@cleverclouds/auth-client 0.0.0-stage → 1.0.0

package/dist/express/index.js

@@ -0,0 +1,296 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAuthMiddleware = createAuthMiddleware;
+__exportStar(require("./types.js"), exports);
+function parseCookies(cookieHeader) {
+    const list = {};
+    if (!cookieHeader)
+        return list;
+    for (const cookie of cookieHeader.split(';')) {
+        const parts = cookie.split('=');
+        const name = parts[0]?.trim();
+        const val = parts.slice(1).join('=').trim();
+        if (name) {
+            try {
+                list[name] = decodeURIComponent(val);
+            }
+            catch {
+                list[name] = val;
+            }
+        }
+    }
+    return list;
+}
+/**
+ * Creates Express authentication and authorization middlewares bound to a CleverCloudsAuthClient instance.
+ */
+function createAuthMiddleware(client, options = {}) {
+    const cookieName = options.cookieName || 'cc_session';
+    const cookieOptions = {
+        httpOnly: options.cookieOptions?.httpOnly ?? true,
+        secure: options.cookieOptions?.secure ?? (process.env.NODE_ENV === 'production'),
+        sameSite: options.cookieOptions?.sameSite ?? 'lax',
+        path: options.cookieOptions?.path ?? '/',
+        maxAge: options.cookieOptions?.maxAge ?? 24 * 60 * 60 * 1000,
+    };
+    /**
+     * Helper to resolve the authenticated session from cookies or Bearer Authorization header.
+     */
+    async function resolveSession(req) {
+        if (req.auth) {
+            return req.auth;
+        }
+        // 1. Check cookies (Express cookie-parser or raw Cookie header fallback)
+        const cookies = req.cookies || parseCookies(req.headers.cookie);
+        const sessionCookie = cookies[cookieName];
+        if (sessionCookie) {
+            const verified = client.verifySessionCookie(sessionCookie);
+            if (verified)
+                return verified;
+            // Fallback: verify directly with Identity if sessionToken string was stored
+            const remote = await client.verifySession(sessionCookie);
+            if (remote)
+                return remote;
+        }
+        // 2. Check Authorization Bearer header (for direct API / service-to-service calls)
+        const authHeader = req.headers.authorization;
+        if (authHeader && authHeader.startsWith('Bearer ')) {
+            const token = authHeader.slice(7).trim();
+            if (token) {
+                const verified = client.verifySessionCookie(token);
+                if (verified)
+                    return verified;
+                const remote = await client.verifySession(token);
+                if (remote)
+                    return remote;
+            }
+        }
+        return null;
+    }
+    /**
+     * Middleware requiring a valid authenticated session.
+     */
+    function requireAuth(authOptions = {}) {
+        return async (req, res, next) => {
+            try {
+                const session = await resolveSession(req);
+                if (session) {
+                    req.auth = session;
+                    return next();
+                }
+                const wantsHtml = authOptions.redirectToLogin !== false &&
+                    (authOptions.redirectToLogin || (req.headers.accept && req.headers.accept.includes('text/html')));
+                if (wantsHtml) {
+                    const returnTo = req.originalUrl || req.url || '/';
+                    res.redirect(client.getLoginUrl({ returnTo }));
+                    return;
+                }
+                res.status(401).json({
+                    error: 'Unauthorized',
+                    message: 'Authentication required. Please sign in.',
+                });
+            }
+            catch (err) {
+                next(err);
+            }
+        };
+    }
+    /**
+     * Middleware requiring one or more application-scoped permissions.
+     */
+    function requirePermission(permission, permOptions = {}) {
+        return async (req, res, next) => {
+            try {
+                const session = await resolveSession(req);
+                if (!session) {
+                    const wantsHtml = req.headers.accept && req.headers.accept.includes('text/html');
+                    if (wantsHtml) {
+                        res.redirect(client.getLoginUrl({ returnTo: req.originalUrl || req.url }));
+                        return;
+                    }
+                    res.status(401).json({
+                        error: 'Unauthorized',
+                        message: 'Authentication required. Please sign in.',
+                    });
+                    return;
+                }
+                req.auth = session;
+                const granted = session.permissions || [];
+                let allowed = false;
+                if (Array.isArray(permission)) {
+                    allowed =
+                        permOptions.requireAll !== false
+                            ? client.hasAllPermissions(granted, permission)
+                            : client.hasAnyPermission(granted, permission);
+                }
+                else {
+                    allowed = client.hasPermission(granted, permission);
+                }
+                if (!allowed) {
+                    res.status(403).json({
+                        error: 'Forbidden',
+                        message: `Missing required permission: ${Array.isArray(permission) ? permission.join(', ') : permission}`,
+                        required: permission,
+                        granted,
+                    });
+                    return;
+                }
+                next();
+            }
+            catch (err) {
+                next(err);
+            }
+        };
+    }
+    /**
+     * Middleware requiring one or more application roles.
+     */
+    function requireRole(role) {
+        return async (req, res, next) => {
+            try {
+                const session = await resolveSession(req);
+                if (!session) {
+                    const wantsHtml = req.headers.accept && req.headers.accept.includes('text/html');
+                    if (wantsHtml) {
+                        res.redirect(client.getLoginUrl({ returnTo: req.originalUrl || req.url }));
+                        return;
+                    }
+                    res.status(401).json({
+                        error: 'Unauthorized',
+                        message: 'Authentication required. Please sign in.',
+                    });
+                    return;
+                }
+                req.auth = session;
+                const grantedRoles = session.roles || [];
+                const allowed = Array.isArray(role)
+                    ? client.hasAnyRole(grantedRoles, role)
+                    : client.hasRole(grantedRoles, role);
+                if (!allowed) {
+                    res.status(403).json({
+                        error: 'Forbidden',
+                        message: `Missing required role: ${Array.isArray(role) ? role.join(', ') : role}`,
+                        required: role,
+                        granted: grantedRoles,
+                    });
+                    return;
+                }
+                next();
+            }
+            catch (err) {
+                next(err);
+            }
+        };
+    }
+    /**
+     * SSO Callback Route Handler: exchanges single-use ticket, signs session cookie, and redirects user.
+     */
+    function handleCallback(callbackOptions = {}) {
+        return async (req, res) => {
+            const ticket = req.query.ticket;
+            if (!ticket) {
+                if (callbackOptions.onError) {
+                    await callbackOptions.onError(req, res, new Error('No authorization ticket found in query parameters'));
+                    return;
+                }
+                res.status(400).json({
+                    error: 'Bad Request',
+                    message: 'No authorization ticket provided',
+                });
+                return;
+            }
+            try {
+                const exchange = await client.exchangeTicketDetailed(ticket);
+                if (!exchange.success) {
+                    if (callbackOptions.onError) {
+                        await callbackOptions.onError(req, res, exchange.error);
+                        return;
+                    }
+                    const statusCode = exchange.error.statusCode || 401;
+                    res.status(statusCode).json({
+                        error: exchange.error.code,
+                        message: exchange.error.message,
+                    });
+                    return;
+                }
+                const authResult = exchange.data;
+                const signedValue = client.signSessionCookie(authResult);
+                res.cookie(cookieName, signedValue, {
+                    httpOnly: cookieOptions.httpOnly,
+                    secure: cookieOptions.secure,
+                    sameSite: cookieOptions.sameSite,
+                    path: cookieOptions.path,
+                    maxAge: cookieOptions.maxAge,
+                });
+                if (callbackOptions.onSuccess) {
+                    await callbackOptions.onSuccess(req, res, authResult);
+                }
+                // Open Redirect Prevention: Ensure redirect target is a safe relative URL path
+                const isSafeRelativeUrl = (url) => {
+                    if (!url || typeof url !== 'string')
+                        return false;
+                    return url.startsWith('/') && !url.startsWith('//') && !url.includes('\\');
+                };
+                const candidateTarget = req.query.state || req.query.returnTo;
+                const defaultTarget = isSafeRelativeUrl(callbackOptions.defaultReturnTo)
+                    ? callbackOptions.defaultReturnTo
+                    : '/';
+                const target = isSafeRelativeUrl(candidateTarget) ? candidateTarget : defaultTarget;
+                res.redirect(target);
+            }
+            catch (err) {
+                if (callbackOptions.onError) {
+                    await callbackOptions.onError(req, res, err);
+                    return;
+                }
+                res.status(500).json({
+                    error: 'Internal Server Error',
+                    message: err?.message || 'Authentication ticket exchange failed',
+                });
+            }
+        };
+    }
+    /**
+     * Logout Route Handler: clears local session cookie and optionally redirects to Identity.
+     */
+    function handleLogout(logoutOptions = {}) {
+        return (_req, res) => {
+            res.clearCookie(cookieName, {
+                path: cookieOptions.path,
+            });
+            if (logoutOptions.redirectToIdentity !== false) {
+                const returnTarget = logoutOptions.returnTo || _req.query?.returnTo;
+                res.redirect(client.getLogoutUrl(returnTarget));
+                return;
+            }
+            res.status(200).json({
+                success: true,
+                message: 'Logged out successfully',
+            });
+        };
+    }
+    return {
+        cookieName,
+        resolveSession,
+        requireAuth,
+        requirePermission,
+        requireRole,
+        handleCallback,
+        handleLogout,
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/express/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/express/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAmCA,oDA6RC;AArTD,6CAA2B;AAE3B,SAAS,YAAY,CAAC,YAAqB;IACzC,MAAM,IAAI,GAA2B,EAAE,CAAC;IACxC,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAE/B,KAAK,MAAM,MAAM,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC;gBACH,IAAI,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;YACnB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAgB,oBAAoB,CAClC,MAA8B,EAC9B,UAAiC,EAAE;IAEnC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,YAAY,CAAC;IACtD,MAAM,aAAa,GAAG;QACpB,QAAQ,EAAE,OAAO,CAAC,aAAa,EAAE,QAAQ,IAAI,IAAI;QACjD,MAAM,EAAE,OAAO,CAAC,aAAa,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;QAChF,QAAQ,EAAE,OAAO,CAAC,aAAa,EAAE,QAAQ,IAAI,KAAK;QAClD,IAAI,EAAE,OAAO,CAAC,aAAa,EAAE,IAAI,IAAI,GAAG;QACxC,MAAM,EAAE,OAAO,CAAC,aAAa,EAAE,MAAM,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;KAC7D,CAAC;IAEF;;OAEG;IACH,KAAK,UAAU,cAAc,CAAC,GAAY;QACxC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACb,OAAO,GAAG,CAAC,IAAI,CAAC;QAClB,CAAC;QAED,yEAAyE;QACzE,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAChE,MAAM,aAAa,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;QAE1C,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,QAAQ,GAAG,MAAM,CAAC,mBAAmB,CAAC,aAAa,CAAC,CAAC;YAC3D,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAC;YAE9B,4EAA4E;YAC5E,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;YACzD,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC5B,CAAC;QAED,mFAAmF;QACnF,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QAC7C,IAAI,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACnD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACzC,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,QAAQ,GAAG,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;gBACnD,IAAI,QAAQ;oBAAE,OAAO,QAAQ,CAAC;gBAE9B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;gBACjD,IAAI,MAAM;oBAAE,OAAO,MAAM,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,SAAS,WAAW,CAAC,cAAkC,EAAE;QACvD,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAiB,EAAE;YAC9E,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;gBAC1C,IAAI,OAAO,EAAE,CAAC;oBACZ,GAAG,CAAC,IAAI,GAAG,OAAO,CAAC;oBACnB,OAAO,IAAI,EAAE,CAAC;gBAChB,CAAC;gBAED,MAAM,SAAS,GACb,WAAW,CAAC,eAAe,KAAK,KAAK;oBACrC,CAAC,WAAW,CAAC,eAAe,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;gBAEpG,IAAI,SAAS,EAAE,CAAC;oBACd,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;oBACnD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;oBAC/C,OAAO;gBACT,CAAC;gBAED,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,cAAc;oBACrB,OAAO,EAAE,0CAA0C;iBACpD,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,CAAC;YACZ,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,SAAS,iBAAiB,CACxB,UAA6B,EAC7B,cAAwC,EAAE;QAE1C,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAiB,EAAE;YAC9E,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;gBAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;oBACjF,IAAI,SAAS,EAAE,CAAC;wBACd,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;wBAC3E,OAAO;oBACT,CAAC;oBACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;wBACnB,KAAK,EAAE,cAAc;wBACrB,OAAO,EAAE,0CAA0C;qBACpD,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBAED,GAAG,CAAC,IAAI,GAAG,OAAO,CAAC;gBACnB,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC;gBAC1C,IAAI,OAAO,GAAG,KAAK,CAAC;gBAEpB,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC9B,OAAO;wBACL,WAAW,CAAC,UAAU,KAAK,KAAK;4BAC9B,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,OAAO,EAAE,UAAU,CAAC;4BAC/C,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;gBACrD,CAAC;qBAAM,CAAC;oBACN,OAAO,GAAG,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;gBACtD,CAAC;gBAED,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;wBACnB,KAAK,EAAE,WAAW;wBAClB,OAAO,EAAE,gCAAgC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE;wBACzG,QAAQ,EAAE,UAAU;wBACpB,OAAO;qBACR,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBAED,IAAI,EAAE,CAAC;YACT,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,CAAC;YACZ,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,SAAS,WAAW,CAAC,IAAuB;QAC1C,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAiB,EAAE;YAC9E,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;gBAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;oBACjF,IAAI,SAAS,EAAE,CAAC;wBACd,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;wBAC3E,OAAO;oBACT,CAAC;oBACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;wBACnB,KAAK,EAAE,cAAc;wBACrB,OAAO,EAAE,0CAA0C;qBACpD,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBAED,GAAG,CAAC,IAAI,GAAG,OAAO,CAAC;gBACnB,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;gBACzC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;oBACjC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,YAAY,EAAE,IAAI,CAAC;oBACvC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;gBAEvC,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;wBACnB,KAAK,EAAE,WAAW;wBAClB,OAAO,EAAE,0BAA0B,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;wBACjF,QAAQ,EAAE,IAAI;wBACd,OAAO,EAAE,YAAY;qBACtB,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBAED,IAAI,EAAE,CAAC;YACT,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,CAAC;YACZ,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,SAAS,cAAc,CAAC,kBAAyC,EAAE;QACjE,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAiB,EAAE;YAC1D,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,MAA4B,CAAC;YAEtD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,IAAI,eAAe,CAAC,OAAO,EAAE,CAAC;oBAC5B,MAAM,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC,CAAC;oBACxG,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,aAAa;oBACpB,OAAO,EAAE,kCAAkC;iBAC5C,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;gBAC7D,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACtB,IAAI,eAAe,CAAC,OAAO,EAAE,CAAC;wBAC5B,MAAM,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;wBACxD,OAAO;oBACT,CAAC;oBACD,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,UAAU,IAAI,GAAG,CAAC;oBACpD,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC;wBAC1B,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI;wBAC1B,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO;qBAChC,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBAED,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC;gBAEjC,MAAM,WAAW,GAAG,MAAM,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;gBAEzD,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE;oBAClC,QAAQ,EAAE,aAAa,CAAC,QAAQ;oBAChC,MAAM,EAAE,aAAa,CAAC,MAAM;oBAC5B,QAAQ,EAAE,aAAa,CAAC,QAAe;oBACvC,IAAI,EAAE,aAAa,CAAC,IAAI;oBACxB,MAAM,EAAE,aAAa,CAAC,MAAM;iBAC7B,CAAC,CAAC;gBAEH,IAAI,eAAe,CAAC,SAAS,EAAE,CAAC;oBAC9B,MAAM,eAAe,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;gBACxD,CAAC;gBAED,+EAA+E;gBAC/E,MAAM,iBAAiB,GAAG,CAAC,GAA8B,EAAW,EAAE;oBACpE,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;wBAAE,OAAO,KAAK,CAAC;oBAClD,OAAO,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAC7E,CAAC,CAAC;gBAEF,MAAM,eAAe,GAAI,GAAG,CAAC,KAAK,CAAC,KAAgB,IAAK,GAAG,CAAC,KAAK,CAAC,QAAmB,CAAC;gBACtF,MAAM,aAAa,GAAG,iBAAiB,CAAC,eAAe,CAAC,eAAe,CAAC;oBACtE,CAAC,CAAC,eAAe,CAAC,eAAgB;oBAClC,CAAC,CAAC,GAAG,CAAC;gBACR,MAAM,MAAM,GAAG,iBAAiB,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,aAAa,CAAC;gBAEpF,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACvB,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,IAAI,eAAe,CAAC,OAAO,EAAE,CAAC;oBAC5B,MAAM,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;oBAC7C,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,uBAAuB;oBAC9B,OAAO,EAAE,GAAG,EAAE,OAAO,IAAI,uCAAuC;iBACjE,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,SAAS,YAAY,CAAC,gBAAqC,EAAE;QAC3D,OAAO,CAAC,IAAa,EAAE,GAAa,EAAQ,EAAE;YAC5C,GAAG,CAAC,WAAW,CAAC,UAAU,EAAE;gBAC1B,IAAI,EAAE,aAAa,CAAC,IAAI;aACzB,CAAC,CAAC;YAEH,IAAI,aAAa,CAAC,kBAAkB,KAAK,KAAK,EAAE,CAAC;gBAC/C,MAAM,YAAY,GAAG,aAAa,CAAC,QAAQ,IAAK,IAAI,CAAC,KAAK,EAAE,QAA+B,CAAC;gBAC5F,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC;gBAChD,OAAO;YACT,CAAC;YAED,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,yBAAyB;aACnC,CAAC,CAAC;QACL,CAAC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,UAAU;QACV,cAAc;QACd,WAAW;QACX,iBAAiB;QACjB,WAAW;QACX,cAAc;QACd,YAAY;KACb,CAAC;AACJ,CAAC"}

package/dist/express/types.d.ts

@@ -0,0 +1,70 @@
+import type { VerificationResult } from '../types.js';
+export interface AuthMiddlewareOptions {
+    /**
+     * Name of the cookie storing the session token.
+     * Default: 'cc_session'
+     */
+    cookieName?: string;
+    /**
+     * Cookie options when setting the session cookie in handleCallback.
+     */
+    cookieOptions?: {
+        httpOnly?: boolean;
+        secure?: boolean;
+        sameSite?: 'lax' | 'strict' | 'none' | boolean;
+        maxAge?: number;
+        path?: string;
+    };
+}
+export interface RequireAuthOptions {
+    /**
+     * If true, unauthenticated browser requests are redirected to the Identity login page.
+     * If false, a 401 Unauthorized JSON response is returned.
+     * Default: true for HTML navigation requests (Accept: text/html), false for API calls.
+     */
+    redirectToLogin?: boolean;
+}
+export interface RequirePermissionOptions {
+    /**
+     * If true, user must have all specified permissions when an array is passed.
+     * If false, user must have at least one of the specified permissions.
+     * Default: true
+     */
+    requireAll?: boolean;
+}
+export interface HandleCallbackOptions {
+    /**
+     * Default redirect target if no `state` or `returnTo` is provided in query params.
+     * Default: '/'
+     */
+    defaultReturnTo?: string;
+    /**
+     * Hook invoked after successful ticket exchange and cookie setting, before sending redirect.
+     */
+    onSuccess?: (req: any, res: any, authResult: VerificationResult) => void | Promise<void>;
+    /**
+     * Hook invoked when ticket exchange fails.
+     */
+    onError?: (req: any, res: any, error: Error) => void | Promise<void>;
+}
+export interface HandleLogoutOptions {
+    /**
+     * Redirect URL after clearing the local session.
+     * If true (or undefined), redirects to Identity login/logout URL.
+     * If false, does not redirect and returns 200 OK JSON.
+     * Default: true
+     */
+    redirectToIdentity?: boolean;
+    /**
+     * Return target after Identity finishes logging out.
+     */
+    returnTo?: string;
+}
+declare global {
+    namespace Express {
+        interface Request {
+            auth?: VerificationResult;
+        }
+    }
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/express/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/express/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEtD,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,aAAa,CAAC,EAAE;QACd,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC;QAC/C,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;CACH;AAED,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,wBAAwB;IACvC;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB;;OAEG;IACH,SAAS,CAAC,EAAE,CACV,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,GAAG,EACR,UAAU,EAAE,kBAAkB,KAC3B,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE1B;;OAEG;IACH,OAAO,CAAC,EAAE,CACR,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,GAAG,EACR,KAAK,EAAE,KAAK,KACT,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED,MAAM,WAAW,mBAAmB;IAClC;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAE7B;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,IAAI,CAAC,EAAE,kBAAkB,CAAC;SAC3B;KACF;CACF"}

package/dist/express/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/express/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/express/types.ts"],"names":[],"mappings":""}

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+export { CleverCloudsAuthClient } from './client.js';
+export * from './types.js';
+export * from './permissions.js';
+export * from './crypto.js';
+export * from './errors.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC;AACjC,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC"}

package/dist/index.js

@@ -0,0 +1,24 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CleverCloudsAuthClient = void 0;
+var client_js_1 = require("./client.js");
+Object.defineProperty(exports, "CleverCloudsAuthClient", { enumerable: true, get: function () { return client_js_1.CleverCloudsAuthClient; } });
+__exportStar(require("./types.js"), exports);
+__exportStar(require("./permissions.js"), exports);
+__exportStar(require("./crypto.js"), exports);
+__exportStar(require("./errors.js"), exports);
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,yCAAqD;AAA5C,mHAAA,sBAAsB,OAAA;AAC/B,6CAA2B;AAC3B,mDAAiC;AACjC,8CAA4B;AAC5B,8CAA4B"}

package/dist/nextjs/index.d.ts

@@ -0,0 +1,33 @@
+import { CleverCloudsAuthClient } from '../client.js';
+import type { VerificationResult } from '../types.js';
+import type { NextAuthOptions, ProtectRouteOptions } from './types.js';
+export * from './types.js';
+/**
+ * Retrieves and validates the current user session in Next.js Server Components,
+ * Server Actions, or Route Handlers.
+ */
+export declare function getServerSession(client: CleverCloudsAuthClient, options?: NextAuthOptions): Promise<VerificationResult | null>;
+/**
+ * Guard utility for Next.js Route Handlers and Server Actions.
+ * Returns { authorized: true, session } or { authorized: false, response }.
+ */
+export declare function protectRoute(client: CleverCloudsAuthClient, options?: ProtectRouteOptions): Promise<{
+    authorized: boolean;
+    session: VerificationResult | null;
+    response?: Response;
+}>;
+/**
+ * Creates a configured Next.js Auth helper instance.
+ */
+export declare function createNextAuth(client: CleverCloudsAuthClient, defaultOptions?: NextAuthOptions): {
+    client: CleverCloudsAuthClient;
+    getServerSession: (options?: NextAuthOptions) => Promise<VerificationResult | null>;
+    protectRoute: (options?: ProtectRouteOptions) => Promise<{
+        authorized: boolean;
+        session: VerificationResult | null;
+        response?: Response;
+    }>;
+    getLoginUrl: (options?: any) => string;
+    getLogoutUrl: (returnTo?: string) => string;
+};
+//# sourceMappingURL=index.d.ts.map

package/dist/nextjs/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/nextjs/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEvE,cAAc,YAAY,CAAC;AAgB3B;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,sBAAsB,EAC9B,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAkEpC;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,sBAAsB,EAC9B,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC;IACT,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB,CAAC,CAgFD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,sBAAsB,EAAE,cAAc,CAAC,EAAE,eAAe;;iCAG9D,eAAe;6BAEnB,mBAAmB;oBA7FlC,OAAO;iBACV,kBAAkB,GAAG,IAAI;mBACvB,QAAQ;;4BA6FO,GAAG;8BACD,MAAM;EAEnC"}

package/dist/nextjs/index.js

@@ -0,0 +1,178 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getServerSession = getServerSession;
+exports.protectRoute = protectRoute;
+exports.createNextAuth = createNextAuth;
+__exportStar(require("./types.js"), exports);
+function parseCookieHeader(cookieHeader) {
+    const map = {};
+    if (!cookieHeader)
+        return map;
+    for (const part of cookieHeader.split(';')) {
+        const [name, ...val] = part.split('=');
+        const key = name?.trim();
+        if (key) {
+            map[key] = decodeURIComponent(val.join('=').trim());
+        }
+    }
+    return map;
+}
+/**
+ * Retrieves and validates the current user session in Next.js Server Components,
+ * Server Actions, or Route Handlers.
+ */
+async function getServerSession(client, options = {}) {
+    const cookieName = options.cookieName || 'cc_session';
+    let token;
+    // 1. Explicit cookie store passed in
+    if (options.cookieStore) {
+        token = options.cookieStore.get(cookieName)?.value;
+    }
+    // 2. Request object passed in
+    if (!token && options.request) {
+        if ('cookies' in options.request && typeof options.request.cookies?.get === 'function') {
+            token = options.request.cookies.get(cookieName)?.value;
+        }
+        if (!token && options.request.headers) {
+            const headers = options.request.headers;
+            let rawCookie;
+            let authHeader;
+            if ('get' in headers && typeof headers.get === 'function') {
+                rawCookie = headers.get('cookie');
+                authHeader = headers.get('authorization');
+            }
+            else {
+                const record = headers;
+                rawCookie = record['cookie'];
+                authHeader = record['authorization'];
+            }
+            if (rawCookie) {
+                token = parseCookieHeader(rawCookie)[cookieName];
+            }
+            if (!token && authHeader && authHeader.startsWith('Bearer ')) {
+                token = authHeader.slice(7).trim();
+            }
+        }
+    }
+    // 3. Dynamic next/headers import fallback (for Next.js App Router server components)
+    if (!token) {
+        try {
+            // Dynamic import to avoid hard dependency on next
+            // @ts-ignore
+            const nextHeaders = await import('next/headers');
+            if (typeof nextHeaders.cookies === 'function') {
+                const cookies = await nextHeaders.cookies();
+                token = cookies?.get?.(cookieName)?.value;
+            }
+        }
+        catch {
+            // Ignored if outside of Next.js server execution context
+        }
+    }
+    if (!token) {
+        return null;
+    }
+    // Verify HMAC-signed or base64 cookie
+    const verified = client.verifySessionCookie(token);
+    if (verified) {
+        return verified;
+    }
+    // Remote verification fallback with Identity server
+    return await client.verifySession(token);
+}
+/**
+ * Guard utility for Next.js Route Handlers and Server Actions.
+ * Returns { authorized: true, session } or { authorized: false, response }.
+ */
+async function protectRoute(client, options = {}) {
+    const session = await getServerSession(client, options);
+    if (!session) {
+        if (options.redirectOnUnauthorized) {
+            const returnTo = options.returnTo || '/';
+            const redirectUrl = client.getLoginUrl({ returnTo });
+            return {
+                authorized: false,
+                session: null,
+                response: Response.redirect(redirectUrl, 307),
+            };
+        }
+        return {
+            authorized: false,
+            session: null,
+            response: new Response(JSON.stringify({ error: 'Unauthorized', message: 'Authentication required' }), { status: 401, headers: { 'Content-Type': 'application/json' } }),
+        };
+    }
+    // Check permissions if specified
+    if (options.permission) {
+        const granted = session.permissions || [];
+        let hasPerm = false;
+        if (Array.isArray(options.permission)) {
+            hasPerm =
+                options.requireAllPermissions !== false
+                    ? client.hasAllPermissions(granted, options.permission)
+                    : client.hasAnyPermission(granted, options.permission);
+        }
+        else {
+            hasPerm = client.hasPermission(granted, options.permission);
+        }
+        if (!hasPerm) {
+            return {
+                authorized: false,
+                session,
+                response: new Response(JSON.stringify({
+                    error: 'Forbidden',
+                    message: `Missing required permission: ${Array.isArray(options.permission) ? options.permission.join(', ') : options.permission}`,
+                    required: options.permission,
+                    granted,
+                }), { status: 403, headers: { 'Content-Type': 'application/json' } }),
+            };
+        }
+    }
+    // Check roles if specified
+    if (options.role) {
+        const grantedRoles = session.roles || [];
+        const hasRole = Array.isArray(options.role)
+            ? client.hasAnyRole(grantedRoles, options.role)
+            : client.hasRole(grantedRoles, options.role);
+        if (!hasRole) {
+            return {
+                authorized: false,
+                session,
+                response: new Response(JSON.stringify({
+                    error: 'Forbidden',
+                    message: `Missing required role: ${Array.isArray(options.role) ? options.role.join(', ') : options.role}`,
+                    required: options.role,
+                    granted: grantedRoles,
+                }), { status: 403, headers: { 'Content-Type': 'application/json' } }),
+            };
+        }
+    }
+    return { authorized: true, session };
+}
+/**
+ * Creates a configured Next.js Auth helper instance.
+ */
+function createNextAuth(client, defaultOptions) {
+    return {
+        client,
+        getServerSession: (options) => getServerSession(client, { ...defaultOptions, ...options }),
+        protectRoute: (options) => protectRoute(client, { ...defaultOptions, ...options }),
+        getLoginUrl: (options) => client.getLoginUrl(options),
+        getLogoutUrl: (returnTo) => client.getLogoutUrl(returnTo),
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/nextjs/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/nextjs/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAwBA,4CAqEC;AAMD,oCAuFC;AAKD,wCAUC;AArMD,6CAA2B;AAE3B,SAAS,iBAAiB,CAAC,YAAqB;IAC9C,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,IAAI,CAAC,YAAY;QAAE,OAAO,GAAG,CAAC;IAE9B,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,CAAC,IAAI,EAAE,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC;QACzB,IAAI,GAAG,EAAE,CAAC;YACR,GAAG,CAAC,GAAG,CAAC,GAAG,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,gBAAgB,CACpC,MAA8B,EAC9B,UAA2B,EAAE;IAE7B,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,YAAY,CAAC;IACtD,IAAI,KAAyB,CAAC;IAE9B,qCAAqC;IACrC,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC;IACrD,CAAC;IAED,8BAA8B;IAC9B,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QAC9B,IAAI,SAAS,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,KAAK,UAAU,EAAE,CAAC;YACvF,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC;QACzD,CAAC;QAED,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACtC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;YACxC,IAAI,SAAoC,CAAC;YACzC,IAAI,UAAqC,CAAC;YAE1C,IAAI,KAAK,IAAI,OAAO,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;gBAC1D,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAClC,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YAC5C,CAAC;iBAAM,CAAC;gBACN,MAAM,MAAM,GAAG,OAA6C,CAAC;gBAC7D,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAC7B,UAAU,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC;YACvC,CAAC;YAED,IAAI,SAAS,EAAE,CAAC;gBACd,KAAK,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC,UAAU,CAAC,CAAC;YACnD,CAAC;YAED,IAAI,CAAC,KAAK,IAAI,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC7D,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACrC,CAAC;QACH,CAAC;IACH,CAAC;IAED,qFAAqF;IACrF,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,IAAI,CAAC;YACH,kDAAkD;YAClD,aAAa;YACb,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;YACjD,IAAI,OAAO,WAAW,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;gBAC9C,MAAM,OAAO,GAAG,MAAO,WAAW,CAAC,OAAe,EAAE,CAAC;gBACrD,KAAK,GAAG,OAAO,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC;YAC5C,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,yDAAyD;QAC3D,CAAC;IACH,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sCAAsC;IACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACnD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,oDAAoD;IACpD,OAAO,MAAM,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,YAAY,CAChC,MAA8B,EAC9B,UAA+B,EAAE;IAMjC,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAExD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,IAAI,OAAO,CAAC,sBAAsB,EAAE,CAAC;YACnC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,GAAG,CAAC;YACzC,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;YACrD,OAAO;gBACL,UAAU,EAAE,KAAK;gBACjB,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC;aAC9C,CAAC;QACJ,CAAC;QAED,OAAO;YACL,UAAU,EAAE,KAAK;YACjB,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,IAAI,QAAQ,CACpB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,EAC7E,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE;SACF,CAAC;IACJ,CAAC;IAED,iCAAiC;IACjC,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC;QAC1C,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACtC,OAAO;gBACL,OAAO,CAAC,qBAAqB,KAAK,KAAK;oBACrC,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC;oBACvD,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QAC7D,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QAC9D,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;gBACL,UAAU,EAAE,KAAK;gBACjB,OAAO;gBACP,QAAQ,EAAE,IAAI,QAAQ,CACpB,IAAI,CAAC,SAAS,CAAC;oBACb,KAAK,EAAE,WAAW;oBAClB,OAAO,EAAE,gCAAgC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE;oBACjI,QAAQ,EAAE,OAAO,CAAC,UAAU;oBAC5B,OAAO;iBACR,CAAC,EACF,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,2BAA2B;IAC3B,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;YACzC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC;YAC/C,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAE/C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;gBACL,UAAU,EAAE,KAAK;gBACjB,OAAO;gBACP,QAAQ,EAAE,IAAI,QAAQ,CACpB,IAAI,CAAC,SAAS,CAAC;oBACb,KAAK,EAAE,WAAW;oBAClB,OAAO,EAAE,0BAA0B,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE;oBACzG,QAAQ,EAAE,OAAO,CAAC,IAAI;oBACtB,OAAO,EAAE,YAAY;iBACtB,CAAC,EACF,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACvC,CAAC;AAED;;GAEG;AACH,SAAgB,cAAc,CAAC,MAA8B,EAAE,cAAgC;IAC7F,OAAO;QACL,MAAM;QACN,gBAAgB,EAAE,CAAC,OAAyB,EAAE,EAAE,CAC9C,gBAAgB,CAAC,MAAM,EAAE,EAAE,GAAG,cAAc,EAAE,GAAG,OAAO,EAAE,CAAC;QAC7D,YAAY,EAAE,CAAC,OAA6B,EAAE,EAAE,CAC9C,YAAY,CAAC,MAAM,EAAE,EAAE,GAAG,cAAc,EAAE,GAAG,OAAO,EAAE,CAAC;QACzD,WAAW,EAAE,CAAC,OAAa,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC;QAC3D,YAAY,EAAE,CAAC,QAAiB,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC;KACnE,CAAC;AACJ,CAAC"}