@dbx-tools/email 0.6.43 → 0.6.44

package/lib/src/auth/gate.d.ts

@@ -73,11 +73,19 @@ export declare class AuthGate {
     /** The `GET /auth/status` payload for a request. */
     status(req: Request): Promise<AuthStatus>;
     /**
-     * Express middleware gating requests on the APP router (mounted at the app
-     * root). Requests to the login flow (`<emailBase>/auth/*`) pass through so a
-     * caller can authenticate; the app's own API/asset requests need a valid
-     * session or get a 401. `emailBase` is the plugin's mount path (e.g.
-     * `/api/email`) so the open prefix is matched against the full request path.
+     * Express middleware gating the app's DATA APIs behind a session.
+     *
+     * It gates `/api/*` and returns 401 for an unauthenticated caller - EXCEPT the
+     * login flow itself (`<emailBase>/auth/*`), which must stay open so a caller
+     * can obtain a session. Static assets (the SPA shell, JS/CSS, favicons) are
+     * NOT gated: the browser has to load the client so the `<AuthGate>` React
+     * component can render the login screen and call these endpoints. A gated
+     * `/api` request from the un-logged-in SPA simply 401s, which the client
+     * treats as "show the login". This is the standard SPA gate shape - protect
+     * the data, serve the shell.
+     *
+     * `emailBase` is the email plugin's mount path (e.g. `/api/email`), so both the
+     * open login prefix and the gated API prefix are matched on the full path.
      */
     middleware(emailBase: string): (req: Request, res: Response, next: NextFunction) => void;
 }

package/lib/src/auth/gate.js

@@ -107,16 +107,25 @@ export class AuthGate {
         return { authenticated: Boolean(email), email, enabled: true };
     }
     /**
-     * Express middleware gating requests on the APP router (mounted at the app
-     * root). Requests to the login flow (`<emailBase>/auth/*`) pass through so a
-     * caller can authenticate; the app's own API/asset requests need a valid
-     * session or get a 401. `emailBase` is the plugin's mount path (e.g.
-     * `/api/email`) so the open prefix is matched against the full request path.
+     * Express middleware gating the app's DATA APIs behind a session.
+     *
+     * It gates `/api/*` and returns 401 for an unauthenticated caller - EXCEPT the
+     * login flow itself (`<emailBase>/auth/*`), which must stay open so a caller
+     * can obtain a session. Static assets (the SPA shell, JS/CSS, favicons) are
+     * NOT gated: the browser has to load the client so the `<AuthGate>` React
+     * component can render the login screen and call these endpoints. A gated
+     * `/api` request from the un-logged-in SPA simply 401s, which the client
+     * treats as "show the login". This is the standard SPA gate shape - protect
+     * the data, serve the shell.
+     *
+     * `emailBase` is the email plugin's mount path (e.g. `/api/email`), so both the
+     * open login prefix and the gated API prefix are matched on the full path.
      */
     middleware(emailBase) {
         const openPrefix = `${emailBase}${AUTH_PATH_PREFIX}`;
         return (req, res, next) => {
-            if (req.path.startsWith(openPrefix)) {
+            // Only API traffic is gated; static assets load freely so the login UI can.
+            if (!req.path.startsWith("/api/") || req.path.startsWith(openPrefix)) {
                 next();
                 return;
             }
@@ -131,4 +140,4 @@ export class AuthGate {
         };
     }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZ2F0ZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3NyYy9hdXRoL2dhdGUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUE7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7R0FtQkc7QUFHSCxPQUFPLEVBQUUsSUFBSSxFQUFFLEdBQUcsRUFBRSxNQUFNLHdCQUF3QixDQUFDO0FBRW5ELE9BQU8sRUFBRSxjQUFjLEVBQUUsZ0JBQWdCLEVBQUUsTUFBTSxnQkFBZ0IsQ0FBQztBQUNsRSxPQUFPLEVBQUUsU0FBUyxFQUFFLFdBQVcsRUFBRSxhQUFhLEVBQUUsTUFBTSxVQUFVLENBQUM7QUFDakUsT0FBTyxFQUFFLFdBQVcsRUFBRSxNQUFNLGlCQUFpQixDQUFDO0FBRTlDLE1BQU0sTUFBTSxHQUFHLEdBQUcsQ0FBQyxNQUFNLENBQUMsWUFBWSxDQUFDLENBQUM7QUFFeEMsdUNBQXVDO0FBQ3ZDLE1BQU0sQ0FBQyxNQUFNLGNBQWMsR0FBRyxVQUFVLENBQUM7QUFFekMsOEVBQThFO0FBQzlFLE1BQU0sZ0JBQWdCLEdBQUcsT0FBTyxDQUFDO0FBa0JqQyxzQ0FBc0M7QUFDdEMsTUFBTSxPQUFPLFFBQVE7SUFPVTtJQU5aLEtBQUssQ0FBWTtJQUNsQyxpRkFBaUY7SUFDakYsb0ZBQW9GO0lBQ25FLGNBQWMsR0FBRyxJQUFJLFdBQVcsQ0FBQyxDQUFDLEVBQUUsRUFBRSxHQUFHLEVBQUUsR0FBRyxJQUFJLENBQUMsQ0FBQztJQUNwRCxhQUFhLEdBQUcsSUFBSSxXQUFXLENBQUMsRUFBRSxFQUFFLEVBQUUsR0FBRyxFQUFFLEdBQUcsSUFBSSxDQUFDLENBQUM7SUFFckUsWUFBNkIsT0FBd0I7UUFBeEIsWUFBTyxHQUFQLE9BQU8sQ0FBaUI7UUFDbkQsSUFBSSxDQUFDLEtBQUssR0FBRyxJQUFJLFNBQVMsQ0FBQyxPQUFPLENBQUMsY0FBYyxHQUFHLElBQUksRUFBRSxPQUFPLENBQUMsV0FBVyxDQUFDLENBQUM7SUFDakYsQ0FBQztJQUVEOzs7OztPQUtHO0lBQ0gsS0FBSyxDQUFDLGFBQWEsQ0FBQyxLQUFhLEVBQUUsRUFBVTtRQUMzQyxNQUFNLE9BQU8sR0FBRyxLQUFLLENBQUMsSUFBSSxFQUFFLENBQUMsV0FBVyxFQUFFLENBQUM7UUFDM0MsTUFBTSxJQUFJLEdBQUcsSUFBSSxDQUFDLGNBQWMsQ0FBQyxHQUFHLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBQ2pELE1BQU0sT0FBTyxHQUFHLElBQUksQ0FBQyxjQUFjLENBQUMsR0FBRyxDQUFDLFNBQVMsT0FBTyxFQUFFLENBQUMsQ0FBQztRQUM1RCxJQUFJLENBQUMsSUFBSSxDQUFDLE9BQU8sSUFBSSxDQUFDLE9BQU8sQ0FBQyxPQUFPLEVBQUUsQ0FBQztZQUN0QyxPQUFPLEVBQUUsRUFBRSxFQUFFLElBQUksRUFBRSxVQUFVLEVBQUUsSUFBSSxDQUFDLFVBQVUsSUFBSSxPQUFPLENBQUMsVUFBVSxFQUFFLENBQUM7UUFDekUsQ0FBQztRQUNELElBQUksY0FBYyxDQUFDLE9BQU8sQ0FBQyxJQUFJLGdCQUFnQixDQUFDLE9BQU8sRUFBRSxJQUFJLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDN0UsTUFBTSxJQUFJLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUM7WUFDdkMsSUFBSSxDQUFDO2dCQUNILE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsT0FBTyxFQUFFLElBQUksQ0FBQyxDQUFDO1lBQzdDLENBQUM7WUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO2dCQUNmLE1BQU0sQ0FBQyxJQUFJLENBQUMsMEJBQTBCLEVBQUUsRUFBRSxLQUFLLEVBQUUsQ0FBQyxDQUFDO1lBQ3JELENBQUM7UUFDSCxDQUFDO1FBQ0QsT0FBTyxFQUFFLEVBQUUsRUFBRSxJQUFJLEVBQUUsQ0FBQztJQUN0QixDQUFDO0lBRUQ7Ozs7O09BS0c7SUFDSCxLQUFLLENBQUMsWUFBWSxDQUNoQixLQUFhLEVBQ2IsSUFBWSxFQUNaLEVBQVUsRUFDVixNQUFlO1FBRWYsTUFBTSxPQUFPLEdBQUcsS0FBSyxDQUFDLElBQUksRUFBRSxDQUFDLFdBQVcsRUFBRSxDQUFDO1FBQzNDLE1BQU0sSUFBSSxHQUFHLElBQUksQ0FBQyxhQUFhLENBQUMsR0FBRyxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsQ0FBQztRQUNoRCxNQUFNLE9BQU8sR0FBRyxJQUFJLENBQUMsYUFBYSxDQUFDLEdBQUcsQ0FBQyxTQUFTLE9BQU8sRUFBRSxDQUFDLENBQUM7UUFDM0QsSUFBSSxDQUFDLElBQUksQ0FBQyxPQUFPLElBQUksQ0FBQyxPQUFPLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDdEMsT0FBTyxFQUFFLEVBQUUsRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFLElBQUksQ0FBQyxVQUFVLElBQUksT0FBTyxDQUFDLFVBQVUsRUFBRSxDQUFDO1FBQzFFLENBQUM7UUFDRCxJQUFJLElBQUksQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLE9BQU8sRUFBRSxJQUFJLENBQUMsSUFBSSxFQUFFLENBQUMsS0FBSyxJQUFJO1lBQUUsT0FBTyxFQUFFLEVBQUUsRUFBRSxLQUFLLEVBQUUsQ0FBQztRQUMzRSw2RUFBNkU7UUFDN0UsSUFBSSxDQUFDLGNBQWMsQ0FBQyxLQUFLLENBQUMsU0FBUyxPQUFPLEVBQUUsQ0FBQyxDQUFDO1FBQzlDLElBQUksQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLFNBQVMsT0FBTyxFQUFFLENBQUMsQ0FBQztRQUM3QyxNQUFNLEtBQUssR0FBRyxNQUFNLFdBQVcsQ0FBQyxPQUFPLEVBQUUsSUFBSSxDQUFDLE9BQU8sQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDO1FBQ3pFLE9BQU8sRUFBRSxFQUFFLEVBQUUsSUFBSSxFQUFFLEtBQUssRUFBRSxhQUFhLEVBQUUsSUFBSSxDQUFDLGFBQWEsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO0lBQ3hFLENBQUM7SUFFRCx5RkFBeUY7SUFDekYsYUFBYSxDQUFDLE1BQWU7UUFDM0IsT0FBTztZQUNMLFFBQVEsRUFBRSxJQUFJO1lBQ2QsUUFBUSxFQUFFLEtBQUs7WUFDZixNQUFNLEVBQUUsTUFBTSxJQUFJLElBQUksQ0FBQyxPQUFPLENBQUMsYUFBYTtZQUM1QyxJQUFJLEVBQUUsR0FBRztZQUNULE1BQU0sRUFBRSxJQUFJLENBQUMsT0FBTyxDQUFDLGlCQUFpQixHQUFHLElBQUk7U0FDOUMsQ0FBQztJQUNKLENBQUM7SUFFRCxxRUFBcUU7SUFDckUsS0FBSyxDQUFDLFlBQVksQ0FBQyxHQUFZO1FBQzdCLDZFQUE2RTtRQUM3RSw4Q0FBOEM7UUFDOUMsTUFBTSxLQUFLLEdBQUcsSUFBSSxDQUFDLFlBQVksQ0FBQyxHQUFHLENBQUMsQ0FBQyxjQUFjLENBQUMsQ0FBQztRQUNyRCxPQUFPLGFBQWEsQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUM5QixDQUFDO0lBRUQsb0RBQW9EO0lBQ3BELEtBQUssQ0FBQyxNQUFNLENBQUMsR0FBWTtRQUN2QixNQUFNLEtBQUssR0FBRyxNQUFNLElBQUksQ0FBQyxZQUFZLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDM0MsT0FBTyxFQUFFLGFBQWEsRUFBRSxPQUFPLENBQUMsS0FBSyxDQUFDLEVBQUUsS0FBSyxFQUFFLE9BQU8sRUFBRSxJQUFJLEVBQUUsQ0FBQztJQUNqRSxDQUFDO0lBRUQ7Ozs7OztPQU1HO0lBQ0gsVUFBVSxDQUFDLFNBQWlCO1FBQzFCLE1BQU0sVUFBVSxHQUFHLEdBQUcsU0FBUyxHQUFHLGdCQUFnQixFQUFFLENBQUM7UUFDckQsT0FBTyxDQUFDLEdBQUcsRUFBRSxHQUFHLEVBQUUsSUFBSSxFQUFFLEVBQUU7WUFDeEIsSUFBSSxHQUFHLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDO2dCQUNwQyxJQUFJLEVBQUUsQ0FBQztnQkFDUCxPQUFPO1lBQ1QsQ0FBQztZQUNELEtBQUssSUFBSSxDQUFDLFlBQVksQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRTtnQkFDekMsSUFBSSxLQUFLLEVBQUUsQ0FBQztvQkFDVixJQUFJLEVBQUUsQ0FBQztnQkFDVCxDQUFDO3FCQUFNLENBQUM7b0JBQ04sR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxLQUFLLEVBQUUseUJBQXlCLEVBQUUsU0FBUyxFQUFFLFVBQVUsRUFBRSxDQUFDLENBQUM7Z0JBQ3BGLENBQUM7WUFDSCxDQUFDLENBQUMsQ0FBQztRQUNMLENBQUMsQ0FBQztJQUNKLENBQUM7Q0FDRiIsInNvdXJjZXNDb250ZW50IjpbIi8qKlxuICogVGhlIGVtYWlsLU9UUCBhY2Nlc3MgZ2F0ZTogcnVudGltZSArIEV4cHJlc3MgbWlkZGxld2FyZSArIHJlcXVlc3QgaGFuZGxlcnMuXG4gKlxuICoge0BsaW5rIEF1dGhHYXRlfSBvd25zIHRoZSBhbGxvdy1saXN0LCByYXRlIGxpbWl0ZXJzLCBjb2RlIHN0b3JlLCBhbmQgc2Vzc2lvblxuICogc2lnbmluZy4gVGhlIHBsdWdpbiB3aXJlcyBmb3VyIHJvdXRlcyB0byBpdCAoYHJlcXVlc3RgL2B2ZXJpZnlgL2Bsb2dvdXRgL1xuICogYHN0YXR1c2ApIGFuZCBtb3VudHMge0BsaW5rIEF1dGhHYXRlLm1pZGRsZXdhcmV9IHNvIGV2ZXJ5IE9USEVSIHJlcXVlc3QgbmVlZHMgYVxuICogdmFsaWQgc2Vzc2lvbiBjb29raWUuXG4gKlxuICogRGVzaWduIHBvaW50czpcbiAqICAgLSBgcmVxdWVzdGAgQUxXQVlTIHJlc29sdmVzIGB7IG9rOiB0cnVlIH1gIChhbnRpLWVudW1lcmF0aW9uKTogYSBjb2RlIGlzIG9ubHlcbiAqICAgICBnZW5lcmF0ZWQgKyBlbWFpbGVkIHdoZW4gdGhlIGFkZHJlc3MgaXMgYWxsb3ctbGlzdGVkIEFORCB1bmRlciB0aGUgcmF0ZVxuICogICAgIGxpbWl0LCBidXQgdGhlIGNhbGxlciBjYW4ndCB0ZWxsIHRoZSBkaWZmZXJlbmNlLlxuICogICAtIHRoZSBzZXNzaW9uIGxpdmVzIGluIGFuIEh0dHBPbmx5ICsgU2FtZVNpdGU9TGF4IGNvb2tpZSAoU2VjdXJlIGluIHByb2QpLCBzb1xuICogICAgIGl0IHN1cnZpdmVzIHJlbG9hZHMgYW5kIGlzIG5vdCByZWFkYWJsZSBieSBwYWdlIHNjcmlwdHMuXG4gKiAgIC0gZmFpbC1vcGVuIG9uIGEgbWlzc2luZyBzaWduaW5nIHNlY3JldCAoc2VlIGBvdHAudHNgKTogYSBEYXRhYnJpY2tzIEFwcCBpc1xuICogICAgIGFscmVhZHkgYWNjZXNzLWxpbWl0ZWQ7IGFuIHVuc2V0IGBBVVRIX0pXVF9TRUNSRVRgIGRlZ3JhZGVzIHRvXG4gKiAgICAgbm9uLWR1cmFibGUgc2Vzc2lvbnMsIG5vdCBhIGxvY2tvdXQuXG4gKlxuICogQG1vZHVsZVxuICovXG5cbmltcG9ydCB0eXBlIHsgQ29va2llT3B0aW9ucywgTmV4dEZ1bmN0aW9uLCBSZXF1ZXN0LCBSZXNwb25zZSB9IGZyb20gXCJleHByZXNzXCI7XG5pbXBvcnQgeyBodHRwLCBsb2cgfSBmcm9tIFwiQGRieC10b29scy9zaGFyZWQtY29yZVwiO1xuaW1wb3J0IHR5cGUgeyBBdXRoU3RhdHVzIH0gZnJvbSBcIkBkYngtdG9vbHMvc2hhcmVkLWVtYWlsXCI7XG5pbXBvcnQgeyBsb29rc0xpa2VFbWFpbCwgbWF0Y2hlc0FsbG93bGlzdCB9IGZyb20gXCIuL2FsbG93bGlzdC50c1wiO1xuaW1wb3J0IHsgQ29kZVN0b3JlLCBzaWduU2Vzc2lvbiwgdmVyaWZ5U2Vzc2lvbiB9IGZyb20gXCIuL290cC50c1wiO1xuaW1wb3J0IHsgUmF0ZUxpbWl0ZXIgfSBmcm9tIFwiLi9yYXRlLWxpbWl0LnRzXCI7XG5cbmNvbnN0IGxvZ2dlciA9IGxvZy5sb2dnZXIoXCJlbWFpbDphdXRoXCIpO1xuXG4vKiogQ29va2llIHRoZSBzZXNzaW9uIEpXVCByaWRlcyBpbi4gKi9cbmV4cG9ydCBjb25zdCBTRVNTSU9OX0NPT0tJRSA9IFwiZGJ4X2F1dGhcIjtcblxuLyoqIFJvdXRlIHByZWZpeCAodW5kZXIgdGhlIHBsdWdpbiBiYXNlIGAvYXBpL2VtYWlsYCkgdGhlIGdhdGUgbGVhdmVzIG9wZW4uICovXG5jb25zdCBBVVRIX1BBVEhfUFJFRklYID0gXCIvYXV0aFwiO1xuXG4vKiogUmVzb2x2ZWQgZ2F0ZSBjb25maWd1cmF0aW9uLiAqL1xuZXhwb3J0IGludGVyZmFjZSBBdXRoR2F0ZU9wdGlvbnMge1xuICAvKiogQWxsb3ctbGlzdCBwYXR0ZXJucyAoZG9tYWluIC8gZ2xvYiAvIGAvcmVnZXgvYCkuIEVtcHR5ID0gYWxsb3cgbm9ib2R5LiAqL1xuICByZWFkb25seSBhbGxvdzogcmVhZG9ubHkgc3RyaW5nW107XG4gIC8qKiBTZXNzaW9uIGxpZmV0aW1lIGluIHNlY29uZHMuICovXG4gIHJlYWRvbmx5IHNlc3Npb25UdGxTZWNvbmRzOiBudW1iZXI7XG4gIC8qKiBPbmUtdGltZSBjb2RlIGxpZmV0aW1lIGluIHNlY29uZHMuICovXG4gIHJlYWRvbmx5IGNvZGVUdGxTZWNvbmRzOiBudW1iZXI7XG4gIC8qKiBNYXggdmVyaWZ5IGF0dGVtcHRzIHBlciBpc3N1ZWQgY29kZS4gKi9cbiAgcmVhZG9ubHkgbWF4QXR0ZW1wdHM6IG51bWJlcjtcbiAgLyoqIFNlbmQgdGhlIGNvZGUgZW1haWwuIFJldHVybnMgbm90aGluZzsgZmFpbHVyZXMgYXJlIGxvZ2dlZCwgbm90IHN1cmZhY2VkLiAqL1xuICByZWFkb25seSBzZW5kQ29kZTogKGVtYWlsOiBzdHJpbmcsIGNvZGU6IHN0cmluZykgPT4gUHJvbWlzZTx2b2lkPjtcbiAgLyoqIFRydWUgaW4gcHJvZHVjdGlvbiAoc2V0cyB0aGUgYFNlY3VyZWAgY29va2llIGZsYWcpLiAqL1xuICByZWFkb25seSBzZWN1cmVDb29raWVzOiBib29sZWFuO1xufVxuXG4vKiogVGhlIGVtYWlsLU9UUCBnYXRlIGZvciBvbmUgYXBwLiAqL1xuZXhwb3J0IGNsYXNzIEF1dGhHYXRlIHtcbiAgcHJpdmF0ZSByZWFkb25seSBjb2RlczogQ29kZVN0b3JlO1xuICAvLyBTZXBhcmF0ZSBsaW1pdGVyczogcmVxdWVzdGluZyBhIGNvZGUgaXMgY2hlYXAtdG8tYWJ1c2UgKGVtYWlsIHNwYW0pLCB2ZXJpZnlpbmdcbiAgLy8gaXMgYSBicnV0ZS1mb3JjZSBzdXJmYWNlLiBQZXItZW1haWwgQU5EIHBlci1JUCBzbyBuZWl0aGVyIGF4aXMgYWxvbmUgaXMgYSBieXBhc3MuXG4gIHByaXZhdGUgcmVhZG9ubHkgcmVxdWVzdExpbWl0ZXIgPSBuZXcgUmF0ZUxpbWl0ZXIoNSwgMTUgKiA2MCAqIDEwMDApO1xuICBwcml2YXRlIHJlYWRvbmx5IHZlcmlmeUxpbWl0ZXIgPSBuZXcgUmF0ZUxpbWl0ZXIoMTAsIDE1ICogNjAgKiAxMDAwKTtcblxuICBjb25zdHJ1Y3Rvcihwcml2YXRlIHJlYWRvbmx5IG9wdGlvbnM6IEF1dGhHYXRlT3B0aW9ucykge1xuICAgIHRoaXMuY29kZXMgPSBuZXcgQ29kZVN0b3JlKG9wdGlvbnMuY29kZVR0bFNlY29uZHMgKiAxMDAwLCBvcHRpb25zLm1heEF0dGVtcHRzKTtcbiAgfVxuXG4gIC8qKlxuICAgKiBIYW5kbGUgYFBPU1QgL2F1dGgvcmVxdWVzdGAuIEFsd2F5cyByZXNvbHZlcyBgeyBvazogdHJ1ZSB9YCAocGx1cyBhXG4gICAqIGByZXRyeUFmdGVyYCB3aGVuIHJhdGUtbGltaXRlZCk7IGEgY29kZSBpcyBpc3N1ZWQgKyBlbWFpbGVkIG9ubHkgZm9yIGFuXG4gICAqIGFsbG93LWxpc3RlZCBhZGRyZXNzIHVuZGVyIHRoZSBsaW1pdC4gRXJyb3JzIGluIHNlbmRpbmcgYXJlIHN3YWxsb3dlZCBzbyB0aGVcbiAgICogcmVzcG9uc2UgbmV2ZXIgcmV2ZWFscyB3aGV0aGVyIGFuIGFkZHJlc3MgZXhpc3RzIC8gaXMgYWxsb3dlZC5cbiAgICovXG4gIGFzeW5jIGhhbmRsZVJlcXVlc3QoZW1haWw6IHN0cmluZywgaXA6IHN0cmluZyk6IFByb21pc2U8eyBvazogdHJ1ZTsgcmV0cnlBZnRlcj86IG51bWJlciB9PiB7XG4gICAgY29uc3QgYWRkcmVzcyA9IGVtYWlsLnRyaW0oKS50b0xvd2VyQ2FzZSgpO1xuICAgIGNvbnN0IGJ5SXAgPSB0aGlzLnJlcXVlc3RMaW1pdGVyLmhpdChgaXA6JHtpcH1gKTtcbiAgICBjb25zdCBieUVtYWlsID0gdGhpcy5yZXF1ZXN0TGltaXRlci5oaXQoYGVtYWlsOiR7YWRkcmVzc31gKTtcbiAgICBpZiAoIWJ5SXAuYWxsb3dlZCB8fCAhYnlFbWFpbC5hbGxvd2VkKSB7XG4gICAgICByZXR1cm4geyBvazogdHJ1ZSwgcmV0cnlBZnRlcjogYnlJcC5yZXRyeUFmdGVyID8/IGJ5RW1haWwucmV0cnlBZnRlciB9O1xuICAgIH1cbiAgICBpZiAobG9va3NMaWtlRW1haWwoYWRkcmVzcykgJiYgbWF0Y2hlc0FsbG93bGlzdChhZGRyZXNzLCB0aGlzLm9wdGlvbnMuYWxsb3cpKSB7XG4gICAgICBjb25zdCBjb2RlID0gdGhpcy5jb2Rlcy5pc3N1ZShhZGRyZXNzKTtcbiAgICAgIHRyeSB7XG4gICAgICAgIGF3YWl0IHRoaXMub3B0aW9ucy5zZW5kQ29kZShhZGRyZXNzLCBjb2RlKTtcbiAgICAgIH0gY2F0Y2ggKGVycm9yKSB7XG4gICAgICAgIGxvZ2dlci53YXJuKFwiZmFpbGVkIHRvIHNlbmQgT1RQIGVtYWlsXCIsIHsgZXJyb3IgfSk7XG4gICAgICB9XG4gICAgfVxuICAgIHJldHVybiB7IG9rOiB0cnVlIH07XG4gIH1cblxuICAvKipcbiAgICogSGFuZGxlIGBQT1NUIC9hdXRoL3ZlcmlmeWAuIE9uIGEgY29ycmVjdCBjb2RlLCByZXR1cm5zIHRoZSBzZXNzaW9uIGB0b2tlbmBcbiAgICogcGx1cyB0aGUgYGNvb2tpZU9wdGlvbnNgIGZvciBpdCBzbyB0aGUgcm91dGUgc2V0cyBpdCB3aXRoIEV4cHJlc3MncyBvd25cbiAgICogYHJlcy5jb29raWUoU0VTU0lPTl9DT09LSUUsIHRva2VuLCBvcHRpb25zKWAgKG5vIGhhbmQtcm9sbGVkIFNldC1Db29raWUpLlxuICAgKiBGYWlsdXJlcyByZXR1cm4gYHsgb2s6IGZhbHNlIH1gIHdpdGggYSBnZW5lcmljIHJlYXNvbi5cbiAgICovXG4gIGFzeW5jIGhhbmRsZVZlcmlmeShcbiAgICBlbWFpbDogc3RyaW5nLFxuICAgIGNvZGU6IHN0cmluZyxcbiAgICBpcDogc3RyaW5nLFxuICAgIHNlY3VyZTogYm9vbGVhbixcbiAgKTogUHJvbWlzZTx7IG9rOiBib29sZWFuOyB0b2tlbj86IHN0cmluZzsgY29va2llT3B0aW9ucz86IENvb2tpZU9wdGlvbnM7IHJldHJ5QWZ0ZXI/OiBudW1iZXIgfT4ge1xuICAgIGNvbnN0IGFkZHJlc3MgPSBlbWFpbC50cmltKCkudG9Mb3dlckNhc2UoKTtcbiAgICBjb25zdCBieUlwID0gdGhpcy52ZXJpZnlMaW1pdGVyLmhpdChgaXA6JHtpcH1gKTtcbiAgICBjb25zdCBieUVtYWlsID0gdGhpcy52ZXJpZnlMaW1pdGVyLmhpdChgZW1haWw6JHthZGRyZXNzfWApO1xuICAgIGlmICghYnlJcC5hbGxvd2VkIHx8ICFieUVtYWlsLmFsbG93ZWQpIHtcbiAgICAgIHJldHVybiB7IG9rOiBmYWxzZSwgcmV0cnlBZnRlcjogYnlJcC5yZXRyeUFmdGVyID8/IGJ5RW1haWwucmV0cnlBZnRlciB9O1xuICAgIH1cbiAgICBpZiAodGhpcy5jb2Rlcy52ZXJpZnkoYWRkcmVzcywgY29kZS50cmltKCkpICE9PSBcIm9rXCIpIHJldHVybiB7IG9rOiBmYWxzZSB9O1xuICAgIC8vIENvcnJlY3QgY29kZTogY2xlYXIgdGhlIGNhbGxlcidzIHJlcXVlc3QvdmVyaWZ5IGJ1ZGdldCBhbmQgbWludCBhIHNlc3Npb24uXG4gICAgdGhpcy5yZXF1ZXN0TGltaXRlci5yZXNldChgZW1haWw6JHthZGRyZXNzfWApO1xuICAgIHRoaXMudmVyaWZ5TGltaXRlci5yZXNldChgZW1haWw6JHthZGRyZXNzfWApO1xuICAgIGNvbnN0IHRva2VuID0gYXdhaXQgc2lnblNlc3Npb24oYWRkcmVzcywgdGhpcy5vcHRpb25zLnNlc3Npb25UdGxTZWNvbmRzKTtcbiAgICByZXR1cm4geyBvazogdHJ1ZSwgdG9rZW4sIGNvb2tpZU9wdGlvbnM6IHRoaXMuY29va2llT3B0aW9ucyhzZWN1cmUpIH07XG4gIH1cblxuICAvKiogRXhwcmVzcyBjb29raWUgb3B0aW9ucyBmb3IgdGhlIHNlc3Npb24gKHVzZWQgd2l0aCBgcmVzLmNvb2tpZWAvYHJlcy5jbGVhckNvb2tpZWApLiAqL1xuICBjb29raWVPcHRpb25zKHNlY3VyZTogYm9vbGVhbik6IENvb2tpZU9wdGlvbnMge1xuICAgIHJldHVybiB7XG4gICAgICBodHRwT25seTogdHJ1ZSxcbiAgICAgIHNhbWVTaXRlOiBcImxheFwiLFxuICAgICAgc2VjdXJlOiBzZWN1cmUgfHwgdGhpcy5vcHRpb25zLnNlY3VyZUNvb2tpZXMsXG4gICAgICBwYXRoOiBcIi9cIixcbiAgICAgIG1heEFnZTogdGhpcy5vcHRpb25zLnNlc3Npb25UdGxTZWNvbmRzICogMTAwMCxcbiAgICB9O1xuICB9XG5cbiAgLyoqIFJlc29sdmUgdGhlIGF1dGhlbnRpY2F0ZWQgZW1haWwgZm9yIGEgcmVxdWVzdCwgb3IgYHVuZGVmaW5lZGAuICovXG4gIGFzeW5jIGF1dGhlbnRpY2F0ZShyZXE6IFJlcXVlc3QpOiBQcm9taXNlPHN0cmluZyB8IHVuZGVmaW5lZD4ge1xuICAgIC8vIFJldXNlIHNoYXJlZC1jb3JlJ3MgY29va2llIHBhcnNlciAoYWNjZXB0cyBhbiBFeHByZXNzIHJlcSBkaXJlY3RseSkgcmF0aGVyXG4gICAgLy8gdGhhbiByZS1pbXBsZW1lbnRpbmcgaGVhZGVyIHNwbGl0dGluZyBoZXJlLlxuICAgIGNvbnN0IHRva2VuID0gaHR0cC5wYXJzZUNvb2tpZXMocmVxKVtTRVNTSU9OX0NPT0tJRV07XG4gICAgcmV0dXJuIHZlcmlmeVNlc3Npb24odG9rZW4pO1xuICB9XG5cbiAgLyoqIFRoZSBgR0VUIC9hdXRoL3N0YXR1c2AgcGF5bG9hZCBmb3IgYSByZXF1ZXN0LiAqL1xuICBhc3luYyBzdGF0dXMocmVxOiBSZXF1ZXN0KTogUHJvbWlzZTxBdXRoU3RhdHVzPiB7XG4gICAgY29uc3QgZW1haWwgPSBhd2FpdCB0aGlzLmF1dGhlbnRpY2F0ZShyZXEpO1xuICAgIHJldHVybiB7IGF1dGhlbnRpY2F0ZWQ6IEJvb2xlYW4oZW1haWwpLCBlbWFpbCwgZW5hYmxlZDogdHJ1ZSB9O1xuICB9XG5cbiAgLyoqXG4gICAqIEV4cHJlc3MgbWlkZGxld2FyZSBnYXRpbmcgcmVxdWVzdHMgb24gdGhlIEFQUCByb3V0ZXIgKG1vdW50ZWQgYXQgdGhlIGFwcFxuICAgKiByb290KS4gUmVxdWVzdHMgdG8gdGhlIGxvZ2luIGZsb3cgKGA8ZW1haWxCYXNlPi9hdXRoLypgKSBwYXNzIHRocm91Z2ggc28gYVxuICAgKiBjYWxsZXIgY2FuIGF1dGhlbnRpY2F0ZTsgdGhlIGFwcCdzIG93biBBUEkvYXNzZXQgcmVxdWVzdHMgbmVlZCBhIHZhbGlkXG4gICAqIHNlc3Npb24gb3IgZ2V0IGEgNDAxLiBgZW1haWxCYXNlYCBpcyB0aGUgcGx1Z2luJ3MgbW91bnQgcGF0aCAoZS5nLlxuICAgKiBgL2FwaS9lbWFpbGApIHNvIHRoZSBvcGVuIHByZWZpeCBpcyBtYXRjaGVkIGFnYWluc3QgdGhlIGZ1bGwgcmVxdWVzdCBwYXRoLlxuICAgKi9cbiAgbWlkZGxld2FyZShlbWFpbEJhc2U6IHN0cmluZyk6IChyZXE6IFJlcXVlc3QsIHJlczogUmVzcG9uc2UsIG5leHQ6IE5leHRGdW5jdGlvbikgPT4gdm9pZCB7XG4gICAgY29uc3Qgb3BlblByZWZpeCA9IGAke2VtYWlsQmFzZX0ke0FVVEhfUEFUSF9QUkVGSVh9YDtcbiAgICByZXR1cm4gKHJlcSwgcmVzLCBuZXh0KSA9PiB7XG4gICAgICBpZiAocmVxLnBhdGguc3RhcnRzV2l0aChvcGVuUHJlZml4KSkge1xuICAgICAgICBuZXh0KCk7XG4gICAgICAgIHJldHVybjtcbiAgICAgIH1cbiAgICAgIHZvaWQgdGhpcy5hdXRoZW50aWNhdGUocmVxKS50aGVuKChlbWFpbCkgPT4ge1xuICAgICAgICBpZiAoZW1haWwpIHtcbiAgICAgICAgICBuZXh0KCk7XG4gICAgICAgIH0gZWxzZSB7XG4gICAgICAgICAgcmVzLnN0YXR1cyg0MDEpLmpzb24oeyBlcnJvcjogXCJhdXRoZW50aWNhdGlvbiByZXF1aXJlZFwiLCBsb2dpblBhdGg6IG9wZW5QcmVmaXggfSk7XG4gICAgICAgIH1cbiAgICAgIH0pO1xuICAgIH07XG4gIH1cbn1cbiJdfQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZ2F0ZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3NyYy9hdXRoL2dhdGUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUE7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7R0FtQkc7QUFHSCxPQUFPLEVBQUUsSUFBSSxFQUFFLEdBQUcsRUFBRSxNQUFNLHdCQUF3QixDQUFDO0FBRW5ELE9BQU8sRUFBRSxjQUFjLEVBQUUsZ0JBQWdCLEVBQUUsTUFBTSxnQkFBZ0IsQ0FBQztBQUNsRSxPQUFPLEVBQUUsU0FBUyxFQUFFLFdBQVcsRUFBRSxhQUFhLEVBQUUsTUFBTSxVQUFVLENBQUM7QUFDakUsT0FBTyxFQUFFLFdBQVcsRUFBRSxNQUFNLGlCQUFpQixDQUFDO0FBRTlDLE1BQU0sTUFBTSxHQUFHLEdBQUcsQ0FBQyxNQUFNLENBQUMsWUFBWSxDQUFDLENBQUM7QUFFeEMsdUNBQXVDO0FBQ3ZDLE1BQU0sQ0FBQyxNQUFNLGNBQWMsR0FBRyxVQUFVLENBQUM7QUFFekMsOEVBQThFO0FBQzlFLE1BQU0sZ0JBQWdCLEdBQUcsT0FBTyxDQUFDO0FBa0JqQyxzQ0FBc0M7QUFDdEMsTUFBTSxPQUFPLFFBQVE7SUFPVTtJQU5aLEtBQUssQ0FBWTtJQUNsQyxpRkFBaUY7SUFDakYsb0ZBQW9GO0lBQ25FLGNBQWMsR0FBRyxJQUFJLFdBQVcsQ0FBQyxDQUFDLEVBQUUsRUFBRSxHQUFHLEVBQUUsR0FBRyxJQUFJLENBQUMsQ0FBQztJQUNwRCxhQUFhLEdBQUcsSUFBSSxXQUFXLENBQUMsRUFBRSxFQUFFLEVBQUUsR0FBRyxFQUFFLEdBQUcsSUFBSSxDQUFDLENBQUM7SUFFckUsWUFBNkIsT0FBd0I7UUFBeEIsWUFBTyxHQUFQLE9BQU8sQ0FBaUI7UUFDbkQsSUFBSSxDQUFDLEtBQUssR0FBRyxJQUFJLFNBQVMsQ0FBQyxPQUFPLENBQUMsY0FBYyxHQUFHLElBQUksRUFBRSxPQUFPLENBQUMsV0FBVyxDQUFDLENBQUM7SUFDakYsQ0FBQztJQUVEOzs7OztPQUtHO0lBQ0gsS0FBSyxDQUFDLGFBQWEsQ0FBQyxLQUFhLEVBQUUsRUFBVTtRQUMzQyxNQUFNLE9BQU8sR0FBRyxLQUFLLENBQUMsSUFBSSxFQUFFLENBQUMsV0FBVyxFQUFFLENBQUM7UUFDM0MsTUFBTSxJQUFJLEdBQUcsSUFBSSxDQUFDLGNBQWMsQ0FBQyxHQUFHLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBQ2pELE1BQU0sT0FBTyxHQUFHLElBQUksQ0FBQyxjQUFjLENBQUMsR0FBRyxDQUFDLFNBQVMsT0FBTyxFQUFFLENBQUMsQ0FBQztRQUM1RCxJQUFJLENBQUMsSUFBSSxDQUFDLE9BQU8sSUFBSSxDQUFDLE9BQU8sQ0FBQyxPQUFPLEVBQUUsQ0FBQztZQUN0QyxPQUFPLEVBQUUsRUFBRSxFQUFFLElBQUksRUFBRSxVQUFVLEVBQUUsSUFBSSxDQUFDLFVBQVUsSUFBSSxPQUFPLENBQUMsVUFBVSxFQUFFLENBQUM7UUFDekUsQ0FBQztRQUNELElBQUksY0FBYyxDQUFDLE9BQU8sQ0FBQyxJQUFJLGdCQUFnQixDQUFDLE9BQU8sRUFBRSxJQUFJLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDN0UsTUFBTSxJQUFJLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUM7WUFDdkMsSUFBSSxDQUFDO2dCQUNILE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsT0FBTyxFQUFFLElBQUksQ0FBQyxDQUFDO1lBQzdDLENBQUM7WUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO2dCQUNmLE1BQU0sQ0FBQyxJQUFJLENBQUMsMEJBQTBCLEVBQUUsRUFBRSxLQUFLLEVBQUUsQ0FBQyxDQUFDO1lBQ3JELENBQUM7UUFDSCxDQUFDO1FBQ0QsT0FBTyxFQUFFLEVBQUUsRUFBRSxJQUFJLEVBQUUsQ0FBQztJQUN0QixDQUFDO0lBRUQ7Ozs7O09BS0c7SUFDSCxLQUFLLENBQUMsWUFBWSxDQUNoQixLQUFhLEVBQ2IsSUFBWSxFQUNaLEVBQVUsRUFDVixNQUFlO1FBRWYsTUFBTSxPQUFPLEdBQUcsS0FBSyxDQUFDLElBQUksRUFBRSxDQUFDLFdBQVcsRUFBRSxDQUFDO1FBQzNDLE1BQU0sSUFBSSxHQUFHLElBQUksQ0FBQyxhQUFhLENBQUMsR0FBRyxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsQ0FBQztRQUNoRCxNQUFNLE9BQU8sR0FBRyxJQUFJLENBQUMsYUFBYSxDQUFDLEdBQUcsQ0FBQyxTQUFTLE9BQU8sRUFBRSxDQUFDLENBQUM7UUFDM0QsSUFBSSxDQUFDLElBQUksQ0FBQyxPQUFPLElBQUksQ0FBQyxPQUFPLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDdEMsT0FBTyxFQUFFLEVBQUUsRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFLElBQUksQ0FBQyxVQUFVLElBQUksT0FBTyxDQUFDLFVBQVUsRUFBRSxDQUFDO1FBQzFFLENBQUM7UUFDRCxJQUFJLElBQUksQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLE9BQU8sRUFBRSxJQUFJLENBQUMsSUFBSSxFQUFFLENBQUMsS0FBSyxJQUFJO1lBQUUsT0FBTyxFQUFFLEVBQUUsRUFBRSxLQUFLLEVBQUUsQ0FBQztRQUMzRSw2RUFBNkU7UUFDN0UsSUFBSSxDQUFDLGNBQWMsQ0FBQyxLQUFLLENBQUMsU0FBUyxPQUFPLEVBQUUsQ0FBQyxDQUFDO1FBQzlDLElBQUksQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLFNBQVMsT0FBTyxFQUFFLENBQUMsQ0FBQztRQUM3QyxNQUFNLEtBQUssR0FBRyxNQUFNLFdBQVcsQ0FBQyxPQUFPLEVBQUUsSUFBSSxDQUFDLE9BQU8sQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDO1FBQ3pFLE9BQU8sRUFBRSxFQUFFLEVBQUUsSUFBSSxFQUFFLEtBQUssRUFBRSxhQUFhLEVBQUUsSUFBSSxDQUFDLGFBQWEsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO0lBQ3hFLENBQUM7SUFFRCx5RkFBeUY7SUFDekYsYUFBYSxDQUFDLE1BQWU7UUFDM0IsT0FBTztZQUNMLFFBQVEsRUFBRSxJQUFJO1lBQ2QsUUFBUSxFQUFFLEtBQUs7WUFDZixNQUFNLEVBQUUsTUFBTSxJQUFJLElBQUksQ0FBQyxPQUFPLENBQUMsYUFBYTtZQUM1QyxJQUFJLEVBQUUsR0FBRztZQUNULE1BQU0sRUFBRSxJQUFJLENBQUMsT0FBTyxDQUFDLGlCQUFpQixHQUFHLElBQUk7U0FDOUMsQ0FBQztJQUNKLENBQUM7SUFFRCxxRUFBcUU7SUFDckUsS0FBSyxDQUFDLFlBQVksQ0FBQyxHQUFZO1FBQzdCLDZFQUE2RTtRQUM3RSw4Q0FBOEM7UUFDOUMsTUFBTSxLQUFLLEdBQUcsSUFBSSxDQUFDLFlBQVksQ0FBQyxHQUFHLENBQUMsQ0FBQyxjQUFjLENBQUMsQ0FBQztRQUNyRCxPQUFPLGFBQWEsQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUM5QixDQUFDO0lBRUQsb0RBQW9EO0lBQ3BELEtBQUssQ0FBQyxNQUFNLENBQUMsR0FBWTtRQUN2QixNQUFNLEtBQUssR0FBRyxNQUFNLElBQUksQ0FBQyxZQUFZLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDM0MsT0FBTyxFQUFFLGFBQWEsRUFBRSxPQUFPLENBQUMsS0FBSyxDQUFDLEVBQUUsS0FBSyxFQUFFLE9BQU8sRUFBRSxJQUFJLEVBQUUsQ0FBQztJQUNqRSxDQUFDO0lBRUQ7Ozs7Ozs7Ozs7Ozs7O09BY0c7SUFDSCxVQUFVLENBQUMsU0FBaUI7UUFDMUIsTUFBTSxVQUFVLEdBQUcsR0FBRyxTQUFTLEdBQUcsZ0JBQWdCLEVBQUUsQ0FBQztRQUNyRCxPQUFPLENBQUMsR0FBRyxFQUFFLEdBQUcsRUFBRSxJQUFJLEVBQUUsRUFBRTtZQUN4Qiw0RUFBNEU7WUFDNUUsSUFBSSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLE9BQU8sQ0FBQyxJQUFJLEdBQUcsQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7Z0JBQ3JFLElBQUksRUFBRSxDQUFDO2dCQUNQLE9BQU87WUFDVCxDQUFDO1lBQ0QsS0FBSyxJQUFJLENBQUMsWUFBWSxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFO2dCQUN6QyxJQUFJLEtBQUssRUFBRSxDQUFDO29CQUNWLElBQUksRUFBRSxDQUFDO2dCQUNULENBQUM7cUJBQU0sQ0FBQztvQkFDTixHQUFHLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQyxFQUFFLEtBQUssRUFBRSx5QkFBeUIsRUFBRSxTQUFTLEVBQUUsVUFBVSxFQUFFLENBQUMsQ0FBQztnQkFDcEYsQ0FBQztZQUNILENBQUMsQ0FBQyxDQUFDO1FBQ0wsQ0FBQyxDQUFDO0lBQ0osQ0FBQztDQUNGIiwic291cmNlc0NvbnRlbnQiOlsiLyoqXG4gKiBUaGUgZW1haWwtT1RQIGFjY2VzcyBnYXRlOiBydW50aW1lICsgRXhwcmVzcyBtaWRkbGV3YXJlICsgcmVxdWVzdCBoYW5kbGVycy5cbiAqXG4gKiB7QGxpbmsgQXV0aEdhdGV9IG93bnMgdGhlIGFsbG93LWxpc3QsIHJhdGUgbGltaXRlcnMsIGNvZGUgc3RvcmUsIGFuZCBzZXNzaW9uXG4gKiBzaWduaW5nLiBUaGUgcGx1Z2luIHdpcmVzIGZvdXIgcm91dGVzIHRvIGl0IChgcmVxdWVzdGAvYHZlcmlmeWAvYGxvZ291dGAvXG4gKiBgc3RhdHVzYCkgYW5kIG1vdW50cyB7QGxpbmsgQXV0aEdhdGUubWlkZGxld2FyZX0gc28gZXZlcnkgT1RIRVIgcmVxdWVzdCBuZWVkcyBhXG4gKiB2YWxpZCBzZXNzaW9uIGNvb2tpZS5cbiAqXG4gKiBEZXNpZ24gcG9pbnRzOlxuICogICAtIGByZXF1ZXN0YCBBTFdBWVMgcmVzb2x2ZXMgYHsgb2s6IHRydWUgfWAgKGFudGktZW51bWVyYXRpb24pOiBhIGNvZGUgaXMgb25seVxuICogICAgIGdlbmVyYXRlZCArIGVtYWlsZWQgd2hlbiB0aGUgYWRkcmVzcyBpcyBhbGxvdy1saXN0ZWQgQU5EIHVuZGVyIHRoZSByYXRlXG4gKiAgICAgbGltaXQsIGJ1dCB0aGUgY2FsbGVyIGNhbid0IHRlbGwgdGhlIGRpZmZlcmVuY2UuXG4gKiAgIC0gdGhlIHNlc3Npb24gbGl2ZXMgaW4gYW4gSHR0cE9ubHkgKyBTYW1lU2l0ZT1MYXggY29va2llIChTZWN1cmUgaW4gcHJvZCksIHNvXG4gKiAgICAgaXQgc3Vydml2ZXMgcmVsb2FkcyBhbmQgaXMgbm90IHJlYWRhYmxlIGJ5IHBhZ2Ugc2NyaXB0cy5cbiAqICAgLSBmYWlsLW9wZW4gb24gYSBtaXNzaW5nIHNpZ25pbmcgc2VjcmV0IChzZWUgYG90cC50c2ApOiBhIERhdGFicmlja3MgQXBwIGlzXG4gKiAgICAgYWxyZWFkeSBhY2Nlc3MtbGltaXRlZDsgYW4gdW5zZXQgYEFVVEhfSldUX1NFQ1JFVGAgZGVncmFkZXMgdG9cbiAqICAgICBub24tZHVyYWJsZSBzZXNzaW9ucywgbm90IGEgbG9ja291dC5cbiAqXG4gKiBAbW9kdWxlXG4gKi9cblxuaW1wb3J0IHR5cGUgeyBDb29raWVPcHRpb25zLCBOZXh0RnVuY3Rpb24sIFJlcXVlc3QsIFJlc3BvbnNlIH0gZnJvbSBcImV4cHJlc3NcIjtcbmltcG9ydCB7IGh0dHAsIGxvZyB9IGZyb20gXCJAZGJ4LXRvb2xzL3NoYXJlZC1jb3JlXCI7XG5pbXBvcnQgdHlwZSB7IEF1dGhTdGF0dXMgfSBmcm9tIFwiQGRieC10b29scy9zaGFyZWQtZW1haWxcIjtcbmltcG9ydCB7IGxvb2tzTGlrZUVtYWlsLCBtYXRjaGVzQWxsb3dsaXN0IH0gZnJvbSBcIi4vYWxsb3dsaXN0LnRzXCI7XG5pbXBvcnQgeyBDb2RlU3RvcmUsIHNpZ25TZXNzaW9uLCB2ZXJpZnlTZXNzaW9uIH0gZnJvbSBcIi4vb3RwLnRzXCI7XG5pbXBvcnQgeyBSYXRlTGltaXRlciB9IGZyb20gXCIuL3JhdGUtbGltaXQudHNcIjtcblxuY29uc3QgbG9nZ2VyID0gbG9nLmxvZ2dlcihcImVtYWlsOmF1dGhcIik7XG5cbi8qKiBDb29raWUgdGhlIHNlc3Npb24gSldUIHJpZGVzIGluLiAqL1xuZXhwb3J0IGNvbnN0IFNFU1NJT05fQ09PS0lFID0gXCJkYnhfYXV0aFwiO1xuXG4vKiogUm91dGUgcHJlZml4ICh1bmRlciB0aGUgcGx1Z2luIGJhc2UgYC9hcGkvZW1haWxgKSB0aGUgZ2F0ZSBsZWF2ZXMgb3Blbi4gKi9cbmNvbnN0IEFVVEhfUEFUSF9QUkVGSVggPSBcIi9hdXRoXCI7XG5cbi8qKiBSZXNvbHZlZCBnYXRlIGNvbmZpZ3VyYXRpb24uICovXG5leHBvcnQgaW50ZXJmYWNlIEF1dGhHYXRlT3B0aW9ucyB7XG4gIC8qKiBBbGxvdy1saXN0IHBhdHRlcm5zIChkb21haW4gLyBnbG9iIC8gYC9yZWdleC9gKS4gRW1wdHkgPSBhbGxvdyBub2JvZHkuICovXG4gIHJlYWRvbmx5IGFsbG93OiByZWFkb25seSBzdHJpbmdbXTtcbiAgLyoqIFNlc3Npb24gbGlmZXRpbWUgaW4gc2Vjb25kcy4gKi9cbiAgcmVhZG9ubHkgc2Vzc2lvblR0bFNlY29uZHM6IG51bWJlcjtcbiAgLyoqIE9uZS10aW1lIGNvZGUgbGlmZXRpbWUgaW4gc2Vjb25kcy4gKi9cbiAgcmVhZG9ubHkgY29kZVR0bFNlY29uZHM6IG51bWJlcjtcbiAgLyoqIE1heCB2ZXJpZnkgYXR0ZW1wdHMgcGVyIGlzc3VlZCBjb2RlLiAqL1xuICByZWFkb25seSBtYXhBdHRlbXB0czogbnVtYmVyO1xuICAvKiogU2VuZCB0aGUgY29kZSBlbWFpbC4gUmV0dXJucyBub3RoaW5nOyBmYWlsdXJlcyBhcmUgbG9nZ2VkLCBub3Qgc3VyZmFjZWQuICovXG4gIHJlYWRvbmx5IHNlbmRDb2RlOiAoZW1haWw6IHN0cmluZywgY29kZTogc3RyaW5nKSA9PiBQcm9taXNlPHZvaWQ+O1xuICAvKiogVHJ1ZSBpbiBwcm9kdWN0aW9uIChzZXRzIHRoZSBgU2VjdXJlYCBjb29raWUgZmxhZykuICovXG4gIHJlYWRvbmx5IHNlY3VyZUNvb2tpZXM6IGJvb2xlYW47XG59XG5cbi8qKiBUaGUgZW1haWwtT1RQIGdhdGUgZm9yIG9uZSBhcHAuICovXG5leHBvcnQgY2xhc3MgQXV0aEdhdGUge1xuICBwcml2YXRlIHJlYWRvbmx5IGNvZGVzOiBDb2RlU3RvcmU7XG4gIC8vIFNlcGFyYXRlIGxpbWl0ZXJzOiByZXF1ZXN0aW5nIGEgY29kZSBpcyBjaGVhcC10by1hYnVzZSAoZW1haWwgc3BhbSksIHZlcmlmeWluZ1xuICAvLyBpcyBhIGJydXRlLWZvcmNlIHN1cmZhY2UuIFBlci1lbWFpbCBBTkQgcGVyLUlQIHNvIG5laXRoZXIgYXhpcyBhbG9uZSBpcyBhIGJ5cGFzcy5cbiAgcHJpdmF0ZSByZWFkb25seSByZXF1ZXN0TGltaXRlciA9IG5ldyBSYXRlTGltaXRlcig1LCAxNSAqIDYwICogMTAwMCk7XG4gIHByaXZhdGUgcmVhZG9ubHkgdmVyaWZ5TGltaXRlciA9IG5ldyBSYXRlTGltaXRlcigxMCwgMTUgKiA2MCAqIDEwMDApO1xuXG4gIGNvbnN0cnVjdG9yKHByaXZhdGUgcmVhZG9ubHkgb3B0aW9uczogQXV0aEdhdGVPcHRpb25zKSB7XG4gICAgdGhpcy5jb2RlcyA9IG5ldyBDb2RlU3RvcmUob3B0aW9ucy5jb2RlVHRsU2Vjb25kcyAqIDEwMDAsIG9wdGlvbnMubWF4QXR0ZW1wdHMpO1xuICB9XG5cbiAgLyoqXG4gICAqIEhhbmRsZSBgUE9TVCAvYXV0aC9yZXF1ZXN0YC4gQWx3YXlzIHJlc29sdmVzIGB7IG9rOiB0cnVlIH1gIChwbHVzIGFcbiAgICogYHJldHJ5QWZ0ZXJgIHdoZW4gcmF0ZS1saW1pdGVkKTsgYSBjb2RlIGlzIGlzc3VlZCArIGVtYWlsZWQgb25seSBmb3IgYW5cbiAgICogYWxsb3ctbGlzdGVkIGFkZHJlc3MgdW5kZXIgdGhlIGxpbWl0LiBFcnJvcnMgaW4gc2VuZGluZyBhcmUgc3dhbGxvd2VkIHNvIHRoZVxuICAgKiByZXNwb25zZSBuZXZlciByZXZlYWxzIHdoZXRoZXIgYW4gYWRkcmVzcyBleGlzdHMgLyBpcyBhbGxvd2VkLlxuICAgKi9cbiAgYXN5bmMgaGFuZGxlUmVxdWVzdChlbWFpbDogc3RyaW5nLCBpcDogc3RyaW5nKTogUHJvbWlzZTx7IG9rOiB0cnVlOyByZXRyeUFmdGVyPzogbnVtYmVyIH0+IHtcbiAgICBjb25zdCBhZGRyZXNzID0gZW1haWwudHJpbSgpLnRvTG93ZXJDYXNlKCk7XG4gICAgY29uc3QgYnlJcCA9IHRoaXMucmVxdWVzdExpbWl0ZXIuaGl0KGBpcDoke2lwfWApO1xuICAgIGNvbnN0IGJ5RW1haWwgPSB0aGlzLnJlcXVlc3RMaW1pdGVyLmhpdChgZW1haWw6JHthZGRyZXNzfWApO1xuICAgIGlmICghYnlJcC5hbGxvd2VkIHx8ICFieUVtYWlsLmFsbG93ZWQpIHtcbiAgICAgIHJldHVybiB7IG9rOiB0cnVlLCByZXRyeUFmdGVyOiBieUlwLnJldHJ5QWZ0ZXIgPz8gYnlFbWFpbC5yZXRyeUFmdGVyIH07XG4gICAgfVxuICAgIGlmIChsb29rc0xpa2VFbWFpbChhZGRyZXNzKSAmJiBtYXRjaGVzQWxsb3dsaXN0KGFkZHJlc3MsIHRoaXMub3B0aW9ucy5hbGxvdykpIHtcbiAgICAgIGNvbnN0IGNvZGUgPSB0aGlzLmNvZGVzLmlzc3VlKGFkZHJlc3MpO1xuICAgICAgdHJ5IHtcbiAgICAgICAgYXdhaXQgdGhpcy5vcHRpb25zLnNlbmRDb2RlKGFkZHJlc3MsIGNvZGUpO1xuICAgICAgfSBjYXRjaCAoZXJyb3IpIHtcbiAgICAgICAgbG9nZ2VyLndhcm4oXCJmYWlsZWQgdG8gc2VuZCBPVFAgZW1haWxcIiwgeyBlcnJvciB9KTtcbiAgICAgIH1cbiAgICB9XG4gICAgcmV0dXJuIHsgb2s6IHRydWUgfTtcbiAgfVxuXG4gIC8qKlxuICAgKiBIYW5kbGUgYFBPU1QgL2F1dGgvdmVyaWZ5YC4gT24gYSBjb3JyZWN0IGNvZGUsIHJldHVybnMgdGhlIHNlc3Npb24gYHRva2VuYFxuICAgKiBwbHVzIHRoZSBgY29va2llT3B0aW9uc2AgZm9yIGl0IHNvIHRoZSByb3V0ZSBzZXRzIGl0IHdpdGggRXhwcmVzcydzIG93blxuICAgKiBgcmVzLmNvb2tpZShTRVNTSU9OX0NPT0tJRSwgdG9rZW4sIG9wdGlvbnMpYCAobm8gaGFuZC1yb2xsZWQgU2V0LUNvb2tpZSkuXG4gICAqIEZhaWx1cmVzIHJldHVybiBgeyBvazogZmFsc2UgfWAgd2l0aCBhIGdlbmVyaWMgcmVhc29uLlxuICAgKi9cbiAgYXN5bmMgaGFuZGxlVmVyaWZ5KFxuICAgIGVtYWlsOiBzdHJpbmcsXG4gICAgY29kZTogc3RyaW5nLFxuICAgIGlwOiBzdHJpbmcsXG4gICAgc2VjdXJlOiBib29sZWFuLFxuICApOiBQcm9taXNlPHsgb2s6IGJvb2xlYW47IHRva2VuPzogc3RyaW5nOyBjb29raWVPcHRpb25zPzogQ29va2llT3B0aW9uczsgcmV0cnlBZnRlcj86IG51bWJlciB9PiB7XG4gICAgY29uc3QgYWRkcmVzcyA9IGVtYWlsLnRyaW0oKS50b0xvd2VyQ2FzZSgpO1xuICAgIGNvbnN0IGJ5SXAgPSB0aGlzLnZlcmlmeUxpbWl0ZXIuaGl0KGBpcDoke2lwfWApO1xuICAgIGNvbnN0IGJ5RW1haWwgPSB0aGlzLnZlcmlmeUxpbWl0ZXIuaGl0KGBlbWFpbDoke2FkZHJlc3N9YCk7XG4gICAgaWYgKCFieUlwLmFsbG93ZWQgfHwgIWJ5RW1haWwuYWxsb3dlZCkge1xuICAgICAgcmV0dXJuIHsgb2s6IGZhbHNlLCByZXRyeUFmdGVyOiBieUlwLnJldHJ5QWZ0ZXIgPz8gYnlFbWFpbC5yZXRyeUFmdGVyIH07XG4gICAgfVxuICAgIGlmICh0aGlzLmNvZGVzLnZlcmlmeShhZGRyZXNzLCBjb2RlLnRyaW0oKSkgIT09IFwib2tcIikgcmV0dXJuIHsgb2s6IGZhbHNlIH07XG4gICAgLy8gQ29ycmVjdCBjb2RlOiBjbGVhciB0aGUgY2FsbGVyJ3MgcmVxdWVzdC92ZXJpZnkgYnVkZ2V0IGFuZCBtaW50IGEgc2Vzc2lvbi5cbiAgICB0aGlzLnJlcXVlc3RMaW1pdGVyLnJlc2V0KGBlbWFpbDoke2FkZHJlc3N9YCk7XG4gICAgdGhpcy52ZXJpZnlMaW1pdGVyLnJlc2V0KGBlbWFpbDoke2FkZHJlc3N9YCk7XG4gICAgY29uc3QgdG9rZW4gPSBhd2FpdCBzaWduU2Vzc2lvbihhZGRyZXNzLCB0aGlzLm9wdGlvbnMuc2Vzc2lvblR0bFNlY29uZHMpO1xuICAgIHJldHVybiB7IG9rOiB0cnVlLCB0b2tlbiwgY29va2llT3B0aW9uczogdGhpcy5jb29raWVPcHRpb25zKHNlY3VyZSkgfTtcbiAgfVxuXG4gIC8qKiBFeHByZXNzIGNvb2tpZSBvcHRpb25zIGZvciB0aGUgc2Vzc2lvbiAodXNlZCB3aXRoIGByZXMuY29va2llYC9gcmVzLmNsZWFyQ29va2llYCkuICovXG4gIGNvb2tpZU9wdGlvbnMoc2VjdXJlOiBib29sZWFuKTogQ29va2llT3B0aW9ucyB7XG4gICAgcmV0dXJuIHtcbiAgICAgIGh0dHBPbmx5OiB0cnVlLFxuICAgICAgc2FtZVNpdGU6IFwibGF4XCIsXG4gICAgICBzZWN1cmU6IHNlY3VyZSB8fCB0aGlzLm9wdGlvbnMuc2VjdXJlQ29va2llcyxcbiAgICAgIHBhdGg6IFwiL1wiLFxuICAgICAgbWF4QWdlOiB0aGlzLm9wdGlvbnMuc2Vzc2lvblR0bFNlY29uZHMgKiAxMDAwLFxuICAgIH07XG4gIH1cblxuICAvKiogUmVzb2x2ZSB0aGUgYXV0aGVudGljYXRlZCBlbWFpbCBmb3IgYSByZXF1ZXN0LCBvciBgdW5kZWZpbmVkYC4gKi9cbiAgYXN5bmMgYXV0aGVudGljYXRlKHJlcTogUmVxdWVzdCk6IFByb21pc2U8c3RyaW5nIHwgdW5kZWZpbmVkPiB7XG4gICAgLy8gUmV1c2Ugc2hhcmVkLWNvcmUncyBjb29raWUgcGFyc2VyIChhY2NlcHRzIGFuIEV4cHJlc3MgcmVxIGRpcmVjdGx5KSByYXRoZXJcbiAgICAvLyB0aGFuIHJlLWltcGxlbWVudGluZyBoZWFkZXIgc3BsaXR0aW5nIGhlcmUuXG4gICAgY29uc3QgdG9rZW4gPSBodHRwLnBhcnNlQ29va2llcyhyZXEpW1NFU1NJT05fQ09PS0lFXTtcbiAgICByZXR1cm4gdmVyaWZ5U2Vzc2lvbih0b2tlbik7XG4gIH1cblxuICAvKiogVGhlIGBHRVQgL2F1dGgvc3RhdHVzYCBwYXlsb2FkIGZvciBhIHJlcXVlc3QuICovXG4gIGFzeW5jIHN0YXR1cyhyZXE6IFJlcXVlc3QpOiBQcm9taXNlPEF1dGhTdGF0dXM+IHtcbiAgICBjb25zdCBlbWFpbCA9IGF3YWl0IHRoaXMuYXV0aGVudGljYXRlKHJlcSk7XG4gICAgcmV0dXJuIHsgYXV0aGVudGljYXRlZDogQm9vbGVhbihlbWFpbCksIGVtYWlsLCBlbmFibGVkOiB0cnVlIH07XG4gIH1cblxuICAvKipcbiAgICogRXhwcmVzcyBtaWRkbGV3YXJlIGdhdGluZyB0aGUgYXBwJ3MgREFUQSBBUElzIGJlaGluZCBhIHNlc3Npb24uXG4gICAqXG4gICAqIEl0IGdhdGVzIGAvYXBpLypgIGFuZCByZXR1cm5zIDQwMSBmb3IgYW4gdW5hdXRoZW50aWNhdGVkIGNhbGxlciAtIEVYQ0VQVCB0aGVcbiAgICogbG9naW4gZmxvdyBpdHNlbGYgKGA8ZW1haWxCYXNlPi9hdXRoLypgKSwgd2hpY2ggbXVzdCBzdGF5IG9wZW4gc28gYSBjYWxsZXJcbiAgICogY2FuIG9idGFpbiBhIHNlc3Npb24uIFN0YXRpYyBhc3NldHMgKHRoZSBTUEEgc2hlbGwsIEpTL0NTUywgZmF2aWNvbnMpIGFyZVxuICAgKiBOT1QgZ2F0ZWQ6IHRoZSBicm93c2VyIGhhcyB0byBsb2FkIHRoZSBjbGllbnQgc28gdGhlIGA8QXV0aEdhdGU+YCBSZWFjdFxuICAgKiBjb21wb25lbnQgY2FuIHJlbmRlciB0aGUgbG9naW4gc2NyZWVuIGFuZCBjYWxsIHRoZXNlIGVuZHBvaW50cy4gQSBnYXRlZFxuICAgKiBgL2FwaWAgcmVxdWVzdCBmcm9tIHRoZSB1bi1sb2dnZWQtaW4gU1BBIHNpbXBseSA0MDFzLCB3aGljaCB0aGUgY2xpZW50XG4gICAqIHRyZWF0cyBhcyBcInNob3cgdGhlIGxvZ2luXCIuIFRoaXMgaXMgdGhlIHN0YW5kYXJkIFNQQSBnYXRlIHNoYXBlIC0gcHJvdGVjdFxuICAgKiB0aGUgZGF0YSwgc2VydmUgdGhlIHNoZWxsLlxuICAgKlxuICAgKiBgZW1haWxCYXNlYCBpcyB0aGUgZW1haWwgcGx1Z2luJ3MgbW91bnQgcGF0aCAoZS5nLiBgL2FwaS9lbWFpbGApLCBzbyBib3RoIHRoZVxuICAgKiBvcGVuIGxvZ2luIHByZWZpeCBhbmQgdGhlIGdhdGVkIEFQSSBwcmVmaXggYXJlIG1hdGNoZWQgb24gdGhlIGZ1bGwgcGF0aC5cbiAgICovXG4gIG1pZGRsZXdhcmUoZW1haWxCYXNlOiBzdHJpbmcpOiAocmVxOiBSZXF1ZXN0LCByZXM6IFJlc3BvbnNlLCBuZXh0OiBOZXh0RnVuY3Rpb24pID0+IHZvaWQge1xuICAgIGNvbnN0IG9wZW5QcmVmaXggPSBgJHtlbWFpbEJhc2V9JHtBVVRIX1BBVEhfUFJFRklYfWA7XG4gICAgcmV0dXJuIChyZXEsIHJlcywgbmV4dCkgPT4ge1xuICAgICAgLy8gT25seSBBUEkgdHJhZmZpYyBpcyBnYXRlZDsgc3RhdGljIGFzc2V0cyBsb2FkIGZyZWVseSBzbyB0aGUgbG9naW4gVUkgY2FuLlxuICAgICAgaWYgKCFyZXEucGF0aC5zdGFydHNXaXRoKFwiL2FwaS9cIikgfHwgcmVxLnBhdGguc3RhcnRzV2l0aChvcGVuUHJlZml4KSkge1xuICAgICAgICBuZXh0KCk7XG4gICAgICAgIHJldHVybjtcbiAgICAgIH1cbiAgICAgIHZvaWQgdGhpcy5hdXRoZW50aWNhdGUocmVxKS50aGVuKChlbWFpbCkgPT4ge1xuICAgICAgICBpZiAoZW1haWwpIHtcbiAgICAgICAgICBuZXh0KCk7XG4gICAgICAgIH0gZWxzZSB7XG4gICAgICAgICAgcmVzLnN0YXR1cyg0MDEpLmpzb24oeyBlcnJvcjogXCJhdXRoZW50aWNhdGlvbiByZXF1aXJlZFwiLCBsb2dpblBhdGg6IG9wZW5QcmVmaXggfSk7XG4gICAgICAgIH1cbiAgICAgIH0pO1xuICAgIH07XG4gIH1cbn1cbiJdfQ==

package/package.json

@@ -27,8 +27,8 @@
   },
   "dependencies": {
     "@databricks/appkit": "^0.43.0",
-    "@dbx-tools/shared-core": "0.6.43",
-    "@dbx-tools/shared-email": "0.6.43",
+    "@dbx-tools/shared-core": "0.6.44",
+    "@dbx-tools/shared-email": "0.6.44",
     "@mastra/core": "^1.47.0",
     "jose": "^6.2.3",
     "juice": "^12.1.1",
@@ -49,7 +49,7 @@
       "./package.json": "./package.json"
     }
   },
-  "version": "0.6.43",
+  "version": "0.6.44",
   "types": "index.ts",
   "type": "module",
   "exports": {

package/src/auth/gate.ts

@@ -138,16 +138,25 @@ export class AuthGate {
   }
 
   /**
-   * Express middleware gating requests on the APP router (mounted at the app
-   * root). Requests to the login flow (`<emailBase>/auth/*`) pass through so a
-   * caller can authenticate; the app's own API/asset requests need a valid
-   * session or get a 401. `emailBase` is the plugin's mount path (e.g.
-   * `/api/email`) so the open prefix is matched against the full request path.
+   * Express middleware gating the app's DATA APIs behind a session.
+   *
+   * It gates `/api/*` and returns 401 for an unauthenticated caller - EXCEPT the
+   * login flow itself (`<emailBase>/auth/*`), which must stay open so a caller
+   * can obtain a session. Static assets (the SPA shell, JS/CSS, favicons) are
+   * NOT gated: the browser has to load the client so the `<AuthGate>` React
+   * component can render the login screen and call these endpoints. A gated
+   * `/api` request from the un-logged-in SPA simply 401s, which the client
+   * treats as "show the login". This is the standard SPA gate shape - protect
+   * the data, serve the shell.
+   *
+   * `emailBase` is the email plugin's mount path (e.g. `/api/email`), so both the
+   * open login prefix and the gated API prefix are matched on the full path.
    */
   middleware(emailBase: string): (req: Request, res: Response, next: NextFunction) => void {
     const openPrefix = `${emailBase}${AUTH_PATH_PREFIX}`;
     return (req, res, next) => {
-      if (req.path.startsWith(openPrefix)) {
+      // Only API traffic is gated; static assets load freely so the login UI can.
+      if (!req.path.startsWith("/api/") || req.path.startsWith(openPrefix)) {
         next();
         return;
       }