@oneuptime/common 12.0.5 → 12.0.7

package/build/dist/Server/API/ProjectAPI.js

@@ -8,6 +8,7 @@ import QueryHelper from "../Types/Database/QueryHelper";
 import JSONWebToken from "../Utils/JsonWebToken";
 import Response from "../Utils/Response";
 import BaseAPI from "./BaseAPI";
+import CommonAPI from "./CommonAPI";
 import BillingService from "../Services/BillingService";
 import Errors from "../Utils/Errors";
 import { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
@@ -17,10 +18,17 @@ import Project from "../../Models/DatabaseModels/Project";
 import BadDataException from "../../Types/Exception/BadDataException";
 import OneUptimeDate from "../../Types/Date";
 import Permission from "../../Types/Permission";
+import ProjectBalanceType from "../../Types/Billing/ProjectBalanceType";
+import BalanceAdjustmentType from "../../Types/Billing/BalanceAdjustmentType";
 import ObjectID from "../../Types/ObjectID";
+/*
+ * The reason is free text a customer types into the delete confirmation. The
+ * column is unbounded text, so the cap is here.
+ */
+export const MAX_DELETION_REASON_LENGTH = 5000;
 export default class ProjectAPI extends BaseAPI {
     constructor() {
-        var _a, _b, _c;
+        var _a, _b, _c, _d, _e;
         super(Project, ProjectService);
         this.router.put(`${(_a = new this.entityType().getCrudApiPath()) === null || _a === void 0 ? void 0 : _a.toString()}/:id/change-plan`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
             var _a;
@@ -87,13 +95,69 @@ export default class ProjectAPI extends BaseAPI {
                 next(err);
             }
         });
+        /*
+         * Deletes a project, carrying the reason the customer gave for deleting it.
+         * The plain DELETE /project/:id route still works and still records the
+         * deletion - this one exists only because a DELETE has nowhere to put the
+         * answer to "why are you deleting this project?".
+         *
+         * The delete itself goes through deleteOneById with the caller's own props,
+         * so ModelPermission enforces ProjectOwner / DeleteProject exactly as it
+         * does on the plain route.
+         */
+        this.router.post(`${(_b = new this.entityType().getCrudApiPath()) === null || _b === void 0 ? void 0 : _b.toString()}/:id/delete-project`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
+            try {
+                const idParam = req.params["id"];
+                ObjectID.validateUUID(idParam);
+                const projectId = new ObjectID(idParam);
+                /*
+                 * Same guard as change-plan: permissions are resolved for the
+                 * authenticated tenant, so the project in the URL has to be that
+                 * tenant or permissions on one project would authorize deleting
+                 * another.
+                 */
+                const tenantId = this.getTenantId(req);
+                if (!tenantId || tenantId.toString() !== projectId.toString()) {
+                    throw new BadDataException("Project ID in the URL does not match the project the request is authenticated for");
+                }
+                const body = req.body || {};
+                const data = body["data"] || {};
+                const deletionReasonValue = data["deletionReason"];
+                let deletionReason = undefined;
+                if (typeof deletionReasonValue === "string") {
+                    /*
+                     * Free text from a form field. Bound what a client can store, and
+                     * drop NUL bytes: Postgres rejects them in a text column, and the
+                     * write that fails here is the audit record of a project that has
+                     * already been deleted - there is no second chance at it.
+                     */
+                    const cleaned = deletionReasonValue
+                        // eslint-disable-next-line no-control-regex
+                        .replace(/\u0000/g, "")
+                        .trim()
+                        .substring(0, MAX_DELETION_REASON_LENGTH);
+                    if (cleaned) {
+                        deletionReason = cleaned;
+                    }
+                }
+                await ProjectService.deleteOneById({
+                    id: projectId,
+                    deletionReason: deletionReason,
+                    props: await CommonAPI.getDatabaseCommonInteractionProps(req),
+                });
+                return Response.sendEmptySuccessResponse(req, res);
+            }
+            catch (err) {
+                next(err);
+            }
+        });
         /*
          * Extends a project's trial. Master-admin only: this hands out free
          * service and moves the customer's next invoice, so it is deliberately not
          * reachable with project-level billing permissions - only OneUptime staff
          * acting from the Admin Dashboard can call it.
          */
-        this.router.put(`${(_b = new this.entityType().getCrudApiPath()) === null || _b === void 0 ? void 0 : _b.toString()}/:id/extend-trial`, MasterAdminAuthorization.isAuthorizedMasterAdminMiddleware, async (req, res, next) => {
+        this.router.put(`${(_c = new this.entityType().getCrudApiPath()) === null || _c === void 0 ? void 0 : _c.toString()}/:id/extend-trial`, MasterAdminAuthorization.isAuthorizedMasterAdminMiddleware, async (req, res, next) => {
             try {
                 if (!IsBillingEnabled) {
                     throw new BadDataException("Billing is not enabled for this server");
@@ -143,12 +207,101 @@ export default class ProjectAPI extends BaseAPI {
                 next(err);
             }
         });
+        /*
+         * Manually corrects a project's SMS/Call or AI balance. Master-admin only,
+         * for the same reason extend-trial is: it hands out (or claws back) paid
+         * service with no payment behind it, so project-level billing permissions
+         * must not reach it - only OneUptime staff acting from the Admin
+         * Dashboard.
+         */
+        this.router.put(`${(_d = new this.entityType().getCrudApiPath()) === null || _d === void 0 ? void 0 : _d.toString()}/:id/adjust-balance`, MasterAdminAuthorization.isAuthorizedMasterAdminMiddleware, async (req, res, next) => {
+            try {
+                if (!IsBillingEnabled) {
+                    throw new BadDataException("Billing is not enabled for this server");
+                }
+                const projectId = new ObjectID(req.params["id"]);
+                const body = req.body || {};
+                const data = body["data"] || {};
+                const balanceTypeValue = data["balanceType"];
+                const adjustmentTypeValue = data["adjustmentType"];
+                const amountInUSDValue = data["amountInUSD"];
+                const reasonValue = data["reason"];
+                if (!balanceTypeValue ||
+                    typeof balanceTypeValue !== "string" ||
+                    !Object.values(ProjectBalanceType).includes(balanceTypeValue)) {
+                    throw new BadDataException(`Balance type must be one of: ${Object.values(ProjectBalanceType).join(", ")}`);
+                }
+                if (!adjustmentTypeValue ||
+                    typeof adjustmentTypeValue !== "string" ||
+                    !Object.values(BalanceAdjustmentType).includes(adjustmentTypeValue)) {
+                    throw new BadDataException(`Adjustment type must be one of: ${Object.values(BalanceAdjustmentType).join(", ")}`);
+                }
+                /*
+                 * The form posts dollars because that is what staff think in, but
+                 * the column is cents. A JSON body can carry a numeric string, so
+                 * accept both and reject anything that does not parse - Number("")
+                 * and Number([]) are 0, which would otherwise read as a real
+                 * "set to zero" instruction.
+                 */
+                if (typeof amountInUSDValue !== "number" &&
+                    typeof amountInUSDValue !== "string") {
+                    throw new BadDataException("Amount is not a valid number");
+                }
+                const amountInUSD = typeof amountInUSDValue === "number"
+                    ? amountInUSDValue
+                    : Number(amountInUSDValue.trim());
+                if (!Number.isFinite(amountInUSD) ||
+                    (typeof amountInUSDValue === "string" &&
+                        amountInUSDValue.trim() === "")) {
+                    throw new BadDataException("Amount is not a valid number");
+                }
+                if (typeof reasonValue !== "string" || !reasonValue.trim()) {
+                    throw new BadDataException("A reason is required to adjust the balance");
+                }
+                /*
+                 * Dollars carry at most two decimal places, and floating point
+                 * multiplication does not (20.15 * 100 is 2014.9999...). Round to
+                 * the nearest cent so the stored amount is the one that was typed.
+                 */
+                const amountInUSDCents = Math.round(amountInUSD * 100);
+                /*
+                 * The master admin middleware verifies the token but does not put
+                 * the decoded payload on the request, so read it again here - who
+                 * moved the balance is the only audit trail this action has.
+                 */
+                let adjustedByUserId = undefined;
+                try {
+                    const accessToken = UserMiddleware.getAccessTokenFromExpressRequest(req);
+                    if (accessToken) {
+                        adjustedByUserId = JSONWebToken.decode(accessToken).userId;
+                    }
+                }
+                catch (_a) {
+                    // Only used for the log line - never block the adjustment on it.
+                }
+                const result = await ProjectService.adjustBalance({
+                    projectId: projectId,
+                    balanceType: balanceTypeValue,
+                    adjustmentType: adjustmentTypeValue,
+                    amountInUSDCents: amountInUSDCents,
+                    reason: reasonValue,
+                    adjustedByUserId: adjustedByUserId,
+                });
+                return Response.sendJsonObjectResponse(req, res, {
+                    previousBalanceInUSDCents: result.previousBalanceInUSDCents,
+                    newBalanceInUSDCents: result.newBalanceInUSDCents,
+                });
+            }
+            catch (err) {
+                next(err);
+            }
+        });
         /*
          * This API lists all the projects where user is its team member.
          * This API is usually used to show project selector dropdown in the UI
          */
-        this.router.post(`${(_c = new this.entityType()
-            .getCrudApiPath()) === null || _c === void 0 ? void 0 : _c.toString()}/list-user-projects`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
+        this.router.post(`${(_e = new this.entityType()
+            .getCrudApiPath()) === null || _e === void 0 ? void 0 : _e.toString()}/list-user-projects`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
             var _a, _b;
             try {
                 if (!((_a = req.userAuthorization) === null || _a === void 0 ? void 0 : _a.userId)) {

package/build/dist/Server/API/ProjectAPI.js.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectAPI.js","sourceRoot":"","sources":["../../../../Server/API/ProjectAPI.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,wBAAwB,MAAM,wCAAwC,CAAC;AAC9E,OAAO,cAAc,MAAM,iCAAiC,CAAC;AAC7D,OAAO,cAEN,MAAM,4BAA4B,CAAC;AACpC,OAAO,eAAe,MAAM,6BAA6B,CAAC;AAC1D,OAAO,iBAAiB,MAAM,+BAA+B,CAAC;AAC9D,OAAO,WAAW,MAAM,+BAA+B,CAAC;AAQxD,OAAO,YAAY,MAAM,uBAAuB,CAAC;AACjD,OAAO,QAAQ,MAAM,mBAAmB,CAAC;AACzC,OAAO,OAAO,MAAM,WAAW,CAAC;AAChC,OAAO,cAAc,MAAM,4BAA4B,CAAC;AACxD,OAAO,MAAM,MAAM,iBAAiB,CAAC;AACrC,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,yBAAyB,MAAM,iDAAiD,CAAC;AACxF,OAAO,cAAc,MAAM,4BAA4B,CAAC;AACxD,OAAO,OAAO,MAAM,qCAAqC,CAAC;AAG1D,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AACtE,OAAO,aAAa,MAAM,kBAAkB,CAAC;AAC7C,OAAO,UAA8B,MAAM,wBAAwB,CAAC;AACpE,OAAO,QAAQ,MAAM,sBAAsB,CAAC;AAG5C,MAAM,CAAC,OAAO,OAAO,UAAW,SAAQ,OAAoC;IAC1E;;QACE,KAAK,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAE/B,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,GAAG,MAAA,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC,cAAc,EAAE,0CAAE,QAAQ,EAAE,kBAAkB,EACvE,cAAc,CAAC,iBAAiB,EAChC,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;;YACtE,IAAI,CAAC;gBACH,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACtB,MAAM,IAAI,gBAAgB,CACxB,wCAAwC,CACzC,CAAC;gBACJ,CAAC;gBAED,MAAM,SAAS,GAAa,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAW,CAAC,CAAC;gBAErE;;;;;;mBAMG;gBACH,MAAM,QAAQ,GAAoB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;gBAExD,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,EAAE,KAAK,SAAS,CAAC,QAAQ,EAAE,EAAE,CAAC;oBAC9D,MAAM,IAAI,gBAAgB,CACxB,mFAAmF,CACpF,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,GAAgB,GAAG,CAAC,IAAmB,IAAI,EAAE,CAAC;gBACxD,MAAM,IAAI,GAAgB,IAAI,CAAC,MAAM,CAAgB,IAAI,EAAE,CAAC;gBAC5D,MAAM,qBAAqB,GAAuB,IAAI,CACpD,uBAAuB,CACF,CAAC;gBAExB,IAAI,CAAC,qBAAqB,EAAE,CAAC;oBAC3B,MAAM,IAAI,gBAAgB,CAAC,oCAAoC,CAAC,CAAC;gBACnE,CAAC;gBAED,qEAAqE;gBACrE,MAAM,OAAO,GAAmB,MAAM,cAAc,CAAC,WAAW,CAAC;oBAC/D,EAAE,EAAE,SAAS;oBACb,MAAM,EAAE;wBACN,yBAAyB,EAAE,IAAI;qBAChC;oBACD,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;iBACF,CAAC,CAAC;gBAEH,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,IAAI,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;gBAClD,CAAC;gBAED,IAAI,CAAC,OAAO,CAAC,yBAAyB,EAAE,CAAC;oBACvC,MAAM,IAAI,gBAAgB,CAAC,qCAAqC,CAAC,CAAC;gBACpE,CAAC;gBAED,MAAM,iBAAiB,GACrB,MAAM,cAAc,CAAC,iBAAiB,CACpC,OAAO,CAAC,yBAAyB,CAClC,CAAC;gBAEJ,IAAI,CAAC,iBAAiB,EAAE,CAAC;oBACvB,MAAM,IAAI,gBAAgB,CACxB,MAAM,CAAC,cAAc,CAAC,mBAAmB,CAC1C,CAAC;gBACJ,CAAC;gBAED,MAAM,WAAW,GACf,MAAM,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC;gBAE1C,MAAM,oBAAoB,GACxB,WAAW,CAAC,MAAM,CAAC,CAAC,UAA0B,EAAE,EAAE;oBAChD,OAAO,CACL,UAAU,CAAC,UAAU,CAAC,QAAQ,EAAE;wBAC9B,UAAU,CAAC,YAAY,CAAC,QAAQ,EAAE;wBACpC,UAAU,CAAC,UAAU,CAAC,QAAQ,EAAE;4BAC9B,UAAU,CAAC,oBAAoB,CAAC,QAAQ,EAAE,CAC7C,CAAC;gBACJ,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;gBAEhB,IACE,CAAC,oBAAoB;oBACrB,CAAC,CAAA,MAAC,GAAwB,CAAC,iBAAiB,0CAAE,aAAa,CAAA,EAC3D,CAAC;oBACD,MAAM,IAAI,gBAAgB,CACxB,YAAY,UAAU,CAAC,YAAY,OAAO,UAAU,CAAC,oBAAoB,oCAAoC,CAC9G,CAAC;gBACJ,CAAC;gBAED,MAAM,cAAc,CAAC,UAAU,CAAC;oBAC9B,SAAS,EAAE,SAAS;oBACpB,qBAAqB,EAAE,qBAAqB;iBAC7C,CAAC,CAAC;gBAEH,OAAO,QAAQ,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,CAAC;YACZ,CAAC;QACH,CAAC,CACF,CAAC;QAEF;;;;;WAKG;QACH,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,GAAG,MAAA,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC,cAAc,EAAE,0CAAE,QAAQ,EAAE,mBAAmB,EACxE,wBAAwB,CAAC,iCAAiC,EAC1D,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;YACtE,IAAI,CAAC;gBACH,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACtB,MAAM,IAAI,gBAAgB,CACxB,wCAAwC,CACzC,CAAC;gBACJ,CAAC;gBAED,MAAM,SAAS,GAAa,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAW,CAAC,CAAC;gBAErE,MAAM,IAAI,GAAgB,GAAG,CAAC,IAAmB,IAAI,EAAE,CAAC;gBACxD,MAAM,IAAI,GAAgB,IAAI,CAAC,MAAM,CAAgB,IAAI,EAAE,CAAC;gBAC5D,MAAM,gBAAgB,GAAc,IAAI,CAAC,aAAa,CAAC,CAAC;gBAExD,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACtB,MAAM,IAAI,gBAAgB,CACxB,gDAAgD,CACjD,CAAC;gBACJ,CAAC;gBAED;;;;mBAIG;gBACH,IAAI,OAAO,gBAAgB,KAAK,QAAQ,EAAE,CAAC;oBACzC,MAAM,IAAI,gBAAgB,CAAC,oCAAoC,CAAC,CAAC;gBACnE,CAAC;gBAED,MAAM,WAAW,GAAS,aAAa,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;gBAErE,IAAI,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;oBACjC,MAAM,IAAI,gBAAgB,CAAC,oCAAoC,CAAC,CAAC;gBACnE,CAAC;gBAED;;;;mBAIG;gBACH,IAAI,gBAAgB,GAAyB,SAAS,CAAC;gBAEvD,IAAI,CAAC;oBACH,MAAM,WAAW,GACf,cAAc,CAAC,gCAAgC,CAAC,GAAG,CAAC,CAAC;oBAEvD,IAAI,WAAW,EAAE,CAAC;wBAChB,gBAAgB,GAAG,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC;oBAC7D,CAAC;gBACH,CAAC;gBAAC,WAAM,CAAC;oBACP,gEAAgE;gBAClE,CAAC;gBAED,MAAM,cAAc,CAAC,WAAW,CAAC;oBAC/B,SAAS,EAAE,SAAS;oBACpB,WAAW,EAAE,WAAW;oBACxB,gBAAgB,EAAE,gBAAgB;iBACnC,CAAC,CAAC;gBAEH,OAAO,QAAQ,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,CAAC;YACZ,CAAC;QACH,CAAC,CACF,CAAC;QAEF;;;WAGG;QACH,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,GAAG,MAAA,IAAI,IAAI,CAAC,UAAU,EAAE;aACrB,cAAc,EAAE,0CACf,QAAQ,EAAE,qBAAqB,EACnC,cAAc,CAAC,iBAAiB,EAChC,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;;YACtE,IAAI,CAAC;gBACH,IAAI,CAAC,CAAA,MAAC,GAAwB,CAAC,iBAAiB,0CAAE,MAAM,CAAA,EAAE,CAAC;oBACzD,MAAM,IAAI,yBAAyB,CACjC,6CAA6C,CAC9C,CAAC;gBACJ,CAAC;gBAED,MAAM,aAAa,GAAoB;oBACrC,GAAG,EAAE,IAAI;oBACT,IAAI,EAAE,IAAI;oBACV,WAAW,EAAE,IAAI;oBACjB,qBAAqB,EAAE,IAAI;oBAC3B,UAAU,EAAE,IAAI;oBAChB,iCAAiC,EAAE,IAAI;oBACvC,wCAAwC,EAAE,IAAI;oBAC9C,iCAAiC,EAAE,IAAI;iBACxC,CAAC;gBAEF,MAAM,WAAW,GAAsB,MAAM,iBAAiB,CAAC,MAAM,CACnE;oBACE,KAAK,EAAE;wBACL,MAAM,EAAG,GAAwB,CAAC,iBAAkB,CAAC,MAAO;wBAC5D,qBAAqB,EAAE,IAAI;qBAC5B;oBACD,MAAM,EAAE;wBACN,OAAO,EAAE,aAAa;qBACvB;oBACD,KAAK,EAAE,iBAAiB;oBACxB,IAAI,EAAE,CAAC;oBACP,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;iBACF,CACF,CAAC;gBAEF,MAAM,QAAQ,GAAmB,EAAE,CAAC;gBAEpC,kGAAkG;gBAElG,IACE,gBAAgB;qBAChB,MAAC,GAAwB,CAAC,iBAAiB,0CAAE,aAAa,CAAA,EAC1D,CAAC;oBACD,MAAM,uBAAuB,GAC3B,MAAM,cAAc,CAAC,MAAM,CAAC;wBAC1B,KAAK,EAAE;4BACL,+BAA+B,EAAE,IAAI;yBACtC;wBACD,MAAM,EAAE,aAAa;wBACrB,KAAK,EAAE,iBAAiB;wBACxB,IAAI,EAAE,CAAC;wBACP,KAAK,EAAE;4BACL,MAAM,EAAE,IAAI;yBACb;qBACF,CAAC,CAAC;oBAEL,KAAK,MAAM,sBAAsB,IAAI,uBAAuB,EAAE,CAAC;wBAC7D,IAAI,CAAC,sBAAsB,EAAE,CAAC;4BAC5B,SAAS;wBACX,CAAC;wBAED,IAAI,CAAC,sBAAsB,CAAC,GAAG,EAAE,CAAC;4BAChC,SAAS;wBACX,CAAC;wBAED,IACE,QAAQ,CAAC,SAAS,CAAC,CAAC,OAAgB,EAAE,EAAE;;4BACtC,OAAO,CACL,CAAA,MAAA,OAAO,CAAC,GAAG,0CAAE,QAAQ,EAAE;iCACvB,MAAA,sBAAuB,CAAC,GAAG,0CAAE,QAAQ,EAAE,CAAA,CACxC,CAAC;wBACJ,CAAC,CAAC,KAAK,CAAC,CAAC,EACT,CAAC;4BACD,QAAQ,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;wBACxC,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;oBACrC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;wBACxB,SAAS;oBACX,CAAC;oBAED,IACE,QAAQ,CAAC,SAAS,CAAC,CAAC,OAAgB,EAAE,EAAE;;wBACtC,OAAO,CACL,CAAA,MAAA,OAAO,CAAC,GAAG,0CAAE,QAAQ,EAAE;6BACvB,MAAA,UAAU,CAAC,OAAQ,CAAC,GAAG,0CAAE,QAAQ,EAAE,CAAA,CACpC,CAAC;oBACJ,CAAC,CAAC,KAAK,CAAC,CAAC,EACT,CAAC;wBACD,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,OAAQ,CAAC,CAAC;oBACrC,CAAC;gBACH,CAAC;gBAED;;;mBAGG;gBACH,MAAM,WAAW,GAAoB,EAAE,CAAC;gBACxC,MAAM,eAAe,GAAgB,IAAI,GAAG,EAAU,CAAC;gBACvD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;oBAC/B,IACE,OAAO,CAAC,UAAU;wBAClB,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,EACnD,CAAC;wBACD,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;wBACnD,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;oBACvC,CAAC;gBACH,CAAC;gBAED,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC3B,MAAM,SAAS,GAAoB,MAAM,eAAe,CAAC,MAAM,CAAC;wBAC9D,KAAK,EAAE;4BACL,GAAG,EAAE,WAAW,CAAC,GAAG,CAClB,WAAW,CAAC,GAAG,CAAC,CAAC,EAAY,EAAE,EAAE;gCAC/B,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC;4BACvB,CAAC,CAAC,CACH;yBACF;wBACD,MAAM,EAAE;4BACN,GAAG,EAAE,IAAI;4BACT,uBAAuB,EAAE,IAAI;yBAC9B;wBACD,KAAK,EAAE,iBAAiB;wBACxB,IAAI,EAAE,CAAC;wBACP,KAAK,EAAE;4BACL,MAAM,EAAE,IAAI;yBACb;qBACF,CAAC,CAAC;oBAEH,MAAM,aAAa,GAA0B,IAAI,GAAG,EAGjD,CAAC;oBACJ,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;wBACjC,IAAI,QAAQ,CAAC,GAAG,EAAE,CAAC;4BACjB,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAC;wBACvD,CAAC;oBACH,CAAC;oBAED,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;wBAC/B,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;4BACvB,MAAM,QAAQ,GAAyB,aAAa,CAAC,GAAG,CACtD,OAAO,CAAC,UAAU,CAAC,QAAQ,EAAE,CAC9B,CAAC;4BACF,IAAI,QAAQ,EAAE,CAAC;gCACb,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC;4BAC9B,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,OAAO,QAAQ,CAAC,uBAAuB,CACrC,GAAG,EACH,GAAG,EACH,QAAQ,EACR,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EACnC,OAAO,CACR,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,CAAC;YACZ,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"ProjectAPI.js","sourceRoot":"","sources":["../../../../Server/API/ProjectAPI.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,wBAAwB,MAAM,wCAAwC,CAAC;AAC9E,OAAO,cAAc,MAAM,iCAAiC,CAAC;AAC7D,OAAO,cAGN,MAAM,4BAA4B,CAAC;AACpC,OAAO,eAAe,MAAM,6BAA6B,CAAC;AAC1D,OAAO,iBAAiB,MAAM,+BAA+B,CAAC;AAC9D,OAAO,WAAW,MAAM,+BAA+B,CAAC;AAQxD,OAAO,YAAY,MAAM,uBAAuB,CAAC;AACjD,OAAO,QAAQ,MAAM,mBAAmB,CAAC;AACzC,OAAO,OAAO,MAAM,WAAW,CAAC;AAChC,OAAO,SAAS,MAAM,aAAa,CAAC;AACpC,OAAO,cAAc,MAAM,4BAA4B,CAAC;AACxD,OAAO,MAAM,MAAM,iBAAiB,CAAC;AACrC,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,yBAAyB,MAAM,iDAAiD,CAAC;AACxF,OAAO,cAAc,MAAM,4BAA4B,CAAC;AACxD,OAAO,OAAO,MAAM,qCAAqC,CAAC;AAG1D,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AACtE,OAAO,aAAa,MAAM,kBAAkB,CAAC;AAC7C,OAAO,UAA8B,MAAM,wBAAwB,CAAC;AACpE,OAAO,kBAAkB,MAAM,wCAAwC,CAAC;AACxE,OAAO,qBAAqB,MAAM,2CAA2C,CAAC;AAC9E,OAAO,QAAQ,MAAM,sBAAsB,CAAC;AAG5C;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAW,IAAI,CAAC;AAEvD,MAAM,CAAC,OAAO,OAAO,UAAW,SAAQ,OAAoC;IAC1E;;QACE,KAAK,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAE/B,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,GAAG,MAAA,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC,cAAc,EAAE,0CAAE,QAAQ,EAAE,kBAAkB,EACvE,cAAc,CAAC,iBAAiB,EAChC,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;;YACtE,IAAI,CAAC;gBACH,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACtB,MAAM,IAAI,gBAAgB,CACxB,wCAAwC,CACzC,CAAC;gBACJ,CAAC;gBAED,MAAM,SAAS,GAAa,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAW,CAAC,CAAC;gBAErE;;;;;;mBAMG;gBACH,MAAM,QAAQ,GAAoB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;gBAExD,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,EAAE,KAAK,SAAS,CAAC,QAAQ,EAAE,EAAE,CAAC;oBAC9D,MAAM,IAAI,gBAAgB,CACxB,mFAAmF,CACpF,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,GAAgB,GAAG,CAAC,IAAmB,IAAI,EAAE,CAAC;gBACxD,MAAM,IAAI,GAAgB,IAAI,CAAC,MAAM,CAAgB,IAAI,EAAE,CAAC;gBAC5D,MAAM,qBAAqB,GAAuB,IAAI,CACpD,uBAAuB,CACF,CAAC;gBAExB,IAAI,CAAC,qBAAqB,EAAE,CAAC;oBAC3B,MAAM,IAAI,gBAAgB,CAAC,oCAAoC,CAAC,CAAC;gBACnE,CAAC;gBAED,qEAAqE;gBACrE,MAAM,OAAO,GAAmB,MAAM,cAAc,CAAC,WAAW,CAAC;oBAC/D,EAAE,EAAE,SAAS;oBACb,MAAM,EAAE;wBACN,yBAAyB,EAAE,IAAI;qBAChC;oBACD,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;iBACF,CAAC,CAAC;gBAEH,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,IAAI,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;gBAClD,CAAC;gBAED,IAAI,CAAC,OAAO,CAAC,yBAAyB,EAAE,CAAC;oBACvC,MAAM,IAAI,gBAAgB,CAAC,qCAAqC,CAAC,CAAC;gBACpE,CAAC;gBAED,MAAM,iBAAiB,GACrB,MAAM,cAAc,CAAC,iBAAiB,CACpC,OAAO,CAAC,yBAAyB,CAClC,CAAC;gBAEJ,IAAI,CAAC,iBAAiB,EAAE,CAAC;oBACvB,MAAM,IAAI,gBAAgB,CACxB,MAAM,CAAC,cAAc,CAAC,mBAAmB,CAC1C,CAAC;gBACJ,CAAC;gBAED,MAAM,WAAW,GACf,MAAM,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC;gBAE1C,MAAM,oBAAoB,GACxB,WAAW,CAAC,MAAM,CAAC,CAAC,UAA0B,EAAE,EAAE;oBAChD,OAAO,CACL,UAAU,CAAC,UAAU,CAAC,QAAQ,EAAE;wBAC9B,UAAU,CAAC,YAAY,CAAC,QAAQ,EAAE;wBACpC,UAAU,CAAC,UAAU,CAAC,QAAQ,EAAE;4BAC9B,UAAU,CAAC,oBAAoB,CAAC,QAAQ,EAAE,CAC7C,CAAC;gBACJ,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;gBAEhB,IACE,CAAC,oBAAoB;oBACrB,CAAC,CAAA,MAAC,GAAwB,CAAC,iBAAiB,0CAAE,aAAa,CAAA,EAC3D,CAAC;oBACD,MAAM,IAAI,gBAAgB,CACxB,YAAY,UAAU,CAAC,YAAY,OAAO,UAAU,CAAC,oBAAoB,oCAAoC,CAC9G,CAAC;gBACJ,CAAC;gBAED,MAAM,cAAc,CAAC,UAAU,CAAC;oBAC9B,SAAS,EAAE,SAAS;oBACpB,qBAAqB,EAAE,qBAAqB;iBAC7C,CAAC,CAAC;gBAEH,OAAO,QAAQ,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,CAAC;YACZ,CAAC;QACH,CAAC,CACF,CAAC;QAEF;;;;;;;;;WASG;QACH,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,GAAG,MAAA,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC,cAAc,EAAE,0CAAE,QAAQ,EAAE,qBAAqB,EAC1E,cAAc,CAAC,iBAAiB,EAChC,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;YACtE,IAAI,CAAC;gBACH,MAAM,OAAO,GAAW,GAAG,CAAC,MAAM,CAAC,IAAI,CAAW,CAAC;gBACnD,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;gBAC/B,MAAM,SAAS,GAAa,IAAI,QAAQ,CAAC,OAAO,CAAC,CAAC;gBAElD;;;;;mBAKG;gBACH,MAAM,QAAQ,GAAoB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;gBAExD,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,EAAE,KAAK,SAAS,CAAC,QAAQ,EAAE,EAAE,CAAC;oBAC9D,MAAM,IAAI,gBAAgB,CACxB,mFAAmF,CACpF,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,GAAgB,GAAG,CAAC,IAAmB,IAAI,EAAE,CAAC;gBACxD,MAAM,IAAI,GAAgB,IAAI,CAAC,MAAM,CAAgB,IAAI,EAAE,CAAC;gBAC5D,MAAM,mBAAmB,GAAc,IAAI,CAAC,gBAAgB,CAAC,CAAC;gBAE9D,IAAI,cAAc,GAAuB,SAAS,CAAC;gBAEnD,IAAI,OAAO,mBAAmB,KAAK,QAAQ,EAAE,CAAC;oBAC5C;;;;;uBAKG;oBACH,MAAM,OAAO,GAAW,mBAAmB;wBACzC,4CAA4C;yBAC3C,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;yBACtB,IAAI,EAAE;yBACN,SAAS,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC;oBAE5C,IAAI,OAAO,EAAE,CAAC;wBACZ,cAAc,GAAG,OAAO,CAAC;oBAC3B,CAAC;gBACH,CAAC;gBAED,MAAM,cAAc,CAAC,aAAa,CAAC;oBACjC,EAAE,EAAE,SAAS;oBACb,cAAc,EAAE,cAAc;oBAC9B,KAAK,EAAE,MAAM,SAAS,CAAC,iCAAiC,CAAC,GAAG,CAAC;iBAC9D,CAAC,CAAC;gBAEH,OAAO,QAAQ,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,CAAC;YACZ,CAAC;QACH,CAAC,CACF,CAAC;QAEF;;;;;WAKG;QACH,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,GAAG,MAAA,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC,cAAc,EAAE,0CAAE,QAAQ,EAAE,mBAAmB,EACxE,wBAAwB,CAAC,iCAAiC,EAC1D,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;YACtE,IAAI,CAAC;gBACH,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACtB,MAAM,IAAI,gBAAgB,CACxB,wCAAwC,CACzC,CAAC;gBACJ,CAAC;gBAED,MAAM,SAAS,GAAa,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAW,CAAC,CAAC;gBAErE,MAAM,IAAI,GAAgB,GAAG,CAAC,IAAmB,IAAI,EAAE,CAAC;gBACxD,MAAM,IAAI,GAAgB,IAAI,CAAC,MAAM,CAAgB,IAAI,EAAE,CAAC;gBAC5D,MAAM,gBAAgB,GAAc,IAAI,CAAC,aAAa,CAAC,CAAC;gBAExD,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACtB,MAAM,IAAI,gBAAgB,CACxB,gDAAgD,CACjD,CAAC;gBACJ,CAAC;gBAED;;;;mBAIG;gBACH,IAAI,OAAO,gBAAgB,KAAK,QAAQ,EAAE,CAAC;oBACzC,MAAM,IAAI,gBAAgB,CAAC,oCAAoC,CAAC,CAAC;gBACnE,CAAC;gBAED,MAAM,WAAW,GAAS,aAAa,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;gBAErE,IAAI,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;oBACjC,MAAM,IAAI,gBAAgB,CAAC,oCAAoC,CAAC,CAAC;gBACnE,CAAC;gBAED;;;;mBAIG;gBACH,IAAI,gBAAgB,GAAyB,SAAS,CAAC;gBAEvD,IAAI,CAAC;oBACH,MAAM,WAAW,GACf,cAAc,CAAC,gCAAgC,CAAC,GAAG,CAAC,CAAC;oBAEvD,IAAI,WAAW,EAAE,CAAC;wBAChB,gBAAgB,GAAG,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC;oBAC7D,CAAC;gBACH,CAAC;gBAAC,WAAM,CAAC;oBACP,gEAAgE;gBAClE,CAAC;gBAED,MAAM,cAAc,CAAC,WAAW,CAAC;oBAC/B,SAAS,EAAE,SAAS;oBACpB,WAAW,EAAE,WAAW;oBACxB,gBAAgB,EAAE,gBAAgB;iBACnC,CAAC,CAAC;gBAEH,OAAO,QAAQ,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,CAAC;YACZ,CAAC;QACH,CAAC,CACF,CAAC;QAEF;;;;;;WAMG;QACH,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,GAAG,MAAA,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC,cAAc,EAAE,0CAAE,QAAQ,EAAE,qBAAqB,EAC1E,wBAAwB,CAAC,iCAAiC,EAC1D,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;YACtE,IAAI,CAAC;gBACH,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACtB,MAAM,IAAI,gBAAgB,CACxB,wCAAwC,CACzC,CAAC;gBACJ,CAAC;gBAED,MAAM,SAAS,GAAa,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAW,CAAC,CAAC;gBAErE,MAAM,IAAI,GAAgB,GAAG,CAAC,IAAmB,IAAI,EAAE,CAAC;gBACxD,MAAM,IAAI,GAAgB,IAAI,CAAC,MAAM,CAAgB,IAAI,EAAE,CAAC;gBAE5D,MAAM,gBAAgB,GAAc,IAAI,CAAC,aAAa,CAAC,CAAC;gBACxD,MAAM,mBAAmB,GAAc,IAAI,CAAC,gBAAgB,CAAC,CAAC;gBAC9D,MAAM,gBAAgB,GAAc,IAAI,CAAC,aAAa,CAAC,CAAC;gBACxD,MAAM,WAAW,GAAc,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAE9C,IACE,CAAC,gBAAgB;oBACjB,OAAO,gBAAgB,KAAK,QAAQ;oBACpC,CAAC,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,QAAQ,CACzC,gBAAsC,CACvC,EACD,CAAC;oBACD,MAAM,IAAI,gBAAgB,CACxB,gCAAgC,MAAM,CAAC,MAAM,CAC3C,kBAAkB,CACnB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACf,CAAC;gBACJ,CAAC;gBAED,IACE,CAAC,mBAAmB;oBACpB,OAAO,mBAAmB,KAAK,QAAQ;oBACvC,CAAC,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,QAAQ,CAC5C,mBAA4C,CAC7C,EACD,CAAC;oBACD,MAAM,IAAI,gBAAgB,CACxB,mCAAmC,MAAM,CAAC,MAAM,CAC9C,qBAAqB,CACtB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACf,CAAC;gBACJ,CAAC;gBAED;;;;;;mBAMG;gBACH,IACE,OAAO,gBAAgB,KAAK,QAAQ;oBACpC,OAAO,gBAAgB,KAAK,QAAQ,EACpC,CAAC;oBACD,MAAM,IAAI,gBAAgB,CAAC,8BAA8B,CAAC,CAAC;gBAC7D,CAAC;gBAED,MAAM,WAAW,GACf,OAAO,gBAAgB,KAAK,QAAQ;oBAClC,CAAC,CAAC,gBAAgB;oBAClB,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC;gBAEtC,IACE,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;oBAC7B,CAAC,OAAO,gBAAgB,KAAK,QAAQ;wBACnC,gBAAgB,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EACjC,CAAC;oBACD,MAAM,IAAI,gBAAgB,CAAC,8BAA8B,CAAC,CAAC;gBAC7D,CAAC;gBAED,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC;oBAC3D,MAAM,IAAI,gBAAgB,CACxB,4CAA4C,CAC7C,CAAC;gBACJ,CAAC;gBAED;;;;mBAIG;gBACH,MAAM,gBAAgB,GAAW,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,GAAG,CAAC,CAAC;gBAE/D;;;;mBAIG;gBACH,IAAI,gBAAgB,GAAyB,SAAS,CAAC;gBAEvD,IAAI,CAAC;oBACH,MAAM,WAAW,GACf,cAAc,CAAC,gCAAgC,CAAC,GAAG,CAAC,CAAC;oBAEvD,IAAI,WAAW,EAAE,CAAC;wBAChB,gBAAgB,GAAG,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC;oBAC7D,CAAC;gBACH,CAAC;gBAAC,WAAM,CAAC;oBACP,iEAAiE;gBACnE,CAAC;gBAED,MAAM,MAAM,GACV,MAAM,cAAc,CAAC,aAAa,CAAC;oBACjC,SAAS,EAAE,SAAS;oBACpB,WAAW,EAAE,gBAAsC;oBACnD,cAAc,EAAE,mBAA4C;oBAC5D,gBAAgB,EAAE,gBAAgB;oBAClC,MAAM,EAAE,WAAW;oBACnB,gBAAgB,EAAE,gBAAgB;iBACnC,CAAC,CAAC;gBAEL,OAAO,QAAQ,CAAC,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE;oBAC/C,yBAAyB,EAAE,MAAM,CAAC,yBAAyB;oBAC3D,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;iBAClD,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,CAAC;YACZ,CAAC;QACH,CAAC,CACF,CAAC;QAEF;;;WAGG;QACH,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,GAAG,MAAA,IAAI,IAAI,CAAC,UAAU,EAAE;aACrB,cAAc,EAAE,0CACf,QAAQ,EAAE,qBAAqB,EACnC,cAAc,CAAC,iBAAiB,EAChC,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;;YACtE,IAAI,CAAC;gBACH,IAAI,CAAC,CAAA,MAAC,GAAwB,CAAC,iBAAiB,0CAAE,MAAM,CAAA,EAAE,CAAC;oBACzD,MAAM,IAAI,yBAAyB,CACjC,6CAA6C,CAC9C,CAAC;gBACJ,CAAC;gBAED,MAAM,aAAa,GAAoB;oBACrC,GAAG,EAAE,IAAI;oBACT,IAAI,EAAE,IAAI;oBACV,WAAW,EAAE,IAAI;oBACjB,qBAAqB,EAAE,IAAI;oBAC3B,UAAU,EAAE,IAAI;oBAChB,iCAAiC,EAAE,IAAI;oBACvC,wCAAwC,EAAE,IAAI;oBAC9C,iCAAiC,EAAE,IAAI;iBACxC,CAAC;gBAEF,MAAM,WAAW,GAAsB,MAAM,iBAAiB,CAAC,MAAM,CACnE;oBACE,KAAK,EAAE;wBACL,MAAM,EAAG,GAAwB,CAAC,iBAAkB,CAAC,MAAO;wBAC5D,qBAAqB,EAAE,IAAI;qBAC5B;oBACD,MAAM,EAAE;wBACN,OAAO,EAAE,aAAa;qBACvB;oBACD,KAAK,EAAE,iBAAiB;oBACxB,IAAI,EAAE,CAAC;oBACP,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;iBACF,CACF,CAAC;gBAEF,MAAM,QAAQ,GAAmB,EAAE,CAAC;gBAEpC,kGAAkG;gBAElG,IACE,gBAAgB;qBAChB,MAAC,GAAwB,CAAC,iBAAiB,0CAAE,aAAa,CAAA,EAC1D,CAAC;oBACD,MAAM,uBAAuB,GAC3B,MAAM,cAAc,CAAC,MAAM,CAAC;wBAC1B,KAAK,EAAE;4BACL,+BAA+B,EAAE,IAAI;yBACtC;wBACD,MAAM,EAAE,aAAa;wBACrB,KAAK,EAAE,iBAAiB;wBACxB,IAAI,EAAE,CAAC;wBACP,KAAK,EAAE;4BACL,MAAM,EAAE,IAAI;yBACb;qBACF,CAAC,CAAC;oBAEL,KAAK,MAAM,sBAAsB,IAAI,uBAAuB,EAAE,CAAC;wBAC7D,IAAI,CAAC,sBAAsB,EAAE,CAAC;4BAC5B,SAAS;wBACX,CAAC;wBAED,IAAI,CAAC,sBAAsB,CAAC,GAAG,EAAE,CAAC;4BAChC,SAAS;wBACX,CAAC;wBAED,IACE,QAAQ,CAAC,SAAS,CAAC,CAAC,OAAgB,EAAE,EAAE;;4BACtC,OAAO,CACL,CAAA,MAAA,OAAO,CAAC,GAAG,0CAAE,QAAQ,EAAE;iCACvB,MAAA,sBAAuB,CAAC,GAAG,0CAAE,QAAQ,EAAE,CAAA,CACxC,CAAC;wBACJ,CAAC,CAAC,KAAK,CAAC,CAAC,EACT,CAAC;4BACD,QAAQ,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;wBACxC,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;oBACrC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;wBACxB,SAAS;oBACX,CAAC;oBAED,IACE,QAAQ,CAAC,SAAS,CAAC,CAAC,OAAgB,EAAE,EAAE;;wBACtC,OAAO,CACL,CAAA,MAAA,OAAO,CAAC,GAAG,0CAAE,QAAQ,EAAE;6BACvB,MAAA,UAAU,CAAC,OAAQ,CAAC,GAAG,0CAAE,QAAQ,EAAE,CAAA,CACpC,CAAC;oBACJ,CAAC,CAAC,KAAK,CAAC,CAAC,EACT,CAAC;wBACD,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,OAAQ,CAAC,CAAC;oBACrC,CAAC;gBACH,CAAC;gBAED;;;mBAGG;gBACH,MAAM,WAAW,GAAoB,EAAE,CAAC;gBACxC,MAAM,eAAe,GAAgB,IAAI,GAAG,EAAU,CAAC;gBACvD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;oBAC/B,IACE,OAAO,CAAC,UAAU;wBAClB,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,EACnD,CAAC;wBACD,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;wBACnD,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;oBACvC,CAAC;gBACH,CAAC;gBAED,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC3B,MAAM,SAAS,GAAoB,MAAM,eAAe,CAAC,MAAM,CAAC;wBAC9D,KAAK,EAAE;4BACL,GAAG,EAAE,WAAW,CAAC,GAAG,CAClB,WAAW,CAAC,GAAG,CAAC,CAAC,EAAY,EAAE,EAAE;gCAC/B,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC;4BACvB,CAAC,CAAC,CACH;yBACF;wBACD,MAAM,EAAE;4BACN,GAAG,EAAE,IAAI;4BACT,uBAAuB,EAAE,IAAI;yBAC9B;wBACD,KAAK,EAAE,iBAAiB;wBACxB,IAAI,EAAE,CAAC;wBACP,KAAK,EAAE;4BACL,MAAM,EAAE,IAAI;yBACb;qBACF,CAAC,CAAC;oBAEH,MAAM,aAAa,GAA0B,IAAI,GAAG,EAGjD,CAAC;oBACJ,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;wBACjC,IAAI,QAAQ,CAAC,GAAG,EAAE,CAAC;4BACjB,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAC;wBACvD,CAAC;oBACH,CAAC;oBAED,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;wBAC/B,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;4BACvB,MAAM,QAAQ,GAAyB,aAAa,CAAC,GAAG,CACtD,OAAO,CAAC,UAAU,CAAC,QAAQ,EAAE,CAC9B,CAAC;4BACF,IAAI,QAAQ,EAAE,CAAC;gCACb,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC;4BAC9B,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,OAAO,QAAQ,CAAC,uBAAuB,CACrC,GAAG,EACH,GAAG,EACH,QAAQ,EACR,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EACnC,OAAO,CACR,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,CAAC;YACZ,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC;CACF"}

package/build/dist/Server/API/StatusPageAPI.js

@@ -94,6 +94,20 @@ import { MASTER_PASSWORD_INVALID_MESSAGE } from "../../Types/StatusPage/MasterPa
 import StatusPageSubscriberNotificationEventType from "../../Types/StatusPage/StatusPageSubscriberNotificationEventType";
 import StatusPageSubscriberNotificationMethod from "../../Types/StatusPage/StatusPageSubscriberNotificationMethod";
 import StatusPageSubscriberNotificationTemplateService, { Service as StatusPageSubscriberNotificationTemplateServiceClass, } from "../Services/StatusPageSubscriberNotificationTemplateService";
+/*
+ * The status badge is hand-built SVG served as image/svg+xml, and SVG is a
+ * document - anything interpolated into it is markup, not text. A monitor
+ * status named `</text><script>...` would otherwise run on the status page
+ * origin for anyone who opens the badge URL directly.
+ */
+const escapeXml = (text) => {
+    return text
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&apos;");
+};
 const resolveStatusPageIdOrThrow = async (statusPageIdOrDomain) => {
     /*
      * Delegates to the service resolver so every endpoint shares its
@@ -370,8 +384,8 @@ export default class StatusPageAPI extends BaseAPI {
                     monitorGroupCurrentStatuses,
                 });
                 // Generate SVG badge
-                const statusName = (overallStatus === null || overallStatus === void 0 ? void 0 : overallStatus.name) || "Unknown";
-                const statusColor = ((_a = overallStatus === null || overallStatus === void 0 ? void 0 : overallStatus.color) === null || _a === void 0 ? void 0 : _a.toString()) || "#808080";
+                const statusName = escapeXml((overallStatus === null || overallStatus === void 0 ? void 0 : overallStatus.name) || "Unknown");
+                const statusColor = escapeXml(((_a = overallStatus === null || overallStatus === void 0 ? void 0 : overallStatus.color) === null || _a === void 0 ? void 0 : _a.toString()) || "#808080");
                 const svg = `<svg xmlns="http://www.w3.org/2000/svg" width="150" height="20">
   <linearGradient id="b" x2="0" y2="100%">
     <stop offset="0" stop-color="#bbb" stop-opacity=".1"/>
@@ -394,6 +408,14 @@ export default class StatusPageAPI extends BaseAPI {
 </svg>`;
                 res.setHeader("Content-Type", "image/svg+xml");
                 res.setHeader("Cache-Control", "no-cache, no-store, must-revalidate");
+                /*
+                 * The badge is only ever loaded through <img>, which ignores both of
+                 * these. They exist for the case where someone opens the badge URL
+                 * as a top-level document, where the SVG would otherwise be a
+                 * scriptable document on this origin.
+                 */
+                res.setHeader("X-Content-Type-Options", "nosniff");
+                res.setHeader("Content-Security-Policy", "sandbox; script-src 'none'; object-src 'none'");
                 return res.send(svg);
             }
             catch (err) {
@@ -535,7 +557,9 @@ export default class StatusPageAPI extends BaseAPI {
         this.router.post(`${(_r = new this.entityType()
             .getCrudApiPath()) === null || _r === void 0 ? void 0 : _r.toString()}/master-page/:statusPageId`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
             try {
-                const objectId = new ObjectID(req.params["statusPageId"]);
+                const statusPageIdParam = req.params["statusPageId"];
+                ObjectID.validateUUID(statusPageIdParam);
+                const objectId = new ObjectID(statusPageIdParam);
                 const select = {
                     _id: true,
                     slug: true,
@@ -2603,16 +2627,26 @@ export default class StatusPageAPI extends BaseAPI {
         else {
             const subscriberId = new ObjectID(req.params["subscriberId"]);
             logger.debug(`Updating existing subscriber with ID: ${subscriberId} for status page with ID: ${objectId}`, getLogAttributesFromRequest(req));
+            /*
+             * Scope the lookup to the status page in the route. This endpoint only
+             * checks read access on that status page, so without the statusPageId
+             * clause anyone holding a subscriber UUID could pass any status page they
+             * can read and edit a subscriber belonging to a different — possibly
+             * private — status page. A subscriber on another page must be
+             * indistinguishable from one that does not exist, so that the shared
+             * "Subscriber not found" below cannot be used to probe for valid UUIDs.
+             */
             statusPageSubscriber = await StatusPageSubscriberService.findOneBy({
                 query: {
                     _id: subscriberId.toString(),
+                    statusPageId: objectId,
                 },
                 props: {
                     isRoot: true,
                 },
             });
             if (!statusPageSubscriber) {
-                logger.debug(`Subscriber not found with ID: ${subscriberId}`, getLogAttributesFromRequest(req));
+                logger.debug(`Subscriber not found with ID: ${subscriberId} on status page with ID: ${objectId}`, getLogAttributesFromRequest(req));
                 throw new BadDataException("Subscriber not found");
             }
             isUpdate = true;