@lenne.tech/nest-server 11.41.2 → 11.41.4

package/dist/core/modules/api-token/core-api-token.helpers.js

@@ -0,0 +1,398 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.API_TOKEN_HEADER = exports.API_TOKEN_MAX_ASSERTION_LENGTH = exports.API_TOKEN_CLOCK_TOLERANCE_SECONDS = exports.API_TOKEN_DEFAULTS = void 0;
+exports.resolveApiTokenConfig = resolveApiTokenConfig;
+exports.getApiTokenConfig = getApiTokenConfig;
+exports.getApiTokenTenantMemberRole = getApiTokenTenantMemberRole;
+exports.getApiTokenManageRole = getApiTokenManageRole;
+exports.resolveApiTokenEncryptionKey = resolveApiTokenEncryptionKey;
+exports.assertApiTokenConfigIsUsable = assertApiTokenConfigIsUsable;
+exports.readApiTokenCredential = readApiTokenCredential;
+exports.readApiTokenCredentialFromHeaders = readApiTokenCredentialFromHeaders;
+exports.hasApiTokenCredential = hasApiTokenCredential;
+exports.generateApiToken = generateApiToken;
+exports.parseApiToken = parseApiToken;
+exports.hashApiTokenSecret = hashApiTokenSecret;
+exports.safeEqualHex = safeEqualHex;
+exports.generateApiTokenSigningKey = generateApiTokenSigningKey;
+exports.signApiTokenAssertion = signApiTokenAssertion;
+exports.decodeApiTokenAssertion = decodeApiTokenAssertion;
+exports.verifyApiTokenAssertionSignature = verifyApiTokenAssertionSignature;
+exports.checkApiTokenAssertionTiming = checkApiTokenAssertionTiming;
+exports.getApiTokenContext = getApiTokenContext;
+exports.attachApiTokenContext = attachApiTokenContext;
+exports.createTenantApiTokenPrincipal = createTenantApiTokenPrincipal;
+exports.isTenantApiTokenPrincipal = isTenantApiTokenPrincipal;
+exports.assertApiTokenScopes = assertApiTokenScopes;
+exports.assertTenantApiTokenRouteAccess = assertTenantApiTokenRouteAccess;
+exports.enforceApiTokenRoute = enforceApiTokenRoute;
+exports.getApiTokenTenantRestriction = getApiTokenTenantRestriction;
+exports.capApiTokenTenantRole = capApiTokenTenantRole;
+const node_crypto_1 = require("node:crypto");
+const common_1 = require("@nestjs/common");
+const role_enum_1 = require("../../common/enums/role.enum");
+const cookies_helper_1 = require("../../common/helpers/cookies.helper");
+const config_service_1 = require("../../common/services/config.service");
+const error_codes_1 = require("../error-code/error-codes");
+const core_tenant_enums_1 = require("../tenant/core-tenant.enums");
+const core_tenant_helpers_1 = require("../tenant/core-tenant.helpers");
+const core_api_token_constants_1 = require("./core-api-token.constants");
+exports.API_TOKEN_DEFAULTS = {
+    maxAssertionLifetimeSeconds: 900,
+    prefix: 'ltt',
+    rateLimit: { max: 600, windowSeconds: 60 },
+};
+exports.API_TOKEN_CLOCK_TOLERANCE_SECONDS = 30;
+exports.API_TOKEN_MAX_ASSERTION_LENGTH = 8192;
+exports.API_TOKEN_HEADER = 'x-api-key';
+const PREFIX_PATTERN = /^[a-z][a-z0-9]{1,15}$/;
+const SCOPE_PATTERN = /^[A-Za-z0-9:._-]{1,64}$/;
+const PUBLIC_ID_PATTERN = /^[0-9a-f]{24}$/;
+const BASE64URL_PATTERN = /^[A-Za-z0-9_-]+$/;
+function resolveApiTokenConfig(config) {
+    const raw = config?.apiTokens;
+    const options = typeof raw === 'object' && raw !== null ? raw : {};
+    const enabled = raw === true || (typeof raw === 'object' && raw !== null && raw.enabled !== false);
+    const multiTenancy = !!config?.multiTenancy && config.multiTenancy.enabled !== false;
+    const lifetime = Number(options.maxAssertionLifetimeSeconds);
+    return {
+        enabled,
+        encryptionKey: typeof options.encryptionKey === 'string' && options.encryptionKey ? options.encryptionKey : undefined,
+        manageRole: typeof options.manageRole === 'string' && options.manageRole ? options.manageRole : undefined,
+        maxAssertionLifetimeSeconds: options.maxAssertionLifetimeSeconds !== null &&
+            typeof options.maxAssertionLifetimeSeconds !== 'boolean' &&
+            Number.isFinite(lifetime) &&
+            lifetime > 0
+            ? Math.floor(lifetime)
+            : exports.API_TOKEN_DEFAULTS.maxAssertionLifetimeSeconds,
+        multiTenancy,
+        prefix: typeof options.prefix === 'string' ? options.prefix : exports.API_TOKEN_DEFAULTS.prefix,
+        rateLimit: resolveRateLimit(options.rateLimit),
+        scopes: Array.isArray(options.scopes) ? [...options.scopes] : [],
+        tenantTokens: enabled && multiTenancy && options.tenantTokens !== false,
+        userTokens: enabled && options.userTokens !== false,
+    };
+}
+function resolveRateLimit(value) {
+    if (value === false || (typeof value === 'object' && value !== null && value.enabled === false)) {
+        return false;
+    }
+    const options = typeof value === 'object' && value !== null ? value : {};
+    const max = Number(options.max);
+    const windowSeconds = Number(options.windowSeconds);
+    return {
+        max: Number.isFinite(max) && max > 0 ? Math.floor(max) : exports.API_TOKEN_DEFAULTS.rateLimit.max,
+        windowSeconds: Number.isFinite(windowSeconds) && windowSeconds > 0
+            ? Math.floor(windowSeconds)
+            : exports.API_TOKEN_DEFAULTS.rateLimit.windowSeconds,
+    };
+}
+function getApiTokenConfig() {
+    return resolveApiTokenConfig(config_service_1.ConfigService.configFastButReadOnly);
+}
+function hierarchy() {
+    return config_service_1.ConfigService.configFastButReadOnly?.multiTenancy?.roleHierarchy ?? core_tenant_enums_1.DEFAULT_ROLE_HIERARCHY;
+}
+function getApiTokenTenantMemberRole() {
+    const entries = Object.entries(hierarchy());
+    if (entries.length === 0) {
+        return 'member';
+    }
+    return entries.reduce((a, b) => (a[1] <= b[1] ? a : b))[0];
+}
+function getApiTokenManageRole(config = getApiTokenConfig()) {
+    if (config.manageRole) {
+        return config.manageRole;
+    }
+    const entries = Object.entries(hierarchy());
+    if (entries.length === 0) {
+        return 'owner';
+    }
+    return entries.reduce((a, b) => (a[1] >= b[1] ? a : b))[0];
+}
+function resolveApiTokenEncryptionKey(config = getApiTokenConfig()) {
+    return config.encryptionKey || process.env.SECRETS_ENCRYPTION_KEY || undefined;
+}
+function assertApiTokenConfigIsUsable() {
+    const config = getApiTokenConfig();
+    if (!config.enabled) {
+        return;
+    }
+    if (!PREFIX_PATTERN.test(config.prefix)) {
+        throw new Error(`apiTokens.prefix "${config.prefix}" is invalid: use 2-16 lowercase letters and digits, starting with ` +
+            'a letter. The prefix is how the server tells a token apart from every other credential.');
+    }
+    const invalidScopes = config.scopes.filter((scope) => typeof scope !== 'string' || !SCOPE_PATTERN.test(scope));
+    if (invalidScopes.length) {
+        throw new Error(`apiTokens.scopes contains invalid scope(s) ${JSON.stringify(invalidScopes)}: ` +
+            'use 1-64 characters of letters, digits, ":", ".", "_" or "-".');
+    }
+    if (config.tenantTokens) {
+        const multiTenancy = config_service_1.ConfigService.configFastButReadOnly?.multiTenancy;
+        const declared = new Set([...Object.keys(hierarchy()), ...(multiTenancy?.additionalMembershipRoles ?? [])]);
+        const manageRole = getApiTokenManageRole(config);
+        if ((0, role_enum_1.isForbiddenMembershipRole)(manageRole) || !declared.has(manageRole)) {
+            throw new Error(`apiTokens.manageRole "${manageRole}" is not a declared tenant role. ` +
+                `Declared: [${[...declared].sort().join(', ')}]. Managing tenant tokens is a tenant right, so it ` +
+                'needs a role from roleHierarchy or additionalMembershipRoles — never a global or system role.');
+        }
+        const levels = hierarchy();
+        const memberRole = getApiTokenTenantMemberRole();
+        if (manageRole in levels && levels[memberRole] >= levels[manageRole]) {
+            throw new Error(`apiTokens needs a tenant role hierarchy with a role below "${manageRole}": a tenant token acts with ` +
+                `the lowest role ("${memberRole}"), and in this hierarchy that role already reaches the role that ` +
+                'manages tokens — a token would count as a tenant administrator. Set apiTokens.tenantTokens: false ' +
+                'if you only need user tokens.');
+        }
+    }
+    if ((0, cookies_helper_1.isProductionLikeEnv)(config_service_1.ConfigService.configFastButReadOnly?.env) && !resolveApiTokenEncryptionKey(config)) {
+        throw new Error('apiTokens.encryptionKey (or SECRETS_ENCRYPTION_KEY) is required in production/staging. ' +
+            'Without it, the signing keys of all tokens are encrypted with a public development default. ' +
+            'Set a random value of 32+ characters.');
+    }
+}
+function classify(value, prefix) {
+    if (value.startsWith(`${prefix}_`)) {
+        return { kind: 'token', value };
+    }
+    if (value.startsWith(`${prefix}s_`)) {
+        return { kind: 'assertion', value };
+    }
+    return undefined;
+}
+function readApiTokenCredential(authorization, prefix) {
+    if (typeof authorization !== 'string') {
+        return undefined;
+    }
+    const match = /^bearer\s+(\S+)\s*$/i.exec(authorization);
+    return match ? classify(match[1], prefix) : undefined;
+}
+function readApiTokenCredentialFromHeaders(headers, prefix) {
+    const fromAuthorization = readApiTokenCredential(headers?.authorization, prefix);
+    const apiKeyHeader = headers?.[exports.API_TOKEN_HEADER];
+    const fromApiKey = typeof apiKeyHeader === 'string' ? classify(apiKeyHeader.trim(), prefix) : undefined;
+    if (fromAuthorization && fromApiKey && fromAuthorization.value !== fromApiKey.value) {
+        return 'conflict';
+    }
+    return fromAuthorization ?? fromApiKey;
+}
+function hasApiTokenCredential(request) {
+    const config = getApiTokenConfig();
+    return config.enabled && !!readApiTokenCredentialFromHeaders(request?.headers, config.prefix);
+}
+function generateApiToken(prefix) {
+    const publicId = (0, node_crypto_1.randomBytes)(12).toString('hex');
+    const secret = (0, node_crypto_1.randomBytes)(32).toString('hex');
+    return { publicId, secret, token: `${prefix}_${publicId}_${secret}` };
+}
+function parseApiToken(value, prefix) {
+    if (!PREFIX_PATTERN.test(prefix)) {
+        return undefined;
+    }
+    const match = new RegExp(`^${prefix}_([0-9a-f]{24})_([0-9a-f]{64})$`).exec(value ?? '');
+    return match ? { publicId: match[1], secret: match[2] } : undefined;
+}
+function hashApiTokenSecret(secret) {
+    return (0, node_crypto_1.createHash)('sha256').update(secret, 'utf8').digest('hex');
+}
+function safeEqualHex(a, b) {
+    const left = Buffer.from(a ?? '', 'hex');
+    const right = Buffer.from(b ?? '', 'hex');
+    return left.length > 0 && left.length === right.length && (0, node_crypto_1.timingSafeEqual)(left, right);
+}
+function generateApiTokenSigningKey() {
+    return (0, node_crypto_1.randomBytes)(32).toString('hex');
+}
+function signApiTokenAssertion(options) {
+    const prefix = options.prefix ?? exports.API_TOKEN_DEFAULTS.prefix;
+    const expiresAtMs = options.expiresAt !== undefined
+        ? new Date(options.expiresAt).getTime()
+        : Date.now() + (options.expiresInSeconds ?? 300) * 1000;
+    const payload = {};
+    if (options.claims !== undefined)
+        payload.claims = options.claims;
+    payload.exp = Math.floor(expiresAtMs / 1000);
+    if (options.nonce !== undefined)
+        payload.nonce = options.nonce;
+    if (options.subject !== undefined)
+        payload.sub = options.subject;
+    payload.tid = options.publicId;
+    const payloadSegment = Buffer.from(JSON.stringify(payload), 'utf8').toString('base64url');
+    return `${prefix}s_${payloadSegment}.${signAssertionPayload(payloadSegment, options.signingKey).toString('base64url')}`;
+}
+function signAssertionPayload(payloadSegment, signingKey) {
+    return (0, node_crypto_1.createHmac)('sha256', Buffer.from(signingKey, 'utf8')).update(payloadSegment, 'ascii').digest();
+}
+function decodeApiTokenAssertion(value, prefix) {
+    const head = `${prefix}s_`;
+    if (typeof value !== 'string' || value.length > exports.API_TOKEN_MAX_ASSERTION_LENGTH || !value.startsWith(head)) {
+        return undefined;
+    }
+    const parts = value.slice(head.length).split('.');
+    if (parts.length !== 2) {
+        return undefined;
+    }
+    const [payloadSegment, signature] = parts;
+    if (!BASE64URL_PATTERN.test(payloadSegment) || !BASE64URL_PATTERN.test(signature)) {
+        return undefined;
+    }
+    let payload;
+    try {
+        payload = JSON.parse(Buffer.from(payloadSegment, 'base64url').toString('utf8'));
+    }
+    catch {
+        return undefined;
+    }
+    if (!payload || typeof payload !== 'object' || Array.isArray(payload)) {
+        return undefined;
+    }
+    if (typeof payload.tid !== 'string' || !PUBLIC_ID_PATTERN.test(payload.tid) || !Number.isInteger(payload.exp)) {
+        return undefined;
+    }
+    for (const field of ['sub', 'nonce']) {
+        if (payload[field] !== undefined && (typeof payload[field] !== 'string' || payload[field].length > 256)) {
+            return undefined;
+        }
+    }
+    if (payload.claims !== undefined &&
+        (payload.claims === null || typeof payload.claims !== 'object' || Array.isArray(payload.claims))) {
+        return undefined;
+    }
+    return {
+        payload: { claims: payload.claims, exp: payload.exp, nonce: payload.nonce, sub: payload.sub, tid: payload.tid },
+        payloadSegment,
+        signature,
+    };
+}
+function verifyApiTokenAssertionSignature(payloadSegment, signature, signingKey) {
+    const expected = signAssertionPayload(payloadSegment, signingKey);
+    const provided = Buffer.from(signature, 'base64url');
+    return provided.length === expected.length && (0, node_crypto_1.timingSafeEqual)(provided, expected);
+}
+function checkApiTokenAssertionTiming(payload, maxLifetimeSeconds, now = Date.now()) {
+    const nowSeconds = Math.floor(now / 1000);
+    if (payload.exp + exports.API_TOKEN_CLOCK_TOLERANCE_SECONDS < nowSeconds) {
+        return 'expired';
+    }
+    if (payload.exp - nowSeconds > maxLifetimeSeconds + exports.API_TOKEN_CLOCK_TOLERANCE_SECONDS) {
+        return 'too-long';
+    }
+    return 'ok';
+}
+const API_TOKEN_CONTEXT = Symbol('apiTokenContext');
+function getApiTokenContext(user) {
+    return user && typeof user === 'object' ? user[API_TOKEN_CONTEXT] : undefined;
+}
+function attachApiTokenContext(user, context) {
+    user[API_TOKEN_CONTEXT] = Object.freeze({ ...context, scopes: [...context.scopes] });
+    return user;
+}
+function createTenantApiTokenPrincipal(context) {
+    const principal = {
+        hasRole: () => false,
+        id: context.tokenId,
+        name: context.name,
+        roles: [],
+        scopes: [...context.scopes],
+        tenantId: context.tenantId,
+    };
+    return attachApiTokenContext(principal, { ...context, kind: core_api_token_constants_1.ApiTokenKind.TENANT });
+}
+function isTenantApiTokenPrincipal(user) {
+    return getApiTokenContext(user)?.kind === core_api_token_constants_1.ApiTokenKind.TENANT;
+}
+function denied() {
+    return new common_1.ForbiddenException(error_codes_1.ErrorCode.ACCESS_DENIED);
+}
+function tenantHeaderName() {
+    return (config_service_1.ConfigService.configFastButReadOnly?.multiTenancy?.headerName ?? 'x-tenant-id').toLowerCase();
+}
+function assertApiTokenScopes(context, handler, controllerClass) {
+    const handlerScopes = handler
+        ? Reflect.getMetadata(core_api_token_constants_1.API_TOKEN_SCOPES_KEY, handler)
+        : undefined;
+    const requiredScopes = handlerScopes ??
+        (controllerClass
+            ? Reflect.getMetadata(core_api_token_constants_1.API_TOKEN_SCOPES_KEY, controllerClass)
+            : undefined);
+    if (!requiredScopes?.length || !requiredScopes.some((scope) => context.scopes.includes(scope))) {
+        throw denied();
+    }
+}
+function assertTenantApiTokenRouteAccess(options) {
+    const { context, controllerClass, handler, request } = options;
+    const handlerRoles = handler ? Reflect.getMetadata('roles', handler) : undefined;
+    const classRoles = controllerClass
+        ? Reflect.getMetadata('roles', controllerClass)
+        : undefined;
+    const roles = (0, core_tenant_helpers_1.mergeRolesMetadata)([handlerRoles, classRoles]);
+    if (roles.includes(role_enum_1.RoleEnum.S_NO_ONE)) {
+        throw denied();
+    }
+    const systemCheckRoles = handlerRoles?.length ? handlerRoles : roles;
+    const memberRole = getApiTokenTenantMemberRole();
+    const openedBySystemRole = [role_enum_1.RoleEnum.S_EVERYONE, role_enum_1.RoleEnum.S_USER, role_enum_1.RoleEnum.S_VERIFIED].some((role) => systemCheckRoles.includes(role));
+    if (!openedBySystemRole) {
+        const checkable = roles.filter((role) => !(0, core_tenant_helpers_1.isSystemRole)(role));
+        if (roles.length && !checkable.length) {
+            throw denied();
+        }
+        if (checkable.length) {
+            const tenantRoles = (0, core_tenant_helpers_1.tenantSatisfiableRoles)(checkable);
+            if (!tenantRoles.length || !(0, core_tenant_helpers_1.checkRoleAccess)(tenantRoles, undefined, memberRole)) {
+                throw denied();
+            }
+        }
+    }
+    assertTenantHeaderMatches(request, context.tenantId);
+    if (request) {
+        request.tenantId = context.tenantId;
+        request.tenantRole = memberRole;
+        request.isAdminBypass = false;
+        request.tenantIds = undefined;
+    }
+}
+function assertTenantHeaderMatches(request, tenantId) {
+    const header = request?.headers?.[tenantHeaderName()];
+    if (header !== undefined && (typeof header !== 'string' || header.trim() !== tenantId)) {
+        throw denied();
+    }
+}
+function enforceApiTokenRoute(options) {
+    const { request } = options;
+    if (!request) {
+        return undefined;
+    }
+    const context = getApiTokenContext(request.user);
+    if (!context) {
+        if (!request.user && hasApiTokenCredential(request)) {
+            throw new common_1.UnauthorizedException(error_codes_1.ErrorCode.UNAUTHORIZED);
+        }
+        return undefined;
+    }
+    assertApiTokenScopes(context, options.handler, options.controllerClass);
+    if (context.kind === core_api_token_constants_1.ApiTokenKind.TENANT) {
+        assertTenantApiTokenRouteAccess({ ...options, context });
+        return core_api_token_constants_1.ApiTokenKind.TENANT;
+    }
+    if (context.tenantId) {
+        assertTenantHeaderMatches(request, context.tenantId);
+    }
+    return core_api_token_constants_1.ApiTokenKind.USER;
+}
+function getApiTokenTenantRestriction(user) {
+    const context = getApiTokenContext(user);
+    return context?.kind === core_api_token_constants_1.ApiTokenKind.USER ? context.tenantId : undefined;
+}
+function capApiTokenTenantRole(user, membershipRole) {
+    const context = getApiTokenContext(user);
+    if (context?.kind !== core_api_token_constants_1.ApiTokenKind.USER || !context.maxTenantRole) {
+        return membershipRole;
+    }
+    const levels = hierarchy();
+    if (!(membershipRole in levels) || !(context.maxTenantRole in levels)) {
+        return null;
+    }
+    return levels[membershipRole] <= levels[context.maxTenantRole] ? membershipRole : context.maxTenantRole;
+}
+//# sourceMappingURL=core-api-token.helpers.js.map

package/dist/core/modules/api-token/core-api-token.helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core-api-token.helpers.js","sourceRoot":"","sources":["../../../../src/core/modules/api-token/core-api-token.helpers.ts"],"names":[],"mappings":";;;AAiEA,sDA8BC;AAoBD,8CAEC;AAWD,kEAMC;AAGD,sDASC;AAGD,oEAIC;AAMD,oEAoDC;AA6BD,wDASC;AAOD,8EAWC;AAMD,sDAGC;AAGD,4CAIC;AAGD,sCAOC;AAMD,gDAEC;AAGD,oCAIC;AAGD,gEAEC;AA8CD,sDAiBC;AAUD,0DA8CC;AAGD,4EAQC;AAMD,oEAaC;AAqDD,gDAEC;AAGD,sDAGC;AAGD,sEAYC;AAGD,8DAEC;AAkBD,oDAYC;AAWD,0EA8CC;AAuBD,oDA4BC;AAOD,oEAGC;AASD,sDAUC;AAtsBD,6CAAmF;AAEnF,2CAA2E;AAE3E,4DAAmF;AACnF,wEAA0E;AAE1E,yEAAqE;AACrE,2DAAsD;AACtD,mEAAqE;AACrE,uEAKuC;AACvC,yEAAgF;AAOnE,QAAA,kBAAkB,GAAG;IAChC,2BAA2B,EAAE,GAAG;IAChC,MAAM,EAAE,KAAK;IACb,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE,EAAE;CAClC,CAAC;AAGE,QAAA,iCAAiC,GAAG,EAAE,CAAC;AAGvC,QAAA,8BAA8B,GAAG,IAAI,CAAC;AAGtC,QAAA,gBAAgB,GAAG,WAAW,CAAC;AAE5C,MAAM,cAAc,GAAG,uBAAuB,CAAC;AAC/C,MAAM,aAAa,GAAG,yBAAyB,CAAC;AAChD,MAAM,iBAAiB,GAAG,gBAAgB,CAAC;AAC3C,MAAM,iBAAiB,GAAG,kBAAkB,CAAC;AAwB7C,SAAgB,qBAAqB,CACnC,MAA6F;IAE7F,MAAM,GAAG,GAAG,MAAM,EAAE,SAAS,CAAC;IAC9B,MAAM,OAAO,GAAe,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,MAAM,OAAO,GAAG,GAAG,KAAK,IAAI,IAAI,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC;IACnG,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,EAAE,YAAY,IAAI,MAAM,CAAC,YAAY,CAAC,OAAO,KAAK,KAAK,CAAC;IAErF,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAC7D,OAAO;QACL,OAAO;QACP,aAAa,EACX,OAAO,OAAO,CAAC,aAAa,KAAK,QAAQ,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;QACxG,UAAU,EAAE,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;QAGzG,2BAA2B,EACzB,OAAO,CAAC,2BAA2B,KAAK,IAAI;YAC5C,OAAO,OAAO,CAAC,2BAA2B,KAAK,SAAS;YACxD,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACzB,QAAQ,GAAG,CAAC;YACV,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;YACtB,CAAC,CAAC,0BAAkB,CAAC,2BAA2B;QACpD,YAAY;QACZ,MAAM,EAAE,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,0BAAkB,CAAC,MAAM;QACvF,SAAS,EAAE,gBAAgB,CAAC,OAAO,CAAC,SAAS,CAAC;QAC9C,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;QAChE,YAAY,EAAE,OAAO,IAAI,YAAY,IAAI,OAAO,CAAC,YAAY,KAAK,KAAK;QACvE,UAAU,EAAE,OAAO,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK;KACpD,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,KAAK,KAAK,KAAK,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAK,KAAa,CAAC,OAAO,KAAK,KAAK,CAAC,EAAE,CAAC;QACzG,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GACX,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAE,KAAoD,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3G,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACpD,OAAO;QACL,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,0BAAkB,CAAC,SAAS,CAAC,GAAG;QACzF,aAAa,EACX,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,CAAC;YACjD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC;YAC3B,CAAC,CAAC,0BAAkB,CAAC,SAAS,CAAC,aAAa;KACjD,CAAC;AACJ,CAAC;AAGD,SAAgB,iBAAiB;IAC/B,OAAO,qBAAqB,CAAC,8BAAa,CAAC,qBAAqB,CAAC,CAAC;AACpE,CAAC;AAGD,SAAS,SAAS;IAChB,OAAO,8BAAa,CAAC,qBAAqB,EAAE,YAAY,EAAE,aAAa,IAAI,0CAAsB,CAAC;AACpG,CAAC;AAMD,SAAgB,2BAA2B;IACzC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAC5C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7D,CAAC;AAGD,SAAgB,qBAAqB,CAAC,SAAkC,iBAAiB,EAAE;IACzF,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACtB,OAAO,MAAM,CAAC,UAAU,CAAC;IAC3B,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAC5C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7D,CAAC;AAGD,SAAgB,4BAA4B,CAC1C,SAAkC,iBAAiB,EAAE;IAErD,OAAO,MAAM,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,SAAS,CAAC;AACjF,CAAC;AAMD,SAAgB,4BAA4B;IAC1C,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAC;IACnC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO;IACT,CAAC;IAED,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,qBAAqB,MAAM,CAAC,MAAM,qEAAqE;YACrG,yFAAyF,CAC5F,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/G,IAAI,aAAa,CAAC,MAAM,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,8CAA8C,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI;YAC7E,+DAA+D,CAClE,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,MAAM,YAAY,GAAG,8BAAa,CAAC,qBAAqB,EAAE,YAAY,CAAC;QACvE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,EAAE,GAAG,CAAC,YAAY,EAAE,yBAAyB,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5G,MAAM,UAAU,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,IAAA,qCAAyB,EAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,CACb,yBAAyB,UAAU,mCAAmC;gBACpE,cAAc,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,qDAAqD;gBAClG,+FAA+F,CAClG,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAG,2BAA2B,EAAE,CAAC;QACjD,IAAI,UAAU,IAAI,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YACrE,MAAM,IAAI,KAAK,CACb,8DAA8D,UAAU,8BAA8B;gBACpG,qBAAqB,UAAU,oEAAoE;gBACnG,oGAAoG;gBACpG,+BAA+B,CAClC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,IAAA,oCAAmB,EAAC,8BAAa,CAAC,qBAAqB,EAAE,GAAG,CAAC,IAAI,CAAC,4BAA4B,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3G,MAAM,IAAI,KAAK,CACb,yFAAyF;YACvF,8FAA8F;YAC9F,uCAAuC,CAC1C,CAAC;IACJ,CAAC;AACH,CAAC;AAYD,SAAS,QAAQ,CAAC,KAAa,EAAE,MAAc;IAC7C,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAClC,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC;QACpC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IACtC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AASD,SAAgB,sBAAsB,CACpC,aAA4C,EAC5C,MAAc;IAEd,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACzD,OAAO,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACxD,CAAC;AAOD,SAAgB,iCAAiC,CAC/C,OAAwC,EACxC,MAAc;IAEd,MAAM,iBAAiB,GAAG,sBAAsB,CAAC,OAAO,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;IACjF,MAAM,YAAY,GAAG,OAAO,EAAE,CAAC,wBAAgB,CAAC,CAAC;IACjD,MAAM,UAAU,GAAG,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxG,IAAI,iBAAiB,IAAI,UAAU,IAAI,iBAAiB,CAAC,KAAK,KAAK,UAAU,CAAC,KAAK,EAAE,CAAC;QACpF,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,OAAO,iBAAiB,IAAI,UAAU,CAAC;AACzC,CAAC;AAMD,SAAgB,qBAAqB,CAAC,OAAsD;IAC1F,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAC;IACnC,OAAO,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC,iCAAiC,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;AAChG,CAAC;AAGD,SAAgB,gBAAgB,CAAC,MAAc;IAC7C,MAAM,QAAQ,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,QAAQ,IAAI,MAAM,EAAE,EAAE,CAAC;AACxE,CAAC;AAGD,SAAgB,aAAa,CAAC,KAAa,EAAE,MAAc;IAEzD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,MAAM,iCAAiC,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACxF,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACtE,CAAC;AAMD,SAAgB,kBAAkB,CAAC,MAAc;IAC/C,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC;AAGD,SAAgB,YAAY,CAAC,CAAS,EAAE,CAAS;IAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;IAC1C,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,IAAA,6BAAe,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACzF,CAAC;AAGD,SAAgB,0BAA0B;IACxC,OAAO,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AA8CD,SAAgB,qBAAqB,CAAC,OAAsC;IAC1E,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,0BAAkB,CAAC,MAAM,CAAC;IAC3D,MAAM,WAAW,GACf,OAAO,CAAC,SAAS,KAAK,SAAS;QAC7B,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACvC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,gBAAgB,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC;IAG5D,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAClE,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC7C,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC/D,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC;IACjE,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;IAE/B,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC1F,OAAO,GAAG,MAAM,KAAK,cAAc,IAAI,oBAAoB,CAAC,cAAc,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AAC1H,CAAC;AAED,SAAS,oBAAoB,CAAC,cAAsB,EAAE,UAAkB;IACtE,OAAO,IAAA,wBAAU,EAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;AACxG,CAAC;AAMD,SAAgB,uBAAuB,CACrC,KAAa,EACb,MAAc;IAEd,MAAM,IAAI,GAAG,GAAG,MAAM,IAAI,CAAC;IAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,sCAA8B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1G,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,CAAC,cAAc,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC;IAC1C,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAClF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,OAAY,CAAC;IACjB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9G,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,CAAC,KAAK,EAAE,OAAO,CAAU,EAAE,CAAC;QAC9C,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,SAAS,IAAI,CAAC,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC;YACxG,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IACD,IACE,OAAO,CAAC,MAAM,KAAK,SAAS;QAC5B,CAAC,OAAO,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAChG,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO;QACL,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;QAC/G,cAAc;QACd,SAAS;KACV,CAAC;AACJ,CAAC;AAGD,SAAgB,gCAAgC,CAC9C,cAAsB,EACtB,SAAiB,EACjB,UAAkB;IAElB,MAAM,QAAQ,GAAG,oBAAoB,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACrD,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,IAAA,6BAAe,EAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACpF,CAAC;AAMD,SAAgB,4BAA4B,CAC1C,OAAoF,EACpF,kBAA0B,EAC1B,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;IAC1C,IAAI,OAAO,CAAC,GAAG,GAAG,yCAAiC,GAAG,UAAU,EAAE,CAAC;QACjE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,GAAG,UAAU,GAAG,kBAAkB,GAAG,yCAAiC,EAAE,CAAC;QACtF,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAYD,MAAM,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAC;AAyCpD,SAAgB,kBAAkB,CAAC,IAAa;IAC9C,OAAO,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAG,IAAY,CAAC,iBAAiB,CAAsB,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/G,CAAC;AAGD,SAAgB,qBAAqB,CAAmB,IAAO,EAAE,OAAyB;IACvF,IAAY,CAAC,iBAAiB,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC9F,OAAO,IAAI,CAAC;AACd,CAAC;AAGD,SAAgB,6BAA6B,CAC3C,OAA2F;IAE3F,MAAM,SAAS,GAA6B;QAC1C,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK;QACpB,EAAE,EAAE,OAAO,CAAC,OAAO;QACnB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,KAAK,EAAE,EAAE;QACT,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;QAC3B,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC;IACF,OAAO,qBAAqB,CAAC,SAAS,EAAE,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,uCAAY,CAAC,MAAM,EAAE,CAAC,CAAC;AACrF,CAAC;AAGD,SAAgB,yBAAyB,CAAC,IAAa;IACrD,OAAO,kBAAkB,CAAC,IAAI,CAAC,EAAE,IAAI,KAAK,uCAAY,CAAC,MAAM,CAAC;AAChE,CAAC;AAMD,SAAS,MAAM;IACb,OAAO,IAAI,2BAAkB,CAAC,uBAAS,CAAC,aAAa,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,gBAAgB;IACvB,OAAO,CAAC,8BAAa,CAAC,qBAAqB,EAAE,YAAY,EAAE,UAAU,IAAI,aAAa,CAAC,CAAC,WAAW,EAAE,CAAC;AACxG,CAAC;AAMD,SAAgB,oBAAoB,CAAC,OAAyB,EAAE,OAAY,EAAE,eAAoB;IAChG,MAAM,aAAa,GAAG,OAAO;QAC3B,CAAC,CAAE,OAAO,CAAC,WAAW,CAAC,+CAAoB,EAAE,OAAO,CAA0B;QAC9E,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,cAAc,GAClB,aAAa;QACb,CAAC,eAAe;YACd,CAAC,CAAE,OAAO,CAAC,WAAW,CAAC,+CAAoB,EAAE,eAAe,CAA0B;YACtF,CAAC,CAAC,SAAS,CAAC,CAAC;IACjB,IAAI,CAAC,cAAc,EAAE,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC/F,MAAM,MAAM,EAAE,CAAC;IACjB,CAAC;AACH,CAAC;AAWD,SAAgB,+BAA+B,CAAC,OAK/C;IACC,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAE/D,MAAM,YAAY,GAAG,OAAO,CAAC,CAAC,CAAE,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAA0B,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3G,MAAM,UAAU,GAAG,eAAe;QAChC,CAAC,CAAE,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,eAAe,CAA0B;QACzE,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,KAAK,GAAG,IAAA,wCAAkB,EAAC,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC;IAC7D,IAAI,KAAK,CAAC,QAAQ,CAAC,oBAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtC,MAAM,MAAM,EAAE,CAAC;IACjB,CAAC;IAGD,MAAM,gBAAgB,GAAG,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC;IACrE,MAAM,UAAU,GAAG,2BAA2B,EAAE,CAAC;IACjD,MAAM,kBAAkB,GAAG,CAAC,oBAAQ,CAAC,UAAU,EAAE,oBAAQ,CAAC,MAAM,EAAE,oBAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CACnG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAChC,CAAC;IACF,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAA,kCAAY,EAAC,IAAI,CAAC,CAAC,CAAC;QAG9D,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;YACtC,MAAM,MAAM,EAAE,CAAC;QACjB,CAAC;QACD,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;YACrB,MAAM,WAAW,GAAG,IAAA,4CAAsB,EAAC,SAAS,CAAC,CAAC;YACtD,IAAI,CAAC,WAAW,CAAC,MAAM,IAAI,CAAC,IAAA,qCAAe,EAAC,WAAW,EAAE,SAAS,EAAE,UAAU,CAAC,EAAE,CAAC;gBAChF,MAAM,MAAM,EAAE,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IAED,yBAAyB,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAErD,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACpC,OAAO,CAAC,UAAU,GAAG,UAAU,CAAC;QAChC,OAAO,CAAC,aAAa,GAAG,KAAK,CAAC;QAC9B,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;IAChC,CAAC;AACH,CAAC;AAGD,SAAS,yBAAyB,CAAC,OAAY,EAAE,QAA4B;IAC3E,MAAM,MAAM,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACtD,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,QAAQ,CAAC,EAAE,CAAC;QACvF,MAAM,MAAM,EAAE,CAAC;IACjB,CAAC;AACH,CAAC;AAeD,SAAgB,oBAAoB,CAAC,OAIpC;IACC,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,8BAAqB,CAAC,uBAAS,CAAC,YAAY,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IAExE,IAAI,OAAO,CAAC,IAAI,KAAK,uCAAY,CAAC,MAAM,EAAE,CAAC;QACzC,+BAA+B,CAAC,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACzD,OAAO,uCAAY,CAAC,MAAM,CAAC;IAC7B,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,yBAAyB,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,uCAAY,CAAC,IAAI,CAAC;AAC3B,CAAC;AAOD,SAAgB,4BAA4B,CAAC,IAAa;IACxD,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACzC,OAAO,OAAO,EAAE,IAAI,KAAK,uCAAY,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5E,CAAC;AASD,SAAgB,qBAAqB,CAAC,IAAa,EAAE,cAAsB;IACzE,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,OAAO,EAAE,IAAI,KAAK,uCAAY,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QAClE,OAAO,cAAc,CAAC;IACxB,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,IAAI,CAAC,CAAC,cAAc,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,aAAa,IAAI,MAAM,CAAC,EAAE,CAAC;QACtE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;AAC1G,CAAC"}

package/dist/core/modules/api-token/core-api-token.middleware.d.ts

@@ -0,0 +1,10 @@
+import { NestMiddleware } from '@nestjs/common';
+import { NextFunction, Request, Response } from 'express';
+import { CoreApiTokenService } from './core-api-token.service';
+export declare class CoreApiTokenMiddleware implements NestMiddleware {
+    protected readonly apiTokenService?: CoreApiTokenService;
+    constructor(apiTokenService?: CoreApiTokenService);
+    use(req: Request & {
+        user?: unknown;
+    }, res: Response, next: NextFunction): Promise<void>;
+}

package/dist/core/modules/api-token/core-api-token.middleware.js

@@ -0,0 +1,58 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CoreApiTokenMiddleware = void 0;
+const common_1 = require("@nestjs/common");
+const error_codes_1 = require("../error-code/error-codes");
+const core_api_token_helpers_1 = require("./core-api-token.helpers");
+const core_api_token_service_1 = require("./core-api-token.service");
+let CoreApiTokenMiddleware = class CoreApiTokenMiddleware {
+    apiTokenService;
+    constructor(apiTokenService) {
+        this.apiTokenService = apiTokenService;
+    }
+    async use(req, res, next) {
+        const config = (0, core_api_token_helpers_1.getApiTokenConfig)();
+        if (!config.enabled) {
+            return next();
+        }
+        const credential = (0, core_api_token_helpers_1.readApiTokenCredentialFromHeaders)(req.headers, config.prefix);
+        if (!credential) {
+            return next();
+        }
+        if (credential === 'conflict' || !this.apiTokenService) {
+            throw new common_1.UnauthorizedException(error_codes_1.ErrorCode.UNAUTHORIZED);
+        }
+        const user = await this.apiTokenService.authenticate(credential);
+        const context = (0, core_api_token_helpers_1.getApiTokenContext)(user);
+        if (!user || !context) {
+            throw new common_1.UnauthorizedException(error_codes_1.ErrorCode.UNAUTHORIZED);
+        }
+        const limited = await this.apiTokenService.consumeRateLimit(context.tokenId);
+        if (limited) {
+            res.setHeader('Retry-After', String(limited.retryAfter));
+            throw new common_1.HttpException(error_codes_1.ErrorCode.RATE_LIMIT_EXCEEDED, common_1.HttpStatus.TOO_MANY_REQUESTS);
+        }
+        this.apiTokenService.touchLastUsed(context.tokenId);
+        req.user = user;
+        next();
+    }
+};
+exports.CoreApiTokenMiddleware = CoreApiTokenMiddleware;
+exports.CoreApiTokenMiddleware = CoreApiTokenMiddleware = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Optional)()),
+    __metadata("design:paramtypes", [core_api_token_service_1.CoreApiTokenService])
+], CoreApiTokenMiddleware);
+//# sourceMappingURL=core-api-token.middleware.js.map

package/dist/core/modules/api-token/core-api-token.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core-api-token.middleware.js","sourceRoot":"","sources":["../../../../src/core/modules/api-token/core-api-token.middleware.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAwH;AAGxH,2DAAsD;AACtD,qEAAoH;AACpH,qEAA+D;AAgBxD,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IACU;IAA3C,YAA2C,eAAqC;QAArC,oBAAe,GAAf,eAAe,CAAsB;IAAG,CAAC;IAEpF,KAAK,CAAC,GAAG,CAAC,GAAiC,EAAE,GAAa,EAAE,IAAkB;QAC5E,MAAM,MAAM,GAAG,IAAA,0CAAiB,GAAE,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,MAAM,UAAU,GAAG,IAAA,0DAAiC,EAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACjF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QACD,IAAI,UAAU,KAAK,UAAU,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YACvD,MAAM,IAAI,8BAAqB,CAAC,uBAAS,CAAC,YAAY,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;QACjE,MAAM,OAAO,GAAG,IAAA,2CAAkB,EAAC,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACtB,MAAM,IAAI,8BAAqB,CAAC,uBAAS,CAAC,YAAY,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7E,IAAI,OAAO,EAAE,CAAC;YACZ,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;YACzD,MAAM,IAAI,sBAAa,CAAC,uBAAS,CAAC,mBAAmB,EAAE,mBAAU,CAAC,iBAAiB,CAAC,CAAC;QACvF,CAAC;QAED,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAGpD,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAChB,IAAI,EAAE,CAAC;IACT,CAAC;CACF,CAAA;AAnCY,wDAAsB;iCAAtB,sBAAsB;IADlC,IAAA,mBAAU,GAAE;IAEE,WAAA,IAAA,iBAAQ,GAAE,CAAA;qCAAsC,4CAAmB;GADrE,sBAAsB,CAmClC"}

package/dist/core/modules/api-token/core-api-token.model.d.ts

@@ -0,0 +1,20 @@
+import { CorePersistenceModel } from '../../common/models/core-persistence.model';
+import { ApiTokenKind } from './core-api-token.constants';
+export declare class CoreApiTokenModel extends CorePersistenceModel {
+    createdBy: string;
+    description: string;
+    expiresAt: Date;
+    kind: ApiTokenKind;
+    lastUsedAt: Date;
+    maxTenantRole: string;
+    name: string;
+    publicId: string;
+    revokedAt: Date;
+    scopes: string[];
+    secretHash: string;
+    signingKeyEncrypted: string;
+    tenant: string;
+    updatedBy: string;
+    user: string;
+    securityCheck(user: any, force?: boolean): this;
+}