@oneuptime/common 12.0.12 → 12.0.14

package/build/dist/Server/Utils/ChannelVerification.js

@@ -0,0 +1,348 @@
+import logger from "./Logger";
+import VerificationCode from "./VerificationCode";
+import BadDataException from "../../Types/Exception/BadDataException";
+/*
+ * The ownership check shared by every notification channel a user can add to
+ * their own account: email, SMS, voice call, WhatsApp and the incoming-call
+ * number. Each of those had its own copy of "compare the column, set
+ * isVerified", and each copy had the same three holes.
+ *
+ * WHAT WAS WRONG
+ *
+ * The code was a stable six-digit value with no expiry, no attempt counter
+ * and no lockout. Nothing stops a caller creating a channel row pointing at
+ * SOMEBODY ELSE'S address or number - that is the normal, intended flow, it
+ * is how you add your own phone - so an authenticated low-privilege user
+ * could add a colleague's number and then walk the whole 10^6 code space
+ * against /verify at request speed. A million requests is minutes of
+ * scripting, and the code at the end of it was still the same code it was at
+ * the start. Success marks the row verified, which creates the default
+ * notification rules, which makes the victim's phone a delivery target for
+ * whatever that project pages about.
+ *
+ * WHAT REPLACES IT
+ *
+ * Four controls, each of which has to be defeated on its own:
+ *
+ *   EXPIRY       a code lives 15 minutes, so the search space is not
+ *                available indefinitely.
+ *   ATTEMPTS     five wrong guesses per issued code, counted with a single
+ *                atomic UPDATE ... RETURNING so racing requests cannot all
+ *                read the same pre-increment value and all decide they are
+ *                under the limit.
+ *   ROTATION     crossing the attempt limit does not merely pause the
+ *                attacker with the target still valid behind it - the stored
+ *                challenge is burned. Continuing costs a resend, which
+ *                notifies the victim.
+ *   THROTTLE     resends are on a cooldown, so "burn the code and get a new
+ *                one" is not free either, and the victim is not the one who
+ *                pays for it in unsolicited messages.
+ *
+ * On top of that the stored value is a keyed digest rather than the code (see
+ * VerificationCode.ts) and the routes are rate limited per user, per row and
+ * per address (see Middleware/VerificationCodeRateLimit.ts).
+ *
+ * Together: five guesses per code, a resend needed for the next five, a
+ * cooldown on resends, and every resend visible to the person being attacked.
+ */
+const parsePositiveIntFromEnv = (envKey, fallback) => {
+    const rawValue = process.env[envKey];
+    if (!rawValue) {
+        return fallback;
+    }
+    const parsedValue = parseInt(rawValue, 10);
+    if (!Number.isFinite(parsedValue) || parsedValue <= 0) {
+        return fallback;
+    }
+    return parsedValue;
+};
+/*
+ * Long enough to survive a slow SMS carrier, an email that lands in a spam
+ * folder the user has to go and look in, or a voice call the user missed and
+ * had to wait to be repeated. Short enough that the code space is not
+ * standing open. Fifteen minutes is the usual figure for exactly this
+ * trade-off and is what the notification copy tells the user.
+ */
+export const VERIFICATION_CODE_EXPIRY_MINUTES = parsePositiveIntFromEnv("NOTIFICATION_VERIFICATION_CODE_EXPIRY_MINUTES", 15);
+/*
+ * Five is chosen for the human, not the attacker: somebody typing a code off
+ * a phone screen will fat-finger it once or twice, and almost never five
+ * times. The attacker's number is not five - it is five multiplied by how
+ * many resends they are willing to send to their victim's phone, which is the
+ * point of the cooldown below.
+ */
+export const MAX_VERIFICATION_ATTEMPTS = parsePositiveIntFromEnv("NOTIFICATION_VERIFICATION_MAX_ATTEMPTS", 5);
+/*
+ * A resend both issues a fresh code and, for SMS/call/WhatsApp, spends real
+ * money sending it to a real handset. The cooldown is the control on the
+ * "burn five guesses, resend, repeat" loop AND on using the resend button as
+ * a way to text somebody 200 times.
+ *
+ * Sixty seconds is the interval a user who did not receive the first message
+ * will tolerate, and it caps the loop above at five guesses a minute: roughly
+ * 200,000 minutes, or four months of uninterrupted attack with a message
+ * landing on the victim's phone every sixty seconds of it, for an even chance
+ * of hitting one code.
+ */
+export const RESEND_COOLDOWN_SECONDS = parsePositiveIntFromEnv("NOTIFICATION_VERIFICATION_RESEND_COOLDOWN_SECONDS", 60);
+export var ChannelVerificationOutcome;
+(function (ChannelVerificationOutcome) {
+    ChannelVerificationOutcome["Verified"] = "verified";
+    ChannelVerificationOutcome["NotFound"] = "not-found";
+    ChannelVerificationOutcome["NotOwner"] = "not-owner";
+    ChannelVerificationOutcome["AlreadyVerified"] = "already-verified";
+    ChannelVerificationOutcome["Expired"] = "expired";
+    ChannelVerificationOutcome["TooManyAttempts"] = "too-many-attempts";
+    ChannelVerificationOutcome["IncorrectCode"] = "incorrect-code";
+})(ChannelVerificationOutcome || (ChannelVerificationOutcome = {}));
+const asWriter = (service) => {
+    return service;
+};
+export default class ChannelVerification {
+    /*
+     * When a code issued now stops being accepted.
+     */
+    static getExpiresAt(now = new Date()) {
+        return new Date(now.getTime() + VERIFICATION_CODE_EXPIRY_MINUTES * 60 * 1000);
+    }
+    /*
+     * A missing expiry is treated as expired, NOT as "never expires".
+     *
+     * That is the direction that matters for the rows written before this
+     * column existed: they carry a plaintext code and no expiry, and the
+     * conservative reading turns them into "request a new code" rather than
+     * leaving a permanently valid challenge in place. The cost is that a user
+     * who had an unverified channel across the upgrade has to press resend
+     * once.
+     */
+    static isCodeExpired(data) {
+        if (!data.expiresAt) {
+            return true;
+        }
+        const now = data.now || new Date();
+        return new Date(data.expiresAt).getTime() <= now.getTime();
+    }
+    /*
+     * Seconds the caller must wait before another code may be sent, or 0 if a
+     * send is allowed right now.
+     */
+    static getResendRetryAfterSeconds(data) {
+        if (!data.lastSentAt) {
+            return 0;
+        }
+        const now = data.now || new Date();
+        const elapsedSeconds = (now.getTime() - new Date(data.lastSentAt).getTime()) / 1000;
+        /*
+         * A lastSentAt in the future means a clock went backwards, not that the
+         * caller may send freely. Treat it as a full cooldown.
+         */
+        if (elapsedSeconds < 0) {
+            return RESEND_COOLDOWN_SECONDS;
+        }
+        if (elapsedSeconds >= RESEND_COOLDOWN_SECONDS) {
+            return 0;
+        }
+        return Math.max(1, Math.ceil(RESEND_COOLDOWN_SECONDS - elapsedSeconds));
+    }
+    /*
+     * The column values that put a freshly issued code on a row. Returned
+     * rather than written so the caller can fold them into whatever write it
+     * was already making, and so the plaintext - which exists in memory for
+     * exactly as long as it takes to hand it to the notification service -
+     * comes back alongside them.
+     */
+    static issueCode(data) {
+        const now = data.now || new Date();
+        const plainCode = VerificationCode.generate();
+        return {
+            plainCode,
+            fields: {
+                verificationCode: VerificationCode.hashCode({
+                    code: plainCode,
+                    channelId: data.channelId,
+                }),
+                verificationCodeExpiresAt: ChannelVerification.getExpiresAt(now),
+                verificationCodeSentAt: now,
+                verificationFailedAttempts: 0,
+            },
+        };
+    }
+    /*
+     * The column values that leave a row with NO live challenge on it: a digest
+     * no code can produce, and no expiry.
+     *
+     * `verificationCode` is NOT NULL on every one of these tables, so "there is
+     * no code" cannot be written as null. A random 256-bit digest says the same
+     * thing and cannot be hit by any of the 10^6 codes.
+     */
+    static getClearedCodeFields() {
+        return {
+            verificationCode: VerificationCode.generateUnusableHash(),
+            verificationCodeExpiresAt: null,
+        };
+    }
+    /*
+     * Write a fresh code onto an existing row and return the plaintext to send.
+     *
+     * Callers must have already decided that a send is allowed - this does not
+     * check the cooldown, because whether a resend is permitted is a question
+     * about the CHANNEL (already verified? project out of SMS credit?) that
+     * only the channel's own service can answer.
+     */
+    static async issueCodeOnItem(data) {
+        const issued = ChannelVerification.issueCode({ channelId: data.itemId });
+        await asWriter(data.service).updateOneById({
+            id: data.itemId,
+            props: {
+                isRoot: true,
+            },
+            data: issued.fields,
+        });
+        return issued.plainCode;
+    }
+    /*
+     * Check a submitted code and, if it is right, mark the row verified.
+     *
+     * The ORDER of the steps is the security-relevant part:
+     *
+     *   ownership first, so one user cannot even probe the state of another
+     *   user's row;
+     *
+     *   already-verified before the counter, so re-submitting a code against a
+     *   row that is already done is not a way to burn somebody's attempts;
+     *
+     *   the lockout gate before the counter, so a row whose budget is already
+     *   spent is refused without growing the counter forever and without a
+     *   database write per request;
+     *
+     *   expiry before the counter, because an expired code is refused
+     *   unconditionally and there is no reason to spend a user's remaining
+     *   attempts telling them so;
+     *
+     *   the counter before the comparison, so every attempt - including the
+     *   ones racing each other - has already consumed its slot by the time
+     *   anybody learns whether it was right.
+     *
+     * The lockout gate reads a value that a concurrent request may already have
+     * moved, which is exactly why it is a fast path and not the control. The
+     * control is the atomic increment below: N requests that all slip past the
+     * stale gate together still receive N DISTINCT attempt numbers, so all but
+     * the first MAX_VERIFICATION_ATTEMPTS of them are refused.
+     */
+    static async verifyCode(data) {
+        var _a;
+        const item = await data.service.findOneById({
+            id: data.itemId,
+            props: {
+                isRoot: true,
+            },
+            select: {
+                userId: true,
+                projectId: true,
+                isVerified: true,
+                verificationCode: true,
+                verificationCodeExpiresAt: true,
+                verificationFailedAttempts: true,
+            },
+        });
+        const writer = asWriter(data.service);
+        if (!item) {
+            return { outcome: ChannelVerificationOutcome.NotFound };
+        }
+        if (((_a = item.userId) === null || _a === void 0 ? void 0 : _a.toString()) !== data.userId.toString()) {
+            return { outcome: ChannelVerificationOutcome.NotOwner };
+        }
+        if (item.isVerified) {
+            return { outcome: ChannelVerificationOutcome.AlreadyVerified };
+        }
+        if ((item.verificationFailedAttempts || 0) >= MAX_VERIFICATION_ATTEMPTS) {
+            return { outcome: ChannelVerificationOutcome.TooManyAttempts };
+        }
+        if (ChannelVerification.isCodeExpired({
+            expiresAt: item.verificationCodeExpiresAt,
+        })) {
+            return { outcome: ChannelVerificationOutcome.Expired };
+        }
+        const attemptNumber = await writer.atomicIncrementColumnValueByOneAndGetValue({
+            id: data.itemId,
+            columnName: "verificationFailedAttempts",
+        });
+        /*
+         * Only reachable when requests raced past the gate above together. They
+         * are refused here rather than being given a comparison, and the request
+         * holding attempt number MAX_VERIFICATION_ATTEMPTS still burns the
+         * challenge below.
+         */
+        if (attemptNumber > MAX_VERIFICATION_ATTEMPTS) {
+            return { outcome: ChannelVerificationOutcome.TooManyAttempts };
+        }
+        const submittedHash = VerificationCode.hashCode({
+            code: String(data.code),
+            channelId: data.itemId,
+        });
+        if (!VerificationCode.isHashEqual(submittedHash, item.verificationCode || "")) {
+            /*
+             * That was the last attempt this code gets, so burn it now rather than
+             * leave a spent-but-still-valid challenge on the row. The attacker's
+             * next move has to be a resend, which costs them the cooldown and tells
+             * the victim what is happening.
+             *
+             * Done exactly once, on the attempt that exhausts the budget; every
+             * later request is turned away by the gate above without a write.
+             */
+            if (attemptNumber >= MAX_VERIFICATION_ATTEMPTS) {
+                await writer.updateOneById({
+                    id: data.itemId,
+                    props: {
+                        isRoot: true,
+                    },
+                    data: ChannelVerification.getClearedCodeFields(),
+                });
+                logger.warn(`ChannelVerification: attempt limit reached on ${writer.getModel().tableName} ${data.itemId.toString()} for user ${data.userId.toString()}; verification code invalidated`);
+            }
+            return { outcome: ChannelVerificationOutcome.IncorrectCode };
+        }
+        /*
+         * Correct. Mark verified AND clear the challenge in the same write: a
+         * used code must not remain usable, and the attempt counter goes back to
+         * zero so a later re-issue (if the row is ever un-verified) starts fresh.
+         */
+        await writer.updateOneById({
+            id: data.itemId,
+            props: {
+                isRoot: true,
+            },
+            data: Object.assign({ isVerified: true, verificationFailedAttempts: 0 }, ChannelVerification.getClearedCodeFields()),
+        });
+        return {
+            outcome: ChannelVerificationOutcome.Verified,
+            itemId: data.itemId,
+            userId: item.userId,
+            projectId: item.projectId,
+        };
+    }
+    /*
+     * The message a failed outcome is reported to the caller with.
+     *
+     * IncorrectCode and NotFound deliberately do NOT say anything the caller
+     * did not already know, and every failure is a plain BadDataException so
+     * the shape of the response does not vary with the reason either.
+     */
+    static getFailureException(outcome) {
+        switch (outcome) {
+            case ChannelVerificationOutcome.NotFound:
+                return new BadDataException("Item not found");
+            case ChannelVerificationOutcome.NotOwner:
+                return new BadDataException("Invalid user ID");
+            case ChannelVerificationOutcome.AlreadyVerified:
+                return new BadDataException("This is already verified");
+            case ChannelVerificationOutcome.Expired:
+                return new BadDataException("This verification code has expired. Please request a new code.");
+            case ChannelVerificationOutcome.TooManyAttempts:
+                return new BadDataException("Too many incorrect attempts. This verification code is no longer valid. Please request a new code.");
+            default:
+                return new BadDataException("Invalid code");
+        }
+    }
+}
+//# sourceMappingURL=ChannelVerification.js.map

package/build/dist/Server/Utils/ChannelVerification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ChannelVerification.js","sourceRoot":"","sources":["../../../../Server/Utils/ChannelVerification.ts"],"names":[],"mappings":"AAEA,OAAO,MAAM,MAAM,UAAU,CAAC;AAC9B,OAAO,gBAAgB,MAAM,oBAAoB,CAAC;AAClD,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AAItE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,MAAM,uBAAuB,GAAiD,CAC5E,MAAc,EACd,QAAgB,EACR,EAAE;IACV,MAAM,QAAQ,GAAuB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAEzD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,WAAW,GAAW,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAEnD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,WAAW,IAAI,CAAC,EAAE,CAAC;QACtD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAW,uBAAuB,CAC7E,+CAA+C,EAC/C,EAAE,CACH,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAW,uBAAuB,CACtE,wCAAwC,EACxC,CAAC,CACF,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAW,uBAAuB,CACpE,mDAAmD,EACnD,EAAE,CACH,CAAC;AAmBF,MAAM,CAAN,IAAY,0BAQX;AARD,WAAY,0BAA0B;IACpC,mDAAqB,CAAA;IACrB,oDAAsB,CAAA;IACtB,oDAAsB,CAAA;IACtB,kEAAoC,CAAA;IACpC,iDAAmB,CAAA;IACnB,mEAAqC,CAAA;IACrC,8DAAgC,CAAA;AAClC,CAAC,EARW,0BAA0B,KAA1B,0BAA0B,QAQrC;AAuCD,MAAM,QAAQ,GAEiB,CAC7B,OAAgD,EACvB,EAAE;IAC3B,OAAO,OAA6C,CAAC;AACvD,CAAC,CAAC;AAEF,MAAM,CAAC,OAAO,OAAO,mBAAmB;IACtC;;OAEG;IACI,MAAM,CAAC,YAAY,CAAC,MAAY,IAAI,IAAI,EAAE;QAC/C,OAAO,IAAI,IAAI,CACb,GAAG,CAAC,OAAO,EAAE,GAAG,gCAAgC,GAAG,EAAE,GAAG,IAAI,CAC7D,CAAC;IACJ,CAAC;IAED;;;;;;;;;OASG;IACI,MAAM,CAAC,aAAa,CAAC,IAG3B;QACC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,GAAG,GAAS,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;QAEzC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;IAC7D,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,0BAA0B,CAAC,IAGxC;QACC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,OAAO,CAAC,CAAC;QACX,CAAC;QAED,MAAM,GAAG,GAAS,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;QACzC,MAAM,cAAc,GAClB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC;QAE/D;;;WAGG;QACH,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,uBAAuB,CAAC;QACjC,CAAC;QAED,IAAI,cAAc,IAAI,uBAAuB,EAAE,CAAC;YAC9C,OAAO,CAAC,CAAC;QACX,CAAC;QAED,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,uBAAuB,GAAG,cAAc,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED;;;;;;OAMG;IACI,MAAM,CAAC,SAAS,CAAC,IAGvB;QAIC,MAAM,GAAG,GAAS,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;QACzC,MAAM,SAAS,GAAW,gBAAgB,CAAC,QAAQ,EAAE,CAAC;QAEtD,OAAO;YACL,SAAS;YACT,MAAM,EAAE;gBACN,gBAAgB,EAAE,gBAAgB,CAAC,QAAQ,CAAC;oBAC1C,IAAI,EAAE,SAAS;oBACf,SAAS,EAAE,IAAI,CAAC,SAAS;iBAC1B,CAAC;gBACF,yBAAyB,EAAE,mBAAmB,CAAC,YAAY,CAAC,GAAG,CAAC;gBAChE,sBAAsB,EAAE,GAAG;gBAC3B,0BAA0B,EAAE,CAAC;aAC9B;SACF,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACI,MAAM,CAAC,oBAAoB;QAChC,OAAO;YACL,gBAAgB,EAAE,gBAAgB,CAAC,oBAAoB,EAAE;YACzD,yBAAyB,EAAE,IAAuB;SACnD,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACI,MAAM,CAAC,KAAK,CAAC,eAAe,CAEjC,IAGD;QACC,MAAM,MAAM,GAGR,mBAAmB,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAE9D,MAAM,QAAQ,CACZ,IAAI,CAAC,OAA6D,CACnE,CAAC,aAAa,CAAC;YACd,EAAE,EAAE,IAAI,CAAC,MAAM;YACf,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;YACD,IAAI,EAAE,MAAM,CAAC,MAAM;SACpB,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC,SAAS,CAAC;IAC1B,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACI,MAAM,CAAC,KAAK,CAAC,UAAU,CAAwC,IAKrE;;QACC,MAAM,IAAI,GAAkB,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;YACzD,EAAE,EAAE,IAAI,CAAC,MAAM;YACf,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;YACD,MAAM,EAAE;gBACN,MAAM,EAAE,IAAI;gBACZ,SAAS,EAAE,IAAI;gBACf,UAAU,EAAE,IAAI;gBAChB,gBAAgB,EAAE,IAAI;gBACtB,yBAAyB,EAAE,IAAI;gBAC/B,0BAA0B,EAAE,IAAI;aACf;SACpB,CAAC,CAAC;QAEH,MAAM,MAAM,GAA4B,QAAQ,CAC9C,IAAI,CAAC,OAA6D,CACnE,CAAC;QAEF,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,EAAE,OAAO,EAAE,0BAA0B,CAAC,QAAQ,EAAE,CAAC;QAC1D,CAAC;QAED,IAAI,CAAA,MAAA,IAAI,CAAC,MAAM,0CAAE,QAAQ,EAAE,MAAK,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;YACvD,OAAO,EAAE,OAAO,EAAE,0BAA0B,CAAC,QAAQ,EAAE,CAAC;QAC1D,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,OAAO,EAAE,OAAO,EAAE,0BAA0B,CAAC,eAAe,EAAE,CAAC;QACjE,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,0BAA0B,IAAI,CAAC,CAAC,IAAI,yBAAyB,EAAE,CAAC;YACxE,OAAO,EAAE,OAAO,EAAE,0BAA0B,CAAC,eAAe,EAAE,CAAC;QACjE,CAAC;QAED,IACE,mBAAmB,CAAC,aAAa,CAAC;YAChC,SAAS,EAAE,IAAI,CAAC,yBAAyB;SAC1C,CAAC,EACF,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,0BAA0B,CAAC,OAAO,EAAE,CAAC;QACzD,CAAC;QAED,MAAM,aAAa,GACjB,MAAM,MAAM,CAAC,0CAA0C,CAAC;YACtD,EAAE,EAAE,IAAI,CAAC,MAAM;YACf,UAAU,EAAE,4BAA4B;SACzC,CAAC,CAAC;QAEL;;;;;WAKG;QACH,IAAI,aAAa,GAAG,yBAAyB,EAAE,CAAC;YAC9C,OAAO,EAAE,OAAO,EAAE,0BAA0B,CAAC,eAAe,EAAE,CAAC;QACjE,CAAC;QAED,MAAM,aAAa,GAAW,gBAAgB,CAAC,QAAQ,CAAC;YACtD,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;YACvB,SAAS,EAAE,IAAI,CAAC,MAAM;SACvB,CAAC,CAAC;QAEH,IACE,CAAC,gBAAgB,CAAC,WAAW,CAAC,aAAa,EAAE,IAAI,CAAC,gBAAgB,IAAI,EAAE,CAAC,EACzE,CAAC;YACD;;;;;;;;eAQG;YACH,IAAI,aAAa,IAAI,yBAAyB,EAAE,CAAC;gBAC/C,MAAM,MAAM,CAAC,aAAa,CAAC;oBACzB,EAAE,EAAE,IAAI,CAAC,MAAM;oBACf,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;oBACD,IAAI,EAAE,mBAAmB,CAAC,oBAAoB,EAAE;iBACjD,CAAC,CAAC;gBAEH,MAAM,CAAC,IAAI,CACT,iDAAiD,MAAM,CAAC,QAAQ,EAAE,CAAC,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,aAAa,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,iCAAiC,CAC3K,CAAC;YACJ,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,0BAA0B,CAAC,aAAa,EAAE,CAAC;QAC/D,CAAC;QAED;;;;WAIG;QACH,MAAM,MAAM,CAAC,aAAa,CAAC;YACzB,EAAE,EAAE,IAAI,CAAC,MAAM;YACf,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;YACD,IAAI,kBACF,UAAU,EAAE,IAAI,EAChB,0BAA0B,EAAE,CAAC,IAC1B,mBAAmB,CAAC,oBAAoB,EAAE,CAC9C;SACF,CAAC,CAAC;QAEH,OAAO;YACL,OAAO,EAAE,0BAA0B,CAAC,QAAQ;YAC5C,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACI,MAAM,CAAC,mBAAmB,CAC/B,OAAmC;QAEnC,QAAQ,OAAO,EAAE,CAAC;YAChB,KAAK,0BAA0B,CAAC,QAAQ;gBACtC,OAAO,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;YAChD,KAAK,0BAA0B,CAAC,QAAQ;gBACtC,OAAO,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;YACjD,KAAK,0BAA0B,CAAC,eAAe;gBAC7C,OAAO,IAAI,gBAAgB,CAAC,0BAA0B,CAAC,CAAC;YAC1D,KAAK,0BAA0B,CAAC,OAAO;gBACrC,OAAO,IAAI,gBAAgB,CACzB,gEAAgE,CACjE,CAAC;YACJ,KAAK,0BAA0B,CAAC,eAAe;gBAC7C,OAAO,IAAI,gBAAgB,CACzB,oGAAoG,CACrG,CAAC;YACJ;gBACE,OAAO,IAAI,gBAAgB,CAAC,cAAc,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;CACF"}