@jazzmind/busibox-app 3.0.18

package/dist/lib/auth/sso.js

@@ -0,0 +1,282 @@
+/**
+ * SSO Authentication Library (Zero Trust JWKS)
+ *
+ * Validates RS256 JWT tokens issued by authz service via JWKS.
+ * This is the standard authentication method for Busibox apps.
+ *
+ * Token Flow:
+ * 1. User clicks app in Busibox Portal
+ * 2. Busibox Portal exchanges user's session JWT for app-scoped token via authz
+ * 3. authz verifies user has app access via RBAC bindings
+ * 4. authz issues RS256 token with app_id claim and user's roles
+ * 5. App validates token via authz JWKS endpoint
+ *
+ * Token validation is done via authz JWKS endpoint - no shared secrets needed.
+ *
+ * @example
+ * ```typescript
+ * import { validateSSOToken, createSessionFromSSO } from '@jazzmind/busibox-app/lib/auth';
+ *
+ * const validation = await validateSSOToken(token);
+ * if (validation.valid) {
+ *   const session = createSessionFromSSO(validation);
+ * }
+ * ```
+ */
+import * as jose from "jose";
+// Default configuration from environment
+const getDefaultAuthzUrl = () => process.env.AUTHZ_BASE_URL || "http://authz-api:8010";
+const getDefaultAppName = () => process.env.APP_NAME || "app";
+const DEFAULT_ISSUER = "busibox-authz";
+// Cache JWKS for performance (keyed by authz URL)
+const jwksCache = new Map();
+const JWKS_CACHE_TTL = 5 * 60 * 1000; // 5 minutes
+// ============================================================================
+// JWKS Verification
+// ============================================================================
+/**
+ * Get or create JWKS verifier from authz service
+ */
+async function getJwksVerifier(authzUrl) {
+    const now = Date.now();
+    const cached = jwksCache.get(authzUrl);
+    // Return cached JWKS if still valid
+    if (cached && now - cached.time < JWKS_CACHE_TTL) {
+        return cached.verifier;
+    }
+    // Fetch fresh JWKS from authz
+    const jwksUrl = new URL("/.well-known/jwks.json", authzUrl);
+    console.log("[SSO] Fetching JWKS from:", jwksUrl.toString());
+    const verifier = jose.createRemoteJWKSet(jwksUrl);
+    jwksCache.set(authzUrl, { verifier, time: now });
+    return verifier;
+}
+/**
+ * Invalidate JWKS cache (call this if key rotation is detected)
+ */
+export function invalidateJwksCache(authzUrl) {
+    if (authzUrl) {
+        jwksCache.delete(authzUrl);
+    }
+    else {
+        jwksCache.clear();
+    }
+}
+// ============================================================================
+// Token Validation
+// ============================================================================
+/**
+ * Validate app-scoped token from authz
+ *
+ * Token is RS256 signed by authz. We verify using authz JWKS endpoint.
+ * No shared secrets needed - asymmetric verification.
+ *
+ * Handles multiple audience formats robustly:
+ * - Short app IDs (e.g., "estimator", "dredge-estimator")
+ * - Display names (e.g., "Dredging Cost Estimator")
+ * - Explicit path/ID audiences (e.g., "projects", "busibox-projects")
+ *
+ * @param token - JWT token string
+ * @param options - Validation options (authzUrl, appName, issuer)
+ * @returns Validation result with user info or error
+ *
+ * @example
+ * ```typescript
+ * // Using environment variables
+ * const result = await validateSSOToken(token);
+ *
+ * // With explicit options
+ * const result = await validateSSOToken(token, {
+ *   authzUrl: 'http://authz:8010',
+ *   appName: 'My App',
+ * });
+ * ```
+ */
+export async function validateSSOToken(token, options) {
+    const authzUrl = options?.authzUrl || getDefaultAuthzUrl();
+    const appName = options?.appName || getDefaultAppName();
+    const issuer = options?.issuer || DEFAULT_ISSUER;
+    try {
+        const jwks = await getJwksVerifier(authzUrl);
+        console.log(`[SSO] Validating token with expected audience: "${appName}"`);
+        // Debug: Log current time vs token expiration
+        try {
+            const parts = token.split('.');
+            if (parts.length === 3) {
+                const payload = JSON.parse(Buffer.from(parts[1], 'base64').toString());
+                const now = Math.floor(Date.now() / 1000);
+                const exp = payload.exp;
+                const iat = payload.iat;
+                console.log(`[SSO] Token timing - Now: ${now}, Issued: ${iat}, Expires: ${exp}, Age: ${now - iat}s, TTL: ${exp - now}s`);
+            }
+        }
+        catch (e) {
+            // Ignore parsing errors
+        }
+        // Verify and decode token WITHOUT strict audience check
+        // We'll validate audience manually for more flexibility
+        // Add clock tolerance to handle clock skew between services
+        const { payload } = await jose.jwtVerify(token, jwks, {
+            issuer,
+            clockTolerance: 60, // Allow 60 seconds clock skew
+            // Don't enforce audience in jwtVerify - we'll check manually
+        });
+        const appToken = payload;
+        // Manual audience validation with flexible matching
+        const tokenAud = appToken.aud;
+        // Build list of acceptable audiences for this app.
+        // Security: do not include global legacy wildcards like "Busibox App".
+        const acceptedAudiences = [];
+        const addAudience = (value) => {
+            const normalized = (value || "").trim();
+            if (!normalized)
+                return;
+            if (!acceptedAudiences.some((aud) => aud.toLowerCase() === normalized.toLowerCase())) {
+                acceptedAudiences.push(normalized);
+            }
+        };
+        // Primary configured app name
+        addAudience(appName);
+        // Explicit audience override(s), from options or env (comma-separated)
+        const ssoAudienceConfig = options?.ssoAudience || process.env.SSO_AUDIENCE || "";
+        for (const value of ssoAudienceConfig.split(",")) {
+            addAudience(value);
+        }
+        // Deployed path audience fallback (portal often uses this format)
+        const basePath = process.env.NEXT_PUBLIC_BASE_PATH || "";
+        if (basePath) {
+            addAudience(basePath.replace(/^\//, "").toLowerCase());
+        }
+        // Common variations based on appName
+        if (appName) {
+            addAudience(appName.toLowerCase().replace(/\s+/g, "-"));
+            addAudience(appName
+                .split(/[-_\s]+/)
+                .map((word) => word.charAt(0).toUpperCase() + word.slice(1).toLowerCase())
+                .join(" "));
+        }
+        // Check if token audience matches any accepted audience
+        const audMatch = acceptedAudiences.some(aud => {
+            // Exact match
+            if (tokenAud === aud)
+                return true;
+            // Case-insensitive match
+            if (typeof tokenAud === 'string' && tokenAud.toLowerCase() === aud.toLowerCase())
+                return true;
+            // Array of audiences (token can have multiple audiences)
+            if (Array.isArray(tokenAud) && tokenAud.some(a => a === aud || (typeof a === 'string' && a.toLowerCase() === aud.toLowerCase())))
+                return true;
+            return false;
+        });
+        if (!audMatch) {
+            console.error(`[SSO] Token audience mismatch. Expected one of:`, acceptedAudiences, `Got:`, tokenAud);
+            // Create a proper error without using JWTClaimValidationFailed constructor directly
+            const error = new Error('Token audience validation failed');
+            error.name = 'JWTClaimValidationFailed';
+            throw error;
+        }
+        console.log(`[SSO] Token audience validated:`, tokenAud);
+        // Extract email from various possible claims
+        // Session tokens include 'email', access tokens may not
+        const email = appToken.email ||
+            appToken.preferred_username ||
+            appToken.name ||
+            ''; // Empty if not found
+        console.log('[SSO] Token claims:', {
+            sub: appToken.sub,
+            email: appToken.email,
+            preferred_username: appToken.preferred_username,
+            name: appToken.name,
+            roles: appToken.roles?.map((r) => r.name),
+        });
+        // Token is valid - extract user info including profile fields
+        return {
+            valid: true,
+            userId: appToken.sub,
+            email,
+            roles: appToken.roles?.map((r) => r.name) || [],
+            appId: appToken.app_id,
+            scopes: appToken.scope?.split(" ").filter(Boolean) || [],
+            displayName: appToken.name || undefined,
+            firstName: appToken.given_name || undefined,
+            lastName: appToken.family_name || undefined,
+            avatarUrl: appToken.picture || undefined,
+            favoriteColor: appToken.favorite_color || undefined,
+        };
+    }
+    catch (error) {
+        console.error("[SSO] Token validation error:", error);
+        let errorMessage = "Invalid token";
+        if (error instanceof jose.errors.JWTExpired) {
+            errorMessage = "Token expired";
+        }
+        else if (error instanceof jose.errors.JWTClaimValidationFailed) {
+            errorMessage = "Token claims validation failed";
+        }
+        else if (error instanceof jose.errors.JWSSignatureVerificationFailed) {
+            errorMessage = "Token signature verification failed";
+            // Invalidate cache in case of key rotation
+            invalidateJwksCache(authzUrl);
+        }
+        return {
+            valid: false,
+            error: errorMessage,
+        };
+    }
+}
+/**
+ * Full validation - validates the token via JWKS
+ * @deprecated Use validateSSOToken instead
+ */
+export async function validateSSOTokenFull(token, options) {
+    return validateSSOToken(token, options);
+}
+// ============================================================================
+// Session Management Helpers
+// ============================================================================
+/**
+ * Create session data from validated SSO token
+ *
+ * @param validation - Result from validateSSOToken
+ * @returns Session data object
+ * @throws Error if validation result is invalid
+ */
+export function createSessionFromSSO(validation) {
+    if (!validation.valid || !validation.userId) {
+        throw new Error("Invalid SSO validation result");
+    }
+    return {
+        userId: validation.userId,
+        email: validation.email || "",
+        roles: validation.roles || [],
+        appId: validation.appId || "",
+        scopes: validation.scopes || [],
+        authenticatedAt: new Date().toISOString(),
+        authMethod: "sso",
+        // Profile fields from JWT claims
+        displayName: validation.displayName,
+        firstName: validation.firstName,
+        lastName: validation.lastName,
+        avatarUrl: validation.avatarUrl,
+        favoriteColor: validation.favoriteColor,
+    };
+}
+/**
+ * Check if session has specific role
+ */
+export function hasSessionRole(session, roleName) {
+    return session.roles?.includes(roleName) || false;
+}
+/**
+ * Check if session has specific scope
+ */
+export function hasSessionScope(session, scope) {
+    return session.scopes?.includes(scope) || false;
+}
+/**
+ * Check if session user is admin
+ */
+export function isSessionAdmin(session) {
+    return hasSessionRole(session, "Admin") || hasSessionRole(session, "admin");
+}
+//# sourceMappingURL=sso.js.map

package/dist/lib/auth/sso.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso.js","sourceRoot":"","sources":["../../../src/lib/auth/sso.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAoB7B,yCAAyC;AACzC,MAAM,kBAAkB,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,uBAAuB,CAAC;AACvF,MAAM,iBAAiB,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,KAAK,CAAC;AAC9D,MAAM,cAAc,GAAG,eAAe,CAAC;AAEvC,kDAAkD;AAClD,MAAM,SAAS,GAAkE,IAAI,GAAG,EAAE,CAAC;AAC3F,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;AAmElD,+EAA+E;AAC/E,oBAAoB;AACpB,+EAA+E;AAE/E;;GAEG;AACH,KAAK,UAAU,eAAe,CAAC,QAAgB;IAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAEvC,oCAAoC;IACpC,IAAI,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,IAAI,GAAG,cAAc,EAAE,CAAC;QACjD,OAAO,MAAM,CAAC,QAAQ,CAAC;IACzB,CAAC;IAED,8BAA8B;IAC9B,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,wBAAwB,EAAE,QAAQ,CAAC,CAAC;IAC5D,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAE7D,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAClD,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IAEjD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAiB;IACnD,IAAI,QAAQ,EAAE,CAAC;QACb,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC7B,CAAC;SAAM,CAAC;QACN,SAAS,CAAC,KAAK,EAAE,CAAC;IACpB,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,mBAAmB;AACnB,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAa,EACb,OAA8B;IAE9B,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,kBAAkB,EAAE,CAAC;IAC3D,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,CAAC;IACxD,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,cAAc,CAAC;IAEjD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;QAE7C,OAAO,CAAC,GAAG,CAAC,mDAAmD,OAAO,GAAG,CAAC,CAAC;QAE3E,8CAA8C;QAC9C,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACvE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;gBAC1C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;gBACxB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;gBACxB,OAAO,CAAC,GAAG,CAAC,6BAA6B,GAAG,aAAa,GAAG,cAAc,GAAG,UAAU,GAAG,GAAG,GAAG,WAAW,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC;YAC3H,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,wBAAwB;QAC1B,CAAC;QAED,wDAAwD;QACxD,wDAAwD;QACxD,4DAA4D;QAC5D,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;YACpD,MAAM;YACN,cAAc,EAAE,EAAE,EAAE,8BAA8B;YAClD,6DAA6D;SAC9D,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,OAAqC,CAAC;QAEvD,oDAAoD;QACpD,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC;QAE9B,mDAAmD;QACnD,uEAAuE;QACvE,MAAM,iBAAiB,GAAa,EAAE,CAAC;QACvC,MAAM,WAAW,GAAG,CAAC,KAAgC,EAAQ,EAAE;YAC7D,MAAM,UAAU,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACxC,IAAI,CAAC,UAAU;gBAAE,OAAO;YACxB,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;gBACrF,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACrC,CAAC;QACH,CAAC,CAAC;QAEF,8BAA8B;QAC9B,WAAW,CAAC,OAAO,CAAC,CAAC;QAErB,uEAAuE;QACvE,MAAM,iBAAiB,GAAG,OAAO,EAAE,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;QACjF,KAAK,MAAM,KAAK,IAAI,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACjD,WAAW,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;QAED,kEAAkE;QAClE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,CAAC;QACzD,IAAI,QAAQ,EAAE,CAAC;YACb,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QACzD,CAAC;QAED,qCAAqC;QACrC,IAAI,OAAO,EAAE,CAAC;YACZ,WAAW,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;YACxD,WAAW,CACT,OAAO;iBACJ,KAAK,CAAC,SAAS,CAAC;iBAChB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;iBACzE,IAAI,CAAC,GAAG,CAAC,CACb,CAAC;QACJ,CAAC;QAED,wDAAwD;QACxD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;YAC5C,cAAc;YACd,IAAI,QAAQ,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC;YAElC,yBAAyB;YACzB,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,WAAW,EAAE;gBAAE,OAAO,IAAI,CAAC;YAE9F,yDAAyD;YACzD,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAC/C,CAAC,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,WAAW,EAAE,CAAC,CAC9E;gBAAE,OAAO,IAAI,CAAC;YAEf,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,KAAK,CAAC,iDAAiD,EAAE,iBAAiB,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YACtG,oFAAoF;YACpF,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YAC5D,KAAK,CAAC,IAAI,GAAG,0BAA0B,CAAC;YACxC,MAAM,KAAK,CAAC;QACd,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,iCAAiC,EAAE,QAAQ,CAAC,CAAC;QAEzD,6CAA6C;QAC7C,wDAAwD;QACxD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK;YACd,QAAQ,CAAC,kBAAkB;YAC3B,QAAQ,CAAC,IAAI;YACb,EAAE,CAAC,CAAC,qBAAqB;QAEvC,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE;YACjC,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;YAC/C,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SAC1C,CAAC,CAAC;QAEH,8DAA8D;QAC9D,OAAO;YACL,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,QAAQ,CAAC,GAAG;YACpB,KAAK;YACL,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE;YAC/C,KAAK,EAAE,QAAQ,CAAC,MAAM;YACtB,MAAM,EAAE,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE;YACxD,WAAW,EAAE,QAAQ,CAAC,IAAI,IAAI,SAAS;YACvC,SAAS,EAAE,QAAQ,CAAC,UAAU,IAAI,SAAS;YAC3C,QAAQ,EAAE,QAAQ,CAAC,WAAW,IAAI,SAAS;YAC3C,SAAS,EAAE,QAAQ,CAAC,OAAO,IAAI,SAAS;YACxC,aAAa,EAAE,QAAQ,CAAC,cAAc,IAAI,SAAS;SACpD,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;QAEtD,IAAI,YAAY,GAAG,eAAe,CAAC;QACnC,IAAI,KAAK,YAAY,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YAC5C,YAAY,GAAG,eAAe,CAAC;QACjC,CAAC;aAAM,IAAI,KAAK,YAAY,IAAI,CAAC,MAAM,CAAC,wBAAwB,EAAE,CAAC;YACjE,YAAY,GAAG,gCAAgC,CAAC;QAClD,CAAC;aAAM,IAAI,KAAK,YAAY,IAAI,CAAC,MAAM,CAAC,8BAA8B,EAAE,CAAC;YACvE,YAAY,GAAG,qCAAqC,CAAC;YACrD,2CAA2C;YAC3C,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;QAED,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,YAAY;SACpB,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAa,EACb,OAA8B;IAE9B,OAAO,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AAC1C,CAAC;AAED,+EAA+E;AAC/E,6BAA6B;AAC7B,+EAA+E;AAE/E;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAA+B;IAE/B,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IAED,OAAO;QACL,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,KAAK,EAAE,UAAU,CAAC,KAAK,IAAI,EAAE;QAC7B,KAAK,EAAE,UAAU,CAAC,KAAK,IAAI,EAAE;QAC7B,KAAK,EAAE,UAAU,CAAC,KAAK,IAAI,EAAE;QAC7B,MAAM,EAAE,UAAU,CAAC,MAAM,IAAI,EAAE;QAC/B,eAAe,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACzC,UAAU,EAAE,KAAK;QACjB,iCAAiC;QACjC,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,aAAa,EAAE,UAAU,CAAC,aAAa;KACxC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAC5B,OAA6B,EAC7B,QAAgB;IAEhB,OAAO,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC;AACpD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAC7B,OAA8B,EAC9B,KAAa;IAEb,OAAO,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC;AAClD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,OAA6B;IAC1D,OAAO,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAC9E,CAAC"}

package/dist/lib/authz/audit.d.ts

@@ -0,0 +1,167 @@
+/**
+ * Audit Client for busibox-app
+ *
+ * Centralized audit logging client that writes to the authz service.
+ * All Busibox applications should use this client for audit logging.
+ *
+ * Usage:
+ * ```typescript
+ * import { logAuditEvent, logUserLogin } from 'busibox-app';
+ *
+ * await logAuditEvent({
+ *   actorId: 'user-123',
+ *   action: 'document.upload',
+ *   resourceType: 'document',
+ *   resourceId: 'doc-456',
+ *   details: { filename: 'report.pdf' },
+ * });
+ * ```
+ */
+export interface AuditEventParams {
+    /** User or system ID performing the action */
+    actorId: string;
+    /** Action being performed (e.g., 'user.login', 'document.upload') */
+    action: string;
+    /** Type of resource being acted upon (e.g., 'user', 'document', 'session') */
+    resourceType: string;
+    /** Optional ID of the specific resource */
+    resourceId?: string | null;
+    /** Optional additional details (will be stored as JSON) */
+    details?: Record<string, unknown>;
+}
+export interface AuditClientOptions {
+    /** User ID (for server-side token acquisition) */
+    userId?: string;
+    /** Custom token acquisition function */
+    getAuthzToken?: (userId: string, audience: string, scopes: string[]) => Promise<string>;
+    /** Override authz service URL */
+    authzUrl?: string;
+    /** Access token (JWT) for Zero Trust authentication */
+    accessToken?: string;
+}
+/**
+ * Write audit event to authz service
+ *
+ * @param event - Audit event parameters
+ * @param options - Client options (optional tokenManager for user context)
+ */
+export declare function logAuditEvent(event: AuditEventParams, options?: AuditClientOptions): Promise<void>;
+/**
+ * Log a successful user login
+ */
+export declare function logUserLogin(userId: string, sessionId: string, options?: AuditClientOptions & {
+    method?: string;
+}): Promise<void>;
+/**
+ * Log a user logout
+ */
+export declare function logUserLogout(userId: string, sessionId: string, options?: AuditClientOptions): Promise<void>;
+/**
+ * Log a failed login attempt
+ */
+export declare function logLoginFailed(email: string, reason: string, options?: AuditClientOptions): Promise<void>;
+/**
+ * Log a password reset request
+ */
+export declare function logPasswordResetRequest(userId: string, options?: AuditClientOptions): Promise<void>;
+/**
+ * Log a password reset completion
+ */
+export declare function logPasswordReset(userId: string, options?: AuditClientOptions): Promise<void>;
+/**
+ * Log role assignment
+ */
+export declare function logRoleAssigned(actorId: string, targetUserId: string, roleId: string, roleName: string, options?: AuditClientOptions): Promise<void>;
+/**
+ * Log role removal
+ */
+export declare function logRoleRemoved(actorId: string, targetUserId: string, roleId: string, roleName: string, options?: AuditClientOptions): Promise<void>;
+/**
+ * Log user creation
+ */
+export declare function logUserCreated(actorId: string, targetUserId: string, email: string, options?: AuditClientOptions): Promise<void>;
+/**
+ * Log user deletion
+ */
+export declare function logUserDeleted(actorId: string, targetUserId: string, email: string, options?: AuditClientOptions): Promise<void>;
+/**
+ * Log user status change
+ */
+export declare function logUserStatusChanged(actorId: string, targetUserId: string, oldStatus: string, newStatus: string, options?: AuditClientOptions): Promise<void>;
+/**
+ * Log document upload
+ */
+export declare function logDocumentUploaded(userId: string, documentId: string, filename: string, options?: AuditClientOptions): Promise<void>;
+/**
+ * Log document deletion
+ */
+export declare function logDocumentDeleted(userId: string, documentId: string, filename: string, options?: AuditClientOptions): Promise<void>;
+/**
+ * Log document access
+ */
+export declare function logDocumentAccessed(userId: string, documentId: string, filename: string, options?: AuditClientOptions): Promise<void>;
+/**
+ * Log configuration change
+ */
+export declare function logConfigChanged(actorId: string, configKey: string, oldValue: unknown, newValue: unknown, options?: AuditClientOptions): Promise<void>;
+/**
+ * Log API key generation
+ */
+export declare function logApiKeyGenerated(userId: string, keyId: string, keyName: string, options?: AuditClientOptions): Promise<void>;
+/**
+ * Log API key revocation
+ */
+export declare function logApiKeyRevoked(userId: string, keyId: string, keyName: string, options?: AuditClientOptions): Promise<void>;
+export declare function logAppRegistered(appId: string, appName: string, actorId: string, options?: AuditClientOptions): Promise<void>;
+export declare function logAppUpdated(appId: string, appName: string, actorId: string, updates?: Record<string, unknown>, options?: AuditClientOptions): Promise<void>;
+export declare function logAppDeleted(appId: string, appName: string, actorId: string, options?: AuditClientOptions): Promise<void>;
+export declare function logMagicLinkSent(email: string, userId: string, options?: AuditClientOptions): Promise<void>;
+export declare function logMagicLinkUsed(userId: string, email: string, options?: AuditClientOptions): Promise<void>;
+export declare function logMagicLinkExpired(email: string, options?: AuditClientOptions): Promise<void>;
+export declare function logTotpCodeSent(email: string, userId: string, options?: AuditClientOptions): Promise<void>;
+export declare function logTotpCodeUsed(userId: string, email: string, options?: AuditClientOptions): Promise<void>;
+export declare function logTotpCodeFailed(email: string, reason: string, options?: AuditClientOptions): Promise<void>;
+export declare function logPasskeyRegistered(userId: string, email: string, options?: AuditClientOptions): Promise<void>;
+export declare function logPasskeyRemoved(userId: string, passkeyId: string, passkeyName?: string, options?: AuditClientOptions): Promise<void>;
+export declare function logPasskeyLogin(userId: string, passkeyId: string, sessionId: string, ipAddress?: string, userAgent?: string, options?: AuditClientOptions): Promise<void>;
+export declare function logPasskeyLoginFailed(email: string, reason: string, ipAddress?: string, userAgent?: string, options?: AuditClientOptions): Promise<void>;
+export declare function logOAuthTokenGenerated(userId: string, clientId: string, options?: AuditClientOptions): Promise<void>;
+export declare function logOAuthTokenValidated(userId: string, clientId: string, options?: AuditClientOptions): Promise<void>;
+export declare function logOAuthTokenRejected(clientId: string, reason: string, options?: AuditClientOptions): Promise<void>;
+export declare function logRoleCreated(roleId: string, roleName: string, actorId: string, options?: AuditClientOptions): Promise<void>;
+export declare function logRoleUpdated(roleId: string, roleName: string, actorId: string, updates?: Record<string, unknown>, options?: AuditClientOptions): Promise<void>;
+export declare function logRoleDeleted(roleId: string, roleName: string, actorId: string, options?: AuditClientOptions): Promise<void>;
+export declare function logPermissionGranted(roleId: string, roleName: string, appId: string, appName: string, actorId: string, options?: AuditClientOptions): Promise<void>;
+export declare function logPermissionRevoked(roleId: string, roleName: string, appId: string, appName: string, actorId: string, options?: AuditClientOptions): Promise<void>;
+export declare function logUserActivated(userId: string, email: string, actorId?: string, options?: AuditClientOptions): Promise<void>;
+export declare function logUserDeactivated(userId: string, email: string, actorId: string, options?: AuditClientOptions): Promise<void>;
+/**
+ * Audit event type string union
+ *
+ * Previously this was imported from Prisma. Now it's a simple string union
+ * matching the event types supported by the authz service.
+ */
+export type AuditEventType = 'USER_LOGIN' | 'USER_LOGIN_FAILED' | 'USER_LOGOUT' | 'PASSWORD_RESET_REQUEST' | 'PASSWORD_RESET' | 'ROLE_ASSIGNED' | 'ROLE_REMOVED' | 'USER_CREATED' | 'USER_DELETED' | 'USER_STATUS_CHANGED' | 'USER_ACTIVATED' | 'USER_DEACTIVATED' | 'DOCUMENT_UPLOADED' | 'DOCUMENT_DELETED' | 'DOCUMENT_ACCESSED' | 'CONFIG_CHANGED' | 'API_KEY_GENERATED' | 'API_KEY_REVOKED' | 'APP_REGISTERED' | 'APP_UPDATED' | 'APP_DELETED' | 'MAGIC_LINK_SENT' | 'MAGIC_LINK_USED' | 'MAGIC_LINK_EXPIRED' | 'TOTP_CODE_SENT' | 'TOTP_CODE_USED' | 'TOTP_CODE_FAILED' | 'PASSKEY_REGISTERED' | 'PASSKEY_REMOVED' | 'PASSKEY_LOGIN' | 'PASSKEY_LOGIN_FAILED' | 'OAUTH_TOKEN_GENERATED' | 'OAUTH_TOKEN_VALIDATED' | 'OAUTH_TOKEN_REJECTED' | 'ROLE_CREATED' | 'ROLE_UPDATED' | 'ROLE_DELETED' | 'PERMISSION_GRANTED' | 'PERMISSION_REVOKED' | 'ACCESS_DENIED' | 'SESSION_EXPIRED';
+export type AuditLogParams = {
+    eventType: AuditEventType | string;
+    userId?: string | null;
+    targetUserId?: string | null;
+    targetRoleId?: string | null;
+    targetAppId?: string | null;
+    action: string;
+    details?: Record<string, unknown> | null;
+    ipAddress?: string | null;
+    userAgent?: string | null;
+    success?: boolean;
+    errorMessage?: string | null;
+};
+/**
+ * Log a security or audit event
+ *
+ * This function provides backward compatibility with the old Prisma-based
+ * audit logging. It now writes directly to the authz service.
+ *
+ * @param params - Audit log parameters
+ */
+export declare function logEvent(params: AuditLogParams): Promise<void>;
+//# sourceMappingURL=audit.d.ts.map

package/dist/lib/authz/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../../src/lib/authz/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,MAAM,WAAW,gBAAgB;IAC/B,8CAA8C;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,8EAA8E;IAC9E,YAAY,EAAE,MAAM,CAAC;IACrB,2CAA2C;IAC3C,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,kBAAkB;IACjC,kDAAkD;IAClD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wCAAwC;IACxC,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACxF,iCAAiC;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAsBD;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,gBAAgB,EACvB,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAkCf;AAMD;;GAEG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,kBAAkB,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACjD,OAAO,CAAC,IAAI,CAAC,CAQf;AAED;;GAEG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAOf;AAED;;GAEG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAOf;AAED;;GAEG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAOf;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAOf;AAED;;GAEG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAQf;AAED;;GAEG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAQf;AAED;;GAEG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAQf;AAED;;GAEG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAQf;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAQf;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAQf;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAQf;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAQf;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE,OAAO,EACjB,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAQf;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAQf;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAQf;AAMD,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAQf;AAED,wBAAsB,aAAa,CACjC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAQf;AAED,wBAAsB,aAAa,CACjC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAQf;AAMD,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAQf;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAQf;AAED,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAOf;AAED,wBAAsB,eAAe,CACnC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAQf;AAED,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAQf;AAED,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAOf;AAMD,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAQf;AAED,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,WAAW,CAAC,EAAE,MAAM,EACpB,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAQf;AAED,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,SAAS,CAAC,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAQf;AAED,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,SAAS,CAAC,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAOf;AAMD,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAOf;AAED,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAOf;AAED,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAOf;AAMD,wBAAsB,cAAc,CAClC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAQf;AAED,wBAAsB,cAAc,CAClC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAQf;AAED,wBAAsB,cAAc,CAClC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAQf;AAED,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAQf;AAED,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAQf;AAMD,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,MAAM,EAChB,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAQf;AAED,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAQf;AAMD;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GACtB,YAAY,GACZ,mBAAmB,GACnB,aAAa,GACb,wBAAwB,GACxB,gBAAgB,GAChB,eAAe,GACf,cAAc,GACd,cAAc,GACd,cAAc,GACd,qBAAqB,GACrB,gBAAgB,GAChB,kBAAkB,GAClB,mBAAmB,GACnB,kBAAkB,GAClB,mBAAmB,GACnB,gBAAgB,GAChB,mBAAmB,GACnB,iBAAiB,GACjB,gBAAgB,GAChB,aAAa,GACb,aAAa,GACb,iBAAiB,GACjB,iBAAiB,GACjB,oBAAoB,GACpB,gBAAgB,GAChB,gBAAgB,GAChB,kBAAkB,GAClB,oBAAoB,GACpB,iBAAiB,GACjB,eAAe,GACf,sBAAsB,GACtB,uBAAuB,GACvB,uBAAuB,GACvB,sBAAsB,GACtB,cAAc,GACd,cAAc,GACd,cAAc,GACd,oBAAoB,GACpB,oBAAoB,GACpB,eAAe,GACf,iBAAiB,CAAC;AAEtB,MAAM,MAAM,cAAc,GAAG;IAC3B,SAAS,EAAE,cAAc,GAAG,MAAM,CAAC;IACnC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACzC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAsB,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBpE"}