@nocobase/app-plugin-api-keys 0.0.0-stage → 1.0.0-beta.13

package/dist/server/scoped-keys.d.ts

@@ -0,0 +1,116 @@
+/**
+ * Keys with scopes: creating, listing, rotating and revoking a user's keys, and recognizing the key behind a request.
+ * The caller authorizes who may manage whose keys; this service only ever acts on the user it is told.
+ */
+import { type Auth, type AuthSession } from '@nocobase/app-plugin-authentication/server';
+import type { Authorization, AuthorizationIdentity, KeyScope } from '@nocobase/authorization/core';
+import type { DatabaseConnection } from '@nocobase/db';
+import { type ApiKeyView, type CreatedApiKey, type KeyScopeInput, type KeyScopeObject, type KeyScopeOptions } from '../shared/scopes.js';
+import { type ApiKeyScopes } from './scopes.js';
+/** The expiry the editor proposes for a scoped key. */
+export declare const DEFAULT_SCOPED_KEY_DAYS = 90;
+/** `apiKeys` in the application's configuration. */
+export interface ApiKeysConfig {
+    /** The longest a scoped key may live, in days. Unset allows "never expires". */
+    readonly maxScopedKeyDays?: number | null;
+}
+/** A refused key operation: a status and a stable code. */
+export declare class ApiKeyRequestError extends Error {
+    readonly status: 400 | 403 | 404;
+    readonly code: string;
+    constructor(status: 400 | 403 | 404, code: string, message: string);
+}
+export interface ScopedApiKeysOptions {
+    readonly auth: Pick<Auth, 'pluginApi'>;
+    readonly connection: () => DatabaseConnection;
+    readonly scopes: ApiKeyScopes;
+    /** The application's authorization, to say what a user holds and to build their identity; optional. */
+    readonly authorization?: () => Authorization | undefined;
+    readonly config?: () => ApiKeysConfig | undefined;
+}
+/**
+ * Whether a user may create (and rotate) keys of their own, as an application decides it. Without one, everyone may.
+ * Listing and revoking one's keys stay open, so a person who loses the permission can still clean up.
+ */
+export type OwnKeyPolicy = (userId: string) => Promise<boolean>;
+/** A key's fields as `create` would issue it, checked but not yet issued (`ScopedApiKeys.check`). */
+export interface CheckedApiKey {
+    readonly name: string;
+    readonly description: string | null;
+    readonly scope: KeyScopeInput | null;
+    readonly expiresInDays: number | null;
+}
+/**
+ * Lets the hook on Better Auth's own `/api-key/create` ask `keys` whether a person may create a key of their own, as
+ * `/api/apiKeys` does. The plugin's provider calls it at boot; returns what disconnects it.
+ */
+export declare function connectOwnKeyPolicy(auth: Pick<Auth, 'administrationContext'>, keys: Pick<ScopedApiKeys, 'mayCreateOwn'>): Promise<() => void>;
+export declare class ScopedApiKeys {
+    private readonly options;
+    private readonly resolved;
+    private ownKeyPolicy;
+    constructor(options: ScopedApiKeysOptions);
+    /**
+     * Sets who may create keys of their own (`/api/apiKeys` and Better Auth's `/api-key/create`). Returns what removes
+     * it again.
+     */
+    setOwnKeyPolicy(policy: OwnKeyPolicy): () => void;
+    /** Whether `userId` may create keys of their own; true unless the application set a policy that says otherwise. */
+    mayCreateOwn(userId: string): Promise<boolean>;
+    /** Refuses with 403 `API_KEY_CREATION_FORBIDDEN` unless `userId` may create keys of their own. */
+    requireOwnCreation(userId: string): Promise<void>;
+    private get maxScopedKeyDays();
+    /** The identity a request of `userId` would carry, as the authorization plugin's middleware builds it. */
+    identityOf(userId: string): Promise<AuthorizationIdentity>;
+    /** What the editor offers for keys of `userId`, with what that user holds today. */
+    scopeOptions(userId: string): Promise<KeyScopeOptions>;
+    /** The records a group may be limited to, as `identity` may see them. */
+    scopeObjects(groupId: string, identity: AuthorizationIdentity, query?: {
+        readonly search?: string;
+        readonly ids?: readonly string[];
+    }): Promise<readonly KeyScopeObject[]>;
+    /** `userId`'s keys of the default configuration, newest first. */
+    list(userId: string): Promise<ApiKeyView[]>;
+    /**
+     * Creates a key for `userId`. `identity` is whoever chooses the records of a group limited to some: each must be
+     * one they may see.
+     */
+    create(userId: string, input: unknown, identity: AuthorizationIdentity): Promise<CreatedApiKey>;
+    /**
+     * Checks what `create` would issue — name, description, scope, the records it picks (`identity` must see each) and
+     * expiry — without issuing anything, so a caller can refuse before creating whatever the key belongs to.
+     */
+    check(input: unknown, identity: AuthorizationIdentity): Promise<CheckedApiKey>;
+    /** Issues a key `check` accepted. */
+    issueChecked(userId: string, input: CheckedApiKey): Promise<CreatedApiKey>;
+    /** One of `userId`'s keys. */
+    get(userId: string, keyId: string): Promise<ApiKeyView>;
+    /**
+     * Gives a key a new secret in place: the same key — id, name, description, scope and owner — with a new value, and
+     * an expiry renewed for the lifetime it had. The old value stops at once.
+     */
+    rotate(userId: string, keyId: string): Promise<CreatedApiKey>;
+    /**
+     * Replaces a key's scope. `identity` is whoever chooses it: each record a group is limited to must be one they may
+     * see. The caller decides who may change a key and whether the new scope is one they may give. A key without a scope
+     * cannot be given one this way, nor the reverse.
+     */
+    setScope(userId: string, keyId: string, input: unknown, identity: AuthorizationIdentity): Promise<ApiKeyView>;
+    /** Renames a key or changes its description; a field left out stays. */
+    update(userId: string, keyId: string, input: unknown): Promise<ApiKeyView>;
+    revoke(userId: string, keyId: string): Promise<void>;
+    /** Every key of `userId`, as when the account is deleted. */
+    revokeAll(userId: string): Promise<void>;
+    /**
+     * The scope of the key a request authenticated with: compiled from its stored scope, unbounded for a service
+     * account's unscoped key, and null for a session or a person's unscoped key. Read once per request.
+     */
+    resolve(session: NonNullable<AuthSession>, request: Request): Promise<KeyScope | null>;
+    private lookup;
+    private issue;
+    private remove;
+    private requireRow;
+    private checkObjects;
+    private expiryOf;
+}
+//# sourceMappingURL=scoped-keys.d.ts.map

package/dist/server/scoped-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scoped-keys.d.ts","sourceRoot":"","sources":["../../server/scoped-keys.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAEL,KAAK,IAAI,EACT,KAAK,WAAW,EACjB,MAAM,4CAA4C,CAAC;AACpD,OAAO,KAAK,EACV,aAAa,EACb,qBAAqB,EACrB,QAAQ,EACT,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,OAAO,EAKL,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,eAAe,EACrB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAoB,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAElE,uDAAuD;AACvD,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAE1C,oDAAoD;AACpD,MAAM,WAAW,aAAa;IAC5B,gFAAgF;IAChF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3C;AAED,2DAA2D;AAC3D,qBAAa,kBAAmB,SAAQ,KAAK;IAEzC,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM;gBADZ,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,EACvB,IAAI,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM;CAKlB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACvC,QAAQ,CAAC,UAAU,EAAE,MAAM,kBAAkB,CAAC;IAC9C,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,uGAAuG;IACvG,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,aAAa,GAAG,SAAS,CAAC;IACzD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,aAAa,GAAG,SAAS,CAAC;CACnD;AAgBD;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhE,qGAAqG;AACrG,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CACvC;AAMD;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,uBAAuB,CAAC,EACzC,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,GACxC,OAAO,CAAC,MAAM,IAAI,CAAC,CAUrB;AAED,qBAAa,aAAa;IAIZ,OAAO,CAAC,QAAQ,CAAC,OAAO;IAHpC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoD;IAC7E,OAAO,CAAC,YAAY,CAA6B;gBAEpB,OAAO,EAAE,oBAAoB;IAE1D;;;OAGG;IACH,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,IAAI;IAOjD,mHAAmH;IAC7G,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIpD,kGAAkG;IAC5F,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASvD,OAAO,KAAK,gBAAgB,GAK3B;IAED,0GAA0G;IACpG,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAYhE,oFAAoF;IAC9E,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IA2D5D,yEAAyE;IACnE,YAAY,CAChB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,qBAAqB,EAC/B,KAAK,GAAE;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAO,GACzE,OAAO,CAAC,SAAS,cAAc,EAAE,CAAC;IAWrC,kEAAkE;IAC5D,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAajD;;;OAGG;IACG,MAAM,CACV,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE,qBAAqB,GAC9B,OAAO,CAAC,aAAa,CAAC;IAIzB;;;OAGG;IACG,KAAK,CACT,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE,qBAAqB,GAC9B,OAAO,CAAC,aAAa,CAAC;IAkBzB,qCAAqC;IACrC,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAI1E,8BAA8B;IACxB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAI7D;;;OAGG;IACG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IA4DnE;;;;OAIG;IACG,QAAQ,CACZ,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE,qBAAqB,GAC9B,OAAO,CAAC,UAAU,CAAC;IAmBtB,wEAAwE;IAClE,MAAM,CACV,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,UAAU,CAAC;IAuBhB,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK1D,6DAA6D;IACvD,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAS9C;;;OAGG;IACH,OAAO,CACL,OAAO,EAAE,WAAW,CAAC,WAAW,CAAC,EACjC,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;YAQb,MAAM;YAqBN,KAAK;YAiCL,MAAM;YAON,UAAU;YAcV,YAAY;IAsB1B,OAAO,CAAC,QAAQ;CAyBjB"}

package/dist/server/scoped-keys.js

@@ -0,0 +1,451 @@
+/**
+ * Keys with scopes: creating, listing, rotating and revoking a user's keys, and recognizing the key behind a request.
+ * The caller authorizes who may manage whose keys; this service only ever acts on the user it is told.
+ */
+import { isServiceAccount, } from '@nocobase/app-plugin-authentication/server';
+import { decodeKeyScope, encodeKeyScope, KEY_SCOPE_LEVELS, pickedObjects, } from '../shared/scopes.js';
+import { ownKeyPolicySlotOf } from './api-keys.js';
+import { API_KEY_HEADER, isApiKeySession } from './key-sessions.js';
+import { ApiKeyScopeError } from './scopes.js';
+/** The expiry the editor proposes for a scoped key. */
+export const DEFAULT_SCOPED_KEY_DAYS = 90;
+/** A refused key operation: a status and a stable code. */
+export class ApiKeyRequestError extends Error {
+    status;
+    code;
+    constructor(status, code, message) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.name = 'ApiKeyRequestError';
+    }
+}
+const DAY_SECONDS = 24 * 60 * 60;
+const MAX_NAME = 100;
+const MAX_DESCRIPTION = 500;
+/**
+ * Lets the hook on Better Auth's own `/api-key/create` ask `keys` whether a person may create a key of their own, as
+ * `/api/apiKeys` does. The plugin's provider calls it at boot; returns what disconnects it.
+ */
+export async function connectOwnKeyPolicy(auth, keys) {
+    const context = await auth.administrationContext();
+    const slots = (context.options.plugins ?? [])
+        .map((plugin) => ownKeyPolicySlotOf(plugin))
+        .filter((slot) => slot !== undefined);
+    const check = (userId) => keys.mayCreateOwn(userId);
+    for (const slot of slots)
+        slot.current = check;
+    return () => {
+        for (const slot of slots)
+            if (slot.current === check)
+                slot.current = null;
+    };
+}
+export class ScopedApiKeys {
+    options;
+    resolved = new WeakMap();
+    ownKeyPolicy = null;
+    constructor(options) {
+        this.options = options;
+    }
+    /**
+     * Sets who may create keys of their own (`/api/apiKeys` and Better Auth's `/api-key/create`). Returns what removes
+     * it again.
+     */
+    setOwnKeyPolicy(policy) {
+        this.ownKeyPolicy = policy;
+        return () => {
+            if (this.ownKeyPolicy === policy)
+                this.ownKeyPolicy = null;
+        };
+    }
+    /** Whether `userId` may create keys of their own; true unless the application set a policy that says otherwise. */
+    async mayCreateOwn(userId) {
+        return this.ownKeyPolicy ? this.ownKeyPolicy(userId) : true;
+    }
+    /** Refuses with 403 `API_KEY_CREATION_FORBIDDEN` unless `userId` may create keys of their own. */
+    async requireOwnCreation(userId) {
+        if (!(await this.mayCreateOwn(userId)))
+            throw new ApiKeyRequestError(403, 'API_KEY_CREATION_FORBIDDEN', 'You may not create API keys of your own.');
+    }
+    get maxScopedKeyDays() {
+        const value = this.options.config?.()?.maxScopedKeyDays;
+        return typeof value === 'number' && Number.isInteger(value) && value > 0
+            ? value
+            : null;
+    }
+    /** The identity a request of `userId` would carry, as the authorization plugin's middleware builds it. */
+    async identityOf(userId) {
+        const principal = { type: 'user', id: userId };
+        const authz = this.options.authorization?.();
+        return {
+            principal,
+            subjects: [
+                { type: 'authenticated', id: '*' },
+                ...(authz ? await authz.subjects.resolveFor(principal) : []),
+            ],
+        };
+    }
+    /** What the editor offers for keys of `userId`, with what that user holds today. */
+    async scopeOptions(userId) {
+        const authz = this.options.authorization?.();
+        const context = authz ? authz.for(await this.identityOf(userId)) : null;
+        const groups = await Promise.all(this.options.scopes.groups.list().map(async (group) => {
+            const levels = KEY_SCOPE_LEVELS.filter((level) => group.levels[level] !== undefined);
+            const held = {};
+            for (const level of levels) {
+                const access = this.options.scopes.accessOf(group, level);
+                // A ref is held when any of its actions is (a business action at any of its levels).
+                held[level] = context
+                    ? (await Promise.all(access.map(async ({ resource, actions }) => (await Promise.all(actions.map((action) => context.can({ resource, action })))).some(Boolean)))).every(Boolean)
+                    : true;
+            }
+            return {
+                id: group.id,
+                category: group.category,
+                title: group.title,
+                description: group.description ?? null,
+                levels,
+                access: group.levels,
+                held,
+                objects: group.objects
+                    ? { business: group.objects.business, title: group.objects.title }
+                    : null,
+            };
+        }));
+        return {
+            groups,
+            presets: this.options.scopes.presets.list().map((preset) => ({
+                id: preset.id,
+                title: preset.title,
+                description: preset.description ?? null,
+                groups: preset.groups,
+                expiresInDays: preset.expiresInDays ?? null,
+            })),
+            maxScopedKeyDays: this.maxScopedKeyDays,
+            defaultExpiresInDays: Math.min(DEFAULT_SCOPED_KEY_DAYS, this.maxScopedKeyDays ?? DEFAULT_SCOPED_KEY_DAYS),
+        };
+    }
+    /** The records a group may be limited to, as `identity` may see them. */
+    async scopeObjects(groupId, identity, query = {}) {
+        const source = this.options.scopes.groups.objects(groupId);
+        if (!source)
+            throw new ApiKeyRequestError(404, 'UNKNOWN_SCOPE_GROUP', `${groupId} has no records to choose from.`);
+        return source.list({ identity, ...query });
+    }
+    /** `userId`'s keys of the default configuration, newest first. */
+    async list(userId) {
+        const rows = await this.options
+            .connection()
+            .query.selectFrom('apikey')
+            .selectAll()
+            .where('referenceId', '=', userId)
+            .where('configId', '=', 'default')
+            .orderBy('createdAt', 'desc')
+            .orderBy('id', 'asc')
+            .execute();
+        return rows.map((row) => viewOf(row));
+    }
+    /**
+     * Creates a key for `userId`. `identity` is whoever chooses the records of a group limited to some: each must be
+     * one they may see.
+     */
+    async create(userId, input, identity) {
+        return this.issue(userId, await this.check(input, identity));
+    }
+    /**
+     * Checks what `create` would issue — name, description, scope, the records it picks (`identity` must see each) and
+     * expiry — without issuing anything, so a caller can refuse before creating whatever the key belongs to.
+     */
+    async check(input, identity) {
+        const body = isRecord(input) ? input : {};
+        const name = text(body.name, 'name', MAX_NAME, true);
+        const description = text(body.description, 'description', MAX_DESCRIPTION, false);
+        const scope = body.scope === null || body.scope === undefined
+            ? null
+            : this.options.scopes.validate(body.scope);
+        if (scope)
+            await this.checkObjects(scope, identity);
+        const expiresInDays = this.expiryOf(body.expiresInDays, scope !== null);
+        return { name, description, scope, expiresInDays };
+    }
+    /** Issues a key `check` accepted. */
+    issueChecked(userId, input) {
+        return this.issue(userId, input);
+    }
+    /** One of `userId`'s keys. */
+    async get(userId, keyId) {
+        return viewOf(await this.requireRow(userId, keyId));
+    }
+    /**
+     * Gives a key a new secret in place: the same key — id, name, description, scope and owner — with a new value, and
+     * an expiry renewed for the lifetime it had. The old value stops at once.
+     */
+    async rotate(userId, keyId) {
+        const row = await this.requireRow(userId, keyId);
+        const created = parseDate(row.createdAt);
+        const expires = row.expiresAt == null ? null : parseDate(row.expiresAt);
+        const lifetime = created && expires
+            ? Math.max(1, Math.round((expires.getTime() - created.getTime()) / 86_400_000))
+            : null;
+        // Better Auth generates and hashes the new value, as for any key (its prefix, length and hashing options apply);
+        // the value moves onto the existing row and the row Better Auth made for it goes.
+        const endpoints = this.options.auth.pluginApi('api-key');
+        const fresh = await endpoints.createApiKey({
+            body: {
+                userId,
+                name: row.name ?? 'API key',
+                ...(lifetime === null ? {} : { expiresIn: lifetime * DAY_SECONDS }),
+            },
+        });
+        const value = await this.options
+            .connection()
+            .query.selectFrom('apikey')
+            .select(['key', 'start', 'prefix', 'expiresAt', 'createdAt', 'updatedAt'])
+            .where('id', '=', fresh.id)
+            .executeTakeFirst();
+        try {
+            if (!value)
+                throw new Error('The rotated key was not stored.');
+            // Stored as Better Auth stored them for the new value, so its own reads see the same encoding. `createdAt` is
+            // when the current value was issued, which the renewed lifetime counts from.
+            await this.options
+                .connection()
+                .query.updateTable('apikey')
+                .set({
+                key: value.key,
+                start: value.start,
+                prefix: value.prefix,
+                expiresAt: value.expiresAt,
+                createdAt: value.createdAt,
+                updatedAt: value.updatedAt,
+            })
+                .where('id', '=', keyId)
+                .execute();
+        }
+        finally {
+            await this.remove(fresh.id);
+        }
+        return {
+            key: viewOf(await this.requireRow(userId, keyId)),
+            secret: fresh.key,
+        };
+    }
+    /**
+     * Replaces a key's scope. `identity` is whoever chooses it: each record a group is limited to must be one they may
+     * see. The caller decides who may change a key and whether the new scope is one they may give. A key without a scope
+     * cannot be given one this way, nor the reverse.
+     */
+    async setScope(userId, keyId, input, identity) {
+        const row = await this.requireRow(userId, keyId);
+        if (decodeKeyScope(row.permissions) === null)
+            throw new ApiKeyRequestError(400, 'KEY_NOT_SCOPED', 'This key has no scope to change.');
+        const scope = this.options.scopes.validate(input);
+        await this.checkObjects(scope, identity);
+        await this.options
+            .connection()
+            .query.updateTable('apikey')
+            .set({ permissions: JSON.stringify(encodeKeyScope(scope)) })
+            .where('id', '=', keyId)
+            .execute();
+        return viewOf(await this.requireRow(userId, keyId));
+    }
+    /** Renames a key or changes its description; a field left out stays. */
+    async update(userId, keyId, input) {
+        const row = await this.requireRow(userId, keyId);
+        const body = isRecord(input) ? input : {};
+        const name = body.name === undefined
+            ? row.name
+            : text(body.name, 'name', MAX_NAME, true);
+        const description = body.description === undefined
+            ? descriptionOf(row.metadata)
+            : text(body.description, 'description', MAX_DESCRIPTION, false);
+        await this.options
+            .connection()
+            .query.updateTable('apikey')
+            .set({
+            name,
+            metadata: description ? JSON.stringify({ description }) : null,
+        })
+            .where('id', '=', keyId)
+            .execute();
+        return viewOf(await this.requireRow(userId, keyId));
+    }
+    async revoke(userId, keyId) {
+        await this.requireRow(userId, keyId);
+        await this.remove(keyId);
+    }
+    /** Every key of `userId`, as when the account is deleted. */
+    async revokeAll(userId) {
+        await this.options
+            .connection()
+            .query.deleteFrom('apikey')
+            .where('referenceId', '=', userId)
+            .where('configId', '=', 'default')
+            .execute();
+    }
+    /**
+     * The scope of the key a request authenticated with: compiled from its stored scope, unbounded for a service
+     * account's unscoped key, and null for a session or a person's unscoped key. Read once per request.
+     */
+    resolve(session, request) {
+        const known = this.resolved.get(request);
+        if (known)
+            return known;
+        const result = this.lookup(session, request);
+        this.resolved.set(request, result);
+        return result;
+    }
+    async lookup(session, request) {
+        // Better Auth's key session carries the key as its token and the key's id as its id; a cookie session never does.
+        if (!isApiKeySession(session, request.headers, [API_KEY_HEADER]))
+            return null;
+        const row = await this.options
+            .connection()
+            .query.selectFrom('apikey')
+            .select(['id', 'permissions'])
+            .where('id', '=', session.session.id)
+            .executeTakeFirst();
+        if (!row)
+            return null;
+        const scope = decodeKeyScope(row.permissions);
+        if (scope)
+            return this.options.scopes.compile(row.id, scope);
+        return isServiceAccount(session.user)
+            ? this.options.scopes.unbounded(row.id)
+            : null;
+    }
+    async issue(userId, input) {
+        const endpoints = this.options.auth.pluginApi('api-key');
+        const created = await endpoints.createApiKey({
+            body: {
+                userId,
+                name: input.name,
+                ...(input.expiresInDays === null
+                    ? {}
+                    : { expiresIn: input.expiresInDays * DAY_SECONDS }),
+                ...(input.scope ? { permissions: encodeKeyScope(input.scope) } : {}),
+            },
+        });
+        // Written directly rather than through Better Auth, whose `metadata` stays off (`enableMetadata`) so that a key's
+        // holder cannot write to it over HTTP.
+        if (input.description)
+            await this.options
+                .connection()
+                .query.updateTable('apikey')
+                .set({ metadata: JSON.stringify({ description: input.description }) })
+                .where('id', '=', created.id)
+                .execute();
+        const row = await this.requireRow(userId, created.id);
+        return { key: viewOf(row), secret: created.key };
+    }
+    async remove(keyId) {
+        const endpoints = this.options.auth.pluginApi('api-key');
+        await endpoints.deleteServerApiKey({
+            body: { keyId, configId: 'default' },
+        });
+    }
+    async requireRow(userId, keyId) {
+        const row = await this.options
+            .connection()
+            .query.selectFrom('apikey')
+            .selectAll()
+            .where('id', '=', keyId)
+            .where('referenceId', '=', userId)
+            .where('configId', '=', 'default')
+            .executeTakeFirst();
+        if (!row)
+            throw new ApiKeyRequestError(404, 'KEY_NOT_FOUND', 'API key not found.');
+        return row;
+    }
+    async checkObjects(scope, identity) {
+        for (const [groupId, grant] of Object.entries(scope.groups)) {
+            const picked = pickedObjects(grant);
+            if (!picked)
+                continue;
+            const source = this.options.scopes.groups.objects(groupId);
+            const found = new Set((source ? await source.list({ identity, ids: picked }) : []).map((item) => item.id));
+            const missing = picked.filter((id) => !found.has(id));
+            if (missing.length > 0)
+                throw new ApiKeyScopeError('UNKNOWN_SCOPE_OBJECT', `${groupId} has no record ${missing.join(', ')} you may choose.`);
+        }
+    }
+    expiryOf(value, scoped) {
+        const max = scoped ? this.maxScopedKeyDays : null;
+        if (value === null || value === undefined) {
+            if (max !== null)
+                throw new ApiKeyRequestError(400, 'EXPIRY_REQUIRED', `A scoped key expires within ${max} days.`);
+            return null;
+        }
+        if (typeof value !== 'number' ||
+            !Number.isInteger(value) ||
+            value < 1 ||
+            value > 365 ||
+            (max !== null && value > max))
+            throw new ApiKeyRequestError(400, 'INVALID_EXPIRY', `expiresInDays must be a whole number of days from 1 to ${max ?? 365}, or null.`);
+        return value;
+    }
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function text(value, name, max, required) {
+    if (value === undefined || value === null || value === '') {
+        if (required)
+            throw new ApiKeyRequestError(400, 'INVALID_KEY', `${name} is required.`);
+        return null;
+    }
+    if (typeof value !== 'string' || value.trim().length > max)
+        throw new ApiKeyRequestError(400, 'INVALID_KEY', `${name} must be text of at most ${max} characters.`);
+    const trimmed = value.trim();
+    if (!trimmed && required)
+        throw new ApiKeyRequestError(400, 'INVALID_KEY', `${name} is required.`);
+    return trimmed || null;
+}
+function parseDate(value) {
+    if (value instanceof Date)
+        return value;
+    if (typeof value === 'number' || typeof value === 'bigint')
+        return new Date(Number(value));
+    if (typeof value === 'string') {
+        const numeric = /^-?\d+(?:\.\d+)?$/u.test(value.trim());
+        const date = new Date(numeric ? Number(value) : value);
+        return Number.isNaN(date.getTime()) ? null : date;
+    }
+    return null;
+}
+function iso(value) {
+    return parseDate(value)?.toISOString() ?? null;
+}
+function descriptionOf(metadata) {
+    let value = metadata;
+    if (typeof value === 'string') {
+        try {
+            value = JSON.parse(value);
+            // Better Auth may store the object stringified twice.
+            if (typeof value === 'string')
+                value = JSON.parse(value);
+        }
+        catch {
+            return null;
+        }
+    }
+    const description = isRecord(value) ? value.description : undefined;
+    return typeof description === 'string' && description ? description : null;
+}
+function viewOf(row) {
+    return {
+        id: row.id,
+        name: row.name,
+        description: descriptionOf(row.metadata),
+        start: row.start,
+        enabled: typeof row.enabled === 'boolean'
+            ? row.enabled
+            : Number(row.enabled) === 1,
+        createdAt: iso(row.createdAt) ?? new Date(0).toISOString(),
+        expiresAt: iso(row.expiresAt),
+        lastUsedAt: iso(row.lastRequest),
+        scope: decodeKeyScope(row.permissions),
+    };
+}
+//# sourceMappingURL=scoped-keys.js.map

package/dist/server/scoped-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scoped-keys.js","sourceRoot":"","sources":["../../server/scoped-keys.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EACL,gBAAgB,GAGjB,MAAM,4CAA4C,CAAC;AAQpD,OAAO,EACL,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,aAAa,GAMd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAsB,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAqB,MAAM,aAAa,CAAC;AAElE,uDAAuD;AACvD,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAQ1C,2DAA2D;AAC3D,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAEhC;IACA;IAFX,YACW,MAAuB,EACvB,IAAY,EACrB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAJN,WAAM,GAAN,MAAM,CAAiB;QACvB,SAAI,GAAJ,IAAI,CAAQ;QAIrB,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAuCD,MAAM,WAAW,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AACjC,MAAM,QAAQ,GAAG,GAAG,CAAC;AACrB,MAAM,eAAe,GAAG,GAAG,CAAC;AAE5B;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAyC,EACzC,IAAyC;IAEzC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAC;IACnD,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;SAC1C,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;SAC3C,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IAC5D,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;IAC/C,OAAO,GAAG,EAAE;QACV,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK;gBAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;IAC5E,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,aAAa;IAIK;IAHZ,QAAQ,GAAG,IAAI,OAAO,EAAqC,CAAC;IACrE,YAAY,GAAwB,IAAI,CAAC;IAEjD,YAA6B,OAA6B;QAA7B,YAAO,GAAP,OAAO,CAAsB;IAAG,CAAC;IAE9D;;;OAGG;IACH,eAAe,CAAC,MAAoB;QAClC,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC;QAC3B,OAAO,GAAG,EAAE;YACV,IAAI,IAAI,CAAC,YAAY,KAAK,MAAM;gBAAE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QAC7D,CAAC,CAAC;IACJ,CAAC;IAED,mHAAmH;IACnH,KAAK,CAAC,YAAY,CAAC,MAAc;QAC/B,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,CAAC;IAED,kGAAkG;IAClG,KAAK,CAAC,kBAAkB,CAAC,MAAc;QACrC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,IAAI,kBAAkB,CAC1B,GAAG,EACH,4BAA4B,EAC5B,0CAA0C,CAC3C,CAAC;IACN,CAAC;IAED,IAAY,gBAAgB;QAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,EAAE,gBAAgB,CAAC;QACxD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;YACtE,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAED,0GAA0G;IAC1G,KAAK,CAAC,UAAU,CAAC,MAAc;QAC7B,MAAM,SAAS,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC;QAC7C,OAAO;YACL,SAAS;YACT,QAAQ,EAAE;gBACR,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,GAAG,EAAE;gBAClC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aAC7D;SACF,CAAC;IACJ,CAAC;IAED,oFAAoF;IACpF,KAAK,CAAC,YAAY,CAAC,MAAc;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACxE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACpD,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CACpC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,SAAS,CAC7C,CAAC;YACF,MAAM,IAAI,GAAsD,EAAE,CAAC;YACnE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;gBAC1D,qFAAqF;gBACrF,IAAI,CAAC,KAAK,CAAC,GAAG,OAAO;oBACnB,CAAC,CAAC,CACE,MAAM,OAAO,CAAC,GAAG,CACf,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,CACzC,CACE,MAAM,OAAO,CAAC,GAAG,CACf,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACrB,OAAO,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAClC,CACF,CACF,CAAC,IAAI,CAAC,OAAO,CAAC,CAChB,CACF,CACF,CAAC,KAAK,CAAC,OAAO,CAAC;oBAClB,CAAC,CAAC,IAAI,CAAC;YACX,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;gBACtC,MAAM;gBACN,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,IAAI;gBACJ,OAAO,EAAE,KAAK,CAAC,OAAO;oBACpB,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE;oBAClE,CAAC,CAAC,IAAI;aACT,CAAC;QACJ,CAAC,CAAC,CACH,CAAC;QACF,OAAO;YACL,MAAM;YACN,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAC3D,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,IAAI;gBACvC,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,IAAI;aAC5C,CAAC,CAAC;YACH,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,oBAAoB,EAAE,IAAI,CAAC,GAAG,CAC5B,uBAAuB,EACvB,IAAI,CAAC,gBAAgB,IAAI,uBAAuB,CACjD;SACF,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,YAAY,CAChB,OAAe,EACf,QAA+B,EAC/B,QAAwE,EAAE;QAE1E,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM;YACT,MAAM,IAAI,kBAAkB,CAC1B,GAAG,EACH,qBAAqB,EACrB,GAAG,OAAO,iCAAiC,CAC5C,CAAC;QACJ,OAAO,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,kEAAkE;IAClE,KAAK,CAAC,IAAI,CAAC,MAAc;QACvB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO;aAC5B,UAAU,EAAE;aACZ,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC;aAC1B,SAAS,EAAE;aACX,KAAK,CAAC,aAAa,EAAE,GAAG,EAAE,MAAM,CAAC;aACjC,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,SAAS,CAAC;aACjC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC;aAC5B,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;aACpB,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAwB,CAAC,CAAC,CAAC;IAC7D,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CACV,MAAc,EACd,KAAc,EACd,QAA+B;QAE/B,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC/D,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,KAAK,CACT,KAAc,EACd,QAA+B;QAE/B,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAE,CAAC;QACtD,MAAM,WAAW,GAAG,IAAI,CACtB,IAAI,CAAC,WAAW,EAChB,aAAa,EACb,eAAe,EACf,KAAK,CACN,CAAC;QACF,MAAM,KAAK,GACT,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;YAC7C,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,KAAK;YAAE,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACpD,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC;QACxE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;IACrD,CAAC;IAED,qCAAqC;IACrC,YAAY,CAAC,MAAc,EAAE,KAAoB;QAC/C,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;IAED,8BAA8B;IAC9B,KAAK,CAAC,GAAG,CAAC,MAAc,EAAE,KAAa;QACrC,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IACtD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,KAAa;QACxC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACxE,MAAM,QAAQ,GACZ,OAAO,IAAI,OAAO;YAChB,CAAC,CAAC,IAAI,CAAC,GAAG,CACN,CAAC,EACD,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,GAAG,UAAU,CAAC,CACjE;YACH,CAAC,CAAC,IAAI,CAAC;QACX,iHAAiH;QACjH,kFAAkF;QAClF,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAgB,SAAS,CAAC,CAAC;QACxE,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC;YACzC,IAAI,EAAE;gBACJ,MAAM;gBACN,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,SAAS;gBAC3B,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,GAAG,WAAW,EAAE,CAAC;aACpE;SACF,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO;aAC7B,UAAU,EAAE;aACZ,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC;aAC1B,MAAM,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;aACzE,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC;aAC1B,gBAAgB,EAOb,CAAC;QACP,IAAI,CAAC;YACH,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;YAC/D,8GAA8G;YAC9G,6EAA6E;YAC7E,MAAM,IAAI,CAAC,OAAO;iBACf,UAAU,EAAE;iBACZ,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC;iBAC3B,GAAG,CAAC;gBACH,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B,CAAC;iBACD,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC;iBACvB,OAAO,EAAE,CAAC;QACf,CAAC;gBAAS,CAAC;YACT,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO;YACL,GAAG,EAAE,MAAM,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACjD,MAAM,EAAE,KAAK,CAAC,GAAG;SAClB,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CACZ,MAAc,EACd,KAAa,EACb,KAAc,EACd,QAA+B;QAE/B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACjD,IAAI,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,IAAI;YAC1C,MAAM,IAAI,kBAAkB,CAC1B,GAAG,EACH,gBAAgB,EAChB,kCAAkC,CACnC,CAAC;QACJ,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACzC,MAAM,IAAI,CAAC,OAAO;aACf,UAAU,EAAE;aACZ,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC;aAC3B,GAAG,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;aAC3D,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC;aACvB,OAAO,EAAE,CAAC;QACb,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,MAAM,CACV,MAAc,EACd,KAAa,EACb,KAAc;QAEd,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,GACR,IAAI,CAAC,IAAI,KAAK,SAAS;YACrB,CAAC,CAAC,GAAG,CAAC,IAAI;YACV,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC9C,MAAM,WAAW,GACf,IAAI,CAAC,WAAW,KAAK,SAAS;YAC5B,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC;YAC7B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,EAAE,eAAe,EAAE,KAAK,CAAC,CAAC;QACpE,MAAM,IAAI,CAAC,OAAO;aACf,UAAU,EAAE;aACZ,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC;aAC3B,GAAG,CAAC;YACH,IAAI;YACJ,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI;SAC/D,CAAC;aACD,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC;aACvB,OAAO,EAAE,CAAC;QACb,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,KAAa;QACxC,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACrC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED,6DAA6D;IAC7D,KAAK,CAAC,SAAS,CAAC,MAAc;QAC5B,MAAM,IAAI,CAAC,OAAO;aACf,UAAU,EAAE;aACZ,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC;aAC1B,KAAK,CAAC,aAAa,EAAE,GAAG,EAAE,MAAM,CAAC;aACjC,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,SAAS,CAAC;aACjC,OAAO,EAAE,CAAC;IACf,CAAC;IAED;;;OAGG;IACH,OAAO,CACL,OAAiC,EACjC,OAAgB;QAEhB,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC7C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACnC,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,MAAM,CAClB,OAAiC,EACjC,OAAgB;QAEhB,kHAAkH;QAClH,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,cAAc,CAAC,CAAC;YAC9D,OAAO,IAAI,CAAC;QACd,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO;aAC3B,UAAU,EAAE;aACZ,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC;aAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;aAC7B,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;aACpC,gBAAgB,EAAsC,CAAC;QAC1D,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC9C,IAAI,KAAK;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC7D,OAAO,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC;YACnC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YACvC,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAEO,KAAK,CAAC,KAAK,CACjB,MAAc,EACd,KAKC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAgB,SAAS,CAAC,CAAC;QACxE,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC;YAC3C,IAAI,EAAE;gBACJ,MAAM;gBACN,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,IAAI;oBAC9B,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,aAAa,GAAG,WAAW,EAAE,CAAC;gBACrD,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACrE;SACF,CAAC,CAAC;QACH,kHAAkH;QAClH,uCAAuC;QACvC,IAAI,KAAK,CAAC,WAAW;YACnB,MAAM,IAAI,CAAC,OAAO;iBACf,UAAU,EAAE;iBACZ,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC;iBAC3B,GAAG,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;iBACrE,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC;iBAC5B,OAAO,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QACtD,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;IACnD,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,KAAa;QAChC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAgB,SAAS,CAAC,CAAC;QACxE,MAAM,SAAS,CAAC,kBAAkB,CAAC;YACjC,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE;SACrC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,KAAa;QACpD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO;aAC3B,UAAU,EAAE;aACZ,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC;aAC1B,SAAS,EAAE;aACX,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC;aACvB,KAAK,CAAC,aAAa,EAAE,GAAG,EAAE,MAAM,CAAC;aACjC,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,SAAS,CAAC;aACjC,gBAAgB,EAAU,CAAC;QAC9B,IAAI,CAAC,GAAG;YACN,MAAM,IAAI,kBAAkB,CAAC,GAAG,EAAE,eAAe,EAAE,oBAAoB,CAAC,CAAC;QAC3E,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,KAAoB,EACpB,QAA+B;QAE/B,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5D,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,CAAC,MAAM;gBAAE,SAAS;YACtB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC3D,MAAM,KAAK,GAAG,IAAI,GAAG,CACnB,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAC9D,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAClB,CACF,CAAC;YACF,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YACtD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;gBACpB,MAAM,IAAI,gBAAgB,CACxB,sBAAsB,EACtB,GAAG,OAAO,kBAAkB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CACjE,CAAC;QACN,CAAC;IACH,CAAC;IAEO,QAAQ,CAAC,KAAc,EAAE,MAAe;QAC9C,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC;QAClD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAC1C,IAAI,GAAG,KAAK,IAAI;gBACd,MAAM,IAAI,kBAAkB,CAC1B,GAAG,EACH,iBAAiB,EACjB,+BAA+B,GAAG,QAAQ,CAC3C,CAAC;YACJ,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IACE,OAAO,KAAK,KAAK,QAAQ;YACzB,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;YACxB,KAAK,GAAG,CAAC;YACT,KAAK,GAAG,GAAG;YACX,CAAC,GAAG,KAAK,IAAI,IAAI,KAAK,GAAG,GAAG,CAAC;YAE7B,MAAM,IAAI,kBAAkB,CAC1B,GAAG,EACH,gBAAgB,EAChB,0DAA0D,GAAG,IAAI,GAAG,YAAY,CACjF,CAAC;QACJ,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,IAAI,CACX,KAAc,EACd,IAAY,EACZ,GAAW,EACX,QAAiB;IAEjB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QAC1D,IAAI,QAAQ;YACV,MAAM,IAAI,kBAAkB,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,IAAI,eAAe,CAAC,CAAC;QAC3E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,GAAG;QACxD,MAAM,IAAI,kBAAkB,CAC1B,GAAG,EACH,aAAa,EACb,GAAG,IAAI,4BAA4B,GAAG,cAAc,CACrD,CAAC;IACJ,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO,IAAI,QAAQ;QACtB,MAAM,IAAI,kBAAkB,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,IAAI,eAAe,CAAC,CAAC;IAC3E,OAAO,OAAO,IAAI,IAAI,CAAC;AACzB,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,YAAY,IAAI;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ;QACxD,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACjC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACvD,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACpD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,GAAG,CAAC,KAAc;IACzB,OAAO,SAAS,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,IAAI,IAAI,CAAC;AACjD,CAAC;AAED,SAAS,aAAa,CAAC,QAAiB;IACtC,IAAI,KAAK,GAAY,QAAQ,CAAC;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAY,CAAC;YACrC,sDAAsD;YACtD,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAY,CAAC;QACtE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,OAAO,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7E,CAAC;AAED,SAAS,MAAM,CAAC,GAAW;IACzB,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,WAAW,EAAE,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC;QACxC,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,OAAO,EACL,OAAO,GAAG,CAAC,OAAO,KAAK,SAAS;YAC9B,CAAC,CAAC,GAAG,CAAC,OAAO;YACb,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC;QAC/B,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;QAC1D,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC;QAC7B,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC;QAChC,KAAK,EAAE,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC;KACvC,CAAC;AACJ,CAAC"}