@portaidentity/server 1.7.0

package/dist/oidc/configuration.js

@@ -0,0 +1,531 @@
+/**
+ * OIDC provider configuration builder.
+ *
+ * Builds the complete node-oidc-provider configuration object from external
+ * dependencies (TTLs, keys, adapter factory, finders). This is a pure function
+ * with no side effects — all dependencies are injected as parameters.
+ *
+ * The configuration enables:
+ * - Hybrid adapter (Postgres/Redis) for OIDC artifact storage
+ * - ES256 signing keys loaded from the database
+ * - Client lookup via adapter pattern (adapter.find('Client', id) → findForOidc())
+ * - PKCE required for all authorization code flows (S256 only)
+ * - Token introspection, revocation, and client credentials
+ * - Standard OIDC scopes and claims mapping
+ * - Refresh token rotation
+ * - Cookie signing with rotation support
+ */
+import { config } from '../config/index.js';
+import { HTML_CSP } from '../middleware/security-headers.js';
+import { renderPage } from '../auth/template-engine.js';
+import { resolveLocale, getTranslationFunction } from '../auth/i18n.js';
+import { logger } from '../lib/logger.js';
+import { getUserById } from '../users/service.js';
+import { getOrganizationById } from '../organizations/service.js';
+import { clearSessionCookies } from '../middleware/prompt-login-reset.js';
+// ---------------------------------------------------------------------------
+// Rendering hook helpers
+// ---------------------------------------------------------------------------
+/**
+ * Build default branding when org resolution is not possible.
+ * Used by rendering hooks when the session is destroyed or org lookup fails.
+ *
+ * @returns Default branding with Porta's standard blue primary color
+ */
+export function buildDefaultBranding() {
+    return {
+        logoUrl: null,
+        faviconUrl: null,
+        primaryColor: '#3B82F6',
+        companyName: '',
+        customCss: null,
+    };
+}
+/**
+ * Build branding context from a resolved organization.
+ * Maps Organization entity fields to the TemplateContext branding shape.
+ *
+ * @param org - The resolved organization
+ * @returns Branding object for TemplateContext
+ */
+function buildBrandingFromOrg(org) {
+    return {
+        logoUrl: org.brandingLogoUrl,
+        faviconUrl: org.brandingFaviconUrl,
+        primaryColor: org.brandingPrimaryColor ?? '#3B82F6',
+        companyName: org.brandingCompanyName ?? org.name,
+        customCss: org.brandingCustomCss,
+    };
+}
+/**
+ * Best-effort organization resolution for oidc-provider rendering hooks.
+ *
+ * Tries multiple strategies in order:
+ *   1. Session accountId → user lookup → org lookup
+ *   2. Client metadata → organizationId → org lookup
+ *   3. Returns undefined (caller uses default branding)
+ *
+ * All errors are caught and logged — never throws.
+ *
+ * @param ctx - oidc-provider's enhanced Koa context (KoaContextWithOIDC)
+ * @returns The resolved Organization, or undefined if resolution fails
+ */
+export async function resolveOrgForProviderHook(ctx) {
+    try {
+        // Access oidc-provider's internal context extensions.
+        // Using `any` because KoaContextWithOIDC is an internal provider type
+        // that we don't want to import directly.
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const oidcCtx = ctx;
+        // Strategy 1: Session accountId → user lookup → org lookup
+        const accountId = oidcCtx?.oidc?.session?.accountId;
+        if (accountId) {
+            const user = await getUserById(accountId);
+            if (user) {
+                const org = await getOrganizationById(user.organizationId);
+                if (org)
+                    return org;
+            }
+        }
+        // Strategy 2: Client metadata → organizationId → org lookup
+        const orgId = oidcCtx?.oidc?.client?.organizationId;
+        if (orgId) {
+            const org = await getOrganizationById(orgId);
+            if (org)
+                return org;
+        }
+        return undefined;
+    }
+    catch (err) {
+        logger.warn({ err }, 'Failed to resolve org for provider rendering hook');
+        return undefined;
+    }
+}
+// ---------------------------------------------------------------------------
+// Rendering hook functions
+// ---------------------------------------------------------------------------
+/**
+ * Custom logoutSource hook for node-oidc-provider.
+ *
+ * Replaces the provider's default bare HTML logout confirmation page with
+ * Porta's styled Handlebars template. Injects a styled submit button into
+ * the provider's pre-built form (which contains the correct action URL and
+ * xsrf hidden field).
+ *
+ * Falls back to minimal inline HTML if the template engine fails, ensuring
+ * the user can still sign out even if templating breaks.
+ *
+ * @param ctx - oidc-provider's enhanced Koa context
+ * @param form - Pre-built HTML form from the provider (contains action + xsrf)
+ */
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+export async function logoutSourceHook(ctx, form) {
+    try {
+        // Resolve org for branding (best-effort, defaults on failure)
+        const org = await resolveOrgForProviderHook(ctx);
+        const branding = org ? buildBrandingFromOrg(org) : buildDefaultBranding();
+        // Resolve locale and translation function
+        const locale = await resolveLocale(undefined, undefined, org?.defaultLocale ?? '');
+        const t = getTranslationFunction(locale, org?.slug);
+        // Inject the "logout=yes" hidden field and a styled submit button into
+        // the provider's form. The provider's form contains the action URL and
+        // xsrf token but lacks both the logout flag and a submit button.
+        //
+        // The "logout" field is CRITICAL: without it, oidc-provider takes the
+        // single-client RP-initiated path (Path 2 in end_session.js) which does
+        // NOT call session.destroy() — the session survives and the user stays
+        // logged in. With logout=yes, it takes Path 1: full session destruction.
+        const styledForm = form.replace('</form>', `<input type="hidden" name="logout" value="yes"/><button type="submit" class="btn-primary">${t('logout.confirm')}</button></form>`);
+        // Extract client name and post_logout_redirect_uri from the OIDC context.
+        // These are available on the oidc-provider's ctx.oidc during the end_session flow.
+        // Used by the template to show which app triggered logout and offer a "cancel" link.
+        const clientName = ctx.oidc?.client?.metadata()?.client_name;
+        const returnUrl = ctx.oidc?.params?.post_logout_redirect_uri;
+        // Render through the template engine (Handlebars + layout)
+        const html = await renderPage('logout', {
+            branding,
+            locale,
+            t,
+            csrfToken: '', // Provider handles CSRF via xsrf field in the form
+            orgSlug: org?.slug ?? '',
+            logoutForm: styledForm,
+            clientName: clientName ?? null,
+            returnUrl: returnUrl ?? null,
+        });
+        ctx.type = 'text/html';
+        ctx.set('Content-Security-Policy', HTML_CSP);
+        ctx.body = html;
+    }
+    catch (err) {
+        // Fallback: render minimal HTML if template engine fails.
+        // Ensures the user can still sign out even if templating breaks.
+        logger.error({ err }, 'Failed to render custom logout page');
+        ctx.type = 'text/html';
+        ctx.set('Content-Security-Policy', HTML_CSP);
+        ctx.body = `<!DOCTYPE html><html><body>${form}<script>document.querySelector('form').insertAdjacentHTML('beforeend','<input type="hidden" name="logout" value="yes"/><button type="submit">Sign out</button>')</script></body></html>`;
+    }
+}
+/**
+ * Custom postLogoutSuccessSource hook for node-oidc-provider.
+ *
+ * Replaces the provider's default bare HTML post-logout page with
+ * Porta's styled Handlebars template. At this point the session is
+ * already destroyed, so org resolution is not possible — default
+ * branding is always used.
+ *
+ * Falls back to minimal inline HTML if the template engine fails.
+ *
+ * @param ctx - oidc-provider's enhanced Koa context
+ */
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+export async function postLogoutSuccessSourceHook(ctx) {
+    try {
+        // Session is destroyed at this point — can't resolve org.
+        // Always use default branding for the post-logout page.
+        const branding = buildDefaultBranding();
+        const locale = await resolveLocale(undefined, undefined, '');
+        const t = getTranslationFunction(locale);
+        const html = await renderPage('logout-success', {
+            branding,
+            locale,
+            t,
+            csrfToken: '',
+            orgSlug: '',
+        });
+        ctx.type = 'text/html';
+        ctx.set('Content-Security-Policy', HTML_CSP);
+        ctx.body = html;
+    }
+    catch (err) {
+        logger.error({ err }, 'Failed to render custom post-logout page');
+        ctx.type = 'text/html';
+        ctx.set('Content-Security-Policy', HTML_CSP);
+        ctx.body = '<!DOCTYPE html><html><body><h1>Signed out</h1><p>You have been signed out successfully.</p></body></html>';
+    }
+}
+/**
+ * Detect a node-oidc-provider `SessionNotFound` error.
+ *
+ * `SessionNotFound` extends `InvalidRequest`, so its OIDC `error` code is
+ * `invalid_request`. We match on the original error's class name (most precise)
+ * and, defensively, on the characteristic `error_description` strings raised by
+ * the provider's resume action ("interaction session not found",
+ * "...session mismatch", "authorization request has expired").
+ *
+ * @param out - OIDC error details
+ * @param error - Original Error object thrown by the provider
+ * @returns true if this is a SessionNotFound error
+ */
+function isSessionNotFoundError(out, error) {
+    if (error?.name === 'SessionNotFound')
+        return true;
+    if (out.error !== 'invalid_request')
+        return false;
+    const desc = (out.error_description ?? '').toLowerCase();
+    return (desc.includes('interaction session not found') ||
+        desc.includes('session and authentication session mismatch') ||
+        desc.includes('authorization request has expired') ||
+        desc.includes('authorization session and cookie identifier mismatch'));
+}
+/**
+ * Clear the provider's session cookie pair from within a provider ctx.
+ *
+ * Resolves the session cookie name from the provider (defaulting to
+ * `_session`) and delegates to the shared, signing-free `clearSessionCookies`
+ * helper so the middleware and this hook use one tested code path (PF-002).
+ *
+ * @param ctx - oidc-provider's enhanced Koa context
+ */
+function clearProviderSessionCookies(
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+ctx) {
+    const cookieNameFn = ctx?.oidc?.provider?.cookieName;
+    const sessionCookieName = typeof cookieNameFn === 'function' ? cookieNameFn.call(ctx.oidc.provider, 'session') : '_session';
+    clearSessionCookies(ctx, sessionCookieName);
+}
+/**
+ * Custom renderError hook for node-oidc-provider.
+ *
+ * Replaces the provider's default bare HTML error page with Porta's styled
+ * Handlebars template. The OIDC error code (e.g., 'invalid_client') is shown
+ * to the user, but the raw error_description is intentionally suppressed to
+ * prevent information leakage — a generic i18n error message is shown instead.
+ *
+ * SECURITY: error_description may contain internal details like "client not
+ * found", "grant not found", etc. Only the standardized OIDC error code is
+ * safe to display.
+ *
+ * @param ctx - oidc-provider's enhanced Koa context
+ * @param out - OIDC error details (error code + optional description)
+ * @param _error - Original Error object (used to detect SessionNotFound)
+ */
+export async function renderErrorHook(
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+ctx, out, _error) {
+    try {
+        // Resolve org from client context for branding (best-effort)
+        const org = await resolveOrgForProviderHook(ctx);
+        const branding = org ? buildBrandingFromOrg(org) : buildDefaultBranding();
+        // Resolve locale and translation function
+        const locale = await resolveLocale(undefined, undefined, org?.defaultLocale ?? '');
+        const t = getTranslationFunction(locale, org?.slug);
+        // ---------------------------------------------------------------------
+        // Graceful SessionNotFound recovery (Bug #1, AR-4).
+        //
+        // node-oidc-provider throws `SessionNotFound` during authorize/resume when
+        // the interaction's recorded session uid no longer matches the live session
+        // (e.g. a stale `_session` cookie carried into the flow), or when the
+        // interaction record is missing. Without recovery the user sees a terminal
+        // "Something went wrong" and must manually clear storage.
+        //
+        // Here we clear the stale `_session`/`_session.sig` cookie pair (signing-free)
+        // and show a recovery message that invites the user to start sign-in again.
+        // The next request then has no stale cookie, so a fresh session is minted.
+        //
+        // SECURITY: this only clears a provably-dead cookie and re-renders — it does
+        // NOT accept or revive any session. The provider's SessionNotFound guard
+        // still fully rejects the mismatched session.
+        // ---------------------------------------------------------------------
+        const isSessionNotFound = isSessionNotFoundError(out, _error);
+        if (isSessionNotFound) {
+            clearProviderSessionCookies(ctx);
+        }
+        const errorMessage = isSessionNotFound
+            ? t('errors.session_expired')
+            : t('errors.generic');
+        // SECURITY: Never expose raw error_description to the user — it may
+        // contain internal details. Use generic i18n message instead.
+        // OIDC error codes (e.g., 'invalid_client') are safe standard strings.
+        const html = await renderPage('error', {
+            branding,
+            locale,
+            t,
+            csrfToken: '',
+            orgSlug: org?.slug ?? '',
+            errorMessage,
+            errorCode: out.error,
+        });
+        ctx.type = 'text/html';
+        ctx.set('Content-Security-Policy', HTML_CSP);
+        ctx.body = html;
+    }
+    catch (err) {
+        logger.error({ err }, 'Failed to render custom error page');
+        ctx.type = 'text/html';
+        ctx.set('Content-Security-Policy', HTML_CSP);
+        ctx.body = '<!DOCTYPE html><html><body><h1>Error</h1><p>An error occurred.</p></body></html>';
+    }
+}
+// ---------------------------------------------------------------------------
+// loadExistingGrant hook
+// ---------------------------------------------------------------------------
+/**
+ * Custom `loadExistingGrant` for node-oidc-provider.
+ *
+ * Mirrors the provider default (resolve the grant from the consent result or
+ * the session's grant id), then conditionally **upgrades** an existing grant to
+ * include `offline_access`.
+ *
+ * Why this exists (Bug #2): with `prompt=login` and a pre-existing Grant that
+ * lacks `offline_access`, the provider does not route through the consent
+ * interaction, so the consent handlers' `offline_access`-adding code never runs.
+ * The authorization code is then issued WITHOUT `offline_access` in its granted
+ * scopes, and `issueRefreshToken` returns false — so no refresh token is minted.
+ * This is exactly the CLI failure ("no refresh_token available" ~1h later).
+ *
+ * The upgrade is strictly gated (AR-6 / AR-7): only when the request asked for
+ * `offline_access`, the client allows the `refresh_token` grant, AND the grant
+ * does not already include `offline_access`. In every other case the grant is
+ * returned unchanged — identical to the provider default — so no other client
+ * or flow is affected.
+ *
+ * @param ctx - node-oidc-provider's enhanced Koa context
+ * @returns the existing Grant (possibly upgraded) or undefined
+ */
+export async function loadExistingGrant(
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+ctx) {
+    const grantId = ctx.oidc.result?.consent?.grantId ||
+        ctx.oidc.session.grantIdFor(ctx.oidc.client.clientId);
+    if (!grantId)
+        return undefined;
+    const grant = await ctx.oidc.provider.Grant.find(grantId);
+    if (!grant)
+        return undefined;
+    // AR-6/AR-7: upgrade an existing grant to include offline_access when the
+    // request asked for it, the client allows refresh_token, and it's missing.
+    const requestedScopes = String(ctx.oidc.params?.scope ?? '')
+        .split(' ')
+        .filter(Boolean);
+    const wantsOffline = requestedScopes.includes('offline_access');
+    const clientAllowsRefresh = typeof ctx.oidc.client?.grantTypeAllowed === 'function' &&
+        ctx.oidc.client.grantTypeAllowed('refresh_token');
+    const grantHasOffline = String(grant.getOIDCScope() ?? '')
+        .split(' ')
+        .filter(Boolean)
+        .includes('offline_access');
+    if (wantsOffline && clientAllowsRefresh && !grantHasOffline) {
+        grant.addOIDCScope('offline_access');
+        await grant.save();
+    }
+    return grant;
+}
+// ---------------------------------------------------------------------------
+// Provider configuration builder
+// ---------------------------------------------------------------------------
+/**
+ * Build the complete node-oidc-provider configuration object.
+ *
+ * Takes all external dependencies as parameters to keep this function
+ * pure and testable. The resulting configuration covers all OIDC features
+ * needed by Porta.
+ *
+ * @param params - All dependencies for the provider configuration
+ * @returns Complete Configuration object for node-oidc-provider
+ */
+export function buildProviderConfiguration(params) {
+    const { ttl, jwks, cookieKeys, findAccount, adapterFactory, interactionUrl, clientBasedCORS } = params;
+    return {
+        // Adapter — hybrid Postgres/Redis via factory
+        adapter: adapterFactory,
+        // Account finder — looks up users for ID token claims and userinfo
+        findAccount,
+        // Custom grant loader — upgrades an existing grant to include
+        // offline_access when requested (Bug #2 fix). See loadExistingGrant above.
+        loadExistingGrant,
+        // OIDC features
+        features: {
+            // Disable devInteractions — we provide our own login/consent UI
+            devInteractions: { enabled: false },
+            // Enable token introspection (RFC 7662)
+            introspection: { enabled: true },
+            // Enable token revocation (RFC 7009)
+            revocation: { enabled: true },
+            // Enable resource indicators (RFC 8707)
+            resourceIndicators: {
+                enabled: true,
+                // Only audience-restrict tokens when the client explicitly requests a resource.
+                // When oneOf is undefined (no `resource` param in auth request), returning
+                // undefined produces a standard, unrestricted token that works with /me (userinfo).
+                // Previously this unconditionally returned 'urn:porta:default', which audience-
+                // restricted EVERY token and caused the userinfo endpoint to reject them all.
+                defaultResource: async (_ctx, _client, oneOf) => oneOf ?? undefined,
+                getResourceServerInfo: () => ({
+                    scope: 'openid profile email',
+                    audience: 'urn:porta:default',
+                    accessTokenFormat: 'opaque',
+                    accessTokenTTL: ttl.accessToken,
+                }),
+                useGrantedResource: () => true,
+            },
+            // Enable client credentials grant (RFC 6749 §4.4)
+            clientCredentials: { enabled: true },
+            // Enable RP-initiated logout (OpenID Connect RP-Initiated Logout 1.0)
+            rpInitiatedLogout: {
+                enabled: true,
+                logoutSource: logoutSourceHook,
+                postLogoutSuccessSource: postLogoutSuccessSourceHook,
+            },
+        },
+        // Token formats — opaque access tokens, JWT ID tokens (default)
+        formats: {
+            AccessToken: 'opaque',
+            ClientCredentials: 'opaque',
+        },
+        // PKCE — required for all authorization code flows, S256 only.
+        // This is a security best practice that prevents authorization code interception.
+        pkce: {
+            required: () => true,
+            methods: ['S256'],
+        },
+        // Token TTLs from system_config table
+        ttl: {
+            AccessToken: ttl.accessToken,
+            AuthorizationCode: ttl.authorizationCode,
+            IdToken: ttl.idToken,
+            RefreshToken: ttl.refreshToken,
+            Interaction: ttl.interaction,
+            Session: ttl.session,
+            Grant: ttl.grant,
+        },
+        // Issue refresh tokens for clients that support them.
+        // The default oidc-provider implementation only checks code.scopes.has('offline_access'),
+        // but offline_access may not propagate to the code scopes in all consent flows.
+        // This explicit function ensures refresh tokens are issued whenever the client
+        // lists 'refresh_token' in its grant_types AND the auth request included offline_access.
+        issueRefreshToken: async (_ctx, client, code) => {
+            return client.grantTypeAllowed('refresh_token') && (code.scopes.has('offline_access') ||
+                // Fallback: also issue for confidential web clients (web + auth method != none)
+                (client.applicationType === 'web' &&
+                    client.tokenEndpointAuthMethod !== 'none'));
+        },
+        // Enable refresh token rotation — each refresh generates a new token
+        rotateRefreshToken: true,
+        // Standard OIDC scopes
+        scopes: ['openid', 'profile', 'email', 'address', 'phone', 'offline_access'],
+        // OIDC claims mapping per scope.
+        // Standard claims follow OpenID Connect Core §5.4.
+        // Custom claims (roles, permissions, ERP attributes) are mapped to
+        // 'openid' so they are always included when the openid scope is granted.
+        // This follows the Auth0/Okta/Azure AD pattern of always-include custom claims.
+        claims: {
+            openid: [
+                'sub',
+                // RBAC claims — always included
+                'roles', 'permissions',
+                // Custom ERP claims — always included
+                'department', 'employee_id', 'cost_center', 'job_title',
+            ],
+            profile: [
+                'name', 'given_name', 'family_name', 'middle_name', 'nickname',
+                'preferred_username', 'profile', 'picture', 'website',
+                'gender', 'birthdate', 'zoneinfo', 'locale', 'updated_at',
+            ],
+            email: ['email', 'email_verified'],
+            address: ['address'],
+            phone: ['phone_number', 'phone_number_verified'],
+        },
+        // Supported response types and grant types
+        responseTypes: ['code'],
+        grantTypes: ['authorization_code', 'client_credentials', 'refresh_token'],
+        // Interaction URL — where users are redirected for login/consent.
+        // Placeholder for RD-03; real login UI implemented in RD-07.
+        interactions: {
+            url: interactionUrl,
+        },
+        // Signing keys in JWK format
+        jwks,
+        // Cookie configuration with signing key rotation support.
+        // The `secure` flag is derived from the configured issuer URL:
+        //   - HTTPS issuer → secure: true  (cookies only sent over TLS)
+        //   - HTTP  issuer → secure: false  (allows local dev on localhost)
+        // This is the same check used by the HSTS header in security-headers.ts.
+        cookies: {
+            keys: cookieKeys,
+            long: { signed: true, httpOnly: true, sameSite: 'lax', secure: config.issuerBaseUrl.startsWith('https://') },
+            short: { signed: true, httpOnly: true, sameSite: 'lax', secure: config.issuerBaseUrl.startsWith('https://') },
+        },
+        // CORS handler — checks client's allowed_origins
+        clientBasedCORS,
+        // Rendering hooks — render styled pages instead of provider defaults.
+        // See logoutSourceHook, postLogoutSuccessSourceHook, renderErrorHook above.
+        renderError: renderErrorHook,
+        // Extra client metadata properties — tell the provider to preserve
+        // these custom fields from the adapter's findClient response.
+        // Without this, node-oidc-provider strips all unknown properties.
+        extraClientMetadata: {
+            properties: [
+                'organizationId',
+                'client_name',
+                'urn:porta:allowed_origins',
+                'urn:porta:client_type',
+                // Per-client login method override. Raw value from findForOidc():
+                //   null       → inherit organization.defaultLoginMethods
+                //   string[]   → explicit override (subset of ['password','magic_link'])
+                // Resolved to effective methods inside the interaction route handlers.
+                'urn:porta:login_methods',
+            ],
+        },
+    };
+}
+//# sourceMappingURL=configuration.js.map

package/dist/oidc/configuration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"configuration.js","sourceRoot":"","sources":["../../src/oidc/configuration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,mCAAmC,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAElE,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAoB1E,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO;QACL,OAAO,EAAE,IAAqB;QAC9B,UAAU,EAAE,IAAqB;QACjC,YAAY,EAAE,SAAS;QACvB,WAAW,EAAE,EAAE;QACf,SAAS,EAAE,IAAqB;KACjC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,oBAAoB,CAAC,GAAiB;IAC7C,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,eAAe;QAC5B,UAAU,EAAE,GAAG,CAAC,kBAAkB;QAClC,YAAY,EAAE,GAAG,CAAC,oBAAoB,IAAI,SAAS;QACnD,WAAW,EAAE,GAAG,CAAC,mBAAmB,IAAI,GAAG,CAAC,IAAI;QAChD,SAAS,EAAE,GAAG,CAAC,iBAAiB;KACjC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,GAAY;IAC1D,IAAI,CAAC;QACH,sDAAsD;QACtD,sEAAsE;QACtE,yCAAyC;QACzC,8DAA8D;QAC9D,MAAM,OAAO,GAAG,GAAU,CAAC;QAE3B,2DAA2D;QAC3D,MAAM,SAAS,GAAG,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAA+B,CAAC;QAC1E,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,SAAS,CAAC,CAAC;YAC1C,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;gBAC3D,IAAI,GAAG;oBAAE,OAAO,GAAG,CAAC;YACtB,CAAC;QACH,CAAC;QAED,4DAA4D;QAC5D,MAAM,KAAK,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,cAAoC,CAAC;QAC1E,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAC7C,IAAI,GAAG;gBAAE,OAAO,GAAG,CAAC;QACtB,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,mDAAmD,CAAC,CAAC;QAC1E,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,2BAA2B;AAC3B,8EAA8E;AAE9E;;;;;;;;;;;;;GAaG;AACH,8DAA8D;AAC9D,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAQ,EAAE,IAAY;IAC3D,IAAI,CAAC;QACH,8DAA8D;QAC9D,MAAM,GAAG,GAAG,MAAM,yBAAyB,CAAC,GAAG,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC;QAE1E,0CAA0C;QAC1C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC;QACnF,MAAM,CAAC,GAAG,sBAAsB,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAEpD,uEAAuE;QACvE,uEAAuE;QACvE,iEAAiE;QACjE,EAAE;QACF,sEAAsE;QACtE,wEAAwE;QACxE,uEAAuE;QACvE,yEAAyE;QACzE,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAC7B,SAAS,EACT,6FAA6F,CAAC,CAAC,gBAAgB,CAAC,kBAAkB,CACnI,CAAC;QAEF,0EAA0E;QAC1E,mFAAmF;QACnF,qFAAqF;QACrF,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,WAAiC,CAAC;QACnF,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,wBAA8C,CAAC;QAEnF,2DAA2D;QAC3D,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE;YACtC,QAAQ;YACR,MAAM;YACN,CAAC;YACD,SAAS,EAAE,EAAE,EAAE,mDAAmD;YAClE,OAAO,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE;YACxB,UAAU,EAAE,UAAU;YACtB,UAAU,EAAE,UAAU,IAAI,IAAI;YAC9B,SAAS,EAAE,SAAS,IAAI,IAAI;SAC7B,CAAC,CAAC;QAEH,GAAG,CAAC,IAAI,GAAG,WAAW,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,QAAQ,CAAC,CAAC;QAC7C,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,0DAA0D;QAC1D,iEAAiE;QACjE,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,qCAAqC,CAAC,CAAC;QAC7D,GAAG,CAAC,IAAI,GAAG,WAAW,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,QAAQ,CAAC,CAAC;QAC7C,GAAG,CAAC,IAAI,GAAG,8BAA8B,IAAI,yLAAyL,CAAC;IACzO,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,8DAA8D;AAC9D,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,GAAQ;IACxD,IAAI,CAAC;QACH,0DAA0D;QAC1D,wDAAwD;QACxD,MAAM,QAAQ,GAAG,oBAAoB,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QAC7D,MAAM,CAAC,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;QAEzC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,gBAAgB,EAAE;YAC9C,QAAQ;YACR,MAAM;YACN,CAAC;YACD,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,EAAE;SACZ,CAAC,CAAC;QAEH,GAAG,CAAC,IAAI,GAAG,WAAW,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,QAAQ,CAAC,CAAC;QAC7C,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,0CAA0C,CAAC,CAAC;QAClE,GAAG,CAAC,IAAI,GAAG,WAAW,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,QAAQ,CAAC,CAAC;QAC7C,GAAG,CAAC,IAAI,GAAG,2GAA2G,CAAC;IACzH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,sBAAsB,CAC7B,GAAkD,EAClD,KAAwB;IAExB,IAAI,KAAK,EAAE,IAAI,KAAK,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAEnD,IAAI,GAAG,CAAC,KAAK,KAAK,iBAAiB;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACzD,OAAO,CACL,IAAI,CAAC,QAAQ,CAAC,+BAA+B,CAAC;QAC9C,IAAI,CAAC,QAAQ,CAAC,6CAA6C,CAAC;QAC5D,IAAI,CAAC,QAAQ,CAAC,mCAAmC,CAAC;QAClD,IAAI,CAAC,QAAQ,CAAC,sDAAsD,CAAC,CACtE,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,2BAA2B;AAClC,8DAA8D;AAC9D,GAAQ;IAER,MAAM,YAAY,GAAG,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC;IACrD,MAAM,iBAAiB,GACrB,OAAO,YAAY,KAAK,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IACpG,mBAAmB,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;AACnC,8DAA8D;AAC9D,GAAQ,EACR,GAAkD,EAClD,MAAa;IAEb,IAAI,CAAC;QACH,6DAA6D;QAC7D,MAAM,GAAG,GAAG,MAAM,yBAAyB,CAAC,GAAG,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC;QAE1E,0CAA0C;QAC1C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC;QACnF,MAAM,CAAC,GAAG,sBAAsB,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAEpD,wEAAwE;QACxE,oDAAoD;QACpD,EAAE;QACF,2EAA2E;QAC3E,4EAA4E;QAC5E,sEAAsE;QACtE,2EAA2E;QAC3E,0DAA0D;QAC1D,EAAE;QACF,+EAA+E;QAC/E,4EAA4E;QAC5E,2EAA2E;QAC3E,EAAE;QACF,6EAA6E;QAC7E,yEAAyE;QACzE,8CAA8C;QAC9C,wEAAwE;QACxE,MAAM,iBAAiB,GAAG,sBAAsB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC9D,IAAI,iBAAiB,EAAE,CAAC;YACtB,2BAA2B,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC;QAED,MAAM,YAAY,GAAG,iBAAiB;YACpC,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC;YAC7B,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;QAExB,oEAAoE;QACpE,8DAA8D;QAC9D,uEAAuE;QACvE,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE;YACrC,QAAQ;YACR,MAAM;YACN,CAAC;YACD,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE;YACxB,YAAY;YACZ,SAAS,EAAE,GAAG,CAAC,KAAK;SACrB,CAAC,CAAC;QAEH,GAAG,CAAC,IAAI,GAAG,WAAW,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,QAAQ,CAAC,CAAC;QAC7C,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,oCAAoC,CAAC,CAAC;QAC5D,GAAG,CAAC,IAAI,GAAG,WAAW,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,QAAQ,CAAC,CAAC;QAC7C,GAAG,CAAC,IAAI,GAAG,kFAAkF,CAAC;IAChG,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;AACrC,8DAA8D;AAC9D,GAAQ;IAER,MAAM,OAAO,GACX,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO;QACjC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAExD,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAE/B,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1D,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAE7B,0EAA0E;IAC1E,2EAA2E;IAC3E,MAAM,eAAe,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC;SACzD,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,MAAM,YAAY,GAAG,eAAe,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IAChE,MAAM,mBAAmB,GACvB,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,KAAK,UAAU;QACvD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,eAAe,CAAC,CAAC;IACpD,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;SACvD,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,OAAO,CAAC;SACf,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IAE9B,IAAI,YAAY,IAAI,mBAAmB,IAAI,CAAC,eAAe,EAAE,CAAC;QAC5D,KAAK,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC;QACrC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;IACrB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,iCAAiC;AACjC,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAAiC;IAC1E,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;IAEvG,OAAO;QACL,8CAA8C;QAC9C,OAAO,EAAE,cAAc;QAEvB,mEAAmE;QACnE,WAAW;QAEX,8DAA8D;QAC9D,2EAA2E;QAC3E,iBAAiB;QAEjB,gBAAgB;QAChB,QAAQ,EAAE;YACR,gEAAgE;YAChE,eAAe,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;YACnC,wCAAwC;YACxC,aAAa,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;YAChC,qCAAqC;YACrC,UAAU,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;YAC7B,wCAAwC;YACxC,kBAAkB,EAAE;gBAClB,OAAO,EAAE,IAAI;gBACb,gFAAgF;gBAChF,2EAA2E;gBAC3E,oFAAoF;gBACpF,gFAAgF;gBAChF,8EAA8E;gBAC9E,eAAe,EAAE,KAAK,EAAE,IAAa,EAAE,OAAgB,EAAE,KAAc,EAAE,EAAE,CACzE,KAAK,IAAI,SAAS;gBACpB,qBAAqB,EAAE,GAAG,EAAE,CAAC,CAAC;oBAC5B,KAAK,EAAE,sBAAsB;oBAC7B,QAAQ,EAAE,mBAAmB;oBAC7B,iBAAiB,EAAE,QAAQ;oBAC3B,cAAc,EAAE,GAAG,CAAC,WAAW;iBAChC,CAAC;gBACF,kBAAkB,EAAE,GAAG,EAAE,CAAC,IAAI;aAC/B;YACD,kDAAkD;YAClD,iBAAiB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;YACpC,sEAAsE;YACtE,iBAAiB,EAAE;gBACjB,OAAO,EAAE,IAAI;gBACb,YAAY,EAAE,gBAAgB;gBAC9B,uBAAuB,EAAE,2BAA2B;aACrD;SACF;QAED,gEAAgE;QAChE,OAAO,EAAE;YACP,WAAW,EAAE,QAAQ;YACrB,iBAAiB,EAAE,QAAQ;SAC5B;QAED,+DAA+D;QAC/D,kFAAkF;QAClF,IAAI,EAAE;YACJ,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI;YACpB,OAAO,EAAE,CAAC,MAAM,CAAC;SAClB;QAED,sCAAsC;QACtC,GAAG,EAAE;YACH,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;YACxC,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,KAAK,EAAE,GAAG,CAAC,KAAK;SACjB;QAED,sDAAsD;QACtD,0FAA0F;QAC1F,gFAAgF;QAChF,+EAA+E;QAC/E,yFAAyF;QACzF,iBAAiB,EAAE,KAAK,EACtB,IAAa,EACb,MAAuD,EACvD,IAA6B,EAC7B,EAAE;YACF,OAAO,MAAM,CAAC,gBAAgB,CAAC,eAAe,CAAC,IAAI,CACjD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC;gBACjC,gFAAgF;gBAChF,CAAE,MAAkC,CAAC,eAAe,KAAK,KAAK;oBAC5D,MAAkC,CAAC,uBAAuB,KAAK,MAAM,CAAC,CACzE,CAAC;QACJ,CAAC;QAED,qEAAqE;QACrE,kBAAkB,EAAE,IAAI;QAExB,uBAAuB;QACvB,MAAM,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,CAAC;QAE5E,iCAAiC;QACjC,mDAAmD;QACnD,mEAAmE;QACnE,yEAAyE;QACzE,gFAAgF;QAChF,MAAM,EAAE;YACN,MAAM,EAAE;gBACN,KAAK;gBACL,gCAAgC;gBAChC,OAAO,EAAE,aAAa;gBACtB,sCAAsC;gBACtC,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW;aACxD;YACD,OAAO,EAAE;gBACP,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,UAAU;gBAC9D,oBAAoB,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS;gBACrD,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY;aAC1D;YACD,KAAK,EAAE,CAAC,OAAO,EAAE,gBAAgB,CAAC;YAClC,OAAO,EAAE,CAAC,SAAS,CAAC;YACpB,KAAK,EAAE,CAAC,cAAc,EAAE,uBAAuB,CAAC;SACjD;QAED,2CAA2C;QAC3C,aAAa,EAAE,CAAC,MAAM,CAAC;QACvB,UAAU,EAAE,CAAC,oBAAoB,EAAE,oBAAoB,EAAE,eAAe,CAAC;QAEzE,kEAAkE;QAClE,6DAA6D;QAC7D,YAAY,EAAE;YACZ,GAAG,EAAE,cAAc;SACpB;QAED,6BAA6B;QAC7B,IAAI;QAEJ,0DAA0D;QAC1D,+DAA+D;QAC/D,gEAAgE;QAChE,oEAAoE;QACpE,yEAAyE;QACzE,OAAO,EAAE;YACP,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAc,EAAE,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE;YACrH,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAc,EAAE,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE;SACvH;QAED,iDAAiD;QACjD,eAAe;QAEf,sEAAsE;QACtE,4EAA4E;QAC5E,WAAW,EAAE,eAAe;QAE5B,mEAAmE;QACnE,8DAA8D;QAC9D,kEAAkE;QAClE,mBAAmB,EAAE;YACnB,UAAU,EAAE;gBACV,gBAAgB;gBAChB,aAAa;gBACb,2BAA2B;gBAC3B,uBAAuB;gBACvB,kEAAkE;gBAClE,0DAA0D;gBAC1D,yEAAyE;gBACzE,uEAAuE;gBACvE,yBAAyB;aAC1B;SACF;KACF,CAAC;AACJ,CAAC"}