@oneuptime/common 12.0.13 → 12.0.14

package/build/dist/Server/Utils/Monitor/SeriesResourceLinker.js

@@ -9,6 +9,7 @@ import ProxmoxCluster from "../../../Models/DatabaseModels/ProxmoxCluster";
 import Service from "../../../Models/DatabaseModels/Service";
 import Includes from "../../../Types/BaseDatabase/Includes";
 import { LIMIT_PER_PROJECT } from "../../../Types/Database/LimitMax";
+import MonitorType from "../../../Types/Monitor/MonitorType";
 import CephClusterService from "../../Services/CephClusterService";
 import DockerHostService from "../../Services/DockerHostService";
 import DockerSwarmClusterService from "../../Services/DockerSwarmClusterService";
@@ -18,6 +19,7 @@ import KubernetesClusterService from "../../Services/KubernetesClusterService";
 import PodmanHostService from "../../Services/PodmanHostService";
 import ProxmoxClusterService from "../../Services/ProxmoxClusterService";
 import ServiceService from "../../Services/ServiceService";
+import QueryHelper from "../../Types/Database/QueryHelper";
 import SeriesResourceLabels from "./SeriesResourceLabels";
 export default class SeriesResourceLinker {
     /*
@@ -29,6 +31,42 @@ export default class SeriesResourceLinker {
      */
     static async resolveResourcesFromSeriesLabels(input) {
         const refs = SeriesResourceLabels.extractResourceRefs(input.seriesLabels);
+        /*
+         * On a Docker or Podman monitor, `resource.host.name` names the
+         * DockerHost / PodmanHost the containers run on — the agent stamps
+         * the container runtime's host under the generic key. The label key
+         * map hands that key to Host, which would attach an unrelated Host
+         * row and surface the event on that host's Activity tab. The
+         * step-config path links the right model instead
+         * (MonitorStepResourceIdentity), so drop the host refs here rather
+         * than linking a resource the event is not about.
+         */
+        if (input.monitorType === MonitorType.Docker ||
+            input.monitorType === MonitorType.Podman) {
+            refs.hostIds = [];
+            refs.hostNames = [];
+        }
+        /*
+         * Series labels are ingest-written, so they match the resource
+         * rows' identifier columns byte for byte. See resolveResourceIds
+         * for why that rules out case-insensitive matching here.
+         */
+        return this.resolveResourceRefs({
+            refs: refs,
+            projectId: input.projectId,
+            nameMatch: "exact",
+        });
+    }
+    /*
+     * The one place that turns identifiers into database ids, shared by
+     * the series-label path and the monitor-step-config path
+     * (MonitorStepResourceIdentity). Keeping the nine-way lookup table,
+     * the project scoping and the `Includes` batching in a single
+     * function is what stops the two paths from resolving the same
+     * identifier to different rows.
+     */
+    static async resolveResourceRefs(input) {
+        const refs = input.refs;
         /*
          * Proxmox / Ceph / Docker Swarm / IoT carry no `oneuptime.*.id`
          * stamp at ingest — they are addressable by name only — so their
@@ -96,6 +134,7 @@ export default class SeriesResourceLinker {
                 names: spec.names,
                 nameColumn: spec.nameColumn,
                 projectId: input.projectId,
+                nameMatch: input.nameMatch,
                 findBy: spec.findBy,
             });
         }));
@@ -113,9 +152,10 @@ export default class SeriesResourceLinker {
     }
     /*
      * Resolve the series' resources and MERGE them onto the alert/incident.
-     * Merging (rather than assigning) matters because attachClusterContext
-     * writes the same four cluster relations from the monitor's step
-     * config; whichever runs second must not erase the other's work.
+     * Merging (rather than assigning) matters because
+     * attachResolvedResources writes the same relations from the
+     * monitor's step config; whichever runs second must not erase the
+     * other's work.
      *
      * Relations the series says nothing about are left untouched —
      * `undefined`, not `[]` — so an ungrouped event and an event whose
@@ -130,6 +170,7 @@ export default class SeriesResourceLinker {
         const resolved = await this.resolveResourcesFromSeriesLabels({
             seriesLabels: input.seriesLabels,
             projectId: input.projectId,
+            monitorType: input.monitorType,
         });
         this.mergeResolvedIdsIntoModel({
             model: input.model,
@@ -137,27 +178,19 @@ export default class SeriesResourceLinker {
         });
     }
     /*
-     * Attach the cluster ids resolved from the monitor's step config
-     * (Proxmox / Ceph / Docker Swarm / IoT), merging with — never
-     * overwriting — anything the series-label path already linked. Both
-     * paths can resolve the same cluster, so this dedupes by id. Unlike
-     * the label path this runs for ungrouped events too: those monitor
-     * types get their cluster identity from the step config alone.
+     * Attach the resources resolved from the monitor's own step config
+     * (MonitorResourceContext), merging with — never overwriting —
+     * anything the series-label path already linked. Both paths can
+     * resolve the same resource, so this dedupes by id.
+     *
+     * Unlike the label path this runs for ungrouped events too, and that
+     * is the whole point: an ungrouped monitor has no series labels, so
+     * before this existed it linked nothing at all.
      */
-    static attachClusterContext(input) {
+    static attachResolvedResources(input) {
         this.mergeResolvedIdsIntoModel({
             model: input.model,
-            resolved: {
-                hostIds: [],
-                dockerHostIds: [],
-                podmanHostIds: [],
-                kubernetesClusterIds: [],
-                serviceIds: [],
-                proxmoxClusterIds: input.clusterContext.proxmoxClusterIds,
-                cephClusterIds: input.clusterContext.cephClusterIds,
-                dockerSwarmClusterIds: input.clusterContext.dockerSwarmClusterIds,
-                iotFleetIds: input.clusterContext.iotFleetIds,
-            },
+            resolved: input.resolved,
         });
     }
     static mergeResolvedIdsIntoModel(input) {
@@ -236,10 +269,16 @@ export default class SeriesResourceLinker {
      * Costs zero round-trips when the series carries neither, which is the
      * common case for most of the nine types on any given series.
      *
-     * Name matching is exact. Every identifier column read here is written
-     * by ingest from the same attribute the series label carries — host
-     * identifiers are canonicalized on both sides — so exact matching is
-     * what keeps a lookup from straying onto a neighbouring row.
+     * `nameMatch: "exact"` is for series labels. Every identifier column
+     * read here is written by ingest from the same attribute the series
+     * label carries — host identifiers are canonicalized on both sides —
+     * so exact matching is what keeps a lookup from straying onto a
+     * neighbouring row.
+     *
+     * `nameMatch: "caseInsensitive"` is for monitor step configs, where
+     * the identifier was typed by a user and the row's name was stamped
+     * by an agent; the two legitimately differ by case. This mirrors what
+     * ingest discovery itself does when it keys a row by name.
      */
     static async resolveResourceIds(input) {
         if (input.ids.length === 0 && input.names.length === 0) {
@@ -263,7 +302,9 @@ export default class SeriesResourceLinker {
             lookups.push(input.findBy({
                 query: {
                     projectId: input.projectId,
-                    [input.nameColumn]: new Includes(input.names),
+                    [input.nameColumn]: input.nameMatch === "caseInsensitive"
+                        ? QueryHelper.findWithSameTextAnyOf(input.names)
+                        : new Includes(input.names),
                 },
                 select: { _id: true },
                 skip: 0,

package/build/dist/Server/Utils/Monitor/SeriesResourceLinker.js.map

@@ -1 +1 @@
-{"version":3,"file":"SeriesResourceLinker.js","sourceRoot":"","sources":["../../../../../Server/Utils/Monitor/SeriesResourceLinker.ts"],"names":[],"mappings":"AAAA,OAAO,WAAW,MAAM,4CAA4C,CAAC;AACrE,OAAO,UAAU,MAAM,2CAA2C,CAAC;AACnE,OAAO,kBAAkB,MAAM,mDAAmD,CAAC;AACnF,OAAO,IAAI,MAAM,qCAAqC,CAAC;AACvD,OAAO,QAAQ,MAAM,yCAAyC,CAAC;AAC/D,OAAO,iBAAiB,MAAM,kDAAkD,CAAC;AACjF,OAAO,UAAU,MAAM,2CAA2C,CAAC;AACnE,OAAO,cAAc,MAAM,+CAA+C,CAAC;AAC3E,OAAO,OAAO,MAAM,wCAAwC,CAAC;AAC7D,OAAO,QAAQ,MAAM,sCAAsC,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAGrE,OAAO,kBAAkB,MAAM,mCAAmC,CAAC;AACnE,OAAO,iBAAiB,MAAM,kCAAkC,CAAC;AACjE,OAAO,yBAAyB,MAAM,0CAA0C,CAAC;AACjF,OAAO,WAAW,MAAM,4BAA4B,CAAC;AACrD,OAAO,eAAe,MAAM,gCAAgC,CAAC;AAC7D,OAAO,wBAAwB,MAAM,yCAAyC,CAAC;AAC/E,OAAO,iBAAiB,MAAM,kCAAkC,CAAC;AACjE,OAAO,qBAAqB,MAAM,sCAAsC,CAAC;AACzE,OAAO,cAAc,MAAM,+BAA+B,CAAC;AAE3D,OAAO,oBAEN,MAAM,wBAAwB,CAAC;AAkEhC,MAAM,CAAC,OAAO,OAAO,oBAAoB;IACvC;;;;;;OAMG;IACI,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAAC,KAGpD;QACC,MAAM,IAAI,GAAuB,oBAAoB,CAAC,mBAAmB,CACvE,KAAK,CAAC,YAAY,CACnB,CAAC;QAEF;;;;WAIG;QACH,MAAM,KAAK,GAAkC;YAC3C;gBACE,GAAG,EAAE,IAAI,CAAC,OAAO;gBACjB,KAAK,EAAE,IAAI,CAAC,SAAS;gBACrB,UAAU,EAAE,gBAAgB;gBAC5B,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC;aAC7C;YACD;gBACE,GAAG,EAAE,IAAI,CAAC,aAAa;gBACvB,KAAK,EAAE,IAAI,CAAC,eAAe;gBAC3B,UAAU,EAAE,gBAAgB;gBAC5B,MAAM,EAAE,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC;aACzD;YACD;gBACE,GAAG,EAAE,IAAI,CAAC,aAAa;gBACvB,KAAK,EAAE,IAAI,CAAC,eAAe;gBAC3B,UAAU,EAAE,gBAAgB;gBAC5B,MAAM,EAAE,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC;aACzD;YACD;gBACE,GAAG,EAAE,IAAI,CAAC,oBAAoB;gBAC9B,KAAK,EAAE,IAAI,CAAC,sBAAsB;gBAClC,UAAU,EAAE,mBAAmB;gBAC/B,MAAM,EAAE,wBAAwB,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC;aACvE;YACD;gBACE,GAAG,EAAE,IAAI,CAAC,UAAU;gBACpB,KAAK,EAAE,IAAI,CAAC,YAAY;gBACxB,UAAU,EAAE,MAAM;gBAClB,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC;aACnD;YACD;gBACE,GAAG,EAAE,EAAE;gBACP,KAAK,EAAE,IAAI,CAAC,mBAAmB;gBAC/B,UAAU,EAAE,MAAM;gBAClB,MAAM,EAAE,qBAAqB,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC;aACjE;YACD;gBACE,GAAG,EAAE,EAAE;gBACP,KAAK,EAAE,IAAI,CAAC,gBAAgB;gBAC5B,UAAU,EAAE,MAAM;gBAClB,MAAM,EAAE,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC;aAC3D;YACD;gBACE,GAAG,EAAE,EAAE;gBACP,KAAK,EAAE,IAAI,CAAC,uBAAuB;gBACnC,UAAU,EAAE,MAAM;gBAClB,MAAM,EAAE,yBAAyB,CAAC,MAAM,CAAC,IAAI,CAC3C,yBAAyB,CAC1B;aACF;YACD;gBACE,GAAG,EAAE,EAAE;gBACP,KAAK,EAAE,IAAI,CAAC,aAAa;gBACzB,UAAU,EAAE,MAAM;gBAClB,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC;aACrD;SACF,CAAC;QAEF,MAAM,CACJ,OAAO,EACP,aAAa,EACb,aAAa,EACb,oBAAoB,EACpB,UAAU,EACV,iBAAiB,EACjB,cAAc,EACd,qBAAqB,EACrB,WAAW,EACZ,GAAG,MAAM,OAAO,CAAC,GAAG,CACnB,KAAK,CAAC,GAAG,CAAC,CAAC,IAA4B,EAA0B,EAAE;YACjE,OAAO,IAAI,CAAC,kBAAkB,CAAC;gBAC7B,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM,EAAE,IAAI,CAAC,MAAM;aACpB,CAAC,CAAC;QACL,CAAC,CAAC,CACH,CAAC;QAEF,OAAO;YACL,OAAO,EAAE,OAAO,IAAI,EAAE;YACtB,aAAa,EAAE,aAAa,IAAI,EAAE;YAClC,aAAa,EAAE,aAAa,IAAI,EAAE;YAClC,oBAAoB,EAAE,oBAAoB,IAAI,EAAE;YAChD,UAAU,EAAE,UAAU,IAAI,EAAE;YAC5B,iBAAiB,EAAE,iBAAiB,IAAI,EAAE;YAC1C,cAAc,EAAE,cAAc,IAAI,EAAE;YACpC,qBAAqB,EAAE,qBAAqB,IAAI,EAAE;YAClD,WAAW,EAAE,WAAW,IAAI,EAAE;SAC/B,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACI,MAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC,KAI9C;QACC,MAAM,QAAQ,GACZ,MAAM,IAAI,CAAC,gCAAgC,CAAC;YAC1C,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;QAEL,IAAI,CAAC,yBAAyB,CAAC;YAC7B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACI,MAAM,CAAC,oBAAoB,CAAC,KAGlC;QACC,IAAI,CAAC,yBAAyB,CAAC;YAC7B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE;gBACR,OAAO,EAAE,EAAE;gBACX,aAAa,EAAE,EAAE;gBACjB,aAAa,EAAE,EAAE;gBACjB,oBAAoB,EAAE,EAAE;gBACxB,UAAU,EAAE,EAAE;gBACd,iBAAiB,EAAE,KAAK,CAAC,cAAc,CAAC,iBAAiB;gBACzD,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,cAAc;gBACnD,qBAAqB,EAAE,KAAK,CAAC,cAAc,CAAC,qBAAqB;gBACjE,WAAW,EAAE,KAAK,CAAC,cAAc,CAAC,WAAW;aAC9C;SACF,CAAC,CAAC;IACL,CAAC;IAEO,MAAM,CAAC,yBAAyB,CAAC,KAGxC;QACC,MAAM,KAAK,GAAwB,KAAK,CAAC,KAAK,CAAC;QAC/C,MAAM,QAAQ,GAA8B,KAAK,CAAC,QAAQ,CAAC;QAE3D,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,OAAO,EAAE,GAAS,EAAE;gBACrE,OAAO,IAAI,IAAI,EAAE,CAAC;YACpB,CAAC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,QAAQ,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,SAAS,CAChC,KAAK,CAAC,WAAW,EACjB,QAAQ,CAAC,aAAa,EACtB,GAAe,EAAE;gBACf,OAAO,IAAI,UAAU,EAAE,CAAC;YAC1B,CAAC,CACF,CAAC;QACJ,CAAC;QAED,IAAI,QAAQ,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,SAAS,CAChC,KAAK,CAAC,WAAW,EACjB,QAAQ,CAAC,aAAa,EACtB,GAAe,EAAE;gBACf,OAAO,IAAI,UAAU,EAAE,CAAC;YAC1B,CAAC,CACF,CAAC;QACJ,CAAC;QAED,IAAI,QAAQ,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7C,KAAK,CAAC,kBAAkB,GAAG,IAAI,CAAC,SAAS,CACvC,KAAK,CAAC,kBAAkB,EACxB,QAAQ,CAAC,oBAAoB,EAC7B,GAAsB,EAAE;gBACtB,OAAO,IAAI,iBAAiB,EAAE,CAAC;YACjC,CAAC,CACF,CAAC;QACJ,CAAC;QAED,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,SAAS,CAC7B,KAAK,CAAC,QAAQ,EACd,QAAQ,CAAC,UAAU,EACnB,GAAY,EAAE;gBACZ,OAAO,IAAI,OAAO,EAAE,CAAC;YACvB,CAAC,CACF,CAAC;QACJ,CAAC;QAED,IAAI,QAAQ,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1C,KAAK,CAAC,eAAe,GAAG,IAAI,CAAC,SAAS,CACpC,KAAK,CAAC,eAAe,EACrB,QAAQ,CAAC,iBAAiB,EAC1B,GAAmB,EAAE;gBACnB,OAAO,IAAI,cAAc,EAAE,CAAC;YAC9B,CAAC,CACF,CAAC;QACJ,CAAC;QAED,IAAI,QAAQ,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvC,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC,SAAS,CACjC,KAAK,CAAC,YAAY,EAClB,QAAQ,CAAC,cAAc,EACvB,GAAgB,EAAE;gBAChB,OAAO,IAAI,WAAW,EAAE,CAAC;YAC3B,CAAC,CACF,CAAC;QACJ,CAAC;QAED,IAAI,QAAQ,CAAC,qBAAqB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9C,KAAK,CAAC,mBAAmB,GAAG,IAAI,CAAC,SAAS,CACxC,KAAK,CAAC,mBAAmB,EACzB,QAAQ,CAAC,qBAAqB,EAC9B,GAAuB,EAAE;gBACvB,OAAO,IAAI,kBAAkB,EAAE,CAAC;YAClC,CAAC,CACF,CAAC;QACJ,CAAC;QAED,IAAI,QAAQ,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAC9B,KAAK,CAAC,SAAS,EACf,QAAQ,CAAC,WAAW,EACpB,GAAa,EAAE;gBACb,OAAO,IAAI,QAAQ,EAAE,CAAC;YACxB,CAAC,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,MAAM,CAAC,SAAS,CACtB,QAA8B,EAC9B,WAA0B,EAC1B,MAAe;QAEf,MAAM,MAAM,GAAa,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAgB,IAAI,GAAG,CAClC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAO,EAAU,EAAE;YAC7B,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC,CAAC,CACH,CAAC;QAEF,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;YAC7B,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBACpB,SAAS;YACX,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAEhB,MAAM,IAAI,GAAM,MAAM,EAAE,CAAC;YACzB,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC;YACd,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;OASG;IACK,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,KAavC;QACC,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvD,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,QAAQ,GAAgB,IAAI,GAAG,EAAU,CAAC;QAEhD,MAAM,OAAO,GAAwD,EAAE,CAAC;QAExE,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,IAAI,CACV,KAAK,CAAC,MAAM,CAAC;gBACX,KAAK,EAAE;oBACL,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,GAAG,EAAE,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC;iBAC7B;gBACD,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE;gBACrB,IAAI,EAAE,CAAC;gBACP,KAAK,EAAE,iBAAiB;gBACxB,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;aACxB,CAAC,CACH,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,OAAO,CAAC,IAAI,CACV,KAAK,CAAC,MAAM,CAAC;gBACX,KAAK,EAAE;oBACL,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC;iBAC9C;gBACD,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE;gBACrB,IAAI,EAAE,CAAC;gBACP,KAAK,EAAE,iBAAiB;gBACxB,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;aACxB,CAAC,CACH,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GACX,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAE7B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;gBACzB,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;oBACZ,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;gBAChC,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;CACF"}
+{"version":3,"file":"SeriesResourceLinker.js","sourceRoot":"","sources":["../../../../../Server/Utils/Monitor/SeriesResourceLinker.ts"],"names":[],"mappings":"AAAA,OAAO,WAAW,MAAM,4CAA4C,CAAC;AACrE,OAAO,UAAU,MAAM,2CAA2C,CAAC;AACnE,OAAO,kBAAkB,MAAM,mDAAmD,CAAC;AACnF,OAAO,IAAI,MAAM,qCAAqC,CAAC;AACvD,OAAO,QAAQ,MAAM,yCAAyC,CAAC;AAC/D,OAAO,iBAAiB,MAAM,kDAAkD,CAAC;AACjF,OAAO,UAAU,MAAM,2CAA2C,CAAC;AACnE,OAAO,cAAc,MAAM,+CAA+C,CAAC;AAC3E,OAAO,OAAO,MAAM,wCAAwC,CAAC;AAC7D,OAAO,QAAQ,MAAM,sCAAsC,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAErE,OAAO,WAAW,MAAM,oCAAoC,CAAC;AAE7D,OAAO,kBAAkB,MAAM,mCAAmC,CAAC;AACnE,OAAO,iBAAiB,MAAM,kCAAkC,CAAC;AACjE,OAAO,yBAAyB,MAAM,0CAA0C,CAAC;AACjF,OAAO,WAAW,MAAM,4BAA4B,CAAC;AACrD,OAAO,eAAe,MAAM,gCAAgC,CAAC;AAC7D,OAAO,wBAAwB,MAAM,yCAAyC,CAAC;AAC/E,OAAO,iBAAiB,MAAM,kCAAkC,CAAC;AACjE,OAAO,qBAAqB,MAAM,sCAAsC,CAAC;AACzE,OAAO,cAAc,MAAM,+BAA+B,CAAC;AAC3D,OAAO,WAAW,MAAM,kCAAkC,CAAC;AAC3D,OAAO,oBAEN,MAAM,wBAAwB,CAAC;AAyEhC,MAAM,CAAC,OAAO,OAAO,oBAAoB;IACvC;;;;;;OAMG;IACI,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAAC,KAQpD;QACC,MAAM,IAAI,GAAuB,oBAAoB,CAAC,mBAAmB,CACvE,KAAK,CAAC,YAAY,CACnB,CAAC;QAEF;;;;;;;;;WASG;QACH,IACE,KAAK,CAAC,WAAW,KAAK,WAAW,CAAC,MAAM;YACxC,KAAK,CAAC,WAAW,KAAK,WAAW,CAAC,MAAM,EACxC,CAAC;YACD,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC;YAClB,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC;QACtB,CAAC;QAED;;;;WAIG;QACH,OAAO,IAAI,CAAC,mBAAmB,CAAC;YAC9B,IAAI,EAAE,IAAI;YACV,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,OAAO;SACnB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACI,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,KAIvC;QACC,MAAM,IAAI,GAAuB,KAAK,CAAC,IAAI,CAAC;QAE5C;;;;WAIG;QACH,MAAM,KAAK,GAAkC;YAC3C;gBACE,GAAG,EAAE,IAAI,CAAC,OAAO;gBACjB,KAAK,EAAE,IAAI,CAAC,SAAS;gBACrB,UAAU,EAAE,gBAAgB;gBAC5B,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC;aAC7C;YACD;gBACE,GAAG,EAAE,IAAI,CAAC,aAAa;gBACvB,KAAK,EAAE,IAAI,CAAC,eAAe;gBAC3B,UAAU,EAAE,gBAAgB;gBAC5B,MAAM,EAAE,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC;aACzD;YACD;gBACE,GAAG,EAAE,IAAI,CAAC,aAAa;gBACvB,KAAK,EAAE,IAAI,CAAC,eAAe;gBAC3B,UAAU,EAAE,gBAAgB;gBAC5B,MAAM,EAAE,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC;aACzD;YACD;gBACE,GAAG,EAAE,IAAI,CAAC,oBAAoB;gBAC9B,KAAK,EAAE,IAAI,CAAC,sBAAsB;gBAClC,UAAU,EAAE,mBAAmB;gBAC/B,MAAM,EAAE,wBAAwB,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC;aACvE;YACD;gBACE,GAAG,EAAE,IAAI,CAAC,UAAU;gBACpB,KAAK,EAAE,IAAI,CAAC,YAAY;gBACxB,UAAU,EAAE,MAAM;gBAClB,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC;aACnD;YACD;gBACE,GAAG,EAAE,EAAE;gBACP,KAAK,EAAE,IAAI,CAAC,mBAAmB;gBAC/B,UAAU,EAAE,MAAM;gBAClB,MAAM,EAAE,qBAAqB,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC;aACjE;YACD;gBACE,GAAG,EAAE,EAAE;gBACP,KAAK,EAAE,IAAI,CAAC,gBAAgB;gBAC5B,UAAU,EAAE,MAAM;gBAClB,MAAM,EAAE,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC;aAC3D;YACD;gBACE,GAAG,EAAE,EAAE;gBACP,KAAK,EAAE,IAAI,CAAC,uBAAuB;gBACnC,UAAU,EAAE,MAAM;gBAClB,MAAM,EAAE,yBAAyB,CAAC,MAAM,CAAC,IAAI,CAC3C,yBAAyB,CAC1B;aACF;YACD;gBACE,GAAG,EAAE,EAAE;gBACP,KAAK,EAAE,IAAI,CAAC,aAAa;gBACzB,UAAU,EAAE,MAAM;gBAClB,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC;aACrD;SACF,CAAC;QAEF,MAAM,CACJ,OAAO,EACP,aAAa,EACb,aAAa,EACb,oBAAoB,EACpB,UAAU,EACV,iBAAiB,EACjB,cAAc,EACd,qBAAqB,EACrB,WAAW,EACZ,GAAG,MAAM,OAAO,CAAC,GAAG,CACnB,KAAK,CAAC,GAAG,CAAC,CAAC,IAA4B,EAA0B,EAAE;YACjE,OAAO,IAAI,CAAC,kBAAkB,CAAC;gBAC7B,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM,EAAE,IAAI,CAAC,MAAM;aACpB,CAAC,CAAC;QACL,CAAC,CAAC,CACH,CAAC;QAEF,OAAO;YACL,OAAO,EAAE,OAAO,IAAI,EAAE;YACtB,aAAa,EAAE,aAAa,IAAI,EAAE;YAClC,aAAa,EAAE,aAAa,IAAI,EAAE;YAClC,oBAAoB,EAAE,oBAAoB,IAAI,EAAE;YAChD,UAAU,EAAE,UAAU,IAAI,EAAE;YAC5B,iBAAiB,EAAE,iBAAiB,IAAI,EAAE;YAC1C,cAAc,EAAE,cAAc,IAAI,EAAE;YACpC,qBAAqB,EAAE,qBAAqB,IAAI,EAAE;YAClD,WAAW,EAAE,WAAW,IAAI,EAAE;SAC/B,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACI,MAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC,KAS9C;QACC,MAAM,QAAQ,GACZ,MAAM,IAAI,CAAC,gCAAgC,CAAC;YAC1C,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC,CAAC;QAEL,IAAI,CAAC,yBAAyB,CAAC;YAC7B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACI,MAAM,CAAC,uBAAuB,CAAC,KAGrC;QACC,IAAI,CAAC,yBAAyB,CAAC;YAC7B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,CAAC;IACL,CAAC;IAEO,MAAM,CAAC,yBAAyB,CAAC,KAGxC;QACC,MAAM,KAAK,GAAwB,KAAK,CAAC,KAAK,CAAC;QAC/C,MAAM,QAAQ,GAA8B,KAAK,CAAC,QAAQ,CAAC;QAE3D,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,OAAO,EAAE,GAAS,EAAE;gBACrE,OAAO,IAAI,IAAI,EAAE,CAAC;YACpB,CAAC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,QAAQ,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,SAAS,CAChC,KAAK,CAAC,WAAW,EACjB,QAAQ,CAAC,aAAa,EACtB,GAAe,EAAE;gBACf,OAAO,IAAI,UAAU,EAAE,CAAC;YAC1B,CAAC,CACF,CAAC;QACJ,CAAC;QAED,IAAI,QAAQ,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,SAAS,CAChC,KAAK,CAAC,WAAW,EACjB,QAAQ,CAAC,aAAa,EACtB,GAAe,EAAE;gBACf,OAAO,IAAI,UAAU,EAAE,CAAC;YAC1B,CAAC,CACF,CAAC;QACJ,CAAC;QAED,IAAI,QAAQ,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7C,KAAK,CAAC,kBAAkB,GAAG,IAAI,CAAC,SAAS,CACvC,KAAK,CAAC,kBAAkB,EACxB,QAAQ,CAAC,oBAAoB,EAC7B,GAAsB,EAAE;gBACtB,OAAO,IAAI,iBAAiB,EAAE,CAAC;YACjC,CAAC,CACF,CAAC;QACJ,CAAC;QAED,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,SAAS,CAC7B,KAAK,CAAC,QAAQ,EACd,QAAQ,CAAC,UAAU,EACnB,GAAY,EAAE;gBACZ,OAAO,IAAI,OAAO,EAAE,CAAC;YACvB,CAAC,CACF,CAAC;QACJ,CAAC;QAED,IAAI,QAAQ,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1C,KAAK,CAAC,eAAe,GAAG,IAAI,CAAC,SAAS,CACpC,KAAK,CAAC,eAAe,EACrB,QAAQ,CAAC,iBAAiB,EAC1B,GAAmB,EAAE;gBACnB,OAAO,IAAI,cAAc,EAAE,CAAC;YAC9B,CAAC,CACF,CAAC;QACJ,CAAC;QAED,IAAI,QAAQ,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvC,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC,SAAS,CACjC,KAAK,CAAC,YAAY,EAClB,QAAQ,CAAC,cAAc,EACvB,GAAgB,EAAE;gBAChB,OAAO,IAAI,WAAW,EAAE,CAAC;YAC3B,CAAC,CACF,CAAC;QACJ,CAAC;QAED,IAAI,QAAQ,CAAC,qBAAqB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9C,KAAK,CAAC,mBAAmB,GAAG,IAAI,CAAC,SAAS,CACxC,KAAK,CAAC,mBAAmB,EACzB,QAAQ,CAAC,qBAAqB,EAC9B,GAAuB,EAAE;gBACvB,OAAO,IAAI,kBAAkB,EAAE,CAAC;YAClC,CAAC,CACF,CAAC;QACJ,CAAC;QAED,IAAI,QAAQ,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAC9B,KAAK,CAAC,SAAS,EACf,QAAQ,CAAC,WAAW,EACpB,GAAa,EAAE;gBACb,OAAO,IAAI,QAAQ,EAAE,CAAC;YACxB,CAAC,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,MAAM,CAAC,SAAS,CACtB,QAA8B,EAC9B,WAA0B,EAC1B,MAAe;QAEf,MAAM,MAAM,GAAa,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAgB,IAAI,GAAG,CAClC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAO,EAAU,EAAE;YAC7B,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC,CAAC,CACH,CAAC;QAEF,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;YAC7B,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBACpB,SAAS;YACX,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAEhB,MAAM,IAAI,GAAM,MAAM,EAAE,CAAC;YACzB,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC;YACd,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACK,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,KAcvC;QACC,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvD,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,QAAQ,GAAgB,IAAI,GAAG,EAAU,CAAC;QAEhD,MAAM,OAAO,GAAwD,EAAE,CAAC;QAExE,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,IAAI,CACV,KAAK,CAAC,MAAM,CAAC;gBACX,KAAK,EAAE;oBACL,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,GAAG,EAAE,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC;iBAC7B;gBACD,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE;gBACrB,IAAI,EAAE,CAAC;gBACP,KAAK,EAAE,iBAAiB;gBACxB,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;aACxB,CAAC,CACH,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,OAAO,CAAC,IAAI,CACV,KAAK,CAAC,MAAM,CAAC;gBACX,KAAK,EAAE;oBACL,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,CAAC,KAAK,CAAC,UAAU,CAAC,EAChB,KAAK,CAAC,SAAS,KAAK,iBAAiB;wBACnC,CAAC,CAAC,WAAW,CAAC,qBAAqB,CAAC,KAAK,CAAC,KAAK,CAAC;wBAChD,CAAC,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC;iBAChC;gBACD,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE;gBACrB,IAAI,EAAE,CAAC;gBACP,KAAK,EAAE,iBAAiB;gBACxB,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;aACxB,CAAC,CACH,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GACX,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAE7B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;gBACzB,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;oBACZ,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;gBAChC,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;CACF"}

package/build/dist/Server/Utils/TotpAuth.js

@@ -9,6 +9,59 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 };
 import * as OTPAuth from "otpauth";
 import CaptureSpan from "./Telemetry/CaptureSpan";
+/**
+ * The HMAC algorithm every new enrolment is issued with.
+ *
+ * RFC 6238 fixes SHA1 as the default and every authenticator implements it.
+ * The `algorithm` parameter in an otpauth:// URI is, in practice, advisory:
+ * Google Authenticator and Microsoft Authenticator parse the URI, ignore the
+ * parameter, and compute SHA1 anyway. A server that issues `algorithm=SHA256`
+ * therefore hands those apps a QR code they will silently mis-implement — the
+ * app shows a confident six digits, the server computes a completely different
+ * six digits, and enrolment can never succeed no matter how many codes the
+ * user tries. That is the failure this constant exists to prevent.
+ *
+ * SHA1 is not a weakness here. HMAC-SHA1 is unaffected by the collision
+ * attacks that retired SHA1 for signatures (RFC 6234 / RFC 2104), and the
+ * output is truncated to six digits over a 30 second window regardless — the
+ * brute-force surface is the 10^6 code space, not the hash.
+ */
+export const DefaultTotpAlgorithm = "SHA1";
+/**
+ * Algorithms a submitted token is checked against, in order.
+ *
+ * OneUptime issued `SHA256` enrolments before this was understood. Those
+ * secrets are still in the database and still work in the minority of apps
+ * that do honour the parameter (1Password, Bitwarden, Aegis, FreeOTP), so
+ * dropping SHA256 from verification would lock those accounts out of their
+ * own logins.
+ *
+ * The cost is exactly one bit: two algorithms across the validation window
+ * means twice as many six-digit strings are accepted at any instant. Against
+ * a 10^6 code space that is still a vanishing fraction, and the tests pin the
+ * bound so it cannot quietly grow.
+ *
+ * Retiring SHA256 needs more than time passing. Nothing on the row records
+ * which algorithm the user's app actually computes, so "no legacy rows remain"
+ * is not a question the database can answer today — removing it means either
+ * storing the algorithm that verified, or accepting that some long-dormant
+ * account re-enrols instead of logging in.
+ */
+export const SupportedTotpAlgorithms = ["SHA1", "SHA256"];
+/**
+ * Number of 30 second steps either side of now that a token is accepted for.
+ *
+ * Three steps is +/- 90 seconds, which absorbs ordinary phone/server clock
+ * drift and the user typing the last digit as the code rolls over.
+ */
+export const TotpValidationWindow = 3;
+/**
+ * Number of digits in a token, and the length of the time step in seconds.
+ * Both are the values Google Authenticator assumes, and — like `algorithm` —
+ * both are parameters it ignores when told anything else.
+ */
+export const TotpDigits = 6;
+export const TotpPeriodInSeconds = 30;
 /**
  * Utility class for handling TOTP authentication.
  */
@@ -32,26 +85,82 @@ export default class TotpAuth {
                 email: data.email,
             }),
             // Algorithm used for the HMAC function.
-            algorithm: "SHA256",
+            algorithm: data.algorithm || DefaultTotpAlgorithm,
             // Length of the generated tokens.
-            digits: 6,
+            digits: TotpDigits,
             // Interval of time for which a token is valid, in seconds.
-            period: 30,
+            period: TotpPeriodInSeconds,
             // Arbitrary key encoded in Base32 or OTPAuth.Secret instance.
             secret: data.secret,
         });
         return totp;
     }
+    /**
+     * Strips the formatting authenticator apps add for readability.
+     *
+     * Google Authenticator renders a code as "123 456" and both the iOS and
+     * Android clipboards keep that space when the user copies it. Rejecting the
+     * paste is a self-inflicted "Invalid code" for a user who supplied exactly
+     * the right secret material, so the separators are removed before the token
+     * is compared. Anything that is not a digit is dropped, which also covers
+     * the hyphen some apps use and stray whitespace from a trimmed paste.
+     *
+     * @param token - The raw token as submitted.
+     * @returns The token reduced to its digits.
+     */
+    static normalizeToken(token) {
+        /*
+         * The token arrives straight off a JSON body, so it is only a string
+         * because the client chose to send one. A number or an object here must
+         * fail verification, not throw out of `.replace` and surface as a 500.
+         */
+        if (typeof token !== "string" || !token) {
+            return "";
+        }
+        return token.replace(/\D/g, "");
+    }
     /**
      * Verifies if a given token matches the provided secret key.
      * @param data - The data object containing the secret key and token.
      * @returns A boolean indicating whether the token is valid or not.
      */
     static verifyToken(data) {
-        const { secret, token, email } = data;
-        const totp = this.getTotp({ secret, email });
-        const delta = totp.validate({ token, window: 3 });
-        return delta !== null;
+        const { secret, email } = data;
+        if (!secret) {
+            return false;
+        }
+        const token = this.normalizeToken(data.token);
+        /*
+         * otpauth compares the submitted string against the codes it generates,
+         * so a token of the wrong length can never match — but it would still be
+         * run through one HMAC per algorithm per window step first. Reject it up
+         * front instead.
+         */
+        if (token.length !== TotpDigits) {
+            return false;
+        }
+        for (const algorithm of SupportedTotpAlgorithms) {
+            let totp;
+            try {
+                totp = this.getTotp({ secret, email, algorithm });
+            }
+            catch (_a) {
+                /*
+                 * A secret that is not valid base32 throws in the OTPAuth.Secret
+                 * constructor. That is a corrupt row, not a wrong code, and it fails
+                 * identically for every algorithm — so stop rather than repeat it.
+                 */
+                return false;
+            }
+            const delta = totp.validate({
+                token,
+                window: TotpValidationWindow,
+            });
+            if (delta !== null) {
+                return true;
+            }
+        }
+        return false;
     }
     /**
      * Generates a URI for the given secret key and user email, which can be used to set up two-factor authentication.
@@ -60,7 +169,11 @@ export default class TotpAuth {
      */
     static generateUri(data) {
         const { secret, userEmail } = data;
-        const totp = this.getTotp({ secret, email: userEmail });
+        const totp = this.getTotp({
+            secret,
+            email: userEmail,
+            algorithm: DefaultTotpAlgorithm,
+        });
         return totp.toString();
     }
 }
@@ -82,6 +195,12 @@ __decorate([
     __metadata("design:paramtypes", [Object]),
     __metadata("design:returntype", OTPAuth.TOTP)
 ], TotpAuth, "getTotp", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", String)
+], TotpAuth, "normalizeToken", null);
 __decorate([
     CaptureSpan(),
     __metadata("design:type", Function),

package/build/dist/Server/Utils/TotpAuth.js.map

@@ -1 +1 @@
-{"version":3,"file":"TotpAuth.js","sourceRoot":"","sources":["../../../../Server/Utils/TotpAuth.ts"],"names":[],"mappings":";;;;;;;;;AACA,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AACnC,OAAO,WAAW,MAAM,yBAAyB,CAAC;AAElD;;GAEG;AACH,MAAM,CAAC,OAAO,OAAO,QAAQ;IAC3B;;;OAGG;IAEW,AAAP,MAAM,CAAC,cAAc;QAC1B,OAAO,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC;IACrC,CAAC;IAGa,AAAP,MAAM,CAAC,QAAQ,CAAC,IAAsB;QAC3C,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;IAC/B,CAAC;IAGa,AAAP,MAAM,CAAC,OAAO,CAAC,IAAsC;QAC1D,MAAM,IAAI,GAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;YAC1C,sDAAsD;YACtD,MAAM,EAAE,WAAW;YACnB,sBAAsB;YACtB,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC;gBACnB,KAAK,EAAE,IAAI,CAAC,KAAK;aAClB,CAAC;YACF,wCAAwC;YACxC,SAAS,EAAE,QAAQ;YACnB,kCAAkC;YAClC,MAAM,EAAE,CAAC;YACT,2DAA2D;YAC3D,MAAM,EAAE,EAAE;YACV,8DAA8D;YAC9D,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IAEW,AAAP,MAAM,CAAC,WAAW,CAAC,IAIzB;QACC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QAEtC,MAAM,IAAI,GAAiB,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAE3D,MAAM,KAAK,GAAkB,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QAEjE,OAAO,KAAK,KAAK,IAAI,CAAC;IACxB,CAAC;IAED;;;;OAIG;IAEW,AAAP,MAAM,CAAC,WAAW,CAAC,IAGzB;QACC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;QAEnC,MAAM,IAAI,GAAiB,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAEtE,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;IACzB,CAAC;CACF;AAnEe;IADb,WAAW,EAAE;;;;oCAGb;AAGa;IADb,WAAW,EAAE;;;;8BAGb;AAGa;IADb,WAAW,EAAE;;;oCACiD,OAAO,CAAC,IAAI;6BAmB1E;AAQa;IADb,WAAW,EAAE;;;;iCAab;AAQa;IADb,WAAW,EAAE;;;;iCAUb"}
+{"version":3,"file":"TotpAuth.js","sourceRoot":"","sources":["../../../../Server/Utils/TotpAuth.ts"],"names":[],"mappings":";;;;;;;;;AACA,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AACnC,OAAO,WAAW,MAAM,yBAAyB,CAAC;AAElD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAW,MAAM,CAAC;AAEnD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAkB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AAEzE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAW,CAAC,CAAC;AAE9C;;;;GAIG;AACH,MAAM,CAAC,MAAM,UAAU,GAAW,CAAC,CAAC;AACpC,MAAM,CAAC,MAAM,mBAAmB,GAAW,EAAE,CAAC;AAE9C;;GAEG;AACH,MAAM,CAAC,OAAO,OAAO,QAAQ;IAC3B;;;OAGG;IAEW,AAAP,MAAM,CAAC,cAAc;QAC1B,OAAO,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC;IACrC,CAAC;IAGa,AAAP,MAAM,CAAC,QAAQ,CAAC,IAAsB;QAC3C,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;IAC/B,CAAC;IAGa,AAAP,MAAM,CAAC,OAAO,CAAC,IAIrB;QACC,MAAM,IAAI,GAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;YAC1C,sDAAsD;YACtD,MAAM,EAAE,WAAW;YACnB,sBAAsB;YACtB,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC;gBACnB,KAAK,EAAE,IAAI,CAAC,KAAK;aAClB,CAAC;YACF,wCAAwC;YACxC,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,oBAAoB;YACjD,kCAAkC;YAClC,MAAM,EAAE,UAAU;YAClB,2DAA2D;YAC3D,MAAM,EAAE,mBAAmB;YAC3B,8DAA8D;YAC9D,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;OAYG;IAEW,AAAP,MAAM,CAAC,cAAc,CAAC,KAAa;QACxC;;;;WAIG;QACH,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;YACxC,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAClC,CAAC;IAED;;;;OAIG;IAEW,AAAP,MAAM,CAAC,WAAW,CAAC,IAIzB;QACC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QAE/B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,KAAK,GAAW,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAEtD;;;;;WAKG;QACH,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAChC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,KAAK,MAAM,SAAS,IAAI,uBAAuB,EAAE,CAAC;YAChD,IAAI,IAAkB,CAAC;YAEvB,IAAI,CAAC;gBACH,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;YACpD,CAAC;YAAC,WAAM,CAAC;gBACP;;;;mBAIG;gBACH,OAAO,KAAK,CAAC;YACf,CAAC;YAED,MAAM,KAAK,GAAkB,IAAI,CAAC,QAAQ,CAAC;gBACzC,KAAK;gBACL,MAAM,EAAE,oBAAoB;aAC7B,CAAC,CAAC;YAEH,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IAEW,AAAP,MAAM,CAAC,WAAW,CAAC,IAGzB;QACC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;QAEnC,MAAM,IAAI,GAAiB,IAAI,CAAC,OAAO,CAAC;YACtC,MAAM;YACN,KAAK,EAAE,SAAS;YAChB,SAAS,EAAE,oBAAoB;SAChC,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;IACzB,CAAC;CACF;AA1Ie;IADb,WAAW,EAAE;;;;oCAGb;AAGa;IADb,WAAW,EAAE;;;;8BAGb;AAGa;IADb,WAAW,EAAE;;;oCAKV,OAAO,CAAC,IAAI;6BAmBf;AAgBa;IADb,WAAW,EAAE;;;;oCAYb;AAQa;IADb,WAAW,EAAE;;;;iCAiDb;AAQa;IADb,WAAW,EAAE;;;;iCAcb"}

package/build/dist/Server/Utils/UserRegistrationToken.js

@@ -0,0 +1,170 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { AccountsRoute } from "../../ServiceRoute";
+import Route from "../../Types/API/Route";
+import URL from "../../Types/API/URL";
+import OneUptimeDate from "../../Types/Date";
+import ObjectID from "../../Types/ObjectID";
+import EmailVerificationToken from "../../Models/DatabaseModels/EmailVerificationToken";
+import DatabaseConfig from "../DatabaseConfig";
+import EmailVerificationTokenService from "../Services/EmailVerificationTokenService";
+import CaptureSpan from "./Telemetry/CaptureSpan";
+/*
+ * An invited user exists in the database before they have ever authenticated.
+ * TeamMemberService creates the row so the membership has something to point
+ * at, and that row carries no password until the person registers.
+ *
+ * /signup is what hands that unclaimed row over, so the hand-over has to be
+ * gated on something only the mailbox owner can hold. Knowing the address is
+ * not enough: addresses at a company are guessable by construction, which is
+ * exactly how GHSA-qg84-6hrg-mr5g turned a pending invitation into an account
+ * takeover -- the guard there was `if (alreadySavedUser.password)`, and an
+ * unclaimed row's password is null, which is falsy.
+ *
+ * This token is that gate. It is minted when the invitation is sent, travels
+ * only inside the invitation email, and is spent the first time it is used.
+ *
+ * It reuses EmailVerificationToken rather than adding a table of its own: the
+ * shape is identical (user, email, opaque token, expiry) and the semantics are
+ * the same claim -- "the holder of this controls this mailbox". Spending one is
+ * therefore also proof of address ownership, which is why the signup path marks
+ * the account verified on the way through.
+ */
+/*
+ * Invitations are read when the person gets round to them, not when they are
+ * sent, so these live longer than the 24 hours an email-verification link gets.
+ * Expiring in a week still bounds how long a leaked invite mail stays useful.
+ */
+export const REGISTRATION_TOKEN_EXPIRY_IN_DAYS = 7;
+export default class UserRegistrationToken {
+    /*
+     * Mint a token for `email` and return it. The caller is responsible for
+     * putting it somewhere only the mailbox owner will see -- which in practice
+     * means a link in an email addressed to that same mailbox, and nowhere else.
+     * It must never be written into an API response.
+     */
+    static async generateRegistrationToken(data) {
+        const token = ObjectID.generate();
+        const emailVerificationToken = new EmailVerificationToken();
+        emailVerificationToken.userId = data.userId;
+        emailVerificationToken.email = data.email;
+        emailVerificationToken.token = token;
+        emailVerificationToken.expires = OneUptimeDate.getSomeDaysAfter(REGISTRATION_TOKEN_EXPIRY_IN_DAYS);
+        await EmailVerificationTokenService.create({
+            data: emailVerificationToken,
+            props: {
+                isRoot: true,
+            },
+        });
+        return token;
+    }
+    /*
+     * The /accounts/register link an invited person follows. The email is carried
+     * alongside the token only to prefill (and lock) the form field; the token is
+     * the part that authorizes anything.
+     */
+    static async getRegistrationLink(data) {
+        const host = await DatabaseConfig.getHost();
+        const httpProtocol = await DatabaseConfig.getHttpProtocol();
+        return URL.fromString(new URL(httpProtocol, host, new Route(AccountsRoute.toString())).toString())
+            .addRoute("/register")
+            .addQueryParam("email", data.email.toString(), true)
+            .addQueryParam("token", data.token.toString(), true);
+    }
+    // Mint a token and build the link that carries it, in one step.
+    static async generateRegistrationLink(data) {
+        const token = await this.generateRegistrationToken({
+            userId: data.userId,
+            email: data.email,
+        });
+        return await this.getRegistrationLink({
+            email: data.email,
+            token: token,
+        });
+    }
+    /*
+     * Spend a token. Returns true only if it exists, was minted for this exact
+     * address, has not expired, and had not already been spent.
+     *
+     * The delete is what makes it single-use, and it is deliberately the last
+     * word: `deleteOneBy` reports how many rows it removed, so two requests
+     * racing on the same token produce exactly one winner (the loser deletes
+     * nothing and gets false back) rather than two callers who both read a live
+     * token and both proceed.
+     *
+     * Every failure returns the same `false`. The caller must not report which
+     * check failed -- "expired" and "no such token" would tell someone probing
+     * with guessed tokens which of them had ever been real.
+     */
+    static async consumeRegistrationToken(data) {
+        const savedToken = await EmailVerificationTokenService.findOneBy({
+            query: {
+                token: data.token,
+            },
+            select: {
+                _id: true,
+                email: true,
+                expires: true,
+            },
+            props: {
+                isRoot: true,
+            },
+        });
+        if (!savedToken || !savedToken.email || !savedToken.expires) {
+            return false;
+        }
+        /*
+         * A token is bound to the address it was mailed to. Without this, a token
+         * from any invitation the attacker had legitimately received would claim
+         * any other unclaimed account. Email lowercases on construction, so the
+         * string comparison is already case-insensitive.
+         */
+        if (savedToken.email.toString() !== data.email.toString()) {
+            return false;
+        }
+        if (OneUptimeDate.hasExpired(savedToken.expires)) {
+            return false;
+        }
+        const deletedCount = await EmailVerificationTokenService.deleteOneBy({
+            query: {
+                _id: savedToken._id,
+            },
+            props: {
+                isRoot: true,
+            },
+        });
+        return deletedCount === 1;
+    }
+}
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], UserRegistrationToken, "generateRegistrationToken", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], UserRegistrationToken, "getRegistrationLink", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], UserRegistrationToken, "generateRegistrationLink", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], UserRegistrationToken, "consumeRegistrationToken", null);
+//# sourceMappingURL=UserRegistrationToken.js.map

package/build/dist/Server/Utils/UserRegistrationToken.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserRegistrationToken.js","sourceRoot":"","sources":["../../../../Server/Utils/UserRegistrationToken.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGnD,OAAO,KAAK,MAAM,uBAAuB,CAAC;AAC1C,OAAO,GAAG,MAAM,qBAAqB,CAAC;AACtC,OAAO,aAAa,MAAM,kBAAkB,CAAC;AAE7C,OAAO,QAAQ,MAAM,sBAAsB,CAAC;AAC5C,OAAO,sBAAsB,MAAM,oDAAoD,CAAC;AACxF,OAAO,cAAc,MAAM,mBAAmB,CAAC;AAC/C,OAAO,6BAA6B,MAAM,2CAA2C,CAAC;AACtF,OAAO,WAAW,MAAM,yBAAyB,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAW,CAAC,CAAC;AAE3D,MAAM,CAAC,OAAO,OAAO,qBAAqB;IACxC;;;;;OAKG;IAEiB,AAAb,MAAM,CAAC,KAAK,CAAC,yBAAyB,CAAC,IAG7C;QACC,MAAM,KAAK,GAAa,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAE5C,MAAM,sBAAsB,GAC1B,IAAI,sBAAsB,EAAE,CAAC;QAC/B,sBAAsB,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC5C,sBAAsB,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAC1C,sBAAsB,CAAC,KAAK,GAAG,KAAK,CAAC;QACrC,sBAAsB,CAAC,OAAO,GAAG,aAAa,CAAC,gBAAgB,CAC7D,iCAAiC,CAClC,CAAC;QAEF,MAAM,6BAA6B,CAAC,MAAM,CAAC;YACzC,IAAI,EAAE,sBAAsB;YAC5B,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IAEiB,AAAb,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,IAGvC;QACC,MAAM,IAAI,GAAa,MAAM,cAAc,CAAC,OAAO,EAAE,CAAC;QACtD,MAAM,YAAY,GAAa,MAAM,cAAc,CAAC,eAAe,EAAE,CAAC;QAEtE,OAAO,GAAG,CAAC,UAAU,CACnB,IAAI,GAAG,CACL,YAAY,EACZ,IAAI,EACJ,IAAI,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC,CACpC,CAAC,QAAQ,EAAE,CACb;aACE,QAAQ,CAAC,WAAW,CAAC;aACrB,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC;aACnD,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC,CAAC;IACzD,CAAC;IAED,gEAAgE;IAE5C,AAAb,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,IAG5C;QACC,MAAM,KAAK,GAAa,MAAM,IAAI,CAAC,yBAAyB,CAAC;YAC3D,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;QAEH,OAAO,MAAM,IAAI,CAAC,mBAAmB,CAAC;YACpC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;OAaG;IAEiB,AAAb,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,IAG5C;QACC,MAAM,UAAU,GACd,MAAM,6BAA6B,CAAC,SAAS,CAAC;YAC5C,KAAK,EAAE;gBACL,KAAK,EAAE,IAAI,CAAC,KAAK;aAClB;YACD,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;gBACT,KAAK,EAAE,IAAI;gBACX,OAAO,EAAE,IAAI;aACd;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEL,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YAC5D,OAAO,KAAK,CAAC;QACf,CAAC;QAED;;;;;WAKG;QACH,IAAI,UAAU,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC1D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,aAAa,CAAC,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACjD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,YAAY,GAChB,MAAM,6BAA6B,CAAC,WAAW,CAAC;YAC9C,KAAK,EAAE;gBACL,GAAG,EAAE,UAAU,CAAC,GAAI;aACrB;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEL,OAAO,YAAY,KAAK,CAAC,CAAC;IAC5B,CAAC;CACF;AAnIqB;IADnB,WAAW,EAAE;;;;4DAwBb;AAQmB;IADnB,WAAW,EAAE;;;;sDAkBb;AAImB;IADnB,WAAW,EAAE;;;;2DAcb;AAiBmB;IADnB,WAAW,EAAE;;;;2DAiDb"}