@nocobase/app-plugin-api-keys 0.0.0-stage → 1.0.0-beta.13

package/dist/server/key-sessions.js

@@ -0,0 +1,50 @@
+import { ApiError, apiErrorHandler } from '@nocobase/app-server/router';
+/** The header a key arrives in; Better Auth's default `apiKeyHeaders`. */
+export const API_KEY_HEADER = 'x-api-key';
+/** The Better Auth endpoints no API key may reach, whatever its scope: every `/api-key/*` endpoint. */
+export const KEY_MANAGEMENT_PATH_PREFIXES = ['/api-key/'];
+/** Whether a Better Auth endpoint path manages API keys. */
+export function isKeyManagementPath(path) {
+    return KEY_MANAGEMENT_PATH_PREFIXES.some((prefix) => path.startsWith(prefix));
+}
+/**
+ * Whether a session was made from an API key: Better Auth's key session carries the key as its token, which a
+ * sign-in session never matches.
+ */
+export function isApiKeySession(session, headers, headerNames = [API_KEY_HEADER]) {
+    return headerNames.some((name) => {
+        const key = headers.get(name);
+        return Boolean(key) && session.session.token === key;
+    });
+}
+/**
+ * The Better Auth endpoints that review, approve or deny a device authorization (`deviceAuthorization()`): approving
+ * issues the device a session, so no API key reaches them.
+ */
+export const DEVICE_APPROVAL_PATHS = [
+    '/device',
+    '/device/approve',
+    '/device/deny',
+];
+/** Whether a Better Auth endpoint path reviews, approves or denies a device authorization. */
+export function isDeviceApprovalPath(path) {
+    return DEVICE_APPROVAL_PATHS.includes(path);
+}
+/**
+ * Refuses a request whose session came from an API key with 403 `API_KEY_SESSION_FORBIDDEN`. Install after
+ * `auth.required()` on every route that manages keys, a service account's included.
+ */
+export function requireSignInSession() {
+    return async (context, next) => {
+        const auth = context.get('auth');
+        if (auth && isApiKeySession(auth, context.req.raw.headers))
+            return apiErrorHandler(new ApiError({
+                status: 'PERMISSION_DENIED',
+                reason: 'API_KEY_SESSION_FORBIDDEN',
+                domain: 'apiKeys',
+                message: 'API keys are managed only from a signed-in session.',
+            }), context);
+        await next();
+    };
+}
+//# sourceMappingURL=key-sessions.js.map

package/dist/server/key-sessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-sessions.js","sourceRoot":"","sources":["../../server/key-sessions.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAGxE,0EAA0E;AAC1E,MAAM,CAAC,MAAM,cAAc,GAAG,WAAW,CAAC;AAE1C,uGAAuG;AACvG,MAAM,CAAC,MAAM,4BAA4B,GAAsB,CAAC,WAAW,CAAC,CAAC;AAE7E,4DAA4D;AAC5D,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,4BAA4B,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AAChF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAyD,EACzD,OAAgB,EAChB,cAAiC,CAAC,cAAc,CAAC;IAEjD,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QAC/B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9B,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,KAAK,GAAG,CAAC;IACvD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAsB;IACtD,SAAS;IACT,iBAAiB;IACjB,cAAc;CACf,CAAC;AAEF,8FAA8F;AAC9F,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,OAAO,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,IAAI,IAAI,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC;YACxD,OAAO,eAAe,CACpB,IAAI,QAAQ,CAAC;gBACX,MAAM,EAAE,mBAAmB;gBAC3B,MAAM,EAAE,2BAA2B;gBACnC,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE,qDAAqD;aAC/D,CAAC,EACF,OAAO,CACR,CAAC;QACJ,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}

package/dist/server/plugin.d.ts

@@ -0,0 +1,4 @@
+import { type AppServerPlugin } from '@nocobase/app-server/plugins';
+declare const apiKeysPlugin: AppServerPlugin;
+export default apiKeysPlugin;
+//# sourceMappingURL=plugin.d.ts.map

package/dist/server/plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../server/plugin.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,8BAA8B,CAAC;AAKtC,QAAA,MAAM,aAAa,EAAE,eAQnB,CAAC;AAEH,eAAe,aAAa,CAAC"}

package/dist/server/plugin.js

@@ -0,0 +1,15 @@
+import path from 'node:path';
+import { defineServerPlugin, } from '@nocobase/app-server/plugins';
+import serviceProviders from './providers/index.js';
+import routes from './routes/index.js';
+const apiKeysPlugin = defineServerPlugin({
+    baseDir: path.resolve(import.meta.dirname, '..'),
+    packageName: '@nocobase/app-plugin-api-keys',
+    serviceProviders,
+    routes,
+    database: {
+        migrations: './database/migrations',
+    },
+});
+export default apiKeysPlugin;
+//# sourceMappingURL=plugin.js.map

package/dist/server/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../server/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EACL,kBAAkB,GAEnB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,gBAAgB,MAAM,sBAAsB,CAAC;AACpD,OAAO,MAAM,MAAM,mBAAmB,CAAC;AAEvC,MAAM,aAAa,GAAoB,kBAAkB,CAAC;IACxD,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC;IAChD,WAAW,EAAE,+BAA+B;IAC5C,gBAAgB;IAChB,MAAM;IACN,QAAQ,EAAE;QACR,UAAU,EAAE,uBAAuB;KACpC;CACF,CAAC,CAAC;AAEH,eAAe,aAAa,CAAC"}

package/dist/server/providers/index.d.ts

@@ -0,0 +1,19 @@
+import type { AppPluginApplication, AppPluginProviderConstructor } from '@nocobase/app-server/plugins';
+import { ServiceProvider } from '@nocobase/service-provider';
+/**
+ * Binds the key-scope registry and the scoped-key service, and at boot teaches authentication and authorization to
+ * recognize a scoped key: `auth.required()` refuses one unless the route opts in, and the authorization identity of a
+ * request made with one carries its `keyScope`. Also lets a request carrying a valid API key read the application's API
+ * documentation, and adds the API key header to the document as a security scheme.
+ */
+export declare class ApiKeysProvider extends ServiceProvider<AppPluginApplication> {
+    readonly name: string;
+    private readonly releases;
+    private booted;
+    register(): void;
+    boot(): Promise<void>;
+    shutdown(): Promise<void>;
+}
+export declare const serviceProviders: readonly AppPluginProviderConstructor[];
+export default serviceProviders;
+//# sourceMappingURL=index.d.ts.map

package/dist/server/providers/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../server/providers/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,oBAAoB,EACpB,4BAA4B,EAC7B,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAc7D;;;;;GAKG;AACH,qBAAa,eAAgB,SAAQ,eAAe,CAAC,oBAAoB,CAAC;IACxE,SAAgB,IAAI,EAAE,MAAM,CAAmC;IAC/D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAsB;IAC/C,OAAO,CAAC,MAAM,CAAS;IAEP,QAAQ,IAAI,IAAI;IAmBV,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAuC3B,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAI1C;AAED,eAAO,MAAM,gBAAgB,EAAE,SAAS,4BAA4B,EAEnE,CAAC;AAEF,eAAe,gBAAgB,CAAC"}

package/dist/server/providers/index.js

@@ -0,0 +1,72 @@
+import { authenticationToken } from '@nocobase/app-plugin-authentication/server';
+import { authorizationToken } from '@nocobase/app-plugin-authorization';
+import { apiDocsToken } from '@nocobase/app-server/router';
+import { databaseManagerToken } from '@nocobase/db';
+import { ServiceProvider } from '@nocobase/service-provider';
+import { createApiKeyApiDocsAccess, createApiKeySecurityFragment, } from '../api-docs.js';
+import { connectOwnKeyPolicy, ScopedApiKeys, } from '../scoped-keys.js';
+import { apiKeyScopesToken, createApiKeyScopes } from '../scopes.js';
+import { scopedApiKeysToken } from '../tokens.js';
+/**
+ * Binds the key-scope registry and the scoped-key service, and at boot teaches authentication and authorization to
+ * recognize a scoped key: `auth.required()` refuses one unless the route opts in, and the authorization identity of a
+ * request made with one carries its `keyScope`. Also lets a request carrying a valid API key read the application's API
+ * documentation, and adds the API key header to the document as a security scheme.
+ */
+export class ApiKeysProvider extends ServiceProvider {
+    name = '@nocobase/app-plugin-api-keys';
+    releases = [];
+    booted = false;
+    register() {
+        const { container } = this.app;
+        container.singleton(apiKeyScopesToken, () => createApiKeyScopes());
+        container.singleton(scopedApiKeysToken, (resolver) => new ScopedApiKeys({
+            auth: resolver.resolve(authenticationToken),
+            connection: () => resolver.resolve(databaseManagerToken).connection(),
+            scopes: resolver.resolve(apiKeyScopesToken),
+            authorization: () => container.has(authorizationToken)
+                ? resolver.resolve(authorizationToken)
+                : undefined,
+            config: () => this.app.config.get('apiKeys'),
+        }));
+    }
+    async boot() {
+        const { container } = this.app;
+        if (this.booted ||
+            !container.has(authenticationToken) ||
+            !container.has(databaseManagerToken))
+            return;
+        this.booted = true;
+        if (container.has(apiDocsToken)) {
+            const apiDocs = container.resolve(apiDocsToken);
+            const resolveAuth = () => container.resolve(authenticationToken);
+            apiDocs.addAccess(createApiKeyApiDocsAccess(resolveAuth));
+            // Resolved on the first request for the document, like the access check, so starting the application builds nothing.
+            apiDocs.addFragment(() => createApiKeySecurityFragment(resolveAuth));
+        }
+        const keys = container.resolve(scopedApiKeysToken);
+        const auth = container.resolve(authenticationToken);
+        this.releases.push(await connectOwnKeyPolicy(auth, keys));
+        this.releases.push(auth.addScopedCredentialCheck(async (session, request) => (await keys.resolve(session, request)) !== null));
+        if (container.has(authorizationToken))
+            container.resolve(authorizationToken).use(async (request, next) => {
+                const session = request.http.get('auth');
+                if (session && typeof session === 'object' && 'session' in session) {
+                    const scope = await keys.resolve(session, request.http.req.raw);
+                    if (scope)
+                        request.keyScope = scope;
+                }
+                await next();
+            });
+    }
+    shutdown() {
+        for (const release of this.releases.splice(0))
+            release();
+        return Promise.resolve();
+    }
+}
+export const serviceProviders = [
+    ApiKeysProvider,
+];
+export default serviceProviders;
+//# sourceMappingURL=index.js.map

package/dist/server/providers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../server/providers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAC;AACjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAKxE,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAE7D,OAAO,EACL,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,mBAAmB,EACnB,aAAa,GAEd,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAElD;;;;;GAKG;AACH,MAAM,OAAO,eAAgB,SAAQ,eAAqC;IACxD,IAAI,GAAW,+BAA+B,CAAC;IAC9C,QAAQ,GAAmB,EAAE,CAAC;IACvC,MAAM,GAAG,KAAK,CAAC;IAEP,QAAQ;QACtB,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC;QAC/B,SAAS,CAAC,SAAS,CAAC,iBAAiB,EAAE,GAAG,EAAE,CAAC,kBAAkB,EAAE,CAAC,CAAC;QACnE,SAAS,CAAC,SAAS,CACjB,kBAAkB,EAClB,CAAC,QAAQ,EAAE,EAAE,CACX,IAAI,aAAa,CAAC;YAChB,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,mBAAmB,CAAC;YAC3C,UAAU,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,UAAU,EAAE;YACrE,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,iBAAiB,CAAC;YAC3C,aAAa,EAAE,GAAG,EAAE,CAClB,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC;gBAC/B,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,kBAAkB,CAAC;gBACtC,CAAC,CAAC,SAAS;YACf,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAgB,SAAS,CAAC;SAC5D,CAAC,CACL,CAAC;IACJ,CAAC;IAEe,KAAK,CAAC,IAAI;QACxB,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC;QAC/B,IACE,IAAI,CAAC,MAAM;YACX,CAAC,SAAS,CAAC,GAAG,CAAC,mBAAmB,CAAC;YACnC,CAAC,SAAS,CAAC,GAAG,CAAC,oBAAoB,CAAC;YAEpC,OAAO;QACT,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YAChC,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YAChD,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;YACjE,OAAO,CAAC,SAAS,CAAC,yBAAyB,CAAC,WAAW,CAAC,CAAC,CAAC;YAC1D,qHAAqH;YACrH,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,4BAA4B,CAAC,WAAW,CAAC,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;QACpD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QAC1D,IAAI,CAAC,QAAQ,CAAC,IAAI,CAChB,IAAI,CAAC,wBAAwB,CAC3B,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CACzB,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,KAAK,IAAI,CAClD,CACF,CAAC;QACF,IAAI,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC;YACnC,SAAS,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;gBAChE,MAAM,OAAO,GAAY,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAe,CAAC,CAAC;gBAC3D,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,SAAS,IAAI,OAAO,EAAE,CAAC;oBACnE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAC9B,OAA6C,EAC7C,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CACrB,CAAC;oBACF,IAAI,KAAK;wBAAE,OAAO,CAAC,QAAQ,GAAG,KAAK,CAAC;gBACtC,CAAC;gBACD,MAAM,IAAI,EAAE,CAAC;YACf,CAAC,CAAC,CAAC;IACP,CAAC;IAEe,QAAQ;QACtB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YAAE,OAAO,EAAE,CAAC;QACzD,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,CAAC,MAAM,gBAAgB,GAA4C;IACvE,eAAe;CAChB,CAAC;AAEF,eAAe,gBAAgB,CAAC"}

package/dist/server/routes/errors.d.ts

@@ -0,0 +1,8 @@
+/** The error domain of the API keys plugin: its URL namespace. */
+export declare const API_KEYS_ERROR_DOMAIN = "apiKeys";
+/**
+ * The plugin's own errors as `ApiError`, domain `apiKeys`, with their code as the reason; anything else is returned
+ * unchanged for `apiErrorHandler`. Exported so an application's own key routes answer the same way.
+ */
+export declare function toApiKeysApiError(error: unknown): unknown;
+//# sourceMappingURL=errors.d.ts.map

package/dist/server/routes/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../server/routes/errors.ts"],"names":[],"mappings":"AAKA,kEAAkE;AAClE,eAAO,MAAM,qBAAqB,YAAY,CAAC;AAe/C;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAwBzD"}

package/dist/server/routes/errors.js

@@ -0,0 +1,48 @@
+import { ApiError } from '@nocobase/app-server/router';
+import { ApiKeyRequestError } from '../scoped-keys.js';
+import { ApiKeyScopeError } from '../scopes.js';
+/** The error domain of the API keys plugin: its URL namespace. */
+export const API_KEYS_ERROR_DOMAIN = 'apiKeys';
+const FIELD_OF = {
+    EXPIRY_REQUIRED: 'expiresInDays',
+    INVALID_EXPIRY: 'expiresInDays',
+};
+function statusOf(error) {
+    if (error.status === 403)
+        return 'PERMISSION_DENIED';
+    if (error.status === 404)
+        return 'NOT_FOUND';
+    return error.code === 'KEY_NOT_SCOPED'
+        ? 'FAILED_PRECONDITION'
+        : 'INVALID_ARGUMENT';
+}
+/**
+ * The plugin's own errors as `ApiError`, domain `apiKeys`, with their code as the reason; anything else is returned
+ * unchanged for `apiErrorHandler`. Exported so an application's own key routes answer the same way.
+ */
+export function toApiKeysApiError(error) {
+    if (error instanceof ApiKeyScopeError)
+        return new ApiError({
+            status: 'INVALID_ARGUMENT',
+            reason: error.code,
+            domain: API_KEYS_ERROR_DOMAIN,
+            message: error.message,
+            fieldViolations: [{ field: 'scope', description: error.message }],
+            cause: error,
+        });
+    if (error instanceof ApiKeyRequestError) {
+        const field = FIELD_OF[error.code];
+        return new ApiError({
+            status: statusOf(error),
+            reason: error.code,
+            domain: API_KEYS_ERROR_DOMAIN,
+            message: error.message,
+            ...(field
+                ? { fieldViolations: [{ field, description: error.message }] }
+                : {}),
+            cause: error,
+        });
+    }
+    return error;
+}
+//# sourceMappingURL=errors.js.map

package/dist/server/routes/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../server/routes/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAuB,MAAM,6BAA6B,CAAC;AAE5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhD,kEAAkE;AAClE,MAAM,CAAC,MAAM,qBAAqB,GAAG,SAAS,CAAC;AAE/C,MAAM,QAAQ,GAAqC;IACjD,eAAe,EAAE,eAAe;IAChC,cAAc,EAAE,eAAe;CAChC,CAAC;AAEF,SAAS,QAAQ,CAAC,KAAyB;IACzC,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,mBAAmB,CAAC;IACrD,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,WAAW,CAAC;IAC7C,OAAO,KAAK,CAAC,IAAI,KAAK,gBAAgB;QACpC,CAAC,CAAC,qBAAqB;QACvB,CAAC,CAAC,kBAAkB,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,IAAI,KAAK,YAAY,gBAAgB;QACnC,OAAO,IAAI,QAAQ,CAAC;YAClB,MAAM,EAAE,kBAAkB;YAC1B,MAAM,EAAE,KAAK,CAAC,IAAI;YAClB,MAAM,EAAE,qBAAqB;YAC7B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,eAAe,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;YACjE,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,IAAI,KAAK,YAAY,kBAAkB,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,OAAO,IAAI,QAAQ,CAAC;YAClB,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC;YACvB,MAAM,EAAE,KAAK,CAAC,IAAI;YAClB,MAAM,EAAE,qBAAqB;YAC7B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,CAAC,KAAK;gBACP,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE;gBAC9D,CAAC,CAAC,EAAE,CAAC;YACP,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/server/routes/index.d.ts

@@ -0,0 +1,10 @@
+import type { AppPluginApplication } from '@nocobase/app-server/plugins';
+import { type AppApiRouteContribution, type AppRouteContribution } from '@nocobase/app-server/router';
+/**
+ * `/api/apiKeys`: a person's own keys, with or without a scope. Self-service: every endpoint acts on the caller's
+ * keys only, and only from a sign-in: a request made with any API key is refused (`requireSignInSession`).
+ */
+export declare const apiRoutes: AppApiRouteContribution<AppPluginApplication>;
+declare const routes: readonly AppRouteContribution<AppPluginApplication>[];
+export default routes;
+//# sourceMappingURL=index.d.ts.map

package/dist/server/routes/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../server/routes/index.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,EAWL,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EAC1B,MAAM,6BAA6B,CAAC;AAqCrC;;;GAGG;AACH,eAAO,MAAM,SAAS,EAAE,uBAAuB,CAAC,oBAAoB,CA+MhE,CAAC;AAEL,QAAA,MAAM,MAAM,EAAE,SAAS,oBAAoB,CAAC,oBAAoB,CAAC,EAEhE,CAAC;AAEF,eAAe,MAAM,CAAC"}

package/dist/server/routes/index.js

@@ -0,0 +1,177 @@
+import { authenticationToken } from '@nocobase/app-plugin-authentication/server';
+import { authorizationToken, } from '@nocobase/app-plugin-authorization';
+import { apiErrorHandler, apiErrorResponse, apiErrorResponses, apiValidator, cliRoute, dataResponse, defineApiRoutes, describeRoute, emptyResponse, listResponse, } from '@nocobase/app-server/router';
+import { Hono } from 'hono';
+import { requireSignInSession } from '../key-sessions.js';
+import { scopedApiKeysToken } from '../tokens.js';
+import { toApiKeysApiError } from './errors.js';
+import { ApiKeyParams, ApiKeysListMeta, ApiKeyViewSchema, CreateApiKeyInput, CreatedApiKeySchema, KeyScopeObjectSchema, KeyScopeOptionsSchema, ScopeGroupParams, ScopeObjectsQuery, } from './schemas.js';
+const tags = ['ApiKeys'];
+/** Every route refuses a request made with an API key: keys are managed from a sign-in. */
+const signInOnly = 'Takes a signed-in session: a request made with any API key is refused (`403`).';
+const keyNotFound = apiErrorResponse(404, 'The caller has no key with this id (`KEY_NOT_FOUND`).');
+const creationForbidden = apiErrorResponse(403, 'The caller may not use API keys or may not create keys of their own (`API_KEY_CREATION_FORBIDDEN`).');
+/**
+ * `/api/apiKeys`: a person's own keys, with or without a scope. Self-service: every endpoint acts on the caller's
+ * keys only, and only from a sign-in: a request made with any API key is refused (`requireSignInSession`).
+ */
+export const apiRoutes = defineApiRoutes(({ container }) => {
+    const router = new Hono();
+    if (!container.has(authenticationToken))
+        return router;
+    const keys = container.resolve(scopedApiKeysToken);
+    const routes = new Hono();
+    routes.onError((error, context) => apiErrorHandler(toApiKeysApiError(error), context));
+    routes.use('*', container.resolve(authenticationToken).required());
+    // Managing keys takes a sign-in: no key, scoped or not, creates, rotates or revokes keys.
+    routes.use('*', requireSignInSession());
+    if (container.has(authorizationToken))
+        routes.use('*', container.resolve(authorizationToken).middleware());
+    const userId = (context) => context.get('auth').user.id;
+    const identity = async (context) => context.get('authz')?.identity ??
+        (await keys.identityOf(userId(context)));
+    // Creating and rotating are refused before the input is read when the person may not create keys.
+    const mayCreate = async (context, next) => {
+        await keys.requireOwnCreation(userId(context));
+        await next();
+    };
+    routes.get('/scopeOptions', describeRoute({
+        tags,
+        summary: 'List what a scoped key may be limited to',
+        operationId: 'apiKeysListScopeOptions',
+        ...cliRoute({ command: 'api-key scope-options' }),
+        description: signInOnly,
+        responses: {
+            200: dataResponse(KeyScopeOptionsSchema),
+            ...apiErrorResponses,
+        },
+    }), async (context) => context.json({
+        data: {
+            ...(await keys.scopeOptions(userId(context))),
+            mayCreate: await keys.mayCreateOwn(userId(context)),
+        },
+    }));
+    // The records a person may pick for a group: bounded by what they see, and narrowed by `q` or `id`.
+    routes.get('/scopeObjects/:group', describeRoute({
+        tags,
+        summary: 'List the records a scope group may be limited to',
+        operationId: 'apiKeysListScopeObjects',
+        ...cliRoute({
+            command: 'api-key scope-objects',
+            columns: ['id', 'title', 'description'],
+            examples: ['api-key scope-objects pm.projects --q checkout'],
+        }),
+        description: `${signInOnly} Bounded by what the caller can see and narrowed by \`q\` or repeated \`id\`; not paged.`,
+        responses: {
+            200: listResponse(KeyScopeObjectSchema, ApiKeysListMeta),
+            ...apiErrorResponses,
+            404: apiErrorResponse(404, 'The scope group does not exist (`UNKNOWN_SCOPE_GROUP`).'),
+        },
+    }), apiValidator('param', ScopeGroupParams), apiValidator('query', ScopeObjectsQuery), async (context) => {
+        const { group } = context.req.valid('param');
+        const { q, id } = context.req.valid('query');
+        const data = await keys.scopeObjects(group, await identity(context), {
+            ...(q ? { search: q } : {}),
+            ...(id ? { ids: id } : {}),
+        });
+        return context.json({ data, meta: { total: data.length } });
+    });
+    // A person's own keys: a bounded list, not paged.
+    routes.get('/', describeRoute({
+        tags,
+        summary: 'List my API keys',
+        operationId: 'apiKeysListKeys',
+        ...cliRoute({
+            command: 'api-key list',
+            columns: [
+                'id',
+                'name',
+                'start',
+                'enabled',
+                'expiresAt',
+                'lastUsedAt',
+            ],
+        }),
+        description: `${signInOnly} Never returns a key's secret.`,
+        responses: {
+            200: listResponse(ApiKeyViewSchema, ApiKeysListMeta),
+            ...apiErrorResponses,
+        },
+    }), async (context) => {
+        const data = await keys.list(userId(context));
+        return context.json({ data, meta: { total: data.length } });
+    });
+    routes.post('/', mayCreate, describeRoute({
+        tags,
+        summary: 'Create an API key',
+        operationId: 'apiKeysCreateKey',
+        ...cliRoute({
+            command: 'api-key create',
+            examples: [
+                'api-key create --name ci --expires-in-days 90',
+                'api-key create --file key.json',
+            ],
+            bodyFile: 'file',
+        }),
+        description: `${signInOnly} The secret is in this response only. \`scope: null\` makes a key that acts as the caller in full.`,
+        responses: {
+            201: dataResponse(CreatedApiKeySchema, 'The created key.'),
+            ...apiErrorResponses,
+            403: creationForbidden,
+            400: apiErrorResponse(400, 'The expiry or the scope is not allowed (`EXPIRY_REQUIRED`, `INVALID_EXPIRY`, `INVALID_SCOPE`, `EMPTY_SCOPE`, `UNKNOWN_SCOPE_GROUP`, `SCOPE_LEVEL_NOT_OFFERED`, `SCOPE_OBJECTS_NOT_OFFERED`, `UNKNOWN_SCOPE_OBJECT`).'),
+        },
+    }), apiValidator('json', CreateApiKeyInput), async (context) => {
+        context.header('Cache-Control', 'no-store');
+        return context.json({
+            data: await keys.create(userId(context), context.req.valid('json'), await identity(context)),
+        }, 201);
+    });
+    routes.post('/:keyId/rotate', mayCreate, describeRoute({
+        tags,
+        summary: 'Rotate an API key',
+        operationId: 'apiKeysRotateKey',
+        ...cliRoute({
+            command: 'api-key rotate',
+            flags: { keyId: { name: 'key' } },
+            confirm: 'Rotate this key? The old secret stops working.',
+        }),
+        description: `${signInOnly} Replaces the key with a new secret, keeping its name, scope and lifetime; the old secret stops working.`,
+        responses: {
+            200: dataResponse(CreatedApiKeySchema),
+            ...apiErrorResponses,
+            403: creationForbidden,
+            404: keyNotFound,
+        },
+    }), apiValidator('param', ApiKeyParams), async (context) => {
+        context.header('Cache-Control', 'no-store');
+        return context.json({
+            data: await keys.rotate(userId(context), context.req.valid('param').keyId),
+        });
+    });
+    routes.delete('/:keyId', describeRoute({
+        tags,
+        summary: 'Revoke an API key',
+        operationId: 'apiKeysRevokeKey',
+        ...cliRoute({
+            command: 'api-key delete',
+            flags: { keyId: { name: 'key' } },
+            confirm: 'Revoke this key? Whatever uses it stops working.',
+        }),
+        description: signInOnly,
+        responses: {
+            204: emptyResponse('The key was revoked.'),
+            ...apiErrorResponses,
+            404: keyNotFound,
+        },
+    }), apiValidator('param', ApiKeyParams), async (context) => {
+        await keys.revoke(userId(context), context.req.valid('param').keyId);
+        return context.body(null, 204);
+    });
+    router.route('/apiKeys', routes);
+    return router;
+});
+const routes = [
+    apiRoutes,
+];
+export default routes;
+//# sourceMappingURL=index.js.map

package/dist/server/routes/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../server/routes/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAC;AACjF,OAAO,EACL,kBAAkB,GAEnB,MAAM,oCAAoC,CAAC;AAG5C,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,aAAa,EACb,aAAa,EACb,YAAY,GAGb,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,IAAI,EAAwC,MAAM,MAAM,CAAC;AAElE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EACL,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,cAAc,CAAC;AAEtB,MAAM,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;AAEzB,2FAA2F;AAC3F,MAAM,UAAU,GACd,gFAAgF,CAAC;AAEnF,MAAM,WAAW,GAAG,gBAAgB,CAClC,GAAG,EACH,uDAAuD,CACxD,CAAC;AACF,MAAM,iBAAiB,GAAG,gBAAgB,CACxC,GAAG,EACH,qGAAqG,CACtG,CAAC;AAMF;;;GAGG;AACH,MAAM,CAAC,MAAM,SAAS,GACpB,eAAe,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE;IAChC,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;IAC1B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAAE,OAAO,MAAM,CAAC;IACvD,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,IAAI,IAAI,EAAO,CAAC;IAC/B,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAChC,eAAe,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CACnD,CAAC;IACF,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IACnE,0FAA0F;IAC1F,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,oBAAoB,EAAE,CAAC,CAAC;IACxC,IAAI,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC;QACnC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,CAAC,OAAqB,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAE,CAAC,IAAI,CAAC,EAAE,CAAC;IACvE,MAAM,QAAQ,GAAG,KAAK,EAAE,OAAqB,EAAE,EAAE,CAC/C,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,QAAQ;QAC9B,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3C,kGAAkG;IAClG,MAAM,SAAS,GAA2B,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAChE,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/C,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;IAEF,MAAM,CAAC,GAAG,CACR,eAAe,EACf,aAAa,CAAC;QACZ,IAAI;QACJ,OAAO,EAAE,0CAA0C;QACnD,WAAW,EAAE,yBAAyB;QACtC,GAAG,QAAQ,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC;QACjD,WAAW,EAAE,UAAU;QACvB,SAAS,EAAE;YACT,GAAG,EAAE,YAAY,CAAC,qBAAqB,CAAC;YACxC,GAAG,iBAAiB;SACrB;KACF,CAAC,EACF,KAAK,EAAE,OAAO,EAAE,EAAE,CAChB,OAAO,CAAC,IAAI,CAAC;QACX,IAAI,EAAE;YACJ,GAAG,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;YAC7C,SAAS,EAAE,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;SACpD;KACF,CAAC,CACL,CAAC;IACF,oGAAoG;IACpG,MAAM,CAAC,GAAG,CACR,sBAAsB,EACtB,aAAa,CAAC;QACZ,IAAI;QACJ,OAAO,EAAE,kDAAkD;QAC3D,WAAW,EAAE,yBAAyB;QACtC,GAAG,QAAQ,CAAC;YACV,OAAO,EAAE,uBAAuB;YAChC,OAAO,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,aAAa,CAAC;YACvC,QAAQ,EAAE,CAAC,gDAAgD,CAAC;SAC7D,CAAC;QACF,WAAW,EAAE,GAAG,UAAU,0FAA0F;QACpH,SAAS,EAAE;YACT,GAAG,EAAE,YAAY,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACxD,GAAG,iBAAiB;YACpB,GAAG,EAAE,gBAAgB,CACnB,GAAG,EACH,yDAAyD,CAC1D;SACF;KACF,CAAC,EACF,YAAY,CAAC,OAAO,EAAE,gBAAgB,CAAC,EACvC,YAAY,CAAC,OAAO,EAAE,iBAAiB,CAAC,EACxC,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,QAAQ,CAAC,OAAO,CAAC,EAAE;YACnE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3B,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3B,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9D,CAAC,CACF,CAAC;IACF,kDAAkD;IAClD,MAAM,CAAC,GAAG,CACR,GAAG,EACH,aAAa,CAAC;QACZ,IAAI;QACJ,OAAO,EAAE,kBAAkB;QAC3B,WAAW,EAAE,iBAAiB;QAC9B,GAAG,QAAQ,CAAC;YACV,OAAO,EAAE,cAAc;YACvB,OAAO,EAAE;gBACP,IAAI;gBACJ,MAAM;gBACN,OAAO;gBACP,SAAS;gBACT,WAAW;gBACX,YAAY;aACb;SACF,CAAC;QACF,WAAW,EAAE,GAAG,UAAU,gCAAgC;QAC1D,SAAS,EAAE;YACT,GAAG,EAAE,YAAY,CAAC,gBAAgB,EAAE,eAAe,CAAC;YACpD,GAAG,iBAAiB;SACrB;KACF,CAAC,EACF,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAC9C,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9D,CAAC,CACF,CAAC;IACF,MAAM,CAAC,IAAI,CACT,GAAG,EACH,SAAS,EACT,aAAa,CAAC;QACZ,IAAI;QACJ,OAAO,EAAE,mBAAmB;QAC5B,WAAW,EAAE,kBAAkB;QAC/B,GAAG,QAAQ,CAAC;YACV,OAAO,EAAE,gBAAgB;YACzB,QAAQ,EAAE;gBACR,+CAA+C;gBAC/C,gCAAgC;aACjC;YACD,QAAQ,EAAE,MAAM;SACjB,CAAC;QACF,WAAW,EAAE,GAAG,UAAU,oGAAoG;QAC9H,SAAS,EAAE;YACT,GAAG,EAAE,YAAY,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;YAC1D,GAAG,iBAAiB;YACpB,GAAG,EAAE,iBAAiB;YACtB,GAAG,EAAE,gBAAgB,CACnB,GAAG,EACH,sNAAsN,CACvN;SACF;KACF,CAAC,EACF,YAAY,CAAC,MAAM,EAAE,iBAAiB,CAAC,EACvC,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC5C,OAAO,OAAO,CAAC,IAAI,CACjB;YACE,IAAI,EAAE,MAAM,IAAI,CAAC,MAAM,CACrB,MAAM,CAAC,OAAO,CAAC,EACf,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EACzB,MAAM,QAAQ,CAAC,OAAO,CAAC,CACxB;SACF,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CACF,CAAC;IACF,MAAM,CAAC,IAAI,CACT,gBAAgB,EAChB,SAAS,EACT,aAAa,CAAC;QACZ,IAAI;QACJ,OAAO,EAAE,mBAAmB;QAC5B,WAAW,EAAE,kBAAkB;QAC/B,GAAG,QAAQ,CAAC;YACV,OAAO,EAAE,gBAAgB;YACzB,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;YACjC,OAAO,EAAE,gDAAgD;SAC1D,CAAC;QACF,WAAW,EAAE,GAAG,UAAU,0GAA0G;QACpI,SAAS,EAAE;YACT,GAAG,EAAE,YAAY,CAAC,mBAAmB,CAAC;YACtC,GAAG,iBAAiB;YACpB,GAAG,EAAE,iBAAiB;YACtB,GAAG,EAAE,WAAW;SACjB;KACF,CAAC,EACF,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,EACnC,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC5C,OAAO,OAAO,CAAC,IAAI,CAAC;YAClB,IAAI,EAAE,MAAM,IAAI,CAAC,MAAM,CACrB,MAAM,CAAC,OAAO,CAAC,EACf,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CACjC;SACF,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IACF,MAAM,CAAC,MAAM,CACX,SAAS,EACT,aAAa,CAAC;QACZ,IAAI;QACJ,OAAO,EAAE,mBAAmB;QAC5B,WAAW,EAAE,kBAAkB;QAC/B,GAAG,QAAQ,CAAC;YACV,OAAO,EAAE,gBAAgB;YACzB,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;YACjC,OAAO,EAAE,kDAAkD;SAC5D,CAAC;QACF,WAAW,EAAE,UAAU;QACvB,SAAS,EAAE;YACT,GAAG,EAAE,aAAa,CAAC,sBAAsB,CAAC;YAC1C,GAAG,iBAAiB;YACpB,GAAG,EAAE,WAAW;SACjB;KACF,CAAC,EACF,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,EACnC,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC;QACrE,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACjC,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACjC,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC,CAAC;AAEL,MAAM,MAAM,GAA0D;IACpE,SAAS;CACV,CAAC;AAEF,eAAe,MAAM,CAAC"}

package/dist/server/routes/schemas.d.ts

@@ -0,0 +1,25 @@
+import { z } from 'zod';
+import { type ApiKeyView, type CreateApiKeyRequest, type CreatedApiKey, type KeyScopeObject, type KeyScopeOptions, type KeyScopeInput } from '../../shared/scopes.js';
+/** A key's scope; which groups exist and what they offer is checked by `ApiKeyScopes.validate`. */
+export declare const KeyScopeInputSchema: z.ZodType<KeyScopeInput>;
+/** The body of `POST /apiKeys`. */
+export declare const CreateApiKeyInput: z.ZodType<CreateApiKeyRequest>;
+export declare const ApiKeyParams: z.ZodObject<{
+    keyId: z.ZodString;
+}>;
+export declare const ScopeGroupParams: z.ZodObject<{
+    group: z.ZodString;
+}>;
+/** The query of `GET /apiKeys/scopeObjects/:group`: a search, or the records to look up by id (`id` repeated). */
+export declare const ScopeObjectsQuery: z.ZodType<{
+    q?: string | undefined;
+    id?: string[] | undefined;
+}>;
+export declare const KeyScopeOptionsSchema: z.ZodType<KeyScopeOptions>;
+export declare const KeyScopeObjectSchema: z.ZodType<KeyScopeObject>;
+export declare const ApiKeyViewSchema: z.ZodType<ApiKeyView>;
+export declare const CreatedApiKeySchema: z.ZodType<CreatedApiKey>;
+export declare const ApiKeysListMeta: z.ZodType<{
+    total: number;
+}>;
+//# sourceMappingURL=schemas.d.ts.map

package/dist/server/routes/schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../../server/routes/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAGL,KAAK,UAAU,EACf,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,eAAe,EAGpB,KAAK,aAAa,EAEnB,MAAM,wBAAwB,CAAC;AAahC,mGAAmG;AACnG,eAAO,MAAM,mBAAmB,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAEvD,CAAC;AAEH,mCAAmC;AACnC,eAAO,MAAM,iBAAiB,EAAE,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAO5D,CAAC;AAEF,eAAO,MAAM,YAAY,EAAE,CAAC,CAAC,SAAS,CAAC;IAAE,KAAK,EAAE,CAAC,CAAC,SAAS,CAAA;CAAE,CAE3D,CAAC;AAEH,eAAO,MAAM,gBAAgB,EAAE,CAAC,CAAC,SAAS,CAAC;IAAE,KAAK,EAAE,CAAC,CAAC,SAAS,CAAA;CAAE,CAE/D,CAAC;AAIH,kHAAkH;AAClH,eAAO,MAAM,iBAAiB,EAAE,CAAC,CAAC,OAAO,CAAC;IACxC,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvB,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;CAC3B,CAQC,CAAC;AAgCH,eAAO,MAAM,qBAAqB,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CA2C3D,CAAC;AAEH,eAAO,MAAM,oBAAoB,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAIzD,CAAC;AAEH,eAAO,MAAM,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAgBrB,CAAC;AAE/B,eAAO,MAAM,mBAAmB,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAOpB,CAAC;AAEtC,eAAO,MAAM,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAEvD,CAAC"}

package/dist/server/routes/schemas.js

@@ -0,0 +1,127 @@
+import { z } from 'zod';
+import { KEY_SCOPE_LEVELS, } from '../../shared/scopes.js';
+const KeyScopeLevelSchema = z.enum(KEY_SCOPE_LEVELS);
+const KeyScopeGroupGrantSchema = z.strictObject({
+    level: KeyScopeLevelSchema,
+    objects: z
+        .union([z.literal('all'), z.array(z.string().min(1)).min(1)])
+        .optional(),
+});
+/** A key's scope; which groups exist and what they offer is checked by `ApiKeyScopes.validate`. */
+export const KeyScopeInputSchema = z.strictObject({
+    groups: z.record(z.string().min(1), KeyScopeGroupGrantSchema),
+});
+/** The body of `POST /apiKeys`. */
+export const CreateApiKeyInput = z.strictObject({
+    name: z.string(),
+    description: z.string().nullable().optional(),
+    expiresInDays: z.number().int().nullable(),
+    scope: KeyScopeInputSchema.nullable(),
+});
+export const ApiKeyParams = z.object({
+    keyId: z.string().min(1),
+});
+export const ScopeGroupParams = z.object({
+    group: z.string().min(1),
+});
+const MAX_PICKED_IDS = 100;
+/** The query of `GET /apiKeys/scopeObjects/:group`: a search, or the records to look up by id (`id` repeated). */
+export const ScopeObjectsQuery = z.object({
+    q: z.string().max(200).optional(),
+    id: z
+        .union([z.string().min(1), z.array(z.string().min(1)).max(MAX_PICKED_IDS)])
+        .optional()
+        .transform((value) => value === undefined ? undefined : Array.isArray(value) ? value : [value]),
+});
+// Response schemas: they document what the routes send; nothing validates a response against them.
+const dateTime = () => z.string().meta({ format: 'date-time' });
+const LocalizedTextSchema = z
+    .union([z.string(), z.object({ key: z.string(), ns: z.string() })])
+    .meta({
+    ref: 'ApiKeysLocalizedText',
+    description: 'Plain text, or an i18n key in a namespace.',
+});
+const AccessRefSchema = z.discriminatedUnion('kind', [
+    z.object({ kind: z.literal('page'), id: z.string() }),
+    z.object({ kind: z.literal('settings'), id: z.string(), action: z.string() }),
+    z.object({ kind: z.literal('business'), id: z.string(), action: z.string() }),
+]);
+const GrantResponseSchema = z.object({
+    level: KeyScopeLevelSchema,
+    objects: z.union([z.literal('all'), z.array(z.string())]).optional(),
+});
+const KeyScopeResponseSchema = z
+    .object({ groups: z.record(z.string(), GrantResponseSchema) })
+    .meta({
+    ref: 'ApiKeysKeyScope',
+    description: 'What the key may do, group by group; a group left out grants nothing.',
+});
+export const KeyScopeOptionsSchema = z.object({
+    groups: z
+        .array(z.object({
+        id: z.string(),
+        category: z.enum(['business', 'administration', 'account']),
+        title: LocalizedTextSchema,
+        description: LocalizedTextSchema.nullable(),
+        levels: z.array(KeyScopeLevelSchema),
+        access: z.partialRecord(KeyScopeLevelSchema, z.array(AccessRefSchema)),
+        held: z.partialRecord(KeyScopeLevelSchema, z.boolean()).meta({
+            description: 'Whether the caller holds everything up to each level; false shows it greyed out.',
+        }),
+        objects: z
+            .object({ business: z.string(), title: LocalizedTextSchema })
+            .nullable(),
+    }))
+        .meta({ description: 'Empty when scoped keys are not offered.' }),
+    presets: z.array(z.object({
+        id: z.string(),
+        title: LocalizedTextSchema,
+        description: LocalizedTextSchema.nullable(),
+        groups: z.record(z.string(), z.object({
+            level: KeyScopeLevelSchema,
+            objects: z.enum(['all', 'pick']).optional(),
+        })),
+        expiresInDays: z.number().int().nullable(),
+    })),
+    maxScopedKeyDays: z.number().int().nullable().meta({
+        description: 'The longest a scoped key may live, in days; null when "never expires" is allowed.',
+    }),
+    defaultExpiresInDays: z.number().int(),
+    mayCreate: z.boolean().optional().meta({
+        description: 'Whether the caller may create keys of their own.',
+    }),
+});
+export const KeyScopeObjectSchema = z.object({
+    id: z.string(),
+    title: z.string(),
+    description: z.string().optional(),
+});
+export const ApiKeyViewSchema = z
+    .object({
+    id: z.string(),
+    name: z.string().nullable(),
+    description: z.string().nullable(),
+    start: z.string().nullable().meta({
+        description: 'The first characters of the key, to recognize it.',
+    }),
+    enabled: z.boolean(),
+    createdAt: dateTime(),
+    expiresAt: dateTime().nullable(),
+    lastUsedAt: dateTime().nullable(),
+    scope: KeyScopeResponseSchema.nullable().meta({
+        description: 'Null for a key that acts as its owner in full.',
+    }),
+})
+    .meta({ ref: 'ApiKeysKey' });
+export const CreatedApiKeySchema = z
+    .object({
+    key: ApiKeyViewSchema,
+    secret: z.string().meta({
+        description: 'The key itself, shown only in this response.',
+    }),
+})
+    .meta({ ref: 'ApiKeysCreatedKey' });
+export const ApiKeysListMeta = z.object({
+    total: z.number().int(),
+});
+//# sourceMappingURL=schemas.js.map

package/dist/server/routes/schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../../server/routes/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,gBAAgB,GAWjB,MAAM,wBAAwB,CAAC;AAEhC,MAAM,mBAAmB,GAA6B,CAAC,CAAC,IAAI,CAC1D,gBAAuD,CACxD,CAAC;AAEF,MAAM,wBAAwB,GAAkC,CAAC,CAAC,YAAY,CAAC;IAC7E,KAAK,EAAE,mBAAmB;IAC1B,OAAO,EAAE,CAAC;SACP,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;SAC5D,QAAQ,EAAE;CACd,CAAC,CAAC;AAEH,mGAAmG;AACnG,MAAM,CAAC,MAAM,mBAAmB,GAA6B,CAAC,CAAC,YAAY,CAAC;IAC1E,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,wBAAwB,CAAC;CAC9D,CAAC,CAAC;AAEH,mCAAmC;AACnC,MAAM,CAAC,MAAM,iBAAiB,GAAmC,CAAC,CAAC,YAAY,CAC7E;IACE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC1C,KAAK,EAAE,mBAAmB,CAAC,QAAQ,EAAE;CACtC,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAwC,CAAC,CAAC,MAAM,CAAC;IACxE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACzB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAwC,CAAC,CAAC,MAAM,CAAC;IAC5E,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACzB,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B,kHAAkH;AAClH,MAAM,CAAC,MAAM,iBAAiB,GAGzB,CAAC,CAAC,MAAM,CAAC;IACZ,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACjC,EAAE,EAAE,CAAC;SACF,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;SAC1E,QAAQ,EAAE;SACV,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CACnB,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CACzE;CACJ,CAAC,CAAC;AAEH,mGAAmG;AAEnG,MAAM,QAAQ,GAAG,GAAgB,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;AAE7E,MAAM,mBAAmB,GAA6B,CAAC;KACpD,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;KAClE,IAAI,CAAC;IACJ,GAAG,EAAE,sBAAsB;IAC3B,WAAW,EAAE,4CAA4C;CAC1D,CAAC,CAAC;AAEL,MAAM,eAAe,GAAyB,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACzE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACrD,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IAC7E,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;CAC9E,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,KAAK,EAAE,mBAAmB;IAC1B,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACrE,CAAC,CAAC;AAEH,MAAM,sBAAsB,GAA6B,CAAC;KACvD,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,EAAE,CAAC;KAC7D,IAAI,CAAC;IACJ,GAAG,EAAE,iBAAiB;IACtB,WAAW,EACT,uEAAuE;CAC1E,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,qBAAqB,GAA+B,CAAC,CAAC,MAAM,CAAC;IACxE,MAAM,EAAE,CAAC;SACN,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;QACP,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,gBAAgB,EAAE,SAAS,CAAC,CAAC;QAC3D,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EAAE,mBAAmB,CAAC,QAAQ,EAAE;QAC3C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC;QACpC,MAAM,EAAE,CAAC,CAAC,aAAa,CAAC,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QACtE,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC;YAC3D,WAAW,EACT,kFAAkF;SACrF,CAAC;QACF,OAAO,EAAE,CAAC;aACP,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;aAC5D,QAAQ,EAAE;KACd,CAAC,CACH;SACA,IAAI,CAAC,EAAE,WAAW,EAAE,yCAAyC,EAAE,CAAC;IACnE,OAAO,EAAE,CAAC,CAAC,KAAK,CACd,CAAC,CAAC,MAAM,CAAC;QACP,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EAAE,mBAAmB,CAAC,QAAQ,EAAE;QAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,CACd,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,MAAM,CAAC;YACP,KAAK,EAAE,mBAAmB;YAC1B,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;SAC5C,CAAC,CACH;QACD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;KAC3C,CAAC,CACH;IACD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC;QACjD,WAAW,EACT,mFAAmF;KACtF,CAAC;IACF,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACtC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC;QACrC,WAAW,EAAE,kDAAkD;KAChE,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAA8B,CAAC,CAAC,MAAM,CAAC;IACtE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAA0B,CAAC;KACrD,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC;QAChC,WAAW,EAAE,mDAAmD;KACjE,CAAC;IACF,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,SAAS,EAAE,QAAQ,EAAE;IACrB,SAAS,EAAE,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAChC,UAAU,EAAE,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACjC,KAAK,EAAE,sBAAsB,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC;QAC5C,WAAW,EAAE,gDAAgD;KAC9D,CAAC;CACH,CAAC;KACD,IAAI,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC;AAE/B,MAAM,CAAC,MAAM,mBAAmB,GAA6B,CAAC;KAC3D,MAAM,CAAC;IACN,GAAG,EAAE,gBAAgB;IACrB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;QACtB,WAAW,EAAE,8CAA8C;KAC5D,CAAC;CACH,CAAC;KACD,IAAI,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE,CAAC,CAAC;AAEtC,MAAM,CAAC,MAAM,eAAe,GAAiC,CAAC,CAAC,MAAM,CAAC;IACpE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;CACxB,CAAC,CAAC"}