@samebase/identity-broker 0.0.0-stage → 0.2.0

package/dist/component/authRequests.js

@@ -0,0 +1,461 @@
+import { v } from "convex/values";
+import { mutation, query } from "./_generated/server";
+import { sha256Base64Url } from "./crypto";
+import { vAuthRequest, vUpstreamIdentity } from "./schema";
+const { boolean, literal, number, object, optional, string, union } = v;
+/** Where the user goes back to once a request fails or finishes: the client's exact redirect URI. */
+const vReturn = object({ redirectUri: string(), state: optional(string()) });
+const vTransitionResult = union(object({ ok: literal(true), ...vReturn.fields }), object({
+    ok: literal(false),
+    error: union(literal("expired"), literal("wrong_status")),
+    ...vReturn.fields,
+}), object({ ok: literal(false), error: literal("not_found") }));
+async function findByRequestId(ctx, requestId) {
+    return await ctx.db
+        .query("authRequests")
+        .withIndex("by_request_id", (q) => q.eq("requestId", requestId))
+        .unique();
+}
+/** Stores a validated /authorize request. The caller has already checked the client and redirect URI. */
+export const create = mutation({
+    args: {
+        requestId: string(),
+        appId: string(),
+        clientId: string(),
+        redirectUri: string(),
+        scope: string(),
+        state: optional(string()),
+        nonce: optional(string()),
+        codeChallenge: string(),
+        freshLogin: boolean(),
+        txnCookieHash: optional(string()),
+        createdAt: number(),
+        expiresAt: number(),
+    },
+    returns: v.null(),
+    handler: async (ctx, args) => {
+        await ctx.db.insert("authRequests", {
+            status: "pending",
+            requestId: args.requestId,
+            appId: args.appId,
+            clientId: args.clientId,
+            redirectUri: args.redirectUri,
+            scope: args.scope,
+            ...optionalField("state", args.state),
+            ...optionalField("nonce", args.nonce),
+            codeChallenge: args.codeChallenge,
+            freshLogin: args.freshLogin,
+            ...optionalField("txnCookieHash", args.txnCookieHash),
+            createdAt: args.createdAt,
+            expiresAt: args.expiresAt,
+        });
+        return null;
+    },
+});
+export const get = query({
+    args: { requestId: string() },
+    returns: union(vAuthRequest, v.null()),
+    handler: async (ctx, args) => {
+        const request = await ctx.db
+            .query("authRequests")
+            .withIndex("by_request_id", (q) => q.eq("requestId", args.requestId))
+            .unique();
+        if (request === null) {
+            return null;
+        }
+        const { _id, _creationTime, ...fields } = request;
+        return fields;
+    },
+});
+/** The user chose an OAuth or OIDC connector; the request now waits for that connector's callback. */
+export const startUpstream = mutation({
+    args: {
+        requestId: string(),
+        connector: string(),
+        upstreamStateHash: string(),
+        upstreamCodeVerifier: string(),
+        upstreamNonce: optional(string()),
+        now: number(),
+    },
+    returns: vTransitionResult,
+    handler: async (ctx, args) => {
+        const request = await findByRequestId(ctx, args.requestId);
+        if (request === null) {
+            return { ok: false, error: "not_found" };
+        }
+        const back = returnTo(request);
+        if (request.expiresAt <= args.now) {
+            return { ok: false, error: "expired", ...back };
+        }
+        // A chooser page can be reloaded, so a pending request may start upstream more than once; the
+        // newest state hash wins. Any other status means the flow already moved on.
+        if (request.status !== "pending" && request.status !== "upstream") {
+            return { ok: false, error: "wrong_status", ...back };
+        }
+        await ctx.db.replace("authRequests", request._id, {
+            status: "upstream",
+            ...baseFields(request),
+            connector: args.connector,
+            upstreamStateHash: args.upstreamStateHash,
+            upstreamCodeVerifier: args.upstreamCodeVerifier,
+            ...optionalField("upstreamNonce", args.upstreamNonce),
+        });
+        return { ok: true, ...back };
+    },
+});
+const vClaimResult = union(object({
+    status: literal("claimed"),
+    requestId: string(),
+    connector: string(),
+    upstreamCodeVerifier: string(),
+    upstreamNonce: optional(string()),
+    freshLogin: boolean(),
+    ...vReturn.fields,
+}), object({ status: literal("expired"), ...vReturn.fields }), object({ status: literal("missing") }));
+/**
+ * The callback of `connector` arrived with its state. Claiming moves the request to `claimed` in
+ * the same mutation that finds it, so a replayed or raced callback finds nothing to claim. A
+ * request started for another connector is not claimed: its state cannot finish elsewhere.
+ */
+export const claimUpstream = mutation({
+    args: { upstreamStateHash: string(), connector: string(), now: number() },
+    returns: vClaimResult,
+    handler: async (ctx, args) => {
+        const request = await ctx.db
+            .query("authRequests")
+            .withIndex("by_upstream_state_hash", (q) => q.eq("upstreamStateHash", args.upstreamStateHash))
+            .unique();
+        if (request === null || request.status !== "upstream" || request.connector !== args.connector) {
+            return { status: "missing" };
+        }
+        const back = returnTo(request);
+        if (request.expiresAt <= args.now) {
+            await ctx.db.delete("authRequests", request._id);
+            return { status: "expired", ...back };
+        }
+        await ctx.db.replace("authRequests", request._id, {
+            status: "claimed",
+            ...baseFields(request),
+            connector: request.connector,
+        });
+        return {
+            status: "claimed",
+            requestId: request.requestId,
+            connector: request.connector,
+            upstreamCodeVerifier: request.upstreamCodeVerifier,
+            ...optionalField("upstreamNonce", request.upstreamNonce),
+            freshLogin: request.freshLogin,
+            ...back,
+        };
+    },
+});
+/** Codes one request may send. */
+const EMAIL_SENDS_PER_REQUEST = 3;
+/** The least time between two sends of one request. */
+const EMAIL_SEND_INTERVAL_MS = 60 * 1000;
+/** Codes one address may receive in `EMAIL_SEND_WINDOW_MS`, across all requests. */
+const EMAIL_SENDS_PER_ADDRESS = 5;
+/** Codes the broker sends in `EMAIL_SEND_WINDOW_MS`, across all addresses. */
+const EMAIL_SENDS_GLOBAL = 200;
+/** The rolling window of the per-address count; `lifecycle.cleanup` drops older `emailSends` rows. */
+export const EMAIL_SEND_WINDOW_MS = 60 * 60 * 1000;
+const vStartEmailResult = union(object({ ok: literal(true), ...vReturn.fields }), object({
+    ok: literal(false),
+    error: union(literal("expired"), literal("wrong_status"), literal("locked"), literal("too_soon"), literal("request_limit"), literal("address_limit"), literal("global_limit")),
+    ...vReturn.fields,
+}), object({ ok: literal(false), error: literal("not_found") }));
+/**
+ * The user chose the email connector and typed an address; a code may be sent to it. A request
+ * sends at most `EMAIL_SENDS_PER_REQUEST` codes, `EMAIL_SEND_INTERVAL_MS` apart, an address
+ * receives at most `EMAIL_SENDS_PER_ADDRESS` codes per `EMAIL_SEND_WINDOW_MS`, and the broker sends
+ * at most `EMAIL_SENDS_GLOBAL` in that window. A resend replaces the code and keeps the attempt
+ * count, so a request locked by `maxAttempts` wrong codes stays locked.
+ */
+export const startEmail = mutation({
+    args: {
+        requestId: string(),
+        connector: string(),
+        email: string(),
+        /** SHA-256 hex of the canonical address. */
+        emailHash: string(),
+        emailCodeHash: string(),
+        emailCodeExpiresAt: number(),
+        maxAttempts: number(),
+        now: number(),
+    },
+    returns: vStartEmailResult,
+    handler: async (ctx, args) => {
+        const request = await findByRequestId(ctx, args.requestId);
+        if (request === null) {
+            return { ok: false, error: "not_found" };
+        }
+        const back = returnTo(request);
+        if (request.expiresAt <= args.now) {
+            return { ok: false, error: "expired", ...back };
+        }
+        if (request.status !== "pending" && request.status !== "emailSent") {
+            return { ok: false, error: "wrong_status", ...back };
+        }
+        const sent = request.status === "emailSent"
+            ? {
+                sends: request.emailSends,
+                lastSentAt: request.emailLastSentAt,
+                attempts: request.emailAttempts,
+            }
+            : { sends: 0, lastSentAt: undefined, attempts: 0 };
+        if (sent.attempts >= args.maxAttempts) {
+            return { ok: false, error: "locked", ...back };
+        }
+        if (sent.sends >= EMAIL_SENDS_PER_REQUEST) {
+            return { ok: false, error: "request_limit", ...back };
+        }
+        if (sent.lastSentAt !== undefined && args.now - sent.lastSentAt < EMAIL_SEND_INTERVAL_MS) {
+            return { ok: false, error: "too_soon", ...back };
+        }
+        const recentToAddress = await ctx.db
+            .query("emailSends")
+            .withIndex("by_email_hash_and_at", (q) => q.eq("emailHash", args.emailHash).gt("at", args.now - EMAIL_SEND_WINDOW_MS))
+            .take(EMAIL_SENDS_PER_ADDRESS);
+        if (recentToAddress.length >= EMAIL_SENDS_PER_ADDRESS) {
+            return { ok: false, error: "address_limit", ...back };
+        }
+        const recent = await ctx.db
+            .query("emailSends")
+            .withIndex("by_at", (q) => q.gt("at", args.now - EMAIL_SEND_WINDOW_MS))
+            .take(EMAIL_SENDS_GLOBAL);
+        if (recent.length >= EMAIL_SENDS_GLOBAL) {
+            return { ok: false, error: "global_limit", ...back };
+        }
+        await ctx.db.insert("emailSends", { emailHash: args.emailHash, at: args.now });
+        await ctx.db.replace("authRequests", request._id, {
+            status: "emailSent",
+            ...baseFields(request),
+            connector: args.connector,
+            email: args.email,
+            emailCodeHash: args.emailCodeHash,
+            emailCodeExpiresAt: args.emailCodeExpiresAt,
+            emailAttempts: sent.attempts,
+            emailSends: sent.sends + 1,
+            emailLastSentAt: args.now,
+        });
+        return { ok: true, ...back };
+    },
+});
+const vVerifyEmailResult = union(object({ ok: literal(true), ...vReturn.fields }), object({
+    ok: literal(false),
+    error: union(literal("wrong_code"), literal("locked"), literal("code_expired"), literal("expired"), literal("wrong_status")),
+    ...vReturn.fields,
+}), object({ ok: literal(false), error: literal("not_found") }));
+/**
+ * Checks a typed email code. A match completes the request with the canonical address as the
+ * upstream identity and issues the authorization code; a miss counts an attempt, and the request
+ * locks at `maxAttempts`.
+ */
+export const verifyEmailCode = mutation({
+    args: {
+        requestId: string(),
+        emailCodeHash: string(),
+        maxAttempts: number(),
+        codeHash: string(),
+        codeExpiresAt: number(),
+        now: number(),
+    },
+    returns: vVerifyEmailResult,
+    handler: async (ctx, args) => {
+        const request = await findByRequestId(ctx, args.requestId);
+        if (request === null) {
+            return { ok: false, error: "not_found" };
+        }
+        const back = returnTo(request);
+        if (request.expiresAt <= args.now) {
+            return { ok: false, error: "expired", ...back };
+        }
+        if (request.status !== "emailSent") {
+            return { ok: false, error: "wrong_status", ...back };
+        }
+        if (request.emailCodeExpiresAt <= args.now) {
+            return { ok: false, error: "code_expired", ...back };
+        }
+        if (request.emailAttempts >= args.maxAttempts) {
+            return { ok: false, error: "locked", ...back };
+        }
+        if (request.emailCodeHash !== args.emailCodeHash) {
+            const attempts = request.emailAttempts + 1;
+            await ctx.db.patch("authRequests", request._id, { emailAttempts: attempts });
+            return { ok: false, error: attempts >= args.maxAttempts ? "locked" : "wrong_code", ...back };
+        }
+        await ctx.db.replace("authRequests", request._id, {
+            status: "completed",
+            ...baseFields(request),
+            expiresAt: completedExpiresAt(request, args.codeExpiresAt),
+            identity: {
+                connector: request.connector,
+                upstreamId: request.email,
+                email: request.email,
+                emailVerified: true,
+            },
+            authTime: args.now,
+        });
+        await ctx.db.insert("authorizationCodes", {
+            codeHash: args.codeHash,
+            authRequestId: request._id,
+            clientId: request.clientId,
+            expiresAt: args.codeExpiresAt,
+        });
+        return { ok: true, ...back };
+    },
+});
+/** The connector attested the identity after a claim; the authorization code can be handed out. */
+export const complete = mutation({
+    args: {
+        requestId: string(),
+        identity: vUpstreamIdentity,
+        authTime: number(),
+        codeHash: string(),
+        codeExpiresAt: number(),
+        now: number(),
+    },
+    returns: vTransitionResult,
+    handler: async (ctx, args) => {
+        const request = await findByRequestId(ctx, args.requestId);
+        if (request === null) {
+            return { ok: false, error: "not_found" };
+        }
+        const back = returnTo(request);
+        if (request.expiresAt <= args.now) {
+            return { ok: false, error: "expired", ...back };
+        }
+        if (request.status !== "claimed") {
+            return { ok: false, error: "wrong_status", ...back };
+        }
+        await ctx.db.replace("authRequests", request._id, {
+            status: "completed",
+            ...baseFields(request),
+            expiresAt: completedExpiresAt(request, args.codeExpiresAt),
+            identity: args.identity,
+            authTime: args.authTime,
+        });
+        await ctx.db.insert("authorizationCodes", {
+            codeHash: args.codeHash,
+            authRequestId: request._id,
+            clientId: request.clientId,
+            expiresAt: args.codeExpiresAt,
+        });
+        return { ok: true, ...back };
+    },
+});
+/** Deletes a request the user abandoned at the hub, such as a declined consent. */
+export const abandon = mutation({
+    args: { requestId: string() },
+    returns: union(vReturn, v.null()),
+    handler: async (ctx, args) => {
+        const request = await findByRequestId(ctx, args.requestId);
+        if (request === null) {
+            return null;
+        }
+        await ctx.db.delete("authRequests", request._id);
+        return returnTo(request);
+    },
+});
+const vExchangeResult = union(object({
+    ok: literal(true),
+    appId: string(),
+    clientId: string(),
+    scope: string(),
+    nonce: optional(string()),
+    identity: vUpstreamIdentity,
+    authTime: number(),
+}), object({ ok: literal(false), description: string() }));
+/**
+ * Redeems an authorization code: single use, bound to the client, the redirect URI and the PKCE
+ * challenge of its request (OAuth 2.1 section 4.1.3). On success the code and the request are gone.
+ */
+export const exchangeCode = mutation({
+    args: {
+        codeHash: string(),
+        clientId: string(),
+        redirectUri: optional(string()),
+        codeVerifier: string(),
+        now: number(),
+    },
+    returns: vExchangeResult,
+    handler: async (ctx, args) => {
+        const code = await ctx.db
+            .query("authorizationCodes")
+            .withIndex("by_code_hash", (q) => q.eq("codeHash", args.codeHash))
+            .unique();
+        if (code === null) {
+            return { ok: false, description: "The authorization code is unknown." };
+        }
+        if (code.usedAt !== undefined) {
+            // Replay: the code and its request are revoked (RFC 9700 section 4.5.3).
+            await ctx.db.delete("authorizationCodes", code._id);
+            const request = await ctx.db.get("authRequests", code.authRequestId);
+            if (request !== null) {
+                await ctx.db.delete("authRequests", request._id);
+            }
+            return { ok: false, description: "The authorization code was already used." };
+        }
+        if (code.expiresAt <= args.now) {
+            return { ok: false, description: "The authorization code expired." };
+        }
+        if (code.clientId !== args.clientId) {
+            return { ok: false, description: "The authorization code belongs to another client." };
+        }
+        const request = await ctx.db.get("authRequests", code.authRequestId);
+        if (request === null || request.status !== "completed") {
+            return { ok: false, description: "The authorization request is gone." };
+        }
+        if (args.redirectUri !== undefined && args.redirectUri !== request.redirectUri) {
+            return { ok: false, description: "redirect_uri does not match the authorization request." };
+        }
+        if ((await sha256Base64Url(args.codeVerifier)) !== request.codeChallenge) {
+            return { ok: false, description: "code_verifier does not match code_challenge." };
+        }
+        await ctx.db.patch("authorizationCodes", code._id, { usedAt: args.now });
+        await ctx.db.delete("authRequests", request._id);
+        return {
+            ok: true,
+            appId: request.appId,
+            clientId: request.clientId,
+            scope: request.scope,
+            ...optionalField("nonce", request.nonce),
+            identity: request.identity,
+            authTime: request.authTime,
+        };
+    },
+});
+function optionalField(key, value) {
+    return value === undefined ? {} : { [key]: value };
+}
+/**
+ * A completed request outlives its authorization code by a minute, so `lifecycle.cleanup` never
+ * deletes the request while its code can still be redeemed.
+ */
+function completedExpiresAt(request, codeExpiresAt) {
+    return Math.max(request.expiresAt, codeExpiresAt + 60 * 1000);
+}
+function returnTo(request) {
+    return { redirectUri: request.redirectUri, ...optionalField("state", request.state) };
+}
+/**
+ * The fields shared by every status, taken from a stored request. `replace` needs the whole
+ * document, and the status-specific fields of the old status must not leak into the new one.
+ */
+function baseFields(request) {
+    return {
+        requestId: request.requestId,
+        appId: request.appId,
+        clientId: request.clientId,
+        redirectUri: request.redirectUri,
+        scope: request.scope,
+        ...optionalField("state", request.state),
+        ...optionalField("nonce", request.nonce),
+        codeChallenge: request.codeChallenge,
+        freshLogin: request.freshLogin,
+        ...optionalField("txnCookieHash", request.txnCookieHash),
+        createdAt: request.createdAt,
+        expiresAt: request.expiresAt,
+    };
+}
+//# sourceMappingURL=authRequests.js.map

package/dist/component/authRequests.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authRequests.js","sourceRoot":"","sources":["../../src/component/authRequests.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAc,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAoB,MAAM,qBAAqB,CAAC;AAExE,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAE3D,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;AAExE,qGAAqG;AACrG,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;AAE7E,MAAM,iBAAiB,GAAG,KAAK,CAC7B,MAAM,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAChD,MAAM,CAAC;IACL,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC;IAClB,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACzD,GAAG,OAAO,CAAC,MAAM;CAClB,CAAC,EACF,MAAM,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC,CAC5D,CAAC;AAGF,KAAK,UAAU,eAAe,CAAC,GAAgB,EAAE,SAAiB;IAChE,OAAO,MAAM,GAAG,CAAC,EAAE;SAChB,KAAK,CAAC,cAAc,CAAC;SACrB,SAAS,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;SAC/D,MAAM,EAAE,CAAC;AACd,CAAC;AAED,yGAAyG;AACzG,MAAM,CAAC,MAAM,MAAM,GAAG,QAAQ,CAAC;IAC7B,IAAI,EAAE;QACJ,SAAS,EAAE,MAAM,EAAE;QACnB,KAAK,EAAE,MAAM,EAAE;QACf,QAAQ,EAAE,MAAM,EAAE;QAClB,WAAW,EAAE,MAAM,EAAE;QACrB,KAAK,EAAE,MAAM,EAAE;QACf,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QACzB,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QACzB,aAAa,EAAE,MAAM,EAAE;QACvB,UAAU,EAAE,OAAO,EAAE;QACrB,aAAa,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QACjC,SAAS,EAAE,MAAM,EAAE;QACnB,SAAS,EAAE,MAAM,EAAE;KACpB;IACD,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE;IACjB,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC3B,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,cAAc,EAAE;YAClC,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC;YACrC,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC;YACrC,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,GAAG,aAAa,CAAC,eAAe,EAAE,IAAI,CAAC,aAAa,CAAC;YACrD,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,CAAC;IACvB,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE;IAC7B,OAAO,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC3B,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,EAAE;aACzB,KAAK,CAAC,cAAc,CAAC;aACrB,SAAS,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;aACpE,MAAM,EAAE,CAAC;QACZ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC;QAClD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF,CAAC,CAAC;AAEH,sGAAsG;AACtG,MAAM,CAAC,MAAM,aAAa,GAAG,QAAQ,CAAC;IACpC,IAAI,EAAE;QACJ,SAAS,EAAE,MAAM,EAAE;QACnB,SAAS,EAAE,MAAM,EAAE;QACnB,iBAAiB,EAAE,MAAM,EAAE;QAC3B,oBAAoB,EAAE,MAAM,EAAE;QAC9B,aAAa,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QACjC,GAAG,EAAE,MAAM,EAAE;KACd;IACD,OAAO,EAAE,iBAAiB;IAC1B,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAA6B,EAAE;QACtD,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAC3C,CAAC;QACD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAClC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,IAAI,EAAE,CAAC;QAClD,CAAC;QACD,8FAA8F;QAC9F,4EAA4E;QAC5E,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAClE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,IAAI,EAAE,CAAC;QACvD,CAAC;QACD,MAAM,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,GAAG,EAAE;YAChD,MAAM,EAAE,UAAU;YAClB,GAAG,UAAU,CAAC,OAAO,CAAC;YACtB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,GAAG,aAAa,CAAC,eAAe,EAAE,IAAI,CAAC,aAAa,CAAC;SACtD,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;IAC/B,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,KAAK,CACxB,MAAM,CAAC;IACL,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC;IAC1B,SAAS,EAAE,MAAM,EAAE;IACnB,SAAS,EAAE,MAAM,EAAE;IACnB,oBAAoB,EAAE,MAAM,EAAE;IAC9B,aAAa,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACjC,UAAU,EAAE,OAAO,EAAE;IACrB,GAAG,OAAO,CAAC,MAAM;CAClB,CAAC,EACF,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EACzD,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CACvC,CAAC;AAGF;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,QAAQ,CAAC;IACpC,IAAI,EAAE,EAAE,iBAAiB,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;IACzE,OAAO,EAAE,YAAY;IACrB,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAwB,EAAE;QACjD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,EAAE;aACzB,KAAK,CAAC,cAAc,CAAC;aACrB,SAAS,CAAC,wBAAwB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,mBAAmB,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;aAC7F,MAAM,EAAE,CAAC;QACZ,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;YAC9F,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC/B,CAAC;QACD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAClC,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YACjD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,EAAE,CAAC;QACxC,CAAC;QACD,MAAM,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,GAAG,EAAE;YAChD,MAAM,EAAE,SAAS;YACjB,GAAG,UAAU,CAAC,OAAO,CAAC;YACtB,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC,CAAC;QACH,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;YAClD,GAAG,aAAa,CAAC,eAAe,EAAE,OAAO,CAAC,aAAa,CAAC;YACxD,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,GAAG,IAAI;SACR,CAAC;IACJ,CAAC;CACF,CAAC,CAAC;AAEH,kCAAkC;AAClC,MAAM,uBAAuB,GAAG,CAAC,CAAC;AAClC,uDAAuD;AACvD,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,CAAC;AACzC,oFAAoF;AACpF,MAAM,uBAAuB,GAAG,CAAC,CAAC;AAClC,8EAA8E;AAC9E,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAC/B,sGAAsG;AACtG,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnD,MAAM,iBAAiB,GAAG,KAAK,CAC7B,MAAM,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAChD,MAAM,CAAC;IACL,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC;IAClB,KAAK,EAAE,KAAK,CACV,OAAO,CAAC,SAAS,CAAC,EAClB,OAAO,CAAC,cAAc,CAAC,EACvB,OAAO,CAAC,QAAQ,CAAC,EACjB,OAAO,CAAC,UAAU,CAAC,EACnB,OAAO,CAAC,eAAe,CAAC,EACxB,OAAO,CAAC,eAAe,CAAC,EACxB,OAAO,CAAC,cAAc,CAAC,CACxB;IACD,GAAG,OAAO,CAAC,MAAM;CAClB,CAAC,EACF,MAAM,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC,CAC5D,CAAC;AAGF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,QAAQ,CAAC;IACjC,IAAI,EAAE;QACJ,SAAS,EAAE,MAAM,EAAE;QACnB,SAAS,EAAE,MAAM,EAAE;QACnB,KAAK,EAAE,MAAM,EAAE;QACf,4CAA4C;QAC5C,SAAS,EAAE,MAAM,EAAE;QACnB,aAAa,EAAE,MAAM,EAAE;QACvB,kBAAkB,EAAE,MAAM,EAAE;QAC5B,WAAW,EAAE,MAAM,EAAE;QACrB,GAAG,EAAE,MAAM,EAAE;KACd;IACD,OAAO,EAAE,iBAAiB;IAC1B,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAA6B,EAAE;QACtD,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAC3C,CAAC;QACD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAClC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,IAAI,EAAE,CAAC;QAClD,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YACnE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,IAAI,EAAE,CAAC;QACvD,CAAC;QACD,MAAM,IAAI,GACR,OAAO,CAAC,MAAM,KAAK,WAAW;YAC5B,CAAC,CAAC;gBACE,KAAK,EAAE,OAAO,CAAC,UAAU;gBACzB,UAAU,EAAE,OAAO,CAAC,eAAe;gBACnC,QAAQ,EAAE,OAAO,CAAC,aAAa;aAChC;YACH,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QACvD,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACtC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;QACjD,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,IAAI,uBAAuB,EAAE,CAAC;YAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,IAAI,EAAE,CAAC;QACxD,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,UAAU,GAAG,sBAAsB,EAAE,CAAC;YACzF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,CAAC;QACnD,CAAC;QACD,MAAM,eAAe,GAAG,MAAM,GAAG,CAAC,EAAE;aACjC,KAAK,CAAC,YAAY,CAAC;aACnB,SAAS,CAAC,sBAAsB,EAAE,CAAC,CAAC,EAAE,EAAE,CACvC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,GAAG,oBAAoB,CAAC,CAC5E;aACA,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACjC,IAAI,eAAe,CAAC,MAAM,IAAI,uBAAuB,EAAE,CAAC;YACtD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,IAAI,EAAE,CAAC;QACxD,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,EAAE;aACxB,KAAK,CAAC,YAAY,CAAC;aACnB,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,GAAG,oBAAoB,CAAC,CAAC;aACtE,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC5B,IAAI,MAAM,CAAC,MAAM,IAAI,kBAAkB,EAAE,CAAC;YACxC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,IAAI,EAAE,CAAC;QACvD,CAAC;QACD,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC/E,MAAM,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,GAAG,EAAE;YAChD,MAAM,EAAE,WAAW;YACnB,GAAG,UAAU,CAAC,OAAO,CAAC;YACtB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,aAAa,EAAE,IAAI,CAAC,QAAQ;YAC5B,UAAU,EAAE,IAAI,CAAC,KAAK,GAAG,CAAC;YAC1B,eAAe,EAAE,IAAI,CAAC,GAAG;SAC1B,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;IAC/B,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,KAAK,CAC9B,MAAM,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAChD,MAAM,CAAC;IACL,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC;IAClB,KAAK,EAAE,KAAK,CACV,OAAO,CAAC,YAAY,CAAC,EACrB,OAAO,CAAC,QAAQ,CAAC,EACjB,OAAO,CAAC,cAAc,CAAC,EACvB,OAAO,CAAC,SAAS,CAAC,EAClB,OAAO,CAAC,cAAc,CAAC,CACxB;IACD,GAAG,OAAO,CAAC,MAAM;CAClB,CAAC,EACF,MAAM,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC,CAC5D,CAAC;AAGF;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC;IACtC,IAAI,EAAE;QACJ,SAAS,EAAE,MAAM,EAAE;QACnB,aAAa,EAAE,MAAM,EAAE;QACvB,WAAW,EAAE,MAAM,EAAE;QACrB,QAAQ,EAAE,MAAM,EAAE;QAClB,aAAa,EAAE,MAAM,EAAE;QACvB,GAAG,EAAE,MAAM,EAAE;KACd;IACD,OAAO,EAAE,kBAAkB;IAC3B,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAA8B,EAAE;QACvD,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAC3C,CAAC;QACD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAClC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,IAAI,EAAE,CAAC;QAClD,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,IAAI,EAAE,CAAC;QACvD,CAAC;QACD,IAAI,OAAO,CAAC,kBAAkB,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAC3C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,IAAI,EAAE,CAAC;QACvD,CAAC;QACD,IAAI,OAAO,CAAC,aAAa,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;QACjD,CAAC;QACD,IAAI,OAAO,CAAC,aAAa,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;YACjD,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,GAAG,CAAC,CAAC;YAC3C,MAAM,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC7E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,EAAE,GAAG,IAAI,EAAE,CAAC;QAC/F,CAAC;QACD,MAAM,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,GAAG,EAAE;YAChD,MAAM,EAAE,WAAW;YACnB,GAAG,UAAU,CAAC,OAAO,CAAC;YACtB,SAAS,EAAE,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC;YAC1D,QAAQ,EAAE;gBACR,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,UAAU,EAAE,OAAO,CAAC,KAAK;gBACzB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,aAAa,EAAE,IAAI;aACpB;YACD,QAAQ,EAAE,IAAI,CAAC,GAAG;SACnB,CAAC,CAAC;QACH,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,oBAAoB,EAAE;YACxC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,aAAa,EAAE,OAAO,CAAC,GAAG;YAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,SAAS,EAAE,IAAI,CAAC,aAAa;SAC9B,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;IAC/B,CAAC;CACF,CAAC,CAAC;AAEH,mGAAmG;AACnG,MAAM,CAAC,MAAM,QAAQ,GAAG,QAAQ,CAAC;IAC/B,IAAI,EAAE;QACJ,SAAS,EAAE,MAAM,EAAE;QACnB,QAAQ,EAAE,iBAAiB;QAC3B,QAAQ,EAAE,MAAM,EAAE;QAClB,QAAQ,EAAE,MAAM,EAAE;QAClB,aAAa,EAAE,MAAM,EAAE;QACvB,GAAG,EAAE,MAAM,EAAE;KACd;IACD,OAAO,EAAE,iBAAiB;IAC1B,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAA6B,EAAE;QACtD,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAC3C,CAAC;QACD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAClC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,IAAI,EAAE,CAAC;QAClD,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,IAAI,EAAE,CAAC;QACvD,CAAC;QACD,MAAM,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,GAAG,EAAE;YAChD,MAAM,EAAE,WAAW;YACnB,GAAG,UAAU,CAAC,OAAO,CAAC;YACtB,SAAS,EAAE,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC;YAC1D,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;QACH,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,oBAAoB,EAAE;YACxC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,aAAa,EAAE,OAAO,CAAC,GAAG;YAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,SAAS,EAAE,IAAI,CAAC,aAAa;SAC9B,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;IAC/B,CAAC;CACF,CAAC,CAAC;AAEH,mFAAmF;AACnF,MAAM,CAAC,MAAM,OAAO,GAAG,QAAQ,CAAC;IAC9B,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE;IAC7B,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACjC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC3B,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACjD,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,KAAK,CAC3B,MAAM,CAAC;IACL,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC;IACjB,KAAK,EAAE,MAAM,EAAE;IACf,QAAQ,EAAE,MAAM,EAAE;IAClB,KAAK,EAAE,MAAM,EAAE;IACf,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACzB,QAAQ,EAAE,iBAAiB;IAC3B,QAAQ,EAAE,MAAM,EAAE;CACnB,CAAC,EACF,MAAM,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC,CACtD,CAAC;AAGF;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,QAAQ,CAAC;IACnC,IAAI,EAAE;QACJ,QAAQ,EAAE,MAAM,EAAE;QAClB,QAAQ,EAAE,MAAM,EAAE;QAClB,WAAW,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC/B,YAAY,EAAE,MAAM,EAAE;QACtB,GAAG,EAAE,MAAM,EAAE;KACd;IACD,OAAO,EAAE,eAAe;IACxB,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAA2B,EAAE;QACpD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,EAAE;aACtB,KAAK,CAAC,oBAAoB,CAAC;aAC3B,SAAS,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;aACjE,MAAM,EAAE,CAAC;QACZ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,oCAAoC,EAAE,CAAC;QAC1E,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,yEAAyE;YACzE,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,oBAAoB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;YACpD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;YACrE,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YACnD,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,0CAA0C,EAAE,CAAC;QAChF,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAC/B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,iCAAiC,EAAE,CAAC;QACvE,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,mDAAmD,EAAE,CAAC;QACzF,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QACrE,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YACvD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,oCAAoC,EAAE,CAAC;QAC1E,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;YAC/E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,wDAAwD,EAAE,CAAC;QAC9F,CAAC;QACD,IAAI,CAAC,MAAM,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,OAAO,CAAC,aAAa,EAAE,CAAC;YACzE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,8CAA8C,EAAE,CAAC;QACpF,CAAC;QACD,MAAM,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,oBAAoB,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACzE,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACjD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,GAAG,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC;YACxC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC;IACJ,CAAC;CACF,CAAC,CAAC;AAEH,SAAS,aAAa,CAAsB,GAAM,EAAE,KAAoB;IACtE,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAsB,CAAC;AAC1E,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,OAA4B,EAAE,aAAqB;IAC7E,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,aAAa,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,QAAQ,CAAC,OAA4B;IAC5C,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,GAAG,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;AACxF,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CAAC,OAA4B;IAC9C,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,GAAG,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC;QACxC,GAAG,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC;QACxC,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,GAAG,aAAa,CAAC,eAAe,EAAE,OAAO,CAAC,aAAa,CAAC;QACxD,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC;AACJ,CAAC"}

package/dist/component/clients.d.ts

@@ -0,0 +1,43 @@
+/** Registers one deployment of an app as a client with its single exact redirect URI. */
+export declare const create: import("convex/server").RegisteredMutation<"public", {
+    appId: string;
+    clientId: string;
+    clientName: string;
+    createdAt: number;
+    deploymentType: "development" | "preview" | "production";
+    redirectUri: string;
+    secretHash: string;
+    softwareVersion: string;
+    tokenEndpointAuthMethod: "client_secret_basic" | "client_secret_post";
+}, Promise<null>>;
+export declare const get: import("convex/server").RegisteredQuery<"public", {
+    clientId: string;
+}, Promise<{
+    appId: string;
+    clientId: string;
+    clientName: string;
+    createdAt: number;
+    deploymentType: "development" | "preview" | "production";
+    lastSignInAt?: number;
+    redirectUri: string;
+    secretHash: string;
+    softwareVersion: string;
+    tokenEndpointAuthMethod: "client_secret_basic" | "client_secret_post";
+} | null>>;
+export declare const listByApp: import("convex/server").RegisteredQuery<"public", {
+    appId: string;
+}, Promise<{
+    appId: string;
+    clientId: string;
+    clientName: string;
+    createdAt: number;
+    deploymentType: "development" | "preview" | "production";
+    lastSignInAt?: number;
+    redirectUri: string;
+    secretHash: string;
+    softwareVersion: string;
+    tokenEndpointAuthMethod: "client_secret_basic" | "client_secret_post";
+}[]>>;
+export declare const remove: import("convex/server").RegisteredMutation<"public", {
+    clientId: string;
+}, Promise<null>>;

package/dist/component/clients.js

@@ -0,0 +1,95 @@
+import { v } from "convex/values";
+import { mutation, query } from "./_generated/server";
+import { vDeploymentType, vTokenEndpointAuthMethod } from "./schema";
+const { array, number, object, optional, string } = v;
+const vClient = object({
+    clientId: string(),
+    appId: string(),
+    secretHash: string(),
+    tokenEndpointAuthMethod: vTokenEndpointAuthMethod,
+    redirectUri: string(),
+    deploymentType: vDeploymentType,
+    clientName: string(),
+    softwareVersion: string(),
+    createdAt: number(),
+    lastSignInAt: optional(number()),
+});
+/** Registers one deployment of an app as a client with its single exact redirect URI. */
+export const create = mutation({
+    args: {
+        clientId: string(),
+        appId: string(),
+        secretHash: string(),
+        tokenEndpointAuthMethod: vTokenEndpointAuthMethod,
+        redirectUri: string(),
+        deploymentType: vDeploymentType,
+        clientName: string(),
+        softwareVersion: string(),
+        createdAt: number(),
+    },
+    returns: v.null(),
+    handler: async (ctx, args) => {
+        const existing = await ctx.db
+            .query("clients")
+            .withIndex("by_client_id", (q) => q.eq("clientId", args.clientId))
+            .unique();
+        if (existing !== null) {
+            throw new Error(`A client with id "${args.clientId}" already exists`);
+        }
+        await ctx.db.insert("clients", {
+            clientId: args.clientId,
+            appId: args.appId,
+            secretHash: args.secretHash,
+            tokenEndpointAuthMethod: args.tokenEndpointAuthMethod,
+            redirectUri: args.redirectUri,
+            deploymentType: args.deploymentType,
+            clientName: args.clientName,
+            softwareVersion: args.softwareVersion,
+            createdAt: args.createdAt,
+        });
+        return null;
+    },
+});
+export const get = query({
+    args: { clientId: string() },
+    returns: v.union(vClient, v.null()),
+    handler: async (ctx, args) => {
+        const client = await ctx.db
+            .query("clients")
+            .withIndex("by_client_id", (q) => q.eq("clientId", args.clientId))
+            .unique();
+        if (client === null) {
+            return null;
+        }
+        const { _id, _creationTime, ...fields } = client;
+        return fields;
+    },
+});
+export const listByApp = query({
+    args: { appId: string() },
+    returns: array(vClient),
+    handler: async (ctx, args) => {
+        const clients = await ctx.db
+            .query("clients")
+            .withIndex("by_app_id", (q) => q.eq("appId", args.appId))
+            .collect();
+        return clients
+            .map(({ _id, _creationTime, ...fields }) => fields)
+            .sort((a, b) => a.createdAt - b.createdAt || a.clientId.localeCompare(b.clientId));
+    },
+});
+export const remove = mutation({
+    args: { clientId: string() },
+    returns: v.null(),
+    handler: async (ctx, args) => {
+        const client = await ctx.db
+            .query("clients")
+            .withIndex("by_client_id", (q) => q.eq("clientId", args.clientId))
+            .unique();
+        if (client !== null) {
+            await ctx.db.delete("clients", client._id);
+        }
+        return null;
+    },
+});
+//# sourceMappingURL=clients.js.map

package/dist/component/clients.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clients.js","sourceRoot":"","sources":["../../src/component/clients.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,eAAe,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AAErE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;AAEtD,MAAM,OAAO,GAAG,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,EAAE;IAClB,KAAK,EAAE,MAAM,EAAE;IACf,UAAU,EAAE,MAAM,EAAE;IACpB,uBAAuB,EAAE,wBAAwB;IACjD,WAAW,EAAE,MAAM,EAAE;IACrB,cAAc,EAAE,eAAe;IAC/B,UAAU,EAAE,MAAM,EAAE;IACpB,eAAe,EAAE,MAAM,EAAE;IACzB,SAAS,EAAE,MAAM,EAAE;IACnB,YAAY,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;CACjC,CAAC,CAAC;AAEH,yFAAyF;AACzF,MAAM,CAAC,MAAM,MAAM,GAAG,QAAQ,CAAC;IAC7B,IAAI,EAAE;QACJ,QAAQ,EAAE,MAAM,EAAE;QAClB,KAAK,EAAE,MAAM,EAAE;QACf,UAAU,EAAE,MAAM,EAAE;QACpB,uBAAuB,EAAE,wBAAwB;QACjD,WAAW,EAAE,MAAM,EAAE;QACrB,cAAc,EAAE,eAAe;QAC/B,UAAU,EAAE,MAAM,EAAE;QACpB,eAAe,EAAE,MAAM,EAAE;QACzB,SAAS,EAAE,MAAM,EAAE;KACpB;IACD,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE;IACjB,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC3B,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,EAAE;aAC1B,KAAK,CAAC,SAAS,CAAC;aAChB,SAAS,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;aACjE,MAAM,EAAE,CAAC;QACZ,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,CAAC,QAAQ,kBAAkB,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE;YAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;YACrD,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,CAAC;IACvB,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE;IAC5B,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACnC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC3B,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,EAAE;aACxB,KAAK,CAAC,SAAS,CAAC;aAChB,SAAS,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;aACjE,MAAM,EAAE,CAAC;QACZ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,MAAM,EAAE,GAAG,MAAM,CAAC;QACjD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,CAAC;IAC7B,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;IACzB,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC;IACvB,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC3B,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,EAAE;aACzB,KAAK,CAAC,SAAS,CAAC;aAChB,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;aACxD,OAAO,EAAE,CAAC;QACb,OAAO,OAAO;aACX,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC;aAClD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvF,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,MAAM,GAAG,QAAQ,CAAC;IAC7B,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE;IAC5B,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE;IACjB,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC3B,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,EAAE;aACxB,KAAK,CAAC,SAAS,CAAC;aAChB,SAAS,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;aACjE,MAAM,EAAE,CAAC;QACZ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAC,CAAC"}

package/dist/component/convex.config.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("convex/server").ComponentDefinition<any, {}>;
+export default _default;

package/dist/component/convex.config.js

@@ -0,0 +1,3 @@
+import { defineComponent } from "convex/server";
+export default defineComponent("identityBroker");
+//# sourceMappingURL=convex.config.js.map

package/dist/component/convex.config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"convex.config.js","sourceRoot":"","sources":["../../src/component/convex.config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,eAAe,eAAe,CAAC,gBAAgB,CAAC,CAAC"}

package/dist/component/crypto.d.ts

@@ -0,0 +1,2 @@
+/** SHA-256 of `input`, base64url without padding: the PKCE S256 transform of RFC 7636. */
+export declare function sha256Base64Url(input: string): Promise<string>;

package/dist/component/crypto.js

@@ -0,0 +1,9 @@
+/** SHA-256 of `input`, base64url without padding: the PKCE S256 transform of RFC 7636. */
+export async function sha256Base64Url(input) {
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(input));
+    return btoa(String.fromCharCode(...new Uint8Array(digest)))
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_")
+        .replace(/=+$/, "");
+}
+//# sourceMappingURL=crypto.js.map