@lamalibre/create-lamaste 4.0.0

package/vendor/gatekeeper/dist/server/routes/access-request.js

@@ -0,0 +1,17 @@
+import { buildAccessRequestPage } from '../../lib/templates.js';
+/**
+ * Standalone access-request page route.
+ * Used as a fallback when the inline 403 body approach isn't available.
+ */
+export async function accessRequestRoutes(fastify) {
+    fastify.get('/access-request', async (request, reply) => {
+        const tunnel = request.query.tunnel ?? 'unknown';
+        const username = request.headers['remote-user'] ?? 'unknown';
+        const html = buildAccessRequestPage(username, tunnel, {
+            adminContact: fastify.getSettings().adminEmail,
+            adminName: fastify.getSettings().adminName,
+        });
+        return reply.type('text/html; charset=utf-8').send(html);
+    });
+}
+//# sourceMappingURL=access-request.js.map

package/vendor/gatekeeper/dist/server/routes/access-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-request.js","sourceRoot":"","sources":["../../../src/server/routes/access-request.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAEhE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAAwB;IAChE,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACpF,MAAM,MAAM,GAAI,OAAO,CAAC,KAAgC,CAAC,MAAM,IAAI,SAAS,CAAC;QAC7E,MAAM,QAAQ,GAAI,OAAO,CAAC,OAAO,CAAC,aAAa,CAAY,IAAI,SAAS,CAAC;QAEzE,MAAM,IAAI,GAAG,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE;YACpD,YAAY,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,UAAU;YAC9C,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,SAAS;SAC3C,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC"}

package/vendor/gatekeeper/dist/server/routes/authz.d.ts

@@ -0,0 +1,3 @@
+import type { FastifyInstance } from 'fastify';
+export declare function authzRoutes(fastify: FastifyInstance): Promise<void>;
+//# sourceMappingURL=authz.d.ts.map

package/vendor/gatekeeper/dist/server/routes/authz.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz.d.ts","sourceRoot":"","sources":["../../../src/server/routes/authz.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAkI7E,wBAAsB,WAAW,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CA4LzE"}

package/vendor/gatekeeper/dist/server/routes/authz.js

@@ -0,0 +1,279 @@
+import crypto from 'node:crypto';
+import { request as undiciRequest } from 'undici';
+import { AUTHELIA_VERIFY_URL, SESSION_CACHE_TTL_MS } from '../../lib/constants.js';
+import { checkAccess } from '../../lib/authz.js';
+import { buildAccessRequestPage } from '../../lib/templates.js';
+import { logAccessRequest } from '../routes/diagnostic.js';
+/** Hard cap on session cache entries to prevent memory exhaustion on 512MB droplets. */
+const MAX_SESSION_CACHE_ENTRIES = 10_000;
+/** Cache-Control max-age for a successful authz response (matches nginx 200 TTL). */
+const AUTHZ_SUCCESS_MAX_AGE_SECONDS = 10;
+/** Upper bound on Authelia /verify call latency before we treat it as a denial. */
+const AUTHELIA_VERIFY_TIMEOUT_MS = 2_500;
+/**
+ * Per-process random key used to HMAC the cookie before storing it as a cache
+ * key. Without this, any actor with a valid cookie could compute the cache
+ * key and trigger collision-based attacks against cache-eviction logic.
+ */
+const COOKIE_HMAC_KEY = crypto.randomBytes(32);
+/**
+ * Extract the Authelia session cookie value from the full cookie header.
+ *
+ * Returns null when the cookie header is missing the `authelia_session=`
+ * pair. The Authelia session cookie is the only auth signal we accept on
+ * this path — any other cookie (CSRF tokens, analytics, etc.) carries no
+ * identity. Falling back to the raw header would let unrelated cookies
+ * drive the cache key, which would either pollute the cache or — once a
+ * future refactor caches negative results — let an unauthenticated request
+ * poison a downstream entry.
+ */
+function extractAutheliaCookie(cookie) {
+    const match = cookie.match(/(?:^|;\s*)authelia_session=([^;]*)/);
+    return match?.[1] ?? null;
+}
+/**
+ * Derive a session cache key from a cookie string using HMAC-SHA256.
+ *
+ * The HMAC key is per-process random — keys are not predictable from cookie
+ * values alone, which prevents an outsider from probing/seeding the cache.
+ */
+function hashCookie(cookie) {
+    return crypto.createHmac('sha256', COOKIE_HMAC_KEY).update(cookie).digest('hex');
+}
+/**
+ * Forward the request's cookies to Authelia's verify endpoint
+ * and extract the identity headers from the response.
+ */
+async function validateWithAuthelia(cookie, originalUrl, requestId) {
+    try {
+        // Authelia's `/api/authz/auth-request` needs both the target URL and
+        // method — without `X-Original-Method` it assumes `GET`, which is fine
+        // for navigation but silently mis-gates non-GET paths (e.g. form POSTs
+        // to protected endpoints). Send both.
+        const { statusCode, headers } = await undiciRequest(AUTHELIA_VERIFY_URL, {
+            method: 'GET',
+            headers: {
+                Cookie: cookie,
+                'X-Original-URL': originalUrl,
+                'X-Original-Method': 'GET',
+                'X-Forwarded-For': '127.0.0.1',
+                'X-Request-ID': requestId,
+            },
+            // Deny by default if Authelia is hung — the call gates every authz check
+            // on the hot path; a stuck request would block the whole request queue.
+            signal: AbortSignal.timeout(AUTHELIA_VERIFY_TIMEOUT_MS),
+        });
+        if (statusCode !== 200) {
+            return null;
+        }
+        const username = getHeader(headers, 'remote-user');
+        if (!username)
+            return null;
+        return {
+            username,
+            groups: getHeader(headers, 'remote-groups') ?? '',
+            displayName: getHeader(headers, 'remote-name') ?? '',
+            email: getHeader(headers, 'remote-email') ?? '',
+            expiresAt: Date.now() + SESSION_CACHE_TTL_MS,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function getHeader(headers, name) {
+    const val = headers[name];
+    if (Array.isArray(val))
+        return val[0];
+    return val;
+}
+/**
+ * Look up a tunnel by its FQDN from the in-memory cache.
+ */
+function findTunnelByFqdn(tunnels, fqdn) {
+    return tunnels.find((t) => t.fqdn === fqdn);
+}
+/**
+ * Parse an X-Original-URL header into its hostname and host components.
+ * Returns null when the value is not a parseable absolute URL.
+ */
+function parseOriginalUrl(originalUrl) {
+    try {
+        const parsed = new URL(originalUrl);
+        return { hostname: parsed.hostname, host: parsed.host };
+    }
+    catch {
+        return null;
+    }
+}
+// ---------------------------------------------------------------------------
+// Route plugin
+// ---------------------------------------------------------------------------
+export async function authzRoutes(fastify) {
+    /**
+     * GET /authz/check — nginx auth_request target
+     *
+     * Flow:
+     * 1. Read Cookie and X-Original-URL from nginx
+     * 2. Validate Authelia session (cached in memory)
+     * 3. Look up tunnel by hostname
+     * 4. Check access mode and grants
+     * 5. Return 200 (allowed), 401 (not authenticated), or 403 (not authorized)
+     *
+     * On 403, the response body is the full access-request HTML page
+     * (nginx serves this inline on the tunnel's FQDN via error_page 403 =).
+     */
+    fastify.get('/authz/check', {
+        // nginx is the only client (the gatekeeper binds 127.0.0.1) and
+        // it expects one call per cache miss on every protected request.
+        // Per-IP throttling here would punish legitimate traffic because
+        // every caller arrives as 127.0.0.1. We collapse the key to a
+        // single bucket and raise the ceiling to an effectively-unlimited
+        // 10k/min so the rate-limit is structurally present (CodeQL
+        // js/missing-rate-limiting) without breaking the hot path.
+        config: {
+            rateLimit: {
+                max: 10_000,
+                timeWindow: '1 minute',
+                keyGenerator: () => 'gatekeeper-internal',
+            },
+        },
+    }, async (request, reply) => {
+        const requestId = request.id;
+        const cookie = request.headers['cookie'] ?? '';
+        const originalUrl = request.headers['x-original-url'] ?? '';
+        if (!cookie || !originalUrl) {
+            return reply.code(401).send();
+        }
+        // Parse and validate X-Original-URL before any other work.
+        // Defense-in-depth: the 127.0.0.1 bind + nginx auth_request boundary is
+        // the primary guarantee that this header is trustworthy; host matching
+        // ensures a misconfigured proxy chain cannot forge tunnel identity.
+        const parsed = parseOriginalUrl(originalUrl);
+        if (!parsed) {
+            request.log.info({ requestId, reason: 'invalid_original_url' }, 'authz denied');
+            return reply.code(401).send();
+        }
+        // Host header check: when nginx forwards the parent request's Host to the
+        // subrequest (default behavior for auth_request), the hostname portion
+        // must match the hostname parsed from X-Original-URL. Port differences
+        // are ignored — nginx often normalizes them. An absent Host header skips
+        // the check (some proxies strip it from internal subrequests).
+        const hostHeader = request.headers['host'] ?? '';
+        if (hostHeader) {
+            const hostOnly = hostHeader.split(':')[0]?.toLowerCase() ?? '';
+            if (hostOnly && hostOnly !== parsed.hostname.toLowerCase()) {
+                request.log.info({
+                    requestId,
+                    reason: 'host_header_mismatch',
+                    originalHost: parsed.hostname,
+                    hostHeader,
+                }, 'authz denied');
+                return reply.code(401).send();
+            }
+        }
+        const tunnels = fastify.getTunnels();
+        const tunnel = findTunnelByFqdn(tunnels, parsed.hostname);
+        if (!tunnel) {
+            request.log.info({ requestId, reason: 'unknown_tunnel_fqdn', fqdn: parsed.hostname }, 'authz denied');
+            return reply.code(401).send();
+        }
+        // Check session cache (keyed by Authelia session cookie only to prevent
+        // cache pollution via unrelated cookies like CSRF tokens or analytics).
+        const autheliaCookie = extractAutheliaCookie(cookie);
+        if (!autheliaCookie) {
+            // No authelia_session — short-circuit before any cache work or the
+            // upstream Authelia /verify call. Without this, an unauthenticated
+            // request would still cost us an Authelia round-trip.
+            request.log.info({ requestId, reason: 'missing_authelia_cookie', fqdn: parsed.hostname }, 'authz denied');
+            return reply.code(401).send();
+        }
+        const cacheKey = hashCookie(autheliaCookie);
+        const sessionCache = fastify.getSessionCache();
+        const cached = sessionCache.get(cacheKey);
+        const now = Date.now();
+        let session;
+        if (cached && cached.expiresAt > now) {
+            session = cached;
+        }
+        else {
+            if (cached) {
+                // Lazy TTL eviction — one stale entry pruned per request.
+                sessionCache.delete(cacheKey);
+            }
+            const validated = await validateWithAuthelia(cookie, originalUrl, requestId);
+            if (!validated) {
+                request.log.info({ requestId, reason: 'authelia_rejected', fqdn: parsed.hostname }, 'authz denied');
+                return reply.code(401).send();
+            }
+            // Opportunistic eviction — drop oldest (insertion-order head) when at cap.
+            while (sessionCache.size >= MAX_SESSION_CACHE_ENTRIES) {
+                const oldestKey = sessionCache.keys().next().value;
+                if (oldestKey === undefined)
+                    break;
+                sessionCache.delete(oldestKey);
+            }
+            sessionCache.set(cacheKey, validated);
+            session = validated;
+        }
+        // Check access mode
+        if (tunnel.accessMode === 'public' || tunnel.accessMode === 'authenticated') {
+            setAutheliaHeaders(reply, session);
+            reply.header('Cache-Control', `public, max-age=${AUTHZ_SUCCESS_MAX_AGE_SECONDS}`);
+            reply.header('X-Gatekeeper-Cache-Version', String(fastify.getCacheVersion()));
+            return reply.code(200).send();
+        }
+        // restricted — check grants
+        const result = await checkAccess(session.username, 'tunnel', tunnel.id, {
+            adminContact: fastify.getSettings().adminEmail,
+            adminName: fastify.getSettings().adminName,
+        });
+        if (result.allowed) {
+            setAutheliaHeaders(reply, session);
+            reply.header('Cache-Control', `public, max-age=${AUTHZ_SUCCESS_MAX_AGE_SECONDS}`);
+            reply.header('X-Gatekeeper-Cache-Version', String(fastify.getCacheVersion()));
+            return reply.code(200).send();
+        }
+        request.log.info({
+            requestId,
+            reason: 'no_matching_grant',
+            username: session.username,
+            resourceType: 'tunnel',
+            resourceId: tunnel.id,
+            requiredGrant: `tunnel:${tunnel.id}`,
+            fqdn: parsed.hostname,
+        }, 'authz denied');
+        if (fastify.getSettings().accessLoggingEnabled) {
+            logAccessRequest({
+                timestamp: new Date().toISOString(),
+                username: session.username,
+                resourceType: 'tunnel',
+                resourceId: tunnel.id,
+                resourceFqdn: parsed.hostname,
+            });
+        }
+        // Access denied — return inline HTML page as 403 body.
+        // Cache-Control: no-store so nginx never caches the denial; the matching
+        // proxy_cache_valid 403 0 in the snippet is the authoritative setting.
+        const html = buildAccessRequestPage(session.username, parsed.hostname, {
+            adminContact: fastify.getSettings().adminEmail,
+            adminName: fastify.getSettings().adminName,
+        });
+        return reply
+            .code(403)
+            .header('Cache-Control', 'no-store')
+            .type('text/html; charset=utf-8')
+            .send(html);
+    });
+}
+/**
+ * Set Authelia identity headers on the response so nginx can
+ * forward them to the tunnel backend.
+ */
+function setAutheliaHeaders(reply, session) {
+    reply.header('remote-user', session.username);
+    reply.header('remote-groups', session.groups);
+    reply.header('remote-name', session.displayName);
+    reply.header('remote-email', session.email);
+}
+//# sourceMappingURL=authz.js.map

package/vendor/gatekeeper/dist/server/routes/authz.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz.js","sourceRoot":"","sources":["../../../src/server/routes/authz.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAG3D,wFAAwF;AACxF,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAEzC,qFAAqF;AACrF,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAEzC,mFAAmF;AACnF,MAAM,0BAA0B,GAAG,KAAK,CAAC;AAEzC;;;;GAIG;AACH,MAAM,eAAe,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;AAE/C;;;;;;;;;;GAUG;AACH,SAAS,qBAAqB,CAAC,MAAc;IAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACjE,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC5B,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnF,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,oBAAoB,CACjC,MAAc,EACd,WAAmB,EACnB,SAAiB;IAEjB,IAAI,CAAC;QACH,qEAAqE;QACrE,uEAAuE;QACvE,uEAAuE;QACvE,sCAAsC;QACtC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,aAAa,CAAC,mBAAmB,EAAE;YACvE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,MAAM,EAAE,MAAM;gBACd,gBAAgB,EAAE,WAAW;gBAC7B,mBAAmB,EAAE,KAAK;gBAC1B,iBAAiB,EAAE,WAAW;gBAC9B,cAAc,EAAE,SAAS;aAC1B;YACD,yEAAyE;YACzE,wEAAwE;YACxE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,0BAA0B,CAAC;SACxD,CAAC,CAAC;QAEH,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QACnD,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE3B,OAAO;YACL,QAAQ;YACR,MAAM,EAAE,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC,IAAI,EAAE;YACjD,WAAW,EAAE,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC,IAAI,EAAE;YACpD,KAAK,EAAE,SAAS,CAAC,OAAO,EAAE,cAAc,CAAC,IAAI,EAAE;YAC/C,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,oBAAoB;SAC7C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAChB,OAAsD,EACtD,IAAY;IAEZ,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;IACtC,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CAAC,OAA8B,EAAE,IAAY;IACpE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,WAAmB;IAC3C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAwB;IACxD;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,GAAG,CACT,cAAc,EACd;QACE,gEAAgE;QAChE,iEAAiE;QACjE,iEAAiE;QACjE,8DAA8D;QAC9D,kEAAkE;QAClE,4DAA4D;QAC5D,2DAA2D;QAC3D,MAAM,EAAE;YACN,SAAS,EAAE;gBACT,GAAG,EAAE,MAAM;gBACX,UAAU,EAAE,UAAU;gBACtB,YAAY,EAAE,GAAG,EAAE,CAAC,qBAAqB;aAC1C;SACF;KACF,EACD,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/C,MAAM,WAAW,GAAI,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAY,IAAI,EAAE,CAAC;QAExE,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;YAC5B,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAChC,CAAC;QAED,2DAA2D;QAC3D,wEAAwE;QACxE,uEAAuE;QACvE,oEAAoE;QACpE,MAAM,MAAM,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,sBAAsB,EAAE,EAAE,cAAc,CAAC,CAAC;YAChF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAChC,CAAC;QAED,0EAA0E;QAC1E,uEAAuE;QACvE,uEAAuE;QACvE,yEAAyE;QACzE,+DAA+D;QAC/D,MAAM,UAAU,GAAI,OAAO,CAAC,OAAO,CAAC,MAAM,CAAwB,IAAI,EAAE,CAAC;QACzE,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;YAC/D,IAAI,QAAQ,IAAI,QAAQ,KAAK,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;gBAC3D,OAAO,CAAC,GAAG,CAAC,IAAI,CACd;oBACE,SAAS;oBACT,MAAM,EAAE,sBAAsB;oBAC9B,YAAY,EAAE,MAAM,CAAC,QAAQ;oBAC7B,UAAU;iBACX,EACD,cAAc,CACf,CAAC;gBACF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YAChC,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,GAAG,CAAC,IAAI,CACd,EAAE,SAAS,EAAE,MAAM,EAAE,qBAAqB,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,EACnE,cAAc,CACf,CAAC;YACF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAChC,CAAC;QAED,wEAAwE;QACxE,wEAAwE;QACxE,MAAM,cAAc,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;QACrD,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,mEAAmE;YACnE,mEAAmE;YACnE,sDAAsD;YACtD,OAAO,CAAC,GAAG,CAAC,IAAI,CACd,EAAE,SAAS,EAAE,MAAM,EAAE,yBAAyB,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,EACvE,cAAc,CACf,CAAC;YACF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAChC,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC;QAC5C,MAAM,YAAY,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,OAAoC,CAAC;QAEzC,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;YACrC,OAAO,GAAG,MAAM,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,IAAI,MAAM,EAAE,CAAC;gBACX,0DAA0D;gBAC1D,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAChC,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;YAC7E,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,CAAC,GAAG,CAAC,IAAI,CACd,EAAE,SAAS,EAAE,MAAM,EAAE,mBAAmB,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,EACjE,cAAc,CACf,CAAC;gBACF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YAChC,CAAC;YAED,2EAA2E;YAC3E,OAAO,YAAY,CAAC,IAAI,IAAI,yBAAyB,EAAE,CAAC;gBACtD,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;gBACnD,IAAI,SAAS,KAAK,SAAS;oBAAE,MAAM;gBACnC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACjC,CAAC;YAED,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YACtC,OAAO,GAAG,SAAS,CAAC;QACtB,CAAC;QAED,oBAAoB;QACpB,IAAI,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,KAAK,eAAe,EAAE,CAAC;YAC5E,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACnC,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,mBAAmB,6BAA6B,EAAE,CAAC,CAAC;YAClF,KAAK,CAAC,MAAM,CAAC,4BAA4B,EAAE,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC;YAC9E,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAChC,CAAC;QAED,4BAA4B;QAC5B,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE;YACtE,YAAY,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,UAAU;YAC9C,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,SAAS;SAC3C,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACnC,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,mBAAmB,6BAA6B,EAAE,CAAC,CAAC;YAClF,KAAK,CAAC,MAAM,CAAC,4BAA4B,EAAE,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC;YAC9E,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAChC,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,IAAI,CACd;YACE,SAAS;YACT,MAAM,EAAE,mBAAmB;YAC3B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,YAAY,EAAE,QAAQ;YACtB,UAAU,EAAE,MAAM,CAAC,EAAE;YACrB,aAAa,EAAE,UAAU,MAAM,CAAC,EAAE,EAAE;YACpC,IAAI,EAAE,MAAM,CAAC,QAAQ;SACtB,EACD,cAAc,CACf,CAAC;QAEF,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,oBAAoB,EAAE,CAAC;YAC/C,gBAAgB,CAAC;gBACf,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,YAAY,EAAE,QAAQ;gBACtB,UAAU,EAAE,MAAM,CAAC,EAAE;gBACrB,YAAY,EAAE,MAAM,CAAC,QAAQ;aAC9B,CAAC,CAAC;QACL,CAAC;QAED,uDAAuD;QACvD,yEAAyE;QACzE,uEAAuE;QACvE,MAAM,IAAI,GAAG,sBAAsB,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;YACrE,YAAY,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,UAAU;YAC9C,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,SAAS;SAC3C,CAAC,CAAC;QAEH,OAAO,KAAK;aACT,IAAI,CAAC,GAAG,CAAC;aACT,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC;aACnC,IAAI,CAAC,0BAA0B,CAAC;aAChC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC,CACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,KAAmB,EAAE,OAAwB;IACvE,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9C,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9C,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IACjD,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9C,CAAC"}

package/vendor/gatekeeper/dist/server/routes/diagnostic.d.ts

@@ -0,0 +1,13 @@
+import type { FastifyInstance } from 'fastify';
+import type { AccessRequestEntry } from '../../lib/types.js';
+export declare function diagnosticRoutes(fastify: FastifyInstance): Promise<void>;
+/**
+ * Log a denied access request (called from authz route).
+ *
+ * Non-blocking: enqueues the entry and returns synchronously. A background
+ * drainer flushes batches every 100ms via a single SQLite transaction.
+ * Entries queued within the last 100ms of a crash may be lost — the trade-off
+ * for keeping the nginx hot path free of disk I/O.
+ */
+export declare function logAccessRequest(entry: AccessRequestEntry): void;
+//# sourceMappingURL=diagnostic.d.ts.map

package/vendor/gatekeeper/dist/server/routes/diagnostic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnostic.d.ts","sourceRoot":"","sources":["../../../src/server/routes/diagnostic.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAO7E,OAAO,KAAK,EAAsB,kBAAkB,EAAoB,MAAM,oBAAoB,CAAC;AAyLnG,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAgG9E;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,kBAAkB,GAAG,IAAI,CAEhE"}

package/vendor/gatekeeper/dist/server/routes/diagnostic.js

@@ -0,0 +1,249 @@
+import path from 'node:path';
+import { z } from 'zod';
+import { atomicWriteJSON } from '@lamalibre/lamaste';
+import { checkAccess } from '../../lib/authz.js';
+import { DEFAULT_DATA_DIR, SETTINGS_FILE } from '../../lib/constants.js';
+import { getGatekeeperDb } from '../../lib/state-db.js';
+const dataDir = process.env['LAMALIBRE_LAMASTE_DATA_DIR'] ?? DEFAULT_DATA_DIR;
+const settingsPath = path.join(dataDir, SETTINGS_FILE);
+const LOG_QUEUE_MAX = 1000;
+const LOG_DRAIN_INTERVAL_MS = 100;
+const LOG_OVERFLOW_WARN_INTERVAL_MS = 60_000;
+const DEFAULT_RETENTION_DAYS = 90;
+// Retention sweep cadence — once per drain tick is wasteful (DELETE every
+// 100ms), and once per process lifetime is too coarse. Hourly matches the
+// JSON-era rotation cadence loosely and is comfortably below any sensible
+// retention setting.
+const RETENTION_SWEEP_INTERVAL_MS = 60 * 60 * 1000;
+const UpdateSettingsSchema = z.object({
+    adminEmail: z.string().email().max(200).optional(),
+    adminName: z.string().max(200).optional(),
+    slackChannel: z.string().max(200).optional(),
+    teamsChannel: z.string().max(200).optional(),
+    sessionCacheTtlMs: z.number().int().min(1000).max(300000).optional(),
+    accessLoggingEnabled: z.boolean().optional(),
+    accessLogRetentionDays: z.number().int().min(1).max(365).optional(),
+});
+let stmts = null;
+async function getStmts() {
+    if (stmts)
+        return stmts;
+    const db = await getGatekeeperDb();
+    stmts = {
+        insert: db.prepare(`
+      INSERT INTO access_request_log
+        (timestamp, username, resource_type, resource_id, resource_fqdn)
+      VALUES (?, ?, ?, ?, ?)
+    `),
+        // Newest-first pagination: id is autoincrement so DESC order matches
+        // insertion order more cheaply than sorting on `timestamp`.
+        selectPage: db.prepare('SELECT * FROM access_request_log ORDER BY id DESC LIMIT ? OFFSET ?'),
+        countAll: db.prepare('SELECT COUNT(*) AS n FROM access_request_log'),
+        deleteAll: db.prepare('DELETE FROM access_request_log'),
+        deleteOlderThan: db.prepare('DELETE FROM access_request_log WHERE timestamp < ?'),
+        begin: db.prepare('BEGIN IMMEDIATE'),
+        commit: db.prepare('COMMIT'),
+        rollback: db.prepare('ROLLBACK'),
+    };
+    return stmts;
+}
+function rowToEntry(row) {
+    return {
+        timestamp: row.timestamp,
+        username: row.username,
+        resourceType: row.resource_type,
+        resourceId: row.resource_id,
+        resourceFqdn: row.resource_fqdn,
+    };
+}
+// ---------------------------------------------------------------------------
+// Persistence (batched insert, retention sweep)
+// ---------------------------------------------------------------------------
+async function persistEntries(entries) {
+    if (entries.length === 0)
+        return;
+    const s = await getStmts();
+    s.begin.run();
+    try {
+        for (const e of entries) {
+            s.insert.run(e.timestamp, e.username, e.resourceType, e.resourceId, e.resourceFqdn);
+        }
+        s.commit.run();
+    }
+    catch (err) {
+        s.rollback.run();
+        throw err;
+    }
+}
+let lastRetentionSweepAt = 0;
+let retentionDaysOverride = null;
+function setRetentionDays(days) {
+    retentionDaysOverride = days;
+}
+async function maybeSweepRetention() {
+    const now = Date.now();
+    if (now - lastRetentionSweepAt < RETENTION_SWEEP_INTERVAL_MS)
+        return;
+    lastRetentionSweepAt = now;
+    const days = retentionDaysOverride ?? DEFAULT_RETENTION_DAYS;
+    const cutoff = new Date(now - days * 24 * 60 * 60 * 1000).toISOString();
+    const s = await getStmts();
+    s.deleteOlderThan.run(cutoff);
+}
+// ---------------------------------------------------------------------------
+// Fire-and-forget queue + drainer
+// ---------------------------------------------------------------------------
+let logQueue = [];
+let drainTimer = null;
+let lastOverflowWarnAt = 0;
+let accessLogger = null;
+function startDrainerIfNeeded() {
+    if (drainTimer)
+        return;
+    drainTimer = setInterval(() => {
+        if (logQueue.length === 0) {
+            // Even when idle, occasionally sweep retention so a long-running
+            // gatekeeper does not accumulate ancient entries.
+            maybeSweepRetention().catch((err) => {
+                accessLogger?.error({ err: err.message }, 'Failed retention sweep');
+            });
+            return;
+        }
+        const batch = logQueue;
+        logQueue = [];
+        persistEntries(batch)
+            .then(() => maybeSweepRetention())
+            .catch((err) => {
+            accessLogger?.error({ err: err.message }, 'Failed to persist access log batch');
+        });
+    }, LOG_DRAIN_INTERVAL_MS);
+    // Allow the process to exit cleanly during shutdown / tests.
+    drainTimer.unref?.();
+}
+function enqueueAccessLog(entry) {
+    if (logQueue.length >= LOG_QUEUE_MAX) {
+        // Drop oldest to bound memory. Rate-limit the warning to once per minute
+        // so a sustained overflow does not itself become a log storm.
+        logQueue.shift();
+        const now = Date.now();
+        if (now - lastOverflowWarnAt >= LOG_OVERFLOW_WARN_INTERVAL_MS) {
+            lastOverflowWarnAt = now;
+            accessLogger?.warn({ queueMax: LOG_QUEUE_MAX }, 'Access log queue full — dropping oldest entries');
+        }
+    }
+    logQueue.push(entry);
+    startDrainerIfNeeded();
+}
+// ---------------------------------------------------------------------------
+// Settings I/O (gatekeeper.json stays JSON — out of migration scope)
+// ---------------------------------------------------------------------------
+async function saveSettings(settings) {
+    await atomicWriteJSON(settingsPath, settings, { mkdirp: true, mode: 0o600 });
+}
+// ---------------------------------------------------------------------------
+// Routes
+// ---------------------------------------------------------------------------
+export async function diagnosticRoutes(fastify) {
+    // Adopt the Fastify logger for access-log queue diagnostics.
+    accessLogger = fastify.log;
+    // Pick up the initial retention setting from the in-memory settings cache.
+    setRetentionDays(fastify.getSettings().accessLogRetentionDays ?? null);
+    startDrainerIfNeeded();
+    // GET /api/access/check — test access for a user
+    fastify.get('/access/check', async (request, reply) => {
+        const query = request.query;
+        const username = query.username;
+        const resourceType = query.resourceType;
+        const resourceId = query.resourceId;
+        if (!username || !resourceType || !resourceId) {
+            return reply.code(400).send({
+                error: 'Missing required query params: username, resourceType, resourceId',
+            });
+        }
+        try {
+            const result = await checkAccess(username, resourceType, resourceId);
+            return result;
+        }
+        catch (err) {
+            return reply.code(500).send({ error: err.message });
+        }
+    });
+    // POST /api/cache/bust — invalidate all cached auth decisions
+    fastify.post('/cache/bust', async (_request, reply) => {
+        fastify.bustCache();
+        return { ok: true };
+    });
+    // GET /api/settings — get gatekeeper settings
+    fastify.get('/settings', async (_request, _reply) => {
+        return { settings: fastify.getSettings() };
+    });
+    // PATCH /api/settings — update gatekeeper settings
+    fastify.patch('/settings', async (request, reply) => {
+        let body;
+        try {
+            body = UpdateSettingsSchema.parse(request.body);
+        }
+        catch (err) {
+            return reply
+                .code(400)
+                .send({ error: 'Invalid request body', details: err.errors });
+        }
+        try {
+            const current = fastify.getSettings();
+            const updated = { ...current, ...body };
+            await saveSettings(updated);
+            fastify.updateSettings(updated);
+            // Honor a freshly-set retention without waiting for a daemon restart.
+            if (body.accessLogRetentionDays !== undefined) {
+                setRetentionDays(body.accessLogRetentionDays);
+            }
+            return { ok: true, settings: updated };
+        }
+        catch (err) {
+            return reply.code(500).send({ error: err.message });
+        }
+    });
+    // GET /api/access-log — get access request log (newest first, paginated)
+    fastify.get('/access-log', async (request, reply) => {
+        const query = request.query;
+        const limit = Math.max(1, Math.min(Number(query.limit) || 100, 1000));
+        const offset = Math.max(0, Number(query.offset) || 0);
+        try {
+            const s = await getStmts();
+            const totalRow = s.countAll.get();
+            const rows = s.selectPage.all(limit, offset);
+            return {
+                entries: rows.map(rowToEntry),
+                total: totalRow.n,
+                limit,
+                offset,
+            };
+        }
+        catch (err) {
+            return reply.code(500).send({ error: err.message });
+        }
+    });
+    // DELETE /api/access-log — clear access request log
+    fastify.delete('/access-log', async (_request, reply) => {
+        try {
+            const s = await getStmts();
+            s.deleteAll.run();
+            return { ok: true };
+        }
+        catch (err) {
+            return reply.code(500).send({ error: err.message });
+        }
+    });
+}
+/**
+ * Log a denied access request (called from authz route).
+ *
+ * Non-blocking: enqueues the entry and returns synchronously. A background
+ * drainer flushes batches every 100ms via a single SQLite transaction.
+ * Entries queued within the last 100ms of a crash may be lost — the trade-off
+ * for keeping the nginx hot path free of disk I/O.
+ */
+export function logAccessRequest(entry) {
+    enqueueAccessLog(entry);
+}
+//# sourceMappingURL=diagnostic.js.map

package/vendor/gatekeeper/dist/server/routes/diagnostic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnostic.js","sourceRoot":"","sources":["../../../src/server/routes/diagnostic.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAGxD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,IAAI,gBAAgB,CAAC;AAC9E,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;AAEvD,MAAM,aAAa,GAAG,IAAI,CAAC;AAC3B,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAClC,MAAM,6BAA6B,GAAG,MAAM,CAAC;AAC7C,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAClC,0EAA0E;AAC1E,0EAA0E;AAC1E,0EAA0E;AAC1E,qBAAqB;AACrB,MAAM,2BAA2B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnD,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAClD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACzC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC5C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC5C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;IACpE,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC5C,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACpE,CAAC,CAAC;AAiBH,IAAI,KAAK,GAAoB,IAAI,CAAC;AAElC,KAAK,UAAU,QAAQ;IACrB,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;IACnC,KAAK,GAAG;QACN,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC;;;;KAIlB,CAAC;QACF,qEAAqE;QACrE,4DAA4D;QAC5D,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,oEAAoE,CAAC;QAC5F,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,8CAA8C,CAAC;QACpE,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,gCAAgC,CAAC;QACvD,eAAe,EAAE,EAAE,CAAC,OAAO,CAAC,oDAAoD,CAAC;QACjF,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC;QACpC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC5B,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC;KACjC,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC;AAeD,SAAS,UAAU,CAAC,GAAW;IAC7B,OAAO;QACL,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,YAAY,EAAE,GAAG,CAAC,aAAa;QAC/B,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,YAAY,EAAE,GAAG,CAAC,aAAa;KAChC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,gDAAgD;AAChD,8EAA8E;AAE9E,KAAK,UAAU,cAAc,CAAC,OAA6B;IACzD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACjC,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;IAC3B,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IACd,IAAI,CAAC;QACH,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC;QACtF,CAAC;QACD,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;IACjB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;QACjB,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,IAAI,oBAAoB,GAAG,CAAC,CAAC;AAC7B,IAAI,qBAAqB,GAAkB,IAAI,CAAC;AAEhD,SAAS,gBAAgB,CAAC,IAAmB;IAC3C,qBAAqB,GAAG,IAAI,CAAC;AAC/B,CAAC;AAED,KAAK,UAAU,mBAAmB;IAChC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,GAAG,GAAG,oBAAoB,GAAG,2BAA2B;QAAE,OAAO;IACrE,oBAAoB,GAAG,GAAG,CAAC;IAC3B,MAAM,IAAI,GAAG,qBAAqB,IAAI,sBAAsB,CAAC;IAC7D,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,GAAG,GAAG,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IACxE,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;IAC3B,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,8EAA8E;AAC9E,kCAAkC;AAClC,8EAA8E;AAE9E,IAAI,QAAQ,GAAyB,EAAE,CAAC;AACxC,IAAI,UAAU,GAA0C,IAAI,CAAC;AAC7D,IAAI,kBAAkB,GAAG,CAAC,CAAC;AAC3B,IAAI,YAAY,GAA4B,IAAI,CAAC;AAEjD,SAAS,oBAAoB;IAC3B,IAAI,UAAU;QAAE,OAAO;IACvB,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE;QAC5B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,iEAAiE;YACjE,kDAAkD;YAClD,mBAAmB,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBAClC,YAAY,EAAE,KAAK,CAAC,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,wBAAwB,CAAC,CAAC;YACjF,CAAC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,QAAQ,CAAC;QACvB,QAAQ,GAAG,EAAE,CAAC;QACd,cAAc,CAAC,KAAK,CAAC;aAClB,IAAI,CAAC,GAAG,EAAE,CAAC,mBAAmB,EAAE,CAAC;aACjC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,YAAY,EAAE,KAAK,CAAC,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,oCAAoC,CAAC,CAAC;QAC7F,CAAC,CAAC,CAAC;IACP,CAAC,EAAE,qBAAqB,CAAC,CAAC;IAC1B,6DAA6D;IAC7D,UAAU,CAAC,KAAK,EAAE,EAAE,CAAC;AACvB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAyB;IACjD,IAAI,QAAQ,CAAC,MAAM,IAAI,aAAa,EAAE,CAAC;QACrC,yEAAyE;QACzE,8DAA8D;QAC9D,QAAQ,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,GAAG,GAAG,kBAAkB,IAAI,6BAA6B,EAAE,CAAC;YAC9D,kBAAkB,GAAG,GAAG,CAAC;YACzB,YAAY,EAAE,IAAI,CAChB,EAAE,QAAQ,EAAE,aAAa,EAAE,EAC3B,iDAAiD,CAClD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,oBAAoB,EAAE,CAAC;AACzB,CAAC;AAED,8EAA8E;AAC9E,qEAAqE;AACrE,8EAA8E;AAE9E,KAAK,UAAU,YAAY,CAAC,QAA4B;IACtD,MAAM,eAAe,CAAC,YAAY,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAwB;IAC7D,6DAA6D;IAC7D,YAAY,GAAG,OAAO,CAAC,GAAuB,CAAC;IAC/C,2EAA2E;IAC3E,gBAAgB,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,sBAAsB,IAAI,IAAI,CAAC,CAAC;IACvE,oBAAoB,EAAE,CAAC;IAEvB,iDAAiD;IACjD,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAClF,MAAM,KAAK,GAAG,OAAO,CAAC,KAA2C,CAAC;QAClE,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QAChC,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;QACxC,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;QAEpC,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,IAAI,CAAC,UAAU,EAAE,CAAC;YAC9C,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,mEAAmE;aAC3E,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;YACrE,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,8DAA8D;IAC9D,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,QAAwB,EAAE,KAAmB,EAAE,EAAE;QAClF,OAAO,CAAC,SAAS,EAAE,CAAC;QACpB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,8CAA8C;IAC9C,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,QAAwB,EAAE,MAAoB,EAAE,EAAE;QAChF,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,mDAAmD;IACnD,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAChF,IAAI,IAA0C,CAAC;QAC/C,IAAI,CAAC;YACH,IAAI,GAAG,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,KAAK;iBACT,IAAI,CAAC,GAAG,CAAC;iBACT,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,OAAO,EAAG,GAAkB,CAAC,MAAM,EAAE,CAAC,CAAC;QAClF,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;YACtC,MAAM,OAAO,GAAuB,EAAE,GAAG,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;YAC5D,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;YAC5B,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;YAChC,sEAAsE;YACtE,IAAI,IAAI,CAAC,sBAAsB,KAAK,SAAS,EAAE,CAAC;gBAC9C,gBAAgB,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;YAChD,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,yEAAyE;IACzE,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAChF,MAAM,KAAK,GAAG,OAAO,CAAC,KAA2C,CAAC;QAClE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QACtE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAEtD,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAmB,CAAC;YACnD,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAwB,CAAC;YACpE,OAAO;gBACL,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;gBAC7B,KAAK,EAAE,QAAQ,CAAC,CAAC;gBACjB,KAAK;gBACL,MAAM;aACP,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,oDAAoD;IACpD,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,EAAE,QAAwB,EAAE,KAAmB,EAAE,EAAE;QACpF,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;YAC3B,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC;YAClB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAyB;IACxD,gBAAgB,CAAC,KAAK,CAAC,CAAC;AAC1B,CAAC"}

package/vendor/gatekeeper/dist/server/routes/grants.d.ts

@@ -0,0 +1,3 @@
+import type { FastifyInstance } from 'fastify';
+export declare function grantRoutes(fastify: FastifyInstance): Promise<void>;
+//# sourceMappingURL=grants.d.ts.map

package/vendor/gatekeeper/dist/server/routes/grants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../../../src/server/routes/grants.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAmB7E,wBAAsB,WAAW,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAwGzE"}