@segmentstream/app 0.0.0-stage → 0.38.1

package/dist/federation.js

@@ -0,0 +1,613 @@
+import { cookies, headers } from "next/headers";
+import { redirect } from "next/navigation";
+import { NextResponse } from "next/server";
+import { createBrowserConfigurationCheck, deploymentRefreshRequired, } from "./browser-revision.js";
+import { hasChannelApps } from "./config.js";
+import { cookiePolicyFor, isLoopbackHostname, safeReturnTo } from "./cookies.js";
+import { channelAppFraming } from "./telegram.js";
+import { createChannelSession } from "./channel-session.js";
+import { isSameOrigin, withUnframeablePages } from "./decision-pages.js";
+import { apiErrorFrom, readJson, SegmentStreamApiError } from "./errors.js";
+import { parseMe } from "./me.js";
+import { createOntologyTransport, ontologyOrigin } from "./ontology-transport.js";
+import { createOntologyClient } from "./ontology.js";
+import { createAgentAuthorizations } from "./oauth.js";
+import { createAgentIdentities } from "./agent.js";
+import { isAllowed } from "./permissions.js";
+import { isApiRequest, revisionUnavailableResponse, unauthenticatedResponse } from "./sign-in.js";
+import { matchesPathPrefix, normalizePublicPath } from "./proxy.js";
+import { base64UrlDecode, base64UrlEncode, constantTimeEqual, createCodeChallenge, randomToken, } from "./pkce.js";
+const PREFIX = "/api/segmentstream";
+const CALLBACK = `${PREFIX}/callback`;
+const LINK = `${PREFIX}/link`;
+function safeDestination(value) {
+    const destination = safeReturnTo(value);
+    const pathname = new URL(destination, "https://return.invalid").pathname;
+    return matchesPathPrefix(pathname, PREFIX) ? "/" : destination;
+}
+function displayIdentity(value) {
+    if (!value || typeof value !== "object")
+        return undefined;
+    const identity = value;
+    if (typeof identity.id !== "string" || !identity.id || identity.id.length > 512)
+        return undefined;
+    return {
+        id: identity.id,
+        ...(typeof identity.email === "string" && identity.email.length <= 320
+            ? { email: identity.email }
+            : {}),
+        ...(typeof identity.name === "string" && identity.name.length <= 200
+            ? { name: identity.name }
+            : {}),
+    };
+}
+function pendingLink(value) {
+    try {
+        const pending = decode(value ?? "");
+        return typeof pending.token === "string" &&
+            pending.token.startsWith("ssfl_") &&
+            typeof pending.expiresAt === "number" &&
+            pending.expiresAt > Date.now() &&
+            displayIdentity(pending.identity)
+            ? pending
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+const encode = (value) => base64UrlEncode(new TextEncoder().encode(JSON.stringify(value)));
+const decode = (value) => JSON.parse(new TextDecoder().decode(base64UrlDecode(value)));
+const cookieName = (workspaceId, secure, purpose = "session") => `${secure ? "__Host-" : ""}ss_oidc_${purpose}.${workspaceId.replace(/[^A-Za-z0-9_-]/g, "_")}`;
+const attributes = (secure, maxAge) => ({
+    httpOnly: true,
+    secure,
+    sameSite: "lax",
+    path: "/",
+    maxAge,
+});
+/** Public-client RP. Only workspace-owned opaque sessions are stored in its session cookie. */
+export function withFederation(base, config, oidc, options) {
+    const issuer = new URL(oidc.issuer);
+    if (issuer.protocol !== "https:" ||
+        issuer.username ||
+        issuer.password ||
+        issuer.search ||
+        issuer.hash ||
+        oidc.issuer.endsWith("/")) {
+        throw new Error("SEGMENTSTREAM_OIDC_ISSUER must be an HTTPS issuer without a trailing slash.");
+    }
+    const checkConfiguration = options.browserAuth && options.browserRevision
+        ? createBrowserConfigurationCheck(options.fetch, options.browserAuth, options.browserRevision, options.ontologyUrl)
+        : undefined;
+    async function verifyConfiguration() {
+        if (!options.browserAuth)
+            return;
+        if (!checkConfiguration)
+            throw deploymentRefreshRequired();
+        await checkConfiguration();
+    }
+    async function configurationFailure(request) {
+        try {
+            await verifyConfiguration();
+        }
+        catch (cause) {
+            return revisionUnavailableResponse(request, cause);
+        }
+    }
+    const signInPage = (request, error) => {
+        const destination = new URL("/sign-in", request.url);
+        destination.searchParams.set("returnTo", safeReturnTo(`${request.nextUrl.pathname}${request.nextUrl.search}`));
+        if (error)
+            destination.searchParams.set("error", error);
+        return NextResponse.redirect(destination);
+    };
+    const channel = createChannelSession({
+        enabled: hasChannelApps(config.channels),
+        workspaceId: config.workspaceId,
+        ontologyUrl: options.ontologyUrl,
+        fetch: options.fetch,
+    });
+    const token = async () => {
+        const cookieStore = await cookies();
+        const host = (await headers()).get("host") ?? "";
+        const hostname = URL.parse(`http://${host}`)?.hostname ?? "";
+        const secure = cookieStore.get(cookieName(config.workspaceId, true))?.value;
+        return (secure ??
+            (isLoopbackHostname(hostname)
+                ? cookieStore.get(cookieName(config.workspaceId, false))?.value
+                : undefined) ??
+            null);
+    };
+    const transport = createOntologyTransport({
+        fetch: options.fetch,
+        ontologyUrl: options.ontologyUrl,
+        credentials: { token },
+    });
+    const fallbackTransport = options.proofTransport ?? options.channelSession?.transport ?? transport;
+    const ontologyTransport = {
+        fetch: async (path, init = {}) => (await channel.read())
+            ? channel.transport.fetch(path, init)
+            : (await token())
+                ? transport.fetch(path, init)
+                : fallbackTransport.fetch(path, init),
+    };
+    // OIDC and channel sessions read `/me` on every call, so `fresh` changes nothing for them.
+    async function getUser(userOptions = {}) {
+        await verifyConfiguration();
+        const channelUser = (await channel.read())?.user;
+        if (channelUser) {
+            return {
+                ...channelUser,
+                email: channelUser.email ?? undefined,
+                name: channelUser.name ?? undefined,
+                organizationId: config.organizationId,
+                workspaceId: config.workspaceId,
+            };
+        }
+        if (!(await token())) {
+            return options.neon ? base.getUser(userOptions) : (options.channelSession?.getUser() ?? null);
+        }
+        return oidcUser();
+    }
+    async function oidcUser() {
+        return userFromResponse(await transport.fetch("/me", { cache: "no-store" }));
+    }
+    async function userFromResponse(response) {
+        if (response.status === 401 || response.status === 403) {
+            return null;
+        }
+        let payload;
+        try {
+            payload = await response.json();
+        }
+        catch (cause) {
+            throw new SegmentStreamApiError({
+                code: "ontology_invalid_response",
+                status: 502,
+                detail: "ontology_invalid_response",
+                cause,
+            });
+        }
+        if (!response.ok) {
+            throw apiErrorFrom(response.status, payload, "session_unavailable");
+        }
+        const user = parseMe(payload);
+        if (!user) {
+            throw new SegmentStreamApiError({
+                code: "ontology_invalid_response",
+                status: 502,
+                detail: "ontology_invalid_response",
+            });
+        }
+        return {
+            id: user.id,
+            ...(user.email ? { email: user.email } : {}),
+            ...(user.name ? { name: user.name } : {}),
+            organizationId: config.organizationId,
+            workspaceId: config.workspaceId,
+            roles: user.roles,
+            permissions: user.permissions,
+            ...(user.scopes === undefined ? {} : { scopes: user.scopes }),
+            kind: user.kind,
+            active: user.active,
+        };
+    }
+    const setSession = (response, request, value) => {
+        const { secure } = cookiePolicyFor(new URL(request.url), config.workspaceId);
+        response.cookies.set(cookieName(config.workspaceId, secure), value, attributes(secure, 30 * 86400));
+    };
+    async function endFederationSession() {
+        if (!(await token())) {
+            return;
+        }
+        const response = await transport.fetch("/federation/logout", { method: "POST" });
+        if (!response.ok) {
+            throw apiErrorFrom(response.status, await readJson(response), "logout_failed");
+        }
+    }
+    async function GET(request) {
+        const { secure } = cookiePolicyFor(new URL(request.url), config.workspaceId);
+        const flowPrefix = cookieName(config.workspaceId, secure, "flow");
+        const pendingName = cookieName(config.workspaceId, secure, "pending");
+        const path = request.nextUrl.pathname;
+        const failure = await configurationFailure(request);
+        if (failure)
+            return failure;
+        if (path === `${PREFIX}/configuration`) {
+            return NextResponse.json({
+                enabled: true,
+                neon: options.neon,
+                channels: config.channels ?? {},
+                ...(options.browserAuth ? { browser: options.browserAuth.browser } : {}),
+            }, { headers: { "cache-control": "no-store" } });
+        }
+        if (path === `${PREFIX}/session`) {
+            const credential = await token();
+            if (!credential) {
+                return NextResponse.json(null, { status: 401, headers: { "cache-control": "no-store" } });
+            }
+            const user = await oidcUser();
+            return NextResponse.json(user
+                ? {
+                    session: { id: await createCodeChallenge(credential) },
+                    user,
+                    source: "oidc",
+                }
+                : { error: "unauthorized", source: "oidc" }, {
+                status: user ? 200 : 401,
+                headers: { "cache-control": "no-store" },
+            });
+        }
+        if (path === `${PREFIX}/sign-in` || path === `${PREFIX}/connect`) {
+            if (request.method !== "GET" ||
+                request.headers.has("next-router-prefetch") ||
+                request.headers.has("purpose") ||
+                request.nextUrl.searchParams.has("_rsc"))
+                return unauthenticatedResponse();
+            let initiatingUser = null;
+            if (path === `${PREFIX}/connect`) {
+                if (!options.neon || !options.identityToken)
+                    return NextResponse.json({ error: "identity_method_unavailable" }, { status: 403 });
+                initiatingUser = await base.getUser({ fresh: true });
+                if (!initiatingUser ||
+                    initiatingUser.active === false ||
+                    initiatingUser.kind === "service" ||
+                    !(await options.identityToken()))
+                    return NextResponse.json({ error: "identity_proof_required" }, { status: 401 });
+            }
+            const state = randomToken();
+            const flow = {
+                state,
+                nonce: randomToken(),
+                verifier: randomToken(),
+                redirectUri: `${request.nextUrl.origin}${CALLBACK}`,
+                returnTo: safeDestination(request.nextUrl.searchParams.get("returnTo")),
+                expiresAt: Date.now() + 600_000,
+                ...(initiatingUser ? { intent: "link", workspaceUserId: initiatingUser.id } : {}),
+            };
+            const destination = new URL(`${oidc.issuer}/authorize`);
+            destination.search = new URLSearchParams({
+                response_type: "code",
+                client_id: oidc.clientId,
+                redirect_uri: flow.redirectUri,
+                scope: "openid profile email",
+                state,
+                nonce: flow.nonce,
+                code_challenge_method: "S256",
+                code_challenge: await createCodeChallenge(flow.verifier),
+            }).toString();
+            const navigation = request.nextUrl.searchParams.get("account") === "select"
+                ? new URL("/auth/sign-in", issuer.origin)
+                : destination;
+            if (navigation !== destination) {
+                navigation.searchParams.set("returnTo", `${destination.pathname}${destination.search}`);
+                navigation.searchParams.set("intent", "app");
+                navigation.searchParams.set("reauthenticate", "1");
+            }
+            const response = NextResponse.redirect(navigation);
+            const pending = request.cookies
+                .getAll()
+                .filter((cookie) => cookie.name.startsWith(`${flowPrefix}.`));
+            if (pending.length >= 4) {
+                for (const cookie of pending) {
+                    response.cookies.set(cookie.name, "", attributes(secure, 0));
+                }
+            }
+            response.cookies.set(`${flowPrefix}.${state}`, encode(flow), attributes(secure, 600));
+            return response;
+        }
+        if (path === CALLBACK) {
+            const params = request.nextUrl.searchParams;
+            const state = params.get("state") ?? "";
+            const flowName = /^[A-Za-z0-9_-]{43}$/.test(state) ? `${flowPrefix}.${state}` : "";
+            const failed = NextResponse.redirect(new URL("/sign-in?error=segmentstream_sign_in_failed", request.url));
+            if (flowName) {
+                failed.cookies.set(flowName, "", attributes(secure, 0));
+            }
+            try {
+                const value = request.cookies.get(flowName)?.value;
+                const flow = value ? decode(value) : undefined;
+                if (typeof flow?.returnTo === "string") {
+                    const recovery = new URL(failed.headers.get("location"));
+                    recovery.searchParams.set("returnTo", safeReturnTo(flow.returnTo));
+                    failed.headers.set("location", recovery.href);
+                }
+                if (!flow ||
+                    [...params.keys()].some((key) => params.getAll(key).length !== 1) ||
+                    typeof flow.state !== "string" ||
+                    !constantTimeEqual(flow.state, state) ||
+                    flow.redirectUri !== `${request.nextUrl.origin}${CALLBACK}` ||
+                    typeof flow.expiresAt !== "number" ||
+                    flow.expiresAt <= Date.now() ||
+                    typeof flow.verifier !== "string" ||
+                    typeof flow.nonce !== "string" ||
+                    params.get("iss") !== oidc.issuer ||
+                    !params.get("code") ||
+                    params.has("error")) {
+                    return failed;
+                }
+                let proof;
+                if (flow.intent === "link") {
+                    const current = options.neon ? await base.getUser({ fresh: true }) : null;
+                    proof = await options.identityToken?.();
+                    if (!current ||
+                        current.active === false ||
+                        current.kind === "service" ||
+                        current.id !== flow.workspaceUserId ||
+                        !proof)
+                        return failed;
+                }
+                else if (flow.intent !== undefined)
+                    return failed;
+                const response = await options.fetch(`${await ontologyOrigin(options.ontologyUrl)}/api/ontology/federation/exchange`, {
+                    method: "POST",
+                    headers: { "content-type": "application/json" },
+                    redirect: "error",
+                    cache: "no-store",
+                    signal: AbortSignal.timeout(15000),
+                    body: JSON.stringify({
+                        code: params.get("code"),
+                        verifier: flow.verifier,
+                        nonce: flow.nonce,
+                        redirectUri: flow.redirectUri,
+                        ...(flow.intent === "link" ? { intent: "link", proof } : {}),
+                    }),
+                });
+                const result = (await response.json());
+                if (!response.ok ||
+                    typeof result.token !== "string" ||
+                    (flow.intent === "link" &&
+                        (result.status !== "proof_required" || result.linkUserId !== flow.workspaceUserId))) {
+                    return failed;
+                }
+                const returnTo = safeDestination(typeof flow.returnTo === "string" ? flow.returnTo : "/");
+                const destination = result.status === "proof_required"
+                    ? `/sign-in/link?returnTo=${encodeURIComponent(returnTo)}`
+                    : returnTo;
+                const completed = NextResponse.redirect(new URL(destination, request.url));
+                completed.cookies.set(flowName, "", attributes(secure, 0));
+                if (result.status === "proof_required" && result.token.startsWith("ssfl_")) {
+                    const identity = displayIdentity(result.identity);
+                    if (!identity)
+                        return failed;
+                    completed.cookies.set(pendingName, encode({
+                        token: result.token,
+                        returnTo,
+                        identity,
+                        expiresAt: Date.now() + 600_000,
+                        ...(flow.intent === "link" ? { workspaceUserId: flow.workspaceUserId } : {}),
+                    }), attributes(secure, 600));
+                }
+                else if (result.status === "signed_in" && result.token.startsWith("ssfs_")) {
+                    setSession(completed, request, result.token);
+                }
+                else {
+                    return failed;
+                }
+                return completed;
+            }
+            catch {
+                return failed;
+            }
+        }
+        if (path === LINK) {
+            const pending = pendingLink(request.cookies.get(pendingName)?.value);
+            const current = options.neon ? await base.getUser({ fresh: true }) : null;
+            const sameUser = !pending?.workspaceUserId || pending.workspaceUserId === current?.id;
+            const ready = !!pending &&
+                !!current &&
+                current.active !== false &&
+                current.kind !== "service" &&
+                sameUser;
+            const response = NextResponse.json({
+                pending: !!pending && sameUser,
+                email_enabled: options.neon,
+                proof_ready: ready,
+                ...(pending && sameUser
+                    ? {
+                        identity: displayIdentity(pending.identity),
+                        expiresAt: pending.expiresAt,
+                        returnTo: safeDestination(typeof pending.returnTo === "string" ? pending.returnTo : "/"),
+                    }
+                    : {}),
+                ...(ready ? { workspaceUser: displayIdentity(current) } : {}),
+            }, { headers: { "cache-control": "no-store" } });
+            if (ready)
+                response.cookies.set(pendingName, encode({ ...pending, reviewedWorkspaceUserId: current.id }), attributes(secure, Math.max(0, Math.floor((Number(pending.expiresAt) - Date.now()) / 1000))));
+            return response;
+        }
+        return new Response("Not found", { status: 404 });
+    }
+    async function POST(request) {
+        const failure = await configurationFailure(request);
+        if (failure)
+            return failure;
+        if (!isSameOrigin(request)) {
+            return NextResponse.json({ error: "cross_origin_session" }, { status: 403 });
+        }
+        if (request.nextUrl.pathname === `${PREFIX}/sign-out`) {
+            await endFederationSession();
+            const response = NextResponse.json({ signed_out: true });
+            for (const secure of [true, false]) {
+                response.cookies.set(cookieName(config.workspaceId, secure), "", attributes(secure, 0));
+            }
+            return response;
+        }
+        if (request.nextUrl.pathname === `${PREFIX}/link-email` && options.neon) {
+            const proof = await options.identityToken?.();
+            if (!proof || !(await token()))
+                return NextResponse.json({ error: "identity_proof_required" }, { status: 401 });
+            const response = await transport.fetch("/federation/link-email", {
+                method: "POST",
+                headers: { "content-type": "application/json" },
+                body: JSON.stringify({ proof }),
+            });
+            const result = await readJson(response);
+            const mismatch = result !== null &&
+                typeof result === "object" &&
+                "error" in result &&
+                result.error === "email_identity_mismatch";
+            return NextResponse.json(response.ok
+                ? { linked: true }
+                : { error: mismatch ? "email_identity_mismatch" : "identity_link_failed" }, {
+                status: response.ok ? 200 : response.status,
+            });
+        }
+        const { secure } = cookiePolicyFor(new URL(request.url), config.workspaceId);
+        const pendingName = cookieName(config.workspaceId, secure, "pending");
+        if (request.nextUrl.pathname !== LINK || !options.neon) {
+            return new Response("Not found", { status: 404 });
+        }
+        try {
+            const pending = pendingLink(request.cookies.get(pendingName)?.value);
+            const current = await base.getUser({ fresh: true });
+            if (!pending ||
+                !current ||
+                current.active === false ||
+                current.kind === "service" ||
+                pending.reviewedWorkspaceUserId !== current.id ||
+                (pending.workspaceUserId && pending.workspaceUserId !== current.id))
+                return NextResponse.json({ error: "identity_proof_changed" }, { status: 403 });
+            const response = await options.proofTransport.fetch("/federation/link", {
+                method: "POST",
+                headers: { "content-type": "application/json" },
+                body: JSON.stringify({ pending: pending.token }),
+            });
+            const body = (await response.json());
+            if (!response.ok || typeof body.token !== "string" || !body.token.startsWith("ssfs_")) {
+                return NextResponse.json({ error: "identity_link_failed" }, { status: 403 });
+            }
+            const completed = NextResponse.redirect(new URL(safeReturnTo(typeof pending.returnTo === "string" ? pending.returnTo : "/"), request.url), 303);
+            setSession(completed, request, body.token);
+            completed.cookies.set(pendingName, "", attributes(secure, 0));
+            return completed;
+        }
+        catch {
+            return NextResponse.json({ error: "identity_proof_required" }, { status: 403 });
+        }
+    }
+    return {
+        ...base,
+        authHandlers: () => {
+            const handlers = base.authHandlers();
+            if (!options.browserAuth || !options.neon)
+                return handlers;
+            const guard = (handler) => async (request, context) => {
+                const failure = await configurationFailure(request);
+                if (failure)
+                    return failure;
+                return handler(request, context);
+            };
+            return {
+                GET: guard(handlers.GET),
+                POST: guard(handlers.POST),
+                PUT: guard(handlers.PUT),
+                DELETE: guard(handlers.DELETE),
+                PATCH: guard(handlers.PATCH),
+            };
+        },
+        handlers: () => ({
+            GET: async (request) => protectResponse(await GET(request)),
+            POST: async (request) => protectResponse(await POST(request)),
+        }),
+        getUser,
+        requireUser: async (settings) => {
+            const user = await getUser(settings);
+            if (!user) {
+                redirect("/sign-in");
+            }
+            return user;
+        },
+        can: async (permission, settings) => {
+            const user = await getUser(settings);
+            return !!user && isAllowed(permission, user);
+        },
+        getAccessToken: async () => null,
+        ontology: createOntologyClient(ontologyTransport),
+        oauth: createAgentAuthorizations(ontologyTransport),
+        agent: createAgentIdentities(ontologyTransport),
+        signOut: async (settings) => {
+            await options.channelSession?.signOut();
+            await endFederationSession();
+            const store = await cookies();
+            for (const secure of [true, false]) {
+                store.set(cookieName(config.workspaceId, secure), "", attributes(secure, 0));
+            }
+            if (options.neon) {
+                return base.signOut(settings);
+            }
+            redirect(safeReturnTo(settings?.redirectTo ?? "/sign-in"));
+        },
+        proxy: (settings) => withUnframeablePages(async (request) => {
+            const forwardedOrPublic = [
+                PREFIX,
+                "/sign-in",
+                "/api/auth",
+                "/mcp",
+                "/api/ontology",
+                "/_next",
+                "/.well-known",
+                ...(settings?.publicPaths ?? []).map(normalizePublicPath),
+            ].some((path) => matchesPathPrefix(request.nextUrl.pathname, path));
+            const channelResponse = forwardedOrPublic ? undefined : await channel.proxy(request);
+            if (channelResponse) {
+                return channelResponse;
+            }
+            const { secure } = cookiePolicyFor(new URL(request.url), config.workspaceId);
+            const credential = request.cookies.get(cookieName(config.workspaceId, secure))?.value;
+            if (matchesPathPrefix(request.nextUrl.pathname, PREFIX)) {
+                return NextResponse.next();
+            }
+            if (options.browserAuth && !forwardedOrPublic) {
+                const failure = await configurationFailure(request);
+                if (failure)
+                    return failure;
+            }
+            if (credential && !forwardedOrPublic) {
+                const origin = await ontologyOrigin(options.ontologyUrl ?? request.nextUrl.origin);
+                const response = await options.fetch(`${origin}/api/ontology/me`, {
+                    headers: { authorization: `Bearer ${credential}` },
+                    cache: "no-store",
+                    redirect: "error",
+                    signal: AbortSignal.timeout(10000),
+                });
+                if (response.ok) {
+                    await userFromResponse(response);
+                    return NextResponse.next();
+                }
+                if (response.status !== 401 && response.status !== 403) {
+                    return NextResponse.json({ error: "session_unavailable" }, { status: 503, headers: { "cache-control": "no-store", "retry-after": "5" } });
+                }
+                const denied = isApiRequest(request)
+                    ? unauthenticatedResponse()
+                    : signInPage(request, "session_ended");
+                denied.cookies.set(cookieName(config.workspaceId, secure), "", attributes(secure, 0));
+                return denied;
+            }
+            if (options.browserAuth && !forwardedOrPublic) {
+                if (!options.neon) {
+                    if (isApiRequest(request) || request.method !== "GET")
+                        return unauthenticatedResponse();
+                    const browser = options.browserAuth.browser;
+                    const destination = request.headers.get("sec-fetch-dest");
+                    // Embedded channel launches must reach the local sign-in response so the
+                    // Telegram wrapper can exchange its assertion without opening central auth.
+                    const topLevel = destination === null || destination === "document";
+                    if (browser.auto_redirect && browser.methods.length === 1 && topLevel) {
+                        const destination = new URL(`${PREFIX}/sign-in`, request.url);
+                        destination.searchParams.set("returnTo", safeReturnTo(`${request.nextUrl.pathname}${request.nextUrl.search}`));
+                        return NextResponse.redirect(destination);
+                    }
+                    return signInPage(request);
+                }
+            }
+            return base.proxy(settings)(request);
+        }, channelAppFraming(config.channels)),
+    };
+}
+function protectResponse(response) {
+    response.headers.set("cache-control", "no-store");
+    response.headers.set("referrer-policy", "no-referrer");
+    return response;
+}