@lamalibre/create-lamaste 4.0.0

package/vendor/gatekeeper/dist/lib/templates.js

@@ -0,0 +1,151 @@
+/**
+ * Generate pre-filled message templates for requesting access to a resource.
+ *
+ * @param username - The authenticated user's username
+ * @param resourceName - Human-readable resource name (e.g., FQDN or plugin name)
+ * @param options - Optional admin contact info and domain
+ * @returns Templates for email, Slack, Teams, WhatsApp, and generic
+ */
+export function getAccessRequestTemplates(username, resourceName, options) {
+    const adminName = options?.adminName ?? 'Administrator';
+    const adminContact = options?.adminContact ?? '';
+    const contactLine = adminContact ? `\nAdmin contact: ${adminContact}` : '';
+    return {
+        email: {
+            subject: `Access request for ${resourceName}`,
+            body: `Hi ${adminName},\n\n` +
+                `I'd like to request access to ${resourceName}.\n` +
+                `My username is: ${username}\n\n` +
+                `Thank you.`,
+        },
+        slack: `Hi, could I get access to \`${resourceName}\`? My username is \`${username}\`.`,
+        teams: `Hi, could I get access to **${resourceName}**? My username is **${username}**.`,
+        whatsapp: `Hi, I need access to ${resourceName} (username: ${username}). Thanks!`,
+        generic: `Access request for ${resourceName}\n` + `Username: ${username}${contactLine}`,
+    };
+}
+/**
+ * Build an HTML page for the access-request denial page.
+ * Server-rendered with inline CSS, no external dependencies.
+ *
+ * @param username - The authenticated user's username
+ * @param resourceFqdn - The tunnel FQDN the user tried to access
+ * @param options - Optional admin contact info
+ * @returns Full HTML page string
+ */
+export function buildAccessRequestPage(username, resourceFqdn, options) {
+    const templates = getAccessRequestTemplates(username, resourceFqdn, options);
+    const adminContact = options?.adminContact ?? '';
+    const adminName = options?.adminName ?? 'your administrator';
+    return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Access Required — ${escapeHtml(resourceFqdn)}</title>
+  <style>
+    *, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
+    body {
+      font-family: ui-monospace, 'Cascadia Code', 'Source Code Pro', Menlo, Consolas, monospace;
+      background: #09090b; color: #e4e4e7;
+      min-height: 100vh; display: flex; align-items: center; justify-content: center;
+      padding: 1rem;
+    }
+    .card {
+      background: #18181b; border: 1px solid #27272a; border-radius: 0.75rem;
+      max-width: 560px; width: 100%; padding: 2rem;
+    }
+    .icon { font-size: 2.5rem; margin-bottom: 1rem; }
+    h1 { font-size: 1.25rem; color: #f4f4f5; margin-bottom: 0.5rem; }
+    .fqdn { color: #22d3ee; }
+    .subtitle { color: #a1a1aa; font-size: 0.875rem; margin-bottom: 1.5rem; }
+    .section-label {
+      color: #71717a; font-size: 0.75rem; text-transform: uppercase;
+      letter-spacing: 0.05em; margin-bottom: 0.5rem; margin-top: 1.25rem;
+    }
+    .template-box {
+      background: #0f0f12; border: 1px solid #27272a; border-radius: 0.5rem;
+      padding: 0.75rem 1rem; margin-bottom: 0.5rem; position: relative;
+      font-size: 0.8125rem; line-height: 1.5; white-space: pre-wrap;
+      word-break: break-word; color: #d4d4d8;
+    }
+    .copy-btn {
+      position: absolute; top: 0.5rem; right: 0.5rem;
+      background: #27272a; border: 1px solid #3f3f46; border-radius: 0.375rem;
+      color: #a1a1aa; font-size: 0.6875rem; padding: 0.25rem 0.5rem;
+      cursor: pointer; font-family: inherit;
+      transition: background 0.15s, color 0.15s;
+    }
+    .copy-btn:hover { background: #3f3f46; color: #e4e4e7; }
+    .copy-btn.copied { background: #065f46; color: #6ee7b7; border-color: #065f46; }
+    .contact { color: #a1a1aa; font-size: 0.8125rem; margin-top: 1.5rem; }
+    .contact a { color: #22d3ee; text-decoration: none; }
+    .contact a:hover { text-decoration: underline; }
+    .user-badge {
+      display: inline-block; background: #27272a; border-radius: 0.25rem;
+      padding: 0.125rem 0.375rem; font-size: 0.75rem; color: #22d3ee;
+    }
+  </style>
+</head>
+<body>
+  <div class="card">
+    <div class="icon">&#128274;</div>
+    <h1>Access Required</h1>
+    <p class="subtitle">
+      You don't have access to <span class="fqdn">${escapeHtml(resourceFqdn)}</span>
+    </p>
+    <p class="subtitle">
+      Signed in as <span class="user-badge">${escapeHtml(username)}</span>
+    </p>
+    <p class="subtitle">
+      Contact ${escapeHtml(adminName)} to request access. Copy a message template below:
+    </p>
+
+    <div class="section-label">Email</div>
+    <div class="template-box" id="tpl-email">Subject: ${escapeHtml(templates.email.subject)}
+
+${escapeHtml(templates.email.body)}<button class="copy-btn" onclick="copyTemplate('tpl-email', this)">Copy</button></div>
+
+    <div class="section-label">Slack / Teams</div>
+    <div class="template-box" id="tpl-slack">${escapeHtml(templates.slack)}<button class="copy-btn" onclick="copyTemplate('tpl-slack', this)">Copy</button></div>
+
+    <div class="section-label">WhatsApp</div>
+    <div class="template-box" id="tpl-whatsapp">${escapeHtml(templates.whatsapp)}<button class="copy-btn" onclick="copyTemplate('tpl-whatsapp', this)">Copy</button></div>
+
+    ${adminContact ? `<p class="contact">Admin: <a href="mailto:${escapeAttr(adminContact)}">${escapeHtml(adminContact)}</a></p>` : ''}
+  </div>
+  <script>
+    function copyTemplate(id, btn) {
+      var el = document.getElementById(id);
+      if (!el) return;
+      var text = el.textContent.replace(/Copy$/, '').trim();
+      navigator.clipboard.writeText(text).then(function() {
+        btn.textContent = 'Copied';
+        btn.classList.add('copied');
+        setTimeout(function() {
+          btn.textContent = 'Copy';
+          btn.classList.remove('copied');
+        }, 2000);
+      });
+    }
+  </script>
+</body>
+</html>`;
+}
+function escapeHtml(str) {
+    return str
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#039;');
+}
+function escapeAttr(str) {
+    return str
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#039;');
+}
+//# sourceMappingURL=templates.js.map

package/vendor/gatekeeper/dist/lib/templates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"templates.js","sourceRoot":"","sources":["../../src/lib/templates.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAAgB,EAChB,YAAoB,EACpB,OAAyB;IAEzB,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,eAAe,CAAC;IACxD,MAAM,YAAY,GAAG,OAAO,EAAE,YAAY,IAAI,EAAE,CAAC;IACjD,MAAM,WAAW,GAAG,YAAY,CAAC,CAAC,CAAC,oBAAoB,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAE3E,OAAO;QACL,KAAK,EAAE;YACL,OAAO,EAAE,sBAAsB,YAAY,EAAE;YAC7C,IAAI,EACF,MAAM,SAAS,OAAO;gBACtB,iCAAiC,YAAY,KAAK;gBAClD,mBAAmB,QAAQ,MAAM;gBACjC,YAAY;SACf;QACD,KAAK,EAAE,+BAA+B,YAAY,wBAAwB,QAAQ,KAAK;QACvF,KAAK,EAAE,+BAA+B,YAAY,wBAAwB,QAAQ,KAAK;QACvF,QAAQ,EAAE,wBAAwB,YAAY,eAAe,QAAQ,YAAY;QACjF,OAAO,EAAE,sBAAsB,YAAY,IAAI,GAAG,aAAa,QAAQ,GAAG,WAAW,EAAE;KACxF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAAgB,EAChB,YAAoB,EACpB,OAAyB;IAEzB,MAAM,SAAS,GAAG,yBAAyB,CAAC,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;IAC7E,MAAM,YAAY,GAAG,OAAO,EAAE,YAAY,IAAI,EAAE,CAAC;IACjD,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,oBAAoB,CAAC;IAE7D,OAAO;;;;;6BAKoB,UAAU,CAAC,YAAY,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oDAkDD,UAAU,CAAC,YAAY,CAAC;;;8CAG9B,UAAU,CAAC,QAAQ,CAAC;;;gBAGlD,UAAU,CAAC,SAAS,CAAC;;;;wDAImB,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC;;EAEzF,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC;;;+CAGa,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC;;;kDAGxB,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC;;MAE1E,YAAY,CAAC,CAAC,CAAC,6CAA6C,UAAU,CAAC,YAAY,CAAC,KAAK,UAAU,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE;;;;;;;;;;;;;;;;;;QAkB9H,CAAC;AACT,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,OAAO,GAAG;SACP,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,OAAO,GAAG;SACP,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC7B,CAAC"}

package/vendor/gatekeeper/dist/lib/types.d.ts

@@ -0,0 +1,178 @@
+import type { PrincipalType, AccessMode } from './constants.js';
+/**
+ * A Lamaste access control group.
+ */
+export interface Group {
+    readonly name: string;
+    readonly description: string;
+    readonly members: readonly string[];
+    readonly createdAt: string;
+    readonly createdBy: string;
+}
+/**
+ * Mutable group state (internal).
+ */
+export interface GroupState {
+    name: string;
+    description: string;
+    members: string[];
+    createdAt: string;
+    createdBy: string;
+}
+/**
+ * Options for creating a group.
+ */
+export interface CreateGroupOptions {
+    readonly description?: string | undefined;
+    readonly createdBy?: string | undefined;
+}
+/**
+ * Options for updating a group.
+ */
+export interface UpdateGroupOptions {
+    readonly name?: string | undefined;
+    readonly description?: string | undefined;
+}
+/**
+ * Result of deleting a group.
+ */
+export interface DeleteGroupResult {
+    readonly deletedGrants: number;
+}
+/**
+ * A generic access grant binding a principal to a resource.
+ */
+export interface Grant {
+    readonly grantId: string;
+    readonly principalType: PrincipalType;
+    readonly principalId: string;
+    readonly resourceType: string;
+    readonly resourceId: string;
+    readonly context: Record<string, unknown>;
+    readonly used: boolean;
+    readonly createdAt: string;
+    readonly usedAt: string | null;
+}
+/**
+ * Mutable grant state (internal).
+ */
+export interface GrantState {
+    grantId: string;
+    principalType: PrincipalType;
+    principalId: string;
+    resourceType: string;
+    resourceId: string;
+    context: Record<string, unknown>;
+    used: boolean;
+    createdAt: string;
+    usedAt: string | null;
+}
+/**
+ * Options for creating a grant.
+ */
+export interface CreateGrantOptions {
+    readonly principalType: PrincipalType;
+    readonly principalId: string;
+    readonly resourceType: string;
+    readonly resourceId: string;
+    readonly context?: Record<string, unknown>;
+}
+/**
+ * Filter for listing grants.
+ */
+export interface GrantFilter {
+    readonly principalType?: PrincipalType | undefined;
+    readonly principalId?: string | undefined;
+    readonly resourceType?: string | undefined;
+    readonly resourceId?: string | undefined;
+    readonly used?: boolean | undefined;
+}
+/**
+ * Result of an access check.
+ */
+export interface AccessAllowed {
+    readonly allowed: true;
+}
+export interface AccessDenied {
+    readonly allowed: false;
+    readonly resource: {
+        readonly type: string;
+        readonly id: string;
+    };
+    readonly templates: AccessRequestTemplates;
+}
+export type AccessResult = AccessAllowed | AccessDenied;
+/**
+ * Pre-filled message templates for access requests.
+ */
+export interface AccessRequestTemplates {
+    readonly email: {
+        readonly subject: string;
+        readonly body: string;
+    };
+    readonly slack: string;
+    readonly teams: string;
+    readonly whatsapp: string;
+    readonly generic: string;
+}
+/**
+ * Options for generating access request templates.
+ */
+export interface TemplateOptions {
+    readonly adminContact?: string | undefined;
+    readonly adminName?: string | undefined;
+    readonly domain?: string | undefined;
+}
+/**
+ * Gatekeeper service settings.
+ */
+export interface GatekeeperSettings {
+    readonly adminEmail?: string | undefined;
+    readonly adminName?: string | undefined;
+    readonly slackChannel?: string | undefined;
+    readonly teamsChannel?: string | undefined;
+    readonly sessionCacheTtlMs?: number | undefined;
+    readonly accessLoggingEnabled?: boolean | undefined;
+    readonly accessLogRetentionDays?: number | undefined;
+}
+/**
+ * An entry in the access request log.
+ */
+export interface AccessRequestEntry {
+    readonly timestamp: string;
+    readonly username: string;
+    readonly resourceType: string;
+    readonly resourceId: string;
+    readonly resourceFqdn: string;
+}
+/**
+ * Tunnel info used by the authz check endpoint.
+ */
+export interface TunnelInfo {
+    readonly id: string;
+    readonly fqdn: string;
+    readonly accessMode: AccessMode;
+    readonly enabled: boolean;
+}
+/**
+ * Cached Authelia session data.
+ */
+export interface AutheliaSession {
+    readonly username: string;
+    readonly groups: string;
+    readonly displayName: string;
+    readonly email: string;
+    readonly expiresAt: number;
+}
+/**
+ * Logger interface (compatible with Fastify logger).
+ */
+export interface GatekeeperLogger {
+    info(msg: string): void;
+    info(obj: Record<string, unknown>, msg: string): void;
+    warn(msg: string): void;
+    warn(obj: Record<string, unknown>, msg: string): void;
+    error(msg: string): void;
+    error(obj: Record<string, unknown>, msg: string): void;
+}
+//# sourceMappingURL=types.d.ts.map

package/vendor/gatekeeper/dist/lib/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/lib/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEhE;;GAEG;AACH,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACzC;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,aAAa,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,IAAI,EAAE,OAAO,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC5C;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IACnD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACrC;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;CACxB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE;QACjB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,QAAQ,CAAC,SAAS,EAAE,sBAAsB,CAAC;CAC5C;AAED,MAAM,MAAM,YAAY,GAAG,aAAa,GAAG,YAAY,CAAC;AAExD;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACpE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACtC;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACpD,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACtD;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACtD,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACtD,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CACxD"}

package/vendor/gatekeeper/dist/lib/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/vendor/gatekeeper/dist/lib/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/lib/types.ts"],"names":[],"mappings":""}

package/vendor/gatekeeper/dist/server/index.d.ts

@@ -0,0 +1,15 @@
+import '../boot.js';
+import Fastify from 'fastify';
+import type { TunnelInfo, GatekeeperSettings, AutheliaSession } from '../lib/types.js';
+export declare function createServer(): Promise<ReturnType<typeof Fastify>>;
+declare module 'fastify' {
+    interface FastifyInstance {
+        getTunnels(): TunnelInfo[];
+        getSettings(): GatekeeperSettings;
+        getSessionCache(): Map<string, AutheliaSession>;
+        getCacheVersion(): number;
+        bustCache(): void;
+        updateSettings(s: GatekeeperSettings): void;
+    }
+}
+//# sourceMappingURL=index.d.ts.map

package/vendor/gatekeeper/dist/server/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,YAAY,CAAC;AAEpB,OAAO,OAAO,MAAM,SAAS,CAAC;AAc9B,OAAO,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAoHvF,wBAAsB,YAAY,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC,CA6IxE;AAkCD,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,eAAe;QACvB,UAAU,IAAI,UAAU,EAAE,CAAC;QAC3B,WAAW,IAAI,kBAAkB,CAAC;QAClC,eAAe,IAAI,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QAChD,eAAe,IAAI,MAAM,CAAC;QAC1B,SAAS,IAAI,IAAI,CAAC;QAClB,cAAc,CAAC,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;KAC7C;CACF"}

package/vendor/gatekeeper/dist/server/index.js

@@ -0,0 +1,251 @@
+import '../boot.js';
+import crypto from 'node:crypto';
+import Fastify from 'fastify';
+import rateLimit from '@fastify/rate-limit';
+import { watch } from 'node:fs';
+import { readFile } from 'node:fs/promises';
+import path from 'node:path';
+import { atomicWriteJSON } from '@lamalibre/lamaste';
+import { DEFAULT_DATA_DIR, GROUPS_FILE, GRANTS_FILE, SETTINGS_FILE, GATEKEEPER_PORT, SESSION_CACHE_TTL_MS, } from '../lib/constants.js';
+import { registerCacheInvalidator } from '../lib/cache-bust.js';
+import { authzRoutes } from './routes/authz.js';
+import { groupRoutes } from './routes/groups.js';
+import { grantRoutes } from './routes/grants.js';
+import { diagnosticRoutes } from './routes/diagnostic.js';
+import { accessRequestRoutes } from './routes/access-request.js';
+const dataDir = process.env.LAMALIBRE_LAMASTE_DATA_DIR ?? DEFAULT_DATA_DIR;
+const tunnelsPath = path.join(dataDir, 'tunnels.json');
+const settingsPath = path.join(dataDir, SETTINGS_FILE);
+// ---------------------------------------------------------------------------
+// In-memory caches (refreshed by file watch + TTL)
+// ---------------------------------------------------------------------------
+/** Tunnel info cache (refreshed on file change) */
+let tunnelsCache = [];
+/** Gatekeeper settings cache */
+let settingsCache = {};
+/** Authelia session cache: cookie hash → session data */
+const sessionCache = new Map();
+/** Cache version counter — incremented on cache bust */
+let cacheVersion = 0;
+// ---------------------------------------------------------------------------
+// File loaders
+// ---------------------------------------------------------------------------
+async function loadTunnels() {
+    try {
+        const raw = await readFile(tunnelsPath, 'utf-8');
+        const parsed = JSON.parse(raw);
+        if (!Array.isArray(parsed))
+            return [];
+        return parsed.map((t) => ({
+            id: String(t.id ?? ''),
+            fqdn: String(t.fqdn ?? ''),
+            accessMode: t.accessMode ?? 'restricted',
+            enabled: t.enabled !== false,
+        }));
+    }
+    catch {
+        return [];
+    }
+}
+async function loadSettings() {
+    try {
+        const raw = await readFile(settingsPath, 'utf-8');
+        return JSON.parse(raw);
+    }
+    catch {
+        return {};
+    }
+}
+// ---------------------------------------------------------------------------
+// File watcher with debounce
+// ---------------------------------------------------------------------------
+/**
+ * One directory watcher per parent directory, multiplexed by filename.
+ *
+ * We watch the parent directory rather than the file itself because all of our
+ * state files (tunnels.json, grants.json, groups.json, gatekeeper.json) are
+ * updated via atomic rename (temp → fsync → rename). A direct `fs.watch` on
+ * the file is pinned to the original inode, and the rename swaps that inode
+ * out — leaving the watcher silently attached to a file that no longer has a
+ * name. Watching the directory survives renames: we receive a `rename` event
+ * for the target filename each time a write lands, and re-run the reloader.
+ */
+const dirWatchers = new Map();
+function watchFile(filePath, reload, logger) {
+    const dir = path.dirname(filePath);
+    const base = path.basename(filePath);
+    let debounceTimer = null;
+    const handler = () => {
+        if (debounceTimer)
+            clearTimeout(debounceTimer);
+        debounceTimer = setTimeout(() => {
+            reload().catch(() => {
+                // Reload errors are non-fatal — keep using cached data
+            });
+            logger.info(`Reloaded ${base}`);
+        }, 200);
+    };
+    let handlers = dirWatchers.get(dir);
+    if (!handlers) {
+        handlers = new Map();
+        dirWatchers.set(dir, handlers);
+        try {
+            watch(dir, (_eventType, filename) => {
+                if (!filename)
+                    return;
+                const cb = handlers.get(filename);
+                if (cb)
+                    cb();
+            });
+        }
+        catch {
+            // Parent directory doesn't exist yet — watcher not set up.
+            dirWatchers.delete(dir);
+            return;
+        }
+    }
+    handlers.set(base, handler);
+}
+// ---------------------------------------------------------------------------
+// Server startup
+// ---------------------------------------------------------------------------
+export async function createServer() {
+    const server = Fastify({
+        logger: true,
+        trustProxy: 1,
+    });
+    // Global rate limit. The gatekeeper binds to 127.0.0.1 and is reached
+    // exclusively by nginx auth_request and the panel proxy — both are
+    // local services. Because every caller arrives from 127.0.0.1, a
+    // per-IP limiter would collapse them into a single bucket and either
+    // be useless or punish legitimate nginx traffic. We collapse the key
+    // explicitly to one shared bucket and set a high ceiling; the hot
+    // /authz/check route then overrides this with its own ceiling that
+    // makes the "nginx-only" assumption explicit.
+    await server.register(rateLimit, {
+        max: 1000,
+        timeWindow: '1 minute',
+        keyGenerator: () => 'gatekeeper-internal',
+    });
+    // Load initial state
+    tunnelsCache = await loadTunnels();
+    settingsCache = await loadSettings();
+    // Decorate server with shared state accessors
+    server.decorate('getTunnels', () => tunnelsCache);
+    server.decorate('getSettings', () => settingsCache);
+    server.decorate('getSessionCache', () => sessionCache);
+    server.decorate('getCacheVersion', () => cacheVersion);
+    const bustCache = () => {
+        cacheVersion++;
+        sessionCache.clear();
+    };
+    server.decorate('bustCache', bustCache);
+    registerCacheInvalidator(bustCache);
+    server.decorate('updateSettings', (s) => {
+        settingsCache = s;
+    });
+    // Watch state files for changes
+    watchFile(tunnelsPath, async () => {
+        tunnelsCache = await loadTunnels();
+    }, server.log);
+    // TODO(sqlite-step-4): groups.json and access-grants.json are now
+    // .migrated stubs after first SQLite open. These watch registrations stay
+    // attached to the old paths so they never fire — every authz read goes
+    // through the DB and is always current, but admin grant/group changes do
+    // not invalidate the in-memory session cache without a daemon restart.
+    // Replace with a DB-modtime sentinel that the writer touches on commit
+    // (or polled `PRAGMA data_version`) once Step 4 (rodeo) is green.
+    watchFile(path.join(dataDir, GROUPS_FILE), async () => {
+        // Groups are read from SQLite on each call,
+        // but clearing session cache ensures authz re-evaluates group membership
+        sessionCache.clear();
+    }, server.log);
+    watchFile(path.join(dataDir, GRANTS_FILE), async () => {
+        // Same — clear session cache so authz picks up grant changes
+        sessionCache.clear();
+    }, server.log);
+    watchFile(settingsPath, async () => {
+        settingsCache = await loadSettings();
+    }, server.log);
+    // Load or generate API secret for localhost management auth.
+    // The secret is wrapped in a JSON envelope and written atomically so a
+    // crash during initial generation never leaves a half-written file
+    // (which the next start would treat as "no secret yet" and rotate, breaking
+    // any external client holding the previous value).
+    const secretPath = path.join(dataDir, 'gatekeeper-secret.json');
+    const legacySecretPath = path.join(dataDir, 'gatekeeper-secret');
+    let apiSecret;
+    try {
+        const raw = await readFile(secretPath, 'utf-8');
+        const parsed = JSON.parse(raw);
+        if (typeof parsed.secret !== 'string' || parsed.secret.length === 0) {
+            throw new Error('gatekeeper-secret.json is missing the "secret" field');
+        }
+        apiSecret = parsed.secret;
+    }
+    catch (err) {
+        if (err.code !== 'ENOENT') {
+            // Existing file is corrupt — refuse to rotate silently. An operator must
+            // resolve this so external callers do not lose their pinned secret.
+            throw err;
+        }
+        // First-run path: try migrating the legacy plaintext file before generating.
+        try {
+            const legacy = (await readFile(legacySecretPath, 'utf-8')).trim();
+            if (legacy.length > 0) {
+                apiSecret = legacy;
+                await atomicWriteJSON(secretPath, { secret: apiSecret }, { mkdirp: true });
+                server.log.info('Migrated legacy gatekeeper-secret file to JSON envelope');
+            }
+            else {
+                throw new Error('legacy gatekeeper-secret was empty');
+            }
+        }
+        catch {
+            apiSecret = crypto.randomBytes(32).toString('hex');
+            await atomicWriteJSON(secretPath, { secret: apiSecret }, { mkdirp: true });
+            server.log.info('Generated new gatekeeper API secret');
+        }
+    }
+    // Register routes — authz, access-request, and health are public (nginx subrequests)
+    await server.register(authzRoutes);
+    await server.register(accessRequestRoutes);
+    // Management /api/* routes require the shared secret
+    await server.register(async (scope) => {
+        scope.addHook('onRequest', async (request, reply) => {
+            const auth = request.headers['x-gatekeeper-secret'];
+            if (auth !== apiSecret) {
+                return reply.code(401).send({ error: 'Unauthorized' });
+            }
+        });
+        await scope.register(groupRoutes, { prefix: '/api' });
+        await scope.register(grantRoutes, { prefix: '/api' });
+        await scope.register(diagnosticRoutes, { prefix: '/api' });
+    });
+    // Health endpoint
+    server.get('/health', async () => ({ status: 'ok' }));
+    return server;
+}
+// ---------------------------------------------------------------------------
+// Entry point
+// ---------------------------------------------------------------------------
+async function start() {
+    const server = await createServer();
+    await server.listen({
+        host: '127.0.0.1',
+        port: GATEKEEPER_PORT,
+    });
+    // Graceful shutdown
+    const shutdown = async (signal) => {
+        server.log.info({ signal }, 'Received signal, shutting down gracefully');
+        await server.close();
+        process.exit(0);
+    };
+    process.on('SIGTERM', () => void shutdown('SIGTERM'));
+    process.on('SIGINT', () => void shutdown('SIGINT'));
+}
+start().catch((err) => {
+    console.error('Failed to start gatekeeper:', err);
+    process.exit(1);
+});
+//# sourceMappingURL=index.js.map

package/vendor/gatekeeper/dist/server/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,YAAY,CAAC;AACpB,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,SAAS,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,WAAW,EACX,aAAa,EACb,eAAe,EACf,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,gBAAgB,CAAC;AAC3E,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;AACvD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;AAEvD,8EAA8E;AAC9E,mDAAmD;AACnD,8EAA8E;AAE9E,mDAAmD;AACnD,IAAI,YAAY,GAAiB,EAAE,CAAC;AAEpC,gCAAgC;AAChC,IAAI,aAAa,GAAuB,EAAE,CAAC;AAE3C,yDAAyD;AACzD,MAAM,YAAY,GAAG,IAAI,GAAG,EAA2B,CAAC;AAExD,wDAAwD;AACxD,IAAI,YAAY,GAAG,CAAC,CAAC;AAErB,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,KAAK,UAAU,WAAW;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACjD,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QACtC,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAA0B,EAAE,EAAE,CAAC,CAAC;YACjD,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;YACtB,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;YAC1B,UAAU,EAAG,CAAC,CAAC,UAAuC,IAAI,YAAY;YACtE,OAAO,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK;SAC7B,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY;IACzB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAuB,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,WAAW,GAAG,IAAI,GAAG,EAAmC,CAAC;AAE/D,SAAS,SAAS,CAChB,QAAgB,EAChB,MAA2B,EAC3B,MAAuC;IAEvC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,aAAa,GAAyC,IAAI,CAAC;IAE/D,MAAM,OAAO,GAAG,GAAS,EAAE;QACzB,IAAI,aAAa;YAAE,YAAY,CAAC,aAAa,CAAC,CAAC;QAC/C,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE;YAC9B,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;gBAClB,uDAAuD;YACzD,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;QAClC,CAAC,EAAE,GAAG,CAAC,CAAC;IACV,CAAC,CAAC;IAEF,IAAI,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,QAAQ,GAAG,IAAI,GAAG,EAAE,CAAC;QACrB,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC/B,IAAI,CAAC;YACH,KAAK,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,EAAE;gBAClC,IAAI,CAAC,QAAQ;oBAAE,OAAO;gBACtB,MAAM,EAAE,GAAG,QAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACnC,IAAI,EAAE;oBAAE,EAAE,EAAE,CAAC;YACf,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,2DAA2D;YAC3D,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACxB,OAAO;QACT,CAAC;IACH,CAAC;IACD,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,MAAM,GAAG,OAAO,CAAC;QACrB,MAAM,EAAE,IAAI;QACZ,UAAU,EAAE,CAAC;KACd,CAAC,CAAC;IAEH,sEAAsE;IACtE,mEAAmE;IACnE,iEAAiE;IACjE,qEAAqE;IACrE,qEAAqE;IACrE,kEAAkE;IAClE,mEAAmE;IACnE,8CAA8C;IAC9C,MAAM,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE;QAC/B,GAAG,EAAE,IAAI;QACT,UAAU,EAAE,UAAU;QACtB,YAAY,EAAE,GAAG,EAAE,CAAC,qBAAqB;KAC1C,CAAC,CAAC;IAEH,qBAAqB;IACrB,YAAY,GAAG,MAAM,WAAW,EAAE,CAAC;IACnC,aAAa,GAAG,MAAM,YAAY,EAAE,CAAC;IAErC,8CAA8C;IAC9C,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,CAAC,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,CAAC;IACpD,MAAM,CAAC,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC;IACvD,MAAM,CAAC,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,GAAS,EAAE;QAC3B,YAAY,EAAE,CAAC;QACf,YAAY,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC;IACF,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IACxC,wBAAwB,CAAC,SAAS,CAAC,CAAC;IACpC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAqB,EAAE,EAAE;QAC1D,aAAa,GAAG,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,gCAAgC;IAChC,SAAS,CACP,WAAW,EACX,KAAK,IAAI,EAAE;QACT,YAAY,GAAG,MAAM,WAAW,EAAE,CAAC;IACrC,CAAC,EACD,MAAM,CAAC,GAAG,CACX,CAAC;IAEF,kEAAkE;IAClE,0EAA0E;IAC1E,uEAAuE;IACvE,yEAAyE;IACzE,uEAAuE;IACvE,uEAAuE;IACvE,kEAAkE;IAClE,SAAS,CACP,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,EAC/B,KAAK,IAAI,EAAE;QACT,4CAA4C;QAC5C,yEAAyE;QACzE,YAAY,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,EACD,MAAM,CAAC,GAAG,CACX,CAAC;IAEF,SAAS,CACP,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,EAC/B,KAAK,IAAI,EAAE;QACT,6DAA6D;QAC7D,YAAY,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,EACD,MAAM,CAAC,GAAG,CACX,CAAC;IAEF,SAAS,CACP,YAAY,EACZ,KAAK,IAAI,EAAE;QACT,aAAa,GAAG,MAAM,YAAY,EAAE,CAAC;IACvC,CAAC,EACD,MAAM,CAAC,GAAG,CACX,CAAC;IAEF,6DAA6D;IAC7D,uEAAuE;IACvE,mEAAmE;IACnE,4EAA4E;IAC5E,mDAAmD;IACnD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;IAChE,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IACjE,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyB,CAAC;QACvD,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QACD,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,yEAAyE;YACzE,oEAAoE;YACpE,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,6EAA6E;QAC7E,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAClE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtB,SAAS,GAAG,MAAM,CAAC;gBACnB,MAAM,eAAe,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC3E,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;YAC7E,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACnD,MAAM,eAAe,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3E,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED,qFAAqF;IACrF,MAAM,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACnC,MAAM,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IAE3C,qDAAqD;IACrD,MAAM,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACpC,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YAClD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;YACpD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YACzD,CAAC;QACH,CAAC,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACtD,MAAM,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACtD,MAAM,KAAK,CAAC,QAAQ,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,kBAAkB;IAClB,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAEtD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E,KAAK,UAAU,KAAK;IAClB,MAAM,MAAM,GAAG,MAAM,YAAY,EAAE,CAAC;IAEpC,MAAM,MAAM,CAAC,MAAM,CAAC;QAClB,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,eAAe;KACtB,CAAC,CAAC;IAEH,oBAAoB;IACpB,MAAM,QAAQ,GAAG,KAAK,EAAE,MAAc,EAAiB,EAAE;QACvD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,2CAA2C,CAAC,CAAC;QACzE,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IACtD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACpB,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;IAClD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/vendor/gatekeeper/dist/server/routes/access-request.d.ts

@@ -0,0 +1,7 @@
+import type { FastifyInstance } from 'fastify';
+/**
+ * Standalone access-request page route.
+ * Used as a fallback when the inline 403 body approach isn't available.
+ */
+export declare function accessRequestRoutes(fastify: FastifyInstance): Promise<void>;
+//# sourceMappingURL=access-request.d.ts.map

package/vendor/gatekeeper/dist/server/routes/access-request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-request.d.ts","sourceRoot":"","sources":["../../../src/server/routes/access-request.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAG7E;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAYjF"}