@lamalibre/create-lamaste 4.0.0

package/vendor/gatekeeper/dist/lib/constants.js

@@ -0,0 +1,79 @@
+/**
+ * Principal types for grants.
+ */
+export const PRINCIPAL_TYPES = ['user', 'group'];
+/**
+ * Built-in resource types. The grant system is extensible — new resource types
+ * can be added without schema changes.
+ */
+export const RESOURCE_TYPES = ['tunnel', 'plugin'];
+/**
+ * Tunnel access modes.
+ */
+export const ACCESS_MODES = ['public', 'authenticated', 'restricted'];
+/**
+ * Reserved Authelia group names (identity tier). These cannot be used as
+ * Lamaste group names to avoid confusion between the two group systems.
+ */
+export const RESERVED_GROUP_NAMES = ['admins', 'internal', 'external'];
+/**
+ * Hard cap on Lamaste groups (DoS protection).
+ */
+export const MAX_GROUPS = 200;
+/**
+ * Hard cap on grants (DoS protection).
+ */
+export const MAX_GRANTS = 1000;
+/**
+ * Hard cap on members per group (DoS protection).
+ */
+export const MAX_MEMBERS_PER_GROUP = 1000;
+/**
+ * Consumed grant retention period (90 days in ms).
+ * Grants older than this are pruned during write operations.
+ */
+export const GRANT_RETENTION_MS = 90 * 24 * 60 * 60 * 1000;
+/**
+ * Gatekeeper in-memory session cache TTL (30 seconds in ms).
+ */
+export const SESSION_CACHE_TTL_MS = 30 * 1000;
+/**
+ * Group name validation regex: lowercase alphanumeric + hyphens,
+ * cannot start or end with a hyphen, 2-63 chars.
+ */
+export const GROUP_NAME_REGEX = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;
+/**
+ * Maximum group name length.
+ */
+export const MAX_GROUP_NAME_LENGTH = 63;
+/**
+ * Minimum group name length.
+ */
+export const MIN_GROUP_NAME_LENGTH = 2;
+/**
+ * Default data directory path.
+ */
+export const DEFAULT_DATA_DIR = '/etc/lamalibre/lamaste';
+/**
+ * State file names.
+ */
+export const GROUPS_FILE = 'groups.json';
+export const GRANTS_FILE = 'access-grants.json';
+export const SETTINGS_FILE = 'gatekeeper.json';
+export const ACCESS_LOG_FILE = 'access-request-log.json';
+/**
+ * Authelia verify endpoint (localhost).
+ *
+ * We call the nginx-flavored `/api/authz/auth-request` endpoint because we
+ * forward the origin request as `X-Original-URL` (+ `X-Original-Method`), the
+ * header contract that endpoint expects. The `/api/authz/forward-auth`
+ * endpoint is for Traefik-style callers that send `X-Forwarded-Host` /
+ * `X-Forwarded-Uri` and errors out with "missing host value" when given
+ * `X-Original-URL` — which was the prior default here.
+ */
+export const AUTHELIA_VERIFY_URL = 'http://127.0.0.1:9091/api/authz/auth-request';
+/**
+ * Gatekeeper service port.
+ */
+export const GATEKEEPER_PORT = 9294;
+//# sourceMappingURL=constants.js.map

package/vendor/gatekeeper/dist/lib/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/lib/constants.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,OAAO,CAAU,CAAC;AAG1D;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAU,CAAC;AAG5D;;GAEG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,YAAY,CAAU,CAAC;AAG/E;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAU,CAAC;AAEhF;;GAEG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,GAAG,CAAC;AAE9B;;GAEG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,CAAC;AAE/B;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAE1C;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE3D;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,GAAG,IAAI,CAAC;AAE9C;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,iCAAiC,CAAC;AAElE;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAExC;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAEvC;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,wBAAwB,CAAC;AAEzD;;GAEG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,aAAa,CAAC;AACzC,MAAM,CAAC,MAAM,WAAW,GAAG,oBAAoB,CAAC;AAChD,MAAM,CAAC,MAAM,aAAa,GAAG,iBAAiB,CAAC;AAC/C,MAAM,CAAC,MAAM,eAAe,GAAG,yBAAyB,CAAC;AAEzD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,8CAA8C,CAAC;AAElF;;GAEG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC"}

package/vendor/gatekeeper/dist/lib/grants.d.ts

@@ -0,0 +1,32 @@
+import type { Grant, GrantState, CreateGrantOptions, GrantFilter } from './types.js';
+export declare function createGrant(options: CreateGrantOptions, initialState?: {
+    used?: boolean;
+    createdAt?: string;
+    usedAt?: string | null;
+}): Promise<Grant>;
+export declare function listGrants(filter?: GrantFilter): Promise<readonly Grant[]>;
+export declare function getGrant(grantId: string): Promise<Grant | null>;
+export declare function revokeGrant(grantId: string): Promise<Grant>;
+/**
+ * Remove all grants matching a filter predicate.
+ * Used by groups.ts for cascading deletes/renames — serialized via grantLock.
+ */
+export declare function removeGrantsByPredicate(predicate: (g: GrantState) => boolean): Promise<number>;
+/**
+ * Remove all grants belonging to a specific principal (user or group).
+ *
+ * Used by the panel server when a user is deleted from Authelia, to cascade
+ * the deletion across gatekeeper grants. Serialized via grantLock.
+ *
+ * @param principalType - 'user' or 'group'
+ * @param principalId   - The principal's identifier (username or group name)
+ * @returns Number of grants removed
+ */
+export declare function removeGrantsByPrincipal(principalType: 'user' | 'group', principalId: string): Promise<number>;
+/**
+ * Update grants matching a filter predicate.
+ * Used by groups.ts for cascading renames — serialized via grantLock.
+ */
+export declare function updateGrantsByPredicate(predicate: (g: GrantState) => boolean, updater: (g: GrantState) => void): Promise<number>;
+export declare function consumeGrant(grantId: string, username: string): Promise<Grant>;
+//# sourceMappingURL=grants.d.ts.map

package/vendor/gatekeeper/dist/lib/grants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../../src/lib/grants.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AA+IrF,wBAAsB,WAAW,CAC/B,OAAO,EAAE,kBAAkB,EAC3B,YAAY,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAC5E,OAAO,CAAC,KAAK,CAAC,CAmEhB;AAED,wBAAsB,UAAU,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,KAAK,EAAE,CAAC,CAkBhF;AAED,wBAAsB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAIrE;AAED,wBAAsB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAiCjE;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,SAAS,EAAE,CAAC,CAAC,EAAE,UAAU,KAAK,OAAO,GACpC,OAAO,CAAC,MAAM,CAAC,CAuBjB;AAED;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,CAC3C,aAAa,EAAE,MAAM,GAAG,OAAO,EAC/B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC,CAIjB;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,SAAS,EAAE,CAAC,CAAC,EAAE,UAAU,KAAK,OAAO,EACrC,OAAO,EAAE,CAAC,CAAC,EAAE,UAAU,KAAK,IAAI,GAC/B,OAAO,CAAC,MAAM,CAAC,CA+CjB;AAED,wBAAsB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAgCpF"}

package/vendor/gatekeeper/dist/lib/grants.js

@@ -0,0 +1,314 @@
+import crypto from 'node:crypto';
+import { PromiseChainMutex } from '@lamalibre/lamaste';
+import { MAX_GRANTS, GRANT_RETENTION_MS } from './constants.js';
+import { notifyCacheInvalidated } from './cache-bust.js';
+import { getGatekeeperDb } from './state-db.js';
+// ---------------------------------------------------------------------------
+// Promise-chain mutex (preserved from JSON era)
+//
+// SQLite's BEGIN IMMEDIATE serialises writers, but several public exports
+// (createGrant with prune, consumeGrant with belongs-to check) are
+// read-modify-write sequences whose JSON-era atomicity came from this lock.
+// Drop as a follow-up after Step 4 (rodeo) lands.
+// ---------------------------------------------------------------------------
+const grantMutex = new PromiseChainMutex();
+function withGrantLock(fn) {
+    return grantMutex.run(fn);
+}
+let stmts = null;
+async function getStmts() {
+    if (stmts)
+        return stmts;
+    const db = await getGatekeeperDb();
+    stmts = {
+        selectAll: db.prepare('SELECT * FROM access_grants ORDER BY created_at'),
+        selectById: db.prepare('SELECT * FROM access_grants WHERE grant_id = ?'),
+        countAll: db.prepare('SELECT COUNT(*) AS n FROM access_grants'),
+        insert: db.prepare(`
+      INSERT INTO access_grants
+        (grant_id, principal_type, principal_id, resource_type, resource_id, context, used, created_at, used_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `),
+        markUsed: db.prepare('UPDATE access_grants SET used = 1, used_at = ? WHERE grant_id = ?'),
+        deleteById: db.prepare('DELETE FROM access_grants WHERE grant_id = ?'),
+        // Retention sweep: prune consumed grants past GRANT_RETENTION_MS. The
+        // matching index (idx_grants_used_used_at) covers the predicate.
+        deleteConsumedBefore: db.prepare('DELETE FROM access_grants WHERE used = 1 AND used_at IS NOT NULL AND used_at < ?'),
+        begin: db.prepare('BEGIN IMMEDIATE'),
+        commit: db.prepare('COMMIT'),
+        rollback: db.prepare('ROLLBACK'),
+    };
+    return stmts;
+}
+function rowToGrant(row) {
+    return {
+        grantId: row.grant_id,
+        principalType: row.principal_type,
+        principalId: row.principal_id,
+        resourceType: row.resource_type,
+        resourceId: row.resource_id,
+        context: JSON.parse(row.context),
+        used: row.used === 1,
+        createdAt: row.created_at,
+        usedAt: row.used_at,
+    };
+}
+// ---------------------------------------------------------------------------
+// Internal helpers
+// ---------------------------------------------------------------------------
+/**
+ * Prune consumed grants older than the retention period. Replaces the
+ * JSON-era `pruneStaleGrants` array filter — the SQL DELETE is now driven
+ * by `idx_grants_used_used_at`, but the call sites (every write operation)
+ * remain the same.
+ */
+function pruneStaleGrants(s) {
+    const cutoff = new Date(Date.now() - GRANT_RETENTION_MS).toISOString();
+    s.deleteConsumedBefore.run(cutoff);
+}
+/**
+ * Check if a grant should be auto-consumed on creation.
+ * Tunnel grants and agent-side plugin grants are auto-consumed.
+ * Local plugin grants start unused (consumed on enrollment).
+ */
+function shouldAutoConsume(options) {
+    if (options.resourceType === 'tunnel')
+        return true;
+    if (options.resourceType === 'plugin') {
+        const target = options.context?.['target'] ?? 'local';
+        return target.startsWith('agent:');
+    }
+    return true;
+}
+/**
+ * Check if two grants are duplicates (same principal + resource + context).
+ */
+function isDuplicate(a, b) {
+    if (a.principalType !== b.principalType)
+        return false;
+    if (a.principalId !== b.principalId)
+        return false;
+    if (a.resourceType !== b.resourceType)
+        return false;
+    if (a.resourceId !== b.resourceId)
+        return false;
+    const aCtx = JSON.stringify(a.context ?? {});
+    const bCtx = JSON.stringify(b.context ?? {});
+    return aCtx === bCtx;
+}
+// ---------------------------------------------------------------------------
+// Public API — signatures preserved byte-identical to the JSON-backed version
+// ---------------------------------------------------------------------------
+export async function createGrant(options, initialState) {
+    return withGrantLock(async () => {
+        const s = await getStmts();
+        // Prune stale grants on every write operation (matches JSON-era cadence).
+        pruneStaleGrants(s);
+        const countRow = s.countAll.get();
+        if (countRow.n >= MAX_GRANTS) {
+            throw Object.assign(new Error(`Maximum number of grants (${MAX_GRANTS}) reached`), {
+                statusCode: 503,
+            });
+        }
+        // Reject duplicates — same scan as the JSON era over the full table.
+        // Index-friendly tightening (e.g. idx_grants_principal + resource pre-
+        // filter) is a Step 4+ optimisation; not changing semantics here.
+        const allRows = s.selectAll.all();
+        const all = allRows.map(rowToGrant);
+        if (all.some((g) => isDuplicate(g, options))) {
+            throw Object.assign(new Error('Duplicate grant: a grant with the same principal, resource, and context already exists'), { statusCode: 409 });
+        }
+        const now = new Date().toISOString();
+        const used = initialState?.used ?? shouldAutoConsume(options);
+        const createdAt = initialState?.createdAt ?? now;
+        const usedAt = initialState?.usedAt !== undefined ? initialState.usedAt : used ? now : null;
+        const grant = {
+            grantId: crypto.randomUUID(),
+            principalType: options.principalType,
+            principalId: options.principalId,
+            resourceType: options.resourceType,
+            resourceId: options.resourceId,
+            context: options.context ?? {},
+            used,
+            createdAt,
+            usedAt,
+        };
+        s.begin.run();
+        try {
+            s.insert.run(grant.grantId, grant.principalType, grant.principalId, grant.resourceType, grant.resourceId, JSON.stringify(grant.context), grant.used ? 1 : 0, grant.createdAt, grant.usedAt);
+            s.commit.run();
+        }
+        catch (err) {
+            s.rollback.run();
+            throw err;
+        }
+        notifyCacheInvalidated();
+        return grant;
+    });
+}
+export async function listGrants(filter) {
+    const s = await getStmts();
+    const rows = s.selectAll.all();
+    let grants = rows.map(rowToGrant);
+    if (filter) {
+        grants = grants.filter((g) => {
+            if (filter.principalType !== undefined && g.principalType !== filter.principalType)
+                return false;
+            if (filter.principalId !== undefined && g.principalId !== filter.principalId)
+                return false;
+            if (filter.resourceType !== undefined && g.resourceType !== filter.resourceType)
+                return false;
+            if (filter.resourceId !== undefined && g.resourceId !== filter.resourceId)
+                return false;
+            if (filter.used !== undefined && g.used !== filter.used)
+                return false;
+            return true;
+        });
+    }
+    return grants;
+}
+export async function getGrant(grantId) {
+    const s = await getStmts();
+    const row = s.selectById.get(grantId);
+    return row ? rowToGrant(row) : null;
+}
+export async function revokeGrant(grantId) {
+    return withGrantLock(async () => {
+        const s = await getStmts();
+        const row = s.selectById.get(grantId);
+        if (!row) {
+            throw Object.assign(new Error('Grant not found'), { statusCode: 404 });
+        }
+        const grant = rowToGrant(row);
+        // Local plugin grants: only revocable if unused
+        if (grant.resourceType === 'plugin' &&
+            grant.context?.['target'] === 'local' &&
+            grant.used) {
+            throw Object.assign(new Error('Cannot revoke a consumed local plugin grant'), {
+                statusCode: 409,
+            });
+        }
+        s.begin.run();
+        try {
+            s.deleteById.run(grantId);
+            s.commit.run();
+        }
+        catch (err) {
+            s.rollback.run();
+            throw err;
+        }
+        notifyCacheInvalidated();
+        return grant;
+    });
+}
+/**
+ * Remove all grants matching a filter predicate.
+ * Used by groups.ts for cascading deletes/renames — serialized via grantLock.
+ */
+export async function removeGrantsByPredicate(predicate) {
+    return withGrantLock(async () => {
+        const s = await getStmts();
+        const rows = s.selectAll.all();
+        const all = rows.map(rowToGrant);
+        const toRemove = all.filter(predicate);
+        if (toRemove.length === 0)
+            return 0;
+        s.begin.run();
+        try {
+            for (const g of toRemove) {
+                s.deleteById.run(g.grantId);
+            }
+            s.commit.run();
+        }
+        catch (err) {
+            s.rollback.run();
+            throw err;
+        }
+        notifyCacheInvalidated();
+        return toRemove.length;
+    });
+}
+/**
+ * Remove all grants belonging to a specific principal (user or group).
+ *
+ * Used by the panel server when a user is deleted from Authelia, to cascade
+ * the deletion across gatekeeper grants. Serialized via grantLock.
+ *
+ * @param principalType - 'user' or 'group'
+ * @param principalId   - The principal's identifier (username or group name)
+ * @returns Number of grants removed
+ */
+export async function removeGrantsByPrincipal(principalType, principalId) {
+    return removeGrantsByPredicate((g) => g.principalType === principalType && g.principalId === principalId);
+}
+/**
+ * Update grants matching a filter predicate.
+ * Used by groups.ts for cascading renames — serialized via grantLock.
+ */
+export async function updateGrantsByPredicate(predicate, updater) {
+    return withGrantLock(async () => {
+        const s = await getStmts();
+        const rows = s.selectAll.all();
+        const all = rows.map(rowToGrant);
+        let updated = 0;
+        const mutated = [];
+        for (const grant of all) {
+            if (predicate(grant)) {
+                updater(grant);
+                mutated.push(grant);
+                updated++;
+            }
+        }
+        if (updated === 0)
+            return 0;
+        s.begin.run();
+        try {
+            // The legacy updater closure mutates principalId / context fields in
+            // place. Persist whatever the closure changed by re-inserting the row
+            // (delete + insert keeps the prepared-statement bundle small and
+            // avoids needing a generic UPDATE for every column permutation).
+            for (const g of mutated) {
+                s.deleteById.run(g.grantId);
+                s.insert.run(g.grantId, g.principalType, g.principalId, g.resourceType, g.resourceId, JSON.stringify(g.context), g.used ? 1 : 0, g.createdAt, g.usedAt);
+            }
+            s.commit.run();
+        }
+        catch (err) {
+            s.rollback.run();
+            throw err;
+        }
+        notifyCacheInvalidated();
+        return updated;
+    });
+}
+export async function consumeGrant(grantId, username) {
+    return withGrantLock(async () => {
+        const s = await getStmts();
+        const row = s.selectById.get(grantId);
+        if (!row) {
+            throw Object.assign(new Error('Grant not found'), { statusCode: 404 });
+        }
+        const grant = rowToGrant(row);
+        if (grant.principalType !== 'user' || grant.principalId !== username) {
+            throw Object.assign(new Error('Grant does not belong to this user'), { statusCode: 403 });
+        }
+        if (grant.used) {
+            throw Object.assign(new Error('Grant has already been consumed'), { statusCode: 409 });
+        }
+        const usedAt = new Date().toISOString();
+        s.begin.run();
+        try {
+            s.markUsed.run(usedAt, grantId);
+            s.commit.run();
+        }
+        catch (err) {
+            s.rollback.run();
+            throw err;
+        }
+        grant.used = true;
+        grant.usedAt = usedAt;
+        notifyCacheInvalidated();
+        return grant;
+    });
+}
+//# sourceMappingURL=grants.js.map

package/vendor/gatekeeper/dist/lib/grants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.js","sourceRoot":"","sources":["../../src/lib/grants.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAKhD,8EAA8E;AAC9E,gDAAgD;AAChD,EAAE;AACF,0EAA0E;AAC1E,mEAAmE;AACnE,4EAA4E;AAC5E,kDAAkD;AAClD,8EAA8E;AAE9E,MAAM,UAAU,GAAG,IAAI,iBAAiB,EAAE,CAAC;AAE3C,SAAS,aAAa,CAAI,EAAoB;IAC5C,OAAO,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAC5B,CAAC;AAmBD,IAAI,KAAK,GAAsB,IAAI,CAAC;AAEpC,KAAK,UAAU,QAAQ;IACrB,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IAExB,MAAM,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;IAEnC,KAAK,GAAG;QACN,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,iDAAiD,CAAC;QACxE,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,gDAAgD,CAAC;QACxE,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,yCAAyC,CAAC;QAC/D,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC;;;;KAIlB,CAAC;QACF,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,mEAAmE,CAAC;QACzF,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,8CAA8C,CAAC;QACtE,sEAAsE;QACtE,iEAAiE;QACjE,oBAAoB,EAAE,EAAE,CAAC,OAAO,CAC9B,kFAAkF,CACnF;QACD,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC;QACpC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC5B,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC;KACjC,CAAC;IAEF,OAAO,KAAK,CAAC;AACf,CAAC;AAkBD,SAAS,UAAU,CAAC,GAAa;IAC/B,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,QAAQ;QACrB,aAAa,EAAE,GAAG,CAAC,cAA+B;QAClD,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,YAAY,EAAE,GAAG,CAAC,aAAa;QAC/B,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAA4B;QAC3D,IAAI,EAAE,GAAG,CAAC,IAAI,KAAK,CAAC;QACpB,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,MAAM,EAAE,GAAG,CAAC,OAAO;KACpB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,CAAa;IACrC,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,kBAAkB,CAAC,CAAC,WAAW,EAAE,CAAC;IACvE,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,OAA2B;IACpD,IAAI,OAAO,CAAC,YAAY,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,OAAO,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,MAAM,GAAI,OAAO,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAY,IAAI,OAAO,CAAC;QAClE,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,CAAa,EAAE,CAAqB;IACvD,IAAI,CAAC,CAAC,aAAa,KAAK,CAAC,CAAC,aAAa;QAAE,OAAO,KAAK,CAAC;IACtD,IAAI,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAClD,IAAI,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAEhD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAC7C,OAAO,IAAI,KAAK,IAAI,CAAC;AACvB,CAAC;AAED,8EAA8E;AAC9E,8EAA8E;AAC9E,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAA2B,EAC3B,YAA6E;IAE7E,OAAO,aAAa,CAAC,KAAK,IAAI,EAAE;QAC9B,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;QAE3B,0EAA0E;QAC1E,gBAAgB,CAAC,CAAC,CAAC,CAAC;QAEpB,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAmB,CAAC;QACnD,IAAI,QAAQ,CAAC,CAAC,IAAI,UAAU,EAAE,CAAC;YAC7B,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,6BAA6B,UAAU,WAAW,CAAC,EAAE;gBACjF,UAAU,EAAE,GAAG;aAChB,CAAC,CAAC;QACL,CAAC;QAED,qEAAqE;QACrE,uEAAuE;QACvE,kEAAkE;QAClE,MAAM,OAAO,GAAG,CAAC,CAAC,SAAS,CAAC,GAAG,EAA2B,CAAC;QAC3D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACpC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;YAC7C,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,wFAAwF,CACzF,EACD,EAAE,UAAU,EAAE,GAAG,EAAE,CACpB,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,YAAY,EAAE,IAAI,IAAI,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC9D,MAAM,SAAS,GAAG,YAAY,EAAE,SAAS,IAAI,GAAG,CAAC;QACjD,MAAM,MAAM,GAAG,YAAY,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QAE5F,MAAM,KAAK,GAAe;YACxB,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE;YAC5B,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,EAAE;YAC9B,IAAI;YACJ,SAAS;YACT,MAAM;SACP,CAAC;QAEF,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,CAAC;YACH,CAAC,CAAC,MAAM,CAAC,GAAG,CACV,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,WAAW,EACjB,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,UAAU,EAChB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,EAC7B,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAClB,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,MAAM,CACb,CAAC;YACF,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;YACjB,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,sBAAsB,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAoB;IACnD,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,GAAG,EAA2B,CAAC;IACxD,IAAI,MAAM,GAAiB,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAEhD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YAC3B,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS,IAAI,CAAC,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa;gBAChF,OAAO,KAAK,CAAC;YACf,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;gBAAE,OAAO,KAAK,CAAC;YAC3F,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI,CAAC,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY;gBAAE,OAAO,KAAK,CAAC;YAC9F,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU;gBAAE,OAAO,KAAK,CAAC;YACxF,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;gBAAE,OAAO,KAAK,CAAC;YACtE,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAe;IAC5C,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAyB,CAAC;IAC9D,OAAO,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAe;IAC/C,OAAO,aAAa,CAAC,KAAK,IAAI,EAAE;QAC9B,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAyB,CAAC;QAC9D,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,iBAAiB,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAE9B,gDAAgD;QAChD,IACE,KAAK,CAAC,YAAY,KAAK,QAAQ;YAC9B,KAAK,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAY,KAAK,OAAO;YACjD,KAAK,CAAC,IAAI,EACV,CAAC;YACD,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,6CAA6C,CAAC,EAAE;gBAC5E,UAAU,EAAE,GAAG;aAChB,CAAC,CAAC;QACL,CAAC;QAED,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,CAAC;YACH,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC1B,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;YACjB,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,sBAAsB,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,SAAqC;IAErC,OAAO,aAAa,CAAC,KAAK,IAAI,EAAE;QAC9B,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,GAAG,EAA2B,CAAC;QACxD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACjC,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAEvC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;QAEpC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,CAAC;YACH,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAC9B,CAAC;YACD,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;YACjB,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,sBAAsB,EAAE,CAAC;QACzB,OAAO,QAAQ,CAAC,MAAM,CAAC;IACzB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,aAA+B,EAC/B,WAAmB;IAEnB,OAAO,uBAAuB,CAC5B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,aAAa,IAAI,CAAC,CAAC,WAAW,KAAK,WAAW,CAC1E,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,SAAqC,EACrC,OAAgC;IAEhC,OAAO,aAAa,CAAC,KAAK,IAAI,EAAE;QAC9B,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,GAAG,EAA2B,CAAC;QACxD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAEjC,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,MAAM,OAAO,GAAiB,EAAE,CAAC;QACjC,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;YACxB,IAAI,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrB,OAAO,CAAC,KAAK,CAAC,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QAED,IAAI,OAAO,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;QAE5B,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,CAAC;YACH,qEAAqE;YACrE,sEAAsE;YACtE,iEAAiE;YACjE,iEAAiE;YACjE,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;gBAC5B,CAAC,CAAC,MAAM,CAAC,GAAG,CACV,CAAC,CAAC,OAAO,EACT,CAAC,CAAC,aAAa,EACf,CAAC,CAAC,WAAW,EACb,CAAC,CAAC,YAAY,EACd,CAAC,CAAC,UAAU,EACZ,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,EACzB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EACd,CAAC,CAAC,SAAS,EACX,CAAC,CAAC,MAAM,CACT,CAAC;YACJ,CAAC;YACD,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;YACjB,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,sBAAsB,EAAE,CAAC;QACzB,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAe,EAAE,QAAgB;IAClE,OAAO,aAAa,CAAC,KAAK,IAAI,EAAE;QAC9B,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAyB,CAAC;QAC9D,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,iBAAiB,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAE9B,IAAI,KAAK,CAAC,aAAa,KAAK,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;YACrE,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,oCAAoC,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC5F,CAAC;QAED,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,iCAAiC,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACxC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,CAAC;YACH,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAChC,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;YACjB,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;QAClB,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;QACtB,sBAAsB,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC"}

package/vendor/gatekeeper/dist/lib/groups.d.ts

@@ -0,0 +1,10 @@
+import type { Group, CreateGroupOptions, UpdateGroupOptions, DeleteGroupResult } from './types.js';
+export declare function createGroup(name: string, options?: CreateGroupOptions): Promise<Group>;
+export declare function listGroups(): Promise<readonly Group[]>;
+export declare function getGroup(name: string): Promise<Group | null>;
+export declare function updateGroup(name: string, updates: UpdateGroupOptions): Promise<Group>;
+export declare function deleteGroup(name: string): Promise<DeleteGroupResult>;
+export declare function addMembers(groupName: string, usernames: readonly string[]): Promise<Group>;
+export declare function removeMembers(groupName: string, usernames: readonly string[]): Promise<Group>;
+export declare function getGroupsForUser(username: string): Promise<readonly string[]>;
+//# sourceMappingURL=groups.d.ts.map

package/vendor/gatekeeper/dist/lib/groups.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"groups.d.ts","sourceRoot":"","sources":["../../src/lib/groups.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EACV,KAAK,EAEL,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EAClB,MAAM,YAAY,CAAC;AAmHpB,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,kBAAuB,GAAG,OAAO,CAAC,KAAK,CAAC,CA4ChG;AAED,wBAAsB,UAAU,IAAI,OAAO,CAAC,SAAS,KAAK,EAAE,CAAC,CAI5D;AAED,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAIlE;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,KAAK,CAAC,CA0D3F;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA4B1E;AAED,wBAAsB,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,CAiChG;AAED,wBAAsB,aAAa,CACjC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,SAAS,MAAM,EAAE,GAC3B,OAAO,CAAC,KAAK,CAAC,CAwBhB;AAED,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAOnF"}