@harperfast/harper 5.2.10 → 5.3.0-alpha.1

package/dist/security/tokenAuthentication.js

@@ -40,6 +40,7 @@ exports.getJWTRSAKeys = getJWTRSAKeys;
 exports.clearJWTRSAKeysCache = clearJWTRSAKeysCache;
 exports.createTokens = createTokens;
 exports.refreshOperationToken = refreshOperationToken;
+exports.createOperationToken = createOperationToken;
 exports.validateOperationToken = validateOperationToken;
 exports.validateRefreshToken = validateRefreshToken;
 exports.validateLoginToken = validateLoginToken;
@@ -56,6 +57,11 @@ const { HTTP_STATUS_CODES, AUTHENTICATION_ERROR_MSGS } = hdbError_ts_1.hdbErrors
 const harper_logger_ts_1 = __importDefault(require("../utility/logging/harper_logger.js"));
 const password = __importStar(require("../utility/password.js"));
 const user_ts_1 = require("./user.js");
+const operationScope_ts_1 = require("./operationScope.js");
+const credentialProvenance_ts_1 = require("./credentialProvenance.js");
+const impersonation_ts_1 = require("./impersonation.js");
+const credentialRejection_ts_1 = require("./credentialRejection.js");
+const operationPermissions_ts_1 = require("../utility/operationPermissions.js");
 const insert_ts_1 = require("../dataLayer/insert.js");
 const UpdateObject_ts_1 = __importDefault(require("../dataLayer/UpdateObject.js"));
 const signalling = __importStar(require("../utility/signalling.js"));
@@ -78,6 +84,10 @@ const TOKEN_TYPE = {
     // TOKEN_TYPE.OPERATION, so validateOperationToken's Bearer-API path rejects it automatically —
     // it can't be replayed as a general API credential the way a full operation token could.
     LOGIN: 'login',
+    // Minted by createTokens with an inline `role` object (super_user-gated): the token embeds its
+    // own downgraded permission set and its bearer needs no hdb_user row. Accepted by
+    // validateOperationToken, which builds a synthetic user from the embedded role.
+    SCOPED: 'scoped-operation',
 };
 /**
  * fetches the rsa keys from cache var or disk
@@ -134,12 +144,39 @@ async function createTokens(authObj) {
     const validation = (0, validationWrapper_ts_1.validateBySchema)(authObj, joi_1.default.object({
         username: joi_1.default.string().optional(),
         password: joi_1.default.string().optional(),
-        role: joi_1.default.string().optional(),
+        role: joi_1.default.alternatives(joi_1.default.string(), joi_1.default.object()).optional(),
         expires_in: joi_1.default.alternatives(joi_1.default.string(), joi_1.default.number()).optional(),
         purpose: joi_1.default.string().valid('login').optional(),
     }));
     if (validation)
         throw new hdbError_ts_1.ClientError(validation.message);
+    // create_authentication_tokens is NO_AUTH, so verifyPerms — and the token-scope gate inside it —
+    // never runs here. A caller holding a workload-identity token (#2171) must not mint any standing
+    // credential through it: honoring expires_in verbatim turns a minutes-long leak into an
+    // arbitrarily long-lived one, and the refresh_token write below hands out a 30-day credential —
+    // both defeating the exchange's ephemerality guarantee. A CI token needs none of this; it already
+    // holds the operation token the exchange gave it, and gets a fresh one next run.
+    //
+    // Gated on provenance, NOT on the scope: a trust policy carries `operations` only when the
+    // operator opts in, so the ordinary exchanged token is unscoped and a scope-only check would let
+    // exactly the common case through. The scope check stays as well, covering a scoped credential
+    // from any other source.
+    //
+    // First, ahead of the user lookup and the `purpose` branch: this reads only the caller's own
+    // principal, so a refused request should cost no database read and write nothing. That also
+    // covers the login path, where a session is minted from a username alone and so cannot be
+    // narrowed after the fact.
+    // `authObj?.` — a bare createTokens() reaches here, and must still fail as invalid credentials
+    // below rather than as a TypeError out of this guard.
+    if ((0, credentialProvenance_ts_1.isWorkloadIdentityPrincipal)(authObj?.hdb_user)) {
+        throw new hdbError_ts_1.ClientError('a workload identity token cannot mint authentication tokens', HTTP_STATUS_CODES.FORBIDDEN);
+    }
+    if ((0, operationScope_ts_1.hasOperationScope)(authObj?.hdb_user?.tokenOperations)) {
+        throw new hdbError_ts_1.ClientError('a scoped token cannot mint authentication tokens', HTTP_STATUS_CODES.FORBIDDEN);
+    }
+    if (authObj?.role && typeof authObj.role === 'object') {
+        return createScopedToken(authObj);
+    }
     let user;
     try {
         // Trusted bypass is dispatch/async-context state (set by a component calling
@@ -148,6 +185,12 @@ async function createTokens(authObj) {
         // without a password (see operationAuthorizationState.ts).
         let validatePassword = !(0, operationAuthorizationState_ts_1.isOperationAuthorizationBypassed)();
         if (!authObj.username && !authObj.password) {
+            // A scoped-token bearer must not self-mint: its username is an unverified attribution
+            // label, and resolving it here without a password would hand out standing operation/
+            // refresh tokens for whatever real user later takes that name (privilege escalation).
+            if (authObj.hdb_user?._scopedToken) {
+                throw new hdbError_ts_1.ClientError(AUTHENTICATION_ERROR_MSGS.INVALID_CREDENTIALS, HTTP_STATUS_CODES.UNAUTHORIZED);
+            }
             // if the username and password are not provided, use the hdb_user making the request.
             authObj.username = authObj.hdb_user?.username;
             // the password would have been checked by authHandler before getting here
@@ -202,6 +245,43 @@ async function createTokens(authObj) {
         refresh_token: refreshToken,
     };
 }
+/**
+ * Mints a scoped token: a single operation-usable JWT that embeds an inline role object, so its
+ * bearer needs no hdb_user or hdb_role row. Requires an authenticated super_user minter (or
+ * trusted internal dispatch). `username` is attribution only, must NOT name an existing user,
+ * and defaults to `scoped:<minter>`. No refresh token is issued and no user record is touched,
+ * so the token is irrevocable until expiry — size expires_in accordingly.
+ */
+// Measured on the signed token (base64url payload + signature), so it reflects what the
+// Authorization header actually carries; keeps tokens inside common 16KB header limits.
+const MAX_SCOPED_TOKEN_LENGTH = 12288;
+async function createScopedToken(authObj) {
+    if (authObj.password) {
+        throw new hdbError_ts_1.ClientError("'password' cannot be combined with an inline 'role' object");
+    }
+    if (authObj.purpose) {
+        throw new hdbError_ts_1.ClientError("'purpose' cannot be combined with an inline 'role' object");
+    }
+    const scopedUser = await (0, impersonation_ts_1.buildScopedTokenUser)(authObj.hdb_user, { username: authObj.username, role: authObj.role }, (0, operationAuthorizationState_ts_1.isOperationAuthorizationBypassed)());
+    const keys = await getJWTRSAKeys();
+    const operationToken = jsonwebtoken_1.default.sign({
+        username: scopedUser.username,
+        super_user: false,
+        role: { permission: scopedUser.role.permission },
+        minted_by: authObj.hdb_user?.username,
+    }, { key: keys.privateKey, passphrase: keys.passphrase }, {
+        expiresIn: (authObj.expires_in ?? OPERATION_TOKEN_TIMEOUT),
+        algorithm: RSA_ALGORITHM,
+        subject: TOKEN_TYPE.SCOPED,
+    });
+    if (operationToken.length > MAX_SCOPED_TOKEN_LENGTH) {
+        throw new hdbError_ts_1.ClientError(`the minted token exceeds ${MAX_SCOPED_TOKEN_LENGTH} bytes and would not fit in an Authorization header; reduce the role permission size`);
+    }
+    // role.role is the content hash of the granted permission set — logged so an operator can
+    // correlate outstanding tokens with what they grant.
+    harper_logger_ts_1.default.info(`Scoped token minted by "${authObj.hdb_user?.username ?? '<internal>'}" for "${scopedUser.username}" (${scopedUser.role.role})`);
+    return { operation_token: operationToken };
+}
 /**
  * Refreshes the operation token using the refresh token.
  * @param tokenObj
@@ -214,13 +294,49 @@ async function refreshOperationToken(tokenObj) {
     await validateRefreshToken(refresh_token);
     const keys = await getJWTRSAKeys();
     const decodedJWT = jsonwebtoken_1.default.decode(refresh_token, { json: true });
-    const operationToken = jsonwebtoken_1.default.sign({ username: decodedJWT.username, super_user: decodedJWT.super_user }, { key: keys.privateKey, passphrase: keys.passphrase }, {
+    const refreshedPayload = {
+        username: decodedJWT.username,
+        super_user: decodedJWT.super_user,
+    };
+    // Refreshing a scoped refresh token must not widen back to the full role.
+    (0, operationScope_ts_1.attachScopeToToken)(refreshedPayload, decodedJWT.operations);
+    const operationToken = jsonwebtoken_1.default.sign(refreshedPayload, { key: keys.privateKey, passphrase: keys.passphrase }, {
         expiresIn: OPERATION_TOKEN_TIMEOUT,
         algorithm: RSA_ALGORITHM,
         subject: TOKEN_TYPE.OPERATION,
     });
     return { operation_token: operationToken };
 }
+/**
+ * Signs a standalone operation token. No refresh token, no write to the user record.
+ *
+ * createTokens cannot serve this: it overwrites hdb_user.refresh_token as a side effect, silently
+ * revoking whatever credential that user already held (#2018). The OIDC exchange (#2171) exists so
+ * CI holds no durable credential at all, so minting one on its behalf would defeat the point.
+ *
+ * The caller is responsible for having established that the user exists, is active, and is entitled
+ * to this token — nothing here re-checks that.
+ */
+async function createOperationToken(user, expiresIn) {
+    const keys = await getJWTRSAKeys();
+    const payload = {
+        username: user.username,
+        super_user: user.super_user,
+    };
+    // A narrowing scope, never a grant: verifyPerms intersects it with the user's role. An empty scope
+    // (deny-all) is preserved rather than dropped — attachScopeToToken carries any array, which is
+    // what keeps this from failing open.
+    (0, operationScope_ts_1.attachScopeToToken)(payload, user.operations);
+    // Unconditional, because every token this function mints is minted without a password — the
+    // caller vouched for the user instead. That is precisely the credential that must not be able to
+    // trade itself for a longer-lived one, whether or not a scope narrows it.
+    (0, credentialProvenance_ts_1.markTokenAsWorkloadIdentity)(payload);
+    return jsonwebtoken_1.default.sign(payload, { key: keys.privateKey, passphrase: keys.passphrase }, {
+        expiresIn,
+        algorithm: RSA_ALGORITHM,
+        subject: TOKEN_TYPE.OPERATION,
+    });
+}
 async function validateOperationToken(token) {
     return validateToken(token, TOKEN_TYPE.OPERATION);
 }
@@ -238,29 +354,94 @@ async function validateLoginToken(token) {
 async function validateToken(token, tokenType) {
     try {
         const keys = await getJWTRSAKeys();
-        const tokenVerified = jsonwebtoken_1.default.verify(token, keys.publicKey, {
-            algorithms: [RSA_ALGORITHM],
-            subject: tokenType,
-        });
+        assertUsableVerificationKey(keys.publicKey);
+        // The OPERATION type also accepts scoped tokens, so the subject is checked after
+        // verification rather than pinned in the verify options.
+        const tokenVerified = jsonwebtoken_1.default.verify(token, keys.publicKey, tokenType === TOKEN_TYPE.OPERATION
+            ? { algorithms: [RSA_ALGORITHM] }
+            : { algorithms: [RSA_ALGORITHM], subject: tokenType });
+        if (tokenType === TOKEN_TYPE.OPERATION && tokenVerified.sub === TOKEN_TYPE.SCOPED) {
+            return buildUserFromScopedToken(tokenVerified);
+        }
+        if (tokenVerified.sub !== tokenType) {
+            throw (0, credentialRejection_ts_1.credentialRejectionError)(AUTHENTICATION_ERROR_MSGS.INVALID_TOKEN, HTTP_STATUS_CODES.UNAUTHORIZED);
+        }
         // If a role is present, it means the token is not an operation token. The validation of
         // the token will happen in the respective function/component that uses the token.
         if (tokenVerified.role) {
-            throw new Error('Invalid token');
+            throw (0, credentialRejection_ts_1.credentialRejectionError)(AUTHENTICATION_ERROR_MSGS.INVALID_TOKEN, HTTP_STATUS_CODES.UNAUTHORIZED);
         }
         const user = await (0, user_ts_1.findAndValidateUser)(tokenVerified.username, undefined, false);
         if (tokenType === TOKEN_TYPE.REFRESH && !password.validate(user.refresh_token, token)) {
-            throw new Error('Invalid token');
+            throw (0, credentialRejection_ts_1.credentialRejectionError)(AUTHENTICATION_ERROR_MSGS.INVALID_TOKEN, HTTP_STATUS_CODES.UNAUTHORIZED);
         }
+        // Surfaced as `tokenOperations` rather than merged into role.permission.operations: that field
+        // is not purely narrowing (verifyPerms gate 2 treats an explicit SU-only listing as a grant),
+        // so merging a token scope into it could widen. verifyPerms intersects this separately, ahead
+        // of every bypass.
+        (0, operationScope_ts_1.attachScopeToUser)(user, tokenVerified.operations);
+        // Provenance rides the same lift: the claim is signed, so a caller cannot strip it to look
+        // like a password-minted principal at createTokens.
+        (0, credentialProvenance_ts_1.attachWorkloadIdentityToUser)(user, tokenVerified[credentialProvenance_ts_1.WORKLOAD_IDENTITY_CLAIM]);
         return user;
     }
     catch (err) {
         harper_logger_ts_1.default.warn(err);
         if (err?.name === 'TokenExpiredError') {
-            throw new hdbError_ts_1.ClientError(AUTHENTICATION_ERROR_MSGS.TOKEN_EXPIRED, HTTP_STATUS_CODES.FORBIDDEN);
+            throw (0, credentialRejection_ts_1.credentialRejectionError)(AUTHENTICATION_ERROR_MSGS.TOKEN_EXPIRED, HTTP_STATUS_CODES.FORBIDDEN);
         }
-        throw new hdbError_ts_1.ClientError(AUTHENTICATION_ERROR_MSGS.INVALID_TOKEN, HTTP_STATUS_CODES.UNAUTHORIZED);
+        // Only positively classified token failures may cross the route-ownership boundary as rejections.
+        if (!isTokenRejection(err))
+            throw err;
+        throw (0, credentialRejection_ts_1.credentialRejectionError)(AUTHENTICATION_ERROR_MSGS.INVALID_TOKEN, HTTP_STATUS_CODES.UNAUTHORIZED);
+    }
+}
+const JWT_REJECTION_ERROR_NAMES = new Set(['JsonWebTokenError', 'NotBeforeError', 'TokenExpiredError']);
+// jsonwebtoken reports unusable verification keys and bad tokens through the same error type.
+const KEY_MATERIAL_FAULT = /secretOrPublicKey|asymmetric key|PEM routines|^error:/i;
+function isTokenRejection(err) {
+    if ((0, credentialRejection_ts_1.isCredentialRejection)(err))
+        return true;
+    if (!JWT_REJECTION_ERROR_NAMES.has(err?.name))
+        return false;
+    return !KEY_MATERIAL_FAULT.test(String(err?.message ?? ''));
+}
+function assertUsableVerificationKey(publicKey) {
+    if (typeof publicKey !== 'string' || !publicKey.includes('-----BEGIN')) {
+        throw new hdbError_ts_1.ServerError(AUTHENTICATION_ERROR_MSGS.NO_ENCRYPTION_KEYS, HTTP_STATUS_CODES.INTERNAL_SERVER_ERROR);
     }
 }
+/**
+ * Builds the request user for a verified scoped token from its embedded role. No hdb_user lookup:
+ * the signed claims are the whole identity. The downgrade is re-applied here as defense-in-depth,
+ * so no scoped token — whatever minted it — can ever assert super_user or cluster_user.
+ */
+function buildUserFromScopedToken(claims) {
+    const embedded = claims.role?.permission;
+    if (!embedded || typeof embedded !== 'object' || Array.isArray(embedded) || typeof claims.username !== 'string') {
+        throw (0, credentialRejection_ts_1.credentialRejectionError)(AUTHENTICATION_ERROR_MSGS.INVALID_TOKEN, HTTP_STATUS_CODES.UNAUTHORIZED);
+    }
+    const permission = { ...embedded, super_user: false, cluster_user: false };
+    // Hashed from the server-side downgraded clone (before the _expandedOperations Set is attached),
+    // so the memo key reflects the effective permissions — see syntheticRoleName.
+    const roleName = (0, impersonation_ts_1.syntheticRoleName)('_scoped_token', permission);
+    if (Array.isArray(permission.operations)) {
+        permission._expandedOperations = (0, operationPermissions_ts_1.expandOperationsPerms)(permission.operations);
+    }
+    return {
+        username: claims.username,
+        active: true,
+        _scopedToken: true,
+        _mintedBy: claims.minted_by,
+        role: {
+            permission: permission,
+            role: roleName,
+            id: roleName,
+            __updatedtime__: 0,
+            __createdtime__: 0,
+        },
+    };
+}
 /**
  * Decodes a JWT and returns its payload.
  * @param {string} token The JWT token to decode.

package/dist/security/tokenAuthentication.js.map

@@ -1 +1 @@
-{"version":3,"file":"tokenAuthentication.js","sourceRoot":"","sources":["../../security/tokenAuthentication.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkFA,sCAiBC;AAUD,oDAGC;AAUD,oCAmGC;AAMD,sDAmBC;AAED,wDAEC;AAED,oDAEC;AAOD,gDAEC;AAqCD,8BAUC;AAKD,oCAKC;AAhUD,gEAAmG;AACnG,wDAA0B;AAC1B,0DAA6B;AAC7B,8CAAsB;AACtB,6EAAsE;AACtE,wDAMgC;AAChC,+DAAuE;AACvE,MAAM,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,GAAG,uBAAS,CAAC;AACnE,2FAAyD;AACzD,iEAAmD;AACnD,uCAA2D;AAC3D,sDAAgD;AAChD,mFAAwD;AACxD,qEAAuD;AACvD,2GAA0G;AAC1G,qDAAwD;AACxD,kFAAoE;AACpE,GAAG,CAAC,QAAQ,EAAE,CAAC;AAGf,MAAM,uBAAuB,GAAgB,GAAG,CAAC,GAAG,CAAC,2BAAa,CAAC,oCAAoC,CAAC,IAAI,IAAI,CAAC;AACjH,MAAM,qBAAqB,GAAgB,GAAG,CAAC,GAAG,CAAC,2BAAa,CAAC,kCAAkC,CAAC,IAAI,KAAK,CAAC;AAC9G,+FAA+F;AAC/F,kGAAkG;AAClG,iCAAiC;AACjC,MAAM,mBAAmB,GAAgB,IAAI,CAAC;AAC9C,MAAM,aAAa,GAAc,OAAO,CAAC;AAEzC,MAAM,UAAU,GAAG;IAClB,SAAS,EAAE,WAAW;IACtB,OAAO,EAAE,SAAS;IAClB,+FAA+F;IAC/F,8EAA8E;IAC9E,+FAA+F;IAC/F,yFAAyF;IACzF,KAAK,EAAE,OAAO;CACd,CAAC;AA8BF;;;GAGG;AACH,IAAI,OAAO,GAA2B,SAAS,CAAC;AAChD,qGAAqG;AACrG,sGAAsG;AACtG,gGAAgG;AAChG,qDAAqD;AACrD,IAAI,iBAAiB,GAAG,CAAC,CAAC;AACnB,KAAK,UAAU,aAAa;IAClC,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,MAAM,UAAU,GAAW,iBAAiB,CAAC;IAC7C,IAAI,CAAC;QACJ,MAAM,OAAO,GAAW,mBAAI,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,kCAAoB,CAAC,CAAC;QAC9E,MAAM,UAAU,GAAW,MAAM,kBAAE,CAAC,QAAQ,CAAC,mBAAI,CAAC,IAAI,CAAC,OAAO,EAAE,sBAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC,CAAC;QACvG,MAAM,UAAU,GAAW,MAAM,kBAAE,CAAC,QAAQ,CAAC,mBAAI,CAAC,IAAI,CAAC,OAAO,EAAE,sBAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC,CAAC;QACxG,MAAM,SAAS,GAAW,MAAM,kBAAE,CAAC,QAAQ,CAAC,mBAAI,CAAC,IAAI,CAAC,OAAO,EAAE,sBAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC,CAAC;QACtG,MAAM,IAAI,GAAe,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;QAC/D,mGAAmG;QACnG,+FAA+F;QAC/F,IAAI,UAAU,KAAK,iBAAiB;YAAE,OAAO,GAAG,IAAI,CAAC;QACrD,OAAO,IAAI,CAAC;IACb,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,0BAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAClB,MAAM,IAAI,yBAAW,CAAC,yBAAyB,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;IAC9G,CAAC;AACF,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,oBAAoB;IACnC,iBAAiB,EAAE,CAAC;IACpB,OAAO,GAAG,SAAS,CAAC;AACrB,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,YAAY,CAAC,OAAmB;IACrD,MAAM,UAAU,GAAQ,IAAA,uCAAgB,EACvC,OAAO,EACP,aAAG,CAAC,MAAM,CAAC;QACV,QAAQ,EAAE,aAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACjC,QAAQ,EAAE,aAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACjC,IAAI,EAAE,aAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC7B,UAAU,EAAE,aAAG,CAAC,YAAY,CAAC,aAAG,CAAC,MAAM,EAAE,EAAE,aAAG,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QACnE,OAAO,EAAE,aAAG,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE;KAC/C,CAAC,CACF,CAAC;IACF,IAAI,UAAU;QAAE,MAAM,IAAI,yBAAW,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAE1D,IAAI,IAAS,CAAC;IACd,IAAI,CAAC;QACJ,6EAA6E;QAC7E,6EAA6E;QAC7E,+EAA+E;QAC/E,2DAA2D;QAC3D,IAAI,gBAAgB,GAAY,CAAC,IAAA,iEAAgC,GAAE,CAAC;QACpE,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC5C,sFAAsF;YACtF,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC;YAC9C,0EAA0E;YAC1E,gBAAgB,GAAG,KAAK,CAAC;QAC1B,CAAC;QACD,IAAI,GAAG,MAAM,IAAA,6BAAmB,EAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IACxF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,0BAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAClB,MAAM,IAAI,yBAAW,CAAC,yBAAyB,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC;IACtG,CAAC;IACD,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,yBAAW,CAAC,yBAAyB,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAEhH,IAAI,SAAS,GAAY,KAAK,CAAC;IAC/B,IAAI,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC;QAC3B,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,KAAK,IAAI,CAAC;IACtD,CAAC;IAED,MAAM,OAAO,GAIT,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IAC1D,IAAI,OAAO,CAAC,IAAI;QAAE,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAE9C,MAAM,IAAI,GAAe,MAAM,aAAa,EAAE,CAAC;IAE/C,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QACjC,yFAAyF;QACzF,6FAA6F;QAC7F,MAAM,UAAU,GAAG,sBAAG,CAAC,IAAI,CAC1B,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,EAC9B,EAAE,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAmB,EACtE;YACC,SAAS,EAAE,CAAC,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAgB;YACrE,SAAS,EAAE,aAAa;YACxB,OAAO,EAAE,UAAU,CAAC,KAAK;SACH,CACvB,CAAC;QACF,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;IACxC,CAAC;IAED,MAAM,cAAc,GAAG,sBAAG,CAAC,IAAI,CAC9B,OAAO,EACP,EAAE,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAmB,EACtE;QACC,SAAS,EAAE,CAAC,OAAO,CAAC,UAAU,IAAI,uBAAuB,CAAgB;QACzE,SAAS,EAAE,aAAa;QACxB,OAAO,EAAE,UAAU,CAAC,SAAS;KACP,CACvB,CAAC;IAEF,MAAM,YAAY,GAAG,sBAAG,CAAC,IAAI,CAC5B,OAAO,EACP,EAAE,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAmB,EACtE;QACC,SAAS,EAAE,qBAAqB;QAChC,SAAS,EAAE,aAAa;QACxB,OAAO,EAAE,UAAU,CAAC,OAAO;KACL,CACvB,CAAC;IAEF,gCAAgC;IAChC,MAAM,WAAW,GAA6B,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACzG,MAAM,YAAY,GAAQ,MAAM,IAAA,kBAAM,EACrC,IAAI,yBAAY,CAAC,gCAAkB,EAAE,gCAAkB,CAAC,eAAe,EAAE;QACxE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE;KAC1D,CAAC,CACF,CAAC;IAEF,IAAI,YAAY,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;QACzC,MAAM,IAAI,yBAAW,CAAC,yBAAyB,CAAC,yBAAyB,EAAE,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;IAErH,UAAU,CAAC,gBAAgB,CAAC,IAAI,qBAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAE3D,OAAO;QACN,eAAe,EAAE,cAAc;QAC/B,aAAa,EAAE,YAAY;KAC3B,CAAC;AACH,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,qBAAqB,CAAC,QAAqB;IAChE,MAAM,UAAU,GAAQ,IAAA,uCAAgB,EAAC,QAAQ,EAAE,aAAG,CAAC,MAAM,CAAC,EAAE,aAAa,EAAE,aAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IACtH,IAAI,UAAU;QAAE,MAAM,IAAI,yBAAW,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,EAAE,aAAa,EAAE,GAAG,QAAQ,CAAC;IACnC,MAAM,oBAAoB,CAAC,aAAa,CAAC,CAAC;IAE1C,MAAM,IAAI,GAAe,MAAM,aAAa,EAAE,CAAC;IAC/C,MAAM,UAAU,GAAG,sBAAG,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,MAAM,cAAc,GAAG,sBAAG,CAAC,IAAI,CAC9B,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE,EACpE,EAAE,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAmB,EACtE;QACC,SAAS,EAAE,uBAAsC;QACjD,SAAS,EAAE,aAAa;QACxB,OAAO,EAAE,UAAU,CAAC,SAAS;KACP,CACvB,CAAC;IAEF,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC;AAC5C,CAAC;AAEM,KAAK,UAAU,sBAAsB,CAAC,KAAa;IACzD,OAAO,aAAa,CAAC,KAAK,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;AACnD,CAAC;AAEM,KAAK,UAAU,oBAAoB,CAAC,KAAa;IACvD,OAAO,aAAa,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,kBAAkB,CAAC,KAAa;IACrD,OAAO,aAAa,CAAC,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,KAAa,EAAE,SAAiB;IAC5D,IAAI,CAAC;QACJ,MAAM,IAAI,GAAe,MAAM,aAAa,EAAE,CAAC;QAC/C,MAAM,aAAa,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE;YACvD,UAAU,EAAE,CAAC,aAAa,CAAC;YAC3B,OAAO,EAAE,SAAS;SAClB,CAAe,CAAC;QAEjB,wFAAwF;QACxF,kFAAkF;QAClF,IAAI,aAAa,CAAC,IAAI,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QAClC,CAAC;QAED,MAAM,IAAI,GAAQ,MAAM,IAAA,6BAAmB,EAAC,aAAa,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QACtF,IAAI,SAAS,KAAK,UAAU,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,EAAE,CAAC;YACvF,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QAClC,CAAC;QAED,OAAO,IAAI,CAAC;IACb,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,0BAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjB,IAAI,GAAG,EAAE,IAAI,KAAK,mBAAmB,EAAE,CAAC;YACvC,MAAM,IAAI,yBAAW,CAAC,yBAAyB,CAAC,aAAa,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC7F,CAAC;QAED,MAAM,IAAI,yBAAW,CAAC,yBAAyB,CAAC,aAAa,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAChG,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,SAAgB,SAAS,CAAC,KAAa;IACtC,IAAI,CAAC;QACJ,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACpC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChE,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED;;GAEG;AACH,SAAgB,YAAY,CAAC,KAAa,EAAE,aAAa,GAAG,GAAG;IAC9D,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,OAAO,OAAO,CAAC,GAAG,GAAG,GAAG,GAAG,aAAa,CAAC;AAC1C,CAAC"}
+{"version":3,"file":"tokenAuthentication.js","sourceRoot":"","sources":["../../security/tokenAuthentication.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoGA,sCAiBC;AAUD,oDAGC;AAUD,oCAsIC;AAyDD,sDAyBC;AAYD,oDA2BC;AAED,wDAEC;AAED,oDAEC;AAOD,gDAEC;AA6GD,8BAUC;AAKD,oCAKC;AA7hBD,gEAAmG;AACnG,wDAA0B;AAC1B,0DAA6B;AAC7B,8CAAsB;AACtB,6EAAsE;AACtE,wDAMgC;AAChC,+DAAoF;AACpF,MAAM,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,GAAG,uBAAS,CAAC;AACnE,2FAAyD;AACzD,iEAAmD;AACnD,uCAA2D;AAC3D,2DAA+F;AAC/F,uEAKmC;AACnC,yDAA6E;AAC7E,qEAA2F;AAE3F,gFAA2E;AAC3E,sDAAgD;AAChD,mFAAwD;AACxD,qEAAuD;AACvD,2GAA0G;AAC1G,qDAAwD;AACxD,kFAAoE;AACpE,GAAG,CAAC,QAAQ,EAAE,CAAC;AAGf,MAAM,uBAAuB,GAAgB,GAAG,CAAC,GAAG,CAAC,2BAAa,CAAC,oCAAoC,CAAC,IAAI,IAAI,CAAC;AACjH,MAAM,qBAAqB,GAAgB,GAAG,CAAC,GAAG,CAAC,2BAAa,CAAC,kCAAkC,CAAC,IAAI,KAAK,CAAC;AAC9G,+FAA+F;AAC/F,kGAAkG;AAClG,iCAAiC;AACjC,MAAM,mBAAmB,GAAgB,IAAI,CAAC;AAC9C,MAAM,aAAa,GAAc,OAAO,CAAC;AAEzC,MAAM,UAAU,GAAG;IAClB,SAAS,EAAE,WAAW;IACtB,OAAO,EAAE,SAAS;IAClB,+FAA+F;IAC/F,8EAA8E;IAC9E,+FAA+F;IAC/F,yFAAyF;IACzF,KAAK,EAAE,OAAO;IACd,+FAA+F;IAC/F,kFAAkF;IAClF,gFAAgF;IAChF,MAAM,EAAE,kBAAkB;CAC1B,CAAC;AAiCF;;;GAGG;AACH,IAAI,OAAO,GAA2B,SAAS,CAAC;AAChD,qGAAqG;AACrG,sGAAsG;AACtG,gGAAgG;AAChG,qDAAqD;AACrD,IAAI,iBAAiB,GAAG,CAAC,CAAC;AACnB,KAAK,UAAU,aAAa;IAClC,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,MAAM,UAAU,GAAW,iBAAiB,CAAC;IAC7C,IAAI,CAAC;QACJ,MAAM,OAAO,GAAW,mBAAI,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,kCAAoB,CAAC,CAAC;QAC9E,MAAM,UAAU,GAAW,MAAM,kBAAE,CAAC,QAAQ,CAAC,mBAAI,CAAC,IAAI,CAAC,OAAO,EAAE,sBAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC,CAAC;QACvG,MAAM,UAAU,GAAW,MAAM,kBAAE,CAAC,QAAQ,CAAC,mBAAI,CAAC,IAAI,CAAC,OAAO,EAAE,sBAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC,CAAC;QACxG,MAAM,SAAS,GAAW,MAAM,kBAAE,CAAC,QAAQ,CAAC,mBAAI,CAAC,IAAI,CAAC,OAAO,EAAE,sBAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC,CAAC;QACtG,MAAM,IAAI,GAAe,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;QAC/D,mGAAmG;QACnG,+FAA+F;QAC/F,IAAI,UAAU,KAAK,iBAAiB;YAAE,OAAO,GAAG,IAAI,CAAC;QACrD,OAAO,IAAI,CAAC;IACb,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,0BAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAClB,MAAM,IAAI,yBAAW,CAAC,yBAAyB,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;IAC9G,CAAC;AACF,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,oBAAoB;IACnC,iBAAiB,EAAE,CAAC;IACpB,OAAO,GAAG,SAAS,CAAC;AACrB,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,YAAY,CAAC,OAAmB;IACrD,MAAM,UAAU,GAAQ,IAAA,uCAAgB,EACvC,OAAO,EACP,aAAG,CAAC,MAAM,CAAC;QACV,QAAQ,EAAE,aAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACjC,QAAQ,EAAE,aAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACjC,IAAI,EAAE,aAAG,CAAC,YAAY,CAAC,aAAG,CAAC,MAAM,EAAE,EAAE,aAAG,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QAC7D,UAAU,EAAE,aAAG,CAAC,YAAY,CAAC,aAAG,CAAC,MAAM,EAAE,EAAE,aAAG,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QACnE,OAAO,EAAE,aAAG,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE;KAC/C,CAAC,CACF,CAAC;IACF,IAAI,UAAU;QAAE,MAAM,IAAI,yBAAW,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAE1D,iGAAiG;IACjG,iGAAiG;IACjG,wFAAwF;IACxF,gGAAgG;IAChG,kGAAkG;IAClG,iFAAiF;IACjF,EAAE;IACF,2FAA2F;IAC3F,iGAAiG;IACjG,+FAA+F;IAC/F,yBAAyB;IACzB,EAAE;IACF,6FAA6F;IAC7F,4FAA4F;IAC5F,0FAA0F;IAC1F,2BAA2B;IAC3B,+FAA+F;IAC/F,sDAAsD;IACtD,IAAI,IAAA,qDAA2B,EAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,yBAAW,CAAC,6DAA6D,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;IACnH,CAAC;IACD,IAAI,IAAA,qCAAiB,EAAE,OAAO,EAAE,QAAgB,EAAE,eAAe,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,yBAAW,CAAC,kDAAkD,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;IACxG,CAAC;IAED,IAAI,OAAO,EAAE,IAAI,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACvD,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,IAAS,CAAC;IACd,IAAI,CAAC;QACJ,6EAA6E;QAC7E,6EAA6E;QAC7E,+EAA+E;QAC/E,2DAA2D;QAC3D,IAAI,gBAAgB,GAAY,CAAC,IAAA,iEAAgC,GAAE,CAAC;QACpE,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC5C,sFAAsF;YACtF,qFAAqF;YACrF,sFAAsF;YACtF,IAAI,OAAO,CAAC,QAAQ,EAAE,YAAY,EAAE,CAAC;gBACpC,MAAM,IAAI,yBAAW,CAAC,yBAAyB,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC;YACtG,CAAC;YACD,sFAAsF;YACtF,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC;YAC9C,0EAA0E;YAC1E,gBAAgB,GAAG,KAAK,CAAC;QAC1B,CAAC;QACD,IAAI,GAAG,MAAM,IAAA,6BAAmB,EAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IACxF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,0BAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAClB,MAAM,IAAI,yBAAW,CAAC,yBAAyB,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC;IACtG,CAAC;IACD,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,yBAAW,CAAC,yBAAyB,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAEhH,IAAI,SAAS,GAAY,KAAK,CAAC;IAC/B,IAAI,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC;QAC3B,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,KAAK,IAAI,CAAC;IACtD,CAAC;IAED,MAAM,OAAO,GAIT,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IAC1D,IAAI,OAAO,CAAC,IAAI;QAAE,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAE9C,MAAM,IAAI,GAAe,MAAM,aAAa,EAAE,CAAC;IAE/C,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QACjC,yFAAyF;QACzF,6FAA6F;QAC7F,MAAM,UAAU,GAAG,sBAAG,CAAC,IAAI,CAC1B,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,EAC9B,EAAE,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAmB,EACtE;YACC,SAAS,EAAE,CAAC,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAgB;YACrE,SAAS,EAAE,aAAa;YACxB,OAAO,EAAE,UAAU,CAAC,KAAK;SACH,CACvB,CAAC;QACF,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;IACxC,CAAC;IAED,MAAM,cAAc,GAAG,sBAAG,CAAC,IAAI,CAC9B,OAAO,EACP,EAAE,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAmB,EACtE;QACC,SAAS,EAAE,CAAC,OAAO,CAAC,UAAU,IAAI,uBAAuB,CAAgB;QACzE,SAAS,EAAE,aAAa;QACxB,OAAO,EAAE,UAAU,CAAC,SAAS;KACP,CACvB,CAAC;IAEF,MAAM,YAAY,GAAG,sBAAG,CAAC,IAAI,CAC5B,OAAO,EACP,EAAE,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAmB,EACtE;QACC,SAAS,EAAE,qBAAqB;QAChC,SAAS,EAAE,aAAa;QACxB,OAAO,EAAE,UAAU,CAAC,OAAO;KACL,CACvB,CAAC;IAEF,gCAAgC;IAChC,MAAM,WAAW,GAA6B,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACzG,MAAM,YAAY,GAAQ,MAAM,IAAA,kBAAM,EACrC,IAAI,yBAAY,CAAC,gCAAkB,EAAE,gCAAkB,CAAC,eAAe,EAAE;QACxE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE;KAC1D,CAAC,CACF,CAAC;IAEF,IAAI,YAAY,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;QACzC,MAAM,IAAI,yBAAW,CAAC,yBAAyB,CAAC,yBAAyB,EAAE,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;IAErH,UAAU,CAAC,gBAAgB,CAAC,IAAI,qBAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAE3D,OAAO;QACN,eAAe,EAAE,cAAc;QAC/B,aAAa,EAAE,YAAY;KAC3B,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,wFAAwF;AACxF,wFAAwF;AACxF,MAAM,uBAAuB,GAAG,KAAK,CAAC;AAEtC,KAAK,UAAU,iBAAiB,CAAC,OAAmB;IACnD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACtB,MAAM,IAAI,yBAAW,CAAC,4DAA4D,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,yBAAW,CAAC,2DAA2D,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,IAAA,uCAAoB,EAC5C,OAAO,CAAC,QAAQ,EAChB,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,IAAkC,EAAE,EAChF,IAAA,iEAAgC,GAAE,CAClC,CAAC;IACF,MAAM,IAAI,GAAe,MAAM,aAAa,EAAE,CAAC;IAC/C,MAAM,cAAc,GAAG,sBAAG,CAAC,IAAI,CAC9B;QACC,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,UAAU,EAAE,KAAK;QACjB,IAAI,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE;QAChD,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE,QAAQ;KACrC,EACD,EAAE,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAmB,EACtE;QACC,SAAS,EAAE,CAAC,OAAO,CAAC,UAAU,IAAI,uBAAuB,CAAgB;QACzE,SAAS,EAAE,aAAa;QACxB,OAAO,EAAE,UAAU,CAAC,MAAM;KACJ,CACvB,CAAC;IACF,IAAI,cAAc,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;QACrD,MAAM,IAAI,yBAAW,CACpB,4BAA4B,uBAAuB,sFAAsF,CACzI,CAAC;IACH,CAAC;IACD,0FAA0F;IAC1F,qDAAqD;IACrD,0BAAM,CAAC,IAAI,CACV,2BAA2B,OAAO,CAAC,QAAQ,EAAE,QAAQ,IAAI,YAAY,UAAU,UAAU,CAAC,QAAQ,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAC/H,CAAC;IACF,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,qBAAqB,CAAC,QAAqB;IAChE,MAAM,UAAU,GAAQ,IAAA,uCAAgB,EAAC,QAAQ,EAAE,aAAG,CAAC,MAAM,CAAC,EAAE,aAAa,EAAE,aAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IACtH,IAAI,UAAU;QAAE,MAAM,IAAI,yBAAW,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,EAAE,aAAa,EAAE,GAAG,QAAQ,CAAC;IACnC,MAAM,oBAAoB,CAAC,aAAa,CAAC,CAAC;IAE1C,MAAM,IAAI,GAAe,MAAM,aAAa,EAAE,CAAC;IAC/C,MAAM,UAAU,GAAG,sBAAG,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,MAAM,gBAAgB,GAAqE;QAC1F,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,UAAU,EAAE,UAAU,CAAC,UAAU;KACjC,CAAC;IACF,0EAA0E;IAC1E,IAAA,sCAAkB,EAAC,gBAAgB,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;IAC5D,MAAM,cAAc,GAAG,sBAAG,CAAC,IAAI,CAC9B,gBAAgB,EAChB,EAAE,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAmB,EACtE;QACC,SAAS,EAAE,uBAAsC;QACjD,SAAS,EAAE,aAAa;QACxB,OAAO,EAAE,UAAU,CAAC,SAAS;KACP,CACvB,CAAC;IAEF,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;;;;;GASG;AACI,KAAK,UAAU,oBAAoB,CACzC,IAAsE,EACtE,SAAsB;IAEtB,MAAM,IAAI,GAAe,MAAM,aAAa,EAAE,CAAC;IAC/C,MAAM,OAAO,GAAqE;QACjF,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,UAAU,EAAE,IAAI,CAAC,UAAU;KAC3B,CAAC;IACF,mGAAmG;IACnG,+FAA+F;IAC/F,qCAAqC;IACrC,IAAA,sCAAkB,EAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAC7C,4FAA4F;IAC5F,iGAAiG;IACjG,0EAA0E;IAC1E,IAAA,qDAA2B,EAAC,OAAO,CAAC,CAAC;IAErC,OAAO,sBAAG,CAAC,IAAI,CACd,OAAO,EACP,EAAE,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAmB,EACtE;QACC,SAAS;QACT,SAAS,EAAE,aAAa;QACxB,OAAO,EAAE,UAAU,CAAC,SAAS;KACP,CACvB,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,sBAAsB,CAAC,KAAa;IACzD,OAAO,aAAa,CAAC,KAAK,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;AACnD,CAAC;AAEM,KAAK,UAAU,oBAAoB,CAAC,KAAa;IACvD,OAAO,aAAa,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,kBAAkB,CAAC,KAAa;IACrD,OAAO,aAAa,CAAC,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,KAAa,EAAE,SAAiB;IAC5D,IAAI,CAAC;QACJ,MAAM,IAAI,GAAe,MAAM,aAAa,EAAE,CAAC;QAC/C,2BAA2B,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5C,iFAAiF;QACjF,yDAAyD;QACzD,MAAM,aAAa,GAAG,sBAAG,CAAC,MAAM,CAC/B,KAAK,EACL,IAAI,CAAC,SAAS,EACd,SAAS,KAAK,UAAU,CAAC,SAAS;YACjC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,aAAa,CAAC,EAAE;YACjC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CACxC,CAAC;QAEhB,IAAI,SAAS,KAAK,UAAU,CAAC,SAAS,IAAI,aAAa,CAAC,GAAG,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;YACnF,OAAO,wBAAwB,CAAC,aAAa,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,aAAa,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YACrC,MAAM,IAAA,iDAAwB,EAAC,yBAAyB,CAAC,aAAa,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC;QACzG,CAAC;QAED,wFAAwF;QACxF,kFAAkF;QAClF,IAAI,aAAa,CAAC,IAAI,EAAE,CAAC;YACxB,MAAM,IAAA,iDAAwB,EAAC,yBAAyB,CAAC,aAAa,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC;QACzG,CAAC;QAED,MAAM,IAAI,GAAQ,MAAM,IAAA,6BAAmB,EAAC,aAAa,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QACtF,IAAI,SAAS,KAAK,UAAU,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,EAAE,CAAC;YACvF,MAAM,IAAA,iDAAwB,EAAC,yBAAyB,CAAC,aAAa,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC;QACzG,CAAC;QAED,+FAA+F;QAC/F,8FAA8F;QAC9F,8FAA8F;QAC9F,mBAAmB;QACnB,IAAA,qCAAiB,EAAC,IAAI,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;QAClD,2FAA2F;QAC3F,oDAAoD;QACpD,IAAA,sDAA4B,EAAC,IAAI,EAAE,aAAa,CAAC,iDAAuB,CAAC,CAAC,CAAC;QAE3E,OAAO,IAAI,CAAC;IACb,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,0BAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjB,IAAI,GAAG,EAAE,IAAI,KAAK,mBAAmB,EAAE,CAAC;YACvC,MAAM,IAAA,iDAAwB,EAAC,yBAAyB,CAAC,aAAa,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;QACtG,CAAC;QACD,kGAAkG;QAClG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC;YAAE,MAAM,GAAG,CAAC;QAEtC,MAAM,IAAA,iDAAwB,EAAC,yBAAyB,CAAC,aAAa,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC;IACzG,CAAC;AACF,CAAC;AAED,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC,CAAC,mBAAmB,EAAE,gBAAgB,EAAE,mBAAmB,CAAC,CAAC,CAAC;AACxG,8FAA8F;AAC9F,MAAM,kBAAkB,GAAG,wDAAwD,CAAC;AAEpF,SAAS,gBAAgB,CAAC,GAAQ;IACjC,IAAI,IAAA,8CAAqB,EAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5D,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,2BAA2B,CAAC,SAAkB;IACtD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,yBAAW,CAAC,yBAAyB,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;IAC9G,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,SAAS,wBAAwB,CAAC,MAAkB;IACnD,MAAM,QAAQ,GAAI,MAAM,CAAC,IAAiD,EAAE,UAAU,CAAC;IACvF,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjH,MAAM,IAAA,iDAAwB,EAAC,yBAAyB,CAAC,aAAa,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC;IACzG,CAAC;IACD,MAAM,UAAU,GAA4B,EAAE,GAAG,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;IACpG,iGAAiG;IACjG,8EAA8E;IAC9E,MAAM,QAAQ,GAAG,IAAA,oCAAiB,EAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAChE,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1C,UAAU,CAAC,mBAAmB,GAAG,IAAA,+CAAqB,EAAC,UAAU,CAAC,UAAsB,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO;QACN,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,IAAI;QACZ,YAAY,EAAE,IAAI;QAClB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,IAAI,EAAE;YACL,UAAU,EAAE,UAAwC;YACpD,IAAI,EAAE,QAAQ;YACd,EAAE,EAAE,QAAQ;YACZ,eAAe,EAAE,CAAC;YAClB,eAAe,EAAE,CAAC;SAClB;KACD,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAgB,SAAS,CAAC,KAAa;IACtC,IAAI,CAAC;QACJ,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACpC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChE,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED;;GAEG;AACH,SAAgB,YAAY,CAAC,KAAa,EAAE,aAAa,GAAG,GAAG;IAC9D,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,OAAO,OAAO,CAAC,GAAG,GAAG,GAAG,GAAG,aAAa,CAAC;AAC1C,CAAC"}

package/dist/security/user.js

@@ -82,6 +82,7 @@ const Server_ts_1 = require("../server/Server.js");
 const terms = __importStar(require("../utility/hdbTerms.js"));
 const operationPermissions_ts_1 = require("../utility/operationPermissions.js");
 const superUserGuard_ts_1 = require("./superUserGuard.js");
+const credentialRejection_ts_1 = require("./credentialRejection.js");
 Server_ts_1.server.getUser = (username, password) => {
     return findAndValidateUser(username, password, password != null);
 };
@@ -349,10 +350,10 @@ async function findAndValidateUser(username, pw, validatePassword = true) {
     if (!userTmp) {
         if (!validatePassword)
             return { username };
-        throw new hdbError_ts_1.ClientError(AUTHENTICATION_ERROR_MSGS.GENERIC_AUTH_FAIL, HTTP_STATUS_CODES.UNAUTHORIZED);
+        throw (0, credentialRejection_ts_1.credentialRejectionError)(AUTHENTICATION_ERROR_MSGS.GENERIC_AUTH_FAIL, HTTP_STATUS_CODES.UNAUTHORIZED);
     }
     if (userTmp && !userTmp.active)
-        throw new hdbError_ts_1.ClientError(AUTHENTICATION_ERROR_MSGS.USER_INACTIVE, HTTP_STATUS_CODES.UNAUTHORIZED);
+        throw (0, credentialRejection_ts_1.credentialRejectionError)(AUTHENTICATION_ERROR_MSGS.USER_INACTIVE, HTTP_STATUS_CODES.UNAUTHORIZED);
     const user = {
         active: userTmp.active,
         username: userTmp.username,
@@ -377,7 +378,7 @@ async function findAndValidateUser(username, pw, validatePassword = true) {
             if (validated === true)
                 passwordHashCache.set(pw, userTmp.password);
             else
-                throw new hdbError_ts_1.ClientError(AUTHENTICATION_ERROR_MSGS.GENERIC_AUTH_FAIL, HTTP_STATUS_CODES.UNAUTHORIZED);
+                throw (0, credentialRejection_ts_1.credentialRejectionError)(AUTHENTICATION_ERROR_MSGS.GENERIC_AUTH_FAIL, HTTP_STATUS_CODES.UNAUTHORIZED);
         }
     }
     return user;

package/dist/security/user.js.map

@@ -1 +1 @@
-{"version":3,"file":"user.js","sourceRoot":"","sources":["../../security/user.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AASZ,0BAAO;AACP,8BAAS;AACT,oEAA4B;AAC5B,4BAAQ;AACR,oCAAY;AACZ,4BAAQ;AACR,8BAAS;AACT,8CAAiB;AACjB,wDAAsB;AACtB,kDAAmB;AACnB,wDAAsB;AAjBvB,MAAM,iBAAiB,GAAG,sBAAsB,CAAC;AAkBhD,8CAAiB;AAjBlB,MAAM,2BAA2B,GAAG,mEAAmE,CAAC;AAkBvG,kEAA2B;AAjB5B,MAAM,cAAc,GAAG,oCAAoC,CAAC;AAkB3D,wCAAc;AAjBf,MAAM,UAAU,GAAG,2CAA2C,CAAC;AAkB9D,gCAAU;AAjBX,MAAM,cAAc,GAAG,8BAA8B,CAAC;AAkBrD,wCAAc;AA4Df,6EAA6E;AAC7E,+DAAiD;AACjD,gEAAkD;AAClD,6EAA+D;AAC/D,+DAAiD;AACjD,qEAAuD;AACvD,uEAAyD;AACzD,sDAAwC;AACxC,4EAA8D;AAC9D,+BAAiC;AACjC,kFAAoE;AACpE,kFAAqD;AACrD,+DAAuE;AACvE,MAAM,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,cAAc,EAAE,GAAG,uBAAS,CAAC;AACnF,MAAM,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;AAC7D,0CAA4B;AAC5B,kFAAoE;AAEpE,sFAAsF;AACtF,iIAAiI;AACjI,iEAAmD;AACnD,mDAA6C;AAC7C,8DAAgD;AAChD,gFAA2E;AAC3E,2DAA6D;AAE7D,kBAAM,CAAC,OAAO,GAAG,CAAC,QAAgB,EAAE,QAAwB,EAAiB,EAAE;IAC9E,OAAO,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,IAAI,IAAI,CAAC,CAAC;AAClE,CAAC,CAAC;AAEF,kBAAM,CAAC,gBAAgB,GAAG,CAAC,QAAgB,EAAE,QAAwB,EAAiB,EAAE;IACvF,OAAO,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAChD,CAAC,CAAC;AAEF,MAAM,wBAAwB,GAAG;IAChC,QAAQ,EAAE,IAAI;IACd,MAAM,EAAE,IAAI;IACZ,IAAI,EAAE,IAAI;IACV,QAAQ,EAAE,IAAI;CACd,CAAC;AACF,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAE,CAAC;AACpC,MAAM,aAAa,GAAG,IAAA,gBAAS,EAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AACjD,MAAM,sBAAsB,GAC3B,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,2BAA2B,CAAC,IAAI,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC;AAC3F,IAAI,iBAAiB,CAAC;AAEtB,KAAK,UAAU,OAAO,CAAC,IAAgB;IACtC,IAAI,SAAS,GAAG,QAAQ,CAAC,eAAe,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC;IACzE,IAAI,cAAc,GAAG,UAAU,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC7D,IAAI,cAAc;QAAE,MAAM,IAAI,yBAAW,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;IAElE,IAAI,UAAU,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC;QAC3C,MAAM,EAAE,QAAQ;QAChB,KAAK,EAAE,UAAU;QACjB,SAAS,EAAE,MAAM;QACjB,KAAK,EAAE,SAAS,CAAC,IAAI;QACrB,cAAc,EAAE,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC;KAC5C,CAAC,CAAC;IAEH,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,yBAAW,CAAC,cAAc,CAAC,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;IACxG,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,yBAAW,CAAC,cAAc,CAAC,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACnG,CAAC;IAED,SAAS,CAAC,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,sBAAsB,CAAC,CAAC;IACrF,SAAS,CAAC,aAAa,GAAG,sBAAsB,CAAC;IACjD,SAAS,CAAC,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAElC,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC;QAC1C,SAAS,EAAE,QAAQ;QACnB,MAAM,EAAE,QAAQ;QAChB,KAAK,EAAE,UAAU;QACjB,OAAO,EAAE,CAAC,SAAS,CAAC;KACpB,CAAC,CAAC;IACH,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAE7B,MAAM,sBAAsB,EAAE,CAAC;IAE/B,IAAI,cAAc,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,yBAAW,CAAC,cAAc,CAAC,mBAAmB,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC3G,CAAC;IAED,MAAM,UAAU,CAAC,gBAAgB,CAAC,IAAI,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACjE,OAAO,GAAG,SAAS,CAAC,QAAQ,qBAAqB,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,WAAW;IACnC,IAAI,SAAS,GAAG,QAAQ,CAAC,eAAe,CAAC,WAAW,EAAE,wBAAwB,CAAC,CAAC;IAEhF,IAAI,UAAU,CAAC,mBAAmB,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACpC,CAAC;IAED,IACC,UAAU,CAAC,mBAAmB,CAAC,SAAS,CAAC,QAAQ,CAAC;QAClD,UAAU,CAAC,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC;QAC9C,UAAU,CAAC,mBAAmB,CAAC,SAAS,CAAC,MAAM,CAAC,EAC/C,CAAC;QACF,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,mBAAmB,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QAC1G,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;QACtF,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QAC3G,SAAS,CAAC,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,sBAAsB,CAAC,CAAC;QACrF,SAAS,CAAC,aAAa,GAAG,sBAAsB,CAAC;IAClD,CAAC;IAED,kHAAkH;IAClH,IAAI,SAAS,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC;IAC7B,CAAC;IACD,iDAAiD;IACjD,IAAI,QAAQ,CAAC;IACb,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC;YAC3C,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,UAAU;YACjB,SAAS,EAAE,MAAM;YACjB,KAAK,EAAE,SAAS,CAAC,IAAI;YACrB,cAAc,EAAE,CAAC,GAAG,CAAC;SACrB,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YACrC,MAAM,IAAI,yBAAW,CAAC,cAAc,CAAC,yBAAyB,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAE9G,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YACtB,MAAM,IAAI,yBAAW,CAAC,cAAc,CAAC,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAEnG,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACvB,SAAS,CAAC,IAAI,GAAG,QAAQ,CAAC,EAAE,CAAC;IAC9B,CAAC;IAED,IAAI,QAAQ,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC9D,MAAM,4BAA4B,CAAC,CAAC,IAAI,EAAE,EAAE,CAC3C,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,QAAQ;YACnC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE;YACnF,CAAC,CAAC,IAAI,CACP,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC;QAC1C,SAAS,EAAE,QAAQ;QACnB,MAAM,EAAE,QAAQ;QAChB,KAAK,EAAE,UAAU;QACjB,OAAO,EAAE,CAAC,SAAS,CAAC;KACpB,CAAC,CAAC;IAEH,MAAM,sBAAsB,EAAE,CAAC;IAC/B,MAAM,UAAU,CAAC,gBAAgB,CAAC,IAAI,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAEjE,OAAO,cAAc,CAAC;AACvB,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAgB;IACvC,MAAM,cAAc,GAAG,UAAU,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC3D,IAAI,cAAc;QAAE,MAAM,IAAI,yBAAW,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;IAElE,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,SAAS;QACrD,MAAM,IAAI,yBAAW,CAAC,cAAc,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAElG,MAAM,4BAA4B,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE/G,MAAM,cAAc,GAAG,MAAM,aAAa,CAAC;QAC1C,KAAK,EAAE,UAAU;QACjB,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;KAC5B,CAAC,CAAC;IAEH,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC7B,MAAM,sBAAsB,EAAE,CAAC;IAC/B,MAAM,UAAU,CAAC,gBAAgB,CAAC,IAAI,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACjE,OAAO,GAAG,IAAI,CAAC,QAAQ,uBAAuB,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAI;IAC3B,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC7B,OAAO,oCAAoC,CAAC;IAC7C,CAAC;IAED,IAAI,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,QAAQ,GACX,IAAI,CAAC,IAAI;QACT,CAAC,MAAM,MAAM,CAAC,YAAY,CAAC;YAC1B,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,UAAU;YACjB,WAAW,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,cAAc,EAAE,CAAC,GAAG,CAAC;SACrB,CAAC,CAAC,CAAC;IAEL,IAAI,CAAC,IAAI,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1B,OAAO,IAAI,CAAC,QAAQ,CAAC;IACrB,OAAO,IAAI,CAAC,aAAa,CAAC;IAC1B,OAAO,IAAI,CAAC,IAAI,CAAC;IACjB,OAAO,IAAI,CAAC,aAAa,CAAC;IAE1B,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,iBAAiB;IAC/B,MAAM,QAAQ,GAAG,MAAM,SAAS,EAAE,CAAC;IACnC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QACzB,OAAO,IAAI,CAAC,QAAQ,CAAC;QACrB,OAAO,IAAI,CAAC,IAAI,CAAC;QACjB,OAAO,IAAI,CAAC,aAAa,CAAC;QAC1B,OAAO,IAAI,CAAC,aAAa,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,SAAS;IACvB,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC;QACxC,MAAM,EAAE,QAAQ;QAChB,KAAK,EAAE,UAAU;QACjB,KAAK,EAAE,GAAG;QACV,SAAS,EAAE,MAAM;QACjB,cAAc,EAAE,CAAC,GAAG,CAAC;KACrB,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,EAAE,CAAC;IACtB,KAAK,IAAI,IAAI,IAAI,KAAK,EAAE,CAAC;QACxB,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC;QACxC,MAAM,EAAE,QAAQ;QAChB,KAAK,EAAE,UAAU;QACjB,KAAK,EAAE,GAAG;QACV,SAAS,EAAE,UAAU;QACrB,cAAc,EAAE,CAAC,GAAG,CAAC;KACrB,CAAC,CAAC;IAEH,MAAM,OAAO,GAAsB,IAAI,GAAG,EAAE,CAAC;IAC7C,KAAK,IAAI,IAAI,IAAI,KAAK,EAAE,CAAC;QACxB,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,OAAO,OAAO,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,SAAS,wBAAwB,CAAC,QAAkB;IACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;QACzC,OAAO;IACR,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;QACjC,QAAQ,CAAC,UAAU,CAAC,MAAM,GAAG;YAC5B,MAAM,EAAE,EAAE;SACV,CAAC;IACH,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACxC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;IACxC,CAAC;IACD,KAAK,IAAI,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,2BAAY,CAAC,EAAE,CAAC;QAC7C,IAAI,OAAO,GAAG;YACb,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU;YACtC,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,KAAK;YACb,qBAAqB,EAAE,EAAE;SACzB,CAAC;QAEF,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC;IACpD,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,SAAS,4BAA4B,CAAC,QAAkB;IACvD,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU;QAAE,OAAO;IAC9C,QAAQ,CAAC,UAAU,CAAC,mBAAmB,GAAG,IAAA,+CAAqB,EAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AACjG,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,KAAK,GAAG,SAAS;IACtD,IAAI,KAAK;QAAE,iBAAiB,GAAG,KAAK,CAAC;;QAChC,iBAAiB,GAAG,MAAM,SAAS,EAAE,CAAC;AAC5C,CAAC;AAED,KAAK,UAAU,sBAAsB;IACpC,IAAI,CAAC,iBAAiB;QAAE,MAAM,sBAAsB,EAAE,CAAC;IACvD,OAAO,iBAAiB,CAAC;AAC1B,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,4BAA4B,CAAC,QAA0C;IACrF,MAAM,KAAK,GAAG,MAAM,sBAAsB,EAAE,CAAC;IAC7C,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,IAAI,IAAA,0CAAsB,EAAC,KAAK,CAAC,MAAM,EAAE,EAAE,QAAQ,CAAC;QAAE,OAAO;IAC7D,MAAM,IAAI,yBAAW,CAAC,cAAc,CAAC,eAAe,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;AACnF,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,mBAAmB,CAAC,QAAgB,EAAE,EAAkB,EAAE,gBAAgB,GAAG,IAAI;IAC/F,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACxB,MAAM,sBAAsB,EAAE,CAAC;IAChC,CAAC;IAED,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,IAAI,CAAC,gBAAgB;YAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;QAC3C,MAAM,IAAI,yBAAW,CAAC,yBAAyB,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC;IACpG,CAAC;IAED,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM;QAC7B,MAAM,IAAI,yBAAW,CAAC,yBAAyB,CAAC,aAAa,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAEhG,MAAM,IAAI,GAAS;QAClB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC1B,CAAC;IACF,IAAI,OAAO,CAAC,aAAa;QAAE,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IACtE,4EAA4E;IAC5E,yFAAyF;IACzF,wFAAwF;IACxF,IAAI,OAAO,CAAC,IAAI;QAAE,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;IAE9F,IAAI,gBAAgB,KAAK,IAAI,EAAE,CAAC;QAC/B,gEAAgE;QAChE,IAAI,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,OAAO,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAChE,mCAAmC;aAC9B,CAAC;YACL,IAAI,SAAS,GAA+B,QAAQ,CAAC,QAAQ,CAC5D,OAAO,CAAC,QAAQ,EAChB,EAAE,EACF,OAAO,CAAC,aAAa,IAAI,QAAQ,CAAC,aAAa,CAAC,GAAG,CACnD,CAAC,CAAC,2CAA2C;YAC9C,mEAAmE;YACnE,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAK,SAA8B,EAAE,IAAI;gBAAE,SAAS,GAAG,MAAM,SAAS,CAAC;YACxG,IAAI,SAAS,KAAK,IAAI;gBAAE,iBAAiB,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;;gBAC/D,MAAM,IAAI,yBAAW,CAAC,yBAAyB,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC;QACzG,CAAC;IACF,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,KAAK,UAAU,YAAY;IAC1B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACxB,MAAM,sBAAsB,EAAE,CAAC;IAChC,CAAC;IACD,KAAK,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,iBAAiB,EAAE,CAAC;QACxC,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,YAAY;YAAE,OAAO,IAAI,CAAC;IACnD,CAAC;AACF,CAAC;AAED,IAAI,mBAAmB,GAAG,EAAE,CAAC;AAC5B,kBAAc,CAAC,cAAc,GAAG,UAAU,IAAgB;IAC1D,KAAK,IAAI,QAAQ,IAAI,mBAAmB,EAAE,CAAC;QAC1C,IAAI,CAAC;YACJ,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,YAAY,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;QACtD,CAAC;IACF,CAAC;AACF,CAAC,CAAC;AAEF,kBAAM,CAAC,iBAAiB,GAAG,UAAU,QAAQ;IAC5C,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACpC,CAAC,CAAC"}
+{"version":3,"file":"user.js","sourceRoot":"","sources":["../../security/user.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AASZ,0BAAO;AACP,8BAAS;AACT,oEAA4B;AAC5B,4BAAQ;AACR,oCAAY;AACZ,4BAAQ;AACR,8BAAS;AACT,8CAAiB;AACjB,wDAAsB;AACtB,kDAAmB;AACnB,wDAAsB;AAjBvB,MAAM,iBAAiB,GAAG,sBAAsB,CAAC;AAkBhD,8CAAiB;AAjBlB,MAAM,2BAA2B,GAAG,mEAAmE,CAAC;AAkBvG,kEAA2B;AAjB5B,MAAM,cAAc,GAAG,oCAAoC,CAAC;AAkB3D,wCAAc;AAjBf,MAAM,UAAU,GAAG,2CAA2C,CAAC;AAkB9D,gCAAU;AAjBX,MAAM,cAAc,GAAG,8BAA8B,CAAC;AAkBrD,wCAAc;AA4Df,6EAA6E;AAC7E,+DAAiD;AACjD,gEAAkD;AAClD,6EAA+D;AAC/D,+DAAiD;AACjD,qEAAuD;AACvD,uEAAyD;AACzD,sDAAwC;AACxC,4EAA8D;AAC9D,+BAAiC;AACjC,kFAAoE;AACpE,kFAAqD;AACrD,+DAAuE;AACvE,MAAM,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,cAAc,EAAE,GAAG,uBAAS,CAAC;AACnF,MAAM,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;AAC7D,0CAA4B;AAC5B,kFAAoE;AAEpE,sFAAsF;AACtF,iIAAiI;AACjI,iEAAmD;AACnD,mDAA6C;AAC7C,8DAAgD;AAChD,gFAA2E;AAC3E,2DAA6D;AAC7D,qEAAoE;AAEpE,kBAAM,CAAC,OAAO,GAAG,CAAC,QAAgB,EAAE,QAAwB,EAAiB,EAAE;IAC9E,OAAO,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,IAAI,IAAI,CAAC,CAAC;AAClE,CAAC,CAAC;AAEF,kBAAM,CAAC,gBAAgB,GAAG,CAAC,QAAgB,EAAE,QAAwB,EAAiB,EAAE;IACvF,OAAO,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAChD,CAAC,CAAC;AAEF,MAAM,wBAAwB,GAAG;IAChC,QAAQ,EAAE,IAAI;IACd,MAAM,EAAE,IAAI;IACZ,IAAI,EAAE,IAAI;IACV,QAAQ,EAAE,IAAI;CACd,CAAC;AACF,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAE,CAAC;AACpC,MAAM,aAAa,GAAG,IAAA,gBAAS,EAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AACjD,MAAM,sBAAsB,GAC3B,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,2BAA2B,CAAC,IAAI,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC;AAC3F,IAAI,iBAAiB,CAAC;AAEtB,KAAK,UAAU,OAAO,CAAC,IAAgB;IACtC,IAAI,SAAS,GAAG,QAAQ,CAAC,eAAe,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC;IACzE,IAAI,cAAc,GAAG,UAAU,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC7D,IAAI,cAAc;QAAE,MAAM,IAAI,yBAAW,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;IAElE,IAAI,UAAU,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC;QAC3C,MAAM,EAAE,QAAQ;QAChB,KAAK,EAAE,UAAU;QACjB,SAAS,EAAE,MAAM;QACjB,KAAK,EAAE,SAAS,CAAC,IAAI;QACrB,cAAc,EAAE,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC;KAC5C,CAAC,CAAC;IAEH,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,yBAAW,CAAC,cAAc,CAAC,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;IACxG,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,yBAAW,CAAC,cAAc,CAAC,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACnG,CAAC;IAED,SAAS,CAAC,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,sBAAsB,CAAC,CAAC;IACrF,SAAS,CAAC,aAAa,GAAG,sBAAsB,CAAC;IACjD,SAAS,CAAC,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAElC,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC;QAC1C,SAAS,EAAE,QAAQ;QACnB,MAAM,EAAE,QAAQ;QAChB,KAAK,EAAE,UAAU;QACjB,OAAO,EAAE,CAAC,SAAS,CAAC;KACpB,CAAC,CAAC;IACH,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAE7B,MAAM,sBAAsB,EAAE,CAAC;IAE/B,IAAI,cAAc,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,yBAAW,CAAC,cAAc,CAAC,mBAAmB,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC3G,CAAC;IAED,MAAM,UAAU,CAAC,gBAAgB,CAAC,IAAI,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACjE,OAAO,GAAG,SAAS,CAAC,QAAQ,qBAAqB,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,WAAW;IACnC,IAAI,SAAS,GAAG,QAAQ,CAAC,eAAe,CAAC,WAAW,EAAE,wBAAwB,CAAC,CAAC;IAEhF,IAAI,UAAU,CAAC,mBAAmB,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACpC,CAAC;IAED,IACC,UAAU,CAAC,mBAAmB,CAAC,SAAS,CAAC,QAAQ,CAAC;QAClD,UAAU,CAAC,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC;QAC9C,UAAU,CAAC,mBAAmB,CAAC,SAAS,CAAC,MAAM,CAAC,EAC/C,CAAC;QACF,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,mBAAmB,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QAC1G,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;QACtF,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QAC3G,SAAS,CAAC,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,sBAAsB,CAAC,CAAC;QACrF,SAAS,CAAC,aAAa,GAAG,sBAAsB,CAAC;IAClD,CAAC;IAED,kHAAkH;IAClH,IAAI,SAAS,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC;IAC7B,CAAC;IACD,iDAAiD;IACjD,IAAI,QAAQ,CAAC;IACb,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC;YAC3C,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,UAAU;YACjB,SAAS,EAAE,MAAM;YACjB,KAAK,EAAE,SAAS,CAAC,IAAI;YACrB,cAAc,EAAE,CAAC,GAAG,CAAC;SACrB,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YACrC,MAAM,IAAI,yBAAW,CAAC,cAAc,CAAC,yBAAyB,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAE9G,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YACtB,MAAM,IAAI,yBAAW,CAAC,cAAc,CAAC,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAEnG,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACvB,SAAS,CAAC,IAAI,GAAG,QAAQ,CAAC,EAAE,CAAC;IAC9B,CAAC;IAED,IAAI,QAAQ,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC9D,MAAM,4BAA4B,CAAC,CAAC,IAAI,EAAE,EAAE,CAC3C,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,QAAQ;YACnC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE;YACnF,CAAC,CAAC,IAAI,CACP,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC;QAC1C,SAAS,EAAE,QAAQ;QACnB,MAAM,EAAE,QAAQ;QAChB,KAAK,EAAE,UAAU;QACjB,OAAO,EAAE,CAAC,SAAS,CAAC;KACpB,CAAC,CAAC;IAEH,MAAM,sBAAsB,EAAE,CAAC;IAC/B,MAAM,UAAU,CAAC,gBAAgB,CAAC,IAAI,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAEjE,OAAO,cAAc,CAAC;AACvB,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAgB;IACvC,MAAM,cAAc,GAAG,UAAU,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC3D,IAAI,cAAc;QAAE,MAAM,IAAI,yBAAW,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;IAElE,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,SAAS;QACrD,MAAM,IAAI,yBAAW,CAAC,cAAc,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAElG,MAAM,4BAA4B,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE/G,MAAM,cAAc,GAAG,MAAM,aAAa,CAAC;QAC1C,KAAK,EAAE,UAAU;QACjB,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;KAC5B,CAAC,CAAC;IAEH,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC7B,MAAM,sBAAsB,EAAE,CAAC;IAC/B,MAAM,UAAU,CAAC,gBAAgB,CAAC,IAAI,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACjE,OAAO,GAAG,IAAI,CAAC,QAAQ,uBAAuB,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAI;IAC3B,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC7B,OAAO,oCAAoC,CAAC;IAC7C,CAAC;IAED,IAAI,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,QAAQ,GACX,IAAI,CAAC,IAAI;QACT,CAAC,MAAM,MAAM,CAAC,YAAY,CAAC;YAC1B,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,UAAU;YACjB,WAAW,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,cAAc,EAAE,CAAC,GAAG,CAAC;SACrB,CAAC,CAAC,CAAC;IAEL,IAAI,CAAC,IAAI,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1B,OAAO,IAAI,CAAC,QAAQ,CAAC;IACrB,OAAO,IAAI,CAAC,aAAa,CAAC;IAC1B,OAAO,IAAI,CAAC,IAAI,CAAC;IACjB,OAAO,IAAI,CAAC,aAAa,CAAC;IAE1B,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,iBAAiB;IAC/B,MAAM,QAAQ,GAAG,MAAM,SAAS,EAAE,CAAC;IACnC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QACzB,OAAO,IAAI,CAAC,QAAQ,CAAC;QACrB,OAAO,IAAI,CAAC,IAAI,CAAC;QACjB,OAAO,IAAI,CAAC,aAAa,CAAC;QAC1B,OAAO,IAAI,CAAC,aAAa,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,SAAS;IACvB,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC;QACxC,MAAM,EAAE,QAAQ;QAChB,KAAK,EAAE,UAAU;QACjB,KAAK,EAAE,GAAG;QACV,SAAS,EAAE,MAAM;QACjB,cAAc,EAAE,CAAC,GAAG,CAAC;KACrB,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,EAAE,CAAC;IACtB,KAAK,IAAI,IAAI,IAAI,KAAK,EAAE,CAAC;QACxB,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC;QACxC,MAAM,EAAE,QAAQ;QAChB,KAAK,EAAE,UAAU;QACjB,KAAK,EAAE,GAAG;QACV,SAAS,EAAE,UAAU;QACrB,cAAc,EAAE,CAAC,GAAG,CAAC;KACrB,CAAC,CAAC;IAEH,MAAM,OAAO,GAAsB,IAAI,GAAG,EAAE,CAAC;IAC7C,KAAK,IAAI,IAAI,IAAI,KAAK,EAAE,CAAC;QACxB,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,OAAO,OAAO,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,SAAS,wBAAwB,CAAC,QAAkB;IACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;QACzC,OAAO;IACR,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;QACjC,QAAQ,CAAC,UAAU,CAAC,MAAM,GAAG;YAC5B,MAAM,EAAE,EAAE;SACV,CAAC;IACH,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACxC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;IACxC,CAAC;IACD,KAAK,IAAI,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,2BAAY,CAAC,EAAE,CAAC;QAC7C,IAAI,OAAO,GAAG;YACb,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU;YACtC,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,KAAK;YACb,qBAAqB,EAAE,EAAE;SACzB,CAAC;QAEF,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC;IACpD,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,SAAS,4BAA4B,CAAC,QAAkB;IACvD,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU;QAAE,OAAO;IAC9C,QAAQ,CAAC,UAAU,CAAC,mBAAmB,GAAG,IAAA,+CAAqB,EAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AACjG,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,KAAK,GAAG,SAAS;IACtD,IAAI,KAAK;QAAE,iBAAiB,GAAG,KAAK,CAAC;;QAChC,iBAAiB,GAAG,MAAM,SAAS,EAAE,CAAC;AAC5C,CAAC;AAED,KAAK,UAAU,sBAAsB;IACpC,IAAI,CAAC,iBAAiB;QAAE,MAAM,sBAAsB,EAAE,CAAC;IACvD,OAAO,iBAAiB,CAAC;AAC1B,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,4BAA4B,CAAC,QAA0C;IACrF,MAAM,KAAK,GAAG,MAAM,sBAAsB,EAAE,CAAC;IAC7C,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,IAAI,IAAA,0CAAsB,EAAC,KAAK,CAAC,MAAM,EAAE,EAAE,QAAQ,CAAC;QAAE,OAAO;IAC7D,MAAM,IAAI,yBAAW,CAAC,cAAc,CAAC,eAAe,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;AACnF,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,mBAAmB,CAAC,QAAgB,EAAE,EAAkB,EAAE,gBAAgB,GAAG,IAAI;IAC/F,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACxB,MAAM,sBAAsB,EAAE,CAAC;IAChC,CAAC;IAED,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,IAAI,CAAC,gBAAgB;YAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;QAC3C,MAAM,IAAA,iDAAwB,EAAC,yBAAyB,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAC7G,CAAC;IAED,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM;QAC7B,MAAM,IAAA,iDAAwB,EAAC,yBAAyB,CAAC,aAAa,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAEzG,MAAM,IAAI,GAAS;QAClB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC1B,CAAC;IACF,IAAI,OAAO,CAAC,aAAa;QAAE,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IACtE,4EAA4E;IAC5E,yFAAyF;IACzF,wFAAwF;IACxF,IAAI,OAAO,CAAC,IAAI;QAAE,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;IAE9F,IAAI,gBAAgB,KAAK,IAAI,EAAE,CAAC;QAC/B,gEAAgE;QAChE,IAAI,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,OAAO,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAChE,mCAAmC;aAC9B,CAAC;YACL,IAAI,SAAS,GAA+B,QAAQ,CAAC,QAAQ,CAC5D,OAAO,CAAC,QAAQ,EAChB,EAAE,EACF,OAAO,CAAC,aAAa,IAAI,QAAQ,CAAC,aAAa,CAAC,GAAG,CACnD,CAAC,CAAC,2CAA2C;YAC9C,mEAAmE;YACnE,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAK,SAA8B,EAAE,IAAI;gBAAE,SAAS,GAAG,MAAM,SAAS,CAAC;YACxG,IAAI,SAAS,KAAK,IAAI;gBAAE,iBAAiB,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;;gBAC/D,MAAM,IAAA,iDAAwB,EAAC,yBAAyB,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC;QAClH,CAAC;IACF,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,KAAK,UAAU,YAAY;IAC1B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACxB,MAAM,sBAAsB,EAAE,CAAC;IAChC,CAAC;IACD,KAAK,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,iBAAiB,EAAE,CAAC;QACxC,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,YAAY;YAAE,OAAO,IAAI,CAAC;IACnD,CAAC;AACF,CAAC;AAED,IAAI,mBAAmB,GAAG,EAAE,CAAC;AAC5B,kBAAc,CAAC,cAAc,GAAG,UAAU,IAAgB;IAC1D,KAAK,IAAI,QAAQ,IAAI,mBAAmB,EAAE,CAAC;QAC1C,IAAI,CAAC;YACJ,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,YAAY,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;QACtD,CAAC;IACF,CAAC;AACF,CAAC,CAAC;AAEF,kBAAM,CAAC,iBAAiB,GAAG,UAAU,QAAQ;IAC5C,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACpC,CAAC,CAAC"}

package/dist/server/DurableSubscriptionsSession.d.ts

@@ -39,7 +39,7 @@ type Acknowledgement = {
     acknowledge?: () => any;
 };
 declare class SubscriptionsSession {
-    listener: (message: any, subscription: any, timestamp: any, qos: any) => any;
+    listener: (topic: any, message: any, messageId: any, subscription: any, version?: any) => any;
     sessionId: any;
     user: any;
     request: any;
@@ -57,7 +57,7 @@ declare class SubscriptionsSession {
     removeSubscription(topic: any): Promise<boolean>;
     publish(message: any, data: any): Promise<any>;
     createContext(): any;
-    setListener(listener: (message: any) => any): void;
+    setListener(listener: (topic: any, message: any, messageId: any, subscription: any, version?: any) => any): void;
     disconnect(clientTerminated: any): void;
     receivedPacket(): void;
 }

package/dist/server/DurableSubscriptionsSession.js

@@ -35,6 +35,24 @@ function getDurableSession() {
     return _DurableSession;
 }
 let _LastWill;
+/**
+ * A scoped token's only revocation is expiry, so its will must not publish past it. Keyed off the
+ * persisted will principal (not any live session user) so both will paths agree on one source.
+ * Fails closed: a scoped will with no recorded expiry is treated as expired rather than published.
+ */
+function isWillFromExpiredScopedToken(will) {
+    const user = will?.user;
+    if (!user?._scopedToken)
+        return false;
+    return !user.authExpiresAt || user.authExpiresAt * 1000 <= Date.now();
+}
+/** Drops the runtime-only pre-expanded operations Set so the permission set is storage-safe. */
+function stripRuntimePermissionState(permission) {
+    if (!permission || typeof permission !== 'object')
+        return permission;
+    const { _expandedOperations, ...durable } = permission;
+    return durable;
+}
 function getLastWill() {
     if (!_LastWill) {
         _LastWill = (0, databases_ts_1.table)({
@@ -59,15 +77,28 @@ if ((0, manageThreads_js_1.getWorkerIndex)() === 0) {
         for await (const will of getLastWill().search({})) {
             const data = will.data;
             const message = { ...will };
-            if (message.user?.username)
-                message.user = await Server_ts_1.server.getUser(message.user.username);
             try {
-                await publishMessage(message, data, message);
+                if (message.user?._scopedToken) {
+                    // A scoped token's username is attribution only; never rehydrate it by name (that could
+                    // substitute a real principal). The will carries the token's own downgraded role.
+                    if (!isWillFromExpiredScopedToken(message)) {
+                        await publishMessage(message, data, message);
+                    }
+                    else
+                        (0, harper_logger_ts_1.warn)('Dropping will from an expired scoped token', data);
+                }
+                else {
+                    if (message.user?.username)
+                        message.user = await Server_ts_1.server.getUser(message.user.username);
+                    await publishMessage(message, data, message);
+                }
+                await getLastWill().delete(will.id);
             }
             catch {
+                // One will's publish/delete failure must not abort replay of the rest; the row stays and
+                // is retried on the next restart.
                 (0, harper_logger_ts_1.warn)('Failed to publish will', data);
             }
-            getLastWill().delete(will.id);
         }
     })();
 }
@@ -118,7 +149,22 @@ async function getSession({ clientId: sessionId, user, clean: nonDurable, proper
     }
     if (will) {
         will.id = sessionId;
-        will.user = { username: user?.username };
+        // A scoped-token bearer's will must carry the token's own role and expiry: its username is
+        // attribution only and cannot be rehydrated from hdb_user at replay time. Persist only the
+        // durable permission fields — not the runtime-only _expandedOperations Set, which is rebuilt
+        // on read and would not round-trip through storage.
+        will.user = user?._scopedToken
+            ? {
+                username: user.username,
+                _scopedToken: true,
+                authExpiresAt: user.authExpiresAt,
+                role: user.role && {
+                    role: user.role.role,
+                    id: user.role.id,
+                    permission: stripRuntimePermissionState(user.role.permission),
+                },
+            }
+            : { username: user?.username };
         // Must be durably persisted before CONNACK is sent (getSession() resolving is what lets
         // mqtt.ts send CONNACK). Otherwise a client that connects and then disconnects abruptly
         // (no DISCONNECT packet) can race ahead of this write: SubscriptionsSession.disconnect()
@@ -306,7 +352,10 @@ class SubscriptionsSession {
                             path = (0, Resources_ts_1.keyArrayToString)(path);
                         if (path == null)
                             path = '';
-                        const result = await this.listener(resourcePath + '/' + path, update.value, messageId, subscriptionRequest);
+                        // the version is forwarded so the delivery side can tell a store-sourced event (whose
+                        // value is a fresh object per version) from an app-yielded one that may be a reused
+                        // mutable envelope — only the former is safe to encode once and share
+                        const result = await this.listener(resourcePath + '/' + path, update.value, messageId, subscriptionRequest, update.version);
                         if (result === false)
                             break;
                         if (this.awaitingAcks?.size > AWAITING_ACKS_HIGH_WATER_MARK) {
@@ -390,8 +439,11 @@ class SubscriptionsSession {
             try {
                 if (!clientTerminated) {
                     const will = await getLastWill().get(this.sessionId);
-                    if (will) {
-                        await publishMessage(will, will.data, context);
+                    if (will && !isWillFromExpiredScopedToken(will)) {
+                        // A scoped will authorizes under its own embedded role, never the disconnecting
+                        // session's user (which may be a later same-clientId reconnect).
+                        const willContext = will.user?._scopedToken ? { ...context, user: will.user } : context;
+                        await publishMessage(will, will.data, willContext);
                     }
                 }
             }
@@ -423,8 +475,13 @@ async function publishMessage(message, data, context) {
     message = { ...message, data, async: true };
     context.authorize = true;
     const entry = Resources_ts_1.resources.getMatch(topic, 'mqtt');
-    if (!entry)
-        throw new Error(`Can not publish to topic ${topic} as it does not exist, no resource has been defined to handle this topic`);
+    if (!entry) {
+        // Typed like addSubscription's identical miss, so a protocol layer can map it to a specific
+        // code rather than a generic failure.
+        const notFoundError = new Error(`Can not publish to topic ${topic} as it does not exist, no resource has been defined to handle this topic`);
+        notFoundError.statusCode = 404;
+        throw notFoundError;
+    }
     message.url = entry.relativeURL;
     const target = new RequestTarget_1.RequestTarget(entry.relativeURL);
     if (entry.params)