@geekity/cms 0.12.0 → 0.13.0

package/dist/indieauth/bearer.js

@@ -0,0 +1,63 @@
+import { findUserById } from '../admin/accounts.js';
+import { PROTECTED_RESOURCE_METADATA_PATH, siteBaseUrl } from './discovery.js';
+import { findAccessToken, recordUse, verifyAccessToken } from './tokens.js';
+/**
+ * Turn the access token on a request into the user and scopes it grants, and
+ * refuse the request when it has none, a bad one, or one without `scope`.
+ *
+ * The token comes from an `Authorization: Bearer` header or, as Micropub
+ * allows, an `access_token` field of a form body. A refusal carries
+ * `WWW-Authenticate: Bearer` naming the protected resource metadata (RFC
+ * 9728), which is how an MCP client finds out where to sign in.
+ */
+export function requireBearer(guard) {
+    return async (c, next) => {
+        const { config } = c.var;
+        const presented = await presentedToken(c);
+        if (presented === undefined) {
+            return refuse(c, 401, 'unauthorized', 'An access token is required.', {});
+        }
+        const now = config.now();
+        const token = guard.audience === 'authorization-server'
+            ? findAccessToken(config.dataDir, presented, now)
+            : verifyAccessToken(config.dataDir, presented, guard.audience, now);
+        const user = token === undefined ? undefined : findUserById(config.dataDir, token.userId);
+        if (token === undefined || user === undefined) {
+            const description = 'The access token is unknown, expired, revoked or not for this resource.';
+            return refuse(c, 401, 'invalid_token', description, { error: 'invalid_token' });
+        }
+        if (guard.scope !== undefined && !token.scopes.includes(guard.scope)) {
+            const description = `The access token was not granted the ${guard.scope} scope.`;
+            return refuse(c, 403, 'insufficient_scope', description, {
+                error: 'insufficient_scope',
+                scope: guard.scope,
+            });
+        }
+        await recordUse(config.dataDir, token, now);
+        c.set('bearer', { token, user });
+        await next();
+    };
+}
+async function presentedToken(c) {
+    const header = /^Bearer +(\S+)$/i.exec(c.req.header('authorization') ?? '');
+    if (header !== null)
+        return header[1];
+    const type = c.req.header('content-type') ?? '';
+    if (!/^(application\/x-www-form-urlencoded|multipart\/form-data)\b/i.test(type)) {
+        return undefined;
+    }
+    const field = (await c.req.parseBody())['access_token'];
+    return typeof field === 'string' && field !== '' ? field : undefined;
+}
+function refuse(c, status, error, description, params) {
+    const challenge = Object.entries({
+        ...params,
+        resource_metadata: `${siteBaseUrl(c)}${PROTECTED_RESOURCE_METADATA_PATH}`,
+    })
+        .map(([name, value]) => `${name}="${value}"`)
+        .join(', ');
+    c.header('www-authenticate', `Bearer ${challenge}`);
+    c.header('cache-control', 'no-store');
+    return c.json({ error, error_description: description }, status);
+}
+//# sourceMappingURL=bearer.js.map

package/dist/indieauth/bearer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearer.js","sourceRoot":"","sources":["../../src/indieauth/bearer.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAGpD,OAAO,EAAE,gCAAgC,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE/E,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AA2B5E;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,KAAY;IACxC,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC;QACzB,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,CAAC,CAAC,CAAC;QAC1C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,cAAc,EAAE,8BAA8B,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,KAAK,GACT,KAAK,CAAC,QAAQ,KAAK,sBAAsB;YACvC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC;YACjD,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACxE,MAAM,IAAI,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC1F,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9C,MAAM,WAAW,GAAG,yEAAyE,CAAC;YAC9F,OAAO,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,eAAe,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;QAClF,CAAC;QAED,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACrE,MAAM,WAAW,GAAG,wCAAwC,KAAK,CAAC,KAAK,SAAS,CAAC;YACjF,OAAO,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,oBAAoB,EAAE,WAAW,EAAE;gBACvD,KAAK,EAAE,oBAAoB;gBAC3B,KAAK,EAAE,KAAK,CAAC,KAAK;aACnB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;QAC5C,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACjC,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,CAAU;IACtC,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5E,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAChD,IAAI,CAAC,+DAA+D,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC;IACxD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC;AAED,SAAS,MAAM,CACb,CAAqB,EACrB,MAAiB,EACjB,KAAa,EACb,WAAmB,EACnB,MAAwC;IAExC,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC;QAC/B,GAAG,MAAM;QACT,iBAAiB,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,gCAAgC,EAAE;KAC1E,CAAC;SACC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,KAAK,KAAK,GAAG,CAAC;SAC5C,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,CAAC,CAAC,MAAM,CAAC,kBAAkB,EAAE,UAAU,SAAS,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IACtC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,EAAE,MAAM,CAAC,CAAC;AACnE,CAAC"}

package/dist/indieauth/client.d.ts

@@ -0,0 +1,61 @@
+import type { HostLookup } from '../webmention/public-address.ts';
+/** What a client says about itself at its client_id URL. */
+export interface ClientInformation {
+    /** What to call it on the consent screen. */
+    readonly name?: string;
+    /** Its home page. */
+    readonly url?: string;
+    /** Where its logo is, an http or https URL. */
+    readonly logo?: string;
+    /** Where it may be sent back to, besides its own origin. */
+    readonly redirectUris: readonly string[];
+}
+/** How long a client is given to answer. */
+export declare const CLIENT_FETCH_TIMEOUT_MS = 5000;
+/** The most of a client's page or document that is read. */
+export declare const CLIENT_FETCH_MAX_BYTES: number;
+/** The most of a client's logo that is read. */
+export declare const CLIENT_LOGO_MAX_BYTES: number;
+/** What {@link fetchClientInformation} and {@link fetchClientLogo} need. */
+export interface FetchClientOptions {
+    readonly lookup: HostLookup;
+    readonly timeoutMs?: number | undefined;
+    readonly maxBytes?: number | undefined;
+}
+/** What fetching one client_id came to. */
+export type ClientFetch = {
+    readonly ok: true;
+    readonly client: ClientInformation;
+} | {
+    readonly ok: false;
+    readonly reason: string;
+};
+/**
+ * Fetch a client_id URL and read what it says about the client.
+ *
+ * The URL is whatever the person's browser was sent here with, so the fetch
+ * goes through {@link fetchPublic}: public hosts only, every redirect hop
+ * checked, one timeout and a byte limit.
+ */
+export declare function fetchClientInformation(clientId: string, options: FetchClientOptions): Promise<ClientFetch>;
+/**
+ * Fetch a client's logo as a `data:` URI, or `undefined` when it cannot be had.
+ *
+ * Fetched here rather than linked from the page, so the admin's `img-src`
+ * never names the client and the client never learns the address of the
+ * person approving it, or when. The fetch is held to {@link fetchPublic}'s
+ * rules like the client_id itself, to image types only, and to
+ * {@link CLIENT_LOGO_MAX_BYTES}.
+ */
+export declare function fetchClientLogo(url: string, options: FetchClientOptions): Promise<string | undefined>;
+/**
+ * What a client_id document says, by its content type.
+ *
+ * A JSON document is a client metadata document, which the OAuth Client ID
+ * Metadata Document draft and MCP use. Its `client_id` must be its own URL;
+ * one that names another client is read as saying nothing. Anything else is
+ * read as an HTML page with an IndieAuth `h-app` (or the older `h-x-app`) and
+ * `rel="redirect_uri"` links, in the response's `Link` header or in the page.
+ */
+export declare function readClientInformation(body: string, type: string, clientId: string, base?: string, link?: string | null): ClientInformation;
+//# sourceMappingURL=client.d.ts.map

package/dist/indieauth/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/indieauth/client.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAElE,4DAA4D;AAC5D,MAAM,WAAW,iBAAiB;IAChC,6CAA6C;IAC7C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,qBAAqB;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,+CAA+C;IAC/C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,4DAA4D;IAC5D,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAED,4CAA4C;AAC5C,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAE5C,4DAA4D;AAC5D,eAAO,MAAM,sBAAsB,QAAa,CAAC;AAEjD,gDAAgD;AAChD,eAAO,MAAM,qBAAqB,QAAY,CAAC;AAM/C,4EAA4E;AAC5E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC;AAED,2CAA2C;AAC3C,MAAM,MAAM,WAAW,GACnB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAA;CAAE,GACzD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpD;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,WAAW,CAAC,CAiBtB;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAW7B;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE,MAAiB,EACvB,IAAI,GAAE,MAAM,GAAG,IAAW,GACzB,iBAAiB,CAEnB"}

package/dist/indieauth/client.js

@@ -0,0 +1,139 @@
+import { linkTargets } from '../webmention/discovery.js';
+import { fetchPublic, webUrl } from '../webmention/fetch-public.js';
+import { elementsIn, hasRel, parseHtml } from '../webmention/html.js';
+import { itemsIn } from '../webmention/microformats.js';
+/** How long a client is given to answer. */
+export const CLIENT_FETCH_TIMEOUT_MS = 5000;
+/** The most of a client's page or document that is read. */
+export const CLIENT_FETCH_MAX_BYTES = 512 * 1024;
+/** The most of a client's logo that is read. */
+export const CLIENT_LOGO_MAX_BYTES = 64 * 1024;
+/** The image types a logo may be, which a browser shows in an `<img>`. */
+const LOGO_TYPE = /^\s*(image\/(?:png|jpeg|gif|webp|avif|svg\+xml|x-icon|vnd\.microsoft\.icon))\s*(?:;|$)/i;
+/**
+ * Fetch a client_id URL and read what it says about the client.
+ *
+ * The URL is whatever the person's browser was sent here with, so the fetch
+ * goes through {@link fetchPublic}: public hosts only, every redirect hop
+ * checked, one timeout and a byte limit.
+ */
+export async function fetchClientInformation(clientId, options) {
+    const fetched = await fetchPublic(clientId, {
+        lookup: options.lookup,
+        timeoutMs: options.timeoutMs ?? CLIENT_FETCH_TIMEOUT_MS,
+        maxBytes: options.maxBytes ?? CLIENT_FETCH_MAX_BYTES,
+        accept: 'application/json, text/html;q=0.9',
+        contentType: {
+            pattern: /^\s*(application\/(?:[\w.+-]+\+)?json|text\/html|application\/xhtml\+xml)/i,
+            name: 'JSON client metadata or an HTML page',
+        },
+    });
+    if (!fetched.ok)
+        return fetched;
+    const body = new TextDecoder().decode(fetched.body);
+    return {
+        ok: true,
+        client: readClientInformation(body, fetched.type, clientId, fetched.url, fetched.link),
+    };
+}
+/**
+ * Fetch a client's logo as a `data:` URI, or `undefined` when it cannot be had.
+ *
+ * Fetched here rather than linked from the page, so the admin's `img-src`
+ * never names the client and the client never learns the address of the
+ * person approving it, or when. The fetch is held to {@link fetchPublic}'s
+ * rules like the client_id itself, to image types only, and to
+ * {@link CLIENT_LOGO_MAX_BYTES}.
+ */
+export async function fetchClientLogo(url, options) {
+    const fetched = await fetchPublic(url, {
+        lookup: options.lookup,
+        timeoutMs: options.timeoutMs ?? CLIENT_FETCH_TIMEOUT_MS,
+        maxBytes: options.maxBytes ?? CLIENT_LOGO_MAX_BYTES,
+        accept: 'image/*',
+        contentType: { pattern: LOGO_TYPE, name: 'an image' },
+    });
+    if (!fetched.ok)
+        return undefined;
+    const type = LOGO_TYPE.exec(fetched.type)?.[1]?.toLowerCase() ?? 'image/png';
+    return `data:${type};base64,${Buffer.from(fetched.body).toString('base64')}`;
+}
+/**
+ * What a client_id document says, by its content type.
+ *
+ * A JSON document is a client metadata document, which the OAuth Client ID
+ * Metadata Document draft and MCP use. Its `client_id` must be its own URL;
+ * one that names another client is read as saying nothing. Anything else is
+ * read as an HTML page with an IndieAuth `h-app` (or the older `h-x-app`) and
+ * `rel="redirect_uri"` links, in the response's `Link` header or in the page.
+ */
+export function readClientInformation(body, type, clientId, base = clientId, link = null) {
+    return /json/i.test(type) ? fromJson(body, clientId) : fromHtml(body, base, link);
+}
+function fromJson(body, clientId) {
+    let document;
+    try {
+        document = JSON.parse(body);
+    }
+    catch {
+        return { redirectUris: [] };
+    }
+    if (typeof document !== 'object' || document === null)
+        return { redirectUris: [] };
+    const fields = document;
+    if (!sameUrl(fields['client_id'], clientId))
+        return { redirectUris: [] };
+    const name = fields['client_name'];
+    const url = fields['client_uri'];
+    const logo = logoUrl(fields['logo_uri']);
+    const redirectUris = Array.isArray(fields['redirect_uris'])
+        ? fields['redirect_uris'].filter((uri) => typeof uri === 'string')
+        : [];
+    return {
+        ...(typeof name === 'string' && name.trim() !== '' ? { name: name.trim() } : {}),
+        ...(typeof url === 'string' && URL.canParse(url) ? { url } : {}),
+        ...(logo === undefined ? {} : { logo }),
+        redirectUris,
+    };
+}
+function fromHtml(body, base, link) {
+    const root = parseHtml(body);
+    const app = firstApp(itemsIn(root, base));
+    const name = app?.properties['name']?.[0]?.text.trim();
+    const url = app?.properties['url']?.[0]?.text;
+    const logo = logoUrl(app?.properties['logo']?.[0]?.text);
+    const hrefs = linkTargets(link, 'redirect_uri');
+    for (const element of elementsIn(root)) {
+        if ((element.name === 'link' || element.name === 'a') && hasRel(element, 'redirect_uri')) {
+            hrefs.push(element.attributes['href'] ?? '');
+        }
+    }
+    const redirectUris = hrefs.flatMap((href) => URL.parse(href, base)?.href ?? []);
+    return {
+        ...(name === undefined || name === '' ? {} : { name }),
+        ...(url === undefined ? {} : { url }),
+        ...(logo === undefined ? {} : { logo }),
+        redirectUris,
+    };
+}
+/** `value` when it is an absolute http or https URL. */
+function logoUrl(value) {
+    return typeof value === 'string' ? webUrl(value)?.href : undefined;
+}
+function firstApp(items) {
+    for (const item of items) {
+        if (item.types.includes('h-app') || item.types.includes('h-x-app'))
+            return item;
+        const nested = firstApp(item.children);
+        if (nested !== undefined)
+            return nested;
+    }
+    return undefined;
+}
+function sameUrl(value, clientId) {
+    if (typeof value !== 'string')
+        return false;
+    const url = URL.parse(value);
+    return url !== null && url.href === new URL(clientId).href;
+}
+//# sourceMappingURL=client.js.map

package/dist/indieauth/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/indieauth/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,MAAM,+BAA+B,CAAC;AAgBxD,4CAA4C;AAC5C,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAE5C,4DAA4D;AAC5D,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,GAAG,IAAI,CAAC;AAEjD,gDAAgD;AAChD,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,CAAC;AAE/C,0EAA0E;AAC1E,MAAM,SAAS,GACb,yFAAyF,CAAC;AAc5F;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,QAAgB,EAChB,OAA2B;IAE3B,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE;QAC1C,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,uBAAuB;QACvD,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,sBAAsB;QACpD,MAAM,EAAE,mCAAmC;QAC3C,WAAW,EAAE;YACX,OAAO,EAAE,4EAA4E;YACrF,IAAI,EAAE,sCAAsC;SAC7C;KACF,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,qBAAqB,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC;KACvF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAW,EACX,OAA2B;IAE3B,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE;QACrC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,uBAAuB;QACvD,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,qBAAqB;QACnD,MAAM,EAAE,SAAS;QACjB,WAAW,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE;KACtD,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC;IAClC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,WAAW,CAAC;IAC7E,OAAO,QAAQ,IAAI,WAAW,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC/E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAY,EACZ,IAAY,EACZ,QAAgB,EAChB,IAAI,GAAW,QAAQ,EACvB,IAAI,GAAkB,IAAI;IAE1B,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,QAAgB;IAC9C,IAAI,QAAiB,CAAC;IACtB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;IAC9B,CAAC;IACD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;IACnF,MAAM,MAAM,GAAG,QAAmC,CAAC;IACnD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC;QAAE,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;IAEzE,MAAM,IAAI,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IACzC,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACzD,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAiB,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC;QACjF,CAAC,CAAC,EAAE,CAAC;IACP,OAAO;QACL,GAAG,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACvC,YAAY;KACb,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,IAAY,EAAE,IAAmB;IAC/D,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IACvD,MAAM,GAAG,GAAG,GAAG,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;IAC9C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAEzD,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAChD,KAAK,MAAM,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,CAAC;YACzF,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IACD,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;IAEhF,OAAO;QACL,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACtD,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;QACrC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACvC,YAAY;KACb,CAAC;AACJ,CAAC;AAED,wDAAwD;AACxD,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACrE,CAAC;AAED,SAAS,QAAQ,CAAC,KAAiC;IACjD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;QAChF,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC;IAC1C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,OAAO,CAAC,KAAc,EAAE,QAAgB;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC;AAC7D,CAAC"}

package/dist/indieauth/connected-apps.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Users > Connected apps (TASK-162): the apps that hold a token for whoever is
+ * signed in, and the button that cuts one off.
+ *
+ * Only ever your own connections, because a token acts as the person who
+ * approved it. Revoking deletes the connection from `data/indieauth-tokens.json`,
+ * so the access token and the refresh token stop working on the next request.
+ */
+import type { Hono } from 'hono';
+import type { AdminRender } from '../admin/documents.ts';
+import type { GeekityEnv } from '../env.ts';
+/** Where a Revoke button posts. */
+export declare const REVOKE_CONNECTION_PATH = "/admin/users/apps/revoke";
+/** The field a Revoke button submits: the connection's id. */
+export declare const CONNECTION_FIELD = "connection";
+/**
+ * Register the screen and its Revoke button. Mounted before the users
+ * screens, whose `/admin/users/:id` would otherwise answer `apps` with a 404.
+ */
+export declare function mountConnectedApps(app: Hono<GeekityEnv>, options: {
+    render: AdminRender;
+}): void;
+//# sourceMappingURL=connected-apps.d.ts.map

package/dist/indieauth/connected-apps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connected-apps.d.ts","sourceRoot":"","sources":["../../src/indieauth/connected-apps.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAEjC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAMzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAK5C,mCAAmC;AACnC,eAAO,MAAM,sBAAsB,6BAAkC,CAAC;AAEtE,8DAA8D;AAC9D,eAAO,MAAM,gBAAgB,eAAe,CAAC;AAE7C;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,GAAG,IAAI,CAgChG"}

package/dist/indieauth/connected-apps.js

@@ -0,0 +1,73 @@
+/**
+ * Users > Connected apps (TASK-162): the apps that hold a token for whoever is
+ * signed in, and the button that cuts one off.
+ *
+ * Only ever your own connections, because a token acts as the person who
+ * approved it. Revoking deletes the connection from `data/indieauth-tokens.json`,
+ * so the access token and the refresh token stop working on the next request.
+ */
+import { flash } from '../admin/flash.js';
+import { formatInTimezone } from '../admin/formatting.js';
+import { readSiteSettings } from '../admin/settings.js';
+import { ADMIN_TEMPLATES } from '../admin/templates.js';
+import { CONNECTED_APPS_CHILD, CONNECTED_APPS_PATH } from '../admin/users.js';
+import { SCOPE_LABELS } from './consent.js';
+import { listTokens, revokeConnection } from './tokens.js';
+/** Where a Revoke button posts. */
+export const REVOKE_CONNECTION_PATH = `${CONNECTED_APPS_PATH}/revoke`;
+/** The field a Revoke button submits: the connection's id. */
+export const CONNECTION_FIELD = 'connection';
+/**
+ * Register the screen and its Revoke button. Mounted before the users
+ * screens, whose `/admin/users/:id` would otherwise answer `apps` with a 404.
+ */
+export function mountConnectedApps(app, options) {
+    const { render } = options;
+    app.get(CONNECTED_APPS_PATH, (c) => {
+        const { config } = c.var;
+        const userId = c.var.session?.userId;
+        const timezone = readSiteSettings(config.contentDir).timezone;
+        const now = config.now().getTime();
+        const connections = listTokens(config.dataDir)
+            .filter((token) => token.userId === userId && Date.parse(token.refreshExpiresAt) > now)
+            .sort((a, b) => b.issuedAt.localeCompare(a.issuedAt))
+            .map((token) => row(token, timezone));
+        return render(c, ADMIN_TEMPLATES.connectedApps, {
+            section: 'users',
+            child: CONNECTED_APPS_CHILD,
+            revokeUrl: REVOKE_CONNECTION_PATH,
+            connectionField: CONNECTION_FIELD,
+            connections,
+        });
+    });
+    app.post(REVOKE_CONNECTION_PATH, async (c) => {
+        const { config, session } = c.var;
+        const id = (await c.req.parseBody())[CONNECTION_FIELD];
+        const revoked = typeof id === 'string' && session?.userId != null
+            ? await revokeConnection(config.dataDir, session.userId, id, config.now())
+            : undefined;
+        if (revoked === undefined)
+            flash(c, 'warning', 'That app was already disconnected.');
+        else
+            flash(c, 'notice', `${clientLabel(revoked)} can no longer act as you.`);
+        return c.redirect(CONNECTED_APPS_PATH, 303);
+    });
+}
+/** One connection as the table shows it. */
+function row(token, timezone) {
+    const when = (instant) => ({ iso: instant, text: formatInTimezone(instant, timezone) });
+    return {
+        id: token.id,
+        name: clientLabel(token),
+        url: token.clientId,
+        scopes: token.scopes.map((scope) => SCOPE_LABELS[scope]),
+        issued: when(token.issuedAt),
+        lastUsed: token.lastUsedAt === undefined ? undefined : when(token.lastUsedAt),
+        expires: when(token.refreshExpiresAt),
+    };
+}
+/** What to call a client: its own name, or its URL when it gave none. */
+function clientLabel(token) {
+    return token.clientName ?? token.clientId;
+}
+//# sourceMappingURL=connected-apps.js.map

package/dist/indieauth/connected-apps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connected-apps.js","sourceRoot":"","sources":["../../src/indieauth/connected-apps.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAE9E,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAG3D,mCAAmC;AACnC,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,mBAAmB,SAAS,CAAC;AAEtE,8DAA8D;AAC9D,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAC;AAE7C;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAqB,EAAE,OAAgC;IACxF,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAE3B,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC,CAAC,EAAE,EAAE;QACjC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC;QACzB,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC;QACrC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC;QAC9D,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;QACnC,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC;aAC3C,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,gBAAgB,CAAC,GAAG,GAAG,CAAC;aACtF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;aACpD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;QACxC,OAAO,MAAM,CAAC,CAAC,EAAE,eAAe,CAAC,aAAa,EAAE;YAC9C,OAAO,EAAE,OAAO;YAChB,KAAK,EAAE,oBAAoB;YAC3B,SAAS,EAAE,sBAAsB;YACjC,eAAe,EAAE,gBAAgB;YACjC,WAAW;SACZ,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,sBAAsB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3C,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC;QAClC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,gBAAgB,CAAC,CAAC;QACvD,MAAM,OAAO,GACX,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,MAAM,IAAI,IAAI;YAC/C,CAAC,CAAC,MAAM,gBAAgB,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;YAC1E,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,OAAO,KAAK,SAAS;YAAE,KAAK,CAAC,CAAC,EAAE,SAAS,EAAE,oCAAoC,CAAC,CAAC;;YAChF,KAAK,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,WAAW,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC;QAC7E,OAAO,CAAC,CAAC,QAAQ,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,4CAA4C;AAC5C,SAAS,GAAG,CAAC,KAAkB,EAAE,QAAgB;IAC/C,MAAM,IAAI,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;IAChG,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,IAAI,EAAE,WAAW,CAAC,KAAK,CAAC;QACxB,GAAG,EAAE,KAAK,CAAC,QAAQ;QACnB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACxD,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC5B,QAAQ,EAAE,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;QAC7E,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC;KACtC,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,SAAS,WAAW,CAAC,KAAkB;IACrC,OAAO,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,QAAQ,CAAC;AAC5C,CAAC"}

package/dist/indieauth/consent.d.ts

@@ -0,0 +1,28 @@
+import type { Hono } from 'hono';
+import type { AdminRender } from '../admin/documents.ts';
+import type { GeekityEnv } from '../env.ts';
+import type { Scope } from './request.ts';
+/**
+ * Where the person approves or denies a sign-in. Under `/admin`, so the admin
+ * guard signs them in first and checks the form's CSRF token.
+ */
+export declare const CONSENT_PATH = "/admin/indieauth/consent";
+/** What each scope lets a client learn or do, as the consent and connected apps screens say it. */
+export declare const SCOPE_LABELS: Readonly<Record<Scope, string>>;
+/**
+ * The authorization endpoint (TASK-158, TASK-159).
+ *
+ * A GET is the person arriving from a client, and is handed, query and all,
+ * to the consent screen. The screen is under `/admin` so that the admin's
+ * guard, login and headers apply to it; the endpoint is not, because a POST
+ * here is a client redeeming its code for the profile, with no admin session.
+ * No access token is issued on this path; that is the token endpoint's job.
+ * Not exempt from maintenance mode: the identity URLs that advertise it
+ * answer 503 then too.
+ */
+export declare function mountAuthorizationEndpoint(app: Hono<GeekityEnv>): void;
+/** Register the consent screen and the Approve and Deny buttons behind it. */
+export declare function mountConsentScreen(app: Hono<GeekityEnv>, options: {
+    render: AdminRender;
+}): void;
+//# sourceMappingURL=consent.d.ts.map

package/dist/indieauth/consent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent.d.ts","sourceRoot":"","sources":["../../src/indieauth/consent.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,IAAI,EAAE,MAAM,MAAM,CAAC;AAI1C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAIzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAQ5C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAE1C;;;GAGG;AACH,eAAO,MAAM,YAAY,6BAAsC,CAAC;AAEhE,mGAAmG;AACnG,eAAO,MAAM,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAOxD,CAAC;AAEF;;;;;;;;;;GAUG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,CAwBtE;AAED,8EAA8E;AAC9E,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,GAAG,IAAI,CA6GhG"}

package/dist/indieauth/consent.js

@@ -0,0 +1,185 @@
+import { findUserById, listUsers } from '../admin/accounts.js';
+import { ADMIN_PREFIX } from '../admin/session.js';
+import { effectiveBaseUrl, readSiteSettings } from '../admin/settings.js';
+import { ADMIN_TEMPLATES } from '../admin/templates.js';
+import { isPrivateHost } from '../webmention/public-address.js';
+import { fetchClientInformation, fetchClientLogo } from './client.js';
+import { AUTHORIZATION_PATH, authorizationServerMetadata } from './discovery.js';
+import { meForSignIn } from './identity.js';
+import { profileResponse, redeemCode, redemptionForm } from './redeem.js';
+import { parseAuthorizationRequest } from './request.js';
+/**
+ * Where the person approves or denies a sign-in. Under `/admin`, so the admin
+ * guard signs them in first and checks the form's CSRF token.
+ */
+export const CONSENT_PATH = `${ADMIN_PREFIX}/indieauth/consent`;
+/** What each scope lets a client learn or do, as the consent and connected apps screens say it. */
+export const SCOPE_LABELS = {
+    profile: 'Your name, URL and photo',
+    email: 'Your email address',
+    create: 'Create posts as you',
+    update: 'Edit your posts',
+    delete: 'Delete your posts',
+    media: 'Upload media to your site',
+};
+/**
+ * The authorization endpoint (TASK-158, TASK-159).
+ *
+ * A GET is the person arriving from a client, and is handed, query and all,
+ * to the consent screen. The screen is under `/admin` so that the admin's
+ * guard, login and headers apply to it; the endpoint is not, because a POST
+ * here is a client redeeming its code for the profile, with no admin session.
+ * No access token is issued on this path; that is the token endpoint's job.
+ * Not exempt from maintenance mode: the identity URLs that advertise it
+ * answer 503 then too.
+ */
+export function mountAuthorizationEndpoint(app) {
+    app.get(AUTHORIZATION_PATH, (c) => c.redirect(`${CONSENT_PATH}${new URL(c.req.url).search}`, 302));
+    app.post(AUTHORIZATION_PATH, async (c) => {
+        c.header('cache-control', 'no-store');
+        const { config } = c.var;
+        const form = redemptionForm(await c.req.parseBody());
+        const redeemed = redeemCode(c.var.indieauth.codes, form);
+        if (!redeemed.ok) {
+            return c.json({ error: redeemed.error, error_description: redeemed.description }, 400);
+        }
+        const { grant } = redeemed;
+        const user = findUserById(config.dataDir, grant.userId);
+        if (user === undefined) {
+            return c.json({ error: 'invalid_grant', error_description: 'The person who approved this is gone.' }, 400);
+        }
+        const baseUrl = effectiveBaseUrl(config, readSiteSettings(config.contentDir));
+        return c.json(profileResponse(grant, user, baseUrl));
+    });
+}
+/** Register the consent screen and the Approve and Deny buttons behind it. */
+export function mountConsentScreen(app, options) {
+    const { render } = options;
+    function refuse(c, message) {
+        c.status(400);
+        return render(c, ADMIN_TEMPLATES.indieauthRefused, { message });
+    }
+    app.get(CONSENT_PATH, async (c) => {
+        const { config } = c.var;
+        const user = signedInUser(c);
+        if (user === undefined)
+            return c.redirect(ADMIN_PREFIX, 302);
+        const settings = readSiteSettings(config.contentDir);
+        const baseUrl = effectiveBaseUrl(config, settings);
+        const parsed = parseAuthorizationRequest(new URL(c.req.url).searchParams, baseUrl);
+        if (parsed.kind === 'unredirectable')
+            return refuse(c, parsed.message);
+        const { clientId, redirectUri } = parsed.kind === 'valid' ? parsed.request : parsed;
+        const client = await clientInformation(c, clientId);
+        if (!mayRedirect(clientId, redirectUri, client)) {
+            return refuse(c, 'The app asked to send you back to an address it has not published as its own.');
+        }
+        if (parsed.kind === 'refused') {
+            return c.redirect(answer(redirectUri, baseUrl, {
+                error: parsed.error,
+                error_description: parsed.description,
+                state: parsed.state,
+            }), 302);
+        }
+        const { request } = parsed;
+        const me = meForSignIn(request.me, user, {
+            baseUrl,
+            users: listUsers(config.dataDir),
+            settings,
+        });
+        const pending = c.var.indieauth.consents.put({
+            request,
+            userId: user.id,
+            me,
+            ...(client.name === undefined ? {} : { clientName: client.name }),
+        });
+        const redirect = new URL(redirectUri);
+        const logo = client.logo === undefined
+            ? undefined
+            : await fetchClientLogo(client.logo, { lookup: config.hostLookup });
+        c.set('cspFormAction', formActionSource(redirect));
+        return render(c, ADMIN_TEMPLATES.indieauthConsent, {
+            consentUrl: CONSENT_PATH,
+            pending,
+            client: {
+                name: client.name ?? clientId,
+                id: clientId,
+                named: client.name !== undefined,
+                logo,
+            },
+            redirectHost: redirect.host === '' ? redirect.protocol : redirect.host,
+            loopback: redirect.hostname !== '' && isPrivateHost(redirect.hostname),
+            identity: me,
+            resource: request.resource,
+            scopes: request.scopes.map((scope) => ({ name: scope, label: SCOPE_LABELS[scope] })),
+        });
+    });
+    app.post(CONSENT_PATH, async (c) => {
+        const { config } = c.var;
+        const user = signedInUser(c);
+        if (user === undefined)
+            return c.redirect(ADMIN_PREFIX, 302);
+        const body = await c.req.parseBody({ all: true });
+        const pending = c.var.indieauth.consents.take(text(body['request']));
+        if (pending?.userId !== user.id) {
+            return refuse(c, 'This sign-in was already answered or has expired. Start again from the app.');
+        }
+        const { request } = pending;
+        const baseUrl = effectiveBaseUrl(config, readSiteSettings(config.contentDir));
+        if (text(body['decision']) !== 'approve') {
+            return c.redirect(answer(request.redirectUri, baseUrl, { error: 'access_denied', state: request.state }), 303);
+        }
+        const ticked = new Set([body['scope']].flat().map(text));
+        const code = c.var.indieauth.codes.put({
+            clientId: request.clientId,
+            ...(pending.clientName === undefined ? {} : { clientName: pending.clientName }),
+            redirectUri: request.redirectUri,
+            codeChallenge: request.codeChallenge,
+            userId: user.id,
+            me: pending.me,
+            scopes: request.scopes.filter((scope) => ticked.has(scope)),
+            ...(request.resource === undefined ? {} : { resource: request.resource }),
+        });
+        return c.redirect(answer(request.redirectUri, baseUrl, { code, state: request.state }), 303);
+    });
+}
+function signedInUser(c) {
+    const userId = c.var.session?.userId;
+    return userId == null ? undefined : findUserById(c.var.config.dataDir, userId);
+}
+/** What the client says about itself, or nothing when it could not be read. */
+async function clientInformation(c, clientId) {
+    const fetched = await fetchClientInformation(clientId, { lookup: c.var.config.hostLookup });
+    if (fetched.ok)
+        return fetched.client;
+    console.warn(`Could not read IndieAuth client ${clientId}: ${fetched.reason}`);
+    return { redirectUris: [] };
+}
+/**
+ * Whether a client may be sent back to `redirectUri`: always on its own
+ * origin, and elsewhere only when its metadata lists that exact URL.
+ */
+function mayRedirect(clientId, redirectUri, client) {
+    const target = new URL(redirectUri);
+    const sameOrigin = (target.protocol === 'https:' || target.protocol === 'http:') &&
+        target.origin === new URL(clientId).origin;
+    return sameOrigin || client.redirectUris.includes(redirectUri);
+}
+/** `redirectUri` with the answer and the issuer added to its query. */
+function answer(redirectUri, baseUrl, fields) {
+    const url = new URL(redirectUri);
+    for (const [name, value] of Object.entries(fields)) {
+        if (value !== undefined)
+            url.searchParams.set(name, value);
+    }
+    url.searchParams.set('iss', authorizationServerMetadata(baseUrl).issuer);
+    return url.href;
+}
+/** The CSP source that lets a form's redirect reach `url`. */
+function formActionSource(url) {
+    return url.protocol === 'https:' || url.protocol === 'http:' ? url.origin : url.protocol;
+}
+function text(value) {
+    return typeof value === 'string' ? value : '';
+}
+//# sourceMappingURL=consent.js.map

package/dist/indieauth/consent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent.js","sourceRoot":"","sources":["../../src/indieauth/consent.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAG/D,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEtE,OAAO,EAAE,kBAAkB,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AACjF,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC1E,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAGzD;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,GAAG,YAAY,oBAAoB,CAAC;AAEhE,mGAAmG;AACnG,MAAM,CAAC,MAAM,YAAY,GAAoC;IAC3D,OAAO,EAAE,0BAA0B;IACnC,KAAK,EAAE,oBAAoB;IAC3B,MAAM,EAAE,qBAAqB;IAC7B,MAAM,EAAE,iBAAiB;IACzB,MAAM,EAAE,mBAAmB;IAC3B,KAAK,EAAE,2BAA2B;CACnC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,0BAA0B,CAAC,GAAqB;IAC9D,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,CAAC,EAAE,EAAE,CAChC,CAAC,CAAC,QAAQ,CAAC,GAAG,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAC/D,CAAC;IAEF,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvC,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACtC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC;QACzB,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACzD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,iBAAiB,EAAE,QAAQ,CAAC,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC;QAC3B,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACxD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,uCAAuC,EAAE,EACtF,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QAC9E,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,kBAAkB,CAAC,GAAqB,EAAE,OAAgC;IACxF,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAE3B,SAAS,MAAM,CAAC,CAAsB,EAAE,OAAe;QACrD,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,MAAM,CAAC,CAAC,EAAE,eAAe,CAAC,gBAAgB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC;QACzB,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAEnD,MAAM,MAAM,GAAG,yBAAyB,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACnF,IAAI,MAAM,CAAC,IAAI,KAAK,gBAAgB;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACvE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;QACpF,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC;YAChD,OAAO,MAAM,CACX,CAAC,EACD,+EAA+E,CAChF,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,CAAC,CAAC,QAAQ,CACf,MAAM,CAAC,WAAW,EAAE,OAAO,EAAE;gBAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,iBAAiB,EAAE,MAAM,CAAC,WAAW;gBACrC,KAAK,EAAE,MAAM,CAAC,KAAK;aACpB,CAAC,EACF,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;QAC3B,MAAM,EAAE,GAAG,WAAW,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE;YACvC,OAAO;YACP,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC;YAChC,QAAQ;SACT,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC3C,OAAO;YACP,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,EAAE;YACF,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;SAClE,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACtC,MAAM,IAAI,GACR,MAAM,CAAC,IAAI,KAAK,SAAS;YACvB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,MAAM,eAAe,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;QAExE,CAAC,CAAC,GAAG,CAAC,eAAe,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;QACnD,OAAO,MAAM,CAAC,CAAC,EAAE,eAAe,CAAC,gBAAgB,EAAE;YACjD,UAAU,EAAE,YAAY;YACxB,OAAO;YACP,MAAM,EAAE;gBACN,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,QAAQ;gBAC7B,EAAE,EAAE,QAAQ;gBACZ,KAAK,EAAE,MAAM,CAAC,IAAI,KAAK,SAAS;gBAChC,IAAI;aACL;YACD,YAAY,EAAE,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI;YACtE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,KAAK,EAAE,IAAI,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACtE,QAAQ,EAAE,EAAE;YACZ,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;SACrF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC;QACzB,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;QAElD,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACrE,IAAI,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC,EAAE,EAAE,CAAC;YAChC,OAAO,MAAM,CACX,CAAC,EACD,6EAA6E,CAC9E,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QAC5B,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QAC9E,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;YACzC,OAAO,CAAC,CAAC,QAAQ,CACf,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,EACtF,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC;YACrC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;YAC/E,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC3D,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;SAC1E,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/F,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,CAAsB;IAC1C,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC;IACrC,OAAO,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACjF,CAAC;AAED,+EAA+E;AAC/E,KAAK,UAAU,iBAAiB,CAC9B,CAAsB,EACtB,QAAgB;IAEhB,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IAC5F,IAAI,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC;IACtC,OAAO,CAAC,IAAI,CAAC,mCAAmC,QAAQ,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/E,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,QAAgB,EAAE,WAAmB,EAAE,MAAyB;IACnF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACpC,MAAM,UAAU,GACd,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC;QAC7D,MAAM,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;IAC7C,OAAO,UAAU,IAAI,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACjE,CAAC;AAED,uEAAuE;AACvE,SAAS,MAAM,CACb,WAAmB,EACnB,OAAe,EACf,MAA0C;IAE1C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,IAAI,KAAK,KAAK,SAAS;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC7D,CAAC;IACD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,2BAA2B,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC;IACzE,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,8DAA8D;AAC9D,SAAS,gBAAgB,CAAC,GAAQ;IAChC,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;AAC3F,CAAC;AAED,SAAS,IAAI,CAAC,KAAc;IAC1B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC"}