@ketvietlab/ketsuite 0.1.1

package/dist/modules/oauth/protocol.js

@@ -0,0 +1,309 @@
+import { constants, createHash, createPublicKey, timingSafeEqual, verify as verifySignature, } from 'node:crypto';
+export class OauthProtocolError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = 'OauthProtocolError';
+        this.code = code;
+    }
+}
+const MAX_DOCUMENT_BYTES = 1024 * 1024;
+const DEFAULT_TIMEOUT_MS = 10_000;
+const CLOCK_SKEW_SECONDS = 60;
+const SUPPORTED_ALGORITHMS = new Set(['RS256', 'PS256', 'ES256']);
+const fail = (code, message) => {
+    throw new OauthProtocolError(code, message);
+};
+const object = (value, code) => {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        fail(code, 'expected a JSON object');
+    return value;
+};
+const loopback = (hostname) => hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]' || hostname === '::1';
+/** OIDC endpoints are HTTPS, with loopback HTTP reserved for local development and deterministic tests. */
+export const safeOidcUrl = (value, field) => {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        return fail('oauth.error.endpointInvalid', `${field} is not an absolute URL`);
+    }
+    if (url.username || url.password || url.hash)
+        return fail('oauth.error.endpointInvalid', `${field} contains credentials or a fragment`);
+    if (url.protocol !== 'https:' && !(url.protocol === 'http:' && loopback(url.hostname)))
+        return fail('oauth.error.endpointInsecure', `${field} must use HTTPS outside loopback`);
+    return url;
+};
+const json = async (response, code) => {
+    const announced = Number(response.headers.get('content-length'));
+    if (Number.isFinite(announced) && announced > MAX_DOCUMENT_BYTES)
+        fail(code, 'remote JSON document is too large');
+    const reader = response.body?.getReader();
+    const chunks = [];
+    let total = 0;
+    if (reader) {
+        try {
+            while (true) {
+                const { done, value } = await reader.read();
+                if (done)
+                    break;
+                total += value.byteLength;
+                if (total > MAX_DOCUMENT_BYTES) {
+                    await reader.cancel();
+                    fail(code, 'remote JSON document is too large');
+                }
+                chunks.push(Buffer.from(value));
+            }
+        }
+        finally {
+            reader.releaseLock();
+        }
+    }
+    const body = Buffer.concat(chunks, total).toString('utf8');
+    try {
+        return object(JSON.parse(body), code);
+    }
+    catch (error) {
+        if (error instanceof OauthProtocolError)
+            throw error;
+        return fail(code, 'remote response is not valid JSON');
+    }
+};
+const fetched = async (url, init, code, fetcher) => {
+    const signal = AbortSignal.timeout(DEFAULT_TIMEOUT_MS);
+    let response;
+    try {
+        response = await fetcher(url, { ...init, redirect: 'error', signal });
+    }
+    catch {
+        return fail(code, 'the identity provider could not be reached');
+    }
+    if (!response.ok)
+        fail(code, `the identity provider returned HTTP ${response.status}`);
+    return response;
+};
+export async function discoverOidc(issuer, fetcher = fetch) {
+    const configured = safeOidcUrl(issuer.trim(), 'issuer');
+    if (configured.search)
+        fail('oauth.error.issuerInvalid', 'the issuer must not contain a query string');
+    const discoveryUrl = new URL(`${configured.toString().replace(/\/$/, '')}/.well-known/openid-configuration`);
+    const response = await fetched(discoveryUrl, { headers: { accept: 'application/json' } }, 'oauth.error.discoveryUnavailable', fetcher);
+    const document = await json(response, 'oauth.error.discoveryInvalid');
+    if (document.issuer !== issuer.trim())
+        fail('oauth.error.issuerMismatch', 'discovery returned a different issuer');
+    const authorizationEndpoint = safeOidcUrl(String(document.authorization_endpoint ?? ''), 'authorization_endpoint');
+    const tokenEndpoint = safeOidcUrl(String(document.token_endpoint ?? ''), 'token_endpoint');
+    const jwksUri = safeOidcUrl(String(document.jwks_uri ?? ''), 'jwks_uri');
+    return {
+        issuer: String(document.issuer),
+        authorizationEndpoint: authorizationEndpoint.toString(),
+        tokenEndpoint: tokenEndpoint.toString(),
+        jwksUri: jwksUri.toString(),
+    };
+}
+export const pkceChallenge = (verifier) => createHash('sha256').update(verifier).digest('base64url');
+export function oidcAuthorizationUrl(discovery, input) {
+    const endpoint = safeOidcUrl(discovery.authorizationEndpoint, 'authorization_endpoint');
+    endpoint.searchParams.set('response_type', 'code');
+    endpoint.searchParams.set('client_id', input.clientId);
+    endpoint.searchParams.set('redirect_uri', input.redirectUri);
+    endpoint.searchParams.set('scope', input.scope);
+    endpoint.searchParams.set('state', input.state);
+    endpoint.searchParams.set('nonce', input.nonce);
+    endpoint.searchParams.set('code_challenge', pkceChallenge(input.codeVerifier));
+    endpoint.searchParams.set('code_challenge_method', 'S256');
+    return endpoint.toString();
+}
+const basicPart = (value) => encodeURIComponent(value).replace(/%20/g, '+');
+export async function exchangeOidcCode(discovery, provider, input, fetcher = fetch) {
+    const endpoint = safeOidcUrl(discovery.tokenEndpoint, 'token_endpoint');
+    const form = new URLSearchParams({
+        grant_type: 'authorization_code',
+        code: input.code,
+        redirect_uri: input.redirectUri,
+        code_verifier: input.codeVerifier,
+    });
+    const headers = {
+        accept: 'application/json',
+        'content-type': 'application/x-www-form-urlencoded',
+    };
+    if (provider.clientAuthMethod === 'client_secret_basic') {
+        const secret = provider.clientSecret;
+        if (!secret)
+            fail('oauth.error.secretMissing', 'the configured client secret is unavailable');
+        headers.authorization = `Basic ${Buffer.from(`${basicPart(provider.clientId)}:${basicPart(secret)}`).toString('base64')}`;
+    }
+    else {
+        form.set('client_id', provider.clientId);
+        if (provider.clientAuthMethod === 'client_secret_post') {
+            const secret = provider.clientSecret;
+            if (!secret)
+                fail('oauth.error.secretMissing', 'the configured client secret is unavailable');
+            form.set('client_secret', secret);
+        }
+    }
+    const response = await fetched(endpoint, { method: 'POST', headers, body: form.toString() }, 'oauth.error.tokenExchange', fetcher);
+    const document = await json(response, 'oauth.error.tokenInvalid');
+    if (document.token_type !== undefined &&
+        (typeof document.token_type !== 'string' || document.token_type.toLowerCase() !== 'bearer'))
+        fail('oauth.error.tokenInvalid', 'the token response uses an unsupported token type');
+    const idToken = document.id_token;
+    if (typeof idToken !== 'string' || !idToken)
+        fail('oauth.error.idTokenMissing', 'the token response contains no ID token');
+    return { idToken: idToken };
+}
+const base64url = (value, code) => {
+    if (!/^[A-Za-z0-9_-]+$/.test(value) || value.length % 4 === 1)
+        fail(code, 'invalid base64url value');
+    const bytes = Buffer.from(value, 'base64url');
+    if (bytes.toString('base64url') !== value.replace(/=+$/, ''))
+        fail(code, 'non-canonical base64url value');
+    return bytes;
+};
+const segmentJson = (value, code) => {
+    try {
+        return object(JSON.parse(base64url(value, code).toString('utf8')), code);
+    }
+    catch (error) {
+        if (error instanceof OauthProtocolError)
+            throw error;
+        return fail(code, 'invalid JWT JSON');
+    }
+};
+const equalSecret = (left, right) => {
+    const a = createHash('sha256').update(left).digest();
+    const b = createHash('sha256').update(right).digest();
+    return timingSafeEqual(a, b);
+};
+const nonceMatches = (claim, input) => {
+    if (input.nonce !== undefined)
+        return equalSecret(claim, input.nonce);
+    if (!input.nonceDigest || !/^[a-f0-9]{64}$/.test(input.nonceDigest))
+        return false;
+    return equalSecret(createHash('sha256').update(claim).digest('hex'), input.nonceDigest);
+};
+const jwksCache = new Map();
+const cacheSeconds = (response) => {
+    const match = /(?:^|,)\s*max-age=(\d+)/i.exec(response.headers.get('cache-control') ?? '');
+    const value = match ? Number(match[1]) : 300;
+    return Math.max(30, Math.min(Number.isFinite(value) ? value : 300, 3600));
+};
+const loadJwks = async (uri, fetcher, force = false) => {
+    const endpoint = safeOidcUrl(uri, 'jwks_uri');
+    const held = jwksCache.get(endpoint.toString());
+    if (!force && held && held.expiresAt > Date.now())
+        return held.keys;
+    const response = await fetched(endpoint, { headers: { accept: 'application/json' } }, 'oauth.error.jwksUnavailable', fetcher);
+    const document = await json(response, 'oauth.error.jwksInvalid');
+    const documentKeys = document.keys;
+    if (!Array.isArray(documentKeys) || documentKeys.length > 64)
+        fail('oauth.error.jwksInvalid', 'JWKS must contain at most 64 keys');
+    const keys = documentKeys.map((key) => object(key, 'oauth.error.jwksInvalid'));
+    jwksCache.set(endpoint.toString(), { keys, expiresAt: Date.now() + cacheSeconds(response) * 1000 });
+    return keys;
+};
+const verifyJwtSignature = (algorithm, signingInput, signature, jwk) => {
+    let key;
+    try {
+        key = createPublicKey({ key: jwk, format: 'jwk' });
+    }
+    catch {
+        return fail('oauth.error.jwksInvalid', 'the selected JWK is invalid');
+    }
+    if (algorithm === 'RS256')
+        return verifySignature('RSA-SHA256', signingInput, key, signature);
+    if (algorithm === 'PS256')
+        return verifySignature('sha256', signingInput, { key, padding: constants.RSA_PKCS1_PSS_PADDING, saltLength: 32 }, signature);
+    if (algorithm === 'ES256')
+        return verifySignature('sha256', signingInput, { key, dsaEncoding: 'ieee-p1363' }, signature);
+    return false;
+};
+const audienceIncludes = (audience, clientId) => {
+    if (typeof audience === 'string')
+        return { matches: audience === clientId, multiple: false };
+    if (!Array.isArray(audience) || audience.some((item) => typeof item !== 'string'))
+        return { matches: false, multiple: false };
+    return { matches: audience.includes(clientId), multiple: audience.length > 1 };
+};
+export async function verifyOidcIdToken(token, discovery, provider, input, fetcher = fetch) {
+    if (token.length > 64 * 1024)
+        fail('oauth.error.idTokenInvalid', 'the ID token is too large');
+    const parts = token.split('.');
+    if (parts.length !== 3)
+        fail('oauth.error.idTokenInvalid', 'the ID token is not a signed JWT');
+    const header = segmentJson(parts[0], 'oauth.error.idTokenInvalid');
+    const claims = segmentJson(parts[1], 'oauth.error.idTokenInvalid');
+    if (header.b64 === false ||
+        (header.crit !== undefined && (!Array.isArray(header.crit) || header.crit.length > 0)))
+        fail('oauth.error.idTokenInvalid', 'the ID token uses unsupported critical headers');
+    const algorithm = String(header.alg ?? '');
+    const allowed = new Set(provider.allowedAlgorithms);
+    if (!SUPPORTED_ALGORITHMS.has(algorithm) || !allowed.has(algorithm))
+        fail('oauth.error.algorithmRejected', 'the ID token uses a disallowed signature algorithm');
+    if (typeof header.kid !== 'string' || !header.kid)
+        fail('oauth.error.idTokenInvalid', 'the ID token has no key id');
+    let keys = await loadJwks(discovery.jwksUri, fetcher);
+    let jwk = keys.find((key) => key.kid === header.kid && (!key.use || key.use === 'sig'));
+    if (!jwk) {
+        keys = await loadJwks(discovery.jwksUri, fetcher, true);
+        jwk = keys.find((key) => key.kid === header.kid && (!key.use || key.use === 'sig'));
+    }
+    if (!jwk)
+        fail('oauth.error.signingKeyMissing', 'the signing key is not present in JWKS');
+    const selected = jwk;
+    if (selected.alg && selected.alg !== algorithm)
+        fail('oauth.error.algorithmRejected', 'the JWK algorithm does not match the ID token');
+    if ((algorithm === 'ES256' && (selected.kty !== 'EC' || selected.crv !== 'P-256')) ||
+        ((algorithm === 'RS256' || algorithm === 'PS256') && selected.kty !== 'RSA'))
+        fail('oauth.error.algorithmRejected', 'the JWK type does not match the ID token algorithm');
+    if (selected.key_ops !== undefined &&
+        (!Array.isArray(selected.key_ops) || !selected.key_ops.includes('verify')))
+        fail('oauth.error.jwksInvalid', 'the selected JWK does not permit signature verification');
+    let verified = false;
+    try {
+        verified = verifyJwtSignature(algorithm, Buffer.from(`${parts[0]}.${parts[1]}`), base64url(parts[2], 'oauth.error.idTokenInvalid'), selected);
+    }
+    catch (error) {
+        if (error instanceof OauthProtocolError)
+            throw error;
+        fail('oauth.error.signatureInvalid', 'the ID token signature could not be verified');
+    }
+    if (!verified)
+        fail('oauth.error.signatureInvalid', 'the ID token signature is invalid');
+    if (claims.iss !== discovery.issuer)
+        fail('oauth.error.issuerMismatch', 'the ID token issuer does not match');
+    const audience = audienceIncludes(claims.aud, provider.clientId);
+    if (!audience.matches)
+        fail('oauth.error.audienceMismatch', 'the ID token audience does not match');
+    if ((audience.multiple || claims.azp !== undefined) && claims.azp !== provider.clientId)
+        fail('oauth.error.authorizedPartyMismatch', 'the ID token authorized party does not match');
+    if (typeof claims.sub !== 'string' ||
+        !claims.sub ||
+        Buffer.byteLength(claims.sub) > 255 ||
+        !/^[\x20-\x7e]+$/.test(claims.sub))
+        fail('oauth.error.subjectInvalid', 'the ID token subject is not a valid OIDC subject');
+    if (typeof claims.nonce !== 'string' || !nonceMatches(claims.nonce, input))
+        fail('oauth.error.nonceMismatch', 'the ID token nonce does not match');
+    const now = Math.floor((input.now ?? Date.now()) / 1000);
+    if (typeof claims.exp !== 'number' || !Number.isFinite(claims.exp) || claims.exp < now - CLOCK_SKEW_SECONDS)
+        fail('oauth.error.idTokenExpired', 'the ID token has expired');
+    if (typeof claims.iat !== 'number' || !Number.isFinite(claims.iat) || claims.iat > now + CLOCK_SKEW_SECONDS)
+        fail('oauth.error.idTokenTime', 'the ID token issue time is invalid');
+    if (claims.nbf !== undefined &&
+        (typeof claims.nbf !== 'number' || !Number.isFinite(claims.nbf) || claims.nbf > now + CLOCK_SKEW_SECONDS))
+        fail('oauth.error.idTokenTime', 'the ID token is not valid yet');
+    return {
+        issuer: String(claims.iss),
+        subject: String(claims.sub),
+        ...(typeof claims.email === 'string' ? { email: claims.email } : {}),
+        ...(typeof claims.email_verified === 'boolean' ? { emailVerified: claims.email_verified } : {}),
+        ...(typeof claims.name === 'string' ? { name: claims.name } : {}),
+        ...(typeof claims.preferred_username === 'string'
+            ? { preferredUsername: claims.preferred_username }
+            : {}),
+        claims,
+    };
+}
+export const clearOidcCachesForTest = () => jwksCache.clear();
+//# sourceMappingURL=protocol.js.map

package/dist/modules/oauth/protocol.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.js","sourceRoot":"","sources":["../../../../../../../packages/ketsuite/src/modules/oauth/protocol.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,UAAU,EACV,eAAe,EACf,eAAe,EACf,MAAM,IAAI,eAAe,GAC1B,MAAM,aAAa,CAAA;AA2BpB,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,IAAI,CAAQ;IAErB,YAAY,IAAY,EAAE,OAAe;QACvC,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAA;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;IAClB,CAAC;CACF;AAKD,MAAM,kBAAkB,GAAG,IAAI,GAAG,IAAI,CAAA;AACtC,MAAM,kBAAkB,GAAG,MAAM,CAAA;AACjC,MAAM,kBAAkB,GAAG,EAAE,CAAA;AAC7B,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAA;AAEjE,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,OAAe,EAAS,EAAE;IACpD,MAAM,IAAI,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;AAC7C,CAAC,CAAA;AAED,MAAM,MAAM,GAAG,CAAC,KAAc,EAAE,IAAY,EAAc,EAAE;IAC1D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAA;IACrG,OAAO,KAAmB,CAAA;AAC5B,CAAC,CAAA;AAED,MAAM,QAAQ,GAAG,CAAC,QAAgB,EAAW,EAAE,CAC7C,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,KAAK,CAAA;AAEpG,2GAA2G;AAC3G,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAa,EAAE,KAAa,EAAO,EAAE;IAC/D,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,6BAA6B,EAAE,GAAG,KAAK,yBAAyB,CAAC,CAAA;IAC/E,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI;QAC1C,OAAO,IAAI,CAAC,6BAA6B,EAAE,GAAG,KAAK,qCAAqC,CAAC,CAAA;IAC3F,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpF,OAAO,IAAI,CAAC,8BAA8B,EAAE,GAAG,KAAK,kCAAkC,CAAC,CAAA;IACzF,OAAO,GAAG,CAAA;AACZ,CAAC,CAAA;AAED,MAAM,IAAI,GAAG,KAAK,EAAE,QAAkB,EAAE,IAAY,EAAuB,EAAE;IAC3E,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAA;IAChE,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,kBAAkB;QAC9D,IAAI,CAAC,IAAI,EAAE,mCAAmC,CAAC,CAAA;IACjD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,CAAA;IACzC,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC;YACH,OAAO,IAAI,EAAE,CAAC;gBACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;gBAC3C,IAAI,IAAI;oBAAE,MAAK;gBACf,KAAK,IAAI,KAAK,CAAC,UAAU,CAAA;gBACzB,IAAI,KAAK,GAAG,kBAAkB,EAAE,CAAC;oBAC/B,MAAM,MAAM,CAAC,MAAM,EAAE,CAAA;oBACrB,IAAI,CAAC,IAAI,EAAE,mCAAmC,CAAC,CAAA;gBACjD,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;YACjC,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,WAAW,EAAE,CAAA;QACtB,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC1D,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAA;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,kBAAkB;YAAE,MAAM,KAAK,CAAA;QACpD,OAAO,IAAI,CAAC,IAAI,EAAE,mCAAmC,CAAC,CAAA;IACxD,CAAC;AACH,CAAC,CAAA;AAED,MAAM,OAAO,GAAG,KAAK,EAAE,GAAQ,EAAE,IAAiB,EAAE,IAAY,EAAE,OAAc,EAAqB,EAAE;IACrG,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAA;IACtD,IAAI,QAAkB,CAAA;IACtB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAA;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,IAAI,EAAE,4CAA4C,CAAC,CAAA;IACjE,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,IAAI,CAAC,IAAI,EAAE,uCAAuC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;IACtF,OAAO,QAAQ,CAAA;AACjB,CAAC,CAAA;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,OAAO,GAAU,KAAK;IACvE,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAA;IACvD,IAAI,UAAU,CAAC,MAAM;QAAE,IAAI,CAAC,2BAA2B,EAAE,4CAA4C,CAAC,CAAA;IACtG,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,GAAG,UAAU,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,mCAAmC,CAAC,CAAA;IAC5G,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B,YAAY,EACZ,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,EAC3C,kCAAkC,EAClC,OAAO,CACR,CAAA;IACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,8BAA8B,CAAC,CAAA;IACrE,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,EAAE;QACnC,IAAI,CAAC,4BAA4B,EAAE,uCAAuC,CAAC,CAAA;IAC7E,MAAM,qBAAqB,GAAG,WAAW,CACvC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,IAAI,EAAE,CAAC,EAC7C,wBAAwB,CACzB,CAAA;IACD,MAAM,aAAa,GAAG,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,IAAI,EAAE,CAAC,EAAE,gBAAgB,CAAC,CAAA;IAC1F,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,UAAU,CAAC,CAAA;IACxE,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC/B,qBAAqB,EAAE,qBAAqB,CAAC,QAAQ,EAAE;QACvD,aAAa,EAAE,aAAa,CAAC,QAAQ,EAAE;QACvC,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;KAC5B,CAAA;AACH,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,QAAgB,EAAU,EAAE,CACxD,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;AAE3D,MAAM,UAAU,oBAAoB,CAClC,SAAwB,EACxB,KAOC;IAED,MAAM,QAAQ,GAAG,WAAW,CAAC,SAAS,CAAC,qBAAqB,EAAE,wBAAwB,CAAC,CAAA;IACvF,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAA;IAClD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAA;IACtD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,WAAW,CAAC,CAAA;IAC5D,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;IAC/C,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;IAC/C,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;IAC/C,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,aAAa,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAA;IAC9E,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAA;IAC1D,OAAO,QAAQ,CAAC,QAAQ,EAAE,CAAA;AAC5B,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;AAE3F,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,SAAwB,EACxB,QAAsB,EACtB,KAAkE,EAClE,OAAO,GAAU,KAAK;IAEtB,MAAM,QAAQ,GAAG,WAAW,CAAC,SAAS,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAA;IACvE,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,oBAAoB;QAChC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,YAAY,EAAE,KAAK,CAAC,WAAW;QAC/B,aAAa,EAAE,KAAK,CAAC,YAAY;KAClC,CAAC,CAAA;IACF,MAAM,OAAO,GAA2B;QACtC,MAAM,EAAE,kBAAkB;QAC1B,cAAc,EAAE,mCAAmC;KACpD,CAAA;IACD,IAAI,QAAQ,CAAC,gBAAgB,KAAK,qBAAqB,EAAE,CAAC;QACxD,MAAM,MAAM,GAAG,QAAQ,CAAC,YAAY,CAAA;QACpC,IAAI,CAAC,MAAM;YAAE,IAAI,CAAC,2BAA2B,EAAE,6CAA6C,CAAC,CAAA;QAC7F,OAAO,CAAC,aAAa,GAAG,SAAS,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,MAAgB,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAA;IACrI,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAA;QACxC,IAAI,QAAQ,CAAC,gBAAgB,KAAK,oBAAoB,EAAE,CAAC;YACvD,MAAM,MAAM,GAAG,QAAQ,CAAC,YAAY,CAAA;YACpC,IAAI,CAAC,MAAM;gBAAE,IAAI,CAAC,2BAA2B,EAAE,6CAA6C,CAAC,CAAA;YAC7F,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,MAAgB,CAAC,CAAA;QAC7C,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B,QAAQ,EACR,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,EAClD,2BAA2B,EAC3B,OAAO,CACR,CAAA;IACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,0BAA0B,CAAC,CAAA;IACjE,IACE,QAAQ,CAAC,UAAU,KAAK,SAAS;QACjC,CAAC,OAAO,QAAQ,CAAC,UAAU,KAAK,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC;QAE3F,IAAI,CAAC,0BAA0B,EAAE,mDAAmD,CAAC,CAAA;IACvF,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAA;IACjC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO;QACzC,IAAI,CAAC,4BAA4B,EAAE,yCAAyC,CAAC,CAAA;IAC/E,OAAO,EAAE,OAAO,EAAE,OAAiB,EAAE,CAAA;AACvC,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,KAAa,EAAE,IAAY,EAAU,EAAE;IACxD,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAA;IACpG,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAA;IAC7C,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QAAE,IAAI,CAAC,IAAI,EAAE,+BAA+B,CAAC,CAAA;IACzG,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AAED,MAAM,WAAW,GAAG,CAAC,KAAa,EAAE,IAAY,EAAc,EAAE;IAC9D,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;IAC1E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,kBAAkB;YAAE,MAAM,KAAK,CAAA;QACpD,OAAO,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAA;IACvC,CAAC;AACH,CAAC,CAAA;AAED,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,KAAa,EAAW,EAAE;IAC3D,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAA;IACpD,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAA;IACrD,OAAO,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;AAC9B,CAAC,CAAA;AAED,MAAM,YAAY,GAAG,CAAC,KAAa,EAAE,KAA+C,EAAW,EAAE;IAC/F,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;IACrE,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;QAAE,OAAO,KAAK,CAAA;IACjF,OAAO,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,WAAW,CAAC,CAAA;AACzF,CAAC,CAAA;AAED,MAAM,SAAS,GAAG,IAAI,GAAG,EAAqD,CAAA;AAE9E,MAAM,YAAY,GAAG,CAAC,QAAkB,EAAU,EAAE;IAClD,MAAM,KAAK,GAAG,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAA;IAC1F,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;IAC5C,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAA;AAC3E,CAAC,CAAA;AAED,MAAM,QAAQ,GAAG,KAAK,EAAE,GAAW,EAAE,OAAc,EAAE,KAAK,GAAG,KAAK,EAAyB,EAAE;IAC3F,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;IAC7C,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAA;IAC/C,IAAI,CAAC,KAAK,IAAI,IAAI,IAAI,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC,IAAI,CAAA;IACnE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B,QAAQ,EACR,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,EAC3C,6BAA6B,EAC7B,OAAO,CACR,CAAA;IACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,yBAAyB,CAAC,CAAA;IAChE,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAA;IAClC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,MAAM,GAAG,EAAE;QAC1D,IAAI,CAAC,yBAAyB,EAAE,mCAAmC,CAAC,CAAA;IACtE,MAAM,IAAI,GAAI,YAA0B,CAAC,GAAG,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC,CAAA;IACtG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC,QAAQ,CAAC,GAAG,IAAI,EAAE,CAAC,CAAA;IACnG,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED,MAAM,kBAAkB,GAAG,CACzB,SAAiB,EACjB,YAAoB,EACpB,SAAiB,EACjB,GAAe,EACN,EAAE;IACX,IAAI,GAAuC,CAAA;IAC3C,IAAI,CAAC;QACH,GAAG,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,GAAY,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,yBAAyB,EAAE,6BAA6B,CAAC,CAAA;IACvE,CAAC;IACD,IAAI,SAAS,KAAK,OAAO;QAAE,OAAO,eAAe,CAAC,YAAY,EAAE,YAAY,EAAE,GAAG,EAAE,SAAS,CAAC,CAAA;IAC7F,IAAI,SAAS,KAAK,OAAO;QACvB,OAAO,eAAe,CACpB,QAAQ,EACR,YAAY,EACZ,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC,qBAAqB,EAAE,UAAU,EAAE,EAAE,EAAE,EACjE,SAAS,CACV,CAAA;IACH,IAAI,SAAS,KAAK,OAAO;QACvB,OAAO,eAAe,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE,SAAS,CAAC,CAAA;IAC/F,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AAED,MAAM,gBAAgB,GAAG,CAAC,QAAiB,EAAE,QAAgB,EAA2C,EAAE;IACxG,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,KAAK,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAA;IAC5F,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;QAC/E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAA;IAC5C,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAA;AAChF,CAAC,CAAA;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAa,EACb,SAAwB,EACxB,QAA8D,EAC9D,KAA6D,EAC7D,OAAO,GAAU,KAAK;IAEtB,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI;QAAE,IAAI,CAAC,4BAA4B,EAAE,2BAA2B,CAAC,CAAA;IAC7F,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,IAAI,CAAC,4BAA4B,EAAE,kCAAkC,CAAC,CAAA;IAC9F,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,4BAA4B,CAAC,CAAA;IACnE,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,4BAA4B,CAAC,CAAA;IACnE,IACE,MAAM,CAAC,GAAG,KAAK,KAAK;QACpB,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAEtF,IAAI,CAAC,4BAA4B,EAAE,gDAAgD,CAAC,CAAA;IACtF,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAA;IAC1C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAA;IACnD,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;QACjE,IAAI,CAAC,+BAA+B,EAAE,oDAAoD,CAAC,CAAA;IAC7F,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,GAAG;QAC/C,IAAI,CAAC,4BAA4B,EAAE,4BAA4B,CAAC,CAAA;IAElE,IAAI,IAAI,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IACrD,IAAI,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC,CAAA;IACvF,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,IAAI,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;QACvD,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC,CAAA;IACrF,CAAC;IACD,IAAI,CAAC,GAAG;QAAE,IAAI,CAAC,+BAA+B,EAAE,wCAAwC,CAAC,CAAA;IACzF,MAAM,QAAQ,GAAG,GAAiB,CAAA;IAClC,IAAI,QAAQ,CAAC,GAAG,IAAI,QAAQ,CAAC,GAAG,KAAK,SAAS;QAC5C,IAAI,CAAC,+BAA+B,EAAE,+CAA+C,CAAC,CAAA;IACxF,IACE,CAAC,SAAS,KAAK,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,KAAK,IAAI,IAAI,QAAQ,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC;QAC9E,CAAC,CAAC,SAAS,KAAK,OAAO,IAAI,SAAS,KAAK,OAAO,CAAC,IAAI,QAAQ,CAAC,GAAG,KAAK,KAAK,CAAC;QAE5E,IAAI,CAAC,+BAA+B,EAAE,oDAAoD,CAAC,CAAA;IAC7F,IACE,QAAQ,CAAC,OAAO,KAAK,SAAS;QAC9B,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAE1E,IAAI,CAAC,yBAAyB,EAAE,yDAAyD,CAAC,CAAA;IAC5F,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,IAAI,CAAC;QACH,QAAQ,GAAG,kBAAkB,CAC3B,SAAS,EACT,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EACtC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,4BAA4B,CAAC,EAClD,QAAQ,CACT,CAAA;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,kBAAkB;YAAE,MAAM,KAAK,CAAA;QACpD,IAAI,CAAC,8BAA8B,EAAE,8CAA8C,CAAC,CAAA;IACtF,CAAC;IACD,IAAI,CAAC,QAAQ;QAAE,IAAI,CAAC,8BAA8B,EAAE,mCAAmC,CAAC,CAAA;IAExF,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,MAAM;QACjC,IAAI,CAAC,4BAA4B,EAAE,oCAAoC,CAAC,CAAA;IAC1E,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAChE,IAAI,CAAC,QAAQ,CAAC,OAAO;QAAE,IAAI,CAAC,8BAA8B,EAAE,sCAAsC,CAAC,CAAA;IACnG,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,IAAI,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,QAAQ;QACrF,IAAI,CAAC,qCAAqC,EAAE,8CAA8C,CAAC,CAAA;IAC7F,IACE,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;QAC9B,CAAC,MAAM,CAAC,GAAG;QACX,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,GAAG;QACnC,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;QAElC,IAAI,CAAC,4BAA4B,EAAE,kDAAkD,CAAC,CAAA;IACxF,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC;QACxE,IAAI,CAAC,2BAA2B,EAAE,mCAAmC,CAAC,CAAA;IAExE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAA;IACxD,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,GAAG,GAAG,GAAG,kBAAkB;QACzG,IAAI,CAAC,4BAA4B,EAAE,0BAA0B,CAAC,CAAA;IAChE,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,GAAG,GAAG,GAAG,kBAAkB;QACzG,IAAI,CAAC,yBAAyB,EAAE,oCAAoC,CAAC,CAAA;IACvE,IACE,MAAM,CAAC,GAAG,KAAK,SAAS;QACxB,CAAC,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,GAAG,GAAG,GAAG,kBAAkB,CAAC;QAEzG,IAAI,CAAC,yBAAyB,EAAE,+BAA+B,CAAC,CAAA;IAElE,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;QAC1B,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;QAC3B,GAAG,CAAC,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,OAAO,MAAM,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/F,GAAG,CAAC,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,OAAO,MAAM,CAAC,kBAAkB,KAAK,QAAQ;YAC/C,CAAC,CAAC,EAAE,iBAAiB,EAAE,MAAM,CAAC,kBAAkB,EAAE;YAClD,CAAC,CAAC,EAAE,CAAC;QACP,MAAM;KACP,CAAA;AACH,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAS,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,CAAA"}

package/dist/modules/oauth/relations.d.ts

@@ -0,0 +1,3 @@
+import type { RelationDef } from '@ketvietlab/ketjs';
+export declare const relations: Record<string, Record<string, RelationDef>>;
+//# sourceMappingURL=relations.d.ts.map

package/dist/modules/oauth/relations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"relations.d.ts","sourceRoot":"","sources":["../../../../../../packages/ketsuite/src/modules/oauth/relations.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAEpD,eAAO,MAAM,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAgBjE,CAAA"}

package/dist/modules/oauth/relations.js

@@ -0,0 +1,18 @@
+export const relations = {
+    'oauth.Provider': {
+        identities: { hasMany: 'oauth.ExternalIdentity', by: 'providerId' },
+        transactions: { hasMany: 'oauth.Transaction', by: 'providerId' },
+    },
+    'oauth.ExternalIdentity': {
+        provider: { belongsTo: 'oauth.Provider', by: 'providerId' },
+        user: { belongsTo: 'user.User', by: 'userId' },
+    },
+    'oauth.Transaction': {
+        provider: { belongsTo: 'oauth.Provider', by: 'providerId' },
+        linkUser: { belongsTo: 'user.User', by: 'linkUserId' },
+    },
+    'user.User': {
+        externalIdentities: { hasMany: 'oauth.ExternalIdentity', by: 'userId' },
+    },
+};
+//# sourceMappingURL=relations.js.map

package/dist/modules/oauth/relations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"relations.js","sourceRoot":"","sources":["../../../../../../../packages/ketsuite/src/modules/oauth/relations.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,SAAS,GAAgD;IACpE,gBAAgB,EAAE;QAChB,UAAU,EAAE,EAAE,OAAO,EAAE,wBAAwB,EAAE,EAAE,EAAE,YAAY,EAAE;QACnE,YAAY,EAAE,EAAE,OAAO,EAAE,mBAAmB,EAAE,EAAE,EAAE,YAAY,EAAE;KACjE;IACD,wBAAwB,EAAE;QACxB,QAAQ,EAAE,EAAE,SAAS,EAAE,gBAAgB,EAAE,EAAE,EAAE,YAAY,EAAE;QAC3D,IAAI,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE;KAC/C;IACD,mBAAmB,EAAE;QACnB,QAAQ,EAAE,EAAE,SAAS,EAAE,gBAAgB,EAAE,EAAE,EAAE,YAAY,EAAE;QAC3D,QAAQ,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,EAAE,YAAY,EAAE;KACvD;IACD,WAAW,EAAE;QACX,kBAAkB,EAAE,EAAE,OAAO,EAAE,wBAAwB,EAAE,EAAE,EAAE,QAAQ,EAAE;KACxE;CACF,CAAA"}

package/dist/modules/oauth/routes.d.ts

@@ -0,0 +1,3 @@
+import type { RouteEntry } from '@ketvietlab/ketjs';
+export declare const routes: Record<string, RouteEntry>;
+//# sourceMappingURL=routes.d.ts.map

package/dist/modules/oauth/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../../../../../packages/ketsuite/src/modules/oauth/routes.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAS,UAAU,EAAgB,MAAM,mBAAmB,CAAA;AAkRxE,eAAO,MAAM,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAG7C,CAAA"}

package/dist/modules/oauth/routes.js

@@ -0,0 +1,185 @@
+import { createHash, timingSafeEqual } from 'node:crypto';
+import { json, parseCookies, text, withHeaders } from '@ketvietlab/ketjs';
+import { discoverOidc, exchangeOidcCode, oidcAuthorizationUrl, OauthProtocolError, verifyOidcIdToken, } from './protocol.js';
+const FLOW_COOKIE = 'ket_oauth_flow';
+const hash = (value) => createHash('sha256').update(value).digest();
+const sameSecret = (left, right) => timingSafeEqual(hash(left), hash(right));
+const decodedCookie = (value) => {
+    try {
+        return decodeURIComponent(value ?? '');
+    }
+    catch {
+        return '';
+    }
+};
+const wantsHtml = (req) => String(req.headers.accept ?? '').includes('text/html');
+const hasUnsafePathCharacter = (value) => value.includes('\\') ||
+    [...value].some((character) => {
+        const code = character.charCodeAt(0);
+        return code <= 0x1f || code === 0x7f;
+    });
+const safeReturnTo = (value) => {
+    if (!value?.startsWith('/') ||
+        value.startsWith('//') ||
+        hasUnsafePathCharacter(value) ||
+        /%5c/i.test(value))
+        return '/admin';
+    const parsed = new URL(value, 'http://ket.local');
+    return parsed.origin === 'http://ket.local' ? `${parsed.pathname}${parsed.search}${parsed.hash}` : '/admin';
+};
+const redirect = (to, cookie) => withHeaders(text('', { status: 303 }), { location: to, ...(cookie ? { 'set-cookie': cookie } : {}) });
+const failurePath = (url, code) => {
+    const target = new URL('/login', 'http://ket.local');
+    target.searchParams.set('oauth_error', code);
+    const lang = url.searchParams.get('lang');
+    if (lang)
+        target.searchParams.set('lang', lang);
+    return `${target.pathname}${target.search}`;
+};
+const firstError = (value, fallback) => value?.errors?.[0]?.code ?? fallback;
+const flowCookie = (provider, state) => [
+    `${FLOW_COOKIE}=${encodeURIComponent(`${provider.code}.${state}`)}`,
+    'Path=/auth/oauth',
+    'HttpOnly',
+    'SameSite=Lax',
+    ...(provider.redirectUri.startsWith('https://') ? ['Secure'] : []),
+    'Max-Age=600',
+].join('; ');
+const errorResponse = (url, req, code) => wantsHtml(req) ? redirect(failurePath(url, code)) : json({ ok: false, code }, { status: 401 });
+const recordFailure = async (ctx, url, req, provider, reason) => {
+    await ctx
+        .call('user.recordSecurityEvent', { event: 'oauth.login.failure', metadata: { provider, reason } }, url, req)
+        .catch(() => undefined);
+};
+const start = (ctx) => async (url, req, params) => {
+    if (req.method !== 'GET')
+        return text('GET', { status: 405 });
+    const provider = (await ctx.call('oauth.providerForLogin', { code: params.code }, url, req));
+    if (!provider)
+        return errorResponse(url, req, 'oauth.error.providerUnavailable');
+    const sessions = await ctx.sessionsOf(url, req);
+    if (!sessions)
+        return text('this deployment has not turned sessions on', { status: 501 });
+    const mode = url.searchParams.get('mode') === 'link' ? 'link' : 'login';
+    const current = await sessions.of(req);
+    if (mode === 'link' && !current)
+        return errorResponse(url, req, 'oauth.error.linkUnauthorized');
+    if (mode === 'login' && current)
+        return redirect(safeReturnTo(url.searchParams.get('next')));
+    try {
+        const discovery = await discoverOidc(provider.issuer);
+        const begun = (await ctx.call('oauth.beginTransaction', {
+            providerId: provider.id,
+            mode,
+            ...(current ? { linkUserId: current.userId } : {}),
+            returnTo: safeReturnTo(url.searchParams.get('next')),
+            discovery,
+        }, url, req));
+        if (!begun.ok || !begun.state || !begun.nonce || !begun.codeVerifier)
+            return errorResponse(url, req, firstError(begun, 'oauth.error.transactionInvalid'));
+        const location = oidcAuthorizationUrl(discovery, {
+            clientId: provider.clientId,
+            redirectUri: provider.redirectUri,
+            scope: provider.scopes,
+            state: begun.state,
+            nonce: begun.nonce,
+            codeVerifier: begun.codeVerifier,
+        });
+        return redirect(location, flowCookie(provider, begun.state));
+    }
+    catch (error) {
+        const code = error instanceof OauthProtocolError ? error.code : 'oauth.error.providerUnavailable';
+        await recordFailure(ctx, url, req, provider.code, code);
+        return errorResponse(url, req, code);
+    }
+};
+const callback = (ctx) => async (url, req, params) => {
+    if (req.method !== 'GET')
+        return text('GET', { status: 405 });
+    const provider = (await ctx.call('oauth.providerForLogin', { code: params.code }, url, req));
+    if (!provider)
+        return errorResponse(url, req, 'oauth.error.providerUnavailable');
+    const state = url.searchParams.get('state') ?? '';
+    const heldCookie = decodedCookie(parseCookies(req.headers.cookie)[FLOW_COOKIE]);
+    if (!state || !sameSecret(heldCookie, `${provider.code}.${state}`)) {
+        await recordFailure(ctx, url, req, provider.code, 'oauth.error.transactionInvalid');
+        return errorResponse(url, req, 'oauth.error.transactionInvalid');
+    }
+    const claimed = (await ctx.call('oauth.claimTransaction', { providerId: provider.id, state }, url, req));
+    if (!claimed.ok || !claimed.discovery || !claimed.codeVerifier || !claimed.nonceDigest) {
+        const code = firstError(claimed, 'oauth.error.transactionInvalid');
+        await recordFailure(ctx, url, req, provider.code, code);
+        return errorResponse(url, req, code);
+    }
+    const sessions = await ctx.sessionsOf(url, req);
+    if (!sessions)
+        return text('this deployment has not turned sessions on', { status: 501 });
+    if (claimed.mode === 'login' && (await sessions.of(req)))
+        return redirect(safeReturnTo(claimed.returnTo ?? null));
+    if (url.searchParams.has('error')) {
+        await recordFailure(ctx, url, req, provider.code, 'oauth.error.providerDenied');
+        return errorResponse(url, req, 'oauth.error.providerDenied');
+    }
+    const code = url.searchParams.get('code') ?? '';
+    if (!code || code.length > 8192)
+        return errorResponse(url, req, 'oauth.error.authorizationCode');
+    try {
+        const secret = provider.clientSecretEnv ? process.env[provider.clientSecretEnv] : null;
+        const exchanged = await exchangeOidcCode(claimed.discovery, {
+            issuer: provider.issuer,
+            clientId: provider.clientId,
+            clientAuthMethod: provider.clientAuthMethod,
+            clientSecret: secret,
+            allowedAlgorithms: provider.allowedAlgorithms.split(/\s+/).filter(Boolean),
+        }, {
+            code,
+            redirectUri: String(claimed.redirectUri),
+            codeVerifier: claimed.codeVerifier,
+        });
+        const identity = await verifyOidcIdToken(exchanged.idToken, claimed.discovery, {
+            clientId: provider.clientId,
+            allowedAlgorithms: provider.allowedAlgorithms.split(/\s+/).filter(Boolean),
+        }, { nonceDigest: claimed.nonceDigest });
+        const verdict = (await ctx.call('oauth.resolveLogin', {
+            providerId: provider.id,
+            providerUpdatedAt: claimed.providerUpdatedAt,
+            mode: claimed.mode,
+            ...(claimed.linkUserId ? { linkUserId: claimed.linkUserId } : {}),
+            issuer: identity.issuer,
+            subject: identity.subject,
+            ...(identity.email ? { email: identity.email } : {}),
+            ...(identity.emailVerified !== undefined ? { emailVerified: identity.emailVerified } : {}),
+            ...(identity.name ? { displayName: identity.name } : {}),
+            ...(identity.preferredUsername ? { preferredUsername: identity.preferredUsername } : {}),
+        }, url, req));
+        if (!verdict.ok || !verdict.userId) {
+            const reason = firstError(verdict, 'oauth.error.identityUnlinked');
+            await recordFailure(ctx, url, req, provider.code, reason);
+            return errorResponse(url, req, reason);
+        }
+        if (verdict.linked)
+            return redirect(safeReturnTo(claimed.returnTo ?? null));
+        const companies = verdict.companies ?? [];
+        if (!companies.length)
+            return errorResponse(url, req, 'oauth.error.userUnavailable');
+        const { cookie } = await sessions.start({
+            userId: verdict.userId,
+            companies,
+            company: verdict.defaultCompanyId ?? null,
+            branches: verdict.branches ?? [],
+            branch: verdict.defaultBranchId ?? null,
+            securityVersion: verdict.securityVersion ?? 0,
+        });
+        return redirect(safeReturnTo(claimed.returnTo ?? null), cookie);
+    }
+    catch (error) {
+        const reason = error instanceof OauthProtocolError ? error.code : 'oauth.error.loginFailed';
+        await recordFailure(ctx, url, req, provider.code, reason);
+        return errorResponse(url, req, reason);
+    }
+};
+export const routes = {
+    '/auth/oauth/{code}/start': { anonymous: true, handler: start },
+    '/auth/oauth/{code}/callback': { anonymous: true, handler: callback },
+};
+//# sourceMappingURL=routes.js.map

package/dist/modules/oauth/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../../../../../../packages/ketsuite/src/modules/oauth/routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AACzD,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAEzE,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,eAAe,CAAA;AAiDtB,MAAM,WAAW,GAAG,gBAAgB,CAAA;AACpC,MAAM,IAAI,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAA;AACnF,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,KAAa,EAAW,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;AACrG,MAAM,aAAa,GAAG,CAAC,KAAyB,EAAU,EAAE;IAC1D,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,KAAK,IAAI,EAAE,CAAC,CAAA;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC,CAAA;AACD,MAAM,SAAS,GAAG,CAAC,GAAQ,EAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AAC/F,MAAM,sBAAsB,GAAG,CAAC,KAAa,EAAW,EAAE,CACxD,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;IACpB,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE;QAC5B,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QACpC,OAAO,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,IAAI,CAAA;IACtC,CAAC,CAAC,CAAA;AACJ,MAAM,YAAY,GAAG,CAAC,KAAoB,EAAU,EAAE;IACpD,IACE,CAAC,KAAK,EAAE,UAAU,CAAC,GAAG,CAAC;QACvB,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QACtB,sBAAsB,CAAC,KAAK,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;QAElB,OAAO,QAAQ,CAAA;IACjB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAA;IACjD,OAAO,MAAM,CAAC,MAAM,KAAK,kBAAkB,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAA;AAC7G,CAAC,CAAA;AACD,MAAM,QAAQ,GAAG,CAAC,EAAU,EAAE,MAAe,EAAE,EAAE,CAC/C,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;AACvG,MAAM,WAAW,GAAG,CAAC,GAAQ,EAAE,IAAY,EAAU,EAAE;IACrD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAA;IACpD,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,CAAA;IAC5C,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACzC,IAAI,IAAI;QAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAC/C,OAAO,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,CAAA;AAC7C,CAAC,CAAA;AACD,MAAM,UAAU,GAAG,CAAC,KAAiD,EAAE,QAAgB,EAAU,EAAE,CACjG,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,QAAQ,CAAA;AACtC,MAAM,UAAU,GAAG,CAAC,QAAkB,EAAE,KAAa,EAAU,EAAE,CAC/D;IACE,GAAG,WAAW,IAAI,kBAAkB,CAAC,GAAG,QAAQ,CAAC,IAAI,IAAI,KAAK,EAAE,CAAC,EAAE;IACnE,kBAAkB;IAClB,UAAU;IACV,cAAc;IACd,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,aAAa;CACd,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAEd,MAAM,aAAa,GAAG,CAAC,GAAQ,EAAE,GAAQ,EAAE,IAAY,EAAE,EAAE,CACzD,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;AAEhG,MAAM,aAAa,GAAG,KAAK,EAAE,GAAiB,EAAE,GAAQ,EAAE,GAAQ,EAAE,QAAgB,EAAE,MAAc,EAAE,EAAE;IACtG,MAAM,GAAG;SACN,IAAI,CACH,0BAA0B,EAC1B,EAAE,KAAK,EAAE,qBAAqB,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAChE,GAAG,EACH,GAAG,CACJ;SACA,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;AAC3B,CAAC,CAAA;AAED,MAAM,KAAK,GACT,CAAC,GAAiB,EAAS,EAAE,CAC7B,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;IACzB,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAC7D,MAAM,QAAQ,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAC9B,wBAAwB,EACxB,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EACrB,GAAG,EACH,GAAG,CACJ,CAAoB,CAAA;IACrB,IAAI,CAAC,QAAQ;QAAE,OAAO,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,iCAAiC,CAAC,CAAA;IAChF,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAC/C,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC,4CAA4C,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IACzF,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAA;IACvE,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,GAAG,CAAC,CAAA;IACtC,IAAI,IAAI,KAAK,MAAM,IAAI,CAAC,OAAO;QAAE,OAAO,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,8BAA8B,CAAC,CAAA;IAC/F,IAAI,IAAI,KAAK,OAAO,IAAI,OAAO;QAAE,OAAO,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;IAC5F,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QACrD,MAAM,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAC3B,wBAAwB,EACxB;YACE,UAAU,EAAE,QAAQ,CAAC,EAAE;YACvB,IAAI;YACJ,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,QAAQ,EAAE,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACpD,SAAS;SACV,EACD,GAAG,EACH,GAAG,CACJ,CAAU,CAAA;QACX,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,YAAY;YAClE,OAAO,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,KAAK,EAAE,gCAAgC,CAAC,CAAC,CAAA;QACrF,MAAM,QAAQ,GAAG,oBAAoB,CAAC,SAAS,EAAE;YAC/C,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,KAAK,EAAE,QAAQ,CAAC,MAAM;YACtB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAA;QACF,OAAO,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAA;IAC9D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,KAAK,YAAY,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,iCAAiC,CAAA;QACjG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QACvD,OAAO,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;IACtC,CAAC;AACH,CAAC,CAAA;AAEH,MAAM,QAAQ,GACZ,CAAC,GAAiB,EAAS,EAAE,CAC7B,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;IACzB,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAC7D,MAAM,QAAQ,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAC9B,wBAAwB,EACxB,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EACrB,GAAG,EACH,GAAG,CACJ,CAAoB,CAAA;IACrB,IAAI,CAAC,QAAQ;QAAE,OAAO,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,iCAAiC,CAAC,CAAA;IAChF,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAA;IACjD,MAAM,UAAU,GAAG,aAAa,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,MAA4B,CAAC,CAAC,WAAW,CAAC,CAAC,CAAA;IACrG,IAAI,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,KAAK,EAAE,CAAC,EAAE,CAAC;QACnE,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,IAAI,EAAE,gCAAgC,CAAC,CAAA;QACnF,OAAO,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,gCAAgC,CAAC,CAAA;IAClE,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAC7B,wBAAwB,EACxB,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,EAClC,GAAG,EACH,GAAG,CACJ,CAAY,CAAA;IACb,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACvF,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,EAAE,gCAAgC,CAAC,CAAA;QAClE,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QACvD,OAAO,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;IACtC,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAC/C,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC,4CAA4C,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IACzF,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,MAAM,QAAQ,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;QACtD,OAAO,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAA;IACzD,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,IAAI,EAAE,4BAA4B,CAAC,CAAA;QAC/E,OAAO,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,4BAA4B,CAAC,CAAA;IAC9D,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAA;IAC/C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI;QAAE,OAAO,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,+BAA+B,CAAC,CAAA;IAEhG,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QACtF,MAAM,SAAS,GAAG,MAAM,gBAAgB,CACtC,OAAO,CAAC,SAAS,EACjB;YACE,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;YAC3C,YAAY,EAAE,MAAM;YACpB,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;SAC3E,EACD;YACE,IAAI;YACJ,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;YACxC,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC,CACF,CAAA;QACD,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CACtC,SAAS,CAAC,OAAO,EACjB,OAAO,CAAC,SAAS,EACjB;YACE,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;SAC3E,EACD,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CACrC,CAAA;QACD,MAAM,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAC7B,oBAAoB,EACpB;YACE,UAAU,EAAE,QAAQ,CAAC,EAAE;YACvB,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;YAC5C,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,GAAG,CAAC,QAAQ,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1F,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzF,EACD,GAAG,EACH,GAAG,CACJ,CAAY,CAAA;QACb,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,EAAE,8BAA8B,CAAC,CAAA;YAClE,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;YACzD,OAAO,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAA;QACxC,CAAC;QACD,IAAI,OAAO,CAAC,MAAM;YAAE,OAAO,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAA;QAC3E,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,CAAA;QACzC,IAAI,CAAC,SAAS,CAAC,MAAM;YAAE,OAAO,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,6BAA6B,CAAC,CAAA;QACpF,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC;YACtC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,SAAS;YACT,OAAO,EAAE,OAAO,CAAC,gBAAgB,IAAI,IAAI;YACzC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE;YAChC,MAAM,EAAE,OAAO,CAAC,eAAe,IAAI,IAAI;YACvC,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,CAAC;SAC9C,CAAC,CAAA;QACF,OAAO,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,EAAE,MAAM,CAAC,CAAA;IACjE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,KAAK,YAAY,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,yBAAyB,CAAA;QAC3F,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACzD,OAAO,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAA;IACxC,CAAC;AACH,CAAC,CAAA;AAEH,MAAM,CAAC,MAAM,MAAM,GAA+B;IAChD,0BAA0B,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE;IAC/D,6BAA6B,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE;CACtE,CAAA"}

package/dist/modules/oauth_backend/index.d.ts

@@ -0,0 +1,4 @@
+declare const _default: import("@ketvietlab/ketjs").KetModule;
+export default _default;
+export { identitiesScreen, identityFormScreen, providerFormScreen, providersScreen } from './screens.tsx';
+//# sourceMappingURL=index.d.ts.map

package/dist/modules/oauth_backend/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../packages/ketsuite/src/modules/oauth_backend/index.ts"],"names":[],"mappings":";;AAuBA,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA"}

package/dist/modules/oauth_backend/index.js

@@ -0,0 +1,23 @@
+import { defineModule } from '@ketvietlab/ketjs';
+import { menus } from './menus.js';
+import { messages } from './messages.js';
+import { routes } from './routes.js';
+export default defineModule({
+    name: 'oauth_backend',
+    version: '0.1.0',
+    depends: ['oauth', 'backend', 'user_backend'],
+    install: 'auto',
+    app: true,
+    title: 'OAuth trong quản trị',
+    summary: 'Cấu hình đăng nhập OIDC và quản lý danh tính đã liên kết.',
+    category: 'Hệ thống',
+    routes,
+    menus,
+    messages,
+    fills: {
+        'user_backend:user.external-identities': `<a data-ui="app-action" href="/admin/oauth/identities?user={{ userId }}">{{ 'oauth_backend.action.viewIdentities' | _ }}</a>`,
+        'user_backend:profile.external-identities': `<a data-ui="app-action" href="/admin/oauth/link">{{ 'oauth_backend.link.action' | _ }}</a>`,
+    },
+});
+export { identitiesScreen, identityFormScreen, providerFormScreen, providersScreen } from './screens.js';
+//# sourceMappingURL=index.js.map

package/dist/modules/oauth_backend/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../packages/ketsuite/src/modules/oauth_backend/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEpC,eAAe,YAAY,CAAC;IAC1B,IAAI,EAAE,eAAe;IACrB,OAAO,EAAE,OAAO;IAChB,OAAO,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,cAAc,CAAC;IAC7C,OAAO,EAAE,MAAM;IACf,GAAG,EAAE,IAAI;IACT,KAAK,EAAE,sBAAsB;IAC7B,OAAO,EAAE,2DAA2D;IACpE,QAAQ,EAAE,UAAU;IACpB,MAAM;IACN,KAAK;IACL,QAAQ;IACR,KAAK,EAAE;QACL,uCAAuC,EAAE,8HAA8H;QACvK,0CAA0C,EAAE,4FAA4F;KACzI;CACF,CAAC,CAAA;AAEF,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,cAAe,CAAA"}

package/dist/modules/oauth_backend/menus.d.ts

@@ -0,0 +1,3 @@
+import type { MenuDef } from '@ketvietlab/ketjs';
+export declare const menus: Record<string, MenuDef>;
+//# sourceMappingURL=menus.d.ts.map

package/dist/modules/oauth_backend/menus.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"menus.d.ts","sourceRoot":"","sources":["../../../../../../packages/ketsuite/src/modules/oauth_backend/menus.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAEhD,eAAO,MAAM,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAezC,CAAA"}