@portaidentity/server 1.7.0

package/dist/oidc/postgres-adapter.d.ts

@@ -0,0 +1,159 @@
+/**
+ * PostgreSQL adapter for node-oidc-provider.
+ *
+ * Stores long-lived OIDC artifacts (AccessToken, RefreshToken, Grant, DeviceCode)
+ * in the oidc_payloads table. Uses parameterized queries to prevent SQL injection.
+ *
+ * Table schema (from migration 010_oidc_adapter.sql):
+ *   id          VARCHAR(255) NOT NULL  — artifact ID
+ *   type        VARCHAR(50) NOT NULL   — model name (e.g., 'AccessToken')
+ *   payload     JSONB NOT NULL         — full OIDC artifact payload
+ *   grant_id    VARCHAR(255)           — for grant-based revocation
+ *   user_code   VARCHAR(255)           — for device flow lookups
+ *   uid         VARCHAR(255)           — for session lookups
+ *   expires_at  TIMESTAMPTZ            — when the artifact expires
+ *   consumed_at TIMESTAMPTZ            — when the artifact was consumed (e.g., auth code used)
+ *   created_at  TIMESTAMPTZ NOT NULL   — row creation timestamp
+ *   PRIMARY KEY (id, type)
+ */
+/** OIDC adapter payload — the data node-oidc-provider stores and retrieves */
+export interface AdapterPayload {
+    [key: string]: unknown;
+    accountId?: string;
+    clientId?: string;
+    grantId?: string;
+    iat?: number;
+    exp?: number;
+    uid?: string;
+    userCode?: string;
+    jti?: string;
+    kind?: string;
+    consumed?: number | boolean;
+}
+/**
+ * PostgreSQL adapter implementing the node-oidc-provider storage interface.
+ *
+ * Each instance is created per-model (e.g., new PostgresAdapter('AccessToken')).
+ * The model name is used as the `type` column to partition artifacts in the
+ * shared oidc_payloads table.
+ */
+export declare class PostgresAdapter {
+    /** Model name — used as the `type` column value (e.g., 'AccessToken', 'RefreshToken') */
+    protected name: string;
+    constructor(name: string);
+    /**
+     * Create or update an OIDC artifact.
+     *
+     * Uses INSERT ... ON CONFLICT to handle both initial creation and updates.
+     * Extracts grant_id, user_code, uid from payload for indexed lookups.
+     * Calculates expires_at from the current time + expiresIn seconds.
+     *
+     * @param id - Artifact ID (e.g., token jti)
+     * @param payload - Full OIDC artifact payload
+     * @param expiresIn - TTL in seconds from now
+     */
+    upsert(id: string, payload: AdapterPayload, expiresIn: number): Promise<void>;
+    /**
+     * Find an artifact by its ID.
+     *
+     * Returns undefined if not found or if the artifact has expired.
+     * Merges consumed_at into the payload as `consumed` (epoch seconds)
+     * which is the format node-oidc-provider expects.
+     *
+     * @param id - Artifact ID to look up
+     * @returns The artifact payload, or undefined if not found/expired
+     */
+    find(id: string): Promise<AdapterPayload | undefined>;
+    /**
+     * Find an artifact by user code (device flow).
+     *
+     * Used for OAuth 2.0 Device Authorization Grant where the user
+     * enters a code on a separate device.
+     *
+     * @param userCode - The user-facing device code
+     * @returns The artifact payload, or undefined if not found/expired
+     */
+    findByUserCode(userCode: string): Promise<AdapterPayload | undefined>;
+    /**
+     * Find an artifact by UID (sessions).
+     *
+     * Used to look up sessions by their unique identifier when
+     * the session ID is not directly available.
+     *
+     * @param uid - The unique identifier
+     * @returns The artifact payload, or undefined if not found/expired
+     */
+    findByUid(uid: string): Promise<AdapterPayload | undefined>;
+    /**
+     * Mark an artifact as consumed.
+     *
+     * Sets consumed_at to the current time. Used primarily for authorization
+     * code replay detection — once a code is consumed, subsequent attempts
+     * to use it are rejected by the provider.
+     *
+     * @param id - Artifact ID to mark as consumed
+     */
+    consume(id: string): Promise<void>;
+    /**
+     * Delete an artifact by its ID.
+     *
+     * Permanently removes the artifact from the database.
+     *
+     * @param id - Artifact ID to delete
+     */
+    destroy(id: string): Promise<void>;
+    /**
+     * Revoke all artifacts associated with a grant.
+     *
+     * Deletes all rows matching the given grant_id for this model type.
+     * Used when a grant is revoked (e.g., user revokes consent) to clean up
+     * all associated tokens and artifacts.
+     *
+     * @param grantId - Grant ID whose artifacts should be deleted
+     */
+    revokeByGrantId(grantId: string): Promise<void>;
+    /**
+     * Merge consumed_at into the payload as `consumed` (epoch seconds).
+     *
+     * node-oidc-provider expects the `consumed` field to be an epoch timestamp
+     * (number of seconds since Unix epoch) in the payload. The database stores
+     * it as a separate TIMESTAMPTZ column which we convert here.
+     *
+     * @param row - Database row with payload and consumed_at
+     * @returns The payload with consumed field merged if applicable
+     */
+    protected withConsumed(row: {
+        payload: AdapterPayload;
+        consumed_at: Date | null;
+    }): AdapterPayload;
+}
+/**
+ * Delete all oidc_payloads records matching any of the given grant_ids.
+ *
+ * Used for cascade cleanup when a session is destroyed during explicit logout.
+ * Deletes across ALL types (AccessToken, RefreshToken, Grant, etc.) in a single
+ * query — the grant_id column links tokens back to their originating grant.
+ *
+ * This is the critical step that ensures "logout = total cleanup": when a user
+ * clicks "Sign Out", all grants and tokens issued during that session are removed
+ * from PostgreSQL so they can no longer be used.
+ *
+ * @param grantIds - Array of grant IDs whose artifacts should be deleted
+ */
+export declare function revokeGrantsByIds(grantIds: string[]): Promise<void>;
+/**
+ * Delete all expired oidc_payloads records (fire-and-forget).
+ *
+ * Called opportunistically on auth flow start to keep the oidc_payloads table
+ * clean without requiring a cron job or external scheduler. This pattern is
+ * proven from Porta v4 — self-regulating cleanup tied to actual usage.
+ *
+ * The function is intentionally fire-and-forget: it does NOT return a promise
+ * that callers should await. Errors are silently caught and logged — a failed
+ * cleanup is harmless (expired rows are already inert) and will be retried on
+ * the next auth flow start.
+ *
+ * Uses the expires_at index for efficient deletion.
+ */
+export declare function purgeExpired(): void;
+//# sourceMappingURL=postgres-adapter.d.ts.map

package/dist/oidc/postgres-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres-adapter.d.ts","sourceRoot":"","sources":["../../src/oidc/postgres-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAMH,8EAA8E;AAC9E,MAAM,WAAW,cAAc;IAC7B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CAC7B;AAED;;;;;;GAMG;AACH,qBAAa,eAAe;IAC1B,yFAAyF;IACzF,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC;IAEvB,YAAY,IAAI,EAAE,MAAM,EAEvB;IAED;;;;;;;;;;OAUG;IACG,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBlF;IAED;;;;;;;;;OASG;IACG,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAY1D;IAED;;;;;;;;OAQG;IACG,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAY1E;IAED;;;;;;;;OAQG;IACG,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAYhE;IAED;;;;;;;;OAQG;IACG,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAcvC;IAED;;;;;;OAMG;IACG,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOvC;IAED;;;;;;;;OAQG;IACG,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOpD;IAED;;;;;;;;;OASG;IACH,SAAS,CAAC,YAAY,CAAC,GAAG,EAAE;QAC1B,OAAO,EAAE,cAAc,CAAC;QACxB,WAAW,EAAE,IAAI,GAAG,IAAI,CAAC;KAC1B,GAAG,cAAc,CASjB;CACF;AAMD;;;;;;;;;;;;GAYG;AACH,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAQzE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,IAAI,IAAI,CAQnC"}

package/dist/oidc/postgres-adapter.js

@@ -0,0 +1,222 @@
+/**
+ * PostgreSQL adapter for node-oidc-provider.
+ *
+ * Stores long-lived OIDC artifacts (AccessToken, RefreshToken, Grant, DeviceCode)
+ * in the oidc_payloads table. Uses parameterized queries to prevent SQL injection.
+ *
+ * Table schema (from migration 010_oidc_adapter.sql):
+ *   id          VARCHAR(255) NOT NULL  — artifact ID
+ *   type        VARCHAR(50) NOT NULL   — model name (e.g., 'AccessToken')
+ *   payload     JSONB NOT NULL         — full OIDC artifact payload
+ *   grant_id    VARCHAR(255)           — for grant-based revocation
+ *   user_code   VARCHAR(255)           — for device flow lookups
+ *   uid         VARCHAR(255)           — for session lookups
+ *   expires_at  TIMESTAMPTZ            — when the artifact expires
+ *   consumed_at TIMESTAMPTZ            — when the artifact was consumed (e.g., auth code used)
+ *   created_at  TIMESTAMPTZ NOT NULL   — row creation timestamp
+ *   PRIMARY KEY (id, type)
+ */
+import { errors } from 'oidc-provider';
+import { getPool } from '../lib/database.js';
+import { logger } from '../lib/logger.js';
+/**
+ * PostgreSQL adapter implementing the node-oidc-provider storage interface.
+ *
+ * Each instance is created per-model (e.g., new PostgresAdapter('AccessToken')).
+ * The model name is used as the `type` column to partition artifacts in the
+ * shared oidc_payloads table.
+ */
+export class PostgresAdapter {
+    /** Model name — used as the `type` column value (e.g., 'AccessToken', 'RefreshToken') */
+    name;
+    constructor(name) {
+        this.name = name;
+    }
+    /**
+     * Create or update an OIDC artifact.
+     *
+     * Uses INSERT ... ON CONFLICT to handle both initial creation and updates.
+     * Extracts grant_id, user_code, uid from payload for indexed lookups.
+     * Calculates expires_at from the current time + expiresIn seconds.
+     *
+     * @param id - Artifact ID (e.g., token jti)
+     * @param payload - Full OIDC artifact payload
+     * @param expiresIn - TTL in seconds from now
+     */
+    async upsert(id, payload, expiresIn) {
+        const pool = getPool();
+        // Extract indexed fields from payload for efficient lookups.
+        // These are stored as separate columns in addition to the full JSONB payload.
+        const grantId = payload.grantId ?? null;
+        const userCode = payload.userCode ?? null;
+        const uid = payload.uid ?? null;
+        // Calculate absolute expiration time using PostgreSQL interval arithmetic
+        const expiresAt = expiresIn
+            ? new Date(Date.now() + expiresIn * 1000)
+            : null;
+        await pool.query(`INSERT INTO oidc_payloads (id, type, payload, grant_id, user_code, uid, expires_at)
+       VALUES ($1, $2, $3, $4, $5, $6, $7)
+       ON CONFLICT (id, type)
+       DO UPDATE SET payload = $3, grant_id = $4, user_code = $5, uid = $6, expires_at = $7`, [id, this.name, JSON.stringify(payload), grantId, userCode, uid, expiresAt]);
+    }
+    /**
+     * Find an artifact by its ID.
+     *
+     * Returns undefined if not found or if the artifact has expired.
+     * Merges consumed_at into the payload as `consumed` (epoch seconds)
+     * which is the format node-oidc-provider expects.
+     *
+     * @param id - Artifact ID to look up
+     * @returns The artifact payload, or undefined if not found/expired
+     */
+    async find(id) {
+        const pool = getPool();
+        const result = await pool.query(`SELECT payload, consumed_at FROM oidc_payloads
+       WHERE id = $1 AND type = $2 AND (expires_at IS NULL OR expires_at > NOW())`, [id, this.name]);
+        if (result.rows.length === 0)
+            return undefined;
+        return this.withConsumed(result.rows[0]);
+    }
+    /**
+     * Find an artifact by user code (device flow).
+     *
+     * Used for OAuth 2.0 Device Authorization Grant where the user
+     * enters a code on a separate device.
+     *
+     * @param userCode - The user-facing device code
+     * @returns The artifact payload, or undefined if not found/expired
+     */
+    async findByUserCode(userCode) {
+        const pool = getPool();
+        const result = await pool.query(`SELECT payload, consumed_at FROM oidc_payloads
+       WHERE user_code = $1 AND type = $2 AND (expires_at IS NULL OR expires_at > NOW())`, [userCode, this.name]);
+        if (result.rows.length === 0)
+            return undefined;
+        return this.withConsumed(result.rows[0]);
+    }
+    /**
+     * Find an artifact by UID (sessions).
+     *
+     * Used to look up sessions by their unique identifier when
+     * the session ID is not directly available.
+     *
+     * @param uid - The unique identifier
+     * @returns The artifact payload, or undefined if not found/expired
+     */
+    async findByUid(uid) {
+        const pool = getPool();
+        const result = await pool.query(`SELECT payload, consumed_at FROM oidc_payloads
+       WHERE uid = $1 AND type = $2 AND (expires_at IS NULL OR expires_at > NOW())`, [uid, this.name]);
+        if (result.rows.length === 0)
+            return undefined;
+        return this.withConsumed(result.rows[0]);
+    }
+    /**
+     * Mark an artifact as consumed.
+     *
+     * Sets consumed_at to the current time. Used primarily for authorization
+     * code replay detection — once a code is consumed, subsequent attempts
+     * to use it are rejected by the provider.
+     *
+     * @param id - Artifact ID to mark as consumed
+     */
+    async consume(id) {
+        const pool = getPool();
+        const result = await pool.query(`UPDATE oidc_payloads SET consumed_at = NOW()
+       WHERE id = $1 AND type = $2 AND consumed_at IS NULL
+         AND (expires_at IS NULL OR expires_at > NOW())
+       RETURNING id`, [id, this.name]);
+        // The conditional write is the durable single-use decision. A preceding read cannot provide
+        // that guarantee because two requests may both observe the artifact before either consumes it.
+        if (result.rowCount !== 1)
+            throw new errors.InvalidGrant();
+    }
+    /**
+     * Delete an artifact by its ID.
+     *
+     * Permanently removes the artifact from the database.
+     *
+     * @param id - Artifact ID to delete
+     */
+    async destroy(id) {
+        const pool = getPool();
+        await pool.query(`DELETE FROM oidc_payloads WHERE id = $1 AND type = $2`, [id, this.name]);
+    }
+    /**
+     * Revoke all artifacts associated with a grant.
+     *
+     * Deletes all rows matching the given grant_id for this model type.
+     * Used when a grant is revoked (e.g., user revokes consent) to clean up
+     * all associated tokens and artifacts.
+     *
+     * @param grantId - Grant ID whose artifacts should be deleted
+     */
+    async revokeByGrantId(grantId) {
+        const pool = getPool();
+        await pool.query(`DELETE FROM oidc_payloads WHERE grant_id = $1 AND type = $2`, [grantId, this.name]);
+    }
+    /**
+     * Merge consumed_at into the payload as `consumed` (epoch seconds).
+     *
+     * node-oidc-provider expects the `consumed` field to be an epoch timestamp
+     * (number of seconds since Unix epoch) in the payload. The database stores
+     * it as a separate TIMESTAMPTZ column which we convert here.
+     *
+     * @param row - Database row with payload and consumed_at
+     * @returns The payload with consumed field merged if applicable
+     */
+    withConsumed(row) {
+        const payload = row.payload;
+        if (row.consumed_at) {
+            // Convert TIMESTAMPTZ to epoch seconds as expected by node-oidc-provider
+            payload.consumed = Math.floor(row.consumed_at.getTime() / 1000);
+        }
+        return payload;
+    }
+}
+// ---------------------------------------------------------------------------
+// Standalone helpers for session lifecycle management
+// ---------------------------------------------------------------------------
+/**
+ * Delete all oidc_payloads records matching any of the given grant_ids.
+ *
+ * Used for cascade cleanup when a session is destroyed during explicit logout.
+ * Deletes across ALL types (AccessToken, RefreshToken, Grant, etc.) in a single
+ * query — the grant_id column links tokens back to their originating grant.
+ *
+ * This is the critical step that ensures "logout = total cleanup": when a user
+ * clicks "Sign Out", all grants and tokens issued during that session are removed
+ * from PostgreSQL so they can no longer be used.
+ *
+ * @param grantIds - Array of grant IDs whose artifacts should be deleted
+ */
+export async function revokeGrantsByIds(grantIds) {
+    if (grantIds.length === 0)
+        return;
+    const pool = getPool();
+    await pool.query('DELETE FROM oidc_payloads WHERE grant_id = ANY($1)', [grantIds]);
+}
+/**
+ * Delete all expired oidc_payloads records (fire-and-forget).
+ *
+ * Called opportunistically on auth flow start to keep the oidc_payloads table
+ * clean without requiring a cron job or external scheduler. This pattern is
+ * proven from Porta v4 — self-regulating cleanup tied to actual usage.
+ *
+ * The function is intentionally fire-and-forget: it does NOT return a promise
+ * that callers should await. Errors are silently caught and logged — a failed
+ * cleanup is harmless (expired rows are already inert) and will be retried on
+ * the next auth flow start.
+ *
+ * Uses the expires_at index for efficient deletion.
+ */
+export function purgeExpired() {
+    const pool = getPool();
+    pool
+        .query('DELETE FROM oidc_payloads WHERE expires_at IS NOT NULL AND expires_at < NOW()')
+        .catch((err) => {
+        // Fire-and-forget — log but don't interrupt the auth flow
+        logger.warn({ err }, 'Failed to purge expired oidc_payloads (will retry on next auth flow)');
+    });
+}
+//# sourceMappingURL=postgres-adapter.js.map

package/dist/oidc/postgres-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres-adapter.js","sourceRoot":"","sources":["../../src/oidc/postgres-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAiB1C;;;;;;GAMG;AACH,MAAM,OAAO,eAAe;IAC1B,yFAAyF;IAC/E,IAAI,CAAS;IAEvB,YAAY,IAAY;QACtB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,OAAuB,EAAE,SAAiB;QACjE,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QAEvB,6DAA6D;QAC7D,8EAA8E;QAC9E,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC;QACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC;QAC1C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC;QAEhC,0EAA0E;QAC1E,MAAM,SAAS,GAAG,SAAS;YACzB,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC;YACzC,CAAC,CAAC,IAAI,CAAC;QAET,MAAM,IAAI,CAAC,KAAK,CACd;;;4FAGsF,EACtF,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,CAAC,CAC5E,CAAC;IACJ,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,IAAI,CAAC,EAAU;QACnB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;kFAC4E,EAC5E,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAChB,CAAC;QAEF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAE/C,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,cAAc,CAAC,QAAgB;QACnC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;yFACmF,EACnF,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CACtB,CAAC;QAEF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAE/C,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,SAAS,CAAC,GAAW;QACzB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;mFAC6E,EAC7E,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CACjB,CAAC;QAEF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAE/C,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;;oBAGc,EACd,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAChB,CAAC;QAEF,4FAA4F;QAC5F,+FAA+F;QAC/F,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;YAAE,MAAM,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;IAC7D,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QAEvB,MAAM,IAAI,CAAC,KAAK,CACd,uDAAuD,EACvD,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAChB,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,eAAe,CAAC,OAAe;QACnC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QAEvB,MAAM,IAAI,CAAC,KAAK,CACd,6DAA6D,EAC7D,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CACrB,CAAC;IACJ,CAAC;IAED;;;;;;;;;OASG;IACO,YAAY,CAAC,GAGtB;QACC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;QAE5B,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;YACpB,yEAAyE;YACzE,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;QAClE,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AAED,8EAA8E;AAC9E,sDAAsD;AACtD,8EAA8E;AAE9E;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,QAAkB;IACxD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAElC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,IAAI,CAAC,KAAK,CACd,oDAAoD,EACpD,CAAC,QAAQ,CAAC,CACX,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,YAAY;IAC1B,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI;SACD,KAAK,CAAC,+EAA+E,CAAC;SACtF,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACb,0DAA0D;QAC1D,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,sEAAsE,CAAC,CAAC;IAC/F,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/oidc/protocol-security-observer.d.ts

@@ -0,0 +1,38 @@
+import type { IncomingMessage } from 'node:http';
+import type Provider from 'oidc-provider';
+/** Stable categories for rejected requests at public OIDC protocol boundaries. */
+export type ProtocolSecurityEventClass = 'authorization-rejected' | 'token-grant-rejected' | 'userinfo-rejected' | 'end-session-rejected' | 'introspection-rejected' | 'revocation-rejected' | 'client-tenant-binding-rejected' | 'interaction-context-rejected';
+/** Minimal input accepted by the privacy-safe protocol rejection observer. */
+export interface ProtocolSecurityRejectionInput {
+    /** Raw request shared by the outer Koa application and the OIDC provider. */
+    request: IncomingMessage;
+    /** Stable location-oriented rejection category. */
+    eventClass: ProtocolSecurityEventClass;
+    /** Public client identifier when the rejecting boundary has already parsed one. */
+    clientId?: string;
+}
+/**
+ * Associates a server-generated request identifier with the raw request object.
+ *
+ * A weak association lets the nested OIDC provider retrieve the identifier without copying
+ * request-controlled headers or retaining request state after Node releases the request.
+ */
+export declare function registerProtocolRequestCorrelation(request: IncomingMessage, requestId: string): void;
+/**
+ * Produces a stable one-way representation of a bounded public client identifier.
+ *
+ * The domain separator prevents the digest from being confused with hashes used for a different
+ * purpose. Missing or malformed identifiers remain `null`; the observer never invents an ID.
+ */
+export declare function digestProtocolClientId(clientId: unknown): string | null;
+/**
+ * Emits one bounded, privacy-safe security-rejection event per request and category.
+ *
+ * Observation is deliberately best-effort: missing correlation suppresses the event, and logging
+ * never performs I/O or changes the protocol response. Error objects, request parameters, and raw
+ * identifiers are intentionally outside this API.
+ */
+export declare function observeProtocolSecurityRejection(input: ProtocolSecurityRejectionInput): void;
+/** Registers the enabled provider rejection events covered by Porta's protocol assurance. */
+export declare function registerProtocolSecurityObservers(provider: Provider): void;
+//# sourceMappingURL=protocol-security-observer.d.ts.map

package/dist/oidc/protocol-security-observer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol-security-observer.d.ts","sourceRoot":"","sources":["../../src/oidc/protocol-security-observer.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAC;AAU1C,kFAAkF;AAClF,MAAM,MAAM,0BAA0B,GAClC,wBAAwB,GACxB,sBAAsB,GACtB,mBAAmB,GACnB,sBAAsB,GACtB,wBAAwB,GACxB,qBAAqB,GACrB,gCAAgC,GAChC,8BAA8B,CAAC;AAEnC,8EAA8E;AAC9E,MAAM,WAAW,8BAA8B;IAC7C,6EAA6E;IAC7E,OAAO,EAAE,eAAe,CAAC;IACzB,mDAAmD;IACnD,UAAU,EAAE,0BAA0B,CAAC;IACvC,mFAAmF;IACnF,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,wBAAgB,kCAAkC,CAChD,OAAO,EAAE,eAAe,EACxB,SAAS,EAAE,MAAM,GAChB,IAAI,CAEN;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAUvE;AAED;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,8BAA8B,GAAG,IAAI,CAsB5F;AAqBD,6FAA6F;AAC7F,wBAAgB,iCAAiC,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAmB1E"}

package/dist/oidc/protocol-security-observer.js

@@ -0,0 +1,93 @@
+import { createHash } from 'node:crypto';
+import { logger } from '../lib/logger.js';
+const MAX_CLIENT_ID_LENGTH = 255;
+const CLIENT_ID_DIGEST_DOMAIN = 'porta:oidc-client-id:v1\0';
+const requestCorrelations = new WeakMap();
+const observedClasses = new WeakMap();
+/**
+ * Associates a server-generated request identifier with the raw request object.
+ *
+ * A weak association lets the nested OIDC provider retrieve the identifier without copying
+ * request-controlled headers or retaining request state after Node releases the request.
+ */
+export function registerProtocolRequestCorrelation(request, requestId) {
+    requestCorrelations.set(request, requestId);
+}
+/**
+ * Produces a stable one-way representation of a bounded public client identifier.
+ *
+ * The domain separator prevents the digest from being confused with hashes used for a different
+ * purpose. Missing or malformed identifiers remain `null`; the observer never invents an ID.
+ */
+export function digestProtocolClientId(clientId) {
+    if (typeof clientId !== 'string' ||
+        clientId.length === 0 ||
+        clientId.length > MAX_CLIENT_ID_LENGTH) {
+        return null;
+    }
+    return createHash('sha256').update(CLIENT_ID_DIGEST_DOMAIN).update(clientId).digest('hex');
+}
+/**
+ * Emits one bounded, privacy-safe security-rejection event per request and category.
+ *
+ * Observation is deliberately best-effort: missing correlation suppresses the event, and logging
+ * never performs I/O or changes the protocol response. Error objects, request parameters, and raw
+ * identifiers are intentionally outside this API.
+ */
+export function observeProtocolSecurityRejection(input) {
+    const requestId = requestCorrelations.get(input.request);
+    if (requestId === undefined)
+        return;
+    const previous = observedClasses.get(input.request) ?? new Set();
+    if (previous.has(input.eventClass))
+        return;
+    previous.add(input.eventClass);
+    observedClasses.set(input.request, previous);
+    try {
+        logger.warn({
+            event: 'protocol-security-rejection',
+            'synthetic-correlation-id': requestId,
+            'event-class': input.eventClass,
+            'public-client-id-digest': digestProtocolClientId(input.clientId),
+        }, 'protocol-security-rejection');
+    }
+    catch {
+        // Security observation must never change the protocol response or create a secondary failure.
+    }
+}
+function clientIdFromProviderContext(context) {
+    const resolvedClientId = context.oidc.client?.clientId;
+    if (typeof resolvedClientId === 'string')
+        return resolvedClientId;
+    const parameterClientId = context.oidc.params?.client_id;
+    return typeof parameterClientId === 'string' ? parameterClientId : undefined;
+}
+function observeProviderRejection(context, eventClass) {
+    observeProtocolSecurityRejection({
+        request: context.req,
+        eventClass,
+        clientId: clientIdFromProviderContext(context),
+    });
+}
+/** Registers the enabled provider rejection events covered by Porta's protocol assurance. */
+export function registerProtocolSecurityObservers(provider) {
+    provider.on('authorization.error', (context) => {
+        observeProviderRejection(context, 'authorization-rejected');
+    });
+    provider.on('grant.error', (context) => {
+        observeProviderRejection(context, 'token-grant-rejected');
+    });
+    provider.on('userinfo.error', (context) => {
+        observeProviderRejection(context, 'userinfo-rejected');
+    });
+    provider.on('end_session.error', (context) => {
+        observeProviderRejection(context, 'end-session-rejected');
+    });
+    provider.on('introspection.error', (context) => {
+        observeProviderRejection(context, 'introspection-rejected');
+    });
+    provider.on('revocation.error', (context) => {
+        observeProviderRejection(context, 'revocation-rejected');
+    });
+}
+//# sourceMappingURL=protocol-security-observer.js.map

package/dist/oidc/protocol-security-observer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol-security-observer.js","sourceRoot":"","sources":["../../src/oidc/protocol-security-observer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIzC,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,MAAM,oBAAoB,GAAG,GAAG,CAAC;AACjC,MAAM,uBAAuB,GAAG,2BAA2B,CAAC;AAE5D,MAAM,mBAAmB,GAAG,IAAI,OAAO,EAA2B,CAAC;AACnE,MAAM,eAAe,GAAG,IAAI,OAAO,EAAoD,CAAC;AAuBxF;;;;;GAKG;AACH,MAAM,UAAU,kCAAkC,CAChD,OAAwB,EACxB,SAAiB;IAEjB,mBAAmB,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAiB;IACtD,IACE,OAAO,QAAQ,KAAK,QAAQ;QAC5B,QAAQ,CAAC,MAAM,KAAK,CAAC;QACrB,QAAQ,CAAC,MAAM,GAAG,oBAAoB,EACtC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC7F,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gCAAgC,CAAC,KAAqC;IACpF,MAAM,SAAS,GAAG,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACzD,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO;IAEpC,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,GAAG,EAA8B,CAAC;IAC7F,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC;QAAE,OAAO;IAC3C,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC/B,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAE7C,IAAI,CAAC;QACH,MAAM,CAAC,IAAI,CACT;YACE,KAAK,EAAE,6BAA6B;YACpC,0BAA0B,EAAE,SAAS;YACrC,aAAa,EAAE,KAAK,CAAC,UAAU;YAC/B,yBAAyB,EAAE,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC;SAClE,EACD,6BAA6B,CAC9B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,8FAA8F;IAChG,CAAC;AACH,CAAC;AAED,SAAS,2BAA2B,CAAC,OAA2B;IAC9D,MAAM,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC;IACvD,IAAI,OAAO,gBAAgB,KAAK,QAAQ;QAAE,OAAO,gBAAgB,CAAC;IAElE,MAAM,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC;IACzD,OAAO,OAAO,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/E,CAAC;AAED,SAAS,wBAAwB,CAC/B,OAA2B,EAC3B,UAAsC;IAEtC,gCAAgC,CAAC;QAC/B,OAAO,EAAE,OAAO,CAAC,GAAG;QACpB,UAAU;QACV,QAAQ,EAAE,2BAA2B,CAAC,OAAO,CAAC;KAC/C,CAAC,CAAC;AACL,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,iCAAiC,CAAC,QAAkB;IAClE,QAAQ,CAAC,EAAE,CAAC,qBAAqB,EAAE,CAAC,OAAO,EAAE,EAAE;QAC7C,wBAAwB,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IACH,QAAQ,CAAC,EAAE,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,EAAE;QACrC,wBAAwB,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IACH,QAAQ,CAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,OAAO,EAAE,EAAE;QACxC,wBAAwB,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IACH,QAAQ,CAAC,EAAE,CAAC,mBAAmB,EAAE,CAAC,OAAO,EAAE,EAAE;QAC3C,wBAAwB,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IACH,QAAQ,CAAC,EAAE,CAAC,qBAAqB,EAAE,CAAC,OAAO,EAAE,EAAE;QAC7C,wBAAwB,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IACH,QAAQ,CAAC,EAAE,CAAC,kBAAkB,EAAE,CAAC,OAAO,EAAE,EAAE;QAC1C,wBAAwB,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/oidc/provider.d.ts

@@ -0,0 +1,37 @@
+/**
+ * OIDC provider factory.
+ *
+ * Creates and configures the node-oidc-provider instance with all
+ * configuration, adapters, keys, and account finder wired together.
+ * This is the main entry point for provider creation, called once at startup.
+ *
+ * The provider uses a base issuer URL and supports path-based
+ * multi-tenancy where each organization gets a unique issuer:
+ *   {issuerBaseUrl}/{orgSlug}
+ */
+import Provider from 'oidc-provider';
+import type { OidcTtlConfig } from '../lib/system-config.js';
+import type { JwkKeyPair } from '../lib/signing-keys.js';
+/**
+ * Create and configure the node-oidc-provider instance.
+ *
+ * Wires together the adapter factory, signing keys, TTL config,
+ * account finder, CORS handler, and interaction URL builder into a
+ * single Provider instance ready to handle OIDC requests.
+ *
+ * Client lookup is handled by the adapter pattern: oidc-provider calls
+ * adapter.find('Client', id), which the adapter factory routes to
+ * findForOidc() in the clients service. This returns client metadata
+ * including SHA-256 hashed secrets for confidential clients.
+ *
+ * @param params.jwks - JWK key set loaded from the signing_keys table
+ * @param params.ttl - TTL configuration loaded from the system_config table
+ * @returns Configured Provider instance
+ */
+export declare function createOidcProvider(params: {
+    jwks: {
+        keys: JwkKeyPair[];
+    };
+    ttl: OidcTtlConfig;
+}): Promise<Provider>;
+//# sourceMappingURL=provider.d.ts.map

package/dist/oidc/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../src/oidc/provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,QAAQ,MAAM,eAAe,CAAC;AAErC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAG7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAOzD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE;IAC/C,IAAI,EAAE;QAAE,IAAI,EAAE,UAAU,EAAE,CAAA;KAAE,CAAC;IAC7B,GAAG,EAAE,aAAa,CAAC;CACpB,GAAG,OAAO,CAAC,QAAQ,CAAC,CA0CpB"}

package/dist/oidc/provider.js

@@ -0,0 +1,71 @@
+/**
+ * OIDC provider factory.
+ *
+ * Creates and configures the node-oidc-provider instance with all
+ * configuration, adapters, keys, and account finder wired together.
+ * This is the main entry point for provider creation, called once at startup.
+ *
+ * The provider uses a base issuer URL and supports path-based
+ * multi-tenancy where each organization gets a unique issuer:
+ *   {issuerBaseUrl}/{orgSlug}
+ */
+import Provider from 'oidc-provider';
+import { config } from '../config/index.js';
+import { getRedis } from '../lib/redis.js';
+import { logger } from '../lib/logger.js';
+import { buildProviderConfiguration } from './configuration.js';
+import { createAdapterFactory } from './adapter-factory.js';
+import { findAccount } from './account-finder.js';
+import { oidcCors } from '../middleware/oidc-cors.js';
+import { registerProtocolSecurityObservers } from './protocol-security-observer.js';
+/**
+ * Create and configure the node-oidc-provider instance.
+ *
+ * Wires together the adapter factory, signing keys, TTL config,
+ * account finder, CORS handler, and interaction URL builder into a
+ * single Provider instance ready to handle OIDC requests.
+ *
+ * Client lookup is handled by the adapter pattern: oidc-provider calls
+ * adapter.find('Client', id), which the adapter factory routes to
+ * findForOidc() in the clients service. This returns client metadata
+ * including SHA-256 hashed secrets for confidential clients.
+ *
+ * @param params.jwks - JWK key set loaded from the signing_keys table
+ * @param params.ttl - TTL configuration loaded from the system_config table
+ * @returns Configured Provider instance
+ */
+export async function createOidcProvider(params) {
+    const { jwks, ttl } = params;
+    // Build the complete provider configuration from all dependencies
+    const configuration = buildProviderConfiguration({
+        ttl,
+        jwks,
+        cookieKeys: config.cookieKeys,
+        findAccount,
+        adapterFactory: createAdapterFactory(),
+        clientBasedCORS: oidcCors,
+        // Interaction URL builder.
+        // Also stores the auth-flow org ID in Redis so interaction handlers
+        // can recover the validated client tenant after the URL slug is stripped.
+        interactionUrl: (ctx, interaction) => {
+            const req = ctx.req ?? ctx.request?.req;
+            const org = req?._portaOrganization;
+            if (org?.id && interaction?.uid) {
+                getRedis()
+                    .set(`interaction:org:${interaction.uid}`, org.id, 'EX', 3600)
+                    .catch((err) => logger.warn({ err }, 'Failed to store interaction org'));
+            }
+            return `/interaction/${interaction.uid}`;
+        },
+    });
+    // Create provider with base issuer URL.
+    // The actual per-org issuer is resolved dynamically via URL rewriting
+    // in the Koa router (server.ts strips the /:orgSlug prefix).
+    const provider = new Provider(config.issuerBaseUrl, configuration);
+    registerProtocolSecurityObservers(provider);
+    // Enable proxy mode — required for path-based multi-tenancy so the
+    // provider trusts forwarded headers and handles URL rewriting correctly.
+    provider.proxy = true;
+    return provider;
+}
+//# sourceMappingURL=provider.js.map

package/dist/oidc/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../../src/oidc/provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,QAAQ,MAAM,eAAe,CAAC;AACrC,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AACtD,OAAO,EAAE,iCAAiC,EAAE,MAAM,iCAAiC,CAAC;AAEpF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAGxC;IACC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;IAE7B,kEAAkE;IAClE,MAAM,aAAa,GAAG,0BAA0B,CAAC;QAC/C,GAAG;QACH,IAAI;QACJ,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,WAAW;QACX,cAAc,EAAE,oBAAoB,EAAE;QACtC,eAAe,EAAE,QAAQ;QACzB,2BAA2B;QAC3B,oEAAoE;QACpE,0EAA0E;QAC1E,cAAc,EAAE,CAAC,GAAG,EAAE,WAAW,EAAE,EAAE;YAKnC,MAAM,GAAG,GACN,GAA8B,CAAC,GAAG,IAAK,GAA8B,CAAC,OAAO,EAAE,GAAG,CAAC;YACtF,MAAM,GAAG,GAAG,GAAG,EAAE,kBAAkB,CAAC;YACpC,IAAI,GAAG,EAAE,EAAE,IAAI,WAAW,EAAE,GAAG,EAAE,CAAC;gBAChC,QAAQ,EAAE;qBACP,GAAG,CAAC,mBAAmB,WAAW,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC;qBAC7D,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,iCAAiC,CAAC,CAAC,CAAC;YACtF,CAAC;YACD,OAAO,gBAAgB,WAAW,CAAC,GAAG,EAAE,CAAC;QAC3C,CAAC;KACF,CAAC,CAAC;IAEH,wCAAwC;IACxC,sEAAsE;IACtE,6DAA6D;IAC7D,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;IACnE,iCAAiC,CAAC,QAAQ,CAAC,CAAC;IAE5C,mEAAmE;IACnE,yEAAyE;IACzE,QAAQ,CAAC,KAAK,GAAG,IAAI,CAAC;IAEtB,OAAO,QAAQ,CAAC;AAClB,CAAC"}