@smileid/usesmileid 12.0.0-beta01

package/src/data/api/interceptors/__tests__/token_refresh_interceptor.test.ts

@@ -0,0 +1,173 @@
+import axios, {
+  AxiosError,
+  AxiosHeaders,
+  type AxiosResponse,
+  type InternalAxiosRequestConfig,
+} from "axios";
+import { describe, expect, it, vi } from "vitest";
+
+import { TokenHolder } from "../../auth/token_holder";
+import { TokenRefreshInterceptor } from "../token_refresh_interceptor";
+
+/**
+ * Build a `RequestOptions`-like object for re-issuing requests. axios's
+ * `client.request(config)` reads `config.url`/`config.method` to dispatch.
+ */
+function makeRequestConfig(): InternalAxiosRequestConfig {
+  return {
+    headers: new AxiosHeaders(),
+    url: "/v1/job",
+    method: "post",
+  } as InternalAxiosRequestConfig;
+}
+
+/**
+ * Build a `401`-shaped `AxiosError` that the interceptor will receive on its
+ * response error branch. Marked with `isAxiosError = true` so the interceptor's
+ * narrow type-guard accepts it.
+ */
+function build401(
+  config: InternalAxiosRequestConfig = makeRequestConfig(),
+): AxiosError {
+  const response = {
+    status: 401,
+    statusText: "Unauthorized",
+    headers: new AxiosHeaders(),
+    config,
+    data: {},
+  } as AxiosResponse;
+  const error = new AxiosError(
+    "401 Unauthorized",
+    "ERR_BAD_REQUEST",
+    config,
+    null,
+    response,
+  );
+  // AxiosError sets isAxiosError = true in the constructor; defensively
+  // ensure it for the type guard.
+  Object.assign(error, { isAxiosError: true });
+  return error;
+}
+
+describe("TokenRefreshInterceptor", () => {
+  it("passes through when callback is undefined", async () => {
+    const client = axios.create();
+    const holder = new TokenHolder("old");
+    const subject = new TokenRefreshInterceptor({
+      tokenHolder: holder,
+      onTokenExpired: undefined,
+    });
+    subject.attach(client);
+    const requestSpy = vi.spyOn(client, "request");
+
+    const error = build401();
+    await expect(
+      // Replay the response interceptor's error branch directly.
+      (
+        client.interceptors.response as unknown as {
+          handlers: { rejected?: (e: unknown) => Promise<unknown> }[];
+        }
+      ).handlers[0]!.rejected!(error),
+    ).rejects.toBe(error);
+    expect(requestSpy).not.toHaveBeenCalled();
+    expect(holder.current).toBe("old");
+  });
+
+  it("on 401 invokes callback, updates holder, retries once", async () => {
+    const client = axios.create();
+    const holder = new TokenHolder("old");
+    const subject = new TokenRefreshInterceptor({
+      tokenHolder: holder,
+      onTokenExpired: async (previous) => {
+        expect(previous).toBe("old");
+        return "new";
+      },
+    });
+    subject.attach(client);
+    const requestSpy = vi
+      .spyOn(client, "request")
+      .mockResolvedValue({ status: 200 } as AxiosResponse);
+
+    const error = build401();
+    const result = await (
+      client.interceptors.response as unknown as {
+        handlers: { rejected?: (e: unknown) => Promise<unknown> }[];
+      }
+    ).handlers[0]!.rejected!(error);
+
+    expect((result as AxiosResponse).status).toBe(200);
+    expect(requestSpy).toHaveBeenCalledTimes(1);
+    expect(holder.current).toBe("new");
+  });
+
+  it("surfaces original 401 when callback throws", async () => {
+    const client = axios.create();
+    const holder = new TokenHolder("old");
+    const subject = new TokenRefreshInterceptor({
+      tokenHolder: holder,
+      onTokenExpired: async () => {
+        throw new Error("partner refresh broke");
+      },
+    });
+    subject.attach(client);
+    const requestSpy = vi.spyOn(client, "request");
+
+    const error = build401();
+    await expect(
+      (
+        client.interceptors.response as unknown as {
+          handlers: { rejected?: (e: unknown) => Promise<unknown> }[];
+        }
+      ).handlers[0]!.rejected!(error),
+    ).rejects.toBe(error);
+    expect(requestSpy).not.toHaveBeenCalled();
+    expect(holder.current).toBe("old");
+  });
+
+  it("surfaces original 401 when callback returns identical token", async () => {
+    const client = axios.create();
+    const holder = new TokenHolder("old");
+    const subject = new TokenRefreshInterceptor({
+      tokenHolder: holder,
+      onTokenExpired: async (previous) => previous,
+    });
+    subject.attach(client);
+    const requestSpy = vi.spyOn(client, "request");
+
+    const error = build401();
+    await expect(
+      (
+        client.interceptors.response as unknown as {
+          handlers: { rejected?: (e: unknown) => Promise<unknown> }[];
+        }
+      ).handlers[0]!.rejected!(error),
+    ).rejects.toBe(error);
+    expect(requestSpy).not.toHaveBeenCalled();
+  });
+
+  it("does not loop on a second 401 — retry marker stops the chain", async () => {
+    const client = axios.create();
+    const holder = new TokenHolder("old");
+    const subject = new TokenRefreshInterceptor({
+      tokenHolder: holder,
+      onTokenExpired: async () => "new",
+    });
+    subject.attach(client);
+    // Simulate a request that already went through one refresh.
+    const config = makeRequestConfig() as InternalAxiosRequestConfig & {
+      __smileid_token_refresh_retried?: boolean;
+    };
+    config.__smileid_token_refresh_retried = true;
+    const requestSpy = vi.spyOn(client, "request");
+
+    const error = build401(config);
+    await expect(
+      (
+        client.interceptors.response as unknown as {
+          handlers: { rejected?: (e: unknown) => Promise<unknown> }[];
+        }
+      ).handlers[0]!.rejected!(error),
+    ).rejects.toBe(error);
+    expect(requestSpy).not.toHaveBeenCalled();
+  });
+});

package/src/data/api/interceptors/gzip_interceptor.ts

@@ -0,0 +1,31 @@
+import type { AxiosInstance } from "axios";
+import type { Interceptor } from "../../../core/models/network_config";
+
+/**
+ * Interceptor that stamps `Accept-Encoding: gzip` on every outbound
+ * request so the server is invited to gzip its response. This is the
+ * same hint-only strategy iOS's `GzipRequestInterceptor` uses.
+ *
+ * Why hint-only on RN:
+ * - axios in React Native does not natively compress outbound bodies.
+ * - The SDK avoids pulling in a JS gzip dependency (`pako` etc.)
+ *   because every additional bundle byte ships to every partner app.
+ * - Stamping `Content-Encoding: gzip` without actually gzipping the
+ *   body — the prior behavior of this interceptor — was wrong: the
+ *   header told the server the body was gzipped when it was not.
+ *   Servers strict-parsing the header would reject the request.
+ *
+ * Partners whose backends require true request-body compression
+ * should add their own compressing interceptor in front of the SDK's
+ * network stack.
+ */
+export function createGzipInterceptor(): Interceptor {
+  return {
+    attach(client: AxiosInstance): void {
+      client.interceptors.request.use((requestConfig) => {
+        requestConfig.headers.set("Accept-Encoding", "gzip");
+        return requestConfig;
+      });
+    },
+  };
+}

package/src/data/api/interceptors/logging_interceptor.ts

@@ -0,0 +1,155 @@
+import type {
+  AxiosInstance,
+  AxiosResponse,
+  AxiosError,
+  InternalAxiosRequestConfig,
+} from "axios";
+import {
+  LogLevel,
+  type NetworkLoggingConfig,
+} from "../../../core/models/network_config";
+import { ALWAYS_REDACT, ALWAYS_REDACT_BODY_KEYS } from "./sensitive_headers";
+
+/**
+ * Logging interceptor.
+ *
+ * Levels:
+ *   - `none`:    silent
+ *   - `basic`:   request line + response status line
+ *   - `headers`: basic + request/response headers (with redaction)
+ *   - `body`:    headers + response body / error body (request body
+ *                is large — multipart binaries — and not logged)
+ *
+ * Header redaction: the auth interceptor adds sensitive headers
+ * (`SmileID-Token`, `smileid-partner-id`) and partners can extend
+ * the redaction list via
+ * `n.logging((l) => { l.redactHeaders = ['x-proxy-secret']; })`.
+ *
+ * One concrete security guard: redact list is case-insensitive —
+ * partners pass `'x-Partner-Token'` and we redact `'x-partner-token'`
+ * too.
+ */
+
+// Canonical redact set lives in a dedicated module so a new sensitive
+// header can be added in one place and picked up by every logging path.
+
+export function attachLoggingInterceptor(
+  client: AxiosInstance,
+  config: NetworkLoggingConfig,
+): { request: number; response: number } {
+  if (!config.enabled || config.level === LogLevel.none) {
+    // Attach no-op interceptors so `eject(...)` calls match.
+    const noopReq = client.interceptors.request.use((c) => c);
+    const noopRes = client.interceptors.response.use((r) => r);
+    return { request: noopReq, response: noopRes };
+  }
+
+  const partnerRedact = new Set(
+    config.redactHeaders.map((h) => h.toLowerCase()),
+  );
+
+  const requestId = client.interceptors.request.use((c) => {
+    logRequest(c, config.level, partnerRedact);
+    return c;
+  });
+
+  const responseId = client.interceptors.response.use(
+    (response) => {
+      logResponse(response, config.level);
+      return response;
+    },
+    (error: AxiosError) => {
+      logError(error, config.level);
+      return Promise.reject(error);
+    },
+  );
+
+  return { request: requestId, response: responseId };
+}
+
+function logRequest(
+  config: InternalAxiosRequestConfig,
+  level: NetworkLoggingConfig["level"],
+  partnerRedact: ReadonlySet<string>,
+): void {
+  const method = (config.method ?? "GET").toUpperCase();
+  const url = `${config.baseURL ?? ""}${config.url ?? ""}`;
+  // eslint-disable-next-line no-console
+  console.log(`[UseSmileID] → ${method} ${url}`);
+  if (level === LogLevel.headers || level === LogLevel.body) {
+    const redacted = redactHeaders(
+      config.headers as unknown as Record<string, unknown>,
+      partnerRedact,
+    );
+    // eslint-disable-next-line no-console
+    console.log("[UseSmileID]   headers:", redacted);
+  }
+}
+
+function logResponse(
+  response: AxiosResponse,
+  level: NetworkLoggingConfig["level"],
+): void {
+  // eslint-disable-next-line no-console
+  console.log(
+    `[UseSmileID] ← ${response.status} ${response.statusText} ${response.config.url ?? ""}`,
+  );
+  if (level === LogLevel.body) {
+    // eslint-disable-next-line no-console
+    console.log("[UseSmileID]   body:", redactBody(response.data));
+  }
+}
+
+function logError(
+  error: AxiosError,
+  level: NetworkLoggingConfig["level"],
+): void {
+  const status = error.response?.status ?? "no-response";
+  // eslint-disable-next-line no-console
+  console.warn(
+    `[UseSmileID] ✗ ${status} ${error.config?.url ?? ""} — ${error.message}`,
+  );
+  if (level === LogLevel.body && error.response) {
+    // eslint-disable-next-line no-console
+    console.warn("[UseSmileID]   body:", redactBody(error.response.data));
+  }
+}
+
+const MAX_REDACT_DEPTH = 6;
+
+/**
+ * Copy of `data` safe to log — sensitive keys masked, recursion capped
+ * at {@link MAX_REDACT_DEPTH}. Never mutates the input.
+ */
+function redactBody(data: unknown, depth: number = 0): unknown {
+  if (depth >= MAX_REDACT_DEPTH) return "<depth-limit>";
+  if (Array.isArray(data)) {
+    return data.map((item) => redactBody(item, depth + 1));
+  }
+  if (data !== null && typeof data === "object") {
+    const out: Record<string, unknown> = {};
+    for (const [key, value] of Object.entries(data)) {
+      out[key] = ALWAYS_REDACT_BODY_KEYS.has(key.toLowerCase())
+        ? "<redacted>"
+        : redactBody(value, depth + 1);
+    }
+    return out;
+  }
+  return data;
+}
+
+function redactHeaders(
+  headers: Record<string, unknown>,
+  partnerRedact: ReadonlySet<string>,
+): Record<string, unknown> {
+  const out: Record<string, unknown> = {};
+  for (const [key, value] of Object.entries(headers ?? {})) {
+    const lower = key.toLowerCase();
+    if (ALWAYS_REDACT.has(lower) || partnerRedact.has(lower)) {
+      out[key] = "<redacted>";
+    } else {
+      out[key] = value;
+    }
+  }
+  return out;
+}

package/src/data/api/interceptors/sensitive_headers.ts

@@ -0,0 +1,46 @@
+/**
+ * Canonical list of HTTP headers the SDK redacts unconditionally from
+ * any partner-visible log line, regardless of whether the partner
+ * remembered to populate `redactHeaders` themselves.
+ *
+ * These headers carry credentials, session tokens, or partner-id signals
+ * that would let a bystander reading the console output impersonate the
+ * partner's backend. The logging interceptor replaces the value with
+ * `██` while preserving the header name, so the audit trail still
+ * shows the header was present.
+ *
+ * Partners can extend this set via
+ * `n.logging((l) => { l.redactHeaders = ['x-partner-proxy-secret']; })` —
+ * the auto-applied + partner-supplied lists are unioned before logging.
+ *
+ * Names are stored lowercase; the logging interceptor matches
+ * case-insensitively.
+ */
+export const ALWAYS_REDACT: ReadonlySet<string> = new Set(
+  [
+    "smileid-token",
+    "smileid-partner-id",
+    "smileid-api-key",
+    "smileid-device-nonce",
+    "authorization",
+    "cookie",
+    "set-cookie",
+  ].map((h) => h.toLowerCase()),
+);
+
+/**
+ * JSON body fields redacted unconditionally from `LogLevel.body` log
+ * lines — credentials the server may echo back (token exchange,
+ * signed-response envelopes). Matched case-insensitively by full key.
+ */
+export const ALWAYS_REDACT_BODY_KEYS: ReadonlySet<string> = new Set(
+  [
+    "token",
+    "api_key",
+    "apikey",
+    "signature",
+    "secret",
+    "authorization",
+    "session_id",
+  ].map((k) => k.toLowerCase()),
+);

package/src/data/api/interceptors/smile_auth_interceptor.ts

@@ -0,0 +1,88 @@
+import type { AxiosInstance, InternalAxiosRequestConfig } from "axios";
+import { Platform } from "react-native";
+
+import type { PartnerConfig } from "../../../core/models/network_config";
+import { currentRequestTimestamp } from "../../security/request_timestamp";
+import type { TokenHolder } from "../auth/token_holder";
+
+/**
+ * Auth interceptor.
+ *
+ * Responsibilities:
+ *   1. Stamp the partner-supplied auth token onto every outbound
+ *      request as the `smileid-token` header.
+ *   2. Add the canonical SDK identification headers
+ *      (`smileid-source-sdk`, `smileid-source-sdk-version`,
+ *      `smileid-partner-id`, `callback-url`).
+ *   3. Stamp `smileid-request-timestamp` (epoch ms) before the request-MAC
+ *      interceptor runs, so it is part of the signed `smileid-*` set and the
+ *      MAC reuses it as the salt.
+ *
+ * Token exchange is the partner application's responsibility — it
+ * fetches a short-lived v3 token from its own backend and supplies the
+ * result via the network DSL's `config.token`. The interceptor reads
+ * the current value from the shared {@link TokenHolder} so a refreshed
+ * value written by `TokenRefreshInterceptor` is observed automatically
+ * by the next outgoing request.
+ */
+
+const SDK_VERSION = "12.0.0-beta01";
+
+/**
+ * Source-SDK identifier, suffixed with the runtime platform so the server can
+ * attribute the request and resolve the matching per-SDK signing secret.
+ */
+function sourceSdk(): string {
+  switch (Platform.OS) {
+    case "android":
+      return "react-native-expo (android)";
+    case "ios":
+      return "react-native-expo (iOS)";
+    default:
+      return "react-native-expo";
+  }
+}
+
+export type SmileAuthInterceptorOptions = {
+  readonly partnerConfig: PartnerConfig;
+  readonly tokenHolder: TokenHolder;
+};
+
+export class SmileAuthInterceptor {
+  private readonly _partnerConfig: PartnerConfig;
+  private readonly _tokenHolder: TokenHolder;
+
+  constructor(options: SmileAuthInterceptorOptions) {
+    this._partnerConfig = options.partnerConfig;
+    this._tokenHolder = options.tokenHolder;
+  }
+
+  /**
+   * Attach to an axios instance. Returns the interceptor ID so the
+   * caller can detach later if needed (typically just on instance
+   * disposal — the interceptor's lifetime tracks the instance).
+   */
+  attach(client: AxiosInstance): { request: number } {
+    const requestId = client.interceptors.request.use(async (config) => {
+      return this._onRequest(config);
+    });
+    return { request: requestId };
+  }
+
+  private async _onRequest(
+    config: InternalAxiosRequestConfig,
+  ): Promise<InternalAxiosRequestConfig> {
+    config.headers.set("smileid-token", this._tokenHolder.current);
+    config.headers.set("smileid-source-sdk", sourceSdk());
+    config.headers.set("smileid-source-sdk-version", SDK_VERSION);
+    config.headers.set("smileid-partner-id", this._partnerConfig.partnerId);
+    if (this._partnerConfig.callbackUrl) {
+      config.headers.set("callback-url", this._partnerConfig.callbackUrl);
+    }
+    // Generated at request time and stamped before the request-MAC interceptor
+    // runs, so it is part of the signed `smileid-*` header set and the MAC
+    // reuses the same value as its salt rather than reading the clock again.
+    config.headers.set("smileid-request-timestamp", currentRequestTimestamp());
+    return config;
+  }
+}

package/src/data/api/interceptors/smile_integrity_interceptor.ts

@@ -0,0 +1,79 @@
+import type { AxiosInstance, InternalAxiosRequestConfig } from "axios";
+
+import { Attestation, AttestationException } from "@smileid/usesmileid_bridge";
+
+import { REQUEST_MAC_HEADER } from "./smile_request_mac_interceptor";
+
+/**
+ * Stamps the `smileid-device-nonce` header on every outbound request
+ * whose axios config declares `_useSmileIDAttestation: true`. The
+ * header carries the base64-encoded envelope from
+ * `Attestation.requestToken`, bound to the `smileid-request-mac`
+ * value set upstream by `SmileRequestMacInterceptor`.
+ *
+ * Native side (Play Integrity on Android, App Attest on iOS) is
+ * already wired through `usesmileid_bridge`'s Expo module; this
+ * interceptor is a thin TS-side coordinator that:
+ *
+ *   1. Skips requests that don't opt in via `_useSmileIDAttestation`.
+ *   2. Reads the upstream `smileid-request-mac` header. If missing
+ *      (e.g. the endpoint opted into attestation but not MAC), ships
+ *      unattested — the integrity guarantee is the body binding, so
+ *      a stamped nonce without a MAC adds noise rather than security.
+ *   3. Calls `Attestation.requestToken(macHeader)`.
+ *   4. On success → stamp `smileid-device-nonce: <token>`.
+ *   5. On `AttestationException` → stamp
+ *      `smileid-device-nonce: ERR_<urlEncoded>`. **Fail-open by
+ *      design**: failing closed on the client means an outage at
+ *      Google / Apple takes the SDK offline; the server logs the
+ *      failure mode and decides policy.
+ *
+ * Warm-up lives outside the interceptor. Call `Attestation.warmUp()`
+ * once at flow mount so the per-request `requestToken` call doesn't
+ * pay the multi-second warm-up cost on every submission.
+ */
+
+export const DEVICE_NONCE_HEADER = "smileid-device-nonce";
+
+/** Axios config key that opts a request into attestation stamping. */
+export const ATTESTATION_OPT_IN_KEY = "_useSmileIDAttestation";
+
+export class SmileIntegrityInterceptor {
+  attach(client: AxiosInstance): { request: number } {
+    const requestId = client.interceptors.request.use(async (config) => {
+      return this._onRequest(config);
+    });
+    return { request: requestId };
+  }
+
+  private async _onRequest(
+    config: InternalAxiosRequestConfig,
+  ): Promise<InternalAxiosRequestConfig> {
+    const optedIn =
+      (config as InternalAxiosRequestConfig & Record<string, unknown>)[
+        ATTESTATION_OPT_IN_KEY
+      ] === true;
+    if (!optedIn) return config;
+
+    const macHeader = config.headers.get(REQUEST_MAC_HEADER);
+    if (typeof macHeader !== "string") return config;
+
+    try {
+      const token = await Attestation.requestToken(macHeader);
+      config.headers.set(DEVICE_NONCE_HEADER, token);
+    } catch (error) {
+      const message = errorMessage(error);
+      config.headers.set(
+        DEVICE_NONCE_HEADER,
+        `ERR_${encodeURIComponent(message)}`,
+      );
+    }
+    return config;
+  }
+}
+
+function errorMessage(error: unknown): string {
+  if (error instanceof AttestationException) return error.message;
+  if (error instanceof Error) return error.message;
+  return String(error);
+}

package/src/data/api/interceptors/smile_request_mac_interceptor.ts

@@ -0,0 +1,93 @@
+import type { AxiosInstance, InternalAxiosRequestConfig } from "axios";
+
+import { SmileIDCryptoError } from "../../security/smile_id_crypto_error";
+import type { SmileIDCryptoManager } from "../../security/smile_id_crypto_manager";
+
+/**
+ * Stamps the `smileid-request-mac` header on every outbound request whose axios
+ * config declares `_useSmileIDRequestMac: true`. The value is computed by
+ * {@link SmileIDCryptoManager}: an HMAC-SHA256 over the canonicalised
+ * `smileid-*` headers and request body, keyed by a PBKDF2-derived key from the
+ * Arkana signing secret, Base64-encoded.
+ *
+ * The MAC is salted with the request timestamp, which is stamped upstream by
+ * `SmileAuthInterceptor` and carried as the signed `smileid-request-timestamp`
+ * header. This interceptor reuses that value as the single source of truth for
+ * the salt; if it is absent (a MAC endpoint that is not auth-annotated — a
+ * misconfiguration), the request is left unsigned for the server to reject
+ * rather than signed against an invented timestamp.
+ *
+ * Requests without the opt-in flag pass through unchanged.
+ */
+
+export const REQUEST_MAC_HEADER = "smileid-request-mac";
+export const REQUEST_TIMESTAMP_HEADER = "smileid-request-timestamp";
+
+/** Axios config key that opts a request into MAC stamping. */
+export const REQUEST_MAC_OPT_IN_KEY = "_useSmileIDRequestMac";
+
+export type SmileRequestMacInterceptorOptions = {
+  readonly cryptoManager: SmileIDCryptoManager;
+};
+
+export class SmileRequestMacInterceptor {
+  private readonly _cryptoManager: SmileIDCryptoManager;
+
+  constructor(options: SmileRequestMacInterceptorOptions) {
+    this._cryptoManager = options.cryptoManager;
+  }
+
+  attach(client: AxiosInstance): { request: number } {
+    const requestId = client.interceptors.request.use(async (config) => {
+      return this._onRequest(config);
+    });
+    return { request: requestId };
+  }
+
+  private async _onRequest(
+    config: InternalAxiosRequestConfig,
+  ): Promise<InternalAxiosRequestConfig> {
+    const optedIn =
+      (config as InternalAxiosRequestConfig & Record<string, unknown>)[
+        REQUEST_MAC_OPT_IN_KEY
+      ] === true;
+    if (!optedIn) return config;
+
+    const timestamp = config.headers.get(REQUEST_TIMESTAMP_HEADER);
+    if (typeof timestamp !== "string") return config;
+
+    try {
+      const mac = await this._cryptoManager.sign(
+        timestamp,
+        headersToRecord(config.headers),
+        config.data,
+      );
+      config.headers.set(REQUEST_MAC_HEADER, mac);
+    } catch (error) {
+      if (!(error instanceof SmileIDCryptoError)) throw error;
+      // Signing failed (e.g. the signing secret is unavailable). Proceed
+      // without the MAC header rather than breaking the request; the server
+      // rejects the unsigned request with a clear error.
+    }
+
+    return config;
+  }
+}
+
+/** Flattens axios `AxiosHeaders` (or a plain object) to a string record. */
+function headersToRecord(
+  headers: InternalAxiosRequestConfig["headers"],
+): Record<string, string> {
+  const source =
+    typeof (headers as { toJSON?: () => unknown }).toJSON === "function"
+      ? ((headers as { toJSON: () => unknown }).toJSON() as Record<
+          string,
+          unknown
+        >)
+      : (headers as unknown as Record<string, unknown>);
+  const out: Record<string, string> = {};
+  for (const [key, value] of Object.entries(source)) {
+    if (value != null) out[key] = String(value);
+  }
+  return out;
+}