@harperfast/harper 5.0.0-alpha.10

package/dist/security/tokenAuthentication.js

@@ -0,0 +1,205 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getJWTRSAKeys = getJWTRSAKeys;
+exports.createTokens = createTokens;
+exports.refreshOperationToken = refreshOperationToken;
+exports.validateOperationToken = validateOperationToken;
+exports.validateRefreshToken = validateRefreshToken;
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+const fs_extra_1 = __importDefault(require("fs-extra"));
+const node_path_1 = __importDefault(require("node:path"));
+const joi_1 = __importDefault(require("joi"));
+const validationWrapper_js_1 = require("../validation/validationWrapper.js");
+const hdbTerms_ts_1 = require("../utility/hdbTerms.js");
+const hdbError_js_1 = require("../utility/errors/hdbError.js");
+const { HTTP_STATUS_CODES, AUTHENTICATION_ERROR_MSGS } = hdbError_js_1.hdbErrors;
+const harper_logger_js_1 = __importDefault(require("../utility/logging/harper_logger.js"));
+const password = __importStar(require("../utility/password.js"));
+const user_ts_1 = require("./user.js");
+const insert_js_1 = require("../dataLayer/insert.js");
+const UpdateObject_js_1 = __importDefault(require("../dataLayer/UpdateObject.js"));
+const signalling_js_1 = __importDefault(require("../utility/signalling.js"));
+const itc_js_1 = require("../server/threads/itc.js");
+const environmentManager_js_1 = __importDefault(require("../utility/environment/environmentManager.js"));
+environmentManager_js_1.default.initSync();
+const OPERATION_TOKEN_TIMEOUT = environmentManager_js_1.default.get(hdbTerms_ts_1.CONFIG_PARAMS.AUTHENTICATION_OPERATIONTOKENTIMEOUT) || '1d';
+const REFRESH_TOKEN_TIMEOUT = environmentManager_js_1.default.get(hdbTerms_ts_1.CONFIG_PARAMS.AUTHENTICATION_REFRESHTOKENTIMEOUT) || '30d';
+const RSA_ALGORITHM = 'RS256';
+const TOKEN_TYPE = {
+    OPERATION: 'operation',
+    REFRESH: 'refresh',
+};
+/**
+ * fetches the rsa keys from cache var or disk
+ * @returns {Promise<JWTRSAKeys>}
+ */
+let rsaKeys = undefined;
+async function getJWTRSAKeys() {
+    if (rsaKeys)
+        return rsaKeys;
+    try {
+        const keysDir = node_path_1.default.join(environmentManager_js_1.default.getHdbBasePath(), hdbTerms_ts_1.LICENSE_KEY_DIR_NAME);
+        const passphrase = await fs_extra_1.default.readFile(node_path_1.default.join(keysDir, hdbTerms_ts_1.JWT_ENUM.JWT_PASSPHRASE_NAME), 'utf8');
+        const privateKey = await fs_extra_1.default.readFile(node_path_1.default.join(keysDir, hdbTerms_ts_1.JWT_ENUM.JWT_PRIVATE_KEY_NAME), 'utf8');
+        const publicKey = await fs_extra_1.default.readFile(node_path_1.default.join(keysDir, hdbTerms_ts_1.JWT_ENUM.JWT_PUBLIC_KEY_NAME), 'utf8');
+        rsaKeys = { publicKey, privateKey, passphrase };
+        return rsaKeys;
+    }
+    catch (err) {
+        harper_logger_js_1.default.error(err);
+        throw new hdbError_js_1.ClientError(AUTHENTICATION_ERROR_MSGS.NO_ENCRYPTION_KEYS, HTTP_STATUS_CODES.INTERNAL_SERVER_ERROR);
+    }
+}
+/**
+ * Creates a new operation token and refresh token.
+ * If there is no username and password, the hdb_user making the request is used in the token.
+ * An optional role can be provided which will be saved in the token payload.
+ * The token expires in the time specified in the expires_in field or the default time.
+ * @param authObj
+ */
+async function createTokens(authObj) {
+    const validation = (0, validationWrapper_js_1.validateBySchema)(authObj, joi_1.default.object({
+        username: joi_1.default.string().optional(),
+        password: joi_1.default.string().optional(),
+        role: joi_1.default.string().optional(),
+        expires_in: joi_1.default.alternatives(joi_1.default.string(), joi_1.default.number()).optional(),
+    }));
+    if (validation)
+        throw new hdbError_js_1.ClientError(validation.message);
+    let user;
+    try {
+        // bypassAuth will be set to true if this is called from a component
+        let validatePassword = authObj.bypass_auth !== true;
+        if (!authObj.username && !authObj.password) {
+            // if the username and password are not provided, use the hdb_user making the request.
+            authObj.username = authObj.hdb_user?.username;
+            // the password would have been checked by authHandler before getting here
+            validatePassword = false;
+        }
+        user = await (0, user_ts_1.findAndValidateUser)(authObj.username, authObj.password, validatePassword);
+    }
+    catch (err) {
+        harper_logger_js_1.default.error(err);
+        throw new hdbError_js_1.ClientError(AUTHENTICATION_ERROR_MSGS.INVALID_CREDENTIALS, HTTP_STATUS_CODES.UNAUTHORIZED);
+    }
+    if (!user)
+        throw new hdbError_js_1.ClientError(AUTHENTICATION_ERROR_MSGS.INVALID_CREDENTIALS, HTTP_STATUS_CODES.UNAUTHORIZED);
+    let superUser = false;
+    if (user.role?.permission) {
+        superUser = user.role.permission.super_user === true;
+    }
+    const payload = { username: authObj.username, super_user: superUser };
+    if (authObj.role)
+        payload.role = authObj.role;
+    const keys = await getJWTRSAKeys();
+    const operationToken = jsonwebtoken_1.default.sign(payload, { key: keys.privateKey, passphrase: keys.passphrase }, {
+        expiresIn: (authObj.expires_in ?? OPERATION_TOKEN_TIMEOUT),
+        algorithm: RSA_ALGORITHM,
+        subject: TOKEN_TYPE.OPERATION,
+    });
+    const refreshToken = jsonwebtoken_1.default.sign(payload, { key: keys.privateKey, passphrase: keys.passphrase }, {
+        expiresIn: REFRESH_TOKEN_TIMEOUT,
+        algorithm: RSA_ALGORITHM,
+        subject: TOKEN_TYPE.REFRESH,
+    });
+    // update the user refresh token
+    const hashedToken = password.hash(refreshToken, password.HASH_FUNCTION.SHA256);
+    const updateResult = await (0, insert_js_1.update)(new UpdateObject_js_1.default(hdbTerms_ts_1.SYSTEM_SCHEMA_NAME, hdbTerms_ts_1.SYSTEM_TABLE_NAMES.USER_TABLE_NAME, [
+        { username: authObj.username, refresh_token: hashedToken },
+    ]));
+    if (updateResult.skipped_hashes.length > 0)
+        throw new hdbError_js_1.ClientError(AUTHENTICATION_ERROR_MSGS.REFRESH_TOKEN_SAVE_FAILED, HTTP_STATUS_CODES.INTERNAL_SERVER_ERROR);
+    signalling_js_1.default.signalUserChange(new itc_js_1.UserEventMsg(process.pid));
+    return {
+        operation_token: operationToken,
+        refresh_token: refreshToken,
+    };
+}
+/**
+ * Refreshes the operation token using the refresh token.
+ * @param tokenObj
+ */
+async function refreshOperationToken(tokenObj) {
+    const validation = (0, validationWrapper_js_1.validateBySchema)(tokenObj, joi_1.default.object({ refresh_token: joi_1.default.string().required() }).required());
+    if (validation)
+        throw new hdbError_js_1.ClientError(validation.message);
+    const { refresh_token } = tokenObj;
+    await validateRefreshToken(refresh_token);
+    const keys = await getJWTRSAKeys();
+    const decodedJWT = jsonwebtoken_1.default.decode(refresh_token, { json: true });
+    const operationToken = jsonwebtoken_1.default.sign({ username: decodedJWT.username, super_user: decodedJWT.super_user }, { key: keys.privateKey, passphrase: keys.passphrase }, {
+        expiresIn: OPERATION_TOKEN_TIMEOUT,
+        algorithm: RSA_ALGORITHM,
+        subject: TOKEN_TYPE.OPERATION,
+    });
+    return { operation_token: operationToken };
+}
+async function validateOperationToken(token) {
+    return validateToken(token, TOKEN_TYPE.OPERATION);
+}
+async function validateRefreshToken(token) {
+    return validateToken(token, TOKEN_TYPE.REFRESH);
+}
+async function validateToken(token, tokenType) {
+    try {
+        const keys = await getJWTRSAKeys();
+        const tokenVerified = jsonwebtoken_1.default.verify(token, keys.publicKey, {
+            algorithms: [RSA_ALGORITHM],
+            subject: tokenType,
+        });
+        // If a role is present, it means the token is not an operation token. The validation of
+        // the token will happen in the respective function/component that uses the token.
+        if (tokenVerified.role) {
+            throw new Error('Invalid token');
+        }
+        const user = await (0, user_ts_1.findAndValidateUser)(tokenVerified.username, undefined, false);
+        if (tokenType === TOKEN_TYPE.REFRESH && !password.validate(user.refresh_token, token)) {
+            throw new Error('Invalid token');
+        }
+        return user;
+    }
+    catch (err) {
+        harper_logger_js_1.default.warn(err);
+        if (err?.name === 'TokenExpiredError') {
+            throw new hdbError_js_1.ClientError(AUTHENTICATION_ERROR_MSGS.TOKEN_EXPIRED, HTTP_STATUS_CODES.FORBIDDEN);
+        }
+        throw new hdbError_js_1.ClientError(AUTHENTICATION_ERROR_MSGS.INVALID_TOKEN, HTTP_STATUS_CODES.UNAUTHORIZED);
+    }
+}
+//# sourceMappingURL=tokenAuthentication.js.map

package/dist/security/tokenAuthentication.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenAuthentication.js","sourceRoot":"","sources":["../../security/tokenAuthentication.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+DA,sCAaC;AASD,oCA+EC;AAMD,sDAmBC;AAED,wDAEC;AAED,oDAEC;AArMD,gEAAmG;AACnG,wDAA0B;AAC1B,0DAA6B;AAC7B,8CAAsB;AACtB,6EAAsE;AACtE,wDAMgC;AAChC,+DAAuE;AACvE,MAAM,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,GAAG,uBAAS,CAAC;AACnE,2FAAyD;AACzD,iEAAmD;AACnD,uCAA2D;AAC3D,sDAAgD;AAChD,mFAAwD;AACxD,6EAAkD;AAClD,qDAAwD;AACxD,yGAA+D;AAC/D,+BAAG,CAAC,QAAQ,EAAE,CAAC;AAGf,MAAM,uBAAuB,GAAgB,+BAAG,CAAC,GAAG,CAAC,2BAAa,CAAC,oCAAoC,CAAC,IAAI,IAAI,CAAC;AACjH,MAAM,qBAAqB,GAAgB,+BAAG,CAAC,GAAG,CAAC,2BAAa,CAAC,kCAAkC,CAAC,IAAI,KAAK,CAAC;AAC9G,MAAM,aAAa,GAAc,OAAO,CAAC;AAEzC,MAAM,UAAU,GAAG;IAClB,SAAS,EAAE,WAAW;IACtB,OAAO,EAAE,SAAS;CAClB,CAAC;AA0BF;;;GAGG;AACH,IAAI,OAAO,GAA2B,SAAS,CAAC;AACzC,KAAK,UAAU,aAAa;IAClC,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,IAAI,CAAC;QACJ,MAAM,OAAO,GAAW,mBAAI,CAAC,IAAI,CAAC,+BAAG,CAAC,cAAc,EAAE,EAAE,kCAAoB,CAAC,CAAC;QAC9E,MAAM,UAAU,GAAW,MAAM,kBAAE,CAAC,QAAQ,CAAC,mBAAI,CAAC,IAAI,CAAC,OAAO,EAAE,sBAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC,CAAC;QACvG,MAAM,UAAU,GAAW,MAAM,kBAAE,CAAC,QAAQ,CAAC,mBAAI,CAAC,IAAI,CAAC,OAAO,EAAE,sBAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC,CAAC;QACxG,MAAM,SAAS,GAAW,MAAM,kBAAE,CAAC,QAAQ,CAAC,mBAAI,CAAC,IAAI,CAAC,OAAO,EAAE,sBAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC,CAAC;QACtG,OAAO,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;QAChD,OAAO,OAAO,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,0BAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAClB,MAAM,IAAI,yBAAW,CAAC,yBAAyB,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;IAC9G,CAAC;AACF,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,YAAY,CAAC,OAAmB;IACrD,MAAM,UAAU,GAAQ,IAAA,uCAAgB,EACvC,OAAO,EACP,aAAG,CAAC,MAAM,CAAC;QACV,QAAQ,EAAE,aAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACjC,QAAQ,EAAE,aAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACjC,IAAI,EAAE,aAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC7B,UAAU,EAAE,aAAG,CAAC,YAAY,CAAC,aAAG,CAAC,MAAM,EAAE,EAAE,aAAG,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;KACnE,CAAC,CACF,CAAC;IACF,IAAI,UAAU;QAAE,MAAM,IAAI,yBAAW,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAE1D,IAAI,IAAS,CAAC;IACd,IAAI,CAAC;QACJ,oEAAoE;QACpE,IAAI,gBAAgB,GAAY,OAAO,CAAC,WAAW,KAAK,IAAI,CAAC;QAC7D,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC5C,sFAAsF;YACtF,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC;YAC9C,0EAA0E;YAC1E,gBAAgB,GAAG,KAAK,CAAC;QAC1B,CAAC;QACD,IAAI,GAAG,MAAM,IAAA,6BAAmB,EAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IACxF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,0BAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAClB,MAAM,IAAI,yBAAW,CAAC,yBAAyB,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC;IACtG,CAAC;IACD,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,yBAAW,CAAC,yBAAyB,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAEhH,IAAI,SAAS,GAAY,KAAK,CAAC;IAC/B,IAAI,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC;QAC3B,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,KAAK,IAAI,CAAC;IACtD,CAAC;IAED,MAAM,OAAO,GAIT,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IAC1D,IAAI,OAAO,CAAC,IAAI;QAAE,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAE9C,MAAM,IAAI,GAAe,MAAM,aAAa,EAAE,CAAC;IAC/C,MAAM,cAAc,GAAG,sBAAG,CAAC,IAAI,CAC9B,OAAO,EACP,EAAE,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAmB,EACtE;QACC,SAAS,EAAE,CAAC,OAAO,CAAC,UAAU,IAAI,uBAAuB,CAAgB;QACzE,SAAS,EAAE,aAAa;QACxB,OAAO,EAAE,UAAU,CAAC,SAAS;KACP,CACvB,CAAC;IAEF,MAAM,YAAY,GAAG,sBAAG,CAAC,IAAI,CAC5B,OAAO,EACP,EAAE,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAmB,EACtE;QACC,SAAS,EAAE,qBAAqB;QAChC,SAAS,EAAE,aAAa;QACxB,OAAO,EAAE,UAAU,CAAC,OAAO;KACL,CACvB,CAAC;IAEF,gCAAgC;IAChC,MAAM,WAAW,GAA6B,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACzG,MAAM,YAAY,GAAQ,MAAM,IAAA,kBAAM,EACrC,IAAI,yBAAY,CAAC,gCAAkB,EAAE,gCAAkB,CAAC,eAAe,EAAE;QACxE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE;KAC1D,CAAC,CACF,CAAC;IAEF,IAAI,YAAY,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;QACzC,MAAM,IAAI,yBAAW,CAAC,yBAAyB,CAAC,yBAAyB,EAAE,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;IAErH,uBAAU,CAAC,gBAAgB,CAAC,IAAI,qBAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAE3D,OAAO;QACN,eAAe,EAAE,cAAc;QAC/B,aAAa,EAAE,YAAY;KAC3B,CAAC;AACH,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,qBAAqB,CAAC,QAAqB;IAChE,MAAM,UAAU,GAAQ,IAAA,uCAAgB,EAAC,QAAQ,EAAE,aAAG,CAAC,MAAM,CAAC,EAAE,aAAa,EAAE,aAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IACtH,IAAI,UAAU;QAAE,MAAM,IAAI,yBAAW,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,EAAE,aAAa,EAAE,GAAG,QAAQ,CAAC;IACnC,MAAM,oBAAoB,CAAC,aAAa,CAAC,CAAC;IAE1C,MAAM,IAAI,GAAe,MAAM,aAAa,EAAE,CAAC;IAC/C,MAAM,UAAU,GAAG,sBAAG,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,MAAM,cAAc,GAAG,sBAAG,CAAC,IAAI,CAC9B,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE,EACpE,EAAE,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAmB,EACtE;QACC,SAAS,EAAE,uBAAsC;QACjD,SAAS,EAAE,aAAa;QACxB,OAAO,EAAE,UAAU,CAAC,SAAS;KACP,CACvB,CAAC;IAEF,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC;AAC5C,CAAC;AAEM,KAAK,UAAU,sBAAsB,CAAC,KAAa;IACzD,OAAO,aAAa,CAAC,KAAK,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;AACnD,CAAC;AAEM,KAAK,UAAU,oBAAoB,CAAC,KAAa;IACvD,OAAO,aAAa,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;AACjD,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,KAAa,EAAE,SAAiB;IAC5D,IAAI,CAAC;QACJ,MAAM,IAAI,GAAe,MAAM,aAAa,EAAE,CAAC;QAC/C,MAAM,aAAa,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE;YACvD,UAAU,EAAE,CAAC,aAAa,CAAC;YAC3B,OAAO,EAAE,SAAS;SAClB,CAAe,CAAC;QAEjB,wFAAwF;QACxF,kFAAkF;QAClF,IAAI,aAAa,CAAC,IAAI,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QAClC,CAAC;QAED,MAAM,IAAI,GAAQ,MAAM,IAAA,6BAAmB,EAAC,aAAa,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QACtF,IAAI,SAAS,KAAK,UAAU,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,EAAE,CAAC;YACvF,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QAClC,CAAC;QAED,OAAO,IAAI,CAAC;IACb,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,0BAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjB,IAAI,GAAG,EAAE,IAAI,KAAK,mBAAmB,EAAE,CAAC;YACvC,MAAM,IAAI,yBAAW,CAAC,yBAAyB,CAAC,aAAa,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC7F,CAAC;QAED,MAAM,IAAI,yBAAW,CAAC,yBAAyB,CAAC,aAAa,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAChG,CAAC;AACF,CAAC"}

package/dist/security/user.d.ts

@@ -0,0 +1,77 @@
+declare const USERNAME_REQUIRED = "username is required";
+declare const ALTERUSER_NOTHING_TO_UPDATE = "nothing to update, must supply active, role or password to update";
+declare const EMPTY_PASSWORD = "password cannot be an empty string";
+declare const EMPTY_ROLE = "If role is specified, it cannot be empty.";
+declare const ACTIVE_BOOLEAN = "active must be true or false";
+export { addUser, alterUser, dropUser, getSuperUser, userInfo, listUsers, listUsersExternal, setUsersWithRolesCache, findAndValidateUser, getUsersWithRolesCache, USERNAME_REQUIRED, ALTERUSER_NOTHING_TO_UPDATE, EMPTY_PASSWORD, EMPTY_ROLE, ACTIVE_BOOLEAN, };
+export interface User {
+    active?: boolean;
+    username: string;
+    role?: UserRole;
+    __updatedtime__?: number;
+    __createdtime__?: number;
+    [other: string]: unknown;
+}
+export interface UserRole {
+    permission: UserRoleNamedPermissions & UserRoleDatabasePermissions;
+    role: string;
+    id: string;
+    __updatedtime__: number;
+    __createdtime__: number;
+}
+export interface UserRoleNamedPermissions extends Partial<CRUDPermissions> {
+    super_user?: boolean;
+    cluster_user?: boolean;
+    structure_user?: boolean | string[];
+    operations?: string[];
+    /** Pre-expanded Set built from operations at cache-load time. Not persisted. */
+    _expandedOperations?: Set<string>;
+}
+export interface UserRoleDatabasePermissions {
+    [databaseName: string]: UserRoleSchemaRecord;
+}
+export interface UserRoleSchemaRecord extends Partial<CRUDPermissions> {
+    tables: Record<string, UserRolePermissionTable | UserLegacyRolePermissionTable>;
+}
+export interface UserRolePermissionTable extends CRUDPermissions {
+    attribute_permissions: UserRoleAttributePermissionTable[];
+}
+export interface UserRoleAttributePermissionTable extends Omit<CRUDPermissions, 'delete'> {
+    attribute_name: string;
+}
+export interface UserLegacyRolePermissionTable extends CRUDPermissions {
+    attribute_restrictions: UserLegacyRoleAttributePermissionTable[];
+}
+export interface UserLegacyRoleAttributePermissionTable extends CRUDPermissions {
+    attribute_name: string;
+}
+export interface CRUDPermissions {
+    read: boolean;
+    insert: boolean;
+    update: boolean;
+    delete: boolean;
+}
+declare function addUser(user: User | any): Promise<string>;
+declare function alterUser(jsonMessage: any): Promise<any>;
+declare function dropUser(user: User | any): Promise<string>;
+declare function userInfo(body: any): Promise<string | User>;
+/**
+ * This function should be called by chooseOperation as it scrubs sensitive information before returning
+ * the results of list users.
+ */
+declare function listUsersExternal(): Promise<User[]>;
+/**
+ * Queries system table for user records, adds role-based perms, scrubs list based on licensed role allowance and returns
+ * data in a Map with the username as the key for the entry
+ */
+declare function listUsers(): Promise<Map<string, User>>;
+declare function setUsersWithRolesCache(cache?: any): Promise<void>;
+declare function getUsersWithRolesCache(): Promise<any>;
+/**
+ * iterates global.hdb_users to find and validate the username & optionally the password as well as if they are active.
+ * @param {string} username
+ * @param {string} pw
+ * @param {boolean} validatePassword
+ */
+declare function findAndValidateUser(username: string, pw?: string | null, validatePassword?: boolean): Promise<User>;
+declare function getSuperUser(): Promise<User | undefined>;

package/dist/security/user.js

@@ -0,0 +1,349 @@
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ACTIVE_BOOLEAN = exports.EMPTY_ROLE = exports.EMPTY_PASSWORD = exports.ALTERUSER_NOTHING_TO_UPDATE = exports.USERNAME_REQUIRED = void 0;
+exports.addUser = addUser;
+exports.alterUser = alterUser;
+exports.dropUser = dropUser;
+exports.getSuperUser = getSuperUser;
+exports.userInfo = userInfo;
+exports.listUsers = listUsers;
+exports.listUsersExternal = listUsersExternal;
+exports.setUsersWithRolesCache = setUsersWithRolesCache;
+exports.findAndValidateUser = findAndValidateUser;
+exports.getUsersWithRolesCache = getUsersWithRolesCache;
+const USERNAME_REQUIRED = 'username is required';
+exports.USERNAME_REQUIRED = USERNAME_REQUIRED;
+const ALTERUSER_NOTHING_TO_UPDATE = 'nothing to update, must supply active, role or password to update';
+exports.ALTERUSER_NOTHING_TO_UPDATE = ALTERUSER_NOTHING_TO_UPDATE;
+const EMPTY_PASSWORD = 'password cannot be an empty string';
+exports.EMPTY_PASSWORD = EMPTY_PASSWORD;
+const EMPTY_ROLE = 'If role is specified, it cannot be empty.';
+exports.EMPTY_ROLE = EMPTY_ROLE;
+const ACTIVE_BOOLEAN = 'active must be true or false';
+exports.ACTIVE_BOOLEAN = ACTIVE_BOOLEAN;
+//requires must be declared after module.exports to avoid cyclical dependency
+const insert = require('../dataLayer/insert.js');
+const delete_ = require('../dataLayer/delete.js');
+const validation = require('../validation/user_validation.js');
+const search = require('../dataLayer/search.js');
+const signalling = require('../utility/signalling.js');
+const hdbUtility = require('../utility/common_utils.js');
+const validate = require('validate.js');
+const logger = require('../utility/logging/harper_logger.js');
+const { promisify } = require('util');
+const env = require('../utility/environment/environmentManager.js');
+const systemSchema = require('../json/systemSchema.json');
+const { hdbErrors, ClientError } = require('../utility/errors/hdbError.js');
+const { HTTP_STATUS_CODES, AUTHENTICATION_ERROR_MSGS, HDB_ERROR_MSGS } = hdbErrors;
+const { UserEventMsg } = require('../server/threads/itc.js');
+const _ = require('lodash');
+const harperLogger = require('../utility/logging/harper_logger.js');
+// Need to use `.js` even for other TS files since TS compiler won't replace requires.
+// Whenever we can fix the cyclical dependency issue in this file (and switch to imports) we can use the correct file extensions.
+const password = require('../utility/password.js');
+const { server } = require('../server/Server.js');
+const terms = require('../utility/hdbTerms.js');
+const { expandOperationsPerms } = require('../utility/operationPermissions.js');
+server.getUser = (username, password) => {
+    return findAndValidateUser(username, password, password != null);
+};
+server.authenticateUser = (username, password) => {
+    return findAndValidateUser(username, password);
+};
+const USER_ATTRIBUTE_ALLOWLIST = {
+    username: true,
+    active: true,
+    role: true,
+    password: true,
+};
+const passwordHashCache = new Map();
+const promiseDelete = promisify(delete_.delete);
+const configuredHashFunction = env.get(terms.CONFIG_PARAMS.AUTHENTICATION_HASHFUNCTION) ?? password.HASH_FUNCTION.SHA256;
+let usersWithRolesMap;
+async function addUser(user) {
+    let cleanUser = validate.cleanAttributes(user, USER_ATTRIBUTE_ALLOWLIST);
+    let validationResp = validation.addUserValidation(cleanUser);
+    if (validationResp)
+        throw new ClientError(validationResp.message);
+    let searchRole = await search.searchByValue({
+        schema: 'system',
+        table: 'hdb_role',
+        attribute: 'role',
+        value: cleanUser.role,
+        get_attributes: ['id', 'permission', 'role'],
+    });
+    if (!searchRole || searchRole.length < 1) {
+        throw new ClientError(HDB_ERROR_MSGS.ROLE_NAME_NOT_FOUND(cleanUser.role), HTTP_STATUS_CODES.NOT_FOUND);
+    }
+    if (searchRole.length > 1) {
+        throw new ClientError(HDB_ERROR_MSGS.DUP_ROLES_FOUND(cleanUser.role), HTTP_STATUS_CODES.CONFLICT);
+    }
+    cleanUser.password = await password.hash(cleanUser.password, configuredHashFunction);
+    cleanUser.hash_function = configuredHashFunction;
+    cleanUser.role = searchRole[0].id;
+    const insertResponse = await insert.insert({
+        operation: 'insert',
+        schema: 'system',
+        table: 'hdb_user',
+        records: [cleanUser],
+    });
+    logger.debug(insertResponse);
+    await setUsersWithRolesCache();
+    if (insertResponse.skipped_hashes.length === 1) {
+        throw new ClientError(HDB_ERROR_MSGS.USER_ALREADY_EXISTS(cleanUser.username), HTTP_STATUS_CODES.CONFLICT);
+    }
+    signalling.signalUserChange(new UserEventMsg(process.pid));
+    return `${cleanUser.username} successfully added`;
+}
+async function alterUser(jsonMessage) {
+    let cleanUser = validate.cleanAttributes(jsonMessage, USER_ATTRIBUTE_ALLOWLIST);
+    if (hdbUtility.isEmptyOrZeroLength(cleanUser.username)) {
+        throw new Error(USERNAME_REQUIRED);
+    }
+    if (hdbUtility.isEmptyOrZeroLength(cleanUser.password) &&
+        hdbUtility.isEmptyOrZeroLength(cleanUser.role) &&
+        hdbUtility.isEmptyOrZeroLength(cleanUser.active)) {
+        throw new Error(ALTERUSER_NOTHING_TO_UPDATE);
+    }
+    if (!hdbUtility.isEmpty(cleanUser.password) && hdbUtility.isEmptyOrZeroLength(cleanUser.password.trim())) {
+        throw new Error(EMPTY_PASSWORD);
+    }
+    if (!hdbUtility.isEmpty(cleanUser.active) && !hdbUtility.isBoolean(cleanUser.active)) {
+        throw new Error(ACTIVE_BOOLEAN);
+    }
+    if (!hdbUtility.isEmpty(cleanUser.password) && !hdbUtility.isEmptyOrZeroLength(cleanUser.password.trim())) {
+        cleanUser.password = await password.hash(cleanUser.password, configuredHashFunction);
+        cleanUser.hash_function = configuredHashFunction;
+    }
+    // the not operator will consider an empty string as undefined, so we need to check for an empty string explicitly
+    if (cleanUser.role === '') {
+        throw new Error(EMPTY_ROLE);
+    }
+    // Invalid roles will be found in the role search
+    if (cleanUser.role) {
+        const roleData = await search.searchByValue({
+            schema: 'system',
+            table: 'hdb_role',
+            attribute: 'role',
+            value: cleanUser.role,
+            get_attributes: ['*'],
+        });
+        if (!roleData || roleData.length === 0)
+            throw new ClientError(HDB_ERROR_MSGS.ALTER_USER_ROLE_NOT_FOUND(cleanUser.role), HTTP_STATUS_CODES.NOT_FOUND);
+        if (roleData.length > 1)
+            throw new ClientError(HDB_ERROR_MSGS.DUP_ROLES_FOUND(cleanUser.role), HTTP_STATUS_CODES.CONFLICT);
+        cleanUser.role = roleData[0].id;
+    }
+    const updateResponse = await insert.update({
+        operation: 'update',
+        schema: 'system',
+        table: 'hdb_user',
+        records: [cleanUser],
+    });
+    await setUsersWithRolesCache();
+    signalling.signalUserChange(new UserEventMsg(process.pid));
+    return updateResponse;
+}
+async function dropUser(user) {
+    const validationResp = validation.dropUserValidation(user);
+    if (validationResp)
+        throw new ClientError(validationResp.message);
+    if (usersWithRolesMap.get(user.username) === undefined)
+        throw new ClientError(HDB_ERROR_MSGS.USER_NOT_EXIST(user.username), HTTP_STATUS_CODES.NOT_FOUND);
+    const deleteResponse = await promiseDelete({
+        table: 'hdb_user',
+        schema: 'system',
+        hash_values: [user.username],
+    });
+    logger.debug(deleteResponse);
+    await setUsersWithRolesCache();
+    signalling.signalUserChange(new UserEventMsg(process.pid));
+    return `${user.username} successfully deleted`;
+}
+async function userInfo(body) {
+    if (!body || !body.hdb_user) {
+        return 'There was no user info in the body';
+    }
+    let user = _.cloneDeep(body.hdb_user);
+    let roleData = await search.searchByHash({
+        schema: 'system',
+        table: 'hdb_role',
+        hash_values: [user.role.id],
+        get_attributes: ['*'],
+    });
+    user.role = roleData[0];
+    delete user.password;
+    delete user.refresh_token;
+    delete user.hash;
+    delete user.hash_function;
+    return user;
+}
+/**
+ * This function should be called by chooseOperation as it scrubs sensitive information before returning
+ * the results of list users.
+ */
+async function listUsersExternal() {
+    const userData = await listUsers();
+    userData.forEach((user) => {
+        delete user.password;
+        delete user.hash;
+        delete user.refresh_token;
+        delete user.hash_function;
+    });
+    return [...userData.values()];
+}
+/**
+ * Queries system table for user records, adds role-based perms, scrubs list based on licensed role allowance and returns
+ * data in a Map with the username as the key for the entry
+ */
+async function listUsers() {
+    const roles = await search.searchByValue({
+        schema: 'system',
+        table: 'hdb_role',
+        value: '*',
+        attribute: 'role',
+        get_attributes: ['*'],
+    });
+    const roleMapObj = {};
+    for (let role of roles) {
+        roleMapObj[role.id] = _.cloneDeep(role);
+    }
+    if (Object.keys(roleMapObj).length === 0)
+        return null;
+    const users = await search.searchByValue({
+        schema: 'system',
+        table: 'hdb_user',
+        value: '*',
+        attribute: 'username',
+        get_attributes: ['*'],
+    });
+    const userMap = new Map();
+    for (let user of users) {
+        user = _.cloneDeep(user);
+        user.role = roleMapObj[user.role];
+        appendSystemTablesToRole(user.role);
+        cacheExpandedOperationsPerms(user.role);
+        userMap.set(user.username, user);
+    }
+    return userMap;
+}
+/**
+ * adds system table permissions to a role.  This is used to protect system tables by leveraging operationAuthorization.
+ * @param userRole - Role of the user found during auth.
+ */
+function appendSystemTablesToRole(userRole) {
+    if (!userRole) {
+        logger.error(`invalid user role found.`);
+        return;
+    }
+    if (!userRole.permission.system) {
+        userRole.permission.system = {
+            tables: {},
+        };
+    }
+    if (!userRole.permission.system.tables) {
+        userRole.permission.system.tables = {};
+    }
+    for (let table of Object.keys(systemSchema)) {
+        let newProp = {
+            read: !!userRole.permission.super_user,
+            insert: false,
+            update: false,
+            delete: false,
+            attribute_permissions: [],
+        };
+        userRole.permission.system.tables[table] = newProp;
+    }
+}
+/**
+ * Pre-expands operations into a Set at cache-load time so verifyPerms can do an O(1) lookup
+ * instead of allocating and expanding on every request.
+ * @param userRole - Role of the user found during auth.
+ */
+function cacheExpandedOperationsPerms(userRole) {
+    if (!userRole?.permission?.operations)
+        return;
+    userRole.permission._expandedOperations = expandOperationsPerms(userRole.permission.operations);
+}
+async function setUsersWithRolesCache(cache = undefined) {
+    if (cache)
+        usersWithRolesMap = cache;
+    else
+        usersWithRolesMap = await listUsers();
+}
+async function getUsersWithRolesCache() {
+    if (!usersWithRolesMap)
+        await setUsersWithRolesCache();
+    return usersWithRolesMap;
+}
+/**
+ * iterates global.hdb_users to find and validate the username & optionally the password as well as if they are active.
+ * @param {string} username
+ * @param {string} pw
+ * @param {boolean} validatePassword
+ */
+async function findAndValidateUser(username, pw, validatePassword = true) {
+    if (!usersWithRolesMap) {
+        await setUsersWithRolesCache();
+    }
+    const userTmp = usersWithRolesMap.get(username);
+    if (!userTmp) {
+        if (!validatePassword)
+            return { username };
+        throw new ClientError(AUTHENTICATION_ERROR_MSGS.GENERIC_AUTH_FAIL, HTTP_STATUS_CODES.UNAUTHORIZED);
+    }
+    if (userTmp && !userTmp.active)
+        throw new ClientError(AUTHENTICATION_ERROR_MSGS.USER_INACTIVE, HTTP_STATUS_CODES.UNAUTHORIZED);
+    const user = {
+        active: userTmp.active,
+        username: userTmp.username,
+    };
+    if (userTmp.refresh_token)
+        user.refresh_token = userTmp.refresh_token;
+    // Shallow-clone the role and its permission so that verifyPerms can replace
+    // requestJson.hdb_user.role.permission with translated perms without mutating the cache.
+    // The _expandedOperations Set and operations array are shared by reference (read-only).
+    if (userTmp.role)
+        user.role = { ...userTmp.role, permission: { ...userTmp.role.permission } };
+    if (validatePassword === true) {
+        // if matches the cached hash immediately return (the fast path)
+        if (passwordHashCache.get(pw) === userTmp.password)
+            return user;
+        // if validates, cache the password
+        else {
+            let validated = password.validate(userTmp.password, pw, userTmp.hash_function || password.HASH_FUNCTION.MD5); // if no hashFunction default to legacy MD5
+            // argon2id hash validation is async so await it if it is a promise
+            if (validated?.then)
+                validated = await validated;
+            if (validated === true)
+                passwordHashCache.set(pw, userTmp.password);
+            else
+                throw new ClientError(AUTHENTICATION_ERROR_MSGS.GENERIC_AUTH_FAIL, HTTP_STATUS_CODES.UNAUTHORIZED);
+        }
+    }
+    return user;
+}
+async function getSuperUser() {
+    if (!usersWithRolesMap) {
+        await setUsersWithRolesCache();
+    }
+    for (let [, user] of usersWithRolesMap) {
+        if (user.role.role === 'super_user')
+            return user;
+    }
+}
+let invalidateCallbacks = [];
+server.invalidateUser = function (user) {
+    for (let callback of invalidateCallbacks) {
+        try {
+            callback(user);
+        }
+        catch (error) {
+            harperLogger.error('Error invalidating user', error);
+        }
+    }
+};
+server.onInvalidatedUser = function (callback) {
+    invalidateCallbacks.push(callback);
+};
+//# sourceMappingURL=user.js.map

package/dist/security/user.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user.js","sourceRoot":"","sources":["../../security/user.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;AASZ,0BAAO;AACP,8BAAS;AACT,4BAAQ;AACR,oCAAY;AACZ,4BAAQ;AACR,8BAAS;AACT,8CAAiB;AACjB,wDAAsB;AACtB,kDAAmB;AACnB,wDAAsB;AAhBvB,MAAM,iBAAiB,GAAG,sBAAsB,CAAC;AAiBhD,8CAAiB;AAhBlB,MAAM,2BAA2B,GAAG,mEAAmE,CAAC;AAiBvG,kEAA2B;AAhB5B,MAAM,cAAc,GAAG,oCAAoC,CAAC;AAiB3D,wCAAc;AAhBf,MAAM,UAAU,GAAG,2CAA2C,CAAC;AAiB9D,gCAAU;AAhBX,MAAM,cAAc,GAAG,8BAA8B,CAAC;AAiBrD,wCAAc;AA4Df,6EAA6E;AAC7E,MAAM,MAAM,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;AACjD,MAAM,OAAO,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;AAClD,MAAM,UAAU,GAAG,OAAO,CAAC,kCAAkC,CAAC,CAAC;AAC/D,MAAM,MAAM,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;AACjD,MAAM,UAAU,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;AACvD,MAAM,UAAU,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAAC;AACzD,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;AACxC,MAAM,MAAM,GAAG,OAAO,CAAC,qCAAqC,CAAC,CAAC;AAC9D,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;AACtC,MAAM,GAAG,GAAG,OAAO,CAAC,8CAA8C,CAAC,CAAC;AACpE,MAAM,YAAY,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;AAC1D,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,+BAA+B,CAAC,CAAC;AAC5E,MAAM,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,cAAc,EAAE,GAAG,SAAS,CAAC;AACnF,MAAM,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;AAC7D,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;AAC5B,MAAM,YAAY,GAAG,OAAO,CAAC,qCAAqC,CAAC,CAAC;AAEpE,sFAAsF;AACtF,iIAAiI;AACjI,MAAM,QAAQ,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;AACnD,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAClD,MAAM,KAAK,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;AAChD,MAAM,EAAE,qBAAqB,EAAE,GAAG,OAAO,CAAC,oCAAoC,CAAC,CAAC;AAEhF,MAAM,CAAC,OAAO,GAAG,CAAC,QAAgB,EAAE,QAAwB,EAAiB,EAAE;IAC9E,OAAO,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,IAAI,IAAI,CAAC,CAAC;AAClE,CAAC,CAAC;AAEF,MAAM,CAAC,gBAAgB,GAAG,CAAC,QAAgB,EAAE,QAAwB,EAAiB,EAAE;IACvF,OAAO,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAChD,CAAC,CAAC;AAEF,MAAM,wBAAwB,GAAG;IAChC,QAAQ,EAAE,IAAI;IACd,MAAM,EAAE,IAAI;IACZ,IAAI,EAAE,IAAI;IACV,QAAQ,EAAE,IAAI;CACd,CAAC;AACF,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAE,CAAC;AACpC,MAAM,aAAa,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;AAChD,MAAM,sBAAsB,GAC3B,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,2BAA2B,CAAC,IAAI,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC;AAC3F,IAAI,iBAAiB,CAAC;AAEtB,KAAK,UAAU,OAAO,CAAC,IAAgB;IACtC,IAAI,SAAS,GAAG,QAAQ,CAAC,eAAe,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC;IACzE,IAAI,cAAc,GAAG,UAAU,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC7D,IAAI,cAAc;QAAE,MAAM,IAAI,WAAW,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;IAElE,IAAI,UAAU,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC;QAC3C,MAAM,EAAE,QAAQ;QAChB,KAAK,EAAE,UAAU;QACjB,SAAS,EAAE,MAAM;QACjB,KAAK,EAAE,SAAS,CAAC,IAAI;QACrB,cAAc,EAAE,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC;KAC5C,CAAC,CAAC;IAEH,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,WAAW,CAAC,cAAc,CAAC,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;IACxG,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,WAAW,CAAC,cAAc,CAAC,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACnG,CAAC;IAED,SAAS,CAAC,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,sBAAsB,CAAC,CAAC;IACrF,SAAS,CAAC,aAAa,GAAG,sBAAsB,CAAC;IACjD,SAAS,CAAC,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAElC,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC;QAC1C,SAAS,EAAE,QAAQ;QACnB,MAAM,EAAE,QAAQ;QAChB,KAAK,EAAE,UAAU;QACjB,OAAO,EAAE,CAAC,SAAS,CAAC;KACpB,CAAC,CAAC;IACH,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAE7B,MAAM,sBAAsB,EAAE,CAAC;IAE/B,IAAI,cAAc,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,WAAW,CAAC,cAAc,CAAC,mBAAmB,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC3G,CAAC;IAED,UAAU,CAAC,gBAAgB,CAAC,IAAI,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,OAAO,GAAG,SAAS,CAAC,QAAQ,qBAAqB,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,WAAW;IACnC,IAAI,SAAS,GAAG,QAAQ,CAAC,eAAe,CAAC,WAAW,EAAE,wBAAwB,CAAC,CAAC;IAEhF,IAAI,UAAU,CAAC,mBAAmB,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACpC,CAAC;IAED,IACC,UAAU,CAAC,mBAAmB,CAAC,SAAS,CAAC,QAAQ,CAAC;QAClD,UAAU,CAAC,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC;QAC9C,UAAU,CAAC,mBAAmB,CAAC,SAAS,CAAC,MAAM,CAAC,EAC/C,CAAC;QACF,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,mBAAmB,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QAC1G,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;QACtF,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QAC3G,SAAS,CAAC,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,sBAAsB,CAAC,CAAC;QACrF,SAAS,CAAC,aAAa,GAAG,sBAAsB,CAAC;IAClD,CAAC;IAED,kHAAkH;IAClH,IAAI,SAAS,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC;IAC7B,CAAC;IACD,iDAAiD;IACjD,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC;YAC3C,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,UAAU;YACjB,SAAS,EAAE,MAAM;YACjB,KAAK,EAAE,SAAS,CAAC,IAAI;YACrB,cAAc,EAAE,CAAC,GAAG,CAAC;SACrB,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YACrC,MAAM,IAAI,WAAW,CAAC,cAAc,CAAC,yBAAyB,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAE9G,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YACtB,MAAM,IAAI,WAAW,CAAC,cAAc,CAAC,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAEnG,SAAS,CAAC,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjC,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC;QAC1C,SAAS,EAAE,QAAQ;QACnB,MAAM,EAAE,QAAQ;QAChB,KAAK,EAAE,UAAU;QACjB,OAAO,EAAE,CAAC,SAAS,CAAC;KACpB,CAAC,CAAC;IAEH,MAAM,sBAAsB,EAAE,CAAC;IAC/B,UAAU,CAAC,gBAAgB,CAAC,IAAI,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAE3D,OAAO,cAAc,CAAC;AACvB,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAgB;IACvC,MAAM,cAAc,GAAG,UAAU,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC3D,IAAI,cAAc;QAAE,MAAM,IAAI,WAAW,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;IAElE,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,SAAS;QACrD,MAAM,IAAI,WAAW,CAAC,cAAc,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAElG,MAAM,cAAc,GAAG,MAAM,aAAa,CAAC;QAC1C,KAAK,EAAE,UAAU;QACjB,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;KAC5B,CAAC,CAAC;IAEH,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC7B,MAAM,sBAAsB,EAAE,CAAC;IAC/B,UAAU,CAAC,gBAAgB,CAAC,IAAI,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,OAAO,GAAG,IAAI,CAAC,QAAQ,uBAAuB,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAI;IAC3B,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC7B,OAAO,oCAAoC,CAAC;IAC7C,CAAC;IAED,IAAI,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,QAAQ,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC;QACxC,MAAM,EAAE,QAAQ;QAChB,KAAK,EAAE,UAAU;QACjB,WAAW,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,cAAc,EAAE,CAAC,GAAG,CAAC;KACrB,CAAC,CAAC;IAEH,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IACxB,OAAO,IAAI,CAAC,QAAQ,CAAC;IACrB,OAAO,IAAI,CAAC,aAAa,CAAC;IAC1B,OAAO,IAAI,CAAC,IAAI,CAAC;IACjB,OAAO,IAAI,CAAC,aAAa,CAAC;IAE1B,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,iBAAiB;IAC/B,MAAM,QAAQ,GAAG,MAAM,SAAS,EAAE,CAAC;IACnC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QACzB,OAAO,IAAI,CAAC,QAAQ,CAAC;QACrB,OAAO,IAAI,CAAC,IAAI,CAAC;QACjB,OAAO,IAAI,CAAC,aAAa,CAAC;QAC1B,OAAO,IAAI,CAAC,aAAa,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,SAAS;IACvB,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC;QACxC,MAAM,EAAE,QAAQ;QAChB,KAAK,EAAE,UAAU;QACjB,KAAK,EAAE,GAAG;QACV,SAAS,EAAE,MAAM;QACjB,cAAc,EAAE,CAAC,GAAG,CAAC;KACrB,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,EAAE,CAAC;IACtB,KAAK,IAAI,IAAI,IAAI,KAAK,EAAE,CAAC;QACxB,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC;QACxC,MAAM,EAAE,QAAQ;QAChB,KAAK,EAAE,UAAU;QACjB,KAAK,EAAE,GAAG;QACV,SAAS,EAAE,UAAU;QACrB,cAAc,EAAE,CAAC,GAAG,CAAC;KACrB,CAAC,CAAC;IAEH,MAAM,OAAO,GAAsB,IAAI,GAAG,EAAE,CAAC;IAC7C,KAAK,IAAI,IAAI,IAAI,KAAK,EAAE,CAAC;QACxB,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,OAAO,OAAO,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,SAAS,wBAAwB,CAAC,QAAkB;IACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;QACzC,OAAO;IACR,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;QACjC,QAAQ,CAAC,UAAU,CAAC,MAAM,GAAG;YAC5B,MAAM,EAAE,EAAE;SACV,CAAC;IACH,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACxC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;IACxC,CAAC;IACD,KAAK,IAAI,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7C,IAAI,OAAO,GAAG;YACb,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU;YACtC,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,KAAK;YACb,qBAAqB,EAAE,EAAE;SACzB,CAAC;QAEF,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC;IACpD,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,SAAS,4BAA4B,CAAC,QAAkB;IACvD,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU;QAAE,OAAO;IAC9C,QAAQ,CAAC,UAAU,CAAC,mBAAmB,GAAG,qBAAqB,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AACjG,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,KAAK,GAAG,SAAS;IACtD,IAAI,KAAK;QAAE,iBAAiB,GAAG,KAAK,CAAC;;QAChC,iBAAiB,GAAG,MAAM,SAAS,EAAE,CAAC;AAC5C,CAAC;AAED,KAAK,UAAU,sBAAsB;IACpC,IAAI,CAAC,iBAAiB;QAAE,MAAM,sBAAsB,EAAE,CAAC;IACvD,OAAO,iBAAiB,CAAC;AAC1B,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,mBAAmB,CAAC,QAAgB,EAAE,EAAkB,EAAE,gBAAgB,GAAG,IAAI;IAC/F,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACxB,MAAM,sBAAsB,EAAE,CAAC;IAChC,CAAC;IAED,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,IAAI,CAAC,gBAAgB;YAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;QAC3C,MAAM,IAAI,WAAW,CAAC,yBAAyB,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC;IACpG,CAAC;IAED,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM;QAC7B,MAAM,IAAI,WAAW,CAAC,yBAAyB,CAAC,aAAa,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAEhG,MAAM,IAAI,GAAS;QAClB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC1B,CAAC;IACF,IAAI,OAAO,CAAC,aAAa;QAAE,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IACtE,4EAA4E;IAC5E,yFAAyF;IACzF,wFAAwF;IACxF,IAAI,OAAO,CAAC,IAAI;QAAE,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;IAE9F,IAAI,gBAAgB,KAAK,IAAI,EAAE,CAAC;QAC/B,gEAAgE;QAChE,IAAI,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,OAAO,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAChE,mCAAmC;aAC9B,CAAC;YACL,IAAI,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,EAAE,OAAO,CAAC,aAAa,IAAI,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,2CAA2C;YACzJ,mEAAmE;YACnE,IAAI,SAAS,EAAE,IAAI;gBAAE,SAAS,GAAG,MAAM,SAAS,CAAC;YACjD,IAAI,SAAS,KAAK,IAAI;gBAAE,iBAAiB,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;;gBAC/D,MAAM,IAAI,WAAW,CAAC,yBAAyB,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC;QACzG,CAAC;IACF,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,KAAK,UAAU,YAAY;IAC1B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACxB,MAAM,sBAAsB,EAAE,CAAC;IAChC,CAAC;IACD,KAAK,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,iBAAiB,EAAE,CAAC;QACxC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,YAAY;YAAE,OAAO,IAAI,CAAC;IAClD,CAAC;AACF,CAAC;AAED,IAAI,mBAAmB,GAAG,EAAE,CAAC;AAC7B,MAAM,CAAC,cAAc,GAAG,UAAU,IAAgB;IACjD,KAAK,IAAI,QAAQ,IAAI,mBAAmB,EAAE,CAAC;QAC1C,IAAI,CAAC;YACJ,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,YAAY,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;QACtD,CAAC;IACF,CAAC;AACF,CAAC,CAAC;AAEF,MAAM,CAAC,iBAAiB,GAAG,UAAU,QAAQ;IAC5C,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACpC,CAAC,CAAC"}