@cauthyhq/node 0.0.0 → 1.0.0

package/dist/next.mjs

@@ -0,0 +1,52 @@
+// src/next.ts
+import { headers } from "next/headers";
+import { NextResponse } from "next/server";
+function cookiesAfter(header, setCookies) {
+  const jar = /* @__PURE__ */ new Map();
+  for (const part of (header ?? "").split(";")) {
+    const i = part.indexOf("=");
+    if (i > 0) jar.set(part.slice(0, i).trim(), part.slice(i + 1).trim());
+  }
+  for (const c of setCookies) {
+    const [pair, ...attrs] = c.split("; ");
+    const i = pair.indexOf("=");
+    if (i <= 0) continue;
+    if (pair.slice(i + 1) === "" || attrs.some((a) => a.toLowerCase() === "max-age=0")) jar.delete(pair.slice(0, i));
+    else jar.set(pair.slice(0, i), pair.slice(i + 1));
+  }
+  return [...jar].map(([k, v]) => `${k}=${v}`).join("; ");
+}
+function cauthyNext(auth) {
+  const base = auth.options.basePath;
+  return {
+    GET: (request) => auth.handler(request),
+    POST: (request) => auth.handler(request),
+    async session() {
+      const h = await headers();
+      const origin = `${h.get("x-forwarded-proto") ?? "http"}://${h.get("x-forwarded-host") ?? h.get("host") ?? "localhost"}`;
+      return auth.getSession(new Request(`${origin}/`, { headers: new Headers(h) }));
+    },
+    middleware(options = {}) {
+      return async (request) => {
+        const url = new URL(request.url);
+        if (url.pathname === base || url.pathname.startsWith(`${base}/`)) return NextResponse.next();
+        const resolved = await auth.resolve(request);
+        if (resolved.session === null && options.protect?.(url.pathname)) {
+          const to = NextResponse.redirect(new URL(auth.urls.signIn(url.pathname + url.search), url));
+          for (const c of resolved.cookies) to.headers.append("set-cookie", c);
+          return to;
+        }
+        if (resolved.cookies.length === 0) return NextResponse.next();
+        const forwarded = new Headers(request.headers);
+        forwarded.set("cookie", cookiesAfter(request.headers.get("cookie"), resolved.cookies));
+        const on = NextResponse.next({ request: { headers: forwarded } });
+        for (const c of resolved.cookies) on.headers.append("set-cookie", c);
+        return on;
+      };
+    }
+  };
+}
+export {
+  cauthyNext
+};
+//# sourceMappingURL=next.mjs.map

package/dist/next.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/next.ts"],"sourcesContent":["// Next.js (App Router): the routes, who is signed in on the server, and a\n// middleware that keeps the session renewed.\n//\n//   // lib/auth.ts\n//   export const auth = createCauthy()\n//   export const cauthy = cauthyNext(auth)\n//\n//   // app/api/auth/[...cauthy]/route.ts\n//   export const { GET, POST } = cauthy\n//\n//   // middleware.ts\n//   export default cauthy.middleware({ protect: (path) => path.startsWith('/app') })\n//\n//   // a server component, a route handler, a server action\n//   const session = await cauthy.session()\n\nimport { headers } from 'next/headers'\nimport { NextResponse } from 'next/server'\nimport type { Cauthy } from './cauthy'\nimport type { Session } from './types'\n\nexport interface CauthyMiddlewareOptions {\n  /** The pages only a signed-in person may see: anybody else is sent to sign in, and back. */\n  protect?: (pathname: string) => boolean\n}\n\nexport interface CauthyNext {\n  GET(request: Request): Promise<Response>\n  POST(request: Request): Promise<Response>\n  /**\n   * Who is signed in, or null: in a server component, a route handler or a\n   * server action. A server component cannot set a cookie, so renewing an\n   * expired session is the middleware's job: use `middleware()`.\n   */\n  session(): Promise<Session | null>\n  /** For `middleware.ts`: renews the session when it has to be, and guards the pages named in `protect`. */\n  middleware(options?: CauthyMiddlewareOptions): (request: Request) => Promise<Response>\n}\n\n/** The request's cookies with the ones a response sets applied, as the browser's next request would carry them. */\nfunction cookiesAfter(header: string | null, setCookies: string[]): string {\n  const jar = new Map<string, string>()\n  for (const part of (header ?? '').split(';')) {\n    const i = part.indexOf('=')\n    if (i > 0) jar.set(part.slice(0, i).trim(), part.slice(i + 1).trim())\n  }\n  for (const c of setCookies) {\n    const [pair, ...attrs] = c.split('; ')\n    const i = pair.indexOf('=')\n    if (i <= 0) continue\n    if (pair.slice(i + 1) === '' || attrs.some((a) => a.toLowerCase() === 'max-age=0')) jar.delete(pair.slice(0, i))\n    else jar.set(pair.slice(0, i), pair.slice(i + 1))\n  }\n  return [...jar].map(([k, v]) => `${k}=${v}`).join('; ')\n}\n\nexport function cauthyNext(auth: Cauthy): CauthyNext {\n  const base = auth.options.basePath\n  return {\n    GET: (request) => auth.handler(request),\n    POST: (request) => auth.handler(request),\n\n    async session() {\n      const h = await headers()\n      const origin = `${h.get('x-forwarded-proto') ?? 'http'}://${h.get('x-forwarded-host') ?? h.get('host') ?? 'localhost'}`\n      return auth.getSession(new Request(`${origin}/`, { headers: new Headers(h) }))\n    },\n\n    middleware(options = {}) {\n      return async (request) => {\n        const url = new URL(request.url)\n        // The routes renew and clear the session themselves.\n        if (url.pathname === base || url.pathname.startsWith(`${base}/`)) return NextResponse.next()\n\n        const resolved = await auth.resolve(request)\n        if (resolved.session === null && options.protect?.(url.pathname)) {\n          const to = NextResponse.redirect(new URL(auth.urls.signIn(url.pathname + url.search), url))\n          for (const c of resolved.cookies) to.headers.append('set-cookie', c)\n          return to\n        }\n        if (resolved.cookies.length === 0) return NextResponse.next()\n\n        // Renewed: the browser gets the new cookie, and so does what renders\n        // this very request, which would otherwise still read the old one.\n        const forwarded = new Headers(request.headers)\n        forwarded.set('cookie', cookiesAfter(request.headers.get('cookie'), resolved.cookies))\n        const on = NextResponse.next({ request: { headers: forwarded } })\n        for (const c of resolved.cookies) on.headers.append('set-cookie', c)\n        return on\n      }\n    },\n  }\n}\n"],"mappings":";AAgBA,SAAS,eAAe;AACxB,SAAS,oBAAoB;AAuB7B,SAAS,aAAa,QAAuB,YAA8B;AACzE,QAAM,MAAM,oBAAI,IAAoB;AACpC,aAAW,SAAS,UAAU,IAAI,MAAM,GAAG,GAAG;AAC5C,UAAM,IAAI,KAAK,QAAQ,GAAG;AAC1B,QAAI,IAAI,EAAG,KAAI,IAAI,KAAK,MAAM,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,MAAM,IAAI,CAAC,EAAE,KAAK,CAAC;AAAA,EACtE;AACA,aAAW,KAAK,YAAY;AAC1B,UAAM,CAAC,MAAM,GAAG,KAAK,IAAI,EAAE,MAAM,IAAI;AACrC,UAAM,IAAI,KAAK,QAAQ,GAAG;AAC1B,QAAI,KAAK,EAAG;AACZ,QAAI,KAAK,MAAM,IAAI,CAAC,MAAM,MAAM,MAAM,KAAK,CAAC,MAAM,EAAE,YAAY,MAAM,WAAW,EAAG,KAAI,OAAO,KAAK,MAAM,GAAG,CAAC,CAAC;AAAA,QAC1G,KAAI,IAAI,KAAK,MAAM,GAAG,CAAC,GAAG,KAAK,MAAM,IAAI,CAAC,CAAC;AAAA,EAClD;AACA,SAAO,CAAC,GAAG,GAAG,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,IAAI;AACxD;AAEO,SAAS,WAAW,MAA0B;AACnD,QAAM,OAAO,KAAK,QAAQ;AAC1B,SAAO;AAAA,IACL,KAAK,CAAC,YAAY,KAAK,QAAQ,OAAO;AAAA,IACtC,MAAM,CAAC,YAAY,KAAK,QAAQ,OAAO;AAAA,IAEvC,MAAM,UAAU;AACd,YAAM,IAAI,MAAM,QAAQ;AACxB,YAAM,SAAS,GAAG,EAAE,IAAI,mBAAmB,KAAK,MAAM,MAAM,EAAE,IAAI,kBAAkB,KAAK,EAAE,IAAI,MAAM,KAAK,WAAW;AACrH,aAAO,KAAK,WAAW,IAAI,QAAQ,GAAG,MAAM,KAAK,EAAE,SAAS,IAAI,QAAQ,CAAC,EAAE,CAAC,CAAC;AAAA,IAC/E;AAAA,IAEA,WAAW,UAAU,CAAC,GAAG;AACvB,aAAO,OAAO,YAAY;AACxB,cAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAE/B,YAAI,IAAI,aAAa,QAAQ,IAAI,SAAS,WAAW,GAAG,IAAI,GAAG,EAAG,QAAO,aAAa,KAAK;AAE3F,cAAM,WAAW,MAAM,KAAK,QAAQ,OAAO;AAC3C,YAAI,SAAS,YAAY,QAAQ,QAAQ,UAAU,IAAI,QAAQ,GAAG;AAChE,gBAAM,KAAK,aAAa,SAAS,IAAI,IAAI,KAAK,KAAK,OAAO,IAAI,WAAW,IAAI,MAAM,GAAG,GAAG,CAAC;AAC1F,qBAAW,KAAK,SAAS,QAAS,IAAG,QAAQ,OAAO,cAAc,CAAC;AACnE,iBAAO;AAAA,QACT;AACA,YAAI,SAAS,QAAQ,WAAW,EAAG,QAAO,aAAa,KAAK;AAI5D,cAAM,YAAY,IAAI,QAAQ,QAAQ,OAAO;AAC7C,kBAAU,IAAI,UAAU,aAAa,QAAQ,QAAQ,IAAI,QAAQ,GAAG,SAAS,OAAO,CAAC;AACrF,cAAM,KAAK,aAAa,KAAK,EAAE,SAAS,EAAE,SAAS,UAAU,EAAE,CAAC;AAChE,mBAAW,KAAK,SAAS,QAAS,IAAG,QAAQ,OAAO,cAAc,CAAC;AACnE,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACF;","names":[]}

package/dist/testing.d.mts

@@ -0,0 +1,62 @@
+declare class FakeCauthy {
+    readonly issuer = "https://id.test";
+    users: Map<string, {
+        sub: string;
+        email: string;
+        name: string;
+        active: boolean;
+        restricted: boolean;
+        anonymous?: boolean;
+        verified?: boolean;
+    }>;
+    codes: Map<string, {
+        sub: string;
+        challenge: string;
+        redirectUri: string;
+    }>;
+    refresh: Map<string, string>;
+    access: Map<string, string>;
+    orgs: Map<string, Record<string, unknown>[]>;
+    revoked: string[];
+    checks: {
+        organization: string;
+        sub: string;
+        body: any;
+    }[];
+    calls: string[];
+    down: boolean;
+    expiresIn: number;
+    /** What token answers say of the session's kind; absent means an older Cauthy that does not say. */
+    persistent: boolean | undefined;
+    /** Serve the API an application's own screens use (/v1/auth/*). Off unless a test asks. */
+    ownScreens: boolean;
+    /** The workspace those screens sign in to, as X-Tenant-Key names it. */
+    tenant: string;
+    /** Each account's password, by email: only these accounts sign in with one. */
+    passwords: Map<string, string>;
+    /** What GET /v1/auth/settings answers. */
+    settings: Record<string, unknown>;
+    private n;
+    constructor();
+    /** What the hosted page does once the person has signed in: hands the browser a code. */
+    authorize(location: string, sub?: string): string;
+    private issue;
+    fetch: typeof fetch;
+    /** The part of /v1/auth/* a password sign-in and the sign-in form read. */
+    private ownScreen;
+}
+/** A browser as far as cookies go: it keeps what it is told to and sends it back. */
+declare class Browser {
+    readonly origin: string;
+    private readonly options;
+    jar: Map<string, string>;
+    /** `requestHeader: false`: a browser whose client sends no X-Cauthy-Request, as cauthy-auth 0.42's does not. */
+    constructor(origin?: string, options?: {
+        requestHeader?: boolean;
+    });
+    request(path: string, init?: RequestInit): Request;
+    /** Keeps the cookies of a response, as a browser would. */
+    take(source: Response | string[]): void;
+}
+
+export { Browser, FakeCauthy };

package/dist/testing.d.ts

@@ -0,0 +1,62 @@
+declare class FakeCauthy {
+    readonly issuer = "https://id.test";
+    users: Map<string, {
+        sub: string;
+        email: string;
+        name: string;
+        active: boolean;
+        restricted: boolean;
+        anonymous?: boolean;
+        verified?: boolean;
+    }>;
+    codes: Map<string, {
+        sub: string;
+        challenge: string;
+        redirectUri: string;
+    }>;
+    refresh: Map<string, string>;
+    access: Map<string, string>;
+    orgs: Map<string, Record<string, unknown>[]>;
+    revoked: string[];
+    checks: {
+        organization: string;
+        sub: string;
+        body: any;
+    }[];
+    calls: string[];
+    down: boolean;
+    expiresIn: number;
+    /** What token answers say of the session's kind; absent means an older Cauthy that does not say. */
+    persistent: boolean | undefined;
+    /** Serve the API an application's own screens use (/v1/auth/*). Off unless a test asks. */
+    ownScreens: boolean;
+    /** The workspace those screens sign in to, as X-Tenant-Key names it. */
+    tenant: string;
+    /** Each account's password, by email: only these accounts sign in with one. */
+    passwords: Map<string, string>;
+    /** What GET /v1/auth/settings answers. */
+    settings: Record<string, unknown>;
+    private n;
+    constructor();
+    /** What the hosted page does once the person has signed in: hands the browser a code. */
+    authorize(location: string, sub?: string): string;
+    private issue;
+    fetch: typeof fetch;
+    /** The part of /v1/auth/* a password sign-in and the sign-in form read. */
+    private ownScreen;
+}
+/** A browser as far as cookies go: it keeps what it is told to and sends it back. */
+declare class Browser {
+    readonly origin: string;
+    private readonly options;
+    jar: Map<string, string>;
+    /** `requestHeader: false`: a browser whose client sends no X-Cauthy-Request, as cauthy-auth 0.42's does not. */
+    constructor(origin?: string, options?: {
+        requestHeader?: boolean;
+    });
+    request(path: string, init?: RequestInit): Request;
+    /** Keeps the cookies of a response, as a browser would. */
+    take(source: Response | string[]): void;
+}
+
+export { Browser, FakeCauthy };

package/dist/testing.js

@@ -0,0 +1,182 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/testing.ts
+var testing_exports = {};
+__export(testing_exports, {
+  Browser: () => Browser,
+  FakeCauthy: () => FakeCauthy
+});
+module.exports = __toCommonJS(testing_exports);
+var FakeCauthy = class {
+  issuer = "https://id.test";
+  users = /* @__PURE__ */ new Map();
+  codes = /* @__PURE__ */ new Map();
+  refresh = /* @__PURE__ */ new Map();
+  // refresh token → sub
+  access = /* @__PURE__ */ new Map();
+  // access token → sub
+  orgs = /* @__PURE__ */ new Map();
+  // sub → organizations
+  revoked = [];
+  checks = [];
+  calls = [];
+  down = false;
+  expiresIn = 600;
+  /** What token answers say of the session's kind; absent means an older Cauthy that does not say. */
+  persistent = void 0;
+  /** Serve the API an application's own screens use (/v1/auth/*). Off unless a test asks. */
+  ownScreens = false;
+  /** The workspace those screens sign in to, as X-Tenant-Key names it. */
+  tenant = "acme";
+  /** Each account's password, by email: only these accounts sign in with one. */
+  passwords = /* @__PURE__ */ new Map();
+  /** What GET /v1/auth/settings answers. */
+  settings = { allow_password: true, allow_signup: false, allow_passkeys: false, persistent_sessions: false };
+  n = 0;
+  constructor() {
+    this.users.set("u1", { sub: "u1", email: "ana@acme.com", name: "Ana", active: true, restricted: false });
+  }
+  /** What the hosted page does once the person has signed in: hands the browser a code. */
+  authorize(location, sub = "u1") {
+    const q = new URL(location).searchParams;
+    if (q.get("response_type") !== "code") throw new Error("Cauthy answers unsupported_response_type: response_type=code is required");
+    const code = `code-${++this.n}`;
+    this.codes.set(code, { sub, challenge: q.get("code_challenge") ?? "", redirectUri: q.get("redirect_uri") ?? "" });
+    return `${q.get("redirect_uri")}?code=${code}&state=${q.get("state")}`;
+  }
+  issue(sub) {
+    const at = `at-${++this.n}`;
+    const rt = `rt-${++this.n}`;
+    this.access.set(at, sub);
+    this.refresh.set(rt, sub);
+    return { access_token: at, refresh_token: rt, token_type: "Bearer", expires_in: this.expiresIn, scope: "", ...this.persistent === void 0 ? {} : { persistent: this.persistent } };
+  }
+  fetch = async (input, init) => {
+    const url = new URL(typeof input === "string" ? input : input instanceof URL ? input.href : input.url);
+    this.calls.push(`${init?.method ?? "GET"} ${url.pathname}`);
+    if (this.down) throw new TypeError("fetch failed");
+    const reply = (status, body) => new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json" } });
+    const form = new URLSearchParams(init?.body instanceof URLSearchParams ? init.body : String(init?.body ?? ""));
+    const bearer = new Headers(init?.headers).get("authorization")?.replace("Bearer ", "") ?? "";
+    if (this.ownScreens && url.pathname.startsWith("/v1/auth/")) return this.ownScreen(url, init);
+    if (url.pathname === "/v1/oauth/token") {
+      if (form.get("grant_type") === "authorization_code") {
+        const c = this.codes.get(form.get("code") ?? "");
+        this.codes.delete(form.get("code") ?? "");
+        const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(form.get("code_verifier") ?? ""));
+        const challenge = btoa(String.fromCharCode(...new Uint8Array(digest))).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+        if (!c || c.challenge !== challenge || c.redirectUri !== form.get("redirect_uri")) return reply(400, { error: "invalid_grant", error_description: "the grant is invalid, expired or already used" });
+        return reply(200, this.issue(c.sub));
+      }
+      if (form.get("grant_type") === "refresh_token") {
+        const sub2 = this.refresh.get(form.get("refresh_token") ?? "");
+        this.refresh.delete(form.get("refresh_token") ?? "");
+        if (!sub2 || !this.users.get(sub2)?.active) return reply(400, { error: "invalid_grant", error_description: "the grant is invalid, expired or already used" });
+        return reply(200, this.issue(sub2));
+      }
+      return reply(400, { error: "unsupported_grant_type", error_description: "supported grant types: authorization_code, refresh_token" });
+    }
+    if (url.pathname === "/v1/oauth/revoke") {
+      this.revoked.push(form.get("token") ?? "");
+      this.refresh.delete(form.get("token") ?? "");
+      return reply(200, {});
+    }
+    const sub = this.access.get(bearer);
+    const user = sub ? this.users.get(sub) : void 0;
+    if (url.pathname === "/v1/oauth/userinfo") {
+      if (!user) return reply(401, {});
+      return reply(200, { sub: user.sub, tid: "t1", email: user.email, name: user.name, email_verified: user.verified ?? !user.anonymous, restricted: user.restricted, roles: ["member"], ...user.anonymous ? { anonymous: true } : {} });
+    }
+    const asking = url.pathname.match(/^\/v1\/oauth\/organizations\/([^/]+)\/check$/);
+    if (asking && init?.method === "POST") {
+      if (!user) return reply(401, { errors: [{ code: "unauthorized", message: "invalid or expired token" }] });
+      const org = decodeURIComponent(asking[1]);
+      const body = JSON.parse(String(init.body));
+      this.checks.push({ organization: org, sub: user.sub, body });
+      if (!(this.orgs.get(user.sub) ?? []).some((o) => o.id === org)) return reply(404, { errors: [{ code: "organization_not_found", message: "organization not found" }] });
+      const allowed = body.resource === "invoices" && body.action === "approve" && Number(body.attributes?.amount) <= 1e6;
+      return reply(200, { data: allowed ? { allowed, reason: "allowed by role accountant: invoices:approve", rule: { source: "role", role: "accountant", kind: "*", resource: "invoices", action: "approve", effect: "allow", condition: "resource.attrs.amount <= 1000000" } } : { allowed, reason: "no rule allows it" } });
+    }
+    if (url.pathname === "/v1/oauth/organizations") {
+      if (!user) return reply(401, {});
+      const system = url.searchParams.get("system");
+      const data = (this.orgs.get(user.sub) ?? []).filter((o) => !system || o.system === system);
+      return reply(200, { data, total_count: data.length });
+    }
+    return reply(404, {});
+  };
+  /** The part of /v1/auth/* a password sign-in and the sign-in form read. */
+  ownScreen(url, init) {
+    const reply = (status, body) => new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json" } });
+    const refuse = (status, code, message) => reply(status, { errors: [{ code, message }] });
+    if (new Headers(init?.headers).get("x-tenant-key") !== this.tenant) return refuse(404, "tenant_not_found", "no such workspace");
+    const method = init?.method ?? "GET";
+    if (method === "POST" && url.pathname === "/v1/auth/login") {
+      const body = JSON.parse(String(init?.body ?? "{}"));
+      const user = [...this.users.values()].find((u) => u.email === body.email);
+      const password = body.email === void 0 ? void 0 : this.passwords.get(body.email);
+      if (!user || !user.active || password === void 0 || password !== body.password) {
+        return refuse(401, "invalid_credentials", "invalid email or password");
+      }
+      return reply(200, { data: this.issue(user.sub) });
+    }
+    if (method === "GET" && url.pathname === "/v1/auth/settings") return reply(200, { data: this.settings });
+    if (method === "GET" && (url.pathname === "/v1/auth/social/providers" || url.pathname === "/v1/auth/sso/connections")) return reply(200, { data: [] });
+    if (method === "GET" && url.pathname === "/v1/auth/webauthn/place") return reply(200, { data: { here: false, on_cauthy: false } });
+    return refuse(404, "not_found", "not found");
+  }
+};
+var Browser = class {
+  /** `requestHeader: false`: a browser whose client sends no X-Cauthy-Request, as cauthy-auth 0.42's does not. */
+  constructor(origin = "https://app.test", options = {}) {
+    this.origin = origin;
+    this.options = options;
+  }
+  origin;
+  options;
+  jar = /* @__PURE__ */ new Map();
+  request(path, init = {}) {
+    const headers = new Headers(init.headers);
+    if (this.jar.size > 0) headers.set("cookie", [...this.jar].map(([k, v]) => `${k}=${v}`).join("; "));
+    const method = (init.method ?? "GET").toUpperCase();
+    if (method !== "GET" && method !== "HEAD" && this.options.requestHeader !== false && !headers.has("x-cauthy-request")) {
+      headers.set("x-cauthy-request", "1");
+    }
+    return new Request(this.origin + path, { ...init, headers });
+  }
+  /** Keeps the cookies of a response, as a browser would. */
+  take(source) {
+    const cookies = Array.isArray(source) ? source : source.headers.getSetCookie();
+    for (const c of cookies) {
+      const [pair, ...attrs] = c.split("; ");
+      const i = pair.indexOf("=");
+      const name = pair.slice(0, i);
+      const value = pair.slice(i + 1);
+      if (value === "" || attrs.includes("Max-Age=0")) this.jar.delete(name);
+      else this.jar.set(name, value);
+    }
+  }
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  Browser,
+  FakeCauthy
+});
+//# sourceMappingURL=testing.js.map

package/dist/testing.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/testing.ts"],"sourcesContent":["// A Cauthy that lives in memory, and a browser that keeps cookies: what the\n// tests sign in against. Exported as `@cauthyhq/node/testing`, for tests only:\n// it signs in anyone it was told about, and checks nothing a real Cauthy does.\n\nexport class FakeCauthy {\n  readonly issuer = 'https://id.test'\n  users = new Map<string, { sub: string; email: string; name: string; active: boolean; restricted: boolean; anonymous?: boolean; verified?: boolean }>()\n  codes = new Map<string, { sub: string; challenge: string; redirectUri: string }>()\n  refresh = new Map<string, string>() // refresh token → sub\n  access = new Map<string, string>() // access token → sub\n  orgs = new Map<string, Record<string, unknown>[]>() // sub → organizations\n  revoked: string[] = []\n  checks: { organization: string; sub: string; body: any }[] = []\n  calls: string[] = []\n  down = false\n  expiresIn = 600\n  /** What token answers say of the session's kind; absent means an older Cauthy that does not say. */\n  persistent: boolean | undefined = undefined\n  /** Serve the API an application's own screens use (/v1/auth/*). Off unless a test asks. */\n  ownScreens = false\n  /** The workspace those screens sign in to, as X-Tenant-Key names it. */\n  tenant = 'acme'\n  /** Each account's password, by email: only these accounts sign in with one. */\n  passwords = new Map<string, string>()\n  /** What GET /v1/auth/settings answers. */\n  settings: Record<string, unknown> = { allow_password: true, allow_signup: false, allow_passkeys: false, persistent_sessions: false }\n  private n = 0\n\n  constructor() {\n    this.users.set('u1', { sub: 'u1', email: 'ana@acme.com', name: 'Ana', active: true, restricted: false })\n  }\n\n  /** What the hosted page does once the person has signed in: hands the browser a code. */\n  authorize(location: string, sub = 'u1'): string {\n    const q = new URL(location).searchParams\n    if (q.get('response_type') !== 'code') throw new Error('Cauthy answers unsupported_response_type: response_type=code is required')\n    const code = `code-${++this.n}`\n    this.codes.set(code, { sub, challenge: q.get('code_challenge') ?? '', redirectUri: q.get('redirect_uri') ?? '' })\n    return `${q.get('redirect_uri')}?code=${code}&state=${q.get('state')}`\n  }\n\n  private issue(sub: string) {\n    const at = `at-${++this.n}`\n    const rt = `rt-${++this.n}`\n    this.access.set(at, sub)\n    this.refresh.set(rt, sub)\n    return { access_token: at, refresh_token: rt, token_type: 'Bearer', expires_in: this.expiresIn, scope: '', ...(this.persistent === undefined ? {} : { persistent: this.persistent }) }\n  }\n\n  fetch: typeof fetch = async (input, init) => {\n    const url = new URL(typeof input === 'string' ? input : input instanceof URL ? input.href : input.url)\n    this.calls.push(`${init?.method ?? 'GET'} ${url.pathname}`)\n    if (this.down) throw new TypeError('fetch failed')\n    const reply = (status: number, body: unknown) =>\n      new Response(JSON.stringify(body), { status, headers: { 'content-type': 'application/json' } })\n    const form = new URLSearchParams(init?.body instanceof URLSearchParams ? init.body : String(init?.body ?? ''))\n    const bearer = new Headers(init?.headers).get('authorization')?.replace('Bearer ', '') ?? ''\n    if (this.ownScreens && url.pathname.startsWith('/v1/auth/')) return this.ownScreen(url, init)\n\n    if (url.pathname === '/v1/oauth/token') {\n      if (form.get('grant_type') === 'authorization_code') {\n        const c = this.codes.get(form.get('code') ?? '')\n        this.codes.delete(form.get('code') ?? '')\n        const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(form.get('code_verifier') ?? ''))\n        const challenge = btoa(String.fromCharCode(...new Uint8Array(digest))).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '')\n        if (!c || c.challenge !== challenge || c.redirectUri !== form.get('redirect_uri')) return reply(400, { error: 'invalid_grant', error_description: 'the grant is invalid, expired or already used' })\n        return reply(200, this.issue(c.sub))\n      }\n      if (form.get('grant_type') === 'refresh_token') {\n        const sub = this.refresh.get(form.get('refresh_token') ?? '')\n        this.refresh.delete(form.get('refresh_token') ?? '') // used once\n        if (!sub || !this.users.get(sub)?.active) return reply(400, { error: 'invalid_grant', error_description: 'the grant is invalid, expired or already used' })\n        return reply(200, this.issue(sub))\n      }\n      return reply(400, { error: 'unsupported_grant_type', error_description: 'supported grant types: authorization_code, refresh_token' })\n    }\n    if (url.pathname === '/v1/oauth/revoke') {\n      this.revoked.push(form.get('token') ?? '')\n      this.refresh.delete(form.get('token') ?? '')\n      return reply(200, {})\n    }\n    const sub = this.access.get(bearer)\n    const user = sub ? this.users.get(sub) : undefined\n    if (url.pathname === '/v1/oauth/userinfo') {\n      if (!user) return reply(401, {})\n      return reply(200, { sub: user.sub, tid: 't1', email: user.email, name: user.name, email_verified: user.verified ?? !user.anonymous, restricted: user.restricted, roles: ['member'], ...(user.anonymous ? { anonymous: true } : {}) })\n    }\n    const asking = url.pathname.match(/^\\/v1\\/oauth\\/organizations\\/([^/]+)\\/check$/)\n    if (asking && init?.method === 'POST') {\n      if (!user) return reply(401, { errors: [{ code: 'unauthorized', message: 'invalid or expired token' }] })\n      const org = decodeURIComponent(asking[1])\n      const body = JSON.parse(String(init.body))\n      this.checks.push({ organization: org, sub: user.sub, body })\n      if (!(this.orgs.get(user.sub) ?? []).some((o) => o.id === org)) return reply(404, { errors: [{ code: 'organization_not_found', message: 'organization not found' }] })\n      // An accountant approves invoices up to a million.\n      const allowed = body.resource === 'invoices' && body.action === 'approve' && Number(body.attributes?.amount) <= 1_000_000\n      return reply(200, { data: allowed\n        ? { allowed, reason: 'allowed by role accountant: invoices:approve', rule: { source: 'role', role: 'accountant', kind: '*', resource: 'invoices', action: 'approve', effect: 'allow', condition: 'resource.attrs.amount <= 1000000' } }\n        : { allowed, reason: 'no rule allows it' } })\n    }\n    if (url.pathname === '/v1/oauth/organizations') {\n      if (!user) return reply(401, {})\n      const system = url.searchParams.get('system')\n      const data = (this.orgs.get(user.sub) ?? []).filter((o) => !system || o.system === system)\n      return reply(200, { data, total_count: data.length })\n    }\n    return reply(404, {})\n  }\n\n  /** The part of /v1/auth/* a password sign-in and the sign-in form read. */\n  private ownScreen(url: URL, init: RequestInit | undefined): Response {\n    const reply = (status: number, body: unknown) =>\n      new Response(JSON.stringify(body), { status, headers: { 'content-type': 'application/json' } })\n    const refuse = (status: number, code: string, message: string) => reply(status, { errors: [{ code, message }] })\n    if (new Headers(init?.headers).get('x-tenant-key') !== this.tenant) return refuse(404, 'tenant_not_found', 'no such workspace')\n    const method = init?.method ?? 'GET'\n    if (method === 'POST' && url.pathname === '/v1/auth/login') {\n      const body = JSON.parse(String(init?.body ?? '{}')) as { email?: string; password?: string }\n      const user = [...this.users.values()].find((u) => u.email === body.email)\n      const password = body.email === undefined ? undefined : this.passwords.get(body.email)\n      if (!user || !user.active || password === undefined || password !== body.password) {\n        return refuse(401, 'invalid_credentials', 'invalid email or password')\n      }\n      return reply(200, { data: this.issue(user.sub) })\n    }\n    if (method === 'GET' && url.pathname === '/v1/auth/settings') return reply(200, { data: this.settings })\n    if (method === 'GET' && (url.pathname === '/v1/auth/social/providers' || url.pathname === '/v1/auth/sso/connections')) return reply(200, { data: [] })\n    if (method === 'GET' && url.pathname === '/v1/auth/webauthn/place') return reply(200, { data: { here: false, on_cauthy: false } })\n    return refuse(404, 'not_found', 'not found')\n  }\n}\n\n/** A browser as far as cookies go: it keeps what it is told to and sends it back. */\nexport class Browser {\n  jar = new Map<string, string>()\n  /** `requestHeader: false`: a browser whose client sends no X-Cauthy-Request, as cauthy-auth 0.42's does not. */\n  constructor(readonly origin = 'https://app.test', private readonly options: { requestHeader?: boolean } = {}) {}\n\n  request(path: string, init: RequestInit = {}): Request {\n    const headers = new Headers(init.headers)\n    if (this.jar.size > 0) headers.set('cookie', [...this.jar].map(([k, v]) => `${k}=${v}`).join('; '))\n    // What a protocol-1 client sends on every mutation.\n    const method = (init.method ?? 'GET').toUpperCase()\n    if (method !== 'GET' && method !== 'HEAD' && this.options.requestHeader !== false && !headers.has('x-cauthy-request')) {\n      headers.set('x-cauthy-request', '1')\n    }\n    return new Request(this.origin + path, { ...init, headers })\n  }\n\n  /** Keeps the cookies of a response, as a browser would. */\n  take(source: Response | string[]): void {\n    const cookies = Array.isArray(source) ? source : source.headers.getSetCookie()\n    for (const c of cookies) {\n      const [pair, ...attrs] = c.split('; ')\n      const i = pair.indexOf('=')\n      const name = pair.slice(0, i)\n      const value = pair.slice(i + 1)\n      if (value === '' || attrs.includes('Max-Age=0')) this.jar.delete(name)\n      else this.jar.set(name, value)\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAIO,IAAM,aAAN,MAAiB;AAAA,EACb,SAAS;AAAA,EAClB,QAAQ,oBAAI,IAAyI;AAAA,EACrJ,QAAQ,oBAAI,IAAqE;AAAA,EACjF,UAAU,oBAAI,IAAoB;AAAA;AAAA,EAClC,SAAS,oBAAI,IAAoB;AAAA;AAAA,EACjC,OAAO,oBAAI,IAAuC;AAAA;AAAA,EAClD,UAAoB,CAAC;AAAA,EACrB,SAA6D,CAAC;AAAA,EAC9D,QAAkB,CAAC;AAAA,EACnB,OAAO;AAAA,EACP,YAAY;AAAA;AAAA,EAEZ,aAAkC;AAAA;AAAA,EAElC,aAAa;AAAA;AAAA,EAEb,SAAS;AAAA;AAAA,EAET,YAAY,oBAAI,IAAoB;AAAA;AAAA,EAEpC,WAAoC,EAAE,gBAAgB,MAAM,cAAc,OAAO,gBAAgB,OAAO,qBAAqB,MAAM;AAAA,EAC3H,IAAI;AAAA,EAEZ,cAAc;AACZ,SAAK,MAAM,IAAI,MAAM,EAAE,KAAK,MAAM,OAAO,gBAAgB,MAAM,OAAO,QAAQ,MAAM,YAAY,MAAM,CAAC;AAAA,EACzG;AAAA;AAAA,EAGA,UAAU,UAAkB,MAAM,MAAc;AAC9C,UAAM,IAAI,IAAI,IAAI,QAAQ,EAAE;AAC5B,QAAI,EAAE,IAAI,eAAe,MAAM,OAAQ,OAAM,IAAI,MAAM,0EAA0E;AACjI,UAAM,OAAO,QAAQ,EAAE,KAAK,CAAC;AAC7B,SAAK,MAAM,IAAI,MAAM,EAAE,KAAK,WAAW,EAAE,IAAI,gBAAgB,KAAK,IAAI,aAAa,EAAE,IAAI,cAAc,KAAK,GAAG,CAAC;AAChH,WAAO,GAAG,EAAE,IAAI,cAAc,CAAC,SAAS,IAAI,UAAU,EAAE,IAAI,OAAO,CAAC;AAAA,EACtE;AAAA,EAEQ,MAAM,KAAa;AACzB,UAAM,KAAK,MAAM,EAAE,KAAK,CAAC;AACzB,UAAM,KAAK,MAAM,EAAE,KAAK,CAAC;AACzB,SAAK,OAAO,IAAI,IAAI,GAAG;AACvB,SAAK,QAAQ,IAAI,IAAI,GAAG;AACxB,WAAO,EAAE,cAAc,IAAI,eAAe,IAAI,YAAY,UAAU,YAAY,KAAK,WAAW,OAAO,IAAI,GAAI,KAAK,eAAe,SAAY,CAAC,IAAI,EAAE,YAAY,KAAK,WAAW,EAAG;AAAA,EACvL;AAAA,EAEA,QAAsB,OAAO,OAAO,SAAS;AAC3C,UAAM,MAAM,IAAI,IAAI,OAAO,UAAU,WAAW,QAAQ,iBAAiB,MAAM,MAAM,OAAO,MAAM,GAAG;AACrG,SAAK,MAAM,KAAK,GAAG,MAAM,UAAU,KAAK,IAAI,IAAI,QAAQ,EAAE;AAC1D,QAAI,KAAK,KAAM,OAAM,IAAI,UAAU,cAAc;AACjD,UAAM,QAAQ,CAAC,QAAgB,SAC7B,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG,EAAE,QAAQ,SAAS,EAAE,gBAAgB,mBAAmB,EAAE,CAAC;AAChG,UAAM,OAAO,IAAI,gBAAgB,MAAM,gBAAgB,kBAAkB,KAAK,OAAO,OAAO,MAAM,QAAQ,EAAE,CAAC;AAC7G,UAAM,SAAS,IAAI,QAAQ,MAAM,OAAO,EAAE,IAAI,eAAe,GAAG,QAAQ,WAAW,EAAE,KAAK;AAC1F,QAAI,KAAK,cAAc,IAAI,SAAS,WAAW,WAAW,EAAG,QAAO,KAAK,UAAU,KAAK,IAAI;AAE5F,QAAI,IAAI,aAAa,mBAAmB;AACtC,UAAI,KAAK,IAAI,YAAY,MAAM,sBAAsB;AACnD,cAAM,IAAI,KAAK,MAAM,IAAI,KAAK,IAAI,MAAM,KAAK,EAAE;AAC/C,aAAK,MAAM,OAAO,KAAK,IAAI,MAAM,KAAK,EAAE;AACxC,cAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,YAAY,EAAE,OAAO,KAAK,IAAI,eAAe,KAAK,EAAE,CAAC;AAC9G,cAAM,YAAY,KAAK,OAAO,aAAa,GAAG,IAAI,WAAW,MAAM,CAAC,CAAC,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAChI,YAAI,CAAC,KAAK,EAAE,cAAc,aAAa,EAAE,gBAAgB,KAAK,IAAI,cAAc,EAAG,QAAO,MAAM,KAAK,EAAE,OAAO,iBAAiB,mBAAmB,gDAAgD,CAAC;AACnM,eAAO,MAAM,KAAK,KAAK,MAAM,EAAE,GAAG,CAAC;AAAA,MACrC;AACA,UAAI,KAAK,IAAI,YAAY,MAAM,iBAAiB;AAC9C,cAAMA,OAAM,KAAK,QAAQ,IAAI,KAAK,IAAI,eAAe,KAAK,EAAE;AAC5D,aAAK,QAAQ,OAAO,KAAK,IAAI,eAAe,KAAK,EAAE;AACnD,YAAI,CAACA,QAAO,CAAC,KAAK,MAAM,IAAIA,IAAG,GAAG,OAAQ,QAAO,MAAM,KAAK,EAAE,OAAO,iBAAiB,mBAAmB,gDAAgD,CAAC;AAC1J,eAAO,MAAM,KAAK,KAAK,MAAMA,IAAG,CAAC;AAAA,MACnC;AACA,aAAO,MAAM,KAAK,EAAE,OAAO,0BAA0B,mBAAmB,2DAA2D,CAAC;AAAA,IACtI;AACA,QAAI,IAAI,aAAa,oBAAoB;AACvC,WAAK,QAAQ,KAAK,KAAK,IAAI,OAAO,KAAK,EAAE;AACzC,WAAK,QAAQ,OAAO,KAAK,IAAI,OAAO,KAAK,EAAE;AAC3C,aAAO,MAAM,KAAK,CAAC,CAAC;AAAA,IACtB;AACA,UAAM,MAAM,KAAK,OAAO,IAAI,MAAM;AAClC,UAAM,OAAO,MAAM,KAAK,MAAM,IAAI,GAAG,IAAI;AACzC,QAAI,IAAI,aAAa,sBAAsB;AACzC,UAAI,CAAC,KAAM,QAAO,MAAM,KAAK,CAAC,CAAC;AAC/B,aAAO,MAAM,KAAK,EAAE,KAAK,KAAK,KAAK,KAAK,MAAM,OAAO,KAAK,OAAO,MAAM,KAAK,MAAM,gBAAgB,KAAK,YAAY,CAAC,KAAK,WAAW,YAAY,KAAK,YAAY,OAAO,CAAC,QAAQ,GAAG,GAAI,KAAK,YAAY,EAAE,WAAW,KAAK,IAAI,CAAC,EAAG,CAAC;AAAA,IACtO;AACA,UAAM,SAAS,IAAI,SAAS,MAAM,8CAA8C;AAChF,QAAI,UAAU,MAAM,WAAW,QAAQ;AACrC,UAAI,CAAC,KAAM,QAAO,MAAM,KAAK,EAAE,QAAQ,CAAC,EAAE,MAAM,gBAAgB,SAAS,2BAA2B,CAAC,EAAE,CAAC;AACxG,YAAM,MAAM,mBAAmB,OAAO,CAAC,CAAC;AACxC,YAAM,OAAO,KAAK,MAAM,OAAO,KAAK,IAAI,CAAC;AACzC,WAAK,OAAO,KAAK,EAAE,cAAc,KAAK,KAAK,KAAK,KAAK,KAAK,CAAC;AAC3D,UAAI,EAAE,KAAK,KAAK,IAAI,KAAK,GAAG,KAAK,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,OAAO,GAAG,EAAG,QAAO,MAAM,KAAK,EAAE,QAAQ,CAAC,EAAE,MAAM,0BAA0B,SAAS,yBAAyB,CAAC,EAAE,CAAC;AAErK,YAAM,UAAU,KAAK,aAAa,cAAc,KAAK,WAAW,aAAa,OAAO,KAAK,YAAY,MAAM,KAAK;AAChH,aAAO,MAAM,KAAK,EAAE,MAAM,UACtB,EAAE,SAAS,QAAQ,gDAAgD,MAAM,EAAE,QAAQ,QAAQ,MAAM,cAAc,MAAM,KAAK,UAAU,YAAY,QAAQ,WAAW,QAAQ,SAAS,WAAW,mCAAmC,EAAE,IACpO,EAAE,SAAS,QAAQ,oBAAoB,EAAE,CAAC;AAAA,IAChD;AACA,QAAI,IAAI,aAAa,2BAA2B;AAC9C,UAAI,CAAC,KAAM,QAAO,MAAM,KAAK,CAAC,CAAC;AAC/B,YAAM,SAAS,IAAI,aAAa,IAAI,QAAQ;AAC5C,YAAM,QAAQ,KAAK,KAAK,IAAI,KAAK,GAAG,KAAK,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,WAAW,MAAM;AACzF,aAAO,MAAM,KAAK,EAAE,MAAM,aAAa,KAAK,OAAO,CAAC;AAAA,IACtD;AACA,WAAO,MAAM,KAAK,CAAC,CAAC;AAAA,EACtB;AAAA;AAAA,EAGQ,UAAU,KAAU,MAAyC;AACnE,UAAM,QAAQ,CAAC,QAAgB,SAC7B,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG,EAAE,QAAQ,SAAS,EAAE,gBAAgB,mBAAmB,EAAE,CAAC;AAChG,UAAM,SAAS,CAAC,QAAgB,MAAc,YAAoB,MAAM,QAAQ,EAAE,QAAQ,CAAC,EAAE,MAAM,QAAQ,CAAC,EAAE,CAAC;AAC/G,QAAI,IAAI,QAAQ,MAAM,OAAO,EAAE,IAAI,cAAc,MAAM,KAAK,OAAQ,QAAO,OAAO,KAAK,oBAAoB,mBAAmB;AAC9H,UAAM,SAAS,MAAM,UAAU;AAC/B,QAAI,WAAW,UAAU,IAAI,aAAa,kBAAkB;AAC1D,YAAM,OAAO,KAAK,MAAM,OAAO,MAAM,QAAQ,IAAI,CAAC;AAClD,YAAM,OAAO,CAAC,GAAG,KAAK,MAAM,OAAO,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,UAAU,KAAK,KAAK;AACxE,YAAM,WAAW,KAAK,UAAU,SAAY,SAAY,KAAK,UAAU,IAAI,KAAK,KAAK;AACrF,UAAI,CAAC,QAAQ,CAAC,KAAK,UAAU,aAAa,UAAa,aAAa,KAAK,UAAU;AACjF,eAAO,OAAO,KAAK,uBAAuB,2BAA2B;AAAA,MACvE;AACA,aAAO,MAAM,KAAK,EAAE,MAAM,KAAK,MAAM,KAAK,GAAG,EAAE,CAAC;AAAA,IAClD;AACA,QAAI,WAAW,SAAS,IAAI,aAAa,oBAAqB,QAAO,MAAM,KAAK,EAAE,MAAM,KAAK,SAAS,CAAC;AACvG,QAAI,WAAW,UAAU,IAAI,aAAa,+BAA+B,IAAI,aAAa,4BAA6B,QAAO,MAAM,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;AACrJ,QAAI,WAAW,SAAS,IAAI,aAAa,0BAA2B,QAAO,MAAM,KAAK,EAAE,MAAM,EAAE,MAAM,OAAO,WAAW,MAAM,EAAE,CAAC;AACjI,WAAO,OAAO,KAAK,aAAa,WAAW;AAAA,EAC7C;AACF;AAGO,IAAM,UAAN,MAAc;AAAA;AAAA,EAGnB,YAAqB,SAAS,oBAAqC,UAAuC,CAAC,GAAG;AAAzF;AAA8C;AAAA,EAA4C;AAAA,EAA1F;AAAA,EAA8C;AAAA,EAFnE,MAAM,oBAAI,IAAoB;AAAA,EAI9B,QAAQ,MAAc,OAAoB,CAAC,GAAY;AACrD,UAAM,UAAU,IAAI,QAAQ,KAAK,OAAO;AACxC,QAAI,KAAK,IAAI,OAAO,EAAG,SAAQ,IAAI,UAAU,CAAC,GAAG,KAAK,GAAG,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,IAAI,CAAC;AAElG,UAAM,UAAU,KAAK,UAAU,OAAO,YAAY;AAClD,QAAI,WAAW,SAAS,WAAW,UAAU,KAAK,QAAQ,kBAAkB,SAAS,CAAC,QAAQ,IAAI,kBAAkB,GAAG;AACrH,cAAQ,IAAI,oBAAoB,GAAG;AAAA,IACrC;AACA,WAAO,IAAI,QAAQ,KAAK,SAAS,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC;AAAA,EAC7D;AAAA;AAAA,EAGA,KAAK,QAAmC;AACtC,UAAM,UAAU,MAAM,QAAQ,MAAM,IAAI,SAAS,OAAO,QAAQ,aAAa;AAC7E,eAAW,KAAK,SAAS;AACvB,YAAM,CAAC,MAAM,GAAG,KAAK,IAAI,EAAE,MAAM,IAAI;AACrC,YAAM,IAAI,KAAK,QAAQ,GAAG;AAC1B,YAAM,OAAO,KAAK,MAAM,GAAG,CAAC;AAC5B,YAAM,QAAQ,KAAK,MAAM,IAAI,CAAC;AAC9B,UAAI,UAAU,MAAM,MAAM,SAAS,WAAW,EAAG,MAAK,IAAI,OAAO,IAAI;AAAA,UAChE,MAAK,IAAI,IAAI,MAAM,KAAK;AAAA,IAC/B;AAAA,EACF;AACF;","names":["sub"]}

package/dist/testing.mjs

@@ -0,0 +1,156 @@
+// src/testing.ts
+var FakeCauthy = class {
+  issuer = "https://id.test";
+  users = /* @__PURE__ */ new Map();
+  codes = /* @__PURE__ */ new Map();
+  refresh = /* @__PURE__ */ new Map();
+  // refresh token → sub
+  access = /* @__PURE__ */ new Map();
+  // access token → sub
+  orgs = /* @__PURE__ */ new Map();
+  // sub → organizations
+  revoked = [];
+  checks = [];
+  calls = [];
+  down = false;
+  expiresIn = 600;
+  /** What token answers say of the session's kind; absent means an older Cauthy that does not say. */
+  persistent = void 0;
+  /** Serve the API an application's own screens use (/v1/auth/*). Off unless a test asks. */
+  ownScreens = false;
+  /** The workspace those screens sign in to, as X-Tenant-Key names it. */
+  tenant = "acme";
+  /** Each account's password, by email: only these accounts sign in with one. */
+  passwords = /* @__PURE__ */ new Map();
+  /** What GET /v1/auth/settings answers. */
+  settings = { allow_password: true, allow_signup: false, allow_passkeys: false, persistent_sessions: false };
+  n = 0;
+  constructor() {
+    this.users.set("u1", { sub: "u1", email: "ana@acme.com", name: "Ana", active: true, restricted: false });
+  }
+  /** What the hosted page does once the person has signed in: hands the browser a code. */
+  authorize(location, sub = "u1") {
+    const q = new URL(location).searchParams;
+    if (q.get("response_type") !== "code") throw new Error("Cauthy answers unsupported_response_type: response_type=code is required");
+    const code = `code-${++this.n}`;
+    this.codes.set(code, { sub, challenge: q.get("code_challenge") ?? "", redirectUri: q.get("redirect_uri") ?? "" });
+    return `${q.get("redirect_uri")}?code=${code}&state=${q.get("state")}`;
+  }
+  issue(sub) {
+    const at = `at-${++this.n}`;
+    const rt = `rt-${++this.n}`;
+    this.access.set(at, sub);
+    this.refresh.set(rt, sub);
+    return { access_token: at, refresh_token: rt, token_type: "Bearer", expires_in: this.expiresIn, scope: "", ...this.persistent === void 0 ? {} : { persistent: this.persistent } };
+  }
+  fetch = async (input, init) => {
+    const url = new URL(typeof input === "string" ? input : input instanceof URL ? input.href : input.url);
+    this.calls.push(`${init?.method ?? "GET"} ${url.pathname}`);
+    if (this.down) throw new TypeError("fetch failed");
+    const reply = (status, body) => new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json" } });
+    const form = new URLSearchParams(init?.body instanceof URLSearchParams ? init.body : String(init?.body ?? ""));
+    const bearer = new Headers(init?.headers).get("authorization")?.replace("Bearer ", "") ?? "";
+    if (this.ownScreens && url.pathname.startsWith("/v1/auth/")) return this.ownScreen(url, init);
+    if (url.pathname === "/v1/oauth/token") {
+      if (form.get("grant_type") === "authorization_code") {
+        const c = this.codes.get(form.get("code") ?? "");
+        this.codes.delete(form.get("code") ?? "");
+        const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(form.get("code_verifier") ?? ""));
+        const challenge = btoa(String.fromCharCode(...new Uint8Array(digest))).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+        if (!c || c.challenge !== challenge || c.redirectUri !== form.get("redirect_uri")) return reply(400, { error: "invalid_grant", error_description: "the grant is invalid, expired or already used" });
+        return reply(200, this.issue(c.sub));
+      }
+      if (form.get("grant_type") === "refresh_token") {
+        const sub2 = this.refresh.get(form.get("refresh_token") ?? "");
+        this.refresh.delete(form.get("refresh_token") ?? "");
+        if (!sub2 || !this.users.get(sub2)?.active) return reply(400, { error: "invalid_grant", error_description: "the grant is invalid, expired or already used" });
+        return reply(200, this.issue(sub2));
+      }
+      return reply(400, { error: "unsupported_grant_type", error_description: "supported grant types: authorization_code, refresh_token" });
+    }
+    if (url.pathname === "/v1/oauth/revoke") {
+      this.revoked.push(form.get("token") ?? "");
+      this.refresh.delete(form.get("token") ?? "");
+      return reply(200, {});
+    }
+    const sub = this.access.get(bearer);
+    const user = sub ? this.users.get(sub) : void 0;
+    if (url.pathname === "/v1/oauth/userinfo") {
+      if (!user) return reply(401, {});
+      return reply(200, { sub: user.sub, tid: "t1", email: user.email, name: user.name, email_verified: user.verified ?? !user.anonymous, restricted: user.restricted, roles: ["member"], ...user.anonymous ? { anonymous: true } : {} });
+    }
+    const asking = url.pathname.match(/^\/v1\/oauth\/organizations\/([^/]+)\/check$/);
+    if (asking && init?.method === "POST") {
+      if (!user) return reply(401, { errors: [{ code: "unauthorized", message: "invalid or expired token" }] });
+      const org = decodeURIComponent(asking[1]);
+      const body = JSON.parse(String(init.body));
+      this.checks.push({ organization: org, sub: user.sub, body });
+      if (!(this.orgs.get(user.sub) ?? []).some((o) => o.id === org)) return reply(404, { errors: [{ code: "organization_not_found", message: "organization not found" }] });
+      const allowed = body.resource === "invoices" && body.action === "approve" && Number(body.attributes?.amount) <= 1e6;
+      return reply(200, { data: allowed ? { allowed, reason: "allowed by role accountant: invoices:approve", rule: { source: "role", role: "accountant", kind: "*", resource: "invoices", action: "approve", effect: "allow", condition: "resource.attrs.amount <= 1000000" } } : { allowed, reason: "no rule allows it" } });
+    }
+    if (url.pathname === "/v1/oauth/organizations") {
+      if (!user) return reply(401, {});
+      const system = url.searchParams.get("system");
+      const data = (this.orgs.get(user.sub) ?? []).filter((o) => !system || o.system === system);
+      return reply(200, { data, total_count: data.length });
+    }
+    return reply(404, {});
+  };
+  /** The part of /v1/auth/* a password sign-in and the sign-in form read. */
+  ownScreen(url, init) {
+    const reply = (status, body) => new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json" } });
+    const refuse = (status, code, message) => reply(status, { errors: [{ code, message }] });
+    if (new Headers(init?.headers).get("x-tenant-key") !== this.tenant) return refuse(404, "tenant_not_found", "no such workspace");
+    const method = init?.method ?? "GET";
+    if (method === "POST" && url.pathname === "/v1/auth/login") {
+      const body = JSON.parse(String(init?.body ?? "{}"));
+      const user = [...this.users.values()].find((u) => u.email === body.email);
+      const password = body.email === void 0 ? void 0 : this.passwords.get(body.email);
+      if (!user || !user.active || password === void 0 || password !== body.password) {
+        return refuse(401, "invalid_credentials", "invalid email or password");
+      }
+      return reply(200, { data: this.issue(user.sub) });
+    }
+    if (method === "GET" && url.pathname === "/v1/auth/settings") return reply(200, { data: this.settings });
+    if (method === "GET" && (url.pathname === "/v1/auth/social/providers" || url.pathname === "/v1/auth/sso/connections")) return reply(200, { data: [] });
+    if (method === "GET" && url.pathname === "/v1/auth/webauthn/place") return reply(200, { data: { here: false, on_cauthy: false } });
+    return refuse(404, "not_found", "not found");
+  }
+};
+var Browser = class {
+  /** `requestHeader: false`: a browser whose client sends no X-Cauthy-Request, as cauthy-auth 0.42's does not. */
+  constructor(origin = "https://app.test", options = {}) {
+    this.origin = origin;
+    this.options = options;
+  }
+  origin;
+  options;
+  jar = /* @__PURE__ */ new Map();
+  request(path, init = {}) {
+    const headers = new Headers(init.headers);
+    if (this.jar.size > 0) headers.set("cookie", [...this.jar].map(([k, v]) => `${k}=${v}`).join("; "));
+    const method = (init.method ?? "GET").toUpperCase();
+    if (method !== "GET" && method !== "HEAD" && this.options.requestHeader !== false && !headers.has("x-cauthy-request")) {
+      headers.set("x-cauthy-request", "1");
+    }
+    return new Request(this.origin + path, { ...init, headers });
+  }
+  /** Keeps the cookies of a response, as a browser would. */
+  take(source) {
+    const cookies = Array.isArray(source) ? source : source.headers.getSetCookie();
+    for (const c of cookies) {
+      const [pair, ...attrs] = c.split("; ");
+      const i = pair.indexOf("=");
+      const name = pair.slice(0, i);
+      const value = pair.slice(i + 1);
+      if (value === "" || attrs.includes("Max-Age=0")) this.jar.delete(name);
+      else this.jar.set(name, value);
+    }
+  }
+};
+export {
+  Browser,
+  FakeCauthy
+};
+//# sourceMappingURL=testing.mjs.map

package/dist/testing.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/testing.ts"],"sourcesContent":["// A Cauthy that lives in memory, and a browser that keeps cookies: what the\n// tests sign in against. Exported as `@cauthyhq/node/testing`, for tests only:\n// it signs in anyone it was told about, and checks nothing a real Cauthy does.\n\nexport class FakeCauthy {\n  readonly issuer = 'https://id.test'\n  users = new Map<string, { sub: string; email: string; name: string; active: boolean; restricted: boolean; anonymous?: boolean; verified?: boolean }>()\n  codes = new Map<string, { sub: string; challenge: string; redirectUri: string }>()\n  refresh = new Map<string, string>() // refresh token → sub\n  access = new Map<string, string>() // access token → sub\n  orgs = new Map<string, Record<string, unknown>[]>() // sub → organizations\n  revoked: string[] = []\n  checks: { organization: string; sub: string; body: any }[] = []\n  calls: string[] = []\n  down = false\n  expiresIn = 600\n  /** What token answers say of the session's kind; absent means an older Cauthy that does not say. */\n  persistent: boolean | undefined = undefined\n  /** Serve the API an application's own screens use (/v1/auth/*). Off unless a test asks. */\n  ownScreens = false\n  /** The workspace those screens sign in to, as X-Tenant-Key names it. */\n  tenant = 'acme'\n  /** Each account's password, by email: only these accounts sign in with one. */\n  passwords = new Map<string, string>()\n  /** What GET /v1/auth/settings answers. */\n  settings: Record<string, unknown> = { allow_password: true, allow_signup: false, allow_passkeys: false, persistent_sessions: false }\n  private n = 0\n\n  constructor() {\n    this.users.set('u1', { sub: 'u1', email: 'ana@acme.com', name: 'Ana', active: true, restricted: false })\n  }\n\n  /** What the hosted page does once the person has signed in: hands the browser a code. */\n  authorize(location: string, sub = 'u1'): string {\n    const q = new URL(location).searchParams\n    if (q.get('response_type') !== 'code') throw new Error('Cauthy answers unsupported_response_type: response_type=code is required')\n    const code = `code-${++this.n}`\n    this.codes.set(code, { sub, challenge: q.get('code_challenge') ?? '', redirectUri: q.get('redirect_uri') ?? '' })\n    return `${q.get('redirect_uri')}?code=${code}&state=${q.get('state')}`\n  }\n\n  private issue(sub: string) {\n    const at = `at-${++this.n}`\n    const rt = `rt-${++this.n}`\n    this.access.set(at, sub)\n    this.refresh.set(rt, sub)\n    return { access_token: at, refresh_token: rt, token_type: 'Bearer', expires_in: this.expiresIn, scope: '', ...(this.persistent === undefined ? {} : { persistent: this.persistent }) }\n  }\n\n  fetch: typeof fetch = async (input, init) => {\n    const url = new URL(typeof input === 'string' ? input : input instanceof URL ? input.href : input.url)\n    this.calls.push(`${init?.method ?? 'GET'} ${url.pathname}`)\n    if (this.down) throw new TypeError('fetch failed')\n    const reply = (status: number, body: unknown) =>\n      new Response(JSON.stringify(body), { status, headers: { 'content-type': 'application/json' } })\n    const form = new URLSearchParams(init?.body instanceof URLSearchParams ? init.body : String(init?.body ?? ''))\n    const bearer = new Headers(init?.headers).get('authorization')?.replace('Bearer ', '') ?? ''\n    if (this.ownScreens && url.pathname.startsWith('/v1/auth/')) return this.ownScreen(url, init)\n\n    if (url.pathname === '/v1/oauth/token') {\n      if (form.get('grant_type') === 'authorization_code') {\n        const c = this.codes.get(form.get('code') ?? '')\n        this.codes.delete(form.get('code') ?? '')\n        const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(form.get('code_verifier') ?? ''))\n        const challenge = btoa(String.fromCharCode(...new Uint8Array(digest))).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '')\n        if (!c || c.challenge !== challenge || c.redirectUri !== form.get('redirect_uri')) return reply(400, { error: 'invalid_grant', error_description: 'the grant is invalid, expired or already used' })\n        return reply(200, this.issue(c.sub))\n      }\n      if (form.get('grant_type') === 'refresh_token') {\n        const sub = this.refresh.get(form.get('refresh_token') ?? '')\n        this.refresh.delete(form.get('refresh_token') ?? '') // used once\n        if (!sub || !this.users.get(sub)?.active) return reply(400, { error: 'invalid_grant', error_description: 'the grant is invalid, expired or already used' })\n        return reply(200, this.issue(sub))\n      }\n      return reply(400, { error: 'unsupported_grant_type', error_description: 'supported grant types: authorization_code, refresh_token' })\n    }\n    if (url.pathname === '/v1/oauth/revoke') {\n      this.revoked.push(form.get('token') ?? '')\n      this.refresh.delete(form.get('token') ?? '')\n      return reply(200, {})\n    }\n    const sub = this.access.get(bearer)\n    const user = sub ? this.users.get(sub) : undefined\n    if (url.pathname === '/v1/oauth/userinfo') {\n      if (!user) return reply(401, {})\n      return reply(200, { sub: user.sub, tid: 't1', email: user.email, name: user.name, email_verified: user.verified ?? !user.anonymous, restricted: user.restricted, roles: ['member'], ...(user.anonymous ? { anonymous: true } : {}) })\n    }\n    const asking = url.pathname.match(/^\\/v1\\/oauth\\/organizations\\/([^/]+)\\/check$/)\n    if (asking && init?.method === 'POST') {\n      if (!user) return reply(401, { errors: [{ code: 'unauthorized', message: 'invalid or expired token' }] })\n      const org = decodeURIComponent(asking[1])\n      const body = JSON.parse(String(init.body))\n      this.checks.push({ organization: org, sub: user.sub, body })\n      if (!(this.orgs.get(user.sub) ?? []).some((o) => o.id === org)) return reply(404, { errors: [{ code: 'organization_not_found', message: 'organization not found' }] })\n      // An accountant approves invoices up to a million.\n      const allowed = body.resource === 'invoices' && body.action === 'approve' && Number(body.attributes?.amount) <= 1_000_000\n      return reply(200, { data: allowed\n        ? { allowed, reason: 'allowed by role accountant: invoices:approve', rule: { source: 'role', role: 'accountant', kind: '*', resource: 'invoices', action: 'approve', effect: 'allow', condition: 'resource.attrs.amount <= 1000000' } }\n        : { allowed, reason: 'no rule allows it' } })\n    }\n    if (url.pathname === '/v1/oauth/organizations') {\n      if (!user) return reply(401, {})\n      const system = url.searchParams.get('system')\n      const data = (this.orgs.get(user.sub) ?? []).filter((o) => !system || o.system === system)\n      return reply(200, { data, total_count: data.length })\n    }\n    return reply(404, {})\n  }\n\n  /** The part of /v1/auth/* a password sign-in and the sign-in form read. */\n  private ownScreen(url: URL, init: RequestInit | undefined): Response {\n    const reply = (status: number, body: unknown) =>\n      new Response(JSON.stringify(body), { status, headers: { 'content-type': 'application/json' } })\n    const refuse = (status: number, code: string, message: string) => reply(status, { errors: [{ code, message }] })\n    if (new Headers(init?.headers).get('x-tenant-key') !== this.tenant) return refuse(404, 'tenant_not_found', 'no such workspace')\n    const method = init?.method ?? 'GET'\n    if (method === 'POST' && url.pathname === '/v1/auth/login') {\n      const body = JSON.parse(String(init?.body ?? '{}')) as { email?: string; password?: string }\n      const user = [...this.users.values()].find((u) => u.email === body.email)\n      const password = body.email === undefined ? undefined : this.passwords.get(body.email)\n      if (!user || !user.active || password === undefined || password !== body.password) {\n        return refuse(401, 'invalid_credentials', 'invalid email or password')\n      }\n      return reply(200, { data: this.issue(user.sub) })\n    }\n    if (method === 'GET' && url.pathname === '/v1/auth/settings') return reply(200, { data: this.settings })\n    if (method === 'GET' && (url.pathname === '/v1/auth/social/providers' || url.pathname === '/v1/auth/sso/connections')) return reply(200, { data: [] })\n    if (method === 'GET' && url.pathname === '/v1/auth/webauthn/place') return reply(200, { data: { here: false, on_cauthy: false } })\n    return refuse(404, 'not_found', 'not found')\n  }\n}\n\n/** A browser as far as cookies go: it keeps what it is told to and sends it back. */\nexport class Browser {\n  jar = new Map<string, string>()\n  /** `requestHeader: false`: a browser whose client sends no X-Cauthy-Request, as cauthy-auth 0.42's does not. */\n  constructor(readonly origin = 'https://app.test', private readonly options: { requestHeader?: boolean } = {}) {}\n\n  request(path: string, init: RequestInit = {}): Request {\n    const headers = new Headers(init.headers)\n    if (this.jar.size > 0) headers.set('cookie', [...this.jar].map(([k, v]) => `${k}=${v}`).join('; '))\n    // What a protocol-1 client sends on every mutation.\n    const method = (init.method ?? 'GET').toUpperCase()\n    if (method !== 'GET' && method !== 'HEAD' && this.options.requestHeader !== false && !headers.has('x-cauthy-request')) {\n      headers.set('x-cauthy-request', '1')\n    }\n    return new Request(this.origin + path, { ...init, headers })\n  }\n\n  /** Keeps the cookies of a response, as a browser would. */\n  take(source: Response | string[]): void {\n    const cookies = Array.isArray(source) ? source : source.headers.getSetCookie()\n    for (const c of cookies) {\n      const [pair, ...attrs] = c.split('; ')\n      const i = pair.indexOf('=')\n      const name = pair.slice(0, i)\n      const value = pair.slice(i + 1)\n      if (value === '' || attrs.includes('Max-Age=0')) this.jar.delete(name)\n      else this.jar.set(name, value)\n    }\n  }\n}\n"],"mappings":";AAIO,IAAM,aAAN,MAAiB;AAAA,EACb,SAAS;AAAA,EAClB,QAAQ,oBAAI,IAAyI;AAAA,EACrJ,QAAQ,oBAAI,IAAqE;AAAA,EACjF,UAAU,oBAAI,IAAoB;AAAA;AAAA,EAClC,SAAS,oBAAI,IAAoB;AAAA;AAAA,EACjC,OAAO,oBAAI,IAAuC;AAAA;AAAA,EAClD,UAAoB,CAAC;AAAA,EACrB,SAA6D,CAAC;AAAA,EAC9D,QAAkB,CAAC;AAAA,EACnB,OAAO;AAAA,EACP,YAAY;AAAA;AAAA,EAEZ,aAAkC;AAAA;AAAA,EAElC,aAAa;AAAA;AAAA,EAEb,SAAS;AAAA;AAAA,EAET,YAAY,oBAAI,IAAoB;AAAA;AAAA,EAEpC,WAAoC,EAAE,gBAAgB,MAAM,cAAc,OAAO,gBAAgB,OAAO,qBAAqB,MAAM;AAAA,EAC3H,IAAI;AAAA,EAEZ,cAAc;AACZ,SAAK,MAAM,IAAI,MAAM,EAAE,KAAK,MAAM,OAAO,gBAAgB,MAAM,OAAO,QAAQ,MAAM,YAAY,MAAM,CAAC;AAAA,EACzG;AAAA;AAAA,EAGA,UAAU,UAAkB,MAAM,MAAc;AAC9C,UAAM,IAAI,IAAI,IAAI,QAAQ,EAAE;AAC5B,QAAI,EAAE,IAAI,eAAe,MAAM,OAAQ,OAAM,IAAI,MAAM,0EAA0E;AACjI,UAAM,OAAO,QAAQ,EAAE,KAAK,CAAC;AAC7B,SAAK,MAAM,IAAI,MAAM,EAAE,KAAK,WAAW,EAAE,IAAI,gBAAgB,KAAK,IAAI,aAAa,EAAE,IAAI,cAAc,KAAK,GAAG,CAAC;AAChH,WAAO,GAAG,EAAE,IAAI,cAAc,CAAC,SAAS,IAAI,UAAU,EAAE,IAAI,OAAO,CAAC;AAAA,EACtE;AAAA,EAEQ,MAAM,KAAa;AACzB,UAAM,KAAK,MAAM,EAAE,KAAK,CAAC;AACzB,UAAM,KAAK,MAAM,EAAE,KAAK,CAAC;AACzB,SAAK,OAAO,IAAI,IAAI,GAAG;AACvB,SAAK,QAAQ,IAAI,IAAI,GAAG;AACxB,WAAO,EAAE,cAAc,IAAI,eAAe,IAAI,YAAY,UAAU,YAAY,KAAK,WAAW,OAAO,IAAI,GAAI,KAAK,eAAe,SAAY,CAAC,IAAI,EAAE,YAAY,KAAK,WAAW,EAAG;AAAA,EACvL;AAAA,EAEA,QAAsB,OAAO,OAAO,SAAS;AAC3C,UAAM,MAAM,IAAI,IAAI,OAAO,UAAU,WAAW,QAAQ,iBAAiB,MAAM,MAAM,OAAO,MAAM,GAAG;AACrG,SAAK,MAAM,KAAK,GAAG,MAAM,UAAU,KAAK,IAAI,IAAI,QAAQ,EAAE;AAC1D,QAAI,KAAK,KAAM,OAAM,IAAI,UAAU,cAAc;AACjD,UAAM,QAAQ,CAAC,QAAgB,SAC7B,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG,EAAE,QAAQ,SAAS,EAAE,gBAAgB,mBAAmB,EAAE,CAAC;AAChG,UAAM,OAAO,IAAI,gBAAgB,MAAM,gBAAgB,kBAAkB,KAAK,OAAO,OAAO,MAAM,QAAQ,EAAE,CAAC;AAC7G,UAAM,SAAS,IAAI,QAAQ,MAAM,OAAO,EAAE,IAAI,eAAe,GAAG,QAAQ,WAAW,EAAE,KAAK;AAC1F,QAAI,KAAK,cAAc,IAAI,SAAS,WAAW,WAAW,EAAG,QAAO,KAAK,UAAU,KAAK,IAAI;AAE5F,QAAI,IAAI,aAAa,mBAAmB;AACtC,UAAI,KAAK,IAAI,YAAY,MAAM,sBAAsB;AACnD,cAAM,IAAI,KAAK,MAAM,IAAI,KAAK,IAAI,MAAM,KAAK,EAAE;AAC/C,aAAK,MAAM,OAAO,KAAK,IAAI,MAAM,KAAK,EAAE;AACxC,cAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,YAAY,EAAE,OAAO,KAAK,IAAI,eAAe,KAAK,EAAE,CAAC;AAC9G,cAAM,YAAY,KAAK,OAAO,aAAa,GAAG,IAAI,WAAW,MAAM,CAAC,CAAC,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAChI,YAAI,CAAC,KAAK,EAAE,cAAc,aAAa,EAAE,gBAAgB,KAAK,IAAI,cAAc,EAAG,QAAO,MAAM,KAAK,EAAE,OAAO,iBAAiB,mBAAmB,gDAAgD,CAAC;AACnM,eAAO,MAAM,KAAK,KAAK,MAAM,EAAE,GAAG,CAAC;AAAA,MACrC;AACA,UAAI,KAAK,IAAI,YAAY,MAAM,iBAAiB;AAC9C,cAAMA,OAAM,KAAK,QAAQ,IAAI,KAAK,IAAI,eAAe,KAAK,EAAE;AAC5D,aAAK,QAAQ,OAAO,KAAK,IAAI,eAAe,KAAK,EAAE;AACnD,YAAI,CAACA,QAAO,CAAC,KAAK,MAAM,IAAIA,IAAG,GAAG,OAAQ,QAAO,MAAM,KAAK,EAAE,OAAO,iBAAiB,mBAAmB,gDAAgD,CAAC;AAC1J,eAAO,MAAM,KAAK,KAAK,MAAMA,IAAG,CAAC;AAAA,MACnC;AACA,aAAO,MAAM,KAAK,EAAE,OAAO,0BAA0B,mBAAmB,2DAA2D,CAAC;AAAA,IACtI;AACA,QAAI,IAAI,aAAa,oBAAoB;AACvC,WAAK,QAAQ,KAAK,KAAK,IAAI,OAAO,KAAK,EAAE;AACzC,WAAK,QAAQ,OAAO,KAAK,IAAI,OAAO,KAAK,EAAE;AAC3C,aAAO,MAAM,KAAK,CAAC,CAAC;AAAA,IACtB;AACA,UAAM,MAAM,KAAK,OAAO,IAAI,MAAM;AAClC,UAAM,OAAO,MAAM,KAAK,MAAM,IAAI,GAAG,IAAI;AACzC,QAAI,IAAI,aAAa,sBAAsB;AACzC,UAAI,CAAC,KAAM,QAAO,MAAM,KAAK,CAAC,CAAC;AAC/B,aAAO,MAAM,KAAK,EAAE,KAAK,KAAK,KAAK,KAAK,MAAM,OAAO,KAAK,OAAO,MAAM,KAAK,MAAM,gBAAgB,KAAK,YAAY,CAAC,KAAK,WAAW,YAAY,KAAK,YAAY,OAAO,CAAC,QAAQ,GAAG,GAAI,KAAK,YAAY,EAAE,WAAW,KAAK,IAAI,CAAC,EAAG,CAAC;AAAA,IACtO;AACA,UAAM,SAAS,IAAI,SAAS,MAAM,8CAA8C;AAChF,QAAI,UAAU,MAAM,WAAW,QAAQ;AACrC,UAAI,CAAC,KAAM,QAAO,MAAM,KAAK,EAAE,QAAQ,CAAC,EAAE,MAAM,gBAAgB,SAAS,2BAA2B,CAAC,EAAE,CAAC;AACxG,YAAM,MAAM,mBAAmB,OAAO,CAAC,CAAC;AACxC,YAAM,OAAO,KAAK,MAAM,OAAO,KAAK,IAAI,CAAC;AACzC,WAAK,OAAO,KAAK,EAAE,cAAc,KAAK,KAAK,KAAK,KAAK,KAAK,CAAC;AAC3D,UAAI,EAAE,KAAK,KAAK,IAAI,KAAK,GAAG,KAAK,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,OAAO,GAAG,EAAG,QAAO,MAAM,KAAK,EAAE,QAAQ,CAAC,EAAE,MAAM,0BAA0B,SAAS,yBAAyB,CAAC,EAAE,CAAC;AAErK,YAAM,UAAU,KAAK,aAAa,cAAc,KAAK,WAAW,aAAa,OAAO,KAAK,YAAY,MAAM,KAAK;AAChH,aAAO,MAAM,KAAK,EAAE,MAAM,UACtB,EAAE,SAAS,QAAQ,gDAAgD,MAAM,EAAE,QAAQ,QAAQ,MAAM,cAAc,MAAM,KAAK,UAAU,YAAY,QAAQ,WAAW,QAAQ,SAAS,WAAW,mCAAmC,EAAE,IACpO,EAAE,SAAS,QAAQ,oBAAoB,EAAE,CAAC;AAAA,IAChD;AACA,QAAI,IAAI,aAAa,2BAA2B;AAC9C,UAAI,CAAC,KAAM,QAAO,MAAM,KAAK,CAAC,CAAC;AAC/B,YAAM,SAAS,IAAI,aAAa,IAAI,QAAQ;AAC5C,YAAM,QAAQ,KAAK,KAAK,IAAI,KAAK,GAAG,KAAK,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,WAAW,MAAM;AACzF,aAAO,MAAM,KAAK,EAAE,MAAM,aAAa,KAAK,OAAO,CAAC;AAAA,IACtD;AACA,WAAO,MAAM,KAAK,CAAC,CAAC;AAAA,EACtB;AAAA;AAAA,EAGQ,UAAU,KAAU,MAAyC;AACnE,UAAM,QAAQ,CAAC,QAAgB,SAC7B,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG,EAAE,QAAQ,SAAS,EAAE,gBAAgB,mBAAmB,EAAE,CAAC;AAChG,UAAM,SAAS,CAAC,QAAgB,MAAc,YAAoB,MAAM,QAAQ,EAAE,QAAQ,CAAC,EAAE,MAAM,QAAQ,CAAC,EAAE,CAAC;AAC/G,QAAI,IAAI,QAAQ,MAAM,OAAO,EAAE,IAAI,cAAc,MAAM,KAAK,OAAQ,QAAO,OAAO,KAAK,oBAAoB,mBAAmB;AAC9H,UAAM,SAAS,MAAM,UAAU;AAC/B,QAAI,WAAW,UAAU,IAAI,aAAa,kBAAkB;AAC1D,YAAM,OAAO,KAAK,MAAM,OAAO,MAAM,QAAQ,IAAI,CAAC;AAClD,YAAM,OAAO,CAAC,GAAG,KAAK,MAAM,OAAO,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,UAAU,KAAK,KAAK;AACxE,YAAM,WAAW,KAAK,UAAU,SAAY,SAAY,KAAK,UAAU,IAAI,KAAK,KAAK;AACrF,UAAI,CAAC,QAAQ,CAAC,KAAK,UAAU,aAAa,UAAa,aAAa,KAAK,UAAU;AACjF,eAAO,OAAO,KAAK,uBAAuB,2BAA2B;AAAA,MACvE;AACA,aAAO,MAAM,KAAK,EAAE,MAAM,KAAK,MAAM,KAAK,GAAG,EAAE,CAAC;AAAA,IAClD;AACA,QAAI,WAAW,SAAS,IAAI,aAAa,oBAAqB,QAAO,MAAM,KAAK,EAAE,MAAM,KAAK,SAAS,CAAC;AACvG,QAAI,WAAW,UAAU,IAAI,aAAa,+BAA+B,IAAI,aAAa,4BAA6B,QAAO,MAAM,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;AACrJ,QAAI,WAAW,SAAS,IAAI,aAAa,0BAA2B,QAAO,MAAM,KAAK,EAAE,MAAM,EAAE,MAAM,OAAO,WAAW,MAAM,EAAE,CAAC;AACjI,WAAO,OAAO,KAAK,aAAa,WAAW;AAAA,EAC7C;AACF;AAGO,IAAM,UAAN,MAAc;AAAA;AAAA,EAGnB,YAAqB,SAAS,oBAAqC,UAAuC,CAAC,GAAG;AAAzF;AAA8C;AAAA,EAA4C;AAAA,EAA1F;AAAA,EAA8C;AAAA,EAFnE,MAAM,oBAAI,IAAoB;AAAA,EAI9B,QAAQ,MAAc,OAAoB,CAAC,GAAY;AACrD,UAAM,UAAU,IAAI,QAAQ,KAAK,OAAO;AACxC,QAAI,KAAK,IAAI,OAAO,EAAG,SAAQ,IAAI,UAAU,CAAC,GAAG,KAAK,GAAG,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,IAAI,CAAC;AAElG,UAAM,UAAU,KAAK,UAAU,OAAO,YAAY;AAClD,QAAI,WAAW,SAAS,WAAW,UAAU,KAAK,QAAQ,kBAAkB,SAAS,CAAC,QAAQ,IAAI,kBAAkB,GAAG;AACrH,cAAQ,IAAI,oBAAoB,GAAG;AAAA,IACrC;AACA,WAAO,IAAI,QAAQ,KAAK,SAAS,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC;AAAA,EAC7D;AAAA;AAAA,EAGA,KAAK,QAAmC;AACtC,UAAM,UAAU,MAAM,QAAQ,MAAM,IAAI,SAAS,OAAO,QAAQ,aAAa;AAC7E,eAAW,KAAK,SAAS;AACvB,YAAM,CAAC,MAAM,GAAG,KAAK,IAAI,EAAE,MAAM,IAAI;AACrC,YAAM,IAAI,KAAK,QAAQ,GAAG;AAC1B,YAAM,OAAO,KAAK,MAAM,GAAG,CAAC;AAC5B,YAAM,QAAQ,KAAK,MAAM,IAAI,CAAC;AAC9B,UAAI,UAAU,MAAM,MAAM,SAAS,WAAW,EAAG,MAAK,IAAI,OAAO,IAAI;AAAA,UAChE,MAAK,IAAI,IAAI,MAAM,KAAK;AAAA,IAC/B;AAAA,EACF;AACF;","names":["sub"]}