@redocly/redoc 0.140.0-next.1 → 0.140.0-next.10

package/dist/server/web-server/middleware/jsonValidatorMiddleware.d.ts

@@ -4,333 +4,13 @@ import type { ZodSchema } from 'zod';
  * in the 400 response only in develop mode.
  */
 export declare function jsonValidatorMiddleware<T extends ZodSchema>(schema: T): import("hono").MiddlewareHandler<import("hono").Env, string, {
-    in: (undefined extends (T extends ZodSchema<any, import("zod").ZodTypeDef, any> ? import("zod").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4").input<T> : never) ? true : false) extends true ? {
-        json?: ([T extends ZodSchema<any, import("zod").ZodTypeDef, any> ? import("zod").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4").input<T> : never] extends [any] ? T extends ZodSchema<any, import("zod").ZodTypeDef, any> ? import("zod").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4").input<T> : never : [Exclude<T extends ZodSchema<any, import("zod").ZodTypeDef, any> ? import("zod").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4").input<T> : never, undefined>] extends [never] ? {} : [Exclude<T extends ZodSchema<any, import("zod").ZodTypeDef, any> ? import("zod").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4").input<T> : never, undefined>] extends [object] ? undefined extends (T extends ZodSchema<any, import("zod").ZodTypeDef, any> ? import("zod").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4").input<T> : never) ? (((Exclude<T extends ZodSchema<any, import("zod").ZodTypeDef, any> ? import("zod").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4").input<T> : never, (T extends ZodSchema<any, import("zod").ZodTypeDef, any> ? import("zod").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4").input<T> : never) & undefined> extends infer T_3 ? { [K in keyof T_3]: ([Exclude<T_3[K], undefined>] extends [string] ? [string & Exclude<T_3[K], undefined>] extends [import("hono/utils/types").UnionToIntersection<string & Exclude<T_3[K], undefined>>] ? false : true : false) extends true ? T_3[K] : ([unknown] extends [T_3[K]] ? false : undefined extends T_3[K] ? true : false) extends true ? T_3[K] : Target extends "form" ? T$1 | T$1[] : Target extends "query" ? string | string[] : Target extends "param" ? string : Target extends "header" ? string : Target extends "cookie" ? string : unknown; } : never) extends infer T_2 ? { [K in keyof T_2]: T_2[K]; } : never) extends infer T_1 ? { [K in keyof T_1]: T_1[K]; } : never) | ((T extends ZodSchema<any, import("zod").ZodTypeDef, any> ? import("zod").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4").input<T> : never) & undefined) : (((T extends ZodSchema<any, import("zod").ZodTypeDef, any> ? import("zod").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4").input<T> : never) extends infer T_6 ? { [K in keyof T_6]: ([Exclude<T_6[K], undefined>] extends [string] ? [string & Exclude<T_6[K], undefined>] extends [import("hono/utils/types").UnionToIntersection<string & Exclude<T_6[K], undefined>>] ? false : true : false) extends true ? T_6[K] : ([unknown] extends [T_6[K]] ? false : undefined extends T_6[K] ? true : false) extends true ? T_6[K] : Target extends "form" ? T$1 | T$1[] : Target extends "query" ? string | string[] : Target extends "param" ? string : Target extends "header" ? string : Target extends "cookie" ? string : unknown; } : never) extends infer T_5 ? { [K in keyof T_5]: T_5[K]; } : never) extends infer T_4 ? { [K in keyof T_4]: T_4[K]; } : never : {}) | undefined;
+    in: (undefined extends (T extends import("zod/v3").ZodType<any, import("zod/v3").ZodTypeDef, any> ? import("zod/v3").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4/core").input<T> : never) ? true : false) extends true ? {
+        json?: ([T extends import("zod/v3").ZodType<any, import("zod/v3").ZodTypeDef, any> ? import("zod/v3").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4/core").input<T> : never] extends [any] ? T extends import("zod/v3").ZodType<any, import("zod/v3").ZodTypeDef, any> ? import("zod/v3").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4/core").input<T> : never : [Exclude<T extends import("zod/v3").ZodType<any, import("zod/v3").ZodTypeDef, any> ? import("zod/v3").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4/core").input<T> : never, undefined>] extends [never] ? {} : [Exclude<T extends import("zod/v3").ZodType<any, import("zod/v3").ZodTypeDef, any> ? import("zod/v3").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4/core").input<T> : never, undefined>] extends [object] ? undefined extends (T extends import("zod/v3").ZodType<any, import("zod/v3").ZodTypeDef, any> ? import("zod/v3").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4/core").input<T> : never) ? (((Exclude<T extends import("zod/v3").ZodType<any, import("zod/v3").ZodTypeDef, any> ? import("zod/v3").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4/core").input<T> : never, (T extends import("zod/v3").ZodType<any, import("zod/v3").ZodTypeDef, any> ? import("zod/v3").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4/core").input<T> : never) & undefined> extends infer T_3 ? { [K in keyof T_3]: ([Exclude<T_3[K], undefined>] extends [string] ? [string & Exclude<T_3[K], undefined>] extends [import("hono/utils/types").UnionToIntersection<string & Exclude<T_3[K], undefined>>] ? false : true : false) extends true ? T_3[K] : ([unknown] extends [T_3[K]] ? false : undefined extends T_3[K] ? true : false) extends true ? T_3[K] : Target extends "form" ? T$1 | T$1[] : Target extends "query" ? string | string[] : Target extends "param" ? string : Target extends "header" ? string : Target extends "cookie" ? string : unknown; } : never) extends infer T_2 ? { [K in keyof T_2]: T_2[K]; } : never) extends infer T_1 ? { [K in keyof T_1]: T_1[K]; } : never) | ((T extends import("zod/v3").ZodType<any, import("zod/v3").ZodTypeDef, any> ? import("zod/v3").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4/core").input<T> : never) & undefined) : (((T extends import("zod/v3").ZodType<any, import("zod/v3").ZodTypeDef, any> ? import("zod/v3").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4/core").input<T> : never) extends infer T_6 ? { [K in keyof T_6]: ([Exclude<T_6[K], undefined>] extends [string] ? [string & Exclude<T_6[K], undefined>] extends [import("hono/utils/types").UnionToIntersection<string & Exclude<T_6[K], undefined>>] ? false : true : false) extends true ? T_6[K] : ([unknown] extends [T_6[K]] ? false : undefined extends T_6[K] ? true : false) extends true ? T_6[K] : Target extends "form" ? T$1 | T$1[] : Target extends "query" ? string | string[] : Target extends "param" ? string : Target extends "header" ? string : Target extends "cookie" ? string : unknown; } : never) extends infer T_5 ? { [K in keyof T_5]: T_5[K]; } : never) extends infer T_4 ? { [K in keyof T_4]: T_4[K]; } : never : {}) | undefined;
     } : {
-        json: [T extends ZodSchema<any, import("zod").ZodTypeDef, any> ? import("zod").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4").input<T> : never] extends [any] ? T extends ZodSchema<any, import("zod").ZodTypeDef, any> ? import("zod").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4").input<T> : never : [Exclude<T extends ZodSchema<any, import("zod").ZodTypeDef, any> ? import("zod").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4").input<T> : never, undefined>] extends [never] ? {} : [Exclude<T extends ZodSchema<any, import("zod").ZodTypeDef, any> ? import("zod").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4").input<T> : never, undefined>] extends [object] ? undefined extends (T extends ZodSchema<any, import("zod").ZodTypeDef, any> ? import("zod").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4").input<T> : never) ? (((Exclude<T extends ZodSchema<any, import("zod").ZodTypeDef, any> ? import("zod").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4").input<T> : never, (T extends ZodSchema<any, import("zod").ZodTypeDef, any> ? import("zod").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4").input<T> : never) & undefined> extends infer T_3 ? { [K in keyof T_3]: ([Exclude<T_3[K], undefined>] extends [string] ? [string & Exclude<T_3[K], undefined>] extends [import("hono/utils/types").UnionToIntersection<string & Exclude<T_3[K], undefined>>] ? false : true : false) extends true ? T_3[K] : ([unknown] extends [T_3[K]] ? false : undefined extends T_3[K] ? true : false) extends true ? T_3[K] : Target extends "form" ? T$1 | T$1[] : Target extends "query" ? string | string[] : Target extends "param" ? string : Target extends "header" ? string : Target extends "cookie" ? string : unknown; } : never) extends infer T_2 ? { [K in keyof T_2]: T_2[K]; } : never) extends infer T_1 ? { [K in keyof T_1]: T_1[K]; } : never) | ((T extends ZodSchema<any, import("zod").ZodTypeDef, any> ? import("zod").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4").input<T> : never) & undefined) : (((T extends ZodSchema<any, import("zod").ZodTypeDef, any> ? import("zod").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4").input<T> : never) extends infer T_6 ? { [K in keyof T_6]: ([Exclude<T_6[K], undefined>] extends [string] ? [string & Exclude<T_6[K], undefined>] extends [import("hono/utils/types").UnionToIntersection<string & Exclude<T_6[K], undefined>>] ? false : true : false) extends true ? T_6[K] : ([unknown] extends [T_6[K]] ? false : undefined extends T_6[K] ? true : false) extends true ? T_6[K] : Target extends "form" ? T$1 | T$1[] : Target extends "query" ? string | string[] : Target extends "param" ? string : Target extends "header" ? string : Target extends "cookie" ? string : unknown; } : never) extends infer T_5 ? { [K in keyof T_5]: T_5[K]; } : never) extends infer T_4 ? { [K in keyof T_4]: T_4[K]; } : never : {};
+        json: [T extends import("zod/v3").ZodType<any, import("zod/v3").ZodTypeDef, any> ? import("zod/v3").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4/core").input<T> : never] extends [any] ? T extends import("zod/v3").ZodType<any, import("zod/v3").ZodTypeDef, any> ? import("zod/v3").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4/core").input<T> : never : [Exclude<T extends import("zod/v3").ZodType<any, import("zod/v3").ZodTypeDef, any> ? import("zod/v3").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4/core").input<T> : never, undefined>] extends [never] ? {} : [Exclude<T extends import("zod/v3").ZodType<any, import("zod/v3").ZodTypeDef, any> ? import("zod/v3").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4/core").input<T> : never, undefined>] extends [object] ? undefined extends (T extends import("zod/v3").ZodType<any, import("zod/v3").ZodTypeDef, any> ? import("zod/v3").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4/core").input<T> : never) ? (((Exclude<T extends import("zod/v3").ZodType<any, import("zod/v3").ZodTypeDef, any> ? import("zod/v3").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4/core").input<T> : never, (T extends import("zod/v3").ZodType<any, import("zod/v3").ZodTypeDef, any> ? import("zod/v3").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4/core").input<T> : never) & undefined> extends infer T_3 ? { [K in keyof T_3]: ([Exclude<T_3[K], undefined>] extends [string] ? [string & Exclude<T_3[K], undefined>] extends [import("hono/utils/types").UnionToIntersection<string & Exclude<T_3[K], undefined>>] ? false : true : false) extends true ? T_3[K] : ([unknown] extends [T_3[K]] ? false : undefined extends T_3[K] ? true : false) extends true ? T_3[K] : Target extends "form" ? T$1 | T$1[] : Target extends "query" ? string | string[] : Target extends "param" ? string : Target extends "header" ? string : Target extends "cookie" ? string : unknown; } : never) extends infer T_2 ? { [K in keyof T_2]: T_2[K]; } : never) extends infer T_1 ? { [K in keyof T_1]: T_1[K]; } : never) | ((T extends import("zod/v3").ZodType<any, import("zod/v3").ZodTypeDef, any> ? import("zod/v3").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4/core").input<T> : never) & undefined) : (((T extends import("zod/v3").ZodType<any, import("zod/v3").ZodTypeDef, any> ? import("zod/v3").input<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4/core").input<T> : never) extends infer T_6 ? { [K in keyof T_6]: ([Exclude<T_6[K], undefined>] extends [string] ? [string & Exclude<T_6[K], undefined>] extends [import("hono/utils/types").UnionToIntersection<string & Exclude<T_6[K], undefined>>] ? false : true : false) extends true ? T_6[K] : ([unknown] extends [T_6[K]] ? false : undefined extends T_6[K] ? true : false) extends true ? T_6[K] : Target extends "form" ? T$1 | T$1[] : Target extends "query" ? string | string[] : Target extends "param" ? string : Target extends "header" ? string : Target extends "cookie" ? string : unknown; } : never) extends infer T_5 ? { [K in keyof T_5]: T_5[K]; } : never) extends infer T_4 ? { [K in keyof T_4]: T_4[K]; } : never : {};
     };
     out: {
-        json: T extends ZodSchema<any, import("zod").ZodTypeDef, any> ? import("zod").output<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod/v4").output<T> : never;
+        json: T extends import("zod/v3").ZodType<any, import("zod/v3").ZodTypeDef, any> ? import("zod/v3").output<T> : T extends import("zod/v4/core").$ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> ? import("zod").infer<T> : never;
     };
-}, (Response & import("hono").TypedResponse<"Bad Request", 400, "text">) | (Response & import("hono").TypedResponse<{
-    success: boolean;
-    error: ({
-        path: (string | number)[];
-        message: string;
-        code: "custom";
-        params?: {
-            [x: string]: any;
-        } | undefined;
-        fatal?: boolean | undefined;
-    } | {
-        path: (string | number)[];
-        message: string;
-        code: "invalid_arguments";
-        argumentsError: {
-            name: string;
-            stack?: string;
-            cause?: import("hono/utils/types").JSONValue | undefined;
-            issues: ({
-                path: (string | number)[];
-                message: string;
-                code: "custom";
-                params?: {
-                    [x: string]: any;
-                } | undefined;
-                fatal?: boolean | undefined;
-            } | /*elided*/ any | {
-                path: (string | number)[];
-                message: string;
-                code: "invalid_date";
-                fatal?: boolean | undefined;
-            } | {
-                path: (string | number)[];
-                message: string;
-                received: string | number;
-                code: "invalid_enum_value";
-                options: (string | number)[];
-                fatal?: boolean | undefined;
-            } | {
-                path: (string | number)[];
-                message: string;
-                code: "invalid_intersection_types";
-                fatal?: boolean | undefined;
-            } | {
-                path: (string | number)[];
-                message: string;
-                code: "invalid_literal";
-                expected: import("hono/utils/types").JSONValue;
-                received: import("hono/utils/types").JSONValue;
-                fatal?: boolean | undefined;
-            } | {
-                path: (string | number)[];
-                message: string;
-                code: "invalid_return_type";
-                returnTypeError: /*elided*/ any;
-                fatal?: boolean | undefined;
-            } | {
-                path: (string | number)[];
-                message: string;
-                code: "invalid_string";
-                validation: import("zod").StringValidation;
-                fatal?: boolean | undefined;
-            } | {
-                path: (string | number)[];
-                message: string;
-                code: "invalid_type";
-                expected: import("zod").ZodParsedType;
-                received: import("zod").ZodParsedType;
-                fatal?: boolean | undefined;
-            } | {
-                path: (string | number)[];
-                message: string;
-                code: "invalid_union_discriminator";
-                options: (string | number | boolean | null)[];
-                fatal?: boolean | undefined;
-            } | {
-                path: (string | number)[];
-                message: string;
-                code: "invalid_union";
-                unionErrors: /*elided*/ any[];
-                fatal?: boolean | undefined;
-            } | {
-                path: (string | number)[];
-                message: string;
-                code: "not_finite";
-                fatal?: boolean | undefined;
-            } | {
-                path: (string | number)[];
-                message: string;
-                code: "not_multiple_of";
-                multipleOf: number;
-                fatal?: boolean | undefined;
-            } | {
-                path: (string | number)[];
-                message: string;
-                code: "too_big";
-                maximum: number;
-                inclusive: boolean;
-                exact?: boolean;
-                type: "array" | "string" | "number" | "set" | "date" | "bigint";
-                fatal?: boolean | undefined;
-            } | {
-                path: (string | number)[];
-                message: string;
-                code: "too_small";
-                minimum: number;
-                inclusive: boolean;
-                exact?: boolean;
-                type: "array" | "string" | "number" | "set" | "date" | "bigint";
-                fatal?: boolean | undefined;
-            } | {
-                path: (string | number)[];
-                message: string;
-                code: "unrecognized_keys";
-                keys: string[];
-                fatal?: boolean | undefined;
-            })[];
-            readonly errors: ({
-                path: (string | number)[];
-                message: string;
-                code: "custom";
-                params?: {
-                    [x: string]: any;
-                } | undefined;
-                fatal?: boolean | undefined;
-            } | /*elided*/ any | {
-                path: (string | number)[];
-                message: string;
-                code: "invalid_date";
-                fatal?: boolean | undefined;
-            } | {
-                path: (string | number)[];
-                message: string;
-                received: string | number;
-                code: "invalid_enum_value";
-                options: (string | number)[];
-                fatal?: boolean | undefined;
-            } | {
-                path: (string | number)[];
-                message: string;
-                code: "invalid_intersection_types";
-                fatal?: boolean | undefined;
-            } | {
-                path: (string | number)[];
-                message: string;
-                code: "invalid_literal";
-                expected: import("hono/utils/types").JSONValue;
-                received: import("hono/utils/types").JSONValue;
-                fatal?: boolean | undefined;
-            } | {
-                path: (string | number)[];
-                message: string;
-                code: "invalid_return_type";
-                returnTypeError: any;
-                fatal?: boolean | undefined;
-            } | {
-                path: (string | number)[];
-                message: string;
-                code: "invalid_string";
-                validation: import("zod").StringValidation;
-                fatal?: boolean | undefined;
-            } | {
-                path: (string | number)[];
-                message: string;
-                code: "invalid_type";
-                expected: import("zod").ZodParsedType;
-                received: import("zod").ZodParsedType;
-                fatal?: boolean | undefined;
-            } | {
-                path: (string | number)[];
-                message: string;
-                code: "invalid_union_discriminator";
-                options: (string | number | boolean | null)[];
-                fatal?: boolean | undefined;
-            } | {
-                path: (string | number)[];
-                message: string;
-                code: "invalid_union";
-                unionErrors: any[];
-                fatal?: boolean | undefined;
-            } | {
-                path: (string | number)[];
-                message: string;
-                code: "not_finite";
-                fatal?: boolean | undefined;
-            } | {
-                path: (string | number)[];
-                message: string;
-                code: "not_multiple_of";
-                multipleOf: number;
-                fatal?: boolean | undefined;
-            } | {
-                path: (string | number)[];
-                message: string;
-                code: "too_big";
-                maximum: number;
-                inclusive: boolean;
-                exact?: boolean;
-                type: "array" | "string" | "number" | "set" | "date" | "bigint";
-                fatal?: boolean | undefined;
-            } | {
-                path: (string | number)[];
-                message: string;
-                code: "too_small";
-                minimum: number;
-                inclusive: boolean;
-                exact?: boolean;
-                type: "array" | "string" | "number" | "set" | "date" | "bigint";
-                fatal?: boolean | undefined;
-            } | {
-                path: (string | number)[];
-                message: string;
-                code: "unrecognized_keys";
-                keys: string[];
-                fatal?: boolean | undefined;
-            })[];
-            readonly message: string;
-            readonly isEmpty: boolean;
-            addIssue: never;
-            addIssues: never;
-            readonly formErrors: {
-                formErrors: string[];
-                fieldErrors: {
-                    [x: string]: string[] | undefined;
-                    [x: number]: string[] | undefined;
-                };
-            };
-        };
-        fatal?: boolean | undefined;
-    } | {
-        path: (string | number)[];
-        message: string;
-        code: "invalid_date";
-        fatal?: boolean | undefined;
-    } | {
-        path: (string | number)[];
-        message: string;
-        received: string | number;
-        code: "invalid_enum_value";
-        options: (string | number)[];
-        fatal?: boolean | undefined;
-    } | {
-        path: (string | number)[];
-        message: string;
-        code: "invalid_intersection_types";
-        fatal?: boolean | undefined;
-    } | {
-        path: (string | number)[];
-        message: string;
-        code: "invalid_literal";
-        expected: import("hono/utils/types").JSONValue;
-        received: import("hono/utils/types").JSONValue;
-        fatal?: boolean | undefined;
-    } | {
-        path: (string | number)[];
-        message: string;
-        code: "invalid_return_type";
-        returnTypeError: any;
-        fatal?: boolean | undefined;
-    } | {
-        path: (string | number)[];
-        message: string;
-        code: "invalid_string";
-        validation: import("zod").StringValidation;
-        fatal?: boolean | undefined;
-    } | {
-        path: (string | number)[];
-        message: string;
-        code: "invalid_type";
-        expected: import("zod").ZodParsedType;
-        received: import("zod").ZodParsedType;
-        fatal?: boolean | undefined;
-    } | {
-        path: (string | number)[];
-        message: string;
-        code: "invalid_union_discriminator";
-        options: (string | number | boolean | null)[];
-        fatal?: boolean | undefined;
-    } | {
-        path: (string | number)[];
-        message: string;
-        code: "invalid_union";
-        unionErrors: any[];
-        fatal?: boolean | undefined;
-    } | {
-        path: (string | number)[];
-        message: string;
-        code: "not_finite";
-        fatal?: boolean | undefined;
-    } | {
-        path: (string | number)[];
-        message: string;
-        code: "not_multiple_of";
-        multipleOf: number;
-        fatal?: boolean | undefined;
-    } | {
-        path: (string | number)[];
-        message: string;
-        code: "too_big";
-        maximum: number;
-        inclusive: boolean;
-        exact?: boolean;
-        type: "array" | "string" | "number" | "set" | "date" | "bigint";
-        fatal?: boolean | undefined;
-    } | {
-        path: (string | number)[];
-        message: string;
-        code: "too_small";
-        minimum: number;
-        inclusive: boolean;
-        exact?: boolean;
-        type: "array" | "string" | "number" | "set" | "date" | "bigint";
-        fatal?: boolean | undefined;
-    } | {
-        path: (string | number)[];
-        message: string;
-        code: "unrecognized_keys";
-        keys: string[];
-        fatal?: boolean | undefined;
-    })[];
-}, 400, "json">)>;
+}, Response>;
 //# sourceMappingURL=jsonValidatorMiddleware.d.ts.map

package/dist/server/web-server/routes/auth.js

@@ -1 +1 @@
-import{setCookie as L,deleteCookie as P}from"hono/cookie";import{AuthProviderType as Y,DEFAULT_TEAM_CLAIM_NAME as Q}from"@redocly/config";import{withPathPrefix as w,getPathPrefix as A}from"@redocly/theme/core/utils";import{compareURIs as x}from"../../../utils/url/compare-uris.js";import{ensureArray as ee}from"../../../utils/array/ensure-array.js";import{ALTERNATIVE_AUD_CLAIM_NAME as re,JWT_SECRET_KEY as U,MAX_AUTH_TOKEN_COOKIE_BYTES as N,ORG_SLUG as oe,ORG_ID as te}from"../../constants/common.js";import{AUTH_SEGMENT as ne,ServerRoutes as k}from"../../../constants/api.js";import{AuthCookieNames as _,DEFAULT_COOKIE_EXPIRATION as B}from"../../../constants/common.js";import{sanitizeRedirectPathname as H}from"../../../utils/url/sanitize-redirect-pathname.js";import{telemetry as y}from"../../telemetry/index.js";import{envConfig as K}from"../../config/env-config.js";import{fetchWithClient as ie}from"../../utils/fetch-with-client.js";import{clearAuthCookies as z,clearPostLogoutCookie as v,hasPostLogoutCookie as se,setPostLogoutCookie as j}from"../../utils/cookie.js";import{getAuthProviderLoginParams as ae,isOidcProviderConfig as b,isSaml2ProviderConfig as de,oidcExchangeCodeForToken as le,buildLoginUrl as ce,decodeSamlResponse as ue,extractUserClaims as pe,parseSamlResponse as ge,parseOidcState as fe,verifySAMLResponse as me,getUsernameFromPayload as he,buildOidcLogoutUrl as Ce,isIdpIssuedToken as Ie,getOidcMetadata as J,getRedoclyTokenPayload as _e,idTokenAudienceIsAllowed as Ae,isRedoclySso as Oe,rewritePreviewAuthRedirectUri as Re,parsePreviewBranch as Te,buildOidcLoginUrl as Le,createMcpSessionResource as M,signTokenWithinCookieSizeLimit as G}from"../auth.js";import*as $ from"../jwt/jwt.js";import{AlgorithmTypes as E}from"../jwt/types.js";import{handleErrorPageRender as we}from"../utils.js";import{encodeBase64URL as ye}from"../jwt/encode.js";import{resolveUiLocalesForIdpLogin as Me}from"./helpers/resolve-ui-locales-for-idp-login.js";async function Ge(n,e){if(!e.devLogin||K.isProductionEnv)return n.newResponse(null,404,{});const{password:r,...a}=await n.req.json(),o=await $.sign({...a,name:a.username||a.email||"Unknown"},U,E.HS256);return L(n,_.AUTHORIZATION,o,{path:A()||"/",httpOnly:!0,secure:!0,sameSite:"none"}),v(n),n.newResponse(null,200,{})}function Ze(){return async n=>{const e=n.get("logger"),r=encodeURIComponent(n.req.query("message")||"");e.error(`Login error: ${r}`);const a=`${k.LOGIN}/?error=${encodeURIComponent(r)}`;return n.newResponse(null,301,{Location:a})}}function Z(n){if(!n||!n.includes(k.MCP_CALLBACK))return null;try{const e=n.split("/"),r=e[e.length-1];if(r){const a=Buffer.from(r,"base64url").toString("utf-8");return JSON.parse(a).mcpSessionId||null}}catch{}return null}function Ve(n){return async e=>{const r=e.get("logger"),a=n.getConfig().ssoDirect;let o;try{o=fe(e.req.query("state"))}catch{return r.warn("OIDC login error: Invalid OAuth2 state"),e.text("Bad request: Invalid OAuth2 state",400)}const C=o.idpId,i=o.source==="mcp"||o.redirectTo&&typeof o.redirectTo=="string"&&o.redirectTo.includes(k.MCP_CALLBACK),u=i?Z(typeof o.redirectTo=="string"?o.redirectTo:void 0):null,s=a?.[C];if(!b(s))return r.error("OIDC login error: missing OIDC provider config"),e.text("Forbidden",403);const p=await J(C,s);if(a&&!p.token_endpoint){const m="Invalid OIDC configuration: token_endpoint is required";return r.error(`OIDC login error: ${m}`),e.text(m,500)}try{const m=p.token_endpoint,f=e.req.query("code"),h=e.req.query("error");if(h)return i&&y.sendMcpAuthorizationFailedMessage([{...M(u),error:`OIDC error: ${h}`,error_details:e.req.query("error_description")||null}]),we(e,n,{slug:"/"},403,"403OIDC");if(!f){const g="Code is expected but not present";return r.error(`OIDC login error: ${g}`),i&&y.sendMcpAuthorizationFailedMessage([{...M(u),error:g,error_details:null}]),new Response(`Forbidden: ${g}`,{status:403})}const R=typeof o.redirectUri=="string"?o.redirectUri:new URL(w(k.OIDC_CALLBACK),e.req.url).toString(),I=e.get("cookies")?.code_verifier,d=await le(m,f,R,s,{...s.tokenRequestCustomParams,...I?{code_verifier:I}:{}});if(d.error)return r.error(`Error from OIDC provider: "${d.error}"`),i&&y.sendMcpAuthorizationFailedMessage([{...M(u),error:`Token exchange error: ${d.error}`,error_details:d.error_description||null}]),e.text(`Forbidden: ${d.error_description||d.error}`,403);if(!d?.id_token){const g="No id_token, please, add openid to scopes";return r.error(`OIDC login error: ${g}`),i&&y.sendMcpAuthorizationFailedMessage([{...M(u),error:g,error_details:null}]),new Response(`Forbidden: ${g}`,{status:403})}const{payload:l,header:T}=$.decode(d.id_token),t=T.alg===E.RS256;if(!Ae(l,s)){const g="No valid audience found in id_token";return r.error(`OIDC login error: ${g}`),i&&y.sendMcpAuthorizationFailedMessage([{...M(u),error:g,error_details:null}]),new Response(`Forbidden: ${g}`,{status:403})}let c=t?d.id_token:await $.sign({...l,idpId:C},U,E.HS256);if(Buffer.byteLength(c)>N){const g=await G(l,C,s.teamsClaimName,{rbacConfig:n.getConfig().access?.rbac,teamsMapping:s.teamsClaimMap});if(!g){const S=`The id_token claims are too large for the session cookie: ${Buffer.byteLength(JSON.stringify(l))} bytes of claims`;return r.error(`OIDC login error: ${S}`),i&&y.sendMcpAuthorizationFailedMessage([{...M(u),error:S,error_details:null}]),e.text(`Forbidden: ${S}`,403)}g.teamsKept<g.teamsTotal&&r.warn(`OIDC login: the "${s.teamsClaimName}" claim is too large for the session cookie size limit; kept ${g.teamsKept} of ${g.teamsTotal} values, with teams from the RBAC configuration first; RBAC ignores the dropped teams: ${JSON.stringify(g.droppedTeams)}`),c=g.token}he(l)||r.warn("To display your username, the required 'email' or 'full_profile' scope must be added to the identity provider configuration");const D=s?.tokenExpirationTime?Date.now()+s.tokenExpirationTime*1e3:l.exp*1e3||Date.now()+B*1e3;if(s.introspectEndpoint){const g=await fetch(s.introspectEndpoint,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({access_token:d.access_token})});if(g.ok){const q=(await g.json()).ext?.federatedIdentity;q&&(L(e,_.FEDERATED_ACCESS_TOKEN,q.access_token||"",{path:A()||"/",httpOnly:!1,expires:new Date(D)}),L(e,_.FEDERATED_ID_TOKEN,q.id_token||"",{path:A()||"/",httpOnly:!1,expires:new Date(D)}))}else r.warn(`OIDC introspect error: ${g.statusText}`)}if(L(e,_.AUTHORIZATION,c,{path:A()||"/",httpOnly:!0,expires:new Date(D)}),c!==d.id_token&&Buffer.byteLength(d.id_token)<=N?L(e,_.IDP_ID_TOKEN,d.id_token||"",{path:A()||"/",httpOnly:!0,expires:new Date(D)}):P(e,_.IDP_ID_TOKEN,{path:A()||"/"}),L(e,_.IDP_ACCESS_TOKEN,d.access_token||"",{path:A()||"/",httpOnly:!0,expires:new Date(D)}),d.refresh_token?L(e,_.IDP_REFRESH_TOKEN,d.refresh_token,{path:A()||"/",httpOnly:!0,expires:new Date(D)}):P(e,_.IDP_REFRESH_TOKEN,{path:A()||"/"}),P(e,"code_verifier",{path:A()||"/"}),v(e),i&&o.redirectTo&&typeof o.redirectTo=="string"&&o.redirectTo.includes(k.MCP_CALLBACK)){const S=`${e.req.url.split("?")[0].replace(k.OIDC_CALLBACK,"")}${o.redirectTo}`;return e.newResponse(null,302,{Location:S})}const V=typeof o.redirectTo=="string"?o.redirectTo:void 0,W=H(new URL(V||"/",e.req.url).pathname),X=e.newResponse(null,302,{Location:W});return r.updateContext({email:l.email,subject:l.sub}),r.info("OIDC login successful"),X}catch(m){const f=m instanceof Error?m.message:String(m),h=m instanceof Error?m.stack:String(m);if(r.error(`OIDC login error: ${f}`),i&&y.sendMcpAuthorizationFailedMessage([{...M(u),error:f,error_details:h}]),m.error==="access_denied")return r.info("Access denied"),e.text("Forbidden",403)}const O="Something went wrong";return r.error(`OIDC login error: ${O}`),i&&y.sendMcpAuthorizationFailedMessage([{...M(u),error:O,error_details:null}]),e.text(O,500)}}function We(n){return async e=>{const r=e.get("logger"),o=e.get("auth").claims?.idpId,i=n.getConfig().ssoDirect?.[o];if(e.req.method==="POST")return b(i)||(z(e),j(e)),r.info("Logout successful"),e.newResponse(null,200,{});let u;if(b(i)){const s=(await J(o,i)).end_session_endpoint;if(s){const p=new URL(e.req.url),O=e.req.header("x-forwarded-proto")||p.protocol.slice(0,-1)||"https",m=e.req.header("x-forwarded-host")||p.host,f=`${O}://${m}`,h=Te(f),R=h?ye(JSON.stringify({branch:h,postLogoutRedirectUri:`${f}${w(k.POST_LOGOUT)}`})):void 0,I=h?`${Re(f)}/${ne}/logout`:`${f}${w(k.POST_LOGOUT)}`,d=e.get("cookies"),l=d?.[_.AUTHORIZATION],T=d?.[_.IDP_ID_TOKEN]||(Ie(l)?l:void 0);u=Ce(s,I,T,R)}}return r.info("Logout successful"),z(e),j(e),e.newResponse(null,302,{Location:u||w("/")})}}function Xe(n){return async e=>{const r=n.getConfig().access?.logoutReturnUrl,a=r||w("/");return e.newResponse(null,302,{Location:a})}}function Ye(n){return async e=>{const r=e.get("logger"),a=e.req.param("code"),o=K.BH_API_URL,C=(i,u,s)=>i&&u?`${i} ${u.charAt(0)}`:s;try{if(!o)throw new Error("BH_API_URL is not set");const i=n.getConfig().ssoDirect;if(!i||!Object.keys(i).length)return r.warn("Invite no sso configured to handle"),e.redirect(w("/"));const u=await ie(`${o}/public-user-invites/${a}`);if(!u.ok)return u.status===404?(r.warn(`Invite ${a} not found redirect to homepage`),e.redirect(w("/"))):(r.error("Invite error",await u.text()),e.redirect(w("/")));const s=await u.json(),p=new URL(w("/invite"),e.req.url);return p.searchParams.set("code",a),p.searchParams.set("org",s.organization.name),p.searchParams.set("invitedBy",C(s.invitedBy.firstName,s.invitedBy.lastName,s.invitedBy.name)),e.newResponse(null,302,{Location:p.toString()})}catch(i){return r.error("Error processing invite",{error:i,inviteCode:a}),e.text(i.message||"Failed to process invite",400)}}}function Qe(n){return async e=>{const r=e.get("logger"),a=n.getConfig().ssoDirect,o=new URL(e.req.url),C=e.req.query("inviteCode"),i=e.req.header("x-forwarded-proto")||o.protocol.slice(0,-1)||"https",u=e.req.header("x-forwarded-host")||o.host,s=`${i}://${u}`;let p=o.searchParams.get("idpId");const O=o.searchParams.get("redirectTo"),m=Object.keys(a||{})[0];p=p||m;const f=o.searchParams.get("mcp_redirect_uri"),h=!!f;if(!a?.[p]){const c="Invalid idpId";if(r.error(`IdP login error: ${c}`),h){const F=Z(O||void 0);y.sendMcpAuthorizationFailedMessage([{...M(F),error:c,error_details:null}])}return e.text(`Forbidden: ${c}`,403)}const I=Me({localePrefixParam:o.searchParams.get("localePrefix"),l10n:n.getGlobalData()?.l10n}),d=p&&a?await ae(p,a[p]):void 0,l={};for(const c of Object.keys(d?.extraParams||{}))l[c]=o.searchParams.get(c)||d?.extraParams?.[c]||void 0;se(e)&&(l.prompt="login",l.post_logout="1");let T,t={};if(h&&f&&d&&d.type===Y.OIDC){r.info(`Building MCP OAuth login URL with redirect_uri: ${f}`);const c=Le("",{...d,extraParams:l},O,C,{redirectUriOverride:f,sourceOverride:"mcp",branchOverride:void 0,uiLocales:I});T=c.loginUrl,t=c.cookies||{}}else if(d){const c=ce({...d,extraParams:l},s,O,C,I);T=c.loginUrl,t=c.cookies||{}}return Object.keys(t).forEach(c=>{L(e,c,t[c].value,t[c].options)}),r.info(`IdP login initiated for ID '${p}'`),e.newResponse(null,302,{Location:T||new URL(e.req.url).pathname})}}function xe(n){return async e=>{const r=e.get("logger"),a=await e.req.formData(),o=a.get("SAMLResponse"),C=a.get("RelayState");if(typeof o!="string"||typeof C!="string"){const t="SAMLResponse is required";return r.error(`SAML2 login error: ${t}`),e.text(`Bad request: ${t}`,400)}const i=ue(o),{success:u,uid:s,nameFormat:p,attrs:O,issuerId:m,expiresAt:f}=ge(i),{idpId:h,redirectTo:R}=JSON.parse(C);if(!u){const t="SAML2 assertion is not successful";return r.error(`SAML2 login error: ${t}`),e.text(`Permission denied: ${t}`,401)}if(!f||Math.ceil(Date.now()/1e3)>=f){const t="SAML2 Token Expired";return r.error(`SAML2 login error: ${t}`),e.text(t,401)}const I=n.getConfig().ssoDirect?.[h];if(!I||!de(I)){const t="Cannot find valid IdP";return r.error(`SAML2 login error: ${t}`),e.text(`Permission denied: ${t}`,401)}if(!(I.issuerId&&m&&x(I.issuerId,m))){const t="IssuerID is misconfigured or untrusted assertions issuer received";return r.error(`SAML2 login error: ${t}`),e.text(`Permission denied: ${t}`,401)}if(!await me(i,I.x509PublicCert)){const t="SAMLResponse signature invalid";return r.error(`SAML2 login error: ${t}`),e.text(t,401)}const l=pe(s,p,O,I.teamsAttributeName??Q);if(!l.sub){const t="The provider did not return a valid user identity.";return r.error(`SAML2 login error: ${t}`),e.text(t,400)}if(!l.email){const t="The provider did not return a valid user email.";return r.error(`SAML2 login error: ${t}`),e.text(t,400)}let T=await $.sign({...l,idpId:h},U,E.HS256);if(Buffer.byteLength(T)>N){const t=await G({...l},h,"teams",{rbacConfig:n.getConfig().access?.rbac,teamsMapping:I.teamsAttributeMap});if(!t){const c=`The SAML2 claims are too large for the session cookie: ${Buffer.byteLength(JSON.stringify(l))} bytes of claims`;return r.error(`SAML2 login error: ${c}`),e.text(`Forbidden: ${c}`,403)}t.teamsKept<t.teamsTotal&&r.warn(`SAML2 login: the "teams" claim is too large for the session cookie size limit; kept ${t.teamsKept} of ${t.teamsTotal} values, with teams from the RBAC configuration first; RBAC ignores the dropped teams: ${JSON.stringify(t.droppedTeams)}`),T=t.token}return L(e,_.AUTHORIZATION,T,{path:A()||"/",httpOnly:!0,expires:new Date(f*1e3)}),P(e,_.IDP_REFRESH_TOKEN,{path:A()||"/"}),v(e),r.updateContext({email:l.email,subject:l.sub}),r.info("SAML2 login successful"),e.newResponse(null,302,{Location:R||"/"})}}function er(n){return async e=>{const r=e.get("logger"),a=new URL(e.req.query("redirectTo")||"/",e.req.url),o=w(H(a.pathname)),C=n.getConfig().ssoDirect,i=Object.entries(C||{}).find(([,R])=>b(R)&&Oe(R));if(!(C&&i))return e.newResponse(null,302,{Location:o});const s=e.req.query("token"),p=s&&await _e(s);if(!p)return e.newResponse(null,302,{Location:o});if(!ee(p[re]||[]).some(R=>R===oe||R===te))return e.newResponse(null,302,{Location:o});const f=await $.sign({...p,idpId:i?.at(0)},U,E.HS256),h=Date.now()+B*1e3;return L(e,_.AUTHORIZATION,f,{path:A()||"/",httpOnly:!0,expires:new Date(h),sameSite:"None",secure:!0}),P(e,_.IDP_REFRESH_TOKEN,{path:A()||"/"}),v(e),r.info("Token login successful"),e.newResponse(null,302,{Location:o})}}export{Ge as authorizeHandler,Qe as idpLoginHandler,Ye as inviteHandler,We as logoutHandler,Ve as oidcCallbackHandler,Xe as postLogoutHandler,Ze as redoclyLoginCallbackHandler,er as redoclyTokenLoginHandler,xe as samlCallbackHandler};
+import{setCookie as T,deleteCookie as P}from"hono/cookie";import{AuthProviderType as Y,DEFAULT_TEAM_CLAIM_NAME as Q}from"@redocly/config";import{withPathPrefix as L,getPathPrefix as O}from"@redocly/theme/core/utils";import{compareURIs as x}from"../../../utils/url/compare-uris.js";import{ensureArray as ee}from"../../../utils/array/ensure-array.js";import{ALTERNATIVE_AUD_CLAIM_NAME as re,JWT_SECRET_KEY as U,MAX_AUTH_TOKEN_COOKIE_BYTES as N,ORG_SLUG as oe,ORG_ID as te}from"../../constants/common.js";import{AUTH_SEGMENT as ne,ServerRoutes as M}from"../../../constants/api.js";import{AuthCookieNames as A,DEFAULT_COOKIE_EXPIRATION as B}from"../../../constants/common.js";import{sanitizeRedirectPathname as H}from"../../../utils/url/sanitize-redirect-pathname.js";import{telemetry as w}from"../../telemetry/index.js";import{envConfig as K}from"../../config/env-config.js";import{fetchWithClient as ie}from"../../utils/fetch-with-client.js";import{clearAuthCookies as z,clearPostLogoutCookie as v,hasPostLogoutCookie as se,setPostLogoutCookie as j}from"../../utils/cookie.js";import{getAuthProviderLoginParams as ae,isOidcProviderConfig as b,isSaml2ProviderConfig as de,oidcExchangeCodeForToken as ce,buildLoginUrl as le,decodeSamlResponse as ue,extractUserClaims as pe,parseSamlResponse as ge,parseOidcState as fe,verifySAMLResponse as me,getUsernameFromPayload as he,buildOidcLogoutUrl as Ce,isIdpIssuedToken as Ie,getOidcMetadata as J,exchangeTokenLoginCode as _e,getRedoclyTokenPayload as Ae,idTokenAudienceIsAllowed as Oe,isRedoclySso as Re,rewritePreviewAuthRedirectUri as Te,parsePreviewBranch as Le,buildOidcLoginUrl as we,createMcpSessionResource as y,signTokenWithinCookieSizeLimit as G}from"../auth.js";import*as $ from"../jwt/jwt.js";import{AlgorithmTypes as E}from"../jwt/types.js";import{handleErrorPageRender as ye}from"../utils.js";import{encodeBase64URL as ke}from"../jwt/encode.js";import{resolveUiLocalesForIdpLogin as Me}from"./helpers/resolve-ui-locales-for-idp-login.js";async function Ze(n,e){if(!e.devLogin||K.isProductionEnv)return n.newResponse(null,404,{});const{password:r,...a}=await n.req.json(),o=await $.sign({...a,name:a.username||a.email||"Unknown"},U,E.HS256);return T(n,A.AUTHORIZATION,o,{path:O()||"/",httpOnly:!0,secure:!0,sameSite:"none"}),v(n),n.newResponse(null,200,{})}function Ve(){return async n=>{const e=n.get("logger"),r=encodeURIComponent(n.req.query("message")||"");e.error(`Login error: ${r}`);const a=`${M.LOGIN}/?error=${encodeURIComponent(r)}`;return n.newResponse(null,301,{Location:a})}}function Z(n){if(!n||!n.includes(M.MCP_CALLBACK))return null;try{const e=n.split("/"),r=e[e.length-1];if(r){const a=Buffer.from(r,"base64url").toString("utf-8");return JSON.parse(a).mcpSessionId||null}}catch{}return null}function We(n){return async e=>{const r=e.get("logger"),a=n.getConfig().ssoDirect;let o;try{o=fe(e.req.query("state"))}catch{return r.warn("OIDC login error: Invalid OAuth2 state"),e.text("Bad request: Invalid OAuth2 state",400)}const I=o.idpId,i=o.source==="mcp"||o.redirectTo&&typeof o.redirectTo=="string"&&o.redirectTo.includes(M.MCP_CALLBACK),u=i?Z(typeof o.redirectTo=="string"?o.redirectTo:void 0):null,s=a?.[I];if(!b(s))return r.error("OIDC login error: missing OIDC provider config"),e.text("Forbidden",403);const g=await J(I,s);if(a&&!g.token_endpoint){const m="Invalid OIDC configuration: token_endpoint is required";return r.error(`OIDC login error: ${m}`),e.text(m,500)}try{const m=g.token_endpoint,h=e.req.query("code"),C=e.req.query("error");if(C)return i&&w.sendMcpAuthorizationFailedMessage([{...y(u),error:`OIDC error: ${C}`,error_details:e.req.query("error_description")||null}]),ye(e,n,{slug:"/"},403,"403OIDC");if(!h){const p="Code is expected but not present";return r.error(`OIDC login error: ${p}`),i&&w.sendMcpAuthorizationFailedMessage([{...y(u),error:p,error_details:null}]),new Response(`Forbidden: ${p}`,{status:403})}const k=typeof o.redirectUri=="string"?o.redirectUri:new URL(L(M.OIDC_CALLBACK),e.req.url).toString(),f=e.get("cookies")?.code_verifier,d=await ce(m,h,k,s,{...s.tokenRequestCustomParams,...f?{code_verifier:f}:{}});if(d.error)return r.error(`Error from OIDC provider: "${d.error}"`),i&&w.sendMcpAuthorizationFailedMessage([{...y(u),error:`Token exchange error: ${d.error}`,error_details:d.error_description||null}]),e.text(`Forbidden: ${d.error_description||d.error}`,403);if(!d?.id_token){const p="No id_token, please, add openid to scopes";return r.error(`OIDC login error: ${p}`),i&&w.sendMcpAuthorizationFailedMessage([{...y(u),error:p,error_details:null}]),new Response(`Forbidden: ${p}`,{status:403})}const{payload:c,header:R}=$.decode(d.id_token),t=R.alg===E.RS256;if(!Oe(c,s)){const p="No valid audience found in id_token";return r.error(`OIDC login error: ${p}`),i&&w.sendMcpAuthorizationFailedMessage([{...y(u),error:p,error_details:null}]),new Response(`Forbidden: ${p}`,{status:403})}let l=t?d.id_token:await $.sign({...c,idpId:I},U,E.HS256);if(Buffer.byteLength(l)>N){const p=await G(c,I,s.teamsClaimName,{rbacConfig:n.getConfig().access?.rbac,teamsMapping:s.teamsClaimMap});if(!p){const S=`The id_token claims are too large for the session cookie: ${Buffer.byteLength(JSON.stringify(c))} bytes of claims`;return r.error(`OIDC login error: ${S}`),i&&w.sendMcpAuthorizationFailedMessage([{...y(u),error:S,error_details:null}]),e.text(`Forbidden: ${S}`,403)}p.teamsKept<p.teamsTotal&&r.warn(`OIDC login: the "${s.teamsClaimName}" claim is too large for the session cookie size limit; kept ${p.teamsKept} of ${p.teamsTotal} values, with teams from the RBAC configuration first; RBAC ignores the dropped teams: ${JSON.stringify(p.droppedTeams)}`),l=p.token}he(c)||r.warn("To display your username, the required 'email' or 'full_profile' scope must be added to the identity provider configuration");const D=s?.tokenExpirationTime?Date.now()+s.tokenExpirationTime*1e3:c.exp*1e3||Date.now()+B*1e3;if(s.introspectEndpoint){const p=await fetch(s.introspectEndpoint,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({access_token:d.access_token})});if(p.ok){const q=(await p.json()).ext?.federatedIdentity;q&&(T(e,A.FEDERATED_ACCESS_TOKEN,q.access_token||"",{path:O()||"/",httpOnly:!1,expires:new Date(D)}),T(e,A.FEDERATED_ID_TOKEN,q.id_token||"",{path:O()||"/",httpOnly:!1,expires:new Date(D)}))}else r.warn(`OIDC introspect error: ${p.statusText}`)}if(T(e,A.AUTHORIZATION,l,{path:O()||"/",httpOnly:!0,expires:new Date(D)}),l!==d.id_token&&Buffer.byteLength(d.id_token)<=N?T(e,A.IDP_ID_TOKEN,d.id_token||"",{path:O()||"/",httpOnly:!0,expires:new Date(D)}):P(e,A.IDP_ID_TOKEN,{path:O()||"/"}),T(e,A.IDP_ACCESS_TOKEN,d.access_token||"",{path:O()||"/",httpOnly:!0,expires:new Date(D)}),d.refresh_token?T(e,A.IDP_REFRESH_TOKEN,d.refresh_token,{path:O()||"/",httpOnly:!0,expires:new Date(D)}):P(e,A.IDP_REFRESH_TOKEN,{path:O()||"/"}),P(e,"code_verifier",{path:O()||"/"}),v(e),i&&o.redirectTo&&typeof o.redirectTo=="string"&&o.redirectTo.includes(M.MCP_CALLBACK)){const S=`${e.req.url.split("?")[0].replace(M.OIDC_CALLBACK,"")}${o.redirectTo}`;return e.newResponse(null,302,{Location:S})}const V=typeof o.redirectTo=="string"?o.redirectTo:void 0,W=H(new URL(V||"/",e.req.url).pathname),X=e.newResponse(null,302,{Location:W});return r.updateContext({email:c.email,subject:c.sub}),r.info("OIDC login successful"),X}catch(m){const h=m instanceof Error?m.message:String(m),C=m instanceof Error?m.stack:String(m);if(r.error(`OIDC login error: ${h}`),i&&w.sendMcpAuthorizationFailedMessage([{...y(u),error:h,error_details:C}]),m.error==="access_denied")return r.info("Access denied"),e.text("Forbidden",403)}const _="Something went wrong";return r.error(`OIDC login error: ${_}`),i&&w.sendMcpAuthorizationFailedMessage([{...y(u),error:_,error_details:null}]),e.text(_,500)}}function Xe(n){return async e=>{const r=e.get("logger"),o=e.get("auth").claims?.idpId,i=n.getConfig().ssoDirect?.[o];if(e.req.method==="POST")return b(i)||(z(e),j(e)),r.info("Logout successful"),e.newResponse(null,200,{});let u;if(b(i)){const s=(await J(o,i)).end_session_endpoint;if(s){const g=new URL(e.req.url),_=e.req.header("x-forwarded-proto")||g.protocol.slice(0,-1)||"https",m=e.req.header("x-forwarded-host")||g.host,h=`${_}://${m}`,C=Le(h),k=C?ke(JSON.stringify({branch:C,postLogoutRedirectUri:`${h}${L(M.POST_LOGOUT)}`})):void 0,f=C?`${Te(h)}/${ne}/logout`:`${h}${L(M.POST_LOGOUT)}`,d=e.get("cookies"),c=d?.[A.AUTHORIZATION],R=d?.[A.IDP_ID_TOKEN]||(Ie(c)?c:void 0);u=Ce(s,f,R,k)}}return r.info("Logout successful"),z(e),j(e),e.newResponse(null,302,{Location:u||L("/")})}}function Ye(n){return async e=>{const r=n.getConfig().access?.logoutReturnUrl,a=r||L("/");return e.newResponse(null,302,{Location:a})}}function Qe(n){return async e=>{const r=e.get("logger"),a=e.req.param("code"),o=K.BH_API_URL,I=(i,u,s)=>i&&u?`${i} ${u.charAt(0)}`:s;try{if(!o)throw new Error("BH_API_URL is not set");const i=n.getConfig().ssoDirect;if(!i||!Object.keys(i).length)return r.warn("Invite no sso configured to handle"),e.redirect(L("/"));const u=await ie(`${o}/public-user-invites/${a}`);if(!u.ok)return u.status===404?(r.warn(`Invite ${a} not found redirect to homepage`),e.redirect(L("/"))):(r.error("Invite error",await u.text()),e.redirect(L("/")));const s=await u.json(),g=new URL(L("/invite"),e.req.url);return g.searchParams.set("code",a),g.searchParams.set("org",s.organization.name),g.searchParams.set("invitedBy",I(s.invitedBy.firstName,s.invitedBy.lastName,s.invitedBy.name)),e.newResponse(null,302,{Location:g.toString()})}catch(i){return r.error("Error processing invite",{error:i,inviteCode:a}),e.text(i.message||"Failed to process invite",400)}}}function xe(n){return async e=>{const r=e.get("logger"),a=n.getConfig().ssoDirect,o=new URL(e.req.url),I=e.req.query("inviteCode"),i=e.req.header("x-forwarded-proto")||o.protocol.slice(0,-1)||"https",u=e.req.header("x-forwarded-host")||o.host,s=`${i}://${u}`;let g=o.searchParams.get("idpId");const _=o.searchParams.get("redirectTo"),m=Object.keys(a||{})[0];g=g||m;const h=o.searchParams.get("mcp_redirect_uri"),C=!!h;if(!a?.[g]){const l="Invalid idpId";if(r.error(`IdP login error: ${l}`),C){const F=Z(_||void 0);w.sendMcpAuthorizationFailedMessage([{...y(F),error:l,error_details:null}])}return e.text(`Forbidden: ${l}`,403)}const f=Me({localePrefixParam:o.searchParams.get("localePrefix"),l10n:n.getGlobalData()?.l10n}),d=g&&a?await ae(g,a[g]):void 0,c={};for(const l of Object.keys(d?.extraParams||{}))c[l]=o.searchParams.get(l)||d?.extraParams?.[l]||void 0;se(e)&&(c.prompt="login",c.post_logout="1");let R,t={};if(C&&h&&d&&d.type===Y.OIDC){r.info(`Building MCP OAuth login URL with redirect_uri: ${h}`);const l=we("",{...d,extraParams:c},_,I,{redirectUriOverride:h,sourceOverride:"mcp",branchOverride:void 0,uiLocales:f});R=l.loginUrl,t=l.cookies||{}}else if(d){const l=le({...d,extraParams:c},s,_,I,f);R=l.loginUrl,t=l.cookies||{}}return Object.keys(t).forEach(l=>{T(e,l,t[l].value,t[l].options)}),r.info(`IdP login initiated for ID '${g}'`),e.newResponse(null,302,{Location:R||new URL(e.req.url).pathname})}}function er(n){return async e=>{const r=e.get("logger"),a=await e.req.formData(),o=a.get("SAMLResponse"),I=a.get("RelayState");if(typeof o!="string"||typeof I!="string"){const t="SAMLResponse is required";return r.error(`SAML2 login error: ${t}`),e.text(`Bad request: ${t}`,400)}const i=ue(o),{success:u,uid:s,nameFormat:g,attrs:_,issuerId:m,expiresAt:h}=ge(i),{idpId:C,redirectTo:k}=JSON.parse(I);if(!u){const t="SAML2 assertion is not successful";return r.error(`SAML2 login error: ${t}`),e.text(`Permission denied: ${t}`,401)}if(!h||Math.ceil(Date.now()/1e3)>=h){const t="SAML2 Token Expired";return r.error(`SAML2 login error: ${t}`),e.text(t,401)}const f=n.getConfig().ssoDirect?.[C];if(!f||!de(f)){const t="Cannot find valid IdP";return r.error(`SAML2 login error: ${t}`),e.text(`Permission denied: ${t}`,401)}if(!(f.issuerId&&m&&x(f.issuerId,m))){const t="IssuerID is misconfigured or untrusted assertions issuer received";return r.error(`SAML2 login error: ${t}`),e.text(`Permission denied: ${t}`,401)}if(!await me(i,f.x509PublicCert)){const t="SAMLResponse signature invalid";return r.error(`SAML2 login error: ${t}`),e.text(t,401)}const c=pe(s,g,_,f.teamsAttributeName??Q);if(!c.sub){const t="The provider did not return a valid user identity.";return r.error(`SAML2 login error: ${t}`),e.text(t,400)}if(!c.email){const t="The provider did not return a valid user email.";return r.error(`SAML2 login error: ${t}`),e.text(t,400)}let R=await $.sign({...c,idpId:C},U,E.HS256);if(Buffer.byteLength(R)>N){const t=await G({...c},C,"teams",{rbacConfig:n.getConfig().access?.rbac,teamsMapping:f.teamsAttributeMap});if(!t){const l=`The SAML2 claims are too large for the session cookie: ${Buffer.byteLength(JSON.stringify(c))} bytes of claims`;return r.error(`SAML2 login error: ${l}`),e.text(`Forbidden: ${l}`,403)}t.teamsKept<t.teamsTotal&&r.warn(`SAML2 login: the "teams" claim is too large for the session cookie size limit; kept ${t.teamsKept} of ${t.teamsTotal} values, with teams from the RBAC configuration first; RBAC ignores the dropped teams: ${JSON.stringify(t.droppedTeams)}`),R=t.token}return T(e,A.AUTHORIZATION,R,{path:O()||"/",httpOnly:!0,expires:new Date(h*1e3)}),P(e,A.IDP_REFRESH_TOKEN,{path:O()||"/"}),v(e),r.updateContext({email:c.email,subject:c.sub}),r.info("SAML2 login successful"),e.newResponse(null,302,{Location:k||"/"})}}function rr(n){return async e=>{const r=e.get("logger"),a=new URL(e.req.query("redirectTo")||"/",e.req.url),o=L(H(a.pathname)),I=n.getConfig().ssoDirect,i=Object.entries(I||{}).find(([,f])=>b(f)&&Re(f));if(!(I&&i))return e.newResponse(null,302,{Location:o});const s=e.req.query("code"),g=s?await _e(s):e.req.query("token"),_=g&&await Ae(g);if(!_)return e.newResponse(null,302,{Location:o});if(!ee(_[re]||[]).some(f=>f===oe||f===te))return e.newResponse(null,302,{Location:o});const C=await $.sign({..._,idpId:i?.at(0)},U,E.HS256),k=Date.now()+B*1e3;return T(e,A.AUTHORIZATION,C,{path:O()||"/",httpOnly:!0,expires:new Date(k),sameSite:"None",secure:!0,partitioned:!0}),P(e,A.IDP_REFRESH_TOKEN,{path:O()||"/"}),v(e),r.info("Token login successful"),e.newResponse(null,302,{Location:o})}}export{Ze as authorizeHandler,xe as idpLoginHandler,Qe as inviteHandler,Xe as logoutHandler,We as oidcCallbackHandler,Ye as postLogoutHandler,Ve as redoclyLoginCallbackHandler,rr as redoclyTokenLoginHandler,er as samlCallbackHandler};

package/dist/server/web-server/routes/dynamic-route.js

@@ -1 +1 @@
-import m from"path";import{realpath as N}from"fs/promises";import{REDOCLY_ROUTE_RBAC as Y,REDOCLY_TEAMS_RBAC as z}from"@redocly/config";import{combineUrls as $,withoutPathPrefix as ne,withPathPrefix as T}from"@redocly/theme/core/utils";import{CACHE_CONTROL_NO_STORE_HEADER_VALUE as k,CACHE_CONTROL_PUBLIC_HTML as oe,DEFAULT_IMMUTABLE_CACHE_MAX_AGE as re,STATIC_DATA_FOLDER as ie,X_REDOCLY_CACHE_CONTROL_HEADER as ae,X_REDOCLY_CACHE_CONTROL_PUBLIC_HTML as se}from"../../constants/common.js";import{removeTrailingSlash as ce}from"../../../utils/url/remove-trailing-slash.js";import{findInIterable as le}from"../../../utils/collection/find-in-iterable.js";import{sanitizeRedirectPathname as me}from"../../../utils/url/sanitize-redirect-pathname.js";import{envConfig as ue}from"../../config/env-config.js";import{sanitizePath as de}from"../../../utils/path/sanitize-path.js";import{normalizeRouteSlug as fe}from"../../../utils/path/normalize-route-slug.js";import{isPathInFolder as G}from"../../../utils/path/is-path-in-folder.js";import{getLlmsTxtMdPathBySlug as ge}from"../../utils/llmstxt/get-llms-txt-md-path-by-slug.js";import{resolveLlmsTxtMd as j}from"../../utils/llmstxt/resolve-llms-txt-md.js";import{removeLeadingSlash as pe}from"../../../utils/url/remove-leading-slash.js";import{AI_INDEX_EXPORT_FOLDER as he,SEARCH_DATA_EXPORT_FOLDER as Re}from"../../constants/plugins/search.js";import{processRedirects as Ce}from"./helpers/process-redirects.js";import{renderPage as Ae,getServerProps as Ee}from"../../ssr/index.js";import{canAccessAsset as Le,canAccessResource as V}from"../../utils/rbac.js";import{handleErrorPageRender as w,handleUnauthorized as W,handleUnauthorizedAsset as Z}from"../utils.js";import{DEFAULT_MAX_AGE_FOR_MIME_TYPE as _e,MIME_TYPES as Te}from"../mime-types.js";import{fileExistsAsync as we}from"../../utils/index.js";import{isAiAgentRequest as Oe}from"../../utils/ai-agent-detection.js";import{getRedirectRoute as Pe}from"../utils/legacy-openapi-redirects.js";import{getContentTypeHeaderValue as x}from"../utils/content-type.js";import{telemetry as ye}from"../../../cli/telemetry/index.js";import{telemetry as Ue}from"../../telemetry/index.js";const Me=[Re,he,ie];async function be(e,p){if(m.extname(e)===".md")return!1;try{const[h,u]=await Promise.all([N(e),N(p)]);return Me.some(t=>G(h,m.join(u,t)))}catch{return!1}}function at(e,p,h,u){return async t=>{const O=t.get("logger"),r=t.req,c=new URL(r.url),i=ne(de(decodeURIComponent(c.pathname))),P=m.parse(i).ext===".md",y=Oe({accept:r.header("accept"),signatureAgent:r.header("signature-agent"),signature:r.header("signature"),signatureInput:r.header("signature-input"),userAgent:r.header("user-agent")}),a=fe(i),o=(r.method==="GET"||r.method==="HEAD")&&!P?e.getRouteBySlug(a,{followRedirect:!1})||le(e.routesBySlug?.values(),n=>n.hasClientRoutes&&(i===n.slug||i.startsWith(n.slug+"/"))):void 0,U=e.getRedirect(a);if(U){const n=Ce({redirect:U,reqUrlSearch:c.search});return Ue.sendRedirectMessage([{id:a,object:"redirect",uri:`urn:redocly:realm:api:redirect:${a}`,from:a,templateId:n.type.toString()}]),t.newResponse(null,n.type,{Location:n.location})}const R=ue.isProductionEnv?301:302;if(o?.metadata?.type==="openapi"){const n=Pe(c.pathname);if(n)return O.info("Legacy OpenAPI docs redirect from "+c.pathname),t.newResponse(null,R,{Location:encodeURI(n)});if(c.pathname.match(/[A-Z]/))return O.warn("Redirect to lowercase route to avoid 404 error"),t.newResponse(null,R,{Location:encodeURI(c.pathname.toLowerCase())})}if(i.endsWith("/")&&i!=="/"){const n=me(new URL(a||"/",t.req.url).pathname);return t.newResponse(null,R,{Location:encodeURI(T((n==="/"?"/":ce(n))+c.search))})}const{isAuthenticated:d,teams:C,claims:{email:A}}=t.get("auth");if(o&&!V(o,{isAuthenticated:d,email:A,teams:C},e.config.access?.rbac,e.config.access?.requiresLogin))return d?w(t,e,{slug:o.slug,[z]:o[z],[Y]:o[Y]},403):W(t,e,o.slug);const f=o&&y?ge(o.slug):void 0,M=f?await j(f,e,u):void 0,b=M?.exists??!1;if(o&&(!y||!b)){const n=await p(o),K=await Ee(o,t,n,e),{html:Q,statusCode:q,error:ee}=await Ae(o,K,t,e,ye),v=e.config.access?.rbac,B=!e.config.access?.requiresLogin&&(!v||!Object.keys(v).length),X=q>=400||!!ee||!!e.compilationErrors?.length,te=B&&!X;let g;return X?g=k:B?g=oe:g="private",t.html(Q,q,{"Cache-Control":g,...te&&{[ae]:se}})}const E=f&&b?f:i,J=pe(E),s=m.resolve(e.outdir,J);if(!G(s,e.outdir))return Z(t);if(await be(s,e.outdir))return w(t,e,{slug:a},404);let l,D;if(P){const n=await j(i,e,u);if(l=n.route,D=n.content,l&&!V(l,{isAuthenticated:d,email:A,teams:C},e.config.access?.rbac,e.config.access?.requiresLogin))return W(t,e,i)}const I=e.getGlobalConfig("access");if(!Le(E,I?.rbac||{},I?.requiresLogin||!1,e.getGlobalConfig("directoryPaths"),{isAuthenticated:d,email:A,teams:C}))return Z(t);const L=Te[m.extname(s)]||"text/plain",_=s.match(/assets\/.*\.[a-f0-9]{8,}\..+/)||s.match(/runtime\/chunks\/.*/)?re:_e[L],S=_?{"Cache-Control":`public, max-age=${_}, immutable`,Expires:new Date(Date.now()+_*1e3).toUTCString()}:{"Cache-Control":k},F=r.query("download")!=null,H=M?.content??D;if(H!==void 0)return t.newResponse(H,200,{"Content-Type":x(L),"Access-Control-Allow-Origin":"*",...S,...l&&{"X-Robots-Tag":"noindex, follow",...e.config.seo?.siteUrl&&{Link:`<${$(e.config.seo.siteUrl,T(l.slug))}>; rel="canonical"`}},...F&&{"Content-Disposition":`attachment; filename="${m.basename(E)}"`}});if(await we(s)){const n=await h(s);return t.newResponse(n,200,{"Content-Type":x(L),"Access-Control-Allow-Origin":"*",...S,...l&&{"X-Robots-Tag":"noindex, follow",...e.config.seo?.siteUrl&&{Link:`<${$(e.config.seo.siteUrl,T(l.slug))}>; rel="canonical"`}},...F&&{"Content-Disposition":`attachment; filename="${m.basename(s)}"`}})}else return w(t,e,{slug:a},404)}}export{at as dynamicRouteHandler};
+import m from"path";import{realpath as G}from"fs/promises";import{REDOCLY_ROUTE_RBAC as z,REDOCLY_TEAMS_RBAC as j}from"@redocly/config";import{combineUrls as V,withoutPathPrefix as ie,withPathPrefix as R}from"@redocly/theme/core/utils";import{CACHE_CONTROL_NO_STORE_HEADER_VALUE as W,CACHE_CONTROL_PUBLIC_HTML as ae,DEFAULT_IMMUTABLE_CACHE_MAX_AGE as se,DEPRECATED_PUBLIC_API_DEFINITIONS_FOLDER as ce,PAGE_DATA_FOLDER as le,PUBLIC_API_DEFINITIONS_FOLDER as me,PUBLIC_ASSETS_FOLDER as ue,STATIC_DATA_FOLDER as de,X_REDOCLY_CACHE_CONTROL_HEADER as fe,X_REDOCLY_CACHE_CONTROL_PUBLIC_HTML as ge}from"../../constants/common.js";import{removeTrailingSlash as Z}from"../../../utils/url/remove-trailing-slash.js";import{findInIterable as pe}from"../../../utils/collection/find-in-iterable.js";import{sanitizeRedirectPathname as he}from"../../../utils/url/sanitize-redirect-pathname.js";import{envConfig as Re}from"../../config/env-config.js";import{addLeadingSlash as Ae}from"../../../utils/url/add-leading-slash.js";import{isPathInFolder as D}from"../../../utils/path/is-path-in-folder.js";import{getLlmsTxtMdPathBySlug as Ee}from"../../utils/llmstxt/get-llms-txt-md-path-by-slug.js";import{resolveLlmsTxtMd as J}from"../../utils/llmstxt/resolve-llms-txt-md.js";import{removeLeadingSlash as I}from"../../../utils/url/remove-leading-slash.js";import{decodeRequestPath as Ce}from"../../utils/decode-request-path.js";import{AI_INDEX_EXPORT_FOLDER as _e,SEARCH_DATA_EXPORT_FOLDER as Le}from"../../constants/plugins/search.js";import{processRedirects as Te}from"./helpers/process-redirects.js";import{renderPage as Pe,getServerProps as Oe}from"../../ssr/index.js";import{canAccessAsset as we,canAccessResource as K}from"../../utils/rbac.js";import{handleErrorPageRender as A,handleUnauthorized as Q,handleUnauthorizedAsset as x}from"../utils.js";import{DEFAULT_MAX_AGE_FOR_MIME_TYPE as De,MIME_TYPES as Ie}from"../mime-types.js";import{fileExistsAsync as Se}from"../../utils/index.js";import{isAiAgentRequest as ye}from"../../utils/ai-agent-detection.js";import{getRedirectRoute as Ue}from"../utils/legacy-openapi-redirects.js";import{getContentTypeHeaderValue as ee}from"../utils/content-type.js";import{telemetry as be}from"../../../cli/telemetry/index.js";import{telemetry as Me}from"../../telemetry/index.js";const Fe=[Le,_e,de,I(me),I(ce),le];async function qe(e,E){try{const[C,u]=await Promise.all([G(e),G(E)]);return Fe.some(t=>D(C,m.join(u,t)))}catch{return!1}}function mt(e,E,C,u){return async t=>{const S=t.get("logger"),i=t.req,c=new URL(i.url),_=c.pathname.replace(/\/{2,}/g,"/"),y=Ce(_);if(y===void 0)return t.text("Bad Request",400);const d=Re.isProductionEnv?301:302;if(_!==c.pathname)return t.newResponse(null,d,{Location:_+c.search});const r=ie(y),U=m.parse(r).ext.toLowerCase()===".md",b=ye({accept:i.header("accept"),signatureAgent:i.header("signature-agent"),signature:i.header("signature"),signatureInput:i.header("signature-input"),userAgent:i.header("user-agent")}),a=Ae(Z(r)),o=(i.method==="GET"||i.method==="HEAD")&&!U?e.getRouteBySlug(a,{followRedirect:!1})||pe(e.routesBySlug?.values(),n=>n.hasClientRoutes&&(r===n.slug||r.startsWith(n.slug+"/"))):void 0,M=e.getRedirect(a);if(M){const n=Te({redirect:M,reqUrlSearch:c.search});return Me.sendRedirectMessage([{id:a,object:"redirect",uri:`urn:redocly:realm:api:redirect:${a}`,from:a,templateId:n.type.toString()}]),t.newResponse(null,n.type,{Location:n.location})}if(o?.metadata?.type==="openapi"){const n=Ue(c.pathname);if(n)return S.info("Legacy OpenAPI docs redirect from "+c.pathname),t.newResponse(null,d,{Location:encodeURI(n)});if(r.match(/[A-Z]/))return S.warn("Redirect to lowercase route to avoid 404 error"),t.newResponse(null,d,{Location:encodeURI(R(r.toLowerCase()))})}if(r.endsWith("/")&&r!=="/"){const n=he(new URL(a||"/",t.req.url).pathname);return t.newResponse(null,d,{Location:R((n==="/"?"/":Z(n))+c.search)})}const{isAuthenticated:f,teams:L,claims:{email:T}}=t.get("auth");if(o&&!K(o,{isAuthenticated:f,email:T,teams:L},e.config.access?.rbac,e.config.access?.requiresLogin))return f?A(t,e,{slug:o.slug,[j]:o[j],[z]:o[z]},403):Q(t,e,o.slug);const g=o&&b?Ee(o.slug):void 0,F=g?await J(g,e,u):void 0,P=F?.exists??!1;if(o&&(!b||!P)){const n=await E(o),N=await Oe(o,t,n,e),{html:ne,statusCode:X,error:oe}=await Pe(o,N,t,e,be),Y=e.config.access?.rbac,$=!e.config.access?.requiresLogin&&(!Y||!Object.keys(Y).length),k=X>=400||!!oe||!!e.compilationErrors?.length,re=$&&!k;let h;return k?h=W:$?h=ae:h="private",t.html(ne,X,{"Cache-Control":h,...re&&{[fe]:ge}})}const p=g&&P?g:r,te=I(p),s=m.resolve(e.outdir,te);if(!D(s,e.outdir))return x(t);const q=U?await J(r,e,u):void 0,l=q?.route;if(l&&!K(l,{isAuthenticated:f,email:T,teams:L},e.config.access?.rbac,e.config.access?.requiresLogin))return Q(t,e,r);if(!P&&!l){if(await qe(s,e.outdir))return A(t,e,{slug:a},404);const n=e.getGlobalConfig("access");if(!we(p,n?.rbac||{},n?.requiresLogin||!1,e.getGlobalConfig("directoryPaths"),{isAuthenticated:f,email:T,teams:L}))return D(p,ue)?x(t):A(t,e,{slug:a},404)}const O=Ie[m.extname(s)]||"text/plain",w=s.match(/assets\/.*\.[a-f0-9]{8,}\..+/)||s.match(/runtime\/chunks\/.*/)?se:De[O],H=w?{"Cache-Control":`public, max-age=${w}, immutable`,Expires:new Date(Date.now()+w*1e3).toUTCString()}:{"Cache-Control":W},B=i.query("download")!=null,v=F?.content??q?.content;if(v!==void 0)return t.newResponse(v,200,{"Content-Type":ee(O),"Access-Control-Allow-Origin":"*",...H,...l&&{"X-Robots-Tag":"noindex, follow",...e.config.seo?.siteUrl&&{Link:`<${V(e.config.seo.siteUrl,R(l.slug))}>; rel="canonical"`}},...B&&{"Content-Disposition":`attachment; filename="${m.basename(p)}"`}});if(await Se(s)){const n=await C(s);return t.newResponse(n,200,{"Content-Type":ee(O),"Access-Control-Allow-Origin":"*",...H,...l&&{"X-Robots-Tag":"noindex, follow",...e.config.seo?.siteUrl&&{Link:`<${V(e.config.seo.siteUrl,R(l.slug))}>; rel="canonical"`}},...B&&{"Content-Disposition":`attachment; filename="${m.basename(s)}"`}})}else return A(t,e,{slug:a},404)}}export{mt as dynamicRouteHandler};

package/dist/server/web-server/routes/error.js

@@ -1 +1 @@
-import{context as s,SpanStatusCode as n,trace as a}from"@opentelemetry/api";import{HTTPException as o}from"hono/http-exception";import{envConfig as i}from"../../config/env-config.js";const u=t=>{const e=a?.getSpan(s.active());return t instanceof Error&&"name"in t&&t.name==="URIError"?(e&&(e.setStatus({code:n.OK}),e.end()),new Response("Malformed URL",{status:400})):t instanceof SyntaxError?(e&&(e.setStatus({code:n.OK}),e.end()),new Response("Invalid JSON",{status:400})):t instanceof o&&t.status<500?(e&&(e.setStatus({code:n.OK}),e.end()),t.getResponse()):(e&&(e.setStatus({code:n.ERROR,message:t.message}),e.recordException(t),e.end()),i.isDevelopMode&&t?.name==="PageMissingDefaultExportError"?new Response(t.message,{status:200}):new Response("Internal Server Error",{status:500}))};export{u as errorHandler};
+import{context as s,SpanStatusCode as n,trace as o}from"@opentelemetry/api";import{HTTPException as a}from"hono/http-exception";import{envConfig as i}from"../../config/env-config.js";import{logger as r}from"../../tools/notifiers/logger.js";import{OidcDiscoveryError as f}from"../../utils/errors.js";const g=e=>{const t=o?.getSpan(s.active());return e instanceof Error&&"name"in e&&e.name==="URIError"?(t&&(t.setStatus({code:n.OK}),t.end()),new Response("Malformed URL",{status:400})):e instanceof SyntaxError?(t&&(t.setStatus({code:n.OK}),t.end()),new Response("Invalid JSON",{status:400})):e instanceof a&&e.status<500?(t&&(t.setStatus({code:n.OK}),t.end()),e.getResponse()):(t&&(t.setStatus({code:n.ERROR,message:e.message}),t.recordException(e),t.end()),e instanceof f?(r.error(e.message),new Response("Bad gateway: the identity provider returned an invalid response",{status:502})):i.isDevelopMode&&e?.name==="PageMissingDefaultExportError"?new Response(e.message,{status:200}):new Response("Internal Server Error",{status:500}))};export{g as errorHandler};

package/dist/server/web-server/routes/helpers/process-redirects.js

@@ -1 +1 @@
-import{removeTrailingSlash as n}from"../../../../utils/url/remove-trailing-slash.js";import{isLocalLink as r}from"../../../../utils/path/is-local-link.js";import{withPathPrefix as m}from"@redocly/theme/core/utils";function s({redirect:o,reqUrlSearch:t=""}){const i=r(o.to)?m(o.to):o.to;return{location:encodeURI(n(i)+t),type:o?.type||301}}export{s as processRedirects};
+import{removeTrailingSlash as i}from"../../../../utils/url/remove-trailing-slash.js";import{isLocalLink as e}from"../../../../utils/path/is-local-link.js";import{withPathPrefix as r}from"@redocly/theme/core/utils";function m({redirect:o,reqUrlSearch:t=""}){const n=e(o.to)?r(o.to):o.to;return{location:a(i(n))+t,type:o?.type||301}}function a(o){return encodeURI(o).replace(/%25([0-9A-Fa-f]{2})/g,"%$1")}export{m as processRedirects};

package/dist/server/web-server/routes/mcp-routes/mcp-consent-page.d.ts

@@ -15,10 +15,10 @@ export type ConsentPageProps = {
     clientIdHost: string | undefined;
     redirectUrl: URL;
     scopes: readonly string[];
-    accessLifetimeHours: number;
+    accessLifetimeDays: number;
     rememberDays: number | undefined;
     consentToken: string;
 };
-export declare function consentPage({ site, user, clientName, clientIdHost, redirectUrl, scopes, accessLifetimeHours, rememberDays, consentToken, }: ConsentPageProps): string;
+export declare function consentPage({ site, user, clientName, clientIdHost, redirectUrl, scopes, accessLifetimeDays, rememberDays, consentToken, }: ConsentPageProps): string;
 export declare function consentInvalidPage(site: PageSite): string;
 //# sourceMappingURL=mcp-consent-page.d.ts.map

package/dist/server/web-server/routes/mcp-routes/mcp-consent-page.js

@@ -1,35 +1,35 @@
-import{ICONS as d,code as E,escapeHtml as a,htmlDocument as p,siteHeader as N}from"../../../plugins/mcp/handlers/credentials-page/layout.js";import{statusPage as L}from"../../../plugins/mcp/handlers/credentials-page/outcome-pages.js";const $=300,e={TITLE:"Allow MCP access",INTRO:"An MCP client asks to use this portal with your account.",WARNING:"Allow access only if you started this connection in your MCP client.",REDIRECT_LABEL:"Sends access to",REDIRECT_HINT:"The app receives access at this address.",USER_LABEL:"Signed in as",NOT_PROVIDED:"Not provided",CLIENT_LABEL:"App",CLIENT_UNKNOWN:"The app did not send a name. Continue only if you just started a connection yourself.",CLIENT_NAME_HINT:"The app chose this name itself. We do not check it.",CLIENT_ID_HOST:s=>`App details loaded from ${E(s)}`,PANEL_TITLE:"What the client gets",ACCOUNT_DETAILS:"Your account details, including your name and email address",ACT_AS_YOU:"Use of the MCP server of this portal as you",ACCESS_LIFETIME:s=>`Access that it can renew for up to ${s} hours`,REMEMBER:s=>`If you allow access, we do not ask again for this client for ${s} days.`,SCOPES_LABEL:"Scopes:",ALLOW:"Allow access",DENY:"Deny",INVALID_TITLE:"This request is no longer valid",INVALID_BODY:s=>`An access request works for ${s} minutes. This one has expired or can no longer be used.`,INVALID_NEXT:"Go back to your MCP client and start the connection again."},f={"Content-Type":"text/html; charset=utf-8","Cache-Control":"no-store","X-Frame-Options":"DENY","Referrer-Policy":"no-referrer","Content-Security-Policy":"default-src 'none'; style-src 'unsafe-inline'; img-src 'self'; frame-ancestors 'none'; base-uri 'none'"};function _({protocol:s,host:n,pathname:t,search:o}){return`${s}${n?`//${n}`:""}${t}${o}`}function r(s,n,t){return`<section aria-labelledby="${s}">
-<h2 id="${s}">${a(n)}</h2>
+import{ICONS as d,code as E,escapeHtml as a,htmlDocument as p,siteHeader as N}from"../../../plugins/mcp/handlers/credentials-page/layout.js";import{statusPage as L}from"../../../plugins/mcp/handlers/credentials-page/outcome-pages.js";const $=300,s={TITLE:"Allow MCP access",INTRO:"An MCP client asks to use this portal with your account.",WARNING:"Allow access only if you started this connection in your MCP client.",REDIRECT_LABEL:"Sends access to",REDIRECT_HINT:"The app receives access at this address.",USER_LABEL:"Signed in as",NOT_PROVIDED:"Not provided",CLIENT_LABEL:"App",CLIENT_UNKNOWN:"The app did not send a name. Continue only if you just started a connection yourself.",CLIENT_NAME_HINT:"The app chose this name itself. We do not check it.",CLIENT_ID_HOST:e=>`App details loaded from ${E(e)}`,PANEL_TITLE:"What the client gets",ACCOUNT_DETAILS:"Your account details, including your name and email address",ACT_AS_YOU:"Use of the MCP server of this portal as you",ACCESS_LIFETIME:e=>`Access that it can renew for up to ${e===1?"1 day":`${e} days`}`,REMEMBER:e=>`If you allow access, we do not ask again for this client for ${e} days.`,SCOPES_LABEL:"Scopes:",ALLOW:"Allow access",DENY:"Deny",INVALID_TITLE:"This request is no longer valid",INVALID_BODY:e=>`An access request works for ${e} minutes. This one has expired or can no longer be used.`,INVALID_NEXT:"Go back to your MCP client and start the connection again."},h={"Content-Type":"text/html; charset=utf-8","Cache-Control":"no-store","X-Frame-Options":"DENY","Referrer-Policy":"no-referrer","Content-Security-Policy":"default-src 'none'; style-src 'unsafe-inline'; img-src 'self'; frame-ancestors 'none'; base-uri 'none'"};function _({protocol:e,host:n,pathname:t,search:o}){return`${e}${n?`//${n}`:""}${t}${o}`}function r(e,n,t){return`<section aria-labelledby="${e}">
+<h2 id="${e}">${a(n)}</h2>
 ${t.filter(Boolean).join(`
 `)}
-</section>`}function m(s,n){return r("consent-client",e.CLIENT_LABEL,[s?`<p>${a(s)}</p><p class="muted small">${e.CLIENT_NAME_HINT}</p>`:`<p>${e.CLIENT_UNKNOWN}</p>`,n?`<p class="muted small">${e.CLIENT_ID_HOST(n)}</p>`:""])}function A({scopes:s,accessLifetimeHours:n,rememberDays:t}){const o=`${d.shield}${e.PANEL_TITLE}`,i=`<ol class="steps">
-<li>${e.ACCOUNT_DETAILS}</li>
-<li>${e.ACT_AS_YOU}</li>
-<li>${e.ACCESS_LIFETIME(n)}</li>
-</ol>`,c=t?`<p>${e.REMEMBER(t)}</p>`:"";return`<aside class="panel" aria-labelledby="panel-title">
+</section>`}function m(e,n){return r("consent-client",s.CLIENT_LABEL,[e?`<p>${a(e)}</p><p class="muted small">${s.CLIENT_NAME_HINT}</p>`:`<p>${s.CLIENT_UNKNOWN}</p>`,n?`<p class="muted small">${s.CLIENT_ID_HOST(n)}</p>`:""])}function A({scopes:e,accessLifetimeDays:n,rememberDays:t}){const o=`${d.shield}${s.PANEL_TITLE}`,i=`<ol class="steps">
+<li>${s.ACCOUNT_DETAILS}</li>
+<li>${s.ACT_AS_YOU}</li>
+<li>${s.ACCESS_LIFETIME(n)}</li>
+</ol>`,c=t?`<p>${s.REMEMBER(t)}</p>`:"";return`<aside class="panel" aria-labelledby="panel-title">
 <div class="panel-steps"><h2 id="panel-title">${o}</h2>${i}</div>
 <details class="panel-steps-toggle"><summary><h2>${o}</h2></summary>${i}</details>
 <div class="link-facts">
 ${c}
-<div class="tags"><span>${e.SCOPES_LABEL}</span>${s.map(l=>`<span class="tag">${a(l)}</span>`).join("")}</div>
+<div class="tags"><span>${s.SCOPES_LABEL}</span>${e.map(l=>`<span class="tag">${a(l)}</span>`).join("")}</div>
 </div>
-</aside>`}function S({site:s,user:n,clientName:t,clientIdHost:o,redirectUrl:i,scopes:c,accessLifetimeHours:l,rememberDays:T,consentToken:u}){const I=`<div class="page">
+</aside>`}function S({site:e,user:n,clientName:t,clientIdHost:o,redirectUrl:i,scopes:c,accessLifetimeDays:l,rememberDays:T,consentToken:u}){const I=`<div class="page">
 <main class="card">
-${N(s)}
-<h1>${e.TITLE}</h1>
-<p class="lede">${e.INTRO}</p>
-<div class="banner warning" role="note">${d.warning}<p>${e.WARNING}</p></div>
+${N(e)}
+<h1>${s.TITLE}</h1>
+<p class="lede">${s.INTRO}</p>
+<div class="banner warning" role="note">${d.warning}<p>${s.WARNING}</p></div>
 <div class="info-card">
 ${m(t,o)}
-${r("consent-user",e.USER_LABEL,[`<p>${a(n||e.NOT_PROVIDED)}</p>`])}
-${r("consent-redirect",e.REDIRECT_LABEL,[`<p>${E(_(i))}</p>`,`<p class="muted small">${e.REDIRECT_HINT}</p>`])}
+${r("consent-user",s.USER_LABEL,[`<p>${a(n||s.NOT_PROVIDED)}</p>`])}
+${r("consent-redirect",s.REDIRECT_LABEL,[`<p>${E(_(i))}</p>`,`<p class="muted small">${s.REDIRECT_HINT}</p>`])}
 </div>
 <form class="credentials" method="post" autocomplete="off">
 <input type="hidden" name="consent" value="${a(u)}">
 <div class="actions">
-<div class="actions-row"><button class="secondary" type="submit" name="decision" value="deny">${e.DENY}</button><button class="primary" type="submit" name="decision" value="allow">${e.ALLOW}</button></div>
+<div class="actions-row"><button class="secondary" type="submit" name="decision" value="deny">${s.DENY}</button><button class="primary" type="submit" name="decision" value="allow">${s.ALLOW}</button></div>
 </div>
 </form>
 </main>
-${A({scopes:c,accessLifetimeHours:l,rememberDays:T})}
-</div>`;return p({title:e.TITLE,body:I},s.colorScheme)}function y(s){return p(L("warning",e.INVALID_TITLE,[e.INVALID_BODY($/60),e.INVALID_NEXT]),s.colorScheme)}export{f as CONSENT_PAGE_HEADERS,$ as MCP_CONSENT_TTL_SEC,y as consentInvalidPage,S as consentPage};
+${A({scopes:c,accessLifetimeDays:l,rememberDays:T})}
+</div>`;return p({title:s.TITLE,body:I},e.colorScheme)}function y(e){return p(L("warning",s.INVALID_TITLE,[s.INVALID_BODY($/60),s.INVALID_NEXT]),e.colorScheme)}export{h as CONSENT_PAGE_HEADERS,$ as MCP_CONSENT_TTL_SEC,y as consentInvalidPage,S as consentPage};