@rebasepro/server-mongo 0.13.0 → 0.13.1-canary.g06dbe5b

package/src/services/MongoRealtimeService.ts

@@ -7,25 +7,39 @@
 
 import { Db, ChangeStream, ChangeStreamDocument, Document, ObjectId } from "mongodb";
 import {
+    ANONYMOUS_USER_ID,
+    DataDriver,
     FilterValues,
     RealtimeProvider,
     CollectionSubscriptionConfig,
     SingleSubscriptionConfig,
     WebSocketMessage,
-    User
+    User,
+    ListLimitError,
+    resolveClientListLimit
 } from "@rebasepro/types";
 import { WebSocket } from "ws";
-import { MongoDataService } from "../db/MongoDataService";
 
 import type { MongoDriver } from "./MongoDriver";
 import { logger } from "@rebasepro/server";
 
+/** The acting user for a subscription, as the driver and the socket carry it. */
+export interface SubscriptionAuthContext {
+    uid: string;
+    roles: string[];
+}
+
 interface Subscription {
     type: "collection" | "single";
-    config: CollectionSubscriptionConfig | SingleSubscriptionConfig;
+    /**
+     * Carries `authContext`. There is deliberately no second copy on this
+     * object: every fetch reads `config.authContext`, and the one that used to
+     * live here was written from three places and read from none — so a
+     * subscription that looked authorized was re-fetched as nobody.
+     */
+    config: (CollectionSubscriptionConfig | SingleSubscriptionConfig) & { authContext?: SubscriptionAuthContext };
     changeStream?: ChangeStream;
     callback?: (data: any) => void;
-    authContext?: { uid: string; roles: string[] };
 }
 
 /**
@@ -37,12 +51,9 @@ interface Subscription {
 export class MongoRealtimeService implements RealtimeProvider {
     private subscriptions = new Map<string, Subscription>();
     private clients = new Map<string, WebSocket>();
-    private dataService: MongoDataService;
     private driver?: MongoDriver;
 
-    constructor(private db: Db) {
-        this.dataService = new MongoDataService(db);
-    }
+    constructor(private db: Db) {}
 
     setDataDriver(driver: MongoDriver) {
         this.driver = driver;
@@ -60,7 +71,7 @@ export class MongoRealtimeService implements RealtimeProvider {
      */
     subscribeToCollection(
         subscriptionId: string,
-        config: CollectionSubscriptionConfig & { authContext?: { uid: string; roles: string[] } },
+        config: CollectionSubscriptionConfig & { authContext?: SubscriptionAuthContext },
         callback?: (rows: Record<string, unknown>[]) => void
     ): void {
         // Clean up existing subscription if any
@@ -89,8 +100,7 @@ export class MongoRealtimeService implements RealtimeProvider {
                 type: "collection",
                 config,
                 changeStream,
-                callback,
-                authContext: config.authContext
+                callback
             };
 
             this.subscriptions.set(subscriptionId, subscription);
@@ -117,8 +127,7 @@ export class MongoRealtimeService implements RealtimeProvider {
             const subscription: Subscription = {
                 type: "collection",
                 config,
-                callback,
-                authContext: config.authContext
+                callback
             };
 
             this.subscriptions.set(subscriptionId, subscription);
@@ -133,38 +142,29 @@ export class MongoRealtimeService implements RealtimeProvider {
      */
     private async fetchAndNotifyCollection(
         subscriptionId: string,
-        config: CollectionSubscriptionConfig & { authContext?: { uid: string; roles: string[] } },
+        config: CollectionSubscriptionConfig & { authContext?: SubscriptionAuthContext },
         callback?: (rows: Record<string, unknown>[]) => void
     ): Promise<void> {
         try {
-            let rows;
             const registryCollection = this.driver?.registry?.getCollectionByPath(config.path);
-
-            if (config.authContext && this.driver) {
-                const mockUser = { uid: config.authContext.uid,
-roles: config.authContext.roles } as User;
-                const authenticatedDriver = await this.driver.withAuth(mockUser);
-                rows = await authenticatedDriver.fetchCollection({
-                    path: config.path,
-                    collection: registryCollection,
-                    filter: config.filter as FilterValues<string> | undefined,
-                    orderBy: config.orderBy,
-                    order: config.order,
-                    limit: config.limit,
-                    startAfter: config.startAfter,
-                    searchString: config.searchString
-                });
-            } else {
-                rows = await this.dataService.fetchCollection(config.path, {
-                    filter: config.filter as FilterValues<string> | undefined,
-                    orderBy: config.orderBy,
-                    order: config.order,
-                    limit: config.limit,
-                    startAfter: config.startAfter,
-                    searchString: config.searchString,
-                    collection: registryCollection
-                });
-            }
+            // One path, authenticated or not. The `else` branch used to reach
+            // past the driver into the repository, which applies no security
+            // rules at all — the fallback stubbing out the contract the primary
+            // branch honours, and granting more while doing it. An anonymous
+            // subscriber is now a user like any other: rules are evaluated
+            // against the anonymous uid, and a rule that needs a real one
+            // matches nothing.
+            const driver = await this.scopedDriver(config.authContext);
+            const rows = await driver.fetchCollection({
+                path: config.path,
+                collection: registryCollection,
+                filter: config.filter as FilterValues<string> | undefined,
+                orderBy: config.orderBy,
+                order: config.order,
+                limit: config.limit,
+                startAfter: config.startAfter,
+                searchString: config.searchString
+            });
 
             if (callback) {
                 callback(rows);
@@ -174,12 +174,27 @@ roles: config.authContext.roles } as User;
         }
     }
 
+    /**
+     * The driver scoped to a subscriber.
+     *
+     * Never the bare repository: everything a subscription delivers has to pass
+     * the same row authorization an HTTP read does.
+     */
+    private async scopedDriver(authContext?: SubscriptionAuthContext): Promise<DataDriver> {
+        if (!this.driver) {
+            throw new Error("MongoRealtimeService has no data driver — subscriptions cannot be authorized");
+        }
+        const user = { uid: authContext?.uid ?? ANONYMOUS_USER_ID,
+roles: authContext?.roles ?? [] } as User;
+        return this.driver.withAuth(user);
+    }
+
     /**
      * Subscribe to single row changes
      */
     subscribeToOne(
         subscriptionId: string,
-        config: SingleSubscriptionConfig & { authContext?: { uid: string; roles: string[] } },
+        config: SingleSubscriptionConfig & { authContext?: SubscriptionAuthContext },
         callback?: (row: Record<string, unknown> | null) => void
     ): void {
         // Clean up existing subscription if any
@@ -211,8 +226,7 @@ roles: config.authContext.roles } as User;
                 type: "single",
                 config,
                 changeStream,
-                callback,
-                authContext: config.authContext
+                callback
             };
 
             this.subscriptions.set(subscriptionId, subscription);
@@ -241,8 +255,7 @@ roles: config.authContext.roles } as User;
             const subscription: Subscription = {
                 type: "single",
                 config,
-                callback,
-                authContext: config.authContext
+                callback
             };
 
             this.subscriptions.set(subscriptionId, subscription);
@@ -257,25 +270,17 @@ roles: config.authContext.roles } as User;
      */
     private async fetchAndNotifyOne(
         subscriptionId: string,
-        config: SingleSubscriptionConfig & { authContext?: { uid: string; roles: string[] } },
+        config: SingleSubscriptionConfig & { authContext?: SubscriptionAuthContext },
         callback?: (row: Record<string, unknown> | null) => void
     ): Promise<void> {
         try {
-            let row;
             const registryCollection = this.driver?.registry?.getCollectionByPath(config.path);
-
-            if (config.authContext && this.driver) {
-                const mockUser = { uid: config.authContext.uid,
-roles: config.authContext.roles } as User;
-                const authenticatedDriver = await this.driver.withAuth(mockUser);
-                row = await authenticatedDriver.fetchOne({
-                    path: config.path,
-                    id: config.id,
-                    collection: registryCollection
-                });
-            } else {
-                row = await this.dataService.fetchOne(config.path, config.id);
-            }
+            const driver = await this.scopedDriver(config.authContext);
+            const row = await driver.fetchOne({
+                path: config.path,
+                id: config.id,
+                collection: registryCollection
+            });
 
             if (callback) {
                 callback(row || null);
@@ -311,14 +316,21 @@ roles: config.authContext.roles } as User;
         // Find all subscriptions that might be affected by this update
         for (const [subscriptionId, subscription] of this.subscriptions) {
             if (subscription.type === "single") {
-                const config = subscription.config as SingleSubscriptionConfig;
+                const config = subscription.config as SingleSubscriptionConfig & { authContext?: SubscriptionAuthContext };
                 if (config.path === path && config.id.toString() === id) {
-                    if (subscription.callback) {
-                        subscription.callback(row);
+                    if (row === null) {
+                        // A deletion carries no row to authorize.
+                        subscription.callback?.(null);
+                    } else {
+                        // Re-fetched through the subscriber's own driver rather
+                        // than pushed verbatim: `notifyUpdate` runs after every
+                        // save, and handing it the row as written broadcast any
+                        // document to whoever happened to be watching its id.
+                        await this.fetchAndNotifyOne(subscriptionId, config, subscription.callback);
                     }
                 }
             } else if (subscription.type === "collection") {
-                const config = subscription.config as CollectionSubscriptionConfig;
+                const config = subscription.config as CollectionSubscriptionConfig & { authContext?: SubscriptionAuthContext };
                 if (config.path === path) {
                     // Re-fetch the collection to get updated data
                     await this.fetchAndNotifyCollection(subscriptionId, config, subscription.callback);
@@ -389,6 +401,28 @@ roles: (_authContext.roles ?? []).map(String) } : undefined;
                 const subscriptionId = message.payload?.subscriptionId ?? message.subscriptionId;
                 if (!subscriptionId) return;
 
+                // The same list bound the Postgres socket and every REST route
+                // apply. This ingress applied none: an absent limit reached the
+                // driver as `undefined` and emitted no `.limit()` at all, so one
+                // subscribe frame streamed the whole collection — and re-streamed
+                // it on every matching write. An over-large limit is refused
+                // rather than shrunk, because a `collection_update` frame carries
+                // no `total` or `hasMore` for the client to notice with.
+                let boundedLimit: number;
+                try {
+                    boundedLimit = resolveClientListLimit(message.payload?.limit);
+                } catch (e) {
+                    if (!(e instanceof ListLimitError)) throw e;
+                    logger.warn(`⚠️ [MongoRealtime] Refused subscription to '${message.payload?.path}': ${e.message}`);
+                    ws.send(JSON.stringify({
+                        type: "ERROR",
+                        subscriptionId,
+                        payload: { error: { message: e.message, code: "INVALID_LIMIT" } },
+                        error: e.message
+                    }));
+                    return;
+                }
+
                 this.subscribeToCollection(
                     subscriptionId,
                     {
@@ -397,7 +431,7 @@ roles: (_authContext.roles ?? []).map(String) } : undefined;
                         filter: message.payload?.filter,
                         orderBy: message.payload?.orderBy,
                         order: message.payload?.order,
-                        limit: message.payload?.limit,
+                        limit: boundedLimit,
                         startAfter: message.payload?.startAfter,
                         searchString: message.payload?.searchString,
                         authContext
@@ -441,6 +475,30 @@ roles: (_authContext.roles ?? []).map(String) } : undefined;
                 }
                 break;
             }
+            default: {
+                // A silent `switch` over a wire protocol is how channel,
+                // presence and broadcast frames came to be accepted here and
+                // dropped: the client's `broadcast()` resolved, `onPresence`
+                // never fired, and a `channel_history` request buffered live
+                // messages until the catch-up timeout on every join. Say so,
+                // and tell the sender rather than leaving it waiting.
+                logger.warn(
+                    `⚠️ [MongoRealtime] Unhandled realtime message type "${message.type}" — ` +
+                    "channels, presence and broadcast are not implemented by the Mongo driver."
+                );
+                ws.send(JSON.stringify({
+                    type: "ERROR",
+                    subscriptionId: message.subscriptionId,
+                    payload: {
+                        error: {
+                            message: `Realtime message type "${message.type}" is not supported by the Mongo driver`,
+                            code: "REALTIME_UNSUPPORTED"
+                        }
+                    },
+                    error: `Realtime message type "${message.type}" is not supported by the Mongo driver`
+                }));
+                break;
+            }
         }
     }
 }

package/src/websocket.ts

@@ -1,8 +1,7 @@
-import { RealtimeProvider, DataDriver, FetchCollectionProps, FetchOneProps, SaveProps, DeleteProps, TableMetadata, DatabaseAdmin, isSchemaAdmin, isDocumentAdmin, User } from "@rebasepro/types";
+import { RealtimeProvider, DataDriver, FetchCollectionProps, FetchOneProps, SaveProps, DeleteProps, TableMetadata, DatabaseAdmin, isSchemaAdmin, isDocumentAdmin, User, AuthAdapter } from "@rebasepro/types";
 import { WebSocketServer, WebSocket } from "ws";
 import { Server } from "http";
 import { inspect } from "util";
-import type { AccessTokenPayload } from "@rebasepro/server";
 import { extractUserFromToken, resolveRequireAuth } from "@rebasepro/server";
 import type { RebaseAuthConfig } from "@rebasepro/server";
 import { MongoRealtimeService } from "./services/MongoRealtimeService";
@@ -17,9 +16,22 @@ function isDriverWithAuth(driver: DataDriver): driver is DriverWithAuth {
     return "withAuth" in driver && typeof (driver as Record<string, unknown>).withAuth === "function";
 }
 
+/**
+ * Normalized user identity for WebSocket sessions — the same shape the Postgres
+ * socket keeps, because an `AuthAdapter` user is not an access-token payload.
+ */
+interface WsUserIdentity {
+    uid: string;
+    email?: string;
+    displayName?: string;
+    photoURL?: string;
+    roles: string[];
+    isAdmin: boolean;
+}
+
 interface ClientSession {
     ws: WebSocket;
-    user?: AccessTokenPayload;
+    user?: WsUserIdentity;
     authenticated: boolean;
     messageCount: number;
     messageWindowStart: number;
@@ -41,8 +53,11 @@ const ADMIN_ONLY_TYPES = new Set([
 ]);
 
 function isAdminSession(session: ClientSession | undefined): boolean {
-    if (!session?.user?.roles) return false;
-    return session.user.roles.includes("admin");
+    if (!session?.user) return false;
+    // The adapter's own answer first; a role *named* `admin` is only the
+    // fallback for the built-in JWT path.
+    if (session.user.isAdmin) return true;
+    return (session.user.roles ?? []).some((r) => r === "admin");
 }
 
 export function createMongoWebSocket(
@@ -50,7 +65,8 @@ export function createMongoWebSocket(
     realtimeService: MongoRealtimeService,
     driver: MongoDriver,
     authConfig?: RebaseAuthConfig,
-    admin?: DatabaseAdmin
+    admin?: DatabaseAdmin,
+    authAdapter?: AuthAdapter
 ) {
     // Scoped to this factory invocation rather than the module, so sessions do
     // not leak across hot reloads or a second server on the same process — the
@@ -70,12 +86,12 @@ export function createMongoWebSocket(
     // `resolveRequireAuth` for what this socket's local copy got wrong — most
     // importantly that a `false` here does not skip a check, it marks every
     // session `authenticated` at connect time.
-    const requireAuth = resolveRequireAuth(authConfig);
+    const requireAuth = !!authAdapter || resolveRequireAuth(authConfig);
 
-    if (requireAuth && !authConfig?.jwtSecret) {
+    if (requireAuth && !authAdapter && !authConfig?.jwtSecret) {
         logger.warn(
-            "🔐 [WebSocket Server] Authentication is required but no jwtSecret is configured — " +
-            "no client can complete AUTH, so every realtime message will be refused."
+            "🔐 [WebSocket Server] Authentication is required but no adapter or jwtSecret is " +
+            "configured — no client can complete AUTH, so every realtime message will be refused."
         );
     }
 
@@ -116,17 +132,52 @@ code } } }));
                         return;
                     }
 
-                    const user = extractUserFromToken(token);
-                    if (user) {
+                    // The adapter verifies when one is configured, exactly as the
+                    // HTTP routes do; the built-in JWT path is the fallback.
+                    let verifiedUser: WsUserIdentity | null = null;
+
+                    if (authAdapter) {
+                        try {
+                            const adapterUser = authAdapter.verifyToken
+                                ? await authAdapter.verifyToken(token)
+                                : await authAdapter.verifyRequest(new Request("http://localhost/_ws_auth", {
+                                    headers: { Authorization: `Bearer ${token}` }
+                                }));
+                            if (adapterUser) {
+                                verifiedUser = {
+                                    uid: adapterUser.uid,
+                                    email: adapterUser.email,
+                                    roles: adapterUser.roles ?? [],
+                                    isAdmin: !!adapterUser.isAdmin
+                                };
+                            }
+                        } catch {
+                            // Adapter threw — treat as invalid token
+                        }
+                    } else {
+                        const jwtPayload = extractUserFromToken(token);
+                        if (jwtPayload) {
+                            verifiedUser = {
+                                uid: jwtPayload.uid,
+                                email: jwtPayload.email,
+                                displayName: jwtPayload.displayName,
+                                photoURL: jwtPayload.photoURL,
+                                roles: jwtPayload.roles ?? [],
+                                isAdmin: (jwtPayload.roles ?? []).some((r: string) => r === "admin")
+                            };
+                        }
+                    }
+
+                    if (verifiedUser) {
                         const session = clientSessions.get(clientId);
                         if (session) {
-                            session.user = user;
+                            session.user = verifiedUser;
                             session.authenticated = true;
                         }
                         ws.send(JSON.stringify({ type: "AUTH_SUCCESS",
 requestId,
-payload: { uid: user.uid,
-roles: user.roles } }));
+payload: { uid: verifiedUser.uid,
+roles: verifiedUser.roles } }));
                     } else {
                         sendError("AUTH_ERROR", "INVALID_TOKEN", "Invalid or expired token");
                     }

package/dist/ensure-collections-Bkx_O5CQ.js

@@ -1,94 +0,0 @@
-import { logger } from "@rebasepro/server";
-//#region src/auth/ensure-collections.ts
-/**
-* Default roles to seed on first run
-*/
-var DEFAULT_ROLES = [
-	{
-		_id: "admin",
-		id: "admin",
-		name: "Admin",
-		isAdmin: true,
-		defaultPermissions: {
-			read: true,
-			create: true,
-			edit: true,
-			delete: true
-		},
-		createdAt: /* @__PURE__ */ new Date()
-	},
-	{
-		_id: "editor",
-		id: "editor",
-		name: "Editor",
-		isAdmin: false,
-		defaultPermissions: {
-			read: true,
-			create: true,
-			edit: true,
-			delete: true
-		},
-		createdAt: /* @__PURE__ */ new Date()
-	},
-	{
-		_id: "viewer",
-		id: "viewer",
-		name: "Viewer",
-		isAdmin: false,
-		defaultPermissions: {
-			read: true,
-			create: false,
-			edit: false,
-			delete: false
-		},
-		createdAt: /* @__PURE__ */ new Date()
-	}
-];
-async function ensureAuthCollectionsExist(db) {
-	logger.info("🔍 Checking MongoDB auth collections and indexes...");
-	try {
-		await db.collection("rebase_users").createIndex({ email: 1 }, { unique: true });
-		const identities = db.collection("rebase_user_identities");
-		await identities.createIndex({
-			provider: 1,
-			provider_id: 1
-		}, { unique: true });
-		await identities.createIndex({ user_id: 1 });
-		const userRoles = db.collection("rebase_user_roles");
-		await userRoles.createIndex({
-			user_id: 1,
-			role_id: 1
-		}, { unique: true });
-		await userRoles.createIndex({ user_id: 1 });
-		const refreshTokens = db.collection("rebase_refresh_tokens");
-		await refreshTokens.createIndex({ token_hash: 1 }, { unique: true });
-		await refreshTokens.createIndex({
-			user_id: 1,
-			user_agent: 1,
-			ip_address: 1
-		}, { unique: true });
-		await refreshTokens.createIndex({ user_id: 1 });
-		const resetTokens = db.collection("rebase_password_reset_tokens");
-		await resetTokens.createIndex({ token_hash: 1 }, { unique: true });
-		await resetTokens.createIndex({ user_id: 1 });
-		await seedDefaultRoles(db);
-		logger.info("✅ MongoDB Auth collections ready");
-	} catch (error) {
-		logger.error("❌ Failed to set up MongoDB auth collections", { error });
-	}
-}
-async function seedDefaultRoles(db) {
-	const roles = db.collection("rebase_roles");
-	const count = await roles.countDocuments();
-	if (count > 0) {
-		logger.info(`📋 Found ${count} existing roles`);
-		return;
-	}
-	logger.info("🌱 Seeding default roles...");
-	for (const role of DEFAULT_ROLES) await roles.updateOne({ id: role.id }, { $setOnInsert: role }, { upsert: true });
-	logger.info("✅ Default roles created: admin, editor, viewer");
-}
-//#endregion
-export { ensureAuthCollectionsExist };
-
-//# sourceMappingURL=ensure-collections-Bkx_O5CQ.js.map

package/dist/ensure-collections-Bkx_O5CQ.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"ensure-collections-Bkx_O5CQ.js","names":[],"sources":["../src/auth/ensure-collections.ts"],"sourcesContent":["import { Db } from \"mongodb\";\nimport { logger } from \"@rebasepro/server\";\n\n/**\n * Default roles to seed on first run\n */\nconst DEFAULT_ROLES = [\n    {\n        _id: \"admin\",\n        id: \"admin\",\n        name: \"Admin\",\n        isAdmin: true,\n        defaultPermissions: { read: true,\ncreate: true,\nedit: true,\ndelete: true },\n        createdAt: new Date()\n    },\n    {\n        _id: \"editor\",\n        id: \"editor\",\n        name: \"Editor\",\n        isAdmin: false,\n        defaultPermissions: { read: true,\ncreate: true,\nedit: true,\ndelete: true },\n        createdAt: new Date()\n    },\n    {\n        _id: \"viewer\",\n        id: \"viewer\",\n        name: \"Viewer\",\n        isAdmin: false,\n        defaultPermissions: { read: true,\ncreate: false,\nedit: false,\ndelete: false },\n        createdAt: new Date()\n    }\n];\n\nexport async function ensureAuthCollectionsExist(db: Db): Promise<void> {\n    logger.info(\"🔍 Checking MongoDB auth collections and indexes...\");\n\n    try {\n        // Users\n        const users = db.collection(\"rebase_users\");\n        await users.createIndex({ email: 1 }, { unique: true });\n\n        // User Identities\n        const identities = db.collection(\"rebase_user_identities\");\n        await identities.createIndex({ provider: 1,\nprovider_id: 1 }, { unique: true });\n        await identities.createIndex({ user_id: 1 });\n\n        // User Roles (junction collection)\n        const userRoles = db.collection(\"rebase_user_roles\");\n        await userRoles.createIndex({ user_id: 1,\nrole_id: 1 }, { unique: true });\n        await userRoles.createIndex({ user_id: 1 });\n\n        // Refresh Tokens\n        const refreshTokens = db.collection(\"rebase_refresh_tokens\");\n        await refreshTokens.createIndex({ token_hash: 1 }, { unique: true });\n        await refreshTokens.createIndex({ user_id: 1,\nuser_agent: 1,\nip_address: 1 }, { unique: true });\n        await refreshTokens.createIndex({ user_id: 1 });\n\n        // Password Reset Tokens\n        const resetTokens = db.collection(\"rebase_password_reset_tokens\");\n        await resetTokens.createIndex({ token_hash: 1 }, { unique: true });\n        await resetTokens.createIndex({ user_id: 1 });\n\n        // Seed roles\n        await seedDefaultRoles(db);\n\n        logger.info(\"✅ MongoDB Auth collections ready\");\n    } catch (error) {\n        logger.error(\"❌ Failed to set up MongoDB auth collections\", { error: error });\n    }\n}\n\nasync function seedDefaultRoles(db: Db): Promise<void> {\n    const roles = db.collection(\"rebase_roles\");\n    const count = await roles.countDocuments();\n\n    if (count > 0) {\n        logger.info(`📋 Found ${count} existing roles`);\n        return;\n    }\n\n    logger.info(\"🌱 Seeding default roles...\");\n\n    for (const role of DEFAULT_ROLES) {\n        await roles.updateOne(\n            { id: role.id },\n            { $setOnInsert: role },\n            { upsert: true }\n        );\n    }\n\n    logger.info(\"✅ Default roles created: admin, editor, viewer\");\n}\n"],"mappings":";;;;;AAMA,IAAM,gBAAgB;CAClB;EACI,KAAK;EACL,IAAI;EACJ,MAAM;EACN,SAAS;EACT,oBAAoB;GAAE,MAAM;GACpC,QAAQ;GACR,MAAM;GACN,QAAQ;EAAK;EACL,2BAAW,IAAI,KAAK;CACxB;CACA;EACI,KAAK;EACL,IAAI;EACJ,MAAM;EACN,SAAS;EACT,oBAAoB;GAAE,MAAM;GACpC,QAAQ;GACR,MAAM;GACN,QAAQ;EAAK;EACL,2BAAW,IAAI,KAAK;CACxB;CACA;EACI,KAAK;EACL,IAAI;EACJ,MAAM;EACN,SAAS;EACT,oBAAoB;GAAE,MAAM;GACpC,QAAQ;GACR,MAAM;GACN,QAAQ;EAAM;EACN,2BAAW,IAAI,KAAK;CACxB;AACJ;AAEA,eAAsB,2BAA2B,IAAuB;CACpE,OAAO,KAAK,qDAAqD;CAEjE,IAAI;EAGA,MADc,GAAG,WAAW,cACtB,CAAA,CAAM,YAAY,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,KAAK,CAAC;EAGtD,MAAM,aAAa,GAAG,WAAW,wBAAwB;EACzD,MAAM,WAAW,YAAY;GAAE,UAAU;GACjD,aAAa;EAAE,GAAG,EAAE,QAAQ,KAAK,CAAC;EAC1B,MAAM,WAAW,YAAY,EAAE,SAAS,EAAE,CAAC;EAG3C,MAAM,YAAY,GAAG,WAAW,mBAAmB;EACnD,MAAM,UAAU,YAAY;GAAE,SAAS;GAC/C,SAAS;EAAE,GAAG,EAAE,QAAQ,KAAK,CAAC;EACtB,MAAM,UAAU,YAAY,EAAE,SAAS,EAAE,CAAC;EAG1C,MAAM,gBAAgB,GAAG,WAAW,uBAAuB;EAC3D,MAAM,cAAc,YAAY,EAAE,YAAY,EAAE,GAAG,EAAE,QAAQ,KAAK,CAAC;EACnE,MAAM,cAAc,YAAY;GAAE,SAAS;GACnD,YAAY;GACZ,YAAY;EAAE,GAAG,EAAE,QAAQ,KAAK,CAAC;EACzB,MAAM,cAAc,YAAY,EAAE,SAAS,EAAE,CAAC;EAG9C,MAAM,cAAc,GAAG,WAAW,8BAA8B;EAChE,MAAM,YAAY,YAAY,EAAE,YAAY,EAAE,GAAG,EAAE,QAAQ,KAAK,CAAC;EACjE,MAAM,YAAY,YAAY,EAAE,SAAS,EAAE,CAAC;EAG5C,MAAM,iBAAiB,EAAE;EAEzB,OAAO,KAAK,kCAAkC;CAClD,SAAS,OAAO;EACZ,OAAO,MAAM,+CAA+C,EAAS,MAAM,CAAC;CAChF;AACJ;AAEA,eAAe,iBAAiB,IAAuB;CACnD,MAAM,QAAQ,GAAG,WAAW,cAAc;CAC1C,MAAM,QAAQ,MAAM,MAAM,eAAe;CAEzC,IAAI,QAAQ,GAAG;EACX,OAAO,KAAK,YAAY,MAAM,gBAAgB;EAC9C;CACJ;CAEA,OAAO,KAAK,6BAA6B;CAEzC,KAAK,MAAM,QAAQ,eACf,MAAM,MAAM,UACR,EAAE,IAAI,KAAK,GAAG,GACd,EAAE,cAAc,KAAK,GACrB,EAAE,QAAQ,KAAK,CACnB;CAGJ,OAAO,KAAK,gDAAgD;AAChE"}

package/dist/websocket-74DDOdK0.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"websocket-74DDOdK0.js","names":[],"sources":["../src/websocket.ts"],"sourcesContent":["import { RealtimeProvider, DataDriver, FetchCollectionProps, FetchOneProps, SaveProps, DeleteProps, TableMetadata, DatabaseAdmin, isSchemaAdmin, isDocumentAdmin, User } from \"@rebasepro/types\";\nimport { WebSocketServer, WebSocket } from \"ws\";\nimport { Server } from \"http\";\nimport { inspect } from \"util\";\nimport type { AccessTokenPayload } from \"@rebasepro/server\";\nimport { extractUserFromToken, resolveRequireAuth } from \"@rebasepro/server\";\nimport type { RebaseAuthConfig } from \"@rebasepro/server\";\nimport { MongoRealtimeService } from \"./services/MongoRealtimeService\";\nimport { MongoDriver } from \"./services/MongoDriver\";\nimport { logger } from \"@rebasepro/server\";\n\ninterface DriverWithAuth extends DataDriver {\n    withAuth(user: Record<string, unknown>): Promise<DataDriver>;\n}\n\nfunction isDriverWithAuth(driver: DataDriver): driver is DriverWithAuth {\n    return \"withAuth\" in driver && typeof (driver as Record<string, unknown>).withAuth === \"function\";\n}\n\ninterface ClientSession {\n    ws: WebSocket;\n    user?: AccessTokenPayload;\n    authenticated: boolean;\n    messageCount: number;\n    messageWindowStart: number;\n}\n\nconst WS_RATE_LIMIT = 2000;\nconst WS_RATE_WINDOW_MS = 60_000;\n\nconst ADMIN_ONLY_TYPES = new Set([\n    \"EXECUTE_SQL\",\n    \"FETCH_DATABASES\",\n    \"FETCH_ROLES\",\n    \"FETCH_UNMAPPED_TABLES\",\n    \"FETCH_TABLE_METADATA\",\n    \"FETCH_CURRENT_DATABASE\",\n    \"CREATE_BRANCH\",\n    \"DELETE_BRANCH\",\n    \"LIST_BRANCHES\"\n]);\n\nfunction isAdminSession(session: ClientSession | undefined): boolean {\n    if (!session?.user?.roles) return false;\n    return session.user.roles.includes(\"admin\");\n}\n\nexport function createMongoWebSocket(\n    server: Server,\n    realtimeService: MongoRealtimeService,\n    driver: MongoDriver,\n    authConfig?: RebaseAuthConfig,\n    admin?: DatabaseAdmin\n) {\n    // Scoped to this factory invocation rather than the module, so sessions do\n    // not leak across hot reloads or a second server on the same process — the\n    // Postgres socket keeps it here for the same reason.\n    const clientSessions = new Map<string, ClientSession>();\n\n    const isProduction = process.env.NODE_ENV === \"production\";\n    const wsDebug = (...args: unknown[]) => { if (!isProduction) console.debug(...args); };\n    const wss = new WebSocketServer({ server });\n\n    wss.on(\"error\", (err: NodeJS.ErrnoException) => {\n        if (err.code === \"EADDRINUSE\") return;\n        logger.error(\"❌ [WebSocket Server] Error\", { error: err });\n    });\n\n    // The same predicate the HTTP data routes use, from the same function. See\n    // `resolveRequireAuth` for what this socket's local copy got wrong — most\n    // importantly that a `false` here does not skip a check, it marks every\n    // session `authenticated` at connect time.\n    const requireAuth = resolveRequireAuth(authConfig);\n\n    if (requireAuth && !authConfig?.jwtSecret) {\n        logger.warn(\n            \"🔐 [WebSocket Server] Authentication is required but no jwtSecret is configured — \" +\n            \"no client can complete AUTH, so every realtime message will be refused.\"\n        );\n    }\n\n    wss.on(\"connection\", (ws) => {\n        const clientId = `client_${Date.now()}_${Math.random().toString(36).substring(2, 9)}`;\n        wsDebug(`WebSocket client connected: ${clientId}`);\n\n        clientSessions.set(clientId, { ws,\nauthenticated: !requireAuth,\nmessageCount: 0,\nmessageWindowStart: Date.now() });\n        realtimeService.addClient(clientId, ws);\n\n        ws.on(\"close\", () => {\n            wsDebug(`WebSocket client disconnected: ${clientId}`);\n            clientSessions.delete(clientId);\n        });\n\n        ws.on(\"message\", async (message) => {\n            let requestId: string | undefined;\n            try {\n                const { type, payload, requestId: reqId } = JSON.parse(message.toString());\n                requestId = reqId;\n\n                wsDebug(`[WS] ${clientId} → ${type}`, requestId ? `(${requestId})` : \"\");\n\n                const sendError = (errType: \"ERROR\" | \"AUTH_ERROR\", code: string, msg: string) => {\n                    ws.send(JSON.stringify({ type: errType,\nrequestId,\npayload: { error: { message: msg,\ncode } } }));\n                };\n\n                if (type === \"AUTHENTICATE\") {\n                    const { token } = payload || {};\n                    if (!token) {\n                        sendError(\"AUTH_ERROR\", \"INVALID_INPUT\", \"Token is required\");\n                        return;\n                    }\n\n                    const user = extractUserFromToken(token);\n                    if (user) {\n                        const session = clientSessions.get(clientId);\n                        if (session) {\n                            session.user = user;\n                            session.authenticated = true;\n                        }\n                        ws.send(JSON.stringify({ type: \"AUTH_SUCCESS\",\nrequestId,\npayload: { uid: user.uid,\nroles: user.roles } }));\n                    } else {\n                        sendError(\"AUTH_ERROR\", \"INVALID_TOKEN\", \"Invalid or expired token\");\n                    }\n                    return;\n                }\n\n                if (requireAuth) {\n                    const session = clientSessions.get(clientId);\n                    if (!session?.authenticated) {\n                        sendError(\"ERROR\", \"UNAUTHORIZED\", \"Authentication required\");\n                        return;\n                    }\n                }\n\n                {\n                    const session = clientSessions.get(clientId);\n                    if (session) {\n                        const now = Date.now();\n                        if (now - session.messageWindowStart > WS_RATE_WINDOW_MS) {\n                            session.messageCount = 0;\n                            session.messageWindowStart = now;\n                        }\n                        session.messageCount++;\n                        if (session.messageCount > WS_RATE_LIMIT) {\n                            sendError(\"ERROR\", \"RATE_LIMITED\", \"Too many requests. Please slow down.\");\n                            return;\n                        }\n                    }\n                }\n\n                if (ADMIN_ONLY_TYPES.has(type)) {\n                    const session = clientSessions.get(clientId);\n                    if (!isAdminSession(session)) {\n                        sendError(\"ERROR\", \"FORBIDDEN\", \"Admin access required for this operation\");\n                        return;\n                    }\n                }\n\n                const getScopedDelegate = async (): Promise<DataDriver> => {\n                    const session = clientSessions.get(clientId);\n                    if (session?.user && isDriverWithAuth(driver)) {\n                        try {\n                            const userForAuth: User = {\n                                uid: session.user.uid,\n                                email: session.user.email ?? \"\",\n                                displayName: session.user.displayName ?? \"\",\n                                photoURL: session.user.photoURL ?? \"\",\n                                providerId: \"jwt\",\n                                isAnonymous: false,\n                                roles: session.user.roles ?? []\n                            };\n                            return await driver.withAuth(userForAuth);\n                        } catch (e) {\n                            logger.error(\"Failed to create authenticated delegate for WS request\", { error: e });\n                            return driver;\n                        }\n                    }\n                    return driver;\n                };\n\n                switch (type) {\n                    case \"FETCH_COLLECTION\": {\n                        const request: FetchCollectionProps = payload;\n                        const delegate = await getScopedDelegate();\n                        const rows = await delegate.fetchCollection(request);\n                        ws.send(JSON.stringify({ type: \"FETCH_COLLECTION_SUCCESS\",\npayload: { rows },\nrequestId }));\n                        break;\n                    }\n                    case \"FETCH_ONE\": {\n                        const request: FetchOneProps = payload;\n                        const delegate = await getScopedDelegate();\n                        const row = await delegate.fetchOne(request);\n                        ws.send(JSON.stringify({ type: \"FETCH_ONE_SUCCESS\",\npayload: { row },\nrequestId }));\n                        break;\n                    }\n                    case \"SAVE\": {\n                        const request: SaveProps = payload;\n                        const delegate = await getScopedDelegate();\n                        const row = await delegate.save(request);\n                        ws.send(JSON.stringify({ type: \"SAVE_SUCCESS\",\npayload: { row },\nrequestId }));\n                        break;\n                    }\n                    case \"DELETE\": {\n                        const request: DeleteProps = payload;\n                        const delegate = await getScopedDelegate();\n                        await delegate.delete(request);\n                        ws.send(JSON.stringify({ type: \"DELETE_SUCCESS\",\npayload: { success: true },\nrequestId }));\n                        break;\n                    }\n                    case \"CHECK_UNIQUE_FIELD\": {\n                        const { path, name, value, id, collection } = payload;\n                        const delegate = await getScopedDelegate();\n                        const isUnique = await delegate.checkUniqueField(path, name, value, id, collection);\n                        ws.send(JSON.stringify({ type: \"CHECK_UNIQUE_FIELD_SUCCESS\",\npayload: { isUnique },\nrequestId }));\n                        break;\n                    }\n                    case \"COUNT\": {\n                        const request: FetchCollectionProps = payload;\n                        const delegate = await getScopedDelegate();\n                        const count = await delegate.count!(request);\n                        ws.send(JSON.stringify({ type: \"COUNT_SUCCESS\",\npayload: { count },\nrequestId }));\n                        break;\n                    }\n                    case \"EXECUTE_SQL\": {\n                        const { sql, options } = payload;\n                        if (admin && isDocumentAdmin(admin) && admin.executeAggregate) {\n                            const result = await admin.executeAggregate(sql as Record<string, unknown>[]);\n                            ws.send(JSON.stringify({ type: \"EXECUTE_SQL_SUCCESS\",\npayload: { result },\nrequestId }));\n                        } else {\n                            ws.send(JSON.stringify({ type: \"ERROR\",\nrequestId,\npayload: { error: { message: \"SQL execution not supported for this driver\",\ncode: \"NOT_SUPPORTED\" } } }));\n                        }\n                        break;\n                    }\n                    case \"FETCH_UNMAPPED_TABLES\": {\n                        if (admin && isSchemaAdmin(admin)) {\n                            const tables = await admin.fetchUnmappedTables?.(payload?.mappedPaths) || [];\n                            ws.send(JSON.stringify({ type: \"FETCH_UNMAPPED_TABLES_SUCCESS\",\npayload: { tables },\nrequestId }));\n                        } else {\n                            ws.send(JSON.stringify({ type: \"FETCH_UNMAPPED_TABLES_SUCCESS\",\npayload: { tables: [] },\nrequestId }));\n                        }\n                        break;\n                    }\n                    case \"FETCH_TABLE_METADATA\": {\n                        const { tableName } = payload;\n                        if (admin && isSchemaAdmin(admin)) {\n                            const metadata = await admin.fetchTableMetadata?.(tableName);\n                            ws.send(JSON.stringify({ type: \"FETCH_TABLE_METADATA_SUCCESS\",\npayload: { metadata },\nrequestId }));\n                        } else {\n                            ws.send(JSON.stringify({ type: \"FETCH_TABLE_METADATA_SUCCESS\",\npayload: { metadata: null },\nrequestId }));\n                        }\n                        break;\n                    }\n                    case \"subscribe_collection\":\n                    case \"subscribe_one\":\n                    case \"unsubscribe\": {\n                        const session = clientSessions.get(clientId);\n                        const authContext = session?.user ? { uid: session.user.uid,\nroles: session.user.roles ?? [] } : undefined;\n                        await realtimeService.handleClientMessage(clientId, {\n                            type,\n                            payload,\n                            subscriptionId: payload?.subscriptionId\n                        }, authContext);\n                        break;\n                    }\n                    default:\n                        logger.error(\"❌ [WebSocket Server] Unknown message type\", { detail: type });\n                }\n            } catch (error: unknown) {\n                const errorMessage = process.env.NODE_ENV === \"production\" ? \"An unexpected error occurred\" : (error instanceof Error ? error.message : \"An unexpected error occurred\");\n                ws.send(JSON.stringify({ type: \"ERROR\",\nrequestId,\npayload: { error: { message: errorMessage,\ncode: \"INTERNAL_ERROR\" } } }));\n            }\n        });\n    });\n}\n"],"mappings":";;;;AAeA,SAAS,iBAAiB,QAA8C;CACpE,OAAO,cAAc,UAAU,OAAQ,OAAmC,aAAa;AAC3F;AAUA,IAAM,gBAAgB;AACtB,IAAM,oBAAoB;AAE1B,IAAM,mCAAmB,IAAI,IAAI;CAC7B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACJ,CAAC;AAED,SAAS,eAAe,SAA6C;CACjE,IAAI,CAAC,SAAS,MAAM,OAAO,OAAO;CAClC,OAAO,QAAQ,KAAK,MAAM,SAAS,OAAO;AAC9C;AAEA,SAAgB,qBACZ,QACA,iBACA,QACA,YACA,OACF;CAIE,MAAM,iCAAiB,IAAI,IAA2B;CAEtD,MAAM,eAAA,QAAA,IAAA,aAAwC;CAC9C,MAAM,WAAW,GAAG,SAAoB;EAAE,IAAI,CAAC,cAAc,QAAQ,MAAM,GAAG,IAAI;CAAG;CACrF,MAAM,MAAM,IAAI,gBAAgB,EAAE,OAAO,CAAC;CAE1C,IAAI,GAAG,UAAU,QAA+B;EAC5C,IAAI,IAAI,SAAS,cAAc;EAC/B,OAAO,MAAM,8BAA8B,EAAE,OAAO,IAAI,CAAC;CAC7D,CAAC;CAMD,MAAM,cAAc,mBAAmB,UAAU;CAEjD,IAAI,eAAe,CAAC,YAAY,WAC5B,OAAO,KACH,2JAEJ;CAGJ,IAAI,GAAG,eAAe,OAAO;EACzB,MAAM,WAAW,UAAU,KAAK,IAAI,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,UAAU,GAAG,CAAC;EAClF,QAAQ,+BAA+B,UAAU;EAEjD,eAAe,IAAI,UAAU;GAAE;GACvC,eAAe,CAAC;GAChB,cAAc;GACd,oBAAoB,KAAK,IAAI;EAAE,CAAC;EACxB,gBAAgB,UAAU,UAAU,EAAE;EAEtC,GAAG,GAAG,eAAe;GACjB,QAAQ,kCAAkC,UAAU;GACpD,eAAe,OAAO,QAAQ;EAClC,CAAC;EAED,GAAG,GAAG,WAAW,OAAO,YAAY;GAChC,IAAI;GACJ,IAAI;IACA,MAAM,EAAE,MAAM,SAAS,WAAW,UAAU,KAAK,MAAM,QAAQ,SAAS,CAAC;IACzE,YAAY;IAEZ,QAAQ,QAAQ,SAAS,KAAK,QAAQ,YAAY,IAAI,UAAU,KAAK,EAAE;IAEvE,MAAM,aAAa,SAAiC,MAAc,QAAgB;KAC9E,GAAG,KAAK,KAAK,UAAU;MAAE,MAAM;MACnD;MACA,SAAS,EAAE,OAAO;OAAE,SAAS;OAC7B;MAAK,EAAE;KAAE,CAAC,CAAC;IACK;IAEA,IAAI,SAAS,gBAAgB;KACzB,MAAM,EAAE,UAAU,WAAW,CAAC;KAC9B,IAAI,CAAC,OAAO;MACR,UAAU,cAAc,iBAAiB,mBAAmB;MAC5D;KACJ;KAEA,MAAM,OAAO,qBAAqB,KAAK;KACvC,IAAI,MAAM;MACN,MAAM,UAAU,eAAe,IAAI,QAAQ;MAC3C,IAAI,SAAS;OACT,QAAQ,OAAO;OACf,QAAQ,gBAAgB;MAC5B;MACA,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OACvD;OACA,SAAS;QAAE,KAAK,KAAK;QACrB,OAAO,KAAK;OAAM;MAAE,CAAC,CAAC;KACF,OACI,UAAU,cAAc,iBAAiB,0BAA0B;KAEvE;IACJ;IAEA,IAAI;SAEI,CADY,eAAe,IAAI,QAC9B,CAAA,EAAS,eAAe;MACzB,UAAU,SAAS,gBAAgB,yBAAyB;MAC5D;KACJ;;IAGJ;KACI,MAAM,UAAU,eAAe,IAAI,QAAQ;KAC3C,IAAI,SAAS;MACT,MAAM,MAAM,KAAK,IAAI;MACrB,IAAI,MAAM,QAAQ,qBAAqB,mBAAmB;OACtD,QAAQ,eAAe;OACvB,QAAQ,qBAAqB;MACjC;MACA,QAAQ;MACR,IAAI,QAAQ,eAAe,eAAe;OACtC,UAAU,SAAS,gBAAgB,sCAAsC;OACzE;MACJ;KACJ;IACJ;IAEA,IAAI,iBAAiB,IAAI,IAAI;SAErB,CAAC,eADW,eAAe,IAAI,QACf,CAAO,GAAG;MAC1B,UAAU,SAAS,aAAa,0CAA0C;MAC1E;KACJ;;IAGJ,MAAM,oBAAoB,YAAiC;KACvD,MAAM,UAAU,eAAe,IAAI,QAAQ;KAC3C,IAAI,SAAS,QAAQ,iBAAiB,MAAM,GACxC,IAAI;MACA,MAAM,cAAoB;OACtB,KAAK,QAAQ,KAAK;OAClB,OAAO,QAAQ,KAAK,SAAS;OAC7B,aAAa,QAAQ,KAAK,eAAe;OACzC,UAAU,QAAQ,KAAK,YAAY;OACnC,YAAY;OACZ,aAAa;OACb,OAAO,QAAQ,KAAK,SAAS,CAAC;MAClC;MACA,OAAO,MAAM,OAAO,SAAS,WAAW;KAC5C,SAAS,GAAG;MACR,OAAO,MAAM,0DAA0D,EAAE,OAAO,EAAE,CAAC;MACnF,OAAO;KACX;KAEJ,OAAO;IACX;IAEA,QAAQ,MAAR;KACI,KAAK,oBAAoB;MACrB,MAAM,UAAgC;MAEtC,MAAM,OAAO,OAAM,MADI,kBAAkB,EAAA,CACb,gBAAgB,OAAO;MACnD,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OACvD,SAAS,EAAE,KAAK;OAChB;MAAU,CAAC,CAAC;MACY;KACJ;KACA,KAAK,aAAa;MACd,MAAM,UAAyB;MAE/B,MAAM,MAAM,OAAM,MADK,kBAAkB,EAAA,CACd,SAAS,OAAO;MAC3C,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OACvD,SAAS,EAAE,IAAI;OACf;MAAU,CAAC,CAAC;MACY;KACJ;KACA,KAAK,QAAQ;MACT,MAAM,UAAqB;MAE3B,MAAM,MAAM,OAAM,MADK,kBAAkB,EAAA,CACd,KAAK,OAAO;MACvC,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OACvD,SAAS,EAAE,IAAI;OACf;MAAU,CAAC,CAAC;MACY;KACJ;KACA,KAAK,UAAU;MACX,MAAM,UAAuB;MAE7B,OAAM,MADiB,kBAAkB,EAAA,CAC1B,OAAO,OAAO;MAC7B,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OACvD,SAAS,EAAE,SAAS,KAAK;OACzB;MAAU,CAAC,CAAC;MACY;KACJ;KACA,KAAK,sBAAsB;MACvB,MAAM,EAAE,MAAM,MAAM,OAAO,IAAI,eAAe;MAE9C,MAAM,WAAW,OAAM,MADA,kBAAkB,EAAA,CACT,iBAAiB,MAAM,MAAM,OAAO,IAAI,UAAU;MAClF,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OACvD,SAAS,EAAE,SAAS;OACpB;MAAU,CAAC,CAAC;MACY;KACJ;KACA,KAAK,SAAS;MACV,MAAM,UAAgC;MAEtC,MAAM,QAAQ,OAAM,MADG,kBAAkB,EAAA,CACZ,MAAO,OAAO;MAC3C,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OACvD,SAAS,EAAE,MAAM;OACjB;MAAU,CAAC,CAAC;MACY;KACJ;KACA,KAAK,eAAe;MAChB,MAAM,EAAE,KAAK,YAAY;MACzB,IAAI,SAAS,gBAAgB,KAAK,KAAK,MAAM,kBAAkB;OAC3D,MAAM,SAAS,MAAM,MAAM,iBAAiB,GAAgC;OAC5E,GAAG,KAAK,KAAK,UAAU;QAAE,MAAM;QAC3D,SAAS,EAAE,OAAO;QAClB;OAAU,CAAC,CAAC;MACY,OACI,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OAC3D;OACA,SAAS,EAAE,OAAO;QAAE,SAAS;QAC7B,MAAM;OAAgB,EAAE;MAAE,CAAC,CAAC;MAEJ;KACJ;KACA,KAAK;MACD,IAAI,SAAS,cAAc,KAAK,GAAG;OAC/B,MAAM,SAAS,MAAM,MAAM,sBAAsB,SAAS,WAAW,KAAK,CAAC;OAC3E,GAAG,KAAK,KAAK,UAAU;QAAE,MAAM;QAC3D,SAAS,EAAE,OAAO;QAClB;OAAU,CAAC,CAAC;MACY,OACI,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OAC3D,SAAS,EAAE,QAAQ,CAAC,EAAE;OACtB;MAAU,CAAC,CAAC;MAEY;KAEJ,KAAK,wBAAwB;MACzB,MAAM,EAAE,cAAc;MACtB,IAAI,SAAS,cAAc,KAAK,GAAG;OAC/B,MAAM,WAAW,MAAM,MAAM,qBAAqB,SAAS;OAC3D,GAAG,KAAK,KAAK,UAAU;QAAE,MAAM;QAC3D,SAAS,EAAE,SAAS;QACpB;OAAU,CAAC,CAAC;MACY,OACI,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OAC3D,SAAS,EAAE,UAAU,KAAK;OAC1B;MAAU,CAAC,CAAC;MAEY;KACJ;KACA,KAAK;KACL,KAAK;KACL,KAAK,eAAe;MAChB,MAAM,UAAU,eAAe,IAAI,QAAQ;MAC3C,MAAM,cAAc,SAAS,OAAO;OAAE,KAAK,QAAQ,KAAK;OAChF,OAAO,QAAQ,KAAK,SAAS,CAAC;MAAE,IAAI,KAAA;MACZ,MAAM,gBAAgB,oBAAoB,UAAU;OAChD;OACA;OACA,gBAAgB,SAAS;MAC7B,GAAG,WAAW;MACd;KACJ;KACA,SACI,OAAO,MAAM,6CAA6C,EAAE,QAAQ,KAAK,CAAC;IAClF;GACJ,SAAS,OAAgB;IACrB,MAAM,eAAA,QAAA,IAAA,aAAwC,eAAe,iCAAkC,iBAAiB,QAAQ,MAAM,UAAU;IACxI,GAAG,KAAK,KAAK,UAAU;KAAE,MAAM;KAC/C;KACA,SAAS,EAAE,OAAO;MAAE,SAAS;MAC7B,MAAM;KAAiB,EAAE;IAAE,CAAC,CAAC;GACjB;EACJ,CAAC;CACL,CAAC;AACL"}