@boopkit/cap-oauth-server 0.1.4 → 0.3.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/capability.json +14 -2
- package/dist/authorization-code-service.d.ts +40 -11
- package/dist/authorization-code-service.d.ts.map +1 -1
- package/dist/authorization-code-service.js +93 -41
- package/dist/authorization-code-service.js.map +1 -1
- package/dist/bearer.d.ts +27 -4
- package/dist/bearer.d.ts.map +1 -1
- package/dist/bearer.js +4 -4
- package/dist/bearer.js.map +1 -1
- package/dist/client-prune.d.ts +102 -0
- package/dist/client-prune.d.ts.map +1 -0
- package/dist/client-prune.js +51 -0
- package/dist/client-prune.js.map +1 -0
- package/dist/client-registry-service.d.ts +78 -7
- package/dist/client-registry-service.d.ts.map +1 -1
- package/dist/client-registry-service.js +200 -52
- package/dist/client-registry-service.js.map +1 -1
- package/dist/config.d.ts +6 -0
- package/dist/config.d.ts.map +1 -1
- package/dist/config.js +1 -0
- package/dist/config.js.map +1 -1
- package/dist/connections-controller.js +1 -1
- package/dist/connections-controller.js.map +1 -1
- package/dist/consent-controller.d.ts +80 -6
- package/dist/consent-controller.d.ts.map +1 -1
- package/dist/consent-controller.js +134 -18
- package/dist/consent-controller.js.map +1 -1
- package/dist/discovery-controller.d.ts +2 -1
- package/dist/discovery-controller.d.ts.map +1 -1
- package/dist/discovery-controller.js +14 -4
- package/dist/discovery-controller.js.map +1 -1
- package/dist/discovery.d.ts +26 -0
- package/dist/discovery.d.ts.map +1 -1
- package/dist/discovery.js +55 -1
- package/dist/discovery.js.map +1 -1
- package/dist/errors.d.ts +38 -0
- package/dist/errors.d.ts.map +1 -1
- package/dist/errors.js +59 -0
- package/dist/errors.js.map +1 -1
- package/dist/grant-service.d.ts +11 -4
- package/dist/grant-service.d.ts.map +1 -1
- package/dist/grant-service.js +6 -3
- package/dist/grant-service.js.map +1 -1
- package/dist/index.d.ts +10 -5
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +18 -3
- package/dist/index.js.map +1 -1
- package/dist/metadata-document.d.ts +22 -0
- package/dist/metadata-document.d.ts.map +1 -1
- package/dist/metadata-document.js +44 -2
- package/dist/metadata-document.js.map +1 -1
- package/dist/outbound-target.d.ts +48 -0
- package/dist/outbound-target.d.ts.map +1 -0
- package/dist/outbound-target.js +211 -0
- package/dist/outbound-target.js.map +1 -0
- package/dist/rate-limit.d.ts +53 -11
- package/dist/rate-limit.d.ts.map +1 -1
- package/dist/rate-limit.js +27 -4
- package/dist/rate-limit.js.map +1 -1
- package/dist/redirect-uri.d.ts +17 -9
- package/dist/redirect-uri.d.ts.map +1 -1
- package/dist/redirect-uri.js +26 -10
- package/dist/redirect-uri.js.map +1 -1
- package/dist/registration-controller.d.ts +10 -0
- package/dist/registration-controller.d.ts.map +1 -1
- package/dist/registration-controller.js +10 -0
- package/dist/registration-controller.js.map +1 -1
- package/dist/same-site.d.ts +54 -0
- package/dist/same-site.d.ts.map +1 -0
- package/dist/same-site.js +124 -0
- package/dist/same-site.js.map +1 -0
- package/dist/token-controller.d.ts +21 -0
- package/dist/token-controller.d.ts.map +1 -1
- package/dist/token-controller.js +42 -18
- package/dist/token-controller.js.map +1 -1
- package/package.json +2 -2
- package/scaffold/reference/oauth-server.ref.md +276 -10
- package/scaffold/src/middleware/oauth-server.ts +33 -17
- package/scaffold/src/scripts/prune-oauth-clients.ts +86 -0
- package/scaffold/src/services/oauth-server.service.ts +24 -0
- package/scaffold/views/oauth-consent-error.hbs +10 -3
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"client-registry-service.js","sourceRoot":"","sources":["../src/client-registry-service.ts"],"names":[],"mappings":";;;AAyJA,oDA0BC;AAsFD,kEAoPC;AA7fD,2CAAkD;AAClD,iEAOgC;AAChC,iDAAwD;AACxD,uDAAwD;AAUxD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,+EAA+E;AAClE,QAAA,mBAAmB,GAAG,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAC;AAC9D,QAAA,sBAAsB,GAAG,CAAC,MAAM,CAAC,CAAC;AAE/C,iFAAiF;AACpE,QAAA,2BAA2B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE/D,gFAAgF;AACnE,QAAA,+BAA+B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAExE,4EAA4E;AAC/D,QAAA,8BAA8B,GAAG,IAAK,CAAC;AAqEpD,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E,MAAM,eAAe,GAAG,CAAC,OAAe,EAAE,EAAE,CAC1C,IAAI,+BAAmB,CAAC,yBAAyB,EAAE,OAAO,CAAC,CAAC;AAE9D,MAAM,eAAe,GAAG,CAAC,OAAe,EAAE,EAAE,CAC1C,IAAI,+BAAmB,CAAC,sBAAsB,EAAE,OAAO,CAAC,CAAC;AAE3D;;;;;;;;;;;;;;GAcG;AACH,SAAgB,oBAAoB,CAAC,KAAc;IACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,eAAe,CAAC,yDAAyD,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACtB,MAAM,eAAe,CAAC,6DAA6D,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YAC9C,MAAM,eAAe,CAAC,sDAAsD,CAAC,CAAC;QAChF,CAAC;QAED,MAAM,OAAO,GAAG,IAAA,qCAAmB,EAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,eAAe,CAAC,uBAAuB,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,0EAA0E;QAC1E,2EAA2E;QAC3E,oCAAoC;QACpC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,KAAa,EAAE,SAAS,GAAG,IAAI;IACrE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACvE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,eAAe,CAAC,GAAG,KAAK,mBAAmB,CAAC,CAAC;IAClF,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS;QAAE,MAAM,eAAe,CAAC,GAAG,KAAK,mBAAmB,SAAS,EAAE,CAAC,CAAC;IAC5F,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc,EAAE,KAAa;IACxD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,eAAe,CAAC,GAAG,KAAK,8BAA8B,CAAC,CAAC;IACzF,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACzB,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,MAAM,eAAe,CAAC,GAAG,KAAK,8BAA8B,CAAC,CAAC;QAC7F,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,wEAAwE;AACxE,SAAS,UAAU,CAAC,KAAc,EAAE,QAAkB;IACpD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC;IAChF,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,eAAe,CAAC,wCAAwC,CAAC,CAAC;IAC/F,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,MAAM,CAAC;IACzE,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,MAAM,eAAe,CACnB,mFAAmF,CACpF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E,MAAM,aAAa,GAAG,CAAC,KAAc,EAAY,EAAE,CACjD,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAElG,MAAM,MAAM,GAAG,CAAC,KAAc,EAAQ,EAAE,CACtC,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAe,CAAC,CAAC;AAE5D,SAAS,QAAQ,CAAC,GAA4B;IAC5C,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAY;QACpB,QAAQ,EAAE,GAAG,CAAC,QAAkB;QAChC,QAAQ,EAAE,GAAG,CAAC,QAAkB;QAChC,IAAI,EAAE,GAAG,CAAC,IAAkB;QAC5B,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;QAC5D,IAAI,EAAG,GAAG,CAAC,IAAsB,IAAI,IAAI;QACzC,WAAW,EAAG,GAAG,CAAC,WAA6B,IAAI,IAAI;QACvD,OAAO,EAAG,GAAG,CAAC,OAAyB,IAAI,IAAI;QAC/C,SAAS,EAAG,GAAG,CAAC,SAA2B,IAAI,IAAI;QACnD,QAAQ,EAAE,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC;QACrC,UAAU,EAAG,GAAG,CAAC,UAA4B,IAAI,IAAI;QACrD,eAAe,EAAG,GAAG,CAAC,eAAiC,IAAI,IAAI;QAC/D,SAAS,EAAG,GAAG,CAAC,SAA2B,IAAI,IAAI;QACnD,MAAM,EAAG,GAAG,CAAC,MAAwB,IAAI,IAAI;QAC7C,YAAY,EAAE,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC;QAC7C,UAAU,EAAE,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC;QACzC,aAAa,EAAE,aAAa,CAAC,GAAG,CAAC,aAAa,CAAC;QAC/C,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC;QACjC,uBAAuB,EAAG,GAAG,CAAC,uBAAkC,IAAI,MAAM;QAC1E,WAAW,EAAG,GAAG,CAAC,WAA6B,IAAI,IAAI;QACvD,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC;QACvF,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;QAChC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;KACjC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E,SAAgB,2BAA2B,CACzC,KAA0B,EAC1B,UAAwC,EAAE;IAE1C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;IAClD,MAAM,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,IAAI,sCAA8B,CAAC;IAC5F,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,mCAA2B,CAAC;IACjF,MAAM,WAAW,GAAG;QAClB,SAAS,EAAE,OAAO,CAAC,iBAAiB,IAAI,kDAA2B;QACnE,QAAQ,EAAE,OAAO,CAAC,gBAAgB,IAAI,iDAA0B;QAChE,YAAY,EAAE,OAAO,CAAC,oBAAoB,IAAI,qDAA8B;KAC7E,CAAC;IAEF,MAAM,OAAO,GAA0B;QACrC,KAAK,CAAC,eAAe,CAAC,KAAK;YACzB,MAAM,YAAY,GAAG,oBAAoB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;YAE/D,IAAI,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;gBAC1C,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;gBACrE,IAAI,UAAU,IAAI,oBAAoB,EAAE,CAAC;oBACvC,MAAM,IAAI,+BAAmB,CAC3B,4BAA4B,EAC5B,wDAAwD,CACzD,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,MAAM,QAAQ,GAAG,IAAA,qCAAsB,GAAE,CAAC;YAC1C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC;gBAC7B,IAAI,EAAE;oBACJ,QAAQ;oBACR,oEAAoE;oBACpE,qEAAqE;oBACrE,iEAAiE;oBACjE,sBAAsB;oBACtB,QAAQ,EAAE,QAAQ;oBAClB,IAAI,EAAE,SAAS;oBACf,MAAM,EAAE,SAAS;oBACjB,IAAI,EAAE,cAAc,CAAC,KAAK,CAAC,WAAW,EAAE,aAAa,EAAE,GAAG,CAAC;oBAC3D,WAAW,EAAE,IAAI;oBACjB,OAAO,EAAE,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC;oBACnD,SAAS,EAAE,cAAc,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC;oBACzD,QAAQ,EAAE,mBAAmB,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC;oBACzD,UAAU,EAAE,cAAc,CAAC,KAAK,CAAC,WAAW,EAAE,aAAa,EAAE,GAAG,CAAC;oBACjE,eAAe,EAAE,cAAc,CAAC,KAAK,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,GAAG,CAAC;oBAChF,SAAS,EAAE,cAAc,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC;oBACzD,MAAM,EAAE,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC;oBAChD,YAAY;oBACZ,UAAU,EAAE,mBAAmB,CAAC,KAAK,CAAC,WAAW,CAAC;oBAClD,aAAa,EAAE,sBAAsB,CAAC,KAAK,CAAC,cAAc,CAAC;oBAC3D,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,aAAa,CAAC;oBAC9C,uBAAuB,EAAE,eAAe,CAAC,KAAK,CAAC,0BAA0B,CAAC;iBAC3E;aACF,CAAC,CAAC;YAEH,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;QAED,KAAK,CAAC,uBAAuB,CAAC,QAAQ;YACpC,IAAI,CAAC,IAAA,yCAAkB,EAAC,QAAQ,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,+BAAmB,CAC3B,iCAAiC,EACjC,0DAA0D,QAAQ,EAAE,CACrE,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC;YAChC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,+BAAmB,CAC3B,iCAAiC,EACjC,0FAA0F,CAC3F,CAAC;YACJ,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;YAEjE,oEAAoE;YACpE,uEAAuE;YACvE,0BAA0B;YAC1B,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,GAAG,GAAG,MAAM,IAAA,4CAAqB,EAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;gBAC1E,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;gBACxD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC;oBAC7B,IAAI,EAAE;wBACJ,QAAQ,EAAE,IAAA,qCAAsB,GAAE;wBAClC,QAAQ;wBACR,IAAI,EAAE,mBAAmB;wBACzB,MAAM,EAAE,SAAS;wBACjB,WAAW,EAAE,QAAQ;wBACrB,iBAAiB,EAAE,GAAG,EAAE;wBACxB,WAAW,EAAE,IAAI;wBACjB,GAAG,MAAM;qBACV;iBACF,CAAC,CAAC;gBACH,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;YACvB,CAAC;YAED,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAClC,IAAI,MAAM,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;gBACxC,wEAAwE;gBACxE,uEAAuE;gBACvE,SAAS;gBACT,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,CAAC,iBAAiB,CAAC;YAC3C,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC;YACzF,IAAI,GAAG,GAAG,gBAAgB;gBAAE,OAAO,MAAM,CAAC;YAE1C,uEAAuE;YACvE,0EAA0E;YAC1E,wEAAwE;YACxE,qEAAqE;YACrE,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,IAAA,4CAAqB,EAAC,MAAM,CAAC,WAAW,IAAI,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;gBAChG,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;gBACxD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC;oBAC7B,KAAK,EAAE,EAAE,QAAQ,EAAE;oBACnB,IAAI,EAAE,EAAE,GAAG,MAAM,EAAE,iBAAiB,EAAE,GAAG,EAAE,EAAE;iBAC9C,CAAC,CAAC;gBACH,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;YACvB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,uBAAuB,EAAE,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;gBACjD,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;QAED,KAAK,CAAC,oBAAoB,CAAC,KAAK;YAC9B,MAAM,YAAY,GAAG,oBAAoB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YAC9D,IAAI,CAAC,KAAK,CAAC,QAAQ;gBAAE,MAAM,eAAe,CAAC,kCAAkC,CAAC,CAAC;YAC/E,IAAI,CAAC,KAAK,CAAC,IAAI;gBAAE,MAAM,eAAe,CAAC,qDAAqD,CAAC,CAAC;YAE9F,MAAM,IAAI,GAAG;gBACX,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,SAAS;gBACjB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,WAAW,EAAE,cAAc,CAAC,KAAK,CAAC,WAAW,EAAE,aAAa,CAAC;gBAC7D,OAAO,EAAE,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC;gBACjD,SAAS,EAAE,cAAc,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC;gBACvD,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,EAAE;gBAC9B,UAAU,EAAE,cAAc,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,EAAE,GAAG,CAAC;gBAC/D,eAAe,EAAE,cAAc,CAAC,KAAK,CAAC,eAAe,EAAE,iBAAiB,EAAE,GAAG,CAAC;gBAC9E,SAAS,EAAE,cAAc,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC;gBACvD,MAAM,EAAE,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC;gBAC9C,YAAY;gBACZ,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,CAAC,GAAG,2BAAmB,CAAC;gBACxD,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,CAAC,GAAG,8BAAsB,CAAC;gBACjE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC,GAAG,aAAa,CAAC;gBAC1C,uBAAuB,EAAE,MAAM;aAChC,CAAC;YAEF,8DAA8D;YAC9D,wEAAwE;YACxE,uEAAuE;YACvE,oDAAoD;YACpD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YACjF,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC9E,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;YACvB,CAAC;YAED,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC;gBAC7B,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAA,qCAAsB,GAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE;aAChF,CAAC,CAAC;YACH,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,QAAQ;YAC3B,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,EAAE;gBAAE,OAAO,IAAI,CAAC;YACjE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC5D,OAAO,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpC,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,QAAQ;YAC3B,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,EAAE;gBAAE,OAAO,IAAI,CAAC;YACjE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC5D,OAAO,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpC,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,QAAQ;YACpB,MAAM,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACrC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;YACvF,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,QAAQ;YACtB,MAAM,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACrC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;YACrF,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,QAAQ,EAAE,KAAK;YACtC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACpD,YAAY,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YAEjC,MAAM,IAAI,GAA4B,EAAE,CAAC;YACzC,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;gBACtC,IAAI,CAAC,YAAY,GAAG,oBAAoB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;YAChE,CAAC;YACD,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;gBACpC,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,WAAW,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;YACpE,CAAC;YACD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;gBAAE,IAAI,CAAC,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;YACpG,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;gBAAE,IAAI,CAAC,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YAC5F,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;gBAAE,IAAI,CAAC,QAAQ,GAAG,mBAAmB,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YAClG,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;gBAAE,IAAI,CAAC,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;YACpG,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;gBAAE,IAAI,CAAC,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YACxF,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;gBAAE,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;YAEpF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9D,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,QAAQ;YAC/B,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACpD,YAAY,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAChC,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC9C,CAAC;QAED,KAAK,CAAC,eAAe;YACnB,OAAO,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QACrD,CAAC;QAED,KAAK,CAAC,qBAAqB,CAAC,YAAY,GAAG,EAAE;YAC3C,MAAM,MAAM,GACV,YAAY,CAAC,MAAM,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,uCAA+B,CAAC,CAAC;YACrF,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC;YAE5D,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC;gBAChC,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE;aACtD,CAAC,CAAC;YAEH,MAAM,OAAO,GAAa,EAAE,CAAC;YAC7B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAC7B,IAAI,MAAM,OAAO,CAAC,MAAM,CAAC;oBAAE,SAAS;gBACpC,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;gBAC7D,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAChC,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC;IAEF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,KAA0B,EAC1B,QAAgB;IAEhB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,+BAAmB,CAAC,gBAAgB,EAAE,mBAAmB,QAAQ,EAAE,CAAC,CAAC;IACzF,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;AACvB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,YAAY,CAAC,MAAmB,EAAE,IAAY;IACrD,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,+BAAmB,CAC3B,8BAA8B,EAC9B,GAAG,MAAM,CAAC,QAAQ,qCAAqC,IAAI,mCAAmC,CAC/F,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,SAAS,mBAAmB,CAAC,KAAc;IACzC,MAAM,SAAS,GAAG,mBAAmB,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IAC5D,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,GAAG,2BAAmB,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,kBAAkB,CAAC,SAAS,EAAE,2BAAmB,CAAC,CAAC;IACrE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAC9C,MAAM,eAAe,CACnB,oCAAoC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB;YAC/E,GAAG,2BAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,+BAA+B,CACnE,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,iFAAiF;AACjF,SAAS,sBAAsB,CAAC,KAAc;IAC5C,MAAM,SAAS,GAAG,mBAAmB,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IAC/D,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,GAAG,8BAAsB,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,kBAAkB,CAAC,SAAS,EAAE,8BAAsB,CAAC,CAAC;IACxE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,MAAM,eAAe,CACnB,uCAAuC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB;YAClF,GAAG,8BAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzC,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,SAAmB,EAAE,SAA4B;IAC3E,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,SAAS,oBAAoB,CAC3B,GAA6B,EAC7B,aAAuB;IAEvB,OAAO;QACL,IAAI,EAAE,cAAc,CAAC,GAAG,CAAC,WAAW,EAAE,aAAa,EAAE,GAAG,CAAC;QACzD,OAAO,EAAE,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC;QACjD,SAAS,EAAE,cAAc,CAAC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC;QACvD,QAAQ,EAAE,mBAAmB,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC;QACvD,SAAS,EAAE,cAAc,CAAC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC;QACvD,MAAM,EAAE,cAAc,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC;QAC9C,YAAY,EAAE,oBAAoB,CAAC,GAAG,CAAC,aAAa,CAAC;QACrD,UAAU,EAAE,mBAAmB,CAAC,GAAG,CAAC,WAAW,CAAC;QAChD,aAAa,EAAE,sBAAsB,CAAC,GAAG,CAAC,cAAc,CAAC;QACzD,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,aAAa,CAAC;QAC5C,uBAAuB,EAAE,eAAe,CAAC,GAAG,CAAC,0BAA0B,CAAC;KACzE,CAAC;AACJ,CAAC"}
|
|
1
|
+
{"version":3,"file":"client-registry-service.js","sourceRoot":"","sources":["../src/client-registry-service.ts"],"names":[],"mappings":";;;AAiOA,oDA0BC;AA2ID,kEAySC;AA/qBD,2CAA+E;AAC/E,iEAOgC;AAChC,iDAAwD;AACxD,uDAAwD;AAUxD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,+EAA+E;AAClE,QAAA,mBAAmB,GAAG,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAC;AAC9D,QAAA,sBAAsB,GAAG,CAAC,MAAM,CAAC,CAAC;AAE/C,iFAAiF;AACpE,QAAA,2BAA2B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE/D,gFAAgF;AACnE,QAAA,+BAA+B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAExE,4EAA4E;AAC/D,QAAA,8BAA8B,GAAG,IAAK,CAAC;AAEpD;;;;;;;;;;;;;;GAcG;AACU,QAAA,sBAAsB,GAA0B,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;AAuH9F,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E,MAAM,eAAe,GAAG,CAAC,OAAe,EAAE,EAAE,CAC1C,IAAI,+BAAmB,CAAC,yBAAyB,EAAE,OAAO,CAAC,CAAC;AAE9D,MAAM,eAAe,GAAG,CAAC,OAAe,EAAE,EAAE,CAC1C,IAAI,+BAAmB,CAAC,sBAAsB,EAAE,OAAO,CAAC,CAAC;AAE3D;;;;;;;;;;;;;;GAcG;AACH,SAAgB,oBAAoB,CAAC,KAAc;IACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,eAAe,CAAC,yDAAyD,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACtB,MAAM,eAAe,CAAC,6DAA6D,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YAC9C,MAAM,eAAe,CAAC,sDAAsD,CAAC,CAAC;QAChF,CAAC;QAED,MAAM,OAAO,GAAG,IAAA,qCAAmB,EAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,eAAe,CAAC,uBAAuB,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,0EAA0E;QAC1E,2EAA2E;QAC3E,oCAAoC;QACpC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,KAAa,EAAE,SAAS,GAAG,IAAI;IACrE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACvE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,eAAe,CAAC,GAAG,KAAK,mBAAmB,CAAC,CAAC;IAClF,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS;QAAE,MAAM,eAAe,CAAC,GAAG,KAAK,mBAAmB,SAAS,EAAE,CAAC,CAAC;IAC5F,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,gBAAgB,CAAC,KAAc,EAAE,KAAa;IACrD,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC1C,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,eAAe,CAAC,GAAG,KAAK,uBAAuB,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,eAAe,CAAC,GAAG,KAAK,8BAA8B,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,4EAA4E;IAC5E,0EAA0E;IAC1E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc,EAAE,KAAa;IACxD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,eAAe,CAAC,GAAG,KAAK,8BAA8B,CAAC,CAAC;IACzF,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACzB,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,MAAM,eAAe,CAAC,GAAG,KAAK,8BAA8B,CAAC,CAAC;QAC7F,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,UAAU,CAAC,KAAc,EAAE,QAAkB,EAAE,SAAmB;IACzE,MAAM,KAAK,GAAG,CAAC,MAAgB,EAAE,EAAE,CACjC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAEtF,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC;IACvF,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,eAAe,CAAC,wCAAwC,CAAC,CAAC;IAC/F,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC;IAErD,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,eAAe,CACnB,+CAA+C,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAClE,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,MAAM,CAAC;IACzE,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,MAAM,eAAe,CACnB,mFAAmF,CACpF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E,MAAM,aAAa,GAAG,CAAC,KAAc,EAAY,EAAE,CACjD,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAElG,MAAM,MAAM,GAAG,CAAC,KAAc,EAAQ,EAAE,CACtC,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAe,CAAC,CAAC;AAE5D,SAAS,QAAQ,CAAC,GAA4B;IAC5C,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAY;QACpB,QAAQ,EAAE,GAAG,CAAC,QAAkB;QAChC,QAAQ,EAAE,GAAG,CAAC,QAAkB;QAChC,IAAI,EAAE,GAAG,CAAC,IAAkB;QAC5B,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;QAC5D,IAAI,EAAG,GAAG,CAAC,IAAsB,IAAI,IAAI;QACzC,WAAW,EAAG,GAAG,CAAC,WAA6B,IAAI,IAAI;QACvD,OAAO,EAAG,GAAG,CAAC,OAAyB,IAAI,IAAI;QAC/C,SAAS,EAAG,GAAG,CAAC,SAA2B,IAAI,IAAI;QACnD,QAAQ,EAAE,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC;QACrC,UAAU,EAAG,GAAG,CAAC,UAA4B,IAAI,IAAI;QACrD,eAAe,EAAG,GAAG,CAAC,eAAiC,IAAI,IAAI;QAC/D,SAAS,EAAG,GAAG,CAAC,SAA2B,IAAI,IAAI;QACnD,MAAM,EAAG,GAAG,CAAC,MAAwB,IAAI,IAAI;QAC7C,YAAY,EAAE,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC;QAC7C,UAAU,EAAE,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC;QACzC,aAAa,EAAE,aAAa,CAAC,GAAG,CAAC,aAAa,CAAC;QAC/C,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC;QACjC,uBAAuB,EAAG,GAAG,CAAC,uBAAkC,IAAI,MAAM;QAC1E,WAAW,EAAG,GAAG,CAAC,WAA6B,IAAI,IAAI;QACvD,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC;QACvF,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;QAChC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;KACjC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E,SAAgB,2BAA2B,CACzC,KAA0B,EAC1B,UAAwC,EAAE;IAE1C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;IAClD,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,aAAa,CAAC;IACjE,MAAM,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,IAAI,sCAA8B,CAAC;IAC5F,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,mCAA2B,CAAC;IACjF,MAAM,WAAW,GAAG;QAClB,SAAS,EAAE,OAAO,CAAC,iBAAiB,IAAI,kDAA2B;QACnE,QAAQ,EAAE,OAAO,CAAC,gBAAgB,IAAI,iDAA0B;QAChE,YAAY,EAAE,OAAO,CAAC,oBAAoB,IAAI,qDAA8B;QAC5E,WAAW,EAAE,OAAO,CAAC,mBAAmB;KACzC,CAAC;IAEF;;;;;OAKG;IACH,KAAK,UAAU,cAAc;QAC3B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC;YAAE,OAAO;QACnD,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,8BAAsB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/F,IAAI,UAAU,IAAI,oBAAoB,EAAE,CAAC;YACvC,MAAM,IAAI,+BAAmB,CAC3B,4BAA4B,EAC5B,wDAAwD,CACzD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAA0B;QACrC,KAAK,CAAC,eAAe,CAAC,KAAK;YACzB,MAAM,YAAY,GAAG,oBAAoB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;YAE/D,MAAM,cAAc,EAAE,CAAC;YAEvB,MAAM,QAAQ,GAAG,IAAA,qCAAsB,GAAE,CAAC;YAC1C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC;gBAC7B,IAAI,EAAE;oBACJ,QAAQ;oBACR,oEAAoE;oBACpE,qEAAqE;oBACrE,iEAAiE;oBACjE,sBAAsB;oBACtB,QAAQ,EAAE,QAAQ;oBAClB,IAAI,EAAE,SAAS;oBACf,MAAM,EAAE,SAAS;oBACjB,IAAI,EAAE,cAAc,CAAC,KAAK,CAAC,WAAW,EAAE,aAAa,EAAE,GAAG,CAAC;oBAC3D,WAAW,EAAE,IAAI;oBACjB,OAAO,EAAE,gBAAgB,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC;oBACrD,SAAS,EAAE,gBAAgB,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC;oBAC3D,QAAQ,EAAE,mBAAmB,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC;oBACzD,UAAU,EAAE,cAAc,CAAC,KAAK,CAAC,WAAW,EAAE,aAAa,EAAE,GAAG,CAAC;oBACjE,eAAe,EAAE,cAAc,CAAC,KAAK,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,GAAG,CAAC;oBAChF,SAAS,EAAE,gBAAgB,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC;oBAC3D,MAAM,EAAE,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC;oBAClD,YAAY;oBACZ,UAAU,EAAE,mBAAmB,CAAC,KAAK,CAAC,WAAW,CAAC;oBAClD,aAAa,EAAE,sBAAsB,CAAC,KAAK,CAAC,cAAc,CAAC;oBAC3D,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,aAAa,EAAE,eAAe,CAAC;oBAC/D,uBAAuB,EAAE,eAAe,CAAC,KAAK,CAAC,0BAA0B,CAAC;iBAC3E;aACF,CAAC,CAAC;YAEH,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;QAED,KAAK,CAAC,uBAAuB,CAAC,QAAQ;YACpC,IAAI,CAAC,IAAA,yCAAkB,EAAC,QAAQ,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,+BAAmB,CAC3B,iCAAiC,EACjC,0DAA0D,QAAQ,EAAE,CACrE,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC;YAChC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,+BAAmB,CAC3B,iCAAiC,EACjC,0FAA0F,CAC3F,CAAC;YACJ,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;YAEjE,oEAAoE;YACpE,uEAAuE;YACvE,0BAA0B;YAC1B,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,oEAAoE;gBACpE,sEAAsE;gBACtE,6DAA6D;gBAC7D,gEAAgE;gBAChE,EAAE;gBACF,uEAAuE;gBACvE,wEAAwE;gBACxE,sEAAsE;gBACtE,YAAY;gBACZ,MAAM,cAAc,EAAE,CAAC;gBACvB,MAAM,GAAG,GAAG,MAAM,IAAA,4CAAqB,EAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;gBAC1E,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,EAAE,aAAa,EAAE,eAAe,CAAC,CAAC;gBACzE,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC;wBAC7B,IAAI,EAAE;4BACJ,QAAQ,EAAE,IAAA,qCAAsB,GAAE;4BAClC,QAAQ;4BACR,IAAI,EAAE,mBAAmB;4BACzB,MAAM,EAAE,SAAS;4BACjB,WAAW,EAAE,QAAQ;4BACrB,iBAAiB,EAAE,GAAG,EAAE;4BACxB,WAAW,EAAE,IAAI;4BACjB,GAAG,MAAM;yBACV;qBACF,CAAC,CAAC;oBACH,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;gBACvB,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,gEAAgE;oBAChE,+DAA+D;oBAC/D,qEAAqE;oBACrE,oEAAoE;oBACpE,oDAAoD;oBACpD,EAAE;oBACF,qEAAqE;oBACrE,mEAAmE;oBACnE,oEAAoE;oBACpE,oEAAoE;oBACpE,2DAA2D;oBAC3D,IAAI,CAAC,IAAA,uCAA2B,EAAC,GAAG,EAAE,UAAU,CAAC;wBAAE,MAAM,GAAG,CAAC;oBAC7D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;oBAC5D,IAAI,CAAC,GAAG;wBAAE,MAAM,GAAG,CAAC;oBACpB,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;gBACvB,CAAC;YACH,CAAC;YAED,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAClC,IAAI,MAAM,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;gBACxC,wEAAwE;gBACxE,uEAAuE;gBACvE,SAAS;gBACT,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,CAAC,iBAAiB,CAAC;YAC3C,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC;YACzF,IAAI,GAAG,GAAG,gBAAgB;gBAAE,OAAO,MAAM,CAAC;YAE1C,uEAAuE;YACvE,0EAA0E;YAC1E,wEAAwE;YACxE,qEAAqE;YACrE,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,IAAA,4CAAqB,EAAC,MAAM,CAAC,WAAW,IAAI,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;gBAChG,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,EAAE,aAAa,EAAE,eAAe,CAAC,CAAC;gBACzE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC;oBAC7B,KAAK,EAAE,EAAE,QAAQ,EAAE;oBACnB,IAAI,EAAE,EAAE,GAAG,MAAM,EAAE,iBAAiB,EAAE,GAAG,EAAE,EAAE;iBAC9C,CAAC,CAAC;gBACH,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;YACvB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,uBAAuB,EAAE,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;gBACjD,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;QAED,KAAK,CAAC,oBAAoB,CAAC,KAAK;YAC9B,MAAM,YAAY,GAAG,oBAAoB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YAC9D,IAAI,CAAC,KAAK,CAAC,QAAQ;gBAAE,MAAM,eAAe,CAAC,kCAAkC,CAAC,CAAC;YAC/E,IAAI,CAAC,KAAK,CAAC,IAAI;gBAAE,MAAM,eAAe,CAAC,qDAAqD,CAAC,CAAC;YAE9F,MAAM,IAAI,GAAG;gBACX,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,SAAS;gBACjB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,WAAW,EAAE,cAAc,CAAC,KAAK,CAAC,WAAW,EAAE,aAAa,CAAC;gBAC7D,OAAO,EAAE,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC;gBACjD,SAAS,EAAE,cAAc,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC;gBACvD,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,EAAE;gBAC9B,UAAU,EAAE,cAAc,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,EAAE,GAAG,CAAC;gBAC/D,eAAe,EAAE,cAAc,CAAC,KAAK,CAAC,eAAe,EAAE,iBAAiB,EAAE,GAAG,CAAC;gBAC9E,SAAS,EAAE,cAAc,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC;gBACvD,MAAM,EAAE,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC;gBAC9C,YAAY;gBACZ,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,CAAC,GAAG,2BAAmB,CAAC;gBACxD,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,CAAC,GAAG,8BAAsB,CAAC;gBACjE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC,GAAG,aAAa,CAAC;gBAC1C,uBAAuB,EAAE,MAAM;aAChC,CAAC;YAEF,8DAA8D;YAC9D,wEAAwE;YACxE,uEAAuE;YACvE,oDAAoD;YACpD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YACjF,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC9E,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;YACvB,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC;oBAC7B,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAA,qCAAsB,GAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE;iBAChF,CAAC,CAAC;gBACH,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;YACvB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,qEAAqE;gBACrE,sEAAsE;gBACtE,wEAAwE;gBACxE,qEAAqE;gBACrE,4DAA4D;gBAC5D,IAAI,CAAC,IAAA,uCAA2B,EAAC,GAAG,EAAE,UAAU,CAAC;oBAAE,MAAM,GAAG,CAAC;gBAC7D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC9E,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,QAAQ;YAC3B,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,EAAE;gBAAE,OAAO,IAAI,CAAC;YACjE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC5D,OAAO,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpC,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,QAAQ;YAC3B,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,EAAE;gBAAE,OAAO,IAAI,CAAC;YACjE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC5D,OAAO,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpC,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,QAAQ;YACpB,MAAM,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACrC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;YACvF,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,QAAQ;YACtB,MAAM,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACrC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;YACrF,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,QAAQ,EAAE,KAAK;YACtC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACpD,YAAY,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YAEjC,MAAM,IAAI,GAA4B,EAAE,CAAC;YACzC,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;gBACtC,IAAI,CAAC,YAAY,GAAG,oBAAoB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;YAChE,CAAC;YACD,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;gBACpC,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,WAAW,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;YACpE,CAAC;YACD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;gBAChC,IAAI,CAAC,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;YACpE,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;gBAAE,IAAI,CAAC,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YAC9F,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;gBAAE,IAAI,CAAC,QAAQ,GAAG,mBAAmB,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YAClG,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;gBAChC,IAAI,CAAC,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;YACpE,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;gBAAE,IAAI,CAAC,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YAC1F,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;gBAC3B,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,aAAa,EAAE,eAAe,CAAC,CAAC;YAExE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9D,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,QAAQ;YAC/B,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACpD,YAAY,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAChC,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC9C,CAAC;QAED,KAAK,CAAC,eAAe;YACnB,OAAO,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,8BAAsB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/E,CAAC;QAED,KAAK,CAAC,qBAAqB,CAAC,YAAY,GAAG,EAAE;YAC3C,MAAM,MAAM,GACV,YAAY,CAAC,MAAM,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,uCAA+B,CAAC,CAAC;YACrF,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC;YAE5D,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC;gBAChC,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,8BAAsB,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE;aAChF,CAAC,CAAC;YAEH,MAAM,OAAO,GAAa,EAAE,CAAC;YAC7B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAC7B,IAAI,MAAM,OAAO,CAAC,MAAM,CAAC;oBAAE,SAAS;gBACpC,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;gBAC7D,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAChC,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC;IAEF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,KAA0B,EAC1B,QAAgB;IAEhB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,+BAAmB,CAAC,gBAAgB,EAAE,mBAAmB,QAAQ,EAAE,CAAC,CAAC;IACzF,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;AACvB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,SAAS,YAAY,CAAC,MAAmB,EAAE,IAAY;IACrD,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,+BAAmB,CAC3B,8BAA8B,EAC9B,GAAG,MAAM,CAAC,QAAQ,qCAAqC,IAAI,mCAAmC,CAC/F,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,SAAS,mBAAmB,CAAC,KAAc;IACzC,MAAM,SAAS,GAAG,mBAAmB,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IAC5D,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,GAAG,2BAAmB,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,kBAAkB,CAAC,SAAS,EAAE,2BAAmB,CAAC,CAAC;IACrE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAC9C,MAAM,eAAe,CACnB,oCAAoC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB;YAC/E,GAAG,2BAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,+BAA+B,CACnE,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,iFAAiF;AACjF,SAAS,sBAAsB,CAAC,KAAc;IAC5C,MAAM,SAAS,GAAG,mBAAmB,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IAC/D,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,GAAG,8BAAsB,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,kBAAkB,CAAC,SAAS,EAAE,8BAAsB,CAAC,CAAC;IACxE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,MAAM,eAAe,CACnB,uCAAuC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB;YAClF,GAAG,8BAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzC,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,SAAmB,EAAE,SAA4B;IAC3E,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,SAAS,oBAAoB,CAC3B,GAA6B,EAC7B,aAAuB,EACvB,eAAyB;IAEzB,OAAO;QACL,IAAI,EAAE,cAAc,CAAC,GAAG,CAAC,WAAW,EAAE,aAAa,EAAE,GAAG,CAAC;QACzD,OAAO,EAAE,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC;QACnD,SAAS,EAAE,gBAAgB,CAAC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC;QACzD,QAAQ,EAAE,mBAAmB,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC;QACvD,SAAS,EAAE,gBAAgB,CAAC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC;QACzD,MAAM,EAAE,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC;QAChD,YAAY,EAAE,oBAAoB,CAAC,GAAG,CAAC,aAAa,CAAC;QACrD,UAAU,EAAE,mBAAmB,CAAC,GAAG,CAAC,WAAW,CAAC;QAChD,aAAa,EAAE,sBAAsB,CAAC,GAAG,CAAC,cAAc,CAAC;QACzD,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,aAAa,EAAE,eAAe,CAAC;QAC7D,uBAAuB,EAAE,eAAe,CAAC,GAAG,CAAC,0BAA0B,CAAC;KACzE,CAAC;AACJ,CAAC"}
|
package/dist/config.d.ts
CHANGED
|
@@ -44,6 +44,12 @@ export interface ServerConfig extends DiscoveryConfig {
|
|
|
44
44
|
maxRegisteredClients: number;
|
|
45
45
|
registrationRateLimit: number;
|
|
46
46
|
registrationRateWindowMs: number;
|
|
47
|
+
/**
|
|
48
|
+
* First-sight metadata-document resolutions per address per window. The same
|
|
49
|
+
* window as registration, because they are two faces of one unauthenticated
|
|
50
|
+
* write and an operator should not have to reason about two clocks.
|
|
51
|
+
*/
|
|
52
|
+
metadataResolutionRateLimit: number;
|
|
47
53
|
}
|
|
48
54
|
export interface ReadConfigOptions {
|
|
49
55
|
/** Where a clamp or a fallback is announced. Defaults to `console.warn`. */
|
package/dist/config.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AACA,OAAO,EAA4B,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;
|
|
1
|
+
{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AACA,OAAO,EAA4B,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAOhF;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,+DAA+D;AAC/D,eAAO,MAAM,gCAAgC,MAAM,CAAC;AACpD,eAAO,MAAM,iCAAiC,UAAY,CAAC;AAE3D;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB;;;CAAmC,CAAC;AACxE,eAAO,MAAM,wBAAwB;;;CAA2C,CAAC;AAEjF,MAAM,WAAW,YAAa,SAAQ,eAAe;IACnD,qBAAqB,EAAE,MAAM,CAAC;IAC9B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,wBAAwB,EAAE,MAAM,CAAC;IACjC;;;;OAIG;IACH,2BAA2B,EAAE,MAAM,CAAC;CACrC;AAED,MAAM,WAAW,iBAAiB;IAChC,4EAA4E;IAC5E,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAE9C,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EACpC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,GAC9B,MAAM,CAcR;AAuCD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,GAAE,iBAAsB,GAAG,YAAY,CAsFxF"}
|
package/dist/config.js
CHANGED
|
@@ -152,6 +152,7 @@ function readServerConfig(env, options = {}) {
|
|
|
152
152
|
maxRegisteredClients: positiveInteger(env.OAUTH_MAX_REGISTERED_CLIENTS, client_registry_service_js_1.DEFAULT_MAX_REGISTERED_CLIENTS, 'OAUTH_MAX_REGISTERED_CLIENTS', warn),
|
|
153
153
|
registrationRateLimit: positiveInteger(env.OAUTH_REGISTRATION_RATE_LIMIT, rate_limit_js_1.DEFAULT_REGISTRATION_RATE_LIMIT, 'OAUTH_REGISTRATION_RATE_LIMIT', warn),
|
|
154
154
|
registrationRateWindowMs: rate_limit_js_1.DEFAULT_REGISTRATION_RATE_WINDOW_MS,
|
|
155
|
+
metadataResolutionRateLimit: positiveInteger(env.OAUTH_METADATA_RESOLUTION_RATE_LIMIT, rate_limit_js_1.DEFAULT_METADATA_RESOLUTION_RATE_LIMIT, 'OAUTH_METADATA_RESOLUTION_RATE_LIMIT', warn),
|
|
155
156
|
};
|
|
156
157
|
}
|
|
157
158
|
//# sourceMappingURL=config.js.map
|
package/dist/config.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":";;;AAoFA,0CAmBC;AA+CD,4CAsFC;AA5OD,6EAA8E;AAC9E,iDAAgF;AAChF,mDAIyB;AAEzB;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,+DAA+D;AAClD,QAAA,gCAAgC,GAAG,GAAG,CAAC;AACvC,QAAA,iCAAiC,GAAG,OAAS,CAAC;AAE3D;;;;;;;GAOG;AACU,QAAA,uBAAuB,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,IAAK,EAAW,CAAC;AAC3D,QAAA,wBAAwB,GAAG,EAAE,GAAG,EAAE,IAAK,EAAE,GAAG,EAAE,QAAU,EAAW,CAAC;AAuBjF,MAAa,sBAAuB,SAAQ,KAAK;IAC/C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AALD,wDAKC;AAED;;;;;;;;;;;GAWG;AACH,SAAgB,eAAe,CAC7B,KAAa,EACb,MAAoC,EACpC,IAAY,EACZ,IAA+B;IAE/B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACtE,IAAI,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,qDAAqD,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QAChG,OAAO,MAAM,CAAC,GAAG,CAAC;IACpB,CAAC;IACD,IAAI,KAAK,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,IAAI,IAAI,KAAK,iBAAiB,MAAM,CAAC,GAAG,kBAAkB,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QAChF,OAAO,MAAM,CAAC,GAAG,CAAC;IACpB,CAAC;IACD,IAAI,KAAK,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,IAAI,IAAI,KAAK,iBAAiB,MAAM,CAAC,GAAG,oBAAoB,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QAClF,OAAO,MAAM,CAAC,GAAG,CAAC;IACpB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CACnB,GAAuB,EACvB,QAAgB,EAChB,MAAoC,EACpC,IAAY,EACZ,IAA+B;IAE/B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IAE5D,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACtE,IAAI,CAAC,GAAG,IAAI,KAAK,GAAG,sDAAsD,QAAQ,EAAE,CAAC,CAAC;QACtF,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,eAAe,CACtB,GAAuB,EACvB,QAAgB,EAChB,IAAY,EACZ,IAA+B;IAE/B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IAC5D,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACtE,IAAI,CAAC,GAAG,IAAI,KAAK,GAAG,2CAA2C,QAAQ,EAAE,CAAC,CAAC;QAC3E,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,kFAAkF;AAClF,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAC1D,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,gBAAgB,CAAC,GAAQ,EAAE,UAA6B,EAAE;IACxE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,OAAe,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,OAAO,EAAE,CAAC,CAAC,CAAC;IAElG,MAAM,SAAS,GAAG,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC;IAC/C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,sBAAsB,CAC9B,uFAAuF,CACxF,CAAC;IACJ,CAAC;IAED,IAAI,SAAc,CAAC;IACnB,IAAI,CAAC;QACH,SAAS,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,sBAAsB,CAAC,kCAAkC,SAAS,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ,IAAI,SAAS,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;QAC1E,MAAM,IAAI,sBAAsB,CAC9B,wEAAwE,SAAS,EAAE,CACpF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAE1C,wEAAwE;IACxE,sEAAsE;IACtE,uEAAuE;IACvE,8EAA8E;IAC9E,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC,CAAC;IAE3E,MAAM,SAAS,GAAG,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,CAAC;IACrD,MAAM,eAAe,GAAG,SAAS;QAC/B,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;QAC3C,CAAC,CAAC,CAAC,GAAG,uCAAwB,CAAC,CAAC;IAElC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAChD,0EAA0E;QAC1E,wEAAwE;QACxE,6CAA6C;QAC7C,IAAI,CAAC,4FAA4F,CAAC,CAAC;IACrG,CAAC;IAED,OAAO;QACL,MAAM;QACN,QAAQ;QACR,eAAe;QACf,0EAA0E;QAC1E,kEAAkE;QAClE,sEAAsE;QACtE,2DAA2D;QAC3D,iBAAiB,EAAE,GAAG,CAAC,yBAAyB,KAAK,MAAM;QAC3D,gBAAgB,EAAE,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE,IAAI,SAAS;QAClE,qBAAqB,EAAE,YAAY,CACjC,GAAG,CAAC,8BAA8B,EAClC,wCAAgC,EAChC,+BAAuB,EACvB,gCAAgC,EAChC,IAAI,CACL;QACD,sBAAsB,EAAE,YAAY,CAClC,GAAG,CAAC,+BAA+B,EACnC,yCAAiC,EACjC,gCAAwB,EACxB,iCAAiC,EACjC,IAAI,CACL;QACD,oBAAoB,EAAE,eAAe,CACnC,GAAG,CAAC,4BAA4B,EAChC,2DAA8B,EAC9B,8BAA8B,EAC9B,IAAI,CACL;QACD,qBAAqB,EAAE,eAAe,CACpC,GAAG,CAAC,6BAA6B,EACjC,+CAA+B,EAC/B,+BAA+B,EAC/B,IAAI,CACL;QACD,wBAAwB,EAAE,mDAAmC;QAC7D,2BAA2B,EAAE,eAAe,CAC1C,GAAG,CAAC,oCAAoC,EACxC,sDAAsC,EACtC,sCAAsC,EACtC,IAAI,CACL;KACF,CAAC;AACJ,CAAC"}
|
|
@@ -58,7 +58,7 @@ function createConnectionsHandlers(deps) {
|
|
|
58
58
|
const view = {
|
|
59
59
|
grantId: grant.grant_id,
|
|
60
60
|
name: client?.name ?? grant.client_id,
|
|
61
|
-
logoUri: client ? (0, consent_controller_js_1.
|
|
61
|
+
logoUri: client ? (0, consent_controller_js_1.safeHttpsUri)(client.logoUri) : undefined,
|
|
62
62
|
monogram: client
|
|
63
63
|
? (0, consent_controller_js_1.monogramFor)(client)
|
|
64
64
|
: (([...grant.client_id].find((ch) => /[\p{L}\p{N}]/u.test(ch)) ?? '?').toUpperCase()),
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"connections-controller.js","sourceRoot":"","sources":["../src/connections-controller.ts"],"names":[],"mappings":";;;AAuHA,8DA6HC;AAcD,0DAeC;AAjRD,qCAAgF;AAIhF,mEAOiC;AACjC,yDAA6F;AAC7F,mEAAkF;AAClF,wBAAsB;AAqFtB;;;;;;GAMG;AACU,QAAA,0BAA0B,GACrC,mFAAmF;IACnF,kFAAkF;IAClF,mBAAmB,CAAC;AAEtB,8EAA8E;AAC9E,SAAS,UAAU,CAAC,GAAkB;IACpC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAAE,OAAO,EAAE,CAAC;IAC5C,OAAO,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED,SAAgB,yBAAyB,CAAC,IAA4B;IACpE,MAAM,EAAE,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;IACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,cAAc,CAAC;IACjD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,yBAAyB,CAAC;IACpE,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,0BAA0B,CAAC;IAC3E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC;IAErC,SAAS,MAAM,CAAC,GAAY;QAC1B,OAAO,GAAG,CAAC,IAAiD,CAAC;IAC/D,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,UAAU,SAAS,CAAC,KAAuB;QAC9C,IAAI,CAAC;YACH,OAAO,MAAM,cAAc,CAAC,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,GAAY,EAAE,KAAuB;QACzD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,IAAI,GAAmB;YAC3B,OAAO,EAAE,KAAK,CAAC,QAAQ;YACvB,IAAI,EAAE,MAAM,EAAE,IAAI,IAAI,KAAK,CAAC,SAAS;YACrC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,IAAA,
|
|
1
|
+
{"version":3,"file":"connections-controller.js","sourceRoot":"","sources":["../src/connections-controller.ts"],"names":[],"mappings":";;;AAuHA,8DA6HC;AAcD,0DAeC;AAjRD,qCAAgF;AAIhF,mEAOiC;AACjC,yDAA6F;AAC7F,mEAAkF;AAClF,wBAAsB;AAqFtB;;;;;;GAMG;AACU,QAAA,0BAA0B,GACrC,mFAAmF;IACnF,kFAAkF;IAClF,mBAAmB,CAAC;AAEtB,8EAA8E;AAC9E,SAAS,UAAU,CAAC,GAAkB;IACpC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAAE,OAAO,EAAE,CAAC;IAC5C,OAAO,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED,SAAgB,yBAAyB,CAAC,IAA4B;IACpE,MAAM,EAAE,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;IACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,cAAc,CAAC;IACjD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,yBAAyB,CAAC;IACpE,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,0BAA0B,CAAC;IAC3E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC;IAErC,SAAS,MAAM,CAAC,GAAY;QAC1B,OAAO,GAAG,CAAC,IAAiD,CAAC;IAC/D,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,UAAU,SAAS,CAAC,KAAuB;QAC9C,IAAI,CAAC;YACH,OAAO,MAAM,cAAc,CAAC,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,GAAY,EAAE,KAAuB;QACzD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,IAAI,GAAmB;YAC3B,OAAO,EAAE,KAAK,CAAC,QAAQ;YACvB,IAAI,EAAE,MAAM,EAAE,IAAI,IAAI,KAAK,CAAC,SAAS;YACrC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,IAAA,oCAAY,EAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;YAC1D,QAAQ,EAAE,MAAM;gBACd,CAAC,CAAC,IAAA,mCAAW,EAAC,MAAM,CAAC;gBACrB,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;YACxF,UAAU,EAAE,MAAM;gBAChB,CAAC,CAAC,IAAA,qCAAa,EAAC,MAAM,CAAC;gBACvB,CAAC,CAAC,gDAAgD;YACpD,IAAI,EAAE,MAAM,EAAE,IAAI;YAClB,MAAM,EAAE,IAAA,oCAAY,EAAC,KAAK,CAAC,MAAM,EAAE,IAAA,6CAAqB,EAAC,GAAG,CAAC,CAAC;YAC9D,WAAW,EAAE,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC;YACzC,cAAc,EAAE,GAAG,QAAQ,IAAI,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa;SAC/E,CAAC;QACF,IAAI,CAAC,IAAA,gCAAa,EAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACjD,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,YAAY,IAAI,SAAS,CAAC;QACrD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,eAAe,GAAmB,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC/D,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,EAAE,CAAC;QAEzB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAChD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CACjC,MAAM,CAAC,MAAM,CAAC,gCAAa,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAChE,CAAC;YACF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAA,gCAAa,EAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CACnF,CAAC;YAEF,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE;gBACvB,MAAM;gBACN,SAAS;gBACT,QAAQ;gBACR,YAAY,EAAE,SAAS,CAAC,MAAM,GAAG,CAAC;gBAClC,WAAW,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC;gBAChC,QAAQ,EAAE,kCAA0B;gBACpC,qEAAqE;gBACrE,sEAAsE;gBACtE,4BAA4B;gBAC5B,YAAY,EAAE,OAAO,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;aAC9F,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,cAAc,GAAmB,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC9D,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,EAAE,CAAC;QAEzB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;YAC/E,sEAAsE;YACtE,kEAAkE;YAClE,IAAI,CAAC,KAAK,IAAI,CAAC,IAAA,gCAAa,EAAC,KAAK,CAAC;gBAAE,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAExE,GAAG,CAAC,MAAM,CAAC,eAAe,EAAE;gBAC1B,MAAM;gBACN,UAAU,EAAE,MAAM,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC;gBACpC,QAAQ,EAAE,kCAA0B;gBACpC,MAAM,EAAE,GAAG,QAAQ,IAAI,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa;gBACtE,UAAU,EAAE,QAAQ;aACrB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,gBAAgB,GAAmB,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAChE,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,EAAE,CAAC;QAEzB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,WAAW,CACjD,IAAI,CAAC,EAAE,EACP,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAC1B,uCAAe,CAChB,CAAC;YACF,IAAI,CAAC,OAAO;gBAAE,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAEjD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC9C,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;YACrD,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,QAAQ,iBAAiB,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;IAEF,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,gBAAgB,EAAE,CAAC;AAC/D,CAAC;AAMD;;;;;;;GAOG;AACH,SAAgB,uBAAuB,CAAC,OAAiC;IACvE,MAAM,QAAQ,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,cAAc,CAAC;IACpD,MAAM,MAAM,GAAG,IAAA,gBAAM,GAAE,CAAC;IAExB,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,aAAa,EAAE,QAAQ,CAAC,eAAe,CAAC,CAAC;IACtE,MAAM,CAAC,GAAG,CAAC,GAAG,QAAQ,sBAAsB,EAAE,OAAO,CAAC,aAAa,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC;IAC9F,MAAM,CAAC,IAAI,CACT,GAAG,QAAQ,sBAAsB,EACjC,OAAO,CAAC,aAAa,EACrB,IAAA,oBAAU,EAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,IAAI,MAAM,EAAE,CAAC,EACnE,QAAQ,CAAC,gBAAgB,CAC1B,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC"}
|
|
@@ -2,6 +2,7 @@ import { Router, type Request, type RequestHandler, type Response } from 'expres
|
|
|
2
2
|
import type { BaseUserInfo, User } from '@boopkit/cap-users';
|
|
3
3
|
import type { AuthorizationCodeService } from './authorization-code-service.js';
|
|
4
4
|
import type { ClientRegistryService } from './client-registry-service.js';
|
|
5
|
+
import { type RateLimiterOptions } from './rate-limit.js';
|
|
5
6
|
import './express.js';
|
|
6
7
|
import type { OauthClient } from './types.js';
|
|
7
8
|
/** Which of the three faces the page is wearing. */
|
|
@@ -138,6 +139,71 @@ export interface ConsentHandlerDeps {
|
|
|
138
139
|
layout?: string;
|
|
139
140
|
/** Where the form posts. Must be the mounted path of the POST handler. */
|
|
140
141
|
actionPath?: string;
|
|
142
|
+
/**
|
|
143
|
+
* Per-address limit on **first-sight** Client ID Metadata Document
|
|
144
|
+
* resolution, or `false` to mount none.
|
|
145
|
+
*
|
|
146
|
+
* `GET /oauth/authorize` is where a CIMD client registers itself: an https
|
|
147
|
+
* `client_id` with no row yet is fetched and written, unauthenticated, with
|
|
148
|
+
* nothing else between a caller and the table. Every other abuse control the
|
|
149
|
+
* capability documents used to sit on `POST /oauth/register`, which this path
|
|
150
|
+
* does not touch — so a loop over distinct URLs wrote a row apiece and made an
|
|
151
|
+
* outbound request apiece, at whatever rate the attacker liked (boop-jd4x).
|
|
152
|
+
*
|
|
153
|
+
* A request is charged only when it is about to resolve a client that has no
|
|
154
|
+
* row. A visitor arriving for a client this server already knows never
|
|
155
|
+
* consumes any of it, which is why this can be mounted on the consent screen
|
|
156
|
+
* at all: limiting `GET /oauth/authorize` wholesale would ration the page
|
|
157
|
+
* itself, and the page is the product.
|
|
158
|
+
*
|
|
159
|
+
* `false` is for an application that limits this somewhere else. It is not a
|
|
160
|
+
* convenience.
|
|
161
|
+
*/
|
|
162
|
+
metadataRateLimit?: RateLimiterOptions | false;
|
|
163
|
+
/**
|
|
164
|
+
* Origins this application serves its own consent page from, beyond the one
|
|
165
|
+
* the request's `Host` already names.
|
|
166
|
+
*
|
|
167
|
+
* `POST /oauth/authorize` refuses a submission that came from another site —
|
|
168
|
+
* see `same-site.ts` for the attack, which is the whole reason the route has
|
|
169
|
+
* a check at all. The host the request arrived on is worked out from the
|
|
170
|
+
* request, so an ordinary deployment names nothing here. This list is for the
|
|
171
|
+
* one arrangement that cannot be worked out: a proxy that rewrites `Host`
|
|
172
|
+
* without setting `X-Forwarded-Host`, or a page deliberately served from a
|
|
173
|
+
* sibling origin. Every entry widens what counts as this application, so it
|
|
174
|
+
* is the application's decision and not a default.
|
|
175
|
+
*/
|
|
176
|
+
allowedOrigins?: string[];
|
|
177
|
+
/**
|
|
178
|
+
* Force `Secure` on the session cookie the inline login sets.
|
|
179
|
+
*
|
|
180
|
+
* Default: on when `NODE_ENV === 'production'`, which is the same rule
|
|
181
|
+
* cap-oauth-client's sign-in flow uses. Off in development, or a boop
|
|
182
|
+
* application served over http at `localhost` could never sign anybody in.
|
|
183
|
+
*/
|
|
184
|
+
secureCookie?: boolean;
|
|
185
|
+
/**
|
|
186
|
+
* `SameSite` on that cookie. Default `lax`, and that default is load-bearing.
|
|
187
|
+
*
|
|
188
|
+
* `strict` is what an authorization endpoint's own POST would want, and it is
|
|
189
|
+
* the wrong answer for this cookie: the consent screen is *reached* by a
|
|
190
|
+
* cross-site top-level navigation — an OAuth client sends the browser here —
|
|
191
|
+
* and `strict` withholds the cookie on exactly that hop, so every
|
|
192
|
+
* authorization would meet a login form for somebody who is already signed
|
|
193
|
+
* in. `lax` refuses the cross-site POST, which is the request a forgery
|
|
194
|
+
* needs, and permits the arrival, which is the request the flow needs.
|
|
195
|
+
*/
|
|
196
|
+
cookieSameSite?: 'lax' | 'strict' | 'none';
|
|
197
|
+
/**
|
|
198
|
+
* Where this page's operator-facing lines go. Defaults to `console.warn`.
|
|
199
|
+
*
|
|
200
|
+
* Two things are said through it, and neither is ever said to the visitor:
|
|
201
|
+
* the boot warning naming scopes the application has not described, and the
|
|
202
|
+
* reason a Client ID Metadata Document could not be resolved. The second is
|
|
203
|
+
* why this sits on the handlers and not only on the router factory — see
|
|
204
|
+
* `resolveTarget`.
|
|
205
|
+
*/
|
|
206
|
+
warn?(message: string): void;
|
|
141
207
|
}
|
|
142
208
|
/**
|
|
143
209
|
* The application's scope vocabulary, as published on `app.locals`.
|
|
@@ -186,14 +252,24 @@ export declare function warnUndescribedScopes(scopesSupported: readonly string[]
|
|
|
186
252
|
/** What the page says about where this client's claims came from. */
|
|
187
253
|
export declare function provenanceFor(client: OauthClient): string;
|
|
188
254
|
/**
|
|
189
|
-
*
|
|
255
|
+
* A stranger's URL we are willing to put in the page — an `<img src>` or an
|
|
256
|
+
* `<a href>` — or nothing.
|
|
190
257
|
*
|
|
191
258
|
* `https` only. `http` would break the page's padlock, and `data:` and
|
|
192
259
|
* `javascript:` are a stranger's payload rendered inside our own origin's page.
|
|
193
|
-
*
|
|
194
|
-
*
|
|
260
|
+
* Template escaping is no help here: Handlebars escapes `<`, `>`, `&`, `"` and
|
|
261
|
+
* `'` and leaves `:` alone, so a scheme survives it intact and has to be judged
|
|
262
|
+
* rather than escaped.
|
|
263
|
+
*
|
|
264
|
+
* All four of the client's display URIs go through this — `logo_uri`,
|
|
265
|
+
* `client_uri`, `policy_uri` and `tos_uri`. Registration refuses a non-https
|
|
266
|
+
* value on the three paths a stranger writes through, which is where a
|
|
267
|
+
* registrant gets told; this runs anyway, because a row written before that
|
|
268
|
+
* rule existed is still rendered on the page. For the logo specifically, the
|
|
269
|
+
* box's size is fixed in CSS regardless, so this decides only whether there is
|
|
270
|
+
* an image at all — never how much room it gets.
|
|
195
271
|
*/
|
|
196
|
-
export declare function
|
|
272
|
+
export declare function safeHttpsUri(value: string | null | undefined): string | undefined;
|
|
197
273
|
/** The letter in the icon box when there is no usable image. */
|
|
198
274
|
export declare function monogramFor(client: OauthClient): string;
|
|
199
275
|
export interface ConsentHandlers {
|
|
@@ -202,8 +278,6 @@ export interface ConsentHandlers {
|
|
|
202
278
|
}
|
|
203
279
|
export declare function createConsentHandlers(deps: ConsentHandlerDeps): ConsentHandlers;
|
|
204
280
|
export interface ConsentRouterOptions extends ConsentHandlerDeps {
|
|
205
|
-
/** Where the undescribed-scope warning goes. Defaults to `console.warn`. */
|
|
206
|
-
warn?(message: string): void;
|
|
207
281
|
bodyLimit?: string;
|
|
208
282
|
}
|
|
209
283
|
/**
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"consent-controller.d.ts","sourceRoot":"","sources":["../src/consent-controller.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAc,KAAK,OAAO,EAAE,KAAK,cAAc,EAAE,KAAK,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC/F,OAAO,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAE7D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAG1E,OAAO,cAAc,CAAC;AACtB,OAAO,KAAK,EAAc,WAAW,EAAE,MAAM,YAAY,CAAC;
|
|
1
|
+
{"version":3,"file":"consent-controller.d.ts","sourceRoot":"","sources":["../src/consent-controller.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAc,KAAK,OAAO,EAAE,KAAK,cAAc,EAAE,KAAK,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC/F,OAAO,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAE7D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAG1E,OAAO,EAIL,KAAK,kBAAkB,EACxB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,cAAc,CAAC;AACtB,OAAO,KAAK,EAAc,WAAW,EAAE,MAAM,YAAY,CAAC;AA6E1D,oDAAoD;AACpD,MAAM,MAAM,cAAc,GAAG,eAAe,GAAG,OAAO,GAAG,QAAQ,CAAC;AAElE,yEAAyE;AACzE,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,uEAAuE;AACvE,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,0EAA0E;AAC1E,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,WAAW,EAAE,kBAAkB,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;AACzF,MAAM,MAAM,eAAe,GAAG,CAAC,YAAY,EAAE,mBAAmB,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;AAE7F;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,KAAK,OAAO,CAAC;AAEvE;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,EAAE,eAG/B,CAAC;AAEF,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,qBAAqB,CAAC;IACtC,wBAAwB,EAAE,wBAAwB,CAAC;IACnD;;;;OAIG;IACH,MAAM,EAAE,aAAa,CAAC;IACtB,4EAA4E;IAC5E,QAAQ,EAAE,eAAe,CAAC;IAC1B;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,oEAAoE;IACpE,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,iBAAiB,CAAC,EAAE,kBAAkB,GAAG,KAAK,CAAC;IAC/C;;;;;;;;;;;;OAYG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IAC3C;;;;;;;;OAQG;IACH,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAEvD,eAAO,MAAM,wBAAwB,2BAA2B,CAAC;AAEjE;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,SAAS,MAAM,EAAE,EACzB,YAAY,EAAE,iBAAiB,GAAG,SAAS,GAC1C,gBAAgB,EAAE,CAMpB;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,OAAO,EACZ,QAAQ,CAAC,EAAE,iBAAiB,GAC3B,iBAAiB,GAAG,SAAS,CAK/B;AAED,uCAAuC;AACvC,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CACnC,eAAe,EAAE,SAAS,MAAM,EAAE,EAClC,YAAY,EAAE,iBAAiB,GAAG,SAAS,EAC3C,IAAI,GAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAiE,GAC3F,MAAM,EAAE,CAYV;AAED,qEAAqE;AACrE,wBAAgB,aAAa,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAezD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAQjF;AAED,gEAAgE;AAChE,wBAAgB,WAAW,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAWvD;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,cAAc,CAAC;IAC5B,aAAa,EAAE,cAAc,CAAC;CAC/B;AAqDD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,kBAAkB,GAAG,eAAe,CAwa/E;AAED,MAAM,WAAW,oBAAqB,SAAQ,kBAAkB;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,oBAAoB,GAAG,MAAM,CAyBzE"}
|
|
@@ -5,13 +5,16 @@ exports.toScopeViews = toScopeViews;
|
|
|
5
5
|
exports.scopeDescriptionsFrom = scopeDescriptionsFrom;
|
|
6
6
|
exports.warnUndescribedScopes = warnUndescribedScopes;
|
|
7
7
|
exports.provenanceFor = provenanceFor;
|
|
8
|
-
exports.
|
|
8
|
+
exports.safeHttpsUri = safeHttpsUri;
|
|
9
9
|
exports.monogramFor = monogramFor;
|
|
10
10
|
exports.createConsentHandlers = createConsentHandlers;
|
|
11
11
|
exports.createConsentRouter = createConsentRouter;
|
|
12
12
|
const express_1 = require("express");
|
|
13
|
+
const errors_js_1 = require("./errors.js");
|
|
13
14
|
const pkce_js_1 = require("./pkce.js");
|
|
15
|
+
const rate_limit_js_1 = require("./rate-limit.js");
|
|
14
16
|
const redirect_uri_js_1 = require("./redirect-uri.js");
|
|
17
|
+
const same_site_js_1 = require("./same-site.js");
|
|
15
18
|
require("./express.js");
|
|
16
19
|
/**
|
|
17
20
|
* `GET` and `POST /oauth/authorize` — the consent screen.
|
|
@@ -65,6 +68,16 @@ require("./express.js");
|
|
|
65
68
|
* somebody to approve a string they cannot evaluate is asking a question they
|
|
66
69
|
* are not prepared to answer.
|
|
67
70
|
*
|
|
71
|
+
* ## The form defends itself
|
|
72
|
+
*
|
|
73
|
+
* `POST /oauth/authorize` is a state-changing form post whose only credential
|
|
74
|
+
* is a cookie the browser attaches unprompted, so it is a cross-site request
|
|
75
|
+
* forgery target — and neither PKCE nor `state` covers it, because on that
|
|
76
|
+
* attack the attacker is the client. The handler refuses any submission whose
|
|
77
|
+
* `Origin` or `Sec-Fetch-Site` says it came from elsewhere, and the session
|
|
78
|
+
* cookie this page writes is labelled `SameSite` and `Secure` rather than
|
|
79
|
+
* leaning on a browser default. `same-site.ts` has the reasoning.
|
|
80
|
+
*
|
|
68
81
|
* ## And the coverage statement
|
|
69
82
|
*
|
|
70
83
|
* The settled data model keys the grant on the *user*, so a client reaches
|
|
@@ -160,14 +173,24 @@ function provenanceFor(client) {
|
|
|
160
173
|
return 'This application registered itself. Nothing about it has been verified.';
|
|
161
174
|
}
|
|
162
175
|
/**
|
|
163
|
-
*
|
|
176
|
+
* A stranger's URL we are willing to put in the page — an `<img src>` or an
|
|
177
|
+
* `<a href>` — or nothing.
|
|
164
178
|
*
|
|
165
179
|
* `https` only. `http` would break the page's padlock, and `data:` and
|
|
166
180
|
* `javascript:` are a stranger's payload rendered inside our own origin's page.
|
|
167
|
-
*
|
|
168
|
-
*
|
|
181
|
+
* Template escaping is no help here: Handlebars escapes `<`, `>`, `&`, `"` and
|
|
182
|
+
* `'` and leaves `:` alone, so a scheme survives it intact and has to be judged
|
|
183
|
+
* rather than escaped.
|
|
184
|
+
*
|
|
185
|
+
* All four of the client's display URIs go through this — `logo_uri`,
|
|
186
|
+
* `client_uri`, `policy_uri` and `tos_uri`. Registration refuses a non-https
|
|
187
|
+
* value on the three paths a stranger writes through, which is where a
|
|
188
|
+
* registrant gets told; this runs anyway, because a row written before that
|
|
189
|
+
* rule existed is still rendered on the page. For the logo specifically, the
|
|
190
|
+
* box's size is fixed in CSS regardless, so this decides only whether there is
|
|
191
|
+
* an image at all — never how much room it gets.
|
|
169
192
|
*/
|
|
170
|
-
function
|
|
193
|
+
function safeHttpsUri(value) {
|
|
171
194
|
if (typeof value !== 'string' || value.trim() === '')
|
|
172
195
|
return undefined;
|
|
173
196
|
try {
|
|
@@ -195,10 +218,11 @@ function monogramFor(client) {
|
|
|
195
218
|
}
|
|
196
219
|
/** Errors that must be shown on our own page, because we cannot redirect yet. */
|
|
197
220
|
class ConsentRequestError extends Error {
|
|
198
|
-
constructor(message, status = 400) {
|
|
221
|
+
constructor(message, status = 400, retryAfterSeconds) {
|
|
199
222
|
super(message);
|
|
200
223
|
this.name = 'ConsentRequestError';
|
|
201
224
|
this.status = status;
|
|
225
|
+
this.retryAfterSeconds = retryAfterSeconds;
|
|
202
226
|
}
|
|
203
227
|
}
|
|
204
228
|
/** Errors that RFC 6749 §4.1.2.1 says go back to the client as a redirect. */
|
|
@@ -218,6 +242,18 @@ function first(value) {
|
|
|
218
242
|
// `redirect_uri` is not a request we should try to interpret.
|
|
219
243
|
return undefined;
|
|
220
244
|
}
|
|
245
|
+
/**
|
|
246
|
+
* One line, whatever the caller put in the `client_id`.
|
|
247
|
+
*
|
|
248
|
+
* The `client_id` is a query parameter and reaches the log twice — once from
|
|
249
|
+
* here and once inside the registry's own message — so a caller who sends
|
|
250
|
+
* `%0A` writes a second line into the operator's log and can shape it. A log
|
|
251
|
+
* an attacker can write sentences in is worth less than no log, and this
|
|
252
|
+
* refusal line exists precisely to be read (boop-nvbd).
|
|
253
|
+
*/
|
|
254
|
+
function oneLine(text) {
|
|
255
|
+
return text.replace(/[\r\n\u2028\u2029]+/g, ' ');
|
|
256
|
+
}
|
|
221
257
|
function parseScopeList(raw) {
|
|
222
258
|
if (!raw)
|
|
223
259
|
return [];
|
|
@@ -226,9 +262,21 @@ function parseScopeList(raw) {
|
|
|
226
262
|
function createConsentHandlers(deps) {
|
|
227
263
|
const { clientRegistry, authorizationCodeService, signIn, register, scopesSupported } = deps;
|
|
228
264
|
const isSignedIn = deps.isSignedIn ?? exports.defaultIsSignedIn;
|
|
265
|
+
const metadataLimiter = deps.metadataRateLimit === false
|
|
266
|
+
? null
|
|
267
|
+
: (0, rate_limit_js_1.createFixedWindowRateLimiter)({
|
|
268
|
+
limit: rate_limit_js_1.DEFAULT_METADATA_RESOLUTION_RATE_LIMIT,
|
|
269
|
+
...deps.metadataRateLimit,
|
|
270
|
+
});
|
|
229
271
|
const viewName = deps.viewName ?? 'oauth-consent';
|
|
230
272
|
const layout = deps.layout ?? 'main';
|
|
231
273
|
const actionPath = deps.actionPath ?? '/oauth/authorize';
|
|
274
|
+
const allowedOrigins = deps.allowedOrigins ?? [];
|
|
275
|
+
const cookieSameSite = deps.cookieSameSite ?? 'lax';
|
|
276
|
+
// Read per request rather than captured, so a test or a boot sequence that
|
|
277
|
+
// sets NODE_ENV after this router is built still gets the right answer.
|
|
278
|
+
const secureCookie = () => deps.secureCookie ?? process.env.NODE_ENV === 'production';
|
|
279
|
+
const warn = deps.warn ?? ((message) => console.warn(`[cap-oauth-server] ${message}`));
|
|
232
280
|
/**
|
|
233
281
|
* Resolve the client and the redirect URI *before* anything else is judged.
|
|
234
282
|
*
|
|
@@ -238,7 +286,7 @@ function createConsentHandlers(deps) {
|
|
|
238
286
|
* failure goes back to the client as a redirect, because a client left with
|
|
239
287
|
* no answer hangs until its own timeout while the user believes they are done.
|
|
240
288
|
*/
|
|
241
|
-
async function resolveTarget(source) {
|
|
289
|
+
async function resolveTarget(req, source) {
|
|
242
290
|
const clientId = first(source.client_id);
|
|
243
291
|
if (!clientId)
|
|
244
292
|
throw new ConsentRequestError('client_id is required');
|
|
@@ -247,15 +295,48 @@ function createConsentHandlers(deps) {
|
|
|
247
295
|
// A Client ID Metadata Document client is allowed to arrive unseen: the
|
|
248
296
|
// document at its own URL is its registration. A fetch failure here is a
|
|
249
297
|
// refusal rather than a 500, because the URL was supplied by the caller.
|
|
298
|
+
//
|
|
299
|
+
// This branch is the whole unauthenticated write, so the limit is charged
|
|
300
|
+
// here rather than on the route: only a request that reaches this line is
|
|
301
|
+
// about to create a row and make an outbound request.
|
|
302
|
+
if (metadataLimiter) {
|
|
303
|
+
const verdict = metadataLimiter.check((0, rate_limit_js_1.rateLimitAddress)(req));
|
|
304
|
+
if (!verdict.allowed) {
|
|
305
|
+
throw new ConsentRequestError('too many unrecognised client_id lookups from this address; please try again later', 429, verdict.retryAfterSeconds);
|
|
306
|
+
}
|
|
307
|
+
}
|
|
250
308
|
try {
|
|
251
309
|
client = await clientRegistry.resolveMetadataDocument(clientId);
|
|
252
310
|
}
|
|
253
|
-
catch {
|
|
254
|
-
|
|
311
|
+
catch (err) {
|
|
312
|
+
// A registry refusal is the caller's problem and is answered on our own
|
|
313
|
+
// page; anything else — a store that is not there, a bug in here — is
|
|
314
|
+
// ours, and saying "unknown client_id" about it sends an operator to
|
|
315
|
+
// read a request when the answer is in the database.
|
|
316
|
+
if (!(0, errors_js_1.isClientRegistryError)(err))
|
|
317
|
+
throw err;
|
|
318
|
+
// The reason, in the registry's own words, once. Five different
|
|
319
|
+
// problems used to reach the operator as one sentence naming a
|
|
320
|
+
// condition that was not true: the `client_id` had been fetched and
|
|
321
|
+
// validated moments earlier, and the only thing the log said about it
|
|
322
|
+
// was that it was unknown (boop-nvbd).
|
|
323
|
+
warn(oneLine(`consent refused: could not resolve the Client ID Metadata Document at ` +
|
|
324
|
+
`${clientId} — ${err.code}: ${err.message}`));
|
|
325
|
+
// The page gets one sentence, and a different one — the log and the
|
|
326
|
+
// page do not have to carry the same words. It is not an enumeration
|
|
327
|
+
// oracle either: this branch is reached only for an https `client_id`
|
|
328
|
+
// with no row, so the caller learns nothing about the registry that
|
|
329
|
+
// their own URL did not already tell them.
|
|
330
|
+
throw new ConsentRequestError('the metadata document for this client_id could not be used');
|
|
255
331
|
}
|
|
256
332
|
}
|
|
257
333
|
if (!client)
|
|
258
334
|
throw new ConsentRequestError('unknown client_id');
|
|
335
|
+
// Suspension is named rather than folded into `unknown client_id`, and 403
|
|
336
|
+
// rather than 400: the row is there and in order, and we are declining it.
|
|
337
|
+
// The view's own comment carries why that is not the enumeration oracle it
|
|
338
|
+
// resembles (boop-wwxg); the back channel says the same sentence for the
|
|
339
|
+
// same reason, in `resolveRequestClient`.
|
|
259
340
|
if (client.status !== 'enabled')
|
|
260
341
|
throw new ConsentRequestError('this client is suspended', 403);
|
|
261
342
|
const redirectUri = first(source.redirect_uri);
|
|
@@ -294,11 +375,21 @@ function createConsentHandlers(deps) {
|
|
|
294
375
|
if (disallowed.length > 0) {
|
|
295
376
|
throw new RedirectableError('invalid_scope', `this client is not registered for: ${disallowed.join(' ')}`);
|
|
296
377
|
}
|
|
378
|
+
// The fallback is the one path neither check above covers: both read the
|
|
379
|
+
// *requested* list, so on a request that omits `scope` both pass vacuously
|
|
380
|
+
// and the client's own registered list is what gets granted. That list was
|
|
381
|
+
// written by whoever registered the client, so it is bounded here too —
|
|
382
|
+
// otherwise the server issues a scope its discovery document does not
|
|
383
|
+
// advertise, and the user is asked to approve a word nothing describes.
|
|
384
|
+
const granted = scopes.length > 0 ? scopes : clientScopes.filter((scope) => scopesSupported.includes(scope));
|
|
385
|
+
if (clientScopes.length > 0 && granted.length === 0) {
|
|
386
|
+
throw new RedirectableError('invalid_scope', 'this client is not registered for any scope this server advertises');
|
|
387
|
+
}
|
|
297
388
|
return {
|
|
298
389
|
responseType,
|
|
299
390
|
clientId: client.clientId,
|
|
300
391
|
redirectUri: first(source.redirect_uri),
|
|
301
|
-
scopes:
|
|
392
|
+
scopes: granted,
|
|
302
393
|
state: first(source.state),
|
|
303
394
|
codeChallenge,
|
|
304
395
|
codeChallengeMethod,
|
|
@@ -344,10 +435,10 @@ function createConsentHandlers(deps) {
|
|
|
344
435
|
client: {
|
|
345
436
|
name: client.name ?? client.clientId,
|
|
346
437
|
description: client.description ?? undefined,
|
|
347
|
-
clientUri: client.clientUri
|
|
348
|
-
policyUri: client.policyUri
|
|
349
|
-
tosUri: client.tosUri
|
|
350
|
-
logoUri:
|
|
438
|
+
clientUri: safeHttpsUri(client.clientUri),
|
|
439
|
+
policyUri: safeHttpsUri(client.policyUri),
|
|
440
|
+
tosUri: safeHttpsUri(client.tosUri),
|
|
441
|
+
logoUri: safeHttpsUri(client.logoUri),
|
|
351
442
|
monogram: monogramFor(client),
|
|
352
443
|
provenance: provenanceFor(client),
|
|
353
444
|
mode: client.mode,
|
|
@@ -364,6 +455,9 @@ function createConsentHandlers(deps) {
|
|
|
364
455
|
function reportConsentError(res, err) {
|
|
365
456
|
// Our own page, because there is nowhere safe to send the caller. Rendered
|
|
366
457
|
// rather than JSON: whoever is looking at this is a person in a browser.
|
|
458
|
+
if (err.retryAfterSeconds !== undefined) {
|
|
459
|
+
res.setHeader('Retry-After', String(err.retryAfterSeconds));
|
|
460
|
+
}
|
|
367
461
|
res.status(err.status).render('oauth-consent-error', {
|
|
368
462
|
layout,
|
|
369
463
|
errorMessage: err.message,
|
|
@@ -372,7 +466,7 @@ function createConsentHandlers(deps) {
|
|
|
372
466
|
const showConsent = async (req, res, next) => {
|
|
373
467
|
let target;
|
|
374
468
|
try {
|
|
375
|
-
target = await resolveTarget(req.query);
|
|
469
|
+
target = await resolveTarget(req, req.query);
|
|
376
470
|
}
|
|
377
471
|
catch (err) {
|
|
378
472
|
if (err instanceof ConsentRequestError)
|
|
@@ -395,10 +489,24 @@ function createConsentHandlers(deps) {
|
|
|
395
489
|
}
|
|
396
490
|
};
|
|
397
491
|
const submitConsent = async (req, res, next) => {
|
|
492
|
+
// Before anything is parsed, and before the client is even looked up: a
|
|
493
|
+
// submission that did not come from a page this server served is not a
|
|
494
|
+
// decision anybody made. Every action on this route changes state — approve
|
|
495
|
+
// mints a code, login mints a session and sets a cookie — so the check is
|
|
496
|
+
// on the route rather than on the approve branch.
|
|
497
|
+
//
|
|
498
|
+
// Refused on our own page and never as a redirect. There is no registered
|
|
499
|
+
// redirect URI yet, and once there is, redirecting to it would hand the
|
|
500
|
+
// attacker who registered it a signal that the victim's browser reached
|
|
501
|
+
// here. See `same-site.ts` for what is being defended against and why
|
|
502
|
+
// neither PKCE nor `state` covers it.
|
|
503
|
+
if (!(0, same_site_js_1.isSameSiteRequest)(req, allowedOrigins)) {
|
|
504
|
+
return reportConsentError(res, new ConsentRequestError('this form was submitted from another site, so it was not acted on', 403));
|
|
505
|
+
}
|
|
398
506
|
const body = (req.body ?? {});
|
|
399
507
|
let target;
|
|
400
508
|
try {
|
|
401
|
-
target = await resolveTarget(body);
|
|
509
|
+
target = await resolveTarget(req, body);
|
|
402
510
|
}
|
|
403
511
|
catch (err) {
|
|
404
512
|
if (err instanceof ConsentRequestError)
|
|
@@ -460,7 +568,12 @@ function createConsentHandlers(deps) {
|
|
|
460
568
|
: 'We could not create that account',
|
|
461
569
|
});
|
|
462
570
|
}
|
|
463
|
-
res.cookie(SESSION_COOKIE, sessionToken, {
|
|
571
|
+
res.cookie(SESSION_COOKIE, sessionToken, {
|
|
572
|
+
httpOnly: true,
|
|
573
|
+
sameSite: cookieSameSite,
|
|
574
|
+
secure: secureCookie(),
|
|
575
|
+
maxAge: ONE_YEAR_MS,
|
|
576
|
+
});
|
|
464
577
|
req.user = user;
|
|
465
578
|
// Signing in is not consenting. Re-render the card and require a
|
|
466
579
|
// second, explicit Approve — see the header.
|
|
@@ -493,7 +606,10 @@ function createConsentHandlers(deps) {
|
|
|
493
606
|
resource: request.resource ?? null,
|
|
494
607
|
});
|
|
495
608
|
// `state` is echoed exactly as it arrived and is never interpreted. It is
|
|
496
|
-
// the client's CSRF token, not ours
|
|
609
|
+
// the client's CSRF token, not ours — this form's own defence is the
|
|
610
|
+
// same-site check at the top of this handler and the `SameSite` attribute
|
|
611
|
+
// on the cookie, because on a forgery of *this* form the attacker is the
|
|
612
|
+
// client and chose the `state` themselves.
|
|
497
613
|
return redirectTo(res, request.redirectUri, { code, state: request.state });
|
|
498
614
|
}
|
|
499
615
|
catch (err) {
|