@molecule/api-resource-user 1.0.0

package/dist/handlers/logInOAuth.js

@@ -0,0 +1,462 @@
+import crypto from 'node:crypto';
+import { v4 as uuid } from 'uuid';
+import { get, getAnalytics, getLogger } from '@molecule/api-bond';
+import { get as getConfig } from '@molecule/api-config';
+import { create as storeCreate, findById, findOne, updateById } from '@molecule/api-database';
+import { t } from '@molecule/api-i18n';
+import { create as resourceCreate } from '@molecule/api-resource';
+import * as authorization from '../authorization.js';
+import { normalizeEmail } from '../utilities/normalizeEmail.js';
+const analytics = getAnalytics();
+const logger = getLogger();
+/**
+ * Constant-time comparison of two strings. Returns `false` on length mismatch
+ * (lengths are not secret here) and otherwise uses `crypto.timingSafeEqual`, so
+ * the OAuth state ↔ cookie check does not leak via comparison timing.
+ * @param a - First string.
+ * @param b - Second string.
+ * @returns `true` if the strings are equal.
+ */
+const timingSafeEqualString = (a, b) => {
+    const ab = Buffer.from(a);
+    const bb = Buffer.from(b);
+    if (ab.length !== bb.length) {
+        return false;
+    }
+    return crypto.timingSafeEqual(ab, bb);
+};
+/**
+ * Logs in or creates a user via OAuth. Verifies the authorization code with the bonded OAuth
+ * provider (`get('oauth', serverName)`), then either finds an existing user by oauthServer+oauthId
+ * or creates a new one with a unique username. Sets JWT authorization and creates a session device.
+ * @param resource - The user resource configuration (name, tableName, schema).
+ * @param resource.name - The resource name.
+ * @param resource.tableName - The database table name for users.
+ * @param resource.schema - The validation schema for user properties.
+ * @returns A request handler that responds with `{ statusCode: 200, body: { props } }` on success.
+ */
+export const logInOAuth = ({ name, tableName, schema }) => {
+    const createResource = resourceCreate({
+        name,
+        tableName,
+        schema,
+    });
+    return async (req, res) => {
+        const { body } = req;
+        if (!body.server || !body.code) {
+            return {
+                statusCode: 400,
+                body: { error: t('user.error.badRequest'), errorKey: 'user.error.badRequest' },
+            };
+        }
+        // Validate the OAuth CSRF state parameter. This is MANDATORY, not gated on
+        // whether the (attacker-controlled) request happened to send a `state` —
+        // otherwise a forged cross-site callback that simply omits `state` would
+        // skip the check entirely (login-CSRF / session fixation: the attacker
+        // plants their own session in the victim's browser). The `oauth_state`
+        // cookie is set by GET /users/oauth/:provider; callback `state` must equal
+        // it. Deployments that genuinely don't wire the state-cookie endpoint can
+        // opt out with OAUTH_REQUIRE_STATE=false, but the secure behavior ships ON
+        // by default and is NEVER relaxed based on request presence.
+        const requireState = getConfig('OAUTH_REQUIRE_STATE', 'true') !== 'false';
+        if (requireState) {
+            // In production the state cookie is `__Host-`-prefixed (unshadowable by a
+            // sibling subdomain). [C4-1] We must NOT accept the plain name in production:
+            // a tenant on a sibling `*.molecule.dev` preview can toss a `.molecule.dev`
+            // plain `oauth_state` cookie, and a plain-name fallback would let that tossed
+            // value satisfy the CSRF check (login-CSRF / session fixation). `__Host-`
+            // cookies cannot carry a Domain, so they can't be tossed. oauth_state has a
+            // 5-min TTL, so there is no legacy plain cookie to support — drop the fallback
+            // in production. In dev (no `__Host-`) the plain name is the real cookie.
+            const stateCookies = req.cookies;
+            const cookieState = getConfig('NODE_ENV') === 'production'
+                ? stateCookies?.[authorization.getAuthCookieName('oauth_state')]
+                : (stateCookies?.[authorization.getAuthCookieName('oauth_state')] ??
+                    stateCookies?.oauth_state);
+            const expressRes = res;
+            // The state cookie is one-time use — always clear it, match or not. Clear
+            // BOTH names so a leftover plain/prefixed copy can't linger. The CLEAR must
+            // carry the SAME attributes the initiation endpoint SET it with
+            // (getAuthCookieOptions: Secure + Path=/ in prod; + SameSite=None +
+            // Partitioned in the sandbox live-preview) or the browser won't match &
+            // delete the (partitioned) cookie.
+            const clearStateCookie = () => {
+                if (typeof expressRes.clearCookie === 'function') {
+                    expressRes.clearCookie(authorization.getAuthCookieName('oauth_state'), {
+                        ...authorization.getAuthCookieOptions(),
+                    });
+                    expressRes.clearCookie('oauth_state', { path: '/' });
+                }
+            };
+            if (!body.state || !cookieState || !timingSafeEqualString(cookieState, body.state)) {
+                clearStateCookie();
+                return {
+                    statusCode: 403,
+                    body: {
+                        error: t('user.error.oauthStateMismatch', undefined, {
+                            defaultValue: 'OAuth state mismatch — possible CSRF attack',
+                        }),
+                        errorKey: 'user.error.oauthStateMismatch',
+                    },
+                };
+            }
+            clearStateCookie();
+        }
+        // [M1-1] Read the PKCE code_verifier from the httpOnly cookie set by the OAuth
+        // initiation endpoint — SERVER-SIDE, never trusting a client-supplied body value.
+        // The verifier is the per-session secret that binds the authorization code to THIS
+        // session (S256). Trusting `body.codeVerifier` would let an attacker replay a
+        // victim's intercepted code with their own verifier (authorization-code injection,
+        // RFC 9700 §2.1). One-time use: cleared whether or not verification succeeds. The
+        // body fallback is only for legacy consumers that never set the cookie — the random
+        // S256 challenge issued at initiation is the actual injection guard either way.
+        const verifierCookies = req.cookies;
+        const cookieVerifier = getConfig('NODE_ENV') === 'production'
+            ? verifierCookies?.[authorization.getAuthCookieName('oauth_verifier')]
+            : (verifierCookies?.[authorization.getAuthCookieName('oauth_verifier')] ??
+                verifierCookies?.oauth_verifier);
+        const expressResVerifier = res;
+        if (typeof expressResVerifier.clearCookie === 'function') {
+            // Same one-time-use clear as oauth_state: match the SET attributes
+            // (Partitioned + SameSite=None + Secure in the live-preview) so the
+            // deletion hits the right cookie jar.
+            expressResVerifier.clearCookie(authorization.getAuthCookieName('oauth_verifier'), {
+                ...authorization.getAuthCookieOptions(),
+            });
+            expressResVerifier.clearCookie('oauth_verifier', { path: '/' });
+        }
+        const codeVerifier = cookieVerifier ?? body.codeVerifier;
+        const oauthProvider = get('oauth', body.server);
+        if (!oauthProvider) {
+            return {
+                statusCode: 400,
+                body: {
+                    error: t('user.error.oauthServerNotConfigured', { server: body.server }),
+                    errorKey: 'user.error.oauthServerNotConfigured',
+                },
+            };
+        }
+        try {
+            // Verify the OAuth code with the bonded provider.
+            // SECURITY: do NOT pass the client-supplied `body.redirect_uri` — it is a value
+            // the browser controls, but the token-exchange redirect_uri MUST equal the one
+            // used to build the authorization request. That URI is `APP_ORIGIN` plus the
+            // sanitized same-origin path the flow started on (e.g. `/login`) — persisted
+            // at initiation in the httpOnly `oauth_redirect` cookie so the exchange can
+            // reconstruct it byte-for-byte (RFC 6749 §4.1.3; GitHub/Google reject with
+            // `redirect_uri_mismatch` otherwise) without trusting the request body.
+            const redirectCookies = req.cookies;
+            const cookieRedirect = getConfig('NODE_ENV') === 'production'
+                ? redirectCookies?.[authorization.getAuthCookieName('oauth_redirect')]
+                : (redirectCookies?.[authorization.getAuthCookieName('oauth_redirect')] ??
+                    redirectCookies?.oauth_redirect);
+            if (typeof expressResVerifier.clearCookie === 'function') {
+                expressResVerifier.clearCookie(authorization.getAuthCookieName('oauth_redirect'), {
+                    ...authorization.getAuthCookieOptions(),
+                });
+                expressResVerifier.clearCookie('oauth_redirect', { path: '/' });
+            }
+            const appOrigin = getConfig('APP_ORIGIN', '');
+            // Re-validate defensively (same rule the initiation applied) so a planted
+            // cookie can never turn the exchange redirect_uri into an open redirect.
+            const safeRedirectPath = typeof cookieRedirect === 'string' &&
+                cookieRedirect.startsWith('/') &&
+                !cookieRedirect.startsWith('//') &&
+                !cookieRedirect.includes('\\')
+                ? cookieRedirect
+                : '';
+            const oauthProps = await oauthProvider.verify(body.code, codeVerifier, appOrigin ? `${appOrigin}${safeRedirectPath}` : undefined);
+            if (!oauthProps?.oauthId || !oauthProps?.oauthServer) {
+                analytics
+                    .track({
+                    name: 'user.login_failed',
+                    properties: { reason: 'oauth_verification_failed', provider: body.server },
+                })
+                    .catch(() => { });
+                return {
+                    statusCode: 403,
+                    body: {
+                        error: t('user.error.oauthVerificationFailed'),
+                        errorKey: 'user.error.oauthVerificationFailed',
+                    },
+                };
+            }
+            // Normalize the provider email once so storage and every collision
+            // lookup compare the same canonical form — a case/whitespace variant
+            // (`Foo@x.com` vs `foo@x.com`) must not slip past the UNIQUE column.
+            const email = normalizeEmail(oauthProps.email);
+            // Only an explicit provider-verified flag counts as proof of mailbox
+            // ownership. Undefined/false from a provider that can't confirm is
+            // treated as unverified.
+            const oauthEmailVerified = oauthProps.emailVerified === true;
+            // Check if a user already exists with this OAuth ID.
+            let user = await findOne(tableName, [
+                { field: 'oauthServer', operator: '=', value: oauthProps.oauthServer },
+                { field: 'oauthId', operator: '=', value: oauthProps.oauthId },
+            ]);
+            if (!user) {
+                // Account-takeover + UNIQUE-crash guard. An OAuth login whose email
+                // already belongs to ANOTHER account must never silently create a
+                // second user (the `email` column is UNIQUE, so that throws and
+                // surfaces as an opaque 500). What we do on collision depends on who
+                // can prove they own the mailbox:
+                //
+                //  • OAuth email is provider-VERIFIED and the existing account is
+                //    UNVERIFIED → the OAuth user is the proven owner and the existing
+                //    account never proved ownership (classic squatting: an unverified
+                //    local signup at someone else's address). Link this provider into
+                //    the existing account so the verified owner isn't locked out.
+                //  • Otherwise (OAuth email unverified, OR the existing account is
+                //    already verified) → do NOT auto-link; an unverified provider email
+                //    could be typo-squatted/compromised, and we never wrest a verified
+                //    account away. Reject with an actionable 409.
+                if (email) {
+                    const existingByEmail = await findOne(tableName, [
+                        { field: 'email', operator: '=', value: email },
+                    ]);
+                    if (existingByEmail) {
+                        const existingVerified = existingByEmail.emailVerified === true;
+                        if (oauthEmailVerified && !existingVerified) {
+                            // Trust the provider-verified owner: link this OAuth identity
+                            // into the existing (unverified) account and mark it verified.
+                            // Also reset twoFactorEnabled — the squatter's prior 2FA state must
+                            // not carry over onto an account a different verified human now owns.
+                            await updateById(tableName, existingByEmail.id, {
+                                oauthServer: oauthProps.oauthServer,
+                                oauthId: oauthProps.oauthId,
+                                oauthData: JSON.stringify(oauthProps.oauthData),
+                                emailVerified: true,
+                                email,
+                                twoFactorEnabled: false,
+                                updatedAt: new Date().toISOString(),
+                            });
+                            // PRE-ACCOUNT-HIJACKING DEFENSE. The pre-existing unverified row
+                            // could be a squatter who registered the victim's email with a
+                            // password (and 2FA) THEY control — and may already hold a live
+                            // session. Now that a provider-verified human owns this email,
+                            // every prior credential on the row is untrusted: wipe the
+                            // password / reset-token / 2FA secrets so the squatter's password
+                            // can no longer authenticate via POST /users/log-in, and revoke
+                            // all existing devices/sessions so any session the squatter
+                            // already holds is killed. A fresh session for the verified owner
+                            // is issued below (device.createOrUpdate → authorization.set).
+                            await updateById(`${tableName}Secrets`, existingByEmail.id, {
+                                passwordHash: null,
+                                passwordResetToken: null,
+                                passwordResetTokenAt: null,
+                                pendingTwoFactorSecret: null,
+                                twoFactorSecret: null,
+                                lastTwoFactorTimeStep: null,
+                            });
+                            try {
+                                await get('device')?.deleteByUserId(existingByEmail.id);
+                                // Evict this process's positive device-exists cache so any live
+                                // session the squatter holds is rejected on its next request,
+                                // not after the cache TTL — immediate in-process revocation.
+                                authorization.invalidateAllDeviceExistsCache();
+                            }
+                            catch (err) {
+                                logger.warn('Failed to revoke prior sessions while claiming squatted account', {
+                                    userId: existingByEmail.id,
+                                    error: err,
+                                });
+                            }
+                            analytics
+                                .track({
+                                name: 'user.oauth_linked',
+                                userId: existingByEmail.id,
+                                properties: {
+                                    provider: oauthProps.oauthServer,
+                                    reason: 'verified_email_claimed_unverified_account',
+                                },
+                            })
+                                .catch((err) => {
+                                logger.debug('Failed to track user.oauth_linked', { error: err });
+                            });
+                            // Re-read the merged row so the response + session reflect DB truth.
+                            user = (await findById(tableName, existingByEmail.id)) ?? existingByEmail;
+                        }
+                        else {
+                            analytics
+                                .track({
+                                name: 'user.login_failed',
+                                properties: {
+                                    reason: 'oauth_email_collision',
+                                    provider: oauthProps.oauthServer,
+                                },
+                            })
+                                .catch((err) => {
+                                logger.debug('Failed to track user.login_failed', { error: err });
+                            });
+                            return {
+                                statusCode: 409,
+                                body: {
+                                    error: t('user.error.emailAlreadyRegistered', undefined, {
+                                        defaultValue: 'An account already exists for this email. Please sign in with your original method, then link this provider from your account settings.',
+                                    }),
+                                    errorKey: 'user.error.emailAlreadyRegistered',
+                                },
+                            };
+                        }
+                    }
+                }
+            }
+            if (!user) {
+                // Create a new user.
+                const id = uuid();
+                // Generate a unique username from OAuth data.
+                let username = oauthProps.username || oauthProps.oauthId;
+                username = username.replace(/[^a-zA-Z0-9]/g, '').substring(0, 255);
+                // Ensure username is unique.
+                const existing = await findOne(tableName, [
+                    { field: 'username', operator: '=', value: username },
+                ]);
+                if (existing) {
+                    username = `${username}${id.substring(0, 8)}`;
+                }
+                const createResponse = await createResource({
+                    props: {
+                        username,
+                        name: oauthProps.name,
+                        email: email || null,
+                        emailVerified: oauthEmailVerified,
+                        oauthServer: oauthProps.oauthServer,
+                        oauthId: oauthProps.oauthId,
+                        oauthData: oauthProps.oauthData,
+                    },
+                    id,
+                });
+                if (createResponse?.statusCode === 201) {
+                    user = createResponse.body?.props;
+                }
+                if (!user) {
+                    // The insert failed. The most likely non-bug cause is a TOCTOU race:
+                    // a concurrent request created an account with this same email
+                    // between our pre-check and this insert, so the UNIQUE constraint
+                    // rejected it. Detect that DB-agnostically (no provider-specific
+                    // error codes) by re-checking the email, and surface a clean 409
+                    // instead of an opaque 500.
+                    if (email) {
+                        const racedByEmail = await findOne(tableName, [
+                            { field: 'email', operator: '=', value: email },
+                        ]);
+                        if (racedByEmail) {
+                            analytics
+                                .track({
+                                name: 'user.login_failed',
+                                properties: {
+                                    reason: 'oauth_email_collision_race',
+                                    provider: oauthProps.oauthServer,
+                                },
+                            })
+                                .catch((err) => {
+                                logger.debug('Failed to track user.login_failed', { error: err });
+                            });
+                            return {
+                                statusCode: 409,
+                                body: {
+                                    error: t('user.error.emailAlreadyRegistered', undefined, {
+                                        defaultValue: 'An account already exists for this email. Please sign in with your original method, then link this provider from your account settings.',
+                                    }),
+                                    errorKey: 'user.error.emailAlreadyRegistered',
+                                },
+                            };
+                        }
+                    }
+                    return {
+                        statusCode: 500,
+                        body: {
+                            error: t('user.error.failedToCreateUser'),
+                            errorKey: 'user.error.failedToCreateUser',
+                        },
+                    };
+                }
+                // Create secrets row (no password for OAuth users).
+                await storeCreate(`${tableName}Secrets`, { id }).catch((err) => {
+                    logger.warn('Failed to store OAuth secrets', { userId: id, error: err });
+                });
+                analytics
+                    .track({
+                    name: 'user.signup',
+                    userId: user.id,
+                    properties: { method: 'oauth', provider: oauthProps.oauthServer },
+                })
+                    .catch(() => { });
+                analytics
+                    .identify({
+                    userId: user.id,
+                    email: oauthProps.email || undefined,
+                    name: oauthProps.name || undefined,
+                })
+                    .catch(() => { });
+            }
+            else {
+                // Update OAuth data on existing user.
+                await updateById(tableName, user.id, {
+                    oauthData: JSON.stringify(oauthProps.oauthData),
+                    updatedAt: new Date().toISOString(),
+                }).catch((err) => {
+                    logger.warn('Failed to update OAuth data', { userId: user.id, error: err });
+                });
+                analytics
+                    .track({
+                    name: 'user.login',
+                    userId: user.id,
+                    properties: { method: 'oauth', provider: oauthProps.oauthServer },
+                })
+                    .catch(() => { });
+            }
+            // SECURITY (M4): if the account has two-factor enabled, an OAuth login must
+            // NOT issue a session on its own — otherwise anyone who compromises the
+            // linked provider account bypasses the 2FA the user deliberately turned on.
+            // OAuth's single-use authorization code cannot carry the "resubmit with the
+            // TOTP" round-trip the password flow uses, so we fail CLOSED and direct the
+            // user to complete 2FA via password sign-in. (A native OAuth-2FA completion
+            // — a short-lived pending token + a verify endpoint + the picker UI — is a
+            // tracked follow-on; this closes the bypass safely without that flow.)
+            if (user.twoFactorEnabled) {
+                return {
+                    statusCode: 403,
+                    body: {
+                        error: t('user.error.twoFactorRequiresPassword', undefined, {
+                            defaultValue: 'Two-factor authentication is enabled on this account. Sign in with your email and password to continue.',
+                        }),
+                        errorKey: 'user.error.twoFactorRequiresPassword',
+                        twoFactorRequired: true,
+                    },
+                };
+            }
+            // Create or update device.
+            const deviceId = await get('device')?.createOrUpdate(user.id, body.deviceName || 'Unknown');
+            if (!deviceId) {
+                return {
+                    statusCode: 500,
+                    body: {
+                        error: t('user.error.failedToCreateSession'),
+                        errorKey: 'user.error.failedToCreateSession',
+                    },
+                };
+            }
+            // Set authorization.
+            authorization.set(req, res, {
+                userId: user.id,
+                deviceId,
+                oauthServer: oauthProps.oauthServer,
+                oauthId: oauthProps.oauthId,
+            });
+            return { statusCode: 200, body: { props: user } };
+        }
+        catch (error) {
+            // Never log the raw error here: an OAuth verify failure rethrows an
+            // error whose attached request/response could carry the token-exchange
+            // body (client_secret, code) or an Authorization header. Log only the
+            // message (CWE-532).
+            logger.error('OAuth login failed:', error instanceof Error ? error.message : String(error));
+            return {
+                statusCode: 500,
+                body: { error: t('user.error.oauthLoginFailed'), errorKey: 'user.error.oauthLoginFailed' },
+            };
+        }
+    };
+};
+//# sourceMappingURL=logInOAuth.js.map

package/dist/handlers/logInOAuth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logInOAuth.js","sourceRoot":"","sources":["../../src/handlers/logInOAuth.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAA;AAEhC,OAAO,EAAE,EAAE,IAAI,IAAI,EAAE,MAAM,MAAM,CAAA;AAEjC,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AACjE,OAAO,EAAE,GAAG,IAAI,SAAS,EAAE,MAAM,sBAAsB,CAAA;AACvD,OAAO,EAAE,MAAM,IAAI,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAC7F,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAA;AAEtC,OAAO,EAAE,MAAM,IAAI,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAEjE,OAAO,KAAK,aAAa,MAAM,qBAAqB,CAAA;AAEpD,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAA;AAE/D,MAAM,SAAS,GAAG,YAAY,EAAE,CAAA;AAChC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAA;AAE1B;;;;;;;GAOG;AACH,MAAM,qBAAqB,GAAG,CAAC,CAAS,EAAE,CAAS,EAAW,EAAE;IAC9D,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACzB,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACzB,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,MAAM,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;AACvC,CAAC,CAAA;AAcD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAkB,EAAE,EAAE;IACxE,MAAM,cAAc,GAAG,cAAc,CAAC;QACpC,IAAI;QACJ,SAAS;QACT,MAAM;KACP,CAAC,CAAA;IAEF,OAAO,KAAK,EAAE,GAAsB,EAAE,GAAqB,EAAE,EAAE;QAC7D,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAA;QAEpB,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAC/B,OAAO;gBACL,UAAU,EAAE,GAAG;gBACf,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,uBAAuB,CAAC,EAAE,QAAQ,EAAE,uBAAuB,EAAE;aAC/E,CAAA;QACH,CAAC;QAED,2EAA2E;QAC3E,yEAAyE;QACzE,yEAAyE;QACzE,uEAAuE;QACvE,uEAAuE;QACvE,2EAA2E;QAC3E,0EAA0E;QAC1E,2EAA2E;QAC3E,6DAA6D;QAC7D,MAAM,YAAY,GAAG,SAAS,CAAS,qBAAqB,EAAE,MAAM,CAAC,KAAK,OAAO,CAAA;QACjF,IAAI,YAAY,EAAE,CAAC;YACjB,0EAA0E;YAC1E,8EAA8E;YAC9E,4EAA4E;YAC5E,8EAA8E;YAC9E,0EAA0E;YAC1E,4EAA4E;YAC5E,+EAA+E;YAC/E,0EAA0E;YAC1E,MAAM,YAAY,GAAI,GAAuD,CAAC,OAAO,CAAA;YACrF,MAAM,WAAW,GACf,SAAS,CAAS,UAAU,CAAC,KAAK,YAAY;gBAC5C,CAAC,CAAC,YAAY,EAAE,CAAC,aAAa,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;gBAChE,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,aAAa,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;oBAC/D,YAAY,EAAE,WAAW,CAAC,CAAA;YAChC,MAAM,UAAU,GAAG,GAElB,CAAA;YACD,0EAA0E;YAC1E,4EAA4E;YAC5E,gEAAgE;YAChE,oEAAoE;YACpE,wEAAwE;YACxE,mCAAmC;YACnC,MAAM,gBAAgB,GAAG,GAAS,EAAE;gBAClC,IAAI,OAAO,UAAU,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;oBACjD,UAAU,CAAC,WAAW,CAAC,aAAa,CAAC,iBAAiB,CAAC,aAAa,CAAC,EAAE;wBACrE,GAAG,aAAa,CAAC,oBAAoB,EAAE;qBACxC,CAAC,CAAA;oBACF,UAAU,CAAC,WAAW,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAA;gBACtD,CAAC;YACH,CAAC,CAAA;YACD,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,WAAW,IAAI,CAAC,qBAAqB,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACnF,gBAAgB,EAAE,CAAA;gBAClB,OAAO;oBACL,UAAU,EAAE,GAAG;oBACf,IAAI,EAAE;wBACJ,KAAK,EAAE,CAAC,CAAC,+BAA+B,EAAE,SAAS,EAAE;4BACnD,YAAY,EAAE,6CAA6C;yBAC5D,CAAC;wBACF,QAAQ,EAAE,+BAA+B;qBAC1C;iBACF,CAAA;YACH,CAAC;YACD,gBAAgB,EAAE,CAAA;QACpB,CAAC;QAED,+EAA+E;QAC/E,kFAAkF;QAClF,mFAAmF;QACnF,8EAA8E;QAC9E,mFAAmF;QACnF,kFAAkF;QAClF,oFAAoF;QACpF,gFAAgF;QAChF,MAAM,eAAe,GAAI,GAAuD,CAAC,OAAO,CAAA;QACxF,MAAM,cAAc,GAClB,SAAS,CAAS,UAAU,CAAC,KAAK,YAAY;YAC5C,CAAC,CAAC,eAAe,EAAE,CAAC,aAAa,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;YACtE,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,aAAa,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;gBACrE,eAAe,EAAE,cAAc,CAAC,CAAA;QACtC,MAAM,kBAAkB,GAAG,GAE1B,CAAA;QACD,IAAI,OAAO,kBAAkB,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;YACzD,mEAAmE;YACnE,oEAAoE;YACpE,sCAAsC;YACtC,kBAAkB,CAAC,WAAW,CAAC,aAAa,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,EAAE;gBAChF,GAAG,aAAa,CAAC,oBAAoB,EAAE;aACxC,CAAC,CAAA;YACF,kBAAkB,CAAC,WAAW,CAAC,gBAAgB,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAA;QACjE,CAAC;QACD,MAAM,YAAY,GAAG,cAAc,IAAI,IAAI,CAAC,YAAY,CAAA;QAExD,MAAM,aAAa,GAAG,GAAG,CAmBtB,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;QACxB,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO;gBACL,UAAU,EAAE,GAAG;gBACf,IAAI,EAAE;oBACJ,KAAK,EAAE,CAAC,CAAC,qCAAqC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAO,EAAE,CAAC;oBACzE,QAAQ,EAAE,qCAAqC;iBAChD;aACF,CAAA;QACH,CAAC;QAED,IAAI,CAAC;YACH,kDAAkD;YAClD,gFAAgF;YAChF,+EAA+E;YAC/E,6EAA6E;YAC7E,6EAA6E;YAC7E,4EAA4E;YAC5E,2EAA2E;YAC3E,wEAAwE;YACxE,MAAM,eAAe,GAAI,GAAuD,CAAC,OAAO,CAAA;YACxF,MAAM,cAAc,GAClB,SAAS,CAAS,UAAU,CAAC,KAAK,YAAY;gBAC5C,CAAC,CAAC,eAAe,EAAE,CAAC,aAAa,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;gBACtE,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,aAAa,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;oBACrE,eAAe,EAAE,cAAc,CAAC,CAAA;YACtC,IAAI,OAAO,kBAAkB,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;gBACzD,kBAAkB,CAAC,WAAW,CAAC,aAAa,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,EAAE;oBAChF,GAAG,aAAa,CAAC,oBAAoB,EAAE;iBACxC,CAAC,CAAA;gBACF,kBAAkB,CAAC,WAAW,CAAC,gBAAgB,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAA;YACjE,CAAC;YACD,MAAM,SAAS,GAAG,SAAS,CAAS,YAAY,EAAE,EAAE,CAAC,CAAA;YACrD,0EAA0E;YAC1E,yEAAyE;YACzE,MAAM,gBAAgB,GACpB,OAAO,cAAc,KAAK,QAAQ;gBAClC,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC;gBAC9B,CAAC,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC;gBAChC,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAC5B,CAAC,CAAC,cAAc;gBAChB,CAAC,CAAC,EAAE,CAAA;YACR,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,MAAM,CAC3C,IAAI,CAAC,IAAI,EACT,YAAY,EACZ,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,GAAG,gBAAgB,EAAE,CAAC,CAAC,CAAC,SAAS,CAC1D,CAAA;YAED,IAAI,CAAC,UAAU,EAAE,OAAO,IAAI,CAAC,UAAU,EAAE,WAAW,EAAE,CAAC;gBACrD,SAAS;qBACN,KAAK,CAAC;oBACL,IAAI,EAAE,mBAAmB;oBACzB,UAAU,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE;iBAC3E,CAAC;qBACD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;gBAClB,OAAO;oBACL,UAAU,EAAE,GAAG;oBACf,IAAI,EAAE;wBACJ,KAAK,EAAE,CAAC,CAAC,oCAAoC,CAAC;wBAC9C,QAAQ,EAAE,oCAAoC;qBAC/C;iBACF,CAAA;YACH,CAAC;YAED,mEAAmE;YACnE,qEAAqE;YACrE,qEAAqE;YACrE,MAAM,KAAK,GAAG,cAAc,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;YAC9C,qEAAqE;YACrE,mEAAmE;YACnE,yBAAyB;YACzB,MAAM,kBAAkB,GAAG,UAAU,CAAC,aAAa,KAAK,IAAI,CAAA;YAE5D,qDAAqD;YACrD,IAAI,IAAI,GAAG,MAAM,OAAO,CAAc,SAAS,EAAE;gBAC/C,EAAE,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,CAAC,WAAW,EAAE;gBACtE,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,CAAC,OAAO,EAAE;aAC/D,CAAC,CAAA;YAEF,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,oEAAoE;gBACpE,kEAAkE;gBAClE,gEAAgE;gBAChE,qEAAqE;gBACrE,kCAAkC;gBAClC,EAAE;gBACF,kEAAkE;gBAClE,sEAAsE;gBACtE,sEAAsE;gBACtE,sEAAsE;gBACtE,kEAAkE;gBAClE,mEAAmE;gBACnE,wEAAwE;gBACxE,uEAAuE;gBACvE,kDAAkD;gBAClD,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,eAAe,GAAG,MAAM,OAAO,CAAc,SAAS,EAAE;wBAC5D,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE;qBAChD,CAAC,CAAA;oBACF,IAAI,eAAe,EAAE,CAAC;wBACpB,MAAM,gBAAgB,GAAG,eAAe,CAAC,aAAa,KAAK,IAAI,CAAA;wBAE/D,IAAI,kBAAkB,IAAI,CAAC,gBAAgB,EAAE,CAAC;4BAC5C,8DAA8D;4BAC9D,+DAA+D;4BAC/D,oEAAoE;4BACpE,sEAAsE;4BACtE,MAAM,UAAU,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,EAAE;gCAC9C,WAAW,EAAE,UAAU,CAAC,WAAW;gCACnC,OAAO,EAAE,UAAU,CAAC,OAAO;gCAC3B,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC;gCAC/C,aAAa,EAAE,IAAI;gCACnB,KAAK;gCACL,gBAAgB,EAAE,KAAK;gCACvB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;6BACpC,CAAC,CAAA;4BAEF,iEAAiE;4BACjE,+DAA+D;4BAC/D,gEAAgE;4BAChE,+DAA+D;4BAC/D,2DAA2D;4BAC3D,kEAAkE;4BAClE,gEAAgE;4BAChE,4DAA4D;4BAC5D,kEAAkE;4BAClE,+DAA+D;4BAC/D,MAAM,UAAU,CAAC,GAAG,SAAS,SAAS,EAAE,eAAe,CAAC,EAAE,EAAE;gCAC1D,YAAY,EAAE,IAAI;gCAClB,kBAAkB,EAAE,IAAI;gCACxB,oBAAoB,EAAE,IAAI;gCAC1B,sBAAsB,EAAE,IAAI;gCAC5B,eAAe,EAAE,IAAI;gCACrB,qBAAqB,EAAE,IAAI;6BAC5B,CAAC,CAAA;4BAEF,IAAI,CAAC;gCACH,MAAM,GAAG,CACP,QAAQ,CACT,EAAE,cAAc,CAAC,eAAe,CAAC,EAAE,CAAC,CAAA;gCACrC,gEAAgE;gCAChE,8DAA8D;gCAC9D,6DAA6D;gCAC7D,aAAa,CAAC,8BAA8B,EAAE,CAAA;4BAChD,CAAC;4BAAC,OAAO,GAAG,EAAE,CAAC;gCACb,MAAM,CAAC,IAAI,CAAC,iEAAiE,EAAE;oCAC7E,MAAM,EAAE,eAAe,CAAC,EAAE;oCAC1B,KAAK,EAAE,GAAG;iCACX,CAAC,CAAA;4BACJ,CAAC;4BAED,SAAS;iCACN,KAAK,CAAC;gCACL,IAAI,EAAE,mBAAmB;gCACzB,MAAM,EAAE,eAAe,CAAC,EAAE;gCAC1B,UAAU,EAAE;oCACV,QAAQ,EAAE,UAAU,CAAC,WAAW;oCAChC,MAAM,EAAE,2CAA2C;iCACpD;6BACF,CAAC;iCACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gCACb,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;4BACnE,CAAC,CAAC,CAAA;4BAEJ,qEAAqE;4BACrE,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAc,SAAS,EAAE,eAAe,CAAC,EAAE,CAAC,CAAC,IAAI,eAAe,CAAA;wBACxF,CAAC;6BAAM,CAAC;4BACN,SAAS;iCACN,KAAK,CAAC;gCACL,IAAI,EAAE,mBAAmB;gCACzB,UAAU,EAAE;oCACV,MAAM,EAAE,uBAAuB;oCAC/B,QAAQ,EAAE,UAAU,CAAC,WAAW;iCACjC;6BACF,CAAC;iCACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gCACb,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;4BACnE,CAAC,CAAC,CAAA;4BACJ,OAAO;gCACL,UAAU,EAAE,GAAG;gCACf,IAAI,EAAE;oCACJ,KAAK,EAAE,CAAC,CAAC,mCAAmC,EAAE,SAAS,EAAE;wCACvD,YAAY,EACV,yIAAyI;qCAC5I,CAAC;oCACF,QAAQ,EAAE,mCAAmC;iCAC9C;6BACF,CAAA;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAED,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,qBAAqB;gBACrB,MAAM,EAAE,GAAG,IAAI,EAAE,CAAA;gBAEjB,8CAA8C;gBAC9C,IAAI,QAAQ,GAAG,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,OAAO,CAAA;gBACxD,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;gBAElE,6BAA6B;gBAC7B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAiB,SAAS,EAAE;oBACxD,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE;iBACtD,CAAC,CAAA;gBAEF,IAAI,QAAQ,EAAE,CAAC;oBACb,QAAQ,GAAG,GAAG,QAAQ,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAA;gBAC/C,CAAC;gBAED,MAAM,cAAc,GAAG,MAAM,cAAc,CAAC;oBAC1C,KAAK,EAAE;wBACL,QAAQ;wBACR,IAAI,EAAE,UAAU,CAAC,IAAI;wBACrB,KAAK,EAAE,KAAK,IAAI,IAAI;wBACpB,aAAa,EAAE,kBAAkB;wBACjC,WAAW,EAAE,UAAU,CAAC,WAAW;wBACnC,OAAO,EAAE,UAAU,CAAC,OAAO;wBAC3B,SAAS,EAAE,UAAU,CAAC,SAAS;qBAChC;oBACD,EAAE;iBACH,CAAC,CAAA;gBAEF,IAAI,cAAc,EAAE,UAAU,KAAK,GAAG,EAAE,CAAC;oBACvC,IAAI,GAAG,cAAc,CAAC,IAAI,EAAE,KAA+B,CAAA;gBAC7D,CAAC;gBAED,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,qEAAqE;oBACrE,+DAA+D;oBAC/D,kEAAkE;oBAClE,iEAAiE;oBACjE,iEAAiE;oBACjE,4BAA4B;oBAC5B,IAAI,KAAK,EAAE,CAAC;wBACV,MAAM,YAAY,GAAG,MAAM,OAAO,CAAiB,SAAS,EAAE;4BAC5D,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE;yBAChD,CAAC,CAAA;wBACF,IAAI,YAAY,EAAE,CAAC;4BACjB,SAAS;iCACN,KAAK,CAAC;gCACL,IAAI,EAAE,mBAAmB;gCACzB,UAAU,EAAE;oCACV,MAAM,EAAE,4BAA4B;oCACpC,QAAQ,EAAE,UAAU,CAAC,WAAW;iCACjC;6BACF,CAAC;iCACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gCACb,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;4BACnE,CAAC,CAAC,CAAA;4BACJ,OAAO;gCACL,UAAU,EAAE,GAAG;gCACf,IAAI,EAAE;oCACJ,KAAK,EAAE,CAAC,CAAC,mCAAmC,EAAE,SAAS,EAAE;wCACvD,YAAY,EACV,yIAAyI;qCAC5I,CAAC;oCACF,QAAQ,EAAE,mCAAmC;iCAC9C;6BACF,CAAA;wBACH,CAAC;oBACH,CAAC;oBAED,OAAO;wBACL,UAAU,EAAE,GAAG;wBACf,IAAI,EAAE;4BACJ,KAAK,EAAE,CAAC,CAAC,+BAA+B,CAAC;4BACzC,QAAQ,EAAE,+BAA+B;yBAC1C;qBACF,CAAA;gBACH,CAAC;gBAED,oDAAoD;gBACpD,MAAM,WAAW,CAAC,GAAG,SAAS,SAAS,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;oBAC7D,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;gBAC1E,CAAC,CAAC,CAAA;gBAEF,SAAS;qBACN,KAAK,CAAC;oBACL,IAAI,EAAE,aAAa;oBACnB,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,UAAU,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,WAAW,EAAE;iBAClE,CAAC;qBACD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;gBAClB,SAAS;qBACN,QAAQ,CAAC;oBACR,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,KAAK,EAAE,UAAU,CAAC,KAAK,IAAI,SAAS;oBACpC,IAAI,EAAE,UAAU,CAAC,IAAI,IAAI,SAAS;iBACnC,CAAC;qBACD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;YACpB,CAAC;iBAAM,CAAC;gBACN,sCAAsC;gBACtC,MAAM,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE;oBACnC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC;oBAC/C,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBACpC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;oBACf,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,MAAM,EAAE,IAAK,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;gBAC9E,CAAC,CAAC,CAAA;gBAEF,SAAS;qBACN,KAAK,CAAC;oBACL,IAAI,EAAE,YAAY;oBAClB,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,UAAU,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,WAAW,EAAE;iBAClE,CAAC;qBACD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;YACpB,CAAC;YAED,4EAA4E;YAC5E,wEAAwE;YACxE,4EAA4E;YAC5E,4EAA4E;YAC5E,4EAA4E;YAC5E,4EAA4E;YAC5E,2EAA2E;YAC3E,uEAAuE;YACvE,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBAC1B,OAAO;oBACL,UAAU,EAAE,GAAG;oBACf,IAAI,EAAE;wBACJ,KAAK,EAAE,CAAC,CAAC,sCAAsC,EAAE,SAAS,EAAE;4BAC1D,YAAY,EACV,yGAAyG;yBAC5G,CAAC;wBACF,QAAQ,EAAE,sCAAsC;wBAChD,iBAAiB,EAAE,IAAI;qBACxB;iBACF,CAAA;YACH,CAAC;YAED,2BAA2B;YAC3B,MAAM,QAAQ,GAAG,MAAM,GAAG,CAEvB,QAAQ,CAAC,EAAE,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,IAAI,SAAS,CAAC,CAAA;YAEnE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO;oBACL,UAAU,EAAE,GAAG;oBACf,IAAI,EAAE;wBACJ,KAAK,EAAE,CAAC,CAAC,kCAAkC,CAAC;wBAC5C,QAAQ,EAAE,kCAAkC;qBAC7C;iBACF,CAAA;YACH,CAAC;YAED,qBAAqB;YACrB,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE;gBAC1B,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,QAAQ;gBACR,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,OAAO,EAAE,UAAU,CAAC,OAAO;aAC5B,CAAC,CAAA;YAEF,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAA;QACnD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,oEAAoE;YACpE,uEAAuE;YACvE,sEAAsE;YACtE,qBAAqB;YACrB,MAAM,CAAC,KAAK,CAAC,qBAAqB,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;YAC3F,OAAO;gBACL,UAAU,EAAE,GAAG;gBACf,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,6BAA6B,CAAC,EAAE,QAAQ,EAAE,6BAA6B,EAAE;aAC3F,CAAA;QACH,CAAC;IACH,CAAC,CAAA;AACH,CAAC,CAAA"}

package/dist/handlers/logout.d.ts

@@ -0,0 +1,22 @@
+import type { MoleculeRequest, MoleculeResponse } from '@molecule/api-resource';
+/**
+ * Logs the current user out. Revokes the session device server-side (so the JWT
+ * is rejected on its next use — covering EVERY copy of the token, not just this
+ * browser) and clears the credential cookies.
+ *
+ * [M1-1] Under the in-memory-token model the httpOnly `token` cookie is the
+ * persistent credential, so logout MUST clear it (and the `mol_auth` presence
+ * hint) — otherwise the app's cookie-based session restore (`GET /users/me` on
+ * init) would silently log the user back in on the next page load, and a
+ * client-side-only logout would be cosmetic (the cookie would still authenticate
+ * direct API calls). Cookie-authed via `auth` (no `:id`; the session identifies
+ * the user).
+ * @returns A request handler responding `{ statusCode: 200, body: { success: true } }`.
+ */
+export declare const logout: () => (_req: MoleculeRequest, res: MoleculeResponse) => Promise<{
+    statusCode: number;
+    body: {
+        success: boolean;
+    };
+}>;
+//# sourceMappingURL=logout.d.ts.map

package/dist/handlers/logout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../src/handlers/logout.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAM/E;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,MAAM,SACH,MAAM,eAAe,EAAE,KAAK,gBAAgB;;;;;EAyC3D,CAAA"}

package/dist/handlers/logout.js

@@ -0,0 +1,57 @@
+import { get, getLogger } from '@molecule/api-bond';
+import { getAuthCookieName, getAuthCookieOptions } from '../authorization.js';
+const logger = getLogger();
+/**
+ * Logs the current user out. Revokes the session device server-side (so the JWT
+ * is rejected on its next use — covering EVERY copy of the token, not just this
+ * browser) and clears the credential cookies.
+ *
+ * [M1-1] Under the in-memory-token model the httpOnly `token` cookie is the
+ * persistent credential, so logout MUST clear it (and the `mol_auth` presence
+ * hint) — otherwise the app's cookie-based session restore (`GET /users/me` on
+ * init) would silently log the user back in on the next page load, and a
+ * client-side-only logout would be cosmetic (the cookie would still authenticate
+ * direct API calls). Cookie-authed via `auth` (no `:id`; the session identifies
+ * the user).
+ * @returns A request handler responding `{ statusCode: 200, body: { success: true } }`.
+ */
+export const logout = () => {
+    return async (_req, res) => {
+        try {
+            const session = res.locals.session;
+            if (session?.deviceId) {
+                // Delete the device so verifyMiddleware rejects this JWT server-side.
+                await get('device')?.delete(session.deviceId);
+            }
+        }
+        catch (error) {
+            // Best-effort — the device row may already be gone; clear cookies regardless.
+            logger.debug('Device delete on logout failed (non-fatal)', { error });
+        }
+        const expressRes = res;
+        if (typeof expressRes.clearCookie === 'function') {
+            // The CLEAR must carry the SAME attributes the cookie was SET with
+            // (getAuthCookieOptions: Secure + Path=/ in prod; + SameSite=None +
+            // Partitioned in the sandbox live-preview) or the browser won't match &
+            // delete it — a mismatched clear leaves a stale (partitioned) credential
+            // cookie alive, so logout would be cosmetic. Single source of truth.
+            const cookieOptions = getAuthCookieOptions();
+            // Clear by BOTH the current name (prod `__Host-`) and the legacy plain name
+            // so a pre-rollout copy can't linger.
+            const clear = (base) => {
+                expressRes.clearCookie(getAuthCookieName(base), { ...cookieOptions });
+                expressRes.clearCookie(base, { path: '/' });
+            };
+            clear('token');
+            clear('sessionId');
+            // The session-presence hint is a plain (non-`__Host-`) cookie set with the
+            // same per-environment attributes, so clear it with them too.
+            expressRes.clearCookie('mol_auth', { ...cookieOptions });
+        }
+        // Drop any Authorization header so a same-response refresh can't hand a
+        // fresh credential back to a client that just logged out.
+        expressRes.removeHeader?.('Authorization');
+        return { statusCode: 200, body: { success: true } };
+    };
+};
+//# sourceMappingURL=logout.js.map

package/dist/handlers/logout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout.js","sourceRoot":"","sources":["../../src/handlers/logout.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAGnD,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAE7E,MAAM,MAAM,GAAG,SAAS,EAAE,CAAA;AAE1B;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,GAAG,EAAE;IACzB,OAAO,KAAK,EAAE,IAAqB,EAAE,GAAqB,EAAE,EAAE;QAC5D,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,OAA4C,CAAA;YACvE,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;gBACtB,sEAAsE;gBACtE,MAAM,GAAG,CAA8C,QAAQ,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;YAC5F,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,8EAA8E;YAC9E,MAAM,CAAC,KAAK,CAAC,4CAA4C,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;QACvE,CAAC;QAED,MAAM,UAAU,GAAG,GAGlB,CAAA;QACD,IAAI,OAAO,UAAU,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;YACjD,mEAAmE;YACnE,oEAAoE;YACpE,wEAAwE;YACxE,yEAAyE;YACzE,qEAAqE;YACrE,MAAM,aAAa,GAAG,oBAAoB,EAAE,CAAA;YAC5C,4EAA4E;YAC5E,sCAAsC;YACtC,MAAM,KAAK,GAAG,CAAC,IAAY,EAAQ,EAAE;gBACnC,UAAU,CAAC,WAAY,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,aAAa,EAAE,CAAC,CAAA;gBACtE,UAAU,CAAC,WAAY,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAA;YAC9C,CAAC,CAAA;YACD,KAAK,CAAC,OAAO,CAAC,CAAA;YACd,KAAK,CAAC,WAAW,CAAC,CAAA;YAClB,2EAA2E;YAC3E,8DAA8D;YAC9D,UAAU,CAAC,WAAY,CAAC,UAAU,EAAE,EAAE,GAAG,aAAa,EAAE,CAAC,CAAA;QAC3D,CAAC;QACD,wEAAwE;QACxE,0DAA0D;QAC1D,UAAU,CAAC,YAAY,EAAE,CAAC,eAAe,CAAC,CAAA;QAE1C,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAA;IACrD,CAAC,CAAA;AACH,CAAC,CAAA"}

package/dist/handlers/oauthAuthorize.d.ts

@@ -0,0 +1,44 @@
+import type { MoleculeRequest, MoleculeResponse } from '@molecule/api-resource';
+/**
+ * OAuth initiation — `GET /users/oauth/:provider`.
+ *
+ * The missing first half of the OAuth flow whose second half is
+ * `logInOAuth` (`POST /users/log-in/oauth`): generates the CSRF `state` and
+ * a per-session PKCE S256 verifier, stores BOTH in httpOnly cookies (the
+ * exact names + attributes `logInOAuth` reads and clears —
+ * `getAuthCookieName('oauth_state')` / `('oauth_verifier')` with
+ * `getAuthCookieOptions()`), then 302-redirects the browser to the
+ * provider's authorization URL.
+ *
+ * Provider knowledge stays in the bond: the handler asks the bonded OAuth
+ * provider (`get('oauth', :provider)`) for its authorize URL via its
+ * optional `getAuthorizeUrl` builder (see `@molecule/api-oauth`). A
+ * provider that is not bonded, lacks the builder, or is unconfigured
+ * (builder returns `null`, e.g. missing client id) yields a clean 404/503 —
+ * never a crash.
+ *
+ * The `redirect_uri` sent to the provider is `APP_ORIGIN` plus an optional
+ * validated same-origin `redirect_to` path from the query string (the page
+ * that initiated the flow, e.g. `/login`, where the app's OAuth callback
+ * handling is mounted). The path is sanitized so this can never become an
+ * open redirect; the state cookie — not `redirect_uri` — is the CSRF
+ * control.
+ *
+ * @returns A request handler that responds `302` with a `Location` header
+ * pointing at the provider's authorization URL.
+ */
+export declare const oauthAuthorize: () => (req: MoleculeRequest, res: MoleculeResponse) => Promise<{
+    statusCode: number;
+    body: {
+        error: string;
+        errorKey: string;
+    };
+    headers?: undefined;
+} | {
+    statusCode: number;
+    headers: {
+        Location: string;
+    };
+    body: undefined;
+}>;
+//# sourceMappingURL=oauthAuthorize.d.ts.map

package/dist/handlers/oauthAuthorize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthAuthorize.d.ts","sourceRoot":"","sources":["../../src/handlers/oauthAuthorize.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AA2B/E;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,cAAc,SACX,KAAK,eAAe,EAAE,KAAK,gBAAgB;;;;;;;;;;;;;EAsG1D,CAAA"}