@oneuptime/common 14.0.0 → 14.0.2

package/build/dist/Server/Utils/Workflow/OAuth2TokenClient.js

@@ -0,0 +1,447 @@
+import axios from "axios";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import Exception from "../../../Types/Exception/Exception";
+import { DEFAULT_OAUTH2_CLIENT_AUTHENTICATION_METHOD, OAuth2ClientAuthenticationMethod, OAuth2GrantType, RESERVED_OAUTH2_TOKEN_REQUEST_PARAMETERS, } from "../../../Types/Workflow/WorkflowVariableOAuth";
+import API from "../../../Utils/API";
+import DataSourceEgressGuard from "../DataSource/EgressGuard";
+import OutboundUserAgent from "../OutboundUserAgent";
+/*
+ * The OAuth 2.0 token request an OAuth workflow variable makes: RFC 6749
+ * section 4.4 (client credentials) and section 6 (refresh token).
+ *
+ * This file knows how to ask for a token and how to read the answer. It knows
+ * nothing about workflow variables, caching or locking - that is
+ * WorkflowVariableOAuthToken's job - so every rule here can be tested against a
+ * fake transport or a loopback server without a database.
+ *
+ * The token URL is chosen by a project member and the request carries the
+ * client secret or refresh token, so the default transport goes through the
+ * same egress guard as the SMTP OAuth token endpoint: loopback, link-local and
+ * cloud-metadata addresses are refused everywhere, private ranges are refused
+ * on SaaS, and the validated addresses are pinned into the socket so DNS cannot
+ * answer differently between the check and the connect. Redirects are never
+ * followed: a validated host that answers 302 would otherwise walk the
+ * credentials on to an address nobody checked.
+ */
+export const OAUTH2_TOKEN_REQUEST_TIMEOUT_IN_MS = 20 * 1000;
+// A token response is a few kilobytes. Anything past this is not one.
+export const OAUTH2_TOKEN_RESPONSE_MAX_BYTES = 1024 * 1024;
+// How much of an unexpected response body an error message quotes.
+const RESPONSE_EXCERPT_MAX_LENGTH = 300;
+// Secrets shorter than this are not scrubbed out of messages by substring.
+const MIN_REDACTABLE_SECRET_LENGTH = 4;
+// A form-encoded token response, which older endpoints send whatever Accept says.
+const FORM_ENCODED_TOKEN_BODY = /^(access_token|error)=/;
+/*
+ * A token request that did not produce a token. The message is written for the
+ * person who configured the variable - it is shown in the dashboard and in the
+ * workflow run log - and never contains the client secret, the refresh token or
+ * an access token.
+ */
+export class OAuth2TokenRequestException extends BadDataException {
+    constructor(message, oauthErrorCode) {
+        super(message);
+        this.oauthErrorCode = oauthErrorCode || null;
+    }
+}
+const redactSecrets = (text, secrets) => {
+    let result = text;
+    const usable = secrets
+        .filter((secret) => {
+        return (typeof secret === "string" &&
+            secret.length >= MIN_REDACTABLE_SECRET_LENGTH);
+    })
+        // Longest first, so a secret that contains another is removed whole.
+        .sort((first, second) => {
+        return second.length - first.length;
+    });
+    for (const secret of usable) {
+        result = result.split(secret).join("[REDACTED]");
+        // The Basic header carries the id:secret pair URL-encoded.
+        const encoded = encodeURIComponent(secret);
+        if (encoded !== secret) {
+            result = result.split(encoded).join("[REDACTED]");
+        }
+    }
+    return result;
+};
+/*
+ * A readable, bounded quote of a response body for an error message. HTML
+ * error pages are reduced to their text, and whitespace is collapsed so a
+ * pretty-printed page does not become forty blank lines in a log.
+ */
+const toExcerpt = (text) => {
+    const plain = (text || "")
+        .replace(/<script[\s\S]*?<\/script>/gi, " ")
+        .replace(/<style[\s\S]*?<\/style>/gi, " ")
+        .replace(/<[^>]*>/g, " ")
+        // eslint-disable-next-line no-control-regex
+        .replace(/[\u0000-\u001f\u007f]+/g, " ")
+        .replace(/\s+/g, " ")
+        .trim();
+    if (plain.length <= RESPONSE_EXCERPT_MAX_LENGTH) {
+        return plain;
+    }
+    return `${plain.substring(0, RESPONSE_EXCERPT_MAX_LENGTH)}…`;
+};
+/*
+ * What to do about the error codes RFC 6749 section 5.2 defines. The provider's
+ * own description is quoted as well; this adds the OneUptime side of the fix.
+ */
+const getOAuthErrorHint = (errorCode, grantType) => {
+    switch (errorCode) {
+        case "invalid_client":
+            return "Check the client ID and client secret. If they are right, switch Client Authentication between HTTP Basic Header and Request Body - some providers accept only one of them.";
+        case "invalid_grant":
+            return grantType === OAuth2GrantType.RefreshToken
+                ? "The refresh token was rejected: it may have expired, been revoked, or already been used. Get a new one from your identity provider and save it with Update Credentials."
+                : "The identity provider rejected the grant. Check that this client is allowed to use the client credentials grant.";
+        case "invalid_scope":
+            return "Check the scope. It must be one your identity provider knows and has granted to this client.";
+        case "unauthorized_client":
+            return `This client is not allowed to use the ${grantType} grant. Enable it for the application in your identity provider.`;
+        case "unsupported_grant_type":
+            return `This token endpoint does not support the ${grantType} grant.`;
+        case "invalid_request":
+            return "The identity provider says the request is missing or repeats a parameter. Check the additional parameters and the scope.";
+        default:
+            return "";
+    }
+};
+class OAuth2TokenClient {
+    static buildTokenRequest(config, timeoutInMs = OAUTH2_TOKEN_REQUEST_TIMEOUT_IN_MS) {
+        const clientId = (config.clientId || "").trim();
+        const clientSecret = config.clientSecret || "";
+        if (!config.tokenUrl || !config.tokenUrl.trim()) {
+            throw new OAuth2TokenRequestException("The token URL is not set.");
+        }
+        if (!clientId) {
+            throw new OAuth2TokenRequestException("The client ID is not set.");
+        }
+        const body = {};
+        /*
+         * Provider extras first, so nothing below can be overwritten by them. The
+         * service refuses reserved names on save; this is the second line for a
+         * row written before that check or by a root caller that skipped it.
+         */
+        for (const [key, value] of Object.entries(config.additionalParameters || {})) {
+            if (!key ||
+                RESERVED_OAUTH2_TOKEN_REQUEST_PARAMETERS.includes(key.toLowerCase())) {
+                continue;
+            }
+            body[key] = value;
+        }
+        if (config.grantType === OAuth2GrantType.ClientCredentials) {
+            if (!clientSecret) {
+                throw new OAuth2TokenRequestException("The client secret is not set. The Client Credentials grant needs one.");
+            }
+            body["grant_type"] = "client_credentials";
+        }
+        else if (config.grantType === OAuth2GrantType.RefreshToken) {
+            if (!config.refreshToken) {
+                throw new OAuth2TokenRequestException("The refresh token is not set. Save one with Update Credentials.");
+            }
+            body["grant_type"] = "refresh_token";
+            body["refresh_token"] = config.refreshToken;
+        }
+        else {
+            throw new OAuth2TokenRequestException(`Unsupported OAuth grant type: ${String(config.grantType)}.`);
+        }
+        const scope = (config.scope || "").trim();
+        if (scope) {
+            body["scope"] = scope;
+        }
+        const headers = {
+            Accept: "application/json",
+            "Content-Type": "application/x-www-form-urlencoded",
+        };
+        const authenticationMethod = config.clientAuthenticationMethod ||
+            DEFAULT_OAUTH2_CLIENT_AUTHENTICATION_METHOD;
+        if (!clientSecret) {
+            /*
+             * A public client (refresh token grant without a secret) identifies
+             * itself with client_id in the body and authenticates with nothing else,
+             * RFC 6749 section 6.
+             */
+            body["client_id"] = clientId;
+        }
+        else if (authenticationMethod === OAuth2ClientAuthenticationMethod.RequestBody) {
+            body["client_id"] = clientId;
+            body["client_secret"] = clientSecret;
+        }
+        else {
+            /*
+             * RFC 6749 section 2.3.1 has the id and secret form-encoded before they
+             * are joined and base64-encoded, so a ":" in the id cannot be mistaken
+             * for the separator. encodeURIComponent is used rather than a strict
+             * form encoder because it leaves the unreserved characters (- . _ ~)
+             * alone: secrets made of those - the usual case - come out byte for byte
+             * as typed, which also keeps providers that never decode the header
+             * working.
+             */
+            const credentials = `${encodeURIComponent(clientId)}:${encodeURIComponent(clientSecret)}`;
+            headers["Authorization"] = `Basic ${Buffer.from(credentials, "utf8").toString("base64")}`;
+        }
+        return {
+            url: config.tokenUrl.trim(),
+            headers,
+            body,
+            timeoutInMs,
+        };
+    }
+    /*
+     * Ask the token endpoint for an access token. Resolves with the token or
+     * rejects with an OAuth2TokenRequestException whose message says why.
+     */
+    static async requestToken(config, options) {
+        const request = OAuth2TokenClient.buildTokenRequest(config, (options === null || options === void 0 ? void 0 : options.timeoutInMs) || OAUTH2_TOKEN_REQUEST_TIMEOUT_IN_MS);
+        const secrets = [
+            config.clientSecret,
+            config.refreshToken,
+        ];
+        let response;
+        try {
+            response = await OAuth2TokenClient.transport(request);
+        }
+        catch (err) {
+            throw new OAuth2TokenRequestException(redactSecrets(`Could not reach the token endpoint: ${OAuth2TokenClient.describeTransportError(err, request.timeoutInMs)}`, secrets));
+        }
+        return OAuth2TokenClient.parseTokenResponse(response, {
+            grantType: config.grantType,
+            now: (options === null || options === void 0 ? void 0 : options.now) || new Date(),
+            secrets,
+        });
+    }
+    static parseTokenResponse(response, options) {
+        var _a;
+        const secrets = options.secrets || [];
+        const status = response.statusCode;
+        if (status >= 300 && status < 400) {
+            const location = ((_a = response.headers) === null || _a === void 0 ? void 0 : _a["location"]) || "";
+            throw new OAuth2TokenRequestException(redactSecrets(`The token endpoint answered with a redirect (HTTP ${status})${location ? ` to ${toExcerpt(location)}` : ""}. OneUptime does not follow redirects on token requests; set the Token URL to the address the token endpoint actually answers on.`, secrets));
+        }
+        const body = OAuth2TokenClient.parseBody(response);
+        const accessToken = body === null || body === void 0 ? void 0 : body["access_token"];
+        const errorCode = body === null || body === void 0 ? void 0 : body["error"];
+        /*
+         * An OAuth error is read from any status: RFC 6749 says 400/401, but some
+         * providers answer 200 with an error object (GitHub does), and a 200 that
+         * carries no token is a failure however it is labelled.
+         */
+        if (status < 200 ||
+            status >= 300 ||
+            typeof accessToken !== "string" ||
+            !accessToken) {
+            if (typeof errorCode === "string" && errorCode) {
+                const description = body === null || body === void 0 ? void 0 : body["error_description"];
+                const hint = getOAuthErrorHint(errorCode, options.grantType);
+                const parts = [
+                    `The token endpoint refused the request (HTTP ${status}): ${toExcerpt(errorCode)}`,
+                ];
+                if (typeof description === "string" && description.trim()) {
+                    parts[0] += ` - ${toExcerpt(description)}`;
+                }
+                parts[0] += ".";
+                if (hint) {
+                    parts.push(hint);
+                }
+                throw new OAuth2TokenRequestException(redactSecrets(parts.join(" "), secrets), errorCode);
+            }
+            if (status < 200 || status >= 300) {
+                const excerpt = toExcerpt(response.bodyText);
+                throw new OAuth2TokenRequestException(redactSecrets(`The token endpoint answered HTTP ${status}${excerpt ? `: ${excerpt}` : " with an empty body"}. Check the Token URL.`, secrets));
+            }
+            throw new OAuth2TokenRequestException(redactSecrets(body
+                ? "The token endpoint answered without an access_token. Check that the Token URL is your identity provider's token endpoint and not its authorization or discovery endpoint."
+                : `The token endpoint did not answer with JSON${response.bodyText
+                    ? `: ${toExcerpt(response.bodyText)}`
+                    : " (the body was empty)"}. Check the Token URL.`, secrets));
+        }
+        const tokenType = body === null || body === void 0 ? void 0 : body["token_type"];
+        const refreshToken = body === null || body === void 0 ? void 0 : body["refresh_token"];
+        const scope = body === null || body === void 0 ? void 0 : body["scope"];
+        return {
+            accessToken,
+            tokenType: typeof tokenType === "string" && tokenType ? tokenType : null,
+            expiresAt: OAuth2TokenClient.computeExpiresAt({
+                expiresIn: body === null || body === void 0 ? void 0 : body["expires_in"],
+                accessToken,
+                now: options.now,
+            }),
+            refreshToken: typeof refreshToken === "string" && refreshToken ? refreshToken : null,
+            scope: typeof scope === "string" && scope ? scope : null,
+        };
+    }
+    /*
+     * expires_in is authoritative (RFC 6749 section 5.1). It is RECOMMENDED, not
+     * required, so when it is missing the token itself is asked: most providers
+     * issue JWT access tokens, and a JWT's exp claim is when it stops working.
+     * Neither present means the expiry is unknown, which the caller treats as
+     * "fetch a new one for every run" rather than guessing a lifetime.
+     *
+     * Azure AD v1 sends expires_in as a string, so numeric strings count.
+     */
+    static computeExpiresAt(data) {
+        const expiresIn = typeof data.expiresIn === "number"
+            ? data.expiresIn
+            : typeof data.expiresIn === "string" && data.expiresIn.trim()
+                ? Number(data.expiresIn.trim())
+                : NaN;
+        if (Number.isFinite(expiresIn) && expiresIn > 0) {
+            const expiresAt = new Date(data.now.getTime() + expiresIn * 1000);
+            if (!isNaN(expiresAt.getTime())) {
+                return expiresAt;
+            }
+        }
+        return OAuth2TokenClient.getJwtExpiry(data.accessToken);
+    }
+    /*
+     * The exp claim of a JWT, read without verifying the signature. That is
+     * safe here: the value only decides when OneUptime asks for a new token, and
+     * the token came straight from the endpoint the variable names.
+     */
+    static getJwtExpiry(token) {
+        if (!token || typeof token !== "string") {
+            return null;
+        }
+        const parts = token.split(".");
+        if (parts.length !== 3 || !parts[1]) {
+            return null;
+        }
+        try {
+            const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+            if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+                return null;
+            }
+            const exp = payload["exp"];
+            if (typeof exp !== "number" || !Number.isFinite(exp) || exp <= 0) {
+                return null;
+            }
+            const expiresAt = new Date(exp * 1000);
+            return isNaN(expiresAt.getTime()) ? null : expiresAt;
+        }
+        catch (_a) {
+            return null;
+        }
+    }
+    /*
+     * JSON is what every current provider sends when asked with
+     * `Accept: application/json`. A form-encoded body is accepted too, because
+     * that is what older GitHub-style endpoints answer with regardless.
+     */
+    static parseBody(response) {
+        var _a;
+        const text = (response.bodyText || "").trim();
+        if (!text) {
+            return null;
+        }
+        try {
+            const parsed = JSON.parse(text);
+            if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+                return parsed;
+            }
+            return null;
+        }
+        catch (_b) {
+            // Not JSON; maybe form-encoded.
+        }
+        const contentType = ((_a = response.headers) === null || _a === void 0 ? void 0 : _a["content-type"]) || "";
+        if (contentType.includes("application/x-www-form-urlencoded") ||
+            FORM_ENCODED_TOKEN_BODY.test(text)) {
+            const result = {};
+            for (const [key, value] of new URLSearchParams(text).entries()) {
+                result[key] = value;
+            }
+            return result;
+        }
+        return null;
+    }
+    static describeTransportError(err, timeoutInMs) {
+        if (axios.isAxiosError(err)) {
+            const axiosError = err;
+            if (axiosError.code === "ECONNABORTED" ||
+                axiosError.code === "ETIMEDOUT" ||
+                (axiosError.message || "").toLowerCase().includes("timeout")) {
+                return `it did not answer within ${Math.round(timeoutInMs / 1000)} seconds.`;
+            }
+            if (axiosError.code === "ERR_FR_MAX_BODY_LENGTH_EXCEEDED") {
+                return "its response was larger than a token response can be.";
+            }
+            if ((axiosError.message || "").includes("maxContentLength")) {
+                return "its response was larger than a token response can be.";
+            }
+            return API.getFriendlyErrorMessage(axiosError);
+        }
+        if (err instanceof Exception || err instanceof Error) {
+            return err.message;
+        }
+        return String(err);
+    }
+    /*
+     * The production transport. Every response status comes back as a value -
+     * the caller reads OAuth errors out of 4xx bodies - and only a failure to
+     * get any response at all rejects.
+     */
+    static async sendThroughEgressGuard(request, egressOptions) {
+        const { url, httpAgent, httpsAgent } = await DataSourceEgressGuard.assertUrlAllowedAndPin(request.url, Object.assign({ targetLabel: "OAuth token URL" }, (egressOptions || {})));
+        const axiosOptions = {
+            /*
+             * The pinned agents below are what make the validated address the
+             * dialled address, and only the Node http adapter uses agents. Named
+             * explicitly so the guarantee never rests on axios' environment
+             * detection picking it.
+             */
+            adapter: "http",
+            method: "POST",
+            url: url.toString(),
+            headers: OutboundUserAgent.withDefault(request.headers),
+            data: new URLSearchParams(request.body).toString(),
+            timeout: request.timeoutInMs,
+            maxRedirects: 0,
+            maxContentLength: OAUTH2_TOKEN_RESPONSE_MAX_BYTES,
+            maxBodyLength: OAUTH2_TOKEN_RESPONSE_MAX_BYTES,
+            responseType: "text",
+            transformResponse: [
+                (body) => {
+                    return body;
+                },
+            ],
+            validateStatus: () => {
+                return true;
+            },
+            httpAgent: httpAgent,
+            httpsAgent: httpsAgent,
+        };
+        try {
+            const response = await axios(axiosOptions);
+            const headers = {};
+            for (const key of Object.keys(response.headers || {})) {
+                const value = response.headers[key];
+                if (value !== undefined && value !== null) {
+                    headers[key.toLowerCase()] = String(value);
+                }
+            }
+            return {
+                statusCode: response.status,
+                bodyText: typeof response.data === "string" ? response.data : "",
+                headers,
+            };
+        }
+        finally {
+            httpAgent.destroy();
+            httpsAgent.destroy();
+        }
+    }
+}
+/*
+ * How the request actually leaves the process. A static property rather than
+ * a hard-wired call so a test can swap it for a loopback transport - the
+ * egress guard refuses loopback in every configuration, which is the point
+ * of it - while every other line of the request and response handling runs
+ * for real.
+ */
+OAuth2TokenClient.transport = (request) => {
+    return OAuth2TokenClient.sendThroughEgressGuard(request);
+};
+export default OAuth2TokenClient;
+//# sourceMappingURL=OAuth2TokenClient.js.map

package/build/dist/Server/Utils/Workflow/OAuth2TokenClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OAuth2TokenClient.js","sourceRoot":"","sources":["../../../../../Server/Utils/Workflow/OAuth2TokenClient.ts"],"names":[],"mappings":"AAAA,OAAO,KAAwD,MAAM,OAAO,CAAC;AAE7E,OAAO,gBAAgB,MAAM,2CAA2C,CAAC;AACzE,OAAO,SAAS,MAAM,oCAAoC,CAAC;AAE3D,OAAO,EACL,2CAA2C,EAC3C,gCAAgC,EAChC,eAAe,EACf,wCAAwC,GACzC,MAAM,+CAA+C,CAAC;AACvD,OAAO,GAAG,MAAM,oBAAoB,CAAC;AACrC,OAAO,qBAEN,MAAM,2BAA2B,CAAC;AACnC,OAAO,iBAAiB,MAAM,sBAAsB,CAAC;AAErD;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,CAAC,MAAM,kCAAkC,GAAW,EAAE,GAAG,IAAI,CAAC;AAEpE,sEAAsE;AACtE,MAAM,CAAC,MAAM,+BAA+B,GAAW,IAAI,GAAG,IAAI,CAAC;AAEnE,mEAAmE;AACnE,MAAM,2BAA2B,GAAW,GAAG,CAAC;AAEhD,2EAA2E;AAC3E,MAAM,4BAA4B,GAAW,CAAC,CAAC;AAE/C,kFAAkF;AAClF,MAAM,uBAAuB,GAAW,wBAAwB,CAAC;AA8CjE;;;;;GAKG;AACH,MAAM,OAAO,2BAA4B,SAAQ,gBAAgB;IAI/D,YAAmB,OAAe,EAAE,cAA8B;QAChE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,cAAc,GAAG,cAAc,IAAI,IAAI,CAAC;IAC/C,CAAC;CACF;AAOD,MAAM,aAAa,GAAmB,CACpC,IAAY,EACZ,OAAkC,EAC1B,EAAE;IACV,IAAI,MAAM,GAAW,IAAI,CAAC;IAE1B,MAAM,MAAM,GAAkB,OAAO;SAClC,MAAM,CAAC,CAAC,MAA0B,EAAoB,EAAE;QACvD,OAAO,CACL,OAAO,MAAM,KAAK,QAAQ;YAC1B,MAAM,CAAC,MAAM,IAAI,4BAA4B,CAC9C,CAAC;IACJ,CAAC,CAAC;QACF,qEAAqE;SACpE,IAAI,CAAC,CAAC,KAAa,EAAE,MAAc,EAAE,EAAE;QACtC,OAAO,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IACtC,CAAC,CAAC,CAAC;IAEL,KAAK,MAAM,MAAM,IAAI,MAAM,EAAE,CAAC;QAC5B,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACjD,2DAA2D;QAC3D,MAAM,OAAO,GAAW,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAEnD,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;YACvB,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAIF;;;;GAIG;AACH,MAAM,SAAS,GAAoB,CAAC,IAAY,EAAU,EAAE;IAC1D,MAAM,KAAK,GAAW,CAAC,IAAI,IAAI,EAAE,CAAC;SAC/B,OAAO,CAAC,6BAA6B,EAAE,GAAG,CAAC;SAC3C,OAAO,CAAC,2BAA2B,EAAE,GAAG,CAAC;SACzC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC;QACzB,4CAA4C;SAC3C,OAAO,CAAC,yBAAyB,EAAE,GAAG,CAAC;SACvC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,IAAI,EAAE,CAAC;IAEV,IAAI,KAAK,CAAC,MAAM,IAAI,2BAA2B,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,2BAA2B,CAAC,GAAG,CAAC;AAC/D,CAAC,CAAC;AAOF;;;GAGG;AACH,MAAM,iBAAiB,GAA8B,CACnD,SAAiB,EACjB,SAA0B,EAClB,EAAE;IACV,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,gBAAgB;YACnB,OAAO,6KAA6K,CAAC;QACvL,KAAK,eAAe;YAClB,OAAO,SAAS,KAAK,eAAe,CAAC,YAAY;gBAC/C,CAAC,CAAC,yKAAyK;gBAC3K,CAAC,CAAC,kHAAkH,CAAC;QACzH,KAAK,eAAe;YAClB,OAAO,8FAA8F,CAAC;QACxG,KAAK,qBAAqB;YACxB,OAAO,yCAAyC,SAAS,kEAAkE,CAAC;QAC9H,KAAK,wBAAwB;YAC3B,OAAO,4CAA4C,SAAS,SAAS,CAAC;QACxE,KAAK,iBAAiB;YACpB,OAAO,0HAA0H,CAAC;QACpI;YACE,OAAO,EAAE,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,MAAqB,iBAAiB;IAc7B,MAAM,CAAC,iBAAiB,CAC7B,MAAgC,EAChC,cAAsB,kCAAkC;QAExD,MAAM,QAAQ,GAAW,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACxD,MAAM,YAAY,GAAW,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC;QAEvD,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;YAChD,MAAM,IAAI,2BAA2B,CAAC,2BAA2B,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,2BAA2B,CAAC,2BAA2B,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,IAAI,GAAuB,EAAE,CAAC;QAEpC;;;;WAIG;QACH,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CACvC,MAAM,CAAC,oBAAoB,IAAI,EAAE,CAClC,EAAE,CAAC;YACF,IACE,CAAC,GAAG;gBACJ,wCAAwC,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,EACpE,CAAC;gBACD,SAAS;YACX,CAAC;YAED,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACpB,CAAC;QAED,IAAI,MAAM,CAAC,SAAS,KAAK,eAAe,CAAC,iBAAiB,EAAE,CAAC;YAC3D,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,IAAI,2BAA2B,CACnC,uEAAuE,CACxE,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,YAAY,CAAC,GAAG,oBAAoB,CAAC;QAC5C,CAAC;aAAM,IAAI,MAAM,CAAC,SAAS,KAAK,eAAe,CAAC,YAAY,EAAE,CAAC;YAC7D,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;gBACzB,MAAM,IAAI,2BAA2B,CACnC,iEAAiE,CAClE,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,YAAY,CAAC,GAAG,eAAe,CAAC;YACrC,IAAI,CAAC,eAAe,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC;QAC9C,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,2BAA2B,CACnC,iCAAiC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAC7D,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAW,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAElD,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC;QACxB,CAAC;QAED,MAAM,OAAO,GAAuB;YAClC,MAAM,EAAE,kBAAkB;YAC1B,cAAc,EAAE,mCAAmC;SACpD,CAAC;QAEF,MAAM,oBAAoB,GACxB,MAAM,CAAC,0BAA0B;YACjC,2CAA2C,CAAC;QAE9C,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB;;;;eAIG;YACH,IAAI,CAAC,WAAW,CAAC,GAAG,QAAQ,CAAC;QAC/B,CAAC;aAAM,IACL,oBAAoB,KAAK,gCAAgC,CAAC,WAAW,EACrE,CAAC;YACD,IAAI,CAAC,WAAW,CAAC,GAAG,QAAQ,CAAC;YAC7B,IAAI,CAAC,eAAe,CAAC,GAAG,YAAY,CAAC;QACvC,CAAC;aAAM,CAAC;YACN;;;;;;;;eAQG;YACH,MAAM,WAAW,GAAW,GAAG,kBAAkB,CAC/C,QAAQ,CACT,IAAI,kBAAkB,CAAC,YAAY,CAAC,EAAE,CAAC;YAExC,OAAO,CAAC,eAAe,CAAC,GAAG,SAAS,MAAM,CAAC,IAAI,CAC7C,WAAW,EACX,MAAM,CACP,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,CAAC;QAED,OAAO;YACL,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE;YAC3B,OAAO;YACP,IAAI;YACJ,WAAW;SACZ,CAAC;IACJ,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,KAAK,CAAC,YAAY,CAC9B,MAAgC,EAChC,OAGC;QAED,MAAM,OAAO,GAA2B,iBAAiB,CAAC,iBAAiB,CACzE,MAAM,EACN,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,WAAW,KAAI,kCAAkC,CAC3D,CAAC;QAEF,MAAM,OAAO,GAA8B;YACzC,MAAM,CAAC,YAAY;YACnB,MAAM,CAAC,YAAY;SACpB,CAAC;QAEF,IAAI,QAAiC,CAAC;QAEtC,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,iBAAiB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,2BAA2B,CACnC,aAAa,CACX,uCAAuC,iBAAiB,CAAC,sBAAsB,CAC7E,GAAG,EACH,OAAO,CAAC,WAAW,CACpB,EAAE,EACH,OAAO,CACR,CACF,CAAC;QACJ,CAAC;QAED,OAAO,iBAAiB,CAAC,kBAAkB,CAAC,QAAQ,EAAE;YACpD,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,GAAG,EAAE,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,GAAG,KAAI,IAAI,IAAI,EAAE;YAC/B,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAEM,MAAM,CAAC,kBAAkB,CAC9B,QAAiC,EACjC,OAIC;;QAED,MAAM,OAAO,GAA8B,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;QACjE,MAAM,MAAM,GAAW,QAAQ,CAAC,UAAU,CAAC;QAE3C,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;YAClC,MAAM,QAAQ,GAAW,CAAA,MAAA,QAAQ,CAAC,OAAO,0CAAG,UAAU,CAAC,KAAI,EAAE,CAAC;YAE9D,MAAM,IAAI,2BAA2B,CACnC,aAAa,CACX,qDAAqD,MAAM,IACzD,QAAQ,CAAC,CAAC,CAAC,OAAO,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAC5C,mIAAmI,EACnI,OAAO,CACR,CACF,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAsB,iBAAiB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACtE,MAAM,WAAW,GAA0B,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAG,cAAc,CAAC,CAAC;QAClE,MAAM,SAAS,GAA0B,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAG,OAAO,CAAC,CAAC;QAEzD;;;;WAIG;QACH,IACE,MAAM,GAAG,GAAG;YACZ,MAAM,IAAI,GAAG;YACb,OAAO,WAAW,KAAK,QAAQ;YAC/B,CAAC,WAAW,EACZ,CAAC;YACD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,EAAE,CAAC;gBAC/C,MAAM,WAAW,GAA0B,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAG,mBAAmB,CAAC,CAAC;gBACvE,MAAM,IAAI,GAAW,iBAAiB,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;gBAErE,MAAM,KAAK,GAAkB;oBAC3B,gDAAgD,MAAM,MAAM,SAAS,CACnE,SAAS,CACV,EAAE;iBACJ,CAAC;gBAEF,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC;oBAC1D,KAAK,CAAC,CAAC,CAAC,IAAI,MAAM,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC7C,CAAC;gBAED,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;gBAEhB,IAAI,IAAI,EAAE,CAAC;oBACT,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACnB,CAAC;gBAED,MAAM,IAAI,2BAA2B,CACnC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,EACvC,SAAS,CACV,CAAC;YACJ,CAAC;YAED,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;gBAClC,MAAM,OAAO,GAAW,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBAErD,MAAM,IAAI,2BAA2B,CACnC,aAAa,CACX,oCAAoC,MAAM,GACxC,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC,qBAC7B,wBAAwB,EACxB,OAAO,CACR,CACF,CAAC;YACJ,CAAC;YAED,MAAM,IAAI,2BAA2B,CACnC,aAAa,CACX,IAAI;gBACF,CAAC,CAAC,2KAA2K;gBAC7K,CAAC,CAAC,8CACE,QAAQ,CAAC,QAAQ;oBACf,CAAC,CAAC,KAAK,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;oBACrC,CAAC,CAAC,uBACN,wBAAwB,EAC5B,OAAO,CACR,CACF,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAA0B,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAG,YAAY,CAAC,CAAC;QAC9D,MAAM,YAAY,GAA0B,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAG,eAAe,CAAC,CAAC;QACpE,MAAM,KAAK,GAA0B,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAG,OAAO,CAAC,CAAC;QAErD,OAAO;YACL,WAAW;YACX,SAAS,EAAE,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;YACxE,SAAS,EAAE,iBAAiB,CAAC,gBAAgB,CAAC;gBAC5C,SAAS,EAAE,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAG,YAAY,CAAC;gBAC/B,WAAW;gBACX,GAAG,EAAE,OAAO,CAAC,GAAG;aACjB,CAAC;YACF,YAAY,EACV,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI;YACxE,KAAK,EAAE,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;SACzD,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACI,MAAM,CAAC,gBAAgB,CAAC,IAI9B;QACC,MAAM,SAAS,GACb,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ;YAChC,CAAC,CAAC,IAAI,CAAC,SAAS;YAChB,CAAC,CAAC,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE;gBAC3D,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;gBAC/B,CAAC,CAAC,GAAG,CAAC;QAEZ,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;YAChD,MAAM,SAAS,GAAS,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC;YAExE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;gBAChC,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QAED,OAAO,iBAAiB,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC1D,CAAC;IAED;;;;OAIG;IACI,MAAM,CAAC,YAAY,CAAC,KAAa;QACtC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,KAAK,GAAkB,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAE9C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAY,IAAI,CAAC,KAAK,CACjC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CACpD,CAAC;YAEF,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtE,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,GAAG,GAAa,OAAsB,CAAC,KAAK,CAAC,CAAC;YAEpD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;gBACjE,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,SAAS,GAAS,IAAI,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;YAE7C,OAAO,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACvD,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,MAAM,CAAC,SAAS,CACtB,QAAiC;;QAEjC,MAAM,IAAI,GAAW,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAEtD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAEzC,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnE,OAAO,MAAoB,CAAC;YAC9B,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,WAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;QAED,MAAM,WAAW,GAAW,CAAA,MAAA,QAAQ,CAAC,OAAO,0CAAG,cAAc,CAAC,KAAI,EAAE,CAAC;QAErE,IACE,WAAW,CAAC,QAAQ,CAAC,mCAAmC,CAAC;YACzD,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,EAClC,CAAC;YACD,MAAM,MAAM,GAAe,EAAE,CAAC;YAE9B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;gBAC/D,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACtB,CAAC;YAED,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,MAAM,CAAC,sBAAsB,CACnC,GAAY,EACZ,WAAmB;QAEnB,IAAI,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,UAAU,GAAe,GAAG,CAAC;YAEnC,IACE,UAAU,CAAC,IAAI,KAAK,cAAc;gBAClC,UAAU,CAAC,IAAI,KAAK,WAAW;gBAC/B,CAAC,UAAU,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,EAC5D,CAAC;gBACD,OAAO,4BAA4B,IAAI,CAAC,KAAK,CAC3C,WAAW,GAAG,IAAI,CACnB,WAAW,CAAC;YACf,CAAC;YAED,IAAI,UAAU,CAAC,IAAI,KAAK,iCAAiC,EAAE,CAAC;gBAC1D,OAAO,uDAAuD,CAAC;YACjE,CAAC;YAED,IAAI,CAAC,UAAU,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBAC5D,OAAO,uDAAuD,CAAC;YACjE,CAAC;YAED,OAAO,GAAG,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC;QACjD,CAAC;QAED,IAAI,GAAG,YAAY,SAAS,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;YACrD,OAAO,GAAG,CAAC,OAAO,CAAC;QACrB,CAAC;QAED,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAED;;;;OAIG;IACI,MAAM,CAAC,KAAK,CAAC,sBAAsB,CACxC,OAA+B,EAC/B,aAA8C;QAE9C,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,GAClC,MAAM,qBAAqB,CAAC,sBAAsB,CAAC,OAAO,CAAC,GAAG,kBAC5D,WAAW,EAAE,iBAAiB,IAC3B,CAAC,aAAa,IAAI,EAAE,CAAC,EACxB,CAAC;QAEL,MAAM,YAAY,GAAuB;YACvC;;;;;eAKG;YACH,OAAO,EAAE,MAAM;YACf,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE;YACnB,OAAO,EAAE,iBAAiB,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC;YACvD,IAAI,EAAE,IAAI,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;YAClD,OAAO,EAAE,OAAO,CAAC,WAAW;YAC5B,YAAY,EAAE,CAAC;YACf,gBAAgB,EAAE,+BAA+B;YACjD,aAAa,EAAE,+BAA+B;YAC9C,YAAY,EAAE,MAAM;YACpB,iBAAiB,EAAE;gBACjB,CAAC,IAAY,EAAU,EAAE;oBACvB,OAAO,IAAI,CAAC;gBACd,CAAC;aACF;YACD,cAAc,EAAE,GAAY,EAAE;gBAC5B,OAAO,IAAI,CAAC;YACd,CAAC;YACD,SAAS,EAAE,SAAS;YACpB,UAAU,EAAE,UAAU;SACvB,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,QAAQ,GAA0B,MAAM,KAAK,CAAC,YAAY,CAAC,CAAC;YAElE,MAAM,OAAO,GAAuB,EAAE,CAAC;YAEvC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;gBACtD,MAAM,KAAK,GAAa,QAAQ,CAAC,OAAmC,CAClE,GAAG,CACJ,CAAC;gBAEF,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;oBAC1C,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC7C,CAAC;YACH,CAAC;YAED,OAAO;gBACL,UAAU,EAAE,QAAQ,CAAC,MAAM;gBAC3B,QAAQ,EAAE,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;gBAChE,OAAO;aACR,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,OAAO,EAAE,CAAC;YACpB,UAAU,CAAC,OAAO,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;;AAlfD;;;;;;GAMG;AACW,2BAAS,GAAyB,CAC9C,OAA+B,EACG,EAAE;IACpC,OAAO,iBAAiB,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAC3D,CAAC,CAAC;eAZiB,iBAAiB"}

package/build/dist/Server/Utils/Workflow/WorkflowVariableOAuthToken.js

@@ -0,0 +1,202 @@
+import Semaphore from "../../Infrastructure/Semaphore";
+import WorkflowVariableService from "../../Services/WorkflowVariableService";
+import logger from "../Logger";
+import OAuth2TokenClient, { OAuth2TokenRequestException, } from "./OAuth2TokenClient";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import Exception from "../../../Types/Exception/Exception";
+import { isOAuth2AccessTokenUsable, isOAuth2WorkflowVariable, normalizeOAuth2AdditionalParameters, toDateOrNull, } from "../../../Types/Workflow/WorkflowVariableOAuth";
+export const WORKFLOW_VARIABLE_OAUTH_LOCK_NAMESPACE = "workflow-variable-oauth-token";
+/*
+ * Longer than one token request (OAUTH2_TOKEN_REQUEST_TIMEOUT_IN_MS, 20s), so a
+ * waiter outlasts the refresh it is waiting on. redis-semaphore keeps
+ * extending a held lock, so lockTimeout only bounds how long a crashed holder
+ * can block everyone else.
+ */
+const LOCK_TIMEOUT_IN_MS = 30 * 1000;
+const LOCK_ACQUIRE_TIMEOUT_IN_MS = 30 * 1000;
+const LOCK_RETRY_INTERVAL_IN_MS = 100;
+// What the refresh error column keeps.
+const MAX_REFRESH_ERROR_LENGTH = 2000;
+export default class WorkflowVariableOAuthToken {
+    static async getAccessToken(data) {
+        const mutex = await WorkflowVariableOAuthToken.lock(data.variableId);
+        try {
+            const variable = await WorkflowVariableService.findOneById({
+                id: data.variableId,
+                select: {
+                    _id: true,
+                    name: true,
+                    variableType: true,
+                    oauthGrantType: true,
+                    oauthTokenUrl: true,
+                    oauthClientId: true,
+                    oauthClientSecret: true,
+                    oauthRefreshToken: true,
+                    oauthScope: true,
+                    oauthAdditionalParameters: true,
+                    oauthClientAuthenticationMethod: true,
+                    oauthAccessToken: true,
+                    oauthAccessTokenExpiresAt: true,
+                    oauthLastRefreshedAt: true,
+                },
+                props: {
+                    isRoot: true,
+                },
+            });
+            if (!variable) {
+                throw new BadDataException("Workflow variable not found.");
+            }
+            if (!isOAuth2WorkflowVariable(variable.variableType)) {
+                throw new BadDataException(`"${variable.name || "This variable"}" is not an OAuth 2.0 variable, so it has no access token to refresh.`);
+            }
+            if (!data.forceRefresh &&
+                variable.oauthAccessToken &&
+                isOAuth2AccessTokenUsable({
+                    state: {
+                        hasAccessToken: true,
+                        accessTokenExpiresAt: variable.oauthAccessTokenExpiresAt,
+                        lastRefreshedAt: variable.oauthLastRefreshedAt,
+                    },
+                    now: new Date(),
+                    acceptTokenRefreshedAtOrAfter: data.acceptTokenRefreshedAtOrAfter,
+                })) {
+                return {
+                    accessToken: variable.oauthAccessToken,
+                    expiresAt: toDateOrNull(variable.oauthAccessTokenExpiresAt),
+                    refreshedAt: toDateOrNull(variable.oauthLastRefreshedAt),
+                    didRefresh: false,
+                };
+            }
+            return await WorkflowVariableOAuthToken.refresh(variable, data.timeoutInMs);
+        }
+        finally {
+            if (mutex) {
+                try {
+                    await Semaphore.release(mutex);
+                }
+                catch (err) {
+                    /*
+                     * The lock expires on its own; failing the caller's token over a
+                     * release that did not reach Redis would throw away a good token.
+                     */
+                    logger.warn(`Could not release the OAuth token lock for workflow variable ${data.variableId.toString()}: ${err instanceof Error ? err.message : String(err)}`);
+                }
+            }
+        }
+    }
+    static getTokenRequestConfig(variable) {
+        return {
+            grantType: variable.oauthGrantType,
+            tokenUrl: variable.oauthTokenUrl ? variable.oauthTokenUrl.toString() : "",
+            clientId: variable.oauthClientId || "",
+            clientSecret: variable.oauthClientSecret || undefined,
+            refreshToken: variable.oauthRefreshToken || undefined,
+            scope: variable.oauthScope || undefined,
+            additionalParameters: normalizeOAuth2AdditionalParameters(variable.oauthAdditionalParameters),
+            clientAuthenticationMethod: variable.oauthClientAuthenticationMethod || undefined,
+        };
+    }
+    static async refresh(variable, timeoutInMs) {
+        const variableId = variable.id;
+        let result;
+        try {
+            result = await OAuth2TokenClient.requestToken(WorkflowVariableOAuthToken.getTokenRequestConfig(variable), { timeoutInMs });
+        }
+        catch (err) {
+            const failure = err instanceof OAuth2TokenRequestException
+                ? err
+                : new OAuth2TokenRequestException(err instanceof Exception || err instanceof Error
+                    ? err.message
+                    : "The token request failed.");
+            await WorkflowVariableOAuthToken.recordFailure(variableId, failure.message);
+            throw failure;
+        }
+        const refreshedAt = new Date();
+        /*
+         * A plain record cast once, because the typed partial of this model (it
+         * has a JSON column) is too deep for TypeScript to instantiate (TS2589).
+         *
+         * isRoot + ignoreHooks: this is OneUptime writing columns nobody may write
+         * through the API (the token, its expiry, the refresh bookkeeping), and the
+         * service's update hook would read a change to the OAuth settings as a
+         * reason to throw the new token away. ignoreHooks does not skip encryption
+         * - _updateBy encrypts outside the hook branch - so the token and a rotated
+         * refresh token are stored encrypted like every other secret column.
+         */
+        const data = {
+            oauthAccessToken: result.accessToken,
+            oauthAccessTokenExpiresAt: result.expiresAt,
+            oauthLastRefreshedAt: refreshedAt,
+            oauthLastRefreshError: null,
+            oauthLastRefreshErrorAt: null,
+        };
+        /*
+         * Only replace the refresh token when the provider sent a new one. RFC 6749
+         * section 6 lets it keep the old one valid and say nothing, and clearing
+         * the stored token then would break every later refresh.
+         */
+        if (result.refreshToken &&
+            result.refreshToken !== variable.oauthRefreshToken) {
+            data["oauthRefreshToken"] = result.refreshToken;
+        }
+        await WorkflowVariableService.updateOneById({
+            id: variableId,
+            data: data,
+            props: {
+                isRoot: true,
+                ignoreHooks: true,
+            },
+        });
+        return {
+            accessToken: result.accessToken,
+            expiresAt: result.expiresAt,
+            refreshedAt,
+            didRefresh: true,
+        };
+    }
+    /*
+     * Best effort. The caller is already failing with the real reason, and a
+     * write that could not be made must not replace it with a database error.
+     */
+    static async recordFailure(variableId, message) {
+        try {
+            await WorkflowVariableService.updateOneById({
+                id: variableId,
+                data: {
+                    oauthLastRefreshError: message.substring(0, MAX_REFRESH_ERROR_LENGTH),
+                    oauthLastRefreshErrorAt: new Date(),
+                },
+                props: {
+                    isRoot: true,
+                    ignoreHooks: true,
+                },
+            });
+        }
+        catch (err) {
+            logger.error(`Could not record the OAuth token refresh failure for workflow variable ${variableId.toString()}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    /*
+     * Without Redis there is no cross-process lock to take, and failing every
+     * run that uses the variable would be worse than the rare double refresh an
+     * unlocked request risks - so the refresh goes ahead unlocked. The same goes
+     * for a lock that could not be acquired in time: whoever holds it has been at
+     * it longer than a token request can take.
+     */
+    static async lock(variableId) {
+        try {
+            return await Semaphore.lock({
+                key: variableId.toString(),
+                namespace: WORKFLOW_VARIABLE_OAUTH_LOCK_NAMESPACE,
+                lockTimeout: LOCK_TIMEOUT_IN_MS,
+                acquireTimeout: LOCK_ACQUIRE_TIMEOUT_IN_MS,
+                retryInterval: LOCK_RETRY_INTERVAL_IN_MS,
+            });
+        }
+        catch (err) {
+            logger.warn(`Refreshing the OAuth token of workflow variable ${variableId.toString()} without a lock: ${err instanceof Error ? err.message : String(err)}`);
+            return null;
+        }
+    }
+}
+//# sourceMappingURL=WorkflowVariableOAuthToken.js.map