@sasjs/api 0.6.1 → 0.7.0

package/build/esm/identity/records.d.ts

@@ -0,0 +1,102 @@
+import type { IdentityClientRecord, IdentityStore, Subject } from './types.js';
+/** The body a client reads for a user, as the server's controllers return it. */
+export interface UserResponse {
+    uid: string;
+    username: string;
+    displayName: string;
+    isAdmin: boolean;
+}
+export interface UserDetailsResponse extends UserResponse {
+    isActive: boolean;
+    needsToUpdatePassword: boolean;
+    autoExec?: string;
+    groups?: {
+        uid: string;
+        name: string;
+        description: string;
+    }[];
+}
+export interface GroupResponse {
+    uid: string;
+    name: string;
+    description: string;
+}
+export interface GroupDetailsResponse extends GroupResponse {
+    isActive: boolean;
+    users: UserResponse[];
+}
+export interface PermissionResponse {
+    uid: string;
+    path: string;
+    type: string;
+    setting: string;
+    user?: UserResponse;
+    group?: GroupDetailsResponse;
+}
+export interface RecordService {
+    listUsers(caller: Subject | undefined): Promise<UserResponse[]>;
+    getUser(caller: Subject | undefined, by: {
+        uid?: string;
+        username?: string;
+    }): Promise<UserDetailsResponse>;
+    createUser(caller: Subject | undefined, body: {
+        username: string;
+        displayName: string;
+        password: string;
+        isAdmin?: boolean;
+        isActive?: boolean;
+        autoExec?: string;
+    }): Promise<UserDetailsResponse>;
+    updateUser(caller: Subject | undefined, by: {
+        uid?: string;
+        username?: string;
+    }, body: {
+        username?: string;
+        displayName?: string;
+        password?: string;
+        isAdmin?: boolean;
+        isActive?: boolean;
+        autoExec?: string;
+    }): Promise<UserDetailsResponse>;
+    deleteUser(caller: Subject | undefined, by: {
+        uid?: string;
+        username?: string;
+    }, body: {
+        password?: string;
+    }): Promise<void>;
+    listGroups(caller: Subject | undefined): Promise<GroupResponse[]>;
+    getGroup(caller: Subject | undefined, by: {
+        uid?: string;
+        name?: string;
+    }): Promise<GroupDetailsResponse>;
+    createGroup(caller: Subject | undefined, body: {
+        name: string;
+        description: string;
+        isActive?: boolean;
+    }): Promise<GroupDetailsResponse>;
+    deleteGroup(caller: Subject | undefined, uid: string): Promise<void>;
+    addUserToGroup(caller: Subject | undefined, groupUid: string, userUid: string): Promise<GroupDetailsResponse>;
+    removeUserFromGroup(caller: Subject | undefined, groupUid: string, userUid: string): Promise<GroupDetailsResponse>;
+    listPermissions(caller: Subject | undefined): Promise<PermissionResponse[]>;
+    createPermission(caller: Subject | undefined, body: {
+        path: string;
+        type: string;
+        setting: string;
+        principalType: string;
+        principalId: string;
+    }): Promise<PermissionResponse>;
+    updatePermission(caller: Subject | undefined, uid: string, body: {
+        setting: string;
+    }): Promise<PermissionResponse>;
+    deletePermission(caller: Subject | undefined, uid: string): Promise<void>;
+    listClients(caller: Subject | undefined): Promise<IdentityClientRecord[]>;
+    createClient(caller: Subject | undefined, body: IdentityClientRecord): Promise<IdentityClientRecord>;
+    /** `PATCH /SASjsApi/auth/updatePassword`, the caller's own password. */
+    updatePassword(caller: Subject | undefined, body: {
+        currentPassword: string;
+        newPassword: string;
+    }): Promise<void>;
+}
+export declare const sanitiseDisplayName: (value: unknown) => string;
+export declare const createRecordService: (store: IdentityStore) => RecordService;
+//# sourceMappingURL=records.d.ts.map

package/build/esm/identity/records.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"records.d.ts","sourceRoot":"","sources":["../../../src/identity/records.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EACV,oBAAoB,EAGpB,aAAa,EAEb,OAAO,EACR,MAAM,YAAY,CAAA;AAEnB,iFAAiF;AACjF,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,OAAO,CAAA;CACjB;AAED,MAAM,WAAW,mBAAoB,SAAQ,YAAY;IACvD,QAAQ,EAAE,OAAO,CAAA;IACjB,qBAAqB,EAAE,OAAO,CAAA;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,MAAM,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;CAC9D;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,oBAAqB,SAAQ,aAAa;IACzD,QAAQ,EAAE,OAAO,CAAA;IACjB,KAAK,EAAE,YAAY,EAAE,CAAA;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,YAAY,CAAA;IACnB,KAAK,CAAC,EAAE,oBAAoB,CAAA;CAC7B;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAA;IAC/D,OAAO,CACL,MAAM,EAAE,OAAO,GAAG,SAAS,EAC3B,EAAE,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GACtC,OAAO,CAAC,mBAAmB,CAAC,CAAA;IAC/B,UAAU,CACR,MAAM,EAAE,OAAO,GAAG,SAAS,EAC3B,IAAI,EAAE;QACJ,QAAQ,EAAE,MAAM,CAAA;QAChB,WAAW,EAAE,MAAM,CAAA;QACnB,QAAQ,EAAE,MAAM,CAAA;QAChB,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,QAAQ,CAAC,EAAE,OAAO,CAAA;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;KAClB,GACA,OAAO,CAAC,mBAAmB,CAAC,CAAA;IAC/B,UAAU,CACR,MAAM,EAAE,OAAO,GAAG,SAAS,EAC3B,EAAE,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,EACvC,IAAI,EAAE;QACJ,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,QAAQ,CAAC,EAAE,OAAO,CAAA;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;KAClB,GACA,OAAO,CAAC,mBAAmB,CAAC,CAAA;IAC/B,UAAU,CACR,MAAM,EAAE,OAAO,GAAG,SAAS,EAC3B,EAAE,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,EACvC,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAC1B,OAAO,CAAC,IAAI,CAAC,CAAA;IAEhB,UAAU,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAA;IACjE,QAAQ,CACN,MAAM,EAAE,OAAO,GAAG,SAAS,EAC3B,EAAE,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAClC,OAAO,CAAC,oBAAoB,CAAC,CAAA;IAChC,WAAW,CACT,MAAM,EAAE,OAAO,GAAG,SAAS,EAC3B,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAC9D,OAAO,CAAC,oBAAoB,CAAC,CAAA;IAChC,WAAW,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACpE,cAAc,CACZ,MAAM,EAAE,OAAO,GAAG,SAAS,EAC3B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,oBAAoB,CAAC,CAAA;IAChC,mBAAmB,CACjB,MAAM,EAAE,OAAO,GAAG,SAAS,EAC3B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,oBAAoB,CAAC,CAAA;IAEhC,eAAe,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAA;IAC3E,gBAAgB,CACd,MAAM,EAAE,OAAO,GAAG,SAAS,EAC3B,IAAI,EAAE;QACJ,IAAI,EAAE,MAAM,CAAA;QACZ,IAAI,EAAE,MAAM,CAAA;QACZ,OAAO,EAAE,MAAM,CAAA;QACf,aAAa,EAAE,MAAM,CAAA;QACrB,WAAW,EAAE,MAAM,CAAA;KACpB,GACA,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAC9B,gBAAgB,CACd,MAAM,EAAE,OAAO,GAAG,SAAS,EAC3B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GACxB,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAC9B,gBAAgB,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEzE,WAAW,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAA;IACzE,YAAY,CACV,MAAM,EAAE,OAAO,GAAG,SAAS,EAC3B,IAAI,EAAE,oBAAoB,GACzB,OAAO,CAAC,oBAAoB,CAAC,CAAA;IAEhC,wEAAwE;IACxE,cAAc,CACZ,MAAM,EAAE,OAAO,GAAG,SAAS,EAC3B,IAAI,EAAE;QAAE,eAAe,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GACrD,OAAO,CAAC,IAAI,CAAC,CAAA;CACjB;AAiED,eAAO,MAAM,mBAAmB,GAAI,OAAO,OAAO,KAAG,MAKf,CAAA;AAetC,eAAO,MAAM,mBAAmB,GAAI,OAAO,aAAa,KAAG,aA2Z1D,CAAA"}

package/build/esm/identity/records.js

@@ -0,0 +1,393 @@
+/**
+ * Users, groups, permission rules and clients: the administration routes'
+ * decisions, over the same store the sign-in flow uses.
+ *
+ * The server answers these from four controllers and two middlewares - the
+ * statuses, the messages and the order of the checks are copied from there, so a
+ * mock and a server refuse a request the same way. What stays with the host is
+ * the *transport* (a session or a bearer token, a CSRF token) and the things a
+ * host owns: a new user's home folder, a directory bind, an audit trail.
+ *
+ * The admin gate is here rather than in a caller because `dispatch` has no
+ * middleware: `requireAdmin` is `verifyAdmin`, and `requireSelfOrAdmin` is
+ * `verifyAdminIfNeeded`. Both answer `401 Admin account required`, which is what
+ * the server sends.
+ */
+import { ApiError } from '../types.js';
+/** The name the server gives the group every account is added to on creation. */
+const ALL_USERS_GROUP = 'all-users';
+/** The group whose membership the API refuses to change. */
+const PUBLIC_GROUP = 'public';
+const unauthorized = () => new ApiError(401, 'Unauthorized');
+/**
+ * The caller, while the account behind it may still act.
+ *
+ * Every administration route reads the caller through this: the server
+ * re-reads the user on every request and refuses a deactivated account, so a
+ * token or session that outlived the account must not administer anything.
+ */
+const requireCaller = async (store, caller) => {
+    if (!caller)
+        throw unauthorized();
+    const user = await store.userById(caller.userId);
+    if (!user || !user.isActive)
+        throw unauthorized();
+    return user;
+};
+/** `verifyAdmin`: the caller is an administrator, or the route refuses. */
+const requireAdmin = async (store, caller) => {
+    const user = await requireCaller(store, caller);
+    if (!user.isAdmin)
+        throw new ApiError(401, 'Admin account required');
+    return user;
+};
+/**
+ * `verifyAdminIfNeeded`: an administrator, or the account being acted on.
+ *
+ * The server compares `req.params.uid` / `.username` with the caller's own
+ * identifier, which is why the target is passed in rather than read from the
+ * body - a restful route names its subject in the path.
+ */
+const requireSelfOrAdmin = async (store, caller, target) => {
+    const user = await requireCaller(store, caller);
+    if (!user.isAdmin && user.uid !== target?.uid)
+        throw new ApiError(401, 'Admin account required');
+    return user;
+};
+/**
+ * A display name, as the server stores one: control characters out, trimmed and
+ * bounded.
+ *
+ * The value reaches generated stored-program source and webout headers, so the
+ * server sanitises on the way in; a host that stored it verbatim would hold a
+ * different value from the server for the same request.
+ */
+const MAX_DISPLAY_NAME_LENGTH = 100;
+export const sanitiseDisplayName = (value) => String(value ?? '')
+    // eslint-disable-next-line no-control-regex
+    .replace(/[\u0000-\u001F\u007F]/g, '')
+    .trim()
+    .slice(0, MAX_DISPLAY_NAME_LENGTH);
+const asUser = (user) => ({
+    uid: user.uid,
+    username: user.username,
+    displayName: user.displayName,
+    isAdmin: user.isAdmin
+});
+const asGroup = (group) => ({
+    uid: group.uid,
+    name: group.name,
+    description: group.description
+});
+export const createRecordService = (store) => {
+    const groupDetails = async (group) => {
+        const members = [];
+        for (const uid of group.users) {
+            const user = await store.userById(uid);
+            if (user)
+                members.push(asUser(user));
+        }
+        return { ...asGroup(group), isActive: group.isActive, users: members };
+    };
+    const userDetails = async (user, withAutoExec) => {
+        const groups = [];
+        for (const uid of user.groups) {
+            const group = await store.groupById(uid);
+            if (group)
+                groups.push(asGroup(group));
+        }
+        const details = {
+            ...asUser(user),
+            isActive: user.isActive,
+            needsToUpdatePassword: user.needsToUpdatePassword,
+            groups
+        };
+        if (withAutoExec)
+            details.autoExec = user.autoExec ?? '';
+        return details;
+    };
+    const findBy = async (by) => by.uid !== undefined
+        ? store.userById(by.uid)
+        : store.userByName(by.username ?? '');
+    const permissionDetails = async (permission) => {
+        const response = {
+            uid: permission.uid,
+            path: permission.path,
+            type: permission.type,
+            setting: permission.setting
+        };
+        if (permission.user) {
+            const user = await store.userById(permission.user);
+            if (user)
+                response.user = asUser(user);
+        }
+        if (permission.group) {
+            const group = await store.groupById(permission.group);
+            if (group)
+                response.group = await groupDetails(group);
+        }
+        return response;
+    };
+    return {
+        async listUsers(caller) {
+            await requireCaller(store, caller);
+            const users = await store.users();
+            return users.map(asUser);
+        },
+        async getUser(caller, by) {
+            const reader = await requireCaller(store, caller);
+            const user = await findBy(by);
+            if (!user)
+                throw new ApiError(404, 'User is not found.');
+            // the server hands the auto-exec code to an administrator or to the user
+            // themselves and omits it for anyone else
+            const withAutoExec = reader.isAdmin || reader.uid === user.uid;
+            return userDetails(user, withAutoExec);
+        },
+        async createUser(caller, body) {
+            await requireAdmin(store, caller);
+            if (await store.userByName(body.username))
+                throw new ApiError(409, 'Username already exists.');
+            const created = await store.createUser({
+                username: body.username,
+                displayName: sanitiseDisplayName(body.displayName),
+                isAdmin: body.isAdmin === true,
+                isActive: body.isActive !== false,
+                autoExec: body.autoExec
+            });
+            await store.setPassword(created.uid, body.password);
+            // the server adds every new account to the all-users group when the host
+            // has one, so a group-based grant reaches it without an explicit add
+            const allUsers = await store.groupByName(ALL_USERS_GROUP);
+            if (allUsers)
+                await store.addToGroup(allUsers.uid, created.uid);
+            const stored = await store.userById(created.uid);
+            return userDetails(stored ?? created, true);
+        },
+        async updateUser(caller, by, body) {
+            const current = await findBy(by);
+            await requireSelfOrAdmin(store, caller, current);
+            const change = {};
+            const displayName = sanitiseDisplayName(body.displayName);
+            // the provider checks come before the uniqueness check and before the
+            // update, in the server's order: a provider-managed account cannot have
+            // its identity fields changed, and saying so does not depend on the new
+            // value being free
+            if (body.username &&
+                body.username !== current?.username &&
+                current?.authProvider)
+                throw new ApiError(405, 'Can not update username of user that is created by an external auth provider.');
+            if (displayName &&
+                displayName !== current?.displayName &&
+                current?.authProvider)
+                throw new ApiError(405, 'Can not update display name of user that is created by an external auth provider.');
+            if (body.username) {
+                const holder = await store.userByName(body.username);
+                if (holder && holder.uid !== current?.uid)
+                    throw new ApiError(409, 'Username already exists.');
+                change.username = body.username;
+            }
+            if (displayName)
+                change.displayName = displayName;
+            if (body.isAdmin !== undefined)
+                change.isAdmin = body.isAdmin;
+            if (body.isActive !== undefined)
+                change.isActive = body.isActive;
+            if (body.autoExec !== undefined)
+                change.autoExec = body.autoExec;
+            const updated = current
+                ? await store.updateUser(current.uid, change)
+                : undefined;
+            if (!updated)
+                throw new ApiError(404, `Unable to find user with ${by.uid || by.username}`);
+            if (body.password)
+                await store.setPassword(updated.uid, body.password);
+            const stored = await store.userById(updated.uid);
+            return userDetails(stored ?? updated, true);
+        },
+        async deleteUser(caller, by, body) {
+            const current = await findBy(by);
+            const actor = await requireSelfOrAdmin(store, caller, current);
+            if (!current)
+                throw new ApiError(404, 'User is not found.');
+            // an administrator deletes without proving the password; anyone else
+            // deleting their own account proves it. The caller's admin flag is the
+            // server's `@Hidden() isAdmin` query parameter, resolved here from the
+            // caller's own record rather than trusted from the request.
+            if (!actor.isAdmin) {
+                if (!(await store.passwordMatches(current, body.password ?? '')))
+                    throw new ApiError(401, 'Invalid password.');
+            }
+            await store.deleteUser(current.uid);
+        },
+        async listGroups(caller) {
+            await requireCaller(store, caller);
+            const groups = await store.groups();
+            return groups.map(asGroup);
+        },
+        async getGroup(caller, by) {
+            await requireCaller(store, caller);
+            const group = by.uid !== undefined
+                ? await store.groupById(by.uid)
+                : await store.groupByName(by.name ?? '');
+            if (!group)
+                throw new ApiError(404, 'Group not found.');
+            return groupDetails(group);
+        },
+        async createGroup(caller, body) {
+            await requireAdmin(store, caller);
+            if (await store.groupByName(body.name))
+                throw new ApiError(409, 'Group name already exists.');
+            const created = await store.createGroup({
+                name: body.name,
+                description: body.description,
+                isActive: body.isActive !== false
+            });
+            return groupDetails(created);
+        },
+        async deleteGroup(caller, uid) {
+            await requireAdmin(store, caller);
+            if (!(await store.groupById(uid)))
+                throw new ApiError(404, 'Group not found.');
+            await store.deleteGroup(uid);
+        },
+        async addUserToGroup(caller, groupUid, userUid) {
+            await requireAdmin(store, caller);
+            const group = await store.groupById(groupUid);
+            if (!group)
+                throw new ApiError(404, 'Group not found.');
+            if (group.name === PUBLIC_GROUP)
+                throw new ApiError(400, `Can't add/remove user to '${PUBLIC_GROUP}' group.`);
+            if (group.authProvider)
+                throw new ApiError(405, "Can't add/remove user to group created by external auth provider.");
+            const user = await store.userById(userUid);
+            if (!user)
+                throw new ApiError(404, 'User not found.');
+            if (user.authProvider)
+                throw new ApiError(405, "Can't add/remove user to group created by external auth provider.");
+            const updated = await store.addToGroup(groupUid, userUid);
+            if (!updated)
+                throw new ApiError(400, 'Unable to update group.');
+            return groupDetails(updated);
+        },
+        async removeUserFromGroup(caller, groupUid, userUid) {
+            await requireAdmin(store, caller);
+            const group = await store.groupById(groupUid);
+            if (!group)
+                throw new ApiError(404, 'Group not found.');
+            if (group.name === PUBLIC_GROUP)
+                throw new ApiError(400, `Can't add/remove user to '${PUBLIC_GROUP}' group.`);
+            if (group.authProvider)
+                throw new ApiError(405, "Can't add/remove user to group created by external auth provider.");
+            const user = await store.userById(userUid);
+            if (!user)
+                throw new ApiError(404, 'User not found.');
+            if (user.authProvider)
+                throw new ApiError(405, "Can't add/remove user to group created by external auth provider.");
+            const updated = await store.removeFromGroup(groupUid, userUid);
+            if (!updated)
+                throw new ApiError(400, 'Unable to update group.');
+            return groupDetails(updated);
+        },
+        async listPermissions(caller) {
+            const reader = await requireCaller(store, caller);
+            const rules = await store.permissions();
+            // an administrator sees every rule; anyone else sees the rules assigned to
+            // them and to the groups they belong to, which is what an app renders its
+            // menus from
+            const visible = reader.isAdmin
+                ? rules
+                : rules.filter((rule) => rule.user === reader.uid ||
+                    (rule.group !== undefined && reader.groups.includes(rule.group)));
+            const out = [];
+            for (const rule of visible)
+                out.push(await permissionDetails(rule));
+            return out;
+        },
+        async createPermission(caller, body) {
+            await requireAdmin(store, caller);
+            if (body.principalType === 'user') {
+                const user = await store.userById(body.principalId);
+                if (!user)
+                    throw new ApiError(404, 'User not found.');
+                if (user.isAdmin)
+                    throw new ApiError(400, 'Can not add permission for admin user.');
+                const exists = (await store.permissions()).some((rule) => rule.path === body.path &&
+                    rule.type === body.type &&
+                    rule.user === body.principalId);
+                if (exists)
+                    throw new ApiError(409, 'Permission already exists with provided Path, Type and User.');
+                const created = await store.createPermission({
+                    path: body.path,
+                    type: body.type,
+                    setting: body.setting,
+                    user: body.principalId
+                });
+                return permissionDetails(created);
+            }
+            if (body.principalType === 'group') {
+                const group = await store.groupById(body.principalId);
+                if (!group)
+                    throw new ApiError(404, 'Group not found.');
+                const exists = (await store.permissions()).some((rule) => rule.path === body.path &&
+                    rule.type === body.type &&
+                    rule.group === body.principalId);
+                if (exists)
+                    throw new ApiError(409, 'Permission already exists with provided Path, Type and Group.');
+                const created = await store.createPermission({
+                    path: body.path,
+                    type: body.type,
+                    setting: body.setting,
+                    group: body.principalId
+                });
+                return permissionDetails(created);
+            }
+            throw new ApiError(400, 'Invalid principal type. Valid types are user or group.');
+        },
+        async updatePermission(caller, uid, body) {
+            await requireAdmin(store, caller);
+            const updated = await store.setPermissionSetting(uid, body.setting);
+            if (!updated)
+                throw new ApiError(404, 'Permission not found.');
+            return permissionDetails(updated);
+        },
+        async deletePermission(caller, uid) {
+            await requireAdmin(store, caller);
+            if (!(await store.permissionById(uid)))
+                throw new ApiError(404, 'Permission not found.');
+            await store.deletePermission(uid);
+        },
+        async listClients(caller) {
+            await requireAdmin(store, caller);
+            return store.clients();
+        },
+        async createClient(caller, body) {
+            await requireAdmin(store, caller);
+            // the server answers `res.status(403).send(err.toString())`, so the body a
+            // client receives carries the Error prefix
+            if (await store.client(body.clientId))
+                throw new ApiError(403, 'Error: Client ID already exists.');
+            return store.createClient({
+                clientId: body.clientId,
+                clientSecret: body.clientSecret,
+                accessTokenExpiration: body.accessTokenExpiration,
+                refreshTokenExpiration: body.refreshTokenExpiration
+            });
+        },
+        async updatePassword(caller, body) {
+            // requireCaller answers 401 for a caller that is absent or deactivated, so
+            // the document's 404 (a caller whose record has gone) cannot be reached
+            // here - the overlay records that as a host-only status.
+            const reader = await requireCaller(store, caller);
+            if (reader.authProvider)
+                throw new ApiError(405, 'Can not update password of user that is created by an external auth provider.');
+            if (!(await store.passwordMatches(reader, body.currentPassword)))
+                throw new ApiError(403, 'Invalid current password!');
+            await store.setPassword(reader.uid, body.newPassword);
+            // the flag is what makes the web interface ask, and the server clears it in
+            // the same write: it has to go through the store, or a host keeps refusing
+            // every call the caller makes after the change
+            await store.updateUser(reader.uid, { needsToUpdatePassword: false });
+        }
+    };
+};

package/build/esm/identity/types.d.ts

@@ -42,8 +42,8 @@ export interface TokenPair {
  * verification, which is never what anyone means.
  */
 export interface IdentityStore {
-    userByName(username: string): Promise<IdentityUser | undefined>;
-    userById(uid: string): Promise<IdentityUser | undefined>;
+    userByName(username: string): Promise<IdentityUserRecord | undefined>;
+    userById(uid: string): Promise<IdentityUserRecord | undefined>;
     /**
      * Whether the password matches. The host owns the check: a bcrypt hash, a
      * directory bind, or a fixture's declared demo password.
@@ -75,5 +75,105 @@ export interface IdentityStore {
      * which is what makes an exchange single-use even when two requests race.
      */
     claimCode(code: string): Promise<boolean>;
+    /** Every user, in the order the host holds them. */
+    users(): Promise<IdentityUserRecord[]>;
+    /** Creates a user. The caller has already refused a duplicate username. */
+    createUser(input: NewUser): Promise<IdentityUserRecord>;
+    /** Applies a change to the user named by `uid`; undefined when there is none. */
+    updateUser(uid: string, change: UserChange): Promise<IdentityUserRecord | undefined>;
+    deleteUser(uid: string): Promise<void>;
+    /** Sets the password the host checks against, in the host's own encoding. */
+    setPassword(uid: string, password: string): Promise<void>;
+    groups(): Promise<IdentityGroupRecord[]>;
+    groupById(uid: string): Promise<IdentityGroupRecord | undefined>;
+    groupByName(name: string): Promise<IdentityGroupRecord | undefined>;
+    createGroup(input: NewGroup): Promise<IdentityGroupRecord>;
+    deleteGroup(uid: string): Promise<void>;
+    /** Membership, answering the updated group; undefined when there is none. */
+    addToGroup(groupUid: string, userUid: string): Promise<IdentityGroupRecord | undefined>;
+    removeFromGroup(groupUid: string, userUid: string): Promise<IdentityGroupRecord | undefined>;
+    permissions(): Promise<IdentityPermissionRecord[]>;
+    permissionById(uid: string): Promise<IdentityPermissionRecord | undefined>;
+    createPermission(input: NewPermission): Promise<IdentityPermissionRecord>;
+    setPermissionSetting(uid: string, setting: string): Promise<IdentityPermissionRecord | undefined>;
+    deletePermission(uid: string): Promise<void>;
+    clients(): Promise<IdentityClientRecord[]>;
+    createClient(input: IdentityClientRecord): Promise<IdentityClientRecord>;
+}
+/**
+ * A user as the administration routes report one: the fields the sign-in flow
+ * reads, plus what those routes expose.
+ *
+ * `autoExec` and `authProvider` are optional because a host that does not hold
+ * them (the browser build's fixture, a directory-backed server) answers without
+ * them, and `groups` is empty rather than absent so a client always gets a list.
+ */
+export interface IdentityUserRecord extends IdentityUser {
+    autoExec?: string;
+    /** Set when the account is managed by an external auth provider. */
+    authProvider?: string;
+    /** The uids of the groups the user belongs to. */
+    groups: string[];
+}
+export interface IdentityGroupRecord {
+    uid: string;
+    name: string;
+    description: string;
+    isActive: boolean;
+    /** The uids of the members. */
+    users: string[];
+    /** Set when the group is managed by an external auth provider. */
+    authProvider?: string;
+}
+export interface IdentityPermissionRecord {
+    uid: string;
+    /** The route the rule is about, e.g. `/SASjsApi/code/execute`. */
+    path: string;
+    /** `Route` is the only kind the API defines. */
+    type: string;
+    /** `Grant` or `Deny`. */
+    setting: string;
+    /** The uid the rule is assigned to, when it is a user's. */
+    user?: string;
+    /** The uid the rule is assigned to, when it is a group's. */
+    group?: string;
+}
+/** A client as the administration routes report one: the flow's fields plus the secret. */
+export interface IdentityClientRecord extends IdentityClient {
+    clientSecret: string;
+}
+/** What creating a user takes. The password reaches `setPassword`, not this. */
+export interface NewUser {
+    username: string;
+    displayName: string;
+    isAdmin: boolean;
+    isActive: boolean;
+    autoExec?: string;
+    authProvider?: string;
+}
+/** The fields an update may carry; omitted fields are left alone. */
+export interface UserChange {
+    username?: string;
+    displayName?: string;
+    isAdmin?: boolean;
+    isActive?: boolean;
+    autoExec?: string;
+    /**
+     * Cleared by a password change: `sasjs/server` refuses every other API call
+     * while this is set, so a host must be able to clear it through the port.
+     */
+    needsToUpdatePassword?: boolean;
+}
+export interface NewGroup {
+    name: string;
+    description: string;
+    isActive: boolean;
+}
+export interface NewPermission {
+    path: string;
+    type: string;
+    setting: string;
+    user?: string;
+    group?: string;
 }
 //# sourceMappingURL=types.d.ts.map

package/build/esm/identity/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/identity/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,iFAAiF;AACjF,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,OAAO,CAAA;IAChB,QAAQ,EAAE,OAAO,CAAA;IACjB,qBAAqB,EAAE,OAAO,CAAA;CAC/B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAA;IAChB,kEAAkE;IAClE,qBAAqB,EAAE,MAAM,CAAA;IAC7B,qCAAqC;IACrC,sBAAsB,EAAE,MAAM,CAAA;CAC/B;AAED,MAAM,WAAW,SAAS;IACxB,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;CACrB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,aAAa;IAC5B,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAA;IAC/D,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAA;IACxD;;;OAGG;IACH,eAAe,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACvE,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAA;IAC7D,+DAA+D;IAC/D,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;IACnE,qFAAqF;IACrF,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAA;IACvD,6EAA6E;IAC7E,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAA;IACxD,sEAAsE;IACtE,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAA;IACzD,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1D,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC3C,0DAA0D;IAC1D,SAAS,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAC5C;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAA;IACpD;;;;OAIG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAC1C"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/identity/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,iFAAiF;AACjF,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,OAAO,CAAA;IAChB,QAAQ,EAAE,OAAO,CAAA;IACjB,qBAAqB,EAAE,OAAO,CAAA;CAC/B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAA;IAChB,kEAAkE;IAClE,qBAAqB,EAAE,MAAM,CAAA;IAC7B,qCAAqC;IACrC,sBAAsB,EAAE,MAAM,CAAA;CAC/B;AAED,MAAM,WAAW,SAAS;IACxB,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;CACrB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,aAAa;IAC5B,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAAA;IACrE,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAAA;IAC9D;;;OAGG;IACH,eAAe,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACvE,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAA;IAC7D,+DAA+D;IAC/D,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;IACnE,qFAAqF;IACrF,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAA;IACvD,6EAA6E;IAC7E,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAA;IACxD,sEAAsE;IACtE,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAA;IACzD,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1D,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC3C,0DAA0D;IAC1D,SAAS,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAC5C;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAA;IACpD;;;;OAIG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IASzC,oDAAoD;IACpD,KAAK,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAA;IACtC,2EAA2E;IAC3E,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;IACvD,iFAAiF;IACjF,UAAU,CACR,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAAA;IAC1C,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACtC,6EAA6E;IAC7E,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEzD,MAAM,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAA;IACxC,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC,CAAA;IAChE,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC,CAAA;IACnE,WAAW,CAAC,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAA;IAC1D,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACvC,6EAA6E;IAC7E,UAAU,CACR,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC,CAAA;IAC3C,eAAe,CACb,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC,CAAA;IAE3C,WAAW,IAAI,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAAA;IAClD,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC,CAAA;IAC1E,gBAAgB,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAA;IACzE,oBAAoB,CAClB,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC,CAAA;IAChD,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAE5C,OAAO,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAA;IAC1C,YAAY,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;CACzE;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAmB,SAAQ,YAAY;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,oEAAoE;IACpE,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,kDAAkD;IAClD,MAAM,EAAE,MAAM,EAAE,CAAA;CACjB;AAED,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,OAAO,CAAA;IACjB,+BAA+B;IAC/B,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,kEAAkE;IAClE,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,wBAAwB;IACvC,GAAG,EAAE,MAAM,CAAA;IACX,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAA;IACZ,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAA;IACZ,yBAAyB;IACzB,OAAO,EAAE,MAAM,CAAA;IACf,4DAA4D;IAC5D,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,2FAA2F;AAC3F,MAAM,WAAW,oBAAqB,SAAQ,cAAc;IAC1D,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,gFAAgF;AAChF,MAAM,WAAW,OAAO;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,OAAO,CAAA;IAChB,QAAQ,EAAE,OAAO,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,qEAAqE;AACrE,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;OAGG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAA;CAChC;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;CACf"}

package/build/esm/index.d.ts

@@ -27,13 +27,16 @@ export type { RouteOverlay } from './routes/overlay.js';
 export { dispatch, HANDLED_ROUTES } from './host/dispatch.js';
 export type { ApiRequest, ApiResponse, Services } from './host/dispatch.js';
 export { createIdentityService } from './identity/service.js';
+export { createRecordService, sanitiseDisplayName } from './identity/records.js';
+export type { GroupDetailsResponse, GroupResponse, PermissionResponse, RecordService, UserDetailsResponse, UserResponse } from './identity/records.js';
 export type { IdentityService, LoginResult, SessionResult } from './identity/service.js';
 export { MemoryIdentityStore } from './identity/memory-store.js';
 export { DEFAULT_IDENTITY, IDENTITY_FORMAT, parseIdentity } from './identity/fixture.js';
 export type { IdentityFixture, IdentityFixtureClient, IdentityFixtureCode, IdentityFixtureGroup, IdentityFixturePermission, IdentityFixtureToken, IdentityFixtureUser } from './identity/fixture.js';
-export type { IdentityClient, IdentityStore, IdentityUser, Subject, TokenPair } from './identity/types.js';
+export type { IdentityClient, IdentityClientRecord, IdentityGroupRecord, IdentityPermissionRecord, IdentityStore, IdentityUser, IdentityUserRecord, NewGroup, NewPermission, NewUser, Subject, TokenPair, UserChange } from './identity/types.js';
 export { DRIVE_CORPUS } from './corpus/drive.js';
 export { IDENTITY_CORPUS } from './corpus/identity.js';
+export { RECORD_CORPUS, ADMIN_SIGNED_IN, PROVIDER_MANAGED } from './corpus/records.js';
 export type { CorpusCase } from './corpus/drive.js';
 export { runCase, servicesFor } from './corpus/runner.js';
 export type { CaseResult } from './corpus/runner.js';

package/build/esm/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,cAAc,YAAY,CAAA;AAC1B,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,OAAO,EACP,QAAQ,EACR,MAAM,EACP,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AACvD,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,cAAc,EACd,eAAe,EACf,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,iBAAiB,EAClB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACV,YAAY,EACZ,kBAAkB,EAClB,YAAY,EACZ,aAAa,EACb,UAAU,EACX,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACV,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,SAAS,EACT,SAAS,EACV,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAChE,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAC7D,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,YAAY,EACV,eAAe,EACf,WAAW,EACX,aAAa,EACd,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,aAAa,EACd,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EACV,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,yBAAyB,EACzB,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EACV,cAAc,EACd,aAAa,EACb,YAAY,EACZ,OAAO,EACP,SAAS,EACV,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AACzD,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,cAAc,YAAY,CAAA;AAC1B,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,OAAO,EACP,QAAQ,EACR,MAAM,EACP,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AACvD,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,cAAc,EACd,eAAe,EACf,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,iBAAiB,EAClB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACV,YAAY,EACZ,kBAAkB,EAClB,YAAY,EACZ,aAAa,EACb,UAAU,EACX,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACV,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,SAAS,EACT,SAAS,EACV,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAChE,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAC7D,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAChF,YAAY,EACV,oBAAoB,EACpB,aAAa,EACb,kBAAkB,EAClB,aAAa,EACb,mBAAmB,EACnB,YAAY,EACb,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EACV,eAAe,EACf,WAAW,EACX,aAAa,EACd,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,aAAa,EACd,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EACV,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,yBAAyB,EACzB,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EACV,cAAc,EACd,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,EACxB,aAAa,EACb,YAAY,EACZ,kBAAkB,EAClB,QAAQ,EACR,aAAa,EACb,OAAO,EACP,OAAO,EACP,SAAS,EACT,UAAU,EACX,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EACL,aAAa,EACb,eAAe,EACf,gBAAgB,EACjB,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AACzD,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA"}