@grest-ts/oauth 0.0.0-stage → 0.0.89

package/dist/src/node/GGOAuthServer.js

@@ -0,0 +1,417 @@
+import { createECDH, createHash, hkdfSync, randomBytes } from "node:crypto";
+import Provider, { errors as oidcErrors } from "oidc-provider";
+import { NOT_FOUND } from "@grest-ts/schema";
+import { toOidcAdapter } from "./store/GGOAuthStore.js";
+const BASE = "/oauth";
+const OIDC_SCOPES = ["openid", "offline_access"];
+const TICKET = "GGOAuthTicket";
+// Claims resolved during a refresh before the presented token was consumed (see rotateRefreshToken).
+const prefetchedClaims = new WeakMap();
+// OAuth 2.1 authorization server on a GGHttpServer. Protocol (PKCE, DCR, CIMD, resource indicators,
+// RFC 9207 iss, refresh rotation + reuse revocation, revocation, discovery) is panva oidc-provider;
+// this class owns the grest-ts seams: mounting, storage, token claims and the login/consent handoff.
+export class GGOAuthServer {
+    _provider;
+    _callback;
+    _firstParty;
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    get firstParty() {
+        this._firstParty ??= new Map((this.options.firstPartyClients?.() ?? []).map(c => [c.clientId, c]));
+        return this._firstParty;
+    }
+    mount(server) {
+        const handle = async (req, res) => {
+            const path = new URL(req.url ?? "/", "http://x").pathname;
+            const interaction = path.match(/^\/oauth\/interaction\/([^/]+)(\/complete)?$/);
+            if (interaction && req.method === "GET") {
+                if (interaction[2])
+                    return this.finishInteraction(req, res, interaction[1]);
+                const found = await this.provider().Interaction.find(interaction[1]);
+                if (!found) {
+                    res.writeHead(400, { "content-type": "text/plain" });
+                    res.end("Sign-in request expired");
+                    return;
+                }
+                const firstParty = this.firstParty.has(String(found.params.client_id));
+                res.writeHead(303, { location: this.options.interactionUrl(interaction[1], { redirectUri: String(found.params.redirect_uri), firstParty }) });
+                res.end();
+                return;
+            }
+            this._callback ??= this.provider().callback();
+            await this._callback(req, res);
+        };
+        for (const method of ["GET", "POST"])
+            server.registerRoute(method, `${BASE}/*`, handle, "GGOAuthServer");
+        server.registerRoute("GET", "/.well-known/openid-configuration", handle, "GGOAuthServer");
+        server.registerRoute("GET", "/.well-known/oauth-authorization-server", handle, "GGOAuthServer");
+        server.announce(`${BASE}/`, "GGOAuthServer");
+        server.announce("/.well-known/openid-configuration", "GGOAuthServer");
+        server.announce("/.well-known/oauth-authorization-server", "GGOAuthServer");
+    }
+    // Serves `path` as an OAuth-protected resource: requests without a valid token for `resource` get
+    // 401 + `WWW-Authenticate: Bearer resource_metadata=…`, and its RFC 9728 metadata is published —
+    // the discovery handshake MCP clients run before signing in.
+    protect(server, resource, path, handle) {
+        const metadataPath = `/.well-known/oauth-protected-resource${path}`;
+        server.registerRoute("GET", metadataPath, async (_req, res) => {
+            res.writeHead(200, { "content-type": "application/json" });
+            res.end(JSON.stringify({
+                resource: resource.resource(),
+                authorization_servers: [this.options.issuer()],
+                scopes_supported: resource.scopes,
+                bearer_methods_supported: ["header"],
+            }));
+        }, "GGOAuthServer");
+        const guarded = async (req, res) => {
+            const auth = req.headers.authorization;
+            const token = auth?.toLowerCase().startsWith("bearer ")
+                ? await resource.accessToken.verify(auth.slice(7)).catch(() => undefined)
+                : undefined;
+            if (!token) {
+                const metadataUrl = `${new URL(resource.resource()).origin}${metadataPath}`;
+                res.writeHead(401, {
+                    "www-authenticate": `Bearer resource_metadata="${metadataUrl}", scope="${resource.scopes.join(" ")}"${auth ? `, error="invalid_token"` : ""}`,
+                });
+                res.end();
+                return;
+            }
+            await handle(req, res, token);
+        };
+        for (const method of ["GET", "POST", "DELETE"])
+            server.registerRoute(method, path, guarded, "GGOAuthServer");
+        server.announce(path, "GGOAuthServer");
+        server.announce(metadataPath, "GGOAuthServer");
+    }
+    // Implementation of GGOAuthInteractionContract; `subject` reads the signed-in user from the app's wire.
+    interactionApi(subject) {
+        return {
+            get: async ({ uid }) => this.describeInteraction(uid),
+            approve: async ({ uid }) => ({ redirectUrl: await this.approve(uid, subject()) }),
+            deny: async ({ uid }) => ({ redirectUrl: await this.ticket(await this.findInteraction(uid), { error: "access_denied", error_description: "The user denied the request" }) }),
+        };
+    }
+    listGrants = async (subject) => {
+        const p = this.provider();
+        const grants = await Promise.all((await this.options.store.listIdsByAccount("Grant", subject)).map(id => p.Grant.find(id)));
+        return await Promise.all(grants
+            .filter(g => g?.clientId && g.accountId === subject)
+            .map(async (g) => ({
+            grantId: g.jti,
+            clientId: g.clientId,
+            // A client metadata document may be unreachable; the grant must still be listed (and revocable).
+            clientName: String((await p.Client.find(g.clientId).catch(() => undefined))?.clientName ?? g.clientId),
+            createdAt: (g.iat ?? 0) * 1000,
+        })));
+    };
+    // Kills the grant's refresh tokens and codes now; already-issued access tokens live out their TTL.
+    revokeGrant = async (subject, grantId) => {
+        const grant = await this.provider().Grant.find(grantId);
+        if (!grant || grant.accountId !== subject)
+            throw new NOT_FOUND();
+        await this.options.store.revokeByGrantId(grantId);
+        // The grant row carries its id as jti, not grantId, so revokeByGrantId leaves it.
+        await this.options.store.destroy("Grant", grantId);
+    };
+    // "Log out everywhere": every grant and login session of the subject.
+    revokeAll = async (subject) => {
+        const store = this.options.store;
+        const [grantIds, sessionIds] = await Promise.all([store.listIdsByAccount("Grant", subject), store.listIdsByAccount("Session", subject)]);
+        await Promise.all([
+            ...grantIds.map(id => Promise.all([store.revokeByGrantId(id), store.destroy("Grant", id)])),
+            ...sessionIds.map(id => store.destroy("Session", id)),
+        ]);
+    };
+    async describeInteraction(uid) {
+        const interaction = await this.findInteraction(uid);
+        const clientId = String(interaction.params.client_id);
+        const client = await this.provider().Client.find(clientId);
+        if (!client)
+            throw new NOT_FOUND({ debugMessage: "Unknown OAuth client" });
+        const hosts = [...new Set((client.redirectUris ?? []).map(u => new URL(u).host))];
+        return {
+            uid,
+            client: {
+                clientId,
+                name: this.firstParty.get(clientId)?.name ?? String(client.clientName ?? clientId),
+                firstParty: this.firstParty.has(clientId),
+                redirectHosts: hosts,
+                loopbackOnly: hosts.length > 0 && hosts.every(h => /^(localhost|127\.0\.0\.1|\[::1\])(:\d+)?$/.test(h)),
+            },
+            scopes: requestedScopes(interaction.params),
+            resource: this.requestedResource(interaction.params, clientId).resource(),
+        };
+    }
+    async approve(uid, subject) {
+        const p = this.provider();
+        const interaction = await this.findInteraction(uid);
+        const clientId = String(interaction.params.client_id);
+        const existing = interaction.grantId ? await p.Grant.find(interaction.grantId) : undefined;
+        const grant = existing?.accountId === subject ? existing : new p.Grant({ accountId: subject, clientId });
+        this.grantRequested(grant, interaction.params);
+        const grantId = await grant.save();
+        return this.ticket(interaction, { login: { accountId: subject }, consent: { grantId } });
+    }
+    async findInteraction(uid) {
+        const interaction = await this.provider().Interaction.find(uid);
+        if (!interaction)
+            throw new NOT_FOUND({ debugMessage: "Unknown or expired OAuth interaction" });
+        return interaction;
+    }
+    // The result is applied only when the browser that started the flow (it holds the interaction
+    // cookie) follows the redirect: a user approving someone else's flow can't hand them a code.
+    async ticket(interaction, result) {
+        const uid = interaction.uid;
+        const id = randomBytes(24).toString("base64url");
+        await this.options.store.upsert(TICKET, id, { uid, result }, 120);
+        // Back to the origin the browser started on (its interaction cookie lives there) — but only a
+        // known one: returnTo comes from the request's Host, which a client can set to its own server.
+        const started = new URL(interaction.returnTo).origin;
+        const known = [this.options.issuer(), ...(this.options.origins?.() ?? [])].map(o => new URL(o).origin);
+        return `${known.includes(started) ? started : known[0]}${BASE}/interaction/${uid}/complete?ticket=${id}`;
+    }
+    async finishInteraction(req, res, uid) {
+        const id = new URL(req.url ?? "/", "http://x").searchParams.get("ticket") ?? "";
+        const ticket = id ? await this.options.store.find(TICKET, id) : undefined;
+        if (id)
+            await this.options.store.destroy(TICKET, id);
+        if (!ticket || ticket.uid !== uid) {
+            res.writeHead(400, { "content-type": "text/plain" });
+            res.end("Invalid or expired sign-in link");
+            return;
+        }
+        try {
+            await this.provider().interactionFinished(req, res, ticket.result, { mergeWithLastSubmission: false });
+        }
+        catch (err) {
+            if (!(err instanceof oidcErrors.SessionNotFound))
+                throw err;
+            res.writeHead(400, { "content-type": "text/plain" });
+            res.end("This sign-in was started in another browser");
+        }
+    }
+    grantRequested(grant, params) {
+        const requested = requestedScopes(params);
+        const oidc = requested.filter(s => OIDC_SCOPES.includes(s));
+        if (oidc.length)
+            grant.addOIDCScope(oidc.join(" "));
+        const resource = this.requestedResource(params, String(grant.clientId));
+        const resourceScopes = requested.filter(s => resource.scopes.includes(s));
+        if (resourceScopes.length)
+            grant.addResourceScope(resource.resource(), resourceScopes.join(" "));
+    }
+    requestedResource(params, clientId) {
+        const indicator = typeof params.resource === "string" ? params.resource : undefined;
+        return (indicator && this.resource(indicator)) || this.defaultResource(clientId);
+    }
+    resource(indicator) {
+        return this.options.resources.find(r => r.resource() === indicator);
+    }
+    clientOf(ctx) {
+        const client = ctx.oidc.client;
+        return { clientId: client.clientId, name: this.firstParty.get(client.clientId)?.name ?? String(client.clientName ?? client.clientId) };
+    }
+    usableResource(indicator, clientId) {
+        const resource = this.resource(indicator);
+        if (!resource)
+            throw new oidcErrors.InvalidTarget();
+        if (resource.firstPartyOnly && !this.firstParty.has(clientId))
+            throw new oidcErrors.InvalidTarget("resource not available to this client");
+        return resource;
+    }
+    defaultResource(clientId) {
+        const firstParty = this.firstParty.has(clientId);
+        return this.options.resources.find(r => firstParty || !r.firstPartyOnly) ?? this.options.resources[0];
+    }
+    provider() {
+        if (this._provider)
+            return this._provider;
+        const o = this.options;
+        const refreshTtlSec = o.refreshTtlSec ?? 30 * 24 * 3600;
+        const firstParty = this.firstParty;
+        const config = {
+            adapter: toOidcAdapter(o.store),
+            jwks: { keys: [deriveEs256Jwk(o.secret())] },
+            cookies: { keys: [hkdf(o.secret(), "@grest-ts/oauth cookies").toString("base64url")] },
+            clients: [...firstParty.values()].map(c => ({
+                client_id: c.clientId,
+                client_name: c.name,
+                redirect_uris: c.redirectUris,
+                post_logout_redirect_uris: c.postLogoutRedirectUris ?? [],
+                token_endpoint_auth_method: "none",
+                grant_types: ["authorization_code", "refresh_token"],
+                response_types: ["code"],
+                application_type: "web",
+            })),
+            clientDefaults: {
+                grant_types: ["authorization_code", "refresh_token"],
+                response_types: ["code"],
+                token_endpoint_auth_method: "none",
+                id_token_signed_response_alg: "ES256",
+                // Undeclared = native: CLI clients (e.g. Claude Code's metadata document) redirect to a
+                // loopback address on a per-run port, which oidc-provider only port-matches for native.
+                application_type: "native",
+            },
+            routes: {
+                authorization: `${BASE}/authorize`, token: `${BASE}/token`, registration: `${BASE}/register`,
+                jwks: `${BASE}/jwks`, revocation: `${BASE}/revoke`, end_session: `${BASE}/logout`, userinfo: `${BASE}/userinfo`,
+                introspection: `${BASE}/introspect`, pushed_authorization_request: `${BASE}/par`, code_verification: `${BASE}/device`,
+                device_authorization: `${BASE}/device/auth`, backchannel_authentication: `${BASE}/backchannel`, challenge: `${BASE}/challenge`,
+            },
+            interactions: { url: (_ctx, interaction) => `${BASE}/interaction/${interaction.uid}` },
+            scopes: OIDC_SCOPES,
+            responseTypes: ["code"],
+            pkce: { required: () => true },
+            features: {
+                devInteractions: { enabled: false },
+                revocation: { enabled: true },
+                registration: { enabled: !!o.dynamicRegistration },
+                ...(o.clientIdMetadataDocument ? { clientIdMetadataDocument: {
+                        enabled: true,
+                        ack: "draft-02",
+                        allowFetch: async (_ctx, clientId) => o.clientIdMetadataDocument.allowedHosts().includes(new URL(clientId).hostname),
+                    } } : {}),
+                rpInitiatedLogout: {
+                    enabled: true,
+                    // Skip the provider's "do you want to sign out?" page. `logout=yes` is that page's
+                    // button value: without it only the requesting client is signed out, not the session.
+                    logoutSource: async (ctx, form) => {
+                        if (!form.includes("</form>"))
+                            throw new Error("GGOAuthServer: oidc-provider's logout form changed; can't confirm logout");
+                        // Any page can link here; only a first-party client's own page (its redirect origin as
+                        // Referer) skips the confirmation click.
+                        const client = ctx.oidc.client && firstParty.get(ctx.oidc.client.clientId);
+                        const referer = URL.parse(ctx.get("referer"))?.origin;
+                        if (client && referer && client.redirectUris.some(u => new URL(u).origin === referer)) {
+                            const confirmed = form.replace("</form>", `<input type="hidden" name="logout" value="yes"/></form>`);
+                            ctx.body = `<!DOCTYPE html><html><body>${confirmed}<script>document.forms[0].submit()</script></body></html>`;
+                            return;
+                        }
+                        ctx.body = `<!DOCTYPE html><html><body>${form.replace("</form>", `<button name="logout" value="yes">Sign out</button></form>`)}</body></html>`;
+                    },
+                },
+                resourceIndicators: {
+                    enabled: true,
+                    defaultResource: (_ctx, client) => this.defaultResource(client.clientId).resource(),
+                    useGrantedResource: () => true,
+                    getResourceServerInfo: (_ctx, indicator, client) => {
+                        const resource = this.usableResource(indicator, client.clientId);
+                        const jws = resource.accessToken.signer.jwsKey?.();
+                        if (!jws)
+                            throw new Error("GGOAuthServer: a resource's accessToken signer must implement jwsKey() (e.g. HmacSigner)");
+                        return {
+                            scope: resource.scopes.join(" "),
+                            audience: resource.accessToken.audience ?? indicator,
+                            accessTokenTTL: Math.floor(resource.accessToken.accessTtlMs / 1000),
+                            accessTokenFormat: "jwt",
+                            jwt: { sign: { alg: jws.alg, key: Buffer.from(jws.key) } },
+                        };
+                    },
+                },
+            },
+            // First-party clients never see a consent screen: an existing login session is enough.
+            loadExistingGrant: async (ctx) => {
+                const client = ctx.oidc.client;
+                const session = ctx.oidc.session;
+                const grantId = ctx.oidc.result?.consent?.grantId || session.grantIdFor(client.clientId);
+                if (grantId)
+                    return ctx.oidc.provider.Grant.find(grantId);
+                if (!firstParty.has(client.clientId) || !session.accountId)
+                    return undefined;
+                const grant = new ctx.oidc.provider.Grant({ accountId: session.accountId, clientId: client.clientId });
+                this.grantRequested(grant, ctx.oidc.params);
+                await grant.save();
+                session.ensureClientContainer(client.clientId);
+                session.grantIdFor(client.clientId, grant.jti);
+                return grant;
+            },
+            // MCP clients don't reliably request offline_access; every code-flow client gets a refresh token.
+            issueRefreshToken: async (_ctx, client) => client.grantTypeAllowed("refresh_token"),
+            // Only first-party sign-ins end with the login session: signing out of the app must not
+            // disconnect the other apps the user connected (revoked explicitly instead).
+            expiresWithSession: async (ctx) => firstParty.has(ctx.oidc.client.clientId),
+            // Runs before the presented refresh token is consumed. Resolve the claims here, so a failure
+            // (store/IdP down) leaves it redeemable — after consumption, the client's retry is reuse and
+            // revokes the grant.
+            rotateRefreshToken: async (ctx) => {
+                const rt = ctx.oidc.entities.RefreshToken;
+                const clientId = String(rt.clientId);
+                // Which resource the new access token will be for, as oidc-provider resolves it (the
+                // request's resource first, then the granted one), validated now rather than after consume.
+                const granted = [rt.resource ?? []].flat();
+                const requested = ctx.oidc.params?.resource;
+                if (typeof requested === "string" && !granted.includes(requested))
+                    throw new oidcErrors.InvalidTarget();
+                const indicator = typeof requested === "string" ? requested : granted.length === 1 ? granted[0] : undefined;
+                const resource = indicator ? this.usableResource(indicator, clientId) : this.defaultResource(clientId);
+                const claims = await resource.claims(String(rt.accountId), this.clientOf(ctx));
+                if (!claims)
+                    throw new oidcErrors.InvalidGrant("subject is no longer valid");
+                prefetchedClaims.set(ctx, { resource: resource.resource(), claims });
+                return true;
+            },
+            extraTokenClaims: async (_ctx, token) => {
+                if (token.kind !== "AccessToken")
+                    return undefined;
+                const at = token;
+                const resource = this.resource(at.resourceServer?.identifier());
+                if (!resource)
+                    return undefined;
+                const prefetched = prefetchedClaims.get(_ctx);
+                const claims = prefetched?.resource === resource.resource() ? prefetched.claims : await resource.claims(String(at.accountId), this.clientOf(_ctx));
+                if (!claims)
+                    throw new oidcErrors.InvalidGrant("subject is no longer valid");
+                return { data: resource.accessToken.encodeClaims(claims) };
+            },
+            findAccount: async (_ctx, sub) => ({ accountId: sub, claims: async () => ({ sub }) }),
+            ttl: {
+                AccessToken: (_ctx, token) => {
+                    const resource = this.resource(token.resourceServer?.identifier());
+                    return resource ? Math.floor(resource.accessToken.accessTtlMs / 1000) : 600;
+                },
+                AuthorizationCode: 60,
+                Interaction: 30 * 60,
+                Session: o.sessionTtlSec ?? 30 * 24 * 3600,
+                Grant: 365 * 24 * 3600,
+                RefreshToken: (ctx, token) => {
+                    const rotated = ctx?.oidc.entities.RotatedRefreshToken;
+                    return rotated && !token.isSenderConstrained() ? rotated.remainingTTL : refreshTtlSec;
+                },
+            },
+            renderError: async (ctx, out) => {
+                ctx.type = "text/plain";
+                ctx.body = `${out.error}: ${out.error_description ?? ""}`;
+            },
+        };
+        const provider = new Provider(o.issuer(), config);
+        provider.proxy = !!o.proxy;
+        // Resource scopes aren't OIDC scopes, so the provider leaves them out of its metadata.
+        provider.use(async (ctx, next) => {
+            await next();
+            if (ctx.oidc?.route === "discovery")
+                ctx.body.scopes_supported = [...OIDC_SCOPES, ...new Set(o.resources.flatMap(r => r.scopes))];
+        });
+        this._provider = provider;
+        return provider;
+    }
+}
+function requestedScopes(params) {
+    return String(params.scope ?? "").split(" ").filter(Boolean);
+}
+function hkdf(secret, info) {
+    return Buffer.from(hkdfSync("sha256", secret, "", info, 32));
+}
+// Deterministic, so every instance publishes the same key without distributing a key file.
+function deriveEs256Jwk(secret) {
+    const d = hkdf(secret, "@grest-ts/oauth es256");
+    const ecdh = createECDH("prime256v1");
+    ecdh.setPrivateKey(d);
+    const point = ecdh.getPublicKey();
+    const x = point.subarray(1, 33).toString("base64url");
+    const y = point.subarray(33).toString("base64url");
+    const kid = createHash("sha256").update(x + y).digest("base64url").slice(0, 16);
+    return { kty: "EC", crv: "P-256", d: d.toString("base64url"), x, y, alg: "ES256", use: "sig", kid };
+}
+//# sourceMappingURL=GGOAuthServer.js.map

package/dist/src/node/GGOAuthServer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GGOAuthServer.js","sourceRoot":"","sources":["../../../src/node/GGOAuthServer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAC,MAAM,aAAa,CAAA;AAEzE,OAAO,QAAQ,EAAE,EAAC,MAAM,IAAI,UAAU,EAAuE,MAAM,eAAe,CAAA;AAClI,OAAO,EAAC,SAAS,EAAC,MAAM,kBAAkB,CAAA;AAI1C,OAAO,EAAC,aAAa,EAAoB,MAAM,sBAAsB,CAAA;AAuDrE,MAAM,IAAI,GAAG,QAAQ,CAAA;AACrB,MAAM,WAAW,GAAG,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAA;AAChD,MAAM,MAAM,GAAG,eAAe,CAAA;AAC9B,qGAAqG;AACrG,MAAM,gBAAgB,GAAG,IAAI,OAAO,EAA8C,CAAA;AAIlF,oGAAoG;AACpG,oGAAoG;AACpG,qGAAqG;AACrG,MAAM,OAAO,aAAa;IAEd,SAAS,CAAsB;IAC/B,SAAS,CAA8C;IACvD,WAAW,CAAkD;IACpD,OAAO,CAAsB;IAE9C,YAAY,OAA6B;QACrC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;IAC1B,CAAC;IAED,IAAY,UAAU;QAClB,IAAI,CAAC,WAAW,KAAK,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;QAClG,OAAO,IAAI,CAAC,WAAW,CAAA;IAC3B,CAAC;IAEM,KAAK,CAAC,MAAoB;QAC7B,MAAM,MAAM,GAAG,KAAK,EAAE,GAAoB,EAAE,GAAmB,EAAE,EAAE;YAC/D,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAA;YACzD,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAA;YAC9E,IAAI,WAAW,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBACtC,IAAI,WAAW,CAAC,CAAC,CAAC;oBAAE,OAAO,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAA;gBAC3E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAA;gBACpE,IAAI,CAAC,KAAK,EAAE,CAAC;oBACT,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAC,cAAc,EAAE,YAAY,EAAC,CAAC,CAAA;oBAClD,GAAG,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAA;oBAClC,OAAM;gBACV,CAAC;gBACD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAA;gBACtE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,EAAC,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,UAAU,EAAC,CAAC,EAAC,CAAC,CAAA;gBACzI,GAAG,CAAC,GAAG,EAAE,CAAA;gBACT,OAAM;YACV,CAAC;YACD,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAA;YAC7C,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QAClC,CAAC,CAAA;QACD,KAAK,MAAM,MAAM,IAAI,CAAC,KAAK,EAAE,MAAM,CAAU;YAAE,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,MAAM,EAAE,eAAe,CAAC,CAAA;QACjH,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,mCAAmC,EAAE,MAAM,EAAE,eAAe,CAAC,CAAA;QACzF,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,yCAAyC,EAAE,MAAM,EAAE,eAAe,CAAC,CAAA;QAE/F,MAAM,CAAC,QAAQ,CAAC,GAAG,IAAI,GAAG,EAAE,eAAe,CAAC,CAAA;QAC5C,MAAM,CAAC,QAAQ,CAAC,mCAAmC,EAAE,eAAe,CAAC,CAAA;QACrE,MAAM,CAAC,QAAQ,CAAC,yCAAyC,EAAE,eAAe,CAAC,CAAA;IAC/E,CAAC;IAED,kGAAkG;IAClG,iGAAiG;IACjG,6DAA6D;IACtD,OAAO,CACV,MAAoB,EACpB,QAA4B,EAC5B,IAAY,EACZ,MAA+F;QAE/F,MAAM,YAAY,GAAG,wCAAwC,IAAI,EAAE,CAAA;QACnE,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;YAC1D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAC,cAAc,EAAE,kBAAkB,EAAC,CAAC,CAAA;YACxD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;gBACnB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;gBAC7B,qBAAqB,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;gBAC9C,gBAAgB,EAAE,QAAQ,CAAC,MAAM;gBACjC,wBAAwB,EAAE,CAAC,QAAQ,CAAC;aACvC,CAAC,CAAC,CAAA;QACP,CAAC,EAAE,eAAe,CAAC,CAAA;QACnB,MAAM,OAAO,GAAG,KAAK,EAAE,GAAoB,EAAE,GAAmB,EAAE,EAAE;YAChE,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAA;YACtC,MAAM,KAAK,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;gBACnD,CAAC,CAAC,MAAM,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;gBACzE,CAAC,CAAC,SAAS,CAAA;YACf,IAAI,CAAC,KAAK,EAAE,CAAC;gBACT,MAAM,WAAW,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,GAAG,YAAY,EAAE,CAAA;gBAC3E,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;oBACf,kBAAkB,EAAE,6BAA6B,WAAW,aAAa,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,EAAE,EAAE;iBAChJ,CAAC,CAAA;gBACF,GAAG,CAAC,GAAG,EAAE,CAAA;gBACT,OAAM;YACV,CAAC;YACD,MAAM,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;QACjC,CAAC,CAAA;QACD,KAAK,MAAM,MAAM,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAU;YAAE,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,eAAe,CAAC,CAAA;QACrH,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC,CAAA;QACtC,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC,CAAA;IAClD,CAAC;IAED,wGAAwG;IACjG,cAAc,CAAC,OAAqB;QACvC,OAAO;YACH,GAAG,EAAE,KAAK,EAAE,EAAC,GAAG,EAAC,EAAE,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC;YACnD,OAAO,EAAE,KAAK,EAAE,EAAC,GAAG,EAAC,EAAE,EAAE,CAAC,CAAC,EAAC,WAAW,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,EAAC,CAAC;YAC7E,IAAI,EAAE,KAAK,EAAE,EAAC,GAAG,EAAC,EAAE,EAAE,CAAC,CAAC,EAAC,WAAW,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,EAAC,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,6BAA6B,EAAC,CAAC,EAAC,CAAC;SACzK,CAAA;IACL,CAAC;IAEM,UAAU,GAAG,KAAK,EAAE,OAAe,EAA8F,EAAE;QACtI,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAA;QACzB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QAC3H,OAAO,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM;aAC1B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,IAAI,CAAC,CAAC,SAAS,KAAK,OAAO,CAAC;aACnD,GAAG,CAAC,KAAK,EAAC,CAAC,EAAC,EAAE,CAAC,CAAC;YACb,OAAO,EAAE,CAAE,CAAC,GAAG;YACf,QAAQ,EAAE,CAAE,CAAC,QAAS;YACtB,iGAAiG;YACjG,UAAU,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAE,CAAC,QAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,UAAU,IAAI,CAAE,CAAC,QAAQ,CAAC;YACzG,SAAS,EAAE,CAAC,CAAE,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI;SAClC,CAAC,CAAC,CAAC,CAAA;IACZ,CAAC,CAAA;IAED,mGAAmG;IAC5F,WAAW,GAAG,KAAK,EAAE,OAAe,EAAE,OAAe,EAAiB,EAAE;QAC3E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACvD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,KAAK,OAAO;YAAE,MAAM,IAAI,SAAS,EAAE,CAAA;QAChE,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,CAAA;QACjD,kFAAkF;QAClF,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IACtD,CAAC,CAAA;IAED,sEAAsE;IAC/D,SAAS,GAAG,KAAK,EAAE,OAAe,EAAiB,EAAE;QACxD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAA;QAChC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC,gBAAgB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA;QACxI,MAAM,OAAO,CAAC,GAAG,CAAC;YACd,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;YAC3F,GAAG,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;SACxD,CAAC,CAAA;IACN,CAAC,CAAA;IAEO,KAAK,CAAC,mBAAmB,CAAC,GAAW;QACzC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;QACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QACrD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC1D,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,SAAS,CAAC,EAAC,YAAY,EAAE,sBAAsB,EAAC,CAAC,CAAA;QACxE,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjF,OAAO;YACH,GAAG;YACH,MAAM,EAAE;gBACJ,QAAQ;gBACR,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,IAAI,QAAQ,CAAC;gBAClF,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC;gBACzC,aAAa,EAAE,KAAK;gBACpB,YAAY,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,2CAA2C,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;aAC1G;YACD,MAAM,EAAE,eAAe,CAAC,WAAW,CAAC,MAAM,CAAC;YAC3C,QAAQ,EAAE,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE;SAC5E,CAAA;IACL,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,GAAW,EAAE,OAAe;QAC9C,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAA;QACzB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;QACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QACrD,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC1F,MAAM,KAAK,GAAG,QAAQ,EAAE,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAC,CAAC,CAAA;QACtG,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;QAC9C,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;QAClC,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,EAAC,KAAK,EAAE,EAAC,SAAS,EAAE,OAAO,EAAC,EAAE,OAAO,EAAE,EAAC,OAAO,EAAC,EAAC,CAAC,CAAA;IACtF,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,GAAW;QACrC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC/D,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,SAAS,CAAC,EAAC,YAAY,EAAE,sCAAsC,EAAC,CAAC,CAAA;QAC7F,OAAO,WAAW,CAAA;IACtB,CAAC;IAED,8FAA8F;IAC9F,6FAA6F;IACrF,KAAK,CAAC,MAAM,CAAC,WAAkD,EAAE,MAA0B;QAC/F,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAA;QAC3B,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QAChD,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,EAAE,EAAC,GAAG,EAAE,MAAM,EAAkB,EAAE,GAAG,CAAC,CAAA;QAChF,8FAA8F;QAC9F,+FAA+F;QAC/F,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAA;QACpD,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;QACtG,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,gBAAgB,GAAG,oBAAoB,EAAE,EAAE,CAAA;IAC5G,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,GAAoB,EAAE,GAAmB,EAAE,GAAW;QAClF,MAAM,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAA;QAC/E,MAAM,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAuB,CAAC,CAAC,CAAC,SAAS,CAAA;QAC/F,IAAI,EAAE;YAAE,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;QACpD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;YAChC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAC,cAAc,EAAE,YAAY,EAAC,CAAC,CAAA;YAClD,GAAG,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAA;YAC1C,OAAM;QACV,CAAC;QACD,IAAI,CAAC;YACD,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,EAAC,uBAAuB,EAAE,KAAK,EAAC,CAAC,CAAA;QACxG,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,IAAI,CAAC,CAAC,GAAG,YAAY,UAAU,CAAC,eAAe,CAAC;gBAAE,MAAM,GAAG,CAAA;YAC3D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAC,cAAc,EAAE,YAAY,EAAC,CAAC,CAAA;YAClD,GAAG,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAA;QAC1D,CAAC;IACL,CAAC;IAEO,cAAc,CAAC,KAAsC,EAAE,MAA+B;QAC1F,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;QACzC,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3D,IAAI,IAAI,CAAC,MAAM;YAAE,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;QACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAA;QACvE,MAAM,cAAc,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;QACzE,IAAI,cAAc,CAAC,MAAM;YAAE,KAAK,CAAC,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;IACpG,CAAC;IAEO,iBAAiB,CAAC,MAA+B,EAAE,QAAgB;QACvE,MAAM,SAAS,GAAG,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAA;QACnF,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAA;IACpF,CAAC;IAEO,QAAQ,CAAC,SAA6B;QAC1C,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,SAAS,CAAC,CAAA;IACvE,CAAC;IAEO,QAAQ,CAAC,GAAuB;QACpC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,MAAO,CAAA;QAC/B,OAAO,EAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAC,CAAA;IACxI,CAAC;IAEO,cAAc,CAAC,SAAiB,EAAE,QAAgB;QACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;QACzC,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,UAAU,CAAC,aAAa,EAAE,CAAA;QACnD,IAAI,QAAQ,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,UAAU,CAAC,aAAa,CAAC,uCAAuC,CAAC,CAAA;QAC1I,OAAO,QAAQ,CAAA;IACnB,CAAC;IAEO,eAAe,CAAC,QAAgB;QACpC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAChD,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;IACzG,CAAC;IAEO,QAAQ;QACZ,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC,SAAS,CAAA;QACzC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAA;QACtB,MAAM,aAAa,GAAG,CAAC,CAAC,aAAa,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;QACvD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAA;QAElC,MAAM,MAAM,GAAkB;YAC1B,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC;YAC/B,IAAI,EAAE,EAAC,IAAI,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,EAAC;YAC1C,OAAO,EAAE,EAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,yBAAyB,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,EAAC;YACpF,OAAO,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACxC,SAAS,EAAE,CAAC,CAAC,QAAQ;gBACrB,WAAW,EAAE,CAAC,CAAC,IAAI;gBACnB,aAAa,EAAE,CAAC,CAAC,YAAY;gBAC7B,yBAAyB,EAAE,CAAC,CAAC,sBAAsB,IAAI,EAAE;gBACzD,0BAA0B,EAAE,MAAM;gBAClC,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;gBACpD,cAAc,EAAE,CAAC,MAAM,CAAC;gBACxB,gBAAgB,EAAE,KAAK;aAC1B,CAAC,CAAC;YACH,cAAc,EAAE;gBACZ,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;gBACpD,cAAc,EAAE,CAAC,MAAM,CAAC;gBACxB,0BAA0B,EAAE,MAAM;gBAClC,4BAA4B,EAAE,OAAO;gBACrC,wFAAwF;gBACxF,wFAAwF;gBACxF,gBAAgB,EAAE,QAAQ;aAC7B;YACD,MAAM,EAAE;gBACJ,aAAa,EAAE,GAAG,IAAI,YAAY,EAAE,KAAK,EAAE,GAAG,IAAI,QAAQ,EAAE,YAAY,EAAE,GAAG,IAAI,WAAW;gBAC5F,IAAI,EAAE,GAAG,IAAI,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,SAAS,EAAE,WAAW,EAAE,GAAG,IAAI,SAAS,EAAE,QAAQ,EAAE,GAAG,IAAI,WAAW;gBAC/G,aAAa,EAAE,GAAG,IAAI,aAAa,EAAE,4BAA4B,EAAE,GAAG,IAAI,MAAM,EAAE,iBAAiB,EAAE,GAAG,IAAI,SAAS;gBACrH,oBAAoB,EAAE,GAAG,IAAI,cAAc,EAAE,0BAA0B,EAAE,GAAG,IAAI,cAAc,EAAE,SAAS,EAAE,GAAG,IAAI,YAAY;aACjI;YACD,YAAY,EAAE,EAAC,GAAG,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC,GAAG,IAAI,gBAAgB,WAAW,CAAC,GAAG,EAAE,EAAC;YACpF,MAAM,EAAE,WAAW;YACnB,aAAa,EAAE,CAAC,MAAM,CAAC;YACvB,IAAI,EAAE,EAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,EAAC;YAC5B,QAAQ,EAAE;gBACN,eAAe,EAAE,EAAC,OAAO,EAAE,KAAK,EAAC;gBACjC,UAAU,EAAE,EAAC,OAAO,EAAE,IAAI,EAAC;gBAC3B,YAAY,EAAE,EAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,mBAAmB,EAAC;gBAChD,GAAG,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAC,wBAAwB,EAAE;wBACxD,OAAO,EAAE,IAAI;wBACb,GAAG,EAAE,UAAU;wBACf,UAAU,EAAE,KAAK,EAAE,IAAa,EAAE,QAAgB,EAAE,EAAE,CAAC,CAAC,CAAC,wBAAyB,CAAC,YAAY,EAAE,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC;qBACzI,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACR,iBAAiB,EAAE;oBACf,OAAO,EAAE,IAAI;oBACb,mFAAmF;oBACnF,sFAAsF;oBACtF,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;wBAC9B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;4BAAE,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAA;wBAC1H,uFAAuF;wBACvF,yCAAyC;wBACzC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;wBAC1E,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,MAAM,CAAA;wBACrD,IAAI,MAAM,IAAI,OAAO,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,EAAE,CAAC;4BACpF,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,yDAAyD,CAAC,CAAA;4BACpG,GAAG,CAAC,IAAI,GAAG,8BAA8B,SAAS,2DAA2D,CAAA;4BAC7G,OAAM;wBACV,CAAC;wBACD,GAAG,CAAC,IAAI,GAAG,8BAA8B,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,4DAA4D,CAAC,gBAAgB,CAAA;oBAClJ,CAAC;iBACJ;gBACD,kBAAkB,EAAE;oBAChB,OAAO,EAAE,IAAI;oBACb,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE;oBACnF,kBAAkB,EAAE,GAAG,EAAE,CAAC,IAAI;oBAC9B,qBAAqB,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE;wBAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;wBAChE,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAA;wBAClD,IAAI,CAAC,GAAG;4BAAE,MAAM,IAAI,KAAK,CAAC,0FAA0F,CAAC,CAAA;wBACrH,OAAO;4BACH,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;4BAChC,QAAQ,EAAE,QAAQ,CAAC,WAAW,CAAC,QAAQ,IAAI,SAAS;4BACpD,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,WAAW,GAAG,IAAI,CAAC;4BACnE,iBAAiB,EAAE,KAAK;4BACxB,GAAG,EAAE,EAAC,IAAI,EAAE,EAAC,GAAG,EAAE,GAAG,CAAC,GAAc,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAC,EAAC;yBACpE,CAAA;oBACL,CAAC;iBACJ;aACJ;YACD,uFAAuF;YACvF,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBAC7B,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,MAAO,CAAA;gBAC/B,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,OAAQ,CAAA;gBACjC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;gBACxF,IAAI,OAAO;oBAAE,OAAO,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;gBACzD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS;oBAAE,OAAO,SAAS,CAAA;gBAC5E,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAC,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAC,CAAC,CAAA;gBACpG,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,MAAiC,CAAC,CAAA;gBACtE,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;gBAClB,OAAO,CAAC,qBAAqB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;gBAC9C,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAA;gBAC9C,OAAO,KAAK,CAAA;YAChB,CAAC;YACD,kGAAkG;YAClG,iBAAiB,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,eAAe,CAAC;YACnF,wFAAwF;YACxF,6EAA6E;YAC7E,kBAAkB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,MAAO,CAAC,QAAQ,CAAC;YAC5E,6FAA6F;YAC7F,6FAA6F;YAC7F,qBAAqB;YACrB,kBAAkB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBAC9B,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAa,CAAA;gBAC1C,MAAM,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAA;gBACpC,qFAAqF;gBACrF,4FAA4F;gBAC5F,MAAM,OAAO,GAAG,CAAC,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAc,CAAA;gBACtD,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAA;gBAC3C,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;oBAAE,MAAM,IAAI,UAAU,CAAC,aAAa,EAAE,CAAA;gBACvG,MAAM,SAAS,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;gBAC3G,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAA;gBACtG,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAA;gBAC9E,IAAI,CAAC,MAAM;oBAAE,MAAM,IAAI,UAAU,CAAC,YAAY,CAAC,4BAA4B,CAAC,CAAA;gBAC5E,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE,EAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAC,CAAC,CAAA;gBAClE,OAAO,IAAI,CAAA;YACf,CAAC;YACD,gBAAgB,EAAE,KAAK,EAAE,IAAwB,EAAE,KAAK,EAAE,EAAE;gBACxD,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa;oBAAE,OAAO,SAAS,CAAA;gBAClD,MAAM,EAAE,GAAG,KAA8C,CAAA;gBACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,cAAc,EAAE,UAAU,EAAE,CAAC,CAAA;gBAC/D,IAAI,CAAC,QAAQ;oBAAE,OAAO,SAAS,CAAA;gBAC/B,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;gBAC7C,MAAM,MAAM,GAAG,UAAU,EAAE,QAAQ,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA;gBAClJ,IAAI,CAAC,MAAM;oBAAE,MAAM,IAAI,UAAU,CAAC,YAAY,CAAC,4BAA4B,CAAC,CAAA;gBAC5E,OAAO,EAAC,IAAI,EAAE,QAAQ,CAAC,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,EAAC,CAAA;YAC5D,CAAC;YACD,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,EAAC,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAC,GAAG,EAAC,CAAC,EAAC,CAAC;YACjF,GAAG,EAAE;gBACD,WAAW,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;oBACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,EAAE,UAAU,EAAE,CAAC,CAAA;oBAClE,OAAO,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;gBAC/E,CAAC;gBACD,iBAAiB,EAAE,EAAE;gBACrB,WAAW,EAAE,EAAE,GAAG,EAAE;gBACpB,OAAO,EAAE,CAAC,CAAC,aAAa,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI;gBAC1C,KAAK,EAAE,GAAG,GAAG,EAAE,GAAG,IAAI;gBACtB,YAAY,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;oBACzB,MAAM,OAAO,GAAG,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAA;oBACtD,OAAO,OAAO,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa,CAAA;gBACzF,CAAC;aACJ;YACD,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;gBAC5B,GAAG,CAAC,IAAI,GAAG,YAAY,CAAA;gBACvB,GAAG,CAAC,IAAI,GAAG,GAAG,GAAG,CAAC,KAAK,KAAK,GAAG,CAAC,iBAAiB,IAAI,EAAE,EAAE,CAAA;YAC7D,CAAC;SACJ,CAAA;QACD,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,CAAA;QACjD,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QAC1B,uFAAuF;QACvF,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;YAC7B,MAAM,IAAI,EAAE,CAAA;YACZ,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,KAAK,WAAW;gBAAG,GAAG,CAAC,IAAqC,CAAC,gBAAgB,GAAG,CAAC,GAAG,WAAW,EAAE,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;QACvK,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAA;QACzB,OAAO,QAAQ,CAAA;IACnB,CAAC;CACJ;AAGD,SAAS,eAAe,CAAC,MAA+B;IACpD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;AAChE,CAAC;AAED,SAAS,IAAI,CAAC,MAAc,EAAE,IAAY;IACtC,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAA;AAChE,CAAC;AAED,2FAA2F;AAC3F,SAAS,cAAc,CAAC,MAAc;IAClC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAA;IAC/C,MAAM,IAAI,GAAG,UAAU,CAAC,YAAY,CAAC,CAAA;IACrC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAA;IACrB,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,EAAE,CAAA;IACjC,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IACrD,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IAClD,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAC/E,OAAO,EAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAC,CAAA;AACrG,CAAC"}

package/dist/src/node/store/DynamoOAuthStore.d.ts

@@ -0,0 +1,28 @@
+import { type GGDynamoDb, GGDynamoDbTable } from "@grest-ts/db-dynamodb";
+import type { GGOAuthPayload, GGOAuthStore } from "./GGOAuthStore";
+declare const IsOAuthRow: import("@grest-ts/schema").ObjectSchema<{
+    pk: string;
+    model: string;
+    id: string;
+    payload: string;
+    grantId?: string | undefined;
+    uid?: string | undefined;
+    accountId?: string | undefined;
+    consumedAt?: number | undefined;
+    expiresAtSec?: number | undefined;
+}>;
+type OAuthRow = typeof IsOAuthRow.infer;
+export declare class DynamoOAuthStore extends GGDynamoDbTable<OAuthRow, "pk"> implements GGOAuthStore {
+    constructor(db: GGDynamoDb, tableName: string);
+    upsert: (model: string, id: string, payload: GGOAuthPayload, expiresInSec: number | undefined) => Promise<void>;
+    find: (model: string, id: string) => Promise<GGOAuthPayload | undefined>;
+    findByUid: (model: string, uid: string) => Promise<GGOAuthPayload | undefined>;
+    consume: (model: string, id: string) => Promise<void>;
+    destroy: (model: string, id: string) => Promise<void>;
+    revokeByGrantId: (grantId: string) => Promise<void>;
+    listIdsByAccount: (model: string, accountId: string) => Promise<string[]>;
+    private payloadOf;
+    private live;
+}
+export {};
+//# sourceMappingURL=DynamoOAuthStore.d.ts.map

package/dist/src/node/store/DynamoOAuthStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DynamoOAuthStore.d.ts","sourceRoot":"","sources":["../../../../src/node/store/DynamoOAuthStore.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,KAAK,UAAU,EAAE,eAAe,EAAC,MAAM,uBAAuB,CAAA;AAEtE,OAAO,KAAK,EAAC,cAAc,EAAE,YAAY,EAAC,MAAM,gBAAgB,CAAA;AAEhE,QAAA,MAAM,UAAU;;;;;;;;;;EAad,CAAA;AACF,KAAK,QAAQ,GAAG,OAAO,UAAU,CAAC,KAAK,CAAA;AASvC,qBAAa,gBAAiB,SAAQ,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAE,YAAW,YAAY;gBAE7E,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM;IAItC,MAAM,GAAU,OAAO,MAAM,EAAE,IAAI,MAAM,EAAE,SAAS,cAAc,EAAE,cAAc,MAAM,GAAG,SAAS,KAAG,OAAO,CAAC,IAAI,CAAC,CAW1H;IAEM,IAAI,GAAU,OAAO,MAAM,EAAE,IAAI,MAAM,KAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAoD;IAEjI,SAAS,GAAU,OAAO,MAAM,EAAE,KAAK,MAAM,KAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CACyD;IAE5I,OAAO,GAAU,OAAO,MAAM,EAAE,IAAI,MAAM,KAAG,OAAO,CAAC,IAAI,CAAC,CAahE;IAEM,OAAO,GAAU,OAAO,MAAM,EAAE,IAAI,MAAM,KAAG,OAAO,CAAC,IAAI,CAAC,CAEhE;IAGM,eAAe,GAAU,SAAS,MAAM,KAAG,OAAO,CAAC,IAAI,CAAC,CAO9D;IAEM,gBAAgB,GAAU,OAAO,MAAM,EAAE,WAAW,MAAM,KAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAE5B;IAEzD,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,IAAI;CAGf"}

package/dist/src/node/store/DynamoOAuthStore.js

@@ -0,0 +1,78 @@
+import { IsNumber, IsObject, IsString } from "@grest-ts/schema";
+import { GGDynamoDbTable } from "@grest-ts/db-dynamodb";
+import { errors as oidcErrors } from "oidc-provider";
+const IsOAuthRow = IsObject({
+    pk: IsString.nonEmpty,
+    model: IsString.nonEmpty,
+    id: IsString.nonEmpty,
+    // oidc-provider's payload as JSON: opaque, nested, may hold undefined values.
+    payload: IsString,
+    grantId: IsString.orUndefined,
+    uid: IsString.orUndefined,
+    accountId: IsString.orUndefined,
+    /** Epoch seconds; set once (conditional write), so only one of two concurrent redemptions wins. */
+    consumedAt: IsNumber.min(0).orUndefined,
+    /** Epoch seconds; drives DynamoDB TTL. TTL deletion lags, so reads check it too. */
+    expiresAtSec: IsNumber.min(0).orUndefined,
+});
+// Table to create (TTL attribute `expiresAtSec`): HASH `pk` (S), plus GSIs projecting ALL —
+// `grantId-index` (grantId), `uid-index` (uid), `accountId-index` (accountId).
+// accountId is written only for the models looked up by account, so the index stays small: every
+// spent refresh token is kept until expiry (reuse detection) and would otherwise land in it.
+const BY_ACCOUNT = new Set(["Grant", "Session"]);
+const REDEEMABLE = new Set(["AuthorizationCode", "RefreshToken"]);
+export class DynamoOAuthStore extends GGDynamoDbTable {
+    constructor(db, tableName) {
+        super(db, tableName, IsOAuthRow, "pk");
+    }
+    upsert = async (model, id, payload, expiresInSec) => {
+        await this.put({
+            pk: `${model}#${id}`,
+            model,
+            id,
+            payload: JSON.stringify(payload),
+            grantId: payload.grantId,
+            uid: payload.uid,
+            accountId: BY_ACCOUNT.has(model) ? payload.accountId : undefined,
+            expiresAtSec: expiresInSec ? Math.floor(Date.now() / 1000) + expiresInSec : undefined,
+        });
+    };
+    find = async (model, id) => this.payloadOf(await this.get(`${model}#${id}`));
+    findByUid = async (model, uid) => this.payloadOf(await this.queryOne("uid-index", "uid = :uid", { ":uid": uid, ":model": model }, { filter: "#m = :model", names: { "#m": "model" } }));
+    consume = async (model, id) => {
+        const row = await this.get(`${model}#${id}`);
+        if (!row) {
+            // A code or refresh token revoked since it was read (e.g. the app was disconnected) must not be redeemed.
+            if (REDEEMABLE.has(model))
+                throw new oidcErrors.InvalidGrant(`${model} revoked`);
+            return;
+        }
+        const consumedAt = Math.floor(Date.now() / 1000);
+        const payload = JSON.stringify({ ...JSON.parse(row.payload), consumed: consumedAt });
+        // attribute_exists(pk): a row revoked meanwhile stays gone instead of being re-created.
+        if (!await this.putConditional({ ...row, payload, consumedAt }, "attribute_exists(pk) AND attribute_not_exists(consumedAt)")) {
+            throw new oidcErrors.InvalidGrant(`${model} already used`);
+        }
+    };
+    destroy = async (model, id) => {
+        await this.delete(`${model}#${id}`);
+    };
+    // A long-lived grant accumulates one spent refresh token per rotation (kept for reuse detection), so page.
+    revokeByGrantId = async (grantId) => {
+        let cursor;
+        do {
+            const page = await this.queryPage("grantId-index", "grantId = :g", { ":g": grantId }, { cursor, limit: 100 });
+            await Promise.all(page.items.map(row => this.delete(row.pk)));
+            cursor = page.cursor;
+        } while (cursor);
+    };
+    listIdsByAccount = async (model, accountId) => (await this.query("accountId-index", "accountId = :a", { ":a": accountId, ":model": model }, { filter: "#m = :model", names: { "#m": "model" } }))
+        .filter(row => this.live(row)).map(row => row.id);
+    payloadOf(row) {
+        return row && this.live(row) ? JSON.parse(row.payload) : undefined;
+    }
+    live(row) {
+        return row.expiresAtSec === undefined || row.expiresAtSec > Date.now() / 1000;
+    }
+}
+//# sourceMappingURL=DynamoOAuthStore.js.map

package/dist/src/node/store/DynamoOAuthStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DynamoOAuthStore.js","sourceRoot":"","sources":["../../../../src/node/store/DynamoOAuthStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAC,MAAM,kBAAkB,CAAA;AAC7D,OAAO,EAAkB,eAAe,EAAC,MAAM,uBAAuB,CAAA;AACtE,OAAO,EAAC,MAAM,IAAI,UAAU,EAAC,MAAM,eAAe,CAAA;AAGlD,MAAM,UAAU,GAAG,QAAQ,CAAC;IACxB,EAAE,EAAE,QAAQ,CAAC,QAAQ;IACrB,KAAK,EAAE,QAAQ,CAAC,QAAQ;IACxB,EAAE,EAAE,QAAQ,CAAC,QAAQ;IACrB,8EAA8E;IAC9E,OAAO,EAAE,QAAQ;IACjB,OAAO,EAAE,QAAQ,CAAC,WAAW;IAC7B,GAAG,EAAE,QAAQ,CAAC,WAAW;IACzB,SAAS,EAAE,QAAQ,CAAC,WAAW;IAC/B,mGAAmG;IACnG,UAAU,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW;IACvC,oFAAoF;IACpF,YAAY,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW;CAC5C,CAAC,CAAA;AAGF,4FAA4F;AAC5F,+EAA+E;AAC/E,iGAAiG;AACjG,6FAA6F;AAC7F,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAA;AAChD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,mBAAmB,EAAE,cAAc,CAAC,CAAC,CAAA;AAEjE,MAAM,OAAO,gBAAiB,SAAQ,eAA+B;IAEjE,YAAY,EAAc,EAAE,SAAiB;QACzC,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,CAAA;IAC1C,CAAC;IAEM,MAAM,GAAG,KAAK,EAAE,KAAa,EAAE,EAAU,EAAE,OAAuB,EAAE,YAAgC,EAAiB,EAAE;QAC1H,MAAM,IAAI,CAAC,GAAG,CAAC;YACX,EAAE,EAAE,GAAG,KAAK,IAAI,EAAE,EAAE;YACpB,KAAK;YACL,EAAE;YACF,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;YAChC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,SAAS,EAAE,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;YAChE,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,SAAS;SACxF,CAAC,CAAA;IACN,CAAC,CAAA;IAEM,IAAI,GAAG,KAAK,EAAE,KAAa,EAAE,EAAU,EAAuC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC,CAAA;IAEjI,SAAS,GAAG,KAAK,EAAE,KAAa,EAAE,GAAW,EAAuC,EAAE,CACzF,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,YAAY,EAAE,EAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAC,EAAE,EAAC,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,EAAC,IAAI,EAAE,OAAO,EAAC,EAAC,CAAC,CAAC,CAAA;IAE5I,OAAO,GAAG,KAAK,EAAE,KAAa,EAAE,EAAU,EAAiB,EAAE;QAChE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,IAAI,EAAE,EAAE,CAAC,CAAA;QAC5C,IAAI,CAAC,GAAG,EAAE,CAAC;YACP,0GAA0G;YAC1G,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,UAAU,CAAC,YAAY,CAAC,GAAG,KAAK,UAAU,CAAC,CAAA;YAChF,OAAM;QACV,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;QAChD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAC,CAAC,CAAA;QAClF,wFAAwF;QACxF,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,EAAC,GAAG,GAAG,EAAE,OAAO,EAAE,UAAU,EAAC,EAAE,2DAA2D,CAAC,EAAE,CAAC;YACzH,MAAM,IAAI,UAAU,CAAC,YAAY,CAAC,GAAG,KAAK,eAAe,CAAC,CAAA;QAC9D,CAAC;IACL,CAAC,CAAA;IAEM,OAAO,GAAG,KAAK,EAAE,KAAa,EAAE,EAAU,EAAiB,EAAE;QAChE,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,KAAK,IAAI,EAAE,EAAE,CAAC,CAAA;IACvC,CAAC,CAAA;IAED,2GAA2G;IACpG,eAAe,GAAG,KAAK,EAAE,OAAe,EAAiB,EAAE;QAC9D,IAAI,MAA0B,CAAA;QAC9B,GAAG,CAAC;YACA,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE,cAAc,EAAE,EAAC,IAAI,EAAE,OAAO,EAAC,EAAE,EAAC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAC,CAAC,CAAA;YACzG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;YAC7D,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;QACxB,CAAC,QAAQ,MAAM,EAAC;IACpB,CAAC,CAAA;IAEM,gBAAgB,GAAG,KAAK,EAAE,KAAa,EAAE,SAAiB,EAAqB,EAAE,CACpF,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE,gBAAgB,EAAE,EAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAC,EAAE,EAAC,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,EAAC,IAAI,EAAE,OAAO,EAAC,EAAC,CAAC,CAAC;SACvI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAEjD,SAAS,CAAC,GAAyB;QACvC,OAAO,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAmB,CAAC,CAAC,CAAC,SAAS,CAAA;IACxF,CAAC;IAEO,IAAI,CAAC,GAAa;QACtB,OAAO,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,GAAG,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;IACjF,CAAC;CACJ"}

package/dist/src/node/store/GGOAuthStore.d.ts

@@ -0,0 +1,18 @@
+import type { AdapterConstructor } from "oidc-provider";
+export type GGOAuthPayload = Record<string, unknown> & {
+    grantId?: string;
+    uid?: string;
+    accountId?: string;
+    consumed?: number;
+};
+export interface GGOAuthStore {
+    upsert(model: string, id: string, payload: GGOAuthPayload, expiresInSec: number | undefined): Promise<void>;
+    find(model: string, id: string): Promise<GGOAuthPayload | undefined>;
+    findByUid(model: string, uid: string): Promise<GGOAuthPayload | undefined>;
+    consume(model: string, id: string): Promise<void>;
+    destroy(model: string, id: string): Promise<void>;
+    revokeByGrantId(grantId: string): Promise<void>;
+    listIdsByAccount(model: string, accountId: string): Promise<string[]>;
+}
+export declare function toOidcAdapter(store: GGOAuthStore): AdapterConstructor;
+//# sourceMappingURL=GGOAuthStore.d.ts.map

package/dist/src/node/store/GGOAuthStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"GGOAuthStore.d.ts","sourceRoot":"","sources":["../../../../src/node/store/GGOAuthStore.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,kBAAkB,EAAC,MAAM,eAAe,CAAA;AAIrD,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IACnD,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;CACpB,CAAA;AAED,MAAM,WAAW,YAAY;IACzB,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC3G,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAA;IACpE,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAA;IAI1E,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACjD,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEjD,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAE/C,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;CACxE;AAGD,wBAAgB,aAAa,CAAC,KAAK,EAAE,YAAY,GAAG,kBAAkB,CAarE"}

package/dist/src/node/store/GGOAuthStore.js

@@ -0,0 +1,16 @@
+// oidc-provider's adapter shape: `new Adapter(modelName)` per model.
+export function toOidcAdapter(store) {
+    return class GGOAuthAdapter {
+        model;
+        constructor(model) { this.model = model; }
+        upsert = (id, payload, expiresIn) => store.upsert(this.model, id, payload, expiresIn);
+        find = (id) => store.find(this.model, id);
+        findByUid = (uid) => store.findByUid(this.model, uid);
+        // Device flow is never enabled.
+        findByUserCode = async () => undefined;
+        consume = (id) => store.consume(this.model, id);
+        destroy = (id) => store.destroy(this.model, id);
+        revokeByGrantId = (grantId) => store.revokeByGrantId(grantId);
+    };
+}
+//# sourceMappingURL=GGOAuthStore.js.map

package/dist/src/node/store/GGOAuthStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GGOAuthStore.js","sourceRoot":"","sources":["../../../../src/node/store/GGOAuthStore.ts"],"names":[],"mappings":"AA0BA,qEAAqE;AACrE,MAAM,UAAU,aAAa,CAAC,KAAmB;IAC7C,OAAO,MAAM,cAAc;QACN,KAAK,CAAQ;QAC9B,YAAY,KAAa,IAAI,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA,CAAC,CAAC;QACjD,MAAM,GAAG,CAAC,EAAU,EAAE,OAAuB,EAAE,SAAkB,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAA;QACtH,IAAI,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;QACjD,SAAS,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;QAC7D,gCAAgC;QAChC,cAAc,GAAG,KAAK,IAAI,EAAE,CAAC,SAAS,CAAA;QACtC,OAAO,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;QACvD,OAAO,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;QACvD,eAAe,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,CAAA;KACxE,CAAA;AACL,CAAC"}