@betterportal/config-manager 10.6.35 → 10.7.1

package/lib/plugins/service-betterportal-config-manager/accessControl.js

@@ -0,0 +1,203 @@
+import { createStaticJwksVerifier, eventHeaders, jsonResponse, resolveEmbeddedRequestContext } from "@betterportal/framework";
+import { verifyBootstrapAdminToken } from "./bootstrapAccess.js";
+const ADMIN = "/.well-known/bp/admin";
+const MANAGE = "/.well-known/bp/manage";
+const CONFIG_MANAGER_ID = "org.betterportal.config-manager";
+function bearer(event) {
+    return /^Bearer\s+(\S+)$/i.exec(event.req.headers.get("authorization") ?? "")?.[1];
+}
+function inTree(path, root) {
+    return path === root || path.startsWith(`${root}/`);
+}
+function ownsServiceAuthorization(path, method) {
+    return (method === "PUT" && path === `${ADMIN}/services/self-mutation`)
+        || (method === "PUT" && /^\/\.well-known\/bp\/admin\/apps\/[^/]+\/auth\/roles\/sync$/.test(path));
+}
+function bootstrapRoute(path, method, appId) {
+    return method === "POST" && (path === `${ADMIN}/services/begin-install`
+        || path === `${ADMIN}/apps/${encodeURIComponent(appId)}/auth/roles`);
+}
+async function allowedBootstrapRequest(config, app, path, event) {
+    const body = await event.req.clone().json().catch(() => null);
+    if (!body || typeof body !== "object" || Array.isArray(body))
+        return false;
+    if (path !== `${ADMIN}/services/begin-install`)
+        return body.id === "admin";
+    if (body.tenantId !== app.tenantId || body.appId !== app.id || body.reconfigure === true || body.instanceId !== undefined)
+        return false;
+    const sharedServiceId = body.sharedServiceId;
+    if (sharedServiceId !== "org.betterportal.auth.default" && sharedServiceId !== "org.betterportal.theme.bootstrap1")
+        return false;
+    const service = config.sharedServiceCatalog.find(candidate => candidate.id === sharedServiceId);
+    const activation = config.sharedServiceActivations.find(candidate => candidate.tenantId === app.tenantId
+        && candidate.sharedServiceId === sharedServiceId && candidate.enabled);
+    return !!service && !!activation && service.enabled && !service.apiKeyHash
+        && typeof body.serviceUrl === "string"
+        && body.serviceUrl.replace(/\/+$/, "") === service.baseUrl.replace(/\/+$/, "");
+}
+function currentApp(config, event) {
+    const url = new URL(event.req.url, "http://betterportal.invalid");
+    const appId = url.searchParams.get("appId") ?? event.req.headers.get("x-bp-app-id");
+    const app = appId
+        ? config.apps.find(candidate => candidate.id === appId)
+        : resolveEmbeddedRequestContext(config, eventHeaders(event))?.app;
+    return app && config.tenants.some(tenant => tenant.id === app.tenantId && tenant.active) ? app : undefined;
+}
+function permissionForManage(path, method) {
+    if (path === `${MANAGE}/current`)
+        return undefined;
+    const suffix = path.slice(MANAGE.length + 1);
+    const resource = suffix.split("/", 1)[0];
+    const viewId = resource === "services" || resource === "webhooks" ? "services.index"
+        : resource === "routes" ? "routes.index"
+            : resource === "fragments" ? "fragments.index"
+                : resource === "theme" ? "config.index"
+                    : undefined;
+    if (!viewId)
+        return undefined;
+    if (!["GET", "POST", "PUT", "PATCH", "DELETE"].includes(method))
+        return undefined;
+    const action = method === "GET" ? "read" : method === "DELETE" ? "delete"
+        : method === "PUT" || method === "PATCH" || (method === "POST" && (resource === "theme" || suffix === "services/activate"))
+            ? "update" : "create";
+    return { viewId, action };
+}
+async function permissionForAdmin(path, method, event, config) {
+    const suffix = path.slice(ADMIN.length + 1);
+    const action = method === "GET" ? "read" : method === "POST" ? "create"
+        : method === "PUT" || method === "PATCH" ? "update" : method === "DELETE" ? "delete" : undefined;
+    if (!action)
+        return undefined;
+    const menuReads = ["menu-editor", "menu-editor/item", "menu-editor/views", "menu-editor/default-target"];
+    if (method === "GET" && menuReads.includes(suffix))
+        return { viewId: "menu.index", action: "read" };
+    const menuAction = /^menu-editor\/(save-visibility|save-title|save-link|save-external|add|remove|toggle|toggle-expanded|move-up|move-down|move-in|move-after|move-out)$/.exec(suffix)?.[1];
+    if (method === "POST" && menuAction)
+        return { viewId: "menu.index", action: menuAction === "add" ? "create" : menuAction === "remove" ? "delete" : "update" };
+    if (method === "GET" && suffix === "fragments-editor")
+        return { viewId: "fragments.index", action: "read" };
+    const fragmentAction = /^fragments-editor\/(set-mode|set-override|add|remove|move-up|move-down)$/.exec(suffix)?.[1];
+    if (method === "POST" && fragmentAction)
+        return { viewId: "fragments.index", action: fragmentAction === "add" ? "create" : fragmentAction === "remove" ? "delete" : "update" };
+    const appResource = /^apps\/[^/]+\/(routes(?:\/[^/]+)?|menu|auth\/roles(?:\/[^/]+)?|m2m\/connections(?:\/[^/]+)?|theme-config\/bootstrap1)$/.exec(suffix)?.[1];
+    if (appResource)
+        return { viewId: appResource.startsWith("routes") ? "routes.index"
+                : appResource === "menu" ? "menu.index"
+                    : appResource.startsWith("auth/") ? "auth.index"
+                        : appResource.startsWith("m2m/") ? "services.index" : "config.index",
+            action: appResource === "theme-config/bootstrap1" ? "update" : action };
+    if (suffix === "platform-services" || /^shared-services(?:\/[^/]+(?:\/activations(?:\/purge)?)?)?$/.test(suffix)
+        || /^tenants\/[^/]+\/(?:services(?:\/[^/]+(?:\/(?:purge|migrate-to-shared(?:\/preview)?))?)?|activate\/[^/]+)$/.test(suffix)) {
+        return { viewId: "services.index", action: suffix.endsWith("/purge") ? "delete" : suffix.endsWith("/migrate-to-shared") ? "update" : action };
+    }
+    if (suffix === "services/begin-install" && method === "POST") {
+        const body = await event.req.clone().json().catch(() => null);
+        const existingInstance = typeof body?.instanceId === "string" && (config.platformServices.some(service => service.id === body.instanceId)
+            || config.tenants.some(tenant => tenant.services.some(service => service.id === body.instanceId)));
+        const registeredShared = typeof body?.sharedServiceId === "string" && config.sharedServiceCatalog.some(service => service.id === body.sharedServiceId && !!service.apiKeyHash);
+        return { viewId: "services.index", action: body?.reconfigure === true || existingInstance || registeredShared ? "update" : "create" };
+    }
+    if (suffix === "services/begin-hostname-change" && method === "POST")
+        return { viewId: "services.index", action: "update" };
+    if ((suffix === "wizard/step1" || suffix === "configure") && method === "GET"
+        || suffix === "wizard/verify" && method === "POST")
+        return { viewId: "services.index", action: "read" };
+    if (suffix === "wizard/register" && method === "POST")
+        return { viewId: "services.index", action: "create" };
+    if (suffix === "wizard/cleanup-provisional-service" && method === "POST")
+        return { viewId: "services.index", action: "delete" };
+    if (suffix === "config-ticket" && method === "POST") {
+        const body = await event.req.clone().json().catch(() => null);
+        return { viewId: "services.index", action: Array.isArray(body?.actions) && body.actions.includes("config.write") ? "update" : "read" };
+    }
+    return undefined;
+}
+function hasPermission(config, app, roleIds, viewId, action) {
+    const ids = new Set([CONFIG_MANAGER_ID]);
+    const tenant = config.tenants.find(candidate => candidate.id === app.tenantId);
+    for (const service of tenant?.services ?? []) {
+        if (service.serviceId === CONFIG_MANAGER_ID)
+            ids.add(service.id);
+    }
+    for (const activation of config.sharedServiceActivations) {
+        if (activation.tenantId !== app.tenantId || !activation.enabled)
+            continue;
+        const shared = config.sharedServiceCatalog.find(service => service.id === activation.sharedServiceId);
+        if (shared?.serviceId === CONFIG_MANAGER_ID)
+            ids.add(activation.id);
+    }
+    return (app.auth?.roles ?? []).some(role => roleIds.includes(role.id)
+        && role.permissions.some(grant => ids.has(grant.serviceId) && grant.viewId === viewId && grant.permissions.includes(action)));
+}
+/** Raw H3 routes do not pass through the framework's registered-route authorization. */
+export function registerRawManagementAccessControl(app, store, cpState) {
+    app.use("/.well-known/bp/**", async (event) => {
+        const path = event.url.pathname;
+        const method = event.req.method;
+        const admin = inTree(path, ADMIN);
+        const manage = inTree(path, MANAGE);
+        if (!admin && !manage)
+            return;
+        if (method === "OPTIONS")
+            return;
+        if (admin && ownsServiceAuthorization(path, method))
+            return;
+        event.res.headers.set("Cache-Control", "no-store");
+        const token = bearer(event);
+        if (!token)
+            return jsonResponse({ error: "Management authorization required" }, 401);
+        const config = await store.loadConfig();
+        const target = admin
+            ? config.apps.find(candidate => candidate.id === config.configManagement.managementAppId
+                && candidate.tenantId === config.configManagement.adminTenantId)
+            : currentApp(config, event);
+        if (!target)
+            return jsonResponse({ error: "Management app unavailable" }, 503);
+        if (admin && bootstrapRoute(path, method, target.id)) {
+            try {
+                const scope = await verifyBootstrapAdminToken(cpState, token);
+                if (scope.tenantId === target.tenantId && scope.appId === target.id) {
+                    return await allowedBootstrapRequest(config, target, path, event)
+                        ? undefined : jsonResponse({ error: "Bootstrap operation is outside its setup scope" }, 403);
+                }
+            }
+            catch { /* A normal management user token may still authorize this request. */ }
+        }
+        const auth = target.auth;
+        if (!auth?.publicKeys?.keys.length)
+            return jsonResponse({ error: "Management authentication unavailable" }, 503);
+        let claims;
+        try {
+            claims = await createStaticJwksVerifier({
+                jwks: auth.publicKeys,
+                expectedIssuer: auth.expectedIssuer,
+                expectedAudience: auth.expectedAudience,
+                expectedTokenType: "access"
+            }).verify(token, { tenantId: target.tenantId, appId: target.id });
+        }
+        catch {
+            return jsonResponse({ error: "Invalid management token" }, 401);
+        }
+        if (claims.tenantId !== target.tenantId || claims.appId !== target.id || claims.tokenType !== "access") {
+            return jsonResponse({ error: "Management token scope mismatch" }, 401);
+        }
+        const root = target.id === config.configManagement.managementAppId
+            && target.tenantId === config.configManagement.adminTenantId && claims.roles.includes("*");
+        if (admin) {
+            if (root)
+                return;
+            const policy = await permissionForAdmin(path, method, event, config);
+            return policy && hasPermission(config, target, claims.roles, policy.viewId, policy.action)
+                ? undefined : jsonResponse({ error: "Platform management permission required" }, 403);
+        }
+        if (root)
+            return;
+        if (path === `${MANAGE}/current`)
+            return;
+        const policy = permissionForManage(path, method);
+        if (!policy || !hasPermission(config, target, claims.roles, policy.viewId, policy.action)) {
+            return jsonResponse({ error: "Management permission required" }, 403);
+        }
+    });
+}
+//# sourceMappingURL=accessControl.js.map

package/lib/plugins/service-betterportal-config-manager/accessControl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"accessControl.js","sourceRoot":"","sources":["../../../src/plugins/service-betterportal-config-manager/accessControl.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,YAAY,EACZ,YAAY,EACZ,6BAA6B,EAM9B,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAEjE,MAAM,KAAK,GAAG,uBAAuB,CAAC;AACtC,MAAM,MAAM,GAAG,wBAAwB,CAAC;AACxC,MAAM,iBAAiB,GAAG,iCAAiC,CAAC;AAG5D,SAAS,MAAM,CAAC,KAAwB;IACtC,OAAO,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AACrF,CAAC;AAED,SAAS,MAAM,CAAC,IAAY,EAAE,IAAY;IACxC,OAAO,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAY,EAAE,MAAc;IAC5D,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,GAAG,KAAK,yBAAyB,CAAC;WAClE,CAAC,MAAM,KAAK,KAAK,IAAI,6DAA6D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACtG,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,MAAc,EAAE,KAAa;IACjE,OAAO,MAAM,KAAK,MAAM,IAAI,CAAC,IAAI,KAAK,GAAG,KAAK,yBAAyB;WAClE,IAAI,KAAK,GAAG,KAAK,SAAS,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;AACzE,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,MAA0B,EAAE,GAAoB,EAAE,IAAY,EAAE,KAAwB;IAC7H,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAmC,CAAC;IAChG,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3E,IAAI,IAAI,KAAK,GAAG,KAAK,yBAAyB;QAAE,OAAO,IAAI,CAAC,EAAE,KAAK,OAAO,CAAC;IAC3E,IAAI,IAAI,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,KAAK,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACxI,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;IAC7C,IAAI,eAAe,KAAK,+BAA+B,IAAI,eAAe,KAAK,mCAAmC;QAAE,OAAO,KAAK,CAAC;IACjI,MAAM,OAAO,GAAG,MAAM,CAAC,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,eAAe,CAAC,CAAC;IAChG,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ;WACnG,SAAS,CAAC,eAAe,KAAK,eAAe,IAAI,SAAS,CAAC,OAAO,CAAC,CAAC;IACzE,OAAO,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,UAAU,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU;WACrE,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ;WACnC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,UAAU,CAAC,MAA0B,EAAE,KAAwB;IACtE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACpF,MAAM,GAAG,GAAG,KAAK;QACf,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,KAAK,CAAC;QACvD,CAAC,CAAC,6BAA6B,CAAC,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;IACpE,OAAO,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,GAAG,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7G,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY,EAAE,MAAc;IACvD,IAAI,IAAI,KAAK,GAAG,MAAM,UAAU;QAAE,OAAO,SAAS,CAAC;IACnD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,gBAAgB;QAClF,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc;YACtC,CAAC,CAAC,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,iBAAiB;gBAC5C,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,cAAc;oBACrC,CAAC,CAAC,SAAS,CAAC;IACpB,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAClF,MAAM,MAAM,GAAW,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ;QAC/E,CAAC,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,OAAO,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,KAAK,mBAAmB,CAAC,CAAC;YACzH,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC1B,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,IAAY,EAAE,MAAc,EAAE,KAAwB,EAAE,MAA0B;IAClH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAuB,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ;QACzF,CAAC,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IACnG,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAE9B,MAAM,SAAS,GAAG,CAAC,aAAa,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,4BAA4B,CAAC,CAAC;IACzG,IAAI,MAAM,KAAK,KAAK,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACpG,MAAM,UAAU,GAAG,qJAAqJ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3L,IAAI,MAAM,KAAK,MAAM,IAAI,UAAU;QAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,KAAK,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAE9J,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,kBAAkB;QAAE,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5G,MAAM,cAAc,GAAG,0EAA0E,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACpH,IAAI,MAAM,KAAK,MAAM,IAAI,cAAc;QAAE,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,cAAc,KAAK,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAE/K,MAAM,WAAW,GAAG,wHAAwH,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/J,IAAI,WAAW;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,cAAc;gBACjF,CAAC,CAAC,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,YAAY;oBACrC,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY;wBAC9C,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,cAAc;YACxE,MAAM,EAAE,WAAW,KAAK,yBAAyB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAE1E,IAAI,MAAM,KAAK,mBAAmB,IAAI,6DAA6D,CAAC,IAAI,CAAC,MAAM,CAAC;WAC3G,4GAA4G,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/H,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAChJ,CAAC;IACD,IAAI,MAAM,KAAK,wBAAwB,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QAC7D,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAsF,CAAC;QACnJ,MAAM,gBAAgB,GAAG,OAAO,IAAI,EAAE,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,IAAI,CAAC,UAAU,CAAC;eACpI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACrG,MAAM,gBAAgB,GAAG,OAAO,IAAI,EAAE,eAAe,KAAK,QAAQ,IAAI,MAAM,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,IAAI,CAAC,eAAe,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC/K,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,KAAK,IAAI,IAAI,gBAAgB,IAAI,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACxI,CAAC;IACD,IAAI,MAAM,KAAK,gCAAgC,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC5H,IAAI,CAAC,MAAM,KAAK,cAAc,IAAI,MAAM,KAAK,WAAW,CAAC,IAAI,MAAM,KAAK,KAAK;WACxE,MAAM,KAAK,eAAe,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC1G,IAAI,MAAM,KAAK,iBAAiB,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC7G,IAAI,MAAM,KAAK,oCAAoC,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAChI,IAAI,MAAM,KAAK,eAAe,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAiC,CAAC;QAC9F,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACzI,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,aAAa,CAAC,MAA0B,EAAE,GAAoB,EAAE,OAAiB,EAAE,MAAc,EAAE,MAAc;IACxH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/E,KAAK,MAAM,OAAO,IAAI,MAAM,EAAE,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC7C,IAAI,OAAO,CAAC,SAAS,KAAK,iBAAiB;YAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,wBAAwB,EAAE,CAAC;QACzD,IAAI,UAAU,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,OAAO;YAAE,SAAS;QAC1E,MAAM,MAAM,GAAG,MAAM,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,UAAU,CAAC,eAAe,CAAC,CAAC;QACtG,IAAI,MAAM,EAAE,SAAS,KAAK,iBAAiB;YAAE,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;WAChE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAClI,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,kCAAkC,CAAC,GAAsB,EAAE,KAA0B,EAAE,OAAyB;IAC9H,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC;QAChC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;QAChC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM;YAAE,OAAO;QAC9B,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO;QACjC,IAAI,KAAK,IAAI,wBAAwB,CAAC,IAAI,EAAE,MAAM,CAAC;YAAE,OAAO;QAE5D,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5B,IAAI,CAAC,KAAK;YAAE,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,mCAAmC,EAAE,EAAE,GAAG,CAAC,CAAC;QACrF,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,UAAU,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,KAAK;YAClB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,MAAM,CAAC,gBAAgB,CAAC,eAAe;mBACnF,SAAS,CAAC,QAAQ,KAAK,MAAM,CAAC,gBAAgB,CAAC,aAAa,CAAC;YAClE,CAAC,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC9B,IAAI,CAAC,MAAM;YAAE,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,EAAE,GAAG,CAAC,CAAC;QAE/E,IAAI,KAAK,IAAI,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,yBAAyB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBAC9D,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC;oBACpE,OAAO,MAAM,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC;wBAC/D,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,gDAAgD,EAAE,EAAE,GAAG,CAAC,CAAC;gBACjG,CAAC;YACH,CAAC;YAAC,MAAM,CAAC,CAAC,sEAAsE,CAAC,CAAC;QACpF,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM;YAAE,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,uCAAuC,EAAE,EAAE,GAAG,CAAC,CAAC;QACjH,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,wBAAwB,CAAC;gBACtC,IAAI,EAAE,IAAI,CAAC,UAAU;gBACrB,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;gBACvC,iBAAiB,EAAE,QAAQ;aAC5B,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,GAAG,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YACvG,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,EAAE,GAAG,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,KAAK,MAAM,CAAC,gBAAgB,CAAC,eAAe;eAC7D,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,gBAAgB,CAAC,aAAa,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC7F,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,IAAI;gBAAE,OAAO;YACjB,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YACrE,OAAO,MAAM,IAAI,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;gBACxF,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,yCAAyC,EAAE,EAAE,GAAG,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,IAAI;YAAE,OAAO;QACjB,IAAI,IAAI,KAAK,GAAG,MAAM,UAAU;YAAE,OAAO;QACzC,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1F,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,EAAE,GAAG,CAAC,CAAC;QACxE,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/lib/plugins/service-betterportal-config-manager/bootstrapAccess.d.ts

@@ -0,0 +1,8 @@
+import type { CpBootstrapState } from "./cpBootstrap.js";
+/** A short-lived capability for the two admin calls needed before first login. */
+export declare function issueBootstrapAdminToken(state: CpBootstrapState, tenantId: string, appId: string): Promise<string>;
+export declare function verifyBootstrapAdminToken(state: CpBootstrapState, token: string): Promise<{
+    tenantId: string;
+    appId: string;
+}>;
+//# sourceMappingURL=bootstrapAccess.d.ts.map

package/lib/plugins/service-betterportal-config-manager/bootstrapAccess.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrapAccess.d.ts","sourceRoot":"","sources":["../../../src/plugins/service-betterportal-config-manager/bootstrapAccess.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAKzD,kFAAkF;AAClF,wBAAsB,wBAAwB,CAAC,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQxH;AAED,wBAAsB,yBAAyB,CAAC,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAYpI"}

package/lib/plugins/service-betterportal-config-manager/bootstrapAccess.js

@@ -0,0 +1,28 @@
+import { createPrivateKey, createPublicKey } from "node:crypto";
+import { SignJWT, jwtVerify } from "jose";
+const AUDIENCE = "betterportal-bootstrap-admin";
+const TYPE = "bp-bootstrap-admin+jwt";
+/** A short-lived capability for the two admin calls needed before first login. */
+export async function issueBootstrapAdminToken(state, tenantId, appId) {
+    return new SignJWT({ purpose: "bootstrap-admin", tenantId, appId })
+        .setProtectedHeader({ alg: "RS256", typ: TYPE, kid: state.keyPair.kid })
+        .setIssuer(state.issuer)
+        .setAudience(AUDIENCE)
+        .setIssuedAt()
+        .setExpirationTime("15m")
+        .sign(createPrivateKey(state.keyPair.privateKeyPem));
+}
+export async function verifyBootstrapAdminToken(state, token) {
+    const { payload, protectedHeader } = await jwtVerify(token, createPublicKey(state.keyPair.publicKeyPem), {
+        issuer: state.issuer,
+        audience: AUDIENCE,
+        algorithms: ["RS256"],
+        typ: TYPE
+    });
+    if (protectedHeader.kid !== state.keyPair.kid || payload.purpose !== "bootstrap-admin"
+        || typeof payload.tenantId !== "string" || typeof payload.appId !== "string") {
+        throw new Error("Invalid bootstrap authorization scope");
+    }
+    return { tenantId: payload.tenantId, appId: payload.appId };
+}
+//# sourceMappingURL=bootstrapAccess.js.map

package/lib/plugins/service-betterportal-config-manager/bootstrapAccess.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrapAccess.js","sourceRoot":"","sources":["../../../src/plugins/service-betterportal-config-manager/bootstrapAccess.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAG1C,MAAM,QAAQ,GAAG,8BAA8B,CAAC;AAChD,MAAM,IAAI,GAAG,wBAAwB,CAAC;AAEtC,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAAuB,EAAE,QAAgB,EAAE,KAAa;IACrG,OAAO,IAAI,OAAO,CAAC,EAAE,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;SAChE,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;SACvE,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC;SACvB,WAAW,CAAC,QAAQ,CAAC;SACrB,WAAW,EAAE;SACb,iBAAiB,CAAC,KAAK,CAAC;SACxB,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAAuB,EAAE,KAAa;IACpF,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE;QACvG,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,QAAQ;QAClB,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,GAAG,EAAE,IAAI;KACV,CAAC,CAAC;IACH,IAAI,eAAe,CAAC,GAAG,KAAK,KAAK,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,OAAO,KAAK,iBAAiB;WACjF,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/E,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;AAC9D,CAAC"}

package/lib/plugins/service-betterportal-config-manager/bootstrapEndpoint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrapEndpoint.d.ts","sourceRoot":"","sources":["../../../src/plugins/service-betterportal-config-manager/bootstrapEndpoint.ts"],"names":[],"mappings":"AACA,OAAO,EAAgB,KAAK,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AACjG,OAAO,EAAmC,KAAK,sBAAsB,EAAE,KAAK,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AACjI,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAGzD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D;;;;GAIG;AACH;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,YAAY,EAAE,MAAM,EAAE,qBAAqB,EAAE,MAAM,GAAG,sBAAsB,EAAE,CAwBrH;AAsCD;;;;;;;;;GASG;AACH,wBAAsB,yBAAyB,CAAC,KAAK,EAAE;IACrD,GAAG,EAAE,iBAAiB,CAAC;IACvB,OAAO,EAAE,mBAAmB,CAAC;IAC7B,OAAO,EAAE,gBAAgB,CAAC;IAC1B,MAAM,EAAE,UAAU,CAAC;IACnB,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC,IAAI,CAAC,CAwRhB"}
+{"version":3,"file":"bootstrapEndpoint.d.ts","sourceRoot":"","sources":["../../../src/plugins/service-betterportal-config-manager/bootstrapEndpoint.ts"],"names":[],"mappings":"AACA,OAAO,EAAgB,KAAK,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AACjG,OAAO,EAAmC,KAAK,sBAAsB,EAAE,KAAK,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AACjI,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAIzD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D;;;;GAIG;AACH;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,YAAY,EAAE,MAAM,EAAE,qBAAqB,EAAE,MAAM,GAAG,sBAAsB,EAAE,CAwBrH;AAsCD;;;;;;;;;GASG;AACH,wBAAsB,yBAAyB,CAAC,KAAK,EAAE;IACrD,GAAG,EAAE,iBAAiB,CAAC;IACvB,OAAO,EAAE,mBAAmB,CAAC;IAC7B,OAAO,EAAE,gBAAgB,CAAC;IAC1B,MAAM,EAAE,UAAU,CAAC;IACnB,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkShB"}

package/lib/plugins/service-betterportal-config-manager/bootstrapEndpoint.js

@@ -2,6 +2,7 @@ import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
 import { jsonResponse } from "@betterportal/framework/lib/runtime/h3.js";
 import { uuidv7 } from "@betterportal/framework";
 import { renderBootstrapWizardHtml } from "./bootstrapWizardHtml.js";
+import { issueBootstrapAdminToken } from "./bootstrapAccess.js";
 import { apiRoutePath } from "./routeMounts.js";
 /**
  * Default admin app route mounts - points each menu entry at a config-manager view.
@@ -129,6 +130,16 @@ export async function registerBootstrapEndpoint(input) {
         }
         const freshConfig = await input.storage.loadConfig();
         const owner = uuidv7();
+        const committedResponse = async (result) => {
+            const tenantId = result.adminTenantId;
+            const appId = result.adminAppId;
+            if (typeof tenantId !== "string" || typeof appId !== "string" || !tenantId || !appId) {
+                return jsonResponse({ error: "Bootstrap result is incomplete" }, 409);
+            }
+            const response = jsonResponse({ ...result, bootstrapAdminToken: await issueBootstrapAdminToken(input.cpState, tenantId, appId) }, 200);
+            response.headers.set("Cache-Control", "no-store");
+            return response;
+        };
         const completeBootstrap = async (result, snapshot) => {
             try {
                 await input.postgres.completePendingAction({ kind: "bootstrap", key: "bootstrap", owner, result }, snapshot);
@@ -146,7 +157,7 @@ export async function registerBootstrapEndpoint(input) {
                 owner
             });
             if (claim.state === "completed")
-                return jsonResponse((claim.action.result ?? { ok: true }), 200);
+                return committedResponse((claim.action.result ?? { ok: true }));
             if (claim.state === "busy")
                 return jsonResponse({ error: "Bootstrap is already being committed" }, 409);
             if (claim.state !== "claimed")
@@ -154,7 +165,7 @@ export async function registerBootstrapEndpoint(input) {
             if (freshConfig.tenants.length > 0) {
                 const result = existingBootstrapResult(freshConfig, input.cpState.issuer);
                 await completeBootstrap(result);
-                return jsonResponse(result, 200);
+                return committedResponse(result);
             }
         }
         else {
@@ -326,7 +337,7 @@ export async function registerBootstrapEndpoint(input) {
         input.logger.log.info("Bootstrap committed: tenant={tid} app={aid}; admin URL={adminUrl}", {
             tid: adminTenantId, aid: adminAppId, adminUrl: body.adminApp.hostname
         });
-        return jsonResponse(result, 200);
+        return committedResponse(result);
     });
 }
 function hashBootstrapKey(value) {

package/lib/plugins/service-betterportal-config-manager/bootstrapEndpoint.js.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrapEndpoint.js","sourceRoot":"","sources":["../../../src/plugins/service-betterportal-config-manager/bootstrapEndpoint.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,YAAY,EAA0B,MAAM,2CAA2C,CAAC;AACjG,OAAO,EAAE,MAAM,EAAkF,MAAM,yBAAyB,CAAC;AAGjI,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAGhD;;;;GAIG;AACH;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,YAAoB,EAAE,qBAA6B;IACzF,OAAO;QACL,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,qBAAqB,CAAC,EAAE;QACjL,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,oBAAoB,CAAC,EAAE;QAChM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,CAAC,iCAAiC,EAAE,UAAU,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,sBAAsB,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE;QAC9P,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,CAAC,iCAAiC,EAAE,UAAU,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,sBAAsB,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE;QAC9P,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,CAAC,iCAAiC,EAAE,UAAU,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,sBAAsB,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE;QAC9P,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,mBAAmB,CAAC,EAAE;QAChL,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,iBAAiB,CAAC,EAAE;QACzK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,sBAAsB,CAAC,EAAE;QAC/L,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,oBAAoB,CAAC,EAAE;QACpL,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,iBAAiB,CAAC,EAAE;QAClL,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,mBAAmB,CAAC,EAAE;QACrL,6FAA6F;QAC7F,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,iBAAiB,CAAC,EAAE;QACzK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,CAAC,+BAA+B,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,YAAY,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE;QACxO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,kBAAkB,CAAC,EAAE;QAC7K,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,CAAC,+BAA+B,EAAE,SAAS,CAAC,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,aAAa,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE;QAC7O,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,CAAC,+BAA+B,EAAE,UAAU,CAAC,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,cAAc,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE;QACxP,4EAA4E;QAC5E,+DAA+D;QAC/D,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,oBAAoB,CAAC,EAAE;QAC7L,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,CAAC,+BAA+B,EAAE,WAAW,CAAC,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE;KAChQ,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,MAA4C;IAQzE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACxB,EAAE,EAAE,MAAM,EAAE;QACZ,IAAI,EAAE,MAAe;QACrB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,OAAO,EAAE,CAAC,CAAC,EAAE;QACb,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,EAAa;KACxB,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,oBAAoB,CAAC,UAAkB;IAC9C,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,UAAU,CAAC;IACpB,CAAC;AACH,CAAC;AAED,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAS5C;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAO/C;IACC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;IAChD,MAAM,mBAAmB,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAEtD,IAAI,KAAK,GAA6B,IAAI,CAAC;IAC3C,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,aAAa,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,GAAG,oBAAoB,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QACjG,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,mBAAmB,CAAC;YACxE,IAAI,EAAE,WAAW;YACjB,GAAG,EAAE,WAAW;YAChB,UAAU,EAAE,gBAAgB,CAAC,GAAG,CAAC;YACjC,OAAO,EAAE,EAAE;YACX,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;SACvD,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACV,IAAI,OAAO;YAAE,KAAK,GAAG,SAAS,CAAC;QAC/B,mFAAmF;QACnF,IAAI,OAAO;YAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAChC,uFAAuF,EACvF;gBACE,GAAG;gBACH,UAAU,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;gBACvD,GAAG,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,2BAA2B;aACxD,CACF,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,2BAA2B,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QACrD,IAAI,WAAW,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAClE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,wBAAwB,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;YAC/F,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACrD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,IAAI,QAAQ,CAAC,yBAAyB,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE;YACjF,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,eAAe,EAAE,UAAU,EAAE;SACrF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,cAAc;IACd,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,kCAAkC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QACjE,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAM5C,CAAC;QACT,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAC;QACpE,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ;YAAE,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,GAAG,CAAC,CAAC;QAEvG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC;YAClF,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,iEAAiE,EAAE,EAAE,GAAG,CAAC,CAAC;QACzG,CAAC;QACD,MAAM,gBAAgB,GAAG,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACzE,MAAM,iBAAiB,GAAG,IAAI,CAAC,YAAY,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC3E,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,EAAE,GAAG,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,mCAAmC,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC;QACvB,MAAM,iBAAiB,GAAG,KAAK,EAAE,MAA+B,EAAE,QAA6B,EAAiB,EAAE;YAChH,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,QAAS,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,QAAQ,CAAC,CAAC;YAChH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,KAAK,CAAC,QAAS,CAAC,oBAAoB,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;gBAC5E,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC,CAAC;QACF,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,kBAAkB,CAAC;gBACpD,IAAI,EAAE,WAAW;gBACjB,GAAG,EAAE,WAAW;gBAChB,UAAU,EAAE,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC;gBAC/C,KAAK;aACN,CAAC,CAAC;YACH,IAAI,KAAK,CAAC,KAAK,KAAK,WAAW;gBAAE,OAAO,YAAY,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAqB,EAAE,GAAG,CAAC,CAAC;YACrH,IAAI,KAAK,CAAC,KAAK,KAAK,MAAM;gBAAE,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,sCAAsC,EAAE,EAAE,GAAG,CAAC,CAAC;YACxG,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;gBAAE,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,EAAE,GAAG,CAAC,CAAC;YACvG,IAAI,WAAW,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnC,MAAM,MAAM,GAAG,uBAAuB,CAAC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBAC1E,MAAM,iBAAiB,CAAC,MAAM,CAAC,CAAC;gBAChC,OAAO,YAAY,CAAC,MAA0B,EAAE,GAAG,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,WAAW,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC/F,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC7C,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAChD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAChF,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,GAAG,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;QAED,gDAAgD;QAChD,MAAM,aAAa,GAAG,MAAM,EAAE,CAAC;QAC/B,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC;QAC5B,MAAM,eAAe,GAAG,aAAa,CAAC;QACtC,MAAM,YAAY,GAAG,UAAU,CAAC;QAEhC,sFAAsF;QACtF,4EAA4E;QAC5E,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC;QAC9B,MAAM,gBAAgB,GAAG,MAAM,EAAE,CAAC;QAClC,MAAM,iBAAiB,GAAG,MAAM,EAAE,CAAC;QACnC,MAAM,mBAAmB,GAAG,+BAA+B,CAAC;QAC5D,MAAM,oBAAoB,GAAG,mCAAmC,CAAC;QAEjE,MAAM,aAAa,GAAG,uBAAuB,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;QAC9E,2EAA2E;QAC3E,mDAAmD;QACnD,MAAM,UAAU,GAAG,aAAa;aAC7B,MAAM,CAAC,CAAC,CAAC,EAAmD,EAAE,CAC7D,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;eACxB,CAAC,CAAC,IAAI,KAAK,MAAM;eACjB,CAAC,CAAC,aAAa,EAAE,cAAc,EAAE,eAAe,EAAE,gBAAgB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAC1F,CAAC;QACJ,MAAM,WAAW,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;QACtD,MAAM,gBAAgB,GAAG;YACvB,GAAG,EAAE;gBACH;oBACE,SAAS,EAAE,gBAAgB;oBAC3B,UAAU,EAAE,SAAS;oBACrB,UAAU,EAAE,QAAQ;oBACpB,OAAO,EAAE,IAAI;iBACd;aACF;SACF,CAAC;QAEF,6EAA6E;QAC7E,yEAAyE;QACzE,MAAM,qBAAqB,GAAG;YAC5B,EAAE,EAAE,YAAY;YAChB,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;YAC9B,UAAU,EAAE,EAAE;YACd,SAAS,EAAE,iCAAiC;YAC5C,YAAY,EAAE,CAAC,QAAQ,CAAC;YACxB,KAAK,EAAE,gBAAgB;YACvB,WAAW,EAAE,SAAS;YACtB,cAAc,EAAE,aAAsB;YACtC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,UAAU,EAAE,SAAS;YACrB,OAAO,EAAE,IAAI;SACd,CAAC;QAEF,uFAAuF;QACvF,8CAA8C;QAC9C,MAAM,iBAAiB,GAAG;YACxB,EAAE,EAAE,mBAAmB;YACvB,SAAS,EAAE,mBAAmB;YAC9B,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,IAAI,MAAM;YACxC,OAAO,EAAE,gBAAgB;YACzB,UAAU,EAAE,EAAE;YACd,WAAW,EAAE,SAAS;YACtB,wBAAwB,EAAE,CAAC,aAAsB,CAAC;YAClD,KAAK,EAAE,IAAa;YACpB,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,CAAC,MAAM,CAAC;YACd,OAAO,EAAE,IAAI;SACd,CAAC;QAEF,+EAA+E;QAC/E,kDAAkD;QAClD,MAAM,kBAAkB,GAAG;YACzB,EAAE,EAAE,oBAAoB;YACxB,SAAS,EAAE,oBAAoB;YAC/B,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,KAAK,IAAI,OAAO;YAC1C,OAAO,EAAE,iBAAiB;YAC1B,UAAU,EAAE,EAAE;YACd,WAAW,EAAE,SAAS;YACtB,wBAAwB,EAAE,CAAC,aAAsB,CAAC;YAClD,KAAK,EAAE,IAAa;YACpB,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,CAAC,OAAO,CAAC;YACf,OAAO,EAAE,IAAI;SACd,CAAC;QAEF,MAAM,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC7C,WAAW,CAAC,oBAAoB,CAAC,IAAI,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,CAAC;QAC7E,WAAW,CAAC,wBAAwB,CAAC,IAAI,CACvC;YACE,EAAE,EAAE,gBAAgB;YACpB,QAAQ,EAAE,aAAa;YACvB,KAAK,EAAE,SAAS;YAChB,eAAe,EAAE,mBAAmB;YACpC,WAAW;YACX,OAAO,EAAE,IAAI;SACd,EACD;YACE,EAAE,EAAE,iBAAiB;YACrB,QAAQ,EAAE,aAAa;YACvB,KAAK,EAAE,SAAS;YAChB,eAAe,EAAE,oBAAoB;YACrC,WAAW;YACX,OAAO,EAAE,IAAI;SACd,CACF,CAAC;QAEF,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;YACvB,EAAE,EAAE,aAAa;YACjB,IAAI,EAAE,eAAe;YACrB,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK;YAC7B,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,EAAE;YACZ,QAAQ,EAAE,CAAC,qBAAqB,CAAC;YACjC,yBAAyB,EAAE,EAAE;SAC9B,CAAC,CAAC;QACH,8EAA8E;QAC9E,iHAAiH;QACjH,8FAA8F;QAC9F,MAAM,OAAO,GAAG;YACd,SAAS,EAAE,gBAAgB;YAC3B,WAAW,EAAE,aAAa;YAC1B,YAAY,EAAE,cAAc;YAC5B,aAAa,EAAE,eAAe;YAC9B,cAAc,EAAE,oBAAoB,CAAC,gBAAgB,CAAC;YACtD,gBAAgB,EAAE,sBAAsB;YACxC,OAAO,EAAE,GAAG,gBAAgB,wBAAwB;YACpD,KAAK,EAAE,EAAE;SACV,CAAC;QAEF,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YACpB,EAAE,EAAE,UAAU;YACd,QAAQ,EAAE,aAAa;YACvB,IAAI,EAAE,YAAY;YAClB,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK;YAC1B,SAAS,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACnC,eAAe,EAAE,EAAE;YACnB,gBAAgB,EAAE,EAAE;YACpB,KAAK,EAAE,EAAE,SAAS,EAAE,iBAAiB,EAAE;YACvC,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;YACnE,YAAY,EAAE,GAAG;YACjB,MAAM,EAAE,aAAa;YACrB,IAAI,EAAE,WAAW;YACjB,KAAK,EAAE,EAAE;YACT,SAAS,EAAE,gBAAgB;YAC3B,IAAI,EAAE,OAAO;SACgC,CAAC,CAAC;QAEjD,WAAW,CAAC,gBAAgB,GAAG;YAC7B,GAAG,CAAC,WAAW,CAAC,gBAAgB,IAAI,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,mBAAmB,EAAE,EAAE,EAAE,EAAE,CAAC;YAC7F,aAAa;YACb,eAAe,EAAE,UAAU;SAC5B,CAAC;QACF,MAAM,MAAM,GAAG;YACb,EAAE,EAAE,IAAI;YACR,aAAa;YACb,UAAU;YACV,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ;YACnC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;YAC9B,aAAa,EAAE,aAAa,CAAC,MAAM;YACnC,YAAY;YACZ,gBAAgB;YAChB,iBAAiB;YACjB,mBAAmB;YACnB,oBAAoB;SACrB,CAAC;QACF,IAAI,KAAK,CAAC,QAAQ;YAAE,MAAM,iBAAiB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;aAC5D,CAAC;YACJ,MAAM,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YAC5C,IAAI,KAAK;gBAAE,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;QACnC,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,mEAAmE,EAAE;YACzF,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ;SACtE,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,MAA0B,EAAE,GAAG,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;AAEL,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,uBAAuB,CAAC,MAA8D,EAAE,QAAgB;IAC/G,MAAM,aAAa,GAAG,MAAM,CAAC,gBAAgB,EAAE,aAAa,IAAI,EAAE,CAAC;IACnE,MAAM,UAAU,GAAG,MAAM,CAAC,gBAAgB,EAAE,eAAe,IAAI,EAAE,CAAC;IAClE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,aAAa,CAAC,CAAC;IAClF,MAAM,UAAU,GAAG,CAAC,eAAuB,EAAE,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACjG,SAAS,CAAC,QAAQ,KAAK,aAAa,IAAI,SAAS,CAAC,eAAe,KAAK,eAAe,CACtF,EAAE,EAAE,IAAI,EAAE,CAAC;IACZ,OAAO;QACL,EAAE,EAAE,IAAI;QACR,aAAa;QACb,UAAU;QACV,WAAW,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE;QACpC,QAAQ;QACR,aAAa,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,IAAI,CAAC;QACtC,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,KAAK,iCAAiC,CAAC,EAAE,EAAE,IAAI,EAAE;QACnH,gBAAgB,EAAE,UAAU,CAAC,+BAA+B,CAAC;QAC7D,iBAAiB,EAAE,UAAU,CAAC,mCAAmC,CAAC;QAClE,mBAAmB,EAAE,+BAA+B;QACpD,oBAAoB,EAAE,mCAAmC;KAC1D,CAAC;AACJ,CAAC"}
+{"version":3,"file":"bootstrapEndpoint.js","sourceRoot":"","sources":["../../../src/plugins/service-betterportal-config-manager/bootstrapEndpoint.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,YAAY,EAA0B,MAAM,2CAA2C,CAAC;AACjG,OAAO,EAAE,MAAM,EAAkF,MAAM,yBAAyB,CAAC;AAGjI,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAGhD;;;;GAIG;AACH;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,YAAoB,EAAE,qBAA6B;IACzF,OAAO;QACL,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,qBAAqB,CAAC,EAAE;QACjL,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,oBAAoB,CAAC,EAAE;QAChM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,CAAC,iCAAiC,EAAE,UAAU,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,sBAAsB,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE;QAC9P,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,CAAC,iCAAiC,EAAE,UAAU,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,sBAAsB,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE;QAC9P,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,CAAC,iCAAiC,EAAE,UAAU,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,sBAAsB,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE;QAC9P,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,mBAAmB,CAAC,EAAE;QAChL,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,iBAAiB,CAAC,EAAE;QACzK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,sBAAsB,CAAC,EAAE;QAC/L,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,oBAAoB,CAAC,EAAE;QACpL,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,iBAAiB,CAAC,EAAE;QAClL,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,mBAAmB,CAAC,EAAE;QACrL,6FAA6F;QAC7F,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,iBAAiB,CAAC,EAAE;QACzK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,CAAC,+BAA+B,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,YAAY,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE;QACxO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,kBAAkB,CAAC,EAAE;QAC7K,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,CAAC,+BAA+B,EAAE,SAAS,CAAC,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,aAAa,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE;QAC7O,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,CAAC,+BAA+B,EAAE,UAAU,CAAC,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,cAAc,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE;QACxP,4EAA4E;QAC5E,+DAA+D;QAC/D,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,oBAAoB,CAAC,EAAE;QAC7L,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,CAAC,+BAA+B,EAAE,WAAW,CAAC,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE;KAChQ,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,MAA4C;IAQzE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACxB,EAAE,EAAE,MAAM,EAAE;QACZ,IAAI,EAAE,MAAe;QACrB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,OAAO,EAAE,CAAC,CAAC,EAAE;QACb,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,EAAa;KACxB,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,oBAAoB,CAAC,UAAkB;IAC9C,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,UAAU,CAAC;IACpB,CAAC;AACH,CAAC;AAED,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAS5C;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAO/C;IACC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;IAChD,MAAM,mBAAmB,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAEtD,IAAI,KAAK,GAA6B,IAAI,CAAC;IAC3C,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,aAAa,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,GAAG,oBAAoB,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QACjG,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,mBAAmB,CAAC;YACxE,IAAI,EAAE,WAAW;YACjB,GAAG,EAAE,WAAW;YAChB,UAAU,EAAE,gBAAgB,CAAC,GAAG,CAAC;YACjC,OAAO,EAAE,EAAE;YACX,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;SACvD,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACV,IAAI,OAAO;YAAE,KAAK,GAAG,SAAS,CAAC;QAC/B,mFAAmF;QACnF,IAAI,OAAO;YAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAChC,uFAAuF,EACvF;gBACE,GAAG;gBACH,UAAU,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;gBACvD,GAAG,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,2BAA2B;aACxD,CACF,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,2BAA2B,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QACrD,IAAI,WAAW,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAClE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,wBAAwB,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;YAC/F,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACrD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,IAAI,QAAQ,CAAC,yBAAyB,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE;YACjF,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,eAAe,EAAE,UAAU,EAAE;SACrF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,cAAc;IACd,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,kCAAkC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QACjE,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAM5C,CAAC;QACT,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAC;QACpE,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ;YAAE,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,GAAG,CAAC,CAAC;QAEvG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC;YAClF,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,iEAAiE,EAAE,EAAE,GAAG,CAAC,CAAC;QACzG,CAAC;QACD,MAAM,gBAAgB,GAAG,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACzE,MAAM,iBAAiB,GAAG,IAAI,CAAC,YAAY,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC3E,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,EAAE,GAAG,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,mCAAmC,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC;QACvB,MAAM,iBAAiB,GAAG,KAAK,EAAE,MAA+B,EAAqB,EAAE;YACrF,MAAM,QAAQ,GAAG,MAAM,CAAC,aAAa,CAAC;YACtC,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC;YAChC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;gBACrF,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,EAAE,GAAG,CAAC,CAAC;YACxE,CAAC;YACD,MAAM,QAAQ,GAAG,YAAY,CAAC,EAAE,GAAG,MAAM,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAW,EAAE,GAAG,CAAC,CAAC;YAChJ,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;YAClD,OAAO,QAAQ,CAAC;QAClB,CAAC,CAAC;QACF,MAAM,iBAAiB,GAAG,KAAK,EAAE,MAA+B,EAAE,QAA6B,EAAiB,EAAE;YAChH,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,QAAS,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,QAAQ,CAAC,CAAC;YAChH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,KAAK,CAAC,QAAS,CAAC,oBAAoB,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;gBAC5E,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC,CAAC;QACF,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,kBAAkB,CAAC;gBACpD,IAAI,EAAE,WAAW;gBACjB,GAAG,EAAE,WAAW;gBAChB,UAAU,EAAE,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC;gBAC/C,KAAK;aACN,CAAC,CAAC;YACH,IAAI,KAAK,CAAC,KAAK,KAAK,WAAW;gBAAE,OAAO,iBAAiB,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAA4B,CAAC,CAAC;YAC5H,IAAI,KAAK,CAAC,KAAK,KAAK,MAAM;gBAAE,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,sCAAsC,EAAE,EAAE,GAAG,CAAC,CAAC;YACxG,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;gBAAE,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,EAAE,GAAG,CAAC,CAAC;YACvG,IAAI,WAAW,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnC,MAAM,MAAM,GAAG,uBAAuB,CAAC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBAC1E,MAAM,iBAAiB,CAAC,MAAM,CAAC,CAAC;gBAChC,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,WAAW,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC/F,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC7C,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAChD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAChF,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,GAAG,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;QAED,gDAAgD;QAChD,MAAM,aAAa,GAAG,MAAM,EAAE,CAAC;QAC/B,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC;QAC5B,MAAM,eAAe,GAAG,aAAa,CAAC;QACtC,MAAM,YAAY,GAAG,UAAU,CAAC;QAEhC,sFAAsF;QACtF,4EAA4E;QAC5E,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC;QAC9B,MAAM,gBAAgB,GAAG,MAAM,EAAE,CAAC;QAClC,MAAM,iBAAiB,GAAG,MAAM,EAAE,CAAC;QACnC,MAAM,mBAAmB,GAAG,+BAA+B,CAAC;QAC5D,MAAM,oBAAoB,GAAG,mCAAmC,CAAC;QAEjE,MAAM,aAAa,GAAG,uBAAuB,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;QAC9E,2EAA2E;QAC3E,mDAAmD;QACnD,MAAM,UAAU,GAAG,aAAa;aAC7B,MAAM,CAAC,CAAC,CAAC,EAAmD,EAAE,CAC7D,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;eACxB,CAAC,CAAC,IAAI,KAAK,MAAM;eACjB,CAAC,CAAC,aAAa,EAAE,cAAc,EAAE,eAAe,EAAE,gBAAgB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAC1F,CAAC;QACJ,MAAM,WAAW,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;QACtD,MAAM,gBAAgB,GAAG;YACvB,GAAG,EAAE;gBACH;oBACE,SAAS,EAAE,gBAAgB;oBAC3B,UAAU,EAAE,SAAS;oBACrB,UAAU,EAAE,QAAQ;oBACpB,OAAO,EAAE,IAAI;iBACd;aACF;SACF,CAAC;QAEF,6EAA6E;QAC7E,yEAAyE;QACzE,MAAM,qBAAqB,GAAG;YAC5B,EAAE,EAAE,YAAY;YAChB,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;YAC9B,UAAU,EAAE,EAAE;YACd,SAAS,EAAE,iCAAiC;YAC5C,YAAY,EAAE,CAAC,QAAQ,CAAC;YACxB,KAAK,EAAE,gBAAgB;YACvB,WAAW,EAAE,SAAS;YACtB,cAAc,EAAE,aAAsB;YACtC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,UAAU,EAAE,SAAS;YACrB,OAAO,EAAE,IAAI;SACd,CAAC;QAEF,uFAAuF;QACvF,8CAA8C;QAC9C,MAAM,iBAAiB,GAAG;YACxB,EAAE,EAAE,mBAAmB;YACvB,SAAS,EAAE,mBAAmB;YAC9B,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,IAAI,MAAM;YACxC,OAAO,EAAE,gBAAgB;YACzB,UAAU,EAAE,EAAE;YACd,WAAW,EAAE,SAAS;YACtB,wBAAwB,EAAE,CAAC,aAAsB,CAAC;YAClD,KAAK,EAAE,IAAa;YACpB,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,CAAC,MAAM,CAAC;YACd,OAAO,EAAE,IAAI;SACd,CAAC;QAEF,+EAA+E;QAC/E,kDAAkD;QAClD,MAAM,kBAAkB,GAAG;YACzB,EAAE,EAAE,oBAAoB;YACxB,SAAS,EAAE,oBAAoB;YAC/B,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,KAAK,IAAI,OAAO;YAC1C,OAAO,EAAE,iBAAiB;YAC1B,UAAU,EAAE,EAAE;YACd,WAAW,EAAE,SAAS;YACtB,wBAAwB,EAAE,CAAC,aAAsB,CAAC;YAClD,KAAK,EAAE,IAAa;YACpB,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,CAAC,OAAO,CAAC;YACf,OAAO,EAAE,IAAI;SACd,CAAC;QAEF,MAAM,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC7C,WAAW,CAAC,oBAAoB,CAAC,IAAI,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,CAAC;QAC7E,WAAW,CAAC,wBAAwB,CAAC,IAAI,CACvC;YACE,EAAE,EAAE,gBAAgB;YACpB,QAAQ,EAAE,aAAa;YACvB,KAAK,EAAE,SAAS;YAChB,eAAe,EAAE,mBAAmB;YACpC,WAAW;YACX,OAAO,EAAE,IAAI;SACd,EACD;YACE,EAAE,EAAE,iBAAiB;YACrB,QAAQ,EAAE,aAAa;YACvB,KAAK,EAAE,SAAS;YAChB,eAAe,EAAE,oBAAoB;YACrC,WAAW;YACX,OAAO,EAAE,IAAI;SACd,CACF,CAAC;QAEF,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;YACvB,EAAE,EAAE,aAAa;YACjB,IAAI,EAAE,eAAe;YACrB,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK;YAC7B,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,EAAE;YACZ,QAAQ,EAAE,CAAC,qBAAqB,CAAC;YACjC,yBAAyB,EAAE,EAAE;SAC9B,CAAC,CAAC;QACH,8EAA8E;QAC9E,iHAAiH;QACjH,8FAA8F;QAC9F,MAAM,OAAO,GAAG;YACd,SAAS,EAAE,gBAAgB;YAC3B,WAAW,EAAE,aAAa;YAC1B,YAAY,EAAE,cAAc;YAC5B,aAAa,EAAE,eAAe;YAC9B,cAAc,EAAE,oBAAoB,CAAC,gBAAgB,CAAC;YACtD,gBAAgB,EAAE,sBAAsB;YACxC,OAAO,EAAE,GAAG,gBAAgB,wBAAwB;YACpD,KAAK,EAAE,EAAE;SACV,CAAC;QAEF,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YACpB,EAAE,EAAE,UAAU;YACd,QAAQ,EAAE,aAAa;YACvB,IAAI,EAAE,YAAY;YAClB,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK;YAC1B,SAAS,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACnC,eAAe,EAAE,EAAE;YACnB,gBAAgB,EAAE,EAAE;YACpB,KAAK,EAAE,EAAE,SAAS,EAAE,iBAAiB,EAAE;YACvC,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;YACnE,YAAY,EAAE,GAAG;YACjB,MAAM,EAAE,aAAa;YACrB,IAAI,EAAE,WAAW;YACjB,KAAK,EAAE,EAAE;YACT,SAAS,EAAE,gBAAgB;YAC3B,IAAI,EAAE,OAAO;SACgC,CAAC,CAAC;QAEjD,WAAW,CAAC,gBAAgB,GAAG;YAC7B,GAAG,CAAC,WAAW,CAAC,gBAAgB,IAAI,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,mBAAmB,EAAE,EAAE,EAAE,EAAE,CAAC;YAC7F,aAAa;YACb,eAAe,EAAE,UAAU;SAC5B,CAAC;QACF,MAAM,MAAM,GAAG;YACb,EAAE,EAAE,IAAI;YACR,aAAa;YACb,UAAU;YACV,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ;YACnC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;YAC9B,aAAa,EAAE,aAAa,CAAC,MAAM;YACnC,YAAY;YACZ,gBAAgB;YAChB,iBAAiB;YACjB,mBAAmB;YACnB,oBAAoB;SACrB,CAAC;QACF,IAAI,KAAK,CAAC,QAAQ;YAAE,MAAM,iBAAiB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;aAC5D,CAAC;YACJ,MAAM,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YAC5C,IAAI,KAAK;gBAAE,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;QACnC,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,mEAAmE,EAAE;YACzF,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ;SACtE,CAAC,CAAC;QACH,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;AAEL,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,uBAAuB,CAAC,MAA8D,EAAE,QAAgB;IAC/G,MAAM,aAAa,GAAG,MAAM,CAAC,gBAAgB,EAAE,aAAa,IAAI,EAAE,CAAC;IACnE,MAAM,UAAU,GAAG,MAAM,CAAC,gBAAgB,EAAE,eAAe,IAAI,EAAE,CAAC;IAClE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,aAAa,CAAC,CAAC;IAClF,MAAM,UAAU,GAAG,CAAC,eAAuB,EAAE,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACjG,SAAS,CAAC,QAAQ,KAAK,aAAa,IAAI,SAAS,CAAC,eAAe,KAAK,eAAe,CACtF,EAAE,EAAE,IAAI,EAAE,CAAC;IACZ,OAAO;QACL,EAAE,EAAE,IAAI;QACR,aAAa;QACb,UAAU;QACV,WAAW,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE;QACpC,QAAQ;QACR,aAAa,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,IAAI,CAAC;QACtC,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,KAAK,iCAAiC,CAAC,EAAE,EAAE,IAAI,EAAE;QACnH,gBAAgB,EAAE,UAAU,CAAC,+BAA+B,CAAC;QAC7D,iBAAiB,EAAE,UAAU,CAAC,mCAAmC,CAAC;QAClE,mBAAmB,EAAE,+BAA+B;QACpD,oBAAoB,EAAE,mCAAmC;KAC1D,CAAC;AACJ,CAAC"}

package/lib/plugins/service-betterportal-config-manager/bootstrapWizardHtml.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrapWizardHtml.d.ts","sourceRoot":"","sources":["../../../src/plugins/service-betterportal-config-manager/bootstrapWizardHtml.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CA8T7E"}
+{"version":3,"file":"bootstrapWizardHtml.d.ts","sourceRoot":"","sources":["../../../src/plugins/service-betterportal-config-manager/bootstrapWizardHtml.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAgU7E"}

package/lib/plugins/service-betterportal-config-manager/bootstrapWizardHtml.js

@@ -142,8 +142,8 @@ function step(id, label) {
   };
 }
 
-async function postJson(url, body) {
-  const res = await fetch(url, { method: "POST", headers: { "content-type": "application/json", "accept": "application/json" }, body: JSON.stringify(body) });
+async function postJson(url, body, authorization) {
+  const res = await fetch(url, { method: "POST", headers: { "content-type": "application/json", "accept": "application/json", ...(authorization ? { authorization: "Bearer " + authorization } : {}) }, body: JSON.stringify(body) });
   if (!res.ok) {
     let text = "";
     try { text = await res.text(); } catch (_) {}
@@ -158,7 +158,7 @@ async function getJson(url) {
   return readJson(res, "GET " + url);
 }
 
-async function installService(label, serviceUrl, scope, options) {
+async function installService(label, serviceUrl, scope, options, authorization) {
   const s = step("install-" + label, "Install " + label + " service");
   try {
     const beginRes = await postJson(CP_ISSUER + "/.well-known/bp/admin/services/begin-install", {
@@ -166,7 +166,7 @@ async function installService(label, serviceUrl, scope, options) {
       ...(scope || {}),
       ...(options && options.instanceId ? { instanceId: options.instanceId } : {}),
       ...(options && options.sharedServiceId ? { sharedServiceId: options.sharedServiceId } : {})
-    });
+    }, authorization);
     const installRes = await postJson(serviceUrl.replace(/\\/+$/, "") + "/.well-known/bp/install", {
       setupToken: beginRes.setupToken,
       cpUrl: CP_ISSUER
@@ -218,7 +218,7 @@ async function buildAdminRole(adminAppId, payload, commit) {
       title: "Administrator",
       description: "Full access to all services and views. Auto-created during bootstrap.",
       permissions: grants
-    });
+    }, commit.bootstrapAdminToken);
     s.done();
     return res;
   } catch (e) {
@@ -293,14 +293,16 @@ document.getElementById("wizard").addEventListener("submit", async (evt) => {
       "auth",
       payload.authService.hostname,
       { tenantId: commit.adminTenantId, appId: commit.adminAppId },
-      { sharedServiceId: commit.authSharedServiceId }
+      { sharedServiceId: commit.authSharedServiceId },
+      commit.bootstrapAdminToken
     );
     if (payload.themeService && payload.themeService.hostname) {
       await installService(
         "theme",
         payload.themeService.hostname,
         { tenantId: commit.adminTenantId, appId: commit.adminAppId },
-        { sharedServiceId: commit.themeSharedServiceId }
+        { sharedServiceId: commit.themeSharedServiceId },
+        commit.bootstrapAdminToken
       );
     }
 

package/lib/plugins/service-betterportal-config-manager/bootstrapWizardHtml.js.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrapWizardHtml.js","sourceRoot":"","sources":["../../../src/plugins/service-betterportal-config-manager/bootstrapWizardHtml.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAA2B;IACnE,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACpD,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBAuGW,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAoNxB,CAAC;AACT,CAAC"}
+{"version":3,"file":"bootstrapWizardHtml.js","sourceRoot":"","sources":["../../../src/plugins/service-betterportal-config-manager/bootstrapWizardHtml.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAA2B;IACnE,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACpD,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBAuGW,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAsNxB,CAAC;AACT,CAAC"}

package/lib/plugins/service-betterportal-config-manager/bp-routes/preview-environments/_renderer.bootstrap5/GET.d.ts

@@ -1,6 +1,6 @@
-import type { HtmlRenderable } from "@betterportal/framework";
+import type { HtmlRenderable, ViewRenderContext } from "@betterportal/framework";
 import type { ResponseData } from "../../../previewEnvironmentManagement.js";
 export declare function configEditorScript(): HtmlRenderable;
 export declare function configEditor(group: ResponseData["groups"][number], path: string, ticketUrl: string): HtmlRenderable;
-export declare function render(data: ResponseData): HtmlRenderable;
+export declare function render(data: ResponseData, ctx: ViewRenderContext): HtmlRenderable;
 //# sourceMappingURL=GET.d.ts.map

package/lib/plugins/service-betterportal-config-manager/bp-routes/preview-environments/_renderer.bootstrap5/GET.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"GET.d.ts","sourceRoot":"","sources":["../../../../../../src/plugins/service-betterportal-config-manager/bp-routes/preview-environments/_renderer.bootstrap5/GET.tsx"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0CAA0C,CAAC;AAmC7E,wBAAgB,kBAAkB,IAAI,cAAc,CAmRnD;AAiED,wBAAgB,YAAY,CAAC,KAAK,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,cAAc,CAsFnH;AAED,wBAAgB,MAAM,CAAC,IAAI,EAAE,YAAY,GAAG,cAAc,CAuLzD"}
+{"version":3,"file":"GET.d.ts","sourceRoot":"","sources":["../../../../../../src/plugins/service-betterportal-config-manager/bp-routes/preview-environments/_renderer.bootstrap5/GET.tsx"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAc,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC7F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0CAA0C,CAAC;AAmC7E,wBAAgB,kBAAkB,IAAI,cAAc,CAmRnD;AAiED,wBAAgB,YAAY,CAAC,KAAK,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,cAAc,CAsFnH;AAED,wBAAgB,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,iBAAiB,GAAG,cAAc,CA4LjF"}

package/lib/plugins/service-betterportal-config-manager/bp-routes/preview-environments/_renderer.bootstrap5/GET.js

@@ -350,7 +350,13 @@ export function configEditor(group, path, ticketUrl) {
                                         return fields.length === 0 ? null : _jsxs("div", { class: "mb-3", children: [_jsxs("div", { class: "text-uppercase text-secondary small fw-semibold mb-2", children: [scope, " config"] }), _jsx("div", { class: "row g-3", children: fields.map((field) => _jsxs("div", { class: "col-12 col-lg-6", children: [_jsxs("label", { class: "form-label", children: [field.title, field.required ? " *" : ""] }), fieldControl(service, field), _jsxs("div", { class: "form-text", children: [field.description, field.secret ? " Unlock with a generated key or decrypt the stored values first." : ""] }), field.secret && !field.required ? _jsxs("div", { class: "form-check mt-1", children: [_jsx("input", { class: "form-check-input", type: "checkbox", disabled: true, "data-bp-clear-secret": "", "data-service-id": service.serviceId, "data-scope": field.scope, "data-key": field.key, id: `bp-clear-${group.id}-${service.serviceId}-${field.scope}-${field.key}` }), _jsx("label", { class: "form-check-label small", for: `bp-clear-${group.id}-${service.serviceId}-${field.scope}-${field.key}`, children: "Clear stored value" })] }) : null] })) })] });
                                     })] }))), _jsx("div", { class: "alert alert-secondary py-2", "data-bp-preview-config-status": "", role: "status", children: "Key is never submitted." }), _jsxs("div", { class: "d-flex flex-wrap gap-2", children: [_jsx("button", { class: "btn btn-primary", type: "submit", children: "Encrypt and save config" }), _jsx("button", { class: "btn btn-outline-secondary", type: "button", "data-bp-sync-prod": "", children: "Sync from prod" })] }), _jsxs("dialog", { class: "border-0 rounded shadow p-0", style: "width:min(92vw,72rem);max-height:90vh", "data-bp-sync-dialog": "", children: [_jsxs("div", { class: "p-3 border-bottom d-flex justify-content-between align-items-center", children: [_jsx("h3", { class: "h5 mb-0", children: "Production config diff" }), _jsx("button", { class: "btn-close", type: "button", "aria-label": "Close", "data-bp-sync-close": "" })] }), _jsx("div", { class: "p-3 overflow-auto", style: "max-height:70vh", "data-bp-sync-body": "" }), _jsxs("div", { class: "p-3 border-top d-flex justify-content-end gap-2", children: [_jsx("button", { class: "btn btn-outline-secondary", type: "button", "data-bp-sync-close": "", children: "Cancel" }), _jsx("button", { class: "btn btn-primary", type: "button", "data-bp-sync-apply": "", children: "Apply selected and save" })] })] })] }))] })] }));
 }
-export function render(data) {
-    return (_jsxs("div", { class: "container-fluid px-0", children: [_jsxs("div", { class: "d-flex flex-wrap justify-content-between align-items-start gap-3 mb-4", children: [_jsxs("div", { children: [_jsx("h2", { class: "mb-1", children: data.title }), _jsx("p", { class: "text-secondary mb-0", children: "Clone an existing tenant/app configuration while CI owns where each service runs." })] }), _jsx("button", { class: "btn btn-primary", "data-bs-toggle": "offcanvas", "data-bs-target": "#bp-create-preview-group", children: "Create group" })] }), data.notice ? _jsx("div", { class: "alert alert-success", role: "status", children: data.notice }) : null, data.error ? _jsx("div", { class: "alert alert-danger", role: "alert", children: data.error }) : null, credentials(data), _jsxs("div", { class: "alert alert-info d-flex gap-2 align-items-start", children: [_jsx("span", { "aria-hidden": "true", children: "i" }), _jsxs("div", { children: [_jsx("strong", { children: "Pull setup only." }), " Services receive credentials from CI, publish their manifest on first sync, and rebuild preview routes/menu automatically."] })] }), data.groups.length === 0 ? (_jsx("div", { class: "card border-0 shadow-sm", children: _jsx("div", { class: "card-body py-5 text-center text-secondary", children: "No preview groups configured." }) })) : data.groups.map((group) => (_jsx("section", { class: "card border-0 shadow-sm mb-4", "aria-labelledby": `bp-group-${group.id}`, children: _jsxs("div", { class: "card-body", children: [_jsxs("div", { class: "d-flex flex-wrap justify-content-between align-items-start gap-3 mb-3", children: [_jsxs("div", { children: [_jsx("h3", { class: "h5 mb-1", id: `bp-group-${group.id}`, children: group.name }), _jsx("div", { class: "small text-secondary", children: group.sourceLabel }), _jsx("code", { class: "small", children: group.id })] }), _jsxs("div", { class: "d-flex flex-wrap gap-2", children: [_jsx("button", { class: "btn btn-sm btn-outline-primary", "data-bs-toggle": "collapse", "data-bs-target": `#bp-new-${group.id}`, children: "New preview" }), _jsx("button", { class: "btn btn-sm btn-outline-secondary", "data-bs-toggle": "collapse", "data-bs-target": `#bp-settings-${group.id}`, "hx-get": `${data.previewPath}?_c=config&groupId=${encodeURIComponent(group.id)}`, "hx-trigger": `click[!document.getElementById('bp-config-${group.id}').querySelector('form')]`, "hx-target": `#bp-config-${group.id}`, "hx-swap": "innerHTML", children: "Settings" }), _jsx("button", { class: "btn btn-sm btn-outline-danger", "hx-delete": `${data.previewPath}?entity=group&id=${encodeURIComponent(group.id)}`, "hx-confirm": `Delete ${group.name} and all of its previews?`, "hx-target": "#bp-main", "hx-swap": "innerHTML", children: "Delete" })] })] }), _jsxs("div", { class: "row g-3 mb-3", children: [_jsxs("div", { class: "col-12 col-xl-7", children: [_jsx("div", { class: "small text-secondary mb-1", children: "CI endpoint" }), _jsxs("code", { class: "d-block text-break", children: ["POST ", data.deploymentApiBase, "/", group.id, "/deployments/<key>"] })] }), _jsxs("div", { class: "col-12 col-xl-5", children: [_jsx("div", { class: "small text-secondary mb-1", children: "BP plugins" }), _jsx("div", { class: "d-flex flex-wrap gap-1", children: group.services.length ? group.services.map((service) => _jsx("span", { class: "badge text-bg-secondary", children: service.serviceId })) : _jsx("span", { class: "small text-secondary", children: "Added by the first preview create request." }) })] })] }), _jsx("div", { class: "collapse mb-4", id: `bp-new-${group.id}`, children: _jsxs("div", { class: "border rounded p-3 bg-body-tertiary", children: [_jsx("h4", { class: "h6", children: "Create preview manually" }), _jsxs("form", { "hx-post": data.previewPath, "hx-target": "#bp-main", "hx-swap": "innerHTML", children: [_jsx("input", { type: "hidden", name: "action", value: "create-deployment" }), _jsx("input", { type: "hidden", name: "groupId", value: group.id }), _jsxs("div", { class: "row g-3", children: [_jsxs("div", { class: "col-12 col-md-4", children: [_jsx("label", { class: "form-label", children: "Key" }), _jsx("input", { class: "form-control font-monospace", name: "key", maxlength: "255", pattern: "[A-Za-z0-9][A-Za-z0-9._:-]*", required: true })] }), _jsxs("div", { class: "col-12 col-md-4", children: [_jsx("label", { class: "form-label", children: "Name" }), _jsx("input", { class: "form-control", name: "name" })] }), _jsxs("div", { class: "col-12 col-md-4", children: [_jsx("label", { class: "form-label", children: "Expiry" }), expiryInput(undefined, true)] }), _jsxs("div", { class: "col-12", children: [_jsx("label", { class: "form-label", children: "App hostname or origin" }), _jsx("input", { class: "form-control font-monospace", name: "hostname", placeholder: "pr-123.preview.example.com", required: true })] }), _jsxs("div", { class: "col-12", children: [_jsx("label", { class: "form-label", for: `bp-preview-services-${group.id}`, children: "Services" }), _jsx("textarea", { id: `bp-preview-services-${group.id}`, class: "form-control font-monospace", name: "services", rows: Math.max(4, group.services.length + 2), required: true, children: JSON.stringify(Object.fromEntries(group.services.map((service) => [service.serviceId, ""])), null, 2) }), _jsx("div", { class: "form-text", children: "JSON object mapping service IDs to public HTTPS URLs." })] })] }), _jsx("button", { class: "btn btn-primary mt-3", type: "submit", children: "Create preview" })] })] }) }), _jsx("div", { class: "collapse mb-4", id: `bp-settings-${group.id}`, children: _jsxs("div", { class: "border rounded p-3", children: [_jsxs("form", { "hx-put": data.previewPath, "hx-target": "#bp-main", "hx-swap": "innerHTML", children: [_jsx("input", { type: "hidden", name: "action", value: "update-group" }), _jsx("input", { type: "hidden", name: "groupId", value: group.id }), _jsxs("div", { class: "row g-3 mb-3", children: [_jsxs("div", { class: "col-12 col-md-8", children: [_jsx("label", { class: "form-label", children: "Group name" }), _jsx("input", { class: "form-control", name: "name", value: group.name, required: true })] }), _jsxs("div", { class: "col-12 col-md-4", children: [_jsx("label", { class: "form-label", children: "Maximum/default expiry" }), expiryInput(group.expiresInDays)] })] }), _jsxs("div", { class: "mb-3", children: [_jsx("label", { class: "form-label", for: `bp-elevated-roles-${group.id}`, children: "Preview admin role IDs" }), _jsx("textarea", { id: `bp-elevated-roles-${group.id}`, class: "form-control", name: "elevatedRoleIds", rows: "3", maxlength: "12900", "aria-describedby": `bp-elevated-roles-help-${group.id}`, children: (group.elevatedRoleIds ?? []).join("\n") }), _jsx("div", { class: "form-text", id: `bp-elevated-roles-help-${group.id}`, children: "Defaults for newly created previews; existing previews keep their own role settings. One exact role ID per line (or comma-separated), e.g. admin, staff, client. Users with any listed role get full access within this group's previews only. Empty keeps normal permissions. Changes apply to existing previews on config sync." })] }), oidcFields(`bp-group-${group.id}`, group.oidc), _jsx("button", { class: "btn btn-primary", type: "submit", children: "Save settings" })] }), _jsx("hr", {}), _jsxs("form", { "hx-post": data.previewPath, "hx-target": "#bp-main", "hx-swap": "innerHTML", children: [_jsx("input", { type: "hidden", name: "action", value: "rotate-key" }), _jsx("input", { type: "hidden", name: "groupId", value: group.id }), _jsx("button", { class: "btn btn-outline-warning", type: "submit", "hx-confirm": "Rotate this group API key? Existing CI credentials will stop working.", children: "Rotate API key" })] }), _jsx("div", { id: `bp-config-${group.id}`, children: _jsx("div", { class: "text-secondary small mt-3", role: "status", children: "Open settings to load service configuration." }) })] }) }), group.deployments.length === 0 ? _jsx("div", { class: "text-secondary small", children: "No active previews." }) : (_jsx("div", { class: "table-responsive", children: _jsxs("table", { class: "table table-sm align-middle mb-0", children: [_jsx("thead", { children: _jsxs("tr", { children: [_jsx("th", { children: "Preview" }), _jsx("th", { children: "App" }), _jsx("th", { children: "Services" }), _jsx("th", { children: "Expiry" }), _jsx("th", {})] }) }), _jsx("tbody", { children: group.deployments.map((deployment) => (_jsxs("tr", { children: [_jsxs("td", { children: [_jsx("div", { class: "fw-semibold", children: deployment.name }), _jsx("code", { class: "small", children: deployment.key }), _jsx("div", { children: _jsx("span", { class: `badge ${deployment.ready ? "text-bg-success" : "text-bg-warning"}`, children: deployment.ready ? "Configured" : "Needs attention" }) })] }), _jsx("td", { children: _jsx("a", { href: deployment.hostname.startsWith("http") ? deployment.hostname : `https://${deployment.hostname}`, target: "_blank", rel: "noreferrer", children: deployment.hostname }) }), _jsx("td", { children: deployment.services.map((service) => _jsxs("div", { class: "small", children: [_jsx("span", { class: `badge ${service.ready ? "text-bg-success" : "text-bg-warning"}`, children: service.status.state }), " ", _jsx("span", { class: "font-monospace", children: service.serviceId })] })) }), _jsxs("td", { children: [_jsxs("form", { class: "d-flex gap-2", "hx-put": data.previewPath, "hx-target": "#bp-main", "hx-swap": "innerHTML", children: [_jsx("input", { type: "hidden", name: "action", value: "update-expiry" }), _jsx("input", { type: "hidden", name: "deploymentId", value: deployment.id }), expiryInput(deployment.expiresInDays, false, `Expiry for ${deployment.name}`), _jsx("button", { class: "btn btn-sm btn-outline-secondary", type: "submit", children: "Save" })] }), _jsx("div", { class: "small text-secondary mt-1", children: deployment.expiresAt ? new Date(deployment.expiresAt).toLocaleString() : "Never expires" })] }), _jsxs("td", { children: [_jsx("button", { type: "button", class: "btn btn-sm btn-outline-secondary me-2", "data-bs-toggle": "offcanvas", "data-bs-target": "#bp-preview-debug", "hx-get": `${data.previewPath}?_c=debug&deploymentId=${encodeURIComponent(deployment.id)}`, "hx-target": "#bp-preview-debug-body", "hx-swap": "innerHTML", children: "Debug" }), _jsx("button", { class: "btn btn-sm btn-outline-danger", "hx-delete": `${data.previewPath}?entity=deployment&id=${encodeURIComponent(deployment.id)}`, "hx-confirm": `Delete preview ${deployment.name}?`, "hx-target": "#bp-main", "hx-swap": "innerHTML", children: "Delete" })] })] }))) })] }) }))] }) }))), _jsxs("aside", { class: "offcanvas offcanvas-end", tabindex: -1, id: "bp-preview-debug", "aria-labelledby": "bp-preview-debug-title", style: "width:min(95vw,52rem)", children: [_jsxs("div", { class: "offcanvas-header", children: [_jsx("h3", { class: "offcanvas-title h5", id: "bp-preview-debug-title", children: "Preview diagnostics" }), _jsx("button", { type: "button", class: "btn-close", "data-bs-dismiss": "offcanvas", "aria-label": "Close" })] }), _jsx("div", { class: "offcanvas-body", id: "bp-preview-debug-body", "aria-live": "polite", children: "Select a deployment to load diagnostics." })] }), _jsxs("aside", { class: "offcanvas offcanvas-end", tabindex: -1, id: "bp-create-preview-group", "aria-labelledby": "bp-create-preview-group-title", children: [_jsxs("div", { class: "offcanvas-header", children: [_jsx("h3", { class: "offcanvas-title h5", id: "bp-create-preview-group-title", children: "Create preview group" }), _jsx("button", { type: "button", class: "btn-close", "data-bs-dismiss": "offcanvas", "aria-label": "Close" })] }), _jsx("div", { class: "offcanvas-body", children: _jsxs("form", { "hx-post": data.previewPath, "hx-target": "#bp-main", "hx-swap": "innerHTML", children: [_jsx("input", { type: "hidden", name: "action", value: "create-group" }), _jsxs("div", { class: "mb-3", children: [_jsx("label", { class: "form-label", for: "bp-preview-group-name", children: "Name" }), _jsx("input", { id: "bp-preview-group-name", class: "form-control", name: "name", maxlength: "120", required: true })] }), _jsxs("div", { class: "mb-3", children: [_jsx("label", { class: "form-label", for: "bp-preview-source-tenant", children: "Source tenant" }), _jsxs("select", { id: "bp-preview-source-tenant", class: "form-select", name: "sourceTenantId", required: true, children: [_jsx("option", { value: "", children: "Select tenant" }), data.sourceTenants.map((tenant) => _jsx("option", { value: tenant.id, children: tenant.title }))] })] }), _jsxs("div", { class: "mb-3", children: [_jsx("label", { class: "form-label", for: "bp-preview-source-app", children: "Source app" }), _jsxs("select", { id: "bp-preview-source-app", class: "form-select", name: "sourceAppId", required: true, children: [_jsx("option", { value: "", children: "Select app" }), data.sourceApps.map((app) => _jsx("option", { value: app.id, "data-tenant-id": app.tenantId, children: app.title }))] })] }), _jsxs("div", { class: "mb-3", children: [_jsx("label", { class: "form-label", children: "Maximum/default expiry" }), expiryInput(30)] }), _jsxs("div", { class: "mb-3", children: [_jsx("label", { class: "form-label", for: "bp-new-plugin-ids", children: "BP plugin IDs" }), _jsx("textarea", { id: "bp-new-plugin-ids", class: "form-control font-monospace", name: "pluginIds", rows: 3, placeholder: "org.example.service" })] }), oidcFields("bp-new-group"), _jsxs("div", { class: "mb-3", children: [_jsx("label", { class: "form-label", for: "bp-new-elevated-roles", children: "Preview admin role IDs" }), _jsx("textarea", { id: "bp-new-elevated-roles", class: "form-control", name: "elevatedRoleIds", rows: "3", maxlength: "12900", placeholder: "admin, staff, client", "aria-describedby": "bp-new-elevated-roles-help" }), _jsx("div", { class: "form-text", id: "bp-new-elevated-roles-help", children: "One exact role ID per line or comma-separated. Grants full access only inside this group's previews; it does not assign roles to users or grant platform-admin access. Empty keeps normal permissions." })] }), _jsx("button", { class: "btn btn-primary w-100", type: "submit", children: "Create group" })] }) })] }), _jsx("script", { children: pageScript() })] }));
+export function render(data, ctx) {
+    const destination = (method, query = {}, component) => {
+        const target = ctx.routeUrl({ path: "/preview-environments", method, query, component })?.absoluteViewPath;
+        if (!target)
+            throw new Error("Preview action route is unavailable");
+        return target;
+    };
+    return (_jsxs("div", { class: "container-fluid px-0", children: [_jsxs("div", { class: "d-flex flex-wrap justify-content-between align-items-start gap-3 mb-4", children: [_jsxs("div", { children: [_jsx("h2", { class: "mb-1", children: data.title }), _jsx("p", { class: "text-secondary mb-0", children: "Clone an existing tenant/app configuration while CI owns where each service runs." })] }), _jsx("button", { class: "btn btn-primary", "data-bs-toggle": "offcanvas", "data-bs-target": "#bp-create-preview-group", children: "Create group" })] }), data.notice ? _jsx("div", { class: "alert alert-success", role: "status", children: data.notice }) : null, data.error ? _jsx("div", { class: "alert alert-danger", role: "alert", children: data.error }) : null, credentials(data), _jsxs("div", { class: "alert alert-info d-flex gap-2 align-items-start", children: [_jsx("span", { "aria-hidden": "true", children: "i" }), _jsxs("div", { children: [_jsx("strong", { children: "Pull setup only." }), " Services receive credentials from CI, publish their manifest on first sync, and rebuild preview routes/menu automatically."] })] }), data.groups.length === 0 ? (_jsx("div", { class: "card border-0 shadow-sm", children: _jsx("div", { class: "card-body py-5 text-center text-secondary", children: "No preview groups configured." }) })) : data.groups.map((group) => (_jsx("section", { class: "card border-0 shadow-sm mb-4", "aria-labelledby": `bp-group-${group.id}`, children: _jsxs("div", { class: "card-body", children: [_jsxs("div", { class: "d-flex flex-wrap justify-content-between align-items-start gap-3 mb-3", children: [_jsxs("div", { children: [_jsx("h3", { class: "h5 mb-1", id: `bp-group-${group.id}`, children: group.name }), _jsx("div", { class: "small text-secondary", children: group.sourceLabel }), _jsx("code", { class: "small", children: group.id })] }), _jsxs("div", { class: "d-flex flex-wrap gap-2", children: [_jsx("button", { class: "btn btn-sm btn-outline-primary", "data-bs-toggle": "collapse", "data-bs-target": `#bp-new-${group.id}`, children: "New preview" }), _jsx("button", { class: "btn btn-sm btn-outline-secondary", "data-bs-toggle": "collapse", "data-bs-target": `#bp-settings-${group.id}`, "hx-get": destination("GET", { groupId: group.id }, "config"), "hx-trigger": `click[!document.getElementById('bp-config-${group.id}').querySelector('form')]`, "hx-target": `#bp-config-${group.id}`, "hx-swap": "innerHTML", children: "Settings" }), _jsx("button", { class: "btn btn-sm btn-outline-danger", "hx-delete": destination("DELETE", { entity: "group", id: group.id }), "hx-confirm": `Delete ${group.name} and all of its previews?`, "hx-target": "#bp-main", "hx-swap": "innerHTML", children: "Delete" })] })] }), _jsxs("div", { class: "row g-3 mb-3", children: [_jsxs("div", { class: "col-12 col-xl-7", children: [_jsx("div", { class: "small text-secondary mb-1", children: "CI endpoint" }), _jsxs("code", { class: "d-block text-break", children: ["POST ", data.deploymentApiBase, "/", group.id, "/deployments/<key>"] })] }), _jsxs("div", { class: "col-12 col-xl-5", children: [_jsx("div", { class: "small text-secondary mb-1", children: "BP plugins" }), _jsx("div", { class: "d-flex flex-wrap gap-1", children: group.services.length ? group.services.map((service) => _jsx("span", { class: "badge text-bg-secondary", children: service.serviceId })) : _jsx("span", { class: "small text-secondary", children: "Added by the first preview create request." }) })] })] }), _jsx("div", { class: "collapse mb-4", id: `bp-new-${group.id}`, children: _jsxs("div", { class: "border rounded p-3 bg-body-tertiary", children: [_jsx("h4", { class: "h6", children: "Create preview manually" }), _jsxs("form", { "hx-post": destination("POST"), "hx-target": "#bp-main", "hx-swap": "innerHTML", children: [_jsx("input", { type: "hidden", name: "action", value: "create-deployment" }), _jsx("input", { type: "hidden", name: "groupId", value: group.id }), _jsxs("div", { class: "row g-3", children: [_jsxs("div", { class: "col-12 col-md-4", children: [_jsx("label", { class: "form-label", children: "Key" }), _jsx("input", { class: "form-control font-monospace", name: "key", maxlength: "255", pattern: "[A-Za-z0-9][A-Za-z0-9._:-]*", required: true })] }), _jsxs("div", { class: "col-12 col-md-4", children: [_jsx("label", { class: "form-label", children: "Name" }), _jsx("input", { class: "form-control", name: "name" })] }), _jsxs("div", { class: "col-12 col-md-4", children: [_jsx("label", { class: "form-label", children: "Expiry" }), expiryInput(undefined, true)] }), _jsxs("div", { class: "col-12", children: [_jsx("label", { class: "form-label", children: "App hostname or origin" }), _jsx("input", { class: "form-control font-monospace", name: "hostname", placeholder: "pr-123.preview.example.com", required: true })] }), _jsxs("div", { class: "col-12", children: [_jsx("label", { class: "form-label", for: `bp-preview-services-${group.id}`, children: "Services" }), _jsx("textarea", { id: `bp-preview-services-${group.id}`, class: "form-control font-monospace", name: "services", rows: Math.max(4, group.services.length + 2), required: true, children: JSON.stringify(Object.fromEntries(group.services.map((service) => [service.serviceId, ""])), null, 2) }), _jsx("div", { class: "form-text", children: "JSON object mapping service IDs to public HTTPS URLs." })] })] }), _jsx("button", { class: "btn btn-primary mt-3", type: "submit", children: "Create preview" })] })] }) }), _jsx("div", { class: "collapse mb-4", id: `bp-settings-${group.id}`, children: _jsxs("div", { class: "border rounded p-3", children: [_jsxs("form", { "hx-put": destination("PUT"), "hx-target": "#bp-main", "hx-swap": "innerHTML", children: [_jsx("input", { type: "hidden", name: "action", value: "update-group" }), _jsx("input", { type: "hidden", name: "groupId", value: group.id }), _jsxs("div", { class: "row g-3 mb-3", children: [_jsxs("div", { class: "col-12 col-md-8", children: [_jsx("label", { class: "form-label", children: "Group name" }), _jsx("input", { class: "form-control", name: "name", value: group.name, required: true })] }), _jsxs("div", { class: "col-12 col-md-4", children: [_jsx("label", { class: "form-label", children: "Maximum/default expiry" }), expiryInput(group.expiresInDays)] })] }), _jsxs("div", { class: "mb-3", children: [_jsx("label", { class: "form-label", for: `bp-elevated-roles-${group.id}`, children: "Preview admin role IDs" }), _jsx("textarea", { id: `bp-elevated-roles-${group.id}`, class: "form-control", name: "elevatedRoleIds", rows: "3", maxlength: "12900", "aria-describedby": `bp-elevated-roles-help-${group.id}`, children: (group.elevatedRoleIds ?? []).join("\n") }), _jsx("div", { class: "form-text", id: `bp-elevated-roles-help-${group.id}`, children: "Defaults for newly created previews; existing previews keep their own role settings. One exact role ID per line (or comma-separated), e.g. admin, staff, client. Users with any listed role get full access within this group's previews only. Empty keeps normal permissions. Changes apply to existing previews on config sync." })] }), oidcFields(`bp-group-${group.id}`, group.oidc), _jsx("button", { class: "btn btn-primary", type: "submit", children: "Save settings" })] }), _jsx("hr", {}), _jsxs("form", { "hx-post": destination("POST"), "hx-target": "#bp-main", "hx-swap": "innerHTML", children: [_jsx("input", { type: "hidden", name: "action", value: "rotate-key" }), _jsx("input", { type: "hidden", name: "groupId", value: group.id }), _jsx("button", { class: "btn btn-outline-warning", type: "submit", "hx-confirm": "Rotate this group API key? Existing CI credentials will stop working.", children: "Rotate API key" })] }), _jsx("div", { id: `bp-config-${group.id}`, children: _jsx("div", { class: "text-secondary small mt-3", role: "status", children: "Open settings to load service configuration." }) })] }) }), group.deployments.length === 0 ? _jsx("div", { class: "text-secondary small", children: "No active previews." }) : (_jsx("div", { class: "table-responsive", children: _jsxs("table", { class: "table table-sm align-middle mb-0", children: [_jsx("thead", { children: _jsxs("tr", { children: [_jsx("th", { children: "Preview" }), _jsx("th", { children: "App" }), _jsx("th", { children: "Services" }), _jsx("th", { children: "Expiry" }), _jsx("th", {})] }) }), _jsx("tbody", { children: group.deployments.map((deployment) => (_jsxs("tr", { children: [_jsxs("td", { children: [_jsx("div", { class: "fw-semibold", children: deployment.name }), _jsx("code", { class: "small", children: deployment.key }), _jsx("div", { children: _jsx("span", { class: `badge ${deployment.ready ? "text-bg-success" : "text-bg-warning"}`, children: deployment.ready ? "Configured" : "Needs attention" }) })] }), _jsx("td", { children: _jsx("a", { href: deployment.hostname.startsWith("http") ? deployment.hostname : `https://${deployment.hostname}`, target: "_blank", rel: "noreferrer", children: deployment.hostname }) }), _jsx("td", { children: deployment.services.map((service) => _jsxs("div", { class: "small", children: [_jsx("span", { class: `badge ${service.ready ? "text-bg-success" : "text-bg-warning"}`, children: service.status.state }), " ", _jsx("span", { class: "font-monospace", children: service.serviceId })] })) }), _jsxs("td", { children: [_jsxs("form", { class: "d-flex gap-2", "hx-put": destination("PUT"), "hx-target": "#bp-main", "hx-swap": "innerHTML", children: [_jsx("input", { type: "hidden", name: "action", value: "update-expiry" }), _jsx("input", { type: "hidden", name: "deploymentId", value: deployment.id }), expiryInput(deployment.expiresInDays, false, `Expiry for ${deployment.name}`), _jsx("button", { class: "btn btn-sm btn-outline-secondary", type: "submit", children: "Save" })] }), _jsx("div", { class: "small text-secondary mt-1", children: deployment.expiresAt ? new Date(deployment.expiresAt).toLocaleString() : "Never expires" })] }), _jsxs("td", { children: [_jsx("button", { type: "button", class: "btn btn-sm btn-outline-secondary me-2", "data-bs-toggle": "offcanvas", "data-bs-target": "#bp-preview-debug", "hx-get": destination("GET", { deploymentId: deployment.id }, "debug"), "hx-target": "#bp-preview-debug-body", "hx-swap": "innerHTML", children: "Debug" }), _jsx("button", { class: "btn btn-sm btn-outline-danger", "hx-delete": destination("DELETE", { entity: "deployment", id: deployment.id }), "hx-confirm": `Delete preview ${deployment.name}?`, "hx-target": "#bp-main", "hx-swap": "innerHTML", children: "Delete" })] })] }))) })] }) }))] }) }))), _jsxs("aside", { class: "offcanvas offcanvas-end", tabindex: -1, id: "bp-preview-debug", "aria-labelledby": "bp-preview-debug-title", style: "width:min(95vw,52rem)", children: [_jsxs("div", { class: "offcanvas-header", children: [_jsx("h3", { class: "offcanvas-title h5", id: "bp-preview-debug-title", children: "Preview diagnostics" }), _jsx("button", { type: "button", class: "btn-close", "data-bs-dismiss": "offcanvas", "aria-label": "Close" })] }), _jsx("div", { class: "offcanvas-body", id: "bp-preview-debug-body", "aria-live": "polite", children: "Select a deployment to load diagnostics." })] }), _jsxs("aside", { class: "offcanvas offcanvas-end", tabindex: -1, id: "bp-create-preview-group", "aria-labelledby": "bp-create-preview-group-title", children: [_jsxs("div", { class: "offcanvas-header", children: [_jsx("h3", { class: "offcanvas-title h5", id: "bp-create-preview-group-title", children: "Create preview group" }), _jsx("button", { type: "button", class: "btn-close", "data-bs-dismiss": "offcanvas", "aria-label": "Close" })] }), _jsx("div", { class: "offcanvas-body", children: _jsxs("form", { "hx-post": destination("POST"), "hx-target": "#bp-main", "hx-swap": "innerHTML", children: [_jsx("input", { type: "hidden", name: "action", value: "create-group" }), _jsxs("div", { class: "mb-3", children: [_jsx("label", { class: "form-label", for: "bp-preview-group-name", children: "Name" }), _jsx("input", { id: "bp-preview-group-name", class: "form-control", name: "name", maxlength: "120", required: true })] }), _jsxs("div", { class: "mb-3", children: [_jsx("label", { class: "form-label", for: "bp-preview-source-tenant", children: "Source tenant" }), _jsxs("select", { id: "bp-preview-source-tenant", class: "form-select", name: "sourceTenantId", required: true, children: [_jsx("option", { value: "", children: "Select tenant" }), data.sourceTenants.map((tenant) => _jsx("option", { value: tenant.id, children: tenant.title }))] })] }), _jsxs("div", { class: "mb-3", children: [_jsx("label", { class: "form-label", for: "bp-preview-source-app", children: "Source app" }), _jsxs("select", { id: "bp-preview-source-app", class: "form-select", name: "sourceAppId", required: true, children: [_jsx("option", { value: "", children: "Select app" }), data.sourceApps.map((app) => _jsx("option", { value: app.id, "data-tenant-id": app.tenantId, children: app.title }))] })] }), _jsxs("div", { class: "mb-3", children: [_jsx("label", { class: "form-label", children: "Maximum/default expiry" }), expiryInput(30)] }), _jsxs("div", { class: "mb-3", children: [_jsx("label", { class: "form-label", for: "bp-new-plugin-ids", children: "BP plugin IDs" }), _jsx("textarea", { id: "bp-new-plugin-ids", class: "form-control font-monospace", name: "pluginIds", rows: 3, placeholder: "org.example.service" })] }), oidcFields("bp-new-group"), _jsxs("div", { class: "mb-3", children: [_jsx("label", { class: "form-label", for: "bp-new-elevated-roles", children: "Preview admin role IDs" }), _jsx("textarea", { id: "bp-new-elevated-roles", class: "form-control", name: "elevatedRoleIds", rows: "3", maxlength: "12900", placeholder: "admin, staff, client", "aria-describedby": "bp-new-elevated-roles-help" }), _jsx("div", { class: "form-text", id: "bp-new-elevated-roles-help", children: "One exact role ID per line or comma-separated. Grants full access only inside this group's previews; it does not assign roles to users or grant platform-admin access. Empty keeps normal permissions." })] }), _jsx("button", { class: "btn btn-primary w-100", type: "submit", children: "Create group" })] }) })] }), _jsx("script", { children: pageScript() })] }));
 }
 //# sourceMappingURL=GET.js.map