@forestadmin/agent-bff 1.0.0 → 1.2.0

package/dist/oauth/oauth-routes.js

@@ -0,0 +1,352 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.default = createOAuthRoutes;
+const crypto_1 = __importDefault(require("crypto"));
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+const bff_token_1 = require("./bff-token");
+const forest_server_client_1 = require("./forest-server-client");
+const oauth_error_1 = require("./oauth-error");
+const session_lifecycle_1 = __importDefault(require("./session-lifecycle"));
+function hashPresentedToken(token) {
+    return crypto_1.default.createHash('sha256').update(token).digest('base64url');
+}
+const CODE_VERIFIER_PATTERN = /^[A-Za-z0-9\-._~]{43,128}$/;
+const S256_CODE_CHALLENGE_PATTERN = /^[A-Za-z0-9_-]{43}$/;
+const SAFE_EXCHANGE_ERRORS = new Set([
+    'invalid_request',
+    'invalid_client',
+    'invalid_grant',
+    'unauthorized_client',
+    'unsupported_grant_type',
+    'invalid_scope',
+]);
+function getQueryParam(ctx, key) {
+    const value = ctx.query[key];
+    if (Array.isArray(value)) {
+        throw (0, oauth_error_1.invalidRequest)(`Parameter must appear at most once: ${key}`);
+    }
+    return value;
+}
+function requireBodyString(body, key) {
+    const value = body[key];
+    if (typeof value !== 'string' || value === '') {
+        throw (0, oauth_error_1.invalidRequest)(`Missing required parameter: ${key}`);
+    }
+    return value;
+}
+function assertValidCodeVerifier(codeVerifier) {
+    if (!CODE_VERIFIER_PATTERN.test(codeVerifier)) {
+        throw (0, oauth_error_1.invalidRequest)('code_verifier is malformed');
+    }
+}
+function assertRegisteredRedirectUri(redirectUris, redirectUri, onMismatch) {
+    if (!Array.isArray(redirectUris) || redirectUris.length === 0) {
+        throw (0, oauth_error_1.invalidRequest)('Client has no registered redirect_uri');
+    }
+    if (!redirectUris.includes(redirectUri)) {
+        throw onMismatch('redirect_uri does not match the registered client');
+    }
+}
+function toSafeExchangeError(saasError) {
+    if (SAFE_EXCHANGE_ERRORS.has(saasError)) {
+        return new oauth_error_1.OAuthRequestError(400, saasError, 'Authorization code exchange failed');
+    }
+    return new oauth_error_1.OAuthRequestError(502, 'server_error', 'Forest server rejected the authorization code');
+}
+function mapIdentityError(error) {
+    const name = error instanceof Error ? error.name : '';
+    if (name === 'ForbiddenError') {
+        return (0, oauth_error_1.forestIdentityNotAllowed)('Caller is not an active user for this rendering');
+    }
+    return new oauth_error_1.OAuthRequestError(502, 'identity_resolution_failed', 'Failed to resolve identity');
+}
+function redirectAuthorizeError(ctx, redirectUri, state, error) {
+    const target = new URL(redirectUri);
+    target.searchParams.set('error', error.type);
+    target.searchParams.set('error_description', error.message);
+    if (state !== undefined && state !== '')
+        target.searchParams.set('state', state);
+    ctx.redirect(target.toString());
+}
+async function handleAuthorize(ctx, options) {
+    // Validate client_id and redirect_uri first: until redirect_uri is confirmed
+    // against the registered client, errors must not redirect (RFC 6749 §10.15).
+    const clientId = getQueryParam(ctx, 'client_id');
+    if (clientId === undefined || clientId === '') {
+        throw (0, oauth_error_1.invalidRequest)('Missing required parameter: client_id');
+    }
+    const redirectUri = getQueryParam(ctx, 'redirect_uri');
+    if (redirectUri === undefined || redirectUri === '') {
+        throw (0, oauth_error_1.invalidRequest)('Missing required parameter: redirect_uri');
+    }
+    const client = await options.serverClient.getRegisteredClient(clientId);
+    if (!client) {
+        throw (0, oauth_error_1.invalidRequest)('Unknown client_id');
+    }
+    assertRegisteredRedirectUri(client.redirect_uris, redirectUri, oauth_error_1.invalidRequest);
+    // redirect_uri is now trusted: remaining validation errors redirect back to
+    // the client with error + state (RFC 6749 §4.1.2.1).
+    let state;
+    try {
+        state = getQueryParam(ctx, 'state');
+        const responseType = getQueryParam(ctx, 'response_type');
+        if (responseType !== 'code') {
+            throw (0, oauth_error_1.invalidRequest)('response_type must be "code"');
+        }
+        if (getQueryParam(ctx, 'code_challenge_method') !== 'S256') {
+            throw (0, oauth_error_1.invalidRequest)('code_challenge_method must be S256');
+        }
+        const codeChallenge = getQueryParam(ctx, 'code_challenge');
+        if (codeChallenge === undefined || !S256_CODE_CHALLENGE_PATTERN.test(codeChallenge)) {
+            throw (0, oauth_error_1.invalidRequest)('code_challenge is missing or malformed');
+        }
+        if (state === undefined || state === '') {
+            throw (0, oauth_error_1.invalidRequest)('Missing required parameter: state');
+        }
+        const appBase = new URL(options.forestAppUrl);
+        const authorizeUrl = new URL(`${appBase.pathname.replace(/\/$/, '')}/oauth/authorize`, appBase);
+        authorizeUrl.searchParams.set('client_id', clientId);
+        authorizeUrl.searchParams.set('redirect_uri', redirectUri);
+        authorizeUrl.searchParams.set('response_type', 'code');
+        authorizeUrl.searchParams.set('code_challenge', codeChallenge);
+        authorizeUrl.searchParams.set('code_challenge_method', 'S256');
+        authorizeUrl.searchParams.set('state', state);
+        authorizeUrl.searchParams.set('environmentId', String(options.environmentId));
+        ctx.redirect(authorizeUrl.toString());
+    }
+    catch (error) {
+        if (error instanceof oauth_error_1.OAuthRequestError) {
+            redirectAuthorizeError(ctx, redirectUri, state, error);
+            return;
+        }
+        throw error;
+    }
+}
+function computeExpiresIn(serverTokens) {
+    const saasRemaining = serverTokens.expiresAt - Math.floor(Date.now() / 1000);
+    if (saasRemaining <= 0) {
+        throw (0, oauth_error_1.invalidGrant)('The Forest server access token is already expired');
+    }
+    return Math.min(bff_token_1.BFF_ACCESS_TOKEN_MAX_EXPIRES_IN, saasRemaining);
+}
+function parseBody(ctx) {
+    const { body } = ctx.request;
+    if (typeof body !== 'object' || body === null) {
+        throw (0, oauth_error_1.invalidRequest)('Missing request body');
+    }
+    return body;
+}
+async function parseTokenRequest(ctx, options) {
+    const params = parseBody(ctx);
+    const request = {
+        code: requireBodyString(params, 'code'),
+        clientId: requireBodyString(params, 'client_id'),
+        codeVerifier: requireBodyString(params, 'code_verifier'),
+        redirectUri: requireBodyString(params, 'redirect_uri'),
+    };
+    assertValidCodeVerifier(request.codeVerifier);
+    const client = await options.serverClient.getRegisteredClient(request.clientId);
+    if (!client) {
+        throw (0, oauth_error_1.invalidClient)('Unknown client_id');
+    }
+    assertRegisteredRedirectUri(client.redirect_uris, request.redirectUri, oauth_error_1.invalidGrant);
+    return request;
+}
+async function exchangeForServerTokens(request, options) {
+    try {
+        return await options.serverClient.exchangeCode(request);
+    }
+    catch (error) {
+        if (error instanceof forest_server_client_1.OAuthExchangeError) {
+            options.logger('Warn', 'Forest server code exchange rejected', { saasError: error.error });
+            throw toSafeExchangeError(error.error);
+        }
+        throw error;
+    }
+}
+function isRetriableExchangeError(error) {
+    return !(error instanceof oauth_error_1.OAuthRequestError) || error.status >= 500;
+}
+async function resolveIdentity(renderingId, saasAccessToken, options) {
+    try {
+        return await options.serverClient.getUserInfo(renderingId, saasAccessToken);
+    }
+    catch (error) {
+        options.logger('Warn', 'Failed to resolve user info after exchange', { renderingId });
+        throw mapIdentityError(error);
+    }
+}
+function writeTokenResponse(ctx, accessToken, expiresInSeconds, refreshToken) {
+    ctx.set('Cache-Control', 'no-store');
+    ctx.set('Pragma', 'no-cache');
+    ctx.status = 200;
+    ctx.body = {
+        access_token: accessToken,
+        token_type: 'Bearer',
+        expires_in: expiresInSeconds,
+        refresh_token: refreshToken,
+    };
+}
+async function handleAuthorizationCodeGrant(ctx, options) {
+    const request = await parseTokenRequest(ctx, options);
+    if (!options.sessionStore.claimAuthorizationCode(request.code)) {
+        throw (0, oauth_error_1.invalidGrant)('Authorization code has already been used');
+    }
+    let serverTokens;
+    try {
+        serverTokens = await exchangeForServerTokens(request, options);
+    }
+    catch (error) {
+        if (isRetriableExchangeError(error)) {
+            options.sessionStore.releaseAuthorizationCode(request.code);
+        }
+        throw error;
+    }
+    const expiresInSeconds = computeExpiresIn(serverTokens);
+    const user = await resolveIdentity(serverTokens.renderingId, serverTokens.saasAccessToken, options);
+    const { sid, refreshToken } = options.sessionStore.create({
+        saasAccessToken: serverTokens.saasAccessToken,
+        saasRefreshToken: serverTokens.saasRefreshToken,
+        renderingId: serverTokens.renderingId,
+        userId: user.id,
+    });
+    const accessToken = (0, bff_token_1.issueBffAccessToken)({
+        sid,
+        user,
+        renderingId: serverTokens.renderingId,
+        authSecret: options.authSecret,
+        expiresInSeconds,
+    });
+    options.logger('Info', 'Issued BFF session token', {
+        renderingId: serverTokens.renderingId,
+        userId: user.id,
+    });
+    writeTokenResponse(ctx, accessToken, expiresInSeconds, refreshToken);
+}
+function expiresInFromAccessToken(saasAccessToken) {
+    const decoded = jsonwebtoken_1.default.decode(saasAccessToken);
+    if (typeof decoded?.exp !== 'number' || !Number.isFinite(decoded.exp)) {
+        return bff_token_1.BFF_ACCESS_TOKEN_MAX_EXPIRES_IN;
+    }
+    const saasRemaining = decoded.exp - Math.floor(Date.now() / 1000);
+    if (saasRemaining <= 0) {
+        throw (0, oauth_error_1.sessionExpired)('The Forest server access token is already expired');
+    }
+    return Math.min(bff_token_1.BFF_ACCESS_TOKEN_MAX_EXPIRES_IN, saasRemaining);
+}
+async function issueAccessForSession(sid, renderingId, refreshToken, options) {
+    const saasAccessToken = await (0, session_lifecycle_1.default)({
+        sid,
+        store: options.sessionStore,
+        serverClient: options.serverClient,
+    });
+    const expiresInSeconds = expiresInFromAccessToken(saasAccessToken);
+    const user = await resolveIdentity(renderingId, saasAccessToken, options);
+    const accessToken = (0, bff_token_1.issueBffAccessToken)({
+        sid,
+        user,
+        renderingId,
+        authSecret: options.authSecret,
+        expiresInSeconds,
+    });
+    return { sid, accessToken, expiresInSeconds, newRefreshToken: refreshToken };
+}
+async function reissueThenCommitRotation(presentedToken, sid, renderingId, newRefreshToken, options) {
+    const result = await issueAccessForSession(sid, renderingId, newRefreshToken, options);
+    if (!options.sessionStore.commitRotation(presentedToken, newRefreshToken)) {
+        throw (0, oauth_error_1.sessionExpired)('Session expired during refresh');
+    }
+    return result;
+}
+async function handleRefreshGrant(ctx, options) {
+    const params = parseBody(ctx);
+    const presentedToken = requireBodyString(params, 'refresh_token');
+    const presentedHash = hashPresentedToken(presentedToken);
+    const inFlight = options.inFlightRefreshByPresentedHash;
+    let pending = inFlight.get(presentedHash);
+    if (!pending) {
+        const rotation = options.sessionStore.prepareRotation(presentedToken);
+        if (rotation.outcome === 'reuse') {
+            options.sessionStore.destroy(rotation.sid);
+            options.logger('Warn', 'Rotated-out refresh token replayed; session invalidated', {
+                sid: rotation.sid,
+            });
+            throw (0, oauth_error_1.sessionInvalidated)('Refresh token was already used; the session is invalidated');
+        }
+        if (rotation.outcome === 'unknown') {
+            throw (0, oauth_error_1.invalidGrant)('Unknown or malformed refresh token');
+        }
+        if (rotation.outcome === 'replay') {
+            options.logger('Info', 'Replayed the last issued pair for a benign retry', {
+                sid: rotation.sid,
+            });
+            pending = issueAccessForSession(rotation.sid, rotation.renderingId, rotation.lastIssuedRefreshToken, options).finally(() => {
+                inFlight.delete(presentedHash);
+            });
+        }
+        else {
+            pending = reissueThenCommitRotation(presentedToken, rotation.sid, rotation.renderingId, rotation.newRefreshToken, options).finally(() => {
+                inFlight.delete(presentedHash);
+            });
+        }
+        inFlight.set(presentedHash, pending);
+    }
+    const result = await pending;
+    options.logger('Info', 'Refreshed BFF session token', { sid: result.sid });
+    writeTokenResponse(ctx, result.accessToken, result.expiresInSeconds, result.newRefreshToken);
+}
+async function handleToken(ctx, options) {
+    const params = parseBody(ctx);
+    if (params.grant_type === 'refresh_token') {
+        await handleRefreshGrant(ctx, options);
+        return;
+    }
+    if (params.grant_type === 'authorization_code') {
+        await handleAuthorizationCodeGrant(ctx, options);
+        return;
+    }
+    throw (0, oauth_error_1.unsupportedGrantType)('Only authorization_code and refresh_token are supported');
+}
+function matchRoute(ctx) {
+    if (ctx.method === 'GET' && ctx.path === '/oauth/authorize')
+        return handleAuthorize;
+    if (ctx.method === 'POST' && ctx.path === '/oauth/token')
+        return handleToken;
+    return undefined;
+}
+function writeError(ctx, error, options) {
+    if (error instanceof oauth_error_1.OAuthRequestError) {
+        ctx.status = error.status;
+        ctx.body = (0, oauth_error_1.toErrorBody)(error);
+        return;
+    }
+    options.logger('Error', 'OAuth route failure', {
+        path: ctx.path,
+        cause: error instanceof Error ? `${error.name}: ${error.message}` : String(error),
+    });
+    ctx.status = 500;
+    ctx.body = { error: 'server_error', error_description: 'OAuth processing failed' };
+}
+function createOAuthRoutes(options) {
+    const runtimeOptions = {
+        ...options,
+        inFlightRefreshByPresentedHash: new Map(),
+    };
+    return async function oauthRoutes(ctx, next) {
+        const handler = matchRoute(ctx);
+        if (!handler) {
+            await next();
+            return;
+        }
+        try {
+            await handler(ctx, runtimeOptions);
+        }
+        catch (error) {
+            writeError(ctx, error, runtimeOptions);
+        }
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoib2F1dGgtcm91dGVzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL29hdXRoL29hdXRoLXJvdXRlcy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7OztBQXFnQkEsb0NBcUJDO0FBbmhCRCxvREFBNEI7QUFDNUIsZ0VBQXdDO0FBRXhDLDJDQUFtRjtBQUNuRixpRUFBNEQ7QUFDNUQsK0NBVXVCO0FBQ3ZCLDRFQUEwRDtBQUUxRCxTQUFTLGtCQUFrQixDQUFDLEtBQWE7SUFDdkMsT0FBTyxnQkFBTSxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxDQUFDO0FBQ3ZFLENBQUM7QUFXRCxNQUFNLHFCQUFxQixHQUFHLDRCQUE0QixDQUFDO0FBQzNELE1BQU0sMkJBQTJCLEdBQUcscUJBQXFCLENBQUM7QUFFMUQsTUFBTSxvQkFBb0IsR0FBRyxJQUFJLEdBQUcsQ0FBQztJQUNuQyxpQkFBaUI7SUFDakIsZ0JBQWdCO0lBQ2hCLGVBQWU7SUFDZixxQkFBcUI7SUFDckIsd0JBQXdCO0lBQ3hCLGVBQWU7Q0FDaEIsQ0FBQyxDQUFDO0FBRUgsU0FBUyxhQUFhLENBQUMsR0FBWSxFQUFFLEdBQVc7SUFDOUMsTUFBTSxLQUFLLEdBQUcsR0FBRyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUU3QixJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztRQUN6QixNQUFNLElBQUEsNEJBQWMsRUFBQyx1Q0FBdUMsR0FBRyxFQUFFLENBQUMsQ0FBQztJQUNyRSxDQUFDO0lBRUQsT0FBTyxLQUFLLENBQUM7QUFDZixDQUFDO0FBRUQsU0FBUyxpQkFBaUIsQ0FBQyxJQUE2QixFQUFFLEdBQVc7SUFDbkUsTUFBTSxLQUFLLEdBQUcsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBRXhCLElBQUksT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLEtBQUssS0FBSyxFQUFFLEVBQUUsQ0FBQztRQUM5QyxNQUFNLElBQUEsNEJBQWMsRUFBQywrQkFBK0IsR0FBRyxFQUFFLENBQUMsQ0FBQztJQUM3RCxDQUFDO0lBRUQsT0FBTyxLQUFLLENBQUM7QUFDZixDQUFDO0FBRUQsU0FBUyx1QkFBdUIsQ0FBQyxZQUFvQjtJQUNuRCxJQUFJLENBQUMscUJBQXFCLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxFQUFFLENBQUM7UUFDOUMsTUFBTSxJQUFBLDRCQUFjLEVBQUMsNEJBQTRCLENBQUMsQ0FBQztJQUNyRCxDQUFDO0FBQ0gsQ0FBQztBQUVELFNBQVMsMkJBQTJCLENBQ2xDLFlBQWtDLEVBQ2xDLFdBQW1CLEVBQ25CLFVBQWtEO0lBRWxELElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFlBQVksQ0FBQyxJQUFJLFlBQVksQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDOUQsTUFBTSxJQUFBLDRCQUFjLEVBQUMsdUNBQXVDLENBQUMsQ0FBQztJQUNoRSxDQUFDO0lBRUQsSUFBSSxDQUFDLFlBQVksQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQztRQUN4QyxNQUFNLFVBQVUsQ0FBQyxtREFBbUQsQ0FBQyxDQUFDO0lBQ3hFLENBQUM7QUFDSCxDQUFDO0FBRUQsU0FBUyxtQkFBbUIsQ0FBQyxTQUFpQjtJQUM1QyxJQUFJLG9CQUFvQixDQUFDLEdBQUcsQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO1FBQ3hDLE9BQU8sSUFBSSwrQkFBaUIsQ0FBQyxHQUFHLEVBQUUsU0FBUyxFQUFFLG9DQUFvQyxDQUFDLENBQUM7SUFDckYsQ0FBQztJQUVELE9BQU8sSUFBSSwrQkFBaUIsQ0FDMUIsR0FBRyxFQUNILGNBQWMsRUFDZCwrQ0FBK0MsQ0FDaEQsQ0FBQztBQUNKLENBQUM7QUFFRCxTQUFTLGdCQUFnQixDQUFDLEtBQWM7SUFDdEMsTUFBTSxJQUFJLEdBQUcsS0FBSyxZQUFZLEtBQUssQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO0lBRXRELElBQUksSUFBSSxLQUFLLGdCQUFnQixFQUFFLENBQUM7UUFDOUIsT0FBTyxJQUFBLHNDQUF3QixFQUFDLGlEQUFpRCxDQUFDLENBQUM7SUFDckYsQ0FBQztJQUVELE9BQU8sSUFBSSwrQkFBaUIsQ0FBQyxHQUFHLEVBQUUsNEJBQTRCLEVBQUUsNEJBQTRCLENBQUMsQ0FBQztBQUNoRyxDQUFDO0FBRUQsU0FBUyxzQkFBc0IsQ0FDN0IsR0FBWSxFQUNaLFdBQW1CLEVBQ25CLEtBQXlCLEVBQ3pCLEtBQXdCO0lBRXhCLE1BQU0sTUFBTSxHQUFHLElBQUksR0FBRyxDQUFDLFdBQVcsQ0FBQyxDQUFDO0lBQ3BDLE1BQU0sQ0FBQyxZQUFZLENBQUMsR0FBRyxDQUFDLE9BQU8sRUFBRSxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUM7SUFDN0MsTUFBTSxDQUFDLFlBQVksQ0FBQyxHQUFHLENBQUMsbUJBQW1CLEVBQUUsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQzVELElBQUksS0FBSyxLQUFLLFNBQVMsSUFBSSxLQUFLLEtBQUssRUFBRTtRQUFFLE1BQU0sQ0FBQyxZQUFZLENBQUMsR0FBRyxDQUFDLE9BQU8sRUFBRSxLQUFLLENBQUMsQ0FBQztJQUVqRixHQUFHLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxRQUFRLEVBQUUsQ0FBQyxDQUFDO0FBQ2xDLENBQUM7QUFFRCxLQUFLLFVBQVUsZUFBZSxDQUFDLEdBQVksRUFBRSxPQUEyQjtJQUN0RSw2RUFBNkU7SUFDN0UsNkVBQTZFO0lBQzdFLE1BQU0sUUFBUSxHQUFHLGFBQWEsQ0FBQyxHQUFHLEVBQUUsV0FBVyxDQUFDLENBQUM7SUFFakQsSUFBSSxRQUFRLEtBQUssU0FBUyxJQUFJLFFBQVEsS0FBSyxFQUFFLEVBQUUsQ0FBQztRQUM5QyxNQUFNLElBQUEsNEJBQWMsRUFBQyx1Q0FBdUMsQ0FBQyxDQUFDO0lBQ2hFLENBQUM7SUFFRCxNQUFNLFdBQVcsR0FBRyxhQUFhLENBQUMsR0FBRyxFQUFFLGNBQWMsQ0FBQyxDQUFDO0lBRXZELElBQUksV0FBVyxLQUFLLFNBQVMsSUFBSSxXQUFXLEtBQUssRUFBRSxFQUFFLENBQUM7UUFDcEQsTUFBTSxJQUFBLDRCQUFjLEVBQUMsMENBQTBDLENBQUMsQ0FBQztJQUNuRSxDQUFDO0lBRUQsTUFBTSxNQUFNLEdBQUcsTUFBTSxPQUFPLENBQUMsWUFBWSxDQUFDLG1CQUFtQixDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBRXhFLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQztRQUNaLE1BQU0sSUFBQSw0QkFBYyxFQUFDLG1CQUFtQixDQUFDLENBQUM7SUFDNUMsQ0FBQztJQUVELDJCQUEyQixDQUFDLE1BQU0sQ0FBQyxhQUFhLEVBQUUsV0FBVyxFQUFFLDRCQUFjLENBQUMsQ0FBQztJQUUvRSw0RUFBNEU7SUFDNUUscURBQXFEO0lBQ3JELElBQUksS0FBeUIsQ0FBQztJQUU5QixJQUFJLENBQUM7UUFDSCxLQUFLLEdBQUcsYUFBYSxDQUFDLEdBQUcsRUFBRSxPQUFPLENBQUMsQ0FBQztRQUNwQyxNQUFNLFlBQVksR0FBRyxhQUFhLENBQUMsR0FBRyxFQUFFLGVBQWUsQ0FBQyxDQUFDO1FBRXpELElBQUksWUFBWSxLQUFLLE1BQU0sRUFBRSxDQUFDO1lBQzVCLE1BQU0sSUFBQSw0QkFBYyxFQUFDLDhCQUE4QixDQUFDLENBQUM7UUFDdkQsQ0FBQztRQUVELElBQUksYUFBYSxDQUFDLEdBQUcsRUFBRSx1QkFBdUIsQ0FBQyxLQUFLLE1BQU0sRUFBRSxDQUFDO1lBQzNELE1BQU0sSUFBQSw0QkFBYyxFQUFDLG9DQUFvQyxDQUFDLENBQUM7UUFDN0QsQ0FBQztRQUVELE1BQU0sYUFBYSxHQUFHLGFBQWEsQ0FBQyxHQUFHLEVBQUUsZ0JBQWdCLENBQUMsQ0FBQztRQUUzRCxJQUFJLGFBQWEsS0FBSyxTQUFTLElBQUksQ0FBQywyQkFBMkIsQ0FBQyxJQUFJLENBQUMsYUFBYSxDQUFDLEVBQUUsQ0FBQztZQUNwRixNQUFNLElBQUEsNEJBQWMsRUFBQyx3Q0FBd0MsQ0FBQyxDQUFDO1FBQ2pFLENBQUM7UUFFRCxJQUFJLEtBQUssS0FBSyxTQUFTLElBQUksS0FBSyxLQUFLLEVBQUUsRUFBRSxDQUFDO1lBQ3hDLE1BQU0sSUFBQSw0QkFBYyxFQUFDLG1DQUFtQyxDQUFDLENBQUM7UUFDNUQsQ0FBQztRQUVELE1BQU0sT0FBTyxHQUFHLElBQUksR0FBRyxDQUFDLE9BQU8sQ0FBQyxZQUFZLENBQUMsQ0FBQztRQUM5QyxNQUFNLFlBQVksR0FBRyxJQUFJLEdBQUcsQ0FBQyxHQUFHLE9BQU8sQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsa0JBQWtCLEVBQUUsT0FBTyxDQUFDLENBQUM7UUFDaEcsWUFBWSxDQUFDLFlBQVksQ0FBQyxHQUFHLENBQUMsV0FBVyxFQUFFLFFBQVEsQ0FBQyxDQUFDO1FBQ3JELFlBQVksQ0FBQyxZQUFZLENBQUMsR0FBRyxDQUFDLGNBQWMsRUFBRSxXQUFXLENBQUMsQ0FBQztRQUMzRCxZQUFZLENBQUMsWUFBWSxDQUFDLEdBQUcsQ0FBQyxlQUFlLEVBQUUsTUFBTSxDQUFDLENBQUM7UUFDdkQsWUFBWSxDQUFDLFlBQVksQ0FBQyxHQUFHLENBQUMsZ0JBQWdCLEVBQUUsYUFBYSxDQUFDLENBQUM7UUFDL0QsWUFBWSxDQUFDLFlBQVksQ0FBQyxHQUFHLENBQUMsdUJBQXVCLEVBQUUsTUFBTSxDQUFDLENBQUM7UUFDL0QsWUFBWSxDQUFDLFlBQVksQ0FBQyxHQUFHLENBQUMsT0FBTyxFQUFFLEtBQUssQ0FBQyxDQUFDO1FBQzlDLFlBQVksQ0FBQyxZQUFZLENBQUMsR0FBRyxDQUFDLGVBQWUsRUFBRSxNQUFNLENBQUMsT0FBTyxDQUFDLGFBQWEsQ0FBQyxDQUFDLENBQUM7UUFFOUUsR0FBRyxDQUFDLFFBQVEsQ0FBQyxZQUFZLENBQUMsUUFBUSxFQUFFLENBQUMsQ0FBQztJQUN4QyxDQUFDO0lBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztRQUNmLElBQUksS0FBSyxZQUFZLCtCQUFpQixFQUFFLENBQUM7WUFDdkMsc0JBQXNCLENBQUMsR0FBRyxFQUFFLFdBQVcsRUFBRSxLQUFLLEVBQUUsS0FBSyxDQUFDLENBQUM7WUFFdkQsT0FBTztRQUNULENBQUM7UUFFRCxNQUFNLEtBQUssQ0FBQztJQUNkLENBQUM7QUFDSCxDQUFDO0FBRUQsU0FBUyxnQkFBZ0IsQ0FBQyxZQUEwQjtJQUNsRCxNQUFNLGFBQWEsR0FBRyxZQUFZLENBQUMsU0FBUyxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRSxHQUFHLElBQUksQ0FBQyxDQUFDO0lBRTdFLElBQUksYUFBYSxJQUFJLENBQUMsRUFBRSxDQUFDO1FBQ3ZCLE1BQU0sSUFBQSwwQkFBWSxFQUFDLG1EQUFtRCxDQUFDLENBQUM7SUFDMUUsQ0FBQztJQUVELE9BQU8sSUFBSSxDQUFDLEdBQUcsQ0FBQywyQ0FBK0IsRUFBRSxhQUFhLENBQUMsQ0FBQztBQUNsRSxDQUFDO0FBU0QsU0FBUyxTQUFTLENBQUMsR0FBWTtJQUM3QixNQUFNLEVBQUUsSUFBSSxFQUFFLEdBQUcsR0FBRyxDQUFDLE9BQTZCLENBQUM7SUFFbkQsSUFBSSxPQUFPLElBQUksS0FBSyxRQUFRLElBQUksSUFBSSxLQUFLLElBQUksRUFBRSxDQUFDO1FBQzlDLE1BQU0sSUFBQSw0QkFBYyxFQUFDLHNCQUFzQixDQUFDLENBQUM7SUFDL0MsQ0FBQztJQUVELE9BQU8sSUFBK0IsQ0FBQztBQUN6QyxDQUFDO0FBRUQsS0FBSyxVQUFVLGlCQUFpQixDQUFDLEdBQVksRUFBRSxPQUEyQjtJQUN4RSxNQUFNLE1BQU0sR0FBRyxTQUFTLENBQUMsR0FBRyxDQUFDLENBQUM7SUFFOUIsTUFBTSxPQUFPLEdBQWlCO1FBQzVCLElBQUksRUFBRSxpQkFBaUIsQ0FBQyxNQUFNLEVBQUUsTUFBTSxDQUFDO1FBQ3ZDLFFBQVEsRUFBRSxpQkFBaUIsQ0FBQyxNQUFNLEVBQUUsV0FBVyxDQUFDO1FBQ2hELFlBQVksRUFBRSxpQkFBaUIsQ0FBQyxNQUFNLEVBQUUsZUFBZSxDQUFDO1FBQ3hELFdBQVcsRUFBRSxpQkFBaUIsQ0FBQyxNQUFNLEVBQUUsY0FBYyxDQUFDO0tBQ3ZELENBQUM7SUFFRix1QkFBdUIsQ0FBQyxPQUFPLENBQUMsWUFBWSxDQUFDLENBQUM7SUFFOUMsTUFBTSxNQUFNLEdBQUcsTUFBTSxPQUFPLENBQUMsWUFBWSxDQUFDLG1CQUFtQixDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUVoRixJQUFJLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDWixNQUFNLElBQUEsMkJBQWEsRUFBQyxtQkFBbUIsQ0FBQyxDQUFDO0lBQzNDLENBQUM7SUFFRCwyQkFBMkIsQ0FBQyxNQUFNLENBQUMsYUFBYSxFQUFFLE9BQU8sQ0FBQyxXQUFXLEVBQUUsMEJBQVksQ0FBQyxDQUFDO0lBRXJGLE9BQU8sT0FBTyxDQUFDO0FBQ2pCLENBQUM7QUFFRCxLQUFLLFVBQVUsdUJBQXVCLENBQ3BDLE9BQXFCLEVBQ3JCLE9BQTJCO0lBRTNCLElBQUksQ0FBQztRQUNILE9BQU8sTUFBTSxPQUFPLENBQUMsWUFBWSxDQUFDLFlBQVksQ0FBQyxPQUFPLENBQUMsQ0FBQztJQUMxRCxDQUFDO0lBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztRQUNmLElBQUksS0FBSyxZQUFZLHlDQUFrQixFQUFFLENBQUM7WUFDeEMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUUsc0NBQXNDLEVBQUUsRUFBRSxTQUFTLEVBQUUsS0FBSyxDQUFDLEtBQUssRUFBRSxDQUFDLENBQUM7WUFDM0YsTUFBTSxtQkFBbUIsQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDekMsQ0FBQztRQUVELE1BQU0sS0FBSyxDQUFDO0lBQ2QsQ0FBQztBQUNILENBQUM7QUFFRCxTQUFTLHdCQUF3QixDQUFDLEtBQWM7SUFDOUMsT0FBTyxDQUFDLENBQUMsS0FBSyxZQUFZLCtCQUFpQixDQUFDLElBQUksS0FBSyxDQUFDLE1BQU0sSUFBSSxHQUFHLENBQUM7QUFDdEUsQ0FBQztBQUVELEtBQUssVUFBVSxlQUFlLENBQzVCLFdBQW1CLEVBQ25CLGVBQXVCLEVBQ3ZCLE9BQTJCO0lBRTNCLElBQUksQ0FBQztRQUNILE9BQU8sTUFBTSxPQUFPLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxXQUFXLEVBQUUsZUFBZSxDQUFDLENBQUM7SUFDOUUsQ0FBQztJQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7UUFDZixPQUFPLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSw0Q0FBNEMsRUFBRSxFQUFFLFdBQVcsRUFBRSxDQUFDLENBQUM7UUFDdEYsTUFBTSxnQkFBZ0IsQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUNoQyxDQUFDO0FBQ0gsQ0FBQztBQUVELFNBQVMsa0JBQWtCLENBQ3pCLEdBQVksRUFDWixXQUFtQixFQUNuQixnQkFBd0IsRUFDeEIsWUFBb0I7SUFFcEIsR0FBRyxDQUFDLEdBQUcsQ0FBQyxlQUFlLEVBQUUsVUFBVSxDQUFDLENBQUM7SUFDckMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxRQUFRLEVBQUUsVUFBVSxDQUFDLENBQUM7SUFDOUIsR0FBRyxDQUFDLE1BQU0sR0FBRyxHQUFHLENBQUM7SUFDakIsR0FBRyxDQUFDLElBQUksR0FBRztRQUNULFlBQVksRUFBRSxXQUFXO1FBQ3pCLFVBQVUsRUFBRSxRQUFRO1FBQ3BCLFVBQVUsRUFBRSxnQkFBZ0I7UUFDNUIsYUFBYSxFQUFFLFlBQVk7S0FDNUIsQ0FBQztBQUNKLENBQUM7QUFFRCxLQUFLLFVBQVUsNEJBQTRCLENBQ3pDLEdBQVksRUFDWixPQUEyQjtJQUUzQixNQUFNLE9BQU8sR0FBRyxNQUFNLGlCQUFpQixDQUFDLEdBQUcsRUFBRSxPQUFPLENBQUMsQ0FBQztJQUV0RCxJQUFJLENBQUMsT0FBTyxDQUFDLFlBQVksQ0FBQyxzQkFBc0IsQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQztRQUMvRCxNQUFNLElBQUEsMEJBQVksRUFBQywwQ0FBMEMsQ0FBQyxDQUFDO0lBQ2pFLENBQUM7SUFFRCxJQUFJLFlBQTBCLENBQUM7SUFFL0IsSUFBSSxDQUFDO1FBQ0gsWUFBWSxHQUFHLE1BQU0sdUJBQXVCLENBQUMsT0FBTyxFQUFFLE9BQU8sQ0FBQyxDQUFDO0lBQ2pFLENBQUM7SUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1FBQ2YsSUFBSSx3QkFBd0IsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQ3BDLE9BQU8sQ0FBQyxZQUFZLENBQUMsd0JBQXdCLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxDQUFDO1FBQzlELENBQUM7UUFFRCxNQUFNLEtBQUssQ0FBQztJQUNkLENBQUM7SUFFRCxNQUFNLGdCQUFnQixHQUFHLGdCQUFnQixDQUFDLFlBQVksQ0FBQyxDQUFDO0lBQ3hELE1BQU0sSUFBSSxHQUFHLE1BQU0sZUFBZSxDQUNoQyxZQUFZLENBQUMsV0FBVyxFQUN4QixZQUFZLENBQUMsZUFBZSxFQUM1QixPQUFPLENBQ1IsQ0FBQztJQUVGLE1BQU0sRUFBRSxHQUFHLEVBQUUsWUFBWSxFQUFFLEdBQUcsT0FBTyxDQUFDLFlBQVksQ0FBQyxNQUFNLENBQUM7UUFDeEQsZUFBZSxFQUFFLFlBQVksQ0FBQyxlQUFlO1FBQzdDLGdCQUFnQixFQUFFLFlBQVksQ0FBQyxnQkFBZ0I7UUFDL0MsV0FBVyxFQUFFLFlBQVksQ0FBQyxXQUFXO1FBQ3JDLE1BQU0sRUFBRSxJQUFJLENBQUMsRUFBRTtLQUNoQixDQUFDLENBQUM7SUFFSCxNQUFNLFdBQVcsR0FBRyxJQUFBLCtCQUFtQixFQUFDO1FBQ3RDLEdBQUc7UUFDSCxJQUFJO1FBQ0osV0FBVyxFQUFFLFlBQVksQ0FBQyxXQUFXO1FBQ3JDLFVBQVUsRUFBRSxPQUFPLENBQUMsVUFBVTtRQUM5QixnQkFBZ0I7S0FDakIsQ0FBQyxDQUFDO0lBRUgsT0FBTyxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUUsMEJBQTBCLEVBQUU7UUFDakQsV0FBVyxFQUFFLFlBQVksQ0FBQyxXQUFXO1FBQ3JDLE1BQU0sRUFBRSxJQUFJLENBQUMsRUFBRTtLQUNoQixDQUFDLENBQUM7SUFFSCxrQkFBa0IsQ0FBQyxHQUFHLEVBQUUsV0FBVyxFQUFFLGdCQUFnQixFQUFFLFlBQVksQ0FBQyxDQUFDO0FBQ3ZFLENBQUM7QUFFRCxTQUFTLHdCQUF3QixDQUFDLGVBQXVCO0lBQ3ZELE1BQU0sT0FBTyxHQUFHLHNCQUFZLENBQUMsTUFBTSxDQUFDLGVBQWUsQ0FBNEIsQ0FBQztJQUVoRixJQUFJLE9BQU8sT0FBTyxFQUFFLEdBQUcsS0FBSyxRQUFRLElBQUksQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ3RFLE9BQU8sMkNBQStCLENBQUM7SUFDekMsQ0FBQztJQUVELE1BQU0sYUFBYSxHQUFHLE9BQU8sQ0FBQyxHQUFHLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLEdBQUcsSUFBSSxDQUFDLENBQUM7SUFFbEUsSUFBSSxhQUFhLElBQUksQ0FBQyxFQUFFLENBQUM7UUFDdkIsTUFBTSxJQUFBLDRCQUFjLEVBQUMsbURBQW1ELENBQUMsQ0FBQztJQUM1RSxDQUFDO0lBRUQsT0FBTyxJQUFJLENBQUMsR0FBRyxDQUFDLDJDQUErQixFQUFFLGFBQWEsQ0FBQyxDQUFDO0FBQ2xFLENBQUM7QUFhRCxLQUFLLFVBQVUscUJBQXFCLENBQ2xDLEdBQVcsRUFDWCxXQUFtQixFQUNuQixZQUFvQixFQUNwQixPQUEyQjtJQUUzQixNQUFNLGVBQWUsR0FBRyxNQUFNLElBQUEsMkJBQXVCLEVBQUM7UUFDcEQsR0FBRztRQUNILEtBQUssRUFBRSxPQUFPLENBQUMsWUFBWTtRQUMzQixZQUFZLEVBQUUsT0FBTyxDQUFDLFlBQVk7S0FDbkMsQ0FBQyxDQUFDO0lBRUgsTUFBTSxnQkFBZ0IsR0FBRyx3QkFBd0IsQ0FBQyxlQUFlLENBQUMsQ0FBQztJQUNuRSxNQUFNLElBQUksR0FBRyxNQUFNLGVBQWUsQ0FBQyxXQUFXLEVBQUUsZUFBZSxFQUFFLE9BQU8sQ0FBQyxDQUFDO0lBRTFFLE1BQU0sV0FBVyxHQUFHLElBQUEsK0JBQW1CLEVBQUM7UUFDdEMsR0FBRztRQUNILElBQUk7UUFDSixXQUFXO1FBQ1gsVUFBVSxFQUFFLE9BQU8sQ0FBQyxVQUFVO1FBQzlCLGdCQUFnQjtLQUNqQixDQUFDLENBQUM7SUFFSCxPQUFPLEVBQUUsR0FBRyxFQUFFLFdBQVcsRUFBRSxnQkFBZ0IsRUFBRSxlQUFlLEVBQUUsWUFBWSxFQUFFLENBQUM7QUFDL0UsQ0FBQztBQUVELEtBQUssVUFBVSx5QkFBeUIsQ0FDdEMsY0FBc0IsRUFDdEIsR0FBVyxFQUNYLFdBQW1CLEVBQ25CLGVBQXVCLEVBQ3ZCLE9BQTJCO0lBRTNCLE1BQU0sTUFBTSxHQUFHLE1BQU0scUJBQXFCLENBQUMsR0FBRyxFQUFFLFdBQVcsRUFBRSxlQUFlLEVBQUUsT0FBTyxDQUFDLENBQUM7SUFFdkYsSUFBSSxDQUFDLE9BQU8sQ0FBQyxZQUFZLENBQUMsY0FBYyxDQUFDLGNBQWMsRUFBRSxlQUFlLENBQUMsRUFBRSxDQUFDO1FBQzFFLE1BQU0sSUFBQSw0QkFBYyxFQUFDLGdDQUFnQyxDQUFDLENBQUM7SUFDekQsQ0FBQztJQUVELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUM7QUFFRCxLQUFLLFVBQVUsa0JBQWtCLENBQUMsR0FBWSxFQUFFLE9BQXVCO0lBQ3JFLE1BQU0sTUFBTSxHQUFHLFNBQVMsQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUM5QixNQUFNLGNBQWMsR0FBRyxpQkFBaUIsQ0FBQyxNQUFNLEVBQUUsZUFBZSxDQUFDLENBQUM7SUFDbEUsTUFBTSxhQUFhLEdBQUcsa0JBQWtCLENBQUMsY0FBYyxDQUFDLENBQUM7SUFDekQsTUFBTSxRQUFRLEdBQUcsT0FBTyxDQUFDLDhCQUE4QixDQUFDO0lBRXhELElBQUksT0FBTyxHQUFHLFFBQVEsQ0FBQyxHQUFHLENBQUMsYUFBYSxDQUFDLENBQUM7SUFFMUMsSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDO1FBQ2IsTUFBTSxRQUFRLEdBQUcsT0FBTyxDQUFDLFlBQVksQ0FBQyxlQUFlLENBQUMsY0FBYyxDQUFDLENBQUM7UUFFdEUsSUFBSSxRQUFRLENBQUMsT0FBTyxLQUFLLE9BQU8sRUFBRSxDQUFDO1lBQ2pDLE9BQU8sQ0FBQyxZQUFZLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsQ0FBQztZQUMzQyxPQUFPLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSx5REFBeUQsRUFBRTtnQkFDaEYsR0FBRyxFQUFFLFFBQVEsQ0FBQyxHQUFHO2FBQ2xCLENBQUMsQ0FBQztZQUNILE1BQU0sSUFBQSxnQ0FBa0IsRUFBQyw0REFBNEQsQ0FBQyxDQUFDO1FBQ3pGLENBQUM7UUFFRCxJQUFJLFFBQVEsQ0FBQyxPQUFPLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDbkMsTUFBTSxJQUFBLDBCQUFZLEVBQUMsb0NBQW9DLENBQUMsQ0FBQztRQUMzRCxDQUFDO1FBRUQsSUFBSSxRQUFRLENBQUMsT0FBTyxLQUFLLFFBQVEsRUFBRSxDQUFDO1lBQ2xDLE9BQU8sQ0FBQyxNQUFNLENBQUMsTUFBTSxFQUFFLGtEQUFrRCxFQUFFO2dCQUN6RSxHQUFHLEVBQUUsUUFBUSxDQUFDLEdBQUc7YUFDbEIsQ0FBQyxDQUFDO1lBQ0gsT0FBTyxHQUFHLHFCQUFxQixDQUM3QixRQUFRLENBQUMsR0FBRyxFQUNaLFFBQVEsQ0FBQyxXQUFXLEVBQ3BCLFFBQVEsQ0FBQyxzQkFBc0IsRUFDL0IsT0FBTyxDQUNSLENBQUMsT0FBTyxDQUFDLEdBQUcsRUFBRTtnQkFDYixRQUFRLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxDQUFDO1lBQ2pDLENBQUMsQ0FBQyxDQUFDO1FBQ0wsQ0FBQzthQUFNLENBQUM7WUFDTixPQUFPLEdBQUcseUJBQXlCLENBQ2pDLGNBQWMsRUFDZCxRQUFRLENBQUMsR0FBRyxFQUNaLFFBQVEsQ0FBQyxXQUFXLEVBQ3BCLFFBQVEsQ0FBQyxlQUFlLEVBQ3hCLE9BQU8sQ0FDUixDQUFDLE9BQU8sQ0FBQyxHQUFHLEVBQUU7Z0JBQ2IsUUFBUSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsQ0FBQztZQUNqQyxDQUFDLENBQUMsQ0FBQztRQUNMLENBQUM7UUFFRCxRQUFRLENBQUMsR0FBRyxDQUFDLGFBQWEsRUFBRSxPQUFPLENBQUMsQ0FBQztJQUN2QyxDQUFDO0lBRUQsTUFBTSxNQUFNLEdBQUcsTUFBTSxPQUFPLENBQUM7SUFFN0IsT0FBTyxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUUsNkJBQTZCLEVBQUUsRUFBRSxHQUFHLEVBQUUsTUFBTSxDQUFDLEdBQUcsRUFBRSxDQUFDLENBQUM7SUFDM0Usa0JBQWtCLENBQUMsR0FBRyxFQUFFLE1BQU0sQ0FBQyxXQUFXLEVBQUUsTUFBTSxDQUFDLGdCQUFnQixFQUFFLE1BQU0sQ0FBQyxlQUFlLENBQUMsQ0FBQztBQUMvRixDQUFDO0FBRUQsS0FBSyxVQUFVLFdBQVcsQ0FBQyxHQUFZLEVBQUUsT0FBdUI7SUFDOUQsTUFBTSxNQUFNLEdBQUcsU0FBUyxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBRTlCLElBQUksTUFBTSxDQUFDLFVBQVUsS0FBSyxlQUFlLEVBQUUsQ0FBQztRQUMxQyxNQUFNLGtCQUFrQixDQUFDLEdBQUcsRUFBRSxPQUFPLENBQUMsQ0FBQztRQUV2QyxPQUFPO0lBQ1QsQ0FBQztJQUVELElBQUksTUFBTSxDQUFDLFVBQVUsS0FBSyxvQkFBb0IsRUFBRSxDQUFDO1FBQy9DLE1BQU0sNEJBQTRCLENBQUMsR0FBRyxFQUFFLE9BQU8sQ0FBQyxDQUFDO1FBRWpELE9BQU87SUFDVCxDQUFDO0lBRUQsTUFBTSxJQUFBLGtDQUFvQixFQUFDLHlEQUF5RCxDQUFDLENBQUM7QUFDeEYsQ0FBQztBQUlELFNBQVMsVUFBVSxDQUFDLEdBQVk7SUFDOUIsSUFBSSxHQUFHLENBQUMsTUFBTSxLQUFLLEtBQUssSUFBSSxHQUFHLENBQUMsSUFBSSxLQUFLLGtCQUFrQjtRQUFFLE9BQU8sZUFBZSxDQUFDO0lBQ3BGLElBQUksR0FBRyxDQUFDLE1BQU0sS0FBSyxNQUFNLElBQUksR0FBRyxDQUFDLElBQUksS0FBSyxjQUFjO1FBQUUsT0FBTyxXQUFXLENBQUM7SUFFN0UsT0FBTyxTQUFTLENBQUM7QUFDbkIsQ0FBQztBQUVELFNBQVMsVUFBVSxDQUFDLEdBQVksRUFBRSxLQUFjLEVBQUUsT0FBMkI7SUFDM0UsSUFBSSxLQUFLLFlBQVksK0JBQWlCLEVBQUUsQ0FBQztRQUN2QyxHQUFHLENBQUMsTUFBTSxHQUFHLEtBQUssQ0FBQyxNQUFNLENBQUM7UUFDMUIsR0FBRyxDQUFDLElBQUksR0FBRyxJQUFBLHlCQUFXLEVBQUMsS0FBSyxDQUFDLENBQUM7UUFFOUIsT0FBTztJQUNULENBQUM7SUFFRCxPQUFPLENBQUMsTUFBTSxDQUFDLE9BQU8sRUFBRSxxQkFBcUIsRUFBRTtRQUM3QyxJQUFJLEVBQUUsR0FBRyxDQUFDLElBQUk7UUFDZCxLQUFLLEVBQUUsS0FBSyxZQUFZLEtBQUssQ0FBQyxDQUFDLENBQUMsR0FBRyxLQUFLLENBQUMsSUFBSSxLQUFLLEtBQUssQ0FBQyxPQUFPLEVBQUUsQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQztLQUNsRixDQUFDLENBQUM7SUFDSCxHQUFHLENBQUMsTUFBTSxHQUFHLEdBQUcsQ0FBQztJQUNqQixHQUFHLENBQUMsSUFBSSxHQUFHLEVBQUUsS0FBSyxFQUFFLGNBQWMsRUFBRSxpQkFBaUIsRUFBRSx5QkFBeUIsRUFBRSxDQUFDO0FBQ3JGLENBQUM7QUFFRCxTQUF3QixpQkFBaUIsQ0FBQyxPQUEyQjtJQUNuRSxNQUFNLGNBQWMsR0FBbUI7UUFDckMsR0FBRyxPQUFPO1FBQ1YsOEJBQThCLEVBQUUsSUFBSSxHQUFHLEVBQUU7S0FDMUMsQ0FBQztJQUVGLE9BQU8sS0FBSyxVQUFVLFdBQVcsQ0FBQyxHQUFHLEVBQUUsSUFBSTtRQUN6QyxNQUFNLE9BQU8sR0FBRyxVQUFVLENBQUMsR0FBRyxDQUFDLENBQUM7UUFFaEMsSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ2IsTUFBTSxJQUFJLEVBQUUsQ0FBQztZQUViLE9BQU87UUFDVCxDQUFDO1FBRUQsSUFBSSxDQUFDO1lBQ0gsTUFBTSxPQUFPLENBQUMsR0FBRyxFQUFFLGNBQWMsQ0FBQyxDQUFDO1FBQ3JDLENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2YsVUFBVSxDQUFDLEdBQUcsRUFBRSxLQUFLLEVBQUUsY0FBYyxDQUFDLENBQUM7UUFDekMsQ0FBQztJQUNILENBQUMsQ0FBQztBQUNKLENBQUMifQ==

package/dist/oauth/pkce.d.ts

@@ -0,0 +1,8 @@
+export interface PkcePair {
+    codeVerifier: string;
+    codeChallenge: string;
+}
+export declare function createVerifier(): string;
+export declare function challengeFromVerifier(verifier: string): string;
+export declare function createPkcePair(): PkcePair;
+//# sourceMappingURL=pkce.d.ts.map

package/dist/oauth/pkce.js

@@ -0,0 +1,23 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createVerifier = createVerifier;
+exports.challengeFromVerifier = challengeFromVerifier;
+exports.createPkcePair = createPkcePair;
+const crypto_1 = __importDefault(require("crypto"));
+function base64url(buffer) {
+    return buffer.toString('base64url');
+}
+function createVerifier() {
+    return base64url(crypto_1.default.randomBytes(64));
+}
+function challengeFromVerifier(verifier) {
+    return base64url(crypto_1.default.createHash('sha256').update(verifier).digest());
+}
+function createPkcePair() {
+    const codeVerifier = createVerifier();
+    return { codeVerifier, codeChallenge: challengeFromVerifier(codeVerifier) };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGtjZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9vYXV0aC9wa2NlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7O0FBV0Esd0NBRUM7QUFFRCxzREFFQztBQUVELHdDQUlDO0FBdkJELG9EQUE0QjtBQU81QixTQUFTLFNBQVMsQ0FBQyxNQUFjO0lBQy9CLE9BQU8sTUFBTSxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUMsQ0FBQztBQUN0QyxDQUFDO0FBRUQsU0FBZ0IsY0FBYztJQUM1QixPQUFPLFNBQVMsQ0FBQyxnQkFBTSxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDO0FBQzNDLENBQUM7QUFFRCxTQUFnQixxQkFBcUIsQ0FBQyxRQUFnQjtJQUNwRCxPQUFPLFNBQVMsQ0FBQyxnQkFBTSxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQztBQUMxRSxDQUFDO0FBRUQsU0FBZ0IsY0FBYztJQUM1QixNQUFNLFlBQVksR0FBRyxjQUFjLEVBQUUsQ0FBQztJQUV0QyxPQUFPLEVBQUUsWUFBWSxFQUFFLGFBQWEsRUFBRSxxQkFBcUIsQ0FBQyxZQUFZLENBQUMsRUFBRSxDQUFDO0FBQzlFLENBQUMifQ==

package/dist/oauth/session-lifecycle.d.ts

@@ -0,0 +1,9 @@
+import type ForestServerClient from './forest-server-client';
+import type { SessionStore } from './session-store';
+export interface EnsureFreshServerAccessParams {
+    sid: string;
+    store: SessionStore;
+    serverClient: ForestServerClient;
+}
+export default function ensureFreshServerAccess({ sid, store, serverClient, }: EnsureFreshServerAccessParams): Promise<string>;
+//# sourceMappingURL=session-lifecycle.d.ts.map

package/dist/oauth/session-lifecycle.js

@@ -0,0 +1,57 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.default = ensureFreshServerAccess;
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+const forest_server_client_1 = require("./forest-server-client");
+const oauth_error_1 = require("./oauth-error");
+const CLIENT_ERROR_CODES = new Set(['invalid_grant', 'invalid_request', 'invalid_client']);
+const inFlightRefreshesBySid = new Map();
+function accessTokenExpiry(saasAccessToken) {
+    const decoded = jsonwebtoken_1.default.decode(saasAccessToken);
+    return decoded?.exp ?? 0;
+}
+async function refreshAndPersist(sid, store, serverClient) {
+    const currentRefresh = store.getSaasRefreshToken(sid);
+    if (currentRefresh === undefined) {
+        throw (0, oauth_error_1.sessionExpired)('Session not found or expired');
+    }
+    let rotated;
+    try {
+        rotated = await serverClient.refreshServerToken(currentRefresh);
+    }
+    catch (error) {
+        if (error instanceof forest_server_client_1.OAuthExchangeError && CLIENT_ERROR_CODES.has(error.error)) {
+            throw (0, oauth_error_1.sessionExpired)('The Forest server rejected the refresh token');
+        }
+        throw (0, oauth_error_1.serverError)('Failed to reach the Forest server to refresh the session');
+    }
+    if (!store.get(sid)) {
+        throw (0, oauth_error_1.sessionExpired)('Session expired during token refresh');
+    }
+    store.updateSaasTokens(sid, {
+        saasAccessToken: rotated.saasAccessToken,
+        saasRefreshToken: rotated.saasRefreshToken,
+    });
+    return rotated.saasAccessToken;
+}
+async function ensureFreshServerAccess({ sid, store, serverClient, }) {
+    const session = store.get(sid);
+    if (!session) {
+        throw (0, oauth_error_1.sessionExpired)('Session not found or expired');
+    }
+    if (accessTokenExpiry(session.saasAccessToken) > Math.floor(Date.now() / 1000)) {
+        return session.saasAccessToken;
+    }
+    const existing = inFlightRefreshesBySid.get(sid);
+    if (existing)
+        return existing;
+    const refresh = refreshAndPersist(sid, store, serverClient).finally(() => {
+        inFlightRefreshesBySid.delete(sid);
+    });
+    inFlightRefreshesBySid.set(sid, refresh);
+    return refresh;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2Vzc2lvbi1saWZlY3ljbGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvb2F1dGgvc2Vzc2lvbi1saWZlY3ljbGUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUEyREEsMENBd0JDO0FBaEZELGdFQUF3QztBQUV4QyxpRUFBNEQ7QUFDNUQsK0NBQTREO0FBUTVELE1BQU0sa0JBQWtCLEdBQUcsSUFBSSxHQUFHLENBQUMsQ0FBQyxlQUFlLEVBQUUsaUJBQWlCLEVBQUUsZ0JBQWdCLENBQUMsQ0FBQyxDQUFDO0FBRTNGLE1BQU0sc0JBQXNCLEdBQUcsSUFBSSxHQUFHLEVBQTJCLENBQUM7QUFFbEUsU0FBUyxpQkFBaUIsQ0FBQyxlQUF1QjtJQUNoRCxNQUFNLE9BQU8sR0FBRyxzQkFBWSxDQUFDLE1BQU0sQ0FBQyxlQUFlLENBQTRCLENBQUM7SUFFaEYsT0FBTyxPQUFPLEVBQUUsR0FBRyxJQUFJLENBQUMsQ0FBQztBQUMzQixDQUFDO0FBRUQsS0FBSyxVQUFVLGlCQUFpQixDQUM5QixHQUFXLEVBQ1gsS0FBbUIsRUFDbkIsWUFBZ0M7SUFFaEMsTUFBTSxjQUFjLEdBQUcsS0FBSyxDQUFDLG1CQUFtQixDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBRXRELElBQUksY0FBYyxLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQ2pDLE1BQU0sSUFBQSw0QkFBYyxFQUFDLDhCQUE4QixDQUFDLENBQUM7SUFDdkQsQ0FBQztJQUVELElBQUksT0FBc0UsQ0FBQztJQUUzRSxJQUFJLENBQUM7UUFDSCxPQUFPLEdBQUcsTUFBTSxZQUFZLENBQUMsa0JBQWtCLENBQUMsY0FBYyxDQUFDLENBQUM7SUFDbEUsQ0FBQztJQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7UUFDZixJQUFJLEtBQUssWUFBWSx5Q0FBa0IsSUFBSSxrQkFBa0IsQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDL0UsTUFBTSxJQUFBLDRCQUFjLEVBQUMsOENBQThDLENBQUMsQ0FBQztRQUN2RSxDQUFDO1FBRUQsTUFBTSxJQUFBLHlCQUFXLEVBQUMsMERBQTBELENBQUMsQ0FBQztJQUNoRixDQUFDO0lBRUQsSUFBSSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUNwQixNQUFNLElBQUEsNEJBQWMsRUFBQyxzQ0FBc0MsQ0FBQyxDQUFDO0lBQy9ELENBQUM7SUFFRCxLQUFLLENBQUMsZ0JBQWdCLENBQUMsR0FBRyxFQUFFO1FBQzFCLGVBQWUsRUFBRSxPQUFPLENBQUMsZUFBZTtRQUN4QyxnQkFBZ0IsRUFBRSxPQUFPLENBQUMsZ0JBQWdCO0tBQzNDLENBQUMsQ0FBQztJQUVILE9BQU8sT0FBTyxDQUFDLGVBQWUsQ0FBQztBQUNqQyxDQUFDO0FBRWMsS0FBSyxVQUFVLHVCQUF1QixDQUFDLEVBQ3BELEdBQUcsRUFDSCxLQUFLLEVBQ0wsWUFBWSxHQUNrQjtJQUM5QixNQUFNLE9BQU8sR0FBRyxLQUFLLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBRS9CLElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQztRQUNiLE1BQU0sSUFBQSw0QkFBYyxFQUFDLDhCQUE4QixDQUFDLENBQUM7SUFDdkQsQ0FBQztJQUVELElBQUksaUJBQWlCLENBQUMsT0FBTyxDQUFDLGVBQWUsQ0FBQyxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRSxHQUFHLElBQUksQ0FBQyxFQUFFLENBQUM7UUFDL0UsT0FBTyxPQUFPLENBQUMsZUFBZSxDQUFDO0lBQ2pDLENBQUM7SUFFRCxNQUFNLFFBQVEsR0FBRyxzQkFBc0IsQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLENBQUM7SUFDakQsSUFBSSxRQUFRO1FBQUUsT0FBTyxRQUFRLENBQUM7SUFFOUIsTUFBTSxPQUFPLEdBQUcsaUJBQWlCLENBQUMsR0FBRyxFQUFFLEtBQUssRUFBRSxZQUFZLENBQUMsQ0FBQyxPQUFPLENBQUMsR0FBRyxFQUFFO1FBQ3ZFLHNCQUFzQixDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUNyQyxDQUFDLENBQUMsQ0FBQztJQUNILHNCQUFzQixDQUFDLEdBQUcsQ0FBQyxHQUFHLEVBQUUsT0FBTyxDQUFDLENBQUM7SUFFekMsT0FBTyxPQUFPLENBQUM7QUFDakIsQ0FBQyJ9

package/dist/oauth/session-store.d.ts

@@ -0,0 +1,61 @@
+import type { EncryptedBlob, TokenCipher } from './token-cipher';
+export interface CreateSessionInput {
+    saasAccessToken: string;
+    saasRefreshToken: string;
+    renderingId: number;
+    userId: number;
+}
+export interface StoredSession {
+    saasAccessToken: string;
+    saasRefreshTokenBlob: EncryptedBlob;
+    refreshTokenHash: string;
+    renderingId: number;
+    userId: number;
+    expiresAt: number;
+}
+export interface CreatedSession {
+    sid: string;
+    refreshToken: string;
+}
+export type PrepareRotationResult = {
+    outcome: 'ready';
+    sid: string;
+    renderingId: number;
+    newRefreshToken: string;
+} | {
+    outcome: 'replay';
+    sid: string;
+    renderingId: number;
+    lastIssuedRefreshToken: string;
+} | {
+    outcome: 'reuse';
+    sid: string;
+} | {
+    outcome: 'unknown';
+};
+export interface UpdateSaasTokensInput {
+    saasAccessToken: string;
+    saasRefreshToken: string;
+}
+export interface SessionStore {
+    create(input: CreateSessionInput): CreatedSession;
+    get(sid: string): StoredSession | undefined;
+    getSaasRefreshToken(sid: string): string | undefined;
+    updateSaasTokens(sid: string, tokens: UpdateSaasTokensInput): void;
+    prepareRotation(presentedToken: string): PrepareRotationResult;
+    commitRotation(presentedToken: string, newRefreshToken: string): boolean;
+    destroy(sid: string): void;
+    claimAuthorizationCode(code: string): boolean;
+    releaseAuthorizationCode(code: string): void;
+    pendingClaimCount(): number;
+}
+export interface SessionStoreOptions {
+    cipher: TokenCipher;
+    now: () => number;
+    sessionTtlSeconds: number;
+    authCodeTtlSeconds?: number;
+    maxPendingCodes?: number;
+}
+export declare function createSid(): string;
+export default function createInMemorySessionStore({ cipher, now, sessionTtlSeconds, authCodeTtlSeconds, maxPendingCodes, }: SessionStoreOptions): SessionStore;
+//# sourceMappingURL=session-store.d.ts.map