@knpkv/codecommit-web 0.11.4 → 0.14.0

package/dist/server/internal/OwnerSessionSecurity.js

@@ -0,0 +1,143 @@
+import { Clock, Context, Crypto, Effect, Layer, Redacted, Ref, Schema } from "effect";
+import { HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/unstable/http";
+import { ForbiddenApiError, OwnerSessionAuth, UnauthorizedApiError } from "../Api.js";
+export class OwnerSessionSecrets extends Context.Service()("@knpkv/codecommit-web/OwnerSessionSecrets") {
+}
+export class UnsafeServerHostnameError extends Schema.TaggedError()("UnsafeServerHostnameError", { hostname: Schema.String, message: Schema.String }) {
+}
+const safeMethods = new Set(["GET", "HEAD", "OPTIONS"]);
+export const isLoopbackHostname = (hostname) => hostname === "127.0.0.1" || hostname === "localhost" || hostname === "::1" || hostname === "[::1]";
+export const requireLoopbackHostname = Effect.fn("OwnerSessionSecurity.requireLoopbackHostname")(function* (hostname) {
+    if (!isLoopbackHostname(hostname)) {
+        return yield* new UnsafeServerHostnameError({
+            hostname,
+            message: "CodeCommit web may only listen on a loopback hostname"
+        });
+    }
+    return hostname;
+});
+export const makeOwnerSessionSecrets = Effect.fn("OwnerSessionSecurity.makeSecrets")(function* () {
+    const cryptoService = yield* Crypto.Crypto;
+    const [ownerToken, csrfToken, bootstrapToken] = yield* Effect.all([
+        cryptoService.randomUUIDv4,
+        cryptoService.randomUUIDv4,
+        cryptoService.randomUUIDv4
+    ]);
+    const bootstrapAvailable = yield* Ref.make(true);
+    return OwnerSessionSecrets.of({
+        ownerToken: Redacted.make(ownerToken),
+        csrfToken: Redacted.make(csrfToken),
+        bootstrapToken: Redacted.make(bootstrapToken),
+        bootstrapAvailable,
+        bootstrapExpiresAtMillis: yield* Ref.make(undefined)
+    });
+});
+export const activateOwnerSessionBootstrap = Effect.fn("OwnerSessionSecurity.activateBootstrap")(function* (secrets) {
+    const now = yield* Clock.currentTimeMillis;
+    yield* Ref.set(secrets.bootstrapExpiresAtMillis, now + 60_000);
+});
+export const ownerSessionOrigin = (hostname, port) => {
+    const urlHostname = hostname === "::1" ? "[::1]" : hostname;
+    return `http://${urlHostname}:${port}/`;
+};
+export const ownerSessionUrl = (hostname, port, secrets) => ownerSessionUrlForOrigin(ownerSessionOrigin(hostname, port), secrets);
+export const ownerSessionUrlForOrigin = (origin, secrets) => {
+    const bootstrapToken = encodeURIComponent(Redacted.value(secrets.bootstrapToken));
+    return `${origin.replace(/\/+$/u, "")}/#bootstrap_token=${bootstrapToken}`;
+};
+export const requireLoopbackOrigin = Effect.fn("OwnerSessionSecurity.requireLoopbackOrigin")(function* (origin) {
+    const url = yield* Effect.try({
+        try: () => new URL(origin),
+        catch: () => new UnsafeServerHostnameError({
+            hostname: origin,
+            message: "CodeCommit public origin must be a valid loopback HTTP origin"
+        })
+    });
+    if (url.protocol !== "http:" || !isLoopbackHostname(url.hostname) || url.pathname !== "/" || url.search || url.hash) {
+        return yield* new UnsafeServerHostnameError({
+            hostname: origin,
+            message: "CodeCommit public origin must be an HTTP loopback origin without a path, query, or fragment"
+        });
+    }
+    return url.origin;
+});
+export const ownerSessionCookie = (secrets) => `cc_owner=${Redacted.value(secrets.ownerToken)}; HttpOnly; Path=/api; SameSite=Strict`;
+export const authorizeOwnerRequest = Effect.fn("OwnerSessionSecurity.authorizeRequest")(function* (request, secrets) {
+    if (request.credential !== Redacted.value(secrets.ownerToken)) {
+        return yield* new UnauthorizedApiError({ message: "Missing or invalid owner session" });
+    }
+    const sameOrigin = request.host !== undefined && request.origin === `http://${request.host}`;
+    if (request.origin !== undefined && !sameOrigin) {
+        return yield* new ForbiddenApiError({ message: "Request origin does not match the CodeCommit server" });
+    }
+    // Safe reads intentionally allow non-browser callers without Origin or CSRF
+    // headers; every read still requires the process-scoped owner credential.
+    if (safeMethods.has(request.method.toUpperCase()))
+        return;
+    if (!sameOrigin) {
+        return yield* new ForbiddenApiError({ message: "Mutation origin does not match the CodeCommit server" });
+    }
+    if (request.csrfToken !== Redacted.value(secrets.csrfToken)) {
+        return yield* new ForbiddenApiError({ message: "Missing or invalid CSRF token" });
+    }
+});
+export const authorizeBootstrapRequest = Effect.fn("OwnerSessionSecurity.authorizeBootstrap")(function* (request, secrets) {
+    if (request.authorization !== `Bearer ${Redacted.value(secrets.bootstrapToken)}`) {
+        return yield* new UnauthorizedApiError({ message: "Missing or invalid bootstrap token" });
+    }
+    if (request.host === undefined || request.origin !== `http://${request.host}`) {
+        return yield* new ForbiddenApiError({ message: "Bootstrap origin does not match the CodeCommit server" });
+    }
+    const expiresAt = yield* Ref.get(secrets.bootstrapExpiresAtMillis);
+    if (expiresAt === undefined) {
+        return yield* new UnauthorizedApiError({ message: "Bootstrap token is not active" });
+    }
+    const now = yield* Clock.currentTimeMillis;
+    if (now >= expiresAt) {
+        return yield* new UnauthorizedApiError({ message: "Bootstrap token has expired" });
+    }
+    const available = yield* Ref.getAndSet(secrets.bootstrapAvailable, false);
+    if (!available) {
+        return yield* new UnauthorizedApiError({ message: "Bootstrap token has already been used" });
+    }
+});
+export const ownerSessionAuthLayer = Layer.effect(OwnerSessionAuth, Effect.gen(function* () {
+    const secrets = yield* OwnerSessionSecrets;
+    return OwnerSessionAuth.of({
+        ownerCookie: Effect.fn("OwnerSessionSecurity.ownerCookie")(function* (httpEffect, { credential }) {
+            const request = yield* HttpServerRequest.HttpServerRequest;
+            yield* authorizeOwnerRequest({
+                credential: Redacted.value(credential),
+                csrfToken: request.headers["x-csrf-token"],
+                host: request.headers.host,
+                method: request.method,
+                origin: request.headers.origin
+            }, secrets);
+            return yield* httpEffect;
+        })
+    });
+}));
+export const OwnerSessionBootstrapRouter = HttpRouter.use((router) => router.add("POST", "/auth/bootstrap", Effect.gen(function* () {
+    const secrets = yield* OwnerSessionSecrets;
+    const request = yield* HttpServerRequest.HttpServerRequest;
+    const authorization = authorizeBootstrapRequest({
+        authorization: request.headers.authorization,
+        host: request.headers.host,
+        origin: request.headers.origin
+    }, secrets);
+    const result = yield* Effect.result(authorization);
+    if (result._tag === "Failure") {
+        const error = result.failure;
+        return HttpServerResponse.text(error.message, {
+            status: error._tag === "UnauthorizedApiError" ? 401 : 403
+        });
+    }
+    return yield* HttpServerResponse.json({ csrfToken: Redacted.value(secrets.csrfToken) }, {
+        status: 200,
+        headers: {
+            "cache-control": "no-store",
+            "set-cookie": ownerSessionCookie(secrets)
+        }
+    });
+})));
+//# sourceMappingURL=OwnerSessionSecurity.js.map

package/dist/server/internal/OwnerSessionSecurity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OwnerSessionSecurity.js","sourceRoot":"","sources":["../../../src/server/internal/OwnerSessionSecurity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AACrF,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AACxF,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAA;AAUrF,MAAM,OAAO,mBAAoB,SAAQ,OAAO,CAAC,OAAO,EAGrD,CAAC,2CAA2C,CAAC;CAAG;AAEnD,MAAM,OAAO,yBAA0B,SAAQ,MAAM,CAAC,WAAW,EAA6B,CAC5F,2BAA2B,EAC3B,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,CACpD;CAAG;AAEJ,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAA;AAEvD,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,QAAgB,EAAW,EAAE,CAC9D,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,KAAK,IAAI,QAAQ,KAAK,OAAO,CAAA;AAEpG,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC,EAAE,CAAC,8CAA8C,CAAC,CAC9F,QAAQ,CAAC,EAAC,QAAgB;IACxB,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,OAAO,KAAK,CAAC,CAAC,IAAI,yBAAyB,CAAC;YAC1C,QAAQ;YACR,OAAO,EAAE,uDAAuD;SACjE,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC,CACF,CAAA;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC,EAAE,CAAC,kCAAkC,CAAC,CAAC,QAAQ,CAAC;IAC5F,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAA;IAC1C,MAAM,CAAC,UAAU,EAAE,SAAS,EAAE,cAAc,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QAChE,aAAa,CAAC,YAAY;QAC1B,aAAa,CAAC,YAAY;QAC1B,aAAa,CAAC,YAAY;KAC3B,CAAC,CAAA;IACF,MAAM,kBAAkB,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAChD,OAAO,mBAAmB,CAAC,EAAE,CAAC;QAC5B,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC;QACrC,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;QACnC,cAAc,EAAE,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC;QAC7C,kBAAkB;QAClB,wBAAwB,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAqB,SAAS,CAAC;KACzE,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,6BAA6B,GAAG,MAAM,CAAC,EAAE,CAAC,wCAAwC,CAAC,CAC9F,QAAQ,CAAC,EAAC,OAAoC;IAC5C,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAA;IAC1C,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,wBAAwB,EAAE,GAAG,GAAG,MAAM,CAAC,CAAA;AAChE,CAAC,CACF,CAAA;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,QAAgB,EAAE,IAAY,EAAU,EAAE;IAC3E,MAAM,WAAW,GAAG,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAA;IAC3D,OAAO,UAAU,WAAW,IAAI,IAAI,GAAG,CAAA;AACzC,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,QAAgB,EAChB,IAAY,EACZ,OAAoC,EAC5B,EAAE,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAA;AAElF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CACtC,MAAc,EACd,OAA4D,EACpD,EAAE;IACV,MAAM,cAAc,GAAG,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAA;IACjF,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,qBAAqB,cAAc,EAAE,CAAA;AAC5E,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,EAAE,CAAC,4CAA4C,CAAC,CAC1F,QAAQ,CAAC,EAAC,MAAc;IACtB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QAC5B,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC;QAC1B,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,yBAAyB,CAAC;YAC5B,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,+DAA+D;SACzE,CAAC;KACL,CAAC,CAAA;IACF,IACE,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAC/G,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,IAAI,yBAAyB,CAAC;YAC1C,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,6FAA6F;SACvG,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAA;AACnB,CAAC,CACF,CAAA;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,OAAwD,EAChD,EAAE,CAAC,YAAY,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,wCAAwC,CAAA;AAUnG,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,EAAE,CAAC,uCAAuC,CAAC,CACrF,QAAQ,CAAC,EAAC,OAAkC,EAAE,OAAoC;IAChF,IAAI,OAAO,CAAC,UAAU,KAAK,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9D,OAAO,KAAK,CAAC,CAAC,IAAI,oBAAoB,CAAC,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC,CAAA;IACzF,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,OAAO,CAAC,IAAI,EAAE,CAAA;IAC5F,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,UAAU,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC,CAAC,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,qDAAqD,EAAE,CAAC,CAAA;IACzG,CAAC;IACD,4EAA4E;IAC5E,0EAA0E;IAC1E,IAAI,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAAE,OAAM;IACzD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,KAAK,CAAC,CAAC,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,sDAAsD,EAAE,CAAC,CAAA;IAC1G,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5D,OAAO,KAAK,CAAC,CAAC,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC,CAAA;IACnF,CAAC;AACH,CAAC,CACF,CAAA;AAQD,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC,EAAE,CAAC,yCAAyC,CAAC,CAC3F,QAAQ,CAAC,EAAC,OAA+B,EAAE,OAAoC;IAC7E,IAAI,OAAO,CAAC,aAAa,KAAK,UAAU,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC;QACjF,OAAO,KAAK,CAAC,CAAC,IAAI,oBAAoB,CAAC,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC,CAAA;IAC3F,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9E,OAAO,KAAK,CAAC,CAAC,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,uDAAuD,EAAE,CAAC,CAAA;IAC3G,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAA;IAClE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC,CAAC,IAAI,oBAAoB,CAAC,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC,CAAA;IACtF,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAA;IAC1C,IAAI,GAAG,IAAI,SAAS,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC,CAAC,IAAI,oBAAoB,CAAC,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC,CAAA;IACpF,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAA;IACzE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,KAAK,CAAC,CAAC,IAAI,oBAAoB,CAAC,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,CAAA;IAC9F,CAAC;AACH,CAAC,CACF,CAAA;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,CAAC,MAAM,CAC/C,gBAAgB,EAChB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAA;IAC1C,OAAO,gBAAgB,CAAC,EAAE,CAAC;QACzB,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC,kCAAkC,CAAC,CACxD,QAAQ,CAAC,EAAC,UAAU,EAAE,EAAE,UAAU,EAAE;YAClC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,iBAAiB,CAAA;YAC1D,KAAK,CAAC,CAAC,qBAAqB,CAC1B;gBACE,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC;gBACtC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC;gBAC1C,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI;gBAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM;aAC/B,EACD,OAAO,CACR,CAAA;YACD,OAAO,KAAK,CAAC,CAAC,UAAU,CAAA;QAC1B,CAAC,CACF;KACF,CAAC,CAAA;AACJ,CAAC,CAAC,CACH,CAAA;AAED,MAAM,CAAC,MAAM,2BAA2B,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACnE,MAAM,CAAC,GAAG,CACR,MAAM,EACN,iBAAiB,EACjB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAA;IAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,iBAAiB,CAAA;IAC1D,MAAM,aAAa,GAAG,yBAAyB,CAC7C;QACE,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,aAAa;QAC5C,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI;QAC1B,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM;KAC/B,EACD,OAAO,CACR,CAAA;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAA;IAClD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAA;QAC5B,OAAO,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE;YAC5C,MAAM,EAAE,KAAK,CAAC,IAAI,KAAK,sBAAsB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;SAC1D,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE;QACtF,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,eAAe,EAAE,UAAU;YAC3B,YAAY,EAAE,kBAAkB,CAAC,OAAO,CAAC;SAC1C;KACF,CAAC,CAAA;AACJ,CAAC,CAAC,CACH,CACF,CAAA"}

package/dist/server/internal/PermissionedReadClient.d.ts

@@ -0,0 +1,27 @@
+import { AuditLogRepo } from "@knpkv/codecommit-core/PermissionService/AuditLog.js";
+import { PermissionService } from "@knpkv/codecommit-core/PermissionService/index.js";
+import { PermissionGate } from "@knpkv/codecommit-core/PermissionService/PermissionGate.js";
+import * as ReadClient from "@knpkv/codecommit-core/ReadClient.js";
+import { Context, Effect, Stream } from "effect";
+declare const InnerCodeCommitReadClient_base: Context.ServiceClass<InnerCodeCommitReadClient, "@knpkv/codecommit-web/InnerCodeCommitReadClient", ReadClient.CodeCommitReadClientService>;
+/** Holds the decoded provider client before permission enforcement. */
+export declare class InnerCodeCommitReadClient extends InnerCodeCommitReadClient_base {
+}
+/** Construct a read client that checks permission and audits before every provider call. */
+export declare const makePermissionedReadClient: (inner: ReadClient.CodeCommitReadClientService) => Effect.Effect<{
+    discoverAccount: (request: {
+        readonly profile: string & import("effect/Brand").Brand<"AwsProfileName">;
+        readonly region: string & import("effect/Brand").Brand<"AwsRegion">;
+    }) => Effect.Effect<ReadClient.CodeCommitAccountIdentity, ReadClient.CodeCommitReadError, never>;
+    listRepositoriesPage: (request: ReadClient.ListRepositoriesProviderPageRequest) => Effect.Effect<ReadClient.CodeCommitRepositoryPage, ReadClient.CodeCommitReadError, never>;
+    getBlob: (request: ReadClient.GetBlobProviderRequest) => Effect.Effect<ReadClient.CodeCommitBlobContent, ReadClient.CodeCommitReadError, never>;
+    listPullRequestIdsPage: (request: Omit<ReadClient.ListPullRequestsProviderPageRequest, "maximumResults">) => Effect.Effect<ReadClient.CodeCommitPullRequestIdsPage, ReadClient.CodeCommitReadError, never>;
+    listPullRequestsPage: (request: Omit<ReadClient.ListPullRequestsProviderPageRequest, "maximumResults">) => Effect.Effect<ReadClient.CodeCommitPullRequestPage, ReadClient.CodeCommitReadError>;
+    streamPullRequests: (request: Omit<ReadClient.ListPullRequestsProviderPageRequest, "maximumResults" | "nextToken">) => Stream.Stream<ReadClient.CodeCommitPullRequestRevision, ReadClient.CodeCommitReadError>;
+    getPullRequest: (request: ReadClient.GetPullRequestProviderRequest) => Effect.Effect<ReadClient.CodeCommitPullRequestRevision, ReadClient.CodeCommitReadError, never>;
+    getRepositoryIdentity: (request: ReadClient.GetRepositoryProviderRequest) => Effect.Effect<ReadClient.CodeCommitRepositoryIdentity, ReadClient.CodeCommitReadError, never>;
+    getChangedFilesPage: (request: Omit<ReadClient.GetDifferencesProviderPageRequest, "maximumResults">) => Effect.Effect<ReadClient.CodeCommitChangedFilesPage, ReadClient.CodeCommitReadError, never>;
+    streamChangedFiles: (request: Omit<ReadClient.GetDifferencesProviderPageRequest, "maximumResults" | "nextToken">) => Stream.Stream<ReadClient.CodeCommitChangedFile, ReadClient.CodeCommitReadError>;
+}, never, AuditLogRepo | PermissionGate | PermissionService>;
+export {};
+//# sourceMappingURL=PermissionedReadClient.d.ts.map

package/dist/server/internal/PermissionedReadClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermissionedReadClient.d.ts","sourceRoot":"","sources":["../../../src/server/internal/PermissionedReadClient.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAyB,MAAM,sDAAsD,CAAA;AAC1G,OAAO,EAAE,iBAAiB,EAAE,MAAM,mDAAmD,CAAA;AAErF,OAAO,EAAE,cAAc,EAAE,MAAM,4DAA4D,CAAA;AAC3F,OAAO,KAAK,UAAU,MAAM,sCAAsC,CAAA;AAClE,OAAO,EAAS,OAAO,EAAE,MAAM,EAAkB,MAAM,EAAE,MAAM,QAAQ,CAAA;;AAiBvE,uEAAuE;AACvE,qBAAa,yBAA0B,SAAQ,8BAGO;CAAG;AAUzD,4FAA4F;AAC5F,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;4DAsMrC,CAAA"}

package/dist/server/internal/PermissionedReadClient.js

@@ -0,0 +1,132 @@
+/** Permission and audit boundary for Schema-decoded CodeCommit provider reads. @module */
+import { AwsApiError, PermissionDeniedError } from "@knpkv/codecommit-core/Errors.js";
+import { AuditLogRepo } from "@knpkv/codecommit-core/PermissionService/AuditLog.js";
+import { PermissionService } from "@knpkv/codecommit-core/PermissionService/index.js";
+import { getOperationMeta } from "@knpkv/codecommit-core/PermissionService/operations.js";
+import { PermissionGate } from "@knpkv/codecommit-core/PermissionService/PermissionGate.js";
+import * as ReadClient from "@knpkv/codecommit-core/ReadClient.js";
+import { Clock, Context, Effect, Option, Random, Stream } from "effect";
+const MAXIMUM_CHANGED_FILE_PAGE_REQUESTS = 1_001;
+/** Holds the decoded provider client before permission enforcement. */
+export class InnerCodeCommitReadClient extends Context.Service()("@knpkv/codecommit-web/InnerCodeCommitReadClient") {
+}
+const deniedError = (params, reason) => new AwsApiError({
+    operation: params.operation,
+    profile: params.account.profile,
+    region: params.account.region,
+    cause: new PermissionDeniedError({ operation: params.operation, reason })
+});
+/** Construct a read client that checks permission and audits before every provider call. */
+export const makePermissionedReadClient = Effect.fn("PermissionedReadClient.make")(function* (inner) {
+    const permissions = yield* PermissionService;
+    const permissionGate = yield* PermissionGate;
+    const auditLog = yield* AuditLogRepo;
+    const audit = (params, permissionState, durationMs) => permissions.isAuditEnabled().pipe(Effect.flatMap((enabled) => enabled
+        ? Clock.currentTimeMillis.pipe(Effect.flatMap((now) => auditLog.log({
+            timestamp: new Date(now).toISOString(),
+            operation: params.operation,
+            accountProfile: params.account.profile,
+            region: params.account.region,
+            permissionState,
+            context: params.context,
+            durationMs
+        })))
+        : Effect.void), Effect.ignore);
+    const check = (params) => Effect.gen(function* () {
+        const state = yield* permissions.check(params.operation);
+        if (state === "always_allow")
+            return "always_allowed";
+        if (state === "deny") {
+            yield* audit(params, "denied", null);
+            return yield* deniedError(params, "denied");
+        }
+        const now = yield* Clock.currentTimeMillis;
+        const nonce = yield* Random.nextIntBetween(0, 999_999_999);
+        const response = yield* permissionGate.request({
+            id: `gate-${now}-${nonce}`,
+            operation: params.operation,
+            category: getOperationMeta(params.operation).category,
+            context: params.context
+        }).pipe(Effect.catchTag("PermissionDeniedError", (error) => Effect.gen(function* () {
+            if (error.reason === "denied") {
+                yield* permissions.set(params.operation, "deny");
+                yield* audit(params, "denied", null);
+            }
+            else {
+                yield* audit(params, "timed_out", null);
+            }
+            return yield* deniedError(params, error.reason);
+        })));
+        if (response === "always_allow") {
+            yield* permissions.set(params.operation, "always_allow");
+            return "always_allowed";
+        }
+        if (response === "deny") {
+            yield* permissions.set(params.operation, "deny");
+            yield* audit(params, "denied", null);
+            return yield* deniedError(params, "denied");
+        }
+        return "allowed";
+    });
+    const gated = (operation, context, account, method) => (request) => {
+        const params = { operation, context: context(request), account: account(request) };
+        return Effect.gen(function* () {
+            const permissionState = yield* check(params);
+            const startedAt = yield* Clock.currentTimeMillis;
+            return yield* method(request).pipe(Effect.ensuring(Clock.currentTimeMillis.pipe(Effect.flatMap((completedAt) => audit(params, permissionState, completedAt - startedAt)))));
+        });
+    };
+    const self = (account) => account;
+    const nested = (request) => request.account;
+    const listPullRequestIdsPage = gated("listPullRequests", (request) => `List pull requests in ${request.repositoryName}`, nested, inner.listPullRequestIdsPage);
+    const getPullRequest = gated("getPullRequest", (request) => `Fetch PR #${request.pullRequestId}`, nested, inner.getPullRequest);
+    const listPullRequestsPage = (request) => Effect.gen(function* () {
+        const page = yield* listPullRequestIdsPage(request);
+        const pullRequests = yield* Effect.forEach(page.pullRequestIds, (pullRequestId) => getPullRequest({ account: request.account, pullRequestId }));
+        return new ReadClient.CodeCommitPullRequestPage({ pullRequests, nextToken: page.nextToken });
+    });
+    const getChangedFilesPage = gated("getDifferences", (request) => `Read differences in ${request.repositoryName}`, nested, inner.getChangedFilesPage);
+    const initialPageToken = () => null;
+    const streamPullRequests = (request) => Stream.paginate(initialPageToken(), (nextToken) => listPullRequestsPage({ ...request, nextToken }).pipe(Effect.map((page) => [
+        page.pullRequests,
+        page.nextToken === null ? Option.none() : Option.some(page.nextToken)
+    ])));
+    const streamChangedFiles = (request) => Stream.paginate({ nextToken: null, pageRequests: 0, seenTokens: new Set() }, Effect.fn("PermissionedReadClient.changedFilesPage")(function* (state) {
+        if (state.pageRequests >= MAXIMUM_CHANGED_FILE_PAGE_REQUESTS) {
+            return yield* new ReadClient.CodeCommitMalformedResponseError({
+                operation: "GetDifferences",
+                diagnosticCode: "page-request-limit"
+            });
+        }
+        const page = yield* getChangedFilesPage({ ...request, nextToken: state.nextToken });
+        if (page.nextToken === null)
+            return [page.files, Option.none()];
+        if (state.seenTokens.has(page.nextToken)) {
+            return yield* new ReadClient.CodeCommitMalformedResponseError({
+                operation: "GetDifferences",
+                diagnosticCode: "repeated-page-token"
+            });
+        }
+        return [
+            page.files,
+            Option.some({
+                nextToken: page.nextToken,
+                pageRequests: state.pageRequests + 1,
+                seenTokens: new Set([...state.seenTokens, page.nextToken])
+            })
+        ];
+    }));
+    return {
+        discoverAccount: gated("getCallerIdentity", (account) => `Discover account for ${account.profile}`, self, inner.discoverAccount),
+        listRepositoriesPage: gated("listRepositories", (request) => `List repositories for ${request.account.profile}`, nested, inner.listRepositoriesPage),
+        getBlob: gated("getBlob", (request) => `Read immutable blob in ${request.repositoryName}`, nested, inner.getBlob),
+        listPullRequestIdsPage,
+        listPullRequestsPage,
+        streamPullRequests,
+        getPullRequest,
+        getRepositoryIdentity: gated("getRepository", (request) => `Read repository identity for ${request.repositoryName}`, nested, inner.getRepositoryIdentity),
+        getChangedFilesPage,
+        streamChangedFiles
+    };
+});
+//# sourceMappingURL=PermissionedReadClient.js.map

package/dist/server/internal/PermissionedReadClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermissionedReadClient.js","sourceRoot":"","sources":["../../../src/server/internal/PermissionedReadClient.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAA;AACrF,OAAO,EAAE,YAAY,EAAyB,MAAM,sDAAsD,CAAA;AAC1G,OAAO,EAAE,iBAAiB,EAAE,MAAM,mDAAmD,CAAA;AACrF,OAAO,EAAE,gBAAgB,EAAE,MAAM,wDAAwD,CAAA;AACzF,OAAO,EAAE,cAAc,EAAE,MAAM,4DAA4D,CAAA;AAC3F,OAAO,KAAK,UAAU,MAAM,sCAAsC,CAAA;AAClE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AASvE,MAAM,kCAAkC,GAAG,KAAK,CAAA;AAQhD,uEAAuE;AACvE,MAAM,OAAO,yBAA0B,SAAQ,OAAO,CAAC,OAAO,EAG3D,CAAC,iDAAiD,CAAC;CAAG;AAEzD,MAAM,WAAW,GAAG,CAAC,MAAkB,EAAE,MAA4B,EAAE,EAAE,CACvE,IAAI,WAAW,CAAC;IACd,SAAS,EAAE,MAAM,CAAC,SAAS;IAC3B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO;IAC/B,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;IAC7B,KAAK,EAAE,IAAI,qBAAqB,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;CAC1E,CAAC,CAAA;AAEJ,4FAA4F;AAC5F,MAAM,CAAC,MAAM,0BAA0B,GAAG,MAAM,CAAC,EAAE,CAAC,6BAA6B,CAAC,CAAC,QAAQ,CAAC,EAC1F,KAA6C;IAE7C,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAA;IAC5C,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,cAAc,CAAA;IAC5C,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,YAAY,CAAA;IAEpC,MAAM,KAAK,GAAG,CACZ,MAAkB,EAClB,eAAoD,EACpD,UAAyB,EACJ,EAAE,CACvB,WAAW,CAAC,cAAc,EAAE,CAAC,IAAI,CAC/B,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CACzB,OAAO;QACL,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAC5B,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CACrB,QAAQ,CAAC,GAAG,CAAC;YACX,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;YACtC,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO;YACtC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;YAC7B,eAAe;YACf,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,UAAU;SACX,CAAC,CACH,CACF;QACD,CAAC,CAAC,MAAM,CAAC,IAAI,CAChB,EACD,MAAM,CAAC,MAAM,CACd,CAAA;IAEH,MAAM,KAAK,GAAG,CAAC,MAAkB,EAA+D,EAAE,CAChG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QACxD,IAAI,KAAK,KAAK,cAAc;YAAE,OAAO,gBAAgB,CAAA;QACrD,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YACrB,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAA;YACpC,OAAO,KAAK,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QAC7C,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAA;QAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;QAC1D,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC;YAC7C,EAAE,EAAE,QAAQ,GAAG,IAAI,KAAK,EAAE;YAC1B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,QAAQ,EAAE,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,QAAQ;YACrD,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,CAAC,KAAK,EAAE,EAAE,CACjD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC9B,KAAK,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;gBAChD,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAA;YACtC,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,CAAA;YACzC,CAAC;YACD,OAAO,KAAK,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;QACjD,CAAC,CAAC,CAAC,CACN,CAAA;QACD,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;YAChC,KAAK,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;YACxD,OAAO,gBAAgB,CAAA;QACzB,CAAC;QACD,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACxB,KAAK,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;YAChD,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAA;YACpC,OAAO,KAAK,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QAC7C,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC,CAAC,CAAA;IAEJ,MAAM,KAAK,GAAG,CACZ,SAAiB,EACjB,OAAwC,EACxC,OAAkE,EAClE,MAAwE,EACxE,EAAE,CACJ,CAAC,OAAU,EAAoD,EAAE;QAC/D,MAAM,MAAM,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAA;QAClF,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YACzB,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;YAC5C,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAA;YAChD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAChC,MAAM,CAAC,QAAQ,CACb,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAC1B,MAAM,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,eAAe,EAAE,WAAW,GAAG,SAAS,CAAC,CAAC,CACzF,CACF,CACF,CAAA;QACH,CAAC,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,MAAM,IAAI,GAAG,CAAC,OAAyC,EAAE,EAAE,CAAC,OAAO,CAAA;IACnE,MAAM,MAAM,GAAG,CAAC,OAA+D,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAA;IAEnG,MAAM,sBAAsB,GAAG,KAAK,CAClC,kBAAkB,EAClB,CAAC,OAAwF,EAAE,EAAE,CAC3F,yBAAyB,OAAO,CAAC,cAAc,EAAE,EACnD,MAAM,EACN,KAAK,CAAC,sBAAsB,CAC7B,CAAA;IACD,MAAM,cAAc,GAAG,KAAK,CAC1B,gBAAgB,EAChB,CAAC,OAAgF,EAAE,EAAE,CACnF,aAAa,OAAO,CAAC,aAAa,EAAE,EACtC,MAAM,EACN,KAAK,CAAC,cAAc,CACrB,CAAA;IACD,MAAM,oBAAoB,GAAmE,CAAC,OAAO,EAAE,EAAE,CACvG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAA;QACnD,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CACxC,IAAI,CAAC,cAAc,EACnB,CAAC,aAAa,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,aAAa,EAAE,CAAC,CAC/E,CAAA;QACD,OAAO,IAAI,UAAU,CAAC,yBAAyB,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;IAC9F,CAAC,CAAC,CAAA;IACJ,MAAM,mBAAmB,GAAG,KAAK,CAC/B,gBAAgB,EAChB,CAAC,OAAqF,EAAE,EAAE,CACxF,uBAAuB,OAAO,CAAC,cAAc,EAAE,EACjD,MAAM,EACN,KAAK,CAAC,mBAAmB,CAC1B,CAAA;IACD,MAAM,gBAAgB,GAAG,GAAkB,EAAE,CAAC,IAAI,CAAA;IAElD,MAAM,kBAAkB,GAAiE,CAAC,OAAO,EAAE,EAAE,CACnG,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,EAAE,CAAC,SAAS,EAAE,EAAE,CAChD,oBAAoB,CAAC,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,CAClD,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACnB,IAAI,CAAC,YAAY;QACjB,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAgB,IAAI,CAAC,SAAS,CAAC;KACpG,CAAC,CACH,CAAC,CAAA;IAEN,MAAM,kBAAkB,GAAiE,CAAC,OAAO,EAAE,EAAE,CACnG,MAAM,CAAC,QAAQ,CACb,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,GAAG,EAAE,EAAE,EAC3D,MAAM,CAAC,EAAE,CAAC,yCAAyC,CAAC,CAAC,QAAQ,CAAC,EAAC,KAAK;QAClE,IAAI,KAAK,CAAC,YAAY,IAAI,kCAAkC,EAAE,CAAC;YAC7D,OAAO,KAAK,CAAC,CAAC,IAAI,UAAU,CAAC,gCAAgC,CAAC;gBAC5D,SAAS,EAAE,gBAAgB;gBAC3B,cAAc,EAAE,oBAAoB;aACrC,CAAC,CAAA;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAA;QACnF,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI;YAAE,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,EAA8B,CAAC,CAAA;QAC3F,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACzC,OAAO,KAAK,CAAC,CAAC,IAAI,UAAU,CAAC,gCAAgC,CAAC;gBAC5D,SAAS,EAAE,gBAAgB;gBAC3B,cAAc,EAAE,qBAAqB;aACtC,CAAC,CAAA;QACJ,CAAC;QACD,OAAO;YACL,IAAI,CAAC,KAAK;YACV,MAAM,CAAC,IAAI,CAA6B;gBACtC,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,YAAY,EAAE,KAAK,CAAC,YAAY,GAAG,CAAC;gBACpC,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;aAC3D,CAAC;SACH,CAAA;IACH,CAAC,CAAC,CACH,CAAA;IAEH,OAAO;QACL,eAAe,EAAE,KAAK,CACpB,mBAAmB,EACnB,CAAC,OAAO,EAAE,EAAE,CAAC,wBAAwB,OAAO,CAAC,OAAO,EAAE,EACtD,IAAI,EACJ,KAAK,CAAC,eAAe,CACtB;QACD,oBAAoB,EAAE,KAAK,CACzB,kBAAkB,EAClB,CAAC,OAAO,EAAE,EAAE,CAAC,yBAAyB,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,EAC/D,MAAM,EACN,KAAK,CAAC,oBAAoB,CAC3B;QACD,OAAO,EAAE,KAAK,CACZ,SAAS,EACT,CAAC,OAAO,EAAE,EAAE,CAAC,0BAA0B,OAAO,CAAC,cAAc,EAAE,EAC/D,MAAM,EACN,KAAK,CAAC,OAAO,CACd;QACD,sBAAsB;QACtB,oBAAoB;QACpB,kBAAkB;QAClB,cAAc;QACd,qBAAqB,EAAE,KAAK,CAC1B,eAAe,EACf,CAAC,OAAO,EAAE,EAAE,CAAC,gCAAgC,OAAO,CAAC,cAAc,EAAE,EACrE,MAAM,EACN,KAAK,CAAC,qBAAqB,CAC5B;QACD,mBAAmB;QACnB,kBAAkB;KAC8B,CAAA;AACpD,CAAC,CAAC,CAAA"}