@crowi/api 2.0.0-alpha.0

package/dist/hono/handlers/oauth.js

@@ -0,0 +1,443 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerOAuthRoutes = void 0;
+const api_contract_1 = require("@crowi/api-contract");
+const api_contract_2 = require("@crowi/api-contract");
+const debug_1 = __importDefault(require("debug"));
+const jwt_1 = require("../../util/jwt");
+const oauth_redirect_uri_1 = require("../../util/oauth-redirect-uri");
+const pkce_1 = require("../../util/pkce");
+const user_code_1 = require("../../util/user-code");
+const auth_1 = require("../middleware/auth");
+const errors_1 = require("./_helpers/errors");
+const debug = (0, debug_1.default)('crowi:hono:handlers:oauth');
+/** Authorization codes live ~60s (RFC 6749 §4.1.2 recommends ≤10min). */
+const AUTH_CODE_TTL_MS = 60 * 1000;
+/** Refresh tokens live 30 days, matching the web-session refresh TTL. */
+const REFRESH_TOKEN_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+/** Access token TTL (seconds), echoed in `expires_in` + the JWT lifetime. */
+const ACCESS_TOKEN_TTL_SEC = Number(process.env.JWT_ACCESS_TOKEN_TTL_SECONDS) || 60 * 60;
+/** Device codes live ~10min (RFC 8628 general value). */
+const DEVICE_CODE_TTL_MS = 10 * 60 * 1000;
+/** Default minimum poll spacing for the device grant (seconds, RFC 8628 §3.2). */
+const DEVICE_POLL_INTERVAL_SEC = 5;
+/** Dev fallback web origin when `CLIENT_URL` is unset (matches `.env.example`). */
+const DEV_CLIENT_BASE_URL = 'http://localhost:4302';
+const FORBIDDEN_BODY = {
+    error: {
+        code: 'FORBIDDEN',
+        message: 'Authorization codes can only be issued from a web session.',
+    },
+};
+const DEVICE_FORBIDDEN_BODY = {
+    error: {
+        code: 'FORBIDDEN',
+        message: 'Device authorizations can only be approved from a web session.',
+    },
+};
+const DEVICE_NOT_FOUND_BODY = {
+    error: {
+        code: 'NOT_FOUND',
+        message: 'No pending device authorization for this code.',
+    },
+};
+const oauthError = (error, description) => ({
+    error,
+    ...(description ? { error_description: description } : {}),
+});
+/**
+ * Read a request body as a plain record from either JSON or
+ * `application/x-www-form-urlencoded` (RFC 6749 / 7009). Returns `{}` on a
+ * malformed / empty body so the schema validation downstream produces the
+ * domain error rather than a thrown 400.
+ */
+async function readBody(c) {
+    const contentType = c.req.header('content-type') ?? '';
+    try {
+        if (contentType.includes('application/json')) {
+            return (await c.req.json());
+        }
+        // form-urlencoded (or anything else with a parseable body).
+        const form = await c.req.parseBody();
+        return form;
+    }
+    catch {
+        return {};
+    }
+}
+const registerOAuthRoutes = (app, crowi) => {
+    const OAuthClient = crowi.model('OAuthClient');
+    const OAuthAuthorizationCode = crowi.model('OAuthAuthorizationCode');
+    const OAuthRefreshToken = crowi.model('OAuthRefreshToken');
+    const OAuthDeviceCode = crowi.model('OAuthDeviceCode');
+    const PersonalAccessToken = crowi.model('PersonalAccessToken');
+    const User = crowi.model('User');
+    const jwtUtil = (0, jwt_1.createJwtUtil)(crowi);
+    // `/oauth/authorize` and `/oauth/device/verify` both require an
+    // authenticated web session. The other routes are public, so we install
+    // jwtAuth on each literal path only (same per-path install as `tokenAuth`'s
+    // `/auth/logout`). `/oauth/device/authorize`, `/oauth/device` (lookup) and
+    // `/oauth/token` (incl. the device grant) stay public.
+    app.use('/oauth/authorize', (0, auth_1.createJwtAuth)(crowi));
+    app.use('/oauth/device/verify', (0, auth_1.createJwtAuth)(crowi));
+    /**
+     * Validate a client + space-delimited scope string (shared by the
+     * authorize-code and device-code authorization endpoints). Returns the
+     * granted scope list, or an `oauthError` envelope describing the failure.
+     * `redirect_uri` validation is authorize-specific and intentionally not
+     * handled here (the device flow has no redirect_uri).
+     */
+    const validateClientAndScopes = async (clientId, scopeStr) => {
+        const client = await OAuthClient.findByClientId(clientId);
+        if (!client) {
+            return { error: oauthError('invalid_client', 'Unknown client') };
+        }
+        const requested = scopeStr.split(/\s+/).filter((s) => s.length > 0);
+        const allowed = new Set(client.allowedScopes);
+        const granted = requested.filter((s) => (0, api_contract_1.isScope)(s) && allowed.has(s));
+        if (granted.length === 0 || granted.length !== requested.length) {
+            return { error: oauthError('invalid_scope', 'One or more requested scopes are not permitted for this client') };
+        }
+        return { granted };
+    };
+    /**
+     * Public base URL of the trusted web client — the single origin every
+     * browser-facing OAuth URL (discovery `issuer`, authorize / device consent
+     * pages) and every advertised API endpoint is built from.
+     *
+     * Sourced from `crowi.getBaseUrl()` (i.e. the `CLIENT_URL` env, the same
+     * trusted origin used for CORS and absolute email links — RFC-0010). It is
+     * deliberately **not** derived from the request `Host` / `X-Forwarded-Host`
+     * header: those are attacker-controllable, and a forged Host would poison
+     * the discovery document and the device `verification_uri`, steering a
+     * victim to an attacker origin. Falls back to the dev web origin when
+     * `CLIENT_URL` is unset (a fixed localhost, never the request Host).
+     */
+    const clientBaseUrl = () => (crowi.getBaseUrl() || DEV_CLIENT_BASE_URL).replace(/\/$/, '');
+    return app
+        .openapi(api_contract_2.authorizeRoute, async (c) => {
+        // Web-session only — a token must never mint a fresh token.
+        if (c.get('authContext').kind !== 'web') {
+            return c.json(FORBIDDEN_BODY, 403);
+        }
+        const user = c.get('user');
+        const { client_id, redirect_uri, scope, code_challenge, code_challenge_method, state } = c.req.valid('json');
+        try {
+            const client = await OAuthClient.findByClientId(client_id);
+            if (!client) {
+                return c.json(oauthError('invalid_client', 'Unknown client'), 400);
+            }
+            // redirect_uri must be registered (loopback host match, any port);
+            // validate before anything else so we never bounce a code to an
+            // attacker-controlled URI.
+            if (!(0, oauth_redirect_uri_1.isRedirectUriAllowed)(client, redirect_uri)) {
+                return c.json(oauthError('invalid_request', 'redirect_uri is not registered for this client'), 400);
+            }
+            // PKCE is mandatory and S256-only (the schema already pins the
+            // method; this guard documents the requirement defensively).
+            if (code_challenge_method !== 'S256' || !code_challenge) {
+                return c.json(oauthError('invalid_request', 'PKCE S256 challenge is required'), 400);
+            }
+            // Requested scopes must be catalog scopes AND within the client's
+            // allowed set (shared with the device-authorize endpoint).
+            const scopeCheck = await validateClientAndScopes(client_id, scope);
+            if ('error' in scopeCheck) {
+                return c.json(scopeCheck.error, 400);
+            }
+            const { granted } = scopeCheck;
+            const { code, codeHash } = OAuthAuthorizationCode.generateCode();
+            await OAuthAuthorizationCode.create({
+                codeHash,
+                clientId: client_id,
+                userId: user._id,
+                scopes: granted,
+                codeChallenge: code_challenge,
+                codeChallengeMethod: 'S256',
+                redirectUri: redirect_uri,
+                expiresAt: new Date(Date.now() + AUTH_CODE_TTL_MS),
+            });
+            const url = new URL(redirect_uri);
+            url.searchParams.set('code', code);
+            if (state != null)
+                url.searchParams.set('state', state);
+            return c.json({ redirectUri: url.toString() }, 200);
+        }
+        catch (err) {
+            debug('authorize failed:', err);
+            return c.json(errors_1.INTERNAL_ERROR_BODY, 500);
+        }
+    })
+        .openapi(api_contract_2.tokenRoute, async (c) => {
+        const raw = await readBody(c);
+        const parsed = api_contract_1.TokenRequestSchema.safeParse(raw);
+        if (!parsed.success) {
+            return c.json(oauthError('invalid_request', 'Malformed token request'), 400);
+        }
+        const body = parsed.data;
+        try {
+            if (body.grant_type === 'authorization_code') {
+                // Atomic single-use consume: a second exchange of the same code
+                // returns null (consumedAt already set) → invalid_grant.
+                const record = await OAuthAuthorizationCode.consume(OAuthAuthorizationCode.hashCode(body.code));
+                if (!record) {
+                    return c.json(oauthError('invalid_grant', 'Authorization code is invalid, expired, or already used'), 400);
+                }
+                if (record.clientId !== body.client_id || record.redirectUri !== body.redirect_uri) {
+                    return c.json(oauthError('invalid_grant', 'client_id / redirect_uri mismatch'), 400);
+                }
+                if (!(0, pkce_1.verifyPkceS256)(body.code_verifier, record.codeChallenge)) {
+                    return c.json(oauthError('invalid_grant', 'PKCE verification failed'), 400);
+                }
+                const user = await User.findById(record.userId);
+                if (!user || user.status !== User.STATUS_ACTIVE) {
+                    return c.json(oauthError('invalid_grant', 'User is no longer active'), 400);
+                }
+                return c.json(await issueTokens(user, record.clientId, record.scopes), 200);
+            }
+            if (body.grant_type === 'refresh_token') {
+                const presentedHash = OAuthRefreshToken.hashToken(body.refresh_token);
+                const active = await OAuthRefreshToken.findActiveByHash(presentedHash);
+                if (!active) {
+                    // Reuse detection: a known-but-revoked token presented again is
+                    // the signature of a stolen-token replay — revoke the whole
+                    // rotation chain so neither the attacker nor the legitimate
+                    // holder can continue (RFC-0010 §Security, PHASE3-Q5).
+                    const known = await OAuthRefreshToken.findOne({ tokenHash: presentedHash });
+                    if (known) {
+                        await OAuthRefreshToken.revokeChain(presentedHash);
+                    }
+                    return c.json(oauthError('invalid_grant', 'Refresh token is invalid, expired, or revoked'), 400);
+                }
+                if (active.clientId !== body.client_id) {
+                    return c.json(oauthError('invalid_grant', 'client_id mismatch'), 400);
+                }
+                // Optional down-scoping: requested scopes must be a subset of the
+                // token's existing scopes (no scope escalation on refresh).
+                let nextScopes = active.scopes;
+                if (body.scope) {
+                    const requested = body.scope.split(/\s+/).filter((s) => s.length > 0);
+                    const existing = new Set(active.scopes);
+                    const ok = requested.every((s) => (0, api_contract_1.scopeSatisfies)(s, existing));
+                    if (!ok || requested.length === 0) {
+                        return c.json(oauthError('invalid_scope', 'Requested scope exceeds the granted scope'), 400);
+                    }
+                    nextScopes = requested;
+                }
+                const user = await User.findById(active.userId);
+                if (!user || user.status !== User.STATUS_ACTIVE) {
+                    return c.json(oauthError('invalid_grant', 'User is no longer active'), 400);
+                }
+                // Rotate: issue the successor, then revoke the presented token and
+                // link it to the successor (`rotatedTo`) so a later replay of the
+                // old token can revoke the whole chain.
+                const issued = await issueTokens(user, active.clientId, nextScopes);
+                const successorHash = OAuthRefreshToken.hashToken(issued.refresh_token);
+                active.revokedAt = new Date();
+                active.rotatedTo = successorHash;
+                await active.save();
+                return c.json(issued, 200);
+            }
+            if (body.grant_type === 'urn:ietf:params:oauth:grant-type:device_code') {
+                const hash = OAuthDeviceCode.hashDeviceCode(body.device_code);
+                const record = await OAuthDeviceCode.findByDeviceCodeHash(hash);
+                // findByDeviceCodeHash filters consumed + expired, so a null here
+                // means the code is unknown, already consumed, or past its TTL —
+                // RFC 8628 §3.5 wants `expired_token` for the timeout case, which is
+                // the common one for a long-lived poll loop.
+                if (!record) {
+                    return c.json(oauthError('expired_token', 'Device code is invalid, expired, or already used'), 400);
+                }
+                if (record.clientId !== body.client_id) {
+                    return c.json(oauthError('invalid_grant', 'client_id mismatch'), 400);
+                }
+                // slow_down (RFC 8628 §3.5): the client polled again sooner than the
+                // advertised interval. We bump lastPolledAt on every poll so the
+                // window slides forward; the first poll (lastPolledAt == null) is
+                // always allowed.
+                const now = Date.now();
+                if (record.lastPolledAt && now - record.lastPolledAt.getTime() < record.interval * 1000) {
+                    await OAuthDeviceCode.touchPolled(hash);
+                    return c.json(oauthError('slow_down', 'Polling too frequently; slow down'), 400);
+                }
+                await OAuthDeviceCode.touchPolled(hash);
+                if (record.status === 'denied') {
+                    return c.json(oauthError('access_denied', 'The user denied the device authorization'), 400);
+                }
+                if (record.status === 'pending') {
+                    return c.json(oauthError('authorization_pending', 'The user has not yet completed the authorization'), 400);
+                }
+                // status === 'approved' — atomically consume (single use) so two
+                // concurrent polls cannot both mint tokens.
+                const consumed = await OAuthDeviceCode.consume(hash);
+                if (!consumed) {
+                    return c.json(oauthError('expired_token', 'Device code is invalid, expired, or already used'), 400);
+                }
+                const user = await User.findById(consumed.userId);
+                if (!user || user.status !== User.STATUS_ACTIVE) {
+                    return c.json(oauthError('invalid_grant', 'User is no longer active'), 400);
+                }
+                return c.json(await issueTokens(user, consumed.clientId, consumed.grantedScopes), 200);
+            }
+            // discriminatedUnion already constrains grant_type; this is
+            // unreachable but keeps the contract explicit for SDKs.
+            return c.json(oauthError('unsupported_grant_type', 'Unsupported grant_type'), 400);
+        }
+        catch (err) {
+            debug('token failed:', err);
+            return c.json(oauthError('invalid_request', 'Internal error processing token request'), 400);
+        }
+    })
+        .openapi(api_contract_2.revokeRoute, async (c) => {
+        const raw = await readBody(c);
+        const token = typeof raw.token === 'string' ? raw.token : null;
+        // RFC 7009: always 200, even for a missing / unknown token, so the
+        // endpoint never reveals which tokens exist.
+        if (!token) {
+            return c.json({}, 200);
+        }
+        try {
+            if (token.startsWith(OAuthRefreshToken.TOKEN_PREFIX)) {
+                // Revoke the whole rotation chain for a refresh token.
+                const hash = OAuthRefreshToken.hashToken(token);
+                await OAuthRefreshToken.revokeChain(hash);
+            }
+            else if (token.startsWith(PersonalAccessToken.TOKEN_PREFIX)) {
+                const hash = PersonalAccessToken.hashToken(token);
+                await PersonalAccessToken.updateOne({ tokenHash: hash, revokedAt: null }, { revokedAt: new Date() });
+            }
+            // An access-token (JWT) or unknown shape is a no-op — access tokens
+            // are stateless and short-lived (RFC-0010 OQ-A); still 200.
+            return c.json({}, 200);
+        }
+        catch (err) {
+            debug('revoke failed (still 200 per RFC 7009):', err);
+            return c.json({}, 200);
+        }
+    })
+        .openapi(api_contract_2.discoveryRoute, async (c) => {
+        // Every URL derives from the trusted CLIENT_URL origin, never the
+        // request Host. authorization_endpoint / device consent are *web*
+        // pages on CLIENT_URL; token / revocation / device-authorize are the
+        // /api/v2 API (reverse-proxied to the same origin in the default
+        // deployment — RFC-0010, PHASE3-Q6).
+        const issuer = clientBaseUrl();
+        const apiBase = `${issuer}/api/v2`;
+        return c.json({
+            issuer,
+            authorization_endpoint: `${issuer}/oauth/authorize`,
+            token_endpoint: `${apiBase}/oauth/token`,
+            revocation_endpoint: `${apiBase}/oauth/revoke`,
+            device_authorization_endpoint: `${apiBase}/oauth/device/authorize`,
+            scopes_supported: [...api_contract_1.DISCOVERY_SCOPES_SUPPORTED],
+            response_types_supported: ['code'],
+            grant_types_supported: [...api_contract_1.GRANT_TYPES_SUPPORTED],
+            code_challenge_methods_supported: ['S256'],
+            token_endpoint_auth_methods_supported: ['none'],
+        }, 200);
+    })
+        .openapi(api_contract_2.deviceAuthorizeRoute, async (c) => {
+        // Public (RFC 8628 §3.1) — a headless client starts the device flow.
+        const { client_id, scope } = c.req.valid('json');
+        try {
+            const scopeCheck = await validateClientAndScopes(client_id, scope);
+            if ('error' in scopeCheck) {
+                return c.json(scopeCheck.error, 400);
+            }
+            const { doc, deviceCode } = await OAuthDeviceCode.createPending({
+                clientId: client_id,
+                requestedScopes: scopeCheck.granted,
+                expiresAt: new Date(Date.now() + DEVICE_CODE_TTL_MS),
+                interval: DEVICE_POLL_INTERVAL_SEC,
+            });
+            // verification_uri is the *web* device-consent page on the trusted
+            // CLIENT_URL origin (never the request Host — a forged Host would
+            // otherwise send the user to an attacker's site).
+            const verificationUri = `${clientBaseUrl()}/oauth/device`;
+            const verificationUriComplete = `${verificationUri}?user_code=${encodeURIComponent(doc.userCode)}`;
+            return c.json({
+                device_code: deviceCode,
+                user_code: doc.userCode,
+                verification_uri: verificationUri,
+                verification_uri_complete: verificationUriComplete,
+                expires_in: Math.floor(DEVICE_CODE_TTL_MS / 1000),
+                interval: DEVICE_POLL_INTERVAL_SEC,
+            }, 200);
+        }
+        catch (err) {
+            debug('device/authorize failed:', err);
+            return c.json(errors_1.INTERNAL_ERROR_BODY, 500);
+        }
+    })
+        .openapi(api_contract_2.deviceInfoRoute, async (c) => {
+        // Public, lightweight lookup (PHASE4-Q9 option A): the consent screen
+        // reads the requesting client + requested scopes before approving. Only
+        // a *pending* row is surfaced — already-handled / expired / unknown
+        // codes return 404 (no secret is ever returned).
+        const { user_code } = c.req.valid('query');
+        const record = await OAuthDeviceCode.findByUserCode((0, user_code_1.normalizeUserCode)(user_code));
+        if (!record || record.status !== 'pending') {
+            return c.json(DEVICE_NOT_FOUND_BODY, 404);
+        }
+        return c.json({ client_id: record.clientId, scopes: record.requestedScopes }, 200);
+    })
+        .openapi(api_contract_2.deviceVerifyRoute, async (c) => {
+        // Web-session only — a token must never approve its own (or a broader)
+        // device authorization (privilege escalation), mirroring /oauth/authorize.
+        if (c.get('authContext').kind !== 'web') {
+            return c.json(DEVICE_FORBIDDEN_BODY, 403);
+        }
+        const user = c.get('user');
+        const { user_code, action } = c.req.valid('json');
+        try {
+            const record = await OAuthDeviceCode.findByUserCode((0, user_code_1.normalizeUserCode)(user_code));
+            if (!record || record.status !== 'pending') {
+                return c.json(DEVICE_NOT_FOUND_BODY, 404);
+            }
+            if (action === 'approve') {
+                // v1 consent is all-or-nothing (PHASE4-Q3): the requested scopes
+                // become the granted set, matching the authorize-code consent.
+                record.status = 'approved';
+                record.userId = user._id;
+                record.grantedScopes = record.requestedScopes;
+            }
+            else {
+                record.status = 'denied';
+            }
+            await record.save();
+            return c.json({ status: record.status === 'approved' ? 'approved' : 'denied' }, 200);
+        }
+        catch (err) {
+            debug('device/verify failed:', err);
+            return c.json(errors_1.INTERNAL_ERROR_BODY, 500);
+        }
+    });
+    /** Mint a fresh access (JWT) + refresh (DB-backed) pair for a grant. */
+    async function issueTokens(user, clientId, scopes) {
+        const accessToken = jwtUtil.signOauthAccessToken({
+            user,
+            scopes,
+            clientId,
+            expiresInSec: ACCESS_TOKEN_TTL_SEC,
+        });
+        const { token: refreshToken, tokenHash } = OAuthRefreshToken.generateToken();
+        await OAuthRefreshToken.create({
+            tokenHash,
+            clientId,
+            userId: user._id,
+            scopes,
+            expiresAt: new Date(Date.now() + REFRESH_TOKEN_TTL_MS),
+        });
+        return {
+            access_token: accessToken,
+            token_type: 'Bearer',
+            expires_in: ACCESS_TOKEN_TTL_SEC,
+            refresh_token: refreshToken,
+            scope: scopes.join(' '),
+        };
+    }
+};
+exports.registerOAuthRoutes = registerOAuthRoutes;
+//# sourceMappingURL=oauth.js.map

package/dist/hono/handlers/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../src/hono/handlers/oauth.ts"],"names":[],"mappings":";;;;;;AAiCA,sDAAqI;AACrI,sDAAwJ;AAGxJ,kDAA0B;AAG1B,sCAA6C;AAC7C,oEAAmE;AACnE,wCAA+C;AAC/C,kDAAuD;AAGvD,6CAAmD;AACnD,8CAAwD;AAExD,MAAM,KAAK,GAAG,IAAA,eAAK,EAAC,2BAA2B,CAAC,CAAC;AAEjD,yEAAyE;AACzE,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,CAAC;AACnC,yEAAyE;AACzE,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACtD,6EAA6E;AAC7E,MAAM,oBAAoB,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC;AACzF,yDAAyD;AACzD,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC1C,kFAAkF;AAClF,MAAM,wBAAwB,GAAG,CAAC,CAAC;AAEnC,mFAAmF;AACnF,MAAM,mBAAmB,GAAG,uBAAuB,CAAC;AAEpD,MAAM,cAAc,GAAmB;IACrC,KAAK,EAAE;QACL,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,4DAA4D;KACtE;CACF,CAAC;AAEF,MAAM,qBAAqB,GAAmB;IAC5C,KAAK,EAAE;QACL,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,gEAAgE;KAC1E;CACF,CAAC;AAEF,MAAM,qBAAqB,GAAkB;IAC3C,KAAK,EAAE;QACL,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,gDAAgD;KAC1D;CACF,CAAC;AAEF,MAAM,UAAU,GAAG,CAAC,KAA0B,EAAE,WAAoB,EAAc,EAAE,CAAC,CAAC;IACpF,KAAK;IACL,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CAC3D,CAAC,CAAC;AAEH;;;;;GAKG;AACH,KAAK,UAAU,QAAQ,CAAC,CAAU;IAChC,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IACvD,IAAI,CAAC;QACH,IAAI,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC7C,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;QACzD,CAAC;QACD,4DAA4D;QAC5D,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;QACrC,OAAO,IAA+B,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAEM,MAAM,mBAAmB,GAAG,CAA2C,GAAM,EAAE,KAAY,EAAE,EAAE;IACpG,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC/C,MAAM,sBAAsB,GAAG,KAAK,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;IACrE,MAAM,iBAAiB,GAAG,KAAK,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;IAC3D,MAAM,eAAe,GAAG,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACvD,MAAM,mBAAmB,GAAG,KAAK,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,IAAA,mBAAa,EAAC,KAAK,CAAC,CAAC;IAErC,gEAAgE;IAChE,wEAAwE;IACxE,4EAA4E;IAC5E,2EAA2E;IAC3E,uDAAuD;IACvD,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAA,oBAAa,EAAC,KAAK,CAAC,CAAC,CAAC;IAClD,GAAG,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAA,oBAAa,EAAC,KAAK,CAAC,CAAC,CAAC;IAEtD;;;;;;OAMG;IACH,MAAM,uBAAuB,GAAG,KAAK,EAAE,QAAgB,EAAE,QAAgB,EAA0D,EAAE;QACnI,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,EAAE,CAAC;QACnE,CAAC;QACD,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACpE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,sBAAO,EAAC,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACtE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,EAAE,CAAC;YAChE,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,eAAe,EAAE,gEAAgE,CAAC,EAAE,CAAC;QAClH,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,CAAC;IACrB,CAAC,CAAC;IAEF;;;;;;;;;;;;OAYG;IACH,MAAM,aAAa,GAAG,GAAW,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,mBAAmB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAEnG,OAAO,GAAG;SACP,OAAO,CAAC,6BAAc,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnC,4DAA4D;QAC5D,IAAI,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACxC,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QACrC,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3B,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,qBAAqB,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAE7G,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;YAC3D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,EAAE,GAAG,CAAC,CAAC;YACrE,CAAC;YAED,mEAAmE;YACnE,gEAAgE;YAChE,2BAA2B;YAC3B,IAAI,CAAC,IAAA,yCAAoB,EAAC,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC;gBAChD,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,EAAE,gDAAgD,CAAC,EAAE,GAAG,CAAC,CAAC;YACtG,CAAC;YAED,+DAA+D;YAC/D,6DAA6D;YAC7D,IAAI,qBAAqB,KAAK,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;gBACxD,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,EAAE,iCAAiC,CAAC,EAAE,GAAG,CAAC,CAAC;YACvF,CAAC;YAED,kEAAkE;YAClE,2DAA2D;YAC3D,MAAM,UAAU,GAAG,MAAM,uBAAuB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YACnE,IAAI,OAAO,IAAI,UAAU,EAAE,CAAC;gBAC1B,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACvC,CAAC;YACD,MAAM,EAAE,OAAO,EAAE,GAAG,UAAU,CAAC;YAE/B,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,sBAAsB,CAAC,YAAY,EAAE,CAAC;YACjE,MAAM,sBAAsB,CAAC,MAAM,CAAC;gBAClC,QAAQ;gBACR,QAAQ,EAAE,SAAS;gBACnB,MAAM,EAAE,IAAI,CAAC,GAAG;gBAChB,MAAM,EAAE,OAAO;gBACf,aAAa,EAAE,cAAc;gBAC7B,mBAAmB,EAAE,MAAM;gBAC3B,WAAW,EAAE,YAAY;gBACzB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,CAAC;aACnD,CAAC,CAAC;YAEH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;YAClC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACnC,IAAI,KAAK,IAAI,IAAI;gBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAExD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,KAAK,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;YAChC,OAAO,CAAC,CAAC,IAAI,CAAC,4BAAmB,EAAE,GAAG,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC,CAAC;SACD,OAAO,CAAC,yBAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/B,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,iCAAkB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,EAAE,yBAAyB,CAAC,EAAE,GAAG,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QAEzB,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,UAAU,KAAK,oBAAoB,EAAE,CAAC;gBAC7C,gEAAgE;gBAChE,yDAAyD;gBACzD,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,OAAO,CAAC,sBAAsB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;gBAChG,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,yDAAyD,CAAC,EAAE,GAAG,CAAC,CAAC;gBAC7G,CAAC;gBACD,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,WAAW,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;oBACnF,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,mCAAmC,CAAC,EAAE,GAAG,CAAC,CAAC;gBACvF,CAAC;gBACD,IAAI,CAAC,IAAA,qBAAc,EAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;oBAC9D,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,0BAA0B,CAAC,EAAE,GAAG,CAAC,CAAC;gBAC9E,CAAC;gBAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAChD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;oBAChD,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,0BAA0B,CAAC,EAAE,GAAG,CAAC,CAAC;gBAC9E,CAAC;gBAED,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;YAC9E,CAAC;YAED,IAAI,IAAI,CAAC,UAAU,KAAK,eAAe,EAAE,CAAC;gBACxC,MAAM,aAAa,GAAG,iBAAiB,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;gBACtE,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;gBAEvE,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,gEAAgE;oBAChE,4DAA4D;oBAC5D,4DAA4D;oBAC5D,uDAAuD;oBACvD,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,CAAC;oBAC5E,IAAI,KAAK,EAAE,CAAC;wBACV,MAAM,iBAAiB,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC;oBACrD,CAAC;oBACD,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,+CAA+C,CAAC,EAAE,GAAG,CAAC,CAAC;gBACnG,CAAC;gBAED,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;oBACvC,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,oBAAoB,CAAC,EAAE,GAAG,CAAC,CAAC;gBACxE,CAAC;gBAED,kEAAkE;gBAClE,4DAA4D;gBAC5D,IAAI,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;gBAC/B,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;oBACf,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;oBACtE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;oBACxC,MAAM,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,6BAAc,EAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;oBAC/D,IAAI,CAAC,EAAE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;wBAClC,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,2CAA2C,CAAC,EAAE,GAAG,CAAC,CAAC;oBAC/F,CAAC;oBACD,UAAU,GAAG,SAAS,CAAC;gBACzB,CAAC;gBAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAChD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;oBAChD,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,0BAA0B,CAAC,EAAE,GAAG,CAAC,CAAC;gBAC9E,CAAC;gBAED,mEAAmE;gBACnE,kEAAkE;gBAClE,wCAAwC;gBACxC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;gBACpE,MAAM,aAAa,GAAG,iBAAiB,CAAC,SAAS,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;gBACxE,MAAM,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;gBAC9B,MAAM,CAAC,SAAS,GAAG,aAAa,CAAC;gBACjC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBAEpB,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAC7B,CAAC;YAED,IAAI,IAAI,CAAC,UAAU,KAAK,8CAA8C,EAAE,CAAC;gBACvE,MAAM,IAAI,GAAG,eAAe,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBAC9D,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;gBAChE,kEAAkE;gBAClE,iEAAiE;gBACjE,qEAAqE;gBACrE,6CAA6C;gBAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,kDAAkD,CAAC,EAAE,GAAG,CAAC,CAAC;gBACtG,CAAC;gBACD,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;oBACvC,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,oBAAoB,CAAC,EAAE,GAAG,CAAC,CAAC;gBACxE,CAAC;gBAED,qEAAqE;gBACrE,iEAAiE;gBACjE,kEAAkE;gBAClE,kBAAkB;gBAClB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBACvB,IAAI,MAAM,CAAC,YAAY,IAAI,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,QAAQ,GAAG,IAAI,EAAE,CAAC;oBACxF,MAAM,eAAe,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;oBACxC,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,mCAAmC,CAAC,EAAE,GAAG,CAAC,CAAC;gBACnF,CAAC;gBACD,MAAM,eAAe,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;gBAExC,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;oBAC/B,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,0CAA0C,CAAC,EAAE,GAAG,CAAC,CAAC;gBAC9F,CAAC;gBACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;oBAChC,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,uBAAuB,EAAE,kDAAkD,CAAC,EAAE,GAAG,CAAC,CAAC;gBAC9G,CAAC;gBAED,iEAAiE;gBACjE,4CAA4C;gBAC5C,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBACrD,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,kDAAkD,CAAC,EAAE,GAAG,CAAC,CAAC;gBACtG,CAAC;gBAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAClD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;oBAChD,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,0BAA0B,CAAC,EAAE,GAAG,CAAC,CAAC;gBAC9E,CAAC;gBAED,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,aAAa,CAAC,EAAE,GAAG,CAAC,CAAC;YACzF,CAAC;YAED,4DAA4D;YAC5D,wDAAwD;YACxD,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,wBAAwB,EAAE,wBAAwB,CAAC,EAAE,GAAG,CAAC,CAAC;QACrF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,KAAK,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;YAC5B,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,EAAE,yCAAyC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC,CAAC;SACD,OAAO,CAAC,0BAAW,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/D,mEAAmE;QACnE,6CAA6C;QAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACzB,CAAC;QAED,IAAI,CAAC;YACH,IAAI,KAAK,CAAC,UAAU,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,CAAC;gBACrD,uDAAuD;gBACvD,MAAM,IAAI,GAAG,iBAAiB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;gBAChD,MAAM,iBAAiB,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YAC5C,CAAC;iBAAM,IAAI,KAAK,CAAC,UAAU,CAAC,mBAAmB,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,GAAG,mBAAmB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;gBAClD,MAAM,mBAAmB,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;YACvG,CAAC;YACD,oEAAoE;YACpE,4DAA4D;YAC5D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,KAAK,CAAC,yCAAyC,EAAE,GAAG,CAAC,CAAC;YACtD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACzB,CAAC;IACH,CAAC,CAAC;SACD,OAAO,CAAC,6BAAc,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnC,kEAAkE;QAClE,kEAAkE;QAClE,qEAAqE;QACrE,iEAAiE;QACjE,qCAAqC;QACrC,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,GAAG,MAAM,SAAS,CAAC;QACnC,OAAO,CAAC,CAAC,IAAI,CACX;YACE,MAAM;YACN,sBAAsB,EAAE,GAAG,MAAM,kBAAkB;YACnD,cAAc,EAAE,GAAG,OAAO,cAAc;YACxC,mBAAmB,EAAE,GAAG,OAAO,eAAe;YAC9C,6BAA6B,EAAE,GAAG,OAAO,yBAAyB;YAClE,gBAAgB,EAAE,CAAC,GAAG,yCAA0B,CAAC;YACjD,wBAAwB,EAAE,CAAC,MAAM,CAAC;YAClC,qBAAqB,EAAE,CAAC,GAAG,oCAAqB,CAAC;YACjD,gCAAgC,EAAE,CAAC,MAAM,CAAC;YAC1C,qCAAqC,EAAE,CAAC,MAAM,CAAC;SAChD,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC;SACD,OAAO,CAAC,mCAAoB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzC,qEAAqE;QACrE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,uBAAuB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YACnE,IAAI,OAAO,IAAI,UAAU,EAAE,CAAC;gBAC1B,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACvC,CAAC;YAED,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,MAAM,eAAe,CAAC,aAAa,CAAC;gBAC9D,QAAQ,EAAE,SAAS;gBACnB,eAAe,EAAE,UAAU,CAAC,OAAO;gBACnC,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,kBAAkB,CAAC;gBACpD,QAAQ,EAAE,wBAAwB;aACnC,CAAC,CAAC;YAEH,mEAAmE;YACnE,kEAAkE;YAClE,kDAAkD;YAClD,MAAM,eAAe,GAAG,GAAG,aAAa,EAAE,eAAe,CAAC;YAC1D,MAAM,uBAAuB,GAAG,GAAG,eAAe,cAAc,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAEnG,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,WAAW,EAAE,UAAU;gBACvB,SAAS,EAAE,GAAG,CAAC,QAAQ;gBACvB,gBAAgB,EAAE,eAAe;gBACjC,yBAAyB,EAAE,uBAAuB;gBAClD,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,kBAAkB,GAAG,IAAI,CAAC;gBACjD,QAAQ,EAAE,wBAAwB;aACnC,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,KAAK,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC;YACvC,OAAO,CAAC,CAAC,IAAI,CAAC,4BAAmB,EAAE,GAAG,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC,CAAC;SACD,OAAO,CAAC,8BAAe,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACpC,sEAAsE;QACtE,wEAAwE;QACxE,oEAAoE;QACpE,iDAAiD;QACjD,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,cAAc,CAAC,IAAA,6BAAiB,EAAC,SAAS,CAAC,CAAC,CAAC;QAClF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC3C,OAAO,CAAC,CAAC,IAAI,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,eAAe,EAAE,EAAE,GAAG,CAAC,CAAC;IACrF,CAAC,CAAC;SACD,OAAO,CAAC,gCAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtC,uEAAuE;QACvE,2EAA2E;QAC3E,IAAI,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACxC,OAAO,CAAC,CAAC,IAAI,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;QAC5C,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3B,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAElD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,cAAc,CAAC,IAAA,6BAAiB,EAAC,SAAS,CAAC,CAAC,CAAC;YAClF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC3C,OAAO,CAAC,CAAC,IAAI,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;YAC5C,CAAC;YAED,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,iEAAiE;gBACjE,+DAA+D;gBAC/D,MAAM,CAAC,MAAM,GAAG,UAAU,CAAC;gBAC3B,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC;gBACzB,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,eAAe,CAAC;YAChD,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC;YAC3B,CAAC;YACD,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAEpB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAE,UAAoB,CAAC,CAAC,CAAE,QAAkB,EAAE,EAAE,GAAG,CAAC,CAAC;QAC7G,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,KAAK,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;YACpC,OAAO,CAAC,CAAC,IAAI,CAAC,4BAAmB,EAAE,GAAG,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,wEAAwE;IACxE,KAAK,UAAU,WAAW,CAAC,IAAoD,EAAE,QAAgB,EAAE,MAAgB;QACjH,MAAM,WAAW,GAAG,OAAO,CAAC,oBAAoB,CAAC;YAC/C,IAAI;YACJ,MAAM;YACN,QAAQ;YACR,YAAY,EAAE,oBAAoB;SACnC,CAAC,CAAC;QACH,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,iBAAiB,CAAC,aAAa,EAAE,CAAC;QAC7E,MAAM,iBAAiB,CAAC,MAAM,CAAC;YAC7B,SAAS;YACT,QAAQ;YACR,MAAM,EAAE,IAAI,CAAC,GAAG;YAChB,MAAM;YACN,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,oBAAoB,CAAC;SACvD,CAAC,CAAC;QACH,OAAO;YACL,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,QAAiB;YAC7B,UAAU,EAAE,oBAAoB;YAChC,aAAa,EAAE,YAAY;YAC3B,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;SACxB,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AApZW,QAAA,mBAAmB,uBAoZ9B"}

package/dist/hono/handlers/page-collab.d.ts

@@ -0,0 +1,79 @@
+import type { OpenAPIHono } from '@hono/zod-openapi';
+import type Crowi from '../../crowi';
+import type { CrowiHonoBindings } from '../app';
+export declare const registerPageCollabRoutes: <E extends OpenAPIHono<CrowiHonoBindings>>(app: E, crowi: Crowi) => OpenAPIHono<CrowiHonoBindings, {
+    "/pages/:id/yjs-token": {
+        $get: {
+            input: {
+                param: {
+                    id: string;
+                };
+            };
+            output: {
+                wsToken: string;
+                pageId: string;
+                expiresAt: string;
+                readonly: boolean;
+            };
+            outputFormat: "json";
+            status: 200;
+        } | {
+            input: {
+                param: {
+                    id: string;
+                };
+            };
+            output: {
+                error: {
+                    code: "INVALID_PAGE_ID";
+                    message: string;
+                };
+            };
+            outputFormat: "json";
+            status: 400;
+        } | {
+            input: {
+                param: {
+                    id: string;
+                };
+            };
+            output: {
+                error: {
+                    code: "AUTHENTICATION_REQUIRED";
+                    message: "Authentication is required";
+                    redirectTo?: string | undefined;
+                };
+            };
+            outputFormat: "json";
+            status: 401;
+        } | {
+            input: {
+                param: {
+                    id: string;
+                };
+            };
+            output: {
+                error: {
+                    code: "PAGE_NOT_FOUND";
+                    message: "Page not found";
+                };
+            };
+            outputFormat: "json";
+            status: 404;
+        } | {
+            input: {
+                param: {
+                    id: string;
+                };
+            };
+            output: {
+                error: {
+                    code: "INTERNAL_ERROR";
+                    message: "Internal server error";
+                };
+            };
+            outputFormat: "json";
+            status: 500;
+        };
+    };
+}, "/">;

package/dist/hono/handlers/page-collab.js

@@ -0,0 +1,98 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerPageCollabRoutes = void 0;
+/**
+ * RFC-0006 Phase 4 Batch 5 — `pageCollab` resource Hono port.
+ *
+ * Replaces `packages/api/src/routes/ts-rest/page-collab.ts`. Single
+ * endpoint:
+ *
+ *   GET /pages/:id/yjs-token — Hocuspocus connection wsToken (RFC-0003)
+ *
+ * Auth is shared with the `page` / `page-preview` / `presence` resources:
+ * the `revision` handler already applies `createJwtAuth(crowi)` broadly
+ * to `/pages/*` (see `packages/api/src/hono/handlers/revision.ts`), so
+ * this handler relies on the established register order (`revision ->
+ * page -> page-preview -> pageCollab -> presence -> notification` in
+ * `buildHonoApp`) and does NOT install jwtAuth itself. Hono does not
+ * dedupe middleware by reference; re-installing it would cost a second
+ * JWT verify + `User.findById` per request. See the page handler file
+ * header for the longer rationale.
+ *
+ * Behaviour parity (wire-format / authorisation):
+ *
+ *  - 401 if no Authorization header (handled by `createJwtAuth`).
+ *  - 400 INVALID_PAGE_ID if `:id` is not a 24-char hex ObjectId
+ *    (`isValidObjectId` short-circuit before `loadGrantedPage`).
+ *  - 404 PAGE_NOT_FOUND for missing pages or grant-denied callers
+ *    (`loadGrantedPage` collapses both — page existence is never leaked).
+ *  - 404 PAGE_NOT_FOUND for non-author callers on draft pages (RFC-0004
+ *    first gate; the second is Hocuspocus `onAuthenticate`).
+ *  - 500 INTERNAL_ERROR on signing exception.
+ *
+ * The cap stub is shared with the ts-rest era: `checkEditorCap` returns
+ * `{ readonly: false }` until Phase 6 wires the Redis-backed counter.
+ * Tests inject a fake counter via `_setEditorCapCounterForTesting` to
+ * exercise the readonly=true branch.
+ */
+const api_contract_1 = require("@crowi/api-contract");
+const debug_1 = __importDefault(require("debug"));
+const page_1 = require("../../models/page");
+const collab_cap_1 = require("../../util/collab-cap");
+const ts_rest_helpers_1 = require("../../util/ts-rest-helpers");
+const ws_token_1 = require("../../util/ws-token");
+const errors_1 = require("./_helpers/errors");
+const debug = (0, debug_1.default)('crowi:hono:handlers:page-collab');
+const registerPageCollabRoutes = (app, crowi) => {
+    const Page = crowi.model('Page');
+    // Resolve / sign helper once per server (closure-captures the secret).
+    // The handler captures this at construction time, so any test that
+    // mutates `WS_TOKEN_SECRET` after server boot must set the env var
+    // BEFORE `src/test/setup` imports the app (see the test file header).
+    const wsTokenUtil = (0, ws_token_1.createWsTokenUtil)();
+    return app.openapi(api_contract_1.getYjsTokenRoute, async (c) => {
+        const user = c.get('user');
+        const { id: pageId } = c.req.valid('param');
+        debug('getYjsToken called', { pageId, userId: user._id.toString() });
+        if (!(0, ts_rest_helpers_1.isValidObjectId)(pageId)) {
+            return c.json(errors_1.INVALID_PAGE_ID_BODY, 400);
+        }
+        const loaded = await (0, ts_rest_helpers_1.loadGrantedPage)(Page, pageId, user);
+        if ('error' in loaded) {
+            return c.json(errors_1.PAGE_NOT_FOUND_BODY, 404);
+        }
+        // RFC-0004: a draft page is editable only by its author. The collab
+        // WebSocket carries the wsToken minted here, so refusing to sign a
+        // token for a non-author is the first of the two draft gates (the
+        // second is the Hocuspocus `onAuthenticate` hook). Collapse "draft
+        // owned by someone else" into the same 404 the grant check uses so
+        // draft existence is never leaked.
+        if (loaded.page.status === page_1.STATUS_DRAFT && !loaded.page.isCreator(user)) {
+            debug('getYjsToken rejected: draft page %s not owned by %s', pageId, user._id.toString());
+            return c.json(errors_1.PAGE_NOT_FOUND_BODY, 404);
+        }
+        try {
+            const { readonly } = await (0, collab_cap_1.checkEditorCap)(crowi, pageId);
+            const { token, expiresAt } = wsTokenUtil.signWsToken({
+                userId: user._id.toString(),
+                pageId,
+                readonly,
+            });
+            return c.json({
+                wsToken: token,
+                pageId,
+                expiresAt: expiresAt.toISOString(),
+                readonly,
+            }, 200);
+        }
+        catch (err) {
+            debug('wsToken signing failed:', err.message);
+            return c.json(errors_1.INTERNAL_ERROR_BODY, 500);
+        }
+    });
+};
+exports.registerPageCollabRoutes = registerPageCollabRoutes;
+//# sourceMappingURL=page-collab.js.map

package/dist/hono/handlers/page-collab.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"page-collab.js","sourceRoot":"","sources":["../../../src/hono/handlers/page-collab.ts"],"names":[],"mappings":";;;;;;AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,sDAAuD;AAEvD,kDAA0B;AAG1B,0CAA+C;AAC/C,oDAAqD;AACrD,8DAA4E;AAC5E,gDAAsD;AAItD,8CAAmG;AAEnG,MAAM,KAAK,GAAG,IAAA,eAAK,EAAC,iCAAiC,CAAC,CAAC;AAEhD,MAAM,wBAAwB,GAAG,CAA2C,GAAM,EAAE,KAAY,EAAE,EAAE;IACzG,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAEjC,uEAAuE;IACvE,mEAAmE;IACnE,mEAAmE;IACnE,sEAAsE;IACtE,MAAM,WAAW,GAAG,IAAA,4BAAiB,GAAE,CAAC;IAExC,OAAO,GAAG,CAAC,OAAO,CAAC,+BAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/C,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3B,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAE5C,KAAK,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAErE,IAAI,CAAC,IAAA,iCAAe,EAAC,MAAM,CAAC,EAAE,CAAC;YAC7B,OAAO,CAAC,CAAC,IAAI,CAAC,6BAAoB,EAAE,GAAG,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAA,iCAAe,EAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QACzD,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;YACtB,OAAO,CAAC,CAAC,IAAI,CAAC,4BAAmB,EAAE,GAAG,CAAC,CAAC;QAC1C,CAAC;QAED,oEAAoE;QACpE,mEAAmE;QACnE,kEAAkE;QAClE,mEAAmE;QACnE,mEAAmE;QACnE,mCAAmC;QACnC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,mBAAY,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YACxE,KAAK,CAAC,qDAAqD,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC1F,OAAO,CAAC,CAAC,IAAI,CAAC,4BAAmB,EAAE,GAAG,CAAC,CAAC;QAC1C,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAA,2BAAc,EAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACzD,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,WAAW,CAAC,WAAW,CAAC;gBACnD,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE;gBAC3B,MAAM;gBACN,QAAQ;aACT,CAAC,CAAC;YAEH,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,OAAO,EAAE,KAAK;gBACd,MAAM;gBACN,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;gBAClC,QAAQ;aACT,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,KAAK,CAAC,yBAAyB,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;YACzD,OAAO,CAAC,CAAC,IAAI,CAAC,4BAAmB,EAAE,GAAG,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAzDW,QAAA,wBAAwB,4BAyDnC"}