@reventlessdev/reventless-local 3.0.0-alpha.113

package/tests/adapter/LocalAuthLoginTest.res.mjs

@@ -0,0 +1,207 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as LocalAuth$ReventlessLocal from "../../src/adapter/Auth/LocalAuth.res.mjs";
+
+let alice_groups = ["Editor"];
+
+let alice = {
+  userId: "u-alice",
+  username: "alice",
+  groups: alice_groups,
+  provider: "InMemory"
+};
+
+let bob_groups = ["Viewer"];
+
+let bob = {
+  userId: "u-bob",
+  username: "bob",
+  groups: bob_groups,
+  provider: "InMemory"
+};
+
+function buildContext(headers) {
+  return {
+    headers: Object.fromEntries(headers)
+  };
+}
+
+function resetAll() {
+  LocalAuth$ReventlessLocal.resetUsers();
+  LocalAuth$ReventlessLocal.Login.resetStore();
+  LocalAuth$ReventlessLocal.Login.setTokenSecret("test-secret-deterministic");
+}
+
+globalThis.test("issue returns Ok(token) for valid credentials", async () => {
+  resetAll();
+  LocalAuth$ReventlessLocal.Login.setCredentials("alice", "alice-pw", alice);
+  let result = await LocalAuth$ReventlessLocal.Login.issue("alice", "alice-pw");
+  if (result.TAG !== "Ok") {
+    return Stdlib_JsError.throwWithMessage("unexpected Error: " + result._0);
+  }
+  let parts = result._0.split(".");
+  globalThis.expect(parts.length).toEqual(2);
+});
+
+globalThis.test("issue returns Error for unknown username", async () => {
+  resetAll();
+  let result = await LocalAuth$ReventlessLocal.Login.issue("ghost", "x");
+  if (result.TAG === "Ok") {
+    return Stdlib_JsError.throwWithMessage("expected Error");
+  }
+});
+
+globalThis.test("issue returns Error for wrong password", async () => {
+  resetAll();
+  LocalAuth$ReventlessLocal.Login.setCredentials("alice", "alice-pw", alice);
+  let result = await LocalAuth$ReventlessLocal.Login.issue("alice", "WRONG");
+  if (result.TAG === "Ok") {
+    return Stdlib_JsError.throwWithMessage("expected Error");
+  }
+});
+
+globalThis.test("verifyAndDecode round-trips the identity for a fresh token", async () => {
+  resetAll();
+  LocalAuth$ReventlessLocal.Login.setCredentials("alice", "alice-pw", alice);
+  let t = await LocalAuth$ReventlessLocal.Login.issue("alice", "alice-pw");
+  let token;
+  token = t.TAG === "Ok" ? t._0 : Stdlib_JsError.throwWithMessage("issue failed: " + t._0);
+  let identity = LocalAuth$ReventlessLocal.Login.verifyAndDecode(token);
+  if (identity !== undefined) {
+    globalThis.expect(identity.username).toEqual("alice");
+    globalThis.expect(identity.groups).toEqual(["Editor"]);
+    globalThis.expect(identity.userId).toEqual("u-alice");
+    return;
+  } else {
+    return Stdlib_JsError.throwWithMessage("verifyAndDecode returned None");
+  }
+});
+
+globalThis.test("verifyAndDecode rejects a tampered payload", async () => {
+  resetAll();
+  LocalAuth$ReventlessLocal.Login.setCredentials("alice", "alice-pw", alice);
+  let t = await LocalAuth$ReventlessLocal.Login.issue("alice", "alice-pw");
+  let token;
+  token = t.TAG === "Ok" ? t._0 : Stdlib_JsError.throwWithMessage("issue failed: " + t._0);
+  let parts = token.split(".");
+  let payload = parts[0];
+  let sig = parts[1];
+  let firstChar = payload.charAt(0);
+  let replacement = firstChar === "A" ? "B" : "A";
+  let tamperedPayload = replacement + payload.slice(1, payload.length);
+  let tampered = tamperedPayload + `.` + sig;
+  let match = LocalAuth$ReventlessLocal.Login.verifyAndDecode(tampered);
+  if (match !== undefined) {
+    return Stdlib_JsError.throwWithMessage("expected verifyAndDecode to reject tampered payload");
+  }
+});
+
+globalThis.test("verifyAndDecode rejects a tampered signature", async () => {
+  resetAll();
+  LocalAuth$ReventlessLocal.Login.setCredentials("alice", "alice-pw", alice);
+  let t = await LocalAuth$ReventlessLocal.Login.issue("alice", "alice-pw");
+  let token;
+  token = t.TAG === "Ok" ? t._0 : Stdlib_JsError.throwWithMessage("issue failed: " + t._0);
+  let match = LocalAuth$ReventlessLocal.Login.verifyAndDecode(token + "x");
+  if (match !== undefined) {
+    return Stdlib_JsError.throwWithMessage("expected verifyAndDecode to reject tampered signature");
+  }
+});
+
+globalThis.test("verifyAndDecode rejects a malformed token (no dot)", async () => {
+  resetAll();
+  let match = LocalAuth$ReventlessLocal.Login.verifyAndDecode("not-a-real-token");
+  if (match !== undefined) {
+    return Stdlib_JsError.throwWithMessage("expected None for malformed token");
+  }
+});
+
+globalThis.test("authenticate accepts a valid Bearer token", async () => {
+  resetAll();
+  LocalAuth$ReventlessLocal.Login.setCredentials("bob", "bob-pw", bob);
+  let t = await LocalAuth$ReventlessLocal.Login.issue("bob", "bob-pw");
+  let token;
+  token = t.TAG === "Ok" ? t._0 : Stdlib_JsError.throwWithMessage("issue failed: " + t._0);
+  let result = await LocalAuth$ReventlessLocal.authenticate(buildContext([[
+      "authorization",
+      "Bearer " + token
+    ]]));
+  if (typeof result !== "object") {
+    return Stdlib_JsError.throwWithMessage("expected Authenticated(bob)");
+  }
+  if (result.TAG !== "Authenticated") {
+    return Stdlib_JsError.throwWithMessage("expected Authenticated(bob)");
+  }
+  let identity = result._0;
+  globalThis.expect(identity.username).toEqual("bob");
+  globalThis.expect(identity.groups).toEqual(["Viewer"]);
+});
+
+globalThis.test("authenticate rejects invalid Bearer even when X-User is present", async () => {
+  resetAll();
+  let result = await LocalAuth$ReventlessLocal.authenticate(buildContext([
+    [
+      "authorization",
+      "Bearer not-a-token"
+    ],
+    [
+      "x-user",
+      "admin"
+    ]
+  ]));
+  if (typeof result !== "object" || result.TAG === "Authenticated") {
+    return Stdlib_JsError.throwWithMessage("expected AuthError for invalid Bearer");
+  }
+});
+
+globalThis.test("Bearer outranks X-User when both present and Bearer is valid", async () => {
+  resetAll();
+  LocalAuth$ReventlessLocal.Login.setCredentials("bob", "bob-pw", bob);
+  let t = await LocalAuth$ReventlessLocal.Login.issue("bob", "bob-pw");
+  let token;
+  token = t.TAG === "Ok" ? t._0 : Stdlib_JsError.throwWithMessage("issue failed: " + t._0);
+  let result = await LocalAuth$ReventlessLocal.authenticate(buildContext([
+    [
+      "authorization",
+      "Bearer " + token
+    ],
+    [
+      "x-user",
+      "admin"
+    ]
+  ]));
+  if (typeof result !== "object") {
+    return Stdlib_JsError.throwWithMessage("expected Bearer to outrank X-User");
+  }
+  if (result.TAG !== "Authenticated") {
+    return Stdlib_JsError.throwWithMessage("expected Bearer to outrank X-User");
+  }
+  globalThis.expect(result._0.username).toEqual("bob");
+});
+
+globalThis.test("setCredentials mirrors identity into the X-User registry", async () => {
+  resetAll();
+  LocalAuth$ReventlessLocal.Login.setCredentials("alice", "alice-pw", alice);
+  let result = await LocalAuth$ReventlessLocal.authenticate(buildContext([[
+      "x-user",
+      "alice"
+    ]]));
+  if (typeof result !== "object") {
+    return Stdlib_JsError.throwWithMessage("expected Authenticated(alice) via X-User");
+  }
+  if (result.TAG !== "Authenticated") {
+    return Stdlib_JsError.throwWithMessage("expected Authenticated(alice) via X-User");
+  }
+  let identity = result._0;
+  globalThis.expect(identity.userId).toEqual("u-alice");
+  globalThis.expect(identity.groups).toEqual(["Editor"]);
+});
+
+export {
+  alice,
+  bob,
+  buildContext,
+  resetAll,
+}
+/*  Not a pure module */

package/tests/adapter/LocalAuthTest.res

@@ -0,0 +1,106 @@
+// Extraction matrix for LocalAuth.authenticate. Each test resets the
+// user registry first so cross-test mutation in registerUser doesn't leak.
+
+@@warning("-44")
+
+open JestGlobals
+
+let buildContext = (headers: array<(string, string)>): ReventlessCore.Auth_Adapter.requestContext => {
+  headers: Dict.fromArray(headers),
+}
+
+testPromise("no X-User, no X-Groups → defaultUser (in-memory dev convenience)", async () => {
+  LocalAuth.resetUsers()
+  let result = await LocalAuth.authenticate(buildContext([]))
+  switch result {
+  | Authenticated(identity) =>
+    expect(identity.username)->toEqual("user")
+    expect(identity.groups)->toEqual(["User"])
+  | _ => JsError.throwWithMessage("expected Authenticated(defaultUser)")
+  }
+})
+
+testPromise("X-User: admin resolves built-in admin identity", async () => {
+  LocalAuth.resetUsers()
+  let result = await LocalAuth.authenticate(
+    buildContext([("x-user", "admin")]),
+  )
+  switch result {
+  | Authenticated(identity) =>
+    expect(identity.username)->toEqual("admin")
+    expect(identity.groups)->toEqual(["Admin", "User"])
+  | _ => JsError.throwWithMessage("expected Authenticated")
+  }
+})
+
+testPromise("X-User: user resolves built-in default identity", async () => {
+  LocalAuth.resetUsers()
+  let result = await LocalAuth.authenticate(
+    buildContext([("x-user", "user")]),
+  )
+  switch result {
+  | Authenticated(identity) =>
+    expect(identity.username)->toEqual("user")
+    expect(identity.groups)->toEqual(["User"])
+  | _ => JsError.throwWithMessage("expected Authenticated")
+  }
+})
+
+testPromise("unknown X-User falls back to Anonymous", async () => {
+  LocalAuth.resetUsers()
+  let result = await LocalAuth.authenticate(
+    buildContext([("x-user", "unknown")]),
+  )
+  switch result {
+  | Anonymous => ()
+  | _ => JsError.throwWithMessage("expected Anonymous")
+  }
+})
+
+testPromise("X-Groups overrides the resolved identity's groups", async () => {
+  LocalAuth.resetUsers()
+  let result = await LocalAuth.authenticate(
+    buildContext([("x-user", "admin"), ("x-groups", "Editor, Viewer")]),
+  )
+  switch result {
+  | Authenticated(identity) =>
+    expect(identity.username)->toEqual("admin")
+    expect(identity.groups)->toEqual(["Editor", "Viewer"])
+  | _ => JsError.throwWithMessage("expected Authenticated")
+  }
+})
+
+testPromise("X-Groups alone yields defaultUser tagged with the override groups", async () => {
+  LocalAuth.resetUsers()
+  let result = await LocalAuth.authenticate(
+    buildContext([("x-groups", "Tester")]),
+  )
+  switch result {
+  | Authenticated(identity) =>
+    expect(identity.userId)->toEqual("local-user")
+    expect(identity.groups)->toEqual(["Tester"])
+  | _ => JsError.throwWithMessage("expected Authenticated")
+  }
+})
+
+testPromise("registerUser injects a custom identity", async () => {
+  LocalAuth.resetUsers()
+  LocalAuth.registerUser(
+    ~username="alice",
+    ~identity={
+      userId: "alice-id",
+      username: "alice",
+      groups: ["Editor"],
+      provider: InMemory,
+    },
+  )
+  let result = await LocalAuth.authenticate(
+    buildContext([("x-user", "alice")]),
+  )
+  switch result {
+  | Authenticated(identity) =>
+    expect(identity.userId)->toEqual("alice-id")
+    expect(identity.groups)->toEqual(["Editor"])
+  | _ => JsError.throwWithMessage("expected Authenticated")
+  }
+})

package/tests/adapter/LocalAuthTest.res.mjs

@@ -0,0 +1,145 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as LocalAuth$ReventlessLocal from "../../src/adapter/Auth/LocalAuth.res.mjs";
+
+function buildContext(headers) {
+  return {
+    headers: Object.fromEntries(headers)
+  };
+}
+
+globalThis.test("no X-User, no X-Groups → defaultUser (in-memory dev convenience)", async () => {
+  LocalAuth$ReventlessLocal.resetUsers();
+  let result = await LocalAuth$ReventlessLocal.authenticate(buildContext([]));
+  if (typeof result !== "object") {
+    return Stdlib_JsError.throwWithMessage("expected Authenticated(defaultUser)");
+  }
+  if (result.TAG !== "Authenticated") {
+    return Stdlib_JsError.throwWithMessage("expected Authenticated(defaultUser)");
+  }
+  let identity = result._0;
+  globalThis.expect(identity.username).toEqual("user");
+  globalThis.expect(identity.groups).toEqual(["User"]);
+});
+
+globalThis.test("X-User: admin resolves built-in admin identity", async () => {
+  LocalAuth$ReventlessLocal.resetUsers();
+  let result = await LocalAuth$ReventlessLocal.authenticate(buildContext([[
+      "x-user",
+      "admin"
+    ]]));
+  if (typeof result !== "object") {
+    return Stdlib_JsError.throwWithMessage("expected Authenticated");
+  }
+  if (result.TAG !== "Authenticated") {
+    return Stdlib_JsError.throwWithMessage("expected Authenticated");
+  }
+  let identity = result._0;
+  globalThis.expect(identity.username).toEqual("admin");
+  globalThis.expect(identity.groups).toEqual([
+    "Admin",
+    "User"
+  ]);
+});
+
+globalThis.test("X-User: user resolves built-in default identity", async () => {
+  LocalAuth$ReventlessLocal.resetUsers();
+  let result = await LocalAuth$ReventlessLocal.authenticate(buildContext([[
+      "x-user",
+      "user"
+    ]]));
+  if (typeof result !== "object") {
+    return Stdlib_JsError.throwWithMessage("expected Authenticated");
+  }
+  if (result.TAG !== "Authenticated") {
+    return Stdlib_JsError.throwWithMessage("expected Authenticated");
+  }
+  let identity = result._0;
+  globalThis.expect(identity.username).toEqual("user");
+  globalThis.expect(identity.groups).toEqual(["User"]);
+});
+
+globalThis.test("unknown X-User falls back to Anonymous", async () => {
+  LocalAuth$ReventlessLocal.resetUsers();
+  let result = await LocalAuth$ReventlessLocal.authenticate(buildContext([[
+      "x-user",
+      "unknown"
+    ]]));
+  if (typeof result !== "object") {
+    return;
+  } else {
+    return Stdlib_JsError.throwWithMessage("expected Anonymous");
+  }
+});
+
+globalThis.test("X-Groups overrides the resolved identity's groups", async () => {
+  LocalAuth$ReventlessLocal.resetUsers();
+  let result = await LocalAuth$ReventlessLocal.authenticate(buildContext([
+    [
+      "x-user",
+      "admin"
+    ],
+    [
+      "x-groups",
+      "Editor, Viewer"
+    ]
+  ]));
+  if (typeof result !== "object") {
+    return Stdlib_JsError.throwWithMessage("expected Authenticated");
+  }
+  if (result.TAG !== "Authenticated") {
+    return Stdlib_JsError.throwWithMessage("expected Authenticated");
+  }
+  let identity = result._0;
+  globalThis.expect(identity.username).toEqual("admin");
+  globalThis.expect(identity.groups).toEqual([
+    "Editor",
+    "Viewer"
+  ]);
+});
+
+globalThis.test("X-Groups alone yields defaultUser tagged with the override groups", async () => {
+  LocalAuth$ReventlessLocal.resetUsers();
+  let result = await LocalAuth$ReventlessLocal.authenticate(buildContext([[
+      "x-groups",
+      "Tester"
+    ]]));
+  if (typeof result !== "object") {
+    return Stdlib_JsError.throwWithMessage("expected Authenticated");
+  }
+  if (result.TAG !== "Authenticated") {
+    return Stdlib_JsError.throwWithMessage("expected Authenticated");
+  }
+  let identity = result._0;
+  globalThis.expect(identity.userId).toEqual("local-user");
+  globalThis.expect(identity.groups).toEqual(["Tester"]);
+});
+
+globalThis.test("registerUser injects a custom identity", async () => {
+  LocalAuth$ReventlessLocal.resetUsers();
+  LocalAuth$ReventlessLocal.registerUser("alice", {
+    userId: "alice-id",
+    username: "alice",
+    groups: ["Editor"],
+    provider: "InMemory"
+  });
+  let result = await LocalAuth$ReventlessLocal.authenticate(buildContext([[
+      "x-user",
+      "alice"
+    ]]));
+  if (typeof result !== "object") {
+    return Stdlib_JsError.throwWithMessage("expected Authenticated");
+  }
+  if (result.TAG !== "Authenticated") {
+    return Stdlib_JsError.throwWithMessage("expected Authenticated");
+  }
+  let identity = result._0;
+  globalThis.expect(identity.userId).toEqual("alice-id");
+  globalThis.expect(identity.groups).toEqual(["Editor"]);
+});
+
+export {
+  buildContext,
+}
+/*  Not a pure module */

package/tests/adapter/LocalAuthUserStoreTest.res

@@ -0,0 +1,172 @@
+// Stage A4 — UserStore.load resolution order and YAML parsing.
+
+@@warning("-44")
+
+open JestGlobals
+
+@module("node:fs") external _writeFileSync: (string, string, string) => unit = "writeFileSync"
+@module("node:fs") external _mkdtempSync: string => string = "mkdtempSync"
+@module("node:fs") external _rmSync: (string, {..}) => unit = "rmSync"
+@module("node:path") external _join: (string, string) => string = "join"
+@module("node:os") external _tmpdir: unit => string = "tmpdir"
+
+let resetAll = () => {
+  LocalAuth.resetUsers()
+  LocalAuth.Login.resetStore()
+  UserStore.resetResolution()
+}
+
+let _writeYamlFile = (contents: string): string => {
+  let dir = _mkdtempSync(_join(_tmpdir(), "reventless-userstore-"))
+  let path = _join(dir, "users.yaml")
+  _writeFileSync(path, contents, "utf8")
+  path
+}
+
+testPromise("parseString decodes a well-formed YAML document", async () => {
+  let yaml = `
+- username: alice
+  password: alice-pw
+  groups: [Editor]
+- username: bob
+  password: bob-pw
+  groups: []
+`
+  switch UserStore.parseString(yaml) {
+  | Ok(entries) =>
+    expect(entries->Array.length)->toEqual(2)
+    let first = entries->Array.getUnsafe(0)
+    expect(first.username)->toEqual("alice")
+    expect(first.password)->toEqual("alice-pw")
+    expect(first.groups)->toEqual(["Editor"])
+  | Error(msg) => JsError.throwWithMessage("parseString failed: " ++ msg)
+  }
+})
+
+testPromise("parseString rejects malformed YAML", async () => {
+  switch UserStore.parseString("not: valid: yaml: at all: ::") {
+  | Error(_) => ()
+  | Ok(_) => JsError.throwWithMessage("expected Error for malformed YAML")
+  }
+})
+
+testPromise("parseString rejects entries missing required fields", async () => {
+  let yaml = `
+- username: alice
+  groups: [Editor]
+`
+  switch UserStore.parseString(yaml) {
+  | Error(_) => ()
+  | Ok(_) => JsError.throwWithMessage("expected Error for missing password")
+  }
+})
+
+testPromise("load(~users) registers credentials and returns InlineUsers", async () => {
+  resetAll()
+  let entries: array<UserStore.entry> = [
+    {username: "alice", password: "alice-pw", groups: ["Editor"]},
+    {username: "bob", password: "bob-pw", groups: [], userId: "u-bob"},
+  ]
+  switch UserStore.load(~users=entries, ()) {
+  | Ok(InlineUsers) => ()
+  | Ok(_) => JsError.throwWithMessage("expected InlineUsers")
+  | Error(msg) => JsError.throwWithMessage("load failed: " ++ msg)
+  }
+  // Verify Login.issue accepts the credentials.
+  let result = await LocalAuth.Login.issue(~username="alice", ~password="alice-pw")
+  switch result {
+  | Ok(_) => ()
+  | Error(msg) => JsError.throwWithMessage("issue rejected loaded credentials: " ++ msg)
+  }
+  // userId override is honored.
+  switch LocalAuth.lookupUser("bob") {
+  | Some(identity) => expect(identity.userId)->toEqual("u-bob")
+  | None => JsError.throwWithMessage("bob not in user registry")
+  }
+})
+
+testPromise("load(~usersFile) reads a YAML file from disk", async () => {
+  resetAll()
+  let path = _writeYamlFile(`
+- username: carol
+  password: carol-pw
+  groups: [Admin]
+`)
+  switch UserStore.load(~usersFile=path, ()) {
+  | Ok(UsersFile(p)) => expect(p)->toEqual(path)
+  | Ok(_) => JsError.throwWithMessage("expected UsersFile resolution")
+  | Error(msg) => JsError.throwWithMessage("load failed: " ++ msg)
+  }
+  let result = await LocalAuth.Login.issue(~username="carol", ~password="carol-pw")
+  switch result {
+  | Ok(_) => ()
+  | Error(msg) => JsError.throwWithMessage("issue rejected file-loaded credentials: " ++ msg)
+  }
+  _rmSync(path, {"force": true})
+})
+
+testPromise("load(~usersFile) returns Error when the file is missing", async () => {
+  resetAll()
+  switch UserStore.load(~usersFile="/tmp/does-not-exist-reventless.yaml", ()) {
+  | Error(_) => ()
+  | Ok(_) => JsError.throwWithMessage("expected Error for missing file")
+  }
+})
+
+testPromise("load() with no args + no default file returns Empty", async () => {
+  resetAll()
+  // The test's cwd has no .reventless/users.yaml — verify Empty is returned.
+  // (The package's own cwd is reventless-local/ during `pnpm test`, where
+  // no such file exists.)
+  switch UserStore.load() {
+  | Ok(Empty) => ()
+  | Ok(DefaultFile(_)) =>
+    // If a .reventless/users.yaml happens to exist in CI, accept it.
+    ()
+  | Ok(_) => JsError.throwWithMessage("expected Empty or DefaultFile")
+  | Error(msg) => JsError.throwWithMessage("load failed: " ++ msg)
+  }
+})
+
+testPromise("inline users win over a file path", async () => {
+  resetAll()
+  let path = _writeYamlFile(`
+- username: file-user
+  password: file-pw
+  groups: []
+`)
+  let inline: array<UserStore.entry> = [
+    {username: "inline-user", password: "inline-pw", groups: []},
+  ]
+  switch UserStore.load(~users=inline, ~usersFile=path, ()) {
+  | Ok(InlineUsers) => ()
+  | Ok(_) => JsError.throwWithMessage("expected InlineUsers (inline should win)")
+  | Error(msg) => JsError.throwWithMessage("load failed: " ++ msg)
+  }
+  // file-user must NOT be in the registry.
+  switch LocalAuth.lookupUser("file-user") {
+  | None => ()
+  | Some(_) => JsError.throwWithMessage("file-user leaked into registry despite inline override")
+  }
+  switch LocalAuth.lookupUser("inline-user") {
+  | Some(_) => ()
+  | None => JsError.throwWithMessage("inline-user missing from registry")
+  }
+  _rmSync(path, {"force": true})
+})
+
+testPromise("autoLoadOnce is a no-op after an explicit load", async () => {
+  resetAll()
+  let _ = UserStore.load(
+    ~users=[{username: "x", password: "x", groups: []}],
+    (),
+  )
+  // Second call should not crash even if .reventless/users.yaml doesn't
+  // exist; resolved=true prevents the default-discovery branch.
+  UserStore.autoLoadOnce()
+  // Sanity: explicit-load registration persists.
+  switch LocalAuth.lookupUser("x") {
+  | Some(_) => ()
+  | None => JsError.throwWithMessage("autoLoadOnce wiped explicit registration")
+  }
+})