfile: any;\n};\n\ntype Options = SamlConfig & {\n  signInResolver?: SignInResolver<SamlAuthResult>;\n  authHandler: AuthHandler<SamlAuthResult>;\n  resolverContext: AuthResolverContext;\n  appUrl: string;\n};\n\nexport class SamlAuthProvider implements AuthProviderRouteHandlers {\n  private readonly strategy: SamlStrategy;\n  private readonly signInResolver?: SignInResolver<SamlAuthResult>;\n  private readonly authHandler: AuthHandler<SamlAuthResult>;\n  private readonly resolverContext: AuthResolverContext;\n  private readonly appUrl: string;\n\n  constructor(options: Options) {\n    this.appUrl = options.appUrl;\n    this.signInResolver = options.signInResolver;\n    this.authHandler = options.authHandler;\n    this.resolverContext = options.resolverContext;\n\n    const verifier: VerifyWithoutRequest = (\n      profile: SamlProfile | null,\n      done: VerifiedCallback,\n    ) => {\n      // TODO: There's plenty more validation and profile handling to do here,\n      //       this provider is currently only intended to validate the provider pattern\n      //       for non-oauth auth flows.\n      // TODO: This flow doesn't issue an identity token that can be used to validate\n      //       the identity of the user in other backends, which we need in some form.\n      done(null, { fullProfile: profile });\n    };\n    this.strategy = new SamlStrategy(options, verifier, verifier);\n  }\n\n  async start(req: express.Request, res: express.Response): Promise<void> {\n    const { url } = await executeRedirectStrategy(req, this.strategy, {});\n    res.redirect(url);\n  }\n\n  async frameHandler(\n    req: express.Request,\n    res: express.Response,\n  ): Promise<void> {\n    try {\n      const { result } = await executeFrameHandlerStrategy<SamlAuthResult>(\n        req,\n        this.strategy,\n      );\n\n      const { profile } = await this.authHandler(result, this.resolverContext);\n\n      const response: ClientAuthResponse<{}> = {\n        profile,\n        providerInfo: {},\n      };\n\n      if (this.signInResolver) {\n        const signInResponse = await this.signInResolver(\n          {\n            result,\n            profile,\n          },\n          this.resolverContext,\n        );\n\n        response.backstageIdentity =\n          prepareBackstageIdentityResponse(signInResponse);\n      }\n\n      return postMessageResponse(res, this.appUrl, {\n        type: 'authorization_response',\n        response,\n      });\n    } catch (error) {\n      const { name, message } = isError(error)\n        ? error\n        : new Error('Encountered invalid error'); // Being a bit safe and not forwarding the bad value\n      return postMessageResponse(res, this.appUrl, {\n        type: 'authorization_response',\n        error: { name, message },\n      });\n    }\n  }\n\n  async logout(_req: express.Request, res: express.Response): Promise<void> {\n    res.end();\n  }\n}\n\ntype SignatureAlgorithm = 'sha1' | 'sha256' | 'sha512';\n\n/**\n * Auth provider integration for SAML auth\n *\n * @public\n */\nexport const saml = createAuthProviderIntegration({\n  create(options?: {\n    /**\n     * The profile transformation function used to verify and convert the auth response\n     * into the profile that will be presented to the user.\n     */\n    authHandler?: AuthHandler<SamlAuthResult>;\n\n    /**\n     * Configure sign-in for this provider, without it the provider can not be used to sign users in.\n     */\n    signIn?: {\n      /**\n       * Maps an auth result to a Backstage identity for the user.\n       */\n      resolver: SignInResolver<SamlAuthResult>;\n    };\n  }) {\n    return ({ providerId, globalConfig, config, resolverContext }) => {\n      const authHandler: AuthHandler<SamlAuthResult> = options?.authHandler\n        ? options.authHandler\n        : async ({ fullProfile }) => ({\n            profile: {\n              email: fullProfile.email,\n              displayName: fullProfile.displayName,\n            },\n          });\n\n      return new SamlAuthProvider({\n        callbackUrl: `${globalConfig.baseUrl}/${providerId}/handler/frame`,\n        entryPoint: config.getString('entryPoint'),\n        logoutUrl: config.getOptionalString('logoutUrl'),\n        audience: config.getString('audience'),\n        issuer: config.getString('issuer'),\n        idpCert: config.getString('cert'),\n        privateKey: config.getOptionalString('privateKey'),\n        authnContext: config.getOptionalStringArray('authnContext'),\n        identifierFormat: config.getOptionalString('identifierFormat'),\n        decryptionPvk: config.getOptionalString('decryptionPvk'),\n        signatureAlgorithm: config.getOptionalString('signatureAlgorithm') as\n          | SignatureAlgorithm\n          | undefined,\n        digestAlgorithm: config.getOptionalString('digestAlgorithm'),\n        acceptedClockSkewMs: config.getOptionalNumber('acceptedClockSkewMs'),\n        wantAuthnResponseSigned: config.getOptionalBoolean(\n          'wantAuthnResponseSigned',\n        ),\n        wantAssertionsSigned: config.getOptionalBoolean('wantAssertionsSigned'),\n        appUrl: globalConfig.appUrl,\n        authHandler,\n        signInResolver: options?.signIn?.resolver,\n        resolverContext,\n      });\n    };\n  },\n  resolvers: {\n    /**\n     * Looks up the user by matching their nameID to the entity name.\n     */\n    nameIdMatchingUserEntityName(): SignInResolver<SamlAuthResult> {\n      return async (info, ctx) => {\n        const id = info.result.fullProfile.nameID;\n\n        if (!id) {\n          throw new AuthenticationError('No nameID found in SAML response');\n        }\n\n        return ctx.signInWithCatalogUser({\n          entityRef: { name: id },\n        });\n      };\n    },\n  },\n});\n"],"names":["SamlStrategy","executeRedirectStrategy","executeFrameHandlerStrategy","prepareBackstageIdentityResponse","postMessageResponse","isError","createAuthProviderIntegration","AuthenticationError"],"mappings":";;;;;;;;;AAsDO,MAAM,gBAAsD,CAAA;AAAA,EAChD,QAAA;AAAA,EACA,cAAA;AAAA,EACA,WAAA;AAAA,EACA,eAAA;AAAA,EACA,MAAA;AAAA,EAEjB,YAAY,OAAkB,EAAA;AAC5B,IAAA,IAAA,CAAK,SAAS,OAAQ,CAAA,MAAA;AACtB,IAAA,IAAA,CAAK,iBAAiB,OAAQ,CAAA,cAAA;AAC9B,IAAA,IAAA,CAAK,cAAc,OAAQ,CAAA,WAAA;AAC3B,IAAA,IAAA,CAAK,kBAAkB,OAAQ,CAAA,eAAA;AAE/B,IAAM,MAAA,QAAA,GAAiC,CACrC,OAAA,EACA,IACG,KAAA;AAMH,MAAA,IAAA,CAAK,IAAM,EAAA,EAAE,WAAa,EAAA,OAAA,EAAS,CAAA;AAAA,KACrC;AACA,IAAA,IAAA,CAAK,QAAW,GAAA,IAAIA,qBAAa,CAAA,OAAA,EAAS,UAAU,QAAQ,CAAA;AAAA;AAC9D,EAEA,MAAM,KAAM,CAAA,GAAA,EAAsB,GAAsC,EAAA;AACtE,IAAM,MAAA,EAAE,KAAQ,GAAA,MAAMC,+CAAwB,GAAK,EAAA,IAAA,CAAK,QAAU,EAAA,EAAE,CAAA;AACpE,IAAA,GAAA,CAAI,SAAS,GAAG,CAAA;AAAA;AAClB,EAEA,MAAM,YACJ,CAAA,GAAA,EACA,GACe,EAAA;AACf,IAAI,IAAA;AACF,MAAM,MAAA,EAAE,MAAO,EAAA,GAAI,MAAMC,kDAAA;AAAA,QACvB,GAAA;AAAA,QACA,IAAK,CAAA;AAAA,OACP;AAEA,MAAM,MAAA,EAAE,SAAY,GAAA,MAAM,KAAK,WAAY,CAAA,MAAA,EAAQ,KAAK,eAAe,CAAA;AAEvE,MAAA,MAAM,QAAmC,GAAA;AAAA,QACvC,OAAA;AAAA,QACA,cAAc;AAAC,OACjB;AAEA,MAAA,IAAI,KAAK,cAAgB,EAAA;AACvB,QAAM,MAAA,cAAA,GAAiB,MAAM,IAAK,CAAA,cAAA;AAAA,UAChC;AAAA,YACE,MAAA;AAAA,YACA;AAAA,WACF;AAAA,UACA,IAAK,CAAA;AAAA,SACP;AAEA,QAAS,QAAA,CAAA,iBAAA,GACPC,kEAAiC,cAAc,CAAA;AAAA;AAGnD,MAAO,OAAAC,mCAAA,CAAoB,GAAK,EAAA,IAAA,CAAK,MAAQ,EAAA;AAAA,QAC3C,IAAM,EAAA,wBAAA;AAAA,QACN;AAAA,OACD,CAAA;AAAA,aACM,KAAO,EAAA;AACd,MAAM,MAAA,EAAE,IAAM,EAAA,OAAA,EAAY,GAAAC,cAAA,CAAQ,KAAK,CACnC,GAAA,KAAA,GACA,IAAI,KAAA,CAAM,2BAA2B,CAAA;AACzC,MAAO,OAAAD,mCAAA,CAAoB,GAAK,EAAA,IAAA,CAAK,MAAQ,EAAA;AAAA,QAC3C,IAAM,EAAA,wBAAA;AAAA,QACN,KAAA,EAAO,EAAE,IAAA,EAAM,OAAQ;AAAA,OACxB,CAAA;AAAA;AACH;AACF,EAEA,MAAM,MAAO,CAAA,IAAA,EAAuB,GAAsC,EAAA;AACxE,IAAA,GAAA,CAAI,GAAI,EAAA;AAAA;AAEZ;AASO,MAAM,OAAOE,2DAA8B,CAAA;AAAA,EAChD,OAAO,OAgBJ,EAAA;AACD,IAAA,OAAO,CAAC,EAAE,UAAA,EAAY,YAAc,EAAA,MAAA,EAAQ,iBAAsB,KAAA;AAChE,MAAM,MAAA,WAAA,GAA2C,SAAS,WACtD,GAAA,OAAA,CAAQ,cACR,OAAO,EAAE,aAAmB,MAAA;AAAA,QAC1B,OAAS,EAAA;AAAA,UACP,OAAO,WAAY,CAAA,KAAA;AAAA,UACnB,aAAa,WAAY,CAAA;AAAA;AAC3B,OACF,CAAA;AAEJ,MAAA,OAAO,IAAI,gBAAiB,CAAA;AAAA,QAC1B,WAAa,EAAA,CAAA,EAAG,YAAa,CAAA,OAAO,IAAI,UAAU,CAAA,cAAA,CAAA;AAAA,QAClD,UAAA,EAAY,MAAO,CAAA,SAAA,CAAU,YAAY,CAAA;AAAA,QACzC,SAAA,EAAW,MAAO,CAAA,iBAAA,CAAkB,WAAW,CAAA;AAAA,QAC/C,QAAA,EAAU,MAAO,CAAA,SAAA,CAAU,UAAU,CAAA;AAAA,QACrC,MAAA,EAAQ,MAAO,CAAA,SAAA,CAAU,QAAQ,CAAA;AAAA,QACjC,OAAA,EAAS,MAAO,CAAA,SAAA,CAAU,MAAM,CAAA;AAAA,QAChC,UAAA,EAAY,MAAO,CAAA,iBAAA,CAAkB,YAAY,CAAA;AAAA,QACjD,YAAA,EAAc,MAAO,CAAA,sBAAA,CAAuB,cAAc,CAAA;AAAA,QAC1D,gBAAA,EAAkB,MAAO,CAAA,iBAAA,CAAkB,kBAAkB,CAAA;AAAA,QAC7D,aAAA,EAAe,MAAO,CAAA,iBAAA,CAAkB,eAAe,CAAA;AAAA,QACvD,kBAAA,EAAoB,MAAO,CAAA,iBAAA,CAAkB,oBAAoB,CAAA;AAAA,QAGjE,eAAA,EAAiB,MAAO,CAAA,iBAAA,CAAkB,iBAAiB,CAAA;AAAA,QAC3D,mBAAA,EAAqB,MAAO,CAAA,iBAAA,CAAkB,qBAAqB,CAAA;AAAA,QACnE,yBAAyB,MAAO,CAAA,kBAAA;AAAA,UAC9B;AAAA,SACF;AAAA,QACA,oBAAA,EAAsB,MAAO,CAAA,kBAAA,CAAmB,sBAAsB,CAAA;AAAA,QACtE,QAAQ,YAAa,CAAA,MAAA;AAAA,QACrB,WAAA;AAAA,QACA,cAAA,EAAgB,SAAS,MAAQ,EAAA,QAAA;AAAA,QACjC;AAAA,OACD,CAAA;AAAA,KACH;AAAA,GACF;AAAA,EACA,SAAW,EAAA;AAAA;AAAA;AAAA;AAAA,IAIT,4BAA+D,GAAA;AAC7D,MAAO,OAAA,OAAO,MAAM,GAAQ,KAAA;AAC1B,QAAM,MAAA,EAAA,GAAK,IAAK,CAAA,MAAA,CAAO,WAAY,CAAA,MAAA;AAEnC,QAAA,IAAI,CAAC,EAAI,EAAA;AACP,UAAM,MAAA,IAAIC,2BAAoB,kCAAkC,CAAA;AAAA;AAGlE,QAAA,OAAO,IAAI,qBAAsB,CAAA;AAAA,UAC/B,SAAA,EAAW,EAAE,IAAA,EAAM,EAAG;AAAA,SACvB,CAAA;AAAA,OACH;AAAA;AACF;AAEJ,CAAC;;;;;"}