@kaapi/oauth2-auth-design 0.0.13 → 0.0.15

package/kaukau.config.mjs

@@ -0,0 +1,20 @@
+import { defineConfig } from 'kaukau/config'
+
+export default defineConfig({
+  enableLogs: true,
+  exitOnFail: true,
+  files: 'test/',
+  ext: '.test.ts',
+  options: {
+    bail: false,
+    fullTrace: true,
+    grep: '',
+    ignoreLeaks: false,
+    reporter: 'spec',
+    retries: 0,
+    slow: 10000,
+    timeout: 30000,
+    ui: 'bdd',
+    color: true,
+  }
+});

package/lib/cli.d.ts

@@ -0,0 +1,13 @@
+import { FileGenerator, FileGeneratorType, Question } from '@kaapi/cli/definitions';
+export declare class OAuth2FileGenerator implements FileGenerator {
+    #private;
+    get type(): FileGeneratorType;
+    get name(): 'oauth2-generator';
+    get description(): string;
+    get options(): Record<string, string>;
+    init(options: Record<string, unknown>): void;
+    isValid(): boolean;
+    getFileContent(): string;
+    getQuestions(): Question[];
+    getFilename(): string;
+}

package/lib/cli.js

@@ -0,0 +1,181 @@
+"use strict";
+var _OAuth2FileGenerator_values;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuth2FileGenerator = void 0;
+const tslib_1 = require("tslib");
+const definitions_1 = require("@kaapi/cli/definitions");
+const utils_1 = require("@kaapi/cli/utils");
+class OAuth2FileGenerator {
+    constructor() {
+        _OAuth2FileGenerator_values.set(this, {
+            name: ''
+        });
+    }
+    get type() {
+        return 'auth-design';
+    }
+    get name() {
+        return 'oauth2-generator';
+    }
+    get description() {
+        return 'Creates an auth design based on OAuth2 specifications.';
+    }
+    get options() {
+        return {
+            name: 'The name of the design'
+        };
+    }
+    init(options) {
+        if (typeof options['name'] == 'string') {
+            tslib_1.__classPrivateFieldGet(this, _OAuth2FileGenerator_values, "f").name = (0, utils_1.camelCase)(options['name']);
+        }
+    }
+    isValid() {
+        return !!tslib_1.__classPrivateFieldGet(this, _OAuth2FileGenerator_values, "f").name;
+    }
+    getFileContent() {
+        return `import Boom from '@hapi/boom'
+import {
+    OAuth2ACAuthorizationRoute,
+    OAuth2RefreshTokenHandler,
+    OAuth2RefreshTokenRoute,
+    OAuth2ACTokenRoute,
+    OpenIDAuthDesign,
+    OpenIDJWKSRoute,
+    OAuth2TokenResponse,
+    BearerToken
+} from '@kaapi/oauth2-auth-design';
+
+const tokenType = new BearerToken()
+
+export const ${tslib_1.__classPrivateFieldGet(this, _OAuth2FileGenerator_values, "f").name} = new OpenIDAuthDesign(
+    {
+        strategyName: '${(0, utils_1.kebabCase)(tslib_1.__classPrivateFieldGet(this, _OAuth2FileGenerator_values, "f").name)}',
+        openidConfiguration: {
+            ...tokenType.configuration
+        },
+        jwksStore: undefined,
+        jwksRoute: new OpenIDJWKSRoute('/openid/jwks'),
+        authorizationRoute: OAuth2ACAuthorizationRoute.buildDefault<object, { Payload: { user: string, pass: string } }>()
+            .setPath('/oauth2/authorize')
+            .setEmailField('email')
+            .setPasswordField('password')
+            .generateCode(async ({ clientId, codeChallenge, scope, nonce }, { payload: { user, pass } }) => {
+                // validate and generate code
+                if (user == 'janed@example.com' && pass == '1234') {
+                    return JSON.stringify({ clientId, codeChallenge, scope, nonce, user: '248289761001' })
+                }
+
+                return null
+            }),
+        tokenRoute: OAuth2ACTokenRoute.buildDefault()
+            .setPath('/oauth2/token')
+            .generateToken(async ({ clientId, clientSecret, code, codeVerifier, redirectUri, ttl, createIdToken }, _req) => {
+
+                if (!clientSecret && !codeVerifier) {
+                    return { error:  OAuth2ErrorCode.INVALID_REQUEST, error_description: 'Token Request was missing the \\'client_secret\\' parameter.' }
+                }
+                try {
+                    //#region @TODO: validation + token
+                    const accessToken = 'generated_access_token'
+                    const refreshToken = 'generated_refresh_token'
+                    const scope: string[] = ['openid']
+                    return new OAuth2TokenResponse({ access_token: accessToken })
+                        .setExpiresIn(ttl)
+                        .setRefreshToken(refreshToken)
+                        .setScope(scope)
+                        .setIdToken(
+                            await createIdToken?.({
+                                sub: '248289761001',
+                                name: 'Jane Doe',
+                                given_name: 'Jane',
+                                family_name: 'Doe',
+                                preferred_username: 'janed',
+                                email: 'janed@example.com',
+                                email_verified: true,
+                                picture: 'https://example.com/janed.jpg'
+                            })
+                        )
+                        .setTokenType(tokenType)
+                    //#endregion @TODO: validation + token
+                } catch (err) {
+                    console.error(err)
+                }
+
+                return null
+            }),
+        refreshTokenRoute: new OAuth2RefreshTokenRoute(
+            '/oauth2/token',
+            (async ({ clientId, clientSecret, refreshToken, scope, ttl }, _req, h) => {
+
+                //#region @TODO: validation + refresh token
+
+                //#endregion @TODO: validation + refresh token
+
+                return h.response({ error: OAuth2ErrorCode.INVALID_GRANT }).code(400)
+            }) as OAuth2RefreshTokenHandler,
+        ),
+        options: {
+            async validate(req, { token }, h) {
+                if (token) {
+                    //#region @TODO: validation
+                    if (token != 'generated_access_token') {
+                        return {}
+                    }
+                    //#endregion @TODO: validation
+
+                    // authorized to go further
+                    return {
+                        isValid: !!token,
+                        credentials: {
+                            user: {
+                                sub: '248289761001',
+                                name: 'Jane Doe',
+                                given_name: 'Jane',
+                            }
+                        }
+                    }
+                }
+
+                return h.unauthenticated(Boom.unauthorized('unauthorized', 'Bearer'))
+            },
+        }
+    }
+)
+    .setDescription('This API uses OAuth 2 with the authentication code grant flow. [More info](https://oauth.net/2/grant-types/authorization-code/)')
+    .setScopes({
+        profile: 'Access to your profile information',
+        email: 'Access to your email address',
+        offline_access: 'Access to your data when you are not connected'
+    })
+    .setTokenType(tokenType)
+    .setTokenTTL(36000)
+    .clientSecretBasicAuthenticationMethod()
+    .clientSecretPostAuthenticationMethod() // to debug (used in SwaggerUI)
+    //.withoutPkce() // to remove 'none'
+`;
+    }
+    getQuestions() {
+        const r = [];
+        if (!tslib_1.__classPrivateFieldGet(this, _OAuth2FileGenerator_values, "f").name) {
+            r.push({
+                type: definitions_1.QuestionType.text,
+                options: {
+                    message: 'The name of the auth design?',
+                    defaultValue: 'oauth2AuthDesign',
+                    placeholder: 'oauth2AuthDesign'
+                },
+                setValue: (pluginName) => {
+                    tslib_1.__classPrivateFieldGet(this, _OAuth2FileGenerator_values, "f").name = (0, utils_1.camelCase)(pluginName);
+                }
+            });
+        }
+        return r;
+    }
+    getFilename() {
+        return (0, utils_1.kebabCase)(`${tslib_1.__classPrivateFieldGet(this, _OAuth2FileGenerator_values, "f").name}`) + '.ts';
+    }
+}
+exports.OAuth2FileGenerator = OAuth2FileGenerator;
+_OAuth2FileGenerator_values = new WeakMap();
+//# sourceMappingURL=cli.js.map

package/lib/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";;;;;AAAA,wDAAiG;AACjG,4CAAuD;AAEvD,MAAa,mBAAmB;IAAhC;QAoBI,sCAAU;YACN,IAAI,EAAE,EAAE;SACX,EAAA;IA8JL,CAAC;IAlLG,IAAI,IAAI;QACJ,OAAO,aAAa,CAAA;IACxB,CAAC;IAED,IAAI,IAAI;QACJ,OAAO,kBAAkB,CAAA;IAC7B,CAAC;IAED,IAAI,WAAW;QACX,OAAO,wDAAwD,CAAA;IACnE,CAAC;IAED,IAAI,OAAO;QACP,OAAO;YACH,IAAI,EAAE,wBAAwB;SACjC,CAAA;IACL,CAAC;IAMD,IAAI,CAAC,OAAgC;QACjC,IAAI,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACrC,+BAAA,IAAI,mCAAQ,CAAC,IAAI,GAAG,IAAA,iBAAS,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;QAClD,CAAC;IACL,CAAC;IAED,OAAO;QACH,OAAO,CAAC,CAAC,+BAAA,IAAI,mCAAQ,CAAC,IAAI,CAAA;IAC9B,CAAC;IAED,cAAc;QACV,OAAO;;;;;;;;;;;;;;eAcA,+BAAA,IAAI,mCAAQ,CAAC,IAAI;;yBAEP,IAAA,iBAAS,EAAC,+BAAA,IAAI,mCAAQ,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuGpD,CAAA;IACG,CAAC;IAED,YAAY;QACR,MAAM,CAAC,GAAe,EAAE,CAAA;QAExB,IAAI,CAAC,+BAAA,IAAI,mCAAQ,CAAC,IAAI,EAAE,CAAC;YACrB,CAAC,CAAC,IAAI,CAAC;gBACH,IAAI,EAAE,0BAAY,CAAC,IAAI;gBACvB,OAAO,EAAE;oBACL,OAAO,EAAE,8BAA8B;oBACvC,YAAY,EAAE,kBAAkB;oBAChC,WAAW,EAAE,kBAAkB;iBAClC;gBACD,QAAQ,EAAE,CAAC,UAAU,EAAE,EAAE;oBACrB,+BAAA,IAAI,mCAAQ,CAAC,IAAI,GAAG,IAAA,iBAAS,EAAC,UAAU,CAAC,CAAA;gBAC7C,CAAC;aACJ,CAAC,CAAA;QACN,CAAC;QAED,OAAO,CAAC,CAAA;IACZ,CAAC;IAED,WAAW;QACP,OAAO,IAAA,iBAAS,EAAC,GAAG,+BAAA,IAAI,mCAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,KAAK,CAAA;IACpD,CAAC;CACJ;AApLD,kDAoLC"}

package/lib/flows/auth-code/authorization-route.d.ts

@@ -1,5 +1,5 @@
 import { Lifecycle, ReqRef, ReqRefDefaults, Request, ResponseToolkit } from '@kaapi/kaapi';
-import { OAuth2Error, PathValue } from '../common';
+import { AnyOAuth2ErrorCodeType, PathValue } from '../common';
 export interface OAuth2ACAuthorizationParams {
     clientId: string;
     responseType: string;
@@ -25,27 +25,78 @@ export declare class OAuth2ACAuthorizationRoute<GetRefs extends ReqRef = ReqRefD
     get postHandler(): OAuth2ACAuthorizationHandler<PostRefs, Lifecycle.ReturnValue<PostRefs>>;
     constructor(path: string, handler: OAuth2ACAuthorizationHandler<GetRefs>, postHandler: OAuth2ACAuthorizationHandler<PostRefs>);
 }
-export type AuthErrorType = OAuth2Error | 'credentials' | 'unknown';
-export type AuthResponseRenderer<Refs extends ReqRef = ReqRefDefaults> = (reason: {
-    code: number;
+export type AuthResponseRenderer<Refs extends ReqRef = ReqRefDefaults> = (context: {
+    statusCode: number;
     emailField: string;
     passwordField: string;
-    error?: AuthErrorType;
+    error?: AnyOAuth2ErrorCodeType;
     errorMessage?: string;
-}, params: OAuth2ACAuthorizationParams, req: Request<Refs>) => Promise<string | object> | string | object;
+}, params: OAuth2ACAuthorizationParams, req: Request<Refs>, h: ResponseToolkit<Refs>) => Promise<string | object> | string | object;
+export type AuthCodeGeneratorResult = {
+    type: 'code';
+    value: string;
+} | {
+    type: 'continue';
+    value?: unknown;
+} | {
+    type: 'deny';
+    value?: unknown;
+};
 /**
  * Return null for invalid code
  */
-export type AuthCodeGenerator<Refs extends ReqRef = ReqRefDefaults> = (params: OAuth2ACAuthorizationParams, req: Request<Refs>) => Promise<string | null> | string | null;
+export type AuthCodeGenerator<Refs extends ReqRef = ReqRefDefaults> = (params: OAuth2ACAuthorizationParams, req: Request<Refs>, h: ResponseToolkit<Refs>) => Promise<AuthCodeGeneratorResult | null> | AuthCodeGeneratorResult | null;
+export type AuthResponseHandler<Refs extends ReqRef = ReqRefDefaults, R extends Lifecycle.ReturnValue<any> = Lifecycle.ReturnValue<Refs>> = (context: {
+    authorizationResult: AuthCodeGeneratorResult;
+    emailField: string;
+    passwordField: string;
+    /**
+     * The full redirect URI that the user should be sent to after authorization.
+     * This URL includes the appropriate query parameters based on the outcome —
+     * either an authorization `code` (on success) or `error`/`error_description` (on failure).
+     *
+     * Automatically constructed from the original `redirect_uri` and the `authorizationResult`.
+     */
+    fullRedirectUri: string;
+}, params: OAuth2ACAuthorizationParams, req: Request<Refs>, h: ResponseToolkit<Refs>) => R;
 export declare class DefaultOAuth2ACAuthorizationRoute<GetRefs extends ReqRef = ReqRefDefaults, PostRefs extends ReqRef = ReqRefDefaults> extends OAuth2ACAuthorizationRoute<GetRefs, PostRefs> {
     #private;
     constructor();
+    /**
+     * Creates a new `DefaultOAuth2ACAuthorizationRoute` instance from the provided configuration.
+     */
+    static fromConfig<GetRefs extends ReqRef = ReqRefDefaults, PostRefs extends ReqRef = ReqRefDefaults>(config: {
+        path?: PathValue;
+        clientId?: string;
+        redirectUri?: string;
+        emailField?: string;
+        passwordField?: string;
+        codeGenerator?: AuthCodeGenerator<PostRefs>;
+        responseRenderer?: AuthResponseRenderer<GetRefs>;
+        postResponseRenderer?: AuthResponseRenderer<PostRefs>;
+        finalizeAuthorization?: AuthResponseHandler<PostRefs>;
+    }): DefaultOAuth2ACAuthorizationRoute<GetRefs, PostRefs>;
+    private validateClientParams;
     setPath(path: PathValue): this;
     validateGET(handler: OAuth2ACAuthorizationHandler<GetRefs>): this;
     validatePOST(handler: OAuth2ACAuthorizationHandler<PostRefs>): this;
     setGETResponseRenderer(renderer: AuthResponseRenderer<GetRefs>): this;
     setPOSTResponseRenderer(renderer: AuthResponseRenderer<PostRefs>): this;
     generateCode(handler: AuthCodeGenerator<PostRefs>): this;
+    /**
+     *
+     * finalizeAuthorization() is called after the authorization code is generated.
+     *
+     * It must redirect the user back to the client's redirect_uri, or respond with an OAuth2 error.
+     *
+     * example:
+     * ```ts
+     * route.finalizeAuthorization(async (ctx, params, req, h) => {
+     *   return h.redirect(ctx.fullRedirectUri)
+     * })
+     * ```
+     */
+    finalizeAuthorization(handler: AuthResponseHandler<PostRefs>): this;
     setClientId(value: string | null): this;
     setRedirectUri(value: string | null): this;
     setEmailField(value: string): this;

package/lib/flows/auth-code/authorization-route.js

@@ -1,9 +1,10 @@
 "use strict";
-var _DefaultOAuth2ACAuthorizationRoute_clientId, _DefaultOAuth2ACAuthorizationRoute_redirectUri, _DefaultOAuth2ACAuthorizationRoute_emailField, _DefaultOAuth2ACAuthorizationRoute_passwordField, _DefaultOAuth2ACAuthorizationRoute_generateCode, _DefaultOAuth2ACAuthorizationRoute_renderResponse, _DefaultOAuth2ACAuthorizationRoute_renderPOSTResponse;
+var _DefaultOAuth2ACAuthorizationRoute_clientId, _DefaultOAuth2ACAuthorizationRoute_redirectUri, _DefaultOAuth2ACAuthorizationRoute_emailField, _DefaultOAuth2ACAuthorizationRoute_passwordField, _DefaultOAuth2ACAuthorizationRoute_generateCode, _DefaultOAuth2ACAuthorizationRoute_renderResponse, _DefaultOAuth2ACAuthorizationRoute_renderPOSTResponse, _DefaultOAuth2ACAuthorizationRoute_authorizationResponseHandler;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DefaultOAuth2ACAuthorizationRoute = exports.OAuth2ACAuthorizationRoute = void 0;
 const tslib_1 = require("tslib");
 const html_entities_1 = require("html-entities");
+const common_1 = require("../common");
 class OAuth2ACAuthorizationRoute {
     static buildDefault() {
         return new DefaultOAuth2ACAuthorizationRoute();
@@ -63,80 +64,93 @@ const render = ({ error, errorMessage, emailField, passwordField }) => {
  </body>
 </html>`;
 };
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+const authResponseHandler = (ctx, _params, _req, h) => tslib_1.__awaiter(void 0, void 0, void 0, function* () {
+    return h.redirect(`${ctx.fullRedirectUri}`);
+});
+function buildRedirectUri(base, params) {
+    const searchParams = new URLSearchParams();
+    for (const [key, value] of Object.entries(params)) {
+        if (value !== undefined && value !== null) {
+            searchParams.append(key, value);
+        }
+    }
+    return `${base}?${searchParams.toString()}`;
+}
 class DefaultOAuth2ACAuthorizationRoute extends OAuth2ACAuthorizationRoute {
     constructor() {
         super('/oauth2/authorize', (_a, req, h) => tslib_1.__awaiter(this, void 0, void 0, function* () {
             var { clientId, redirectUri } = _a, props = tslib_1.__rest(_a, ["clientId", "redirectUri"]);
-            if (tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_clientId, "f") && tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_clientId, "f") != clientId) {
-                return h.response(yield tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_renderResponse, "f").call(this, {
-                    emailField: tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_emailField, "f"),
-                    passwordField: tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_passwordField, "f"),
-                    code: 400,
-                    error: 'invalid_client',
-                    errorMessage: 'Bad \'client_id\' parameter'
-                }, Object.assign({ clientId, redirectUri }, props), req)).code(400);
-            }
-            if (tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_redirectUri, "f") && tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_redirectUri, "f") != redirectUri) {
-                return h.response(yield tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_renderResponse, "f").call(this, {
-                    emailField: tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_emailField, "f"),
-                    passwordField: tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_passwordField, "f"),
-                    code: 400,
-                    error: 'invalid_client',
-                    errorMessage: 'Bad \'redirect_uri\' parameter'
-                }, Object.assign({ clientId, redirectUri }, props), req)).code(400);
-            }
+            const validationError = yield this.validateClientParams(clientId, redirectUri, Object.assign({ clientId, redirectUri }, props), req, h, tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_renderResponse, "f"));
+            if (validationError)
+                return validationError;
             // render form
             return h.response(yield tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_renderResponse, "f").call(this, {
                 emailField: tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_emailField, "f"),
                 passwordField: tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_passwordField, "f"),
-                code: 200
-            }, Object.assign({ clientId, redirectUri }, props), req)).code(200);
+                statusCode: 200
+            }, Object.assign({ clientId, redirectUri }, props), req, h)).code(200);
         }), (props, req, h) => tslib_1.__awaiter(this, void 0, void 0, function* () {
-            if (tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_clientId, "f") && tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_clientId, "f") != props.clientId) {
-                return h.response(yield tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_renderPOSTResponse, "f").call(this, {
-                    emailField: tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_emailField, "f"),
-                    passwordField: tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_passwordField, "f"),
-                    code: 400,
-                    error: 'invalid_client',
-                    errorMessage: 'Bad \'client_id\' parameter'
-                }, props, req)).code(400);
-            }
-            if (tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_redirectUri, "f") && tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_redirectUri, "f") != props.redirectUri) {
-                return h.response(yield tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_renderPOSTResponse, "f").call(this, {
-                    emailField: tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_emailField, "f"),
-                    passwordField: tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_passwordField, "f"),
-                    code: 400,
-                    error: 'invalid_client',
-                    errorMessage: 'Bad \'redirect_uri\' parameter'
-                }, props, req)).code(400);
-            }
-            let error = 'unknown';
-            let errorMessage = 'someting went wrong';
+            var _a, _b, _c;
+            const validationError = yield this.validateClientParams(props.clientId, props.redirectUri, props, req, h, tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_renderResponse, "f"));
+            if (validationError)
+                return validationError;
+            let error = common_1.OAuth2ErrorCode.SERVER_ERROR;
+            let errorMessage = 'something went wrong';
             if (props.clientId &&
                 req.payload &&
                 typeof req.payload === 'object' &&
-                tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_emailField, "f") in req.payload &&
-                tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_passwordField, "f") in req.payload) {
-                const code = yield tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_generateCode, "f").call(this, props, req);
+                !Array.isArray(req.payload) /*&&
+            this.#emailField in req.payload &&
+            this.#passwordField in req.payload
+            */) {
+                const code = yield tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_generateCode, "f").call(this, props, req, h);
                 if (code) {
-                    return h.redirect(`${props.redirectUri}?code=${code}${props.state ? `&state=${props.state}` : ''}`);
+                    let fullRedirectUri = '';
+                    if (code.type === 'code' && code.value) {
+                        fullRedirectUri = buildRedirectUri(props.redirectUri, {
+                            code: code.value,
+                            state: (_a = props.state) !== null && _a !== void 0 ? _a : ''
+                        });
+                    }
+                    else if (code.type === 'deny') {
+                        fullRedirectUri = buildRedirectUri(props.redirectUri, {
+                            error: common_1.OAuth2ErrorCode.ACCESS_DENIED,
+                            error_description: 'User denied consent',
+                            state: (_b = props.state) !== null && _b !== void 0 ? _b : ''
+                        });
+                    }
+                    else {
+                        fullRedirectUri = buildRedirectUri(props.redirectUri, {
+                            error: common_1.OAuth2ErrorCode.INVALID_REQUEST,
+                            error_description: 'No code',
+                            state: (_c = props.state) !== null && _c !== void 0 ? _c : ''
+                        });
+                    }
+                    return tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_authorizationResponseHandler, "f").call(this, {
+                        authorizationResult: code,
+                        emailField: tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_emailField, "f"),
+                        passwordField: tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_passwordField, "f"),
+                        fullRedirectUri
+                    }, props, req, h);
                 }
                 else {
-                    error = 'credentials';
+                    error = common_1.OAuth2ErrorCode.ACCESS_DENIED;
                     errorMessage = 'wrong credentials';
                 }
             }
             else {
-                error = 'invalid_request';
+                error = common_1.OAuth2ErrorCode.INVALID_REQUEST;
+                errorMessage = 'Missing or invalid request payload';
             }
             // render form
             return h.response(yield tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_renderPOSTResponse, "f").call(this, {
                 emailField: tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_emailField, "f"),
                 passwordField: tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_passwordField, "f"),
-                code: 400,
+                statusCode: 400,
                 error: error,
                 errorMessage
-            }, props, req)).code(400);
+            }, props, req, h)).code(400);
         }));
         _DefaultOAuth2ACAuthorizationRoute_clientId.set(this, void 0);
         _DefaultOAuth2ACAuthorizationRoute_redirectUri.set(this, void 0);
@@ -145,10 +159,66 @@ class DefaultOAuth2ACAuthorizationRoute extends OAuth2ACAuthorizationRoute {
         _DefaultOAuth2ACAuthorizationRoute_generateCode.set(this, void 0);
         _DefaultOAuth2ACAuthorizationRoute_renderResponse.set(this, void 0);
         _DefaultOAuth2ACAuthorizationRoute_renderPOSTResponse.set(this, void 0);
+        _DefaultOAuth2ACAuthorizationRoute_authorizationResponseHandler.set(this, void 0);
         // @TODO: generate id for user, store it in-memory, generate jwt code ?
         tslib_1.__classPrivateFieldSet(this, _DefaultOAuth2ACAuthorizationRoute_generateCode, () => tslib_1.__awaiter(this, void 0, void 0, function* () { return null; }), "f");
         tslib_1.__classPrivateFieldSet(this, _DefaultOAuth2ACAuthorizationRoute_renderResponse, render, "f");
         tslib_1.__classPrivateFieldSet(this, _DefaultOAuth2ACAuthorizationRoute_renderPOSTResponse, render, "f");
+        tslib_1.__classPrivateFieldSet(this, _DefaultOAuth2ACAuthorizationRoute_authorizationResponseHandler, authResponseHandler, "f");
+    }
+    /**
+     * Creates a new `DefaultOAuth2ACAuthorizationRoute` instance from the provided configuration.
+     */
+    static fromConfig(config) {
+        const instance = new DefaultOAuth2ACAuthorizationRoute();
+        if (config.path)
+            instance.setPath(config.path);
+        if (config.clientId)
+            instance.setClientId(config.clientId);
+        if (config.redirectUri)
+            instance.setRedirectUri(config.redirectUri);
+        if (config.emailField)
+            instance.setEmailField(config.emailField);
+        if (config.passwordField)
+            instance.setPasswordField(config.passwordField);
+        if (config.codeGenerator)
+            instance.generateCode(config.codeGenerator);
+        if (config.responseRenderer)
+            instance.setGETResponseRenderer(config.responseRenderer);
+        if (config.postResponseRenderer)
+            instance.setPOSTResponseRenderer(config.postResponseRenderer);
+        if (config.finalizeAuthorization)
+            instance.finalizeAuthorization(config.finalizeAuthorization);
+        return instance;
+    }
+    validateClientParams(clientId, redirectUri, props, 
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    req, 
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    h, 
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    renderer) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            if (tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_clientId, "f") && tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_clientId, "f") !== clientId) {
+                return h.response(yield renderer({
+                    emailField: tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_emailField, "f"),
+                    passwordField: tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_passwordField, "f"),
+                    statusCode: 400,
+                    error: common_1.OAuth2ErrorCode.INVALID_CLIENT,
+                    errorMessage: 'Bad \'client_id\' parameter'
+                }, props, req, h)).code(400);
+            }
+            if (tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_redirectUri, "f") && tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_redirectUri, "f") !== redirectUri) {
+                return h.response(yield renderer({
+                    emailField: tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_emailField, "f"),
+                    passwordField: tslib_1.__classPrivateFieldGet(this, _DefaultOAuth2ACAuthorizationRoute_passwordField, "f"),
+                    statusCode: 400,
+                    error: common_1.OAuth2ErrorCode.INVALID_CLIENT,
+                    errorMessage: 'Bad \'redirect_uri\' parameter'
+                }, props, req, h)).code(400);
+            }
+            return null;
+        });
     }
     setPath(path) {
         if (path)
@@ -175,6 +245,23 @@ class DefaultOAuth2ACAuthorizationRoute extends OAuth2ACAuthorizationRoute {
         tslib_1.__classPrivateFieldSet(this, _DefaultOAuth2ACAuthorizationRoute_generateCode, handler, "f");
         return this;
     }
+    /**
+     *
+     * finalizeAuthorization() is called after the authorization code is generated.
+     *
+     * It must redirect the user back to the client's redirect_uri, or respond with an OAuth2 error.
+     *
+     * example:
+     * ```ts
+     * route.finalizeAuthorization(async (ctx, params, req, h) => {
+     *   return h.redirect(ctx.fullRedirectUri)
+     * })
+     * ```
+     */
+    finalizeAuthorization(handler) {
+        tslib_1.__classPrivateFieldSet(this, _DefaultOAuth2ACAuthorizationRoute_authorizationResponseHandler, handler, "f");
+        return this;
+    }
     setClientId(value) {
         tslib_1.__classPrivateFieldSet(this, _DefaultOAuth2ACAuthorizationRoute_clientId, value, "f");
         return this;
@@ -184,19 +271,19 @@ class DefaultOAuth2ACAuthorizationRoute extends OAuth2ACAuthorizationRoute {
         return this;
     }
     setEmailField(value) {
-        const escaped = encodeURIComponent((0, html_entities_1.encode)(value));
+        const escaped = (0, html_entities_1.encode)(value); // For HTML rendering, use encode() (from html-entities)
         if (escaped)
             tslib_1.__classPrivateFieldSet(this, _DefaultOAuth2ACAuthorizationRoute_emailField, escaped, "f");
         return this;
     }
     setPasswordField(value) {
-        const escaped = encodeURIComponent((0, html_entities_1.encode)(value));
+        const escaped = (0, html_entities_1.encode)(value); // For HTML rendering, use encode() (from html-entities)
         if (escaped)
             tslib_1.__classPrivateFieldSet(this, _DefaultOAuth2ACAuthorizationRoute_passwordField, escaped, "f");
         return this;
     }
 }
 exports.DefaultOAuth2ACAuthorizationRoute = DefaultOAuth2ACAuthorizationRoute;
-_DefaultOAuth2ACAuthorizationRoute_clientId = new WeakMap(), _DefaultOAuth2ACAuthorizationRoute_redirectUri = new WeakMap(), _DefaultOAuth2ACAuthorizationRoute_emailField = new WeakMap(), _DefaultOAuth2ACAuthorizationRoute_passwordField = new WeakMap(), _DefaultOAuth2ACAuthorizationRoute_generateCode = new WeakMap(), _DefaultOAuth2ACAuthorizationRoute_renderResponse = new WeakMap(), _DefaultOAuth2ACAuthorizationRoute_renderPOSTResponse = new WeakMap();
+_DefaultOAuth2ACAuthorizationRoute_clientId = new WeakMap(), _DefaultOAuth2ACAuthorizationRoute_redirectUri = new WeakMap(), _DefaultOAuth2ACAuthorizationRoute_emailField = new WeakMap(), _DefaultOAuth2ACAuthorizationRoute_passwordField = new WeakMap(), _DefaultOAuth2ACAuthorizationRoute_generateCode = new WeakMap(), _DefaultOAuth2ACAuthorizationRoute_renderResponse = new WeakMap(), _DefaultOAuth2ACAuthorizationRoute_renderPOSTResponse = new WeakMap(), _DefaultOAuth2ACAuthorizationRoute_authorizationResponseHandler = new WeakMap();
 //#endregion Defaults
 //# sourceMappingURL=authorization-route.js.map

package/lib/flows/auth-code/authorization-route.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorization-route.js","sourceRoot":"","sources":["../../../src/flows/auth-code/authorization-route.ts"],"names":[],"mappings":";;;;;AAOA,iDAAsC;AA8BtC,MAAa,0BAA0B;IAKnC,MAAM,CAAC,YAAY;QAIf,OAAO,IAAI,iCAAiC,EAAqB,CAAA;IACrE,CAAC;IAMD,IAAI,IAAI;QACJ,OAAO,IAAI,CAAC,KAAK,CAAA;IACrB,CAAC;IAED,IAAI,OAAO;QACP,OAAO,IAAI,CAAC,QAAQ,CAAA;IACxB,CAAC;IAED,IAAI,WAAW;QACX,OAAO,IAAI,CAAC,YAAY,CAAA;IAC5B,CAAC;IAED,YACI,IAAY,EACZ,OAA8C,EAC9C,WAAmD;QAEnD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;IACpC,CAAC;CACJ;AArCD,gEAqCC;AA4BD,8DAA8D;AAC9D,MAAM,MAAM,GAA8B,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,EAAE,EAAE;IAC7F,IAAI,KAAK,IAAI,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9C,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAqB,CAAA;IACxE,CAAC;IACD,OAAO;;;;;;;;;;;;;;;;;;;MAmBL,YAAY,IAAI,EAAE;;;4BAGI,UAAU,WAAW,UAAU,kBAAkB,UAAU,mBAAmB,UAAU;+BACrF,aAAa,WAAW,aAAa,kBAAkB,aAAa;;;;;;;;;QAS3F,CAAA;AACR,CAAC,CAAA;AAED,MAAa,iCAGX,SAAQ,0BAA6C;IAWnD;QACI,KAAK,CAAC,mBAAmB,EAAE,CAAO,EAAmC,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;gBAA/C,EAAE,QAAQ,EAAE,WAAW,OAAY,EAAP,KAAK,sBAAjC,2BAAmC,CAAF;YAC/D,IAAI,+BAAA,IAAI,mDAAU,IAAI,+BAAA,IAAI,mDAAU,IAAI,QAAQ,EAAE,CAAC;gBAC/C,OAAO,CAAC,CAAC,QAAQ,CACb,MAAM,+BAAA,IAAI,yDAAgB,MAApB,IAAI,EACN;oBACI,UAAU,EAAE,+BAAA,IAAI,qDAAY;oBAC5B,aAAa,EAAE,+BAAA,IAAI,wDAAe;oBAClC,IAAI,EAAE,GAAG;oBACT,KAAK,EAAE,gBAAgB;oBACvB,YAAY,EAAE,6BAA6B;iBAC9C,kBACC,QAAQ,EAAE,WAAW,IAAK,KAAK,GACjC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAC3B,CAAC;YACD,IAAI,+BAAA,IAAI,sDAAa,IAAI,+BAAA,IAAI,sDAAa,IAAI,WAAW,EAAE,CAAC;gBACxD,OAAO,CAAC,CAAC,QAAQ,CACb,MAAM,+BAAA,IAAI,yDAAgB,MAApB,IAAI,EACN;oBACI,UAAU,EAAE,+BAAA,IAAI,qDAAY;oBAC5B,aAAa,EAAE,+BAAA,IAAI,wDAAe;oBAClC,IAAI,EAAE,GAAG;oBACT,KAAK,EAAE,gBAAgB;oBACvB,YAAY,EAAE,gCAAgC;iBACjD,kBACC,QAAQ,EAAE,WAAW,IAAK,KAAK,GACjC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAC3B,CAAC;YAED,cAAc;YACd,OAAO,CAAC,CAAC,QAAQ,CACb,MAAM,+BAAA,IAAI,yDAAgB,MAApB,IAAI,EAAiB;gBACvB,UAAU,EAAE,+BAAA,IAAI,qDAAY;gBAC5B,aAAa,EAAE,+BAAA,IAAI,wDAAe;gBAClC,IAAI,EAAE,GAAG;aACZ,kBAAI,QAAQ,EAAE,WAAW,IAAK,KAAK,GAAI,GAAG,CAAC,CAC/C,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACf,CAAC,CAAA,EAAE,CAAO,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;YACvB,IAAI,+BAAA,IAAI,mDAAU,IAAI,+BAAA,IAAI,mDAAU,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACrD,OAAO,CAAC,CAAC,QAAQ,CACb,MAAM,+BAAA,IAAI,6DAAoB,MAAxB,IAAI,EACN;oBACI,UAAU,EAAE,+BAAA,IAAI,qDAAY;oBAC5B,aAAa,EAAE,+BAAA,IAAI,wDAAe;oBAClC,IAAI,EAAE,GAAG;oBACT,KAAK,EAAE,gBAAgB;oBACvB,YAAY,EAAE,6BAA6B;iBAC9C,EACD,KAAK,EACL,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAC3B,CAAC;YACD,IAAI,+BAAA,IAAI,sDAAa,IAAI,+BAAA,IAAI,sDAAa,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;gBAC9D,OAAO,CAAC,CAAC,QAAQ,CACb,MAAM,+BAAA,IAAI,6DAAoB,MAAxB,IAAI,EACN;oBACI,UAAU,EAAE,+BAAA,IAAI,qDAAY;oBAC5B,aAAa,EAAE,+BAAA,IAAI,wDAAe;oBAClC,IAAI,EAAE,GAAG;oBACT,KAAK,EAAE,gBAAgB;oBACvB,YAAY,EAAE,gCAAgC;iBACjD,EACD,KAAK,EACL,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAC3B,CAAC;YAED,IAAI,KAAK,GAAkB,SAAS,CAAA;YACpC,IAAI,YAAY,GAAG,qBAAqB,CAAA;YAExC,IACI,KAAK,CAAC,QAAQ;gBACd,GAAG,CAAC,OAAO;gBACX,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;gBAC/B,+BAAA,IAAI,qDAAY,IAAI,GAAG,CAAC,OAAO;gBAC/B,+BAAA,IAAI,wDAAe,IAAI,GAAG,CAAC,OAAO,EACpC,CAAC;gBACC,MAAM,IAAI,GAAG,MAAM,+BAAA,IAAI,uDAAc,MAAlB,IAAI,EAAe,KAAK,EAAE,GAAG,CAAC,CAAA;gBACjD,IAAI,IAAI,EAAE,CAAC;oBACP,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,WAAW,SAAS,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;gBACvG,CAAC;qBAAM,CAAC;oBACJ,KAAK,GAAG,aAAa,CAAA;oBACrB,YAAY,GAAG,mBAAmB,CAAA;gBACtC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACJ,KAAK,GAAG,iBAAiB,CAAA;YAC7B,CAAC;YAED,cAAc;YACd,OAAO,CAAC,CAAC,QAAQ,CACb,MAAM,+BAAA,IAAI,6DAAoB,MAAxB,IAAI,EACN;gBACI,UAAU,EAAE,+BAAA,IAAI,qDAAY;gBAC5B,aAAa,EAAE,+BAAA,IAAI,wDAAe;gBAClC,IAAI,EAAE,GAAG;gBACT,KAAK,EAAE,KAAK;gBACZ,YAAY;aACf,EACD,KAAK,EACL,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC3B,CAAC,CAAA,CAAC,CAAA;QA5GN,8DAAyB;QACzB,iEAA4B;QAE5B,wDAAc,OAAO,EAAA;QACrB,2DAAiB,UAAU,EAAA;QAE3B,kEAA0C;QAC1C,oEAA8C;QAC9C,wEAAmD;QAsG/C,uEAAuE;QACvE,+BAAA,IAAI,mDAAiB,GAAS,EAAE,wDAAC,OAAA,IAAI,CAAA,GAAA,MAAA,CAAA;QACrC,+BAAA,IAAI,qDAAmB,MAAM,MAAA,CAAA;QAC7B,+BAAA,IAAI,yDAAuB,MAAM,MAAA,CAAA;IACrC,CAAC;IAED,OAAO,CAAC,IAAe;QACnB,IAAI,IAAI;YACJ,IAAI,CAAC,KAAK,GAAG,IAAI,CAAA;QACrB,OAAO,IAAI,CAAA;IACf,CAAC;IAED,WAAW,CAAC,OAA8C;QACtD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAA;QACvB,OAAO,IAAI,CAAA;IACf,CAAC;IAED,YAAY,CAAC,OAA+C;QACxD,IAAI,CAAC,YAAY,GAAG,OAAO,CAAA;QAC3B,OAAO,IAAI,CAAA;IACf,CAAC;IAED,sBAAsB,CAAC,QAAuC;QAC1D,+BAAA,IAAI,qDAAmB,QAAQ,MAAA,CAAA;QAC/B,OAAO,IAAI,CAAA;IACf,CAAC;IAED,uBAAuB,CAAC,QAAwC;QAC5D,+BAAA,IAAI,yDAAuB,QAAQ,MAAA,CAAA;QACnC,OAAO,IAAI,CAAA;IACf,CAAC;IAED,YAAY,CAAC,OAAoC;QAC7C,+BAAA,IAAI,mDAAiB,OAAO,MAAA,CAAA;QAC5B,OAAO,IAAI,CAAA;IACf,CAAC;IAED,WAAW,CAAC,KAAoB;QAC5B,+BAAA,IAAI,+CAAa,KAAK,MAAA,CAAA;QACtB,OAAO,IAAI,CAAA;IACf,CAAC;IAED,cAAc,CAAC,KAAoB;QAC/B,+BAAA,IAAI,kDAAgB,KAAK,MAAA,CAAA;QACzB,OAAO,IAAI,CAAA;IACf,CAAC;IAED,aAAa,CAAC,KAAa;QACvB,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAA,sBAAM,EAAC,KAAK,CAAC,CAAC,CAAA;QACjD,IAAI,OAAO;YACP,+BAAA,IAAI,iDAAe,OAAO,MAAA,CAAA;QAC9B,OAAO,IAAI,CAAA;IACf,CAAC;IAED,gBAAgB,CAAC,KAAa;QAC1B,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAA,sBAAM,EAAC,KAAK,CAAC,CAAC,CAAA;QACjD,IAAI,OAAO;YACP,+BAAA,IAAI,oDAAkB,OAAO,MAAA,CAAA;QACjC,OAAO,IAAI,CAAA;IACf,CAAC;CACJ;AA9KD,8EA8KC;;AAED,qBAAqB"}
+{"version":3,"file":"authorization-route.js","sourceRoot":"","sources":["../../../src/flows/auth-code/authorization-route.ts"],"names":[],"mappings":";;;;;AAOA,iDAAsC;AACtC,sCAA+F;AA6B/F,MAAa,0BAA0B;IAKnC,MAAM,CAAC,YAAY;QAIf,OAAO,IAAI,iCAAiC,EAAqB,CAAA;IACrE,CAAC;IAMD,IAAI,IAAI;QACJ,OAAO,IAAI,CAAC,KAAK,CAAA;IACrB,CAAC;IAED,IAAI,OAAO;QACP,OAAO,IAAI,CAAC,QAAQ,CAAA;IACxB,CAAC;IAED,IAAI,WAAW;QACX,OAAO,IAAI,CAAC,YAAY,CAAA;IAC5B,CAAC;IAED,YACI,IAAY,EACZ,OAA8C,EAC9C,WAAmD;QAEnD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;IACpC,CAAC;CACJ;AArCD,gEAqCC;AAuDD,8DAA8D;AAC9D,MAAM,MAAM,GAA8B,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,EAAE,EAAE;IAC7F,IAAI,KAAK,IAAI,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9C,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAqB,CAAA;IACxE,CAAC;IACD,OAAO;;;;;;;;;;;;;;;;;;;MAmBL,YAAY,IAAI,EAAE;;;4BAGI,UAAU,WAAW,UAAU,kBAAkB,UAAU,mBAAmB,UAAU;+BACrF,aAAa,WAAW,aAAa,kBAAkB,aAAa;;;;;;;;;QAS3F,CAAA;AACR,CAAC,CAAA;AAED,8DAA8D;AAC9D,MAAM,mBAAmB,GAA6B,CAAO,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE;IAClF,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC,eAAe,EAAE,CAAC,CAAA;AAC/C,CAAC,CAAA,CAAA;AAED,SAAS,gBAAgB,CAAC,IAAY,EAAE,MAA8B;IAClE,MAAM,YAAY,GAAG,IAAI,eAAe,EAAE,CAAA;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAChD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACxC,YAAY,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QACnC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,IAAI,IAAI,YAAY,CAAC,QAAQ,EAAE,EAAE,CAAA;AAC/C,CAAC;AAED,MAAa,iCAGX,SAAQ,0BAA6C;IAYnD;QACI,KAAK,CAAC,mBAAmB,EAAE,CAAO,EAAmC,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;gBAA/C,EAAE,QAAQ,EAAE,WAAW,OAAY,EAAP,KAAK,sBAAjC,2BAAmC,CAAF;YAC/D,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,WAAW,kBAAI,QAAQ,EAAE,WAAW,IAAK,KAAK,GAAI,GAAG,EAAE,CAAC,EAAE,+BAAA,IAAI,yDAAgB,CAAC,CAAA;YACjJ,IAAI,eAAe;gBAAE,OAAO,eAAe,CAAA;YAE3C,cAAc;YACd,OAAO,CAAC,CAAC,QAAQ,CACb,MAAM,+BAAA,IAAI,yDAAgB,MAApB,IAAI,EAAiB;gBACvB,UAAU,EAAE,+BAAA,IAAI,qDAAY;gBAC5B,aAAa,EAAE,+BAAA,IAAI,wDAAe;gBAClC,UAAU,EAAE,GAAG;aAClB,kBAAI,QAAQ,EAAE,WAAW,IAAK,KAAK,GAAI,GAAG,EAAE,CAAC,CAAC,CAClD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACf,CAAC,CAAA,EAAE,CAAO,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;;YACvB,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,+BAAA,IAAI,yDAAgB,CAAC,CAAA;YAC/H,IAAI,eAAe;gBAAE,OAAO,eAAe,CAAA;YAE3C,IAAI,KAAK,GAA2B,wBAAe,CAAC,YAAY,CAAA;YAChE,IAAI,YAAY,GAAG,sBAAsB,CAAA;YAEzC,IACI,KAAK,CAAC,QAAQ;gBACd,GAAG,CAAC,OAAO;gBACX,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;gBAC/B,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;;;cAGzB,EACJ,CAAC;gBACC,MAAM,IAAI,GAAG,MAAM,+BAAA,IAAI,uDAAc,MAAlB,IAAI,EAAe,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;gBACrD,IAAI,IAAI,EAAE,CAAC;oBACP,IAAI,eAAe,GAAG,EAAE,CAAC;oBACzB,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;wBACrC,eAAe,GAAG,gBAAgB,CAAC,KAAK,CAAC,WAAW,EAAE;4BAClD,IAAI,EAAE,IAAI,CAAC,KAAK;4BAChB,KAAK,EAAE,MAAA,KAAK,CAAC,KAAK,mCAAI,EAAE;yBAC3B,CAAC,CAAC;oBACP,CAAC;yBAAM,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;wBAC9B,eAAe,GAAG,gBAAgB,CAAC,KAAK,CAAC,WAAW,EAAE;4BAClD,KAAK,EAAE,wBAAe,CAAC,aAAa;4BACpC,iBAAiB,EAAE,qBAAqB;4BACxC,KAAK,EAAE,MAAA,KAAK,CAAC,KAAK,mCAAI,EAAE;yBAC3B,CAAC,CAAC;oBACP,CAAC;yBAAM,CAAC;wBACJ,eAAe,GAAG,gBAAgB,CAAC,KAAK,CAAC,WAAW,EAAE;4BAClD,KAAK,EAAE,wBAAe,CAAC,eAAe;4BACtC,iBAAiB,EAAE,SAAS;4BAC5B,KAAK,EAAE,MAAA,KAAK,CAAC,KAAK,mCAAI,EAAE;yBAC3B,CAAC,CAAC;oBACP,CAAC;oBACD,OAAO,+BAAA,IAAI,uEAA8B,MAAlC,IAAI,EAA+B;wBACtC,mBAAmB,EAAE,IAAI;wBACzB,UAAU,EAAE,+BAAA,IAAI,qDAAY;wBAC5B,aAAa,EAAE,+BAAA,IAAI,wDAAe;wBAClC,eAAe;qBAClB,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;gBACrB,CAAC;qBAAM,CAAC;oBACJ,KAAK,GAAG,wBAAe,CAAC,aAAa,CAAA;oBACrC,YAAY,GAAG,mBAAmB,CAAA;gBACtC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACJ,KAAK,GAAG,wBAAe,CAAC,eAAe,CAAA;gBACvC,YAAY,GAAG,oCAAoC,CAAA;YACvD,CAAC;YAED,cAAc;YACd,OAAO,CAAC,CAAC,QAAQ,CACb,MAAM,+BAAA,IAAI,6DAAoB,MAAxB,IAAI,EACN;gBACI,UAAU,EAAE,+BAAA,IAAI,qDAAY;gBAC5B,aAAa,EAAE,+BAAA,IAAI,wDAAe;gBAClC,UAAU,EAAE,GAAG;gBACf,KAAK,EAAE,KAAK;gBACZ,YAAY;aACf,EACD,KAAK,EACL,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC9B,CAAC,CAAA,CAAC,CAAA;QAxFN,8DAAyB;QACzB,iEAA4B;QAE5B,wDAAc,OAAO,EAAA;QACrB,2DAAiB,UAAU,EAAA;QAE3B,kEAA0C;QAC1C,oEAA8C;QAC9C,wEAAmD;QACnD,kFAA4D;QAiFxD,uEAAuE;QACvE,+BAAA,IAAI,mDAAiB,GAAS,EAAE,wDAAC,OAAA,IAAI,CAAA,GAAA,MAAA,CAAA;QACrC,+BAAA,IAAI,qDAAmB,MAAM,MAAA,CAAA;QAC7B,+BAAA,IAAI,yDAAuB,MAAM,MAAA,CAAA;QACjC,+BAAA,IAAI,mEAAiC,mBAAmB,MAAA,CAAA;IAC5D,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,UAAU,CAGf,MAUD;QACG,MAAM,QAAQ,GAAG,IAAI,iCAAiC,EAAqB,CAAA;QAC3E,IAAI,MAAM,CAAC,IAAI;YAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAC9C,IAAI,MAAM,CAAC,QAAQ;YAAE,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;QAC1D,IAAI,MAAM,CAAC,WAAW;YAAE,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;QACnE,IAAI,MAAM,CAAC,UAAU;YAAE,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;QAChE,IAAI,MAAM,CAAC,aAAa;YAAE,QAAQ,CAAC,gBAAgB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAA;QACzE,IAAI,MAAM,CAAC,aAAa;YAAE,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,aAAa,CAAC,CAAA;QACrE,IAAI,MAAM,CAAC,gBAAgB;YAAE,QAAQ,CAAC,sBAAsB,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAA;QACrF,IAAI,MAAM,CAAC,oBAAoB;YAAE,QAAQ,CAAC,uBAAuB,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAA;QAC9F,IAAI,MAAM,CAAC,qBAAqB;YAAE,QAAQ,CAAC,qBAAqB,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAA;QAC9F,OAAO,QAAQ,CAAA;IACnB,CAAC;IAEa,oBAAoB,CAC9B,QAAgB,EAChB,WAAmB,EACnB,KAAkC;IAClC,8DAA8D;IAC9D,GAAiB;IACjB,8DAA8D;IAC9D,CAAuB;IACvB,8DAA8D;IAC9D,QAAmC;;YAEnC,IAAI,+BAAA,IAAI,mDAAU,IAAI,+BAAA,IAAI,mDAAU,KAAK,QAAQ,EAAE,CAAC;gBAChD,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,QAAQ,CAAC;oBAC7B,UAAU,EAAE,+BAAA,IAAI,qDAAY;oBAC5B,aAAa,EAAE,+BAAA,IAAI,wDAAe;oBAClC,UAAU,EAAE,GAAG;oBACf,KAAK,EAAE,wBAAe,CAAC,cAAc;oBACrC,YAAY,EAAE,6BAA6B;iBAC9C,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAChC,CAAC;YAED,IAAI,+BAAA,IAAI,sDAAa,IAAI,+BAAA,IAAI,sDAAa,KAAK,WAAW,EAAE,CAAC;gBACzD,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,QAAQ,CAAC;oBAC7B,UAAU,EAAE,+BAAA,IAAI,qDAAY;oBAC5B,aAAa,EAAE,+BAAA,IAAI,wDAAe;oBAClC,UAAU,EAAE,GAAG;oBACf,KAAK,EAAE,wBAAe,CAAC,cAAc;oBACrC,YAAY,EAAE,gCAAgC;iBACjD,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAChC,CAAC;YAED,OAAO,IAAI,CAAA;QACf,CAAC;KAAA;IAED,OAAO,CAAC,IAAe;QACnB,IAAI,IAAI;YACJ,IAAI,CAAC,KAAK,GAAG,IAAI,CAAA;QACrB,OAAO,IAAI,CAAA;IACf,CAAC;IAED,WAAW,CAAC,OAA8C;QACtD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAA;QACvB,OAAO,IAAI,CAAA;IACf,CAAC;IAED,YAAY,CAAC,OAA+C;QACxD,IAAI,CAAC,YAAY,GAAG,OAAO,CAAA;QAC3B,OAAO,IAAI,CAAA;IACf,CAAC;IAED,sBAAsB,CAAC,QAAuC;QAC1D,+BAAA,IAAI,qDAAmB,QAAQ,MAAA,CAAA;QAC/B,OAAO,IAAI,CAAA;IACf,CAAC;IAED,uBAAuB,CAAC,QAAwC;QAC5D,+BAAA,IAAI,yDAAuB,QAAQ,MAAA,CAAA;QACnC,OAAO,IAAI,CAAA;IACf,CAAC;IAED,YAAY,CAAC,OAAoC;QAC7C,+BAAA,IAAI,mDAAiB,OAAO,MAAA,CAAA;QAC5B,OAAO,IAAI,CAAA;IACf,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,qBAAqB,CAAC,OAAsC;QACxD,+BAAA,IAAI,mEAAiC,OAAO,MAAA,CAAA;QAC5C,OAAO,IAAI,CAAA;IACf,CAAC;IAED,WAAW,CAAC,KAAoB;QAC5B,+BAAA,IAAI,+CAAa,KAAK,MAAA,CAAA;QACtB,OAAO,IAAI,CAAA;IACf,CAAC;IAED,cAAc,CAAC,KAAoB;QAC/B,+BAAA,IAAI,kDAAgB,KAAK,MAAA,CAAA;QACzB,OAAO,IAAI,CAAA;IACf,CAAC;IAED,aAAa,CAAC,KAAa;QACvB,MAAM,OAAO,GAAG,IAAA,sBAAM,EAAC,KAAK,CAAC,CAAA,CAAC,wDAAwD;QACtF,IAAI,OAAO;YACP,+BAAA,IAAI,iDAAe,OAAO,MAAA,CAAA;QAC9B,OAAO,IAAI,CAAA;IACf,CAAC;IAED,gBAAgB,CAAC,KAAa;QAC1B,MAAM,OAAO,GAAG,IAAA,sBAAM,EAAC,KAAK,CAAC,CAAA,CAAC,wDAAwD;QACtF,IAAI,OAAO;YACP,+BAAA,IAAI,oDAAkB,OAAO,MAAA,CAAA;QACjC,OAAO,IAAI,CAAA;IACf,CAAC;CACJ;AA7OD,8EA6OC;;AAED,qBAAqB"}