@lamalibre/create-lamaste 4.5.0 → 4.7.0

package/vendor/gatekeeper/dist/server/routes/authz.js

@@ -1,10 +1,15 @@
 import crypto from 'node:crypto';
 import { request as undiciRequest } from 'undici';
-import { AUTHELIA_SESSION_COOKIE, RELAY_ASSERTION_HEADER, RELAY_PANEL_AUDIENCE, RELAY_PANEL_PORT, autheliaSessionCookies, isUserSurfaceUrl, signRelayAssertion, } from '@lamalibre/lamaste';
+import { AUTHELIA_SESSION_COOKIE, RELAY_ASSERTION_HEADER, RELAY_PANEL_AUDIENCE, RELAY_PANEL_PORT, autheliaSessionCookies, domainMembership, domainOfHost, isLamasteOwnedGroup, isUserSurfaceUrl, signRelayAssertion, userSurfaceHostByFqdn, } from '@lamalibre/lamaste';
 import { AUTHELIA_VERIFY_URL, SESSION_CACHE_TTL_MS } from '../../lib/constants.js';
-import { checkAccess } from '../../lib/authz.js';
-import { buildAccessRequestPage } from '../../lib/templates.js';
+import { checkAccess, isPluginAudienceMember } from '../../lib/authz.js';
+import { buildAccessRequestPage, buildDomainRefusalPage } from '../../lib/templates.js';
 import { logAccessRequest } from '../routes/diagnostic.js';
+/**
+ * The header a user-surface 403 names its refusal in — `not_a_member` or
+ * `forbidden` — for nginx to answer the application with as JSON.
+ */
+const USER_SURFACE_REFUSAL_HEADER = 'X-Lamalibre-Refusal';
 /** Hard cap on session cache entries to prevent memory exhaustion on 512MB droplets. */
 const MAX_SESSION_CACHE_ENTRIES = 10_000;
 /** Cache-Control max-age for a successful authz response (matches nginx 200 TTL). */
@@ -40,10 +45,18 @@ function sessionCacheKey(session, host) {
         .update(`${host.toLowerCase()}\n${session}`)
         .digest('hex');
 }
+/**
+ * Authelia refused a signed-in session for the host (its 403): the user is
+ * not a member of the host's domain, or not one of a site rule's users. A
+ * refusal page, never the sign-in — which would send the browser straight
+ * back here.
+ */
+const FORBIDDEN = 'forbidden';
 /**
  * Ask Authelia's verify endpoint about one session cookie for one URL, and
- * take the identity headers from its answer. Authelia is sent that cookie
- * alone (`authelia_session=<value>`), never the browser's others.
+ * take the identity headers from its answer — or {@link FORBIDDEN} when it
+ * refused a valid session for that URL. Authelia is sent that cookie alone
+ * (`authelia_session=<value>`), never the browser's others.
  */
 async function validateWithAuthelia(session, originalUrl, requestId) {
     try {
@@ -64,6 +77,8 @@ async function validateWithAuthelia(session, originalUrl, requestId) {
             // on the hot path; a stuck request would block the whole request queue.
             signal: AbortSignal.timeout(AUTHELIA_VERIFY_TIMEOUT_MS),
         });
+        if (statusCode === 403)
+            return FORBIDDEN;
         if (statusCode !== 200) {
             return null;
         }
@@ -184,29 +199,69 @@ export async function authzRoutes(fastify, opts = {}) {
     /**
      * GET /authz/user-surface/:fqdn — the nginx auth_request target of a
      * plugin's user surface: `/api/<route>/app` and everything under it, on
-     * the host of a tunnel bound to the plugin (`userSurface` in
-     * tunnels.json). The vhost names the tunnel as for `/authz/tunnel/:fqdn`.
+     * a host serving it — a tunnel bound to the plugin (`userSurface` in
+     * tunnels.json) or the site the plugin owns (`owner` in sites.json; core
+     * `userSurfaceHosts` reads both). The vhost names the host as for
+     * `/authz/tunnel/:fqdn`.
      *
-     * Gatekeeper authenticates the session — on a restricted tunnel it checks
-     * the user's grant too — and vouches for its user to the panel: a relay
+     * Gatekeeper authenticates the session — on a restricted host it checks
+     * the user's grant for the tunnel or the site too — and vouches for its user to the panel: a relay
      * assertion for the panel's audience and port, naming the username alone
      * and bound to the method and the raw request target, which must lie on
-     * the user surface of a route bound to this tunnel. The panel takes
+     * the user surface of a route this host serves. The panel takes
      * everything else about the user from its own directory.
      *
      * 200 with the assertion (never cacheable, no `Remote-*`), 401 without a
      * session (nginx answers with `/authz/user-surface-unauthenticated`), 403
      * for anything else refused — never the access-request page, never a
-     * redirect: the caller is an application's request. 503 while the relay
-     * signing key is unusable.
+     * redirect: the caller is an application's request. A 403 names its
+     * refusal in `X-Lamalibre-Refusal` (`not_a_member` for a user who is not a
+     * member of the host's domain, `forbidden` otherwise): nginx keeps only a
+     * subrequest's status and headers, never its body, and answers the
+     * application with that refusal as JSON. 503 while the relay signing key is
+     * unusable.
      */
     fastify.get('/authz/user-surface/:fqdn', { config: authzRateLimit }, async (request, reply) => authorizeUserSurfaceRequest(fastify, request, reply, request.params.fqdn));
+    /**
+     * GET /authz/user-surface-shell/:fqdn — the nginx auth_request target of
+     * every path of a plugin-owned site but its user surface's API: the shell
+     * of the plugin's web surface (`userSurface.web`). The vhost names the
+     * site in the path, as a tunnel vhost names its tunnel.
+     *
+     * The shell is the front of an API that knows its users, so it is gated
+     * as that API is: the site's route must be served (its plugin hosted, no
+     * other host serving it), the session valid, the user in the plugin's
+     * audience (an entitlement with roles, to the user or a group of theirs)
+     * and, on a restricted site, holding the site's grant. 200 (nothing else:
+     * nginx serves the shell from disk), 401 without a session
+     * (nginx redirects a page to the login), 403 otherwise — with the
+     * access-request page when the user lacks an entitlement or a grant
+     * (nginx serves it inline, as for a restricted tunnel).
+     */
+    fastify.get('/authz/user-surface-shell/:fqdn', { config: authzRateLimit }, async (request, reply) => authorizeUserSurfaceShellRequest(fastify, request, reply, request.params.fqdn));
     /**
      * GET /authz/user-surface-unauthenticated — what a user-surface request
      * without a session is answered with (nginx `error_page 401`): JSON, so
      * the application can tell its user to sign in again; never a redirect.
      */
     fastify.get('/authz/user-surface-unauthenticated', { config: authzRateLimit }, async (_request, reply) => reply.code(401).header('Cache-Control', 'no-store').send({ error: 'unauthenticated' }));
+    /**
+     * GET /authz/refusal/:fqdn — the page an Authelia-protected static site
+     * answers a signed-in user Authelia refused with (nginx `error_page 403`;
+     * the site asks Authelia itself, not Gatekeeper): not a member of the
+     * site's domain, or not one of its users. Decides nothing — always 403 —
+     * and reads no session: the vhost names its site in the path.
+     */
+    fastify.get('/authz/refusal/:fqdn', { config: authzRateLimit }, async (request, reply) => {
+        const { fqdn } = request.params;
+        if (!TUNNEL_FQDN_RE.test(fqdn))
+            return reply.code(403).send();
+        return sendRefusalPage(fastify, request, reply, fqdn, {
+            reason: 'site_refused',
+            domain: domainShownFor(fastify, fqdn),
+            site: true,
+        });
+    });
     /**
      * GET /authz/check — what tunnel vhosts written before 4.3 call. They name
      * the tunnel by the client's Host header (`$http_host`), which an
@@ -259,6 +314,10 @@ async function authenticatedSession(fastify, request, cookieHeader, originalUrl,
         sessionCache.delete(cacheKey);
     }
     const validated = await validateWithAuthelia(presented.value, originalUrl, requestId);
+    // Never cached: a membership added a moment later must be seen. Logged
+    // by the refusal that answers it.
+    if (validated === FORBIDDEN)
+        return refusedSession(fastify, presented.value, hostname, requestId);
     if (!validated) {
         request.log.info({ requestId, reason: 'authelia_rejected', fqdn: hostname }, 'authz denied');
         return null;
@@ -273,6 +332,84 @@ async function authenticatedSession(fastify, request, cookieHeader, originalUrl,
     sessionCache.set(cacheKey, validated);
     return validated;
 }
+/**
+ * Who an Authelia refusal for `hostname` was for, when they are an external
+ * member of its domain: Authelia's 403 names nobody, so Authelia is asked
+ * once more about the same session for the domain's sign-in portal
+ * (`https://auth.<domain>/`), which its rules admit for the domain's
+ * members and external members alike, and the projection says the kind.
+ * Never cached, and nothing but the refusal's wording follows from it: the
+ * request stays refused.
+ */
+async function refusedSession(fastify, session, hostname, requestId) {
+    const index = fastify.getDomains();
+    const domain = index ? domainOfHost(hostname, index.names) : null;
+    if (!index || domain === null)
+        return { forbidden: true, external: null };
+    const probe = await validateWithAuthelia(session, `https://auth.${domain}/`, requestId);
+    if (!probe || probe === FORBIDDEN)
+        return { forbidden: true, external: null };
+    const { kind } = domainMembership(index, hostname, probe.username);
+    return { forbidden: true, external: kind === 'external' ? probe : null };
+}
+/**
+ * The domain `hostname` is under — of the panel's projection; `hostname`
+ * itself when the projection names none for it (or is unreadable).
+ */
+function domainShownFor(fastify, hostname) {
+    const index = fastify.getDomains();
+    return index ? domainOfHost(hostname, index.names) : null;
+}
+/**
+ * The session's user admitted to `hostname`'s domain, with the kind of
+ * their membership — or why not: Authelia refused them for the host (its
+ * rendered membership), or the panel's projection (`domains.json`) lists
+ * them neither as a member nor as an external member of the domain the host
+ * is under. Checked after Authelia on every request, cached sessions too; a
+ * missing or unreadable projection, or a host under no domain, is a refusal
+ * (fail closed). An external member reaches only what names them: each
+ * route checks the kind against its access mode ({@link externalRefused}).
+ */
+function checkDomain(fastify, answer, hostname) {
+    if ('forbidden' in answer) {
+        const domain = domainShownFor(fastify, hostname);
+        return {
+            refused: answer.external
+                ? { reason: 'external_not_granted', domain, external: answer.external }
+                : { reason: 'authelia_forbidden', domain },
+        };
+    }
+    const index = fastify.getDomains();
+    const verdict = index ? domainMembership(index, hostname, answer.username) : null;
+    if (verdict?.kind)
+        return { session: answer, kind: verdict.kind };
+    return {
+        refused: { reason: 'not_a_member', domain: verdict?.domain ?? null },
+    };
+}
+/**
+ * Whether a host's access mode refuses a user of this membership kind on
+ * its own: `authenticated` admits every member of the domain and no
+ * external member — they reach only `restricted` hosts that grant them.
+ */
+function externalRefused(kind, accessMode) {
+    return kind === 'external' && accessMode === 'authenticated';
+}
+/**
+ * Answer a refused request with a refusal page — nginx serves it inline
+ * (`error_page 403`): a signed-in user who may not reach the host's domain,
+ * or (`site`) a static site that refused one. Logged with the host and the
+ * reason — never the user.
+ */
+function sendRefusalPage(fastify, request, reply, hostname, { reason, domain, site = false }) {
+    request.log.info({ requestId: request.id, reason, fqdn: hostname }, 'authz denied');
+    const settings = fastify.getSettings();
+    return reply
+        .code(403)
+        .header('Cache-Control', 'no-store')
+        .type('text/html; charset=utf-8')
+        .send(buildDomainRefusalPage(domain, { adminContact: settings.adminEmail, adminName: settings.adminName }, { host: hostname.toLowerCase(), site }));
+}
 /**
  * Authorize one request on the tunnel named `fqdn` (see the
  * `/authz/tunnel/:fqdn` route).
@@ -307,10 +444,28 @@ async function authorizeTunnelRequest(fastify, request, reply, fqdn) {
         request.log.info({ requestId, reason: 'unknown_tunnel_fqdn', fqdn }, 'authz denied');
         return reply.code(401).send();
     }
-    const session = await authenticatedSession(fastify, request, cookie, originalUrl, parsed.hostname);
-    if (!session)
+    const answer = await authenticatedSession(fastify, request, cookie, originalUrl, parsed.hostname);
+    if (!answer)
         return reply.code(401).send();
+    const checked = checkDomain(fastify, answer, parsed.hostname);
+    if ('refused' in checked) {
+        const { external } = checked.refused;
+        if (external) {
+            return refuseUngranted(fastify, request, reply, external, parsed.hostname, {
+                reason: 'external_not_granted',
+                resourceId: tunnel.id,
+            });
+        }
+        return sendRefusalPage(fastify, request, reply, parsed.hostname, checked.refused);
+    }
+    const { session } = checked;
     // Check access mode
+    if (externalRefused(checked.kind, tunnel.accessMode)) {
+        return refuseUngranted(fastify, request, reply, session, parsed.hostname, {
+            reason: 'external_not_granted',
+            resourceId: tunnel.id,
+        });
+    }
     if (tunnel.accessMode === 'public' || tunnel.accessMode === 'authenticated') {
         return allow(fastify, request, reply, tunnel, session);
     }
@@ -322,29 +477,35 @@ async function authorizeTunnelRequest(fastify, request, reply, fqdn) {
     if (result.allowed) {
         return allow(fastify, request, reply, tunnel, session);
     }
-    // The tunnel and the reason only — never who was refused.
-    request.log.info({
-        requestId,
+    return refuseUngranted(fastify, request, reply, session, parsed.hostname, {
         reason: 'no_matching_grant',
-        tunnel: fqdn,
-        resourceType: 'tunnel',
         resourceId: tunnel.id,
-    }, 'authz denied');
-    if (fastify.getSettings().accessLoggingEnabled) {
+    });
+}
+/**
+ * Answer a tunnel request its user is not granted with the access-request
+ * page (403): no grant on a `restricted` tunnel, or an external member on an
+ * `authenticated` one (they are on the domain, only not granted). Logged
+ * with the tunnel and the reason — never who was refused.
+ */
+function refuseUngranted(fastify, request, reply, session, hostname, { reason, resourceId }) {
+    request.log.info({ requestId: request.id, reason, tunnel: hostname, resourceType: 'tunnel', resourceId }, 'authz denied');
+    const settings = fastify.getSettings();
+    if (settings.accessLoggingEnabled) {
         logAccessRequest({
             timestamp: new Date().toISOString(),
             username: session.username,
             resourceType: 'tunnel',
-            resourceId: tunnel.id,
-            resourceFqdn: parsed.hostname,
+            resourceId,
+            resourceFqdn: hostname,
         });
     }
-    // Access denied — return inline HTML page as 403 body.
-    // Cache-Control: no-store so nginx never caches the denial; the matching
-    // proxy_cache_valid 403 0 in the snippet is the authoritative setting.
-    const html = buildAccessRequestPage(session.username, parsed.hostname, {
-        adminContact: fastify.getSettings().adminEmail,
-        adminName: fastify.getSettings().adminName,
+    // Inline HTML as the 403 body. Cache-Control: no-store so nginx never
+    // caches the denial; the matching proxy_cache_valid 403 0 in the snippet
+    // is the authoritative setting.
+    const html = buildAccessRequestPage(session.username, hostname, {
+        adminContact: settings.adminEmail,
+        adminName: settings.adminName,
     });
     return reply
         .code(403)
@@ -362,7 +523,7 @@ async function authorizeUserSurfaceRequest(fastify, request, reply, fqdn) {
     reply.header('Cache-Control', 'no-store');
     const refuse = (reason, extra = {}) => {
         request.log.info({ requestId, reason, tunnel: fqdn, ...extra }, 'user-surface authz denied');
-        return reply.code(403).send();
+        return reply.code(403).header(USER_SURFACE_REFUSAL_HEADER, 'forbidden').send();
     };
     if (!TUNNEL_FQDN_RE.test(fqdn))
         return refuse('invalid_tunnel_name');
@@ -379,13 +540,11 @@ async function authorizeUserSurfaceRequest(fastify, request, reply, fqdn) {
         const { reason, ...detail } = mismatch;
         return refuse(reason, detail);
     }
-    const tunnel = findTunnelByFqdn(fastify.getTunnels(), fqdn);
-    if (!tunnel)
-        return refuse('unknown_tunnel_fqdn');
-    if (!tunnel.enabled)
-        return refuse('tunnel_disabled');
-    if (tunnel.accessMode === 'public' || !tunnel.userSurface)
+    const host = userSurfaceHostByFqdn(fastify.getUserSurfaceHosts(), fqdn);
+    if (!host)
         return refuse('no_user_surface');
+    if (!host.enabled)
+        return refuse('tunnel_disabled');
     // The request target exactly as the browser sent it — what follows the
     // hostname the vhost wrote — never re-encoded by a URL parser: the panel
     // receives it unchanged and holds the assertion against it byte for byte.
@@ -394,25 +553,42 @@ async function authorizeUserSurfaceRequest(fastify, request, reply, fqdn) {
         return refuse('invalid_original_url');
     }
     const target = originalUrl.slice(prefix.length);
-    const route = tunnel.userSurface.routes.find((r) => isUserSurfaceUrl(target, r));
+    const route = host.routes.find((r) => isUserSurfaceUrl(target, r));
     if (!route)
         return refuse('not_on_user_surface');
-    // Bound, but its plugin is not hosted by the agent carrying this tunnel
-    // (moved, revoked, hosted elsewhere): nothing of it is served here.
-    if (!tunnel.userSurface.served.includes(route))
+    // Bound, but not served here: a tunnel's plugin hosted by another agent
+    // than the one carrying it (moved, revoked, hosted elsewhere), a site's
+    // plugin not hosted at all, or a route another host would serve too.
+    if (!host.served.includes(route))
         return refuse('not_hosting_agent', { route });
-    const session = await authenticatedSession(fastify, request, request.headers['cookie'], originalUrl, parsed.hostname);
-    if (!session)
+    const answer = await authenticatedSession(fastify, request, request.headers['cookie'], originalUrl, parsed.hostname);
+    if (!answer)
         return reply.code(401).send();
-    if (tunnel.accessMode !== 'authenticated') {
-        // restricted — the user's grant for the tunnel, as on its other paths
-        const result = await checkAccess(session.username, 'tunnel', tunnel.id, {
+    const checked = checkDomain(fastify, answer, parsed.hostname);
+    if ('refused' in checked) {
+        // An application's request: JSON, never a page.
+        request.log.info({ requestId, reason: checked.refused.reason, tunnel: fqdn }, 'user-surface authz denied');
+        // An external member Authelia refused is on the domain, only not
+        // granted: `forbidden`, as Gatekeeper's own refusal of them says.
+        return reply
+            .code(403)
+            .header(USER_SURFACE_REFUSAL_HEADER, checked.refused.external ? 'forbidden' : 'not_a_member')
+            .send();
+    }
+    const { session } = checked;
+    if (externalRefused(checked.kind, host.accessMode)) {
+        return refuse('external_not_granted', { resourceType: host.kind, resourceId: host.id });
+    }
+    if (host.accessMode !== 'authenticated') {
+        // restricted — the user's grant for the host (the tunnel, or the site),
+        // as on its other paths
+        const result = await checkAccess(session.username, host.kind, host.id, {
             adminContact: fastify.getSettings().adminEmail,
             adminName: fastify.getSettings().adminName,
         });
         if (!result.allowed) {
-            // The tunnel and the reason only — never who was refused.
-            return refuse('no_matching_grant', { resourceType: 'tunnel', resourceId: tunnel.id });
+            // The host and the reason only — never who was refused.
+            return refuse('no_matching_grant', { resourceType: host.kind, resourceId: host.id });
         }
     }
     const key = await currentRelayKey(fastify, request);
@@ -437,6 +613,90 @@ async function authorizeUserSurfaceRequest(fastify, request, reply, fqdn) {
     reply.header(RELAY_ASSERTION_HEADER, assertion);
     return reply.code(200).send();
 }
+/**
+ * Authorize one request for the shell of the plugin-owned site named
+ * `fqdn` (see the `/authz/user-surface-shell/:fqdn` route).
+ */
+async function authorizeUserSurfaceShellRequest(fastify, request, reply, fqdn) {
+    const requestId = request.id;
+    reply.header('Cache-Control', 'no-store');
+    const refuse = (reason, extra = {}) => {
+        request.log.info({ requestId, reason, site: fqdn, ...extra }, 'shell authz denied');
+        return reply.code(403).send();
+    };
+    if (!TUNNEL_FQDN_RE.test(fqdn))
+        return refuse('invalid_site_name');
+    const originalUrl = request.headers['x-original-url'];
+    if (typeof originalUrl !== 'string')
+        return refuse('missing_original_request');
+    const parsed = parseOriginalUrl(originalUrl);
+    if (!parsed)
+        return refuse('invalid_original_url');
+    const mismatch = hostnameMismatch(request, fqdn, parsed.hostname);
+    if (mismatch) {
+        const { reason, ...detail } = mismatch;
+        return refuse(reason, detail);
+    }
+    const host = userSurfaceHostByFqdn(fastify.getUserSurfaceHosts(), fqdn);
+    if (!host || host.kind !== 'site')
+        return refuse('not_a_web_surface');
+    const [route] = host.routes;
+    if (route === undefined || !host.served.includes(route))
+        return refuse('not_served', { route });
+    const answer = await authenticatedSession(fastify, request, request.headers['cookie'], originalUrl, parsed.hostname);
+    if (!answer)
+        return reply.code(401).send();
+    const checked = checkDomain(fastify, answer, parsed.hostname);
+    const settings = fastify.getSettings();
+    const templateOptions = { adminContact: settings.adminEmail, adminName: settings.adminName };
+    if ('refused' in checked) {
+        const { external } = checked.refused;
+        if (!external) {
+            return sendRefusalPage(fastify, request, reply, parsed.hostname, checked.refused);
+        }
+        // An external member Authelia refused: on the domain, only not granted.
+        request.log.info({
+            requestId,
+            reason: 'external_not_granted',
+            site: fqdn,
+            resourceType: 'site',
+            resourceId: host.id,
+        }, 'shell authz denied');
+        return reply
+            .code(403)
+            .type('text/html; charset=utf-8')
+            .send(buildAccessRequestPage(external.username, parsed.hostname, templateOptions));
+    }
+    const { session } = checked;
+    const deny = (resourceType, resourceId) => {
+        // The host and the reason only — never who was refused.
+        request.log.info({ requestId, reason: 'no_matching_grant', site: fqdn, resourceType, resourceId }, 'shell authz denied');
+        if (settings.accessLoggingEnabled) {
+            logAccessRequest({
+                timestamp: new Date().toISOString(),
+                username: session.username,
+                resourceType,
+                resourceId,
+                resourceFqdn: parsed.hostname,
+            });
+        }
+        return reply
+            .code(403)
+            .type('text/html; charset=utf-8')
+            .send(buildAccessRequestPage(session.username, parsed.hostname, templateOptions));
+    };
+    if (!(await isPluginAudienceMember(session.username, route)))
+        return deny('plugin', route);
+    if (externalRefused(checked.kind, host.accessMode))
+        return deny('site', host.id);
+    if (host.accessMode !== 'authenticated') {
+        const result = await checkAccess(session.username, 'site', host.id, templateOptions);
+        if (!result.allowed)
+            return deny('site', host.id);
+    }
+    // Nothing to pass on: nginx serves the shell from disk, no backend gets a user.
+    return reply.code(200).send();
+}
 /** The relay signing key, or null when there is none or it is unusable (logged). */
 async function currentRelayKey(fastify, request) {
     try {
@@ -460,7 +720,7 @@ async function currentRelayKey(fastify, request) {
 async function allow(fastify, request, reply, tunnel, session) {
     reply.header('X-Gatekeeper-Cache-Version', String(fastify.getCacheVersion()));
     if (!tunnel.plugin) {
-        setAutheliaHeaders(reply, session);
+        setAutheliaHeaders(fastify, reply, session);
         reply.header('Cache-Control', `public, max-age=${AUTHZ_SUCCESS_MAX_AGE_SECONDS}`);
         return reply.code(200).send();
     }
@@ -479,10 +739,7 @@ async function allow(fastify, request, reply, tunnel, session) {
             caller: {
                 type: 'user',
                 username: session.username,
-                groups: session.groups
-                    .split(',')
-                    .map((g) => g.trim())
-                    .filter((g) => g.length > 0),
+                groups: shownGroups(fastify, session),
                 name: session.displayName,
                 email: session.email,
             },
@@ -501,17 +758,30 @@ async function allow(fastify, request, reply, tunnel, session) {
         }, 'authz denied');
         return reply.code(403).send();
     }
-    setAutheliaHeaders(reply, session);
+    setAutheliaHeaders(fastify, reply, session);
     reply.header(RELAY_ASSERTION_HEADER, assertion);
     return reply.code(200).send();
 }
+/**
+ * The user's Authelia groups a backend may see: every group but the ones
+ * Lamaste owns (`lamaste:…` and host groups — who is a member of which
+ * domain and named on which host is Authelia's business, not an
+ * application's).
+ */
+function shownGroups(fastify, session) {
+    const names = fastify.getDomains()?.names ?? [];
+    return session.groups
+        .split(',')
+        .map((g) => g.trim())
+        .filter((g) => g.length > 0 && !isLamasteOwnedGroup(g, names));
+}
 /**
  * Set Authelia identity headers on the response so nginx can
  * forward them to the tunnel backend.
  */
-function setAutheliaHeaders(reply, session) {
+function setAutheliaHeaders(fastify, reply, session) {
     reply.header('remote-user', session.username);
-    reply.header('remote-groups', session.groups);
+    reply.header('remote-groups', shownGroups(fastify, session).join(','));
     reply.header('remote-name', session.displayName);
     reply.header('remote-email', session.email);
 }

package/vendor/gatekeeper/dist/server/routes/authz.js.map

@@ -1 +1 @@
-{"version":3,"file":"authz.js","sourceRoot":"","sources":["../../../src/server/routes/authz.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAG3D,wFAAwF;AACxF,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAEzC,qFAAqF;AACrF,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAEzC,mFAAmF;AACnF,MAAM,0BAA0B,GAAG,KAAK,CAAC;AAEzC;;;;GAIG;AACH,MAAM,eAAe,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;AAiB/C,SAAS,gBAAgB,CAAC,YAA2C;IACnE,yEAAyE;IACzE,uEAAuE;IACvE,MAAM,MAAM,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAC;IACpD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC/C,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC;IACvB,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,OAAe,EAAE,IAAY;IACpD,OAAO,MAAM;SACV,UAAU,CAAC,QAAQ,EAAE,eAAe,CAAC;SACrC,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,KAAK,OAAO,EAAE,CAAC;SAC3C,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,oBAAoB,CACjC,OAAe,EACf,WAAmB,EACnB,SAAiB;IAEjB,IAAI,CAAC;QACH,qEAAqE;QACrE,uEAAuE;QACvE,uEAAuE;QACvE,sCAAsC;QACtC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,aAAa,CAAC,mBAAmB,EAAE;YACvE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,MAAM,EAAE,GAAG,uBAAuB,IAAI,OAAO,EAAE;gBAC/C,gBAAgB,EAAE,WAAW;gBAC7B,mBAAmB,EAAE,KAAK;gBAC1B,iBAAiB,EAAE,WAAW;gBAC9B,cAAc,EAAE,SAAS;aAC1B;YACD,yEAAyE;YACzE,wEAAwE;YACxE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,0BAA0B,CAAC;SACxD,CAAC,CAAC;QAEH,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QACnD,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE3B,OAAO;YACL,QAAQ;YACR,MAAM,EAAE,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC,IAAI,EAAE;YACjD,WAAW,EAAE,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC,IAAI,EAAE;YACpD,KAAK,EAAE,SAAS,CAAC,OAAO,EAAE,cAAc,CAAC,IAAI,EAAE;YAC/C,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,oBAAoB;SAC7C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAChB,OAAsD,EACtD,IAAY;IAEZ,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;IACtC,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,OAA8B,EAAE,IAAY;IACpE,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAClC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CACvB,OAAuB,EACvB,IAAY,EACZ,YAAoB;IAEpB,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,MAAM,UAAU,GAAI,OAAO,CAAC,OAAO,CAAC,MAAM,CAAwB,IAAI,EAAE,CAAC;IACzE,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC/D,IAAI,YAAY,CAAC,WAAW,EAAE,KAAK,KAAK,IAAI,QAAQ,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAC5E,OAAO;QACL,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,qBAAqB;QACjE,YAAY;QACZ,UAAU;KACX,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,MAAM,cAAc,GAClB,+FAA+F,CAAC;AAElG;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,CAAC;AAEjD;;;;;;;;GAQG;AACH,SAAS,iBAAiB,CAAC,OAAuB;IAChD,MAAM,IAAI,GAAI,OAAO,CAAC,MAAyC,EAAE,IAAI,CAAC;IACtE,MAAM,IAAI,GACR,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAwB,IAAI,EAAE,CAAC,CAAC;IAC5F,OAAO,GAAG,OAAO,CAAC,EAAE,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;AAC/C,CAAC;AAQD;;;GAGG;AACH,SAAS,gBAAgB,CAAC,WAAmB;IAC3C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAwB,EACxB,OAA2B,EAAE;IAE7B,MAAM,cAAc,GAAG;QACrB,SAAS,EAAE;YACT,GAAG,EAAE,IAAI,CAAC,kBAAkB,IAAI,2BAA2B;YAC3D,UAAU,EAAE,UAAU;YACtB,YAAY,EAAE,iBAAiB;SAChC;KACF,CAAC;IAEF;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,GAAG,CACT,qBAAqB,EACrB,EAAE,MAAM,EAAE,cAAc,EAAE,EAC1B,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAC/F,CAAC;IAEF;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,GAAG,CACT,2BAA2B,EAC3B,EAAE,MAAM,EAAE,cAAc,EAAE,EAC1B,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CACvB,2BAA2B,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAC5E,CAAC;IAEF;;;;OAIG;IACH,OAAO,CAAC,GAAG,CACT,qCAAqC,EACrC,EAAE,MAAM,EAAE,cAAc,EAAE,EAC1B,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CACxB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CACzF,CAAC;IAEF;;;;;;;OAOG;IACH,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC/E,OAAO,CAAC,GAAG,CAAC,KAAK,CACf;YACE,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,MAAM,EAAE,6BAA6B;YACrC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,EACD,8HAA8H,CAC/H,CAAC;QACF,OAAO,KAAK;aACT,IAAI,CAAC,GAAG,CAAC;aACT,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC;aACnC,IAAI,CAAC,2BAA2B,CAAC;aACjC,IAAI,CAAC,0EAA0E,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,oBAAoB,CACjC,OAAwB,EACxB,OAAuB,EACvB,YAA2C,EAC3C,WAAmB,EACnB,QAAgB;IAEhB,MAAM,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAC;IACjD,IAAI,SAAS,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC7B,uEAAuE;QACvE,iEAAiE;QACjE,OAAO,CAAC,GAAG,CAAC,IAAI,CACd;YACE,SAAS;YACT,MAAM,EAAE,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,2BAA2B;YAC3F,IAAI,EAAE,QAAQ;SACf,EACD,cAAc,CACf,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,eAAe,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAC/C,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,MAAM,CAAC;IAC3D,IAAI,MAAM,EAAE,CAAC;QACX,0DAA0D;QAC1D,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,SAAS,CAAC,KAAK,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;IACtF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,mBAAmB,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,cAAc,CAAC,CAAC;QAC7F,OAAO,IAAI,CAAC;IACd,CAAC;IAED,2EAA2E;IAC3E,OAAO,YAAY,CAAC,IAAI,IAAI,yBAAyB,EAAE,CAAC;QACtD,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QACnD,IAAI,SAAS,KAAK,SAAS;YAAE,MAAM;QACnC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAED,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACtC,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,sBAAsB,CACnC,OAAwB,EACxB,OAAuB,EACvB,KAAmB,EACnB,IAAY;IAEZ,MAAM,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC;IAC7B,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,qBAAqB,EAAE,EAAE,cAAc,CAAC,CAAC;QAC/E,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,WAAW,GAAI,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAY,IAAI,EAAE,CAAC;IACxE,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,sBAAsB,EAAE,EAAE,cAAc,CAAC,CAAC;QAChF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,wEAAwE;IACxE,6DAA6D;IAC7D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClE,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,GAAG,QAAQ,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC;QACjF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,qBAAqB,EAAE,IAAI,EAAE,EAAE,cAAc,CAAC,CAAC;QACrF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,oBAAoB,CACxC,OAAO,EACP,OAAO,EACP,MAAM,EACN,WAAW,EACX,MAAM,CAAC,QAAQ,CAChB,CAAC;IACF,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAE5C,oBAAoB;IACpB,IAAI,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,KAAK,eAAe,EAAE,CAAC;QAC5E,OAAO,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC;IAED,4BAA4B;IAC5B,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE;QACtE,YAAY,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,UAAU;QAC9C,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,SAAS;KAC3C,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC;IAED,0DAA0D;IAC1D,OAAO,CAAC,GAAG,CAAC,IAAI,CACd;QACE,SAAS;QACT,MAAM,EAAE,mBAAmB;QAC3B,MAAM,EAAE,IAAI;QACZ,YAAY,EAAE,QAAQ;QACtB,UAAU,EAAE,MAAM,CAAC,EAAE;KACtB,EACD,cAAc,CACf,CAAC;IAEF,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,oBAAoB,EAAE,CAAC;QAC/C,gBAAgB,CAAC;YACf,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,YAAY,EAAE,QAAQ;YACtB,UAAU,EAAE,MAAM,CAAC,EAAE;YACrB,YAAY,EAAE,MAAM,CAAC,QAAQ;SAC9B,CAAC,CAAC;IACL,CAAC;IAED,uDAAuD;IACvD,yEAAyE;IACzE,uEAAuE;IACvE,MAAM,IAAI,GAAG,sBAAsB,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;QACrE,YAAY,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,UAAU;QAC9C,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,SAAS;KAC3C,CAAC,CAAC;IAEH,OAAO,KAAK;SACT,IAAI,CAAC,GAAG,CAAC;SACT,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC;SACnC,IAAI,CAAC,0BAA0B,CAAC;SAChC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,2BAA2B,CACxC,OAAwB,EACxB,OAAuB,EACvB,KAAmB,EACnB,IAAY;IAEZ,MAAM,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC;IAC7B,wEAAwE;IACxE,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,QAAiC,EAAE,EAAgB,EAAE;QACnF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,EAAE,2BAA2B,CAAC,CAAC;QAC7F,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC,CAAC;IAEF,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC,qBAAqB,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACtD,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC5D,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;QAC1E,OAAO,MAAM,CAAC,0BAA0B,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC,sBAAsB,CAAC,CAAC;IAEnD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClE,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,GAAG,QAAQ,CAAC;QACvC,OAAO,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,IAAI,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACtD,IAAI,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,WAAW;QAAE,OAAO,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAE5F,uEAAuE;IACvE,yEAAyE;IACzE,0EAA0E;IAC1E,MAAM,MAAM,GAAG,WAAW,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;IAC/C,IAAI,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;QACjE,OAAO,MAAM,CAAC,sBAAsB,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACjF,IAAI,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC,qBAAqB,CAAC,CAAC;IACjD,wEAAwE;IACxE,oEAAoE;IACpE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,mBAAmB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAE9F,MAAM,OAAO,GAAG,MAAM,oBAAoB,CACxC,OAAO,EACP,OAAO,EACP,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EACzB,WAAW,EACX,MAAM,CAAC,QAAQ,CAChB,CAAC;IACF,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAE5C,IAAI,MAAM,CAAC,UAAU,KAAK,eAAe,EAAE,CAAC;QAC1C,sEAAsE;QACtE,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE;YACtE,YAAY,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,UAAU;YAC9C,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,SAAS;SAC3C,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,0DAA0D;YAC1D,OAAO,MAAM,CAAC,mBAAmB,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,SAAS,EAAE,MAAM,EAAE,+BAA+B,EAAE,MAAM,EAAE,IAAI,EAAE,EACpE,2BAA2B,CAC5B,CAAC;QACF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,kBAAkB,CAC5B;YACE,GAAG,EAAE,oBAAoB;YACzB,IAAI,EAAE,gBAAgB;YACtB,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;YACpD,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE;SAChC,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,0DAA0D;QAC1D,OAAO,MAAM,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,sBAAsB,EAAE,SAAS,CAAC,CAAC;IAChD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAChC,CAAC;AAED,oFAAoF;AACpF,KAAK,UAAU,eAAe,CAC5B,OAAwB,EACxB,OAAuB;IAEvB,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC,OAAO,EAAE,CAAC;IAClD,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACzD,4BAA4B,CAC7B,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,KAAK,CAClB,OAAwB,EACxB,OAAuB,EACvB,KAAmB,EACnB,MAAkB,EAClB,OAAwB;IAExB,KAAK,CAAC,MAAM,CAAC,4BAA4B,EAAE,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC;IAC9E,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACnC,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,mBAAmB,6BAA6B,EAAE,CAAC,CAAC;QAClF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,+BAA+B,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EACrF,cAAc,CACf,CAAC;QACF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC5D,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,kBAAkB,CAC5B;YACE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU;YAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI;YACxB,MAAM,EAAE;gBACN,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;qBACnB,KAAK,CAAC,GAAG,CAAC;qBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;qBACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;gBAC9B,IAAI,EAAE,OAAO,CAAC,WAAW;gBACzB,KAAK,EAAE,OAAO,CAAC,KAAK;aACrB;YACD,MAAM,EAAE,OAAO,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK;YACnE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE;SACvC,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,4DAA4D;QAC5D,wEAAwE;QACxE,OAAO,CAAC,GAAG,CAAC,IAAI,CACd;YACE,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,MAAM,EAAE,yBAAyB;YACjC,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YACxD,IAAI,EAAE,MAAM,CAAC,IAAI;SAClB,EACD,cAAc,CACf,CAAC;QACF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACnC,KAAK,CAAC,MAAM,CAAC,sBAAsB,EAAE,SAAS,CAAC,CAAC;IAChD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,KAAmB,EAAE,OAAwB;IACvE,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9C,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9C,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IACjD,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9C,CAAC"}
+{"version":3,"file":"authz.js","sourceRoot":"","sources":["../../../src/server/routes/authz.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,YAAY,EACZ,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AACxF,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAG3D;;;GAGG;AACH,MAAM,2BAA2B,GAAG,qBAAqB,CAAC;AAE1D,wFAAwF;AACxF,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAEzC,qFAAqF;AACrF,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAEzC,mFAAmF;AACnF,MAAM,0BAA0B,GAAG,KAAK,CAAC;AAEzC;;;;GAIG;AACH,MAAM,eAAe,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;AAiB/C,SAAS,gBAAgB,CAAC,YAA2C;IACnE,yEAAyE;IACzE,uEAAuE;IACvE,MAAM,MAAM,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAC;IACpD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC/C,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC;IACvB,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,OAAe,EAAE,IAAY;IACpD,OAAO,MAAM;SACV,UAAU,CAAC,QAAQ,EAAE,eAAe,CAAC;SACrC,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,KAAK,OAAO,EAAE,CAAC;SAC3C,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,SAAS,GAAG,WAAW,CAAC;AAE9B;;;;;GAKG;AACH,KAAK,UAAU,oBAAoB,CACjC,OAAe,EACf,WAAmB,EACnB,SAAiB;IAEjB,IAAI,CAAC;QACH,qEAAqE;QACrE,uEAAuE;QACvE,uEAAuE;QACvE,sCAAsC;QACtC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,aAAa,CAAC,mBAAmB,EAAE;YACvE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,MAAM,EAAE,GAAG,uBAAuB,IAAI,OAAO,EAAE;gBAC/C,gBAAgB,EAAE,WAAW;gBAC7B,mBAAmB,EAAE,KAAK;gBAC1B,iBAAiB,EAAE,WAAW;gBAC9B,cAAc,EAAE,SAAS;aAC1B;YACD,yEAAyE;YACzE,wEAAwE;YACxE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,0BAA0B,CAAC;SACxD,CAAC,CAAC;QAEH,IAAI,UAAU,KAAK,GAAG;YAAE,OAAO,SAAS,CAAC;QACzC,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QACnD,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE3B,OAAO;YACL,QAAQ;YACR,MAAM,EAAE,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC,IAAI,EAAE;YACjD,WAAW,EAAE,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC,IAAI,EAAE;YACpD,KAAK,EAAE,SAAS,CAAC,OAAO,EAAE,cAAc,CAAC,IAAI,EAAE;YAC/C,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,oBAAoB;SAC7C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAChB,OAAsD,EACtD,IAAY;IAEZ,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;IACtC,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,OAA8B,EAAE,IAAY;IACpE,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAClC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CACvB,OAAuB,EACvB,IAAY,EACZ,YAAoB;IAEpB,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,MAAM,UAAU,GAAI,OAAO,CAAC,OAAO,CAAC,MAAM,CAAwB,IAAI,EAAE,CAAC;IACzE,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC/D,IAAI,YAAY,CAAC,WAAW,EAAE,KAAK,KAAK,IAAI,QAAQ,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAC5E,OAAO;QACL,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,qBAAqB;QACjE,YAAY;QACZ,UAAU;KACX,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,MAAM,cAAc,GAClB,+FAA+F,CAAC;AAElG;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,CAAC;AAEjD;;;;;;;;GAQG;AACH,SAAS,iBAAiB,CAAC,OAAuB;IAChD,MAAM,IAAI,GAAI,OAAO,CAAC,MAAyC,EAAE,IAAI,CAAC;IACtE,MAAM,IAAI,GACR,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAwB,IAAI,EAAE,CAAC,CAAC;IAC5F,OAAO,GAAG,OAAO,CAAC,EAAE,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;AAC/C,CAAC;AAQD;;;GAGG;AACH,SAAS,gBAAgB,CAAC,WAAmB;IAC3C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAwB,EACxB,OAA2B,EAAE;IAE7B,MAAM,cAAc,GAAG;QACrB,SAAS,EAAE;YACT,GAAG,EAAE,IAAI,CAAC,kBAAkB,IAAI,2BAA2B;YAC3D,UAAU,EAAE,UAAU;YACtB,YAAY,EAAE,iBAAiB;SAChC;KACF,CAAC;IAEF;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,GAAG,CACT,qBAAqB,EACrB,EAAE,MAAM,EAAE,cAAc,EAAE,EAC1B,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAC/F,CAAC;IAEF;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,OAAO,CAAC,GAAG,CACT,2BAA2B,EAC3B,EAAE,MAAM,EAAE,cAAc,EAAE,EAC1B,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CACvB,2BAA2B,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAC5E,CAAC;IAEF;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,GAAG,CACT,iCAAiC,EACjC,EAAE,MAAM,EAAE,cAAc,EAAE,EAC1B,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CACvB,gCAAgC,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CACjF,CAAC;IAEF;;;;OAIG;IACH,OAAO,CAAC,GAAG,CACT,qCAAqC,EACrC,EAAE,MAAM,EAAE,cAAc,EAAE,EAC1B,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CACxB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CACzF,CAAC;IAEF;;;;;;OAMG;IACH,OAAO,CAAC,GAAG,CACT,sBAAsB,EACtB,EAAE,MAAM,EAAE,cAAc,EAAE,EAC1B,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9D,OAAO,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE;YACpD,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC;YACrC,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF;;;;;;;OAOG;IACH,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC/E,OAAO,CAAC,GAAG,CAAC,KAAK,CACf;YACE,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,MAAM,EAAE,6BAA6B;YACrC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,EACD,8HAA8H,CAC/H,CAAC;QACF,OAAO,KAAK;aACT,IAAI,CAAC,GAAG,CAAC;aACT,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC;aACnC,IAAI,CAAC,2BAA2B,CAAC;aACjC,IAAI,CAAC,0EAA0E,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,oBAAoB,CACjC,OAAwB,EACxB,OAAuB,EACvB,YAA2C,EAC3C,WAAmB,EACnB,QAAgB;IAEhB,MAAM,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAC;IACjD,IAAI,SAAS,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC7B,uEAAuE;QACvE,iEAAiE;QACjE,OAAO,CAAC,GAAG,CAAC,IAAI,CACd;YACE,SAAS;YACT,MAAM,EAAE,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,2BAA2B;YAC3F,IAAI,EAAE,QAAQ;SACf,EACD,cAAc,CACf,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,eAAe,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAC/C,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,MAAM,CAAC;IAC3D,IAAI,MAAM,EAAE,CAAC;QACX,0DAA0D;QAC1D,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,SAAS,CAAC,KAAK,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;IACtF,uEAAuE;IACvE,kCAAkC;IAClC,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,cAAc,CAAC,OAAO,EAAE,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IAClG,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,mBAAmB,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,cAAc,CAAC,CAAC;QAC7F,OAAO,IAAI,CAAC;IACd,CAAC;IAED,2EAA2E;IAC3E,OAAO,YAAY,CAAC,IAAI,IAAI,yBAAyB,EAAE,CAAC;QACtD,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QACnD,IAAI,SAAS,KAAK,SAAS;YAAE,MAAM;QACnC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAED,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACtC,OAAO,SAAS,CAAC;AACnB,CAAC;AAaD;;;;;;;;GAQG;AACH,KAAK,UAAU,cAAc,CAC3B,OAAwB,EACxB,OAAe,EACf,QAAgB,EAChB,SAAiB;IAEjB,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,IAAI,CAAC,KAAK,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1E,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,gBAAgB,MAAM,GAAG,EAAE,SAAS,CAAC,CAAC;IACxF,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC9E,MAAM,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IACnE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAC3E,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,OAAwB,EAAE,QAAgB;IAChE,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IACnC,OAAO,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5D,CAAC;AAWD;;;;;;;;;GASG;AACH,SAAS,WAAW,CAClB,OAAwB,EACxB,MAAmC,EACnC,QAAgB;IAIhB,IAAI,WAAW,IAAI,MAAM,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACjD,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,QAAQ;gBACtB,CAAC,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;gBACvE,CAAC,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE;SAC7C,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClF,IAAI,OAAO,EAAE,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IAClE,OAAO;QACL,OAAO,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,IAAI,IAAI,EAAE;KACrE,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,IAAoB,EAAE,UAAkB;IAC/D,OAAO,IAAI,KAAK,UAAU,IAAI,UAAU,KAAK,eAAe,CAAC;AAC/D,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CACtB,OAAwB,EACxB,OAAuB,EACvB,KAAmB,EACnB,QAAgB,EAChB,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,GAAG,KAAK,EAA6D;IAE3F,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,cAAc,CAAC,CAAC;IACpF,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACvC,OAAO,KAAK;SACT,IAAI,CAAC,GAAG,CAAC;SACT,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC;SACnC,IAAI,CAAC,0BAA0B,CAAC;SAChC,IAAI,CACH,sBAAsB,CACpB,MAAM,EACN,EAAE,YAAY,EAAE,QAAQ,CAAC,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,EACpE,EAAE,IAAI,EAAE,QAAQ,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,CACvC,CACF,CAAC;AACN,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,sBAAsB,CACnC,OAAwB,EACxB,OAAuB,EACvB,KAAmB,EACnB,IAAY;IAEZ,MAAM,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC;IAC7B,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,qBAAqB,EAAE,EAAE,cAAc,CAAC,CAAC;QAC/E,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,WAAW,GAAI,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAY,IAAI,EAAE,CAAC;IACxE,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,sBAAsB,EAAE,EAAE,cAAc,CAAC,CAAC;QAChF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,wEAAwE;IACxE,6DAA6D;IAC7D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClE,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,GAAG,QAAQ,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC;QACjF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,qBAAqB,EAAE,IAAI,EAAE,EAAE,cAAc,CAAC,CAAC;QACrF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClG,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC9D,IAAI,SAAS,IAAI,OAAO,EAAE,CAAC;QACzB,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;QACrC,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;gBACzE,MAAM,EAAE,sBAAsB;gBAC9B,UAAU,EAAE,MAAM,CAAC,EAAE;aACtB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAE5B,oBAAoB;IACpB,IAAI,eAAe,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QACrD,OAAO,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE;YACxE,MAAM,EAAE,sBAAsB;YAC9B,UAAU,EAAE,MAAM,CAAC,EAAE;SACtB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,KAAK,eAAe,EAAE,CAAC;QAC5E,OAAO,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC;IAED,4BAA4B;IAC5B,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE;QACtE,YAAY,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,UAAU;QAC9C,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,SAAS;KAC3C,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC;IAED,OAAO,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE;QACxE,MAAM,EAAE,mBAAmB;QAC3B,UAAU,EAAE,MAAM,CAAC,EAAE;KACtB,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CACtB,OAAwB,EACxB,OAAuB,EACvB,KAAmB,EACnB,OAAwB,EACxB,QAAgB,EAChB,EAAE,MAAM,EAAE,UAAU,EAA0C;IAE9D,OAAO,CAAC,GAAG,CAAC,IAAI,CACd,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,EACvF,cAAc,CACf,CAAC;IACF,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACvC,IAAI,QAAQ,CAAC,oBAAoB,EAAE,CAAC;QAClC,gBAAgB,CAAC;YACf,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,YAAY,EAAE,QAAQ;YACtB,UAAU;YACV,YAAY,EAAE,QAAQ;SACvB,CAAC,CAAC;IACL,CAAC;IACD,sEAAsE;IACtE,yEAAyE;IACzE,gCAAgC;IAChC,MAAM,IAAI,GAAG,sBAAsB,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE;QAC9D,YAAY,EAAE,QAAQ,CAAC,UAAU;QACjC,SAAS,EAAE,QAAQ,CAAC,SAAS;KAC9B,CAAC,CAAC;IACH,OAAO,KAAK;SACT,IAAI,CAAC,GAAG,CAAC;SACT,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC;SACnC,IAAI,CAAC,0BAA0B,CAAC;SAChC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,2BAA2B,CACxC,OAAwB,EACxB,OAAuB,EACvB,KAAmB,EACnB,IAAY;IAEZ,MAAM,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC;IAC7B,wEAAwE;IACxE,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,QAAiC,EAAE,EAAgB,EAAE;QACnF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,EAAE,2BAA2B,CAAC,CAAC;QAC7F,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,2BAA2B,EAAE,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC;IACjF,CAAC,CAAC;IAEF,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC,qBAAqB,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACtD,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC5D,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;QAC1E,OAAO,MAAM,CAAC,0BAA0B,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC,sBAAsB,CAAC,CAAC;IAEnD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClE,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,GAAG,QAAQ,CAAC;QACvC,OAAO,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAED,MAAM,IAAI,GAAG,qBAAqB,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,IAAI,CAAC,CAAC;IACxE,IAAI,CAAC,IAAI;QAAE,OAAO,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAC5C,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAEpD,uEAAuE;IACvE,yEAAyE;IACzE,0EAA0E;IAC1E,MAAM,MAAM,GAAG,WAAW,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;IAC/C,IAAI,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;QACjE,OAAO,MAAM,CAAC,sBAAsB,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACnE,IAAI,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC,qBAAqB,CAAC,CAAC;IACjD,wEAAwE;IACxE,wEAAwE;IACxE,qEAAqE;IACrE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,mBAAmB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAEhF,MAAM,MAAM,GAAG,MAAM,oBAAoB,CACvC,OAAO,EACP,OAAO,EACP,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EACzB,WAAW,EACX,MAAM,CAAC,QAAQ,CAChB,CAAC;IACF,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC9D,IAAI,SAAS,IAAI,OAAO,EAAE,CAAC;QACzB,gDAAgD;QAChD,OAAO,CAAC,GAAG,CAAC,IAAI,CACd,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAC3D,2BAA2B,CAC5B,CAAC;QACF,iEAAiE;QACjE,kEAAkE;QAClE,OAAO,KAAK;aACT,IAAI,CAAC,GAAG,CAAC;aACT,MAAM,CAAC,2BAA2B,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC;aAC5F,IAAI,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAE5B,IAAI,eAAe,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACnD,OAAO,MAAM,CAAC,sBAAsB,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,KAAK,eAAe,EAAE,CAAC;QACxC,wEAAwE;QACxE,wBAAwB;QACxB,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE;YACrE,YAAY,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,UAAU;YAC9C,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,SAAS;SAC3C,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,wDAAwD;YACxD,OAAO,MAAM,CAAC,mBAAmB,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,SAAS,EAAE,MAAM,EAAE,+BAA+B,EAAE,MAAM,EAAE,IAAI,EAAE,EACpE,2BAA2B,CAC5B,CAAC;QACF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,kBAAkB,CAC5B;YACE,GAAG,EAAE,oBAAoB;YACzB,IAAI,EAAE,gBAAgB;YACtB,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;YACpD,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE;SAChC,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,0DAA0D;QAC1D,OAAO,MAAM,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,sBAAsB,EAAE,SAAS,CAAC,CAAC;IAChD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,gCAAgC,CAC7C,OAAwB,EACxB,OAAuB,EACvB,KAAmB,EACnB,IAAY;IAEZ,MAAM,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC;IAC7B,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,QAAiC,EAAE,EAAgB,EAAE;QACnF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,EAAE,oBAAoB,CAAC,CAAC;QACpF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC,CAAC;IAEF,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACnE,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACtD,IAAI,OAAO,WAAW,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,0BAA0B,CAAC,CAAC;IAC/E,MAAM,MAAM,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC,sBAAsB,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClE,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,GAAG,QAAQ,CAAC;QACvC,OAAO,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAED,MAAM,IAAI,GAA2B,qBAAqB,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,IAAI,CAAC,CAAC;IAChG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACtE,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;IAC5B,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAEhG,MAAM,MAAM,GAAG,MAAM,oBAAoB,CACvC,OAAO,EACP,OAAO,EACP,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EACzB,WAAW,EACX,MAAM,CAAC,QAAQ,CAChB,CAAC;IACF,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACvC,MAAM,eAAe,GAAG,EAAE,YAAY,EAAE,QAAQ,CAAC,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;IAC7F,IAAI,SAAS,IAAI,OAAO,EAAE,CAAC;QACzB,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;QACrC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACpF,CAAC;QACD,wEAAwE;QACxE,OAAO,CAAC,GAAG,CAAC,IAAI,CACd;YACE,SAAS;YACT,MAAM,EAAE,sBAAsB;YAC9B,IAAI,EAAE,IAAI;YACV,YAAY,EAAE,MAAM;YACpB,UAAU,EAAE,IAAI,CAAC,EAAE;SACpB,EACD,oBAAoB,CACrB,CAAC;QACF,OAAO,KAAK;aACT,IAAI,CAAC,GAAG,CAAC;aACT,IAAI,CAAC,0BAA0B,CAAC;aAChC,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAE5B,MAAM,IAAI,GAAG,CAAC,YAA+B,EAAE,UAAkB,EAAgB,EAAE;QACjF,wDAAwD;QACxD,OAAO,CAAC,GAAG,CAAC,IAAI,CACd,EAAE,SAAS,EAAE,MAAM,EAAE,mBAAmB,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,EAChF,oBAAoB,CACrB,CAAC;QACF,IAAI,QAAQ,CAAC,oBAAoB,EAAE,CAAC;YAClC,gBAAgB,CAAC;gBACf,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,YAAY;gBACZ,UAAU;gBACV,YAAY,EAAE,MAAM,CAAC,QAAQ;aAC9B,CAAC,CAAC;QACL,CAAC;QACD,OAAO,KAAK;aACT,IAAI,CAAC,GAAG,CAAC;aACT,IAAI,CAAC,0BAA0B,CAAC;aAChC,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC;IACtF,CAAC,CAAC;IAEF,IAAI,CAAC,CAAC,MAAM,sBAAsB,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC3F,IAAI,eAAe,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IACjF,IAAI,IAAI,CAAC,UAAU,KAAK,eAAe,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;QACrF,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,gFAAgF;IAChF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAChC,CAAC;AAED,oFAAoF;AACpF,KAAK,UAAU,eAAe,CAC5B,OAAwB,EACxB,OAAuB;IAEvB,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC,OAAO,EAAE,CAAC;IAClD,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACzD,4BAA4B,CAC7B,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,KAAK,CAClB,OAAwB,EACxB,OAAuB,EACvB,KAAmB,EACnB,MAAkB,EAClB,OAAwB;IAExB,KAAK,CAAC,MAAM,CAAC,4BAA4B,EAAE,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC;IAC9E,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,kBAAkB,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QAC5C,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,mBAAmB,6BAA6B,EAAE,CAAC,CAAC;QAClF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,+BAA+B,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EACrF,cAAc,CACf,CAAC;QACF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC5D,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,kBAAkB,CAC5B;YACE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU;YAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI;YACxB,MAAM,EAAE;gBACN,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,MAAM,EAAE,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC;gBACrC,IAAI,EAAE,OAAO,CAAC,WAAW;gBACzB,KAAK,EAAE,OAAO,CAAC,KAAK;aACrB;YACD,MAAM,EAAE,OAAO,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK;YACnE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE;SACvC,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,4DAA4D;QAC5D,wEAAwE;QACxE,OAAO,CAAC,GAAG,CAAC,IAAI,CACd;YACE,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,MAAM,EAAE,yBAAyB;YACjC,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YACxD,IAAI,EAAE,MAAM,CAAC,IAAI;SAClB,EACD,cAAc,CACf,CAAC;QACF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,kBAAkB,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IAC5C,KAAK,CAAC,MAAM,CAAC,sBAAsB,EAAE,SAAS,CAAC,CAAC;IAChD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAChC,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,OAAwB,EAAE,OAAwB;IACrE,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,EAAE,EAAE,KAAK,IAAI,EAAE,CAAC;IAChD,OAAO,OAAO,CAAC,MAAM;SAClB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;AACnE,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CACzB,OAAwB,EACxB,KAAmB,EACnB,OAAwB;IAExB,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9C,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACvE,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IACjD,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9C,CAAC"}

package/vendor/gatekeeper/dist/server/routes/diagnostic.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"diagnostic.d.ts","sourceRoot":"","sources":["../../../src/server/routes/diagnostic.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAO7E,OAAO,KAAK,EAAsB,kBAAkB,EAAoB,MAAM,oBAAoB,CAAC;AAiNnG,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAyI9E;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,kBAAkB,GAAG,IAAI,CAEhE"}
+{"version":3,"file":"diagnostic.d.ts","sourceRoot":"","sources":["../../../src/server/routes/diagnostic.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAO7E,OAAO,KAAK,EAAsB,kBAAkB,EAAoB,MAAM,oBAAoB,CAAC;AAiNnG,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CA4I9E;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,kBAAkB,GAAG,IAAI,CAEhE"}

package/vendor/gatekeeper/dist/server/routes/diagnostic.js

@@ -187,8 +187,11 @@ export async function diagnosticRoutes(fastify) {
             return reply.code(500).send({ error: err.message });
         }
     });
-    // POST /api/cache/bust — invalidate all cached auth decisions
-    fastify.post('/cache/bust', async (_request, reply) => {
+    // POST /api/cache/bust — invalidate all cached auth decisions. The panel
+    // calls it after every membership change: the projection is read again
+    // first, so a missed watch event never leaves a removed member admitted.
+    fastify.post('/cache/bust', async (_request, _reply) => {
+        await fastify.reloadDomains();
         fastify.bustCache();
         return { ok: true };
     });