@oneuptime/common 12.0.12 → 12.0.14

package/build/dist/Server/Middleware/UserAuthorization.js.map

@@ -1 +1 @@
-{"version":3,"file":"UserAuthorization.js","sourceRoot":"","sources":["../../../../Server/Middleware/UserAuthorization.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,kBAAkB,MAAM,gCAAgC,CAAC;AAChE,OAAO,mBAAmB,MAAM,iCAAiC,CAAC;AAClE,OAAO,cAAc,MAAM,4BAA4B,CAAC;AACxD,OAAO,iBAAiB,MAAM,+BAA+B,CAAC;AAC9D,OAAO,WAAW,MAAM,yBAAyB,CAAC;AAClD,OAAO,UAAU,MAAM,iBAAiB,CAAC;AAOzC,OAAO,WAAW,MAAM,gCAAgC,CAAC;AACzD,OAAO,YAAY,MAAM,uBAAuB,CAAC;AACjD,OAAO,MAAM,EAAE,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,QAAQ,MAAM,mBAAmB,CAAC;AACzC,OAAO,iBAAiB,MAAM,wBAAwB,CAAC;AACvD,OAAO,QAAQ,MAAM,6BAA6B,CAAC;AAGnD,OAAO,yBAAyB,MAAM,iDAAiD,CAAC;AACxF,OAAO,yBAAyB,MAAM,iDAAiD,CAAC;AACxF,OAAO,uBAAuB,MAAM,+CAA+C,CAAC;AACpF,OAAO,YAAY,MAAM,0BAA0B,CAAC;AAEpD,OAAO,aAAa,MAAM,2BAA2B,CAAC;AAEtD,OAAO,QAAQ,MAAM,sBAAsB,CAAC;AAC5C,OAAO,eAAe,MAAM,iCAAiC,CAAC;AAC9D,OAAO,sBAAsB,MAAM,8CAA8C,CAAC;AAClF,OAAmB,EACjB,gBAAgB,GAIjB,MAAM,wBAAwB,CAAC;AAChC,OAAO,QAAQ,MAAM,sBAAsB,CAAC;AAC5C,OAAO,kBAAkB,MAAM,wCAAwC,CAAC;AAExE,MAAM,CAAC,OAAO,OAAO,cAAc;IACjC;;;;;OAKG;IAGW,AAAP,MAAM,CAAC,wBAAwB,CACpC,GAAmB;QAEnB,IAAI,WAAW,GAAuB,SAAS,CAAC;QAEhD,IACE,UAAU,CAAC,2BAA2B,CAAC,GAAG,EAAE,UAAU,CAAC,eAAe,EAAE,CAAC,EACzE,CAAC;YACD,WAAW,GAAG,UAAU,CAAC,2BAA2B,CAClD,GAAG,EACH,UAAU,CAAC,eAAe,EAAE,CAC7B,CAAC;QACJ,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;IAGa,AAAP,MAAM,CAAC,gCAAgC,CAC5C,GAAmB;QAEnB,8CAA8C;QAC9C,MAAM,WAAW,GACf,UAAU,CAAC,2BAA2B,CAAC,GAAG,EAAE,UAAU,CAAC,eAAe,EAAE,CAAC,CAAC;QAE5E,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,4EAA4E;QAC5E,MAAM,UAAU,GAAuB,GAAG,CAAC,OAAO,CAAC,eAAe,CAErD,CAAC;QACd,IAAI,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACnD,OAAO,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACjC,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAGa,AAAP,MAAM,CAAC,YAAY,CAAC,GAAmB;;QAC5C,MAAM,SAAS,GAAuB,EAAE,CAAC;QAEzC,+BAA+B;QAE/B,MAAM,OAAO,GAAuB,UAAU,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAElE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACvC,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC;gBAC3C,MAAM,KAAK,GAAuC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAC/D,IAAI,SAAS,GAAuB,SAAS,CAAC;gBAE9C,IAAI,CAAC;oBACH,SAAS,GAAG,MAAA,YAAY,CAAC,MAAM,CAC7B,KAAe,CAChB,CAAC,SAAS,0CAAE,QAAQ,EAAE,CAAC;gBAC1B,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,CAAC,KAAK,CACV,GAAG,EACH,2BAA2B,CAAC,GAAuB,CAAC,CACrD,CAAC;oBACF,SAAS;gBACX,CAAC;gBAED,IACE,SAAS;oBACT,KAAK;oBACL,OAAO,KAAK,KAAK,QAAQ;oBACzB,OAAO,SAAS,KAAK,QAAQ,EAC7B,CAAC;oBACD,SAAS,CAAC,SAAS,CAAC,GAAG,OAAO,CAAC,GAAG,CAAW,CAAC;gBAChD,CAAC;YACH,CAAC;QACH,CAAC;QAED;;;WAGG;QACH,MAAM,eAAe,GAAuB,GAAG,CAAC,OAAO,CAAC,cAAc,CAEzD,CAAC;QAEd,IAAI,eAAe,EAAE,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,YAAY,GAChB,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;gBAE9B,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;oBAClD,MAAM,KAAK,GAAuB,YAAY,CAAC,SAAS,CAAC,CAAC;oBAE1D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;wBACxC,SAAS;oBACX,CAAC;oBAED,IAAI,CAAC;wBACH,MAAM,OAAO,GAAqB,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;wBAE7D,IAAI,CAAA,MAAA,OAAO,CAAC,SAAS,0CAAE,QAAQ,EAAE,MAAK,SAAS,EAAE,CAAC;4BAChD,SAAS,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC;wBAC/B,CAAC;oBACH,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,MAAM,CAAC,KAAK,CACV,GAAG,EACH,2BAA2B,CAAC,GAAuB,CAAC,CACrD,CAAC;wBACF,SAAS;oBACX,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,2BAA2B,CAAC,GAAuB,CAAC,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,sBAAsB,CACnC,WAA6B,EAC7B,qBAA4C;QAE5C,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,eAAe,GAAuB,WAAW,CAAC,aAAa;YACnE,CAAC,CAAC,WAAW,CAAC,aAAa,CAAC,QAAQ,EAAE;YACtC,CAAC,CAAC,SAAS,CAAC;QAEd,OAAO,OAAO,CACZ,eAAe,IAAI,eAAe,KAAK,qBAAqB,CAAC,QAAQ,EAAE,CACxE,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IAEW,AAAP,MAAM,CAAC,qBAAqB,CACjC,GAAmB;QAEnB,IAAI,QAAQ,GAAuB,UAAU,CAAC,2BAA2B,CACvE,GAAG,EACH,UAAU,CAAC,eAAe,EAAE,CAC7B,CAAC;QAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,WAAW,GAAuB,GAAG,CAAC,OAAO,CACjD,oBAAoB,CACC,CAAC;YACxB,IAAI,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;gBACnD,QAAQ,GAAG,WAAW,CAAC;YACzB,CAAC;QACH,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,MAAM,WAAW,GAAqB,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAEpE,IACE,WAAW,CAAC,eAAe,KAAK,eAAe,CAAC,SAAS;gBACzD,WAAW,CAAC,eAAe,KAAK,eAAe,CAAC,UAAU,EAC1D,CAAC;gBACD,OAAO,WAAW,CAAC;YACrB,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,2BAA2B,CAAC,GAAuB,CAAC,CAAC,CAAC;YACxE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAGa,AAAP,MAAM,CAAC,2BAA2B,CACvC,GAAmB,EACnB,SAAmB,EACnB,MAAgB,EAChB,qBAA4C;;QAE5C,MAAM,SAAS,GAAuB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAE7D;;WAEG;QACH,IAAI,SAAS,IAAI,SAAS,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC;YACjD,MAAM,WAAW,GAAqB,YAAY,CAAC,MAAM,CACvD,SAAS,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAW,CAC1C,CAAC;YACF,IACE,CAAA,MAAA,WAAW,CAAC,SAAS,0CAAE,QAAQ,EAAE,MAAK,SAAS,CAAC,QAAQ,EAAE;gBAC1D,WAAW,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,MAAM,CAAC,QAAQ,EAAE;gBACnD,IAAI,CAAC,sBAAsB,CAAC,WAAW,EAAE,qBAAqB,CAAC,EAC/D,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED;;;;;;WAMG;QACH,MAAM,kBAAkB,GACtB,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAElC,IACE,kBAAkB;YAClB,kBAAkB,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,MAAM,CAAC,QAAQ,EAAE;YAC1D,IAAI,CAAC,sBAAsB,CAAC,kBAAkB,EAAE,qBAAqB,CAAC,EACtE,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAGmB,AAAb,MAAM,CAAC,KAAK,CAAC,iBAAiB,CACnC,GAAmB,EACnB,GAAoB,EACpB,IAAkB;QAElB,MAAM,QAAQ,GAAoB,iBAAiB,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QACtE,MAAM,gBAAgB,GAAqB,GAAuB,CAAC;QAEnE,IAAI,QAAQ,EAAE,CAAC;YACb,gBAAgB,CAAC,QAAQ,GAAG,QAAQ,CAAC;YAErC;;;;eAIG;YACH,KAAK,cAAc,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACjD,CAAC;QAED,IAAI,iBAAiB,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YACrC,OAAO,MAAM,iBAAiB,CAAC,mCAAmC,CAChE,GAAG,EACH,GAAG,EACH,IAAI,CACL,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GACf,cAAc,CAAC,gCAAgC,CAAC,GAAG,CAAC,CAAC;QAEvD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,gBAAgB,CAAC,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC;YAC5C,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,IAAI,CAAC;YACH,gBAAgB,CAAC,iBAAiB,GAAG,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACxE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mFAAmF;YACnF,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,2BAA2B,CAAC,gBAAgB,CAAC,CAAC,CAAC;YACjE,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,yBAAyB,CAC3B,+DAA+D,CAChE,CACF,CAAC;QACJ,CAAC;QAED,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,aAAa,EAAE,CAAC;YACrD,gBAAgB,CAAC,QAAQ,GAAG,QAAQ,CAAC,WAAW,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,gBAAgB,CAAC,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC;QAC5C,CAAC;QAED,MAAM,MAAM,GAAW,gBAAgB,CAAC,iBAAiB,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QAE5E,uEAAuE;QACvE,QAAQ,CAAC,0BAA0B,+BACjC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,IAChC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACpD,CAAC,gBAAgB,CAAC,SAAS;YAC5B,CAAC,CAAC,EAAE,SAAS,EAAE,gBAAgB,CAAC,SAAS,EAAE;YAC3C,CAAC,CAAC,EAAE,CAAC,EACP,CAAC;QAEH;;;WAGG;QACH,KAAK,WAAW,CAAC,gBAAgB,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAExD;;;;;;;;WAQG;QACH,MAAM,iCAAiC,GACrC,kBAAkB,CAAC,6BAA6B,CAC9C,gBAAgB,CAAC,iBAAiB,CAAC,MAAM,CAC1C,CAAC;QAEJ,IAAI,0BAA0B,GAAsC,IAAI,CAAC;QAEzE,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,MAAM,CAAC,gBAAgB,EAAE,0BAA0B,EAAE,WAAW,CAAC,GAI7D,MAAM,OAAO,CAAC,GAAG,CAAC;oBACpB,iCAAiC;oBACjC,cAAc,CAAC,yCAAyC,CAAC;wBACvD,GAAG;wBACH,QAAQ;wBACR,MAAM,EAAE,IAAI,QAAQ,CAAC,MAAM,CAAC;qBAC7B,CAAC;oBACF,iBAAiB,CAAC,iBAAiB,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC;iBACpE,CAAC,CAAC;gBAEH,0BAA0B,GAAG,gBAAgB,CAAC;gBAE9C,IAAI,0BAA0B,EAAE,CAAC;oBAC/B,gBAAgB,CAAC,0BAA0B;wBACzC,0BAA0B,CAAC;gBAC/B,CAAC;gBAED,IAAI,0BAA0B,EAAE,CAAC;oBAC/B,gBAAgB,CAAC,0BAA0B,GAAG,EAAE,CAAC;oBACjD,gBAAgB,CAAC,0BAA0B,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;wBAC9D,0BAA0B,CAAC;gBAC/B,CAAC;gBAED;;;;;mBAKG;gBACH,gBAAgB,CAAC,WAAW,GAAG,WAAW,CAAC;YAC7C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,QAAQ,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,KAAkB,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,0BAA0B,GAAG,MAAM,iCAAiC,CAAC;YAErE,IAAI,0BAA0B,EAAE,CAAC;gBAC/B,gBAAgB,CAAC,0BAA0B;oBACzC,0BAA0B,CAAC;YAC/B,CAAC;QACH,CAAC;QAED,IAAI,GAAG,CAAC,OAAO,CAAC,uBAAuB,CAAC,EAAE,CAAC;YACzC,IACE,0BAA0B;gBAC1B,0BAA0B,CAAC,UAAU;gBACrC,0BAA0B,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAChD,CAAC;gBACD,MAAM,0BAA0B,GAC9B,MAAM,cAAc,CAAC,2CAA2C,CAC9D,GAAG,EACH,IAAI,QAAQ,CAAC,MAAM,CAAC,EACpB,0BAA0B,CAAC,UAAU,CACtC,CAAC;gBAEJ,IAAI,0BAA0B,EAAE,CAAC;oBAC/B,gBAAgB,CAAC,0BAA0B;wBACzC,0BAA0B,CAAC;gBAC/B,CAAC;YACH,CAAC;QACH,CAAC;QAED,uBAAuB;QAEvB,IAAI,gBAAgB,CAAC,0BAA0B,EAAE,CAAC;YAChD,MAAM,eAAe,GAAe,aAAa,CAAC,SAAS,CACzD,gBAAgB,CAAC,0BAA0B,CAC5C,CAAC;YACF,MAAM,WAAW,GAAW,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;YAC5D,MAAM,qBAAqB,GAAW,MAAM,YAAY,CAAC,SAAS,CAChE,WAAW,EACX,IAAI,CACL,CAAC;YACF,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC;YAC3C,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,qBAAqB,CAAC,CAAC;QAC5D,CAAC;QAED,gCAAgC;QAChC,IACE,gBAAgB,CAAC,0BAA0B;YAC3C,QAAQ;YACR,gBAAgB,CAAC,0BAA0B,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,EAChE,CAAC;YACD,MAAM,YAAY,GAAW,IAAI,CAAC,SAAS,CACzC,aAAa,CAAC,SAAS,CACrB,gBAAgB,CAAC,0BAA0B,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAE,CAClE,CACF,CAAC;YAEF,MAAM,sBAAsB,GAAW,MAAM,YAAY,CAAC,SAAS,CACjE,YAAY,EACZ,IAAI,CACL,CAAC;YAEF,IACE,CAAC,CACC,GAAG,CAAC,OAAO;gBACX,GAAG,CAAC,OAAO,CAAC,0BAA0B,CAAC;gBACvC,GAAG,CAAC,OAAO,CAAC,0BAA0B,CAAC,KAAK,sBAAsB,CACnE,EACD,CAAC;gBACD,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,YAAY,CAAC,CAAC;gBAC7C,GAAG,CAAC,GAAG,CAAC,0BAA0B,EAAE,sBAAsB,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;QAED,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAGmB,AAAb,MAAM,CAAC,KAAK,CAAC,yBAAyB,CAC3C,GAAmB,EACnB,GAAoB,EACpB,IAAkB;QAElB,MAAM,gBAAgB,GAAqB,GAAuB,CAAC;QAEnE,IACE,CAAC,gBAAgB,CAAC,QAAQ;YAC1B,gBAAgB,CAAC,QAAQ,KAAK,QAAQ,CAAC,MAAM,EAC7C,CAAC;YACD,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,yBAAyB,CAC3B,iEAAiE,CAClE,CACF,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAEM,MAAM,CAAC,iBAAiB,CAAC,IAE/B;QAKC,OAAO,KAAK,EACV,GAAmB,EACnB,GAAoB,EACpB,IAAkB,EACH,EAAE;;YACjB,MAAM,gBAAgB,GAAqB,GAAuB,CAAC;YAEnE,yCAAyC;YACzC,IAAI,gBAAgB,CAAC,QAAQ,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC;gBACvD,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YAED,MAAM,QAAQ,GAAyB,gBAAgB,CAAC,QAAQ,CAAC;YAEjE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,sBAAsB,CACxB,iDAAiD,CAClD,CACF,CAAC;YACJ,CAAC;YAED,MAAM,oBAAoB,GACxB,MAAA,gBAAgB,CAAC,0BAA0B,0CAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;YAErE,IAAI,CAAC,oBAAoB,EAAE,CAAC;gBAC1B,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,sBAAsB,CACxB,oDAAoD,CACrD,CACF,CAAC;YACJ,CAAC;YAED,MAAM,eAAe,GACnB,oBAAoB,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAiB,EAAE,EAAE;gBACzD,OAAO,CAAC,CAAC,UAAU,CAAC;YACtB,CAAC,CAAC,CAAC;YAEL,IACE,CAAC,gBAAgB,CAAC,wBAAwB,CACxC,eAAe,EACf,IAAI,CAAC,WAAW,CACjB,EACD,CAAC;gBACD,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,sBAAsB,CACxB,iEAAiE,CAClE,CACF,CAAC;YACJ,CAAC;YAED,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC,CAAC;IACJ,CAAC;IAGmB,AAAb,MAAM,CAAC,KAAK,CAAC,yCAAyC,CAAC,IAI7D;;QACC,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAEvC,MAAM,aAAa,GACjB,CAAA,MAAC,GAAwB,CAAC,iBAAiB,0CAAE,aAAa,MAAK,IAAI,CAAC;QAEtE;;;;WAIG;QACH,MAAM,CAAC,yBAAyB,EAAE,gBAAgB,CAAC,GAG/C,MAAM,OAAO,CAAC,GAAG,CAAC;YACpB,cAAc,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,GAAU,EAAE,EAAE;gBAClE;;;mBAGG;gBACH,IAAI,GAAG,CAAC,OAAO,KAAK,mBAAmB,EAAE,CAAC;oBACxC,MAAM,IAAI,uBAAuB,CAAC,kBAAkB,CAAC,CAAC;gBACxD,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC,CAAC;YACF,kBAAkB,CAAC,6BAA6B,CAAC,MAAM,EAAE,QAAQ,CAAC;SACnE,CAAC,CAAC;QAEH;;;;;WAKG;QACH,IAAI,kBAAkB,GAAY,yBAAyB,CAAC;QAC5D,IAAI,CAAC,kBAAkB,IAAI,CAAC,aAAa,EAAE,CAAC;YAC1C,kBAAkB;gBAChB,MAAM,mBAAmB,CAAC,qBAAqB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;oBAC3D,OAAO,KAAK,CAAC;gBACf,CAAC,CAAC,CAAC;QACP,CAAC;QAED,IAAI,kBAAkB,EAAE,CAAC;YACvB;;;eAGG;YACH,MAAM,qBAAqB,GACzB,MAAM,cAAc,CAAC,8BAA8B,CAAC,QAAQ,CAAC,CAAC,KAAK,CACjE,GAAG,EAAE;gBACH,OAAO,IAAI,CAAC;YACd,CAAC,CACF,CAAC;YAEJ,IACE,CAAC,cAAc,CAAC,2BAA2B,CACzC,GAAG,EACH,QAAQ,EACR,MAAM,EACN,qBAAqB,aAArB,qBAAqB,cAArB,qBAAqB,GAAI,SAAS,CACnC,EACD,CAAC;gBACD,MAAM,IAAI,yBAAyB,EAAE,CAAC;YACxC,CAAC;QACH,CAAC;QAED,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAGmB,AAAb,MAAM,CAAC,KAAK,CAAC,2CAA2C,CAC7D,GAAmB,EACnB,MAAgB,EAChB,UAAsB;;QAEtB,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,aAAa,GACjB,CAAA,MAAC,GAAwB,CAAC,iBAAiB,0CAAE,aAAa,MAAK,IAAI,CAAC;QAEtE;;;WAGG;QACH,MAAM,wBAAwB,GAAY,aAAa;YACrD,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,MAAM,mBAAmB,CAAC,qBAAqB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;gBAC3D,OAAO,KAAK,CAAC;YACf,CAAC,CAAC,CAAC;QAEP;;;;WAIG;QACH,MAAM,QAAQ,GAGT,MAAM,OAAO,CAAC,GAAG,CACpB,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,SAAmB,EAAE,EAAE;YAC3C,MAAM,yBAAyB,GAC7B,MAAM,cAAc,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;gBAC/D;;;mBAGG;gBACH,OAAO,KAAK,CAAC;YACf,CAAC,CAAC,CAAC;YAEL,MAAM,kBAAkB,GACtB,yBAAyB,IAAI,wBAAwB,CAAC;YAExD,IAAI,kBAAkB,EAAE,CAAC;gBACvB,MAAM,qBAAqB,GACzB,MAAM,cAAc,CAAC,8BAA8B,CACjD,SAAS,CACV,CAAC,KAAK,CAAC,GAAG,EAAE;oBACX,OAAO,IAAI,CAAC;gBACd,CAAC,CAAC,CAAC;gBAEL,IACE,CAAC,cAAc,CAAC,2BAA2B,CACzC,GAAG,EACH,SAAS,EACT,MAAM,EACN,qBAAqB,aAArB,qBAAqB,cAArB,qBAAqB,GAAI,SAAS,CACnC,EACD,CAAC;oBACD,OAAO;wBACL,SAAS;wBACT,UAAU,EACR,kBAAkB,CAAC,oCAAoC,CACrD,SAAS,CACV;qBACJ,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,OAAO;gBACL,SAAS;gBACT,UAAU,EAAE,MAAM,kBAAkB,CAAC,6BAA6B,CAChE,MAAM,EACN,SAAS,CACV;aACF,CAAC;QACJ,CAAC,CAAC,CACH,CAAC;QAEF,IAAI,MAAM,GAAkD,IAAI,CAAC;QACjE,KAAK,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,QAAQ,EAAE,CAAC;YACjD,IAAI,UAAU,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,GAAG,EAAE,CAAC;gBACd,CAAC;gBACD,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,GAAG,UAAU,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AA1rBe;IADb,WAAW,EAAE;;;;oDAgBb;AAGa;IADb,WAAW,EAAE;;;;4DAqBb;AAGa;IADb,WAAW,EAAE;;;;wCA4Eb;AAkCa;IADb,WAAW,EAAE;;;;iDAqCb;AAGa;IADb,WAAW,EAAE;;6CAGD,QAAQ;QACX,QAAQ;;uDAwCjB;AAGmB;IADnB,WAAW,EAAE;;;;6CA2Mb;AAGmB;IADnB,WAAW,EAAE;;;;qDAsBb;AAuEmB;IADnB,WAAW,EAAE;;;;qEAwEb;AAGmB;IADnB,WAAW,EAAE;;6CAGJ,QAAQ;;uEAyFjB"}
+{"version":3,"file":"UserAuthorization.js","sourceRoot":"","sources":["../../../../Server/Middleware/UserAuthorization.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,kBAAkB,MAAM,gCAAgC,CAAC;AAChE,OAAO,mBAAmB,MAAM,iCAAiC,CAAC;AAClE,OAAO,cAAc,MAAM,4BAA4B,CAAC;AACxD,OAAO,iBAAiB,MAAM,+BAA+B,CAAC;AAC9D,OAAO,WAAW,MAAM,yBAAyB,CAAC;AAClD,OAAO,UAAU,MAAM,iBAAiB,CAAC;AAOzC,OAAO,WAAW,MAAM,gCAAgC,CAAC;AACzD,OAAO,YAAY,MAAM,uBAAuB,CAAC;AACjD,OAAO,MAAM,EAAE,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,QAAQ,MAAM,mBAAmB,CAAC;AACzC,OAAO,iBAAiB,MAAM,wBAAwB,CAAC;AACvD,OAAO,QAAQ,MAAM,6BAA6B,CAAC;AAGnD,OAAO,yBAAyB,MAAM,iDAAiD,CAAC;AACxF,OAAO,yBAAyB,MAAM,iDAAiD,CAAC;AACxF,OAAO,uBAAuB,MAAM,+CAA+C,CAAC;AACpF,OAAO,YAAY,MAAM,0BAA0B,CAAC;AAEpD,OAAO,aAAa,MAAM,2BAA2B,CAAC;AAEtD,OAAO,QAAQ,MAAM,sBAAsB,CAAC;AAC5C,OAAO,eAAe,MAAM,iCAAiC,CAAC;AAC9D,OAAO,sBAAsB,MAAM,8CAA8C,CAAC;AAClF,OAAmB,EACjB,gBAAgB,GAIjB,MAAM,wBAAwB,CAAC;AAChC,OAAO,QAAQ,MAAM,sBAAsB,CAAC;AAC5C,OAAO,kBAAkB,MAAM,wCAAwC,CAAC;AAExE,MAAM,CAAC,OAAO,OAAO,cAAc;IACjC;;;;;OAKG;IAGW,AAAP,MAAM,CAAC,wBAAwB,CACpC,GAAmB;QAEnB,IAAI,WAAW,GAAuB,SAAS,CAAC;QAEhD,IACE,UAAU,CAAC,2BAA2B,CAAC,GAAG,EAAE,UAAU,CAAC,eAAe,EAAE,CAAC,EACzE,CAAC;YACD,WAAW,GAAG,UAAU,CAAC,2BAA2B,CAClD,GAAG,EACH,UAAU,CAAC,eAAe,EAAE,CAC7B,CAAC;QACJ,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;IAGa,AAAP,MAAM,CAAC,gCAAgC,CAC5C,GAAmB;QAEnB,8CAA8C;QAC9C,MAAM,WAAW,GACf,UAAU,CAAC,2BAA2B,CAAC,GAAG,EAAE,UAAU,CAAC,eAAe,EAAE,CAAC,CAAC;QAE5E,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,4EAA4E;QAC5E,MAAM,UAAU,GAAuB,GAAG,CAAC,OAAO,CAAC,eAAe,CAErD,CAAC;QACd,IAAI,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACnD,OAAO,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACjC,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAGa,AAAP,MAAM,CAAC,YAAY,CAAC,GAAmB;;QAC5C,MAAM,SAAS,GAAuB,EAAE,CAAC;QAEzC,+BAA+B;QAE/B,MAAM,OAAO,GAAuB,UAAU,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAElE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACvC,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC;gBAC3C,MAAM,KAAK,GAAuC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAC/D,IAAI,SAAS,GAAuB,SAAS,CAAC;gBAE9C,IAAI,CAAC;oBACH,SAAS,GAAG,MAAA,YAAY,CAAC,MAAM,CAC7B,KAAe,CAChB,CAAC,SAAS,0CAAE,QAAQ,EAAE,CAAC;gBAC1B,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,CAAC,KAAK,CACV,GAAG,EACH,2BAA2B,CAAC,GAAuB,CAAC,CACrD,CAAC;oBACF,SAAS;gBACX,CAAC;gBAED,IACE,SAAS;oBACT,KAAK;oBACL,OAAO,KAAK,KAAK,QAAQ;oBACzB,OAAO,SAAS,KAAK,QAAQ,EAC7B,CAAC;oBACD,SAAS,CAAC,SAAS,CAAC,GAAG,OAAO,CAAC,GAAG,CAAW,CAAC;gBAChD,CAAC;YACH,CAAC;QACH,CAAC;QAED;;;WAGG;QACH,MAAM,eAAe,GAAuB,GAAG,CAAC,OAAO,CAAC,cAAc,CAEzD,CAAC;QAEd,IAAI,eAAe,EAAE,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,YAAY,GAChB,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;gBAE9B,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;oBAClD,MAAM,KAAK,GAAuB,YAAY,CAAC,SAAS,CAAC,CAAC;oBAE1D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;wBACxC,SAAS;oBACX,CAAC;oBAED,IAAI,CAAC;wBACH,MAAM,OAAO,GAAqB,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;wBAE7D,IAAI,CAAA,MAAA,OAAO,CAAC,SAAS,0CAAE,QAAQ,EAAE,MAAK,SAAS,EAAE,CAAC;4BAChD,SAAS,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC;wBAC/B,CAAC;oBACH,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,MAAM,CAAC,KAAK,CACV,GAAG,EACH,2BAA2B,CAAC,GAAuB,CAAC,CACrD,CAAC;wBACF,SAAS;oBACX,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,2BAA2B,CAAC,GAAuB,CAAC,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,sBAAsB,CACnC,WAA6B,EAC7B,qBAA4C;QAE5C,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,eAAe,GAAuB,WAAW,CAAC,aAAa;YACnE,CAAC,CAAC,WAAW,CAAC,aAAa,CAAC,QAAQ,EAAE;YACtC,CAAC,CAAC,SAAS,CAAC;QAEd,OAAO,OAAO,CACZ,eAAe,IAAI,eAAe,KAAK,qBAAqB,CAAC,QAAQ,EAAE,CACxE,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IAEW,AAAP,MAAM,CAAC,qBAAqB,CACjC,GAAmB;QAEnB,IAAI,QAAQ,GAAuB,UAAU,CAAC,2BAA2B,CACvE,GAAG,EACH,UAAU,CAAC,eAAe,EAAE,CAC7B,CAAC;QAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,WAAW,GAAuB,GAAG,CAAC,OAAO,CACjD,oBAAoB,CACC,CAAC;YACxB,IAAI,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;gBACnD,QAAQ,GAAG,WAAW,CAAC;YACzB,CAAC;QACH,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,MAAM,WAAW,GAAqB,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAEpE,IACE,WAAW,CAAC,eAAe,KAAK,eAAe,CAAC,SAAS;gBACzD,WAAW,CAAC,eAAe,KAAK,eAAe,CAAC,UAAU,EAC1D,CAAC;gBACD,OAAO,WAAW,CAAC;YACrB,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,2BAA2B,CAAC,GAAuB,CAAC,CAAC,CAAC;YACxE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAGa,AAAP,MAAM,CAAC,2BAA2B,CACvC,GAAmB,EACnB,SAAmB,EACnB,MAAgB,EAChB,qBAA4C;;QAE5C,MAAM,SAAS,GAAuB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAE7D;;WAEG;QACH,IAAI,SAAS,IAAI,SAAS,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC;YACjD,MAAM,WAAW,GAAqB,YAAY,CAAC,MAAM,CACvD,SAAS,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAW,CAC1C,CAAC;YACF,IACE,CAAA,MAAA,WAAW,CAAC,SAAS,0CAAE,QAAQ,EAAE,MAAK,SAAS,CAAC,QAAQ,EAAE;gBAC1D,WAAW,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,MAAM,CAAC,QAAQ,EAAE;gBACnD,IAAI,CAAC,sBAAsB,CAAC,WAAW,EAAE,qBAAqB,CAAC,EAC/D,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED;;;;;;WAMG;QACH,MAAM,kBAAkB,GACtB,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAElC,IACE,kBAAkB;YAClB,kBAAkB,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,MAAM,CAAC,QAAQ,EAAE;YAC1D,IAAI,CAAC,sBAAsB,CAAC,kBAAkB,EAAE,qBAAqB,CAAC,EACtE,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAGmB,AAAb,MAAM,CAAC,KAAK,CAAC,iBAAiB,CACnC,GAAmB,EACnB,GAAoB,EACpB,IAAkB;QAElB,MAAM,QAAQ,GAAoB,iBAAiB,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QACtE,MAAM,gBAAgB,GAAqB,GAAuB,CAAC;QAEnE,IAAI,QAAQ,EAAE,CAAC;YACb,gBAAgB,CAAC,QAAQ,GAAG,QAAQ,CAAC;YAErC;;;;eAIG;YACH,KAAK,cAAc,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACjD,CAAC;QAED,IAAI,iBAAiB,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YACrC,OAAO,MAAM,iBAAiB,CAAC,mCAAmC,CAChE,GAAG,EACH,GAAG,EACH,IAAI,CACL,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GACf,cAAc,CAAC,gCAAgC,CAAC,GAAG,CAAC,CAAC;QAEvD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,gBAAgB,CAAC,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC;YAC5C,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,IAAI,CAAC;YACH,gBAAgB,CAAC,iBAAiB,GAAG,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACxE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mFAAmF;YACnF,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,2BAA2B,CAAC,gBAAgB,CAAC,CAAC,CAAC;YACjE,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,yBAAyB,CAC3B,+DAA+D,CAChE,CACF,CAAC;QACJ,CAAC;QAED,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,aAAa,EAAE,CAAC;YACrD,gBAAgB,CAAC,QAAQ,GAAG,QAAQ,CAAC,WAAW,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,gBAAgB,CAAC,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC;QAC5C,CAAC;QAED,MAAM,MAAM,GAAW,gBAAgB,CAAC,iBAAiB,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QAE5E,uEAAuE;QACvE,QAAQ,CAAC,0BAA0B,+BACjC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,IAChC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACpD,CAAC,gBAAgB,CAAC,SAAS;YAC5B,CAAC,CAAC,EAAE,SAAS,EAAE,gBAAgB,CAAC,SAAS,EAAE;YAC3C,CAAC,CAAC,EAAE,CAAC,EACP,CAAC;QAEH;;;WAGG;QACH,KAAK,WAAW,CAAC,gBAAgB,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAExD;;;;;;;;WAQG;QACH,MAAM,iCAAiC,GACrC,kBAAkB,CAAC,6BAA6B,CAC9C,gBAAgB,CAAC,iBAAiB,CAAC,MAAM,CAC1C,CAAC;QAEJ,IAAI,0BAA0B,GAAsC,IAAI,CAAC;QAEzE,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,MAAM,CAAC,gBAAgB,EAAE,0BAA0B,EAAE,WAAW,CAAC,GAI7D,MAAM,OAAO,CAAC,GAAG,CAAC;oBACpB,iCAAiC;oBACjC,cAAc,CAAC,yCAAyC,CAAC;wBACvD,GAAG;wBACH,QAAQ;wBACR,MAAM,EAAE,IAAI,QAAQ,CAAC,MAAM,CAAC;qBAC7B,CAAC;oBACF,iBAAiB,CAAC,iBAAiB,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC;iBACpE,CAAC,CAAC;gBAEH,0BAA0B,GAAG,gBAAgB,CAAC;gBAE9C,IAAI,0BAA0B,EAAE,CAAC;oBAC/B,gBAAgB,CAAC,0BAA0B;wBACzC,0BAA0B,CAAC;gBAC/B,CAAC;gBAED,IAAI,0BAA0B,EAAE,CAAC;oBAC/B,gBAAgB,CAAC,0BAA0B,GAAG,EAAE,CAAC;oBACjD,gBAAgB,CAAC,0BAA0B,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;wBAC9D,0BAA0B,CAAC;gBAC/B,CAAC;gBAED;;;;;mBAKG;gBACH,gBAAgB,CAAC,WAAW,GAAG,WAAW,CAAC;YAC7C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,QAAQ,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,KAAkB,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,0BAA0B,GAAG,MAAM,iCAAiC,CAAC;YAErE,IAAI,0BAA0B,EAAE,CAAC;gBAC/B,gBAAgB,CAAC,0BAA0B;oBACzC,0BAA0B,CAAC;YAC/B,CAAC;QACH,CAAC;QAED,IAAI,GAAG,CAAC,OAAO,CAAC,uBAAuB,CAAC,EAAE,CAAC;YACzC,IACE,0BAA0B;gBAC1B,0BAA0B,CAAC,UAAU;gBACrC,0BAA0B,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAChD,CAAC;gBACD,MAAM,0BAA0B,GAC9B,MAAM,cAAc,CAAC,2CAA2C,CAC9D,GAAG,EACH,IAAI,QAAQ,CAAC,MAAM,CAAC,EACpB,0BAA0B,CAAC,UAAU,CACtC,CAAC;gBAEJ,IAAI,0BAA0B,EAAE,CAAC;oBAC/B,gBAAgB,CAAC,0BAA0B;wBACzC,0BAA0B,CAAC;gBAC/B,CAAC;YACH,CAAC;QACH,CAAC;QAED,uBAAuB;QAEvB,IAAI,gBAAgB,CAAC,0BAA0B,EAAE,CAAC;YAChD,MAAM,eAAe,GAAe,aAAa,CAAC,SAAS,CACzD,gBAAgB,CAAC,0BAA0B,CAC5C,CAAC;YACF,MAAM,WAAW,GAAW,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;YAC5D,MAAM,qBAAqB,GAAW,MAAM,YAAY,CAAC,SAAS,CAChE,WAAW,EACX,IAAI,CACL,CAAC;YAEF,IACE,CAAC,CACC,GAAG,CAAC,OAAO;gBACX,GAAG,CAAC,OAAO,CAAC,yBAAyB,CAAC;gBACtC,GAAG,CAAC,OAAO,CAAC,yBAAyB,CAAC,KAAK,qBAAqB,CACjE,EACD,CAAC;gBACD,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC;gBAC3C,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,qBAAqB,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QAED,gCAAgC;QAChC,IACE,gBAAgB,CAAC,0BAA0B;YAC3C,QAAQ;YACR,gBAAgB,CAAC,0BAA0B,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,EAChE,CAAC;YACD,MAAM,YAAY,GAAW,IAAI,CAAC,SAAS,CACzC,aAAa,CAAC,SAAS,CACrB,gBAAgB,CAAC,0BAA0B,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAE,CAClE,CACF,CAAC;YAEF,MAAM,sBAAsB,GAAW,MAAM,YAAY,CAAC,SAAS,CACjE,YAAY,EACZ,IAAI,CACL,CAAC;YAEF,IACE,CAAC,CACC,GAAG,CAAC,OAAO;gBACX,GAAG,CAAC,OAAO,CAAC,0BAA0B,CAAC;gBACvC,GAAG,CAAC,OAAO,CAAC,0BAA0B,CAAC,KAAK,sBAAsB,CACnE,EACD,CAAC;gBACD,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,YAAY,CAAC,CAAC;gBAC7C,GAAG,CAAC,GAAG,CAAC,0BAA0B,EAAE,sBAAsB,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;QAED,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAGmB,AAAb,MAAM,CAAC,KAAK,CAAC,yBAAyB,CAC3C,GAAmB,EACnB,GAAoB,EACpB,IAAkB;QAElB,MAAM,gBAAgB,GAAqB,GAAuB,CAAC;QAEnE,IACE,CAAC,gBAAgB,CAAC,QAAQ;YAC1B,gBAAgB,CAAC,QAAQ,KAAK,QAAQ,CAAC,MAAM,EAC7C,CAAC;YACD,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,yBAAyB,CAC3B,iEAAiE,CAClE,CACF,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAEM,MAAM,CAAC,iBAAiB,CAAC,IAE/B;QAKC,OAAO,KAAK,EACV,GAAmB,EACnB,GAAoB,EACpB,IAAkB,EACH,EAAE;;YACjB,MAAM,gBAAgB,GAAqB,GAAuB,CAAC;YAEnE,yCAAyC;YACzC,IAAI,gBAAgB,CAAC,QAAQ,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC;gBACvD,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YAED,MAAM,QAAQ,GAAyB,gBAAgB,CAAC,QAAQ,CAAC;YAEjE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,sBAAsB,CACxB,iDAAiD,CAClD,CACF,CAAC;YACJ,CAAC;YAED,MAAM,oBAAoB,GACxB,MAAA,gBAAgB,CAAC,0BAA0B,0CAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;YAErE,IAAI,CAAC,oBAAoB,EAAE,CAAC;gBAC1B,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,sBAAsB,CACxB,oDAAoD,CACrD,CACF,CAAC;YACJ,CAAC;YAED,MAAM,eAAe,GACnB,oBAAoB,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAiB,EAAE,EAAE;gBACzD,OAAO,CAAC,CAAC,UAAU,CAAC;YACtB,CAAC,CAAC,CAAC;YAEL,IACE,CAAC,gBAAgB,CAAC,wBAAwB,CACxC,eAAe,EACf,IAAI,CAAC,WAAW,CACjB,EACD,CAAC;gBACD,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,sBAAsB,CACxB,iEAAiE,CAClE,CACF,CAAC;YACJ,CAAC;YAED,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC,CAAC;IACJ,CAAC;IAGmB,AAAb,MAAM,CAAC,KAAK,CAAC,yCAAyC,CAAC,IAI7D;;QACC,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAEvC,MAAM,aAAa,GACjB,CAAA,MAAC,GAAwB,CAAC,iBAAiB,0CAAE,aAAa,MAAK,IAAI,CAAC;QAEtE;;;;WAIG;QACH,MAAM,CAAC,yBAAyB,EAAE,gBAAgB,CAAC,GAG/C,MAAM,OAAO,CAAC,GAAG,CAAC;YACpB,cAAc,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,GAAU,EAAE,EAAE;gBAClE;;;mBAGG;gBACH,IAAI,GAAG,CAAC,OAAO,KAAK,mBAAmB,EAAE,CAAC;oBACxC,MAAM,IAAI,uBAAuB,CAAC,kBAAkB,CAAC,CAAC;gBACxD,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC,CAAC;YACF,kBAAkB,CAAC,6BAA6B,CAAC,MAAM,EAAE,QAAQ,CAAC;SACnE,CAAC,CAAC;QAEH;;;;;WAKG;QACH,IAAI,kBAAkB,GAAY,yBAAyB,CAAC;QAC5D,IAAI,CAAC,kBAAkB,IAAI,CAAC,aAAa,EAAE,CAAC;YAC1C,kBAAkB;gBAChB,MAAM,mBAAmB,CAAC,qBAAqB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;oBAC3D,OAAO,KAAK,CAAC;gBACf,CAAC,CAAC,CAAC;QACP,CAAC;QAED,IAAI,kBAAkB,EAAE,CAAC;YACvB;;;eAGG;YACH,MAAM,qBAAqB,GACzB,MAAM,cAAc,CAAC,8BAA8B,CAAC,QAAQ,CAAC,CAAC,KAAK,CACjE,GAAG,EAAE;gBACH,OAAO,IAAI,CAAC;YACd,CAAC,CACF,CAAC;YAEJ,IACE,CAAC,cAAc,CAAC,2BAA2B,CACzC,GAAG,EACH,QAAQ,EACR,MAAM,EACN,qBAAqB,aAArB,qBAAqB,cAArB,qBAAqB,GAAI,SAAS,CACnC,EACD,CAAC;gBACD,MAAM,IAAI,yBAAyB,EAAE,CAAC;YACxC,CAAC;QACH,CAAC;QAED,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAGmB,AAAb,MAAM,CAAC,KAAK,CAAC,2CAA2C,CAC7D,GAAmB,EACnB,MAAgB,EAChB,UAAsB;;QAEtB,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,aAAa,GACjB,CAAA,MAAC,GAAwB,CAAC,iBAAiB,0CAAE,aAAa,MAAK,IAAI,CAAC;QAEtE;;;WAGG;QACH,MAAM,wBAAwB,GAAY,aAAa;YACrD,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,MAAM,mBAAmB,CAAC,qBAAqB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;gBAC3D,OAAO,KAAK,CAAC;YACf,CAAC,CAAC,CAAC;QAEP;;;;WAIG;QACH,MAAM,QAAQ,GAGT,MAAM,OAAO,CAAC,GAAG,CACpB,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,SAAmB,EAAE,EAAE;YAC3C,MAAM,yBAAyB,GAC7B,MAAM,cAAc,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;gBAC/D;;;mBAGG;gBACH,OAAO,KAAK,CAAC;YACf,CAAC,CAAC,CAAC;YAEL,MAAM,kBAAkB,GACtB,yBAAyB,IAAI,wBAAwB,CAAC;YAExD,IAAI,kBAAkB,EAAE,CAAC;gBACvB,MAAM,qBAAqB,GACzB,MAAM,cAAc,CAAC,8BAA8B,CACjD,SAAS,CACV,CAAC,KAAK,CAAC,GAAG,EAAE;oBACX,OAAO,IAAI,CAAC;gBACd,CAAC,CAAC,CAAC;gBAEL,IACE,CAAC,cAAc,CAAC,2BAA2B,CACzC,GAAG,EACH,SAAS,EACT,MAAM,EACN,qBAAqB,aAArB,qBAAqB,cAArB,qBAAqB,GAAI,SAAS,CACnC,EACD,CAAC;oBACD,OAAO;wBACL,SAAS;wBACT,UAAU,EACR,kBAAkB,CAAC,oCAAoC,CACrD,SAAS,CACV;qBACJ,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,OAAO;gBACL,SAAS;gBACT,UAAU,EAAE,MAAM,kBAAkB,CAAC,6BAA6B,CAChE,MAAM,EACN,SAAS,CACV;aACF,CAAC;QACJ,CAAC,CAAC,CACH,CAAC;QAEF,IAAI,MAAM,GAAkD,IAAI,CAAC;QACjE,KAAK,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,QAAQ,EAAE,CAAC;YACjD,IAAI,UAAU,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,GAAG,EAAE,CAAC;gBACd,CAAC;gBACD,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,GAAG,UAAU,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AAnsBe;IADb,WAAW,EAAE;;;;oDAgBb;AAGa;IADb,WAAW,EAAE;;;;4DAqBb;AAGa;IADb,WAAW,EAAE;;;;wCA4Eb;AAkCa;IADb,WAAW,EAAE;;;;iDAqCb;AAGa;IADb,WAAW,EAAE;;6CAGD,QAAQ;QACX,QAAQ;;uDAwCjB;AAGmB;IADnB,WAAW,EAAE;;;;6CAoNb;AAGmB;IADnB,WAAW,EAAE;;;;qDAsBb;AAuEmB;IADnB,WAAW,EAAE;;;;qEAwEb;AAGmB;IADnB,WAAW,EAAE;;6CAGJ,QAAQ;;uEAyFjB"}

package/build/dist/Server/Middleware/VerificationCodeRateLimit.js

@@ -0,0 +1,393 @@
+import Redis from "../Infrastructure/Redis";
+import logger from "../Utils/Logger";
+import resolveTrustedClientIp from "../Utils/ClientIp";
+import Response from "../Utils/Response";
+import ObjectID from "../../Types/ObjectID";
+import TooManyRequestsException from "../../Types/Exception/TooManyRequestsException";
+/*
+ * Request limiting for the notification-channel verification routes:
+ * /user-email/verify, /user-sms/verify, /user-call/verify,
+ * /user-whats-app/verify, /user-incoming-call-number/verify and each of their
+ * resend siblings.
+ *
+ * WHAT THIS IS FOR, GIVEN THE DATABASE ALREADY COUNTS ATTEMPTS
+ *
+ * The durable controls in ChannelVerification bound guessing against ONE
+ * issued code: five attempts, then the code is burned. This middleware bounds
+ * the things a per-row counter cannot see.
+ *
+ *   ROW ROTATION. Nothing stops a caller creating a hundred channel rows —
+ *   that is the ordinary "add my phone" flow — and each new row is a fresh
+ *   code with a fresh attempt budget. Five guesses per row multiplied by
+ *   however many rows the caller cares to create is not bounded by anything
+ *   on the row. The per-user and per-address counters are.
+ *
+ *   MESSAGE VOLUME. Every issued code is a real email, SMS, voice call or
+ *   WhatsApp message to somebody who did not ask for it, billed to the
+ *   project. The resend bucket bounds that independently of whether any
+ *   individual row is inside its own cooldown.
+ *
+ *   COST BEFORE THE CHECK. A verify request costs a session lookup and a row
+ *   read before the attempt counter is even consulted. This runs first.
+ *
+ * THIS FAILS OPEN, DELIBERATELY
+ *
+ * If Redis is unreachable, requests are allowed through with a throttled
+ * warning. That is the opposite of the choice PublicDashboardRateLimit makes
+ * for /master-password, and the difference is that there the counter IS the
+ * only thing bounding guesses, whereas here the expiry, the attempt counter,
+ * the rotation and the resend cooldown all live in Postgres and are all still
+ * in force. Failing closed would mean nobody can verify a new phone number
+ * during a Redis blip, in exchange for a control that is at that moment
+ * redundant with four others.
+ */
+export var VerificationCodeRateLimitBucket;
+(function (VerificationCodeRateLimitBucket) {
+    /* Submitting a code. The guessing surface. */
+    VerificationCodeRateLimitBucket["Verify"] = "verify";
+    /* Asking for a new code. The spending-somebody-else's-attention surface. */
+    VerificationCodeRateLimitBucket["Resend"] = "resend";
+})(VerificationCodeRateLimitBucket || (VerificationCodeRateLimitBucket = {}));
+export var VerificationCodeRateLimitScope;
+(function (VerificationCodeRateLimitScope) {
+    /* One channel row, for one user. */
+    VerificationCodeRateLimitScope["Item"] = "item";
+    /* One signed-in user, across every row they own. Survives row rotation. */
+    VerificationCodeRateLimitScope["User"] = "user";
+    /* One client address, across every account. Survives account rotation. */
+    VerificationCodeRateLimitScope["Ip"] = "ip";
+})(VerificationCodeRateLimitScope || (VerificationCodeRateLimitScope = {}));
+export var VerificationCodeRateLimitOutcome;
+(function (VerificationCodeRateLimitOutcome) {
+    VerificationCodeRateLimitOutcome["Allowed"] = "allowed";
+    VerificationCodeRateLimitOutcome["RateLimited"] = "rate-limited";
+    /* Redis is unreachable, so no limit can be honoured either way. */
+    VerificationCodeRateLimitOutcome["CounterUnavailable"] = "counter-unavailable";
+})(VerificationCodeRateLimitOutcome || (VerificationCodeRateLimitOutcome = {}));
+const parsePositiveIntFromEnv = (envKey, fallback) => {
+    const rawValue = process.env[envKey];
+    if (!rawValue) {
+        return fallback;
+    }
+    const parsedValue = parseInt(rawValue, 10);
+    if (!Number.isFinite(parsedValue) || parsedValue <= 0) {
+        return fallback;
+    }
+    return parsedValue;
+};
+/*
+ * Verify budget, over a window matching the code's own lifetime.
+ *
+ * Per item is 10 against a per-code attempt limit of 5, so it never fires
+ * before the durable counter does for a single honest code — it is there to
+ * bound the requests that arrive after the row is already locked out.
+ *
+ * Per user is the one that closes row rotation: 50 submissions per quarter
+ * hour across every channel row the account owns. A person adding a phone
+ * number and mistyping the code a few times is nowhere near it; a script
+ * creating rows to farm attempt budgets hits it after ten rows.
+ *
+ * Per address is higher than per user because a corporate NAT can put a whole
+ * office behind one address, and several colleagues onboarding at once is a
+ * real thing that must not be refused.
+ */
+const VERIFY_BUCKET = {
+    windowSeconds: parsePositiveIntFromEnv("NOTIFICATION_VERIFICATION_RATE_LIMIT_WINDOW_SECONDS", 15 * 60),
+    perItemLimit: parsePositiveIntFromEnv("NOTIFICATION_VERIFICATION_RATE_LIMIT_PER_ITEM_PER_WINDOW", 10),
+    perUserLimit: parsePositiveIntFromEnv("NOTIFICATION_VERIFICATION_RATE_LIMIT_PER_USER_PER_WINDOW", 50),
+    perIpLimit: parsePositiveIntFromEnv("NOTIFICATION_VERIFICATION_RATE_LIMIT_PER_IP_PER_WINDOW", 150),
+};
+/*
+ * Resend budget. Tighter than verify, because each one of these is a message
+ * that arrives on somebody's phone and a line on somebody's bill. The
+ * per-item figure sits just above what the 60-second per-row cooldown allows
+ * in the window, so an honest user pressing "resend" whenever the cooldown
+ * lets them is never refused by this.
+ */
+const RESEND_BUCKET = {
+    windowSeconds: parsePositiveIntFromEnv("NOTIFICATION_VERIFICATION_RESEND_RATE_LIMIT_WINDOW_SECONDS", 15 * 60),
+    perItemLimit: parsePositiveIntFromEnv("NOTIFICATION_VERIFICATION_RESEND_RATE_LIMIT_PER_ITEM_PER_WINDOW", 5),
+    perUserLimit: parsePositiveIntFromEnv("NOTIFICATION_VERIFICATION_RESEND_RATE_LIMIT_PER_USER_PER_WINDOW", 15),
+    perIpLimit: parsePositiveIntFromEnv("NOTIFICATION_VERIFICATION_RESEND_RATE_LIMIT_PER_IP_PER_WINDOW", 45),
+};
+const KEY_PREFIX = "notifverify:rl:";
+/*
+ * Counter keys outlive their window by one full window, so a request landing
+ * on a boundary cannot read a key that was reclaimed mid-window.
+ */
+const TTL_MULTIPLIER = 2;
+/* Bounds a Redis key built from caller-supplied values. */
+const MAX_KEY_SEGMENT_LENGTH = 64;
+/* How often the "counter unavailable" condition may be logged, per bucket. */
+const COUNTER_UNAVAILABLE_LOG_INTERVAL_MS = 60 * 1000;
+class VerificationCodeRateLimit {
+    /*
+     * The client address to bill this request to.
+     *
+     * Uses the shared ClientIp helper, which reads X-Forwarded-For from the
+     * trusted right-hand end. Express.getClientIp takes the LEFTMOST entry,
+     * which the caller can set themselves — for a rate limiter that is fatal,
+     * because a fresh spoofed value per request is a fresh bucket per request
+     * and therefore no limit at all.
+     */
+    static resolveClientIp(req) {
+        const clientIp = resolveTrustedClientIp(req);
+        if (clientIp) {
+            return VerificationCodeRateLimit.sanitizeKeySegment(clientIp);
+        }
+        /*
+         * Everything with no resolvable address shares one bucket. That is the
+         * conservative direction: an unidentifiable caller should not be handed a
+         * private allowance.
+         */
+        return "unknown";
+    }
+    /*
+     * The signed-in user this request belongs to.
+     *
+     * These routes all sit behind UserMiddleware, so in practice this is always
+     * present. If it somehow is not, everything anonymous shares one bucket
+     * rather than each getting its own.
+     */
+    static resolveUserKey(req) {
+        var _a;
+        const userId = (_a = req === null || req === void 0 ? void 0 : req.userAuthorization) === null || _a === void 0 ? void 0 : _a.userId;
+        if (!userId) {
+            return "anonymous";
+        }
+        return VerificationCodeRateLimit.sanitizeKeySegment(userId.toString());
+    }
+    /*
+     * The channel row this request is about.
+     *
+     * Anything that is not a valid id collapses into one shared "invalid"
+     * bucket. That bounds Redis memory against a caller feeding junk ids, and
+     * it is the right grouping anyway: those requests cannot name a real row,
+     * so one small shared allowance between all of them is what we want.
+     */
+    static resolveItemKey(req) {
+        var _a;
+        const raw = (_a = req.body) === null || _a === void 0 ? void 0 : _a["itemId"];
+        if (typeof raw !== "string" || raw.trim().length === 0) {
+            return "none";
+        }
+        const value = raw.trim();
+        if (!ObjectID.isValidUUID(value)) {
+            return "invalid";
+        }
+        return value.toLowerCase();
+    }
+    static sanitizeKeySegment(value) {
+        return (value
+            .slice(0, MAX_KEY_SEGMENT_LENGTH)
+            /*
+             * Redis keys are binary safe, but a predictable charset keeps
+             * operational tooling (SCAN patterns, dashboards) sane.
+             */
+            .replace(/[^a-zA-Z0-9._:%\-[\]]/g, "_"));
+    }
+    static getBucketConfig(bucket) {
+        return bucket === VerificationCodeRateLimitBucket.Resend
+            ? RESEND_BUCKET
+            : VERIFY_BUCKET;
+    }
+    /*
+     * Increment all three counters for this request and decide.
+     *
+     * All three INCRs go out in one pipeline so the common path is a single
+     * round trip; the EXPIRE follow-ups only happen on the request that created
+     * a key.
+     *
+     * Every counter is incremented on every request, INCLUDING a rejected one.
+     * That is standard fixed-window behaviour and it is deliberate: a caller
+     * who keeps hammering keeps their window pinned rather than being handed a
+     * fresh allowance for free.
+     */
+    static async consume(data) {
+        const client = Redis.getClient();
+        if (!client || !Redis.isConnected()) {
+            return { outcome: VerificationCodeRateLimitOutcome.CounterUnavailable };
+        }
+        const config = VerificationCodeRateLimit.getBucketConfig(data.bucket);
+        const windowMs = config.windowSeconds * 1000;
+        const windowIndex = Math.floor(Date.now() / windowMs);
+        /*
+         * The item counter is keyed on item AND user. Two users cannot own the
+         * same row, so this changes nothing about correctness — but it means a
+         * caller cannot deny a row's real owner their allowance by burning it
+         * against an id they do not own.
+         */
+        const itemCounterKey = `${KEY_PREFIX}${data.bucket}:t:${data.userKey}:${data.itemKey}:${windowIndex}`;
+        const userCounterKey = `${KEY_PREFIX}${data.bucket}:u:${data.userKey}:${windowIndex}`;
+        const ipCounterKey = `${KEY_PREFIX}${data.bucket}:i:${data.clientIp}:${windowIndex}`;
+        try {
+            const pipelineResults = (await client
+                .pipeline()
+                .incr(itemCounterKey)
+                .incr(userCounterKey)
+                .incr(ipCounterKey)
+                .exec());
+            if (!pipelineResults || pipelineResults.length < 3) {
+                throw new Error("Rate limit pipeline returned no result");
+            }
+            const itemCount = VerificationCodeRateLimit.readCounterResult(pipelineResults[0]);
+            const userCount = VerificationCodeRateLimit.readCounterResult(pipelineResults[1]);
+            const ipCount = VerificationCodeRateLimit.readCounterResult(pipelineResults[2]);
+            /*
+             * Set the expiry only on the write that created the key. Re-issuing
+             * EXPIRE on every increment would slide the window forward for as long
+             * as the load continues, so a caller who tripped the limit once could
+             * never recover.
+             */
+            const ttlSeconds = config.windowSeconds * TTL_MULTIPLIER;
+            const keysToExpire = [];
+            if (itemCount === 1) {
+                keysToExpire.push(itemCounterKey);
+            }
+            if (userCount === 1) {
+                keysToExpire.push(userCounterKey);
+            }
+            if (ipCount === 1) {
+                keysToExpire.push(ipCounterKey);
+            }
+            if (keysToExpire.length > 0) {
+                const expirePipeline = client.pipeline();
+                for (const key of keysToExpire) {
+                    expirePipeline.expire(key, ttlSeconds);
+                }
+                await expirePipeline.exec();
+            }
+            const retryAfterSeconds = VerificationCodeRateLimit.getSecondsUntilWindowEnd(config.windowSeconds);
+            /*
+             * Reported most specific first, because that is the most useful thing
+             * to see in a log line when more than one is over.
+             */
+            if (itemCount > config.perItemLimit) {
+                return {
+                    outcome: VerificationCodeRateLimitOutcome.RateLimited,
+                    retryAfterSeconds,
+                    scope: VerificationCodeRateLimitScope.Item,
+                    isFirstRejectionInWindow: itemCount === config.perItemLimit + 1,
+                };
+            }
+            if (userCount > config.perUserLimit) {
+                return {
+                    outcome: VerificationCodeRateLimitOutcome.RateLimited,
+                    retryAfterSeconds,
+                    scope: VerificationCodeRateLimitScope.User,
+                    isFirstRejectionInWindow: userCount === config.perUserLimit + 1,
+                };
+            }
+            if (ipCount > config.perIpLimit) {
+                return {
+                    outcome: VerificationCodeRateLimitOutcome.RateLimited,
+                    retryAfterSeconds,
+                    scope: VerificationCodeRateLimitScope.Ip,
+                    isFirstRejectionInWindow: ipCount === config.perIpLimit + 1,
+                };
+            }
+            return { outcome: VerificationCodeRateLimitOutcome.Allowed };
+        }
+        catch (err) {
+            /*
+             * Throttled: whatever broke Redis is unlikely to have broken it for one
+             * request only, and a per-request log line buries the incident it is
+             * reporting.
+             */
+            if (VerificationCodeRateLimit.shouldLogCounterUnavailable(data.bucket)) {
+                logger.warn(`VerificationCodeRateLimit: counter failed for ${data.bucket} request from user ${data.userKey}`);
+                logger.warn(err);
+            }
+            return { outcome: VerificationCodeRateLimitOutcome.CounterUnavailable };
+        }
+    }
+    static readCounterResult(result) {
+        if (!result) {
+            throw new Error("Rate limit counter returned no result");
+        }
+        const [error, value] = result;
+        if (error) {
+            throw error;
+        }
+        if (typeof value !== "number") {
+            throw new Error("Rate limit counter returned a non-numeric value");
+        }
+        return value;
+    }
+    /*
+     * Remaining seconds in the current fixed window, so every rejected caller
+     * is told to come back when the window actually rolls rather than all
+     * backing off by the same constant and re-colliding.
+     */
+    static getSecondsUntilWindowEnd(windowSeconds) {
+        const windowMs = windowSeconds * 1000;
+        const msIntoWindow = Date.now() % windowMs;
+        return Math.max(1, Math.ceil((windowMs - msIntoWindow) / 1000));
+    }
+    /*
+     * Express middleware. Register AFTER UserMiddleware — the user counter is
+     * the one that closes row rotation, and it needs the session — but before
+     * the route handler, so a flood is refused before it costs a row read.
+     */
+    static getMiddleware(bucket) {
+        return async (req, res, next) => {
+            const itemKey = VerificationCodeRateLimit.resolveItemKey(req);
+            const userKey = VerificationCodeRateLimit.resolveUserKey(req);
+            const clientIp = VerificationCodeRateLimit.resolveClientIp(req);
+            const decision = await VerificationCodeRateLimit.consume({
+                itemKey,
+                userKey,
+                clientIp,
+                bucket,
+            });
+            if (decision.outcome === VerificationCodeRateLimitOutcome.RateLimited) {
+                if (decision.retryAfterSeconds) {
+                    VerificationCodeRateLimit.setRetryAfterHeader(res, decision.retryAfterSeconds);
+                }
+                if (decision.isFirstRejectionInWindow) {
+                    logger.warn(`VerificationCodeRateLimit: rejected ${bucket} request for item ${itemKey} from user ${userKey} at ${clientIp} (${decision.scope} limit)`);
+                }
+                return Response.sendErrorResponse(req, res, new TooManyRequestsException(bucket === VerificationCodeRateLimitBucket.Resend
+                    ? "Too many verification codes requested. Please try again later."
+                    : "Too many verification attempts. Please try again later."));
+            }
+            if (decision.outcome === VerificationCodeRateLimitOutcome.CounterUnavailable) {
+                /*
+                 * Fails open. See the note at the top of this file: the expiry, the
+                 * attempt counter, the rotation and the resend cooldown are all in
+                 * Postgres and all still in force, so allowing the request through
+                 * costs a bounded amount of extra attempt budget rather than an
+                 * unlimited guessing oracle.
+                 */
+                if (VerificationCodeRateLimit.shouldLogCounterUnavailable(bucket)) {
+                    logger.warn(`VerificationCodeRateLimit: rate limit counter unavailable, allowing ${bucket} requests unthrottled`);
+                }
+            }
+            return next();
+        };
+    }
+    /*
+     * A Redis outage means EVERY request takes the unavailable path, so an
+     * unguarded log line there is one per request for as long as the outage
+     * lasts. One line per bucket per interval makes the condition visible
+     * without burying everything else.
+     */
+    static shouldLogCounterUnavailable(bucket) {
+        const now = Date.now();
+        const lastLoggedAt = VerificationCodeRateLimit.counterUnavailableLastLoggedAt.get(bucket) || 0;
+        if (now - lastLoggedAt < COUNTER_UNAVAILABLE_LOG_INTERVAL_MS) {
+            return false;
+        }
+        VerificationCodeRateLimit.counterUnavailableLastLoggedAt.set(bucket, now);
+        return true;
+    }
+    static setRetryAfterHeader(res, retryAfterSeconds) {
+        const setHeader = res["setHeader"];
+        if (typeof setHeader === "function") {
+            setHeader.call(res, "Retry-After", String(retryAfterSeconds));
+        }
+    }
+}
+VerificationCodeRateLimit.counterUnavailableLastLoggedAt = new Map();
+export default VerificationCodeRateLimit;
+//# sourceMappingURL=VerificationCodeRateLimit.js.map

package/build/dist/Server/Middleware/VerificationCodeRateLimit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"VerificationCodeRateLimit.js","sourceRoot":"","sources":["../../../../Server/Middleware/VerificationCodeRateLimit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAqB,MAAM,yBAAyB,CAAC;AAO5D,OAAO,MAAM,MAAM,iBAAiB,CAAC;AACrC,OAAO,sBAA+C,MAAM,mBAAmB,CAAC;AAChF,OAAO,QAAQ,MAAM,mBAAmB,CAAC;AACzC,OAAO,QAAQ,MAAM,sBAAsB,CAAC;AAC5C,OAAO,wBAAwB,MAAM,gDAAgD,CAAC;AAEtF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,MAAM,CAAN,IAAY,+BAMX;AAND,WAAY,+BAA+B;IACzC,8CAA8C;IAC9C,oDAAiB,CAAA;IAEjB,4EAA4E;IAC5E,oDAAiB,CAAA;AACnB,CAAC,EANW,+BAA+B,KAA/B,+BAA+B,QAM1C;AAED,MAAM,CAAN,IAAY,8BASX;AATD,WAAY,8BAA8B;IACxC,oCAAoC;IACpC,+CAAa,CAAA;IAEb,2EAA2E;IAC3E,+CAAa,CAAA;IAEb,0EAA0E;IAC1E,2CAAS,CAAA;AACX,CAAC,EATW,8BAA8B,KAA9B,8BAA8B,QASzC;AAED,MAAM,CAAN,IAAY,gCAMX;AAND,WAAY,gCAAgC;IAC1C,uDAAmB,CAAA;IACnB,gEAA4B,CAAA;IAE5B,mEAAmE;IACnE,8EAA0C,CAAA;AAC5C,CAAC,EANW,gCAAgC,KAAhC,gCAAgC,QAM3C;AAiBD,MAAM,uBAAuB,GAAiD,CAC5E,MAAc,EACd,QAAgB,EACR,EAAE;IACV,MAAM,QAAQ,GAAuB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAEzD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,WAAW,GAAW,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAEnD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,WAAW,IAAI,CAAC,EAAE,CAAC;QACtD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC,CAAC;AASF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,aAAa,GAAiB;IAClC,aAAa,EAAE,uBAAuB,CACpC,qDAAqD,EACrD,EAAE,GAAG,EAAE,CACR;IACD,YAAY,EAAE,uBAAuB,CACnC,0DAA0D,EAC1D,EAAE,CACH;IACD,YAAY,EAAE,uBAAuB,CACnC,0DAA0D,EAC1D,EAAE,CACH;IACD,UAAU,EAAE,uBAAuB,CACjC,wDAAwD,EACxD,GAAG,CACJ;CACF,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,aAAa,GAAiB;IAClC,aAAa,EAAE,uBAAuB,CACpC,4DAA4D,EAC5D,EAAE,GAAG,EAAE,CACR;IACD,YAAY,EAAE,uBAAuB,CACnC,iEAAiE,EACjE,CAAC,CACF;IACD,YAAY,EAAE,uBAAuB,CACnC,iEAAiE,EACjE,EAAE,CACH;IACD,UAAU,EAAE,uBAAuB,CACjC,+DAA+D,EAC/D,EAAE,CACH;CACF,CAAC;AAEF,MAAM,UAAU,GAAW,iBAAiB,CAAC;AAE7C;;;GAGG;AACH,MAAM,cAAc,GAAW,CAAC,CAAC;AAEjC,2DAA2D;AAC3D,MAAM,sBAAsB,GAAW,EAAE,CAAC;AAE1C,8EAA8E;AAC9E,MAAM,mCAAmC,GAAW,EAAE,GAAG,IAAI,CAAC;AAE9D,MAAqB,yBAAyB;IAC5C;;;;;;;;OAQG;IACI,MAAM,CAAC,eAAe,CAAC,GAAmB;QAC/C,MAAM,QAAQ,GAAuB,sBAAsB,CACzD,GAAqC,CACtC,CAAC;QAEF,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,yBAAyB,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QAChE,CAAC;QAED;;;;WAIG;QACH,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;OAMG;IACI,MAAM,CAAC,cAAc,CAAC,GAAmB;;QAC9C,MAAM,MAAM,GAAyB,MAAC,GAAwB,aAAxB,GAAG,uBAAH,GAAG,CACrC,iBAAiB,0CAAE,MAAM,CAAC;QAE9B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,OAAO,yBAAyB,CAAC,kBAAkB,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IACzE,CAAC;IAED;;;;;;;OAOG;IACI,MAAM,CAAC,cAAc,CAAC,GAAmB;;QAC9C,MAAM,GAAG,GAAY,MAAC,GAAG,CAAC,IAA4C,0CACpE,QAAQ,CACT,CAAC;QAEF,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvD,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,KAAK,GAAW,GAAG,CAAC,IAAI,EAAE,CAAC;QAEjC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;YACjC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC;IAC7B,CAAC;IAEO,MAAM,CAAC,kBAAkB,CAAC,KAAa;QAC7C,OAAO,CACL,KAAK;aACF,KAAK,CAAC,CAAC,EAAE,sBAAsB,CAAC;YACjC;;;eAGG;aACF,OAAO,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAC1C,CAAC;IACJ,CAAC;IAEM,MAAM,CAAC,eAAe,CAC3B,MAAuC;QAEvC,OAAO,MAAM,KAAK,+BAA+B,CAAC,MAAM;YACtD,CAAC,CAAC,aAAa;YACf,CAAC,CAAC,aAAa,CAAC;IACpB,CAAC;IAED;;;;;;;;;;;OAWG;IACI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAK3B;QACC,MAAM,MAAM,GAAsB,KAAK,CAAC,SAAS,EAAE,CAAC;QAEpD,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACpC,OAAO,EAAE,OAAO,EAAE,gCAAgC,CAAC,kBAAkB,EAAE,CAAC;QAC1E,CAAC;QAED,MAAM,MAAM,GAAiB,yBAAyB,CAAC,eAAe,CACpE,IAAI,CAAC,MAAM,CACZ,CAAC;QAEF,MAAM,QAAQ,GAAW,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC;QACrD,MAAM,WAAW,GAAW,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,CAAC;QAE9D;;;;;WAKG;QACH,MAAM,cAAc,GAAW,GAAG,UAAU,GAAG,IAAI,CAAC,MAAM,MAAM,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,IAAI,WAAW,EAAE,CAAC;QAC9G,MAAM,cAAc,GAAW,GAAG,UAAU,GAAG,IAAI,CAAC,MAAM,MAAM,IAAI,CAAC,OAAO,IAAI,WAAW,EAAE,CAAC;QAC9F,MAAM,YAAY,GAAW,GAAG,UAAU,GAAG,IAAI,CAAC,MAAM,MAAM,IAAI,CAAC,QAAQ,IAAI,WAAW,EAAE,CAAC;QAE7F,IAAI,CAAC;YACH,MAAM,eAAe,GACnB,CAAC,MAAM,MAAM;iBACV,QAAQ,EAAE;iBACV,IAAI,CAAC,cAAc,CAAC;iBACpB,IAAI,CAAC,cAAc,CAAC;iBACpB,IAAI,CAAC,YAAY,CAAC;iBAClB,IAAI,EAAE,CAA0C,CAAC;YAEtD,IAAI,CAAC,eAAe,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;YAC5D,CAAC;YAED,MAAM,SAAS,GAAW,yBAAyB,CAAC,iBAAiB,CACnE,eAAe,CAAC,CAAC,CAAC,CACnB,CAAC;YACF,MAAM,SAAS,GAAW,yBAAyB,CAAC,iBAAiB,CACnE,eAAe,CAAC,CAAC,CAAC,CACnB,CAAC;YACF,MAAM,OAAO,GAAW,yBAAyB,CAAC,iBAAiB,CACjE,eAAe,CAAC,CAAC,CAAC,CACnB,CAAC;YAEF;;;;;eAKG;YACH,MAAM,UAAU,GAAW,MAAM,CAAC,aAAa,GAAG,cAAc,CAAC;YACjE,MAAM,YAAY,GAAkB,EAAE,CAAC;YAEvC,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;gBACpB,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACpC,CAAC;YAED,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;gBACpB,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACpC,CAAC;YAED,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;gBAClB,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAClC,CAAC;YAED,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5B,MAAM,cAAc,GAClB,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAEpB,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;oBAC/B,cAAc,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;gBACzC,CAAC;gBAED,MAAM,cAAc,CAAC,IAAI,EAAE,CAAC;YAC9B,CAAC;YAED,MAAM,iBAAiB,GACrB,yBAAyB,CAAC,wBAAwB,CAChD,MAAM,CAAC,aAAa,CACrB,CAAC;YAEJ;;;eAGG;YACH,IAAI,SAAS,GAAG,MAAM,CAAC,YAAY,EAAE,CAAC;gBACpC,OAAO;oBACL,OAAO,EAAE,gCAAgC,CAAC,WAAW;oBACrD,iBAAiB;oBACjB,KAAK,EAAE,8BAA8B,CAAC,IAAI;oBAC1C,wBAAwB,EAAE,SAAS,KAAK,MAAM,CAAC,YAAY,GAAG,CAAC;iBAChE,CAAC;YACJ,CAAC;YAED,IAAI,SAAS,GAAG,MAAM,CAAC,YAAY,EAAE,CAAC;gBACpC,OAAO;oBACL,OAAO,EAAE,gCAAgC,CAAC,WAAW;oBACrD,iBAAiB;oBACjB,KAAK,EAAE,8BAA8B,CAAC,IAAI;oBAC1C,wBAAwB,EAAE,SAAS,KAAK,MAAM,CAAC,YAAY,GAAG,CAAC;iBAChE,CAAC;YACJ,CAAC;YAED,IAAI,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;gBAChC,OAAO;oBACL,OAAO,EAAE,gCAAgC,CAAC,WAAW;oBACrD,iBAAiB;oBACjB,KAAK,EAAE,8BAA8B,CAAC,EAAE;oBACxC,wBAAwB,EAAE,OAAO,KAAK,MAAM,CAAC,UAAU,GAAG,CAAC;iBAC5D,CAAC;YACJ,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,gCAAgC,CAAC,OAAO,EAAE,CAAC;QAC/D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb;;;;eAIG;YACH,IAAI,yBAAyB,CAAC,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvE,MAAM,CAAC,IAAI,CACT,iDAAiD,IAAI,CAAC,MAAM,sBAAsB,IAAI,CAAC,OAAO,EAAE,CACjG,CAAC;gBACF,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,gCAAgC,CAAC,kBAAkB,EAAE,CAAC;QAC1E,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,iBAAiB,CAC9B,MAA2C;QAE3C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,CAAC;QAE9B,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,KAAK,CAAC;QACd,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IACK,MAAM,CAAC,wBAAwB,CAAC,aAAqB;QAC3D,MAAM,QAAQ,GAAW,aAAa,GAAG,IAAI,CAAC;QAC9C,MAAM,YAAY,GAAW,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC;QAEnD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,GAAG,YAAY,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IAClE,CAAC;IAED;;;;OAIG;IACI,MAAM,CAAC,aAAa,CACzB,MAAuC;QAMvC,OAAO,KAAK,EACV,GAAmB,EACnB,GAAoB,EACpB,IAAkB,EACH,EAAE;YACjB,MAAM,OAAO,GAAW,yBAAyB,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;YACtE,MAAM,OAAO,GAAW,yBAAyB,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;YACtE,MAAM,QAAQ,GAAW,yBAAyB,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;YAExE,MAAM,QAAQ,GACZ,MAAM,yBAAyB,CAAC,OAAO,CAAC;gBACtC,OAAO;gBACP,OAAO;gBACP,QAAQ;gBACR,MAAM;aACP,CAAC,CAAC;YAEL,IAAI,QAAQ,CAAC,OAAO,KAAK,gCAAgC,CAAC,WAAW,EAAE,CAAC;gBACtE,IAAI,QAAQ,CAAC,iBAAiB,EAAE,CAAC;oBAC/B,yBAAyB,CAAC,mBAAmB,CAC3C,GAAG,EACH,QAAQ,CAAC,iBAAiB,CAC3B,CAAC;gBACJ,CAAC;gBAED,IAAI,QAAQ,CAAC,wBAAwB,EAAE,CAAC;oBACtC,MAAM,CAAC,IAAI,CACT,uCAAuC,MAAM,qBAAqB,OAAO,cAAc,OAAO,OAAO,QAAQ,KAAK,QAAQ,CAAC,KAAK,SAAS,CAC1I,CAAC;gBACJ,CAAC;gBAED,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,wBAAwB,CAC1B,MAAM,KAAK,+BAA+B,CAAC,MAAM;oBAC/C,CAAC,CAAC,gEAAgE;oBAClE,CAAC,CAAC,yDAAyD,CAC9D,CACF,CAAC;YACJ,CAAC;YAED,IACE,QAAQ,CAAC,OAAO,KAAK,gCAAgC,CAAC,kBAAkB,EACxE,CAAC;gBACD;;;;;;mBAMG;gBACH,IAAI,yBAAyB,CAAC,2BAA2B,CAAC,MAAM,CAAC,EAAE,CAAC;oBAClE,MAAM,CAAC,IAAI,CACT,uEAAuE,MAAM,uBAAuB,CACrG,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,MAAM,CAAC,2BAA2B,CACxC,MAAuC;QAEvC,MAAM,GAAG,GAAW,IAAI,CAAC,GAAG,EAAE,CAAC;QAC/B,MAAM,YAAY,GAChB,yBAAyB,CAAC,8BAA8B,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAE5E,IAAI,GAAG,GAAG,YAAY,GAAG,mCAAmC,EAAE,CAAC;YAC7D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,yBAAyB,CAAC,8BAA8B,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAE1E,OAAO,IAAI,CAAC;IACd,CAAC;IAOO,MAAM,CAAC,mBAAmB,CAChC,GAAoB,EACpB,iBAAyB;QAEzB,MAAM,SAAS,GAAa,GAA0C,CACpE,WAAW,CACZ,CAAC;QAEF,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;YACnC,SAAmD,CAAC,IAAI,CACvD,GAAG,EACH,aAAa,EACb,MAAM,CAAC,iBAAiB,CAAC,CAC1B,CAAC;QACJ,CAAC;IACH,CAAC;;AApBc,wDAA8B,GAGzC,IAAI,GAAG,EAAE,CAAC;eArXK,yBAAyB"}

package/build/dist/Server/Services/AnalyticsDatabaseService.js

@@ -1000,6 +1000,129 @@ export default class AnalyticsDatabaseService extends BaseService {
          */
         return Object.assign(Object.assign({}, sort), { _id: direction });
     }
+    /**
+     * Bounds the rows an `ORDER BY ... , _id` find has to sort, without
+     * changing which rows it returns.
+     *
+     * ClickHouse can read in sorting-key order — and stop early — only when the
+     * ORDER BY lines up with the table's physical key. The `_id` tiebreaker
+     * appended by `toPaginationStableSort` is deliberately NOT a sorting-key
+     * column, so it denies that plan: the engine reads every row matching the
+     * WHERE, sorts the lot in memory, then discards all but one page. On the
+     * Logs viewer that turned a 100-row page into a full-window scan and tripped
+     * the 3 GiB `max_memory_usage` ceiling (Code 241, surfacing as
+     * "Server Error").
+     *
+     * Weakening the tiebreaker would reintroduce the skip/repeat paging bug it
+     * was added to fix, so bound the input instead. `min(k)` over the top
+     * `skip + limit` values of the leading sort key `k` is a rank statistic of
+     * k's MULTISET: it does not depend on which of several tied rows the inner
+     * LIMIT happened to keep. Every row that could reach position `skip + limit`
+     * satisfies `k >= min(k)`, and every row tied at the boundary value is
+     * admitted — so the page is exactly the page the unbounded query returns.
+     * That is what makes this a pure cost change: every gate below is a
+     * performance gate, and getting one wrong can only make a query slower,
+     * never lose or repeat a row.
+     *
+     * The inner pass reads one narrow key column in physical order and stops at
+     * `skip + limit` rows, so it costs far less than the wide outer read it
+     * saves.
+     *
+     * `min()` is nested over a subquery rather than taken as the N-th value via
+     * `ORDER BY k DESC LIMIT 1 OFFSET n - 1` on purpose: on a final page with
+     * fewer than `skip + limit` matching rows the latter returns no row, the
+     * scalar is NULL, `k >= NULL` is NULL, and the page comes back empty.
+     * `min()` over the available rows degrades to the smallest matching value.
+     */
+    toSortKeyBoundaryFilter(findBy, sort, options) {
+        var _a;
+        /*
+         * Under GROUP BY the predicate would restrict the aggregation INPUT
+         * rather than the page, so it would change results. Mirrors the
+         * tiebreaker's own exemption, leaving grouped finds byte-identical.
+         */
+        if (options.hasGroupBy) {
+            return null;
+        }
+        /*
+         * Without an `_id` column there is no off-key tiebreaker — the six
+         * `includeBaseColumns: false` aggregate targets — so the ORDER BY is
+         * already key-aligned and the bound would be pure overhead. Same
+         * condition toPaginationStableSort bails on.
+         */
+        const hasIdColumn = this.model.tableColumns.some((column) => {
+            return column.key === "_id";
+        });
+        if (!hasIdColumn) {
+            return null;
+        }
+        const leadingSortKey = Object.keys(sort || {})[0];
+        if (!leadingSortKey) {
+            return null;
+        }
+        /*
+         * Only a column in the physical sorting key can be read in order, so
+         * only there can the off-key `_id` term have cost anything. Off-key
+         * leads (e.g. Log by `severityText`) already plan a bounded top-N and
+         * an extra pass would be pure waste.
+         */
+        if (!this.model.sortKeys.includes(leadingSortKey)) {
+            return null;
+        }
+        /*
+         * A non-required column is `Nullable(...)` in the DDL, and `k >= NULL`
+         * is NULL — the predicate would DROP those rows rather than just
+         * narrowing the scan. Fail safe to today's behavior.
+         */
+        const leadingSortColumn = this.model.getTableColumn(leadingSortKey);
+        if (!leadingSortColumn || !leadingSortColumn.required) {
+            return null;
+        }
+        /*
+         * `findOneById` funnels a point lookup through `findOneBy` carrying the
+         * model's default sort. At most one row can match, so bounding it would
+         * double a query that has no ordering problem to begin with.
+         */
+        if ((_a = findBy.query) === null || _a === void 0 ? void 0 : _a["_id"]) {
+            return null;
+        }
+        /*
+         * The predicate is valid only BECAUSE of LIMIT/OFFSET: it admits the
+         * rows that can reach position `skip + limit` and no more. Guards the
+         * `new PositiveNumber(undefined)` -> NaN path that exists upstream.
+         */
+        const limit = Number(findBy.limit);
+        const skip = Number(findBy.skip);
+        if (!Number.isFinite(limit) || !Number.isFinite(skip)) {
+            return null;
+        }
+        const boundaryRowCount = skip + limit;
+        if (boundaryRowCount <= 0) {
+            return null;
+        }
+        const isDescending = sort[leadingSortKey] !==
+            SortOrder.Ascending;
+        /*
+         * The bound must be computed over the same row set the outer query
+         * filters on, so the WHERE is regenerated rather than shared: appending
+         * one Statement into two places would bind its parameters twice.
+         */
+        const boundaryWhereStatement = this.statementGenerator.toWhereStatement(findBy.query);
+        const boundaryStatement = SQL ` AND ${leadingSortKey} `;
+        boundaryStatement.append(isDescending ? SQL `>=` : SQL `<=`);
+        boundaryStatement.append(isDescending
+            ? SQL ` (SELECT min(${leadingSortKey}) FROM (SELECT ${leadingSortKey} FROM ${options.databaseName}.${this.model.tableName} WHERE TRUE `
+            : SQL ` (SELECT max(${leadingSortKey}) FROM (SELECT ${leadingSortKey} FROM ${options.databaseName}.${this.model.tableName} WHERE TRUE `);
+        boundaryStatement.append(boundaryWhereStatement);
+        boundaryStatement.append(this.getRetentionReadFilter());
+        boundaryStatement.append(SQL ` ORDER BY ${leadingSortKey} `);
+        boundaryStatement.append(isDescending ? SQL `DESC` : SQL `ASC`);
+        boundaryStatement.append(SQL ` LIMIT ${{
+            value: boundaryRowCount,
+            type: TableColumnType.Number,
+        }}))`);
+        return boundaryStatement;
+    }
     toFindStatement(findBy) {
         if (!this.database) {
             this.useDefaultDatabase();
@@ -1016,6 +1139,16 @@ export default class AnalyticsDatabaseService extends BaseService {
         const sortStatement = this.statementGenerator.toSortStatement(this.toPaginationStableSort(findBy.sort, {
             hasGroupBy: Boolean(groupByStatement),
         }));
+        /*
+         * Keeps the `_id` tiebreaker affordable. Result-preserving by
+         * construction, so it is appended to the WHERE without touching the
+         * ORDER BY above. Null whenever the bound cannot help or cannot be
+         * proven safe.
+         */
+        const sortKeyBoundaryStatement = this.toSortKeyBoundaryFilter(findBy, findBy.sort, {
+            hasGroupBy: Boolean(groupByStatement),
+            databaseName: databaseName,
+        });
         const statement = SQL ``;
         statement.append(SQL `SELECT `.append(select.statement));
         statement.append(SQL ` FROM ${databaseName}.${this.model.tableName}`);
@@ -1023,6 +1156,9 @@ export default class AnalyticsDatabaseService extends BaseService {
             .append(SQL ` WHERE TRUE `)
             .append(whereStatement)
             .append(this.getRetentionReadFilter());
+        if (sortKeyBoundaryStatement) {
+            statement.append(sortKeyBoundaryStatement);
+        }
         if (groupByStatement) {
             statement.append(SQL ` GROUP BY `).append(groupByStatement);
         }