@budibase/backend-core 2.9.39-alpha.0 → 2.9.39-alpha.2

package/dist/src/middleware/passport/sso/oidc.js

@@ -0,0 +1,135 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var oidc_exports = {};
+__export(oidc_exports, {
+  buildVerifyFn: () => buildVerifyFn,
+  fetchStrategyConfig: () => fetchStrategyConfig,
+  getCallbackUrl: () => getCallbackUrl,
+  strategyFactory: () => strategyFactory
+});
+module.exports = __toCommonJS(oidc_exports);
+var import_node_fetch = __toESM(require("node-fetch"));
+var sso = __toESM(require("./sso"));
+var import_utils = require("../utils");
+var import_utils2 = require("../../../utils");
+var import_types = require("@budibase/types");
+const OIDCStrategy = require("@techpass/passport-openidconnect").Strategy;
+function buildVerifyFn(saveUserFn) {
+  return async (issuer, sub, profile, jwtClaims, accessToken, refreshToken, idToken, params, done) => {
+    const details = {
+      // store the issuer info to enable sync in future
+      provider: issuer,
+      providerType: import_types.SSOProviderType.OIDC,
+      userId: profile.id,
+      profile,
+      email: getEmail(profile, jwtClaims),
+      oauth2: {
+        accessToken,
+        refreshToken
+      }
+    };
+    return sso.authenticate(
+      details,
+      false,
+      // don't require local accounts to exist
+      done,
+      saveUserFn
+    );
+  };
+}
+function getEmail(profile, jwtClaims) {
+  if (profile._json.email) {
+    return profile._json.email;
+  }
+  if (jwtClaims.email) {
+    return jwtClaims.email;
+  }
+  const username = jwtClaims.preferred_username;
+  if (username && (0, import_utils2.validEmail)(username)) {
+    return username;
+  }
+  throw new Error(
+    `Could not determine user email from profile ${JSON.stringify(
+      profile
+    )} and claims ${JSON.stringify(jwtClaims)}`
+  );
+}
+async function strategyFactory(config, saveUserFn) {
+  try {
+    const verify = buildVerifyFn(saveUserFn);
+    const strategy = new OIDCStrategy(config, verify);
+    strategy.name = "oidc";
+    return strategy;
+  } catch (err) {
+    console.error(err);
+    throw new Error(`Error constructing OIDC authentication strategy - ${err}`);
+  }
+}
+async function fetchStrategyConfig(oidcConfig, callbackUrl) {
+  try {
+    const { clientID, clientSecret, configUrl } = oidcConfig;
+    if (!clientID || !clientSecret || !callbackUrl || !configUrl) {
+      throw new Error(
+        "Configuration invalid. Must contain clientID, clientSecret, callbackUrl and configUrl"
+      );
+    }
+    const response = await (0, import_node_fetch.default)(configUrl);
+    if (!response.ok) {
+      throw new Error(
+        `Unexpected response when fetching openid-configuration: ${response.statusText}`
+      );
+    }
+    const body = await response.json();
+    return {
+      issuer: body.issuer,
+      authorizationURL: body.authorization_endpoint,
+      tokenURL: body.token_endpoint,
+      userInfoURL: body.userinfo_endpoint,
+      clientID,
+      clientSecret,
+      callbackURL: callbackUrl
+    };
+  } catch (err) {
+    console.error(err);
+    throw new Error(
+      `Error constructing OIDC authentication configuration - ${err}`
+    );
+  }
+}
+async function getCallbackUrl() {
+  return (0, import_utils.ssoCallbackUrl)(import_types.ConfigType.OIDC);
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  buildVerifyFn,
+  fetchStrategyConfig,
+  getCallbackUrl,
+  strategyFactory
+});
+//# sourceMappingURL=oidc.js.map

package/dist/src/middleware/passport/sso/oidc.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/middleware/passport/sso/oidc.ts"],
+  "sourcesContent": ["import fetch from \"node-fetch\"\nimport * as sso from \"./sso\"\nimport { ssoCallbackUrl } from \"../utils\"\nimport { validEmail } from \"../../../utils\"\nimport {\n  ConfigType,\n  OIDCInnerConfig,\n  SSOProfile,\n  OIDCStrategyConfiguration,\n  SSOAuthDetails,\n  SSOProviderType,\n  JwtClaims,\n  SaveSSOUserFunction,\n} from \"@budibase/types\"\n\nconst OIDCStrategy = require(\"@techpass/passport-openidconnect\").Strategy\n\nexport function buildVerifyFn(saveUserFn: SaveSSOUserFunction) {\n  /**\n   * @param {*} issuer The identity provider base URL\n   * @param {*} sub The user ID\n   * @param {*} profile The user profile information. Created by passport from the /userinfo response\n   * @param {*} jwtClaims The parsed id_token claims\n   * @param {*} accessToken The access_token for contacting the identity provider - may or may not be a JWT\n   * @param {*} refreshToken The refresh_token for obtaining a new access_token - usually not a JWT\n   * @param {*} idToken The id_token - always a JWT\n   * @param {*} params The response body from requesting an access_token\n   * @param {*} done The passport callback: err, user, info\n   */\n  return async (\n    issuer: string,\n    sub: string,\n    profile: SSOProfile,\n    jwtClaims: JwtClaims,\n    accessToken: string,\n    refreshToken: string,\n    idToken: string,\n    params: any,\n    done: Function\n  ) => {\n    const details: SSOAuthDetails = {\n      // store the issuer info to enable sync in future\n      provider: issuer,\n      providerType: SSOProviderType.OIDC,\n      userId: profile.id,\n      profile: profile,\n      email: getEmail(profile, jwtClaims),\n      oauth2: {\n        accessToken: accessToken,\n        refreshToken: refreshToken,\n      },\n    }\n\n    return sso.authenticate(\n      details,\n      false, // don't require local accounts to exist\n      done,\n      saveUserFn\n    )\n  }\n}\n\n/**\n * @param {*} profile The structured profile created by passport using the user info endpoint\n * @param {*} jwtClaims The claims returned in the id token\n */\nfunction getEmail(profile: SSOProfile, jwtClaims: JwtClaims) {\n  // profile not guaranteed to contain email e.g. github connected azure ad account\n  if (profile._json.email) {\n    return profile._json.email\n  }\n\n  // fallback to id token email\n  if (jwtClaims.email) {\n    return jwtClaims.email\n  }\n\n  // fallback to id token preferred username\n  const username = jwtClaims.preferred_username\n  if (username && validEmail(username)) {\n    return username\n  }\n\n  throw new Error(\n    `Could not determine user email from profile ${JSON.stringify(\n      profile\n    )} and claims ${JSON.stringify(jwtClaims)}`\n  )\n}\n\n/**\n * Create an instance of the oidc passport strategy. This wrapper fetches the configuration\n * from couchDB rather than environment variables, using this factory is necessary for dynamically configuring passport.\n * @returns Dynamically configured Passport OIDC Strategy\n */\nexport async function strategyFactory(\n  config: OIDCStrategyConfiguration,\n  saveUserFn: SaveSSOUserFunction\n) {\n  try {\n    const verify = buildVerifyFn(saveUserFn)\n    const strategy = new OIDCStrategy(config, verify)\n    strategy.name = \"oidc\"\n    return strategy\n  } catch (err: any) {\n    console.error(err)\n    throw new Error(`Error constructing OIDC authentication strategy - ${err}`)\n  }\n}\n\nexport async function fetchStrategyConfig(\n  oidcConfig: OIDCInnerConfig,\n  callbackUrl?: string\n): Promise<OIDCStrategyConfiguration> {\n  try {\n    const { clientID, clientSecret, configUrl } = oidcConfig\n\n    if (!clientID || !clientSecret || !callbackUrl || !configUrl) {\n      // check for remote config and all required elements\n      throw new Error(\n        \"Configuration invalid. Must contain clientID, clientSecret, callbackUrl and configUrl\"\n      )\n    }\n\n    const response = await fetch(configUrl)\n\n    if (!response.ok) {\n      throw new Error(\n        `Unexpected response when fetching openid-configuration: ${response.statusText}`\n      )\n    }\n\n    const body = await response.json()\n\n    return {\n      issuer: body.issuer,\n      authorizationURL: body.authorization_endpoint,\n      tokenURL: body.token_endpoint,\n      userInfoURL: body.userinfo_endpoint,\n      clientID: clientID,\n      clientSecret: clientSecret,\n      callbackURL: callbackUrl,\n    }\n  } catch (err) {\n    console.error(err)\n    throw new Error(\n      `Error constructing OIDC authentication configuration - ${err}`\n    )\n  }\n}\n\nexport async function getCallbackUrl() {\n  return ssoCallbackUrl(ConfigType.OIDC)\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,wBAAkB;AAClB,UAAqB;AACrB,mBAA+B;AAC/B,IAAAA,gBAA2B;AAC3B,mBASO;AAEP,MAAM,eAAe,QAAQ,kCAAkC,EAAE;AAE1D,SAAS,cAAc,YAAiC;AAY7D,SAAO,OACL,QACA,KACA,SACA,WACA,aACA,cACA,SACA,QACA,SACG;AACH,UAAM,UAA0B;AAAA;AAAA,MAE9B,UAAU;AAAA,MACV,cAAc,6BAAgB;AAAA,MAC9B,QAAQ,QAAQ;AAAA,MAChB;AAAA,MACA,OAAO,SAAS,SAAS,SAAS;AAAA,MAClC,QAAQ;AAAA,QACN;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,WAAO,IAAI;AAAA,MACT;AAAA,MACA;AAAA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAMA,SAAS,SAAS,SAAqB,WAAsB;AAE3D,MAAI,QAAQ,MAAM,OAAO;AACvB,WAAO,QAAQ,MAAM;AAAA,EACvB;AAGA,MAAI,UAAU,OAAO;AACnB,WAAO,UAAU;AAAA,EACnB;AAGA,QAAM,WAAW,UAAU;AAC3B,MAAI,gBAAY,0BAAW,QAAQ,GAAG;AACpC,WAAO;AAAA,EACT;AAEA,QAAM,IAAI;AAAA,IACR,+CAA+C,KAAK;AAAA,MAClD;AAAA,IACF,CAAC,eAAe,KAAK,UAAU,SAAS,CAAC;AAAA,EAC3C;AACF;AAOA,eAAsB,gBACpB,QACA,YACA;AACA,MAAI;AACF,UAAM,SAAS,cAAc,UAAU;AACvC,UAAM,WAAW,IAAI,aAAa,QAAQ,MAAM;AAChD,aAAS,OAAO;AAChB,WAAO;AAAA,EACT,SAAS,KAAU;AACjB,YAAQ,MAAM,GAAG;AACjB,UAAM,IAAI,MAAM,qDAAqD,GAAG,EAAE;AAAA,EAC5E;AACF;AAEA,eAAsB,oBACpB,YACA,aACoC;AACpC,MAAI;AACF,UAAM,EAAE,UAAU,cAAc,UAAU,IAAI;AAE9C,QAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,eAAe,CAAC,WAAW;AAE5D,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,WAAW,UAAM,kBAAAC,SAAM,SAAS;AAEtC,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,2DAA2D,SAAS,UAAU;AAAA,MAChF;AAAA,IACF;AAEA,UAAM,OAAO,MAAM,SAAS,KAAK;AAEjC,WAAO;AAAA,MACL,QAAQ,KAAK;AAAA,MACb,kBAAkB,KAAK;AAAA,MACvB,UAAU,KAAK;AAAA,MACf,aAAa,KAAK;AAAA,MAClB;AAAA,MACA;AAAA,MACA,aAAa;AAAA,IACf;AAAA,EACF,SAAS,KAAK;AACZ,YAAQ,MAAM,GAAG;AACjB,UAAM,IAAI;AAAA,MACR,0DAA0D,GAAG;AAAA,IAC/D;AAAA,EACF;AACF;AAEA,eAAsB,iBAAiB;AACrC,aAAO,6BAAe,wBAAW,IAAI;AACvC;",
+  "names": ["import_utils", "fetch"]
+}

package/dist/src/middleware/passport/sso/sso.js

@@ -0,0 +1,149 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var sso_exports = {};
+__export(sso_exports, {
+  authenticate: () => authenticate,
+  ssoSaveUserNoOp: () => ssoSaveUserNoOp
+});
+module.exports = __toCommonJS(sso_exports);
+var import_db = require("../../../db");
+var import_utils = require("../utils");
+var users = __toESM(require("../../../users"));
+var context = __toESM(require("../../../context"));
+var import_node_fetch = __toESM(require("node-fetch"));
+const ssoSaveUserNoOp = (user, opts) => Promise.resolve(user);
+async function authenticate(details, requireLocalAccount = true, done, saveUserFn) {
+  if (!saveUserFn) {
+    throw new Error("Save user function must be provided");
+  }
+  if (!details.userId) {
+    return (0, import_utils.authError)(done, "sso user id required");
+  }
+  if (!details.email) {
+    return (0, import_utils.authError)(done, "sso user email required");
+  }
+  const userId = (0, import_db.generateGlobalUserID)(details.userId);
+  let dbUser;
+  try {
+    dbUser = await users.getById(userId);
+  } catch (err) {
+    if (!err.status || err.status !== 404) {
+      return (0, import_utils.authError)(
+        done,
+        "Unexpected error when retrieving existing user",
+        err
+      );
+    }
+  }
+  if (!dbUser) {
+    dbUser = await users.getGlobalUserByEmail(details.email);
+  }
+  if (!dbUser && requireLocalAccount) {
+    return (0, import_utils.authError)(
+      done,
+      "Email does not yet exist. You must set up your local budibase account first."
+    );
+  }
+  if (!dbUser) {
+    dbUser = {
+      _id: userId,
+      email: details.email,
+      roles: {},
+      tenantId: context.getTenantId()
+    };
+  }
+  let ssoUser = await syncUser(dbUser, details);
+  ssoUser.forceResetPassword = false;
+  try {
+    delete ssoUser.password;
+    ssoUser = await saveUserFn(ssoUser, {
+      hashPassword: false,
+      requirePassword: false
+    });
+  } catch (err) {
+    return (0, import_utils.authError)(done, "Error saving user", err);
+  }
+  return done(null, ssoUser);
+}
+async function getProfilePictureUrl(user, details) {
+  const pictureUrl = details.profile?._json.picture;
+  if (pictureUrl) {
+    const response = await (0, import_node_fetch.default)(pictureUrl);
+    if (response.status === 200) {
+      const type = response.headers.get("content-type");
+      if (type.startsWith("image/")) {
+        return pictureUrl;
+      }
+    }
+  }
+}
+async function syncUser(user, details) {
+  let firstName;
+  let lastName;
+  let pictureUrl;
+  let oauth2;
+  let thirdPartyProfile;
+  if (details.profile) {
+    const profile = details.profile;
+    if (profile.name) {
+      const name = profile.name;
+      if (name.givenName) {
+        firstName = name.givenName;
+      }
+      if (name.familyName) {
+        lastName = name.familyName;
+      }
+    }
+    pictureUrl = await getProfilePictureUrl(user, details);
+    thirdPartyProfile = {
+      ...profile._json
+    };
+  }
+  if (details.oauth2) {
+    oauth2 = {
+      ...details.oauth2
+    };
+  }
+  return {
+    ...user,
+    provider: details.provider,
+    providerType: details.providerType,
+    firstName,
+    lastName,
+    thirdPartyProfile,
+    pictureUrl,
+    oauth2
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  authenticate,
+  ssoSaveUserNoOp
+});
+//# sourceMappingURL=sso.js.map

package/dist/src/middleware/passport/sso/sso.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/middleware/passport/sso/sso.ts"],
+  "sourcesContent": ["import { generateGlobalUserID } from \"../../../db\"\nimport { authError } from \"../utils\"\nimport * as users from \"../../../users\"\nimport * as context from \"../../../context\"\nimport fetch from \"node-fetch\"\nimport {\n  SaveSSOUserFunction,\n  SaveUserOpts,\n  SSOAuthDetails,\n  SSOUser,\n  User,\n} from \"@budibase/types\"\n\n// no-op function for user save\n// - this allows datasource auth and access token refresh to work correctly\n// - prefer no-op over an optional argument to ensure function is provided to login flows\nexport const ssoSaveUserNoOp: SaveSSOUserFunction = (\n  user: SSOUser,\n  opts: SaveUserOpts\n) => Promise.resolve(user)\n\n/**\n * Common authentication logic for third parties. e.g. OAuth, OIDC.\n */\nexport async function authenticate(\n  details: SSOAuthDetails,\n  requireLocalAccount: boolean = true,\n  done: any,\n  saveUserFn: SaveSSOUserFunction\n) {\n  if (!saveUserFn) {\n    throw new Error(\"Save user function must be provided\")\n  }\n  if (!details.userId) {\n    return authError(done, \"sso user id required\")\n  }\n  if (!details.email) {\n    return authError(done, \"sso user email required\")\n  }\n\n  // use the third party id\n  const userId = generateGlobalUserID(details.userId)\n\n  let dbUser: User | undefined\n\n  // try to load by id\n  try {\n    dbUser = await users.getById(userId)\n  } catch (err: any) {\n    // abort when not 404 error\n    if (!err.status || err.status !== 404) {\n      return authError(\n        done,\n        \"Unexpected error when retrieving existing user\",\n        err\n      )\n    }\n  }\n\n  // fallback to loading by email\n  if (!dbUser) {\n    dbUser = await users.getGlobalUserByEmail(details.email)\n  }\n\n  // exit early if there is still no user and auto creation is disabled\n  if (!dbUser && requireLocalAccount) {\n    return authError(\n      done,\n      \"Email does not yet exist. You must set up your local budibase account first.\"\n    )\n  }\n\n  // first time creation\n  if (!dbUser) {\n    // setup a blank user using the third party id\n    dbUser = {\n      _id: userId,\n      email: details.email,\n      roles: {},\n      tenantId: context.getTenantId(),\n    }\n  }\n\n  let ssoUser = await syncUser(dbUser, details)\n  // never prompt for password reset\n  ssoUser.forceResetPassword = false\n\n  try {\n    // don't try to re-save any existing password\n    delete ssoUser.password\n    // create or sync the user\n    ssoUser = (await saveUserFn(ssoUser, {\n      hashPassword: false,\n      requirePassword: false,\n    })) as SSOUser\n  } catch (err: any) {\n    return authError(done, \"Error saving user\", err)\n  }\n\n  return done(null, ssoUser)\n}\n\nasync function getProfilePictureUrl(user: User, details: SSOAuthDetails) {\n  const pictureUrl = details.profile?._json.picture\n  if (pictureUrl) {\n    const response = await fetch(pictureUrl)\n    if (response.status === 200) {\n      const type = response.headers.get(\"content-type\") as string\n      if (type.startsWith(\"image/\")) {\n        return pictureUrl\n      }\n    }\n  }\n}\n\n/**\n * @returns a user that has been sync'd with third party information\n */\nasync function syncUser(user: User, details: SSOAuthDetails): Promise<SSOUser> {\n  let firstName\n  let lastName\n  let pictureUrl\n  let oauth2\n  let thirdPartyProfile\n\n  if (details.profile) {\n    const profile = details.profile\n\n    if (profile.name) {\n      const name = profile.name\n      // first name\n      if (name.givenName) {\n        firstName = name.givenName\n      }\n      // last name\n      if (name.familyName) {\n        lastName = name.familyName\n      }\n    }\n\n    pictureUrl = await getProfilePictureUrl(user, details)\n\n    thirdPartyProfile = {\n      ...profile._json,\n    }\n  }\n\n  // oauth tokens for future use\n  if (details.oauth2) {\n    oauth2 = {\n      ...details.oauth2,\n    }\n  }\n\n  return {\n    ...user,\n    provider: details.provider,\n    providerType: details.providerType,\n    firstName,\n    lastName,\n    thirdPartyProfile,\n    pictureUrl,\n    oauth2,\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,gBAAqC;AACrC,mBAA0B;AAC1B,YAAuB;AACvB,cAAyB;AACzB,wBAAkB;AAYX,MAAM,kBAAuC,CAClD,MACA,SACG,QAAQ,QAAQ,IAAI;AAKzB,eAAsB,aACpB,SACA,sBAA+B,MAC/B,MACA,YACA;AACA,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,MAAM,qCAAqC;AAAA,EACvD;AACA,MAAI,CAAC,QAAQ,QAAQ;AACnB,eAAO,wBAAU,MAAM,sBAAsB;AAAA,EAC/C;AACA,MAAI,CAAC,QAAQ,OAAO;AAClB,eAAO,wBAAU,MAAM,yBAAyB;AAAA,EAClD;AAGA,QAAM,aAAS,gCAAqB,QAAQ,MAAM;AAElD,MAAI;AAGJ,MAAI;AACF,aAAS,MAAM,MAAM,QAAQ,MAAM;AAAA,EACrC,SAAS,KAAU;AAEjB,QAAI,CAAC,IAAI,UAAU,IAAI,WAAW,KAAK;AACrC,iBAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAGA,MAAI,CAAC,QAAQ;AACX,aAAS,MAAM,MAAM,qBAAqB,QAAQ,KAAK;AAAA,EACzD;AAGA,MAAI,CAAC,UAAU,qBAAqB;AAClC,eAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,MAAI,CAAC,QAAQ;AAEX,aAAS;AAAA,MACP,KAAK;AAAA,MACL,OAAO,QAAQ;AAAA,MACf,OAAO,CAAC;AAAA,MACR,UAAU,QAAQ,YAAY;AAAA,IAChC;AAAA,EACF;AAEA,MAAI,UAAU,MAAM,SAAS,QAAQ,OAAO;AAE5C,UAAQ,qBAAqB;AAE7B,MAAI;AAEF,WAAO,QAAQ;AAEf,cAAW,MAAM,WAAW,SAAS;AAAA,MACnC,cAAc;AAAA,MACd,iBAAiB;AAAA,IACnB,CAAC;AAAA,EACH,SAAS,KAAU;AACjB,eAAO,wBAAU,MAAM,qBAAqB,GAAG;AAAA,EACjD;AAEA,SAAO,KAAK,MAAM,OAAO;AAC3B;AAEA,eAAe,qBAAqB,MAAY,SAAyB;AACvE,QAAM,aAAa,QAAQ,SAAS,MAAM;AAC1C,MAAI,YAAY;AACd,UAAM,WAAW,UAAM,kBAAAA,SAAM,UAAU;AACvC,QAAI,SAAS,WAAW,KAAK;AAC3B,YAAM,OAAO,SAAS,QAAQ,IAAI,cAAc;AAChD,UAAI,KAAK,WAAW,QAAQ,GAAG;AAC7B,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACF;AAKA,eAAe,SAAS,MAAY,SAA2C;AAC7E,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,MAAI;AAEJ,MAAI,QAAQ,SAAS;AACnB,UAAM,UAAU,QAAQ;AAExB,QAAI,QAAQ,MAAM;AAChB,YAAM,OAAO,QAAQ;AAErB,UAAI,KAAK,WAAW;AAClB,oBAAY,KAAK;AAAA,MACnB;AAEA,UAAI,KAAK,YAAY;AACnB,mBAAW,KAAK;AAAA,MAClB;AAAA,IACF;AAEA,iBAAa,MAAM,qBAAqB,MAAM,OAAO;AAErD,wBAAoB;AAAA,MAClB,GAAG,QAAQ;AAAA,IACb;AAAA,EACF;AAGA,MAAI,QAAQ,QAAQ;AAClB,aAAS;AAAA,MACP,GAAG,QAAQ;AAAA,IACb;AAAA,EACF;AAEA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,UAAU,QAAQ;AAAA,IAClB,cAAc,QAAQ;AAAA,IACtB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;",
+  "names": ["fetch"]
+}

package/dist/src/middleware/passport/sso/tests/google.spec.js

@@ -0,0 +1,77 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var import_tests = require("../../../../../tests");
+var import_types = require("@budibase/types");
+var _sso = __toESM(require("../sso"));
+var google = __toESM(require("../google"));
+jest.mock("passport-google-oauth");
+const mockStrategy = require("passport-google-oauth").OAuth2Strategy;
+jest.mock("../sso");
+const sso = jest.mocked(_sso);
+const mockSaveUserFn = jest.fn();
+const mockDone = jest.fn();
+describe("google", () => {
+  describe("strategyFactory", () => {
+    const googleConfig = import_tests.structures.sso.googleConfig();
+    const callbackUrl = import_tests.generator.url();
+    it("should create successfully create a google strategy", async () => {
+      await google.strategyFactory(googleConfig, callbackUrl, mockSaveUserFn);
+      const expectedOptions = {
+        clientID: googleConfig.clientID,
+        clientSecret: googleConfig.clientSecret,
+        callbackURL: callbackUrl
+      };
+      expect(mockStrategy).toHaveBeenCalledWith(
+        expectedOptions,
+        expect.anything()
+      );
+    });
+  });
+  describe("authenticate", () => {
+    const details = import_tests.structures.sso.authDetails();
+    details.provider = "google";
+    details.providerType = import_types.SSOProviderType.GOOGLE;
+    const profile = details.profile;
+    profile.provider = "google";
+    beforeEach(() => {
+      jest.clearAllMocks();
+    });
+    it("delegates authentication to third party common", async () => {
+      const authenticate = await google.buildVerifyFn(mockSaveUserFn);
+      await authenticate(
+        details.oauth2.accessToken,
+        details.oauth2.refreshToken,
+        profile,
+        mockDone
+      );
+      expect(sso.authenticate).toHaveBeenCalledWith(
+        details,
+        true,
+        mockDone,
+        mockSaveUserFn
+      );
+    });
+  });
+});
+//# sourceMappingURL=google.spec.js.map

package/dist/src/middleware/passport/sso/tests/google.spec.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/middleware/passport/sso/tests/google.spec.ts"],
+  "sourcesContent": ["import { generator, structures } from \"../../../../../tests\"\nimport { SSOProviderType } from \"@budibase/types\"\n\njest.mock(\"passport-google-oauth\")\nconst mockStrategy = require(\"passport-google-oauth\").OAuth2Strategy\n\njest.mock(\"../sso\")\nimport * as _sso from \"../sso\"\nconst sso = jest.mocked(_sso)\n\nconst mockSaveUserFn = jest.fn()\nconst mockDone = jest.fn()\n\nimport * as google from \"../google\"\n\ndescribe(\"google\", () => {\n  describe(\"strategyFactory\", () => {\n    const googleConfig = structures.sso.googleConfig()\n    const callbackUrl = generator.url()\n\n    it(\"should create successfully create a google strategy\", async () => {\n      await google.strategyFactory(googleConfig, callbackUrl, mockSaveUserFn)\n\n      const expectedOptions = {\n        clientID: googleConfig.clientID,\n        clientSecret: googleConfig.clientSecret,\n        callbackURL: callbackUrl,\n      }\n\n      expect(mockStrategy).toHaveBeenCalledWith(\n        expectedOptions,\n        expect.anything()\n      )\n    })\n  })\n\n  describe(\"authenticate\", () => {\n    const details = structures.sso.authDetails()\n    details.provider = \"google\"\n    details.providerType = SSOProviderType.GOOGLE\n\n    const profile = details.profile!\n    profile.provider = \"google\"\n\n    beforeEach(() => {\n      jest.clearAllMocks()\n    })\n\n    it(\"delegates authentication to third party common\", async () => {\n      const authenticate = await google.buildVerifyFn(mockSaveUserFn)\n\n      await authenticate(\n        details.oauth2.accessToken,\n        details.oauth2.refreshToken!,\n        profile,\n        mockDone\n      )\n\n      expect(sso.authenticate).toHaveBeenCalledWith(\n        details,\n        true,\n        mockDone,\n        mockSaveUserFn\n      )\n    })\n  })\n})\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;AAAA,mBAAsC;AACtC,mBAAgC;AAMhC,WAAsB;AAMtB,aAAwB;AAVxB,KAAK,KAAK,uBAAuB;AACjC,MAAM,eAAe,QAAQ,uBAAuB,EAAE;AAEtD,KAAK,KAAK,QAAQ;AAElB,MAAM,MAAM,KAAK,OAAO,IAAI;AAE5B,MAAM,iBAAiB,KAAK,GAAG;AAC/B,MAAM,WAAW,KAAK,GAAG;AAIzB,SAAS,UAAU,MAAM;AACvB,WAAS,mBAAmB,MAAM;AAChC,UAAM,eAAe,wBAAW,IAAI,aAAa;AACjD,UAAM,cAAc,uBAAU,IAAI;AAElC,OAAG,uDAAuD,YAAY;AACpE,YAAM,OAAO,gBAAgB,cAAc,aAAa,cAAc;AAEtE,YAAM,kBAAkB;AAAA,QACtB,UAAU,aAAa;AAAA,QACvB,cAAc,aAAa;AAAA,QAC3B,aAAa;AAAA,MACf;AAEA,aAAO,YAAY,EAAE;AAAA,QACnB;AAAA,QACA,OAAO,SAAS;AAAA,MAClB;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AAED,WAAS,gBAAgB,MAAM;AAC7B,UAAM,UAAU,wBAAW,IAAI,YAAY;AAC3C,YAAQ,WAAW;AACnB,YAAQ,eAAe,6BAAgB;AAEvC,UAAM,UAAU,QAAQ;AACxB,YAAQ,WAAW;AAEnB,eAAW,MAAM;AACf,WAAK,cAAc;AAAA,IACrB,CAAC;AAED,OAAG,kDAAkD,YAAY;AAC/D,YAAM,eAAe,MAAM,OAAO,cAAc,cAAc;AAE9D,YAAM;AAAA,QACJ,QAAQ,OAAO;AAAA,QACf,QAAQ,OAAO;AAAA,QACf;AAAA,QACA;AAAA,MACF;AAEA,aAAO,IAAI,YAAY,EAAE;AAAA,QACvB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AACH,CAAC;",
+  "names": []
+}

package/dist/src/middleware/passport/sso/tests/oidc.spec.js

@@ -0,0 +1,143 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var import_tests = require("../../../../../tests");
+var import_types = require("@budibase/types");
+var _sso = __toESM(require("../sso"));
+var oidc = __toESM(require("../oidc"));
+jest.mock("@techpass/passport-openidconnect");
+const mockStrategy = require("@techpass/passport-openidconnect").Strategy;
+jest.mock("../sso");
+const sso = jest.mocked(_sso);
+const mockSaveUser = jest.fn();
+const mockDone = jest.fn();
+describe("oidc", () => {
+  const callbackUrl = import_tests.generator.url();
+  const oidcConfig = import_tests.structures.sso.oidcConfig();
+  const wellKnownConfig = import_tests.structures.sso.oidcWellKnownConfig();
+  function mockRetrieveWellKnownConfig() {
+    import_tests.mocks.fetch.mockReturnValue({
+      ok: true,
+      json: () => wellKnownConfig
+    });
+  }
+  beforeEach(() => {
+    mockRetrieveWellKnownConfig();
+  });
+  describe("strategyFactory", () => {
+    it("should create successfully create an oidc strategy", async () => {
+      const strategyConfiguration = await oidc.fetchStrategyConfig(
+        oidcConfig,
+        callbackUrl
+      );
+      await oidc.strategyFactory(strategyConfiguration, mockSaveUser);
+      expect(import_tests.mocks.fetch).toHaveBeenCalledWith(oidcConfig.configUrl);
+      const expectedOptions = {
+        issuer: wellKnownConfig.issuer,
+        authorizationURL: wellKnownConfig.authorization_endpoint,
+        tokenURL: wellKnownConfig.token_endpoint,
+        userInfoURL: wellKnownConfig.userinfo_endpoint,
+        clientID: oidcConfig.clientID,
+        clientSecret: oidcConfig.clientSecret,
+        callbackURL: callbackUrl
+      };
+      expect(mockStrategy).toHaveBeenCalledWith(
+        expectedOptions,
+        expect.anything()
+      );
+    });
+  });
+  describe("authenticate", () => {
+    const details = import_tests.structures.sso.authDetails();
+    details.providerType = import_types.SSOProviderType.OIDC;
+    const profile = details.profile;
+    const issuer = profile.provider;
+    const sub = import_tests.generator.string();
+    const idToken = import_tests.generator.string();
+    const params = {};
+    let authenticateFn;
+    let jwtClaims;
+    beforeEach(async () => {
+      jest.clearAllMocks();
+      authenticateFn = await oidc.buildVerifyFn(mockSaveUser);
+    });
+    async function authenticate() {
+      await authenticateFn(
+        issuer,
+        sub,
+        profile,
+        jwtClaims,
+        details.oauth2.accessToken,
+        details.oauth2.refreshToken,
+        idToken,
+        params,
+        mockDone
+      );
+    }
+    it("passes auth details to sso module", async () => {
+      await authenticate();
+      expect(sso.authenticate).toHaveBeenCalledWith(
+        details,
+        false,
+        mockDone,
+        mockSaveUser
+      );
+    });
+    it("uses JWT email to get email", async () => {
+      delete profile._json.email;
+      jwtClaims = {
+        email: details.email
+      };
+      await authenticate();
+      expect(sso.authenticate).toHaveBeenCalledWith(
+        details,
+        false,
+        mockDone,
+        mockSaveUser
+      );
+    });
+    it("uses JWT username to get email", async () => {
+      delete profile._json.email;
+      jwtClaims = {
+        email: details.email
+      };
+      await authenticate();
+      expect(sso.authenticate).toHaveBeenCalledWith(
+        details,
+        false,
+        mockDone,
+        mockSaveUser
+      );
+    });
+    it("uses JWT invalid username to get email", async () => {
+      delete profile._json.email;
+      jwtClaims = {
+        preferred_username: "invalidUsername"
+      };
+      await expect(authenticate()).rejects.toThrow(
+        "Could not determine user email from profile"
+      );
+    });
+  });
+});
+//# sourceMappingURL=oidc.spec.js.map

package/dist/src/middleware/passport/sso/tests/oidc.spec.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/middleware/passport/sso/tests/oidc.spec.ts"],
+  "sourcesContent": ["import { generator, mocks, structures } from \"../../../../../tests\"\nimport {\n  JwtClaims,\n  OIDCInnerConfig,\n  SSOAuthDetails,\n  SSOProviderType,\n} from \"@budibase/types\"\nimport * as _sso from \"../sso\"\nimport * as oidc from \"../oidc\"\n\njest.mock(\"@techpass/passport-openidconnect\")\nconst mockStrategy = require(\"@techpass/passport-openidconnect\").Strategy\n\njest.mock(\"../sso\")\nconst sso = jest.mocked(_sso)\n\nconst mockSaveUser = jest.fn()\nconst mockDone = jest.fn()\n\ndescribe(\"oidc\", () => {\n  const callbackUrl = generator.url()\n  const oidcConfig: OIDCInnerConfig = structures.sso.oidcConfig()\n  const wellKnownConfig = structures.sso.oidcWellKnownConfig()\n\n  function mockRetrieveWellKnownConfig() {\n    // mock the request to retrieve the oidc configuration\n    mocks.fetch.mockReturnValue({\n      ok: true,\n      json: () => wellKnownConfig,\n    })\n  }\n\n  beforeEach(() => {\n    mockRetrieveWellKnownConfig()\n  })\n\n  describe(\"strategyFactory\", () => {\n    it(\"should create successfully create an oidc strategy\", async () => {\n      const strategyConfiguration = await oidc.fetchStrategyConfig(\n        oidcConfig,\n        callbackUrl\n      )\n      await oidc.strategyFactory(strategyConfiguration, mockSaveUser)\n\n      expect(mocks.fetch).toHaveBeenCalledWith(oidcConfig.configUrl)\n\n      const expectedOptions = {\n        issuer: wellKnownConfig.issuer,\n        authorizationURL: wellKnownConfig.authorization_endpoint,\n        tokenURL: wellKnownConfig.token_endpoint,\n        userInfoURL: wellKnownConfig.userinfo_endpoint,\n        clientID: oidcConfig.clientID,\n        clientSecret: oidcConfig.clientSecret,\n        callbackURL: callbackUrl,\n      }\n      expect(mockStrategy).toHaveBeenCalledWith(\n        expectedOptions,\n        expect.anything()\n      )\n    })\n  })\n\n  describe(\"authenticate\", () => {\n    const details: SSOAuthDetails = structures.sso.authDetails()\n    details.providerType = SSOProviderType.OIDC\n    const profile = details.profile!\n    const issuer = profile.provider\n\n    const sub = generator.string()\n    const idToken = generator.string()\n    const params = {}\n\n    let authenticateFn: any\n    let jwtClaims: JwtClaims\n\n    beforeEach(async () => {\n      jest.clearAllMocks()\n      authenticateFn = await oidc.buildVerifyFn(mockSaveUser)\n    })\n\n    async function authenticate() {\n      await authenticateFn(\n        issuer,\n        sub,\n        profile,\n        jwtClaims,\n        details.oauth2.accessToken,\n        details.oauth2.refreshToken,\n        idToken,\n        params,\n        mockDone\n      )\n    }\n\n    it(\"passes auth details to sso module\", async () => {\n      await authenticate()\n\n      expect(sso.authenticate).toHaveBeenCalledWith(\n        details,\n        false,\n        mockDone,\n        mockSaveUser\n      )\n    })\n\n    it(\"uses JWT email to get email\", async () => {\n      delete profile._json.email\n\n      jwtClaims = {\n        email: details.email,\n      }\n\n      await authenticate()\n\n      expect(sso.authenticate).toHaveBeenCalledWith(\n        details,\n        false,\n        mockDone,\n        mockSaveUser\n      )\n    })\n\n    it(\"uses JWT username to get email\", async () => {\n      delete profile._json.email\n\n      jwtClaims = {\n        email: details.email,\n      }\n\n      await authenticate()\n\n      expect(sso.authenticate).toHaveBeenCalledWith(\n        details,\n        false,\n        mockDone,\n        mockSaveUser\n      )\n    })\n\n    it(\"uses JWT invalid username to get email\", async () => {\n      delete profile._json.email\n\n      jwtClaims = {\n        preferred_username: \"invalidUsername\",\n      }\n\n      await expect(authenticate()).rejects.toThrow(\n        \"Could not determine user email from profile\"\n      )\n    })\n  })\n})\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;AAAA,mBAA6C;AAC7C,mBAKO;AACP,WAAsB;AACtB,WAAsB;AAEtB,KAAK,KAAK,kCAAkC;AAC5C,MAAM,eAAe,QAAQ,kCAAkC,EAAE;AAEjE,KAAK,KAAK,QAAQ;AAClB,MAAM,MAAM,KAAK,OAAO,IAAI;AAE5B,MAAM,eAAe,KAAK,GAAG;AAC7B,MAAM,WAAW,KAAK,GAAG;AAEzB,SAAS,QAAQ,MAAM;AACrB,QAAM,cAAc,uBAAU,IAAI;AAClC,QAAM,aAA8B,wBAAW,IAAI,WAAW;AAC9D,QAAM,kBAAkB,wBAAW,IAAI,oBAAoB;AAE3D,WAAS,8BAA8B;AAErC,uBAAM,MAAM,gBAAgB;AAAA,MAC1B,IAAI;AAAA,MACJ,MAAM,MAAM;AAAA,IACd,CAAC;AAAA,EACH;AAEA,aAAW,MAAM;AACf,gCAA4B;AAAA,EAC9B,CAAC;AAED,WAAS,mBAAmB,MAAM;AAChC,OAAG,sDAAsD,YAAY;AACnE,YAAM,wBAAwB,MAAM,KAAK;AAAA,QACvC;AAAA,QACA;AAAA,MACF;AACA,YAAM,KAAK,gBAAgB,uBAAuB,YAAY;AAE9D,aAAO,mBAAM,KAAK,EAAE,qBAAqB,WAAW,SAAS;AAE7D,YAAM,kBAAkB;AAAA,QACtB,QAAQ,gBAAgB;AAAA,QACxB,kBAAkB,gBAAgB;AAAA,QAClC,UAAU,gBAAgB;AAAA,QAC1B,aAAa,gBAAgB;AAAA,QAC7B,UAAU,WAAW;AAAA,QACrB,cAAc,WAAW;AAAA,QACzB,aAAa;AAAA,MACf;AACA,aAAO,YAAY,EAAE;AAAA,QACnB;AAAA,QACA,OAAO,SAAS;AAAA,MAClB;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AAED,WAAS,gBAAgB,MAAM;AAC7B,UAAM,UAA0B,wBAAW,IAAI,YAAY;AAC3D,YAAQ,eAAe,6BAAgB;AACvC,UAAM,UAAU,QAAQ;AACxB,UAAM,SAAS,QAAQ;AAEvB,UAAM,MAAM,uBAAU,OAAO;AAC7B,UAAM,UAAU,uBAAU,OAAO;AACjC,UAAM,SAAS,CAAC;AAEhB,QAAI;AACJ,QAAI;AAEJ,eAAW,YAAY;AACrB,WAAK,cAAc;AACnB,uBAAiB,MAAM,KAAK,cAAc,YAAY;AAAA,IACxD,CAAC;AAED,mBAAe,eAAe;AAC5B,YAAM;AAAA,QACJ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,QAAQ,OAAO;AAAA,QACf,QAAQ,OAAO;AAAA,QACf;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,OAAG,qCAAqC,YAAY;AAClD,YAAM,aAAa;AAEnB,aAAO,IAAI,YAAY,EAAE;AAAA,QACvB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF,CAAC;AAED,OAAG,+BAA+B,YAAY;AAC5C,aAAO,QAAQ,MAAM;AAErB,kBAAY;AAAA,QACV,OAAO,QAAQ;AAAA,MACjB;AAEA,YAAM,aAAa;AAEnB,aAAO,IAAI,YAAY,EAAE;AAAA,QACvB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF,CAAC;AAED,OAAG,kCAAkC,YAAY;AAC/C,aAAO,QAAQ,MAAM;AAErB,kBAAY;AAAA,QACV,OAAO,QAAQ;AAAA,MACjB;AAEA,YAAM,aAAa;AAEnB,aAAO,IAAI,YAAY,EAAE;AAAA,QACvB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF,CAAC;AAED,OAAG,0CAA0C,YAAY;AACvD,aAAO,QAAQ,MAAM;AAErB,kBAAY;AAAA,QACV,oBAAoB;AAAA,MACtB;AAEA,YAAM,OAAO,aAAa,CAAC,EAAE,QAAQ;AAAA,QACnC;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AACH,CAAC;",
+  "names": []
+}