@hilbras/keystone 2.5.0 → 2.6.0

package/CHANGELOG.md

@@ -5,6 +5,79 @@ All notable changes to Hilbras Keystone are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.6.0] - 2026-09-27
+
+### Security
+
+- **The API key scope guard had a bypass by construction.** It read
+  `scopes.includes(scope) || scopes.includes("service_account")`, so a key whose
+  scope list contained the literal string `"service_account"` satisfied *every*
+  scope requirement. That string was client-suppliable: `POST /api-keys` stored
+  whatever `scopes` it was given, with no validation against any list.
+- **The same guard also failed open.** It returned early whenever
+  `apiKeyScopes` was absent, which is indistinguishable from "this is a session".
+  A key that resolved without a scope list therefore skipped the check entirely.
+- **The guard was never referenced.** `requireScopes` was defined and decorated
+  onto the Fastify instance, but no route in the repository used it. Scopes were
+  stored, returned to callers, and enforced nowhere.
+
+### How exploitable this actually was
+
+Stated precisely, because it matters for prioritising: `app.authenticate` is
+JWT-only and returns 401 for anything that is not a valid access token.
+`authenticateOrApiKey` is the handler with the API key path, and before this
+release exactly one route used it — `GET /auth/validate`. A leaked API key
+therefore reached one endpoint, which returns the caller's own public profile.
+
+So the exposure was a credential whose stated limits were fiction, on a
+credential that could be used almost nowhere. That is a real defect and worth
+fixing, but it is not an authentication bypass, and describing it as one would
+mislead anyone deciding what to do first.
+
+### Changed
+
+- `src/services/scopes.ts` — a scope registry: the canonical names, their
+  descriptions, per-principal defaults, validation, and the allow-list grant
+  check. A scope that is not defined cannot be granted.
+- Unknown or forbidden scopes are refused at key creation with a `400` naming
+  what was rejected and what is allowed, instead of being stored verbatim.
+- `requireScopes` now fails closed, keyed off a new `request.apiKeyId` that is
+  set only when a machine credential authenticated the request. A session is
+  still exempt, since it carries a person's authority and is governed by the
+  permission system.
+- Applied to the routes where a credential's limits matter most: API key
+  creation, listing and revocation, session listing and revocation, and profile
+  read and write.
+- `profile:read`, `profile:write`, and `mfa:manage` are human-only. A service
+  account's profile is a synthesized object with an id of `sa:<uuid>` that
+  matches no user row, so the scope is meaningless for a machine and misleading
+  in an audit log.
+- A service account's default grant is now `organizations:read` only. A personal
+  key's default is read-only on the caller's own resources; the previous
+  `api:read` default was not in any registry, which is a fair indication that
+  nothing was checking it.
+
+### Added
+
+- `src/plugins/machinePrincipal.ts` — `requireHumanPrincipal`, refusing a service
+  account on TOTP, WebAuthn, SMS OTP, identity linking, OAuth consent, and
+  userinfo routes with an explicit `403` and an audit record. This is a backstop
+  rather than a fix for a live hole: those routes are JWT-only today, so a
+  machine credential is refused with a 401 before the guard is reached. It exists
+  so that switching a route to `authenticateOrApiKey` does not silently make a
+  machine principal acceptable somewhere a person was assumed.
+- 25 tests covering the registry, validation, intersection, the grant check, the
+  fail-closed behaviour, HTTP enforcement on the one key-reachable route, and
+  the machine-principal boundary.
+
+### Fixed
+
+- Scope enforcement is keyed on `apiKeyId` rather than the presence of a scope
+  list, closing the fail-open path.
+- The `service_account` wildcard no longer grants anything.
+- Scope ordering is normalised, so two equivalent requests produce identical
+  rows.
+
 ## [2.5.0] - 2026-09-27
 
 ### Security

package/README.md

@@ -1,6 +1,6 @@
 # Hilbras Keystone
 
-**Current version: `2.5.0`**
+**Current version: `2.6.0`**
 
 > A provider-agnostic, API-first identity platform for Hilbras products and third-party applications.
 
@@ -22,6 +22,19 @@ Keystone is a **standalone identity platform**, not a wrapper around another ide
 
 ---
 
+## What's new in v2.6.0
+
+- **API key scopes are now a real registry** — a single list of scope names with descriptions. A scope not in the registry cannot be granted, so there is no string a caller can invent, and a route that needs a scope names it from the list so enforcement cannot quietly drift out of date again.
+- **Unknown scopes are refused, not dropped** — key creation previously stored whatever strings it was given. Silently discarding an unrecognised one hides a typo and leaves the caller believing they hold something they do not, so it now returns `400` listing what was rejected and what is allowed.
+- **The `service_account` wildcard is gone** — the scope guard treated a key as holding *every* scope if its scope list merely contained the string `"service_account"`, and that string was client-suppliable at key creation. It is no longer a scope, and a key holding only it satisfies nothing.
+- **The scope guard fails closed** — it previously returned early whenever `apiKeyScopes` was absent, which is indistinguishable from "this is a session", so a key that resolved without a scope list skipped the check entirely. It now keys off `apiKeyId`, which is set only when a machine credential authenticated.
+- **Scopes are enforced** on key, session, and profile routes, so a key is limited to the operations its grant covers.
+- **Profile and MFA scopes cannot be granted to a service account** — a machine's "profile" is a synthesized object with an id of `sa:<uuid>` that matches no user row, and it has no authenticator to enrol a second factor with.
+- **A stated boundary for machine principals** — `requireHumanPrincipal` refuses a service account on TOTP, WebAuthn, SMS OTP, identity linking, consent, and userinfo routes, with an explicit `403` and an audit record, rather than relying on the synthetic principal happening to match no row.
+- **Personal keys default to read-only** on the caller's own resources. The previous default, `api:read`, was not in any registry — a fair sign that nothing was checking it.
+
+> **Note on reachability.** `app.authenticate` is JWT-only, so almost every route still refuses an API key outright. `GET /auth/validate` is the one route that accepts one, and it is where scope enforcement is observable end to end. What this release fixes is the enforcement machinery, so the next route to adopt key authentication inherits a real check.
+
 ## What's new in v2.5.0
 
 - **The OIDC nonce now reaches the Google connector** — `GoogleConnector.exchangeCode` overrode the base method without forwarding its options, so the nonce added in 2.4.0 was silently discarded for the default provider. Every non-Google OIDC provider validated the nonce; Google, the most likely to be in use, did not.

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,OAAO,EAAE,EAAE,KAAK,eAAe,EAAE,MAAM,SAAS,CAAC;AAqFxD,wBAAsB,QAAQ,+RA2M7B"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,OAAO,EAAE,EAAE,KAAK,eAAe,EAAE,MAAM,SAAS,CAAC;AAsFxD,wBAAsB,QAAQ,+RA4M7B"}

package/dist/index.js

@@ -33,6 +33,7 @@ import appContextPlugin from "./plugins/appContext.js";
 import permissionsPlugin from "./plugins/permissions.js";
 import mtlsPlugin from "./plugins/mtls.js";
 import headerSanitization from "./plugins/headerSanitization.js";
+import machinePrincipal from "./plugins/machinePrincipal.js";
 import metricsPlugin from "./plugins/metrics.js";
 import { globalRateLimit } from "./plugins/rateLimit.js";
 import authRoutes from "./routes/auth.js";
@@ -101,7 +102,7 @@ export async function buildApp() {
             info: {
                 title: "Hilbras Keystone API",
                 description: "Identity platform API for Hilbras products and third-party apps.",
-                version: "2.5.0",
+                version: "2.6.0",
             },
             servers: [{ url: config.AUTH_API_PUBLIC_URL || `http://localhost:${config.PORT}` }],
             tags: [
@@ -181,6 +182,7 @@ export async function buildApp() {
     }));
     await app.register(appContextPlugin);
     await app.register(authPlugin);
+    await app.register(machinePrincipal);
     await app.register(permissionsPlugin);
     await app.register(mtlsPlugin);
     await app.register(metricsPlugin);

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,OAAiC,MAAM,SAAS,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC;AAC/B,OAAO,IAAI,MAAM,eAAe,CAAC;AACjC,OAAO,MAAM,MAAM,iBAAiB,CAAC;AACrC,OAAO,OAAO,MAAM,kBAAkB,CAAC;AACvC,OAAO,SAAS,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,kCAAkC,CAAC;AAC3D,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,EAAE,EAAE,MAAM,eAAe,CAAC;AACnC,OAAO,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AACxE,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAEtE,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,UAAU,MAAM,mBAAmB,CAAC;AAC3C,OAAO,WAAW,MAAM,oBAAoB,CAAC;AAC7C,OAAO,aAAa,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AAC/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,kDAAkD,CAAC;AAC7F,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAC;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAEhE,OAAO,gBAAgB,MAAM,yBAAyB,CAAC;AACvD,OAAO,iBAAiB,MAAM,0BAA0B,CAAC;AACzD,OAAO,UAAU,MAAM,mBAAmB,CAAC;AAC3C,OAAO,kBAAkB,MAAM,iCAAiC,CAAC;AACjE,OAAO,aAAa,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,UAAU,MAAM,kBAAkB,CAAC;AAC1C,OAAO,WAAW,MAAM,mBAAmB,CAAC;AAC5C,OAAO,YAAY,MAAM,oBAAoB,CAAC;AAC9C,OAAO,cAAc,MAAM,sBAAsB,CAAC;AAClD,OAAO,YAAY,MAAM,qBAAqB,CAAC;AAC/C,OAAO,WAAW,MAAM,mBAAmB,CAAC;AAC5C,OAAO,oBAAoB,MAAM,6BAA6B,CAAC;AAC/D,OAAO,eAAe,MAAM,wBAAwB,CAAC;AACrD,OAAO,UAAU,MAAM,kBAAkB,CAAC;AAC1C,OAAO,cAAc,MAAM,sBAAsB,CAAC;AAClD,OAAO,YAAY,MAAM,oBAAoB,CAAC;AAC9C,OAAO,WAAW,MAAM,mBAAmB,CAAC;AAC5C,OAAO,UAAU,MAAM,kBAAkB,CAAC;AAC1C,OAAO,oBAAoB,MAAM,4BAA4B,CAAC;AAC9D,OAAO,UAAU,MAAM,kBAAkB,CAAC;AAC1C,OAAO,gBAAgB,MAAM,wBAAwB,CAAC;AACtD,OAAO,cAAc,MAAM,uBAAuB,CAAC;AACnD,OAAO,WAAW,MAAM,mBAAmB,CAAC;AAC5C,OAAO,SAAS,MAAM,iBAAiB,CAAC;AACxC,OAAO,YAAY,MAAM,oBAAoB,CAAC;AAC9C,OAAO,aAAa,MAAM,sBAAsB,CAAC;AACjD,OAAO,aAAa,MAAM,qBAAqB,CAAC;AAChD,OAAO,uBAAuB,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAEhF,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE/D,KAAK,UAAU,kBAAkB,CAAC,GAAoB;IACpD,MAAM,WAAW,GAAG,CAAC,MAAM,CAAC,gBAAgB,IAAI,EAAE,CAAC;SAChD,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;YACxC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC;YACzD,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;gBACjE,cAAc,CAAC,MAAwB,CAAC,CAAC;gBACzC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,sBAAsB,UAAU,KAAK,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;YAC5E,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,UAAU,wCAAwC,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,yBAAyB,UAAU,EAAE,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ;IAC5B,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IAExC,MAAM,GAAG,GAAG,OAAO,CAAC;QAClB,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE;QACtE,wEAAwE;QACxE,oDAAoD;QACpD,UAAU,EAAE,wBAAwB,EAAE;QACtC,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE;KACpC,CAAC,CAAC;IAEH,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAErC,MAAM,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IAClC,2EAA2E;IAC3E,gEAAgE;IAChE,MAAM,GAAG,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IAEvC,MAAM,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE;QAC1B,OAAO,EAAE;YACP,IAAI,EAAE;gBACJ,KAAK,EAAE,sBAAsB;gBAC7B,WAAW,EAAE,kEAAkE;gBAC/E,OAAO,EAAE,OAAO;aACjB;YACD,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,mBAAmB,IAAI,oBAAoB,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YACnF,IAAI,EAAE;gBACJ,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,uCAAuC,EAAE;gBACtE,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,yCAAyC,EAAE;gBACzE,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,2BAA2B,EAAE;aAChE;SACF;KACF,CAAC,CAAC;IACH,MAAM,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE;QAC5B,WAAW,EAAE,gBAAgB;KAC9B,CAAC,CAAC;IAEH,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE;QACvB,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE;YACrB,IAAI,CAAC,MAAM;gBAAE,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACnC,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC/D,IAAI,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACnE,uEAAuE;YACvE,+DAA+D;YAC/D,IAAI,MAAM,CAAC,QAAQ,KAAK,YAAY,IAAI,MAAM,EAAE,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBAChF,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACxB,CAAC;YACD,EAAE,CAAC,IAAI,KAAK,CAAC,oBAAoB,CAAC,EAAE,KAAK,CAAC,CAAC;QAC7C,CAAC;QACD,WAAW,EAAE,IAAI;KAClB,CAAC,CAAC;IAEH,MAAM,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE;QACzB,MAAM,EAAE,MAAM,CAAC,gBAAgB,IAAI,SAAS;QAC5C,YAAY,EAAE,EAAE;KACjB,CAAC,CAAC;IAEH,MAAM,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAEhC,iCAAiC;IACjC,YAAY,CAAC,kBAAkB,CAAC,CAAC;IACjC,YAAY,CAAC,iBAAiB,CAAC,CAAC;IAChC,YAAY,CAAC,yBAAyB,CAAC,CAAC;IACxC,SAAS,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,CAAC;IAClD,SAAS,CAAC,qBAAqB,EAAE,iBAAiB,CAAC,CAAC;IAEpD,sCAAsC;IACtC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACnC,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,OAAkE,CAAC;QAC3F,MAAM,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IACH,kBAAkB,EAAE,CAAC;IACrB,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACrC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,OAK1C,CAAC;QACF,MAAM,KAAK,CAAC,GAAG,EAAE;YACf,MAAM,EAAE,MAAM,IAAI,MAAM;YACxB,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,OAAO,EAAE;YAC3D,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;SAC9C,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC1C,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC,OAAgD,CAAC;QACnF,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAC;QAC1E,MAAM,cAAc,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,sDAAsD;IACtD,GAAG,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC,MAAsB,EAAE,EAAE;QACxD,cAAc,CAAC,MAAM,CAAC,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,sBAAsB,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,MAAM,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAE9B,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;QAChC,MAAM,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QACtB,yEAAyE;QACzE,+DAA+D;QAC/D,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,+DAA+D;IAC/D,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,eAAe,CAAC;QACvC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,IAAI,GAAG;QACxD,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,IAAI,EAAE;KAC7D,CAAC,CAAC,CAAC;IAEJ,MAAM,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IACrC,MAAM,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC/B,MAAM,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IACtC,MAAM,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC/B,MAAM,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IAElC,MAAM,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACpD,MAAM,GAAG,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACvD,MAAM,GAAG,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACvD,MAAM,GAAG,CAAC,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACjE,MAAM,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACrD,MAAM,GAAG,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IACxD,MAAM,GAAG,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACxD,MAAM,GAAG,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACtD,MAAM,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IACzD,MAAM,GAAG,CAAC,QAAQ,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IAClE,MAAM,GAAG,CAAC,QAAQ,CAAC,eAAe,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACzD,MAAM,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACpD,MAAM,GAAG,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACxD,MAAM,GAAG,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACtD,MAAM,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,MAAM,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACnD,MAAM,GAAG,CAAC,QAAQ,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7D,MAAM,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAChD,MAAM,GAAG,CAAC,QAAQ,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;IAChE,MAAM,GAAG,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IAC5D,MAAM,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAClD,MAAM,GAAG,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAEjE,MAAM,MAAM,GAAG,MAAM,CAAC,mBAAmB,IAAI,oBAAoB,MAAM,CAAC,IAAI,EAAE,CAAC;IAC/E,GAAG,CAAC,GAAG,CAAC,mCAAmC,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC7F,MAAM;QACN,sBAAsB,EAAE,GAAG,MAAM,mBAAmB;QACpD,cAAc,EAAE,GAAG,MAAM,eAAe;QACxC,iBAAiB,EAAE,GAAG,MAAM,kBAAkB;QAC9C,mBAAmB,EAAE,GAAG,MAAM,gBAAgB;QAC9C,QAAQ,EAAE,GAAG,MAAM,wBAAwB;QAC3C,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,EAAE,oBAAoB,CAAC;QACpF,uBAAuB,EAAE,CAAC,QAAQ,CAAC;QACnC,qCAAqC,EAAE,CAAC,OAAO,CAAC;QAChD,gBAAgB,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;QAChD,qCAAqC,EAAE,CAAC,oBAAoB,EAAE,qBAAqB,CAAC;QACpF,gCAAgC,EAAE,CAAC,MAAM,CAAC;KAC3C,CAAC,CAAC,CAAC;IAEJ,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,KAAK,IAAI,EAAE;QAChF,OAAO,aAAa,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAExF,MAAM,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAEtD,GAAG,CAAC,eAAe,CAAC,CAAC,KAAc,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACrD,MAAM,SAAS,GAAG,KAAK,YAAY,QAAQ,IAAI,CAC7C,KAAK;YACL,OAAO,KAAK,KAAK,QAAQ;YACzB,CAAE,KAA4B,CAAC,IAAI,KAAK,UAAU;gBAChD,CAAC,QAAQ,IAAI,KAAK,IAAI,KAAK,CAAC,OAAO,CAAE,KAA8B,CAAC,MAAM,CAAC,CAAC,CAAC,CAChF,CAAC;QACF,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,KAAK,YAAY,QAAQ;gBACtC,CAAC,CAAC,KAAK,CAAC,MAAM;gBACd,CAAC,CAAE,KAAgF,CAAC,MAAM,CAAC;YAC7F,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE,eAAe;gBACtB,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,eAAe,EAAE,CAAC,CAAC;aACxG,CAAC,CAAC;QACL,CAAC;QAED,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,YAAY,IAAI,KAAK,EAAE,CAAC;YAChE,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,IAAI,KAAK,YAAY,KAAK,IAAI,YAAY,IAAI,KAAK,EAAE,CAAC;YACpD,MAAM,UAAU,GAAI,KAAwC,CAAC,UAAU,CAAC;YACxE,MAAM,IAAI,GAAI,KAAmC,CAAC,IAAI,CAAC;YACvD,IAAI,UAAU,IAAI,GAAG,IAAI,UAAU,GAAG,GAAG,EAAE,CAAC;gBAC1C,OAAO,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,iBAAiB,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3F,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,KAAK;IAClB,YAAY,EAAE,CAAC;IACf,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QAC3C,OAAO,CAAC,IAAI,CAAC,mDAAmD,EAAE,GAAG,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,MAAM,QAAQ,EAAE,CAAC;IAE7B,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,iBAAiB,CAAC,EAAE,CAAC,CAAC;QACpF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,oEAAoE,CAAC,CAAC;IAC/F,CAAC;IAED,IAAI,CAAC;QACH,MAAM,eAAe,EAAE,CAAC;QACxB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,8DAA8D,CAAC,CAAC;IACzF,CAAC;IAED,+EAA+E;IAC/E,yEAAyE;IACzE,IAAI,CAAC;QACH,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,mCAAmC,CAAC,CAAC;QACnF,MAAM,oBAAoB,CAAC,YAAY,EAAE,CAAC,wBAAwB,CAAC,CAAC;IACtE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,6CAA6C,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,CAAC;QACH,kBAAkB,EAAE,CAAC;QACrB,eAAe,EAAE,CAAC;IACpB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,oDAAoD,CAAC,CAAC;IAC9E,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,SAAS,CAAC,oBAAoB,CAAC,2BAA2B,EAAE,CAAC;QACvE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,uEAAuE,CAAC,CAAC;IAClG,CAAC;IAED,IAAI,CAAC;QACH,MAAM,aAAa,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,gEAAgE,CAAC,CAAC;IAC1F,CAAC;IAED,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;QAChC,MAAM,WAAW,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,sCAAsC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACnF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAClE,KAAK,EAAE,CAAC;AACV,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,OAAiC,MAAM,SAAS,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC;AAC/B,OAAO,IAAI,MAAM,eAAe,CAAC;AACjC,OAAO,MAAM,MAAM,iBAAiB,CAAC;AACrC,OAAO,OAAO,MAAM,kBAAkB,CAAC;AACvC,OAAO,SAAS,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,kCAAkC,CAAC;AAC3D,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,EAAE,EAAE,MAAM,eAAe,CAAC;AACnC,OAAO,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AACxE,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAEtE,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,UAAU,MAAM,mBAAmB,CAAC;AAC3C,OAAO,WAAW,MAAM,oBAAoB,CAAC;AAC7C,OAAO,aAAa,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AAC/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,kDAAkD,CAAC;AAC7F,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAC;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAEhE,OAAO,gBAAgB,MAAM,yBAAyB,CAAC;AACvD,OAAO,iBAAiB,MAAM,0BAA0B,CAAC;AACzD,OAAO,UAAU,MAAM,mBAAmB,CAAC;AAC3C,OAAO,kBAAkB,MAAM,iCAAiC,CAAC;AACjE,OAAO,gBAAgB,MAAM,+BAA+B,CAAC;AAC7D,OAAO,aAAa,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,UAAU,MAAM,kBAAkB,CAAC;AAC1C,OAAO,WAAW,MAAM,mBAAmB,CAAC;AAC5C,OAAO,YAAY,MAAM,oBAAoB,CAAC;AAC9C,OAAO,cAAc,MAAM,sBAAsB,CAAC;AAClD,OAAO,YAAY,MAAM,qBAAqB,CAAC;AAC/C,OAAO,WAAW,MAAM,mBAAmB,CAAC;AAC5C,OAAO,oBAAoB,MAAM,6BAA6B,CAAC;AAC/D,OAAO,eAAe,MAAM,wBAAwB,CAAC;AACrD,OAAO,UAAU,MAAM,kBAAkB,CAAC;AAC1C,OAAO,cAAc,MAAM,sBAAsB,CAAC;AAClD,OAAO,YAAY,MAAM,oBAAoB,CAAC;AAC9C,OAAO,WAAW,MAAM,mBAAmB,CAAC;AAC5C,OAAO,UAAU,MAAM,kBAAkB,CAAC;AAC1C,OAAO,oBAAoB,MAAM,4BAA4B,CAAC;AAC9D,OAAO,UAAU,MAAM,kBAAkB,CAAC;AAC1C,OAAO,gBAAgB,MAAM,wBAAwB,CAAC;AACtD,OAAO,cAAc,MAAM,uBAAuB,CAAC;AACnD,OAAO,WAAW,MAAM,mBAAmB,CAAC;AAC5C,OAAO,SAAS,MAAM,iBAAiB,CAAC;AACxC,OAAO,YAAY,MAAM,oBAAoB,CAAC;AAC9C,OAAO,aAAa,MAAM,sBAAsB,CAAC;AACjD,OAAO,aAAa,MAAM,qBAAqB,CAAC;AAChD,OAAO,uBAAuB,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAEhF,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE/D,KAAK,UAAU,kBAAkB,CAAC,GAAoB;IACpD,MAAM,WAAW,GAAG,CAAC,MAAM,CAAC,gBAAgB,IAAI,EAAE,CAAC;SAChD,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;YACxC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC;YACzD,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;gBACjE,cAAc,CAAC,MAAwB,CAAC,CAAC;gBACzC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,sBAAsB,UAAU,KAAK,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;YAC5E,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,UAAU,wCAAwC,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,yBAAyB,UAAU,EAAE,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ;IAC5B,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IAExC,MAAM,GAAG,GAAG,OAAO,CAAC;QAClB,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE;QACtE,wEAAwE;QACxE,oDAAoD;QACpD,UAAU,EAAE,wBAAwB,EAAE;QACtC,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE;KACpC,CAAC,CAAC;IAEH,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAErC,MAAM,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IAClC,2EAA2E;IAC3E,gEAAgE;IAChE,MAAM,GAAG,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IAEvC,MAAM,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE;QAC1B,OAAO,EAAE;YACP,IAAI,EAAE;gBACJ,KAAK,EAAE,sBAAsB;gBAC7B,WAAW,EAAE,kEAAkE;gBAC/E,OAAO,EAAE,OAAO;aACjB;YACD,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,mBAAmB,IAAI,oBAAoB,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YACnF,IAAI,EAAE;gBACJ,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,uCAAuC,EAAE;gBACtE,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,yCAAyC,EAAE;gBACzE,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,2BAA2B,EAAE;aAChE;SACF;KACF,CAAC,CAAC;IACH,MAAM,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE;QAC5B,WAAW,EAAE,gBAAgB;KAC9B,CAAC,CAAC;IAEH,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE;QACvB,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE;YACrB,IAAI,CAAC,MAAM;gBAAE,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACnC,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC/D,IAAI,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACnE,uEAAuE;YACvE,+DAA+D;YAC/D,IAAI,MAAM,CAAC,QAAQ,KAAK,YAAY,IAAI,MAAM,EAAE,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBAChF,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACxB,CAAC;YACD,EAAE,CAAC,IAAI,KAAK,CAAC,oBAAoB,CAAC,EAAE,KAAK,CAAC,CAAC;QAC7C,CAAC;QACD,WAAW,EAAE,IAAI;KAClB,CAAC,CAAC;IAEH,MAAM,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE;QACzB,MAAM,EAAE,MAAM,CAAC,gBAAgB,IAAI,SAAS;QAC5C,YAAY,EAAE,EAAE;KACjB,CAAC,CAAC;IAEH,MAAM,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAEhC,iCAAiC;IACjC,YAAY,CAAC,kBAAkB,CAAC,CAAC;IACjC,YAAY,CAAC,iBAAiB,CAAC,CAAC;IAChC,YAAY,CAAC,yBAAyB,CAAC,CAAC;IACxC,SAAS,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,CAAC;IAClD,SAAS,CAAC,qBAAqB,EAAE,iBAAiB,CAAC,CAAC;IAEpD,sCAAsC;IACtC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACnC,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,OAAkE,CAAC;QAC3F,MAAM,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IACH,kBAAkB,EAAE,CAAC;IACrB,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACrC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,OAK1C,CAAC;QACF,MAAM,KAAK,CAAC,GAAG,EAAE;YACf,MAAM,EAAE,MAAM,IAAI,MAAM;YACxB,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,OAAO,EAAE;YAC3D,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;SAC9C,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC1C,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC,OAAgD,CAAC;QACnF,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAC;QAC1E,MAAM,cAAc,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,sDAAsD;IACtD,GAAG,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC,MAAsB,EAAE,EAAE;QACxD,cAAc,CAAC,MAAM,CAAC,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,sBAAsB,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,MAAM,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAE9B,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;QAChC,MAAM,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QACtB,yEAAyE;QACzE,+DAA+D;QAC/D,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,+DAA+D;IAC/D,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,eAAe,CAAC;QACvC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,IAAI,GAAG;QACxD,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,IAAI,EAAE;KAC7D,CAAC,CAAC,CAAC;IAEJ,MAAM,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IACrC,MAAM,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC/B,MAAM,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IACrC,MAAM,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IACtC,MAAM,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC/B,MAAM,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IAElC,MAAM,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACpD,MAAM,GAAG,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACvD,MAAM,GAAG,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACvD,MAAM,GAAG,CAAC,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACjE,MAAM,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACrD,MAAM,GAAG,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IACxD,MAAM,GAAG,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACxD,MAAM,GAAG,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACtD,MAAM,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IACzD,MAAM,GAAG,CAAC,QAAQ,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IAClE,MAAM,GAAG,CAAC,QAAQ,CAAC,eAAe,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACzD,MAAM,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACpD,MAAM,GAAG,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACxD,MAAM,GAAG,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACtD,MAAM,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,MAAM,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACnD,MAAM,GAAG,CAAC,QAAQ,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7D,MAAM,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAChD,MAAM,GAAG,CAAC,QAAQ,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;IAChE,MAAM,GAAG,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IAC5D,MAAM,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAClD,MAAM,GAAG,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAEjE,MAAM,MAAM,GAAG,MAAM,CAAC,mBAAmB,IAAI,oBAAoB,MAAM,CAAC,IAAI,EAAE,CAAC;IAC/E,GAAG,CAAC,GAAG,CAAC,mCAAmC,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC7F,MAAM;QACN,sBAAsB,EAAE,GAAG,MAAM,mBAAmB;QACpD,cAAc,EAAE,GAAG,MAAM,eAAe;QACxC,iBAAiB,EAAE,GAAG,MAAM,kBAAkB;QAC9C,mBAAmB,EAAE,GAAG,MAAM,gBAAgB;QAC9C,QAAQ,EAAE,GAAG,MAAM,wBAAwB;QAC3C,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,EAAE,oBAAoB,CAAC;QACpF,uBAAuB,EAAE,CAAC,QAAQ,CAAC;QACnC,qCAAqC,EAAE,CAAC,OAAO,CAAC;QAChD,gBAAgB,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;QAChD,qCAAqC,EAAE,CAAC,oBAAoB,EAAE,qBAAqB,CAAC;QACpF,gCAAgC,EAAE,CAAC,MAAM,CAAC;KAC3C,CAAC,CAAC,CAAC;IAEJ,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,KAAK,IAAI,EAAE;QAChF,OAAO,aAAa,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAExF,MAAM,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAEtD,GAAG,CAAC,eAAe,CAAC,CAAC,KAAc,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACrD,MAAM,SAAS,GAAG,KAAK,YAAY,QAAQ,IAAI,CAC7C,KAAK;YACL,OAAO,KAAK,KAAK,QAAQ;YACzB,CAAE,KAA4B,CAAC,IAAI,KAAK,UAAU;gBAChD,CAAC,QAAQ,IAAI,KAAK,IAAI,KAAK,CAAC,OAAO,CAAE,KAA8B,CAAC,MAAM,CAAC,CAAC,CAAC,CAChF,CAAC;QACF,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,KAAK,YAAY,QAAQ;gBACtC,CAAC,CAAC,KAAK,CAAC,MAAM;gBACd,CAAC,CAAE,KAAgF,CAAC,MAAM,CAAC;YAC7F,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE,eAAe;gBACtB,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,eAAe,EAAE,CAAC,CAAC;aACxG,CAAC,CAAC;QACL,CAAC;QAED,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,YAAY,IAAI,KAAK,EAAE,CAAC;YAChE,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,IAAI,KAAK,YAAY,KAAK,IAAI,YAAY,IAAI,KAAK,EAAE,CAAC;YACpD,MAAM,UAAU,GAAI,KAAwC,CAAC,UAAU,CAAC;YACxE,MAAM,IAAI,GAAI,KAAmC,CAAC,IAAI,CAAC;YACvD,IAAI,UAAU,IAAI,GAAG,IAAI,UAAU,GAAG,GAAG,EAAE,CAAC;gBAC1C,OAAO,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,iBAAiB,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3F,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,KAAK;IAClB,YAAY,EAAE,CAAC;IACf,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QAC3C,OAAO,CAAC,IAAI,CAAC,mDAAmD,EAAE,GAAG,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,MAAM,QAAQ,EAAE,CAAC;IAE7B,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,iBAAiB,CAAC,EAAE,CAAC,CAAC;QACpF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,oEAAoE,CAAC,CAAC;IAC/F,CAAC;IAED,IAAI,CAAC;QACH,MAAM,eAAe,EAAE,CAAC;QACxB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,8DAA8D,CAAC,CAAC;IACzF,CAAC;IAED,+EAA+E;IAC/E,yEAAyE;IACzE,IAAI,CAAC;QACH,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,mCAAmC,CAAC,CAAC;QACnF,MAAM,oBAAoB,CAAC,YAAY,EAAE,CAAC,wBAAwB,CAAC,CAAC;IACtE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,6CAA6C,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,CAAC;QACH,kBAAkB,EAAE,CAAC;QACrB,eAAe,EAAE,CAAC;IACpB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,oDAAoD,CAAC,CAAC;IAC9E,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,SAAS,CAAC,oBAAoB,CAAC,2BAA2B,EAAE,CAAC;QACvE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,uEAAuE,CAAC,CAAC;IAClG,CAAC;IAED,IAAI,CAAC;QACH,MAAM,aAAa,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,gEAAgE,CAAC,CAAC;IAC1F,CAAC;IAED,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;QAChC,MAAM,WAAW,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,sCAAsC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACnF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAClE,KAAK,EAAE,CAAC;AACV,CAAC"}

package/dist/plugins/auth.d.ts

@@ -9,6 +9,8 @@ declare module "fastify" {
     interface FastifyRequest {
         serviceAccount?: typeof serviceAccounts.$inferSelect;
         apiKeyScopes?: string[];
+        /** Set when a machine credential authenticated the request. */
+        apiKeyId?: string;
     }
 }
 export declare function accessCookieName(clientId?: string): string;

package/dist/plugins/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/plugins/auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAI7E,OAAO,EAAkB,eAAe,EAAa,MAAM,iBAAiB,CAAC;AAK7E,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,eAAe;QACvB,YAAY,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QAC9E,oBAAoB,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QACtF,aAAa,EAAE,CAAC,GAAG,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;KACzG;IAED,UAAU,cAAc;QACtB,cAAc,CAAC,EAAE,OAAO,eAAe,CAAC,YAAY,CAAC;QACrD,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;KACzB;CACF;AAKD,wBAAgB,gBAAgB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAE3D;AAmBD,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,YAAY,EACnB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,MAAM,GAChB,IAAI,CAWN;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,YAAY,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAIhF;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,cAAc,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAE9F;8BA6DgD,eAAe"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/plugins/auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAI7E,OAAO,EAAkB,eAAe,EAAa,MAAM,iBAAiB,CAAC;AAM7E,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,eAAe;QACvB,YAAY,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QAC9E,oBAAoB,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QACtF,aAAa,EAAE,CAAC,GAAG,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;KACzG;IAED,UAAU,cAAc;QACtB,cAAc,CAAC,EAAE,OAAO,eAAe,CAAC,YAAY,CAAC;QACrD,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,+DAA+D;QAC/D,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB;CACF;AAKD,wBAAgB,gBAAgB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAE3D;AAmBD,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,YAAY,EACnB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,MAAM,GAChB,IAAI,CAWN;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,YAAY,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAIhF;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,cAAc,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAE9F;8BA6DgD,eAAe"}

package/dist/plugins/auth.js

@@ -5,6 +5,7 @@ import { db } from "../db/index.js";
 import { apiKeys, users, serviceAccounts } from "../db/schema.js";
 import { verifyAccessToken, hashApiKey } from "../services/tokens.js";
 import { emit } from "../services/events/bus.js";
+import { SERVICE_ACCOUNT_DEFAULT_SCOPES, hasScopes } from "../services/scopes.js";
 const DEFAULT_ACCESS_COOKIE = config.COOKIE_NAME;
 const DEFAULT_REFRESH_COOKIE = `${config.COOKIE_NAME}-refresh`;
 export function accessCookieName(clientId) {
@@ -77,7 +78,7 @@ async function resolveUserFromApiKey(key, request) {
                 metadata: { keyId: keyRecord.id, scopes: keyRecord.scopes ?? [] },
             },
         });
-        return { user, scopes: keyRecord.scopes ?? [] };
+        return { user, scopes: keyRecord.scopes ?? [], keyId: keyRecord.id };
     }
     return undefined;
 }
@@ -135,13 +136,18 @@ export default fp(async function authPlugin(app) {
         if (apiKeyUser) {
             request.user = apiKeyUser.user;
             request.apiKeyScopes = apiKeyUser.scopes;
+            request.apiKeyId = apiKeyUser.keyId;
             return;
         }
         const serviceAccountResult = await resolveServiceAccountFromApiKey(token);
         if (serviceAccountResult) {
             const { serviceAccount, keyId, scopes } = serviceAccountResult;
             request.serviceAccount = serviceAccount;
-            request.apiKeyScopes = ["api:read", "api:write", "service_account"];
+            // An explicit set from the registry, not a wildcard string. Service
+            // accounts are granted scopes explicitly and the grant is stored on the
+            // key, so revoking it is a data change rather than a code change.
+            request.apiKeyScopes = scopes.length > 0 ? scopes : SERVICE_ACCOUNT_DEFAULT_SCOPES;
+            request.apiKeyId = keyId;
             await emit({
                 type: "api_key_used",
                 payload: {
@@ -180,12 +186,20 @@ export default fp(async function authPlugin(app) {
     });
     app.decorate("requireScopes", function requireScopes(...required) {
         return async function scopeCheck(request, reply) {
-            // Session-based authentication has full scope access.
-            if (!request.apiKeyScopes)
+            // A session or bearer token carries the authority of a human and is
+            // governed by the permission system instead. Only machine credentials are
+            // scope-limited.
+            if (!request.apiKeyId)
                 return;
-            const scopes = request.apiKeyScopes;
-            const hasAll = required.every((scope) => scopes.includes(scope) || scopes.includes("service_account"));
-            if (!hasAll) {
+            // Fail closed. Previously the guard returned early whenever
+            // `apiKeyScopes` was absent, which is indistinguishable from "this is a
+            // session" — so a key that resolved without a scope list skipped the check
+            // entirely. Keying off `apiKeyId` removes the ambiguity.
+            if (!hasScopes(request.apiKeyScopes, required)) {
+                await request.audit("unauthorized_access", {
+                    action: "insufficient_api_key_scope",
+                    requiredScope: required.join(" "),
+                });
                 return reply.status(403).send({ error: "Insufficient API key scope", required });
             }
         };

package/dist/plugins/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/plugins/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAEhC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAa,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAEtE,OAAO,EAAE,IAAI,EAAE,MAAM,2BAA2B,CAAC;AAejD,MAAM,qBAAqB,GAAG,MAAM,CAAC,WAAW,CAAC;AACjD,MAAM,sBAAsB,GAAG,GAAG,MAAM,CAAC,WAAW,UAAU,CAAC;AAE/D,MAAM,UAAU,gBAAgB,CAAC,QAAiB;IAChD,OAAO,QAAQ,CAAC,CAAC,CAAC,OAAO,QAAQ,UAAU,CAAC,CAAC,CAAC,qBAAqB,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAiB;IACjD,OAAO,QAAQ,CAAC,CAAC,CAAC,OAAO,QAAQ,kBAAkB,CAAC,CAAC,CAAC,sBAAsB,CAAC;AAC/E,CAAC;AAED,SAAS,aAAa;IAOpB,MAAM,QAAQ,GAAI,MAAM,CAAC,gBAA8C,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACjI,OAAO;QACL,IAAI,EAAE,GAAG;QACT,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,MAAM,CAAC,aAAa;QAC5B,QAAQ;QACR,MAAM,EAAE,MAAM,CAAC,aAAa,IAAI,SAAS;KAC1C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,KAAmB,EACnB,WAAmB,EACnB,YAAoB,EACpB,QAAiB;IAEjB,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAE7B,KAAK,CAAC,SAAS,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE;QACvD,GAAG,IAAI;QACP,MAAM,EAAE,MAAM,CAAC,wBAAwB;KACxC,CAAC,CAAC;IACH,KAAK,CAAC,SAAS,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,YAAY,EAAE;QACzD,GAAG,IAAI;QACP,MAAM,EAAE,MAAM,CAAC,yBAAyB;KACzC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAmB,EAAE,QAAiB;IACxE,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,KAAK,CAAC,WAAW,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;IACpD,KAAK,CAAC,WAAW,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAuB,EAAE,QAAiB;IACxE,OAAO,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,MAAmB;IACtD,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACtF,OAAO,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3C,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,GAAW;IAC5C,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE;SACzB,MAAM,EAAE;SACR,IAAI,CAAC,OAAO,CAAC;SACb,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;SAChE,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,GAAW,EACX,OAAuB;IAEvB,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACjD,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACjC,IAAI,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE;QAAE,OAAO,SAAS,CAAC;IAE9E,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;IAE7F,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;QACrB,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5F,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC9C,MAAM,IAAI,CAAC;YACT,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE;gBACP,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,SAAS;gBACnC,SAAS,EAAE,OAAO,CAAC,EAAE;gBACrB,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC;gBACxC,QAAQ,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,EAAE,EAAE;aAClE;SACF,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;IAClD,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAuB;IACjD,+DAA+D;IAC/D,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC;IACjD,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3F,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IAEhC,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC7D,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IAExC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;IAC7C,IAAI,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,eAAe,EAAE,CAAC,KAAK,UAAU,UAAU,CAAC,GAAoB;IAC9D,GAAG,CAAC,QAAQ,CAAC,cAAc,EAAE,KAAK,UAAU,YAAY,CAAC,OAAO,EAAE,KAAK;QACrE,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAC9C,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,MAAM,CAAC,CAAC;YACjD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAC7D,CAAC;YACD,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;YACpB,OAAO,CAAC,UAAU,GAAG,MAAM,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,QAAQ,CAAC,sBAAsB,EAAE,KAAK,UAAU,oBAAoB,CAAC,OAAO,EAAE,KAAK;QACrF,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAC9C,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,MAAM,CAAC,CAAC;YACjD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAC7D,CAAC;YACD,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;YACpB,OAAO;QACT,CAAC;QAAC,MAAM,CAAC;YACP,0CAA0C;QAC5C,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,qBAAqB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC/D,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;YAC/B,OAAO,CAAC,YAAY,GAAG,UAAU,CAAC,MAAM,CAAC;YACzC,OAAO;QACT,CAAC;QAED,MAAM,oBAAoB,GAAG,MAAM,+BAA+B,CAAC,KAAK,CAAC,CAAC;QAC1E,IAAI,oBAAoB,EAAE,CAAC;YACzB,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,oBAAoB,CAAC;YAC/D,OAAO,CAAC,cAAc,GAAG,cAAc,CAAC;YACxC,OAAO,CAAC,YAAY,GAAG,CAAC,UAAU,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC;YACpE,MAAM,IAAI,CAAC;gBACT,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE;oBACP,KAAK,EAAE,cAAc,CAAC,KAAK;oBAC3B,SAAS,EAAE,OAAO,CAAC,EAAE;oBACrB,EAAE,EAAE,OAAO,CAAC,EAAE;oBACd,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC;oBACxC,QAAQ,EAAE,EAAE,gBAAgB,EAAE,cAAc,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE;iBACjE;aACF,CAAC,CAAC;YACH,8EAA8E;YAC9E,OAAO,CAAC,IAAI,GAAG;gBACb,EAAE,EAAE,MAAM,cAAc,CAAC,EAAE,EAAE;gBAC7B,KAAK,EAAE,mBAAmB,cAAc,CAAC,EAAE,WAAW;gBACtD,QAAQ,EAAE,MAAM,cAAc,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;gBAC/C,IAAI,EAAE,cAAc,CAAC,IAAI;gBACzB,SAAS,EAAE,IAAI;gBACf,aAAa,EAAE,IAAI;gBACnB,IAAI,EAAE,YAAY;gBAClB,IAAI,EAAE,iBAAiB;gBACvB,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,SAAS;gBACnB,aAAa,EAAE,IAAI;gBACnB,YAAY,EAAE,cAAc,CAAC,KAAK;gBAClC,WAAW,EAAE,IAAI;gBACjB,aAAa,EAAE,KAAK;gBACpB,UAAU,EAAE,IAAI;gBAChB,WAAW,EAAE,KAAK;gBAClB,cAAc,EAAE,IAAI;gBACpB,SAAS,EAAE,cAAc,CAAC,SAAS;gBACnC,SAAS,EAAE,cAAc,CAAC,SAAS;aAC5B,CAAC;YACV,OAAO;QACT,CAAC;QAED,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,QAAQ,CAAC,eAAe,EAAE,SAAS,aAAa,CAAC,GAAG,QAAkB;QACxE,OAAO,KAAK,UAAU,UAAU,CAAC,OAAuB,EAAE,KAAmB;YAC3E,sDAAsD;YACtD,IAAI,CAAC,OAAO,CAAC,YAAY;gBAAE,OAAO;YAClC,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;YACpC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC;YACvG,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,QAAQ,EAAE,CAAC,CAAC;YACnF,CAAC;QACH,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,+BAA+B,CAAC,GAAW;IACxD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE;SACzB,MAAM,EAAE;SACR,IAAI,CAAC,OAAO,CAAC;SACb,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;SAChE,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACjC,IAAI,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE;QAAE,OAAO,SAAS,CAAC;IAC9E,IAAI,CAAC,SAAS,CAAC,gBAAgB;QAAE,OAAO,SAAS,CAAC;IAElD,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7F,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,EAAE;SACR,IAAI,CAAC,eAAe,CAAC;SACrB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,SAAS,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;SAClG,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAChH,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/plugins/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAEhC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAa,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAEtE,OAAO,EAAE,IAAI,EAAE,MAAM,2BAA2B,CAAC;AACjD,OAAO,EAAE,8BAA8B,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAiBlF,MAAM,qBAAqB,GAAG,MAAM,CAAC,WAAW,CAAC;AACjD,MAAM,sBAAsB,GAAG,GAAG,MAAM,CAAC,WAAW,UAAU,CAAC;AAE/D,MAAM,UAAU,gBAAgB,CAAC,QAAiB;IAChD,OAAO,QAAQ,CAAC,CAAC,CAAC,OAAO,QAAQ,UAAU,CAAC,CAAC,CAAC,qBAAqB,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAiB;IACjD,OAAO,QAAQ,CAAC,CAAC,CAAC,OAAO,QAAQ,kBAAkB,CAAC,CAAC,CAAC,sBAAsB,CAAC;AAC/E,CAAC;AAED,SAAS,aAAa;IAOpB,MAAM,QAAQ,GAAI,MAAM,CAAC,gBAA8C,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACjI,OAAO;QACL,IAAI,EAAE,GAAG;QACT,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,MAAM,CAAC,aAAa;QAC5B,QAAQ;QACR,MAAM,EAAE,MAAM,CAAC,aAAa,IAAI,SAAS;KAC1C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,KAAmB,EACnB,WAAmB,EACnB,YAAoB,EACpB,QAAiB;IAEjB,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAE7B,KAAK,CAAC,SAAS,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE;QACvD,GAAG,IAAI;QACP,MAAM,EAAE,MAAM,CAAC,wBAAwB;KACxC,CAAC,CAAC;IACH,KAAK,CAAC,SAAS,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,YAAY,EAAE;QACzD,GAAG,IAAI;QACP,MAAM,EAAE,MAAM,CAAC,yBAAyB;KACzC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAmB,EAAE,QAAiB;IACxE,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,KAAK,CAAC,WAAW,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;IACpD,KAAK,CAAC,WAAW,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAuB,EAAE,QAAiB;IACxE,OAAO,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,MAAmB;IACtD,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACtF,OAAO,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3C,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,GAAW;IAC5C,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE;SACzB,MAAM,EAAE;SACR,IAAI,CAAC,OAAO,CAAC;SACb,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;SAChE,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,GAAW,EACX,OAAuB;IAEvB,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACjD,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACjC,IAAI,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE;QAAE,OAAO,SAAS,CAAC;IAE9E,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;IAE7F,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;QACrB,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5F,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC9C,MAAM,IAAI,CAAC;YACT,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE;gBACP,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,SAAS;gBACnC,SAAS,EAAE,OAAO,CAAC,EAAE;gBACrB,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC;gBACxC,QAAQ,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,EAAE,EAAE;aAClE;SACF,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC;IACvE,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAuB;IACjD,+DAA+D;IAC/D,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC;IACjD,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3F,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IAEhC,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC7D,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IAExC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;IAC7C,IAAI,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,eAAe,EAAE,CAAC,KAAK,UAAU,UAAU,CAAC,GAAoB;IAC9D,GAAG,CAAC,QAAQ,CAAC,cAAc,EAAE,KAAK,UAAU,YAAY,CAAC,OAAO,EAAE,KAAK;QACrE,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAC9C,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,MAAM,CAAC,CAAC;YACjD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAC7D,CAAC;YACD,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;YACpB,OAAO,CAAC,UAAU,GAAG,MAAM,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,QAAQ,CAAC,sBAAsB,EAAE,KAAK,UAAU,oBAAoB,CAAC,OAAO,EAAE,KAAK;QACrF,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAC9C,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,MAAM,CAAC,CAAC;YACjD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAC7D,CAAC;YACD,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;YACpB,OAAO;QACT,CAAC;QAAC,MAAM,CAAC;YACP,0CAA0C;QAC5C,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,qBAAqB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC/D,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;YAC/B,OAAO,CAAC,YAAY,GAAG,UAAU,CAAC,MAAM,CAAC;YACzC,OAAO,CAAC,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC;YACpC,OAAO;QACT,CAAC;QAED,MAAM,oBAAoB,GAAG,MAAM,+BAA+B,CAAC,KAAK,CAAC,CAAC;QAC1E,IAAI,oBAAoB,EAAE,CAAC;YACzB,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,oBAAoB,CAAC;YAC/D,OAAO,CAAC,cAAc,GAAG,cAAc,CAAC;YACxC,oEAAoE;YACpE,wEAAwE;YACxE,kEAAkE;YAClE,OAAO,CAAC,YAAY,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,8BAA8B,CAAC;YACnF,OAAO,CAAC,QAAQ,GAAG,KAAK,CAAC;YACzB,MAAM,IAAI,CAAC;gBACT,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE;oBACP,KAAK,EAAE,cAAc,CAAC,KAAK;oBAC3B,SAAS,EAAE,OAAO,CAAC,EAAE;oBACrB,EAAE,EAAE,OAAO,CAAC,EAAE;oBACd,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC;oBACxC,QAAQ,EAAE,EAAE,gBAAgB,EAAE,cAAc,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE;iBACjE;aACF,CAAC,CAAC;YACH,8EAA8E;YAC9E,OAAO,CAAC,IAAI,GAAG;gBACb,EAAE,EAAE,MAAM,cAAc,CAAC,EAAE,EAAE;gBAC7B,KAAK,EAAE,mBAAmB,cAAc,CAAC,EAAE,WAAW;gBACtD,QAAQ,EAAE,MAAM,cAAc,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;gBAC/C,IAAI,EAAE,cAAc,CAAC,IAAI;gBACzB,SAAS,EAAE,IAAI;gBACf,aAAa,EAAE,IAAI;gBACnB,IAAI,EAAE,YAAY;gBAClB,IAAI,EAAE,iBAAiB;gBACvB,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,SAAS;gBACnB,aAAa,EAAE,IAAI;gBACnB,YAAY,EAAE,cAAc,CAAC,KAAK;gBAClC,WAAW,EAAE,IAAI;gBACjB,aAAa,EAAE,KAAK;gBACpB,UAAU,EAAE,IAAI;gBAChB,WAAW,EAAE,KAAK;gBAClB,cAAc,EAAE,IAAI;gBACpB,SAAS,EAAE,cAAc,CAAC,SAAS;gBACnC,SAAS,EAAE,cAAc,CAAC,SAAS;aAC5B,CAAC;YACV,OAAO;QACT,CAAC;QAED,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,QAAQ,CAAC,eAAe,EAAE,SAAS,aAAa,CAAC,GAAG,QAAkB;QACxE,OAAO,KAAK,UAAU,UAAU,CAAC,OAAuB,EAAE,KAAmB;YAC3E,oEAAoE;YACpE,0EAA0E;YAC1E,iBAAiB;YACjB,IAAI,CAAC,OAAO,CAAC,QAAQ;gBAAE,OAAO;YAE9B,4DAA4D;YAC5D,wEAAwE;YACxE,2EAA2E;YAC3E,yDAAyD;YACzD,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAC/C,MAAM,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE;oBACzC,MAAM,EAAE,4BAA4B;oBACpC,aAAa,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;iBAClC,CAAC,CAAC;gBACH,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,QAAQ,EAAE,CAAC,CAAC;YACnF,CAAC;QACH,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,+BAA+B,CAAC,GAAW;IACxD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE;SACzB,MAAM,EAAE;SACR,IAAI,CAAC,OAAO,CAAC;SACb,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;SAChE,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACjC,IAAI,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE;QAAE,OAAO,SAAS,CAAC;IAC9E,IAAI,CAAC,SAAS,CAAC,gBAAgB;QAAE,OAAO,SAAS,CAAC;IAElD,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7F,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,EAAE;SACR,IAAI,CAAC,eAAe,CAAC;SACrB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,SAAS,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;SAClG,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAChH,CAAC"}

package/dist/plugins/machinePrincipal.d.ts

@@ -0,0 +1,28 @@
+import type { FastifyInstance } from "fastify";
+declare module "fastify" {
+    interface FastifyInstance {
+        requireHumanPrincipal: () => (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
+    }
+}
+/**
+ * Reject machine credentials on routes that only make sense for a person.
+ *
+ * A service account authenticates by presenting an API key, and the auth plugin
+ * then synthesizes a `request.user` so existing routes keep working. The
+ * synthesized principal has an id of `sa:<uuid>`, which matches no row in
+ * `users` and no row in `org_memberships`.
+ *
+ * That makes most routes fail by accident rather than by decision: a write keyed
+ * on `request.user.id` updates zero rows, and an org-permission check finds no
+ * membership and returns 403. Correct, but incidental — and it relies on every
+ * future route happening to key off the user id. A route that acted on
+ * `request.state.org`, or on the service account's own `orgId`, would not be
+ * stopped by any of that.
+ *
+ * So the boundary is stated rather than implied. On the routes this guard is
+ * applied to, a machine credential is refused with a 403 that says why, instead
+ * of being allowed through to fail somewhere less obvious.
+ */
+declare const _default: (app: FastifyInstance) => Promise<void>;
+export default _default;
+//# sourceMappingURL=machinePrincipal.d.ts.map

package/dist/plugins/machinePrincipal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"machinePrincipal.d.ts","sourceRoot":"","sources":["../../src/plugins/machinePrincipal.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAE7E,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,eAAe;QACvB,qBAAqB,EAAE,MAAM,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;KAC9F;CACF;AAED;;;;;;;;;;;;;;;;;;GAkBG;8BAC4D,eAAe"}

package/dist/plugins/machinePrincipal.js

@@ -0,0 +1,45 @@
+import fp from "fastify-plugin";
+/**
+ * Reject machine credentials on routes that only make sense for a person.
+ *
+ * A service account authenticates by presenting an API key, and the auth plugin
+ * then synthesizes a `request.user` so existing routes keep working. The
+ * synthesized principal has an id of `sa:<uuid>`, which matches no row in
+ * `users` and no row in `org_memberships`.
+ *
+ * That makes most routes fail by accident rather than by decision: a write keyed
+ * on `request.user.id` updates zero rows, and an org-permission check finds no
+ * membership and returns 403. Correct, but incidental — and it relies on every
+ * future route happening to key off the user id. A route that acted on
+ * `request.state.org`, or on the service account's own `orgId`, would not be
+ * stopped by any of that.
+ *
+ * So the boundary is stated rather than implied. On the routes this guard is
+ * applied to, a machine credential is refused with a 403 that says why, instead
+ * of being allowed through to fail somewhere less obvious.
+ */
+export default fp(async function machinePrincipalBoundary(app) {
+    /**
+     * Refuse the request if a service account authenticated it.
+     *
+     * Place after `authenticate`, since that is what populates
+     * `request.serviceAccount`.
+     */
+    app.decorate("requireHumanPrincipal", function requireHumanPrincipal() {
+        return async function humanPrincipalCheck(request, reply) {
+            if (!request.serviceAccount)
+                return;
+            await request.audit("unauthorized_access", {
+                action: "machine_principal_on_interactive_route",
+                serviceAccountId: request.serviceAccount.id,
+                method: request.method,
+                url: request.url,
+            });
+            return reply.status(403).send({
+                error: "This endpoint is for user sessions only",
+                code: "MACHINE_PRINCIPAL_REFUSED",
+            });
+        };
+    });
+});
+//# sourceMappingURL=machinePrincipal.js.map

package/dist/plugins/machinePrincipal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"machinePrincipal.js","sourceRoot":"","sources":["../../src/plugins/machinePrincipal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAShC;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAe,EAAE,CAAC,KAAK,UAAU,wBAAwB,CAAC,GAAoB;IAC5E;;;;;OAKG;IACH,GAAG,CAAC,QAAQ,CAAC,uBAAuB,EAAE,SAAS,qBAAqB;QAClE,OAAO,KAAK,UAAU,mBAAmB,CAAC,OAAuB,EAAE,KAAmB;YACpF,IAAI,CAAC,OAAO,CAAC,cAAc;gBAAE,OAAO;YACpC,MAAM,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE;gBACzC,MAAM,EAAE,wCAAwC;gBAChD,gBAAgB,EAAE,OAAO,CAAC,cAAc,CAAC,EAAE;gBAC3C,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,GAAG,EAAE,OAAO,CAAC,GAAG;aACjB,CAAC,CAAC;YACH,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE,yCAAyC;gBAChD,IAAI,EAAE,2BAA2B;aAClC,CAAC,CAAC;QACL,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/routes/apiKeys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apiKeys.d.ts","sourceRoot":"","sources":["../../src/routes/apiKeys.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAS/C,wBAA8B,YAAY,CAAC,GAAG,EAAE,eAAe,iBAqE9D"}
+{"version":3,"file":"apiKeys.d.ts","sourceRoot":"","sources":["../../src/routes/apiKeys.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAU/C,wBAA8B,YAAY,CAAC,GAAG,EAAE,eAAe,iBAuG9D"}

package/dist/routes/apiKeys.js

@@ -1,12 +1,16 @@
 import { z } from "zod";
 import { generateApiKey, hashApiKey } from "../services/tokens.js";
 import { toPublicApiKey, toPublicUser } from "../types.js";
+import { knownScopes, validateScopes } from "../services/scopes.js";
 const CreateKeySchema = z.object({
     name: z.string().min(1).max(100),
     scopes: z.array(z.string()).optional(),
 });
 export default async function apiKeyRoutes(app) {
-    app.post("/api-keys", { preHandler: [app.authenticate] }, async (request) => {
+    // Credential management is scope-checked, not merely authenticated. Minting a
+    // key is the one operation a leaked key must not be able to repeat, and
+    // revoking one is the operation an operator most needs when a key escapes.
+    app.post("/api-keys", { preHandler: [app.authenticate, app.requireScopes("api_keys:read")] }, async (request, reply) => {
         const body = CreateKeySchema.parse(request.body);
         const user = request.user;
         let orgId = user.defaultOrgId ?? null;
@@ -27,6 +31,19 @@ export default async function apiKeyRoutes(app) {
                 request.state.org = await app.container.organizationRepository.findById(orgId);
             }
         }
+        // Scopes were previously stored exactly as supplied, so a caller could
+        // record any string at all — including the literal "service_account",
+        // which the scope guard used to treat as a wildcard. An unrecognised scope
+        // is refused rather than dropped: silently discarding one hides a typo and
+        // leaves the caller believing they hold something they do not.
+        const scopeCheck = validateScopes(body.scopes, { principal: "user" });
+        if (!scopeCheck.ok) {
+            return reply.status(400).send({
+                error: "Unknown API key scope",
+                unknown: scopeCheck.unknown,
+                known: knownScopes(),
+            });
+        }
         const { key, prefix } = generateApiKey();
         const record = await app.container.apiKeyRepository.create({
             userId: user.id,
@@ -35,22 +52,23 @@ export default async function apiKeyRoutes(app) {
             name: body.name,
             prefix,
             keyHash: hashApiKey(key),
-            scopes: body.scopes?.length ? body.scopes : ["api:read"],
+            scopes: scopeCheck.scopes,
         });
         await request.audit("api_key_created", {
             keyId: record.id,
             name: record.name,
             orgId,
             appId,
+            scopes: scopeCheck.scopes,
         });
         return { key, apiKey: toPublicApiKey(record) };
     });
-    app.get("/api-keys", { preHandler: [app.authenticate] }, async (request) => {
+    app.get("/api-keys", { preHandler: [app.authenticate, app.requireScopes("api_keys:read")] }, async (request) => {
         const user = request.user;
         const rows = await app.container.apiKeyRepository.listByUserId(user.id);
         return { keys: rows };
     });
-    app.delete("/api-keys/:id", { preHandler: [app.authenticate] }, async (request, reply) => {
+    app.delete("/api-keys/:id", { preHandler: [app.authenticate, app.requireScopes("api_keys:revoke")] }, async (request, reply) => {
         const { id } = request.params;
         const user = request.user;
         const record = await app.container.apiKeyRepository.revokeByKeyIdAndUserId(id, user.id);
@@ -60,7 +78,7 @@ export default async function apiKeyRoutes(app) {
         await request.audit("api_key_revoked", { keyId: record.id, name: record.name });
         return { success: true };
     });
-    app.get("/validate", { preHandler: [app.authenticateOrApiKey] }, async (request) => {
+    app.get("/validate", { preHandler: [app.authenticateOrApiKey, app.requireScopes("profile:read")] }, async (request) => {
         const user = request.user;
         return { valid: true, user: toPublicUser(user) };
     });

package/dist/routes/apiKeys.js.map

@@ -1 +1 @@
-{"version":3,"file":"apiKeys.js","sourceRoot":"","sources":["../../src/routes/apiKeys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3D,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAEH,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,YAAY,CAAC,GAAoB;IAC7D,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC1E,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,IAAI,KAAK,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC;QACtC,IAAI,KAAyB,CAAC;QAC9B,IAAI,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;YACvB,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,cAAc,CAC1E,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EACvB,IAAI,CAAC,EAAE,CACR,CAAC;YACF,IAAI,UAAU,EAAE,CAAC;gBACf,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC;gBAChC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7B,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC;gBACtC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACnG,CAAC;QACH,CAAC;aAAM,IAAI,KAAK,EAAE,CAAC;YACjB,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YAC7F,IAAI,UAAU,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC;gBACtC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;QAED,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,MAAM,CAAC;YACzD,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,KAAK,EAAE,KAAK,IAAI,IAAI;YACpB,KAAK,EAAE,KAAK,IAAI,IAAI;YACpB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM;YACN,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC;YACxB,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;SACzD,CAAC,CAAC;QAEH,MAAM,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE;YACrC,KAAK,EAAE,MAAM,CAAC,EAAE;YAChB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,KAAK;YACL,KAAK;SACN,CAAC,CAAC;QAEH,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACzE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,eAAe,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvF,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAE3B,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACxF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAChF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACjF,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"apiKeys.js","sourceRoot":"","sources":["../../src/routes/apiKeys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEpE,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAEH,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,YAAY,CAAC,GAAoB;IAC7D,8EAA8E;IAC9E,wEAAwE;IACxE,2EAA2E;IAC3E,GAAG,CAAC,IAAI,CACN,WAAW,EACX,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC,EAAE,EACtE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,IAAI,KAAK,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC;QACtC,IAAI,KAAyB,CAAC;QAC9B,IAAI,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;YACvB,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,cAAc,CAC1E,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EACvB,IAAI,CAAC,EAAE,CACR,CAAC;YACF,IAAI,UAAU,EAAE,CAAC;gBACf,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC;gBAChC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7B,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC;gBACtC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACnG,CAAC;QACH,CAAC;aAAM,IAAI,KAAK,EAAE,CAAC;YACjB,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YAC7F,IAAI,UAAU,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC;gBACtC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;QAED,uEAAuE;QACvE,sEAAsE;QACtE,2EAA2E;QAC3E,2EAA2E;QAC3E,+DAA+D;QAC/D,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;YACnB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE,uBAAuB;gBAC9B,OAAO,EAAE,UAAU,CAAC,OAAO;gBAC3B,KAAK,EAAE,WAAW,EAAE;aACrB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,MAAM,CAAC;YACzD,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,KAAK,EAAE,KAAK,IAAI,IAAI;YACpB,KAAK,EAAE,KAAK,IAAI,IAAI;YACpB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM;YACN,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC;YACxB,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QAEH,MAAM,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE;YACrC,KAAK,EAAE,MAAM,CAAC,EAAE;YAChB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,KAAK;YACL,KAAK;YACL,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QAEH,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;IACjD,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,GAAG,CACL,WAAW,EACX,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC,EAAE,EACtE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,MAAM,CACR,eAAe,EACf,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC,EAAE,EACxE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAE3B,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACxF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAChF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,GAAG,CACL,WAAW,EACX,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,oBAAoB,EAAE,GAAG,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC,EAAE,EAC7E,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;IACnD,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/routes/federation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"federation.d.ts","sourceRoot":"","sources":["../../src/routes/federation.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAuE7E,wBAA8B,gBAAgB,CAAC,GAAG,EAAE,eAAe,iBAqGlE"}
+{"version":3,"file":"federation.d.ts","sourceRoot":"","sources":["../../src/routes/federation.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAuE7E,wBAA8B,gBAAgB,CAAC,GAAG,EAAE,eAAe,iBA2GlE"}

package/dist/routes/federation.js

@@ -131,7 +131,10 @@ export default async function federationRoutes(app) {
             providers: listConfiguredProviders(),
         };
     });
-    app.post("/link", { preHandler: [app.authenticate] }, async (request, reply) => {
+    app.post("/link", { preHandler: [app.authenticate,
+            // linking an external identity is a human account action. Placed after app.authenticate, which is what
+            // populates request.serviceAccount.
+            app.requireHumanPrincipal()] }, async (request, reply) => {
         const body = LinkIdentitySchema.parse(request.body);
         const result = await sdk.identity.linkUserIdentity(request.user.id, request.user.id, body.providerId, body.providerType, body.externalSub, body.email);
         if (!result.success)
@@ -139,7 +142,10 @@ export default async function federationRoutes(app) {
         await request.audit("federation_identity_linked", { userId: request.user.id, providerType: body.providerType, providerId: body.providerId });
         return reply.status(201).send({ success: true });
     });
-    app.get("/identities", { preHandler: [app.authenticate] }, async (request) => {
+    app.get("/identities", { preHandler: [app.authenticate,
+            // identity linkage is a human account action. Placed after app.authenticate, which is what
+            // populates request.serviceAccount.
+            app.requireHumanPrincipal()] }, async (request) => {
         const rows = await app.container.identityRepository.listByUserId(request.user.id);
         return { identities: rows };
     });

package/dist/routes/federation.js.map

@@ -1 +1 @@
-{"version":3,"file":"federation.js","sourceRoot":"","sources":["../../src/routes/federation.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AACrG,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AAExE,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AACpF,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,sBAAsB,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,WAAW;IAClB,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,MAAM,CAAC,mBAAmB,IAAI,oBAAoB,MAAM,CAAC,IAAI,EAAE,CAAC;AACzE,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,OAAO,GAAG,SAAS,EAAE,eAAe,QAAQ,WAAW,CAAC;AAC1D,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAmB,EAAE,KAAa,EAAE,QAAiB;IAC/E,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,EAAE;QAClC,IAAI,EAAE,GAAG;QACT,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,MAAM,CAAC,aAAa;QAC5B,QAAQ,EAAE,KAAc;QACxB,MAAM,EAAE,MAAM,CAAC,aAAa,IAAI,SAAS;QACzC,MAAM,EAAE,GAAG;KACZ,CAAC,CAAC;IACH,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,CAAC,SAAS,CAAC,eAAe,EAAE,QAAQ,EAAE;YACzC,IAAI,EAAE,GAAG;YACT,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,MAAM,CAAC,aAAa;YAC5B,QAAQ,EAAE,KAAc;YACxB,MAAM,EAAE,MAAM,CAAC,aAAa,IAAI,SAAS;YACzC,MAAM,EAAE,GAAG;SACZ,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAmB;IACjD,MAAM,IAAI,GAAG;QACX,IAAI,EAAE,GAAG;QACT,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,MAAM,CAAC,aAAa;QAC5B,QAAQ,EAAE,KAAc;QACxB,MAAM,EAAE,MAAM,CAAC,aAAa,IAAI,SAAS;KAC1C,CAAC;IACF,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IACrC,KAAK,CAAC,WAAW,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAiB,EAAE,GAAiB;IAC7D,IAAI,GAAG,EAAE,YAAY,EAAE,MAAM;QAAE,OAAO,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC1D,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,uBAAuB,CAAC;AAC/D,CAAC;AAED,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAEH,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAoB;IACjE,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IAErB,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACnD,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,MAA8B,CAAC;QAC5D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAsD,CAAC;QAC7E,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACrE,IAAI,CAAC,WAAW;gBAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;QAC5B,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAElD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,yBAAyB,CAAC,QAAQ,EAAE,KAAK,EAAE,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC5G,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,yBAAyB,CAAC,CAAC;YACtD,sBAAsB,CAAC,KAAK,CAAC,CAAC;YAC9B,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;YAC1D,OAAO,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACtD,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,MAA8B,CAAC;QAC5D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,KAA0C,CAAC;QAC3E,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC;QAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAE/C,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;YAC7C,sBAAsB,CAAC,KAAK,CAAC,CAAC;YAC9B,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,iBAAiB,CAAC,QAAQ,CAAC,UAAU,kBAAkB,CAAC,0BAA0B,CAAC,EAAE,CAAC,CAAC;QAClH,CAAC;QACD,sBAAsB,CAAC,KAAK,CAAC,CAAC;QAE9B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,yBAAyB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7E,IAAI,QAAQ,IAAI,CAAC,GAAG,EAAE,CAAC;gBACrB,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,iBAAiB,CAAC,QAAQ,CAAC,UAAU,kBAAkB,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC;YAC7G,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,uBAAuB,CACvD,QAAQ,EACR,IAAI,EACJ,mBAAmB,CAAC,QAAQ,CAAC,EAC7B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,CAC3E,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC3D,OAAO,CAAC,KAAK,CAAC,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,IAAI,GAAG,EAAE,CAAC;gBACR,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC;gBACxB,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,sBAAsB,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAChG,CAAC;YACD,MAAM,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5G,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;YACzG,OAAO,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,4BAA4B,CAAC,CAAC;YACzD,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAC3B,MAAM,GAAG,GAAG,uBAAuB,CAAC,GAAG,EAAE,iBAAiB,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACjF,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,IAAI,EAAE;QAC/B,OAAO;YACL,SAAS,EAAE,uBAAuB,EAAE;SACrC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CACN,OAAO,EACP,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAClC,KAAK,EAAE,OAAuB,EAAE,KAAK,EAAE,EAAE;QACvC,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAChD,OAAO,CAAC,IAAK,CAAC,EAAE,EAChB,OAAO,CAAC,IAAK,CAAC,EAAE,EAChB,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,KAAK,CACX,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC3D,MAAM,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,IAAK,CAAC,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QAC9I,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,OAAuB,EAAE,EAAE;QAC3F,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,YAAY,CAAC,OAAO,CAAC,IAAK,CAAC,EAAE,CAAC,CAAC;QACnF,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"federation.js","sourceRoot":"","sources":["../../src/routes/federation.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AACrG,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AAExE,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AACpF,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,sBAAsB,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,WAAW;IAClB,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,MAAM,CAAC,mBAAmB,IAAI,oBAAoB,MAAM,CAAC,IAAI,EAAE,CAAC;AACzE,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,OAAO,GAAG,SAAS,EAAE,eAAe,QAAQ,WAAW,CAAC;AAC1D,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAmB,EAAE,KAAa,EAAE,QAAiB;IAC/E,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,EAAE;QAClC,IAAI,EAAE,GAAG;QACT,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,MAAM,CAAC,aAAa;QAC5B,QAAQ,EAAE,KAAc;QACxB,MAAM,EAAE,MAAM,CAAC,aAAa,IAAI,SAAS;QACzC,MAAM,EAAE,GAAG;KACZ,CAAC,CAAC;IACH,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,CAAC,SAAS,CAAC,eAAe,EAAE,QAAQ,EAAE;YACzC,IAAI,EAAE,GAAG;YACT,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,MAAM,CAAC,aAAa;YAC5B,QAAQ,EAAE,KAAc;YACxB,MAAM,EAAE,MAAM,CAAC,aAAa,IAAI,SAAS;YACzC,MAAM,EAAE,GAAG;SACZ,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAmB;IACjD,MAAM,IAAI,GAAG;QACX,IAAI,EAAE,GAAG;QACT,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,MAAM,CAAC,aAAa;QAC5B,QAAQ,EAAE,KAAc;QACxB,MAAM,EAAE,MAAM,CAAC,aAAa,IAAI,SAAS;KAC1C,CAAC;IACF,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IACrC,KAAK,CAAC,WAAW,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAiB,EAAE,GAAiB;IAC7D,IAAI,GAAG,EAAE,YAAY,EAAE,MAAM;QAAE,OAAO,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC1D,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,uBAAuB,CAAC;AAC/D,CAAC;AAED,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAEH,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAoB;IACjE,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IAErB,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACnD,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,MAA8B,CAAC;QAC5D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAsD,CAAC;QAC7E,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACrE,IAAI,CAAC,WAAW;gBAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;QAC5B,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAElD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,yBAAyB,CAAC,QAAQ,EAAE,KAAK,EAAE,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC5G,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,yBAAyB,CAAC,CAAC;YACtD,sBAAsB,CAAC,KAAK,CAAC,CAAC;YAC9B,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;YAC1D,OAAO,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACtD,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,MAA8B,CAAC;QAC5D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,KAA0C,CAAC;QAC3E,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC;QAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAE/C,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;YAC7C,sBAAsB,CAAC,KAAK,CAAC,CAAC;YAC9B,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,iBAAiB,CAAC,QAAQ,CAAC,UAAU,kBAAkB,CAAC,0BAA0B,CAAC,EAAE,CAAC,CAAC;QAClH,CAAC;QACD,sBAAsB,CAAC,KAAK,CAAC,CAAC;QAE9B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,yBAAyB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7E,IAAI,QAAQ,IAAI,CAAC,GAAG,EAAE,CAAC;gBACrB,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,iBAAiB,CAAC,QAAQ,CAAC,UAAU,kBAAkB,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC;YAC7G,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,uBAAuB,CACvD,QAAQ,EACR,IAAI,EACJ,mBAAmB,CAAC,QAAQ,CAAC,EAC7B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,CAC3E,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC3D,OAAO,CAAC,KAAK,CAAC,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,IAAI,GAAG,EAAE,CAAC;gBACR,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC;gBACxB,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,sBAAsB,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAChG,CAAC;YACD,MAAM,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5G,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;YACzG,OAAO,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,4BAA4B,CAAC,CAAC;YACzD,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAC3B,MAAM,GAAG,GAAG,uBAAuB,CAAC,GAAG,EAAE,iBAAiB,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACjF,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,IAAI,EAAE;QAC/B,OAAO;YACL,SAAS,EAAE,uBAAuB,EAAE;SACrC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CACN,OAAO,EACP,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY;YAC7B,uGAAuG;YACvG,oCAAoC;YACpC,GAAG,CAAC,qBAAqB,EAAE,CAAC,EAAE,EAChC,KAAK,EAAE,OAAuB,EAAE,KAAK,EAAE,EAAE;QACvC,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAChD,OAAO,CAAC,IAAK,CAAC,EAAE,EAChB,OAAO,CAAC,IAAK,CAAC,EAAE,EAChB,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,KAAK,CACX,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC3D,MAAM,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,IAAK,CAAC,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QAC9I,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY;YAClD,2FAA2F;YAC3F,oCAAoC;YACpC,GAAG,CAAC,qBAAqB,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,OAAuB,EAAE,EAAE;QACpE,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,YAAY,CAAC,OAAO,CAAC,IAAK,CAAC,EAAE,CAAC,CAAC;QACnF,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/routes/oauth2.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth2.d.ts","sourceRoot":"","sources":["../../src/routes/oauth2.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAoF7E,wBAA8B,YAAY,CAAC,GAAG,EAAE,eAAe,iBAmY9D"}
+{"version":3,"file":"oauth2.d.ts","sourceRoot":"","sources":["../../src/routes/oauth2.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAoF7E,wBAA8B,YAAY,CAAC,GAAG,EAAE,eAAe,iBAyY9D"}

package/dist/routes/oauth2.js

@@ -334,7 +334,10 @@ export default async function oauth2Routes(app) {
         }
         return reply.status(400).send({ error: "unsupported_grant_type" });
     });
-    app.get("/userinfo", { preHandler: [app.authenticate] }, async (request) => {
+    app.get("/userinfo", { preHandler: [app.authenticate,
+            // the userinfo claims describe a person. Placed after app.authenticate, which is what
+            // populates request.serviceAccount.
+            app.requireHumanPrincipal()] }, async (request) => {
         const user = request.user;
         return {
             sub: user.id,
@@ -351,7 +354,10 @@ export default async function oauth2Routes(app) {
         await request.audit("oauth2_revoke", {});
         return { success: true };
     });
-    app.post("/consent", { preHandler: [app.authenticate] }, async (request, reply) => {
+    app.post("/consent", { preHandler: [app.authenticate,
+            // consent is a human authorization decision. Placed after app.authenticate, which is what
+            // populates request.serviceAccount.
+            app.requireHumanPrincipal()] }, async (request, reply) => {
         const body = ConsentBodySchema.parse(request.body);
         const application = await findApplicationByClientId(body.client_id);
         if (!application) {