@hilbras/keystone 1.9.0 → 2.6.0

package/dist/services/oauth2.js

@@ -1,5 +1,5 @@
 import crypto from "node:crypto";
-import { eq, and, gt, isNull, or } from "drizzle-orm";
+import { eq, and, gt, isNull } from "drizzle-orm";
 import { db } from "../db/index.js";
 import { oauth2AuthorizationCodes, oauth2Consents, applications, orgMemberships, } from "../db/schema.js";
 import { config } from "../config.js";
@@ -38,8 +38,11 @@ export async function consumeAuthorizationCode(code, appId, redirectUri) {
         gt(oauth2AuthorizationCodes.expiresAt, now),
         isNull(oauth2AuthorizationCodes.usedAt),
     ];
+    // Exact match, no exceptions. `redirect_uri` is required at /authorize, so
+    // there is always a stored value to compare against; tolerating a missing one
+    // here would let a stolen code be redeemed against any redirect URI.
     if (redirectUri) {
-        conditions.push(or(isNull(oauth2AuthorizationCodes.redirectUri), eq(oauth2AuthorizationCodes.redirectUri, redirectUri)));
+        conditions.push(eq(oauth2AuthorizationCodes.redirectUri, redirectUri));
     }
     const [record] = await db
         .update(oauth2AuthorizationCodes)
@@ -48,13 +51,92 @@ export async function consumeAuthorizationCode(code, appId, redirectUri) {
         .returning();
     return record;
 }
-export function verifyPKCE(challenge, method, verifier) {
-    if (!challenge)
-        return true;
+/**
+ * Verify a PKCE code verifier against a stored challenge.
+ *
+ * `requireChallenge` exists because the previous shape of this function was the
+ * whole PKCE story at the token endpoint, and it was not a check at all:
+ *
+ * ```ts
+ * if (!challenge) return true;   // no challenge was registered -> accept
+ * ```
+ *
+ * A client that omitted `code_challenge` at `/authorize` and then sent any
+ * string as `code_verifier` at `/token` passed. The endpoint required a
+ * verifier to be *present*, so the requirement looked enforced while proving
+ * nothing. For a public client — an SPA or a mobile app that cannot hold a
+ * secret — PKCE is the only thing standing between an intercepted authorization
+ * code and a stolen account, so "optional" meant "unprotected".
+ *
+ * The two failure modes are now separated deliberately:
+ *  - no challenge and `requireChallenge` false: a confidential client that chose
+ *    not to use PKCE. Permitted, because it authenticates with a secret.
+ *  - a challenge but a mismatched or malformed verifier: always a failure.
+ */
+export function verifyPKCE(challenge, method, verifier, options = {}) {
+    if (!challenge) {
+        // No challenge to verify against. Only acceptable when PKCE was not
+        // required for this client.
+        return !options.requireChallenge;
+    }
+    if (typeof verifier !== "string" || verifier === "")
+        return false;
     if (method?.toLowerCase() !== "s256")
         return false;
     const hash = crypto.createHash("sha256").update(verifier).digest("base64url");
-    return hash === challenge;
+    return timingSafeEqual(hash, challenge);
+}
+/** Constant-time comparison, so a verifier cannot be recovered byte by byte. */
+function timingSafeEqual(a, b) {
+    const bufA = Buffer.from(a, "utf8");
+    const bufB = Buffer.from(b, "utf8");
+    if (bufA.length !== bufB.length)
+        return false;
+    return crypto.timingSafeEqual(bufA, bufB);
+}
+/**
+ * A client that cannot keep a secret must use PKCE.
+ *
+ * Today every application has a non-null `client_secret_hash`, so this reduces to
+ * "the client has no usable secret" — which is the honest test regardless of how
+ * the column is populated, and stays correct if secretless public clients are
+ * introduced later.
+ */
+export function requiresPkce(clientSecretHash) {
+    return !clientSecretHash || clientSecretHash === "";
+}
+/**
+ * Reduce requested scopes to the ones actually granted.
+ *
+ * The effective set is the intersection of what the client is registered to ask
+ * for, what it asked for, and what the user consented to. Previously the
+ * client's `scope` parameter was stored verbatim and the only filter applied was
+ * consent, so a client could put any string it liked into the issued token.
+ *
+ * Rejecting rather than silently dropping is deliberate: a client asking for
+ * something it was never registered for is a misconfiguration or an attempt to
+ * escalate, and quietly handing back a lesser scope set hides both. The error
+ * names the offending scope so the client can be fixed.
+ *
+ * An empty `allowedScopes` means "no restriction registered", which preserves
+ * every existing application. Once an application has an allowlist, it is
+ * enforced.
+ */
+export function resolveEffectiveScopes(input) {
+    const requested = [...new Set(input.requested.filter(Boolean))];
+    const allowed = new Set(input.allowed);
+    const consented = input.consented === null ? null : new Set(input.consented);
+    const effective = [];
+    for (const scope of requested) {
+        if (allowed.size > 0 && !allowed.has(scope)) {
+            return { ok: false, error: "invalid_scope", scope };
+        }
+        if (consented && !consented.has(scope)) {
+            return { ok: false, error: "invalid_scope", scope };
+        }
+        effective.push(scope);
+    }
+    return { ok: true, scopes: effective };
 }
 export async function hasConsent(userId, appId, requestedScopes) {
     if (requestedScopes.length === 0)
@@ -69,6 +151,21 @@ export async function hasConsent(userId, appId, requestedScopes) {
     const granted = new Set(consent.scopes);
     return requestedScopes.every((scope) => granted.has(scope));
 }
+/**
+ * The user's current consent record, or undefined if they have never consented
+ * or have revoked it.
+ *
+ * Kept separate from `hasConsent` because the scope intersection needs the
+ * granted set itself, not a yes/no answer to it.
+ */
+export async function findConsent(userId, appId) {
+    const [consent] = await db
+        .select()
+        .from(oauth2Consents)
+        .where(and(eq(oauth2Consents.appId, appId), eq(oauth2Consents.userId, userId), isNull(oauth2Consents.revokedAt)))
+        .limit(1);
+    return consent;
+}
 export async function grantConsent(userId, appId, scopes) {
     const now = new Date();
     const [record] = await db
@@ -114,6 +211,9 @@ export async function createTokenResponse(user, app, scopes, opts = {}) {
         appId: app.id,
         orgId: app.orgId,
         clientId: app.clientId,
+        // The granted set is persisted on the refresh token so it survives rotation
+        // instead of being dropped at the first refresh.
+        ...(scopes.length > 0 ? { scopes } : {}),
         ...(opts.mfaFactor ? { mfaFactor: opts.mfaFactor } : {}),
     };
     const tokenSet = await createTokenSet(user, opts.ip, opts.userAgent, tokenOpts, opts.deviceFingerprint);

package/dist/services/oauth2.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth2.js","sourceRoot":"","sources":["../../src/services/oauth2.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EACL,wBAAwB,EACxB,cAAc,EACd,YAAY,EACZ,cAAc,GAGf,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,cAAc,EAAE,aAAa,EAA8C,MAAM,aAAa,CAAC;AAaxG,MAAM,UAAU,yBAAyB;IACvC,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACxE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAA6B;IACxE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,yBAAyB,EAAE,CAAC;IACvD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;IAE9E,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,wBAAwB,CAAC;SAChC,MAAM,CAAC;QACN,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ;QACR,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;QAClC,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI;QAC9C,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;QACtC,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,EAAE;QAC1B,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;QAClC,SAAS;KACV,CAAC;SACD,SAAS,EAAE,CAAC;IAEf,OAAO,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAY,EACZ,KAAa,EACb,WAAoB;IAEpB,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACxE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,MAAM,UAAU,GAAG;QACjB,EAAE,CAAC,wBAAwB,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAC/C,EAAE,CAAC,wBAAwB,CAAC,KAAK,EAAE,KAAK,CAAC;QACzC,EAAE,CAAC,wBAAwB,CAAC,SAAS,EAAE,GAAG,CAAC;QAC3C,MAAM,CAAC,wBAAwB,CAAC,MAAM,CAAC;KACxC,CAAC;IACF,IAAI,WAAW,EAAE,CAAC;QAChB,UAAU,CAAC,IAAI,CACb,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,wBAAwB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAE,CACzG,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,wBAAwB,CAAC;SAChC,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;SACpB,KAAK,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC;SACzB,SAAS,EAAE,CAAC;IACf,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,SAAoC,EACpC,MAAiC,EACjC,QAAgB;IAEhB,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,MAAM,EAAE,WAAW,EAAE,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACnD,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC9E,OAAO,IAAI,KAAK,SAAS,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,MAAc,EACd,KAAa,EACb,eAAyB;IAEzB,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9C,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,EAAE;SACR,IAAI,CAAC,cAAc,CAAC;SACpB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,EAC/B,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,EACjC,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CACjC,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,KAAa,EAAE,MAAgB;IAChF,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,cAAc,CAAC;SACtB,MAAM,CAAC;QACN,KAAK;QACL,MAAM;QACN,MAAM;QACN,SAAS,EAAE,GAAG;KACf,CAAC;SACD,kBAAkB,CAAC;QAClB,MAAM,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,cAAc,CAAC,MAAM,CAAC;QACrD,GAAG,EAAE;YACH,MAAM;YACN,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,IAAI;SAChB;KACF,CAAC;SACD,SAAS,EAAE,CAAC;IACf,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAc,EAAE,KAAa;IAC/D,MAAM,EAAE;SACL,MAAM,CAAC,cAAc,CAAC;SACtB,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;SAC9B,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAAa;IACrD,OAAO,EAAE;SACN,MAAM,EAAE;SACR,IAAI,CAAC,cAAc,CAAC;SACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AACnF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAU,EACV,GAAgB,EAChB,MAAgB,EAChB,IAAI,GAMA,EAAE;IAEN,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE;SAC1B,MAAM,CAAC,EAAE,EAAE,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC;SACjC,IAAI,CAAC,cAAc,CAAC;SACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;SACnF,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAE/F,MAAM,SAAS,GAAuB;QACpC,KAAK,EAAE,GAAG,CAAC,EAAE;QACb,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzD,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,cAAc,CACnC,IAAI,EACJ,IAAI,CAAC,EAAE,EACP,IAAI,CAAC,SAAS,EACd,SAAS,EACT,IAAI,CAAC,iBAAiB,CACvB,CAAC;IAEF,MAAM,QAAQ,GAA4B;QACxC,YAAY,EAAE,QAAQ,CAAC,WAAW;QAClC,aAAa,EAAE,QAAQ,CAAC,YAAY;QACpC,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE,MAAM,CAAC,wBAAwB;QAC3C,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;KACxB,CAAC;IAEF,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,QAAQ,CAAC,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACjE,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,QAAgB;IAC9D,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,EAAE;SACR,IAAI,CAAC,YAAY,CAAC;SAClB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;SAChF,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,QAAgB,EAChB,MAAc;IAEd,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,EAAE;SACR,IAAI,CAAC,YAAY,CAAC;SAClB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;SAChF,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACtE,IAAI,GAAG,CAAC,gBAAgB,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACpD,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"oauth2.js","sourceRoot":"","sources":["../../src/services/oauth2.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EACL,wBAAwB,EACxB,cAAc,EACd,YAAY,EACZ,cAAc,GAGf,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,cAAc,EAAE,aAAa,EAA8C,MAAM,aAAa,CAAC;AAaxG,MAAM,UAAU,yBAAyB;IACvC,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACxE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAA6B;IACxE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,yBAAyB,EAAE,CAAC;IACvD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;IAE9E,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,wBAAwB,CAAC;SAChC,MAAM,CAAC;QACN,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ;QACR,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;QAClC,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI;QAC9C,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;QACtC,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,EAAE;QAC1B,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;QAClC,SAAS;KACV,CAAC;SACD,SAAS,EAAE,CAAC;IAEf,OAAO,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAY,EACZ,KAAa,EACb,WAAoB;IAEpB,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACxE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,MAAM,UAAU,GAAG;QACjB,EAAE,CAAC,wBAAwB,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAC/C,EAAE,CAAC,wBAAwB,CAAC,KAAK,EAAE,KAAK,CAAC;QACzC,EAAE,CAAC,wBAAwB,CAAC,SAAS,EAAE,GAAG,CAAC;QAC3C,MAAM,CAAC,wBAAwB,CAAC,MAAM,CAAC;KACxC,CAAC;IACF,2EAA2E;IAC3E,8EAA8E;IAC9E,qEAAqE;IACrE,IAAI,WAAW,EAAE,CAAC;QAChB,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,wBAAwB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,wBAAwB,CAAC;SAChC,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;SACpB,KAAK,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC;SACzB,SAAS,EAAE,CAAC;IACf,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,UAAU,CACxB,SAAoC,EACpC,MAAiC,EACjC,QAAmC,EACnC,OAAO,GAAmC,EAAE;IAE5C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,oEAAoE;QACpE,4BAA4B;QAC5B,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC;IACnC,CAAC;IAED,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAClE,IAAI,MAAM,EAAE,WAAW,EAAE,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAEnD,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC9E,OAAO,eAAe,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;AAC1C,CAAC;AAED,gFAAgF;AAChF,SAAS,eAAe,CAAC,CAAS,EAAE,CAAS;IAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACpC,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,gBAA2C;IACtE,OAAO,CAAC,gBAAgB,IAAI,gBAAgB,KAAK,EAAE,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAItC;IACC,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAE7E,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;QACtD,CAAC;QACD,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACvC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;QACtD,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AACzC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,MAAc,EACd,KAAa,EACb,eAAyB;IAEzB,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9C,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,EAAE;SACR,IAAI,CAAC,cAAc,CAAC;SACpB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,EAC/B,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,EACjC,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CACjC,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAc,EACd,KAAa;IAEb,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,EAAE;SACR,IAAI,CAAC,cAAc,CAAC;SACpB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,EAC/B,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,EACjC,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CACjC,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,KAAa,EAAE,MAAgB;IAChF,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,cAAc,CAAC;SACtB,MAAM,CAAC;QACN,KAAK;QACL,MAAM;QACN,MAAM;QACN,SAAS,EAAE,GAAG;KACf,CAAC;SACD,kBAAkB,CAAC;QAClB,MAAM,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,cAAc,CAAC,MAAM,CAAC;QACrD,GAAG,EAAE;YACH,MAAM;YACN,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,IAAI;SAChB;KACF,CAAC;SACD,SAAS,EAAE,CAAC;IACf,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAc,EAAE,KAAa;IAC/D,MAAM,EAAE;SACL,MAAM,CAAC,cAAc,CAAC;SACtB,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;SAC9B,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAAa;IACrD,OAAO,EAAE;SACN,MAAM,EAAE;SACR,IAAI,CAAC,cAAc,CAAC;SACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AACnF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAU,EACV,GAAgB,EAChB,MAAgB,EAChB,IAAI,GAMA,EAAE;IAEN,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE;SAC1B,MAAM,CAAC,EAAE,EAAE,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC;SACjC,IAAI,CAAC,cAAc,CAAC;SACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;SACnF,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAE/F,MAAM,SAAS,GAAuB;QACpC,KAAK,EAAE,GAAG,CAAC,EAAE;QACb,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,4EAA4E;QAC5E,iDAAiD;QACjD,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzD,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,cAAc,CACnC,IAAI,EACJ,IAAI,CAAC,EAAE,EACP,IAAI,CAAC,SAAS,EACd,SAAS,EACT,IAAI,CAAC,iBAAiB,CACvB,CAAC;IAEF,MAAM,QAAQ,GAA4B;QACxC,YAAY,EAAE,QAAQ,CAAC,WAAW;QAClC,aAAa,EAAE,QAAQ,CAAC,YAAY;QACpC,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE,MAAM,CAAC,wBAAwB;QAC3C,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;KACxB,CAAC;IAEF,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,QAAQ,CAAC,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACjE,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,QAAgB;IAC9D,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,EAAE;SACR,IAAI,CAAC,YAAY,CAAC;SAClB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;SAChF,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,QAAgB,EAChB,MAAc;IAEd,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,EAAE;SACR,IAAI,CAAC,YAAY,CAAC;SAClB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;SAChF,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACtE,IAAI,GAAG,CAAC,gBAAgB,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACpD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/services/redirectUri.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Redirect URI validation.
+ *
+ * Redirect URIs are the one place an authorization server sends a user's browser
+ * somewhere on its own authority. Anything accepted here becomes a `Location`
+ * header the identity provider itself emits, so the accepted set has to be a
+ * set a browser cannot be talked out of.
+ *
+ * Two distinct jobs, kept separate on purpose:
+ *
+ *  - {@link validateRedirectUri} decides whether a URI may be **registered**.
+ *  - {@link isRedirectUriRegistered} decides whether a URI may be **used**.
+ *
+ * Matching is exact string comparison. That is the strictest form available and
+ * the one RFC 9700 requires: no prefix matching, no normalization, no wildcards.
+ * Normalizing before comparing is what turns a strict check into a loose one,
+ * because the two sides then stop being compared as the bytes that will
+ * actually be sent.
+ */
+export interface RedirectUriRejection {
+    ok: false;
+    reason: string;
+}
+export type RedirectUriCheck = {
+    ok: true;
+} | RedirectUriRejection;
+/**
+ * Whether a redirect URI may be registered.
+ *
+ * Rejects, in order of how badly they fail:
+ *  - `javascript:`, `data:`, and friends — script execution on our own origin
+ *  - wildcards — accepted by the URL parser but can never match exactly, so they
+ *    mislead the operator into thinking a redirect is configured when it is not
+ *  - fragments — never transmitted to the server, so an exact comparison against
+ *    them can never succeed
+ *  - embedded credentials — `https://user:pass@host` is a phishing primitive
+ *  - plaintext HTTP to anything that is not loopback
+ */
+export declare function validateRedirectUri(uri: string): RedirectUriCheck;
+/**
+ * Validate a whole registration set, returning every problem rather than the
+ * first, so an operator fixing a configuration sees all of it at once.
+ */
+export declare function validateRedirectUris(uris: string[]): RedirectUriRejection[];
+/**
+ * Whether a requested redirect URI is registered.
+ *
+ * Exact string comparison, deliberately. The requested value is compared as the
+ * exact bytes that will be sent in the `Location` header, with no parsing,
+ * case-folding, trailing-slash adjustment, or default-port removal. Any of those
+ * would widen the check: `https://example.com` and `https://example.com/` are
+ * different origins paths-wise, and a comparison that treats them as equal is a
+ * comparison that can be made to match something it should not.
+ */
+export declare function isRedirectUriRegistered(registered: string[], requested: string | undefined): boolean;
+//# sourceMappingURL=redirectUri.d.ts.map

package/dist/services/redirectUri.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirectUri.d.ts","sourceRoot":"","sources":["../../src/services/redirectUri.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,gBAAgB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG,oBAAoB,CAAC;AAcnE;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,CA6DjE;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,oBAAoB,EAAE,CAiB3E;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAGpG"}

package/dist/services/redirectUri.js

@@ -0,0 +1,129 @@
+/**
+ * Redirect URI validation.
+ *
+ * Redirect URIs are the one place an authorization server sends a user's browser
+ * somewhere on its own authority. Anything accepted here becomes a `Location`
+ * header the identity provider itself emits, so the accepted set has to be a
+ * set a browser cannot be talked out of.
+ *
+ * Two distinct jobs, kept separate on purpose:
+ *
+ *  - {@link validateRedirectUri} decides whether a URI may be **registered**.
+ *  - {@link isRedirectUriRegistered} decides whether a URI may be **used**.
+ *
+ * Matching is exact string comparison. That is the strictest form available and
+ * the one RFC 9700 requires: no prefix matching, no normalization, no wildcards.
+ * Normalizing before comparing is what turns a strict check into a loose one,
+ * because the two sides then stop being compared as the bytes that will
+ * actually be sent.
+ */
+/** Schemes that would execute script or inline a document if navigated to. */
+const SCRIPT_SCHEMES = new Set(["javascript", "data", "vbscript", "blob", "file"]);
+/**
+ * Hostnames that may legitimately be reached over plaintext HTTP, because they
+ * never leave the developer's machine.
+ */
+const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]", "::1", "0.0.0.0"]);
+/** `scheme:` per RFC 3986, which custom app schemes (`myapp://`) must match. */
+const SCHEME = /^([a-z][a-z0-9+.-]*):/i;
+/**
+ * Whether a redirect URI may be registered.
+ *
+ * Rejects, in order of how badly they fail:
+ *  - `javascript:`, `data:`, and friends — script execution on our own origin
+ *  - wildcards — accepted by the URL parser but can never match exactly, so they
+ *    mislead the operator into thinking a redirect is configured when it is not
+ *  - fragments — never transmitted to the server, so an exact comparison against
+ *    them can never succeed
+ *  - embedded credentials — `https://user:pass@host` is a phishing primitive
+ *  - plaintext HTTP to anything that is not loopback
+ */
+export function validateRedirectUri(uri) {
+    if (typeof uri !== "string" || uri.trim() === "") {
+        return { ok: false, reason: "must be a non-empty string" };
+    }
+    const value = uri.trim();
+    // A wildcard is a valid URL character sequence to the parser, so it has to be
+    // rejected explicitly rather than caught by scheme or host rules.
+    if (value.includes("*")) {
+        return { ok: false, reason: "must not contain a wildcard; register each redirect URI exactly" };
+    }
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        return { ok: false, reason: "must be a valid absolute URL" };
+    }
+    const scheme = url.protocol.replace(/:$/, "").toLowerCase();
+    if (SCRIPT_SCHEMES.has(scheme)) {
+        return {
+            ok: false,
+            reason: `scheme "${scheme}" would execute script or inline a document and is never a valid redirect target`,
+        };
+    }
+    if (url.hash) {
+        return { ok: false, reason: "must not contain a fragment; fragments are not sent to the server" };
+    }
+    if (url.username || url.password) {
+        return { ok: false, reason: "must not embed credentials" };
+    }
+    if (scheme === "https") {
+        return { ok: true };
+    }
+    if (scheme === "http") {
+        const host = url.hostname.toLowerCase();
+        if (LOOPBACK_HOSTS.has(host))
+            return { ok: true };
+        return {
+            ok: false,
+            reason: "must use https; plaintext http is accepted only for loopback addresses during development",
+        };
+    }
+    // A custom scheme is how native and mobile clients receive the redirect, so it
+    // is allowed — provided it is not one of the script-bearing schemes handled
+    // above. It must be a reverse-DNS style identifier, not a bare word.
+    if (SCHEME.test(value) && url.protocol !== ":") {
+        if (!/^[a-z][a-z0-9+.-]*:$/i.test(url.protocol)) {
+            return { ok: false, reason: "scheme is malformed" };
+        }
+        return { ok: true };
+    }
+    return { ok: false, reason: `scheme "${scheme}" is not supported` };
+}
+/**
+ * Validate a whole registration set, returning every problem rather than the
+ * first, so an operator fixing a configuration sees all of it at once.
+ */
+export function validateRedirectUris(uris) {
+    const problems = [];
+    for (const uri of uris) {
+        const result = validateRedirectUri(uri);
+        if (!result.ok)
+            problems.push({ ok: false, reason: `${uri}: ${result.reason}` });
+    }
+    const seen = new Set();
+    for (const uri of uris) {
+        if (seen.has(uri)) {
+            problems.push({ ok: false, reason: `${uri}: registered more than once` });
+        }
+        seen.add(uri);
+    }
+    return problems;
+}
+/**
+ * Whether a requested redirect URI is registered.
+ *
+ * Exact string comparison, deliberately. The requested value is compared as the
+ * exact bytes that will be sent in the `Location` header, with no parsing,
+ * case-folding, trailing-slash adjustment, or default-port removal. Any of those
+ * would widen the check: `https://example.com` and `https://example.com/` are
+ * different origins paths-wise, and a comparison that treats them as equal is a
+ * comparison that can be made to match something it should not.
+ */
+export function isRedirectUriRegistered(registered, requested) {
+    if (typeof requested !== "string" || requested === "")
+        return false;
+    return registered.includes(requested);
+}
+//# sourceMappingURL=redirectUri.js.map

package/dist/services/redirectUri.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirectUri.js","sourceRoot":"","sources":["../../src/services/redirectUri.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AASH,8EAA8E;AAC9E,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAEnF;;;GAGG;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;AAEtF,gFAAgF;AAChF,MAAM,MAAM,GAAG,wBAAwB,CAAC;AAExC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACjD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IAC7D,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAEzB,8EAA8E;IAC9E,kEAAkE;IAClE,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iEAAiE,EAAE,CAAC;IAClG,CAAC;IAED,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;IAC/D,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAE5D,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,WAAW,MAAM,kFAAkF;SAC5G,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mEAAmE,EAAE,CAAC;IACpG,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IAC7D,CAAC;IAED,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACvB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACxC,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAClD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,2FAA2F;SACpG,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,4EAA4E;IAC5E,qEAAqE;IACrE,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;QAC/C,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;QACtD,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,MAAM,oBAAoB,EAAE,CAAC;AACtE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAc;IACjD,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAE5C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,KAAK,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,6BAA6B,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChB,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CAAC,UAAoB,EAAE,SAA6B;IACzF,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACpE,OAAO,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AACxC,CAAC"}

package/dist/services/scopes.d.ts

@@ -0,0 +1,113 @@
+/**
+ * API key scope registry.
+ *
+ * API key scopes used to be decorative. `requireScopes` existed and was
+ * decorated onto the Fastify instance, but no route referenced it, so a key
+ * issued with the default `["api:read"]` carried exactly the same authority as
+ * the user who created it. Scopes were also free-form: a caller could request
+ * any string at key creation, including the literal `"service_account"` that
+ * `requireScopes` treated as a wildcard.
+ *
+ * A registry fixes both halves. A scope that is not defined here cannot be
+ * granted, so there is no string an attacker can invent; and a route that needs a
+ * scope names it from this list, so enforcement cannot silently drift out of
+ * date the way an unreferenced decorator did.
+ */
+/** Every scope Keystone recognises. Order is the order shown to operators. */
+export declare const API_KEY_SCOPES: {
+    /** Read the caller's own profile, sessions, and keys. */
+    readonly "profile:read": "Read your own profile and identity";
+    readonly "profile:write": "Update your own profile";
+    /** Read sessions belonging to the caller. */
+    readonly "sessions:read": "List your own sessions";
+    readonly "sessions:revoke": "Revoke your own sessions";
+    /** Manage the caller's own API keys. */
+    readonly "api_keys:read": "List your own API keys";
+    readonly "api_keys:revoke": "Revoke your own API keys";
+    /** Read organization members and applications. */
+    readonly "organizations:read": "Read organization membership and applications";
+    /** Manage organization members, applications, and roles. */
+    readonly "organizations:write": "Manage organization membership and applications";
+    /** Read and manage webhooks. */
+    readonly "webhooks:manage": "Create, update, and delete webhooks";
+    /** Read and manage workflows. */
+    readonly "workflows:read": "Read workflows and their runs";
+    readonly "workflows:write": "Create and update workflows";
+    /** Second-factor management. Never appropriate for a machine credential. */
+    readonly "mfa:manage": "Enroll, verify, and disable TOTP and backup codes";
+};
+export type ApiKeyScope = keyof typeof API_KEY_SCOPES;
+export declare function isApiKeyScope(value: string): value is ApiKeyScope;
+export declare function knownScopes(): ApiKeyScope[];
+/** Human-readable description of a scope, for API responses and dashboards. */
+export declare function describeScope(scope: string): string | undefined;
+/**
+ * Scopes granted to a service account by default.
+ *
+ * Deliberately excludes anything interactive: a machine credential has no user
+ * present to complete a second factor, no real profile, and no sessions worth
+ * listing. A service account that needs more is granted it explicitly.
+ */
+export declare const SERVICE_ACCOUNT_DEFAULT_SCOPES: ApiKeyScope[];
+/**
+ * Scopes a new personal API key receives when the caller names none.
+ *
+ * Read-only and confined to the caller's own resources. The previous default,
+ * `["api:read"]`, was not in the registry at all — which is a fair indicator that
+ * nothing was checking it.
+ */
+export declare const PERSONAL_KEY_DEFAULT_SCOPES: ApiKeyScope[];
+/**
+ * Scopes that may never be granted to a machine credential.
+ *
+ * `mfa:manage` because a second factor is enrolled by a person holding an
+ * authenticator; `MfaRequiredError` is raised when a token is minted for a user
+ * with TOTP enabled and no recorded factor, and a service account has no
+ * authenticator to record.
+ *
+ * `profile:*` because a service account's "profile" is a synthesized object with
+ * an id of `sa:<uuid>` that matches no user row. Reading it returns nothing real,
+ * and writing it would update zero rows -- so the scope is meaningless for a
+ * machine and misleading in an audit log that shows what a key was used for.
+ */
+export declare const HUMAN_ONLY_SCOPES: readonly ApiKeyScope[];
+export interface ScopeValidation {
+    ok: boolean;
+    /** Unknown scopes, which must be refused rather than stored. */
+    unknown: string[];
+    /** Scopes refused because a service account may not hold them. */
+    forbiddenForServiceAccount: string[];
+    /** The accepted set, de-duplicated and in registry order. */
+    scopes: ApiKeyScope[];
+}
+/**
+ * Validate a requested scope set.
+ *
+ * Unknown scopes are refused rather than dropped. Silently discarding a scope a
+ * caller asked for hides both a typo and an attempt to smuggle an unrecognised
+ * privilege past a review, and it leaves the caller believing they hold
+ * something they do not.
+ */
+export declare function validateScopes(requested: string[] | undefined, options?: {
+    principal: "user" | "service_account";
+    fallback?: ApiKeyScope[];
+}): ScopeValidation;
+/**
+ * Narrow a key's stored scopes to what the caller is actually entitled to.
+ *
+ * A key never gains authority from its own record. The effective set is what the
+ * key holds *intersected with* what its principal could do directly, so revoking
+ * a role or removing a membership takes effect on the key too rather than
+ * leaving a stale grant behind.
+ */
+export declare function intersectScopes(granted: string[] | null | undefined, principalAllows: string[]): ApiKeyScope[];
+/**
+ * Grant check used by `requireScopes`.
+ *
+ * Explicit allow-list membership only. The previous implementation also accepted
+ * a key whose scopes merely *contained* the string `"service_account"`, which is
+ * a bypass by construction: that string was client-suppliable at key creation, so
+ * any key created with `scopes: ["service_account"]` satisfied every check.
+ */
+export declare function hasScopes(granted: string[] | null | undefined, required: readonly string[]): boolean;
+//# sourceMappingURL=scopes.d.ts.map

package/dist/services/scopes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopes.d.ts","sourceRoot":"","sources":["../../src/services/scopes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,8EAA8E;AAC9E,eAAO,MAAM,cAAc;IACzB,yDAAyD;aACzD,cAAc,EAAE,oCAAoC;aACpD,eAAe,EAAE,yBAAyB;IAC1C,6CAA6C;aAC7C,eAAe,EAAE,wBAAwB;aACzC,iBAAiB,EAAE,0BAA0B;IAC7C,wCAAwC;aACxC,eAAe,EAAE,wBAAwB;aACzC,iBAAiB,EAAE,0BAA0B;IAC7C,kDAAkD;aAClD,oBAAoB,EAAE,+CAA+C;IACrE,4DAA4D;aAC5D,qBAAqB,EAAE,iDAAiD;IACxE,gCAAgC;aAChC,iBAAiB,EAAE,qCAAqC;IACxD,iCAAiC;aACjC,gBAAgB,EAAE,+BAA+B;aACjD,iBAAiB,EAAE,6BAA6B;IAChD,4EAA4E;aAC5E,YAAY,EAAE,mDAAmD;CACzD,CAAC;AAEX,MAAM,MAAM,WAAW,GAAG,MAAM,OAAO,cAAc,CAAC;AAItD,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,WAAW,CAEjE;AAED,wBAAgB,WAAW,IAAI,WAAW,EAAE,CAE3C;AAED,+EAA+E;AAC/E,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAE/D;AAED;;;;;;GAMG;AACH,eAAO,MAAM,8BAA8B,EAAE,WAAW,EAA2B,CAAC;AAEpF;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,EAAE,WAAW,EAAuD,CAAC;AAE7G;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iBAAiB,EAAE,SAAS,WAAW,EAInD,CAAC;AAEF,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAC;IACZ,gEAAgE;IAChE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,kEAAkE;IAClE,0BAA0B,EAAE,MAAM,EAAE,CAAC;IACrC,6DAA6D;IAC7D,MAAM,EAAE,WAAW,EAAE,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC5B,SAAS,EAAE,MAAM,EAAE,GAAG,SAAS,EAC/B,OAAO,GAAE;IAAE,SAAS,EAAE,MAAM,GAAG,iBAAiB,CAAC;IAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,CAAA;CAA0B,GACnG,eAAe,CAwBjB;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,GAAG,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,WAAW,EAAE,CAI9G;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,GAAG,SAAS,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAIpG"}

package/dist/services/scopes.js

@@ -0,0 +1,138 @@
+/**
+ * API key scope registry.
+ *
+ * API key scopes used to be decorative. `requireScopes` existed and was
+ * decorated onto the Fastify instance, but no route referenced it, so a key
+ * issued with the default `["api:read"]` carried exactly the same authority as
+ * the user who created it. Scopes were also free-form: a caller could request
+ * any string at key creation, including the literal `"service_account"` that
+ * `requireScopes` treated as a wildcard.
+ *
+ * A registry fixes both halves. A scope that is not defined here cannot be
+ * granted, so there is no string an attacker can invent; and a route that needs a
+ * scope names it from this list, so enforcement cannot silently drift out of
+ * date the way an unreferenced decorator did.
+ */
+/** Every scope Keystone recognises. Order is the order shown to operators. */
+export const API_KEY_SCOPES = {
+    /** Read the caller's own profile, sessions, and keys. */
+    "profile:read": "Read your own profile and identity",
+    "profile:write": "Update your own profile",
+    /** Read sessions belonging to the caller. */
+    "sessions:read": "List your own sessions",
+    "sessions:revoke": "Revoke your own sessions",
+    /** Manage the caller's own API keys. */
+    "api_keys:read": "List your own API keys",
+    "api_keys:revoke": "Revoke your own API keys",
+    /** Read organization members and applications. */
+    "organizations:read": "Read organization membership and applications",
+    /** Manage organization members, applications, and roles. */
+    "organizations:write": "Manage organization membership and applications",
+    /** Read and manage webhooks. */
+    "webhooks:manage": "Create, update, and delete webhooks",
+    /** Read and manage workflows. */
+    "workflows:read": "Read workflows and their runs",
+    "workflows:write": "Create and update workflows",
+    /** Second-factor management. Never appropriate for a machine credential. */
+    "mfa:manage": "Enroll, verify, and disable TOTP and backup codes",
+};
+const ALL_SCOPES = Object.keys(API_KEY_SCOPES);
+export function isApiKeyScope(value) {
+    return Object.prototype.hasOwnProperty.call(API_KEY_SCOPES, value);
+}
+export function knownScopes() {
+    return [...ALL_SCOPES];
+}
+/** Human-readable description of a scope, for API responses and dashboards. */
+export function describeScope(scope) {
+    return isApiKeyScope(scope) ? API_KEY_SCOPES[scope] : undefined;
+}
+/**
+ * Scopes granted to a service account by default.
+ *
+ * Deliberately excludes anything interactive: a machine credential has no user
+ * present to complete a second factor, no real profile, and no sessions worth
+ * listing. A service account that needs more is granted it explicitly.
+ */
+export const SERVICE_ACCOUNT_DEFAULT_SCOPES = ["organizations:read"];
+/**
+ * Scopes a new personal API key receives when the caller names none.
+ *
+ * Read-only and confined to the caller's own resources. The previous default,
+ * `["api:read"]`, was not in the registry at all — which is a fair indicator that
+ * nothing was checking it.
+ */
+export const PERSONAL_KEY_DEFAULT_SCOPES = ["profile:read", "sessions:read", "api_keys:read"];
+/**
+ * Scopes that may never be granted to a machine credential.
+ *
+ * `mfa:manage` because a second factor is enrolled by a person holding an
+ * authenticator; `MfaRequiredError` is raised when a token is minted for a user
+ * with TOTP enabled and no recorded factor, and a service account has no
+ * authenticator to record.
+ *
+ * `profile:*` because a service account's "profile" is a synthesized object with
+ * an id of `sa:<uuid>` that matches no user row. Reading it returns nothing real,
+ * and writing it would update zero rows -- so the scope is meaningless for a
+ * machine and misleading in an audit log that shows what a key was used for.
+ */
+export const HUMAN_ONLY_SCOPES = [
+    "mfa:manage",
+    "profile:read",
+    "profile:write",
+];
+/**
+ * Validate a requested scope set.
+ *
+ * Unknown scopes are refused rather than dropped. Silently discarding a scope a
+ * caller asked for hides both a typo and an attempt to smuggle an unrecognised
+ * privilege past a review, and it leaves the caller believing they hold
+ * something they do not.
+ */
+export function validateScopes(requested, options = { principal: "user" }) {
+    const wanted = requested && requested.length > 0
+        ? requested
+        : (options.fallback ??
+            (options.principal === "service_account" ? SERVICE_ACCOUNT_DEFAULT_SCOPES : PERSONAL_KEY_DEFAULT_SCOPES));
+    const unknown = wanted.filter((scope) => !isApiKeyScope(scope));
+    const known = wanted.filter(isApiKeyScope);
+    const forbidden = options.principal === "service_account"
+        ? known.filter((scope) => HUMAN_ONLY_SCOPES.includes(scope))
+        : [];
+    const allowed = known.filter((scope) => !forbidden.includes(scope));
+    return {
+        ok: unknown.length === 0 && forbidden.length === 0,
+        unknown,
+        forbiddenForServiceAccount: forbidden,
+        // Registry order, so two equivalent requests produce identical rows.
+        scopes: ALL_SCOPES.filter((scope) => allowed.includes(scope)),
+    };
+}
+/**
+ * Narrow a key's stored scopes to what the caller is actually entitled to.
+ *
+ * A key never gains authority from its own record. The effective set is what the
+ * key holds *intersected with* what its principal could do directly, so revoking
+ * a role or removing a membership takes effect on the key too rather than
+ * leaving a stale grant behind.
+ */
+export function intersectScopes(granted, principalAllows) {
+    const held = new Set((granted ?? []).filter(isApiKeyScope));
+    const allowed = new Set(principalAllows.filter(isApiKeyScope));
+    return ALL_SCOPES.filter((scope) => held.has(scope) && allowed.has(scope));
+}
+/**
+ * Grant check used by `requireScopes`.
+ *
+ * Explicit allow-list membership only. The previous implementation also accepted
+ * a key whose scopes merely *contained* the string `"service_account"`, which is
+ * a bypass by construction: that string was client-suppliable at key creation, so
+ * any key created with `scopes: ["service_account"]` satisfied every check.
+ */
+export function hasScopes(granted, required) {
+    if (required.length === 0)
+        return true;
+    const held = new Set(granted ?? []);
+    return required.every((scope) => held.has(scope));
+}
+//# sourceMappingURL=scopes.js.map

package/dist/services/scopes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopes.js","sourceRoot":"","sources":["../../src/services/scopes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,8EAA8E;AAC9E,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,yDAAyD;IACzD,cAAc,EAAE,oCAAoC;IACpD,eAAe,EAAE,yBAAyB;IAC1C,6CAA6C;IAC7C,eAAe,EAAE,wBAAwB;IACzC,iBAAiB,EAAE,0BAA0B;IAC7C,wCAAwC;IACxC,eAAe,EAAE,wBAAwB;IACzC,iBAAiB,EAAE,0BAA0B;IAC7C,kDAAkD;IAClD,oBAAoB,EAAE,+CAA+C;IACrE,4DAA4D;IAC5D,qBAAqB,EAAE,iDAAiD;IACxE,gCAAgC;IAChC,iBAAiB,EAAE,qCAAqC;IACxD,iCAAiC;IACjC,gBAAgB,EAAE,+BAA+B;IACjD,iBAAiB,EAAE,6BAA6B;IAChD,4EAA4E;IAC5E,YAAY,EAAE,mDAAmD;CACzD,CAAC;AAIX,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAkB,CAAC;AAEhE,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,OAAO,CAAC,GAAG,UAAU,CAAC,CAAC;AACzB,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAClE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAkB,CAAC,oBAAoB,CAAC,CAAC;AAEpF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAkB,CAAC,cAAc,EAAE,eAAe,EAAE,eAAe,CAAC,CAAC;AAE7G;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA2B;IACvD,YAAY;IACZ,cAAc;IACd,eAAe;CAChB,CAAC;AAYF;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC5B,SAA+B,EAC/B,OAAO,GAAwE,EAAE,SAAS,EAAE,MAAM,EAAE;IAEpG,MAAM,MAAM,GACV,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QAC/B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ;YACjB,CAAC,OAAO,CAAC,SAAS,KAAK,iBAAiB,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC;IAEhH,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IAEhE,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC3C,MAAM,SAAS,GACb,OAAO,CAAC,SAAS,KAAK,iBAAiB;QACrC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC5D,CAAC,CAAC,EAAE,CAAC;IAET,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAEpE,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAClD,OAAO;QACP,0BAA0B,EAAE,SAAS;QACrC,qEAAqE;QACrE,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;KAC9D,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,OAAoC,EAAE,eAAyB;IAC7F,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;IAC/D,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CAAC,OAAoC,EAAE,QAA2B;IACzF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IACpC,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AACpD,CAAC"}