@rapidrest/service-core 1.0.0-rc.7 → 1.0.0

package/dist/lib/routes/{MetricsRoute.js → BaseMetricsRoute.js}

@@ -12,21 +12,40 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 };
 ///////////////////////////////////////////////////////////////////////////////
 // Copyright (C) 2020-2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
 import * as prom from "prom-client";
 import { ApiError, UserUtils, ObjectDecorators } from "@rapidrest/core";
-import { Get, Param, Route, ContentType, User } from "../decorators/RouteDecorators.js";
+import { Get, Param, ContentType, User } from "../decorators/RouteDecorators.js";
 import { Description, Returns, Summary } from "../decorators/DocDecorators.js";
 import { ApiErrorMessages, ApiErrors } from "../ApiErrors.js";
 const { Config } = ObjectDecorators;
 /**
- * Handles all REST API requests for the endpoint `/metrics'. This route handler produces Prometheus compatible metrics
- * for use with a Prometheus based server.
+ * The `BaseMetricsRoute` class provides a base set of endpoints for exposing Prometheus metrics.
+ *
+ * Exposed endpoints:
+ *
+ * | Name | HTTP Method | What it does |
+ * | --- | --- | --- |
+ * | `getMetrics` | `GET /<base_path>` | Returns all Prometheus metrics gathered by the system |
+ * | `getSingleMetric` | `GET /<base_path>/:metric` | Returns a single Prometheus metric with the given name |
  *
  * Services that wish to provide metrics to be exposed via this route can register them using the global registry
  * from the provided `prom-client` dependency. See the `prom-client` documentation for more details.
+ *
+ * !!Note!! that the `BaseMetricsRoute` is not automatically registered with a server by default. You must create
+ * your own class that extends `AdminRoute` and apply the desired base path with `@Route()`.
+ *
+ * @example
+ * ```ts
+ * import { BaseMetricsRoute, RouteDecorators } from "@rapidrest/service-core";
+ * const { Route } = RouteDecorators;
+ *
+ * @Route("/metrics")
+ * export class MetricsRoute extends BaseMetricsRoute {}
+ * ```
  */
-let MetricsRoute = class MetricsRoute {
+export class BaseMetricsRoute {
     constructor() {
         this.metricsConfig = {
             authRequired: true,
@@ -46,15 +65,15 @@ let MetricsRoute = class MetricsRoute {
         }
         return await this.registry.getSingleMetricAsString(metric);
     }
-};
+}
 __decorate([
     Config("metrics", { authRequired: true }),
     __metadata("design:type", Object)
-], MetricsRoute.prototype, "metricsConfig", void 0);
+], BaseMetricsRoute.prototype, "metricsConfig", void 0);
 __decorate([
     Config("trusted_roles"),
     __metadata("design:type", Array)
-], MetricsRoute.prototype, "trustedRoles", void 0);
+], BaseMetricsRoute.prototype, "trustedRoles", void 0);
 __decorate([
     Summary("{{serviceName}} all Prometheus metrics"),
     Description("Returns all Prometheus metrics emitted by this service."),
@@ -65,7 +84,7 @@ __decorate([
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object]),
     __metadata("design:returntype", Promise)
-], MetricsRoute.prototype, "getMetrics", null);
+], BaseMetricsRoute.prototype, "getMetrics", null);
 __decorate([
     Summary("{{serviceName}} Prometheus metrics by name"),
     Description("Returns the Prometheus metric emitted by this service with the given name."),
@@ -77,10 +96,5 @@ __decorate([
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, Object]),
     __metadata("design:returntype", Promise)
-], MetricsRoute.prototype, "getSingleMetric", null);
-MetricsRoute = __decorate([
-    Route("/metrics"),
-    __metadata("design:paramtypes", [])
-], MetricsRoute);
-export { MetricsRoute };
-//# sourceMappingURL=MetricsRoute.js.map
+], BaseMetricsRoute.prototype, "getSingleMetric", null);
+//# sourceMappingURL=BaseMetricsRoute.js.map

package/dist/lib/routes/BaseMetricsRoute.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BaseMetricsRoute.js","sourceRoot":"","sources":["../../../src/routes/BaseMetricsRoute.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,+EAA+E;AAC/E,kDAAkD;AAClD,mCAAmC;AACnC,+EAA+E;AAC/E,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,gBAAgB,EAAgB,MAAM,iBAAiB,CAAC;AACtF,OAAO,EAAQ,GAAG,EAAE,KAAK,EAAS,WAAW,EAAE,IAAI,EAAE,MAAM,kCAAkC,CAAC;AAC9F,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAC/E,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC9D,MAAM,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC;AAEpC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,OAAO,gBAAgB;IAWzB;QATU,kBAAa,GAAG;YACtB,YAAY,EAAE,IAAI;SACrB,CAAC;QAKQ,iBAAY,GAAa,EAAE,CAAC;QAGlC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAClC,CAAC;IAOY,AAAN,KAAK,CAAC,UAAU,CAAO,IAAc;QACxC,IAAI,IAAI,CAAC,aAAa,CAAC,YAAY,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;YAC7F,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,uBAAuB,EAAE,GAAG,EAAE,gBAAgB,CAAC,uBAAuB,CAAC,CAAC;QACzG,CAAC;QACD,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;IACzC,CAAC;IAOY,AAAN,KAAK,CAAC,eAAe,CAAkB,MAAW,EAAQ,IAAc;QAC3E,IAAI,IAAI,CAAC,aAAa,CAAC,YAAY,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;YAC7F,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,uBAAuB,EAAE,GAAG,EAAE,gBAAgB,CAAC,uBAAuB,CAAC,CAAC;QACzG,CAAC;QACD,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAC/D,CAAC;CACJ;AApCa;IADT,MAAM,CAAC,SAAS,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;;uDAGxC;AAKQ;IADT,MAAM,CAAC,eAAe,CAAC;;sDACc;AAWzB;IALZ,OAAO,CAAC,wCAAwC,CAAC;IACjD,WAAW,CAAC,yDAAyD,CAAC;IACtE,GAAG,EAAE;IACL,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;IACtC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC;IACO,WAAA,IAAI,CAAA;;;;kDAK5B;AAOY;IALZ,OAAO,CAAC,4CAA4C,CAAC;IACrD,WAAW,CAAC,4EAA4E,CAAC;IACzF,GAAG,CAAC,UAAU,CAAC;IACf,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;IACtC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC;IACY,WAAA,KAAK,CAAC,QAAQ,CAAC,CAAA;IAAe,WAAA,IAAI,CAAA;;;;uDAK/D"}

package/dist/lib/routes/{OpenAPIRoute.js → BaseOpenAPIRoute.js}

@@ -9,11 +9,12 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 };
 ///////////////////////////////////////////////////////////////////////////////
 // Copyright (C) 2020-2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
 import { ObjectDecorators } from "@rapidrest/core";
 import { OpenApiSpec } from "../OpenApiSpec.js";
 import { Description, Returns, Summary } from "../decorators/DocDecorators.js";
-import { Get, Route, ContentType } from "../decorators/RouteDecorators.js";
+import { Get, ContentType } from "../decorators/RouteDecorators.js";
 const { Inject } = ObjectDecorators;
 /** Inline Swagger UI HTML page — loads swagger-ui-dist from CDN so there is no npm dependency. */
 function swaggerHtml(specUrl) {
@@ -39,15 +40,31 @@ function swaggerHtml(specUrl) {
 </html>`;
 }
 /**
- * The `OpenAPIRoute` provides default routes to expose the service's OpenAPI specification.
+ * The `BaseOpenAPIRoute` class provides a base set of endpoints exposing the server's OpenAPI specification.
  *
- * - `GET /` — Swagger UI HTML (loads swagger-ui-dist from CDN)
- * - `GET /openapi.json` — raw OpenAPI specification as JSON
- * - `GET /openapi.yaml` — raw OpenAPI specification as YAML
+ * Exposed endpoints:
+ *
+ * | Name | HTTP Method | What it does |
+ * | --- | --- | --- |
+ * | `getHTML` | `GET /<base_path>` | Swagger UI HTML (loads swagger-ui-dist from CDN) |
+ * | `getJSON` | `GET /<base_path>/json` | raw OpenAPI specification as JSON |
+ * | `getYAML` | `GET /<base_path>/yaml` | raw OpenAPI specification as YAML |
+ *
+ * !!Note!! that the `BaseAdminRoute` is not automatically registered with a server by default. You must create
+ * your own class that extends `AdminRoute` and apply the desired base path with `@Route()`.
+ *
+ * @example
+ * ```ts
+ * import { BaseOpenAPIRoute, RouteDecorators } from "@rapidrest/service-core";
+ * const { Route } = RouteDecorators;
+ *
+ * @Route("/openapi")
+ * export class OpenAPIRoute extends BaseOpenAPIRoute {}
+ * ```
  *
  * @author Jean-Philippe Steinmetz
  */
-let OpenAPIRoute = class OpenAPIRoute {
+export class BaseOpenAPIRoute {
     constructor() {
         /** The underlying OpenAPI specification. */
         this.apiSpec = new OpenApiSpec();
@@ -55,61 +72,44 @@ let OpenAPIRoute = class OpenAPIRoute {
     getHTML() {
         return swaggerHtml("/openapi.json");
     }
-    getAPIDocs() {
-        return swaggerHtml("/openapi.json");
-    }
     getJSON() {
         return this.apiSpec.getSpec();
     }
     getYAML() {
         return this.apiSpec.getSpecAsYaml();
     }
-};
+}
 __decorate([
     Inject(OpenApiSpec),
     __metadata("design:type", OpenApiSpec)
-], OpenAPIRoute.prototype, "apiSpec", void 0);
-__decorate([
-    Summary("{{serviceName}} OpenAPI, HTLM format"),
-    Description("Returns the OpenAPI specification for the service in HTML format."),
-    Get(),
-    ContentType("text/html"),
-    Returns([String]),
-    __metadata("design:type", Function),
-    __metadata("design:paramtypes", []),
-    __metadata("design:returntype", String)
-], OpenAPIRoute.prototype, "getHTML", null);
+], BaseOpenAPIRoute.prototype, "apiSpec", void 0);
 __decorate([
     Summary("{{serviceName}} API docs"),
     Description("Returns the OpenAPI specification for the service in HTML format."),
-    Get("api-docs"),
+    Get(),
     ContentType("text/html"),
     Returns([String]),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", []),
     __metadata("design:returntype", String)
-], OpenAPIRoute.prototype, "getAPIDocs", null);
+], BaseOpenAPIRoute.prototype, "getHTML", null);
 __decorate([
     Summary("{{serviceName}} OpenAPI, JSON format"),
     Description("Returns the OpenAPI specification for the service in JSON format."),
-    Get("openapi.json"),
+    Get("json"),
     Returns([String]),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", []),
     __metadata("design:returntype", Object)
-], OpenAPIRoute.prototype, "getJSON", null);
+], BaseOpenAPIRoute.prototype, "getJSON", null);
 __decorate([
     Summary("{{serviceName}} OpenAPI, YAML format"),
     Description("Returns the OpenAPI specification for the service in YAML format."),
-    Get("openapi.yaml"),
+    Get("yaml"),
     ContentType("text/yaml"),
     Returns([String]),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", []),
     __metadata("design:returntype", String)
-], OpenAPIRoute.prototype, "getYAML", null);
-OpenAPIRoute = __decorate([
-    Route("/")
-], OpenAPIRoute);
-export { OpenAPIRoute };
-//# sourceMappingURL=OpenAPIRoute.js.map
+], BaseOpenAPIRoute.prototype, "getYAML", null);
+//# sourceMappingURL=BaseOpenAPIRoute.js.map

package/dist/lib/routes/BaseOpenAPIRoute.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BaseOpenAPIRoute.js","sourceRoot":"","sources":["../../../src/routes/BaseOpenAPIRoute.ts"],"names":[],"mappings":";;;;;;;;;AAAA,+EAA+E;AAC/E,kDAAkD;AAClD,mCAAmC;AACnC,+EAA+E;AAC/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAC/E,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AACpE,MAAM,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC;AAEpC,kGAAkG;AAClG,SAAS,WAAW,CAAC,OAAe;IAChC,OAAO;;;;;;;;;;;;cAYG,OAAO;;;;;;;QAOb,CAAC;AACT,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,OAAO,gBAAgB;IAA7B;QACI,4CAA4C;QAElC,YAAO,GAAgB,IAAI,WAAW,EAAE,CAAC;IA2BvD,CAAC;IApBU,OAAO;QACV,OAAO,WAAW,CAAC,eAAe,CAAC,CAAC;IACxC,CAAC;IAMM,OAAO;QACV,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IAClC,CAAC;IAOM,OAAO;QACV,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;IACxC,CAAC;CACJ;AA3Ba;IADT,MAAM,CAAC,WAAW,CAAC;8BACD,WAAW;iDAAqB;AAO5C;IALN,OAAO,CAAC,0BAA0B,CAAC;IACnC,WAAW,CAAC,mEAAmE,CAAC;IAChF,GAAG,EAAE;IACL,WAAW,CAAC,WAAW,CAAC;IACxB,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC;;;;+CAGjB;AAMM;IAJN,OAAO,CAAC,sCAAsC,CAAC;IAC/C,WAAW,CAAC,mEAAmE,CAAC;IAChF,GAAG,CAAC,MAAM,CAAC;IACX,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC;;;;+CAGjB;AAOM;IALN,OAAO,CAAC,sCAAsC,CAAC;IAC/C,WAAW,CAAC,mEAAmE,CAAC;IAChF,GAAG,CAAC,MAAM,CAAC;IACX,WAAW,CAAC,WAAW,CAAC;IACxB,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC;;;;+CAGjB"}

package/dist/lib/routes/BasePushRoute.js

@@ -0,0 +1,305 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2020-2026 Jean-Philippe Steinmetz. All rights reserved.
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { ApiError, ObjectDecorators } from "@rapidrest/core";
+import { Auth, Param, Post, Socket, User, WebSocket } from "../decorators/RouteDecorators.js";
+import { ACLUtils } from "../security/ACLUtils.js";
+import ws from "ws";
+import { importRedis } from "../database/ConnectionKinds.js";
+import { Description, Summary } from "../decorators/DocDecorators.js";
+import { ACLAction } from "../security/AccessControlList.js";
+import { ApiErrorMessages, ApiErrors } from "../ApiErrors.js";
+const { Config, Init, Inject, Logger } = ObjectDecorators;
+/**
+ * The `BasePushRoute` class provides a base set of endpoints for implement client push notifications.
+ *
+ * Exposed endpoints:
+ *
+ * | Name | HTTP Method | What it does |
+ * | --- | --- | --- |
+ * | `connect` | `UPGRADE /<base_path>/connect` | Establishes a connection to the push notification system. |
+ * | `send` | `POST /<base_path>/:id` | Sends a push notification message to the channel with the given id |
+ *
+ * !!Note!! that the `BasePushRoute` is not automatically registered with a server by default. You must create
+ * your own class that extends `AdminRoute` and apply the desired base path with `@Route()`.
+ *
+ * @example
+ * ```ts
+ * import { BasePushRoute, RouteDecorators } from "@rapidrest/service-core";
+ * const { Route } = RouteDecorators;
+ *
+ * @Route("/push")
+ * export class PushRoute extends BasePushRoute {}
+ * ```
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+export class BasePushRoute {
+    constructor() {
+        /** A map of active socket connections to users.  */
+        this.activeSocks = new Map();
+        /** A map of active subscription uids to users. */
+        this.activeSubs = new Map();
+        /** Per-user in-process locks (see `runExclusive`) guarding read-modify-write access to `activeSubs`. */
+        this.subLocks = new Map();
+        /** The maximum number of concurrent sockets a single user may hold open at once. */
+        this.maxSocketsPerUser = 10;
+        /** The maximum number of channels a single user may be subscribed to at once. */
+        this.maxSubscriptionsPerUser = 50;
+    }
+    async init() {
+        if (this.redisConfig) {
+            const { createClient } = await importRedis();
+            this.redisPub = createClient({ url: this.redisConfig.url });
+            await this.redisPub.connect();
+        }
+        else {
+            this.logger.warn("Could not initialize the push notification publisher. The `events` datasource is not configured.");
+        }
+    }
+    /**
+     * Runs `fn` exclusively with respect to any other call currently queued under the same `key` on this
+     * instance — a call only starts once every call queued ahead of it under that key has fully settled. Used
+     * to serialize SUBSCRIBE/UNSUBSCRIBE handling per user so two messages arriving close together (on the same
+     * or different concurrent sockets for that user) can't both read the same stale `activeSubs` snapshot and
+     * clobber (or exceed the cap on) each other's committed subscription list.
+     */
+    async runExclusive(key, fn) {
+        const previous = this.subLocks.get(key) ?? Promise.resolve();
+        const run = previous.then(fn);
+        const guard = run.then(() => undefined, () => undefined);
+        this.subLocks.set(key, guard);
+        void guard.finally(() => {
+            if (this.subLocks.get(key) === guard) {
+                this.subLocks.delete(key);
+            }
+        });
+        return run;
+    }
+    async connect(sock, user) {
+        const onMessage = (message, channel) => {
+            this.logger.debug(`Forwarding message to ${user.uid}`);
+            sock.send(message, (err) => {
+                if (err) {
+                    this.logger.debug(`Failed to forward message to ${user.uid}`);
+                }
+            });
+        };
+        // The socket cap check, the subscribe, and the activeSocks/activeSubs bookkeeping below must all happen
+        // atomically with respect to any other concurrent connect()/SUBSCRIBE/UNSUBSCRIBE for this same user
+        // (e.g. a burst of connections opened milliseconds apart), or two calls could both read the same
+        // pre-commit state: bypassing the per-user socket cap, or clobbering each other's committed
+        // subscription list the same way the message handlers below already guard against via `runExclusive`.
+        const redis = await this.runExclusive(user.uid, async () => {
+            // Cap the number of concurrent connections a single user may hold, to prevent an authenticated user
+            // from exhausting server resources by opening unbounded sockets.
+            if ((this.activeSocks.get(user.uid)?.length ?? 0) >= this.maxSocketsPerUser) {
+                this.logger.debug(`User ${user.uid} exceeded the maximum of ${this.maxSocketsPerUser} concurrent push connections.`);
+                return undefined;
+            }
+            // Establish a new redis pub/sub client for this connection
+            const { createClient } = await importRedis();
+            const conn = createClient({ url: this.redisConfig.url });
+            await conn.connect();
+            // On a first-ever connection there's nothing stored yet, so just the user's own identity channel
+            // (always implicitly permitted, same as the SUBSCRIBE message handler below never ACL-checks it).
+            // On a *re*connection, activeSubs may hold channels approved during a previous session — permission
+            // can have been revoked since then, so every channel other than the identity one is re-checked here
+            // rather than trusted as still-valid.
+            const storedSubs = this.activeSubs.get(user.uid) ?? [user.uid];
+            const subs = [];
+            for (const channel of storedSubs) {
+                if (channel === user.uid || (await this.aclUtils?.hasPermission(user, channel, ACLAction.READ))) {
+                    subs.push(channel);
+                }
+            }
+            try {
+                await conn.subscribe(subs, onMessage);
+                this.logger.info(`User ${user.uid} successfully subscribed to push channels: ${subs}`);
+                sock.send(JSON.stringify({ id: 0, type: "SUBSCRIBED", success: true, data: subs }));
+                this.activeSubs.set(user.uid, subs);
+            }
+            catch (err) {
+                this.logger.error(`Failed to subscribe to push channels: user: ${user.uid}, subs: ${subs}`);
+                this.logger.debug(err);
+            }
+            // Track the socket so it doesn't get automatically cleaned up.
+            if (!this.activeSocks.has(user.uid)) {
+                this.activeSocks.set(user.uid, []);
+            }
+            this.activeSocks.get(user.uid).push(sock);
+            return conn;
+        });
+        if (!redis) {
+            sock.close(1008, "Too many concurrent connections.");
+            return;
+        }
+        // Set up the incoming message handler from the client
+        sock.on("message", async (data, isBinary) => {
+            if (!isBinary) {
+                try {
+                    // Decode the incoming message
+                    const message = JSON.parse(data);
+                    if (message.type === "SUBSCRIBE") {
+                        // Serialized per user: reading `activeSubs` and later committing the updated list must
+                        // be atomic with respect to any other concurrent SUBSCRIBE/UNSUBSCRIBE for this same
+                        // user (e.g. from a second open socket), or two messages could both compute their
+                        // approved/remaining-budget delta off the same stale snapshot and the second commit
+                        // would silently clobber the first's.
+                        await this.runExclusive(user.uid, async () => {
+                            const origSubs = this.activeSubs.get(user.uid) ?? [user.uid];
+                            const requested = Array.isArray(message.data) ? message.data : [message.data];
+                            // Bound the number of channels actually *checked* to the caller's remaining
+                            // subscription budget, not just the number of successful grants — otherwise a client
+                            // naming far more channels than it could ever be granted (each denial doesn't consume
+                            // budget) forces one sequential ACL lookup (a cache-miss-prone Redis/DB round trip)
+                            // per attacker-controlled entry, with no upper bound on how many it sends in one frame.
+                            const remaining = Math.max(0, this.maxSubscriptionsPerUser - origSubs.length);
+                            const subs = requested.slice(0, remaining);
+                            const subd = [];
+                            for (const channel of subs) {
+                                if (await this.aclUtils?.hasPermission(user, channel, ACLAction.READ)) {
+                                    subd.push(channel);
+                                }
+                            }
+                            // Subscribe to all approved channels
+                            if (subd.length > 0) {
+                                await redis.subscribe(subd, onMessage);
+                            }
+                            this.activeSubs.set(user.uid, origSubs.concat(subd));
+                            sock.send(JSON.stringify({ id: message.id, type: "SUBSCRIBED", success: true, data: subd }));
+                        });
+                    }
+                    else if (message.type === "UNSUBSCRIBE") {
+                        await this.runExclusive(user.uid, async () => {
+                            const origSubs = this.activeSubs.get(user.uid) ?? [user.uid];
+                            const subs = Array.isArray(message.data) ? message.data : [message.data];
+                            // An empty channel list means "unsubscribe from everything" per the Redis protocol,
+                            // which is not what an empty UNSUBSCRIBE request from the client should do.
+                            if (subs.length > 0) {
+                                await redis.unsubscribe(subs);
+                            }
+                            for (const channel of subs) {
+                                const idx = origSubs.indexOf(channel);
+                                if (idx !== -1) {
+                                    origSubs.splice(idx, 1);
+                                }
+                            }
+                            this.activeSubs.set(user.uid, origSubs);
+                            sock.send(JSON.stringify({ id: message.id, type: "UNSUBSCRIBED", success: true, data: subs }));
+                        });
+                    }
+                    else {
+                        this.logger.debug(`Received invalid message from user ${user.uid}.`);
+                    }
+                }
+                catch (err) {
+                    this.logger.debug(`Received invalid message from user ${user.uid}.`);
+                }
+            }
+        });
+        // Set up the close connection handler
+        sock.on("close", async (code, reason) => {
+            // Serialized per user, same as SUBSCRIBE/UNSUBSCRIBE above: a close racing a concurrent
+            // connect()/SUBSCRIBE for the same user (a second open socket) must not interleave its
+            // read-modify-write of activeSocks/activeSubs with theirs, or one of the two updates is lost.
+            await this.runExclusive(user.uid, async () => {
+                // Unsubscribe from all redis pub/sub channels
+                const subs = this.activeSubs.get(user.uid);
+                if (subs && subs.length > 0) {
+                    await redis.unsubscribe(subs);
+                }
+                // Disconnect the redis client
+                await redis.disconnect();
+                // Remove the socket from our tracked list
+                const socks = this.activeSocks.get(user.uid) || [];
+                const idx = socks.indexOf(sock);
+                if (idx !== -1) {
+                    socks.splice(idx, 1);
+                }
+                // Once the user has no other open connections, drop their tracked state entirely rather than
+                // leaving a stale (activeSocks) or permanently-growing (activeSubs) entry behind — otherwise
+                // every distinct uid that ever connects, even once, leaks a map entry for the life of the process.
+                if (socks.length === 0) {
+                    this.activeSocks.delete(user.uid);
+                    this.activeSubs.delete(user.uid);
+                }
+                else {
+                    this.activeSocks.set(user.uid, socks);
+                }
+            });
+        });
+    }
+    async send(id, msg, user) {
+        if (!(await this.aclUtils?.hasPermission(user, id, ACLAction.CREATE))) {
+            throw new ApiError(ApiErrors.AUTH_PERMISSION_FAILURE, 403, ApiErrorMessages.AUTH_PERMISSION_FAILURE);
+        }
+        if (!this.redisPub) {
+            this.logger.error(`Failed to send push message to channel ${id}. The \`events\` datasource is not configured.`);
+            throw new ApiError(ApiErrors.INTERNAL_ERROR, 500, ApiErrorMessages.INTERNAL_ERROR);
+        }
+        await this.redisPub.publish(id, JSON.stringify({ type: "MESSAGE", channel: id, data: msg }));
+    }
+}
+__decorate([
+    Inject(ACLUtils),
+    __metadata("design:type", ACLUtils)
+], BasePushRoute.prototype, "aclUtils", void 0);
+__decorate([
+    Logger,
+    __metadata("design:type", Object)
+], BasePushRoute.prototype, "logger", void 0);
+__decorate([
+    Config("datastores:events"),
+    __metadata("design:type", Object)
+], BasePushRoute.prototype, "redisConfig", void 0);
+__decorate([
+    Config("push:max_sockets_per_user", 10),
+    __metadata("design:type", Number)
+], BasePushRoute.prototype, "maxSocketsPerUser", void 0);
+__decorate([
+    Config("push:max_subscriptions_per_user", 50),
+    __metadata("design:type", Number)
+], BasePushRoute.prototype, "maxSubscriptionsPerUser", void 0);
+__decorate([
+    Init,
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], BasePushRoute.prototype, "init", null);
+__decorate([
+    Summary("Push connect"),
+    Description("Establishes a connection to the push notification system."),
+    Auth(["jwt"]),
+    WebSocket(),
+    __param(0, Socket),
+    __param(1, User),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [ws, Object]),
+    __metadata("design:returntype", Promise)
+], BasePushRoute.prototype, "connect", null);
+__decorate([
+    Summary("Send push"),
+    Description("Sends a push notification message to the channel with the given id."),
+    Auth(["jwt"]),
+    Post("/:id"),
+    __param(0, Param("id")),
+    __param(2, User),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, Object, Object]),
+    __metadata("design:returntype", Promise)
+], BasePushRoute.prototype, "send", null);
+//# sourceMappingURL=BasePushRoute.js.map

package/dist/lib/routes/BasePushRoute.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BasePushRoute.js","sourceRoot":"","sources":["../../../src/routes/BasePushRoute.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,+EAA+E;AAC/E,wEAAwE;AACxE,mCAAmC;AACnC,+EAA+E;AAC/E,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAC9F,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAE,MAAM,IAAI,CAAC;AAEpB,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC9D,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC;AAE1D;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,OAAO,aAAa;IAA1B;QAII,oDAAoD;QAC5C,gBAAW,GAAsB,IAAI,GAAG,EAAE,CAAC;QAEnD,kDAAkD;QAC1C,eAAU,GAA0B,IAAI,GAAG,EAAE,CAAC;QAEtD,wGAAwG;QAChG,aAAQ,GAA+B,IAAI,GAAG,EAAE,CAAC;QAQzD,oFAAoF;QAE5E,sBAAiB,GAAW,EAAE,CAAC;QAEvC,iFAAiF;QAEzE,4BAAuB,GAAW,EAAE,CAAC;IAwOjD,CAAC;IAlOiB,AAAN,KAAK,CAAC,IAAI;QACd,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACnB,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;YAC7C,IAAI,CAAC,QAAQ,GAAG,YAAY,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC;YAC5D,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QAClC,CAAC;aAAM,CAAC;YACJ,IAAI,CAAC,MAAM,CAAC,IAAI,CACZ,kGAAkG,CACrG,CAAC;QACN,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,YAAY,CAAI,GAAW,EAAE,EAAoB;QAC3D,MAAM,QAAQ,GAAkB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QAC5E,MAAM,GAAG,GAAe,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAkB,GAAG,CAAC,IAAI,CACjC,GAAG,EAAE,CAAC,SAAS,EACf,GAAG,EAAE,CAAC,SAAS,CAClB,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9B,KAAK,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE;YACpB,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,EAAE,CAAC;gBACnC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC9B,CAAC;QACL,CAAC,CAAC,CAAC;QACH,OAAO,GAAG,CAAC;IACf,CAAC;IAMY,AAAN,KAAK,CAAC,OAAO,CAAS,IAAQ,EAAQ,IAAS;QAClD,MAAM,SAAS,GAAG,CAAC,OAAe,EAAE,OAAe,EAAE,EAAE;YACnD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACvD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACvB,IAAI,GAAG,EAAE,CAAC;oBACN,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;gBAClE,CAAC;YACL,CAAC,CAAC,CAAC;QACP,CAAC,CAAC;QAEF,wGAAwG;QACxG,qGAAqG;QACrG,iGAAiG;QACjG,4FAA4F;QAC5F,sGAAsG;QACtG,MAAM,KAAK,GAAgC,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;YACpF,oGAAoG;YACpG,iEAAiE;YACjE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBAC1E,IAAI,CAAC,MAAM,CAAC,KAAK,CACb,QAAQ,IAAI,CAAC,GAAG,4BAA4B,IAAI,CAAC,iBAAiB,+BAA+B,CACpG,CAAC;gBACF,OAAO,SAAS,CAAC;YACrB,CAAC;YAED,2DAA2D;YAC3D,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAoB,YAAY,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC;YAC1E,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAErB,iGAAiG;YACjG,kGAAkG;YAClG,oGAAoG;YACpG,oGAAoG;YACpG,sCAAsC;YACtC,MAAM,UAAU,GAAa,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACzE,MAAM,IAAI,GAAa,EAAE,CAAC;YAC1B,KAAK,MAAM,OAAO,IAAI,UAAU,EAAE,CAAC;gBAC/B,IAAI,OAAO,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;oBAC9F,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACvB,CAAC;YACL,CAAC;YACD,IAAI,CAAC;gBACD,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;gBACtC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,GAAG,8CAA8C,IAAI,EAAE,CAAC,CAAC;gBACvF,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;gBACpF,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACxC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,+CAA+C,IAAI,CAAC,GAAG,WAAW,IAAI,EAAE,CAAC,CAAC;gBAC5F,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;YAED,+DAA+D;YAC/D,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACvC,CAAC;YACD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAE3C,OAAO,IAAI,CAAC;QAChB,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,kCAAkC,CAAC,CAAC;YACrD,OAAO;QACX,CAAC;QAED,sDAAsD;QACtD,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,IAAS,EAAE,QAAiB,EAAE,EAAE;YACtD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACZ,IAAI,CAAC;oBACD,8BAA8B;oBAC9B,MAAM,OAAO,GAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBAEtC,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;wBAC/B,uFAAuF;wBACvF,qFAAqF;wBACrF,kFAAkF;wBAClF,oFAAoF;wBACpF,sCAAsC;wBACtC,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;4BACzC,MAAM,QAAQ,GAAa,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;4BACvE,MAAM,SAAS,GAAa,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;4BACxF,4EAA4E;4BAC5E,qFAAqF;4BACrF,sFAAsF;4BACtF,oFAAoF;4BACpF,wFAAwF;4BACxF,MAAM,SAAS,GAAW,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,uBAAuB,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;4BACtF,MAAM,IAAI,GAAa,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;4BACrD,MAAM,IAAI,GAAa,EAAE,CAAC;4BAC1B,KAAK,MAAM,OAAO,IAAI,IAAI,EAAE,CAAC;gCACzB,IAAI,MAAM,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;oCACpE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gCACvB,CAAC;4BACL,CAAC;4BAED,qCAAqC;4BACrC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gCAClB,MAAM,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;4BAC3C,CAAC;4BACD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;4BACrD,IAAI,CAAC,IAAI,CACL,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CACpF,CAAC;wBACN,CAAC,CAAC,CAAC;oBACP,CAAC;yBAAM,IAAI,OAAO,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;wBACxC,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;4BACzC,MAAM,QAAQ,GAAa,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;4BACvE,MAAM,IAAI,GAAa,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;4BACnF,oFAAoF;4BACpF,4EAA4E;4BAC5E,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gCAClB,MAAM,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;4BAClC,CAAC;4BACD,KAAK,MAAM,OAAO,IAAI,IAAI,EAAE,CAAC;gCACzB,MAAM,GAAG,GAAW,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gCAC9C,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;oCACb,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;gCAC5B,CAAC;4BACL,CAAC;4BACD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;4BACxC,IAAI,CAAC,IAAI,CACL,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CACtF,CAAC;wBACN,CAAC,CAAC,CAAC;oBACP,CAAC;yBAAM,CAAC;wBACJ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;oBACzE,CAAC;gBACL,CAAC;gBAAC,OAAO,GAAQ,EAAE,CAAC;oBAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;gBACzE,CAAC;YACL,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,sCAAsC;QACtC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,IAAY,EAAE,MAAc,EAAE,EAAE;YACpD,wFAAwF;YACxF,uFAAuF;YACvF,8FAA8F;YAC9F,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;gBACzC,8CAA8C;gBAC9C,MAAM,IAAI,GAAyB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACjE,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC1B,MAAM,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;gBAClC,CAAC;gBAED,8BAA8B;gBAC9B,MAAM,KAAK,CAAC,UAAU,EAAE,CAAC;gBAEzB,0CAA0C;gBAC1C,MAAM,KAAK,GAAS,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBACzD,MAAM,GAAG,GAAW,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBACxC,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;oBACb,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;gBACzB,CAAC;gBAED,6FAA6F;gBAC7F,6FAA6F;gBAC7F,mGAAmG;gBACnG,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACrB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBAClC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACrC,CAAC;qBAAM,CAAC;oBACJ,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAC1C,CAAC;YACL,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;IACP,CAAC;IAMY,AAAN,KAAK,CAAC,IAAI,CAAc,EAAU,EAAE,GAAQ,EAAQ,IAAS;QAChE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,IAAI,EAAE,EAAE,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,uBAAuB,EAAE,GAAG,EAAE,gBAAgB,CAAC,uBAAuB,CAAC,CAAC;QACzG,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACjB,IAAI,CAAC,MAAM,CAAC,KAAK,CACb,0CAA0C,EAAE,gDAAgD,CAC/F,CAAC;YACF,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,GAAG,EAAE,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACvF,CAAC;QAED,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACjG,CAAC;CACJ;AA/PW;IADP,MAAM,CAAC,QAAQ,CAAC;8BACE,QAAQ;+CAAC;AAYpB;IADP,MAAM;;6CACa;AAGZ;IADP,MAAM,CAAC,mBAAmB,CAAC;;kDACH;AAIjB;IADP,MAAM,CAAC,2BAA2B,EAAE,EAAE,CAAC;;wDACD;AAI/B;IADP,MAAM,CAAC,iCAAiC,EAAE,EAAE,CAAC;;8DACD;AAM/B;IADb,IAAI;;;;yCAWJ;AA6BY;IAJZ,OAAO,CAAC,cAAc,CAAC;IACvB,WAAW,CAAC,2DAA2D,CAAC;IACxE,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;IACb,SAAS,EAAE;IACU,WAAA,MAAM,CAAA;IAAY,WAAA,IAAI,CAAA;;qCAAT,EAAE;;4CAuKpC;AAMY;IAJZ,OAAO,CAAC,WAAW,CAAC;IACpB,WAAW,CAAC,qEAAqE,CAAC;IAClF,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;IACb,IAAI,CAAC,MAAM,CAAC;IACM,WAAA,KAAK,CAAC,IAAI,CAAC,CAAA;IAAwB,WAAA,IAAI,CAAA;;;;yCAazD"}