@c9up/warden 0.1.17 → 0.1.19
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/AuthManager.d.ts +86 -1
- package/dist/AuthManager.d.ts.map +1 -1
- package/dist/AuthManager.js +113 -10
- package/dist/AuthManager.js.map +1 -1
- package/dist/Authenticator.d.ts +13 -1
- package/dist/Authenticator.d.ts.map +1 -1
- package/dist/Authenticator.js +37 -3
- package/dist/Authenticator.js.map +1 -1
- package/dist/RememberMeToken.d.ts +169 -0
- package/dist/RememberMeToken.d.ts.map +1 -0
- package/dist/RememberMeToken.js +269 -0
- package/dist/RememberMeToken.js.map +1 -0
- package/dist/ResilientBlacklistDriver.d.ts +15 -9
- package/dist/ResilientBlacklistDriver.d.ts.map +1 -1
- package/dist/ResilientBlacklistDriver.js +53 -15
- package/dist/ResilientBlacklistDriver.js.map +1 -1
- package/dist/Secret.d.ts +11 -0
- package/dist/Secret.d.ts.map +1 -0
- package/dist/Secret.js +36 -0
- package/dist/Secret.js.map +1 -0
- package/dist/WardenProvider.d.ts +1 -0
- package/dist/WardenProvider.d.ts.map +1 -1
- package/dist/WardenProvider.js +64 -0
- package/dist/WardenProvider.js.map +1 -1
- package/dist/bouncer/Bouncer.d.ts +46 -1
- package/dist/bouncer/Bouncer.d.ts.map +1 -1
- package/dist/bouncer/Bouncer.js +77 -4
- package/dist/bouncer/Bouncer.js.map +1 -1
- package/dist/bouncer/PolicyAuthorizer.d.ts +9 -1
- package/dist/bouncer/PolicyAuthorizer.d.ts.map +1 -1
- package/dist/bouncer/PolicyAuthorizer.js +17 -1
- package/dist/bouncer/PolicyAuthorizer.js.map +1 -1
- package/dist/bouncer/evaluate.d.ts +14 -2
- package/dist/bouncer/evaluate.d.ts.map +1 -1
- package/dist/bouncer/evaluate.js +16 -5
- package/dist/bouncer/evaluate.js.map +1 -1
- package/dist/bouncer/types.d.ts +4 -2
- package/dist/bouncer/types.d.ts.map +1 -1
- package/dist/config.d.ts +3 -0
- package/dist/config.d.ts.map +1 -1
- package/dist/config.js +5 -0
- package/dist/config.js.map +1 -1
- package/dist/firstcontact/drivers/GitHubDriver.d.ts.map +1 -1
- package/dist/firstcontact/drivers/GitHubDriver.js +2 -3
- package/dist/firstcontact/drivers/GitHubDriver.js.map +1 -1
- package/dist/firstcontact/drivers/GoogleDriver.d.ts.map +1 -1
- package/dist/firstcontact/drivers/GoogleDriver.js +2 -3
- package/dist/firstcontact/drivers/GoogleDriver.js.map +1 -1
- package/dist/firstcontact/types.d.ts +10 -0
- package/dist/firstcontact/types.d.ts.map +1 -1
- package/dist/firstcontact/types.js +18 -1
- package/dist/firstcontact/types.js.map +1 -1
- package/dist/index.d.ts +8 -4
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +6 -3
- package/dist/index.js.map +1 -1
- package/dist/mfa/MfaManager.d.ts.map +1 -1
- package/dist/mfa/MfaManager.js +14 -5
- package/dist/mfa/MfaManager.js.map +1 -1
- package/dist/mfa/TotpProvider.d.ts +34 -1
- package/dist/mfa/TotpProvider.d.ts.map +1 -1
- package/dist/mfa/TotpProvider.js +60 -4
- package/dist/mfa/TotpProvider.js.map +1 -1
- package/dist/mfa/webauthn-codec.d.ts +6 -1
- package/dist/mfa/webauthn-codec.d.ts.map +1 -1
- package/dist/mfa/webauthn-codec.js +50 -6
- package/dist/mfa/webauthn-codec.js.map +1 -1
- package/dist/middleware.d.ts.map +1 -1
- package/dist/middleware.js +46 -1
- package/dist/middleware.js.map +1 -1
- package/dist/quasar.d.ts.map +1 -1
- package/dist/quasar.js +6 -14
- package/dist/quasar.js.map +1 -1
- package/dist/sanitize.d.ts +10 -0
- package/dist/sanitize.d.ts.map +1 -0
- package/dist/sanitize.js +15 -0
- package/dist/sanitize.js.map +1 -0
- package/dist/strategies/ApiKeyStrategy.d.ts +10 -1
- package/dist/strategies/ApiKeyStrategy.d.ts.map +1 -1
- package/dist/strategies/ApiKeyStrategy.js +16 -0
- package/dist/strategies/ApiKeyStrategy.js.map +1 -1
- package/dist/strategies/BasicAuthStrategy.d.ts +59 -0
- package/dist/strategies/BasicAuthStrategy.d.ts.map +1 -0
- package/dist/strategies/BasicAuthStrategy.js +97 -0
- package/dist/strategies/BasicAuthStrategy.js.map +1 -0
- package/dist/strategies/JwtStrategy.d.ts +10 -1
- package/dist/strategies/JwtStrategy.d.ts.map +1 -1
- package/dist/strategies/JwtStrategy.js +11 -0
- package/dist/strategies/JwtStrategy.js.map +1 -1
- package/dist/strategies/SessionStrategy.d.ts +84 -2
- package/dist/strategies/SessionStrategy.d.ts.map +1 -1
- package/dist/strategies/SessionStrategy.js +124 -1
- package/dist/strategies/SessionStrategy.js.map +1 -1
- package/index.darwin-arm64.node +0 -0
- package/index.darwin-x64.node +0 -0
- package/index.linux-arm64-gnu.node +0 -0
- package/index.linux-x64-gnu.node +0 -0
- package/index.win32-x64-msvc.node +0 -0
- package/package.json +4 -2
- package/src/AuthManager.ts +163 -7
- package/src/Authenticator.ts +58 -10
- package/src/RememberMeToken.ts +357 -0
- package/src/ResilientBlacklistDriver.ts +58 -18
- package/src/Secret.ts +41 -0
- package/src/WardenProvider.ts +90 -0
- package/src/bouncer/Bouncer.ts +93 -4
- package/src/bouncer/PolicyAuthorizer.ts +20 -1
- package/src/bouncer/evaluate.ts +26 -6
- package/src/bouncer/types.ts +4 -2
- package/src/config.ts +9 -0
- package/src/firstcontact/drivers/GitHubDriver.ts +2 -3
- package/src/firstcontact/drivers/GoogleDriver.ts +2 -3
- package/src/firstcontact/types.ts +24 -0
- package/src/index.ts +30 -2
- package/src/mfa/MfaManager.ts +15 -8
- package/src/mfa/TotpProvider.ts +90 -6
- package/src/mfa/webauthn-codec.ts +48 -6
- package/src/middleware.ts +55 -2
- package/src/quasar.ts +6 -14
- package/src/sanitize.ts +17 -0
- package/src/strategies/ApiKeyStrategy.ts +23 -1
- package/src/strategies/BasicAuthStrategy.ts +127 -0
- package/src/strategies/JwtStrategy.ts +18 -1
- package/src/strategies/SessionStrategy.ts +167 -2
package/dist/AuthManager.d.ts
CHANGED
|
@@ -3,6 +3,10 @@
|
|
|
3
3
|
*
|
|
4
4
|
* @implements FR48, FR50, FR51
|
|
5
5
|
*/
|
|
6
|
+
import { Authenticator } from "./Authenticator.js";
|
|
7
|
+
import type { WardenContext } from "./middleware.js";
|
|
8
|
+
import { sanitizePayload } from "./sanitize.js";
|
|
9
|
+
export { sanitizePayload };
|
|
6
10
|
import { RightsResolver } from "./rights/RightsResolver.js";
|
|
7
11
|
import type { EffectivePermissions, Scope } from "./rights/types.js";
|
|
8
12
|
import type { SessionStore } from "./strategies/SessionStrategy.js";
|
|
@@ -25,10 +29,46 @@ export interface AuthResult {
|
|
|
25
29
|
*/
|
|
26
30
|
strategyCrash?: true;
|
|
27
31
|
}
|
|
32
|
+
/**
|
|
33
|
+
* What a test client must send to act as a user (AdonisJS `AuthClientResponse`).
|
|
34
|
+
*
|
|
35
|
+
* Each guard answers in its own currency — a header for a token guard, a
|
|
36
|
+
* session entry for a session guard — so the test harness applies whichever
|
|
37
|
+
* fields come back instead of knowing how each guard authenticates.
|
|
38
|
+
*/
|
|
39
|
+
export interface AuthClientResponse {
|
|
40
|
+
/** Headers to set on the request. */
|
|
41
|
+
headers?: Record<string, string>;
|
|
42
|
+
/** Session values to seed before the request. */
|
|
43
|
+
session?: Record<string, unknown>;
|
|
44
|
+
/** Cookies to send. */
|
|
45
|
+
cookies?: Record<string, string>;
|
|
46
|
+
}
|
|
47
|
+
/**
|
|
48
|
+
* The event namespace for a guard, taken from its DRIVER.
|
|
49
|
+
*
|
|
50
|
+
* AdonisJS namespaces auth events per driver — `session_auth:*`,
|
|
51
|
+
* `access_tokens_auth:*`, `basic_auth:*` — so an app can audit session logins
|
|
52
|
+
* without also hearing about every bearer token. Warden emitted `session_auth:*`
|
|
53
|
+
* whatever authenticated, which told a session listener about JWT traffic and
|
|
54
|
+
* left no name to subscribe to for the others.
|
|
55
|
+
*
|
|
56
|
+
* Driven by the strategy's `name` rather than the guard's config key: a guard
|
|
57
|
+
* called `web` running a `SessionStrategy` is still the session driver, exactly
|
|
58
|
+
* as upstream. A driver already ending in `_auth` (`basic_auth`) keeps its name
|
|
59
|
+
* rather than growing a second suffix, which is how AdonisJS spells it.
|
|
60
|
+
*/
|
|
61
|
+
export declare function authEventPrefix(driverName: string | undefined): string;
|
|
28
62
|
export interface AuthStrategy {
|
|
29
63
|
name: string;
|
|
30
64
|
authenticate(credentials: Record<string, unknown>): Promise<AuthResult>;
|
|
31
65
|
verify(token: string, context?: Record<string, unknown>): Promise<AuthResult>;
|
|
66
|
+
/**
|
|
67
|
+
* Build what a test client sends to be this user (AdonisJS
|
|
68
|
+
* `authenticateAsClient`). Optional: a guard with no test seam simply has
|
|
69
|
+
* none, and the harness says so instead of forging one.
|
|
70
|
+
*/
|
|
71
|
+
authenticateAsClient?(...args: never[]): Promise<AuthClientResponse> | AuthClientResponse;
|
|
32
72
|
}
|
|
33
73
|
/**
|
|
34
74
|
* AuthManager configuration. Two equivalent forms are accepted:
|
|
@@ -62,10 +102,29 @@ export interface AuthConfig {
|
|
|
62
102
|
/**
|
|
63
103
|
* Manages authentication strategies and provides guard/permission checks.
|
|
64
104
|
*/
|
|
105
|
+
/**
|
|
106
|
+
* The slice of an event emitter warden publishes through — `emit(name, data)`,
|
|
107
|
+
* which is what both `@c9up/ream`'s Emitter and Adonis' expose.
|
|
108
|
+
*/
|
|
109
|
+
export interface WardenEmitter {
|
|
110
|
+
emit(event: string, data: unknown): unknown;
|
|
111
|
+
}
|
|
65
112
|
export declare class AuthManager {
|
|
113
|
+
#private;
|
|
66
114
|
private guards;
|
|
67
115
|
private default;
|
|
68
116
|
private readonly rights;
|
|
117
|
+
/**
|
|
118
|
+
* Publish auth events on `emitter`. AdonisJS emits six of them from its
|
|
119
|
+
* session guard, and an app that audits logins reads exactly those.
|
|
120
|
+
*/
|
|
121
|
+
setEmitter(emitter: WardenEmitter): this;
|
|
122
|
+
/**
|
|
123
|
+
* Publish one auth event. Public so the per-request `Authenticator` can
|
|
124
|
+
* report what it observed — it holds the guard chain, the manager holds the
|
|
125
|
+
* emitter.
|
|
126
|
+
*/
|
|
127
|
+
emitAuthEvent(event: string, payload: Record<string, unknown>): void;
|
|
69
128
|
constructor(config: AuthConfig);
|
|
70
129
|
/** Authenticate with credentials using a specific or default strategy. */
|
|
71
130
|
authenticate(credentials: Record<string, unknown>, strategyName?: string): Promise<AuthResult>;
|
|
@@ -111,6 +170,33 @@ export declare class AuthManager {
|
|
|
111
170
|
*/
|
|
112
171
|
hasAllPermissions(user: UserPayload, permissions: string[], scope?: Scope): Promise<boolean>;
|
|
113
172
|
/** Get a registered strategy by name. */
|
|
173
|
+
/**
|
|
174
|
+
* An {@link Authenticator} bound to one request (AdonisJS
|
|
175
|
+
* `createAuthenticator`).
|
|
176
|
+
*
|
|
177
|
+
* What the HTTP middleware builds per request. Exposed so anything outside
|
|
178
|
+
* that path — a console command acting as a user, a background job — can
|
|
179
|
+
* build one without reaching for the class.
|
|
180
|
+
*/
|
|
181
|
+
createAuthenticator(ctx: WardenContext): Authenticator;
|
|
182
|
+
/**
|
|
183
|
+
* What a test client needs to authenticate as a user (AdonisJS
|
|
184
|
+
* `createAuthenticatorClient`).
|
|
185
|
+
*
|
|
186
|
+
* Delegates to the guard's own `authenticateAsClient`, so a guard with no
|
|
187
|
+
* test seam says so instead of having one forged for it.
|
|
188
|
+
*/
|
|
189
|
+
createAuthenticatorClient(): {
|
|
190
|
+
use(guard?: string): {
|
|
191
|
+
authenticateAsClient(...args: never[]): Promise<AuthClientResponse> | AuthClientResponse;
|
|
192
|
+
};
|
|
193
|
+
};
|
|
194
|
+
/**
|
|
195
|
+
* The event namespace a guard's events carry, resolved from its driver.
|
|
196
|
+
* Falls back to `session_auth` when the guard cannot be resolved, so a
|
|
197
|
+
* failure to look one up never becomes a second failure at emit time.
|
|
198
|
+
*/
|
|
199
|
+
eventPrefixFor(guardName?: string): string;
|
|
114
200
|
getStrategy(name?: string): AuthStrategy;
|
|
115
201
|
/**
|
|
116
202
|
* Name of the default guard (Adonis's "default guard"). Used by `silentAuth`
|
|
@@ -148,5 +234,4 @@ export declare class AuthManager {
|
|
|
148
234
|
* directly (not `AuthManager.verify`), so without this it would skip
|
|
149
235
|
* the guard JWT / api-key users get.
|
|
150
236
|
*/
|
|
151
|
-
export declare function sanitizePayload(user: UserPayload): void;
|
|
152
237
|
//# sourceMappingURL=AuthManager.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"AuthManager.d.ts","sourceRoot":"","sources":["../src/AuthManager.ts"],"names":[],"mappings":"AAAA;;;;GAIG;
|
|
1
|
+
{"version":3,"file":"AuthManager.d.ts","sourceRoot":"","sources":["../src/AuthManager.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,OAAO,EAAE,eAAe,EAAE,CAAC;AAG3B,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,KAAK,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AACrE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAEpE,MAAM,WAAW,WAAW;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,UAAU;IAC1B,aAAa,EAAE,OAAO,CAAC;IACvB,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,IAAI,CAAC;CACrB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IAClC,qCAAqC;IACrC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,iDAAiD;IACjD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,uBAAuB;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAGtE;AAED,MAAM,WAAW,YAAY;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACxE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC9E;;;;OAIG;IACH,oBAAoB,CAAC,CACpB,GAAG,IAAI,EAAE,KAAK,EAAE,GACd,OAAO,CAAC,kBAAkB,CAAC,GAAG,kBAAkB,CAAC;CACpD;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,UAAU;IAC1B,2CAA2C;IAC3C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACtC,mDAAmD;IACnD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kDAAkD;IAClD,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC1C;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,cAAc,CAAC;CACxB;AAkBD;;GAEG;AACH;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC7B,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;CAC5C;AAED,qBAAa,WAAW;;IAGvB,OAAO,CAAC,MAAM,CAAwC;IACtD,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiB;IASxC;;;OAGG;IACH,UAAU,CAAC,OAAO,EAAE,aAAa,GAAG,IAAI;IAKxC;;;;OAIG;IACH,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;gBAaxD,MAAM,EAAE,UAAU;IAoC9B,0EAA0E;IACpE,YAAY,CACjB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,YAAY,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,UAAU,CAAC;IAmBtB,8CAA8C;IACxC,MAAM,CACX,KAAK,EAAE,MAAM,EACb,YAAY,CAAC,EAAE,MAAM,EACrB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,OAAO,CAAC,UAAU,CAAC;IAoBtB;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM;IAc1D;;;;;;;OAOG;IACH,kBAAkB,CACjB,IAAI,EAAE,WAAW,EACjB,KAAK,GAAE,KAAgB,GACrB,OAAO,CAAC,oBAAoB,CAAC;IAIhC;;;;OAIG;IACG,OAAO,CACZ,IAAI,EAAE,WAAW,EACjB,IAAI,EAAE,MAAM,EACZ,KAAK,GAAE,KAAgB,GACrB,OAAO,CAAC,OAAO,CAAC;IAInB;;;;OAIG;IACG,aAAa,CAClB,IAAI,EAAE,WAAW,EACjB,UAAU,EAAE,MAAM,EAClB,KAAK,GAAE,KAAgB,GACrB,OAAO,CAAC,OAAO,CAAC;IAInB;;;OAGG;IACG,iBAAiB,CACtB,IAAI,EAAE,WAAW,EACjB,WAAW,EAAE,MAAM,EAAE,EACrB,KAAK,GAAE,KAAgB,GACrB,OAAO,CAAC,OAAO,CAAC;IAInB,yCAAyC;IACzC;;;;;;;OAOG;IACH,mBAAmB,CAAC,GAAG,EAAE,aAAa,GAAG,aAAa;IAItD;;;;;;OAMG;IACH,yBAAyB,IAAI;QAC5B,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG;YACpB,oBAAoB,CACnB,GAAG,IAAI,EAAE,KAAK,EAAE,GACd,OAAO,CAAC,kBAAkB,CAAC,GAAG,kBAAkB,CAAC;SACpD,CAAC;KACF;IAmBD;;;;OAIG;IACH,cAAc,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM;IAQ1C,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,YAAY;IAexC;;;;OAIG;IACH,IAAI,mBAAmB,IAAI,MAAM,CAEhC;IAED,0CAA0C;IAC1C,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,GAAG,IAAI;IAI5D,yCAAyC;IACzC,gBAAgB,IAAI,MAAM,EAAE;IAI5B;;;;;;;;;OASG;IACG,KAAK,CACV,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,YAAY,EACrB,YAAY,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC;IAwBhB;;;;OAIG;IACG,MAAM,CAAC,OAAO,EAAE,YAAY,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAezE;AAwBD,kEAAkE;AAClE;;;;;;GAMG"}
|
package/dist/AuthManager.js
CHANGED
|
@@ -3,9 +3,31 @@
|
|
|
3
3
|
*
|
|
4
4
|
* @implements FR48, FR50, FR51
|
|
5
5
|
*/
|
|
6
|
+
import { Authenticator } from "./Authenticator.js";
|
|
6
7
|
import { WardenError } from "./errors.js";
|
|
8
|
+
import { sanitizePayload } from "./sanitize.js";
|
|
9
|
+
export { sanitizePayload };
|
|
7
10
|
import { MemoryRightsStore } from "./rights/MemoryRightsStore.js";
|
|
8
11
|
import { RightsResolver } from "./rights/RightsResolver.js";
|
|
12
|
+
/**
|
|
13
|
+
* The event namespace for a guard, taken from its DRIVER.
|
|
14
|
+
*
|
|
15
|
+
* AdonisJS namespaces auth events per driver — `session_auth:*`,
|
|
16
|
+
* `access_tokens_auth:*`, `basic_auth:*` — so an app can audit session logins
|
|
17
|
+
* without also hearing about every bearer token. Warden emitted `session_auth:*`
|
|
18
|
+
* whatever authenticated, which told a session listener about JWT traffic and
|
|
19
|
+
* left no name to subscribe to for the others.
|
|
20
|
+
*
|
|
21
|
+
* Driven by the strategy's `name` rather than the guard's config key: a guard
|
|
22
|
+
* called `web` running a `SessionStrategy` is still the session driver, exactly
|
|
23
|
+
* as upstream. A driver already ending in `_auth` (`basic_auth`) keeps its name
|
|
24
|
+
* rather than growing a second suffix, which is how AdonisJS spells it.
|
|
25
|
+
*/
|
|
26
|
+
export function authEventPrefix(driverName) {
|
|
27
|
+
if (!driverName)
|
|
28
|
+
return "session_auth";
|
|
29
|
+
return driverName.endsWith("_auth") ? driverName : `${driverName}_auth`;
|
|
30
|
+
}
|
|
9
31
|
/**
|
|
10
32
|
* Capability check for {@link AuthManager.issueFor}. `signToken` is not on the
|
|
11
33
|
* `AuthStrategy` interface (only token-minting strategies have it), so narrow
|
|
@@ -14,15 +36,43 @@ import { RightsResolver } from "./rights/RightsResolver.js";
|
|
|
14
36
|
function isTokenIssuer(strategy) {
|
|
15
37
|
return "signToken" in strategy && typeof strategy.signToken === "function";
|
|
16
38
|
}
|
|
17
|
-
/**
|
|
18
|
-
* Manages authentication strategies and provides guard/permission checks.
|
|
19
|
-
*/
|
|
20
39
|
export class AuthManager {
|
|
21
40
|
// AdonisJS names: `guards` (name → strategy) and `default` (the guard used
|
|
22
41
|
// when none is named). Renamed from the previous `strategies`/`defaultStrategy`.
|
|
23
42
|
guards = new Map();
|
|
24
43
|
default;
|
|
25
44
|
rights;
|
|
45
|
+
/**
|
|
46
|
+
* Where auth events go. Structural and optional: warden is a leaf and must
|
|
47
|
+
* not import an emitter — a host wires its own through `setEmitter`, and one
|
|
48
|
+
* that wires none simply gets no events.
|
|
49
|
+
*/
|
|
50
|
+
#emitter;
|
|
51
|
+
/**
|
|
52
|
+
* Publish auth events on `emitter`. AdonisJS emits six of them from its
|
|
53
|
+
* session guard, and an app that audits logins reads exactly those.
|
|
54
|
+
*/
|
|
55
|
+
setEmitter(emitter) {
|
|
56
|
+
this.#emitter = emitter;
|
|
57
|
+
return this;
|
|
58
|
+
}
|
|
59
|
+
/**
|
|
60
|
+
* Publish one auth event. Public so the per-request `Authenticator` can
|
|
61
|
+
* report what it observed — it holds the guard chain, the manager holds the
|
|
62
|
+
* emitter.
|
|
63
|
+
*/
|
|
64
|
+
emitAuthEvent(event, payload) {
|
|
65
|
+
this.#emit(event, payload);
|
|
66
|
+
}
|
|
67
|
+
/** Fire-and-forget: an event listener must never break authentication. */
|
|
68
|
+
#emit(event, payload) {
|
|
69
|
+
try {
|
|
70
|
+
void this.#emitter?.emit(event, payload);
|
|
71
|
+
}
|
|
72
|
+
catch {
|
|
73
|
+
// A throwing listener is the listener's problem, not the login's.
|
|
74
|
+
}
|
|
75
|
+
}
|
|
26
76
|
constructor(config) {
|
|
27
77
|
// Normalise the two accepted forms — AdonisJS `{ default, guards }` and
|
|
28
78
|
// the legacy `{ defaultStrategy, strategies }` — to the AdonisJS names.
|
|
@@ -148,6 +198,51 @@ export class AuthManager {
|
|
|
148
198
|
return (await this.resolvePermissions(user, scope)).hasAll(permissions);
|
|
149
199
|
}
|
|
150
200
|
/** Get a registered strategy by name. */
|
|
201
|
+
/**
|
|
202
|
+
* An {@link Authenticator} bound to one request (AdonisJS
|
|
203
|
+
* `createAuthenticator`).
|
|
204
|
+
*
|
|
205
|
+
* What the HTTP middleware builds per request. Exposed so anything outside
|
|
206
|
+
* that path — a console command acting as a user, a background job — can
|
|
207
|
+
* build one without reaching for the class.
|
|
208
|
+
*/
|
|
209
|
+
createAuthenticator(ctx) {
|
|
210
|
+
return new Authenticator(ctx, this);
|
|
211
|
+
}
|
|
212
|
+
/**
|
|
213
|
+
* What a test client needs to authenticate as a user (AdonisJS
|
|
214
|
+
* `createAuthenticatorClient`).
|
|
215
|
+
*
|
|
216
|
+
* Delegates to the guard's own `authenticateAsClient`, so a guard with no
|
|
217
|
+
* test seam says so instead of having one forged for it.
|
|
218
|
+
*/
|
|
219
|
+
createAuthenticatorClient() {
|
|
220
|
+
return {
|
|
221
|
+
use: (guard) => {
|
|
222
|
+
const strategy = this.getStrategy(guard);
|
|
223
|
+
const seam = strategy.authenticateAsClient?.bind(strategy);
|
|
224
|
+
if (!seam) {
|
|
225
|
+
throw new WardenError("STRATEGY_HAS_NO_CLIENT", `Auth strategy '${guard ?? this.default}' has no authenticateAsClient() — it cannot forge a client request.`, {
|
|
226
|
+
hint: "Implement authenticateAsClient() on the strategy, or authenticate through a real login in the test.",
|
|
227
|
+
});
|
|
228
|
+
}
|
|
229
|
+
return { authenticateAsClient: seam };
|
|
230
|
+
},
|
|
231
|
+
};
|
|
232
|
+
}
|
|
233
|
+
/**
|
|
234
|
+
* The event namespace a guard's events carry, resolved from its driver.
|
|
235
|
+
* Falls back to `session_auth` when the guard cannot be resolved, so a
|
|
236
|
+
* failure to look one up never becomes a second failure at emit time.
|
|
237
|
+
*/
|
|
238
|
+
eventPrefixFor(guardName) {
|
|
239
|
+
try {
|
|
240
|
+
return authEventPrefix(this.getStrategy(guardName).name);
|
|
241
|
+
}
|
|
242
|
+
catch {
|
|
243
|
+
return authEventPrefix(undefined);
|
|
244
|
+
}
|
|
245
|
+
}
|
|
151
246
|
getStrategy(name) {
|
|
152
247
|
const strategyName = name ?? this.default;
|
|
153
248
|
const strategy = this.guards.get(strategyName);
|
|
@@ -191,7 +286,17 @@ export class AuthManager {
|
|
|
191
286
|
hint: "login()/logout() need a stateful guard (e.g. SessionStrategy). JWT / API-key guards are stateless — mint a token with issueFor() instead.",
|
|
192
287
|
});
|
|
193
288
|
}
|
|
289
|
+
const prefix = authEventPrefix(strategy.name);
|
|
290
|
+
this.#emit(`${prefix}:login_attempted`, {
|
|
291
|
+
guardName: strategyName ?? this.default,
|
|
292
|
+
user,
|
|
293
|
+
});
|
|
194
294
|
await strategy.login(user, session);
|
|
295
|
+
this.#emit(`${prefix}:login_succeeded`, {
|
|
296
|
+
guardName: strategyName ?? this.default,
|
|
297
|
+
user,
|
|
298
|
+
sessionId: undefined,
|
|
299
|
+
});
|
|
195
300
|
}
|
|
196
301
|
/**
|
|
197
302
|
* Log a user out of a session-capable guard (AdonisJS `auth.use('web').logout()`
|
|
@@ -204,6 +309,11 @@ export class AuthManager {
|
|
|
204
309
|
throw new WardenError("STRATEGY_CANNOT_LOGIN", `Auth strategy '${strategyName ?? this.default}' does not support session logout.`);
|
|
205
310
|
}
|
|
206
311
|
await strategy.logout(session);
|
|
312
|
+
this.#emit(`${authEventPrefix(strategy.name)}:logged_out`, {
|
|
313
|
+
guardName: strategyName ?? this.default,
|
|
314
|
+
user: null,
|
|
315
|
+
error: null,
|
|
316
|
+
});
|
|
207
317
|
}
|
|
208
318
|
}
|
|
209
319
|
/**
|
|
@@ -225,11 +335,4 @@ function isLoginCapable(strategy) {
|
|
|
225
335
|
* directly (not `AuthManager.verify`), so without this it would skip
|
|
226
336
|
* the guard JWT / api-key users get.
|
|
227
337
|
*/
|
|
228
|
-
export function sanitizePayload(user) {
|
|
229
|
-
for (const key of ["__proto__", "constructor", "prototype"]) {
|
|
230
|
-
if (key in user) {
|
|
231
|
-
delete user[key];
|
|
232
|
-
}
|
|
233
|
-
}
|
|
234
|
-
}
|
|
235
338
|
//# sourceMappingURL=AuthManager.js.map
|
package/dist/AuthManager.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"AuthManager.js","sourceRoot":"","sources":["../src/AuthManager.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;
|
|
1
|
+
{"version":3,"file":"AuthManager.js","sourceRoot":"","sources":["../src/AuthManager.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,OAAO,EAAE,eAAe,EAAE,CAAC;AAE3B,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAyC5D;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe,CAAC,UAA8B;IAC7D,IAAI,CAAC,UAAU;QAAE,OAAO,cAAc,CAAC;IACvC,OAAO,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,OAAO,CAAC;AACzE,CAAC;AAmDD;;;;GAIG;AACH,SAAS,aAAa,CACrB,QAAsB;IAEtB,OAAO,WAAW,IAAI,QAAQ,IAAI,OAAO,QAAQ,CAAC,SAAS,KAAK,UAAU,CAAC;AAC5E,CAAC;AAaD,MAAM,OAAO,WAAW;IACvB,2EAA2E;IAC3E,iFAAiF;IACzE,MAAM,GAA8B,IAAI,GAAG,EAAE,CAAC;IAC9C,OAAO,CAAS;IACP,MAAM,CAAiB;IAExC;;;;OAIG;IACH,QAAQ,CAA4B;IAEpC;;;OAGG;IACH,UAAU,CAAC,OAAsB;QAChC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,OAAO,IAAI,CAAC;IACb,CAAC;IAED;;;;OAIG;IACH,aAAa,CAAC,KAAa,EAAE,OAAgC;QAC5D,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC5B,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,KAAa,EAAE,OAAgC;QACpD,IAAI,CAAC;YACJ,KAAK,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACR,kEAAkE;QACnE,CAAC;IACF,CAAC;IAED,YAAY,MAAkB;QAC7B,wEAAwE;QACxE,wEAAwE;QACxE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC;QAClD,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,eAAe,CAAC;QAC9D,IAAI,CAAC,MAAM,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC3C,MAAM,IAAI,WAAW,CACpB,gBAAgB,EAChB,wGAAwG,CACxG,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,YAAY,CAAC;QAC5B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,cAAc,CAAC,IAAI,iBAAiB,EAAE,CAAC,CAAC;QAC3E,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACvD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACjC,CAAC;QACD,kEAAkE;QAClE,kEAAkE;QAClE,iEAAiE;QACjE,sEAAsE;QACtE,wEAAwE;QACxE,sCAAsC;QACtC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,WAAW,CACpB,gBAAgB,EAChB,6IAA6I,CAC7I,CAAC;QACH,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,WAAW,CACpB,gBAAgB,EAChB,kBAAkB,YAAY,4BAA4B,CAC1D,CAAC;QACH,CAAC;IACF,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,YAAY,CACjB,WAAoC,EACpC,YAAqB;QAErB,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAChD,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;YACxD,IAAI,MAAM,CAAC,IAAI;gBAAE,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC9C,OAAO,MAAM,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,oEAAoE;YACpE,qEAAqE;YACrE,kEAAkE;YAClE,IAAI,GAAG,YAAY,WAAW;gBAAE,MAAM,GAAG,CAAC;YAC1C,OAAO;gBACN,aAAa,EAAE,KAAK;gBACpB,KAAK,EACJ,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B;aACpE,CAAC;QACH,CAAC;IACF,CAAC;IAED,8CAA8C;IAC9C,KAAK,CAAC,MAAM,CACX,KAAa,EACb,YAAqB,EACrB,OAAiC;QAEjC,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAChD,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACrD,IAAI,MAAM,CAAC,IAAI;gBAAE,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC9C,OAAO,MAAM,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,mEAAmE;YACnE,mEAAmE;YACnE,sEAAsE;YACtE,IAAI,GAAG,YAAY,WAAW;gBAAE,MAAM,GAAG,CAAC;YAC1C,OAAO;gBACN,aAAa,EAAE,KAAK;gBACpB,KAAK,EACJ,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,4BAA4B;gBAClE,aAAa,EAAE,IAAI;aACnB,CAAC;QACH,CAAC;IACF,CAAC;IAED;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,IAAiB,EAAE,YAAqB;QAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAChD,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,WAAW,CACpB,uBAAuB,EACvB,kBAAkB,YAAY,IAAI,IAAI,CAAC,OAAO,wBAAwB,EACtE;gBACC,IAAI,EAAE,8HAA8H;aACpI,CACD,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;;OAOG;IACH,kBAAkB,CACjB,IAAiB,EACjB,QAAe,QAAQ;QAEvB,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CACZ,IAAiB,EACjB,IAAY,EACZ,QAAe,QAAQ;QAEvB,OAAO,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,aAAa,CAClB,IAAiB,EACjB,UAAkB,EAClB,QAAe,QAAQ;QAEvB,OAAO,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACrE,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,iBAAiB,CACtB,IAAiB,EACjB,WAAqB,EACrB,QAAe,QAAQ;QAEvB,OAAO,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACzE,CAAC;IAED,yCAAyC;IACzC;;;;;;;OAOG;IACH,mBAAmB,CAAC,GAAkB;QACrC,OAAO,IAAI,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACrC,CAAC;IAED;;;;;;OAMG;IACH,yBAAyB;QAOxB,OAAO;YACN,GAAG,EAAE,CAAC,KAAc,EAAE,EAAE;gBACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;gBACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,oBAAoB,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAC3D,IAAI,CAAC,IAAI,EAAE,CAAC;oBACX,MAAM,IAAI,WAAW,CACpB,wBAAwB,EACxB,kBAAkB,KAAK,IAAI,IAAI,CAAC,OAAO,qEAAqE,EAC5G;wBACC,IAAI,EAAE,qGAAqG;qBAC3G,CACD,CAAC;gBACH,CAAC;gBACD,OAAO,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC;YACvC,CAAC;SACD,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,cAAc,CAAC,SAAkB;QAChC,IAAI,CAAC;YACJ,OAAO,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,eAAe,CAAC,SAAS,CAAC,CAAC;QACnC,CAAC;IACF,CAAC;IAED,WAAW,CAAC,IAAa;QACxB,MAAM,YAAY,GAAG,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,MAAM,IAAI,WAAW,CACpB,oBAAoB,EACpB,kBAAkB,YAAY,kBAAkB,EAChD;gBACC,IAAI,EAAE,0DAA0D;aAChE,CACD,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED;;;;OAIG;IACH,IAAI,mBAAmB;QACtB,OAAO,IAAI,CAAC,OAAO,CAAC;IACrB,CAAC;IAED,0CAA0C;IAC1C,gBAAgB,CAAC,IAAY,EAAE,QAAsB;QACpD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACjC,CAAC;IAED,yCAAyC;IACzC,gBAAgB;QACf,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAChC,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,KAAK,CACV,IAAiB,EACjB,OAAqB,EACrB,YAAqB;QAErB,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAChD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,WAAW,CACpB,uBAAuB,EACvB,kBAAkB,YAAY,IAAI,IAAI,CAAC,OAAO,mCAAmC,EACjF;gBACC,IAAI,EAAE,2IAA2I;aACjJ,CACD,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK,CAAC,GAAG,MAAM,kBAAkB,EAAE;YACvC,SAAS,EAAE,YAAY,IAAI,IAAI,CAAC,OAAO;YACvC,IAAI;SACJ,CAAC,CAAC;QACH,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,CAAC,GAAG,MAAM,kBAAkB,EAAE;YACvC,SAAS,EAAE,YAAY,IAAI,IAAI,CAAC,OAAO;YACvC,IAAI;YACJ,SAAS,EAAE,SAAS;SACpB,CAAC,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,OAAqB,EAAE,YAAqB;QACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAChD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,WAAW,CACpB,uBAAuB,EACvB,kBAAkB,YAAY,IAAI,IAAI,CAAC,OAAO,oCAAoC,CAClF,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,GAAG,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE;YAC1D,SAAS,EAAE,YAAY,IAAI,IAAI,CAAC,OAAO;YACvC,IAAI,EAAE,IAAI;YACV,KAAK,EAAE,IAAI;SACX,CAAC,CAAC;IACJ,CAAC;CACD;AAQD;;;;GAIG;AACH,SAAS,cAAc,CACtB,QAAsB;IAEtB,OAAO,CACN,OAAO,IAAI,QAAQ;QACnB,OAAO,QAAQ,CAAC,KAAK,KAAK,UAAU;QACpC,QAAQ,IAAI,QAAQ;QACpB,OAAO,QAAQ,CAAC,MAAM,KAAK,UAAU,CACrC,CAAC;AACH,CAAC;AAED,kEAAkE;AAClE;;;;;;GAMG"}
|
package/dist/Authenticator.d.ts
CHANGED
|
@@ -13,7 +13,7 @@
|
|
|
13
13
|
* (resolved via `ctx.containerResolver`) + the request `ctx`; it never imports
|
|
14
14
|
* `@c9up/ream`.
|
|
15
15
|
*/
|
|
16
|
-
import {
|
|
16
|
+
import type { AuthManager, AuthResult, UserPayload } from "./AuthManager.js";
|
|
17
17
|
import type { WardenContext } from "./middleware.js";
|
|
18
18
|
import type { SessionStore } from "./strategies/SessionStrategy.js";
|
|
19
19
|
/**
|
|
@@ -105,6 +105,18 @@ export declare class Authenticator {
|
|
|
105
105
|
* propagates (a server incident must not be silently swallowed as "guest").
|
|
106
106
|
*/
|
|
107
107
|
check(): Promise<boolean>;
|
|
108
|
+
/**
|
|
109
|
+
* Try the given guards in order and report whether one succeeded, without
|
|
110
|
+
* throwing (AdonisJS `checkUsing`).
|
|
111
|
+
*
|
|
112
|
+
* The non-throwing sibling of {@link authenticateUsing}: `check()` is to
|
|
113
|
+
* `authenticate()` what this is to it. A handler that wants to branch on
|
|
114
|
+
* "is anyone signed in through either of these" had to wrap the throwing
|
|
115
|
+
* form in a try/catch itself.
|
|
116
|
+
*/
|
|
117
|
+
checkUsing(guards?: string[], options?: {
|
|
118
|
+
loginRoute?: string;
|
|
119
|
+
}): Promise<boolean>;
|
|
108
120
|
/**
|
|
109
121
|
* Authenticate by trying the given guards in order (default: the default
|
|
110
122
|
* guard). Sets the user on the first success; throws `E_UNAUTHORIZED_ACCESS`
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"Authenticator.d.ts","sourceRoot":"","sources":["../src/Authenticator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,
|
|
1
|
+
{"version":3,"file":"Authenticator.d.ts","sourceRoot":"","sources":["../src/Authenticator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EACX,WAAW,EACX,UAAU,EAEV,WAAW,EACX,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAErD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAEpE;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAGhD,CAAC;AAcF,iFAAiF;AACjF,MAAM,WAAW,oBAAoB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,YAAY,GAAG,SAAS,CAAC;CAClC;AAoBD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CACjC,GAAG,EAAE,aAAa,EAClB,IAAI,EAAE,WAAW,GACf,oBAAoB,CAUtB;AAED,0CAA0C;AAC1C,MAAM,WAAW,WAAW;IAC3B,MAAM,EAAE,UAAU,GAAG,IAAI,CAAC;IAC1B,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACpC,IAAI,EAAE,WAAW,EACjB,UAAU,EAAE,MAAM,EAAE,EACpB,KAAK,EAAE;IACN,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,YAAY,GAAG,SAAS,CAAC;IAClC,kBAAkB,EAAE,OAAO,CAAC;CAC5B,GACC,OAAO,CAAC,WAAW,CAAC,CAyDtB;AAED;;;GAGG;AACH,qBAAa,aAAa;;gBAOxB,GAAG,EAAE,aAAa,EAClB,IAAI,EAAE,WAAW,EACjB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,aAAa;IAQtB,kEAAkE;IAClE,IAAI,IAAI,IAAI,WAAW,GAAG,SAAS,CAIlC;IAED,IAAI,eAAe,IAAI,OAAO,CAE7B;IAED,0EAA0E;IAC1E,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAI7B,yDAAyD;IACzD,KAAK,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvC,+DAA+D;IAC/D,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;CAavB;AAED;;;;;GAKG;AACH,qBAAa,aAAa;;gBAQb,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,WAAW;IAKjD,0DAA0D;IAC1D,IAAI,IAAI,IAAI,WAAW,GAAG,SAAS,CAElC;IAED,qEAAqE;IACrE,IAAI,eAAe,IAAI,OAAO,CAE7B;IAED,2EAA2E;IAC3E,IAAI,uBAAuB,IAAI,OAAO,CAErC;IAED,gEAAgE;IAChE,IAAI,qBAAqB,IAAI,MAAM,GAAG,SAAS,CAE9C;IAED;;;;OAIG;IACH,IAAI,KAAK,IAAI,MAAM,EAAE,GAAG,SAAS,CAEhC;IAED,+EAA+E;IAC/E,IAAI,WAAW,IAAI,MAAM,EAAE,GAAG,SAAS,CAEtC;IAED,qFAAqF;IACrF,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAI7B;;;;OAIG;IACG,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC;IAU/B;;;;;;;;OAQG;IACG,UAAU,CACf,MAAM,CAAC,EAAE,MAAM,EAAE,EACjB,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/B,OAAO,CAAC,OAAO,CAAC;IAanB;;;;;OAKG;IACG,iBAAiB,CACtB,MAAM,CAAC,EAAE,MAAM,EAAE,EACjB,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/B,OAAO,CAAC,IAAI,CAAC;IAuDhB,sEAAsE;IACtE,aAAa,IAAI,WAAW;IAU5B,2FAA2F;IAC3F,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa;IAShC;;;;OAIG;IACH,KAAK,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI;CAOpE"}
|
package/dist/Authenticator.js
CHANGED
|
@@ -13,8 +13,8 @@
|
|
|
13
13
|
* (resolved via `ctx.containerResolver`) + the request `ctx`; it never imports
|
|
14
14
|
* `@c9up/ream`.
|
|
15
15
|
*/
|
|
16
|
-
import { sanitizePayload, } from "./AuthManager.js";
|
|
17
16
|
import { E_UNAUTHORIZED_ACCESS, WardenError } from "./errors.js";
|
|
17
|
+
import { sanitizePayload } from "./sanitize.js";
|
|
18
18
|
/**
|
|
19
19
|
* Guard names Warden accepts for the API-key / access-tokens driver. AdonisJS
|
|
20
20
|
* names the driver `access_tokens`; the legacy `api-key` spelling stays valid so
|
|
@@ -234,6 +234,29 @@ export class Authenticator {
|
|
|
234
234
|
throw err;
|
|
235
235
|
}
|
|
236
236
|
}
|
|
237
|
+
/**
|
|
238
|
+
* Try the given guards in order and report whether one succeeded, without
|
|
239
|
+
* throwing (AdonisJS `checkUsing`).
|
|
240
|
+
*
|
|
241
|
+
* The non-throwing sibling of {@link authenticateUsing}: `check()` is to
|
|
242
|
+
* `authenticate()` what this is to it. A handler that wants to branch on
|
|
243
|
+
* "is anyone signed in through either of these" had to wrap the throwing
|
|
244
|
+
* form in a try/catch itself.
|
|
245
|
+
*/
|
|
246
|
+
async checkUsing(guards, options) {
|
|
247
|
+
try {
|
|
248
|
+
await this.authenticateUsing(guards, options);
|
|
249
|
+
return this.isAuthenticated;
|
|
250
|
+
}
|
|
251
|
+
catch (err) {
|
|
252
|
+
// A credential rejection is an answer, not a failure. Anything else
|
|
253
|
+
// — a crashed strategy, a config error — is still a real problem and
|
|
254
|
+
// must not be reported as "not signed in".
|
|
255
|
+
if (err instanceof E_UNAUTHORIZED_ACCESS)
|
|
256
|
+
return false;
|
|
257
|
+
throw err;
|
|
258
|
+
}
|
|
259
|
+
}
|
|
237
260
|
/**
|
|
238
261
|
* Authenticate by trying the given guards in order (default: the default
|
|
239
262
|
* guard). Sets the user on the first success; throws `E_UNAUTHORIZED_ACCESS`
|
|
@@ -243,6 +266,11 @@ export class Authenticator {
|
|
|
243
266
|
async authenticateUsing(guards, options) {
|
|
244
267
|
this.#attempted = true;
|
|
245
268
|
const names = guards && guards.length > 0 ? guards : [this.#auth.defaultStrategyName];
|
|
269
|
+
const guardName = names[0] ?? this.#auth.defaultStrategyName;
|
|
270
|
+
// Namespaced by the guard's driver, as AdonisJS does: `session_auth:*`,
|
|
271
|
+
// `access_tokens_auth:*`, `basic_auth:*`. An app auditing session logins
|
|
272
|
+
// must not be told about bearer-token traffic under the same name.
|
|
273
|
+
this.#auth.emitAuthEvent(`${this.#auth.eventPrefixFor(guardName)}:authentication_attempted`, { guardName });
|
|
246
274
|
const creds = extractCredentials(this.#ctx, this.#auth);
|
|
247
275
|
const hasSessionStrategy = names.includes("session");
|
|
248
276
|
const { result, viaGuard, attemptCount, crashCount } = await tryAuthenticate(this.#auth, names, {
|
|
@@ -252,6 +280,10 @@ export class Authenticator {
|
|
|
252
280
|
if (result?.authenticated && result.user) {
|
|
253
281
|
this.#user = result.user;
|
|
254
282
|
this.#viaGuard = viaGuard;
|
|
283
|
+
// The guard that actually answered names the event, not the one asked
|
|
284
|
+
// for first.
|
|
285
|
+
const winner = viaGuard ?? guardName;
|
|
286
|
+
this.#auth.emitAuthEvent(`${this.#auth.eventPrefixFor(winner)}:authentication_succeeded`, { guardName: winner, user: result.user, sessionId: undefined });
|
|
255
287
|
return;
|
|
256
288
|
}
|
|
257
289
|
// Every attempted guard crashed → a server-side incident, not a
|
|
@@ -259,10 +291,12 @@ export class Authenticator {
|
|
|
259
291
|
if (attemptCount > 0 && crashCount === attemptCount) {
|
|
260
292
|
throw new WardenError("AUTH_STRATEGY_ERROR", "Authentication unavailable — one or more strategies failed. Check server logs.", { status: 500 });
|
|
261
293
|
}
|
|
262
|
-
|
|
263
|
-
guardDriverName:
|
|
294
|
+
const failure = new E_UNAUTHORIZED_ACCESS(result?.error ?? "Unauthorized access", {
|
|
295
|
+
guardDriverName: guardName,
|
|
264
296
|
redirectTo: hasSessionStrategy ? options?.loginRoute : undefined,
|
|
265
297
|
});
|
|
298
|
+
this.#auth.emitAuthEvent(`${this.#auth.eventPrefixFor(guardName)}:authentication_failed`, { guardName, error: failure });
|
|
299
|
+
throw failure;
|
|
266
300
|
}
|
|
267
301
|
/** Return the authenticated user or throw `E_UNAUTHORIZED_ACCESS`. */
|
|
268
302
|
getUserOrFail() {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"Authenticator.js","sourceRoot":"","sources":["../src/Authenticator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;
|
|
1
|
+
{"version":3,"file":"Authenticator.js","sourceRoot":"","sources":["../src/Authenticator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAQH,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEjE,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAGhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAsB;IACrD,eAAe;IACf,SAAS;CACT,CAAC;AAMF,SAAS,oBAAoB,CAC5B,QAAsB;IAEtB,OAAO,CACN,OAAQ,QAAgC,CAAC,iBAAiB,KAAK,UAAU,CACzE,CAAC;AACH,CAAC;AASD;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,IAAiB;IAC7C,KAAK,MAAM,IAAI,IAAI,mBAAmB,EAAE,CAAC;QACxC,IAAI,CAAC;YACJ,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,MAAM,GAAG,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,MAAM,CAAC;QACpE,CAAC;QAAC,MAAM,CAAC;YACR,uDAAuD;QACxD,CAAC;IACF,CAAC;IACD,OAAO,WAAW,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CACjC,GAAkB,EAClB,IAAiB;IAEjB,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IACtC,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;IAC/C,MAAM,WAAW,GAAG,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC;QACnD,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;QACrB,CAAC,CAAC,EAAE,CAAC;IACN,4EAA4E;IAC5E,6DAA6D;IAC7D,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IACtE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;AACtD,CAAC;AAWD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACpC,IAAiB,EACjB,UAAoB,EACpB,KAKC;IAED,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC/C,IAAI,MAAM,GAAsB,IAAI,CAAC;IACrC,IAAI,QAA4B,CAAC;IACjC,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,KAAK,MAAM,YAAY,IAAI,UAAU,EAAE,CAAC;QACvC,IAAI,CAAC;YACJ,IAAI,CAAa,CAAC;YAClB,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;gBAChD,MAAM,iBAAiB,GACtB,QAAQ,IAAI,oBAAoB,CAAC,QAAQ,CAAC;oBACzC,CAAC,CAAC,QAAQ,CAAC,iBAAiB;oBAC5B,CAAC,CAAC,SAAS,CAAC;gBACd,IAAI,iBAAiB,EAAE,CAAC;oBACvB,YAAY,EAAE,CAAC;oBACf,CAAC,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;oBAC5D,+DAA+D;oBAC/D,gEAAgE;oBAChE,IAAI,CAAC,CAAC,IAAI;wBAAE,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACrC,CAAC;qBAAM,CAAC;oBACP,SAAS;gBACV,CAAC;YACF,CAAC;iBAAM,CAAC;gBACP,4DAA4D;gBAC5D,+DAA+D;gBAC/D,iEAAiE;gBACjE,MAAM,UAAU,GAAG,mBAAmB,CAAC,QAAQ,CAAC,YAAY,CAAC;oBAC5D,CAAC,CAAC,MAAM,IAAI,WAAW;oBACvB,CAAC,CAAC,WAAW,IAAI,MAAM,CAAC;gBACzB,IAAI,CAAC,UAAU;oBAAE,SAAS;gBAC1B,YAAY,EAAE,CAAC;gBACf,CAAC,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;YACjD,CAAC;YACD,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC;gBACrB,MAAM,GAAG,CAAC,CAAC;gBACX,QAAQ,GAAG,YAAY,CAAC;gBACxB,MAAM;YACP,CAAC;YACD,IAAI,CAAC,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;gBAC9B,UAAU,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CACZ,sBAAsB,YAAY,4BAA4B,CAAC,CAAC,KAAK,IAAI,eAAe,EAAE,CAC1F,CAAC;YACH,CAAC;QACF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,sEAAsE;YACtE,mEAAmE;YACnE,UAAU,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CACZ,sBAAsB,YAAY,0BAA0B,EAC5D,GAAG,CACH,CAAC;QACH,CAAC;IACF,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,aAAa;IAChB,IAAI,CAAgB;IACpB,KAAK,CAAc;IACnB,KAAK,CAAS;IACd,OAAO,CAAgB;IAEhC,YACC,GAAkB,EAClB,IAAiB,EACjB,IAAY,EACZ,MAAqB;QAErB,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;QAChB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,kEAAkE;IAClE,IAAI,IAAI;QACP,OAAO,IAAI,CAAC,OAAO,CAAC,qBAAqB,KAAK,IAAI,CAAC,KAAK;YACvD,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI;YACnB,CAAC,CAAC,SAAS,CAAC;IACd,CAAC;IAED,IAAI,eAAe;QAClB,OAAO,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC;IAChC,CAAC;IAED,0EAA0E;IAC1E,YAAY;QACX,OAAO,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,yDAAyD;IACzD,KAAK,CAAC,IAAiB;QACtB,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,eAAe,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACnE,CAAC;IAED,+DAA+D;IAC/D,MAAM;QACL,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9D,CAAC;IAED,eAAe;QACd,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACxB,MAAM,IAAI,WAAW,CACpB,YAAY,EACZ,UAAU,IAAI,CAAC,KAAK,4GAA4G,CAChI,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;IAC1B,CAAC;CACD;AAED;;;;;GAKG;AACH,MAAM,OAAO,aAAa;IAChB,IAAI,CAAgB;IACpB,KAAK,CAAc;IAC5B,KAAK,CAAe;IACpB,SAAS,CAAU;IACnB,UAAU,GAAG,KAAK,CAAC;IACV,WAAW,GAAG,IAAI,GAAG,EAAyB,CAAC;IAExD,YAAY,GAAkB,EAAE,IAAiB;QAChD,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;QAChB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,0DAA0D;IAC1D,IAAI,IAAI;QACP,OAAO,IAAI,CAAC,KAAK,CAAC;IACnB,CAAC;IAED,qEAAqE;IACrE,IAAI,eAAe;QAClB,OAAO,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC;IACjC,CAAC;IAED,2EAA2E;IAC3E,IAAI,uBAAuB;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC;IACxB,CAAC;IAED,gEAAgE;IAChE,IAAI,qBAAqB;QACxB,OAAO,IAAI,CAAC,SAAS,CAAC;IACvB,CAAC;IAED;;;;OAIG;IACH,IAAI,KAAK;QACR,OAAO,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC;IAC1B,CAAC;IAED,+EAA+E;IAC/E,IAAI,WAAW;QACd,OAAO,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC;IAChC,CAAC;IAED,qFAAqF;IACrF,YAAY;QACX,OAAO,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACjE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK;QACV,IAAI,CAAC;YACJ,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,eAAe,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,GAAG,YAAY,qBAAqB;gBAAE,OAAO,KAAK,CAAC;YACvD,MAAM,GAAG,CAAC;QACX,CAAC;IACF,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,UAAU,CACf,MAAiB,EACjB,OAAiC;QAEjC,IAAI,CAAC;YACJ,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC9C,OAAO,IAAI,CAAC,eAAe,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,oEAAoE;YACpE,qEAAqE;YACrE,2CAA2C;YAC3C,IAAI,GAAG,YAAY,qBAAqB;gBAAE,OAAO,KAAK,CAAC;YACvD,MAAM,GAAG,CAAC;QACX,CAAC;IACF,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,iBAAiB,CACtB,MAAiB,EACjB,OAAiC;QAEjC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,MAAM,KAAK,GACV,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACzE,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC;QAC7D,wEAAwE;QACxE,yEAAyE;QACzE,mEAAmE;QACnE,IAAI,CAAC,KAAK,CAAC,aAAa,CACvB,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,2BAA2B,EAClE,EAAE,SAAS,EAAE,CACb,CAAC;QACF,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACxD,MAAM,kBAAkB,GAAG,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACrD,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,GACnD,MAAM,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE;YACxC,GAAG,KAAK;YACR,kBAAkB;SAClB,CAAC,CAAC;QAEJ,IAAI,MAAM,EAAE,aAAa,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAC1C,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC;YACzB,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;YAC1B,sEAAsE;YACtE,aAAa;YACb,MAAM,MAAM,GAAG,QAAQ,IAAI,SAAS,CAAC;YACrC,IAAI,CAAC,KAAK,CAAC,aAAa,CACvB,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,2BAA2B,EAC/D,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAC9D,CAAC;YACF,OAAO;QACR,CAAC;QACD,gEAAgE;QAChE,0EAA0E;QAC1E,IAAI,YAAY,GAAG,CAAC,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;YACrD,MAAM,IAAI,WAAW,CACpB,qBAAqB,EACrB,gFAAgF,EAChF,EAAE,MAAM,EAAE,GAAG,EAAE,CACf,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,qBAAqB,CACxC,MAAM,EAAE,KAAK,IAAI,qBAAqB,EACtC;YACC,eAAe,EAAE,SAAS;YAC1B,UAAU,EAAE,kBAAkB,CAAC,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,SAAS;SAChE,CACD,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,aAAa,CACvB,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,wBAAwB,EAC/D,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,CAC7B,CAAC;QACF,MAAM,OAAO,CAAC;IACf,CAAC;IAED,sEAAsE;IACtE,aAAa;QACZ,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YACjB,MAAM,IAAI,qBAAqB,CAC9B,yEAAyE,EACzE,EAAE,eAAe,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE,CACrE,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC;IACnB,CAAC;IAED,2FAA2F;IAC3F,GAAG,CAAC,IAAY;QACf,IAAI,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,QAAQ,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YAChE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAyB,EAAE,QAA4B;QAC5D,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,IAAI,MAAM,EAAE,aAAa,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAC1C,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC;YACzB,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;QAC3B,CAAC;IACF,CAAC;CACD"}
|