@oneuptime/common 12.0.14 → 12.0.16

package/build/dist/Server/Middleware/IdentityRateLimit.js

@@ -0,0 +1,491 @@
+import Redis from "../Infrastructure/Redis";
+import logger from "../Utils/Logger";
+import resolveTrustedClientIp from "../Utils/ClientIp";
+import Response from "../Utils/Response";
+import ServiceUnavailableException from "../../Types/Exception/ServiceUnavailableException";
+import TooManyRequestsException from "../../Types/Exception/TooManyRequestsException";
+/*
+ * Attempt limiting for the anonymous identity routes that accept a
+ * credential: POST /login, POST /verify-totp-auth, POST /verify-webauthn-auth
+ * and POST /verify-totp-enrolment
+ * (App/FeatureSet/Identity/API/Authentication.ts).
+ *
+ * WHY THESE ROUTES NEED IT
+ *
+ * All three are unauthenticated by definition -- they are how a session is
+ * obtained -- so nothing upstream of them counts anything. Until this
+ * middleware existed a caller could submit credentials to them as fast as the
+ * process would answer.
+ *
+ * /verify-totp-auth is the sharpest case. It is reached with a valid password
+ * already in hand, and the only thing left to produce is a six digit code, so
+ * unthrottled it is an online guessing oracle against a 10^6 space. The space
+ * is not even 10^6 wide at any given instant: Common/Server/Utils/TotpAuth.ts
+ * accepts TotpValidationWindow = 3 steps either side of now (seven 30 second
+ * steps, +/- 90 seconds) across both entries in SupportedTotpAlgorithms, so
+ * fourteen distinct six digit strings are live at once and a single guess
+ * lands with probability ~1.4e-5. At a few thousand requests a second that is
+ * a bypassed second factor in minutes. Bounded to the budgets below it is
+ * years, and the account owner sees the failures.
+ *
+ * /login is the same shape one step earlier, against a password rather than a
+ * code.
+ *
+ * /verify-webauthn-auth and /verify-totp-enrolment are covered for a reason
+ * that holds whatever their own factor is worth. All four routes share one
+ * `login()` function and all of them run the same `verifyHashedColumnValue`
+ * before they reach their factor, so each is a password oracle in its own
+ * right. Leaving any one of them unlimited would not be an unguarded route so
+ * much as a hole in the fence: an attacker refused at /login points the same
+ * guesses at whichever sibling still answers. The enrolment route makes that
+ * concrete -- guessing its CODE is pointless, because /login hands the user
+ * the secret it is derived from, but guessing the PASSWORD it demands first is
+ * exactly as useful there as anywhere else.
+ *
+ * CAPTCHA IS NOT THIS
+ *
+ * /login already calls CaptchaUtil.verifyCaptcha, but that is not a
+ * substitute on either axis. CAPTCHA_ENABLED is off by default, so a
+ * self-hosted instance has nothing there at all; and an hCaptcha token is
+ * single use, which is exactly why the second step of a login cannot demand
+ * one -- /verify-totp-auth deliberately does not, and could not.
+ *
+ * THIS FAILS CLOSED
+ *
+ * With Redis unreachable these routes answer 503 rather than running
+ * unthrottled. That is the choice PublicDashboardRateLimit makes for
+ * /master-password and the opposite of the one VerificationCodeRateLimit
+ * makes, and the deciding question is the same in all three: is there another
+ * control still standing? Here there is not. Nothing in Postgres counts login
+ * attempts, so serving the route without the counter means serving the
+ * unlimited guessing oracle this middleware exists to close.
+ *
+ * It also costs nothing in availability that was not already lost. A
+ * successful login goes through AccessTokenService.refreshUserAllPermissions,
+ * which writes the user's permissions to GlobalCache, which throws
+ * DatabaseNotConnectedException when Redis is down. Logging in is already
+ * impossible in that state; the difference this makes is a 503 that says to
+ * come back shortly instead of a 500.
+ */
+/*
+ * Every request consumes TWO counters, and either one can reject it:
+ *
+ *  - the account counter, keyed on the submitted email address AND the client
+ *    address. This is the budget one person gets for one account.
+ *
+ *  - the address counter, keyed on the client address alone. Without it the
+ *    account counter is trivially bypassed: the email address is a field in
+ *    the request body, so a caller who changes it on every request lands in a
+ *    fresh bucket every time. Against /verify-totp-auth that matters
+ *    enormously -- a code guessed against ANY account is a bypassed second
+ *    factor, the attacker does not care whose. The address counter is the
+ *    ceiling that survives email rotation.
+ *
+ * Deliberately NOT keyed on the email address alone. A bare per-account
+ * counter is a lockout weapon: anyone who knows a victim's email address
+ * could burn that account's whole budget from anywhere and keep the real
+ * owner out for as long as they cared to keep sending. Pairing the address
+ * in means an attacker can only spend their own bucket.
+ *
+ * The cost of that pairing, stated plainly: an attacker with many source
+ * addresses gets a fresh per-account budget from each one, so a distributed
+ * attack on a single account is bounded only by how many addresses they have.
+ * That is the standard trade and it is the right way round -- the alternative
+ * hands every user a remote lockout button, and the distributed case is what
+ * the account owner's own failed-login visibility and the network layer are
+ * for.
+ *
+ * Both counters are incremented on every request including a rejected one.
+ * That is standard fixed-window behaviour and it is deliberate: a caller who
+ * keeps hammering keeps their window pinned rather than being handed a fresh
+ * allowance for free.
+ */
+export var IdentityRateLimitBucket;
+(function (IdentityRateLimitBucket) {
+    /* POST /login. Password guessing. */
+    IdentityRateLimitBucket["Login"] = "login";
+    /*
+     * POST /verify-totp-auth, POST /verify-webauthn-auth and
+     * POST /verify-totp-enrolment -- the second step, reached with a valid
+     * password already accepted.
+     */
+    IdentityRateLimitBucket["TwoFactor"] = "two-factor";
+})(IdentityRateLimitBucket || (IdentityRateLimitBucket = {}));
+export var IdentityRateLimitScope;
+(function (IdentityRateLimitScope) {
+    /* One email address, from one client address. */
+    IdentityRateLimitScope["Account"] = "account";
+    /* One client address, across every account. Survives email rotation. */
+    IdentityRateLimitScope["Ip"] = "ip";
+})(IdentityRateLimitScope || (IdentityRateLimitScope = {}));
+export var IdentityRateLimitOutcome;
+(function (IdentityRateLimitOutcome) {
+    IdentityRateLimitOutcome["Allowed"] = "allowed";
+    IdentityRateLimitOutcome["RateLimited"] = "rate-limited";
+    /* Redis is unreachable, so no limit can be honoured either way. */
+    IdentityRateLimitOutcome["CounterUnavailable"] = "counter-unavailable";
+})(IdentityRateLimitOutcome || (IdentityRateLimitOutcome = {}));
+const parsePositiveIntFromEnv = (envKey, fallback) => {
+    const rawValue = process.env[envKey];
+    if (!rawValue) {
+        return fallback;
+    }
+    const parsedValue = parseInt(rawValue, 10);
+    if (!Number.isFinite(parsedValue) || parsedValue <= 0) {
+        return fallback;
+    }
+    return parsedValue;
+};
+/*
+ * Password budget.
+ *
+ * Ten attempts per quarter hour for one account from one address. A person
+ * who has forgotten which of their passwords this is tries three or four and
+ * then uses the reset link; ten is comfortably past that and still turns
+ * "as fast as the process answers" into forty an hour.
+ *
+ * The per-address ceiling is set for the honest worst case rather than the
+ * typical one, because a corporate NAT puts a whole office behind a single
+ * address and a morning sign-in surge must not be refused. 150 a quarter hour
+ * covers that while still bounding a caller who rotates email addresses to
+ * fifteen accounts' worth of attempts -- and it is the number an operator
+ * most likely wants to lower, which is what the environment variable is for.
+ * A limiter that fires on real users gets switched off, and a switched-off
+ * limiter bounds nothing.
+ */
+const LOGIN_BUCKET = {
+    windowSeconds: parsePositiveIntFromEnv("IDENTITY_LOGIN_RATE_LIMIT_WINDOW_SECONDS", 15 * 60),
+    perAccountLimit: parsePositiveIntFromEnv("IDENTITY_LOGIN_RATE_LIMIT_PER_ACCOUNT_PER_WINDOW", 10),
+    perIpLimit: parsePositiveIntFromEnv("IDENTITY_LOGIN_RATE_LIMIT_PER_IP_PER_WINDOW", 150),
+};
+/*
+ * Second step budget.
+ *
+ * Same shape as the password bucket, and the same numbers, for a different
+ * reason: the code is read off a screen rather than recalled, so ten wrong
+ * ones in a quarter hour is already well past anything a real user does --
+ * a phone whose clock has drifted past the +/- 90 second window fails every
+ * time, and no number of retries fixes that.
+ *
+ * Kept as a SEPARATE bucket from the password one rather than a shared pool,
+ * which does mean a caller gets both budgets in a window. That is the price of
+ * the property that matters more: a burst of /login noise must not be able to
+ * refuse a user who is midway through finishing a two factor login, and a user
+ * being marched through a mandated enrolment must not be locked out of it by
+ * the /login attempt that sent them there.
+ *
+ * What ten buys against guessing: fourteen of the 10^6 codes are live at any
+ * instant, so forty guesses an hour is a ~0.06% chance of landing one in a
+ * day and about a year to reach even odds -- against an attacker who holds
+ * the account's password for that entire year and generates a visible failed
+ * attempt every ninety seconds throughout.
+ */
+const TWO_FACTOR_BUCKET = {
+    windowSeconds: parsePositiveIntFromEnv("IDENTITY_TWO_FACTOR_RATE_LIMIT_WINDOW_SECONDS", 15 * 60),
+    perAccountLimit: parsePositiveIntFromEnv("IDENTITY_TWO_FACTOR_RATE_LIMIT_PER_ACCOUNT_PER_WINDOW", 10),
+    perIpLimit: parsePositiveIntFromEnv("IDENTITY_TWO_FACTOR_RATE_LIMIT_PER_IP_PER_WINDOW", 150),
+};
+const KEY_PREFIX = "identity:rl:";
+/*
+ * Counter keys outlive their window by one full window, so a request landing
+ * on a boundary cannot read a key that was reclaimed mid-window.
+ */
+const TTL_MULTIPLIER = 2;
+/* Bounds a Redis key built from caller-supplied values. */
+const MAX_KEY_SEGMENT_LENGTH = 64;
+/* How often the "counter unavailable" condition may be logged, per bucket. */
+const COUNTER_UNAVAILABLE_LOG_INTERVAL_MS = 60 * 1000;
+class IdentityRateLimit {
+    /*
+     * The client address to bill this request to.
+     *
+     * Delegates to the shared ClientIp helper, which reads X-Forwarded-For from
+     * the trusted (right-hand) end under the instance-wide TRUSTED_PROXY_HOPS
+     * setting. Deliberately NOT Express.getClientIp: that one takes the LEFTMOST
+     * entry, which any caller can set by sending its own X-Forwarded-For header,
+     * and for a rate limiter that is fatal -- a fresh spoofed value per request
+     * is a fresh bucket per request and therefore no limit at all.
+     *
+     * The helper also normalizes ports, brackets and IPv4-mapped IPv6, so one
+     * caller cannot land in two different buckets depending on the form their
+     * address arrives in.
+     */
+    static resolveClientIp(req) {
+        const clientIp = resolveTrustedClientIp(req);
+        if (clientIp) {
+            return IdentityRateLimit.sanitizeKeySegment(clientIp);
+        }
+        /*
+         * Everything with no resolvable address shares one bucket. That is the
+         * conservative direction: an unidentifiable caller should not be handed a
+         * private allowance.
+         */
+        return "unknown";
+    }
+    /*
+     * The account this request is trying to authenticate as, as a key segment.
+     *
+     * The login page posts everything nested under `data` (see
+     * App/FeatureSet/Accounts/src/Pages/Login.tsx), which is where all four
+     * routes read the credentials from; the top level is checked too so that a
+     * caller posting the flatter shape is still counted rather than silently
+     * sharing the "none" bucket with everybody else.
+     *
+     * `email` ARRIVES IN TWO SHAPES, AND BOTH ARE FIRST-PARTY
+     *
+     * A bare string, and the serialized SerializableObject envelope
+     * `{ _type: "Email", value: "..." }` that Email.toJSON produces. Which one
+     * turns up depends on how the caller was written, and the shipped clients
+     * disagree with each other on the very routes limited here:
+     *
+     *   - POST /login from the dashboard goes through ModelForm, which hands the
+     *     model to ModelAPI.createOrUpdate, which sends
+     *     JSONFunctions.serialize(BaseModel.toJSON(...)) -- the ENVELOPE.
+     *   - POST /login from the mobile app hand-builds the same envelope
+     *     (MobileApp/src/api/auth.ts).
+     *   - POST /verify-totp-auth, /verify-totp-enrolment and
+     *     /verify-webauthn-auth from the dashboard spread the raw form values
+     *     (`...initialValues`), so there `email` is a bare STRING.
+     *
+     * The handler does not care, because BaseModel.fromJSON resolves both to the
+     * same address -- so this must not care either. Reading only the string form
+     * would put every /login from every shipped client into the shared "none"
+     * bucket, which is not a small mistake in either direction: the per-account
+     * counter would degenerate into a SECOND per-address counter at the much
+     * tighter per-account limit, refusing a whole office (or a carrier NAT) after
+     * ten sign-ins rather than the hundred and fifty the per-address ceiling is
+     * deliberately sized for; and, because the two shapes would key differently,
+     * an attacker could take the per-account budget twice by alternating them.
+     *
+     * The unwrap is deliberately not gated on `_type` being exactly Email. Any
+     * object carrying a string `value` is keyed by that value, which is the safe
+     * direction: the worst case is counting a request the handler will reject
+     * anyway against the bucket it names, whereas gating narrowly leaves another
+     * shape sitting in "none" for someone to spend.
+     *
+     * Lower-cased, because otherwise Bob@example.com and bob@example.com are
+     * two buckets for one account and case alone buys a fresh allowance. No
+     * attempt is made to validate the address: a well-formed one that belongs
+     * to nobody is worth exactly as much to an attacker as a malformed one, so
+     * there is nothing for a format check to separate. Normalizing is the part
+     * that matters.
+     */
+    static resolveAccountKey(req) {
+        var _a;
+        const body = req.body;
+        const data = body && typeof body["data"] === "object" && body["data"] !== null
+            ? body["data"]
+            : undefined;
+        const field = (_a = data === null || data === void 0 ? void 0 : data["email"]) !== null && _a !== void 0 ? _a : body === null || body === void 0 ? void 0 : body["email"];
+        /*
+         * Arrays are typeof "object" too, and indexing one by "value" is
+         * undefined rather than a throw -- but excluding them keeps the intent
+         * legible and stops a caller smuggling anything odd through.
+         */
+        const raw = field && typeof field === "object" && !Array.isArray(field)
+            ? field["value"]
+            : field;
+        /*
+         * `email` is whatever JSON the caller sent, so it is only a string
+         * because they chose to make it one. A number, a nested object or a
+         * missing field must land in a bucket rather than throw.
+         */
+        if (typeof raw !== "string" || raw.trim().length === 0) {
+            return "none";
+        }
+        return IdentityRateLimit.sanitizeKeySegment(raw.trim().toLowerCase());
+    }
+    static sanitizeKeySegment(value) {
+        return (value
+            .slice(0, MAX_KEY_SEGMENT_LENGTH)
+            /*
+             * Redis keys are binary safe, but a predictable charset keeps
+             * operational tooling (SCAN patterns, dashboards) sane.
+             */
+            .replace(/[^a-zA-Z0-9._:%\-[\]@]/g, "_"));
+    }
+    static getBucketConfig(bucket) {
+        return bucket === IdentityRateLimitBucket.TwoFactor
+            ? TWO_FACTOR_BUCKET
+            : LOGIN_BUCKET;
+    }
+    /*
+     * Increment both counters for this request and decide.
+     *
+     * Both INCRs go out in one pipeline so the common path costs a single round
+     * trip; the EXPIRE follow-ups only happen on the request that created a key.
+     */
+    static async consume(data) {
+        const client = Redis.getClient();
+        if (!client || !Redis.isConnected()) {
+            return { outcome: IdentityRateLimitOutcome.CounterUnavailable };
+        }
+        const config = IdentityRateLimit.getBucketConfig(data.bucket);
+        const windowMs = config.windowSeconds * 1000;
+        const windowIndex = Math.floor(Date.now() / windowMs);
+        const accountCounterKey = `${KEY_PREFIX}${data.bucket}:a:${data.accountKey}:${data.clientIp}:${windowIndex}`;
+        const ipCounterKey = `${KEY_PREFIX}${data.bucket}:i:${data.clientIp}:${windowIndex}`;
+        try {
+            const pipelineResults = (await client
+                .pipeline()
+                .incr(accountCounterKey)
+                .incr(ipCounterKey)
+                .exec());
+            if (!pipelineResults || pipelineResults.length < 2) {
+                throw new Error("Rate limit pipeline returned no result");
+            }
+            const accountCount = IdentityRateLimit.readCounterResult(pipelineResults[0]);
+            const ipCount = IdentityRateLimit.readCounterResult(pipelineResults[1]);
+            /*
+             * Set the expiry only on the write that created the key. Re-issuing
+             * EXPIRE on every increment would slide the window forward for as long
+             * as the attempts continue, so the counter would never reset and a
+             * caller who tripped the limit once could never recover -- which on a
+             * login route is a permanent lockout, not a slowdown.
+             */
+            const ttlSeconds = config.windowSeconds * TTL_MULTIPLIER;
+            const keysToExpire = [];
+            if (accountCount === 1) {
+                keysToExpire.push(accountCounterKey);
+            }
+            if (ipCount === 1) {
+                keysToExpire.push(ipCounterKey);
+            }
+            if (keysToExpire.length > 0) {
+                const expirePipeline = client.pipeline();
+                for (const key of keysToExpire) {
+                    expirePipeline.expire(key, ttlSeconds);
+                }
+                await expirePipeline.exec();
+            }
+            const retryAfterSeconds = IdentityRateLimit.getSecondsUntilWindowEnd(config.windowSeconds);
+            /*
+             * The account counter is reported first when both are over, because it
+             * is the more specific of the two and the more useful thing to see in a
+             * log line.
+             */
+            if (accountCount > config.perAccountLimit) {
+                return {
+                    outcome: IdentityRateLimitOutcome.RateLimited,
+                    retryAfterSeconds,
+                    scope: IdentityRateLimitScope.Account,
+                    isFirstRejectionInWindow: accountCount === config.perAccountLimit + 1,
+                };
+            }
+            if (ipCount > config.perIpLimit) {
+                return {
+                    outcome: IdentityRateLimitOutcome.RateLimited,
+                    retryAfterSeconds,
+                    scope: IdentityRateLimitScope.Ip,
+                    isFirstRejectionInWindow: ipCount === config.perIpLimit + 1,
+                };
+            }
+            return { outcome: IdentityRateLimitOutcome.Allowed };
+        }
+        catch (err) {
+            /*
+             * Throttled: whatever broke Redis is unlikely to have broken it for one
+             * request only, and a per-request log line buries the incident it is
+             * reporting.
+             */
+            if (IdentityRateLimit.shouldLogCounterUnavailable(data.bucket)) {
+                logger.warn(`IdentityRateLimit: counter failed for ${data.bucket} request from ${data.clientIp}`);
+                logger.warn(err);
+            }
+            return { outcome: IdentityRateLimitOutcome.CounterUnavailable };
+        }
+    }
+    static readCounterResult(result) {
+        if (!result) {
+            throw new Error("Rate limit counter returned no result");
+        }
+        const [error, value] = result;
+        if (error) {
+            throw error;
+        }
+        if (typeof value !== "number") {
+            throw new Error("Rate limit counter returned a non-numeric value");
+        }
+        return value;
+    }
+    /*
+     * Remaining seconds in the current fixed window, so every rejected caller
+     * is told to come back when the window actually rolls rather than all
+     * backing off by the same constant and re-colliding.
+     */
+    static getSecondsUntilWindowEnd(windowSeconds) {
+        const windowMs = windowSeconds * 1000;
+        const msIntoWindow = Date.now() % windowMs;
+        return Math.max(1, Math.ceil((windowMs - msIntoWindow) / 1000));
+    }
+    /*
+     * Express middleware. Registered as the first handler on each credential
+     * route, so a flood is refused before it costs a user lookup -- and, on the
+     * password routes, before it costs the bcrypt verify that makes each guess
+     * expensive for us as well as for the attacker.
+     */
+    static getMiddleware(bucket) {
+        return async (req, res, next) => {
+            const accountKey = IdentityRateLimit.resolveAccountKey(req);
+            const clientIp = IdentityRateLimit.resolveClientIp(req);
+            const decision = await IdentityRateLimit.consume({
+                accountKey,
+                clientIp,
+                bucket,
+            });
+            if (decision.outcome === IdentityRateLimitOutcome.RateLimited) {
+                if (decision.retryAfterSeconds) {
+                    IdentityRateLimit.setRetryAfterHeader(res, decision.retryAfterSeconds);
+                }
+                if (decision.isFirstRejectionInWindow) {
+                    logger.warn(`IdentityRateLimit: rejected ${bucket} attempt for ${accountKey} from ${clientIp} (${decision.scope} limit)`);
+                }
+                /*
+                 * The same message whichever counter fired, and whether or not the
+                 * account exists. These routes are careful not to say which half of a
+                 * credential was wrong; a limiter that answered differently for a real
+                 * address than for an invented one would hand back the account
+                 * enumeration the handlers withhold.
+                 */
+                return Response.sendErrorResponse(req, res, new TooManyRequestsException("Too many sign-in attempts. Please try again later."));
+            }
+            if (decision.outcome === IdentityRateLimitOutcome.CounterUnavailable) {
+                /*
+                 * Fails closed. See the note at the top of this file: the counter is
+                 * the only thing bounding guesses on these routes, and a login cannot
+                 * complete without Redis anyway.
+                 */
+                if (IdentityRateLimit.shouldLogCounterUnavailable(bucket)) {
+                    logger.error(`IdentityRateLimit: rate limit counter unavailable, refusing ${bucket} attempts`);
+                }
+                return Response.sendErrorResponse(req, res, new ServiceUnavailableException("Unable to sign you in right now. Please try again shortly."));
+            }
+            return next();
+        };
+    }
+    /*
+     * A Redis outage means EVERY request takes the unavailable path, so an
+     * unguarded log line there is one per request for as long as the outage
+     * lasts -- the same log-flooding problem the crossing-only rejection log
+     * avoids, but continuous. One line per bucket per interval is enough to
+     * make the condition visible without burying everything else.
+     */
+    static shouldLogCounterUnavailable(bucket) {
+        const now = Date.now();
+        const lastLoggedAt = IdentityRateLimit.counterUnavailableLastLoggedAt.get(bucket) || 0;
+        if (now - lastLoggedAt < COUNTER_UNAVAILABLE_LOG_INTERVAL_MS) {
+            return false;
+        }
+        IdentityRateLimit.counterUnavailableLastLoggedAt.set(bucket, now);
+        return true;
+    }
+    static setRetryAfterHeader(res, retryAfterSeconds) {
+        const setHeader = res["setHeader"];
+        if (typeof setHeader === "function") {
+            setHeader.call(res, "Retry-After", String(retryAfterSeconds));
+        }
+    }
+}
+IdentityRateLimit.counterUnavailableLastLoggedAt = new Map();
+export default IdentityRateLimit;
+//# sourceMappingURL=IdentityRateLimit.js.map

package/build/dist/Server/Middleware/IdentityRateLimit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"IdentityRateLimit.js","sourceRoot":"","sources":["../../../../Server/Middleware/IdentityRateLimit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAqB,MAAM,yBAAyB,CAAC;AAM5D,OAAO,MAAM,MAAM,iBAAiB,CAAC;AACrC,OAAO,sBAA+C,MAAM,mBAAmB,CAAC;AAChF,OAAO,QAAQ,MAAM,mBAAmB,CAAC;AACzC,OAAO,2BAA2B,MAAM,mDAAmD,CAAC;AAC5F,OAAO,wBAAwB,MAAM,gDAAgD,CAAC;AAEtF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAN,IAAY,uBAUX;AAVD,WAAY,uBAAuB;IACjC,qCAAqC;IACrC,0CAAe,CAAA;IAEf;;;;OAIG;IACH,mDAAwB,CAAA;AAC1B,CAAC,EAVW,uBAAuB,KAAvB,uBAAuB,QAUlC;AAED,MAAM,CAAN,IAAY,sBAMX;AAND,WAAY,sBAAsB;IAChC,iDAAiD;IACjD,6CAAmB,CAAA;IAEnB,wEAAwE;IACxE,mCAAS,CAAA;AACX,CAAC,EANW,sBAAsB,KAAtB,sBAAsB,QAMjC;AAED,MAAM,CAAN,IAAY,wBAMX;AAND,WAAY,wBAAwB;IAClC,+CAAmB,CAAA;IACnB,wDAA4B,CAAA;IAE5B,mEAAmE;IACnE,sEAA0C,CAAA;AAC5C,CAAC,EANW,wBAAwB,KAAxB,wBAAwB,QAMnC;AAoBD,MAAM,uBAAuB,GAAiD,CAC5E,MAAc,EACd,QAAgB,EACR,EAAE;IACV,MAAM,QAAQ,GAAuB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAEzD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,WAAW,GAAW,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAEnD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,WAAW,IAAI,CAAC,EAAE,CAAC;QACtD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC,CAAC;AAQF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,YAAY,GAAiB;IACjC,aAAa,EAAE,uBAAuB,CACpC,0CAA0C,EAC1C,EAAE,GAAG,EAAE,CACR;IACD,eAAe,EAAE,uBAAuB,CACtC,kDAAkD,EAClD,EAAE,CACH;IACD,UAAU,EAAE,uBAAuB,CACjC,6CAA6C,EAC7C,GAAG,CACJ;CACF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,iBAAiB,GAAiB;IACtC,aAAa,EAAE,uBAAuB,CACpC,+CAA+C,EAC/C,EAAE,GAAG,EAAE,CACR;IACD,eAAe,EAAE,uBAAuB,CACtC,uDAAuD,EACvD,EAAE,CACH;IACD,UAAU,EAAE,uBAAuB,CACjC,kDAAkD,EAClD,GAAG,CACJ;CACF,CAAC;AAEF,MAAM,UAAU,GAAW,cAAc,CAAC;AAE1C;;;GAGG;AACH,MAAM,cAAc,GAAW,CAAC,CAAC;AAEjC,2DAA2D;AAC3D,MAAM,sBAAsB,GAAW,EAAE,CAAC;AAE1C,8EAA8E;AAC9E,MAAM,mCAAmC,GAAW,EAAE,GAAG,IAAI,CAAC;AAE9D,MAAqB,iBAAiB;IACpC;;;;;;;;;;;;;OAaG;IACI,MAAM,CAAC,eAAe,CAAC,GAAmB;QAC/C,MAAM,QAAQ,GAAuB,sBAAsB,CACzD,GAAqC,CACtC,CAAC;QAEF,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,iBAAiB,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACxD,CAAC;QAED;;;;WAIG;QACH,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+CG;IACI,MAAM,CAAC,iBAAiB,CAAC,GAAmB;;QACjD,MAAM,IAAI,GAAwC,GAAG,CAAC,IAEzC,CAAC;QAEd,MAAM,IAAI,GACR,IAAI,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI;YAC/D,CAAC,CAAE,IAAI,CAAC,MAAM,CAA6B;YAC3C,CAAC,CAAC,SAAS,CAAC;QAEhB,MAAM,KAAK,GAAY,MAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAG,OAAO,CAAC,mCAAI,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAG,OAAO,CAAC,CAAC;QAE1D;;;;WAIG;QACH,MAAM,GAAG,GACP,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YACzD,CAAC,CAAE,KAAiC,CAAC,OAAO,CAAC;YAC7C,CAAC,CAAC,KAAK,CAAC;QAEZ;;;;WAIG;QACH,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvD,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,OAAO,iBAAiB,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IACxE,CAAC;IAEO,MAAM,CAAC,kBAAkB,CAAC,KAAa;QAC7C,OAAO,CACL,KAAK;aACF,KAAK,CAAC,CAAC,EAAE,sBAAsB,CAAC;YACjC;;;eAGG;aACF,OAAO,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAC3C,CAAC;IACJ,CAAC;IAEM,MAAM,CAAC,eAAe,CAAC,MAA+B;QAC3D,OAAO,MAAM,KAAK,uBAAuB,CAAC,SAAS;YACjD,CAAC,CAAC,iBAAiB;YACnB,CAAC,CAAC,YAAY,CAAC;IACnB,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAI3B;QACC,MAAM,MAAM,GAAsB,KAAK,CAAC,SAAS,EAAE,CAAC;QAEpD,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACpC,OAAO,EAAE,OAAO,EAAE,wBAAwB,CAAC,kBAAkB,EAAE,CAAC;QAClE,CAAC;QAED,MAAM,MAAM,GAAiB,iBAAiB,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAE5E,MAAM,QAAQ,GAAW,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC;QACrD,MAAM,WAAW,GAAW,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,CAAC;QAE9D,MAAM,iBAAiB,GAAW,GAAG,UAAU,GAAG,IAAI,CAAC,MAAM,MAAM,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,QAAQ,IAAI,WAAW,EAAE,CAAC;QACrH,MAAM,YAAY,GAAW,GAAG,UAAU,GAAG,IAAI,CAAC,MAAM,MAAM,IAAI,CAAC,QAAQ,IAAI,WAAW,EAAE,CAAC;QAE7F,IAAI,CAAC;YACH,MAAM,eAAe,GACnB,CAAC,MAAM,MAAM;iBACV,QAAQ,EAAE;iBACV,IAAI,CAAC,iBAAiB,CAAC;iBACvB,IAAI,CAAC,YAAY,CAAC;iBAClB,IAAI,EAAE,CAA0C,CAAC;YAEtD,IAAI,CAAC,eAAe,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;YAC5D,CAAC;YAED,MAAM,YAAY,GAAW,iBAAiB,CAAC,iBAAiB,CAC9D,eAAe,CAAC,CAAC,CAAC,CACnB,CAAC;YACF,MAAM,OAAO,GAAW,iBAAiB,CAAC,iBAAiB,CACzD,eAAe,CAAC,CAAC,CAAC,CACnB,CAAC;YAEF;;;;;;eAMG;YACH,MAAM,UAAU,GAAW,MAAM,CAAC,aAAa,GAAG,cAAc,CAAC;YACjE,MAAM,YAAY,GAAkB,EAAE,CAAC;YAEvC,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;gBACvB,YAAY,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YACvC,CAAC;YAED,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;gBAClB,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAClC,CAAC;YAED,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5B,MAAM,cAAc,GAClB,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAEpB,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;oBAC/B,cAAc,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;gBACzC,CAAC;gBAED,MAAM,cAAc,CAAC,IAAI,EAAE,CAAC;YAC9B,CAAC;YAED,MAAM,iBAAiB,GACrB,iBAAiB,CAAC,wBAAwB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YAEnE;;;;eAIG;YACH,IAAI,YAAY,GAAG,MAAM,CAAC,eAAe,EAAE,CAAC;gBAC1C,OAAO;oBACL,OAAO,EAAE,wBAAwB,CAAC,WAAW;oBAC7C,iBAAiB;oBACjB,KAAK,EAAE,sBAAsB,CAAC,OAAO;oBACrC,wBAAwB,EAAE,YAAY,KAAK,MAAM,CAAC,eAAe,GAAG,CAAC;iBACtE,CAAC;YACJ,CAAC;YAED,IAAI,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;gBAChC,OAAO;oBACL,OAAO,EAAE,wBAAwB,CAAC,WAAW;oBAC7C,iBAAiB;oBACjB,KAAK,EAAE,sBAAsB,CAAC,EAAE;oBAChC,wBAAwB,EAAE,OAAO,KAAK,MAAM,CAAC,UAAU,GAAG,CAAC;iBAC5D,CAAC;YACJ,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,wBAAwB,CAAC,OAAO,EAAE,CAAC;QACvD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb;;;;eAIG;YACH,IAAI,iBAAiB,CAAC,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC/D,MAAM,CAAC,IAAI,CACT,yCAAyC,IAAI,CAAC,MAAM,iBAAiB,IAAI,CAAC,QAAQ,EAAE,CACrF,CAAC;gBACF,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,wBAAwB,CAAC,kBAAkB,EAAE,CAAC;QAClE,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,iBAAiB,CAC9B,MAA2C;QAE3C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,CAAC;QAE9B,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,KAAK,CAAC;QACd,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IACK,MAAM,CAAC,wBAAwB,CAAC,aAAqB;QAC3D,MAAM,QAAQ,GAAW,aAAa,GAAG,IAAI,CAAC;QAC9C,MAAM,YAAY,GAAW,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC;QAEnD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,GAAG,YAAY,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IAClE,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,aAAa,CACzB,MAA+B;QAM/B,OAAO,KAAK,EACV,GAAmB,EACnB,GAAoB,EACpB,IAAkB,EACH,EAAE;YACjB,MAAM,UAAU,GAAW,iBAAiB,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;YACpE,MAAM,QAAQ,GAAW,iBAAiB,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;YAEhE,MAAM,QAAQ,GACZ,MAAM,iBAAiB,CAAC,OAAO,CAAC;gBAC9B,UAAU;gBACV,QAAQ;gBACR,MAAM;aACP,CAAC,CAAC;YAEL,IAAI,QAAQ,CAAC,OAAO,KAAK,wBAAwB,CAAC,WAAW,EAAE,CAAC;gBAC9D,IAAI,QAAQ,CAAC,iBAAiB,EAAE,CAAC;oBAC/B,iBAAiB,CAAC,mBAAmB,CACnC,GAAG,EACH,QAAQ,CAAC,iBAAiB,CAC3B,CAAC;gBACJ,CAAC;gBAED,IAAI,QAAQ,CAAC,wBAAwB,EAAE,CAAC;oBACtC,MAAM,CAAC,IAAI,CACT,+BAA+B,MAAM,gBAAgB,UAAU,SAAS,QAAQ,KAAK,QAAQ,CAAC,KAAK,SAAS,CAC7G,CAAC;gBACJ,CAAC;gBAED;;;;;;mBAMG;gBACH,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,wBAAwB,CAC1B,oDAAoD,CACrD,CACF,CAAC;YACJ,CAAC;YAED,IAAI,QAAQ,CAAC,OAAO,KAAK,wBAAwB,CAAC,kBAAkB,EAAE,CAAC;gBACrE;;;;mBAIG;gBACH,IAAI,iBAAiB,CAAC,2BAA2B,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC1D,MAAM,CAAC,KAAK,CACV,+DAA+D,MAAM,WAAW,CACjF,CAAC;gBACJ,CAAC;gBAED,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,2BAA2B,CAC7B,4DAA4D,CAC7D,CACF,CAAC;YACJ,CAAC;YAED,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,2BAA2B,CACxC,MAA+B;QAE/B,MAAM,GAAG,GAAW,IAAI,CAAC,GAAG,EAAE,CAAC;QAC/B,MAAM,YAAY,GAChB,iBAAiB,CAAC,8BAA8B,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAEpE,IAAI,GAAG,GAAG,YAAY,GAAG,mCAAmC,EAAE,CAAC;YAC7D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,iBAAiB,CAAC,8BAA8B,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAElE,OAAO,IAAI,CAAC;IACd,CAAC;IAOO,MAAM,CAAC,mBAAmB,CAChC,GAAoB,EACpB,iBAAyB;QAEzB,MAAM,SAAS,GAAa,GAA0C,CACpE,WAAW,CACZ,CAAC;QAEF,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;YACnC,SAAmD,CAAC,IAAI,CACvD,GAAG,EACH,aAAa,EACb,MAAM,CAAC,iBAAiB,CAAC,CAC1B,CAAC;QACJ,CAAC;IACH,CAAC;;AApBc,gDAA8B,GAGzC,IAAI,GAAG,EAAE,CAAC;eAtYK,iBAAiB"}

package/build/dist/Server/Middleware/SlackAuthorization.js

@@ -13,6 +13,17 @@ import { SlackAppSigningSecret } from "../EnvironmentConfig";
 import crypto from "crypto";
 import logger, { getLogAttributesFromRequest } from "../Utils/Logger";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+/*
+ * Slack sends the digest as "v0=" followed by the 64 hex characters of a
+ * SHA-256 HMAC. Same reasoning as WhatsAppAuthorization: the header is
+ * attacker-controlled on an endpoint whose only authentication IS the
+ * signature, and crypto.timingSafeEqual throws RangeError on a length
+ * mismatch instead of returning false, so the shape is validated before the
+ * comparison. A missing header is covered by the same check - it used to
+ * reach Buffer.from(undefined) and throw a TypeError.
+ */
+const SIGNATURE_PREFIX = "v0=";
+const HEX_DIGEST_REGEX = /^[a-f0-9]{64}$/i;
 export default class SlackAuthorization {
     static async isAuthorizedSlackRequest(req, res, next) {
         logger.debug("Starting Slack request authorization", getLogAttributesFromRequest(req));
@@ -32,11 +43,24 @@ export default class SlackAuthorization {
         logger.debug(`timestamp: ${timestamp}`, getLogAttributesFromRequest(req));
         logger.debug(`requestBody: `, getLogAttributesFromRequest(req));
         logger.debug(requestBody, getLogAttributesFromRequest(req));
+        const providedDigest = slackSignature && slackSignature.startsWith(SIGNATURE_PREFIX)
+            ? slackSignature.slice(SIGNATURE_PREFIX.length)
+            : "";
+        if (!HEX_DIGEST_REGEX.test(providedDigest)) {
+            logger.error("Slack request has a missing or malformed X-Slack-Signature header.", getLogAttributesFromRequest(req));
+            return Response.sendErrorResponse(req, res, new BadDataException("Slack Signature Verification Failed."));
+        }
         const baseString = `v0:${timestamp}:${requestBody}`;
-        const signature = `v0=${crypto.createHmac("sha256", slackSigningSecret).update(baseString).digest("hex")}`;
-        logger.debug(`Generated signature: ${signature}`, getLogAttributesFromRequest(req));
-        // check if the signature is valid
-        if (!crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(slackSignature))) {
+        const expectedDigest = crypto
+            .createHmac("sha256", slackSigningSecret)
+            .update(baseString)
+            .digest("hex");
+        logger.debug(`Generated signature: ${SIGNATURE_PREFIX}${expectedDigest}`, getLogAttributesFromRequest(req));
+        /*
+         * Both sides are decoded from 64 validated hex characters, so both
+         * buffers are 32 bytes and timingSafeEqual cannot throw here.
+         */
+        if (!crypto.timingSafeEqual(Buffer.from(expectedDigest, "hex"), Buffer.from(providedDigest, "hex"))) {
             logger.error("Slack Signature Verification Failed.", getLogAttributesFromRequest(req));
             return Response.sendErrorResponse(req, res, new BadDataException("Slack Signature Verification Failed."));
         }

package/build/dist/Server/Middleware/SlackAuthorization.js.map

@@ -1 +1 @@
-{"version":3,"file":"SlackAuthorization.js","sourceRoot":"","sources":["../../../../Server/Middleware/SlackAuthorization.ts"],"names":[],"mappings":";;;;;;;;;AAKA,OAAO,QAAQ,MAAM,mBAAmB,CAAC;AACzC,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,MAAM,EAAE,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,WAAW,MAAM,gCAAgC,CAAC;AAEzD,MAAM,CAAC,OAAO,OAAO,kBAAkB;IAEjB,AAAb,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAC1C,GAAqB,EACrB,GAAoB,EACpB,IAAkB;QAElB,MAAM,CAAC,KAAK,CACV,sCAAsC,EACtC,2BAA2B,CAAC,GAAG,CAAC,CACjC,CAAC;QAEF,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC3B,MAAM,CAAC,KAAK,CACV,kDAAkD,EAClD,2BAA2B,CAAC,GAAG,CAAC,CACjC,CAAC;YACF,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAClB,kDAAkD,CACnD,CACF,CAAC;QACJ,CAAC;QAED,gCAAgC;QAChC,MAAM,kBAAkB,GAAW,qBAAqB,CAAC,QAAQ,EAAE,CAAC;QAEpE,MAAM,cAAc,GAAW,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAW,CAAC;QAC1E,MAAM,SAAS,GAAW,GAAG,CAAC,OAAO,CACnC,2BAA2B,CAClB,CAAC;QACZ,mHAAmH;QACnH,MAAM,WAAW,GACd,GAAwB,CAAC,OAAO;YAChC,GAAwB,CAAC,qBAAqB;YAC/C,EAAE,CAAC;QAEL,MAAM,CAAC,KAAK,CACV,mBAAmB,cAAc,EAAE,EACnC,2BAA2B,CAAC,GAAG,CAAC,CACjC,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,cAAc,SAAS,EAAE,EAAE,2BAA2B,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1E,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,2BAA2B,CAAC,GAAG,CAAC,CAAC,CAAC;QAChE,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,2BAA2B,CAAC,GAAG,CAAC,CAAC,CAAC;QAE5D,MAAM,UAAU,GAAW,MAAM,SAAS,IAAI,WAAW,EAAE,CAAC;QAC5D,MAAM,SAAS,GAAW,MAAM,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAEnH,MAAM,CAAC,KAAK,CACV,wBAAwB,SAAS,EAAE,EACnC,2BAA2B,CAAC,GAAG,CAAC,CACjC,CAAC;QAEF,kCAAkC;QAClC,IACE,CAAC,MAAM,CAAC,eAAe,CACrB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAe,EACpC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAe,CAC1C,EACD,CAAC;YACD,MAAM,CAAC,KAAK,CACV,sCAAsC,EACtC,2BAA2B,CAAC,GAAG,CAAC,CACjC,CAAC;YACF,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,sCAAsC,CAAC,CAC7D,CAAC;QACJ,CAAC;QAED,MAAM,CAAC,KAAK,CACV,uCAAuC,EACvC,2BAA2B,CAAC,GAAG,CAAC,CACjC,CAAC;QACF,IAAI,EAAE,CAAC;IACT,CAAC;CACF;AA7EqB;IADnB,WAAW,EAAE;;;;wDA6Eb"}
+{"version":3,"file":"SlackAuthorization.js","sourceRoot":"","sources":["../../../../Server/Middleware/SlackAuthorization.ts"],"names":[],"mappings":";;;;;;;;;AAKA,OAAO,QAAQ,MAAM,mBAAmB,CAAC;AACzC,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,MAAM,EAAE,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,WAAW,MAAM,gCAAgC,CAAC;AAEzD;;;;;;;;GAQG;AACH,MAAM,gBAAgB,GAAW,KAAK,CAAC;AACvC,MAAM,gBAAgB,GAAW,iBAAiB,CAAC;AAEnD,MAAM,CAAC,OAAO,OAAO,kBAAkB;IAEjB,AAAb,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAC1C,GAAqB,EACrB,GAAoB,EACpB,IAAkB;QAElB,MAAM,CAAC,KAAK,CACV,sCAAsC,EACtC,2BAA2B,CAAC,GAAG,CAAC,CACjC,CAAC;QAEF,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC3B,MAAM,CAAC,KAAK,CACV,kDAAkD,EAClD,2BAA2B,CAAC,GAAG,CAAC,CACjC,CAAC;YACF,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAClB,kDAAkD,CACnD,CACF,CAAC;QACJ,CAAC;QAED,gCAAgC;QAChC,MAAM,kBAAkB,GAAW,qBAAqB,CAAC,QAAQ,EAAE,CAAC;QAEpE,MAAM,cAAc,GAAuB,GAAG,CAAC,OAAO,CACpD,mBAAmB,CACE,CAAC;QACxB,MAAM,SAAS,GAAW,GAAG,CAAC,OAAO,CACnC,2BAA2B,CAClB,CAAC;QACZ,mHAAmH;QACnH,MAAM,WAAW,GACd,GAAwB,CAAC,OAAO;YAChC,GAAwB,CAAC,qBAAqB;YAC/C,EAAE,CAAC;QAEL,MAAM,CAAC,KAAK,CACV,mBAAmB,cAAc,EAAE,EACnC,2BAA2B,CAAC,GAAG,CAAC,CACjC,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,cAAc,SAAS,EAAE,EAAE,2BAA2B,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1E,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,2BAA2B,CAAC,GAAG,CAAC,CAAC,CAAC;QAChE,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,2BAA2B,CAAC,GAAG,CAAC,CAAC,CAAC;QAE5D,MAAM,cAAc,GAClB,cAAc,IAAI,cAAc,CAAC,UAAU,CAAC,gBAAgB,CAAC;YAC3D,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC;YAC/C,CAAC,CAAC,EAAE,CAAC;QAET,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;YAC3C,MAAM,CAAC,KAAK,CACV,oEAAoE,EACpE,2BAA2B,CAAC,GAAG,CAAC,CACjC,CAAC;YACF,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,sCAAsC,CAAC,CAC7D,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAW,MAAM,SAAS,IAAI,WAAW,EAAE,CAAC;QAC5D,MAAM,cAAc,GAAW,MAAM;aAClC,UAAU,CAAC,QAAQ,EAAE,kBAAkB,CAAC;aACxC,MAAM,CAAC,UAAU,CAAC;aAClB,MAAM,CAAC,KAAK,CAAC,CAAC;QAEjB,MAAM,CAAC,KAAK,CACV,wBAAwB,gBAAgB,GAAG,cAAc,EAAE,EAC3D,2BAA2B,CAAC,GAAG,CAAC,CACjC,CAAC;QAEF;;;WAGG;QACH,IACE,CAAC,MAAM,CAAC,eAAe,CACrB,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAe,EAChD,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAe,CACjD,EACD,CAAC;YACD,MAAM,CAAC,KAAK,CACV,sCAAsC,EACtC,2BAA2B,CAAC,GAAG,CAAC,CACjC,CAAC;YACF,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,gBAAgB,CAAC,sCAAsC,CAAC,CAC7D,CAAC;QACJ,CAAC;QAED,MAAM,CAAC,KAAK,CACV,uCAAuC,EACvC,2BAA2B,CAAC,GAAG,CAAC,CACjC,CAAC;QACF,IAAI,EAAE,CAAC;IACT,CAAC;CACF;AAtGqB;IADnB,WAAW,EAAE;;;;wDAsGb"}