@oneuptime/common 13.0.4 → 13.0.5

package/build/dist/Server/Utils/SecurityEvent/Connectors/Okta/OktaClient.js

@@ -0,0 +1,314 @@
+import APIException from "../../../../../Types/Exception/ApiException";
+import { REDACTED, redactLogString, redactLogValue, } from "../../../LogRedaction";
+// The documented maximum for `limit`.
+export const OKTA_MAX_PAGE_SIZE = 1000;
+export const OKTA_LOGS_STEP = "Okta System Log events request";
+/*
+ * What the connector reads when the connection's Event filter is empty:
+ * the event families that matter to a security team, by `eventType`
+ * prefix (sign-ins and sessions, MFA, account and lifecycle changes,
+ * Okta's own security detections, policy evaluations, API token
+ * lifecycle, application and group membership). Everything else in the
+ * System Log — app lifecycle, profile mapping, rate-limit chatter — is
+ * left out unless the tenant asks for it with its own filter.
+ */
+export const OKTA_DEFAULT_EVENT_FILTER = [
+    "user.session",
+    "user.authentication",
+    "user.mfa",
+    "user.account",
+    "user.lifecycle",
+    "security.",
+    "policy.",
+    "system.api_token",
+    "application.user_membership",
+    "group.user_membership",
+]
+    .map((prefix) => {
+    return `eventType sw "${prefix}"`;
+})
+    .join(" or ");
+/*
+ * Thrown for every failure that carries an HTTP status, so the connector
+ * can pick remediation text per status without parsing the message.
+ */
+export class OktaHttpError extends APIException {
+    constructor(message, statusCode) {
+        super(message);
+        this.statusCode = statusCode;
+    }
+}
+const TRANSPORT_HTTP_FAILURE_REGEX = /Data source responded with HTTP (\d{3}):\s*([\s\S]*)$/;
+export default class OktaClient {
+    constructor(options) {
+        this.requestCount = 0;
+        this.options = options;
+        this.baseUrl = OktaClient.buildBaseUrl(options.orgUrl);
+    }
+    /*
+     * {orgUrl} with trailing slashes removed, so a URL pasted as
+     * "https://acme.okta.com/" does not produce "//api/v1/logs".
+     */
+    static buildBaseUrl(orgUrl) {
+        return orgUrl.trim().replace(/\/+$/, "");
+    }
+    getBaseUrl() {
+        return this.baseUrl;
+    }
+    getRequestCount() {
+        return this.requestCount;
+    }
+    /*
+     * Parse an RFC 8288 Link header into rel -> URL. Node joins repeated
+     * `link` headers with ", ", so the value may hold several
+     * `<url>; rel="x"` members; commas inside the angle brackets belong to
+     * the URL and must not split it.
+     */
+    static parseLinkHeader(value) {
+        const links = {};
+        const memberRegex = /<([^>]*)>\s*((?:;[^,<]*)*)/g;
+        let match = memberRegex.exec(value);
+        while (match) {
+            const url = (match[1] || "").trim();
+            const params = match[2] || "";
+            const relMatch = params.match(/;\s*rel\s*=\s*"?([^";]+)"?/i);
+            if (url && relMatch && relMatch[1]) {
+                /*
+                 * rel may carry several space-separated relation types; each of
+                 * them points at the same URL.
+                 */
+                for (const rel of relMatch[1].trim().split(/\s+/)) {
+                    links[rel.toLowerCase()] = url;
+                }
+            }
+            match = memberRegex.exec(value);
+        }
+        return links;
+    }
+    /*
+     * The cheapest authenticated call: one event, no bounds. Answers the
+     * question "does Okta accept this token for the System Log at all"
+     * before any window or filter is involved.
+     */
+    async probe() {
+        const url = new URL(`${this.baseUrl}/api/v1/logs`);
+        url.searchParams.set("limit", "1");
+        return this.fetchPage(url.toString());
+    }
+    /*
+     * The first page of events published in [startTime, endTime], oldest
+     * first. Follow `nextUrl` with listNextPage until it is null or a page
+     * comes back empty.
+     */
+    async listLogEvents(request) {
+        const limit = Math.max(0, Math.min(OKTA_MAX_PAGE_SIZE, Math.trunc(request.limit)));
+        const url = new URL(`${this.baseUrl}/api/v1/logs`);
+        url.searchParams.set("since", OktaClient.toIso(request.startTime));
+        url.searchParams.set("until", OktaClient.toIso(request.endTime));
+        url.searchParams.set("sortOrder", "ASCENDING");
+        url.searchParams.set("limit", String(limit));
+        const filter = (request.filter || "").trim();
+        if (filter) {
+            url.searchParams.set("filter", filter);
+        }
+        return this.fetchPage(url.toString());
+    }
+    /*
+     * Request the page a previous response linked to. Okta's own URL is
+     * used as-is (the guide forbids crafting `after` cursors), after
+     * checking it belongs to the configured org: the SSWS token is attached
+     * to every request, and a Link header must not be able to send it
+     * anywhere else.
+     */
+    async listNextPage(nextUrl) {
+        let parsed;
+        try {
+            parsed = new URL(nextUrl);
+        }
+        catch (_a) {
+            throw new APIException(`${OKTA_LOGS_STEP} returned a next link that is not a URL; it was not followed.`);
+        }
+        if (parsed.origin !== new URL(this.baseUrl).origin) {
+            throw new APIException(`${OKTA_LOGS_STEP} returned a next link outside the Okta organization URL (${parsed.host}); it was not followed.`);
+        }
+        return this.fetchPage(parsed.toString());
+    }
+    /*
+     * How many events the window holds, bounded to one page: the count is
+     * exact below the page size, and "at least limit" when Okta offered a
+     * next page.
+     */
+    async countLogEvents(data) {
+        const page = await this.listLogEvents({
+            startTime: data.startTime,
+            endTime: data.endTime,
+            limit: OKTA_MAX_PAGE_SIZE,
+            filter: data.filter,
+        });
+        return {
+            count: page.events.length,
+            hasMore: page.nextUrl !== null && page.events.length > 0,
+        };
+    }
+    headers() {
+        return {
+            Authorization: `SSWS ${this.options.apiToken}`,
+            Accept: "application/json",
+        };
+    }
+    async fetchPage(url) {
+        const response = await this.send({
+            method: "GET",
+            url: url,
+            headers: this.headers(),
+            timeoutInMs: this.options.requestTimeoutInMs,
+        });
+        return {
+            events: this.parseEventsBody(response),
+            nextUrl: OktaClient.readNextLink(response),
+        };
+    }
+    /*
+     * Send through the transport and normalize the two ways a failure
+     * arrives (a thrown transport error, or a fixture's non-2xx status) into
+     * one OktaHttpError / APIException taxonomy.
+     */
+    async send(request) {
+        let response;
+        this.requestCount += 1;
+        try {
+            response = await this.options.transport(request);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            const match = message.match(TRANSPORT_HTTP_FAILURE_REGEX);
+            if (match && match[1]) {
+                const status = Number(match[1]);
+                throw new OktaHttpError(`${OKTA_LOGS_STEP} failed (HTTP ${status}): ${this.redactBody(match[2] || "")}${OktaClient.describeHttpFailure(status)}`, status);
+            }
+            /*
+             * No status at all: a timeout, a refused connection, a DNS failure
+             * or the egress guard. Nothing came back, so the message assigns no
+             * side; the connector's remediation text talks about reachability.
+             */
+            throw new APIException(`${OKTA_LOGS_STEP} did not complete: ${this.scrub(redactLogString(message))}`);
+        }
+        if (response.statusCode < 200 || response.statusCode >= 300) {
+            throw new OktaHttpError(`${OKTA_LOGS_STEP} failed (HTTP ${response.statusCode}): ${this.redactBody(response.bodyText || "")}${OktaClient.describeHttpFailure(response.statusCode)}`, response.statusCode);
+        }
+        return response;
+    }
+    parseEventsBody(response) {
+        const body = response.bodyJson;
+        if (body === undefined) {
+            throw new APIException(`${OKTA_LOGS_STEP} returned a non-JSON body.`);
+        }
+        /*
+         * A 200 whose body is not an array is never "no events": Okta's error
+         * envelope is a JSON object, and so is whatever a proxy or a login
+         * page in front of the org returns. Counting either as an empty
+         * window would let the poller advance its cursor past events it
+         * never read.
+         */
+        if (!Array.isArray(body)) {
+            throw new APIException(`${OKTA_LOGS_STEP} returned an unrecognized response shape: ${this.summarize(body)}`);
+        }
+        const events = [];
+        for (const item of body) {
+            if (OktaClient.isJsonObject(item)) {
+                events.push(item);
+            }
+        }
+        return events;
+    }
+    static readNextLink(response) {
+        const headers = response.headers || {};
+        let value = "";
+        for (const key of Object.keys(headers)) {
+            if (key.toLowerCase() === "link") {
+                value = headers[key] || "";
+                break;
+            }
+        }
+        if (!value) {
+            return null;
+        }
+        const links = OktaClient.parseLinkHeader(value);
+        return links["next"] || null;
+    }
+    /*
+     * Operator guidance appended behind the echoed body, keyed by status.
+     * The prefix, status and body ahead of it are the contract the docs are
+     * written against; this only adds to the tail. Error codes are Okta's
+     * (E0000011 invalid token, E0000006 access denied, E0000047 rate limit,
+     * E0000053 invalid filter / range, E0000009 query timeout).
+     */
+    static describeHttpFailure(status) {
+        let hint = "";
+        if (status === 400) {
+            hint =
+                "Okta rejected the request parameters. Usually the Event filter is not a valid System Log filter expression (operators are eq, ne, co, sw, ew, pr, gt, ge, lt and le joined with and/or; the published attribute cannot be filtered), or the requested range starts more than 180 days ago.";
+        }
+        else if (status === 401) {
+            hint =
+                "Okta did not accept the API token. SSWS tokens expire after 30 days without use and are deprovisioned when the admin who created them is deactivated; create a new token and update the credentials.";
+        }
+        else if (status === 403) {
+            hint =
+                "The token authenticated but is not allowed to read the System Log. API tokens inherit the privileges of the admin who created them: use a token created by a Read-only Administrator or Super Administrator, and check the token's network zone restriction allows requests from OneUptime.";
+        }
+        else if (status === 404) {
+            hint =
+                "Okta answered 404. Check the Okta organization URL: it must be the org's base URL such as https://acme.okta.com, without a path.";
+        }
+        else if (status === 429) {
+            hint =
+                "Okta is rate limiting the token. System Log requests share the org's API rate limit and each token is capped at a percentage of it; the poll will be retried on the next interval.";
+        }
+        else if (status >= 500) {
+            hint =
+                "Okta failed internally or the query took longer than Okta's 30 second limit. The poll will be retried.";
+        }
+        else if (status >= 300 && status < 400) {
+            hint =
+                "Okta redirected the request. Redirects are refused; use the org's own URL (not the -admin URL) directly.";
+        }
+        return hint ? ` — ${hint}` : "";
+    }
+    /*
+     * The body of a failed response is quoted into check messages and the
+     * connection's lastError, so it is decoded and structurally redacted
+     * first (a JSON message can itself contain credential JSON), then the
+     * configured token is scrubbed as a literal in case Okta echoed it.
+     */
+    redactBody(body) {
+        const excerpt = body.substring(0, 500);
+        try {
+            return this.scrub(JSON.stringify(redactLogValue(JSON.parse(excerpt))));
+        }
+        catch (_a) {
+            return this.scrub(redactLogString(excerpt));
+        }
+    }
+    summarize(body) {
+        return this.scrub(JSON.stringify(redactLogValue(body)).substring(0, 300));
+    }
+    /*
+     * The textual redaction rules know Bearer/Basic/Token schemes but not
+     * "SSWS", so the configured token is removed as a literal as well.
+     */
+    scrub(text) {
+        const apiToken = this.options.apiToken;
+        if (!apiToken || !text) {
+            return text;
+        }
+        return text.split(apiToken).join(REDACTED);
+    }
+    static toIso(value) {
+        return value instanceof Date ? value.toISOString() : value;
+    }
+    static isJsonObject(value) {
+        return typeof value === "object" && value !== null && !Array.isArray(value);
+    }
+}
+//# sourceMappingURL=OktaClient.js.map

package/build/dist/Server/Utils/SecurityEvent/Connectors/Okta/OktaClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OktaClient.js","sourceRoot":"","sources":["../../../../../../../Server/Utils/SecurityEvent/Connectors/Okta/OktaClient.ts"],"names":[],"mappings":"AAAA,OAAO,YAAY,MAAM,6CAA6C,CAAC;AAOvE,OAAO,EACL,QAAQ,EACR,eAAe,EACf,cAAc,GACf,MAAM,uBAAuB,CAAC;AA2E/B,sCAAsC;AACtC,MAAM,CAAC,MAAM,kBAAkB,GAAW,IAAI,CAAC;AAE/C,MAAM,CAAC,MAAM,cAAc,GAAW,gCAAgC,CAAC;AAEvE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAW;IAC/C,cAAc;IACd,qBAAqB;IACrB,UAAU;IACV,cAAc;IACd,gBAAgB;IAChB,WAAW;IACX,SAAS;IACT,kBAAkB;IAClB,6BAA6B;IAC7B,uBAAuB;CACxB;KACE,GAAG,CAAC,CAAC,MAAc,EAAU,EAAE;IAC9B,OAAO,iBAAiB,MAAM,GAAG,CAAC;AACpC,CAAC,CAAC;KACD,IAAI,CAAC,MAAM,CAAC,CAAC;AAEhB;;;GAGG;AACH,MAAM,OAAO,aAAc,SAAQ,YAAY;IAG7C,YAAmB,OAAe,EAAE,UAAkB;QACpD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;AAED,MAAM,4BAA4B,GAChC,uDAAuD,CAAC;AAE1D,MAAM,CAAC,OAAO,OAAO,UAAU;IAK7B,YAAmB,OAA0B;QAFrC,iBAAY,GAAW,CAAC,CAAC;QAG/B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACzD,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,YAAY,CAAC,MAAc;QACvC,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC3C,CAAC;IAEM,UAAU;QACf,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAEM,eAAe;QACpB,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,eAAe,CAAC,KAAa;QACzC,MAAM,KAAK,GAAuB,EAAE,CAAC;QACrC,MAAM,WAAW,GAAW,6BAA6B,CAAC;QAC1D,IAAI,KAAK,GAA2B,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAE5D,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,GAAG,GAAW,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5C,MAAM,MAAM,GAAW,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACtC,MAAM,QAAQ,GAA4B,MAAM,CAAC,KAAK,CACpD,6BAA6B,CAC9B,CAAC;YAEF,IAAI,GAAG,IAAI,QAAQ,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnC;;;mBAGG;gBACH,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;oBAClD,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,GAAG,GAAG,CAAC;gBACjC,CAAC;YACH,CAAC;YAED,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,KAAK;QAChB,MAAM,GAAG,GAAQ,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,cAAc,CAAC,CAAC;QACxD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAEnC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IACxC,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,aAAa,CACxB,OAA6B;QAE7B,MAAM,KAAK,GAAW,IAAI,CAAC,GAAG,CAC5B,CAAC,EACD,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CACxD,CAAC;QAEF,MAAM,GAAG,GAAQ,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,cAAc,CAAC,CAAC;QACxD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QACnE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;QACjE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QAC/C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAE7C,MAAM,MAAM,GAAW,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAErD,IAAI,MAAM,EAAE,CAAC;YACX,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACzC,CAAC;QAED,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IACxC,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,YAAY,CAAC,OAAe;QACvC,IAAI,MAAW,CAAC;QAEhB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5B,CAAC;QAAC,WAAM,CAAC;YACP,MAAM,IAAI,YAAY,CACpB,GAAG,cAAc,+DAA+D,CACjF,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;YACnD,MAAM,IAAI,YAAY,CACpB,GAAG,cAAc,4DAA4D,MAAM,CAAC,IAAI,yBAAyB,CAClH,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,cAAc,CAAC,IAI3B;QACC,MAAM,IAAI,GAAsB,MAAM,IAAI,CAAC,aAAa,CAAC;YACvD,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,KAAK,EAAE,kBAAkB;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;QAEH,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;YACzB,OAAO,EAAE,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;SACzD,CAAC;IACJ,CAAC;IAEO,OAAO;QACb,OAAO;YACL,aAAa,EAAE,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE;YAC9C,MAAM,EAAE,kBAAkB;SAC3B,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,GAAW;QACjC,MAAM,QAAQ,GAA2B,MAAM,IAAI,CAAC,IAAI,CAAC;YACvD,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,GAAG;YACR,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;YACvB,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,kBAAkB;SAC7C,CAAC,CAAC;QAEH,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC;YACtC,OAAO,EAAE,UAAU,CAAC,YAAY,CAAC,QAAQ,CAAC;SAC3C,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,IAAI,CAChB,OAA8B;QAE9B,IAAI,QAAgC,CAAC;QACrC,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC;QAEvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GACX,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACzD,MAAM,KAAK,GAA4B,OAAO,CAAC,KAAK,CAClD,4BAA4B,CAC7B,CAAC;YAEF,IAAI,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtB,MAAM,MAAM,GAAW,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBACxC,MAAM,IAAI,aAAa,CACrB,GAAG,cAAc,iBAAiB,MAAM,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,UAAU,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,EACxH,MAAM,CACP,CAAC;YACJ,CAAC;YAED;;;;eAIG;YACH,MAAM,IAAI,YAAY,CACpB,GAAG,cAAc,sBAAsB,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,EAAE,CAC9E,CAAC;QACJ,CAAC;QAED,IAAI,QAAQ,CAAC,UAAU,GAAG,GAAG,IAAI,QAAQ,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;YAC5D,MAAM,IAAI,aAAa,CACrB,GAAG,cAAc,iBAAiB,QAAQ,CAAC,UAAU,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC,GAAG,UAAU,CAAC,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,EAC3J,QAAQ,CAAC,UAAU,CACpB,CAAC;QACJ,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,eAAe,CAAC,QAAgC;QACtD,MAAM,IAAI,GAA0B,QAAQ,CAAC,QAEhC,CAAC;QAEd,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,YAAY,CAAC,GAAG,cAAc,4BAA4B,CAAC,CAAC;QACxE,CAAC;QAED;;;;;;WAMG;QACH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,YAAY,CACpB,GAAG,cAAc,6CAA6C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CACrF,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAsB,EAAE,CAAC;QAErC,KAAK,MAAM,IAAI,IAAI,IAAwB,EAAE,CAAC;YAC5C,IAAI,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpB,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,MAAM,CAAC,YAAY,CAAC,QAAgC;QAC1D,MAAM,OAAO,GAAuB,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC;QAC3D,IAAI,KAAK,GAAW,EAAE,CAAC;QAEvB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACvC,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;gBACjC,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC3B,MAAM;YACR,CAAC;QACH,CAAC;QAED,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,KAAK,GAAuB,UAAU,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAEpE,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;IAC/B,CAAC;IAED;;;;;;OAMG;IACI,MAAM,CAAC,mBAAmB,CAAC,MAAc;QAC9C,IAAI,IAAI,GAAW,EAAE,CAAC;QAEtB,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,IAAI;gBACF,4RAA4R,CAAC;QACjS,CAAC;aAAM,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YAC1B,IAAI;gBACF,sMAAsM,CAAC;QAC3M,CAAC;aAAM,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YAC1B,IAAI;gBACF,6RAA6R,CAAC;QAClS,CAAC;aAAM,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YAC1B,IAAI;gBACF,kIAAkI,CAAC;QACvI,CAAC;aAAM,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YAC1B,IAAI;gBACF,oLAAoL,CAAC;QACzL,CAAC;aAAM,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;YACzB,IAAI;gBACF,wGAAwG,CAAC;QAC7G,CAAC;aAAM,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;YACzC,IAAI;gBACF,0GAA0G,CAAC;QAC/G,CAAC;QAED,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClC,CAAC;IAED;;;;;OAKG;IACK,UAAU,CAAC,IAAY;QAC7B,MAAM,OAAO,GAAW,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAE/C,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CACf,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAc,CAAC,CAAC,CACjE,CAAC;QACJ,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAEO,SAAS,CAAC,IAAe;QAC/B,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,IAAY;QACxB,MAAM,QAAQ,GAAW,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;QAE/C,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,KAAoB;QACvC,OAAO,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IAC7D,CAAC;IAEO,MAAM,CAAC,YAAY,CACzB,KAAmC;QAEnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9E,CAAC;CACF"}