@growth-labs/auth 0.13.0 → 0.14.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +1 -0
- package/dist/middleware/auth.d.ts.map +1 -1
- package/dist/middleware/auth.js +30 -1
- package/dist/middleware/auth.js.map +1 -1
- package/dist/routes/logout.js +1 -1
- package/dist/routes/logout.js.map +1 -1
- package/dist/types.d.ts +8 -4
- package/dist/types.d.ts.map +1 -1
- package/dist/utils/index.d.ts +1 -0
- package/dist/utils/index.d.ts.map +1 -1
- package/dist/utils/index.js +1 -0
- package/dist/utils/index.js.map +1 -1
- package/dist/utils/refresh-carrier.d.ts +10 -0
- package/dist/utils/refresh-carrier.d.ts.map +1 -0
- package/dist/utils/refresh-carrier.js +76 -0
- package/dist/utils/refresh-carrier.js.map +1 -0
- package/dist/utils/refresh-flight.d.ts +9 -0
- package/dist/utils/refresh-flight.d.ts.map +1 -0
- package/dist/utils/refresh-flight.js +55 -0
- package/dist/utils/refresh-flight.js.map +1 -0
- package/dist/utils/tokens.d.ts +7 -0
- package/dist/utils/tokens.d.ts.map +1 -1
- package/dist/utils/tokens.js +38 -27
- package/dist/utils/tokens.js.map +1 -1
- package/dist/workers.d.ts +7 -0
- package/dist/workers.d.ts.map +1 -1
- package/dist/workers.js +15 -1
- package/dist/workers.js.map +1 -1
- package/package.json +3 -3
- package/src/middleware/auth.ts +30 -1
- package/src/routes/logout.ts +1 -1
- package/src/types.ts +14 -4
- package/src/utils/index.ts +5 -0
- package/src/utils/refresh-carrier.ts +74 -0
- package/src/utils/refresh-flight.ts +59 -0
- package/src/utils/tokens.ts +55 -30
- package/src/workers.ts +25 -1
package/README.md
CHANGED
|
@@ -50,6 +50,7 @@ auth({
|
|
|
50
50
|
2. Verifies access token JWT against the internal issuer's JWKS (`{issuerInternal ?? issuer}/.well-known/jwks.json`, cached in Worker memory)
|
|
51
51
|
3. Requires the access token `aud` to match `resource`; wrong or missing audiences remain unauthenticated
|
|
52
52
|
4. If expired but refresh token valid → silent refresh, verify the new access token audience, then set new cookies
|
|
53
|
+
— one exchange per token per isolate, and never on a beacon or a prefetch (those are answered as a guest / `425`, and the next real request refreshes)
|
|
53
54
|
5. Populates `context.locals.user` as `User | null`
|
|
54
55
|
6. If path matches `gatedPaths` and `user` is null → redirect to `loginPath`
|
|
55
56
|
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AACA,OAAO,sBAAsB,CAAA;
|
|
1
|
+
{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AACA,OAAO,sBAAsB,CAAA;AAmB7B,wBAAsB,SAAS,CAC9B,OAAO,EAAE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,GAAG,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,EACxE,IAAI,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,GAC3B,OAAO,CAAC,QAAQ,CAAC,CA0KnB"}
|
package/dist/middleware/auth.js
CHANGED
|
@@ -4,6 +4,7 @@ import { resolveClientSecret } from '../utils/client-secret.js';
|
|
|
4
4
|
import { getCookie, setTokenCookies } from '../utils/cookies.js';
|
|
5
5
|
import { secretResolutionFailureResponse } from '../utils/fail-closed.js';
|
|
6
6
|
import { resolveInternalIssuer } from '../utils/issuer.js';
|
|
7
|
+
import { classifyRefreshCarrier, prefetchDeferredResponse, } from '../utils/refresh-carrier.js';
|
|
7
8
|
import { refreshTokens, verifyAccessToken } from '../utils/tokens.js';
|
|
8
9
|
const PRIVATE_NO_STORE_HEADERS = [
|
|
9
10
|
'Cache-Control',
|
|
@@ -54,8 +55,18 @@ export async function onRequest(context, next) {
|
|
|
54
55
|
}
|
|
55
56
|
}
|
|
56
57
|
}
|
|
58
|
+
// A refresh rotates the token, and only a response the browser is waiting
|
|
59
|
+
// for can deliver the successor. A beacon or a prefetch that would need one
|
|
60
|
+
// does not get it: the request is answered as `deferred` and the next
|
|
61
|
+
// consumable request refreshes instead (refresh-carrier.ts says why).
|
|
57
62
|
let refreshFailure = null;
|
|
63
|
+
let deferredCarrier = null;
|
|
58
64
|
if (!user && refreshToken) {
|
|
65
|
+
const carrier = classifyRefreshCarrier(request);
|
|
66
|
+
if (carrier !== 'consumable')
|
|
67
|
+
deferredCarrier = carrier;
|
|
68
|
+
}
|
|
69
|
+
if (!user && refreshToken && deferredCarrier === null) {
|
|
59
70
|
const clientId = options.clientId || context.url.hostname;
|
|
60
71
|
refreshed = await refreshTokens(issuer, refreshToken, clientId, resolvedClientSecret, options.resource, (failure) => {
|
|
61
72
|
refreshFailure = failure;
|
|
@@ -82,6 +93,7 @@ export async function onRequest(context, next) {
|
|
|
82
93
|
hadAccessToken: accessToken !== null,
|
|
83
94
|
hadRefreshToken: refreshToken !== null,
|
|
84
95
|
refreshFailure,
|
|
96
|
+
deferred: deferredCarrier !== null,
|
|
85
97
|
});
|
|
86
98
|
context.locals.authSession = session;
|
|
87
99
|
// The cookies are deliberately left alone, even when the state is `expired`.
|
|
@@ -91,7 +103,22 @@ export async function onRequest(context, next) {
|
|
|
91
103
|
// the next navigation, and clearing would turn it into a forced sign-in.
|
|
92
104
|
// Recovery never needed the clear: signing in again overwrites them.
|
|
93
105
|
const documentNavigation = isDocumentNavigation(request);
|
|
94
|
-
if (
|
|
106
|
+
if (deferredCarrier !== null) {
|
|
107
|
+
try {
|
|
108
|
+
console.info('[auth] session refresh deferred', {
|
|
109
|
+
carrier: deferredCarrier,
|
|
110
|
+
pathname: context.url.pathname,
|
|
111
|
+
});
|
|
112
|
+
}
|
|
113
|
+
catch {
|
|
114
|
+
/* a patched console must not turn a guest page into a 500 */
|
|
115
|
+
}
|
|
116
|
+
// A prefetched document rendered as a guest would be shown to the member
|
|
117
|
+
// on navigation as if they had signed out; a non-2xx is dropped instead.
|
|
118
|
+
if (deferredCarrier === 'prefetch')
|
|
119
|
+
return prefetchDeferredResponse();
|
|
120
|
+
}
|
|
121
|
+
else if (!user && refreshToken) {
|
|
95
122
|
const failure = refreshFailure ?? { reason: 'unreported' };
|
|
96
123
|
try {
|
|
97
124
|
console.warn('[auth] session refresh failed', {
|
|
@@ -141,6 +168,8 @@ function resolveSessionState(input) {
|
|
|
141
168
|
return input.refreshed ? 'refreshed' : 'verified';
|
|
142
169
|
if (!input.hadAccessToken && !input.hadRefreshToken)
|
|
143
170
|
return 'anonymous';
|
|
171
|
+
if (input.deferred)
|
|
172
|
+
return 'deferred';
|
|
144
173
|
// A rejected access token with no refresh token beside it cannot be revived.
|
|
145
174
|
if (!input.hadRefreshToken)
|
|
146
175
|
return 'expired';
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,sBAAsB,CAAA;AAE7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAChE,OAAO,EAAE,+BAA+B,EAAE,MAAM,yBAAyB,CAAA;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAA;AAC1D,OAAO,EAAuB,aAAa,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAE1F,MAAM,wBAAwB,GAAG;IAChC,eAAe;IACf,mBAAmB;IACnB,8BAA8B;CACrB,CAAA;AAEV,MAAM,CAAC,KAAK,UAAU,SAAS,CAC9B,OAAwE,EACxE,IAA6B;IAE7B,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAA;IAC7C,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAE3B,8BAA8B;IAC9B,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,CAAC,CAAA;IACpE,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,CAAC,CAAA;IAErE,6BAA6B;IAC7B,IAAI,IAAI,GAAgB,IAAI,CAAA;IAC5B,IAAI,SAAS,GAA8C,IAAI,CAAA;IAC/D,IAAI,oBAAwC,CAAA;IAE5C,uEAAuE;IACvE,0EAA0E;IAC1E,wEAAwE;IACxE,0EAA0E;IAC1E,4EAA4E;IAC5E,2EAA2E;IAC3E,0EAA0E;IAC1E,uEAAuE;IACvE,IAAI,YAAY,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACxD,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;QAC7E,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;YACtB,OAAO,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAA;YAC1B,OAAO,+BAA+B,CAAC,OAAO,EAAE;gBAC/C,OAAO,EAAE,oBAAoB;gBAC7B,IAAI,EAAE,YAAY,CAAC,IAAI;aACvB,CAAC,CAAA;QACH,CAAC;QACD,oBAAoB,GAAG,YAAY,CAAC,MAAM,IAAI,SAAS,CAAA;IACxD,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QACjB,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAA;QAC7F,IAAI,QAAQ,EAAE,CAAC;YACd,IAAI,GAAG;gBACN,EAAE,EAAE,QAAQ,CAAC,GAAG;gBAChB,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,IAAI;gBAC3B,SAAS,EAAE,QAAQ,CAAC,KAAK,IAAI,IAAI;aACjC,CAAA;YACD,IAAI,QAAQ,CAAC,SAAS,KAAK,IAAI,IAAI,QAAQ,CAAC,OAAO,KAAK,YAAY,EAAE,CAAC;gBACtE,OAAO,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAA;YAChC,CAAC;QACF,CAAC;IACF,CAAC;IAED,IAAI,cAAc,GAAG,IAA6B,CAAA;IAClD,IAAI,CAAC,IAAI,IAAI,YAAY,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAA;QACzD,SAAS,GAAG,MAAM,aAAa,CAC9B,MAAM,EACN,YAAY,EACZ,QAAQ,EACR,oBAAoB,EACpB,OAAO,CAAC,QAAQ,EAChB,CAAC,OAAO,EAAE,EAAE;YACX,cAAc,GAAG,OAAO,CAAA;QACzB,CAAC,CACD,CAAA;QACD,IAAI,SAAS,EAAE,CAAC;YACf,IAAI,GAAG;gBACN,EAAE,EAAE,SAAS,CAAC,MAAM,CAAC,GAAG;gBACxB,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK;gBAC7B,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI;gBACnC,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK,IAAI,IAAI;aACzC,CAAA;QACF,CAAC;IACF,CAAC;IAED,2EAA2E;IAC3E,4EAA4E;IAC5E,6EAA6E;IAC7E,yEAAyE;IACzE,0EAA0E;IAC1E,mBAAmB;IACnB,OAAO,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAA;IAC1B,MAAM,OAAO,GAAG,mBAAmB,CAAC;QACnC,IAAI;QACJ,SAAS,EAAE,SAAS,KAAK,IAAI;QAC7B,cAAc,EAAE,WAAW,KAAK,IAAI;QACpC,eAAe,EAAE,YAAY,KAAK,IAAI;QACtC,cAAc;
|
|
1
|
+
{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,sBAAsB,CAAA;AAE7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAChE,OAAO,EAAE,+BAA+B,EAAE,MAAM,yBAAyB,CAAA;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAA;AAC1D,OAAO,EACN,sBAAsB,EACtB,wBAAwB,GAExB,MAAM,6BAA6B,CAAA;AACpC,OAAO,EAAuB,aAAa,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAE1F,MAAM,wBAAwB,GAAG;IAChC,eAAe;IACf,mBAAmB;IACnB,8BAA8B;CACrB,CAAA;AAEV,MAAM,CAAC,KAAK,UAAU,SAAS,CAC9B,OAAwE,EACxE,IAA6B;IAE7B,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAA;IAC7C,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAE3B,8BAA8B;IAC9B,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,CAAC,CAAA;IACpE,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,CAAC,CAAA;IAErE,6BAA6B;IAC7B,IAAI,IAAI,GAAgB,IAAI,CAAA;IAC5B,IAAI,SAAS,GAA8C,IAAI,CAAA;IAC/D,IAAI,oBAAwC,CAAA;IAE5C,uEAAuE;IACvE,0EAA0E;IAC1E,wEAAwE;IACxE,0EAA0E;IAC1E,4EAA4E;IAC5E,2EAA2E;IAC3E,0EAA0E;IAC1E,uEAAuE;IACvE,IAAI,YAAY,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACxD,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;QAC7E,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;YACtB,OAAO,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAA;YAC1B,OAAO,+BAA+B,CAAC,OAAO,EAAE;gBAC/C,OAAO,EAAE,oBAAoB;gBAC7B,IAAI,EAAE,YAAY,CAAC,IAAI;aACvB,CAAC,CAAA;QACH,CAAC;QACD,oBAAoB,GAAG,YAAY,CAAC,MAAM,IAAI,SAAS,CAAA;IACxD,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QACjB,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAA;QAC7F,IAAI,QAAQ,EAAE,CAAC;YACd,IAAI,GAAG;gBACN,EAAE,EAAE,QAAQ,CAAC,GAAG;gBAChB,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,IAAI;gBAC3B,SAAS,EAAE,QAAQ,CAAC,KAAK,IAAI,IAAI;aACjC,CAAA;YACD,IAAI,QAAQ,CAAC,SAAS,KAAK,IAAI,IAAI,QAAQ,CAAC,OAAO,KAAK,YAAY,EAAE,CAAC;gBACtE,OAAO,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAA;YAChC,CAAC;QACF,CAAC;IACF,CAAC;IAED,0EAA0E;IAC1E,4EAA4E;IAC5E,sEAAsE;IACtE,sEAAsE;IACtE,IAAI,cAAc,GAAG,IAA6B,CAAA;IAClD,IAAI,eAAe,GAA0B,IAAI,CAAA;IACjD,IAAI,CAAC,IAAI,IAAI,YAAY,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAA;QAC/C,IAAI,OAAO,KAAK,YAAY;YAAE,eAAe,GAAG,OAAO,CAAA;IACxD,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,YAAY,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;QACvD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAA;QACzD,SAAS,GAAG,MAAM,aAAa,CAC9B,MAAM,EACN,YAAY,EACZ,QAAQ,EACR,oBAAoB,EACpB,OAAO,CAAC,QAAQ,EAChB,CAAC,OAAO,EAAE,EAAE;YACX,cAAc,GAAG,OAAO,CAAA;QACzB,CAAC,CACD,CAAA;QACD,IAAI,SAAS,EAAE,CAAC;YACf,IAAI,GAAG;gBACN,EAAE,EAAE,SAAS,CAAC,MAAM,CAAC,GAAG;gBACxB,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK;gBAC7B,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI;gBACnC,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK,IAAI,IAAI;aACzC,CAAA;QACF,CAAC;IACF,CAAC;IAED,2EAA2E;IAC3E,4EAA4E;IAC5E,6EAA6E;IAC7E,yEAAyE;IACzE,0EAA0E;IAC1E,mBAAmB;IACnB,OAAO,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAA;IAC1B,MAAM,OAAO,GAAG,mBAAmB,CAAC;QACnC,IAAI;QACJ,SAAS,EAAE,SAAS,KAAK,IAAI;QAC7B,cAAc,EAAE,WAAW,KAAK,IAAI;QACpC,eAAe,EAAE,YAAY,KAAK,IAAI;QACtC,cAAc;QACd,QAAQ,EAAE,eAAe,KAAK,IAAI;KAClC,CAAC,CAAA;IACF,OAAO,CAAC,MAAM,CAAC,WAAW,GAAG,OAAO,CAAA;IAEpC,6EAA6E;IAC7E,0EAA0E;IAC1E,0EAA0E;IAC1E,2EAA2E;IAC3E,yEAAyE;IACzE,qEAAqE;IACrE,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAA;IAExD,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC;YACJ,OAAO,CAAC,IAAI,CAAC,iCAAiC,EAAE;gBAC/C,OAAO,EAAE,eAAe;gBACxB,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ;aAC9B,CAAC,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACR,6DAA6D;QAC9D,CAAC;QACD,yEAAyE;QACzE,yEAAyE;QACzE,IAAI,eAAe,KAAK,UAAU;YAAE,OAAO,wBAAwB,EAAE,CAAA;IACtE,CAAC;SAAM,IAAI,CAAC,IAAI,IAAI,YAAY,EAAE,CAAC;QAClC,MAAM,OAAO,GAAmB,cAAc,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,CAAA;QAC1E,IAAI,CAAC;YACJ,OAAO,CAAC,IAAI,CAAC,+BAA+B,EAAE;gBAC7C,GAAG,OAAO;gBACV,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ;gBAC9B,kBAAkB;gBAClB,OAAO;aACP,CAAC,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACR,6DAA6D;QAC9D,CAAC;IACF,CAAC;IAED,0BAA0B;IAC1B,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACpE,wEAAwE;QACxE,yEAAyE;QACzE,uEAAuE;QACvE,uEAAuE;QACvE,MAAM,YAAY,GAAG,cAAc,EAAE,MAAM,KAAK,eAAe,CAAA;QAC/D,MAAM,QAAQ,GAAG,IAAI,GAAG,CACvB,GAAG,OAAO,CAAC,SAAS,aAAa,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GACxE,YAAY,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAC3C,EAAE,EACF,OAAO,CAAC,GAAG,CAAC,MAAM,CAClB,CAAA;QACD,OAAO,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAA;IACnD,CAAC;IAED,0BAA0B;IAC1B,MAAM,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAA;IAE7B,oFAAoF;IACpF,IAAI,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QACpD,MAAM,gBAAgB,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;YACpD,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,OAAO,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;SACtC,CAAC,CAAA;QACF,IAAI,SAAS,EAAE,CAAC;YACf,eAAe,CAAC,gBAAgB,EAAE,OAAO,EAAE,SAAS,CAAC,WAAW,EAAE,SAAS,CAAC,YAAY,CAAC,CAAA;QAC1F,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YACvC,KAAK,MAAM,MAAM,IAAI,wBAAwB,EAAE,CAAC;gBAC/C,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;YAC1D,CAAC;QACF,CAAC;QACD,OAAO,gBAAgB,CAAA;IACxB,CAAC;IAED,OAAO,QAAQ,CAAA;AAChB,CAAC;AAED,SAAS,mBAAmB,CAAC,KAO5B;IACA,IAAI,KAAK,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,CAAA;IACjE,IAAI,CAAC,KAAK,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,eAAe;QAAE,OAAO,WAAW,CAAA;IACvE,IAAI,KAAK,CAAC,QAAQ;QAAE,OAAO,UAAU,CAAA;IACrC,6EAA6E;IAC7E,IAAI,CAAC,KAAK,CAAC,eAAe;QAAE,OAAO,SAAS,CAAA;IAC5C,OAAO,KAAK,CAAC,cAAc,EAAE,MAAM,KAAK,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAA;AACvF,CAAC;AAED,uFAAuF;AACvF,SAAS,oBAAoB,CAAC,OAAgB;IAC7C,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK;QAAE,OAAO,KAAK,CAAA;IAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;IAClD,IAAI,IAAI;QAAE,OAAO,IAAI,KAAK,UAAU,CAAA;IACpC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;IAClD,IAAI,IAAI;QAAE,OAAO,IAAI,KAAK,UAAU,CAAA;IACpC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AACnE,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB,EAAE,UAAoB;IAC1D,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QAClC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA,CAAC,6BAA6B;YACjE,OAAO,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;QACnC,CAAC;QACD,OAAO,QAAQ,KAAK,OAAO,CAAA;IAC5B,CAAC,CAAC,CAAA;AACH,CAAC"}
|
package/dist/routes/logout.js
CHANGED
|
@@ -36,7 +36,7 @@ export async function GET(context) {
|
|
|
36
36
|
}
|
|
37
37
|
// Emit auth_logout (non-blocking) when the consumer has @growth-labs/analytics
|
|
38
38
|
// wired. Without analytics installed this is a no-op (analyticsAvailable
|
|
39
|
-
// returns false). Documented in packages
|
|
39
|
+
// returns false). Documented in packages/analytics/EVENT_REGISTRY.md (growth-labs/publishing).
|
|
40
40
|
if (analyticsAvailable(context)) {
|
|
41
41
|
const promise = emitAuthEvent(context, 'auth_logout', {
|
|
42
42
|
revoked: refreshToken ? 'true' : 'false',
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"logout.js","sourceRoot":"","sources":["../../src/routes/logout.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAEzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EACN,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,SAAS,GACT,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,+BAA+B,EAAE,MAAM,yBAAyB,CAAA;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAYzD,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAAsB;IAC/C,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,CAAC,CAAA;IAC7E,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAA;IACzD,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAA;IAE3C,mCAAmC;IACnC,yEAAyE;IACzE,sFAAsF;IACtF,kFAAkF;IAClF,4CAA4C;IAC5C,IAAI,iBAAiB,GAA2C,IAAI,CAAA;IACpE,IAAI,YAAY,EAAE,CAAC;QAClB,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACxC,SAAS,CAAC,WAAW,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAA;QAC/C,CAAC;aAAM,CAAC;YACP,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;YACrF,IAAI,YAAY,CAAC,EAAE,EAAE,CAAC;gBACrB,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,IAAI,SAAS,CAAA;gBAC/C,MAAM,OAAO,GAAG,MAAM;oBACrB,CAAC,CAAC,WAAW,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC;oBAC7C,CAAC,CAAC,WAAW,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAA;gBACtC,SAAS,CAAC,OAAO,CAAC,CAAA;YACnB,CAAC;iBAAM,CAAC;gBACP,iBAAiB,GAAG,YAAY,CAAC,IAAI,CAAA;YACtC,CAAC;QACF,CAAC;IACF,CAAC;IAED,+EAA+E;IAC/E,yEAAyE;IACzE
|
|
1
|
+
{"version":3,"file":"logout.js","sourceRoot":"","sources":["../../src/routes/logout.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAEzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EACN,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,SAAS,GACT,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,+BAA+B,EAAE,MAAM,yBAAyB,CAAA;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAYzD,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAAsB;IAC/C,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,CAAC,CAAA;IAC7E,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAA;IACzD,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAA;IAE3C,mCAAmC;IACnC,yEAAyE;IACzE,sFAAsF;IACtF,kFAAkF;IAClF,4CAA4C;IAC5C,IAAI,iBAAiB,GAA2C,IAAI,CAAA;IACpE,IAAI,YAAY,EAAE,CAAC;QAClB,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACxC,SAAS,CAAC,WAAW,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAA;QAC/C,CAAC;aAAM,CAAC;YACP,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;YACrF,IAAI,YAAY,CAAC,EAAE,EAAE,CAAC;gBACrB,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,IAAI,SAAS,CAAA;gBAC/C,MAAM,OAAO,GAAG,MAAM;oBACrB,CAAC,CAAC,WAAW,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC;oBAC7C,CAAC,CAAC,WAAW,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAA;gBACtC,SAAS,CAAC,OAAO,CAAC,CAAA;YACnB,CAAC;iBAAM,CAAC;gBACP,iBAAiB,GAAG,YAAY,CAAC,IAAI,CAAA;YACtC,CAAC;QACF,CAAC;IACF,CAAC;IAED,+EAA+E;IAC/E,yEAAyE;IACzE,+FAA+F;IAC/F,IAAI,kBAAkB,CAAC,OAA+C,CAAC,EAAE,CAAC;QACzE,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,EAAE,aAAa,EAAE;YACrD,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;SACxC,CAAC,CAAA;QACF,SAAS,CAAC,OAAO,CAAC,CAAA;IACnB,CAAC;IAED,IAAI,iBAAiB,EAAE,CAAC;QACvB,yEAAyE;QACzE,8DAA8D;QAC9D,MAAM,YAAY,GAAG,+BAA+B,CAAC,OAAO,CAAC,OAAO,EAAE;YACrE,OAAO,EAAE,mBAAmB;YAC5B,IAAI,EAAE,iBAAiB;SACvB,CAAC,CAAA;QACF,iBAAiB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;QACxC,mBAAmB,CAAC,YAAY,CAAC,CAAA;QACjC,oBAAoB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;QAC3C,OAAO,YAAY,CAAA;IACpB,CAAC;IAED,0BAA0B;IAC1B,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;IAClF,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,CAAA;IAEpD,oCAAoC;IACpC,MAAM,eAAe,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QACnD,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;KACtC,CAAC,CAAA;IAEF,iBAAiB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAA;IAC3C,mBAAmB,CAAC,eAAe,CAAC,CAAA;IACpC,oBAAoB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAA;IAE9C,OAAO,eAAe,CAAA;AACvB,CAAC"}
|
package/dist/types.d.ts
CHANGED
|
@@ -137,11 +137,15 @@ export interface TokenExchangeResult {
|
|
|
137
137
|
* could not be revived on this request — the issuer answered the refresh token
|
|
138
138
|
* `invalid_grant`, or a rejected access token arrived with no refresh token
|
|
139
139
|
* beside it — so offer a sign-in-again path; `refresh_failed` hit a fault that
|
|
140
|
-
* may pass
|
|
141
|
-
*
|
|
142
|
-
*
|
|
140
|
+
* may pass; `deferred` holds a refresh token this request deliberately did not
|
|
141
|
+
* spend, because it is a beacon or a prefetch whose response the browser would
|
|
142
|
+
* not apply (0.14.0) — the next consumable request refreshes, so treat it as a
|
|
143
|
+
* guest request and nothing more. NONE is proof the session is dead (the
|
|
144
|
+
* issuer's token store is eventually consistent), so never clear cookies on
|
|
145
|
+
* them: signing in again overwrites the cookies, and the middleware itself
|
|
146
|
+
* clears nothing.
|
|
143
147
|
*/
|
|
144
|
-
export type AuthSessionState = 'anonymous' | 'verified' | 'refreshed' | 'expired' | 'refresh_failed';
|
|
148
|
+
export type AuthSessionState = 'anonymous' | 'verified' | 'refreshed' | 'expired' | 'refresh_failed' | 'deferred';
|
|
145
149
|
declare global {
|
|
146
150
|
namespace App {
|
|
147
151
|
interface Locals {
|
package/dist/types.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,IAAI;IACpB,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACzB;AAED,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAA;AACpC,MAAM,MAAM,mBAAmB,GAAG,IAAI,CAAA;AAEtC,MAAM,WAAW,iBAAiB;IACjC,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,oBAAoB;IACpC,YAAY,EAAE;QACb,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,SAAS,CAAC,EAAE,MAAM,CAAA;KAClB,CAAA;IACD,SAAS,CAAC,EAAE,aAAa,GAAG,iBAAiB,GAAG,MAAM,CAAA;IACtD,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,iBAAiB,CAAA;CACxB;AAED,MAAM,WAAW,6BAA6B;IAC7C,iBAAiB,EAAE,MAAM,CAAA;IACzB,uBAAuB,EAAE,MAAM,CAAA;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,iBAAiB,CAAA;CACxB;AAED,MAAM,WAAW,4BAA4B;IAC5C,gBAAgB,EAAE,MAAM,CAAA;IACxB,uBAAuB,EAAE,MAAM,CAAA;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,iBAAiB,CAAA;CACxB;AAED,MAAM,WAAW,uBAAuB;IACvC,iBAAiB,EAAE,MAAM,CAAA;IACzB,iBAAiB,EAAE,MAAM,CAAA;IACzB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,iBAAiB,CAAA;CACxB;AAED,MAAM,WAAW,yBAAyB;IACzC,cAAc,EAAE,MAAM,CAAA;IACtB,aAAa,EAAE,MAAM,CAAA;IACrB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,WAAW,CAAC,EAAE,gBAAgB,CAAA;IAC9B,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,iBAAiB,CAAA;CACxB;AAED,MAAM,WAAW,+BAA+B;IAC/C,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,iBAAiB,CAAA;CACxB;AAED,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC,CAAA;AAE/E,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,oBAAoB,KAAK,kBAAkB,CAAA;AACjF,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,EAAE,6BAA6B,KAAK,kBAAkB,CAAA;AACnG,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE,4BAA4B,KAAK,kBAAkB,CAAA;AACjG,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,EAAE,uBAAuB,KAAK,kBAAkB,CAAA;AACvF,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,EAAE,yBAAyB,KAAK,kBAAkB,CAAA;AAC3F,MAAM,MAAM,wBAAwB,GAAG,CACtC,OAAO,EAAE,+BAA+B,KACpC,kBAAkB,CAAA;AAEvB;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,gBAAgB;IAChC,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,aAAa;IAC7B,KAAK,CAAC,EAAE,gBAAgB,CAAA;IACxB,cAAc,CAAC,EAAE,gBAAgB,CAAA;IACjC,aAAa,CAAC,EAAE,gBAAgB,CAAA;IAChC,QAAQ,CAAC,EAAE,gBAAgB,CAAA;IAC3B,UAAU,CAAC,EAAE,gBAAgB,CAAA;IAC7B,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;CACnC;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACrC,KAAK,CAAC,EAAE,aAAa,CAAA;IACrB,cAAc,CAAC,EAAE,sBAAsB,CAAA;IACvC,aAAa,CAAC,EAAE,qBAAqB,CAAA;IACrC,QAAQ,CAAC,EAAE,gBAAgB,CAAA;IAC3B,UAAU,CAAC,EAAE,kBAAkB,CAAA;IAC/B,gBAAgB,CAAC,EAAE,wBAAwB,CAAA;CAC3C;AAED,MAAM,WAAW,kBAAkB;IAClC,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE;QACP,GAAG,EAAE,MAAM,CAAA;QACX,KAAK,EAAE,MAAM,CAAA;QACb,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;QACpB,KAAK,CAAC,EAAE,MAAM,CAAA;KACd,CAAA;CACD;AAED,MAAM,WAAW,mBAAmB;IACnC,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,OAAO,CAAA;IAClB,QAAQ,EAAE,QAAQ,GAAG,UAAU,GAAG,YAAY,GAAG,SAAS,CAAA;IAC1D,MAAM,EAAE;QACP,GAAG,EAAE,MAAM,CAAA;QACX,KAAK,EAAE,MAAM,CAAA;QACb,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;QACpB,KAAK,CAAC,EAAE,MAAM,CAAA;KACd,CAAA;CACD;AAED
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,IAAI;IACpB,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACzB;AAED,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAA;AACpC,MAAM,MAAM,mBAAmB,GAAG,IAAI,CAAA;AAEtC,MAAM,WAAW,iBAAiB;IACjC,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,oBAAoB;IACpC,YAAY,EAAE;QACb,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,SAAS,CAAC,EAAE,MAAM,CAAA;KAClB,CAAA;IACD,SAAS,CAAC,EAAE,aAAa,GAAG,iBAAiB,GAAG,MAAM,CAAA;IACtD,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,iBAAiB,CAAA;CACxB;AAED,MAAM,WAAW,6BAA6B;IAC7C,iBAAiB,EAAE,MAAM,CAAA;IACzB,uBAAuB,EAAE,MAAM,CAAA;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,iBAAiB,CAAA;CACxB;AAED,MAAM,WAAW,4BAA4B;IAC5C,gBAAgB,EAAE,MAAM,CAAA;IACxB,uBAAuB,EAAE,MAAM,CAAA;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,iBAAiB,CAAA;CACxB;AAED,MAAM,WAAW,uBAAuB;IACvC,iBAAiB,EAAE,MAAM,CAAA;IACzB,iBAAiB,EAAE,MAAM,CAAA;IACzB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,iBAAiB,CAAA;CACxB;AAED,MAAM,WAAW,yBAAyB;IACzC,cAAc,EAAE,MAAM,CAAA;IACtB,aAAa,EAAE,MAAM,CAAA;IACrB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,WAAW,CAAC,EAAE,gBAAgB,CAAA;IAC9B,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,iBAAiB,CAAA;CACxB;AAED,MAAM,WAAW,+BAA+B;IAC/C,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,iBAAiB,CAAA;CACxB;AAED,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC,CAAA;AAE/E,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,oBAAoB,KAAK,kBAAkB,CAAA;AACjF,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,EAAE,6BAA6B,KAAK,kBAAkB,CAAA;AACnG,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE,4BAA4B,KAAK,kBAAkB,CAAA;AACjG,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,EAAE,uBAAuB,KAAK,kBAAkB,CAAA;AACvF,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,EAAE,yBAAyB,KAAK,kBAAkB,CAAA;AAC3F,MAAM,MAAM,wBAAwB,GAAG,CACtC,OAAO,EAAE,+BAA+B,KACpC,kBAAkB,CAAA;AAEvB;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,gBAAgB;IAChC,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,aAAa;IAC7B,KAAK,CAAC,EAAE,gBAAgB,CAAA;IACxB,cAAc,CAAC,EAAE,gBAAgB,CAAA;IACjC,aAAa,CAAC,EAAE,gBAAgB,CAAA;IAChC,QAAQ,CAAC,EAAE,gBAAgB,CAAA;IAC3B,UAAU,CAAC,EAAE,gBAAgB,CAAA;IAC7B,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;CACnC;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACrC,KAAK,CAAC,EAAE,aAAa,CAAA;IACrB,cAAc,CAAC,EAAE,sBAAsB,CAAA;IACvC,aAAa,CAAC,EAAE,qBAAqB,CAAA;IACrC,QAAQ,CAAC,EAAE,gBAAgB,CAAA;IAC3B,UAAU,CAAC,EAAE,kBAAkB,CAAA;IAC/B,gBAAgB,CAAC,EAAE,wBAAwB,CAAA;CAC3C;AAED,MAAM,WAAW,kBAAkB;IAClC,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE;QACP,GAAG,EAAE,MAAM,CAAA;QACX,KAAK,EAAE,MAAM,CAAA;QACb,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;QACpB,KAAK,CAAC,EAAE,MAAM,CAAA;KACd,CAAA;CACD;AAED,MAAM,WAAW,mBAAmB;IACnC,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,OAAO,CAAA;IAClB,QAAQ,EAAE,QAAQ,GAAG,UAAU,GAAG,YAAY,GAAG,SAAS,CAAA;IAC1D,MAAM,EAAE;QACP,GAAG,EAAE,MAAM,CAAA;QACX,KAAK,EAAE,MAAM,CAAA;QACb,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;QACpB,KAAK,CAAC,EAAE,MAAM,CAAA;KACd,CAAA;CACD;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,gBAAgB,GACzB,WAAW,GACX,UAAU,GACV,WAAW,GACX,SAAS,GACT,gBAAgB,GAChB,UAAU,CAAA;AAGb,OAAO,CAAC,MAAM,CAAC;IACd,UAAU,GAAG,CAAC;QACb,UAAU,MAAM;YACf,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;YACjB,WAAW,CAAC,EAAE,gBAAgB,CAAA;YAC9B,SAAS,CAAC,EAAE,OAAO,CAAA;SACnB;KACD;CACD"}
|
package/dist/utils/index.d.ts
CHANGED
|
@@ -7,6 +7,7 @@ export { type BridgeMigrationOptions, type BridgeMigrationStatement, buildLegacy
|
|
|
7
7
|
export { signIdentityCookie, verifyIdentityCookie } from './identity-cookie.js';
|
|
8
8
|
export { EXCHANGE_SECRET_FAILURE, type ExchangeSecretFailure, getAuthorizationUrl, getMagicLinkUrl, getPasswordLoginUrl, } from './openauth.js';
|
|
9
9
|
export { createPKCEChallenge, generatePKCE } from './pkce.js';
|
|
10
|
+
export { classifyRefreshCarrier, prefetchDeferredResponse, type RefreshCarrier, } from './refresh-carrier.js';
|
|
10
11
|
export { generateState, verifyState } from './state.js';
|
|
11
12
|
export type { RefreshFailure, RefreshFailureReason, VerifiedClaims } from './tokens.js';
|
|
12
13
|
//# sourceMappingURL=index.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,oBAAoB,EACpB,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,EAC1B,qBAAqB,EACrB,cAAc,GACd,MAAM,gBAAgB,CAAA;AACvB,YAAY,EACX,mBAAmB,EACnB,+BAA+B,EAC/B,kBAAkB,GAClB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AAC/E,OAAO,EACN,kBAAkB,EAClB,KAAK,OAAO,EACZ,oBAAoB,EACpB,UAAU,EACV,aAAa,EACb,aAAa,GACb,MAAM,UAAU,CAAA;AACjB,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAA;AAC9D,OAAO,EACN,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC7B,gCAAgC,EAChC,mCAAmC,EACnC,wBAAwB,EACxB,iBAAiB,EACjB,0BAA0B,EAC1B,yBAAyB,EACzB,uBAAuB,EACvB,2BAA2B,EAC3B,wBAAwB,EACxB,6BAA6B,GAC7B,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAC/E,OAAO,EACN,uBAAuB,EACvB,KAAK,qBAAqB,EAC1B,mBAAmB,EACnB,eAAe,EACf,mBAAmB,GACnB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAC7D,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AACvD,YAAY,EAAE,cAAc,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA"}
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,oBAAoB,EACpB,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,EAC1B,qBAAqB,EACrB,cAAc,GACd,MAAM,gBAAgB,CAAA;AACvB,YAAY,EACX,mBAAmB,EACnB,+BAA+B,EAC/B,kBAAkB,GAClB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AAC/E,OAAO,EACN,kBAAkB,EAClB,KAAK,OAAO,EACZ,oBAAoB,EACpB,UAAU,EACV,aAAa,EACb,aAAa,GACb,MAAM,UAAU,CAAA;AACjB,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAA;AAC9D,OAAO,EACN,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC7B,gCAAgC,EAChC,mCAAmC,EACnC,wBAAwB,EACxB,iBAAiB,EACjB,0BAA0B,EAC1B,yBAAyB,EACzB,uBAAuB,EACvB,2BAA2B,EAC3B,wBAAwB,EACxB,6BAA6B,GAC7B,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAC/E,OAAO,EACN,uBAAuB,EACvB,KAAK,qBAAqB,EAC1B,mBAAmB,EACnB,eAAe,EACf,mBAAmB,GACnB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAC7D,OAAO,EACN,sBAAsB,EACtB,wBAAwB,EACxB,KAAK,cAAc,GACnB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AACvD,YAAY,EAAE,cAAc,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA"}
|
package/dist/utils/index.js
CHANGED
|
@@ -6,5 +6,6 @@ export { buildLegacyIdentitySubjectCanary, buildLegacyIdentitySubjectMigration,
|
|
|
6
6
|
export { signIdentityCookie, verifyIdentityCookie } from './identity-cookie.js';
|
|
7
7
|
export { EXCHANGE_SECRET_FAILURE, getAuthorizationUrl, getMagicLinkUrl, getPasswordLoginUrl, } from './openauth.js';
|
|
8
8
|
export { createPKCEChallenge, generatePKCE } from './pkce.js';
|
|
9
|
+
export { classifyRefreshCarrier, prefetchDeferredResponse, } from './refresh-carrier.js';
|
|
9
10
|
export { generateState, verifyState } from './state.js';
|
|
10
11
|
//# sourceMappingURL=index.js.map
|
package/dist/utils/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAIN,oBAAoB,EACpB,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,EAC1B,qBAAqB,EACrB,cAAc,GACd,MAAM,gBAAgB,CAAA;AAMvB,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AAC/E,OAAO,EACN,kBAAkB,EAElB,oBAAoB,EACpB,UAAU,EACV,aAAa,EACb,aAAa,GACb,MAAM,UAAU,CAAA;AACjB,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAA;AAC9D,OAAO,EAGN,gCAAgC,EAChC,mCAAmC,EACnC,wBAAwB,EACxB,iBAAiB,EACjB,0BAA0B,EAC1B,yBAAyB,EACzB,uBAAuB,EACvB,2BAA2B,EAC3B,wBAAwB,EACxB,6BAA6B,GAC7B,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAC/E,OAAO,EACN,uBAAuB,EAEvB,mBAAmB,EACnB,eAAe,EACf,mBAAmB,GACnB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAC7D,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA"}
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAIN,oBAAoB,EACpB,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,EAC1B,qBAAqB,EACrB,cAAc,GACd,MAAM,gBAAgB,CAAA;AAMvB,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AAC/E,OAAO,EACN,kBAAkB,EAElB,oBAAoB,EACpB,UAAU,EACV,aAAa,EACb,aAAa,GACb,MAAM,UAAU,CAAA;AACjB,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAA;AAC9D,OAAO,EAGN,gCAAgC,EAChC,mCAAmC,EACnC,wBAAwB,EACxB,iBAAiB,EACjB,0BAA0B,EAC1B,yBAAyB,EACzB,uBAAuB,EACvB,2BAA2B,EAC3B,wBAAwB,EACxB,6BAA6B,GAC7B,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAC/E,OAAO,EACN,uBAAuB,EAEvB,mBAAmB,EACnB,eAAe,EACf,mBAAmB,GACnB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAC7D,OAAO,EACN,sBAAsB,EACtB,wBAAwB,GAExB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA"}
|
|
@@ -0,0 +1,10 @@
|
|
|
1
|
+
export type RefreshCarrier = 'consumable' | 'beacon' | 'prefetch';
|
|
2
|
+
export declare function classifyRefreshCarrier(request: Request): RefreshCarrier;
|
|
3
|
+
/**
|
|
4
|
+
* The answer to a prefetch that would have needed a refresh. Non-2xx, so the
|
|
5
|
+
* browser drops it and navigates for real; 425 because the server declines a
|
|
6
|
+
* request it may never be asked to honour. `Vary` keeps a shared cache from
|
|
7
|
+
* serving it to the navigation.
|
|
8
|
+
*/
|
|
9
|
+
export declare function prefetchDeferredResponse(): Response;
|
|
10
|
+
//# sourceMappingURL=refresh-carrier.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"refresh-carrier.d.ts","sourceRoot":"","sources":["../../src/utils/refresh-carrier.ts"],"names":[],"mappings":"AA2BA,MAAM,MAAM,cAAc,GAAG,YAAY,GAAG,QAAQ,GAAG,UAAU,CAAA;AAyBjE,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,cAAc,CAIvE;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,IAAI,QAAQ,CASnD"}
|
|
@@ -0,0 +1,76 @@
|
|
|
1
|
+
// Which requests may spend a refresh token.
|
|
2
|
+
//
|
|
3
|
+
// A refresh rotates the token: the issuer retires the one presented and the
|
|
4
|
+
// response carries its successor as a Set-Cookie. If that response is never
|
|
5
|
+
// applied, the browser keeps presenting a token nothing will accept again, and
|
|
6
|
+
// the member is locked out until they sign in again (fronts, 2026-09: the
|
|
7
|
+
// issuer's `oauth.token_refresh.rejected` with disposition `rotated` and an
|
|
8
|
+
// `unused` successor is exactly this shape). So a refresh belongs only on a
|
|
9
|
+
// request whose response the browser is waiting for and will apply:
|
|
10
|
+
//
|
|
11
|
+
// - A beacon (`navigator.sendBeacon`, `fetch` with `mode: 'no-cors'`, an
|
|
12
|
+
// `<a ping>`, a Reporting API upload) is fire-and-forget. Its response is
|
|
13
|
+
// discarded, often after the document that sent it is gone. Refreshing on
|
|
14
|
+
// one spends the token for nobody. The request proceeds as a guest and the
|
|
15
|
+
// next consumable request refreshes instead.
|
|
16
|
+
//
|
|
17
|
+
// - A prefetch or prerender (speculation rules, `<link rel="prefetch">`) is
|
|
18
|
+
// speculative: it is the request class the browser cancels most (fronts:
|
|
19
|
+
// 6.5% of prefetches end `canceled` against 1.4% of all requests), and a
|
|
20
|
+
// prefetched document rendered as a guest would be shown to the member on
|
|
21
|
+
// navigation as if they had been signed out. The request is answered with a
|
|
22
|
+
// non-2xx the browser will not use, so the real navigation refreshes.
|
|
23
|
+
//
|
|
24
|
+
// Sec-Fetch-* and Sec-Purpose are browser-set and cannot be forged by page
|
|
25
|
+
// script. Where a client sends none of them, the request is treated as
|
|
26
|
+
// consumable, which is exactly the pre-0.14 behaviour.
|
|
27
|
+
function headerLower(request, name) {
|
|
28
|
+
return (request.headers.get(name) ?? '').toLowerCase();
|
|
29
|
+
}
|
|
30
|
+
/** Speculation-rules and legacy prefetch/prerender markers. */
|
|
31
|
+
function isPrefetch(request) {
|
|
32
|
+
const secPurpose = headerLower(request, 'sec-purpose');
|
|
33
|
+
if (secPurpose.includes('prefetch') || secPurpose.includes('prerender'))
|
|
34
|
+
return true;
|
|
35
|
+
if (headerLower(request, 'purpose') === 'prefetch')
|
|
36
|
+
return true;
|
|
37
|
+
const xPurpose = headerLower(request, 'x-purpose');
|
|
38
|
+
if (xPurpose === 'prefetch' || xPurpose === 'preview')
|
|
39
|
+
return true;
|
|
40
|
+
return headerLower(request, 'x-moz') === 'prefetch';
|
|
41
|
+
}
|
|
42
|
+
/** Fire-and-forget requests whose response nobody reads. */
|
|
43
|
+
function isBeacon(request) {
|
|
44
|
+
const dest = headerLower(request, 'sec-fetch-dest');
|
|
45
|
+
if (dest === 'report')
|
|
46
|
+
return true;
|
|
47
|
+
if (dest === 'empty' && headerLower(request, 'sec-fetch-mode') === 'no-cors')
|
|
48
|
+
return true;
|
|
49
|
+
if (headerLower(request, 'content-type').startsWith('text/ping'))
|
|
50
|
+
return true;
|
|
51
|
+
return request.headers.has('ping-to');
|
|
52
|
+
}
|
|
53
|
+
export function classifyRefreshCarrier(request) {
|
|
54
|
+
if (isPrefetch(request))
|
|
55
|
+
return 'prefetch';
|
|
56
|
+
if (isBeacon(request))
|
|
57
|
+
return 'beacon';
|
|
58
|
+
return 'consumable';
|
|
59
|
+
}
|
|
60
|
+
/**
|
|
61
|
+
* The answer to a prefetch that would have needed a refresh. Non-2xx, so the
|
|
62
|
+
* browser drops it and navigates for real; 425 because the server declines a
|
|
63
|
+
* request it may never be asked to honour. `Vary` keeps a shared cache from
|
|
64
|
+
* serving it to the navigation.
|
|
65
|
+
*/
|
|
66
|
+
export function prefetchDeferredResponse() {
|
|
67
|
+
return new Response(null, {
|
|
68
|
+
status: 425,
|
|
69
|
+
statusText: 'Too Early',
|
|
70
|
+
headers: {
|
|
71
|
+
'Cache-Control': 'private, no-store',
|
|
72
|
+
Vary: 'Sec-Purpose, Cookie',
|
|
73
|
+
},
|
|
74
|
+
});
|
|
75
|
+
}
|
|
76
|
+
//# sourceMappingURL=refresh-carrier.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"refresh-carrier.js","sourceRoot":"","sources":["../../src/utils/refresh-carrier.ts"],"names":[],"mappings":"AAAA,4CAA4C;AAC5C,EAAE;AACF,4EAA4E;AAC5E,4EAA4E;AAC5E,+EAA+E;AAC/E,0EAA0E;AAC1E,4EAA4E;AAC5E,4EAA4E;AAC5E,oEAAoE;AACpE,EAAE;AACF,yEAAyE;AACzE,4EAA4E;AAC5E,4EAA4E;AAC5E,6EAA6E;AAC7E,+CAA+C;AAC/C,EAAE;AACF,4EAA4E;AAC5E,2EAA2E;AAC3E,2EAA2E;AAC3E,4EAA4E;AAC5E,8EAA8E;AAC9E,wEAAwE;AACxE,EAAE;AACF,2EAA2E;AAC3E,uEAAuE;AACvE,uDAAuD;AAIvD,SAAS,WAAW,CAAC,OAAgB,EAAE,IAAY;IAClD,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;AACvD,CAAC;AAED,+DAA+D;AAC/D,SAAS,UAAU,CAAC,OAAgB;IACnC,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;IACtD,IAAI,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAA;IACpF,IAAI,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC,KAAK,UAAU;QAAE,OAAO,IAAI,CAAA;IAC/D,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;IAClD,IAAI,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IAClE,OAAO,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,UAAU,CAAA;AACpD,CAAC;AAED,4DAA4D;AAC5D,SAAS,QAAQ,CAAC,OAAgB;IACjC,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAA;IACnD,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IAClC,IAAI,IAAI,KAAK,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,gBAAgB,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IACzF,IAAI,WAAW,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAA;IAC7E,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;AACtC,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAgB;IACtD,IAAI,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,UAAU,CAAA;IAC1C,IAAI,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,QAAQ,CAAA;IACtC,OAAO,YAAY,CAAA;AACpB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB;IACvC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACzB,MAAM,EAAE,GAAG;QACX,UAAU,EAAE,WAAW;QACvB,OAAO,EAAE;YACR,eAAe,EAAE,mBAAmB;YACpC,IAAI,EAAE,qBAAqB;SAC3B;KACD,CAAC,CAAA;AACH,CAAC"}
|
|
@@ -0,0 +1,9 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Run `exchange` unless an identical exchange is already in flight in this
|
|
3
|
+
* isolate, in which case share its promise. `parts` identify the exchange:
|
|
4
|
+
* issuer, client, resource and the refresh token.
|
|
5
|
+
*/
|
|
6
|
+
export declare function singleFlightRefresh<T>(parts: readonly string[], exchange: () => Promise<T>): Promise<T>;
|
|
7
|
+
/** @internal Test-only. Reports how many refreshes are in flight right now. */
|
|
8
|
+
export declare function _refreshFlightsInProgress(): number;
|
|
9
|
+
//# sourceMappingURL=refresh-flight.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"refresh-flight.d.ts","sourceRoot":"","sources":["../../src/utils/refresh-flight.ts"],"names":[],"mappings":"AAkCA;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,EACpC,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,QAAQ,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACxB,OAAO,CAAC,CAAC,CAAC,CAWZ;AAED,+EAA+E;AAC/E,wBAAgB,yBAAyB,IAAI,MAAM,CAElD"}
|
|
@@ -0,0 +1,55 @@
|
|
|
1
|
+
// One in-flight refresh per refresh token, per isolate.
|
|
2
|
+
//
|
|
3
|
+
// A page whose access token has just expired does not send one request: the
|
|
4
|
+
// document, its same-origin fetches, images and prefetches all arrive within
|
|
5
|
+
// the same second, every one carrying the same refresh token, and every one
|
|
6
|
+
// used to POST /token on its own. The issuer converges them — inside its
|
|
7
|
+
// reuse window (identity-platform: 600s) a re-presented token gets the same
|
|
8
|
+
// successor back — so the race was never a rejection, but it was N exchanges,
|
|
9
|
+
// N JWKS verifications and N marker writes for one rotation. Callers that
|
|
10
|
+
// arrive while an exchange for the same token is in flight now await that
|
|
11
|
+
// exchange and receive its outcome, success or failure alike.
|
|
12
|
+
//
|
|
13
|
+
// Scope is deliberately the isolate. Two tabs are two documents but one
|
|
14
|
+
// cookie jar, so their concurrent refreshes carry the same token and land, in
|
|
15
|
+
// practice, on the same colo and usually the same isolate; where they do not,
|
|
16
|
+
// the issuer's reuse window already converges them, and a cross-isolate lock
|
|
17
|
+
// (KV, Durable Object) would put a network round trip and a new dependency on
|
|
18
|
+
// every refresh to solve a case that is already solved. Nothing is retained
|
|
19
|
+
// after the flight settles for the same reason: a client-side successor cache
|
|
20
|
+
// would be a weaker copy of the issuer's reuse window.
|
|
21
|
+
//
|
|
22
|
+
// The map lives only in this isolate's memory and is keyed on the token
|
|
23
|
+
// together with its client context. Keying synchronously is what makes the
|
|
24
|
+
// guarantee hold: a caller that arrives while a flight is registered shares it,
|
|
25
|
+
// with no asynchronous gap between "look" and "register" for a second caller
|
|
26
|
+
// to slip through. The token is already held as a string by the request that
|
|
27
|
+
// carried it, so the key adds nothing a heap dump did not have.
|
|
28
|
+
const inFlight = new Map();
|
|
29
|
+
function flightKey(parts) {
|
|
30
|
+
return parts.join('\u001f');
|
|
31
|
+
}
|
|
32
|
+
/**
|
|
33
|
+
* Run `exchange` unless an identical exchange is already in flight in this
|
|
34
|
+
* isolate, in which case share its promise. `parts` identify the exchange:
|
|
35
|
+
* issuer, client, resource and the refresh token.
|
|
36
|
+
*/
|
|
37
|
+
export function singleFlightRefresh(parts, exchange) {
|
|
38
|
+
const key = flightKey(parts);
|
|
39
|
+
const existing = inFlight.get(key);
|
|
40
|
+
if (existing)
|
|
41
|
+
return existing;
|
|
42
|
+
const flight = Promise.resolve()
|
|
43
|
+
.then(exchange)
|
|
44
|
+
.finally(() => {
|
|
45
|
+
if (inFlight.get(key) === flight)
|
|
46
|
+
inFlight.delete(key);
|
|
47
|
+
});
|
|
48
|
+
inFlight.set(key, flight);
|
|
49
|
+
return flight;
|
|
50
|
+
}
|
|
51
|
+
/** @internal Test-only. Reports how many refreshes are in flight right now. */
|
|
52
|
+
export function _refreshFlightsInProgress() {
|
|
53
|
+
return inFlight.size;
|
|
54
|
+
}
|
|
55
|
+
//# sourceMappingURL=refresh-flight.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"refresh-flight.js","sourceRoot":"","sources":["../../src/utils/refresh-flight.ts"],"names":[],"mappings":"AAAA,wDAAwD;AACxD,EAAE;AACF,4EAA4E;AAC5E,6EAA6E;AAC7E,4EAA4E;AAC5E,yEAAyE;AACzE,4EAA4E;AAC5E,8EAA8E;AAC9E,0EAA0E;AAC1E,0EAA0E;AAC1E,8DAA8D;AAC9D,EAAE;AACF,wEAAwE;AACxE,8EAA8E;AAC9E,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAC9E,4EAA4E;AAC5E,8EAA8E;AAC9E,uDAAuD;AACvD,EAAE;AACF,wEAAwE;AACxE,2EAA2E;AAC3E,gFAAgF;AAChF,6EAA6E;AAC7E,6EAA6E;AAC7E,gEAAgE;AAEhE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA4B,CAAA;AAEpD,SAAS,SAAS,CAAC,KAAwB;IAC1C,OAAO,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;AAC5B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAClC,KAAwB,EACxB,QAA0B;IAE1B,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;IAC5B,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAClC,IAAI,QAAQ;QAAE,OAAO,QAAsB,CAAA;IAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE;SAC9B,IAAI,CAAC,QAAQ,CAAC;SACd,OAAO,CAAC,GAAG,EAAE;QACb,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,MAAM;YAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IACvD,CAAC,CAAC,CAAA;IACH,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IACzB,OAAO,MAAM,CAAA;AACd,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,yBAAyB;IACxC,OAAO,QAAQ,CAAC,IAAI,CAAA;AACrB,CAAC"}
|
package/dist/utils/tokens.d.ts
CHANGED
|
@@ -46,6 +46,13 @@ export interface RefreshFailure {
|
|
|
46
46
|
/** The OAuth `error` code the issuer returned, when it was readable. */
|
|
47
47
|
error?: string;
|
|
48
48
|
}
|
|
49
|
+
/**
|
|
50
|
+
* Exchange a refresh token for new tokens. Concurrent calls for the same token
|
|
51
|
+
* (same issuer, client and resource) within one isolate share a single
|
|
52
|
+
* exchange and receive its outcome — see `refresh-flight.ts` for why the scope
|
|
53
|
+
* is the isolate and nothing is cached once the flight settles. `onFailure` is
|
|
54
|
+
* this caller's own reporter and fires for followers as well as the leader.
|
|
55
|
+
*/
|
|
49
56
|
export declare function refreshTokens(issuer: string, refreshToken: string, clientId?: string, clientSecret?: string, resource?: string, onFailure?: (failure: RefreshFailure) => void): Promise<TokenRefreshResult | null>;
|
|
50
57
|
export declare function decodeJwtPayload(jwt: string): Record<string, unknown>;
|
|
51
58
|
/** @internal Test-only helper. Not exported from @growth-labs/auth/utils. */
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/utils/tokens.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;
|
|
1
|
+
{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/utils/tokens.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAgErD,MAAM,WAAW,cAAc;IAC9B,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;IAChB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;CACpB;AAED,MAAM,WAAW,kBAAmB,SAAQ,cAAc;IACzD,SAAS,EAAE,OAAO,CAAA;CAClB;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,kBAAkB,CAWvF;AAYD,MAAM,WAAW,wBAAwB;IACxC,iFAAiF;IACjF,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC5B,iGAAiG;IACjG,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACrB,oFAAoF;IACpF,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,sEAAsE;IACtE,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,4EAA4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAA;CAClB;AAmDD,wBAAsB,iBAAiB,CACtC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,wBAA6B,GACpC,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAuBhC;AAED,wBAAsB,6BAA6B,CAClD,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC1B,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAKpC;AA6BD;;;;;;;GAOG;AACH,MAAM,MAAM,oBAAoB,GAC7B,eAAe,GACf,iBAAiB,GACjB,cAAc,GACd,oBAAoB,GACpB,iBAAiB,GACjB,SAAS,GACT,gBAAgB;AAClB,0DAA0D;GACxD,YAAY,CAAA;AAEf,MAAM,WAAW,cAAc;IAC9B,MAAM,EAAE,oBAAoB,CAAA;IAC5B,8DAA8D;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAA;CACd;AA8ED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAClC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,MAAM,EACjB,YAAY,CAAC,EAAE,MAAM,EACrB,QAAQ,CAAC,EAAE,MAAM,EACjB,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,IAAI,GAC3C,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAkBpC;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAErE;AAED,6EAA6E;AAC7E,wBAAgB,eAAe,IAAI,IAAI,CAEtC"}
|
package/dist/utils/tokens.js
CHANGED
|
@@ -2,6 +2,7 @@ import { createLocalJWKSet, jwtVerify } from 'jose';
|
|
|
2
2
|
import { JWTExpired } from 'jose/errors';
|
|
3
3
|
import { createClientSecretBasicAuthHeader } from './client-secret-header.js';
|
|
4
4
|
import { extractIdentityId } from './identity.js';
|
|
5
|
+
import { singleFlightRefresh } from './refresh-flight.js';
|
|
5
6
|
const JWKS_TTL = 600_000; // 10 minutes in ms
|
|
6
7
|
const jwksCache = new Map();
|
|
7
8
|
async function getJWKS(issuer, requiredKid) {
|
|
@@ -169,25 +170,7 @@ async function oauthErrorCode(response) {
|
|
|
169
170
|
return undefined;
|
|
170
171
|
}
|
|
171
172
|
}
|
|
172
|
-
|
|
173
|
-
// Reporting is advisory: a callback that throws must not change the outcome,
|
|
174
|
-
// and the catch below must not report a second time on its behalf.
|
|
175
|
-
let reported = false;
|
|
176
|
-
const report = (failure) => {
|
|
177
|
-
if (reported)
|
|
178
|
-
return;
|
|
179
|
-
reported = true;
|
|
180
|
-
try {
|
|
181
|
-
onFailure?.(failure);
|
|
182
|
-
}
|
|
183
|
-
catch {
|
|
184
|
-
/* the caller's reporter is not this function's failure */
|
|
185
|
-
}
|
|
186
|
-
};
|
|
187
|
-
if (!resource) {
|
|
188
|
-
report({ reason: 'not_configured' });
|
|
189
|
-
return null;
|
|
190
|
-
}
|
|
173
|
+
async function exchangeRefreshToken(issuer, refreshToken, clientId, clientSecret, resource) {
|
|
191
174
|
try {
|
|
192
175
|
const params = new URLSearchParams({
|
|
193
176
|
grant_type: 'refresh_token',
|
|
@@ -214,25 +197,53 @@ export async function refreshTokens(issuer, refreshToken, clientId, clientSecret
|
|
|
214
197
|
: response.status >= 500
|
|
215
198
|
? 'issuer_error'
|
|
216
199
|
: 'issuer_rejected';
|
|
217
|
-
|
|
218
|
-
|
|
200
|
+
return {
|
|
201
|
+
result: null,
|
|
202
|
+
failure: { reason, status: response.status, ...(error ? { error } : {}) },
|
|
203
|
+
};
|
|
219
204
|
}
|
|
220
205
|
const data = await response.json().catch(() => null);
|
|
221
206
|
if (!tokenResponseHasTokens(data)) {
|
|
222
|
-
|
|
223
|
-
return null;
|
|
207
|
+
return { result: null, failure: { reason: 'malformed_response', status: response.status } };
|
|
224
208
|
}
|
|
225
209
|
const claims = await verifyIssuedAccessTokenClaims(issuer, data.access_token, resource);
|
|
226
210
|
if (!claims) {
|
|
227
|
-
|
|
228
|
-
return null;
|
|
211
|
+
return { result: null, failure: { reason: 'claims_rejected', status: response.status } };
|
|
229
212
|
}
|
|
230
|
-
return
|
|
213
|
+
return {
|
|
214
|
+
result: tokenResultFromClaims(data.access_token, data.refresh_token, claims),
|
|
215
|
+
failure: null,
|
|
216
|
+
};
|
|
231
217
|
}
|
|
232
218
|
catch {
|
|
233
|
-
|
|
219
|
+
return { result: null, failure: { reason: 'network' } };
|
|
220
|
+
}
|
|
221
|
+
}
|
|
222
|
+
/**
|
|
223
|
+
* Exchange a refresh token for new tokens. Concurrent calls for the same token
|
|
224
|
+
* (same issuer, client and resource) within one isolate share a single
|
|
225
|
+
* exchange and receive its outcome — see `refresh-flight.ts` for why the scope
|
|
226
|
+
* is the isolate and nothing is cached once the flight settles. `onFailure` is
|
|
227
|
+
* this caller's own reporter and fires for followers as well as the leader.
|
|
228
|
+
*/
|
|
229
|
+
export async function refreshTokens(issuer, refreshToken, clientId, clientSecret, resource, onFailure) {
|
|
230
|
+
// Reporting is advisory: a callback that throws must not change the outcome.
|
|
231
|
+
const report = (failure) => {
|
|
232
|
+
try {
|
|
233
|
+
onFailure?.(failure);
|
|
234
|
+
}
|
|
235
|
+
catch {
|
|
236
|
+
/* the caller's reporter is not this function's failure */
|
|
237
|
+
}
|
|
238
|
+
};
|
|
239
|
+
if (!resource) {
|
|
240
|
+
report({ reason: 'not_configured' });
|
|
234
241
|
return null;
|
|
235
242
|
}
|
|
243
|
+
const exchange = await singleFlightRefresh([issuer, clientId ?? '', resource, refreshToken], () => exchangeRefreshToken(issuer, refreshToken, clientId, clientSecret, resource));
|
|
244
|
+
if (exchange.failure)
|
|
245
|
+
report(exchange.failure);
|
|
246
|
+
return exchange.result;
|
|
236
247
|
}
|
|
237
248
|
export function decodeJwtPayload(jwt) {
|
|
238
249
|
return decodeJwtSegment(jwt, 1) ?? {};
|
package/dist/utils/tokens.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/utils/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC,OAAO,EAAE,iCAAiC,EAAE,MAAM,2BAA2B,CAAA;AAC7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;
|
|
1
|
+
{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/utils/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC,OAAO,EAAE,iCAAiC,EAAE,MAAM,2BAA2B,CAAA;AAC7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAIzD,MAAM,QAAQ,GAAG,OAAO,CAAA,CAAC,mBAAmB;AAQ5C,MAAM,SAAS,GAAG,IAAI,GAAG,EAA0B,CAAA;AAEnD,KAAK,UAAU,OAAO,CAAC,MAAc,EAAE,WAAoB;IAC1D,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IAEtB,IAAI,KAAK,EAAE,CAAC;QACX,MAAM,UAAU,GAAG,GAAG,GAAG,KAAK,CAAC,SAAS,GAAG,QAAQ,CAAA;QACnD,MAAM,UAAU,GAAG,WAAW,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QAC5E,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,EAAE,CAAC;YAChC,OAAO,KAAK,CAAC,IAAI,CAAA;QAClB,CAAC;IACF,CAAC;IAED,IAAI,QAAkB,CAAA;IACtB,IAAI,CAAC;QACJ,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,wBAAwB,CAAC,CAAA;QACzD,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;IAC3E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC,IAAI,CAAA;QAC5B,MAAM,GAAG,CAAA;IACV,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA2B,CAAA;IAC9D,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAA;IACpC,MAAM,IAAI,GAAG,IAAI,GAAG,CACnB,IAAI,CAAC,IAAI;SACP,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAsB,CAAC,GAAG,CAAC;SACvC,MAAM,CAAC,CAAC,GAAG,EAAiB,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CACzD,CAAA;IACD,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAA;IACrD,OAAO,IAAI,CAAA;AACZ,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAW,EAAE,KAAa;IACnD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACnC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAClE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IACrF,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA;AAChC,CAAC;AAED,SAAS,eAAe,CAAC,GAAW;IACnC,IAAI,CAAC;QACJ,OAAO,gBAAgB,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IACtC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAA;IACV,CAAC;AACF,CAAC;AAkBD,MAAM,UAAU,kBAAkB,CAAC,OAAgC;IAClE,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAA4B,CAAA;IACxE,MAAM,iBAAiB,GAAG,OAAO,CAAC,SAAS,CAAA;IAE3C,OAAO;QACN,GAAG,EAAE,OAAO,CAAC,GAAa;QAC1B,KAAK,EAAE,CAAC,UAAU,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAW;QACpD,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAuB;QAC7D,KAAK,EAAE,CAAC,UAAU,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAuB;QAChE,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,SAAS,IAAI,iBAAiB,CAAC;KAC7D,CAAA;AACF,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAY;IACtC,OAAO,CACN,GAAG,YAAY,UAAU;QACzB,CAAC,OAAO,GAAG,KAAK,QAAQ;YACvB,GAAG,KAAK,IAAI;YACZ,MAAM,IAAI,GAAG;YACZ,GAA0B,CAAC,IAAI,KAAK,iBAAiB,CAAC,CACxD,CAAA;AACF,CAAC;AAeD,KAAK,UAAU,wBAAwB,CACtC,MAAc,EACd,KAAa,EACb,UAAoC,EAAE;IAEtC,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;QACrC,MAAM,GAAG,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;QACnE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,UAAU,IAAI,MAAM,EAAE,GAAG,CAAC,CAAA;QAC7D,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;YAChD,MAAM;YACN,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC;YAC3C,cAAc,EAAE,OAAO,CAAC,SAAS;SACjC,CAAC,CAAA;QACF,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;YAC9B,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;YACrC,IACC,OAAO,CAAC,IAAI,KAAK,MAAM;gBACvB,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;gBAC/B,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;gBAC/B,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;gBAC/B,OAAO,UAAU,KAAK,QAAQ;gBAC9B,UAAU,KAAK,IAAI,EAClB,CAAC;gBACF,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;YACjE,CAAC;YACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YAC7C,IACC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC;gBACrE,UAAsC,CAAC,MAAM,KAAK,MAAM;gBACzD,OAAQ,UAAsC,CAAC,KAAK,KAAK,QAAQ;gBAChE,UAAsC,CAAC,KAAK,KAAK,EAAE,EACnD,CAAC;gBACF,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;YACjE,CAAC;QACF,CAAC;QACD,OAAO,OAAkC,CAAA;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAA;QAC/C,CAAC;QACD,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACtC,MAAc,EACd,KAAa,EACb,UAAoC,EAAE;IAEtC,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAA;IACtE,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAA;IACzB,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAA;IAC1C,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAA4B,CAAA;IACxE,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC;QAC1C,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;QAC3E,CAAC,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;YAChC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;YACf,CAAC,CAAC,EAAE,CAAA;IACN,OAAO;QACN,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,SAAS,EAAE,OAAO,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QACxD,OAAO,EAAE,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;QAC1E,MAAM,EAAE,OAAO,UAAU,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QAC7E,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC;YAClC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;YAC7E,CAAC,CAAC,SAAS;QACZ,SAAS,EAAE,QAAQ;KACnB,CAAA;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAClD,MAAc,EACd,KAAa,EACb,QAA4B;IAE5B,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAA;IAC1B,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC3E,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAA;IACzB,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAA;AACnC,CAAC;AAED,SAAS,sBAAsB,CAC9B,IAAa;IAEb,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC3D,OAAO,CACN,OAAQ,IAAmC,CAAC,YAAY,KAAK,QAAQ;QACrE,OAAQ,IAAoC,CAAC,aAAa,KAAK,QAAQ,CACvE,CAAA;AACF,CAAC;AAED,SAAS,qBAAqB,CAC7B,WAAmB,EACnB,YAAoB,EACpB,MAA0B;IAE1B,OAAO;QACN,WAAW;QACX,YAAY;QACZ,MAAM,EAAE;YACP,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,KAAK,EAAE,MAAM,CAAC,KAAK;SACnB;KACD,CAAA;AACF,CAAC;AA6BD,KAAK,UAAU,cAAc,CAAC,QAAkB;IAC/C,IAAI,CAAC;QACJ,MAAM,IAAI,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;QAC3C,MAAM,IAAI,GAAI,IAAmC,EAAE,KAAK,CAAA;QACxD,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;IACnD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAA;IACjB,CAAC;AACF,CAAC;AAOD,KAAK,UAAU,oBAAoB,CAClC,MAAc,EACd,YAAoB,EACpB,QAA4B,EAC5B,YAAgC,EAChC,QAAgB;IAEhB,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YAClC,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,YAAY;SAC3B,CAAC,CAAA;QACF,IAAI,QAAQ;YAAE,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;QAC/C,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;QAEhC,MAAM,OAAO,GAA2B;YACvC,cAAc,EAAE,mCAAmC;SACnD,CAAA;QACD,IAAI,QAAQ,IAAI,YAAY,EAAE,CAAC;YAC9B,OAAO,CAAC,aAAa,GAAG,iCAAiC,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAA;QAClF,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,QAAQ,EAAE;YAC/C,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;SACvB,CAAC,CAAA;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAA;YAC5C,MAAM,MAAM,GACX,KAAK,KAAK,eAAe;gBACxB,CAAC,CAAC,eAAe;gBACjB,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,GAAG;oBACvB,CAAC,CAAC,cAAc;oBAChB,CAAC,CAAC,iBAAiB,CAAA;YACtB,OAAO;gBACN,MAAM,EAAE,IAAI;gBACZ,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;aACzE,CAAA;QACF,CAAC;QAED,MAAM,IAAI,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;QAC7D,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAA;QAC5F,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAA;QACvF,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAA;QACzF,CAAC;QAED,OAAO;YACN,MAAM,EAAE,qBAAqB,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC;YAC5E,OAAO,EAAE,IAAI;SACb,CAAA;IACF,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAA;IACxD,CAAC;AACF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAClC,MAAc,EACd,YAAoB,EACpB,QAAiB,EACjB,YAAqB,EACrB,QAAiB,EACjB,SAA6C;IAE7C,6EAA6E;IAC7E,MAAM,MAAM,GAAG,CAAC,OAAuB,EAAQ,EAAE;QAChD,IAAI,CAAC;YACJ,SAAS,EAAE,CAAC,OAAO,CAAC,CAAA;QACrB,CAAC;QAAC,MAAM,CAAC;YACR,0DAA0D;QAC3D,CAAC;IACF,CAAC,CAAA;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAA;QACpC,OAAO,IAAI,CAAA;IACZ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,CAAC,MAAM,EAAE,QAAQ,IAAI,EAAE,EAAE,QAAQ,EAAE,YAAY,CAAC,EAAE,GAAG,EAAE,CACjG,oBAAoB,CAAC,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,CAAC,CAC5E,CAAA;IACD,IAAI,QAAQ,CAAC,OAAO;QAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IAC9C,OAAO,QAAQ,CAAC,MAAM,CAAA;AACvB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC3C,OAAO,gBAAgB,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;AACtC,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,eAAe;IAC9B,SAAS,CAAC,KAAK,EAAE,CAAA;AAClB,CAAC"}
|
package/dist/workers.d.ts
CHANGED
|
@@ -42,6 +42,13 @@ export interface Session {
|
|
|
42
42
|
Principal: Principal | null;
|
|
43
43
|
Tokens: Tokens | null;
|
|
44
44
|
Refreshed: boolean;
|
|
45
|
+
/**
|
|
46
|
+
* The request carried a refresh token that was deliberately not spent: it
|
|
47
|
+
* is a beacon or a prefetch whose response the browser would not apply, so
|
|
48
|
+
* the next consumable request refreshes instead (0.14.0). A guest request,
|
|
49
|
+
* nothing more; never clear cookies on it.
|
|
50
|
+
*/
|
|
51
|
+
Deferred?: true;
|
|
45
52
|
}
|
|
46
53
|
export interface WorkersAuthVariables {
|
|
47
54
|
principal: Principal | null;
|
package/dist/workers.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"workers.d.ts","sourceRoot":"","sources":["../src/workers.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"workers.d.ts","sourceRoot":"","sources":["../src/workers.ts"],"names":[],"mappings":"AAiBA,KAAK,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;AAErC,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,MAAM,CAAA;AACnD,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,YAAY,CAAC,iBAAiB,CAAC,CAAA;AAExF,MAAM,WAAW,iBAAiB;IACjC,GAAG,IAAI,YAAY,CAAC,iBAAiB,GAAG,MAAM,CAAC,CAAA;CAC/C;AAED,MAAM,WAAW,0BAA0B;IAC1C,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,YAAY,CAAC,iBAAiB,CAAC,CAAA;CAC1D;AAED,MAAM,MAAM,mBAAmB,GAC5B,UAAU,GACV,oBAAoB,GACpB,0BAA0B,GAC1B,iBAAiB,CAAA;AAEpB,MAAM,WAAW,iBAAiB;IACjC,MAAM,EAAE,MAAM,CAAA;IACd,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,CAAC,EAAE,mBAAmB,CAAA;IAClC,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,YAAY,EAAE,MAAM,CAAA;IACpB,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;IAC5B,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAA;CAClB;AAoBD,MAAM,WAAW,SAAS;IACzB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,SAAS,EAAE,MAAM,EAAE,CAAA;CACnB;AAED,MAAM,WAAW,MAAM;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,OAAO;IACvB,SAAS,EAAE,SAAS,GAAG,IAAI,CAAA;IAC3B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,SAAS,EAAE,OAAO,CAAA;IAClB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,IAAI,CAAA;CACf;AAED,MAAM,WAAW,oBAAoB;IACpC,SAAS,EAAE,SAAS,GAAG,IAAI,CAAA;IAC3B,OAAO,EAAE,OAAO,CAAA;CAChB;AAED,MAAM,WAAW,cAAc;IAC9B,SAAS,EAAE,oBAAoB,CAAA;CAC/B;AAED,MAAM,WAAW,kBAAkB;IAClC,GAAG,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAA;KAAE,CAAA;IAC9B,GAAG,CAAC,GAAG,SAAS,MAAM,oBAAoB,EAAE,GAAG,EAAE,GAAG,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAA;IAChF,GAAG,CAAC,GAAG,SAAS,MAAM,oBAAoB,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,oBAAoB,CAAC,GAAG,CAAC,GAAG,IAAI,CAAA;IAC7F,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,GAAG,QAAQ,CAAA;IACjD,GAAG,EAAE,QAAQ,CAAA;CACb;AAED,MAAM,MAAM,qBAAqB,GAAG,CACnC,OAAO,EAAE,kBAAkB,EAC3B,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,KACrB,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAA;AAClC,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,IAAI,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAA;AAC5E,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,IAAI,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAA;AAEvE,qBAAa,kCAAmC,SAAQ,KAAK;IAC5D,QAAQ,CAAC,IAAI,8BAA6B;IAC1C,QAAQ,CAAC,MAAM,OAAM;;CAMrB;AAED,MAAM,WAAW,iBAAiB;IACjC,SAAS,CACR,gBAAgB,EAAE,oBAAoB,EACtC,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GAClB,OAAO,CAAC,QAAQ,CAAC,CAAA;IACpB,QAAQ,CAAC,gBAAgB,EAAE,oBAAoB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IACnE,UAAU,IAAI,qBAAqB,CAAA;IACnC,SAAS,CAAC,MAAM,EAAE,eAAe,GAAG,SAAS,GAAG,IAAI,CAAA;IACpD,UAAU,CAAC,gBAAgB,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACpE,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG,QAAQ,CAAA;IAC/D,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,GAAG,QAAQ,CAAA;CACjD;AA8YD,wBAAsB,SAAS,CAC9B,MAAM,EAAE,iBAAiB,EACzB,gBAAgB,EAAE,oBAAoB,EACtC,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GAClB,OAAO,CAAC,QAAQ,CAAC,CAqCnB;AAED,wBAAsB,QAAQ,CAC7B,MAAM,EAAE,iBAAiB,EACzB,gBAAgB,EAAE,oBAAoB,GACpC,OAAO,CAAC,QAAQ,CAAC,CAwEnB;AA0CD,wBAAsB,UAAU,CAC/B,MAAM,EAAE,iBAAiB,EACzB,gBAAgB,EAAE,oBAAoB,GACpC,OAAO,CAAC,OAAO,CAAC,CAElB;AAED,wBAAgB,iBAAiB,CAChC,MAAM,EAAE,iBAAiB,EACzB,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,MAAM,GACZ,QAAQ,CAEV;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,iBAAiB,EAAE,QAAQ,EAAE,QAAQ,GAAG,QAAQ,CAE3F;AAED,wBAAgB,SAAS,CAAC,MAAM,EAAE,eAAe,GAAG,SAAS,GAAG,IAAI,CAGnE;AAQD,wBAAgB,UAAU,CAAC,MAAM,EAAE,iBAAiB,GAAG,qBAAqB,CA6B3E;AAED,wBAAgB,GAAG,CAAC,MAAM,EAAE,iBAAiB,GAAG,iBAAiB,CAahE;AAED,eAAO,MAAM,iBAAiB,YAAM,CAAA"}
|
package/dist/workers.js
CHANGED
|
@@ -3,6 +3,8 @@ import { getCookie, setCookie } from './utils/cookies.js';
|
|
|
3
3
|
import { extractIdentityId } from './utils/identity.js';
|
|
4
4
|
import { resolveInternalIssuer } from './utils/issuer.js';
|
|
5
5
|
import { generatePKCE } from './utils/pkce.js';
|
|
6
|
+
import { classifyRefreshCarrier, prefetchDeferredResponse } from './utils/refresh-carrier.js';
|
|
7
|
+
import { singleFlightRefresh } from './utils/refresh-flight.js';
|
|
6
8
|
import { generateState, verifyState } from './utils/state.js';
|
|
7
9
|
import { verifyAccessToken } from './utils/tokens.js';
|
|
8
10
|
const DEFAULT_CALLBACK_PATH = '/api/auth/callback';
|
|
@@ -443,12 +445,19 @@ async function getSessionNormalized(config, request) {
|
|
|
443
445
|
}
|
|
444
446
|
}
|
|
445
447
|
if (refreshToken) {
|
|
448
|
+
// Only a response the browser is waiting for can deliver the rotated
|
|
449
|
+
// token; a beacon or prefetch is answered as a guest (refresh-carrier.ts).
|
|
450
|
+
if (classifyRefreshCarrier(request) !== 'consumable') {
|
|
451
|
+
return { Principal: null, Tokens: null, Refreshed: false, Deferred: true };
|
|
452
|
+
}
|
|
446
453
|
const form = new URLSearchParams();
|
|
447
454
|
form.set('grant_type', 'refresh_token');
|
|
448
455
|
form.set('refresh_token', refreshToken);
|
|
449
456
|
form.set('client_id', config.clientId);
|
|
450
457
|
form.set('resource', config.resource);
|
|
451
|
-
|
|
458
|
+
// Concurrent requests presenting the same token share one exchange
|
|
459
|
+
// (refresh-flight.ts); the leader's request resolves the client secret.
|
|
460
|
+
const result = await singleFlightRefresh([config.issuerInternal, config.clientId, config.resource, refreshToken], () => requestTokens(config, request, form));
|
|
452
461
|
if (result) {
|
|
453
462
|
return { Principal: result.principal, Tokens: result.tokens, Refreshed: true };
|
|
454
463
|
}
|
|
@@ -487,6 +496,11 @@ export function Middleware(config) {
|
|
|
487
496
|
}
|
|
488
497
|
context.set('session', session);
|
|
489
498
|
context.set('principal', session.Principal);
|
|
499
|
+
// A prefetched page rendered as a guest would be shown to the member on
|
|
500
|
+
// navigation as if they had signed out; a non-2xx is dropped instead.
|
|
501
|
+
if (session.Deferred && classifyRefreshCarrier(request) === 'prefetch') {
|
|
502
|
+
return prefetchDeferredResponse();
|
|
503
|
+
}
|
|
490
504
|
if (!session.Principal && isGated(normalized, new URL(request.url).pathname)) {
|
|
491
505
|
const login = new URL(normalized.loginPath, request.url);
|
|
492
506
|
login.searchParams.set('redirect', new URL(request.url).pathname);
|
package/dist/workers.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"workers.js","sourceRoot":"","sources":["../src/workers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iCAAiC,EAAE,MAAM,iCAAiC,CAAA;AACnF,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAA;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC7D,OAAO,EAAuB,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAE1E,MAAM,qBAAqB,GAAG,oBAAoB,CAAA;AAClD,MAAM,kBAAkB,GAAG,QAAQ,CAAA;AACnC,MAAM,4BAA4B,GAAG,GAAG,CAAA;AACxC,MAAM,6BAA6B,GAAG,SAAS,CAAA;AAC/C,MAAM,2BAA2B,GAAG,GAAG,CAAA;AACvC,MAAM,kBAAkB,GAAG,EAAE,CAAA;AAsG7B,MAAM,OAAO,kCAAmC,SAAQ,KAAK;IACnD,IAAI,GAAG,0BAA0B,CAAA;IACjC,MAAM,GAAG,GAAG,CAAA;IAErB;QACC,KAAK,CAAC,0BAA0B,CAAC,CAAA;QACjC,IAAI,CAAC,IAAI,GAAG,oCAAoC,CAAA;IACjD,CAAC;CACD;AAgBD,SAAS,eAAe,CAAC,KAAa,EAAE,KAAa;IACpD,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACJ,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;IACrB,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,+BAA+B,CAAC,CAAA;IAC7D,CAAC;IACD,IACC,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC;QACvD,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,CAAC,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,CAAC;QAC7C,GAAG,CAAC,MAAM,KAAK,EAAE;QACjB,GAAG,CAAC,IAAI,KAAK,EAAE,EACd,CAAC;QACF,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,kEAAkE,CAAC,CAAA;IAChG,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAA;AAClB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACtC,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACJ,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;IACrB,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAA;IAC7D,CAAC;IACD,IACC,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC;QACvD,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,GAAG,CAAC,IAAI,KAAK,EAAE,EACd,CAAC;QACF,MAAM,IAAI,SAAS,CAAC,uEAAuE,CAAC,CAAA;IAC7F,CAAC;IACD,OAAO,KAAK,CAAA;AACb,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;IAChC,IACC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QACrB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QACrB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QACnB,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QACrB,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EACpB,CAAC;QACF,OAAO,KAAK,CAAA;IACb,CAAC;IACD,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAA;QACrD,OAAO,MAAM,CAAC,MAAM,KAAK,uBAAuB,CAAA;IACjD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAA;IACb,CAAC;AACF,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACrC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAA;IAC3C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAA;IACrD,OAAO,MAAM,CAAC,MAAM,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,KAAK,EAAE,CAAA;AAClD,CAAC;AAED,SAAS,YAAY,CAAC,IAAmB;IACxC,OAAO,IAAI,KAAK,IAAI,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAA;AAC9D,CAAC;AAED,SAAS,eAAe,CAAC,KAAyB,EAAE,QAAgB,EAAE,KAAa;IAClF,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAA;IACxC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,+CAA+C,CAAC,CAAA;IAC7E,CAAC;IACD,OAAO,KAAK,CAAA;AACb,CAAC;AAED,SAAS,eAAe,CAAC,MAAyB;IACjD,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IACvD,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc;QAC3C,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,cAAc,EAAE,gBAAgB,CAAC;QAC1D,CAAC,CAAC,MAAM,CAAA;IACT,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC1E,MAAM,IAAI,SAAS,CAAC,sBAAsB,CAAC,CAAA;IAC5C,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9F,MAAM,IAAI,SAAS,CAAC,0EAA0E,CAAC,CAAA;IAChG,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,qBAAqB,CAAA;IACjE,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,kBAAkB,CAAA;IACxD,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,oCAAoC,CAAC,CAAA;IAC9F,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,iCAAiC,CAAC,CAAA;IACxF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,SAAS,CAAC,mCAAmC,CAAC,CAAA;IACzD,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACjG,MAAM,IAAI,SAAS,CAAC,qCAAqC,CAAC,CAAA;IAC3D,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAA;IACjD,KAAK,MAAM,OAAO,IAAI,UAAU,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;QACrE,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,sCAAsC,CAAC,CAAA;IAC1F,CAAC;IACD,IACC,MAAM,CAAC,mBAAmB,KAAK,SAAS;QACxC,CAAC,CAAC,4CAA4C,CAAC,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC;YAC9E,MAAM,CAAC,mBAAmB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAC1C,CAAC;QACF,MAAM,IAAI,SAAS,CAAC,gCAAgC,CAAC,CAAA;IACtD,CAAC;IACD,OAAO;QACN,MAAM;QACN,cAAc;QACd,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,QAAQ,EAAE,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC3C,YAAY;QACZ,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;QAC/C,SAAS,EAAE,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC;QAChC,UAAU;QACV,SAAS;QACT,iBAAiB,EAAE,eAAe,CACjC,MAAM,CAAC,iBAAiB,EACxB,4BAA4B,EAC5B,mBAAmB,CACnB;QACD,kBAAkB,EAAE,eAAe,CAClC,MAAM,CAAC,kBAAkB,EACzB,6BAA6B,EAC7B,oBAAoB,CACpB;QACD,iBAAiB,EAAE,eAAe,CACjC,MAAM,CAAC,iBAAiB,EACxB,2BAA2B,EAC3B,mBAAmB,CACnB;QACD,SAAS,EAAE,eAAe,CAAC,MAAM,CAAC,SAAS,EAAE,kBAAkB,EAAE,WAAW,CAAC;KAC7E,CAAA;AACF,CAAC;AAED,SAAS,WAAW,CAAC,KAA2B;IAC/C,IAAI,KAAK,YAAY,OAAO;QAAE,OAAO,KAAK,CAAA;IAC1C,IAAI,KAAK,IAAI,KAAK,CAAC,GAAG,EAAE,GAAG,YAAY,OAAO;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,GAAG,CAAA;IACpE,MAAM,IAAI,SAAS,CAAC,wCAAwC,CAAC,CAAA;AAC9D,CAAC;AAED,SAAS,UAAU,CAAC,MAAmC,EAAE,MAAc;IACtE,OAAO,GAAG,MAAM,CAAC,YAAY,IAAI,MAAM,EAAE,CAAA;AAC1C,CAAC;AAED,SAAS,eAAe,CACvB,QAAkB,EAClB,IAAY,EACZ,KAAa,EACb,IAAY,EACZ,MAAc,EACd,MAAe;IAEf,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE;QAChC,IAAI;QACJ,MAAM;QACN,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,KAAK;QACf,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7B,CAAC,CAAA;AACH,CAAC;AAED,SAAS,qBAAqB,CAC7B,MAAmC,EACnC,QAAkB,EAClB,WAOC;IAED,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAU,CAAA;IAC9D,MAAM,cAAc,GAAG;QACtB,WAAW,CAAC,QAAQ;QACpB,WAAW,CAAC,QAAQ;QACpB,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC;KAClB,CAAA;IACV,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,aAAa,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC9D,eAAe,CACd,QAAQ,EACR,UAAU,CAAC,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,EACxC,cAAc,CAAC,KAAK,CAAC,EACrB,MAAM,CAAC,YAAY,EACnB,MAAM,CAAC,iBAAiB,CACxB,CAAA;IACF,CAAC;IACD,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI;QAC7B,CAAC,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC;QAC5B,CAAC,UAAU,EAAE,WAAW,CAAC,QAAQ,CAAC;QAClC,CAAC,UAAU,EAAE,WAAW,CAAC,QAAQ,CAAC;KACzB,EAAE,CAAC;QACZ,eAAe,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAA;IAC5F,CAAC;AACF,CAAC;AAED,SAAS,uBAAuB,CAAC,MAAmC,EAAE,QAAkB;IACvF,KAAK,MAAM,MAAM,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,CAAC;QACtD,eAAe,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAA;IAClF,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC;QACxD,eAAe,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;IAClE,CAAC;AACF,CAAC;AAED,SAAS,2BAA2B,CACnC,MAAmC,EACnC,QAAkB,EAClB,MAAc;IAEd,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAA;IAC9C,8BAA8B,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;IACvD,OAAO,OAAO,CAAA;AACf,CAAC;AAED,SAAS,8BAA8B,CACtC,MAAmC,EACnC,QAAkB,EAClB,MAAc;IAEd,eAAe,CACd,QAAQ,EACR,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,EACxB,MAAM,CAAC,WAAW,EAClB,GAAG,EACH,MAAM,CAAC,iBAAiB,EACxB,MAAM,CAAC,mBAAmB,CAC1B,CAAA;IACD,eAAe,CACd,QAAQ,EACR,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,EACxB,MAAM,CAAC,YAAY,EACnB,GAAG,EACH,MAAM,CAAC,kBAAkB,EACzB,MAAM,CAAC,mBAAmB,CAC1B,CAAA;AACF,CAAC;AAED,SAAS,6BAA6B,CACrC,MAAmC,EACnC,QAAkB;IAElB,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAA;IAC9C,eAAe,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,CAAC,mBAAmB,CAAC,CAAA;IAC1F,eAAe,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,CAAC,mBAAmB,CAAC,CAAA;IAC1F,OAAO,OAAO,CAAA;AACf,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAkB;IAC/C,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QAClC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;KACtC,CAAC,CAAA;AACH,CAAC;AAED,SAAS,wBAAwB,CAChC,MAAmC,EACnC,QAAkB;IAElB,uBAAuB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IACzC,OAAO,QAAQ,CAAA;AAChB,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAgB;IAC3C,MAAM,OAAO,GAAG;QACf,eAAe,EAAE,mBAAmB;QACpC,MAAM,EAAE,UAAU;QAClB,OAAO,EAAE,GAAG;KACZ,CAAA;IACD,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO;SACjC,GAAG,CAAC,QAAQ,CAAC;QACd,EAAE,KAAK,CAAC,GAAG,CAAC;SACX,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,kBAAkB,CAAC,CAAA;IACnF,IAAI,WAAW,EAAE,CAAC;QACjB,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;IACtF,CAAC;IACD,OAAO,IAAI,QAAQ,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;AACrE,CAAC;AAED,KAAK,UAAU,aAAa,CAC3B,MAAmC,EACnC,OAAgB;IAEhB,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAA;IAClC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IACrC,IAAI,KAAc,CAAA;IAClB,IAAI,CAAC;QACJ,IAAI,MAAM,YAAY,UAAU,EAAE,CAAC;YAClC,KAAK,GAAG,MAAM,CAAA;QACf,CAAC;aAAM,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;YACzC,KAAK,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,CAAA;QAC9B,CAAC;aAAM,IAAI,SAAS,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;YACxE,KAAK,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QACtC,CAAC;aAAM,IAAI,KAAK,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;YAChE,KAAK,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAA;QAC3B,CAAC;IACF,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,kCAAkC,EAAE,CAAA;IAC/C,CAAC;IACD,IAAI,MAAc,CAAA;IAClB,IAAI,CAAC;QACJ,MAAM;YACL,KAAK,YAAY,UAAU;gBAC1B,CAAC,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBACzD,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ;oBAC1B,CAAC,CAAC,KAAK;oBACP,CAAC,CAAC,EAAE,CAAA;IACR,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,kCAAkC,EAAE,CAAA;IAC/C,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,MAAM,IAAI,kCAAkC,EAAE,CAAA;IACxE,OAAO,MAAM,CAAA;AACd,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAsB;IAClD,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAC7D,OAAO;YACN,OAAO,EAAE,MAAM,CAAC,GAAG;YACnB,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE;YACvB,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE;YACzB,KAAK,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;YAChC,SAAS,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;SACxC,CAAA;IACF,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED,KAAK,UAAU,WAAW,CACzB,MAAmC,EACnC,KAAa;IAEb,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE;QAC5D,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,UAAU,EAAE,qBAAqB,CAAC,MAAM,CAAC;QACzC,gBAAgB,EAAE,IAAI;QACtB,SAAS,EAAE,MAAM,CAAC,SAAS;KAC3B,CAAC,CAAA;IACF,OAAO,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACnD,CAAC;AAED,KAAK,UAAU,aAAa,CAC3B,MAAmC,EACnC,OAAgB,EAChB,IAAqB;IAErB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACnD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,cAAc,EAAE,mCAAmC,EAAE,CAAC,CAAA;IACpF,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,iCAAiC,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAA;IACzF,CAAC;IACD,IAAI,QAAkB,CAAA;IACtB,IAAI,CAAC;QACJ,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,CAAC,cAAc,QAAQ,EAAE;YACxD,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;SACrB,CAAC,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,IAAI,CAAA;IAC7B,IAAI,IAAa,CAAA;IACjB,IAAI,CAAC;QACJ,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;IAC7B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;IACD,IACC,OAAO,IAAI,KAAK,QAAQ;QACxB,IAAI,KAAK,IAAI;QACb,OAAQ,IAAmC,CAAC,YAAY,KAAK,QAAQ;QACrE,OAAQ,IAAoC,CAAC,aAAa,KAAK,QAAQ,EACtE,CAAC;QACF,OAAO,IAAI,CAAA;IACZ,CAAC;IACD,MAAM,MAAM,GAAW;QACtB,WAAW,EAAG,IAAiC,CAAC,YAAY;QAC5D,YAAY,EAAG,IAAkC,CAAC,aAAa;KAC/D,CAAA;IACD,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,CAAA;IAC/D,OAAO,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC9B,MAAyB,EACzB,gBAAsC,EACtC,QAAgB,EAChB,YAAoB;IAEpB,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;IAC1C,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,4BAA4B,CAAC,CAAA;IAC/F,MAAM,OAAO,GAAG,WAAW,CAAC,gBAAgB,CAAC,CAAA;IAC7C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACvC,MAAM,QAAQ,GAAG,GAAG,UAAU,CAAC,MAAM,GAAG,UAAU,CAAC,YAAY,EAAE,CAAA;IACjE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,YAAY,EAAE,CAAA;IACpD,MAAM,KAAK,GAAG,aAAa,EAAE,CAAA;IAC7B,MAAM,QAAQ,GAAG,YAAY,CAAC,YAAY,CAAC,CAAA;IAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,UAAU,CAAC,iBAAiB,CAAA;IAC5E,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,GAAG,UAAU,CAAC,MAAM,YAAY,CAAC,CAAA;IAClE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI;QAC1B,CAAC,eAAe,EAAE,MAAM,CAAC;QACzB,CAAC,WAAW,EAAE,UAAU,CAAC,QAAQ,CAAC;QAClC,CAAC,cAAc,EAAE,QAAQ,CAAC;QAC1B,CAAC,OAAO,EAAE,sBAAsB,CAAC;QACjC,CAAC,OAAO,EAAE,KAAK,CAAC;QAChB,CAAC,gBAAgB,EAAE,SAAS,CAAC;QAC7B,CAAC,uBAAuB,EAAE,MAAM,CAAC;QACjC,CAAC,UAAU,EAAE,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC3D,CAAC,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC;KACxB,EAAE,CAAC;QACZ,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAC9C,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE;QACnC,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,EAAE,EAAE;KAClD,CAAC,CAAA;IACF,qBAAqB,CAAC,UAAU,EAAE,QAAQ,EAAE;QAC3C,QAAQ;QACR,QAAQ;QACR,OAAO;QACP,KAAK;QACL,QAAQ;QACR,QAAQ;KACR,CAAC,CAAA;IACF,OAAO,QAAQ,CAAA;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC7B,MAAyB,EACzB,gBAAsC;IAEtC,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;IAC1C,MAAM,OAAO,GAAG,WAAW,CAAC,gBAAgB,CAAC,CAAA;IAC7C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAChC,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAA;IACjD,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAA;IAC7E,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAA;IACvE,MAAM,gBAAgB,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,UAAU,CAAC,YAAY,EAAE,CAAA;IAClE,MAAM,aAAa,GAAG,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,CAAA;IACjF,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAA;IAC3F,IAAI,GAAG,CAAC,QAAQ,KAAK,UAAU,CAAC,YAAY,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC;QAClF,OAAO,IAAI,QAAQ,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAChE,CAAC;IACD,IACC,QAAQ,KAAK,gBAAgB;QAC7B,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,OAAO,EACvC,CAAC;QACF,OAAO,wBAAwB,CAC9B,UAAU,EACV,IAAI,QAAQ,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CACxD,CAAA;IACF,CAAC;IACD,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAA;IACnE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACf,OAAO,wBAAwB,CAC9B,UAAU,EACV,IAAI,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CACtD,CAAA;IACF,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACzC,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5C,OAAO,wBAAwB,CAC9B,UAAU,EACV,IAAI,QAAQ,CAAC,IAAI,EAAE;YAClB,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,UAAU,CAAC,SAAS,oBAAoB,EAAE;SAClE,CAAC,CACF,CAAA;IACF,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAA;IAClC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAA;IAC5C,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IACtB,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAA;IACnC,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAA;IAClC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAA;IAC1C,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAA;IACzC,IAAI,MAAiD,CAAA;IACrD,IAAI,CAAC;QACJ,MAAM,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;IACxD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,KAAK,YAAY,kCAAkC,EAAE,CAAC;YACzD,OAAO,wBAAwB,CAAC,UAAU,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAA;QACzE,CAAC;QACD,MAAM,KAAK,CAAA;IACZ,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,OAAO,wBAAwB,CAC9B,UAAU,EACV,IAAI,QAAQ,CAAC,IAAI,EAAE;YAClB,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,UAAU,CAAC,SAAS,oBAAoB,EAAE;SAClE,CAAC,CACF,CAAA;IACF,CAAC;IACD,IAAI,QAAQ,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE;QACjC,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,QAAQ,EAAE,YAAY,CAAC,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE;KAC3F,CAAC,CAAA;IACF,QAAQ,GAAG,2BAA2B,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;IAC3E,uBAAuB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;IAC7C,OAAO,QAAQ,CAAA;AAChB,CAAC;AAED,KAAK,UAAU,oBAAoB,CAClC,MAAmC,EACnC,OAAgB;IAEhB,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,CAAA;IACtE,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,CAAA;IACvE,IAAI,WAAW,EAAE,CAAC;QACjB,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;QACxD,IAAI,SAAS,EAAE,CAAC;YACf,OAAO;gBACN,SAAS,EAAE,SAAS;gBACpB,MAAM,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE;gBAChE,SAAS,EAAE,KAAK;aAChB,CAAA;QACF,CAAC;IACF,CAAC;IACD,IAAI,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAA;QAClC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,eAAe,CAAC,CAAA;QACvC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,YAAY,CAAC,CAAA;QACvC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;QACtC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;QACrC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;QACzD,IAAI,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;QAC/E,CAAC;IACF,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;AAC3D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC/B,MAAyB,EACzB,gBAAsC;IAEtC,OAAO,oBAAoB,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,gBAAgB,CAAC,CAAC,CAAA;AACpF,CAAC;AAED,MAAM,UAAU,iBAAiB,CAChC,MAAyB,EACzB,QAAkB,EAClB,MAAc;IAEd,OAAO,2BAA2B,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;AAC9E,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAyB,EAAE,QAAkB;IAChF,OAAO,6BAA6B,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAA;AACxE,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,MAAuB;IAChD,IAAI,WAAW,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,SAAS,CAAA;IAClD,OAAO,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,IAAI,CAAA;AACvC,CAAC;AAED,SAAS,OAAO,CAAC,MAAmC,EAAE,IAAY;IACjE,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CACzC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CACjF,CAAA;AACF,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAyB;IACnD,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;IAC1C,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC9B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAA;QAC/B,IAAI,OAAgB,CAAA;QACpB,IAAI,CAAC;YACJ,OAAO,GAAG,MAAM,oBAAoB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;QAC1D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,YAAY,kCAAkC;gBAAE,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAA;YAC3F,MAAM,KAAK,CAAA;QACZ,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;QAC/B,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;QAC3C,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,UAAU,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9E,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAA;YACxD,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAA;YACjE,OAAO,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAA;QAC/C,CAAC;QACD,MAAM,IAAI,EAAE,CAAA;QACZ,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACzC,OAAO,CAAC,GAAG,GAAG,oBAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YAC/C,8BAA8B,CAAC,UAAU,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;QACxE,CAAC;IACF,CAAC,CAAA;AACF,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,MAAyB;IAC5C,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;IAC1C,MAAM,YAAY,GAAsB,UAAU,CAAA;IAClD,OAAO;QACN,SAAS,EAAE,CAAC,gBAAgB,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CACvD,SAAS,CAAC,YAAY,EAAE,gBAAgB,EAAE,QAAQ,EAAE,YAAY,CAAC;QAClE,QAAQ,EAAE,CAAC,gBAAgB,EAAE,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,gBAAgB,CAAC;QACxE,UAAU,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC;QAC1C,SAAS;QACT,UAAU,EAAE,CAAC,gBAAgB,EAAE,EAAE,CAAC,UAAU,CAAC,YAAY,EAAE,gBAAgB,CAAC;QAC5E,iBAAiB,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC,iBAAiB,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC;QAC1F,mBAAmB,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,mBAAmB,CAAC,YAAY,EAAE,QAAQ,CAAC;KAC9E,CAAA;AACF,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAA"}
|
|
1
|
+
{"version":3,"file":"workers.js","sourceRoot":"","sources":["../src/workers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iCAAiC,EAAE,MAAM,iCAAiC,CAAA;AACnF,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAA;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAA;AAC7F,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC7D,OAAO,EAAuB,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAE1E,MAAM,qBAAqB,GAAG,oBAAoB,CAAA;AAClD,MAAM,kBAAkB,GAAG,QAAQ,CAAA;AACnC,MAAM,4BAA4B,GAAG,GAAG,CAAA;AACxC,MAAM,6BAA6B,GAAG,SAAS,CAAA;AAC/C,MAAM,2BAA2B,GAAG,GAAG,CAAA;AACvC,MAAM,kBAAkB,GAAG,EAAE,CAAA;AA6G7B,MAAM,OAAO,kCAAmC,SAAQ,KAAK;IACnD,IAAI,GAAG,0BAA0B,CAAA;IACjC,MAAM,GAAG,GAAG,CAAA;IAErB;QACC,KAAK,CAAC,0BAA0B,CAAC,CAAA;QACjC,IAAI,CAAC,IAAI,GAAG,oCAAoC,CAAA;IACjD,CAAC;CACD;AAgBD,SAAS,eAAe,CAAC,KAAa,EAAE,KAAa;IACpD,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACJ,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;IACrB,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,+BAA+B,CAAC,CAAA;IAC7D,CAAC;IACD,IACC,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC;QACvD,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,CAAC,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,CAAC;QAC7C,GAAG,CAAC,MAAM,KAAK,EAAE;QACjB,GAAG,CAAC,IAAI,KAAK,EAAE,EACd,CAAC;QACF,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,kEAAkE,CAAC,CAAA;IAChG,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAA;AAClB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACtC,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACJ,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;IACrB,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAA;IAC7D,CAAC;IACD,IACC,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC;QACvD,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,GAAG,CAAC,IAAI,KAAK,EAAE,EACd,CAAC;QACF,MAAM,IAAI,SAAS,CAAC,uEAAuE,CAAC,CAAA;IAC7F,CAAC;IACD,OAAO,KAAK,CAAA;AACb,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;IAChC,IACC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QACrB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QACrB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QACnB,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QACrB,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EACpB,CAAC;QACF,OAAO,KAAK,CAAA;IACb,CAAC;IACD,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAA;QACrD,OAAO,MAAM,CAAC,MAAM,KAAK,uBAAuB,CAAA;IACjD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAA;IACb,CAAC;AACF,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACrC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAA;IAC3C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAA;IACrD,OAAO,MAAM,CAAC,MAAM,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,KAAK,EAAE,CAAA;AAClD,CAAC;AAED,SAAS,YAAY,CAAC,IAAmB;IACxC,OAAO,IAAI,KAAK,IAAI,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAA;AAC9D,CAAC;AAED,SAAS,eAAe,CAAC,KAAyB,EAAE,QAAgB,EAAE,KAAa;IAClF,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAA;IACxC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,+CAA+C,CAAC,CAAA;IAC7E,CAAC;IACD,OAAO,KAAK,CAAA;AACb,CAAC;AAED,SAAS,eAAe,CAAC,MAAyB;IACjD,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IACvD,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc;QAC3C,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,cAAc,EAAE,gBAAgB,CAAC;QAC1D,CAAC,CAAC,MAAM,CAAA;IACT,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC1E,MAAM,IAAI,SAAS,CAAC,sBAAsB,CAAC,CAAA;IAC5C,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9F,MAAM,IAAI,SAAS,CAAC,0EAA0E,CAAC,CAAA;IAChG,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,qBAAqB,CAAA;IACjE,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,kBAAkB,CAAA;IACxD,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,oCAAoC,CAAC,CAAA;IAC9F,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,iCAAiC,CAAC,CAAA;IACxF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,SAAS,CAAC,mCAAmC,CAAC,CAAA;IACzD,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACjG,MAAM,IAAI,SAAS,CAAC,qCAAqC,CAAC,CAAA;IAC3D,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAA;IACjD,KAAK,MAAM,OAAO,IAAI,UAAU,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;QACrE,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,sCAAsC,CAAC,CAAA;IAC1F,CAAC;IACD,IACC,MAAM,CAAC,mBAAmB,KAAK,SAAS;QACxC,CAAC,CAAC,4CAA4C,CAAC,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC;YAC9E,MAAM,CAAC,mBAAmB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAC1C,CAAC;QACF,MAAM,IAAI,SAAS,CAAC,gCAAgC,CAAC,CAAA;IACtD,CAAC;IACD,OAAO;QACN,MAAM;QACN,cAAc;QACd,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,QAAQ,EAAE,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC3C,YAAY;QACZ,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;QAC/C,SAAS,EAAE,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC;QAChC,UAAU;QACV,SAAS;QACT,iBAAiB,EAAE,eAAe,CACjC,MAAM,CAAC,iBAAiB,EACxB,4BAA4B,EAC5B,mBAAmB,CACnB;QACD,kBAAkB,EAAE,eAAe,CAClC,MAAM,CAAC,kBAAkB,EACzB,6BAA6B,EAC7B,oBAAoB,CACpB;QACD,iBAAiB,EAAE,eAAe,CACjC,MAAM,CAAC,iBAAiB,EACxB,2BAA2B,EAC3B,mBAAmB,CACnB;QACD,SAAS,EAAE,eAAe,CAAC,MAAM,CAAC,SAAS,EAAE,kBAAkB,EAAE,WAAW,CAAC;KAC7E,CAAA;AACF,CAAC;AAED,SAAS,WAAW,CAAC,KAA2B;IAC/C,IAAI,KAAK,YAAY,OAAO;QAAE,OAAO,KAAK,CAAA;IAC1C,IAAI,KAAK,IAAI,KAAK,CAAC,GAAG,EAAE,GAAG,YAAY,OAAO;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,GAAG,CAAA;IACpE,MAAM,IAAI,SAAS,CAAC,wCAAwC,CAAC,CAAA;AAC9D,CAAC;AAED,SAAS,UAAU,CAAC,MAAmC,EAAE,MAAc;IACtE,OAAO,GAAG,MAAM,CAAC,YAAY,IAAI,MAAM,EAAE,CAAA;AAC1C,CAAC;AAED,SAAS,eAAe,CACvB,QAAkB,EAClB,IAAY,EACZ,KAAa,EACb,IAAY,EACZ,MAAc,EACd,MAAe;IAEf,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE;QAChC,IAAI;QACJ,MAAM;QACN,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,KAAK;QACf,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7B,CAAC,CAAA;AACH,CAAC;AAED,SAAS,qBAAqB,CAC7B,MAAmC,EACnC,QAAkB,EAClB,WAOC;IAED,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAU,CAAA;IAC9D,MAAM,cAAc,GAAG;QACtB,WAAW,CAAC,QAAQ;QACpB,WAAW,CAAC,QAAQ;QACpB,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC;KAClB,CAAA;IACV,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,aAAa,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC9D,eAAe,CACd,QAAQ,EACR,UAAU,CAAC,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,EACxC,cAAc,CAAC,KAAK,CAAC,EACrB,MAAM,CAAC,YAAY,EACnB,MAAM,CAAC,iBAAiB,CACxB,CAAA;IACF,CAAC;IACD,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI;QAC7B,CAAC,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC;QAC5B,CAAC,UAAU,EAAE,WAAW,CAAC,QAAQ,CAAC;QAClC,CAAC,UAAU,EAAE,WAAW,CAAC,QAAQ,CAAC;KACzB,EAAE,CAAC;QACZ,eAAe,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAA;IAC5F,CAAC;AACF,CAAC;AAED,SAAS,uBAAuB,CAAC,MAAmC,EAAE,QAAkB;IACvF,KAAK,MAAM,MAAM,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,CAAC;QACtD,eAAe,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAA;IAClF,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC;QACxD,eAAe,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;IAClE,CAAC;AACF,CAAC;AAED,SAAS,2BAA2B,CACnC,MAAmC,EACnC,QAAkB,EAClB,MAAc;IAEd,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAA;IAC9C,8BAA8B,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;IACvD,OAAO,OAAO,CAAA;AACf,CAAC;AAED,SAAS,8BAA8B,CACtC,MAAmC,EACnC,QAAkB,EAClB,MAAc;IAEd,eAAe,CACd,QAAQ,EACR,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,EACxB,MAAM,CAAC,WAAW,EAClB,GAAG,EACH,MAAM,CAAC,iBAAiB,EACxB,MAAM,CAAC,mBAAmB,CAC1B,CAAA;IACD,eAAe,CACd,QAAQ,EACR,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,EACxB,MAAM,CAAC,YAAY,EACnB,GAAG,EACH,MAAM,CAAC,kBAAkB,EACzB,MAAM,CAAC,mBAAmB,CAC1B,CAAA;AACF,CAAC;AAED,SAAS,6BAA6B,CACrC,MAAmC,EACnC,QAAkB;IAElB,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAA;IAC9C,eAAe,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,CAAC,mBAAmB,CAAC,CAAA;IAC1F,eAAe,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,CAAC,mBAAmB,CAAC,CAAA;IAC1F,OAAO,OAAO,CAAA;AACf,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAkB;IAC/C,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QAClC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;KACtC,CAAC,CAAA;AACH,CAAC;AAED,SAAS,wBAAwB,CAChC,MAAmC,EACnC,QAAkB;IAElB,uBAAuB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IACzC,OAAO,QAAQ,CAAA;AAChB,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAgB;IAC3C,MAAM,OAAO,GAAG;QACf,eAAe,EAAE,mBAAmB;QACpC,MAAM,EAAE,UAAU;QAClB,OAAO,EAAE,GAAG;KACZ,CAAA;IACD,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO;SACjC,GAAG,CAAC,QAAQ,CAAC;QACd,EAAE,KAAK,CAAC,GAAG,CAAC;SACX,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,kBAAkB,CAAC,CAAA;IACnF,IAAI,WAAW,EAAE,CAAC;QACjB,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;IACtF,CAAC;IACD,OAAO,IAAI,QAAQ,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;AACrE,CAAC;AAED,KAAK,UAAU,aAAa,CAC3B,MAAmC,EACnC,OAAgB;IAEhB,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAA;IAClC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IACrC,IAAI,KAAc,CAAA;IAClB,IAAI,CAAC;QACJ,IAAI,MAAM,YAAY,UAAU,EAAE,CAAC;YAClC,KAAK,GAAG,MAAM,CAAA;QACf,CAAC;aAAM,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;YACzC,KAAK,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,CAAA;QAC9B,CAAC;aAAM,IAAI,SAAS,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;YACxE,KAAK,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QACtC,CAAC;aAAM,IAAI,KAAK,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;YAChE,KAAK,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAA;QAC3B,CAAC;IACF,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,kCAAkC,EAAE,CAAA;IAC/C,CAAC;IACD,IAAI,MAAc,CAAA;IAClB,IAAI,CAAC;QACJ,MAAM;YACL,KAAK,YAAY,UAAU;gBAC1B,CAAC,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBACzD,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ;oBAC1B,CAAC,CAAC,KAAK;oBACP,CAAC,CAAC,EAAE,CAAA;IACR,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,kCAAkC,EAAE,CAAA;IAC/C,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,MAAM,IAAI,kCAAkC,EAAE,CAAA;IACxE,OAAO,MAAM,CAAA;AACd,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAsB;IAClD,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAC7D,OAAO;YACN,OAAO,EAAE,MAAM,CAAC,GAAG;YACnB,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE;YACvB,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE;YACzB,KAAK,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;YAChC,SAAS,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;SACxC,CAAA;IACF,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED,KAAK,UAAU,WAAW,CACzB,MAAmC,EACnC,KAAa;IAEb,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE;QAC5D,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,UAAU,EAAE,qBAAqB,CAAC,MAAM,CAAC;QACzC,gBAAgB,EAAE,IAAI;QACtB,SAAS,EAAE,MAAM,CAAC,SAAS;KAC3B,CAAC,CAAA;IACF,OAAO,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACnD,CAAC;AAED,KAAK,UAAU,aAAa,CAC3B,MAAmC,EACnC,OAAgB,EAChB,IAAqB;IAErB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACnD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,cAAc,EAAE,mCAAmC,EAAE,CAAC,CAAA;IACpF,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,iCAAiC,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAA;IACzF,CAAC;IACD,IAAI,QAAkB,CAAA;IACtB,IAAI,CAAC;QACJ,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,CAAC,cAAc,QAAQ,EAAE;YACxD,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;SACrB,CAAC,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,IAAI,CAAA;IAC7B,IAAI,IAAa,CAAA;IACjB,IAAI,CAAC;QACJ,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;IAC7B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;IACD,IACC,OAAO,IAAI,KAAK,QAAQ;QACxB,IAAI,KAAK,IAAI;QACb,OAAQ,IAAmC,CAAC,YAAY,KAAK,QAAQ;QACrE,OAAQ,IAAoC,CAAC,aAAa,KAAK,QAAQ,EACtE,CAAC;QACF,OAAO,IAAI,CAAA;IACZ,CAAC;IACD,MAAM,MAAM,GAAW;QACtB,WAAW,EAAG,IAAiC,CAAC,YAAY;QAC5D,YAAY,EAAG,IAAkC,CAAC,aAAa;KAC/D,CAAA;IACD,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,CAAA;IAC/D,OAAO,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC9B,MAAyB,EACzB,gBAAsC,EACtC,QAAgB,EAChB,YAAoB;IAEpB,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;IAC1C,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,4BAA4B,CAAC,CAAA;IAC/F,MAAM,OAAO,GAAG,WAAW,CAAC,gBAAgB,CAAC,CAAA;IAC7C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACvC,MAAM,QAAQ,GAAG,GAAG,UAAU,CAAC,MAAM,GAAG,UAAU,CAAC,YAAY,EAAE,CAAA;IACjE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,YAAY,EAAE,CAAA;IACpD,MAAM,KAAK,GAAG,aAAa,EAAE,CAAA;IAC7B,MAAM,QAAQ,GAAG,YAAY,CAAC,YAAY,CAAC,CAAA;IAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,UAAU,CAAC,iBAAiB,CAAA;IAC5E,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,GAAG,UAAU,CAAC,MAAM,YAAY,CAAC,CAAA;IAClE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI;QAC1B,CAAC,eAAe,EAAE,MAAM,CAAC;QACzB,CAAC,WAAW,EAAE,UAAU,CAAC,QAAQ,CAAC;QAClC,CAAC,cAAc,EAAE,QAAQ,CAAC;QAC1B,CAAC,OAAO,EAAE,sBAAsB,CAAC;QACjC,CAAC,OAAO,EAAE,KAAK,CAAC;QAChB,CAAC,gBAAgB,EAAE,SAAS,CAAC;QAC7B,CAAC,uBAAuB,EAAE,MAAM,CAAC;QACjC,CAAC,UAAU,EAAE,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC3D,CAAC,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC;KACxB,EAAE,CAAC;QACZ,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAC9C,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE;QACnC,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,EAAE,EAAE;KAClD,CAAC,CAAA;IACF,qBAAqB,CAAC,UAAU,EAAE,QAAQ,EAAE;QAC3C,QAAQ;QACR,QAAQ;QACR,OAAO;QACP,KAAK;QACL,QAAQ;QACR,QAAQ;KACR,CAAC,CAAA;IACF,OAAO,QAAQ,CAAA;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC7B,MAAyB,EACzB,gBAAsC;IAEtC,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;IAC1C,MAAM,OAAO,GAAG,WAAW,CAAC,gBAAgB,CAAC,CAAA;IAC7C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAChC,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAA;IACjD,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAA;IAC7E,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAA;IACvE,MAAM,gBAAgB,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,UAAU,CAAC,YAAY,EAAE,CAAA;IAClE,MAAM,aAAa,GAAG,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,CAAA;IACjF,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAA;IAC3F,IAAI,GAAG,CAAC,QAAQ,KAAK,UAAU,CAAC,YAAY,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC;QAClF,OAAO,IAAI,QAAQ,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAChE,CAAC;IACD,IACC,QAAQ,KAAK,gBAAgB;QAC7B,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,OAAO,EACvC,CAAC;QACF,OAAO,wBAAwB,CAC9B,UAAU,EACV,IAAI,QAAQ,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CACxD,CAAA;IACF,CAAC;IACD,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAA;IACnE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACf,OAAO,wBAAwB,CAC9B,UAAU,EACV,IAAI,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CACtD,CAAA;IACF,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACzC,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5C,OAAO,wBAAwB,CAC9B,UAAU,EACV,IAAI,QAAQ,CAAC,IAAI,EAAE;YAClB,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,UAAU,CAAC,SAAS,oBAAoB,EAAE;SAClE,CAAC,CACF,CAAA;IACF,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAA;IAClC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAA;IAC5C,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IACtB,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAA;IACnC,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAA;IAClC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAA;IAC1C,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAA;IACzC,IAAI,MAAiD,CAAA;IACrD,IAAI,CAAC;QACJ,MAAM,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;IACxD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,KAAK,YAAY,kCAAkC,EAAE,CAAC;YACzD,OAAO,wBAAwB,CAAC,UAAU,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAA;QACzE,CAAC;QACD,MAAM,KAAK,CAAA;IACZ,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,OAAO,wBAAwB,CAC9B,UAAU,EACV,IAAI,QAAQ,CAAC,IAAI,EAAE;YAClB,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,UAAU,CAAC,SAAS,oBAAoB,EAAE;SAClE,CAAC,CACF,CAAA;IACF,CAAC;IACD,IAAI,QAAQ,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE;QACjC,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,QAAQ,EAAE,YAAY,CAAC,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE;KAC3F,CAAC,CAAA;IACF,QAAQ,GAAG,2BAA2B,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;IAC3E,uBAAuB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;IAC7C,OAAO,QAAQ,CAAA;AAChB,CAAC;AAED,KAAK,UAAU,oBAAoB,CAClC,MAAmC,EACnC,OAAgB;IAEhB,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,CAAA;IACtE,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,CAAA;IACvE,IAAI,WAAW,EAAE,CAAC;QACjB,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;QACxD,IAAI,SAAS,EAAE,CAAC;YACf,OAAO;gBACN,SAAS,EAAE,SAAS;gBACpB,MAAM,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE;gBAChE,SAAS,EAAE,KAAK;aAChB,CAAA;QACF,CAAC;IACF,CAAC;IACD,IAAI,YAAY,EAAE,CAAC;QAClB,qEAAqE;QACrE,2EAA2E;QAC3E,IAAI,sBAAsB,CAAC,OAAO,CAAC,KAAK,YAAY,EAAE,CAAC;YACtD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;QAC3E,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAA;QAClC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,eAAe,CAAC,CAAA;QACvC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,YAAY,CAAC,CAAA;QACvC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;QACtC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;QACrC,mEAAmE;QACnE,wEAAwE;QACxE,MAAM,MAAM,GAAG,MAAM,mBAAmB,CACvC,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,EACvE,GAAG,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAC1C,CAAA;QACD,IAAI,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;QAC/E,CAAC;IACF,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;AAC3D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC/B,MAAyB,EACzB,gBAAsC;IAEtC,OAAO,oBAAoB,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,gBAAgB,CAAC,CAAC,CAAA;AACpF,CAAC;AAED,MAAM,UAAU,iBAAiB,CAChC,MAAyB,EACzB,QAAkB,EAClB,MAAc;IAEd,OAAO,2BAA2B,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;AAC9E,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAyB,EAAE,QAAkB;IAChF,OAAO,6BAA6B,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAA;AACxE,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,MAAuB;IAChD,IAAI,WAAW,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,SAAS,CAAA;IAClD,OAAO,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,IAAI,CAAA;AACvC,CAAC;AAED,SAAS,OAAO,CAAC,MAAmC,EAAE,IAAY;IACjE,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CACzC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CACjF,CAAA;AACF,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAyB;IACnD,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;IAC1C,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC9B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAA;QAC/B,IAAI,OAAgB,CAAA;QACpB,IAAI,CAAC;YACJ,OAAO,GAAG,MAAM,oBAAoB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;QAC1D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,YAAY,kCAAkC;gBAAE,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAA;YAC3F,MAAM,KAAK,CAAA;QACZ,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;QAC/B,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;QAC3C,wEAAwE;QACxE,sEAAsE;QACtE,IAAI,OAAO,CAAC,QAAQ,IAAI,sBAAsB,CAAC,OAAO,CAAC,KAAK,UAAU,EAAE,CAAC;YACxE,OAAO,wBAAwB,EAAE,CAAA;QAClC,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,UAAU,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9E,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAA;YACxD,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAA;YACjE,OAAO,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAA;QAC/C,CAAC;QACD,MAAM,IAAI,EAAE,CAAA;QACZ,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACzC,OAAO,CAAC,GAAG,GAAG,oBAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YAC/C,8BAA8B,CAAC,UAAU,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;QACxE,CAAC;IACF,CAAC,CAAA;AACF,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,MAAyB;IAC5C,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;IAC1C,MAAM,YAAY,GAAsB,UAAU,CAAA;IAClD,OAAO;QACN,SAAS,EAAE,CAAC,gBAAgB,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CACvD,SAAS,CAAC,YAAY,EAAE,gBAAgB,EAAE,QAAQ,EAAE,YAAY,CAAC;QAClE,QAAQ,EAAE,CAAC,gBAAgB,EAAE,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,gBAAgB,CAAC;QACxE,UAAU,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC;QAC1C,SAAS;QACT,UAAU,EAAE,CAAC,gBAAgB,EAAE,EAAE,CAAC,UAAU,CAAC,YAAY,EAAE,gBAAgB,CAAC;QAC5E,iBAAiB,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC,iBAAiB,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC;QAC1F,mBAAmB,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,mBAAmB,CAAC,YAAY,EAAE,QAAQ,CAAC;KAC9E,CAAA;AACF,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAA"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@growth-labs/auth",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.14.0",
|
|
4
4
|
"type": "module",
|
|
5
5
|
"types": "./dist/index.d.ts",
|
|
6
6
|
"exports": {
|
|
@@ -69,13 +69,13 @@
|
|
|
69
69
|
"zod": "^3.23.0"
|
|
70
70
|
},
|
|
71
71
|
"devDependencies": {
|
|
72
|
+
"@growth-labs/analytics": "0.20.5",
|
|
72
73
|
"astro": "7.3.1",
|
|
73
74
|
"hono": "^4.12.25",
|
|
74
75
|
"typescript": "^5.8.0",
|
|
75
76
|
"vite": "8.0.16",
|
|
76
77
|
"vitest": "^4.1.8",
|
|
77
|
-
"wrangler": "^4.92.0"
|
|
78
|
-
"@growth-labs/analytics": "0.20.4"
|
|
78
|
+
"wrangler": "^4.92.0"
|
|
79
79
|
},
|
|
80
80
|
"scripts": {
|
|
81
81
|
"build": "tsc",
|
package/src/middleware/auth.ts
CHANGED
|
@@ -5,6 +5,11 @@ import { resolveClientSecret } from '../utils/client-secret.js'
|
|
|
5
5
|
import { getCookie, setTokenCookies } from '../utils/cookies.js'
|
|
6
6
|
import { secretResolutionFailureResponse } from '../utils/fail-closed.js'
|
|
7
7
|
import { resolveInternalIssuer } from '../utils/issuer.js'
|
|
8
|
+
import {
|
|
9
|
+
classifyRefreshCarrier,
|
|
10
|
+
prefetchDeferredResponse,
|
|
11
|
+
type RefreshCarrier,
|
|
12
|
+
} from '../utils/refresh-carrier.js'
|
|
8
13
|
import { type RefreshFailure, refreshTokens, verifyAccessToken } from '../utils/tokens.js'
|
|
9
14
|
|
|
10
15
|
const PRIVATE_NO_STORE_HEADERS = [
|
|
@@ -65,8 +70,17 @@ export async function onRequest(
|
|
|
65
70
|
}
|
|
66
71
|
}
|
|
67
72
|
|
|
73
|
+
// A refresh rotates the token, and only a response the browser is waiting
|
|
74
|
+
// for can deliver the successor. A beacon or a prefetch that would need one
|
|
75
|
+
// does not get it: the request is answered as `deferred` and the next
|
|
76
|
+
// consumable request refreshes instead (refresh-carrier.ts says why).
|
|
68
77
|
let refreshFailure = null as RefreshFailure | null
|
|
78
|
+
let deferredCarrier: RefreshCarrier | null = null
|
|
69
79
|
if (!user && refreshToken) {
|
|
80
|
+
const carrier = classifyRefreshCarrier(request)
|
|
81
|
+
if (carrier !== 'consumable') deferredCarrier = carrier
|
|
82
|
+
}
|
|
83
|
+
if (!user && refreshToken && deferredCarrier === null) {
|
|
70
84
|
const clientId = options.clientId || context.url.hostname
|
|
71
85
|
refreshed = await refreshTokens(
|
|
72
86
|
issuer,
|
|
@@ -101,6 +115,7 @@ export async function onRequest(
|
|
|
101
115
|
hadAccessToken: accessToken !== null,
|
|
102
116
|
hadRefreshToken: refreshToken !== null,
|
|
103
117
|
refreshFailure,
|
|
118
|
+
deferred: deferredCarrier !== null,
|
|
104
119
|
})
|
|
105
120
|
context.locals.authSession = session
|
|
106
121
|
|
|
@@ -112,7 +127,19 @@ export async function onRequest(
|
|
|
112
127
|
// Recovery never needed the clear: signing in again overwrites them.
|
|
113
128
|
const documentNavigation = isDocumentNavigation(request)
|
|
114
129
|
|
|
115
|
-
if (
|
|
130
|
+
if (deferredCarrier !== null) {
|
|
131
|
+
try {
|
|
132
|
+
console.info('[auth] session refresh deferred', {
|
|
133
|
+
carrier: deferredCarrier,
|
|
134
|
+
pathname: context.url.pathname,
|
|
135
|
+
})
|
|
136
|
+
} catch {
|
|
137
|
+
/* a patched console must not turn a guest page into a 500 */
|
|
138
|
+
}
|
|
139
|
+
// A prefetched document rendered as a guest would be shown to the member
|
|
140
|
+
// on navigation as if they had signed out; a non-2xx is dropped instead.
|
|
141
|
+
if (deferredCarrier === 'prefetch') return prefetchDeferredResponse()
|
|
142
|
+
} else if (!user && refreshToken) {
|
|
116
143
|
const failure: RefreshFailure = refreshFailure ?? { reason: 'unreported' }
|
|
117
144
|
try {
|
|
118
145
|
console.warn('[auth] session refresh failed', {
|
|
@@ -172,9 +199,11 @@ function resolveSessionState(input: {
|
|
|
172
199
|
hadAccessToken: boolean
|
|
173
200
|
hadRefreshToken: boolean
|
|
174
201
|
refreshFailure: RefreshFailure | null
|
|
202
|
+
deferred: boolean
|
|
175
203
|
}): AuthSessionState {
|
|
176
204
|
if (input.user) return input.refreshed ? 'refreshed' : 'verified'
|
|
177
205
|
if (!input.hadAccessToken && !input.hadRefreshToken) return 'anonymous'
|
|
206
|
+
if (input.deferred) return 'deferred'
|
|
178
207
|
// A rejected access token with no refresh token beside it cannot be revived.
|
|
179
208
|
if (!input.hadRefreshToken) return 'expired'
|
|
180
209
|
return input.refreshFailure?.reason === 'invalid_grant' ? 'expired' : 'refresh_failed'
|
package/src/routes/logout.ts
CHANGED
|
@@ -53,7 +53,7 @@ export async function GET(context: LogoutContext): Promise<Response> {
|
|
|
53
53
|
|
|
54
54
|
// Emit auth_logout (non-blocking) when the consumer has @growth-labs/analytics
|
|
55
55
|
// wired. Without analytics installed this is a no-op (analyticsAvailable
|
|
56
|
-
// returns false). Documented in packages
|
|
56
|
+
// returns false). Documented in packages/analytics/EVENT_REGISTRY.md (growth-labs/publishing).
|
|
57
57
|
if (analyticsAvailable(context as { locals?: Record<string, unknown> })) {
|
|
58
58
|
const promise = emitAuthEvent(context, 'auth_logout', {
|
|
59
59
|
revoked: refreshToken ? 'true' : 'false',
|
package/src/types.ts
CHANGED
|
@@ -155,11 +155,21 @@ export interface TokenExchangeResult {
|
|
|
155
155
|
* could not be revived on this request — the issuer answered the refresh token
|
|
156
156
|
* `invalid_grant`, or a rejected access token arrived with no refresh token
|
|
157
157
|
* beside it — so offer a sign-in-again path; `refresh_failed` hit a fault that
|
|
158
|
-
* may pass
|
|
159
|
-
*
|
|
160
|
-
*
|
|
158
|
+
* may pass; `deferred` holds a refresh token this request deliberately did not
|
|
159
|
+
* spend, because it is a beacon or a prefetch whose response the browser would
|
|
160
|
+
* not apply (0.14.0) — the next consumable request refreshes, so treat it as a
|
|
161
|
+
* guest request and nothing more. NONE is proof the session is dead (the
|
|
162
|
+
* issuer's token store is eventually consistent), so never clear cookies on
|
|
163
|
+
* them: signing in again overwrites the cookies, and the middleware itself
|
|
164
|
+
* clears nothing.
|
|
161
165
|
*/
|
|
162
|
-
export type AuthSessionState =
|
|
166
|
+
export type AuthSessionState =
|
|
167
|
+
| 'anonymous'
|
|
168
|
+
| 'verified'
|
|
169
|
+
| 'refreshed'
|
|
170
|
+
| 'expired'
|
|
171
|
+
| 'refresh_failed'
|
|
172
|
+
| 'deferred'
|
|
163
173
|
|
|
164
174
|
// Augment Astro's locals
|
|
165
175
|
declare global {
|
package/src/utils/index.ts
CHANGED
|
@@ -48,5 +48,10 @@ export {
|
|
|
48
48
|
getPasswordLoginUrl,
|
|
49
49
|
} from './openauth.js'
|
|
50
50
|
export { createPKCEChallenge, generatePKCE } from './pkce.js'
|
|
51
|
+
export {
|
|
52
|
+
classifyRefreshCarrier,
|
|
53
|
+
prefetchDeferredResponse,
|
|
54
|
+
type RefreshCarrier,
|
|
55
|
+
} from './refresh-carrier.js'
|
|
51
56
|
export { generateState, verifyState } from './state.js'
|
|
52
57
|
export type { RefreshFailure, RefreshFailureReason, VerifiedClaims } from './tokens.js'
|
|
@@ -0,0 +1,74 @@
|
|
|
1
|
+
// Which requests may spend a refresh token.
|
|
2
|
+
//
|
|
3
|
+
// A refresh rotates the token: the issuer retires the one presented and the
|
|
4
|
+
// response carries its successor as a Set-Cookie. If that response is never
|
|
5
|
+
// applied, the browser keeps presenting a token nothing will accept again, and
|
|
6
|
+
// the member is locked out until they sign in again (fronts, 2026-09: the
|
|
7
|
+
// issuer's `oauth.token_refresh.rejected` with disposition `rotated` and an
|
|
8
|
+
// `unused` successor is exactly this shape). So a refresh belongs only on a
|
|
9
|
+
// request whose response the browser is waiting for and will apply:
|
|
10
|
+
//
|
|
11
|
+
// - A beacon (`navigator.sendBeacon`, `fetch` with `mode: 'no-cors'`, an
|
|
12
|
+
// `<a ping>`, a Reporting API upload) is fire-and-forget. Its response is
|
|
13
|
+
// discarded, often after the document that sent it is gone. Refreshing on
|
|
14
|
+
// one spends the token for nobody. The request proceeds as a guest and the
|
|
15
|
+
// next consumable request refreshes instead.
|
|
16
|
+
//
|
|
17
|
+
// - A prefetch or prerender (speculation rules, `<link rel="prefetch">`) is
|
|
18
|
+
// speculative: it is the request class the browser cancels most (fronts:
|
|
19
|
+
// 6.5% of prefetches end `canceled` against 1.4% of all requests), and a
|
|
20
|
+
// prefetched document rendered as a guest would be shown to the member on
|
|
21
|
+
// navigation as if they had been signed out. The request is answered with a
|
|
22
|
+
// non-2xx the browser will not use, so the real navigation refreshes.
|
|
23
|
+
//
|
|
24
|
+
// Sec-Fetch-* and Sec-Purpose are browser-set and cannot be forged by page
|
|
25
|
+
// script. Where a client sends none of them, the request is treated as
|
|
26
|
+
// consumable, which is exactly the pre-0.14 behaviour.
|
|
27
|
+
|
|
28
|
+
export type RefreshCarrier = 'consumable' | 'beacon' | 'prefetch'
|
|
29
|
+
|
|
30
|
+
function headerLower(request: Request, name: string): string {
|
|
31
|
+
return (request.headers.get(name) ?? '').toLowerCase()
|
|
32
|
+
}
|
|
33
|
+
|
|
34
|
+
/** Speculation-rules and legacy prefetch/prerender markers. */
|
|
35
|
+
function isPrefetch(request: Request): boolean {
|
|
36
|
+
const secPurpose = headerLower(request, 'sec-purpose')
|
|
37
|
+
if (secPurpose.includes('prefetch') || secPurpose.includes('prerender')) return true
|
|
38
|
+
if (headerLower(request, 'purpose') === 'prefetch') return true
|
|
39
|
+
const xPurpose = headerLower(request, 'x-purpose')
|
|
40
|
+
if (xPurpose === 'prefetch' || xPurpose === 'preview') return true
|
|
41
|
+
return headerLower(request, 'x-moz') === 'prefetch'
|
|
42
|
+
}
|
|
43
|
+
|
|
44
|
+
/** Fire-and-forget requests whose response nobody reads. */
|
|
45
|
+
function isBeacon(request: Request): boolean {
|
|
46
|
+
const dest = headerLower(request, 'sec-fetch-dest')
|
|
47
|
+
if (dest === 'report') return true
|
|
48
|
+
if (dest === 'empty' && headerLower(request, 'sec-fetch-mode') === 'no-cors') return true
|
|
49
|
+
if (headerLower(request, 'content-type').startsWith('text/ping')) return true
|
|
50
|
+
return request.headers.has('ping-to')
|
|
51
|
+
}
|
|
52
|
+
|
|
53
|
+
export function classifyRefreshCarrier(request: Request): RefreshCarrier {
|
|
54
|
+
if (isPrefetch(request)) return 'prefetch'
|
|
55
|
+
if (isBeacon(request)) return 'beacon'
|
|
56
|
+
return 'consumable'
|
|
57
|
+
}
|
|
58
|
+
|
|
59
|
+
/**
|
|
60
|
+
* The answer to a prefetch that would have needed a refresh. Non-2xx, so the
|
|
61
|
+
* browser drops it and navigates for real; 425 because the server declines a
|
|
62
|
+
* request it may never be asked to honour. `Vary` keeps a shared cache from
|
|
63
|
+
* serving it to the navigation.
|
|
64
|
+
*/
|
|
65
|
+
export function prefetchDeferredResponse(): Response {
|
|
66
|
+
return new Response(null, {
|
|
67
|
+
status: 425,
|
|
68
|
+
statusText: 'Too Early',
|
|
69
|
+
headers: {
|
|
70
|
+
'Cache-Control': 'private, no-store',
|
|
71
|
+
Vary: 'Sec-Purpose, Cookie',
|
|
72
|
+
},
|
|
73
|
+
})
|
|
74
|
+
}
|
|
@@ -0,0 +1,59 @@
|
|
|
1
|
+
// One in-flight refresh per refresh token, per isolate.
|
|
2
|
+
//
|
|
3
|
+
// A page whose access token has just expired does not send one request: the
|
|
4
|
+
// document, its same-origin fetches, images and prefetches all arrive within
|
|
5
|
+
// the same second, every one carrying the same refresh token, and every one
|
|
6
|
+
// used to POST /token on its own. The issuer converges them — inside its
|
|
7
|
+
// reuse window (identity-platform: 600s) a re-presented token gets the same
|
|
8
|
+
// successor back — so the race was never a rejection, but it was N exchanges,
|
|
9
|
+
// N JWKS verifications and N marker writes for one rotation. Callers that
|
|
10
|
+
// arrive while an exchange for the same token is in flight now await that
|
|
11
|
+
// exchange and receive its outcome, success or failure alike.
|
|
12
|
+
//
|
|
13
|
+
// Scope is deliberately the isolate. Two tabs are two documents but one
|
|
14
|
+
// cookie jar, so their concurrent refreshes carry the same token and land, in
|
|
15
|
+
// practice, on the same colo and usually the same isolate; where they do not,
|
|
16
|
+
// the issuer's reuse window already converges them, and a cross-isolate lock
|
|
17
|
+
// (KV, Durable Object) would put a network round trip and a new dependency on
|
|
18
|
+
// every refresh to solve a case that is already solved. Nothing is retained
|
|
19
|
+
// after the flight settles for the same reason: a client-side successor cache
|
|
20
|
+
// would be a weaker copy of the issuer's reuse window.
|
|
21
|
+
//
|
|
22
|
+
// The map lives only in this isolate's memory and is keyed on the token
|
|
23
|
+
// together with its client context. Keying synchronously is what makes the
|
|
24
|
+
// guarantee hold: a caller that arrives while a flight is registered shares it,
|
|
25
|
+
// with no asynchronous gap between "look" and "register" for a second caller
|
|
26
|
+
// to slip through. The token is already held as a string by the request that
|
|
27
|
+
// carried it, so the key adds nothing a heap dump did not have.
|
|
28
|
+
|
|
29
|
+
const inFlight = new Map<string, Promise<unknown>>()
|
|
30
|
+
|
|
31
|
+
function flightKey(parts: readonly string[]): string {
|
|
32
|
+
return parts.join('\u001f')
|
|
33
|
+
}
|
|
34
|
+
|
|
35
|
+
/**
|
|
36
|
+
* Run `exchange` unless an identical exchange is already in flight in this
|
|
37
|
+
* isolate, in which case share its promise. `parts` identify the exchange:
|
|
38
|
+
* issuer, client, resource and the refresh token.
|
|
39
|
+
*/
|
|
40
|
+
export function singleFlightRefresh<T>(
|
|
41
|
+
parts: readonly string[],
|
|
42
|
+
exchange: () => Promise<T>,
|
|
43
|
+
): Promise<T> {
|
|
44
|
+
const key = flightKey(parts)
|
|
45
|
+
const existing = inFlight.get(key)
|
|
46
|
+
if (existing) return existing as Promise<T>
|
|
47
|
+
const flight = Promise.resolve()
|
|
48
|
+
.then(exchange)
|
|
49
|
+
.finally(() => {
|
|
50
|
+
if (inFlight.get(key) === flight) inFlight.delete(key)
|
|
51
|
+
})
|
|
52
|
+
inFlight.set(key, flight)
|
|
53
|
+
return flight
|
|
54
|
+
}
|
|
55
|
+
|
|
56
|
+
/** @internal Test-only. Reports how many refreshes are in flight right now. */
|
|
57
|
+
export function _refreshFlightsInProgress(): number {
|
|
58
|
+
return inFlight.size
|
|
59
|
+
}
|
package/src/utils/tokens.ts
CHANGED
|
@@ -3,6 +3,7 @@ import { JWTExpired } from 'jose/errors'
|
|
|
3
3
|
import type { TokenRefreshResult } from '../types.js'
|
|
4
4
|
import { createClientSecretBasicAuthHeader } from './client-secret-header.js'
|
|
5
5
|
import { extractIdentityId } from './identity.js'
|
|
6
|
+
import { singleFlightRefresh } from './refresh-flight.js'
|
|
6
7
|
|
|
7
8
|
type JWKSFunction = ReturnType<typeof createLocalJWKSet>
|
|
8
9
|
|
|
@@ -268,30 +269,18 @@ async function oauthErrorCode(response: Response): Promise<string | undefined> {
|
|
|
268
269
|
}
|
|
269
270
|
}
|
|
270
271
|
|
|
271
|
-
|
|
272
|
+
interface RefreshExchange {
|
|
273
|
+
result: TokenRefreshResult | null
|
|
274
|
+
failure: RefreshFailure | null
|
|
275
|
+
}
|
|
276
|
+
|
|
277
|
+
async function exchangeRefreshToken(
|
|
272
278
|
issuer: string,
|
|
273
279
|
refreshToken: string,
|
|
274
|
-
clientId
|
|
275
|
-
clientSecret
|
|
276
|
-
resource
|
|
277
|
-
|
|
278
|
-
): Promise<TokenRefreshResult | null> {
|
|
279
|
-
// Reporting is advisory: a callback that throws must not change the outcome,
|
|
280
|
-
// and the catch below must not report a second time on its behalf.
|
|
281
|
-
let reported = false
|
|
282
|
-
const report = (failure: RefreshFailure): void => {
|
|
283
|
-
if (reported) return
|
|
284
|
-
reported = true
|
|
285
|
-
try {
|
|
286
|
-
onFailure?.(failure)
|
|
287
|
-
} catch {
|
|
288
|
-
/* the caller's reporter is not this function's failure */
|
|
289
|
-
}
|
|
290
|
-
}
|
|
291
|
-
if (!resource) {
|
|
292
|
-
report({ reason: 'not_configured' })
|
|
293
|
-
return null
|
|
294
|
-
}
|
|
280
|
+
clientId: string | undefined,
|
|
281
|
+
clientSecret: string | undefined,
|
|
282
|
+
resource: string,
|
|
283
|
+
): Promise<RefreshExchange> {
|
|
295
284
|
try {
|
|
296
285
|
const params = new URLSearchParams({
|
|
297
286
|
grant_type: 'refresh_token',
|
|
@@ -321,27 +310,63 @@ export async function refreshTokens(
|
|
|
321
310
|
: response.status >= 500
|
|
322
311
|
? 'issuer_error'
|
|
323
312
|
: 'issuer_rejected'
|
|
324
|
-
|
|
325
|
-
|
|
313
|
+
return {
|
|
314
|
+
result: null,
|
|
315
|
+
failure: { reason, status: response.status, ...(error ? { error } : {}) },
|
|
316
|
+
}
|
|
326
317
|
}
|
|
327
318
|
|
|
328
319
|
const data: unknown = await response.json().catch(() => null)
|
|
329
320
|
if (!tokenResponseHasTokens(data)) {
|
|
330
|
-
|
|
331
|
-
return null
|
|
321
|
+
return { result: null, failure: { reason: 'malformed_response', status: response.status } }
|
|
332
322
|
}
|
|
333
323
|
|
|
334
324
|
const claims = await verifyIssuedAccessTokenClaims(issuer, data.access_token, resource)
|
|
335
325
|
if (!claims) {
|
|
336
|
-
|
|
337
|
-
return null
|
|
326
|
+
return { result: null, failure: { reason: 'claims_rejected', status: response.status } }
|
|
338
327
|
}
|
|
339
328
|
|
|
340
|
-
return
|
|
329
|
+
return {
|
|
330
|
+
result: tokenResultFromClaims(data.access_token, data.refresh_token, claims),
|
|
331
|
+
failure: null,
|
|
332
|
+
}
|
|
341
333
|
} catch {
|
|
342
|
-
|
|
334
|
+
return { result: null, failure: { reason: 'network' } }
|
|
335
|
+
}
|
|
336
|
+
}
|
|
337
|
+
|
|
338
|
+
/**
|
|
339
|
+
* Exchange a refresh token for new tokens. Concurrent calls for the same token
|
|
340
|
+
* (same issuer, client and resource) within one isolate share a single
|
|
341
|
+
* exchange and receive its outcome — see `refresh-flight.ts` for why the scope
|
|
342
|
+
* is the isolate and nothing is cached once the flight settles. `onFailure` is
|
|
343
|
+
* this caller's own reporter and fires for followers as well as the leader.
|
|
344
|
+
*/
|
|
345
|
+
export async function refreshTokens(
|
|
346
|
+
issuer: string,
|
|
347
|
+
refreshToken: string,
|
|
348
|
+
clientId?: string,
|
|
349
|
+
clientSecret?: string,
|
|
350
|
+
resource?: string,
|
|
351
|
+
onFailure?: (failure: RefreshFailure) => void,
|
|
352
|
+
): Promise<TokenRefreshResult | null> {
|
|
353
|
+
// Reporting is advisory: a callback that throws must not change the outcome.
|
|
354
|
+
const report = (failure: RefreshFailure): void => {
|
|
355
|
+
try {
|
|
356
|
+
onFailure?.(failure)
|
|
357
|
+
} catch {
|
|
358
|
+
/* the caller's reporter is not this function's failure */
|
|
359
|
+
}
|
|
360
|
+
}
|
|
361
|
+
if (!resource) {
|
|
362
|
+
report({ reason: 'not_configured' })
|
|
343
363
|
return null
|
|
344
364
|
}
|
|
365
|
+
const exchange = await singleFlightRefresh([issuer, clientId ?? '', resource, refreshToken], () =>
|
|
366
|
+
exchangeRefreshToken(issuer, refreshToken, clientId, clientSecret, resource),
|
|
367
|
+
)
|
|
368
|
+
if (exchange.failure) report(exchange.failure)
|
|
369
|
+
return exchange.result
|
|
345
370
|
}
|
|
346
371
|
|
|
347
372
|
export function decodeJwtPayload(jwt: string): Record<string, unknown> {
|
package/src/workers.ts
CHANGED
|
@@ -3,6 +3,8 @@ import { getCookie, setCookie } from './utils/cookies.js'
|
|
|
3
3
|
import { extractIdentityId } from './utils/identity.js'
|
|
4
4
|
import { resolveInternalIssuer } from './utils/issuer.js'
|
|
5
5
|
import { generatePKCE } from './utils/pkce.js'
|
|
6
|
+
import { classifyRefreshCarrier, prefetchDeferredResponse } from './utils/refresh-carrier.js'
|
|
7
|
+
import { singleFlightRefresh } from './utils/refresh-flight.js'
|
|
6
8
|
import { generateState, verifyState } from './utils/state.js'
|
|
7
9
|
import { type VerifiedClaims, verifyAccessToken } from './utils/tokens.js'
|
|
8
10
|
|
|
@@ -87,6 +89,13 @@ export interface Session {
|
|
|
87
89
|
Principal: Principal | null
|
|
88
90
|
Tokens: Tokens | null
|
|
89
91
|
Refreshed: boolean
|
|
92
|
+
/**
|
|
93
|
+
* The request carried a refresh token that was deliberately not spent: it
|
|
94
|
+
* is a beacon or a prefetch whose response the browser would not apply, so
|
|
95
|
+
* the next consumable request refreshes instead (0.14.0). A guest request,
|
|
96
|
+
* nothing more; never clear cookies on it.
|
|
97
|
+
*/
|
|
98
|
+
Deferred?: true
|
|
90
99
|
}
|
|
91
100
|
|
|
92
101
|
export interface WorkersAuthVariables {
|
|
@@ -671,12 +680,22 @@ async function getSessionNormalized(
|
|
|
671
680
|
}
|
|
672
681
|
}
|
|
673
682
|
if (refreshToken) {
|
|
683
|
+
// Only a response the browser is waiting for can deliver the rotated
|
|
684
|
+
// token; a beacon or prefetch is answered as a guest (refresh-carrier.ts).
|
|
685
|
+
if (classifyRefreshCarrier(request) !== 'consumable') {
|
|
686
|
+
return { Principal: null, Tokens: null, Refreshed: false, Deferred: true }
|
|
687
|
+
}
|
|
674
688
|
const form = new URLSearchParams()
|
|
675
689
|
form.set('grant_type', 'refresh_token')
|
|
676
690
|
form.set('refresh_token', refreshToken)
|
|
677
691
|
form.set('client_id', config.clientId)
|
|
678
692
|
form.set('resource', config.resource)
|
|
679
|
-
|
|
693
|
+
// Concurrent requests presenting the same token share one exchange
|
|
694
|
+
// (refresh-flight.ts); the leader's request resolves the client secret.
|
|
695
|
+
const result = await singleFlightRefresh(
|
|
696
|
+
[config.issuerInternal, config.clientId, config.resource, refreshToken],
|
|
697
|
+
() => requestTokens(config, request, form),
|
|
698
|
+
)
|
|
680
699
|
if (result) {
|
|
681
700
|
return { Principal: result.principal, Tokens: result.tokens, Refreshed: true }
|
|
682
701
|
}
|
|
@@ -727,6 +746,11 @@ export function Middleware(config: WorkersAuthConfig): WorkersAuthMiddleware {
|
|
|
727
746
|
}
|
|
728
747
|
context.set('session', session)
|
|
729
748
|
context.set('principal', session.Principal)
|
|
749
|
+
// A prefetched page rendered as a guest would be shown to the member on
|
|
750
|
+
// navigation as if they had signed out; a non-2xx is dropped instead.
|
|
751
|
+
if (session.Deferred && classifyRefreshCarrier(request) === 'prefetch') {
|
|
752
|
+
return prefetchDeferredResponse()
|
|
753
|
+
}
|
|
730
754
|
if (!session.Principal && isGated(normalized, new URL(request.url).pathname)) {
|
|
731
755
|
const login = new URL(normalized.loginPath, request.url)
|
|
732
756
|
login.searchParams.set('redirect', new URL(request.url).pathname)
|