@backstage/plugin-auth-backend 0.26.1-next.0 → 0.27.0

package/dist/service/OidcRouter.cjs.js

@@ -4,12 +4,102 @@ var Router = require('express-promise-router');
 var OidcService = require('./OidcService.cjs.js');
 var errors = require('@backstage/errors');
 var express = require('express');
-var readTokenExpiration = require('./readTokenExpiration.cjs.js');
+var zod = require('zod');
+var zodValidationError = require('zod-validation-error');
+var OidcError = require('./OidcError.cjs.js');
 
 function _interopDefaultCompat (e) { return e && typeof e === 'object' && 'default' in e ? e : { default: e }; }
 
 var Router__default = /*#__PURE__*/_interopDefaultCompat(Router);
 
+function ensureTrailingSlash(url) {
+  return url.endsWith("/") ? url : `${url}/`;
+}
+const authorizeQuerySchema = zod.z.object({
+  client_id: zod.z.string().min(1),
+  redirect_uri: zod.z.string().url(),
+  response_type: zod.z.string().min(1),
+  scope: zod.z.string().optional(),
+  state: zod.z.string().optional(),
+  nonce: zod.z.string().optional(),
+  code_challenge: zod.z.string().optional(),
+  code_challenge_method: zod.z.string().optional()
+});
+const sessionIdParamSchema = zod.z.object({
+  sessionId: zod.z.string().min(1)
+});
+const tokenRequestBodySchema = zod.z.object({
+  grant_type: zod.z.string().min(1),
+  code: zod.z.string().optional(),
+  redirect_uri: zod.z.string().url().optional(),
+  code_verifier: zod.z.string().optional(),
+  refresh_token: zod.z.string().optional(),
+  client_id: zod.z.string().optional(),
+  client_secret: zod.z.string().optional()
+});
+const registerRequestBodySchema = zod.z.object({
+  client_name: zod.z.string().optional(),
+  redirect_uris: zod.z.array(zod.z.string().url()).min(1),
+  response_types: zod.z.array(zod.z.string()).optional(),
+  grant_types: zod.z.array(zod.z.string()).optional(),
+  scope: zod.z.string().optional()
+});
+const revokeRequestBodySchema = zod.z.object({
+  token: zod.z.string().min(1),
+  token_type_hint: zod.z.string().optional(),
+  client_id: zod.z.string().optional(),
+  client_secret: zod.z.string().optional()
+});
+function validateRequest(schema, data) {
+  const parseResult = schema.safeParse(data);
+  if (!parseResult.success) {
+    const errorMessage = zodValidationError.fromZodError(parseResult.error).message;
+    throw new OidcError.OidcError("invalid_request", errorMessage, 400);
+  }
+  return parseResult.data;
+}
+async function authenticateClient(opts) {
+  const { req, oidc, bodyClientId, bodyClientSecret } = opts;
+  let clientId;
+  let clientSecret;
+  const basicAuth = req.headers.authorization?.match(/^Basic[ ]+([^\s]+)$/i);
+  if (basicAuth) {
+    try {
+      const decoded = Buffer.from(basicAuth[1], "base64").toString("utf8");
+      const idx = decoded.indexOf(":");
+      if (idx >= 0) {
+        clientId = decoded.slice(0, idx);
+        clientSecret = decoded.slice(idx + 1);
+      }
+    } catch {
+    }
+  }
+  if (!clientId || !clientSecret) {
+    if (bodyClientId && bodyClientSecret) {
+      clientId = bodyClientId;
+      clientSecret = bodyClientSecret;
+    }
+  }
+  if (!clientId || !clientSecret) {
+    throw new OidcError.OidcError(
+      "invalid_client",
+      "Client authentication required",
+      401
+    );
+  }
+  try {
+    const ok = await oidc.verifyClientCredentials({
+      clientId,
+      clientSecret
+    });
+    if (!ok) {
+      throw new OidcError.OidcError("invalid_client", "Invalid client credentials", 401);
+    }
+  } catch (e) {
+    throw OidcError.OidcError.fromError(e);
+  }
+  return { clientId, clientSecret };
+}
 class OidcRouter {
   oidc;
   logger;
@@ -58,9 +148,13 @@ class OidcRouter {
       }
       res.json(userInfo);
     });
-    if (this.config.getOptionalBoolean(
+    const dcrEnabled = this.config.getOptionalBoolean(
       "auth.experimentalDynamicClientRegistration.enabled"
-    )) {
+    );
+    const cimdEnabled = this.config.getOptionalBoolean(
+      "auth.experimentalClientIdMetadataDocuments.enabled"
+    );
+    if (dcrEnabled || cimdEnabled) {
       router.get("/v1/authorize", async (req, res) => {
         const {
           client_id: clientId,
@@ -71,14 +165,7 @@ class OidcRouter {
           nonce,
           code_challenge: codeChallenge,
           code_challenge_method: codeChallengeMethod
-        } = req.query;
-        if (!clientId || !redirectUri || !responseType) {
-          this.logger.error(`Failed to authorize: Missing required parameters`);
-          return res.status(400).json({
-            error: "invalid_request",
-            error_description: "Missing required parameters: client_id, redirect_uri, response_type"
-          });
-        }
+        } = validateRequest(authorizeQuerySchema, req.query);
         try {
           const result = await this.oidc.createAuthorizationSession({
             clientId,
@@ -96,31 +183,25 @@ class OidcRouter {
           );
           return res.redirect(authSessionRedirectUrl.toString());
         } catch (error) {
-          const errorParams = new URLSearchParams();
-          errorParams.append(
-            "error",
-            errors.isError(error) ? error.name : "server_error"
-          );
-          errorParams.append(
-            "error_description",
-            errors.isError(error) ? error.message : "Unknown error"
-          );
-          if (state) {
-            errorParams.append("state", state);
+          if (OidcError.OidcError.isOidcError(error)) {
+            const errorParams = new URLSearchParams();
+            errorParams.append("error", error.body.error);
+            errorParams.append(
+              "error_description",
+              error.body.error_description
+            );
+            if (state) {
+              errorParams.append("state", state);
+            }
+            const redirectUrl = new URL(redirectUri);
+            redirectUrl.search = errorParams.toString();
+            return res.redirect(redirectUrl.toString());
           }
-          const redirectUrl = new URL(redirectUri);
-          redirectUrl.search = errorParams.toString();
-          return res.redirect(redirectUrl.toString());
+          throw error;
         }
       });
       router.get("/v1/sessions/:sessionId", async (req, res) => {
-        const { sessionId } = req.params;
-        if (!sessionId) {
-          return res.status(400).json({
-            error: "invalid_request",
-            error_description: "Missing Authorization Session ID"
-          });
-        }
+        const { sessionId } = validateRequest(sessionIdParamSchema, req.params);
         try {
           const session = await this.oidc.getAuthorizationSession({
             sessionId
@@ -132,32 +213,19 @@ class OidcRouter {
             redirectUri: session.redirectUri
           });
         } catch (error) {
-          const description = errors.isError(error) ? error.message : "Unknown error";
-          this.logger.error(
-            `Failed to get authorization session: ${description}`,
-            error
-          );
-          return res.status(404).json({
-            error: "not_found",
-            error_description: description
-          });
+          throw OidcError.OidcError.fromError(error);
         }
       });
       router.post("/v1/sessions/:sessionId/approve", async (req, res) => {
-        const { sessionId } = req.params;
-        if (!sessionId) {
-          return res.status(400).json({
-            error: "invalid_request",
-            error_description: "Missing authorization session ID"
-          });
-        }
+        const { sessionId } = validateRequest(sessionIdParamSchema, req.params);
         try {
           const httpCredentials = await this.httpAuth.credentials(req);
           if (!this.auth.isPrincipal(httpCredentials, "user")) {
-            return res.status(401).json({
-              error: "unauthorized",
-              error_description: "Authentication required"
-            });
+            throw new OidcError.OidcError(
+              "access_denied",
+              "Authentication required",
+              403
+            );
           }
           const { userEntityRef } = httpCredentials.principal;
           const result = await this.oidc.approveAuthorizationSession({
@@ -168,31 +236,14 @@ class OidcRouter {
             redirectUrl: result.redirectUrl
           });
         } catch (error) {
-          const description = errors.isError(error) ? error.message : "Unknown error";
-          this.logger.error(
-            `Failed to approve authorization session: ${description}`,
-            error
-          );
-          return res.status(400).json({
-            error: "invalid_request",
-            error_description: description
-          });
+          throw OidcError.OidcError.fromError(error);
         }
       });
       router.post("/v1/sessions/:sessionId/reject", async (req, res) => {
-        const { sessionId } = req.params;
-        if (!sessionId) {
-          return res.status(400).json({
-            error: "invalid_request",
-            error_description: "Missing authorization session ID"
-          });
-        }
+        const { sessionId } = validateRequest(sessionIdParamSchema, req.params);
         const httpCredentials = await this.httpAuth.credentials(req);
         if (!this.auth.isPrincipal(httpCredentials, "user")) {
-          return res.status(401).json({
-            error: "unauthorized",
-            error_description: "Authentication required"
-          });
+          throw new OidcError.OidcError("access_denied", "Authentication required", 403);
         }
         const { userEntityRef } = httpCredentials.principal;
         try {
@@ -215,15 +266,7 @@ class OidcRouter {
             redirectUrl: redirectUrl.toString()
           });
         } catch (error) {
-          const description = errors.isError(error) ? error.message : "Unknown error";
-          this.logger.error(
-            `Failed to reject authorization session: ${description}`,
-            error
-          );
-          return res.status(400).json({
-            error: "invalid_request",
-            error_description: description
-          });
+          throw OidcError.OidcError.fromError(error);
         }
       });
       router.post("/v1/token", async (req, res) => {
@@ -231,59 +274,81 @@ class OidcRouter {
           grant_type: grantType,
           code,
           redirect_uri: redirectUri,
-          code_verifier: codeVerifier
-        } = req.body;
-        if (!grantType || !code || !redirectUri) {
-          this.logger.error(
-            `Failed to exchange code for token: Missing required parameters`
-          );
-          return res.status(400).json({
-            error: "invalid_request",
-            error_description: "Missing required parameters"
-          });
-        }
-        const expiresIn = readTokenExpiration.readDcrTokenExpiration(this.config);
+          code_verifier: codeVerifier,
+          refresh_token: refreshToken,
+          client_id: bodyClientId,
+          client_secret: bodyClientSecret
+        } = validateRequest(tokenRequestBodySchema, req.body);
         try {
-          const result = await this.oidc.exchangeCodeForToken({
-            code,
-            redirectUri,
-            codeVerifier,
-            grantType,
-            expiresIn
-          });
-          return res.json({
-            access_token: result.accessToken,
-            token_type: result.tokenType,
-            expires_in: result.expiresIn,
-            id_token: result.idToken,
-            scope: result.scope
-          });
-        } catch (error) {
-          const description = errors.isError(error) ? error.message : "Unknown error";
-          this.logger.error(
-            `Failed to exchange code for token: ${description}`,
-            error
-          );
-          if (errors.isError(error)) {
-            if (error.name === "AuthenticationError") {
-              return res.status(401).json({
-                error: "invalid_client",
-                error_description: error.message
-              });
+          if (grantType === "authorization_code") {
+            if (!code || !redirectUri) {
+              throw new OidcError.OidcError(
+                "invalid_request",
+                "Missing code or redirect_uri parameters for authorization_code grant",
+                400
+              );
+            }
+            const result = await this.oidc.exchangeCodeForToken({
+              code,
+              redirectUri,
+              codeVerifier,
+              grantType
+            });
+            return res.json({
+              access_token: result.accessToken,
+              token_type: result.tokenType,
+              expires_in: result.expiresIn,
+              id_token: result.idToken,
+              scope: result.scope,
+              ...result.refreshToken && {
+                refresh_token: result.refreshToken
+              }
+            });
+          }
+          if (grantType === "refresh_token") {
+            if (!refreshToken) {
+              throw new OidcError.OidcError(
+                "invalid_request",
+                "Missing refresh_token parameter for refresh_token grant",
+                400
+              );
             }
-            if (error.name === "InputError") {
-              return res.status(400).json({
-                error: "invalid_request",
-                error_description: error.message
+            const hasCredentials = req.headers.authorization?.match(/^Basic[ ]+([^\s]+)$/i) || bodyClientId && bodyClientSecret;
+            let authenticatedClientId;
+            if (hasCredentials) {
+              const { clientId: authedId } = await authenticateClient({
+                req,
+                oidc: this.oidc,
+                bodyClientId,
+                bodyClientSecret
               });
+              authenticatedClientId = authedId;
             }
+            const result = await this.oidc.refreshAccessToken({
+              refreshToken,
+              clientId: authenticatedClientId
+            });
+            return res.json({
+              access_token: result.accessToken,
+              token_type: result.tokenType,
+              expires_in: result.expiresIn,
+              refresh_token: result.refreshToken
+            });
           }
-          return res.status(500).json({
-            error: "server_error",
-            error_description: description
-          });
+          throw new OidcError.OidcError(
+            "unsupported_grant_type",
+            `Grant type ${grantType} is not supported`,
+            400
+          );
+        } catch (error) {
+          if (errors.isError(error) && error.name === "AuthenticationError") {
+            throw new OidcError.OidcError("invalid_grant", error.message, 400, error);
+          }
+          throw OidcError.OidcError.fromError(error);
         }
       });
+    }
+    if (dcrEnabled) {
       router.post("/v1/register", async (req, res) => {
         const {
           client_name: clientName,
@@ -291,46 +356,52 @@ class OidcRouter {
           response_types: responseTypes,
           grant_types: grantTypes,
           scope
-        } = req.body;
-        if (!redirectUris?.length) {
-          res.status(400).json({
-            error: "invalid_request",
-            error_description: "redirect_uris is required"
-          });
-          return;
-        }
+        } = validateRequest(registerRequestBodySchema, req.body);
         try {
           const client = await this.oidc.registerClient({
-            clientName,
+            clientName: clientName ?? "Backstage CLI",
             redirectUris,
             responseTypes,
             grantTypes,
             scope
           });
-          res.status(201).json({
+          return res.status(201).json({
             client_id: client.clientId,
             redirect_uris: client.redirectUris,
             client_secret: client.clientSecret
           });
         } catch (e) {
-          const description = errors.isError(e) ? e.message : "Unknown error";
-          this.logger.error(`Failed to register client: ${description}`, e);
-          res.status(500).json({
-            error: "server_error",
-            error_description: `Failed to register client: ${description}`
+          throw OidcError.OidcError.fromError(e);
+        }
+      });
+      router.post("/v1/revoke", async (req, res) => {
+        try {
+          const {
+            token,
+            client_id: bodyClientId,
+            client_secret: bodyClientSecret
+          } = validateRequest(revokeRequestBodySchema, req.body ?? {});
+          await authenticateClient({
+            req,
+            oidc: this.oidc,
+            bodyClientId,
+            bodyClientSecret
           });
+          try {
+            await this.oidc.revokeRefreshToken(token);
+          } catch (e) {
+            this.logger.debug("Failed to revoke token", e);
+          }
+          return res.status(200).send("");
+        } catch (e) {
+          throw OidcError.OidcError.fromError(e);
         }
       });
     }
+    router.use(OidcError.OidcError.middleware(this.logger));
     return router;
   }
 }
-function ensureTrailingSlash(appUrl) {
-  if (appUrl.endsWith("/")) {
-    return appUrl;
-  }
-  return `${appUrl}/`;
-}
 
 exports.OidcRouter = OidcRouter;
 //# sourceMappingURL=OidcRouter.cjs.js.map

package/dist/service/OidcRouter.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"OidcRouter.cjs.js","sources":["../../src/service/OidcRouter.ts"],"sourcesContent":["/*\n * Copyright 2025 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport Router from 'express-promise-router';\nimport { OidcService } from './OidcService';\nimport { AuthenticationError, isError } from '@backstage/errors';\nimport {\n  AuthService,\n  HttpAuthService,\n  LoggerService,\n  RootConfigService,\n} from '@backstage/backend-plugin-api';\nimport { TokenIssuer } from '../identity/types';\nimport { UserInfoDatabase } from '../database/UserInfoDatabase';\nimport { OidcDatabase } from '../database/OidcDatabase';\nimport { json } from 'express';\nimport { readDcrTokenExpiration } from './readTokenExpiration.ts';\n\nexport class OidcRouter {\n  private readonly oidc: OidcService;\n  private readonly logger: LoggerService;\n  private readonly auth: AuthService;\n  private readonly appUrl: string;\n  private readonly httpAuth: HttpAuthService;\n  private readonly config: RootConfigService;\n\n  private constructor(\n    oidc: OidcService,\n    logger: LoggerService,\n    auth: AuthService,\n    appUrl: string,\n    httpAuth: HttpAuthService,\n    config: RootConfigService,\n  ) {\n    this.oidc = oidc;\n    this.logger = logger;\n    this.auth = auth;\n    this.appUrl = appUrl;\n    this.httpAuth = httpAuth;\n    this.config = config;\n  }\n\n  static create(options: {\n    auth: AuthService;\n    tokenIssuer: TokenIssuer;\n    baseUrl: string;\n    appUrl: string;\n    logger: LoggerService;\n    userInfo: UserInfoDatabase;\n    oidc: OidcDatabase;\n    httpAuth: HttpAuthService;\n    config: RootConfigService;\n  }) {\n    return new OidcRouter(\n      OidcService.create(options),\n      options.logger,\n      options.auth,\n      options.appUrl,\n      options.httpAuth,\n      options.config,\n    );\n  }\n\n  public getRouter() {\n    const router = Router();\n\n    router.use(json());\n\n    // OpenID Provider Configuration endpoint\n    // https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig\n    // Returns the OpenID Provider Configuration document containing metadata about the provider\n    router.get('/.well-known/openid-configuration', (_req, res) => {\n      res.json(this.oidc.getConfiguration());\n    });\n\n    // JSON Web Key Set endpoint\n    // https://openid.net/specs/openid-connect-core-1_0.html#rfc.section.10.1.1\n    // Returns the public keys used to verify JWTs issued by this provider\n    router.get('/.well-known/jwks.json', async (_req, res) => {\n      const { keys } = await this.oidc.listPublicKeys();\n      res.json({ keys });\n    });\n\n    // UserInfo endpoint\n    // https://openid.net/specs/openid-connect-core-1_0.html#UserInfo\n    // Returns claims about the authenticated user using an access token\n    router.get('/v1/userinfo', async (req, res) => {\n      const matches = req.headers.authorization?.match(/^Bearer[ ]+(\\S+)$/i);\n      const token = matches?.[1];\n      if (!token) {\n        throw new AuthenticationError('No token provided');\n      }\n\n      const userInfo = await this.oidc.getUserInfo({ token });\n\n      if (!userInfo) {\n        res.status(404).send('User info not found');\n        return;\n      }\n\n      res.json(userInfo);\n    });\n\n    if (\n      this.config.getOptionalBoolean(\n        'auth.experimentalDynamicClientRegistration.enabled',\n      )\n    ) {\n      // Authorization endpoint\n      // https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest\n      // Handles the initial authorization request from the client, validates parameters,\n      // and redirects to the Authorization Session page for user approval\n      router.get('/v1/authorize', async (req, res) => {\n        // todo(blam): maybe add zod types for validating input\n        const {\n          client_id: clientId,\n          redirect_uri: redirectUri,\n          response_type: responseType,\n          scope,\n          state,\n          nonce,\n          code_challenge: codeChallenge,\n          code_challenge_method: codeChallengeMethod,\n        } = req.query;\n\n        if (!clientId || !redirectUri || !responseType) {\n          this.logger.error(`Failed to authorize: Missing required parameters`);\n          return res.status(400).json({\n            error: 'invalid_request',\n            error_description:\n              'Missing required parameters: client_id, redirect_uri, response_type',\n          });\n        }\n\n        try {\n          const result = await this.oidc.createAuthorizationSession({\n            clientId: clientId as string,\n            redirectUri: redirectUri as string,\n            responseType: responseType as string,\n            scope: scope as string | undefined,\n            state: state as string | undefined,\n            nonce: nonce as string | undefined,\n            codeChallenge: codeChallenge as string | undefined,\n            codeChallengeMethod: codeChallengeMethod as string | undefined,\n          });\n\n          // todo(blam): maybe this URL could be overridable by config if\n          // the plugin is mounted somewhere else?\n          // support slashes in baseUrl?\n          const authSessionRedirectUrl = new URL(\n            `./oauth2/authorize/${result.id}`,\n            ensureTrailingSlash(this.appUrl),\n          );\n\n          return res.redirect(authSessionRedirectUrl.toString());\n        } catch (error) {\n          const errorParams = new URLSearchParams();\n          errorParams.append(\n            'error',\n            isError(error) ? error.name : 'server_error',\n          );\n          errorParams.append(\n            'error_description',\n            isError(error) ? error.message : 'Unknown error',\n          );\n          if (state) {\n            errorParams.append('state', state as string);\n          }\n\n          const redirectUrl = new URL(redirectUri as string);\n          redirectUrl.search = errorParams.toString();\n          return res.redirect(redirectUrl.toString());\n        }\n      });\n\n      // Authorization Session request details endpoint\n      // Returns Authorization Session request details for the frontend\n      router.get('/v1/sessions/:sessionId', async (req, res) => {\n        const { sessionId } = req.params;\n\n        if (!sessionId) {\n          return res.status(400).json({\n            error: 'invalid_request',\n            error_description: 'Missing Authorization Session ID',\n          });\n        }\n\n        try {\n          const session = await this.oidc.getAuthorizationSession({\n            sessionId,\n          });\n\n          return res.json({\n            id: session.id,\n            clientName: session.clientName,\n            scope: session.scope,\n            redirectUri: session.redirectUri,\n          });\n        } catch (error) {\n          const description = isError(error) ? error.message : 'Unknown error';\n          this.logger.error(\n            `Failed to get authorization session: ${description}`,\n            error,\n          );\n          return res.status(404).json({\n            error: 'not_found',\n            error_description: description,\n          });\n        }\n      });\n\n      // Authorization Session approval endpoint\n      // Handles user approval of Authorization Session requests and generates authorization codes\n      router.post('/v1/sessions/:sessionId/approve', async (req, res) => {\n        const { sessionId } = req.params;\n\n        if (!sessionId) {\n          return res.status(400).json({\n            error: 'invalid_request',\n            error_description: 'Missing authorization session ID',\n          });\n        }\n\n        try {\n          const httpCredentials = await this.httpAuth.credentials(req);\n\n          if (!this.auth.isPrincipal(httpCredentials, 'user')) {\n            return res.status(401).json({\n              error: 'unauthorized',\n              error_description: 'Authentication required',\n            });\n          }\n\n          const { userEntityRef } = httpCredentials.principal;\n\n          const result = await this.oidc.approveAuthorizationSession({\n            sessionId,\n            userEntityRef,\n          });\n\n          return res.json({\n            redirectUrl: result.redirectUrl,\n          });\n        } catch (error) {\n          const description = isError(error) ? error.message : 'Unknown error';\n          this.logger.error(\n            `Failed to approve authorization session: ${description}`,\n            error,\n          );\n          return res.status(400).json({\n            error: 'invalid_request',\n            error_description: description,\n          });\n        }\n      });\n\n      // Authorization Session rejection endpoint\n      // Handles user rejection of Authorization Session requests and redirects with error\n      router.post('/v1/sessions/:sessionId/reject', async (req, res) => {\n        const { sessionId } = req.params;\n\n        if (!sessionId) {\n          return res.status(400).json({\n            error: 'invalid_request',\n            error_description: 'Missing authorization session ID',\n          });\n        }\n\n        const httpCredentials = await this.httpAuth.credentials(req);\n\n        if (!this.auth.isPrincipal(httpCredentials, 'user')) {\n          return res.status(401).json({\n            error: 'unauthorized',\n            error_description: 'Authentication required',\n          });\n        }\n\n        const { userEntityRef } = httpCredentials.principal;\n        try {\n          const session = await this.oidc.getAuthorizationSession({\n            sessionId,\n          });\n\n          await this.oidc.rejectAuthorizationSession({\n            sessionId,\n            userEntityRef,\n          });\n\n          const errorParams = new URLSearchParams();\n          errorParams.append('error', 'access_denied');\n          errorParams.append('error_description', 'User denied the request');\n          if (session.state) {\n            errorParams.append('state', session.state);\n          }\n\n          const redirectUrl = new URL(session.redirectUri);\n          redirectUrl.search = errorParams.toString();\n\n          return res.json({\n            redirectUrl: redirectUrl.toString(),\n          });\n        } catch (error) {\n          const description = isError(error) ? error.message : 'Unknown error';\n          this.logger.error(\n            `Failed to reject authorization session: ${description}`,\n            error,\n          );\n\n          return res.status(400).json({\n            error: 'invalid_request',\n            error_description: description,\n          });\n        }\n      });\n\n      // Token endpoint\n      // https://openid.net/specs/openid-connect-core-1_0.html#TokenRequest\n      // Exchanges authorization codes for access tokens and ID tokens\n      router.post('/v1/token', async (req, res) => {\n        // todo(blam): maybe add zod types for validating input\n        const {\n          grant_type: grantType,\n          code,\n          redirect_uri: redirectUri,\n          code_verifier: codeVerifier,\n        } = req.body;\n\n        if (!grantType || !code || !redirectUri) {\n          this.logger.error(\n            `Failed to exchange code for token: Missing required parameters`,\n          );\n          return res.status(400).json({\n            error: 'invalid_request',\n            error_description: 'Missing required parameters',\n          });\n        }\n\n        const expiresIn = readDcrTokenExpiration(this.config);\n\n        try {\n          const result = await this.oidc.exchangeCodeForToken({\n            code,\n            redirectUri,\n            codeVerifier,\n            grantType,\n            expiresIn,\n          });\n\n          return res.json({\n            access_token: result.accessToken,\n            token_type: result.tokenType,\n            expires_in: result.expiresIn,\n            id_token: result.idToken,\n            scope: result.scope,\n          });\n        } catch (error) {\n          const description = isError(error) ? error.message : 'Unknown error';\n          this.logger.error(\n            `Failed to exchange code for token: ${description}`,\n            error,\n          );\n\n          if (isError(error)) {\n            if (error.name === 'AuthenticationError') {\n              return res.status(401).json({\n                error: 'invalid_client',\n                error_description: error.message,\n              });\n            }\n            if (error.name === 'InputError') {\n              return res.status(400).json({\n                error: 'invalid_request',\n                error_description: error.message,\n              });\n            }\n          }\n\n          return res.status(500).json({\n            error: 'server_error',\n            error_description: description,\n          });\n        }\n      });\n\n      // Dynamic Client Registration endpoint\n      // https://openid.net/specs/openid-connect-registration-1_0.html#ClientRegistration\n      // Allows clients to register themselves dynamically with the provider\n      router.post('/v1/register', async (req, res) => {\n        // todo(blam): maybe add zod types for validating input\n        const {\n          client_name: clientName,\n          redirect_uris: redirectUris,\n          response_types: responseTypes,\n          grant_types: grantTypes,\n          scope,\n        } = req.body;\n\n        if (!redirectUris?.length) {\n          res.status(400).json({\n            error: 'invalid_request',\n            error_description: 'redirect_uris is required',\n          });\n          return;\n        }\n\n        try {\n          const client = await this.oidc.registerClient({\n            clientName,\n            redirectUris,\n            responseTypes,\n            grantTypes,\n            scope,\n          });\n\n          res.status(201).json({\n            client_id: client.clientId,\n            redirect_uris: client.redirectUris,\n            client_secret: client.clientSecret,\n          });\n        } catch (e) {\n          const description = isError(e) ? e.message : 'Unknown error';\n          this.logger.error(`Failed to register client: ${description}`, e);\n\n          res.status(500).json({\n            error: 'server_error',\n            error_description: `Failed to register client: ${description}`,\n          });\n        }\n      });\n    }\n\n    return router;\n  }\n}\nfunction ensureTrailingSlash(appUrl: string): string | URL | undefined {\n  if (appUrl.endsWith('/')) {\n    return appUrl;\n  }\n  return `${appUrl}/`;\n}\n"],"names":["OidcService","Router","json","AuthenticationError","isError","readDcrTokenExpiration"],"mappings":";;;;;;;;;;;;AA8BO,MAAM,UAAA,CAAW;AAAA,EACL,IAAA;AAAA,EACA,MAAA;AAAA,EACA,IAAA;AAAA,EACA,MAAA;AAAA,EACA,QAAA;AAAA,EACA,MAAA;AAAA,EAET,YACN,IAAA,EACA,MAAA,EACA,IAAA,EACA,MAAA,EACA,UACA,MAAA,EACA;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAChB,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AAAA,EAChB;AAAA,EAEA,OAAO,OAAO,OAAA,EAUX;AACD,IAAA,OAAO,IAAI,UAAA;AAAA,MACTA,uBAAA,CAAY,OAAO,OAAO,CAAA;AAAA,MAC1B,OAAA,CAAQ,MAAA;AAAA,MACR,OAAA,CAAQ,IAAA;AAAA,MACR,OAAA,CAAQ,MAAA;AAAA,MACR,OAAA,CAAQ,QAAA;AAAA,MACR,OAAA,CAAQ;AAAA,KACV;AAAA,EACF;AAAA,EAEO,SAAA,GAAY;AACjB,IAAA,MAAM,SAASC,uBAAA,EAAO;AAEtB,IAAA,MAAA,CAAO,GAAA,CAAIC,cAAM,CAAA;AAKjB,IAAA,MAAA,CAAO,GAAA,CAAI,mCAAA,EAAqC,CAAC,IAAA,EAAM,GAAA,KAAQ;AAC7D,MAAA,GAAA,CAAI,IAAA,CAAK,IAAA,CAAK,IAAA,CAAK,gBAAA,EAAkB,CAAA;AAAA,IACvC,CAAC,CAAA;AAKD,IAAA,MAAA,CAAO,GAAA,CAAI,wBAAA,EAA0B,OAAO,IAAA,EAAM,GAAA,KAAQ;AACxD,MAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,IAAA,CAAK,KAAK,cAAA,EAAe;AAChD,MAAA,GAAA,CAAI,IAAA,CAAK,EAAE,IAAA,EAAM,CAAA;AAAA,IACnB,CAAC,CAAA;AAKD,IAAA,MAAA,CAAO,GAAA,CAAI,cAAA,EAAgB,OAAO,GAAA,EAAK,GAAA,KAAQ;AAC7C,MAAA,MAAM,OAAA,GAAU,GAAA,CAAI,OAAA,CAAQ,aAAA,EAAe,MAAM,oBAAoB,CAAA;AACrE,MAAA,MAAM,KAAA,GAAQ,UAAU,CAAC,CAAA;AACzB,MAAA,IAAI,CAAC,KAAA,EAAO;AACV,QAAA,MAAM,IAAIC,2BAAoB,mBAAmB,CAAA;AAAA,MACnD;AAEA,MAAA,MAAM,WAAW,MAAM,IAAA,CAAK,KAAK,WAAA,CAAY,EAAE,OAAO,CAAA;AAEtD,MAAA,IAAI,CAAC,QAAA,EAAU;AACb,QAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,qBAAqB,CAAA;AAC1C,QAAA;AAAA,MACF;AAEA,MAAA,GAAA,CAAI,KAAK,QAAQ,CAAA;AAAA,IACnB,CAAC,CAAA;AAED,IAAA,IACE,KAAK,MAAA,CAAO,kBAAA;AAAA,MACV;AAAA,KACF,EACA;AAKA,MAAA,MAAA,CAAO,GAAA,CAAI,eAAA,EAAiB,OAAO,GAAA,EAAK,GAAA,KAAQ;AAE9C,QAAA,MAAM;AAAA,UACJ,SAAA,EAAW,QAAA;AAAA,UACX,YAAA,EAAc,WAAA;AAAA,UACd,aAAA,EAAe,YAAA;AAAA,UACf,KAAA;AAAA,UACA,KAAA;AAAA,UACA,KAAA;AAAA,UACA,cAAA,EAAgB,aAAA;AAAA,UAChB,qBAAA,EAAuB;AAAA,YACrB,GAAA,CAAI,KAAA;AAER,QAAA,IAAI,CAAC,QAAA,IAAY,CAAC,WAAA,IAAe,CAAC,YAAA,EAAc;AAC9C,UAAA,IAAA,CAAK,MAAA,CAAO,MAAM,CAAA,gDAAA,CAAkD,CAAA;AACpE,UAAA,OAAO,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK;AAAA,YAC1B,KAAA,EAAO,iBAAA;AAAA,YACP,iBAAA,EACE;AAAA,WACH,CAAA;AAAA,QACH;AAEA,QAAA,IAAI;AACF,UAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,IAAA,CAAK,0BAAA,CAA2B;AAAA,YACxD,QAAA;AAAA,YACA,WAAA;AAAA,YACA,YAAA;AAAA,YACA,KAAA;AAAA,YACA,KAAA;AAAA,YACA,KAAA;AAAA,YACA,aAAA;AAAA,YACA;AAAA,WACD,CAAA;AAKD,UAAA,MAAM,yBAAyB,IAAI,GAAA;AAAA,YACjC,CAAA,mBAAA,EAAsB,OAAO,EAAE,CAAA,CAAA;AAAA,YAC/B,mBAAA,CAAoB,KAAK,MAAM;AAAA,WACjC;AAEA,UAAA,OAAO,GAAA,CAAI,QAAA,CAAS,sBAAA,CAAuB,QAAA,EAAU,CAAA;AAAA,QACvD,SAAS,KAAA,EAAO;AACd,UAAA,MAAM,WAAA,GAAc,IAAI,eAAA,EAAgB;AACxC,UAAA,WAAA,CAAY,MAAA;AAAA,YACV,OAAA;AAAA,YACAC,cAAA,CAAQ,KAAK,CAAA,GAAI,KAAA,CAAM,IAAA,GAAO;AAAA,WAChC;AACA,UAAA,WAAA,CAAY,MAAA;AAAA,YACV,mBAAA;AAAA,YACAA,cAAA,CAAQ,KAAK,CAAA,GAAI,KAAA,CAAM,OAAA,GAAU;AAAA,WACnC;AACA,UAAA,IAAI,KAAA,EAAO;AACT,YAAA,WAAA,CAAY,MAAA,CAAO,SAAS,KAAe,CAAA;AAAA,UAC7C;AAEA,UAAA,MAAM,WAAA,GAAc,IAAI,GAAA,CAAI,WAAqB,CAAA;AACjD,UAAA,WAAA,CAAY,MAAA,GAAS,YAAY,QAAA,EAAS;AAC1C,UAAA,OAAO,GAAA,CAAI,QAAA,CAAS,WAAA,CAAY,QAAA,EAAU,CAAA;AAAA,QAC5C;AAAA,MACF,CAAC,CAAA;AAID,MAAA,MAAA,CAAO,GAAA,CAAI,yBAAA,EAA2B,OAAO,GAAA,EAAK,GAAA,KAAQ;AACxD,QAAA,MAAM,EAAE,SAAA,EAAU,GAAI,GAAA,CAAI,MAAA;AAE1B,QAAA,IAAI,CAAC,SAAA,EAAW;AACd,UAAA,OAAO,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK;AAAA,YAC1B,KAAA,EAAO,iBAAA;AAAA,YACP,iBAAA,EAAmB;AAAA,WACpB,CAAA;AAAA,QACH;AAEA,QAAA,IAAI;AACF,UAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,IAAA,CAAK,uBAAA,CAAwB;AAAA,YACtD;AAAA,WACD,CAAA;AAED,UAAA,OAAO,IAAI,IAAA,CAAK;AAAA,YACd,IAAI,OAAA,CAAQ,EAAA;AAAA,YACZ,YAAY,OAAA,CAAQ,UAAA;AAAA,YACpB,OAAO,OAAA,CAAQ,KAAA;AAAA,YACf,aAAa,OAAA,CAAQ;AAAA,WACtB,CAAA;AAAA,QACH,SAAS,KAAA,EAAO;AACd,UAAA,MAAM,WAAA,GAAcA,cAAA,CAAQ,KAAK,CAAA,GAAI,MAAM,OAAA,GAAU,eAAA;AACrD,UAAA,IAAA,CAAK,MAAA,CAAO,KAAA;AAAA,YACV,wCAAwC,WAAW,CAAA,CAAA;AAAA,YACnD;AAAA,WACF;AACA,UAAA,OAAO,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK;AAAA,YAC1B,KAAA,EAAO,WAAA;AAAA,YACP,iBAAA,EAAmB;AAAA,WACpB,CAAA;AAAA,QACH;AAAA,MACF,CAAC,CAAA;AAID,MAAA,MAAA,CAAO,IAAA,CAAK,iCAAA,EAAmC,OAAO,GAAA,EAAK,GAAA,KAAQ;AACjE,QAAA,MAAM,EAAE,SAAA,EAAU,GAAI,GAAA,CAAI,MAAA;AAE1B,QAAA,IAAI,CAAC,SAAA,EAAW;AACd,UAAA,OAAO,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK;AAAA,YAC1B,KAAA,EAAO,iBAAA;AAAA,YACP,iBAAA,EAAmB;AAAA,WACpB,CAAA;AAAA,QACH;AAEA,QAAA,IAAI;AACF,UAAA,MAAM,eAAA,GAAkB,MAAM,IAAA,CAAK,QAAA,CAAS,YAAY,GAAG,CAAA;AAE3D,UAAA,IAAI,CAAC,IAAA,CAAK,IAAA,CAAK,WAAA,CAAY,eAAA,EAAiB,MAAM,CAAA,EAAG;AACnD,YAAA,OAAO,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK;AAAA,cAC1B,KAAA,EAAO,cAAA;AAAA,cACP,iBAAA,EAAmB;AAAA,aACpB,CAAA;AAAA,UACH;AAEA,UAAA,MAAM,EAAE,aAAA,EAAc,GAAI,eAAA,CAAgB,SAAA;AAE1C,UAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,IAAA,CAAK,2BAAA,CAA4B;AAAA,YACzD,SAAA;AAAA,YACA;AAAA,WACD,CAAA;AAED,UAAA,OAAO,IAAI,IAAA,CAAK;AAAA,YACd,aAAa,MAAA,CAAO;AAAA,WACrB,CAAA;AAAA,QACH,SAAS,KAAA,EAAO;AACd,UAAA,MAAM,WAAA,GAAcA,cAAA,CAAQ,KAAK,CAAA,GAAI,MAAM,OAAA,GAAU,eAAA;AACrD,UAAA,IAAA,CAAK,MAAA,CAAO,KAAA;AAAA,YACV,4CAA4C,WAAW,CAAA,CAAA;AAAA,YACvD;AAAA,WACF;AACA,UAAA,OAAO,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK;AAAA,YAC1B,KAAA,EAAO,iBAAA;AAAA,YACP,iBAAA,EAAmB;AAAA,WACpB,CAAA;AAAA,QACH;AAAA,MACF,CAAC,CAAA;AAID,MAAA,MAAA,CAAO,IAAA,CAAK,gCAAA,EAAkC,OAAO,GAAA,EAAK,GAAA,KAAQ;AAChE,QAAA,MAAM,EAAE,SAAA,EAAU,GAAI,GAAA,CAAI,MAAA;AAE1B,QAAA,IAAI,CAAC,SAAA,EAAW;AACd,UAAA,OAAO,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK;AAAA,YAC1B,KAAA,EAAO,iBAAA;AAAA,YACP,iBAAA,EAAmB;AAAA,WACpB,CAAA;AAAA,QACH;AAEA,QAAA,MAAM,eAAA,GAAkB,MAAM,IAAA,CAAK,QAAA,CAAS,YAAY,GAAG,CAAA;AAE3D,QAAA,IAAI,CAAC,IAAA,CAAK,IAAA,CAAK,WAAA,CAAY,eAAA,EAAiB,MAAM,CAAA,EAAG;AACnD,UAAA,OAAO,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK;AAAA,YAC1B,KAAA,EAAO,cAAA;AAAA,YACP,iBAAA,EAAmB;AAAA,WACpB,CAAA;AAAA,QACH;AAEA,QAAA,MAAM,EAAE,aAAA,EAAc,GAAI,eAAA,CAAgB,SAAA;AAC1C,QAAA,IAAI;AACF,UAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,IAAA,CAAK,uBAAA,CAAwB;AAAA,YACtD;AAAA,WACD,CAAA;AAED,UAAA,MAAM,IAAA,CAAK,KAAK,0BAAA,CAA2B;AAAA,YACzC,SAAA;AAAA,YACA;AAAA,WACD,CAAA;AAED,UAAA,MAAM,WAAA,GAAc,IAAI,eAAA,EAAgB;AACxC,UAAA,WAAA,CAAY,MAAA,CAAO,SAAS,eAAe,CAAA;AAC3C,UAAA,WAAA,CAAY,MAAA,CAAO,qBAAqB,yBAAyB,CAAA;AACjE,UAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,YAAA,WAAA,CAAY,MAAA,CAAO,OAAA,EAAS,OAAA,CAAQ,KAAK,CAAA;AAAA,UAC3C;AAEA,UAAA,MAAM,WAAA,GAAc,IAAI,GAAA,CAAI,OAAA,CAAQ,WAAW,CAAA;AAC/C,UAAA,WAAA,CAAY,MAAA,GAAS,YAAY,QAAA,EAAS;AAE1C,UAAA,OAAO,IAAI,IAAA,CAAK;AAAA,YACd,WAAA,EAAa,YAAY,QAAA;AAAS,WACnC,CAAA;AAAA,QACH,SAAS,KAAA,EAAO;AACd,UAAA,MAAM,WAAA,GAAcA,cAAA,CAAQ,KAAK,CAAA,GAAI,MAAM,OAAA,GAAU,eAAA;AACrD,UAAA,IAAA,CAAK,MAAA,CAAO,KAAA;AAAA,YACV,2CAA2C,WAAW,CAAA,CAAA;AAAA,YACtD;AAAA,WACF;AAEA,UAAA,OAAO,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK;AAAA,YAC1B,KAAA,EAAO,iBAAA;AAAA,YACP,iBAAA,EAAmB;AAAA,WACpB,CAAA;AAAA,QACH;AAAA,MACF,CAAC,CAAA;AAKD,MAAA,MAAA,CAAO,IAAA,CAAK,WAAA,EAAa,OAAO,GAAA,EAAK,GAAA,KAAQ;AAE3C,QAAA,MAAM;AAAA,UACJ,UAAA,EAAY,SAAA;AAAA,UACZ,IAAA;AAAA,UACA,YAAA,EAAc,WAAA;AAAA,UACd,aAAA,EAAe;AAAA,YACb,GAAA,CAAI,IAAA;AAER,QAAA,IAAI,CAAC,SAAA,IAAa,CAAC,IAAA,IAAQ,CAAC,WAAA,EAAa;AACvC,UAAA,IAAA,CAAK,MAAA,CAAO,KAAA;AAAA,YACV,CAAA,8DAAA;AAAA,WACF;AACA,UAAA,OAAO,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK;AAAA,YAC1B,KAAA,EAAO,iBAAA;AAAA,YACP,iBAAA,EAAmB;AAAA,WACpB,CAAA;AAAA,QACH;AAEA,QAAA,MAAM,SAAA,GAAYC,0CAAA,CAAuB,IAAA,CAAK,MAAM,CAAA;AAEpD,QAAA,IAAI;AACF,UAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,IAAA,CAAK,oBAAA,CAAqB;AAAA,YAClD,IAAA;AAAA,YACA,WAAA;AAAA,YACA,YAAA;AAAA,YACA,SAAA;AAAA,YACA;AAAA,WACD,CAAA;AAED,UAAA,OAAO,IAAI,IAAA,CAAK;AAAA,YACd,cAAc,MAAA,CAAO,WAAA;AAAA,YACrB,YAAY,MAAA,CAAO,SAAA;AAAA,YACnB,YAAY,MAAA,CAAO,SAAA;AAAA,YACnB,UAAU,MAAA,CAAO,OAAA;AAAA,YACjB,OAAO,MAAA,CAAO;AAAA,WACf,CAAA;AAAA,QACH,SAAS,KAAA,EAAO;AACd,UAAA,MAAM,WAAA,GAAcD,cAAA,CAAQ,KAAK,CAAA,GAAI,MAAM,OAAA,GAAU,eAAA;AACrD,UAAA,IAAA,CAAK,MAAA,CAAO,KAAA;AAAA,YACV,sCAAsC,WAAW,CAAA,CAAA;AAAA,YACjD;AAAA,WACF;AAEA,UAAA,IAAIA,cAAA,CAAQ,KAAK,CAAA,EAAG;AAClB,YAAA,IAAI,KAAA,CAAM,SAAS,qBAAA,EAAuB;AACxC,cAAA,OAAO,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK;AAAA,gBAC1B,KAAA,EAAO,gBAAA;AAAA,gBACP,mBAAmB,KAAA,CAAM;AAAA,eAC1B,CAAA;AAAA,YACH;AACA,YAAA,IAAI,KAAA,CAAM,SAAS,YAAA,EAAc;AAC/B,cAAA,OAAO,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK;AAAA,gBAC1B,KAAA,EAAO,iBAAA;AAAA,gBACP,mBAAmB,KAAA,CAAM;AAAA,eAC1B,CAAA;AAAA,YACH;AAAA,UACF;AAEA,UAAA,OAAO,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK;AAAA,YAC1B,KAAA,EAAO,cAAA;AAAA,YACP,iBAAA,EAAmB;AAAA,WACpB,CAAA;AAAA,QACH;AAAA,MACF,CAAC,CAAA;AAKD,MAAA,MAAA,CAAO,IAAA,CAAK,cAAA,EAAgB,OAAO,GAAA,EAAK,GAAA,KAAQ;AAE9C,QAAA,MAAM;AAAA,UACJ,WAAA,EAAa,UAAA;AAAA,UACb,aAAA,EAAe,YAAA;AAAA,UACf,cAAA,EAAgB,aAAA;AAAA,UAChB,WAAA,EAAa,UAAA;AAAA,UACb;AAAA,YACE,GAAA,CAAI,IAAA;AAER,QAAA,IAAI,CAAC,cAAc,MAAA,EAAQ;AACzB,UAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK;AAAA,YACnB,KAAA,EAAO,iBAAA;AAAA,YACP,iBAAA,EAAmB;AAAA,WACpB,CAAA;AACD,UAAA;AAAA,QACF;AAEA,QAAA,IAAI;AACF,UAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,IAAA,CAAK,cAAA,CAAe;AAAA,YAC5C,UAAA;AAAA,YACA,YAAA;AAAA,YACA,aAAA;AAAA,YACA,UAAA;AAAA,YACA;AAAA,WACD,CAAA;AAED,UAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK;AAAA,YACnB,WAAW,MAAA,CAAO,QAAA;AAAA,YAClB,eAAe,MAAA,CAAO,YAAA;AAAA,YACtB,eAAe,MAAA,CAAO;AAAA,WACvB,CAAA;AAAA,QACH,SAAS,CAAA,EAAG;AACV,UAAA,MAAM,WAAA,GAAcA,cAAA,CAAQ,CAAC,CAAA,GAAI,EAAE,OAAA,GAAU,eAAA;AAC7C,UAAA,IAAA,CAAK,MAAA,CAAO,KAAA,CAAM,CAAA,2BAAA,EAA8B,WAAW,IAAI,CAAC,CAAA;AAEhE,UAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK;AAAA,YACnB,KAAA,EAAO,cAAA;AAAA,YACP,iBAAA,EAAmB,8BAA8B,WAAW,CAAA;AAAA,WAC7D,CAAA;AAAA,QACH;AAAA,MACF,CAAC,CAAA;AAAA,IACH;AAEA,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AACA,SAAS,oBAAoB,MAAA,EAA0C;AACrE,EAAA,IAAI,MAAA,CAAO,QAAA,CAAS,GAAG,CAAA,EAAG;AACxB,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,OAAO,GAAG,MAAM,CAAA,CAAA,CAAA;AAClB;;;;"}
+{"version":3,"file":"OidcRouter.cjs.js","sources":["../../src/service/OidcRouter.ts"],"sourcesContent":["/*\n * Copyright 2025 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport Router from 'express-promise-router';\nimport { OidcService } from './OidcService';\nimport { AuthenticationError, isError } from '@backstage/errors';\nimport {\n  AuthService,\n  HttpAuthService,\n  LoggerService,\n  RootConfigService,\n} from '@backstage/backend-plugin-api';\nimport { TokenIssuer } from '../identity/types';\nimport { UserInfoDatabase } from '../database/UserInfoDatabase';\nimport { OidcDatabase } from '../database/OidcDatabase';\nimport { OfflineAccessService } from './OfflineAccessService';\nimport { json } from 'express';\nimport { z } from 'zod';\nimport { fromZodError } from 'zod-validation-error';\nimport { OidcError } from './OidcError';\n\nfunction ensureTrailingSlash(url: string): string {\n  return url.endsWith('/') ? url : `${url}/`;\n}\n\nconst authorizeQuerySchema = z.object({\n  client_id: z.string().min(1),\n  redirect_uri: z.string().url(),\n  response_type: z.string().min(1),\n  scope: z.string().optional(),\n  state: z.string().optional(),\n  nonce: z.string().optional(),\n  code_challenge: z.string().optional(),\n  code_challenge_method: z.string().optional(),\n});\n\nconst sessionIdParamSchema = z.object({\n  sessionId: z.string().min(1),\n});\n\nconst tokenRequestBodySchema = z.object({\n  grant_type: z.string().min(1),\n  code: z.string().optional(),\n  redirect_uri: z.string().url().optional(),\n  code_verifier: z.string().optional(),\n  refresh_token: z.string().optional(),\n  client_id: z.string().optional(),\n  client_secret: z.string().optional(),\n});\n\nconst registerRequestBodySchema = z.object({\n  client_name: z.string().optional(),\n  redirect_uris: z.array(z.string().url()).min(1),\n  response_types: z.array(z.string()).optional(),\n  grant_types: z.array(z.string()).optional(),\n  scope: z.string().optional(),\n});\n\nconst revokeRequestBodySchema = z.object({\n  token: z.string().min(1),\n  token_type_hint: z.string().optional(),\n  client_id: z.string().optional(),\n  client_secret: z.string().optional(),\n});\n\nfunction validateRequest<T>(schema: z.ZodSchema<T>, data: unknown): T {\n  const parseResult = schema.safeParse(data);\n  if (!parseResult.success) {\n    const errorMessage = fromZodError(parseResult.error).message;\n    throw new OidcError('invalid_request', errorMessage, 400);\n  }\n  return parseResult.data;\n}\n\nasync function authenticateClient(opts: {\n  req: { headers: { authorization?: string } };\n  oidc: OidcService;\n  bodyClientId?: string;\n  bodyClientSecret?: string;\n}): Promise<{ clientId: string; clientSecret: string }> {\n  const { req, oidc, bodyClientId, bodyClientSecret } = opts;\n  let clientId: string | undefined;\n  let clientSecret: string | undefined;\n\n  const basicAuth = req.headers.authorization?.match(/^Basic[ ]+([^\\s]+)$/i);\n  if (basicAuth) {\n    try {\n      const decoded = Buffer.from(basicAuth[1], 'base64').toString('utf8');\n      const idx = decoded.indexOf(':');\n      if (idx >= 0) {\n        clientId = decoded.slice(0, idx);\n        clientSecret = decoded.slice(idx + 1);\n      }\n    } catch {\n      /* ignore */\n    }\n  }\n\n  if (!clientId || !clientSecret) {\n    if (bodyClientId && bodyClientSecret) {\n      clientId = bodyClientId;\n      clientSecret = bodyClientSecret;\n    }\n  }\n\n  if (!clientId || !clientSecret) {\n    throw new OidcError(\n      'invalid_client',\n      'Client authentication required',\n      401,\n    );\n  }\n\n  try {\n    const ok = await oidc.verifyClientCredentials({\n      clientId,\n      clientSecret,\n    });\n    if (!ok) {\n      throw new OidcError('invalid_client', 'Invalid client credentials', 401);\n    }\n  } catch (e) {\n    throw OidcError.fromError(e);\n  }\n\n  return { clientId, clientSecret };\n}\n\nexport class OidcRouter {\n  private readonly oidc: OidcService;\n  private readonly logger: LoggerService;\n  private readonly auth: AuthService;\n  private readonly appUrl: string;\n  private readonly httpAuth: HttpAuthService;\n  private readonly config: RootConfigService;\n\n  private constructor(\n    oidc: OidcService,\n    logger: LoggerService,\n    auth: AuthService,\n    appUrl: string,\n    httpAuth: HttpAuthService,\n    config: RootConfigService,\n  ) {\n    this.oidc = oidc;\n    this.logger = logger;\n    this.auth = auth;\n    this.appUrl = appUrl;\n    this.httpAuth = httpAuth;\n    this.config = config;\n  }\n\n  static create(options: {\n    auth: AuthService;\n    tokenIssuer: TokenIssuer;\n    baseUrl: string;\n    appUrl: string;\n    logger: LoggerService;\n    userInfo: UserInfoDatabase;\n    oidc: OidcDatabase;\n    httpAuth: HttpAuthService;\n    config: RootConfigService;\n    offlineAccess?: OfflineAccessService;\n  }) {\n    return new OidcRouter(\n      OidcService.create(options),\n      options.logger,\n      options.auth,\n      options.appUrl,\n      options.httpAuth,\n      options.config,\n    );\n  }\n\n  public getRouter() {\n    const router = Router();\n\n    router.use(json());\n\n    // OpenID Provider Configuration endpoint\n    // https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig\n    // Returns the OpenID Provider Configuration document containing metadata about the provider\n    router.get('/.well-known/openid-configuration', (_req, res) => {\n      res.json(this.oidc.getConfiguration());\n    });\n\n    // JSON Web Key Set endpoint\n    // https://openid.net/specs/openid-connect-core-1_0.html#rfc.section.10.1.1\n    // Returns the public keys used to verify JWTs issued by this provider\n    router.get('/.well-known/jwks.json', async (_req, res) => {\n      const { keys } = await this.oidc.listPublicKeys();\n      res.json({ keys });\n    });\n\n    // UserInfo endpoint\n    // https://openid.net/specs/openid-connect-core-1_0.html#UserInfo\n    // Returns claims about the authenticated user using an access token\n    router.get('/v1/userinfo', async (req, res) => {\n      const matches = req.headers.authorization?.match(/^Bearer[ ]+(\\S+)$/i);\n      const token = matches?.[1];\n      if (!token) {\n        throw new AuthenticationError('No token provided');\n      }\n\n      const userInfo = await this.oidc.getUserInfo({ token });\n\n      if (!userInfo) {\n        res.status(404).send('User info not found');\n        return;\n      }\n\n      res.json(userInfo);\n    });\n\n    const dcrEnabled = this.config.getOptionalBoolean(\n      'auth.experimentalDynamicClientRegistration.enabled',\n    );\n    const cimdEnabled = this.config.getOptionalBoolean(\n      'auth.experimentalClientIdMetadataDocuments.enabled',\n    );\n\n    if (dcrEnabled || cimdEnabled) {\n      // Authorization endpoint\n      // https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest\n      // Handles the initial authorization request from the client, validates parameters,\n      // and redirects to the Authorization Session page for user approval\n      router.get('/v1/authorize', async (req, res) => {\n        const {\n          client_id: clientId,\n          redirect_uri: redirectUri,\n          response_type: responseType,\n          scope,\n          state,\n          nonce,\n          code_challenge: codeChallenge,\n          code_challenge_method: codeChallengeMethod,\n        } = validateRequest(authorizeQuerySchema, req.query);\n\n        try {\n          const result = await this.oidc.createAuthorizationSession({\n            clientId,\n            redirectUri,\n            responseType,\n            scope,\n            state,\n            nonce,\n            codeChallenge,\n            codeChallengeMethod,\n          });\n\n          // todo(blam): maybe this URL could be overridable by config if\n          // the plugin is mounted somewhere else?\n          // support slashes in baseUrl?\n          const authSessionRedirectUrl = new URL(\n            `./oauth2/authorize/${result.id}`,\n            ensureTrailingSlash(this.appUrl),\n          );\n\n          return res.redirect(authSessionRedirectUrl.toString());\n        } catch (error) {\n          if (OidcError.isOidcError(error)) {\n            const errorParams = new URLSearchParams();\n            errorParams.append('error', error.body.error);\n            errorParams.append(\n              'error_description',\n              error.body.error_description,\n            );\n            if (state) {\n              errorParams.append('state', state);\n            }\n\n            const redirectUrl = new URL(redirectUri);\n            redirectUrl.search = errorParams.toString();\n            return res.redirect(redirectUrl.toString());\n          }\n          throw error;\n        }\n      });\n\n      // Authorization Session request details endpoint\n      // Returns Authorization Session request details for the frontend\n      router.get('/v1/sessions/:sessionId', async (req, res) => {\n        const { sessionId } = validateRequest(sessionIdParamSchema, req.params);\n\n        try {\n          const session = await this.oidc.getAuthorizationSession({\n            sessionId,\n          });\n\n          return res.json({\n            id: session.id,\n            clientName: session.clientName,\n            scope: session.scope,\n            redirectUri: session.redirectUri,\n          });\n        } catch (error) {\n          throw OidcError.fromError(error);\n        }\n      });\n\n      // Authorization Session approval endpoint\n      // Handles user approval of Authorization Session requests and generates authorization codes\n      router.post('/v1/sessions/:sessionId/approve', async (req, res) => {\n        const { sessionId } = validateRequest(sessionIdParamSchema, req.params);\n\n        try {\n          const httpCredentials = await this.httpAuth.credentials(req);\n\n          if (!this.auth.isPrincipal(httpCredentials, 'user')) {\n            throw new OidcError(\n              'access_denied',\n              'Authentication required',\n              403,\n            );\n          }\n\n          const { userEntityRef } = httpCredentials.principal;\n\n          const result = await this.oidc.approveAuthorizationSession({\n            sessionId,\n            userEntityRef,\n          });\n\n          return res.json({\n            redirectUrl: result.redirectUrl,\n          });\n        } catch (error) {\n          throw OidcError.fromError(error);\n        }\n      });\n\n      // Authorization Session rejection endpoint\n      // Handles user rejection of Authorization Session requests and redirects with error\n      router.post('/v1/sessions/:sessionId/reject', async (req, res) => {\n        const { sessionId } = validateRequest(sessionIdParamSchema, req.params);\n\n        const httpCredentials = await this.httpAuth.credentials(req);\n\n        if (!this.auth.isPrincipal(httpCredentials, 'user')) {\n          throw new OidcError('access_denied', 'Authentication required', 403);\n        }\n\n        const { userEntityRef } = httpCredentials.principal;\n        try {\n          const session = await this.oidc.getAuthorizationSession({\n            sessionId,\n          });\n\n          await this.oidc.rejectAuthorizationSession({\n            sessionId,\n            userEntityRef,\n          });\n\n          const errorParams = new URLSearchParams();\n          errorParams.append('error', 'access_denied');\n          errorParams.append('error_description', 'User denied the request');\n          if (session.state) {\n            errorParams.append('state', session.state);\n          }\n\n          const redirectUrl = new URL(session.redirectUri);\n          redirectUrl.search = errorParams.toString();\n\n          return res.json({\n            redirectUrl: redirectUrl.toString(),\n          });\n        } catch (error) {\n          throw OidcError.fromError(error);\n        }\n      });\n\n      // Token endpoint\n      // https://openid.net/specs/openid-connect-core-1_0.html#TokenRequest\n      // Exchanges authorization codes for access tokens and ID tokens\n      // Also handles refresh token grant type\n      router.post('/v1/token', async (req, res) => {\n        const {\n          grant_type: grantType,\n          code,\n          redirect_uri: redirectUri,\n          code_verifier: codeVerifier,\n          refresh_token: refreshToken,\n          client_id: bodyClientId,\n          client_secret: bodyClientSecret,\n        } = validateRequest(tokenRequestBodySchema, req.body);\n\n        try {\n          // Handle authorization_code grant type\n          if (grantType === 'authorization_code') {\n            if (!code || !redirectUri) {\n              throw new OidcError(\n                'invalid_request',\n                'Missing code or redirect_uri parameters for authorization_code grant',\n                400,\n              );\n            }\n\n            const result = await this.oidc.exchangeCodeForToken({\n              code,\n              redirectUri,\n              codeVerifier,\n              grantType,\n            });\n\n            return res.json({\n              access_token: result.accessToken,\n              token_type: result.tokenType,\n              expires_in: result.expiresIn,\n              id_token: result.idToken,\n              scope: result.scope,\n              ...(result.refreshToken && {\n                refresh_token: result.refreshToken,\n              }),\n            });\n          }\n\n          // Handle refresh_token grant type\n          if (grantType === 'refresh_token') {\n            if (!refreshToken) {\n              throw new OidcError(\n                'invalid_request',\n                'Missing refresh_token parameter for refresh_token grant',\n                400,\n              );\n            }\n\n            // Authenticate if credentials are provided via Basic auth or body\n            const hasCredentials =\n              req.headers.authorization?.match(/^Basic[ ]+([^\\s]+)$/i) ||\n              (bodyClientId && bodyClientSecret);\n\n            let authenticatedClientId: string | undefined;\n            if (hasCredentials) {\n              const { clientId: authedId } = await authenticateClient({\n                req,\n                oidc: this.oidc,\n                bodyClientId,\n                bodyClientSecret,\n              });\n              authenticatedClientId = authedId;\n            }\n\n            const result = await this.oidc.refreshAccessToken({\n              refreshToken,\n              clientId: authenticatedClientId,\n            });\n\n            return res.json({\n              access_token: result.accessToken,\n              token_type: result.tokenType,\n              expires_in: result.expiresIn,\n              refresh_token: result.refreshToken,\n            });\n          }\n\n          // Unsupported grant type\n          throw new OidcError(\n            'unsupported_grant_type',\n            `Grant type ${grantType} is not supported`,\n            400,\n          );\n        } catch (error) {\n          // Invalid auth codes and refresh tokens should be invalid_grant, not invalid_client.\n          // Client auth failures are already thrown as OidcError by authenticateClient.\n          if (isError(error) && error.name === 'AuthenticationError') {\n            throw new OidcError('invalid_grant', error.message, 400, error);\n          }\n          throw OidcError.fromError(error);\n        }\n      });\n    }\n\n    // Dynamic Client Registration endpoint - only available when DCR is enabled\n    if (dcrEnabled) {\n      // https://openid.net/specs/openid-connect-registration-1_0.html#ClientRegistration\n      // Allows clients to register themselves dynamically with the provider\n      router.post('/v1/register', async (req, res) => {\n        const {\n          client_name: clientName,\n          redirect_uris: redirectUris,\n          response_types: responseTypes,\n          grant_types: grantTypes,\n          scope,\n        } = validateRequest(registerRequestBodySchema, req.body);\n\n        try {\n          const client = await this.oidc.registerClient({\n            clientName: clientName ?? 'Backstage CLI',\n            redirectUris,\n            responseTypes,\n            grantTypes,\n            scope,\n          });\n\n          return res.status(201).json({\n            client_id: client.clientId,\n            redirect_uris: client.redirectUris,\n            client_secret: client.clientSecret,\n          });\n        } catch (e) {\n          throw OidcError.fromError(e);\n        }\n      });\n\n      // Token Revocation endpoint (RFC 7009-like)\n      // Allows clients to revoke refresh tokens\n      router.post('/v1/revoke', async (req, res) => {\n        try {\n          const {\n            token,\n            client_id: bodyClientId,\n            client_secret: bodyClientSecret,\n          } = validateRequest(revokeRequestBodySchema, req.body ?? {});\n\n          await authenticateClient({\n            req,\n            oidc: this.oidc,\n            bodyClientId,\n            bodyClientSecret,\n          });\n\n          try {\n            await this.oidc.revokeRefreshToken(token);\n          } catch (e) {\n            // RFC 7009 says always respond 200 even for invalid tokens\n            this.logger.debug('Failed to revoke token', e);\n          }\n\n          return res.status(200).send('');\n        } catch (e) {\n          throw OidcError.fromError(e);\n        }\n      });\n    }\n\n    router.use(OidcError.middleware(this.logger));\n\n    return router;\n  }\n}\n"],"names":["z","fromZodError","OidcError","OidcService","Router","json","AuthenticationError","isError"],"mappings":";;;;;;;;;;;;;;AAiCA,SAAS,oBAAoB,GAAA,EAAqB;AAChD,EAAA,OAAO,IAAI,QAAA,CAAS,GAAG,CAAA,GAAI,GAAA,GAAM,GAAG,GAAG,CAAA,CAAA,CAAA;AACzC;AAEA,MAAM,oBAAA,GAAuBA,MAAE,MAAA,CAAO;AAAA,EACpC,SAAA,EAAWA,KAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA,EAC3B,YAAA,EAAcA,KAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI;AAAA,EAC7B,aAAA,EAAeA,KAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA,EAC/B,KAAA,EAAOA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC3B,KAAA,EAAOA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC3B,KAAA,EAAOA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC3B,cAAA,EAAgBA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACpC,qBAAA,EAAuBA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AACpC,CAAC,CAAA;AAED,MAAM,oBAAA,GAAuBA,MAAE,MAAA,CAAO;AAAA,EACpC,SAAA,EAAWA,KAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC;AAC7B,CAAC,CAAA;AAED,MAAM,sBAAA,GAAyBA,MAAE,MAAA,CAAO;AAAA,EACtC,UAAA,EAAYA,KAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA,EAC5B,IAAA,EAAMA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC1B,cAAcA,KAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,QAAA,EAAS;AAAA,EACxC,aAAA,EAAeA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACnC,aAAA,EAAeA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACnC,SAAA,EAAWA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC/B,aAAA,EAAeA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AAC5B,CAAC,CAAA;AAED,MAAM,yBAAA,GAA4BA,MAAE,MAAA,CAAO;AAAA,EACzC,WAAA,EAAaA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACjC,aAAA,EAAeA,KAAA,CAAE,KAAA,CAAMA,KAAA,CAAE,MAAA,GAAS,GAAA,EAAK,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EAC9C,gBAAgBA,KAAA,CAAE,KAAA,CAAMA,MAAE,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EAC7C,aAAaA,KAAA,CAAE,KAAA,CAAMA,MAAE,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EAC1C,KAAA,EAAOA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AACpB,CAAC,CAAA;AAED,MAAM,uBAAA,GAA0BA,MAAE,MAAA,CAAO;AAAA,EACvC,KAAA,EAAOA,KAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA,EACvB,eAAA,EAAiBA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACrC,SAAA,EAAWA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC/B,aAAA,EAAeA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AAC5B,CAAC,CAAA;AAED,SAAS,eAAA,CAAmB,QAAwB,IAAA,EAAkB;AACpE,EAAA,MAAM,WAAA,GAAc,MAAA,CAAO,SAAA,CAAU,IAAI,CAAA;AACzC,EAAA,IAAI,CAAC,YAAY,OAAA,EAAS;AACxB,IAAA,MAAM,YAAA,GAAeC,+BAAA,CAAa,WAAA,CAAY,KAAK,CAAA,CAAE,OAAA;AACrD,IAAA,MAAM,IAAIC,mBAAA,CAAU,iBAAA,EAAmB,YAAA,EAAc,GAAG,CAAA;AAAA,EAC1D;AACA,EAAA,OAAO,WAAA,CAAY,IAAA;AACrB;AAEA,eAAe,mBAAmB,IAAA,EAKsB;AACtD,EAAA,MAAM,EAAE,GAAA,EAAK,IAAA,EAAM,YAAA,EAAc,kBAAiB,GAAI,IAAA;AACtD,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI,YAAA;AAEJ,EAAA,MAAM,SAAA,GAAY,GAAA,CAAI,OAAA,CAAQ,aAAA,EAAe,MAAM,sBAAsB,CAAA;AACzE,EAAA,IAAI,SAAA,EAAW;AACb,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAU,OAAO,IAAA,CAAK,SAAA,CAAU,CAAC,CAAA,EAAG,QAAQ,CAAA,CAAE,QAAA,CAAS,MAAM,CAAA;AACnE,MAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,OAAA,CAAQ,GAAG,CAAA;AAC/B,MAAA,IAAI,OAAO,CAAA,EAAG;AACZ,QAAA,QAAA,GAAW,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA;AAC/B,QAAA,YAAA,GAAe,OAAA,CAAQ,KAAA,CAAM,GAAA,GAAM,CAAC,CAAA;AAAA,MACtC;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AAEA,EAAA,IAAI,CAAC,QAAA,IAAY,CAAC,YAAA,EAAc;AAC9B,IAAA,IAAI,gBAAgB,gBAAA,EAAkB;AACpC,MAAA,QAAA,GAAW,YAAA;AACX,MAAA,YAAA,GAAe,gBAAA;AAAA,IACjB;AAAA,EACF;AAEA,EAAA,IAAI,CAAC,QAAA,IAAY,CAAC,YAAA,EAAc;AAC9B,IAAA,MAAM,IAAIA,mBAAA;AAAA,MACR,gBAAA;AAAA,MACA,gCAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAEA,EAAA,IAAI;AACF,IAAA,MAAM,EAAA,GAAK,MAAM,IAAA,CAAK,uBAAA,CAAwB;AAAA,MAC5C,QAAA;AAAA,MACA;AAAA,KACD,CAAA;AACD,IAAA,IAAI,CAAC,EAAA,EAAI;AACP,MAAA,MAAM,IAAIA,mBAAA,CAAU,gBAAA,EAAkB,4BAAA,EAA8B,GAAG,CAAA;AAAA,IACzE;AAAA,EACF,SAAS,CAAA,EAAG;AACV,IAAA,MAAMA,mBAAA,CAAU,UAAU,CAAC,CAAA;AAAA,EAC7B;AAEA,EAAA,OAAO,EAAE,UAAU,YAAA,EAAa;AAClC;AAEO,MAAM,UAAA,CAAW;AAAA,EACL,IAAA;AAAA,EACA,MAAA;AAAA,EACA,IAAA;AAAA,EACA,MAAA;AAAA,EACA,QAAA;AAAA,EACA,MAAA;AAAA,EAET,YACN,IAAA,EACA,MAAA,EACA,IAAA,EACA,MAAA,EACA,UACA,MAAA,EACA;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAChB,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AAAA,EAChB;AAAA,EAEA,OAAO,OAAO,OAAA,EAWX;AACD,IAAA,OAAO,IAAI,UAAA;AAAA,MACTC,uBAAA,CAAY,OAAO,OAAO,CAAA;AAAA,MAC1B,OAAA,CAAQ,MAAA;AAAA,MACR,OAAA,CAAQ,IAAA;AAAA,MACR,OAAA,CAAQ,MAAA;AAAA,MACR,OAAA,CAAQ,QAAA;AAAA,MACR,OAAA,CAAQ;AAAA,KACV;AAAA,EACF;AAAA,EAEO,SAAA,GAAY;AACjB,IAAA,MAAM,SAASC,uBAAA,EAAO;AAEtB,IAAA,MAAA,CAAO,GAAA,CAAIC,cAAM,CAAA;AAKjB,IAAA,MAAA,CAAO,GAAA,CAAI,mCAAA,EAAqC,CAAC,IAAA,EAAM,GAAA,KAAQ;AAC7D,MAAA,GAAA,CAAI,IAAA,CAAK,IAAA,CAAK,IAAA,CAAK,gBAAA,EAAkB,CAAA;AAAA,IACvC,CAAC,CAAA;AAKD,IAAA,MAAA,CAAO,GAAA,CAAI,wBAAA,EAA0B,OAAO,IAAA,EAAM,GAAA,KAAQ;AACxD,MAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,IAAA,CAAK,KAAK,cAAA,EAAe;AAChD,MAAA,GAAA,CAAI,IAAA,CAAK,EAAE,IAAA,EAAM,CAAA;AAAA,IACnB,CAAC,CAAA;AAKD,IAAA,MAAA,CAAO,GAAA,CAAI,cAAA,EAAgB,OAAO,GAAA,EAAK,GAAA,KAAQ;AAC7C,MAAA,MAAM,OAAA,GAAU,GAAA,CAAI,OAAA,CAAQ,aAAA,EAAe,MAAM,oBAAoB,CAAA;AACrE,MAAA,MAAM,KAAA,GAAQ,UAAU,CAAC,CAAA;AACzB,MAAA,IAAI,CAAC,KAAA,EAAO;AACV,QAAA,MAAM,IAAIC,2BAAoB,mBAAmB,CAAA;AAAA,MACnD;AAEA,MAAA,MAAM,WAAW,MAAM,IAAA,CAAK,KAAK,WAAA,CAAY,EAAE,OAAO,CAAA;AAEtD,MAAA,IAAI,CAAC,QAAA,EAAU;AACb,QAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,qBAAqB,CAAA;AAC1C,QAAA;AAAA,MACF;AAEA,MAAA,GAAA,CAAI,KAAK,QAAQ,CAAA;AAAA,IACnB,CAAC,CAAA;AAED,IAAA,MAAM,UAAA,GAAa,KAAK,MAAA,CAAO,kBAAA;AAAA,MAC7B;AAAA,KACF;AACA,IAAA,MAAM,WAAA,GAAc,KAAK,MAAA,CAAO,kBAAA;AAAA,MAC9B;AAAA,KACF;AAEA,IAAA,IAAI,cAAc,WAAA,EAAa;AAK7B,MAAA,MAAA,CAAO,GAAA,CAAI,eAAA,EAAiB,OAAO,GAAA,EAAK,GAAA,KAAQ;AAC9C,QAAA,MAAM;AAAA,UACJ,SAAA,EAAW,QAAA;AAAA,UACX,YAAA,EAAc,WAAA;AAAA,UACd,aAAA,EAAe,YAAA;AAAA,UACf,KAAA;AAAA,UACA,KAAA;AAAA,UACA,KAAA;AAAA,UACA,cAAA,EAAgB,aAAA;AAAA,UAChB,qBAAA,EAAuB;AAAA,SACzB,GAAI,eAAA,CAAgB,oBAAA,EAAsB,GAAA,CAAI,KAAK,CAAA;AAEnD,QAAA,IAAI;AACF,UAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,IAAA,CAAK,0BAAA,CAA2B;AAAA,YACxD,QAAA;AAAA,YACA,WAAA;AAAA,YACA,YAAA;AAAA,YACA,KAAA;AAAA,YACA,KAAA;AAAA,YACA,KAAA;AAAA,YACA,aAAA;AAAA,YACA;AAAA,WACD,CAAA;AAKD,UAAA,MAAM,yBAAyB,IAAI,GAAA;AAAA,YACjC,CAAA,mBAAA,EAAsB,OAAO,EAAE,CAAA,CAAA;AAAA,YAC/B,mBAAA,CAAoB,KAAK,MAAM;AAAA,WACjC;AAEA,UAAA,OAAO,GAAA,CAAI,QAAA,CAAS,sBAAA,CAAuB,QAAA,EAAU,CAAA;AAAA,QACvD,SAAS,KAAA,EAAO;AACd,UAAA,IAAIJ,mBAAA,CAAU,WAAA,CAAY,KAAK,CAAA,EAAG;AAChC,YAAA,MAAM,WAAA,GAAc,IAAI,eAAA,EAAgB;AACxC,YAAA,WAAA,CAAY,MAAA,CAAO,OAAA,EAAS,KAAA,CAAM,IAAA,CAAK,KAAK,CAAA;AAC5C,YAAA,WAAA,CAAY,MAAA;AAAA,cACV,mBAAA;AAAA,cACA,MAAM,IAAA,CAAK;AAAA,aACb;AACA,YAAA,IAAI,KAAA,EAAO;AACT,cAAA,WAAA,CAAY,MAAA,CAAO,SAAS,KAAK,CAAA;AAAA,YACnC;AAEA,YAAA,MAAM,WAAA,GAAc,IAAI,GAAA,CAAI,WAAW,CAAA;AACvC,YAAA,WAAA,CAAY,MAAA,GAAS,YAAY,QAAA,EAAS;AAC1C,YAAA,OAAO,GAAA,CAAI,QAAA,CAAS,WAAA,CAAY,QAAA,EAAU,CAAA;AAAA,UAC5C;AACA,UAAA,MAAM,KAAA;AAAA,QACR;AAAA,MACF,CAAC,CAAA;AAID,MAAA,MAAA,CAAO,GAAA,CAAI,yBAAA,EAA2B,OAAO,GAAA,EAAK,GAAA,KAAQ;AACxD,QAAA,MAAM,EAAE,SAAA,EAAU,GAAI,eAAA,CAAgB,oBAAA,EAAsB,IAAI,MAAM,CAAA;AAEtE,QAAA,IAAI;AACF,UAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,IAAA,CAAK,uBAAA,CAAwB;AAAA,YACtD;AAAA,WACD,CAAA;AAED,UAAA,OAAO,IAAI,IAAA,CAAK;AAAA,YACd,IAAI,OAAA,CAAQ,EAAA;AAAA,YACZ,YAAY,OAAA,CAAQ,UAAA;AAAA,YACpB,OAAO,OAAA,CAAQ,KAAA;AAAA,YACf,aAAa,OAAA,CAAQ;AAAA,WACtB,CAAA;AAAA,QACH,SAAS,KAAA,EAAO;AACd,UAAA,MAAMA,mBAAA,CAAU,UAAU,KAAK,CAAA;AAAA,QACjC;AAAA,MACF,CAAC,CAAA;AAID,MAAA,MAAA,CAAO,IAAA,CAAK,iCAAA,EAAmC,OAAO,GAAA,EAAK,GAAA,KAAQ;AACjE,QAAA,MAAM,EAAE,SAAA,EAAU,GAAI,eAAA,CAAgB,oBAAA,EAAsB,IAAI,MAAM,CAAA;AAEtE,QAAA,IAAI;AACF,UAAA,MAAM,eAAA,GAAkB,MAAM,IAAA,CAAK,QAAA,CAAS,YAAY,GAAG,CAAA;AAE3D,UAAA,IAAI,CAAC,IAAA,CAAK,IAAA,CAAK,WAAA,CAAY,eAAA,EAAiB,MAAM,CAAA,EAAG;AACnD,YAAA,MAAM,IAAIA,mBAAA;AAAA,cACR,eAAA;AAAA,cACA,yBAAA;AAAA,cACA;AAAA,aACF;AAAA,UACF;AAEA,UAAA,MAAM,EAAE,aAAA,EAAc,GAAI,eAAA,CAAgB,SAAA;AAE1C,UAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,IAAA,CAAK,2BAAA,CAA4B;AAAA,YACzD,SAAA;AAAA,YACA;AAAA,WACD,CAAA;AAED,UAAA,OAAO,IAAI,IAAA,CAAK;AAAA,YACd,aAAa,MAAA,CAAO;AAAA,WACrB,CAAA;AAAA,QACH,SAAS,KAAA,EAAO;AACd,UAAA,MAAMA,mBAAA,CAAU,UAAU,KAAK,CAAA;AAAA,QACjC;AAAA,MACF,CAAC,CAAA;AAID,MAAA,MAAA,CAAO,IAAA,CAAK,gCAAA,EAAkC,OAAO,GAAA,EAAK,GAAA,KAAQ;AAChE,QAAA,MAAM,EAAE,SAAA,EAAU,GAAI,eAAA,CAAgB,oBAAA,EAAsB,IAAI,MAAM,CAAA;AAEtE,QAAA,MAAM,eAAA,GAAkB,MAAM,IAAA,CAAK,QAAA,CAAS,YAAY,GAAG,CAAA;AAE3D,QAAA,IAAI,CAAC,IAAA,CAAK,IAAA,CAAK,WAAA,CAAY,eAAA,EAAiB,MAAM,CAAA,EAAG;AACnD,UAAA,MAAM,IAAIA,mBAAA,CAAU,eAAA,EAAiB,yBAAA,EAA2B,GAAG,CAAA;AAAA,QACrE;AAEA,QAAA,MAAM,EAAE,aAAA,EAAc,GAAI,eAAA,CAAgB,SAAA;AAC1C,QAAA,IAAI;AACF,UAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,IAAA,CAAK,uBAAA,CAAwB;AAAA,YACtD;AAAA,WACD,CAAA;AAED,UAAA,MAAM,IAAA,CAAK,KAAK,0BAAA,CAA2B;AAAA,YACzC,SAAA;AAAA,YACA;AAAA,WACD,CAAA;AAED,UAAA,MAAM,WAAA,GAAc,IAAI,eAAA,EAAgB;AACxC,UAAA,WAAA,CAAY,MAAA,CAAO,SAAS,eAAe,CAAA;AAC3C,UAAA,WAAA,CAAY,MAAA,CAAO,qBAAqB,yBAAyB,CAAA;AACjE,UAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,YAAA,WAAA,CAAY,MAAA,CAAO,OAAA,EAAS,OAAA,CAAQ,KAAK,CAAA;AAAA,UAC3C;AAEA,UAAA,MAAM,WAAA,GAAc,IAAI,GAAA,CAAI,OAAA,CAAQ,WAAW,CAAA;AAC/C,UAAA,WAAA,CAAY,MAAA,GAAS,YAAY,QAAA,EAAS;AAE1C,UAAA,OAAO,IAAI,IAAA,CAAK;AAAA,YACd,WAAA,EAAa,YAAY,QAAA;AAAS,WACnC,CAAA;AAAA,QACH,SAAS,KAAA,EAAO;AACd,UAAA,MAAMA,mBAAA,CAAU,UAAU,KAAK,CAAA;AAAA,QACjC;AAAA,MACF,CAAC,CAAA;AAMD,MAAA,MAAA,CAAO,IAAA,CAAK,WAAA,EAAa,OAAO,GAAA,EAAK,GAAA,KAAQ;AAC3C,QAAA,MAAM;AAAA,UACJ,UAAA,EAAY,SAAA;AAAA,UACZ,IAAA;AAAA,UACA,YAAA,EAAc,WAAA;AAAA,UACd,aAAA,EAAe,YAAA;AAAA,UACf,aAAA,EAAe,YAAA;AAAA,UACf,SAAA,EAAW,YAAA;AAAA,UACX,aAAA,EAAe;AAAA,SACjB,GAAI,eAAA,CAAgB,sBAAA,EAAwB,GAAA,CAAI,IAAI,CAAA;AAEpD,QAAA,IAAI;AAEF,UAAA,IAAI,cAAc,oBAAA,EAAsB;AACtC,YAAA,IAAI,CAAC,IAAA,IAAQ,CAAC,WAAA,EAAa;AACzB,cAAA,MAAM,IAAIA,mBAAA;AAAA,gBACR,iBAAA;AAAA,gBACA,sEAAA;AAAA,gBACA;AAAA,eACF;AAAA,YACF;AAEA,YAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,IAAA,CAAK,oBAAA,CAAqB;AAAA,cAClD,IAAA;AAAA,cACA,WAAA;AAAA,cACA,YAAA;AAAA,cACA;AAAA,aACD,CAAA;AAED,YAAA,OAAO,IAAI,IAAA,CAAK;AAAA,cACd,cAAc,MAAA,CAAO,WAAA;AAAA,cACrB,YAAY,MAAA,CAAO,SAAA;AAAA,cACnB,YAAY,MAAA,CAAO,SAAA;AAAA,cACnB,UAAU,MAAA,CAAO,OAAA;AAAA,cACjB,OAAO,MAAA,CAAO,KAAA;AAAA,cACd,GAAI,OAAO,YAAA,IAAgB;AAAA,gBACzB,eAAe,MAAA,CAAO;AAAA;AACxB,aACD,CAAA;AAAA,UACH;AAGA,UAAA,IAAI,cAAc,eAAA,EAAiB;AACjC,YAAA,IAAI,CAAC,YAAA,EAAc;AACjB,cAAA,MAAM,IAAIA,mBAAA;AAAA,gBACR,iBAAA;AAAA,gBACA,yDAAA;AAAA,gBACA;AAAA,eACF;AAAA,YACF;AAGA,YAAA,MAAM,iBACJ,GAAA,CAAI,OAAA,CAAQ,eAAe,KAAA,CAAM,sBAAsB,KACtD,YAAA,IAAgB,gBAAA;AAEnB,YAAA,IAAI,qBAAA;AACJ,YAAA,IAAI,cAAA,EAAgB;AAClB,cAAA,MAAM,EAAE,QAAA,EAAU,QAAA,EAAS,GAAI,MAAM,kBAAA,CAAmB;AAAA,gBACtD,GAAA;AAAA,gBACA,MAAM,IAAA,CAAK,IAAA;AAAA,gBACX,YAAA;AAAA,gBACA;AAAA,eACD,CAAA;AACD,cAAA,qBAAA,GAAwB,QAAA;AAAA,YAC1B;AAEA,YAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,IAAA,CAAK,kBAAA,CAAmB;AAAA,cAChD,YAAA;AAAA,cACA,QAAA,EAAU;AAAA,aACX,CAAA;AAED,YAAA,OAAO,IAAI,IAAA,CAAK;AAAA,cACd,cAAc,MAAA,CAAO,WAAA;AAAA,cACrB,YAAY,MAAA,CAAO,SAAA;AAAA,cACnB,YAAY,MAAA,CAAO,SAAA;AAAA,cACnB,eAAe,MAAA,CAAO;AAAA,aACvB,CAAA;AAAA,UACH;AAGA,UAAA,MAAM,IAAIA,mBAAA;AAAA,YACR,wBAAA;AAAA,YACA,cAAc,SAAS,CAAA,iBAAA,CAAA;AAAA,YACvB;AAAA,WACF;AAAA,QACF,SAAS,KAAA,EAAO;AAGd,UAAA,IAAIK,cAAA,CAAQ,KAAK,CAAA,IAAK,KAAA,CAAM,SAAS,qBAAA,EAAuB;AAC1D,YAAA,MAAM,IAAIL,mBAAA,CAAU,eAAA,EAAiB,KAAA,CAAM,OAAA,EAAS,KAAK,KAAK,CAAA;AAAA,UAChE;AACA,UAAA,MAAMA,mBAAA,CAAU,UAAU,KAAK,CAAA;AAAA,QACjC;AAAA,MACF,CAAC,CAAA;AAAA,IACH;AAGA,IAAA,IAAI,UAAA,EAAY;AAGd,MAAA,MAAA,CAAO,IAAA,CAAK,cAAA,EAAgB,OAAO,GAAA,EAAK,GAAA,KAAQ;AAC9C,QAAA,MAAM;AAAA,UACJ,WAAA,EAAa,UAAA;AAAA,UACb,aAAA,EAAe,YAAA;AAAA,UACf,cAAA,EAAgB,aAAA;AAAA,UAChB,WAAA,EAAa,UAAA;AAAA,UACb;AAAA,SACF,GAAI,eAAA,CAAgB,yBAAA,EAA2B,GAAA,CAAI,IAAI,CAAA;AAEvD,QAAA,IAAI;AACF,UAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,IAAA,CAAK,cAAA,CAAe;AAAA,YAC5C,YAAY,UAAA,IAAc,eAAA;AAAA,YAC1B,YAAA;AAAA,YACA,aAAA;AAAA,YACA,UAAA;AAAA,YACA;AAAA,WACD,CAAA;AAED,UAAA,OAAO,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK;AAAA,YAC1B,WAAW,MAAA,CAAO,QAAA;AAAA,YAClB,eAAe,MAAA,CAAO,YAAA;AAAA,YACtB,eAAe,MAAA,CAAO;AAAA,WACvB,CAAA;AAAA,QACH,SAAS,CAAA,EAAG;AACV,UAAA,MAAMA,mBAAA,CAAU,UAAU,CAAC,CAAA;AAAA,QAC7B;AAAA,MACF,CAAC,CAAA;AAID,MAAA,MAAA,CAAO,IAAA,CAAK,YAAA,EAAc,OAAO,GAAA,EAAK,GAAA,KAAQ;AAC5C,QAAA,IAAI;AACF,UAAA,MAAM;AAAA,YACJ,KAAA;AAAA,YACA,SAAA,EAAW,YAAA;AAAA,YACX,aAAA,EAAe;AAAA,cACb,eAAA,CAAgB,uBAAA,EAAyB,GAAA,CAAI,IAAA,IAAQ,EAAE,CAAA;AAE3D,UAAA,MAAM,kBAAA,CAAmB;AAAA,YACvB,GAAA;AAAA,YACA,MAAM,IAAA,CAAK,IAAA;AAAA,YACX,YAAA;AAAA,YACA;AAAA,WACD,CAAA;AAED,UAAA,IAAI;AACF,YAAA,MAAM,IAAA,CAAK,IAAA,CAAK,kBAAA,CAAmB,KAAK,CAAA;AAAA,UAC1C,SAAS,CAAA,EAAG;AAEV,YAAA,IAAA,CAAK,MAAA,CAAO,KAAA,CAAM,wBAAA,EAA0B,CAAC,CAAA;AAAA,UAC/C;AAEA,UAAA,OAAO,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,KAAK,EAAE,CAAA;AAAA,QAChC,SAAS,CAAA,EAAG;AACV,UAAA,MAAMA,mBAAA,CAAU,UAAU,CAAC,CAAA;AAAA,QAC7B;AAAA,MACF,CAAC,CAAA;AAAA,IACH;AAEA,IAAA,MAAA,CAAO,GAAA,CAAIA,mBAAA,CAAU,UAAA,CAAW,IAAA,CAAK,MAAM,CAAC,CAAA;AAE5C,IAAA,OAAO,MAAA;AAAA,EACT;AACF;;;;"}