@oneuptime/common 14.0.13 → 14.0.14

package/build/dist/UI/Components/Sso/OidcProviderFormFields.js

@@ -0,0 +1,283 @@
+import { DEFAULT_OIDC_EMAIL_CLAIM_NAME, DEFAULT_OIDC_NAME_CLAIM_NAME, DEFAULT_OIDC_SCOPES, getOidcDiscoveryUrl, includesRequiredOidcScope, isDefaultOidcDiscoveryUrl, isOidcIssuerUrl, splitOidcDiscoveryUrl, } from "../../../Types/SSO/OidcProviderDefaults";
+import { isBlankSsoValue, isDefaultSsoProviderDescription, } from "../../../Types/SSO/SsoProviderDefaults";
+import { translationKey } from "../../Utils/TranslateTemplate";
+import FormFieldSchemaType from "../Forms/Types/FormFieldSchemaType";
+import { getAdvancedFormSection } from "../Forms/Utils/AdvancedFormSection";
+import { translateValidationMessage } from "../Forms/Validation";
+import { SSO_GLOBAL_ADVANCED_DEFAULTS_SUMMARY, SSO_GLOBAL_DISABLE_SIGN_UP_DESCRIPTION, SSO_GLOBAL_RESTRICT_DESCRIPTION, getSsoProviderDescriptionField, getSsoProviderDisableSignUpField, getSsoProviderEnabledField, getSsoProviderNameField, getSsoProviderRestrictToAttachedProjectsField, getSsoProviderTeamsField, isSsoGlobalAccessAtDefaults, readSsoFormValue, ssoFormValueAsText, } from "./SsoProviderFormFields";
+export const OIDC_ISSUER_DESCRIPTION = translationKey("Your identity provider's issuer, exactly as the provider shows it. Pasting its discovery URL works too.");
+export const OIDC_DISCOVERY_URL_DESCRIPTION = translationKey("Where OneUptime finds the provider's endpoints. It follows the issuer; change it only if your provider publishes its discovery document somewhere else.");
+export const OIDC_ISSUER_URL_ERROR = translationKey("Enter the issuer as a URL that starts with https://.");
+export const OIDC_SCOPES_WITHOUT_OPENID_ERROR = translationKey("The scopes must include openid.");
+/*
+ * What the folded Advanced section says while everything in it is at its
+ * default, in place of the "Configured" badge.
+ */
+export const OIDC_ADVANCED_DEFAULTS_SUMMARY = translationKey("Endpoints are found from the issuer, and sign-in asks for the openid, email and profile scopes.");
+/*
+ * The instance-wide provider's switches and what its folded section says
+ * about them are the same for SAML and OIDC (SsoProviderFormFields).
+ */
+export const GLOBAL_OIDC_ADVANCED_DEFAULTS_SUMMARY = SSO_GLOBAL_ADVANCED_DEFAULTS_SUMMARY;
+export const GLOBAL_OIDC_DISABLE_SIGN_UP_DESCRIPTION = SSO_GLOBAL_DISABLE_SIGN_UP_DESCRIPTION;
+export const GLOBAL_OIDC_RESTRICT_DESCRIPTION = SSO_GLOBAL_RESTRICT_DESCRIPTION;
+const isAtDefault = (value, defaultValue) => {
+    return (isBlankSsoValue(value) || ssoFormValueAsText(value).trim() === defaultValue);
+};
+/**
+ * Whether everything the Advanced section folds is what the form would fill
+ * in on its own: the discovery URL the issuer gives, the usual scopes and
+ * claim names, the description the name gives, and (on the Global form) both
+ * switches off.
+ */
+export const isOidcAdvancedAtDefaults = (values, options) => {
+    const read = (key) => {
+        return readSsoFormValue(values, key);
+    };
+    if (!isDefaultOidcDiscoveryUrl({
+        discoveryURL: ssoFormValueAsText(read("discoveryURL")),
+        issuerURL: ssoFormValueAsText(read("issuerURL")),
+    })) {
+        return false;
+    }
+    if (!isAtDefault(read("scopes"), DEFAULT_OIDC_SCOPES) ||
+        !isAtDefault(read("emailClaimName"), DEFAULT_OIDC_EMAIL_CLAIM_NAME) ||
+        !isAtDefault(read("nameClaimName"), DEFAULT_OIDC_NAME_CLAIM_NAME)) {
+        return false;
+    }
+    if (!isDefaultSsoProviderDescription({
+        description: ssoFormValueAsText(read("description")),
+        name: ssoFormValueAsText(read("name")),
+    })) {
+        return false;
+    }
+    if ((options === null || options === void 0 ? void 0 : options.withGlobalAccessSwitches) &&
+        !isSsoGlobalAccessAtDefaults(values)) {
+        return false;
+    }
+    return true;
+};
+/*
+ * The Sign-in step's Advanced section: folded on Create and Edit; while
+ * everything in it is at its default its header says what that default
+ * does, and once something differs it says "Configured".
+ */
+export const getOidcAdvancedSection = (options) => {
+    return getAdvancedFormSection({
+        isConfigured: (values) => {
+            return !isOidcAdvancedAtDefaults(values, options);
+        },
+        getSummary: (values) => {
+            if (!isOidcAdvancedAtDefaults(values, options)) {
+                return undefined;
+            }
+            return (options === null || options === void 0 ? void 0 : options.withGlobalAccessSwitches)
+                ? [
+                    OIDC_ADVANCED_DEFAULTS_SUMMARY,
+                    GLOBAL_OIDC_ADVANCED_DEFAULTS_SUMMARY,
+                ]
+                : [OIDC_ADVANCED_DEFAULTS_SUMMARY];
+        },
+    });
+};
+/**
+ * What else changes when the issuer is changed to `issuer`:
+ *
+ *   - a discovery URL pasted as the issuer is split: the issuer in front of
+ *     it goes in the issuer field, and the URL is the discovery URL;
+ *   - otherwise the discovery URL follows the issuer.
+ *
+ * The discovery URL moves only while it is the one the old issuer gave (or
+ * empty): one set by hand stays. Null when nothing else changes.
+ */
+export const getOidcIssuerChange = (data) => {
+    const typed = ssoFormValueAsText(data.issuer);
+    const currentDiscoveryUrl = ssoFormValueAsText(readSsoFormValue(data.values, "discoveryURL"));
+    const discoveryFollowsIssuer = isDefaultOidcDiscoveryUrl({
+        discoveryURL: currentDiscoveryUrl,
+        issuerURL: ssoFormValueAsText(readSsoFormValue(data.values, "issuerURL")),
+    });
+    const split = splitOidcDiscoveryUrl(typed);
+    if (split) {
+        return {
+            replacesTypedIssuer: true,
+            values: discoveryFollowsIssuer
+                ? { issuerURL: split.issuerURL, discoveryURL: split.discoveryURL }
+                : { issuerURL: split.issuerURL },
+        };
+    }
+    if (!discoveryFollowsIssuer) {
+        return null;
+    }
+    const discoveryURL = getOidcDiscoveryUrl(typed);
+    if (discoveryURL === currentDiscoveryUrl) {
+        return null;
+    }
+    return { replacesTypedIssuer: false, values: { discoveryURL } };
+};
+// The issuer field's own check: an issuer is an http(s) URL.
+export const getOidcIssuerError = (values) => {
+    const issuer = ssoFormValueAsText(readSsoFormValue(values, "issuerURL"));
+    if (!issuer.trim() || isOidcIssuerUrl(issuer)) {
+        return null;
+    }
+    return translateValidationMessage(OIDC_ISSUER_URL_ERROR);
+};
+// The scopes' own check: every OIDC sign-in asks for openid.
+export const getOidcScopesError = (values) => {
+    const scopes = ssoFormValueAsText(readSsoFormValue(values, "scopes"));
+    if (!scopes.trim() || includesRequiredOidcScope(scopes)) {
+        return null;
+    }
+    return translateValidationMessage(OIDC_SCOPES_WITHOUT_OPENID_ERROR);
+};
+/**
+ * The fields of an OIDC provider form, create and edit alike, on the steps
+ * getSsoProviderFormSteps() declares.
+ */
+export const getOidcProviderFormFields = (options) => {
+    const advancedSection = getOidcAdvancedSection(options);
+    return [
+        getSsoProviderNameField({ stepId: "provider" }),
+        {
+            field: { issuerURL: true },
+            title: "Issuer URL",
+            fieldType: FormFieldSchemaType.Text,
+            required: true,
+            description: OIDC_ISSUER_DESCRIPTION,
+            placeholder: "https://accounts.example.com",
+            stepId: "provider",
+            disableSpellCheck: true,
+            customValidation: (values) => {
+                return getOidcIssuerError(values);
+            },
+            onChange: (value, currentValues, setNewFormValues) => {
+                const change = getOidcIssuerChange({
+                    values: currentValues,
+                    issuer: value,
+                });
+                if (!change) {
+                    return;
+                }
+                const apply = () => {
+                    setNewFormValues(Object.assign(Object.assign({}, currentValues), change.values));
+                };
+                if (change.replacesTypedIssuer) {
+                    /*
+                     * The form stores what was typed once this returns, over anything
+                     * set now; the issuer goes in its place right after.
+                     */
+                    queueMicrotask(apply);
+                    return;
+                }
+                apply();
+            },
+        },
+        {
+            field: { clientId: true },
+            title: "Client ID",
+            fieldType: FormFieldSchemaType.Text,
+            required: true,
+            description: "OIDC client ID issued by your identity provider.",
+            placeholder: "abc123-client-id",
+            stepId: "provider",
+            disableSpellCheck: true,
+        },
+        {
+            field: { clientSecret: true },
+            title: "Client Secret",
+            fieldType: FormFieldSchemaType.EncryptedText,
+            required: true,
+            description: "OIDC client secret issued by your identity provider. Stored encrypted at rest.",
+            placeholder: "client-secret-value",
+            stepId: "provider",
+        },
+        ...((options === null || options === void 0 ? void 0 : options.withTeams)
+            ? [getSsoProviderTeamsField({ stepId: "sign-in" })]
+            : []),
+        getSsoProviderEnabledField({ stepId: "sign-in" }),
+        {
+            field: { discoveryURL: true },
+            title: "Discovery URL",
+            fieldType: FormFieldSchemaType.URL,
+            required: true,
+            description: OIDC_DISCOVERY_URL_DESCRIPTION,
+            placeholder: "https://accounts.example.com/.well-known/openid-configuration",
+            stepId: "sign-in",
+            disableSpellCheck: true,
+            collapsibleSection: advancedSection,
+            // The issuer and /.well-known/openid-configuration, followed.
+            isAtDefault: (values) => {
+                return isDefaultOidcDiscoveryUrl({
+                    discoveryURL: ssoFormValueAsText(readSsoFormValue(values, "discoveryURL")),
+                    issuerURL: ssoFormValueAsText(readSsoFormValue(values, "issuerURL")),
+                });
+            },
+        },
+        /*
+         * The scopes and the two claim names start at their usual values and
+         * are never required: sign-in reads an empty one as its usual value
+         * (Identity/API/OIDC, StatusPageOIDC, GlobalOIDC), and the services fill
+         * one left out of a new provider. A status page provider made before
+         * this may have no name claim at all, and editing it must not stop on a
+         * field nobody asked for. The placeholder shows the value an empty one
+         * stands for.
+         */
+        {
+            field: { scopes: true },
+            title: "Scopes",
+            fieldType: FormFieldSchemaType.Text,
+            required: false,
+            description: "Space-separated list of OIDC scopes to request. Must include 'openid'.",
+            placeholder: DEFAULT_OIDC_SCOPES,
+            defaultValue: DEFAULT_OIDC_SCOPES,
+            stepId: "sign-in",
+            disableSpellCheck: true,
+            customValidation: (values) => {
+                return getOidcScopesError(values);
+            },
+            collapsibleSection: advancedSection,
+        },
+        {
+            field: { emailClaimName: true },
+            title: "Email Claim Name",
+            fieldType: FormFieldSchemaType.Text,
+            required: false,
+            description: "Name of the ID token / userinfo claim that contains the user's email address.",
+            placeholder: DEFAULT_OIDC_EMAIL_CLAIM_NAME,
+            defaultValue: DEFAULT_OIDC_EMAIL_CLAIM_NAME,
+            stepId: "sign-in",
+            disableSpellCheck: true,
+            collapsibleSection: advancedSection,
+        },
+        {
+            field: { nameClaimName: true },
+            title: "Name Claim Name",
+            fieldType: FormFieldSchemaType.Text,
+            required: false,
+            description: "Name of the ID token / userinfo claim that contains the user's display name.",
+            placeholder: DEFAULT_OIDC_NAME_CLAIM_NAME,
+            defaultValue: DEFAULT_OIDC_NAME_CLAIM_NAME,
+            stepId: "sign-in",
+            disableSpellCheck: true,
+            collapsibleSection: advancedSection,
+        },
+        getSsoProviderDescriptionField({
+            stepId: "sign-in",
+            collapsibleSection: advancedSection,
+        }),
+        ...((options === null || options === void 0 ? void 0 : options.withGlobalAccessSwitches)
+            ? [
+                getSsoProviderDisableSignUpField({
+                    stepId: "sign-in",
+                    collapsibleSection: advancedSection,
+                }),
+                getSsoProviderRestrictToAttachedProjectsField({
+                    stepId: "sign-in",
+                    collapsibleSection: advancedSection,
+                }),
+            ]
+            : []),
+    ];
+};
+//# sourceMappingURL=OidcProviderFormFields.js.map

package/build/dist/UI/Components/Sso/OidcProviderFormFields.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OidcProviderFormFields.js","sourceRoot":"","sources":["../../../../../UI/Components/Sso/OidcProviderFormFields.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,6BAA6B,EAC7B,4BAA4B,EAC5B,mBAAmB,EAEnB,mBAAmB,EACnB,yBAAyB,EACzB,yBAAyB,EACzB,eAAe,EACf,qBAAqB,GACtB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACL,eAAe,EACf,+BAA+B,GAChC,MAAM,wCAAwC,CAAC;AAEhD,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAE/D,OAAO,mBAAmB,MAAM,oCAAoC,CAAC;AAErE,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EACL,oCAAoC,EACpC,sCAAsC,EACtC,+BAA+B,EAC/B,8BAA8B,EAC9B,gCAAgC,EAChC,0BAA0B,EAC1B,uBAAuB,EACvB,6CAA6C,EAC7C,wBAAwB,EACxB,2BAA2B,EAC3B,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,yBAAyB,CAAC;AA+CjC,MAAM,CAAC,MAAM,uBAAuB,GAAW,cAAc,CAC3D,yGAAyG,CAC1G,CAAC;AAEF,MAAM,CAAC,MAAM,8BAA8B,GAAW,cAAc,CAClE,yJAAyJ,CAC1J,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAW,cAAc,CACzD,sDAAsD,CACvD,CAAC;AAEF,MAAM,CAAC,MAAM,gCAAgC,GAAW,cAAc,CACpE,iCAAiC,CAClC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAW,cAAc,CAClE,iGAAiG,CAClG,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAChD,oCAAoC,CAAC;AAEvC,MAAM,CAAC,MAAM,uCAAuC,GAClD,sCAAsC,CAAC;AAEzC,MAAM,CAAC,MAAM,gCAAgC,GAC3C,+BAA+B,CAAC;AAIlC,MAAM,WAAW,GAAwB,CACvC,KAAc,EACd,YAAoB,EACX,EAAE;IACX,OAAO,CACL,eAAe,CAAC,KAAK,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,YAAY,CAC5E,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAGtB,CACb,MAAe,EACf,OAAiC,EACxB,EAAE;IACX,MAAM,IAAI,GAA6B,CAAC,GAAW,EAAW,EAAE;QAC9D,OAAO,gBAAgB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACvC,CAAC,CAAC;IAEF,IACE,CAAC,yBAAyB,CAAC;QACzB,YAAY,EAAE,kBAAkB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACtD,SAAS,EAAE,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;KACjD,CAAC,EACF,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IACE,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,mBAAmB,CAAC;QACjD,CAAC,WAAW,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,6BAA6B,CAAC;QACnE,CAAC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,4BAA4B,CAAC,EACjE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IACE,CAAC,+BAA+B,CAAC;QAC/B,WAAW,EAAE,kBAAkB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACpD,IAAI,EAAE,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;KACvC,CAAC,EACF,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IACE,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,wBAAwB;QACjC,CAAC,2BAA2B,CAAC,MAAM,CAAC,EACpC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAMF;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAmC,CACpE,OAAiC,EACK,EAAE;IACxC,OAAO,sBAAsB,CAAU;QACrC,YAAY,EAAE,CAAC,MAA2B,EAAW,EAAE;YACrD,OAAO,CAAC,wBAAwB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACpD,CAAC;QACD,UAAU,EAAE,CAAC,MAA2B,EAA6B,EAAE;YACrE,IAAI,CAAC,wBAAwB,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;gBAC/C,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,OAAO,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,wBAAwB;gBACtC,CAAC,CAAC;oBACE,8BAA8B;oBAC9B,qCAAqC;iBACtC;gBACH,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC;QACvC,CAAC;KACF,CAAC,CAAC;AACL,CAAC,CAAC;AAaF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAIA,CAAC,IAGhC,EAA2B,EAAE;IAC5B,MAAM,KAAK,GAAW,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtD,MAAM,mBAAmB,GAAW,kBAAkB,CACpD,gBAAgB,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAC9C,CAAC;IACF,MAAM,sBAAsB,GAAY,yBAAyB,CAAC;QAChE,YAAY,EAAE,mBAAmB;QACjC,SAAS,EAAE,kBAAkB,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;KAC1E,CAAC,CAAC;IAEH,MAAM,KAAK,GAA2B,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAEnE,IAAI,KAAK,EAAE,CAAC;QACV,OAAO;YACL,mBAAmB,EAAE,IAAI;YACzB,MAAM,EAAE,sBAAsB;gBAC5B,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE;gBAClE,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE;SACnC,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,YAAY,GAAW,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAExD,IAAI,YAAY,KAAK,mBAAmB,EAAE,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,YAAY,EAAE,EAAE,CAAC;AAClE,CAAC,CAAC;AAEF,6DAA6D;AAC7D,MAAM,CAAC,MAAM,kBAAkB,GAAuC,CACpE,MAAe,EACA,EAAE;IACjB,MAAM,MAAM,GAAW,kBAAkB,CACvC,gBAAgB,CAAC,MAAM,EAAE,WAAW,CAAC,CACtC,CAAC;IAEF,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,0BAA0B,CAAC,qBAAqB,CAAC,CAAC;AAC3D,CAAC,CAAC;AAEF,6DAA6D;AAC7D,MAAM,CAAC,MAAM,kBAAkB,GAAuC,CACpE,MAAe,EACA,EAAE;IACjB,MAAM,MAAM,GAAW,kBAAkB,CAAC,gBAAgB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IAE9E,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,yBAAyB,CAAC,MAAM,CAAC,EAAE,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,0BAA0B,CAAC,gCAAgC,CAAC,CAAC;AACtE,CAAC,CAAC;AAMF;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAsC,CAG1E,OAAiC,EACV,EAAE;IACzB,MAAM,eAAe,GACnB,sBAAsB,CAAU,OAAO,CAAC,CAAC;IAE3C,OAAO;QACL,uBAAuB,CAAU,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QACxD;YACE,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAA0C;YAClE,KAAK,EAAE,YAAY;YACnB,SAAS,EAAE,mBAAmB,CAAC,IAAI;YACnC,QAAQ,EAAE,IAAI;YACd,WAAW,EAAE,uBAAuB;YACpC,WAAW,EAAE,8BAA8B;YAC3C,MAAM,EAAE,UAAU;YAClB,iBAAiB,EAAE,IAAI;YACvB,gBAAgB,EAAE,CAAC,MAA2B,EAAiB,EAAE;gBAC/D,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;YACpC,CAAC;YACD,QAAQ,EAAE,CACR,KAAc,EACd,aAAkC,EAClC,gBAAuD,EACjD,EAAE;gBACR,MAAM,MAAM,GAA4B,mBAAmB,CAAC;oBAC1D,MAAM,EAAE,aAAa;oBACrB,MAAM,EAAE,KAAK;iBACd,CAAC,CAAC;gBAEH,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO;gBACT,CAAC;gBAED,MAAM,KAAK,GAAe,GAAS,EAAE;oBACnC,gBAAgB,CAAC,gCACZ,aAAa,GACb,MAAM,CAAC,MAAM,CACM,CAAC,CAAC;gBAC5B,CAAC,CAAC;gBAEF,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;oBAC/B;;;uBAGG;oBACH,cAAc,CAAC,KAAK,CAAC,CAAC;oBACtB,OAAO;gBACT,CAAC;gBAED,KAAK,EAAE,CAAC;YACV,CAAC;SACF;QACD;YACE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAA0C;YACjE,KAAK,EAAE,WAAW;YAClB,SAAS,EAAE,mBAAmB,CAAC,IAAI;YACnC,QAAQ,EAAE,IAAI;YACd,WAAW,EAAE,kDAAkD;YAC/D,WAAW,EAAE,kBAAkB;YAC/B,MAAM,EAAE,UAAU;YAClB,iBAAiB,EAAE,IAAI;SACxB;QACD;YACE,KAAK,EAAE,EAAE,YAAY,EAAE,IAAI,EAA0C;YACrE,KAAK,EAAE,eAAe;YACtB,SAAS,EAAE,mBAAmB,CAAC,aAAa;YAC5C,QAAQ,EAAE,IAAI;YACd,WAAW,EACT,gFAAgF;YAClF,WAAW,EAAE,qBAAqB;YAClC,MAAM,EAAE,UAAU;SACnB;QACD,GAAG,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,SAAS;YACpB,CAAC,CAAC,CAAC,wBAAwB,CAAU,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YAC5D,CAAC,CAAC,EAAE,CAAC;QACP,0BAA0B,CAAU,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC1D;YACE,KAAK,EAAE,EAAE,YAAY,EAAE,IAAI,EAA0C;YACrE,KAAK,EAAE,eAAe;YACtB,SAAS,EAAE,mBAAmB,CAAC,GAAG;YAClC,QAAQ,EAAE,IAAI;YACd,WAAW,EAAE,8BAA8B;YAC3C,WAAW,EACT,+DAA+D;YACjE,MAAM,EAAE,SAAS;YACjB,iBAAiB,EAAE,IAAI;YACvB,kBAAkB,EAAE,eAAe;YACnC,8DAA8D;YAC9D,WAAW,EAAE,CAAC,MAA2B,EAAW,EAAE;gBACpD,OAAO,yBAAyB,CAAC;oBAC/B,YAAY,EAAE,kBAAkB,CAC9B,gBAAgB,CAAC,MAAM,EAAE,cAAc,CAAC,CACzC;oBACD,SAAS,EAAE,kBAAkB,CAAC,gBAAgB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;iBACrE,CAAC,CAAC;YACL,CAAC;SACF;QACD;;;;;;;;WAQG;QACH;YACE,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAA0C;YAC/D,KAAK,EAAE,QAAQ;YACf,SAAS,EAAE,mBAAmB,CAAC,IAAI;YACnC,QAAQ,EAAE,KAAK;YACf,WAAW,EACT,wEAAwE;YAC1E,WAAW,EAAE,mBAAmB;YAChC,YAAY,EAAE,mBAAmB;YACjC,MAAM,EAAE,SAAS;YACjB,iBAAiB,EAAE,IAAI;YACvB,gBAAgB,EAAE,CAAC,MAA2B,EAAiB,EAAE;gBAC/D,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;YACpC,CAAC;YACD,kBAAkB,EAAE,eAAe;SACpC;QACD;YACE,KAAK,EAAE,EAAE,cAAc,EAAE,IAAI,EAA0C;YACvE,KAAK,EAAE,kBAAkB;YACzB,SAAS,EAAE,mBAAmB,CAAC,IAAI;YACnC,QAAQ,EAAE,KAAK;YACf,WAAW,EACT,+EAA+E;YACjF,WAAW,EAAE,6BAA6B;YAC1C,YAAY,EAAE,6BAA6B;YAC3C,MAAM,EAAE,SAAS;YACjB,iBAAiB,EAAE,IAAI;YACvB,kBAAkB,EAAE,eAAe;SACpC;QACD;YACE,KAAK,EAAE,EAAE,aAAa,EAAE,IAAI,EAA0C;YACtE,KAAK,EAAE,iBAAiB;YACxB,SAAS,EAAE,mBAAmB,CAAC,IAAI;YACnC,QAAQ,EAAE,KAAK;YACf,WAAW,EACT,8EAA8E;YAChF,WAAW,EAAE,4BAA4B;YACzC,YAAY,EAAE,4BAA4B;YAC1C,MAAM,EAAE,SAAS;YACjB,iBAAiB,EAAE,IAAI;YACvB,kBAAkB,EAAE,eAAe;SACpC;QACD,8BAA8B,CAAU;YACtC,MAAM,EAAE,SAAS;YACjB,kBAAkB,EAAE,eAAe;SACpC,CAAC;QACF,GAAG,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,wBAAwB;YACnC,CAAC,CAAC;gBACE,gCAAgC,CAAU;oBACxC,MAAM,EAAE,SAAS;oBACjB,kBAAkB,EAAE,eAAe;iBACpC,CAAC;gBACF,6CAA6C,CAAU;oBACrD,MAAM,EAAE,SAAS;oBACjB,kBAAkB,EAAE,eAAe;iBACpC,CAAC;aACH;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC,CAAC"}

package/build/dist/UI/Components/Sso/SamlProviderFormFields.js

@@ -0,0 +1,182 @@
+import DigestMethod from "../../../Types/SSO/DigestMethod";
+import { DEFAULT_SAML_DIGEST_METHOD, DEFAULT_SAML_SIGNATURE_METHOD, } from "../../../Types/SSO/SamlProviderDefaults";
+import SignatureMethod from "../../../Types/SSO/SignatureMethod";
+import { isBlankSsoValue, isDefaultSsoProviderDescription, } from "../../../Types/SSO/SsoProviderDefaults";
+import { translationKey } from "../../Utils/TranslateTemplate";
+import FormFieldSchemaType from "../Forms/Types/FormFieldSchemaType";
+import { getAdvancedFormSection } from "../Forms/Utils/AdvancedFormSection";
+import { SSO_GLOBAL_ADVANCED_DEFAULTS_SUMMARY, getSsoProviderDescriptionField, getSsoProviderDisableSignUpField, getSsoProviderEnabledField, getSsoProviderNameField, getSsoProviderRestrictToAttachedProjectsField, getSsoProviderTeamsField, isSsoGlobalAccessAtDefaults, readSsoFormValue, ssoFormValueAsText, } from "./SsoProviderFormFields";
+export const SAML_SIGN_ON_URL_DESCRIPTION = translationKey("Your identity provider's single sign-on URL. OneUptime sends people there to sign in.");
+export const SAML_ISSUER_DESCRIPTION = translationKey("Your identity provider's issuer (its entity ID), exactly as the provider shows it.");
+export const SAML_PUBLIC_CERTIFICATE_DESCRIPTION = translationKey("The X.509 certificate your identity provider signs with, including its BEGIN CERTIFICATE and END CERTIFICATE lines.");
+export const SAML_SIGNATURE_METHOD_DESCRIPTION = translationKey("The algorithm your identity provider signs with. Most use RSA-SHA256.");
+export const SAML_DIGEST_METHOD_DESCRIPTION = translationKey("The digest algorithm your identity provider signs with. Most use SHA256.");
+/*
+ * What the folded Advanced section says while everything in it is at its
+ * default, in place of the "Configured" badge.
+ */
+export const SAML_ADVANCED_DEFAULTS_SUMMARY = translationKey("Signatures use RSA-SHA256 with a SHA256 digest, as most identity providers do.");
+/*
+ * The choices of the two dropdowns, each shown as the value it saves: they
+ * are identifiers ("RSA-SHA256"), not words.
+ */
+const optionsOf = (values) => {
+    return values.map((value) => {
+        return { label: value, value: value };
+    });
+};
+export const SAML_SIGNATURE_METHOD_OPTIONS = optionsOf(Object.values(SignatureMethod));
+export const SAML_DIGEST_METHOD_OPTIONS = optionsOf(Object.values(DigestMethod));
+/*
+ * A dropdown's value as text: a form can hold the option it was picked as
+ * ({ label, value }) rather than its value.
+ */
+const dropdownValueAsText = (value) => {
+    if (value && typeof value === "object" && "value" in value) {
+        return ssoFormValueAsText(value.value);
+    }
+    return ssoFormValueAsText(value);
+};
+const isAtDefault = (value, defaultValue) => {
+    return (isBlankSsoValue(dropdownValueAsText(value)) ||
+        dropdownValueAsText(value).trim() === defaultValue);
+};
+/**
+ * Whether everything the Advanced section folds is what the form would fill
+ * in on its own: RSA-SHA256 and SHA256, the description the name gives, and
+ * (on the Global form) both switches off.
+ */
+export const isSamlAdvancedAtDefaults = (values, options) => {
+    const read = (key) => {
+        return readSsoFormValue(values, key);
+    };
+    if (!isAtDefault(read("signatureMethod"), DEFAULT_SAML_SIGNATURE_METHOD) ||
+        !isAtDefault(read("digestMethod"), DEFAULT_SAML_DIGEST_METHOD)) {
+        return false;
+    }
+    if (!isDefaultSsoProviderDescription({
+        description: ssoFormValueAsText(read("description")),
+        name: ssoFormValueAsText(read("name")),
+    })) {
+        return false;
+    }
+    if ((options === null || options === void 0 ? void 0 : options.withGlobalAccessSwitches) &&
+        !isSsoGlobalAccessAtDefaults(values)) {
+        return false;
+    }
+    return true;
+};
+/*
+ * The Sign-in step's Advanced section: folded on Create and Edit; while
+ * everything in it is at its default its header says what that default
+ * does, and once something differs it says "Configured".
+ */
+export const getSamlAdvancedSection = (options) => {
+    return getAdvancedFormSection({
+        isConfigured: (values) => {
+            return !isSamlAdvancedAtDefaults(values, options);
+        },
+        getSummary: (values) => {
+            if (!isSamlAdvancedAtDefaults(values, options)) {
+                return undefined;
+            }
+            return (options === null || options === void 0 ? void 0 : options.withGlobalAccessSwitches)
+                ? [SAML_ADVANCED_DEFAULTS_SUMMARY, SSO_GLOBAL_ADVANCED_DEFAULTS_SUMMARY]
+                : [SAML_ADVANCED_DEFAULTS_SUMMARY];
+        },
+    });
+};
+/**
+ * The fields of a SAML provider form, create and edit alike, on the steps
+ * getSsoProviderFormSteps() declares.
+ */
+export const getSamlProviderFormFields = (options) => {
+    const advancedSection = getSamlAdvancedSection(options);
+    return [
+        getSsoProviderNameField({ stepId: "provider" }),
+        {
+            field: { signOnURL: true },
+            title: "Sign On URL",
+            fieldType: FormFieldSchemaType.URL,
+            required: true,
+            description: SAML_SIGN_ON_URL_DESCRIPTION,
+            placeholder: "https://yourapp.example.com/apps/appId",
+            stepId: "provider",
+            disableSpellCheck: true,
+        },
+        {
+            field: { issuerURL: true },
+            title: "Issuer",
+            fieldType: FormFieldSchemaType.Text,
+            required: true,
+            description: SAML_ISSUER_DESCRIPTION,
+            placeholder: "https://example.com",
+            stepId: "provider",
+            disableSpellCheck: true,
+        },
+        {
+            field: {
+                publicCertificate: true,
+            },
+            title: "Public Certificate",
+            fieldType: FormFieldSchemaType.LongText,
+            required: true,
+            description: SAML_PUBLIC_CERTIFICATE_DESCRIPTION,
+            placeholder: "Paste in your x509 certificate here.",
+            stepId: "provider",
+            disableSpellCheck: true,
+        },
+        ...((options === null || options === void 0 ? void 0 : options.withTeams)
+            ? [getSsoProviderTeamsField({ stepId: "sign-in" })]
+            : []),
+        getSsoProviderEnabledField({ stepId: "sign-in" }),
+        /*
+         * Required, and started on the value nearly every identity provider
+         * uses, so the form never stops on them; the services fill the same in
+         * for an API caller who leaves them out.
+         */
+        {
+            field: {
+                signatureMethod: true,
+            },
+            title: "Signature Method",
+            fieldType: FormFieldSchemaType.Dropdown,
+            dropdownOptions: SAML_SIGNATURE_METHOD_OPTIONS,
+            required: true,
+            description: SAML_SIGNATURE_METHOD_DESCRIPTION,
+            placeholder: DEFAULT_SAML_SIGNATURE_METHOD,
+            defaultValue: DEFAULT_SAML_SIGNATURE_METHOD,
+            stepId: "sign-in",
+            collapsibleSection: advancedSection,
+        },
+        {
+            field: { digestMethod: true },
+            title: "Digest Method",
+            fieldType: FormFieldSchemaType.Dropdown,
+            dropdownOptions: SAML_DIGEST_METHOD_OPTIONS,
+            required: true,
+            description: SAML_DIGEST_METHOD_DESCRIPTION,
+            placeholder: DEFAULT_SAML_DIGEST_METHOD,
+            defaultValue: DEFAULT_SAML_DIGEST_METHOD,
+            stepId: "sign-in",
+            collapsibleSection: advancedSection,
+        },
+        getSsoProviderDescriptionField({
+            stepId: "sign-in",
+            collapsibleSection: advancedSection,
+        }),
+        ...((options === null || options === void 0 ? void 0 : options.withGlobalAccessSwitches)
+            ? [
+                getSsoProviderDisableSignUpField({
+                    stepId: "sign-in",
+                    collapsibleSection: advancedSection,
+                }),
+                getSsoProviderRestrictToAttachedProjectsField({
+                    stepId: "sign-in",
+                    collapsibleSection: advancedSection,
+                }),
+            ]
+            : []),
+    ];
+};
+//# sourceMappingURL=SamlProviderFormFields.js.map

package/build/dist/UI/Components/Sso/SamlProviderFormFields.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SamlProviderFormFields.js","sourceRoot":"","sources":["../../../../../UI/Components/Sso/SamlProviderFormFields.ts"],"names":[],"mappings":"AAAA,OAAO,YAAY,MAAM,iCAAiC,CAAC;AAC3D,OAAO,EACL,0BAA0B,EAC1B,6BAA6B,GAC9B,MAAM,yCAAyC,CAAC;AACjD,OAAO,eAAe,MAAM,oCAAoC,CAAC;AACjE,OAAO,EACL,eAAe,EACf,+BAA+B,GAChC,MAAM,wCAAwC,CAAC;AAEhD,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAG/D,OAAO,mBAAmB,MAAM,oCAAoC,CAAC;AAErE,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,EACL,oCAAoC,EACpC,8BAA8B,EAC9B,gCAAgC,EAChC,0BAA0B,EAC1B,uBAAuB,EACvB,6CAA6C,EAC7C,wBAAwB,EACxB,2BAA2B,EAC3B,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,yBAAyB,CAAC;AA6CjC,MAAM,CAAC,MAAM,4BAA4B,GAAW,cAAc,CAChE,uFAAuF,CACxF,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAW,cAAc,CAC3D,oFAAoF,CACrF,CAAC;AAEF,MAAM,CAAC,MAAM,mCAAmC,GAAW,cAAc,CACvE,qHAAqH,CACtH,CAAC;AAEF,MAAM,CAAC,MAAM,iCAAiC,GAAW,cAAc,CACrE,uEAAuE,CACxE,CAAC;AAEF,MAAM,CAAC,MAAM,8BAA8B,GAAW,cAAc,CAClE,0EAA0E,CAC3E,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAW,cAAc,CAClE,gFAAgF,CACjF,CAAC;AAEF;;;GAGG;AACH,MAAM,SAAS,GAAqD,CAClE,MAAqB,EACE,EAAE;IACzB,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAa,EAAkB,EAAE;QAClD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,6BAA6B,GAA0B,SAAS,CAC3E,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAC/B,CAAC;AAEF,MAAM,CAAC,MAAM,0BAA0B,GAA0B,SAAS,CACxE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAC5B,CAAC;AAIF;;;GAGG;AACH,MAAM,mBAAmB,GAAgC,CACvD,KAAc,EACN,EAAE;IACV,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,EAAE,CAAC;QAC3D,OAAO,kBAAkB,CAAE,KAA4B,CAAC,KAAK,CAAC,CAAC;IACjE,CAAC;IAED,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC,CAAC;AAIF,MAAM,WAAW,GAAwB,CACvC,KAAc,EACd,YAAoB,EACX,EAAE;IACX,OAAO,CACL,eAAe,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC3C,mBAAmB,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,YAAY,CACnD,CAAC;AACJ,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAGtB,CACb,MAAe,EACf,OAAiC,EACxB,EAAE;IACX,MAAM,IAAI,GAA6B,CAAC,GAAW,EAAW,EAAE;QAC9D,OAAO,gBAAgB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACvC,CAAC,CAAC;IAEF,IACE,CAAC,WAAW,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,6BAA6B,CAAC;QACpE,CAAC,WAAW,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,0BAA0B,CAAC,EAC9D,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IACE,CAAC,+BAA+B,CAAC;QAC/B,WAAW,EAAE,kBAAkB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACpD,IAAI,EAAE,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;KACvC,CAAC,EACF,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IACE,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,wBAAwB;QACjC,CAAC,2BAA2B,CAAC,MAAM,CAAC,EACpC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAMF;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAmC,CACpE,OAAiC,EACK,EAAE;IACxC,OAAO,sBAAsB,CAAU;QACrC,YAAY,EAAE,CAAC,MAA2B,EAAW,EAAE;YACrD,OAAO,CAAC,wBAAwB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACpD,CAAC;QACD,UAAU,EAAE,CAAC,MAA2B,EAA6B,EAAE;YACrE,IAAI,CAAC,wBAAwB,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;gBAC/C,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,OAAO,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,wBAAwB;gBACtC,CAAC,CAAC,CAAC,8BAA8B,EAAE,oCAAoC,CAAC;gBACxE,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC;QACvC,CAAC;KACF,CAAC,CAAC;AACL,CAAC,CAAC;AAMF;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAsC,CAG1E,OAAiC,EACV,EAAE;IACzB,MAAM,eAAe,GACnB,sBAAsB,CAAU,OAAO,CAAC,CAAC;IAE3C,OAAO;QACL,uBAAuB,CAAU,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QACxD;YACE,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAA0C;YAClE,KAAK,EAAE,aAAa;YACpB,SAAS,EAAE,mBAAmB,CAAC,GAAG;YAClC,QAAQ,EAAE,IAAI;YACd,WAAW,EAAE,4BAA4B;YACzC,WAAW,EAAE,wCAAwC;YACrD,MAAM,EAAE,UAAU;YAClB,iBAAiB,EAAE,IAAI;SACxB;QACD;YACE,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAA0C;YAClE,KAAK,EAAE,QAAQ;YACf,SAAS,EAAE,mBAAmB,CAAC,IAAI;YACnC,QAAQ,EAAE,IAAI;YACd,WAAW,EAAE,uBAAuB;YACpC,WAAW,EAAE,qBAAqB;YAClC,MAAM,EAAE,UAAU;YAClB,iBAAiB,EAAE,IAAI;SACxB;QACD;YACE,KAAK,EAAE;gBACL,iBAAiB,EAAE,IAAI;aACgB;YACzC,KAAK,EAAE,oBAAoB;YAC3B,SAAS,EAAE,mBAAmB,CAAC,QAAQ;YACvC,QAAQ,EAAE,IAAI;YACd,WAAW,EAAE,mCAAmC;YAChD,WAAW,EAAE,sCAAsC;YACnD,MAAM,EAAE,UAAU;YAClB,iBAAiB,EAAE,IAAI;SACxB;QACD,GAAG,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,SAAS;YACpB,CAAC,CAAC,CAAC,wBAAwB,CAAU,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YAC5D,CAAC,CAAC,EAAE,CAAC;QACP,0BAA0B,CAAU,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC1D;;;;WAIG;QACH;YACE,KAAK,EAAE;gBACL,eAAe,EAAE,IAAI;aACkB;YACzC,KAAK,EAAE,kBAAkB;YACzB,SAAS,EAAE,mBAAmB,CAAC,QAAQ;YACvC,eAAe,EAAE,6BAA6B;YAC9C,QAAQ,EAAE,IAAI;YACd,WAAW,EAAE,iCAAiC;YAC9C,WAAW,EAAE,6BAA6B;YAC1C,YAAY,EAAE,6BAA6B;YAC3C,MAAM,EAAE,SAAS;YACjB,kBAAkB,EAAE,eAAe;SACpC;QACD;YACE,KAAK,EAAE,EAAE,YAAY,EAAE,IAAI,EAA0C;YACrE,KAAK,EAAE,eAAe;YACtB,SAAS,EAAE,mBAAmB,CAAC,QAAQ;YACvC,eAAe,EAAE,0BAA0B;YAC3C,QAAQ,EAAE,IAAI;YACd,WAAW,EAAE,8BAA8B;YAC3C,WAAW,EAAE,0BAA0B;YACvC,YAAY,EAAE,0BAA0B;YACxC,MAAM,EAAE,SAAS;YACjB,kBAAkB,EAAE,eAAe;SACpC;QACD,8BAA8B,CAAU;YACtC,MAAM,EAAE,SAAS;YACjB,kBAAkB,EAAE,eAAe;SACpC,CAAC;QACF,GAAG,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,wBAAwB;YACnC,CAAC,CAAC;gBACE,gCAAgC,CAAU;oBACxC,MAAM,EAAE,SAAS;oBACjB,kBAAkB,EAAE,eAAe;iBACpC,CAAC;gBACF,6CAA6C,CAAU;oBACrD,MAAM,EAAE,SAAS;oBACjB,kBAAkB,EAAE,eAAe;iBACpC,CAAC;aACH;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC,CAAC"}