@hed-hog/core 0.0.398 → 0.0.400

package/dist/authorize/authorize.controller.js

@@ -17,34 +17,107 @@ const api_1 = require("@hed-hog/api");
 const api_locale_1 = require("@hed-hog/api-locale");
 const common_1 = require("@nestjs/common");
 const throttler_1 = require("@nestjs/throttler");
+const authorize_errors_1 = require("./authorize.errors");
 const authorize_service_1 = require("./authorize.service");
+const oauth_metadata_service_1 = require("./oauth-metadata.service");
+const oauth_exception_filter_1 = require("./oauth-exception.filter");
 const authorize_info_dto_1 = require("./dto/authorize-info.dto");
 const consent_dto_1 = require("./dto/consent.dto");
 const token_dto_1 = require("./dto/token.dto");
 /**
  * Endpoints do fluxo Authorization Code + PKCE.
  *
- * Note o que NÃO existe aqui: um `GET /auth/authorize` que redireciona. O
- * redirect final é feito pelo browser, na página de consent do admin, depois do
- * POST /auth/authorize/consent. Assim toda a validação fica no servidor e o
- * `code` não passa pelo mecanismo de redirect do Nest (nem pelos seus logs).
+ * O `GET /auth/authorize` daqui NÃO emite o `code`: ele valida e redireciona para
+ * a tela de consent do admin, que é quem faz o redirect final depois do
+ * `POST /auth/authorize/consent`. A restrição original continua valendo — o
+ * `code` nunca passa pelo mecanismo de redirect do Nest, nem pelos seus logs.
+ *
+ * Ele existe porque um cliente OAuth padrão (o conector do Claude) espera um
+ * `authorization_endpoint` na mesma origem do `issuer`, e porque a validação de
+ * `response_type`, `scope` e `resource` tem que acontecer no servidor, antes de
+ * qualquer render — um erro precisa voltar como `error=` na query, e não como uma
+ * tela morta.
  */
 let AuthorizeController = class AuthorizeController {
-    constructor(service) {
+    constructor(service, metadata) {
         this.service = service;
+        this.metadata = metadata;
+    }
+    /**
+     * O authorization endpoint anunciado nos metadados.
+     *
+     * A ordem de validação é normativa (RFC 6749 §4.1.2.1): `client_id` e
+     * `redirect_uri` primeiro, e falha neles NÃO redireciona — sem um redirect_uri
+     * validado, redirecionar seria mandar o usuário para onde o atacante pediu.
+     * Tudo o mais volta para o cliente como `error` na query.
+     */
+    async authorize(query, res) {
+        try {
+            await this.service.getAuthorizationInfo({
+                clientId: query.client_id,
+                redirectUri: query.redirect_uri,
+                scope: query.scope,
+                codeChallenge: query.code_challenge,
+                codeChallengeMethod: query.code_challenge_method,
+                responseType: query.response_type,
+                resource: query.resource,
+            });
+        }
+        catch (error) {
+            if (error instanceof authorize_errors_1.OAuthError && error.redirectable) {
+                return res.redirect(302, await this.buildErrorRedirect(query, error));
+            }
+            throw error;
+        }
+        // Só parâmetros validados seguem para a tela. O `code` é emitido lá, pelo
+        // consent, e volta por um redirect do browser — não por este.
+        const consentBase = await this.metadata.getConsentUiBase();
+        const params = new URLSearchParams();
+        for (const [key, value] of Object.entries(query)) {
+            if (value !== undefined && value !== null && value !== '') {
+                params.set(key, String(value));
+            }
+        }
+        return res.redirect(302, `${consentBase}/auth/authorize?${params.toString()}`);
+    }
+    async buildErrorRedirect(query, error) {
+        const target = new URL(query.redirect_uri);
+        target.searchParams.set('error', error.code);
+        target.searchParams.set('error_description', error.description);
+        if (query.state)
+            target.searchParams.set('state', query.state);
+        // RFC 9207: vai também no erro, e o cliente valida antes de exibir qualquer
+        // coisa. Anunciamos `authorization_response_iss_parameter_supported`.
+        target.searchParams.set('iss', await this.metadata.getIssuer());
+        return target.toString();
     }
     /**
      * Metadados para a tela de consent. Público: a página precisa validar os
      * parâmetros e mostrar de quem é o app ANTES de exigir login.
      */
     async authorizeInfo(query) {
-        return this.service.getAuthorizationInfo({
-            clientId: query.client_id,
-            redirectUri: query.redirect_uri,
-            scope: query.scope,
-            codeChallenge: query.code_challenge,
-            codeChallengeMethod: query.code_challenge_method,
-        });
+        try {
+            return await this.service.getAuthorizationInfo({
+                clientId: query.client_id,
+                redirectUri: query.redirect_uri,
+                scope: query.scope,
+                codeChallenge: query.code_challenge,
+                codeChallengeMethod: query.code_challenge_method,
+                responseType: query.response_type,
+                resource: query.resource,
+            });
+        }
+        catch (error) {
+            // Erro redirecionável volta para o cliente pelas mãos da tela, e o RFC 9207
+            // exige `iss` também nele. Mas a tela só aprende o issuer no caminho de
+            // SUCESSO desta chamada — num erro ela redirecionaria sem o parâmetro, e um
+            // cliente que o valide (nós anunciamos suportá-lo) rejeita a resposta
+            // inteira. Então o issuer viaja junto do erro.
+            if (error instanceof authorize_errors_1.OAuthError && error.redirectable) {
+                throw new authorize_errors_1.OAuthError(error.code, error.description, true, await this.metadata.getIssuer());
+            }
+            throw error;
+        }
     }
     /** O usuário logado aprova. O code sai vinculado a ele. */
     async consent({ id }, body) {
@@ -55,6 +128,8 @@ let AuthorizeController = class AuthorizeController {
             scope: body.scope,
             codeChallenge: body.code_challenge,
             codeChallengeMethod: body.code_challenge_method,
+            responseType: body.response_type,
+            resource: body.resource,
         });
         return { code };
     }
@@ -66,11 +141,23 @@ let AuthorizeController = class AuthorizeController {
      * seria ruído para um cliente não-browser e um vetor de CSRF a mais.
      */
     async token(body, locale, ipAddress, userAgent, browserId) {
+        if (body.grant_type === 'refresh_token') {
+            return this.service.exchangeRefreshToken({
+                refreshToken: body.refresh_token,
+                clientId: body.client_id,
+                resource: body.resource,
+                locale,
+                ipAddress,
+                userAgent,
+                browserId: browserId || null,
+            });
+        }
         return this.service.exchangeCode({
             code: body.code,
             codeVerifier: body.code_verifier,
             clientId: body.client_id,
             redirectUri: body.redirect_uri,
+            resource: body.resource,
             locale,
             ipAddress,
             userAgent,
@@ -79,6 +166,18 @@ let AuthorizeController = class AuthorizeController {
     }
 };
 exports.AuthorizeController = AuthorizeController;
+__decorate([
+    (0, api_1.Public)(),
+    (0, common_1.UseGuards)(throttler_1.ThrottlerGuard),
+    (0, throttler_1.Throttle)({ default: { limit: 30, ttl: 60000 } }),
+    (0, common_1.UseFilters)(oauth_exception_filter_1.OAuthExceptionFilter),
+    (0, common_1.Get)('authorize'),
+    __param(0, (0, common_1.Query)()),
+    __param(1, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [authorize_info_dto_1.AuthorizeInfoDTO, Object]),
+    __metadata("design:returntype", Promise)
+], AuthorizeController.prototype, "authorize", null);
 __decorate([
     (0, api_1.Public)(),
     (0, common_1.UseGuards)(throttler_1.ThrottlerGuard),
@@ -104,6 +203,12 @@ __decorate([
     (0, api_1.Public)(),
     (0, common_1.UseGuards)(throttler_1.ThrottlerGuard),
     (0, throttler_1.Throttle)({ default: { limit: 20, ttl: 60000 } }),
+    (0, common_1.UseFilters)(oauth_exception_filter_1.OAuthExceptionFilter)
+    // RFC 6749 5.1: a resposta carrega credenciais e nao pode ser cacheada. O
+    // filtro ja poe isto nos erros; aqui vale para o sucesso.
+    ,
+    (0, common_1.Header)('Cache-Control', 'no-store'),
+    (0, common_1.Header)('Pragma', 'no-cache'),
     (0, common_1.Post)('token'),
     __param(0, (0, common_1.Body)()),
     __param(1, (0, api_locale_1.Locale)()),
@@ -117,6 +222,8 @@ __decorate([
 exports.AuthorizeController = AuthorizeController = __decorate([
     (0, common_1.Controller)('auth'),
     __param(0, (0, common_1.Inject)((0, common_1.forwardRef)(() => authorize_service_1.AuthorizeService))),
-    __metadata("design:paramtypes", [authorize_service_1.AuthorizeService])
+    __param(1, (0, common_1.Inject)((0, common_1.forwardRef)(() => oauth_metadata_service_1.OAuthMetadataService))),
+    __metadata("design:paramtypes", [authorize_service_1.AuthorizeService,
+        oauth_metadata_service_1.OAuthMetadataService])
 ], AuthorizeController);
 //# sourceMappingURL=authorize.controller.js.map

package/dist/authorize/authorize.controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorize.controller.js","sourceRoot":"","sources":["../../src/authorize/authorize.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,sCAAoD;AACpD,oDAA6C;AAC7C,2CAWwB;AACxB,iDAA6D;AAC7D,2DAAuD;AACvD,iEAA4D;AAC5D,mDAA+C;AAC/C,+CAA2C;AAE3C;;;;;;;GAOG;AAEI,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAC9B,YAEmB,OAAyB;QAAzB,YAAO,GAAP,OAAO,CAAkB;IACzC,CAAC;IAEJ;;;OAGG;IAKG,AAAN,KAAK,CAAC,aAAa,CAAU,KAAuB;QAClD,OAAO,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC;YACvC,QAAQ,EAAE,KAAK,CAAC,SAAS;YACzB,WAAW,EAAE,KAAK,CAAC,YAAY;YAC/B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,aAAa,EAAE,KAAK,CAAC,cAAc;YACnC,mBAAmB,EAAE,KAAK,CAAC,qBAAqB;SACjD,CAAC,CAAC;IACL,CAAC;IAED,2DAA2D;IAKrD,AAAN,KAAK,CAAC,OAAO,CAAS,EAAE,EAAE,EAAE,EAAU,IAAgB;QACpD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;YACxC,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE,IAAI,CAAC,SAAS;YACxB,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,aAAa,EAAE,IAAI,CAAC,cAAc;YAClC,mBAAmB,EAAE,IAAI,CAAC,qBAAqB;SAChD,CAAC,CAAC;QAEH,OAAO,EAAE,IAAI,EAAE,CAAC;IAClB,CAAC;IAED;;;;;;OAMG;IAKG,AAAN,KAAK,CAAC,KAAK,CACD,IAAc,EACZ,MAAc,EAClB,SAAiB,EACA,SAAiB,EACf,SAAiB;QAE1C,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;YAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,QAAQ,EAAE,IAAI,CAAC,SAAS;YACxB,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,MAAM;YACN,SAAS;YACT,SAAS;YACT,SAAS,EAAE,SAAS,IAAI,IAAI;SAC7B,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAvEY,kDAAmB;AAcxB;IAJL,IAAA,YAAM,GAAE;IACR,IAAA,kBAAS,EAAC,0BAAc,CAAC;IACzB,IAAA,oBAAQ,EAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC;IAChD,IAAA,YAAG,EAAC,gBAAgB,CAAC;IACD,WAAA,IAAA,cAAK,GAAE,CAAA;;qCAAQ,qCAAgB;;wDAQnD;AAOK;IAJL,IAAA,YAAM,GAAE;IACR,IAAA,kBAAS,EAAC,0BAAc,CAAC;IACzB,IAAA,oBAAQ,EAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC;IAChD,IAAA,aAAI,EAAC,mBAAmB,CAAC;IACX,WAAA,IAAA,UAAI,GAAE,CAAA;IAAU,WAAA,IAAA,aAAI,GAAE,CAAA;;6CAAO,wBAAU;;kDAWrD;AAaK;IAJL,IAAA,YAAM,GAAE;IACR,IAAA,kBAAS,EAAC,0BAAc,CAAC;IACzB,IAAA,oBAAQ,EAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC;IAChD,IAAA,aAAI,EAAC,OAAO,CAAC;IAEX,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,mBAAM,GAAE,CAAA;IACR,WAAA,IAAA,WAAE,GAAE,CAAA;IACJ,WAAA,IAAA,gBAAO,EAAC,YAAY,CAAC,CAAA;IACrB,WAAA,IAAA,gBAAO,EAAC,cAAc,CAAC,CAAA;;qCAJV,oBAAQ;;gDAgBvB;8BAtEU,mBAAmB;IAD/B,IAAA,mBAAU,EAAC,MAAM,CAAC;IAGd,WAAA,IAAA,eAAM,EAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,oCAAgB,CAAC,CAAC,CAAA;qCACjB,oCAAgB;GAHjC,mBAAmB,CAuE/B"}
+{"version":3,"file":"authorize.controller.js","sourceRoot":"","sources":["../../src/authorize/authorize.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,sCAAoD;AACpD,oDAA6C;AAC7C,2CAcwB;AACxB,iDAA6D;AAE7D,yDAAgD;AAChD,2DAAuD;AACvD,qEAAgE;AAChE,qEAAgE;AAChE,iEAA4D;AAC5D,mDAA+C;AAC/C,+CAA2C;AAE3C;;;;;;;;;;;;;GAaG;AAEI,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAC9B,YAEmB,OAAyB,EAEzB,QAA8B;QAF9B,YAAO,GAAP,OAAO,CAAkB;QAEzB,aAAQ,GAAR,QAAQ,CAAsB;IAC9C,CAAC;IAEJ;;;;;;;OAOG;IAMG,AAAN,KAAK,CAAC,SAAS,CAAU,KAAuB,EAAS,GAAa;QACpE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC;gBACtC,QAAQ,EAAE,KAAK,CAAC,SAAS;gBACzB,WAAW,EAAE,KAAK,CAAC,YAAY;gBAC/B,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,aAAa,EAAE,KAAK,CAAC,cAAc;gBACnC,mBAAmB,EAAE,KAAK,CAAC,qBAAqB;gBAChD,YAAY,EAAE,KAAK,CAAC,aAAa;gBACjC,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,6BAAU,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;gBACtD,OAAO,GAAG,CAAC,QAAQ,CACjB,GAAG,EACH,MAAM,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,KAAK,CAAC,CAC5C,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,0EAA0E;QAC1E,8DAA8D;QAC9D,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QACrC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;gBAC1D,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;QAED,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,WAAW,mBAAmB,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACjF,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAC9B,KAAuB,EACvB,KAAiB;QAEjB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC3C,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QAChE,IAAI,KAAK,CAAC,KAAK;YAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/D,4EAA4E;QAC5E,sEAAsE;QACtE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;QAChE,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC3B,CAAC;IAED;;;OAGG;IAKG,AAAN,KAAK,CAAC,aAAa,CAAU,KAAuB;QAClD,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC;gBAC7C,QAAQ,EAAE,KAAK,CAAC,SAAS;gBACzB,WAAW,EAAE,KAAK,CAAC,YAAY;gBAC/B,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,aAAa,EAAE,KAAK,CAAC,cAAc;gBACnC,mBAAmB,EAAE,KAAK,CAAC,qBAAqB;gBAChD,YAAY,EAAE,KAAK,CAAC,aAAa;gBACjC,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,4EAA4E;YAC5E,wEAAwE;YACxE,4EAA4E;YAC5E,sEAAsE;YACtE,+CAA+C;YAC/C,IAAI,KAAK,YAAY,6BAAU,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;gBACtD,MAAM,IAAI,6BAAU,CAClB,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,WAAW,EACjB,IAAI,EACJ,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAChC,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,2DAA2D;IAKrD,AAAN,KAAK,CAAC,OAAO,CAAS,EAAE,EAAE,EAAE,EAAU,IAAgB;QACpD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;YACxC,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE,IAAI,CAAC,SAAS;YACxB,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,aAAa,EAAE,IAAI,CAAC,cAAc;YAClC,mBAAmB,EAAE,IAAI,CAAC,qBAAqB;YAC/C,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;QAEH,OAAO,EAAE,IAAI,EAAE,CAAC;IAClB,CAAC;IAED;;;;;;OAMG;IAUG,AAAN,KAAK,CAAC,KAAK,CACD,IAAc,EACZ,MAAc,EAClB,SAAiB,EACA,SAAiB,EACf,SAAiB;QAE1C,IAAI,IAAI,CAAC,UAAU,KAAK,eAAe,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC;gBACvC,YAAY,EAAE,IAAI,CAAC,aAAa;gBAChC,QAAQ,EAAE,IAAI,CAAC,SAAS;gBACxB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,MAAM;gBACN,SAAS;gBACT,SAAS;gBACT,SAAS,EAAE,SAAS,IAAI,IAAI;aAC7B,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;YAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,QAAQ,EAAE,IAAI,CAAC,SAAS;YACxB,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM;YACN,SAAS;YACT,SAAS;YACT,SAAS,EAAE,SAAS,IAAI,IAAI;SAC7B,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AA7KY,kDAAmB;AAqBxB;IALL,IAAA,YAAM,GAAE;IACR,IAAA,kBAAS,EAAC,0BAAc,CAAC;IACzB,IAAA,oBAAQ,EAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC;IAChD,IAAA,mBAAU,EAAC,6CAAoB,CAAC;IAChC,IAAA,YAAG,EAAC,WAAW,CAAC;IACA,WAAA,IAAA,cAAK,GAAE,CAAA;IAA2B,WAAA,IAAA,YAAG,GAAE,CAAA;;qCAAxB,qCAAgB;;oDAgC/C;AAwBK;IAJL,IAAA,YAAM,GAAE;IACR,IAAA,kBAAS,EAAC,0BAAc,CAAC;IACzB,IAAA,oBAAQ,EAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC;IAChD,IAAA,YAAG,EAAC,gBAAgB,CAAC;IACD,WAAA,IAAA,cAAK,GAAE,CAAA;;qCAAQ,qCAAgB;;wDA2BnD;AAOK;IAJL,IAAA,YAAM,GAAE;IACR,IAAA,kBAAS,EAAC,0BAAc,CAAC;IACzB,IAAA,oBAAQ,EAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC;IAChD,IAAA,aAAI,EAAC,mBAAmB,CAAC;IACX,WAAA,IAAA,UAAI,GAAE,CAAA;IAAU,WAAA,IAAA,aAAI,GAAE,CAAA;;6CAAO,wBAAU;;kDAarD;AAkBK;IATL,IAAA,YAAM,GAAE;IACR,IAAA,kBAAS,EAAC,0BAAc,CAAC;IACzB,IAAA,oBAAQ,EAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC;IAChD,IAAA,mBAAU,EAAC,6CAAoB,CAAC;IACjC,0EAA0E;IAC1E,0DAA0D;;IACzD,IAAA,eAAM,EAAC,eAAe,EAAE,UAAU,CAAC;IACnC,IAAA,eAAM,EAAC,QAAQ,EAAE,UAAU,CAAC;IAC5B,IAAA,aAAI,EAAC,OAAO,CAAC;IAEX,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,mBAAM,GAAE,CAAA;IACR,WAAA,IAAA,WAAE,GAAE,CAAA;IACJ,WAAA,IAAA,gBAAO,EAAC,YAAY,CAAC,CAAA;IACrB,WAAA,IAAA,gBAAO,EAAC,cAAc,CAAC,CAAA;;qCAJV,oBAAQ;;gDA6BvB;8BA5KU,mBAAmB;IAD/B,IAAA,mBAAU,EAAC,MAAM,CAAC;IAGd,WAAA,IAAA,eAAM,EAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,oCAAgB,CAAC,CAAC,CAAA;IAE1C,WAAA,IAAA,eAAM,EAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,6CAAoB,CAAC,CAAC,CAAA;qCADrB,oCAAgB;QAEf,6CAAoB;GALtC,mBAAmB,CA6K/B"}

package/dist/authorize/authorize.errors.d.ts

@@ -0,0 +1,34 @@
+import { BadRequestException } from '@nestjs/common';
+/**
+ * Códigos de erro do RFC 6749 §4.1.2.1 e §5.2, mais o `invalid_target` do
+ * RFC 8707.
+ */
+export type OAuthErrorCode = 'invalid_request' | 'invalid_client' | 'invalid_grant' | 'unauthorized_client' | 'unsupported_grant_type' | 'unsupported_response_type' | 'invalid_scope' | 'invalid_target' | 'access_denied' | 'login_required' | 'server_error';
+/**
+ * Erro do fluxo OAuth.
+ *
+ * `redirectable` decide o que acontece com ele, e a distinção é normativa
+ * (RFC 6749 §4.1.2.1): erro de `client_id` ou de `redirect_uri` **não** pode
+ * voltar para o `redirect_uri` — se ele não foi validado, redirecionar seria
+ * mandar o usuário para onde o atacante pediu. Todo o resto volta para o cliente
+ * como `error` na query, que é como ele descobre o que fez de errado.
+ */
+export declare class OAuthError extends BadRequestException {
+    readonly code: OAuthErrorCode;
+    readonly description: string;
+    readonly redirectable: boolean;
+    /**
+     * Só acompanha erro redirecionável: é o `iss` que a tela precisa devolver ao
+     * cliente junto do erro (RFC 9207). No caminho de sucesso ela já o recebe em
+     * `getAuthorizationInfo`.
+     */
+    readonly issuer?: string;
+    constructor(code: OAuthErrorCode, description: string, redirectable?: boolean, 
+    /**
+     * Só acompanha erro redirecionável: é o `iss` que a tela precisa devolver ao
+     * cliente junto do erro (RFC 9207). No caminho de sucesso ela já o recebe em
+     * `getAuthorizationInfo`.
+     */
+    issuer?: string);
+}
+//# sourceMappingURL=authorize.errors.d.ts.map

package/dist/authorize/authorize.errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.errors.d.ts","sourceRoot":"","sources":["../../src/authorize/authorize.errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAErD;;;GAGG;AACH,MAAM,MAAM,cAAc,GACtB,iBAAiB,GACjB,gBAAgB,GAChB,eAAe,GACf,qBAAqB,GACrB,wBAAwB,GACxB,2BAA2B,GAC3B,eAAe,GACf,gBAAgB,GAChB,eAAe,GACf,gBAAgB,GAChB,cAAc,CAAC;AAEnB;;;;;;;;GAQG;AACH,qBAAa,UAAW,SAAQ,mBAAmB;IAM/C,QAAQ,CAAC,IAAI,EAAE,cAAc;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM;IAC5B,QAAQ,CAAC,YAAY;IACrB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM;gBARf,IAAI,EAAE,cAAc,EACpB,WAAW,EAAE,MAAM,EACnB,YAAY,UAAQ;IAC7B;;;;OAIG;IACM,MAAM,CAAC,EAAE,MAAM;CAY3B"}

package/dist/authorize/authorize.errors.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuthError = void 0;
+const common_1 = require("@nestjs/common");
+/**
+ * Erro do fluxo OAuth.
+ *
+ * `redirectable` decide o que acontece com ele, e a distinção é normativa
+ * (RFC 6749 §4.1.2.1): erro de `client_id` ou de `redirect_uri` **não** pode
+ * voltar para o `redirect_uri` — se ele não foi validado, redirecionar seria
+ * mandar o usuário para onde o atacante pediu. Todo o resto volta para o cliente
+ * como `error` na query, que é como ele descobre o que fez de errado.
+ */
+class OAuthError extends common_1.BadRequestException {
+    // Herda de BadRequestException, e nao de HttpException direto: todo erro OAuth
+    // de requisicao e um 400, e manter a hierarquia preserva qualquer `catch` que
+    // ja exista para BadRequestException — inclusive os testes que descrevem o
+    // comportamento anterior.
+    constructor(code, description, redirectable = false, 
+    /**
+     * Só acompanha erro redirecionável: é o `iss` que a tela precisa devolver ao
+     * cliente junto do erro (RFC 9207). No caminho de sucesso ela já o recebe em
+     * `getAuthorizationInfo`.
+     */
+    issuer) {
+        super(Object.assign(Object.assign({ error: code, error_description: description, redirectable }, (issuer ? { issuer } : {})), { 
+            // `message` fica junto porque os clientes ja registrados leem esse campo
+            // nas respostas de erro de hoje. Tirar seria uma quebra silenciosa.
+            message: description }));
+        this.code = code;
+        this.description = description;
+        this.redirectable = redirectable;
+        this.issuer = issuer;
+    }
+}
+exports.OAuthError = OAuthError;
+//# sourceMappingURL=authorize.errors.js.map

package/dist/authorize/authorize.errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.errors.js","sourceRoot":"","sources":["../../src/authorize/authorize.errors.ts"],"names":[],"mappings":";;;AAAA,2CAAqD;AAmBrD;;;;;;;;GAQG;AACH,MAAa,UAAW,SAAQ,4BAAmB;IACjD,+EAA+E;IAC/E,8EAA8E;IAC9E,2EAA2E;IAC3E,0BAA0B;IAC1B,YACW,IAAoB,EACpB,WAAmB,EACnB,eAAe,KAAK;IAC7B;;;;OAIG;IACM,MAAe;QAExB,KAAK,+BACH,KAAK,EAAE,IAAI,EACX,iBAAiB,EAAE,WAAW,EAC9B,YAAY,IACT,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,yEAAyE;YACzE,oEAAoE;YACpE,OAAO,EAAE,WAAW,IACpB,CAAC;QAlBM,SAAI,GAAJ,IAAI,CAAgB;QACpB,gBAAW,GAAX,WAAW,CAAQ;QACnB,iBAAY,GAAZ,YAAY,CAAQ;QAMpB,WAAM,GAAN,MAAM,CAAS;IAW1B,CAAC;CACF;AA1BD,gCA0BC"}

package/dist/authorize/authorize.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorize.module.d.ts","sourceRoot":"","sources":["../../src/authorize/authorize.module.ts"],"names":[],"mappings":"AAOA;;;;GAIG;AACH,qBAUa,eAAe;CAAG"}
+{"version":3,"file":"authorize.module.d.ts","sourceRoot":"","sources":["../../src/authorize/authorize.module.ts"],"names":[],"mappings":"AAUA;;;;GAIG;AACH,qBAYa,eAAe;CAAG"}

package/dist/authorize/authorize.module.js

@@ -11,8 +11,11 @@ const api_prisma_1 = require("@hed-hog/api-prisma");
 const common_1 = require("@nestjs/common");
 const auth_module_1 = require("../auth/auth.module");
 const security_module_1 = require("../security/security.module");
+const session_module_1 = require("../session/session.module");
+const token_module_1 = require("../token/token.module");
 const authorize_controller_1 = require("./authorize.controller");
 const authorize_service_1 = require("./authorize.service");
+const well_known_controller_1 = require("./well-known.controller");
 /**
  * Separado de OAuthModule de propósito: lá o HedHog é *client* de IdPs externos
  * (Google, Apple...). Aqui ele é o *provider*. Misturar os dois confundiria dois
@@ -27,8 +30,10 @@ exports.AuthorizeModule = AuthorizeModule = __decorate([
             (0, common_1.forwardRef)(() => api_prisma_1.PrismaModule),
             (0, common_1.forwardRef)(() => security_module_1.SecurityModule),
             (0, common_1.forwardRef)(() => auth_module_1.AuthModule),
+            (0, common_1.forwardRef)(() => session_module_1.SessionModule),
+            (0, common_1.forwardRef)(() => token_module_1.TokenModule),
         ],
-        controllers: [authorize_controller_1.AuthorizeController],
+        controllers: [authorize_controller_1.AuthorizeController, well_known_controller_1.WellKnownController],
         providers: [authorize_service_1.AuthorizeService],
         exports: [authorize_service_1.AuthorizeService],
     })

package/dist/authorize/authorize.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorize.module.js","sourceRoot":"","sources":["../../src/authorize/authorize.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,oDAAmD;AACnD,2CAAoD;AACpD,qDAAiD;AACjD,iEAA6D;AAC7D,iEAA6D;AAC7D,2DAAuD;AAEvD;;;;GAIG;AAWI,IAAM,eAAe,GAArB,MAAM,eAAe;CAAG,CAAA;AAAlB,0CAAe;0BAAf,eAAe;IAV3B,IAAA,eAAM,EAAC;QACN,OAAO,EAAE;YACP,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,yBAAY,CAAC;YAC9B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,gCAAc,CAAC;YAChC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,wBAAU,CAAC;SAC7B;QACD,WAAW,EAAE,CAAC,0CAAmB,CAAC;QAClC,SAAS,EAAE,CAAC,oCAAgB,CAAC;QAC7B,OAAO,EAAE,CAAC,oCAAgB,CAAC;KAC5B,CAAC;GACW,eAAe,CAAG"}
+{"version":3,"file":"authorize.module.js","sourceRoot":"","sources":["../../src/authorize/authorize.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,oDAAmD;AACnD,2CAAoD;AACpD,qDAAiD;AACjD,iEAA6D;AAC7D,8DAA0D;AAC1D,wDAAoD;AACpD,iEAA6D;AAC7D,2DAAuD;AACvD,mEAA8D;AAE9D;;;;GAIG;AAaI,IAAM,eAAe,GAArB,MAAM,eAAe;CAAG,CAAA;AAAlB,0CAAe;0BAAf,eAAe;IAZ3B,IAAA,eAAM,EAAC;QACN,OAAO,EAAE;YACP,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,yBAAY,CAAC;YAC9B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,gCAAc,CAAC;YAChC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,wBAAU,CAAC;YAC5B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,8BAAa,CAAC;YAC/B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,0BAAW,CAAC;SAC9B;QACD,WAAW,EAAE,CAAC,0CAAmB,EAAE,2CAAmB,CAAC;QACvD,SAAS,EAAE,CAAC,oCAAgB,CAAC;QAC7B,OAAO,EAAE,CAAC,oCAAgB,CAAC;KAC5B,CAAC;GACW,eAAe,CAAG"}

package/dist/authorize/authorize.service.d.ts

@@ -1,5 +1,8 @@
 import { PrismaService } from '@hed-hog/api-prisma';
 import { AuthService } from '../auth/auth.service';
+import { SessionService } from '../session/session.service';
+import { TokenService } from '../token/token.service';
+import { OAuthMetadataService } from './oauth-metadata.service';
 import { SecurityService } from '../security/security.service';
 /**
  * Authorization Code + PKCE — o HedHog como OAuth *provider* para apps
@@ -16,10 +19,13 @@ export declare class AuthorizeService {
     private readonly prisma;
     private readonly security;
     private readonly auth;
+    private readonly session;
+    private readonly token;
+    private readonly metadata;
     private readonly logger;
     /** Curto de propósito: o code viaja na URL e só precisa sobreviver ao redirect. */
     private readonly codeTtlMs;
-    constructor(prisma: PrismaService, security: SecurityService, auth: AuthService);
+    constructor(prisma: PrismaService, security: SecurityService, auth: AuthService, session: SessionService, token: TokenService, metadata: OAuthMetadataService);
     private getClient;
     /**
      * A allowlist é comparada por igualdade de string, não por parsing de URL:
@@ -27,17 +33,40 @@ export declare class AuthorizeService {
      * userinfo, `origin` valendo "null" em esquemas não-http).
      */
     private assertRedirectUri;
+    /**
+     * Devolve o escopo efetivo. `scope` ausente assume o que o client tem
+     * registrado — um cliente OAuth padrao pode simplesmente nao mandar o
+     * parametro, e recusa-lo seria recusar o fluxo inteiro por nada.
+     */
     private assertScope;
+    /**
+     * `resource` (RFC 8707) é uma allowlist de um item só: o /mcp deste servidor.
+     * Igualdade exata — o middleware de compatibilidade do main.ts faz `/api/mcp`
+     * responder no mesmo lugar, e comparar por prefixo deixaria nascer um token com
+     * audiência paralela que o TokenService nunca reconheceria.
+     *
+     * E ele é OBRIGATÓRIO quando a concessão inclui o escopo `mcp`. Sem essa regra
+     * o confinamento seria opt-in pela parte que ele restringe: bastava o cliente
+     * omitir o parâmetro para receber um token sem `aud` — válido na API REST
+     * inteira, com o TTL longo de login e renovável pelo /auth/refresh. Um cliente
+     * de MCP nunca deve conseguir uma sessão de propósito geral.
+     */
+    private assertResource;
+    /** RFC 6749: só `code`. Ausente, assume `code` — nenhum client atual manda. */
+    private assertResponseType;
     /** Metadados para a tela de consent. Também valida antes de qualquer redirect. */
     getAuthorizationInfo(params: {
         clientId: string;
         redirectUri: string;
-        scope: string;
+        scope?: string;
         codeChallenge: string;
         codeChallengeMethod: string;
+        responseType?: string;
+        resource?: string;
     }): Promise<{
-        clientName: any;
+        clientName: string;
         scopes: string[];
+        issuer: string;
     }>;
     /**
      * `plain` é rejeitado sem exceção: com ele o "verifier" viaja igual ao
@@ -49,9 +78,11 @@ export declare class AuthorizeService {
         userId: number;
         clientId: string;
         redirectUri: string;
-        scope: string;
+        scope?: string;
         codeChallenge: string;
         codeChallengeMethod: string;
+        responseType?: string;
+        resource?: string;
     }): Promise<string>;
     /**
      * Troca o code por tokens. O consumo é atômico (UPDATE ... WHERE consumed_at
@@ -63,6 +94,7 @@ export declare class AuthorizeService {
         codeVerifier: string;
         clientId: string;
         redirectUri: string;
+        resource?: string;
         locale: string;
         ipAddress: string;
         userAgent: string;
@@ -74,12 +106,54 @@ export declare class AuthorizeService {
          */
         browserId?: string | null;
     }): Promise<{
+        access_token: string;
         accessToken: string;
+        refresh_token: string;
         refreshToken: string;
+        token_type: string;
         tokenType: string;
+        expires_in: number;
         expiresIn: number;
         scope: string;
     }>;
+    /**
+     * Renovacao do cliente OAuth externo.
+     *
+     * Existe separado do POST /auth/refresh porque aquele devolve um token SEM
+     * `aud` — e por isso mesmo recusa sessao de conector. Aqui o `aud` e reaplicado
+     * a partir da propria sessao, que e a unica coisa que sobrevive a rotacao do
+     * refresh token (que e opaco).
+     */
+    exchangeRefreshToken(params: {
+        refreshToken: string;
+        clientId: string;
+        resource?: string;
+        locale: string;
+        ipAddress: string;
+        userAgent: string;
+        browserId?: string | null;
+    }): Promise<{
+        access_token: string;
+        accessToken: string;
+        refresh_token: string;
+        refreshToken: string;
+        token_type: string;
+        tokenType: string;
+        expires_in: number;
+        expiresIn: number;
+        scope: string;
+    }>;
+    /**
+     * `expires_in` sai do `exp` do proprio JWT recem-assinado, e nao da setting: o
+     * JwtModule le `access-token-expiration-minutes` uma UNICA vez, no boot, entao a
+     * setting e o token podem divergir ate o proximo deploy. O token e a verdade.
+     *
+     * A resposta traz snake_case e camelCase ao mesmo tempo. O RFC 6749 5.1 permite
+     * membros extras, e os cinco clientes ja registrados leem camelCase — passar so
+     * a snake_case quebraria todos de uma vez.
+     */
+    private buildTokenResponse;
+    private expiresInFromJwt;
     /** base64url(sha256(verifier)) === challenge, em tempo constante. */
     private verifyPkce;
 }

package/dist/authorize/authorize.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorize.service.d.ts","sourceRoot":"","sources":["../../src/authorize/authorize.service.ts"],"names":[],"mappings":"AAGA,OAAO,EAAU,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAS5D,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAE/D;;;;;;;;;;GAUG;AACH,qBACa,gBAAgB;IAQzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAEzB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAXvB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqC;IAE5D,mFAAmF;IACnF,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAU;gBAIjB,MAAM,EAAE,aAAa,EAErB,QAAQ,EAAE,eAAe,EAEzB,IAAI,EAAE,WAAW;YAGtB,SAAS;IAYvB;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAWzB,OAAO,CAAC,WAAW;IAYnB,kFAAkF;IAC5E,oBAAoB,CAAC,MAAM,EAAE;QACjC,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,MAAM,CAAC;QACtB,mBAAmB,EAAE,MAAM,CAAC;KAC7B;;;;IAYD;;;OAGG;IACH,OAAO,CAAC,UAAU;IAclB,4EAA4E;IACtE,SAAS,CAAC,MAAM,EAAE;QACtB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,MAAM,CAAC;QACtB,mBAAmB,EAAE,MAAM,CAAC;KAC7B,GAAG,OAAO,CAAC,MAAM,CAAC;IA8BnB;;;;OAIG;IACG,YAAY,CAAC,MAAM,EAAE;QACzB,IAAI,EAAE,MAAM,CAAC;QACb,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB;;;;;WAKG;QACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC3B;;;;;;;IAyDD,qEAAqE;IACrE,OAAO,CAAC,UAAU;CAiBnB"}
+{"version":3,"file":"authorize.service.d.ts","sourceRoot":"","sources":["../../src/authorize/authorize.service.ts"],"names":[],"mappings":"AAGA,OAAO,EAAU,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAU5D,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEtD,OAAO,EAAa,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAE/D;;;;;;;;;;GAUG;AACH,qBACa,gBAAgB;IAQzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAEzB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAErB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAExB,OAAO,CAAC,QAAQ,CAAC,KAAK;IAEtB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAjB3B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqC;IAE5D,mFAAmF;IACnF,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAU;gBAIjB,MAAM,EAAE,aAAa,EAErB,QAAQ,EAAE,eAAe,EAEzB,IAAI,EAAE,WAAW,EAEjB,OAAO,EAAE,cAAc,EAEvB,KAAK,EAAE,YAAY,EAEnB,QAAQ,EAAE,oBAAoB;YAKnC,SAAS;IAevB;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAuBzB;;;;OAIG;IACH,OAAO,CAAC,WAAW;IAiBnB;;;;;;;;;;;OAWG;YACW,cAAc;IA+B5B,+EAA+E;IAC/E,OAAO,CAAC,kBAAkB;IAU1B,kFAAkF;IAC5E,oBAAoB,CAAC,MAAM,EAAE;QACjC,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,aAAa,EAAE,MAAM,CAAC;QACtB,mBAAmB,EAAE,MAAM,CAAC;QAC5B,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB;;;;;IAsBD;;;OAGG;IACH,OAAO,CAAC,UAAU;IAkBlB,4EAA4E;IACtE,SAAS,CAAC,MAAM,EAAE;QACtB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,aAAa,EAAE,MAAM,CAAC;QACtB,mBAAmB,EAAE,MAAM,CAAC;QAC5B,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,MAAM,CAAC;IAmCnB;;;;OAIG;IACG,YAAY,CAAC,MAAM,EAAE;QACzB,IAAI,EAAE,MAAM,CAAC;QACb,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB;;;;;WAKG;QACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC3B;;;;;;;;;;;IA0ED;;;;;;;OAOG;IACG,oBAAoB,CAAC,MAAM,EAAE;QACjC,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC3B;;;;;;;;;;;IAkGD;;;;;;;;OAQG;IACH,OAAO,CAAC,kBAAkB;IAgB1B,OAAO,CAAC,gBAAgB;IAcxB,qEAAqE;IACrE,OAAO,CAAC,UAAU;CAiBnB"}