@portaidentity/server 1.7.0

package/dist/middleware/admin-cors.js

@@ -0,0 +1,83 @@
+/**
+ * Admin API CORS allow-list middleware.
+ *
+ * Implements a strict CORS policy for `/api/admin/*` endpoints.
+ * By default (empty `adminCorsOrigins` config), **no CORS headers are
+ * emitted** — all cross-origin requests are blocked by the browser.
+ *
+ * When `ADMIN_CORS_ORIGINS` is configured with one or more origin URLs,
+ * only those exact origins receive CORS headers.  This is intended for
+ * operators who deploy a web-based admin dashboard on a different origin.
+ *
+ * Non-browser clients (CLI, same-origin requests) never send an `Origin`
+ * header, so they pass through this middleware untouched.
+ *
+ * Placement: mount after the admin metadata router and before
+ * `setAdminAuthProvider()` — preflight `OPTIONS` requests don't carry
+ * an `Authorization` header, so CORS must respond before auth runs.
+ *
+ * @module middleware/admin-cors
+ */
+// ---------------------------------------------------------------------------
+// Constants — exported for test assertions
+// ---------------------------------------------------------------------------
+/** HTTP methods allowed for cross-origin admin API requests. */
+export const CORS_ALLOWED_METHODS = 'GET, POST, PUT, PATCH, DELETE, OPTIONS';
+/** HTTP headers allowed in cross-origin admin API requests. */
+export const CORS_ALLOWED_HEADERS = 'Authorization, Content-Type';
+/** Preflight cache duration in seconds (24 hours). */
+export const CORS_MAX_AGE = '86400';
+// ---------------------------------------------------------------------------
+// Middleware factory
+// ---------------------------------------------------------------------------
+/**
+ * Create admin CORS middleware with the given application config.
+ *
+ * Uses a `Set` for O(1) origin lookup.  The `Vary: Origin` header is
+ * required by the CORS specification when `Access-Control-Allow-Origin`
+ * is not the wildcard `*` — it tells caches that the response varies by
+ * the request's `Origin` header.
+ *
+ * @param config - Application config (reads `adminCorsOrigins`)
+ * @returns Koa middleware that handles CORS for `/api/admin/*` routes
+ */
+export function adminCors(config) {
+    // Pre-compute the Set once at middleware creation time —
+    // config doesn't change at runtime.
+    const allowedOrigins = new Set(config.adminCorsOrigins);
+    return async function adminCorsMiddleware(ctx, next) {
+        // Only process requests to admin API paths.
+        // Non-admin paths (health, OIDC, interactions, etc.) are unaffected.
+        if (!ctx.path.startsWith('/api/admin')) {
+            return next();
+        }
+        const origin = ctx.get('Origin');
+        // No Origin header → not a cross-origin request (same-origin browser
+        // request, CLI tool, or server-to-server call).  Pass through.
+        if (!origin) {
+            return next();
+        }
+        // Check if the requesting origin is in the allow-list.
+        // Only emit CORS headers when there's an explicit match.
+        if (allowedOrigins.size > 0 && allowedOrigins.has(origin)) {
+            ctx.set('Access-Control-Allow-Origin', origin);
+            ctx.set('Access-Control-Allow-Credentials', 'true');
+            ctx.set('Access-Control-Allow-Methods', CORS_ALLOWED_METHODS);
+            ctx.set('Access-Control-Allow-Headers', CORS_ALLOWED_HEADERS);
+            ctx.set('Access-Control-Max-Age', CORS_MAX_AGE);
+            // Vary: Origin is required by CORS spec — responses differ per origin.
+            ctx.set('Vary', 'Origin');
+        }
+        // Handle preflight requests — browsers send OPTIONS before the real
+        // request to check CORS policy.  Respond with 204 regardless of
+        // whether the origin matched: if headers weren't set, the browser
+        // sees no CORS permission and blocks the follow-up request.
+        if (ctx.method === 'OPTIONS') {
+            ctx.status = 204;
+            ctx.body = '';
+            return;
+        }
+        return next();
+    };
+}
+//# sourceMappingURL=admin-cors.js.map

package/dist/middleware/admin-cors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-cors.js","sourceRoot":"","sources":["../../src/middleware/admin-cors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAKH,8EAA8E;AAC9E,2CAA2C;AAC3C,8EAA8E;AAE9E,gEAAgE;AAChE,MAAM,CAAC,MAAM,oBAAoB,GAAG,wCAAwC,CAAC;AAE7E,+DAA+D;AAC/D,MAAM,CAAC,MAAM,oBAAoB,GAAG,6BAA6B,CAAC;AAElE,sDAAsD;AACtD,MAAM,CAAC,MAAM,YAAY,GAAG,OAAO,CAAC;AAEpC,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,SAAS,CAAC,MAAiB;IACzC,yDAAyD;IACzD,oCAAoC;IACpC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAExD,OAAO,KAAK,UAAU,mBAAmB,CAAC,GAAG,EAAE,IAAI;QACjD,4CAA4C;QAC5C,qEAAqE;QACrE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAEjC,qEAAqE;QACrE,+DAA+D;QAC/D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,uDAAuD;QACvD,yDAAyD;QACzD,IAAI,cAAc,CAAC,IAAI,GAAG,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,GAAG,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAC;YAC/C,GAAG,CAAC,GAAG,CAAC,kCAAkC,EAAE,MAAM,CAAC,CAAC;YACpD,GAAG,CAAC,GAAG,CAAC,8BAA8B,EAAE,oBAAoB,CAAC,CAAC;YAC9D,GAAG,CAAC,GAAG,CAAC,8BAA8B,EAAE,oBAAoB,CAAC,CAAC;YAC9D,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,YAAY,CAAC,CAAC;YAChD,uEAAuE;YACvE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC5B,CAAC;QAED,oEAAoE;QACpE,gEAAgE;QAChE,kEAAkE;QAClE,4DAA4D;QAC5D,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;YACd,OAAO;QACT,CAAC;QAED,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/admin-mutation-audit.d.ts

@@ -0,0 +1,9 @@
+import type { Middleware } from 'koa';
+/**
+ * Atomically bind successful administrative mutations to one durable audit row.
+ *
+ * Bulk and import own specialized transaction/result semantics and are excluded here. Every other
+ * state-changing admin request shares one request-local PostgreSQL client across repository calls.
+ */
+export declare function adminMutationAudit(): Middleware;
+//# sourceMappingURL=admin-mutation-audit.d.ts.map

package/dist/middleware/admin-mutation-audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-mutation-audit.d.ts","sourceRoot":"","sources":["../../src/middleware/admin-mutation-audit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AA2BtC;;;;;GAKG;AACH,wBAAgB,kBAAkB,IAAI,UAAU,CA2C/C"}

package/dist/middleware/admin-mutation-audit.js

@@ -0,0 +1,76 @@
+import { writeAuditLogInTransaction } from '../lib/audit-log.js';
+import { getDatabaseTransactionClient, runDatabaseTransaction } from '../lib/database.js';
+import { normalizedRouteTemplate, recordSecurityDecision } from '../security/decision-context.js';
+const MUTATION_METHODS = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
+const SELF_MANAGED_MUTATION_PREFIXES = ['/api/admin/bulk', '/api/admin/import'];
+/** Internal signal used to roll back a handled non-success response without replacing its body. */
+class HandledMutationRejection extends Error {
+}
+/** Koa-compatible errors retain their public status after the transaction rolls back. */
+function isPublicHttpError(error) {
+    if (!(error instanceof Error))
+        return false;
+    const status = Reflect.get(error, 'status');
+    return typeof status === 'number' && status >= 400 && status < 500;
+}
+/** Return whether a request belongs to the generic administrative mutation transaction. */
+function ownsAdministrativeMutation(method, path) {
+    return (MUTATION_METHODS.has(method) &&
+        path.startsWith('/api/admin/') &&
+        !SELF_MANAGED_MUTATION_PREFIXES.some((prefix) => path.startsWith(prefix)));
+}
+/**
+ * Atomically bind successful administrative mutations to one durable audit row.
+ *
+ * Bulk and import own specialized transaction/result semantics and are excluded here. Every other
+ * state-changing admin request shares one request-local PostgreSQL client across repository calls.
+ */
+export function adminMutationAudit() {
+    return async (ctx, next) => {
+        if (!ownsAdministrativeMutation(ctx.method, ctx.path)) {
+            await next();
+            return;
+        }
+        try {
+            await runDatabaseTransaction(async () => {
+                await next();
+                if (ctx.status >= 400)
+                    throw new HandledMutationRejection();
+                const client = getDatabaseTransactionClient();
+                if (!client)
+                    throw new Error('Administrative mutation transaction is unavailable');
+                const actor = ctx.state.adminUser;
+                if (!actor)
+                    throw new Error('Administrative mutation actor is unavailable');
+                await writeAuditLogInTransaction(client, {
+                    organizationId: actor.organizationId,
+                    actorId: actor.id,
+                    eventType: 'admin.mutation.committed',
+                    eventCategory: 'admin',
+                    metadata: {
+                        method: ctx.method,
+                        routeTemplate: normalizedRouteTemplate(ctx),
+                    },
+                });
+            });
+        }
+        catch (error) {
+            if (error instanceof HandledMutationRejection)
+                return;
+            if (isPublicHttpError(error))
+                throw error;
+            recordSecurityDecision(ctx, {
+                decisionPoint: 'handler',
+                reasonCode: 'handler-failed',
+                outcome: 'error',
+            });
+            ctx.status = 503;
+            ctx.body = {
+                error: 'Administrative request could not be completed',
+                code: 'admin_mutation_unavailable',
+                requestId: ctx.state.requestId,
+            };
+        }
+    };
+}
+//# sourceMappingURL=admin-mutation-audit.js.map

package/dist/middleware/admin-mutation-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-mutation-audit.js","sourceRoot":"","sources":["../../src/middleware/admin-mutation-audit.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,4BAA4B,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC1F,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAElG,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AACrE,MAAM,8BAA8B,GAAG,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;AAEhF,mGAAmG;AACnG,MAAM,wBAAyB,SAAQ,KAAK;CAAG;AAE/C,yFAAyF;AACzF,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC5C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,CAAC;AACrE,CAAC;AAED,2FAA2F;AAC3F,SAAS,0BAA0B,CAAC,MAAc,EAAE,IAAY;IAC9D,OAAO,CACL,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC;QAC9B,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAC1E,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,sBAAsB,CAAC,KAAK,IAAI,EAAE;gBACtC,MAAM,IAAI,EAAE,CAAC;gBACb,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG;oBAAE,MAAM,IAAI,wBAAwB,EAAE,CAAC;gBAE5D,MAAM,MAAM,GAAG,4BAA4B,EAAE,CAAC;gBAC9C,IAAI,CAAC,MAAM;oBAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;gBACnF,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;gBAClC,IAAI,CAAC,KAAK;oBAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;gBAC5E,MAAM,0BAA0B,CAAC,MAAM,EAAE;oBACvC,cAAc,EAAE,KAAK,CAAC,cAAc;oBACpC,OAAO,EAAE,KAAK,CAAC,EAAE;oBACjB,SAAS,EAAE,0BAA0B;oBACrC,aAAa,EAAE,OAAO;oBACtB,QAAQ,EAAE;wBACR,MAAM,EAAE,GAAG,CAAC,MAAM;wBAClB,aAAa,EAAE,uBAAuB,CAAC,GAAG,CAAC;qBAC5C;iBACF,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,wBAAwB;gBAAE,OAAO;YACtD,IAAI,iBAAiB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC1C,sBAAsB,CAAC,GAAG,EAAE;gBAC1B,aAAa,EAAE,SAAS;gBACxB,UAAU,EAAE,gBAAgB;gBAC5B,OAAO,EAAE,OAAO;aACjB,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG;gBACT,KAAK,EAAE,+CAA+C;gBACtD,IAAI,EAAE,4BAA4B;gBAClC,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,SAAS;aAC/B,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/admin-rate-limiter.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Admin API rate limiter middleware.
+ *
+ * Protects state-changing admin endpoints (POST/PUT/PATCH/DELETE on
+ * `/api/admin/*`) against brute-force attacks and automated abuse.
+ * GET requests are read-only and pass through without rate limiting.
+ *
+ * Key format: `ratelimit:admin:{ip}` — per-IP only since admin-auth
+ * already restricts access to authenticated super-admin users.  There
+ * is no per-user key because the IP-based counter is sufficient:
+ * legitimate admins won't make 60 write requests per minute, and
+ * attackers from the same IP are blocked regardless of identity.
+ *
+ * Limit: 60 requests / 60 seconds (sliding window).
+ *
+ * Reuses `checkRateLimit()` from `src/auth/rate-limiter.ts` which
+ * provides Redis INCR+EXPIRE sliding window and graceful degradation
+ * on Redis failure (allows request + logs warning).
+ *
+ * Placement: mount as global middleware in `src/server.ts` before the
+ * admin route routers.  The path + method check ensures only write
+ * requests to `/api/admin/*` are counted.
+ *
+ * @module middleware/admin-rate-limiter
+ */
+import type { Middleware } from 'koa';
+import type { RateLimitConfig } from '../auth/rate-limiter.js';
+/** Path prefix for admin API routes. */
+export declare const ADMIN_PATH_PREFIX = "/api/admin/";
+/**
+ * HTTP methods that are considered state-changing (write operations).
+ * Only these methods are rate-limited; GET/HEAD/OPTIONS pass through.
+ */
+export declare const ADMIN_WRITE_METHODS: Set<string>;
+/**
+ * Rate limit configuration for admin API write operations.
+ *
+ * 60 requests per 60-second window — generous enough for admin
+ * workflows (bulk operations, rapid CRUD during setup) while catching
+ * automated abuse or runaway scripts.
+ */
+export declare const ADMIN_RATE_LIMIT: RateLimitConfig;
+/**
+ * Create the admin API rate limiter middleware.
+ *
+ * Only intercepts requests that match ALL of:
+ *   - Path starts with `/api/admin/`
+ *   - Method is POST, PUT, PATCH, or DELETE
+ *
+ * Sets informational `X-RateLimit-*` headers on every matched response
+ * and returns `429` with a JSON error body when the limit is exceeded.
+ *
+ * @returns Koa middleware that rate-limits admin API write operations
+ */
+export declare function adminRateLimiter(): Middleware;
+//# sourceMappingURL=admin-rate-limiter.d.ts.map

package/dist/middleware/admin-rate-limiter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-rate-limiter.d.ts","sourceRoot":"","sources":["../../src/middleware/admin-rate-limiter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AAEtC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAO/D,wCAAwC;AACxC,eAAO,MAAM,iBAAiB,gBAAgB,CAAC;AAE/C;;;GAGG;AACH,eAAO,MAAM,mBAAmB,aAA8C,CAAC;AAE/E;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,EAAE,eAG9B,CAAC;AAMF;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,IAAI,UAAU,CAyC7C"}

package/dist/middleware/admin-rate-limiter.js

@@ -0,0 +1,97 @@
+/**
+ * Admin API rate limiter middleware.
+ *
+ * Protects state-changing admin endpoints (POST/PUT/PATCH/DELETE on
+ * `/api/admin/*`) against brute-force attacks and automated abuse.
+ * GET requests are read-only and pass through without rate limiting.
+ *
+ * Key format: `ratelimit:admin:{ip}` — per-IP only since admin-auth
+ * already restricts access to authenticated super-admin users.  There
+ * is no per-user key because the IP-based counter is sufficient:
+ * legitimate admins won't make 60 write requests per minute, and
+ * attackers from the same IP are blocked regardless of identity.
+ *
+ * Limit: 60 requests / 60 seconds (sliding window).
+ *
+ * Reuses `checkRateLimit()` from `src/auth/rate-limiter.ts` which
+ * provides Redis INCR+EXPIRE sliding window and graceful degradation
+ * on Redis failure (allows request + logs warning).
+ *
+ * Placement: mount as global middleware in `src/server.ts` before the
+ * admin route routers.  The path + method check ensures only write
+ * requests to `/api/admin/*` are counted.
+ *
+ * @module middleware/admin-rate-limiter
+ */
+import { checkRateLimit } from '../auth/rate-limiter.js';
+import { logger } from '../lib/logger.js';
+// ---------------------------------------------------------------------------
+// Constants — exported for test assertions and documentation
+// ---------------------------------------------------------------------------
+/** Path prefix for admin API routes. */
+export const ADMIN_PATH_PREFIX = '/api/admin/';
+/**
+ * HTTP methods that are considered state-changing (write operations).
+ * Only these methods are rate-limited; GET/HEAD/OPTIONS pass through.
+ */
+export const ADMIN_WRITE_METHODS = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
+/**
+ * Rate limit configuration for admin API write operations.
+ *
+ * 60 requests per 60-second window — generous enough for admin
+ * workflows (bulk operations, rapid CRUD during setup) while catching
+ * automated abuse or runaway scripts.
+ */
+export const ADMIN_RATE_LIMIT = {
+    max: 60,
+    windowSeconds: 60,
+};
+// ---------------------------------------------------------------------------
+// Middleware factory
+// ---------------------------------------------------------------------------
+/**
+ * Create the admin API rate limiter middleware.
+ *
+ * Only intercepts requests that match ALL of:
+ *   - Path starts with `/api/admin/`
+ *   - Method is POST, PUT, PATCH, or DELETE
+ *
+ * Sets informational `X-RateLimit-*` headers on every matched response
+ * and returns `429` with a JSON error body when the limit is exceeded.
+ *
+ * @returns Koa middleware that rate-limits admin API write operations
+ */
+export function adminRateLimiter() {
+    return async function adminRateLimiterMiddleware(ctx, next) {
+        // Only rate-limit write methods on admin API paths — GETs and
+        // non-admin paths pass through immediately without touching Redis.
+        if (!ctx.path.startsWith(ADMIN_PATH_PREFIX) || !ADMIN_WRITE_METHODS.has(ctx.method)) {
+            return next();
+        }
+        // Per-IP key — no user identifier needed since admin-auth already
+        // filters out unauthenticated requests, and legitimate admins
+        // won't hit 60 writes/minute under normal conditions.
+        const key = `ratelimit:admin:${ctx.ip}`;
+        const result = await checkRateLimit(key, ADMIN_RATE_LIMIT);
+        // Informational headers on all matched responses — helps admin
+        // clients (CLI, dashboards) monitor their usage.
+        ctx.set('X-RateLimit-Limit', String(ADMIN_RATE_LIMIT.max));
+        ctx.set('X-RateLimit-Remaining', String(result.remaining));
+        if (!result.allowed) {
+            logger.warn({
+                action: 'admin_rate_limit_exceeded',
+                method: ctx.method,
+            }, 'Admin API rate limit exceeded');
+            ctx.status = 429;
+            ctx.set('Retry-After', String(result.retryAfter));
+            ctx.body = {
+                error: 'Too Many Requests',
+                message: 'Admin API rate limit exceeded. Please try again later.',
+                retry_after: result.retryAfter,
+            };
+            return;
+        }
+        return next();
+    };
+}
+//# sourceMappingURL=admin-rate-limiter.js.map

package/dist/middleware/admin-rate-limiter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-rate-limiter.js","sourceRoot":"","sources":["../../src/middleware/admin-rate-limiter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAEzD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,8EAA8E;AAC9E,6DAA6D;AAC7D,8EAA8E;AAE9E,wCAAwC;AACxC,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAC;AAE/C;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAE/E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAoB;IAC/C,GAAG,EAAE,EAAE;IACP,aAAa,EAAE,EAAE;CAClB,CAAC;AAEF,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,KAAK,UAAU,0BAA0B,CAAC,GAAG,EAAE,IAAI;QACxD,8DAA8D;QAC9D,mEAAmE;QACnE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACpF,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,kEAAkE;QAClE,8DAA8D;QAC9D,sDAAsD;QACtD,MAAM,GAAG,GAAG,mBAAmB,GAAG,CAAC,EAAE,EAAE,CAAC;QAExC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QAE3D,+DAA+D;QAC/D,iDAAiD;QACjD,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAE3D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CACT;gBACE,MAAM,EAAE,2BAA2B;gBACnC,MAAM,EAAE,GAAG,CAAC,MAAM;aACnB,EACD,+BAA+B,CAChC,CAAC;YAEF,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;YAClD,GAAG,CAAC,IAAI,GAAG;gBACT,KAAK,EAAE,mBAAmB;gBAC1B,OAAO,EAAE,wDAAwD;gBACjE,WAAW,EAAE,MAAM,CAAC,UAAU;aAC/B,CAAC;YACF,OAAO;QACT,CAAC;QAED,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/client-secret-hash.d.ts

@@ -0,0 +1,34 @@
+/**
+ * SHA-256 client secret pre-hashing middleware.
+ *
+ * Transforms client_secret values in incoming requests by replacing
+ * the plaintext with its SHA-256 hash BEFORE oidc-provider processes them.
+ *
+ * Supports:
+ * - client_secret_basic: Authorization: Basic base64(client_id:secret)
+ * - client_secret_post: client_secret in POST body
+ *
+ * This allows oidc-provider's built-in string comparison to work
+ * with our SHA-256-hashed secret storage — no monkey-patching needed.
+ *
+ * How it works:
+ * 1. At secret generation: SHA-256(secret) is stored in the DB
+ * 2. At request time: This middleware hashes the presented secret
+ * 3. In the adapter: findForOidc() returns SHA-256 hash as client_secret
+ * 4. oidc-provider compares: SHA-256(presented) === SHA-256(stored) → ✅ MATCH
+ *
+ * Security: SHA-256 is appropriate for machine-generated, high-entropy
+ * client secrets (48 bytes / 384 bits of randomness).
+ */
+import type { Middleware } from 'koa';
+/**
+ * Create middleware that pre-hashes client secrets with SHA-256.
+ *
+ * Must be mounted BEFORE oidc-provider's callback handler on the
+ * OIDC router. Transparently transforms secrets so oidc-provider
+ * can compare them against stored SHA-256 hashes.
+ *
+ * @returns Koa middleware function
+ */
+export declare function clientSecretHash(): Middleware;
+//# sourceMappingURL=client-secret-hash.d.ts.map

package/dist/middleware/client-secret-hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-secret-hash.d.ts","sourceRoot":"","sources":["../../src/middleware/client-secret-hash.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AAStC;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,IAAI,UAAU,CAqC7C"}

package/dist/middleware/client-secret-hash.js

@@ -0,0 +1,74 @@
+/**
+ * SHA-256 client secret pre-hashing middleware.
+ *
+ * Transforms client_secret values in incoming requests by replacing
+ * the plaintext with its SHA-256 hash BEFORE oidc-provider processes them.
+ *
+ * Supports:
+ * - client_secret_basic: Authorization: Basic base64(client_id:secret)
+ * - client_secret_post: client_secret in POST body
+ *
+ * This allows oidc-provider's built-in string comparison to work
+ * with our SHA-256-hashed secret storage — no monkey-patching needed.
+ *
+ * How it works:
+ * 1. At secret generation: SHA-256(secret) is stored in the DB
+ * 2. At request time: This middleware hashes the presented secret
+ * 3. In the adapter: findForOidc() returns SHA-256 hash as client_secret
+ * 4. oidc-provider compares: SHA-256(presented) === SHA-256(stored) → ✅ MATCH
+ *
+ * Security: SHA-256 is appropriate for machine-generated, high-entropy
+ * client secrets (48 bytes / 384 bits of randomness).
+ */
+import { createHash } from 'node:crypto';
+/**
+ * Compute SHA-256 hash of a string, returned as hex.
+ */
+function sha256(input) {
+    return createHash('sha256').update(input).digest('hex');
+}
+/**
+ * Create middleware that pre-hashes client secrets with SHA-256.
+ *
+ * Must be mounted BEFORE oidc-provider's callback handler on the
+ * OIDC router. Transparently transforms secrets so oidc-provider
+ * can compare them against stored SHA-256 hashes.
+ *
+ * @returns Koa middleware function
+ */
+export function clientSecretHash() {
+    return async (ctx, next) => {
+        // Handle client_secret_basic: Authorization: Basic base64(client_id:secret)
+        const authHeader = ctx.headers.authorization;
+        if (authHeader && authHeader.startsWith('Basic ')) {
+            try {
+                const encoded = authHeader.slice(6); // strip 'Basic '
+                const decoded = Buffer.from(encoded, 'base64').toString('utf8');
+                const colonIndex = decoded.indexOf(':');
+                if (colonIndex !== -1) {
+                    const clientId = decoded.slice(0, colonIndex);
+                    const secret = decoded.slice(colonIndex + 1);
+                    if (secret.length > 0) {
+                        // Hash the secret and re-encode the Basic auth header
+                        const hashedSecret = sha256(secret);
+                        const newEncoded = Buffer.from(`${clientId}:${hashedSecret}`).toString('base64');
+                        ctx.headers.authorization = `Basic ${newEncoded}`;
+                        // Also update the raw request header for oidc-provider
+                        ctx.req.headers.authorization = `Basic ${newEncoded}`;
+                    }
+                }
+            }
+            catch {
+                // Malformed Basic auth — let oidc-provider handle the error
+            }
+        }
+        // Handle client_secret_post: client_secret in POST body
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const body = ctx.request.body;
+        if (body && typeof body.client_secret === 'string' && body.client_secret.length > 0) {
+            body.client_secret = sha256(body.client_secret);
+        }
+        await next();
+    };
+}
+//# sourceMappingURL=client-secret-hash.js.map

package/dist/middleware/client-secret-hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-secret-hash.js","sourceRoot":"","sources":["../../src/middleware/client-secret-hash.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC;;GAEG;AACH,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,4EAA4E;QAC5E,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QAC7C,IAAI,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClD,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB;gBACtD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAChE,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAExC,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;oBACtB,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;oBAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;oBAE7C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACtB,sDAAsD;wBACtD,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;wBACpC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;wBACjF,GAAG,CAAC,OAAO,CAAC,aAAa,GAAG,SAAS,UAAU,EAAE,CAAC;wBAClD,uDAAuD;wBACvD,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,GAAG,SAAS,UAAU,EAAE,CAAC;oBACxD,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,4DAA4D;YAC9D,CAAC;QACH,CAAC;QAED,wDAAwD;QACxD,8DAA8D;QAC9D,MAAM,IAAI,GAAI,GAAG,CAAC,OAAe,CAAC,IAAI,CAAC;QACvC,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpF,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/error-handler.d.ts

@@ -0,0 +1,3 @@
+import type { Middleware } from 'koa';
+export declare function errorHandler(): Middleware;
+//# sourceMappingURL=error-handler.d.ts.map

package/dist/middleware/error-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-handler.d.ts","sourceRoot":"","sources":["../../src/middleware/error-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AAItC,wBAAgB,YAAY,IAAI,UAAU,CAsEzC"}

package/dist/middleware/error-handler.js

@@ -0,0 +1,93 @@
+import { logger } from '../lib/logger.js';
+import { recordSecurityDecision } from '../security/decision-context.js';
+export function errorHandler() {
+    return async (ctx, next) => {
+        try {
+            await next();
+        }
+        catch (err) {
+            const error = err;
+            ctx.status = error.status || 500;
+            ctx.body = {
+                error: publicErrorMessage(ctx.status),
+                status: ctx.status,
+            };
+            if (ctx.status === 401) {
+                recordSecurityDecision(ctx, {
+                    decisionPoint: 'authentication',
+                    reasonCode: 'authentication-required',
+                    outcome: 'deny',
+                });
+            }
+            else if (ctx.status === 403) {
+                recordSecurityDecision(ctx, {
+                    decisionPoint: 'permission',
+                    reasonCode: 'permission-required',
+                    outcome: 'deny',
+                });
+            }
+            else if (ctx.status === 413) {
+                recordSecurityDecision(ctx, {
+                    decisionPoint: 'validation',
+                    reasonCode: 'body-too-large',
+                    outcome: 'deny',
+                });
+            }
+            else if (ctx.status === 400) {
+                recordSecurityDecision(ctx, {
+                    decisionPoint: 'validation',
+                    reasonCode: 'malformed-body',
+                    outcome: 'deny',
+                });
+            }
+            else if (ctx.status === 404) {
+                recordSecurityDecision(ctx, {
+                    decisionPoint: 'resource',
+                    reasonCode: 'resource-not-found',
+                    outcome: 'deny',
+                });
+            }
+            else if (ctx.status === 405) {
+                recordSecurityDecision(ctx, {
+                    decisionPoint: 'validation',
+                    reasonCode: 'method-not-allowed',
+                    outcome: 'deny',
+                });
+            }
+            else if (ctx.status < 500) {
+                recordSecurityDecision(ctx, {
+                    decisionPoint: 'validation',
+                    reasonCode: 'schema-invalid',
+                    outcome: 'deny',
+                });
+            }
+            else {
+                recordSecurityDecision(ctx, {
+                    decisionPoint: 'handler',
+                    reasonCode: 'handler-failed',
+                    outcome: 'error',
+                });
+            }
+            if (ctx.status >= 500) {
+                logger.error({ event: 'request-handler-failed', requestId: ctx.state.requestId }, 'Request handler failed');
+            }
+        }
+    };
+}
+/** Return one minimal public error label without exposing a thrown diagnostic. */
+function publicErrorMessage(status) {
+    if (status === 400)
+        return 'Bad Request';
+    if (status === 401)
+        return 'Unauthorized';
+    if (status === 403)
+        return 'Forbidden';
+    if (status === 404)
+        return 'Not Found';
+    if (status === 405)
+        return 'Method Not Allowed';
+    if (status === 413)
+        return 'Payload Too Large';
+    return status < 500 ? 'Request Rejected' : 'Internal Server Error';
+}
+//# sourceMappingURL=error-handler.js.map

package/dist/middleware/error-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-handler.js","sourceRoot":"","sources":["../../src/middleware/error-handler.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAEzE,MAAM,UAAU,YAAY;IAC1B,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,IAAI,CAAC;YACH,MAAM,IAAI,EAAE,CAAC;QACf,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,GAAoD,CAAC;YACnE,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,GAAG,CAAC;YACjC,GAAG,CAAC,IAAI,GAAG;gBACT,KAAK,EAAE,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC;gBACrC,MAAM,EAAE,GAAG,CAAC,MAAM;aACnB,CAAC;YAEF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvB,sBAAsB,CAAC,GAAG,EAAE;oBAC1B,aAAa,EAAE,gBAAgB;oBAC/B,UAAU,EAAE,yBAAyB;oBACrC,OAAO,EAAE,MAAM;iBAChB,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC9B,sBAAsB,CAAC,GAAG,EAAE;oBAC1B,aAAa,EAAE,YAAY;oBAC3B,UAAU,EAAE,qBAAqB;oBACjC,OAAO,EAAE,MAAM;iBAChB,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC9B,sBAAsB,CAAC,GAAG,EAAE;oBAC1B,aAAa,EAAE,YAAY;oBAC3B,UAAU,EAAE,gBAAgB;oBAC5B,OAAO,EAAE,MAAM;iBAChB,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC9B,sBAAsB,CAAC,GAAG,EAAE;oBAC1B,aAAa,EAAE,YAAY;oBAC3B,UAAU,EAAE,gBAAgB;oBAC5B,OAAO,EAAE,MAAM;iBAChB,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC9B,sBAAsB,CAAC,GAAG,EAAE;oBAC1B,aAAa,EAAE,UAAU;oBACzB,UAAU,EAAE,oBAAoB;oBAChC,OAAO,EAAE,MAAM;iBAChB,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC9B,sBAAsB,CAAC,GAAG,EAAE;oBAC1B,aAAa,EAAE,YAAY;oBAC3B,UAAU,EAAE,oBAAoB;oBAChC,OAAO,EAAE,MAAM;iBAChB,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;gBAC5B,sBAAsB,CAAC,GAAG,EAAE;oBAC1B,aAAa,EAAE,YAAY;oBAC3B,UAAU,EAAE,gBAAgB;oBAC5B,OAAO,EAAE,MAAM;iBAChB,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,sBAAsB,CAAC,GAAG,EAAE;oBAC1B,aAAa,EAAE,SAAS;oBACxB,UAAU,EAAE,gBAAgB;oBAC5B,OAAO,EAAE,OAAO;iBACjB,CAAC,CAAC;YACL,CAAC;YAED,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;gBACtB,MAAM,CAAC,KAAK,CACV,EAAE,KAAK,EAAE,wBAAwB,EAAE,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,EACnE,wBAAwB,CACzB,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,SAAS,kBAAkB,CAAC,MAAc;IACxC,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,aAAa,CAAC;IACzC,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,cAAc,CAAC;IAC1C,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,WAAW,CAAC;IACvC,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,WAAW,CAAC;IACvC,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,oBAAoB,CAAC;IAChD,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,mBAAmB,CAAC;IAC/C,OAAO,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,uBAAuB,CAAC;AACrE,CAAC"}

package/dist/middleware/health.d.ts

@@ -0,0 +1,3 @@
+import type { Middleware } from 'koa';
+export declare function healthCheck(): Middleware;
+//# sourceMappingURL=health.d.ts.map

package/dist/middleware/health.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.d.ts","sourceRoot":"","sources":["../../src/middleware/health.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AAItC,wBAAgB,WAAW,IAAI,UAAU,CAgCxC"}

package/dist/middleware/health.js

@@ -0,0 +1,35 @@
+import { getPool } from '../lib/database.js';
+import { getRedis } from '../lib/redis.js';
+export function healthCheck() {
+    return async (ctx) => {
+        const checks = { server: 'ok' };
+        let healthy = true;
+        // Check PostgreSQL
+        try {
+            const pool = getPool();
+            await pool.query('SELECT 1');
+            checks.database = 'ok';
+        }
+        catch {
+            checks.database = 'error';
+            healthy = false;
+        }
+        // Check Redis
+        try {
+            const redis = getRedis();
+            await redis.ping();
+            checks.redis = 'ok';
+        }
+        catch {
+            checks.redis = 'error';
+            healthy = false;
+        }
+        ctx.status = healthy ? 200 : 503;
+        ctx.body = {
+            status: healthy ? 'healthy' : 'unhealthy',
+            checks,
+            timestamp: new Date().toISOString(),
+        };
+    };
+}
+//# sourceMappingURL=health.js.map

package/dist/middleware/health.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.js","sourceRoot":"","sources":["../../src/middleware/health.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE3C,MAAM,UAAU,WAAW;IACzB,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,MAAM,MAAM,GAA2B,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACxD,IAAI,OAAO,GAAG,IAAI,CAAC;QAEnB,mBAAmB;QACnB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAC7B,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,QAAQ,GAAG,OAAO,CAAC;YAC1B,OAAO,GAAG,KAAK,CAAC;QAClB,CAAC;QAED,cAAc;QACd,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;YACzB,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;YACnB,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,KAAK,GAAG,OAAO,CAAC;YACvB,OAAO,GAAG,KAAK,CAAC;QAClB,CAAC;QAED,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACjC,GAAG,CAAC,IAAI,GAAG;YACT,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW;YACzC,MAAM;YACN,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}