@researchdatabox/redbox-core 0.0.0-bootstrap.0

package/dist/policies/companionAttachmentUploadAuth.js

@@ -0,0 +1,221 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.companionAttachmentUploadAuth = companionAttachmentUploadAuth;
+const crypto = __importStar(require("node:crypto"));
+const node_net_1 = require("node:net");
+const COMPANION_SECRET_HEADER_DEFAULT = 'x-companion-secret';
+const COMPANION_BYPASS_FLAG = 'companionAttachmentUploadAuthorized';
+function isLoopbackAddress(rawAddress) {
+    if (typeof rawAddress !== 'string' || rawAddress.trim().length === 0) {
+        return false;
+    }
+    const withoutZone = rawAddress.trim().split('%')[0];
+    const normalized = withoutZone.toLowerCase();
+    if (normalized === '::1' || normalized === '0:0:0:0:0:0:0:1') {
+        return true;
+    }
+    const v4Mapped = normalized.startsWith('::ffff:') ? normalized.slice(7) : normalized;
+    return v4Mapped === '127.0.0.1' || v4Mapped.startsWith('127.');
+}
+function normalizeAddress(rawAddress) {
+    if (typeof rawAddress !== 'string') {
+        return undefined;
+    }
+    let value = rawAddress.trim();
+    if (!value || value === 'unknown' || value === '_hidden') {
+        return undefined;
+    }
+    if ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'"))) {
+        value = value.slice(1, -1).trim();
+    }
+    if (value.startsWith('[') && value.includes(']')) {
+        value = value.slice(1, value.indexOf(']'));
+    }
+    else if (/^\d{1,3}(?:\.\d{1,3}){3}:\d+$/.test(value)) {
+        // IPv4 with port, e.g. 127.0.0.1:12345
+        value = value.slice(0, value.lastIndexOf(':'));
+    }
+    const normalized = value.toLowerCase().split('%')[0].trim();
+    return normalized || undefined;
+}
+function isPrivateOrLoopbackAddress(rawAddress) {
+    const normalized = normalizeAddress(rawAddress);
+    if (!normalized) {
+        return false;
+    }
+    if (isLoopbackAddress(normalized)) {
+        return true;
+    }
+    const v4 = normalized.startsWith('::ffff:') ? normalized.slice(7) : normalized;
+    if ((0, node_net_1.isIP)(v4) === 4) {
+        if (v4.startsWith('10.') || v4.startsWith('192.168.') || v4.startsWith('169.254.')) {
+            return true;
+        }
+        if (/^172\.(1[6-9]|2\d|3[0-1])\./.test(v4)) {
+            return true;
+        }
+        return false;
+    }
+    if ((0, node_net_1.isIP)(normalized) === 6) {
+        return normalized.startsWith('fc')
+            || normalized.startsWith('fd')
+            || normalized.startsWith('fe8')
+            || normalized.startsWith('fe9')
+            || normalized.startsWith('fea')
+            || normalized.startsWith('feb');
+    }
+    return false;
+}
+function isIpLikeAddress(rawAddress) {
+    const normalized = normalizeAddress(rawAddress);
+    if (!normalized) {
+        return false;
+    }
+    if (isLoopbackAddress(normalized)) {
+        return true;
+    }
+    const v4 = normalized.startsWith('::ffff:') ? normalized.slice(7) : normalized;
+    return (0, node_net_1.isIP)(v4) === 4 || (0, node_net_1.isIP)(normalized) === 6;
+}
+function readHeaderValues(raw) {
+    if (typeof raw === 'string') {
+        return raw.split(',').map((v) => v.trim()).filter(Boolean);
+    }
+    if (Array.isArray(raw)) {
+        return raw.flatMap((v) => readHeaderValues(v));
+    }
+    return [];
+}
+function getForwardedForCandidates(req) {
+    const xForwardedFor = readHeaderValues(req.headers?.['x-forwarded-for']);
+    const xRealIp = readHeaderValues(req.headers?.['x-real-ip']);
+    const forwarded = readHeaderValues(req.headers?.forwarded)
+        .flatMap((entry) => entry.split(';').map((segment) => segment.trim()))
+        .map((segment) => {
+        const lower = segment.toLowerCase();
+        if (!lower.startsWith('for=')) {
+            return undefined;
+        }
+        return segment.slice(4).trim();
+    })
+        .filter((v) => typeof v === 'string' && v.length > 0);
+    return [...xForwardedFor, ...xRealIp, ...forwarded];
+}
+function isLocalRequest(req) {
+    const socket = req.socket;
+    const connection = req.connection;
+    const candidateAddresses = [
+        socket?.remoteAddress,
+        connection?.remoteAddress,
+        ...getForwardedForCandidates(req),
+    ];
+    const normalizedCandidates = candidateAddresses
+        .map((v) => normalizeAddress(v))
+        .filter((v) => typeof v === 'string' && v.length > 0);
+    const ipCandidates = normalizedCandidates.filter((v) => isIpLikeAddress(v));
+    if (ipCandidates.length === 0) {
+        return false;
+    }
+    return ipCandidates.every(isPrivateOrLoopbackAddress);
+}
+function secureEquals(value, expected) {
+    const valueDigest = crypto.createHash('sha256').update(value).digest();
+    const expectedDigest = crypto.createHash('sha256').update(expected).digest();
+    return crypto.timingSafeEqual(valueDigest, expectedDigest);
+}
+function isAuthenticatedRequest(req) {
+    return typeof req.isAuthenticated === 'function' && req.isAuthenticated();
+}
+/**
+ * CompanionAttachmentUploadAuth Policy
+ *
+ * Allows Companion-server upload creation requests (POST /companion/record/:oid/attach)
+ * to bypass normal checkAuth when they include a valid shared secret header.
+ */
+function companionAttachmentUploadAuth(req, res, next) {
+    const requestWithBypassFlag = req;
+    if (typeof requestWithBypassFlag[COMPANION_BYPASS_FLAG] !== 'undefined') {
+        sails.log.warn(`Ignoring pre-set ${COMPANION_BYPASS_FLAG} value on incoming request.`);
+        delete requestWithBypassFlag[COMPANION_BYPASS_FLAG];
+    }
+    const hasClientSuppliedBypassFlag = [
+        req.headers?.[COMPANION_BYPASS_FLAG.toLowerCase()],
+        req.query?.[COMPANION_BYPASS_FLAG],
+        req.body?.[COMPANION_BYPASS_FLAG],
+    ].some((value) => typeof value !== 'undefined');
+    if (hasClientSuppliedBypassFlag) {
+        sails.log.warn(`Ignoring client supplied ${COMPANION_BYPASS_FLAG} in header/query/body.`);
+    }
+    const method = String(req.method ?? '').toUpperCase();
+    const attachId = String(req.param('attachId') ?? '').trim();
+    const isCreateRequest = method === 'POST' && attachId.length === 0;
+    const isTusChunkRequest = (method === 'PATCH' || method === 'HEAD') && attachId.length > 0;
+    if (!isCreateRequest && !isTusChunkRequest) {
+        return next();
+    }
+    const companionConfig = sails.config.companion || {};
+    const headerName = String(companionConfig.attachmentSecretHeader ?? COMPANION_SECRET_HEADER_DEFAULT)
+        .trim()
+        .toLowerCase() || COMPANION_SECRET_HEADER_DEFAULT;
+    const suppliedSecretRaw = req.headers?.[headerName];
+    const suppliedSecret = (Array.isArray(suppliedSecretRaw) ? suppliedSecretRaw[0] : suppliedSecretRaw);
+    if (typeof suppliedSecret !== 'string' || suppliedSecret.trim().length === 0) {
+        if (!isAuthenticatedRequest(req)) {
+            res.status(403).json({ message: 'Companion upload secret is required' });
+            return;
+        }
+        return next();
+    }
+    const expectedSecret = String(companionConfig.attachmentSecret ?? companionConfig.secret ?? '').trim();
+    if (!expectedSecret) {
+        sails.log.warn('Companion attachment upload secret is not configured; rejecting companion upload request.');
+        res.status(503).json({ message: 'Companion upload auth is not configured' });
+        return;
+    }
+    if (!secureEquals(suppliedSecret.trim(), expectedSecret)) {
+        res.status(403).json({ message: 'Invalid companion upload secret' });
+        return;
+    }
+    const localOnly = companionConfig.attachmentLocalOnly !== false;
+    if (localOnly && !isLocalRequest(req)) {
+        res.status(403).json({ message: 'Companion upload requests must originate locally' });
+        return;
+    }
+    requestWithBypassFlag[COMPANION_BYPASS_FLAG] = true;
+    return next();
+}
+exports.default = companionAttachmentUploadAuth;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29tcGFuaW9uQXR0YWNobWVudFVwbG9hZEF1dGguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvcG9saWNpZXMvY29tcGFuaW9uQXR0YWNobWVudFVwbG9hZEF1dGgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7QUFvSkEsc0VBK0RDO0FBbk5ELG9EQUFzQztBQUN0Qyx1Q0FBZ0M7QUFFaEMsTUFBTSwrQkFBK0IsR0FBRyxvQkFBb0IsQ0FBQztBQUM3RCxNQUFNLHFCQUFxQixHQUFHLHFDQUFxQyxDQUFDO0FBRXBFLFNBQVMsaUJBQWlCLENBQUMsVUFBbUI7SUFDMUMsSUFBSSxPQUFPLFVBQVUsS0FBSyxRQUFRLElBQUksVUFBVSxDQUFDLElBQUksRUFBRSxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztRQUNuRSxPQUFPLEtBQUssQ0FBQztJQUNqQixDQUFDO0lBRUQsTUFBTSxXQUFXLEdBQUcsVUFBVSxDQUFDLElBQUksRUFBRSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUNwRCxNQUFNLFVBQVUsR0FBRyxXQUFXLENBQUMsV0FBVyxFQUFFLENBQUM7SUFDN0MsSUFBSSxVQUFVLEtBQUssS0FBSyxJQUFJLFVBQVUsS0FBSyxpQkFBaUIsRUFBRSxDQUFDO1FBQzNELE9BQU8sSUFBSSxDQUFDO0lBQ2hCLENBQUM7SUFFRCxNQUFNLFFBQVEsR0FBRyxVQUFVLENBQUMsVUFBVSxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxVQUFVLENBQUM7SUFDckYsT0FBTyxRQUFRLEtBQUssV0FBVyxJQUFJLFFBQVEsQ0FBQyxVQUFVLENBQUMsTUFBTSxDQUFDLENBQUM7QUFDbkUsQ0FBQztBQUVELFNBQVMsZ0JBQWdCLENBQUMsVUFBbUI7SUFDekMsSUFBSSxPQUFPLFVBQVUsS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUNqQyxPQUFPLFNBQVMsQ0FBQztJQUNyQixDQUFDO0lBQ0QsSUFBSSxLQUFLLEdBQUcsVUFBVSxDQUFDLElBQUksRUFBRSxDQUFDO0lBQzlCLElBQUksQ0FBQyxLQUFLLElBQUksS0FBSyxLQUFLLFNBQVMsSUFBSSxLQUFLLEtBQUssU0FBUyxFQUFFLENBQUM7UUFDdkQsT0FBTyxTQUFTLENBQUM7SUFDckIsQ0FBQztJQUNELElBQUksQ0FBQyxLQUFLLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQyxJQUFJLEtBQUssQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDLElBQUksS0FBSyxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDbkcsS0FBSyxHQUFHLEtBQUssQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUM7SUFDdEMsQ0FBQztJQUNELElBQUksS0FBSyxDQUFDLFVBQVUsQ0FBQyxHQUFHLENBQUMsSUFBSSxLQUFLLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDL0MsS0FBSyxHQUFHLEtBQUssQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLEtBQUssQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQztJQUMvQyxDQUFDO1NBQU0sSUFBSSwrQkFBK0IsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztRQUNyRCx1Q0FBdUM7UUFDdkMsS0FBSyxHQUFHLEtBQUssQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLEtBQUssQ0FBQyxXQUFXLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQztJQUNuRCxDQUFDO0lBQ0QsTUFBTSxVQUFVLEdBQUcsS0FBSyxDQUFDLFdBQVcsRUFBRSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztJQUM1RCxPQUFPLFVBQVUsSUFBSSxTQUFTLENBQUM7QUFDbkMsQ0FBQztBQUVELFNBQVMsMEJBQTBCLENBQUMsVUFBbUI7SUFDbkQsTUFBTSxVQUFVLEdBQUcsZ0JBQWdCLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDaEQsSUFBSSxDQUFDLFVBQVUsRUFBRSxDQUFDO1FBQ2QsT0FBTyxLQUFLLENBQUM7SUFDakIsQ0FBQztJQUNELElBQUksaUJBQWlCLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQztRQUNoQyxPQUFPLElBQUksQ0FBQztJQUNoQixDQUFDO0lBRUQsTUFBTSxFQUFFLEdBQUcsVUFBVSxDQUFDLFVBQVUsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLENBQUMsVUFBVSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsVUFBVSxDQUFDO0lBQy9FLElBQUksSUFBQSxlQUFJLEVBQUMsRUFBRSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDakIsSUFBSSxFQUFFLENBQUMsVUFBVSxDQUFDLEtBQUssQ0FBQyxJQUFJLEVBQUUsQ0FBQyxVQUFVLENBQUMsVUFBVSxDQUFDLElBQUksRUFBRSxDQUFDLFVBQVUsQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDO1lBQ2pGLE9BQU8sSUFBSSxDQUFDO1FBQ2hCLENBQUM7UUFDRCxJQUFJLDZCQUE2QixDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsRUFBRSxDQUFDO1lBQ3pDLE9BQU8sSUFBSSxDQUFDO1FBQ2hCLENBQUM7UUFDRCxPQUFPLEtBQUssQ0FBQztJQUNqQixDQUFDO0lBRUQsSUFBSSxJQUFBLGVBQUksRUFBQyxVQUFVLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztRQUN6QixPQUFPLFVBQVUsQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDO2VBQzNCLFVBQVUsQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDO2VBQzNCLFVBQVUsQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDO2VBQzVCLFVBQVUsQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDO2VBQzVCLFVBQVUsQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDO2VBQzVCLFVBQVUsQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDLENBQUM7SUFDeEMsQ0FBQztJQUVELE9BQU8sS0FBSyxDQUFDO0FBQ2pCLENBQUM7QUFFRCxTQUFTLGVBQWUsQ0FBQyxVQUFtQjtJQUN4QyxNQUFNLFVBQVUsR0FBRyxnQkFBZ0IsQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUNoRCxJQUFJLENBQUMsVUFBVSxFQUFFLENBQUM7UUFDZCxPQUFPLEtBQUssQ0FBQztJQUNqQixDQUFDO0lBQ0QsSUFBSSxpQkFBaUIsQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDO1FBQ2hDLE9BQU8sSUFBSSxDQUFDO0lBQ2hCLENBQUM7SUFDRCxNQUFNLEVBQUUsR0FBRyxVQUFVLENBQUMsVUFBVSxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxVQUFVLENBQUM7SUFDL0UsT0FBTyxJQUFBLGVBQUksRUFBQyxFQUFFLENBQUMsS0FBSyxDQUFDLElBQUksSUFBQSxlQUFJLEVBQUMsVUFBVSxDQUFDLEtBQUssQ0FBQyxDQUFDO0FBQ3BELENBQUM7QUFFRCxTQUFTLGdCQUFnQixDQUFDLEdBQVk7SUFDbEMsSUFBSSxPQUFPLEdBQUcsS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUMxQixPQUFPLEdBQUcsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLENBQUM7SUFDL0QsQ0FBQztJQUNELElBQUksS0FBSyxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ3JCLE9BQU8sR0FBRyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsZ0JBQWdCLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUNuRCxDQUFDO0lBQ0QsT0FBTyxFQUFFLENBQUM7QUFDZCxDQUFDO0FBRUQsU0FBUyx5QkFBeUIsQ0FBQyxHQUFjO0lBQzdDLE1BQU0sYUFBYSxHQUFHLGdCQUFnQixDQUFDLEdBQUcsQ0FBQyxPQUFPLEVBQUUsQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDLENBQUM7SUFDekUsTUFBTSxPQUFPLEdBQUcsZ0JBQWdCLENBQUMsR0FBRyxDQUFDLE9BQU8sRUFBRSxDQUFDLFdBQVcsQ0FBQyxDQUFDLENBQUM7SUFDN0QsTUFBTSxTQUFTLEdBQUcsZ0JBQWdCLENBQUMsR0FBRyxDQUFDLE9BQU8sRUFBRSxTQUFTLENBQUM7U0FDckQsT0FBTyxDQUFDLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRSxDQUFDLENBQUM7U0FDckUsR0FBRyxDQUFDLENBQUMsT0FBTyxFQUFFLEVBQUU7UUFDYixNQUFNLEtBQUssR0FBRyxPQUFPLENBQUMsV0FBVyxFQUFFLENBQUM7UUFDcEMsSUFBSSxDQUFDLEtBQUssQ0FBQyxVQUFVLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQztZQUM1QixPQUFPLFNBQVMsQ0FBQztRQUNyQixDQUFDO1FBQ0QsT0FBTyxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDO0lBQ25DLENBQUMsQ0FBQztTQUNELE1BQU0sQ0FBQyxDQUFDLENBQUMsRUFBZSxFQUFFLENBQUMsT0FBTyxDQUFDLEtBQUssUUFBUSxJQUFJLENBQUMsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxDQUFDLENBQUM7SUFFdkUsT0FBTyxDQUFDLEdBQUcsYUFBYSxFQUFFLEdBQUcsT0FBTyxFQUFFLEdBQUcsU0FBUyxDQUFDLENBQUM7QUFDeEQsQ0FBQztBQUVELFNBQVMsY0FBYyxDQUFDLEdBQWM7SUFDbEMsTUFBTSxNQUFNLEdBQUksR0FBMkQsQ0FBQyxNQUFNLENBQUM7SUFDbkYsTUFBTSxVQUFVLEdBQUksR0FBK0QsQ0FBQyxVQUFVLENBQUM7SUFDL0YsTUFBTSxrQkFBa0IsR0FBRztRQUN2QixNQUFNLEVBQUUsYUFBYTtRQUNyQixVQUFVLEVBQUUsYUFBYTtRQUN6QixHQUFHLHlCQUF5QixDQUFDLEdBQUcsQ0FBQztLQUNwQyxDQUFDO0lBQ0YsTUFBTSxvQkFBb0IsR0FBRyxrQkFBa0I7U0FDMUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDLENBQUMsQ0FBQztTQUMvQixNQUFNLENBQUMsQ0FBQyxDQUFDLEVBQWUsRUFBRSxDQUFDLE9BQU8sQ0FBQyxLQUFLLFFBQVEsSUFBSSxDQUFDLENBQUMsTUFBTSxHQUFHLENBQUMsQ0FBQyxDQUFDO0lBQ3ZFLE1BQU0sWUFBWSxHQUFHLG9CQUFvQixDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsZUFBZSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDNUUsSUFBSSxZQUFZLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQzVCLE9BQU8sS0FBSyxDQUFDO0lBQ2pCLENBQUM7SUFFRCxPQUFPLFlBQVksQ0FBQyxLQUFLLENBQUMsMEJBQTBCLENBQUMsQ0FBQztBQUMxRCxDQUFDO0FBRUQsU0FBUyxZQUFZLENBQUMsS0FBYSxFQUFFLFFBQWdCO0lBQ2pELE1BQU0sV0FBVyxHQUFHLE1BQU0sQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDO0lBQ3ZFLE1BQU0sY0FBYyxHQUFHLE1BQU0sQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDO0lBQzdFLE9BQU8sTUFBTSxDQUFDLGVBQWUsQ0FBQyxXQUFXLEVBQUUsY0FBYyxDQUFDLENBQUM7QUFDL0QsQ0FBQztBQUVELFNBQVMsc0JBQXNCLENBQUMsR0FBYztJQUMxQyxPQUFPLE9BQU8sR0FBRyxDQUFDLGVBQWUsS0FBSyxVQUFVLElBQUksR0FBRyxDQUFDLGVBQWUsRUFBRSxDQUFDO0FBQzlFLENBQUM7QUFFRDs7Ozs7R0FLRztBQUNILFNBQWdCLDZCQUE2QixDQUFDLEdBQWMsRUFBRSxHQUFjLEVBQUUsSUFBd0I7SUFDbEcsTUFBTSxxQkFBcUIsR0FBRyxHQUEwQyxDQUFDO0lBQ3pFLElBQUksT0FBTyxxQkFBcUIsQ0FBQyxxQkFBcUIsQ0FBQyxLQUFLLFdBQVcsRUFBRSxDQUFDO1FBQ3RFLEtBQUssQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLG9CQUFvQixxQkFBcUIsNkJBQTZCLENBQUMsQ0FBQztRQUN2RixPQUFPLHFCQUFxQixDQUFDLHFCQUFxQixDQUFDLENBQUM7SUFDeEQsQ0FBQztJQUVELE1BQU0sMkJBQTJCLEdBQUc7UUFDaEMsR0FBRyxDQUFDLE9BQU8sRUFBRSxDQUFDLHFCQUFxQixDQUFDLFdBQVcsRUFBRSxDQUFDO1FBQ2pELEdBQUcsQ0FBQyxLQUE2QyxFQUFFLENBQUMscUJBQXFCLENBQUM7UUFDMUUsR0FBRyxDQUFDLElBQTRDLEVBQUUsQ0FBQyxxQkFBcUIsQ0FBQztLQUM3RSxDQUFDLElBQUksQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsT0FBTyxLQUFLLEtBQUssV0FBVyxDQUFDLENBQUM7SUFDaEQsSUFBSSwyQkFBMkIsRUFBRSxDQUFDO1FBQzlCLEtBQUssQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLDRCQUE0QixxQkFBcUIsd0JBQXdCLENBQUMsQ0FBQztJQUM5RixDQUFDO0lBRUQsTUFBTSxNQUFNLEdBQUcsTUFBTSxDQUFDLEdBQUcsQ0FBQyxNQUFNLElBQUksRUFBRSxDQUFDLENBQUMsV0FBVyxFQUFFLENBQUM7SUFDdEQsTUFBTSxRQUFRLEdBQUcsTUFBTSxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsVUFBVSxDQUFDLElBQUksRUFBRSxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUM7SUFDNUQsTUFBTSxlQUFlLEdBQUcsTUFBTSxLQUFLLE1BQU0sSUFBSSxRQUFRLENBQUMsTUFBTSxLQUFLLENBQUMsQ0FBQztJQUNuRSxNQUFNLGlCQUFpQixHQUFHLENBQUMsTUFBTSxLQUFLLE9BQU8sSUFBSSxNQUFNLEtBQUssTUFBTSxDQUFDLElBQUksUUFBUSxDQUFDLE1BQU0sR0FBRyxDQUFDLENBQUM7SUFDM0YsSUFBSSxDQUFDLGVBQWUsSUFBSSxDQUFDLGlCQUFpQixFQUFFLENBQUM7UUFDekMsT0FBTyxJQUFJLEVBQUUsQ0FBQztJQUNsQixDQUFDO0lBRUQsTUFBTSxlQUFlLEdBQUksS0FBSyxDQUFDLE1BQU0sQ0FBQyxTQUtwQyxJQUFJLEVBQUUsQ0FBQztJQUNULE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQyxlQUFlLENBQUMsc0JBQXNCLElBQUksK0JBQStCLENBQUM7U0FDL0YsSUFBSSxFQUFFO1NBQ04sV0FBVyxFQUFFLElBQUksK0JBQStCLENBQUM7SUFDdEQsTUFBTSxpQkFBaUIsR0FBRyxHQUFHLENBQUMsT0FBTyxFQUFFLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDcEQsTUFBTSxjQUFjLEdBQUcsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLGlCQUFpQixDQUFDLENBQUMsQ0FBQyxDQUFDLGlCQUFpQixDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDO0lBQ3JHLElBQUksT0FBTyxjQUFjLEtBQUssUUFBUSxJQUFJLGNBQWMsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDM0UsSUFBSSxDQUFDLHNCQUFzQixDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDL0IsR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxPQUFPLEVBQUUscUNBQXFDLEVBQUUsQ0FBQyxDQUFDO1lBQ3pFLE9BQU87UUFDWCxDQUFDO1FBQ0QsT0FBTyxJQUFJLEVBQUUsQ0FBQztJQUNsQixDQUFDO0lBRUQsTUFBTSxjQUFjLEdBQUcsTUFBTSxDQUFDLGVBQWUsQ0FBQyxnQkFBZ0IsSUFBSSxlQUFlLENBQUMsTUFBTSxJQUFJLEVBQUUsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDO0lBQ3ZHLElBQUksQ0FBQyxjQUFjLEVBQUUsQ0FBQztRQUNsQixLQUFLLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQywyRkFBMkYsQ0FBQyxDQUFDO1FBQzVHLEdBQUcsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDLEVBQUUsT0FBTyxFQUFFLHlDQUF5QyxFQUFFLENBQUMsQ0FBQztRQUM3RSxPQUFPO0lBQ1gsQ0FBQztJQUVELElBQUksQ0FBQyxZQUFZLENBQUMsY0FBYyxDQUFDLElBQUksRUFBRSxFQUFFLGNBQWMsQ0FBQyxFQUFFLENBQUM7UUFDdkQsR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxPQUFPLEVBQUUsaUNBQWlDLEVBQUUsQ0FBQyxDQUFDO1FBQ3JFLE9BQU87SUFDWCxDQUFDO0lBRUQsTUFBTSxTQUFTLEdBQUcsZUFBZSxDQUFDLG1CQUFtQixLQUFLLEtBQUssQ0FBQztJQUNoRSxJQUFJLFNBQVMsSUFBSSxDQUFDLGNBQWMsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ3BDLEdBQUcsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDLEVBQUUsT0FBTyxFQUFFLGtEQUFrRCxFQUFFLENBQUMsQ0FBQztRQUN0RixPQUFPO0lBQ1gsQ0FBQztJQUVELHFCQUFxQixDQUFDLHFCQUFxQixDQUFDLEdBQUcsSUFBSSxDQUFDO0lBQ3BELE9BQU8sSUFBSSxFQUFFLENBQUM7QUFDbEIsQ0FBQztBQUVELGtCQUFlLDZCQUE2QixDQUFDIn0=

package/dist/policies/contentSecurityPolicy.d.ts

@@ -0,0 +1,23 @@
+/**
+ * ContentSecurityPolicy Policy
+ *
+ * Adds the Content Security Policy (CSP) http header.
+ *
+ * Includes generating a nonce ("number used once") for verifying server-provided files on the client.
+ * This enables dynamic scripts to be generated and compiled on the server-side,
+ * then provided to the client-side in a way that can be verified.
+ *
+ * NOTE: The CSP is a 'defense in depth' approach, it helps limit potential issues,
+ * but does not prevent cross site scripting or script injection attacks.
+ * For example, the nonce allows the client to verify that scripts originated from the server,
+ * but the server could provide scripts with malicious code already injected
+ * (e.g. from a user-entered value stored in a database).
+ *
+ * See: https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html
+ * See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP
+ * See: https://angular.dev/best-practices/security#content-security-policy
+ * See: https://centralcsp.com/docs
+ */
+export declare function contentSecurityPolicy(req: Sails.Req, res: Sails.Res, next: Sails.NextFunction): void;
+export default contentSecurityPolicy;
+//# sourceMappingURL=contentSecurityPolicy.d.ts.map

package/dist/policies/contentSecurityPolicy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contentSecurityPolicy.d.ts","sourceRoot":"","sources":["../../src/policies/contentSecurityPolicy.ts"],"names":[],"mappings":"AAUA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,YAAY,GAAG,IAAI,CAsFpG;AAED,eAAe,qBAAqB,CAAC"}

package/dist/policies/contentSecurityPolicy.js

@@ -0,0 +1,135 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.contentSecurityPolicy = contentSecurityPolicy;
+const crypto = __importStar(require("node:crypto"));
+/**
+ * ContentSecurityPolicy Policy
+ *
+ * Adds the Content Security Policy (CSP) http header.
+ *
+ * Includes generating a nonce ("number used once") for verifying server-provided files on the client.
+ * This enables dynamic scripts to be generated and compiled on the server-side,
+ * then provided to the client-side in a way that can be verified.
+ *
+ * NOTE: The CSP is a 'defense in depth' approach, it helps limit potential issues,
+ * but does not prevent cross site scripting or script injection attacks.
+ * For example, the nonce allows the client to verify that scripts originated from the server,
+ * but the server could provide scripts with malicious code already injected
+ * (e.g. from a user-entered value stored in a database).
+ *
+ * See: https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html
+ * See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP
+ * See: https://angular.dev/best-practices/security#content-security-policy
+ * See: https://centralcsp.com/docs
+ */
+function contentSecurityPolicy(req, res, next) {
+    sails.log.verbose(`Setting Content Security Policy nonce headers and view local for ${req.path}`);
+    // Config can be provided at sails.config.csp or sails.config.security.csp
+    const cfg = (sails.config && (sails.config.csp || (sails.config.security && sails.config.security.csp))) || {};
+    // Fallback defaults mirror previous hard-coded behavior
+    const defaults = {
+        enabled: true,
+        reportOnly: false,
+        addNonceTo: ['script-src', 'style-src'],
+        directives: {
+            'default-src': ["'self'"],
+            'script-src': ["'self'"],
+            'worker-src': ["'self'"],
+            'object-src': ["'none'"],
+            'manifest-src': ["'self'"],
+            'style-src': ["'self'", 'https://fonts.googleapis.com', 'https://fonts.gstatic.com'],
+            'font-src': ["'self'", 'https://fonts.googleapis.com', 'https://fonts.gstatic.com'],
+            'frame-ancestors': ["'none'"],
+            'form-action': ["'self'"],
+            'base-uri': ["'self'"],
+        },
+        extras: ['upgrade-insecure-requests'],
+    };
+    // Merge settings: shallow for top-level, replace arrays for directives keys if provided
+    const enabled = cfg.enabled != null ? !!cfg.enabled : defaults.enabled;
+    const reportOnly = cfg.reportOnly != null ? !!cfg.reportOnly : defaults.reportOnly;
+    const addNonceTo = Array.isArray(cfg.addNonceTo) ? cfg.addNonceTo : defaults.addNonceTo;
+    const extras = Array.isArray(cfg.extras) ? cfg.extras : defaults.extras;
+    const directives = Object.assign({}, defaults.directives, cfg.directives || {});
+    if (!enabled) {
+        return next();
+    }
+    // generate a nonce - a cryptographically secure random string,
+    // which must be different for each request
+    const generatedNonce = crypto.randomBytes(16).toString("base64");
+    // For any directive configured in addNonceTo, ensure the nonce token is prepended
+    addNonceTo.forEach((name) => {
+        const arr = directives[name];
+        if (Array.isArray(arr)) {
+            const token = `'nonce-${generatedNonce}'`;
+            // Remove any existing nonces and prepend the fresh one
+            const filtered = arr.filter((v) => typeof v !== 'string' || !v.startsWith("'nonce-"));
+            directives[name] = [token, ...filtered];
+        }
+    });
+    // Build the header value
+    const parts = [];
+    Object.keys(directives).forEach((key) => {
+        const values = directives[key];
+        if (Array.isArray(values) && values.length > 0) {
+            parts.push(`${key} ${values.join(' ')}`);
+        }
+        // empty array means emit key with no values (rare), skip to avoid invalid policy
+    });
+    (extras || []).forEach((d) => {
+        if (typeof d === 'string' && d.trim().length > 0) {
+            parts.push(d.trim());
+        }
+    });
+    if (parts.length === 0) {
+        sails.log.warn('CSP is enabled but no directives or extras are configured. Skipping CSP header.');
+        return next();
+    }
+    const headerValue = parts.join('; ');
+    // Set the appropriate CSP header; add trailing semicolon for readability consistency with previous code
+    const headerName = reportOnly ? 'Content-Security-Policy-Report-Only' : 'Content-Security-Policy';
+    res.set(headerName, `${headerValue};`);
+    // provide the nonce to the view, so it can be set in the angular app and scripts
+    if (!req.options)
+        req.options = {};
+    const locals = (req.options.locals ?? {});
+    req.options.locals = locals;
+    locals.contentSecurityPolicyNonce = generatedNonce;
+    // proceed to the next policy
+    return next();
+}
+exports.default = contentSecurityPolicy;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29udGVudFNlY3VyaXR5UG9saWN5LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL3BvbGljaWVzL2NvbnRlbnRTZWN1cml0eVBvbGljeS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztBQThCQSxzREFzRkM7QUFwSEQsb0RBQXNDO0FBVXRDOzs7Ozs7Ozs7Ozs7Ozs7Ozs7O0dBbUJHO0FBQ0gsU0FBZ0IscUJBQXFCLENBQUMsR0FBYyxFQUFFLEdBQWMsRUFBRSxJQUF3QjtJQUMxRixLQUFLLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxvRUFBb0UsR0FBRyxDQUFDLElBQUksRUFBRSxDQUFDLENBQUM7SUFFbEcsMEVBQTBFO0lBQzFFLE1BQU0sR0FBRyxHQUFjLENBQUMsS0FBSyxDQUFDLE1BQU0sSUFBSSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsR0FBZ0IsSUFBSSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsUUFBUSxJQUFLLEtBQUssQ0FBQyxNQUFNLENBQUMsUUFBK0MsQ0FBQyxHQUE0QixDQUFDLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztJQUV4TSx3REFBd0Q7SUFDeEQsTUFBTSxRQUFRLEdBQXdCO1FBQ2xDLE9BQU8sRUFBRSxJQUFJO1FBQ2IsVUFBVSxFQUFFLEtBQUs7UUFDakIsVUFBVSxFQUFFLENBQUMsWUFBWSxFQUFFLFdBQVcsQ0FBQztRQUN2QyxVQUFVLEVBQUU7WUFDUixhQUFhLEVBQUUsQ0FBQyxRQUFRLENBQUM7WUFDekIsWUFBWSxFQUFFLENBQUMsUUFBUSxDQUFDO1lBQ3hCLFlBQVksRUFBRSxDQUFDLFFBQVEsQ0FBQztZQUN4QixZQUFZLEVBQUUsQ0FBQyxRQUFRLENBQUM7WUFDeEIsY0FBYyxFQUFFLENBQUMsUUFBUSxDQUFDO1lBQzFCLFdBQVcsRUFBRSxDQUFDLFFBQVEsRUFBRSw4QkFBOEIsRUFBRSwyQkFBMkIsQ0FBQztZQUNwRixVQUFVLEVBQUUsQ0FBQyxRQUFRLEVBQUUsOEJBQThCLEVBQUUsMkJBQTJCLENBQUM7WUFDbkYsaUJBQWlCLEVBQUUsQ0FBQyxRQUFRLENBQUM7WUFDN0IsYUFBYSxFQUFFLENBQUMsUUFBUSxDQUFDO1lBQ3pCLFVBQVUsRUFBRSxDQUFDLFFBQVEsQ0FBQztTQUN6QjtRQUNELE1BQU0sRUFBRSxDQUFDLDJCQUEyQixDQUFDO0tBQ3hDLENBQUM7SUFFRix3RkFBd0Y7SUFDeEYsTUFBTSxPQUFPLEdBQUcsR0FBRyxDQUFDLE9BQU8sSUFBSSxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDO0lBQ3ZFLE1BQU0sVUFBVSxHQUFHLEdBQUcsQ0FBQyxVQUFVLElBQUksSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQztJQUNuRixNQUFNLFVBQVUsR0FBRyxLQUFLLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQztJQUN4RixNQUFNLE1BQU0sR0FBRyxLQUFLLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQztJQUN4RSxNQUFNLFVBQVUsR0FBNkIsTUFBTSxDQUFDLE1BQU0sQ0FBQyxFQUFFLEVBQUUsUUFBUSxDQUFDLFVBQVUsRUFBRSxHQUFHLENBQUMsVUFBVSxJQUFJLEVBQUUsQ0FBQyxDQUFDO0lBRTFHLElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQztRQUNYLE9BQU8sSUFBSSxFQUFFLENBQUM7SUFDbEIsQ0FBQztJQUVELCtEQUErRDtJQUMvRCwyQ0FBMkM7SUFDM0MsTUFBTSxjQUFjLEdBQUcsTUFBTSxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUMsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLENBQUM7SUFFakUsa0ZBQWtGO0lBQ2xGLFVBQVUsQ0FBQyxPQUFPLENBQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRTtRQUN4QixNQUFNLEdBQUcsR0FBRyxVQUFVLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDN0IsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDckIsTUFBTSxLQUFLLEdBQUcsVUFBVSxjQUFjLEdBQUcsQ0FBQztZQUMxQyx1REFBdUQ7WUFDdkQsTUFBTSxRQUFRLEdBQUcsR0FBRyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsT0FBTyxDQUFDLEtBQUssUUFBUSxJQUFJLENBQUMsQ0FBQyxDQUFDLFVBQVUsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDO1lBQ3RGLFVBQVUsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLEtBQUssRUFBRSxHQUFHLFFBQVEsQ0FBQyxDQUFDO1FBQzVDLENBQUM7SUFDTCxDQUFDLENBQUMsQ0FBQztJQUVILHlCQUF5QjtJQUN6QixNQUFNLEtBQUssR0FBYSxFQUFFLENBQUM7SUFDM0IsTUFBTSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsQ0FBQyxPQUFPLENBQUMsQ0FBQyxHQUFHLEVBQUUsRUFBRTtRQUNwQyxNQUFNLE1BQU0sR0FBRyxVQUFVLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDL0IsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxJQUFJLE1BQU0sQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDN0MsS0FBSyxDQUFDLElBQUksQ0FBQyxHQUFHLEdBQUcsSUFBSSxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUM3QyxDQUFDO1FBQ0QsaUZBQWlGO0lBQ3JGLENBQUMsQ0FBQyxDQUFDO0lBQ0gsQ0FBQyxNQUFNLElBQUksRUFBRSxDQUFDLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUU7UUFDekIsSUFBSSxPQUFPLENBQUMsS0FBSyxRQUFRLElBQUksQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUMvQyxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDO1FBQ3pCLENBQUM7SUFDTCxDQUFDLENBQUMsQ0FBQztJQUVILElBQUksS0FBSyxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztRQUNyQixLQUFLLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxpRkFBaUYsQ0FBQyxDQUFDO1FBQ2xHLE9BQU8sSUFBSSxFQUFFLENBQUM7SUFDbEIsQ0FBQztJQUVELE1BQU0sV0FBVyxHQUFHLEtBQUssQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUM7SUFFckMsd0dBQXdHO0lBQ3hHLE1BQU0sVUFBVSxHQUFHLFVBQVUsQ0FBQyxDQUFDLENBQUMscUNBQXFDLENBQUMsQ0FBQyxDQUFDLHlCQUF5QixDQUFDO0lBQ2xHLEdBQUcsQ0FBQyxHQUFHLENBQUMsVUFBVSxFQUFFLEdBQUcsV0FBVyxHQUFHLENBQUMsQ0FBQztJQUV2QyxpRkFBaUY7SUFDakYsSUFBSSxDQUFDLEdBQUcsQ0FBQyxPQUFPO1FBQUUsR0FBRyxDQUFDLE9BQU8sR0FBRyxFQUFFLENBQUM7SUFDbkMsTUFBTSxNQUFNLEdBQUcsQ0FBQyxHQUFHLENBQUMsT0FBTyxDQUFDLE1BQU0sSUFBSSxFQUFFLENBQTRCLENBQUM7SUFDckUsR0FBRyxDQUFDLE9BQU8sQ0FBQyxNQUFNLEdBQUcsTUFBTSxDQUFDO0lBQzVCLE1BQU0sQ0FBQywwQkFBMEIsR0FBRyxjQUFjLENBQUM7SUFFbkQsNkJBQTZCO0lBQzdCLE9BQU8sSUFBSSxFQUFFLENBQUM7QUFDbEIsQ0FBQztBQUVELGtCQUFlLHFCQUFxQixDQUFDIn0=

package/dist/policies/disallowedHeadRequestHandler.d.ts

@@ -0,0 +1,8 @@
+/**
+ * DisallowedHeadRequestHandler Policy
+ *
+ * Blocks HEAD requests by returning a 400 Bad Request response.
+ */
+export declare function disallowedHeadRequestHandler(req: Sails.Req, res: Sails.Res, next: Sails.NextFunction): void;
+export default disallowedHeadRequestHandler;
+//# sourceMappingURL=disallowedHeadRequestHandler.d.ts.map

package/dist/policies/disallowedHeadRequestHandler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"disallowedHeadRequestHandler.d.ts","sourceRoot":"","sources":["../../src/policies/disallowedHeadRequestHandler.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,YAAY,GAAG,IAAI,CAM3G;AAED,eAAe,4BAA4B,CAAC"}

package/dist/policies/disallowedHeadRequestHandler.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.disallowedHeadRequestHandler = disallowedHeadRequestHandler;
+/**
+ * DisallowedHeadRequestHandler Policy
+ *
+ * Blocks HEAD requests by returning a 400 Bad Request response.
+ */
+function disallowedHeadRequestHandler(req, res, next) {
+    if (req.method === 'HEAD') {
+        res.status(400).send('Bad Request: HEAD method is not allowed');
+        return;
+    }
+    return next();
+}
+exports.default = disallowedHeadRequestHandler;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGlzYWxsb3dlZEhlYWRSZXF1ZXN0SGFuZGxlci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9wb2xpY2llcy9kaXNhbGxvd2VkSGVhZFJlcXVlc3RIYW5kbGVyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBS0Esb0VBTUM7QUFYRDs7OztHQUlHO0FBQ0gsU0FBZ0IsNEJBQTRCLENBQUMsR0FBYyxFQUFFLEdBQWMsRUFBRSxJQUF3QjtJQUNqRyxJQUFJLEdBQUcsQ0FBQyxNQUFNLEtBQUssTUFBTSxFQUFFLENBQUM7UUFDeEIsR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMseUNBQXlDLENBQUMsQ0FBQztRQUNoRSxPQUFPO0lBQ1gsQ0FBQztJQUNELE9BQU8sSUFBSSxFQUFFLENBQUM7QUFDbEIsQ0FBQztBQUVELGtCQUFlLDRCQUE0QixDQUFDIn0=

package/dist/policies/i18nLanguages.d.ts

@@ -0,0 +1,8 @@
+/**
+ * I18nLanguages Policy
+ *
+ * Adds available languages for the current branding to template context.
+ */
+export declare function i18nLanguages(req: Sails.Req, res: Sails.Res, next: Sails.NextFunction): Promise<void>;
+export default i18nLanguages;
+//# sourceMappingURL=i18nLanguages.d.ts.map

package/dist/policies/i18nLanguages.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"i18nLanguages.d.ts","sourceRoot":"","sources":["../../src/policies/i18nLanguages.ts"],"names":[],"mappings":"AAcA;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA2C3G;AAED,eAAe,aAAa,CAAC"}

package/dist/policies/i18nLanguages.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.i18nLanguages = i18nLanguages;
+/**
+ * I18nLanguages Policy
+ *
+ * Adds available languages for the current branding to template context.
+ */
+async function i18nLanguages(req, res, next) {
+    try {
+        const brandingName = BrandingService.getBrandNameFromReq(req);
+        const branding = BrandingService.getBrand(brandingName);
+        if (branding && I18nEntriesService && I18nEntriesService.listBundles) {
+            const bundles = await I18nEntriesService.listBundles(branding);
+            // Filter to only enabled languages and create objects with code and displayName
+            const availableLanguages = bundles
+                .filter((bundle) => bundle.enabled !== false && bundle.locale !== 'cimode')
+                .map((bundle) => ({
+                code: bundle.locale,
+                displayName: bundle.displayName || bundle.locale
+            }));
+            // Make available to templates
+            res.locals = res.locals || {};
+            res.locals.availableLanguages = availableLanguages;
+        }
+        else {
+            // Fallback to configured languages with display names
+            const configured = sails?.config?.i18n?.next?.init?.supportedLngs || ['en'];
+            const availableLanguages = [];
+            for (const langCode of configured.filter((lang) => lang !== 'cimode')) {
+                const displayName = I18nEntriesService && I18nEntriesService.getLanguageDisplayName
+                    ? await I18nEntriesService.getLanguageDisplayName(langCode)
+                    : langCode;
+                availableLanguages.push({
+                    code: langCode,
+                    displayName: displayName
+                });
+            }
+            const resOpts = res;
+            if (!resOpts.options)
+                resOpts.options = { locals: {} };
+            if (!resOpts.options.locals)
+                resOpts.options.locals = {};
+            resOpts.options.locals.availableLanguages = availableLanguages;
+        }
+    }
+    catch (e) {
+        sails.log.warn('[i18nLanguages policy] Error fetching languages:', e instanceof Error ? e.message : e);
+        // Fallback
+        res.locals = res.locals || {};
+        res.locals.availableLanguages = [{ code: 'en', displayName: 'English' }];
+    }
+    return next();
+}
+exports.default = i18nLanguages;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaTE4bkxhbmd1YWdlcy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9wb2xpY2llcy9pMThuTGFuZ3VhZ2VzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBbUJBLHNDQTJDQztBQWhERDs7OztHQUlHO0FBQ0ksS0FBSyxVQUFVLGFBQWEsQ0FBQyxHQUFjLEVBQUUsR0FBYyxFQUFFLElBQXdCO0lBQ3hGLElBQUksQ0FBQztRQUNELE1BQU0sWUFBWSxHQUFHLGVBQWUsQ0FBQyxtQkFBbUIsQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUM5RCxNQUFNLFFBQVEsR0FBRyxlQUFlLENBQUMsUUFBUSxDQUFDLFlBQVksQ0FBQyxDQUFDO1FBRXhELElBQUksUUFBUSxJQUFJLGtCQUFrQixJQUFJLGtCQUFrQixDQUFDLFdBQVcsRUFBRSxDQUFDO1lBQ25FLE1BQU0sT0FBTyxHQUFHLE1BQU0sa0JBQWtCLENBQUMsV0FBVyxDQUFDLFFBQVEsQ0FBQyxDQUFDO1lBQy9ELGdGQUFnRjtZQUNoRixNQUFNLGtCQUFrQixHQUFtQixPQUFPO2lCQUM3QyxNQUFNLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLE1BQU0sQ0FBQyxPQUFPLEtBQUssS0FBSyxJQUFJLE1BQU0sQ0FBQyxNQUFNLEtBQUssUUFBUSxDQUFDO2lCQUMxRSxHQUFHLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLENBQUM7Z0JBQ2QsSUFBSSxFQUFFLE1BQU0sQ0FBQyxNQUFNO2dCQUNuQixXQUFXLEVBQUUsTUFBTSxDQUFDLFdBQVcsSUFBSSxNQUFNLENBQUMsTUFBTTthQUNuRCxDQUFDLENBQUMsQ0FBQztZQUNSLDhCQUE4QjtZQUM5QixHQUFHLENBQUMsTUFBTSxHQUFHLEdBQUcsQ0FBQyxNQUFNLElBQUksRUFBRSxDQUFDO1lBQzlCLEdBQUcsQ0FBQyxNQUFNLENBQUMsa0JBQWtCLEdBQUcsa0JBQWtCLENBQUM7UUFDdkQsQ0FBQzthQUFNLENBQUM7WUFDSixzREFBc0Q7WUFDdEQsTUFBTSxVQUFVLEdBQWEsS0FBSyxFQUFFLE1BQU0sRUFBRSxJQUFJLEVBQUUsSUFBSSxFQUFFLElBQUksRUFBRSxhQUFhLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQztZQUN0RixNQUFNLGtCQUFrQixHQUFtQixFQUFFLENBQUM7WUFDOUMsS0FBSyxNQUFNLFFBQVEsSUFBSSxVQUFVLENBQUMsTUFBTSxDQUFDLENBQUMsSUFBWSxFQUFFLEVBQUUsQ0FBQyxJQUFJLEtBQUssUUFBUSxDQUFDLEVBQUUsQ0FBQztnQkFDNUUsTUFBTSxXQUFXLEdBQUcsa0JBQWtCLElBQUksa0JBQWtCLENBQUMsc0JBQXNCO29CQUMvRSxDQUFDLENBQUMsTUFBTSxrQkFBa0IsQ0FBQyxzQkFBc0IsQ0FBQyxRQUFRLENBQUM7b0JBQzNELENBQUMsQ0FBQyxRQUFRLENBQUM7Z0JBQ2Ysa0JBQWtCLENBQUMsSUFBSSxDQUFDO29CQUNwQixJQUFJLEVBQUUsUUFBUTtvQkFDZCxXQUFXLEVBQUUsV0FBVztpQkFDM0IsQ0FBQyxDQUFDO1lBQ1AsQ0FBQztZQUNELE1BQU0sT0FBTyxHQUFHLEdBQWtFLENBQUM7WUFDbkYsSUFBSSxDQUFDLE9BQU8sQ0FBQyxPQUFPO2dCQUFHLE9BQTJDLENBQUMsT0FBTyxHQUFHLEVBQUUsTUFBTSxFQUFFLEVBQUUsRUFBRSxDQUFDO1lBQzVGLElBQUksQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLE1BQU07Z0JBQUUsT0FBTyxDQUFDLE9BQU8sQ0FBQyxNQUFNLEdBQUcsRUFBRSxDQUFDO1lBQ3pELE9BQU8sQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLGtCQUFrQixHQUFHLGtCQUFrQixDQUFDO1FBQ25FLENBQUM7SUFDTCxDQUFDO0lBQUMsT0FBTyxDQUFVLEVBQUUsQ0FBQztRQUNsQixLQUFLLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxrREFBa0QsRUFBRSxDQUFDLFlBQVksS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUN2RyxXQUFXO1FBQ1gsR0FBRyxDQUFDLE1BQU0sR0FBRyxHQUFHLENBQUMsTUFBTSxJQUFJLEVBQUUsQ0FBQztRQUM5QixHQUFHLENBQUMsTUFBTSxDQUFDLGtCQUFrQixHQUFHLENBQUMsRUFBRSxJQUFJLEVBQUUsSUFBSSxFQUFFLFdBQVcsRUFBRSxTQUFTLEVBQUUsQ0FBQyxDQUFDO0lBQzdFLENBQUM7SUFFRCxPQUFPLElBQUksRUFBRSxDQUFDO0FBQ2xCLENBQUM7QUFFRCxrQkFBZSxhQUFhLENBQUMifQ==

package/dist/policies/index.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Sails Policies
+ *
+ * This module exports all policies for use in Sails applications.
+ * These policies are middleware functions that run before controller actions.
+ */
+export { brandingAndPortal } from './brandingAndPortal';
+export { checkAuth } from './checkAuth';
+export { checkBrandingValid } from './checkBrandingValid';
+export { companionAttachmentUploadAuth } from './companionAttachmentUploadAuth';
+export { contentSecurityPolicy } from './contentSecurityPolicy';
+export { disallowedHeadRequestHandler } from './disallowedHeadRequestHandler';
+export { i18nLanguages } from './i18nLanguages';
+export { isAuthenticated } from './isAuthenticated';
+export { isWebServiceAuthenticated } from './isWebServiceAuthenticated';
+export { menuResolver } from './menuResolver';
+export { noCache } from './noCache';
+export { prepWs } from './prepWs';
+export { sessionAuth } from './sessionAuth';
+export { setLang } from './setLang';
+import { brandingAndPortal } from './brandingAndPortal';
+import { checkAuth } from './checkAuth';
+import { checkBrandingValid } from './checkBrandingValid';
+import { companionAttachmentUploadAuth } from './companionAttachmentUploadAuth';
+import { contentSecurityPolicy } from './contentSecurityPolicy';
+import { disallowedHeadRequestHandler } from './disallowedHeadRequestHandler';
+import { i18nLanguages } from './i18nLanguages';
+import { isAuthenticated } from './isAuthenticated';
+import { isWebServiceAuthenticated } from './isWebServiceAuthenticated';
+import { menuResolver } from './menuResolver';
+import { noCache } from './noCache';
+import { prepWs } from './prepWs';
+import { sessionAuth } from './sessionAuth';
+import { setLang } from './setLang';
+export declare const Policies: {
+    brandingAndPortal: typeof brandingAndPortal;
+    checkAuth: typeof checkAuth;
+    checkBrandingValid: typeof checkBrandingValid;
+    companionAttachmentUploadAuth: typeof companionAttachmentUploadAuth;
+    contentSecurityPolicy: typeof contentSecurityPolicy;
+    disallowedHeadRequestHandler: typeof disallowedHeadRequestHandler;
+    i18nLanguages: typeof i18nLanguages;
+    isAuthenticated: typeof isAuthenticated;
+    isWebServiceAuthenticated: typeof isWebServiceAuthenticated;
+    menuResolver: typeof menuResolver;
+    noCache: typeof noCache;
+    prepWs: typeof prepWs;
+    sessionAuth: typeof sessionAuth;
+    setLang: typeof setLang;
+};
+export default Policies;
+//# sourceMappingURL=index.d.ts.map

package/dist/policies/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/policies/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAClC,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAClC,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;CAepB,CAAC;AAEF,eAAe,QAAQ,CAAC"}