@formigio/fazemos-cli 0.10.77 → 0.10.79
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/auth.d.ts +31 -3
- package/dist/auth.js +109 -19
- package/dist/auth.js.map +1 -1
- package/dist/authConfig.d.ts +43 -0
- package/dist/authConfig.js +54 -0
- package/dist/authConfig.js.map +1 -0
- package/dist/config.d.ts +53 -13
- package/dist/config.js +22 -1
- package/dist/config.js.map +1 -1
- package/dist/governance.d.ts +156 -0
- package/dist/governance.js +45 -0
- package/dist/governance.js.map +1 -1
- package/dist/index.js +71 -36
- package/dist/index.js.map +1 -1
- package/dist/oidc.d.ts +111 -0
- package/dist/oidc.js +283 -0
- package/dist/oidc.js.map +1 -0
- package/dist/wake.d.ts +81 -0
- package/dist/wake.js +76 -15
- package/dist/wake.js.map +1 -1
- package/package.json +1 -1
package/dist/auth.d.ts
CHANGED
|
@@ -1,7 +1,35 @@
|
|
|
1
|
-
export
|
|
1
|
+
export interface BrowserLoginResult {
|
|
2
2
|
email: string;
|
|
3
|
-
expiresIn: number
|
|
4
|
-
}
|
|
3
|
+
expiresIn: number;
|
|
4
|
+
}
|
|
5
|
+
/**
|
|
6
|
+
* Sign in through the Cognito hosted UI — authorization code + PKCE, with the
|
|
7
|
+
* code caught on a loopback listener. This is the only interactive login the
|
|
8
|
+
* CLI has; the CLI's app client has ALLOW_USER_PASSWORD_AUTH switched off, so
|
|
9
|
+
* there is no password path to fall back to even by accident.
|
|
10
|
+
*
|
|
11
|
+
* The auth config is refetched on every login rather than read from the
|
|
12
|
+
* stored environment. It is one cheap unauthenticated request, it lets an
|
|
13
|
+
* environment configured before OIDC login backfill its CLI client id and
|
|
14
|
+
* hosted-UI domain instead of failing, and it means a pool rotation on the
|
|
15
|
+
* server is picked up without the operator re-running `fazemos init`.
|
|
16
|
+
*/
|
|
17
|
+
export declare function loginWithBrowser(opts?: {
|
|
18
|
+
/** Print the URL instead of launching a browser (SSH, headless boxes). */
|
|
19
|
+
noBrowser?: boolean;
|
|
20
|
+
/** Where progress is reported. Injected so tests can capture it. */
|
|
21
|
+
log?: (line: string) => void;
|
|
22
|
+
}): Promise<BrowserLoginResult>;
|
|
23
|
+
/**
|
|
24
|
+
* The hosted-UI logout URL for the current environment, or null when the
|
|
25
|
+
* environment has never completed an OIDC login (so there is no hosted-UI
|
|
26
|
+
* session to end).
|
|
27
|
+
*
|
|
28
|
+
* `fazemos auth logout` always clears the local tokens; visiting this URL
|
|
29
|
+
* additionally drops the browser's Cognito session, which is what stops the
|
|
30
|
+
* next `auth login` from signing straight back in without a prompt.
|
|
31
|
+
*/
|
|
32
|
+
export declare function hostedLogoutUrl(): string | null;
|
|
5
33
|
export declare function signup(email: string, password: string): Promise<{
|
|
6
34
|
email: string;
|
|
7
35
|
message: string;
|
package/dist/auth.js
CHANGED
|
@@ -1,26 +1,106 @@
|
|
|
1
1
|
import { CognitoIdentityProviderClient, InitiateAuthCommand, SignUpCommand, ConfirmSignUpCommand, AdminCreateUserCommand, AdminSetUserPasswordCommand, AdminInitiateAuthCommand, } from '@aws-sdk/client-cognito-identity-provider';
|
|
2
|
-
import { getEnv, setAuth, config } from './config.js';
|
|
2
|
+
import { getEnv, setAuth, updateEnvironment, config } from './config.js';
|
|
3
|
+
import { fetchAuthConfig } from './authConfig.js';
|
|
4
|
+
import { buildAuthorizeUrl, buildLogoutUrl, createPkcePair, createState, exchangeCodeForTokens, openBrowser, readEmailClaim, waitForCallback, } from './oidc.js';
|
|
3
5
|
function getClient() {
|
|
4
6
|
const env = getEnv();
|
|
5
7
|
return new CognitoIdentityProviderClient({ region: env.cognitoRegion });
|
|
6
8
|
}
|
|
7
|
-
|
|
9
|
+
/** How long to wait for the operator to finish signing in before giving up. */
|
|
10
|
+
const LOGIN_TIMEOUT_MS = 5 * 60 * 1000;
|
|
11
|
+
/**
|
|
12
|
+
* Sign in through the Cognito hosted UI — authorization code + PKCE, with the
|
|
13
|
+
* code caught on a loopback listener. This is the only interactive login the
|
|
14
|
+
* CLI has; the CLI's app client has ALLOW_USER_PASSWORD_AUTH switched off, so
|
|
15
|
+
* there is no password path to fall back to even by accident.
|
|
16
|
+
*
|
|
17
|
+
* The auth config is refetched on every login rather than read from the
|
|
18
|
+
* stored environment. It is one cheap unauthenticated request, it lets an
|
|
19
|
+
* environment configured before OIDC login backfill its CLI client id and
|
|
20
|
+
* hosted-UI domain instead of failing, and it means a pool rotation on the
|
|
21
|
+
* server is picked up without the operator re-running `fazemos init`.
|
|
22
|
+
*/
|
|
23
|
+
export async function loginWithBrowser(opts = {}) {
|
|
24
|
+
const log = opts.log ?? ((line) => console.log(line));
|
|
8
25
|
const env = getEnv();
|
|
9
|
-
const
|
|
10
|
-
const
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
throw new Error('Login failed — no tokens returned');
|
|
26
|
+
const authConfig = await fetchAuthConfig(env.apiUrl);
|
|
27
|
+
const cli = authConfig.cognito.clients.cli;
|
|
28
|
+
const hostedUiDomain = authConfig.cognito.hostedUiDomain;
|
|
29
|
+
if (!cli?.clientId || !hostedUiDomain) {
|
|
30
|
+
// The env-fallback branch of GET /auth/config produces exactly this: a
|
|
31
|
+
// 200 whose CLI client id is empty because the API could not read its SSM
|
|
32
|
+
// parameter. Say so, rather than sending Cognito an empty client_id and
|
|
33
|
+
// letting it answer with an unstyled error page.
|
|
34
|
+
throw new Error(`The API at ${env.apiUrl} did not advertise a CLI app client or hosted-UI domain. ` +
|
|
35
|
+
`Its /auth/config is running in the degraded env-only mode — check that the ` +
|
|
36
|
+
`stack published /fazemos/<env>/auth/public-config and that the API role can read it.`);
|
|
21
37
|
}
|
|
22
|
-
|
|
23
|
-
|
|
38
|
+
// Persist what we learned so `fazemos env` shows the truth and so a later
|
|
39
|
+
// refresh has the right client even if the API is unreachable.
|
|
40
|
+
updateEnvironment(env.name, {
|
|
41
|
+
cognitoPoolId: authConfig.cognito.userPoolId,
|
|
42
|
+
cognitoRegion: authConfig.cognito.region,
|
|
43
|
+
cognitoClientId: authConfig.cognito.clients.web.clientId || env.cognitoClientId,
|
|
44
|
+
cognitoCliClientId: cli.clientId,
|
|
45
|
+
hostedUiDomain,
|
|
46
|
+
});
|
|
47
|
+
const endpoints = { hostedUiDomain, clientId: cli.clientId };
|
|
48
|
+
const { verifier, challenge } = createPkcePair();
|
|
49
|
+
const state = createState();
|
|
50
|
+
const { code, redirectUri } = await waitForCallback({
|
|
51
|
+
state,
|
|
52
|
+
timeoutMs: LOGIN_TIMEOUT_MS,
|
|
53
|
+
onReady: (boundRedirectUri) => {
|
|
54
|
+
// The authorize URL can only be built once a port is bound: Cognito
|
|
55
|
+
// matches redirect_uri exactly, so it must carry the port we actually
|
|
56
|
+
// got, not the one we hoped for.
|
|
57
|
+
const url = buildAuthorizeUrl({
|
|
58
|
+
endpoints,
|
|
59
|
+
redirectUri: boundRedirectUri,
|
|
60
|
+
state,
|
|
61
|
+
codeChallenge: challenge,
|
|
62
|
+
});
|
|
63
|
+
if (opts.noBrowser) {
|
|
64
|
+
log(`Open this URL to sign in:\n\n ${url}\n`);
|
|
65
|
+
}
|
|
66
|
+
else if (openBrowser(url)) {
|
|
67
|
+
log(`Opening your browser to sign in...`);
|
|
68
|
+
log(`If it did not open, use this URL:\n\n ${url}\n`);
|
|
69
|
+
}
|
|
70
|
+
else {
|
|
71
|
+
log(`Could not launch a browser. Open this URL to sign in:\n\n ${url}\n`);
|
|
72
|
+
}
|
|
73
|
+
log(`Waiting for the redirect on ${boundRedirectUri} ...`);
|
|
74
|
+
},
|
|
75
|
+
});
|
|
76
|
+
const tokens = await exchangeCodeForTokens({
|
|
77
|
+
endpoints,
|
|
78
|
+
code,
|
|
79
|
+
redirectUri,
|
|
80
|
+
codeVerifier: verifier,
|
|
81
|
+
});
|
|
82
|
+
const email = readEmailClaim(tokens.idToken);
|
|
83
|
+
setAuth(env.name, email, tokens.idToken, tokens.refreshToken, tokens.expiresIn, cli.clientId);
|
|
84
|
+
return { email, expiresIn: tokens.expiresIn };
|
|
85
|
+
}
|
|
86
|
+
/**
|
|
87
|
+
* The hosted-UI logout URL for the current environment, or null when the
|
|
88
|
+
* environment has never completed an OIDC login (so there is no hosted-UI
|
|
89
|
+
* session to end).
|
|
90
|
+
*
|
|
91
|
+
* `fazemos auth logout` always clears the local tokens; visiting this URL
|
|
92
|
+
* additionally drops the browser's Cognito session, which is what stops the
|
|
93
|
+
* next `auth login` from signing straight back in without a prompt.
|
|
94
|
+
*/
|
|
95
|
+
export function hostedLogoutUrl() {
|
|
96
|
+
const env = getEnv();
|
|
97
|
+
const clientId = env.cognitoCliClientId;
|
|
98
|
+
if (!env.hostedUiDomain || !clientId)
|
|
99
|
+
return null;
|
|
100
|
+
// Any registered LogoutURL will do — the browser lands on a dead loopback
|
|
101
|
+
// port and shows a connection error, which is ugly, so point it at the
|
|
102
|
+
// hosted UI's own login page instead by reusing the callback origin.
|
|
103
|
+
return buildLogoutUrl({ hostedUiDomain: env.hostedUiDomain, clientId }, 'http://localhost:8976/logout');
|
|
24
104
|
}
|
|
25
105
|
export async function signup(email, password) {
|
|
26
106
|
const env = getEnv();
|
|
@@ -54,11 +134,18 @@ export async function refreshSession() {
|
|
|
54
134
|
const authData = config.get('auth')[env.name];
|
|
55
135
|
if (!authData?.refreshToken)
|
|
56
136
|
return null;
|
|
137
|
+
// A refresh token is bound to the app client that minted it. Since OIDC
|
|
138
|
+
// login that is the CLI client, not the web one, so the environment's
|
|
139
|
+
// cognitoClientId is the WRONG value for any session created by
|
|
140
|
+
// `auth login`. Prefer what the session recorded; fall back to the
|
|
141
|
+
// environment's CLI client, then to the legacy single client for sessions
|
|
142
|
+
// stored before either field existed.
|
|
143
|
+
const clientId = authData.clientId || env.cognitoCliClientId || env.cognitoClientId;
|
|
57
144
|
try {
|
|
58
145
|
const client = getClient();
|
|
59
146
|
const result = await client.send(new InitiateAuthCommand({
|
|
60
147
|
AuthFlow: 'REFRESH_TOKEN_AUTH',
|
|
61
|
-
ClientId:
|
|
148
|
+
ClientId: clientId,
|
|
62
149
|
AuthParameters: {
|
|
63
150
|
REFRESH_TOKEN: authData.refreshToken,
|
|
64
151
|
},
|
|
@@ -67,7 +154,7 @@ export async function refreshSession() {
|
|
|
67
154
|
if (!auth?.IdToken)
|
|
68
155
|
return null;
|
|
69
156
|
// Update stored tokens (refresh token is NOT returned on refresh — keep the existing one)
|
|
70
|
-
setAuth(env.name, authData.email, auth.IdToken, authData.refreshToken, auth.ExpiresIn || 3600);
|
|
157
|
+
setAuth(env.name, authData.email, auth.IdToken, authData.refreshToken, auth.ExpiresIn || 3600, clientId);
|
|
71
158
|
return auth.IdToken;
|
|
72
159
|
}
|
|
73
160
|
catch {
|
|
@@ -118,7 +205,10 @@ export async function adminLogin(email, password) {
|
|
|
118
205
|
if (!auth?.IdToken || !auth?.RefreshToken) {
|
|
119
206
|
throw new Error('Admin login failed — no tokens returned');
|
|
120
207
|
}
|
|
121
|
-
|
|
208
|
+
// Records the web client explicitly: admin-login goes through
|
|
209
|
+
// ADMIN_USER_PASSWORD_AUTH on cognitoClientId, so its refresh token is
|
|
210
|
+
// bound to that client and not to the CLI's.
|
|
211
|
+
setAuth(env.name, email, auth.IdToken, auth.RefreshToken, auth.ExpiresIn || 3600, env.cognitoClientId);
|
|
122
212
|
return { email, expiresIn: auth.ExpiresIn };
|
|
123
213
|
}
|
|
124
214
|
//# sourceMappingURL=auth.js.map
|
package/dist/auth.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,6BAA6B,EAC7B,mBAAmB,EACnB,aAAa,EACb,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,GACzB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;
|
|
1
|
+
{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,6BAA6B,EAC7B,mBAAmB,EACnB,aAAa,EACb,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,GACzB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,WAAW,EACX,qBAAqB,EACrB,WAAW,EACX,cAAc,EACd,eAAe,GAEhB,MAAM,WAAW,CAAC;AAEnB,SAAS,SAAS;IAChB,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IACrB,OAAO,IAAI,6BAA6B,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC;AAC1E,CAAC;AAED,+EAA+E;AAC/E,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAOvC;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAKnC,EAAE;IACJ,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IAErB,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC;IAC3C,MAAM,cAAc,GAAG,UAAU,CAAC,OAAO,CAAC,cAAc,CAAC;IAEzD,IAAI,CAAC,GAAG,EAAE,QAAQ,IAAI,CAAC,cAAc,EAAE,CAAC;QACtC,uEAAuE;QACvE,0EAA0E;QAC1E,wEAAwE;QACxE,iDAAiD;QACjD,MAAM,IAAI,KAAK,CACb,cAAc,GAAG,CAAC,MAAM,2DAA2D;YACnF,6EAA6E;YAC7E,sFAAsF,CACvF,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,+DAA+D;IAC/D,iBAAiB,CAAC,GAAG,CAAC,IAAI,EAAE;QAC1B,aAAa,EAAE,UAAU,CAAC,OAAO,CAAC,UAAU;QAC5C,aAAa,EAAE,UAAU,CAAC,OAAO,CAAC,MAAM;QACxC,eAAe,EAAE,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,eAAe;QAC/E,kBAAkB,EAAE,GAAG,CAAC,QAAQ;QAChC,cAAc;KACf,CAAC,CAAC;IAEH,MAAM,SAAS,GAAkB,EAAE,cAAc,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC5E,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,cAAc,EAAE,CAAC;IACjD,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;IAE5B,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,MAAM,eAAe,CAAC;QAClD,KAAK;QACL,SAAS,EAAE,gBAAgB;QAC3B,OAAO,EAAE,CAAC,gBAAgB,EAAE,EAAE;YAC5B,oEAAoE;YACpE,sEAAsE;YACtE,iCAAiC;YACjC,MAAM,GAAG,GAAG,iBAAiB,CAAC;gBAC5B,SAAS;gBACT,WAAW,EAAE,gBAAgB;gBAC7B,KAAK;gBACL,aAAa,EAAE,SAAS;aACzB,CAAC,CAAC;YAEH,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBACnB,GAAG,CAAC,oCAAoC,GAAG,IAAI,CAAC,CAAC;YACnD,CAAC;iBAAM,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5B,GAAG,CAAC,oCAAoC,CAAC,CAAC;gBAC1C,GAAG,CAAC,4CAA4C,GAAG,IAAI,CAAC,CAAC;YAC3D,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,gEAAgE,GAAG,IAAI,CAAC,CAAC;YAC/E,CAAC;YACD,GAAG,CAAC,+BAA+B,gBAAgB,MAAM,CAAC,CAAC;QAC7D,CAAC;KACF,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC;QACzC,SAAS;QACT,IAAI;QACJ,WAAW;QACX,YAAY,EAAE,QAAQ;KACvB,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7C,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IAE9F,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;AAChD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IACrB,MAAM,QAAQ,GAAG,GAAG,CAAC,kBAAkB,CAAC;IACxC,IAAI,CAAC,GAAG,CAAC,cAAc,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAClD,0EAA0E;IAC1E,uEAAuE;IACvE,qEAAqE;IACrE,OAAO,cAAc,CAAC,EAAE,cAAc,EAAE,GAAG,CAAC,cAAc,EAAE,QAAQ,EAAE,EAAE,8BAA8B,CAAC,CAAC;AAC1G,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,KAAa,EAAE,QAAgB;IAC1D,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IACrB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAE3B,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC;QAClC,QAAQ,EAAE,GAAG,CAAC,eAAe;QAC7B,QAAQ,EAAE,KAAK;QACf,QAAQ,EAAE,QAAQ;QAClB,cAAc,EAAE;YACd,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE;SAChC;KACF,CAAC,CAAC,CAAC;IAEJ,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAC;AACxE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAa,EAAE,IAAY;IAC7D,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IACrB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAE3B,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,oBAAoB,CAAC;QACzC,QAAQ,EAAE,GAAG,CAAC,eAAe;QAC7B,QAAQ,EAAE,KAAK;QACf,gBAAgB,EAAE,IAAI;KACvB,CAAC,CAAC,CAAC;IAEJ,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC;AACnE,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IACrB,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,CAAC,QAAQ,EAAE,YAAY;QAAE,OAAO,IAAI,CAAC;IAEzC,wEAAwE;IACxE,sEAAsE;IACtE,gEAAgE;IAChE,mEAAmE;IACnE,0EAA0E;IAC1E,sCAAsC;IACtC,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,IAAI,GAAG,CAAC,kBAAkB,IAAI,GAAG,CAAC,eAAe,CAAC;IAEpF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC;YACvD,QAAQ,EAAE,oBAAoB;YAC9B,QAAQ,EAAE,QAAQ;YAClB,cAAc,EAAE;gBACd,aAAa,EAAE,QAAQ,CAAC,YAAY;aACrC;SACF,CAAC,CAAC,CAAC;QAEJ,MAAM,IAAI,GAAG,MAAM,CAAC,oBAAoB,CAAC;QACzC,IAAI,CAAC,IAAI,EAAE,OAAO;YAAE,OAAO,IAAI,CAAC;QAEhC,0FAA0F;QAC1F,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI,EAAE,QAAQ,CAAC,CAAC;QAEzG,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,KAAa,EAAE,QAAgB;IAC9D,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IACrB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAE3B,iCAAiC;IACjC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,sBAAsB,CAAC;YAC3C,UAAU,EAAE,GAAG,CAAC,aAAa;YAC7B,QAAQ,EAAE,KAAK;YACf,cAAc,EAAE;gBACd,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE;gBAC/B,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE;aAC1C;YACD,aAAa,EAAE,UAAU;SAC1B,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,GAAG,CAAC,IAAI,KAAK,yBAAyB;YAAE,MAAM,GAAG,CAAC;IACxD,CAAC;IAED,eAAe;IACf,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,2BAA2B,CAAC;QAChD,UAAU,EAAE,GAAG,CAAC,aAAa;QAC7B,QAAQ,EAAE,KAAK;QACf,QAAQ,EAAE,QAAQ;QAClB,SAAS,EAAE,IAAI;KAChB,CAAC,CAAC,CAAC;IAEJ,aAAa;IACb,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,wBAAwB,CAAC;QAC5D,UAAU,EAAE,GAAG,CAAC,aAAa;QAC7B,QAAQ,EAAE,GAAG,CAAC,eAAe;QAC7B,QAAQ,EAAE,0BAA0B;QACpC,cAAc,EAAE;YACd,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,QAAQ;SACnB;KACF,CAAC,CAAC,CAAC;IAEJ,MAAM,IAAI,GAAG,MAAM,CAAC,oBAAoB,CAAC;IACzC,IAAI,CAAC,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,8DAA8D;IAC9D,uEAAuE;IACvE,6CAA6C;IAC7C,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI,EAAE,GAAG,CAAC,eAAe,CAAC,CAAC;IAEvG,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;AAC9C,CAAC"}
|
|
@@ -0,0 +1,43 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Client for the API's unauthenticated `GET /auth/config`.
|
|
3
|
+
*
|
|
4
|
+
* The endpoint is the one place that knows which Cognito app client belongs
|
|
5
|
+
* to which surface, and where the hosted UI lives. Baking those into the CLI
|
|
6
|
+
* would mean a pool rotation needs a CLI release; fetching them means it does
|
|
7
|
+
* not. `fazemos init` writes the answer into the stored environment, and
|
|
8
|
+
* `auth login` refetches on every run so an environment configured before
|
|
9
|
+
* OIDC login backfills itself instead of erroring.
|
|
10
|
+
*
|
|
11
|
+
* See fazemos-api/src/routes/authConfig.ts for the server side.
|
|
12
|
+
*/
|
|
13
|
+
export interface AuthClientConfig {
|
|
14
|
+
clientId: string;
|
|
15
|
+
redirectUris: string[];
|
|
16
|
+
}
|
|
17
|
+
export interface AuthPublicConfig {
|
|
18
|
+
environment: string;
|
|
19
|
+
apiBaseUrl: string;
|
|
20
|
+
chatStreamUrl: string;
|
|
21
|
+
cognito: {
|
|
22
|
+
region: string;
|
|
23
|
+
userPoolId: string;
|
|
24
|
+
issuer: string;
|
|
25
|
+
hostedUiDomain: string;
|
|
26
|
+
scopes: string[];
|
|
27
|
+
clients: {
|
|
28
|
+
web: AuthClientConfig;
|
|
29
|
+
cli: AuthClientConfig;
|
|
30
|
+
mobile: AuthClientConfig;
|
|
31
|
+
};
|
|
32
|
+
};
|
|
33
|
+
}
|
|
34
|
+
/**
|
|
35
|
+
* Fetch and shape-check the public auth config.
|
|
36
|
+
*
|
|
37
|
+
* Throws with the reason rather than returning null: every caller needs the
|
|
38
|
+
* payload to proceed, and a null would only be turned into a vaguer message
|
|
39
|
+
* one frame up. The shape check is deliberately shallow — enough to catch an
|
|
40
|
+
* HTML error page or a 503 body being treated as config, not a full schema
|
|
41
|
+
* validation the server already guarantees.
|
|
42
|
+
*/
|
|
43
|
+
export declare function fetchAuthConfig(apiUrl: string, timeoutMs?: number): Promise<AuthPublicConfig>;
|
|
@@ -0,0 +1,54 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Client for the API's unauthenticated `GET /auth/config`.
|
|
3
|
+
*
|
|
4
|
+
* The endpoint is the one place that knows which Cognito app client belongs
|
|
5
|
+
* to which surface, and where the hosted UI lives. Baking those into the CLI
|
|
6
|
+
* would mean a pool rotation needs a CLI release; fetching them means it does
|
|
7
|
+
* not. `fazemos init` writes the answer into the stored environment, and
|
|
8
|
+
* `auth login` refetches on every run so an environment configured before
|
|
9
|
+
* OIDC login backfills itself instead of erroring.
|
|
10
|
+
*
|
|
11
|
+
* See fazemos-api/src/routes/authConfig.ts for the server side.
|
|
12
|
+
*/
|
|
13
|
+
/**
|
|
14
|
+
* Fetch and shape-check the public auth config.
|
|
15
|
+
*
|
|
16
|
+
* Throws with the reason rather than returning null: every caller needs the
|
|
17
|
+
* payload to proceed, and a null would only be turned into a vaguer message
|
|
18
|
+
* one frame up. The shape check is deliberately shallow — enough to catch an
|
|
19
|
+
* HTML error page or a 503 body being treated as config, not a full schema
|
|
20
|
+
* validation the server already guarantees.
|
|
21
|
+
*/
|
|
22
|
+
export async function fetchAuthConfig(apiUrl, timeoutMs = 10_000) {
|
|
23
|
+
const url = `${apiUrl.replace(/\/$/, '')}/auth/config`;
|
|
24
|
+
let res;
|
|
25
|
+
try {
|
|
26
|
+
res = await fetch(url, { signal: AbortSignal.timeout(timeoutMs) });
|
|
27
|
+
}
|
|
28
|
+
catch (err) {
|
|
29
|
+
const reason = err?.name === 'TimeoutError' ? `timed out after ${timeoutMs}ms` : err?.message || String(err);
|
|
30
|
+
throw new Error(`Could not reach ${url} (${reason})`);
|
|
31
|
+
}
|
|
32
|
+
if (!res.ok) {
|
|
33
|
+
// A 404 here is the specific, likely case worth naming: an API deployed
|
|
34
|
+
// before this endpoint existed. Anything else is a live failure.
|
|
35
|
+
if (res.status === 404) {
|
|
36
|
+
throw new Error(`${url} returned 404 — this API predates GET /auth/config. ` +
|
|
37
|
+
`Deploy an API with the endpoint, or configure the environment manually with ` +
|
|
38
|
+
`\`fazemos init <name> --api-url <url> --cognito-pool <id> --cognito-cli-client <id> --hosted-ui <domain>\`.`);
|
|
39
|
+
}
|
|
40
|
+
throw new Error(`${url} returned ${res.status} ${res.statusText}`);
|
|
41
|
+
}
|
|
42
|
+
let data;
|
|
43
|
+
try {
|
|
44
|
+
data = await res.json();
|
|
45
|
+
}
|
|
46
|
+
catch {
|
|
47
|
+
throw new Error(`${url} did not return JSON — is that the API base URL?`);
|
|
48
|
+
}
|
|
49
|
+
if (!data?.cognito?.userPoolId || !data?.cognito?.clients) {
|
|
50
|
+
throw new Error(`${url} returned an unrecognized shape (no cognito.userPoolId / cognito.clients).`);
|
|
51
|
+
}
|
|
52
|
+
return data;
|
|
53
|
+
}
|
|
54
|
+
//# sourceMappingURL=authConfig.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"authConfig.js","sourceRoot":"","sources":["../src/authConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAyBH;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAc,EAAE,SAAS,GAAG,MAAM;IACtE,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC;IAEvD,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,GAAG,EAAE,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,mBAAmB,SAAS,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7G,MAAM,IAAI,KAAK,CAAC,mBAAmB,GAAG,KAAK,MAAM,GAAG,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,wEAAwE;QACxE,iEAAiE;QACjE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,GAAG,GAAG,sDAAsD;gBAC5D,8EAA8E;gBAC9E,6GAA6G,CAC9G,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,aAAa,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,IAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAsB,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,kDAAkD,CAAC,CAAC;IAC5E,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,4EAA4E,CAAC,CAAC;IACtG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
|
package/dist/config.d.ts
CHANGED
|
@@ -42,13 +42,30 @@ export interface AuthMeResponse {
|
|
|
42
42
|
activeOrgId: string;
|
|
43
43
|
activeProjectId: string | null;
|
|
44
44
|
}
|
|
45
|
+
/**
|
|
46
|
+
* A configured environment. `cognitoCliClientId` and `hostedUiDomain` were
|
|
47
|
+
* added with OIDC redirect login and are OPTIONAL on purpose: environments
|
|
48
|
+
* written by an older `fazemos init` have neither, and must keep working
|
|
49
|
+
* rather than failing to load. `auth login` refetches /auth/config on every
|
|
50
|
+
* run and backfills them, so an old entry heals on first use.
|
|
51
|
+
*/
|
|
52
|
+
export interface EnvironmentConfig {
|
|
53
|
+
apiUrl: string;
|
|
54
|
+
cognitoPoolId: string;
|
|
55
|
+
/** The WEB console app client. Retained for display and for older entries. */
|
|
56
|
+
cognitoClientId: string;
|
|
57
|
+
cognitoRegion: string;
|
|
58
|
+
/**
|
|
59
|
+
* The CLI's own app client — the one `auth login` authorizes against and
|
|
60
|
+
* the one refresh must use, because a refresh token is bound to the client
|
|
61
|
+
* that minted it. Absent on environments configured before OIDC login.
|
|
62
|
+
*/
|
|
63
|
+
cognitoCliClientId?: string;
|
|
64
|
+
/** Cognito hosted-UI origin, no trailing slash. Absent on older entries. */
|
|
65
|
+
hostedUiDomain?: string;
|
|
66
|
+
}
|
|
45
67
|
interface FazemosConfig {
|
|
46
|
-
environments: Record<string,
|
|
47
|
-
apiUrl: string;
|
|
48
|
-
cognitoPoolId: string;
|
|
49
|
-
cognitoClientId: string;
|
|
50
|
-
cognitoRegion: string;
|
|
51
|
-
}>;
|
|
68
|
+
environments: Record<string, EnvironmentConfig>;
|
|
52
69
|
activeEnv: string;
|
|
53
70
|
activeOrgId: string;
|
|
54
71
|
/**
|
|
@@ -63,6 +80,14 @@ interface FazemosConfig {
|
|
|
63
80
|
idToken: string;
|
|
64
81
|
refreshToken: string;
|
|
65
82
|
expiresAt: number;
|
|
83
|
+
/**
|
|
84
|
+
* The Cognito app client that minted this session. A refresh token is
|
|
85
|
+
* bound to its client, so refreshing with a different one fails — and
|
|
86
|
+
* since OIDC login introduced a CLI-specific client, "which client" is no
|
|
87
|
+
* longer answerable from the environment alone. Optional: sessions stored
|
|
88
|
+
* before this field existed fall back to the environment's client id.
|
|
89
|
+
*/
|
|
90
|
+
clientId?: string;
|
|
66
91
|
}>;
|
|
67
92
|
/**
|
|
68
93
|
* F15 — Cached /auth/me response. 5-minute TTL. Invalidated explicitly
|
|
@@ -77,12 +102,7 @@ interface FazemosConfig {
|
|
|
77
102
|
}
|
|
78
103
|
export declare const AUTH_ME_CACHE_TTL_MS: number;
|
|
79
104
|
export declare const config: Conf<FazemosConfig>;
|
|
80
|
-
export declare function addEnvironment(name: string, env:
|
|
81
|
-
apiUrl: string;
|
|
82
|
-
cognitoPoolId: string;
|
|
83
|
-
cognitoClientId: string;
|
|
84
|
-
cognitoRegion: string;
|
|
85
|
-
}): void;
|
|
105
|
+
export declare function addEnvironment(name: string, env: EnvironmentConfig): void;
|
|
86
106
|
export declare function hasEnvironments(): boolean;
|
|
87
107
|
/** Set the in-memory environment override from the global `--env` flag (or null to clear). */
|
|
88
108
|
export declare function setEnvOverride(name: string | null): void;
|
|
@@ -98,10 +118,30 @@ export declare function getActiveEnvName(): string;
|
|
|
98
118
|
export declare function getEnv(): {
|
|
99
119
|
apiUrl: string;
|
|
100
120
|
cognitoPoolId: string;
|
|
121
|
+
/** The WEB console app client. Retained for display and for older entries. */
|
|
101
122
|
cognitoClientId: string;
|
|
102
123
|
cognitoRegion: string;
|
|
124
|
+
/**
|
|
125
|
+
* The CLI's own app client — the one `auth login` authorizes against and
|
|
126
|
+
* the one refresh must use, because a refresh token is bound to the client
|
|
127
|
+
* that minted it. Absent on environments configured before OIDC login.
|
|
128
|
+
*/
|
|
129
|
+
cognitoCliClientId?: string;
|
|
130
|
+
/** Cognito hosted-UI origin, no trailing slash. Absent on older entries. */
|
|
131
|
+
hostedUiDomain?: string;
|
|
103
132
|
name: string;
|
|
104
133
|
};
|
|
134
|
+
/**
|
|
135
|
+
* Merge freshly-discovered fields into a stored environment.
|
|
136
|
+
*
|
|
137
|
+
* Used by `auth login`, which refetches /auth/config every run so an
|
|
138
|
+
* environment configured before OIDC login (no CLI client id, no hosted-UI
|
|
139
|
+
* domain) repairs itself instead of erroring. Only the supplied keys are
|
|
140
|
+
* written — apiUrl in particular stays whatever the user configured, since
|
|
141
|
+
* they may be reaching the API through a tunnel or an alias that the API's
|
|
142
|
+
* own view of its base URL would clobber.
|
|
143
|
+
*/
|
|
144
|
+
export declare function updateEnvironment(name: string, patch: Partial<EnvironmentConfig>): void;
|
|
105
145
|
export declare function getToken(): string | null;
|
|
106
146
|
export declare function getActiveOrgId(): string | null;
|
|
107
147
|
export declare function setActiveOrgId(orgId: string): void;
|
|
@@ -121,7 +161,7 @@ export declare function getDirContextSource(): {
|
|
|
121
161
|
org?: string;
|
|
122
162
|
project?: string;
|
|
123
163
|
} | null;
|
|
124
|
-
export declare function setAuth(env: string, email: string, idToken: string, refreshToken: string, expiresInSeconds: number): void;
|
|
164
|
+
export declare function setAuth(env: string, email: string, idToken: string, refreshToken: string, expiresInSeconds: number, clientId?: string): void;
|
|
125
165
|
/**
|
|
126
166
|
* Returns the active project id for the currently-active org, or null if
|
|
127
167
|
* none is set. Follows KD9 — no auto-pick, no interactive prompt. The
|
package/dist/config.js
CHANGED
|
@@ -72,6 +72,24 @@ export function getEnv() {
|
|
|
72
72
|
}
|
|
73
73
|
return { name, ...env };
|
|
74
74
|
}
|
|
75
|
+
/**
|
|
76
|
+
* Merge freshly-discovered fields into a stored environment.
|
|
77
|
+
*
|
|
78
|
+
* Used by `auth login`, which refetches /auth/config every run so an
|
|
79
|
+
* environment configured before OIDC login (no CLI client id, no hosted-UI
|
|
80
|
+
* domain) repairs itself instead of erroring. Only the supplied keys are
|
|
81
|
+
* written — apiUrl in particular stays whatever the user configured, since
|
|
82
|
+
* they may be reaching the API through a tunnel or an alias that the API's
|
|
83
|
+
* own view of its base URL would clobber.
|
|
84
|
+
*/
|
|
85
|
+
export function updateEnvironment(name, patch) {
|
|
86
|
+
const envs = config.get('environments');
|
|
87
|
+
const existing = envs[name];
|
|
88
|
+
if (!existing)
|
|
89
|
+
throw new Error(`Environment "${name}" is not configured.`);
|
|
90
|
+
envs[name] = { ...existing, ...patch };
|
|
91
|
+
config.set('environments', envs);
|
|
92
|
+
}
|
|
75
93
|
export function getToken() {
|
|
76
94
|
const env = getActiveEnvName();
|
|
77
95
|
const auth = config.get('auth')[env];
|
|
@@ -117,13 +135,16 @@ export function setDirContextSource(source) {
|
|
|
117
135
|
export function getDirContextSource() {
|
|
118
136
|
return dirContextSource;
|
|
119
137
|
}
|
|
120
|
-
export function setAuth(env, email, idToken, refreshToken, expiresInSeconds) {
|
|
138
|
+
export function setAuth(env, email, idToken, refreshToken, expiresInSeconds, clientId) {
|
|
121
139
|
const auth = config.get('auth');
|
|
122
140
|
auth[env] = {
|
|
123
141
|
email,
|
|
124
142
|
idToken,
|
|
125
143
|
refreshToken,
|
|
126
144
|
expiresAt: Date.now() + expiresInSeconds * 1000,
|
|
145
|
+
// Preserved across a refresh by the caller passing it back in; see
|
|
146
|
+
// refreshSession() in auth.ts.
|
|
147
|
+
...(clientId ? { clientId } : {}),
|
|
127
148
|
};
|
|
128
149
|
config.set('auth', auth);
|
|
129
150
|
}
|
package/dist/config.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;
|
|
1
|
+
{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AAyGxB,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAElD,MAAM,CAAC,MAAM,MAAM,GAAG,IAAI,IAAI,CAAgB;IAC5C,WAAW,EAAE,aAAa;IAC1B,QAAQ,EAAE;QACR,YAAY,EAAE,EAAE;QAChB,SAAS,EAAE,EAAE;QACb,WAAW,EAAE,EAAE;QACf,kBAAkB,EAAE,EAAE;QACtB,IAAI,EAAE,EAAE;KACT;CACF,CAAC,CAAC;AAEH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,GAAsB;IACjE,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;IACjB,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IACjC,iCAAiC;IACjC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAC5D,CAAC;AAED,+DAA+D;AAC/D,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,2EAA2E;AAC3E,4EAA4E;AAC5E,2DAA2D;AAC3D,EAAE;AACF,sEAAsE;AACtE,EAAE;AACF,4EAA4E;AAC5E,+EAA+E;AAC/E,6EAA6E;AAC7E,qEAAqE;AAErE,IAAI,WAAW,GAAkB,IAAI,CAAC;AAEtC,8FAA8F;AAC9F,MAAM,UAAU,cAAc,CAAC,IAAmB;IAChD,WAAW,GAAG,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;AACrC,CAAC;AAID,iFAAiF;AACjF,MAAM,UAAU,kBAAkB;IAChC,IAAI,WAAW;QAAE,OAAO,MAAM,CAAC;IAC/B,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE;QAAE,OAAO,SAAS,CAAC;IACtD,IAAI,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC;QAAE,OAAO,WAAW,CAAC;IAChD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;AACnF,CAAC;AAED,MAAM,UAAU,MAAM;IACpB,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAC;IAChC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,GAAG,GAAG,kBAAkB,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9F,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,IAAI,GAAG,uDAAuD,IAAI,kBAAkB,CAAC,CAAC;IAC5H,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,GAAG,GAAG,EAAE,CAAC;AAC1B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,KAAiC;IAC/E,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,sBAAsB,CAAC,CAAC;IAC3E,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAK,EAAE,CAAC;IACvC,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,QAAQ;IACtB,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,IAAI,CAAC,OAAO,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IACpC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACxC,OAAO,KAAK,IAAI,IAAI,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,+DAA+D;AAC/D,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,wEAAwE;AACxE,8EAA8E;AAC9E,6EAA6E;AAC7E,4DAA4D;AAE5D,IAAI,WAAW,GAAkB,IAAI,CAAC;AACtC,IAAI,eAAe,GAAkB,IAAI,CAAC;AAC1C,IAAI,gBAAgB,GAA4D,IAAI,CAAC;AAErF,iFAAiF;AACjF,MAAM,UAAU,cAAc,CAAC,KAAoB;IACjD,WAAW,GAAG,KAAK,CAAC;AACtB,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,kBAAkB,CAAC,SAAwB;IACzD,eAAe,GAAG,SAAS,CAAC;AAC9B,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,mBAAmB,CAAC,MAA+D;IACjG,gBAAgB,GAAG,MAAM,CAAC;AAC5B,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,mBAAmB;IACjC,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,OAAO,CACrB,GAAW,EACX,KAAa,EACb,OAAe,EACf,YAAoB,EACpB,gBAAwB,EACxB,QAAiB;IAEjB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG,CAAC,GAAG;QACV,KAAK;QACL,OAAO;QACP,YAAY;QACZ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,GAAG,IAAI;QAC/C,mEAAmE;QACnE,+BAA+B;QAC/B,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClC,CAAC;IACF,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,+DAA+D;AAE/D;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB;IAChC,IAAI,eAAe;QAAE,OAAO,eAAe,CAAC;IAC5C,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC;IACnD,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa,EAAE,SAAiB;IACjE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC;IACnD,GAAG,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC;IACvB,MAAM,CAAC,GAAG,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;AACxC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC;IACnD,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC;IAClB,MAAM,CAAC,GAAG,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;AACxC,CAAC;AAED,+DAA+D;AAE/D,MAAM,UAAU,cAAc;IAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,SAAS,GAAG,gBAAgB,EAAE,CAAC;IACrC,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,GAAG,oBAAoB;QAAE,OAAO,IAAI,CAAC;IACrE,OAAO,KAAK,CAAC,IAAI,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAoB;IACjD,MAAM,SAAS,GAAG,gBAAgB,EAAE,CAAC;IACrC,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE;QACxB,SAAS;QACT,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;QACrB,IAAI;KACL,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,yEAAyE;IACzE,yEAAyE;IACzE,wBAAwB;IACxB,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,IAAY;IAC3D,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;IAC5B,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,MAAM,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC;IAC9C,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,SAAiB;IAC9D,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;IAC5B,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,MAAM,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC;IAC9C,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,IAAI,IAAI,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;IAC5B,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC;AACnD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;IAC5B,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC;AACpD,CAAC"}
|