@flytedesk/app-kit 0.6.0 → 0.7.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/auth/client/httpClient.d.ts +85 -0
- package/dist/auth/client/httpClient.js +218 -0
- package/dist/auth/client/httpClient.js.map +1 -0
- package/dist/auth/client/index.d.ts +9 -0
- package/dist/auth/client/index.js +9 -0
- package/dist/auth/client/index.js.map +1 -0
- package/dist/auth/client/useAuthSession.d.ts +25 -0
- package/dist/auth/client/useAuthSession.js +97 -0
- package/dist/auth/client/useAuthSession.js.map +1 -0
- package/dist/auth/errors.d.ts +47 -0
- package/dist/auth/errors.js +75 -0
- package/dist/auth/errors.js.map +1 -0
- package/dist/auth/index.d.ts +3 -1
- package/dist/auth/index.js +1 -0
- package/dist/auth/index.js.map +1 -1
- package/dist/auth/oidc-client.d.ts +3 -14
- package/dist/auth/oidc-client.js +5 -4
- package/dist/auth/oidc-client.js.map +1 -1
- package/dist/auth/plugin.js +149 -28
- package/dist/auth/plugin.js.map +1 -1
- package/dist/auth/shared-types.d.ts +49 -0
- package/dist/auth/shared-types.js +11 -0
- package/dist/auth/shared-types.js.map +1 -0
- package/dist/auth/testing/fake-idp.d.ts +24 -2
- package/dist/auth/testing/fake-idp.js +85 -4
- package/dist/auth/testing/fake-idp.js.map +1 -1
- package/dist/auth/types.d.ts +6 -18
- package/package.json +16 -2
|
@@ -1,3 +1,4 @@
|
|
|
1
|
+
import type { AppSwitcherEntry } from "./shared-types.js";
|
|
1
2
|
import type { UserinfoClaims } from "./types.js";
|
|
2
3
|
export interface OidcClientOptions {
|
|
3
4
|
issuer: string;
|
|
@@ -25,19 +26,7 @@ export interface IdpAuthorization {
|
|
|
25
26
|
}>;
|
|
26
27
|
permissions: string[];
|
|
27
28
|
}
|
|
28
|
-
|
|
29
|
-
* One entry from `GET {issuer}/me/apps` — an app the caller holds any role in.
|
|
30
|
-
* Shaped to drop straight into `@flytedan/flytebot-design-system`'s `AppEntry`
|
|
31
|
-
* ("All flytedesk apps" switcher, MP-209): `icon` is that same convention's bare
|
|
32
|
-
* Phosphor icon-library key (e.g. "chart-bar"), not a URL, and either field is
|
|
33
|
-
* `null` for an app flytedesk-id hasn't been seeded with one for yet.
|
|
34
|
-
*/
|
|
35
|
-
export interface IdpAppSwitcherEntry {
|
|
36
|
-
key: string;
|
|
37
|
-
name: string;
|
|
38
|
-
url: string | null;
|
|
39
|
-
icon: string | null;
|
|
40
|
-
}
|
|
29
|
+
export type { AppSwitcherEntry };
|
|
41
30
|
export interface OidcClient {
|
|
42
31
|
buildAuthorizeUrl(opts: {
|
|
43
32
|
state: string;
|
|
@@ -52,7 +41,7 @@ export interface OidcClient {
|
|
|
52
41
|
* design system's "All flytedesk apps" switcher. Computed live by flytedesk-id on
|
|
53
42
|
* every call (never cached there — see fetchAuthorization's doc comment, same
|
|
54
43
|
* reasoning), so callers must call this live too rather than memoizing the result. */
|
|
55
|
-
fetchMyApps(idpAccessToken: string): Promise<
|
|
44
|
+
fetchMyApps(idpAccessToken: string): Promise<AppSwitcherEntry[]>;
|
|
56
45
|
/** Best-effort — never throws. Returns whether flytedesk-id accepted the revocation. */
|
|
57
46
|
revokeIdpToken(token: string): Promise<boolean>;
|
|
58
47
|
}
|
package/dist/auth/oidc-client.js
CHANGED
|
@@ -1,4 +1,5 @@
|
|
|
1
1
|
import { createRemoteJWKSet, jwtVerify } from "jose";
|
|
2
|
+
import { OidcHttpError } from "./errors.js";
|
|
2
3
|
/**
|
|
3
4
|
* One instance per FlytedeskAuthOptions (i.e. per plugin registration), not a module
|
|
4
5
|
* singleton — keeps the JWKS/discovery caches below scoped to one issuer/client pair
|
|
@@ -33,7 +34,7 @@ export function createOidcClient(opts) {
|
|
|
33
34
|
});
|
|
34
35
|
if (!res.ok) {
|
|
35
36
|
const text = await res.text().catch(() => "");
|
|
36
|
-
throw new
|
|
37
|
+
throw new OidcHttpError(`flytedesk-id /token returned ${res.status}: ${text}`, res.status);
|
|
37
38
|
}
|
|
38
39
|
return (await res.json());
|
|
39
40
|
}
|
|
@@ -108,7 +109,7 @@ export function createOidcClient(opts) {
|
|
|
108
109
|
headers: { Authorization: `Bearer ${idpAccessToken}` },
|
|
109
110
|
});
|
|
110
111
|
if (!res.ok) {
|
|
111
|
-
throw new
|
|
112
|
+
throw new OidcHttpError(`flytedesk-id userinfo (/me) returned ${res.status}`, res.status);
|
|
112
113
|
}
|
|
113
114
|
const body = (await res.json());
|
|
114
115
|
if (typeof body.sub !== "string" || typeof body.email !== "string") {
|
|
@@ -130,7 +131,7 @@ export function createOidcClient(opts) {
|
|
|
130
131
|
headers: { Authorization: `Bearer ${idpAccessToken}` },
|
|
131
132
|
});
|
|
132
133
|
if (!res.ok) {
|
|
133
|
-
throw new
|
|
134
|
+
throw new OidcHttpError(`flytedesk-id authorization endpoint returned ${res.status}`, res.status);
|
|
134
135
|
}
|
|
135
136
|
return (await res.json());
|
|
136
137
|
},
|
|
@@ -140,7 +141,7 @@ export function createOidcClient(opts) {
|
|
|
140
141
|
headers: { Authorization: `Bearer ${idpAccessToken}` },
|
|
141
142
|
});
|
|
142
143
|
if (!res.ok) {
|
|
143
|
-
throw new
|
|
144
|
+
throw new OidcHttpError(`flytedesk-id /me/apps returned ${res.status}`, res.status);
|
|
144
145
|
}
|
|
145
146
|
const body = (await res.json());
|
|
146
147
|
return body.apps;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"oidc-client.js","sourceRoot":"","sources":["../../src/auth/oidc-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAwB,MAAM,MAAM,CAAC;
|
|
1
|
+
{"version":3,"file":"oidc-client.js","sourceRoot":"","sources":["../../src/auth/oidc-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAwB,MAAM,MAAM,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAqD5C;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAuB;IACtD,SAAS,SAAS,CAAC,IAAY;QAC7B,OAAO,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC/C,CAAC;IAED;;;;;;;OAOG;IACH,SAAS,eAAe;QACtB,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnD,MAAM,YAAY,GAAG,kBAAkB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC3D,OAAO,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClF,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,IAA4B;QACtD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE;YAC3C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;gBACnD,aAAa,EAAE,eAAe,EAAE;aACjC;YACD,IAAI,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;SAC3C,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,MAAM,IAAI,aAAa,CAAC,gCAAgC,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7F,CAAC;QACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAqB,CAAC;IAChD,CAAC;IAED,IAAI,IAAiC,CAAC;IACtC,SAAS,OAAO;QACd,IAAI,KAAK,kBAAkB,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,cAAsD,CAAC;IAC3D,SAAS,YAAY;QACnB,cAAc,KAAK,KAAK,CAAC,SAAS,CAAC,mCAAmC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YACpF,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YAC9E,OAAO,GAAG,CAAC,IAAI,EAAgC,CAAC;QAClD,CAAC,CAAC,CAAC;QACH,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,OAAO;QACL,iBAAiB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE;YACpC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;YACxC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YACjD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YACvD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;YACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;YAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;YACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACrC,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;QACxB,CAAC;QAED,4FAA4F;QAC5F,qBAAqB,CAAC,IAAI,EAAE,QAAQ;YAClC,OAAO,YAAY,CAAC;gBAClB,UAAU,EAAE,oBAAoB;gBAChC,IAAI;gBACJ,YAAY,EAAE,IAAI,CAAC,WAAW;gBAC9B,aAAa,EAAE,QAAQ;gBACvB,SAAS,EAAE,IAAI,CAAC,QAAQ;aACzB,CAAC,CAAC;QACL,CAAC;QAED;qCAC6B;QAC7B,gBAAgB,CAAC,YAAY;YAC3B,OAAO,YAAY,CAAC;gBAClB,UAAU,EAAE,eAAe;gBAC3B,aAAa,EAAE,YAAY;gBAC3B,SAAS,EAAE,IAAI,CAAC,QAAQ;aACzB,CAAC,CAAC;QACL,CAAC;QAED;;;;;;;;WAQG;QACH,KAAK,CAAC,aAAa,CAAC,OAAO;YACzB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;gBACtD,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB,CAAC,CAAC;YACH,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;YAC7E,CAAC;YACD,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;QAC9B,CAAC;QAED;0EACkE;QAClE,KAAK,CAAC,aAAa,CAAC,cAAc;YAChC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;gBACxC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,cAAc,EAAE,EAAE;aACvD,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,aAAa,CAAC,wCAAwC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YAC5F,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;YAC3D,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACnE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;YACtF,CAAC;YACD,OAAO;gBACL,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,aAAa,EAAE,IAAI,CAAC,cAAc,KAAK,IAAI;gBAC3C,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;aAC5D,CAAC;QACJ,CAAC;QAED;;;sFAG8E;QAC9E,KAAK,CAAC,kBAAkB,CAAC,cAAc,EAAE,KAAK;YAC5C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,SAAS,KAAK,gBAAgB,CAAC,EAAE;gBACjE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,cAAc,EAAE,EAAE;aACvD,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,aAAa,CAAC,gDAAgD,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YACpG,CAAC;YACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAqB,CAAC;QAChD,CAAC;QAED,kFAAkF;QAClF,KAAK,CAAC,WAAW,CAAC,cAAc;YAC9B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE;gBAC7C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,cAAc,EAAE,EAAE;aACvD,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,aAAa,CAAC,kCAAkC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YACtF,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAiC,CAAC;YAChE,OAAO,IAAI,CAAC,IAAI,CAAC;QACnB,CAAC;QAED;;;8FAGsF;QACtF,KAAK,CAAC,cAAc,CAAC,KAAK;YACxB,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,YAAY,EAAE,CAAC;gBACvC,IAAI,CAAC,SAAS,CAAC,mBAAmB;oBAAE,OAAO,KAAK,CAAC;gBACjD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,mBAAmB,EAAE;oBACrD,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE;wBACP,cAAc,EAAE,mCAAmC;wBACnD,aAAa,EAAE,eAAe,EAAE;qBACjC;oBACD,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE;iBAChD,CAAC,CAAC;gBACH,OAAO,GAAG,CAAC,EAAE,CAAC;YAChB,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}
|
package/dist/auth/plugin.js
CHANGED
|
@@ -1,6 +1,7 @@
|
|
|
1
1
|
import { randomUUID } from "node:crypto";
|
|
2
2
|
import fp from "fastify-plugin";
|
|
3
3
|
import fastifyCookie from "@fastify/cookie";
|
|
4
|
+
import { AuthStoreError, IdpAccessRevokedError, classifyIdpError } from "./errors.js";
|
|
4
5
|
import { createOidcClient } from "./oidc-client.js";
|
|
5
6
|
import { generatePkce, randomState } from "./pkce.js";
|
|
6
7
|
import { generateRefreshToken, hashRefreshToken, signAccessToken, verifyAccessToken } from "./tokens.js";
|
|
@@ -57,12 +58,22 @@ const flytedeskAuthPlugin = async (fastify, options) => {
|
|
|
57
58
|
fastify.decorateRequest("authUser", undefined);
|
|
58
59
|
// __Host- requires Secure, no Domain attribute, and Path=/ — so the prefix (and the
|
|
59
60
|
// Path=/ it forces) is only used when options.secureCookies says this is actually an
|
|
60
|
-
// HTTPS deployment. Plain,
|
|
61
|
-
//
|
|
61
|
+
// HTTPS deployment. Plain, scoped cookies are used for local HTTP dev, where __Host-
|
|
62
|
+
// would just make the browser silently refuse to set the cookie.
|
|
62
63
|
const useHostPrefix = options.secureCookies;
|
|
63
64
|
const refreshCookieName = useHostPrefix ? "__Host-fd_refresh" : "fd_refresh";
|
|
64
65
|
const loginCookieName = useHostPrefix ? "__Host-fd_login_attempt" : "fd_login_attempt";
|
|
65
|
-
|
|
66
|
+
// fastify-plugin (fp, below) keeps this plugin's routes in the SAME encapsulation
|
|
67
|
+
// context as whatever it's registered under — so if a consumer nests it inside an
|
|
68
|
+
// outer `{ prefix: "/api/v1" }` context, `fastify.prefix` here is already "/api/v1"
|
|
69
|
+
// and the routes below actually land at `/api/v1${routePrefix}/*`. A cookie's Path
|
|
70
|
+
// scopes which request paths the browser will ever send it back on; computing it from
|
|
71
|
+
// `routePrefix` alone (AK-16) ignored that outer prefix entirely, so a browser at
|
|
72
|
+
// `/api/v1/auth/login` would set a cookie the browser then refuses to send back on
|
|
73
|
+
// `/api/v1/auth/callback` or `/api/v1/auth/refresh` — a real browser enforces Path
|
|
74
|
+
// scoping; Fastify's own `inject()` test helper doesn't, which is why this only
|
|
75
|
+
// surfaced against a real browser (see the nested-prefix test below).
|
|
76
|
+
const cookiePath = useHostPrefix ? "/" : `${fastify.prefix}${routePrefix}`;
|
|
66
77
|
function refreshCookieOptions(maxAgeSeconds) {
|
|
67
78
|
return {
|
|
68
79
|
httpOnly: true,
|
|
@@ -73,35 +84,70 @@ const flytedeskAuthPlugin = async (fastify, options) => {
|
|
|
73
84
|
};
|
|
74
85
|
}
|
|
75
86
|
const authorizationCache = new Map();
|
|
87
|
+
const EXPIRY_SKEW_MS = 5_000;
|
|
88
|
+
/**
|
|
89
|
+
* Returns a live IdP access token for this session — the one already on the row if
|
|
90
|
+
* it's not near expiry, otherwise a freshly refreshed one (persisted back via
|
|
91
|
+
* store.updateIdpSession before returning, since flytedesk-id rotates the refresh
|
|
92
|
+
* token on every use — see ./oidc-client.ts's refreshIdpTokens doc comment). Shared
|
|
93
|
+
* by loadAuthedUser (below) and the GET {routePrefix}/apps route, so the refresh
|
|
94
|
+
* behaviour — and its failure classification — can't drift between the two call
|
|
95
|
+
* sites. Throws IdpAccessRevokedError (nothing left to refresh with, or flytedesk-id
|
|
96
|
+
* rejected the refresh token) or IdpUnavailableError (an outage) — never swallows;
|
|
97
|
+
* every caller is expected to log what it decides to do with the failure (fail
|
|
98
|
+
* loudly, AK-16).
|
|
99
|
+
*/
|
|
100
|
+
async function getLiveIdpAccessToken(session) {
|
|
101
|
+
if (session.idpAccessTokenExpiresAt.getTime() - EXPIRY_SKEW_MS >= Date.now()) {
|
|
102
|
+
return session.idpAccessToken;
|
|
103
|
+
}
|
|
104
|
+
if (!session.idpRefreshToken) {
|
|
105
|
+
throw new IdpAccessRevokedError("No IdP refresh token on this session — re-login required");
|
|
106
|
+
}
|
|
107
|
+
try {
|
|
108
|
+
const refreshed = await oidc.refreshIdpTokens(session.idpRefreshToken);
|
|
109
|
+
await store.updateIdpSession(session.id, {
|
|
110
|
+
idpAccessToken: refreshed.access_token,
|
|
111
|
+
idpAccessTokenExpiresAt: new Date(Date.now() + refreshed.expires_in * 1000),
|
|
112
|
+
idpRefreshToken: refreshed.refresh_token ?? session.idpRefreshToken,
|
|
113
|
+
});
|
|
114
|
+
return refreshed.access_token;
|
|
115
|
+
}
|
|
116
|
+
catch (err) {
|
|
117
|
+
throw classifyIdpError(err);
|
|
118
|
+
}
|
|
119
|
+
}
|
|
76
120
|
/**
|
|
77
121
|
* Live per-request by default: resolves `request.authUser` from the access token's
|
|
78
122
|
* `sid` by looking up the IdpSession, refreshing the IdP token pair if it's near
|
|
79
123
|
* expiry, then calling flytedesk-id's authorization endpoint fresh — see
|
|
80
124
|
* FlytedeskAuthOptions.authorizationCacheTtlMs for the one opt-in exception. Never
|
|
81
|
-
* throws: any failure just means no AuthedUser gets attached
|
|
125
|
+
* throws: any failure just means no AuthedUser gets attached — requireAuth 401s from
|
|
126
|
+
* there. Every failure that is NOT a routine "no session"/"nothing to refresh with"
|
|
127
|
+
* outcome is still logged with context (fail loudly, AK-16), distinguishing a
|
|
128
|
+
* flytedesk-id outage from a genuinely revoked session from an AuthStore failure.
|
|
82
129
|
*/
|
|
83
|
-
async function loadAuthedUser(claims) {
|
|
84
|
-
|
|
130
|
+
async function loadAuthedUser(request, claims) {
|
|
131
|
+
let session;
|
|
132
|
+
try {
|
|
133
|
+
session = await store.findIdpSession(claims.sid);
|
|
134
|
+
}
|
|
135
|
+
catch (err) {
|
|
136
|
+
request.log.error({ err: new AuthStoreError("AuthStore.findIdpSession failed", err), sid: claims.sid }, "@flytedesk/app-kit/auth: AuthStore error looking up IdP session");
|
|
137
|
+
return undefined;
|
|
138
|
+
}
|
|
85
139
|
if (!session || session.subject !== claims.sub)
|
|
140
|
+
return undefined; // no session for this claim — expected, not an error
|
|
141
|
+
let idpAccessToken;
|
|
142
|
+
try {
|
|
143
|
+
idpAccessToken = await getLiveIdpAccessToken(session);
|
|
144
|
+
}
|
|
145
|
+
catch (err) {
|
|
146
|
+
const classified = classifyIdpError(err);
|
|
147
|
+
request.log.error({ err: classified, sid: claims.sid }, classified instanceof IdpAccessRevokedError
|
|
148
|
+
? "@flytedesk/app-kit/auth: flytedesk-id refresh token revoked or expired — forcing re-login"
|
|
149
|
+
: "@flytedesk/app-kit/auth: flytedesk-id token refresh failed — possible IdP outage");
|
|
86
150
|
return undefined;
|
|
87
|
-
let idpAccessToken = session.idpAccessToken;
|
|
88
|
-
const EXPIRY_SKEW_MS = 5_000;
|
|
89
|
-
if (session.idpAccessTokenExpiresAt.getTime() - EXPIRY_SKEW_MS < Date.now()) {
|
|
90
|
-
if (!session.idpRefreshToken)
|
|
91
|
-
return undefined; // nothing left to refresh with — force re-login
|
|
92
|
-
try {
|
|
93
|
-
const refreshed = await oidc.refreshIdpTokens(session.idpRefreshToken);
|
|
94
|
-
idpAccessToken = refreshed.access_token;
|
|
95
|
-
await store.updateIdpSession(session.id, {
|
|
96
|
-
idpAccessToken: refreshed.access_token,
|
|
97
|
-
idpAccessTokenExpiresAt: new Date(Date.now() + refreshed.expires_in * 1000),
|
|
98
|
-
// flytedesk-id rotates refresh tokens on every use — must persist the new one.
|
|
99
|
-
idpRefreshToken: refreshed.refresh_token ?? session.idpRefreshToken,
|
|
100
|
-
});
|
|
101
|
-
}
|
|
102
|
-
catch {
|
|
103
|
-
return undefined; // flytedesk-id refresh token revoked/expired — force re-login
|
|
104
|
-
}
|
|
105
151
|
}
|
|
106
152
|
let authorization;
|
|
107
153
|
if (options.authorizationCacheTtlMs) {
|
|
@@ -113,7 +159,11 @@ const flytedeskAuthPlugin = async (fastify, options) => {
|
|
|
113
159
|
try {
|
|
114
160
|
authorization = await oidc.fetchAuthorization(idpAccessToken, options.appId);
|
|
115
161
|
}
|
|
116
|
-
catch {
|
|
162
|
+
catch (err) {
|
|
163
|
+
const classified = classifyIdpError(err);
|
|
164
|
+
request.log.error({ err: classified, sid: claims.sid }, classified instanceof IdpAccessRevokedError
|
|
165
|
+
? "@flytedesk/app-kit/auth: flytedesk-id revoked this session's authorization"
|
|
166
|
+
: "@flytedesk/app-kit/auth: flytedesk-id authorization lookup failed — possible IdP outage");
|
|
117
167
|
return undefined;
|
|
118
168
|
}
|
|
119
169
|
if (options.authorizationCacheTtlMs) {
|
|
@@ -145,7 +195,7 @@ const flytedeskAuthPlugin = async (fastify, options) => {
|
|
|
145
195
|
return;
|
|
146
196
|
try {
|
|
147
197
|
const claims = await verifyAccessToken(options.accessTokenSecret, header.slice(7));
|
|
148
|
-
const user = await loadAuthedUser(claims);
|
|
198
|
+
const user = await loadAuthedUser(request, claims);
|
|
149
199
|
if (user)
|
|
150
200
|
request.authUser = user;
|
|
151
201
|
}
|
|
@@ -330,6 +380,59 @@ const flytedeskAuthPlugin = async (fastify, options) => {
|
|
|
330
380
|
reply.setCookie(refreshCookieName, next.token, refreshCookieOptions(refreshTokenTtlSeconds));
|
|
331
381
|
return reply.send({ accessToken, accessTokenExpiresAt: accessExpiresAt.toISOString() });
|
|
332
382
|
});
|
|
383
|
+
/**
|
|
384
|
+
* GET {routePrefix}/apps — the "All flytedesk apps" switcher feed (flytedesk-id's
|
|
385
|
+
* `GET /me/apps`, MP-213/MP-209), served by the plugin itself so every consumer gets
|
|
386
|
+
* it for free instead of building a second OIDC client and reading the IdP token
|
|
387
|
+
* straight out of its own AuthStore to call this (the workaround AK-16 replaces —
|
|
388
|
+
* see sms-app's app.ts before this card). Uses the caller's live, auto-refreshed IdP
|
|
389
|
+
* access token via getLiveIdpAccessToken, through this plugin's own encapsulated
|
|
390
|
+
* oidc client — never exposed on request.authUser (AuthedUser deliberately carries
|
|
391
|
+
* no token). Every upstream failure is mapped to a typed, logged error: never an
|
|
392
|
+
* unmapped 500 carrying flytedesk-id's raw response text.
|
|
393
|
+
*/
|
|
394
|
+
fastify.get(`${routePrefix}/apps`, async (request, reply) => {
|
|
395
|
+
if (!request.authUser) {
|
|
396
|
+
return reply.code(401).send({ error: "Authentication required", code: "unauthenticated" });
|
|
397
|
+
}
|
|
398
|
+
let session;
|
|
399
|
+
try {
|
|
400
|
+
session = await store.findIdpSession(request.authUser.sessionId);
|
|
401
|
+
}
|
|
402
|
+
catch (err) {
|
|
403
|
+
request.log.error({ err: new AuthStoreError("AuthStore.findIdpSession failed", err), sessionId: request.authUser.sessionId }, "@flytedesk/app-kit/auth: /apps AuthStore error looking up IdP session");
|
|
404
|
+
return reply.code(502).send({ error: "Could not load the signed-in session", code: "auth_store_failed" });
|
|
405
|
+
}
|
|
406
|
+
if (!session) {
|
|
407
|
+
return reply.code(401).send({ error: "Session not found", code: "unauthenticated" });
|
|
408
|
+
}
|
|
409
|
+
let idpAccessToken;
|
|
410
|
+
try {
|
|
411
|
+
idpAccessToken = await getLiveIdpAccessToken(session);
|
|
412
|
+
}
|
|
413
|
+
catch (err) {
|
|
414
|
+
const classified = classifyIdpError(err);
|
|
415
|
+
request.log.error({ err: classified, sessionId: session.id }, classified instanceof IdpAccessRevokedError
|
|
416
|
+
? "@flytedesk/app-kit/auth: /apps — flytedesk-id refresh token revoked or expired"
|
|
417
|
+
: "@flytedesk/app-kit/auth: /apps — flytedesk-id token refresh failed, possible outage");
|
|
418
|
+
if (classified instanceof IdpAccessRevokedError) {
|
|
419
|
+
return reply.code(401).send({ error: "Sign-in with flytedesk-id has expired", code: "idp_access_revoked" });
|
|
420
|
+
}
|
|
421
|
+
return reply.code(502).send({ error: "flytedesk-id is unavailable", code: "idp_unavailable" });
|
|
422
|
+
}
|
|
423
|
+
try {
|
|
424
|
+
const apps = await oidc.fetchMyApps(idpAccessToken);
|
|
425
|
+
return reply.send({ apps });
|
|
426
|
+
}
|
|
427
|
+
catch (err) {
|
|
428
|
+
const classified = classifyIdpError(err);
|
|
429
|
+
request.log.error({ err: classified, sessionId: session.id }, "@flytedesk/app-kit/auth: /apps — flytedesk-id /me/apps lookup failed");
|
|
430
|
+
if (classified instanceof IdpAccessRevokedError) {
|
|
431
|
+
return reply.code(401).send({ error: "Sign-in with flytedesk-id has expired", code: "idp_access_revoked" });
|
|
432
|
+
}
|
|
433
|
+
return reply.code(502).send({ error: "flytedesk-id is unavailable", code: "idp_unavailable" });
|
|
434
|
+
}
|
|
435
|
+
});
|
|
333
436
|
/**
|
|
334
437
|
* POST {routePrefix}/logout — revokes the whole refresh-token family (not just the
|
|
335
438
|
* presented cookie) and the IdpSession row, then best-effort revokes the IdP-side
|
|
@@ -344,12 +447,30 @@ const flytedeskAuthPlugin = async (fastify, options) => {
|
|
|
344
447
|
const hash = hashRefreshToken(token);
|
|
345
448
|
const stored = await store.findRefreshTokenByHash(hash);
|
|
346
449
|
if (stored) {
|
|
450
|
+
// Revoke the local family FIRST and unconditionally — that's what actually
|
|
451
|
+
// keeps a signed-out browser locked out, independent of anything below.
|
|
347
452
|
await store.revokeFamily(stored.familyId);
|
|
348
453
|
const idpSession = await store.findIdpSession(stored.idpSessionId);
|
|
349
454
|
if (idpSession?.idpRefreshToken) {
|
|
350
|
-
|
|
455
|
+
// revokeIdpToken's own contract (see oidc-client.ts) is never to throw — this
|
|
456
|
+
// is best-effort by design (flytedesk-id currently advertises no
|
|
457
|
+
// revocation_endpoint at all), not a swallowed failure.
|
|
458
|
+
await oidc.revokeIdpToken(idpSession.idpRefreshToken);
|
|
459
|
+
}
|
|
460
|
+
try {
|
|
461
|
+
await store.deleteIdpSession(stored.idpSessionId);
|
|
462
|
+
}
|
|
463
|
+
catch (err) {
|
|
464
|
+
// Fail loudly (AK-16): the family is already revoked above, so the browser is
|
|
465
|
+
// locked out either way — but a store failure here means the IdpSession row
|
|
466
|
+
// (and the IdP tokens it holds) leaked, which is worth surfacing rather than
|
|
467
|
+
// reporting a silent, fully-clean "signed out".
|
|
468
|
+
request.log.error({ err: new AuthStoreError("AuthStore.deleteIdpSession failed", err), idpSessionId: stored.idpSessionId }, "@flytedesk/app-kit/auth: logout failed to delete the IdP session — the refresh token family is revoked either way");
|
|
469
|
+
reply.clearCookie(refreshCookieName, { path: cookiePath });
|
|
470
|
+
return reply
|
|
471
|
+
.code(502)
|
|
472
|
+
.send({ error: "Sign-out did not fully complete", code: "logout_store_failed" });
|
|
351
473
|
}
|
|
352
|
-
await store.deleteIdpSession(stored.idpSessionId).catch(() => undefined);
|
|
353
474
|
}
|
|
354
475
|
}
|
|
355
476
|
reply.clearCookie(refreshCookieName, { path: cookiePath });
|
package/dist/auth/plugin.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../src/auth/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAChC,OAAO,aAA8C,MAAM,iBAAiB,CAAC;AAE7E,OAAO,EAAE,gBAAgB,EAAyB,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAYzG,MAAM,oBAAoB,GAAG,OAAO,CAAC;AACrC,MAAM,gCAAgC,GAAG,GAAG,CAAC;AAC7C,MAAM,iCAAiC,GAAG,SAAS,CAAC;AACpD,MAAM,iCAAiC,GAAG,GAAG,CAAC;AAE9C,MAAM,uBAAuB,GAAG;IAC9B,UAAU;IACV,cAAc;IACd,QAAQ;IACR,aAAa;IACb,OAAO;IACP,mBAAmB;IACnB,mBAAmB;CACyC,CAAC;AAE/D,SAAS,qBAAqB,CAAC,OAA6B;IAC1D,KAAK,MAAM,GAAG,IAAI,uBAAuB,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,qDAAqD,GAAG,GAAG,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IACD,IACE,OAAO,CAAC,YAAY,IAAI,IAAI;QAC5B,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,EAC7G,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,MAAM,mBAAmB,GAA6C,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE;IAC/F,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAE/B,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;IAChE,MAAM,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,IAAI,gCAAgC,CAAC;IAChG,MAAM,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,IAAI,iCAAiC,CAAC;IACnG,MAAM,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,IAAI,iCAAiC,CAAC;IACnG,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAE5B,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,IAAI,CACd,EAAE,uBAAuB,EAAE,OAAO,CAAC,uBAAuB,EAAE,EAC5D,uFAAuF;YACrF,uFAAuF;YACvF,8EAA8E,CACjF,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,gBAAgB,CAAC;QAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC,CAAC;IAEH,MAAM,OAAO,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAExE,OAAO,CAAC,eAAe,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAE/C,oFAAoF;IACpF,qFAAqF;IACrF,mFAAmF;IACnF,+EAA+E;IAC/E,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAC5C,MAAM,iBAAiB,GAAG,aAAa,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,YAAY,CAAC;IAC7E,MAAM,eAAe,GAAG,aAAa,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,kBAAkB,CAAC;IACvF,MAAM,UAAU,GAAG,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC;IAErD,SAAS,oBAAoB,CAAC,aAAqB;QACjD,OAAO;YACL,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,OAAO,CAAC,aAAa;YAC7B,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,aAAa;SACtB,CAAC;IACJ,CAAC;IAED,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAA0D,CAAC;IAE7F;;;;;;OAMG;IACH,KAAK,UAAU,cAAc,CAAC,MAAoC;QAChE,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAEjE,IAAI,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;QAC5C,MAAM,cAAc,GAAG,KAAK,CAAC;QAC7B,IAAI,OAAO,CAAC,uBAAuB,CAAC,OAAO,EAAE,GAAG,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC5E,IAAI,CAAC,OAAO,CAAC,eAAe;gBAAE,OAAO,SAAS,CAAC,CAAC,gDAAgD;YAChG,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;gBACvE,cAAc,GAAG,SAAS,CAAC,YAAY,CAAC;gBACxC,MAAM,KAAK,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,EAAE;oBACvC,cAAc,EAAE,SAAS,CAAC,YAAY;oBACtC,uBAAuB,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,UAAU,GAAG,IAAI,CAAC;oBAC3E,+EAA+E;oBAC/E,eAAe,EAAE,SAAS,CAAC,aAAa,IAAI,OAAO,CAAC,eAAe;iBACpE,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,SAAS,CAAC,CAAC,8DAA8D;YAClF,CAAC;QACH,CAAC;QAED,IAAI,aAA2C,CAAC;QAChD,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAClD,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;gBAAE,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,IAAI,CAAC;gBACH,aAAa,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,cAAc,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YAC/E,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;gBACpC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE;oBACjC,KAAK,EAAE,aAAa;oBACpB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,uBAAuB;iBACxD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,gFAAgF;QAChF,+EAA+E;QAC/E,2DAA2D;QAC3D,MAAM,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,GAAG,CAAC;QACnC,OAAO;YACL,EAAE,EAAE,OAAO,CAAC,OAAO;YACnB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,KAAK,EAAE,aAAa,CAAC,KAAK;YAC1B,WAAW,EAAE,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACvG,CAAC;IACJ,CAAC;IAED,iFAAiF;IACjF,mFAAmF;IACnF,yBAAyB;IACzB,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAC7C,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO;QAC3C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACnF,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,IAAI;gBAAE,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,gFAAgF;QAClF,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,KAAK,UAAU,YAAY,CACzB,OAAuB,EACvB,KAAmB,EACnB,MAAc,EACd,YAAoB,EACpB,QAAgB;QAEhB,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,oBAAoB,EAAE,CAAC;QAC7D,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,sBAAsB,GAAG,IAAI,CAAC,CAAC;QACvE,MAAM,KAAK,CAAC,kBAAkB,CAAC;YAC7B,EAAE,EAAE,UAAU,EAAE;YAChB,QAAQ;YACR,MAAM;YACN,SAAS,EAAE,IAAI;YACf,SAAS;YACT,YAAY;YACZ,SAAS,EAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAwB,IAAI,IAAI;YACxE,EAAE,EAAE,OAAO,CAAC,EAAE;SACf,CAAC,CAAC;QAEH,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,MAAM,eAAe,CAC9E,OAAO,CAAC,iBAAiB,EACzB,qBAAqB,EACrB,MAAM,EACN,YAAY,CACb,CAAC;QACF,KAAK,CAAC,SAAS,CAAC,iBAAiB,EAAE,YAAY,EAAE,oBAAoB,CAAC,sBAAsB,CAAC,CAAC,CAAC;QAC/F,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,eAAe,CAAC,WAAW,EAAE,EAAE,CAAC;IAC9E,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,GAAG,CAAC,GAAG,WAAW,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC3D,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,YAAY,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;QAE5B,KAAK,CAAC,SAAS,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE;YACpE,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,OAAO,CAAC,aAAa;YAC7B,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,sBAAsB;YAC9B,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH;;;;;;OAMG;IACH,OAAO,CAAC,GAAG,CACT,GAAG,WAAW,WAAW,EACzB,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC;QAC7C,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAC7C,KAAK,CAAC,WAAW,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAEzD,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,KAAK;iBACT,IAAI,CAAC,GAAG,CAAC;iBACT,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;YAC5B,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,kDAAkD;gBACzD,IAAI,EAAE,kBAAkB;aACzB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACvC,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,0CAA0C;gBACjD,IAAI,EAAE,sBAAsB;aAC7B,CAAC,CAAC;QACL,CAAC;QAED,IAAI,KAA0C,CAAC;QAC/C,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAwC,CAAC;QAC5E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;QAClF,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;YACtE,yEAAyE;YACzE,yEAAyE;YACzE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC1D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC9D,IAAI,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;gBAChC,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBAC1B,KAAK,EAAE,iDAAiD;oBACxD,IAAI,EAAE,kBAAkB;iBACzB,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;gBAC3B,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBAC1B,KAAK,EAAE,4CAA4C;oBACnD,IAAI,EAAE,oBAAoB;iBAC3B,CAAC,CAAC;YACL,CAAC;YAED,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACrB,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC3C,CAAC;YAED,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;YAC1D,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC;gBAC9C,OAAO,EAAE,OAAO,CAAC,GAAG;gBACpB,IAAI;gBACJ,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,cAAc,EAAE,MAAM,CAAC,YAAY;gBACnC,uBAAuB,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC;gBACxE,eAAe,EAAE,MAAM,CAAC,aAAa,IAAI,IAAI;aAC9C,CAAC,CAAC;YAEH,6EAA6E;YAC7E,gFAAgF;YAChF,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC;YAC9B,MAAM,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YAEzE,OAAO,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,8BAA8B,CAAC,CAAC;YAC3D,OAAO,KAAK;iBACT,IAAI,CAAC,GAAG,CAAC;iBACT,IAAI,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC,CACF,CAAC;IAEF;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,IAAI,CAAC,GAAG,WAAW,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC9D,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACtF,CAAC;QAED,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAClG,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,4BAA4B,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,8EAA8E;YAC9E,8EAA8E;YAC9E,OAAO,CAAC,GAAG,CAAC,IAAI,CACd,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EACpD,+EAA+E,CAChF,CAAC;YACF,MAAM,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC1C,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;QACvG,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YAClC,+EAA+E;YAC/E,uCAAuC;YACvC,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC3F,CAAC;QAED,mFAAmF;QACnF,kFAAkF;QAClF,+EAA+E;QAC/E,YAAY;QACZ,MAAM,IAAI,GAAG,oBAAoB,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,sBAAsB,GAAG,IAAI,CAAC,CAAC;QACvE,MAAM,KAAK,CAAC,kBAAkB,CAAC;YAC7B,EAAE,EAAE,UAAU,EAAE;YAChB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,IAAI,CAAC,IAAI;YACpB,SAAS;YACT,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,SAAS,EAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAwB,IAAI,IAAI;YACxE,EAAE,EAAE,OAAO,CAAC,EAAE;SACf,CAAC,CAAC;QAEH,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,MAAM,eAAe,CAC9E,OAAO,CAAC,iBAAiB,EACzB,qBAAqB,EACrB,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,YAAY,CACpB,CAAC;QACF,KAAK,CAAC,SAAS,CAAC,iBAAiB,EAAE,IAAI,CAAC,KAAK,EAAE,oBAAoB,CAAC,sBAAsB,CAAC,CAAC,CAAC;QAC7F,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,oBAAoB,EAAE,eAAe,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH;;;;;;;OAOG;IACH,OAAO,CAAC,IAAI,CAAC,GAAG,WAAW,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC7D,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACjD,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACrC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;YACxD,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAC1C,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;gBACnE,IAAI,UAAU,EAAE,eAAe,EAAE,CAAC;oBAChC,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAC/E,CAAC;gBACD,MAAM,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC3E,CAAC;QACH,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC,mBAAmB,EAAE;IACnD,IAAI,EAAE,yBAAyB;CAChC,CAAC,CAAC"}
|
|
1
|
+
{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../src/auth/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAChC,OAAO,aAA8C,MAAM,iBAAiB,CAAC;AAE7E,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACtF,OAAO,EAAE,gBAAgB,EAAyB,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAYzG,MAAM,oBAAoB,GAAG,OAAO,CAAC;AACrC,MAAM,gCAAgC,GAAG,GAAG,CAAC;AAC7C,MAAM,iCAAiC,GAAG,SAAS,CAAC;AACpD,MAAM,iCAAiC,GAAG,GAAG,CAAC;AAE9C,MAAM,uBAAuB,GAAG;IAC9B,UAAU;IACV,cAAc;IACd,QAAQ;IACR,aAAa;IACb,OAAO;IACP,mBAAmB;IACnB,mBAAmB;CACyC,CAAC;AAE/D,SAAS,qBAAqB,CAAC,OAA6B;IAC1D,KAAK,MAAM,GAAG,IAAI,uBAAuB,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,qDAAqD,GAAG,GAAG,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IACD,IACE,OAAO,CAAC,YAAY,IAAI,IAAI;QAC5B,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,EAC7G,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,MAAM,mBAAmB,GAA6C,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE;IAC/F,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAE/B,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;IAChE,MAAM,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,IAAI,gCAAgC,CAAC;IAChG,MAAM,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,IAAI,iCAAiC,CAAC;IACnG,MAAM,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,IAAI,iCAAiC,CAAC;IACnG,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAE5B,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,IAAI,CACd,EAAE,uBAAuB,EAAE,OAAO,CAAC,uBAAuB,EAAE,EAC5D,uFAAuF;YACrF,uFAAuF;YACvF,8EAA8E,CACjF,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,gBAAgB,CAAC;QAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC,CAAC;IAEH,MAAM,OAAO,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAExE,OAAO,CAAC,eAAe,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAE/C,oFAAoF;IACpF,qFAAqF;IACrF,qFAAqF;IACrF,iEAAiE;IACjE,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAC5C,MAAM,iBAAiB,GAAG,aAAa,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,YAAY,CAAC;IAC7E,MAAM,eAAe,GAAG,aAAa,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,kBAAkB,CAAC;IACvF,kFAAkF;IAClF,kFAAkF;IAClF,oFAAoF;IACpF,mFAAmF;IACnF,sFAAsF;IACtF,kFAAkF;IAClF,mFAAmF;IACnF,mFAAmF;IACnF,gFAAgF;IAChF,sEAAsE;IACtE,MAAM,UAAU,GAAG,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,WAAW,EAAE,CAAC;IAE3E,SAAS,oBAAoB,CAAC,aAAqB;QACjD,OAAO;YACL,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,OAAO,CAAC,aAAa;YAC7B,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,aAAa;SACtB,CAAC;IACJ,CAAC;IAED,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAA0D,CAAC;IAE7F,MAAM,cAAc,GAAG,KAAK,CAAC;IAE7B;;;;;;;;;;;OAWG;IACH,KAAK,UAAU,qBAAqB,CAAC,OAAsB;QACzD,IAAI,OAAO,CAAC,uBAAuB,CAAC,OAAO,EAAE,GAAG,cAAc,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC7E,OAAO,OAAO,CAAC,cAAc,CAAC;QAChC,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;YAC7B,MAAM,IAAI,qBAAqB,CAAC,0DAA0D,CAAC,CAAC;QAC9F,CAAC;QACD,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YACvE,MAAM,KAAK,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,EAAE;gBACvC,cAAc,EAAE,SAAS,CAAC,YAAY;gBACtC,uBAAuB,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,UAAU,GAAG,IAAI,CAAC;gBAC3E,eAAe,EAAE,SAAS,CAAC,aAAa,IAAI,OAAO,CAAC,eAAe;aACpE,CAAC,CAAC;YACH,OAAO,SAAS,CAAC,YAAY,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,UAAU,cAAc,CAC3B,OAAuB,EACvB,MAAoC;QAEpC,IAAI,OAA6B,CAAC;QAClC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,IAAI,cAAc,CAAC,iCAAiC,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EACpF,iEAAiE,CAClE,CAAC;YACF,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC,CAAC,qDAAqD;QAEvH,IAAI,cAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,cAAc,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EACpC,UAAU,YAAY,qBAAqB;gBACzC,CAAC,CAAC,2FAA2F;gBAC7F,CAAC,CAAC,kFAAkF,CACvF,CAAC;YACF,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,aAA2C,CAAC;QAChD,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAClD,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;gBAAE,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,IAAI,CAAC;gBACH,aAAa,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,cAAc,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YAC/E,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;gBACzC,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EACpC,UAAU,YAAY,qBAAqB;oBACzC,CAAC,CAAC,4EAA4E;oBAC9E,CAAC,CAAC,yFAAyF,CAC9F,CAAC;gBACF,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;gBACpC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE;oBACjC,KAAK,EAAE,aAAa;oBACpB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,uBAAuB;iBACxD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,gFAAgF;QAChF,+EAA+E;QAC/E,2DAA2D;QAC3D,MAAM,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,GAAG,CAAC;QACnC,OAAO;YACL,EAAE,EAAE,OAAO,CAAC,OAAO;YACnB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,KAAK,EAAE,aAAa,CAAC,KAAK;YAC1B,WAAW,EAAE,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACvG,CAAC;IACJ,CAAC;IAED,iFAAiF;IACjF,mFAAmF;IACnF,yBAAyB;IACzB,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAC7C,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO;QAC3C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACnF,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACnD,IAAI,IAAI;gBAAE,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,gFAAgF;QAClF,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,KAAK,UAAU,YAAY,CACzB,OAAuB,EACvB,KAAmB,EACnB,MAAc,EACd,YAAoB,EACpB,QAAgB;QAEhB,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,oBAAoB,EAAE,CAAC;QAC7D,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,sBAAsB,GAAG,IAAI,CAAC,CAAC;QACvE,MAAM,KAAK,CAAC,kBAAkB,CAAC;YAC7B,EAAE,EAAE,UAAU,EAAE;YAChB,QAAQ;YACR,MAAM;YACN,SAAS,EAAE,IAAI;YACf,SAAS;YACT,YAAY;YACZ,SAAS,EAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAwB,IAAI,IAAI;YACxE,EAAE,EAAE,OAAO,CAAC,EAAE;SACf,CAAC,CAAC;QAEH,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,MAAM,eAAe,CAC9E,OAAO,CAAC,iBAAiB,EACzB,qBAAqB,EACrB,MAAM,EACN,YAAY,CACb,CAAC;QACF,KAAK,CAAC,SAAS,CAAC,iBAAiB,EAAE,YAAY,EAAE,oBAAoB,CAAC,sBAAsB,CAAC,CAAC,CAAC;QAC/F,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,eAAe,CAAC,WAAW,EAAE,EAAE,CAAC;IAC9E,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,GAAG,CAAC,GAAG,WAAW,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC3D,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,YAAY,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;QAE5B,KAAK,CAAC,SAAS,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE;YACpE,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,OAAO,CAAC,aAAa;YAC7B,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,sBAAsB;YAC9B,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH;;;;;;OAMG;IACH,OAAO,CAAC,GAAG,CACT,GAAG,WAAW,WAAW,EACzB,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC;QAC7C,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAC7C,KAAK,CAAC,WAAW,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAEzD,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,KAAK;iBACT,IAAI,CAAC,GAAG,CAAC;iBACT,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;YAC5B,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,kDAAkD;gBACzD,IAAI,EAAE,kBAAkB;aACzB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACvC,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,0CAA0C;gBACjD,IAAI,EAAE,sBAAsB;aAC7B,CAAC,CAAC;QACL,CAAC;QAED,IAAI,KAA0C,CAAC;QAC/C,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAwC,CAAC;QAC5E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;QAClF,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;YACtE,yEAAyE;YACzE,yEAAyE;YACzE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC1D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC9D,IAAI,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;gBAChC,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBAC1B,KAAK,EAAE,iDAAiD;oBACxD,IAAI,EAAE,kBAAkB;iBACzB,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;gBAC3B,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBAC1B,KAAK,EAAE,4CAA4C;oBACnD,IAAI,EAAE,oBAAoB;iBAC3B,CAAC,CAAC;YACL,CAAC;YAED,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACrB,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC3C,CAAC;YAED,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;YAC1D,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC;gBAC9C,OAAO,EAAE,OAAO,CAAC,GAAG;gBACpB,IAAI;gBACJ,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,cAAc,EAAE,MAAM,CAAC,YAAY;gBACnC,uBAAuB,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC;gBACxE,eAAe,EAAE,MAAM,CAAC,aAAa,IAAI,IAAI;aAC9C,CAAC,CAAC;YAEH,6EAA6E;YAC7E,gFAAgF;YAChF,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC;YAC9B,MAAM,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YAEzE,OAAO,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,8BAA8B,CAAC,CAAC;YAC3D,OAAO,KAAK;iBACT,IAAI,CAAC,GAAG,CAAC;iBACT,IAAI,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC,CACF,CAAC;IAEF;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,IAAI,CAAC,GAAG,WAAW,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC9D,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACtF,CAAC;QAED,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAClG,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,4BAA4B,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,8EAA8E;YAC9E,8EAA8E;YAC9E,OAAO,CAAC,GAAG,CAAC,IAAI,CACd,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EACpD,+EAA+E,CAChF,CAAC;YACF,MAAM,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC1C,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;QACvG,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YAClC,+EAA+E;YAC/E,uCAAuC;YACvC,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC3F,CAAC;QAED,mFAAmF;QACnF,kFAAkF;QAClF,+EAA+E;QAC/E,YAAY;QACZ,MAAM,IAAI,GAAG,oBAAoB,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,sBAAsB,GAAG,IAAI,CAAC,CAAC;QACvE,MAAM,KAAK,CAAC,kBAAkB,CAAC;YAC7B,EAAE,EAAE,UAAU,EAAE;YAChB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,IAAI,CAAC,IAAI;YACpB,SAAS;YACT,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,SAAS,EAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAwB,IAAI,IAAI;YACxE,EAAE,EAAE,OAAO,CAAC,EAAE;SACf,CAAC,CAAC;QAEH,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,MAAM,eAAe,CAC9E,OAAO,CAAC,iBAAiB,EACzB,qBAAqB,EACrB,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,YAAY,CACpB,CAAC;QACF,KAAK,CAAC,SAAS,CAAC,iBAAiB,EAAE,IAAI,CAAC,KAAK,EAAE,oBAAoB,CAAC,sBAAsB,CAAC,CAAC,CAAC;QAC7F,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,oBAAoB,EAAE,eAAe,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH;;;;;;;;;;OAUG;IACH,OAAO,CAAC,GAAG,CAAC,GAAG,WAAW,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC1D,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC7F,CAAC;QAED,IAAI,OAA6B,CAAC;QAClC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACnE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,IAAI,cAAc,CAAC,iCAAiC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE,EAC1G,uEAAuE,CACxE,CAAC;YACF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sCAAsC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC5G,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACvF,CAAC;QAED,IAAI,cAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,cAAc,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,EAC1C,UAAU,YAAY,qBAAqB;gBACzC,CAAC,CAAC,gFAAgF;gBAClF,CAAC,CAAC,qFAAqF,CAC1F,CAAC;YACF,IAAI,UAAU,YAAY,qBAAqB,EAAE,CAAC;gBAChD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uCAAuC,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAC9G,CAAC;YACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACjG,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;YACpD,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,EAC1C,sEAAsE,CACvE,CAAC;YACF,IAAI,UAAU,YAAY,qBAAqB,EAAE,CAAC;gBAChD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uCAAuC,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAC9G,CAAC;YACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACjG,CAAC;IACH,CAAC,CAAC,CAAC;IAEH;;;;;;;OAOG;IACH,OAAO,CAAC,IAAI,CAAC,GAAG,WAAW,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC7D,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACjD,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACrC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;YACxD,IAAI,MAAM,EAAE,CAAC;gBACX,2EAA2E;gBAC3E,wEAAwE;gBACxE,MAAM,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAC1C,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;gBACnE,IAAI,UAAU,EAAE,eAAe,EAAE,CAAC;oBAChC,8EAA8E;oBAC9E,iEAAiE;oBACjE,wDAAwD;oBACxD,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;gBACxD,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;gBACpD,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,8EAA8E;oBAC9E,4EAA4E;oBAC5E,6EAA6E;oBAC7E,gDAAgD;oBAChD,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,IAAI,cAAc,CAAC,mCAAmC,EAAE,GAAG,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,EACxG,mHAAmH,CACpH,CAAC;oBACF,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;oBAC3D,OAAO,KAAK;yBACT,IAAI,CAAC,GAAG,CAAC;yBACT,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;gBACrF,CAAC;YACH,CAAC;QACH,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC,mBAAmB,EAAE;IACnD,IAAI,EAAE,yBAAyB;CAChC,CAAC,CAAC"}
|
|
@@ -0,0 +1,49 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Pure data shapes shared between the Node-only server surface (./types.ts,
|
|
3
|
+
* ./oidc-client.ts) and the browser-safe client (./client/*). This file MUST stay free
|
|
4
|
+
* of Node built-ins, Fastify, jose, or any other runtime import — it exists precisely so
|
|
5
|
+
* a browser bundle can import these types (and, post-erasure, nothing else) without
|
|
6
|
+
* pulling a single byte of server-only code across the boundary. If a type here ever
|
|
7
|
+
* needs a helper function, that function belongs in a Node-only or browser-only module,
|
|
8
|
+
* never here.
|
|
9
|
+
*/
|
|
10
|
+
export interface IdpRole {
|
|
11
|
+
id: string;
|
|
12
|
+
key: string;
|
|
13
|
+
name: string;
|
|
14
|
+
}
|
|
15
|
+
/** The shape of `request.authUser` (server) / `GET {api}/me`'s `user` (browser) —
|
|
16
|
+
* one definition, so a consuming app's browser code never hand-declares a copy that
|
|
17
|
+
* can drift from what the server plugin actually attaches (see AK-16 AC 2247: SMS-5's
|
|
18
|
+
* useAuthSession.ts redeclared this by hand before this type existed). */
|
|
19
|
+
export interface AuthedUserDto {
|
|
20
|
+
id: string;
|
|
21
|
+
email: string;
|
|
22
|
+
name: string;
|
|
23
|
+
roles: IdpRole[];
|
|
24
|
+
/** Already stripped of the `${appId}:` prefix flytedesk-id's catalog uses — see
|
|
25
|
+
* ./plugin.ts's loadAuthedUser. */
|
|
26
|
+
permissions: string[];
|
|
27
|
+
sessionId: string;
|
|
28
|
+
}
|
|
29
|
+
/**
|
|
30
|
+
* One entry from `GET {issuer}/me/apps` — an app the caller holds any role in. Shaped to
|
|
31
|
+
* drop straight into `@flytedan/flytebot-design-system`'s `AppEntry` ("All flytedesk
|
|
32
|
+
* apps" switcher, MP-209): `icon` is that same convention's bare Phosphor icon-library
|
|
33
|
+
* key (e.g. "chart-bar"), not a URL, and either field is `null` for an app flytedesk-id
|
|
34
|
+
* hasn't been seeded with one for yet.
|
|
35
|
+
*/
|
|
36
|
+
export interface AppSwitcherEntry {
|
|
37
|
+
key: string;
|
|
38
|
+
name: string;
|
|
39
|
+
url: string | null;
|
|
40
|
+
icon: string | null;
|
|
41
|
+
}
|
|
42
|
+
/** The standard `{error, code, field?}` error body every @flytedesk/app-kit/auth route
|
|
43
|
+
* (server) sends on failure, and every consumer's error handling (browser) should
|
|
44
|
+
* branch on. */
|
|
45
|
+
export interface ApiErrorBody {
|
|
46
|
+
error: string;
|
|
47
|
+
code: string;
|
|
48
|
+
field?: string;
|
|
49
|
+
}
|
|
@@ -0,0 +1,11 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Pure data shapes shared between the Node-only server surface (./types.ts,
|
|
3
|
+
* ./oidc-client.ts) and the browser-safe client (./client/*). This file MUST stay free
|
|
4
|
+
* of Node built-ins, Fastify, jose, or any other runtime import — it exists precisely so
|
|
5
|
+
* a browser bundle can import these types (and, post-erasure, nothing else) without
|
|
6
|
+
* pulling a single byte of server-only code across the boundary. If a type here ever
|
|
7
|
+
* needs a helper function, that function belongs in a Node-only or browser-only module,
|
|
8
|
+
* never here.
|
|
9
|
+
*/
|
|
10
|
+
export {};
|
|
11
|
+
//# sourceMappingURL=shared-types.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"shared-types.js","sourceRoot":"","sources":["../../src/auth/shared-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG"}
|
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import type {
|
|
1
|
+
import type { AppSwitcherEntry } from "../oidc-client.js";
|
|
2
2
|
/**
|
|
3
3
|
* A fake flytedesk-id (OIDC provider) for e2e/integration harnesses, generalized out of
|
|
4
4
|
* media-planner's `apps/web/e2e/fake-idp.ts` (AK-10 follow-up, R-2/R-10) so every
|
|
@@ -32,7 +32,7 @@ export interface FakeIdpIdentity {
|
|
|
32
32
|
permissions: string[];
|
|
33
33
|
/** Fed to `/me/apps` for `fetchMyApps`/the design system's "All flytedesk apps"
|
|
34
34
|
* switcher. Defaults to an empty list. */
|
|
35
|
-
apps?:
|
|
35
|
+
apps?: AppSwitcherEntry[];
|
|
36
36
|
}
|
|
37
37
|
export interface FakeIdpOptions {
|
|
38
38
|
clientId: string;
|
|
@@ -44,6 +44,10 @@ export interface FakeIdpOptions {
|
|
|
44
44
|
/** Which key in `identities` `/auth` grants until `setNextIdentity`/`/__set-identity`
|
|
45
45
|
* says otherwise. */
|
|
46
46
|
defaultIdentityKey: string;
|
|
47
|
+
/** `expires_in` reported on every access/refresh token response. Default 900 (15
|
|
48
|
+
* minutes, matching real flytedesk-id's default) — lets a consumer's test drive a
|
|
49
|
+
* real expiry-then-refresh cycle on its own clock instead of waiting on a real one. */
|
|
50
|
+
accessTokenTtlSeconds?: number;
|
|
47
51
|
}
|
|
48
52
|
export declare class FakeIdp {
|
|
49
53
|
private server?;
|
|
@@ -53,6 +57,8 @@ export declare class FakeIdp {
|
|
|
53
57
|
private readonly identities;
|
|
54
58
|
private nextIdentityKey;
|
|
55
59
|
private idpSessionLive;
|
|
60
|
+
private readonly accessTokenTtlSeconds;
|
|
61
|
+
private forceRefreshFailure;
|
|
56
62
|
private keys;
|
|
57
63
|
private publicJwk;
|
|
58
64
|
private readonly kid;
|
|
@@ -63,6 +69,22 @@ export declare class FakeIdp {
|
|
|
63
69
|
setNextIdentity(key: string): void;
|
|
64
70
|
/** See `idpSessionLive`'s doc comment. */
|
|
65
71
|
setIdpSessionLive(live: boolean): void;
|
|
72
|
+
/** Forces every subsequent `grant_type=refresh_token` call to fail with
|
|
73
|
+
* `invalid_grant`, exactly as real flytedesk-id would for a revoked/expired refresh
|
|
74
|
+
* token — lets a consumer's test exercise its refresh-failure handling (AK-16;
|
|
75
|
+
* `@flytedesk/app-kit/auth`'s `loadAuthedUser`/`getLiveIdpAccessToken` force
|
|
76
|
+
* re-login on this) without waiting on a real expiry or needing a separate
|
|
77
|
+
* `/revoke` call. */
|
|
78
|
+
setForceRefreshFailure(force: boolean): void;
|
|
79
|
+
/**
|
|
80
|
+
* Mutates a registered identity's roles/permissions/apps IN PLACE. Every live grant
|
|
81
|
+
* already holds a reference to this identity object (this fixture keeps identities by
|
|
82
|
+
* reference, never a copy — see the file doc comment), so the change is visible on
|
|
83
|
+
* that identity's very next request, with NO new login required. Lets a consumer's
|
|
84
|
+
* test simulate flytedesk-id revoking a role or changing an app's catalog entry mid-
|
|
85
|
+
* session (AK-16), which the plain "log in as a different identity" flow can't do.
|
|
86
|
+
*/
|
|
87
|
+
updateIdentity(key: string, patch: Partial<Omit<FakeIdpIdentity, "sub">>): void;
|
|
66
88
|
get url(): string;
|
|
67
89
|
start(port?: number): Promise<string>;
|
|
68
90
|
stop(): Promise<void>;
|