@rapidmx/activesync-plugin 1.0.0-beta.2 → 1.0.0-beta.3

package/README.md

@@ -2,7 +2,7 @@
 
 [![CI](https://github.com/RapidMX/activesync/actions/workflows/build.yml/badge.svg?branch=main)](https://github.com/RapidMX/activesync/actions/workflows/build.yml)
 [![Coverage Status](https://coveralls.io/repos/github/RapidMX/activesync/badge.svg?branch=main)](https://coveralls.io/github/RapidMX/activesync?branch=main)
-[![npm version](https://img.shields.io/npm/v/@rapidmx/activesync)](https://www.npmjs.com/package/@rapidmx/activesync)
+[![npm version](https://img.shields.io/npm/v/@rapidmx/activesync-plugin)](https://www.npmjs.com/package/@rapidmx/activesync-plugin)
 
 Exchange ActiveSync (EAS) protocol support for a [`@rapidmx/restapi`](https://github.com/RapidMX/restapi)-based
 mail server — covers every command a real mobile client (iOS Mail, Outlook mobile, Android/Samsung Mail) needs
@@ -23,7 +23,7 @@ EAS-specific login flow — which means a real native device (rather than a test
 token) needs an OAuth 2.0 Authorization Server role in front of it to obtain one; that piece is tracked as a
 follow-up in `@rapidrest/auth`, not this package.
 
-A [`@rapidmx/autodiscover`](https://github.com/RapidMX/autodiscover) mount lets real clients find this
+A [`@rapidmx/autodiscover-plugin`](https://github.com/RapidMX/autodiscover) mount lets real clients find this
 package's endpoint from just an email address.
 
 Responds to a client's `OPTIONS` capability probe with real `MS-ASProtocolVersions`/`MS-ASProtocolCommands`
@@ -36,11 +36,11 @@ means `OPTIONS` falls back to the bare `204` and a client falls back to trying i
 
 ## Usage
 
-Mount `EasRouteMongo`/`EasRouteSQL` (from `@rapidmx/activesync/mongo` or `/sql`) at the protocol's well-known
+Mount `EasRouteMongo`/`EasRouteSQL` (from `@rapidmx/activesync-plugin/mongo` or `/sql`) at the protocol's well-known
 path with a one-line subclass:
 
 ```ts
-import { EasRouteMongo } from "@rapidmx/activesync/mongo";
+import { EasRouteMongo } from "@rapidmx/activesync-plugin/mongo";
 import { RouteDecorators } from "@rapidrest/service-core";
 const { Route } = RouteDecorators;
 

package/dist/lib/BaseDeviceSyncStateRoute.js

@@ -30,6 +30,11 @@ const { Auth, Param, Post, Request, User: AuthUser } = RouteDecorators;
  * existing 449 gate, at which point `ProvisionCommand.issuePolicy` sees the flag and sends the device a
  * `RemoteWipe` directive instead of a normal policy document - no separate push/notification channel is needed.
  *
+ * **Scope**: a `DeviceSyncState` row is one (mailbox, client-supplied `DeviceId`) pairing, so the wipe and the block
+ * that follows its acknowledgement apply to that `DeviceId` only. A compliant client wipes itself; a client that
+ * ignores the directive can pair again under a different `DeviceId` with the same credentials. Cutting such a client
+ * off requires revoking the account's credentials - not something this route does.
+ *
  * `deviceSyncStateClass` is supplied by the Mongo/SQL concrete subclasses, the same one-line-per-backend
  * pattern used throughout this library.
  *
@@ -69,9 +74,27 @@ export class BaseDeviceSyncStateRoute {
             remoteWipeRequested: true,
             remoteWipeAccountOnly: accountOnly,
             provisioned: false,
+            // The old key must stop working immediately, not just once the device next provisions.
+            policyKey: null,
         });
         return deviceSyncState;
     }
+    /**
+     * Lets a device that acknowledged a remote wipe (`blocked`, see `ProvisionCommand`) connect again: it must still
+     * complete a fresh Provision handshake. Admin-only, like `remoteWipe`.
+     */
+    async unblock(uid, user) {
+        if (!user || !UserUtils.hasRoles(user, this.trustedRoles)) {
+            throw new ApiError(ApiErrors.AUTH_PERMISSION_FAILURE, 403, ApiErrorMessages.AUTH_PERMISSION_FAILURE);
+        }
+        const repo = await this.getDeviceSyncStateRepo();
+        const deviceSyncState = await repo.findOne(uid, { ignoreACL: true });
+        if (!deviceSyncState) {
+            throw new ApiError(ApiErrors.NOT_FOUND, 404, ApiErrorMessages.NOT_FOUND);
+        }
+        await persistDeviceSyncState(deviceSyncState, repo, { blocked: false });
+        return deviceSyncState;
+    }
 }
 __decorate([
     Config("trusted_roles", ["admin"]),
@@ -87,4 +110,13 @@ __decorate([
     __metadata("design:paramtypes", [String, Object, Object]),
     __metadata("design:returntype", Promise)
 ], BaseDeviceSyncStateRoute.prototype, "remoteWipe", null);
+__decorate([
+    Auth(["jwt"]),
+    Post("/:uid/unblock"),
+    __param(0, Param("uid")),
+    __param(1, AuthUser),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, Object]),
+    __metadata("design:returntype", Promise)
+], BaseDeviceSyncStateRoute.prototype, "unblock", null);
 //# sourceMappingURL=BaseDeviceSyncStateRoute.js.map

package/dist/lib/BaseDeviceSyncStateRoute.js.map

@@ -1 +1 @@
-{"version":3,"file":"BaseDeviceSyncStateRoute.js","sourceRoot":"","sources":["../../src/BaseDeviceSyncStateRoute.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,+EAA+E;AAC/E,mEAAmE;AACnE,mCAAmC;AACnC,+EAA+E;AAC/E,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAiB,SAAS,EAAgB,MAAM,iBAAiB,CAAC;AACrG,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAe,SAAS,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE/G,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,MAAM,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC;AACpC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,eAAe,CAAC;AAEvE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAgB,wBAAwB;IAA9C;QAIc,iBAAY,GAAa,CAAC,OAAO,CAAC,CAAC;IAiDjD,CAAC;IA1CW,KAAK,CAAC,sBAAsB;QAChC,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC5B,IAAI,CAAC,mBAAmB,GAAG,MAAM,IAAI,CAAC,cAAe,CAAC,WAAW,CAAC,SAAS,EAAE;gBACzE,IAAI,EAAE,IAAI,CAAC,oBAAoB,CAAC,IAAI;gBACpC,IAAI,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC;aACpC,CAAC,CAAC;QACP,CAAC;QACD,OAAO,IAAI,CAAC,mBAAmB,CAAC;IACpC,CAAC;IAED;;;;;;OAMG;IAGU,AAAN,KAAK,CAAC,UAAU,CACL,GAAW,EAChB,GAAgB,EACf,IAAc;QAExB,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,uBAAuB,EAAE,GAAG,EAAE,gBAAgB,CAAC,uBAAuB,CAAC,CAAC;QACzG,CAAC;QAED,MAAM,IAAI,GAAiB,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC/D,MAAM,eAAe,GAAkB,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,IAAI,CAAC,eAAe,EAAE,CAAC;YACnB,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,WAAW,GAAY,GAAG,CAAC,IAAI,EAAE,WAAW,KAAK,IAAI,CAAC;QAC5D,MAAM,sBAAsB,CAAC,eAAe,EAAE,IAAI,EAAE;YAChD,mBAAmB,EAAE,IAAI;YACzB,qBAAqB,EAAE,WAAW;YAClC,WAAW,EAAE,KAAK;SACrB,CAAC,CAAC;QACH,OAAO,eAAe,CAAC;IAC3B,CAAC;CACJ;AAjDa;IADT,MAAM,CAAC,eAAe,EAAE,CAAC,OAAO,CAAC,CAAC;;8DACU;AA0BhC;IAFZ,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;IACb,IAAI,CAAC,mBAAmB,CAAC;IAErB,WAAA,KAAK,CAAC,KAAK,CAAC,CAAA;IACZ,WAAA,OAAO,CAAA;IACP,WAAA,QAAQ,CAAA;;;;0DAmBZ"}
+{"version":3,"file":"BaseDeviceSyncStateRoute.js","sourceRoot":"","sources":["../../src/BaseDeviceSyncStateRoute.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,+EAA+E;AAC/E,mEAAmE;AACnE,mCAAmC;AACnC,+EAA+E;AAC/E,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAiB,SAAS,EAAgB,MAAM,iBAAiB,CAAC;AACrG,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAe,SAAS,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE/G,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,MAAM,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC;AACpC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,eAAe,CAAC;AAEvE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,OAAgB,wBAAwB;IAA9C;QAIc,iBAAY,GAAa,CAAC,OAAO,CAAC,CAAC;IAwEjD,CAAC;IAjEW,KAAK,CAAC,sBAAsB;QAChC,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC5B,IAAI,CAAC,mBAAmB,GAAG,MAAM,IAAI,CAAC,cAAe,CAAC,WAAW,CAAC,SAAS,EAAE;gBACzE,IAAI,EAAE,IAAI,CAAC,oBAAoB,CAAC,IAAI;gBACpC,IAAI,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC;aACpC,CAAC,CAAC;QACP,CAAC;QACD,OAAO,IAAI,CAAC,mBAAmB,CAAC;IACpC,CAAC;IAED;;;;;;OAMG;IAGU,AAAN,KAAK,CAAC,UAAU,CACL,GAAW,EAChB,GAAgB,EACf,IAAc;QAExB,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,uBAAuB,EAAE,GAAG,EAAE,gBAAgB,CAAC,uBAAuB,CAAC,CAAC;QACzG,CAAC;QAED,MAAM,IAAI,GAAiB,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC/D,MAAM,eAAe,GAAkB,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,IAAI,CAAC,eAAe,EAAE,CAAC;YACnB,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,WAAW,GAAY,GAAG,CAAC,IAAI,EAAE,WAAW,KAAK,IAAI,CAAC;QAC5D,MAAM,sBAAsB,CAAC,eAAe,EAAE,IAAI,EAAE;YAChD,mBAAmB,EAAE,IAAI;YACzB,qBAAqB,EAAE,WAAW;YAClC,WAAW,EAAE,KAAK;YAClB,uFAAuF;YACvF,SAAS,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,OAAO,eAAe,CAAC;IAC3B,CAAC;IAED;;;OAGG;IAGU,AAAN,KAAK,CAAC,OAAO,CAAe,GAAW,EAAY,IAAc;QACpE,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,uBAAuB,EAAE,GAAG,EAAE,gBAAgB,CAAC,uBAAuB,CAAC,CAAC;QACzG,CAAC;QAED,MAAM,IAAI,GAAiB,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC/D,MAAM,eAAe,GAAkB,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,IAAI,CAAC,eAAe,EAAE,CAAC;YACnB,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,sBAAsB,CAAC,eAAe,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACxE,OAAO,eAAe,CAAC;IAC3B,CAAC;CACJ;AAxEa;IADT,MAAM,CAAC,eAAe,EAAE,CAAC,OAAO,CAAC,CAAC;;8DACU;AA0BhC;IAFZ,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;IACb,IAAI,CAAC,mBAAmB,CAAC;IAErB,WAAA,KAAK,CAAC,KAAK,CAAC,CAAA;IACZ,WAAA,OAAO,CAAA;IACP,WAAA,QAAQ,CAAA;;;;0DAqBZ;AAQY;IAFZ,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;IACb,IAAI,CAAC,eAAe,CAAC;IACA,WAAA,KAAK,CAAC,KAAK,CAAC,CAAA;IAAe,WAAA,QAAQ,CAAA;;;;uDAaxD"}

package/dist/lib/BaseEasRoute.js

@@ -16,11 +16,11 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 ///////////////////////////////////////////////////////////////////////////////
 import { ApiError, ObjectDecorators } from "@rapidrest/core";
 import { ApiErrorMessages, ApiErrors, RepoUtils, RouteDecorators, } from "@rapidrest/service-core";
-import { WbxmlDecoder } from "./codec/WbxmlDecoder.js";
+import { WbxmlDecodeError, WbxmlDecoder } from "./codec/WbxmlDecoder.js";
 import { WbxmlEncoder } from "./codec/WbxmlEncoder.js";
 import { persistDeviceSyncState } from "./EasSyncKeyUtils.js";
 import { resolveCallerMailboxUid } from "@rapidmx/restapi";
-const { Init, Logger } = ObjectDecorators;
+const { Config, Init, Logger } = ObjectDecorators;
 const { Auth, Options, Post, Request, Response, User: AuthUser } = RouteDecorators;
 /** HTTP 449 ("Retry With") is not a standard HTTP status, but is the long-established Exchange ActiveSync
  * convention a real client recognizes as "you must successfully complete `Provision` before this command will
@@ -38,9 +38,27 @@ const HTTP_STATUS_RETRY_WITH = 449;
  * `ResolveRecipients`). No MS-ASCMD `Sync`/`FolderSync`/`Provision` schema element became newly mandatory
  * between 14.1 and 16.1 outside `Oof`/IRM. Ascending, matching the order Microsoft's own spec lists them in. */
 const MS_AS_PROTOCOL_VERSIONS = "14.0,14.1,16.0,16.1";
+/** Default `mail:eas:max_request_bytes` - comfortably above a real device's largest request (a `SendMail` with
+ * attachments), far below the host-wide body limit. The WBXML decoder's own element limits bound memory further. */
+const DEFAULT_MAX_REQUEST_BYTES = 16 * 1024 * 1024;
+/** Settings request elements a device may send before it is provisioned (and without a policy key): the first-run
+ * `UserInformation` lookup and `DeviceInformation` report. Anything else - `Oof` in particular, which writes the
+ * mailbox's automatic replies - needs a provisioned device. */
+const SETTINGS_WITHOUT_PROVISIONING = new Set(["UserInformation", "DeviceInformation"]);
 function firstQueryValue(value) {
     return Array.isArray(value) ? value[0] : value;
 }
+/** An acceptable `DeviceId`: up to 128 visible ASCII characters other than parentheses and commas. [MS-ASHTTP] only
+ * allows alphanumerics; this stays more tolerant of real clients while keeping the value out of the query parser's
+ * `op(value)` and `in(a,b)` syntax - `DeviceId` goes straight into `find()` criteria for the device's own rows. */
+const DEVICE_ID_PATTERN = /^[\x21-\x27\x2a\x2b\x2d-\x7e]{1,128}$/;
+/** `DeviceId` values the query parser gives a meaning of its own even without an operator: `me` becomes the caller's
+ * uid (or a 403 without one) and `null` becomes an IS NULL match. Both are refused like any other malformed id. */
+const RESERVED_DEVICE_IDS = new Set(["me", "null"]);
+/** Whether `deviceId` is an acceptable `DeviceId` (`DEVICE_ID_PATTERN`, and not one of `RESERVED_DEVICE_IDS`). */
+export function isValidDeviceId(deviceId) {
+    return deviceId !== undefined && DEVICE_ID_PATTERN.test(deviceId) && !RESERVED_DEVICE_IDS.has(deviceId);
+}
 /**
  * Abstract base for the single fixed EAS endpoint (`POST /Microsoft-Server-ActiveSync` by MS-ASHTTP
  * convention, though the concrete path is left to the consuming application to mount via `@Route(...)` — see
@@ -54,10 +72,13 @@ function firstQueryValue(value) {
  * deliberately does not implement itself — see the architecture plan's "Auth" section for the full reasoning
  * behind this choice over a per-request Basic Auth strategy.
  *
- * **Dispatch flow**: resolve the caller's own `Mailbox` (never a client-supplied one — `resolveCallerMailboxUid`,
- * the same helper `BaseSearchRoute` already uses), find-or-create that (mailbox, device) pair's
- * `DeviceSyncState`, enforce the provisioning gate, decode the WBXML request body (if any), dispatch to the
- * matching registered `EasCommandHandler`, bump `lastSyncAt`, and encode the handler's response back to WBXML.
+ * **Dispatch flow**: reject a body over `mail:eas:max_request_bytes` (413), resolve the caller's own `Mailbox` (never
+ * a client-supplied one — `resolveCallerMailboxUid`), find-or-create that (mailbox, device) pair's `DeviceSyncState`,
+ * refuse a `blocked` device (one that acknowledged a remote wipe) with 403 for anything but `Provision` (which
+ * answers Status 129 itself), decode the WBXML request body (if any; malformed or over the decoder's element limits
+ * -> 400), enforce the provisioning gate (provisioned *and* presenting the stored policy key, else 449 - only
+ * `Provision` and a `Settings` request limited to `UserInformation`/`DeviceInformation` are exempt), dispatch to the matching registered
+ * `EasCommandHandler`, record `lastSyncAt` (best-effort), and encode the handler's response back to WBXML.
  *
  * **Command handlers** are supplied via `commandHandlerClasses` (empty by default — this class alone is just
  * the transport skeleton; concrete command support, e.g. `ProvisionCommand`/`FolderSyncCommand`, is added
@@ -84,6 +105,8 @@ export class BaseEasRoute {
          * for a transport skeleton with no commands implemented yet, not a bug to work around. */
         this.commandHandlerClasses = [];
         this.handlers = new Map();
+        /** Largest request body `dispatch()` accepts (HTTP 413 beyond it). */
+        this.maxRequestBytes = DEFAULT_MAX_REQUEST_BYTES;
     }
     async init() {
         this.deviceSyncStateRepo = await this._objectFactory.newInstance(RepoUtils, {
@@ -124,40 +147,70 @@ export class BaseEasRoute {
         const deviceId = firstQueryValue(req.query["DeviceId"]);
         const deviceType = firstQueryValue(req.query["DeviceType"]) ?? "Unknown";
         const policyKey = firstQueryValue(req.query["PolicyKey"]);
-        if (!cmd || !deviceId) {
+        if (!cmd || !isValidDeviceId(deviceId)) {
             throw new ApiError(ApiErrors.INVALID_REQUEST, 400, ApiErrorMessages.INVALID_REQUEST);
         }
+        // service-core has no per-route body limit, so the host-wide `max_body_size` still bounds how much was
+        // read; this rejects anything beyond the (much lower) EAS limit before any decoding or database work.
+        const declaredLength = Number(firstQueryValue(req.headers["content-length"]));
+        if ((Number.isFinite(declaredLength) && declaredLength > this.maxRequestBytes) || (req.rawBody?.length ?? 0) > this.maxRequestBytes) {
+            res.status(413).send();
+            return;
+        }
         const mailboxUid = await resolveCallerMailboxUid(this.mailboxRepo, user);
         if (!mailboxUid) {
             throw new ApiError(ApiErrors.NOT_FOUND, 404, ApiErrorMessages.NOT_FOUND);
         }
         const deviceSyncState = await this.findOrCreateDeviceSyncState(mailboxUid, deviceId, deviceType);
-        // Every command except the two that must work on an unprovisioned device (Provision itself, and
-        // Settings - real clients query Settings/DeviceInformation as part of first-run setup, before
-        // provisioning completes) requires the device to have already been provisioned.
-        if (!deviceSyncState.provisioned && cmd !== "Provision" && cmd !== "Settings") {
-            res.status(HTTP_STATUS_RETRY_WITH).send();
+        // A device that acknowledged a remote wipe stays locked out until an administrator unblocks it.
+        if (deviceSyncState.blocked && cmd !== "Provision") {
+            res.status(403).send();
             return;
         }
         const handler = this.handlers.get(cmd);
+        // Settings is decoded ahead of the provisioning gate, which needs to see what it asks for; everything else is
+        // only decoded once the gate has passed.
+        let request = cmd === "Settings" && handler ? this.decodeRequest(req) : undefined;
+        // Every command except what must work on an unprovisioned device (Provision itself, and the first-run
+        // Settings lookups real clients make before provisioning completes) requires the device to be provisioned AND
+        // to present the policy key it acknowledged ([MS-ASPROV]: `X-MS-PolicyKey`, or the `PolicyKey` query value).
+        // A missing or stale key - e.g. one from before an admin-requested remote wipe, which clears the stored key -
+        // is sent back through Provision with the same 449 rather than being served.
+        if (!this.exemptFromProvisioning(cmd, request)) {
+            const presentedKey = firstQueryValue(req.headers["x-ms-policykey"]) ?? policyKey;
+            if (!deviceSyncState.provisioned || !deviceSyncState.policyKey || presentedKey !== deviceSyncState.policyKey) {
+                res.status(HTTP_STATUS_RETRY_WITH).send();
+                return;
+            }
+        }
         if (!handler) {
             res.status(501).send();
             return;
         }
-        const request = req.rawBody && req.rawBody.length > 0 ? new WbxmlDecoder().decode(req.rawBody) : undefined;
+        if (cmd !== "Settings") {
+            request = this.decodeRequest(req);
+        }
         const response = await handler.handle({
             user,
             mailboxUid,
             deviceId,
             deviceType,
-            policyKey,
+            policyKey: firstQueryValue(req.headers["x-ms-policykey"]) ?? policyKey,
             deviceSyncState,
             deviceSyncStateRepo: this.deviceSyncStateRepo,
             query: req.query,
             request,
             req,
+            res,
         });
-        await persistDeviceSyncState(deviceSyncState, this.deviceSyncStateRepo, { lastSyncAt: new Date() });
+        // Bookkeeping only - the command already ran, so failing to record the timestamp must never turn a
+        // successful response into an error.
+        try {
+            await persistDeviceSyncState(deviceSyncState, this.deviceSyncStateRepo, { lastSyncAt: new Date() });
+        }
+        catch (err) {
+            this.logger?.warn(`BaseEasRoute: failed to record lastSyncAt for device ${deviceId}: ${err?.message}`);
+        }
         if (!response) {
             res.status(200).send();
             return;
@@ -168,6 +221,25 @@ export class BaseEasRoute {
             .status(200)
             .send(buffer);
     }
+    /** Decodes the WBXML request body, if any (malformed or over the decoder's element limits -> 400). */
+    decodeRequest(req) {
+        try {
+            return req.rawBody && req.rawBody.length > 0 ? new WbxmlDecoder().decode(req.rawBody) : undefined;
+        }
+        catch (err) {
+            if (err instanceof WbxmlDecodeError) {
+                throw new ApiError(ApiErrors.INVALID_REQUEST, 400, `Malformed WBXML request: ${err.message}`);
+            }
+            throw err;
+        }
+    }
+    /** `Provision`, and a `Settings` request whose every element is one `SETTINGS_WITHOUT_PROVISIONING` allows. */
+    exemptFromProvisioning(cmd, request) {
+        if (cmd === "Provision") {
+            return true;
+        }
+        return cmd === "Settings" && (request?.children ?? []).every((child) => SETTINGS_WITHOUT_PROVISIONING.has(child.tag));
+    }
     async findOrCreateDeviceSyncState(mailboxUid, deviceId, deviceType) {
         const existing = await this.deviceSyncStateRepo.find({ mailboxUid, deviceId }, { ignoreACL: true, limit: 1 });
         if (existing[0]) {
@@ -183,6 +255,10 @@ export class BaseEasRoute {
         return await this.deviceSyncStateRepo.create(instance, { ignoreACL: true });
     }
 }
+__decorate([
+    Config("mail:eas:max_request_bytes", DEFAULT_MAX_REQUEST_BYTES),
+    __metadata("design:type", Number)
+], BaseEasRoute.prototype, "maxRequestBytes", void 0);
 __decorate([
     Logger,
     __metadata("design:type", Object)

package/dist/lib/BaseEasRoute.js.map

@@ -1 +1 @@
-{"version":3,"file":"BaseEasRoute.js","sourceRoot":"","sources":["../../src/BaseEasRoute.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,+EAA+E;AAC/E,mEAAmE;AACnE,mCAAmC;AACnC,+EAA+E;AAC/E,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAgB,MAAM,iBAAiB,CAAC;AAC3E,OAAO,EACH,gBAAgB,EAChB,SAAS,EAIT,SAAS,EACT,eAAe,GAClB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAGvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAW,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAEpE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC;AAC1C,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,eAAe,CAAC;AAEnF;;;gDAGgD;AAChD,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAEnC;;;;;;;;;gHASgH;AAChH,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AAEtD,SAAS,eAAe,CAAC,KAAoC;IACzD,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,OAAgB,YAAY;IAAlC;QAII;;kGAE0F;QAChF,0BAAqB,GAAU,EAAE,CAAC;QAO3B,aAAQ,GAAG,IAAI,GAAG,EAA6B,CAAC;IA2HrE,CAAC;IArHgB,AAAN,KAAK,CAAC,IAAI;QACb,IAAI,CAAC,mBAAmB,GAAG,MAAM,IAAI,CAAC,cAAe,CAAC,WAAW,CAAC,SAAS,EAAE;YACzE,IAAI,EAAE,IAAI,CAAC,oBAAoB,CAAC,IAAI;YACpC,IAAI,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC;SACpC,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,GAAG,MAAM,IAAI,CAAC,cAAe,CAAC,WAAW,CAAC,SAAS,EAAE;YACjE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI;YAC5B,IAAI,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC;SAC5B,CAAC,CAAC;QACH,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;YACpD,MAAM,OAAO,GAAsB,MAAM,IAAI,CAAC,cAAe,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;YACxF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAChD,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IAEU,AAAN,KAAK,CAAC,OAAO,CAAW,GAAiB;QAC5C,GAAG,CAAC,SAAS,CAAC,uBAAuB,EAAE,uBAAuB,CAAC;aAC1D,SAAS,CAAC,uBAAuB,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;aAC9E,MAAM,CAAC,GAAG,CAAC;aACX,IAAI,EAAE,CAAC;IAChB,CAAC;IAIY,AAAN,KAAK,CAAC,QAAQ,CAAU,GAAgB,EAAY,GAAiB,EAAY,IAAc;QAClG,IAAI,CAAC,IAAI,CAAC,mBAAmB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjD,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,GAAG,EAAE,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,uBAAuB,EAAE,GAAG,EAAE,gBAAgB,CAAC,uBAAuB,CAAC,CAAC;QACzG,CAAC;QAED,MAAM,GAAG,GAAuB,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QAClE,MAAM,QAAQ,GAAuB,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;QAC5E,MAAM,UAAU,GAAW,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,IAAI,SAAS,CAAC;QACjF,MAAM,SAAS,GAAuB,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;QAC9E,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpB,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,GAAG,EAAE,gBAAgB,CAAC,eAAe,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,UAAU,GAAuB,MAAM,uBAAuB,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QAC7F,IAAI,CAAC,UAAU,EAAE,CAAC;YACd,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,eAAe,GAAM,MAAM,IAAI,CAAC,2BAA2B,CAAC,UAAU,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QAEpG,gGAAgG;QAChG,8FAA8F;QAC9F,gFAAgF;QAChF,IAAI,CAAC,eAAe,CAAC,WAAW,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;YAC5E,GAAG,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,IAAI,EAAE,CAAC;YAC1C,OAAO;QACX,CAAC;QAED,MAAM,OAAO,GAAkC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtE,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACvB,OAAO;QACX,CAAC;QAED,MAAM,OAAO,GACT,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,YAAY,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAE/F,MAAM,QAAQ,GAA6B,MAAM,OAAO,CAAC,MAAM,CAAC;YAC5D,IAAI;YACJ,UAAU;YACV,QAAQ;YACR,UAAU;YACV,SAAS;YACT,eAAe;YACf,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,OAAO;YACP,GAAG;SACN,CAAC,CAAC;QAEH,MAAM,sBAAsB,CAAC,eAAe,EAAE,IAAI,CAAC,mBAAmB,EAAE,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;QAEpG,IAAI,CAAC,QAAQ,EAAE,CAAC;YACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACvB,OAAO;QACX,CAAC;QAED,MAAM,MAAM,GAAW,IAAI,YAAY,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC3D,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,+BAA+B,CAAC;aACzD,SAAS,CAAC,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC;aAC1C,MAAM,CAAC,GAAG,CAAC;aACX,IAAI,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IAEO,KAAK,CAAC,2BAA2B,CAAC,UAAkB,EAAE,QAAgB,EAAE,UAAkB;QAC9F,MAAM,QAAQ,GAAQ,MAAM,IAAI,CAAC,mBAAoB,CAAC,IAAI,CACtD,EAAE,UAAU,EAAE,QAAQ,EAAE,EACxB,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAChC,CAAC;QACF,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACd,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC;QACvB,CAAC;QACD,MAAM,QAAQ,GAAM,IAAI,CAAC,mBAAoB,CAAC,iBAAiB,CAAC;YAC5D,UAAU;YACV,QAAQ;YACR,UAAU;YACV,cAAc,EAAE,EAAE;YAClB,WAAW,EAAE,KAAK;SACrB,CAAC,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,mBAAoB,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjF,CAAC;CACJ;AAxHW;IADP,MAAM;;4CACa;AAGP;IADZ,IAAI;;;;wCAcJ;AAWY;IADZ,OAAO,EAAE;IACY,WAAA,QAAQ,CAAA;;;;2CAK7B;AAIY;IAFZ,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;IACb,IAAI,EAAE;IACgB,WAAA,OAAO,CAAA;IAAoB,WAAA,QAAQ,CAAA;IAAqB,WAAA,QAAQ,CAAA;;;;4CAiEtF"}
+{"version":3,"file":"BaseEasRoute.js","sourceRoot":"","sources":["../../src/BaseEasRoute.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,+EAA+E;AAC/E,mEAAmE;AACnE,mCAAmC;AACnC,+EAA+E;AAC/E,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAgB,MAAM,iBAAiB,CAAC;AAC3E,OAAO,EACH,gBAAgB,EAChB,SAAS,EAIT,SAAS,EACT,eAAe,GAClB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAGvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAW,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAEpE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC;AAClD,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,eAAe,CAAC;AAEnF;;;gDAGgD;AAChD,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAEnC;;;;;;;;;gHASgH;AAChH,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AAEtD;oHACoH;AACpH,MAAM,yBAAyB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEnD;;+DAE+D;AAC/D,MAAM,6BAA6B,GAAG,IAAI,GAAG,CAAC,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAExF,SAAS,eAAe,CAAC,KAAoC;IACzD,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACnD,CAAC;AAED;;mHAEmH;AACnH,MAAM,iBAAiB,GAAG,uCAAuC,CAAC;AAElE;mHACmH;AACnH,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;AAEzE,kHAAkH;AAClH,MAAM,UAAU,eAAe,CAAC,QAA4B;IACxD,OAAO,QAAQ,KAAK,SAAS,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC5G,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,MAAM,OAAgB,YAAY;IAAlC;QAII;;kGAE0F;QAChF,0BAAqB,GAAU,EAAE,CAAC;QAO3B,aAAQ,GAAG,IAAI,GAAG,EAA6B,CAAC;QAEjE,sEAAsE;QAE9D,oBAAe,GAAW,yBAAyB,CAAC;IA8KhE,CAAC;IAxKgB,AAAN,KAAK,CAAC,IAAI;QACb,IAAI,CAAC,mBAAmB,GAAG,MAAM,IAAI,CAAC,cAAe,CAAC,WAAW,CAAC,SAAS,EAAE;YACzE,IAAI,EAAE,IAAI,CAAC,oBAAoB,CAAC,IAAI;YACpC,IAAI,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC;SACpC,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,GAAG,MAAM,IAAI,CAAC,cAAe,CAAC,WAAW,CAAC,SAAS,EAAE;YACjE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI;YAC5B,IAAI,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC;SAC5B,CAAC,CAAC;QACH,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;YACpD,MAAM,OAAO,GAAsB,MAAM,IAAI,CAAC,cAAe,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;YACxF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAChD,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IAEU,AAAN,KAAK,CAAC,OAAO,CAAW,GAAiB;QAC5C,GAAG,CAAC,SAAS,CAAC,uBAAuB,EAAE,uBAAuB,CAAC;aAC1D,SAAS,CAAC,uBAAuB,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;aAC9E,MAAM,CAAC,GAAG,CAAC;aACX,IAAI,EAAE,CAAC;IAChB,CAAC;IAIY,AAAN,KAAK,CAAC,QAAQ,CAAU,GAAgB,EAAY,GAAiB,EAAY,IAAc;QAClG,IAAI,CAAC,IAAI,CAAC,mBAAmB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjD,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,GAAG,EAAE,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,uBAAuB,EAAE,GAAG,EAAE,gBAAgB,CAAC,uBAAuB,CAAC,CAAC;QACzG,CAAC;QAED,MAAM,GAAG,GAAuB,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QAClE,MAAM,QAAQ,GAAuB,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;QAC5E,MAAM,UAAU,GAAW,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,IAAI,SAAS,CAAC;QACjF,MAAM,SAAS,GAAuB,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;QAC9E,IAAI,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,GAAG,EAAE,gBAAgB,CAAC,eAAe,CAAC,CAAC;QACzF,CAAC;QAED,uGAAuG;QACvG,sGAAsG;QACtG,MAAM,cAAc,GAAG,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;QAC9E,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;YAClI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACvB,OAAO;QACX,CAAC;QAED,MAAM,UAAU,GAAuB,MAAM,uBAAuB,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QAC7F,IAAI,CAAC,UAAU,EAAE,CAAC;YACd,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,eAAe,GAAM,MAAM,IAAI,CAAC,2BAA2B,CAAC,UAAU,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QAEpG,gGAAgG;QAChG,IAAI,eAAe,CAAC,OAAO,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;YACjD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACvB,OAAO;QACX,CAAC;QAED,MAAM,OAAO,GAAkC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEtE,8GAA8G;QAC9G,yCAAyC;QACzC,IAAI,OAAO,GAA6B,GAAG,KAAK,UAAU,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAE5G,sGAAsG;QACtG,8GAA8G;QAC9G,6GAA6G;QAC7G,8GAA8G;QAC9G,6EAA6E;QAC7E,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC;YAC7C,MAAM,YAAY,GAAuB,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,IAAI,SAAS,CAAC;YACrG,IAAI,CAAC,eAAe,CAAC,WAAW,IAAI,CAAC,eAAe,CAAC,SAAS,IAAI,YAAY,KAAK,eAAe,CAAC,SAAS,EAAE,CAAC;gBAC3G,GAAG,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC1C,OAAO;YACX,CAAC;QACL,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACvB,OAAO;QACX,CAAC;QACD,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;YACrB,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QACtC,CAAC;QAED,MAAM,QAAQ,GAA6B,MAAM,OAAO,CAAC,MAAM,CAAC;YAC5D,IAAI;YACJ,UAAU;YACV,QAAQ;YACR,UAAU;YACV,SAAS,EAAE,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,IAAI,SAAS;YACtE,eAAe;YACf,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,OAAO;YACP,GAAG;YACH,GAAG;SACN,CAAC,CAAC;QAEH,mGAAmG;QACnG,qCAAqC;QACrC,IAAI,CAAC;YACD,MAAM,sBAAsB,CAAC,eAAe,EAAE,IAAI,CAAC,mBAAmB,EAAE,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;QACxG,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,wDAAwD,QAAQ,KAAK,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3G,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,CAAC;YACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACvB,OAAO;QACX,CAAC;QAED,MAAM,MAAM,GAAW,IAAI,YAAY,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC3D,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,+BAA+B,CAAC;aACzD,SAAS,CAAC,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC;aAC1C,MAAM,CAAC,GAAG,CAAC;aACX,IAAI,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IAED,sGAAsG;IAC9F,aAAa,CAAC,GAAgB;QAClC,IAAI,CAAC;YACD,OAAO,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,YAAY,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACtG,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,IAAI,GAAG,YAAY,gBAAgB,EAAE,CAAC;gBAClC,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,GAAG,EAAE,4BAA4B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YAClG,CAAC;YACD,MAAM,GAAG,CAAC;QACd,CAAC;IACL,CAAC;IAED,+GAA+G;IACvG,sBAAsB,CAAC,GAAW,EAAE,OAAiC;QACzE,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,OAAO,GAAG,KAAK,UAAU,IAAI,CAAC,OAAO,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,6BAA6B,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1H,CAAC;IAEO,KAAK,CAAC,2BAA2B,CAAC,UAAkB,EAAE,QAAgB,EAAE,UAAkB;QAC9F,MAAM,QAAQ,GAAQ,MAAM,IAAI,CAAC,mBAAoB,CAAC,IAAI,CACtD,EAAE,UAAU,EAAE,QAAQ,EAAE,EACxB,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAChC,CAAC;QACF,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACd,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC;QACvB,CAAC;QACD,MAAM,QAAQ,GAAM,IAAI,CAAC,mBAAoB,CAAC,iBAAiB,CAAC;YAC5D,UAAU;YACV,QAAQ;YACR,UAAU;YACV,cAAc,EAAE,EAAE;YAClB,WAAW,EAAE,KAAK;SACrB,CAAC,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,mBAAoB,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjF,CAAC;CACJ;AA9KW;IADP,MAAM,CAAC,4BAA4B,EAAE,yBAAyB,CAAC;;qDACJ;AAGpD;IADP,MAAM;;4CACa;AAGP;IADZ,IAAI;;;;wCAcJ;AAWY;IADZ,OAAO,EAAE;IACY,WAAA,QAAQ,CAAA;;;;2CAK7B;AAIY;IAFZ,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;IACb,IAAI,EAAE;IACgB,WAAA,OAAO,CAAA;IAAoB,WAAA,QAAQ,CAAA;IAAqB,WAAA,QAAQ,CAAA;;;;4CAgGtF"}

package/dist/lib/EasAuditLog.js

@@ -0,0 +1,56 @@
+import { isNonOwnerAccess, recordAuditLog } from "@rapidmx/restapi";
+/**
+ * Audit entries for ActiveSync access to mail in a mailbox the caller doesn't own - an administrator reaching in
+ * through a trusted role, or a delegate working in a shared folder. It uses restapi's `recordAuditLog()` and
+ * `isNonOwnerAccess()`, as `BaseMessageRoute` does: REST records `MESSAGE_CONTENT_ACCESSED` for a non-owner content
+ * read and `MESSAGE_DELETE` for a delete.
+ *
+ * Built once per request. The caller's own mailbox (`ctx.mailboxUid`, resolved by `ownerUserUid`) is never audited
+ * and needs no lookup. Any other mailbox is loaded once. A mailbox that can't be loaded counts as non-owner, the
+ * defensive reading restapi's `content()` uses. Recording never throws: an audit failure is logged and the command
+ * goes on, like restapi's own best-effort persistence.
+ *
+ * Every entry's `details` carries `protocol: "ActiveSync"`, the command and the `DeviceId`.
+ */
+export class EasAuditLog {
+    constructor(deps, ctx, command) {
+        this.deps = deps;
+        this.ctx = ctx;
+        this.command = command;
+        this.nonOwner = new Map();
+    }
+    /** Whether reading `mailboxUid`'s content is a non-owner access for this request's caller. */
+    isNonOwner(mailboxUid) {
+        if (mailboxUid === this.ctx.mailboxUid) {
+            return Promise.resolve(false);
+        }
+        let pending = this.nonOwner.get(mailboxUid);
+        if (!pending) {
+            pending = this.deps.mailboxRepo
+                .findOne(mailboxUid, { ignoreACL: true })
+                .then((mailbox) => !mailbox || isNonOwnerAccess(mailbox, this.ctx.user))
+                .catch(() => true);
+            this.nonOwner.set(mailboxUid, pending);
+        }
+        return pending;
+    }
+    /** Records `entry` when its mailbox isn't the caller's own. */
+    async record(entry) {
+        try {
+            if (!(await this.isNonOwner(entry.mailboxUid))) {
+                return;
+            }
+            await recordAuditLog(this.deps.objectFactory, this.deps.auditLogClass, { config: this.deps.config, req: this.ctx.req, user: this.ctx.user, logger: this.deps.logger }, {
+                action: entry.action,
+                targetType: entry.targetType,
+                targetUid: entry.targetUid,
+                mailboxUid: entry.mailboxUid,
+                details: { protocol: "ActiveSync", command: this.command, deviceId: this.ctx.deviceId, ...entry.details },
+            });
+        }
+        catch (err) {
+            this.deps.logger?.warn(`${this.command}: failed to record audit entry ${entry.action} ${entry.targetType}:${entry.targetUid}: ${err?.message}`);
+        }
+    }
+}
+//# sourceMappingURL=EasAuditLog.js.map

package/dist/lib/EasAuditLog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EasAuditLog.js","sourceRoot":"","sources":["../../src/EasAuditLog.ts"],"names":[],"mappings":"AAMA,OAAO,EAAe,gBAAgB,EAAE,cAAc,EAAgB,MAAM,kBAAkB,CAAC;AAwB/F;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,WAAW;IAGpB,YACqB,IAA0B,EAC1B,GAAsB,EACtB,OAAe;QAFf,SAAI,GAAJ,IAAI,CAAsB;QAC1B,QAAG,GAAH,GAAG,CAAmB;QACtB,YAAO,GAAP,OAAO,CAAQ;QALnB,aAAQ,GAAkC,IAAI,GAAG,EAAE,CAAC;IAMlE,CAAC;IAEJ,8FAA8F;IACvF,UAAU,CAAC,UAAkB;QAChC,IAAI,UAAU,KAAK,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;YACrC,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,OAAO,GAAiC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC1E,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW;iBAC1B,OAAO,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;iBACxC,IAAI,CAAC,CAAC,OAA4B,EAAE,EAAE,CAAC,CAAC,OAAO,IAAI,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;iBAC5F,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YACvB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,OAAO,CAAC;IACnB,CAAC;IAED,+DAA+D;IACxD,KAAK,CAAC,MAAM,CAAC,KAAoB;QACpC,IAAI,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;gBAC7C,OAAO;YACX,CAAC;YACD,MAAM,cAAc,CAChB,IAAI,CAAC,IAAI,CAAC,aAAa,EACvB,IAAI,CAAC,IAAI,CAAC,aAAa,EACvB,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAC9F;gBACI,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,OAAO,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE;aAC5G,CACJ,CAAC;QACN,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAChB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,kCAAkC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,SAAS,KAAK,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;QACpJ,CAAC;IACL,CAAC;CACJ"}

package/dist/lib/EasCollectionLease.js

@@ -0,0 +1,199 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz. All rights reserved.
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import * as crypto from "crypto";
+import { createClient } from "redis";
+/** Deletes the lease key only while it still carries this holder's token, so an expired-and-retaken lease survives. */
+const RELEASE_SCRIPT = 'if redis.call("get", KEYS[1]) == ARGV[1] then return redis.call("del", KEYS[1]) else return 0 end';
+/** Extends the lease key's expiry only while it still carries this holder's token. */
+const RENEW_SCRIPT = 'if redis.call("get", KEYS[1]) == ARGV[1] then return redis.call("pexpire", KEYS[1], ARGV[2]) else return 0 end';
+/** Default `LeaseOptions.redisTimeoutMs`. */
+const DEFAULT_REDIS_TIMEOUT_MS = 2000;
+/** Reconnect attempts after which a lost Redis connection gives up (and a later lease creates a fresh client). */
+const MAX_RECONNECT_ATTEMPTS = 3;
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/** Sentinel a timed-out Redis call resolves with. */
+const TIMED_OUT = Symbol("timed out");
+/** Resolves with `promise`'s value, or `TIMED_OUT` after `ms` (a rejection still rejects). */
+async function withTimeout(promise, ms) {
+    let timer;
+    try {
+        return await Promise.race([promise, new Promise((resolve) => (timer = setTimeout(() => resolve(TIMED_OUT), Math.max(0, ms))))]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * A short exclusive lease on one key - `SyncCommand` holds one per (mailbox, device, folder) for the duration of a
+ * collection's round, so two concurrent `Sync`s of the same collection (a client retrying while its first request is
+ * still running, or two server copies) can't both read the same state, apply their commands and overwrite each
+ * other's result.
+ *
+ * Always taken in-process first (a per-key promise chain), then - when a Redis URL is configured - as a `SET NX PX`
+ * key shared by every server copy, released with a token check and renewed (token-checked `PEXPIRE`) every
+ * `ttlMs / 3` while held, so a round that outlasts `ttlMs` doesn't lose it to another copy.
+ *
+ * **Redis being unreachable fails open** to the in-process lease alone rather than refusing - or hanging - every
+ * `Sync`: the client is created with `disableOfflineQueue` (a command fails at once while disconnected instead of
+ * waiting in a queue) and a bounded `reconnectStrategy` (so `connect()` rejects instead of retrying forever), and
+ * every connect/`SET` is additionally raced against `redisTimeoutMs`. The connect and the first `SET` get the whole
+ * `redisTimeoutMs` even when the in-process wait already used up `waitMs` - otherwise a healthy Redis would get no time
+ * at all and the lease would fail open for nothing; only the polling `SET`s after Redis has answered are cut short by
+ * the deadline, which then means another copy still holds the key (`undefined`). A `SET` that times out but lands later
+ * is released again straight away. A client whose reconnects gave up is replaced on the next lease.
+ *
+ * **Release never hangs**: the token-checked release is raced against `redisTimeoutMs` too (the key expires on its
+ * own), and the in-process lease is freed whatever happens to it.
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+export class EasCollectionLease {
+    /** Forgets all process-wide state. Intended for tests. */
+    static resetSharedState() {
+        EasCollectionLease.local.clear();
+        EasCollectionLease.clients.clear();
+    }
+    static getClient(url, connectTimeoutMs) {
+        let pending = EasCollectionLease.clients.get(url);
+        if (!pending) {
+            const client = createClient({
+                url,
+                disableOfflineQueue: true,
+                socket: {
+                    connectTimeout: connectTimeoutMs,
+                    reconnectStrategy: (retries) => retries >= MAX_RECONNECT_ATTEMPTS ? new Error("Redis unreachable") : Math.min(100 * 2 ** retries, 1000),
+                },
+            });
+            // An unhandled `error` event would crash the process.
+            client.on("error", () => undefined);
+            const connecting = client.connect().then(() => client);
+            connecting.catch(() => EasCollectionLease.forgetClient(url, connecting));
+            EasCollectionLease.clients.set(url, connecting);
+            pending = connecting;
+        }
+        return pending;
+    }
+    static forgetClient(url, pending) {
+        if (EasCollectionLease.clients.get(url) === pending) {
+            EasCollectionLease.clients.delete(url);
+        }
+    }
+    /** Waits for `key`'s in-process holder (if any) to release, up to `deadline`, then takes it over with `held` - the
+     * check and the take-over happen in the same tick, so two waiters can never both find the key free. `false` on
+     * timeout. */
+    static async takeLocal(key, held, deadline) {
+        for (;;) {
+            const holder = EasCollectionLease.local.get(key);
+            if (!holder) {
+                EasCollectionLease.local.set(key, held);
+                return true;
+            }
+            const remaining = deadline - Date.now();
+            if (remaining <= 0) {
+                return false;
+            }
+            let timer;
+            await Promise.race([holder, new Promise((resolve) => (timer = setTimeout(resolve, remaining)))]);
+            clearTimeout(timer);
+        }
+    }
+    /**
+     * Acquires the lease on `key`, waiting up to `options.waitMs` for a current holder. Resolves with the release
+     * function, or `undefined` when the lease couldn't be acquired in time.
+     */
+    static async acquire(key, options) {
+        const deadline = Date.now() + options.waitMs;
+        let resolveLocal;
+        const held = new Promise((resolve) => (resolveLocal = resolve));
+        if (!(await EasCollectionLease.takeLocal(key, held, deadline))) {
+            return undefined;
+        }
+        const releaseLocal = () => {
+            if (EasCollectionLease.local.get(key) === held) {
+                EasCollectionLease.local.delete(key);
+            }
+            resolveLocal();
+        };
+        const failOpen = async () => releaseLocal();
+        if (!options.redisUrl) {
+            return failOpen;
+        }
+        const url = options.redisUrl;
+        const redisTimeoutMs = options.redisTimeoutMs ?? DEFAULT_REDIS_TIMEOUT_MS;
+        // A polling SET never waits past the deadline for Redis; with no time left at all, it still gets the current tick.
+        const pollTimeout = () => Math.min(redisTimeoutMs, Math.max(0, deadline - Date.now()));
+        const redisKey = `eas:lease:${key}`;
+        const token = crypto.randomUUID();
+        const releaseRedis = async (client) => {
+            try {
+                await client.eval(RELEASE_SCRIPT, { keys: [redisKey], arguments: [token] });
+            }
+            catch {
+                // The key expires on its own.
+            }
+        };
+        let client;
+        try {
+            const pending = EasCollectionLease.getClient(url, redisTimeoutMs);
+            const connected = await withTimeout(pending, redisTimeoutMs);
+            if (connected === TIMED_OUT) {
+                return failOpen;
+            }
+            client = connected;
+            if (client.isOpen === false) {
+                // Its reconnects gave up: the next lease starts a fresh client.
+                EasCollectionLease.forgetClient(url, pending);
+                return failOpen;
+            }
+            let answered = false;
+            for (;;) {
+                const setting = client.set(redisKey, token, { condition: "NX", expiration: { type: "PX", value: options.ttlMs } });
+                const reply = await withTimeout(setting, answered ? pollTimeout() : redisTimeoutMs);
+                if (reply === TIMED_OUT) {
+                    // Give back the key should the SET still land.
+                    setting.then((late) => (late === "OK" ? releaseRedis(client) : undefined)).catch(() => undefined);
+                    if (answered && Date.now() >= deadline) {
+                        // Redis is up and another copy holds the key - only the wait ran out.
+                        releaseLocal();
+                        return undefined;
+                    }
+                    return failOpen;
+                }
+                answered = true;
+                if (reply === "OK") {
+                    break;
+                }
+                if (Date.now() >= deadline) {
+                    releaseLocal();
+                    return undefined;
+                }
+                await sleep(Math.min(options.pollMs ?? 100, Math.max(1, deadline - Date.now())));
+            }
+        }
+        catch {
+            // Redis unreachable: fail open to the in-process lease.
+            return failOpen;
+        }
+        const renewal = setInterval(() => {
+            client.eval(RENEW_SCRIPT, { keys: [redisKey], arguments: [token, String(options.ttlMs)] }).catch(() => undefined);
+        }, Math.max(1, Math.floor(options.ttlMs / 3)));
+        renewal.unref?.();
+        return async () => {
+            clearInterval(renewal);
+            try {
+                // An unresponsive (but connected) Redis must not hold this collection on this server copy.
+                await withTimeout(releaseRedis(client), redisTimeoutMs);
+            }
+            finally {
+                releaseLocal();
+            }
+        };
+    }
+}
+/** The in-process holder of each key: resolves once that holder releases. */
+EasCollectionLease.local = new Map();
+/** Shared command clients, keyed by Redis URL. */
+EasCollectionLease.clients = new Map();
+//# sourceMappingURL=EasCollectionLease.js.map

package/dist/lib/EasCollectionLease.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EasCollectionLease.js","sourceRoot":"","sources":["../../src/EasCollectionLease.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,mEAAmE;AACnE,mCAAmC;AACnC,+EAA+E;AAC/E,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAE,YAAY,EAAwB,MAAM,OAAO,CAAC;AAqB3D,uHAAuH;AACvH,MAAM,cAAc,GAAG,mGAAmG,CAAC;AAE3H,sFAAsF;AACtF,MAAM,YAAY,GAAG,gHAAgH,CAAC;AAEtI,6CAA6C;AAC7C,MAAM,wBAAwB,GAAG,IAAK,CAAC;AAEvC,kHAAkH;AAClH,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAEjC,MAAM,KAAK,GAAG,CAAC,EAAU,EAAiB,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAE/F,qDAAqD;AACrD,MAAM,SAAS,GAAkB,MAAM,CAAC,WAAW,CAAC,CAAC;AAErD,8FAA8F;AAC9F,KAAK,UAAU,WAAW,CAAI,OAAmB,EAAE,EAAU;IACzD,IAAI,KAAiC,CAAC;IACtC,IAAI,CAAC;QACD,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,IAAI,OAAO,CAAmB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtJ,CAAC;YAAS,CAAC;QACP,YAAY,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,OAAO,kBAAkB;IAM3B,0DAA0D;IACnD,MAAM,CAAC,gBAAgB;QAC1B,kBAAkB,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACjC,kBAAkB,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvC,CAAC;IAEO,MAAM,CAAC,SAAS,CAAC,GAAW,EAAE,gBAAwB;QAC1D,IAAI,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,MAAM,MAAM,GAAG,YAAY,CAAC;gBACxB,GAAG;gBACH,mBAAmB,EAAE,IAAI;gBACzB,MAAM,EAAE;oBACJ,cAAc,EAAE,gBAAgB;oBAChC,iBAAiB,EAAE,CAAC,OAAe,EAAE,EAAE,CACnC,OAAO,IAAI,sBAAsB,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,OAAO,EAAE,IAAK,CAAC;iBAC/G;aACJ,CAAoB,CAAC;YACtB,sDAAsD;YACtD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACpC,MAAM,UAAU,GAA6B,MAAM,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC;YACjF,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,YAAY,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC;YACzE,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YAChD,OAAO,GAAG,UAAU,CAAC;QACzB,CAAC;QACD,OAAO,OAAO,CAAC;IACnB,CAAC;IAEO,MAAM,CAAC,YAAY,CAAC,GAAW,EAAE,OAAiC;QACtE,IAAI,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,OAAO,EAAE,CAAC;YAClD,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3C,CAAC;IACL,CAAC;IAED;;kBAEc;IACN,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,GAAW,EAAE,IAAmB,EAAE,QAAgB;QAC7E,SAAS,CAAC;YACN,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACjD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACV,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBACxC,OAAO,IAAI,CAAC;YAChB,CAAC;YACD,MAAM,SAAS,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACxC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;gBACjB,OAAO,KAAK,CAAC;YACjB,CAAC;YACD,IAAI,KAAiC,CAAC;YACtC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACvG,YAAY,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;IACL,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,GAAW,EAAE,OAAqB;QAC1D,MAAM,QAAQ,GAAW,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;QACrD,IAAI,YAAyB,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC;QACtE,IAAI,CAAC,CAAC,MAAM,kBAAkB,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC7D,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,MAAM,YAAY,GAAG,GAAS,EAAE;YAC5B,IAAI,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC7C,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzC,CAAC;YACD,YAAY,EAAE,CAAC;QACnB,CAAC,CAAC;QACF,MAAM,QAAQ,GAAiB,KAAK,IAAI,EAAE,CAAC,YAAY,EAAE,CAAC;QAE1D,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACpB,OAAO,QAAQ,CAAC;QACpB,CAAC;QAED,MAAM,GAAG,GAAW,OAAO,CAAC,QAAQ,CAAC;QACrC,MAAM,cAAc,GAAW,OAAO,CAAC,cAAc,IAAI,wBAAwB,CAAC;QAClF,mHAAmH;QACnH,MAAM,WAAW,GAAG,GAAW,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC/F,MAAM,QAAQ,GAAG,aAAa,GAAG,EAAE,CAAC;QACpC,MAAM,KAAK,GAAW,MAAM,CAAC,UAAU,EAAE,CAAC;QAC1C,MAAM,YAAY,GAAG,KAAK,EAAE,MAAuB,EAAiB,EAAE;YAClE,IAAI,CAAC;gBACD,MAAM,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAChF,CAAC;YAAC,MAAM,CAAC;gBACL,8BAA8B;YAClC,CAAC;QACL,CAAC,CAAC;QAEF,IAAI,MAAuB,CAAC;QAC5B,IAAI,CAAC;YACD,MAAM,OAAO,GAA6B,kBAAkB,CAAC,SAAS,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;YAC5F,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;YAC7D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC1B,OAAO,QAAQ,CAAC;YACpB,CAAC;YACD,MAAM,GAAG,SAAS,CAAC;YACnB,IAAK,MAAc,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBACnC,gEAAgE;gBAChE,kBAAkB,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBAC9C,OAAO,QAAQ,CAAC;YACpB,CAAC;YACD,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,SAAS,CAAC;gBACN,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACnH,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;gBACpF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACtB,+CAA+C;oBAC/C,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;oBAClG,IAAI,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;wBACrC,sEAAsE;wBACtE,YAAY,EAAE,CAAC;wBACf,OAAO,SAAS,CAAC;oBACrB,CAAC;oBACD,OAAO,QAAQ,CAAC;gBACpB,CAAC;gBACD,QAAQ,GAAG,IAAI,CAAC;gBAChB,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;oBACjB,MAAM;gBACV,CAAC;gBACD,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;oBACzB,YAAY,EAAE,CAAC;oBACf,OAAO,SAAS,CAAC;gBACrB,CAAC;gBACD,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;YACrF,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACL,wDAAwD;YACxD,OAAO,QAAQ,CAAC;QACpB,CAAC;QAED,MAAM,OAAO,GAAmB,WAAW,CACvC,GAAG,EAAE;YACD,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACtH,CAAC,EACD,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAC7C,CAAC;QACF,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QAElB,OAAO,KAAK,IAAI,EAAE;YACd,aAAa,CAAC,OAAO,CAAC,CAAC;YACvB,IAAI,CAAC;gBACD,2FAA2F;gBAC3F,MAAM,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC,CAAC;YAC5D,CAAC;oBAAS,CAAC;gBACP,YAAY,EAAE,CAAC;YACnB,CAAC;QACL,CAAC,CAAC;IACN,CAAC;;AA3JD,6EAA6E;AACrD,wBAAK,GAA+B,IAAI,GAAG,EAAE,CAAC;AACtE,kDAAkD;AAC1B,0BAAO,GAA0C,IAAI,GAAG,EAAE,CAAC"}