@betterportal/auth-authress-io 0.0.1

package/lib/plugins/service-betterportal-auth-authress-io/index.js

@@ -0,0 +1,366 @@
+import { createConfigSchema, createEventSchemas } from "@bsb/base";
+import * as av from "anyvali";
+import { BetterPortalConfigSchema, BPService } from "@betterportal/plugin-bsb";
+import { verify as verifySignature } from "node:crypto";
+import jwt from "jsonwebtoken";
+import { createBpTokenIssuer, getSigningKeyForKid, loadOrGenerateKeyPair, publicKeyToJwk } from "@betterportal/framework";
+import { registry } from "./.bp-generated/registry.js";
+import { resolve } from "node:path";
+const PluginConfigSchema = av.object({
+    host: av.string().minLength(1).default("0.0.0.0"),
+    port: av.int().min(1).default(3211),
+    issuer: av.string().minLength(1).default("https://authress.betterportal.local"),
+    audience: av.string().minLength(1).default("betterportal-runtime"),
+    accessTokenSeconds: av.int().min(1).default(60 * 15),
+    refreshTokenSeconds: av.int().min(1).default(60 * 60 * 24 * 7),
+    keyStorePath: av.string().minLength(1).default("./.bp-authress-state/keys.json"),
+    betterportal: BetterPortalConfigSchema
+}, { unknownKeys: "strip" });
+const Config = createConfigSchema({
+    name: "service.betterportal.auth.authress-io",
+    description: "BetterPortal Authress.io auth service",
+    tags: ["betterportal", "auth", "authress"],
+    documentation: ["./README.md"]
+}, PluginConfigSchema);
+const EventSchemas = createEventSchemas({
+    emitEvents: {},
+    onEvents: {},
+    emitReturnableEvents: {},
+    onReturnableEvents: {},
+    emitBroadcast: {},
+    onBroadcast: {}
+});
+const STRONG_JWT_ALGORITHMS = [
+    "RS256", "RS384", "RS512",
+    "PS256", "PS384", "PS512",
+    "ES256", "ES384", "ES512"
+];
+const STRONG_EXTERNAL_ALGORITHMS = new Set([...STRONG_JWT_ALGORITHMS, "EdDSA"]);
+function nonEmptyString(value) {
+    return typeof value === "string" && value.trim().length > 0 ? value.trim() : undefined;
+}
+function stripTrailingSlash(value) {
+    return value.replace(/\/+$/, "");
+}
+export function resolveAuthressBrowserConfig(raw) {
+    const authressApiUrl = nonEmptyString(raw?.authressApiUrl);
+    const applicationId = nonEmptyString(raw?.applicationId);
+    if (!authressApiUrl || !applicationId)
+        return null;
+    return {
+        authressApiUrl,
+        applicationId,
+        ...(nonEmptyString(raw?.scopes) ? { scopes: nonEmptyString(raw?.scopes) } : {})
+    };
+}
+export function resolveAuthressAppConfig(raw) {
+    const browser = resolveAuthressBrowserConfig(raw);
+    if (!browser)
+        return null;
+    const authressApiUrl = stripTrailingSlash(browser.authressApiUrl);
+    return {
+        ...browser,
+        authressApiUrl,
+        expectedIssuer: nonEmptyString(raw?.expectedIssuer) ?? authressApiUrl,
+        ...(nonEmptyString(raw?.expectedAudience) ? { expectedAudience: nonEmptyString(raw?.expectedAudience) } : {}),
+        jwksUri: nonEmptyString(raw?.jwksUri) ?? `${authressApiUrl}/.well-known/openid-configuration/jwks`,
+        ...(nonEmptyString(raw?.loginRedirectPath) ? { loginRedirectPath: nonEmptyString(raw?.loginRedirectPath) } : {}),
+        ...(nonEmptyString(raw?.logoutRedirectPath) ? { logoutRedirectPath: nonEmptyString(raw?.logoutRedirectPath) } : {}),
+        ...(nonEmptyString(raw?.roleClaimPath) ? { roleClaimPath: nonEmptyString(raw?.roleClaimPath) } : {}),
+        ...(nonEmptyString(raw?.subjectClaimPath) ? { subjectClaimPath: nonEmptyString(raw?.subjectClaimPath) } : {}),
+        ...(nonEmptyString(raw?.nameClaimPath) ? { nameClaimPath: nonEmptyString(raw?.nameClaimPath) } : {}),
+        ...(nonEmptyString(raw?.emailClaimPath) ? { emailClaimPath: nonEmptyString(raw?.emailClaimPath) } : {}),
+        ...(nonEmptyString(raw?.pictureClaimPath) ? { pictureClaimPath: nonEmptyString(raw?.pictureClaimPath) } : {}),
+        ...(nonEmptyString(raw?.clientSecret) ? { clientSecret: nonEmptyString(raw?.clientSecret) } : {}),
+        ...(nonEmptyString(raw?.apiKey) ? { apiKey: nonEmptyString(raw?.apiKey) } : {})
+    };
+}
+export const AuthressConfigSchemas = [
+    {
+        id: "authress.app",
+        title: "Authress App Config",
+        description: "App-scoped Authress settings for browser login and JWT verification.",
+        scope: "app",
+        jsonSchema: {
+            authressApiUrl: "string",
+            applicationId: "string",
+            expectedIssuer: "string",
+            expectedAudience: "string",
+            jwksUri: "string",
+            scopes: "string",
+            loginRedirectPath: "string",
+            logoutRedirectPath: "string",
+            roleClaimPath: "string",
+            subjectClaimPath: "string",
+            nameClaimPath: "string",
+            emailClaimPath: "string",
+            pictureClaimPath: "string",
+            clientSecret: "string",
+            apiKey: "string"
+        },
+        groups: [
+            { id: "connection", title: "Connection", description: "Authress application and API endpoints.", order: 10, optional: false },
+            { id: "jwt", title: "JWT Verification", description: "Optional overrides for Authress token verification. Leave blank to derive from the Authress API URL.", order: 20, optional: true },
+            { id: "login", title: "Login", description: "Browser login request options.", order: 30, optional: true },
+            { id: "claims", title: "Claims", description: "JWT claim paths mapped into the BetterPortal user context.", order: 40, optional: true },
+            { id: "secrets", title: "Server Credentials", description: "Optional encrypted credentials for server-side Authress API calls.", order: 50, optional: true }
+        ],
+        fields: [
+            { key: "authressApiUrl", title: "Authress API URL", description: "Authress account API URL used by the browser SDK.", scope: "app", visibility: "protected", ownership: "bp", sourceOfTruth: "bp", groupId: "connection", order: 10, required: true },
+            { key: "applicationId", title: "Application ID", description: "Authress application ID for this BP app.", scope: "app", visibility: "protected", ownership: "bp", sourceOfTruth: "bp", groupId: "connection", order: 20, required: true },
+            { key: "expectedIssuer", title: "Expected Issuer", description: "Optional JWT issuer override. Blank uses the Authress API URL.", scope: "app", visibility: "protected", ownership: "bp", sourceOfTruth: "bp", groupId: "jwt", order: 10, required: false },
+            { key: "expectedAudience", title: "Expected Audience", description: "Optional JWT audience override. Blank disables audience validation.", scope: "app", visibility: "protected", ownership: "bp", sourceOfTruth: "bp", groupId: "jwt", order: 20, required: false },
+            { key: "jwksUri", title: "JWKS URI", description: "Optional JWKS endpoint override. Blank uses Authress API URL + /.well-known/openid-configuration/jwks.", scope: "app", visibility: "protected", ownership: "bp", sourceOfTruth: "bp", groupId: "jwt", order: 30, required: false },
+            { key: "scopes", title: "Scopes", description: "Space-separated scopes requested by the browser login flow.", scope: "app", visibility: "protected", ownership: "bp", sourceOfTruth: "bp", groupId: "login", order: 10, required: false },
+            { key: "loginRedirectPath", title: "Logged In Route", description: "Tenant route shown after signing in when no next path is supplied.", scope: "app", visibility: "protected", ownership: "bp", sourceOfTruth: "bp", groupId: "login", order: 20, defaultValue: "/", ui: { control: "select", optionsSource: "app.routes" }, required: false },
+            { key: "logoutRedirectPath", title: "Logged Out Route", description: "Tenant route shown after signing out.", scope: "app", visibility: "protected", ownership: "bp", sourceOfTruth: "bp", groupId: "login", order: 30, defaultValue: "/", ui: { control: "select", optionsSource: "app.routes" }, required: false },
+            { key: "roleClaimPath", title: "Role Claim Path", description: "Dot path to roles in the Authress token.", scope: "app", visibility: "protected", ownership: "bp", sourceOfTruth: "bp", groupId: "claims", order: 10, defaultValue: "roles", required: false },
+            { key: "subjectClaimPath", title: "Subject Claim Path", description: "Dot path to the user subject in the Authress token.", scope: "app", visibility: "protected", ownership: "bp", sourceOfTruth: "bp", groupId: "claims", order: 20, defaultValue: "sub", required: false },
+            { key: "nameClaimPath", title: "Name Claim Path", description: "Dot path to display name in the Authress token.", scope: "app", visibility: "protected", ownership: "bp", sourceOfTruth: "bp", groupId: "claims", order: 30, defaultValue: "name", required: false },
+            { key: "emailClaimPath", title: "Email Claim Path", description: "Dot path to email in the Authress token.", scope: "app", visibility: "protected", ownership: "bp", sourceOfTruth: "bp", groupId: "claims", order: 40, defaultValue: "email", required: false },
+            { key: "pictureClaimPath", title: "Picture Claim Path", description: "Dot path to avatar URL in the Authress token.", scope: "app", visibility: "protected", ownership: "bp", sourceOfTruth: "bp", groupId: "claims", order: 50, defaultValue: "picture", required: false },
+            { key: "clientSecret", title: "Client Secret", description: "Optional Authress client secret for server-side Authress flows.", scope: "app", visibility: "secret", ownership: "bp", sourceOfTruth: "bp", groupId: "secrets", order: 10, required: false },
+            { key: "apiKey", title: "API Key", description: "Optional Authress API key for server-side Authress API calls.", scope: "app", visibility: "secret", ownership: "bp", sourceOfTruth: "bp", groupId: "secrets", order: 20, required: false }
+        ]
+    }
+];
+export class Plugin extends BPService {
+    static Config = Config;
+    static EventSchemas = EventSchemas;
+    keyPair;
+    constructor(cfg) {
+        super({ ...cfg, eventSchemas: EventSchemas });
+    }
+    async init(obs) {
+        this.keyPair = loadOrGenerateKeyPair(resolve(this.config.keyStorePath));
+        await super.init(obs);
+        const jwk = publicKeyToJwk(this.keyPair.publicKeyPem, this.keyPair.kid);
+        this.registerAsAuthProvider({
+            jwks: { keys: [jwk] }
+        });
+    }
+    definition() {
+        return {
+            manifest: {
+                pluginId: "service.betterportal.auth.authress-io",
+                title: "BetterPortal Authress.io",
+                description: "Authress-backed auth service for BetterPortal apps.",
+                capabilities: ["auth"],
+                configSchemas: AuthressConfigSchemas
+            },
+            registry
+        };
+    }
+    getJwtVerifier(tenantId, appId) {
+        void tenantId;
+        void appId;
+        return this.tokenIssuer().verifier("access");
+    }
+    signAccessToken(input) {
+        return this.tokenIssuer().signAccessToken(input);
+    }
+    verifyAuthressToken(token, appConfig, scope) {
+        return verifyAuthressToken(token, appConfig, scope);
+    }
+    issueTokenPair(input, options) {
+        return this.tokenIssuer().issueTokenPair(input, options);
+    }
+    getAuthressAppConfig(tenantId, appId) {
+        return resolveAuthressAppConfig(this.getAuthressRawConfig(tenantId, appId));
+    }
+    getAuthressBrowserConfig(tenantId, appId) {
+        return resolveAuthressBrowserConfig(this.getAuthressRawConfig(tenantId, appId));
+    }
+    getAuthressRawConfig(tenantId, appId) {
+        const ticket = this.authressConfigReadTicket(tenantId);
+        const state = this.configStore.read(ticket);
+        return { ...state.tenant, ...(state.app[appId] ?? {}) };
+    }
+    authressConfigReadTicket(tenantId) {
+        const now = Math.floor(Date.now() / 1000);
+        return {
+            iss: "service.betterportal.auth.authress-io",
+            aud: "service.betterportal.auth.authress-io",
+            sub: "service.betterportal.auth.authress-io",
+            iat: now,
+            exp: now + 60,
+            jti: `${tenantId}:${now}`,
+            realm: "control-plane",
+            tenantId,
+            serviceId: "service.betterportal.auth.authress-io",
+            actions: ["config.read"]
+        };
+    }
+    tokenIssuer() {
+        return createBpTokenIssuer({
+            keyPair: this.keyPair,
+            issuer: this.config.issuer,
+            audience: this.config.audience,
+            accessTokenSeconds: this.config.accessTokenSeconds,
+            refreshTokenSeconds: this.config.refreshTokenSeconds
+        });
+    }
+}
+export { Config, EventSchemas };
+async function verifyAuthressToken(token, appConfig, scope) {
+    const raw = await verifyExternalAuthressJwt(token, appConfig);
+    const subjectPath = appConfig.subjectClaimPath ?? "sub";
+    const sub = readStringClaim(raw, subjectPath) ?? readStringClaim(raw, "sub");
+    if (!sub)
+        throw new Error(`Authress token missing subject claim ${subjectPath}`);
+    const name = readStringClaim(raw, appConfig.nameClaimPath ?? "name") ??
+        readStringClaim(raw, "name") ??
+        readStringClaim(raw, "data.name") ??
+        readStringClaim(raw, "displayName") ??
+        readStringClaim(raw, "preferred_username") ??
+        readStringClaim(raw, "nickname") ??
+        readStringClaim(raw, "data.login");
+    const email = readStringClaim(raw, appConfig.emailClaimPath ?? "email") ??
+        readStringClaim(raw, "email") ??
+        readStringClaim(raw, "email_address");
+    const picture = readStringClaim(raw, appConfig.pictureClaimPath ?? "picture") ??
+        readStringClaim(raw, "picture") ??
+        readStringClaim(raw, "avatar") ??
+        readStringClaim(raw, "avatarUrl") ??
+        readStringClaim(raw, "data.avatar_url");
+    const now = Math.floor(Date.now() / 1000);
+    return {
+        iss: String(raw.iss),
+        aud: normalizeAudience(raw.aud),
+        sub,
+        exp: typeof raw.exp === "number" ? raw.exp : now,
+        iat: typeof raw.iat === "number" ? raw.iat : now,
+        ...(typeof raw.nbf === "number" ? { nbf: raw.nbf } : {}),
+        jti: typeof raw.jti === "string" && raw.jti.length > 0 ? raw.jti : `${sub}:${raw.iat ?? now}`,
+        realm: "runtime",
+        tenantId: scope.tenantId,
+        appId: scope.appId,
+        roles: readStringArrayClaim(raw, appConfig.roleClaimPath ?? "roles"),
+        tokenType: "access",
+        authProvider: "authress.io",
+        providerSubject: sub,
+        provider: authressProviderReference(raw),
+        ...optionalClaim("name", name),
+        ...optionalClaim("email", email),
+        ...optionalClaim("picture", picture)
+    };
+}
+async function verifyExternalAuthressJwt(token, appConfig) {
+    if (typeof token !== "string" || token.length === 0)
+        throw new Error("Token is empty");
+    const parts = token.split(".");
+    if (parts.length !== 3)
+        throw new Error("Token must have exactly three parts");
+    const header = parseHeader(parts[0]);
+    if (!STRONG_EXTERNAL_ALGORITHMS.has(String(header.alg)))
+        throw new Error(`Algorithm not allowed: ${String(header.alg)}`);
+    if (typeof header.kid !== "string" || header.kid.length === 0)
+        throw new Error("Token header missing kid");
+    if ("jku" in header || "x5u" in header)
+        throw new Error("Token header contains untrusted reference (jku/x5u)");
+    const publicKeyPem = await getSigningKeyForKid({ jwksUri: appConfig.jwksUri, issuer: appConfig.expectedIssuer }, header.kid);
+    const claims = header.alg === "EdDSA"
+        ? verifyEdDsaJwt(token, publicKeyPem)
+        : verifyJwtWithJsonwebtoken(token, publicKeyPem, appConfig);
+    assertAuthressClaims(claims, appConfig);
+    return claims;
+}
+function verifyJwtWithJsonwebtoken(token, publicKeyPem, appConfig) {
+    const verified = jwt.verify(token, publicKeyPem, {
+        algorithms: STRONG_JWT_ALGORITHMS,
+        issuer: appConfig.expectedIssuer,
+        ...(appConfig.expectedAudience ? { audience: appConfig.expectedAudience } : {}),
+        complete: false
+    });
+    if (!verified || typeof verified !== "object")
+        throw new Error("Library returned non-object claims");
+    return verified;
+}
+function verifyEdDsaJwt(token, publicKeyPem) {
+    const [encodedHeader, encodedPayload, encodedSignature] = token.split(".");
+    const verified = verifySignature(null, Buffer.from(`${encodedHeader}.${encodedPayload}`), publicKeyPem, Buffer.from(encodedSignature, "base64url"));
+    if (!verified)
+        throw new Error("Library verification failed: invalid signature");
+    return parsePayload(encodedPayload);
+}
+function assertAuthressClaims(claims, appConfig) {
+    const now = Math.floor(Date.now() / 1000);
+    if (claims.iss !== appConfig.expectedIssuer)
+        throw new Error(`Issuer mismatch (manual re-check) (${claims.iss} != ${appConfig.expectedIssuer})`);
+    if (appConfig.expectedAudience) {
+        const audiences = Array.isArray(claims.aud) ? claims.aud : [claims.aud];
+        if (!audiences.includes(appConfig.expectedAudience)) {
+            throw new Error(`Audience mismatch (manual re-check) (${appConfig.expectedAudience} != ${audiences.join(",")})`);
+        }
+    }
+    if (typeof claims.exp !== "number" || claims.exp <= now)
+        throw new Error("Token is expired (manual re-check)");
+    if (typeof claims.nbf === "number" && claims.nbf > now)
+        throw new Error("Token is not yet valid (manual re-check)");
+}
+function parseHeader(encodedHeader) {
+    const parsed = parsePayload(encodedHeader);
+    return parsed;
+}
+function parsePayload(encodedPayload) {
+    let parsed;
+    try {
+        parsed = JSON.parse(Buffer.from(encodedPayload, "base64url").toString("utf8"));
+    }
+    catch {
+        throw new Error("Token part is not valid JSON");
+    }
+    if (!parsed || typeof parsed !== "object")
+        throw new Error("Token part is not an object");
+    return parsed;
+}
+function readStringClaim(claims, path) {
+    const value = readPath(claims, path);
+    return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+function readStringArrayClaim(claims, path) {
+    const value = readPath(claims, path);
+    if (Array.isArray(value))
+        return value.filter((entry) => typeof entry === "string" && entry.length > 0);
+    return typeof value === "string" && value.length > 0 ? [value] : [];
+}
+function authressProviderReference(claims) {
+    const data = claims.data && typeof claims.data === "object" && !Array.isArray(claims.data)
+        ? claims.data
+        : {};
+    return compactProviderReference({
+        username: readStringClaim(claims, "preferred_username") ?? stringValue(data.login),
+        profileUrl: stringValue(data.html_url),
+        accountId: stringValue(data.id) ?? numberValue(data.id),
+        nodeId: stringValue(data.node_id),
+        scope: stringValue(claims.scope) ?? readStringClaim(claims, "context.scope")
+    });
+}
+function compactProviderReference(input) {
+    return Object.fromEntries(Object.entries(input).filter(([, value]) => value !== undefined));
+}
+function stringValue(value) {
+    return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+function numberValue(value) {
+    return typeof value === "number" && Number.isFinite(value) ? value : undefined;
+}
+function readPath(claims, path) {
+    return path.split(".").reduce((current, segment) => {
+        if (!current || typeof current !== "object")
+            return undefined;
+        return current[segment];
+    }, claims);
+}
+function normalizeAudience(value) {
+    if (Array.isArray(value)) {
+        const aud = value.filter((entry) => typeof entry === "string" && entry.length > 0);
+        if (aud.length > 0)
+            return aud;
+    }
+    return typeof value === "string" && value.length > 0 ? value : "authress";
+}
+function optionalClaim(key, value) {
+    return value ? { [key]: value } : {};
+}
+//# sourceMappingURL=index.js.map

package/lib/plugins/service-betterportal-auth-authress-io/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/plugins/service-betterportal-auth-authress-io/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,kBAAkB,EAClB,kBAAkB,EAEnB,MAAM,WAAW,CAAC;AACnB,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EACL,wBAAwB,EACxB,SAAS,EAEV,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,MAAM,IAAI,eAAe,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,GAAuC,MAAM,cAAc,CAAC;AACnE,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,cAAc,EAOf,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AACvD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,MAAM,kBAAkB,GAAG,EAAE,CAAC,MAAM,CAAC;IACnC,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IACjD,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACnC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,qCAAqC,CAAC;IAC/E,QAAQ,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC;IAClE,kBAAkB,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;IACpD,mBAAmB,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC9D,YAAY,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gCAAgC,CAAC;IAChF,YAAY,EAAE,wBAAwB;CACvC,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;AAG7B,MAAM,MAAM,GAAG,kBAAkB,CAC/B;IACE,IAAI,EAAE,uCAAuC;IAC7C,WAAW,EAAE,uCAAuC;IACpD,IAAI,EAAE,CAAC,cAAc,EAAE,MAAM,EAAE,UAAU,CAAC;IAC1C,aAAa,EAAE,CAAC,aAAa,CAAC;CAC/B,EACD,kBAAkB,CACnB,CAAC;AAEF,MAAM,YAAY,GAAG,kBAAkB,CAAC;IACtC,UAAU,EAAE,EAAE;IACd,QAAQ,EAAE,EAAE;IACZ,oBAAoB,EAAE,EAAE;IACxB,kBAAkB,EAAE,EAAE;IACtB,aAAa,EAAE,EAAE;IACjB,WAAW,EAAE,EAAE;CAChB,CAAC,CAAC;AAEH,MAAM,qBAAqB,GAAgB;IACzC,OAAO,EAAE,OAAO,EAAE,OAAO;IACzB,OAAO,EAAE,OAAO,EAAE,OAAO;IACzB,OAAO,EAAE,OAAO,EAAE,OAAO;CAC1B,CAAC;AACF,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,qBAAqB,EAAE,OAAO,CAAC,CAAC,CAAC;AAsBxF,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACzF,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,GAAwC;IACnF,MAAM,cAAc,GAAG,cAAc,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAC3D,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IACzD,IAAI,CAAC,cAAc,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO;QACL,cAAc;QACd,aAAa;QACb,GAAG,CAAC,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,GAAwC;IAC/E,MAAM,OAAO,GAAG,4BAA4B,CAAC,GAAG,CAAC,CAAC;IAClD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,cAAc,GAAG,kBAAkB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAClE,OAAO;QACL,GAAG,OAAO;QACV,cAAc;QACd,cAAc,EAAE,cAAc,CAAC,GAAG,EAAE,cAAc,CAAC,IAAI,cAAc;QACrE,GAAG,CAAC,cAAc,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,cAAc,CAAC,GAAG,EAAE,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7G,OAAO,EAAE,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,GAAG,cAAc,wCAAwC;QAClG,GAAG,CAAC,cAAc,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,cAAc,CAAC,GAAG,EAAE,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChH,GAAG,CAAC,cAAc,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,cAAc,CAAC,GAAG,EAAE,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnH,GAAG,CAAC,cAAc,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,cAAc,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpG,GAAG,CAAC,cAAc,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,cAAc,CAAC,GAAG,EAAE,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7G,GAAG,CAAC,cAAc,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,cAAc,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpG,GAAG,CAAC,cAAc,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,cAAc,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvG,GAAG,CAAC,cAAc,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,cAAc,CAAC,GAAG,EAAE,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7G,GAAG,CAAC,cAAc,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,cAAc,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjG,GAAG,CAAC,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,qBAAqB,GAA6B;IAC7D;QACE,EAAE,EAAE,cAAc;QAClB,KAAK,EAAE,qBAAqB;QAC5B,WAAW,EAAE,sEAAsE;QACnF,KAAK,EAAE,KAAK;QACZ,UAAU,EAAE;YACV,cAAc,EAAE,QAAQ;YACxB,aAAa,EAAE,QAAQ;YACvB,cAAc,EAAE,QAAQ;YACxB,gBAAgB,EAAE,QAAQ;YAC1B,OAAO,EAAE,QAAQ;YACjB,MAAM,EAAE,QAAQ;YAChB,iBAAiB,EAAE,QAAQ;YAC3B,kBAAkB,EAAE,QAAQ;YAC5B,aAAa,EAAE,QAAQ;YACvB,gBAAgB,EAAE,QAAQ;YAC1B,aAAa,EAAE,QAAQ;YACvB,cAAc,EAAE,QAAQ;YACxB,gBAAgB,EAAE,QAAQ;YAC1B,YAAY,EAAE,QAAQ;YACtB,MAAM,EAAE,QAAQ;SACjB;QACD,MAAM,EAAE;YACN,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,yCAAyC,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;YAC7H,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,sGAAsG,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;YACxL,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,gCAAgC,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;YACzG,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,4DAA4D,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;YACvI,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,oBAAoB,EAAE,WAAW,EAAE,oEAAoE,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;SAC7J;QACD,MAAM,EAAE;YACN,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,mDAAmD,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;YACrP,EAAE,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,0CAA0C,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;YACzO,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,gEAAgE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;YAC3P,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,qEAAqE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;YACpQ,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,wGAAwG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;YACrR,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,6DAA6D,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;YACzO,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,oEAAoE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;YAC/U,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,uCAAuC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;YACpT,EAAE,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,0CAA0C,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE;YAC9P,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,oBAAoB,EAAE,WAAW,EAAE,qDAAqD,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE;YAC7Q,EAAE,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,iDAAiD,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE;YACpQ,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,0CAA0C,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE;YAChQ,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,oBAAoB,EAAE,WAAW,EAAE,+CAA+C,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE;YAC3Q,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,iEAAiE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;YACzP,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,+DAA+D,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;SAC5O;KACF;CACF,CAAC;AAEF,MAAM,OAAO,MAAO,SAAQ,SAA2D;IACrF,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,MAAM,CAAC,YAAY,GAAG,YAAY,CAAC;IAC3B,OAAO,CAAc;IAE7B,YAAY,GAA4E;QACtF,KAAK,CAAC,EAAE,GAAG,GAAG,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAe;QACxB,IAAI,CAAC,OAAO,GAAG,qBAAqB,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;QACxE,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtB,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACxE,IAAI,CAAC,sBAAsB,CAAC;YAC1B,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,GAAyC,CAAC,EAAE;SAC5D,CAAC,CAAC;IACL,CAAC;IAES,UAAU;QAClB,OAAO;YACL,QAAQ,EAAE;gBACR,QAAQ,EAAE,uCAAuC;gBACjD,KAAK,EAAE,0BAA0B;gBACjC,WAAW,EAAE,qDAAqD;gBAClE,YAAY,EAAE,CAAC,MAAM,CAAC;gBACtB,aAAa,EAAE,qBAAqB;aACrC;YACD,QAAQ;SACT,CAAC;IACJ,CAAC;IAES,cAAc,CAAC,QAAgB,EAAE,KAAa;QACtD,KAAK,QAAQ,CAAC;QACd,KAAK,KAAK,CAAC;QACX,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC/C,CAAC;IAED,eAAe,CAAC,KAQf;QACC,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IACnD,CAAC;IAED,mBAAmB,CAAC,KAAa,EAAE,SAA4B,EAAE,KAA0C;QACzG,OAAO,mBAAmB,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACtD,CAAC;IAED,cAAc,CAAC,KAWd,EAAE,OAA2C;QAC5C,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC;IAED,oBAAoB,CAAC,QAAgB,EAAE,KAAa;QAClD,OAAO,wBAAwB,CAAC,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;IAC9E,CAAC;IAED,wBAAwB,CAAC,QAAgB,EAAE,KAAa;QACtD,OAAO,4BAA4B,CAAC,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;IAClF,CAAC;IAEO,oBAAoB,CAAC,QAAgB,EAAE,KAAa;QAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5C,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;IAC1D,CAAC;IAEO,wBAAwB,CAAC,QAAgB;QAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,OAAO;YACL,GAAG,EAAE,uCAAuC;YAC5C,GAAG,EAAE,uCAAuC;YAC5C,GAAG,EAAE,uCAAuC;YAC5C,GAAG,EAAE,GAAG;YACR,GAAG,EAAE,GAAG,GAAG,EAAE;YACb,GAAG,EAAE,GAAG,QAAQ,IAAI,GAAG,EAAE;YACzB,KAAK,EAAE,eAAe;YACtB,QAAQ;YACR,SAAS,EAAE,uCAAuC;YAClD,OAAO,EAAE,CAAC,aAAa,CAAC;SACzB,CAAC;IACJ,CAAC;IAEO,WAAW;QACjB,OAAO,mBAAmB,CAAC;YACzB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;YAC1B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC9B,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB;YAClD,mBAAmB,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAmB;SACrD,CAAC,CAAC;IACL,CAAC;;AAGH,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;AAEhC,KAAK,UAAU,mBAAmB,CAAC,KAAa,EAAE,SAA4B,EAAE,KAA0C;IACxH,MAAM,GAAG,GAAG,MAAM,yBAAyB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC9D,MAAM,WAAW,GAAG,SAAS,CAAC,gBAAgB,IAAI,KAAK,CAAC;IACxD,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC7E,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,WAAW,EAAE,CAAC,CAAC;IACjF,MAAM,IAAI,GACR,eAAe,CAAC,GAAG,EAAE,SAAS,CAAC,aAAa,IAAI,MAAM,CAAC;QACvD,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC;QAC5B,eAAe,CAAC,GAAG,EAAE,WAAW,CAAC;QACjC,eAAe,CAAC,GAAG,EAAE,aAAa,CAAC;QACnC,eAAe,CAAC,GAAG,EAAE,oBAAoB,CAAC;QAC1C,eAAe,CAAC,GAAG,EAAE,UAAU,CAAC;QAChC,eAAe,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACrC,MAAM,KAAK,GACT,eAAe,CAAC,GAAG,EAAE,SAAS,CAAC,cAAc,IAAI,OAAO,CAAC;QACzD,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC;QAC7B,eAAe,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IACxC,MAAM,OAAO,GACX,eAAe,CAAC,GAAG,EAAE,SAAS,CAAC,gBAAgB,IAAI,SAAS,CAAC;QAC7D,eAAe,CAAC,GAAG,EAAE,SAAS,CAAC;QAC/B,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC;QAC9B,eAAe,CAAC,GAAG,EAAE,WAAW,CAAC;QACjC,eAAe,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,OAAO;QACL,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;QACpB,GAAG,EAAE,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC;QAC/B,GAAG;QACH,GAAG,EAAE,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;QAChD,GAAG,EAAE,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;QAChD,GAAG,CAAC,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,EAAE,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE;QAC7F,KAAK,EAAE,SAAS;QAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,oBAAoB,CAAC,GAAG,EAAE,SAAS,CAAC,aAAa,IAAI,OAAO,CAAC;QACpE,SAAS,EAAE,QAAQ;QACnB,YAAY,EAAE,aAAa;QAC3B,eAAe,EAAE,GAAG;QACpB,QAAQ,EAAE,yBAAyB,CAAC,GAAG,CAAC;QACxC,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC;QAC9B,GAAG,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC;QAChC,GAAG,aAAa,CAAC,SAAS,EAAE,OAAO,CAAC;KACrC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,KAAa,EAAE,SAA4B;IAClF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACvF,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC/E,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACzH,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC3G,IAAI,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IAE/G,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,cAAc,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7H,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,KAAK,OAAO;QACnC,CAAC,CAAC,cAAc,CAAC,KAAK,EAAE,YAAY,CAAC;QACrC,CAAC,CAAC,yBAAyB,CAAC,KAAK,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;IAC9D,oBAAoB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAa,EAAE,YAAoB,EAAE,SAA4B;IAClG,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE;QAC/C,UAAU,EAAE,qBAAqB;QACjC,MAAM,EAAE,SAAS,CAAC,cAAc;QAChC,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,QAAQ,EAAE,KAAK;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACrG,OAAO,QAAmC,CAAC;AAC7C,CAAC;AAED,SAAS,cAAc,CAAC,KAAa,EAAE,YAAoB;IACzD,MAAM,CAAC,aAAa,EAAE,cAAc,EAAE,gBAAgB,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,eAAe,CAC9B,IAAI,EACJ,MAAM,CAAC,IAAI,CAAC,GAAG,aAAa,IAAI,cAAc,EAAE,CAAC,EACjD,YAAY,EACZ,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAC3C,CAAC;IACF,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACjF,OAAO,YAAY,CAAC,cAAc,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,oBAAoB,CAAC,MAA+B,EAAE,SAA4B;IACzF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,MAAM,CAAC,GAAG,OAAO,SAAS,CAAC,cAAc,GAAG,CAAC,CAAC;IACjJ,IAAI,SAAS,CAAC,gBAAgB,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACxE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,wCAAwC,SAAS,CAAC,gBAAgB,OAAO,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnH,CAAC;IACH,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,IAAI,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAC/G,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,GAAG,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;AACtH,CAAC;AAED,SAAS,WAAW,CAAC,aAAqB;IACxC,MAAM,MAAM,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;IAC3C,OAAO,MAA6E,CAAC;AACvF,CAAC;AAED,SAAS,YAAY,CAAC,cAAsB;IAC1C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC1F,OAAO,MAAiC,CAAC;AAC3C,CAAC;AAED,SAAS,eAAe,CAAC,MAA+B,EAAE,IAAY;IACpE,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC;AAED,SAAS,oBAAoB,CAAC,MAA+B,EAAE,IAAY;IACzE,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACrC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzH,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACtE,CAAC;AAED,SAAS,yBAAyB,CAAC,MAA+B;IAChE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;QACxF,CAAC,CAAC,MAAM,CAAC,IAA+B;QACxC,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,wBAAwB,CAAC;QAC9B,QAAQ,EAAE,eAAe,CAAC,MAAM,EAAE,oBAAoB,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;QAClF,UAAU,EAAE,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC;QACtC,SAAS,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACvD,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC;QACjC,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,eAAe,CAAC,MAAM,EAAE,eAAe,CAAC;KAC7E,CAAC,CAAC;AACL,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAyC;IACzE,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAA0B,CAAC;AACvH,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACjF,CAAC;AAED,SAAS,QAAQ,CAAC,MAA+B,EAAE,IAAY;IAC7D,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAU,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;QAC1D,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC9D,OAAQ,OAAmC,CAAC,OAAO,CAAC,CAAC;IACvD,CAAC,EAAE,MAAM,CAAC,CAAC;AACb,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACpG,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;IACjC,CAAC;IACD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;AAC5E,CAAC;AAED,SAAS,aAAa,CAAyC,GAAM,EAAE,KAAyB;IAC9F,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAiC,CAAC,CAAC,CAAC,EAAE,CAAC;AACtE,CAAC"}

package/lib/schemas/service-betterportal-auth-authress-io.json

@@ -0,0 +1,139 @@
+{
+  "pluginName": "service.betterportal.auth.authress-io",
+  "events": {},
+  "version": "0.0.1",
+  "configSchema": {
+    "anyvaliVersion": "1.0",
+    "schemaVersion": "1.1",
+    "root": {
+      "kind": "object",
+      "properties": {
+        "host": {
+          "kind": "string",
+          "minLength": 1,
+          "default": "0.0.0.0"
+        },
+        "port": {
+          "kind": "int",
+          "min": 1,
+          "default": 3211
+        },
+        "issuer": {
+          "kind": "string",
+          "minLength": 1,
+          "default": "https://authress.betterportal.local"
+        },
+        "audience": {
+          "kind": "string",
+          "minLength": 1,
+          "default": "betterportal-runtime"
+        },
+        "accessTokenSeconds": {
+          "kind": "int",
+          "min": 1,
+          "default": 900
+        },
+        "refreshTokenSeconds": {
+          "kind": "int",
+          "min": 1,
+          "default": 604800
+        },
+        "keyStorePath": {
+          "kind": "string",
+          "minLength": 1,
+          "default": "./.bp-authress-state/keys.json"
+        },
+        "betterportal": {
+          "kind": "optional",
+          "inner": {
+            "kind": "object",
+            "properties": {
+              "bpConfigPath": {
+                "kind": "optional",
+                "inner": {
+                  "kind": "string",
+                  "minLength": 1
+                }
+              },
+              "configApiToken": {
+                "kind": "optional",
+                "inner": {
+                  "kind": "string",
+                  "minLength": 1
+                }
+              },
+              "configEncryptionKey": {
+                "kind": "optional",
+                "inner": {
+                  "kind": "string",
+                  "minLength": 16
+                }
+              },
+              "controlPlaneUrl": {
+                "kind": "optional",
+                "inner": {
+                  "kind": "string",
+                  "minLength": 1
+                }
+              },
+              "serviceApiKey": {
+                "kind": "optional",
+                "inner": {
+                  "kind": "string",
+                  "minLength": 1
+                }
+              },
+              "bootstrapStatePath": {
+                "kind": "string",
+                "minLength": 1,
+                "default": "./.bp-bootstrap/state.enc"
+              },
+              "scopedConfigCachePath": {
+                "kind": "string",
+                "minLength": 1,
+                "default": "./.bp-sync-cache/scoped.json"
+              },
+              "trustedProxyHeaders": {
+                "kind": "bool",
+                "default": false
+              },
+              "cfProxy": {
+                "kind": "bool",
+                "default": false
+              },
+              "trustedProxyIps": {
+                "kind": "array",
+                "items": {
+                  "kind": "string",
+                  "minLength": 1
+                },
+                "default": []
+              }
+            },
+            "required": [
+              "bootstrapStatePath",
+              "scopedConfigCachePath",
+              "trustedProxyHeaders",
+              "cfProxy",
+              "trustedProxyIps"
+            ],
+            "unknownKeys": "strip"
+          }
+        }
+      },
+      "required": [
+        "host",
+        "port",
+        "issuer",
+        "audience",
+        "accessTokenSeconds",
+        "refreshTokenSeconds",
+        "keyStorePath"
+      ],
+      "unknownKeys": "strip"
+    },
+    "definitions": {},
+    "extensions": {}
+  },
+  "pluginType": "service"
+}