@oxy.so/services 1.0.0

package/lib/module/ui/oauth/explicitOAuthConsent.js

@@ -0,0 +1,241 @@
+"use strict";
+
+/**
+ * Explicit OAuth consent for an already-authenticated Oxy user.
+ *
+ * This is deliberately separate from sign-in routing. First-party applications
+ * normally use the account dialog, but a consent-required scope (for example
+ * `acting-as:offline`) still has to go through the OAuth authorize surface. The
+ * caller must invoke this operation from a real user gesture; it never runs on
+ * mount, retries silently, or grants anything locally.
+ */
+
+import { openAuthorizeUrlNative } from "../components/oauthNavigation.js";
+import { startWebOAuthSignIn } from "./browserAuthTransport.js";
+import { completeOAuthCode } from "./completeOAuthCode.js";
+import { prepareAuthorizeRequest } from "./oauthHandshake.js";
+import { closeOAuthPopup, openOAuthPopup } from "./oauthPopup.js";
+const EXACT_SCOPE = /^[a-z][a-z0-9-]*(?::[a-z0-9-]+)+$/;
+function hasExactRedirectUri(value) {
+  if (!value || value !== value.trim() || /\s/.test(value)) return false;
+  try {
+    const parsed = new URL(value);
+    return Boolean(parsed.protocol) && !parsed.username && !parsed.password && !parsed.hash;
+  } catch {
+    return false;
+  }
+}
+function hasExactScopes(scopes) {
+  if (scopes.length === 0 || new Set(scopes).size !== scopes.length) return false;
+  return scopes.every(scope => scope === scope.trim() && EXACT_SCOPE.test(scope));
+}
+function parseNativeCallback(redirectUrl, expectedRedirectUri) {
+  const separator = expectedRedirectUri.includes("?") ? "&" : "?";
+  if (!redirectUrl.startsWith(`${expectedRedirectUri}${separator}`)) {
+    return {
+      kind: "invalid"
+    };
+  }
+  const response = redirectUrl.slice(expectedRedirectUri.length + 1);
+  const params = new URLSearchParams(response);
+  if (params.getAll("code").length > 1 || params.getAll("state").length > 1) {
+    return {
+      kind: "invalid"
+    };
+  }
+  const error = params.get("error");
+  if (error) {
+    const description = params.get("error_description");
+    return description ? {
+      kind: "error",
+      description
+    } : {
+      kind: "error"
+    };
+  }
+  const code = params.get("code");
+  const state = params.get("state");
+  if (!code || !state) return {
+    kind: "invalid"
+  };
+  return {
+    kind: "code",
+    code,
+    state
+  };
+}
+
+/**
+ * Ask the current user to grant exact application scopes through Oxy OAuth.
+ *
+ * Scope syntax is checked before any window opens. After that, the exact client
+ * id resolves its public Application and every requested scope must be present
+ * in that application's configured scope list. Unknown, trimmed, duplicated or
+ * reordered-by-the-SDK values are never sent to the IdP.
+ */
+export async function requestOAuthConsent(context, options) {
+  if (!hasExactRedirectUri(options.redirectUri)) {
+    return {
+      status: "failed",
+      reason: "invalid-redirect-uri"
+    };
+  }
+  if (!hasExactScopes(options.scopes)) {
+    return {
+      status: "failed",
+      reason: "invalid-scopes"
+    };
+  }
+  if (!context.clientId) {
+    return {
+      status: "unsupported",
+      reason: "missing-client-id"
+    };
+  }
+  if (context.identityBound) {
+    return {
+      status: "unsupported",
+      reason: "identity-bound"
+    };
+  }
+  if (!context.expectedUserId) {
+    return {
+      status: "unsupported",
+      reason: "not-authenticated"
+    };
+  }
+  if (context.platform === "unsupported") {
+    return {
+      status: "unsupported",
+      reason: "unsupported-platform"
+    };
+  }
+
+  // Claim a popup before the first await. This function is only safe when the
+  // caller invokes it directly from the user's confirmation gesture.
+  const popup = context.platform === "web" && context.mode === "popup" ? openOAuthPopup() : null;
+  let application;
+  try {
+    application = await context.oxyServices.getPublicApplication(context.clientId);
+  } catch {
+    closeOAuthPopup(popup);
+    return {
+      status: "failed",
+      reason: "client-resolution-failed"
+    };
+  }
+  const configuredScopes = new Set(application.scopes);
+  if (options.scopes.some(scope => !configuredScopes.has(scope))) {
+    closeOAuthPopup(popup);
+    return {
+      status: "failed",
+      reason: "scope-not-configured"
+    };
+  }
+  const scope = options.scopes.join(" ");
+  let subjectMismatch = false;
+  const commitExactSubject = async input => {
+    if (input.userId !== context.expectedUserId) {
+      subjectMismatch = true;
+      throw new Error("OAuth consent returned a different user");
+    }
+    await context.commitSession(input);
+  };
+  if (context.platform === "web") {
+    const result = await startWebOAuthSignIn({
+      mode: context.mode,
+      oxyServices: context.oxyServices,
+      clientId: context.clientId,
+      authorizeBaseUrl: context.authorizeBaseUrl,
+      identityBound: false,
+      commitSession: commitExactSubject
+    }, {
+      redirectUri: options.redirectUri,
+      scope,
+      ...(context.mode === "popup" ? {
+        popup
+      } : {}),
+      ...(options.timeoutMs !== undefined ? {
+        timeoutMs: options.timeoutMs
+      } : {})
+    });
+    if (subjectMismatch) return {
+      status: "failed",
+      reason: "subject-mismatch"
+    };
+    switch (result.status) {
+      case "signed-in":
+        return {
+          status: "consented"
+        };
+      case "redirecting":
+      case "cancelled":
+      case "timed-out":
+        return result;
+      case "failed":
+        return {
+          status: "failed",
+          reason: result.reason,
+          ...(result.description ? {
+            description: result.description
+          } : {})
+        };
+      case "unsupported":
+        return {
+          status: "unsupported",
+          reason: "unsupported-platform"
+        };
+    }
+  }
+  closeOAuthPopup(popup);
+  const prepared = await prepareAuthorizeRequest({
+    clientId: context.clientId,
+    redirectUri: options.redirectUri,
+    authorizeBaseUrl: context.authorizeBaseUrl,
+    scope
+  });
+  const {
+    redirectUrl
+  } = await openAuthorizeUrlNative(prepared.authorizeUrl, options.redirectUri, {
+    allowExternalFallback: false
+  });
+  if (!redirectUrl) return {
+    status: "cancelled"
+  };
+  const callback = parseNativeCallback(redirectUrl, options.redirectUri);
+  if (callback.kind === "error") {
+    return {
+      status: "failed",
+      reason: "idp-error",
+      ...(callback.description ? {
+        description: callback.description
+      } : {})
+    };
+  }
+  if (callback.kind === "invalid") {
+    return {
+      status: "failed",
+      reason: "native-callback-invalid"
+    };
+  }
+  const completion = await completeOAuthCode({
+    oxyServices: context.oxyServices,
+    clientId: context.clientId,
+    code: callback.code,
+    returnedState: callback.state,
+    handshake: prepared.handshake,
+    redirectUri: options.redirectUri,
+    commitSession: commitExactSubject
+  });
+  if (subjectMismatch) return {
+    status: "failed",
+    reason: "subject-mismatch"
+  };
+  return completion.ok ? {
+    status: "consented"
+  } : {
+    status: "failed",
+    reason: completion.reason
+  };
+}
+//# sourceMappingURL=explicitOAuthConsent.js.map

package/lib/module/ui/oauth/explicitOAuthConsent.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["openAuthorizeUrlNative","startWebOAuthSignIn","completeOAuthCode","prepareAuthorizeRequest","closeOAuthPopup","openOAuthPopup","EXACT_SCOPE","hasExactRedirectUri","value","trim","test","parsed","URL","Boolean","protocol","username","password","hash","hasExactScopes","scopes","length","Set","size","every","scope","parseNativeCallback","redirectUrl","expectedRedirectUri","separator","includes","startsWith","kind","response","slice","params","URLSearchParams","getAll","error","get","description","code","state","requestOAuthConsent","context","options","redirectUri","status","reason","clientId","identityBound","expectedUserId","platform","popup","mode","application","oxyServices","getPublicApplication","configuredScopes","some","has","join","subjectMismatch","commitExactSubject","input","userId","Error","commitSession","result","authorizeBaseUrl","timeoutMs","undefined","prepared","authorizeUrl","allowExternalFallback","callback","completion","returnedState","handshake","ok"],"sourceRoot":"../../../../src","sources":["ui/oauth/explicitOAuthConsent.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAGA,SAASA,sBAAsB,QAAQ,kCAA+B;AACtE,SAASC,mBAAmB,QAAQ,2BAAwB;AAC5D,SAASC,iBAAiB,QAAQ,wBAAqB;AACvD,SAASC,uBAAuB,QAAQ,qBAAkB;AAC1D,SAASC,eAAe,EAAEC,cAAc,QAAQ,iBAAc;AA2D9D,MAAMC,WAAW,GAAG,mCAAmC;AAEvD,SAASC,mBAAmBA,CAACC,KAAa,EAAW;EACpD,IAAI,CAACA,KAAK,IAAIA,KAAK,KAAKA,KAAK,CAACC,IAAI,CAAC,CAAC,IAAI,IAAI,CAACC,IAAI,CAACF,KAAK,CAAC,EAAE,OAAO,KAAK;EACtE,IAAI;IACH,MAAMG,MAAM,GAAG,IAAIC,GAAG,CAACJ,KAAK,CAAC;IAC7B,OACCK,OAAO,CAACF,MAAM,CAACG,QAAQ,CAAC,IACxB,CAACH,MAAM,CAACI,QAAQ,IAChB,CAACJ,MAAM,CAACK,QAAQ,IAChB,CAACL,MAAM,CAACM,IAAI;EAEd,CAAC,CAAC,MAAM;IACP,OAAO,KAAK;EACb;AACD;AAEA,SAASC,cAAcA,CAACC,MAAyB,EAAW;EAC3D,IAAIA,MAAM,CAACC,MAAM,KAAK,CAAC,IAAI,IAAIC,GAAG,CAACF,MAAM,CAAC,CAACG,IAAI,KAAKH,MAAM,CAACC,MAAM,EAChE,OAAO,KAAK;EACb,OAAOD,MAAM,CAACI,KAAK,CACjBC,KAAK,IAAKA,KAAK,KAAKA,KAAK,CAACf,IAAI,CAAC,CAAC,IAAIH,WAAW,CAACI,IAAI,CAACc,KAAK,CAC5D,CAAC;AACF;AAEA,SAASC,mBAAmBA,CAC3BC,WAAmB,EACnBC,mBAA2B,EAIL;EACtB,MAAMC,SAAS,GAAGD,mBAAmB,CAACE,QAAQ,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,GAAG;EAC/D,IAAI,CAACH,WAAW,CAACI,UAAU,CAAC,GAAGH,mBAAmB,GAAGC,SAAS,EAAE,CAAC,EAAE;IAClE,OAAO;MAAEG,IAAI,EAAE;IAAU,CAAC;EAC3B;EAEA,MAAMC,QAAQ,GAAGN,WAAW,CAACO,KAAK,CAACN,mBAAmB,CAACP,MAAM,GAAG,CAAC,CAAC;EAClE,MAAMc,MAAM,GAAG,IAAIC,eAAe,CAACH,QAAQ,CAAC;EAC5C,IAAIE,MAAM,CAACE,MAAM,CAAC,MAAM,CAAC,CAAChB,MAAM,GAAG,CAAC,IAAIc,MAAM,CAACE,MAAM,CAAC,OAAO,CAAC,CAAChB,MAAM,GAAG,CAAC,EAAE;IAC1E,OAAO;MAAEW,IAAI,EAAE;IAAU,CAAC;EAC3B;EACA,MAAMM,KAAK,GAAGH,MAAM,CAACI,GAAG,CAAC,OAAO,CAAC;EACjC,IAAID,KAAK,EAAE;IACV,MAAME,WAAW,GAAGL,MAAM,CAACI,GAAG,CAAC,mBAAmB,CAAC;IACnD,OAAOC,WAAW,GAAG;MAAER,IAAI,EAAE,OAAO;MAAEQ;IAAY,CAAC,GAAG;MAAER,IAAI,EAAE;IAAQ,CAAC;EACxE;EACA,MAAMS,IAAI,GAAGN,MAAM,CAACI,GAAG,CAAC,MAAM,CAAC;EAC/B,MAAMG,KAAK,GAAGP,MAAM,CAACI,GAAG,CAAC,OAAO,CAAC;EACjC,IAAI,CAACE,IAAI,IAAI,CAACC,KAAK,EAAE,OAAO;IAAEV,IAAI,EAAE;EAAU,CAAC;EAC/C,OAAO;IAAEA,IAAI,EAAE,MAAM;IAAES,IAAI;IAAEC;EAAM,CAAC;AACrC;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeC,mBAAmBA,CACxCC,OAA4B,EAC5BC,OAAmC,EACL;EAC9B,IAAI,CAACrC,mBAAmB,CAACqC,OAAO,CAACC,WAAW,CAAC,EAAE;IAC9C,OAAO;MAAEC,MAAM,EAAE,QAAQ;MAAEC,MAAM,EAAE;IAAuB,CAAC;EAC5D;EACA,IAAI,CAAC7B,cAAc,CAAC0B,OAAO,CAACzB,MAAM,CAAC,EAAE;IACpC,OAAO;MAAE2B,MAAM,EAAE,QAAQ;MAAEC,MAAM,EAAE;IAAiB,CAAC;EACtD;EACA,IAAI,CAACJ,OAAO,CAACK,QAAQ,EAAE;IACtB,OAAO;MAAEF,MAAM,EAAE,aAAa;MAAEC,MAAM,EAAE;IAAoB,CAAC;EAC9D;EACA,IAAIJ,OAAO,CAACM,aAAa,EAAE;IAC1B,OAAO;MAAEH,MAAM,EAAE,aAAa;MAAEC,MAAM,EAAE;IAAiB,CAAC;EAC3D;EACA,IAAI,CAACJ,OAAO,CAACO,cAAc,EAAE;IAC5B,OAAO;MAAEJ,MAAM,EAAE,aAAa;MAAEC,MAAM,EAAE;IAAoB,CAAC;EAC9D;EACA,IAAIJ,OAAO,CAACQ,QAAQ,KAAK,aAAa,EAAE;IACvC,OAAO;MAAEL,MAAM,EAAE,aAAa;MAAEC,MAAM,EAAE;IAAuB,CAAC;EACjE;;EAEA;EACA;EACA,MAAMK,KAA8B,GACnCT,OAAO,CAACQ,QAAQ,KAAK,KAAK,IAAIR,OAAO,CAACU,IAAI,KAAK,OAAO,GACnDhD,cAAc,CAAC,CAAC,GAChB,IAAI;EAER,IAAIiD,WAA8B;EAClC,IAAI;IACHA,WAAW,GAAG,MAAMX,OAAO,CAACY,WAAW,CAACC,oBAAoB,CAC3Db,OAAO,CAACK,QACT,CAAC;EACF,CAAC,CAAC,MAAM;IACP5C,eAAe,CAACgD,KAAK,CAAC;IACtB,OAAO;MAAEN,MAAM,EAAE,QAAQ;MAAEC,MAAM,EAAE;IAA2B,CAAC;EAChE;EAEA,MAAMU,gBAAgB,GAAG,IAAIpC,GAAG,CAACiC,WAAW,CAACnC,MAAM,CAAC;EACpD,IAAIyB,OAAO,CAACzB,MAAM,CAACuC,IAAI,CAAElC,KAAK,IAAK,CAACiC,gBAAgB,CAACE,GAAG,CAACnC,KAAK,CAAC,CAAC,EAAE;IACjEpB,eAAe,CAACgD,KAAK,CAAC;IACtB,OAAO;MAAEN,MAAM,EAAE,QAAQ;MAAEC,MAAM,EAAE;IAAuB,CAAC;EAC5D;EAEA,MAAMvB,KAAK,GAAGoB,OAAO,CAACzB,MAAM,CAACyC,IAAI,CAAC,GAAG,CAAC;EACtC,IAAIC,eAAe,GAAG,KAAK;EAC3B,MAAMC,kBAAkB,GAAG,MAC1BC,KAA8B,IACX;IACnB,IAAIA,KAAK,CAACC,MAAM,KAAKrB,OAAO,CAACO,cAAc,EAAE;MAC5CW,eAAe,GAAG,IAAI;MACtB,MAAM,IAAII,KAAK,CAAC,yCAAyC,CAAC;IAC3D;IACA,MAAMtB,OAAO,CAACuB,aAAa,CAACH,KAAK,CAAC;EACnC,CAAC;EAED,IAAIpB,OAAO,CAACQ,QAAQ,KAAK,KAAK,EAAE;IAC/B,MAAMgB,MAAM,GAAG,MAAMlE,mBAAmB,CACvC;MACCoD,IAAI,EAAEV,OAAO,CAACU,IAAI;MAClBE,WAAW,EAAEZ,OAAO,CAACY,WAAW;MAChCP,QAAQ,EAAEL,OAAO,CAACK,QAAQ;MAC1BoB,gBAAgB,EAAEzB,OAAO,CAACyB,gBAAgB;MAC1CnB,aAAa,EAAE,KAAK;MACpBiB,aAAa,EAAEJ;IAChB,CAAC,EACD;MACCjB,WAAW,EAAED,OAAO,CAACC,WAAW;MAChCrB,KAAK;MACL,IAAImB,OAAO,CAACU,IAAI,KAAK,OAAO,GAAG;QAAED;MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;MAC9C,IAAIR,OAAO,CAACyB,SAAS,KAAKC,SAAS,GAChC;QAAED,SAAS,EAAEzB,OAAO,CAACyB;MAAU,CAAC,GAChC,CAAC,CAAC;IACN,CACD,CAAC;IACD,IAAIR,eAAe,EAClB,OAAO;MAAEf,MAAM,EAAE,QAAQ;MAAEC,MAAM,EAAE;IAAmB,CAAC;IACxD,QAAQoB,MAAM,CAACrB,MAAM;MACpB,KAAK,WAAW;QACf,OAAO;UAAEA,MAAM,EAAE;QAAY,CAAC;MAC/B,KAAK,aAAa;MAClB,KAAK,WAAW;MAChB,KAAK,WAAW;QACf,OAAOqB,MAAM;MACd,KAAK,QAAQ;QACZ,OAAO;UACNrB,MAAM,EAAE,QAAQ;UAChBC,MAAM,EAAEoB,MAAM,CAACpB,MAAM;UACrB,IAAIoB,MAAM,CAAC5B,WAAW,GAAG;YAAEA,WAAW,EAAE4B,MAAM,CAAC5B;UAAY,CAAC,GAAG,CAAC,CAAC;QAClE,CAAC;MACF,KAAK,aAAa;QACjB,OAAO;UAAEO,MAAM,EAAE,aAAa;UAAEC,MAAM,EAAE;QAAuB,CAAC;IAClE;EACD;EAEA3C,eAAe,CAACgD,KAAK,CAAC;EACtB,MAAMmB,QAAQ,GAAG,MAAMpE,uBAAuB,CAAC;IAC9C6C,QAAQ,EAAEL,OAAO,CAACK,QAAQ;IAC1BH,WAAW,EAAED,OAAO,CAACC,WAAW;IAChCuB,gBAAgB,EAAEzB,OAAO,CAACyB,gBAAgB;IAC1C5C;EACD,CAAC,CAAC;EACF,MAAM;IAAEE;EAAY,CAAC,GAAG,MAAM1B,sBAAsB,CACnDuE,QAAQ,CAACC,YAAY,EACrB5B,OAAO,CAACC,WAAW,EACnB;IAAE4B,qBAAqB,EAAE;EAAM,CAChC,CAAC;EACD,IAAI,CAAC/C,WAAW,EAAE,OAAO;IAAEoB,MAAM,EAAE;EAAY,CAAC;EAEhD,MAAM4B,QAAQ,GAAGjD,mBAAmB,CAACC,WAAW,EAAEkB,OAAO,CAACC,WAAW,CAAC;EACtE,IAAI6B,QAAQ,CAAC3C,IAAI,KAAK,OAAO,EAAE;IAC9B,OAAO;MACNe,MAAM,EAAE,QAAQ;MAChBC,MAAM,EAAE,WAAW;MACnB,IAAI2B,QAAQ,CAACnC,WAAW,GAAG;QAAEA,WAAW,EAAEmC,QAAQ,CAACnC;MAAY,CAAC,GAAG,CAAC,CAAC;IACtE,CAAC;EACF;EACA,IAAImC,QAAQ,CAAC3C,IAAI,KAAK,SAAS,EAAE;IAChC,OAAO;MAAEe,MAAM,EAAE,QAAQ;MAAEC,MAAM,EAAE;IAA0B,CAAC;EAC/D;EAEA,MAAM4B,UAAU,GAAG,MAAMzE,iBAAiB,CAAC;IAC1CqD,WAAW,EAAEZ,OAAO,CAACY,WAAW;IAChCP,QAAQ,EAAEL,OAAO,CAACK,QAAQ;IAC1BR,IAAI,EAAEkC,QAAQ,CAAClC,IAAI;IACnBoC,aAAa,EAAEF,QAAQ,CAACjC,KAAK;IAC7BoC,SAAS,EAAEN,QAAQ,CAACM,SAAS;IAC7BhC,WAAW,EAAED,OAAO,CAACC,WAAW;IAChCqB,aAAa,EAAEJ;EAChB,CAAC,CAAC;EACF,IAAID,eAAe,EAAE,OAAO;IAAEf,MAAM,EAAE,QAAQ;IAAEC,MAAM,EAAE;EAAmB,CAAC;EAC5E,OAAO4B,UAAU,CAACG,EAAE,GACjB;IAAEhC,MAAM,EAAE;EAAY,CAAC,GACvB;IAAEA,MAAM,EAAE,QAAQ;IAAEC,MAAM,EAAE4B,UAAU,CAAC5B;EAAO,CAAC;AACnD","ignoreList":[]}

package/lib/module/ui/oauth/legacyRedirectLanes.js

@@ -0,0 +1,44 @@
+"use strict";
+
+/**
+ * The legacy, redirect-mode-only lanes that navigate the RP's TOP-LEVEL window
+ * to the IdP without a user gesture.
+ *
+ * `webAuthMode: 'popup'` exists to guarantee exactly one thing: the relying
+ * party never leaves its route. Two mechanics in this SDK break that guarantee,
+ * because each replaces the whole document on its own initiative:
+ *
+ * 1. **Cold-boot silent restore** — a full-page `prompt=none` authorize bounce
+ *    to `auth.oxy.so` when the device-secret mint finds no local session
+ *    (`maybeStartSilentOAuthRestore`, called from `runProviderColdBoot`).
+ * 2. **Post-sign-in hub sync** — a full-page hop to `auth.oxy.so/sync` that
+ *    plants this device's credential on the IdP hub so OTHER origins can later
+ *    run lane 1 (`syncHubAfterSignIn`, called from the `commitSession` funnel).
+ *
+ * Both belong to the redirect transport and are kept only for the migration
+ * window (issue #691, "Cold boot and cross-domain behavior"). In popup mode a
+ * domain with no local credential simply resolves SIGNED OUT, and the user's
+ * next explicit "Continue with Oxy" opens the popup — from a real user gesture,
+ * never automatically.
+ *
+ * NOT covered here, and correctly enabled in BOTH modes: navigations the user
+ * asked for. When the browser blocks the popup, `startWebOAuthSignIn` still
+ * falls back to a full-page redirect rather than dead-ending the sign-in, and
+ * `tryCompleteOAuthReturn` still consumes a `?code=` that is already on the URL.
+ *
+ * PHASE 7b: once the pilot flips the default transport to `'popup'`, this
+ * predicate and BOTH lanes above are deleted outright. Grepping this symbol
+ * finds every site that has to go.
+ */
+
+/**
+ * Whether a provider running `webAuthMode` may perform an SDK-initiated,
+ * non-gesture, full-page navigation to the IdP.
+ *
+ * `true` only for `'redirect'` — still the default and the compatibility path,
+ * whose behaviour must stay byte-for-byte unchanged.
+ */
+export function allowsAutomaticIdpRedirect(webAuthMode) {
+  return webAuthMode === 'redirect';
+}
+//# sourceMappingURL=legacyRedirectLanes.js.map

package/lib/module/ui/oauth/legacyRedirectLanes.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["allowsAutomaticIdpRedirect","webAuthMode"],"sourceRoot":"../../../../src","sources":["ui/oauth/legacyRedirectLanes.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASA,0BAA0BA,CAACC,WAAwB,EAAW;EAC5E,OAAOA,WAAW,KAAK,UAAU;AACnC","ignoreList":[]}

package/lib/module/ui/oauth/oauthHandshake.js

@@ -0,0 +1,50 @@
+"use strict";
+
+/**
+ * The RP half of an OAuth authorize request: a fresh CSRF `state` + PKCE pair,
+ * and the authorize URL built from them.
+ *
+ * Both web transports start here, and the ONLY difference between them is one
+ * parameter: `popup` asks the IdP for `response_mode=web_message` so the result
+ * comes back to `window.opener` instead of navigating the RP's tab. Everything
+ * else — `S256` PKCE, exact registered `redirect_uri`, random `state` — is
+ * identical, which is what lets both lanes converge on one completion path.
+ */
+
+import { buildOAuthAuthorizeUrl, generateOAuthState, generatePkcePair } from '@oxy.so/core';
+
+/** Inputs for {@link prepareAuthorizeRequest}. */
+
+/** A ready-to-use authorize request plus the secrets that finish it. */
+
+/**
+ * Generate a fresh handshake and build the authorize URL around it.
+ *
+ * The verifier is returned to the caller and never stored here: the popup
+ * transport keeps it in memory for the lifetime of the attempt, and the
+ * redirect transport persists it through `persistOAuthHandshake` because a
+ * full-page navigation destroys the running document.
+ */
+export async function prepareAuthorizeRequest(params) {
+  const [pkce, state] = await Promise.all([generatePkcePair(), generateOAuthState()]);
+  const authorizeUrl = buildOAuthAuthorizeUrl({
+    authorizeBaseUrl: params.authorizeBaseUrl,
+    clientId: params.clientId,
+    redirectUri: params.redirectUri,
+    scope: params.scope,
+    state,
+    codeChallenge: pkce.codeChallenge,
+    ...(params.responseMode ? {
+      responseMode: params.responseMode
+    } : {})
+  });
+  return {
+    authorizeUrl,
+    authorizeOrigin: new URL(authorizeUrl).origin,
+    handshake: {
+      state,
+      codeVerifier: pkce.codeVerifier
+    }
+  };
+}
+//# sourceMappingURL=oauthHandshake.js.map

package/lib/module/ui/oauth/oauthHandshake.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["buildOAuthAuthorizeUrl","generateOAuthState","generatePkcePair","prepareAuthorizeRequest","params","pkce","state","Promise","all","authorizeUrl","authorizeBaseUrl","clientId","redirectUri","scope","codeChallenge","responseMode","authorizeOrigin","URL","origin","handshake","codeVerifier"],"sourceRoot":"../../../../src","sources":["ui/oauth/oauthHandshake.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAASA,sBAAsB,EAAEC,kBAAkB,EAAEC,gBAAgB,QAAQ,cAAc;;AAG3F;;AAkBA;;AAaA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeC,uBAAuBA,CAC3CC,MAAqC,EACF;EACnC,MAAM,CAACC,IAAI,EAAEC,KAAK,CAAC,GAAG,MAAMC,OAAO,CAACC,GAAG,CAAC,CAACN,gBAAgB,CAAC,CAAC,EAAED,kBAAkB,CAAC,CAAC,CAAC,CAAC;EAEnF,MAAMQ,YAAY,GAAGT,sBAAsB,CAAC;IAC1CU,gBAAgB,EAAEN,MAAM,CAACM,gBAAgB;IACzCC,QAAQ,EAAEP,MAAM,CAACO,QAAQ;IACzBC,WAAW,EAAER,MAAM,CAACQ,WAAW;IAC/BC,KAAK,EAAET,MAAM,CAACS,KAAK;IACnBP,KAAK;IACLQ,aAAa,EAAET,IAAI,CAACS,aAAa;IACjC,IAAIV,MAAM,CAACW,YAAY,GAAG;MAAEA,YAAY,EAAEX,MAAM,CAACW;IAAa,CAAC,GAAG,CAAC,CAAC;EACtE,CAAC,CAAC;EAEF,OAAO;IACLN,YAAY;IACZO,eAAe,EAAE,IAAIC,GAAG,CAACR,YAAY,CAAC,CAACS,MAAM;IAC7CC,SAAS,EAAE;MAAEb,KAAK;MAAEc,YAAY,EAAEf,IAAI,CAACe;IAAa;EACtD,CAAC;AACH","ignoreList":[]}

package/lib/module/ui/oauth/oauthPopup.js

@@ -0,0 +1,268 @@
+"use strict";
+
+/**
+ * Popup lifecycle for the web OAuth transport.
+ *
+ * Owns the window itself — opening it, navigating it, watching it, and tearing
+ * every listener and timer down — and nothing else: message validation lives in
+ * `oauthPopupMessages.ts`, and the code exchange in `completeOAuthCode.ts`.
+ *
+ * Three browser realities shape this module:
+ *
+ * - **Gesture attribution.** `window.open` only succeeds while the user's click
+ *   is still being handled. Anything awaited first (resolving the application,
+ *   generating PKCE) loses it and the popup is silently blocked. So the window
+ *   is opened EMPTY up front and navigated once the authorize URL exists —
+ *   the same shape as `passkeyHubPopup.ts`.
+ * - **No close event.** A cross-origin popup fires nothing when the user
+ *   dismisses it; polling `closed` is the only mechanism (as in core's
+ *   `AccountDialogController.watchPopup`).
+ * - **No cross-origin reads.** The popup's URL, title, and document are all
+ *   opaque. The authorization result arrives ONLY as a `postMessage`.
+ */
+
+import { canonicalizeOAuthRedirectUri, logger } from '@oxy.so/core';
+import { readOAuthPopupMessage } from "./oauthPopupMessages.js";
+/**
+ * Window name for the sign-in popup. Naming the target means a second press
+ * REUSES the same window instead of stacking a new one behind the first.
+ */
+export const OXY_OAUTH_POPUP_WINDOW_NAME = 'oxy-oauth';
+
+/** Chrome-free window roughly sized for the IdP's sign-in / QR surface. */
+const POPUP_FEATURES = 'popup=yes,width=460,height=700,menubar=no,toolbar=no,location=no,status=no';
+
+/**
+ * How long a popup sign-in may stay unanswered (ms).
+ *
+ * Generous on purpose: the IdP surface can involve scanning a QR and approving
+ * on a phone, so this tracks the authorize handle's own ~5-minute lifetime
+ * rather than a UI-scale timeout. It is a backstop against a wedged popup, not
+ * a pace-setter — a user who gives up closes the window and gets the faster
+ * `closed` outcome.
+ */
+export const DEFAULT_OAUTH_POPUP_TIMEOUT_MS = 300_000;
+
+/** How often the popup's `closed` flag is sampled (ms). */
+const CLOSE_POLL_INTERVAL_MS = 1000;
+
+/**
+ * Grace period (ms) after `closed` flips before reporting cancellation.
+ *
+ * The IdP posts its result and THEN closes itself. Both land as separate tasks,
+ * so a poll tick that happens to fall between them would otherwise turn a
+ * successful sign-in into a "user cancelled". One short grace window lets the
+ * already-queued message win.
+ */
+const CLOSE_GRACE_MS = 400;
+
+/** The `message` half of the DOM host, absent on native and during SSR. */
+
+/** The `open` half of the DOM host, absent on native and during SSR. */
+
+function messageEventHost() {
+  const win = globalThis.window;
+  if (!win || typeof win.addEventListener !== 'function' || typeof win.removeEventListener !== 'function') {
+    return null;
+  }
+  return win;
+}
+
+/**
+ * Open a new, EMPTY sign-in popup.
+ *
+ * MUST be called SYNCHRONOUSLY from a user-gesture handler, before any `await`.
+ * Returns `null` when the browser blocked it, when `window.open` threw, and on
+ * hosts with no DOM (native / SSR) — never throws, because "no popup" is an
+ * ordinary outcome the caller answers by falling back to a redirect.
+ */
+export function openOAuthPopup() {
+  const win = globalThis.window;
+  if (!win || typeof win.open !== 'function') return null;
+  try {
+    return win.open('', OXY_OAUTH_POPUP_WINDOW_NAME, POPUP_FEATURES) ?? null;
+  } catch (error) {
+    logger.warn('Could not open the OAuth sign-in popup', {
+      component: 'oauthPopup'
+    }, error);
+    return null;
+  }
+}
+
+/**
+ * Point an already-open popup at the authorize URL. Returns `false` when the
+ * assignment threw (a window closed between opening and navigating), so the
+ * caller can fall back to a redirect instead of waiting on a dead window.
+ */
+export function navigateOAuthPopup(popup, url) {
+  try {
+    popup.location.href = url;
+    return true;
+  } catch (error) {
+    logger.warn('Could not navigate the OAuth sign-in popup', {
+      component: 'oauthPopup'
+    }, error);
+    return false;
+  }
+}
+
+/** Close the popup if it is still open. Idempotent, null-safe, never throws. */
+export function closeOAuthPopup(popup) {
+  if (!popup || popup.closed) return;
+  try {
+    popup.close();
+  } catch (error) {
+    logger.debug('OAuth popup close failed', {
+      component: 'oauthPopup'
+    }, error);
+  }
+}
+
+/**
+ * When the IdP falls back to a top-level redirect inside the popup (no usable
+ * `window.opener`), a same-origin `redirect_uri` is readable from the opener.
+ * Cross-origin redirects remain opaque and are not handled here.
+ */
+function readSameOriginRedirectOutcome(popup, redirectUri, expectedState) {
+  try {
+    const href = popup.location.href;
+    if (!href) return null;
+    const popupUrl = new URL(href);
+    const expected = new URL(canonicalizeOAuthRedirectUri(redirectUri));
+    if (popupUrl.origin !== expected.origin) return null;
+    if (popupUrl.pathname !== expected.pathname) return null;
+    const oauthError = popupUrl.searchParams.get('error');
+    if (oauthError) {
+      const errorDescription = popupUrl.searchParams.get('error_description') ?? undefined;
+      return {
+        kind: 'oauth-error',
+        error: oauthError,
+        ...(errorDescription ? {
+          errorDescription
+        } : {})
+      };
+    }
+    const code = popupUrl.searchParams.get('code');
+    if (!code) return null;
+    const state = popupUrl.searchParams.get('state');
+    if (!state || state !== expectedState) return {
+      kind: 'state-mismatch'
+    };
+    return {
+      kind: 'code',
+      code,
+      state
+    };
+  } catch {
+    // Cross-origin navigation — the popup URL is opaque to the opener.
+    return null;
+  }
+}
+
+/** Inputs for {@link awaitOAuthPopupResult}. */
+
+/**
+ * Wait for the popup to deliver an authorization result.
+ *
+ * Settles EXACTLY once, with a typed outcome for every path — code, IdP error,
+ * state mismatch, user-closed, timeout — and removes its listener, its close
+ * poll, and both timers before resolving, whatever the outcome. Messages that
+ * arrive after settling reach nothing, so a duplicate delivery is inert.
+ *
+ * Never rejects: closing the window and running out of time are expected
+ * outcomes, not exceptions.
+ */
+export function awaitOAuthPopupResult(options) {
+  const {
+    popup,
+    expectedOrigin,
+    expectedState,
+    redirectUri,
+    timeoutMs = DEFAULT_OAUTH_POPUP_TIMEOUT_MS
+  } = options;
+  const host = messageEventHost();
+  if (!host) return Promise.resolve({
+    kind: 'unsupported'
+  });
+  return new Promise(resolve => {
+    let settled = false;
+    let timeoutTimer = null;
+    let closeGraceTimer = null;
+    let closePoll = null;
+    const onMessage = event => {
+      const verdict = readOAuthPopupMessage(event, {
+        expectedOrigin,
+        expectedState,
+        popup
+      });
+      switch (verdict.kind) {
+        case 'ignore':
+          return;
+        case 'code':
+          settle({
+            kind: 'code',
+            code: verdict.code,
+            state: verdict.state
+          });
+          return;
+        case 'oauth-error':
+          settle({
+            kind: 'oauth-error',
+            error: verdict.error,
+            ...(verdict.errorDescription ? {
+              errorDescription: verdict.errorDescription
+            } : {})
+          });
+          return;
+        case 'state-mismatch':
+          settle({
+            kind: 'state-mismatch'
+          });
+          return;
+      }
+    };
+    const cleanup = () => {
+      host.removeEventListener('message', onMessage);
+      if (timeoutTimer !== null) {
+        clearTimeout(timeoutTimer);
+        timeoutTimer = null;
+      }
+      if (closeGraceTimer !== null) {
+        clearTimeout(closeGraceTimer);
+        closeGraceTimer = null;
+      }
+      if (closePoll !== null) {
+        clearInterval(closePoll);
+        closePoll = null;
+      }
+    };
+    function settle(outcome) {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      resolve(outcome);
+    }
+    host.addEventListener('message', onMessage);
+    timeoutTimer = setTimeout(() => settle({
+      kind: 'timed-out'
+    }), timeoutMs);
+    closePoll = setInterval(() => {
+      const redirectOutcome = readSameOriginRedirectOutcome(popup, redirectUri, expectedState);
+      if (redirectOutcome) {
+        settle(redirectOutcome);
+        return;
+      }
+      if (!popup.closed) return;
+      // Stop sampling immediately: the window is gone and only the in-flight
+      // message (if any) can still change the outcome.
+      if (closePoll !== null) {
+        clearInterval(closePoll);
+        closePoll = null;
+      }
+      closeGraceTimer = setTimeout(() => settle({
+        kind: 'closed'
+      }), CLOSE_GRACE_MS);
+    }, CLOSE_POLL_INTERVAL_MS);
+  });
+}
+//# sourceMappingURL=oauthPopup.js.map

package/lib/module/ui/oauth/oauthPopup.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["canonicalizeOAuthRedirectUri","logger","readOAuthPopupMessage","OXY_OAUTH_POPUP_WINDOW_NAME","POPUP_FEATURES","DEFAULT_OAUTH_POPUP_TIMEOUT_MS","CLOSE_POLL_INTERVAL_MS","CLOSE_GRACE_MS","messageEventHost","win","globalThis","window","addEventListener","removeEventListener","openOAuthPopup","open","error","warn","component","navigateOAuthPopup","popup","url","location","href","closeOAuthPopup","closed","close","debug","readSameOriginRedirectOutcome","redirectUri","expectedState","popupUrl","URL","expected","origin","pathname","oauthError","searchParams","get","errorDescription","undefined","kind","code","state","awaitOAuthPopupResult","options","expectedOrigin","timeoutMs","host","Promise","resolve","settled","timeoutTimer","closeGraceTimer","closePoll","onMessage","event","verdict","settle","cleanup","clearTimeout","clearInterval","outcome","setTimeout","setInterval","redirectOutcome"],"sourceRoot":"../../../../src","sources":["ui/oauth/oauthPopup.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAASA,4BAA4B,EAAEC,MAAM,QAAQ,cAAc;AACnE,SAASC,qBAAqB,QAAQ,yBAAsB;AAG5D;AACA;AACA;AACA;AACA,OAAO,MAAMC,2BAA2B,GAAG,WAAW;;AAEtD;AACA,MAAMC,cAAc,GAAG,4EAA4E;;AAEnG;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,8BAA8B,GAAG,OAAO;;AAErD;AACA,MAAMC,sBAAsB,GAAG,IAAI;;AAEnC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMC,cAAc,GAAG,GAAG;;AAE1B;;AAMA;;AAKA,SAASC,gBAAgBA,CAAA,EAA4B;EACnD,MAAMC,GAAG,GAAIC,UAAU,CAA4CC,MAAM;EACzE,IAAI,CAACF,GAAG,IAAI,OAAOA,GAAG,CAACG,gBAAgB,KAAK,UAAU,IAAI,OAAOH,GAAG,CAACI,mBAAmB,KAAK,UAAU,EAAE;IACvG,OAAO,IAAI;EACb;EACA,OAAOJ,GAAG;AACZ;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASK,cAAcA,CAAA,EAA4B;EACxD,MAAML,GAAG,GAAIC,UAAU,CAAkCC,MAAM;EAC/D,IAAI,CAACF,GAAG,IAAI,OAAOA,GAAG,CAACM,IAAI,KAAK,UAAU,EAAE,OAAO,IAAI;EACvD,IAAI;IACF,OAAON,GAAG,CAACM,IAAI,CAAC,EAAE,EAAEZ,2BAA2B,EAAEC,cAAc,CAAC,IAAI,IAAI;EAC1E,CAAC,CAAC,OAAOY,KAAK,EAAE;IACdf,MAAM,CAACgB,IAAI,CAAC,wCAAwC,EAAE;MAAEC,SAAS,EAAE;IAAa,CAAC,EAAEF,KAAK,CAAC;IACzF,OAAO,IAAI;EACb;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASG,kBAAkBA,CAACC,KAAuB,EAAEC,GAAW,EAAW;EAChF,IAAI;IACFD,KAAK,CAACE,QAAQ,CAACC,IAAI,GAAGF,GAAG;IACzB,OAAO,IAAI;EACb,CAAC,CAAC,OAAOL,KAAK,EAAE;IACdf,MAAM,CAACgB,IAAI,CAAC,4CAA4C,EAAE;MAAEC,SAAS,EAAE;IAAa,CAAC,EAAEF,KAAK,CAAC;IAC7F,OAAO,KAAK;EACd;AACF;;AAEA;AACA,OAAO,SAASQ,eAAeA,CAACJ,KAA8B,EAAQ;EACpE,IAAI,CAACA,KAAK,IAAIA,KAAK,CAACK,MAAM,EAAE;EAC5B,IAAI;IACFL,KAAK,CAACM,KAAK,CAAC,CAAC;EACf,CAAC,CAAC,OAAOV,KAAK,EAAE;IACdf,MAAM,CAAC0B,KAAK,CAAC,0BAA0B,EAAE;MAAET,SAAS,EAAE;IAAa,CAAC,EAAEF,KAAK,CAAC;EAC9E;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA,SAASY,6BAA6BA,CACpCR,KAAuB,EACvBS,WAAmB,EACnBC,aAAqB,EACK;EAC1B,IAAI;IACF,MAAMP,IAAI,GAAGH,KAAK,CAACE,QAAQ,CAACC,IAAI;IAChC,IAAI,CAACA,IAAI,EAAE,OAAO,IAAI;IAEtB,MAAMQ,QAAQ,GAAG,IAAIC,GAAG,CAACT,IAAI,CAAC;IAC9B,MAAMU,QAAQ,GAAG,IAAID,GAAG,CAAChC,4BAA4B,CAAC6B,WAAW,CAAC,CAAC;IACnE,IAAIE,QAAQ,CAACG,MAAM,KAAKD,QAAQ,CAACC,MAAM,EAAE,OAAO,IAAI;IACpD,IAAIH,QAAQ,CAACI,QAAQ,KAAKF,QAAQ,CAACE,QAAQ,EAAE,OAAO,IAAI;IAExD,MAAMC,UAAU,GAAGL,QAAQ,CAACM,YAAY,CAACC,GAAG,CAAC,OAAO,CAAC;IACrD,IAAIF,UAAU,EAAE;MACd,MAAMG,gBAAgB,GAAGR,QAAQ,CAACM,YAAY,CAACC,GAAG,CAAC,mBAAmB,CAAC,IAAIE,SAAS;MACpF,OAAO;QACLC,IAAI,EAAE,aAAa;QACnBzB,KAAK,EAAEoB,UAAU;QACjB,IAAIG,gBAAgB,GAAG;UAAEA;QAAiB,CAAC,GAAG,CAAC,CAAC;MAClD,CAAC;IACH;IAEA,MAAMG,IAAI,GAAGX,QAAQ,CAACM,YAAY,CAACC,GAAG,CAAC,MAAM,CAAC;IAC9C,IAAI,CAACI,IAAI,EAAE,OAAO,IAAI;IAEtB,MAAMC,KAAK,GAAGZ,QAAQ,CAACM,YAAY,CAACC,GAAG,CAAC,OAAO,CAAC;IAChD,IAAI,CAACK,KAAK,IAAIA,KAAK,KAAKb,aAAa,EAAE,OAAO;MAAEW,IAAI,EAAE;IAAiB,CAAC;IACxE,OAAO;MAAEA,IAAI,EAAE,MAAM;MAAEC,IAAI;MAAEC;IAAM,CAAC;EACtC,CAAC,CAAC,MAAM;IACN;IACA,OAAO,IAAI;EACb;AACF;;AAEA;;AAkBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,qBAAqBA,CACnCC,OAA+B,EACH;EAC5B,MAAM;IACJzB,KAAK;IACL0B,cAAc;IACdhB,aAAa;IACbD,WAAW;IACXkB,SAAS,GAAG1C;EACd,CAAC,GAAGwC,OAAO;EAEX,MAAMG,IAAI,GAAGxC,gBAAgB,CAAC,CAAC;EAC/B,IAAI,CAACwC,IAAI,EAAE,OAAOC,OAAO,CAACC,OAAO,CAAC;IAAET,IAAI,EAAE;EAAc,CAAC,CAAC;EAE1D,OAAO,IAAIQ,OAAO,CAAqBC,OAAO,IAAK;IACjD,IAAIC,OAAO,GAAG,KAAK;IACnB,IAAIC,YAAkD,GAAG,IAAI;IAC7D,IAAIC,eAAqD,GAAG,IAAI;IAChE,IAAIC,SAAgD,GAAG,IAAI;IAE3D,MAAMC,SAAS,GAAIC,KAAmB,IAAW;MAC/C,MAAMC,OAAO,GAAGvD,qBAAqB,CAACsD,KAAK,EAAE;QAAEV,cAAc;QAAEhB,aAAa;QAAEV;MAAM,CAAC,CAAC;MACtF,QAAQqC,OAAO,CAAChB,IAAI;QAClB,KAAK,QAAQ;UACX;QACF,KAAK,MAAM;UACTiB,MAAM,CAAC;YAAEjB,IAAI,EAAE,MAAM;YAAEC,IAAI,EAAEe,OAAO,CAACf,IAAI;YAAEC,KAAK,EAAEc,OAAO,CAACd;UAAM,CAAC,CAAC;UAClE;QACF,KAAK,aAAa;UAChBe,MAAM,CAAC;YACLjB,IAAI,EAAE,aAAa;YACnBzB,KAAK,EAAEyC,OAAO,CAACzC,KAAK;YACpB,IAAIyC,OAAO,CAAClB,gBAAgB,GAAG;cAAEA,gBAAgB,EAAEkB,OAAO,CAAClB;YAAiB,CAAC,GAAG,CAAC,CAAC;UACpF,CAAC,CAAC;UACF;QACF,KAAK,gBAAgB;UACnBmB,MAAM,CAAC;YAAEjB,IAAI,EAAE;UAAiB,CAAC,CAAC;UAClC;MACJ;IACF,CAAC;IAED,MAAMkB,OAAO,GAAGA,CAAA,KAAY;MAC1BX,IAAI,CAACnC,mBAAmB,CAAC,SAAS,EAAE0C,SAAS,CAAC;MAC9C,IAAIH,YAAY,KAAK,IAAI,EAAE;QACzBQ,YAAY,CAACR,YAAY,CAAC;QAC1BA,YAAY,GAAG,IAAI;MACrB;MACA,IAAIC,eAAe,KAAK,IAAI,EAAE;QAC5BO,YAAY,CAACP,eAAe,CAAC;QAC7BA,eAAe,GAAG,IAAI;MACxB;MACA,IAAIC,SAAS,KAAK,IAAI,EAAE;QACtBO,aAAa,CAACP,SAAS,CAAC;QACxBA,SAAS,GAAG,IAAI;MAClB;IACF,CAAC;IAED,SAASI,MAAMA,CAACI,OAA0B,EAAQ;MAChD,IAAIX,OAAO,EAAE;MACbA,OAAO,GAAG,IAAI;MACdQ,OAAO,CAAC,CAAC;MACTT,OAAO,CAACY,OAAO,CAAC;IAClB;IAEAd,IAAI,CAACpC,gBAAgB,CAAC,SAAS,EAAE2C,SAAS,CAAC;IAE3CH,YAAY,GAAGW,UAAU,CAAC,MAAML,MAAM,CAAC;MAAEjB,IAAI,EAAE;IAAY,CAAC,CAAC,EAAEM,SAAS,CAAC;IAEzEO,SAAS,GAAGU,WAAW,CAAC,MAAM;MAC5B,MAAMC,eAAe,GAAGrC,6BAA6B,CAACR,KAAK,EAAES,WAAW,EAAEC,aAAa,CAAC;MACxF,IAAImC,eAAe,EAAE;QACnBP,MAAM,CAACO,eAAe,CAAC;QACvB;MACF;MAEA,IAAI,CAAC7C,KAAK,CAACK,MAAM,EAAE;MACnB;MACA;MACA,IAAI6B,SAAS,KAAK,IAAI,EAAE;QACtBO,aAAa,CAACP,SAAS,CAAC;QACxBA,SAAS,GAAG,IAAI;MAClB;MACAD,eAAe,GAAGU,UAAU,CAAC,MAAML,MAAM,CAAC;QAAEjB,IAAI,EAAE;MAAS,CAAC,CAAC,EAAElC,cAAc,CAAC;IAChF,CAAC,EAAED,sBAAsB,CAAC;EAC5B,CAAC,CAAC;AACJ","ignoreList":[]}