@lamalibre/create-lamaste 4.4.0 → 4.5.0

package/vendor/gatekeeper/dist/server/routes/authz.js

@@ -1,6 +1,6 @@
 import crypto from 'node:crypto';
 import { request as undiciRequest } from 'undici';
-import { RELAY_ASSERTION_HEADER, signRelayAssertion } from '@lamalibre/lamaste';
+import { AUTHELIA_SESSION_COOKIE, RELAY_ASSERTION_HEADER, RELAY_PANEL_AUDIENCE, RELAY_PANEL_PORT, autheliaSessionCookies, isUserSurfaceUrl, signRelayAssertion, } from '@lamalibre/lamaste';
 import { AUTHELIA_VERIFY_URL, SESSION_CACHE_TTL_MS } from '../../lib/constants.js';
 import { checkAccess } from '../../lib/authz.js';
 import { buildAccessRequestPage } from '../../lib/templates.js';
@@ -17,35 +17,35 @@ const AUTHELIA_VERIFY_TIMEOUT_MS = 2_500;
  * key and trigger collision-based attacks against cache-eviction logic.
  */
 const COOKIE_HMAC_KEY = crypto.randomBytes(32);
-/**
- * Extract the Authelia session cookie value from the full cookie header.
- *
- * Returns null when the cookie header is missing the `authelia_session=`
- * pair. The Authelia session cookie is the only auth signal we accept on
- * this path — any other cookie (CSRF tokens, analytics, etc.) carries no
- * identity. Falling back to the raw header would let unrelated cookies
- * drive the cache key, which would either pollute the cache or — once a
- * future refactor caches negative results — let an unauthenticated request
- * poison a downstream entry.
- */
-function extractAutheliaCookie(cookie) {
-    const match = cookie.match(/(?:^|;\s*)authelia_session=([^;]*)/);
-    return match?.[1] ?? null;
+function presentedSession(cookieHeader) {
+    // Every pair counts towards "more than one", an empty one too: a planted
+    // `authelia_session=` beside the real cookie is still a second cookie.
+    const values = autheliaSessionCookies(cookieHeader);
+    if (values.length > 1)
+        return { kind: 'many' };
+    const [value] = values;
+    return value ? { kind: 'one', value } : { kind: 'none' };
 }
 /**
- * Derive a session cache key from a cookie string using HMAC-SHA256.
- *
- * The HMAC key is per-process random — keys are not predictable from cookie
- * values alone, which prevents an outsider from probing/seeding the cache.
+ * The session cache key of a session cookie on one tunnel host —
+ * HMAC-SHA256 under a per-process random key, so keys are not predictable
+ * from cookie values, and nobody can probe or seed the cache. Keyed by the
+ * host too: Authelia decides per host (a site's or plugin tunnel's rules
+ * name users), so a session it accepted for one host proves nothing on
+ * another.
  */
-function hashCookie(cookie) {
-    return crypto.createHmac('sha256', COOKIE_HMAC_KEY).update(cookie).digest('hex');
+function sessionCacheKey(session, host) {
+    return crypto
+        .createHmac('sha256', COOKIE_HMAC_KEY)
+        .update(`${host.toLowerCase()}\n${session}`)
+        .digest('hex');
 }
 /**
- * Forward the request's cookies to Authelia's verify endpoint
- * and extract the identity headers from the response.
+ * Ask Authelia's verify endpoint about one session cookie for one URL, and
+ * take the identity headers from its answer. Authelia is sent that cookie
+ * alone (`authelia_session=<value>`), never the browser's others.
  */
-async function validateWithAuthelia(cookie, originalUrl, requestId) {
+async function validateWithAuthelia(session, originalUrl, requestId) {
     try {
         // Authelia's `/api/authz/auth-request` needs both the target URL and
         // method — without `X-Original-Method` it assumes `GET`, which is fine
@@ -54,7 +54,7 @@ async function validateWithAuthelia(cookie, originalUrl, requestId) {
         const { statusCode, headers } = await undiciRequest(AUTHELIA_VERIFY_URL, {
             method: 'GET',
             headers: {
-                Cookie: cookie,
+                Cookie: `${AUTHELIA_SESSION_COOKIE}=${session}`,
                 'X-Original-URL': originalUrl,
                 'X-Original-Method': 'GET',
                 'X-Forwarded-For': '127.0.0.1',
@@ -96,23 +96,47 @@ function findTunnelByFqdn(tunnels, fqdn) {
     const wanted = fqdn.toLowerCase();
     return tunnels.find((t) => t.fqdn.toLowerCase() === wanted);
 }
+/**
+ * Why the hostnames a tunnel vhost writes into the subrequest's path,
+ * X-Original-URL and Host disagree, or null when they agree.
+ */
+function hostnameMismatch(request, fqdn, originalHost) {
+    const named = fqdn.toLowerCase();
+    const hostHeader = request.headers['host'] ?? '';
+    const hostOnly = hostHeader.split(':')[0]?.toLowerCase() ?? '';
+    if (originalHost.toLowerCase() === named && hostOnly === named)
+        return null;
+    return {
+        reason: hostOnly ? 'tunnel_name_mismatch' : 'missing_host_header',
+        originalHost,
+        hostHeader,
+    };
+}
 /** A tunnel hostname as a vhost writes it into the subrequest's path. */
 const TUNNEL_FQDN_RE = /^[A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?(\.[A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?)+$/;
 /**
- * nginx is the only client of the authorization routes (Gatekeeper binds
- * 127.0.0.1) and calls them on every protected request. Per-IP throttling
- * would punish legitimate traffic because every caller arrives as
- * 127.0.0.1, so the key is one bucket with an effectively-unlimited 10k/min
- * ceiling: the rate limit is structurally present (CodeQL
- * js/missing-rate-limiting) without breaking the hot path.
+ * How many authorization subrequests one client may cause on one tunnel
+ * host per minute. nginx asks on every request a protected host serves — a
+ * page and its assets, an application's polling — so the bound is
+ * generous; what it stops is one client (a script hammering Authelia with
+ * made-up session cookies, each an Authelia round trip) starving the
+ * others.
  */
-const INTERNAL_RATE_LIMIT = {
-    rateLimit: {
-        max: 10_000,
-        timeWindow: '1 minute',
-        keyGenerator: () => 'gatekeeper-internal',
-    },
-};
+export const AUTHZ_RATE_LIMIT_PER_CLIENT = 6_000;
+/**
+ * The bucket of an authorization subrequest: the client's address and the
+ * tunnel host. nginx is the only client of these routes (Gatekeeper binds
+ * 127.0.0.1) and sets `X-Forwarded-For` to `$remote_addr` on every
+ * subrequest; Gatekeeper trusts that header from 127.0.0.1 only
+ * (`trustProxy` in `server/index.ts`), so `request.ip` is the address nginx
+ * accepted the browser's connection from — never one the browser named.
+ * The host is the tunnel the vhost names in the path (or its `Host`).
+ */
+function authzRateLimitKey(request) {
+    const fqdn = request.params?.fqdn;
+    const host = typeof fqdn === 'string' ? fqdn : (request.headers['host'] ?? '');
+    return `${request.ip}|${host.toLowerCase()}`;
+}
 /**
  * Parse an X-Original-URL header into its hostname and host components.
  * Returns null when the value is not a parseable absolute URL.
@@ -129,7 +153,14 @@ function parseOriginalUrl(originalUrl) {
 // ---------------------------------------------------------------------------
 // Route plugin
 // ---------------------------------------------------------------------------
-export async function authzRoutes(fastify) {
+export async function authzRoutes(fastify, opts = {}) {
+    const authzRateLimit = {
+        rateLimit: {
+            max: opts.rateLimitPerClient ?? AUTHZ_RATE_LIMIT_PER_CLIENT,
+            timeWindow: '1 minute',
+            keyGenerator: authzRateLimitKey,
+        },
+    };
     /**
      * GET /authz/tunnel/:fqdn — the nginx auth_request target of a tunnel vhost
      *
@@ -149,7 +180,33 @@ export async function authzRoutes(fastify) {
      * On 403, the response body is the full access-request HTML page
      * (nginx serves this inline on the tunnel's FQDN via error_page 403 =).
      */
-    fastify.get('/authz/tunnel/:fqdn', { config: INTERNAL_RATE_LIMIT }, async (request, reply) => authorizeTunnelRequest(fastify, request, reply, request.params.fqdn));
+    fastify.get('/authz/tunnel/:fqdn', { config: authzRateLimit }, async (request, reply) => authorizeTunnelRequest(fastify, request, reply, request.params.fqdn));
+    /**
+     * GET /authz/user-surface/:fqdn — the nginx auth_request target of a
+     * plugin's user surface: `/api/<route>/app` and everything under it, on
+     * the host of a tunnel bound to the plugin (`userSurface` in
+     * tunnels.json). The vhost names the tunnel as for `/authz/tunnel/:fqdn`.
+     *
+     * Gatekeeper authenticates the session — on a restricted tunnel it checks
+     * the user's grant too — and vouches for its user to the panel: a relay
+     * assertion for the panel's audience and port, naming the username alone
+     * and bound to the method and the raw request target, which must lie on
+     * the user surface of a route bound to this tunnel. The panel takes
+     * everything else about the user from its own directory.
+     *
+     * 200 with the assertion (never cacheable, no `Remote-*`), 401 without a
+     * session (nginx answers with `/authz/user-surface-unauthenticated`), 403
+     * for anything else refused — never the access-request page, never a
+     * redirect: the caller is an application's request. 503 while the relay
+     * signing key is unusable.
+     */
+    fastify.get('/authz/user-surface/:fqdn', { config: authzRateLimit }, async (request, reply) => authorizeUserSurfaceRequest(fastify, request, reply, request.params.fqdn));
+    /**
+     * GET /authz/user-surface-unauthenticated — what a user-surface request
+     * without a session is answered with (nginx `error_page 401`): JSON, so
+     * the application can tell its user to sign in again; never a redirect.
+     */
+    fastify.get('/authz/user-surface-unauthenticated', { config: authzRateLimit }, async (_request, reply) => reply.code(401).header('Cache-Control', 'no-store').send({ error: 'unauthenticated' }));
     /**
      * GET /authz/check — what tunnel vhosts written before 4.3 call. They name
      * the tunnel by the client's Host header (`$http_host`), which an
@@ -158,7 +215,7 @@ export async function authzRoutes(fastify) {
      * such a vhost (it does when it starts) its tunnel is closed, rather than
      * open to the users of every other tunnel.
      */
-    fastify.get('/authz/check', { config: INTERNAL_RATE_LIMIT }, async (request, reply) => {
+    fastify.get('/authz/check', { config: authzRateLimit }, async (request, reply) => {
         request.log.error({
             requestId: request.id,
             reason: 'vhost_predates_host_binding',
@@ -171,6 +228,51 @@ export async function authzRoutes(fastify) {
             .send('This tunnel is unavailable until the relay rewrites its configuration.\n');
     });
 }
+/**
+ * The Authelia session behind the request's `authelia_session` cookie, or
+ * null: none, more than one (refused — see {@link presentedSession}), or
+ * Authelia refused it. The session cache — one shared by every route here
+ * — is keyed by that cookie's value and the tunnel host, so unrelated
+ * cookies (CSRF tokens, analytics) cannot pollute it, and a session Authelia
+ * accepted on one host is never taken for another.
+ */
+async function authenticatedSession(fastify, request, cookieHeader, originalUrl, hostname) {
+    const requestId = request.id;
+    const presented = presentedSession(cookieHeader);
+    if (presented.kind !== 'one') {
+        // Short-circuit before any cache work or the upstream Authelia /verify
+        // call: an unauthenticated request costs no Authelia round-trip.
+        request.log.info({
+            requestId,
+            reason: presented.kind === 'none' ? 'missing_authelia_cookie' : 'duplicate_authelia_cookie',
+            fqdn: hostname,
+        }, 'authz denied');
+        return null;
+    }
+    const cacheKey = sessionCacheKey(presented.value, hostname);
+    const sessionCache = fastify.getSessionCache();
+    const cached = sessionCache.get(cacheKey);
+    if (cached && cached.expiresAt > Date.now())
+        return cached;
+    if (cached) {
+        // Lazy TTL eviction — one stale entry pruned per request.
+        sessionCache.delete(cacheKey);
+    }
+    const validated = await validateWithAuthelia(presented.value, originalUrl, requestId);
+    if (!validated) {
+        request.log.info({ requestId, reason: 'authelia_rejected', fqdn: hostname }, 'authz denied');
+        return null;
+    }
+    // Opportunistic eviction — drop oldest (insertion-order head) when at cap.
+    while (sessionCache.size >= MAX_SESSION_CACHE_ENTRIES) {
+        const oldestKey = sessionCache.keys().next().value;
+        if (oldestKey === undefined)
+            break;
+        sessionCache.delete(oldestKey);
+    }
+    sessionCache.set(cacheKey, validated);
+    return validated;
+}
 /**
  * Authorize one request on the tunnel named `fqdn` (see the
  * `/authz/tunnel/:fqdn` route).
@@ -181,7 +283,7 @@ async function authorizeTunnelRequest(fastify, request, reply, fqdn) {
         request.log.info({ requestId, reason: 'invalid_tunnel_name' }, 'authz denied');
         return reply.code(401).send();
     }
-    const cookie = request.headers['cookie'] ?? '';
+    const cookie = request.headers['cookie'];
     const originalUrl = request.headers['x-original-url'] ?? '';
     if (!cookie || !originalUrl) {
         return reply.code(401).send();
@@ -191,20 +293,12 @@ async function authorizeTunnelRequest(fastify, request, reply, fqdn) {
         request.log.info({ requestId, reason: 'invalid_original_url' }, 'authz denied');
         return reply.code(401).send();
     }
-    // The vhost writes the same hostname into the path, X-Original-URL and
-    // Host. Disagreement means a request that did not come from a tunnel
-    // vhost of this version: refuse it before Authelia is asked anything.
-    const named = fqdn.toLowerCase();
-    const hostHeader = request.headers['host'] ?? '';
-    const hostOnly = hostHeader.split(':')[0]?.toLowerCase() ?? '';
-    if (parsed.hostname.toLowerCase() !== named || hostOnly !== named) {
-        request.log.info({
-            requestId,
-            reason: hostOnly ? 'tunnel_name_mismatch' : 'missing_host_header',
-            tunnel: fqdn,
-            originalHost: parsed.hostname,
-            hostHeader,
-        }, 'authz denied');
+    // Disagreement means a request that did not come from a tunnel vhost of
+    // this version: refuse it before Authelia is asked anything.
+    const mismatch = hostnameMismatch(request, fqdn, parsed.hostname);
+    if (mismatch) {
+        const { reason, ...detail } = mismatch;
+        request.log.info({ requestId, reason, tunnel: fqdn, ...detail }, 'authz denied');
         return reply.code(401).send();
     }
     const tunnels = fastify.getTunnels();
@@ -213,44 +307,9 @@ async function authorizeTunnelRequest(fastify, request, reply, fqdn) {
         request.log.info({ requestId, reason: 'unknown_tunnel_fqdn', fqdn }, 'authz denied');
         return reply.code(401).send();
     }
-    // Check session cache (keyed by Authelia session cookie only to prevent
-    // cache pollution via unrelated cookies like CSRF tokens or analytics).
-    const autheliaCookie = extractAutheliaCookie(cookie);
-    if (!autheliaCookie) {
-        // No authelia_session — short-circuit before any cache work or the
-        // upstream Authelia /verify call. Without this, an unauthenticated
-        // request would still cost us an Authelia round-trip.
-        request.log.info({ requestId, reason: 'missing_authelia_cookie', fqdn: parsed.hostname }, 'authz denied');
+    const session = await authenticatedSession(fastify, request, cookie, originalUrl, parsed.hostname);
+    if (!session)
         return reply.code(401).send();
-    }
-    const cacheKey = hashCookie(autheliaCookie);
-    const sessionCache = fastify.getSessionCache();
-    const cached = sessionCache.get(cacheKey);
-    const now = Date.now();
-    let session;
-    if (cached && cached.expiresAt > now) {
-        session = cached;
-    }
-    else {
-        if (cached) {
-            // Lazy TTL eviction — one stale entry pruned per request.
-            sessionCache.delete(cacheKey);
-        }
-        const validated = await validateWithAuthelia(cookie, originalUrl, requestId);
-        if (!validated) {
-            request.log.info({ requestId, reason: 'authelia_rejected', fqdn: parsed.hostname }, 'authz denied');
-            return reply.code(401).send();
-        }
-        // Opportunistic eviction — drop oldest (insertion-order head) when at cap.
-        while (sessionCache.size >= MAX_SESSION_CACHE_ENTRIES) {
-            const oldestKey = sessionCache.keys().next().value;
-            if (oldestKey === undefined)
-                break;
-            sessionCache.delete(oldestKey);
-        }
-        sessionCache.set(cacheKey, validated);
-        session = validated;
-    }
     // Check access mode
     if (tunnel.accessMode === 'public' || tunnel.accessMode === 'authenticated') {
         return allow(fastify, request, reply, tunnel, session);
@@ -263,14 +322,13 @@ async function authorizeTunnelRequest(fastify, request, reply, fqdn) {
     if (result.allowed) {
         return allow(fastify, request, reply, tunnel, session);
     }
+    // The tunnel and the reason only — never who was refused.
     request.log.info({
         requestId,
         reason: 'no_matching_grant',
-        username: session.username,
+        tunnel: fqdn,
         resourceType: 'tunnel',
         resourceId: tunnel.id,
-        requiredGrant: `tunnel:${tunnel.id}`,
-        fqdn: parsed.hostname,
     }, 'authz denied');
     if (fastify.getSettings().accessLoggingEnabled) {
         logAccessRequest({
@@ -294,6 +352,101 @@ async function authorizeTunnelRequest(fastify, request, reply, fqdn) {
         .type('text/html; charset=utf-8')
         .send(html);
 }
+/**
+ * Authorize one request on the user surface of the tunnel named `fqdn` (see
+ * the `/authz/user-surface/:fqdn` route).
+ */
+async function authorizeUserSurfaceRequest(fastify, request, reply, fqdn) {
+    const requestId = request.id;
+    // Single use: nothing of this answer may be cached, a refusal included.
+    reply.header('Cache-Control', 'no-store');
+    const refuse = (reason, extra = {}) => {
+        request.log.info({ requestId, reason, tunnel: fqdn, ...extra }, 'user-surface authz denied');
+        return reply.code(403).send();
+    };
+    if (!TUNNEL_FQDN_RE.test(fqdn))
+        return refuse('invalid_tunnel_name');
+    const originalUrl = request.headers['x-original-url'];
+    const originalMethod = request.headers['x-original-method'];
+    if (typeof originalUrl !== 'string' || typeof originalMethod !== 'string') {
+        return refuse('missing_original_request');
+    }
+    const parsed = parseOriginalUrl(originalUrl);
+    if (!parsed)
+        return refuse('invalid_original_url');
+    const mismatch = hostnameMismatch(request, fqdn, parsed.hostname);
+    if (mismatch) {
+        const { reason, ...detail } = mismatch;
+        return refuse(reason, detail);
+    }
+    const tunnel = findTunnelByFqdn(fastify.getTunnels(), fqdn);
+    if (!tunnel)
+        return refuse('unknown_tunnel_fqdn');
+    if (!tunnel.enabled)
+        return refuse('tunnel_disabled');
+    if (tunnel.accessMode === 'public' || !tunnel.userSurface)
+        return refuse('no_user_surface');
+    // The request target exactly as the browser sent it — what follows the
+    // hostname the vhost wrote — never re-encoded by a URL parser: the panel
+    // receives it unchanged and holds the assertion against it byte for byte.
+    const prefix = `https://${fqdn.toLowerCase()}`;
+    if (originalUrl.slice(0, prefix.length).toLowerCase() !== prefix) {
+        return refuse('invalid_original_url');
+    }
+    const target = originalUrl.slice(prefix.length);
+    const route = tunnel.userSurface.routes.find((r) => isUserSurfaceUrl(target, r));
+    if (!route)
+        return refuse('not_on_user_surface');
+    // Bound, but its plugin is not hosted by the agent carrying this tunnel
+    // (moved, revoked, hosted elsewhere): nothing of it is served here.
+    if (!tunnel.userSurface.served.includes(route))
+        return refuse('not_hosting_agent', { route });
+    const session = await authenticatedSession(fastify, request, request.headers['cookie'], originalUrl, parsed.hostname);
+    if (!session)
+        return reply.code(401).send();
+    if (tunnel.accessMode !== 'authenticated') {
+        // restricted — the user's grant for the tunnel, as on its other paths
+        const result = await checkAccess(session.username, 'tunnel', tunnel.id, {
+            adminContact: fastify.getSettings().adminEmail,
+            adminName: fastify.getSettings().adminName,
+        });
+        if (!result.allowed) {
+            // The tunnel and the reason only — never who was refused.
+            return refuse('no_matching_grant', { resourceType: 'tunnel', resourceId: tunnel.id });
+        }
+    }
+    const key = await currentRelayKey(fastify, request);
+    if (!key) {
+        request.log.error({ requestId, reason: 'relay_signing_key_unavailable', tunnel: fqdn }, 'user-surface authz failed');
+        return reply.code(503).send();
+    }
+    let assertion;
+    try {
+        assertion = signRelayAssertion({
+            aud: RELAY_PANEL_AUDIENCE,
+            port: RELAY_PANEL_PORT,
+            caller: { type: 'user', username: session.username },
+            method: originalMethod,
+            target: { route, path: target },
+        }, key);
+    }
+    catch (err) {
+        // A username, method or target an assertion cannot carry.
+        return refuse('not_assertable', { detail: err instanceof Error ? err.message : String(err) });
+    }
+    reply.header(RELAY_ASSERTION_HEADER, assertion);
+    return reply.code(200).send();
+}
+/** The relay signing key, or null when there is none or it is unusable (logged). */
+async function currentRelayKey(fastify, request) {
+    try {
+        return await fastify.getRelaySigner().current();
+    }
+    catch (err) {
+        request.log.error({ err: err instanceof Error ? err.message : String(err) }, 'Relay signing key unusable');
+        return null;
+    }
+}
 /**
  * Answer an allowed request: the Authelia identity headers nginx forwards
  * to the tunnel backend.
@@ -312,13 +465,7 @@ async function allow(fastify, request, reply, tunnel, session) {
         return reply.code(200).send();
     }
     reply.header('Cache-Control', 'no-store');
-    let key = null;
-    try {
-        key = await fastify.getRelaySigner().current();
-    }
-    catch (err) {
-        request.log.error({ err: err instanceof Error ? err.message : String(err) }, 'Relay signing key unusable');
-    }
+    const key = await currentRelayKey(fastify, request);
     if (!key) {
         request.log.error({ requestId: request.id, reason: 'relay_signing_key_unavailable', fqdn: tunnel.fqdn }, 'authz failed');
         return reply.code(503).send();

package/vendor/gatekeeper/dist/server/routes/authz.js.map

@@ -1 +1 @@
-{"version":3,"file":"authz.js","sourceRoot":"","sources":["../../../src/server/routes/authz.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAEhF,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAG3D,wFAAwF;AACxF,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAEzC,qFAAqF;AACrF,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAEzC,mFAAmF;AACnF,MAAM,0BAA0B,GAAG,KAAK,CAAC;AAEzC;;;;GAIG;AACH,MAAM,eAAe,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;AAE/C;;;;;;;;;;GAUG;AACH,SAAS,qBAAqB,CAAC,MAAc;IAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACjE,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC5B,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnF,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,oBAAoB,CACjC,MAAc,EACd,WAAmB,EACnB,SAAiB;IAEjB,IAAI,CAAC;QACH,qEAAqE;QACrE,uEAAuE;QACvE,uEAAuE;QACvE,sCAAsC;QACtC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,aAAa,CAAC,mBAAmB,EAAE;YACvE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,MAAM,EAAE,MAAM;gBACd,gBAAgB,EAAE,WAAW;gBAC7B,mBAAmB,EAAE,KAAK;gBAC1B,iBAAiB,EAAE,WAAW;gBAC9B,cAAc,EAAE,SAAS;aAC1B;YACD,yEAAyE;YACzE,wEAAwE;YACxE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,0BAA0B,CAAC;SACxD,CAAC,CAAC;QAEH,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QACnD,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE3B,OAAO;YACL,QAAQ;YACR,MAAM,EAAE,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC,IAAI,EAAE;YACjD,WAAW,EAAE,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC,IAAI,EAAE;YACpD,KAAK,EAAE,SAAS,CAAC,OAAO,EAAE,cAAc,CAAC,IAAI,EAAE;YAC/C,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,oBAAoB;SAC7C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAChB,OAAsD,EACtD,IAAY;IAEZ,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;IACtC,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,OAA8B,EAAE,IAAY;IACpE,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAClC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC;AAC9D,CAAC;AAED,yEAAyE;AACzE,MAAM,cAAc,GAClB,+FAA+F,CAAC;AAElG;;;;;;;GAOG;AACH,MAAM,mBAAmB,GAAG;IAC1B,SAAS,EAAE;QACT,GAAG,EAAE,MAAM;QACX,UAAU,EAAE,UAAU;QACtB,YAAY,EAAE,GAAG,EAAE,CAAC,qBAAqB;KAC1C;CACF,CAAC;AAEF;;;GAGG;AACH,SAAS,gBAAgB,CAAC,WAAmB;IAC3C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAwB;IACxD;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,GAAG,CACT,qBAAqB,EACrB,EAAE,MAAM,EAAE,mBAAmB,EAAE,EAC/B,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAC/F,CAAC;IAEF;;;;;;;OAOG;IACH,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACpF,OAAO,CAAC,GAAG,CAAC,KAAK,CACf;YACE,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,MAAM,EAAE,6BAA6B;YACrC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,EACD,8HAA8H,CAC/H,CAAC;QACF,OAAO,KAAK;aACT,IAAI,CAAC,GAAG,CAAC;aACT,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC;aACnC,IAAI,CAAC,2BAA2B,CAAC;aACjC,IAAI,CAAC,0EAA0E,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,sBAAsB,CACnC,OAAwB,EACxB,OAAuB,EACvB,KAAmB,EACnB,IAAY;IAEZ,MAAM,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC;IAC7B,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,qBAAqB,EAAE,EAAE,cAAc,CAAC,CAAC;QAC/E,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/C,MAAM,WAAW,GAAI,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAY,IAAI,EAAE,CAAC;IACxE,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,sBAAsB,EAAE,EAAE,cAAc,CAAC,CAAC;QAChF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,uEAAuE;IACvE,qEAAqE;IACrE,sEAAsE;IACtE,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,MAAM,UAAU,GAAI,OAAO,CAAC,OAAO,CAAC,MAAM,CAAwB,IAAI,EAAE,CAAC;IACzE,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC/D,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,KAAK,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,IAAI,CACd;YACE,SAAS;YACT,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,qBAAqB;YACjE,MAAM,EAAE,IAAI;YACZ,YAAY,EAAE,MAAM,CAAC,QAAQ;YAC7B,UAAU;SACX,EACD,cAAc,CACf,CAAC;QACF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,qBAAqB,EAAE,IAAI,EAAE,EAAE,cAAc,CAAC,CAAC;QACrF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,wEAAwE;IACxE,wEAAwE;IACxE,MAAM,cAAc,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IACrD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,mEAAmE;QACnE,mEAAmE;QACnE,sDAAsD;QACtD,OAAO,CAAC,GAAG,CAAC,IAAI,CACd,EAAE,SAAS,EAAE,MAAM,EAAE,yBAAyB,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,EACvE,cAAc,CACf,CAAC;QACF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC;IAC5C,MAAM,YAAY,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAC/C,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,OAAoC,CAAC;IAEzC,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;QACrC,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;SAAM,CAAC;QACN,IAAI,MAAM,EAAE,CAAC;YACX,0DAA0D;YAC1D,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;QAC7E,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,IAAI,CACd,EAAE,SAAS,EAAE,MAAM,EAAE,mBAAmB,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,EACjE,cAAc,CACf,CAAC;YACF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAChC,CAAC;QAED,2EAA2E;QAC3E,OAAO,YAAY,CAAC,IAAI,IAAI,yBAAyB,EAAE,CAAC;YACtD,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YACnD,IAAI,SAAS,KAAK,SAAS;gBAAE,MAAM;YACnC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACjC,CAAC;QAED,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACtC,OAAO,GAAG,SAAS,CAAC;IACtB,CAAC;IAED,oBAAoB;IACpB,IAAI,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,KAAK,eAAe,EAAE,CAAC;QAC5E,OAAO,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC;IAED,4BAA4B;IAC5B,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE;QACtE,YAAY,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,UAAU;QAC9C,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,SAAS;KAC3C,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,IAAI,CACd;QACE,SAAS;QACT,MAAM,EAAE,mBAAmB;QAC3B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,YAAY,EAAE,QAAQ;QACtB,UAAU,EAAE,MAAM,CAAC,EAAE;QACrB,aAAa,EAAE,UAAU,MAAM,CAAC,EAAE,EAAE;QACpC,IAAI,EAAE,MAAM,CAAC,QAAQ;KACtB,EACD,cAAc,CACf,CAAC;IAEF,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,oBAAoB,EAAE,CAAC;QAC/C,gBAAgB,CAAC;YACf,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,YAAY,EAAE,QAAQ;YACtB,UAAU,EAAE,MAAM,CAAC,EAAE;YACrB,YAAY,EAAE,MAAM,CAAC,QAAQ;SAC9B,CAAC,CAAC;IACL,CAAC;IAED,uDAAuD;IACvD,yEAAyE;IACzE,uEAAuE;IACvE,MAAM,IAAI,GAAG,sBAAsB,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;QACrE,YAAY,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,UAAU;QAC9C,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,SAAS;KAC3C,CAAC,CAAC;IAEH,OAAO,KAAK;SACT,IAAI,CAAC,GAAG,CAAC;SACT,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC;SACnC,IAAI,CAAC,0BAA0B,CAAC;SAChC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,KAAK,CAClB,OAAwB,EACxB,OAAuB,EACvB,KAAmB,EACnB,MAAkB,EAClB,OAAwB;IAExB,KAAK,CAAC,MAAM,CAAC,4BAA4B,EAAE,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC;IAC9E,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACnC,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,mBAAmB,6BAA6B,EAAE,CAAC,CAAC;QAClF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAC1C,IAAI,GAAG,GAA2B,IAAI,CAAC;IACvC,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC,OAAO,EAAE,CAAC;IACjD,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACzD,4BAA4B,CAC7B,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,+BAA+B,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EACrF,cAAc,CACf,CAAC;QACF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC5D,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,kBAAkB,CAC5B;YACE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU;YAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI;YACxB,MAAM,EAAE;gBACN,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;qBACnB,KAAK,CAAC,GAAG,CAAC;qBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;qBACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;gBAC9B,IAAI,EAAE,OAAO,CAAC,WAAW;gBACzB,KAAK,EAAE,OAAO,CAAC,KAAK;aACrB;YACD,MAAM,EAAE,OAAO,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK;YACnE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE;SACvC,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,4DAA4D;QAC5D,wEAAwE;QACxE,OAAO,CAAC,GAAG,CAAC,IAAI,CACd;YACE,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,MAAM,EAAE,yBAAyB;YACjC,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YACxD,IAAI,EAAE,MAAM,CAAC,IAAI;SAClB,EACD,cAAc,CACf,CAAC;QACF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACnC,KAAK,CAAC,MAAM,CAAC,sBAAsB,EAAE,SAAS,CAAC,CAAC;IAChD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,KAAmB,EAAE,OAAwB;IACvE,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9C,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9C,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IACjD,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9C,CAAC"}
+{"version":3,"file":"authz.js","sourceRoot":"","sources":["../../../src/server/routes/authz.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAG3D,wFAAwF;AACxF,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAEzC,qFAAqF;AACrF,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAEzC,mFAAmF;AACnF,MAAM,0BAA0B,GAAG,KAAK,CAAC;AAEzC;;;;GAIG;AACH,MAAM,eAAe,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;AAiB/C,SAAS,gBAAgB,CAAC,YAA2C;IACnE,yEAAyE;IACzE,uEAAuE;IACvE,MAAM,MAAM,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAC;IACpD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC/C,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC;IACvB,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,OAAe,EAAE,IAAY;IACpD,OAAO,MAAM;SACV,UAAU,CAAC,QAAQ,EAAE,eAAe,CAAC;SACrC,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,KAAK,OAAO,EAAE,CAAC;SAC3C,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,oBAAoB,CACjC,OAAe,EACf,WAAmB,EACnB,SAAiB;IAEjB,IAAI,CAAC;QACH,qEAAqE;QACrE,uEAAuE;QACvE,uEAAuE;QACvE,sCAAsC;QACtC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,aAAa,CAAC,mBAAmB,EAAE;YACvE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,MAAM,EAAE,GAAG,uBAAuB,IAAI,OAAO,EAAE;gBAC/C,gBAAgB,EAAE,WAAW;gBAC7B,mBAAmB,EAAE,KAAK;gBAC1B,iBAAiB,EAAE,WAAW;gBAC9B,cAAc,EAAE,SAAS;aAC1B;YACD,yEAAyE;YACzE,wEAAwE;YACxE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,0BAA0B,CAAC;SACxD,CAAC,CAAC;QAEH,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QACnD,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE3B,OAAO;YACL,QAAQ;YACR,MAAM,EAAE,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC,IAAI,EAAE;YACjD,WAAW,EAAE,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC,IAAI,EAAE;YACpD,KAAK,EAAE,SAAS,CAAC,OAAO,EAAE,cAAc,CAAC,IAAI,EAAE;YAC/C,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,oBAAoB;SAC7C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAChB,OAAsD,EACtD,IAAY;IAEZ,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;IACtC,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,OAA8B,EAAE,IAAY;IACpE,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAClC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CACvB,OAAuB,EACvB,IAAY,EACZ,YAAoB;IAEpB,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,MAAM,UAAU,GAAI,OAAO,CAAC,OAAO,CAAC,MAAM,CAAwB,IAAI,EAAE,CAAC;IACzE,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC/D,IAAI,YAAY,CAAC,WAAW,EAAE,KAAK,KAAK,IAAI,QAAQ,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAC5E,OAAO;QACL,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,qBAAqB;QACjE,YAAY;QACZ,UAAU;KACX,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,MAAM,cAAc,GAClB,+FAA+F,CAAC;AAElG;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,CAAC;AAEjD;;;;;;;;GAQG;AACH,SAAS,iBAAiB,CAAC,OAAuB;IAChD,MAAM,IAAI,GAAI,OAAO,CAAC,MAAyC,EAAE,IAAI,CAAC;IACtE,MAAM,IAAI,GACR,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAwB,IAAI,EAAE,CAAC,CAAC;IAC5F,OAAO,GAAG,OAAO,CAAC,EAAE,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;AAC/C,CAAC;AAQD;;;GAGG;AACH,SAAS,gBAAgB,CAAC,WAAmB;IAC3C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAwB,EACxB,OAA2B,EAAE;IAE7B,MAAM,cAAc,GAAG;QACrB,SAAS,EAAE;YACT,GAAG,EAAE,IAAI,CAAC,kBAAkB,IAAI,2BAA2B;YAC3D,UAAU,EAAE,UAAU;YACtB,YAAY,EAAE,iBAAiB;SAChC;KACF,CAAC;IAEF;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,GAAG,CACT,qBAAqB,EACrB,EAAE,MAAM,EAAE,cAAc,EAAE,EAC1B,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAC/F,CAAC;IAEF;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,GAAG,CACT,2BAA2B,EAC3B,EAAE,MAAM,EAAE,cAAc,EAAE,EAC1B,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CACvB,2BAA2B,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAC5E,CAAC;IAEF;;;;OAIG;IACH,OAAO,CAAC,GAAG,CACT,qCAAqC,EACrC,EAAE,MAAM,EAAE,cAAc,EAAE,EAC1B,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CACxB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CACzF,CAAC;IAEF;;;;;;;OAOG;IACH,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC/E,OAAO,CAAC,GAAG,CAAC,KAAK,CACf;YACE,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,MAAM,EAAE,6BAA6B;YACrC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,EACD,8HAA8H,CAC/H,CAAC;QACF,OAAO,KAAK;aACT,IAAI,CAAC,GAAG,CAAC;aACT,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC;aACnC,IAAI,CAAC,2BAA2B,CAAC;aACjC,IAAI,CAAC,0EAA0E,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,oBAAoB,CACjC,OAAwB,EACxB,OAAuB,EACvB,YAA2C,EAC3C,WAAmB,EACnB,QAAgB;IAEhB,MAAM,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAC;IACjD,IAAI,SAAS,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC7B,uEAAuE;QACvE,iEAAiE;QACjE,OAAO,CAAC,GAAG,CAAC,IAAI,CACd;YACE,SAAS;YACT,MAAM,EAAE,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,2BAA2B;YAC3F,IAAI,EAAE,QAAQ;SACf,EACD,cAAc,CACf,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,eAAe,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAC/C,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,MAAM,CAAC;IAC3D,IAAI,MAAM,EAAE,CAAC;QACX,0DAA0D;QAC1D,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,SAAS,CAAC,KAAK,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;IACtF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,mBAAmB,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,cAAc,CAAC,CAAC;QAC7F,OAAO,IAAI,CAAC;IACd,CAAC;IAED,2EAA2E;IAC3E,OAAO,YAAY,CAAC,IAAI,IAAI,yBAAyB,EAAE,CAAC;QACtD,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QACnD,IAAI,SAAS,KAAK,SAAS;YAAE,MAAM;QACnC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAED,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACtC,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,sBAAsB,CACnC,OAAwB,EACxB,OAAuB,EACvB,KAAmB,EACnB,IAAY;IAEZ,MAAM,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC;IAC7B,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,qBAAqB,EAAE,EAAE,cAAc,CAAC,CAAC;QAC/E,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,WAAW,GAAI,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAY,IAAI,EAAE,CAAC;IACxE,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,sBAAsB,EAAE,EAAE,cAAc,CAAC,CAAC;QAChF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,wEAAwE;IACxE,6DAA6D;IAC7D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClE,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,GAAG,QAAQ,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC;QACjF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,qBAAqB,EAAE,IAAI,EAAE,EAAE,cAAc,CAAC,CAAC;QACrF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,oBAAoB,CACxC,OAAO,EACP,OAAO,EACP,MAAM,EACN,WAAW,EACX,MAAM,CAAC,QAAQ,CAChB,CAAC;IACF,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAE5C,oBAAoB;IACpB,IAAI,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,KAAK,eAAe,EAAE,CAAC;QAC5E,OAAO,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC;IAED,4BAA4B;IAC5B,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE;QACtE,YAAY,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,UAAU;QAC9C,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,SAAS;KAC3C,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC;IAED,0DAA0D;IAC1D,OAAO,CAAC,GAAG,CAAC,IAAI,CACd;QACE,SAAS;QACT,MAAM,EAAE,mBAAmB;QAC3B,MAAM,EAAE,IAAI;QACZ,YAAY,EAAE,QAAQ;QACtB,UAAU,EAAE,MAAM,CAAC,EAAE;KACtB,EACD,cAAc,CACf,CAAC;IAEF,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,oBAAoB,EAAE,CAAC;QAC/C,gBAAgB,CAAC;YACf,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,YAAY,EAAE,QAAQ;YACtB,UAAU,EAAE,MAAM,CAAC,EAAE;YACrB,YAAY,EAAE,MAAM,CAAC,QAAQ;SAC9B,CAAC,CAAC;IACL,CAAC;IAED,uDAAuD;IACvD,yEAAyE;IACzE,uEAAuE;IACvE,MAAM,IAAI,GAAG,sBAAsB,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;QACrE,YAAY,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,UAAU;QAC9C,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,SAAS;KAC3C,CAAC,CAAC;IAEH,OAAO,KAAK;SACT,IAAI,CAAC,GAAG,CAAC;SACT,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC;SACnC,IAAI,CAAC,0BAA0B,CAAC;SAChC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,2BAA2B,CACxC,OAAwB,EACxB,OAAuB,EACvB,KAAmB,EACnB,IAAY;IAEZ,MAAM,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC;IAC7B,wEAAwE;IACxE,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,QAAiC,EAAE,EAAgB,EAAE;QACnF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,EAAE,2BAA2B,CAAC,CAAC;QAC7F,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC,CAAC;IAEF,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC,qBAAqB,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACtD,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC5D,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;QAC1E,OAAO,MAAM,CAAC,0BAA0B,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC,sBAAsB,CAAC,CAAC;IAEnD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClE,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,GAAG,QAAQ,CAAC;QACvC,OAAO,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,IAAI,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACtD,IAAI,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,WAAW;QAAE,OAAO,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAE5F,uEAAuE;IACvE,yEAAyE;IACzE,0EAA0E;IAC1E,MAAM,MAAM,GAAG,WAAW,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;IAC/C,IAAI,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;QACjE,OAAO,MAAM,CAAC,sBAAsB,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACjF,IAAI,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC,qBAAqB,CAAC,CAAC;IACjD,wEAAwE;IACxE,oEAAoE;IACpE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,mBAAmB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAE9F,MAAM,OAAO,GAAG,MAAM,oBAAoB,CACxC,OAAO,EACP,OAAO,EACP,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EACzB,WAAW,EACX,MAAM,CAAC,QAAQ,CAChB,CAAC;IACF,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAE5C,IAAI,MAAM,CAAC,UAAU,KAAK,eAAe,EAAE,CAAC;QAC1C,sEAAsE;QACtE,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE;YACtE,YAAY,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,UAAU;YAC9C,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,SAAS;SAC3C,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,0DAA0D;YAC1D,OAAO,MAAM,CAAC,mBAAmB,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,SAAS,EAAE,MAAM,EAAE,+BAA+B,EAAE,MAAM,EAAE,IAAI,EAAE,EACpE,2BAA2B,CAC5B,CAAC;QACF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,kBAAkB,CAC5B;YACE,GAAG,EAAE,oBAAoB;YACzB,IAAI,EAAE,gBAAgB;YACtB,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;YACpD,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE;SAChC,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,0DAA0D;QAC1D,OAAO,MAAM,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,sBAAsB,EAAE,SAAS,CAAC,CAAC;IAChD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAChC,CAAC;AAED,oFAAoF;AACpF,KAAK,UAAU,eAAe,CAC5B,OAAwB,EACxB,OAAuB;IAEvB,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC,OAAO,EAAE,CAAC;IAClD,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACzD,4BAA4B,CAC7B,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,KAAK,CAClB,OAAwB,EACxB,OAAuB,EACvB,KAAmB,EACnB,MAAkB,EAClB,OAAwB;IAExB,KAAK,CAAC,MAAM,CAAC,4BAA4B,EAAE,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC;IAC9E,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACnC,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,mBAAmB,6BAA6B,EAAE,CAAC,CAAC;QAClF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,+BAA+B,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EACrF,cAAc,CACf,CAAC;QACF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC5D,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,kBAAkB,CAC5B;YACE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU;YAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI;YACxB,MAAM,EAAE;gBACN,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;qBACnB,KAAK,CAAC,GAAG,CAAC;qBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;qBACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;gBAC9B,IAAI,EAAE,OAAO,CAAC,WAAW;gBACzB,KAAK,EAAE,OAAO,CAAC,KAAK;aACrB;YACD,MAAM,EAAE,OAAO,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK;YACnE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE;SACvC,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,4DAA4D;QAC5D,wEAAwE;QACxE,OAAO,CAAC,GAAG,CAAC,IAAI,CACd;YACE,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,MAAM,EAAE,yBAAyB;YACjC,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YACxD,IAAI,EAAE,MAAM,CAAC,IAAI;SAClB,EACD,cAAc,CACf,CAAC;QACF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACnC,KAAK,CAAC,MAAM,CAAC,sBAAsB,EAAE,SAAS,CAAC,CAAC;IAChD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,KAAmB,EAAE,OAAwB;IACvE,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9C,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9C,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IACjD,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9C,CAAC"}

package/vendor/gatekeeper/dist/server/routes/diagnostic.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"diagnostic.d.ts","sourceRoot":"","sources":["../../../src/server/routes/diagnostic.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAO7E,OAAO,KAAK,EAAsB,kBAAkB,EAAoB,MAAM,oBAAoB,CAAC;AAyLnG,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAgG9E;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,kBAAkB,GAAG,IAAI,CAEhE"}
+{"version":3,"file":"diagnostic.d.ts","sourceRoot":"","sources":["../../../src/server/routes/diagnostic.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAO7E,OAAO,KAAK,EAAsB,kBAAkB,EAAoB,MAAM,oBAAoB,CAAC;AAiNnG,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAyI9E;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,kBAAkB,GAAG,IAAI,CAEhE"}

package/vendor/gatekeeper/dist/server/routes/diagnostic.js

@@ -15,6 +15,20 @@ const DEFAULT_RETENTION_DAYS = 90;
 // JSON-era rotation cadence loosely and is comfortably below any sensible
 // retention setting.
 const RETENTION_SWEEP_INTERVAL_MS = 60 * 60 * 1000;
+/**
+ * `POST /api/access-log/purge { username, before? }`: the rows of one
+ * username, before a time when given. The username travels in the body —
+ * a URL is what request logs keep.
+ */
+const PurgeBodySchema = z
+    .object({
+    username: z.string().min(1).max(100),
+    before: z
+        .string()
+        .regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d{1,3})?Z$/, 'before is an ISO 8601 UTC time')
+        .optional(),
+})
+    .strict();
 const UpdateSettingsSchema = z.object({
     adminEmail: z.string().email().max(200).optional(),
     adminName: z.string().max(200).optional(),
@@ -41,6 +55,11 @@ async function getStmts() {
         countAll: db.prepare('SELECT COUNT(*) AS n FROM access_request_log'),
         deleteAll: db.prepare('DELETE FROM access_request_log'),
         deleteOlderThan: db.prepare('DELETE FROM access_request_log WHERE timestamp < ?'),
+        // Erasing a removed user (the panel): their rows only — those logged
+        // before they were removed, when the panel says when that was (a later
+        // user may have the same username).
+        deleteByUsername: db.prepare('DELETE FROM access_request_log WHERE username = ?'),
+        deleteByUsernameBefore: db.prepare('DELETE FROM access_request_log WHERE username = ? AND timestamp < ?'),
         begin: db.prepare('BEGIN IMMEDIATE'),
         commit: db.prepare('COMMIT'),
         rollback: db.prepare('ROLLBACK'),
@@ -223,12 +242,50 @@ export async function diagnosticRoutes(fastify) {
             return reply.code(500).send({ error: err.message });
         }
     });
-    // DELETE /api/access-log — clear access request log
-    fastify.delete('/access-log', async (_request, reply) => {
+    // DELETE /api/access-log — clear the whole access request log (and the
+    // entries still queued for it). It takes no query: a purge of one user's
+    // rows is POST /api/access-log/purge, and a query an older caller sent to
+    // narrow the purge must never clear everything instead. Answers how many
+    // rows went (`removed`).
+    fastify.delete('/access-log', async (request, reply) => {
+        if (Object.keys(request.query ?? {}).length > 0) {
+            return reply.code(400).send({
+                error: "DELETE clears the whole log and takes no query — purge one user's rows with POST /api/access-log/purge",
+            });
+        }
+        try {
+            const s = await getStmts();
+            logQueue = [];
+            const result = s.deleteAll.run();
+            return { ok: true, removed: Number(result.changes) };
+        }
+        catch (err) {
+            return reply.code(500).send({ error: err.message });
+        }
+    });
+    // POST /api/access-log/purge { username, before? } — one user's rows,
+    // logged before `before` when given (a later user may hold the username),
+    // and the matching entries still queued for the log, so none of them is
+    // written after the purge. Answers how many rows went (`removed`).
+    fastify.post('/access-log/purge', async (request, reply) => {
+        const parsed = PurgeBodySchema.safeParse(request.body ?? {});
+        if (!parsed.success) {
+            return reply.code(400).send({
+                error: 'Invalid body',
+                details: parsed.error.issues.map((i) => i.message),
+            });
+        }
+        const { username, before } = parsed.data;
         try {
             const s = await getStmts();
-            s.deleteAll.run();
-            return { ok: true };
+            const matches = (e) => e.username === username && (before === undefined || e.timestamp < before);
+            const kept = logQueue.filter((e) => !matches(e));
+            const queued = logQueue.length - kept.length;
+            logQueue = kept;
+            const result = before === undefined
+                ? s.deleteByUsername.run(username)
+                : s.deleteByUsernameBefore.run(username, before);
+            return { ok: true, removed: Number(result.changes) + queued };
         }
         catch (err) {
             return reply.code(500).send({ error: err.message });