@digitalpaws/starr 0.0.1

package/dist/auth/oidc/oidc-flow.d.ts

@@ -0,0 +1,60 @@
+import type Database from "better-sqlite3";
+import type { Logger } from "../../types/plugin.js";
+import type { OidcProviderService } from "./oidc-provider-service.js";
+import type { User, UserService } from "./user-service.js";
+/** Result of a successful OIDC callback. */
+export interface OidcCallbackResult {
+    user: User;
+    providerId: string;
+    created: boolean;
+    redirectTo: string;
+}
+export declare class OidcFlow {
+    private db;
+    private providerService;
+    private userService;
+    private baseUrl;
+    private logger;
+    constructor(db: Database.Database, providerService: OidcProviderService, userService: UserService, baseUrl: string, // e.g. "http://localhost:3457"
+    logger: Logger);
+    /**
+     * Stage 1 — Initiate the OIDC login flow.
+     *
+     * 1. Look up the provider configuration.
+     * 2. Discover the OIDC issuer's endpoints (via .well-known).
+     * 3. Generate PKCE code verifier and challenge, state, nonce.
+     * 4. Store the state in oidc_auth_states.
+     * 5. Return the redirect URL to send the user's browser to.
+     *
+     * @param providerId  The OIDC provider's UUID.
+     * @param redirectTo  Where to send the user after successful login (e.g. "/browse").
+     * @returns The authorization URL to redirect the browser to.
+     */
+    initiateLogin(providerId: string, redirectTo?: string): Promise<string>;
+    /**
+     * Stage 2 — Handle the OIDC callback.
+     *
+     * 1. Validate the state (CSRF protection).
+     * 2. Look up stored auth state from DB.
+     * 3. Exchange authorization code for tokens.
+     * 4. Validate the ID token (handled by openid-client).
+     * 5. Find or create the user.
+     * 6. Clean up the used auth state.
+     *
+     * @returns The authenticated user and whether they were just created.
+     */
+    handleCallback(providerId: string, code: string, state: string): Promise<OidcCallbackResult>;
+    /**
+     * Resolve a Starr role from an OIDC claim using a JSONPath-like expression.
+     *
+     * Simple dot-notation path (e.g. "$.starr_roles" or "starr_roles"):
+     * - If the resolved value is an array, it's checked for "admin".
+     * - If it's a string, it's checked as-is.
+     * - If it's a boolean, true=admin, false=defaultRole.
+     * - If not found, returns null (caller uses defaultRole).
+     */
+    private resolveRoleFromClaim;
+    /** Delete auth states older than 10 minutes (capped at 100 rows). */
+    private cleanupExpiredStates;
+}
+//# sourceMappingURL=oidc-flow.d.ts.map

package/dist/auth/oidc/oidc-flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-flow.d.ts","sourceRoot":"","sources":["../../../src/auth/oidc/oidc-flow.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAI3D,4CAA4C;AAC5C,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,IAAI,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,QAAQ;IAEjB,OAAO,CAAC,EAAE;IACV,OAAO,CAAC,eAAe;IACvB,OAAO,CAAC,WAAW;IACnB,OAAO,CAAC,OAAO;IACf,OAAO,CAAC,MAAM;gBAJN,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,eAAe,EAAE,mBAAmB,EACpC,WAAW,EAAE,WAAW,EACxB,OAAO,EAAE,MAAM,EAAI,+BAA+B;IAClD,MAAM,EAAE,MAAM;IAGxB;;;;;;;;;;;;OAYG;IACG,aAAa,CACjB,UAAU,EAAE,MAAM,EAClB,UAAU,GAAE,MAAkB,GAC7B,OAAO,CAAC,MAAM,CAAC;IAqDlB;;;;;;;;;;;OAWG;IACG,cAAc,CAClB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,kBAAkB,CAAC;IA2F9B;;;;;;;;OAQG;IACH,OAAO,CAAC,oBAAoB;IAkC5B,qEAAqE;IACrE,OAAO,CAAC,oBAAoB;CAS7B"}

package/dist/auth/oidc/oidc-flow.js

@@ -0,0 +1,201 @@
+// SPDX-License-Identifier: 0BSD
+// SPDX-FileCopyrightText: 2025 Digi <digitalpaws@proton.me>
+import { discovery, buildAuthorizationUrl, authorizationCodeGrant, randomPKCECodeVerifier, calculatePKCECodeChallenge, randomState, randomNonce, } from "openid-client";
+const STATE_TTL_MS = 10 * 60 * 1000; // 10 minutes
+export class OidcFlow {
+    db;
+    providerService;
+    userService;
+    baseUrl;
+    logger;
+    constructor(db, providerService, userService, baseUrl, // e.g. "http://localhost:3457"
+    logger) {
+        this.db = db;
+        this.providerService = providerService;
+        this.userService = userService;
+        this.baseUrl = baseUrl;
+        this.logger = logger;
+    }
+    /**
+     * Stage 1 — Initiate the OIDC login flow.
+     *
+     * 1. Look up the provider configuration.
+     * 2. Discover the OIDC issuer's endpoints (via .well-known).
+     * 3. Generate PKCE code verifier and challenge, state, nonce.
+     * 4. Store the state in oidc_auth_states.
+     * 5. Return the redirect URL to send the user's browser to.
+     *
+     * @param providerId  The OIDC provider's UUID.
+     * @param redirectTo  Where to send the user after successful login (e.g. "/browse").
+     * @returns The authorization URL to redirect the browser to.
+     */
+    async initiateLogin(providerId, redirectTo = "/browse") {
+        const provider = this.providerService.get(providerId);
+        if (!provider) {
+            throw new Error(`OIDC provider not found: ${providerId}`);
+        }
+        if (!provider.enabled) {
+            throw new Error(`OIDC provider is disabled: ${providerId}`);
+        }
+        // Discover the OIDC issuer's metadata
+        const config = await discovery(new URL(provider.issuerUrl), provider.clientId, { client_secret: provider.clientSecret });
+        // Generate PKCE and state values
+        const codeVerifier = randomPKCECodeVerifier();
+        const codeChallenge = await calculatePKCECodeChallenge(codeVerifier);
+        const state = randomState();
+        const nonce = randomNonce();
+        // Store the auth state
+        this.db.prepare(`
+      INSERT INTO oidc_auth_states (state, nonce, code_verifier, provider_id, redirect_to, created_at)
+      VALUES (@state, @nonce, @codeVerifier, @providerId, @redirectTo, datetime('now'))
+    `).run({
+            state,
+            nonce,
+            codeVerifier,
+            providerId: provider.id,
+            redirectTo,
+        });
+        // Build the authorization URL
+        const authUrl = buildAuthorizationUrl(config, {
+            redirect_uri: `${this.baseUrl}/api/oidc/callback/${provider.id}`,
+            scope: provider.scopes,
+            state,
+            nonce,
+            code_challenge: codeChallenge,
+            code_challenge_method: "S256",
+            response_type: "code",
+        });
+        this.logger.info("OIDC login initiated", {
+            providerId: provider.id,
+            providerName: provider.name,
+        });
+        return authUrl.href;
+    }
+    /**
+     * Stage 2 — Handle the OIDC callback.
+     *
+     * 1. Validate the state (CSRF protection).
+     * 2. Look up stored auth state from DB.
+     * 3. Exchange authorization code for tokens.
+     * 4. Validate the ID token (handled by openid-client).
+     * 5. Find or create the user.
+     * 6. Clean up the used auth state.
+     *
+     * @returns The authenticated user and whether they were just created.
+     */
+    async handleCallback(providerId, code, state) {
+        // 1. Validate the state (CSRF)
+        if (!state || !code) {
+            throw new Error("Missing state or code parameter");
+        }
+        // 2. Look up the stored auth state
+        const authState = this.db.prepare(`
+      SELECT * FROM oidc_auth_states WHERE state = @state AND provider_id = @providerId
+    `).get({ state, providerId });
+        if (!authState) {
+            throw new Error("Invalid or expired OIDC state");
+        }
+        // Delete the used state now (before any further processing)
+        this.db.prepare("DELETE FROM oidc_auth_states WHERE state = @state").run({ state });
+        // 3. Clean up any expired auth states (older than 10 minutes)
+        this.cleanupExpiredStates();
+        // 4. Get the provider config and exchange the code
+        const provider = this.providerService.get(providerId);
+        if (!provider) {
+            throw new Error(`OIDC provider not found: ${providerId}`);
+        }
+        const config = await discovery(new URL(provider.issuerUrl), provider.clientId, { client_secret: provider.clientSecret });
+        // Build the callback URL with code + state params (as the provider would redirect to)
+        const callbackUrl = new URL(`${this.baseUrl}/api/oidc/callback/${provider.id}`);
+        callbackUrl.searchParams.set("code", code);
+        callbackUrl.searchParams.set("state", state);
+        // Exchange the authorization code for tokens.
+        // openid-client automatically:
+        //   - Validates the state parameter
+        //   - Validates the ID token (signature, iss, aud, exp, expectedNonce)
+        //   - Fetches the JWKS from the provider
+        const tokenSet = await authorizationCodeGrant(config, callbackUrl, {
+            expectedNonce: authState.nonce,
+            pkceCodeVerifier: authState.code_verifier,
+            expectedState: state,
+        });
+        // 5. Extract claims from the ID token
+        const idTokenClaims = tokenSet.claims();
+        if (!idTokenClaims) {
+            throw new Error("OIDC provider did not return an ID token");
+        }
+        // Cast claims to access OIDC standard claims (preferred_username, name, etc.)
+        const claims = idTokenClaims;
+        this.logger.info("OIDC callback successful", {
+            providerId,
+            sub: String(claims.sub ?? ""),
+            email: claims.email,
+        });
+        // 6. Resolve the role from the provider's role_attribute, if configured
+        let role = provider.defaultRole;
+        if (provider.roleAttribute) {
+            const resolvedRole = this.resolveRoleFromClaim(claims, provider.roleAttribute, provider.defaultRole);
+            if (resolvedRole)
+                role = resolvedRole;
+        }
+        // 7. Find or create the user
+        const { user, created } = this.userService.findOrCreateFromOidc({
+            sub: String(claims.sub ?? ""),
+            preferred_username: claims.preferred_username,
+            name: claims.name,
+            picture: claims.picture,
+            email: claims.email,
+        }, providerId, role);
+        return { user, providerId, created, redirectTo: authState.redirect_to ?? "/browse" };
+    }
+    /**
+     * Resolve a Starr role from an OIDC claim using a JSONPath-like expression.
+     *
+     * Simple dot-notation path (e.g. "$.starr_roles" or "starr_roles"):
+     * - If the resolved value is an array, it's checked for "admin".
+     * - If it's a string, it's checked as-is.
+     * - If it's a boolean, true=admin, false=defaultRole.
+     * - If not found, returns null (caller uses defaultRole).
+     */
+    resolveRoleFromClaim(claims, roleAttribute, defaultRole) {
+        try {
+            // Simple dot-notation path resolution
+            const path = roleAttribute.replace(/^\$\.?/, ""); // strip leading "$." or "$"
+            const keys = path.split(".");
+            let value = claims;
+            for (const key of keys) {
+                if (value && typeof value === "object" && key in value) {
+                    value = value[key];
+                }
+                else {
+                    return null; // path not found
+                }
+            }
+            // Interpret the value
+            if (Array.isArray(value)) {
+                return value.includes("admin") ? "admin" : defaultRole;
+            }
+            if (typeof value === "string") {
+                return value === "admin" ? "admin" : (value === "user" ? "user" : null);
+            }
+            if (typeof value === "boolean") {
+                return value ? "admin" : defaultRole;
+            }
+        }
+        catch {
+            // If anything goes wrong resolving the role, fall back to default
+        }
+        return null;
+    }
+    /** Delete auth states older than 10 minutes (capped at 100 rows). */
+    cleanupExpiredStates() {
+        // Use SQLite's datetime arithmetic for consistent comparison with
+        // the stored datetime('now') format (no T, no Z).
+        this.db.prepare(`
+      DELETE FROM oidc_auth_states
+      WHERE created_at < datetime('now', @offset)
+      LIMIT 100
+    `).run({ offset: `-${STATE_TTL_MS / 1000} seconds` });
+    }
+}
+//# sourceMappingURL=oidc-flow.js.map

package/dist/auth/oidc/oidc-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-flow.js","sourceRoot":"","sources":["../../../src/auth/oidc/oidc-flow.ts"],"names":[],"mappings":"AAAA,gCAAgC;AAChC,4DAA4D;AAE5D,OAAO,EACL,SAAS,EACT,qBAAqB,EACrB,sBAAsB,EACtB,sBAAsB,EACtB,0BAA0B,EAC1B,WAAW,EACX,WAAW,GACZ,MAAM,eAAe,CAAC;AAMvB,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAE,aAAa;AAUnD,MAAM,OAAO,QAAQ;IAET;IACA;IACA;IACA;IACA;IALV,YACU,EAAqB,EACrB,eAAoC,EACpC,WAAwB,EACxB,OAAe,EAAI,+BAA+B;IAClD,MAAc;QAJd,OAAE,GAAF,EAAE,CAAmB;QACrB,oBAAe,GAAf,eAAe,CAAqB;QACpC,gBAAW,GAAX,WAAW,CAAa;QACxB,YAAO,GAAP,OAAO,CAAQ;QACf,WAAM,GAAN,MAAM,CAAQ;IACrB,CAAC;IAEJ;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,aAAa,CACjB,UAAkB,EAClB,aAAqB,SAAS;QAE9B,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACtD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,4BAA4B,UAAU,EAAE,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,8BAA8B,UAAU,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,sCAAsC;QACtC,MAAM,MAAM,GAAG,MAAM,SAAS,CAC5B,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAC3B,QAAQ,CAAC,QAAQ,EACjB,EAAE,aAAa,EAAE,QAAQ,CAAC,YAAY,EAAE,CACzC,CAAC;QAEF,iCAAiC;QACjC,MAAM,YAAY,GAAG,sBAAsB,EAAE,CAAC;QAC9C,MAAM,aAAa,GAAG,MAAM,0BAA0B,CAAC,YAAY,CAAC,CAAC;QACrE,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;QAE5B,uBAAuB;QACvB,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;KAGf,CAAC,CAAC,GAAG,CAAC;YACL,KAAK;YACL,KAAK;YACL,YAAY;YACZ,UAAU,EAAE,QAAQ,CAAC,EAAE;YACvB,UAAU;SACX,CAAC,CAAC;QAEH,8BAA8B;QAC9B,MAAM,OAAO,GAAG,qBAAqB,CAAC,MAAM,EAAE;YAC5C,YAAY,EAAE,GAAG,IAAI,CAAC,OAAO,sBAAsB,QAAQ,CAAC,EAAE,EAAE;YAChE,KAAK,EAAE,QAAQ,CAAC,MAAM;YACtB,KAAK;YACL,KAAK;YACL,cAAc,EAAE,aAAa;YAC7B,qBAAqB,EAAE,MAAM;YAC7B,aAAa,EAAE,MAAM;SACtB,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE;YACvC,UAAU,EAAE,QAAQ,CAAC,EAAE;YACvB,YAAY,EAAE,QAAQ,CAAC,IAAI;SAC5B,CAAC,CAAC;QAEH,OAAO,OAAO,CAAC,IAAI,CAAC;IACtB,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,cAAc,CAClB,UAAkB,EAClB,IAAY,EACZ,KAAa;QAEb,+BAA+B;QAC/B,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QAED,mCAAmC;QACnC,MAAM,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;KAEjC,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAQ,CAAC;QAErC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QAED,4DAA4D;QAC5D,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,mDAAmD,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAEpF,8DAA8D;QAC9D,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAE5B,mDAAmD;QACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACtD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,4BAA4B,UAAU,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,SAAS,CAC5B,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAC3B,QAAQ,CAAC,QAAQ,EACjB,EAAE,aAAa,EAAE,QAAQ,CAAC,YAAY,EAAE,CACzC,CAAC;QAEF,sFAAsF;QACtF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,sBAAsB,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QAChF,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC3C,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAE7C,8CAA8C;QAC9C,+BAA+B;QAC/B,oCAAoC;QACpC,uEAAuE;QACvE,yCAAyC;QACzC,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAC3C,MAAM,EACN,WAAW,EACX;YACE,aAAa,EAAE,SAAS,CAAC,KAAK;YAC9B,gBAAgB,EAAE,SAAS,CAAC,aAAa;YACzC,aAAa,EAAE,KAAK;SACrB,CACF,CAAC;QAEF,sCAAsC;QACtC,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;QACxC,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QAED,8EAA8E;QAC9E,MAAM,MAAM,GAAG,aAAwC,CAAC;QAExD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE;YAC3C,UAAU;YACV,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;YAC7B,KAAK,EAAE,MAAM,CAAC,KAA2B;SAC1C,CAAC,CAAC;QAEH,wEAAwE;QACxE,IAAI,IAAI,GAAqB,QAAQ,CAAC,WAAW,CAAC;QAClD,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC;YAC3B,MAAM,YAAY,GAAG,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;YACrG,IAAI,YAAY;gBAAE,IAAI,GAAG,YAAY,CAAC;QACxC,CAAC;QAED,6BAA6B;QAC7B,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,oBAAoB,CAC7D;YACE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;YAC7B,kBAAkB,EAAE,MAAM,CAAC,kBAAwC;YACnE,IAAI,EAAE,MAAM,CAAC,IAA0B;YACvC,OAAO,EAAE,MAAM,CAAC,OAA6B;YAC7C,KAAK,EAAE,MAAM,CAAC,KAA2B;SAC1C,EACD,UAAU,EACV,IAAI,CACL,CAAC;QAEF,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,CAAC,WAAW,IAAI,SAAS,EAAE,CAAC;IACvF,CAAC;IAED;;;;;;;;OAQG;IACK,oBAAoB,CAC1B,MAA+B,EAC/B,aAAqB,EACrB,WAA6B;QAE7B,IAAI,CAAC;YACH,sCAAsC;YACtC,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,4BAA4B;YAC9E,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,KAAK,GAAY,MAAM,CAAC;YAC5B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,GAAG,IAAK,KAAiC,EAAE,CAAC;oBACpF,KAAK,GAAI,KAAiC,CAAC,GAAG,CAAC,CAAC;gBAClD,CAAC;qBAAM,CAAC;oBACN,OAAO,IAAI,CAAC,CAAC,iBAAiB;gBAChC,CAAC;YACH,CAAC;YAED,sBAAsB;YACtB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,OAAO,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;YACzD,CAAC;YACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,OAAO,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC1E,CAAC;YACD,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC/B,OAAO,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;YACvC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;QACpE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,qEAAqE;IAC7D,oBAAoB;QAC1B,kEAAkE;QAClE,kDAAkD;QAClD,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;;KAIf,CAAC,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,YAAY,GAAG,IAAI,UAAU,EAAE,CAAC,CAAC;IACxD,CAAC;CACF"}

package/dist/auth/oidc/oidc-provider-service.d.ts

@@ -0,0 +1,59 @@
+import type Database from "better-sqlite3";
+import type { Logger } from "../../types/plugin.js";
+/**
+ * Shape of an OIDC provider as stored.
+ * client_secret is encrypted at rest.
+ */
+export interface OidcProvider {
+    id: string;
+    name: string;
+    issuerUrl: string;
+    clientId: string;
+    clientSecret: string;
+    scopes: string;
+    roleAttribute: string | null;
+    defaultRole: "admin" | "user";
+    enabled: boolean;
+    createdAt: string;
+    updatedAt: string;
+}
+/**
+ * Public-facing shape (no secret, for the login page).
+ */
+export interface OidcProviderPublic {
+    id: string;
+    name: string;
+    enabled: boolean;
+}
+/** Shape used when creating or updating a provider. */
+export interface OidcProviderInput {
+    name: string;
+    issuerUrl: string;
+    clientId: string;
+    clientSecret: string;
+    scopes?: string;
+    roleAttribute?: string | null;
+    defaultRole?: "admin" | "user";
+    enabled?: boolean;
+}
+export declare class OidcProviderService {
+    private db;
+    private encrypt;
+    private decrypt;
+    private logger;
+    constructor(db: Database.Database, encrypt: (plaintext: string) => string, decrypt: (ciphertext: string) => string, logger: Logger);
+    /** List all providers (with encrypted secrets, for admin API). */
+    list(): OidcProvider[];
+    /** List only enabled providers (public info, no secrets). */
+    listEnabled(): OidcProviderPublic[];
+    /** Get a single provider by ID. */
+    get(id: string): OidcProvider | null;
+    /** Create a new provider. Returns the created provider. */
+    create(input: OidcProviderInput): OidcProvider;
+    /** Update an existing provider. Fields that are undefined are not changed. */
+    update(id: string, input: Partial<OidcProviderInput>): OidcProvider | null;
+    /** Delete a provider. Also cleans up auth states referencing it (CASCADE). */
+    delete(id: string): boolean;
+    private rowToProvider;
+}
+//# sourceMappingURL=oidc-provider-service.d.ts.map

package/dist/auth/oidc/oidc-provider-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-provider-service.d.ts","sourceRoot":"","sources":["../../../src/auth/oidc/oidc-provider-service.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAEpD;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,WAAW,EAAE,OAAO,GAAG,MAAM,CAAC;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,uDAAuD;AACvD,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,WAAW,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC/B,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,qBAAa,mBAAmB;IAE5B,OAAO,CAAC,EAAE;IACV,OAAO,CAAC,OAAO;IACf,OAAO,CAAC,OAAO;IACf,OAAO,CAAC,MAAM;gBAHN,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,EACtC,OAAO,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,MAAM,EACvC,MAAM,EAAE,MAAM;IAGxB,kEAAkE;IAClE,IAAI,IAAI,YAAY,EAAE;IAOtB,6DAA6D;IAC7D,WAAW,IAAI,kBAAkB,EAAE;IAWnC,mCAAmC;IACnC,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI;IAOpC,2DAA2D;IAC3D,MAAM,CAAC,KAAK,EAAE,iBAAiB,GAAG,YAAY;IA2B9C,8EAA8E;IAC9E,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,YAAY,GAAG,IAAI;IAmC1E,8EAA8E;IAC9E,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAW3B,OAAO,CAAC,aAAa;CAetB"}

package/dist/auth/oidc/oidc-provider-service.js

@@ -0,0 +1,124 @@
+// SPDX-License-Identifier: 0BSD
+// SPDX-FileCopyrightText: 2025 Digi <digitalpaws@proton.me>
+import { randomUUID } from "node:crypto";
+export class OidcProviderService {
+    db;
+    encrypt;
+    decrypt;
+    logger;
+    constructor(db, encrypt, decrypt, logger) {
+        this.db = db;
+        this.encrypt = encrypt;
+        this.decrypt = decrypt;
+        this.logger = logger;
+    }
+    /** List all providers (with encrypted secrets, for admin API). */
+    list() {
+        const rows = this.db
+            .prepare("SELECT * FROM oidc_providers ORDER BY name ASC")
+            .all();
+        return rows.map(this.rowToProvider);
+    }
+    /** List only enabled providers (public info, no secrets). */
+    listEnabled() {
+        const rows = this.db
+            .prepare("SELECT id, name, enabled FROM oidc_providers WHERE enabled = 1 ORDER BY name ASC")
+            .all();
+        return rows.map((r) => ({
+            id: r.id,
+            name: r.name,
+            enabled: !!r.enabled,
+        }));
+    }
+    /** Get a single provider by ID. */
+    get(id) {
+        const row = this.db
+            .prepare("SELECT * FROM oidc_providers WHERE id = @id")
+            .get({ id });
+        return row ? this.rowToProvider(row) : null;
+    }
+    /** Create a new provider. Returns the created provider. */
+    create(input) {
+        const id = randomUUID();
+        const encryptedSecret = this.encrypt(input.clientSecret);
+        const scopes = input.scopes ?? "openid profile email";
+        const defaultRole = input.defaultRole ?? "user";
+        this.db.prepare(`
+      INSERT INTO oidc_providers (id, name, issuer_url, client_id, client_secret,
+        scopes, role_attribute, default_role, enabled)
+      VALUES (@id, @name, @issuerUrl, @clientId, @clientSecret,
+        @scopes, @roleAttribute, @defaultRole, @enabled)
+    `).run({
+            id,
+            name: input.name,
+            issuerUrl: input.issuerUrl,
+            clientId: input.clientId,
+            clientSecret: encryptedSecret,
+            scopes,
+            roleAttribute: input.roleAttribute ?? null,
+            defaultRole,
+            enabled: input.enabled !== false ? 1 : 0,
+        });
+        this.logger.info("OIDC provider created", { id, name: input.name });
+        return this.get(id);
+    }
+    /** Update an existing provider. Fields that are undefined are not changed. */
+    update(id, input) {
+        const existing = this.get(id);
+        if (!existing)
+            return null;
+        const name = input.name ?? existing.name;
+        const issuerUrl = input.issuerUrl ?? existing.issuerUrl;
+        const clientId = input.clientId ?? existing.clientId;
+        const clientSecret = input.clientSecret
+            ? this.encrypt(input.clientSecret)
+            : existing.clientSecret; // Keep existing encrypted value if no new secret provided
+        const scopes = input.scopes ?? existing.scopes;
+        const roleAttribute = input.roleAttribute !== undefined
+            ? (input.roleAttribute ?? null)
+            : existing.roleAttribute;
+        const defaultRole = input.defaultRole ?? existing.defaultRole;
+        const enabled = input.enabled !== undefined ? (input.enabled ? 1 : 0) : (existing.enabled ? 1 : 0);
+        this.db.prepare(`
+      UPDATE oidc_providers SET
+        name = @name,
+        issuer_url = @issuerUrl,
+        client_id = @clientId,
+        client_secret = @clientSecret,
+        scopes = @scopes,
+        role_attribute = @roleAttribute,
+        default_role = @defaultRole,
+        enabled = @enabled,
+        updated_at = datetime('now')
+      WHERE id = @id
+    `).run({ id, name, issuerUrl, clientId, clientSecret, scopes, roleAttribute, defaultRole, enabled });
+        this.logger.info("OIDC provider updated", { id, name });
+        return this.get(id);
+    }
+    /** Delete a provider. Also cleans up auth states referencing it (CASCADE). */
+    delete(id) {
+        const existing = this.get(id);
+        if (!existing)
+            return false;
+        this.db.prepare("DELETE FROM oidc_providers WHERE id = @id").run({ id });
+        this.logger.info("OIDC provider deleted", { id, name: existing.name });
+        return true;
+    }
+    // ── Private helpers ──
+    rowToProvider(row) {
+        return {
+            id: row.id,
+            name: row.name,
+            issuerUrl: row.issuer_url,
+            clientId: row.client_id,
+            clientSecret: this.decrypt(row.client_secret),
+            scopes: row.scopes,
+            roleAttribute: row.role_attribute,
+            defaultRole: row.default_role,
+            enabled: !!row.enabled,
+            createdAt: row.created_at,
+            updatedAt: row.updated_at,
+        };
+    }
+}
+//# sourceMappingURL=oidc-provider-service.js.map

package/dist/auth/oidc/oidc-provider-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-provider-service.js","sourceRoot":"","sources":["../../../src/auth/oidc/oidc-provider-service.ts"],"names":[],"mappings":"AAAA,gCAAgC;AAChC,4DAA4D;AAE5D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AA2CzC,MAAM,OAAO,mBAAmB;IAEpB;IACA;IACA;IACA;IAJV,YACU,EAAqB,EACrB,OAAsC,EACtC,OAAuC,EACvC,MAAc;QAHd,OAAE,GAAF,EAAE,CAAmB;QACrB,YAAO,GAAP,OAAO,CAA+B;QACtC,YAAO,GAAP,OAAO,CAAgC;QACvC,WAAM,GAAN,MAAM,CAAQ;IACrB,CAAC;IAEJ,kEAAkE;IAClE,IAAI;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACjB,OAAO,CAAC,gDAAgD,CAAC;aACzD,GAAG,EAAW,CAAC;QAClB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACtC,CAAC;IAED,6DAA6D;IAC7D,WAAW;QACT,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACjB,OAAO,CAAC,kFAAkF,CAAC;aAC3F,GAAG,EAAW,CAAC;QAClB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;YAC3B,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO;SACrB,CAAC,CAAC,CAAC;IACN,CAAC;IAED,mCAAmC;IACnC,GAAG,CAAC,EAAU;QACZ,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,OAAO,CAAC,6CAA6C,CAAC;aACtD,GAAG,CAAC,EAAE,EAAE,EAAE,CAAQ,CAAC;QACtB,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9C,CAAC;IAED,2DAA2D;IAC3D,MAAM,CAAC,KAAwB;QAC7B,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;QACxB,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,sBAAsB,CAAC;QACtD,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,MAAM,CAAC;QAEhD,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;;;KAKf,CAAC,CAAC,GAAG,CAAC;YACL,EAAE;YACF,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,YAAY,EAAE,eAAe;YAC7B,MAAM;YACN,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,IAAI;YAC1C,WAAW;YACX,OAAO,EAAE,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACzC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC;IACvB,CAAC;IAED,8EAA8E;IAC9E,MAAM,CAAC,EAAU,EAAE,KAAiC;QAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE3B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC;QACzC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,QAAQ,CAAC,SAAS,CAAC;QACxD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC;QACrD,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY;YACrC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC;YAClC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAE,0DAA0D;QACtF,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC;QAC/C,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,KAAK,SAAS;YACrD,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,IAAI,IAAI,CAAC;YAC/B,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC;QAC3B,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,QAAQ,CAAC,WAAW,CAAC;QAC9D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAEnG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;;;;;;;;;;KAYf,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;QAErG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACtB,CAAC;IAED,8EAA8E;IAC9E,MAAM,CAAC,EAAU;QACf,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAE5B,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,2CAA2C,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QACvE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,wBAAwB;IAEhB,aAAa,CAAC,GAAQ;QAC5B,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,QAAQ,EAAE,GAAG,CAAC,SAAS;YACvB,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;YAC7C,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,aAAa,EAAE,GAAG,CAAC,cAAc;YACjC,WAAW,EAAE,GAAG,CAAC,YAAY;YAC7B,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO;YACtB,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,SAAS,EAAE,GAAG,CAAC,UAAU;SAC1B,CAAC;IACJ,CAAC;CACF"}

package/dist/auth/oidc/user-service.d.ts

@@ -0,0 +1,67 @@
+import type Database from "better-sqlite3";
+import type { Logger } from "../../types/plugin.js";
+export interface User {
+    id: string;
+    username: string;
+    displayName: string | null;
+    avatarUrl: string | null;
+    role: "admin" | "user";
+    provider: "local" | "oidc";
+    oidcSub: string | null;
+    oidcProviderId: string | null;
+    createdAt: string;
+    updatedAt: string;
+}
+/** Shape for updating user role (admin-only). */
+export interface UserRoleUpdate {
+    role: "admin" | "user";
+}
+export declare class UserService {
+    private db;
+    private logger;
+    constructor(db: Database.Database, logger: Logger);
+    /** Get a user by UUID or the fixed admin id. */
+    get(id: string): User | null;
+    /** Get a user by username. */
+    getByUsername(username: string): User | null;
+    /**
+     * Find a user by OIDC subject and provider.
+     * This is the primary lookup during OIDC callback.
+     */
+    getByOidcSub(oidcSub: string, oidcProviderId: string): User | null;
+    /**
+     * Find or create a user from OIDC claims during callback.
+     *
+     * Steps:
+     * 1. Look up by (oidc_sub, oidc_provider_id).
+     * 2. If found, update display_name, avatar_url, username from claims.
+     * 3. If not found, create a new user with provider='oidc'.
+     *
+     * Returns the user and a boolean indicating whether it was newly created.
+     */
+    findOrCreateFromOidc(claims: {
+        sub: string;
+        preferred_username?: string;
+        name?: string;
+        picture?: string;
+        email?: string;
+    }, oidcProviderId: string, defaultRole: "admin" | "user"): {
+        user: User;
+        created: boolean;
+    };
+    /** List all users (admin only). */
+    list(): User[];
+    /** Count how many admin users exist. */
+    countAdmins(): number;
+    /** Change a user's role. Returns the updated user or null if not found. */
+    setRole(id: string, role: "admin" | "user"): User | null;
+    /** Check if there is at least one admin user. */
+    hasAdmin(): boolean;
+    /**
+     * Resolve a user identifier (UUID or "admin") to a user.
+     * Used when validating sessions that may have either format in user_id.
+     */
+    resolveUser(userId: string): User | null;
+    private rowToUser;
+}
+//# sourceMappingURL=user-service.d.ts.map

package/dist/auth/oidc/user-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-service.d.ts","sourceRoot":"","sources":["../../../src/auth/oidc/user-service.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAEpD,MAAM,WAAW,IAAI;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC;IACvB,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC;IAC3B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,iDAAiD;AACjD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC;CACxB;AAED,qBAAa,WAAW;IAEpB,OAAO,CAAC,EAAE;IACV,OAAO,CAAC,MAAM;gBADN,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,MAAM,EAAE,MAAM;IAGxB,gDAAgD;IAChD,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAO5B,8BAA8B;IAC9B,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAO5C;;;OAGG;IACH,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IASlE;;;;;;;;;OASG;IACH,oBAAoB,CAClB,MAAM,EAAE;QACN,GAAG,EAAE,MAAM,CAAC;QACZ,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,EACD,cAAc,EAAE,MAAM,EACtB,WAAW,EAAE,OAAO,GAAG,MAAM,GAC5B;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE;IAiEnC,mCAAmC;IACnC,IAAI,IAAI,IAAI,EAAE;IAOd,wCAAwC;IACxC,WAAW,IAAI,MAAM;IAOrB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,GAAG,IAAI;IA4BxD,iDAAiD;IACjD,QAAQ,IAAI,OAAO;IAOnB;;;OAGG;IACH,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAUxC,OAAO,CAAC,SAAS;CAclB"}