@ipul-labs/forge 1.22.0 → 1.35.1

package/lib/server/forge/auth/createAuth.js

@@ -0,0 +1,387 @@
+import { randomInt, timingSafeEqual } from "node:crypto";
+import express from "express";
+import { API_TOKEN_PREFIX, createApiTokens } from "./apiTokens.js";
+import { createAuditLog } from "./auditLog.js";
+import { createOidcClient, randomToken } from "./oidc.js";
+import { requireRole } from "./middleware.js";
+import { isRole } from "./roles.js";
+import { createSessions } from "./sessions.js";
+import { createUsers } from "./users.js";
+const SAFE_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
+export const CSRF_HEADER = "x-forge-request";
+const OIDC_STATE_TTL_MS = 10 * 60_000;
+function safeEqual(a, b) {
+    const x = Buffer.from(a);
+    const y = Buffer.from(b);
+    return x.length === y.length && timingSafeEqual(x, y);
+}
+const LOOPBACK = new Set(["127.0.0.1", "::1", "::ffff:127.0.0.1"]);
+const LOCAL_HOSTNAMES = new Set(["localhost", "127.0.0.1", "[::1]"]);
+const FORWARDING_HEADERS = ["x-forwarded-for", "forwarded", "x-real-ip", "x-forwarded-host"];
+/**
+ * True only for a browser on the server machine talking to Forge directly:
+ * loopback socket, no proxy headers (a reverse proxy on the same host would
+ * otherwise make every visitor look local), and a localhost Host header (so a
+ * DNS-rebinding page can't pose as local).
+ */
+export function isLocalRequest(req) {
+    if (!LOOPBACK.has(req.socket.remoteAddress ?? ""))
+        return false;
+    if (FORWARDING_HEADERS.some((h) => req.headers[h] !== undefined))
+        return false;
+    const host = (req.headers.host ?? "").replace(/:\d+$/, "").toLowerCase();
+    return LOCAL_HOSTNAMES.has(host);
+}
+const CODE_ALPHABET = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
+function generateSetupCode() {
+    const chunk = () => Array.from({ length: 4 }, () => CODE_ALPHABET[randomInt(CODE_ALPHABET.length)]).join("");
+    return `${chunk()}-${chunk()}-${chunk()}`;
+}
+function parseCookies(header) {
+    const out = {};
+    for (const part of header?.split(";") ?? []) {
+        const i = part.indexOf("=");
+        if (i > 0)
+            out[part.slice(0, i).trim()] = decodeURIComponent(part.slice(i + 1).trim());
+    }
+    return out;
+}
+/** Only same-origin relative paths; anything else (incl. `//host`) → "/". */
+export function safeReturnTo(value) {
+    return typeof value === "string" && value.startsWith("/") && !value.startsWith("//") && !value.startsWith("/\\")
+        ? value
+        : "/";
+}
+const userPrincipal = (u, kind) => ({
+    id: u.id,
+    email: u.email,
+    name: u.name,
+    role: u.role,
+    kind,
+});
+const errorPage = (message) => `<!doctype html><meta charset="utf-8"><title>Sign-in failed</title><body style="font-family:system-ui;max-width:28rem;margin:15vh auto;padding:0 1rem"><h1 style="font-size:1.1rem">Sign-in failed</h1><p>${message.replace(/[<>&]/g, "")}</p><p><a href="/">Back to Forge</a></p></body>`;
+export function createAuth(opts) {
+    const { db, clock = Date.now } = opts;
+    const users = createUsers({ db, clock });
+    const sessions = createSessions({ db, clock, idleMs: opts.sessionIdleMs, absoluteMs: opts.sessionAbsoluteMs });
+    const tokens = createApiTokens({ db, clock });
+    const audit = createAuditLog({ db, clock });
+    const oidc = opts.oidc ? createOidcClient(opts.oidc) : null;
+    let oidcRedirectUri = opts.oidc?.redirectUri ?? "";
+    // __Host- pins the cookie to this exact origin; it requires Secure.
+    const cookieName = opts.cookieSecure ? "__Host-forge_session" : "forge_session";
+    const setSessionCookie = (res, token) => {
+        const attrs = [`${cookieName}=${token}`, "Path=/", "HttpOnly", "SameSite=Lax", `Max-Age=${Math.floor(sessions.absoluteMs / 1000)}`];
+        if (opts.cookieSecure)
+            attrs.push("Secure");
+        res.append("Set-Cookie", attrs.join("; "));
+    };
+    const clearSessionCookie = (res) => res.append("Set-Cookie", `${cookieName}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0${opts.cookieSecure ? "; Secure" : ""}`);
+    const clientMeta = (req) => ({ ip: req.ip ?? "", userAgent: String(req.headers["user-agent"] ?? "") });
+    const record = (req, e) => audit.record({
+        actorId: e.actor?.id ?? null,
+        actorLabel: e.actor?.email ?? e.actorLabel ?? "anonymous",
+        action: e.action,
+        outcome: e.outcome,
+        target: e.target ?? null,
+        details: e.details ?? null,
+        ...clientMeta(req),
+    });
+    async function startSession(req, res, user) {
+        const { token } = await sessions.create({ userId: user.id, ...clientMeta(req) });
+        setSessionCookie(res, token);
+    }
+    // ── Middleware ───────────────────────────────────────────────────────────
+    async function resolvePrincipal(req) {
+        const header = req.headers.authorization;
+        if (header?.startsWith("Bearer ")) {
+            req.authVia = "bearer";
+            const value = header.slice(7).trim();
+            if (value.startsWith(API_TOKEN_PREFIX)) {
+                const hit = await tokens.resolve(value);
+                const user = hit && (await users.findById(hit.userId));
+                return user && !user.disabled ? userPrincipal(user, "token") : "invalid";
+            }
+            if (opts.serviceToken && safeEqual(value, opts.serviceToken)) {
+                return { id: "service", email: "service-token", name: "Service token", role: "admin", kind: "service" };
+            }
+            return "invalid";
+        }
+        const sessionToken = parseCookies(req.headers.cookie)[cookieName];
+        if (!sessionToken)
+            return null;
+        req.authVia = "cookie";
+        const session = await sessions.resolve(sessionToken);
+        const user = session && (await users.findById(session.userId));
+        if (!user || user.disabled)
+            return null;
+        return userPrincipal(user, "user");
+    }
+    const authenticate = async (req, res, next) => {
+        try {
+            const principal = await resolvePrincipal(req);
+            if (principal === "invalid") {
+                res.status(401).json({ error: "Invalid or revoked token." });
+                return;
+            }
+            req.principal = principal ?? undefined;
+            next();
+        }
+        catch (err) {
+            next(err);
+        }
+    };
+    const requireUser = (req, res, next) => {
+        if (!req.principal) {
+            res.status(401).json({ error: "Sign in required." });
+            return;
+        }
+        next();
+    };
+    /** Cookie-authenticated writes must carry a header a cross-site form can't set. */
+    const csrf = (req, res, next) => {
+        if (req.authVia === "cookie" && !SAFE_METHODS.has(req.method) && req.headers[CSRF_HEADER] !== "1") {
+            res.status(403).json({ error: "Missing request header." });
+            return;
+        }
+        next();
+    };
+    /** Logs every state-changing API call once the response is sent. */
+    const auditTrail = (req, res, next) => {
+        if (SAFE_METHODS.has(req.method))
+            return next();
+        res.on("finish", () => {
+            if (res.locals.audited)
+                return;
+            const params = req.params ?? {};
+            const target = params.mrIid ? `!${params.mrIid}` : params.iid ? `#${params.iid}` : params.jobId ? `job ${params.jobId}` : null;
+            const repo = (req.body && typeof req.body.repo === "string" ? req.body.repo : null) ?? (typeof req.query.repo === "string" ? req.query.repo : null);
+            const outcome = res.statusCode < 400 ? "success" : res.statusCode === 401 || res.statusCode === 403 ? "denied" : "failure";
+            void audit
+                .record({
+                actorId: req.principal?.id ?? null,
+                actorLabel: req.principal?.email ?? "anonymous",
+                action: `${req.method} ${req.route?.path ?? req.path}`,
+                target,
+                repo,
+                outcome,
+                details: { status: res.statusCode },
+                ...clientMeta(req),
+            })
+                .catch((err) => console.error("[forge] audit write failed:", err));
+        });
+        next();
+    };
+    // ── /auth ────────────────────────────────────────────────────────────────
+    // Remote first-run setup needs proof of operating the server: FORGE_TOKEN
+    // when set, otherwise a one-time code printed to the server log.
+    const setupCode = opts.serviceToken ?? generateSetupCode();
+    let announced = false;
+    const router = express.Router();
+    router.use(express.json({ limit: "64kb" }));
+    router.get("/me", authenticate, async (req, res) => {
+        res.json({
+            user: req.principal ?? null,
+            needsSetup: (await users.count()) === 0,
+            setupRequiresToken: !isLocalRequest(req),
+            sso: oidc ? { name: opts.oidc?.name ?? "SSO" } : null,
+        });
+    });
+    router.post("/setup", async (req, res) => {
+        const { email, name, password, setupToken } = req.body ?? {};
+        if ((await users.count()) > 0)
+            return res.status(409).json({ error: "Forge is already set up." });
+        if (!isLocalRequest(req) && (typeof setupToken !== "string" || !safeEqual(setupToken.trim().toUpperCase(), setupCode.toUpperCase()))) {
+            return res.status(403).json({ error: "The setup code is incorrect." });
+        }
+        try {
+            const user = await users.create({ email, name: name ?? "", role: "admin", password });
+            await startSession(req, res, user);
+            await record(req, { action: "auth.setup", outcome: "success", actor: userPrincipal(user, "user") });
+            res.status(201).json({ user: userPrincipal(user, "user") });
+        }
+        catch (err) {
+            res.status(400).json({ error: err.message });
+        }
+    });
+    router.post("/login", async (req, res) => {
+        const { email, password } = req.body ?? {};
+        const result = await users.authenticate(String(email ?? ""), String(password ?? ""));
+        if ("reason" in result) {
+            await record(req, { action: "auth.login", outcome: "failure", actorLabel: String(email ?? "").toLowerCase(), details: { reason: result.reason } });
+            const message = result.reason === "locked"
+                ? "Too many failed attempts. Try again in 15 minutes."
+                : result.reason === "disabled"
+                    ? "This account is disabled."
+                    : "Invalid email or password.";
+            return res.status(401).json({ error: message });
+        }
+        const { user } = result;
+        await startSession(req, res, user);
+        await record(req, { action: "auth.login", outcome: "success", actor: userPrincipal(user, "user") });
+        res.json({ user: userPrincipal(user, "user") });
+    });
+    router.post("/logout", authenticate, csrf, async (req, res) => {
+        const token = parseCookies(req.headers.cookie)[cookieName];
+        if (token)
+            await sessions.revoke(token);
+        clearSessionCookie(res);
+        if (req.principal)
+            await record(req, { action: "auth.logout", outcome: "success", actor: req.principal });
+        res.json({ ok: true });
+    });
+    router.get("/tokens", authenticate, requireUser, async (req, res) => {
+        res.json({ tokens: await tokens.list(req.principal.id) });
+    });
+    router.post("/tokens", authenticate, requireUser, csrf, async (req, res) => {
+        if (req.principal.kind === "service")
+            return res.status(400).json({ error: "Service tokens can't mint personal tokens." });
+        const created = await tokens.create({ userId: req.principal.id, name: String(req.body?.name ?? "") });
+        await record(req, { action: "token.create", outcome: "success", actor: req.principal, target: created.record.prefix });
+        res.status(201).json(created);
+    });
+    router.delete("/tokens/:id", authenticate, requireUser, csrf, async (req, res) => {
+        const id = String(req.params.id);
+        const ok = await tokens.revoke({ id, userId: req.principal.id });
+        await record(req, { action: "token.revoke", outcome: ok ? "success" : "failure", actor: req.principal, target: id });
+        res.status(ok ? 200 : 404).json({ ok });
+    });
+    router.get("/oidc/start", async (req, res, next) => {
+        if (!oidc)
+            return res.status(404).json({ error: "Single sign-on is not configured." });
+        try {
+            const state = randomToken();
+            const nonce = randomToken();
+            const codeVerifier = randomToken();
+            await db.run("DELETE FROM oidc_states WHERE created_at < ?", [clock() - OIDC_STATE_TTL_MS]);
+            await db.run("INSERT INTO oidc_states (state, code_verifier, nonce, return_to, created_at) VALUES (?, ?, ?, ?, ?)", [
+                state,
+                codeVerifier,
+                nonce,
+                safeReturnTo(req.query.returnTo),
+                clock(),
+            ]);
+            res.redirect(302, await oidc.authorizationUrl({ state, nonce, codeVerifier, redirectUri: oidcRedirectUri }));
+        }
+        catch (err) {
+            next(err);
+        }
+    });
+    router.get("/oidc/callback", async (req, res) => {
+        if (!oidc || !opts.oidc)
+            return res.status(404).send(errorPage("Single sign-on is not configured."));
+        const state = String(req.query.state ?? "");
+        const row = await db.get("SELECT * FROM oidc_states WHERE state = ?", [state]);
+        await db.run("DELETE FROM oidc_states WHERE state = ?", [state]);
+        if (!row || clock() - row.created_at > OIDC_STATE_TTL_MS) {
+            return res.status(400).send(errorPage("This sign-in link expired. Start again."));
+        }
+        if (req.query.error)
+            return res.status(400).send(errorPage(String(req.query.error_description ?? req.query.error)));
+        const fail = async (status, message, label) => {
+            await record(req, { action: "auth.sso_login", outcome: "failure", actorLabel: label, details: { reason: message } });
+            res.status(status).send(errorPage(message));
+        };
+        try {
+            const claims = await oidc.exchange({ code: String(req.query.code ?? ""), codeVerifier: row.code_verifier, nonce: row.nonce, redirectUri: oidcRedirectUri });
+            const email = claims.email?.toLowerCase();
+            if (!email || claims.email_verified === false)
+                return fail(403, "Your identity provider did not supply a verified email.", email ?? "unknown");
+            const domain = email.split("@")[1];
+            if (opts.oidc.allowedDomains.length && !opts.oidc.allowedDomains.includes(domain)) {
+                return fail(403, "Your email domain is not allowed to sign in to this Forge workspace.", email);
+            }
+            const user = await users.upsertOidc({ subject: `${claims.iss}|${claims.sub}`, email, name: claims.name ?? "", defaultRole: opts.oidc.defaultRole });
+            if (user.disabled)
+                return fail(403, "This account is disabled.", email);
+            await startSession(req, res, user);
+            await record(req, { action: "auth.sso_login", outcome: "success", actor: userPrincipal(user, "user") });
+            res.redirect(302, row.return_to);
+        }
+        catch (err) {
+            await fail(400, err.message, "unknown");
+        }
+    });
+    // ── /admin ───────────────────────────────────────────────────────────────
+    const adminRouter = express.Router();
+    adminRouter.use(requireRole("admin"));
+    adminRouter.use((_req, res, next) => {
+        res.locals.audited = true; // admin routes write explicit, descriptive events
+        next();
+    });
+    adminRouter.get("/users", async (_req, res) => {
+        res.json({ users: await users.list() });
+    });
+    adminRouter.post("/users", async (req, res) => {
+        const { email, name, role, password } = req.body ?? {};
+        if (!isRole(role))
+            return res.status(400).json({ error: "Choose a valid role." });
+        try {
+            const user = await users.create({ email: String(email ?? ""), name: String(name ?? ""), role, password: password || undefined });
+            await record(req, { action: "user.create", outcome: "success", actor: req.principal, target: user.email, details: { role } });
+            res.status(201).json({ user });
+        }
+        catch (err) {
+            res.status(400).json({ error: err.message });
+        }
+    });
+    adminRouter.patch("/users/:id", async (req, res) => {
+        const target = await users.findById(String(req.params.id));
+        if (!target)
+            return res.status(404).json({ error: "User not found." });
+        const { role, disabled, name, password } = req.body ?? {};
+        if (role !== undefined && !isRole(role))
+            return res.status(400).json({ error: "Choose a valid role." });
+        const losesAdmin = target.role === "admin" && !target.disabled && ((role !== undefined && role !== "admin") || disabled === true);
+        if (losesAdmin && (await users.countActiveAdmins()) <= 1) {
+            return res.status(409).json({ error: "Forge needs at least one active admin." });
+        }
+        try {
+            const user = await users.update(target.id, { role, disabled, name, password });
+            if (disabled === true || password !== undefined) {
+                await sessions.revokeAllForUser(target.id);
+                if (disabled === true)
+                    await tokens.revokeAllForUser(target.id);
+            }
+            const changes = Object.fromEntries(Object.entries({ role, disabled, name, password: password !== undefined ? "reset" : undefined }).filter(([, v]) => v !== undefined));
+            await record(req, { action: "user.update", outcome: "success", actor: req.principal, target: target.email, details: changes });
+            res.json({ user });
+        }
+        catch (err) {
+            res.status(400).json({ error: err.message });
+        }
+    });
+    adminRouter.get("/audit", async (req, res) => {
+        const n = (v) => (typeof v === "string" && v ? Number(v) : undefined);
+        res.json(await audit.list({
+            action: typeof req.query.action === "string" && req.query.action ? req.query.action : undefined,
+            actorId: typeof req.query.actorId === "string" && req.query.actorId ? req.query.actorId : undefined,
+            limit: n(req.query.limit),
+            before: n(req.query.before),
+        }));
+    });
+    return {
+        users,
+        sessions,
+        tokens,
+        audit,
+        router,
+        adminRouter,
+        authenticate,
+        requireUser,
+        requireRole,
+        csrf,
+        auditTrail,
+        /** Logs the setup code while no admin exists (only when it was generated). */
+        announceSetup: async () => {
+            if (opts.serviceToken || announced || (await users.count()) > 0)
+                return;
+            announced = true;
+            (opts.onSetupCode ?? ((code) => console.log(`[forge] First-run setup code (needed when not on localhost): ${code}`)))(setupCode);
+        },
+        setOidcRedirectUri: (uri) => {
+            oidcRedirectUri = uri;
+        },
+    };
+}
+//# sourceMappingURL=createAuth.js.map

package/lib/server/forge/auth/createAuth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createAuth.js","sourceRoot":"","sources":["../../../../server/forge/auth/createAuth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEzD,OAAO,OAA2D,MAAM,SAAS,CAAC;AAIlF,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACnE,OAAO,EAAqB,cAAc,EAAE,MAAM,eAAe,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAoB,WAAW,EAAE,MAAM,WAAW,CAAC;AAC5E,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAa,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAa,MAAM,YAAY,CAAC;AAiCpD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AACzD,MAAM,CAAC,MAAM,WAAW,GAAG,iBAAiB,CAAC;AAC7C,MAAM,iBAAiB,GAAG,EAAE,GAAG,MAAM,CAAC;AAEtC,SAAS,SAAS,CAAC,CAAS,EAAE,CAAS;IACtC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,kBAAkB,CAAC,CAAC,CAAC;AACnE,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AACrE,MAAM,kBAAkB,GAAG,CAAC,iBAAiB,EAAE,WAAW,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC;AAE7F;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,GAAY;IAC1C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IAChE,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/E,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACzE,OAAO,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,aAAa,GAAG,kCAAkC,CAAC;AACzD,SAAS,iBAAiB;IACzB,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7G,OAAO,GAAG,KAAK,EAAE,IAAI,KAAK,EAAE,IAAI,KAAK,EAAE,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,YAAY,CAAC,MAA0B;IAC/C,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;QAC7C,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,YAAY,CAAC,KAAc;IAC1C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;QAC/G,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,GAAG,CAAC;AACR,CAAC;AAED,MAAM,aAAa,GAAG,CAAC,CAAO,EAAE,IAAuB,EAAa,EAAE,CAAC,CAAC;IACvE,EAAE,EAAE,CAAC,CAAC,EAAE;IACR,KAAK,EAAE,CAAC,CAAC,KAAK;IACd,IAAI,EAAE,CAAC,CAAC,IAAI;IACZ,IAAI,EAAE,CAAC,CAAC,IAAI;IACZ,IAAI;CACJ,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,CAAC,OAAe,EAAE,EAAE,CACrC,4MAA4M,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,iDAAiD,CAAC;AAE5R,MAAM,UAAU,UAAU,CAAC,IAAiB;IAC3C,MAAM,EAAE,EAAE,EAAE,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IACtC,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,cAAc,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAC/G,MAAM,MAAM,GAAG,eAAe,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,cAAc,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,IAAI,eAAe,GAAG,IAAI,CAAC,IAAI,EAAE,WAAW,IAAI,EAAE,CAAC;IAEnD,oEAAoE;IACpE,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,eAAe,CAAC;IAChF,MAAM,gBAAgB,GAAG,CAAC,GAAa,EAAE,KAAa,EAAE,EAAE;QACzD,MAAM,KAAK,GAAG,CAAC,GAAG,UAAU,IAAI,KAAK,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,WAAW,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;QACpI,IAAI,IAAI,CAAC,YAAY;YAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5C,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC;IACF,MAAM,kBAAkB,GAAG,CAAC,GAAa,EAAE,EAAE,CAC5C,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,UAAU,+CAA+C,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAE7H,MAAM,UAAU,GAAG,CAAC,GAAY,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;IAEhH,MAAM,MAAM,GAAG,CAAC,GAAY,EAAE,CAAsJ,EAAE,EAAE,CACvL,KAAK,CAAC,MAAM,CAAC;QACZ,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,EAAE,IAAI,IAAI;QAC5B,UAAU,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,IAAI,CAAC,CAAC,UAAU,IAAI,WAAW;QACzD,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI;QACxB,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,IAAI;QAC1B,GAAG,UAAU,CAAC,GAAG,CAAC;KAClB,CAAC,CAAC;IAEJ,KAAK,UAAU,YAAY,CAAC,GAAY,EAAE,GAAa,EAAE,IAAU;QAClE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjF,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IAED,4EAA4E;IAE5E,KAAK,UAAU,gBAAgB,CAAC,GAAY;QAC3C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACzC,IAAI,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACnC,GAAG,CAAC,OAAO,GAAG,QAAQ,CAAC;YACvB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACrC,IAAI,KAAK,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACxC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBACxC,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;gBACvD,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC1E,CAAC;YACD,IAAI,IAAI,CAAC,YAAY,IAAI,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC9D,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YACzG,CAAC;YACD,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,MAAM,YAAY,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;QAClE,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC;QAC/B,GAAG,CAAC,OAAO,GAAG,QAAQ,CAAC;QACvB,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACrD,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QACxC,OAAO,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,YAAY,GAAG,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAC9E,IAAI,CAAC;YACJ,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;YAC9C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC7B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;gBAC7D,OAAO;YACR,CAAC;YACD,GAAG,CAAC,SAAS,GAAG,SAAS,IAAI,SAAS,CAAC;YACvC,IAAI,EAAE,CAAC;QACR,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,CAAC,GAAG,CAAC,CAAC;QACX,CAAC;IACF,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACvE,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;YACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACrD,OAAO;QACR,CAAC;QACD,IAAI,EAAE,CAAC;IACR,CAAC,CAAC;IAEF,mFAAmF;IACnF,MAAM,IAAI,GAAG,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAChE,IAAI,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,GAAG,EAAE,CAAC;YACnG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;YAC3D,OAAO;QACR,CAAC;QACD,IAAI,EAAE,CAAC;IACR,CAAC,CAAC;IAEF,oEAAoE;IACpE,MAAM,UAAU,GAAG,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACtE,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QAChD,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;YACrB,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO;YAC/B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YAC/H,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACpJ,MAAM,OAAO,GAAiB,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,KAAK,GAAG,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;YACzI,KAAK,KAAK;iBACR,MAAM,CAAC;gBACP,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,EAAE,IAAI,IAAI;gBAClC,UAAU,EAAE,GAAG,CAAC,SAAS,EAAE,KAAK,IAAI,WAAW;gBAC/C,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE;gBACtD,MAAM;gBACN,IAAI;gBACJ,OAAO;gBACP,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE;gBACnC,GAAG,UAAU,CAAC,GAAG,CAAC;aAClB,CAAC;iBACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC,CAAC;QACrE,CAAC,CAAC,CAAC;QACH,IAAI,EAAE,CAAC;IACR,CAAC,CAAC;IAEF,4EAA4E;IAE5E,0EAA0E;IAC1E,iEAAiE;IACjE,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,IAAI,iBAAiB,EAAE,CAAC;IAC3D,IAAI,SAAS,GAAG,KAAK,CAAC;IAEtB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAChC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAE5C,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAClD,GAAG,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;YAC3B,UAAU,EAAE,CAAC,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC;YACvC,kBAAkB,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC;YACxC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI;SACrD,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QAC7D,IAAI,CAAC,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;QAClG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC;YACtI,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,CAAC;YACJ,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;YACtF,MAAM,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YACnC,MAAM,MAAM,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;YACpG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAC7D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACzD,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;QACrF,IAAI,QAAQ,IAAI,MAAM,EAAE,CAAC;YACxB,MAAM,MAAM,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACnJ,MAAM,OAAO,GACZ,MAAM,CAAC,MAAM,KAAK,QAAQ;gBACzB,CAAC,CAAC,oDAAoD;gBACtD,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,UAAU;oBAC7B,CAAC,CAAC,2BAA2B;oBAC7B,CAAC,CAAC,4BAA4B,CAAC;YAClC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAwB,CAAC;QAC1C,MAAM,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACnC,MAAM,MAAM,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACpG,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7D,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;QAC3D,IAAI,KAAK;YAAE,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxC,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,GAAG,CAAC,SAAS;YAAE,MAAM,MAAM,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;QAC1G,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACnE,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,SAAU,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC1E,IAAI,GAAG,CAAC,SAAU,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAC,CAAC;QAC5H,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,SAAU,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QACvG,MAAM,MAAM,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACvH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,YAAY,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAChF,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACjC,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,SAAU,CAAC,EAAE,EAAE,CAAC,CAAC;QAClE,MAAM,MAAM,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QACrH,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAClD,IAAI,CAAC,IAAI;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC,CAAC;QACvF,IAAI,CAAC;YACJ,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;YAC5B,MAAM,YAAY,GAAG,WAAW,EAAE,CAAC;YACnC,MAAM,EAAE,CAAC,GAAG,CAAC,8CAA8C,EAAE,CAAC,KAAK,EAAE,GAAG,iBAAiB,CAAC,CAAC,CAAC;YAC5F,MAAM,EAAE,CAAC,GAAG,CAAC,qGAAqG,EAAE;gBACnH,KAAK;gBACL,YAAY;gBACZ,KAAK;gBACL,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC;gBAChC,KAAK,EAAE;aACP,CAAC,CAAC;YACH,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC;QAC9G,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,CAAC,GAAG,CAAC,CAAC;QACX,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/C,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,mCAAmC,CAAC,CAAC,CAAC;QACrG,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QAC5C,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,GAAG,CACvB,2CAA2C,EAC3C,CAAC,KAAK,CAAC,CACP,CAAC;QACF,MAAM,EAAE,CAAC,GAAG,CAAC,yCAAyC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QACjE,IAAI,CAAC,GAAG,IAAI,KAAK,EAAE,GAAG,GAAG,CAAC,UAAU,GAAG,iBAAiB,EAAE,CAAC;YAC1D,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,yCAAyC,CAAC,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,iBAAiB,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACpH,MAAM,IAAI,GAAG,KAAK,EAAE,MAAc,EAAE,OAAe,EAAE,KAAa,EAAE,EAAE;YACrE,MAAM,MAAM,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;YACrH,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7C,CAAC,CAAC;QACF,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC,CAAC;YAC5J,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC;YAC1C,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,cAAc,KAAK,KAAK;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,yDAAyD,EAAE,KAAK,IAAI,SAAS,CAAC,CAAC;YAC/I,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACnC,IAAI,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnF,OAAO,IAAI,CAAC,GAAG,EAAE,sEAAsE,EAAE,KAAK,CAAC,CAAC;YACjG,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YACpJ,IAAI,IAAI,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,2BAA2B,EAAE,KAAK,CAAC,CAAC;YACxE,MAAM,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YACnC,MAAM,MAAM,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;YACxG,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACpD,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAE5E,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IACrC,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;IACtC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACnC,GAAG,CAAC,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,kDAAkD;QAC7E,IAAI,EAAE,CAAC;IACR,CAAC,CAAC,CAAC;IAEH,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAC7C,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,WAAW,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7C,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC;YACJ,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,IAAI,SAAS,EAAE,CAAC,CAAC;YACjI,MAAM,MAAM,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;YAC9H,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACzD,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,WAAW,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAClD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACvE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QAC1D,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;QACxG,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,OAAO,CAAC,IAAI,QAAQ,KAAK,IAAI,CAAC,CAAC;QAClI,IAAI,UAAU,IAAI,CAAC,MAAM,KAAK,CAAC,iBAAiB,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1D,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,CAAC;YACJ,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC/E,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACjD,MAAM,QAAQ,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC3C,IAAI,QAAQ,KAAK,IAAI;oBAAE,MAAM,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACjE,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CACjC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CACnI,CAAC;YACF,MAAM,MAAM,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;YAC/H,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACzD,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC5C,MAAM,CAAC,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC/E,GAAG,CAAC,IAAI,CACP,MAAM,KAAK,CAAC,IAAI,CAAC;YAChB,MAAM,EAAE,OAAO,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;YAC/F,OAAO,EAAE,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;YACnG,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;YACzB,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;SAC3B,CAAC,CACF,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO;QACN,KAAK;QACL,QAAQ;QACR,MAAM;QACN,KAAK;QACL,MAAM;QACN,WAAW;QACX,YAAY;QACZ,WAAW;QACX,WAAW;QACX,IAAI;QACJ,UAAU;QACV,8EAA8E;QAC9E,aAAa,EAAE,KAAK,IAAI,EAAE;YACzB,IAAI,IAAI,CAAC,YAAY,IAAI,SAAS,IAAI,CAAC,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC;gBAAE,OAAO;YACxE,SAAS,GAAG,IAAI,CAAC;YACjB,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,gEAAgE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC1I,CAAC;QACD,kBAAkB,EAAE,CAAC,GAAW,EAAE,EAAE;YACnC,eAAe,GAAG,GAAG,CAAC;QACvB,CAAC;KACD,CAAC;AACH,CAAC"}

package/lib/server/forge/auth/middleware.d.ts

@@ -0,0 +1,10 @@
+import type { NextFunction, Request, Response } from "express";
+import { type Role } from "./roles.ts";
+export type RoleGuard = ((req: Request, res: Response, next: NextFunction) => void) & {
+    requiredRole: Role;
+};
+/** Stateless: only reads `req.principal`, so routers can use it without the auth instance. */
+export declare function requireRole(role: Role): RoleGuard;
+/** Fail closed if a router is mounted without the auth stack in front of it. */
+export declare function requirePrincipal(req: Request, res: Response, next: NextFunction): void;
+//# sourceMappingURL=middleware.d.ts.map

package/lib/server/forge/auth/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../../../server/forge/auth/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAE/D,OAAO,EAAW,KAAK,IAAI,EAAE,MAAM,YAAY,CAAC;AAEhD,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,KAAK,IAAI,CAAC,GAAG;IAAE,YAAY,EAAE,IAAI,CAAA;CAAE,CAAC;AAE7G,8FAA8F;AAC9F,wBAAgB,WAAW,CAAC,IAAI,EAAE,IAAI,GAAG,SAAS,CAUjD;AAED,gFAAgF;AAChF,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,QAM/E"}

package/lib/server/forge/auth/middleware.js

@@ -0,0 +1,22 @@
+import { hasRole } from "./roles.js";
+/** Stateless: only reads `req.principal`, so routers can use it without the auth instance. */
+export function requireRole(role) {
+    const guard = ((req, res, next) => {
+        if (!req.principal || !hasRole(req.principal.role, role)) {
+            res.status(req.principal ? 403 : 401).json({ error: req.principal ? `Requires the ${role} role.` : "Sign in required." });
+            return;
+        }
+        next();
+    });
+    guard.requiredRole = role;
+    return guard;
+}
+/** Fail closed if a router is mounted without the auth stack in front of it. */
+export function requirePrincipal(req, res, next) {
+    if (!req.principal) {
+        res.status(401).json({ error: "Sign in required." });
+        return;
+    }
+    next();
+}
+//# sourceMappingURL=middleware.js.map

package/lib/server/forge/auth/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../../../server/forge/auth/middleware.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAa,MAAM,YAAY,CAAC;AAIhD,8FAA8F;AAC9F,MAAM,UAAU,WAAW,CAAC,IAAU;IACrC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAClE,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,IAAI,QAAQ,CAAC,CAAC,CAAC,mBAAmB,EAAE,CAAC,CAAC;YAC1H,OAAO;QACR,CAAC;QACD,IAAI,EAAE,CAAC;IACR,CAAC,CAAc,CAAC;IAChB,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC;IAC1B,OAAO,KAAK,CAAC;AACd,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,gBAAgB,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IAC/E,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;QACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACrD,OAAO;IACR,CAAC;IACD,IAAI,EAAE,CAAC;AACR,CAAC"}

package/lib/server/forge/auth/oidc.d.ts

@@ -0,0 +1,38 @@
+import { type JWTPayload } from "jose";
+import type { Role } from "./roles.ts";
+export interface OidcOptions {
+    issuer: string;
+    clientId: string;
+    clientSecret: string;
+    redirectUri: string;
+    defaultRole: Role;
+    /** Empty = any domain the IdP vouches for. */
+    allowedDomains: string[];
+    /** Button label, e.g. "Okta". */
+    name?: string;
+    scopes?: string;
+}
+export interface OidcClaims extends JWTPayload {
+    email?: string;
+    email_verified?: boolean;
+    name?: string;
+    nonce?: string;
+}
+export declare const randomToken: () => string;
+export declare const pkceChallenge: (verifier: string) => string;
+/** Authorization-code flow with PKCE; id_token verified against the IdP's JWKS. */
+export declare function createOidcClient(opts: OidcOptions): {
+    authorizationUrl({ state, nonce, codeVerifier, redirectUri }: {
+        state: string;
+        nonce: string;
+        codeVerifier: string;
+        redirectUri: string;
+    }): Promise<string>;
+    exchange({ code, codeVerifier, nonce, redirectUri }: {
+        code: string;
+        codeVerifier: string;
+        nonce: string;
+        redirectUri: string;
+    }): Promise<OidcClaims & JWTPayload>;
+};
+//# sourceMappingURL=oidc.d.ts.map

package/lib/server/forge/auth/oidc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.d.ts","sourceRoot":"","sources":["../../../../server/forge/auth/oidc.ts"],"names":[],"mappings":"AAEA,OAAO,EAAiC,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC;AAEtE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAEvC,MAAM,WAAW,WAAW;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,IAAI,CAAC;IAClB,8CAA8C;IAC9C,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,iCAAiC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AASD,MAAM,WAAW,UAAW,SAAQ,UAAU;IAC7C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAGD,eAAO,MAAM,WAAW,cAAgC,CAAC;AACzD,eAAO,MAAM,aAAa,GAAI,UAAU,MAAM,WAA2D,CAAC;AAE1G,mFAAmF;AACnF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,WAAW;kEAgBoB;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE;yDAgBpF;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE;EAuBtI"}

package/lib/server/forge/auth/oidc.js

@@ -0,0 +1,63 @@
+import { createHash, randomBytes } from "node:crypto";
+import { createRemoteJWKSet, jwtVerify } from "jose";
+const b64url = (buf) => buf.toString("base64url");
+export const randomToken = () => b64url(randomBytes(32));
+export const pkceChallenge = (verifier) => b64url(createHash("sha256").update(verifier).digest());
+/** Authorization-code flow with PKCE; id_token verified against the IdP's JWKS. */
+export function createOidcClient(opts) {
+    let discovery = null;
+    let jwks = null;
+    const discover = () => {
+        discovery ??= fetch(`${opts.issuer.replace(/\/$/, "")}/.well-known/openid-configuration`).then(async (res) => {
+            if (!res.ok) {
+                discovery = null;
+                throw new Error(`OIDC discovery failed (${res.status}).`);
+            }
+            return (await res.json());
+        });
+        return discovery;
+    };
+    return {
+        async authorizationUrl({ state, nonce, codeVerifier, redirectUri }) {
+            const d = await discover();
+            const url = new URL(d.authorization_endpoint);
+            url.search = new URLSearchParams({
+                response_type: "code",
+                client_id: opts.clientId,
+                redirect_uri: redirectUri,
+                scope: opts.scopes ?? "openid email profile",
+                state,
+                nonce,
+                code_challenge: pkceChallenge(codeVerifier),
+                code_challenge_method: "S256",
+            }).toString();
+            return url.toString();
+        },
+        async exchange({ code, codeVerifier, nonce, redirectUri }) {
+            const d = await discover();
+            const res = await fetch(d.token_endpoint, {
+                method: "POST",
+                headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
+                body: new URLSearchParams({
+                    grant_type: "authorization_code",
+                    code,
+                    redirect_uri: redirectUri,
+                    client_id: opts.clientId,
+                    client_secret: opts.clientSecret,
+                    code_verifier: codeVerifier,
+                }),
+            });
+            if (!res.ok)
+                throw new Error(`OIDC token exchange failed (${res.status}).`);
+            const { id_token: idToken } = (await res.json());
+            if (!idToken)
+                throw new Error("OIDC provider returned no id_token.");
+            jwks ??= createRemoteJWKSet(new URL(d.jwks_uri));
+            const { payload } = await jwtVerify(idToken, jwks, { issuer: d.issuer, audience: opts.clientId });
+            if (payload.nonce !== nonce)
+                throw new Error("OIDC nonce mismatch.");
+            return payload;
+        },
+    };
+}
+//# sourceMappingURL=oidc.js.map

package/lib/server/forge/auth/oidc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../../../../server/forge/auth/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAmB,MAAM,MAAM,CAAC;AA+BtE,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC1D,MAAM,CAAC,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;AACzD,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,QAAgB,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AAE1G,mFAAmF;AACnF,MAAM,UAAU,gBAAgB,CAAC,IAAiB;IACjD,IAAI,SAAS,GAA8B,IAAI,CAAC;IAChD,IAAI,IAAI,GAAiD,IAAI,CAAC;IAE9D,MAAM,QAAQ,GAAG,GAAG,EAAE;QACrB,SAAS,KAAK,KAAK,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,mCAAmC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC5G,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACb,SAAS,GAAG,IAAI,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;YAC3D,CAAC;YACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAc,CAAC;QACxC,CAAC,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO;QACN,KAAK,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAA+E;YAC9I,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC;YAC9C,GAAG,CAAC,MAAM,GAAG,IAAI,eAAe,CAAC;gBAChC,aAAa,EAAE,MAAM;gBACrB,SAAS,EAAE,IAAI,CAAC,QAAQ;gBACxB,YAAY,EAAE,WAAW;gBACzB,KAAK,EAAE,IAAI,CAAC,MAAM,IAAI,sBAAsB;gBAC5C,KAAK;gBACL,KAAK;gBACL,cAAc,EAAE,aAAa,CAAC,YAAY,CAAC;gBAC3C,qBAAqB,EAAE,MAAM;aAC7B,CAAC,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;QACvB,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,WAAW,EAA8E;YACpI,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,cAAc,EAAE;gBACzC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBAC5F,IAAI,EAAE,IAAI,eAAe,CAAC;oBACzB,UAAU,EAAE,oBAAoB;oBAChC,IAAI;oBACJ,YAAY,EAAE,WAAW;oBACzB,SAAS,EAAE,IAAI,CAAC,QAAQ;oBACxB,aAAa,EAAE,IAAI,CAAC,YAAY;oBAChC,aAAa,EAAE,YAAY;iBAC3B,CAAC;aACF,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;YAC5E,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0B,CAAC;YAC1E,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;YACrE,IAAI,KAAK,kBAAkB,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;YACjD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAa,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC9G,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;YACrE,OAAO,OAAO,CAAC;QAChB,CAAC;KACD,CAAC;AACH,CAAC"}

package/lib/server/forge/auth/passwords.d.ts

@@ -0,0 +1,7 @@
+export declare const PASSWORD_MIN_LENGTH = 12;
+/** `scrypt$<N>$<salt b64>$<hash b64>` */
+export declare function hashPassword(password: string): Promise<string>;
+export declare function verifyPassword(password: string, stored: string): Promise<boolean>;
+/** Returns an error message, or null when the password is acceptable. */
+export declare function validatePassword(password: string): string | null;
+//# sourceMappingURL=passwords.d.ts.map

package/lib/server/forge/auth/passwords.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passwords.d.ts","sourceRoot":"","sources":["../../../../server/forge/auth/passwords.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAItC,yCAAyC;AACzC,wBAAsB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAIpE;AAED,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAMvF;AAED,yEAAyE;AACzE,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAKhE"}

package/lib/server/forge/auth/passwords.js

@@ -0,0 +1,28 @@
+import { randomBytes, scrypt as scryptCb, timingSafeEqual } from "node:crypto";
+import { promisify } from "node:util";
+const scrypt = promisify(scryptCb);
+export const PASSWORD_MIN_LENGTH = 12;
+const PARAMS = { N: 2 ** 15, r: 8, p: 1, maxmem: 64 * 1024 * 1024 };
+const KEY_LEN = 32;
+/** `scrypt$<N>$<salt b64>$<hash b64>` */
+export async function hashPassword(password) {
+    const salt = randomBytes(16);
+    const hash = await scrypt(password, salt, KEY_LEN, PARAMS);
+    return `scrypt$${PARAMS.N}$${salt.toString("base64")}$${hash.toString("base64")}`;
+}
+export async function verifyPassword(password, stored) {
+    const [scheme, n, saltB64, hashB64] = stored.split("$");
+    if (scheme !== "scrypt" || !n || !saltB64 || !hashB64)
+        return false;
+    const expected = Buffer.from(hashB64, "base64");
+    const actual = await scrypt(password, Buffer.from(saltB64, "base64"), expected.length, { ...PARAMS, N: Number(n) });
+    return actual.length === expected.length && timingSafeEqual(actual, expected);
+}
+/** Returns an error message, or null when the password is acceptable. */
+export function validatePassword(password) {
+    if (typeof password !== "string" || password.length < PASSWORD_MIN_LENGTH) {
+        return `Password must be at least ${PASSWORD_MIN_LENGTH} characters.`;
+    }
+    return null;
+}
+//# sourceMappingURL=passwords.js.map

package/lib/server/forge/auth/passwords.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passwords.js","sourceRoot":"","sources":["../../../../server/forge/auth/passwords.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,IAAI,QAAQ,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC/E,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAA6E,CAAC;AAE/G,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AACtC,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;AACpE,MAAM,OAAO,GAAG,EAAE,CAAC;AAEnB,yCAAyC;AACzC,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAgB;IAClD,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC3D,OAAO,UAAU,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;AACnF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,MAAc;IACpE,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxD,IAAI,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IACpE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACpH,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AAC/E,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAChD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;QAC3E,OAAO,6BAA6B,mBAAmB,cAAc,CAAC;IACvE,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC"}