@harperfast/harper 5.0.0-alpha.10

package/dist/security/auth.js

@@ -0,0 +1,408 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.bypassAuth = bypassAuth;
+exports.authentication = authentication;
+exports.start = start;
+exports.login = login;
+exports.logout = logout;
+const user_ts_1 = require("./user.js");
+const Server_ts_1 = require("../server/Server.js");
+const Resources_ts_1 = require("../resources/Resources.js");
+const tokenAuthentication_ts_1 = require("./tokenAuthentication.js");
+const databases_ts_1 = require("../resources/databases.js");
+const uuid_1 = require("uuid");
+const env = __importStar(require("../utility/environment/environmentManager.js"));
+const hdbTerms_ts_1 = require("../utility/hdbTerms.js");
+const harper_logger_js_1 = __importDefault(require("../utility/logging/harper_logger.js"));
+const { forComponent, AuthAuditLog } = harper_logger_js_1.default;
+const serverHandlers_js_1 = __importDefault(require("../server/itc/serverHandlers.js"));
+const { user } = serverHandlers_js_1.default;
+const Headers_ts_1 = require("../server/serverHelpers/Headers.js");
+const common_utils_js_1 = require("../utility/common_utils.js");
+const index_ts_1 = require("./certificateVerification/index.js");
+const contentTypes_ts_1 = require("../server/serverHelpers/contentTypes.js");
+const authLogger = forComponent('authentication');
+const { debug } = authLogger;
+const authEventLog = authLogger.withTag('auth-event');
+env.initSync();
+const appsCorsAccesslist = env.get(hdbTerms_ts_1.CONFIG_PARAMS.HTTP_CORSACCESSLIST);
+const appsCors = env.get(hdbTerms_ts_1.CONFIG_PARAMS.HTTP_CORS);
+const operationsCorsAccesslist = env.get(hdbTerms_ts_1.CONFIG_PARAMS.OPERATIONSAPI_NETWORK_CORSACCESSLIST);
+const operationsCors = env.get(hdbTerms_ts_1.CONFIG_PARAMS.OPERATIONSAPI_NETWORK_CORS);
+const sessionTable = (0, databases_ts_1.table)({
+    table: 'hdb_session',
+    database: 'system',
+    attributes: [{ name: 'id', isPrimaryKey: true }, { name: 'user' }],
+});
+const ENABLE_SESSIONS = env.get(hdbTerms_ts_1.CONFIG_PARAMS.AUTHENTICATION_ENABLESESSIONS) ?? true;
+// check the environment for a flag to bypass authentication (for testing) since it doesn't necessarily get set on child threads
+let AUTHORIZE_LOCAL = process.env.AUTHENTICATION_AUTHORIZELOCAL ??
+    env.get(hdbTerms_ts_1.CONFIG_PARAMS.AUTHENTICATION_AUTHORIZELOCAL) ??
+    process.env.DEV_MODE;
+const LOG_AUTH_SUCCESSFUL = env.get(hdbTerms_ts_1.CONFIG_PARAMS.LOGGING_AUDITAUTHEVENTS_LOGSUCCESSFUL) ?? false;
+const LOG_AUTH_FAILED = env.get(hdbTerms_ts_1.CONFIG_PARAMS.LOGGING_AUDITAUTHEVENTS_LOGFAILED) ?? false;
+const DEFAULT_COOKIE_EXPIRES = 'Tue, 01 Oct 8307 19:33:20 GMT';
+let authorizationCache = new Map();
+Server_ts_1.server.onInvalidatedUser(() => {
+    // TODO: Eventually we probably want to be able to invalidate individual users
+    authorizationCache = new Map();
+});
+function bypassAuth() {
+    AUTHORIZE_LOCAL = true;
+}
+// TODO: Make this not return a promise if it can be fulfilled synchronously (from cache)
+async function authentication(request, nextHandler) {
+    const headers = request.headers.asObject; // we cheat and use the node headers object since it is a little faster
+    const authorization = headers.authorization;
+    const cookie = headers.cookie;
+    let origin = headers.origin;
+    let responseHeaders = [];
+    try {
+        if (origin) {
+            const accessList = request.isOperationsServer
+                ? operationsCors
+                    ? operationsCorsAccesslist
+                    : []
+                : appsCors
+                    ? appsCorsAccesslist
+                    : [];
+            if (accessList.includes(origin) || accessList.includes('*')) {
+                if (request.method === 'OPTIONS') {
+                    const accessControlAllowHeaders = env.get(hdbTerms_ts_1.CONFIG_PARAMS.HTTP_CORSACCESSCONTROLALLOWHEADERS) ?? 'Accept, Content-Type, Authorization';
+                    // preflight request
+                    const headers = new Headers_ts_1.Headers([
+                        ['Access-Control-Allow-Methods', 'POST, GET, PUT, DELETE, PATCH, OPTIONS'],
+                        ['Access-Control-Allow-Headers', accessControlAllowHeaders],
+                        ['Access-Control-Allow-Origin', origin],
+                    ]);
+                    if (ENABLE_SESSIONS)
+                        headers.set('Access-Control-Allow-Credentials', 'true');
+                    return {
+                        status: 200,
+                        headers,
+                    };
+                }
+                responseHeaders.push('Access-Control-Allow-Origin', origin);
+                if (ENABLE_SESSIONS)
+                    responseHeaders.push('Access-Control-Allow-Credentials', 'true');
+            }
+        }
+        let sessionId;
+        let session;
+        if (ENABLE_SESSIONS) {
+            // we prefix the cookie name with the origin so that we can partition/separate session/authentications
+            // host, to protect against CSRF
+            if (!origin)
+                origin = headers.host;
+            const cookiePrefix = (origin ? origin.replace(/^https?:\/\//, '').replace(/\W/, '_') + '-' : '') + 'hdb-session=';
+            const cookies = cookie?.split(/;\s+/) || [];
+            for (const cookie of cookies) {
+                if (cookie.startsWith(cookiePrefix)) {
+                    const end = cookie.indexOf(';');
+                    sessionId = cookie.slice(cookiePrefix.length, end === -1 ? cookie.length : end);
+                    session = await sessionTable.get(sessionId);
+                    break;
+                }
+            }
+            request.session = session || (session = {});
+        }
+        const authAuditLog = (username, status, strategy) => {
+            const log = new AuthAuditLog(username, status, hdbTerms_ts_1.AUTH_AUDIT_TYPES.AUTHENTICATION, headers['x-forwarded-for'] ?? request.ip, request.method, request.pathname);
+            log.auth_strategy = strategy;
+            if (sessionId)
+                log.session_id = sessionId;
+            if (headers['referer'])
+                log.referer = headers['referer'];
+            if (headers['origin'])
+                log.origin = headers['origin'];
+            if (status === hdbTerms_ts_1.AUTH_AUDIT_STATUS.SUCCESS)
+                authEventLog.info?.(log);
+            else
+                authEventLog.error?.(log);
+        };
+        if (!request.authorized &&
+            request.mtlsConfig &&
+            request.peerCertificate.subject &&
+            request?._nodeRequest?.socket?.authorizationError)
+            authEventLog.error?.('Authorization error:', request._nodeRequest.socket.authorizationError);
+        if (request.mtlsConfig && request.authorized && request.peerCertificate.subject) {
+            const verificationResult = await (0, index_ts_1.verifyCertificate)(request.peerCertificate, request.mtlsConfig);
+            if (!verificationResult.valid) {
+                authEventLog.error?.('Certificate verification failed:', verificationResult.status, 'for', request.peerCertificate.subject.CN);
+                return applyResponseHeaders({
+                    status: 401,
+                    body: (0, contentTypes_ts_1.serializeMessage)({ error: 'Certificate revoked or verification failed' }, request),
+                });
+            }
+            // Alternative behavior: Instead of returning 401 above, we could just not set the user
+            // and let authentication fall through to other methods (Basic auth, etc.):
+            // if (verificationResult.valid) {
+            //     // Only extract user from certificate if verification passed
+            //     let username = ...
+            // }
+            let username = request.mtlsConfig.user;
+            if (username !== null) {
+                // null means no user is defined from certificate, need regular authentication as well
+                if (username === undefined || username === 'Common Name' || username === 'CN')
+                    username = request.peerCertificate.subject.CN;
+                request.user = await Server_ts_1.server.getUser(username, null, request);
+                authAuditLog(username, hdbTerms_ts_1.AUTH_AUDIT_STATUS.SUCCESS, 'mTLS');
+            }
+            else {
+                debug('HTTPS/WSS mTLS authorized connection (mTLS did not authorize a user)', 'from', request.ip);
+            }
+        }
+        let newUser;
+        if (request.user) {
+            // already authenticated
+        }
+        else if (authorization) {
+            const cachedUser = authorizationCache.get(authorization);
+            if (cachedUser?.role) {
+                // Shallow-clone so verifyPerms's `role.permission = fullRolePerms` reassignment
+                // doesn't mutate the cache entry (defense-in-depth; operations and other
+                // meta-permission fields are now preserved through translation in permissionsTranslator).
+                newUser = { ...cachedUser, role: { ...cachedUser.role, permission: { ...cachedUser.role.permission } } };
+            }
+            else if (cachedUser) {
+                newUser = cachedUser;
+            }
+            if (!newUser) {
+                const spaceIndex = authorization.indexOf(' ');
+                const strategy = authorization.slice(0, spaceIndex);
+                const credentials = authorization.slice(spaceIndex + 1);
+                let username, password;
+                try {
+                    switch (strategy) {
+                        case 'Basic':
+                            const decoded = atob(credentials);
+                            const colonIndex = decoded.indexOf(':');
+                            username = decoded.slice(0, colonIndex);
+                            password = decoded.slice(colonIndex + 1);
+                            // legacy support for passing in blank username and password to indicate no auth
+                            newUser = username || password ? await Server_ts_1.server.getUser(username, password, request) : null;
+                            break;
+                        case 'Bearer':
+                            try {
+                                newUser = await (0, tokenAuthentication_ts_1.validateOperationToken)(credentials);
+                            }
+                            catch (error) {
+                                if (error.message === 'invalid token') {
+                                    // see if they provided a refresh token; we can allow that and pass it on to operations API
+                                    try {
+                                        await (0, tokenAuthentication_ts_1.validateRefreshToken)(credentials);
+                                        return applyResponseHeaders({
+                                            // we explicitly declare we don't want to handle this because the operations
+                                            // API has its own logic for handling this
+                                            status: -1,
+                                        });
+                                    }
+                                    catch {
+                                        throw error;
+                                    }
+                                }
+                            }
+                            break;
+                    }
+                }
+                catch (err) {
+                    if (LOG_AUTH_FAILED) {
+                        const failedAttempt = authorizationCache.get(credentials);
+                        if (!failedAttempt) {
+                            authorizationCache.set(credentials, credentials);
+                            authAuditLog(username, hdbTerms_ts_1.AUTH_AUDIT_STATUS.FAILURE, strategy);
+                        }
+                    }
+                    return applyResponseHeaders({
+                        status: 401,
+                        body: (0, contentTypes_ts_1.serializeMessage)({ error: err.message }, request),
+                    });
+                }
+                authorizationCache.set(authorization, newUser);
+                if (LOG_AUTH_SUCCESSFUL)
+                    authAuditLog(newUser.username, hdbTerms_ts_1.AUTH_AUDIT_STATUS.SUCCESS, strategy);
+                // Shallow-clone so verifyPerms's `role.permission = fullRolePerms` reassignment
+                // doesn't mutate the just-stored cache entry (defense-in-depth).
+                if (newUser?.role) {
+                    newUser = { ...newUser, role: { ...newUser.role, permission: { ...newUser.role.permission } } };
+                }
+            }
+            request.user = newUser;
+        }
+        else if (session?.user) {
+            // or should this be cached in the session?
+            request.user = await Server_ts_1.server.getUser(session.user, null, request);
+        }
+        else if ((AUTHORIZE_LOCAL && (request.ip?.includes('127.0.0.') || request.ip == '::1')) ||
+            (request?._nodeRequest?.socket?.server?._pipeName && request.ip === undefined) // allow socket domain
+        ) {
+            request.user = await (0, user_ts_1.getSuperUser)();
+        }
+        if (ENABLE_SESSIONS) {
+            request.session.update = function (updatedSession) {
+                const expires = env.get(hdbTerms_ts_1.CONFIG_PARAMS.AUTHENTICATION_COOKIE_EXPIRES);
+                const useSecure = request.protocol === 'https' ||
+                    headers.host?.startsWith('localhost:') ||
+                    headers.host?.startsWith('127.0.0.1:') ||
+                    headers.host?.startsWith('::1');
+                if (!sessionId) {
+                    sessionId = (0, uuid_1.v4)();
+                    const domains = env.get(hdbTerms_ts_1.CONFIG_PARAMS.AUTHENTICATION_COOKIE_DOMAINS);
+                    const expiresString = expires
+                        ? new Date(Date.now() + (0, common_utils_js_1.convertToMS)(expires)).toUTCString()
+                        : DEFAULT_COOKIE_EXPIRES;
+                    const domain = headers.host &&
+                        domains?.find((domain) => {
+                            // find a domain that matches the host header
+                            // the configured cookie domain starts with a dot, that indicates a wildcard, so we need to remove it
+                            if (domain.startsWith('.'))
+                                domain = domain.slice(1);
+                            // host can have a port, so we need to remove it because we are comparing domain names
+                            const portStart = headers.host.indexOf(':');
+                            const host = portStart !== -1 ? headers.host.slice(0, portStart) : headers.host;
+                            return host.endsWith(domain);
+                        });
+                    const cookiePrefix = (origin ? origin.replace(/^https?:\/\//, '').replace(/\W/, '_') + '-' : '') + 'hdb-session=';
+                    // "Secure" can work with localhost/127.0.0.1 in certain browsers.
+                    // https://github.com/httpwg/http-extensions/issues/2605
+                    let cookie = `${cookiePrefix}${sessionId}; Path=/; Expires=${expiresString}; HttpOnly`;
+                    if (domain) {
+                        cookie += `; Domain=${domain}`;
+                    }
+                    if (useSecure) {
+                        cookie += `; SameSite=None; Secure`;
+                    }
+                    if (responseHeaders) {
+                        responseHeaders.push('Set-Cookie', cookie);
+                    }
+                    else if (response?.headers?.set) {
+                        response.headers.set('Set-Cookie', cookie);
+                    }
+                }
+                if (useSecure) {
+                    // Indicate that we have successfully updated a session
+                    // We make sure this is allowed by CORS so that a client can determine if it has
+                    // a valid cookie-authenticated session (studio needs this)
+                    if (responseHeaders) {
+                        if (origin)
+                            responseHeaders.push('Access-Control-Expose-Headers', 'X-Hdb-Session');
+                        responseHeaders.push('X-Hdb-Session', 'Secure');
+                    }
+                    else if (response?.headers?.set) {
+                        if (origin)
+                            response.headers.set('Access-Control-Expose-Headers', 'X-Hdb-Session');
+                        response.headers.set('X-Hdb-Session', 'Secure');
+                    }
+                }
+                updatedSession.id = sessionId;
+                return sessionTable.put(updatedSession, {
+                    expiresAt: expires ? Date.now() + (0, common_utils_js_1.convertToMS)(expires) : undefined,
+                });
+            };
+            request.login = async function (username, password) {
+                const user = (request.user = await Server_ts_1.server.authenticateUser(username, password, request));
+                request.session.update({ user: user && (user.getId?.() ?? user.username) });
+            };
+        }
+        const response = await nextHandler(request);
+        if (!response)
+            return response;
+        if (response.status === 401) {
+            if (headers['user-agent']?.startsWith('Mozilla') &&
+                headers.accept?.startsWith('text/html') &&
+                Resources_ts_1.resources.loginPath) {
+                // on the web if we have a login page, default to redirecting to it
+                response.status = 302;
+                response.headers.set('Location', Resources_ts_1.resources.loginPath(request));
+            } // the HTTP specified way of indicating HTTP authentication methods supported:
+            else
+                response.headers.set('WWW-Authenticate', 'Basic');
+        }
+        return applyResponseHeaders(response);
+    }
+    catch (error) {
+        throw applyResponseHeaders(error);
+    }
+    function applyResponseHeaders(response) {
+        const l = responseHeaders.length;
+        if (l > 0) {
+            let headers = response.headers;
+            if (!headers)
+                response.headers = headers = new Headers_ts_1.Headers();
+            for (let i = 0; i < l;) {
+                const name = responseHeaders[i++];
+                headers.set(name, responseHeaders[i++]);
+            }
+        }
+        responseHeaders = null;
+        return response;
+    }
+}
+let started;
+function start({ server, port, securePort }) {
+    server.http(authentication, port || securePort ? { port, securePort } : { port: 'all' });
+    // keep it cleaned out periodically
+    if (!started) {
+        started = true;
+        setInterval(() => {
+            authorizationCache = new Map();
+        }, env.get(hdbTerms_ts_1.CONFIG_PARAMS.AUTHENTICATION_CACHETTL)).unref();
+        user.addListener(() => {
+            authorizationCache = new Map();
+        });
+    }
+}
+// operations
+async function login(loginObject) {
+    if (!loginObject.baseRequest?.login)
+        throw new Error('No session for login');
+    // intercept any attempts to set headers on the standard response object and pass them on to fastify
+    loginObject.baseResponse.headers.set = (name, value) => {
+        loginObject.fastifyResponse.header(name, value);
+    };
+    await loginObject.baseRequest.login(loginObject.username, loginObject.password ?? '');
+    return 'Login successful';
+}
+async function logout(logoutObject) {
+    if (!logoutObject.baseRequest.session)
+        throw new Error('No session for logout');
+    await logoutObject.baseRequest.session.update({ user: null });
+    return 'Logout successful';
+}
+//# sourceMappingURL=auth.js.map

package/dist/security/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../security/auth.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+CA,gCAEC;AAGD,wCAqSC;AAED,sBAYC;AAED,sBAQC;AAED,wBAIC;AAvXD,uCAAyC;AACzC,mDAA6C;AAC7C,4DAAsD;AACtD,qEAAwF;AACxF,4DAAkD;AAClD,+BAAkC;AAClC,kFAAoE;AACpE,wDAA4F;AAC5F,2FAA+D;AAC/D,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,GAAG,0BAAY,CAAC;AACpD,wFAA6D;AAC7D,MAAM,EAAE,IAAI,EAAE,GAAG,2BAAc,CAAC;AAChC,mEAA6D;AAC7D,gEAAyD;AACzD,iEAAuE;AACvE,6EAA2E;AAC3E,MAAM,UAAU,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAC;AAClD,MAAM,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC;AAC7B,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;AACtD,GAAG,CAAC,QAAQ,EAAE,CAAC;AAEf,MAAM,kBAAkB,GAAG,GAAG,CAAC,GAAG,CAAC,2BAAa,CAAC,mBAAmB,CAAC,CAAC;AACtE,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,2BAAa,CAAC,SAAS,CAAC,CAAC;AAClD,MAAM,wBAAwB,GAAG,GAAG,CAAC,GAAG,CAAC,2BAAa,CAAC,oCAAoC,CAAC,CAAC;AAC7F,MAAM,cAAc,GAAG,GAAG,CAAC,GAAG,CAAC,2BAAa,CAAC,0BAA0B,CAAC,CAAC;AAEzE,MAAM,YAAY,GAAG,IAAA,oBAAK,EAAC;IAC1B,KAAK,EAAE,aAAa;IACpB,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;CAClE,CAAC,CAAC;AACH,MAAM,eAAe,GAAG,GAAG,CAAC,GAAG,CAAC,2BAAa,CAAC,6BAA6B,CAAC,IAAI,IAAI,CAAC;AACrF,gIAAgI;AAChI,IAAI,eAAe,GAClB,OAAO,CAAC,GAAG,CAAC,6BAA6B;IACzC,GAAG,CAAC,GAAG,CAAC,2BAAa,CAAC,6BAA6B,CAAC;IACpD,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;AACtB,MAAM,mBAAmB,GAAG,GAAG,CAAC,GAAG,CAAC,2BAAa,CAAC,qCAAqC,CAAC,IAAI,KAAK,CAAC;AAClG,MAAM,eAAe,GAAG,GAAG,CAAC,GAAG,CAAC,2BAAa,CAAC,iCAAiC,CAAC,IAAI,KAAK,CAAC;AAE1F,MAAM,sBAAsB,GAAG,+BAA+B,CAAC;AAE/D,IAAI,kBAAkB,GAAG,IAAI,GAAG,EAAE,CAAC;AACnC,kBAAM,CAAC,iBAAiB,CAAC,GAAG,EAAE;IAC7B,8EAA8E;IAC9E,kBAAkB,GAAG,IAAI,GAAG,EAAE,CAAC;AAChC,CAAC,CAAC,CAAC;AACH,SAAgB,UAAU;IACzB,eAAe,GAAG,IAAI,CAAC;AACxB,CAAC;AAED,yFAAyF;AAClF,KAAK,UAAU,cAAc,CAAC,OAAO,EAAE,WAAW;IACxD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,uEAAuE;IACjH,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,IAAI,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC5B,IAAI,eAAe,GAAG,EAAE,CAAC;IACzB,IAAI,CAAC;QACJ,IAAI,MAAM,EAAE,CAAC;YACZ,MAAM,UAAU,GAAG,OAAO,CAAC,kBAAkB;gBAC5C,CAAC,CAAC,cAAc;oBACf,CAAC,CAAC,wBAAwB;oBAC1B,CAAC,CAAC,EAAE;gBACL,CAAC,CAAC,QAAQ;oBACT,CAAC,CAAC,kBAAkB;oBACpB,CAAC,CAAC,EAAE,CAAC;YACP,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7D,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;oBAClC,MAAM,yBAAyB,GAC9B,GAAG,CAAC,GAAG,CAAC,2BAAa,CAAC,kCAAkC,CAAC,IAAI,qCAAqC,CAAC;oBAEpG,oBAAoB;oBACpB,MAAM,OAAO,GAAG,IAAI,oBAAO,CAAC;wBAC3B,CAAC,8BAA8B,EAAE,wCAAwC,CAAC;wBAC1E,CAAC,8BAA8B,EAAE,yBAAyB,CAAC;wBAC3D,CAAC,6BAA6B,EAAE,MAAM,CAAC;qBACvC,CAAC,CAAC;oBACH,IAAI,eAAe;wBAAE,OAAO,CAAC,GAAG,CAAC,kCAAkC,EAAE,MAAM,CAAC,CAAC;oBAC7E,OAAO;wBACN,MAAM,EAAE,GAAG;wBACX,OAAO;qBACP,CAAC;gBACH,CAAC;gBACD,eAAe,CAAC,IAAI,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAC;gBAC5D,IAAI,eAAe;oBAAE,eAAe,CAAC,IAAI,CAAC,kCAAkC,EAAE,MAAM,CAAC,CAAC;YACvF,CAAC;QACF,CAAC;QACD,IAAI,SAAS,CAAC;QACd,IAAI,OAAO,CAAC;QACZ,IAAI,eAAe,EAAE,CAAC;YACrB,sGAAsG;YACtG,gCAAgC;YAChC,IAAI,CAAC,MAAM;gBAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YACnC,MAAM,YAAY,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,cAAc,CAAC;YAClH,MAAM,OAAO,GAAG,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC9B,IAAI,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;oBACrC,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;oBAChC,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;oBAChF,OAAO,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;oBAC5C,MAAM;gBACP,CAAC;YACF,CAAC;YACD,OAAO,CAAC,OAAO,GAAG,OAAO,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,YAAY,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE;YACnD,MAAM,GAAG,GAAG,IAAI,YAAY,CAC3B,QAAQ,EACR,MAAM,EACN,8BAAgB,CAAC,cAAc,EAC/B,OAAO,CAAC,iBAAiB,CAAC,IAAI,OAAO,CAAC,EAAE,EACxC,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,QAAQ,CAChB,CAAC;YACF,GAAG,CAAC,aAAa,GAAG,QAAQ,CAAC;YAC7B,IAAI,SAAS;gBAAE,GAAG,CAAC,UAAU,GAAG,SAAS,CAAC;YAC1C,IAAI,OAAO,CAAC,SAAS,CAAC;gBAAE,GAAG,CAAC,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;YACzD,IAAI,OAAO,CAAC,QAAQ,CAAC;gBAAE,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;YAEtD,IAAI,MAAM,KAAK,+BAAiB,CAAC,OAAO;gBAAE,YAAY,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC;;gBAC9D,YAAY,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC;QAChC,CAAC,CAAC;QAEF,IACC,CAAC,OAAO,CAAC,UAAU;YACnB,OAAO,CAAC,UAAU;YAClB,OAAO,CAAC,eAAe,CAAC,OAAO;YAC/B,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,kBAAkB;YAEjD,YAAY,CAAC,KAAK,EAAE,CAAC,sBAAsB,EAAE,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAE9F,IAAI,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;YACjF,MAAM,kBAAkB,GAAG,MAAM,IAAA,4BAAiB,EAAC,OAAO,CAAC,eAAe,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;YAChG,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;gBAC/B,YAAY,CAAC,KAAK,EAAE,CACnB,kCAAkC,EAClC,kBAAkB,CAAC,MAAM,EACzB,KAAK,EACL,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAClC,CAAC;gBACF,OAAO,oBAAoB,CAAC;oBAC3B,MAAM,EAAE,GAAG;oBACX,IAAI,EAAE,IAAA,kCAAgB,EAAC,EAAE,KAAK,EAAE,4CAA4C,EAAE,EAAE,OAAO,CAAC;iBACxF,CAAC,CAAC;YACJ,CAAC;YAED,uFAAuF;YACvF,2EAA2E;YAC3E,kCAAkC;YAClC,mEAAmE;YACnE,yBAAyB;YACzB,IAAI;YAEJ,IAAI,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;YACvC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACvB,sFAAsF;gBACtF,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,aAAa,IAAI,QAAQ,KAAK,IAAI;oBAC5E,QAAQ,GAAG,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/C,OAAO,CAAC,IAAI,GAAG,MAAM,kBAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;gBAC7D,YAAY,CAAC,QAAQ,EAAE,+BAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC3D,CAAC;iBAAM,CAAC;gBACP,KAAK,CAAC,sEAAsE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YACnG,CAAC;QACF,CAAC;QAED,IAAI,OAAO,CAAC;QACZ,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,wBAAwB;QACzB,CAAC;aAAM,IAAI,aAAa,EAAE,CAAC;YAC1B,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACzD,IAAI,UAAU,EAAE,IAAI,EAAE,CAAC;gBACtB,gFAAgF;gBAChF,yEAAyE;gBACzE,0FAA0F;gBAC1F,OAAO,GAAG,EAAE,GAAG,UAAU,EAAE,IAAI,EAAE,EAAE,GAAG,UAAU,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,CAAC;YAC1G,CAAC;iBAAM,IAAI,UAAU,EAAE,CAAC;gBACvB,OAAO,GAAG,UAAU,CAAC;YACtB,CAAC;YACD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACd,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAC9C,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;gBACpD,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;gBACxD,IAAI,QAAQ,EAAE,QAAQ,CAAC;gBACvB,IAAI,CAAC;oBACJ,QAAQ,QAAQ,EAAE,CAAC;wBAClB,KAAK,OAAO;4BACX,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;4BAClC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;4BACxC,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;4BACxC,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;4BACzC,gFAAgF;4BAChF,OAAO,GAAG,QAAQ,IAAI,QAAQ,CAAC,CAAC,CAAC,MAAM,kBAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;4BAC1F,MAAM;wBACP,KAAK,QAAQ;4BACZ,IAAI,CAAC;gCACJ,OAAO,GAAG,MAAM,IAAA,+CAAsB,EAAC,WAAW,CAAC,CAAC;4BACrD,CAAC;4BAAC,OAAO,KAAK,EAAE,CAAC;gCAChB,IAAI,KAAK,CAAC,OAAO,KAAK,eAAe,EAAE,CAAC;oCACvC,2FAA2F;oCAC3F,IAAI,CAAC;wCACJ,MAAM,IAAA,6CAAoB,EAAC,WAAW,CAAC,CAAC;wCACxC,OAAO,oBAAoB,CAAC;4CAC3B,4EAA4E;4CAC5E,0CAA0C;4CAC1C,MAAM,EAAE,CAAC,CAAC;yCACV,CAAC,CAAC;oCACJ,CAAC;oCAAC,MAAM,CAAC;wCACR,MAAM,KAAK,CAAC;oCACb,CAAC;gCACF,CAAC;4BACF,CAAC;4BACD,MAAM;oBACR,CAAC;gBACF,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACd,IAAI,eAAe,EAAE,CAAC;wBACrB,MAAM,aAAa,GAAG,kBAAkB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;wBAC1D,IAAI,CAAC,aAAa,EAAE,CAAC;4BACpB,kBAAkB,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;4BACjD,YAAY,CAAC,QAAQ,EAAE,+BAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;wBAC7D,CAAC;oBACF,CAAC;oBAED,OAAO,oBAAoB,CAAC;wBAC3B,MAAM,EAAE,GAAG;wBACX,IAAI,EAAE,IAAA,kCAAgB,EAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC;qBACvD,CAAC,CAAC;gBACJ,CAAC;gBAED,kBAAkB,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;gBAC/C,IAAI,mBAAmB;oBAAE,YAAY,CAAC,OAAO,CAAC,QAAQ,EAAE,+BAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBAC7F,gFAAgF;gBAChF,iEAAiE;gBACjE,IAAI,OAAO,EAAE,IAAI,EAAE,CAAC;oBACnB,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,CAAC;gBACjG,CAAC;YACF,CAAC;YAED,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC;QACxB,CAAC;aAAM,IAAI,OAAO,EAAE,IAAI,EAAE,CAAC;YAC1B,2CAA2C;YAC3C,OAAO,CAAC,IAAI,GAAG,MAAM,kBAAM,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAClE,CAAC;aAAM,IACN,CAAC,eAAe,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,EAAE,IAAI,KAAK,CAAC,CAAC;YAC9E,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,IAAI,OAAO,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,sBAAsB;UACpG,CAAC;YACF,OAAO,CAAC,IAAI,GAAG,MAAM,IAAA,sBAAY,GAAE,CAAC;QACrC,CAAC;QACD,IAAI,eAAe,EAAE,CAAC;YACrB,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,UAAU,cAAc;gBAChD,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,2BAAa,CAAC,6BAA6B,CAAC,CAAC;gBACrE,MAAM,SAAS,GACd,OAAO,CAAC,QAAQ,KAAK,OAAO;oBAC5B,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,YAAY,CAAC;oBACtC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,YAAY,CAAC;oBACtC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;gBACjC,IAAI,CAAC,SAAS,EAAE,CAAC;oBAChB,SAAS,GAAG,IAAA,SAAI,GAAE,CAAC;oBACnB,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,2BAAa,CAAC,6BAA6B,CAAC,CAAC;oBACrE,MAAM,aAAa,GAAG,OAAO;wBAC5B,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAA,6BAAW,EAAC,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE;wBAC3D,CAAC,CAAC,sBAAsB,CAAC;oBAC1B,MAAM,MAAM,GACX,OAAO,CAAC,IAAI;wBACZ,OAAO,EAAE,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;4BACxB,6CAA6C;4BAC7C,qGAAqG;4BACrG,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;gCAAE,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;4BACrD,sFAAsF;4BACtF,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;4BAC5C,MAAM,IAAI,GAAG,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;4BAChF,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;wBAC9B,CAAC,CAAC,CAAC;oBACJ,MAAM,YAAY,GACjB,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,cAAc,CAAC;oBAC9F,kEAAkE;oBAClE,wDAAwD;oBACxD,IAAI,MAAM,GAAG,GAAG,YAAY,GAAG,SAAS,qBAAqB,aAAa,YAAY,CAAC;oBACvF,IAAI,MAAM,EAAE,CAAC;wBACZ,MAAM,IAAI,YAAY,MAAM,EAAE,CAAC;oBAChC,CAAC;oBAED,IAAI,SAAS,EAAE,CAAC;wBACf,MAAM,IAAI,yBAAyB,CAAC;oBACrC,CAAC;oBACD,IAAI,eAAe,EAAE,CAAC;wBACrB,eAAe,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;oBAC5C,CAAC;yBAAM,IAAI,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;wBACnC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;oBAC5C,CAAC;gBACF,CAAC;gBACD,IAAI,SAAS,EAAE,CAAC;oBACf,uDAAuD;oBACvD,gFAAgF;oBAChF,2DAA2D;oBAC3D,IAAI,eAAe,EAAE,CAAC;wBACrB,IAAI,MAAM;4BAAE,eAAe,CAAC,IAAI,CAAC,+BAA+B,EAAE,eAAe,CAAC,CAAC;wBACnF,eAAe,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;oBACjD,CAAC;yBAAM,IAAI,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;wBACnC,IAAI,MAAM;4BAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,eAAe,CAAC,CAAC;wBACnF,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;oBACjD,CAAC;gBACF,CAAC;gBACD,cAAc,CAAC,EAAE,GAAG,SAAS,CAAC;gBAC9B,OAAO,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE;oBACvC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAA,6BAAW,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;iBAClE,CAAC,CAAC;YACJ,CAAC,CAAC;YACF,OAAO,CAAC,KAAK,GAAG,KAAK,WAAW,QAAgB,EAAE,QAAgB;gBACjE,MAAM,IAAI,GAAQ,CAAC,OAAO,CAAC,IAAI,GAAG,MAAM,kBAAM,CAAC,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;gBAC9F,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC7E,CAAC,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,CAAC,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC/B,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC7B,IACC,OAAO,CAAC,YAAY,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC;gBAC5C,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,WAAW,CAAC;gBACvC,wBAAS,CAAC,SAAS,EAClB,CAAC;gBACF,mEAAmE;gBACnE,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC;gBACtB,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,wBAAS,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;YAChE,CAAC,CAAC,8EAA8E;;gBAC3E,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IACD,SAAS,oBAAoB,CAAC,QAAQ;QACrC,MAAM,CAAC,GAAG,eAAe,CAAC,MAAM,CAAC;QACjC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACX,IAAI,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;YAC/B,IAAI,CAAC,OAAO;gBAAE,QAAQ,CAAC,OAAO,GAAG,OAAO,GAAG,IAAI,oBAAO,EAAE,CAAC;YACzD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAI,CAAC;gBACzB,MAAM,IAAI,GAAG,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC;gBAClC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACzC,CAAC;QACF,CAAC;QACD,eAAe,GAAG,IAAI,CAAC;QACvB,OAAO,QAAQ,CAAC;IACjB,CAAC;AACF,CAAC;AACD,IAAI,OAAO,CAAC;AACZ,SAAgB,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE;IACjD,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzF,mCAAmC;IACnC,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,OAAO,GAAG,IAAI,CAAC;QACf,WAAW,CAAC,GAAG,EAAE;YAChB,kBAAkB,GAAG,IAAI,GAAG,EAAE,CAAC;QAChC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,2BAAa,CAAC,uBAAuB,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QAC3D,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE;YACrB,kBAAkB,GAAG,IAAI,GAAG,EAAE,CAAC;QAChC,CAAC,CAAC,CAAC;IACJ,CAAC;AACF,CAAC;AACD,aAAa;AACN,KAAK,UAAU,KAAK,CAAC,WAAW;IACtC,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC7E,oGAAoG;IACpG,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QACtD,WAAW,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACjD,CAAC,CAAC;IACF,MAAM,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,EAAE,WAAW,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IACtF,OAAO,kBAAkB,CAAC;AAC3B,CAAC;AAEM,KAAK,UAAU,MAAM,CAAC,YAAY;IACxC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAChF,MAAM,YAAY,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,OAAO,mBAAmB,CAAC;AAC5B,CAAC"}

package/dist/security/certificateVerification/certificateVerificationSource.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Certificate verification source that handles both CRL and OCSP methods
+ */
+import { Resource } from '../../resources/Resource.ts';
+import type { Query } from '../../resources/ResourceInterface.ts';
+/**
+ * Certificate Verification Source that can handle both CRL and OCSP
+ */
+export declare class CertificateVerificationSource extends Resource {
+    get(query: Query): Promise<{
+        certificate_id: string;
+        status: any;
+        reason: any;
+        checked_at: number;
+        expiresAt: any;
+        method: string;
+    }>;
+}

package/dist/security/certificateVerification/certificateVerificationSource.js

@@ -0,0 +1,78 @@
+"use strict";
+/**
+ * Certificate verification source that handles both CRL and OCSP methods
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CertificateVerificationSource = void 0;
+const Resource_ts_1 = require("../../resources/Resource.js");
+// Import verification functions
+let performCRLCheck;
+let performOCSPCheck;
+// Lazy load to avoid circular dependencies
+async function loadVerificationFunctions() {
+    if (!performCRLCheck) {
+        const crlModule = await import('./crlVerification.js');
+        performCRLCheck = crlModule.performCRLCheck;
+    }
+    if (!performOCSPCheck) {
+        const ocspModule = await import('./ocspVerification.js');
+        performOCSPCheck = ocspModule.performOCSPCheck;
+    }
+}
+/**
+ * Certificate Verification Source that can handle both CRL and OCSP
+ */
+class CertificateVerificationSource extends Resource_ts_1.Resource {
+    async get(query) {
+        const id = query.id;
+        // Get the certificate data from requestContext
+        const context = this.getContext();
+        const requestContext = context?.requestContext;
+        if (!requestContext || !requestContext.certPem || !requestContext.issuerPem) {
+            // Likely a source request for an expired entry - we can't verify without cert and issuer data
+            return null;
+        }
+        const { certPem: certPemStr, issuerPem: issuerPemStr, ocspUrls, config } = requestContext;
+        // Determine method from cache key
+        let method;
+        if (id.startsWith('crl:')) {
+            method = 'crl';
+        }
+        else if (id.startsWith('ocsp:')) {
+            method = 'ocsp';
+        }
+        else {
+            method = 'unknown';
+        }
+        // Load verification functions
+        await loadVerificationFunctions();
+        // Perform verification based on method
+        let result;
+        let methodConfig;
+        if (method === 'crl') {
+            methodConfig = config.crl;
+            // Pass distributionPoint as an array if available (for CRL fetch)
+            const crlUrls = requestContext.distributionPoint ? [requestContext.distributionPoint] : undefined;
+            result = await performCRLCheck(certPemStr, issuerPemStr, methodConfig, crlUrls);
+        }
+        else if (method === 'ocsp') {
+            methodConfig = config.ocsp;
+            result = await performOCSPCheck(certPemStr, issuerPemStr, methodConfig, ocspUrls);
+        }
+        else {
+            throw new Error(`Unsupported verification method: ${method} for ID: ${id}`);
+        }
+        // Handle result consistently
+        const expiresAt = Date.now() + methodConfig.cacheTtl;
+        return {
+            certificate_id: id,
+            status: result.status,
+            reason: result.reason,
+            checked_at: Date.now(),
+            expiresAt,
+            method,
+        };
+    }
+}
+exports.CertificateVerificationSource = CertificateVerificationSource;
+//# sourceMappingURL=certificateVerificationSource.js.map

package/dist/security/certificateVerification/certificateVerificationSource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"certificateVerificationSource.js","sourceRoot":"","sources":["../../../security/certificateVerification/certificateVerificationSource.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAEH,6DAAuD;AAIvD,gCAAgC;AAChC,IAAI,eAAoB,CAAC;AACzB,IAAI,gBAAqB,CAAC;AAE1B,2CAA2C;AAC3C,KAAK,UAAU,yBAAyB;IACvC,IAAI,CAAC,eAAe,EAAE,CAAC;QACtB,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QACvD,eAAe,GAAI,SAAiB,CAAC,eAAe,CAAC;IACtD,CAAC;IACD,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QACzD,gBAAgB,GAAI,UAAkB,CAAC,gBAAgB,CAAC;IACzD,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAa,6BAA8B,SAAQ,sBAAQ;IAC1D,KAAK,CAAC,GAAG,CAAC,KAAY;QACrB,MAAM,EAAE,GAAG,KAAK,CAAC,EAAY,CAAC;QAE9B,+CAA+C;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAmD,CAAC;QACnF,MAAM,cAAc,GAAG,OAAO,EAAE,cAAc,CAAC;QAE/C,IAAI,CAAC,cAAc,IAAI,CAAC,cAAc,CAAC,OAAO,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,CAAC;YAC7E,8FAA8F;YAC9F,OAAO,IAAI,CAAC;QACb,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,cAAc,CAAC;QAE1F,kCAAkC;QAClC,IAAI,MAAc,CAAC;QACnB,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,MAAM,GAAG,KAAK,CAAC;QAChB,CAAC;aAAM,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACnC,MAAM,GAAG,MAAM,CAAC;QACjB,CAAC;aAAM,CAAC;YACP,MAAM,GAAG,SAAS,CAAC;QACpB,CAAC;QAED,8BAA8B;QAC9B,MAAM,yBAAyB,EAAE,CAAC;QAElC,uCAAuC;QACvC,IAAI,MAAM,CAAC;QACX,IAAI,YAAY,CAAC;QAEjB,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACtB,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC;YAC1B,kEAAkE;YAClE,MAAM,OAAO,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAClG,MAAM,GAAG,MAAM,eAAe,CAAC,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;QACjF,CAAC;aAAM,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YAC9B,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC;YAC3B,MAAM,GAAG,MAAM,gBAAgB,CAAC,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;QACnF,CAAC;aAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,oCAAoC,MAAM,YAAY,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QAED,6BAA6B;QAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC,QAAQ,CAAC;QAErD,OAAO;YACN,cAAc,EAAE,EAAE;YAClB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;YACtB,SAAS;YACT,MAAM;SACN,CAAC;IACH,CAAC;CACD;AAxDD,sEAwDC"}

package/dist/security/certificateVerification/configValidation.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Configuration validation for certificate verification
+ */
+import type { CertificateVerificationConfig, OCSPDefaults, CRLDefaults } from './types.ts';
+export declare const DEFAULT_FAILURE_MODE = "fail-closed";
+export declare const OCSP_DEFAULTS: OCSPDefaults;
+export declare const CRL_DEFAULTS: CRLDefaults;
+/**
+ * Validate and parse certificate verification configuration
+ * @param config - Certificate verification configuration to validate
+ * @returns Validated and parsed configuration object
+ * @throws {Error} If configuration is invalid
+ */
+export declare function validateAndParseCertificateVerificationConfig(config: unknown): CertificateVerificationConfig;

package/dist/security/certificateVerification/configValidation.js

@@ -0,0 +1,101 @@
+"use strict";
+/**
+ * Configuration validation for certificate verification
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CRL_DEFAULTS = exports.OCSP_DEFAULTS = exports.DEFAULT_FAILURE_MODE = void 0;
+exports.validateAndParseCertificateVerificationConfig = validateAndParseCertificateVerificationConfig;
+const joi_1 = __importDefault(require("joi"));
+exports.DEFAULT_FAILURE_MODE = 'fail-closed'; // Global default for certificate verification
+// Default configuration values for OCSP
+exports.OCSP_DEFAULTS = {
+    timeout: 5000, // 5 seconds
+    cacheTtl: 3600000, // 1 hour
+    errorCacheTtl: 300000, // 5 minutes (shorter for faster recovery)
+    failureMode: 'fail-closed',
+};
+// Default configuration values for CRL
+exports.CRL_DEFAULTS = {
+    timeout: 10000, // 10 seconds
+    cacheTtl: 86400000, // 24 hours
+    failureMode: 'fail-closed',
+    gracePeriod: 86400000, // 24 hours after nextUpdate
+};
+const failureModeSchema = joi_1.default.string().valid('fail-open', 'fail-closed');
+// CRL config schema that handles boolean shorthand and object config
+const crlConfigSchema = joi_1.default.alternatives().try(
+// Boolean shorthand: false = disabled, true = enabled with defaults
+joi_1.default.boolean().custom((value) => {
+    if (value === false) {
+        return { enabled: false };
+    }
+    // true = enabled with all defaults
+    return { enabled: true, ...exports.CRL_DEFAULTS };
+}), 
+// Object config with defaults applied
+joi_1.default.object({
+    enabled: joi_1.default.boolean().default(true),
+    timeout: joi_1.default.number().min(1000).default(exports.CRL_DEFAULTS.timeout).messages({
+        'number.min': 'CRL timeout must be at least 1000ms (1 second)',
+    }),
+    cacheTtl: joi_1.default.number().min(1000).default(exports.CRL_DEFAULTS.cacheTtl).messages({
+        'number.min': 'CRL cacheTtl must be at least 1000ms (1 second)',
+    }),
+    failureMode: failureModeSchema.default(exports.CRL_DEFAULTS.failureMode),
+    gracePeriod: joi_1.default.number().min(0).default(exports.CRL_DEFAULTS.gracePeriod).messages({
+        'number.min': 'CRL gracePeriod must be at least 0ms',
+    }),
+}));
+// OCSP config schema that handles boolean shorthand and object config
+const ocspConfigSchema = joi_1.default.alternatives().try(
+// Boolean shorthand: false = disabled, true = enabled with defaults
+joi_1.default.boolean().custom((value) => {
+    if (value === false) {
+        return { enabled: false };
+    }
+    // true = enabled with all defaults
+    return { enabled: true, ...exports.OCSP_DEFAULTS };
+}), 
+// Object config with defaults applied
+joi_1.default.object({
+    enabled: joi_1.default.boolean().default(true),
+    timeout: joi_1.default.number().min(1000).default(exports.OCSP_DEFAULTS.timeout).messages({
+        'number.min': 'OCSP timeout must be at least 1000ms (1 second)',
+    }),
+    cacheTtl: joi_1.default.number().min(1000).default(exports.OCSP_DEFAULTS.cacheTtl).messages({
+        'number.min': 'OCSP cacheTtl must be at least 1000ms (1 second)',
+    }),
+    errorCacheTtl: joi_1.default.number().min(1000).default(exports.OCSP_DEFAULTS.errorCacheTtl).messages({
+        'number.min': 'OCSP errorCacheTtl must be at least 1000ms (1 second)',
+    }),
+    failureMode: failureModeSchema.default(exports.OCSP_DEFAULTS.failureMode),
+}));
+// Main certificate verification schema
+// Note: crl and ocsp default to "enabled with defaults" if not provided
+const certificateVerificationSchema = joi_1.default.object({
+    failureMode: failureModeSchema.default(exports.DEFAULT_FAILURE_MODE),
+    crl: crlConfigSchema.default({ enabled: true, ...exports.CRL_DEFAULTS }),
+    ocsp: ocspConfigSchema.default({ enabled: true, ...exports.OCSP_DEFAULTS }),
+});
+/**
+ * Validate and parse certificate verification configuration
+ * @param config - Certificate verification configuration to validate
+ * @returns Validated and parsed configuration object
+ * @throws {Error} If configuration is invalid
+ */
+function validateAndParseCertificateVerificationConfig(config) {
+    const { error, value } = certificateVerificationSchema.validate(config, {
+        abortEarly: false,
+        allowUnknown: false,
+    });
+    if (error) {
+        const errorMessage = error.details.map((detail) => detail.message).join('; ');
+        throw new Error(`Invalid certificate verification configuration: ${errorMessage}`);
+    }
+    // Return the validated config (Joi has already done the parsing/validation)
+    return value;
+}
+//# sourceMappingURL=configValidation.js.map