@mongodb-js/oidc-plugin 0.1.0-alpha.0

package/dist/plugin.js

@@ -0,0 +1,465 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MongoDBOIDCPluginImpl = void 0;
+const types_1 = require("./types");
+const util_1 = require("./util");
+const openid_client_1 = require("openid-client");
+const rfc_8252_http_server_1 = require("./rfc-8252-http-server");
+const open_1 = __importDefault(require("open"));
+const util_2 = require("util");
+const crypto_1 = require("crypto");
+const events_1 = require("events");
+const api_1 = require("./api");
+const child_process_1 = require("child_process");
+// eslint-disable-next-line @typescript-eslint/consistent-type-imports
+let _electron = undefined;
+async function getDefaultOpenBrowser() {
+    // If running electron, use electron.shell.openExternal() by default
+    // to open a browser.
+    if (process.versions.electron && _electron !== 'cannot-require') {
+        try {
+            _electron ?? (_electron = await Promise.resolve().then(() => __importStar(require('electron'))));
+            return ({ url }) => 
+            // eslint-disable-next-line @typescript-eslint/consistent-type-imports
+            _electron.shell.openExternal(url);
+        }
+        catch {
+            _electron = 'cannot-require';
+        }
+    }
+    // Otherwise, use open() from npm.
+    return async ({ url }) => {
+        const child = await (0, open_1.default)(url);
+        child.unref();
+        return child;
+    };
+}
+const kEnableFallback = Symbol.for('@@mdb.oidcplugin.kEnableFallback');
+/** @internal */
+class MongoDBOIDCPluginImpl {
+    constructor(options) {
+        this.mapUserToAuthState = new Map();
+        this.options = options;
+        this.logger = options.logger ?? new events_1.EventEmitter();
+        this.mongoClientOptions = {
+            authMechanismProperties: {
+                REQUEST_TOKEN_CALLBACK: this.requestToken.bind(this),
+                REFRESH_TOKEN_CALLBACK: this.refreshToken.bind(this),
+            },
+        };
+    }
+    // Is this flow supported and allowed?
+    isFlowAllowed(flow) {
+        if (this.options.allowedFlows?.includes(flow) === false)
+            return false;
+        if (flow === 'auth-code' && this.options.openBrowser === false)
+            return false;
+        if (flow === 'device-auth' && !this.options.notifyDeviceFlow)
+            return false;
+        return true;
+    }
+    // Return the current state for a given [server, username] configuration,
+    // or create a new one if none exists.
+    getAuthState(serverMetadata, principalName) {
+        if (!serverMetadata.clientId) {
+            throw new types_1.MongoDBOIDCError('No clientId passed in server OIDC metadata object');
+        }
+        principalName ?? (principalName = null);
+        const key = JSON.stringify({
+            clientId: serverMetadata.clientId,
+            principalName,
+        });
+        const existing = this.mapUserToAuthState.get(key);
+        if (existing)
+            return existing;
+        const newState = {
+            serverOIDCMetadata: serverMetadata,
+            currentAuthAttempt: null,
+            currentTokenSet: null,
+        };
+        this.mapUserToAuthState.set(key, newState);
+        return newState;
+    }
+    getRedirectURI() {
+        if (!this.isFlowAllowed('auth-code'))
+            return '';
+        // TODO(MONGOSH-1394): Properly standardize a port
+        return this.options.redirectURI ?? 'http://localhost:27097/redirect';
+    }
+    getInitialOIDCIssuerAndClientParams(serverMetadata) {
+        return {
+            scope: [
+                ...new Set([
+                    'openid',
+                    'offline_access',
+                    ...(serverMetadata.requestScopes ?? []),
+                ]),
+            ].join(' '),
+            issuerParams: {
+                authorization_endpoint: serverMetadata.authorizationEndpoint,
+                token_endpoint: serverMetadata.tokenEndpoint,
+                device_authorization_endpoint: serverMetadata.deviceAuthorizationEndpoint,
+                // Required by the TS definitions, but we just don't have this data
+                // at this point. We re-define it later where necessary.
+                issuer: '',
+            },
+            clientParams: {
+                client_id: serverMetadata.clientId,
+                client_secret: serverMetadata.clientSecret,
+                redirect_uris: [this.getRedirectURI()],
+                response_types: ['code'],
+                // At least Okta requires this:
+                token_endpoint_auth_method: serverMetadata.clientSecret
+                    ? 'client_secret_post'
+                    : 'none',
+            },
+        };
+    }
+    async openBrowser(options) {
+        // Consistency check: options.url is a valid URL.
+        new URL(options.url);
+        this.logger.emit('mongodb-oidc-plugin:open-browser', {
+            customOpener: !!this.options.openBrowser,
+        });
+        if (this.options.openBrowser === false) {
+            // We should never really get to this point
+            throw new Error('Cannot open browser if `openBrowser` is false');
+        }
+        if (typeof this.options.openBrowser === 'function') {
+            return await this.options.openBrowser(options);
+        }
+        if (this.options.openBrowser === undefined) {
+            const defaultOpener = await getDefaultOpenBrowser();
+            return await defaultOpener(options);
+        }
+        if (typeof this.options.openBrowser?.command === 'string') {
+            const child = (0, child_process_1.spawn)(this.options.openBrowser.command, [options.url], {
+                shell: true,
+                stdio: 'ignore',
+                detached: true,
+                signal: this.options.openBrowser.abortable ? options.signal : undefined,
+            });
+            child.unref();
+            return child;
+        }
+        throw new Error('Unknown format for `openBrowser`');
+    }
+    async notifyDeviceFlow(deviceFlowInformation) {
+        if (!this.options.notifyDeviceFlow) {
+            // Should never happen.
+            throw new Error('notifyDeviceFlow() requested but not provided');
+        }
+        this.logger.emit('mongodb-oidc-plugin:notify-device-flow');
+        await this.options.notifyDeviceFlow(deviceFlowInformation);
+    }
+    storeTokenSet(state, tokenSet, client) {
+        state.currentTokenSet = {
+            set: tokenSet,
+            tryRefresh: async () => {
+                // Only refresh this token set if it is the one currently
+                // being used.
+                if (state.currentTokenSet?.set !== tokenSet)
+                    return false;
+                try {
+                    const refreshedTokens = await client.refresh(tokenSet);
+                    // Check again to avoid race conditions.
+                    if (state.currentTokenSet?.set === tokenSet) {
+                        this.storeTokenSet(state, refreshedTokens, client);
+                        return true;
+                    }
+                }
+                catch (err) {
+                    this.logger.emit('mongodb-oidc-plugin:refresh-failed', {
+                        error: (0, util_1.errorString)(err),
+                    });
+                }
+                return false;
+            },
+        };
+    }
+    async authorizationCodeFlow(state, signal) {
+        const { scope, issuerParams, clientParams } = this.getInitialOIDCIssuerAndClientParams(state.serverOIDCMetadata);
+        const codeVerifier = openid_client_1.generators.codeVerifier();
+        const codeChallenge = openid_client_1.generators.codeChallenge(codeVerifier);
+        let issuer = new openid_client_1.Issuer(issuerParams);
+        let client = new issuer.Client(clientParams);
+        const oidcStateParam = (await (0, util_2.promisify)(crypto_1.randomBytes)(16)).toString('hex');
+        const server = new rfc_8252_http_server_1.RFC8252HTTPServer({
+            redirectUrl: this.getRedirectURI(),
+            logger: this.logger,
+            redirectServerRequestHandler: this.options.redirectServerRequestHandler,
+            oidcStateParam,
+        });
+        let paramsUrl = '';
+        let enableFallback = true;
+        try {
+            await (0, util_1.withAbortCheck)(signal, async ({ signalCheck, signalPromise }) => {
+                await Promise.race([server.listen(), signalPromise]);
+                const authCodeFlowUrl = client.authorizationUrl({
+                    scope,
+                    code_challenge: codeChallenge,
+                    code_challenge_method: 'S256',
+                    state: oidcStateParam,
+                });
+                const { localUrl, onAccessed: onLocalUrlAccessed } = await server.addRedirect(authCodeFlowUrl);
+                signalCheck();
+                // Handle errors from opening a browser but do not await the Promise
+                // in case it only resolves when the browser exits (which is the case
+                // for the default `open` handler).
+                const browserStatePromise = new Promise((resolve, reject) => {
+                    this.openBrowser({ url: localUrl, signal })
+                        .then((browserHandle) => {
+                        browserHandle?.once('error', (err) => reject(err));
+                        browserHandle?.once('exit', (code) => {
+                            if (code !== 0)
+                                reject(new types_1.MongoDBOIDCError(`Opening browser failed with exit code ${code}`));
+                        });
+                    })
+                        .catch(reject);
+                });
+                const timeout = new Promise((resolve, reject) => {
+                    if (this.options.openBrowserTimeout !== 0) {
+                        setTimeout(reject, this.options.openBrowserTimeout ?? api_1.kDefaultOpenBrowserTimeout, new types_1.MongoDBOIDCError('Opening browser timed out')).unref();
+                    }
+                });
+                browserStatePromise.catch(() => {
+                    /* squelch UnhandledPromiseRejectionWarning */
+                });
+                timeout.catch(() => {
+                    /* ditto */
+                });
+                await Promise.race([
+                    onLocalUrlAccessed,
+                    timeout,
+                    browserStatePromise,
+                    signalPromise,
+                ]);
+                // If we reached this point, we know that we have successfully opened
+                // a server listening on a local port and a browser and that the
+                // browser accessed the server. We do not want to fall back to another
+                // flow anymore, any error from here on is most likely a genuine
+                // authentication error.
+                enableFallback = false;
+                paramsUrl = await server.waitForOIDCParamsAndClose({ signal });
+            });
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        }
+        catch (err) {
+            // Tell the outer logic here to fallback to device auth flow if it is
+            // available if any of the steps above failed.
+            if (Object.isExtensible(err)) {
+                err[kEnableFallback] = enableFallback;
+            }
+            throw err;
+        }
+        finally {
+            await server.close();
+        }
+        const params = client.callbackParams(paramsUrl);
+        // The oidc-client library requires `issuer` to be set here; we did not
+        // set it when we assembled the original `issuerParams` (because it was
+        // not available as information), but we should have received it from the
+        // callback parameters and can set it here.
+        issuerParams.issuer = String(params.iss);
+        issuer = new openid_client_1.Issuer(issuerParams);
+        client = new issuer.Client(clientParams);
+        client.validateIdToken = () => {
+            // Do not attempt to validate the ID token. The client library would
+            // do this by default, but we do not have access to the necessary
+            // JWKS here. This is in direct conflict with the OIDC spec (!!)
+            // https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation:
+            //
+            // > Clients MUST validate the ID Token in the Token Response in the following manner: [...]
+            //
+            // We accept this because for the purposes of this plugin, we do not
+            // interact with the identity token, nor do we actually consume the
+            // access token. We leave it to the the server to validate that the token is
+            // valid, refers to the right identity, and comes from the right source.
+        };
+        const tokenSet = await client.callback(this.getRedirectURI(), params, {
+            code_verifier: codeVerifier,
+            state: oidcStateParam,
+        });
+        this.storeTokenSet(state, tokenSet, client);
+    }
+    async deviceAuthorizationFlow(state, signal) {
+        const { scope, issuerParams, clientParams } = this.getInitialOIDCIssuerAndClientParams(state.serverOIDCMetadata);
+        const issuer = new openid_client_1.Issuer(issuerParams);
+        const client = new issuer.Client(clientParams);
+        client.validateIdToken = () => {
+            /* see above */
+        };
+        await (0, util_1.withAbortCheck)(signal, async ({ signalCheck, signalPromise }) => {
+            const deviceFlowHandle = await Promise.race([
+                client.deviceAuthorization({
+                    client_id: clientParams.client_id,
+                    scope,
+                }),
+                signalPromise,
+            ]);
+            signalCheck();
+            await this.notifyDeviceFlow({
+                userCode: deviceFlowHandle.user_code,
+                verificationUrl: deviceFlowHandle.verification_uri,
+            });
+            const tokenSet = await deviceFlowHandle.poll({ signal });
+            this.storeTokenSet(state, tokenSet, client);
+        });
+    }
+    async initiateAuthAttempt(state, driverAbortSignal) {
+        (0, util_1.throwIfAborted)(this.options.signal);
+        (0, util_1.throwIfAborted)(driverAbortSignal);
+        const combinedAbortController = new util_1.AbortController();
+        const optionsAbortCb = () => {
+            // @ts-expect-error TS doesn't understand .abort(reason)
+            combinedAbortController.abort(this.options.signal.reason);
+        };
+        const driverAbortCb = () => {
+            // @ts-expect-error TS doesn't understand .abort(reason)
+            combinedAbortController.abort(driverAbortSignal.reason);
+        };
+        this.options.signal?.addEventListener('abort', optionsAbortCb);
+        driverAbortSignal?.addEventListener('abort', driverAbortCb);
+        const signal = combinedAbortController.signal;
+        try {
+            get_tokens: {
+                if ((state.currentTokenSet?.set?.expires_in ?? 0) > 5 * 60) {
+                    this.logger.emit('mongodb-oidc-plugin:skip-auth-attempt', {
+                        reason: 'not-expired',
+                    });
+                    break get_tokens;
+                }
+                if (await state.currentTokenSet?.tryRefresh?.()) {
+                    this.logger.emit('mongodb-oidc-plugin:skip-auth-attempt', {
+                        reason: 'refresh-succeeded',
+                    });
+                    break get_tokens;
+                }
+                state.currentTokenSet = null;
+                let error;
+                if (this.isFlowAllowed('auth-code')) {
+                    try {
+                        this.logger.emit('mongodb-oidc-plugin:auth-attempt-started', {
+                            flow: 'auth-code',
+                        });
+                        await this.authorizationCodeFlow(state, signal);
+                        this.logger.emit('mongodb-oidc-plugin:auth-attempt-succeeded');
+                        break get_tokens;
+                    }
+                    catch (err) {
+                        error = err;
+                        this.logger.emit('mongodb-oidc-plugin:auth-attempt-failed', {
+                            error: (0, util_1.errorString)(err),
+                        });
+                        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+                        if (!err?.[kEnableFallback])
+                            throw err;
+                    }
+                }
+                if (this.isFlowAllowed('device-auth')) {
+                    try {
+                        this.logger.emit('mongodb-oidc-plugin:auth-attempt-started', {
+                            flow: 'device-auth',
+                        });
+                        await this.deviceAuthorizationFlow(state, signal);
+                        this.logger.emit('mongodb-oidc-plugin:auth-attempt-succeeded');
+                        break get_tokens;
+                    }
+                    catch (err) {
+                        this.logger.emit('mongodb-oidc-plugin:auth-attempt-failed', {
+                            error: (0, util_1.errorString)(err),
+                        });
+                        throw err;
+                    }
+                }
+                if (error)
+                    throw error;
+            }
+            if (!state.currentTokenSet?.set?.access_token) {
+                throw new types_1.MongoDBOIDCError('Could not retrieve valid access token');
+            }
+        }
+        catch (err) {
+            this.logger.emit('mongodb-oidc-plugin:auth-failed', {
+                error: (0, util_1.errorString)(err),
+            });
+            throw err;
+        }
+        finally {
+            this.options.signal?.removeEventListener('abort', optionsAbortCb);
+            driverAbortSignal?.removeEventListener('abort', driverAbortCb);
+        }
+        this.logger.emit('mongodb-oidc-plugin:auth-succeeded', {
+            hasRefreshToken: !!state.currentTokenSet.set.refresh_token,
+            expiresAt: state.currentTokenSet.set.expires_at
+                ? new Date(state.currentTokenSet.set.expires_at * 1000).toISOString()
+                : null,
+        });
+        return {
+            accessToken: state.currentTokenSet.set.access_token,
+            refreshToken: state.currentTokenSet.set.refresh_token,
+            // Passing `expiresInSeconds: 0` results in the driver not caching the token.
+            // We perform our own caching here inside the plugin, so interactions with the
+            // cache of the driver are not really required or necessarily helpful.
+            // The driver cache has a finer cache key (host address instead of clientId),
+            // so may require more authentication attempts, and is global,
+            // not per-MongoClient.
+            // It probably would be fine to pass in the actual expiration time here, but
+            // there seem to be no benefits to doing so.
+            expiresInSeconds: 0,
+        };
+    }
+    async requestToken(principalName, serverMetadata, driverAbortSignal) {
+        const state = this.getAuthState(serverMetadata, principalName);
+        if (state.currentAuthAttempt) {
+            return await state.currentAuthAttempt;
+        }
+        // The currently plan is for the 6.x driver (which may drop support
+        // for Node.js 14.x) to pass in an actual AbortSignal here. For
+        // compatibility with the 5.x driver/AbortSignal-less-Node.js, we accept
+        // a timeout in milliseconds as well.
+        if (typeof driverAbortSignal === 'number') {
+            driverAbortSignal = (0, util_1.timeoutSignal)(driverAbortSignal);
+        }
+        const newAuthAttempt = this.initiateAuthAttempt(state, driverAbortSignal);
+        state.currentAuthAttempt = newAuthAttempt;
+        newAuthAttempt.finally(() => {
+            if (state.currentAuthAttempt === newAuthAttempt)
+                state.currentAuthAttempt = null;
+        });
+        return newAuthAttempt;
+    }
+    async refreshToken(principalName, serverMetadata, 
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    previousResult, driverAbortSignal) {
+        return await this.requestToken(principalName, serverMetadata, driverAbortSignal);
+    }
+}
+exports.MongoDBOIDCPluginImpl = MongoDBOIDCPluginImpl;
+//# sourceMappingURL=plugin.js.map

package/dist/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAOA,mCAA2C;AAC3C,iCAMgB;AAOhB,iDAAmD;AACnD,iEAA2D;AAC3D,gDAAwB;AACxB,+BAAiC;AACjC,mCAAqC;AACrC,mCAAsC;AAStC,+BAAmD;AACnD,iDAAsC;AAkBtC,sEAAsE;AACtE,IAAI,SAAS,GACX,SAAS,CAAC;AACZ,KAAK,UAAU,qBAAqB;IAGlC,oEAAoE;IACpE,qBAAqB;IACrB,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,IAAI,SAAS,KAAK,gBAAgB,EAAE;QAC/D,IAAI;YACF,SAAS,KAAT,SAAS,GAAK,wDAAa,UAAU,GAAC,EAAC;YACvC,OAAO,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE;YACjB,sEAAsE;YACrE,SAAuC,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;SACpE;QAAC,MAAM;YACN,SAAS,GAAG,gBAAgB,CAAC;SAC9B;KACF;IACD,kCAAkC;IAClC,OAAO,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;QACvB,MAAM,KAAK,GAAG,MAAM,IAAA,cAAI,EAAC,GAAG,CAAC,CAAC;QAC9B,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,eAAe,GAAG,MAAM,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;AAEvE,gBAAgB;AAChB,MAAa,qBAAqB;IAMhC,YAAY,OAA2C;QAHtC,uBAAkB,GAAG,IAAI,GAAG,EAA6B,CAAC;QAIzE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,qBAAY,EAAE,CAAC;QACnD,IAAI,CAAC,kBAAkB,GAAG;YACxB,uBAAuB,EAAE;gBACvB,sBAAsB,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;gBACpD,sBAAsB,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;aACrD;SACF,CAAC;IACJ,CAAC;IAED,sCAAsC;IAC9B,aAAa,CAAC,IAAkB;QACtC,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,KAAK;YAAE,OAAO,KAAK,CAAC;QACtE,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,KAAK,KAAK;YAC5D,OAAO,KAAK,CAAC;QACf,IAAI,IAAI,KAAK,aAAa,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB;YAAE,OAAO,KAAK,CAAC;QAC3E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,yEAAyE;IACzE,sCAAsC;IAC9B,YAAY,CAClB,cAAwC,EACxC,aAAwC;QAExC,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE;YAC5B,MAAM,IAAI,wBAAgB,CACxB,mDAAmD,CACpD,CAAC;SACH;QACD,aAAa,KAAb,aAAa,GAAK,IAAI,EAAC;QAEvB,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC;YACzB,QAAQ,EAAE,cAAc,CAAC,QAAQ;YACjC,aAAa;SACd,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,QAAQ,GAAsB;YAClC,kBAAkB,EAAE,cAAc;YAClC,kBAAkB,EAAE,IAAI;YACxB,eAAe,EAAE,IAAI;SACtB,CAAC;QACF,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC3C,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,cAAc;QACpB,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC;YAAE,OAAO,EAAE,CAAC;QAChD,kDAAkD;QAClD,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,iCAAiC,CAAC;IACvE,CAAC;IAEO,mCAAmC,CACzC,cAAwC;QAMxC,OAAO;YACL,KAAK,EAAE;gBACL,GAAG,IAAI,GAAG,CAAC;oBACT,QAAQ;oBACR,gBAAgB;oBAChB,GAAG,CAAC,cAAc,CAAC,aAAa,IAAI,EAAE,CAAC;iBACxC,CAAC;aACH,CAAC,IAAI,CAAC,GAAG,CAAC;YACX,YAAY,EAAE;gBACZ,sBAAsB,EAAE,cAAc,CAAC,qBAAqB;gBAC5D,cAAc,EAAE,cAAc,CAAC,aAAa;gBAC5C,6BAA6B,EAC3B,cAAc,CAAC,2BAA2B;gBAC5C,mEAAmE;gBACnE,wDAAwD;gBACxD,MAAM,EAAE,EAAE;aACX;YACD,YAAY,EAAE;gBACZ,SAAS,EAAE,cAAc,CAAC,QAAQ;gBAClC,aAAa,EAAE,cAAc,CAAC,YAAY;gBAC1C,aAAa,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;gBACtC,cAAc,EAAE,CAAC,MAAM,CAAC;gBACxB,+BAA+B;gBAC/B,0BAA0B,EAAE,cAAc,CAAC,YAAY;oBACrD,CAAC,CAAC,oBAAoB;oBACtB,CAAC,CAAC,MAAM;aACX;SACF,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,WAAW,CACvB,OAA2B;QAE3B,iDAAiD;QACjD,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE;YACnD,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW;SACzC,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,KAAK,KAAK,EAAE;YACtC,2CAA2C;YAC3C,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;SAClE;QACD,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,KAAK,UAAU,EAAE;YAClD,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;SAChD;QACD,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE;YAC1C,MAAM,aAAa,GAAG,MAAM,qBAAqB,EAAE,CAAC;YACpD,OAAO,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;SACrC;QACD,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,KAAK,QAAQ,EAAE;YACzD,MAAM,KAAK,GAAG,IAAA,qBAAK,EAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE;gBACnE,KAAK,EAAE,IAAI;gBACX,KAAK,EAAE,QAAQ;gBACf,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;aACxE,CAAC,CAAC;YACH,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,OAAO,KAAK,CAAC;SACd;QACD,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAC5B,qBAA4C;QAE5C,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE;YAClC,uBAAuB;YACvB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;SAClE;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;QAC3D,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,CAAC;IAC7D,CAAC;IAEO,aAAa,CACnB,KAAwB,EACxB,QAAkB,EAClB,MAAc;QAEd,KAAK,CAAC,eAAe,GAAG;YACtB,GAAG,EAAE,QAAQ;YACb,UAAU,EAAE,KAAK,IAAI,EAAE;gBACrB,yDAAyD;gBACzD,cAAc;gBACd,IAAI,KAAK,CAAC,eAAe,EAAE,GAAG,KAAK,QAAQ;oBAAE,OAAO,KAAK,CAAC;gBAC1D,IAAI;oBACF,MAAM,eAAe,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;oBACvD,wCAAwC;oBACxC,IAAI,KAAK,CAAC,eAAe,EAAE,GAAG,KAAK,QAAQ,EAAE;wBAC3C,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC;wBACnD,OAAO,IAAI,CAAC;qBACb;iBACF;gBAAC,OAAO,GAAY,EAAE;oBACrB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE;wBACrD,KAAK,EAAE,IAAA,kBAAW,EAAC,GAAG,CAAC;qBACxB,CAAC,CAAC;iBACJ;gBACD,OAAO,KAAK,CAAC;YACf,CAAC;SACF,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,qBAAqB,CACjC,KAAwB,EACxB,MAAmB;QAEnB,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,GACzC,IAAI,CAAC,mCAAmC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAErE,MAAM,YAAY,GAAG,0BAAU,CAAC,YAAY,EAAE,CAAC;QAC/C,MAAM,aAAa,GAAG,0BAAU,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAE7D,IAAI,MAAM,GAAG,IAAI,sBAAM,CAAC,YAAY,CAAC,CAAC;QACtC,IAAI,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAE7C,MAAM,cAAc,GAAG,CAAC,MAAM,IAAA,gBAAS,EAAC,oBAAW,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC1E,MAAM,MAAM,GAAG,IAAI,wCAAiB,CAAC;YACnC,WAAW,EAAE,IAAI,CAAC,cAAc,EAAE;YAClC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,4BAA4B,EAAE,IAAI,CAAC,OAAO,CAAC,4BAA4B;YACvE,cAAc;SACf,CAAC,CAAC;QACH,IAAI,SAAS,GAAG,EAAE,CAAC;QACnB,IAAI,cAAc,GAAG,IAAI,CAAC;QAE1B,IAAI;YACF,MAAM,IAAA,qBAAc,EAAC,MAAM,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,aAAa,EAAE,EAAE,EAAE;gBACpE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC;gBAErD,MAAM,eAAe,GAAG,MAAM,CAAC,gBAAgB,CAAC;oBAC9C,KAAK;oBACL,cAAc,EAAE,aAAa;oBAC7B,qBAAqB,EAAE,MAAM;oBAC7B,KAAK,EAAE,cAAc;iBACtB,CAAC,CAAC;gBACH,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,kBAAkB,EAAE,GAChD,MAAM,MAAM,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC;gBAE5C,WAAW,EAAE,CAAC;gBAEd,oEAAoE;gBACpE,qEAAqE;gBACrE,mCAAmC;gBACnC,MAAM,mBAAmB,GAAG,IAAI,OAAO,CAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;oBACjE,IAAI,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;yBACxC,IAAI,CAAC,CAAC,aAAa,EAAE,EAAE;wBACtB,aAAa,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;wBACnD,aAAa,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;4BACnC,IAAI,IAAI,KAAK,CAAC;gCACZ,MAAM,CACJ,IAAI,wBAAgB,CAClB,yCAAyC,IAAI,EAAE,CAChD,CACF,CAAC;wBACN,CAAC,CAAC,CAAC;oBACL,CAAC,CAAC;yBACD,KAAK,CAAC,MAAM,CAAC,CAAC;gBACnB,CAAC,CAAC,CAAC;gBAEH,MAAM,OAAO,GAAmB,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;oBAC9D,IAAI,IAAI,CAAC,OAAO,CAAC,kBAAkB,KAAK,CAAC,EAAE;wBACzC,UAAU,CACR,MAAM,EACN,IAAI,CAAC,OAAO,CAAC,kBAAkB,IAAI,gCAA0B,EAC7D,IAAI,wBAAgB,CAAC,2BAA2B,CAAC,CAClD,CAAC,KAAK,EAAE,CAAC;qBACX;gBACH,CAAC,CAAC,CAAC;gBAEH,mBAAmB,CAAC,KAAK,CAAC,GAAG,EAAE;oBAC7B,8CAA8C;gBAChD,CAAC,CAAC,CAAC;gBACH,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE;oBACjB,WAAW;gBACb,CAAC,CAAC,CAAC;gBACH,MAAM,OAAO,CAAC,IAAI,CAAC;oBACjB,kBAAkB;oBAClB,OAAO;oBACP,mBAAmB;oBACnB,aAAa;iBACd,CAAC,CAAC;gBACH,qEAAqE;gBACrE,gEAAgE;gBAChE,sEAAsE;gBACtE,gEAAgE;gBAChE,wBAAwB;gBACxB,cAAc,GAAG,KAAK,CAAC;gBAEvB,SAAS,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;YACjE,CAAC,CAAC,CAAC;YACH,8DAA8D;SAC/D;QAAC,OAAO,GAAQ,EAAE;YACjB,qEAAqE;YACrE,8CAA8C;YAC9C,IAAI,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE;gBAC5B,GAAG,CAAC,eAAe,CAAC,GAAG,cAAc,CAAC;aACvC;YACD,MAAM,GAAG,CAAC;SACX;gBAAS;YACR,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;SACtB;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QAChD,uEAAuE;QACvE,uEAAuE;QACvE,yEAAyE;QACzE,2CAA2C;QAC3C,YAAY,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,GAAG,IAAI,sBAAM,CAAC,YAAY,CAAC,CAAC;QAClC,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACzC,MAAM,CAAC,eAAe,GAAG,GAAG,EAAE;YAC5B,oEAAoE;YACpE,iEAAiE;YACjE,gEAAgE;YAChE,2EAA2E;YAC3E,EAAE;YACF,4FAA4F;YAC5F,EAAE;YACF,oEAAoE;YACpE,mEAAmE;YACnE,4EAA4E;YAC5E,wEAAwE;QAC1E,CAAC,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE;YACpE,aAAa,EAAE,YAAY;YAC3B,KAAK,EAAE,cAAc;SACtB,CAAC,CAAC;QACH,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IAEO,KAAK,CAAC,uBAAuB,CACnC,KAAwB,EACxB,MAAmB;QAEnB,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,GACzC,IAAI,CAAC,mCAAmC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAErE,MAAM,MAAM,GAAG,IAAI,sBAAM,CAAC,YAAY,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAE/C,MAAM,CAAC,eAAe,GAAG,GAAG,EAAE;YAC5B,eAAe;QACjB,CAAC,CAAC;QACF,MAAM,IAAA,qBAAc,EAAC,MAAM,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,aAAa,EAAE,EAAE,EAAE;YACpE,MAAM,gBAAgB,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;gBAC1C,MAAM,CAAC,mBAAmB,CAAC;oBACzB,SAAS,EAAE,YAAY,CAAC,SAAS;oBACjC,KAAK;iBACN,CAAC;gBACF,aAAa;aACd,CAAC,CAAC;YAEH,WAAW,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,gBAAgB,CAAC;gBAC1B,QAAQ,EAAE,gBAAgB,CAAC,SAAS;gBACpC,eAAe,EAAE,gBAAgB,CAAC,gBAAgB;aACnD,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;YACzD,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAC/B,KAAwB,EACxB,iBAAmC;QAEnC,IAAA,qBAAc,EAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACpC,IAAA,qBAAc,EAAC,iBAAiB,CAAC,CAAC;QAElC,MAAM,uBAAuB,GAAG,IAAI,sBAAe,EAAE,CAAC;QACtD,MAAM,cAAc,GAAG,GAAG,EAAE;YAC1B,wDAAwD;YACxD,uBAAuB,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5D,CAAC,CAAC;QACF,MAAM,aAAa,GAAG,GAAG,EAAE;YACzB,wDAAwD;YACxD,uBAAuB,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC1D,CAAC,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAC/D,iBAAiB,EAAE,gBAAgB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,uBAAuB,CAAC,MAAM,CAAC;QAE9C,IAAI;YACF,UAAU,EAAE;gBACV,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,GAAG,EAAE,UAAU,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE;oBAC1D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uCAAuC,EAAE;wBACxD,MAAM,EAAE,aAAa;qBACtB,CAAC,CAAC;oBACH,MAAM,UAAU,CAAC;iBAClB;gBACD,IAAI,MAAM,KAAK,CAAC,eAAe,EAAE,UAAU,EAAE,EAAE,EAAE;oBAC/C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uCAAuC,EAAE;wBACxD,MAAM,EAAE,mBAAmB;qBAC5B,CAAC,CAAC;oBACH,MAAM,UAAU,CAAC;iBAClB;gBACD,KAAK,CAAC,eAAe,GAAG,IAAI,CAAC;gBAC7B,IAAI,KAAK,CAAC;gBACV,IAAI,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE;oBACnC,IAAI;wBACF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0CAA0C,EAAE;4BAC3D,IAAI,EAAE,WAAW;yBAClB,CAAC,CAAC;wBACH,MAAM,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;wBAChD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;wBAC/D,MAAM,UAAU,CAAC;qBAClB;oBAAC,OAAO,GAAY,EAAE;wBACrB,KAAK,GAAG,GAAG,CAAC;wBACZ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE;4BAC1D,KAAK,EAAE,IAAA,kBAAW,EAAC,GAAG,CAAC;yBACxB,CAAC,CAAC;wBACH,8DAA8D;wBAC9D,IAAI,CAAE,GAAW,EAAE,CAAC,eAAe,CAAC;4BAAE,MAAM,GAAG,CAAC;qBACjD;iBACF;gBACD,IAAI,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,EAAE;oBACrC,IAAI;wBACF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0CAA0C,EAAE;4BAC3D,IAAI,EAAE,aAAa;yBACpB,CAAC,CAAC;wBACH,MAAM,IAAI,CAAC,uBAAuB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;wBAClD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;wBAC/D,MAAM,UAAU,CAAC;qBAClB;oBAAC,OAAO,GAAY,EAAE;wBACrB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE;4BAC1D,KAAK,EAAE,IAAA,kBAAW,EAAC,GAAG,CAAC;yBACxB,CAAC,CAAC;wBACH,MAAM,GAAG,CAAC;qBACX;iBACF;gBACD,IAAI,KAAK;oBAAE,MAAM,KAAK,CAAC;aACxB;YAED,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,GAAG,EAAE,YAAY,EAAE;gBAC7C,MAAM,IAAI,wBAAgB,CAAC,uCAAuC,CAAC,CAAC;aACrE;SACF;QAAC,OAAO,GAAY,EAAE;YACrB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE;gBAClD,KAAK,EAAE,IAAA,kBAAW,EAAC,GAAG,CAAC;aACxB,CAAC,CAAC;YACH,MAAM,GAAG,CAAC;SACX;gBAAS;YACR,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;YAClE,iBAAiB,EAAE,mBAAmB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;SAChE;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE;YACrD,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,aAAa;YAC1D,SAAS,EAAE,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU;gBAC7C,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;gBACrE,CAAC,CAAC,IAAI;SACT,CAAC,CAAC;QAEH,OAAO;YACL,WAAW,EAAE,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,YAAY;YACnD,YAAY,EAAE,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,aAAa;YACrD,6EAA6E;YAC7E,8EAA8E;YAC9E,sEAAsE;YACtE,6EAA6E;YAC7E,8DAA8D;YAC9D,uBAAuB;YACvB,4EAA4E;YAC5E,4CAA4C;YAC5C,gBAAgB,EAAE,CAAC;SACpB,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,YAAY,CACvB,aAAiC,EACjC,cAAwC,EACxC,iBAA4C;QAE5C,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;QAE/D,IAAI,KAAK,CAAC,kBAAkB,EAAE;YAC5B,OAAO,MAAM,KAAK,CAAC,kBAAkB,CAAC;SACvC;QAED,mEAAmE;QACnE,+DAA+D;QAC/D,wEAAwE;QACxE,qCAAqC;QACrC,IAAI,OAAO,iBAAiB,KAAK,QAAQ,EAAE;YACzC,iBAAiB,GAAG,IAAA,oBAAa,EAAC,iBAAiB,CAAC,CAAC;SACtD;QAED,MAAM,cAAc,GAAG,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QAC1E,KAAK,CAAC,kBAAkB,GAAG,cAAc,CAAC;QAC1C,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE;YAC1B,IAAI,KAAK,CAAC,kBAAkB,KAAK,cAAc;gBAC7C,KAAK,CAAC,kBAAkB,GAAG,IAAI,CAAC;QACpC,CAAC,CAAC,CAAC;QACH,OAAO,cAAc,CAAC;IACxB,CAAC;IAEM,KAAK,CAAC,YAAY,CACvB,aAAiC,EACjC,cAAwC;IACxC,6DAA6D;IAC7D,cAAsC,EACtC,iBAA4C;QAE5C,OAAO,MAAM,IAAI,CAAC,YAAY,CAC5B,aAAa,EACb,cAAc,EACd,iBAAiB,CAClB,CAAC;IACJ,CAAC;CACF;AA5dD,sDA4dC"}

package/dist/rfc-8252-http-server.d.ts

@@ -0,0 +1,68 @@
+import type { MongoDBOIDCLogEventsMap, OIDCAbortSignal, TypedEventEmitter } from './types';
+import type { RedirectServerRequestHandler } from './api';
+export interface RFC8252HTTPServerOptions {
+    redirectUrl: string;
+    oidcStateParam: string;
+    logger?: TypedEventEmitter<MongoDBOIDCLogEventsMap>;
+    redirectServerRequestHandler?: RedirectServerRequestHandler;
+}
+/** @internal */
+export declare class RFC8252HTTPServer {
+    private readonly redirectUrl;
+    private readonly oidcStateParam;
+    private readonly redirectServerHandler;
+    private readonly logger;
+    private servers;
+    private readonly expressApp;
+    private readonly redirects;
+    private readonly oidcParamsPromise;
+    private oidcParamsResolve?;
+    private oidcParamsReject?;
+    private oidcParams;
+    constructor(options: RFC8252HTTPServerOptions);
+    private _handleSuccess;
+    private _handleRedirectToExternal;
+    private _handleOIDCCallback;
+    private _fallbackHandler;
+    /**
+     * Add a redirect from a local URL served on the server to an external URL.
+     */
+    addRedirect(targetUrl: string): Promise<{
+        localUrl: string;
+        onAccessed: Promise<void>;
+    }>;
+    /**
+     * Returns the port that this server is listening on if
+     * listen() was successfully called and undefined otherwise.
+     */
+    get listeningPort(): number | undefined;
+    /**
+     * Returns the full redirectURL passed to the constructor, with
+     * a possible unspecified port resolved to the actual port,
+     * or undefined if this server is not listening.
+     */
+    get listeningRedirectUrl(): string | undefined;
+    /**
+     * Create HTTP servers and listen on them corresponding to the redirect URL
+     * provided to the constructor.
+     */
+    listen(): Promise<void>;
+    private createServerAndListen;
+    /**
+     * Returns the OIDC params as the full URL used to access them
+     * (regardless of whether OIDC params were passed as URL params or not)
+     */
+    waitForOIDCParams(): Promise<string>;
+    /**
+     * Close all resources associated with this server.
+     */
+    close(): Promise<void>;
+    /**
+     * Convenience method to wait until a single successful OIDC parameter
+     * request is received or abort early, and close the server in any case.
+     */
+    waitForOIDCParamsAndClose({ signal, }?: {
+        signal?: OIDCAbortSignal;
+    }): Promise<string>;
+}
+//# sourceMappingURL=rfc-8252-http-server.d.ts.map

package/dist/rfc-8252-http-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rfc-8252-http-server.d.ts","sourceRoot":"","sources":["../src/rfc-8252-http-server.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EACV,uBAAuB,EACvB,eAAe,EACf,iBAAiB,EAClB,MAAM,SAAS,CAAC;AAIjB,OAAO,KAAK,EACV,4BAA4B,EAE7B,MAAM,OAAO,CAAC;AAIf,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,iBAAiB,CAAC,uBAAuB,CAAC,CAAC;IACpD,4BAA4B,CAAC,EAAE,4BAA4B,CAAC;CAC7D;AAED,gBAAgB;AAChB,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAM;IAClC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAA+B;IACrE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6C;IACpE,OAAO,CAAC,OAAO,CAAoB;IACnC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA6B;IACxD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAGtB;IAIJ,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAkB;IACpD,OAAO,CAAC,iBAAiB,CAAC,CAA2B;IACrD,OAAO,CAAC,gBAAgB,CAAC,CAAoC;IAG7D,OAAO,CAAC,UAAU,CAAqB;gBAE3B,OAAO,EAAE,wBAAwB;IAqC7C,OAAO,CAAC,cAAc,CAcpB;IAEF,OAAO,CAAC,yBAAyB,CAiB/B;IAEF,OAAO,CAAC,mBAAmB,CAmHzB;IAEF,OAAO,CAAC,gBAAgB,CAYtB;IAEF;;OAEG;IACU,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QACnD,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;KAC3B,CAAC;IAgBF;;;OAGG;IACH,IAAW,aAAa,IAAI,MAAM,GAAG,SAAS,CAa7C;IAED;;;;OAIG;IACH,IAAW,oBAAoB,IAAI,MAAM,GAAG,SAAS,CAMpD;IAED;;;OAGG;IACU,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IA6GpC,OAAO,CAAC,qBAAqB;IAoB7B;;;OAGG;IACU,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC;IAIjD;;OAEG;IACU,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAcnC;;;OAGG;IACU,yBAAyB,CAAC,EACrC,MAAM,GACP,GAAE;QACD,MAAM,CAAC,EAAE,eAAe,CAAC;KACrB,GAAG,OAAO,CAAC,MAAM,CAAC;CASzB"}