@hilbras/keystone 1.9.0 → 2.6.0

package/dist/routes/oauth2.js

@@ -1,13 +1,23 @@
 import { z } from "zod";
+import { isRedirectUriRegistered, validateRedirectUri } from "../services/redirectUri.js";
+/**
+ * A redirect URI must survive the same validation at use time as at registration
+ * time, so a value that could never have been registered is also refused here.
+ */
+const redirectUriParam = z.string().superRefine((value, ctx) => {
+    const result = validateRedirectUri(value);
+    if (!result.ok)
+        ctx.addIssue({ code: z.ZodIssueCode.custom, message: result.reason });
+});
 import { config } from "../config.js";
-import { storeAuthorizationCode, consumeAuthorizationCode, verifyPKCE, hasConsent, grantConsent, revokeConsent, createTokenResponse, findApplicationByClientId, verifyClientSecret, } from "../services/oauth2.js";
+import { storeAuthorizationCode, consumeAuthorizationCode, verifyPKCE, requiresPkce, findConsent, resolveEffectiveScopes, grantConsent, revokeConsent, createTokenResponse, findApplicationByClientId, verifyClientSecret, } from "../services/oauth2.js";
 import { findUserById } from "../services/users.js";
 import { revokeRefreshToken, createApplicationAccessToken, rotateRefreshToken, MfaRequiredError, } from "../services/tokens.js";
 import { fingerprintFromRequest } from "../services/devices.js";
 import { rateLimit } from "../plugins/rateLimit.js";
 const AuthorizeQuerySchema = z.object({
     client_id: z.string(),
-    redirect_uri: z.string().url(),
+    redirect_uri: redirectUriParam,
     response_type: z.literal("code"),
     scope: z.string().optional(),
     state: z.string().optional(),
@@ -18,7 +28,7 @@ const AuthorizeQuerySchema = z.object({
 const TokenBodySchema = z.object({
     grant_type: z.enum(["authorization_code", "refresh_token", "client_credentials"]),
     code: z.string().optional(),
-    redirect_uri: z.string().url().optional(),
+    redirect_uri: redirectUriParam.optional(),
     code_verifier: z.string().min(43).max(128).optional(),
     refresh_token: z.string().optional(),
     client_id: z.string().optional(),
@@ -77,16 +87,57 @@ export default async function oauth2Routes(app) {
                 error_description: "You are not a member of the application organization",
             });
         }
-        if (!application.redirectUris.includes(query.redirect_uri)) {
+        // Exact string comparison, via the shared helper so registration-time and
+        // use-time rules cannot drift apart.
+        if (!isRedirectUriRegistered(application.redirectUris, query.redirect_uri)) {
             return reply
                 .status(400)
                 .send({ error: "invalid_redirect_uri", error_description: "Redirect URI not registered" });
         }
+        // A client that cannot keep a secret gets no protection from the
+        // client-authentication step, so PKCE is not optional for it: an
+        // intercepted code would otherwise be redeemable by whoever intercepted
+        // it. Reject here rather than at /token, so the client learns before the
+        // user is redirected.
+        const pkceRequired = requiresPkce(application.clientSecretHash);
+        if (pkceRequired && !query.code_challenge) {
+            return reply.status(400).send({
+                error: "invalid_request",
+                error_description: "code_challenge is required for this client",
+            });
+        }
+        if (query.code_challenge && query.code_challenge_method !== "S256") {
+            return reply.status(400).send({
+                error: "invalid_request",
+                error_description: "code_challenge_method must be S256; plain is not accepted",
+            });
+        }
         request.state.membership = membership;
         request.state.org = await app.container.organizationRepository.findById(application.orgId);
         const scopes = query.scope ? query.scope.split(" ").filter(Boolean) : [];
-        const consent = await hasConsent(request.user.id, application.id, scopes);
-        if (!consent) {
+        // Effective scopes are the intersection of registered, requested, and
+        // consented. An unregistered or unconsented scope is refused outright
+        // rather than quietly dropped, so a client asking for more than it has is
+        // visible instead of silently downgraded.
+        const consentRecord = await findConsent(request.user.id, application.id);
+        const resolved = resolveEffectiveScopes({
+            requested: scopes,
+            allowed: application.allowedScopes ?? [],
+            consented: consentRecord ? consentRecord.scopes : [],
+        });
+        if (!resolved.ok) {
+            await request.audit("unauthorized_access", {
+                action: "oauth_scope_not_registered",
+                appId: application.id,
+                orgId: application.orgId,
+                scope: resolved.scope,
+            });
+            return reply.status(400).send({
+                error: resolved.error,
+                error_description: `Scope "${resolved.scope}" is not available to this client`,
+            });
+        }
+        if (!consentRecord && resolved.scopes.length > 0) {
             return reply.status(403).send({
                 error: "consent_required",
                 error_description: "User consent required",
@@ -101,7 +152,7 @@ export default async function oauth2Routes(app) {
             challenge: query.code_challenge,
             challengeMethod: query.code_challenge_method,
             redirectUri: query.redirect_uri,
-            scopes,
+            scopes: resolved.scopes,
             nonce: query.nonce,
             ...(sessionMfaFactor ? { mfaFactor: sessionMfaFactor } : {}),
         });
@@ -134,15 +185,37 @@ export default async function oauth2Routes(app) {
             if (!application) {
                 return reply.status(400).send({ error: "invalid_client" });
             }
+            // RFC 6749 3.2.1: a confidential client must authenticate at the token
+            // endpoint. This grant previously looked the client up and went straight
+            // to redeeming the code, so client authentication was skipped entirely
+            // and the code plus its PKCE verifier were the only factors. A public
+            // client is exempt because it has no secret to present -- PKCE is what it
+            // authenticates with, and that is enforced immediately below.
+            const authenticatesWithSecret = !requiresPkce(application.clientSecretHash);
+            if (authenticatesWithSecret) {
+                const authenticated = await verifyClientSecret(body.client_id, body.client_secret ?? "");
+                if (!authenticated) {
+                    await request.audit("oauth2_token", {
+                        appId: application.id,
+                        clientId: application.clientId,
+                        grantType: "authorization_code",
+                        outcome: "invalid_client",
+                    });
+                    return reply.status(401).send({ error: "invalid_client" });
+                }
+            }
             const record = await consumeAuthorizationCode(body.code, application.id, body.redirect_uri);
             if (!record) {
                 return reply.status(400).send({ error: "invalid_grant" });
             }
-            const verifier = body.code_verifier;
-            if (!verifier) {
-                return reply.status(400).send({ error: "invalid_request", error_description: "PKCE verifier required" });
+            const pkceRequired = requiresPkce(application.clientSecretHash);
+            if (!body.code_verifier && pkceRequired) {
+                return reply.status(400).send({
+                    error: "invalid_request",
+                    error_description: "code_verifier is required for this client",
+                });
             }
-            if (!verifyPKCE(record.challenge, record.challengeMethod, verifier)) {
+            if (!verifyPKCE(record.challenge, record.challengeMethod, body.code_verifier, { requireChallenge: pkceRequired })) {
                 return reply.status(400).send({ error: "invalid_grant", error_description: "PKCE verification failed" });
             }
             const user = await findUserById(record.userId);
@@ -261,7 +334,10 @@ export default async function oauth2Routes(app) {
         }
         return reply.status(400).send({ error: "unsupported_grant_type" });
     });
-    app.get("/userinfo", { preHandler: [app.authenticate] }, async (request) => {
+    app.get("/userinfo", { preHandler: [app.authenticate,
+            // the userinfo claims describe a person. Placed after app.authenticate, which is what
+            // populates request.serviceAccount.
+            app.requireHumanPrincipal()] }, async (request) => {
         const user = request.user;
         return {
             sub: user.id,
@@ -278,7 +354,10 @@ export default async function oauth2Routes(app) {
         await request.audit("oauth2_revoke", {});
         return { success: true };
     });
-    app.post("/consent", { preHandler: [app.authenticate] }, async (request, reply) => {
+    app.post("/consent", { preHandler: [app.authenticate,
+            // consent is a human authorization decision. Placed after app.authenticate, which is what
+            // populates request.serviceAccount.
+            app.requireHumanPrincipal()] }, async (request, reply) => {
         const body = ConsentBodySchema.parse(request.body);
         const application = await findApplicationByClientId(body.client_id);
         if (!application) {

package/dist/routes/oauth2.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth2.js","sourceRoot":"","sources":["../../src/routes/oauth2.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,UAAU,EACV,UAAU,EACV,YAAY,EACZ,aAAa,EACb,mBAAmB,EACnB,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EACL,kBAAkB,EAClB,4BAA4B,EAC5B,kBAAkB,EAClB,gBAAgB,GAEjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAEpD,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC9B,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAChC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC3C,qBAAqB,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACxC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,oBAAoB,EAAE,eAAe,EAAE,oBAAoB,CAAC,CAAC;IACjF,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACzC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACrD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACvC,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE;CACnB,CAAC,CAAC;AAOH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS,CAAC,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;AAEvF;;;;GAIG;AACH,SAAS,cAAc,CAAC,KAAgC;IACtD,OAAO,KAAK,IAAI,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAsB,CAAC,CAAC,CAAC,SAAS,CAAC;AAClF,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAuB,EAAE,IAAuB;IAChF,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;IACjD,IAAI,UAAU,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC5E,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACpD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,YAAY,CAAC,GAAoB;IAC7D,GAAG,CAAC,GAAG,CACL,YAAY,EACZ;QACE,UAAU,EAAE;YACV,GAAG,CAAC,YAAY;YAChB,SAAS,CAAC,EAAE,SAAS,EAAE,kBAAkB,EAAE,WAAW,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;SACjF;KACF,EACD,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,KAAK,GAAG,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAExD,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAClG,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,cAAc,CAC1E,WAAW,CAAC,KAAK,EACjB,OAAO,CAAC,IAAK,CAAC,EAAE,CACjB,CAAC;QACF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE;gBACzC,MAAM,EAAE,qCAAqC;gBAC7C,KAAK,EAAE,WAAW,CAAC,EAAE;gBACrB,KAAK,EAAE,WAAW,CAAC,KAAK;aACzB,CAAC,CAAC;YACH,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE,YAAY;gBACnB,iBAAiB,EAAE,sDAAsD;aAC1E,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;YAC3D,OAAO,KAAK;iBACT,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAC/F,CAAC;QAED,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC;QACtC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAC3F,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAEzE,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,IAAK,CAAC,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC3E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE,kBAAkB;gBACzB,iBAAiB,EAAE,uBAAuB;aAC3C,CAAC,CAAC;QACL,CAAC;QAED,wEAAwE;QACxE,yEAAyE;QACzE,MAAM,gBAAgB,GAAG,cAAc,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAExE,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC;YAC1C,KAAK,EAAE,WAAW,CAAC,EAAE;YACrB,MAAM,EAAE,OAAO,CAAC,IAAK,CAAC,EAAE;YACxB,SAAS,EAAE,KAAK,CAAC,cAAc;YAC/B,eAAe,EAAE,KAAK,CAAC,qBAAqB;YAC5C,WAAW,EAAE,KAAK,CAAC,YAAY;YAC/B,MAAM;YACN,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7D,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,KAAK,CAAC,KAAK;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAE5D,MAAM,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE;YACtC,KAAK,EAAE,WAAW,CAAC,EAAE;YACrB,QAAQ,EAAE,WAAW,CAAC,QAAQ;SAC/B,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IACxC,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,QAAQ,EACR;QACE,UAAU,EAAE,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,CAAC;KAC3F,EACD,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACvD,MAAM,WAAW,GAAG,wBAAwB,CAAC,OAAO,EAAE;YACpD,QAAQ,EAAE,UAAU,CAAC,SAAS;YAC9B,YAAY,EAAE,UAAU,CAAC,aAAa;SACvC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,EAAE,GAAG,UAAU,EAAE,SAAS,EAAE,WAAW,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,CAAC,YAAY,EAAE,CAAC;QAEzG,IAAI,IAAI,CAAC,UAAU,KAAK,oBAAoB,EAAE,CAAC;YAC7C,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;gBACxD,OAAO,KAAK;qBACT,MAAM,CAAC,GAAG,CAAC;qBACX,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,gDAAgD,EAAE,CAAC,CAAC;YAC7G,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACpE,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAC7D,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;YAC5F,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YAC5D,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC;YACpC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,CAAC,CAAC;YAC3G,CAAC;YAED,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,eAAe,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACpE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,CAAC,CAAC;YAC3G,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC/C,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC;gBACpB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YAC5D,CAAC;YAED,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,cAAc,CAC1E,WAAW,CAAC,KAAK,EACjB,IAAI,CAAC,EAAE,CACR,CAAC;YACF,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE;oBACzC,MAAM,EAAE,qCAAqC;oBAC7C,KAAK,EAAE,WAAW,CAAC,EAAE;oBACrB,KAAK,EAAE,WAAW,CAAC,KAAK;iBACzB,CAAC,CAAC;gBACH,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YAC5D,CAAC;YAED,OAAO,CAAC,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,EAAE,CAAC;YACpC,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC;YACtC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAC3F,MAAM,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE;gBAClC,KAAK,EAAE,WAAW,CAAC,EAAE;gBACrB,QAAQ,EAAE,WAAW,CAAC,QAAQ;gBAC9B,SAAS,EAAE,oBAAoB;aAChC,CAAC,CAAC;YAEH,MAAM,eAAe,GAAG,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACzD,MAAM,WAAW,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;YACpD,IAAI,CAAC;gBACH,OAAO,MAAM,mBAAmB,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE;oBACjE,EAAE,EAAE,OAAO,CAAC,EAAE;oBACd,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC;oBACxC,iBAAiB,EAAE,WAAW;oBAC9B,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,SAAS;oBAChC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC3D,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,gBAAgB,EAAE,CAAC;oBACpC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;wBAC5B,KAAK,EAAE,cAAc;wBACrB,iBAAiB,EACf,gHAAgH;qBACnH,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,KAAK,eAAe,EAAE,CAAC;YACxC,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;gBAClE,MAAM,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE;oBAC3C,QAAQ,EAAE,IAAI,CAAC,SAAS;oBACxB,MAAM,EAAE,iBAAiB;iBAC1B,CAAC,CAAC;gBACH,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC9D,CAAC;YACD,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;YACjF,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,MAAM,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE;oBAC3C,QAAQ,EAAE,IAAI,CAAC,SAAS;oBACxB,MAAM,EAAE,gBAAgB;iBACzB,CAAC,CAAC;gBACH,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAC7D,CAAC;YAED,4CAA4C;YAC5C,MAAM,MAAM,GAAG,MAAM,kBAAkB,CACrC,IAAI,CAAC,aAAa,EAClB,OAAO,CAAC,EAAE,EACV,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EAC7B,IAAI,CAAC,SAAS,EACd,WAAW,CAAC,EAAE,CACf,CAAC;YACF,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,WAAW,CAAC;gBAChC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;gBAC3F,MAAM,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE;oBAC3C,KAAK,EAAE,WAAW,CAAC,EAAE;oBACrB,KAAK,EAAE,WAAW,CAAC,KAAK;oBACxB,QAAQ,EAAE,WAAW,CAAC,QAAQ;oBAC9B,MAAM,EAAE,eAAe;iBACxB,CAAC,CAAC;gBACH,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YAC5D,CAAC;YAED,OAAO,CAAC,KAAK,CAAC,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC;YAC1C,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,WAAW,CAAC;YAChC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAC3F,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,cAAc,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YACvH,MAAM,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE;gBACpC,KAAK,EAAE,WAAW,CAAC,EAAE;gBACrB,KAAK,EAAE,WAAW,CAAC,KAAK;gBACxB,QAAQ,EAAE,WAAW,CAAC,QAAQ;gBAC9B,SAAS,EAAE,eAAe;aAC3B,CAAC,CAAC;YACH,OAAO;gBACL,YAAY,EAAE,MAAM,CAAC,WAAW;gBAChC,aAAa,EAAE,MAAM,CAAC,YAAY;gBAClC,UAAU,EAAE,QAAQ;gBACpB,UAAU,EAAE,MAAM,CAAC,wBAAwB;aAC5C,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,KAAK,oBAAoB,EAAE,CAAC;YAC7C,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;gBAC3C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,6BAA6B,EAAE,CAAC,CAAC;YAChH,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;YACjF,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAC7D,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,MAAM,WAAW,GAAG,MAAM,4BAA4B,CAAC;gBACrD,KAAK,EAAE,WAAW,CAAC,EAAE;gBACrB,KAAK,EAAE,WAAW,CAAC,KAAK;gBACxB,QAAQ,EAAE,WAAW,CAAC,QAAQ;gBAC9B,MAAM;aACP,CAAC,CAAC;YAEH,MAAM,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE;gBAC/C,KAAK,EAAE,WAAW,CAAC,EAAE;gBACrB,QAAQ,EAAE,WAAW,CAAC,QAAQ;aAC/B,CAAC,CAAC;YAEH,OAAO;gBACL,YAAY,EAAE,WAAW;gBACzB,UAAU,EAAE,QAAQ;gBACpB,UAAU,EAAE,MAAM,CAAC,wBAAwB;gBAC3C,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;aACxB,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;IACrE,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,GAAG,CACL,WAAW,EACX,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAClC,KAAK,EAAE,OAAuB,EAAE,EAAE;QAChC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,OAAO;YACL,GAAG,EAAE,IAAI,CAAC,EAAE;YACZ,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,cAAc,EAAE,IAAI,CAAC,aAAa;YAClC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,SAAS;SACxB,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACpC,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACjE,MAAM,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;QACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CACN,UAAU,EACV,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAClC,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,cAAc,CAC1E,WAAW,CAAC,KAAK,EACjB,OAAO,CAAC,IAAK,CAAC,EAAE,CACjB,CAAC;QACF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE;gBACzC,MAAM,EAAE,qCAAqC;gBAC7C,KAAK,EAAE,WAAW,CAAC,EAAE;gBACrB,KAAK,EAAE,WAAW,CAAC,KAAK;aACzB,CAAC,CAAC;YACH,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;QACzD,CAAC;QAED,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC;QACtC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAC3F,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,YAAY,CAAC,OAAO,CAAC,IAAK,CAAC,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACpE,CAAC;aAAM,CAAC;YACN,MAAM,aAAa,CAAC,OAAO,CAAC,IAAK,CAAC,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE;YACpC,KAAK,EAAE,WAAW,CAAC,EAAE;YACrB,OAAO,EAAE,IAAI,CAAC,KAAK;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;QAEH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"oauth2.js","sourceRoot":"","sources":["../../src/routes/oauth2.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAE1F;;;GAGG;AACH,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC7D,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AACxF,CAAC,CAAC,CAAC;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,UAAU,EACV,YAAY,EACZ,WAAW,EACX,sBAAsB,EACtB,YAAY,EACZ,aAAa,EACb,mBAAmB,EACnB,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EACL,kBAAkB,EAClB,4BAA4B,EAC5B,kBAAkB,EAClB,gBAAgB,GAEjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAEpD,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,YAAY,EAAE,gBAAgB;IAC9B,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAChC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC3C,qBAAqB,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACxC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,oBAAoB,EAAE,eAAe,EAAE,oBAAoB,CAAC,CAAC;IACjF,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,YAAY,EAAE,gBAAgB,CAAC,QAAQ,EAAE;IACzC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACrD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACvC,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE;CACnB,CAAC,CAAC;AAOH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS,CAAC,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;AAEvF;;;;GAIG;AACH,SAAS,cAAc,CAAC,KAAgC;IACtD,OAAO,KAAK,IAAI,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAsB,CAAC,CAAC,CAAC,SAAS,CAAC;AAClF,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAuB,EAAE,IAAuB;IAChF,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;IACjD,IAAI,UAAU,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC5E,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACpD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,YAAY,CAAC,GAAoB;IAC7D,GAAG,CAAC,GAAG,CACL,YAAY,EACZ;QACE,UAAU,EAAE;YACV,GAAG,CAAC,YAAY;YAChB,SAAS,CAAC,EAAE,SAAS,EAAE,kBAAkB,EAAE,WAAW,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;SACjF;KACF,EACD,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,KAAK,GAAG,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAExD,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAClG,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,cAAc,CAC1E,WAAW,CAAC,KAAK,EACjB,OAAO,CAAC,IAAK,CAAC,EAAE,CACjB,CAAC;QACF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE;gBACzC,MAAM,EAAE,qCAAqC;gBAC7C,KAAK,EAAE,WAAW,CAAC,EAAE;gBACrB,KAAK,EAAE,WAAW,CAAC,KAAK;aACzB,CAAC,CAAC;YACH,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE,YAAY;gBACnB,iBAAiB,EAAE,sDAAsD;aAC1E,CAAC,CAAC;QACL,CAAC;QAED,0EAA0E;QAC1E,qCAAqC;QACrC,IAAI,CAAC,uBAAuB,CAAC,WAAW,CAAC,YAAY,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;YAC3E,OAAO,KAAK;iBACT,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAC/F,CAAC;QAED,iEAAiE;QACjE,iEAAiE;QACjE,wEAAwE;QACxE,yEAAyE;QACzE,sBAAsB;QACtB,MAAM,YAAY,GAAG,YAAY,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC;QAChE,IAAI,YAAY,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE,iBAAiB;gBACxB,iBAAiB,EAAE,4CAA4C;aAChE,CAAC,CAAC;QACL,CAAC;QACD,IAAI,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,qBAAqB,KAAK,MAAM,EAAE,CAAC;YACnE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE,iBAAiB;gBACxB,iBAAiB,EAAE,2DAA2D;aAC/E,CAAC,CAAC;QACL,CAAC;QAED,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC;QACtC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAC3F,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAEzE,sEAAsE;QACtE,sEAAsE;QACtE,0EAA0E;QAC1E,0CAA0C;QAC1C,MAAM,aAAa,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,IAAK,CAAC,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC;QAC1E,MAAM,QAAQ,GAAG,sBAAsB,CAAC;YACtC,SAAS,EAAE,MAAM;YACjB,OAAO,EAAE,WAAW,CAAC,aAAa,IAAI,EAAE;YACxC,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;SACrD,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE;gBACzC,MAAM,EAAE,4BAA4B;gBACpC,KAAK,EAAE,WAAW,CAAC,EAAE;gBACrB,KAAK,EAAE,WAAW,CAAC,KAAK;gBACxB,KAAK,EAAE,QAAQ,CAAC,KAAK;aACtB,CAAC,CAAC;YACH,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,iBAAiB,EAAE,UAAU,QAAQ,CAAC,KAAK,mCAAmC;aAC/E,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,aAAa,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjD,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE,kBAAkB;gBACzB,iBAAiB,EAAE,uBAAuB;aAC3C,CAAC,CAAC;QACL,CAAC;QAED,wEAAwE;QACxE,yEAAyE;QACzE,MAAM,gBAAgB,GAAG,cAAc,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAExE,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC;YAC1C,KAAK,EAAE,WAAW,CAAC,EAAE;YACrB,MAAM,EAAE,OAAO,CAAC,IAAK,CAAC,EAAE;YACxB,SAAS,EAAE,KAAK,CAAC,cAAc;YAC/B,eAAe,EAAE,KAAK,CAAC,qBAAqB;YAC5C,WAAW,EAAE,KAAK,CAAC,YAAY;YAC/B,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7D,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,KAAK,CAAC,KAAK;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAE5D,MAAM,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE;YACtC,KAAK,EAAE,WAAW,CAAC,EAAE;YACrB,QAAQ,EAAE,WAAW,CAAC,QAAQ;SAC/B,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IACxC,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,QAAQ,EACR;QACE,UAAU,EAAE,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,CAAC;KAC3F,EACD,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACvD,MAAM,WAAW,GAAG,wBAAwB,CAAC,OAAO,EAAE;YACpD,QAAQ,EAAE,UAAU,CAAC,SAAS;YAC9B,YAAY,EAAE,UAAU,CAAC,aAAa;SACvC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,EAAE,GAAG,UAAU,EAAE,SAAS,EAAE,WAAW,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,CAAC,YAAY,EAAE,CAAC;QAEzG,IAAI,IAAI,CAAC,UAAU,KAAK,oBAAoB,EAAE,CAAC;YAC7C,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;gBACxD,OAAO,KAAK;qBACT,MAAM,CAAC,GAAG,CAAC;qBACX,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,gDAAgD,EAAE,CAAC,CAAC;YAC7G,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACpE,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAC7D,CAAC;YAED,uEAAuE;YACvE,yEAAyE;YACzE,uEAAuE;YACvE,sEAAsE;YACtE,0EAA0E;YAC1E,8DAA8D;YAC9D,MAAM,uBAAuB,GAAG,CAAC,YAAY,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC;YAC5E,IAAI,uBAAuB,EAAE,CAAC;gBAC5B,MAAM,aAAa,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;gBACzF,IAAI,CAAC,aAAa,EAAE,CAAC;oBACnB,MAAM,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE;wBAClC,KAAK,EAAE,WAAW,CAAC,EAAE;wBACrB,QAAQ,EAAE,WAAW,CAAC,QAAQ;wBAC9B,SAAS,EAAE,oBAAoB;wBAC/B,OAAO,EAAE,gBAAgB;qBAC1B,CAAC,CAAC;oBACH,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;gBAC7D,CAAC;YACH,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;YAC5F,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YAC5D,CAAC;YAED,MAAM,YAAY,GAAG,YAAY,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC;YAChE,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,YAAY,EAAE,CAAC;gBACxC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBAC5B,KAAK,EAAE,iBAAiB;oBACxB,iBAAiB,EAAE,2CAA2C;iBAC/D,CAAC,CAAC;YACL,CAAC;YAED,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,eAAe,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,gBAAgB,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;gBAClH,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,CAAC,CAAC;YAC3G,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC/C,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC;gBACpB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YAC5D,CAAC;YAED,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,cAAc,CAC1E,WAAW,CAAC,KAAK,EACjB,IAAI,CAAC,EAAE,CACR,CAAC;YACF,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE;oBACzC,MAAM,EAAE,qCAAqC;oBAC7C,KAAK,EAAE,WAAW,CAAC,EAAE;oBACrB,KAAK,EAAE,WAAW,CAAC,KAAK;iBACzB,CAAC,CAAC;gBACH,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YAC5D,CAAC;YAED,OAAO,CAAC,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,EAAE,CAAC;YACpC,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC;YACtC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAC3F,MAAM,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE;gBAClC,KAAK,EAAE,WAAW,CAAC,EAAE;gBACrB,QAAQ,EAAE,WAAW,CAAC,QAAQ;gBAC9B,SAAS,EAAE,oBAAoB;aAChC,CAAC,CAAC;YAEH,MAAM,eAAe,GAAG,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACzD,MAAM,WAAW,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;YACpD,IAAI,CAAC;gBACH,OAAO,MAAM,mBAAmB,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE;oBACjE,EAAE,EAAE,OAAO,CAAC,EAAE;oBACd,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC;oBACxC,iBAAiB,EAAE,WAAW;oBAC9B,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,SAAS;oBAChC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC3D,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,gBAAgB,EAAE,CAAC;oBACpC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;wBAC5B,KAAK,EAAE,cAAc;wBACrB,iBAAiB,EACf,gHAAgH;qBACnH,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,KAAK,eAAe,EAAE,CAAC;YACxC,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;gBAClE,MAAM,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE;oBAC3C,QAAQ,EAAE,IAAI,CAAC,SAAS;oBACxB,MAAM,EAAE,iBAAiB;iBAC1B,CAAC,CAAC;gBACH,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC9D,CAAC;YACD,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;YACjF,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,MAAM,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE;oBAC3C,QAAQ,EAAE,IAAI,CAAC,SAAS;oBACxB,MAAM,EAAE,gBAAgB;iBACzB,CAAC,CAAC;gBACH,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAC7D,CAAC;YAED,4CAA4C;YAC5C,MAAM,MAAM,GAAG,MAAM,kBAAkB,CACrC,IAAI,CAAC,aAAa,EAClB,OAAO,CAAC,EAAE,EACV,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EAC7B,IAAI,CAAC,SAAS,EACd,WAAW,CAAC,EAAE,CACf,CAAC;YACF,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,WAAW,CAAC;gBAChC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;gBAC3F,MAAM,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE;oBAC3C,KAAK,EAAE,WAAW,CAAC,EAAE;oBACrB,KAAK,EAAE,WAAW,CAAC,KAAK;oBACxB,QAAQ,EAAE,WAAW,CAAC,QAAQ;oBAC9B,MAAM,EAAE,eAAe;iBACxB,CAAC,CAAC;gBACH,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YAC5D,CAAC;YAED,OAAO,CAAC,KAAK,CAAC,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC;YAC1C,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,WAAW,CAAC;YAChC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAC3F,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,cAAc,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YACvH,MAAM,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE;gBACpC,KAAK,EAAE,WAAW,CAAC,EAAE;gBACrB,KAAK,EAAE,WAAW,CAAC,KAAK;gBACxB,QAAQ,EAAE,WAAW,CAAC,QAAQ;gBAC9B,SAAS,EAAE,eAAe;aAC3B,CAAC,CAAC;YACH,OAAO;gBACL,YAAY,EAAE,MAAM,CAAC,WAAW;gBAChC,aAAa,EAAE,MAAM,CAAC,YAAY;gBAClC,UAAU,EAAE,QAAQ;gBACpB,UAAU,EAAE,MAAM,CAAC,wBAAwB;aAC5C,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,KAAK,oBAAoB,EAAE,CAAC;YAC7C,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;gBAC3C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,6BAA6B,EAAE,CAAC,CAAC;YAChH,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;YACjF,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAC7D,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,MAAM,WAAW,GAAG,MAAM,4BAA4B,CAAC;gBACrD,KAAK,EAAE,WAAW,CAAC,EAAE;gBACrB,KAAK,EAAE,WAAW,CAAC,KAAK;gBACxB,QAAQ,EAAE,WAAW,CAAC,QAAQ;gBAC9B,MAAM;aACP,CAAC,CAAC;YAEH,MAAM,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE;gBAC/C,KAAK,EAAE,WAAW,CAAC,EAAE;gBACrB,QAAQ,EAAE,WAAW,CAAC,QAAQ;aAC/B,CAAC,CAAC;YAEH,OAAO;gBACL,YAAY,EAAE,WAAW;gBACzB,UAAU,EAAE,QAAQ;gBACpB,UAAU,EAAE,MAAM,CAAC,wBAAwB;gBAC3C,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;aACxB,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;IACrE,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,GAAG,CACL,WAAW,EACX,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY;YAC7B,sFAAsF;YACtF,oCAAoC;YACpC,GAAG,CAAC,qBAAqB,EAAE,CAAC,EAAE,EAChC,KAAK,EAAE,OAAuB,EAAE,EAAE;QAChC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,OAAO;YACL,GAAG,EAAE,IAAI,CAAC,EAAE;YACZ,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,cAAc,EAAE,IAAI,CAAC,aAAa;YAClC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,SAAS;SACxB,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACpC,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACjE,MAAM,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;QACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CACN,UAAU,EACV,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY;YAC7B,0FAA0F;YAC1F,oCAAoC;YACpC,GAAG,CAAC,qBAAqB,EAAE,CAAC,EAAE,EAChC,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,cAAc,CAC1E,WAAW,CAAC,KAAK,EACjB,OAAO,CAAC,IAAK,CAAC,EAAE,CACjB,CAAC;QACF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE;gBACzC,MAAM,EAAE,qCAAqC;gBAC7C,KAAK,EAAE,WAAW,CAAC,EAAE;gBACrB,KAAK,EAAE,WAAW,CAAC,KAAK;aACzB,CAAC,CAAC;YACH,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;QACzD,CAAC;QAED,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC;QACtC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAC3F,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,YAAY,CAAC,OAAO,CAAC,IAAK,CAAC,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACpE,CAAC;aAAM,CAAC;YACN,MAAM,aAAa,CAAC,OAAO,CAAC,IAAK,CAAC,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE;YACpC,KAAK,EAAE,WAAW,CAAC,EAAE;YACrB,OAAO,EAAE,IAAI,CAAC,KAAK;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;QAEH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/routes/profile.js

@@ -7,7 +7,7 @@ const UpdateProfileSchema = z.object({
     metadata: z.record(z.string(), z.unknown()).optional(),
 });
 export default async function profileRoutes(app) {
-    app.get("/profile", { preHandler: [app.authenticate] }, async (request, reply) => {
+    app.get("/profile", { preHandler: [app.authenticate, app.requireScopes("profile:read")] }, async (request, reply) => {
         const userId = request.user?.id;
         if (!userId)
             return reply.status(401).send({ error: "Unauthorized" });
@@ -16,7 +16,7 @@ export default async function profileRoutes(app) {
             return reply.status(404).send({ error: "User not found" });
         return { user: toSelfUser(user) };
     });
-    app.patch("/profile", { preHandler: [app.authenticate] }, async (request, reply) => {
+    app.patch("/profile", { preHandler: [app.authenticate, app.requireScopes("profile:write")] }, async (request, reply) => {
         const userId = request.user?.id;
         if (!userId)
             return reply.status(401).send({ error: "Unauthorized" });

package/dist/routes/profile.js.map

@@ -1 +1 @@
-{"version":3,"file":"profile.js","sourceRoot":"","sources":["../../src/routes/profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC3D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACrD,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CACvD,CAAC,CAAC;AAEH,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,aAAa,CAAC,GAAoB;IAC9D,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAC7G,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAEtE,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACjE,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAEtE,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAC/G,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAEtE,MAAM,IAAI,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,OAAO,GAA4B,EAAE,CAAC;QAC5C,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtD,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QACrE,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;YAAE,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAClE,4DAA4D;QAC5D,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACnC,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;YACvC,OAAO,CAAC,aAAa,GAAG,KAAK,CAAC;QAChC,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC3E,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAEzE,MAAM,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACnD,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"profile.js","sourceRoot":"","sources":["../../src/routes/profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC3D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACrD,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CACvD,CAAC,CAAC;AAEH,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,aAAa,CAAC,GAAoB;IAC9D,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAChJ,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAEtE,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACjE,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAEtE,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACnJ,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAEtE,MAAM,IAAI,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,OAAO,GAA4B,EAAE,CAAC;QAC5C,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtD,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QACrE,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;YAAE,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAClE,4DAA4D;QAC5D,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACnC,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;YACvC,OAAO,CAAC,aAAa,GAAG,KAAK,CAAC;QAChC,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC3E,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAEzE,MAAM,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACnD,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/routes/saml.d.ts

@@ -1,9 +1,33 @@
+import { z } from "zod";
 import type { FastifyInstance } from "fastify";
 import type { SamlConnection } from "../db/schema.js";
+export declare const RelayStateSchema: z.ZodObject<{
+    transactionId: z.ZodString;
+    connectionId: z.ZodString;
+    orgId: z.ZodString;
+    nonce: z.ZodString;
+    signature: z.ZodString;
+}, z.core.$strip>;
+export declare function signRelayState(value: {
+    transactionId: string;
+    connectionId: string;
+    orgId: string;
+    nonce: string;
+}): string;
+/**
+ * Verify a RelayState signature.
+ *
+ * Returns false for anything malformed rather than throwing. The caller treats
+ * a false result as "reject", so a throw here would surface as a 500 on a
+ * request an attacker fully controls — a malformed RelayState is a bad request,
+ * not a server error.
+ */
+export declare function verifyRelayState(value: z.infer<typeof RelayStateSchema>): boolean;
 export declare function validateSamlSemantics(result: {
     samlContent?: string;
     extract: {
         audience?: string | string[];
+        issuer?: string | string[];
         response?: Record<string, string | string[]>;
         nameID?: string;
     };

package/dist/routes/saml.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"saml.d.ts","sourceRoot":"","sources":["../../src/routes/saml.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAG7E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAyLtD,wBAAgB,qBAAqB,CACnC,MAAM,EAAE;IACN,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE;QACP,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;QAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;QAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;CACH,EACD,UAAU,EAAE,cAAc,EAC1B,UAAU,EAAE,MAAM,GACjB,IAAI,CA2BN;AAkBD,wBAA8B,UAAU,CAAC,GAAG,EAAE,eAAe,iBA0L5D"}
+{"version":3,"file":"saml.d.ts","sourceRoot":"","sources":["../../src/routes/saml.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAG7E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAiBtD,eAAO,MAAM,gBAAgB;;;;;;iBAM3B,CAAC;AAUH,wBAAgB,cAAc,CAAC,KAAK,EAAE;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAE3H;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,GAAG,OAAO,CAejF;AAyID,wBAAgB,qBAAqB,CACnC,MAAM,EAAE;IACN,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE;QACP,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;QAC7B,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;QAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;QAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;CACH,EACD,UAAU,EAAE,cAAc,EAC1B,UAAU,EAAE,MAAM,GACjB,IAAI,CA2CN;AAkBD,wBAA8B,UAAU,CAAC,GAAG,EAAE,eAAe,iBA0L5D"}

package/dist/routes/saml.js

@@ -16,17 +16,31 @@ setSchemaValidator(samlSchemaValidator);
 const SAML_TRANSACTION_COOKIE = "keystone_saml_transaction";
 const SAML_TRANSACTION_TTL_SECONDS = 600;
 const relayStateSecret = config.INTERNAL_API_KEY || crypto.randomBytes(32).toString("base64url");
-const RelayStateSchema = z.object({
+export const RelayStateSchema = z.object({
     transactionId: z.string().min(32),
     connectionId: z.string().min(1),
     orgId: z.string().uuid(),
     nonce: z.string().min(16),
     signature: z.string().min(16),
 });
-function signRelayState(value) {
+export function signRelayState(value) {
     return crypto.createHmac("sha256", relayStateSecret).update(JSON.stringify(value)).digest("base64url");
 }
-function verifyRelayState(value) {
+/**
+ * Verify a RelayState signature.
+ *
+ * Returns false for anything malformed rather than throwing. The caller treats
+ * a false result as "reject", so a throw here would surface as a 500 on a
+ * request an attacker fully controls — a malformed RelayState is a bad request,
+ * not a server error.
+ */
+export function verifyRelayState(value) {
+    if (typeof value?.signature !== "string" || value.signature === "")
+        return false;
+    if (typeof value.transactionId !== "string" || typeof value.connectionId !== "string")
+        return false;
+    if (typeof value.orgId !== "string" || typeof value.nonce !== "string")
+        return false;
     const unsigned = {
         transactionId: value.transactionId,
         connectionId: value.connectionId,
@@ -154,6 +168,21 @@ export function validateSamlSemantics(result, connection, externalId) {
     if (!audiences.includes(connection.spEntityId)) {
         throw new Error("SAML audience mismatch");
     }
+    // The Response-level <saml:Issuer> sits outside both signed regions, so
+    // rewriting it does not invalidate the signature, and samlify does not compare
+    // it to the IdP metadata. SAML 2.0 2.5.1.5 requires a relying party to verify
+    // an unsigned issuer against trusted metadata, which is what this does.
+    //
+    // The assertion's own issuer is inside the signed region, so that one cannot be
+    // swapped without breaking the signature. This covers the element the
+    // signature cannot.
+    if (connection.idpEntityId) {
+        const issuer = result.extract.issuer;
+        const presented = valuesOf(issuer);
+        if (presented.length !== 1 || presented[0] !== connection.idpEntityId) {
+            throw new Error("SAML issuer mismatch");
+        }
+    }
     const responseDestination = result.extract.response?.Destination ?? result.extract.response?.destination;
     const destination = valuesOf(responseDestination);
     if (destination.length !== 1 || destination[0] !== connection.spAcsUrl) {

package/dist/routes/saml.js.map

@@ -1 +1 @@
-{"version":3,"file":"saml.js","sourceRoot":"","sources":["../../src/routes/saml.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAChF,OAAO,KAAK,mBAAmB,MAAM,gCAAgC,CAAC;AAEtE,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAC1F,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAE7C,kBAAkB,CAAC,mBAAmB,CAAC,CAAC;AAExC,MAAM,uBAAuB,GAAG,2BAA2B,CAAC;AAC5D,MAAM,4BAA4B,GAAG,GAAG,CAAC;AACzC,MAAM,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,IAAI,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAEjG,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;IACjC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IACxB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;CAC9B,CAAC,CAAC;AAUH,SAAS,cAAc,CAAC,KAAoF;IAC1G,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACzG,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAuC;IAC/D,MAAM,QAAQ,GAAG;QACf,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;IACF,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAClD,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7C,OAAO,YAAY,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM,IAAI,MAAM,CAAC,eAAe,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;AAC/G,CAAC;AAED,SAAS,cAAc,CAAC,aAAqB;IAC3C,OAAO,6BAA6B,aAAa,EAAE,CAAC;AACtD,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,aAAqB,EAAE,WAA4B;IACjF,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAC5B,cAAc,CAAC,aAAa,CAAC,EAC7B,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAC3B,IAAI,EACJ,4BAA4B,EAC5B,IAAI,CACL,CAAC;IACF,IAAI,MAAM,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;AACrE,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,aAAqB;IACjD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,CAAC;IAC3D,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC9C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoB,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,aAAqB;IACrD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAC1B,uGAAuG,EACvG,CAAC,EACD,cAAc,CAAC,aAAa,CAAC,CAC9B,CAAC;IACF,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC9C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoB,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAmB,EAAE,YAAoB;IACrE,KAAK,CAAC,SAAS,CAAC,uBAAuB,EAAE,YAAY,EAAE;QACrD,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,MAAM,CAAC,aAAa;QAC5B,QAAQ,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK;QAC/C,MAAM,EAAE,4BAA4B;KACrC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAmB;IACjD,KAAK,CAAC,WAAW,CAAC,uBAAuB,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,yBAAyB,GAA6B;IAC1D,KAAK,EAAE;QACL,OAAO;QACP,MAAM;QACN,mCAAmC;QACnC,oEAAoE;QACpE,oDAAoD;KACrD;IACD,IAAI,EAAE;QACJ,MAAM;QACN,aAAa;QACb,IAAI;QACJ,YAAY;QACZ,mCAAmC;QACnC,4DAA4D;QAC5D,0DAA0D;KAC3D;CACF,CAAC;AAEF,SAAS,iBAAiB,CAAC,UAA0B;IACnD,IAAI,CAAC,UAAU,CAAC,WAAW,IAAI,CAAC,UAAU,CAAC,SAAS,IAAI,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC;QACnF,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,EAAE,GAAG,eAAe,CAAC;QACzB,QAAQ,EAAE,UAAU,CAAC,UAAU;QAC/B,oBAAoB,EAAE,IAAI;QAC1B,iBAAiB,EAAE,IAAI;QACvB,wBAAwB,EAAE;YACxB;gBACE,OAAO,EAAE,gDAAgD;gBACzD,QAAQ,EAAE,UAAU,CAAC,QAAQ;aAC9B;SACF;KACF,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,gBAAgB,CAAC;QAC3B,QAAQ,EAAE,UAAU,CAAC,WAAW;QAChC,WAAW,EAAE,UAAU,CAAC,cAAc;QACtC,mBAAmB,EAAE;YACnB;gBACE,OAAO,EAAE,oDAAoD;gBAC7D,QAAQ,EAAE,UAAU,CAAC,SAAS;aAC/B;SACF;KACF,CAAC,CAAC;IAEH,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC;AACrB,CAAC;AAED,SAAS,YAAY,CACnB,UAAyD,EACzD,GAAW,EACX,OAAiC,EACjC,eAAyC;IAEzC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjE,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC,SAAS,CAAC,CAAC;QACtC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QACpD,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC3D,IAAI,UAAU;YAAE,OAAO,UAAU,CAAC;IACpC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,mBAAmB,CAC1B,UAAyD,EACzD,UAA0B;IAE1B,MAAM,OAAO,GAAG,CAAC,UAAU,CAAC,gBAAgB,IAAI,EAAE,CAA6B,CAAC;IAChF,OAAO;QACL,KAAK,EAAE,YAAY,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,yBAAyB,CAAC;QAC5E,IAAI,EAAE,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,CAAC;KAC3E,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAoC;IACpD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,MAOC,EACD,UAA0B,EAC1B,UAAkB;IAElB,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,mBAAmB,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,WAAW,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC;IACzG,MAAM,WAAW,GAAG,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IAClD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,QAAQ,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,eAAe,CAC/I,WAAW,EACX,iBAAiB,CAClB,CAAC;IACF,MAAM,cAAc,GAAG,MAAM,CAAC,sBAAsB,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;IACrF,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAC5E,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,YAAY,CAAC,WAAW,CAAC,IAAI,EAAE,CAC5D,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjG,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,4EAA4E;IAC5E,gFAAgF;IAChF,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO;YACL,UAAU,EAAE,GAAG;YACf,IAAI,EAAE;gBACJ,KAAK,EAAE,cAAc;gBACrB,IAAI,EAAE,cAAc;aACrB;SACF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,KAAK,aAAa,IAAI,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC;IACvH,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC;AACvD,CAAC;AAED,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,UAAU,CAAC,GAAoB;IAC3D,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACpF,MAAM,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,MAAkC,CAAC;QACpE,MAAM,KAAK,GAAI,OAAO,CAAC,KAA4B,CAAC,KAAK,CAAC;QAC1D,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC1E,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QAE5G,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,KAAK,YAAY,IAAI,CAAC,CAAC,MAAM,CAAC,gBAAgB,IAAI,MAAM,CAAC,gBAAgB,CAAC,MAAM,GAAG,EAAE,CAAC,EAAE,CAAC;YAC1G,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAC,CAAC;QACzF,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;YAClD,MAAM,aAAa,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACnE,MAAM,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAClE,MAAM,YAAY,GAAG;gBACnB,aAAa;gBACb,YAAY;gBACZ,KAAK;gBACL,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;aACpD,CAAC;YACF,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAC5B,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,YAAY,EAAE,SAAS,EAAE,cAAc,CAAC,YAAY,CAAC,EAAE,CAAC,CAC7E,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACxB,MAAM,YAAY,GAAG,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;YAC5E,MAAM,gBAAgB,CAAC,aAAa,EAAE;gBACpC,YAAY;gBACZ,KAAK;gBACL,KAAK,EAAE,YAAY,CAAC,KAAK;gBACzB,SAAS,EAAE,YAAY,CAAC,EAAE;gBAC1B,YAAY;aACb,CAAC,CAAC;YACH,oBAAoB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;YAE1C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YAC1C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC;YAC1D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;YAE/C,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,sBAAsB,CAAC,KAAK,CAAC,CAAC;YAC9B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,oCAAoC,CAAC,CAAC;YACjE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;YACpD,OAAO,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAC3E,MAAM,IAAI,GAAG,OAAO,CAAC,IAAsD,CAAC;QAC5E,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,sBAAsB,CAAC,KAAK,CAAC,CAAC;YAC9B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;QACnE,CAAC;QAED,IAAI,UAAwD,CAAC;QAC7D,IAAI,CAAC;YACH,UAAU,GAAG,gBAAgB,CAAC,KAAK,CACjC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAC7E,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,sBAAsB,CAAC,KAAK,CAAC,CAAC;YAC9B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,CAAC,UAAU,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,CAAC;YACjD,sBAAsB,CAAC,KAAK,CAAC,CAAC;YAC9B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;QAC9D,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,sBAAsB,CAAC,KAAK,CAAC,CAAC;YAC9B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;QACnE,IACE,CAAC,WAAW;YACZ,WAAW,CAAC,YAAY,KAAK,UAAU,CAAC,YAAY;YACpD,WAAW,CAAC,KAAK,KAAK,UAAU,CAAC,KAAK;YACtC,WAAW,CAAC,KAAK,KAAK,UAAU,CAAC,KAAK;YACtC,WAAW,CAAC,YAAY,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM;YACvD,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,EACzF,CAAC;YACD,sBAAsB,CAAC,KAAK,CAAC,CAAC;YAC9B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,wBAAwB,CAAC,sBAAsB,CACpF,UAAU,CAAC,YAAY,EACvB,UAAU,CAAC,KAAK,CACjB,CAAC;QAEF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,IAAI,kBAAkB,GAAG,KAAK,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;YAClD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAClE,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,QAA4D,CAAC;YAC7F,MAAM,iBAAiB,GAAG,QAAQ,CAAC,YAAY,IAAI,QAAQ,CAAC,YAAY,CAAC;YACzE,IAAI,iBAAiB,KAAK,WAAW,CAAC,SAAS,EAAE,CAAC;gBAChD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YACvD,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;YACzC,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;YAC7D,CAAC;YACD,qBAAqB,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;YACtD,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;YAE1E,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBAClB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC,CAAC;YACrF,CAAC;YAED,MAAM,kBAAkB,GAAG,MAAM,kBAAkB,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;YAC9E,IAAI,CAAC,kBAAkB,IAAI,kBAAkB,CAAC,SAAS,KAAK,WAAW,CAAC,SAAS,EAAE,CAAC;gBAClF,sBAAsB,CAAC,KAAK,CAAC,CAAC;gBAC9B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC,CAAC;YAChF,CAAC;YACD,kBAAkB,GAAG,IAAI,CAAC;YAC1B,sBAAsB,CAAC,KAAK,CAAC,CAAC;YAE9B,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAElF,MAAM,IAAI,GAAG,MAAM,uBAAuB,CACxC,UAAU,CAAC,KAAK,EAChB,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,EACtD,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EACnC,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CACxC,CAAC;YACF,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;YACpB,IAAI,GAAG;gBAAE,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC;YAEjC,MAAM,WAAW,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;YACpD,MAAM,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;YACpF,MAAM,MAAM,GAAG,MAAM,cAAc,CACjC,IAAI,EACJ,OAAO,CAAC,EAAE,EACV,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EAC7B,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,EAC3B,WAAW,CACZ,CAAC;YACF,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;YAElE,MAAM,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE;gBACpC,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,YAAY,EAAE,UAAU,CAAC,EAAE;gBAC3B,MAAM,EAAE,IAAI,CAAC,EAAE;aAChB,CAAC,CAAC;YAEH,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,kBAAkB;gBAAE,sBAAsB,CAAC,KAAK,CAAC,CAAC;YACtD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,4BAA4B,CAAC,CAAC;YACzD,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;YACpD,OAAO,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,8BAA8B,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAC7F,MAAM,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,MAAkC,CAAC;QACpE,MAAM,KAAK,GAAI,OAAO,CAAC,KAA4B,CAAC,KAAK,CAAC;QAC1D,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC1E,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QAE5G,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,QAAQ,GAAG;iFAC4D,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC;;sGAEX,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC;;uBAE7G,CAAC,IAAI,EAAE,CAAC;QAE3B,OAAO,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"saml.js","sourceRoot":"","sources":["../../src/routes/saml.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAChF,OAAO,KAAK,mBAAmB,MAAM,gCAAgC,CAAC;AAEtE,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAC1F,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAE7C,kBAAkB,CAAC,mBAAmB,CAAC,CAAC;AAExC,MAAM,uBAAuB,GAAG,2BAA2B,CAAC;AAC5D,MAAM,4BAA4B,GAAG,GAAG,CAAC;AACzC,MAAM,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,IAAI,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAEjG,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;IACjC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IACxB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;CAC9B,CAAC,CAAC;AAUH,MAAM,UAAU,cAAc,CAAC,KAAoF;IACjH,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACzG,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAuC;IACtE,IAAI,OAAO,KAAK,EAAE,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACjF,IAAI,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACpG,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAErF,MAAM,QAAQ,GAAG;QACf,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;IACF,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAClD,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7C,OAAO,YAAY,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM,IAAI,MAAM,CAAC,eAAe,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;AAC/G,CAAC;AAED,SAAS,cAAc,CAAC,aAAqB;IAC3C,OAAO,6BAA6B,aAAa,EAAE,CAAC;AACtD,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,aAAqB,EAAE,WAA4B;IACjF,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAC5B,cAAc,CAAC,aAAa,CAAC,EAC7B,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAC3B,IAAI,EACJ,4BAA4B,EAC5B,IAAI,CACL,CAAC;IACF,IAAI,MAAM,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;AACrE,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,aAAqB;IACjD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,CAAC;IAC3D,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC9C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoB,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,aAAqB;IACrD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAC1B,uGAAuG,EACvG,CAAC,EACD,cAAc,CAAC,aAAa,CAAC,CAC9B,CAAC;IACF,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC9C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoB,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAmB,EAAE,YAAoB;IACrE,KAAK,CAAC,SAAS,CAAC,uBAAuB,EAAE,YAAY,EAAE;QACrD,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,MAAM,CAAC,aAAa;QAC5B,QAAQ,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK;QAC/C,MAAM,EAAE,4BAA4B;KACrC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAmB;IACjD,KAAK,CAAC,WAAW,CAAC,uBAAuB,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,yBAAyB,GAA6B;IAC1D,KAAK,EAAE;QACL,OAAO;QACP,MAAM;QACN,mCAAmC;QACnC,oEAAoE;QACpE,oDAAoD;KACrD;IACD,IAAI,EAAE;QACJ,MAAM;QACN,aAAa;QACb,IAAI;QACJ,YAAY;QACZ,mCAAmC;QACnC,4DAA4D;QAC5D,0DAA0D;KAC3D;CACF,CAAC;AAEF,SAAS,iBAAiB,CAAC,UAA0B;IACnD,IAAI,CAAC,UAAU,CAAC,WAAW,IAAI,CAAC,UAAU,CAAC,SAAS,IAAI,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC;QACnF,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,EAAE,GAAG,eAAe,CAAC;QACzB,QAAQ,EAAE,UAAU,CAAC,UAAU;QAC/B,oBAAoB,EAAE,IAAI;QAC1B,iBAAiB,EAAE,IAAI;QACvB,wBAAwB,EAAE;YACxB;gBACE,OAAO,EAAE,gDAAgD;gBACzD,QAAQ,EAAE,UAAU,CAAC,QAAQ;aAC9B;SACF;KACF,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,gBAAgB,CAAC;QAC3B,QAAQ,EAAE,UAAU,CAAC,WAAW;QAChC,WAAW,EAAE,UAAU,CAAC,cAAc;QACtC,mBAAmB,EAAE;YACnB;gBACE,OAAO,EAAE,oDAAoD;gBAC7D,QAAQ,EAAE,UAAU,CAAC,SAAS;aAC/B;SACF;KACF,CAAC,CAAC;IAEH,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC;AACrB,CAAC;AAED,SAAS,YAAY,CACnB,UAAyD,EACzD,GAAW,EACX,OAAiC,EACjC,eAAyC;IAEzC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjE,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC,SAAS,CAAC,CAAC;QACtC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QACpD,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC3D,IAAI,UAAU;YAAE,OAAO,UAAU,CAAC;IACpC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,mBAAmB,CAC1B,UAAyD,EACzD,UAA0B;IAE1B,MAAM,OAAO,GAAG,CAAC,UAAU,CAAC,gBAAgB,IAAI,EAAE,CAA6B,CAAC;IAChF,OAAO;QACL,KAAK,EAAE,YAAY,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,yBAAyB,CAAC;QAC5E,IAAI,EAAE,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,CAAC;KAC3E,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAoC;IACpD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,MAQC,EACD,UAA0B,EAC1B,UAAkB;IAElB,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IAED,wEAAwE;IACxE,+EAA+E;IAC/E,8EAA8E;IAC9E,wEAAwE;IACxE,EAAE;IACF,gFAAgF;IAChF,sEAAsE;IACtE,oBAAoB;IACpB,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QACrC,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAuC,CAAC,CAAC;QACpE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,WAAW,EAAE,CAAC;YACtE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,MAAM,mBAAmB,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,WAAW,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC;IACzG,MAAM,WAAW,GAAG,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IAClD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,QAAQ,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,eAAe,CAC/I,WAAW,EACX,iBAAiB,CAClB,CAAC;IACF,MAAM,cAAc,GAAG,MAAM,CAAC,sBAAsB,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;IACrF,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAC5E,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,YAAY,CAAC,WAAW,CAAC,IAAI,EAAE,CAC5D,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjG,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,4EAA4E;IAC5E,gFAAgF;IAChF,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO;YACL,UAAU,EAAE,GAAG;YACf,IAAI,EAAE;gBACJ,KAAK,EAAE,cAAc;gBACrB,IAAI,EAAE,cAAc;aACrB;SACF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,KAAK,aAAa,IAAI,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC;IACvH,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC;AACvD,CAAC;AAED,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,UAAU,CAAC,GAAoB;IAC3D,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACpF,MAAM,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,MAAkC,CAAC;QACpE,MAAM,KAAK,GAAI,OAAO,CAAC,KAA4B,CAAC,KAAK,CAAC;QAC1D,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC1E,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QAE5G,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,KAAK,YAAY,IAAI,CAAC,CAAC,MAAM,CAAC,gBAAgB,IAAI,MAAM,CAAC,gBAAgB,CAAC,MAAM,GAAG,EAAE,CAAC,EAAE,CAAC;YAC1G,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAC,CAAC;QACzF,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;YAClD,MAAM,aAAa,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACnE,MAAM,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAClE,MAAM,YAAY,GAAG;gBACnB,aAAa;gBACb,YAAY;gBACZ,KAAK;gBACL,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;aACpD,CAAC;YACF,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAC5B,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,YAAY,EAAE,SAAS,EAAE,cAAc,CAAC,YAAY,CAAC,EAAE,CAAC,CAC7E,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACxB,MAAM,YAAY,GAAG,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;YAC5E,MAAM,gBAAgB,CAAC,aAAa,EAAE;gBACpC,YAAY;gBACZ,KAAK;gBACL,KAAK,EAAE,YAAY,CAAC,KAAK;gBACzB,SAAS,EAAE,YAAY,CAAC,EAAE;gBAC1B,YAAY;aACb,CAAC,CAAC;YACH,oBAAoB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;YAE1C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YAC1C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC;YAC1D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;YAE/C,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,sBAAsB,CAAC,KAAK,CAAC,CAAC;YAC9B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,oCAAoC,CAAC,CAAC;YACjE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;YACpD,OAAO,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAC3E,MAAM,IAAI,GAAG,OAAO,CAAC,IAAsD,CAAC;QAC5E,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,sBAAsB,CAAC,KAAK,CAAC,CAAC;YAC9B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;QACnE,CAAC;QAED,IAAI,UAAwD,CAAC;QAC7D,IAAI,CAAC;YACH,UAAU,GAAG,gBAAgB,CAAC,KAAK,CACjC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAC7E,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,sBAAsB,CAAC,KAAK,CAAC,CAAC;YAC9B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,CAAC,UAAU,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,CAAC;YACjD,sBAAsB,CAAC,KAAK,CAAC,CAAC;YAC9B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;QAC9D,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,sBAAsB,CAAC,KAAK,CAAC,CAAC;YAC9B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;QACnE,IACE,CAAC,WAAW;YACZ,WAAW,CAAC,YAAY,KAAK,UAAU,CAAC,YAAY;YACpD,WAAW,CAAC,KAAK,KAAK,UAAU,CAAC,KAAK;YACtC,WAAW,CAAC,KAAK,KAAK,UAAU,CAAC,KAAK;YACtC,WAAW,CAAC,YAAY,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM;YACvD,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,EACzF,CAAC;YACD,sBAAsB,CAAC,KAAK,CAAC,CAAC;YAC9B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,wBAAwB,CAAC,sBAAsB,CACpF,UAAU,CAAC,YAAY,EACvB,UAAU,CAAC,KAAK,CACjB,CAAC;QAEF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,IAAI,kBAAkB,GAAG,KAAK,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;YAClD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAClE,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,QAA4D,CAAC;YAC7F,MAAM,iBAAiB,GAAG,QAAQ,CAAC,YAAY,IAAI,QAAQ,CAAC,YAAY,CAAC;YACzE,IAAI,iBAAiB,KAAK,WAAW,CAAC,SAAS,EAAE,CAAC;gBAChD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YACvD,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;YACzC,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;YAC7D,CAAC;YACD,qBAAqB,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;YACtD,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;YAE1E,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBAClB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC,CAAC;YACrF,CAAC;YAED,MAAM,kBAAkB,GAAG,MAAM,kBAAkB,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;YAC9E,IAAI,CAAC,kBAAkB,IAAI,kBAAkB,CAAC,SAAS,KAAK,WAAW,CAAC,SAAS,EAAE,CAAC;gBAClF,sBAAsB,CAAC,KAAK,CAAC,CAAC;gBAC9B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC,CAAC;YAChF,CAAC;YACD,kBAAkB,GAAG,IAAI,CAAC;YAC1B,sBAAsB,CAAC,KAAK,CAAC,CAAC;YAE9B,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAElF,MAAM,IAAI,GAAG,MAAM,uBAAuB,CACxC,UAAU,CAAC,KAAK,EAChB,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,EACtD,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EACnC,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CACxC,CAAC;YACF,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;YACpB,IAAI,GAAG;gBAAE,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC;YAEjC,MAAM,WAAW,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;YACpD,MAAM,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;YACpF,MAAM,MAAM,GAAG,MAAM,cAAc,CACjC,IAAI,EACJ,OAAO,CAAC,EAAE,EACV,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EAC7B,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,EAC3B,WAAW,CACZ,CAAC;YACF,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;YAElE,MAAM,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE;gBACpC,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,YAAY,EAAE,UAAU,CAAC,EAAE;gBAC3B,MAAM,EAAE,IAAI,CAAC,EAAE;aAChB,CAAC,CAAC;YAEH,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,kBAAkB;gBAAE,sBAAsB,CAAC,KAAK,CAAC,CAAC;YACtD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,4BAA4B,CAAC,CAAC;YACzD,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;YACpD,OAAO,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,8BAA8B,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAC7F,MAAM,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,MAAkC,CAAC;QACpE,MAAM,KAAK,GAAI,OAAO,CAAC,KAA4B,CAAC,KAAK,CAAC;QAC1D,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC1E,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QAE5G,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,QAAQ,GAAG;iFAC4D,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC;;sGAEX,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC;;uBAE7G,CAAC,IAAI,EAAE,CAAC;QAE3B,OAAO,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/routes/serviceAccounts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serviceAccounts.d.ts","sourceRoot":"","sources":["../../src/routes/serviceAccounts.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AA4B7E,wBAA8B,oBAAoB,CAAC,GAAG,EAAE,eAAe,iBA+FtE"}
+{"version":3,"file":"serviceAccounts.d.ts","sourceRoot":"","sources":["../../src/routes/serviceAccounts.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAiD7E,wBAA8B,oBAAoB,CAAC,GAAG,EAAE,eAAe,iBA4KtE"}

package/dist/routes/serviceAccounts.js

@@ -1,5 +1,7 @@
 import { z } from "zod";
-import { createServiceAccount, findServiceAccountsByOrgId, findServiceAccountById, updateServiceAccount, listServiceAccountApiKeys, } from "../services/serviceAccounts.js";
+import { createServiceAccount, findServiceAccountsByOrgId, findServiceAccountById, updateServiceAccount, setServiceAccountCertificate, revokeServiceAccount, listServiceAccountApiKeys, } from "../services/serviceAccounts.js";
+import { canonicalFingerprint, isValidFingerprint } from "../services/trustedProxies.js";
+import { knownScopes, validateScopes } from "../services/scopes.js";
 import { generateApiKey, hashApiKey } from "../services/tokens.js";
 import { toPublicApiKey } from "../types.js";
 const CreateSchema = z.object({
@@ -11,6 +13,21 @@ const UpdateSchema = z.object({
     description: z.string().max(500).optional(),
     isActive: z.boolean().optional(),
 });
+/**
+ * A SHA-256 client-certificate fingerprint, in hex or the colon-separated form
+ * AWS ALB emits. Stored canonicalized so the two spellings cannot become two
+ * distinct bindings for one certificate.
+ */
+const FingerprintSchema = z
+    .string()
+    .refine((value) => isValidFingerprint(value), {
+    message: "fingerprint must be a SHA-256 digest (64 hex characters)",
+})
+    .transform(canonicalFingerprint);
+const CertificateSchema = z.object({
+    /** `null` removes the binding, leaving API keys as the only credential. */
+    fingerprint: FingerprintSchema.nullable(),
+});
 const CreateKeySchema = z.object({
     name: z.string().min(1).max(100),
     scopes: z.array(z.string()).optional(),
@@ -55,6 +72,50 @@ export default async function serviceAccountRoutes(app) {
         });
         return updated;
     });
+    app.put("/organizations/:id/service-accounts/:accountId/certificate", { preHandler: [app.requirePermission("service_account", "update")] }, async (request, reply) => {
+        const { id, accountId } = request.params;
+        const body = CertificateSchema.parse(request.body);
+        const account = await findServiceAccountById(accountId, id);
+        if (!account) {
+            return reply.status(404).send({ error: "Service account not found" });
+        }
+        let updated;
+        try {
+            updated = await setServiceAccountCertificate(accountId, id, body.fingerprint);
+        }
+        catch {
+            // The unique index on cert_fingerprint rejects a certificate that is
+            // already bound elsewhere. Report it as a conflict, not a 500.
+            return reply.status(409).send({
+                error: "That certificate is already bound to another service account",
+            });
+        }
+        if (!updated) {
+            return reply.status(404).send({ error: "Service account not found" });
+        }
+        await request.audit(body.fingerprint ? "service_account_certificate_bound" : "service_account_certificate_unbound", {
+            orgId: id,
+            serviceAccountId: updated.id,
+            fingerprint: body.fingerprint,
+        });
+        return updated;
+    });
+    app.post("/organizations/:id/service-accounts/:accountId/revoke", { preHandler: [app.requirePermission("service_account", "update")] }, async (request, reply) => {
+        const { id, accountId } = request.params;
+        const account = await findServiceAccountById(accountId, id);
+        if (!account) {
+            return reply.status(404).send({ error: "Service account not found" });
+        }
+        const revoked = await revokeServiceAccount(accountId, id);
+        if (!revoked) {
+            return reply.status(409).send({ error: "Service account is already revoked" });
+        }
+        await request.audit("service_account_revoked", {
+            orgId: id,
+            serviceAccountId: revoked.id,
+        });
+        return revoked;
+    });
     app.post("/organizations/:id/service-accounts/:accountId/api-keys", { preHandler: [app.requirePermission("api_key", "create")] }, async (request, reply) => {
         const { id, accountId } = request.params;
         const body = CreateKeySchema.parse(request.body);
@@ -62,6 +123,20 @@ export default async function serviceAccountRoutes(app) {
         if (!account) {
             return reply.status(404).send({ error: "Service account not found" });
         }
+        // A machine credential cannot be issued an interactive scope. TOTP
+        // enrolment in particular would let a caller attempt to enrol a factor
+        // against the synthesized principal, which has no user row to attach it to.
+        const scopeCheck = validateScopes(body.scopes, { principal: "service_account" });
+        if (!scopeCheck.ok) {
+            return reply.status(400).send({
+                error: scopeCheck.forbiddenForServiceAccount.length
+                    ? "Scope not available to a service account"
+                    : "Unknown API key scope",
+                unknown: scopeCheck.unknown,
+                forbidden: scopeCheck.forbiddenForServiceAccount,
+                known: knownScopes(),
+            });
+        }
         const { key, prefix } = generateApiKey();
         const record = await app.container.apiKeyRepository.create({
             serviceAccountId: account.id,
@@ -69,13 +144,14 @@ export default async function serviceAccountRoutes(app) {
             name: body.name,
             prefix,
             keyHash: hashApiKey(key),
-            scopes: body.scopes?.length ? body.scopes : ["api:read"],
+            scopes: scopeCheck.scopes,
             expiresAt: body.expiresAt ? new Date(body.expiresAt) : null,
         });
         await request.audit("api_key_created", {
             orgId: id,
             serviceAccountId: account.id,
             keyId: record.id,
+            scopes: scopeCheck.scopes,
         });
         return { key, apiKey: toPublicApiKey(record) };
     });

package/dist/routes/serviceAccounts.js.map

@@ -1 +1 @@
-{"version":3,"file":"serviceAccounts.js","sourceRoot":"","sources":["../../src/routes/serviceAccounts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,sBAAsB,EACtB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC;AAEH,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,oBAAoB,CAAC,GAAoB;IACrE,GAAG,CAAC,IAAI,CACN,qCAAqC,EACrC,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC,EAAE,EACpE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAE9C,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC;YACxC,KAAK,EAAE,EAAE;YACT,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC,CAAC;QAEH,MAAM,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3F,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,GAAG,CACL,qCAAqC,EACrC,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,EAAE,EAClE,KAAK,EAAE,OAAuB,EAAE,EAAE;QAChC,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAAC,EAAE,CAAC,CAAC;QACtD,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC;IACvC,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,GAAG,CACL,gDAAgD,EAChD,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,EAAE,EAClE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,MAA2C,CAAC;QAC9E,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,yBAAyB,CAAC,SAAS,CAAC,CAAC;QACxD,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACtC,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,KAAK,CACP,gDAAgD,EAChD,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC,EAAE,EACpE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,MAA2C,CAAC;QAC9E,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAE9C,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,SAAS,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;QAChE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE;YAC7C,KAAK,EAAE,EAAE;YACT,gBAAgB,EAAE,OAAO,CAAC,EAAE;SAC7B,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,yDAAyD,EACzD,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,EAAE,EAC5D,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,MAA2C,CAAC;QAC9E,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEjD,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC5D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,MAAM,CAAC;YACzD,gBAAgB,EAAE,OAAO,CAAC,EAAE;YAC5B,KAAK,EAAE,EAAE;YACT,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM;YACN,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC;YACxB,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;YACxD,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI;SAC5D,CAAC,CAAC;QAEH,MAAM,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE;YACrC,KAAK,EAAE,EAAE;YACT,gBAAgB,EAAE,OAAO,CAAC,EAAE;YAC5B,KAAK,EAAE,MAAM,CAAC,EAAE;SACjB,CAAC,CAAC;QAEH,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;IACjD,CAAC,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"serviceAccounts.js","sourceRoot":"","sources":["../../src/routes/serviceAccounts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,sBAAsB,EACtB,oBAAoB,EACpB,4BAA4B,EAC5B,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACzF,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,CAAC;KACxB,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE;IAC5C,OAAO,EAAE,0DAA0D;CACpE,CAAC;KACD,SAAS,CAAC,oBAAoB,CAAC,CAAC;AAEnC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,2EAA2E;IAC3E,WAAW,EAAE,iBAAiB,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC;AAEH,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,oBAAoB,CAAC,GAAoB;IACrE,GAAG,CAAC,IAAI,CACN,qCAAqC,EACrC,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC,EAAE,EACpE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAE9C,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC;YACxC,KAAK,EAAE,EAAE;YACT,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC,CAAC;QAEH,MAAM,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3F,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,GAAG,CACL,qCAAqC,EACrC,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,EAAE,EAClE,KAAK,EAAE,OAAuB,EAAE,EAAE;QAChC,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAAC,EAAE,CAAC,CAAC;QACtD,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC;IACvC,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,GAAG,CACL,gDAAgD,EAChD,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,EAAE,EAClE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,MAA2C,CAAC;QAC9E,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,yBAAyB,CAAC,SAAS,CAAC,CAAC;QACxD,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACtC,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,KAAK,CACP,gDAAgD,EAChD,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC,EAAE,EACpE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,MAA2C,CAAC;QAC9E,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAE9C,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,SAAS,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;QAChE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE;YAC7C,KAAK,EAAE,EAAE;YACT,gBAAgB,EAAE,OAAO,CAAC,EAAE;SAC7B,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,GAAG,CACL,4DAA4D,EAC5D,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC,EAAE,EACpE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,MAA2C,CAAC;QAC9E,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEnD,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC5D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,4BAA4B,CAAC,SAAS,EAAE,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAChF,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;YACrE,+DAA+D;YAC/D,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE,8DAA8D;aACtE,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,qCAAqC,EAAE;YAClH,KAAK,EAAE,EAAE;YACT,gBAAgB,EAAE,OAAO,CAAC,EAAE;YAC5B,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC,CAAC;QAEH,OAAO,OAAO,CAAC;IACjB,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,uDAAuD,EACvD,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC,EAAE,EACpE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,MAA2C,CAAC;QAE9E,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC5D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;QACjF,CAAC;QAED,MAAM,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE;YAC7C,KAAK,EAAE,EAAE;YACT,gBAAgB,EAAE,OAAO,CAAC,EAAE;SAC7B,CAAC,CAAC;QAEH,OAAO,OAAO,CAAC;IACjB,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,yDAAyD,EACzD,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,EAAE,EAC5D,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,MAA2C,CAAC;QAC9E,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEjD,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC5D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,mEAAmE;QACnE,uEAAuE;QACvE,4EAA4E;QAC5E,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACjF,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;YACnB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE,UAAU,CAAC,0BAA0B,CAAC,MAAM;oBACjD,CAAC,CAAC,0CAA0C;oBAC5C,CAAC,CAAC,uBAAuB;gBAC3B,OAAO,EAAE,UAAU,CAAC,OAAO;gBAC3B,SAAS,EAAE,UAAU,CAAC,0BAA0B;gBAChD,KAAK,EAAE,WAAW,EAAE;aACrB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,MAAM,CAAC;YACzD,gBAAgB,EAAE,OAAO,CAAC,EAAE;YAC5B,KAAK,EAAE,EAAE;YACT,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM;YACN,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC;YACxB,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI;SAC5D,CAAC,CAAC;QAEH,MAAM,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE;YACrC,KAAK,EAAE,EAAE;YACT,gBAAgB,EAAE,OAAO,CAAC,EAAE;YAC5B,KAAK,EAAE,MAAM,CAAC,EAAE;YAChB,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QAEH,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;IACjD,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/routes/sessions.js

@@ -6,7 +6,7 @@ function hashToken(token) {
     return crypto.createHash("sha256").update(token).digest("hex");
 }
 export default async function sessionRoutes(app) {
-    app.get("/sessions", { preHandler: [app.authenticate] }, async (request) => {
+    app.get("/sessions", { preHandler: [app.authenticate, app.requireScopes("sessions:read")] }, async (request) => {
         const userId = request.user?.id;
         if (!userId)
             return { sessions: [] };
@@ -23,7 +23,7 @@ export default async function sessionRoutes(app) {
             })),
         };
     });
-    app.delete("/sessions/:id", { preHandler: [app.authenticate] }, async (request, reply) => {
+    app.delete("/sessions/:id", { preHandler: [app.authenticate, app.requireScopes("sessions:revoke")] }, async (request, reply) => {
         const userId = request.user?.id;
         const { id } = request.params;
         if (!userId)
@@ -37,7 +37,7 @@ export default async function sessionRoutes(app) {
         await request.audit("session_revoked", { sessionId: id });
         return { success: true };
     });
-    app.post("/sessions/revoke-all", { preHandler: [app.authenticate] }, async (request, reply) => {
+    app.post("/sessions/revoke-all", { preHandler: [app.authenticate, app.requireScopes("sessions:revoke")] }, async (request, reply) => {
         const userId = request.user?.id;
         if (!userId)
             return reply.status(401).send({ error: "Unauthorized" });