@oneuptime/common 12.0.14 → 12.0.15

package/build/dist/Server/Middleware/UserAuthorization.js

@@ -26,6 +26,10 @@ import HashedString from "../../Types/HashedString";
 import JSONFunctions from "../../Types/JSONFunctions";
 import ObjectID from "../../Types/ObjectID";
 import SsoProviderType from "../../Types/SSO/SsoProviderType";
+import GlobalSsoService from "../Services/GlobalSsoService";
+import GlobalOidcService from "../Services/GlobalOidcService";
+import GlobalSsoProjectService from "../Services/GlobalSsoProjectService";
+import GlobalOidcProjectService from "../Services/GlobalOidcProjectService";
 import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
 import { PermissionHelper, } from "../../Types/Permission";
 import UserType from "../../Types/UserType";
@@ -159,34 +163,170 @@ export default class UserMiddleware {
             return null;
         }
     }
-    static doesSsoTokenForProjectExist(req, projectId, userId, requiredSsoProviderId) {
+    /**
+     * Per-project SSO token check (Project SSO/OIDC login). Bound to one project,
+     * entirely stateless: signature, expiry, project, user, and the optional
+     * pinned-provider discriminator.
+     */
+    static doesProjectScopedSsoTokenExist(req, projectId, userId, requiredSsoProviderId) {
         var _a;
         const ssoTokens = this.getSsoTokens(req);
-        /*
-         * 1) Per-project SSO token (Project SSO/OIDC login). Bound to one project.
-         */
-        if (ssoTokens && ssoTokens[projectId.toString()]) {
+        if (!ssoTokens || !ssoTokens[projectId.toString()]) {
+            return false;
+        }
+        try {
             const decodedData = JSONWebToken.decode(ssoTokens[projectId.toString()]);
-            if (((_a = decodedData.projectId) === null || _a === void 0 ? void 0 : _a.toString()) === projectId.toString() &&
-                decodedData.userId.toString() === userId.toString() &&
-                this.isSsoProviderSatisfied(decodedData, requiredSsoProviderId)) {
-                return true;
+            /*
+             * A Global-typed credential is NEVER accepted here, whichever slot it
+             * arrived in. Before the single-token redesign the Global SSO router
+             * minted one per-project token per project, typed GlobalSSO, signed for
+             * 30 days - and those are still sitting in browsers as `sso-<projectId>`
+             * cookies and in the mobile app's AsyncStorage, replayed on every
+             * request. Accepting them here would let a Global credential short-
+             * circuit past the provider-trust check, so disabling a provider would
+             * still not revoke them. Route every Global token through the stateful
+             * path instead.
+             */
+            if (decodedData.ssoProviderType === SsoProviderType.GlobalSSO ||
+                decodedData.ssoProviderType === SsoProviderType.GlobalOIDC) {
+                return false;
             }
+            return (((_a = decodedData.projectId) === null || _a === void 0 ? void 0 : _a.toString()) === projectId.toString() &&
+                decodedData.userId.toString() === userId.toString() &&
+                this.isSsoProviderSatisfied(decodedData, requiredSsoProviderId));
         }
-        /*
-         * 2) Global SSO token (Global SSO/OIDC login). Not bound to a project, so a
-         * single token satisfies enforcement for every project this user belongs to
-         * — including projects created after the login. The specific-provider
-         * discriminator still applies (a project pinned to a different provider is
-         * not satisfied by this token).
-         */
+        catch (_b) {
+            /*
+             * A token that expires between `getSsoTokens` decoding it and this call
+             * throws out of `decode`. Swallowing it here means the request falls
+             * through to the Global SSO token instead of 500-ing, which is what a
+             * user with both kinds would expect.
+             */
+            return false;
+        }
+    }
+    /**
+     * The Global SSO token, if one is present and stateless-valid for this user.
+     *
+     * "Stateless-valid" means signature, expiry, Global provider type, matching
+     * user, and the project's pinned-provider discriminator. It deliberately
+     * says nothing about whether the provider still exists, is still enabled, or
+     * governs the project in question - those need the database, and live in
+     * `isGlobalSsoTokenAuthorizedForProject`.
+     */
+    static getStatelessValidGlobalSsoTokenData(req, userId, requiredSsoProviderId) {
         const globalSsoTokenData = this.getGlobalSsoTokenData(req);
-        if (globalSsoTokenData &&
-            globalSsoTokenData.userId.toString() === userId.toString() &&
-            this.isSsoProviderSatisfied(globalSsoTokenData, requiredSsoProviderId)) {
+        if (!globalSsoTokenData) {
+            return null;
+        }
+        if (globalSsoTokenData.userId.toString() !== userId.toString()) {
+            return null;
+        }
+        if (!this.isSsoProviderSatisfied(globalSsoTokenData, requiredSsoProviderId)) {
+            return null;
+        }
+        return globalSsoTokenData;
+    }
+    /**
+     * The stateless half of the whole decision, kept as one call because it is
+     * the part that can be reasoned about without a database.
+     *
+     * NOTE: this is NOT the enforcement entry point. A Global SSO token that
+     * passes here can still be refused by `isSsoSatisfiedForProject`, which also
+     * asks whether the provider is still trusted and whether it governs this
+     * project. Enforcement must call that.
+     */
+    static doesSsoTokenForProjectExist(req, projectId, userId, requiredSsoProviderId) {
+        if (this.doesProjectScopedSsoTokenExist(req, projectId, userId, requiredSsoProviderId)) {
+            return true;
+        }
+        return Boolean(this.getStatelessValidGlobalSsoTokenData(req, userId, requiredSsoProviderId));
+    }
+    /**
+     * Whether a stateless-valid Global SSO token is STILL authorized for this
+     * project right now.
+     *
+     * Two questions the token itself cannot answer:
+     *
+     *   1. IS THE PROVIDER STILL TRUSTED? Always checked. A Global SSO token
+     *      lives for 30 days and carries no revocation, so without this an admin
+     *      turning a provider off - or deleting it outright - changes nothing
+     *      for anyone already signed in, for up to a month.
+     *
+     *   2. DOES THE PROVIDER GOVERN THIS PROJECT? Only checked when the admin
+     *      turned on `restrictToAttachedProjects` for that provider. The
+     *      attachment rows are the PROVISIONING allow-list by default, and the
+     *      login routers grant a session on membership of ANY project - so
+     *      treating attachments as an access boundary unasked would deny users
+     *      projects they legitimately reach today, with nothing in the product
+     *      to recover with.
+     *
+     * Answers are cached in-process for 60s and concurrent misses share one
+     * query (Common/Server/Utils/GlobalSsoAuthorization.ts).
+     *
+     * THROWS rather than denying when the lookup itself fails. "This provider is
+     * not allowed here" and "we could not find out" are different answers, and
+     * conflating them lets a database blip look like a permission decision - on
+     * the multi-tenant path that would silently hand back a 200 with no
+     * permissions rather than an error anyone would notice.
+     */
+    static async isGlobalSsoTokenAuthorizedForProject(data) {
+        var _a;
+        const { globalSsoTokenData, projectId } = data;
+        const providerIdValue = (_a = globalSsoTokenData.ssoProviderId) === null || _a === void 0 ? void 0 : _a.toString();
+        if (!providerIdValue) {
+            /*
+             * A Global-typed token with no provider id cannot be checked against
+             * either question, so it cannot be trusted for a project. This is a
+             * decision, not a failure - do not throw.
+             */
+            return false;
+        }
+        const providerId = new ObjectID(providerIdValue);
+        const isOidc = globalSsoTokenData.ssoProviderType === SsoProviderType.GlobalOIDC;
+        const trust = isOidc
+            ? await GlobalOidcService.getProviderTrust(providerId)
+            : await GlobalSsoService.getProviderTrust(providerId);
+        if (!trust.isUsable) {
+            return false;
+        }
+        if (!trust.restrictToAttachedProjects) {
+            /*
+             * The default, and what every existing installation gets: a global login
+             * satisfies enforcement for every project the user belongs to.
+             */
             return true;
         }
-        return false;
+        return isOidc
+            ? GlobalOidcProjectService.doesProviderGovernProject({
+                globalOidcId: providerId,
+                projectId,
+            })
+            : GlobalSsoProjectService.doesProviderGovernProject({
+                globalSsoId: providerId,
+                projectId,
+            });
+    }
+    /**
+     * THE enforcement entry point: is this request's SSO requirement satisfied
+     * for this project?
+     *
+     * A per-project token is decided statelessly. A Global SSO token additionally
+     * has to survive the provider-trust and project-governance checks above.
+     */
+    static async isSsoSatisfiedForProject(data) {
+        const { req, projectId, userId, requiredSsoProviderId } = data;
+        if (this.doesProjectScopedSsoTokenExist(req, projectId, userId, requiredSsoProviderId)) {
+            return true;
+        }
+        const globalSsoTokenData = this.getStatelessValidGlobalSsoTokenData(req, userId, requiredSsoProviderId);
+        if (!globalSsoTokenData) {
+            return false;
+        }
+        return this.isGlobalSsoTokenAuthorizedForProject({
+            globalSsoTokenData,
+            projectId,
+        });
     }
     static async getUserMiddleware(req, res, next) {
         const tenantId = ProjectMiddleware.getProjectId(req);
@@ -397,7 +537,12 @@ export default class UserMiddleware {
             const requiredSsoProviderId = await ProjectService.getRequireSsoWithSsoProviderId(tenantId).catch(() => {
                 return null;
             });
-            if (!UserMiddleware.doesSsoTokenForProjectExist(req, tenantId, userId, requiredSsoProviderId !== null && requiredSsoProviderId !== void 0 ? requiredSsoProviderId : undefined)) {
+            if (!(await UserMiddleware.isSsoSatisfiedForProject({
+                req,
+                projectId: tenantId,
+                userId,
+                requiredSsoProviderId: requiredSsoProviderId !== null && requiredSsoProviderId !== void 0 ? requiredSsoProviderId : undefined,
+            }))) {
                 throw new SsoAuthorizationException();
             }
         }
@@ -436,7 +581,12 @@ export default class UserMiddleware {
                 const requiredSsoProviderId = await ProjectService.getRequireSsoWithSsoProviderId(projectId).catch(() => {
                     return null;
                 });
-                if (!UserMiddleware.doesSsoTokenForProjectExist(req, projectId, userId, requiredSsoProviderId !== null && requiredSsoProviderId !== void 0 ? requiredSsoProviderId : undefined)) {
+                if (!(await UserMiddleware.isSsoSatisfiedForProject({
+                    req,
+                    projectId,
+                    userId,
+                    requiredSsoProviderId: requiredSsoProviderId !== null && requiredSsoProviderId !== void 0 ? requiredSsoProviderId : undefined,
+                }))) {
                     return {
                         projectId,
                         permission: UserPermissionUtil.getDefaultUserTenantAccessPermission(projectId),
@@ -484,6 +634,19 @@ __decorate([
     __metadata("design:paramtypes", [Object]),
     __metadata("design:returntype", Object)
 ], UserMiddleware, "getGlobalSsoTokenData", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, ObjectID,
+        ObjectID, Object]),
+    __metadata("design:returntype", Boolean)
+], UserMiddleware, "doesProjectScopedSsoTokenExist", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, ObjectID, Object]),
+    __metadata("design:returntype", Object)
+], UserMiddleware, "getStatelessValidGlobalSsoTokenData", null);
 __decorate([
     CaptureSpan(),
     __metadata("design:type", Function),
@@ -491,6 +654,18 @@ __decorate([
         ObjectID, Object]),
     __metadata("design:returntype", Boolean)
 ], UserMiddleware, "doesSsoTokenForProjectExist", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], UserMiddleware, "isGlobalSsoTokenAuthorizedForProject", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], UserMiddleware, "isSsoSatisfiedForProject", null);
 __decorate([
     CaptureSpan(),
     __metadata("design:type", Function),

package/build/dist/Server/Middleware/UserAuthorization.js.map

@@ -1 +1 @@
-{"version":3,"file":"UserAuthorization.js","sourceRoot":"","sources":["../../../../Server/Middleware/UserAuthorization.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,kBAAkB,MAAM,gCAAgC,CAAC;AAChE,OAAO,mBAAmB,MAAM,iCAAiC,CAAC;AAClE,OAAO,cAAc,MAAM,4BAA4B,CAAC;AACxD,OAAO,iBAAiB,MAAM,+BAA+B,CAAC;AAC9D,OAAO,WAAW,MAAM,yBAAyB,CAAC;AAClD,OAAO,UAAU,MAAM,iBAAiB,CAAC;AAOzC,OAAO,WAAW,MAAM,gCAAgC,CAAC;AACzD,OAAO,YAAY,MAAM,uBAAuB,CAAC;AACjD,OAAO,MAAM,EAAE,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,QAAQ,MAAM,mBAAmB,CAAC;AACzC,OAAO,iBAAiB,MAAM,wBAAwB,CAAC;AACvD,OAAO,QAAQ,MAAM,6BAA6B,CAAC;AAGnD,OAAO,yBAAyB,MAAM,iDAAiD,CAAC;AACxF,OAAO,yBAAyB,MAAM,iDAAiD,CAAC;AACxF,OAAO,uBAAuB,MAAM,+CAA+C,CAAC;AACpF,OAAO,YAAY,MAAM,0BAA0B,CAAC;AAEpD,OAAO,aAAa,MAAM,2BAA2B,CAAC;AAEtD,OAAO,QAAQ,MAAM,sBAAsB,CAAC;AAC5C,OAAO,eAAe,MAAM,iCAAiC,CAAC;AAC9D,OAAO,sBAAsB,MAAM,8CAA8C,CAAC;AAClF,OAAmB,EACjB,gBAAgB,GAIjB,MAAM,wBAAwB,CAAC;AAChC,OAAO,QAAQ,MAAM,sBAAsB,CAAC;AAC5C,OAAO,kBAAkB,MAAM,wCAAwC,CAAC;AAExE,MAAM,CAAC,OAAO,OAAO,cAAc;IACjC;;;;;OAKG;IAGW,AAAP,MAAM,CAAC,wBAAwB,CACpC,GAAmB;QAEnB,IAAI,WAAW,GAAuB,SAAS,CAAC;QAEhD,IACE,UAAU,CAAC,2BAA2B,CAAC,GAAG,EAAE,UAAU,CAAC,eAAe,EAAE,CAAC,EACzE,CAAC;YACD,WAAW,GAAG,UAAU,CAAC,2BAA2B,CAClD,GAAG,EACH,UAAU,CAAC,eAAe,EAAE,CAC7B,CAAC;QACJ,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;IAGa,AAAP,MAAM,CAAC,gCAAgC,CAC5C,GAAmB;QAEnB,8CAA8C;QAC9C,MAAM,WAAW,GACf,UAAU,CAAC,2BAA2B,CAAC,GAAG,EAAE,UAAU,CAAC,eAAe,EAAE,CAAC,CAAC;QAE5E,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,4EAA4E;QAC5E,MAAM,UAAU,GAAuB,GAAG,CAAC,OAAO,CAAC,eAAe,CAErD,CAAC;QACd,IAAI,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACnD,OAAO,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACjC,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAGa,AAAP,MAAM,CAAC,YAAY,CAAC,GAAmB;;QAC5C,MAAM,SAAS,GAAuB,EAAE,CAAC;QAEzC,+BAA+B;QAE/B,MAAM,OAAO,GAAuB,UAAU,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAElE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACvC,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC;gBAC3C,MAAM,KAAK,GAAuC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAC/D,IAAI,SAAS,GAAuB,SAAS,CAAC;gBAE9C,IAAI,CAAC;oBACH,SAAS,GAAG,MAAA,YAAY,CAAC,MAAM,CAC7B,KAAe,CAChB,CAAC,SAAS,0CAAE,QAAQ,EAAE,CAAC;gBAC1B,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,CAAC,KAAK,CACV,GAAG,EACH,2BAA2B,CAAC,GAAuB,CAAC,CACrD,CAAC;oBACF,SAAS;gBACX,CAAC;gBAED,IACE,SAAS;oBACT,KAAK;oBACL,OAAO,KAAK,KAAK,QAAQ;oBACzB,OAAO,SAAS,KAAK,QAAQ,EAC7B,CAAC;oBACD,SAAS,CAAC,SAAS,CAAC,GAAG,OAAO,CAAC,GAAG,CAAW,CAAC;gBAChD,CAAC;YACH,CAAC;QACH,CAAC;QAED;;;WAGG;QACH,MAAM,eAAe,GAAuB,GAAG,CAAC,OAAO,CAAC,cAAc,CAEzD,CAAC;QAEd,IAAI,eAAe,EAAE,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,YAAY,GAChB,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;gBAE9B,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;oBAClD,MAAM,KAAK,GAAuB,YAAY,CAAC,SAAS,CAAC,CAAC;oBAE1D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;wBACxC,SAAS;oBACX,CAAC;oBAED,IAAI,CAAC;wBACH,MAAM,OAAO,GAAqB,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;wBAE7D,IAAI,CAAA,MAAA,OAAO,CAAC,SAAS,0CAAE,QAAQ,EAAE,MAAK,SAAS,EAAE,CAAC;4BAChD,SAAS,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC;wBAC/B,CAAC;oBACH,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,MAAM,CAAC,KAAK,CACV,GAAG,EACH,2BAA2B,CAAC,GAAuB,CAAC,CACrD,CAAC;wBACF,SAAS;oBACX,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,2BAA2B,CAAC,GAAuB,CAAC,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,sBAAsB,CACnC,WAA6B,EAC7B,qBAA4C;QAE5C,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,eAAe,GAAuB,WAAW,CAAC,aAAa;YACnE,CAAC,CAAC,WAAW,CAAC,aAAa,CAAC,QAAQ,EAAE;YACtC,CAAC,CAAC,SAAS,CAAC;QAEd,OAAO,OAAO,CACZ,eAAe,IAAI,eAAe,KAAK,qBAAqB,CAAC,QAAQ,EAAE,CACxE,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IAEW,AAAP,MAAM,CAAC,qBAAqB,CACjC,GAAmB;QAEnB,IAAI,QAAQ,GAAuB,UAAU,CAAC,2BAA2B,CACvE,GAAG,EACH,UAAU,CAAC,eAAe,EAAE,CAC7B,CAAC;QAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,WAAW,GAAuB,GAAG,CAAC,OAAO,CACjD,oBAAoB,CACC,CAAC;YACxB,IAAI,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;gBACnD,QAAQ,GAAG,WAAW,CAAC;YACzB,CAAC;QACH,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,MAAM,WAAW,GAAqB,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAEpE,IACE,WAAW,CAAC,eAAe,KAAK,eAAe,CAAC,SAAS;gBACzD,WAAW,CAAC,eAAe,KAAK,eAAe,CAAC,UAAU,EAC1D,CAAC;gBACD,OAAO,WAAW,CAAC;YACrB,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,2BAA2B,CAAC,GAAuB,CAAC,CAAC,CAAC;YACxE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAGa,AAAP,MAAM,CAAC,2BAA2B,CACvC,GAAmB,EACnB,SAAmB,EACnB,MAAgB,EAChB,qBAA4C;;QAE5C,MAAM,SAAS,GAAuB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAE7D;;WAEG;QACH,IAAI,SAAS,IAAI,SAAS,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC;YACjD,MAAM,WAAW,GAAqB,YAAY,CAAC,MAAM,CACvD,SAAS,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAW,CAC1C,CAAC;YACF,IACE,CAAA,MAAA,WAAW,CAAC,SAAS,0CAAE,QAAQ,EAAE,MAAK,SAAS,CAAC,QAAQ,EAAE;gBAC1D,WAAW,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,MAAM,CAAC,QAAQ,EAAE;gBACnD,IAAI,CAAC,sBAAsB,CAAC,WAAW,EAAE,qBAAqB,CAAC,EAC/D,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED;;;;;;WAMG;QACH,MAAM,kBAAkB,GACtB,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAElC,IACE,kBAAkB;YAClB,kBAAkB,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,MAAM,CAAC,QAAQ,EAAE;YAC1D,IAAI,CAAC,sBAAsB,CAAC,kBAAkB,EAAE,qBAAqB,CAAC,EACtE,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAGmB,AAAb,MAAM,CAAC,KAAK,CAAC,iBAAiB,CACnC,GAAmB,EACnB,GAAoB,EACpB,IAAkB;QAElB,MAAM,QAAQ,GAAoB,iBAAiB,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QACtE,MAAM,gBAAgB,GAAqB,GAAuB,CAAC;QAEnE,IAAI,QAAQ,EAAE,CAAC;YACb,gBAAgB,CAAC,QAAQ,GAAG,QAAQ,CAAC;YAErC;;;;eAIG;YACH,KAAK,cAAc,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACjD,CAAC;QAED,IAAI,iBAAiB,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YACrC,OAAO,MAAM,iBAAiB,CAAC,mCAAmC,CAChE,GAAG,EACH,GAAG,EACH,IAAI,CACL,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GACf,cAAc,CAAC,gCAAgC,CAAC,GAAG,CAAC,CAAC;QAEvD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,gBAAgB,CAAC,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC;YAC5C,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,IAAI,CAAC;YACH,gBAAgB,CAAC,iBAAiB,GAAG,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACxE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mFAAmF;YACnF,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,2BAA2B,CAAC,gBAAgB,CAAC,CAAC,CAAC;YACjE,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,yBAAyB,CAC3B,+DAA+D,CAChE,CACF,CAAC;QACJ,CAAC;QAED,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,aAAa,EAAE,CAAC;YACrD,gBAAgB,CAAC,QAAQ,GAAG,QAAQ,CAAC,WAAW,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,gBAAgB,CAAC,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC;QAC5C,CAAC;QAED,MAAM,MAAM,GAAW,gBAAgB,CAAC,iBAAiB,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QAE5E,uEAAuE;QACvE,QAAQ,CAAC,0BAA0B,+BACjC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,IAChC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACpD,CAAC,gBAAgB,CAAC,SAAS;YAC5B,CAAC,CAAC,EAAE,SAAS,EAAE,gBAAgB,CAAC,SAAS,EAAE;YAC3C,CAAC,CAAC,EAAE,CAAC,EACP,CAAC;QAEH;;;WAGG;QACH,KAAK,WAAW,CAAC,gBAAgB,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAExD;;;;;;;;WAQG;QACH,MAAM,iCAAiC,GACrC,kBAAkB,CAAC,6BAA6B,CAC9C,gBAAgB,CAAC,iBAAiB,CAAC,MAAM,CAC1C,CAAC;QAEJ,IAAI,0BAA0B,GAAsC,IAAI,CAAC;QAEzE,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,MAAM,CAAC,gBAAgB,EAAE,0BAA0B,EAAE,WAAW,CAAC,GAI7D,MAAM,OAAO,CAAC,GAAG,CAAC;oBACpB,iCAAiC;oBACjC,cAAc,CAAC,yCAAyC,CAAC;wBACvD,GAAG;wBACH,QAAQ;wBACR,MAAM,EAAE,IAAI,QAAQ,CAAC,MAAM,CAAC;qBAC7B,CAAC;oBACF,iBAAiB,CAAC,iBAAiB,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC;iBACpE,CAAC,CAAC;gBAEH,0BAA0B,GAAG,gBAAgB,CAAC;gBAE9C,IAAI,0BAA0B,EAAE,CAAC;oBAC/B,gBAAgB,CAAC,0BAA0B;wBACzC,0BAA0B,CAAC;gBAC/B,CAAC;gBAED,IAAI,0BAA0B,EAAE,CAAC;oBAC/B,gBAAgB,CAAC,0BAA0B,GAAG,EAAE,CAAC;oBACjD,gBAAgB,CAAC,0BAA0B,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;wBAC9D,0BAA0B,CAAC;gBAC/B,CAAC;gBAED;;;;;mBAKG;gBACH,gBAAgB,CAAC,WAAW,GAAG,WAAW,CAAC;YAC7C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,QAAQ,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,KAAkB,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,0BAA0B,GAAG,MAAM,iCAAiC,CAAC;YAErE,IAAI,0BAA0B,EAAE,CAAC;gBAC/B,gBAAgB,CAAC,0BAA0B;oBACzC,0BAA0B,CAAC;YAC/B,CAAC;QACH,CAAC;QAED,IAAI,GAAG,CAAC,OAAO,CAAC,uBAAuB,CAAC,EAAE,CAAC;YACzC,IACE,0BAA0B;gBAC1B,0BAA0B,CAAC,UAAU;gBACrC,0BAA0B,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAChD,CAAC;gBACD,MAAM,0BAA0B,GAC9B,MAAM,cAAc,CAAC,2CAA2C,CAC9D,GAAG,EACH,IAAI,QAAQ,CAAC,MAAM,CAAC,EACpB,0BAA0B,CAAC,UAAU,CACtC,CAAC;gBAEJ,IAAI,0BAA0B,EAAE,CAAC;oBAC/B,gBAAgB,CAAC,0BAA0B;wBACzC,0BAA0B,CAAC;gBAC/B,CAAC;YACH,CAAC;QACH,CAAC;QAED,uBAAuB;QAEvB,IAAI,gBAAgB,CAAC,0BAA0B,EAAE,CAAC;YAChD,MAAM,eAAe,GAAe,aAAa,CAAC,SAAS,CACzD,gBAAgB,CAAC,0BAA0B,CAC5C,CAAC;YACF,MAAM,WAAW,GAAW,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;YAC5D,MAAM,qBAAqB,GAAW,MAAM,YAAY,CAAC,SAAS,CAChE,WAAW,EACX,IAAI,CACL,CAAC;YAEF,IACE,CAAC,CACC,GAAG,CAAC,OAAO;gBACX,GAAG,CAAC,OAAO,CAAC,yBAAyB,CAAC;gBACtC,GAAG,CAAC,OAAO,CAAC,yBAAyB,CAAC,KAAK,qBAAqB,CACjE,EACD,CAAC;gBACD,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC;gBAC3C,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,qBAAqB,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QAED,gCAAgC;QAChC,IACE,gBAAgB,CAAC,0BAA0B;YAC3C,QAAQ;YACR,gBAAgB,CAAC,0BAA0B,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,EAChE,CAAC;YACD,MAAM,YAAY,GAAW,IAAI,CAAC,SAAS,CACzC,aAAa,CAAC,SAAS,CACrB,gBAAgB,CAAC,0BAA0B,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAE,CAClE,CACF,CAAC;YAEF,MAAM,sBAAsB,GAAW,MAAM,YAAY,CAAC,SAAS,CACjE,YAAY,EACZ,IAAI,CACL,CAAC;YAEF,IACE,CAAC,CACC,GAAG,CAAC,OAAO;gBACX,GAAG,CAAC,OAAO,CAAC,0BAA0B,CAAC;gBACvC,GAAG,CAAC,OAAO,CAAC,0BAA0B,CAAC,KAAK,sBAAsB,CACnE,EACD,CAAC;gBACD,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,YAAY,CAAC,CAAC;gBAC7C,GAAG,CAAC,GAAG,CAAC,0BAA0B,EAAE,sBAAsB,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;QAED,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAGmB,AAAb,MAAM,CAAC,KAAK,CAAC,yBAAyB,CAC3C,GAAmB,EACnB,GAAoB,EACpB,IAAkB;QAElB,MAAM,gBAAgB,GAAqB,GAAuB,CAAC;QAEnE,IACE,CAAC,gBAAgB,CAAC,QAAQ;YAC1B,gBAAgB,CAAC,QAAQ,KAAK,QAAQ,CAAC,MAAM,EAC7C,CAAC;YACD,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,yBAAyB,CAC3B,iEAAiE,CAClE,CACF,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAEM,MAAM,CAAC,iBAAiB,CAAC,IAE/B;QAKC,OAAO,KAAK,EACV,GAAmB,EACnB,GAAoB,EACpB,IAAkB,EACH,EAAE;;YACjB,MAAM,gBAAgB,GAAqB,GAAuB,CAAC;YAEnE,yCAAyC;YACzC,IAAI,gBAAgB,CAAC,QAAQ,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC;gBACvD,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YAED,MAAM,QAAQ,GAAyB,gBAAgB,CAAC,QAAQ,CAAC;YAEjE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,sBAAsB,CACxB,iDAAiD,CAClD,CACF,CAAC;YACJ,CAAC;YAED,MAAM,oBAAoB,GACxB,MAAA,gBAAgB,CAAC,0BAA0B,0CAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;YAErE,IAAI,CAAC,oBAAoB,EAAE,CAAC;gBAC1B,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,sBAAsB,CACxB,oDAAoD,CACrD,CACF,CAAC;YACJ,CAAC;YAED,MAAM,eAAe,GACnB,oBAAoB,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAiB,EAAE,EAAE;gBACzD,OAAO,CAAC,CAAC,UAAU,CAAC;YACtB,CAAC,CAAC,CAAC;YAEL,IACE,CAAC,gBAAgB,CAAC,wBAAwB,CACxC,eAAe,EACf,IAAI,CAAC,WAAW,CACjB,EACD,CAAC;gBACD,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,sBAAsB,CACxB,iEAAiE,CAClE,CACF,CAAC;YACJ,CAAC;YAED,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC,CAAC;IACJ,CAAC;IAGmB,AAAb,MAAM,CAAC,KAAK,CAAC,yCAAyC,CAAC,IAI7D;;QACC,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAEvC,MAAM,aAAa,GACjB,CAAA,MAAC,GAAwB,CAAC,iBAAiB,0CAAE,aAAa,MAAK,IAAI,CAAC;QAEtE;;;;WAIG;QACH,MAAM,CAAC,yBAAyB,EAAE,gBAAgB,CAAC,GAG/C,MAAM,OAAO,CAAC,GAAG,CAAC;YACpB,cAAc,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,GAAU,EAAE,EAAE;gBAClE;;;mBAGG;gBACH,IAAI,GAAG,CAAC,OAAO,KAAK,mBAAmB,EAAE,CAAC;oBACxC,MAAM,IAAI,uBAAuB,CAAC,kBAAkB,CAAC,CAAC;gBACxD,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC,CAAC;YACF,kBAAkB,CAAC,6BAA6B,CAAC,MAAM,EAAE,QAAQ,CAAC;SACnE,CAAC,CAAC;QAEH;;;;;WAKG;QACH,IAAI,kBAAkB,GAAY,yBAAyB,CAAC;QAC5D,IAAI,CAAC,kBAAkB,IAAI,CAAC,aAAa,EAAE,CAAC;YAC1C,kBAAkB;gBAChB,MAAM,mBAAmB,CAAC,qBAAqB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;oBAC3D,OAAO,KAAK,CAAC;gBACf,CAAC,CAAC,CAAC;QACP,CAAC;QAED,IAAI,kBAAkB,EAAE,CAAC;YACvB;;;eAGG;YACH,MAAM,qBAAqB,GACzB,MAAM,cAAc,CAAC,8BAA8B,CAAC,QAAQ,CAAC,CAAC,KAAK,CACjE,GAAG,EAAE;gBACH,OAAO,IAAI,CAAC;YACd,CAAC,CACF,CAAC;YAEJ,IACE,CAAC,cAAc,CAAC,2BAA2B,CACzC,GAAG,EACH,QAAQ,EACR,MAAM,EACN,qBAAqB,aAArB,qBAAqB,cAArB,qBAAqB,GAAI,SAAS,CACnC,EACD,CAAC;gBACD,MAAM,IAAI,yBAAyB,EAAE,CAAC;YACxC,CAAC;QACH,CAAC;QAED,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAGmB,AAAb,MAAM,CAAC,KAAK,CAAC,2CAA2C,CAC7D,GAAmB,EACnB,MAAgB,EAChB,UAAsB;;QAEtB,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,aAAa,GACjB,CAAA,MAAC,GAAwB,CAAC,iBAAiB,0CAAE,aAAa,MAAK,IAAI,CAAC;QAEtE;;;WAGG;QACH,MAAM,wBAAwB,GAAY,aAAa;YACrD,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,MAAM,mBAAmB,CAAC,qBAAqB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;gBAC3D,OAAO,KAAK,CAAC;YACf,CAAC,CAAC,CAAC;QAEP;;;;WAIG;QACH,MAAM,QAAQ,GAGT,MAAM,OAAO,CAAC,GAAG,CACpB,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,SAAmB,EAAE,EAAE;YAC3C,MAAM,yBAAyB,GAC7B,MAAM,cAAc,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;gBAC/D;;;mBAGG;gBACH,OAAO,KAAK,CAAC;YACf,CAAC,CAAC,CAAC;YAEL,MAAM,kBAAkB,GACtB,yBAAyB,IAAI,wBAAwB,CAAC;YAExD,IAAI,kBAAkB,EAAE,CAAC;gBACvB,MAAM,qBAAqB,GACzB,MAAM,cAAc,CAAC,8BAA8B,CACjD,SAAS,CACV,CAAC,KAAK,CAAC,GAAG,EAAE;oBACX,OAAO,IAAI,CAAC;gBACd,CAAC,CAAC,CAAC;gBAEL,IACE,CAAC,cAAc,CAAC,2BAA2B,CACzC,GAAG,EACH,SAAS,EACT,MAAM,EACN,qBAAqB,aAArB,qBAAqB,cAArB,qBAAqB,GAAI,SAAS,CACnC,EACD,CAAC;oBACD,OAAO;wBACL,SAAS;wBACT,UAAU,EACR,kBAAkB,CAAC,oCAAoC,CACrD,SAAS,CACV;qBACJ,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,OAAO;gBACL,SAAS;gBACT,UAAU,EAAE,MAAM,kBAAkB,CAAC,6BAA6B,CAChE,MAAM,EACN,SAAS,CACV;aACF,CAAC;QACJ,CAAC,CAAC,CACH,CAAC;QAEF,IAAI,MAAM,GAAkD,IAAI,CAAC;QACjE,KAAK,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,QAAQ,EAAE,CAAC;YACjD,IAAI,UAAU,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,GAAG,EAAE,CAAC;gBACd,CAAC;gBACD,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,GAAG,UAAU,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AAnsBe;IADb,WAAW,EAAE;;;;oDAgBb;AAGa;IADb,WAAW,EAAE;;;;4DAqBb;AAGa;IADb,WAAW,EAAE;;;;wCA4Eb;AAkCa;IADb,WAAW,EAAE;;;;iDAqCb;AAGa;IADb,WAAW,EAAE;;6CAGD,QAAQ;QACX,QAAQ;;uDAwCjB;AAGmB;IADnB,WAAW,EAAE;;;;6CAoNb;AAGmB;IADnB,WAAW,EAAE;;;;qDAsBb;AAuEmB;IADnB,WAAW,EAAE;;;;qEAwEb;AAGmB;IADnB,WAAW,EAAE;;6CAGJ,QAAQ;;uEAyFjB"}
+{"version":3,"file":"UserAuthorization.js","sourceRoot":"","sources":["../../../../Server/Middleware/UserAuthorization.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,kBAAkB,MAAM,gCAAgC,CAAC;AAChE,OAAO,mBAAmB,MAAM,iCAAiC,CAAC;AAClE,OAAO,cAAc,MAAM,4BAA4B,CAAC;AACxD,OAAO,iBAAiB,MAAM,+BAA+B,CAAC;AAC9D,OAAO,WAAW,MAAM,yBAAyB,CAAC;AAClD,OAAO,UAAU,MAAM,iBAAiB,CAAC;AAOzC,OAAO,WAAW,MAAM,gCAAgC,CAAC;AACzD,OAAO,YAAY,MAAM,uBAAuB,CAAC;AACjD,OAAO,MAAM,EAAE,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,QAAQ,MAAM,mBAAmB,CAAC;AACzC,OAAO,iBAAiB,MAAM,wBAAwB,CAAC;AACvD,OAAO,QAAQ,MAAM,6BAA6B,CAAC;AAGnD,OAAO,yBAAyB,MAAM,iDAAiD,CAAC;AACxF,OAAO,yBAAyB,MAAM,iDAAiD,CAAC;AACxF,OAAO,uBAAuB,MAAM,+CAA+C,CAAC;AACpF,OAAO,YAAY,MAAM,0BAA0B,CAAC;AAEpD,OAAO,aAAa,MAAM,2BAA2B,CAAC;AAEtD,OAAO,QAAQ,MAAM,sBAAsB,CAAC;AAC5C,OAAO,eAAe,MAAM,iCAAiC,CAAC;AAC9D,OAAO,gBAAgB,MAAM,8BAA8B,CAAC;AAE5D,OAAO,iBAAiB,MAAM,+BAA+B,CAAC;AAC9D,OAAO,uBAAuB,MAAM,qCAAqC,CAAC;AAC1E,OAAO,wBAAwB,MAAM,sCAAsC,CAAC;AAC5E,OAAO,sBAAsB,MAAM,8CAA8C,CAAC;AAClF,OAAmB,EACjB,gBAAgB,GAIjB,MAAM,wBAAwB,CAAC;AAChC,OAAO,QAAQ,MAAM,sBAAsB,CAAC;AAC5C,OAAO,kBAAkB,MAAM,wCAAwC,CAAC;AAExE,MAAM,CAAC,OAAO,OAAO,cAAc;IACjC;;;;;OAKG;IAGW,AAAP,MAAM,CAAC,wBAAwB,CACpC,GAAmB;QAEnB,IAAI,WAAW,GAAuB,SAAS,CAAC;QAEhD,IACE,UAAU,CAAC,2BAA2B,CAAC,GAAG,EAAE,UAAU,CAAC,eAAe,EAAE,CAAC,EACzE,CAAC;YACD,WAAW,GAAG,UAAU,CAAC,2BAA2B,CAClD,GAAG,EACH,UAAU,CAAC,eAAe,EAAE,CAC7B,CAAC;QACJ,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;IAGa,AAAP,MAAM,CAAC,gCAAgC,CAC5C,GAAmB;QAEnB,8CAA8C;QAC9C,MAAM,WAAW,GACf,UAAU,CAAC,2BAA2B,CAAC,GAAG,EAAE,UAAU,CAAC,eAAe,EAAE,CAAC,CAAC;QAE5E,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,4EAA4E;QAC5E,MAAM,UAAU,GAAuB,GAAG,CAAC,OAAO,CAAC,eAAe,CAErD,CAAC;QACd,IAAI,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACnD,OAAO,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACjC,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAGa,AAAP,MAAM,CAAC,YAAY,CAAC,GAAmB;;QAC5C,MAAM,SAAS,GAAuB,EAAE,CAAC;QAEzC,+BAA+B;QAE/B,MAAM,OAAO,GAAuB,UAAU,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAElE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACvC,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC;gBAC3C,MAAM,KAAK,GAAuC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAC/D,IAAI,SAAS,GAAuB,SAAS,CAAC;gBAE9C,IAAI,CAAC;oBACH,SAAS,GAAG,MAAA,YAAY,CAAC,MAAM,CAC7B,KAAe,CAChB,CAAC,SAAS,0CAAE,QAAQ,EAAE,CAAC;gBAC1B,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,CAAC,KAAK,CACV,GAAG,EACH,2BAA2B,CAAC,GAAuB,CAAC,CACrD,CAAC;oBACF,SAAS;gBACX,CAAC;gBAED,IACE,SAAS;oBACT,KAAK;oBACL,OAAO,KAAK,KAAK,QAAQ;oBACzB,OAAO,SAAS,KAAK,QAAQ,EAC7B,CAAC;oBACD,SAAS,CAAC,SAAS,CAAC,GAAG,OAAO,CAAC,GAAG,CAAW,CAAC;gBAChD,CAAC;YACH,CAAC;QACH,CAAC;QAED;;;WAGG;QACH,MAAM,eAAe,GAAuB,GAAG,CAAC,OAAO,CAAC,cAAc,CAEzD,CAAC;QAEd,IAAI,eAAe,EAAE,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,YAAY,GAChB,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;gBAE9B,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;oBAClD,MAAM,KAAK,GAAuB,YAAY,CAAC,SAAS,CAAC,CAAC;oBAE1D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;wBACxC,SAAS;oBACX,CAAC;oBAED,IAAI,CAAC;wBACH,MAAM,OAAO,GAAqB,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;wBAE7D,IAAI,CAAA,MAAA,OAAO,CAAC,SAAS,0CAAE,QAAQ,EAAE,MAAK,SAAS,EAAE,CAAC;4BAChD,SAAS,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC;wBAC/B,CAAC;oBACH,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,MAAM,CAAC,KAAK,CACV,GAAG,EACH,2BAA2B,CAAC,GAAuB,CAAC,CACrD,CAAC;wBACF,SAAS;oBACX,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,2BAA2B,CAAC,GAAuB,CAAC,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,sBAAsB,CACnC,WAA6B,EAC7B,qBAA4C;QAE5C,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,eAAe,GAAuB,WAAW,CAAC,aAAa;YACnE,CAAC,CAAC,WAAW,CAAC,aAAa,CAAC,QAAQ,EAAE;YACtC,CAAC,CAAC,SAAS,CAAC;QAEd,OAAO,OAAO,CACZ,eAAe,IAAI,eAAe,KAAK,qBAAqB,CAAC,QAAQ,EAAE,CACxE,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IAEW,AAAP,MAAM,CAAC,qBAAqB,CACjC,GAAmB;QAEnB,IAAI,QAAQ,GAAuB,UAAU,CAAC,2BAA2B,CACvE,GAAG,EACH,UAAU,CAAC,eAAe,EAAE,CAC7B,CAAC;QAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,WAAW,GAAuB,GAAG,CAAC,OAAO,CACjD,oBAAoB,CACC,CAAC;YACxB,IAAI,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;gBACnD,QAAQ,GAAG,WAAW,CAAC;YACzB,CAAC;QACH,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,MAAM,WAAW,GAAqB,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAEpE,IACE,WAAW,CAAC,eAAe,KAAK,eAAe,CAAC,SAAS;gBACzD,WAAW,CAAC,eAAe,KAAK,eAAe,CAAC,UAAU,EAC1D,CAAC;gBACD,OAAO,WAAW,CAAC;YACrB,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,2BAA2B,CAAC,GAAuB,CAAC,CAAC,CAAC;YACxE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IAEW,AAAP,MAAM,CAAC,8BAA8B,CAC1C,GAAmB,EACnB,SAAmB,EACnB,MAAgB,EAChB,qBAA4C;;QAE5C,MAAM,SAAS,GAAuB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAE7D,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC;YACnD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC;YACH,MAAM,WAAW,GAAqB,YAAY,CAAC,MAAM,CACvD,SAAS,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAW,CAC1C,CAAC;YAEF;;;;;;;;;;eAUG;YACH,IACE,WAAW,CAAC,eAAe,KAAK,eAAe,CAAC,SAAS;gBACzD,WAAW,CAAC,eAAe,KAAK,eAAe,CAAC,UAAU,EAC1D,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC;YAED,OAAO,CACL,CAAA,MAAA,WAAW,CAAC,SAAS,0CAAE,QAAQ,EAAE,MAAK,SAAS,CAAC,QAAQ,EAAE;gBAC1D,WAAW,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,MAAM,CAAC,QAAQ,EAAE;gBACnD,IAAI,CAAC,sBAAsB,CAAC,WAAW,EAAE,qBAAqB,CAAC,CAChE,CAAC;QACJ,CAAC;QAAC,WAAM,CAAC;YACP;;;;;eAKG;YACH,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IAEW,AAAP,MAAM,CAAC,mCAAmC,CAC/C,GAAmB,EACnB,MAAgB,EAChB,qBAA4C;QAE5C,MAAM,kBAAkB,GACtB,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAElC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,kBAAkB,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC/D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IACE,CAAC,IAAI,CAAC,sBAAsB,CAAC,kBAAkB,EAAE,qBAAqB,CAAC,EACvE,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IAED;;;;;;;;OAQG;IAEW,AAAP,MAAM,CAAC,2BAA2B,CACvC,GAAmB,EACnB,SAAmB,EACnB,MAAgB,EAChB,qBAA4C;QAE5C,IACE,IAAI,CAAC,8BAA8B,CACjC,GAAG,EACH,SAAS,EACT,MAAM,EACN,qBAAqB,CACtB,EACD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,OAAO,CACZ,IAAI,CAAC,mCAAmC,CACtC,GAAG,EACH,MAAM,EACN,qBAAqB,CACtB,CACF,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IAEiB,AAAb,MAAM,CAAC,KAAK,CAAC,oCAAoC,CAAC,IAGxD;;QACC,MAAM,EAAE,kBAAkB,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;QAE/C,MAAM,eAAe,GACnB,MAAA,kBAAkB,CAAC,aAAa,0CAAE,QAAQ,EAAE,CAAC;QAE/C,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB;;;;eAIG;YACH,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,UAAU,GAAa,IAAI,QAAQ,CAAC,eAAe,CAAC,CAAC;QAE3D,MAAM,MAAM,GACV,kBAAkB,CAAC,eAAe,KAAK,eAAe,CAAC,UAAU,CAAC;QAEpE,MAAM,KAAK,GAAwB,MAAM;YACvC,CAAC,CAAC,MAAM,iBAAiB,CAAC,gBAAgB,CAAC,UAAU,CAAC;YACtD,CAAC,CAAC,MAAM,gBAAgB,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAExD,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;YACpB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,0BAA0B,EAAE,CAAC;YACtC;;;eAGG;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,MAAM;YACX,CAAC,CAAC,wBAAwB,CAAC,yBAAyB,CAAC;gBACjD,YAAY,EAAE,UAAU;gBACxB,SAAS;aACV,CAAC;YACJ,CAAC,CAAC,uBAAuB,CAAC,yBAAyB,CAAC;gBAChD,WAAW,EAAE,UAAU;gBACvB,SAAS;aACV,CAAC,CAAC;IACT,CAAC;IAED;;;;;;OAMG;IAEiB,AAAb,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,IAK5C;QACC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,qBAAqB,EAAE,GAAG,IAAI,CAAC;QAE/D,IACE,IAAI,CAAC,8BAA8B,CACjC,GAAG,EACH,SAAS,EACT,MAAM,EACN,qBAAqB,CACtB,EACD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,kBAAkB,GACtB,IAAI,CAAC,mCAAmC,CACtC,GAAG,EACH,MAAM,EACN,qBAAqB,CACtB,CAAC;QAEJ,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,IAAI,CAAC,oCAAoC,CAAC;YAC/C,kBAAkB;YAClB,SAAS;SACV,CAAC,CAAC;IACL,CAAC;IAGmB,AAAb,MAAM,CAAC,KAAK,CAAC,iBAAiB,CACnC,GAAmB,EACnB,GAAoB,EACpB,IAAkB;QAElB,MAAM,QAAQ,GAAoB,iBAAiB,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QACtE,MAAM,gBAAgB,GAAqB,GAAuB,CAAC;QAEnE,IAAI,QAAQ,EAAE,CAAC;YACb,gBAAgB,CAAC,QAAQ,GAAG,QAAQ,CAAC;YAErC;;;;eAIG;YACH,KAAK,cAAc,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACjD,CAAC;QAED,IAAI,iBAAiB,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YACrC,OAAO,MAAM,iBAAiB,CAAC,mCAAmC,CAChE,GAAG,EACH,GAAG,EACH,IAAI,CACL,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GACf,cAAc,CAAC,gCAAgC,CAAC,GAAG,CAAC,CAAC;QAEvD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,gBAAgB,CAAC,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC;YAC5C,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,IAAI,CAAC;YACH,gBAAgB,CAAC,iBAAiB,GAAG,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACxE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mFAAmF;YACnF,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,2BAA2B,CAAC,gBAAgB,CAAC,CAAC,CAAC;YACjE,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,yBAAyB,CAC3B,+DAA+D,CAChE,CACF,CAAC;QACJ,CAAC;QAED,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,aAAa,EAAE,CAAC;YACrD,gBAAgB,CAAC,QAAQ,GAAG,QAAQ,CAAC,WAAW,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,gBAAgB,CAAC,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC;QAC5C,CAAC;QAED,MAAM,MAAM,GAAW,gBAAgB,CAAC,iBAAiB,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QAE5E,uEAAuE;QACvE,QAAQ,CAAC,0BAA0B,+BACjC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,IAChC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACpD,CAAC,gBAAgB,CAAC,SAAS;YAC5B,CAAC,CAAC,EAAE,SAAS,EAAE,gBAAgB,CAAC,SAAS,EAAE;YAC3C,CAAC,CAAC,EAAE,CAAC,EACP,CAAC;QAEH;;;WAGG;QACH,KAAK,WAAW,CAAC,gBAAgB,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAExD;;;;;;;;WAQG;QACH,MAAM,iCAAiC,GACrC,kBAAkB,CAAC,6BAA6B,CAC9C,gBAAgB,CAAC,iBAAiB,CAAC,MAAM,CAC1C,CAAC;QAEJ,IAAI,0BAA0B,GAAsC,IAAI,CAAC;QAEzE,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,MAAM,CAAC,gBAAgB,EAAE,0BAA0B,EAAE,WAAW,CAAC,GAI7D,MAAM,OAAO,CAAC,GAAG,CAAC;oBACpB,iCAAiC;oBACjC,cAAc,CAAC,yCAAyC,CAAC;wBACvD,GAAG;wBACH,QAAQ;wBACR,MAAM,EAAE,IAAI,QAAQ,CAAC,MAAM,CAAC;qBAC7B,CAAC;oBACF,iBAAiB,CAAC,iBAAiB,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC;iBACpE,CAAC,CAAC;gBAEH,0BAA0B,GAAG,gBAAgB,CAAC;gBAE9C,IAAI,0BAA0B,EAAE,CAAC;oBAC/B,gBAAgB,CAAC,0BAA0B;wBACzC,0BAA0B,CAAC;gBAC/B,CAAC;gBAED,IAAI,0BAA0B,EAAE,CAAC;oBAC/B,gBAAgB,CAAC,0BAA0B,GAAG,EAAE,CAAC;oBACjD,gBAAgB,CAAC,0BAA0B,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;wBAC9D,0BAA0B,CAAC;gBAC/B,CAAC;gBAED;;;;;mBAKG;gBACH,gBAAgB,CAAC,WAAW,GAAG,WAAW,CAAC;YAC7C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,QAAQ,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,KAAkB,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,0BAA0B,GAAG,MAAM,iCAAiC,CAAC;YAErE,IAAI,0BAA0B,EAAE,CAAC;gBAC/B,gBAAgB,CAAC,0BAA0B;oBACzC,0BAA0B,CAAC;YAC/B,CAAC;QACH,CAAC;QAED,IAAI,GAAG,CAAC,OAAO,CAAC,uBAAuB,CAAC,EAAE,CAAC;YACzC,IACE,0BAA0B;gBAC1B,0BAA0B,CAAC,UAAU;gBACrC,0BAA0B,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAChD,CAAC;gBACD,MAAM,0BAA0B,GAC9B,MAAM,cAAc,CAAC,2CAA2C,CAC9D,GAAG,EACH,IAAI,QAAQ,CAAC,MAAM,CAAC,EACpB,0BAA0B,CAAC,UAAU,CACtC,CAAC;gBAEJ,IAAI,0BAA0B,EAAE,CAAC;oBAC/B,gBAAgB,CAAC,0BAA0B;wBACzC,0BAA0B,CAAC;gBAC/B,CAAC;YACH,CAAC;QACH,CAAC;QAED,uBAAuB;QAEvB,IAAI,gBAAgB,CAAC,0BAA0B,EAAE,CAAC;YAChD,MAAM,eAAe,GAAe,aAAa,CAAC,SAAS,CACzD,gBAAgB,CAAC,0BAA0B,CAC5C,CAAC;YACF,MAAM,WAAW,GAAW,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;YAC5D,MAAM,qBAAqB,GAAW,MAAM,YAAY,CAAC,SAAS,CAChE,WAAW,EACX,IAAI,CACL,CAAC;YAEF,IACE,CAAC,CACC,GAAG,CAAC,OAAO;gBACX,GAAG,CAAC,OAAO,CAAC,yBAAyB,CAAC;gBACtC,GAAG,CAAC,OAAO,CAAC,yBAAyB,CAAC,KAAK,qBAAqB,CACjE,EACD,CAAC;gBACD,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC;gBAC3C,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,qBAAqB,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QAED,gCAAgC;QAChC,IACE,gBAAgB,CAAC,0BAA0B;YAC3C,QAAQ;YACR,gBAAgB,CAAC,0BAA0B,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,EAChE,CAAC;YACD,MAAM,YAAY,GAAW,IAAI,CAAC,SAAS,CACzC,aAAa,CAAC,SAAS,CACrB,gBAAgB,CAAC,0BAA0B,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAE,CAClE,CACF,CAAC;YAEF,MAAM,sBAAsB,GAAW,MAAM,YAAY,CAAC,SAAS,CACjE,YAAY,EACZ,IAAI,CACL,CAAC;YAEF,IACE,CAAC,CACC,GAAG,CAAC,OAAO;gBACX,GAAG,CAAC,OAAO,CAAC,0BAA0B,CAAC;gBACvC,GAAG,CAAC,OAAO,CAAC,0BAA0B,CAAC,KAAK,sBAAsB,CACnE,EACD,CAAC;gBACD,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,YAAY,CAAC,CAAC;gBAC7C,GAAG,CAAC,GAAG,CAAC,0BAA0B,EAAE,sBAAsB,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;QAED,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAGmB,AAAb,MAAM,CAAC,KAAK,CAAC,yBAAyB,CAC3C,GAAmB,EACnB,GAAoB,EACpB,IAAkB;QAElB,MAAM,gBAAgB,GAAqB,GAAuB,CAAC;QAEnE,IACE,CAAC,gBAAgB,CAAC,QAAQ;YAC1B,gBAAgB,CAAC,QAAQ,KAAK,QAAQ,CAAC,MAAM,EAC7C,CAAC;YACD,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,yBAAyB,CAC3B,iEAAiE,CAClE,CACF,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAEM,MAAM,CAAC,iBAAiB,CAAC,IAE/B;QAKC,OAAO,KAAK,EACV,GAAmB,EACnB,GAAoB,EACpB,IAAkB,EACH,EAAE;;YACjB,MAAM,gBAAgB,GAAqB,GAAuB,CAAC;YAEnE,yCAAyC;YACzC,IAAI,gBAAgB,CAAC,QAAQ,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC;gBACvD,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YAED,MAAM,QAAQ,GAAyB,gBAAgB,CAAC,QAAQ,CAAC;YAEjE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,sBAAsB,CACxB,iDAAiD,CAClD,CACF,CAAC;YACJ,CAAC;YAED,MAAM,oBAAoB,GACxB,MAAA,gBAAgB,CAAC,0BAA0B,0CAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;YAErE,IAAI,CAAC,oBAAoB,EAAE,CAAC;gBAC1B,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,sBAAsB,CACxB,oDAAoD,CACrD,CACF,CAAC;YACJ,CAAC;YAED,MAAM,eAAe,GACnB,oBAAoB,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAiB,EAAE,EAAE;gBACzD,OAAO,CAAC,CAAC,UAAU,CAAC;YACtB,CAAC,CAAC,CAAC;YAEL,IACE,CAAC,gBAAgB,CAAC,wBAAwB,CACxC,eAAe,EACf,IAAI,CAAC,WAAW,CACjB,EACD,CAAC;gBACD,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,sBAAsB,CACxB,iEAAiE,CAClE,CACF,CAAC;YACJ,CAAC;YAED,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC,CAAC;IACJ,CAAC;IAGmB,AAAb,MAAM,CAAC,KAAK,CAAC,yCAAyC,CAAC,IAI7D;;QACC,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAEvC,MAAM,aAAa,GACjB,CAAA,MAAC,GAAwB,CAAC,iBAAiB,0CAAE,aAAa,MAAK,IAAI,CAAC;QAEtE;;;;WAIG;QACH,MAAM,CAAC,yBAAyB,EAAE,gBAAgB,CAAC,GAG/C,MAAM,OAAO,CAAC,GAAG,CAAC;YACpB,cAAc,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,GAAU,EAAE,EAAE;gBAClE;;;mBAGG;gBACH,IAAI,GAAG,CAAC,OAAO,KAAK,mBAAmB,EAAE,CAAC;oBACxC,MAAM,IAAI,uBAAuB,CAAC,kBAAkB,CAAC,CAAC;gBACxD,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC,CAAC;YACF,kBAAkB,CAAC,6BAA6B,CAAC,MAAM,EAAE,QAAQ,CAAC;SACnE,CAAC,CAAC;QAEH;;;;;WAKG;QACH,IAAI,kBAAkB,GAAY,yBAAyB,CAAC;QAC5D,IAAI,CAAC,kBAAkB,IAAI,CAAC,aAAa,EAAE,CAAC;YAC1C,kBAAkB;gBAChB,MAAM,mBAAmB,CAAC,qBAAqB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;oBAC3D,OAAO,KAAK,CAAC;gBACf,CAAC,CAAC,CAAC;QACP,CAAC;QAED,IAAI,kBAAkB,EAAE,CAAC;YACvB;;;eAGG;YACH,MAAM,qBAAqB,GACzB,MAAM,cAAc,CAAC,8BAA8B,CAAC,QAAQ,CAAC,CAAC,KAAK,CACjE,GAAG,EAAE;gBACH,OAAO,IAAI,CAAC;YACd,CAAC,CACF,CAAC;YAEJ,IACE,CAAC,CAAC,MAAM,cAAc,CAAC,wBAAwB,CAAC;gBAC9C,GAAG;gBACH,SAAS,EAAE,QAAQ;gBACnB,MAAM;gBACN,qBAAqB,EAAE,qBAAqB,aAArB,qBAAqB,cAArB,qBAAqB,GAAI,SAAS;aAC1D,CAAC,CAAC,EACH,CAAC;gBACD,MAAM,IAAI,yBAAyB,EAAE,CAAC;YACxC,CAAC;QACH,CAAC;QAED,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAGmB,AAAb,MAAM,CAAC,KAAK,CAAC,2CAA2C,CAC7D,GAAmB,EACnB,MAAgB,EAChB,UAAsB;;QAEtB,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,aAAa,GACjB,CAAA,MAAC,GAAwB,CAAC,iBAAiB,0CAAE,aAAa,MAAK,IAAI,CAAC;QAEtE;;;WAGG;QACH,MAAM,wBAAwB,GAAY,aAAa;YACrD,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,MAAM,mBAAmB,CAAC,qBAAqB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;gBAC3D,OAAO,KAAK,CAAC;YACf,CAAC,CAAC,CAAC;QAEP;;;;WAIG;QACH,MAAM,QAAQ,GAGT,MAAM,OAAO,CAAC,GAAG,CACpB,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,SAAmB,EAAE,EAAE;YAC3C,MAAM,yBAAyB,GAC7B,MAAM,cAAc,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;gBAC/D;;;mBAGG;gBACH,OAAO,KAAK,CAAC;YACf,CAAC,CAAC,CAAC;YAEL,MAAM,kBAAkB,GACtB,yBAAyB,IAAI,wBAAwB,CAAC;YAExD,IAAI,kBAAkB,EAAE,CAAC;gBACvB,MAAM,qBAAqB,GACzB,MAAM,cAAc,CAAC,8BAA8B,CACjD,SAAS,CACV,CAAC,KAAK,CAAC,GAAG,EAAE;oBACX,OAAO,IAAI,CAAC;gBACd,CAAC,CAAC,CAAC;gBAEL,IACE,CAAC,CAAC,MAAM,cAAc,CAAC,wBAAwB,CAAC;oBAC9C,GAAG;oBACH,SAAS;oBACT,MAAM;oBACN,qBAAqB,EAAE,qBAAqB,aAArB,qBAAqB,cAArB,qBAAqB,GAAI,SAAS;iBAC1D,CAAC,CAAC,EACH,CAAC;oBACD,OAAO;wBACL,SAAS;wBACT,UAAU,EACR,kBAAkB,CAAC,oCAAoC,CACrD,SAAS,CACV;qBACJ,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,OAAO;gBACL,SAAS;gBACT,UAAU,EAAE,MAAM,kBAAkB,CAAC,6BAA6B,CAChE,MAAM,EACN,SAAS,CACV;aACF,CAAC;QACJ,CAAC,CAAC,CACH,CAAC;QAEF,IAAI,MAAM,GAAkD,IAAI,CAAC;QACjE,KAAK,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,QAAQ,EAAE,CAAC;YACjD,IAAI,UAAU,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,GAAG,EAAE,CAAC;gBACd,CAAC;gBACD,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,GAAG,UAAU,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AAh5Be;IADb,WAAW,EAAE;;;;oDAgBb;AAGa;IADb,WAAW,EAAE;;;;4DAqBb;AAGa;IADb,WAAW,EAAE;;;;wCA4Eb;AAkCa;IADb,WAAW,EAAE;;;;iDAqCb;AAQa;IADb,WAAW,EAAE;;6CAGD,QAAQ;QACX,QAAQ;;0DA8CjB;AAYa;IADb,WAAW,EAAE;;6CAGJ,QAAQ;;+DAqBjB;AAYa;IADb,WAAW,EAAE;;6CAGD,QAAQ;QACX,QAAQ;;uDAqBjB;AA+BmB;IADnB,WAAW,EAAE;;;;gEAiDb;AAUmB;IADnB,WAAW,EAAE;;;;oDAmCb;AAGmB;IADnB,WAAW,EAAE;;;;6CAoNb;AAGmB;IADnB,WAAW,EAAE;;;;qDAsBb;AAuEmB;IADnB,WAAW,EAAE;;;;qEAwEb;AAGmB;IADnB,WAAW,EAAE;;6CAGJ,QAAQ;;uEAyFjB"}

package/build/dist/Server/Middleware/WhatsAppAuthorization.js

@@ -14,6 +14,18 @@ import ObjectID from "../../Types/ObjectID";
 import crypto from "crypto";
 import logger, { getLogAttributesFromRequest } from "../Utils/Logger";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+/*
+ * Meta sends the digest as "sha256=" followed by the 64 hex characters of a
+ * SHA-256 HMAC. The header is attacker-controlled and the endpoint is
+ * unauthenticated by design - the signature IS the authentication - so the
+ * shape has to be checked before the value reaches crypto.timingSafeEqual,
+ * which throws RangeError on a length mismatch rather than returning false.
+ * Without the guard, any unauthenticated request carrying a signature header
+ * of some other length threw out of the middleware instead of getting the
+ * intended 400.
+ */
+const SIGNATURE_PREFIX = "sha256=";
+const HEX_DIGEST_REGEX = /^[a-f0-9]{64}$/i;
 export default class WhatsAppAuthorization {
     static async isAuthorizedWhatsAppRequest(req, res, next) {
         var _a;
@@ -23,6 +35,17 @@ export default class WhatsAppAuthorization {
             logger.error("WhatsApp webhook request missing X-Hub-Signature-256 header.", getLogAttributesFromRequest(req));
             return Response.sendErrorResponse(req, res, new BadDataException("Missing X-Hub-Signature-256 header."));
         }
+        /*
+         * Checked up front, before the config lookup: a request whose signature
+         * cannot possibly verify should not cost a database round trip.
+         */
+        const providedDigest = signature.startsWith(SIGNATURE_PREFIX)
+            ? signature.slice(SIGNATURE_PREFIX.length)
+            : "";
+        if (!HEX_DIGEST_REGEX.test(providedDigest)) {
+            logger.error("WhatsApp webhook request has a malformed X-Hub-Signature-256 header.", getLogAttributesFromRequest(req));
+            return Response.sendErrorResponse(req, res, new BadDataException("WhatsApp webhook signature verification failed."));
+        }
         const globalConfig = await GlobalConfigService.findOneBy({
             query: {
                 _id: ObjectID.getZeroObjectID().toString(),
@@ -40,8 +63,15 @@ export default class WhatsAppAuthorization {
             return Response.sendErrorResponse(req, res, new BadDataException("Meta WhatsApp App Secret is not configured."));
         }
         const rawBody = req.rawBody || "";
-        const expectedSignature = `sha256=${crypto.createHmac("sha256", appSecret).update(rawBody).digest("hex")}`;
-        if (!crypto.timingSafeEqual(Buffer.from(expectedSignature), Buffer.from(signature))) {
+        const expectedDigest = crypto
+            .createHmac("sha256", appSecret)
+            .update(rawBody)
+            .digest("hex");
+        /*
+         * Both sides are decoded from 64 validated hex characters, so both
+         * buffers are 32 bytes and timingSafeEqual cannot throw here.
+         */
+        if (!crypto.timingSafeEqual(Buffer.from(expectedDigest, "hex"), Buffer.from(providedDigest, "hex"))) {
             logger.error("WhatsApp webhook signature verification failed.", getLogAttributesFromRequest(req));
             return Response.sendErrorResponse(req, res, new BadDataException("WhatsApp webhook signature verification failed."));
         }

package/build/dist/Server/Middleware/WhatsAppAuthorization.js.map

@@ -1 +1 @@
-{"version":3,"file":"WhatsAppAuthorization.js","sourceRoot":"","sources":["../../../../Server/Middleware/WhatsAppAuthorization.ts"],"names":[],"mappings":";;;;;;;;;AAKA,OAAO,QAAQ,MAAM,mBAAmB,CAAC;AACzC,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AAEtE,OAAO,mBAAmB,MAAM,iCAAiC,CAAC;AAClE,OAAO,QAAQ,MAAM,sBAAsB,CAAC;AAC5C,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,MAAM,EAAE,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,WAAW,MAAM,gCAAgC,CAAC;AAEzD,MAAM,CAAC,OAAO,OAAO,qBAAqB;IAEpB,AAAb,MAAM,CAAC,KAAK,CAAC,2BAA2B,CAC7C,GAAqB,EACrB,GAAoB,EACpB,IAAkB;;QAElB,MAAM,CAAC,KAAK,CACV,kDAAkD,EAClD,2BAA2B,CAAC,GAAG,CAAC,CACjC,CAAC;QAEF,MAAM,SAAS,GAAuB,GAAG,CAAC,OAAO,CAAC,qBAAqB,CAE1D,CAAC;QAEd,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CACV,8DAA8D,EAC9D,2BAA2B,CAAC,GAAG,CAAC,CACjC,CAAC;YACF,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,qCAAqC,CAAC,CAC5D,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAChB,MAAM,mBAAmB,CAAC,SAAS,CAAC;YAClC,KAAK,EAAE;gBACL,GAAG,EAAE,QAAQ,CAAC,eAAe,EAAE,CAAC,QAAQ,EAAE;aAC3C;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;YACD,MAAM,EAAE;gBACN,qBAAqB,EAAE,IAAI;aAC5B;SACF,CAAC,CAAC;QAEL,MAAM,SAAS,GACb,CAAA,MAAA,YAAY,aAAZ,YAAY,uBAAZ,YAAY,CAAE,qBAAqB,0CAAE,IAAI,EAAE,KAAI,SAAS,CAAC;QAE3D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CACV,8EAA8E,EAC9E,2BAA2B,CAAC,GAAG,CAAC,CACjC,CAAC;YACF,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,6CAA6C,CAAC,CACpE,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAW,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;QAE1C,MAAM,iBAAiB,GAAW,UAAU,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAEnH,IACE,CAAC,MAAM,CAAC,eAAe,CACrB,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAe,EAC5C,MAAM,CAAC,IAAI,CAAC,SAAS,CAAe,CACrC,EACD,CAAC;YACD,MAAM,CAAC,KAAK,CACV,iDAAiD,EACjD,2BAA2B,CAAC,GAAG,CAAC,CACjC,CAAC;YACF,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,iDAAiD,CAAC,CACxE,CAAC;QACJ,CAAC;QAED,MAAM,CAAC,KAAK,CACV,kDAAkD,EAClD,2BAA2B,CAAC,GAAG,CAAC,CACjC,CAAC;QACF,IAAI,EAAE,CAAC;IACT,CAAC;CACF;AAjFqB;IADnB,WAAW,EAAE;;;;8DAiFb"}
+{"version":3,"file":"WhatsAppAuthorization.js","sourceRoot":"","sources":["../../../../Server/Middleware/WhatsAppAuthorization.ts"],"names":[],"mappings":";;;;;;;;;AAKA,OAAO,QAAQ,MAAM,mBAAmB,CAAC;AACzC,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AAEtE,OAAO,mBAAmB,MAAM,iCAAiC,CAAC;AAClE,OAAO,QAAQ,MAAM,sBAAsB,CAAC;AAC5C,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,MAAM,EAAE,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,WAAW,MAAM,gCAAgC,CAAC;AAEzD;;;;;;;;;GASG;AACH,MAAM,gBAAgB,GAAW,SAAS,CAAC;AAC3C,MAAM,gBAAgB,GAAW,iBAAiB,CAAC;AAEnD,MAAM,CAAC,OAAO,OAAO,qBAAqB;IAEpB,AAAb,MAAM,CAAC,KAAK,CAAC,2BAA2B,CAC7C,GAAqB,EACrB,GAAoB,EACpB,IAAkB;;QAElB,MAAM,CAAC,KAAK,CACV,kDAAkD,EAClD,2BAA2B,CAAC,GAAG,CAAC,CACjC,CAAC;QAEF,MAAM,SAAS,GAAuB,GAAG,CAAC,OAAO,CAAC,qBAAqB,CAE1D,CAAC;QAEd,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CACV,8DAA8D,EAC9D,2BAA2B,CAAC,GAAG,CAAC,CACjC,CAAC;YACF,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,qCAAqC,CAAC,CAC5D,CAAC;QACJ,CAAC;QAED;;;WAGG;QACH,MAAM,cAAc,GAAW,SAAS,CAAC,UAAU,CAAC,gBAAgB,CAAC;YACnE,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC;YAC1C,CAAC,CAAC,EAAE,CAAC;QAEP,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;YAC3C,MAAM,CAAC,KAAK,CACV,sEAAsE,EACtE,2BAA2B,CAAC,GAAG,CAAC,CACjC,CAAC;YACF,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,iDAAiD,CAAC,CACxE,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAChB,MAAM,mBAAmB,CAAC,SAAS,CAAC;YAClC,KAAK,EAAE;gBACL,GAAG,EAAE,QAAQ,CAAC,eAAe,EAAE,CAAC,QAAQ,EAAE;aAC3C;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;YACD,MAAM,EAAE;gBACN,qBAAqB,EAAE,IAAI;aAC5B;SACF,CAAC,CAAC;QAEL,MAAM,SAAS,GACb,CAAA,MAAA,YAAY,aAAZ,YAAY,uBAAZ,YAAY,CAAE,qBAAqB,0CAAE,IAAI,EAAE,KAAI,SAAS,CAAC;QAE3D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CACV,8EAA8E,EAC9E,2BAA2B,CAAC,GAAG,CAAC,CACjC,CAAC;YACF,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,6CAA6C,CAAC,CACpE,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAW,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;QAE1C,MAAM,cAAc,GAAW,MAAM;aAClC,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC;aAC/B,MAAM,CAAC,OAAO,CAAC;aACf,MAAM,CAAC,KAAK,CAAC,CAAC;QAEjB;;;WAGG;QACH,IACE,CAAC,MAAM,CAAC,eAAe,CACrB,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAe,EAChD,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAe,CACjD,EACD,CAAC;YACD,MAAM,CAAC,KAAK,CACV,iDAAiD,EACjD,2BAA2B,CAAC,GAAG,CAAC,CACjC,CAAC;YACF,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,iDAAiD,CAAC,CACxE,CAAC;QACJ,CAAC;QAED,MAAM,CAAC,KAAK,CACV,kDAAkD,EAClD,2BAA2B,CAAC,GAAG,CAAC,CACjC,CAAC;QACF,IAAI,EAAE,CAAC;IACT,CAAC;CACF;AA5GqB;IADnB,WAAW,EAAE;;;;8DA4Gb"}

package/build/dist/Server/Services/GlobalOidcProjectService.js

@@ -12,10 +12,82 @@ import Model from "../../Models/DatabaseModels/GlobalOidcProject";
 import { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import validateGlobalProviderProjectTeams, { resolveAttachmentProjectId, } from "../Utils/ValidateGlobalProviderProjectTeams";
+import { GLOBAL_SSO_AUTHORIZATION_CACHE_TTL_MS, clearGlobalSsoAuthorizationCaches, doAttachmentsGovernProject, globalProviderCacheKey, globalSsoAttachmentsCache, loadAttachmentsOnce, } from "../Utils/GlobalSsoAuthorization";
 export class Service extends DatabaseService {
     constructor() {
         super(Model);
     }
+    /**
+     * Whether this provider's attachments cover `projectId`.
+     *
+     * Only consulted when the provider has `restrictToAttachedProjects` on -
+     * attachments are the PROVISIONING allow-list by default, not an access
+     * boundary, and reading them as one without the admin asking would lock
+     * existing users out of projects they legitimately reach.
+     *
+     * "No attachment rows at all" means instance-wide, matching the login
+     * router's default-all mode. "Rows exist but none are enabled" is a
+     * different answer and denies - otherwise an admin disabling the last
+     * attachment would WIDEN the provider to every project.
+     *
+     * Cached for 60s, with concurrent misses sharing one query.
+     */
+    async doesProviderGovernProject(data) {
+        const key = globalProviderCacheKey("oidc", data.globalOidcId);
+        const cached = globalSsoAttachmentsCache.get(key);
+        if (cached !== undefined) {
+            return doAttachmentsGovernProject(cached, data.projectId);
+        }
+        const attachments = await loadAttachmentsOnce(key, async () => {
+            /*
+             * Fetched WITHOUT the isEnabled filter so a disabled row still counts
+             * as "this provider has attachments"; the enabled ones are selected
+             * out below.
+             */
+            const rows = await this.findBy({
+                query: { globalOidcId: data.globalOidcId },
+                select: { _id: true, projectId: true, isEnabled: true },
+                limit: LIMIT_PER_PROJECT,
+                skip: 0,
+                props: { isRoot: true },
+            });
+            const loaded = {
+                hasAnyAttachmentRows: rows.length > 0,
+                enabledProjectIds: rows
+                    .filter((row) => {
+                    return Boolean(row.isEnabled) && Boolean(row.projectId);
+                })
+                    .map((row) => {
+                    return row.projectId.toString();
+                }),
+            };
+            globalSsoAttachmentsCache.set(key, loaded, GLOBAL_SSO_AUTHORIZATION_CACHE_TTL_MS);
+            return loaded;
+        });
+        return doAttachmentsGovernProject(attachments, data.projectId);
+    }
+    async onBeforeDelete(deleteBy) {
+        // Detaching a project has to take effect now, not in 60s, on this node.
+        clearGlobalSsoAuthorizationCaches();
+        return { deleteBy, carryForward: null };
+    }
+    /*
+     * Cleared again AFTER the write commits. A clear that runs before the row
+     * lands can be immediately re-filled with the pre-change answer by a
+     * concurrent request, handing the old attachment set another full TTL.
+     */
+    async onDeleteSuccess(onDelete, _itemIdsBeforeDelete) {
+        clearGlobalSsoAuthorizationCaches();
+        return onDelete;
+    }
+    async onCreateSuccess(_onCreate, createdItem) {
+        clearGlobalSsoAuthorizationCaches();
+        return createdItem;
+    }
+    async onUpdateSuccess(onUpdate, _updatedItemIds) {
+        clearGlobalSsoAuthorizationCaches();
+        return onUpdate;
+    }
     async onBeforeCreate(createBy) {
         /*
          * The attach form submits the project via the `project` relation, so the
@@ -30,6 +102,8 @@ export class Service extends DatabaseService {
             teams: createBy.data.teams,
             projectId,
         });
+        // A new attachment narrows (or widens) which projects the provider governs.
+        clearGlobalSsoAuthorizationCaches();
         return { createBy, carryForward: null };
     }
     async onBeforeUpdate(updateBy) {
@@ -61,9 +135,40 @@ export class Service extends DatabaseService {
                 }
             }
         }
+        clearGlobalSsoAuthorizationCaches();
         return { updateBy, carryForward: null };
     }
 }
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "doesProviderGovernProject", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onBeforeDelete", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Array]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onDeleteSuccess", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Model]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onCreateSuccess", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Array]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onUpdateSuccess", null);
 __decorate([
     CaptureSpan(),
     __metadata("design:type", Function),

package/build/dist/Server/Services/GlobalOidcProjectService.js.map

@@ -1 +1 @@
-{"version":3,"file":"GlobalOidcProjectService.js","sourceRoot":"","sources":["../../../../Server/Services/GlobalOidcProjectService.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,MAAM,+CAA+C,CAAC;AAElE,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAKlE,OAAO,WAAW,MAAM,gCAAgC,CAAC;AACzD,OAAO,kCAAkC,EAAE,EACzC,0BAA0B,GAC3B,MAAM,6CAA6C,CAAC;AAErD,MAAM,OAAO,OAAQ,SAAQ,eAAsB;IACjD;QACE,KAAK,CAAC,KAAK,CAAC,CAAC;IACf,CAAC;IAGwB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB;;;;WAIG;QACH,MAAM,SAAS,GAAyB,0BAA0B,CAChE,QAAQ,CAAC,IAAI,CACd,CAAC;QAEF,IAAI,SAAS,EAAE,CAAC;YACd,QAAQ,CAAC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QACtC,CAAC;QAED,MAAM,kCAAkC,CAAC;YACvC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK;YAC1B,SAAS;SACV,CAAC,CAAC;QAEH,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IAGwB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB,0EAA0E;QAC1E,MAAM,KAAK,GAA4B,QAAQ,CAAC,IAAI,CAAC,KAExC,CAAC;QAEd,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,iBAAiB,GAAyB,QAAQ,CAAC,IAAI;iBAC1D,SAA4C,CAAC;YAEhD,IAAI,iBAAiB,EAAE,CAAC;gBACtB,MAAM,kCAAkC,CAAC;oBACvC,KAAK;oBACL,SAAS,EAAE,iBAAiB;iBAC7B,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,yEAAyE;gBACzE,MAAM,IAAI,GAAiB,MAAM,IAAI,CAAC,MAAM,CAAC;oBAC3C,KAAK,EAAE,QAAQ,CAAC,KAAK;oBACrB,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;oBACtC,KAAK,EAAE,iBAAiB;oBACxB,IAAI,EAAE,CAAC;oBACP,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;iBACxB,CAAC,CAAC;gBAEH,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;oBACvB,MAAM,kCAAkC,CAAC;wBACvC,KAAK;wBACL,SAAS,EAAE,GAAG,CAAC,SAAS;qBACzB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;CACF;AA/D0B;IADxB,WAAW,EAAE;;;;6CAuBb;AAGwB;IADxB,WAAW,EAAE;;;;6CAsCb;AAGH,eAAe,IAAI,OAAO,EAAE,CAAC"}
+{"version":3,"file":"GlobalOidcProjectService.js","sourceRoot":"","sources":["../../../../Server/Services/GlobalOidcProjectService.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,MAAM,+CAA+C,CAAC;AAElE,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAKlE,OAAO,WAAW,MAAM,gCAAgC,CAAC;AACzD,OAAO,kCAAkC,EAAE,EACzC,0BAA0B,GAC3B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EACL,qCAAqC,EAErC,iCAAiC,EACjC,0BAA0B,EAC1B,sBAAsB,EACtB,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,iCAAiC,CAAC;AAGzC,MAAM,OAAO,OAAQ,SAAQ,eAAsB;IACjD;QACE,KAAK,CAAC,KAAK,CAAC,CAAC;IACf,CAAC;IAED;;;;;;;;;;;;;;OAcG;IAEU,AAAN,KAAK,CAAC,yBAAyB,CAAC,IAGtC;QACC,MAAM,GAAG,GAAW,sBAAsB,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAEtE,MAAM,MAAM,GACV,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAErC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,0BAA0B,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,WAAW,GAA8B,MAAM,mBAAmB,CACtE,GAAG,EACH,KAAK,IAAwC,EAAE;YAC7C;;;;eAIG;YACH,MAAM,IAAI,GAAiB,MAAM,IAAI,CAAC,MAAM,CAAC;gBAC3C,KAAK,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE;gBAC1C,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;gBACvD,KAAK,EAAE,iBAAiB;gBACxB,IAAI,EAAE,CAAC;gBACP,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;aACxB,CAAC,CAAC;YAEH,MAAM,MAAM,GAA8B;gBACxC,oBAAoB,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC;gBACrC,iBAAiB,EAAE,IAAI;qBACpB,MAAM,CAAC,CAAC,GAAU,EAAE,EAAE;oBACrB,OAAO,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAC1D,CAAC,CAAC;qBACD,GAAG,CAAC,CAAC,GAAU,EAAE,EAAE;oBAClB,OAAO,GAAG,CAAC,SAAU,CAAC,QAAQ,EAAE,CAAC;gBACnC,CAAC,CAAC;aACL,CAAC;YAEF,yBAAyB,CAAC,GAAG,CAC3B,GAAG,EACH,MAAM,EACN,qCAAqC,CACtC,CAAC;YAEF,OAAO,MAAM,CAAC;QAChB,CAAC,CACF,CAAC;QAEF,OAAO,0BAA0B,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACjE,CAAC;IAGwB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB,wEAAwE;QACxE,iCAAiC,EAAE,CAAC;QACpC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IAED;;;;OAIG;IAEsB,AAAN,KAAK,CAAC,eAAe,CACtC,QAAyB,EACzB,oBAAqC;QAErC,iCAAiC,EAAE,CAAC;QACpC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAGwB,AAAN,KAAK,CAAC,eAAe,CACtC,SAA0B,EAC1B,WAAkB;QAElB,iCAAiC,EAAE,CAAC;QACpC,OAAO,WAAW,CAAC;IACrB,CAAC;IAGwB,AAAN,KAAK,CAAC,eAAe,CACtC,QAAyB,EACzB,eAAgC;QAEhC,iCAAiC,EAAE,CAAC;QACpC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAGwB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB;;;;WAIG;QACH,MAAM,SAAS,GAAyB,0BAA0B,CAChE,QAAQ,CAAC,IAAI,CACd,CAAC;QAEF,IAAI,SAAS,EAAE,CAAC;YACd,QAAQ,CAAC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QACtC,CAAC;QAED,MAAM,kCAAkC,CAAC;YACvC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK;YAC1B,SAAS;SACV,CAAC,CAAC;QAEH,4EAA4E;QAC5E,iCAAiC,EAAE,CAAC;QAEpC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IAGwB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB,0EAA0E;QAC1E,MAAM,KAAK,GAA4B,QAAQ,CAAC,IAAI,CAAC,KAExC,CAAC;QAEd,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,iBAAiB,GAAyB,QAAQ,CAAC,IAAI;iBAC1D,SAA4C,CAAC;YAEhD,IAAI,iBAAiB,EAAE,CAAC;gBACtB,MAAM,kCAAkC,CAAC;oBACvC,KAAK;oBACL,SAAS,EAAE,iBAAiB;iBAC7B,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,yEAAyE;gBACzE,MAAM,IAAI,GAAiB,MAAM,IAAI,CAAC,MAAM,CAAC;oBAC3C,KAAK,EAAE,QAAQ,CAAC,KAAK;oBACrB,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;oBACtC,KAAK,EAAE,iBAAiB;oBACxB,IAAI,EAAE,CAAC;oBACP,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;iBACxB,CAAC,CAAC;gBAEH,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;oBACvB,MAAM,kCAAkC,CAAC;wBACvC,KAAK;wBACL,SAAS,EAAE,GAAG,CAAC,SAAS;qBACzB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,iCAAiC,EAAE,CAAC;QAEpC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;CACF;AAnKc;IADZ,WAAW,EAAE;;;;wDAoDb;AAGwB;IADxB,WAAW,EAAE;;;;6CAOb;AAQwB;IADxB,WAAW,EAAE;;6CAGU,KAAK;;8CAI5B;AAGwB;IADxB,WAAW,EAAE;;6CAGC,KAAK;;8CAInB;AAGwB;IADxB,WAAW,EAAE;;6CAGK,KAAK;;8CAIvB;AAGwB;IADxB,WAAW,EAAE;;;;6CA0Bb;AAGwB;IADxB,WAAW,EAAE;;;;6CAwCb;AAGH,eAAe,IAAI,OAAO,EAAE,CAAC"}