@dbx-tools/tunnel 0.6.60

package/README.md

@@ -0,0 +1,373 @@
+# @dbx-tools/tunnel
+
+Front an app with a public tunnel and an email one-time-code access gate,
+in-process.
+
+Built on [portr](https://github.com/amalshaji/portr). Use this library when an
+app needs to be reachable from outside its network - a stakeholder demo, a
+webhook sender that has to reach a dev build, an OAuth redirect that cannot point
+at `localhost` - without publishing the app to anyone who learns the URL. It is
+shaped for Databricks Apps (it honours the `DATABRICKS_APP_PORT` contract and
+lets the platform's own front door through ungated) but the gate itself is
+platform-neutral.
+
+The tunnel plugs into `@dbx-tools/appkit`'s `createApp` through its INTERCEPTOR
+context: `createApp({ interceptor: tunnelInterceptor() })` applies the computed
+`DATABRICKS_HOST`, launches portr pointed at the app's public port, and binds it
+so the app and portr live and die as one (concurrently-style - signals pass
+through, either death tears the pair down). The app is the process; the tunnel
+rides along inside it. Access is granted per email address against an allow-list,
+verified by a code sent over [`@dbx-tools/email`](../../node/email); the gate
+itself is the `authGate` AppKit plugin plus the `startProxy` reverse-proxy, both
+exported here for an app that wants to gate the tunnelled traffic.
+
+**Key features:**
+
+- Consumed in-process via the `createApp` interceptor context - no wrapper CLI,
+  no separate process: `createApp({ interceptor: tunnelInterceptor() })`. A no-op
+  when no `PORTR_TOKEN` / `TUNNEL_PUBLIC_DOMAIN` is set, so it is safe to register
+  unconditionally.
+- Branded from the repo-wide brand context: the code email's accent colour, font,
+  logo, and display name come from the app's own `branding/brand.yaml` (via
+  `@dbx-tools/core`'s `loadBrandContext()`), falling back to the dbx-tools
+  default - so the sign-in email looks like the app it fronts with nothing to
+  configure. `TUNNEL_AUTH_BRAND_NAME` overrides just the name.
+- Conventional one-time-code copy, so platform autofill works: the email is
+  `Your verification code is: / <code> / This code expires in N minutes`, and the
+  code input carries `autocomplete="one-time-code"`. iOS, Gmail, Outlook, and
+  Android detect a code from that shape and offer it directly from the
+  notification; novel phrasing is what breaks the detection. Both MIME parts carry
+  the code as visible text, never an image, and no trailer follows the copy.
+- The code rides in the SUBJECT and the preheader, not only the body:
+  `123456 is your verification code`. Mobile autofill reads an incoming
+  NOTIFICATION, and a notification contains the sender, the subject, and a short
+  snippet - nothing else - so a code that lives only in the body is unreachable
+  however cleanly the body is shaped. See
+  [Why the code is in the subject](#why-the-code-is-in-the-subject).
+- The two MIME parts are built separately, on purpose. The HTML part is the full
+  branded template with the code as a large styled heading; the `text/plain` part
+  is authored directly, keeping the prompt and the code on ONE line
+  (`Your verification code is: 123456`) because that is the shape client code
+  detection reads most reliably. A generated text part cannot hold it - the text
+  part is a rendering of the HTML, so the heading's CSS margin arrives as blank
+  lines and autofill stops being offered while the HTML still looks perfect. See
+  `codeEmailTextBody` in the `app` module.
+- The sign-in code is SYSTEM mail: it sends from `no-reply@EMAIL_DOMAIN` (or
+  `EMAIL_SYSTEM_FROM`), never a person's address, since a reply to a
+  machine-generated code reaches nobody. `EMAIL_FROM` is not required - see
+  [`@dbx-tools/email`](../../node/email#sender-addresses).
+- Email one-time-code gate: a 6-digit code stored as a SHA-256 hash with an
+  attempt counter, verified in constant time, in AppKit's `CacheManager` (Lakebase
+  when a database is bound to the deployment, else memory) so TTL expiry and
+  eviction are the cache's job.
+- The gate resolves Lakebase for itself, so its cache is actually persistent. The
+  gate is its own tiny AppKit app with no `lakebase()` plugin (it has no server to
+  mount routes on), and AppKit only chooses Lakebase for the cache when a pool can
+  be built from `LAKEBASE_ENDPOINT` **and** `PGHOST` **and** `PGDATABASE` - while a
+  Databricks App `postgres` binding supplies only the first. The gate fills in the
+  rest at boot, and skips entirely when nothing is bound rather than creating
+  infrastructure on someone else's behalf.
+- HS256 session JWT (via `jose`) carrying only the email, signed with a key that
+  is PERSISTED in AppKit's cache for 30 days - so a signed-in browser stays signed
+  in across the restarts a tunnel sees whenever the app it wraps reloads. An
+  operator-held `TUNNEL_AUTH_JWT_SECRET` still wins. `TUNNEL_AUTH_SESSION_CUTOFF`
+  is the log-everyone-out switch, and takes a relative duration (`-30d`) as
+  readily as a date.
+- Allow-list patterns in three shapes, matched in order: a domain shortcut
+  (`example.com`, `@example.com`), a shell-style glob (`*@example.com`), or a
+  regex literal (`/^ops-.*@example\.com$/`). An empty list allows nobody.
+- Per-email and per-IP fixed-window rate limiting, plus anti-enumeration: a code
+  request always answers `{ ok: true }`, whether or not the address is allowed.
+- Inbound `x-` headers are stripped by default and re-allowed by pattern, so a
+  public caller cannot spoof the headers the app trusts - above all
+  `x-forwarded-access-token`, which would otherwise let anyone drive the app's
+  workspace calls with a pasted token. Add an app's own headers with
+  `TUNNEL_FORWARD_HEADERS`.
+- Platform traffic passes through UNGATED. The gate distinguishes the portr
+  client (a loopback source address, same container) from the hosting platform's
+  front door (a non-loopback container-network address), so health checks and the
+  workspace UI keep working while public tunnel traffic is gated.
+- SPA-aware gating: static assets and the login routes stay open so the browser
+  can load the client and render the login form; every other `/api/*` needs a
+  valid session cookie or gets `401`. WebSocket upgrades are gated the same way.
+- Supervised teardown - `tunnelInterceptor` binds portr through the `createApp`
+  interceptor context, so the app and the tunnel are tied together: if either
+  exits, `bindProcess` brings the whole set down and passes signals through.
+- The gate fails fast when email is not configured for SMTP, because a gate that
+  cannot send codes locks everyone out (see `startGateApp` in the `app` module).
+
+## Why This Over An Ad-Hoc Tunnel
+
+A bare tunnel (`ngrok`, `portr` on its own) makes the app reachable by anyone
+with the URL. This package keeps the tunnel but puts a gate in front of it,
+reusing what the app already has: AppKit's cache for code storage, the
+`@dbx-tools/email` transport for delivery, and the app's own `From` policy.
+Because it rides inside the app's own `createApp`, there is no second process to
+supervise and no wrapper command to thread flags through.
+
+## Run It
+
+```ts
+import { createApp } from "@dbx-tools/appkit";
+import { server } from "@databricks/appkit";
+import { interceptor } from "@dbx-tools/tunnel";
+
+const { tunnelInterceptor } = interceptor;
+
+await createApp.createApp({
+  plugins: [server({ host, staticPath })],
+  // Applies DATABRICKS_HOST, launches portr at the app's public port, and binds
+  // it to the app. No-op when no PORTR_TOKEN / TUNNEL_PUBLIC_DOMAIN is set.
+  interceptor: tunnelInterceptor(),
+});
+```
+
+`tunnelInterceptor(opts)` takes optional `publicDomain` / `subdomain` / `port`;
+each falls back to env (and `port` to the `DATABRICKS_APP_PORT` contract), so a
+deployment usually passes nothing and configures through the environment. The
+OTP gate is a separate concern - see [Use The Gate](#use-the-gate) to mount
+`authGate` + `startProxy` for gated traffic.
+
+## Options
+
+The interceptor reads portr wiring from the environment; the gate (the `authGate`
+plugin) reads its own settings the same way, so a deployment configures both
+without touching code.
+
+| Env                          | Default                      |
+| ---------------------------- | ---------------------------- |
+| `TUNNEL_AUTH_ALLOW`          | empty (allow nobody)         |
+| `TUNNEL_AUTH_SUBJECT`        | `Your verification code`     |
+| `TUNNEL_AUTH_BRAND_NAME`     | the brand context `name`     |
+| `TUNNEL_AUTH_MESSAGE`        | `Your verification code is:` |
+| `TUNNEL_AUTH_SESSION_TTL`    | `2592000` (30 days)          |
+| `TUNNEL_AUTH_CODE_TTL`       | `600` (10 minutes)           |
+| `TUNNEL_AUTH_SESSION_CUTOFF` | unset (no cutoff)            |
+| `TUNNEL_PUBLIC_DOMAIN`       | - (no tunnel when unset)     |
+| `TUNNEL_FORWARD_HEADERS`     | the built-in `x-` allow-list |
+| `TUNNEL_AUTH_JWT_SECRET`     | an ephemeral per-process key |
+
+Every variable is `TUNNEL_`-prefixed because the tunnel shares one environment
+with the app it fronts, so a generic name is one the app may already be using.
+The earlier unprefixed spellings - `AUTH_SUBJECT`, `AUTH_BRAND_NAME`,
+`AUTH_MESSAGE`, `AUTH_SESSION_TTL`, `AUTH_CODE_TTL`, `AUTH_JWT_SECRET`,
+`EMAIL_AUTH_ALLOW`, `PUBLIC_DOMAIN`, plus `TUNNEL_AUTH_SESSION_EPOCH` from before
+the cutoff rename - are still read as deprecated aliases, with the `TUNNEL_` name
+winning when both are set, so an existing deployment needs no coordinated rename.
+`PORTR_TOKEN` / `PORTR_SERVER` keep their names: that namespace belongs to portr
+itself, as does `DATABRICKS_APP_PORT`, which the platform sets and the tunnel
+honours.
+
+## Sessions That Survive A Restart
+
+The signing key decides whether an already-issued session COOKIE still verifies,
+so where that key comes from is what decides whether a restart signs everyone out.
+Resolution order:
+
+1. **`TUNNEL_AUTH_JWT_SECRET`**, when set. The right answer for a fleet: an
+   operator-held secret needs no shared cache, and it survives a cache flush.
+2. **A key persisted in AppKit's cache for 30 days.** With a persistent
+   `CacheStorage` (Lakebase) the key outlives the process, so cookies stay valid
+   across restarts - which a tunnel does often, since it restarts whenever the app
+   it wraps reloads. On the default in-memory cache the key is per-process, the
+   same as having no secret at all.
+
+   Getting that persistence is not automatic, and the gate does the work at boot
+   via `lakebaseResolver.applyLakebaseEnv()`: it turns `LAKEBASE_ENDPOINT` into the
+   `PGHOST` / `PGDATABASE` / `PGUSER` the cache's pool also needs. Without them
+   AppKit cannot build the pool, silently uses an in-memory cache, and every
+   redeploy signs everyone out - so the startup log says which one you got
+   (`lakebase resolved for the gate cache`, or `the gate cache stays in memory`).
+   Bind a `postgres` resource to the app to get the persistent path.
+
+3. **An ephemeral per-process key**, when there is no secret and no reachable
+   cache. Sessions do not survive a restart, but the gate still serves: the key
+   only validates an ALREADY-issued session, so losing it costs sessions, never
+   admission. A caller still needs a code delivered to an allow-listed address.
+
+The cached key is read, generated-and-stored, then **re-read**. Two instances
+booting together both miss the cache, so both generate; adopting whatever is
+STORED afterwards is what makes them converge on one key instead of each trusting
+the one it minted. Set `TUNNEL_AUTH_JWT_SECRET` to remove the race entirely.
+
+`TUNNEL_AUTH_SESSION_TTL` defaults to the same 30 days the key is stored for, on
+purpose - a key that expired before the cookies it signed would sign everyone out
+for no reason.
+
+## Why The Code Is In The Subject
+
+The subject line the gate SENDS is `123456 is your verification code` -
+`--subject` is the template the code is spliced into, not the literal line.
+
+Mobile autofill does not read the email; it reads the NOTIFICATION. iOS scans
+incoming notification text for a code and offers to fill it - natively for
+Messages and Mail, and since iOS 26 for any app's notification, which is what
+finally made Gmail work. A notification carries the sender, the subject, and a
+short snippet. That is all. A code sitting in the body is invisible to it no
+matter how carefully the body is formatted, which is why a perfectly shaped
+`text/plain` part alone produced no prompt in Gmail.
+
+So the code goes in both strings a notification actually shows:
+
+- **The subject**, code FIRST, because a notification and an inbox row both
+  truncate: `123456 is your verification code` survives the cut wherever it lands,
+  and keeps the code in the same sentence as the words the heuristics look for.
+  A subject that does not use the conventional `Your ...` phrasing is treated as
+  deliberate and only prefixed (`123456 - Acme Ops access`).
+- **The preheader**, the hidden snippet a client shows beside the subject and puts
+  in the notification body, repeating the prompt with the code
+  (`Your verification code is: 123456`).
+
+The body keeps the code as a large styled heading regardless, for a recipient
+reading the mail rather than a notification. This is deliberately NOT Apple's
+domain-bound `@domain #code` trailer, which binds a code to a single origin;
+subject + preheader works across clients and needs no origin.
+
+### Signing everyone out
+
+`TUNNEL_AUTH_SESSION_CUTOFF` (or `sessionCutoff` on the `authGate` config)
+invalidates every session issued before a given moment:
+
+```sh
+TUNNEL_AUTH_SESSION_CUTOFF="-30d" ...       # a relative duration
+TUNNEL_AUTH_SESSION_CUTOFF="2026-08-02" ... # a date
+TUNNEL_AUTH_SESSION_CUTOFF="now" ...         # sign everyone out on this boot
+```
+
+The value goes through `@dbx-tools/shared-core`'s `object.toDate`, so a date, an
+ISO instant, epoch seconds or millis from `date +%s`, and a relative duration
+(`-30d`, `12 hours ago`) all work - the relative spelling being the one an
+operator usually wants, since "sign out anything older than a month" needs no
+timestamp arithmetic. It works two ways at once, so it holds however the key was
+resolved: the cutoff is part of the key's CACHE KEY (moving it orphans the
+previous key), and it is also checked against each token's `iat` (which is what
+makes it bite when `TUNNEL_AUTH_JWT_SECRET` is set and there is no key to
+rotate).
+
+A FUTURE date is clamped to now, because an unclamped one would refuse the
+sessions it is about to mint as well as the old ones - an app nobody can sign in
+to, from a mistyped year. An unparseable value is ignored with a warning rather
+than failing startup: this is the switch that gets a fleet back in.
+
+## Inbound Header Policy
+
+Tunnel traffic arrives from the public internet, so every header on it is
+attacker-controlled - and the headers an app trusts are exactly the ones a caller
+must not be able to write, because the app cannot tell a header the Databricks
+front door set from one a browser typed.
+
+Enumerating headers to remove is a losing game (a deny-list is only correct until
+the platform adds a header), so the policy is inverted: **every `x-`-prefixed
+request header is stripped from tunnel traffic unless a pattern allows it.** A
+header nobody thought about is removed rather than trusted. Non-`x-` headers -
+`content-type`, `accept`, `authorization`, `cookie` - are the app's normal input
+and pass through untouched.
+
+The default allow-list covers the `x-` namespaces this repo's own client sends
+and its own server reads, so a dbx-tools app works behind the tunnel with no
+configuration:
+
+| Pattern            | Why                                                 |
+| ------------------ | --------------------------------------------------- |
+| `x-mastra-*`       | thread and model routing for `@dbx-tools/ui-mastra` |
+| `x-mlflow-*`       | MLflow trace correlation for feedback               |
+| `x-requested-with` | the conventional AJAX marker                        |
+
+Add an app's own headers with `TUNNEL_FORWARD_HEADERS` (or `forwardHeaders` on
+`startProxy`). Each entry is a literal name, a shell-style glob, or a `/regex/` -
+the same three shapes the email allow-list takes - and the configured list is
+UNIONED with the defaults, so extending it never silently breaks the built-in
+surfaces:
+
+```sh
+TUNNEL_FORWARD_HEADERS="x-acme-*, /^x-trace-/, x-tenant" ...
+```
+
+Some headers no pattern can forward. These decide who a request is and where it
+came from, and on tunnel traffic only the gate may answer that:
+
+| Header                                | Why it is never forwarded                                                                                                                                |
+| ------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `x-forwarded-access-token`            | OBO auth. A pasted workspace token would make every call in the app run as its owner; a verified email proves nothing about who a credential belongs to. |
+| `x-forwarded-user`, `-email`          | Caller identity. The gate sets these itself, from a verified session.                                                                                    |
+| `x-forwarded-preferred-username`      | Display identity from the IdP.                                                                                                                           |
+| `x-forwarded-host`, `-proto`, `-port` | Original host/scheme/port. Spoofing them poisons absolute URLs the app builds, or makes a plaintext request look like TLS.                               |
+| `x-forwarded-for`, `x-real-ip`        | Client IP. Spoofing forges the audit trail and gives a caller a fresh rate-limit bucket per request.                                                     |
+| `x-request-id`                        | Request correlation UUID. Forged or colliding ids make logs unreliable.                                                                                  |
+
+The identity headers are AppKit's OBO contract; the rest are the
+[`X-Forwarded-*` set Databricks Apps documents passing to an
+app](https://docs.databricks.com/aws/en/dev-tools/databricks-apps/http-headers),
+plus the conventional `x-forwarded-proto`/`-port`/`x-real-ip` a library may read
+anyway. Dropping the transport headers costs nothing: the proxy re-adds them from
+the real socket after the policy runs, so the app sees the honest values instead
+of the caller's claim. Rate limiting reads the client IP before stripping, and
+takes the **rightmost** `x-forwarded-for` entry - the only one a proxy appended
+rather than a client supplied.
+
+## Use The Gate
+
+The gate is an AppKit plugin, so an app that wants the OTP flow can mount it
+directly - with or without the portr tunnel. It registers no routes - it exposes
+handlers the caller invokes (drive them from the `startProxy` reverse-proxy, or
+your own server) - and it takes a `sendCode` callback because delivering mail is
+the one thing it cannot resolve on its own:
+
+```ts
+import { createApp } from "@dbx-tools/appkit";
+import { authGate } from "@dbx-tools/tunnel";
+import { brand, email, sender, transport } from "@dbx-tools/email";
+
+const handle = await createApp({
+  plugins: [
+    email({ brand: brand.defaultEmailBrand }),
+    authGate({
+      allow: ["example.com"],
+      sendCode: async (to, code, opts) => {
+        const runtime = transport.getEmailRuntime();
+        await transport.sendEmail(
+          {
+            to: [to],
+            subject: opts.subject,
+            body: `${opts.message}\n\n## ${code}`,
+          },
+          // The app's configured sender; a code email has no on-behalf-of user.
+          sender.resolveSenderAddress(runtime.config, undefined),
+        );
+      },
+    }),
+  ],
+});
+
+// The gate exposes handlers rather than routes - call them from your own server.
+const status = await handle.authGate.status(sessionCookieValue);
+```
+
+`sendCode` is the one thing the plugin cannot resolve on its own. The `app`
+module's `startGateApp()` wires this same callback and derives the email styling
+from the brand context, so mounting the plugin directly is the only case that
+needs it by hand.
+
+## Modules
+
+- `interceptor` - `tunnelInterceptor()`, the `createApp` interceptor that applies
+  `DATABRICKS_HOST`, launches portr, and binds it to the app.
+- `plugin` - `authGate()`, its config/env resolution, and the `AuthGateApi`
+  handlers the proxy calls in-process.
+- `proxy` - the public-port reverse proxy: loopback-vs-platform classification,
+  open login routes, session enforcement, and WebSocket forwarding.
+- `otp` - the `CacheManager`-backed code store and the session JWT.
+- `signingKey` - the cache-persisted HS256 session key (30-day TTL, get/generate/
+  re-read convergence) and the `TUNNEL_AUTH_SESSION_CUTOFF` force-clear cutoff.
+- `allowlist` - email domain / glob / regex matching and `looksLikeEmail`.
+- `headers` - the inbound-header allow-list: `toHeaderPolicy()`,
+  `DEFAULT_FORWARD_HEADERS`, and the `PROTECTED_HEADERS` no pattern can forward.
+- `rate-limit` - the in-memory fixed-window limiter (single-instance only; not
+  distributed).
+- `portr` - portr install, config rendering, and child launch.
+- `env` - the environment-variable names, each with its deprecated aliases.
+- `app` - boots the minimal gate AppKit app and returns the `AuthGateApi`.
+
+Browser-safe login wire schemas (the request/verify payloads and the session
+cookie name) live in [`@dbx-tools/shared-email`](../../shared/email); the React
+login surface is in [`@dbx-tools/ui-email`](../../ui/email).

package/index.ts

@@ -0,0 +1,28 @@
+// GENERATED by projen watch - DO NOT EDIT.
+// Regenerated from the exporting modules in ./src.
+// Hand edits are overwritten on the next watch; this file is read-only.
+
+export * as allowlist from "./src/allowlist.ts";
+export * as app from "./src/app.ts";
+export * as env from "./src/env.ts";
+export * as headers from "./src/headers.ts";
+export * as interceptor from "./src/interceptor.ts";
+export * as otp from "./src/otp.ts";
+export * as plugin from "./src/plugin.ts";
+export * as portr from "./src/portr.ts";
+export * as proxy from "./src/proxy.ts";
+export * as rateLimit from "./src/rate-limit.ts";
+export * as signingKey from "./src/signing-key.ts";
+export { ALLOW_ENV, SUBJECT_ENV, BRAND_NAME_ENV, MESSAGE_ENV, SESSION_TTL_ENV, CODE_TTL_ENV, JWT_SECRET_ENV, SESSION_CUTOFF_ENV, PUBLIC_DOMAIN_ENV, INSECURE_ENV, FORWARD_HEADERS_ENV } from "./src/env.ts";
+export { PROTECTED_HEADERS, DEFAULT_FORWARD_HEADERS } from "./src/headers.ts";
+export type { HeaderPolicy } from "./src/headers.ts";
+export type { TunnelInterceptorOptions } from "./src/interceptor.ts";
+export { CodeStore } from "./src/otp.ts";
+export type { VerifyOutcome } from "./src/otp.ts";
+export { AuthGatePlugin, authGate } from "./src/plugin.ts";
+export type { AuthGateConfig, SendCodeOptions, ResolvedAuthGateConfig, AuthGateApi } from "./src/plugin.ts";
+export type { PortrConfig } from "./src/portr.ts";
+export type { ProxyOptions } from "./src/proxy.ts";
+export { RateLimiter } from "./src/rate-limit.ts";
+export { KEY_TTL_SECONDS } from "./src/signing-key.ts";
+export type { SigningKey } from "./src/signing-key.ts";

package/lib/index.d.ts

@@ -0,0 +1,24 @@
+export * as allowlist from "./src/allowlist.ts";
+export * as app from "./src/app.ts";
+export * as env from "./src/env.ts";
+export * as headers from "./src/headers.ts";
+export * as interceptor from "./src/interceptor.ts";
+export * as otp from "./src/otp.ts";
+export * as plugin from "./src/plugin.ts";
+export * as portr from "./src/portr.ts";
+export * as proxy from "./src/proxy.ts";
+export * as rateLimit from "./src/rate-limit.ts";
+export * as signingKey from "./src/signing-key.ts";
+export { ALLOW_ENV, SUBJECT_ENV, BRAND_NAME_ENV, MESSAGE_ENV, SESSION_TTL_ENV, CODE_TTL_ENV, JWT_SECRET_ENV, SESSION_CUTOFF_ENV, PUBLIC_DOMAIN_ENV, INSECURE_ENV, FORWARD_HEADERS_ENV } from "./src/env.ts";
+export { PROTECTED_HEADERS, DEFAULT_FORWARD_HEADERS } from "./src/headers.ts";
+export type { HeaderPolicy } from "./src/headers.ts";
+export type { TunnelInterceptorOptions } from "./src/interceptor.ts";
+export { CodeStore } from "./src/otp.ts";
+export type { VerifyOutcome } from "./src/otp.ts";
+export { AuthGatePlugin, authGate } from "./src/plugin.ts";
+export type { AuthGateConfig, SendCodeOptions, ResolvedAuthGateConfig, AuthGateApi } from "./src/plugin.ts";
+export type { PortrConfig } from "./src/portr.ts";
+export type { ProxyOptions } from "./src/proxy.ts";
+export { RateLimiter } from "./src/rate-limit.ts";
+export { KEY_TTL_SECONDS } from "./src/signing-key.ts";
+export type { SigningKey } from "./src/signing-key.ts";

package/lib/index.js

@@ -0,0 +1,21 @@
+// GENERATED by projen watch - DO NOT EDIT.
+// Regenerated from the exporting modules in ./src.
+// Hand edits are overwritten on the next watch; this file is read-only.
+export * as allowlist from "./src/allowlist.js";
+export * as app from "./src/app.js";
+export * as env from "./src/env.js";
+export * as headers from "./src/headers.js";
+export * as interceptor from "./src/interceptor.js";
+export * as otp from "./src/otp.js";
+export * as plugin from "./src/plugin.js";
+export * as portr from "./src/portr.js";
+export * as proxy from "./src/proxy.js";
+export * as rateLimit from "./src/rate-limit.js";
+export * as signingKey from "./src/signing-key.js";
+export { ALLOW_ENV, SUBJECT_ENV, BRAND_NAME_ENV, MESSAGE_ENV, SESSION_TTL_ENV, CODE_TTL_ENV, JWT_SECRET_ENV, SESSION_CUTOFF_ENV, PUBLIC_DOMAIN_ENV, INSECURE_ENV, FORWARD_HEADERS_ENV } from "./src/env.js";
+export { PROTECTED_HEADERS, DEFAULT_FORWARD_HEADERS } from "./src/headers.js";
+export { CodeStore } from "./src/otp.js";
+export { AuthGatePlugin, authGate } from "./src/plugin.js";
+export { RateLimiter } from "./src/rate-limit.js";
+export { KEY_TTL_SECONDS } from "./src/signing-key.js";
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSwyQ0FBMkM7QUFDM0MsbURBQW1EO0FBQ25ELHdFQUF3RTtBQUV4RSxPQUFPLEtBQUssU0FBUyxNQUFNLG9CQUFvQixDQUFDO0FBQ2hELE9BQU8sS0FBSyxHQUFHLE1BQU0sY0FBYyxDQUFDO0FBQ3BDLE9BQU8sS0FBSyxHQUFHLE1BQU0sY0FBYyxDQUFDO0FBQ3BDLE9BQU8sS0FBSyxPQUFPLE1BQU0sa0JBQWtCLENBQUM7QUFDNUMsT0FBTyxLQUFLLFdBQVcsTUFBTSxzQkFBc0IsQ0FBQztBQUNwRCxPQUFPLEtBQUssR0FBRyxNQUFNLGNBQWMsQ0FBQztBQUNwQyxPQUFPLEtBQUssTUFBTSxNQUFNLGlCQUFpQixDQUFDO0FBQzFDLE9BQU8sS0FBSyxLQUFLLE1BQU0sZ0JBQWdCLENBQUM7QUFDeEMsT0FBTyxLQUFLLEtBQUssTUFBTSxnQkFBZ0IsQ0FBQztBQUN4QyxPQUFPLEtBQUssU0FBUyxNQUFNLHFCQUFxQixDQUFDO0FBQ2pELE9BQU8sS0FBSyxVQUFVLE1BQU0sc0JBQXNCLENBQUM7QUFDbkQsT0FBTyxFQUFFLFNBQVMsRUFBRSxXQUFXLEVBQUUsY0FBYyxFQUFFLFdBQVcsRUFBRSxlQUFlLEVBQUUsWUFBWSxFQUFFLGNBQWMsRUFBRSxrQkFBa0IsRUFBRSxpQkFBaUIsRUFBRSxZQUFZLEVBQUUsbUJBQW1CLEVBQUUsTUFBTSxjQUFjLENBQUM7QUFDNU0sT0FBTyxFQUFFLGlCQUFpQixFQUFFLHVCQUF1QixFQUFFLE1BQU0sa0JBQWtCLENBQUM7QUFHOUUsT0FBTyxFQUFFLFNBQVMsRUFBRSxNQUFNLGNBQWMsQ0FBQztBQUV6QyxPQUFPLEVBQUUsY0FBYyxFQUFFLFFBQVEsRUFBRSxNQUFNLGlCQUFpQixDQUFDO0FBSTNELE9BQU8sRUFBRSxXQUFXLEVBQUUsTUFBTSxxQkFBcUIsQ0FBQztBQUNsRCxPQUFPLEVBQUUsZUFBZSxFQUFFLE1BQU0sc0JBQXNCLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvLyBHRU5FUkFURUQgYnkgcHJvamVuIHdhdGNoIC0gRE8gTk9UIEVESVQuXG4vLyBSZWdlbmVyYXRlZCBmcm9tIHRoZSBleHBvcnRpbmcgbW9kdWxlcyBpbiAuL3NyYy5cbi8vIEhhbmQgZWRpdHMgYXJlIG92ZXJ3cml0dGVuIG9uIHRoZSBuZXh0IHdhdGNoOyB0aGlzIGZpbGUgaXMgcmVhZC1vbmx5LlxuXG5leHBvcnQgKiBhcyBhbGxvd2xpc3QgZnJvbSBcIi4vc3JjL2FsbG93bGlzdC50c1wiO1xuZXhwb3J0ICogYXMgYXBwIGZyb20gXCIuL3NyYy9hcHAudHNcIjtcbmV4cG9ydCAqIGFzIGVudiBmcm9tIFwiLi9zcmMvZW52LnRzXCI7XG5leHBvcnQgKiBhcyBoZWFkZXJzIGZyb20gXCIuL3NyYy9oZWFkZXJzLnRzXCI7XG5leHBvcnQgKiBhcyBpbnRlcmNlcHRvciBmcm9tIFwiLi9zcmMvaW50ZXJjZXB0b3IudHNcIjtcbmV4cG9ydCAqIGFzIG90cCBmcm9tIFwiLi9zcmMvb3RwLnRzXCI7XG5leHBvcnQgKiBhcyBwbHVnaW4gZnJvbSBcIi4vc3JjL3BsdWdpbi50c1wiO1xuZXhwb3J0ICogYXMgcG9ydHIgZnJvbSBcIi4vc3JjL3BvcnRyLnRzXCI7XG5leHBvcnQgKiBhcyBwcm94eSBmcm9tIFwiLi9zcmMvcHJveHkudHNcIjtcbmV4cG9ydCAqIGFzIHJhdGVMaW1pdCBmcm9tIFwiLi9zcmMvcmF0ZS1saW1pdC50c1wiO1xuZXhwb3J0ICogYXMgc2lnbmluZ0tleSBmcm9tIFwiLi9zcmMvc2lnbmluZy1rZXkudHNcIjtcbmV4cG9ydCB7IEFMTE9XX0VOViwgU1VCSkVDVF9FTlYsIEJSQU5EX05BTUVfRU5WLCBNRVNTQUdFX0VOViwgU0VTU0lPTl9UVExfRU5WLCBDT0RFX1RUTF9FTlYsIEpXVF9TRUNSRVRfRU5WLCBTRVNTSU9OX0NVVE9GRl9FTlYsIFBVQkxJQ19ET01BSU5fRU5WLCBJTlNFQ1VSRV9FTlYsIEZPUldBUkRfSEVBREVSU19FTlYgfSBmcm9tIFwiLi9zcmMvZW52LnRzXCI7XG5leHBvcnQgeyBQUk9URUNURURfSEVBREVSUywgREVGQVVMVF9GT1JXQVJEX0hFQURFUlMgfSBmcm9tIFwiLi9zcmMvaGVhZGVycy50c1wiO1xuZXhwb3J0IHR5cGUgeyBIZWFkZXJQb2xpY3kgfSBmcm9tIFwiLi9zcmMvaGVhZGVycy50c1wiO1xuZXhwb3J0IHR5cGUgeyBUdW5uZWxJbnRlcmNlcHRvck9wdGlvbnMgfSBmcm9tIFwiLi9zcmMvaW50ZXJjZXB0b3IudHNcIjtcbmV4cG9ydCB7IENvZGVTdG9yZSB9IGZyb20gXCIuL3NyYy9vdHAudHNcIjtcbmV4cG9ydCB0eXBlIHsgVmVyaWZ5T3V0Y29tZSB9IGZyb20gXCIuL3NyYy9vdHAudHNcIjtcbmV4cG9ydCB7IEF1dGhHYXRlUGx1Z2luLCBhdXRoR2F0ZSB9IGZyb20gXCIuL3NyYy9wbHVnaW4udHNcIjtcbmV4cG9ydCB0eXBlIHsgQXV0aEdhdGVDb25maWcsIFNlbmRDb2RlT3B0aW9ucywgUmVzb2x2ZWRBdXRoR2F0ZUNvbmZpZywgQXV0aEdhdGVBcGkgfSBmcm9tIFwiLi9zcmMvcGx1Z2luLnRzXCI7XG5leHBvcnQgdHlwZSB7IFBvcnRyQ29uZmlnIH0gZnJvbSBcIi4vc3JjL3BvcnRyLnRzXCI7XG5leHBvcnQgdHlwZSB7IFByb3h5T3B0aW9ucyB9IGZyb20gXCIuL3NyYy9wcm94eS50c1wiO1xuZXhwb3J0IHsgUmF0ZUxpbWl0ZXIgfSBmcm9tIFwiLi9zcmMvcmF0ZS1saW1pdC50c1wiO1xuZXhwb3J0IHsgS0VZX1RUTF9TRUNPTkRTIH0gZnJvbSBcIi4vc3JjL3NpZ25pbmcta2V5LnRzXCI7XG5leHBvcnQgdHlwZSB7IFNpZ25pbmdLZXkgfSBmcm9tIFwiLi9zcmMvc2lnbmluZy1rZXkudHNcIjtcbiJdfQ==

package/lib/src/allowlist.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Unified access allow-list matching for the email-OTP gate.
+ *
+ * Each pattern in the configured list is one of three shapes:
+ *
+ *   - **domain shortcut** - `example.com` or `@example.com`: matches any
+ *     address whose domain equals it. This is the gate's OWN semantic (a bare
+ *     value means "the domain", not "the whole address"), so it is handled here.
+ *   - **glob** - contains `*` or `?`, e.g. `*@example.com`: matched against the
+ *     WHOLE address with shell-style wildcards.
+ *   - **regex** - wrapped in slashes, `/.../ [flags]`: tested against the whole
+ *     address. An invalid regex never matches (it is skipped with a warning
+ *     rather than throwing).
+ *
+ * Only the first shape is this module's business: the glob and regex shapes are
+ * delegated to `@dbx-tools/shared-core`'s {@link pattern.toPattern}, which is
+ * where that compilation lives for every allow-list in the repo (the tunnel's
+ * inbound-header policy uses the same one). Matching is case-insensitive
+ * throughout.
+ *
+ * An EMPTY list matches nobody (fail closed): an app that enables the gate but
+ * configures no patterns lets no one in, which is the safe default.
+ *
+ * @module
+ */
+/**
+ * True when `email` is allowed by ANY pattern in `patterns`. An empty (or
+ * missing) list allows nobody - the gate fails closed.
+ */
+export declare function matchesAllowlist(email: string, patterns: readonly string[] | undefined): boolean;
+/** Rough shape check so a clearly-invalid address is rejected before any work. */
+export declare function looksLikeEmail(value: string): boolean;

package/lib/src/allowlist.js

@@ -0,0 +1,57 @@
+/**
+ * Unified access allow-list matching for the email-OTP gate.
+ *
+ * Each pattern in the configured list is one of three shapes:
+ *
+ *   - **domain shortcut** - `example.com` or `@example.com`: matches any
+ *     address whose domain equals it. This is the gate's OWN semantic (a bare
+ *     value means "the domain", not "the whole address"), so it is handled here.
+ *   - **glob** - contains `*` or `?`, e.g. `*@example.com`: matched against the
+ *     WHOLE address with shell-style wildcards.
+ *   - **regex** - wrapped in slashes, `/.../ [flags]`: tested against the whole
+ *     address. An invalid regex never matches (it is skipped with a warning
+ *     rather than throwing).
+ *
+ * Only the first shape is this module's business: the glob and regex shapes are
+ * delegated to `@dbx-tools/shared-core`'s {@link pattern.toPattern}, which is
+ * where that compilation lives for every allow-list in the repo (the tunnel's
+ * inbound-header policy uses the same one). Matching is case-insensitive
+ * throughout.
+ *
+ * An EMPTY list matches nobody (fail closed): an app that enables the gate but
+ * configures no patterns lets no one in, which is the safe default.
+ *
+ * @module
+ */
+import { pattern } from "@dbx-tools/shared-core";
+/** True when `email` matches a single allow-list `pattern`. */
+function matchesPattern(email, entry) {
+    const trimmed = entry.trim();
+    if (!trimmed)
+        return false;
+    const address = email.trim().toLowerCase();
+    // A bare value with no wildcard and no regex delimiters is a DOMAIN shortcut,
+    // the one shape shared-core cannot infer: there it would mean whole-string
+    // equality against the address, which is never what an operator writing
+    // `example.com` in an access list intends.
+    if (!trimmed.startsWith("/") && !trimmed.includes("*") && !trimmed.includes("?")) {
+        const domain = trimmed.replace(/^@/, "").toLowerCase();
+        const at = address.lastIndexOf("@");
+        return at >= 0 && address.slice(at + 1) === domain;
+    }
+    return pattern.toPattern(trimmed)?.(address) ?? false;
+}
+/**
+ * True when `email` is allowed by ANY pattern in `patterns`. An empty (or
+ * missing) list allows nobody - the gate fails closed.
+ */
+export function matchesAllowlist(email, patterns) {
+    if (!email || !patterns || patterns.length === 0)
+        return false;
+    return patterns.some((entry) => matchesPattern(email, entry));
+}
+/** Rough shape check so a clearly-invalid address is rejected before any work. */
+export function looksLikeEmail(value) {
+    return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value.trim());
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWxsb3dsaXN0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2FsbG93bGlzdC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQTs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0dBd0JHO0FBRUgsT0FBTyxFQUFFLE9BQU8sRUFBRSxNQUFNLHdCQUF3QixDQUFDO0FBRWpELCtEQUErRDtBQUMvRCxTQUFTLGNBQWMsQ0FBQyxLQUFhLEVBQUUsS0FBYTtJQUNsRCxNQUFNLE9BQU8sR0FBRyxLQUFLLENBQUMsSUFBSSxFQUFFLENBQUM7SUFDN0IsSUFBSSxDQUFDLE9BQU87UUFBRSxPQUFPLEtBQUssQ0FBQztJQUMzQixNQUFNLE9BQU8sR0FBRyxLQUFLLENBQUMsSUFBSSxFQUFFLENBQUMsV0FBVyxFQUFFLENBQUM7SUFFM0MsOEVBQThFO0lBQzlFLDJFQUEyRTtJQUMzRSx3RUFBd0U7SUFDeEUsMkNBQTJDO0lBQzNDLElBQUksQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUNqRixNQUFNLE1BQU0sR0FBRyxPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRSxFQUFFLENBQUMsQ0FBQyxXQUFXLEVBQUUsQ0FBQztRQUN2RCxNQUFNLEVBQUUsR0FBRyxPQUFPLENBQUMsV0FBVyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQ3BDLE9BQU8sRUFBRSxJQUFJLENBQUMsSUFBSSxPQUFPLENBQUMsS0FBSyxDQUFDLEVBQUUsR0FBRyxDQUFDLENBQUMsS0FBSyxNQUFNLENBQUM7SUFDckQsQ0FBQztJQUVELE9BQU8sT0FBTyxDQUFDLFNBQVMsQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDLE9BQU8sQ0FBQyxJQUFJLEtBQUssQ0FBQztBQUN4RCxDQUFDO0FBRUQ7OztHQUdHO0FBQ0gsTUFBTSxVQUFVLGdCQUFnQixDQUFDLEtBQWEsRUFBRSxRQUF1QztJQUNyRixJQUFJLENBQUMsS0FBSyxJQUFJLENBQUMsUUFBUSxJQUFJLFFBQVEsQ0FBQyxNQUFNLEtBQUssQ0FBQztRQUFFLE9BQU8sS0FBSyxDQUFDO0lBQy9ELE9BQU8sUUFBUSxDQUFDLElBQUksQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsY0FBYyxDQUFDLEtBQUssRUFBRSxLQUFLLENBQUMsQ0FBQyxDQUFDO0FBQ2hFLENBQUM7QUFFRCxrRkFBa0Y7QUFDbEYsTUFBTSxVQUFVLGNBQWMsQ0FBQyxLQUFhO0lBQzFDLE9BQU8sNEJBQTRCLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDO0FBQ3pELENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvKipcbiAqIFVuaWZpZWQgYWNjZXNzIGFsbG93LWxpc3QgbWF0Y2hpbmcgZm9yIHRoZSBlbWFpbC1PVFAgZ2F0ZS5cbiAqXG4gKiBFYWNoIHBhdHRlcm4gaW4gdGhlIGNvbmZpZ3VyZWQgbGlzdCBpcyBvbmUgb2YgdGhyZWUgc2hhcGVzOlxuICpcbiAqICAgLSAqKmRvbWFpbiBzaG9ydGN1dCoqIC0gYGV4YW1wbGUuY29tYCBvciBgQGV4YW1wbGUuY29tYDogbWF0Y2hlcyBhbnlcbiAqICAgICBhZGRyZXNzIHdob3NlIGRvbWFpbiBlcXVhbHMgaXQuIFRoaXMgaXMgdGhlIGdhdGUncyBPV04gc2VtYW50aWMgKGEgYmFyZVxuICogICAgIHZhbHVlIG1lYW5zIFwidGhlIGRvbWFpblwiLCBub3QgXCJ0aGUgd2hvbGUgYWRkcmVzc1wiKSwgc28gaXQgaXMgaGFuZGxlZCBoZXJlLlxuICogICAtICoqZ2xvYioqIC0gY29udGFpbnMgYCpgIG9yIGA/YCwgZS5nLiBgKkBleGFtcGxlLmNvbWA6IG1hdGNoZWQgYWdhaW5zdCB0aGVcbiAqICAgICBXSE9MRSBhZGRyZXNzIHdpdGggc2hlbGwtc3R5bGUgd2lsZGNhcmRzLlxuICogICAtICoqcmVnZXgqKiAtIHdyYXBwZWQgaW4gc2xhc2hlcywgYC8uLi4vIFtmbGFnc11gOiB0ZXN0ZWQgYWdhaW5zdCB0aGUgd2hvbGVcbiAqICAgICBhZGRyZXNzLiBBbiBpbnZhbGlkIHJlZ2V4IG5ldmVyIG1hdGNoZXMgKGl0IGlzIHNraXBwZWQgd2l0aCBhIHdhcm5pbmdcbiAqICAgICByYXRoZXIgdGhhbiB0aHJvd2luZykuXG4gKlxuICogT25seSB0aGUgZmlyc3Qgc2hhcGUgaXMgdGhpcyBtb2R1bGUncyBidXNpbmVzczogdGhlIGdsb2IgYW5kIHJlZ2V4IHNoYXBlcyBhcmVcbiAqIGRlbGVnYXRlZCB0byBgQGRieC10b29scy9zaGFyZWQtY29yZWAncyB7QGxpbmsgcGF0dGVybi50b1BhdHRlcm59LCB3aGljaCBpc1xuICogd2hlcmUgdGhhdCBjb21waWxhdGlvbiBsaXZlcyBmb3IgZXZlcnkgYWxsb3ctbGlzdCBpbiB0aGUgcmVwbyAodGhlIHR1bm5lbCdzXG4gKiBpbmJvdW5kLWhlYWRlciBwb2xpY3kgdXNlcyB0aGUgc2FtZSBvbmUpLiBNYXRjaGluZyBpcyBjYXNlLWluc2Vuc2l0aXZlXG4gKiB0aHJvdWdob3V0LlxuICpcbiAqIEFuIEVNUFRZIGxpc3QgbWF0Y2hlcyBub2JvZHkgKGZhaWwgY2xvc2VkKTogYW4gYXBwIHRoYXQgZW5hYmxlcyB0aGUgZ2F0ZSBidXRcbiAqIGNvbmZpZ3VyZXMgbm8gcGF0dGVybnMgbGV0cyBubyBvbmUgaW4sIHdoaWNoIGlzIHRoZSBzYWZlIGRlZmF1bHQuXG4gKlxuICogQG1vZHVsZVxuICovXG5cbmltcG9ydCB7IHBhdHRlcm4gfSBmcm9tIFwiQGRieC10b29scy9zaGFyZWQtY29yZVwiO1xuXG4vKiogVHJ1ZSB3aGVuIGBlbWFpbGAgbWF0Y2hlcyBhIHNpbmdsZSBhbGxvdy1saXN0IGBwYXR0ZXJuYC4gKi9cbmZ1bmN0aW9uIG1hdGNoZXNQYXR0ZXJuKGVtYWlsOiBzdHJpbmcsIGVudHJ5OiBzdHJpbmcpOiBib29sZWFuIHtcbiAgY29uc3QgdHJpbW1lZCA9IGVudHJ5LnRyaW0oKTtcbiAgaWYgKCF0cmltbWVkKSByZXR1cm4gZmFsc2U7XG4gIGNvbnN0IGFkZHJlc3MgPSBlbWFpbC50cmltKCkudG9Mb3dlckNhc2UoKTtcblxuICAvLyBBIGJhcmUgdmFsdWUgd2l0aCBubyB3aWxkY2FyZCBhbmQgbm8gcmVnZXggZGVsaW1pdGVycyBpcyBhIERPTUFJTiBzaG9ydGN1dCxcbiAgLy8gdGhlIG9uZSBzaGFwZSBzaGFyZWQtY29yZSBjYW5ub3QgaW5mZXI6IHRoZXJlIGl0IHdvdWxkIG1lYW4gd2hvbGUtc3RyaW5nXG4gIC8vIGVxdWFsaXR5IGFnYWluc3QgdGhlIGFkZHJlc3MsIHdoaWNoIGlzIG5ldmVyIHdoYXQgYW4gb3BlcmF0b3Igd3JpdGluZ1xuICAvLyBgZXhhbXBsZS5jb21gIGluIGFuIGFjY2VzcyBsaXN0IGludGVuZHMuXG4gIGlmICghdHJpbW1lZC5zdGFydHNXaXRoKFwiL1wiKSAmJiAhdHJpbW1lZC5pbmNsdWRlcyhcIipcIikgJiYgIXRyaW1tZWQuaW5jbHVkZXMoXCI/XCIpKSB7XG4gICAgY29uc3QgZG9tYWluID0gdHJpbW1lZC5yZXBsYWNlKC9eQC8sIFwiXCIpLnRvTG93ZXJDYXNlKCk7XG4gICAgY29uc3QgYXQgPSBhZGRyZXNzLmxhc3RJbmRleE9mKFwiQFwiKTtcbiAgICByZXR1cm4gYXQgPj0gMCAmJiBhZGRyZXNzLnNsaWNlKGF0ICsgMSkgPT09IGRvbWFpbjtcbiAgfVxuXG4gIHJldHVybiBwYXR0ZXJuLnRvUGF0dGVybih0cmltbWVkKT8uKGFkZHJlc3MpID8/IGZhbHNlO1xufVxuXG4vKipcbiAqIFRydWUgd2hlbiBgZW1haWxgIGlzIGFsbG93ZWQgYnkgQU5ZIHBhdHRlcm4gaW4gYHBhdHRlcm5zYC4gQW4gZW1wdHkgKG9yXG4gKiBtaXNzaW5nKSBsaXN0IGFsbG93cyBub2JvZHkgLSB0aGUgZ2F0ZSBmYWlscyBjbG9zZWQuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBtYXRjaGVzQWxsb3dsaXN0KGVtYWlsOiBzdHJpbmcsIHBhdHRlcm5zOiByZWFkb25seSBzdHJpbmdbXSB8IHVuZGVmaW5lZCk6IGJvb2xlYW4ge1xuICBpZiAoIWVtYWlsIHx8ICFwYXR0ZXJucyB8fCBwYXR0ZXJucy5sZW5ndGggPT09IDApIHJldHVybiBmYWxzZTtcbiAgcmV0dXJuIHBhdHRlcm5zLnNvbWUoKGVudHJ5KSA9PiBtYXRjaGVzUGF0dGVybihlbWFpbCwgZW50cnkpKTtcbn1cblxuLyoqIFJvdWdoIHNoYXBlIGNoZWNrIHNvIGEgY2xlYXJseS1pbnZhbGlkIGFkZHJlc3MgaXMgcmVqZWN0ZWQgYmVmb3JlIGFueSB3b3JrLiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGxvb2tzTGlrZUVtYWlsKHZhbHVlOiBzdHJpbmcpOiBib29sZWFuIHtcbiAgcmV0dXJuIC9eW15cXHNAXStAW15cXHNAXStcXC5bXlxcc0BdKyQvLnRlc3QodmFsdWUudHJpbSgpKTtcbn1cbiJdfQ==