@gauts/auth 0.3.2 → 0.3.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +11 -10
- package/SECURITY.md +1 -1
- package/dist/adapters/hono/index.js +3 -3
- package/dist/adapters/hono/index.js.map +1 -1
- package/dist/adapters/next/index.d.ts +1 -1
- package/dist/adapters/next/index.d.ts.map +1 -1
- package/dist/adapters/next/index.js +7 -2
- package/dist/adapters/next/index.js.map +1 -1
- package/dist/session/cookie.d.ts +2 -1
- package/dist/session/cookie.d.ts.map +1 -1
- package/dist/session/cookie.js +19 -1
- package/dist/session/cookie.js.map +1 -1
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -7,7 +7,7 @@ The package stores only a SHA-256 token hash in the database. Browser integratio
|
|
|
7
7
|
```text
|
|
8
8
|
session cookie -> opaque token
|
|
9
9
|
cache cookie -> short signed session snapshot
|
|
10
|
-
renew cookie -> untrusted
|
|
10
|
+
renew cookie -> untrusted renewAt timestamp
|
|
11
11
|
```
|
|
12
12
|
|
|
13
13
|
Only the opaque session token authenticates. It remains stable during sliding renewal, but the session can never exceed its configured maximum lifetime. The optional cache is disabled when omitted and never replaces database validation for unsafe methods, renewal, logout, WebSockets, or direct core calls.
|
|
@@ -55,7 +55,7 @@ credentials accepted
|
|
|
55
55
|
-> load current account and user relations
|
|
56
56
|
-> validate configured status and role rules
|
|
57
57
|
-> write opaque session token cookie
|
|
58
|
-
-> write
|
|
58
|
+
-> write renewAt as Unix seconds
|
|
59
59
|
-> optionally write signed short cache
|
|
60
60
|
```
|
|
61
61
|
|
|
@@ -82,12 +82,12 @@ opaque session token
|
|
|
82
82
|
Renewal:
|
|
83
83
|
|
|
84
84
|
```text
|
|
85
|
-
Next
|
|
86
|
-
->
|
|
87
|
-
->
|
|
85
|
+
Next reads renewAt from the renewal cookie
|
|
86
|
+
-> valid future Unix timestamp: no API call
|
|
87
|
+
-> missing, invalid, or due timestamp: POST /auth/renew
|
|
88
88
|
-> API performs full DB validation
|
|
89
89
|
-> DB expires_at = min(now + ttl, created_at + maxLifetime)
|
|
90
|
-
-> Set-Cookie with same token, a new
|
|
90
|
+
-> Set-Cookie with same token, a new renewAt, and a fresh cache
|
|
91
91
|
```
|
|
92
92
|
|
|
93
93
|
`auth.session.resolve()` is always DB-backed and read-only. Only the explicit renewal operation updates database expiry, and neither activity nor renewal can extend the session beyond `maxLifetime`.
|
|
@@ -358,7 +358,7 @@ Logout marks the database session as revoked and then clears all three cookies.
|
|
|
358
358
|
|
|
359
359
|
## Next.js renewal adapter
|
|
360
360
|
|
|
361
|
-
The Next.js adapter does not authenticate sessions. It calls the private API renewal URL
|
|
361
|
+
The Next.js adapter does not authenticate sessions. It calls the private API renewal URL when `renewAt` is missing, invalid, or due.
|
|
362
362
|
|
|
363
363
|
```ts
|
|
364
364
|
import { createNextAuth } from "@gauts/auth/next";
|
|
@@ -403,11 +403,11 @@ Result semantics:
|
|
|
403
403
|
|
|
404
404
|
| `attempted` | `status` | Meaning |
|
|
405
405
|
| --- | ---: | --- |
|
|
406
|
-
| `false` | `null` | Session token and
|
|
406
|
+
| `false` | `null` | Session token exists and `renewAt` is a valid future timestamp. |
|
|
407
407
|
| `false` | `401` | Session token is missing or malformed. No API call occurred. |
|
|
408
408
|
| `true` | HTTP status | `/auth/renew` was called and its `Set-Cookie` headers were copied. |
|
|
409
409
|
|
|
410
|
-
The adapter forwards only the session cookie and the client/origin headers required for session and CSRF validation. If the browser request has no `Origin`, it
|
|
410
|
+
The adapter forwards only the session cookie and the client/origin headers required for session, host, and CSRF validation. If the browser request has no `Origin` or `X-Forwarded-Host`, it derives them from the public `NextRequest` URL. Other cookies, `Authorization`, and arbitrary request headers are never forwarded. Renewal rejects redirects and times out after five seconds. `renewUrl` must point to the application's trusted private API.
|
|
411
411
|
|
|
412
412
|
Protected API endpoints remain responsible for real authentication. The renewal marker is only a browser scheduling mechanism and never acts as a refresh token.
|
|
413
413
|
|
|
@@ -497,7 +497,8 @@ cookie: {
|
|
|
497
497
|
|
|
498
498
|
- The session cookie contains only the stable opaque token and expires with the database session.
|
|
499
499
|
- The cache cookie contains the signed snapshot and expires after `cache.ttl`.
|
|
500
|
-
- The renewal cookie contains the
|
|
500
|
+
- The renewal cookie contains the authoritative `renew_at` as Unix seconds and expires with the session cookie.
|
|
501
|
+
- The renewal timestamp is an untrusted scheduling hint. It never authenticates or extends a session.
|
|
501
502
|
- Cookie names default to `__sec`, `__cac`, and `__ren`.
|
|
502
503
|
- All three names must be valid and unique.
|
|
503
504
|
|
package/SECURITY.md
CHANGED
|
@@ -37,7 +37,7 @@ The cache is bound to the opaque session token, its own expiry, the authoritativ
|
|
|
37
37
|
|
|
38
38
|
Cookie caching introduces a bounded consistency window. A session revoked on another device, or account/user access changed in the database, may remain readable until the cache TTL expires. Unsafe methods, renewal, logout, WebSockets, and direct core calls always validate through the database. Applications requiring immediate cross-device read revocation must leave the cache disabled or provide shared server-side enforcement outside this package.
|
|
39
39
|
|
|
40
|
-
Keep `AUTH_SECRET` in the API environment. Do not expose it to browser code or share it with a frontend merely to inspect the renewal
|
|
40
|
+
Keep `AUTH_SECRET` in the API environment. Do not expose it to browser code or share it with a frontend merely to inspect the renewal timestamp. The timestamp is intentionally untrusted and never authenticates or renews a session by itself.
|
|
41
41
|
|
|
42
42
|
## Session lifetime
|
|
43
43
|
|
|
@@ -2,7 +2,7 @@ import { deleteCookie, getCookie, setCookie } from "hono/cookie";
|
|
|
2
2
|
import { createAuth } from "../../auth.js";
|
|
3
3
|
import { createError, isAuthError } from "../../errors.js";
|
|
4
4
|
import { createSessionCache } from "../../session/cache.js";
|
|
5
|
-
import {
|
|
5
|
+
import { formatRenewAt, parseSessionToken, resolveSessionCookieNames, } from "../../session/cookie.js";
|
|
6
6
|
const resolveCookie = (config = {}) => {
|
|
7
7
|
const names = resolveSessionCookieNames(config);
|
|
8
8
|
const path = config.path ?? "/";
|
|
@@ -81,9 +81,9 @@ export const createHonoAdapter = ({ auth, cache, cookie, getIp, secret, }) => {
|
|
|
81
81
|
...resolved.options,
|
|
82
82
|
expires: value.expires_at,
|
|
83
83
|
});
|
|
84
|
-
setCookie(context, resolved.names.renewName,
|
|
84
|
+
setCookie(context, resolved.names.renewName, formatRenewAt(value.renew_at), {
|
|
85
85
|
...resolved.options,
|
|
86
|
-
expires: value.
|
|
86
|
+
expires: value.expires_at,
|
|
87
87
|
});
|
|
88
88
|
};
|
|
89
89
|
const setCache = ({ context, resolved: value, token }) => {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/hono/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,UAAU,EAA4B,MAAM,eAAe,CAAC;AAErE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAA2B,MAAM,wBAAwB,CAAC;AAIrF,OAAO,EACH,iBAAiB,EACjB,
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/hono/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,UAAU,EAA4B,MAAM,eAAe,CAAC;AAErE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAA2B,MAAM,wBAAwB,CAAC;AAIrF,OAAO,EACH,aAAa,EACb,iBAAiB,EACjB,yBAAyB,GAE5B,MAAM,yBAAyB,CAAC;AAiFjC,MAAM,aAAa,GAAG,CAAC,SAA2B,EAAE,EAAE,EAAE;IACpD,MAAM,KAAK,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,GAAG,CAAC;IAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC;IAErC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,WAAW,CAAC;YACd,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,wCAAwC;SACpD,CAAC,CAAC;IACP,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,IAAI,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3E,MAAM,WAAW,CAAC;gBACd,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE,6DAA6D;aACzE,CAAC,CAAC;QACP,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAC1C,MAAM,WAAW,CAAC;gBACd,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE,wCAAwC;aACpD,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED,IAAI,QAAQ,KAAK,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,WAAW,CAAC;YACd,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,4CAA4C;SACxD,CAAC,CAAC;IACP,CAAC;IAED,OAAO;QACH,KAAK;QACL,OAAO,EAAE;YACL,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,QAAQ,EAAE,IAAa;YACvB,IAAI;YACJ,QAAQ;YACR,MAAM;SACT;KACJ,CAAC;AACN,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAAC,MAAc,EAAW,EAAE,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC;AAEvF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,EAC9B,IAAI,EACJ,KAAK,EACL,MAAM,EACN,KAAK,EACL,MAAM,GACU,EAAe,EAAE;IACjC,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;QAC9B,MAAM,WAAW,CAAC;YACd,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,gCAAgC;SAC5C,CAAC,CAAC;IACP,CAAC;IAED,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,YAAY,GAAG,IAAI,CAAC;IAExB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACtB,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,WAAW,CAAC;gBACd,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE,qEAAqE;aACjF,CAAC,CAAC;QACP,CAAC;QAED,YAAY,GAAG,kBAAkB,CAAC;YAC9B,MAAM,EAAE,KAAK;YACb,MAAM;YACN,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;SAC/B,CAAC,CAAC;IACP,CAAC;IAED,MAAM,gBAAgB,GAAG,KAAK,EAAE,CAAU,EAA+B,EAAE,CAAC,CAAC;QACzE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,IAAI;QACzC,EAAE,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI;QAC5B,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,oBAAoB,CAAC,IAAI,IAAI;KACvD,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAiB,EAAE;QAC3C,OAAO,iBAAiB,CAAC,SAAS,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAChE,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAmB,EAAQ,EAAE;QAC7E,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;YAC3C,GAAG,QAAQ,CAAC,OAAO;YACnB,OAAO,EAAE,KAAK,CAAC,UAAU;SAC5B,CAAC,CAAC;QACH,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE;YACxE,GAAG,QAAQ,CAAC,OAAO;YACnB,OAAO,EAAE,KAAK,CAAC,UAAU;SAC5B,CAAC,CAAC;IACP,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAiB,EAAQ,EAAE;QAC1E,IAAI,CAAC,YAAY,EAAE,CAAC;YAChB,OAAO;QACX,CAAC;QAED,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/D,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,EAAE;YACvD,GAAG,QAAQ,CAAC,OAAO;YACnB,OAAO,EAAE,MAAM,CAAC,UAAU;SAC7B,CAAC,CAAC;IACP,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,CAAC,CAAU,EAAQ,EAAE;QACpC,IAAI,YAAY,EAAE,CAAC;YACf,YAAY,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAChE,CAAC;IACL,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,CAAC,CAAU,EAAQ,EAAE;QACtC,YAAY,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvD,YAAY,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC5D,YAAY,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IAChE,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,CAAC,CAAU,EAAU,EAAE;QACxC,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QAE1B,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,YAAY,CAAC,CAAC,CAAC,CAAC;YAChB,MAAM,WAAW,CAAC;gBACd,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,0BAA0B;aACtC,CAAC,CAAC;QACP,CAAC;QAED,OAAO,KAAK,CAAC;IACjB,CAAC,CAAC;IAEF,MAAM,gBAAgB,GAAG,KAAK,EAAE,EAC5B,MAAM,EACN,OAAO,EACP,KAAK,GAKR,EAA4B,EAAE;QAC3B,IAAI,KAAK,CAAC;QAEV,IAAI,CAAC;YACD,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,yBAAyB,EAAE,CAAC;gBACjE,YAAY,CAAC,OAAO,CAAC,CAAC;YAC1B,CAAC;YAED,MAAM,KAAK,CAAC;QAChB,CAAC;QAED,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,MAAM,WAAW,CAAC;gBACd,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,0BAA0B;aACtC,CAAC,CAAC;QACP,CAAC;QAED,OAAO,KAAK,CAAC;IACjB,CAAC,CAAC;IAEF,MAAM,aAAa,GAAG,KAAK,EAAE,EAAE,UAAU,EAAE,OAAO,EAAsB,EAAoB,EAAE;QAC1F,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;YACtC,UAAU;YACV,MAAM,EAAE,MAAM,gBAAgB,CAAC,OAAO,CAAC;SAC1C,CAAC,CAAC;QACH,MAAM,KAAK,GAAoB;YAC3B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,IAAI,EAAE,OAAO,CAAC,IAAI;SACrB,CAAC;QAEF,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QACxE,QAAQ,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QAE7D,OAAO,OAAO,CAAC,OAAO,CAAC;IAC3B,CAAC,CAAC;IAEF,MAAM,cAAc,GAAG,KAAK,EAAE,CAAU,EAA4B,EAAE;QAClE,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAE3C,IAAI,YAAY,IAAI,QAAQ,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC;gBAChC,MAAM;gBACN,KAAK;gBACL,KAAK,EAAE,SAAS,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC;aAChD,CAAC,CAAC;YAEH,IAAI,MAAM,EAAE,CAAC;gBACT,OAAO,MAAM,CAAC;YAClB,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAEpE,IAAI,YAAY,IAAI,QAAQ,EAAE,CAAC;YAC3B,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACrD,CAAC;aAAM,CAAC;YACJ,UAAU,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,OAAO,KAAK,CAAC;IACjB,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,KAAK,EAAE,CAAU,EAAoB,EAAE;QACxD,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,OAAO,CAAC;QAEZ,IAAI,CAAC;YACD,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;gBAC/B,MAAM,EAAE,MAAM,gBAAgB,CAAC,CAAC,CAAC;gBACjC,KAAK;aACR,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,yBAAyB,EAAE,CAAC;gBACjE,YAAY,CAAC,CAAC,CAAC,CAAC;YACpB,CAAC;YAED,MAAM,KAAK,CAAC;QAChB,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,YAAY,CAAC,CAAC,CAAC,CAAC;YAChB,MAAM,WAAW,CAAC;gBACd,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,0BAA0B;aACtC,CAAC,CAAC;QACP,CAAC;QAED,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5D,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACnD,OAAO,OAAO,CAAC,OAAO,CAAC;IAC3B,CAAC,CAAC;IAEF,MAAM,cAAc,GAAmC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACrE,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,CAAC,CAAC,CAAC;QAEtC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAChC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAChC,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,MAAM,IAAI,EAAE,CAAC;IACjB,CAAC,CAAC;IAEF,MAAM,aAAa,GAAG,KAAK,EAAE,CAAU,EAAqB,EAAE;QAC1D,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAEnE,YAAY,CAAC,CAAC,CAAC,CAAC;QAChB,OAAO,OAAO,CAAC;IACnB,CAAC,CAAC;IAEF,OAAO;QACH,YAAY;QACZ,MAAM,EAAE,QAAQ,CAAC,KAAK;QACtB,aAAa;QACb,QAAQ;QACR,YAAY;QACZ,cAAc;QACd,cAAc;QACd,aAAa;KAChB,CAAC;AACN,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,EAC3B,KAAK,EACL,MAAM,EACN,EAAE,EACF,KAAK,EACL,QAAQ,EACR,MAAM,EACN,OAAO,GACM,EAAY,EAAE;IAC3B,MAAM,IAAI,GAAG,UAAU,CAAC;QACpB,EAAE;QACF,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC/C,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;KAChD,CAAC,CAAC;IAEH,OAAO;QACH,GAAG,IAAI;QACP,GAAG,iBAAiB,CAAC;YACjB,IAAI;YACJ,KAAK;YACL,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;YACzC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;YAC3C,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;SAC9C,CAAC;KACL,CAAC;AACN,CAAC,CAAC"}
|
|
@@ -19,6 +19,6 @@ export type NextRenewResult = {
|
|
|
19
19
|
export type NextAuth = {
|
|
20
20
|
renew(input: NextRenewInput): Promise<NextRenewResult>;
|
|
21
21
|
};
|
|
22
|
-
export declare const FORWARD_HEADERS: readonly ["cf-connecting-ip", "origin", "referer", "sec-ch-ua-platform", "sec-fetch-dest", "sec-fetch-mode", "sec-fetch-site", "sec-fetch-user", "true-client-ip", "user-agent", "x-forwarded-for", "x-real-ip"];
|
|
22
|
+
export declare const FORWARD_HEADERS: readonly ["cf-connecting-ip", "origin", "referer", "sec-ch-ua-platform", "sec-fetch-dest", "sec-fetch-mode", "sec-fetch-site", "sec-fetch-user", "true-client-ip", "user-agent", "x-forwarded-for", "x-forwarded-host", "x-real-ip"];
|
|
23
23
|
export declare const createNextAuth: ({ cookie, renewUrl }: NextAuthConfig) => NextAuth;
|
|
24
24
|
//# sourceMappingURL=index.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapters/next/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAShE,MAAM,MAAM,gBAAgB,GAAG;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IACzB,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IACzB,OAAO,EAAE,WAAW,CAAC;IACrB,QAAQ,EAAE,YAAY,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC1B,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,YAAY,CAAC;IACvB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG;IACnB,KAAK,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CAC1D,CAAC;AAUF,eAAO,MAAM,eAAe,
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapters/next/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAShE,MAAM,MAAM,gBAAgB,GAAG;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IACzB,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IACzB,OAAO,EAAE,WAAW,CAAC;IACrB,QAAQ,EAAE,YAAY,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC1B,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,YAAY,CAAC;IACvB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG;IACnB,KAAK,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CAC1D,CAAC;AAUF,eAAO,MAAM,eAAe,sOAclB,CAAC;AAqCX,eAAO,MAAM,cAAc,GAAI,sBAAsB,cAAc,KAAG,QA8DrE,CAAC"}
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import { createError } from "../../errors.js";
|
|
2
|
-
import {
|
|
2
|
+
import { parseRenewAt, parseSessionToken, resolveSessionCookieNames, } from "../../session/cookie.js";
|
|
3
3
|
const RENEW_TIMEOUT = 5_000;
|
|
4
4
|
export const FORWARD_HEADERS = [
|
|
5
5
|
"cf-connecting-ip",
|
|
@@ -13,6 +13,7 @@ export const FORWARD_HEADERS = [
|
|
|
13
13
|
"true-client-ip",
|
|
14
14
|
"user-agent",
|
|
15
15
|
"x-forwarded-for",
|
|
16
|
+
"x-forwarded-host",
|
|
16
17
|
"x-real-ip",
|
|
17
18
|
];
|
|
18
19
|
const getSetCookies = (headers) => {
|
|
@@ -34,6 +35,9 @@ const getForwardHeaders = ({ name, request, token }) => {
|
|
|
34
35
|
if (!headers.has("origin")) {
|
|
35
36
|
headers.set("origin", request.nextUrl.origin);
|
|
36
37
|
}
|
|
38
|
+
if (!headers.get("x-forwarded-host")?.trim()) {
|
|
39
|
+
headers.set("x-forwarded-host", request.nextUrl.host);
|
|
40
|
+
}
|
|
37
41
|
return headers;
|
|
38
42
|
};
|
|
39
43
|
export const createNextAuth = ({ cookie, renewUrl }) => {
|
|
@@ -65,7 +69,8 @@ export const createNextAuth = ({ cookie, renewUrl }) => {
|
|
|
65
69
|
status: 401,
|
|
66
70
|
};
|
|
67
71
|
}
|
|
68
|
-
|
|
72
|
+
const renewAt = parseRenewAt(request.cookies.get(names.renewName)?.value);
|
|
73
|
+
if (renewAt !== null && renewAt > Math.floor(Date.now() / 1000)) {
|
|
69
74
|
return {
|
|
70
75
|
attempted: false,
|
|
71
76
|
response,
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/next/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EACH,iBAAiB,EACjB,
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/next/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EACH,YAAY,EACZ,iBAAiB,EACjB,yBAAyB,GAC5B,MAAM,yBAAyB,CAAC;AAiCjC,MAAM,aAAa,GAAG,KAAK,CAAC;AAE5B,MAAM,CAAC,MAAM,eAAe,GAAG;IAC3B,kBAAkB;IAClB,QAAQ;IACR,SAAS;IACT,oBAAoB;IACpB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,YAAY;IACZ,iBAAiB;IACjB,kBAAkB;IAClB,WAAW;CACL,CAAC;AAEX,MAAM,aAAa,GAAG,CAAC,OAAgB,EAAY,EAAE;IACjD,MAAM,aAAa,GAAG,OAErB,CAAC;IAEF,IAAI,OAAO,aAAa,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;QACnD,OAAO,aAAa,CAAC,YAAY,EAAE,CAAC;IACxC,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAClC,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAuB,EAAW,EAAE;IACjF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC,CAAC;IAE5D,KAAK,MAAM,MAAM,IAAI,eAAe,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAE1C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC;IACL,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,CAAC;IAED,OAAO,OAAO,CAAC;AACnB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAkB,EAAY,EAAE;IAC7E,MAAM,KAAK,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,GAAQ,CAAC;IAEb,IAAI,CAAC;QACD,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,MAAM,WAAW,CAAC;YACd,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,8BAA8B;SAC1C,CAAC,CAAC;IACP,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACxD,MAAM,WAAW,CAAC;YACd,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,0CAA0C;SACtD,CAAC,CAAC;IACP,CAAC;IAED,OAAO;QACH,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE;YACnC,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;YAExE,IAAI,CAAC,KAAK,EAAE,CAAC;gBACT,OAAO;oBACH,SAAS,EAAE,KAAK;oBAChB,QAAQ;oBACR,MAAM,EAAE,GAAG;iBACd,CAAC;YACN,CAAC;YAED,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC;YAE1E,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;gBAC9D,OAAO;oBACH,SAAS,EAAE,KAAK;oBAChB,QAAQ;oBACR,MAAM,EAAE,IAAI;iBACf,CAAC;YACN,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;gBACxC,KAAK,EAAE,UAAU;gBACjB,OAAO,EAAE,iBAAiB,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;gBAChE,MAAM,EAAE,MAAM;gBACd,QAAQ,EAAE,OAAO;gBACjB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,aAAa,CAAC;aAC7C,CAAC,CAAC;YAEH,KAAK,MAAM,KAAK,IAAI,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjD,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;YACjD,CAAC;YAED,OAAO;gBACH,SAAS,EAAE,IAAI;gBACf,QAAQ;gBACR,MAAM,EAAE,OAAO,CAAC,MAAM;aACzB,CAAC;QACN,CAAC;KACJ,CAAC;AACN,CAAC,CAAC"}
|
package/dist/session/cookie.d.ts
CHANGED
|
@@ -8,7 +8,8 @@ export type SessionCookieNames = {
|
|
|
8
8
|
name: string;
|
|
9
9
|
renewName: string;
|
|
10
10
|
};
|
|
11
|
-
export declare const
|
|
11
|
+
export declare const formatRenewAt: (value: Date) => string;
|
|
12
|
+
export declare const parseRenewAt: (value?: string | null) => number | null;
|
|
12
13
|
export declare const resolveSessionCookieName: (input?: string) => string;
|
|
13
14
|
export declare const resolveSessionCookieNames: (input?: SessionCookieNamesInput) => SessionCookieNames;
|
|
14
15
|
export declare const parseSessionToken: (value?: string | null) => string | null;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"cookie.d.ts","sourceRoot":"","sources":["../../src/session/cookie.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,uBAAuB,GAAG;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,eAAO,MAAM,
|
|
1
|
+
{"version":3,"file":"cookie.d.ts","sourceRoot":"","sources":["../../src/session/cookie.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,uBAAuB,GAAG;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACrB,CAAC;AAKF,eAAO,MAAM,aAAa,GAAI,OAAO,IAAI,KAAG,MAW3C,CAAC;AAEF,eAAO,MAAM,YAAY,GAAI,QAAQ,MAAM,GAAG,IAAI,KAAG,MAAM,GAAG,IAS7D,CAAC;AAEF,eAAO,MAAM,wBAAwB,GAAI,QAAQ,MAAM,KAAG,MAWzD,CAAC;AAEF,eAAO,MAAM,yBAAyB,GAClC,QAAO,uBAA4B,KACpC,kBAaF,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAAI,QAAQ,MAAM,GAAG,IAAI,KAAG,MAAM,GAAG,IAGlE,CAAC"}
|
package/dist/session/cookie.js
CHANGED
|
@@ -1,7 +1,25 @@
|
|
|
1
1
|
import { createError } from "../errors.js";
|
|
2
2
|
import { tokenPattern } from "./token.js";
|
|
3
|
-
export const RENEW_COOKIE_VALUE = "1";
|
|
4
3
|
const cookieNamePattern = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
|
|
4
|
+
const renewAtPattern = /^[1-9]\d*$/;
|
|
5
|
+
export const formatRenewAt = (value) => {
|
|
6
|
+
const seconds = Math.floor(value.getTime() / 1000);
|
|
7
|
+
if (!Number.isSafeInteger(seconds) || seconds < 1) {
|
|
8
|
+
throw createError({
|
|
9
|
+
code: "SESSION_DATA_INVALID",
|
|
10
|
+
message: "Session renewal date is invalid.",
|
|
11
|
+
});
|
|
12
|
+
}
|
|
13
|
+
return seconds.toString();
|
|
14
|
+
};
|
|
15
|
+
export const parseRenewAt = (value) => {
|
|
16
|
+
const input = value?.trim();
|
|
17
|
+
if (!input || !renewAtPattern.test(input)) {
|
|
18
|
+
return null;
|
|
19
|
+
}
|
|
20
|
+
const seconds = Number(input);
|
|
21
|
+
return Number.isSafeInteger(seconds) ? seconds : null;
|
|
22
|
+
};
|
|
5
23
|
export const resolveSessionCookieName = (input) => {
|
|
6
24
|
const name = input ?? "__sec";
|
|
7
25
|
if (!cookieNamePattern.test(name)) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"cookie.js","sourceRoot":"","sources":["../../src/session/cookie.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAc1C,MAAM,CAAC,MAAM,
|
|
1
|
+
{"version":3,"file":"cookie.js","sourceRoot":"","sources":["../../src/session/cookie.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAc1C,MAAM,iBAAiB,GAAG,gCAAgC,CAAC;AAC3D,MAAM,cAAc,GAAG,YAAY,CAAC;AAEpC,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAAW,EAAU,EAAE;IACjD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IAEnD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,WAAW,CAAC;YACd,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,kCAAkC;SAC9C,CAAC,CAAC;IACP,CAAC;IAED,OAAO,OAAO,CAAC,QAAQ,EAAE,CAAC;AAC9B,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAqB,EAAiB,EAAE;IACjE,MAAM,KAAK,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAE5B,IAAI,CAAC,KAAK,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1D,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,KAAc,EAAU,EAAE;IAC/D,MAAM,IAAI,GAAG,KAAK,IAAI,OAAO,CAAC;IAE9B,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,MAAM,WAAW,CAAC;YACd,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,iCAAiC;SAC7C,CAAC,CAAC;IACP,CAAC;IAED,OAAO,IAAI,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACrC,QAAiC,EAAE,EACjB,EAAE;IACpB,MAAM,IAAI,GAAG,wBAAwB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,wBAAwB,CAAC,KAAK,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC;IACvE,MAAM,SAAS,GAAG,wBAAwB,CAAC,KAAK,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC;IAEvE,IAAI,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACnD,MAAM,WAAW,CAAC;YACd,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,sCAAsC;SAClD,CAAC,CAAC;IACP,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAC1C,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,KAAqB,EAAiB,EAAE;IACtE,MAAM,KAAK,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC5B,OAAO,KAAK,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5D,CAAC,CAAC"}
|