@strapi/plugin-users-permissions 0.0.0-experimental.6340da17068c3bed7fb006e7bcc554c71129e282 → 0.0.0-experimental.63624e21eb5b0713345a0cf2f68f1c40eab427bc

package/dist/server/utils/oauth-connect/index.mjs

@@ -0,0 +1,235 @@
+import require$$1 from '@strapi/utils';
+import { __require as requireProviders } from './providers.mjs';
+import { __require as requireOauth1 } from './oauth1.mjs';
+import { __require as requireOauth2 } from './oauth2.mjs';
+import { __require as requireTrimGrantSessionResponse } from '../trim-grant-session-response.mjs';
+import { __require as requireUtils } from '../index.mjs';
+
+var oauthConnect;
+var hasRequiredOauthConnect;
+function requireOauthConnect() {
+    if (hasRequiredOauthConnect) return oauthConnect;
+    hasRequiredOauthConnect = 1;
+    const { errors } = require$$1;
+    const builtinProviderEndpoints = requireProviders();
+    const oauth1 = requireOauth1();
+    const oauth2 = requireOauth2();
+    const { trimGrantSessionResponse } = requireTrimGrantSessionResponse();
+    const CONNECT_PREFIX = '/connect';
+    const parseConnectPath = (requestPath, apiPrefix)=>{
+        const prefix = `${apiPrefix}${CONNECT_PREFIX}/`;
+        if (!requestPath.startsWith(prefix)) {
+            return null;
+        }
+        const remainder = requestPath.slice(prefix.length);
+        const [provider, segment] = remainder.split('/').filter(Boolean);
+        if (!provider) {
+            return null;
+        }
+        return {
+            provider,
+            isCallback: segment === 'callback'
+        };
+    };
+    /**
+	 * Resolve OAuth endpoint config from built-ins, falling back to store-defined
+	 * endpoints so custom providers registered via providers-registry still work.
+	 */ const buildProviderConfig = (providerName, storedConfig, redirectUri)=>{
+        const defaults = builtinProviderEndpoints[providerName];
+        const endpoints = defaults || {
+            oauth: storedConfig.oauth,
+            authorize_url: storedConfig.authorize_url,
+            access_url: storedConfig.access_url,
+            request_url: storedConfig.request_url,
+            scope_delimiter: storedConfig.scope_delimiter,
+            token_endpoint_auth_method: storedConfig.token_endpoint_auth_method
+        };
+        if (endpoints.oauth === 1) {
+            if (!endpoints.request_url || !endpoints.authorize_url || !endpoints.access_url) {
+                return null;
+            }
+        } else if (!endpoints.authorize_url || !endpoints.access_url) {
+            return null;
+        }
+        return {
+            name: providerName,
+            ...endpoints,
+            key: storedConfig.key,
+            secret: storedConfig.secret,
+            scope: storedConfig.scope,
+            subdomain: storedConfig.subdomain,
+            callback: storedConfig.callback,
+            redirect_uri: redirectUri
+        };
+    };
+    const redirectWithPayload = (ctx, callbackUrl, payload)=>{
+        const url = new URL(callbackUrl);
+        const params = new URLSearchParams();
+        Object.entries(payload).forEach(([key, value])=>{
+            if (key === 'raw') {
+                Object.entries(value).forEach(([rawKey, rawValue])=>{
+                    params.set(`raw[${rawKey}]`, String(rawValue));
+                });
+                return;
+            }
+            if (value !== undefined && value !== null) {
+                params.set(key, String(value));
+            }
+        });
+        url.search = params.toString();
+        ctx.redirect(url.toString());
+    };
+    const preserveGrantDynamic = (ctx)=>{
+        const dynamic = ctx.session.grant?.dynamic;
+        return dynamic ? {
+            dynamic
+        } : {};
+    };
+    const redirectWithSessionResponse = (ctx, callbackUrl, provider, tokenResponse)=>{
+        const grantResponse = oauth2.tokensToQueryPayload(provider, tokenResponse);
+        ctx.session.grant = {
+            response: trimGrantSessionResponse(grantResponse, provider.name)
+        };
+        return redirectWithPayload(ctx, callbackUrl, {});
+    };
+    const startOAuth1Flow = async (ctx, provider, parsed, redirectUri)=>{
+        const requestToken = await oauth1.requestToken({
+            requestUrl: provider.request_url,
+            redirectUri,
+            consumerKey: provider.key,
+            clientCredential: provider.secret
+        });
+        ctx.session.grant = {
+            ...preserveGrantDynamic(ctx),
+            provider: parsed.provider,
+            request: requestToken
+        };
+        const authorizeUrl = `${provider.authorize_url}?oauth_token=${encodeURIComponent(requestToken.oauth_token)}`;
+        return ctx.redirect(authorizeUrl);
+    };
+    const startOAuth2Flow = (ctx, provider, parsed, redirectUri)=>{
+        const state = oauth2.generateState();
+        ctx.session.grant = {
+            ...preserveGrantDynamic(ctx),
+            provider: parsed.provider,
+            state
+        };
+        let authorizeUrl = oauth2.buildAuthorizeUrl(provider, {
+            key: provider.key,
+            redirectUri,
+            scope: provider.scope,
+            subdomain: provider.subdomain
+        });
+        authorizeUrl += `&state=${encodeURIComponent(state)}`;
+        return ctx.redirect(authorizeUrl);
+    };
+    const handleOAuth1Callback = async (ctx, provider, callbackUrl)=>{
+        const session = ctx.session.grant || {};
+        const { oauth_token: oauthToken, oauth_verifier: oauthVerifier } = ctx.query;
+        const requestToken = session.request;
+        if (!requestToken?.oauth_token || oauthToken !== requestToken.oauth_token) {
+            throw new Error('OAuth1 token mismatch');
+        }
+        const tokenResponse = await oauth1.accessToken({
+            accessUrl: provider.access_url,
+            consumerKey: provider.key,
+            clientCredential: provider.secret,
+            oauthToken,
+            oauthVerifier,
+            oauthTokenCredential: requestToken.oauth_token_secret
+        });
+        return redirectWithSessionResponse(ctx, callbackUrl, provider, tokenResponse);
+    };
+    const handleOAuth2Callback = async (ctx, provider, callbackUrl, redirectUri)=>{
+        const session = ctx.session.grant || {};
+        const { code, state: queryState, error, error_description: errorDescription } = ctx.query;
+        if (error) {
+            ctx.session.grant = {};
+            return redirectWithPayload(ctx, callbackUrl, {
+                error,
+                error_description: errorDescription
+            });
+        }
+        if (!code) {
+            throw new Error('OAuth2 missing code parameter');
+        }
+        // Reject when session state is missing (not only on mismatch) to close login-CSRF.
+        if (!session.state || queryState !== session.state) {
+            throw new Error('OAuth2 state mismatch');
+        }
+        const tokenResponse = await oauth2.exchangeAuthorizationCode(provider, {
+            key: provider.key,
+            secret: provider.secret,
+            redirectUri,
+            code,
+            subdomain: provider.subdomain
+        });
+        return redirectWithSessionResponse(ctx, callbackUrl, provider, tokenResponse);
+    };
+    const createOAuthConnectMiddleware = ()=>{
+        return async (ctx, next)=>{
+            const apiPrefix = strapi.config.get('api.rest.prefix');
+            const [requestPath] = ctx.request.url.split('?');
+            const parsed = parseConnectPath(requestPath, apiPrefix);
+            if (!parsed) {
+                return next();
+            }
+            if (!ctx.session) {
+                ctx.throw(400, 'OAuth connect requires session middleware');
+            }
+            const storedProviders = await strapi.store({
+                type: 'plugin',
+                name: 'users-permissions',
+                key: 'grant'
+            }).get();
+            const storedConfig = storedProviders?.[parsed.provider];
+            if (!storedConfig?.enabled) {
+                throw new errors.ApplicationError('This provider is disabled');
+            }
+            const { getService } = requireUtils();
+            const redirectUri = getService('providers').buildRedirectUri(parsed.provider);
+            const callbackOverride = ctx.state.oauthConnect?.callback ?? ctx.session.grant?.dynamic?.callback;
+            const effectiveConfig = callbackOverride ? {
+                ...storedConfig,
+                callback: callbackOverride
+            } : storedConfig;
+            const provider = buildProviderConfig(parsed.provider, effectiveConfig, redirectUri);
+            if (!provider) {
+                throw new errors.ApplicationError('Unknown OAuth provider');
+            }
+            ctx.session.grant = ctx.session.grant || {};
+            if (!parsed.isCallback) {
+                if (provider.oauth === 1) {
+                    return startOAuth1Flow(ctx, provider, parsed, redirectUri);
+                }
+                return startOAuth2Flow(ctx, provider, parsed, redirectUri);
+            }
+            const callbackUrl = effectiveConfig.callback;
+            if (!callbackUrl) {
+                throw new errors.ApplicationError('Provider callback URL is not configured');
+            }
+            try {
+                if (provider.oauth === 1) {
+                    return await handleOAuth1Callback(ctx, provider, callbackUrl);
+                }
+                return await handleOAuth2Callback(ctx, provider, callbackUrl, redirectUri);
+            } catch (err) {
+                ctx.session.grant = {};
+                return redirectWithPayload(ctx, callbackUrl, {
+                    error: 'oauth_error',
+                    error_description: err.message
+                });
+            }
+        };
+    };
+    oauthConnect = {
+        createOAuthConnectMiddleware,
+        parseConnectPath,
+        buildProviderConfig,
+        redirectWithPayload
+    };
+    return oauthConnect;
+}
+
+export { requireOauthConnect as __require };
+//# sourceMappingURL=index.mjs.map

package/dist/server/utils/oauth-connect/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","sources":["../../../../server/src/utils/oauth-connect/index.js"],"sourcesContent":["'use strict';\n\nconst { errors } = require('@strapi/utils');\n\nconst builtinProviderEndpoints = require('./providers');\nconst oauth1 = require('./oauth1');\nconst oauth2 = require('./oauth2');\nconst { trimGrantSessionResponse } = require('../trim-grant-session-response');\n\nconst CONNECT_PREFIX = '/connect';\n\nconst parseConnectPath = (requestPath, apiPrefix) => {\n  const prefix = `${apiPrefix}${CONNECT_PREFIX}/`;\n  if (!requestPath.startsWith(prefix)) {\n    return null;\n  }\n\n  const remainder = requestPath.slice(prefix.length);\n  const [provider, segment] = remainder.split('/').filter(Boolean);\n\n  if (!provider) {\n    return null;\n  }\n\n  return {\n    provider,\n    isCallback: segment === 'callback',\n  };\n};\n\n/**\n * Resolve OAuth endpoint config from built-ins, falling back to store-defined\n * endpoints so custom providers registered via providers-registry still work.\n */\nconst buildProviderConfig = (providerName, storedConfig, redirectUri) => {\n  const defaults = builtinProviderEndpoints[providerName];\n  const endpoints = defaults || {\n    oauth: storedConfig.oauth,\n    authorize_url: storedConfig.authorize_url,\n    access_url: storedConfig.access_url,\n    request_url: storedConfig.request_url,\n    scope_delimiter: storedConfig.scope_delimiter,\n    token_endpoint_auth_method: storedConfig.token_endpoint_auth_method,\n  };\n\n  if (endpoints.oauth === 1) {\n    if (!endpoints.request_url || !endpoints.authorize_url || !endpoints.access_url) {\n      return null;\n    }\n  } else if (!endpoints.authorize_url || !endpoints.access_url) {\n    return null;\n  }\n\n  return {\n    name: providerName,\n    ...endpoints,\n    key: storedConfig.key,\n    secret: storedConfig.secret,\n    scope: storedConfig.scope,\n    subdomain: storedConfig.subdomain,\n    callback: storedConfig.callback,\n    redirect_uri: redirectUri,\n  };\n};\n\nconst redirectWithPayload = (ctx, callbackUrl, payload) => {\n  const url = new URL(callbackUrl);\n  const params = new URLSearchParams();\n\n  Object.entries(payload).forEach(([key, value]) => {\n    if (key === 'raw') {\n      Object.entries(value).forEach(([rawKey, rawValue]) => {\n        params.set(`raw[${rawKey}]`, String(rawValue));\n      });\n      return;\n    }\n    if (value !== undefined && value !== null) {\n      params.set(key, String(value));\n    }\n  });\n\n  url.search = params.toString();\n  ctx.redirect(url.toString());\n};\n\nconst preserveGrantDynamic = (ctx) => {\n  const dynamic = ctx.session.grant?.dynamic;\n  return dynamic ? { dynamic } : {};\n};\n\nconst redirectWithSessionResponse = (ctx, callbackUrl, provider, tokenResponse) => {\n  const grantResponse = oauth2.tokensToQueryPayload(provider, tokenResponse);\n  ctx.session.grant = {\n    response: trimGrantSessionResponse(grantResponse, provider.name),\n  };\n\n  return redirectWithPayload(ctx, callbackUrl, {});\n};\n\nconst startOAuth1Flow = async (ctx, provider, parsed, redirectUri) => {\n  const requestToken = await oauth1.requestToken({\n    requestUrl: provider.request_url,\n    redirectUri,\n    consumerKey: provider.key,\n    clientCredential: provider.secret,\n  });\n\n  ctx.session.grant = {\n    ...preserveGrantDynamic(ctx),\n    provider: parsed.provider,\n    request: requestToken,\n  };\n\n  const authorizeUrl = `${provider.authorize_url}?oauth_token=${encodeURIComponent(requestToken.oauth_token)}`;\n  return ctx.redirect(authorizeUrl);\n};\n\nconst startOAuth2Flow = (ctx, provider, parsed, redirectUri) => {\n  const state = oauth2.generateState();\n  ctx.session.grant = {\n    ...preserveGrantDynamic(ctx),\n    provider: parsed.provider,\n    state,\n  };\n\n  let authorizeUrl = oauth2.buildAuthorizeUrl(provider, {\n    key: provider.key,\n    redirectUri,\n    scope: provider.scope,\n    subdomain: provider.subdomain,\n  });\n\n  authorizeUrl += `&state=${encodeURIComponent(state)}`;\n  return ctx.redirect(authorizeUrl);\n};\n\nconst handleOAuth1Callback = async (ctx, provider, callbackUrl) => {\n  const session = ctx.session.grant || {};\n  const { oauth_token: oauthToken, oauth_verifier: oauthVerifier } = ctx.query;\n  const requestToken = session.request;\n\n  if (!requestToken?.oauth_token || oauthToken !== requestToken.oauth_token) {\n    throw new Error('OAuth1 token mismatch');\n  }\n\n  const tokenResponse = await oauth1.accessToken({\n    accessUrl: provider.access_url,\n    consumerKey: provider.key,\n    clientCredential: provider.secret,\n    oauthToken,\n    oauthVerifier,\n    oauthTokenCredential: requestToken.oauth_token_secret,\n  });\n\n  return redirectWithSessionResponse(ctx, callbackUrl, provider, tokenResponse);\n};\n\nconst handleOAuth2Callback = async (ctx, provider, callbackUrl, redirectUri) => {\n  const session = ctx.session.grant || {};\n  const { code, state: queryState, error, error_description: errorDescription } = ctx.query;\n\n  if (error) {\n    ctx.session.grant = {};\n    return redirectWithPayload(ctx, callbackUrl, {\n      error,\n      error_description: errorDescription,\n    });\n  }\n\n  if (!code) {\n    throw new Error('OAuth2 missing code parameter');\n  }\n\n  // Reject when session state is missing (not only on mismatch) to close login-CSRF.\n  if (!session.state || queryState !== session.state) {\n    throw new Error('OAuth2 state mismatch');\n  }\n\n  const tokenResponse = await oauth2.exchangeAuthorizationCode(provider, {\n    key: provider.key,\n    secret: provider.secret,\n    redirectUri,\n    code,\n    subdomain: provider.subdomain,\n  });\n\n  return redirectWithSessionResponse(ctx, callbackUrl, provider, tokenResponse);\n};\n\nconst createOAuthConnectMiddleware = () => {\n  return async (ctx, next) => {\n    const apiPrefix = strapi.config.get('api.rest.prefix');\n    const [requestPath] = ctx.request.url.split('?');\n    const parsed = parseConnectPath(requestPath, apiPrefix);\n\n    if (!parsed) {\n      return next();\n    }\n\n    if (!ctx.session) {\n      ctx.throw(400, 'OAuth connect requires session middleware');\n    }\n\n    const storedProviders = await strapi\n      .store({ type: 'plugin', name: 'users-permissions', key: 'grant' })\n      .get();\n\n    const storedConfig = storedProviders?.[parsed.provider];\n    if (!storedConfig?.enabled) {\n      throw new errors.ApplicationError('This provider is disabled');\n    }\n\n    const { getService } = require('..');\n    const redirectUri = getService('providers').buildRedirectUri(parsed.provider);\n\n    const callbackOverride =\n      ctx.state.oauthConnect?.callback ?? ctx.session.grant?.dynamic?.callback;\n    const effectiveConfig = callbackOverride\n      ? { ...storedConfig, callback: callbackOverride }\n      : storedConfig;\n\n    const provider = buildProviderConfig(parsed.provider, effectiveConfig, redirectUri);\n\n    if (!provider) {\n      throw new errors.ApplicationError('Unknown OAuth provider');\n    }\n\n    ctx.session.grant = ctx.session.grant || {};\n\n    if (!parsed.isCallback) {\n      if (provider.oauth === 1) {\n        return startOAuth1Flow(ctx, provider, parsed, redirectUri);\n      }\n      return startOAuth2Flow(ctx, provider, parsed, redirectUri);\n    }\n\n    const callbackUrl = effectiveConfig.callback;\n    if (!callbackUrl) {\n      throw new errors.ApplicationError('Provider callback URL is not configured');\n    }\n\n    try {\n      if (provider.oauth === 1) {\n        return await handleOAuth1Callback(ctx, provider, callbackUrl);\n      }\n      return await handleOAuth2Callback(ctx, provider, callbackUrl, redirectUri);\n    } catch (err) {\n      ctx.session.grant = {};\n      return redirectWithPayload(ctx, callbackUrl, {\n        error: 'oauth_error',\n        error_description: err.message,\n      });\n    }\n  };\n};\n\nmodule.exports = {\n  createOAuthConnectMiddleware,\n  parseConnectPath,\n  buildProviderConfig,\n  redirectWithPayload,\n};\n"],"names":["errors","require$$0","builtinProviderEndpoints","require$$1","oauth1","require$$2","oauth2","require$$3","trimGrantSessionResponse","require$$4","CONNECT_PREFIX","parseConnectPath","requestPath","apiPrefix","prefix","startsWith","remainder","slice","length","provider","segment","split","filter","Boolean","isCallback","buildProviderConfig","providerName","storedConfig","redirectUri","defaults","endpoints","oauth","authorize_url","access_url","request_url","scope_delimiter","token_endpoint_auth_method","name","key","secret","scope","subdomain","callback","redirect_uri","redirectWithPayload","ctx","callbackUrl","payload","url","URL","params","URLSearchParams","Object","entries","forEach","value","rawKey","rawValue","set","String","undefined","search","toString","redirect","preserveGrantDynamic","dynamic","session","grant","redirectWithSessionResponse","tokenResponse","grantResponse","tokensToQueryPayload","response","startOAuth1Flow","parsed","requestToken","requestUrl","consumerKey","clientCredential","request","authorizeUrl","encodeURIComponent","oauth_token","startOAuth2Flow","state","generateState","buildAuthorizeUrl","handleOAuth1Callback","oauthToken","oauth_verifier","oauthVerifier","query","Error","accessToken","accessUrl","oauthTokenCredential","oauth_token_secret","handleOAuth2Callback","code","queryState","error","error_description","errorDescription","exchangeAuthorizationCode","createOAuthConnectMiddleware","next","strapi","config","get","throw","storedProviders","store","type","enabled","ApplicationError","getService","require$$5","buildRedirectUri","callbackOverride","oauthConnect","effectiveConfig","err","message"],"mappings":";;;;;;;;;;;;IAEA,MAAM,EAAEA,MAAM,EAAE,GAAGC,UAAAA;AAEnB,IAAA,MAAMC,wBAAAA,GAA2BC,gBAAAA,EAAAA;AACjC,IAAA,MAAMC,MAAAA,GAASC,aAAAA,EAAAA;AACf,IAAA,MAAMC,MAAAA,GAASC,aAAAA,EAAAA;IACf,MAAM,EAAEC,wBAAwB,EAAE,GAAGC,+BAAAA,EAAAA;AAErC,IAAA,MAAMC,cAAAA,GAAiB,UAAA;IAEvB,MAAMC,gBAAAA,GAAmB,CAACC,WAAAA,EAAaC,SAAAA,GAAAA;AACrC,QAAA,MAAMC,MAAAA,GAAS,CAAA,EAAGD,SAAAA,CAAAA,EAAYH,cAAAA,CAAe,CAAC,CAAC;AAC/C,QAAA,IAAI,CAACE,WAAAA,CAAYG,UAAU,CAACD,MAAAA,CAAAA,EAAS;YACnC,OAAO,IAAA;AACX,QAAA;AAEE,QAAA,MAAME,SAAAA,GAAYJ,WAAAA,CAAYK,KAAK,CAACH,OAAOI,MAAM,CAAA;QACjD,MAAM,CAACC,UAAUC,OAAAA,CAAQ,GAAGJ,UAAUK,KAAK,CAAC,GAAA,CAAA,CAAKC,MAAM,CAACC,OAAAA,CAAAA;AAExD,QAAA,IAAI,CAACJ,QAAAA,EAAU;YACb,OAAO,IAAA;AACX,QAAA;QAEE,OAAO;AACLA,YAAAA,QAAAA;AACAK,YAAAA,UAAAA,EAAYJ,OAAAA,KAAY;AAC5B,SAAA;AACA,IAAA,CAAA;AAEA;;;AAGA,KACA,MAAMK,mBAAAA,GAAsB,CAACC,YAAAA,EAAcC,YAAAA,EAAcC,WAAAA,GAAAA;QACvD,MAAMC,QAAAA,GAAW3B,wBAAwB,CAACwB,YAAAA,CAAa;AACvD,QAAA,MAAMI,YAAYD,QAAAA,IAAY;AAC5BE,YAAAA,KAAAA,EAAOJ,aAAaI,KAAK;AACzBC,YAAAA,aAAAA,EAAeL,aAAaK,aAAa;AACzCC,YAAAA,UAAAA,EAAYN,aAAaM,UAAU;AACnCC,YAAAA,WAAAA,EAAaP,aAAaO,WAAW;AACrCC,YAAAA,eAAAA,EAAiBR,aAAaQ,eAAe;AAC7CC,YAAAA,0BAAAA,EAA4BT,aAAaS;AAC7C,SAAA;QAEE,IAAIN,SAAAA,CAAUC,KAAK,KAAK,CAAA,EAAG;YACzB,IAAI,CAACD,SAAAA,CAAUI,WAAW,IAAI,CAACJ,SAAAA,CAAUE,aAAa,IAAI,CAACF,SAAAA,CAAUG,UAAU,EAAE;gBAC/E,OAAO,IAAA;AACb,YAAA;QACA,CAAA,MAAS,IAAI,CAACH,SAAAA,CAAUE,aAAa,IAAI,CAACF,SAAAA,CAAUG,UAAU,EAAE;YAC5D,OAAO,IAAA;AACX,QAAA;QAEE,OAAO;YACLI,IAAAA,EAAMX,YAAAA;AACN,YAAA,GAAGI,SAAS;AACZQ,YAAAA,GAAAA,EAAKX,aAAaW,GAAG;AACrBC,YAAAA,MAAAA,EAAQZ,aAAaY,MAAM;AAC3BC,YAAAA,KAAAA,EAAOb,aAAaa,KAAK;AACzBC,YAAAA,SAAAA,EAAWd,aAAac,SAAS;AACjCC,YAAAA,QAAAA,EAAUf,aAAae,QAAQ;YAC/BC,YAAAA,EAAcf;AAClB,SAAA;AACA,IAAA,CAAA;IAEA,MAAMgB,mBAAAA,GAAsB,CAACC,GAAAA,EAAKC,WAAAA,EAAaC,OAAAA,GAAAA;QAC7C,MAAMC,GAAAA,GAAM,IAAIC,GAAAA,CAAIH,WAAAA,CAAAA;AACpB,QAAA,MAAMI,SAAS,IAAIC,eAAAA,EAAAA;QAEnBC,MAAAA,CAAOC,OAAO,CAACN,OAAAA,CAAAA,CAASO,OAAO,CAAC,CAAC,CAAChB,KAAKiB,KAAAA,CAAM,GAAA;AAC3C,YAAA,IAAIjB,QAAQ,KAAA,EAAO;gBACjBc,MAAAA,CAAOC,OAAO,CAACE,KAAAA,CAAAA,CAAOD,OAAO,CAAC,CAAC,CAACE,QAAQC,QAAAA,CAAS,GAAA;oBAC/CP,MAAAA,CAAOQ,GAAG,CAAC,CAAC,IAAI,EAAEF,MAAAA,CAAO,CAAC,CAAC,EAAEG,MAAAA,CAAOF,QAAAA,CAAAA,CAAAA;AAC5C,gBAAA,CAAA,CAAA;AACM,gBAAA;AACN,YAAA;YACI,IAAIF,KAAAA,KAAUK,SAAAA,IAAaL,KAAAA,KAAU,IAAA,EAAM;gBACzCL,MAAAA,CAAOQ,GAAG,CAACpB,GAAAA,EAAKqB,MAAAA,CAAOJ,KAAAA,CAAAA,CAAAA;AAC7B,YAAA;AACA,QAAA,CAAA,CAAA;QAEEP,GAAAA,CAAIa,MAAM,GAAGX,MAAAA,CAAOY,QAAQ,EAAA;QAC5BjB,GAAAA,CAAIkB,QAAQ,CAACf,GAAAA,CAAIc,QAAQ,EAAA,CAAA;AAC3B,IAAA,CAAA;AAEA,IAAA,MAAME,uBAAuB,CAACnB,GAAAA,GAAAA;AAC5B,QAAA,MAAMoB,OAAAA,GAAUpB,GAAAA,CAAIqB,OAAO,CAACC,KAAK,EAAEF,OAAAA;AACnC,QAAA,OAAOA,OAAAA,GAAU;AAAEA,YAAAA;AAAO,SAAA,GAAK,EAAA;AACjC,IAAA,CAAA;AAEA,IAAA,MAAMG,2BAAAA,GAA8B,CAACvB,GAAAA,EAAKC,WAAAA,EAAa3B,QAAAA,EAAUkD,aAAAA,GAAAA;AAC/D,QAAA,MAAMC,aAAAA,GAAgBhE,MAAAA,CAAOiE,oBAAoB,CAACpD,QAAAA,EAAUkD,aAAAA,CAAAA;QAC5DxB,GAAAA,CAAIqB,OAAO,CAACC,KAAK,GAAG;YAClBK,QAAAA,EAAUhE,wBAAAA,CAAyB8D,aAAAA,EAAenD,QAAAA,CAASkB,IAAI;AACnE,SAAA;QAEE,OAAOO,mBAAAA,CAAoBC,GAAAA,EAAKC,WAAAA,EAAa;AAC/C,IAAA,CAAA;AAEA,IAAA,MAAM2B,eAAAA,GAAkB,OAAO5B,GAAAA,EAAK1B,QAAAA,EAAUuD,MAAAA,EAAQ9C,WAAAA,GAAAA;AACpD,QAAA,MAAM+C,YAAAA,GAAe,MAAMvE,MAAAA,CAAOuE,YAAY,CAAC;AAC7CC,YAAAA,UAAAA,EAAYzD,SAASe,WAAW;AAChCN,YAAAA,WAAAA;AACAiD,YAAAA,WAAAA,EAAa1D,SAASmB,GAAG;AACzBwC,YAAAA,gBAAAA,EAAkB3D,SAASoB;AAC/B,SAAA,CAAA;QAEEM,GAAAA,CAAIqB,OAAO,CAACC,KAAK,GAAG;AAClB,YAAA,GAAGH,qBAAqBnB,GAAAA,CAAI;AAC5B1B,YAAAA,QAAAA,EAAUuD,OAAOvD,QAAQ;YACzB4D,OAAAA,EAASJ;AACb,SAAA;QAEE,MAAMK,YAAAA,GAAe,CAAA,EAAG7D,QAAAA,CAASa,aAAa,CAAC,aAAa,EAAEiD,kBAAAA,CAAmBN,YAAAA,CAAaO,WAAW,CAAA,CAAA,CAAG;QAC5G,OAAOrC,GAAAA,CAAIkB,QAAQ,CAACiB,YAAAA,CAAAA;AACtB,IAAA,CAAA;AAEA,IAAA,MAAMG,eAAAA,GAAkB,CAACtC,GAAAA,EAAK1B,QAAAA,EAAUuD,MAAAA,EAAQ9C,WAAAA,GAAAA;QAC9C,MAAMwD,KAAAA,GAAQ9E,OAAO+E,aAAa,EAAA;QAClCxC,GAAAA,CAAIqB,OAAO,CAACC,KAAK,GAAG;AAClB,YAAA,GAAGH,qBAAqBnB,GAAAA,CAAI;AAC5B1B,YAAAA,QAAAA,EAAUuD,OAAOvD,QAAQ;AACzBiE,YAAAA;AACJ,SAAA;AAEE,QAAA,IAAIJ,YAAAA,GAAe1E,MAAAA,CAAOgF,iBAAiB,CAACnE,QAAAA,EAAU;AACpDmB,YAAAA,GAAAA,EAAKnB,SAASmB,GAAG;AACjBV,YAAAA,WAAAA;AACAY,YAAAA,KAAAA,EAAOrB,SAASqB,KAAK;AACrBC,YAAAA,SAAAA,EAAWtB,SAASsB;AACxB,SAAA,CAAA;AAEEuC,QAAAA,YAAAA,IAAgB,CAAC,OAAO,EAAEC,kBAAAA,CAAmBG,KAAAA,CAAAA,CAAAA,CAAQ;QACrD,OAAOvC,GAAAA,CAAIkB,QAAQ,CAACiB,YAAAA,CAAAA;AACtB,IAAA,CAAA;IAEA,MAAMO,oBAAAA,GAAuB,OAAO1C,GAAAA,EAAK1B,QAAAA,EAAU2B,WAAAA,GAAAA;AACjD,QAAA,MAAMoB,UAAUrB,GAAAA,CAAIqB,OAAO,CAACC,KAAK,IAAI,EAAA;QACrC,MAAM,EAAEe,aAAaM,UAAU,EAAEC,gBAAgBC,aAAa,EAAE,GAAG7C,GAAAA,CAAI8C,KAAK;QAC5E,MAAMhB,YAAAA,GAAeT,QAAQa,OAAO;AAEpC,QAAA,IAAI,CAACJ,YAAAA,EAAcO,WAAAA,IAAeM,UAAAA,KAAeb,YAAAA,CAAaO,WAAW,EAAE;AACzE,YAAA,MAAM,IAAIU,KAAAA,CAAM,uBAAA,CAAA;AACpB,QAAA;AAEE,QAAA,MAAMvB,aAAAA,GAAgB,MAAMjE,MAAAA,CAAOyF,WAAW,CAAC;AAC7CC,YAAAA,SAAAA,EAAW3E,SAASc,UAAU;AAC9B4C,YAAAA,WAAAA,EAAa1D,SAASmB,GAAG;AACzBwC,YAAAA,gBAAAA,EAAkB3D,SAASoB,MAAM;AACjCiD,YAAAA,UAAAA;AACAE,YAAAA,aAAAA;AACAK,YAAAA,oBAAAA,EAAsBpB,aAAaqB;AACvC,SAAA,CAAA;QAEE,OAAO5B,2BAAAA,CAA4BvB,GAAAA,EAAKC,WAAAA,EAAa3B,QAAAA,EAAUkD,aAAAA,CAAAA;AACjE,IAAA,CAAA;AAEA,IAAA,MAAM4B,oBAAAA,GAAuB,OAAOpD,GAAAA,EAAK1B,QAAAA,EAAU2B,WAAAA,EAAalB,WAAAA,GAAAA;AAC9D,QAAA,MAAMsC,UAAUrB,GAAAA,CAAIqB,OAAO,CAACC,KAAK,IAAI,EAAA;AACrC,QAAA,MAAM,EAAE+B,IAAI,EAAEd,KAAAA,EAAOe,UAAU,EAAEC,KAAK,EAAEC,iBAAAA,EAAmBC,gBAAgB,EAAE,GAAGzD,IAAI8C,KAAK;AAEzF,QAAA,IAAIS,KAAAA,EAAO;AACTvD,YAAAA,GAAAA,CAAIqB,OAAO,CAACC,KAAK,GAAG,EAAA;YACpB,OAAOvB,mBAAAA,CAAoBC,KAAKC,WAAAA,EAAa;AAC3CsD,gBAAAA,KAAAA;gBACAC,iBAAAA,EAAmBC;AACzB,aAAA,CAAA;AACA,QAAA;AAEE,QAAA,IAAI,CAACJ,IAAAA,EAAM;AACT,YAAA,MAAM,IAAIN,KAAAA,CAAM,+BAAA,CAAA;AACpB,QAAA;;AAGE,QAAA,IAAI,CAAC1B,OAAAA,CAAQkB,KAAK,IAAIe,UAAAA,KAAejC,OAAAA,CAAQkB,KAAK,EAAE;AAClD,YAAA,MAAM,IAAIQ,KAAAA,CAAM,uBAAA,CAAA;AACpB,QAAA;AAEE,QAAA,MAAMvB,aAAAA,GAAgB,MAAM/D,MAAAA,CAAOiG,yBAAyB,CAACpF,QAAAA,EAAU;AACrEmB,YAAAA,GAAAA,EAAKnB,SAASmB,GAAG;AACjBC,YAAAA,MAAAA,EAAQpB,SAASoB,MAAM;AACvBX,YAAAA,WAAAA;AACAsE,YAAAA,IAAAA;AACAzD,YAAAA,SAAAA,EAAWtB,SAASsB;AACxB,SAAA,CAAA;QAEE,OAAO2B,2BAAAA,CAA4BvB,GAAAA,EAAKC,WAAAA,EAAa3B,QAAAA,EAAUkD,aAAAA,CAAAA;AACjE,IAAA,CAAA;AAEA,IAAA,MAAMmC,4BAAAA,GAA+B,IAAA;AACnC,QAAA,OAAO,OAAO3D,GAAAA,EAAK4D,IAAAA,GAAAA;AACjB,YAAA,MAAM5F,SAAAA,GAAY6F,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,iBAAA,CAAA;YACpC,MAAM,CAAChG,YAAY,GAAGiC,GAAAA,CAAIkC,OAAO,CAAC/B,GAAG,CAAC3B,KAAK,CAAC,GAAA,CAAA;YAC5C,MAAMqD,MAAAA,GAAS/D,iBAAiBC,WAAAA,EAAaC,SAAAA,CAAAA;AAE7C,YAAA,IAAI,CAAC6D,MAAAA,EAAQ;gBACX,OAAO+B,IAAAA,EAAAA;AACb,YAAA;YAEI,IAAI,CAAC5D,GAAAA,CAAIqB,OAAO,EAAE;gBAChBrB,GAAAA,CAAIgE,KAAK,CAAC,GAAA,EAAK,2CAAA,CAAA;AACrB,YAAA;AAEI,YAAA,MAAMC,eAAAA,GAAkB,MAAMJ,MAAAA,CAC3BK,KAAK,CAAC;gBAAEC,IAAAA,EAAM,QAAA;gBAAU3E,IAAAA,EAAM,mBAAA;gBAAqBC,GAAAA,EAAK;AAAO,aAAA,CAAA,CAC/DsE,GAAG,EAAA;AAEN,YAAA,MAAMjF,YAAAA,GAAemF,eAAAA,GAAkBpC,MAAAA,CAAOvD,QAAQ,CAAC;YACvD,IAAI,CAACQ,cAAcsF,OAAAA,EAAS;gBAC1B,MAAM,IAAIjH,MAAAA,CAAOkH,gBAAgB,CAAC,2BAAA,CAAA;AACxC,YAAA;YAEI,MAAM,EAAEC,UAAU,EAAE,GAAGC,YAAAA,EAAAA;AACvB,YAAA,MAAMxF,cAAcuF,UAAAA,CAAW,WAAA,CAAA,CAAaE,gBAAgB,CAAC3C,OAAOvD,QAAQ,CAAA;AAE5E,YAAA,MAAMmG,gBAAAA,GACJzE,GAAAA,CAAIuC,KAAK,CAACmC,YAAY,EAAE7E,QAAAA,IAAYG,GAAAA,CAAIqB,OAAO,CAACC,KAAK,EAAEF,OAAAA,EAASvB,QAAAA;AAClE,YAAA,MAAM8E,kBAAkBF,gBAAAA,GACpB;AAAE,gBAAA,GAAG3F,YAAY;gBAAEe,QAAAA,EAAU4E;aAAgB,GAC7C3F,YAAAA;AAEJ,YAAA,MAAMR,QAAAA,GAAWM,mBAAAA,CAAoBiD,MAAAA,CAAOvD,QAAQ,EAAEqG,eAAAA,EAAiB5F,WAAAA,CAAAA;AAEvE,YAAA,IAAI,CAACT,QAAAA,EAAU;gBACb,MAAM,IAAInB,MAAAA,CAAOkH,gBAAgB,CAAC,wBAAA,CAAA;AACxC,YAAA;YAEIrE,GAAAA,CAAIqB,OAAO,CAACC,KAAK,GAAGtB,IAAIqB,OAAO,CAACC,KAAK,IAAI,EAAA;YAEzC,IAAI,CAACO,MAAAA,CAAOlD,UAAU,EAAE;gBACtB,IAAIL,QAAAA,CAASY,KAAK,KAAK,CAAA,EAAG;oBACxB,OAAO0C,eAAAA,CAAgB5B,GAAAA,EAAK1B,QAAAA,EAAUuD,MAAAA,EAAQ9C,WAAAA,CAAAA;AACtD,gBAAA;gBACM,OAAOuD,eAAAA,CAAgBtC,GAAAA,EAAK1B,QAAAA,EAAUuD,MAAAA,EAAQ9C,WAAAA,CAAAA;AACpD,YAAA;YAEI,MAAMkB,WAAAA,GAAc0E,gBAAgB9E,QAAQ;AAC5C,YAAA,IAAI,CAACI,WAAAA,EAAa;gBAChB,MAAM,IAAI9C,MAAAA,CAAOkH,gBAAgB,CAAC,yCAAA,CAAA;AACxC,YAAA;YAEI,IAAI;gBACF,IAAI/F,QAAAA,CAASY,KAAK,KAAK,CAAA,EAAG;oBACxB,OAAO,MAAMwD,oBAAAA,CAAqB1C,GAAAA,EAAK1B,QAAAA,EAAU2B,WAAAA,CAAAA;AACzD,gBAAA;AACM,gBAAA,OAAO,MAAMmD,oBAAAA,CAAqBpD,GAAAA,EAAK1B,QAAAA,EAAU2B,WAAAA,EAAalB,WAAAA,CAAAA;AACpE,YAAA,CAAA,CAAM,OAAO6F,GAAAA,EAAK;AACZ5E,gBAAAA,GAAAA,CAAIqB,OAAO,CAACC,KAAK,GAAG,EAAA;gBACpB,OAAOvB,mBAAAA,CAAoBC,KAAKC,WAAAA,EAAa;oBAC3CsD,KAAAA,EAAO,aAAA;AACPC,oBAAAA,iBAAAA,EAAmBoB,IAAIC;AAC/B,iBAAA,CAAA;AACA,YAAA;AACA,QAAA,CAAA;AACA,IAAA,CAAA;IAEAH,YAAAA,GAAiB;AACff,QAAAA,4BAAAA;AACA7F,QAAAA,gBAAAA;AACAc,QAAAA,mBAAAA;AACAmB,QAAAA;AACF,KAAA;;;;;;"}

package/dist/server/utils/oauth-connect/oauth1.js

@@ -0,0 +1,138 @@
+'use strict';
+
+var _node_crypto_commonjsExternal = require('../../_virtual/_node_crypto.js');
+var _node_url_commonjsExternal = require('../../_virtual/_node_url.js');
+
+var oauth1;
+var hasRequiredOauth1;
+function requireOauth1() {
+    if (hasRequiredOauth1) return oauth1;
+    hasRequiredOauth1 = 1;
+    const crypto = _node_crypto_commonjsExternal.__require();
+    const { URLSearchParams } = _node_url_commonjsExternal.__require();
+    const encode = (str)=>encodeURIComponent(str).replace(/[!'()*]/g, (c)=>`%${c.codePointAt(0).toString(16).toUpperCase()}`);
+    const sortKeys = (keys)=>keys.sort((a, b)=>{
+            if (a < b) return -1;
+            if (a > b) return 1;
+            return 0;
+        });
+    /**
+	 * OAuth 1.0 (RFC 5849) request signature — HMAC-SHA1 is required by the protocol.
+	 * This is not password storage or user-credential hashing (those use bcrypt).
+	 */ const signRfc5849BaseString = (signatureBaseString, signingMaterial)=>{
+        // codeql[js/insufficient-password-hash] OAuth 1.0 signing material, not user password storage
+        return crypto.createHmac('sha1', signingMaterial).update(signatureBaseString).digest('base64');
+    };
+    const buildOAuth1Header = ({ method, url, params, consumerKey, clientCredential, token, tokenCredential })=>{
+        const requestParameters = {
+            oauth_consumer_key: consumerKey,
+            oauth_nonce: crypto.randomBytes(16).toString('hex'),
+            oauth_signature_method: 'HMAC-SHA1',
+            oauth_timestamp: Math.floor(Date.now() / 1000).toString(),
+            oauth_version: '1.0',
+            ...token ? {
+                oauth_token: token
+            } : {},
+            ...params
+        };
+        const paramString = sortKeys(Object.keys(requestParameters)).map((key)=>`${encode(key)}=${encode(requestParameters[key])}`).join('&');
+        const signatureBaseString = [
+            method.toUpperCase(),
+            encode(url),
+            encode(paramString)
+        ].join('&');
+        const signingMaterial = `${encode(clientCredential)}&${encode(tokenCredential || '')}`;
+        const signature = signRfc5849BaseString(signatureBaseString, signingMaterial);
+        const headerParameters = {
+            ...requestParameters,
+            oauth_signature: signature
+        };
+        const header = `OAuth ${sortKeys(Object.keys(headerParameters)).map((key)=>`${encode(key)}="${encode(headerParameters[key])}"`).join(', ')}`;
+        return header;
+    };
+    const oauth1Request = async ({ method, url, consumerKey, clientCredential, token, tokenCredential, params = {} })=>{
+        const authorization = buildOAuth1Header({
+            method,
+            url,
+            params,
+            consumerKey,
+            clientCredential,
+            token,
+            tokenCredential
+        });
+        const response = await fetch(url, {
+            method,
+            headers: {
+                Authorization: authorization
+            }
+        });
+        const text = await response.text();
+        if (!response.ok) {
+            throw new Error(text || `OAuth1 request failed (${response.status})`);
+        }
+        return Object.fromEntries(new URLSearchParams(text));
+    };
+    const requestToken = async ({ requestUrl, redirectUri, consumerKey, clientCredential })=>oauth1Request({
+            method: 'POST',
+            url: requestUrl,
+            consumerKey,
+            clientCredential,
+            params: {
+                oauth_callback: redirectUri
+            }
+        });
+    const accessToken = async ({ accessUrl, consumerKey, clientCredential, oauthToken, oauthVerifier, oauthTokenCredential })=>oauth1Request({
+            method: 'POST',
+            url: accessUrl,
+            consumerKey,
+            clientCredential,
+            token: oauthToken,
+            tokenCredential: oauthTokenCredential,
+            params: {
+                oauth_verifier: oauthVerifier
+            }
+        });
+    const twitterGet = async ({ url, accessToken, accessCredential, consumerKey, clientCredential, qs = {} })=>{
+        const target = new URL(url);
+        const signedParams = {};
+        Object.entries(qs).forEach(([key, value])=>{
+            if (value !== undefined && value !== null) {
+                const stringValue = String(value);
+                target.searchParams.set(key, stringValue);
+                // RFC 5849 §3.4.1: base-string URI excludes the query; params are signed separately.
+                signedParams[key] = stringValue;
+            }
+        });
+        const authorization = buildOAuth1Header({
+            method: 'GET',
+            url: target.origin + target.pathname,
+            params: signedParams,
+            consumerKey,
+            clientCredential,
+            token: accessToken,
+            tokenCredential: accessCredential
+        });
+        const response = await fetch(target, {
+            headers: {
+                Authorization: authorization
+            }
+        });
+        const body = await response.json();
+        if (!response.ok) {
+            throw new Error(body.errors?.[0]?.message || `Twitter API error (${response.status})`);
+        }
+        return {
+            body
+        };
+    };
+    oauth1 = {
+        buildOAuth1Header,
+        requestToken,
+        accessToken,
+        twitterGet
+    };
+    return oauth1;
+}
+
+exports.__require = requireOauth1;
+//# sourceMappingURL=oauth1.js.map

package/dist/server/utils/oauth-connect/oauth1.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth1.js","sources":["../../../../server/src/utils/oauth-connect/oauth1.js"],"sourcesContent":["'use strict';\n\nconst crypto = require('node:crypto');\nconst { URLSearchParams } = require('node:url');\n\nconst encode = (str) =>\n  encodeURIComponent(str).replace(\n    /[!'()*]/g,\n    (c) => `%${c.codePointAt(0).toString(16).toUpperCase()}`\n  );\n\nconst sortKeys = (keys) =>\n  keys.sort((a, b) => {\n    if (a < b) return -1;\n    if (a > b) return 1;\n    return 0;\n  });\n\n/**\n * OAuth 1.0 (RFC 5849) request signature — HMAC-SHA1 is required by the protocol.\n * This is not password storage or user-credential hashing (those use bcrypt).\n */\nconst signRfc5849BaseString = (signatureBaseString, signingMaterial) => {\n  // codeql[js/insufficient-password-hash] OAuth 1.0 signing material, not user password storage\n  return crypto.createHmac('sha1', signingMaterial).update(signatureBaseString).digest('base64');\n};\n\nconst buildOAuth1Header = ({\n  method,\n  url,\n  params,\n  consumerKey,\n  clientCredential,\n  token,\n  tokenCredential,\n}) => {\n  const requestParameters = {\n    oauth_consumer_key: consumerKey,\n    oauth_nonce: crypto.randomBytes(16).toString('hex'),\n    oauth_signature_method: 'HMAC-SHA1',\n    oauth_timestamp: Math.floor(Date.now() / 1000).toString(),\n    oauth_version: '1.0',\n    ...(token ? { oauth_token: token } : {}),\n    ...params,\n  };\n\n  const paramString = sortKeys(Object.keys(requestParameters))\n    .map((key) => `${encode(key)}=${encode(requestParameters[key])}`)\n    .join('&');\n\n  const signatureBaseString = [method.toUpperCase(), encode(url), encode(paramString)].join('&');\n  const signingMaterial = `${encode(clientCredential)}&${encode(tokenCredential || '')}`;\n  const signature = signRfc5849BaseString(signatureBaseString, signingMaterial);\n\n  const headerParameters = { ...requestParameters, oauth_signature: signature };\n  const header = `OAuth ${sortKeys(Object.keys(headerParameters))\n    .map((key) => `${encode(key)}=\"${encode(headerParameters[key])}\"`)\n    .join(', ')}`;\n\n  return header;\n};\n\nconst oauth1Request = async ({\n  method,\n  url,\n  consumerKey,\n  clientCredential,\n  token,\n  tokenCredential,\n  params = {},\n}) => {\n  const authorization = buildOAuth1Header({\n    method,\n    url,\n    params,\n    consumerKey,\n    clientCredential,\n    token,\n    tokenCredential,\n  });\n\n  const response = await fetch(url, {\n    method,\n    headers: { Authorization: authorization },\n  });\n\n  const text = await response.text();\n  if (!response.ok) {\n    throw new Error(text || `OAuth1 request failed (${response.status})`);\n  }\n\n  return Object.fromEntries(new URLSearchParams(text));\n};\n\nconst requestToken = async ({ requestUrl, redirectUri, consumerKey, clientCredential }) =>\n  oauth1Request({\n    method: 'POST',\n    url: requestUrl,\n    consumerKey,\n    clientCredential,\n    params: { oauth_callback: redirectUri },\n  });\n\nconst accessToken = async ({\n  accessUrl,\n  consumerKey,\n  clientCredential,\n  oauthToken,\n  oauthVerifier,\n  oauthTokenCredential,\n}) =>\n  oauth1Request({\n    method: 'POST',\n    url: accessUrl,\n    consumerKey,\n    clientCredential,\n    token: oauthToken,\n    tokenCredential: oauthTokenCredential,\n    params: { oauth_verifier: oauthVerifier },\n  });\n\nconst twitterGet = async ({\n  url,\n  accessToken,\n  accessCredential,\n  consumerKey,\n  clientCredential,\n  qs = {},\n}) => {\n  const target = new URL(url);\n  const signedParams = {};\n\n  Object.entries(qs).forEach(([key, value]) => {\n    if (value !== undefined && value !== null) {\n      const stringValue = String(value);\n      target.searchParams.set(key, stringValue);\n      // RFC 5849 §3.4.1: base-string URI excludes the query; params are signed separately.\n      signedParams[key] = stringValue;\n    }\n  });\n\n  const authorization = buildOAuth1Header({\n    method: 'GET',\n    url: target.origin + target.pathname,\n    params: signedParams,\n    consumerKey,\n    clientCredential,\n    token: accessToken,\n    tokenCredential: accessCredential,\n  });\n\n  const response = await fetch(target, {\n    headers: { Authorization: authorization },\n  });\n\n  const body = await response.json();\n  if (!response.ok) {\n    throw new Error(body.errors?.[0]?.message || `Twitter API error (${response.status})`);\n  }\n\n  return { body };\n};\n\nmodule.exports = {\n  buildOAuth1Header,\n  requestToken,\n  accessToken,\n  twitterGet,\n};\n"],"names":["crypto","require$$0","URLSearchParams","require$$1","encode","str","encodeURIComponent","replace","c","codePointAt","toString","toUpperCase","sortKeys","keys","sort","a","b","signRfc5849BaseString","signatureBaseString","signingMaterial","createHmac","update","digest","buildOAuth1Header","method","url","params","consumerKey","clientCredential","token","tokenCredential","requestParameters","oauth_consumer_key","oauth_nonce","randomBytes","oauth_signature_method","oauth_timestamp","Math","floor","Date","now","oauth_version","oauth_token","paramString","Object","map","key","join","signature","headerParameters","oauth_signature","header","oauth1Request","authorization","response","fetch","headers","Authorization","text","ok","Error","status","fromEntries","requestToken","requestUrl","redirectUri","oauth_callback","accessToken","accessUrl","oauthToken","oauthVerifier","oauthTokenCredential","oauth_verifier","twitterGet","accessCredential","qs","target","URL","signedParams","entries","forEach","value","undefined","stringValue","String","searchParams","set","origin","pathname","body","json","errors","message","oauth1"],"mappings":";;;;;;;;;;AAEA,IAAA,MAAMA,MAAAA,GAASC,uCAAAA,EAAAA;IACf,MAAM,EAAEC,eAAe,EAAE,GAAGC,oCAAAA,EAAAA;IAE5B,MAAMC,MAAAA,GAAS,CAACC,GAAAA,GACdC,kBAAAA,CAAmBD,KAAKE,OAAO,CAC7B,YACA,CAACC,CAAAA,GAAM,CAAC,CAAC,EAAEA,EAAEC,WAAW,CAAC,GAAGC,QAAQ,CAAC,EAAA,CAAA,CAAIC,WAAW,EAAA,CAAA,CAAG,CAAA;AAG3D,IAAA,MAAMC,WAAW,CAACC,IAAAA,GAChBA,KAAKC,IAAI,CAAC,CAACC,CAAAA,EAAGC,CAAAA,GAAAA;YACZ,IAAID,CAAAA,GAAIC,CAAAA,EAAG,OAAO,EAAC;YACnB,IAAID,CAAAA,GAAIC,GAAG,OAAO,CAAA;YAClB,OAAO,CAAA;AACX,QAAA,CAAA,CAAA;AAEA;;;KAIA,MAAMC,qBAAAA,GAAwB,CAACC,mBAAAA,EAAqBC,eAAAA,GAAAA;;QAElD,OAAOnB,MAAAA,CAAOoB,UAAU,CAAC,MAAA,EAAQD,iBAAiBE,MAAM,CAACH,mBAAAA,CAAAA,CAAqBI,MAAM,CAAC,QAAA,CAAA;AACvF,IAAA,CAAA;AAEA,IAAA,MAAMC,oBAAoB,CAAC,EACzBC,MAAM,EACNC,GAAG,EACHC,MAAM,EACNC,WAAW,EACXC,gBAAgB,EAChBC,KAAK,EACLC,eAAe,EAChB,GAAA;AACC,QAAA,MAAMC,iBAAAA,GAAoB;YACxBC,kBAAAA,EAAoBL,WAAAA;AACpBM,YAAAA,WAAAA,EAAajC,MAAAA,CAAOkC,WAAW,CAAC,EAAA,CAAA,CAAIxB,QAAQ,CAAC,KAAA,CAAA;YAC7CyB,sBAAAA,EAAwB,WAAA;AACxBC,YAAAA,eAAAA,EAAiBC,KAAKC,KAAK,CAACC,KAAKC,GAAG,EAAA,GAAK,MAAM9B,QAAQ,EAAA;YACvD+B,aAAAA,EAAe,KAAA;AACf,YAAA,GAAIZ,KAAAA,GAAQ;gBAAEa,WAAAA,EAAab;AAAK,aAAA,GAAK,EAAE;AACvC,YAAA,GAAGH;AACP,SAAA;QAEE,MAAMiB,WAAAA,GAAc/B,SAASgC,MAAAA,CAAO/B,IAAI,CAACkB,iBAAAA,CAAAA,CAAAA,CACtCc,GAAG,CAAC,CAACC,GAAAA,GAAQ,CAAA,EAAG1C,OAAO0C,GAAAA,CAAAA,CAAK,CAAC,EAAE1C,MAAAA,CAAO2B,iBAAiB,CAACe,GAAAA,CAAI,CAAA,CAAA,CAAG,CAAA,CAC/DC,IAAI,CAAC,GAAA,CAAA;AAER,QAAA,MAAM7B,mBAAAA,GAAsB;AAACM,YAAAA,MAAAA,CAAOb,WAAW,EAAA;YAAIP,MAAAA,CAAOqB,GAAAA,CAAAA;YAAMrB,MAAAA,CAAOuC,WAAAA;AAAa,SAAA,CAACI,IAAI,CAAC,GAAA,CAAA;QAC1F,MAAM5B,eAAAA,GAAkB,GAAGf,MAAAA,CAAOwB,gBAAAA,CAAAA,CAAkB,CAAC,EAAExB,MAAAA,CAAO0B,mBAAmB,EAAA,CAAA,CAAA,CAAK;QACtF,MAAMkB,SAAAA,GAAY/B,sBAAsBC,mBAAAA,EAAqBC,eAAAA,CAAAA;AAE7D,QAAA,MAAM8B,gBAAAA,GAAmB;AAAE,YAAA,GAAGlB,iBAAiB;YAAEmB,eAAAA,EAAiBF;AAAS,SAAA;AAC3E,QAAA,MAAMG,MAAAA,GAAS,CAAC,MAAM,EAAEvC,QAAAA,CAASgC,MAAAA,CAAO/B,IAAI,CAACoC,gBAAAA,CAAAA,CAAAA,CAC1CJ,GAAG,CAAC,CAACC,GAAAA,GAAQ,CAAA,EAAG1C,MAAAA,CAAO0C,GAAAA,CAAAA,CAAK,EAAE,EAAE1C,MAAAA,CAAO6C,gBAAgB,CAACH,GAAAA,CAAI,CAAA,CAAE,CAAC,CAAC,CAAA,CAChEC,IAAI,CAAC,IAAA,CAAA,CAAA,CAAO;QAEf,OAAOI,MAAAA;AACT,IAAA,CAAA;AAEA,IAAA,MAAMC,gBAAgB,OAAO,EAC3B5B,MAAM,EACNC,GAAG,EACHE,WAAW,EACXC,gBAAgB,EAChBC,KAAK,EACLC,eAAe,EACfJ,MAAAA,GAAS,EAAE,EACZ,GAAA;AACC,QAAA,MAAM2B,gBAAgB9B,iBAAAA,CAAkB;AACtCC,YAAAA,MAAAA;AACAC,YAAAA,GAAAA;AACAC,YAAAA,MAAAA;AACAC,YAAAA,WAAAA;AACAC,YAAAA,gBAAAA;AACAC,YAAAA,KAAAA;AACAC,YAAAA;AACJ,SAAA,CAAA;QAEE,MAAMwB,QAAAA,GAAW,MAAMC,KAAAA,CAAM9B,GAAAA,EAAK;AAChCD,YAAAA,MAAAA;YACAgC,OAAAA,EAAS;gBAAEC,aAAAA,EAAeJ;AAAa;AAC3C,SAAA,CAAA;QAEE,MAAMK,IAAAA,GAAO,MAAMJ,QAAAA,CAASI,IAAI,EAAA;QAChC,IAAI,CAACJ,QAAAA,CAASK,EAAE,EAAE;YAChB,MAAM,IAAIC,KAAAA,CAAMF,IAAAA,IAAQ,CAAC,uBAAuB,EAAEJ,QAAAA,CAASO,MAAM,CAAC,CAAC,CAAC,CAAA;AACxE,QAAA;AAEE,QAAA,OAAOjB,MAAAA,CAAOkB,WAAW,CAAC,IAAI5D,eAAAA,CAAgBwD,IAAAA,CAAAA,CAAAA;AAChD,IAAA,CAAA;AAEA,IAAA,MAAMK,YAAAA,GAAe,OAAO,EAAEC,UAAU,EAAEC,WAAW,EAAEtC,WAAW,EAAEC,gBAAgB,EAAE,GACpFwB,aAAAA,CAAc;YACZ5B,MAAAA,EAAQ,MAAA;YACRC,GAAAA,EAAKuC,UAAAA;AACLrC,YAAAA,WAAAA;AACAC,YAAAA,gBAAAA;YACAF,MAAAA,EAAQ;gBAAEwC,cAAAA,EAAgBD;AAAW;AACzC,SAAA,CAAA;AAEA,IAAA,MAAME,cAAc,OAAO,EACzBC,SAAS,EACTzC,WAAW,EACXC,gBAAgB,EAChByC,UAAU,EACVC,aAAa,EACbC,oBAAoB,EACrB,GACCnB,aAAAA,CAAc;YACZ5B,MAAAA,EAAQ,MAAA;YACRC,GAAAA,EAAK2C,SAAAA;AACLzC,YAAAA,WAAAA;AACAC,YAAAA,gBAAAA;YACAC,KAAAA,EAAOwC,UAAAA;YACPvC,eAAAA,EAAiByC,oBAAAA;YACjB7C,MAAAA,EAAQ;gBAAE8C,cAAAA,EAAgBF;AAAa;AAC3C,SAAA,CAAA;AAEA,IAAA,MAAMG,aAAa,OAAO,EACxBhD,GAAG,EACH0C,WAAW,EACXO,gBAAgB,EAChB/C,WAAW,EACXC,gBAAgB,EAChB+C,EAAAA,GAAK,EAAE,EACR,GAAA;QACC,MAAMC,MAAAA,GAAS,IAAIC,GAAAA,CAAIpD,GAAAA,CAAAA;AACvB,QAAA,MAAMqD,eAAe,EAAA;QAErBlC,MAAAA,CAAOmC,OAAO,CAACJ,EAAAA,CAAAA,CAAIK,OAAO,CAAC,CAAC,CAAClC,KAAKmC,KAAAA,CAAM,GAAA;YACtC,IAAIA,KAAAA,KAAUC,SAAAA,IAAaD,KAAAA,KAAU,IAAA,EAAM;AACzC,gBAAA,MAAME,cAAcC,MAAAA,CAAOH,KAAAA,CAAAA;AAC3BL,gBAAAA,MAAAA,CAAOS,YAAY,CAACC,GAAG,CAACxC,GAAAA,EAAKqC,WAAAA,CAAAA;;gBAE7BL,YAAY,CAAChC,IAAI,GAAGqC,WAAAA;AAC1B,YAAA;AACA,QAAA,CAAA,CAAA;AAEE,QAAA,MAAM9B,gBAAgB9B,iBAAAA,CAAkB;YACtCC,MAAAA,EAAQ,KAAA;AACRC,YAAAA,GAAAA,EAAKmD,MAAAA,CAAOW,MAAM,GAAGX,MAAAA,CAAOY,QAAQ;YACpC9D,MAAAA,EAAQoD,YAAAA;AACRnD,YAAAA,WAAAA;AACAC,YAAAA,gBAAAA;YACAC,KAAAA,EAAOsC,WAAAA;YACPrC,eAAAA,EAAiB4C;AACrB,SAAA,CAAA;QAEE,MAAMpB,QAAAA,GAAW,MAAMC,KAAAA,CAAMqB,MAAAA,EAAQ;YACnCpB,OAAAA,EAAS;gBAAEC,aAAAA,EAAeJ;AAAa;AAC3C,SAAA,CAAA;QAEE,MAAMoC,IAAAA,GAAO,MAAMnC,QAAAA,CAASoC,IAAI,EAAA;QAChC,IAAI,CAACpC,QAAAA,CAASK,EAAE,EAAE;AAChB,YAAA,MAAM,IAAIC,KAAAA,CAAM6B,IAAAA,CAAKE,MAAM,GAAG,CAAA,CAAE,EAAEC,OAAAA,IAAW,CAAC,mBAAmB,EAAEtC,QAAAA,CAASO,MAAM,CAAC,CAAC,CAAC,CAAA;AACzF,QAAA;QAEE,OAAO;AAAE4B,YAAAA;AAAI,SAAA;AACf,IAAA,CAAA;IAEAI,MAAAA,GAAiB;AACftE,QAAAA,iBAAAA;AACAwC,QAAAA,YAAAA;AACAI,QAAAA,WAAAA;AACAM,QAAAA;AACF,KAAA;;;;;;"}

package/dist/server/utils/oauth-connect/oauth1.mjs

@@ -0,0 +1,136 @@
+import { __require } from '../../_virtual/_node_crypto.mjs';
+import { __require as __require$1 } from '../../_virtual/_node_url.mjs';
+
+var oauth1;
+var hasRequiredOauth1;
+function requireOauth1() {
+    if (hasRequiredOauth1) return oauth1;
+    hasRequiredOauth1 = 1;
+    const crypto = __require();
+    const { URLSearchParams } = __require$1();
+    const encode = (str)=>encodeURIComponent(str).replace(/[!'()*]/g, (c)=>`%${c.codePointAt(0).toString(16).toUpperCase()}`);
+    const sortKeys = (keys)=>keys.sort((a, b)=>{
+            if (a < b) return -1;
+            if (a > b) return 1;
+            return 0;
+        });
+    /**
+	 * OAuth 1.0 (RFC 5849) request signature — HMAC-SHA1 is required by the protocol.
+	 * This is not password storage or user-credential hashing (those use bcrypt).
+	 */ const signRfc5849BaseString = (signatureBaseString, signingMaterial)=>{
+        // codeql[js/insufficient-password-hash] OAuth 1.0 signing material, not user password storage
+        return crypto.createHmac('sha1', signingMaterial).update(signatureBaseString).digest('base64');
+    };
+    const buildOAuth1Header = ({ method, url, params, consumerKey, clientCredential, token, tokenCredential })=>{
+        const requestParameters = {
+            oauth_consumer_key: consumerKey,
+            oauth_nonce: crypto.randomBytes(16).toString('hex'),
+            oauth_signature_method: 'HMAC-SHA1',
+            oauth_timestamp: Math.floor(Date.now() / 1000).toString(),
+            oauth_version: '1.0',
+            ...token ? {
+                oauth_token: token
+            } : {},
+            ...params
+        };
+        const paramString = sortKeys(Object.keys(requestParameters)).map((key)=>`${encode(key)}=${encode(requestParameters[key])}`).join('&');
+        const signatureBaseString = [
+            method.toUpperCase(),
+            encode(url),
+            encode(paramString)
+        ].join('&');
+        const signingMaterial = `${encode(clientCredential)}&${encode(tokenCredential || '')}`;
+        const signature = signRfc5849BaseString(signatureBaseString, signingMaterial);
+        const headerParameters = {
+            ...requestParameters,
+            oauth_signature: signature
+        };
+        const header = `OAuth ${sortKeys(Object.keys(headerParameters)).map((key)=>`${encode(key)}="${encode(headerParameters[key])}"`).join(', ')}`;
+        return header;
+    };
+    const oauth1Request = async ({ method, url, consumerKey, clientCredential, token, tokenCredential, params = {} })=>{
+        const authorization = buildOAuth1Header({
+            method,
+            url,
+            params,
+            consumerKey,
+            clientCredential,
+            token,
+            tokenCredential
+        });
+        const response = await fetch(url, {
+            method,
+            headers: {
+                Authorization: authorization
+            }
+        });
+        const text = await response.text();
+        if (!response.ok) {
+            throw new Error(text || `OAuth1 request failed (${response.status})`);
+        }
+        return Object.fromEntries(new URLSearchParams(text));
+    };
+    const requestToken = async ({ requestUrl, redirectUri, consumerKey, clientCredential })=>oauth1Request({
+            method: 'POST',
+            url: requestUrl,
+            consumerKey,
+            clientCredential,
+            params: {
+                oauth_callback: redirectUri
+            }
+        });
+    const accessToken = async ({ accessUrl, consumerKey, clientCredential, oauthToken, oauthVerifier, oauthTokenCredential })=>oauth1Request({
+            method: 'POST',
+            url: accessUrl,
+            consumerKey,
+            clientCredential,
+            token: oauthToken,
+            tokenCredential: oauthTokenCredential,
+            params: {
+                oauth_verifier: oauthVerifier
+            }
+        });
+    const twitterGet = async ({ url, accessToken, accessCredential, consumerKey, clientCredential, qs = {} })=>{
+        const target = new URL(url);
+        const signedParams = {};
+        Object.entries(qs).forEach(([key, value])=>{
+            if (value !== undefined && value !== null) {
+                const stringValue = String(value);
+                target.searchParams.set(key, stringValue);
+                // RFC 5849 §3.4.1: base-string URI excludes the query; params are signed separately.
+                signedParams[key] = stringValue;
+            }
+        });
+        const authorization = buildOAuth1Header({
+            method: 'GET',
+            url: target.origin + target.pathname,
+            params: signedParams,
+            consumerKey,
+            clientCredential,
+            token: accessToken,
+            tokenCredential: accessCredential
+        });
+        const response = await fetch(target, {
+            headers: {
+                Authorization: authorization
+            }
+        });
+        const body = await response.json();
+        if (!response.ok) {
+            throw new Error(body.errors?.[0]?.message || `Twitter API error (${response.status})`);
+        }
+        return {
+            body
+        };
+    };
+    oauth1 = {
+        buildOAuth1Header,
+        requestToken,
+        accessToken,
+        twitterGet
+    };
+    return oauth1;
+}
+
+export { requireOauth1 as __require };
+//# sourceMappingURL=oauth1.mjs.map

package/dist/server/utils/oauth-connect/oauth1.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth1.mjs","sources":["../../../../server/src/utils/oauth-connect/oauth1.js"],"sourcesContent":["'use strict';\n\nconst crypto = require('node:crypto');\nconst { URLSearchParams } = require('node:url');\n\nconst encode = (str) =>\n  encodeURIComponent(str).replace(\n    /[!'()*]/g,\n    (c) => `%${c.codePointAt(0).toString(16).toUpperCase()}`\n  );\n\nconst sortKeys = (keys) =>\n  keys.sort((a, b) => {\n    if (a < b) return -1;\n    if (a > b) return 1;\n    return 0;\n  });\n\n/**\n * OAuth 1.0 (RFC 5849) request signature — HMAC-SHA1 is required by the protocol.\n * This is not password storage or user-credential hashing (those use bcrypt).\n */\nconst signRfc5849BaseString = (signatureBaseString, signingMaterial) => {\n  // codeql[js/insufficient-password-hash] OAuth 1.0 signing material, not user password storage\n  return crypto.createHmac('sha1', signingMaterial).update(signatureBaseString).digest('base64');\n};\n\nconst buildOAuth1Header = ({\n  method,\n  url,\n  params,\n  consumerKey,\n  clientCredential,\n  token,\n  tokenCredential,\n}) => {\n  const requestParameters = {\n    oauth_consumer_key: consumerKey,\n    oauth_nonce: crypto.randomBytes(16).toString('hex'),\n    oauth_signature_method: 'HMAC-SHA1',\n    oauth_timestamp: Math.floor(Date.now() / 1000).toString(),\n    oauth_version: '1.0',\n    ...(token ? { oauth_token: token } : {}),\n    ...params,\n  };\n\n  const paramString = sortKeys(Object.keys(requestParameters))\n    .map((key) => `${encode(key)}=${encode(requestParameters[key])}`)\n    .join('&');\n\n  const signatureBaseString = [method.toUpperCase(), encode(url), encode(paramString)].join('&');\n  const signingMaterial = `${encode(clientCredential)}&${encode(tokenCredential || '')}`;\n  const signature = signRfc5849BaseString(signatureBaseString, signingMaterial);\n\n  const headerParameters = { ...requestParameters, oauth_signature: signature };\n  const header = `OAuth ${sortKeys(Object.keys(headerParameters))\n    .map((key) => `${encode(key)}=\"${encode(headerParameters[key])}\"`)\n    .join(', ')}`;\n\n  return header;\n};\n\nconst oauth1Request = async ({\n  method,\n  url,\n  consumerKey,\n  clientCredential,\n  token,\n  tokenCredential,\n  params = {},\n}) => {\n  const authorization = buildOAuth1Header({\n    method,\n    url,\n    params,\n    consumerKey,\n    clientCredential,\n    token,\n    tokenCredential,\n  });\n\n  const response = await fetch(url, {\n    method,\n    headers: { Authorization: authorization },\n  });\n\n  const text = await response.text();\n  if (!response.ok) {\n    throw new Error(text || `OAuth1 request failed (${response.status})`);\n  }\n\n  return Object.fromEntries(new URLSearchParams(text));\n};\n\nconst requestToken = async ({ requestUrl, redirectUri, consumerKey, clientCredential }) =>\n  oauth1Request({\n    method: 'POST',\n    url: requestUrl,\n    consumerKey,\n    clientCredential,\n    params: { oauth_callback: redirectUri },\n  });\n\nconst accessToken = async ({\n  accessUrl,\n  consumerKey,\n  clientCredential,\n  oauthToken,\n  oauthVerifier,\n  oauthTokenCredential,\n}) =>\n  oauth1Request({\n    method: 'POST',\n    url: accessUrl,\n    consumerKey,\n    clientCredential,\n    token: oauthToken,\n    tokenCredential: oauthTokenCredential,\n    params: { oauth_verifier: oauthVerifier },\n  });\n\nconst twitterGet = async ({\n  url,\n  accessToken,\n  accessCredential,\n  consumerKey,\n  clientCredential,\n  qs = {},\n}) => {\n  const target = new URL(url);\n  const signedParams = {};\n\n  Object.entries(qs).forEach(([key, value]) => {\n    if (value !== undefined && value !== null) {\n      const stringValue = String(value);\n      target.searchParams.set(key, stringValue);\n      // RFC 5849 §3.4.1: base-string URI excludes the query; params are signed separately.\n      signedParams[key] = stringValue;\n    }\n  });\n\n  const authorization = buildOAuth1Header({\n    method: 'GET',\n    url: target.origin + target.pathname,\n    params: signedParams,\n    consumerKey,\n    clientCredential,\n    token: accessToken,\n    tokenCredential: accessCredential,\n  });\n\n  const response = await fetch(target, {\n    headers: { Authorization: authorization },\n  });\n\n  const body = await response.json();\n  if (!response.ok) {\n    throw new Error(body.errors?.[0]?.message || `Twitter API error (${response.status})`);\n  }\n\n  return { body };\n};\n\nmodule.exports = {\n  buildOAuth1Header,\n  requestToken,\n  accessToken,\n  twitterGet,\n};\n"],"names":["crypto","require$$0","URLSearchParams","require$$1","encode","str","encodeURIComponent","replace","c","codePointAt","toString","toUpperCase","sortKeys","keys","sort","a","b","signRfc5849BaseString","signatureBaseString","signingMaterial","createHmac","update","digest","buildOAuth1Header","method","url","params","consumerKey","clientCredential","token","tokenCredential","requestParameters","oauth_consumer_key","oauth_nonce","randomBytes","oauth_signature_method","oauth_timestamp","Math","floor","Date","now","oauth_version","oauth_token","paramString","Object","map","key","join","signature","headerParameters","oauth_signature","header","oauth1Request","authorization","response","fetch","headers","Authorization","text","ok","Error","status","fromEntries","requestToken","requestUrl","redirectUri","oauth_callback","accessToken","accessUrl","oauthToken","oauthVerifier","oauthTokenCredential","oauth_verifier","twitterGet","accessCredential","qs","target","URL","signedParams","entries","forEach","value","undefined","stringValue","String","searchParams","set","origin","pathname","body","json","errors","message","oauth1"],"mappings":";;;;;;;;AAEA,IAAA,MAAMA,MAAAA,GAASC,SAAAA,EAAAA;IACf,MAAM,EAAEC,eAAe,EAAE,GAAGC,WAAAA,EAAAA;IAE5B,MAAMC,MAAAA,GAAS,CAACC,GAAAA,GACdC,kBAAAA,CAAmBD,KAAKE,OAAO,CAC7B,YACA,CAACC,CAAAA,GAAM,CAAC,CAAC,EAAEA,EAAEC,WAAW,CAAC,GAAGC,QAAQ,CAAC,EAAA,CAAA,CAAIC,WAAW,EAAA,CAAA,CAAG,CAAA;AAG3D,IAAA,MAAMC,WAAW,CAACC,IAAAA,GAChBA,KAAKC,IAAI,CAAC,CAACC,CAAAA,EAAGC,CAAAA,GAAAA;YACZ,IAAID,CAAAA,GAAIC,CAAAA,EAAG,OAAO,EAAC;YACnB,IAAID,CAAAA,GAAIC,GAAG,OAAO,CAAA;YAClB,OAAO,CAAA;AACX,QAAA,CAAA,CAAA;AAEA;;;KAIA,MAAMC,qBAAAA,GAAwB,CAACC,mBAAAA,EAAqBC,eAAAA,GAAAA;;QAElD,OAAOnB,MAAAA,CAAOoB,UAAU,CAAC,MAAA,EAAQD,iBAAiBE,MAAM,CAACH,mBAAAA,CAAAA,CAAqBI,MAAM,CAAC,QAAA,CAAA;AACvF,IAAA,CAAA;AAEA,IAAA,MAAMC,oBAAoB,CAAC,EACzBC,MAAM,EACNC,GAAG,EACHC,MAAM,EACNC,WAAW,EACXC,gBAAgB,EAChBC,KAAK,EACLC,eAAe,EAChB,GAAA;AACC,QAAA,MAAMC,iBAAAA,GAAoB;YACxBC,kBAAAA,EAAoBL,WAAAA;AACpBM,YAAAA,WAAAA,EAAajC,MAAAA,CAAOkC,WAAW,CAAC,EAAA,CAAA,CAAIxB,QAAQ,CAAC,KAAA,CAAA;YAC7CyB,sBAAAA,EAAwB,WAAA;AACxBC,YAAAA,eAAAA,EAAiBC,KAAKC,KAAK,CAACC,KAAKC,GAAG,EAAA,GAAK,MAAM9B,QAAQ,EAAA;YACvD+B,aAAAA,EAAe,KAAA;AACf,YAAA,GAAIZ,KAAAA,GAAQ;gBAAEa,WAAAA,EAAab;AAAK,aAAA,GAAK,EAAE;AACvC,YAAA,GAAGH;AACP,SAAA;QAEE,MAAMiB,WAAAA,GAAc/B,SAASgC,MAAAA,CAAO/B,IAAI,CAACkB,iBAAAA,CAAAA,CAAAA,CACtCc,GAAG,CAAC,CAACC,GAAAA,GAAQ,CAAA,EAAG1C,OAAO0C,GAAAA,CAAAA,CAAK,CAAC,EAAE1C,MAAAA,CAAO2B,iBAAiB,CAACe,GAAAA,CAAI,CAAA,CAAA,CAAG,CAAA,CAC/DC,IAAI,CAAC,GAAA,CAAA;AAER,QAAA,MAAM7B,mBAAAA,GAAsB;AAACM,YAAAA,MAAAA,CAAOb,WAAW,EAAA;YAAIP,MAAAA,CAAOqB,GAAAA,CAAAA;YAAMrB,MAAAA,CAAOuC,WAAAA;AAAa,SAAA,CAACI,IAAI,CAAC,GAAA,CAAA;QAC1F,MAAM5B,eAAAA,GAAkB,GAAGf,MAAAA,CAAOwB,gBAAAA,CAAAA,CAAkB,CAAC,EAAExB,MAAAA,CAAO0B,mBAAmB,EAAA,CAAA,CAAA,CAAK;QACtF,MAAMkB,SAAAA,GAAY/B,sBAAsBC,mBAAAA,EAAqBC,eAAAA,CAAAA;AAE7D,QAAA,MAAM8B,gBAAAA,GAAmB;AAAE,YAAA,GAAGlB,iBAAiB;YAAEmB,eAAAA,EAAiBF;AAAS,SAAA;AAC3E,QAAA,MAAMG,MAAAA,GAAS,CAAC,MAAM,EAAEvC,QAAAA,CAASgC,MAAAA,CAAO/B,IAAI,CAACoC,gBAAAA,CAAAA,CAAAA,CAC1CJ,GAAG,CAAC,CAACC,GAAAA,GAAQ,CAAA,EAAG1C,MAAAA,CAAO0C,GAAAA,CAAAA,CAAK,EAAE,EAAE1C,MAAAA,CAAO6C,gBAAgB,CAACH,GAAAA,CAAI,CAAA,CAAE,CAAC,CAAC,CAAA,CAChEC,IAAI,CAAC,IAAA,CAAA,CAAA,CAAO;QAEf,OAAOI,MAAAA;AACT,IAAA,CAAA;AAEA,IAAA,MAAMC,gBAAgB,OAAO,EAC3B5B,MAAM,EACNC,GAAG,EACHE,WAAW,EACXC,gBAAgB,EAChBC,KAAK,EACLC,eAAe,EACfJ,MAAAA,GAAS,EAAE,EACZ,GAAA;AACC,QAAA,MAAM2B,gBAAgB9B,iBAAAA,CAAkB;AACtCC,YAAAA,MAAAA;AACAC,YAAAA,GAAAA;AACAC,YAAAA,MAAAA;AACAC,YAAAA,WAAAA;AACAC,YAAAA,gBAAAA;AACAC,YAAAA,KAAAA;AACAC,YAAAA;AACJ,SAAA,CAAA;QAEE,MAAMwB,QAAAA,GAAW,MAAMC,KAAAA,CAAM9B,GAAAA,EAAK;AAChCD,YAAAA,MAAAA;YACAgC,OAAAA,EAAS;gBAAEC,aAAAA,EAAeJ;AAAa;AAC3C,SAAA,CAAA;QAEE,MAAMK,IAAAA,GAAO,MAAMJ,QAAAA,CAASI,IAAI,EAAA;QAChC,IAAI,CAACJ,QAAAA,CAASK,EAAE,EAAE;YAChB,MAAM,IAAIC,KAAAA,CAAMF,IAAAA,IAAQ,CAAC,uBAAuB,EAAEJ,QAAAA,CAASO,MAAM,CAAC,CAAC,CAAC,CAAA;AACxE,QAAA;AAEE,QAAA,OAAOjB,MAAAA,CAAOkB,WAAW,CAAC,IAAI5D,eAAAA,CAAgBwD,IAAAA,CAAAA,CAAAA;AAChD,IAAA,CAAA;AAEA,IAAA,MAAMK,YAAAA,GAAe,OAAO,EAAEC,UAAU,EAAEC,WAAW,EAAEtC,WAAW,EAAEC,gBAAgB,EAAE,GACpFwB,aAAAA,CAAc;YACZ5B,MAAAA,EAAQ,MAAA;YACRC,GAAAA,EAAKuC,UAAAA;AACLrC,YAAAA,WAAAA;AACAC,YAAAA,gBAAAA;YACAF,MAAAA,EAAQ;gBAAEwC,cAAAA,EAAgBD;AAAW;AACzC,SAAA,CAAA;AAEA,IAAA,MAAME,cAAc,OAAO,EACzBC,SAAS,EACTzC,WAAW,EACXC,gBAAgB,EAChByC,UAAU,EACVC,aAAa,EACbC,oBAAoB,EACrB,GACCnB,aAAAA,CAAc;YACZ5B,MAAAA,EAAQ,MAAA;YACRC,GAAAA,EAAK2C,SAAAA;AACLzC,YAAAA,WAAAA;AACAC,YAAAA,gBAAAA;YACAC,KAAAA,EAAOwC,UAAAA;YACPvC,eAAAA,EAAiByC,oBAAAA;YACjB7C,MAAAA,EAAQ;gBAAE8C,cAAAA,EAAgBF;AAAa;AAC3C,SAAA,CAAA;AAEA,IAAA,MAAMG,aAAa,OAAO,EACxBhD,GAAG,EACH0C,WAAW,EACXO,gBAAgB,EAChB/C,WAAW,EACXC,gBAAgB,EAChB+C,EAAAA,GAAK,EAAE,EACR,GAAA;QACC,MAAMC,MAAAA,GAAS,IAAIC,GAAAA,CAAIpD,GAAAA,CAAAA;AACvB,QAAA,MAAMqD,eAAe,EAAA;QAErBlC,MAAAA,CAAOmC,OAAO,CAACJ,EAAAA,CAAAA,CAAIK,OAAO,CAAC,CAAC,CAAClC,KAAKmC,KAAAA,CAAM,GAAA;YACtC,IAAIA,KAAAA,KAAUC,SAAAA,IAAaD,KAAAA,KAAU,IAAA,EAAM;AACzC,gBAAA,MAAME,cAAcC,MAAAA,CAAOH,KAAAA,CAAAA;AAC3BL,gBAAAA,MAAAA,CAAOS,YAAY,CAACC,GAAG,CAACxC,GAAAA,EAAKqC,WAAAA,CAAAA;;gBAE7BL,YAAY,CAAChC,IAAI,GAAGqC,WAAAA;AAC1B,YAAA;AACA,QAAA,CAAA,CAAA;AAEE,QAAA,MAAM9B,gBAAgB9B,iBAAAA,CAAkB;YACtCC,MAAAA,EAAQ,KAAA;AACRC,YAAAA,GAAAA,EAAKmD,MAAAA,CAAOW,MAAM,GAAGX,MAAAA,CAAOY,QAAQ;YACpC9D,MAAAA,EAAQoD,YAAAA;AACRnD,YAAAA,WAAAA;AACAC,YAAAA,gBAAAA;YACAC,KAAAA,EAAOsC,WAAAA;YACPrC,eAAAA,EAAiB4C;AACrB,SAAA,CAAA;QAEE,MAAMpB,QAAAA,GAAW,MAAMC,KAAAA,CAAMqB,MAAAA,EAAQ;YACnCpB,OAAAA,EAAS;gBAAEC,aAAAA,EAAeJ;AAAa;AAC3C,SAAA,CAAA;QAEE,MAAMoC,IAAAA,GAAO,MAAMnC,QAAAA,CAASoC,IAAI,EAAA;QAChC,IAAI,CAACpC,QAAAA,CAASK,EAAE,EAAE;AAChB,YAAA,MAAM,IAAIC,KAAAA,CAAM6B,IAAAA,CAAKE,MAAM,GAAG,CAAA,CAAE,EAAEC,OAAAA,IAAW,CAAC,mBAAmB,EAAEtC,QAAAA,CAASO,MAAM,CAAC,CAAC,CAAC,CAAA;AACzF,QAAA;QAEE,OAAO;AAAE4B,YAAAA;AAAI,SAAA;AACf,IAAA,CAAA;IAEAI,MAAAA,GAAiB;AACftE,QAAAA,iBAAAA;AACAwC,QAAAA,YAAAA;AACAI,QAAAA,WAAAA;AACAM,QAAAA;AACF,KAAA;;;;;;"}