npm - @strapi/plugin-users-permissions - Versions diffs - 5.52.2 → 5.52.3 - Mend

@strapi/plugin-users-permissions 5.52.2 → 5.52.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (11) hide show

package/dist/server/controllers/auth.js +1 -1
package/dist/server/controllers/auth.js.map +1 -1
package/dist/server/controllers/auth.mjs +1 -1
package/dist/server/controllers/auth.mjs.map +1 -1
package/dist/server/middlewares/rateLimit.js +1 -1
package/dist/server/middlewares/rateLimit.js.map +1 -1
package/dist/server/middlewares/rateLimit.mjs +1 -1
package/dist/server/middlewares/rateLimit.mjs.map +1 -1
package/package.json +4 -4
package/server/src/controllers/auth.js +4 -1
package/server/src/middlewares/rateLimit.js +1 -1

package/dist/server/controllers/auth.js CHANGED Viewed

@@ -334,7 +334,7 @@ function requireAuth() {
                 if (upSessions?.httpOnly || requestHttpOnly) {
                     const cookieName = upSessions.cookie?.name || 'strapi_up_refresh';
                     const isProduction = process.env.NODE_ENV === 'production';
-                    const { maxAge, ...cookieOptions } = buildRefreshCookieOptions(upSessions, isProduction);
+                    const { maxAge: _maxAge, ...cookieOptions } = buildRefreshCookieOptions(upSessions, isProduction);
                     ctx.cookies.set(cookieName, '', {
                         ...cookieOptions,
                         expires: new Date(0)

package/dist/server/controllers/auth.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"auth.js","sources":["../../../server/src/controllers/auth.js"],"sourcesContent":["'use strict';\n\n/*\n Auth.js controller\n \n @description: A set of functions called \"actions\" for managing `Auth`.\n /\n\n/ eslint-disable no-useless-escape */\nconst crypto = require('crypto');\nconst _ = require('lodash');\nconst { concat, compact, isArray } = require('lodash/fp');\nconst utils = require('@strapi/utils');\nconst { getService } = require('../utils');\nconst { buildRefreshCookieOptions } = require('../utils/refresh-cookie-options');\nconst {\n validateCallbackBody,\n validateRegisterBody,\n validateSendEmailConfirmationBody,\n validateForgotPasswordBody,\n validateResetPasswordBody,\n validateEmailConfirmationBody,\n validateChangePasswordBody,\n} = require('./validation/auth');\n\nconst { ApplicationError, ValidationError, ForbiddenError } = utils.errors;\nconst { buildSessionMetadata, sanitizeSessionEntry, sortSessionsForDisplay } = utils;\n\nconst sanitizeUser = (user, ctx) => {\n const { auth } = ctx.state;\n const userSchema = strapi.getModel('plugin::users-permissions.user');\n\n return strapi.contentAPI.sanitize.output(user, userSchema, { auth });\n};\n\nconst extractDeviceId = (requestBody) => {\n const { deviceId } = requestBody \|\| {};\n\n return typeof deviceId === 'string' && deviceId.length > 0 ? deviceId : undefined;\n};\n\nconst buildSessionMetadataFromContext = (ctx) =>\n buildSessionMetadata({\n userAgent: ctx.request.headers['user-agent'],\n });\n\nconst sendRefreshAuthResponse = async (strapi, ctx, user, { metadata } = {}) => {\n const deviceId = extractDeviceId(ctx.request.body);\n const tokenOptions = { type: 'refresh', ...(metadata ? { metadata } : {}) };\n\n const refresh = await strapi\n .sessionManager('users-permissions')\n .generateRefreshToken(String(user.id), deviceId, tokenOptions);\n\n const access = await strapi\n .sessionManager('users-permissions')\n .generateAccessToken(refresh.token);\n if ('error' in access) {\n throw new ApplicationError('Invalid credentials');\n }\n\n const upSessions = strapi.config.get('plugin::users-permissions.sessions');\n const requestHttpOnly = ctx.request.header['x-strapi-refresh-cookie'] === 'httpOnly';\n\n if (upSessions?.httpOnly \|\| requestHttpOnly) {\n const cookieName = upSessions.cookie?.name \|\| 'strapi_up_refresh';\n const isProduction = process.env.NODE_ENV === 'production';\n ctx.cookies.set(cookieName, refresh.token, buildRefreshCookieOptions(upSessions, isProduction));\n return ctx.send({ jwt: access.token, user: await sanitizeUser(user, ctx) });\n }\n\n return ctx.send({\n jwt: access.token,\n refreshToken: refresh.token,\n user: await sanitizeUser(user, ctx),\n });\n};\n\nconst reissueTokensAfterPasswordChange = async (strapi, ctx, user) => {\n const deviceId = extractDeviceId(ctx.request.body);\n\n await strapi.sessionManager('users-permissions').invalidateRefreshToken(String(user.id));\n\n const newDeviceId = deviceId \|\| crypto.randomUUID();\n const refresh = await strapi\n .sessionManager('users-permissions')\n .generateRefreshToken(String(user.id), newDeviceId, { type: 'refresh' });\n\n const access = await strapi\n .sessionManager('users-permissions')\n .generateAccessToken(refresh.token);\n if ('error' in access) {\n throw new ApplicationError('Invalid credentials');\n }\n\n return ctx.send({\n jwt: access.token,\n refreshToken: refresh.token,\n user: await sanitizeUser(user, ctx),\n });\n};\n\nconst revokeLogoutSessions = async (strapi, ctx, userId, { scope, deviceId, body }) => {\n const sessionManager = strapi.sessionManager('users-permissions');\n const upSessions = strapi.config.get('plugin::users-permissions.sessions');\n\n if (scope === 'all') {\n await sessionManager.invalidateRefreshToken(userId);\n return;\n }\n\n if (deviceId) {\n await sessionManager.invalidateRefreshToken(userId, deviceId);\n return;\n }\n\n let currentSessionId = ctx.state.session?.id;\n const cookieName = upSessions?.cookie?.name \|\| 'strapi_up_refresh';\n const refreshToken =\n ctx.cookies.get(cookieName) \|\|\n (typeof body.refreshToken === 'string' ? body.refreshToken : undefined);\n\n if (refreshToken) {\n const validation = await sessionManager.validateRefreshToken(refreshToken);\n if (validation.isValid) {\n currentSessionId = validation.sessionId;\n }\n }\n\n if (currentSessionId) {\n await sessionManager.revokeSessionById(userId, currentSessionId);\n return;\n }\n\n await sessionManager.invalidateRefreshToken(userId);\n};\n\nmodule.exports = ({ strapi }) => ({\n async callback(ctx) {\n const provider = ctx.params.provider \|\| 'local';\n const params = ctx.request.body;\n\n const store = strapi.store({ type: 'plugin', name: 'users-permissions' });\n const grantSettings = await store.get({ key: 'grant' });\n\n const grantProvider = provider === 'local' ? 'email' : provider;\n\n if (!_.get(grantSettings, [grantProvider, 'enabled'])) {\n throw new ApplicationError('This provider is disabled');\n }\n\n if (provider === 'local') {\n await validateCallbackBody(params);\n\n const { identifier } = params;\n\n // Check if the user exists.\n const user = await strapi.db.query('plugin::users-permissions.user').findOne({\n where: {\n provider,\n $or: [{ email: identifier.toLowerCase() }, { username: identifier }],\n },\n });\n\n if (!user) {\n throw new ValidationError('Invalid identifier or password');\n }\n\n if (!user.password) {\n throw new ValidationError('Invalid identifier or password');\n }\n\n const validPassword = await getService('user').validatePassword(\n params.password,\n user.password\n );\n\n if (!validPassword) {\n throw new ValidationError('Invalid identifier or password');\n }\n\n const advancedSettings = await store.get({ key: 'advanced' });\n const requiresConfirmation = _.get(advancedSettings, 'email_confirmation');\n\n if (requiresConfirmation && user.confirmed !== true) {\n throw new ApplicationError('Your account email is not confirmed');\n }\n\n if (user.blocked === true) {\n throw new ApplicationError('Your account has been blocked by an administrator');\n }\n\n const mode = strapi.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');\n if (mode === 'refresh') {\n return sendRefreshAuthResponse(strapi, ctx, user, {\n metadata: buildSessionMetadataFromContext(ctx),\n });\n }\n\n return ctx.send({\n jwt: getService('jwt').issue({ id: user.id }),\n user: await sanitizeUser(user, ctx),\n });\n }\n\n // Connect the user with the third-party provider.\n try {\n const user = await getService('providers').connect(provider, ctx.query);\n\n if (user.blocked) {\n throw new ForbiddenError('Your account has been blocked by an administrator');\n }\n\n const mode = strapi.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');\n if (mode === 'refresh') {\n return sendRefreshAuthResponse(strapi, ctx, user, {\n metadata: buildSessionMetadataFromContext(ctx),\n });\n }\n\n return ctx.send({\n jwt: getService('jwt').issue({ id: user.id }),\n user: await sanitizeUser(user, ctx),\n });\n } catch (error) {\n throw new ApplicationError(error.message);\n }\n },\n\n async changePassword(ctx) {\n if (!ctx.state.user) {\n throw new ApplicationError('You must be authenticated to reset your password');\n }\n\n const validations = strapi.config.get('plugin::users-permissions.validationRules');\n\n const { currentPassword, password } = await validateChangePasswordBody(\n ctx.request.body,\n validations\n );\n\n const user = await strapi.db\n .query('plugin::users-permissions.user')\n .findOne({ where: { id: ctx.state.user.id } });\n\n const validPassword = await getService('user').validatePassword(currentPassword, user.password);\n\n if (!validPassword) {\n throw new ValidationError('The provided current password is invalid');\n }\n\n if (currentPassword === password) {\n throw new ValidationError('Your new password must be different than your current password');\n }\n\n await getService('user').edit(user.id, { password });\n\n const mode = strapi.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');\n if (mode === 'refresh') {\n return reissueTokensAfterPasswordChange(strapi, ctx, user);\n }\n\n return ctx.send({\n jwt: getService('jwt').issue({ id: user.id }),\n user: await sanitizeUser(user, ctx),\n });\n },\n\n async resetPassword(ctx) {\n const validations = strapi.config.get('plugin::users-permissions.validationRules');\n\n const { password, passwordConfirmation, code } = await validateResetPasswordBody(\n ctx.request.body,\n validations\n );\n\n if (password !== passwordConfirmation) {\n throw new ValidationError('Passwords do not match');\n }\n\n const user = await strapi.db\n .query('plugin::users-permissions.user')\n .findOne({ where: { resetPasswordToken: code } });\n\n if (!user) {\n throw new ValidationError('Incorrect code provided');\n }\n\n await getService('user').edit(user.id, {\n resetPasswordToken: null,\n password,\n });\n\n const mode = strapi.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');\n if (mode === 'refresh') {\n return reissueTokensAfterPasswordChange(strapi, ctx, user);\n }\n\n return ctx.send({\n jwt: getService('jwt').issue({ id: user.id }),\n user: await sanitizeUser(user, ctx),\n });\n },\n async refresh(ctx) {\n const mode = strapi.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');\n if (mode !== 'refresh') {\n return ctx.notFound();\n }\n\n const upSessions = strapi.config.get('plugin::users-permissions.sessions');\n const cookieName = upSessions?.cookie?.name \|\| 'strapi_up_refresh';\n\n // Check for refresh token in cookie first (if httpOnly is configured), then in body\n let refreshToken = ctx.cookies.get(cookieName);\n if (!refreshToken) {\n refreshToken = ctx.request.body?.refreshToken;\n }\n\n if (!refreshToken \|\| typeof refreshToken !== 'string') {\n return ctx.badRequest('Missing refresh token');\n }\n\n const rotation = await strapi\n .sessionManager('users-permissions')\n .rotateRefreshToken(refreshToken);\n if ('error' in rotation) {\n return ctx.unauthorized('Invalid refresh token');\n }\n\n const result = await strapi\n .sessionManager('users-permissions')\n .generateAccessToken(rotation.token);\n if ('error' in result) {\n return ctx.unauthorized('Invalid refresh token');\n }\n\n const requestHttpOnly = ctx.request.header['x-strapi-refresh-cookie'] === 'httpOnly';\n if (upSessions?.httpOnly \|\| requestHttpOnly) {\n const isProduction = process.env.NODE_ENV === 'production';\n ctx.cookies.set(\n cookieName,\n rotation.token,\n buildRefreshCookieOptions(upSessions, isProduction)\n );\n return ctx.send({ jwt: result.token });\n }\n return ctx.send({ jwt: result.token, refreshToken: rotation.token });\n },\n async logout(ctx) {\n const mode = strapi.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');\n if (mode !== 'refresh') {\n return ctx.notFound();\n }\n\n if (!ctx.state.user) {\n return ctx.unauthorized('Missing authentication');\n }\n\n const userId = String(ctx.state.user.id);\n const upSessions = strapi.config.get('plugin::users-permissions.sessions');\n const body = ctx.request.body \|\| {};\n const scope = typeof body.scope === 'string' ? body.scope : undefined;\n const deviceId = extractDeviceId(body);\n\n try {\n await revokeLogoutSessions(strapi, ctx, userId, { scope, deviceId, body });\n } catch (err) {\n strapi.log.error('UP logout failed', err);\n }\n\n const requestHttpOnly = ctx.request.header['x-strapi-refresh-cookie'] === 'httpOnly';\n if (upSessions?.httpOnly \|\| requestHttpOnly) {\n const cookieName = upSessions.cookie?.name \|\| 'strapi_up_refresh';\n const isProduction = process.env.NODE_ENV === 'production';\n\n const { maxAge, ...cookieOptions } = buildRefreshCookieOptions(upSessions, isProduction);\n\n ctx.cookies.set(cookieName, '', { ...cookieOptions, expires: new Date(0) });\n }\n return ctx.send({ ok: true });\n },\n async getSessions(ctx) {\n const mode = strapi.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');\n if (mode !== 'refresh') {\n return ctx.notFound();\n }\n\n if (!ctx.state.user) {\n return ctx.unauthorized('Missing authentication');\n }\n\n const currentSessionId = ctx.state.session?.id;\n const sessions = await strapi\n .sessionManager('users-permissions')\n .listSessions(String(ctx.state.user.id));\n\n const data = sortSessionsForDisplay(\n sessions.map((session) => sanitizeSessionEntry(session, currentSessionId))\n );\n\n return ctx.send({ data });\n },\n async revokeSession(ctx) {\n const mode = strapi.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');\n if (mode !== 'refresh') {\n return ctx.notFound();\n }\n\n if (!ctx.state.user) {\n return ctx.unauthorized('Missing authentication');\n }\n\n const { sessionId } = ctx.params;\n const revoked = await strapi\n .sessionManager('users-permissions')\n .revokeSessionById(String(ctx.state.user.id), sessionId);\n\n if (!revoked) {\n return ctx.notFound('Session not found');\n }\n\n return ctx.send({ data: {} });\n },\n async connect(ctx, next) {\n const providers = await strapi\n .store({ type: 'plugin', name: 'users-permissions', key: 'grant' })\n .get();\n\n const [requestPath] = ctx.request.url.split('?');\n const provider = requestPath.split('/connect/')[1].split('/')[0];\n\n if (!_.get(providers, [provider, 'enabled'])) {\n throw new ApplicationError('This provider is disabled');\n }\n\n if (!strapi.config.server.url.startsWith('http')) {\n strapi.log.warn(\n 'You are using a third party provider for login. Make sure to set an absolute url in config/server.js. More info here: https://docs.strapi.io/developer-docs/latest/plugins/users-permissions.html#setting-up-the-server-url'\n );\n }\n\n const queryCustomCallback = _.get(ctx, 'query.callback');\n const dynamicSessionCallback = _.get(ctx, 'session.grant.dynamic.callback');\n const customCallback = queryCustomCallback ?? dynamicSessionCallback;\n\n if (customCallback !== undefined) {\n try {\n const { validate: validateCallback } = strapi\n .plugin('users-permissions')\n .config('callback');\n\n await validateCallback(customCallback, providers[provider]);\n\n // Persist across the provider redirect round-trip (request state alone is lost).\n ctx.session = ctx.session \|\| {};\n ctx.session.grant = ctx.session.grant \|\| {};\n ctx.session.grant.dynamic = {\n ...ctx.session.grant.dynamic,\n callback: customCallback,\n };\n ctx.state.oauthConnect = { callback: customCallback };\n } catch {\n throw new ValidationError('Invalid callback URL provided', { callback: customCallback });\n }\n }\n\n const { createOAuthConnectMiddleware } = require('../utils/oauth-connect');\n const oauthConnect = createOAuthConnectMiddleware();\n\n return oauthConnect(ctx, next);\n },\n\n async forgotPassword(ctx) {\n const { email } = await validateForgotPasswordBody(ctx.request.body);\n\n const pluginStore = await strapi.store({ type: 'plugin', name: 'users-permissions' });\n\n const emailSettings = await pluginStore.get({ key: 'email' });\n const advancedSettings = await pluginStore.get({ key: 'advanced' });\n\n // Find the user by email.\n const user = await strapi.db\n .query('plugin::users-permissions.user')\n .findOne({ where: { email: email.toLowerCase() } });\n\n if (!user \|\| user.blocked) {\n return ctx.send({ ok: true });\n }\n\n // Generate random token.\n const userInfo = await sanitizeUser(user, ctx);\n\n const resetPasswordToken = crypto.randomBytes(64).toString('hex');\n\n const resetPasswordSettings = _.get(emailSettings, 'reset_password.options', {});\n const emailBody = await getService('users-permissions').template(\n resetPasswordSettings.message,\n {\n URL: advancedSettings.email_reset_password,\n SERVER_URL: strapi.config.get('server.absoluteUrl'),\n ADMIN_URL: strapi.config.get('admin.absoluteUrl'),\n USER: userInfo,\n TOKEN: resetPasswordToken,\n }\n );\n\n const emailObject = await getService('users-permissions').template(\n resetPasswordSettings.object,\n {\n USER: userInfo,\n }\n );\n\n const emailToSend = {\n to: user.email,\n from:\n resetPasswordSettings.from.email \|\| resetPasswordSettings.from.name\n ? `${resetPasswordSettings.from.name} <${resetPasswordSettings.from.email}>`\n : undefined,\n replyTo: resetPasswordSettings.response_email,\n subject: emailObject,\n text: emailBody,\n html: emailBody,\n };\n\n // NOTE: Update the user before sending the email so an Admin can generate the link if the email fails\n await getService('user').edit(user.id, { resetPasswordToken });\n\n // Send an email to the user.\n await strapi.plugin('email').service('email').send(emailToSend);\n\n ctx.send({ ok: true });\n },\n\n async register(ctx) {\n const pluginStore = await strapi.store({ type: 'plugin', name: 'users-permissions' });\n\n const settings = await pluginStore.get({ key: 'advanced' });\n\n if (!settings.allow_register) {\n throw new ApplicationError('Register action is currently disabled');\n }\n\n const { register } = strapi.config.get('plugin::users-permissions');\n const alwaysAllowedKeys = ['username', 'password', 'email'];\n\n // Note that we intentionally do not filter allowedFields to allow a project to explicitly accept private or other Strapi field on registration\n const allowedKeys = compact(\n concat(alwaysAllowedKeys, isArray(register?.allowedFields) ? register.allowedFields : [])\n );\n\n // Check if there are any keys in requestBody that are not in allowedKeys\n const invalidKeys = Object.keys(ctx.request.body).filter((key) => !allowedKeys.includes(key));\n\n if (invalidKeys.length > 0) {\n // If there are invalid keys, throw an error\n throw new ValidationError(`Invalid parameters: ${invalidKeys.join(', ')}`);\n }\n\n const params = {\n ..._.pick(ctx.request.body, allowedKeys),\n provider: 'local',\n };\n\n const validations = strapi.config.get('plugin::users-permissions.validationRules');\n\n await validateRegisterBody(params, validations);\n\n const role = await strapi.db\n .query('plugin::users-permissions.role')\n .findOne({ where: { type: settings.default_role } });\n\n if (!role) {\n throw new ApplicationError('Impossible to find the default role');\n }\n\n const { email, username, provider } = params;\n\n const identifierFilter = {\n $or: [\n { email: email.toLowerCase() },\n { username: email.toLowerCase() },\n { username },\n { email: username },\n ],\n };\n\n const conflictingUserCount = await strapi.db.query('plugin::users-permissions.user').count({\n where: { ...identifierFilter, provider },\n });\n\n if (conflictingUserCount > 0) {\n throw new ApplicationError('Email or Username are already taken');\n }\n\n if (settings.unique_email) {\n const conflictingUserCount = await strapi.db.query('plugin::users-permissions.user').count({\n where: { ...identifierFilter },\n });\n\n if (conflictingUserCount > 0) {\n throw new ApplicationError('Email or Username are already taken');\n }\n }\n\n const newUser = {\n ...params,\n role: role.id,\n email: email.toLowerCase(),\n username,\n confirmed: !settings.email_confirmation,\n };\n\n const user = await getService('user').add(newUser);\n\n const sanitizedUser = await sanitizeUser(user, ctx);\n\n if (settings.email_confirmation) {\n try {\n await getService('user').sendConfirmationEmail(sanitizedUser);\n } catch (err) {\n strapi.log.error(err);\n throw new ApplicationError('Error sending confirmation email');\n }\n\n return ctx.send({ user: sanitizedUser });\n }\n\n const mode = strapi.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');\n if (mode === 'refresh') {\n const deviceId = extractDeviceId(ctx.request.body) \|\| crypto.randomUUID();\n\n const refresh = await strapi\n .sessionManager('users-permissions')\n .generateRefreshToken(String(user.id), deviceId, {\n type: 'refresh',\n metadata: buildSessionMetadataFromContext(ctx),\n });\n\n const access = await strapi\n .sessionManager('users-permissions')\n .generateAccessToken(refresh.token);\n if ('error' in access) {\n throw new ApplicationError('Invalid credentials');\n }\n\n return ctx.send({ jwt: access.token, refreshToken: refresh.token, user: sanitizedUser });\n }\n\n const jwt = getService('jwt').issue(_.pick(user, ['id']));\n return ctx.send({ jwt, user: sanitizedUser });\n },\n\n async emailConfirmation(ctx, next, returnUser) {\n const { confirmation: confirmationToken } = await validateEmailConfirmationBody(ctx.query);\n\n const userService = getService('user');\n const jwtService = getService('jwt');\n\n const [user] = await userService.fetchAll({ filters: { confirmationToken } });\n\n if (!user) {\n throw new ValidationError('Invalid token');\n }\n\n await userService.edit(user.id, { confirmed: true, confirmationToken: null });\n\n if (returnUser) {\n ctx.send({\n jwt: jwtService.issue({ id: user.id }),\n user: await sanitizeUser(user, ctx),\n });\n } else {\n const settings = await strapi\n .store({ type: 'plugin', name: 'users-permissions', key: 'advanced' })\n .get();\n\n ctx.redirect(settings.email_confirmation_redirection \|\| '/');\n }\n },\n\n async sendEmailConfirmation(ctx) {\n const { email } = await validateSendEmailConfirmationBody(ctx.request.body);\n\n const user = await strapi.db.query('plugin::users-permissions.user').findOne({\n where: { email: email.toLowerCase() },\n });\n\n if (!user) {\n return ctx.send({ email, sent: true });\n }\n\n if (user.confirmed) {\n throw new ApplicationError('Already confirmed');\n }\n\n if (user.blocked) {\n throw new ApplicationError('User blocked');\n }\n\n await getService('user').sendConfirmationEmail(user);\n\n ctx.send({\n email: user.email,\n sent: true,\n });\n },\n});\n"],"names":["crypto","require$$0","_","require$$1","concat","compact","isArray","require$$2","utils","require$$3","getService","require$$4","buildRefreshCookieOptions","require$$5","validateCallbackBody","validateRegisterBody","validateSendEmailConfirmationBody","validateForgotPasswordBody","validateResetPasswordBody","validateEmailConfirmationBody","validateChangePasswordBody","require$$6","ApplicationError","ValidationError","ForbiddenError","errors","buildSessionMetadata","sanitizeSessionEntry","sortSessionsForDisplay","sanitizeUser","user","ctx","auth","state","userSchema","strapi","getModel","contentAPI","sanitize","output","extractDeviceId","requestBody","deviceId","length","undefined","buildSessionMetadataFromContext","userAgent","request","headers","sendRefreshAuthResponse","metadata","body","tokenOptions","type","refresh","sessionManager","generateRefreshToken","String","id","access","generateAccessToken","token","upSessions","config","get","requestHttpOnly","header","httpOnly","cookieName","cookie","name","isProduction","process","env","NODE_ENV","cookies","set","send","jwt","refreshToken","reissueTokensAfterPasswordChange","invalidateRefreshToken","newDeviceId","randomUUID","revokeLogoutSessions","userId","scope","currentSessionId","session","validation","validateRefreshToken","isValid","sessionId","revokeSessionById","callback","provider","params","store","grantSettings","key","grantProvider","identifier","db","query","findOne","where","$or","email","toLowerCase","username","password","validPassword","validatePassword","advancedSettings","requiresConfirmation","confirmed","blocked","mode","issue","connect","error","message","changePassword","validations","currentPassword","edit","resetPassword","passwordConfirmation","code","resetPasswordToken","notFound","badRequest","rotation","rotateRefreshToken","unauthorized","result","logout","err","log","maxAge","cookieOptions","expires","Date","ok","getSessions","sessions","listSessions","data","map","revokeSession","revoked","next","providers","requestPath","url","split","server","startsWith","warn","queryCustomCallback","dynamicSessionCallback","customCallback","validate","validateCallback","plugin","grant","dynamic","oauthConnect","createOAuthConnectMiddleware","require$$7","forgotPassword","pluginStore","emailSettings","userInfo","randomBytes","toString","resetPasswordSettings","emailBody","template","URL","email_reset_password","SERVER_URL","ADMIN_URL","USER","TOKEN","emailObject","object","emailToSend","to","from","replyTo","response_email","subject","text","html","service","register","settings","allow_register","alwaysAllowedKeys","allowedKeys","allowedFields","invalidKeys","Object","keys","filter","includes","join","pick","role","default_role","identifierFilter","conflictingUserCount","count","unique_email","newUser","email_confirmation","add","sanitizedUser","sendConfirmationEmail","emailConfirmation","returnUser","confirmation","confirmationToken","userService","jwtService","fetchAll","filters","redirect","email_confirmation_redirection","sendEmailConfirmation","sent"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAEA;;;;4CAOA,MAAMA,MAAAA,GAASC,6BAAAA;AACf,IAAA,MAAMC,CAAAA,GAAIC,6BAAAA;AACV,IAAA,MAAM,EAAEC,MAAM,EAAEC,OAAO,EAAEC,OAAO,EAAE,GAAGC,2BAAAA;AACrC,IAAA,MAAMC,KAAAA,GAAQC,2BAAAA;IACd,MAAM,EAAEC,UAAU,EAAE,GAAGC,eAAAA,EAAAA;IACvB,MAAM,EAAEC,yBAAyB,EAAE,GAAGC,8BAAAA,EAAAA;AACtC,IAAA,MAAM,EACJC,oBAAoB,EACpBC,oBAAoB,EACpBC,iCAAiC,EACjCC,0BAA0B,EAC1BC,yBAAyB,EACzBC,6BAA6B,EAC7BC,0BAA0B,EAC3B,GAAGC,gBAAAA,EAAAA;IAEJ,MAAM,EAAEC,gBAAgB,EAAEC,eAAe,EAAEC,cAAc,EAAE,GAAGhB,KAAAA,CAAMiB,MAAM;AAC1E,IAAA,MAAM,EAAEC,oBAAoB,EAAEC,oBAAoB,EAAEC,sBAAsB,EAAE,GAAGpB,KAAAA;IAE/E,MAAMqB,YAAAA,GAAe,CAACC,IAAAA,EAAMC,GAAAA,GAAAA;AAC1B,QAAA,MAAM,EAAEC,IAAI,EAAE,GAAGD,IAAIE,KAAK;QAC1B,MAAMC,UAAAA,GAAaC,MAAAA,CAAOC,QAAQ,CAAC,gCAAA,CAAA;QAEnC,OAAOD,MAAAA,CAAOE,UAAU,CAACC,QAAQ,CAACC,MAAM,CAACT,MAAMI,UAAAA,EAAY;AAAEF,YAAAA;;AAC/D,IAAA,CAAA;AAEA,IAAA,MAAMQ,kBAAkB,CAACC,WAAAA,GAAAA;AACvB,QAAA,MAAM,EAAEC,QAAQ,EAAE,GAAGD,eAAe,EAAA;AAEpC,QAAA,OAAO,OAAOC,QAAAA,KAAa,QAAA,IAAYA,SAASC,MAAM,GAAG,IAAID,QAAAA,GAAWE,SAAAA;AAC1E,IAAA,CAAA;IAEA,MAAMC,+BAAAA,GAAkC,CAACd,GAAAA,GACvCL,oBAAAA,CAAqB;AACnBoB,YAAAA,SAAAA,EAAWf,GAAAA,CAAIgB,OAAO,CAACC,OAAO,CAAC,YAAA;AACnC,SAAA,CAAA;IAEA,MAAMC,uBAAAA,GAA0B,OAAOd,OAAAA,EAAQJ,GAAAA,EAAKD,IAAAA,EAAM,EAAEoB,QAAQ,EAAE,GAAG,EAAE,GAAA;AACzE,QAAA,MAAMR,QAAAA,GAAWF,eAAAA,CAAgBT,GAAAA,CAAIgB,OAAO,CAACI,IAAI,CAAA;AACjD,QAAA,MAAMC,YAAAA,GAAe;YAAEC,IAAAA,EAAM,SAAA;AAAW,YAAA,GAAIH,QAAAA,GAAW;AAAEA,gBAAAA;gBAAa;AAAG,SAAA;AAEzE,QAAA,MAAMI,OAAAA,GAAU,MAAMnB,OAAAA,CACnBoB,cAAc,CAAC,mBAAA,CAAA,CACfC,oBAAoB,CAACC,MAAAA,CAAO3B,IAAAA,CAAK4B,EAAE,CAAA,EAAGhB,QAAAA,EAAUU,YAAAA,CAAAA;QAEnD,MAAMO,MAAAA,GAAS,MAAMxB,OAAAA,CAClBoB,cAAc,CAAC,mBAAA,CAAA,CACfK,mBAAmB,CAACN,OAAAA,CAAQO,KAAK,CAAA;AACpC,QAAA,IAAI,WAAWF,MAAAA,EAAQ;AACrB,YAAA,MAAM,IAAIrC,gBAAAA,CAAiB,qBAAA,CAAA;AAC/B,QAAA;AAEE,QAAA,MAAMwC,UAAAA,GAAa3B,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,oCAAA,CAAA;AACrC,QAAA,MAAMC,kBAAkBlC,GAAAA,CAAIgB,OAAO,CAACmB,MAAM,CAAC,0BAA0B,KAAK,UAAA;QAE1E,IAAIJ,UAAAA,EAAYK,YAAYF,eAAAA,EAAiB;AAC3C,YAAA,MAAMG,UAAAA,GAAaN,UAAAA,CAAWO,MAAM,EAAEC,IAAAA,IAAQ,mBAAA;AAC9C,YAAA,MAAMC,YAAAA,GAAeC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;YAC9C3C,GAAAA,CAAI4C,OAAO,CAACC,GAAG,CAACR,YAAYd,OAAAA,CAAQO,KAAK,EAAEjD,yBAAAA,CAA0BkD,UAAAA,EAAYS,YAAAA,CAAAA,CAAAA;YACjF,OAAOxC,GAAAA,CAAI8C,IAAI,CAAC;AAAEC,gBAAAA,GAAAA,EAAKnB,OAAOE,KAAK;gBAAE/B,IAAAA,EAAM,MAAMD,aAAaC,IAAAA,EAAMC,GAAAA;AAAI,aAAA,CAAA;AAC5E,QAAA;QAEE,OAAOA,GAAAA,CAAI8C,IAAI,CAAC;AACdC,YAAAA,GAAAA,EAAKnB,OAAOE,KAAK;AACjBkB,YAAAA,YAAAA,EAAczB,QAAQO,KAAK;YAC3B/B,IAAAA,EAAM,MAAMD,aAAaC,IAAAA,EAAMC,GAAAA;AACnC,SAAA,CAAA;AACA,IAAA,CAAA;IAEA,MAAMiD,gCAAAA,GAAmC,OAAO7C,OAAAA,EAAQJ,GAAAA,EAAKD,IAAAA,GAAAA;AAC3D,QAAA,MAAMY,QAAAA,GAAWF,eAAAA,CAAgBT,GAAAA,CAAIgB,OAAO,CAACI,IAAI,CAAA;QAEjD,MAAMhB,OAAAA,CAAOoB,cAAc,CAAC,mBAAA,CAAA,CAAqB0B,sBAAsB,CAACxB,MAAAA,CAAO3B,KAAK4B,EAAE,CAAA,CAAA;QAEtF,MAAMwB,WAAAA,GAAcxC,QAAAA,IAAY1C,MAAAA,CAAOmF,UAAU,EAAA;AACjD,QAAA,MAAM7B,OAAAA,GAAU,MAAMnB,OAAAA,CACnBoB,cAAc,CAAC,mBAAA,CAAA,CACfC,oBAAoB,CAACC,MAAAA,CAAO3B,IAAAA,CAAK4B,EAAE,CAAA,EAAGwB,WAAAA,EAAa;YAAE7B,IAAAA,EAAM;;QAE9D,MAAMM,MAAAA,GAAS,MAAMxB,OAAAA,CAClBoB,cAAc,CAAC,mBAAA,CAAA,CACfK,mBAAmB,CAACN,OAAAA,CAAQO,KAAK,CAAA;AACpC,QAAA,IAAI,WAAWF,MAAAA,EAAQ;AACrB,YAAA,MAAM,IAAIrC,gBAAAA,CAAiB,qBAAA,CAAA;AAC/B,QAAA;QAEE,OAAOS,GAAAA,CAAI8C,IAAI,CAAC;AACdC,YAAAA,GAAAA,EAAKnB,OAAOE,KAAK;AACjBkB,YAAAA,YAAAA,EAAczB,QAAQO,KAAK;YAC3B/B,IAAAA,EAAM,MAAMD,aAAaC,IAAAA,EAAMC,GAAAA;AACnC,SAAA,CAAA;AACA,IAAA,CAAA;IAEA,MAAMqD,oBAAAA,GAAuB,OAAOjD,OAAAA,EAAQJ,GAAAA,EAAKsD,MAAAA,EAAQ,EAAEC,KAAK,EAAE5C,QAAQ,EAAES,IAAI,EAAE,GAAA;QAChF,MAAMI,cAAAA,GAAiBpB,OAAAA,CAAOoB,cAAc,CAAC,mBAAA,CAAA;AAC7C,QAAA,MAAMO,UAAAA,GAAa3B,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,oCAAA,CAAA;AAErC,QAAA,IAAIsB,UAAU,KAAA,EAAO;YACnB,MAAM/B,cAAAA,CAAe0B,sBAAsB,CAACI,MAAAA,CAAAA;AAC5C,YAAA;AACJ,QAAA;AAEE,QAAA,IAAI3C,QAAAA,EAAU;YACZ,MAAMa,cAAAA,CAAe0B,sBAAsB,CAACI,MAAAA,EAAQ3C,QAAAA,CAAAA;AACpD,YAAA;AACJ,QAAA;AAEE,QAAA,IAAI6C,gBAAAA,GAAmBxD,GAAAA,CAAIE,KAAK,CAACuD,OAAO,EAAE9B,EAAAA;QAC1C,MAAMU,UAAAA,GAAaN,UAAAA,EAAYO,MAAAA,EAAQC,IAAAA,IAAQ,mBAAA;AAC/C,QAAA,MAAMS,eACJhD,GAAAA,CAAI4C,OAAO,CAACX,GAAG,CAACI,UAAAA,CAAAA,KACf,OAAOjB,IAAAA,CAAK4B,YAAY,KAAK,QAAA,GAAW5B,IAAAA,CAAK4B,YAAY,GAAGnC,SAAA,CAAA;AAE/D,QAAA,IAAImC,YAAAA,EAAc;AAChB,YAAA,MAAMU,UAAAA,GAAa,MAAMlC,cAAAA,CAAemC,oBAAoB,CAACX,YAAAA,CAAAA;YAC7D,IAAIU,UAAAA,CAAWE,OAAO,EAAE;AACtBJ,gBAAAA,gBAAAA,GAAmBE,WAAWG,SAAS;AAC7C,YAAA;AACA,QAAA;AAEE,QAAA,IAAIL,gBAAAA,EAAkB;YACpB,MAAMhC,cAAAA,CAAesC,iBAAiB,CAACR,MAAAA,EAAQE,gBAAAA,CAAAA;AAC/C,YAAA;AACJ,QAAA;QAEE,MAAMhC,cAAAA,CAAe0B,sBAAsB,CAACI,MAAAA,CAAAA;AAC9C,IAAA,CAAA;AAEArD,IAAAA,IAAAA,GAAiB,CAAC,EAAEG,MAAAA,EAAAA,OAAM,EAAE,IAAM;AAChC,YAAA,MAAM2D,UAAS/D,GAAG,EAAA;AAChB,gBAAA,MAAMgE,QAAAA,GAAWhE,GAAAA,CAAIiE,MAAM,CAACD,QAAQ,IAAI,OAAA;AACxC,gBAAA,MAAMC,MAAAA,GAASjE,GAAAA,CAAIgB,OAAO,CAACI,IAAI;gBAE/B,MAAM8C,KAAAA,GAAQ9D,OAAAA,CAAO8D,KAAK,CAAC;oBAAE5C,IAAAA,EAAM,QAAA;oBAAUiB,IAAAA,EAAM;;AACnD,gBAAA,MAAM4B,aAAAA,GAAgB,MAAMD,KAAAA,CAAMjC,GAAG,CAAC;oBAAEmC,GAAAA,EAAK;;gBAE7C,MAAMC,aAAAA,GAAgBL,QAAAA,KAAa,OAAA,GAAU,OAAA,GAAUA,QAAAA;AAEvD,gBAAA,IAAI,CAAC7F,CAAAA,CAAE8D,GAAG,CAACkC,aAAAA,EAAe;AAACE,oBAAAA,aAAAA;AAAe,oBAAA;iBAAU,CAAA,EAAG;AACrD,oBAAA,MAAM,IAAI9E,gBAAAA,CAAiB,2BAAA,CAAA;AACjC,gBAAA;AAEI,gBAAA,IAAIyE,aAAa,OAAA,EAAS;AACxB,oBAAA,MAAMjF,oBAAAA,CAAqBkF,MAAAA,CAAAA;oBAE3B,MAAM,EAAEK,UAAU,EAAE,GAAGL,MAAAA;;oBAGvB,MAAMlE,IAAAA,GAAO,MAAMK,OAAAA,CAAOmE,EAAE,CAACC,KAAK,CAAC,gCAAA,CAAA,CAAkCC,OAAO,CAAC;wBAC3EC,KAAAA,EAAO;AACLV,4BAAAA,QAAAA;4BACAW,GAAAA,EAAK;AAAC,gCAAA;AAAEC,oCAAAA,KAAAA,EAAON,WAAWO,WAAW;;AAAM,gCAAA;oCAAEC,QAAAA,EAAUR;;AAAa;AAC9E;AACA,qBAAA,CAAA;AAEM,oBAAA,IAAI,CAACvE,IAAAA,EAAM;AACT,wBAAA,MAAM,IAAIP,eAAAA,CAAgB,gCAAA,CAAA;AAClC,oBAAA;oBAEM,IAAI,CAACO,IAAAA,CAAKgF,QAAQ,EAAE;AAClB,wBAAA,MAAM,IAAIvF,eAAAA,CAAgB,gCAAA,CAAA;AAClC,oBAAA;oBAEM,MAAMwF,aAAAA,GAAgB,MAAMrG,UAAAA,CAAW,MAAA,CAAA,CAAQsG,gBAAgB,CAC7DhB,MAAAA,CAAOc,QAAQ,EACfhF,IAAAA,CAAKgF,QAAA,CAAA;AAGP,oBAAA,IAAI,CAACC,aAAAA,EAAe;AAClB,wBAAA,MAAM,IAAIxF,eAAAA,CAAgB,gCAAA,CAAA;AAClC,oBAAA;AAEM,oBAAA,MAAM0F,gBAAAA,GAAmB,MAAMhB,KAAAA,CAAMjC,GAAG,CAAC;wBAAEmC,GAAAA,EAAK;;AAChD,oBAAA,MAAMe,oBAAAA,GAAuBhH,CAAAA,CAAE8D,GAAG,CAACiD,gBAAAA,EAAkB,oBAAA,CAAA;AAErD,oBAAA,IAAIC,oBAAAA,IAAwBpF,IAAAA,CAAKqF,SAAS,KAAK,IAAA,EAAM;AACnD,wBAAA,MAAM,IAAI7F,gBAAAA,CAAiB,qCAAA,CAAA;AACnC,oBAAA;oBAEM,IAAIQ,IAAAA,CAAKsF,OAAO,KAAK,IAAA,EAAM;AACzB,wBAAA,MAAM,IAAI9F,gBAAAA,CAAiB,mDAAA,CAAA;AACnC,oBAAA;AAEM,oBAAA,MAAM+F,OAAOlF,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,yCAAA,EAA2C,gBAAA,CAAA;AAC1E,oBAAA,IAAIqD,SAAS,SAAA,EAAW;wBACtB,OAAOpE,uBAAAA,CAAwBd,OAAAA,EAAQJ,GAAAA,EAAKD,IAAAA,EAAM;AAChDoB,4BAAAA,QAAAA,EAAUL,+BAAAA,CAAgCd,GAAAA;AACpD,yBAAA,CAAA;AACA,oBAAA;oBAEM,OAAOA,GAAAA,CAAI8C,IAAI,CAAC;wBACdC,GAAAA,EAAKpE,UAAAA,CAAW,KAAA,CAAA,CAAO4G,KAAK,CAAC;AAAE5D,4BAAAA,EAAAA,EAAI5B,KAAK4B;;wBACxC5B,IAAAA,EAAM,MAAMD,aAAaC,IAAAA,EAAMC,GAAAA;AACvC,qBAAA,CAAA;AACA,gBAAA;;gBAGI,IAAI;oBACF,MAAMD,IAAAA,GAAO,MAAMpB,UAAAA,CAAW,WAAA,CAAA,CAAa6G,OAAO,CAACxB,QAAAA,EAAUhE,IAAIwE,KAAK,CAAA;oBAEtE,IAAIzE,IAAAA,CAAKsF,OAAO,EAAE;AAChB,wBAAA,MAAM,IAAI5F,cAAAA,CAAe,mDAAA,CAAA;AACjC,oBAAA;AAEM,oBAAA,MAAM6F,OAAOlF,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,yCAAA,EAA2C,gBAAA,CAAA;AAC1E,oBAAA,IAAIqD,SAAS,SAAA,EAAW;wBACtB,OAAOpE,uBAAAA,CAAwBd,OAAAA,EAAQJ,GAAAA,EAAKD,IAAAA,EAAM;AAChDoB,4BAAAA,QAAAA,EAAUL,+BAAAA,CAAgCd,GAAAA;AACpD,yBAAA,CAAA;AACA,oBAAA;oBAEM,OAAOA,GAAAA,CAAI8C,IAAI,CAAC;wBACdC,GAAAA,EAAKpE,UAAAA,CAAW,KAAA,CAAA,CAAO4G,KAAK,CAAC;AAAE5D,4BAAAA,EAAAA,EAAI5B,KAAK4B;;wBACxC5B,IAAAA,EAAM,MAAMD,aAAaC,IAAAA,EAAMC,GAAAA;AACvC,qBAAA,CAAA;AACA,gBAAA,CAAA,CAAM,OAAOyF,KAAAA,EAAO;oBACd,MAAM,IAAIlG,gBAAAA,CAAiBkG,KAAAA,CAAMC,OAAO,CAAA;AAC9C,gBAAA;AACA,YAAA,CAAA;AAEE,YAAA,MAAMC,gBAAe3F,GAAG,EAAA;AACtB,gBAAA,IAAI,CAACA,GAAAA,CAAIE,KAAK,CAACH,IAAI,EAAE;AACnB,oBAAA,MAAM,IAAIR,gBAAAA,CAAiB,kDAAA,CAAA;AACjC,gBAAA;AAEI,gBAAA,MAAMqG,WAAAA,GAAcxF,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,2CAAA,CAAA;AAEtC,gBAAA,MAAM,EAAE4D,eAAe,EAAEd,QAAQ,EAAE,GAAG,MAAM1F,0BAAAA,CAC1CW,GAAAA,CAAIgB,OAAO,CAACI,IAAI,EAChBwE,WAAAA,CAAAA;gBAGF,MAAM7F,IAAAA,GAAO,MAAMK,OAAAA,CAAOmE,EAAA,CACvBC,KAAK,CAAC,gCAAA,CAAA,CACNC,OAAO,CAAC;oBAAEC,KAAAA,EAAO;AAAE/C,wBAAAA,EAAAA,EAAI3B,GAAAA,CAAIE,KAAK,CAACH,IAAI,CAAC4B;AAAE;;gBAE3C,MAAMqD,aAAAA,GAAgB,MAAMrG,UAAAA,CAAW,MAAA,CAAA,CAAQsG,gBAAgB,CAACY,eAAAA,EAAiB9F,KAAKgF,QAAQ,CAAA;AAE9F,gBAAA,IAAI,CAACC,aAAAA,EAAe;AAClB,oBAAA,MAAM,IAAIxF,eAAAA,CAAgB,0CAAA,CAAA;AAChC,gBAAA;AAEI,gBAAA,IAAIqG,oBAAoBd,QAAAA,EAAU;AAChC,oBAAA,MAAM,IAAIvF,eAAAA,CAAgB,gEAAA,CAAA;AAChC,gBAAA;AAEI,gBAAA,MAAMb,WAAW,MAAA,CAAA,CAAQmH,IAAI,CAAC/F,IAAAA,CAAK4B,EAAE,EAAE;AAAEoD,oBAAAA;;AAEzC,gBAAA,MAAMO,OAAOlF,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,yCAAA,EAA2C,gBAAA,CAAA;AAC1E,gBAAA,IAAIqD,SAAS,SAAA,EAAW;oBACtB,OAAOrC,gCAAAA,CAAiC7C,SAAQJ,GAAAA,EAAKD,IAAAA,CAAAA;AAC3D,gBAAA;gBAEI,OAAOC,GAAAA,CAAI8C,IAAI,CAAC;oBACdC,GAAAA,EAAKpE,UAAAA,CAAW,KAAA,CAAA,CAAO4G,KAAK,CAAC;AAAE5D,wBAAAA,EAAAA,EAAI5B,KAAK4B;;oBACxC5B,IAAAA,EAAM,MAAMD,aAAaC,IAAAA,EAAMC,GAAAA;AACrC,iBAAA,CAAA;AACA,YAAA,CAAA;AAEE,YAAA,MAAM+F,eAAc/F,GAAG,EAAA;AACrB,gBAAA,MAAM4F,WAAAA,GAAcxF,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,2CAAA,CAAA;AAEtC,gBAAA,MAAM,EAAE8C,QAAQ,EAAEiB,oBAAoB,EAAEC,IAAI,EAAE,GAAG,MAAM9G,yBAAAA,CACrDa,GAAAA,CAAIgB,OAAO,CAACI,IAAI,EAChBwE,WAAAA,CAAAA;AAGF,gBAAA,IAAIb,aAAaiB,oBAAAA,EAAsB;AACrC,oBAAA,MAAM,IAAIxG,eAAAA,CAAgB,wBAAA,CAAA;AAChC,gBAAA;gBAEI,MAAMO,IAAAA,GAAO,MAAMK,OAAAA,CAAOmE,EAAA,CACvBC,KAAK,CAAC,gCAAA,CAAA,CACNC,OAAO,CAAC;oBAAEC,KAAAA,EAAO;wBAAEwB,kBAAAA,EAAoBD;AAAI;AAAE,iBAAA,CAAA;AAEhD,gBAAA,IAAI,CAAClG,IAAAA,EAAM;AACT,oBAAA,MAAM,IAAIP,eAAAA,CAAgB,yBAAA,CAAA;AAChC,gBAAA;AAEI,gBAAA,MAAMb,WAAW,MAAA,CAAA,CAAQmH,IAAI,CAAC/F,IAAAA,CAAK4B,EAAE,EAAE;oBACrCuE,kBAAAA,EAAoB,IAAA;AACpBnB,oBAAAA;AACN,iBAAA,CAAA;AAEI,gBAAA,MAAMO,OAAOlF,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,yCAAA,EAA2C,gBAAA,CAAA;AAC1E,gBAAA,IAAIqD,SAAS,SAAA,EAAW;oBACtB,OAAOrC,gCAAAA,CAAiC7C,SAAQJ,GAAAA,EAAKD,IAAAA,CAAAA;AAC3D,gBAAA;gBAEI,OAAOC,GAAAA,CAAI8C,IAAI,CAAC;oBACdC,GAAAA,EAAKpE,UAAAA,CAAW,KAAA,CAAA,CAAO4G,KAAK,CAAC;AAAE5D,wBAAAA,EAAAA,EAAI5B,KAAK4B;;oBACxC5B,IAAAA,EAAM,MAAMD,aAAaC,IAAAA,EAAMC,GAAAA;AACrC,iBAAA,CAAA;AACA,YAAA,CAAA;AACE,YAAA,MAAMuB,SAAQvB,GAAG,EAAA;AACf,gBAAA,MAAMsF,OAAOlF,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,yCAAA,EAA2C,gBAAA,CAAA;AAC1E,gBAAA,IAAIqD,SAAS,SAAA,EAAW;AACtB,oBAAA,OAAOtF,IAAImG,QAAQ,EAAA;AACzB,gBAAA;AAEI,gBAAA,MAAMpE,UAAAA,GAAa3B,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,oCAAA,CAAA;gBACrC,MAAMI,UAAAA,GAAaN,UAAAA,EAAYO,MAAAA,EAAQC,IAAAA,IAAQ,mBAAA;;AAG/C,gBAAA,IAAIS,YAAAA,GAAehD,GAAAA,CAAI4C,OAAO,CAACX,GAAG,CAACI,UAAAA,CAAAA;AACnC,gBAAA,IAAI,CAACW,YAAAA,EAAc;AACjBA,oBAAAA,YAAAA,GAAehD,GAAAA,CAAIgB,OAAO,CAACI,IAAI,EAAE4B,YAAAA;AACvC,gBAAA;AAEI,gBAAA,IAAI,CAACA,YAAAA,IAAgB,OAAOA,YAAAA,KAAiB,QAAA,EAAU;oBACrD,OAAOhD,GAAAA,CAAIoG,UAAU,CAAC,uBAAA,CAAA;AAC5B,gBAAA;AAEI,gBAAA,MAAMC,WAAW,MAAMjG,OAAAA,CACpBoB,cAAc,CAAC,mBAAA,CAAA,CACf8E,kBAAkB,CAACtD,YAAAA,CAAAA;AACtB,gBAAA,IAAI,WAAWqD,QAAAA,EAAU;oBACvB,OAAOrG,GAAAA,CAAIuG,YAAY,CAAC,uBAAA,CAAA;AAC9B,gBAAA;gBAEI,MAAMC,MAAAA,GAAS,MAAMpG,OAAAA,CAClBoB,cAAc,CAAC,mBAAA,CAAA,CACfK,mBAAmB,CAACwE,QAAAA,CAASvE,KAAK,CAAA;AACrC,gBAAA,IAAI,WAAW0E,MAAAA,EAAQ;oBACrB,OAAOxG,GAAAA,CAAIuG,YAAY,CAAC,uBAAA,CAAA;AAC9B,gBAAA;AAEI,gBAAA,MAAMrE,kBAAkBlC,GAAAA,CAAIgB,OAAO,CAACmB,MAAM,CAAC,0BAA0B,KAAK,UAAA;gBAC1E,IAAIJ,UAAAA,EAAYK,YAAYF,eAAAA,EAAiB;AAC3C,oBAAA,MAAMM,YAAAA,GAAeC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;oBAC9C3C,GAAAA,CAAI4C,OAAO,CAACC,GAAG,CACbR,YACAgE,QAAAA,CAASvE,KAAK,EACdjD,yBAAAA,CAA0BkD,UAAAA,EAAYS,YAAAA,CAAAA,CAAAA;oBAExC,OAAOxC,GAAAA,CAAI8C,IAAI,CAAC;AAAEC,wBAAAA,GAAAA,EAAKyD,OAAO1E;AAAK,qBAAA,CAAA;AACzC,gBAAA;gBACI,OAAO9B,GAAAA,CAAI8C,IAAI,CAAC;AAAEC,oBAAAA,GAAAA,EAAKyD,OAAO1E,KAAK;AAAEkB,oBAAAA,YAAAA,EAAcqD,SAASvE;;AAChE,YAAA,CAAA;AACE,YAAA,MAAM2E,QAAOzG,GAAG,EAAA;AACd,gBAAA,MAAMsF,OAAOlF,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,yCAAA,EAA2C,gBAAA,CAAA;AAC1E,gBAAA,IAAIqD,SAAS,SAAA,EAAW;AACtB,oBAAA,OAAOtF,IAAImG,QAAQ,EAAA;AACzB,gBAAA;AAEI,gBAAA,IAAI,CAACnG,GAAAA,CAAIE,KAAK,CAACH,IAAI,EAAE;oBACnB,OAAOC,GAAAA,CAAIuG,YAAY,CAAC,wBAAA,CAAA;AAC9B,gBAAA;AAEI,gBAAA,MAAMjD,SAAS5B,MAAAA,CAAO1B,GAAAA,CAAIE,KAAK,CAACH,IAAI,CAAC4B,EAAE,CAAA;AACvC,gBAAA,MAAMI,UAAAA,GAAa3B,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,oCAAA,CAAA;AACrC,gBAAA,MAAMb,OAAOpB,GAAAA,CAAIgB,OAAO,CAACI,IAAI,IAAI,EAAA;gBACjC,MAAMmC,KAAAA,GAAQ,OAAOnC,IAAAA,CAAKmC,KAAK,KAAK,QAAA,GAAWnC,IAAAA,CAAKmC,KAAK,GAAG1C,SAAAA;AAC5D,gBAAA,MAAMF,WAAWF,eAAAA,CAAgBW,IAAAA,CAAAA;gBAEjC,IAAI;oBACF,MAAMiC,oBAAAA,CAAqBjD,OAAAA,EAAQJ,GAAAA,EAAKsD,MAAAA,EAAQ;AAAEC,wBAAAA,KAAAA;AAAO5C,wBAAAA,QAAAA;AAAUS,wBAAAA;;AACzE,gBAAA,CAAA,CAAM,OAAOsF,GAAAA,EAAK;AACZtG,oBAAAA,OAAAA,CAAOuG,GAAG,CAAClB,KAAK,CAAC,kBAAA,EAAoBiB,GAAAA,CAAAA;AAC3C,gBAAA;AAEI,gBAAA,MAAMxE,kBAAkBlC,GAAAA,CAAIgB,OAAO,CAACmB,MAAM,CAAC,0BAA0B,KAAK,UAAA;gBAC1E,IAAIJ,UAAAA,EAAYK,YAAYF,eAAAA,EAAiB;AAC3C,oBAAA,MAAMG,UAAAA,GAAaN,UAAAA,CAAWO,MAAM,EAAEC,IAAAA,IAAQ,mBAAA;AAC9C,oBAAA,MAAMC,YAAAA,GAAeC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;AAE9C,oBAAA,MAAM,EAAEiE,MAAM,EAAE,GAAGC,aAAAA,EAAe,GAAGhI,0BAA0BkD,UAAAA,EAAYS,YAAAA,CAAAA;AAE3ExC,oBAAAA,GAAAA,CAAI4C,OAAO,CAACC,GAAG,CAACR,YAAY,EAAA,EAAI;AAAE,wBAAA,GAAGwE,aAAa;AAAEC,wBAAAA,OAAAA,EAAS,IAAIC,IAAAA,CAAK,CAAA;AAAE,qBAAA,CAAA;AAC9E,gBAAA;gBACI,OAAO/G,GAAAA,CAAI8C,IAAI,CAAC;oBAAEkE,EAAAA,EAAI;AAAI,iBAAA,CAAA;AAC9B,YAAA,CAAA;AACE,YAAA,MAAMC,aAAYjH,GAAG,EAAA;AACnB,gBAAA,MAAMsF,OAAOlF,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,yCAAA,EAA2C,gBAAA,CAAA;AAC1E,gBAAA,IAAIqD,SAAS,SAAA,EAAW;AACtB,oBAAA,OAAOtF,IAAImG,QAAQ,EAAA;AACzB,gBAAA;AAEI,gBAAA,IAAI,CAACnG,GAAAA,CAAIE,KAAK,CAACH,IAAI,EAAE;oBACnB,OAAOC,GAAAA,CAAIuG,YAAY,CAAC,wBAAA,CAAA;AAC9B,gBAAA;AAEI,gBAAA,MAAM/C,gBAAAA,GAAmBxD,GAAAA,CAAIE,KAAK,CAACuD,OAAO,EAAE9B,EAAAA;AAC5C,gBAAA,MAAMuF,QAAAA,GAAW,MAAM9G,OAAAA,CACpBoB,cAAc,CAAC,mBAAA,CAAA,CACf2F,YAAY,CAACzF,MAAAA,CAAO1B,GAAAA,CAAIE,KAAK,CAACH,IAAI,CAAC4B,EAAE,CAAA,CAAA;gBAExC,MAAMyF,IAAAA,GAAOvH,uBACXqH,QAAAA,CAASG,GAAG,CAAC,CAAC5D,OAAAA,GAAY7D,qBAAqB6D,OAAAA,EAASD,gBAAAA,CAAAA,CAAAA,CAAAA;gBAG1D,OAAOxD,GAAAA,CAAI8C,IAAI,CAAC;AAAEsE,oBAAAA;;AACtB,YAAA,CAAA;AACE,YAAA,MAAME,eAActH,GAAG,EAAA;AACrB,gBAAA,MAAMsF,OAAOlF,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,yCAAA,EAA2C,gBAAA,CAAA;AAC1E,gBAAA,IAAIqD,SAAS,SAAA,EAAW;AACtB,oBAAA,OAAOtF,IAAImG,QAAQ,EAAA;AACzB,gBAAA;AAEI,gBAAA,IAAI,CAACnG,GAAAA,CAAIE,KAAK,CAACH,IAAI,EAAE;oBACnB,OAAOC,GAAAA,CAAIuG,YAAY,CAAC,wBAAA,CAAA;AAC9B,gBAAA;AAEI,gBAAA,MAAM,EAAE1C,SAAS,EAAE,GAAG7D,IAAIiE,MAAM;AAChC,gBAAA,MAAMsD,OAAAA,GAAU,MAAMnH,OAAAA,CACnBoB,cAAc,CAAC,mBAAA,CAAA,CACfsC,iBAAiB,CAACpC,MAAAA,CAAO1B,IAAIE,KAAK,CAACH,IAAI,CAAC4B,EAAE,CAAA,EAAGkC,SAAAA,CAAAA;AAEhD,gBAAA,IAAI,CAAC0D,OAAAA,EAAS;oBACZ,OAAOvH,GAAAA,CAAImG,QAAQ,CAAC,mBAAA,CAAA;AAC1B,gBAAA;gBAEI,OAAOnG,GAAAA,CAAI8C,IAAI,CAAC;AAAEsE,oBAAAA,IAAAA,EAAM;AAAE,iBAAA,CAAA;AAC9B,YAAA,CAAA;YACE,MAAM5B,OAAAA,CAAAA,CAAQxF,GAAG,EAAEwH,IAAI,EAAA;AACrB,gBAAA,MAAMC,SAAAA,GAAY,MAAMrH,OAAAA,CACrB8D,KAAK,CAAC;oBAAE5C,IAAAA,EAAM,QAAA;oBAAUiB,IAAAA,EAAM,mBAAA;oBAAqB6B,GAAAA,EAAK;AAAO,iBAAA,CAAA,CAC/DnC,GAAG,EAAA;gBAEN,MAAM,CAACyF,YAAY,GAAG1H,GAAAA,CAAIgB,OAAO,CAAC2G,GAAG,CAACC,KAAK,CAAC,GAAA,CAAA;AAC5C,gBAAA,MAAM5D,QAAAA,GAAW0D,WAAAA,CAAYE,KAAK,CAAC,WAAA,CAAY,CAAC,CAAA,CAAE,CAACA,KAAK,CAAC,GAAA,CAAI,CAAC,CAAA,CAAE;AAEhE,gBAAA,IAAI,CAACzJ,CAAAA,CAAE8D,GAAG,CAACwF,SAAAA,EAAW;AAACzD,oBAAAA,QAAAA;AAAU,oBAAA;iBAAU,CAAA,EAAG;AAC5C,oBAAA,MAAM,IAAIzE,gBAAAA,CAAiB,2BAAA,CAAA;AACjC,gBAAA;gBAEI,IAAI,CAACa,OAAAA,CAAO4B,MAAM,CAAC6F,MAAM,CAACF,GAAG,CAACG,UAAU,CAAC,MAAA,CAAA,EAAS;oBAChD1H,OAAAA,CAAOuG,GAAG,CAACoB,IAAI,CACb,6NAAA,CAAA;AAER,gBAAA;AAEI,gBAAA,MAAMC,mBAAAA,GAAsB7J,CAAAA,CAAE8D,GAAG,CAACjC,GAAAA,EAAK,gBAAA,CAAA;AACvC,gBAAA,MAAMiI,sBAAAA,GAAyB9J,CAAAA,CAAE8D,GAAG,CAACjC,GAAAA,EAAK,gCAAA,CAAA;AAC1C,gBAAA,MAAMkI,iBAAiBF,mBAAAA,IAAuBC,sBAAAA;AAE9C,gBAAA,IAAIC,mBAAmBrH,SAAAA,EAAW;oBAChC,IAAI;wBACF,MAAM,EAAEsH,QAAAA,EAAUC,gBAAgB,EAAE,GAAGhI,QACpCiI,MAAM,CAAC,mBAAA,CAAA,CACPrG,MAAM,CAAC,UAAA,CAAA;AAEV,wBAAA,MAAMoG,gBAAAA,CAAiBF,cAAAA,EAAgBT,SAAS,CAACzD,QAAAA,CAAS,CAAA;;AAG1DhE,wBAAAA,GAAAA,CAAIyD,OAAO,GAAGzD,GAAAA,CAAIyD,OAAO,IAAI,EAAA;wBAC7BzD,GAAAA,CAAIyD,OAAO,CAAC6E,KAAK,GAAGtI,IAAIyD,OAAO,CAAC6E,KAAK,IAAI,EAAA;AACzCtI,wBAAAA,GAAAA,CAAIyD,OAAO,CAAC6E,KAAK,CAACC,OAAO,GAAG;AAC1B,4BAAA,GAAGvI,GAAAA,CAAIyD,OAAO,CAAC6E,KAAK,CAACC,OAAO;4BAC5BxE,QAAAA,EAAUmE;AACpB,yBAAA;wBACQlI,GAAAA,CAAIE,KAAK,CAACsI,YAAY,GAAG;4BAAEzE,QAAAA,EAAUmE;AAAc,yBAAA;AAC3D,oBAAA,CAAA,CAAQ,OAAM;wBACN,MAAM,IAAI1I,gBAAgB,+BAAA,EAAiC;4BAAEuE,QAAAA,EAAUmE;AAAc,yBAAA,CAAA;AAC7F,oBAAA;AACA,gBAAA;gBAEI,MAAM,EAAEO,4BAA4B,EAAE,GAAGC,iBAAAA,EAAAA;AACzC,gBAAA,MAAMF,YAAAA,GAAeC,4BAAAA,EAAAA;AAErB,gBAAA,OAAOD,aAAaxI,GAAAA,EAAKwH,IAAAA,CAAAA;AAC7B,YAAA,CAAA;AAEE,YAAA,MAAMmB,gBAAe3I,GAAG,EAAA;gBACtB,MAAM,EAAE4E,KAAK,EAAE,GAAG,MAAM1F,0BAAAA,CAA2Bc,GAAAA,CAAIgB,OAAO,CAACI,IAAI,CAAA;AAEnE,gBAAA,MAAMwH,WAAAA,GAAc,MAAMxI,OAAAA,CAAO8D,KAAK,CAAC;oBAAE5C,IAAAA,EAAM,QAAA;oBAAUiB,IAAAA,EAAM;;AAE/D,gBAAA,MAAMsG,aAAAA,GAAgB,MAAMD,WAAAA,CAAY3G,GAAG,CAAC;oBAAEmC,GAAAA,EAAK;;AACnD,gBAAA,MAAMc,gBAAAA,GAAmB,MAAM0D,WAAAA,CAAY3G,GAAG,CAAC;oBAAEmC,GAAAA,EAAK;;;gBAGtD,MAAMrE,IAAAA,GAAO,MAAMK,OAAAA,CAAOmE,EAAA,CACvBC,KAAK,CAAC,gCAAA,CAAA,CACNC,OAAO,CAAC;oBAAEC,KAAAA,EAAO;AAAEE,wBAAAA,KAAAA,EAAOA,MAAMC,WAAW;AAAE;;AAEhD,gBAAA,IAAI,CAAC9E,IAAAA,IAAQA,IAAAA,CAAKsF,OAAO,EAAE;oBACzB,OAAOrF,GAAAA,CAAI8C,IAAI,CAAC;wBAAEkE,EAAAA,EAAI;AAAI,qBAAA,CAAA;AAChC,gBAAA;;gBAGI,MAAM8B,QAAAA,GAAW,MAAMhJ,YAAAA,CAAaC,IAAAA,EAAMC,GAAAA,CAAAA;AAE1C,gBAAA,MAAMkG,qBAAqBjI,MAAAA,CAAO8K,WAAW,CAAC,EAAA,CAAA,CAAIC,QAAQ,CAAC,KAAA,CAAA;AAE3D,gBAAA,MAAMC,wBAAwB9K,CAAAA,CAAE8D,GAAG,CAAC4G,aAAAA,EAAe,0BAA0B,EAAA,CAAA;gBAC7E,MAAMK,SAAAA,GAAY,MAAMvK,UAAAA,CAAW,mBAAA,CAAA,CAAqBwK,QAAQ,CAC9DF,qBAAAA,CAAsBvD,OAAO,EAC7B;AACE0D,oBAAAA,GAAAA,EAAKlE,iBAAiBmE,oBAAoB;AAC1CC,oBAAAA,UAAAA,EAAYlJ,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,oBAAA,CAAA;AAC9BsH,oBAAAA,SAAAA,EAAWnJ,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,mBAAA,CAAA;oBAC7BuH,IAAAA,EAAMV,QAAAA;oBACNW,KAAAA,EAAOvD;AACf,iBAAA,CAAA;gBAGI,MAAMwD,WAAAA,GAAc,MAAM/K,UAAAA,CAAW,mBAAA,CAAA,CAAqBwK,QAAQ,CAChEF,qBAAAA,CAAsBU,MAAM,EAC5B;oBACEH,IAAAA,EAAMV;AACd,iBAAA,CAAA;AAGI,gBAAA,MAAMc,WAAAA,GAAc;AAClBC,oBAAAA,EAAAA,EAAI9J,KAAK6E,KAAK;oBACdkF,IAAAA,EACEb,qBAAAA,CAAsBa,IAAI,CAAClF,KAAK,IAAIqE,sBAAsBa,IAAI,CAACvH,IAAA,GAC3D,CAAA,EAAG0G,qBAAAA,CAAsBa,IAAI,CAACvH,IAAI,CAAC,EAAE,EAAE0G,qBAAAA,CAAsBa,IAAI,CAAClF,KAAK,CAAC,CAAC,CAAA,GACzE/D,SAAAA;AACNkJ,oBAAAA,OAAAA,EAASd,sBAAsBe,cAAc;oBAC7CC,OAAAA,EAASP,WAAAA;oBACTQ,IAAAA,EAAMhB,SAAAA;oBACNiB,IAAAA,EAAMjB;AACZ,iBAAA;;AAGI,gBAAA,MAAMvK,WAAW,MAAA,CAAA,CAAQmH,IAAI,CAAC/F,IAAAA,CAAK4B,EAAE,EAAE;AAAEuE,oBAAAA;;;gBAGzC,MAAM9F,OAAAA,CAAOiI,MAAM,CAAC,OAAA,CAAA,CAAS+B,OAAO,CAAC,OAAA,CAAA,CAAStH,IAAI,CAAC8G,WAAAA,CAAAA;AAEnD5J,gBAAAA,GAAAA,CAAI8C,IAAI,CAAC;oBAAEkE,EAAAA,EAAI;AAAI,iBAAA,CAAA;AACvB,YAAA,CAAA;AAEE,YAAA,MAAMqD,UAASrK,GAAG,EAAA;AAChB,gBAAA,MAAM4I,WAAAA,GAAc,MAAMxI,OAAAA,CAAO8D,KAAK,CAAC;oBAAE5C,IAAAA,EAAM,QAAA;oBAAUiB,IAAAA,EAAM;;AAE/D,gBAAA,MAAM+H,QAAAA,GAAW,MAAM1B,WAAAA,CAAY3G,GAAG,CAAC;oBAAEmC,GAAAA,EAAK;;gBAE9C,IAAI,CAACkG,QAAAA,CAASC,cAAc,EAAE;AAC5B,oBAAA,MAAM,IAAIhL,gBAAAA,CAAiB,uCAAA,CAAA;AACjC,gBAAA;gBAEI,MAAM,EAAE8K,QAAQ,EAAE,GAAGjK,QAAO4B,MAAM,CAACC,GAAG,CAAC,2BAAA,CAAA;AACvC,gBAAA,MAAMuI,iBAAAA,GAAoB;AAAC,oBAAA,UAAA;AAAY,oBAAA,UAAA;AAAY,oBAAA;AAAQ,iBAAA;;gBAG3D,MAAMC,WAAAA,GAAcnM,OAAAA,CAClBD,MAAAA,CAAOmM,iBAAAA,EAAmBjM,OAAAA,CAAQ8L,UAAUK,aAAAA,CAAAA,GAAiBL,QAAAA,CAASK,aAAa,GAAG,EAAE,CAAA,CAAA;;AAI1F,gBAAA,MAAMC,cAAcC,MAAAA,CAAOC,IAAI,CAAC7K,GAAAA,CAAIgB,OAAO,CAACI,IAAI,CAAA,CAAE0J,MAAM,CAAC,CAAC1G,GAAAA,GAAQ,CAACqG,WAAAA,CAAYM,QAAQ,CAAC3G,GAAAA,CAAAA,CAAAA;gBAExF,IAAIuG,WAAAA,CAAY/J,MAAM,GAAG,CAAA,EAAG;;oBAE1B,MAAM,IAAIpB,gBAAgB,CAAC,oBAAoB,EAAEmL,WAAAA,CAAYK,IAAI,CAAC,IAAA,CAAA,CAAA,CAAO,CAAA;AAC/E,gBAAA;AAEI,gBAAA,MAAM/G,MAAAA,GAAS;oBACb,GAAG9F,CAAAA,CAAE8M,IAAI,CAACjL,GAAAA,CAAIgB,OAAO,CAACI,IAAI,EAAEqJ,WAAAA,CAAY;oBACxCzG,QAAAA,EAAU;AAChB,iBAAA;AAEI,gBAAA,MAAM4B,WAAAA,GAAcxF,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,2CAAA,CAAA;AAEtC,gBAAA,MAAMjD,qBAAqBiF,MAAAA,EAAQ2B,WAAAA,CAAAA;gBAEnC,MAAMsF,IAAAA,GAAO,MAAM9K,OAAAA,CAAOmE,EAAA,CACvBC,KAAK,CAAC,gCAAA,CAAA,CACNC,OAAO,CAAC;oBAAEC,KAAAA,EAAO;AAAEpD,wBAAAA,IAAAA,EAAMgJ,SAASa;AAAY;;AAEjD,gBAAA,IAAI,CAACD,IAAAA,EAAM;AACT,oBAAA,MAAM,IAAI3L,gBAAAA,CAAiB,qCAAA,CAAA;AACjC,gBAAA;AAEI,gBAAA,MAAM,EAAEqF,KAAK,EAAEE,QAAQ,EAAEd,QAAQ,EAAE,GAAGC,MAAAA;AAEtC,gBAAA,MAAMmH,gBAAAA,GAAmB;oBACvBzG,GAAAA,EAAK;AACH,wBAAA;AAAEC,4BAAAA,KAAAA,EAAOA,MAAMC,WAAW;AAAE,yBAAA;AAC5B,wBAAA;AAAEC,4BAAAA,QAAAA,EAAUF,MAAMC,WAAW;AAAE,yBAAA;AAC/B,wBAAA;AAAEC,4BAAAA;AAAQ,yBAAA;AACV,wBAAA;4BAAEF,KAAAA,EAAOE;AAAQ;AAClB;AACP,iBAAA;gBAEI,MAAMuG,oBAAAA,GAAuB,MAAMjL,OAAAA,CAAOmE,EAAE,CAACC,KAAK,CAAC,gCAAA,CAAA,CAAkC8G,KAAK,CAAC;oBACzF5G,KAAAA,EAAO;AAAE,wBAAA,GAAG0G,gBAAgB;AAAEpH,wBAAAA;AAAQ;AAC5C,iBAAA,CAAA;AAEI,gBAAA,IAAIqH,uBAAuB,CAAA,EAAG;AAC5B,oBAAA,MAAM,IAAI9L,gBAAAA,CAAiB,qCAAA,CAAA;AACjC,gBAAA;gBAEI,IAAI+K,QAAAA,CAASiB,YAAY,EAAE;oBACzB,MAAMF,oBAAAA,GAAuB,MAAMjL,OAAAA,CAAOmE,EAAE,CAACC,KAAK,CAAC,gCAAA,CAAA,CAAkC8G,KAAK,CAAC;wBACzF5G,KAAAA,EAAO;AAAE,4BAAA,GAAG0G;AAAgB;AACpC,qBAAA,CAAA;AAEM,oBAAA,IAAIC,uBAAuB,CAAA,EAAG;AAC5B,wBAAA,MAAM,IAAI9L,gBAAAA,CAAiB,qCAAA,CAAA;AACnC,oBAAA;AACA,gBAAA;AAEI,gBAAA,MAAMiM,OAAAA,GAAU;AACd,oBAAA,GAAGvH,MAAM;AACTiH,oBAAAA,IAAAA,EAAMA,KAAKvJ,EAAE;AACbiD,oBAAAA,KAAAA,EAAOA,MAAMC,WAAW,EAAA;AACxBC,oBAAAA,QAAAA;oBACAM,SAAAA,EAAW,CAACkF,SAASmB;AAC3B,iBAAA;AAEI,gBAAA,MAAM1L,IAAAA,GAAO,MAAMpB,UAAAA,CAAW,MAAA,CAAA,CAAQ+M,GAAG,CAACF,OAAAA,CAAAA;gBAE1C,MAAMG,aAAAA,GAAgB,MAAM7L,YAAAA,CAAaC,IAAAA,EAAMC,GAAAA,CAAAA;gBAE/C,IAAIsK,QAAAA,CAASmB,kBAAkB,EAAE;oBAC/B,IAAI;wBACF,MAAM9M,UAAAA,CAAW,MAAA,CAAA,CAAQiN,qBAAqB,CAACD,aAAAA,CAAAA;AACvD,oBAAA,CAAA,CAAQ,OAAOjF,GAAAA,EAAK;wBACZtG,OAAAA,CAAOuG,GAAG,CAAClB,KAAK,CAACiB,GAAAA,CAAAA;AACjB,wBAAA,MAAM,IAAInH,gBAAAA,CAAiB,kCAAA,CAAA;AACnC,oBAAA;oBAEM,OAAOS,GAAAA,CAAI8C,IAAI,CAAC;wBAAE/C,IAAAA,EAAM4L;AAAa,qBAAA,CAAA;AAC3C,gBAAA;AAEI,gBAAA,MAAMrG,OAAOlF,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,yCAAA,EAA2C,gBAAA,CAAA;AAC1E,gBAAA,IAAIqD,SAAS,SAAA,EAAW;oBACtB,MAAM3E,QAAAA,GAAWF,gBAAgBT,GAAAA,CAAIgB,OAAO,CAACI,IAAI,CAAA,IAAKnD,OAAOmF,UAAU,EAAA;AAEvE,oBAAA,MAAM7B,OAAAA,GAAU,MAAMnB,OAAAA,CACnBoB,cAAc,CAAC,mBAAA,CAAA,CACfC,oBAAoB,CAACC,MAAAA,CAAO3B,IAAAA,CAAK4B,EAAE,CAAA,EAAGhB,QAAAA,EAAU;wBAC/CW,IAAAA,EAAM,SAAA;AACNH,wBAAAA,QAAAA,EAAUL,+BAAAA,CAAgCd,GAAAA;AACpD,qBAAA,CAAA;oBAEM,MAAM4B,MAAAA,GAAS,MAAMxB,OAAAA,CAClBoB,cAAc,CAAC,mBAAA,CAAA,CACfK,mBAAmB,CAACN,OAAAA,CAAQO,KAAK,CAAA;AACpC,oBAAA,IAAI,WAAWF,MAAAA,EAAQ;AACrB,wBAAA,MAAM,IAAIrC,gBAAAA,CAAiB,qBAAA,CAAA;AACnC,oBAAA;oBAEM,OAAOS,GAAAA,CAAI8C,IAAI,CAAC;AAAEC,wBAAAA,GAAAA,EAAKnB,OAAOE,KAAK;AAAEkB,wBAAAA,YAAAA,EAAczB,QAAQO,KAAK;wBAAE/B,IAAAA,EAAM4L;AAAa,qBAAA,CAAA;AAC3F,gBAAA;gBAEI,MAAM5I,GAAAA,GAAMpE,WAAW,KAAA,CAAA,CAAO4G,KAAK,CAACpH,CAAAA,CAAE8M,IAAI,CAAClL,IAAAA,EAAM;AAAC,oBAAA;AAAK,iBAAA,CAAA,CAAA;gBACvD,OAAOC,GAAAA,CAAI8C,IAAI,CAAC;AAAEC,oBAAAA,GAAAA;oBAAKhD,IAAAA,EAAM4L;AAAa,iBAAA,CAAA;AAC9C,YAAA,CAAA;AAEE,YAAA,MAAME,iBAAAA,CAAAA,CAAkB7L,GAAG,EAAEwH,IAAI,EAAEsE,UAAU,EAAA;gBAC3C,MAAM,EAAEC,cAAcC,iBAAiB,EAAE,GAAG,MAAM5M,6BAAAA,CAA8BY,IAAIwE,KAAK,CAAA;AAEzF,gBAAA,MAAMyH,cAActN,UAAAA,CAAW,MAAA,CAAA;AAC/B,gBAAA,MAAMuN,aAAavN,UAAAA,CAAW,KAAA,CAAA;AAE9B,gBAAA,MAAM,CAACoB,IAAAA,CAAK,GAAG,MAAMkM,WAAAA,CAAYE,QAAQ,CAAC;oBAAEC,OAAAA,EAAS;AAAEJ,wBAAAA;AAAiB;;AAExE,gBAAA,IAAI,CAACjM,IAAAA,EAAM;AACT,oBAAA,MAAM,IAAIP,eAAAA,CAAgB,eAAA,CAAA;AAChC,gBAAA;AAEI,gBAAA,MAAMyM,WAAAA,CAAYnG,IAAI,CAAC/F,IAAAA,CAAK4B,EAAE,EAAE;oBAAEyD,SAAAA,EAAW,IAAA;oBAAM4G,iBAAAA,EAAmB;;AAEtE,gBAAA,IAAIF,UAAAA,EAAY;AACd9L,oBAAAA,GAAAA,CAAI8C,IAAI,CAAC;wBACPC,GAAAA,EAAKmJ,UAAAA,CAAW3G,KAAK,CAAC;AAAE5D,4BAAAA,EAAAA,EAAI5B,KAAK4B;;wBACjC5B,IAAAA,EAAM,MAAMD,aAAaC,IAAAA,EAAMC,GAAAA;AACvC,qBAAA,CAAA;gBACA,CAAA,MAAW;AACL,oBAAA,MAAMsK,QAAAA,GAAW,MAAMlK,OAAAA,CACpB8D,KAAK,CAAC;wBAAE5C,IAAAA,EAAM,QAAA;wBAAUiB,IAAAA,EAAM,mBAAA;wBAAqB6B,GAAAA,EAAK;AAAU,qBAAA,CAAA,CAClEnC,GAAG,EAAA;AAENjC,oBAAAA,GAAAA,CAAIqM,QAAQ,CAAC/B,QAAAA,CAASgC,8BAA8B,IAAI,GAAA,CAAA;AAC9D,gBAAA;AACA,YAAA,CAAA;AAEE,YAAA,MAAMC,uBAAsBvM,GAAG,EAAA;gBAC7B,MAAM,EAAE4E,KAAK,EAAE,GAAG,MAAM3F,iCAAAA,CAAkCe,GAAAA,CAAIgB,OAAO,CAACI,IAAI,CAAA;gBAE1E,MAAMrB,IAAAA,GAAO,MAAMK,OAAAA,CAAOmE,EAAE,CAACC,KAAK,CAAC,gCAAA,CAAA,CAAkCC,OAAO,CAAC;oBAC3EC,KAAAA,EAAO;AAAEE,wBAAAA,KAAAA,EAAOA,MAAMC,WAAW;AAAE;AACzC,iBAAA,CAAA;AAEI,gBAAA,IAAI,CAAC9E,IAAAA,EAAM;oBACT,OAAOC,GAAAA,CAAI8C,IAAI,CAAC;AAAE8B,wBAAAA,KAAAA;wBAAO4H,IAAAA,EAAM;AAAI,qBAAA,CAAA;AACzC,gBAAA;gBAEI,IAAIzM,IAAAA,CAAKqF,SAAS,EAAE;AAClB,oBAAA,MAAM,IAAI7F,gBAAAA,CAAiB,mBAAA,CAAA;AACjC,gBAAA;gBAEI,IAAIQ,IAAAA,CAAKsF,OAAO,EAAE;AAChB,oBAAA,MAAM,IAAI9F,gBAAAA,CAAiB,cAAA,CAAA;AACjC,gBAAA;gBAEI,MAAMZ,UAAAA,CAAW,MAAA,CAAA,CAAQiN,qBAAqB,CAAC7L,IAAAA,CAAAA;AAE/CC,gBAAAA,GAAAA,CAAI8C,IAAI,CAAC;AACP8B,oBAAAA,KAAAA,EAAO7E,KAAK6E,KAAK;oBACjB4H,IAAAA,EAAM;AACZ,iBAAA,CAAA;AACA,YAAA;SACA,CAAA;;;;;;"}
1	+ {"version":3,"file":"auth.js","sources":["../../../server/src/controllers/auth.js"],"sourcesContent":["'use strict';\n\n/*\n Auth.js controller\n \n @description: A set of functions called \"actions\" for managing `Auth`.\n /\n\n/ eslint-disable no-useless-escape */\nconst crypto = require('crypto');\nconst _ = require('lodash');\nconst { concat, compact, isArray } = require('lodash/fp');\nconst utils = require('@strapi/utils');\nconst { getService } = require('../utils');\nconst { buildRefreshCookieOptions } = require('../utils/refresh-cookie-options');\nconst {\n validateCallbackBody,\n validateRegisterBody,\n validateSendEmailConfirmationBody,\n validateForgotPasswordBody,\n validateResetPasswordBody,\n validateEmailConfirmationBody,\n validateChangePasswordBody,\n} = require('./validation/auth');\n\nconst { ApplicationError, ValidationError, ForbiddenError } = utils.errors;\nconst { buildSessionMetadata, sanitizeSessionEntry, sortSessionsForDisplay } = utils;\n\nconst sanitizeUser = (user, ctx) => {\n const { auth } = ctx.state;\n const userSchema = strapi.getModel('plugin::users-permissions.user');\n\n return strapi.contentAPI.sanitize.output(user, userSchema, { auth });\n};\n\nconst extractDeviceId = (requestBody) => {\n const { deviceId } = requestBody \|\| {};\n\n return typeof deviceId === 'string' && deviceId.length > 0 ? deviceId : undefined;\n};\n\nconst buildSessionMetadataFromContext = (ctx) =>\n buildSessionMetadata({\n userAgent: ctx.request.headers['user-agent'],\n });\n\nconst sendRefreshAuthResponse = async (strapi, ctx, user, { metadata } = {}) => {\n const deviceId = extractDeviceId(ctx.request.body);\n const tokenOptions = { type: 'refresh', ...(metadata ? { metadata } : {}) };\n\n const refresh = await strapi\n .sessionManager('users-permissions')\n .generateRefreshToken(String(user.id), deviceId, tokenOptions);\n\n const access = await strapi\n .sessionManager('users-permissions')\n .generateAccessToken(refresh.token);\n if ('error' in access) {\n throw new ApplicationError('Invalid credentials');\n }\n\n const upSessions = strapi.config.get('plugin::users-permissions.sessions');\n const requestHttpOnly = ctx.request.header['x-strapi-refresh-cookie'] === 'httpOnly';\n\n if (upSessions?.httpOnly \|\| requestHttpOnly) {\n const cookieName = upSessions.cookie?.name \|\| 'strapi_up_refresh';\n const isProduction = process.env.NODE_ENV === 'production';\n ctx.cookies.set(cookieName, refresh.token, buildRefreshCookieOptions(upSessions, isProduction));\n return ctx.send({ jwt: access.token, user: await sanitizeUser(user, ctx) });\n }\n\n return ctx.send({\n jwt: access.token,\n refreshToken: refresh.token,\n user: await sanitizeUser(user, ctx),\n });\n};\n\nconst reissueTokensAfterPasswordChange = async (strapi, ctx, user) => {\n const deviceId = extractDeviceId(ctx.request.body);\n\n await strapi.sessionManager('users-permissions').invalidateRefreshToken(String(user.id));\n\n const newDeviceId = deviceId \|\| crypto.randomUUID();\n const refresh = await strapi\n .sessionManager('users-permissions')\n .generateRefreshToken(String(user.id), newDeviceId, { type: 'refresh' });\n\n const access = await strapi\n .sessionManager('users-permissions')\n .generateAccessToken(refresh.token);\n if ('error' in access) {\n throw new ApplicationError('Invalid credentials');\n }\n\n return ctx.send({\n jwt: access.token,\n refreshToken: refresh.token,\n user: await sanitizeUser(user, ctx),\n });\n};\n\nconst revokeLogoutSessions = async (strapi, ctx, userId, { scope, deviceId, body }) => {\n const sessionManager = strapi.sessionManager('users-permissions');\n const upSessions = strapi.config.get('plugin::users-permissions.sessions');\n\n if (scope === 'all') {\n await sessionManager.invalidateRefreshToken(userId);\n return;\n }\n\n if (deviceId) {\n await sessionManager.invalidateRefreshToken(userId, deviceId);\n return;\n }\n\n let currentSessionId = ctx.state.session?.id;\n const cookieName = upSessions?.cookie?.name \|\| 'strapi_up_refresh';\n const refreshToken =\n ctx.cookies.get(cookieName) \|\|\n (typeof body.refreshToken === 'string' ? body.refreshToken : undefined);\n\n if (refreshToken) {\n const validation = await sessionManager.validateRefreshToken(refreshToken);\n if (validation.isValid) {\n currentSessionId = validation.sessionId;\n }\n }\n\n if (currentSessionId) {\n await sessionManager.revokeSessionById(userId, currentSessionId);\n return;\n }\n\n await sessionManager.invalidateRefreshToken(userId);\n};\n\nmodule.exports = ({ strapi }) => ({\n async callback(ctx) {\n const provider = ctx.params.provider \|\| 'local';\n const params = ctx.request.body;\n\n const store = strapi.store({ type: 'plugin', name: 'users-permissions' });\n const grantSettings = await store.get({ key: 'grant' });\n\n const grantProvider = provider === 'local' ? 'email' : provider;\n\n if (!_.get(grantSettings, [grantProvider, 'enabled'])) {\n throw new ApplicationError('This provider is disabled');\n }\n\n if (provider === 'local') {\n await validateCallbackBody(params);\n\n const { identifier } = params;\n\n // Check if the user exists.\n const user = await strapi.db.query('plugin::users-permissions.user').findOne({\n where: {\n provider,\n $or: [{ email: identifier.toLowerCase() }, { username: identifier }],\n },\n });\n\n if (!user) {\n throw new ValidationError('Invalid identifier or password');\n }\n\n if (!user.password) {\n throw new ValidationError('Invalid identifier or password');\n }\n\n const validPassword = await getService('user').validatePassword(\n params.password,\n user.password\n );\n\n if (!validPassword) {\n throw new ValidationError('Invalid identifier or password');\n }\n\n const advancedSettings = await store.get({ key: 'advanced' });\n const requiresConfirmation = _.get(advancedSettings, 'email_confirmation');\n\n if (requiresConfirmation && user.confirmed !== true) {\n throw new ApplicationError('Your account email is not confirmed');\n }\n\n if (user.blocked === true) {\n throw new ApplicationError('Your account has been blocked by an administrator');\n }\n\n const mode = strapi.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');\n if (mode === 'refresh') {\n return sendRefreshAuthResponse(strapi, ctx, user, {\n metadata: buildSessionMetadataFromContext(ctx),\n });\n }\n\n return ctx.send({\n jwt: getService('jwt').issue({ id: user.id }),\n user: await sanitizeUser(user, ctx),\n });\n }\n\n // Connect the user with the third-party provider.\n try {\n const user = await getService('providers').connect(provider, ctx.query);\n\n if (user.blocked) {\n throw new ForbiddenError('Your account has been blocked by an administrator');\n }\n\n const mode = strapi.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');\n if (mode === 'refresh') {\n return sendRefreshAuthResponse(strapi, ctx, user, {\n metadata: buildSessionMetadataFromContext(ctx),\n });\n }\n\n return ctx.send({\n jwt: getService('jwt').issue({ id: user.id }),\n user: await sanitizeUser(user, ctx),\n });\n } catch (error) {\n throw new ApplicationError(error.message);\n }\n },\n\n async changePassword(ctx) {\n if (!ctx.state.user) {\n throw new ApplicationError('You must be authenticated to reset your password');\n }\n\n const validations = strapi.config.get('plugin::users-permissions.validationRules');\n\n const { currentPassword, password } = await validateChangePasswordBody(\n ctx.request.body,\n validations\n );\n\n const user = await strapi.db\n .query('plugin::users-permissions.user')\n .findOne({ where: { id: ctx.state.user.id } });\n\n const validPassword = await getService('user').validatePassword(currentPassword, user.password);\n\n if (!validPassword) {\n throw new ValidationError('The provided current password is invalid');\n }\n\n if (currentPassword === password) {\n throw new ValidationError('Your new password must be different than your current password');\n }\n\n await getService('user').edit(user.id, { password });\n\n const mode = strapi.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');\n if (mode === 'refresh') {\n return reissueTokensAfterPasswordChange(strapi, ctx, user);\n }\n\n return ctx.send({\n jwt: getService('jwt').issue({ id: user.id }),\n user: await sanitizeUser(user, ctx),\n });\n },\n\n async resetPassword(ctx) {\n const validations = strapi.config.get('plugin::users-permissions.validationRules');\n\n const { password, passwordConfirmation, code } = await validateResetPasswordBody(\n ctx.request.body,\n validations\n );\n\n if (password !== passwordConfirmation) {\n throw new ValidationError('Passwords do not match');\n }\n\n const user = await strapi.db\n .query('plugin::users-permissions.user')\n .findOne({ where: { resetPasswordToken: code } });\n\n if (!user) {\n throw new ValidationError('Incorrect code provided');\n }\n\n await getService('user').edit(user.id, {\n resetPasswordToken: null,\n password,\n });\n\n const mode = strapi.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');\n if (mode === 'refresh') {\n return reissueTokensAfterPasswordChange(strapi, ctx, user);\n }\n\n return ctx.send({\n jwt: getService('jwt').issue({ id: user.id }),\n user: await sanitizeUser(user, ctx),\n });\n },\n async refresh(ctx) {\n const mode = strapi.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');\n if (mode !== 'refresh') {\n return ctx.notFound();\n }\n\n const upSessions = strapi.config.get('plugin::users-permissions.sessions');\n const cookieName = upSessions?.cookie?.name \|\| 'strapi_up_refresh';\n\n // Check for refresh token in cookie first (if httpOnly is configured), then in body\n let refreshToken = ctx.cookies.get(cookieName);\n if (!refreshToken) {\n refreshToken = ctx.request.body?.refreshToken;\n }\n\n if (!refreshToken \|\| typeof refreshToken !== 'string') {\n return ctx.badRequest('Missing refresh token');\n }\n\n const rotation = await strapi\n .sessionManager('users-permissions')\n .rotateRefreshToken(refreshToken);\n if ('error' in rotation) {\n return ctx.unauthorized('Invalid refresh token');\n }\n\n const result = await strapi\n .sessionManager('users-permissions')\n .generateAccessToken(rotation.token);\n if ('error' in result) {\n return ctx.unauthorized('Invalid refresh token');\n }\n\n const requestHttpOnly = ctx.request.header['x-strapi-refresh-cookie'] === 'httpOnly';\n if (upSessions?.httpOnly \|\| requestHttpOnly) {\n const isProduction = process.env.NODE_ENV === 'production';\n ctx.cookies.set(\n cookieName,\n rotation.token,\n buildRefreshCookieOptions(upSessions, isProduction)\n );\n return ctx.send({ jwt: result.token });\n }\n return ctx.send({ jwt: result.token, refreshToken: rotation.token });\n },\n async logout(ctx) {\n const mode = strapi.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');\n if (mode !== 'refresh') {\n return ctx.notFound();\n }\n\n if (!ctx.state.user) {\n return ctx.unauthorized('Missing authentication');\n }\n\n const userId = String(ctx.state.user.id);\n const upSessions = strapi.config.get('plugin::users-permissions.sessions');\n const body = ctx.request.body \|\| {};\n const scope = typeof body.scope === 'string' ? body.scope : undefined;\n const deviceId = extractDeviceId(body);\n\n try {\n await revokeLogoutSessions(strapi, ctx, userId, { scope, deviceId, body });\n } catch (err) {\n strapi.log.error('UP logout failed', err);\n }\n\n const requestHttpOnly = ctx.request.header['x-strapi-refresh-cookie'] === 'httpOnly';\n if (upSessions?.httpOnly \|\| requestHttpOnly) {\n const cookieName = upSessions.cookie?.name \|\| 'strapi_up_refresh';\n const isProduction = process.env.NODE_ENV === 'production';\n\n const { maxAge: _maxAge, ...cookieOptions } = buildRefreshCookieOptions(\n upSessions,\n isProduction\n );\n\n ctx.cookies.set(cookieName, '', { ...cookieOptions, expires: new Date(0) });\n }\n return ctx.send({ ok: true });\n },\n async getSessions(ctx) {\n const mode = strapi.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');\n if (mode !== 'refresh') {\n return ctx.notFound();\n }\n\n if (!ctx.state.user) {\n return ctx.unauthorized('Missing authentication');\n }\n\n const currentSessionId = ctx.state.session?.id;\n const sessions = await strapi\n .sessionManager('users-permissions')\n .listSessions(String(ctx.state.user.id));\n\n const data = sortSessionsForDisplay(\n sessions.map((session) => sanitizeSessionEntry(session, currentSessionId))\n );\n\n return ctx.send({ data });\n },\n async revokeSession(ctx) {\n const mode = strapi.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');\n if (mode !== 'refresh') {\n return ctx.notFound();\n }\n\n if (!ctx.state.user) {\n return ctx.unauthorized('Missing authentication');\n }\n\n const { sessionId } = ctx.params;\n const revoked = await strapi\n .sessionManager('users-permissions')\n .revokeSessionById(String(ctx.state.user.id), sessionId);\n\n if (!revoked) {\n return ctx.notFound('Session not found');\n }\n\n return ctx.send({ data: {} });\n },\n async connect(ctx, next) {\n const providers = await strapi\n .store({ type: 'plugin', name: 'users-permissions', key: 'grant' })\n .get();\n\n const [requestPath] = ctx.request.url.split('?');\n const provider = requestPath.split('/connect/')[1].split('/')[0];\n\n if (!_.get(providers, [provider, 'enabled'])) {\n throw new ApplicationError('This provider is disabled');\n }\n\n if (!strapi.config.server.url.startsWith('http')) {\n strapi.log.warn(\n 'You are using a third party provider for login. Make sure to set an absolute url in config/server.js. More info here: https://docs.strapi.io/developer-docs/latest/plugins/users-permissions.html#setting-up-the-server-url'\n );\n }\n\n const queryCustomCallback = _.get(ctx, 'query.callback');\n const dynamicSessionCallback = _.get(ctx, 'session.grant.dynamic.callback');\n const customCallback = queryCustomCallback ?? dynamicSessionCallback;\n\n if (customCallback !== undefined) {\n try {\n const { validate: validateCallback } = strapi\n .plugin('users-permissions')\n .config('callback');\n\n await validateCallback(customCallback, providers[provider]);\n\n // Persist across the provider redirect round-trip (request state alone is lost).\n ctx.session = ctx.session \|\| {};\n ctx.session.grant = ctx.session.grant \|\| {};\n ctx.session.grant.dynamic = {\n ...ctx.session.grant.dynamic,\n callback: customCallback,\n };\n ctx.state.oauthConnect = { callback: customCallback };\n } catch {\n throw new ValidationError('Invalid callback URL provided', { callback: customCallback });\n }\n }\n\n const { createOAuthConnectMiddleware } = require('../utils/oauth-connect');\n const oauthConnect = createOAuthConnectMiddleware();\n\n return oauthConnect(ctx, next);\n },\n\n async forgotPassword(ctx) {\n const { email } = await validateForgotPasswordBody(ctx.request.body);\n\n const pluginStore = await strapi.store({ type: 'plugin', name: 'users-permissions' });\n\n const emailSettings = await pluginStore.get({ key: 'email' });\n const advancedSettings = await pluginStore.get({ key: 'advanced' });\n\n // Find the user by email.\n const user = await strapi.db\n .query('plugin::users-permissions.user')\n .findOne({ where: { email: email.toLowerCase() } });\n\n if (!user \|\| user.blocked) {\n return ctx.send({ ok: true });\n }\n\n // Generate random token.\n const userInfo = await sanitizeUser(user, ctx);\n\n const resetPasswordToken = crypto.randomBytes(64).toString('hex');\n\n const resetPasswordSettings = _.get(emailSettings, 'reset_password.options', {});\n const emailBody = await getService('users-permissions').template(\n resetPasswordSettings.message,\n {\n URL: advancedSettings.email_reset_password,\n SERVER_URL: strapi.config.get('server.absoluteUrl'),\n ADMIN_URL: strapi.config.get('admin.absoluteUrl'),\n USER: userInfo,\n TOKEN: resetPasswordToken,\n }\n );\n\n const emailObject = await getService('users-permissions').template(\n resetPasswordSettings.object,\n {\n USER: userInfo,\n }\n );\n\n const emailToSend = {\n to: user.email,\n from:\n resetPasswordSettings.from.email \|\| resetPasswordSettings.from.name\n ? `${resetPasswordSettings.from.name} <${resetPasswordSettings.from.email}>`\n : undefined,\n replyTo: resetPasswordSettings.response_email,\n subject: emailObject,\n text: emailBody,\n html: emailBody,\n };\n\n // NOTE: Update the user before sending the email so an Admin can generate the link if the email fails\n await getService('user').edit(user.id, { resetPasswordToken });\n\n // Send an email to the user.\n await strapi.plugin('email').service('email').send(emailToSend);\n\n ctx.send({ ok: true });\n },\n\n async register(ctx) {\n const pluginStore = await strapi.store({ type: 'plugin', name: 'users-permissions' });\n\n const settings = await pluginStore.get({ key: 'advanced' });\n\n if (!settings.allow_register) {\n throw new ApplicationError('Register action is currently disabled');\n }\n\n const { register } = strapi.config.get('plugin::users-permissions');\n const alwaysAllowedKeys = ['username', 'password', 'email'];\n\n // Note that we intentionally do not filter allowedFields to allow a project to explicitly accept private or other Strapi field on registration\n const allowedKeys = compact(\n concat(alwaysAllowedKeys, isArray(register?.allowedFields) ? register.allowedFields : [])\n );\n\n // Check if there are any keys in requestBody that are not in allowedKeys\n const invalidKeys = Object.keys(ctx.request.body).filter((key) => !allowedKeys.includes(key));\n\n if (invalidKeys.length > 0) {\n // If there are invalid keys, throw an error\n throw new ValidationError(`Invalid parameters: ${invalidKeys.join(', ')}`);\n }\n\n const params = {\n ..._.pick(ctx.request.body, allowedKeys),\n provider: 'local',\n };\n\n const validations = strapi.config.get('plugin::users-permissions.validationRules');\n\n await validateRegisterBody(params, validations);\n\n const role = await strapi.db\n .query('plugin::users-permissions.role')\n .findOne({ where: { type: settings.default_role } });\n\n if (!role) {\n throw new ApplicationError('Impossible to find the default role');\n }\n\n const { email, username, provider } = params;\n\n const identifierFilter = {\n $or: [\n { email: email.toLowerCase() },\n { username: email.toLowerCase() },\n { username },\n { email: username },\n ],\n };\n\n const conflictingUserCount = await strapi.db.query('plugin::users-permissions.user').count({\n where: { ...identifierFilter, provider },\n });\n\n if (conflictingUserCount > 0) {\n throw new ApplicationError('Email or Username are already taken');\n }\n\n if (settings.unique_email) {\n const conflictingUserCount = await strapi.db.query('plugin::users-permissions.user').count({\n where: { ...identifierFilter },\n });\n\n if (conflictingUserCount > 0) {\n throw new ApplicationError('Email or Username are already taken');\n }\n }\n\n const newUser = {\n ...params,\n role: role.id,\n email: email.toLowerCase(),\n username,\n confirmed: !settings.email_confirmation,\n };\n\n const user = await getService('user').add(newUser);\n\n const sanitizedUser = await sanitizeUser(user, ctx);\n\n if (settings.email_confirmation) {\n try {\n await getService('user').sendConfirmationEmail(sanitizedUser);\n } catch (err) {\n strapi.log.error(err);\n throw new ApplicationError('Error sending confirmation email');\n }\n\n return ctx.send({ user: sanitizedUser });\n }\n\n const mode = strapi.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');\n if (mode === 'refresh') {\n const deviceId = extractDeviceId(ctx.request.body) \|\| crypto.randomUUID();\n\n const refresh = await strapi\n .sessionManager('users-permissions')\n .generateRefreshToken(String(user.id), deviceId, {\n type: 'refresh',\n metadata: buildSessionMetadataFromContext(ctx),\n });\n\n const access = await strapi\n .sessionManager('users-permissions')\n .generateAccessToken(refresh.token);\n if ('error' in access) {\n throw new ApplicationError('Invalid credentials');\n }\n\n return ctx.send({ jwt: access.token, refreshToken: refresh.token, user: sanitizedUser });\n }\n\n const jwt = getService('jwt').issue(_.pick(user, ['id']));\n return ctx.send({ jwt, user: sanitizedUser });\n },\n\n async emailConfirmation(ctx, next, returnUser) {\n const { confirmation: confirmationToken } = await validateEmailConfirmationBody(ctx.query);\n\n const userService = getService('user');\n const jwtService = getService('jwt');\n\n const [user] = await userService.fetchAll({ filters: { confirmationToken } });\n\n if (!user) {\n throw new ValidationError('Invalid token');\n }\n\n await userService.edit(user.id, { confirmed: true, confirmationToken: null });\n\n if (returnUser) {\n ctx.send({\n jwt: jwtService.issue({ id: user.id }),\n user: await sanitizeUser(user, ctx),\n });\n } else {\n const settings = await strapi\n .store({ type: 'plugin', name: 'users-permissions', key: 'advanced' })\n .get();\n\n ctx.redirect(settings.email_confirmation_redirection \|\| '/');\n }\n },\n\n async sendEmailConfirmation(ctx) {\n const { email } = await validateSendEmailConfirmationBody(ctx.request.body);\n\n const user = await strapi.db.query('plugin::users-permissions.user').findOne({\n where: { email: email.toLowerCase() },\n });\n\n if (!user) {\n return ctx.send({ email, sent: true });\n }\n\n if (user.confirmed) {\n throw new ApplicationError('Already confirmed');\n }\n\n if (user.blocked) {\n throw new ApplicationError('User blocked');\n }\n\n await getService('user').sendConfirmationEmail(user);\n\n ctx.send({\n email: user.email,\n sent: true,\n });\n },\n});\n"],"names":["crypto","require$$0","_","require$$1","concat","compact","isArray","require$$2","utils","require$$3","getService","require$$4","buildRefreshCookieOptions","require$$5","validateCallbackBody","validateRegisterBody","validateSendEmailConfirmationBody","validateForgotPasswordBody","validateResetPasswordBody","validateEmailConfirmationBody","validateChangePasswordBody","require$$6","ApplicationError","ValidationError","ForbiddenError","errors","buildSessionMetadata","sanitizeSessionEntry","sortSessionsForDisplay","sanitizeUser","user","ctx","auth","state","userSchema","strapi","getModel","contentAPI","sanitize","output","extractDeviceId","requestBody","deviceId","length","undefined","buildSessionMetadataFromContext","userAgent","request","headers","sendRefreshAuthResponse","metadata","body","tokenOptions","type","refresh","sessionManager","generateRefreshToken","String","id","access","generateAccessToken","token","upSessions","config","get","requestHttpOnly","header","httpOnly","cookieName","cookie","name","isProduction","process","env","NODE_ENV","cookies","set","send","jwt","refreshToken","reissueTokensAfterPasswordChange","invalidateRefreshToken","newDeviceId","randomUUID","revokeLogoutSessions","userId","scope","currentSessionId","session","validation","validateRefreshToken","isValid","sessionId","revokeSessionById","callback","provider","params","store","grantSettings","key","grantProvider","identifier","db","query","findOne","where","$or","email","toLowerCase","username","password","validPassword","validatePassword","advancedSettings","requiresConfirmation","confirmed","blocked","mode","issue","connect","error","message","changePassword","validations","currentPassword","edit","resetPassword","passwordConfirmation","code","resetPasswordToken","notFound","badRequest","rotation","rotateRefreshToken","unauthorized","result","logout","err","log","maxAge","_maxAge","cookieOptions","expires","Date","ok","getSessions","sessions","listSessions","data","map","revokeSession","revoked","next","providers","requestPath","url","split","server","startsWith","warn","queryCustomCallback","dynamicSessionCallback","customCallback","validate","validateCallback","plugin","grant","dynamic","oauthConnect","createOAuthConnectMiddleware","require$$7","forgotPassword","pluginStore","emailSettings","userInfo","randomBytes","toString","resetPasswordSettings","emailBody","template","URL","email_reset_password","SERVER_URL","ADMIN_URL","USER","TOKEN","emailObject","object","emailToSend","to","from","replyTo","response_email","subject","text","html","service","register","settings","allow_register","alwaysAllowedKeys","allowedKeys","allowedFields","invalidKeys","Object","keys","filter","includes","join","pick","role","default_role","identifierFilter","conflictingUserCount","count","unique_email","newUser","email_confirmation","add","sanitizedUser","sendConfirmationEmail","emailConfirmation","returnUser","confirmation","confirmationToken","userService","jwtService","fetchAll","filters","redirect","email_confirmation_redirection","sendEmailConfirmation","sent"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAEA;;;;4CAOA,MAAMA,MAAAA,GAASC,6BAAAA;AACf,IAAA,MAAMC,CAAAA,GAAIC,6BAAAA;AACV,IAAA,MAAM,EAAEC,MAAM,EAAEC,OAAO,EAAEC,OAAO,EAAE,GAAGC,2BAAAA;AACrC,IAAA,MAAMC,KAAAA,GAAQC,2BAAAA;IACd,MAAM,EAAEC,UAAU,EAAE,GAAGC,eAAAA,EAAAA;IACvB,MAAM,EAAEC,yBAAyB,EAAE,GAAGC,8BAAAA,EAAAA;AACtC,IAAA,MAAM,EACJC,oBAAoB,EACpBC,oBAAoB,EACpBC,iCAAiC,EACjCC,0BAA0B,EAC1BC,yBAAyB,EACzBC,6BAA6B,EAC7BC,0BAA0B,EAC3B,GAAGC,gBAAAA,EAAAA;IAEJ,MAAM,EAAEC,gBAAgB,EAAEC,eAAe,EAAEC,cAAc,EAAE,GAAGhB,KAAAA,CAAMiB,MAAM;AAC1E,IAAA,MAAM,EAAEC,oBAAoB,EAAEC,oBAAoB,EAAEC,sBAAsB,EAAE,GAAGpB,KAAAA;IAE/E,MAAMqB,YAAAA,GAAe,CAACC,IAAAA,EAAMC,GAAAA,GAAAA;AAC1B,QAAA,MAAM,EAAEC,IAAI,EAAE,GAAGD,IAAIE,KAAK;QAC1B,MAAMC,UAAAA,GAAaC,MAAAA,CAAOC,QAAQ,CAAC,gCAAA,CAAA;QAEnC,OAAOD,MAAAA,CAAOE,UAAU,CAACC,QAAQ,CAACC,MAAM,CAACT,MAAMI,UAAAA,EAAY;AAAEF,YAAAA;;AAC/D,IAAA,CAAA;AAEA,IAAA,MAAMQ,kBAAkB,CAACC,WAAAA,GAAAA;AACvB,QAAA,MAAM,EAAEC,QAAQ,EAAE,GAAGD,eAAe,EAAA;AAEpC,QAAA,OAAO,OAAOC,QAAAA,KAAa,QAAA,IAAYA,SAASC,MAAM,GAAG,IAAID,QAAAA,GAAWE,SAAAA;AAC1E,IAAA,CAAA;IAEA,MAAMC,+BAAAA,GAAkC,CAACd,GAAAA,GACvCL,oBAAAA,CAAqB;AACnBoB,YAAAA,SAAAA,EAAWf,GAAAA,CAAIgB,OAAO,CAACC,OAAO,CAAC,YAAA;AACnC,SAAA,CAAA;IAEA,MAAMC,uBAAAA,GAA0B,OAAOd,OAAAA,EAAQJ,GAAAA,EAAKD,IAAAA,EAAM,EAAEoB,QAAQ,EAAE,GAAG,EAAE,GAAA;AACzE,QAAA,MAAMR,QAAAA,GAAWF,eAAAA,CAAgBT,GAAAA,CAAIgB,OAAO,CAACI,IAAI,CAAA;AACjD,QAAA,MAAMC,YAAAA,GAAe;YAAEC,IAAAA,EAAM,SAAA;AAAW,YAAA,GAAIH,QAAAA,GAAW;AAAEA,gBAAAA;gBAAa;AAAG,SAAA;AAEzE,QAAA,MAAMI,OAAAA,GAAU,MAAMnB,OAAAA,CACnBoB,cAAc,CAAC,mBAAA,CAAA,CACfC,oBAAoB,CAACC,MAAAA,CAAO3B,IAAAA,CAAK4B,EAAE,CAAA,EAAGhB,QAAAA,EAAUU,YAAAA,CAAAA;QAEnD,MAAMO,MAAAA,GAAS,MAAMxB,OAAAA,CAClBoB,cAAc,CAAC,mBAAA,CAAA,CACfK,mBAAmB,CAACN,OAAAA,CAAQO,KAAK,CAAA;AACpC,QAAA,IAAI,WAAWF,MAAAA,EAAQ;AACrB,YAAA,MAAM,IAAIrC,gBAAAA,CAAiB,qBAAA,CAAA;AAC/B,QAAA;AAEE,QAAA,MAAMwC,UAAAA,GAAa3B,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,oCAAA,CAAA;AACrC,QAAA,MAAMC,kBAAkBlC,GAAAA,CAAIgB,OAAO,CAACmB,MAAM,CAAC,0BAA0B,KAAK,UAAA;QAE1E,IAAIJ,UAAAA,EAAYK,YAAYF,eAAAA,EAAiB;AAC3C,YAAA,MAAMG,UAAAA,GAAaN,UAAAA,CAAWO,MAAM,EAAEC,IAAAA,IAAQ,mBAAA;AAC9C,YAAA,MAAMC,YAAAA,GAAeC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;YAC9C3C,GAAAA,CAAI4C,OAAO,CAACC,GAAG,CAACR,YAAYd,OAAAA,CAAQO,KAAK,EAAEjD,yBAAAA,CAA0BkD,UAAAA,EAAYS,YAAAA,CAAAA,CAAAA;YACjF,OAAOxC,GAAAA,CAAI8C,IAAI,CAAC;AAAEC,gBAAAA,GAAAA,EAAKnB,OAAOE,KAAK;gBAAE/B,IAAAA,EAAM,MAAMD,aAAaC,IAAAA,EAAMC,GAAAA;AAAI,aAAA,CAAA;AAC5E,QAAA;QAEE,OAAOA,GAAAA,CAAI8C,IAAI,CAAC;AACdC,YAAAA,GAAAA,EAAKnB,OAAOE,KAAK;AACjBkB,YAAAA,YAAAA,EAAczB,QAAQO,KAAK;YAC3B/B,IAAAA,EAAM,MAAMD,aAAaC,IAAAA,EAAMC,GAAAA;AACnC,SAAA,CAAA;AACA,IAAA,CAAA;IAEA,MAAMiD,gCAAAA,GAAmC,OAAO7C,OAAAA,EAAQJ,GAAAA,EAAKD,IAAAA,GAAAA;AAC3D,QAAA,MAAMY,QAAAA,GAAWF,eAAAA,CAAgBT,GAAAA,CAAIgB,OAAO,CAACI,IAAI,CAAA;QAEjD,MAAMhB,OAAAA,CAAOoB,cAAc,CAAC,mBAAA,CAAA,CAAqB0B,sBAAsB,CAACxB,MAAAA,CAAO3B,KAAK4B,EAAE,CAAA,CAAA;QAEtF,MAAMwB,WAAAA,GAAcxC,QAAAA,IAAY1C,MAAAA,CAAOmF,UAAU,EAAA;AACjD,QAAA,MAAM7B,OAAAA,GAAU,MAAMnB,OAAAA,CACnBoB,cAAc,CAAC,mBAAA,CAAA,CACfC,oBAAoB,CAACC,MAAAA,CAAO3B,IAAAA,CAAK4B,EAAE,CAAA,EAAGwB,WAAAA,EAAa;YAAE7B,IAAAA,EAAM;;QAE9D,MAAMM,MAAAA,GAAS,MAAMxB,OAAAA,CAClBoB,cAAc,CAAC,mBAAA,CAAA,CACfK,mBAAmB,CAACN,OAAAA,CAAQO,KAAK,CAAA;AACpC,QAAA,IAAI,WAAWF,MAAAA,EAAQ;AACrB,YAAA,MAAM,IAAIrC,gBAAAA,CAAiB,qBAAA,CAAA;AAC/B,QAAA;QAEE,OAAOS,GAAAA,CAAI8C,IAAI,CAAC;AACdC,YAAAA,GAAAA,EAAKnB,OAAOE,KAAK;AACjBkB,YAAAA,YAAAA,EAAczB,QAAQO,KAAK;YAC3B/B,IAAAA,EAAM,MAAMD,aAAaC,IAAAA,EAAMC,GAAAA;AACnC,SAAA,CAAA;AACA,IAAA,CAAA;IAEA,MAAMqD,oBAAAA,GAAuB,OAAOjD,OAAAA,EAAQJ,GAAAA,EAAKsD,MAAAA,EAAQ,EAAEC,KAAK,EAAE5C,QAAQ,EAAES,IAAI,EAAE,GAAA;QAChF,MAAMI,cAAAA,GAAiBpB,OAAAA,CAAOoB,cAAc,CAAC,mBAAA,CAAA;AAC7C,QAAA,MAAMO,UAAAA,GAAa3B,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,oCAAA,CAAA;AAErC,QAAA,IAAIsB,UAAU,KAAA,EAAO;YACnB,MAAM/B,cAAAA,CAAe0B,sBAAsB,CAACI,MAAAA,CAAAA;AAC5C,YAAA;AACJ,QAAA;AAEE,QAAA,IAAI3C,QAAAA,EAAU;YACZ,MAAMa,cAAAA,CAAe0B,sBAAsB,CAACI,MAAAA,EAAQ3C,QAAAA,CAAAA;AACpD,YAAA;AACJ,QAAA;AAEE,QAAA,IAAI6C,gBAAAA,GAAmBxD,GAAAA,CAAIE,KAAK,CAACuD,OAAO,EAAE9B,EAAAA;QAC1C,MAAMU,UAAAA,GAAaN,UAAAA,EAAYO,MAAAA,EAAQC,IAAAA,IAAQ,mBAAA;AAC/C,QAAA,MAAMS,eACJhD,GAAAA,CAAI4C,OAAO,CAACX,GAAG,CAACI,UAAAA,CAAAA,KACf,OAAOjB,IAAAA,CAAK4B,YAAY,KAAK,QAAA,GAAW5B,IAAAA,CAAK4B,YAAY,GAAGnC,SAAA,CAAA;AAE/D,QAAA,IAAImC,YAAAA,EAAc;AAChB,YAAA,MAAMU,UAAAA,GAAa,MAAMlC,cAAAA,CAAemC,oBAAoB,CAACX,YAAAA,CAAAA;YAC7D,IAAIU,UAAAA,CAAWE,OAAO,EAAE;AACtBJ,gBAAAA,gBAAAA,GAAmBE,WAAWG,SAAS;AAC7C,YAAA;AACA,QAAA;AAEE,QAAA,IAAIL,gBAAAA,EAAkB;YACpB,MAAMhC,cAAAA,CAAesC,iBAAiB,CAACR,MAAAA,EAAQE,gBAAAA,CAAAA;AAC/C,YAAA;AACJ,QAAA;QAEE,MAAMhC,cAAAA,CAAe0B,sBAAsB,CAACI,MAAAA,CAAAA;AAC9C,IAAA,CAAA;AAEArD,IAAAA,IAAAA,GAAiB,CAAC,EAAEG,MAAAA,EAAAA,OAAM,EAAE,IAAM;AAChC,YAAA,MAAM2D,UAAS/D,GAAG,EAAA;AAChB,gBAAA,MAAMgE,QAAAA,GAAWhE,GAAAA,CAAIiE,MAAM,CAACD,QAAQ,IAAI,OAAA;AACxC,gBAAA,MAAMC,MAAAA,GAASjE,GAAAA,CAAIgB,OAAO,CAACI,IAAI;gBAE/B,MAAM8C,KAAAA,GAAQ9D,OAAAA,CAAO8D,KAAK,CAAC;oBAAE5C,IAAAA,EAAM,QAAA;oBAAUiB,IAAAA,EAAM;;AACnD,gBAAA,MAAM4B,aAAAA,GAAgB,MAAMD,KAAAA,CAAMjC,GAAG,CAAC;oBAAEmC,GAAAA,EAAK;;gBAE7C,MAAMC,aAAAA,GAAgBL,QAAAA,KAAa,OAAA,GAAU,OAAA,GAAUA,QAAAA;AAEvD,gBAAA,IAAI,CAAC7F,CAAAA,CAAE8D,GAAG,CAACkC,aAAAA,EAAe;AAACE,oBAAAA,aAAAA;AAAe,oBAAA;iBAAU,CAAA,EAAG;AACrD,oBAAA,MAAM,IAAI9E,gBAAAA,CAAiB,2BAAA,CAAA;AACjC,gBAAA;AAEI,gBAAA,IAAIyE,aAAa,OAAA,EAAS;AACxB,oBAAA,MAAMjF,oBAAAA,CAAqBkF,MAAAA,CAAAA;oBAE3B,MAAM,EAAEK,UAAU,EAAE,GAAGL,MAAAA;;oBAGvB,MAAMlE,IAAAA,GAAO,MAAMK,OAAAA,CAAOmE,EAAE,CAACC,KAAK,CAAC,gCAAA,CAAA,CAAkCC,OAAO,CAAC;wBAC3EC,KAAAA,EAAO;AACLV,4BAAAA,QAAAA;4BACAW,GAAAA,EAAK;AAAC,gCAAA;AAAEC,oCAAAA,KAAAA,EAAON,WAAWO,WAAW;;AAAM,gCAAA;oCAAEC,QAAAA,EAAUR;;AAAa;AAC9E;AACA,qBAAA,CAAA;AAEM,oBAAA,IAAI,CAACvE,IAAAA,EAAM;AACT,wBAAA,MAAM,IAAIP,eAAAA,CAAgB,gCAAA,CAAA;AAClC,oBAAA;oBAEM,IAAI,CAACO,IAAAA,CAAKgF,QAAQ,EAAE;AAClB,wBAAA,MAAM,IAAIvF,eAAAA,CAAgB,gCAAA,CAAA;AAClC,oBAAA;oBAEM,MAAMwF,aAAAA,GAAgB,MAAMrG,UAAAA,CAAW,MAAA,CAAA,CAAQsG,gBAAgB,CAC7DhB,MAAAA,CAAOc,QAAQ,EACfhF,IAAAA,CAAKgF,QAAA,CAAA;AAGP,oBAAA,IAAI,CAACC,aAAAA,EAAe;AAClB,wBAAA,MAAM,IAAIxF,eAAAA,CAAgB,gCAAA,CAAA;AAClC,oBAAA;AAEM,oBAAA,MAAM0F,gBAAAA,GAAmB,MAAMhB,KAAAA,CAAMjC,GAAG,CAAC;wBAAEmC,GAAAA,EAAK;;AAChD,oBAAA,MAAMe,oBAAAA,GAAuBhH,CAAAA,CAAE8D,GAAG,CAACiD,gBAAAA,EAAkB,oBAAA,CAAA;AAErD,oBAAA,IAAIC,oBAAAA,IAAwBpF,IAAAA,CAAKqF,SAAS,KAAK,IAAA,EAAM;AACnD,wBAAA,MAAM,IAAI7F,gBAAAA,CAAiB,qCAAA,CAAA;AACnC,oBAAA;oBAEM,IAAIQ,IAAAA,CAAKsF,OAAO,KAAK,IAAA,EAAM;AACzB,wBAAA,MAAM,IAAI9F,gBAAAA,CAAiB,mDAAA,CAAA;AACnC,oBAAA;AAEM,oBAAA,MAAM+F,OAAOlF,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,yCAAA,EAA2C,gBAAA,CAAA;AAC1E,oBAAA,IAAIqD,SAAS,SAAA,EAAW;wBACtB,OAAOpE,uBAAAA,CAAwBd,OAAAA,EAAQJ,GAAAA,EAAKD,IAAAA,EAAM;AAChDoB,4BAAAA,QAAAA,EAAUL,+BAAAA,CAAgCd,GAAAA;AACpD,yBAAA,CAAA;AACA,oBAAA;oBAEM,OAAOA,GAAAA,CAAI8C,IAAI,CAAC;wBACdC,GAAAA,EAAKpE,UAAAA,CAAW,KAAA,CAAA,CAAO4G,KAAK,CAAC;AAAE5D,4BAAAA,EAAAA,EAAI5B,KAAK4B;;wBACxC5B,IAAAA,EAAM,MAAMD,aAAaC,IAAAA,EAAMC,GAAAA;AACvC,qBAAA,CAAA;AACA,gBAAA;;gBAGI,IAAI;oBACF,MAAMD,IAAAA,GAAO,MAAMpB,UAAAA,CAAW,WAAA,CAAA,CAAa6G,OAAO,CAACxB,QAAAA,EAAUhE,IAAIwE,KAAK,CAAA;oBAEtE,IAAIzE,IAAAA,CAAKsF,OAAO,EAAE;AAChB,wBAAA,MAAM,IAAI5F,cAAAA,CAAe,mDAAA,CAAA;AACjC,oBAAA;AAEM,oBAAA,MAAM6F,OAAOlF,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,yCAAA,EAA2C,gBAAA,CAAA;AAC1E,oBAAA,IAAIqD,SAAS,SAAA,EAAW;wBACtB,OAAOpE,uBAAAA,CAAwBd,OAAAA,EAAQJ,GAAAA,EAAKD,IAAAA,EAAM;AAChDoB,4BAAAA,QAAAA,EAAUL,+BAAAA,CAAgCd,GAAAA;AACpD,yBAAA,CAAA;AACA,oBAAA;oBAEM,OAAOA,GAAAA,CAAI8C,IAAI,CAAC;wBACdC,GAAAA,EAAKpE,UAAAA,CAAW,KAAA,CAAA,CAAO4G,KAAK,CAAC;AAAE5D,4BAAAA,EAAAA,EAAI5B,KAAK4B;;wBACxC5B,IAAAA,EAAM,MAAMD,aAAaC,IAAAA,EAAMC,GAAAA;AACvC,qBAAA,CAAA;AACA,gBAAA,CAAA,CAAM,OAAOyF,KAAAA,EAAO;oBACd,MAAM,IAAIlG,gBAAAA,CAAiBkG,KAAAA,CAAMC,OAAO,CAAA;AAC9C,gBAAA;AACA,YAAA,CAAA;AAEE,YAAA,MAAMC,gBAAe3F,GAAG,EAAA;AACtB,gBAAA,IAAI,CAACA,GAAAA,CAAIE,KAAK,CAACH,IAAI,EAAE;AACnB,oBAAA,MAAM,IAAIR,gBAAAA,CAAiB,kDAAA,CAAA;AACjC,gBAAA;AAEI,gBAAA,MAAMqG,WAAAA,GAAcxF,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,2CAAA,CAAA;AAEtC,gBAAA,MAAM,EAAE4D,eAAe,EAAEd,QAAQ,EAAE,GAAG,MAAM1F,0BAAAA,CAC1CW,GAAAA,CAAIgB,OAAO,CAACI,IAAI,EAChBwE,WAAAA,CAAAA;gBAGF,MAAM7F,IAAAA,GAAO,MAAMK,OAAAA,CAAOmE,EAAA,CACvBC,KAAK,CAAC,gCAAA,CAAA,CACNC,OAAO,CAAC;oBAAEC,KAAAA,EAAO;AAAE/C,wBAAAA,EAAAA,EAAI3B,GAAAA,CAAIE,KAAK,CAACH,IAAI,CAAC4B;AAAE;;gBAE3C,MAAMqD,aAAAA,GAAgB,MAAMrG,UAAAA,CAAW,MAAA,CAAA,CAAQsG,gBAAgB,CAACY,eAAAA,EAAiB9F,KAAKgF,QAAQ,CAAA;AAE9F,gBAAA,IAAI,CAACC,aAAAA,EAAe;AAClB,oBAAA,MAAM,IAAIxF,eAAAA,CAAgB,0CAAA,CAAA;AAChC,gBAAA;AAEI,gBAAA,IAAIqG,oBAAoBd,QAAAA,EAAU;AAChC,oBAAA,MAAM,IAAIvF,eAAAA,CAAgB,gEAAA,CAAA;AAChC,gBAAA;AAEI,gBAAA,MAAMb,WAAW,MAAA,CAAA,CAAQmH,IAAI,CAAC/F,IAAAA,CAAK4B,EAAE,EAAE;AAAEoD,oBAAAA;;AAEzC,gBAAA,MAAMO,OAAOlF,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,yCAAA,EAA2C,gBAAA,CAAA;AAC1E,gBAAA,IAAIqD,SAAS,SAAA,EAAW;oBACtB,OAAOrC,gCAAAA,CAAiC7C,SAAQJ,GAAAA,EAAKD,IAAAA,CAAAA;AAC3D,gBAAA;gBAEI,OAAOC,GAAAA,CAAI8C,IAAI,CAAC;oBACdC,GAAAA,EAAKpE,UAAAA,CAAW,KAAA,CAAA,CAAO4G,KAAK,CAAC;AAAE5D,wBAAAA,EAAAA,EAAI5B,KAAK4B;;oBACxC5B,IAAAA,EAAM,MAAMD,aAAaC,IAAAA,EAAMC,GAAAA;AACrC,iBAAA,CAAA;AACA,YAAA,CAAA;AAEE,YAAA,MAAM+F,eAAc/F,GAAG,EAAA;AACrB,gBAAA,MAAM4F,WAAAA,GAAcxF,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,2CAAA,CAAA;AAEtC,gBAAA,MAAM,EAAE8C,QAAQ,EAAEiB,oBAAoB,EAAEC,IAAI,EAAE,GAAG,MAAM9G,yBAAAA,CACrDa,GAAAA,CAAIgB,OAAO,CAACI,IAAI,EAChBwE,WAAAA,CAAAA;AAGF,gBAAA,IAAIb,aAAaiB,oBAAAA,EAAsB;AACrC,oBAAA,MAAM,IAAIxG,eAAAA,CAAgB,wBAAA,CAAA;AAChC,gBAAA;gBAEI,MAAMO,IAAAA,GAAO,MAAMK,OAAAA,CAAOmE,EAAA,CACvBC,KAAK,CAAC,gCAAA,CAAA,CACNC,OAAO,CAAC;oBAAEC,KAAAA,EAAO;wBAAEwB,kBAAAA,EAAoBD;AAAI;AAAE,iBAAA,CAAA;AAEhD,gBAAA,IAAI,CAAClG,IAAAA,EAAM;AACT,oBAAA,MAAM,IAAIP,eAAAA,CAAgB,yBAAA,CAAA;AAChC,gBAAA;AAEI,gBAAA,MAAMb,WAAW,MAAA,CAAA,CAAQmH,IAAI,CAAC/F,IAAAA,CAAK4B,EAAE,EAAE;oBACrCuE,kBAAAA,EAAoB,IAAA;AACpBnB,oBAAAA;AACN,iBAAA,CAAA;AAEI,gBAAA,MAAMO,OAAOlF,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,yCAAA,EAA2C,gBAAA,CAAA;AAC1E,gBAAA,IAAIqD,SAAS,SAAA,EAAW;oBACtB,OAAOrC,gCAAAA,CAAiC7C,SAAQJ,GAAAA,EAAKD,IAAAA,CAAAA;AAC3D,gBAAA;gBAEI,OAAOC,GAAAA,CAAI8C,IAAI,CAAC;oBACdC,GAAAA,EAAKpE,UAAAA,CAAW,KAAA,CAAA,CAAO4G,KAAK,CAAC;AAAE5D,wBAAAA,EAAAA,EAAI5B,KAAK4B;;oBACxC5B,IAAAA,EAAM,MAAMD,aAAaC,IAAAA,EAAMC,GAAAA;AACrC,iBAAA,CAAA;AACA,YAAA,CAAA;AACE,YAAA,MAAMuB,SAAQvB,GAAG,EAAA;AACf,gBAAA,MAAMsF,OAAOlF,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,yCAAA,EAA2C,gBAAA,CAAA;AAC1E,gBAAA,IAAIqD,SAAS,SAAA,EAAW;AACtB,oBAAA,OAAOtF,IAAImG,QAAQ,EAAA;AACzB,gBAAA;AAEI,gBAAA,MAAMpE,UAAAA,GAAa3B,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,oCAAA,CAAA;gBACrC,MAAMI,UAAAA,GAAaN,UAAAA,EAAYO,MAAAA,EAAQC,IAAAA,IAAQ,mBAAA;;AAG/C,gBAAA,IAAIS,YAAAA,GAAehD,GAAAA,CAAI4C,OAAO,CAACX,GAAG,CAACI,UAAAA,CAAAA;AACnC,gBAAA,IAAI,CAACW,YAAAA,EAAc;AACjBA,oBAAAA,YAAAA,GAAehD,GAAAA,CAAIgB,OAAO,CAACI,IAAI,EAAE4B,YAAAA;AACvC,gBAAA;AAEI,gBAAA,IAAI,CAACA,YAAAA,IAAgB,OAAOA,YAAAA,KAAiB,QAAA,EAAU;oBACrD,OAAOhD,GAAAA,CAAIoG,UAAU,CAAC,uBAAA,CAAA;AAC5B,gBAAA;AAEI,gBAAA,MAAMC,WAAW,MAAMjG,OAAAA,CACpBoB,cAAc,CAAC,mBAAA,CAAA,CACf8E,kBAAkB,CAACtD,YAAAA,CAAAA;AACtB,gBAAA,IAAI,WAAWqD,QAAAA,EAAU;oBACvB,OAAOrG,GAAAA,CAAIuG,YAAY,CAAC,uBAAA,CAAA;AAC9B,gBAAA;gBAEI,MAAMC,MAAAA,GAAS,MAAMpG,OAAAA,CAClBoB,cAAc,CAAC,mBAAA,CAAA,CACfK,mBAAmB,CAACwE,QAAAA,CAASvE,KAAK,CAAA;AACrC,gBAAA,IAAI,WAAW0E,MAAAA,EAAQ;oBACrB,OAAOxG,GAAAA,CAAIuG,YAAY,CAAC,uBAAA,CAAA;AAC9B,gBAAA;AAEI,gBAAA,MAAMrE,kBAAkBlC,GAAAA,CAAIgB,OAAO,CAACmB,MAAM,CAAC,0BAA0B,KAAK,UAAA;gBAC1E,IAAIJ,UAAAA,EAAYK,YAAYF,eAAAA,EAAiB;AAC3C,oBAAA,MAAMM,YAAAA,GAAeC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;oBAC9C3C,GAAAA,CAAI4C,OAAO,CAACC,GAAG,CACbR,YACAgE,QAAAA,CAASvE,KAAK,EACdjD,yBAAAA,CAA0BkD,UAAAA,EAAYS,YAAAA,CAAAA,CAAAA;oBAExC,OAAOxC,GAAAA,CAAI8C,IAAI,CAAC;AAAEC,wBAAAA,GAAAA,EAAKyD,OAAO1E;AAAK,qBAAA,CAAA;AACzC,gBAAA;gBACI,OAAO9B,GAAAA,CAAI8C,IAAI,CAAC;AAAEC,oBAAAA,GAAAA,EAAKyD,OAAO1E,KAAK;AAAEkB,oBAAAA,YAAAA,EAAcqD,SAASvE;;AAChE,YAAA,CAAA;AACE,YAAA,MAAM2E,QAAOzG,GAAG,EAAA;AACd,gBAAA,MAAMsF,OAAOlF,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,yCAAA,EAA2C,gBAAA,CAAA;AAC1E,gBAAA,IAAIqD,SAAS,SAAA,EAAW;AACtB,oBAAA,OAAOtF,IAAImG,QAAQ,EAAA;AACzB,gBAAA;AAEI,gBAAA,IAAI,CAACnG,GAAAA,CAAIE,KAAK,CAACH,IAAI,EAAE;oBACnB,OAAOC,GAAAA,CAAIuG,YAAY,CAAC,wBAAA,CAAA;AAC9B,gBAAA;AAEI,gBAAA,MAAMjD,SAAS5B,MAAAA,CAAO1B,GAAAA,CAAIE,KAAK,CAACH,IAAI,CAAC4B,EAAE,CAAA;AACvC,gBAAA,MAAMI,UAAAA,GAAa3B,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,oCAAA,CAAA;AACrC,gBAAA,MAAMb,OAAOpB,GAAAA,CAAIgB,OAAO,CAACI,IAAI,IAAI,EAAA;gBACjC,MAAMmC,KAAAA,GAAQ,OAAOnC,IAAAA,CAAKmC,KAAK,KAAK,QAAA,GAAWnC,IAAAA,CAAKmC,KAAK,GAAG1C,SAAAA;AAC5D,gBAAA,MAAMF,WAAWF,eAAAA,CAAgBW,IAAAA,CAAAA;gBAEjC,IAAI;oBACF,MAAMiC,oBAAAA,CAAqBjD,OAAAA,EAAQJ,GAAAA,EAAKsD,MAAAA,EAAQ;AAAEC,wBAAAA,KAAAA;AAAO5C,wBAAAA,QAAAA;AAAUS,wBAAAA;;AACzE,gBAAA,CAAA,CAAM,OAAOsF,GAAAA,EAAK;AACZtG,oBAAAA,OAAAA,CAAOuG,GAAG,CAAClB,KAAK,CAAC,kBAAA,EAAoBiB,GAAAA,CAAAA;AAC3C,gBAAA;AAEI,gBAAA,MAAMxE,kBAAkBlC,GAAAA,CAAIgB,OAAO,CAACmB,MAAM,CAAC,0BAA0B,KAAK,UAAA;gBAC1E,IAAIJ,UAAAA,EAAYK,YAAYF,eAAAA,EAAiB;AAC3C,oBAAA,MAAMG,UAAAA,GAAaN,UAAAA,CAAWO,MAAM,EAAEC,IAAAA,IAAQ,mBAAA;AAC9C,oBAAA,MAAMC,YAAAA,GAAeC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;oBAE9C,MAAM,EAAEiE,QAAQC,OAAO,EAAE,GAAGC,aAAAA,EAAe,GAAGjI,0BAC5CkD,UAAAA,EACAS,YAAAA,CAAAA;AAGFxC,oBAAAA,GAAAA,CAAI4C,OAAO,CAACC,GAAG,CAACR,YAAY,EAAA,EAAI;AAAE,wBAAA,GAAGyE,aAAa;AAAEC,wBAAAA,OAAAA,EAAS,IAAIC,IAAAA,CAAK,CAAA;AAAE,qBAAA,CAAA;AAC9E,gBAAA;gBACI,OAAOhH,GAAAA,CAAI8C,IAAI,CAAC;oBAAEmE,EAAAA,EAAI;AAAI,iBAAA,CAAA;AAC9B,YAAA,CAAA;AACE,YAAA,MAAMC,aAAYlH,GAAG,EAAA;AACnB,gBAAA,MAAMsF,OAAOlF,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,yCAAA,EAA2C,gBAAA,CAAA;AAC1E,gBAAA,IAAIqD,SAAS,SAAA,EAAW;AACtB,oBAAA,OAAOtF,IAAImG,QAAQ,EAAA;AACzB,gBAAA;AAEI,gBAAA,IAAI,CAACnG,GAAAA,CAAIE,KAAK,CAACH,IAAI,EAAE;oBACnB,OAAOC,GAAAA,CAAIuG,YAAY,CAAC,wBAAA,CAAA;AAC9B,gBAAA;AAEI,gBAAA,MAAM/C,gBAAAA,GAAmBxD,GAAAA,CAAIE,KAAK,CAACuD,OAAO,EAAE9B,EAAAA;AAC5C,gBAAA,MAAMwF,QAAAA,GAAW,MAAM/G,OAAAA,CACpBoB,cAAc,CAAC,mBAAA,CAAA,CACf4F,YAAY,CAAC1F,MAAAA,CAAO1B,GAAAA,CAAIE,KAAK,CAACH,IAAI,CAAC4B,EAAE,CAAA,CAAA;gBAExC,MAAM0F,IAAAA,GAAOxH,uBACXsH,QAAAA,CAASG,GAAG,CAAC,CAAC7D,OAAAA,GAAY7D,qBAAqB6D,OAAAA,EAASD,gBAAAA,CAAAA,CAAAA,CAAAA;gBAG1D,OAAOxD,GAAAA,CAAI8C,IAAI,CAAC;AAAEuE,oBAAAA;;AACtB,YAAA,CAAA;AACE,YAAA,MAAME,eAAcvH,GAAG,EAAA;AACrB,gBAAA,MAAMsF,OAAOlF,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,yCAAA,EAA2C,gBAAA,CAAA;AAC1E,gBAAA,IAAIqD,SAAS,SAAA,EAAW;AACtB,oBAAA,OAAOtF,IAAImG,QAAQ,EAAA;AACzB,gBAAA;AAEI,gBAAA,IAAI,CAACnG,GAAAA,CAAIE,KAAK,CAACH,IAAI,EAAE;oBACnB,OAAOC,GAAAA,CAAIuG,YAAY,CAAC,wBAAA,CAAA;AAC9B,gBAAA;AAEI,gBAAA,MAAM,EAAE1C,SAAS,EAAE,GAAG7D,IAAIiE,MAAM;AAChC,gBAAA,MAAMuD,OAAAA,GAAU,MAAMpH,OAAAA,CACnBoB,cAAc,CAAC,mBAAA,CAAA,CACfsC,iBAAiB,CAACpC,MAAAA,CAAO1B,IAAIE,KAAK,CAACH,IAAI,CAAC4B,EAAE,CAAA,EAAGkC,SAAAA,CAAAA;AAEhD,gBAAA,IAAI,CAAC2D,OAAAA,EAAS;oBACZ,OAAOxH,GAAAA,CAAImG,QAAQ,CAAC,mBAAA,CAAA;AAC1B,gBAAA;gBAEI,OAAOnG,GAAAA,CAAI8C,IAAI,CAAC;AAAEuE,oBAAAA,IAAAA,EAAM;AAAE,iBAAA,CAAA;AAC9B,YAAA,CAAA;YACE,MAAM7B,OAAAA,CAAAA,CAAQxF,GAAG,EAAEyH,IAAI,EAAA;AACrB,gBAAA,MAAMC,SAAAA,GAAY,MAAMtH,OAAAA,CACrB8D,KAAK,CAAC;oBAAE5C,IAAAA,EAAM,QAAA;oBAAUiB,IAAAA,EAAM,mBAAA;oBAAqB6B,GAAAA,EAAK;AAAO,iBAAA,CAAA,CAC/DnC,GAAG,EAAA;gBAEN,MAAM,CAAC0F,YAAY,GAAG3H,GAAAA,CAAIgB,OAAO,CAAC4G,GAAG,CAACC,KAAK,CAAC,GAAA,CAAA;AAC5C,gBAAA,MAAM7D,QAAAA,GAAW2D,WAAAA,CAAYE,KAAK,CAAC,WAAA,CAAY,CAAC,CAAA,CAAE,CAACA,KAAK,CAAC,GAAA,CAAI,CAAC,CAAA,CAAE;AAEhE,gBAAA,IAAI,CAAC1J,CAAAA,CAAE8D,GAAG,CAACyF,SAAAA,EAAW;AAAC1D,oBAAAA,QAAAA;AAAU,oBAAA;iBAAU,CAAA,EAAG;AAC5C,oBAAA,MAAM,IAAIzE,gBAAAA,CAAiB,2BAAA,CAAA;AACjC,gBAAA;gBAEI,IAAI,CAACa,OAAAA,CAAO4B,MAAM,CAAC8F,MAAM,CAACF,GAAG,CAACG,UAAU,CAAC,MAAA,CAAA,EAAS;oBAChD3H,OAAAA,CAAOuG,GAAG,CAACqB,IAAI,CACb,6NAAA,CAAA;AAER,gBAAA;AAEI,gBAAA,MAAMC,mBAAAA,GAAsB9J,CAAAA,CAAE8D,GAAG,CAACjC,GAAAA,EAAK,gBAAA,CAAA;AACvC,gBAAA,MAAMkI,sBAAAA,GAAyB/J,CAAAA,CAAE8D,GAAG,CAACjC,GAAAA,EAAK,gCAAA,CAAA;AAC1C,gBAAA,MAAMmI,iBAAiBF,mBAAAA,IAAuBC,sBAAAA;AAE9C,gBAAA,IAAIC,mBAAmBtH,SAAAA,EAAW;oBAChC,IAAI;wBACF,MAAM,EAAEuH,QAAAA,EAAUC,gBAAgB,EAAE,GAAGjI,QACpCkI,MAAM,CAAC,mBAAA,CAAA,CACPtG,MAAM,CAAC,UAAA,CAAA;AAEV,wBAAA,MAAMqG,gBAAAA,CAAiBF,cAAAA,EAAgBT,SAAS,CAAC1D,QAAAA,CAAS,CAAA;;AAG1DhE,wBAAAA,GAAAA,CAAIyD,OAAO,GAAGzD,GAAAA,CAAIyD,OAAO,IAAI,EAAA;wBAC7BzD,GAAAA,CAAIyD,OAAO,CAAC8E,KAAK,GAAGvI,IAAIyD,OAAO,CAAC8E,KAAK,IAAI,EAAA;AACzCvI,wBAAAA,GAAAA,CAAIyD,OAAO,CAAC8E,KAAK,CAACC,OAAO,GAAG;AAC1B,4BAAA,GAAGxI,GAAAA,CAAIyD,OAAO,CAAC8E,KAAK,CAACC,OAAO;4BAC5BzE,QAAAA,EAAUoE;AACpB,yBAAA;wBACQnI,GAAAA,CAAIE,KAAK,CAACuI,YAAY,GAAG;4BAAE1E,QAAAA,EAAUoE;AAAc,yBAAA;AAC3D,oBAAA,CAAA,CAAQ,OAAM;wBACN,MAAM,IAAI3I,gBAAgB,+BAAA,EAAiC;4BAAEuE,QAAAA,EAAUoE;AAAc,yBAAA,CAAA;AAC7F,oBAAA;AACA,gBAAA;gBAEI,MAAM,EAAEO,4BAA4B,EAAE,GAAGC,iBAAAA,EAAAA;AACzC,gBAAA,MAAMF,YAAAA,GAAeC,4BAAAA,EAAAA;AAErB,gBAAA,OAAOD,aAAazI,GAAAA,EAAKyH,IAAAA,CAAAA;AAC7B,YAAA,CAAA;AAEE,YAAA,MAAMmB,gBAAe5I,GAAG,EAAA;gBACtB,MAAM,EAAE4E,KAAK,EAAE,GAAG,MAAM1F,0BAAAA,CAA2Bc,GAAAA,CAAIgB,OAAO,CAACI,IAAI,CAAA;AAEnE,gBAAA,MAAMyH,WAAAA,GAAc,MAAMzI,OAAAA,CAAO8D,KAAK,CAAC;oBAAE5C,IAAAA,EAAM,QAAA;oBAAUiB,IAAAA,EAAM;;AAE/D,gBAAA,MAAMuG,aAAAA,GAAgB,MAAMD,WAAAA,CAAY5G,GAAG,CAAC;oBAAEmC,GAAAA,EAAK;;AACnD,gBAAA,MAAMc,gBAAAA,GAAmB,MAAM2D,WAAAA,CAAY5G,GAAG,CAAC;oBAAEmC,GAAAA,EAAK;;;gBAGtD,MAAMrE,IAAAA,GAAO,MAAMK,OAAAA,CAAOmE,EAAA,CACvBC,KAAK,CAAC,gCAAA,CAAA,CACNC,OAAO,CAAC;oBAAEC,KAAAA,EAAO;AAAEE,wBAAAA,KAAAA,EAAOA,MAAMC,WAAW;AAAE;;AAEhD,gBAAA,IAAI,CAAC9E,IAAAA,IAAQA,IAAAA,CAAKsF,OAAO,EAAE;oBACzB,OAAOrF,GAAAA,CAAI8C,IAAI,CAAC;wBAAEmE,EAAAA,EAAI;AAAI,qBAAA,CAAA;AAChC,gBAAA;;gBAGI,MAAM8B,QAAAA,GAAW,MAAMjJ,YAAAA,CAAaC,IAAAA,EAAMC,GAAAA,CAAAA;AAE1C,gBAAA,MAAMkG,qBAAqBjI,MAAAA,CAAO+K,WAAW,CAAC,EAAA,CAAA,CAAIC,QAAQ,CAAC,KAAA,CAAA;AAE3D,gBAAA,MAAMC,wBAAwB/K,CAAAA,CAAE8D,GAAG,CAAC6G,aAAAA,EAAe,0BAA0B,EAAA,CAAA;gBAC7E,MAAMK,SAAAA,GAAY,MAAMxK,UAAAA,CAAW,mBAAA,CAAA,CAAqByK,QAAQ,CAC9DF,qBAAAA,CAAsBxD,OAAO,EAC7B;AACE2D,oBAAAA,GAAAA,EAAKnE,iBAAiBoE,oBAAoB;AAC1CC,oBAAAA,UAAAA,EAAYnJ,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,oBAAA,CAAA;AAC9BuH,oBAAAA,SAAAA,EAAWpJ,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,mBAAA,CAAA;oBAC7BwH,IAAAA,EAAMV,QAAAA;oBACNW,KAAAA,EAAOxD;AACf,iBAAA,CAAA;gBAGI,MAAMyD,WAAAA,GAAc,MAAMhL,UAAAA,CAAW,mBAAA,CAAA,CAAqByK,QAAQ,CAChEF,qBAAAA,CAAsBU,MAAM,EAC5B;oBACEH,IAAAA,EAAMV;AACd,iBAAA,CAAA;AAGI,gBAAA,MAAMc,WAAAA,GAAc;AAClBC,oBAAAA,EAAAA,EAAI/J,KAAK6E,KAAK;oBACdmF,IAAAA,EACEb,qBAAAA,CAAsBa,IAAI,CAACnF,KAAK,IAAIsE,sBAAsBa,IAAI,CAACxH,IAAA,GAC3D,CAAA,EAAG2G,qBAAAA,CAAsBa,IAAI,CAACxH,IAAI,CAAC,EAAE,EAAE2G,qBAAAA,CAAsBa,IAAI,CAACnF,KAAK,CAAC,CAAC,CAAA,GACzE/D,SAAAA;AACNmJ,oBAAAA,OAAAA,EAASd,sBAAsBe,cAAc;oBAC7CC,OAAAA,EAASP,WAAAA;oBACTQ,IAAAA,EAAMhB,SAAAA;oBACNiB,IAAAA,EAAMjB;AACZ,iBAAA;;AAGI,gBAAA,MAAMxK,WAAW,MAAA,CAAA,CAAQmH,IAAI,CAAC/F,IAAAA,CAAK4B,EAAE,EAAE;AAAEuE,oBAAAA;;;gBAGzC,MAAM9F,OAAAA,CAAOkI,MAAM,CAAC,OAAA,CAAA,CAAS+B,OAAO,CAAC,OAAA,CAAA,CAASvH,IAAI,CAAC+G,WAAAA,CAAAA;AAEnD7J,gBAAAA,GAAAA,CAAI8C,IAAI,CAAC;oBAAEmE,EAAAA,EAAI;AAAI,iBAAA,CAAA;AACvB,YAAA,CAAA;AAEE,YAAA,MAAMqD,UAAStK,GAAG,EAAA;AAChB,gBAAA,MAAM6I,WAAAA,GAAc,MAAMzI,OAAAA,CAAO8D,KAAK,CAAC;oBAAE5C,IAAAA,EAAM,QAAA;oBAAUiB,IAAAA,EAAM;;AAE/D,gBAAA,MAAMgI,QAAAA,GAAW,MAAM1B,WAAAA,CAAY5G,GAAG,CAAC;oBAAEmC,GAAAA,EAAK;;gBAE9C,IAAI,CAACmG,QAAAA,CAASC,cAAc,EAAE;AAC5B,oBAAA,MAAM,IAAIjL,gBAAAA,CAAiB,uCAAA,CAAA;AACjC,gBAAA;gBAEI,MAAM,EAAE+K,QAAQ,EAAE,GAAGlK,QAAO4B,MAAM,CAACC,GAAG,CAAC,2BAAA,CAAA;AACvC,gBAAA,MAAMwI,iBAAAA,GAAoB;AAAC,oBAAA,UAAA;AAAY,oBAAA,UAAA;AAAY,oBAAA;AAAQ,iBAAA;;gBAG3D,MAAMC,WAAAA,GAAcpM,OAAAA,CAClBD,MAAAA,CAAOoM,iBAAAA,EAAmBlM,OAAAA,CAAQ+L,UAAUK,aAAAA,CAAAA,GAAiBL,QAAAA,CAASK,aAAa,GAAG,EAAE,CAAA,CAAA;;AAI1F,gBAAA,MAAMC,cAAcC,MAAAA,CAAOC,IAAI,CAAC9K,GAAAA,CAAIgB,OAAO,CAACI,IAAI,CAAA,CAAE2J,MAAM,CAAC,CAAC3G,GAAAA,GAAQ,CAACsG,WAAAA,CAAYM,QAAQ,CAAC5G,GAAAA,CAAAA,CAAAA;gBAExF,IAAIwG,WAAAA,CAAYhK,MAAM,GAAG,CAAA,EAAG;;oBAE1B,MAAM,IAAIpB,gBAAgB,CAAC,oBAAoB,EAAEoL,WAAAA,CAAYK,IAAI,CAAC,IAAA,CAAA,CAAA,CAAO,CAAA;AAC/E,gBAAA;AAEI,gBAAA,MAAMhH,MAAAA,GAAS;oBACb,GAAG9F,CAAAA,CAAE+M,IAAI,CAAClL,GAAAA,CAAIgB,OAAO,CAACI,IAAI,EAAEsJ,WAAAA,CAAY;oBACxC1G,QAAAA,EAAU;AAChB,iBAAA;AAEI,gBAAA,MAAM4B,WAAAA,GAAcxF,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,2CAAA,CAAA;AAEtC,gBAAA,MAAMjD,qBAAqBiF,MAAAA,EAAQ2B,WAAAA,CAAAA;gBAEnC,MAAMuF,IAAAA,GAAO,MAAM/K,OAAAA,CAAOmE,EAAA,CACvBC,KAAK,CAAC,gCAAA,CAAA,CACNC,OAAO,CAAC;oBAAEC,KAAAA,EAAO;AAAEpD,wBAAAA,IAAAA,EAAMiJ,SAASa;AAAY;;AAEjD,gBAAA,IAAI,CAACD,IAAAA,EAAM;AACT,oBAAA,MAAM,IAAI5L,gBAAAA,CAAiB,qCAAA,CAAA;AACjC,gBAAA;AAEI,gBAAA,MAAM,EAAEqF,KAAK,EAAEE,QAAQ,EAAEd,QAAQ,EAAE,GAAGC,MAAAA;AAEtC,gBAAA,MAAMoH,gBAAAA,GAAmB;oBACvB1G,GAAAA,EAAK;AACH,wBAAA;AAAEC,4BAAAA,KAAAA,EAAOA,MAAMC,WAAW;AAAE,yBAAA;AAC5B,wBAAA;AAAEC,4BAAAA,QAAAA,EAAUF,MAAMC,WAAW;AAAE,yBAAA;AAC/B,wBAAA;AAAEC,4BAAAA;AAAQ,yBAAA;AACV,wBAAA;4BAAEF,KAAAA,EAAOE;AAAQ;AAClB;AACP,iBAAA;gBAEI,MAAMwG,oBAAAA,GAAuB,MAAMlL,OAAAA,CAAOmE,EAAE,CAACC,KAAK,CAAC,gCAAA,CAAA,CAAkC+G,KAAK,CAAC;oBACzF7G,KAAAA,EAAO;AAAE,wBAAA,GAAG2G,gBAAgB;AAAErH,wBAAAA;AAAQ;AAC5C,iBAAA,CAAA;AAEI,gBAAA,IAAIsH,uBAAuB,CAAA,EAAG;AAC5B,oBAAA,MAAM,IAAI/L,gBAAAA,CAAiB,qCAAA,CAAA;AACjC,gBAAA;gBAEI,IAAIgL,QAAAA,CAASiB,YAAY,EAAE;oBACzB,MAAMF,oBAAAA,GAAuB,MAAMlL,OAAAA,CAAOmE,EAAE,CAACC,KAAK,CAAC,gCAAA,CAAA,CAAkC+G,KAAK,CAAC;wBACzF7G,KAAAA,EAAO;AAAE,4BAAA,GAAG2G;AAAgB;AACpC,qBAAA,CAAA;AAEM,oBAAA,IAAIC,uBAAuB,CAAA,EAAG;AAC5B,wBAAA,MAAM,IAAI/L,gBAAAA,CAAiB,qCAAA,CAAA;AACnC,oBAAA;AACA,gBAAA;AAEI,gBAAA,MAAMkM,OAAAA,GAAU;AACd,oBAAA,GAAGxH,MAAM;AACTkH,oBAAAA,IAAAA,EAAMA,KAAKxJ,EAAE;AACbiD,oBAAAA,KAAAA,EAAOA,MAAMC,WAAW,EAAA;AACxBC,oBAAAA,QAAAA;oBACAM,SAAAA,EAAW,CAACmF,SAASmB;AAC3B,iBAAA;AAEI,gBAAA,MAAM3L,IAAAA,GAAO,MAAMpB,UAAAA,CAAW,MAAA,CAAA,CAAQgN,GAAG,CAACF,OAAAA,CAAAA;gBAE1C,MAAMG,aAAAA,GAAgB,MAAM9L,YAAAA,CAAaC,IAAAA,EAAMC,GAAAA,CAAAA;gBAE/C,IAAIuK,QAAAA,CAASmB,kBAAkB,EAAE;oBAC/B,IAAI;wBACF,MAAM/M,UAAAA,CAAW,MAAA,CAAA,CAAQkN,qBAAqB,CAACD,aAAAA,CAAAA;AACvD,oBAAA,CAAA,CAAQ,OAAOlF,GAAAA,EAAK;wBACZtG,OAAAA,CAAOuG,GAAG,CAAClB,KAAK,CAACiB,GAAAA,CAAAA;AACjB,wBAAA,MAAM,IAAInH,gBAAAA,CAAiB,kCAAA,CAAA;AACnC,oBAAA;oBAEM,OAAOS,GAAAA,CAAI8C,IAAI,CAAC;wBAAE/C,IAAAA,EAAM6L;AAAa,qBAAA,CAAA;AAC3C,gBAAA;AAEI,gBAAA,MAAMtG,OAAOlF,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,yCAAA,EAA2C,gBAAA,CAAA;AAC1E,gBAAA,IAAIqD,SAAS,SAAA,EAAW;oBACtB,MAAM3E,QAAAA,GAAWF,gBAAgBT,GAAAA,CAAIgB,OAAO,CAACI,IAAI,CAAA,IAAKnD,OAAOmF,UAAU,EAAA;AAEvE,oBAAA,MAAM7B,OAAAA,GAAU,MAAMnB,OAAAA,CACnBoB,cAAc,CAAC,mBAAA,CAAA,CACfC,oBAAoB,CAACC,MAAAA,CAAO3B,IAAAA,CAAK4B,EAAE,CAAA,EAAGhB,QAAAA,EAAU;wBAC/CW,IAAAA,EAAM,SAAA;AACNH,wBAAAA,QAAAA,EAAUL,+BAAAA,CAAgCd,GAAAA;AACpD,qBAAA,CAAA;oBAEM,MAAM4B,MAAAA,GAAS,MAAMxB,OAAAA,CAClBoB,cAAc,CAAC,mBAAA,CAAA,CACfK,mBAAmB,CAACN,OAAAA,CAAQO,KAAK,CAAA;AACpC,oBAAA,IAAI,WAAWF,MAAAA,EAAQ;AACrB,wBAAA,MAAM,IAAIrC,gBAAAA,CAAiB,qBAAA,CAAA;AACnC,oBAAA;oBAEM,OAAOS,GAAAA,CAAI8C,IAAI,CAAC;AAAEC,wBAAAA,GAAAA,EAAKnB,OAAOE,KAAK;AAAEkB,wBAAAA,YAAAA,EAAczB,QAAQO,KAAK;wBAAE/B,IAAAA,EAAM6L;AAAa,qBAAA,CAAA;AAC3F,gBAAA;gBAEI,MAAM7I,GAAAA,GAAMpE,WAAW,KAAA,CAAA,CAAO4G,KAAK,CAACpH,CAAAA,CAAE+M,IAAI,CAACnL,IAAAA,EAAM;AAAC,oBAAA;AAAK,iBAAA,CAAA,CAAA;gBACvD,OAAOC,GAAAA,CAAI8C,IAAI,CAAC;AAAEC,oBAAAA,GAAAA;oBAAKhD,IAAAA,EAAM6L;AAAa,iBAAA,CAAA;AAC9C,YAAA,CAAA;AAEE,YAAA,MAAME,iBAAAA,CAAAA,CAAkB9L,GAAG,EAAEyH,IAAI,EAAEsE,UAAU,EAAA;gBAC3C,MAAM,EAAEC,cAAcC,iBAAiB,EAAE,GAAG,MAAM7M,6BAAAA,CAA8BY,IAAIwE,KAAK,CAAA;AAEzF,gBAAA,MAAM0H,cAAcvN,UAAAA,CAAW,MAAA,CAAA;AAC/B,gBAAA,MAAMwN,aAAaxN,UAAAA,CAAW,KAAA,CAAA;AAE9B,gBAAA,MAAM,CAACoB,IAAAA,CAAK,GAAG,MAAMmM,WAAAA,CAAYE,QAAQ,CAAC;oBAAEC,OAAAA,EAAS;AAAEJ,wBAAAA;AAAiB;;AAExE,gBAAA,IAAI,CAAClM,IAAAA,EAAM;AACT,oBAAA,MAAM,IAAIP,eAAAA,CAAgB,eAAA,CAAA;AAChC,gBAAA;AAEI,gBAAA,MAAM0M,WAAAA,CAAYpG,IAAI,CAAC/F,IAAAA,CAAK4B,EAAE,EAAE;oBAAEyD,SAAAA,EAAW,IAAA;oBAAM6G,iBAAAA,EAAmB;;AAEtE,gBAAA,IAAIF,UAAAA,EAAY;AACd/L,oBAAAA,GAAAA,CAAI8C,IAAI,CAAC;wBACPC,GAAAA,EAAKoJ,UAAAA,CAAW5G,KAAK,CAAC;AAAE5D,4BAAAA,EAAAA,EAAI5B,KAAK4B;;wBACjC5B,IAAAA,EAAM,MAAMD,aAAaC,IAAAA,EAAMC,GAAAA;AACvC,qBAAA,CAAA;gBACA,CAAA,MAAW;AACL,oBAAA,MAAMuK,QAAAA,GAAW,MAAMnK,OAAAA,CACpB8D,KAAK,CAAC;wBAAE5C,IAAAA,EAAM,QAAA;wBAAUiB,IAAAA,EAAM,mBAAA;wBAAqB6B,GAAAA,EAAK;AAAU,qBAAA,CAAA,CAClEnC,GAAG,EAAA;AAENjC,oBAAAA,GAAAA,CAAIsM,QAAQ,CAAC/B,QAAAA,CAASgC,8BAA8B,IAAI,GAAA,CAAA;AAC9D,gBAAA;AACA,YAAA,CAAA;AAEE,YAAA,MAAMC,uBAAsBxM,GAAG,EAAA;gBAC7B,MAAM,EAAE4E,KAAK,EAAE,GAAG,MAAM3F,iCAAAA,CAAkCe,GAAAA,CAAIgB,OAAO,CAACI,IAAI,CAAA;gBAE1E,MAAMrB,IAAAA,GAAO,MAAMK,OAAAA,CAAOmE,EAAE,CAACC,KAAK,CAAC,gCAAA,CAAA,CAAkCC,OAAO,CAAC;oBAC3EC,KAAAA,EAAO;AAAEE,wBAAAA,KAAAA,EAAOA,MAAMC,WAAW;AAAE;AACzC,iBAAA,CAAA;AAEI,gBAAA,IAAI,CAAC9E,IAAAA,EAAM;oBACT,OAAOC,GAAAA,CAAI8C,IAAI,CAAC;AAAE8B,wBAAAA,KAAAA;wBAAO6H,IAAAA,EAAM;AAAI,qBAAA,CAAA;AACzC,gBAAA;gBAEI,IAAI1M,IAAAA,CAAKqF,SAAS,EAAE;AAClB,oBAAA,MAAM,IAAI7F,gBAAAA,CAAiB,mBAAA,CAAA;AACjC,gBAAA;gBAEI,IAAIQ,IAAAA,CAAKsF,OAAO,EAAE;AAChB,oBAAA,MAAM,IAAI9F,gBAAAA,CAAiB,cAAA,CAAA;AACjC,gBAAA;gBAEI,MAAMZ,UAAAA,CAAW,MAAA,CAAA,CAAQkN,qBAAqB,CAAC9L,IAAAA,CAAAA;AAE/CC,gBAAAA,GAAAA,CAAI8C,IAAI,CAAC;AACP8B,oBAAAA,KAAAA,EAAO7E,KAAK6E,KAAK;oBACjB6H,IAAAA,EAAM;AACZ,iBAAA,CAAA;AACA,YAAA;SACA,CAAA;;;;;;"}

package/dist/server/controllers/auth.mjs CHANGED Viewed

@@ -325,7 +325,7 @@ function requireAuth() {
                 if (upSessions?.httpOnly || requestHttpOnly) {
                     const cookieName = upSessions.cookie?.name || 'strapi_up_refresh';
                     const isProduction = process.env.NODE_ENV === 'production';
-                    const { maxAge, ...cookieOptions } = buildRefreshCookieOptions(upSessions, isProduction);
+                    const { maxAge: _maxAge, ...cookieOptions } = buildRefreshCookieOptions(upSessions, isProduction);
                     ctx.cookies.set(cookieName, '', {
                         ...cookieOptions,
                         expires: new Date(0)

package/dist/server/controllers/auth.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"auth.mjs","sources":["../../../server/src/controllers/auth.js"],"sourcesContent":["'use strict';\n\n/*\n Auth.js controller\n \n @description: A set of functions called \"actions\" for managing `Auth`.\n /\n\n/ eslint-disable no-useless-escape */\nconst crypto = require('crypto');\nconst _ = require('lodash');\nconst { concat, compact, isArray } = require('lodash/fp');\nconst utils = require('@strapi/utils');\nconst { getService } = require('../utils');\nconst { buildRefreshCookieOptions } = require('../utils/refresh-cookie-options');\nconst {\n validateCallbackBody,\n validateRegisterBody,\n validateSendEmailConfirmationBody,\n validateForgotPasswordBody,\n validateResetPasswordBody,\n validateEmailConfirmationBody,\n validateChangePasswordBody,\n} = require('./validation/auth');\n\nconst { ApplicationError, ValidationError, ForbiddenError } = utils.errors;\nconst { buildSessionMetadata, sanitizeSessionEntry, sortSessionsForDisplay } = utils;\n\nconst sanitizeUser = (user, ctx) => {\n const { auth } = ctx.state;\n const userSchema = strapi.getModel('plugin::users-permissions.user');\n\n return strapi.contentAPI.sanitize.output(user, userSchema, { auth });\n};\n\nconst extractDeviceId = (requestBody) => {\n const { deviceId } = requestBody \|\| {};\n\n return typeof deviceId === 'string' && deviceId.length > 0 ? deviceId : undefined;\n};\n\nconst buildSessionMetadataFromContext = (ctx) =>\n buildSessionMetadata({\n userAgent: ctx.request.headers['user-agent'],\n });\n\nconst sendRefreshAuthResponse = async (strapi, ctx, user, { metadata } = {}) => {\n const deviceId = extractDeviceId(ctx.request.body);\n const tokenOptions = { type: 'refresh', ...(metadata ? { metadata } : {}) };\n\n const refresh = await strapi\n .sessionManager('users-permissions')\n .generateRefreshToken(String(user.id), deviceId, tokenOptions);\n\n const access = await strapi\n .sessionManager('users-permissions')\n .generateAccessToken(refresh.token);\n if ('error' in access) {\n throw new ApplicationError('Invalid credentials');\n }\n\n const upSessions = strapi.config.get('plugin::users-permissions.sessions');\n const requestHttpOnly = ctx.request.header['x-strapi-refresh-cookie'] === 'httpOnly';\n\n if (upSessions?.httpOnly \|\| requestHttpOnly) {\n const cookieName = upSessions.cookie?.name \|\| 'strapi_up_refresh';\n const isProduction = process.env.NODE_ENV === 'production';\n ctx.cookies.set(cookieName, refresh.token, buildRefreshCookieOptions(upSessions, isProduction));\n return ctx.send({ jwt: access.token, user: await sanitizeUser(user, ctx) });\n }\n\n return ctx.send({\n jwt: access.token,\n refreshToken: refresh.token,\n user: await sanitizeUser(user, ctx),\n });\n};\n\nconst reissueTokensAfterPasswordChange = async (strapi, ctx, user) => {\n const deviceId = extractDeviceId(ctx.request.body);\n\n await strapi.sessionManager('users-permissions').invalidateRefreshToken(String(user.id));\n\n const newDeviceId = deviceId \|\| crypto.randomUUID();\n const refresh = await strapi\n .sessionManager('users-permissions')\n .generateRefreshToken(String(user.id), newDeviceId, { type: 'refresh' });\n\n const access = await strapi\n .sessionManager('users-permissions')\n .generateAccessToken(refresh.token);\n if ('error' in access) {\n throw new ApplicationError('Invalid credentials');\n }\n\n return ctx.send({\n jwt: access.token,\n refreshToken: refresh.token,\n user: await sanitizeUser(user, ctx),\n });\n};\n\nconst revokeLogoutSessions = async (strapi, ctx, userId, { scope, deviceId, body }) => {\n const sessionManager = strapi.sessionManager('users-permissions');\n const upSessions = strapi.config.get('plugin::users-permissions.sessions');\n\n if (scope === 'all') {\n await sessionManager.invalidateRefreshToken(userId);\n return;\n }\n\n if (deviceId) {\n await sessionManager.invalidateRefreshToken(userId, deviceId);\n return;\n }\n\n let currentSessionId = ctx.state.session?.id;\n const cookieName = upSessions?.cookie?.name \|\| 'strapi_up_refresh';\n const refreshToken =\n ctx.cookies.get(cookieName) \|\|\n (typeof body.refreshToken === 'string' ? body.refreshToken : undefined);\n\n if (refreshToken) {\n const validation = await sessionManager.validateRefreshToken(refreshToken);\n if (validation.isValid) {\n currentSessionId = validation.sessionId;\n }\n }\n\n if (currentSessionId) {\n await sessionManager.revokeSessionById(userId, currentSessionId);\n return;\n }\n\n await sessionManager.invalidateRefreshToken(userId);\n};\n\nmodule.exports = ({ strapi }) => ({\n async callback(ctx) {\n const provider = ctx.params.provider \|\| 'local';\n const params = ctx.request.body;\n\n const store = strapi.store({ type: 'plugin', name: 'users-permissions' });\n const grantSettings = await store.get({ key: 'grant' });\n\n const grantProvider = provider === 'local' ? 'email' : provider;\n\n if (!_.get(grantSettings, [grantProvider, 'enabled'])) {\n throw new ApplicationError('This provider is disabled');\n }\n\n if (provider === 'local') {\n await validateCallbackBody(params);\n\n const { identifier } = params;\n\n // Check if the user exists.\n const user = await strapi.db.query('plugin::users-permissions.user').findOne({\n where: {\n provider,\n $or: [{ email: identifier.toLowerCase() }, { username: identifier }],\n },\n });\n\n if (!user) {\n throw new ValidationError('Invalid identifier or password');\n }\n\n if (!user.password) {\n throw new ValidationError('Invalid identifier or password');\n }\n\n const validPassword = await getService('user').validatePassword(\n params.password,\n user.password\n );\n\n if (!validPassword) {\n throw new ValidationError('Invalid identifier or password');\n }\n\n const advancedSettings = await store.get({ key: 'advanced' });\n const requiresConfirmation = _.get(advancedSettings, 'email_confirmation');\n\n if (requiresConfirmation && user.confirmed !== true) {\n throw new ApplicationError('Your account email is not confirmed');\n }\n\n if (user.blocked === true) {\n throw new ApplicationError('Your account has been blocked by an administrator');\n }\n\n const mode = strapi.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');\n if (mode === 'refresh') {\n return sendRefreshAuthResponse(strapi, ctx, user, {\n metadata: buildSessionMetadataFromContext(ctx),\n });\n }\n\n return ctx.send({\n jwt: getService('jwt').issue({ id: user.id }),\n user: await sanitizeUser(user, ctx),\n });\n }\n\n // Connect the user with the third-party provider.\n try {\n const user = await getService('providers').connect(provider, ctx.query);\n\n if (user.blocked) {\n throw new ForbiddenError('Your account has been blocked by an administrator');\n }\n\n const mode = strapi.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');\n if (mode === 'refresh') {\n return sendRefreshAuthResponse(strapi, ctx, user, {\n metadata: buildSessionMetadataFromContext(ctx),\n });\n }\n\n return ctx.send({\n jwt: getService('jwt').issue({ id: user.id }),\n user: await sanitizeUser(user, ctx),\n });\n } catch (error) {\n throw new ApplicationError(error.message);\n }\n },\n\n async changePassword(ctx) {\n if (!ctx.state.user) {\n throw new ApplicationError('You must be authenticated to reset your password');\n }\n\n const validations = strapi.config.get('plugin::users-permissions.validationRules');\n\n const { currentPassword, password } = await validateChangePasswordBody(\n ctx.request.body,\n validations\n );\n\n const user = await strapi.db\n .query('plugin::users-permissions.user')\n .findOne({ where: { id: ctx.state.user.id } });\n\n const validPassword = await getService('user').validatePassword(currentPassword, user.password);\n\n if (!validPassword) {\n throw new ValidationError('The provided current password is invalid');\n }\n\n if (currentPassword === password) {\n throw new ValidationError('Your new password must be different than your current password');\n }\n\n await getService('user').edit(user.id, { password });\n\n const mode = strapi.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');\n if (mode === 'refresh') {\n return reissueTokensAfterPasswordChange(strapi, ctx, user);\n }\n\n return ctx.send({\n jwt: getService('jwt').issue({ id: user.id }),\n user: await sanitizeUser(user, ctx),\n });\n },\n\n async resetPassword(ctx) {\n const validations = strapi.config.get('plugin::users-permissions.validationRules');\n\n const { password, passwordConfirmation, code } = await validateResetPasswordBody(\n ctx.request.body,\n validations\n );\n\n if (password !== passwordConfirmation) {\n throw new ValidationError('Passwords do not match');\n }\n\n const user = await strapi.db\n .query('plugin::users-permissions.user')\n .findOne({ where: { resetPasswordToken: code } });\n\n if (!user) {\n throw new ValidationError('Incorrect code provided');\n }\n\n await getService('user').edit(user.id, {\n resetPasswordToken: null,\n password,\n });\n\n const mode = strapi.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');\n if (mode === 'refresh') {\n return reissueTokensAfterPasswordChange(strapi, ctx, user);\n }\n\n return ctx.send({\n jwt: getService('jwt').issue({ id: user.id }),\n user: await sanitizeUser(user, ctx),\n });\n },\n async refresh(ctx) {\n const mode = strapi.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');\n if (mode !== 'refresh') {\n return ctx.notFound();\n }\n\n const upSessions = strapi.config.get('plugin::users-permissions.sessions');\n const cookieName = upSessions?.cookie?.name \|\| 'strapi_up_refresh';\n\n // Check for refresh token in cookie first (if httpOnly is configured), then in body\n let refreshToken = ctx.cookies.get(cookieName);\n if (!refreshToken) {\n refreshToken = ctx.request.body?.refreshToken;\n }\n\n if (!refreshToken \|\| typeof refreshToken !== 'string') {\n return ctx.badRequest('Missing refresh token');\n }\n\n const rotation = await strapi\n .sessionManager('users-permissions')\n .rotateRefreshToken(refreshToken);\n if ('error' in rotation) {\n return ctx.unauthorized('Invalid refresh token');\n }\n\n const result = await strapi\n .sessionManager('users-permissions')\n .generateAccessToken(rotation.token);\n if ('error' in result) {\n return ctx.unauthorized('Invalid refresh token');\n }\n\n const requestHttpOnly = ctx.request.header['x-strapi-refresh-cookie'] === 'httpOnly';\n if (upSessions?.httpOnly \|\| requestHttpOnly) {\n const isProduction = process.env.NODE_ENV === 'production';\n ctx.cookies.set(\n cookieName,\n rotation.token,\n buildRefreshCookieOptions(upSessions, isProduction)\n );\n return ctx.send({ jwt: result.token });\n }\n return ctx.send({ jwt: result.token, refreshToken: rotation.token });\n },\n async logout(ctx) {\n const mode = strapi.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');\n if (mode !== 'refresh') {\n return ctx.notFound();\n }\n\n if (!ctx.state.user) {\n return ctx.unauthorized('Missing authentication');\n }\n\n const userId = String(ctx.state.user.id);\n const upSessions = strapi.config.get('plugin::users-permissions.sessions');\n const body = ctx.request.body \|\| {};\n const scope = typeof body.scope === 'string' ? body.scope : undefined;\n const deviceId = extractDeviceId(body);\n\n try {\n await revokeLogoutSessions(strapi, ctx, userId, { scope, deviceId, body });\n } catch (err) {\n strapi.log.error('UP logout failed', err);\n }\n\n const requestHttpOnly = ctx.request.header['x-strapi-refresh-cookie'] === 'httpOnly';\n if (upSessions?.httpOnly \|\| requestHttpOnly) {\n const cookieName = upSessions.cookie?.name \|\| 'strapi_up_refresh';\n const isProduction = process.env.NODE_ENV === 'production';\n\n const { maxAge, ...cookieOptions } = buildRefreshCookieOptions(upSessions, isProduction);\n\n ctx.cookies.set(cookieName, '', { ...cookieOptions, expires: new Date(0) });\n }\n return ctx.send({ ok: true });\n },\n async getSessions(ctx) {\n const mode = strapi.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');\n if (mode !== 'refresh') {\n return ctx.notFound();\n }\n\n if (!ctx.state.user) {\n return ctx.unauthorized('Missing authentication');\n }\n\n const currentSessionId = ctx.state.session?.id;\n const sessions = await strapi\n .sessionManager('users-permissions')\n .listSessions(String(ctx.state.user.id));\n\n const data = sortSessionsForDisplay(\n sessions.map((session) => sanitizeSessionEntry(session, currentSessionId))\n );\n\n return ctx.send({ data });\n },\n async revokeSession(ctx) {\n const mode = strapi.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');\n if (mode !== 'refresh') {\n return ctx.notFound();\n }\n\n if (!ctx.state.user) {\n return ctx.unauthorized('Missing authentication');\n }\n\n const { sessionId } = ctx.params;\n const revoked = await strapi\n .sessionManager('users-permissions')\n .revokeSessionById(String(ctx.state.user.id), sessionId);\n\n if (!revoked) {\n return ctx.notFound('Session not found');\n }\n\n return ctx.send({ data: {} });\n },\n async connect(ctx, next) {\n const providers = await strapi\n .store({ type: 'plugin', name: 'users-permissions', key: 'grant' })\n .get();\n\n const [requestPath] = ctx.request.url.split('?');\n const provider = requestPath.split('/connect/')[1].split('/')[0];\n\n if (!_.get(providers, [provider, 'enabled'])) {\n throw new ApplicationError('This provider is disabled');\n }\n\n if (!strapi.config.server.url.startsWith('http')) {\n strapi.log.warn(\n 'You are using a third party provider for login. Make sure to set an absolute url in config/server.js. More info here: https://docs.strapi.io/developer-docs/latest/plugins/users-permissions.html#setting-up-the-server-url'\n );\n }\n\n const queryCustomCallback = _.get(ctx, 'query.callback');\n const dynamicSessionCallback = _.get(ctx, 'session.grant.dynamic.callback');\n const customCallback = queryCustomCallback ?? dynamicSessionCallback;\n\n if (customCallback !== undefined) {\n try {\n const { validate: validateCallback } = strapi\n .plugin('users-permissions')\n .config('callback');\n\n await validateCallback(customCallback, providers[provider]);\n\n // Persist across the provider redirect round-trip (request state alone is lost).\n ctx.session = ctx.session \|\| {};\n ctx.session.grant = ctx.session.grant \|\| {};\n ctx.session.grant.dynamic = {\n ...ctx.session.grant.dynamic,\n callback: customCallback,\n };\n ctx.state.oauthConnect = { callback: customCallback };\n } catch {\n throw new ValidationError('Invalid callback URL provided', { callback: customCallback });\n }\n }\n\n const { createOAuthConnectMiddleware } = require('../utils/oauth-connect');\n const oauthConnect = createOAuthConnectMiddleware();\n\n return oauthConnect(ctx, next);\n },\n\n async forgotPassword(ctx) {\n const { email } = await validateForgotPasswordBody(ctx.request.body);\n\n const pluginStore = await strapi.store({ type: 'plugin', name: 'users-permissions' });\n\n const emailSettings = await pluginStore.get({ key: 'email' });\n const advancedSettings = await pluginStore.get({ key: 'advanced' });\n\n // Find the user by email.\n const user = await strapi.db\n .query('plugin::users-permissions.user')\n .findOne({ where: { email: email.toLowerCase() } });\n\n if (!user \|\| user.blocked) {\n return ctx.send({ ok: true });\n }\n\n // Generate random token.\n const userInfo = await sanitizeUser(user, ctx);\n\n const resetPasswordToken = crypto.randomBytes(64).toString('hex');\n\n const resetPasswordSettings = _.get(emailSettings, 'reset_password.options', {});\n const emailBody = await getService('users-permissions').template(\n resetPasswordSettings.message,\n {\n URL: advancedSettings.email_reset_password,\n SERVER_URL: strapi.config.get('server.absoluteUrl'),\n ADMIN_URL: strapi.config.get('admin.absoluteUrl'),\n USER: userInfo,\n TOKEN: resetPasswordToken,\n }\n );\n\n const emailObject = await getService('users-permissions').template(\n resetPasswordSettings.object,\n {\n USER: userInfo,\n }\n );\n\n const emailToSend = {\n to: user.email,\n from:\n resetPasswordSettings.from.email \|\| resetPasswordSettings.from.name\n ? `${resetPasswordSettings.from.name} <${resetPasswordSettings.from.email}>`\n : undefined,\n replyTo: resetPasswordSettings.response_email,\n subject: emailObject,\n text: emailBody,\n html: emailBody,\n };\n\n // NOTE: Update the user before sending the email so an Admin can generate the link if the email fails\n await getService('user').edit(user.id, { resetPasswordToken });\n\n // Send an email to the user.\n await strapi.plugin('email').service('email').send(emailToSend);\n\n ctx.send({ ok: true });\n },\n\n async register(ctx) {\n const pluginStore = await strapi.store({ type: 'plugin', name: 'users-permissions' });\n\n const settings = await pluginStore.get({ key: 'advanced' });\n\n if (!settings.allow_register) {\n throw new ApplicationError('Register action is currently disabled');\n }\n\n const { register } = strapi.config.get('plugin::users-permissions');\n const alwaysAllowedKeys = ['username', 'password', 'email'];\n\n // Note that we intentionally do not filter allowedFields to allow a project to explicitly accept private or other Strapi field on registration\n const allowedKeys = compact(\n concat(alwaysAllowedKeys, isArray(register?.allowedFields) ? register.allowedFields : [])\n );\n\n // Check if there are any keys in requestBody that are not in allowedKeys\n const invalidKeys = Object.keys(ctx.request.body).filter((key) => !allowedKeys.includes(key));\n\n if (invalidKeys.length > 0) {\n // If there are invalid keys, throw an error\n throw new ValidationError(`Invalid parameters: ${invalidKeys.join(', ')}`);\n }\n\n const params = {\n ..._.pick(ctx.request.body, allowedKeys),\n provider: 'local',\n };\n\n const validations = strapi.config.get('plugin::users-permissions.validationRules');\n\n await validateRegisterBody(params, validations);\n\n const role = await strapi.db\n .query('plugin::users-permissions.role')\n .findOne({ where: { type: settings.default_role } });\n\n if (!role) {\n throw new ApplicationError('Impossible to find the default role');\n }\n\n const { email, username, provider } = params;\n\n const identifierFilter = {\n $or: [\n { email: email.toLowerCase() },\n { username: email.toLowerCase() },\n { username },\n { email: username },\n ],\n };\n\n const conflictingUserCount = await strapi.db.query('plugin::users-permissions.user').count({\n where: { ...identifierFilter, provider },\n });\n\n if (conflictingUserCount > 0) {\n throw new ApplicationError('Email or Username are already taken');\n }\n\n if (settings.unique_email) {\n const conflictingUserCount = await strapi.db.query('plugin::users-permissions.user').count({\n where: { ...identifierFilter },\n });\n\n if (conflictingUserCount > 0) {\n throw new ApplicationError('Email or Username are already taken');\n }\n }\n\n const newUser = {\n ...params,\n role: role.id,\n email: email.toLowerCase(),\n username,\n confirmed: !settings.email_confirmation,\n };\n\n const user = await getService('user').add(newUser);\n\n const sanitizedUser = await sanitizeUser(user, ctx);\n\n if (settings.email_confirmation) {\n try {\n await getService('user').sendConfirmationEmail(sanitizedUser);\n } catch (err) {\n strapi.log.error(err);\n throw new ApplicationError('Error sending confirmation email');\n }\n\n return ctx.send({ user: sanitizedUser });\n }\n\n const mode = strapi.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');\n if (mode === 'refresh') {\n const deviceId = extractDeviceId(ctx.request.body) \|\| crypto.randomUUID();\n\n const refresh = await strapi\n .sessionManager('users-permissions')\n .generateRefreshToken(String(user.id), deviceId, {\n type: 'refresh',\n metadata: buildSessionMetadataFromContext(ctx),\n });\n\n const access = await strapi\n .sessionManager('users-permissions')\n .generateAccessToken(refresh.token);\n if ('error' in access) {\n throw new ApplicationError('Invalid credentials');\n }\n\n return ctx.send({ jwt: access.token, refreshToken: refresh.token, user: sanitizedUser });\n }\n\n const jwt = getService('jwt').issue(_.pick(user, ['id']));\n return ctx.send({ jwt, user: sanitizedUser });\n },\n\n async emailConfirmation(ctx, next, returnUser) {\n const { confirmation: confirmationToken } = await validateEmailConfirmationBody(ctx.query);\n\n const userService = getService('user');\n const jwtService = getService('jwt');\n\n const [user] = await userService.fetchAll({ filters: { confirmationToken } });\n\n if (!user) {\n throw new ValidationError('Invalid token');\n }\n\n await userService.edit(user.id, { confirmed: true, confirmationToken: null });\n\n if (returnUser) {\n ctx.send({\n jwt: jwtService.issue({ id: user.id }),\n user: await sanitizeUser(user, ctx),\n });\n } else {\n const settings = await strapi\n .store({ type: 'plugin', name: 'users-permissions', key: 'advanced' })\n .get();\n\n ctx.redirect(settings.email_confirmation_redirection \|\| '/');\n }\n },\n\n async sendEmailConfirmation(ctx) {\n const { email } = await validateSendEmailConfirmationBody(ctx.request.body);\n\n const user = await strapi.db.query('plugin::users-permissions.user').findOne({\n where: { email: email.toLowerCase() },\n });\n\n if (!user) {\n return ctx.send({ email, sent: true });\n }\n\n if (user.confirmed) {\n throw new ApplicationError('Already confirmed');\n }\n\n if (user.blocked) {\n throw new ApplicationError('User blocked');\n }\n\n await getService('user').sendConfirmationEmail(user);\n\n ctx.send({\n email: user.email,\n sent: true,\n });\n },\n});\n"],"names":["crypto","require$$0","_","require$$1","concat","compact","isArray","require$$2","utils","require$$3","getService","require$$4","buildRefreshCookieOptions","require$$5","validateCallbackBody","validateRegisterBody","validateSendEmailConfirmationBody","validateForgotPasswordBody","validateResetPasswordBody","validateEmailConfirmationBody","validateChangePasswordBody","require$$6","ApplicationError","ValidationError","ForbiddenError","errors","buildSessionMetadata","sanitizeSessionEntry","sortSessionsForDisplay","sanitizeUser","user","ctx","auth","state","userSchema","strapi","getModel","contentAPI","sanitize","output","extractDeviceId","requestBody","deviceId","length","undefined","buildSessionMetadataFromContext","userAgent","request","headers","sendRefreshAuthResponse","metadata","body","tokenOptions","type","refresh","sessionManager","generateRefreshToken","String","id","access","generateAccessToken","token","upSessions","config","get","requestHttpOnly","header","httpOnly","cookieName","cookie","name","isProduction","process","env","NODE_ENV","cookies","set","send","jwt","refreshToken","reissueTokensAfterPasswordChange","invalidateRefreshToken","newDeviceId","randomUUID","revokeLogoutSessions","userId","scope","currentSessionId","session","validation","validateRefreshToken","isValid","sessionId","revokeSessionById","callback","provider","params","store","grantSettings","key","grantProvider","identifier","db","query","findOne","where","$or","email","toLowerCase","username","password","validPassword","validatePassword","advancedSettings","requiresConfirmation","confirmed","blocked","mode","issue","connect","error","message","changePassword","validations","currentPassword","edit","resetPassword","passwordConfirmation","code","resetPasswordToken","notFound","badRequest","rotation","rotateRefreshToken","unauthorized","result","logout","err","log","maxAge","cookieOptions","expires","Date","ok","getSessions","sessions","listSessions","data","map","revokeSession","revoked","next","providers","requestPath","url","split","server","startsWith","warn","queryCustomCallback","dynamicSessionCallback","customCallback","validate","validateCallback","plugin","grant","dynamic","oauthConnect","createOAuthConnectMiddleware","require$$7","forgotPassword","pluginStore","emailSettings","userInfo","randomBytes","toString","resetPasswordSettings","emailBody","template","URL","email_reset_password","SERVER_URL","ADMIN_URL","USER","TOKEN","emailObject","object","emailToSend","to","from","replyTo","response_email","subject","text","html","service","register","settings","allow_register","alwaysAllowedKeys","allowedKeys","allowedFields","invalidKeys","Object","keys","filter","includes","join","pick","role","default_role","identifierFilter","conflictingUserCount","count","unique_email","newUser","email_confirmation","add","sanitizedUser","sendConfirmationEmail","emailConfirmation","returnUser","confirmation","confirmationToken","userService","jwtService","fetchAll","filters","redirect","email_confirmation_redirection","sendEmailConfirmation","sent"],"mappings":";;;;;;;;;;;;;;AAEA;;;;4CAOA,MAAMA,MAAAA,GAASC,YAAAA;AACf,IAAA,MAAMC,CAAAA,GAAIC,YAAAA;AACV,IAAA,MAAM,EAAEC,MAAM,EAAEC,OAAO,EAAEC,OAAO,EAAE,GAAGC,UAAAA;AACrC,IAAA,MAAMC,KAAAA,GAAQC,UAAAA;IACd,MAAM,EAAEC,UAAU,EAAE,GAAGC,YAAAA,EAAAA;IACvB,MAAM,EAAEC,yBAAyB,EAAE,GAAGC,2BAAAA,EAAAA;AACtC,IAAA,MAAM,EACJC,oBAAoB,EACpBC,oBAAoB,EACpBC,iCAAiC,EACjCC,0BAA0B,EAC1BC,yBAAyB,EACzBC,6BAA6B,EAC7BC,0BAA0B,EAC3B,GAAGC,aAAAA,EAAAA;IAEJ,MAAM,EAAEC,gBAAgB,EAAEC,eAAe,EAAEC,cAAc,EAAE,GAAGhB,KAAAA,CAAMiB,MAAM;AAC1E,IAAA,MAAM,EAAEC,oBAAoB,EAAEC,oBAAoB,EAAEC,sBAAsB,EAAE,GAAGpB,KAAAA;IAE/E,MAAMqB,YAAAA,GAAe,CAACC,IAAAA,EAAMC,GAAAA,GAAAA;AAC1B,QAAA,MAAM,EAAEC,IAAI,EAAE,GAAGD,IAAIE,KAAK;QAC1B,MAAMC,UAAAA,GAAaC,MAAAA,CAAOC,QAAQ,CAAC,gCAAA,CAAA;QAEnC,OAAOD,MAAAA,CAAOE,UAAU,CAACC,QAAQ,CAACC,MAAM,CAACT,MAAMI,UAAAA,EAAY;AAAEF,YAAAA;;AAC/D,IAAA,CAAA;AAEA,IAAA,MAAMQ,kBAAkB,CAACC,WAAAA,GAAAA;AACvB,QAAA,MAAM,EAAEC,QAAQ,EAAE,GAAGD,eAAe,EAAA;AAEpC,QAAA,OAAO,OAAOC,QAAAA,KAAa,QAAA,IAAYA,SAASC,MAAM,GAAG,IAAID,QAAAA,GAAWE,SAAAA;AAC1E,IAAA,CAAA;IAEA,MAAMC,+BAAAA,GAAkC,CAACd,GAAAA,GACvCL,oBAAAA,CAAqB;AACnBoB,YAAAA,SAAAA,EAAWf,GAAAA,CAAIgB,OAAO,CAACC,OAAO,CAAC,YAAA;AACnC,SAAA,CAAA;IAEA,MAAMC,uBAAAA,GAA0B,OAAOd,OAAAA,EAAQJ,GAAAA,EAAKD,IAAAA,EAAM,EAAEoB,QAAQ,EAAE,GAAG,EAAE,GAAA;AACzE,QAAA,MAAMR,QAAAA,GAAWF,eAAAA,CAAgBT,GAAAA,CAAIgB,OAAO,CAACI,IAAI,CAAA;AACjD,QAAA,MAAMC,YAAAA,GAAe;YAAEC,IAAAA,EAAM,SAAA;AAAW,YAAA,GAAIH,QAAAA,GAAW;AAAEA,gBAAAA;gBAAa;AAAG,SAAA;AAEzE,QAAA,MAAMI,OAAAA,GAAU,MAAMnB,OAAAA,CACnBoB,cAAc,CAAC,mBAAA,CAAA,CACfC,oBAAoB,CAACC,MAAAA,CAAO3B,IAAAA,CAAK4B,EAAE,CAAA,EAAGhB,QAAAA,EAAUU,YAAAA,CAAAA;QAEnD,MAAMO,MAAAA,GAAS,MAAMxB,OAAAA,CAClBoB,cAAc,CAAC,mBAAA,CAAA,CACfK,mBAAmB,CAACN,OAAAA,CAAQO,KAAK,CAAA;AACpC,QAAA,IAAI,WAAWF,MAAAA,EAAQ;AACrB,YAAA,MAAM,IAAIrC,gBAAAA,CAAiB,qBAAA,CAAA;AAC/B,QAAA;AAEE,QAAA,MAAMwC,UAAAA,GAAa3B,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,oCAAA,CAAA;AACrC,QAAA,MAAMC,kBAAkBlC,GAAAA,CAAIgB,OAAO,CAACmB,MAAM,CAAC,0BAA0B,KAAK,UAAA;QAE1E,IAAIJ,UAAAA,EAAYK,YAAYF,eAAAA,EAAiB;AAC3C,YAAA,MAAMG,UAAAA,GAAaN,UAAAA,CAAWO,MAAM,EAAEC,IAAAA,IAAQ,mBAAA;AAC9C,YAAA,MAAMC,YAAAA,GAAeC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;YAC9C3C,GAAAA,CAAI4C,OAAO,CAACC,GAAG,CAACR,YAAYd,OAAAA,CAAQO,KAAK,EAAEjD,yBAAAA,CAA0BkD,UAAAA,EAAYS,YAAAA,CAAAA,CAAAA;YACjF,OAAOxC,GAAAA,CAAI8C,IAAI,CAAC;AAAEC,gBAAAA,GAAAA,EAAKnB,OAAOE,KAAK;gBAAE/B,IAAAA,EAAM,MAAMD,aAAaC,IAAAA,EAAMC,GAAAA;AAAI,aAAA,CAAA;AAC5E,QAAA;QAEE,OAAOA,GAAAA,CAAI8C,IAAI,CAAC;AACdC,YAAAA,GAAAA,EAAKnB,OAAOE,KAAK;AACjBkB,YAAAA,YAAAA,EAAczB,QAAQO,KAAK;YAC3B/B,IAAAA,EAAM,MAAMD,aAAaC,IAAAA,EAAMC,GAAAA;AACnC,SAAA,CAAA;AACA,IAAA,CAAA;IAEA,MAAMiD,gCAAAA,GAAmC,OAAO7C,OAAAA,EAAQJ,GAAAA,EAAKD,IAAAA,GAAAA;AAC3D,QAAA,MAAMY,QAAAA,GAAWF,eAAAA,CAAgBT,GAAAA,CAAIgB,OAAO,CAACI,IAAI,CAAA;QAEjD,MAAMhB,OAAAA,CAAOoB,cAAc,CAAC,mBAAA,CAAA,CAAqB0B,sBAAsB,CAACxB,MAAAA,CAAO3B,KAAK4B,EAAE,CAAA,CAAA;QAEtF,MAAMwB,WAAAA,GAAcxC,QAAAA,IAAY1C,MAAAA,CAAOmF,UAAU,EAAA;AACjD,QAAA,MAAM7B,OAAAA,GAAU,MAAMnB,OAAAA,CACnBoB,cAAc,CAAC,mBAAA,CAAA,CACfC,oBAAoB,CAACC,MAAAA,CAAO3B,IAAAA,CAAK4B,EAAE,CAAA,EAAGwB,WAAAA,EAAa;YAAE7B,IAAAA,EAAM;;QAE9D,MAAMM,MAAAA,GAAS,MAAMxB,OAAAA,CAClBoB,cAAc,CAAC,mBAAA,CAAA,CACfK,mBAAmB,CAACN,OAAAA,CAAQO,KAAK,CAAA;AACpC,QAAA,IAAI,WAAWF,MAAAA,EAAQ;AACrB,YAAA,MAAM,IAAIrC,gBAAAA,CAAiB,qBAAA,CAAA;AAC/B,QAAA;QAEE,OAAOS,GAAAA,CAAI8C,IAAI,CAAC;AACdC,YAAAA,GAAAA,EAAKnB,OAAOE,KAAK;AACjBkB,YAAAA,YAAAA,EAAczB,QAAQO,KAAK;YAC3B/B,IAAAA,EAAM,MAAMD,aAAaC,IAAAA,EAAMC,GAAAA;AACnC,SAAA,CAAA;AACA,IAAA,CAAA;IAEA,MAAMqD,oBAAAA,GAAuB,OAAOjD,OAAAA,EAAQJ,GAAAA,EAAKsD,MAAAA,EAAQ,EAAEC,KAAK,EAAE5C,QAAQ,EAAES,IAAI,EAAE,GAAA;QAChF,MAAMI,cAAAA,GAAiBpB,OAAAA,CAAOoB,cAAc,CAAC,mBAAA,CAAA;AAC7C,QAAA,MAAMO,UAAAA,GAAa3B,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,oCAAA,CAAA;AAErC,QAAA,IAAIsB,UAAU,KAAA,EAAO;YACnB,MAAM/B,cAAAA,CAAe0B,sBAAsB,CAACI,MAAAA,CAAAA;AAC5C,YAAA;AACJ,QAAA;AAEE,QAAA,IAAI3C,QAAAA,EAAU;YACZ,MAAMa,cAAAA,CAAe0B,sBAAsB,CAACI,MAAAA,EAAQ3C,QAAAA,CAAAA;AACpD,YAAA;AACJ,QAAA;AAEE,QAAA,IAAI6C,gBAAAA,GAAmBxD,GAAAA,CAAIE,KAAK,CAACuD,OAAO,EAAE9B,EAAAA;QAC1C,MAAMU,UAAAA,GAAaN,UAAAA,EAAYO,MAAAA,EAAQC,IAAAA,IAAQ,mBAAA;AAC/C,QAAA,MAAMS,eACJhD,GAAAA,CAAI4C,OAAO,CAACX,GAAG,CAACI,UAAAA,CAAAA,KACf,OAAOjB,IAAAA,CAAK4B,YAAY,KAAK,QAAA,GAAW5B,IAAAA,CAAK4B,YAAY,GAAGnC,SAAA,CAAA;AAE/D,QAAA,IAAImC,YAAAA,EAAc;AAChB,YAAA,MAAMU,UAAAA,GAAa,MAAMlC,cAAAA,CAAemC,oBAAoB,CAACX,YAAAA,CAAAA;YAC7D,IAAIU,UAAAA,CAAWE,OAAO,EAAE;AACtBJ,gBAAAA,gBAAAA,GAAmBE,WAAWG,SAAS;AAC7C,YAAA;AACA,QAAA;AAEE,QAAA,IAAIL,gBAAAA,EAAkB;YACpB,MAAMhC,cAAAA,CAAesC,iBAAiB,CAACR,MAAAA,EAAQE,gBAAAA,CAAAA;AAC/C,YAAA;AACJ,QAAA;QAEE,MAAMhC,cAAAA,CAAe0B,sBAAsB,CAACI,MAAAA,CAAAA;AAC9C,IAAA,CAAA;AAEArD,IAAAA,IAAAA,GAAiB,CAAC,EAAEG,MAAAA,EAAAA,OAAM,EAAE,IAAM;AAChC,YAAA,MAAM2D,UAAS/D,GAAG,EAAA;AAChB,gBAAA,MAAMgE,QAAAA,GAAWhE,GAAAA,CAAIiE,MAAM,CAACD,QAAQ,IAAI,OAAA;AACxC,gBAAA,MAAMC,MAAAA,GAASjE,GAAAA,CAAIgB,OAAO,CAACI,IAAI;gBAE/B,MAAM8C,KAAAA,GAAQ9D,OAAAA,CAAO8D,KAAK,CAAC;oBAAE5C,IAAAA,EAAM,QAAA;oBAAUiB,IAAAA,EAAM;;AACnD,gBAAA,MAAM4B,aAAAA,GAAgB,MAAMD,KAAAA,CAAMjC,GAAG,CAAC;oBAAEmC,GAAAA,EAAK;;gBAE7C,MAAMC,aAAAA,GAAgBL,QAAAA,KAAa,OAAA,GAAU,OAAA,GAAUA,QAAAA;AAEvD,gBAAA,IAAI,CAAC7F,CAAAA,CAAE8D,GAAG,CAACkC,aAAAA,EAAe;AAACE,oBAAAA,aAAAA;AAAe,oBAAA;iBAAU,CAAA,EAAG;AACrD,oBAAA,MAAM,IAAI9E,gBAAAA,CAAiB,2BAAA,CAAA;AACjC,gBAAA;AAEI,gBAAA,IAAIyE,aAAa,OAAA,EAAS;AACxB,oBAAA,MAAMjF,oBAAAA,CAAqBkF,MAAAA,CAAAA;oBAE3B,MAAM,EAAEK,UAAU,EAAE,GAAGL,MAAAA;;oBAGvB,MAAMlE,IAAAA,GAAO,MAAMK,OAAAA,CAAOmE,EAAE,CAACC,KAAK,CAAC,gCAAA,CAAA,CAAkCC,OAAO,CAAC;wBAC3EC,KAAAA,EAAO;AACLV,4BAAAA,QAAAA;4BACAW,GAAAA,EAAK;AAAC,gCAAA;AAAEC,oCAAAA,KAAAA,EAAON,WAAWO,WAAW;;AAAM,gCAAA;oCAAEC,QAAAA,EAAUR;;AAAa;AAC9E;AACA,qBAAA,CAAA;AAEM,oBAAA,IAAI,CAACvE,IAAAA,EAAM;AACT,wBAAA,MAAM,IAAIP,eAAAA,CAAgB,gCAAA,CAAA;AAClC,oBAAA;oBAEM,IAAI,CAACO,IAAAA,CAAKgF,QAAQ,EAAE;AAClB,wBAAA,MAAM,IAAIvF,eAAAA,CAAgB,gCAAA,CAAA;AAClC,oBAAA;oBAEM,MAAMwF,aAAAA,GAAgB,MAAMrG,UAAAA,CAAW,MAAA,CAAA,CAAQsG,gBAAgB,CAC7DhB,MAAAA,CAAOc,QAAQ,EACfhF,IAAAA,CAAKgF,QAAA,CAAA;AAGP,oBAAA,IAAI,CAACC,aAAAA,EAAe;AAClB,wBAAA,MAAM,IAAIxF,eAAAA,CAAgB,gCAAA,CAAA;AAClC,oBAAA;AAEM,oBAAA,MAAM0F,gBAAAA,GAAmB,MAAMhB,KAAAA,CAAMjC,GAAG,CAAC;wBAAEmC,GAAAA,EAAK;;AAChD,oBAAA,MAAMe,oBAAAA,GAAuBhH,CAAAA,CAAE8D,GAAG,CAACiD,gBAAAA,EAAkB,oBAAA,CAAA;AAErD,oBAAA,IAAIC,oBAAAA,IAAwBpF,IAAAA,CAAKqF,SAAS,KAAK,IAAA,EAAM;AACnD,wBAAA,MAAM,IAAI7F,gBAAAA,CAAiB,qCAAA,CAAA;AACnC,oBAAA;oBAEM,IAAIQ,IAAAA,CAAKsF,OAAO,KAAK,IAAA,EAAM;AACzB,wBAAA,MAAM,IAAI9F,gBAAAA,CAAiB,mDAAA,CAAA;AACnC,oBAAA;AAEM,oBAAA,MAAM+F,OAAOlF,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,yCAAA,EAA2C,gBAAA,CAAA;AAC1E,oBAAA,IAAIqD,SAAS,SAAA,EAAW;wBACtB,OAAOpE,uBAAAA,CAAwBd,OAAAA,EAAQJ,GAAAA,EAAKD,IAAAA,EAAM;AAChDoB,4BAAAA,QAAAA,EAAUL,+BAAAA,CAAgCd,GAAAA;AACpD,yBAAA,CAAA;AACA,oBAAA;oBAEM,OAAOA,GAAAA,CAAI8C,IAAI,CAAC;wBACdC,GAAAA,EAAKpE,UAAAA,CAAW,KAAA,CAAA,CAAO4G,KAAK,CAAC;AAAE5D,4BAAAA,EAAAA,EAAI5B,KAAK4B;;wBACxC5B,IAAAA,EAAM,MAAMD,aAAaC,IAAAA,EAAMC,GAAAA;AACvC,qBAAA,CAAA;AACA,gBAAA;;gBAGI,IAAI;oBACF,MAAMD,IAAAA,GAAO,MAAMpB,UAAAA,CAAW,WAAA,CAAA,CAAa6G,OAAO,CAACxB,QAAAA,EAAUhE,IAAIwE,KAAK,CAAA;oBAEtE,IAAIzE,IAAAA,CAAKsF,OAAO,EAAE;AAChB,wBAAA,MAAM,IAAI5F,cAAAA,CAAe,mDAAA,CAAA;AACjC,oBAAA;AAEM,oBAAA,MAAM6F,OAAOlF,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,yCAAA,EAA2C,gBAAA,CAAA;AAC1E,oBAAA,IAAIqD,SAAS,SAAA,EAAW;wBACtB,OAAOpE,uBAAAA,CAAwBd,OAAAA,EAAQJ,GAAAA,EAAKD,IAAAA,EAAM;AAChDoB,4BAAAA,QAAAA,EAAUL,+BAAAA,CAAgCd,GAAAA;AACpD,yBAAA,CAAA;AACA,oBAAA;oBAEM,OAAOA,GAAAA,CAAI8C,IAAI,CAAC;wBACdC,GAAAA,EAAKpE,UAAAA,CAAW,KAAA,CAAA,CAAO4G,KAAK,CAAC;AAAE5D,4BAAAA,EAAAA,EAAI5B,KAAK4B;;wBACxC5B,IAAAA,EAAM,MAAMD,aAAaC,IAAAA,EAAMC,GAAAA;AACvC,qBAAA,CAAA;AACA,gBAAA,CAAA,CAAM,OAAOyF,KAAAA,EAAO;oBACd,MAAM,IAAIlG,gBAAAA,CAAiBkG,KAAAA,CAAMC,OAAO,CAAA;AAC9C,gBAAA;AACA,YAAA,CAAA;AAEE,YAAA,MAAMC,gBAAe3F,GAAG,EAAA;AACtB,gBAAA,IAAI,CAACA,GAAAA,CAAIE,KAAK,CAACH,IAAI,EAAE;AACnB,oBAAA,MAAM,IAAIR,gBAAAA,CAAiB,kDAAA,CAAA;AACjC,gBAAA;AAEI,gBAAA,MAAMqG,WAAAA,GAAcxF,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,2CAAA,CAAA;AAEtC,gBAAA,MAAM,EAAE4D,eAAe,EAAEd,QAAQ,EAAE,GAAG,MAAM1F,0BAAAA,CAC1CW,GAAAA,CAAIgB,OAAO,CAACI,IAAI,EAChBwE,WAAAA,CAAAA;gBAGF,MAAM7F,IAAAA,GAAO,MAAMK,OAAAA,CAAOmE,EAAA,CACvBC,KAAK,CAAC,gCAAA,CAAA,CACNC,OAAO,CAAC;oBAAEC,KAAAA,EAAO;AAAE/C,wBAAAA,EAAAA,EAAI3B,GAAAA,CAAIE,KAAK,CAACH,IAAI,CAAC4B;AAAE;;gBAE3C,MAAMqD,aAAAA,GAAgB,MAAMrG,UAAAA,CAAW,MAAA,CAAA,CAAQsG,gBAAgB,CAACY,eAAAA,EAAiB9F,KAAKgF,QAAQ,CAAA;AAE9F,gBAAA,IAAI,CAACC,aAAAA,EAAe;AAClB,oBAAA,MAAM,IAAIxF,eAAAA,CAAgB,0CAAA,CAAA;AAChC,gBAAA;AAEI,gBAAA,IAAIqG,oBAAoBd,QAAAA,EAAU;AAChC,oBAAA,MAAM,IAAIvF,eAAAA,CAAgB,gEAAA,CAAA;AAChC,gBAAA;AAEI,gBAAA,MAAMb,WAAW,MAAA,CAAA,CAAQmH,IAAI,CAAC/F,IAAAA,CAAK4B,EAAE,EAAE;AAAEoD,oBAAAA;;AAEzC,gBAAA,MAAMO,OAAOlF,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,yCAAA,EAA2C,gBAAA,CAAA;AAC1E,gBAAA,IAAIqD,SAAS,SAAA,EAAW;oBACtB,OAAOrC,gCAAAA,CAAiC7C,SAAQJ,GAAAA,EAAKD,IAAAA,CAAAA;AAC3D,gBAAA;gBAEI,OAAOC,GAAAA,CAAI8C,IAAI,CAAC;oBACdC,GAAAA,EAAKpE,UAAAA,CAAW,KAAA,CAAA,CAAO4G,KAAK,CAAC;AAAE5D,wBAAAA,EAAAA,EAAI5B,KAAK4B;;oBACxC5B,IAAAA,EAAM,MAAMD,aAAaC,IAAAA,EAAMC,GAAAA;AACrC,iBAAA,CAAA;AACA,YAAA,CAAA;AAEE,YAAA,MAAM+F,eAAc/F,GAAG,EAAA;AACrB,gBAAA,MAAM4F,WAAAA,GAAcxF,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,2CAAA,CAAA;AAEtC,gBAAA,MAAM,EAAE8C,QAAQ,EAAEiB,oBAAoB,EAAEC,IAAI,EAAE,GAAG,MAAM9G,yBAAAA,CACrDa,GAAAA,CAAIgB,OAAO,CAACI,IAAI,EAChBwE,WAAAA,CAAAA;AAGF,gBAAA,IAAIb,aAAaiB,oBAAAA,EAAsB;AACrC,oBAAA,MAAM,IAAIxG,eAAAA,CAAgB,wBAAA,CAAA;AAChC,gBAAA;gBAEI,MAAMO,IAAAA,GAAO,MAAMK,OAAAA,CAAOmE,EAAA,CACvBC,KAAK,CAAC,gCAAA,CAAA,CACNC,OAAO,CAAC;oBAAEC,KAAAA,EAAO;wBAAEwB,kBAAAA,EAAoBD;AAAI;AAAE,iBAAA,CAAA;AAEhD,gBAAA,IAAI,CAAClG,IAAAA,EAAM;AACT,oBAAA,MAAM,IAAIP,eAAAA,CAAgB,yBAAA,CAAA;AAChC,gBAAA;AAEI,gBAAA,MAAMb,WAAW,MAAA,CAAA,CAAQmH,IAAI,CAAC/F,IAAAA,CAAK4B,EAAE,EAAE;oBACrCuE,kBAAAA,EAAoB,IAAA;AACpBnB,oBAAAA;AACN,iBAAA,CAAA;AAEI,gBAAA,MAAMO,OAAOlF,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,yCAAA,EAA2C,gBAAA,CAAA;AAC1E,gBAAA,IAAIqD,SAAS,SAAA,EAAW;oBACtB,OAAOrC,gCAAAA,CAAiC7C,SAAQJ,GAAAA,EAAKD,IAAAA,CAAAA;AAC3D,gBAAA;gBAEI,OAAOC,GAAAA,CAAI8C,IAAI,CAAC;oBACdC,GAAAA,EAAKpE,UAAAA,CAAW,KAAA,CAAA,CAAO4G,KAAK,CAAC;AAAE5D,wBAAAA,EAAAA,EAAI5B,KAAK4B;;oBACxC5B,IAAAA,EAAM,MAAMD,aAAaC,IAAAA,EAAMC,GAAAA;AACrC,iBAAA,CAAA;AACA,YAAA,CAAA;AACE,YAAA,MAAMuB,SAAQvB,GAAG,EAAA;AACf,gBAAA,MAAMsF,OAAOlF,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,yCAAA,EAA2C,gBAAA,CAAA;AAC1E,gBAAA,IAAIqD,SAAS,SAAA,EAAW;AACtB,oBAAA,OAAOtF,IAAImG,QAAQ,EAAA;AACzB,gBAAA;AAEI,gBAAA,MAAMpE,UAAAA,GAAa3B,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,oCAAA,CAAA;gBACrC,MAAMI,UAAAA,GAAaN,UAAAA,EAAYO,MAAAA,EAAQC,IAAAA,IAAQ,mBAAA;;AAG/C,gBAAA,IAAIS,YAAAA,GAAehD,GAAAA,CAAI4C,OAAO,CAACX,GAAG,CAACI,UAAAA,CAAAA;AACnC,gBAAA,IAAI,CAACW,YAAAA,EAAc;AACjBA,oBAAAA,YAAAA,GAAehD,GAAAA,CAAIgB,OAAO,CAACI,IAAI,EAAE4B,YAAAA;AACvC,gBAAA;AAEI,gBAAA,IAAI,CAACA,YAAAA,IAAgB,OAAOA,YAAAA,KAAiB,QAAA,EAAU;oBACrD,OAAOhD,GAAAA,CAAIoG,UAAU,CAAC,uBAAA,CAAA;AAC5B,gBAAA;AAEI,gBAAA,MAAMC,WAAW,MAAMjG,OAAAA,CACpBoB,cAAc,CAAC,mBAAA,CAAA,CACf8E,kBAAkB,CAACtD,YAAAA,CAAAA;AACtB,gBAAA,IAAI,WAAWqD,QAAAA,EAAU;oBACvB,OAAOrG,GAAAA,CAAIuG,YAAY,CAAC,uBAAA,CAAA;AAC9B,gBAAA;gBAEI,MAAMC,MAAAA,GAAS,MAAMpG,OAAAA,CAClBoB,cAAc,CAAC,mBAAA,CAAA,CACfK,mBAAmB,CAACwE,QAAAA,CAASvE,KAAK,CAAA;AACrC,gBAAA,IAAI,WAAW0E,MAAAA,EAAQ;oBACrB,OAAOxG,GAAAA,CAAIuG,YAAY,CAAC,uBAAA,CAAA;AAC9B,gBAAA;AAEI,gBAAA,MAAMrE,kBAAkBlC,GAAAA,CAAIgB,OAAO,CAACmB,MAAM,CAAC,0BAA0B,KAAK,UAAA;gBAC1E,IAAIJ,UAAAA,EAAYK,YAAYF,eAAAA,EAAiB;AAC3C,oBAAA,MAAMM,YAAAA,GAAeC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;oBAC9C3C,GAAAA,CAAI4C,OAAO,CAACC,GAAG,CACbR,YACAgE,QAAAA,CAASvE,KAAK,EACdjD,yBAAAA,CAA0BkD,UAAAA,EAAYS,YAAAA,CAAAA,CAAAA;oBAExC,OAAOxC,GAAAA,CAAI8C,IAAI,CAAC;AAAEC,wBAAAA,GAAAA,EAAKyD,OAAO1E;AAAK,qBAAA,CAAA;AACzC,gBAAA;gBACI,OAAO9B,GAAAA,CAAI8C,IAAI,CAAC;AAAEC,oBAAAA,GAAAA,EAAKyD,OAAO1E,KAAK;AAAEkB,oBAAAA,YAAAA,EAAcqD,SAASvE;;AAChE,YAAA,CAAA;AACE,YAAA,MAAM2E,QAAOzG,GAAG,EAAA;AACd,gBAAA,MAAMsF,OAAOlF,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,yCAAA,EAA2C,gBAAA,CAAA;AAC1E,gBAAA,IAAIqD,SAAS,SAAA,EAAW;AACtB,oBAAA,OAAOtF,IAAImG,QAAQ,EAAA;AACzB,gBAAA;AAEI,gBAAA,IAAI,CAACnG,GAAAA,CAAIE,KAAK,CAACH,IAAI,EAAE;oBACnB,OAAOC,GAAAA,CAAIuG,YAAY,CAAC,wBAAA,CAAA;AAC9B,gBAAA;AAEI,gBAAA,MAAMjD,SAAS5B,MAAAA,CAAO1B,GAAAA,CAAIE,KAAK,CAACH,IAAI,CAAC4B,EAAE,CAAA;AACvC,gBAAA,MAAMI,UAAAA,GAAa3B,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,oCAAA,CAAA;AACrC,gBAAA,MAAMb,OAAOpB,GAAAA,CAAIgB,OAAO,CAACI,IAAI,IAAI,EAAA;gBACjC,MAAMmC,KAAAA,GAAQ,OAAOnC,IAAAA,CAAKmC,KAAK,KAAK,QAAA,GAAWnC,IAAAA,CAAKmC,KAAK,GAAG1C,SAAAA;AAC5D,gBAAA,MAAMF,WAAWF,eAAAA,CAAgBW,IAAAA,CAAAA;gBAEjC,IAAI;oBACF,MAAMiC,oBAAAA,CAAqBjD,OAAAA,EAAQJ,GAAAA,EAAKsD,MAAAA,EAAQ;AAAEC,wBAAAA,KAAAA;AAAO5C,wBAAAA,QAAAA;AAAUS,wBAAAA;;AACzE,gBAAA,CAAA,CAAM,OAAOsF,GAAAA,EAAK;AACZtG,oBAAAA,OAAAA,CAAOuG,GAAG,CAAClB,KAAK,CAAC,kBAAA,EAAoBiB,GAAAA,CAAAA;AAC3C,gBAAA;AAEI,gBAAA,MAAMxE,kBAAkBlC,GAAAA,CAAIgB,OAAO,CAACmB,MAAM,CAAC,0BAA0B,KAAK,UAAA;gBAC1E,IAAIJ,UAAAA,EAAYK,YAAYF,eAAAA,EAAiB;AAC3C,oBAAA,MAAMG,UAAAA,GAAaN,UAAAA,CAAWO,MAAM,EAAEC,IAAAA,IAAQ,mBAAA;AAC9C,oBAAA,MAAMC,YAAAA,GAAeC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;AAE9C,oBAAA,MAAM,EAAEiE,MAAM,EAAE,GAAGC,aAAAA,EAAe,GAAGhI,0BAA0BkD,UAAAA,EAAYS,YAAAA,CAAAA;AAE3ExC,oBAAAA,GAAAA,CAAI4C,OAAO,CAACC,GAAG,CAACR,YAAY,EAAA,EAAI;AAAE,wBAAA,GAAGwE,aAAa;AAAEC,wBAAAA,OAAAA,EAAS,IAAIC,IAAAA,CAAK,CAAA;AAAE,qBAAA,CAAA;AAC9E,gBAAA;gBACI,OAAO/G,GAAAA,CAAI8C,IAAI,CAAC;oBAAEkE,EAAAA,EAAI;AAAI,iBAAA,CAAA;AAC9B,YAAA,CAAA;AACE,YAAA,MAAMC,aAAYjH,GAAG,EAAA;AACnB,gBAAA,MAAMsF,OAAOlF,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,yCAAA,EAA2C,gBAAA,CAAA;AAC1E,gBAAA,IAAIqD,SAAS,SAAA,EAAW;AACtB,oBAAA,OAAOtF,IAAImG,QAAQ,EAAA;AACzB,gBAAA;AAEI,gBAAA,IAAI,CAACnG,GAAAA,CAAIE,KAAK,CAACH,IAAI,EAAE;oBACnB,OAAOC,GAAAA,CAAIuG,YAAY,CAAC,wBAAA,CAAA;AAC9B,gBAAA;AAEI,gBAAA,MAAM/C,gBAAAA,GAAmBxD,GAAAA,CAAIE,KAAK,CAACuD,OAAO,EAAE9B,EAAAA;AAC5C,gBAAA,MAAMuF,QAAAA,GAAW,MAAM9G,OAAAA,CACpBoB,cAAc,CAAC,mBAAA,CAAA,CACf2F,YAAY,CAACzF,MAAAA,CAAO1B,GAAAA,CAAIE,KAAK,CAACH,IAAI,CAAC4B,EAAE,CAAA,CAAA;gBAExC,MAAMyF,IAAAA,GAAOvH,uBACXqH,QAAAA,CAASG,GAAG,CAAC,CAAC5D,OAAAA,GAAY7D,qBAAqB6D,OAAAA,EAASD,gBAAAA,CAAAA,CAAAA,CAAAA;gBAG1D,OAAOxD,GAAAA,CAAI8C,IAAI,CAAC;AAAEsE,oBAAAA;;AACtB,YAAA,CAAA;AACE,YAAA,MAAME,eAActH,GAAG,EAAA;AACrB,gBAAA,MAAMsF,OAAOlF,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,yCAAA,EAA2C,gBAAA,CAAA;AAC1E,gBAAA,IAAIqD,SAAS,SAAA,EAAW;AACtB,oBAAA,OAAOtF,IAAImG,QAAQ,EAAA;AACzB,gBAAA;AAEI,gBAAA,IAAI,CAACnG,GAAAA,CAAIE,KAAK,CAACH,IAAI,EAAE;oBACnB,OAAOC,GAAAA,CAAIuG,YAAY,CAAC,wBAAA,CAAA;AAC9B,gBAAA;AAEI,gBAAA,MAAM,EAAE1C,SAAS,EAAE,GAAG7D,IAAIiE,MAAM;AAChC,gBAAA,MAAMsD,OAAAA,GAAU,MAAMnH,OAAAA,CACnBoB,cAAc,CAAC,mBAAA,CAAA,CACfsC,iBAAiB,CAACpC,MAAAA,CAAO1B,IAAIE,KAAK,CAACH,IAAI,CAAC4B,EAAE,CAAA,EAAGkC,SAAAA,CAAAA;AAEhD,gBAAA,IAAI,CAAC0D,OAAAA,EAAS;oBACZ,OAAOvH,GAAAA,CAAImG,QAAQ,CAAC,mBAAA,CAAA;AAC1B,gBAAA;gBAEI,OAAOnG,GAAAA,CAAI8C,IAAI,CAAC;AAAEsE,oBAAAA,IAAAA,EAAM;AAAE,iBAAA,CAAA;AAC9B,YAAA,CAAA;YACE,MAAM5B,OAAAA,CAAAA,CAAQxF,GAAG,EAAEwH,IAAI,EAAA;AACrB,gBAAA,MAAMC,SAAAA,GAAY,MAAMrH,OAAAA,CACrB8D,KAAK,CAAC;oBAAE5C,IAAAA,EAAM,QAAA;oBAAUiB,IAAAA,EAAM,mBAAA;oBAAqB6B,GAAAA,EAAK;AAAO,iBAAA,CAAA,CAC/DnC,GAAG,EAAA;gBAEN,MAAM,CAACyF,YAAY,GAAG1H,GAAAA,CAAIgB,OAAO,CAAC2G,GAAG,CAACC,KAAK,CAAC,GAAA,CAAA;AAC5C,gBAAA,MAAM5D,QAAAA,GAAW0D,WAAAA,CAAYE,KAAK,CAAC,WAAA,CAAY,CAAC,CAAA,CAAE,CAACA,KAAK,CAAC,GAAA,CAAI,CAAC,CAAA,CAAE;AAEhE,gBAAA,IAAI,CAACzJ,CAAAA,CAAE8D,GAAG,CAACwF,SAAAA,EAAW;AAACzD,oBAAAA,QAAAA;AAAU,oBAAA;iBAAU,CAAA,EAAG;AAC5C,oBAAA,MAAM,IAAIzE,gBAAAA,CAAiB,2BAAA,CAAA;AACjC,gBAAA;gBAEI,IAAI,CAACa,OAAAA,CAAO4B,MAAM,CAAC6F,MAAM,CAACF,GAAG,CAACG,UAAU,CAAC,MAAA,CAAA,EAAS;oBAChD1H,OAAAA,CAAOuG,GAAG,CAACoB,IAAI,CACb,6NAAA,CAAA;AAER,gBAAA;AAEI,gBAAA,MAAMC,mBAAAA,GAAsB7J,CAAAA,CAAE8D,GAAG,CAACjC,GAAAA,EAAK,gBAAA,CAAA;AACvC,gBAAA,MAAMiI,sBAAAA,GAAyB9J,CAAAA,CAAE8D,GAAG,CAACjC,GAAAA,EAAK,gCAAA,CAAA;AAC1C,gBAAA,MAAMkI,iBAAiBF,mBAAAA,IAAuBC,sBAAAA;AAE9C,gBAAA,IAAIC,mBAAmBrH,SAAAA,EAAW;oBAChC,IAAI;wBACF,MAAM,EAAEsH,QAAAA,EAAUC,gBAAgB,EAAE,GAAGhI,QACpCiI,MAAM,CAAC,mBAAA,CAAA,CACPrG,MAAM,CAAC,UAAA,CAAA;AAEV,wBAAA,MAAMoG,gBAAAA,CAAiBF,cAAAA,EAAgBT,SAAS,CAACzD,QAAAA,CAAS,CAAA;;AAG1DhE,wBAAAA,GAAAA,CAAIyD,OAAO,GAAGzD,GAAAA,CAAIyD,OAAO,IAAI,EAAA;wBAC7BzD,GAAAA,CAAIyD,OAAO,CAAC6E,KAAK,GAAGtI,IAAIyD,OAAO,CAAC6E,KAAK,IAAI,EAAA;AACzCtI,wBAAAA,GAAAA,CAAIyD,OAAO,CAAC6E,KAAK,CAACC,OAAO,GAAG;AAC1B,4BAAA,GAAGvI,GAAAA,CAAIyD,OAAO,CAAC6E,KAAK,CAACC,OAAO;4BAC5BxE,QAAAA,EAAUmE;AACpB,yBAAA;wBACQlI,GAAAA,CAAIE,KAAK,CAACsI,YAAY,GAAG;4BAAEzE,QAAAA,EAAUmE;AAAc,yBAAA;AAC3D,oBAAA,CAAA,CAAQ,OAAM;wBACN,MAAM,IAAI1I,gBAAgB,+BAAA,EAAiC;4BAAEuE,QAAAA,EAAUmE;AAAc,yBAAA,CAAA;AAC7F,oBAAA;AACA,gBAAA;gBAEI,MAAM,EAAEO,4BAA4B,EAAE,GAAGC,mBAAAA,EAAAA;AACzC,gBAAA,MAAMF,YAAAA,GAAeC,4BAAAA,EAAAA;AAErB,gBAAA,OAAOD,aAAaxI,GAAAA,EAAKwH,IAAAA,CAAAA;AAC7B,YAAA,CAAA;AAEE,YAAA,MAAMmB,gBAAe3I,GAAG,EAAA;gBACtB,MAAM,EAAE4E,KAAK,EAAE,GAAG,MAAM1F,0BAAAA,CAA2Bc,GAAAA,CAAIgB,OAAO,CAACI,IAAI,CAAA;AAEnE,gBAAA,MAAMwH,WAAAA,GAAc,MAAMxI,OAAAA,CAAO8D,KAAK,CAAC;oBAAE5C,IAAAA,EAAM,QAAA;oBAAUiB,IAAAA,EAAM;;AAE/D,gBAAA,MAAMsG,aAAAA,GAAgB,MAAMD,WAAAA,CAAY3G,GAAG,CAAC;oBAAEmC,GAAAA,EAAK;;AACnD,gBAAA,MAAMc,gBAAAA,GAAmB,MAAM0D,WAAAA,CAAY3G,GAAG,CAAC;oBAAEmC,GAAAA,EAAK;;;gBAGtD,MAAMrE,IAAAA,GAAO,MAAMK,OAAAA,CAAOmE,EAAA,CACvBC,KAAK,CAAC,gCAAA,CAAA,CACNC,OAAO,CAAC;oBAAEC,KAAAA,EAAO;AAAEE,wBAAAA,KAAAA,EAAOA,MAAMC,WAAW;AAAE;;AAEhD,gBAAA,IAAI,CAAC9E,IAAAA,IAAQA,IAAAA,CAAKsF,OAAO,EAAE;oBACzB,OAAOrF,GAAAA,CAAI8C,IAAI,CAAC;wBAAEkE,EAAAA,EAAI;AAAI,qBAAA,CAAA;AAChC,gBAAA;;gBAGI,MAAM8B,QAAAA,GAAW,MAAMhJ,YAAAA,CAAaC,IAAAA,EAAMC,GAAAA,CAAAA;AAE1C,gBAAA,MAAMkG,qBAAqBjI,MAAAA,CAAO8K,WAAW,CAAC,EAAA,CAAA,CAAIC,QAAQ,CAAC,KAAA,CAAA;AAE3D,gBAAA,MAAMC,wBAAwB9K,CAAAA,CAAE8D,GAAG,CAAC4G,aAAAA,EAAe,0BAA0B,EAAA,CAAA;gBAC7E,MAAMK,SAAAA,GAAY,MAAMvK,UAAAA,CAAW,mBAAA,CAAA,CAAqBwK,QAAQ,CAC9DF,qBAAAA,CAAsBvD,OAAO,EAC7B;AACE0D,oBAAAA,GAAAA,EAAKlE,iBAAiBmE,oBAAoB;AAC1CC,oBAAAA,UAAAA,EAAYlJ,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,oBAAA,CAAA;AAC9BsH,oBAAAA,SAAAA,EAAWnJ,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,mBAAA,CAAA;oBAC7BuH,IAAAA,EAAMV,QAAAA;oBACNW,KAAAA,EAAOvD;AACf,iBAAA,CAAA;gBAGI,MAAMwD,WAAAA,GAAc,MAAM/K,UAAAA,CAAW,mBAAA,CAAA,CAAqBwK,QAAQ,CAChEF,qBAAAA,CAAsBU,MAAM,EAC5B;oBACEH,IAAAA,EAAMV;AACd,iBAAA,CAAA;AAGI,gBAAA,MAAMc,WAAAA,GAAc;AAClBC,oBAAAA,EAAAA,EAAI9J,KAAK6E,KAAK;oBACdkF,IAAAA,EACEb,qBAAAA,CAAsBa,IAAI,CAAClF,KAAK,IAAIqE,sBAAsBa,IAAI,CAACvH,IAAA,GAC3D,CAAA,EAAG0G,qBAAAA,CAAsBa,IAAI,CAACvH,IAAI,CAAC,EAAE,EAAE0G,qBAAAA,CAAsBa,IAAI,CAAClF,KAAK,CAAC,CAAC,CAAA,GACzE/D,SAAAA;AACNkJ,oBAAAA,OAAAA,EAASd,sBAAsBe,cAAc;oBAC7CC,OAAAA,EAASP,WAAAA;oBACTQ,IAAAA,EAAMhB,SAAAA;oBACNiB,IAAAA,EAAMjB;AACZ,iBAAA;;AAGI,gBAAA,MAAMvK,WAAW,MAAA,CAAA,CAAQmH,IAAI,CAAC/F,IAAAA,CAAK4B,EAAE,EAAE;AAAEuE,oBAAAA;;;gBAGzC,MAAM9F,OAAAA,CAAOiI,MAAM,CAAC,OAAA,CAAA,CAAS+B,OAAO,CAAC,OAAA,CAAA,CAAStH,IAAI,CAAC8G,WAAAA,CAAAA;AAEnD5J,gBAAAA,GAAAA,CAAI8C,IAAI,CAAC;oBAAEkE,EAAAA,EAAI;AAAI,iBAAA,CAAA;AACvB,YAAA,CAAA;AAEE,YAAA,MAAMqD,UAASrK,GAAG,EAAA;AAChB,gBAAA,MAAM4I,WAAAA,GAAc,MAAMxI,OAAAA,CAAO8D,KAAK,CAAC;oBAAE5C,IAAAA,EAAM,QAAA;oBAAUiB,IAAAA,EAAM;;AAE/D,gBAAA,MAAM+H,QAAAA,GAAW,MAAM1B,WAAAA,CAAY3G,GAAG,CAAC;oBAAEmC,GAAAA,EAAK;;gBAE9C,IAAI,CAACkG,QAAAA,CAASC,cAAc,EAAE;AAC5B,oBAAA,MAAM,IAAIhL,gBAAAA,CAAiB,uCAAA,CAAA;AACjC,gBAAA;gBAEI,MAAM,EAAE8K,QAAQ,EAAE,GAAGjK,QAAO4B,MAAM,CAACC,GAAG,CAAC,2BAAA,CAAA;AACvC,gBAAA,MAAMuI,iBAAAA,GAAoB;AAAC,oBAAA,UAAA;AAAY,oBAAA,UAAA;AAAY,oBAAA;AAAQ,iBAAA;;gBAG3D,MAAMC,WAAAA,GAAcnM,OAAAA,CAClBD,MAAAA,CAAOmM,iBAAAA,EAAmBjM,OAAAA,CAAQ8L,UAAUK,aAAAA,CAAAA,GAAiBL,QAAAA,CAASK,aAAa,GAAG,EAAE,CAAA,CAAA;;AAI1F,gBAAA,MAAMC,cAAcC,MAAAA,CAAOC,IAAI,CAAC7K,GAAAA,CAAIgB,OAAO,CAACI,IAAI,CAAA,CAAE0J,MAAM,CAAC,CAAC1G,GAAAA,GAAQ,CAACqG,WAAAA,CAAYM,QAAQ,CAAC3G,GAAAA,CAAAA,CAAAA;gBAExF,IAAIuG,WAAAA,CAAY/J,MAAM,GAAG,CAAA,EAAG;;oBAE1B,MAAM,IAAIpB,gBAAgB,CAAC,oBAAoB,EAAEmL,WAAAA,CAAYK,IAAI,CAAC,IAAA,CAAA,CAAA,CAAO,CAAA;AAC/E,gBAAA;AAEI,gBAAA,MAAM/G,MAAAA,GAAS;oBACb,GAAG9F,CAAAA,CAAE8M,IAAI,CAACjL,GAAAA,CAAIgB,OAAO,CAACI,IAAI,EAAEqJ,WAAAA,CAAY;oBACxCzG,QAAAA,EAAU;AAChB,iBAAA;AAEI,gBAAA,MAAM4B,WAAAA,GAAcxF,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,2CAAA,CAAA;AAEtC,gBAAA,MAAMjD,qBAAqBiF,MAAAA,EAAQ2B,WAAAA,CAAAA;gBAEnC,MAAMsF,IAAAA,GAAO,MAAM9K,OAAAA,CAAOmE,EAAA,CACvBC,KAAK,CAAC,gCAAA,CAAA,CACNC,OAAO,CAAC;oBAAEC,KAAAA,EAAO;AAAEpD,wBAAAA,IAAAA,EAAMgJ,SAASa;AAAY;;AAEjD,gBAAA,IAAI,CAACD,IAAAA,EAAM;AACT,oBAAA,MAAM,IAAI3L,gBAAAA,CAAiB,qCAAA,CAAA;AACjC,gBAAA;AAEI,gBAAA,MAAM,EAAEqF,KAAK,EAAEE,QAAQ,EAAEd,QAAQ,EAAE,GAAGC,MAAAA;AAEtC,gBAAA,MAAMmH,gBAAAA,GAAmB;oBACvBzG,GAAAA,EAAK;AACH,wBAAA;AAAEC,4BAAAA,KAAAA,EAAOA,MAAMC,WAAW;AAAE,yBAAA;AAC5B,wBAAA;AAAEC,4BAAAA,QAAAA,EAAUF,MAAMC,WAAW;AAAE,yBAAA;AAC/B,wBAAA;AAAEC,4BAAAA;AAAQ,yBAAA;AACV,wBAAA;4BAAEF,KAAAA,EAAOE;AAAQ;AAClB;AACP,iBAAA;gBAEI,MAAMuG,oBAAAA,GAAuB,MAAMjL,OAAAA,CAAOmE,EAAE,CAACC,KAAK,CAAC,gCAAA,CAAA,CAAkC8G,KAAK,CAAC;oBACzF5G,KAAAA,EAAO;AAAE,wBAAA,GAAG0G,gBAAgB;AAAEpH,wBAAAA;AAAQ;AAC5C,iBAAA,CAAA;AAEI,gBAAA,IAAIqH,uBAAuB,CAAA,EAAG;AAC5B,oBAAA,MAAM,IAAI9L,gBAAAA,CAAiB,qCAAA,CAAA;AACjC,gBAAA;gBAEI,IAAI+K,QAAAA,CAASiB,YAAY,EAAE;oBACzB,MAAMF,oBAAAA,GAAuB,MAAMjL,OAAAA,CAAOmE,EAAE,CAACC,KAAK,CAAC,gCAAA,CAAA,CAAkC8G,KAAK,CAAC;wBACzF5G,KAAAA,EAAO;AAAE,4BAAA,GAAG0G;AAAgB;AACpC,qBAAA,CAAA;AAEM,oBAAA,IAAIC,uBAAuB,CAAA,EAAG;AAC5B,wBAAA,MAAM,IAAI9L,gBAAAA,CAAiB,qCAAA,CAAA;AACnC,oBAAA;AACA,gBAAA;AAEI,gBAAA,MAAMiM,OAAAA,GAAU;AACd,oBAAA,GAAGvH,MAAM;AACTiH,oBAAAA,IAAAA,EAAMA,KAAKvJ,EAAE;AACbiD,oBAAAA,KAAAA,EAAOA,MAAMC,WAAW,EAAA;AACxBC,oBAAAA,QAAAA;oBACAM,SAAAA,EAAW,CAACkF,SAASmB;AAC3B,iBAAA;AAEI,gBAAA,MAAM1L,IAAAA,GAAO,MAAMpB,UAAAA,CAAW,MAAA,CAAA,CAAQ+M,GAAG,CAACF,OAAAA,CAAAA;gBAE1C,MAAMG,aAAAA,GAAgB,MAAM7L,YAAAA,CAAaC,IAAAA,EAAMC,GAAAA,CAAAA;gBAE/C,IAAIsK,QAAAA,CAASmB,kBAAkB,EAAE;oBAC/B,IAAI;wBACF,MAAM9M,UAAAA,CAAW,MAAA,CAAA,CAAQiN,qBAAqB,CAACD,aAAAA,CAAAA;AACvD,oBAAA,CAAA,CAAQ,OAAOjF,GAAAA,EAAK;wBACZtG,OAAAA,CAAOuG,GAAG,CAAClB,KAAK,CAACiB,GAAAA,CAAAA;AACjB,wBAAA,MAAM,IAAInH,gBAAAA,CAAiB,kCAAA,CAAA;AACnC,oBAAA;oBAEM,OAAOS,GAAAA,CAAI8C,IAAI,CAAC;wBAAE/C,IAAAA,EAAM4L;AAAa,qBAAA,CAAA;AAC3C,gBAAA;AAEI,gBAAA,MAAMrG,OAAOlF,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,yCAAA,EAA2C,gBAAA,CAAA;AAC1E,gBAAA,IAAIqD,SAAS,SAAA,EAAW;oBACtB,MAAM3E,QAAAA,GAAWF,gBAAgBT,GAAAA,CAAIgB,OAAO,CAACI,IAAI,CAAA,IAAKnD,OAAOmF,UAAU,EAAA;AAEvE,oBAAA,MAAM7B,OAAAA,GAAU,MAAMnB,OAAAA,CACnBoB,cAAc,CAAC,mBAAA,CAAA,CACfC,oBAAoB,CAACC,MAAAA,CAAO3B,IAAAA,CAAK4B,EAAE,CAAA,EAAGhB,QAAAA,EAAU;wBAC/CW,IAAAA,EAAM,SAAA;AACNH,wBAAAA,QAAAA,EAAUL,+BAAAA,CAAgCd,GAAAA;AACpD,qBAAA,CAAA;oBAEM,MAAM4B,MAAAA,GAAS,MAAMxB,OAAAA,CAClBoB,cAAc,CAAC,mBAAA,CAAA,CACfK,mBAAmB,CAACN,OAAAA,CAAQO,KAAK,CAAA;AACpC,oBAAA,IAAI,WAAWF,MAAAA,EAAQ;AACrB,wBAAA,MAAM,IAAIrC,gBAAAA,CAAiB,qBAAA,CAAA;AACnC,oBAAA;oBAEM,OAAOS,GAAAA,CAAI8C,IAAI,CAAC;AAAEC,wBAAAA,GAAAA,EAAKnB,OAAOE,KAAK;AAAEkB,wBAAAA,YAAAA,EAAczB,QAAQO,KAAK;wBAAE/B,IAAAA,EAAM4L;AAAa,qBAAA,CAAA;AAC3F,gBAAA;gBAEI,MAAM5I,GAAAA,GAAMpE,WAAW,KAAA,CAAA,CAAO4G,KAAK,CAACpH,CAAAA,CAAE8M,IAAI,CAAClL,IAAAA,EAAM;AAAC,oBAAA;AAAK,iBAAA,CAAA,CAAA;gBACvD,OAAOC,GAAAA,CAAI8C,IAAI,CAAC;AAAEC,oBAAAA,GAAAA;oBAAKhD,IAAAA,EAAM4L;AAAa,iBAAA,CAAA;AAC9C,YAAA,CAAA;AAEE,YAAA,MAAME,iBAAAA,CAAAA,CAAkB7L,GAAG,EAAEwH,IAAI,EAAEsE,UAAU,EAAA;gBAC3C,MAAM,EAAEC,cAAcC,iBAAiB,EAAE,GAAG,MAAM5M,6BAAAA,CAA8BY,IAAIwE,KAAK,CAAA;AAEzF,gBAAA,MAAMyH,cAActN,UAAAA,CAAW,MAAA,CAAA;AAC/B,gBAAA,MAAMuN,aAAavN,UAAAA,CAAW,KAAA,CAAA;AAE9B,gBAAA,MAAM,CAACoB,IAAAA,CAAK,GAAG,MAAMkM,WAAAA,CAAYE,QAAQ,CAAC;oBAAEC,OAAAA,EAAS;AAAEJ,wBAAAA;AAAiB;;AAExE,gBAAA,IAAI,CAACjM,IAAAA,EAAM;AACT,oBAAA,MAAM,IAAIP,eAAAA,CAAgB,eAAA,CAAA;AAChC,gBAAA;AAEI,gBAAA,MAAMyM,WAAAA,CAAYnG,IAAI,CAAC/F,IAAAA,CAAK4B,EAAE,EAAE;oBAAEyD,SAAAA,EAAW,IAAA;oBAAM4G,iBAAAA,EAAmB;;AAEtE,gBAAA,IAAIF,UAAAA,EAAY;AACd9L,oBAAAA,GAAAA,CAAI8C,IAAI,CAAC;wBACPC,GAAAA,EAAKmJ,UAAAA,CAAW3G,KAAK,CAAC;AAAE5D,4BAAAA,EAAAA,EAAI5B,KAAK4B;;wBACjC5B,IAAAA,EAAM,MAAMD,aAAaC,IAAAA,EAAMC,GAAAA;AACvC,qBAAA,CAAA;gBACA,CAAA,MAAW;AACL,oBAAA,MAAMsK,QAAAA,GAAW,MAAMlK,OAAAA,CACpB8D,KAAK,CAAC;wBAAE5C,IAAAA,EAAM,QAAA;wBAAUiB,IAAAA,EAAM,mBAAA;wBAAqB6B,GAAAA,EAAK;AAAU,qBAAA,CAAA,CAClEnC,GAAG,EAAA;AAENjC,oBAAAA,GAAAA,CAAIqM,QAAQ,CAAC/B,QAAAA,CAASgC,8BAA8B,IAAI,GAAA,CAAA;AAC9D,gBAAA;AACA,YAAA,CAAA;AAEE,YAAA,MAAMC,uBAAsBvM,GAAG,EAAA;gBAC7B,MAAM,EAAE4E,KAAK,EAAE,GAAG,MAAM3F,iCAAAA,CAAkCe,GAAAA,CAAIgB,OAAO,CAACI,IAAI,CAAA;gBAE1E,MAAMrB,IAAAA,GAAO,MAAMK,OAAAA,CAAOmE,EAAE,CAACC,KAAK,CAAC,gCAAA,CAAA,CAAkCC,OAAO,CAAC;oBAC3EC,KAAAA,EAAO;AAAEE,wBAAAA,KAAAA,EAAOA,MAAMC,WAAW;AAAE;AACzC,iBAAA,CAAA;AAEI,gBAAA,IAAI,CAAC9E,IAAAA,EAAM;oBACT,OAAOC,GAAAA,CAAI8C,IAAI,CAAC;AAAE8B,wBAAAA,KAAAA;wBAAO4H,IAAAA,EAAM;AAAI,qBAAA,CAAA;AACzC,gBAAA;gBAEI,IAAIzM,IAAAA,CAAKqF,SAAS,EAAE;AAClB,oBAAA,MAAM,IAAI7F,gBAAAA,CAAiB,mBAAA,CAAA;AACjC,gBAAA;gBAEI,IAAIQ,IAAAA,CAAKsF,OAAO,EAAE;AAChB,oBAAA,MAAM,IAAI9F,gBAAAA,CAAiB,cAAA,CAAA;AACjC,gBAAA;gBAEI,MAAMZ,UAAAA,CAAW,MAAA,CAAA,CAAQiN,qBAAqB,CAAC7L,IAAAA,CAAAA;AAE/CC,gBAAAA,GAAAA,CAAI8C,IAAI,CAAC;AACP8B,oBAAAA,KAAAA,EAAO7E,KAAK6E,KAAK;oBACjB4H,IAAAA,EAAM;AACZ,iBAAA,CAAA;AACA,YAAA;SACA,CAAA;;;;;;"}
1	+ {"version":3,"file":"auth.mjs","sources":["../../../server/src/controllers/auth.js"],"sourcesContent":["'use strict';\n\n/*\n Auth.js controller\n \n @description: A set of functions called \"actions\" for managing `Auth`.\n /\n\n/ eslint-disable no-useless-escape */\nconst crypto = require('crypto');\nconst _ = require('lodash');\nconst { concat, compact, isArray } = require('lodash/fp');\nconst utils = require('@strapi/utils');\nconst { getService } = require('../utils');\nconst { buildRefreshCookieOptions } = require('../utils/refresh-cookie-options');\nconst {\n validateCallbackBody,\n validateRegisterBody,\n validateSendEmailConfirmationBody,\n validateForgotPasswordBody,\n validateResetPasswordBody,\n validateEmailConfirmationBody,\n validateChangePasswordBody,\n} = require('./validation/auth');\n\nconst { ApplicationError, ValidationError, ForbiddenError } = utils.errors;\nconst { buildSessionMetadata, sanitizeSessionEntry, sortSessionsForDisplay } = utils;\n\nconst sanitizeUser = (user, ctx) => {\n const { auth } = ctx.state;\n const userSchema = strapi.getModel('plugin::users-permissions.user');\n\n return strapi.contentAPI.sanitize.output(user, userSchema, { auth });\n};\n\nconst extractDeviceId = (requestBody) => {\n const { deviceId } = requestBody \|\| {};\n\n return typeof deviceId === 'string' && deviceId.length > 0 ? deviceId : undefined;\n};\n\nconst buildSessionMetadataFromContext = (ctx) =>\n buildSessionMetadata({\n userAgent: ctx.request.headers['user-agent'],\n });\n\nconst sendRefreshAuthResponse = async (strapi, ctx, user, { metadata } = {}) => {\n const deviceId = extractDeviceId(ctx.request.body);\n const tokenOptions = { type: 'refresh', ...(metadata ? { metadata } : {}) };\n\n const refresh = await strapi\n .sessionManager('users-permissions')\n .generateRefreshToken(String(user.id), deviceId, tokenOptions);\n\n const access = await strapi\n .sessionManager('users-permissions')\n .generateAccessToken(refresh.token);\n if ('error' in access) {\n throw new ApplicationError('Invalid credentials');\n }\n\n const upSessions = strapi.config.get('plugin::users-permissions.sessions');\n const requestHttpOnly = ctx.request.header['x-strapi-refresh-cookie'] === 'httpOnly';\n\n if (upSessions?.httpOnly \|\| requestHttpOnly) {\n const cookieName = upSessions.cookie?.name \|\| 'strapi_up_refresh';\n const isProduction = process.env.NODE_ENV === 'production';\n ctx.cookies.set(cookieName, refresh.token, buildRefreshCookieOptions(upSessions, isProduction));\n return ctx.send({ jwt: access.token, user: await sanitizeUser(user, ctx) });\n }\n\n return ctx.send({\n jwt: access.token,\n refreshToken: refresh.token,\n user: await sanitizeUser(user, ctx),\n });\n};\n\nconst reissueTokensAfterPasswordChange = async (strapi, ctx, user) => {\n const deviceId = extractDeviceId(ctx.request.body);\n\n await strapi.sessionManager('users-permissions').invalidateRefreshToken(String(user.id));\n\n const newDeviceId = deviceId \|\| crypto.randomUUID();\n const refresh = await strapi\n .sessionManager('users-permissions')\n .generateRefreshToken(String(user.id), newDeviceId, { type: 'refresh' });\n\n const access = await strapi\n .sessionManager('users-permissions')\n .generateAccessToken(refresh.token);\n if ('error' in access) {\n throw new ApplicationError('Invalid credentials');\n }\n\n return ctx.send({\n jwt: access.token,\n refreshToken: refresh.token,\n user: await sanitizeUser(user, ctx),\n });\n};\n\nconst revokeLogoutSessions = async (strapi, ctx, userId, { scope, deviceId, body }) => {\n const sessionManager = strapi.sessionManager('users-permissions');\n const upSessions = strapi.config.get('plugin::users-permissions.sessions');\n\n if (scope === 'all') {\n await sessionManager.invalidateRefreshToken(userId);\n return;\n }\n\n if (deviceId) {\n await sessionManager.invalidateRefreshToken(userId, deviceId);\n return;\n }\n\n let currentSessionId = ctx.state.session?.id;\n const cookieName = upSessions?.cookie?.name \|\| 'strapi_up_refresh';\n const refreshToken =\n ctx.cookies.get(cookieName) \|\|\n (typeof body.refreshToken === 'string' ? body.refreshToken : undefined);\n\n if (refreshToken) {\n const validation = await sessionManager.validateRefreshToken(refreshToken);\n if (validation.isValid) {\n currentSessionId = validation.sessionId;\n }\n }\n\n if (currentSessionId) {\n await sessionManager.revokeSessionById(userId, currentSessionId);\n return;\n }\n\n await sessionManager.invalidateRefreshToken(userId);\n};\n\nmodule.exports = ({ strapi }) => ({\n async callback(ctx) {\n const provider = ctx.params.provider \|\| 'local';\n const params = ctx.request.body;\n\n const store = strapi.store({ type: 'plugin', name: 'users-permissions' });\n const grantSettings = await store.get({ key: 'grant' });\n\n const grantProvider = provider === 'local' ? 'email' : provider;\n\n if (!_.get(grantSettings, [grantProvider, 'enabled'])) {\n throw new ApplicationError('This provider is disabled');\n }\n\n if (provider === 'local') {\n await validateCallbackBody(params);\n\n const { identifier } = params;\n\n // Check if the user exists.\n const user = await strapi.db.query('plugin::users-permissions.user').findOne({\n where: {\n provider,\n $or: [{ email: identifier.toLowerCase() }, { username: identifier }],\n },\n });\n\n if (!user) {\n throw new ValidationError('Invalid identifier or password');\n }\n\n if (!user.password) {\n throw new ValidationError('Invalid identifier or password');\n }\n\n const validPassword = await getService('user').validatePassword(\n params.password,\n user.password\n );\n\n if (!validPassword) {\n throw new ValidationError('Invalid identifier or password');\n }\n\n const advancedSettings = await store.get({ key: 'advanced' });\n const requiresConfirmation = _.get(advancedSettings, 'email_confirmation');\n\n if (requiresConfirmation && user.confirmed !== true) {\n throw new ApplicationError('Your account email is not confirmed');\n }\n\n if (user.blocked === true) {\n throw new ApplicationError('Your account has been blocked by an administrator');\n }\n\n const mode = strapi.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');\n if (mode === 'refresh') {\n return sendRefreshAuthResponse(strapi, ctx, user, {\n metadata: buildSessionMetadataFromContext(ctx),\n });\n }\n\n return ctx.send({\n jwt: getService('jwt').issue({ id: user.id }),\n user: await sanitizeUser(user, ctx),\n });\n }\n\n // Connect the user with the third-party provider.\n try {\n const user = await getService('providers').connect(provider, ctx.query);\n\n if (user.blocked) {\n throw new ForbiddenError('Your account has been blocked by an administrator');\n }\n\n const mode = strapi.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');\n if (mode === 'refresh') {\n return sendRefreshAuthResponse(strapi, ctx, user, {\n metadata: buildSessionMetadataFromContext(ctx),\n });\n }\n\n return ctx.send({\n jwt: getService('jwt').issue({ id: user.id }),\n user: await sanitizeUser(user, ctx),\n });\n } catch (error) {\n throw new ApplicationError(error.message);\n }\n },\n\n async changePassword(ctx) {\n if (!ctx.state.user) {\n throw new ApplicationError('You must be authenticated to reset your password');\n }\n\n const validations = strapi.config.get('plugin::users-permissions.validationRules');\n\n const { currentPassword, password } = await validateChangePasswordBody(\n ctx.request.body,\n validations\n );\n\n const user = await strapi.db\n .query('plugin::users-permissions.user')\n .findOne({ where: { id: ctx.state.user.id } });\n\n const validPassword = await getService('user').validatePassword(currentPassword, user.password);\n\n if (!validPassword) {\n throw new ValidationError('The provided current password is invalid');\n }\n\n if (currentPassword === password) {\n throw new ValidationError('Your new password must be different than your current password');\n }\n\n await getService('user').edit(user.id, { password });\n\n const mode = strapi.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');\n if (mode === 'refresh') {\n return reissueTokensAfterPasswordChange(strapi, ctx, user);\n }\n\n return ctx.send({\n jwt: getService('jwt').issue({ id: user.id }),\n user: await sanitizeUser(user, ctx),\n });\n },\n\n async resetPassword(ctx) {\n const validations = strapi.config.get('plugin::users-permissions.validationRules');\n\n const { password, passwordConfirmation, code } = await validateResetPasswordBody(\n ctx.request.body,\n validations\n );\n\n if (password !== passwordConfirmation) {\n throw new ValidationError('Passwords do not match');\n }\n\n const user = await strapi.db\n .query('plugin::users-permissions.user')\n .findOne({ where: { resetPasswordToken: code } });\n\n if (!user) {\n throw new ValidationError('Incorrect code provided');\n }\n\n await getService('user').edit(user.id, {\n resetPasswordToken: null,\n password,\n });\n\n const mode = strapi.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');\n if (mode === 'refresh') {\n return reissueTokensAfterPasswordChange(strapi, ctx, user);\n }\n\n return ctx.send({\n jwt: getService('jwt').issue({ id: user.id }),\n user: await sanitizeUser(user, ctx),\n });\n },\n async refresh(ctx) {\n const mode = strapi.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');\n if (mode !== 'refresh') {\n return ctx.notFound();\n }\n\n const upSessions = strapi.config.get('plugin::users-permissions.sessions');\n const cookieName = upSessions?.cookie?.name \|\| 'strapi_up_refresh';\n\n // Check for refresh token in cookie first (if httpOnly is configured), then in body\n let refreshToken = ctx.cookies.get(cookieName);\n if (!refreshToken) {\n refreshToken = ctx.request.body?.refreshToken;\n }\n\n if (!refreshToken \|\| typeof refreshToken !== 'string') {\n return ctx.badRequest('Missing refresh token');\n }\n\n const rotation = await strapi\n .sessionManager('users-permissions')\n .rotateRefreshToken(refreshToken);\n if ('error' in rotation) {\n return ctx.unauthorized('Invalid refresh token');\n }\n\n const result = await strapi\n .sessionManager('users-permissions')\n .generateAccessToken(rotation.token);\n if ('error' in result) {\n return ctx.unauthorized('Invalid refresh token');\n }\n\n const requestHttpOnly = ctx.request.header['x-strapi-refresh-cookie'] === 'httpOnly';\n if (upSessions?.httpOnly \|\| requestHttpOnly) {\n const isProduction = process.env.NODE_ENV === 'production';\n ctx.cookies.set(\n cookieName,\n rotation.token,\n buildRefreshCookieOptions(upSessions, isProduction)\n );\n return ctx.send({ jwt: result.token });\n }\n return ctx.send({ jwt: result.token, refreshToken: rotation.token });\n },\n async logout(ctx) {\n const mode = strapi.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');\n if (mode !== 'refresh') {\n return ctx.notFound();\n }\n\n if (!ctx.state.user) {\n return ctx.unauthorized('Missing authentication');\n }\n\n const userId = String(ctx.state.user.id);\n const upSessions = strapi.config.get('plugin::users-permissions.sessions');\n const body = ctx.request.body \|\| {};\n const scope = typeof body.scope === 'string' ? body.scope : undefined;\n const deviceId = extractDeviceId(body);\n\n try {\n await revokeLogoutSessions(strapi, ctx, userId, { scope, deviceId, body });\n } catch (err) {\n strapi.log.error('UP logout failed', err);\n }\n\n const requestHttpOnly = ctx.request.header['x-strapi-refresh-cookie'] === 'httpOnly';\n if (upSessions?.httpOnly \|\| requestHttpOnly) {\n const cookieName = upSessions.cookie?.name \|\| 'strapi_up_refresh';\n const isProduction = process.env.NODE_ENV === 'production';\n\n const { maxAge: _maxAge, ...cookieOptions } = buildRefreshCookieOptions(\n upSessions,\n isProduction\n );\n\n ctx.cookies.set(cookieName, '', { ...cookieOptions, expires: new Date(0) });\n }\n return ctx.send({ ok: true });\n },\n async getSessions(ctx) {\n const mode = strapi.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');\n if (mode !== 'refresh') {\n return ctx.notFound();\n }\n\n if (!ctx.state.user) {\n return ctx.unauthorized('Missing authentication');\n }\n\n const currentSessionId = ctx.state.session?.id;\n const sessions = await strapi\n .sessionManager('users-permissions')\n .listSessions(String(ctx.state.user.id));\n\n const data = sortSessionsForDisplay(\n sessions.map((session) => sanitizeSessionEntry(session, currentSessionId))\n );\n\n return ctx.send({ data });\n },\n async revokeSession(ctx) {\n const mode = strapi.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');\n if (mode !== 'refresh') {\n return ctx.notFound();\n }\n\n if (!ctx.state.user) {\n return ctx.unauthorized('Missing authentication');\n }\n\n const { sessionId } = ctx.params;\n const revoked = await strapi\n .sessionManager('users-permissions')\n .revokeSessionById(String(ctx.state.user.id), sessionId);\n\n if (!revoked) {\n return ctx.notFound('Session not found');\n }\n\n return ctx.send({ data: {} });\n },\n async connect(ctx, next) {\n const providers = await strapi\n .store({ type: 'plugin', name: 'users-permissions', key: 'grant' })\n .get();\n\n const [requestPath] = ctx.request.url.split('?');\n const provider = requestPath.split('/connect/')[1].split('/')[0];\n\n if (!_.get(providers, [provider, 'enabled'])) {\n throw new ApplicationError('This provider is disabled');\n }\n\n if (!strapi.config.server.url.startsWith('http')) {\n strapi.log.warn(\n 'You are using a third party provider for login. Make sure to set an absolute url in config/server.js. More info here: https://docs.strapi.io/developer-docs/latest/plugins/users-permissions.html#setting-up-the-server-url'\n );\n }\n\n const queryCustomCallback = _.get(ctx, 'query.callback');\n const dynamicSessionCallback = _.get(ctx, 'session.grant.dynamic.callback');\n const customCallback = queryCustomCallback ?? dynamicSessionCallback;\n\n if (customCallback !== undefined) {\n try {\n const { validate: validateCallback } = strapi\n .plugin('users-permissions')\n .config('callback');\n\n await validateCallback(customCallback, providers[provider]);\n\n // Persist across the provider redirect round-trip (request state alone is lost).\n ctx.session = ctx.session \|\| {};\n ctx.session.grant = ctx.session.grant \|\| {};\n ctx.session.grant.dynamic = {\n ...ctx.session.grant.dynamic,\n callback: customCallback,\n };\n ctx.state.oauthConnect = { callback: customCallback };\n } catch {\n throw new ValidationError('Invalid callback URL provided', { callback: customCallback });\n }\n }\n\n const { createOAuthConnectMiddleware } = require('../utils/oauth-connect');\n const oauthConnect = createOAuthConnectMiddleware();\n\n return oauthConnect(ctx, next);\n },\n\n async forgotPassword(ctx) {\n const { email } = await validateForgotPasswordBody(ctx.request.body);\n\n const pluginStore = await strapi.store({ type: 'plugin', name: 'users-permissions' });\n\n const emailSettings = await pluginStore.get({ key: 'email' });\n const advancedSettings = await pluginStore.get({ key: 'advanced' });\n\n // Find the user by email.\n const user = await strapi.db\n .query('plugin::users-permissions.user')\n .findOne({ where: { email: email.toLowerCase() } });\n\n if (!user \|\| user.blocked) {\n return ctx.send({ ok: true });\n }\n\n // Generate random token.\n const userInfo = await sanitizeUser(user, ctx);\n\n const resetPasswordToken = crypto.randomBytes(64).toString('hex');\n\n const resetPasswordSettings = _.get(emailSettings, 'reset_password.options', {});\n const emailBody = await getService('users-permissions').template(\n resetPasswordSettings.message,\n {\n URL: advancedSettings.email_reset_password,\n SERVER_URL: strapi.config.get('server.absoluteUrl'),\n ADMIN_URL: strapi.config.get('admin.absoluteUrl'),\n USER: userInfo,\n TOKEN: resetPasswordToken,\n }\n );\n\n const emailObject = await getService('users-permissions').template(\n resetPasswordSettings.object,\n {\n USER: userInfo,\n }\n );\n\n const emailToSend = {\n to: user.email,\n from:\n resetPasswordSettings.from.email \|\| resetPasswordSettings.from.name\n ? `${resetPasswordSettings.from.name} <${resetPasswordSettings.from.email}>`\n : undefined,\n replyTo: resetPasswordSettings.response_email,\n subject: emailObject,\n text: emailBody,\n html: emailBody,\n };\n\n // NOTE: Update the user before sending the email so an Admin can generate the link if the email fails\n await getService('user').edit(user.id, { resetPasswordToken });\n\n // Send an email to the user.\n await strapi.plugin('email').service('email').send(emailToSend);\n\n ctx.send({ ok: true });\n },\n\n async register(ctx) {\n const pluginStore = await strapi.store({ type: 'plugin', name: 'users-permissions' });\n\n const settings = await pluginStore.get({ key: 'advanced' });\n\n if (!settings.allow_register) {\n throw new ApplicationError('Register action is currently disabled');\n }\n\n const { register } = strapi.config.get('plugin::users-permissions');\n const alwaysAllowedKeys = ['username', 'password', 'email'];\n\n // Note that we intentionally do not filter allowedFields to allow a project to explicitly accept private or other Strapi field on registration\n const allowedKeys = compact(\n concat(alwaysAllowedKeys, isArray(register?.allowedFields) ? register.allowedFields : [])\n );\n\n // Check if there are any keys in requestBody that are not in allowedKeys\n const invalidKeys = Object.keys(ctx.request.body).filter((key) => !allowedKeys.includes(key));\n\n if (invalidKeys.length > 0) {\n // If there are invalid keys, throw an error\n throw new ValidationError(`Invalid parameters: ${invalidKeys.join(', ')}`);\n }\n\n const params = {\n ..._.pick(ctx.request.body, allowedKeys),\n provider: 'local',\n };\n\n const validations = strapi.config.get('plugin::users-permissions.validationRules');\n\n await validateRegisterBody(params, validations);\n\n const role = await strapi.db\n .query('plugin::users-permissions.role')\n .findOne({ where: { type: settings.default_role } });\n\n if (!role) {\n throw new ApplicationError('Impossible to find the default role');\n }\n\n const { email, username, provider } = params;\n\n const identifierFilter = {\n $or: [\n { email: email.toLowerCase() },\n { username: email.toLowerCase() },\n { username },\n { email: username },\n ],\n };\n\n const conflictingUserCount = await strapi.db.query('plugin::users-permissions.user').count({\n where: { ...identifierFilter, provider },\n });\n\n if (conflictingUserCount > 0) {\n throw new ApplicationError('Email or Username are already taken');\n }\n\n if (settings.unique_email) {\n const conflictingUserCount = await strapi.db.query('plugin::users-permissions.user').count({\n where: { ...identifierFilter },\n });\n\n if (conflictingUserCount > 0) {\n throw new ApplicationError('Email or Username are already taken');\n }\n }\n\n const newUser = {\n ...params,\n role: role.id,\n email: email.toLowerCase(),\n username,\n confirmed: !settings.email_confirmation,\n };\n\n const user = await getService('user').add(newUser);\n\n const sanitizedUser = await sanitizeUser(user, ctx);\n\n if (settings.email_confirmation) {\n try {\n await getService('user').sendConfirmationEmail(sanitizedUser);\n } catch (err) {\n strapi.log.error(err);\n throw new ApplicationError('Error sending confirmation email');\n }\n\n return ctx.send({ user: sanitizedUser });\n }\n\n const mode = strapi.config.get('plugin::users-permissions.jwtManagement', 'legacy-support');\n if (mode === 'refresh') {\n const deviceId = extractDeviceId(ctx.request.body) \|\| crypto.randomUUID();\n\n const refresh = await strapi\n .sessionManager('users-permissions')\n .generateRefreshToken(String(user.id), deviceId, {\n type: 'refresh',\n metadata: buildSessionMetadataFromContext(ctx),\n });\n\n const access = await strapi\n .sessionManager('users-permissions')\n .generateAccessToken(refresh.token);\n if ('error' in access) {\n throw new ApplicationError('Invalid credentials');\n }\n\n return ctx.send({ jwt: access.token, refreshToken: refresh.token, user: sanitizedUser });\n }\n\n const jwt = getService('jwt').issue(_.pick(user, ['id']));\n return ctx.send({ jwt, user: sanitizedUser });\n },\n\n async emailConfirmation(ctx, next, returnUser) {\n const { confirmation: confirmationToken } = await validateEmailConfirmationBody(ctx.query);\n\n const userService = getService('user');\n const jwtService = getService('jwt');\n\n const [user] = await userService.fetchAll({ filters: { confirmationToken } });\n\n if (!user) {\n throw new ValidationError('Invalid token');\n }\n\n await userService.edit(user.id, { confirmed: true, confirmationToken: null });\n\n if (returnUser) {\n ctx.send({\n jwt: jwtService.issue({ id: user.id }),\n user: await sanitizeUser(user, ctx),\n });\n } else {\n const settings = await strapi\n .store({ type: 'plugin', name: 'users-permissions', key: 'advanced' })\n .get();\n\n ctx.redirect(settings.email_confirmation_redirection \|\| '/');\n }\n },\n\n async sendEmailConfirmation(ctx) {\n const { email } = await validateSendEmailConfirmationBody(ctx.request.body);\n\n const user = await strapi.db.query('plugin::users-permissions.user').findOne({\n where: { email: email.toLowerCase() },\n });\n\n if (!user) {\n return ctx.send({ email, sent: true });\n }\n\n if (user.confirmed) {\n throw new ApplicationError('Already confirmed');\n }\n\n if (user.blocked) {\n throw new ApplicationError('User blocked');\n }\n\n await getService('user').sendConfirmationEmail(user);\n\n ctx.send({\n email: user.email,\n sent: true,\n });\n },\n});\n"],"names":["crypto","require$$0","_","require$$1","concat","compact","isArray","require$$2","utils","require$$3","getService","require$$4","buildRefreshCookieOptions","require$$5","validateCallbackBody","validateRegisterBody","validateSendEmailConfirmationBody","validateForgotPasswordBody","validateResetPasswordBody","validateEmailConfirmationBody","validateChangePasswordBody","require$$6","ApplicationError","ValidationError","ForbiddenError","errors","buildSessionMetadata","sanitizeSessionEntry","sortSessionsForDisplay","sanitizeUser","user","ctx","auth","state","userSchema","strapi","getModel","contentAPI","sanitize","output","extractDeviceId","requestBody","deviceId","length","undefined","buildSessionMetadataFromContext","userAgent","request","headers","sendRefreshAuthResponse","metadata","body","tokenOptions","type","refresh","sessionManager","generateRefreshToken","String","id","access","generateAccessToken","token","upSessions","config","get","requestHttpOnly","header","httpOnly","cookieName","cookie","name","isProduction","process","env","NODE_ENV","cookies","set","send","jwt","refreshToken","reissueTokensAfterPasswordChange","invalidateRefreshToken","newDeviceId","randomUUID","revokeLogoutSessions","userId","scope","currentSessionId","session","validation","validateRefreshToken","isValid","sessionId","revokeSessionById","callback","provider","params","store","grantSettings","key","grantProvider","identifier","db","query","findOne","where","$or","email","toLowerCase","username","password","validPassword","validatePassword","advancedSettings","requiresConfirmation","confirmed","blocked","mode","issue","connect","error","message","changePassword","validations","currentPassword","edit","resetPassword","passwordConfirmation","code","resetPasswordToken","notFound","badRequest","rotation","rotateRefreshToken","unauthorized","result","logout","err","log","maxAge","_maxAge","cookieOptions","expires","Date","ok","getSessions","sessions","listSessions","data","map","revokeSession","revoked","next","providers","requestPath","url","split","server","startsWith","warn","queryCustomCallback","dynamicSessionCallback","customCallback","validate","validateCallback","plugin","grant","dynamic","oauthConnect","createOAuthConnectMiddleware","require$$7","forgotPassword","pluginStore","emailSettings","userInfo","randomBytes","toString","resetPasswordSettings","emailBody","template","URL","email_reset_password","SERVER_URL","ADMIN_URL","USER","TOKEN","emailObject","object","emailToSend","to","from","replyTo","response_email","subject","text","html","service","register","settings","allow_register","alwaysAllowedKeys","allowedKeys","allowedFields","invalidKeys","Object","keys","filter","includes","join","pick","role","default_role","identifierFilter","conflictingUserCount","count","unique_email","newUser","email_confirmation","add","sanitizedUser","sendConfirmationEmail","emailConfirmation","returnUser","confirmation","confirmationToken","userService","jwtService","fetchAll","filters","redirect","email_confirmation_redirection","sendEmailConfirmation","sent"],"mappings":";;;;;;;;;;;;;;AAEA;;;;4CAOA,MAAMA,MAAAA,GAASC,YAAAA;AACf,IAAA,MAAMC,CAAAA,GAAIC,YAAAA;AACV,IAAA,MAAM,EAAEC,MAAM,EAAEC,OAAO,EAAEC,OAAO,EAAE,GAAGC,UAAAA;AACrC,IAAA,MAAMC,KAAAA,GAAQC,UAAAA;IACd,MAAM,EAAEC,UAAU,EAAE,GAAGC,YAAAA,EAAAA;IACvB,MAAM,EAAEC,yBAAyB,EAAE,GAAGC,2BAAAA,EAAAA;AACtC,IAAA,MAAM,EACJC,oBAAoB,EACpBC,oBAAoB,EACpBC,iCAAiC,EACjCC,0BAA0B,EAC1BC,yBAAyB,EACzBC,6BAA6B,EAC7BC,0BAA0B,EAC3B,GAAGC,aAAAA,EAAAA;IAEJ,MAAM,EAAEC,gBAAgB,EAAEC,eAAe,EAAEC,cAAc,EAAE,GAAGhB,KAAAA,CAAMiB,MAAM;AAC1E,IAAA,MAAM,EAAEC,oBAAoB,EAAEC,oBAAoB,EAAEC,sBAAsB,EAAE,GAAGpB,KAAAA;IAE/E,MAAMqB,YAAAA,GAAe,CAACC,IAAAA,EAAMC,GAAAA,GAAAA;AAC1B,QAAA,MAAM,EAAEC,IAAI,EAAE,GAAGD,IAAIE,KAAK;QAC1B,MAAMC,UAAAA,GAAaC,MAAAA,CAAOC,QAAQ,CAAC,gCAAA,CAAA;QAEnC,OAAOD,MAAAA,CAAOE,UAAU,CAACC,QAAQ,CAACC,MAAM,CAACT,MAAMI,UAAAA,EAAY;AAAEF,YAAAA;;AAC/D,IAAA,CAAA;AAEA,IAAA,MAAMQ,kBAAkB,CAACC,WAAAA,GAAAA;AACvB,QAAA,MAAM,EAAEC,QAAQ,EAAE,GAAGD,eAAe,EAAA;AAEpC,QAAA,OAAO,OAAOC,QAAAA,KAAa,QAAA,IAAYA,SAASC,MAAM,GAAG,IAAID,QAAAA,GAAWE,SAAAA;AAC1E,IAAA,CAAA;IAEA,MAAMC,+BAAAA,GAAkC,CAACd,GAAAA,GACvCL,oBAAAA,CAAqB;AACnBoB,YAAAA,SAAAA,EAAWf,GAAAA,CAAIgB,OAAO,CAACC,OAAO,CAAC,YAAA;AACnC,SAAA,CAAA;IAEA,MAAMC,uBAAAA,GAA0B,OAAOd,OAAAA,EAAQJ,GAAAA,EAAKD,IAAAA,EAAM,EAAEoB,QAAQ,EAAE,GAAG,EAAE,GAAA;AACzE,QAAA,MAAMR,QAAAA,GAAWF,eAAAA,CAAgBT,GAAAA,CAAIgB,OAAO,CAACI,IAAI,CAAA;AACjD,QAAA,MAAMC,YAAAA,GAAe;YAAEC,IAAAA,EAAM,SAAA;AAAW,YAAA,GAAIH,QAAAA,GAAW;AAAEA,gBAAAA;gBAAa;AAAG,SAAA;AAEzE,QAAA,MAAMI,OAAAA,GAAU,MAAMnB,OAAAA,CACnBoB,cAAc,CAAC,mBAAA,CAAA,CACfC,oBAAoB,CAACC,MAAAA,CAAO3B,IAAAA,CAAK4B,EAAE,CAAA,EAAGhB,QAAAA,EAAUU,YAAAA,CAAAA;QAEnD,MAAMO,MAAAA,GAAS,MAAMxB,OAAAA,CAClBoB,cAAc,CAAC,mBAAA,CAAA,CACfK,mBAAmB,CAACN,OAAAA,CAAQO,KAAK,CAAA;AACpC,QAAA,IAAI,WAAWF,MAAAA,EAAQ;AACrB,YAAA,MAAM,IAAIrC,gBAAAA,CAAiB,qBAAA,CAAA;AAC/B,QAAA;AAEE,QAAA,MAAMwC,UAAAA,GAAa3B,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,oCAAA,CAAA;AACrC,QAAA,MAAMC,kBAAkBlC,GAAAA,CAAIgB,OAAO,CAACmB,MAAM,CAAC,0BAA0B,KAAK,UAAA;QAE1E,IAAIJ,UAAAA,EAAYK,YAAYF,eAAAA,EAAiB;AAC3C,YAAA,MAAMG,UAAAA,GAAaN,UAAAA,CAAWO,MAAM,EAAEC,IAAAA,IAAQ,mBAAA;AAC9C,YAAA,MAAMC,YAAAA,GAAeC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;YAC9C3C,GAAAA,CAAI4C,OAAO,CAACC,GAAG,CAACR,YAAYd,OAAAA,CAAQO,KAAK,EAAEjD,yBAAAA,CAA0BkD,UAAAA,EAAYS,YAAAA,CAAAA,CAAAA;YACjF,OAAOxC,GAAAA,CAAI8C,IAAI,CAAC;AAAEC,gBAAAA,GAAAA,EAAKnB,OAAOE,KAAK;gBAAE/B,IAAAA,EAAM,MAAMD,aAAaC,IAAAA,EAAMC,GAAAA;AAAI,aAAA,CAAA;AAC5E,QAAA;QAEE,OAAOA,GAAAA,CAAI8C,IAAI,CAAC;AACdC,YAAAA,GAAAA,EAAKnB,OAAOE,KAAK;AACjBkB,YAAAA,YAAAA,EAAczB,QAAQO,KAAK;YAC3B/B,IAAAA,EAAM,MAAMD,aAAaC,IAAAA,EAAMC,GAAAA;AACnC,SAAA,CAAA;AACA,IAAA,CAAA;IAEA,MAAMiD,gCAAAA,GAAmC,OAAO7C,OAAAA,EAAQJ,GAAAA,EAAKD,IAAAA,GAAAA;AAC3D,QAAA,MAAMY,QAAAA,GAAWF,eAAAA,CAAgBT,GAAAA,CAAIgB,OAAO,CAACI,IAAI,CAAA;QAEjD,MAAMhB,OAAAA,CAAOoB,cAAc,CAAC,mBAAA,CAAA,CAAqB0B,sBAAsB,CAACxB,MAAAA,CAAO3B,KAAK4B,EAAE,CAAA,CAAA;QAEtF,MAAMwB,WAAAA,GAAcxC,QAAAA,IAAY1C,MAAAA,CAAOmF,UAAU,EAAA;AACjD,QAAA,MAAM7B,OAAAA,GAAU,MAAMnB,OAAAA,CACnBoB,cAAc,CAAC,mBAAA,CAAA,CACfC,oBAAoB,CAACC,MAAAA,CAAO3B,IAAAA,CAAK4B,EAAE,CAAA,EAAGwB,WAAAA,EAAa;YAAE7B,IAAAA,EAAM;;QAE9D,MAAMM,MAAAA,GAAS,MAAMxB,OAAAA,CAClBoB,cAAc,CAAC,mBAAA,CAAA,CACfK,mBAAmB,CAACN,OAAAA,CAAQO,KAAK,CAAA;AACpC,QAAA,IAAI,WAAWF,MAAAA,EAAQ;AACrB,YAAA,MAAM,IAAIrC,gBAAAA,CAAiB,qBAAA,CAAA;AAC/B,QAAA;QAEE,OAAOS,GAAAA,CAAI8C,IAAI,CAAC;AACdC,YAAAA,GAAAA,EAAKnB,OAAOE,KAAK;AACjBkB,YAAAA,YAAAA,EAAczB,QAAQO,KAAK;YAC3B/B,IAAAA,EAAM,MAAMD,aAAaC,IAAAA,EAAMC,GAAAA;AACnC,SAAA,CAAA;AACA,IAAA,CAAA;IAEA,MAAMqD,oBAAAA,GAAuB,OAAOjD,OAAAA,EAAQJ,GAAAA,EAAKsD,MAAAA,EAAQ,EAAEC,KAAK,EAAE5C,QAAQ,EAAES,IAAI,EAAE,GAAA;QAChF,MAAMI,cAAAA,GAAiBpB,OAAAA,CAAOoB,cAAc,CAAC,mBAAA,CAAA;AAC7C,QAAA,MAAMO,UAAAA,GAAa3B,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,oCAAA,CAAA;AAErC,QAAA,IAAIsB,UAAU,KAAA,EAAO;YACnB,MAAM/B,cAAAA,CAAe0B,sBAAsB,CAACI,MAAAA,CAAAA;AAC5C,YAAA;AACJ,QAAA;AAEE,QAAA,IAAI3C,QAAAA,EAAU;YACZ,MAAMa,cAAAA,CAAe0B,sBAAsB,CAACI,MAAAA,EAAQ3C,QAAAA,CAAAA;AACpD,YAAA;AACJ,QAAA;AAEE,QAAA,IAAI6C,gBAAAA,GAAmBxD,GAAAA,CAAIE,KAAK,CAACuD,OAAO,EAAE9B,EAAAA;QAC1C,MAAMU,UAAAA,GAAaN,UAAAA,EAAYO,MAAAA,EAAQC,IAAAA,IAAQ,mBAAA;AAC/C,QAAA,MAAMS,eACJhD,GAAAA,CAAI4C,OAAO,CAACX,GAAG,CAACI,UAAAA,CAAAA,KACf,OAAOjB,IAAAA,CAAK4B,YAAY,KAAK,QAAA,GAAW5B,IAAAA,CAAK4B,YAAY,GAAGnC,SAAA,CAAA;AAE/D,QAAA,IAAImC,YAAAA,EAAc;AAChB,YAAA,MAAMU,UAAAA,GAAa,MAAMlC,cAAAA,CAAemC,oBAAoB,CAACX,YAAAA,CAAAA;YAC7D,IAAIU,UAAAA,CAAWE,OAAO,EAAE;AACtBJ,gBAAAA,gBAAAA,GAAmBE,WAAWG,SAAS;AAC7C,YAAA;AACA,QAAA;AAEE,QAAA,IAAIL,gBAAAA,EAAkB;YACpB,MAAMhC,cAAAA,CAAesC,iBAAiB,CAACR,MAAAA,EAAQE,gBAAAA,CAAAA;AAC/C,YAAA;AACJ,QAAA;QAEE,MAAMhC,cAAAA,CAAe0B,sBAAsB,CAACI,MAAAA,CAAAA;AAC9C,IAAA,CAAA;AAEArD,IAAAA,IAAAA,GAAiB,CAAC,EAAEG,MAAAA,EAAAA,OAAM,EAAE,IAAM;AAChC,YAAA,MAAM2D,UAAS/D,GAAG,EAAA;AAChB,gBAAA,MAAMgE,QAAAA,GAAWhE,GAAAA,CAAIiE,MAAM,CAACD,QAAQ,IAAI,OAAA;AACxC,gBAAA,MAAMC,MAAAA,GAASjE,GAAAA,CAAIgB,OAAO,CAACI,IAAI;gBAE/B,MAAM8C,KAAAA,GAAQ9D,OAAAA,CAAO8D,KAAK,CAAC;oBAAE5C,IAAAA,EAAM,QAAA;oBAAUiB,IAAAA,EAAM;;AACnD,gBAAA,MAAM4B,aAAAA,GAAgB,MAAMD,KAAAA,CAAMjC,GAAG,CAAC;oBAAEmC,GAAAA,EAAK;;gBAE7C,MAAMC,aAAAA,GAAgBL,QAAAA,KAAa,OAAA,GAAU,OAAA,GAAUA,QAAAA;AAEvD,gBAAA,IAAI,CAAC7F,CAAAA,CAAE8D,GAAG,CAACkC,aAAAA,EAAe;AAACE,oBAAAA,aAAAA;AAAe,oBAAA;iBAAU,CAAA,EAAG;AACrD,oBAAA,MAAM,IAAI9E,gBAAAA,CAAiB,2BAAA,CAAA;AACjC,gBAAA;AAEI,gBAAA,IAAIyE,aAAa,OAAA,EAAS;AACxB,oBAAA,MAAMjF,oBAAAA,CAAqBkF,MAAAA,CAAAA;oBAE3B,MAAM,EAAEK,UAAU,EAAE,GAAGL,MAAAA;;oBAGvB,MAAMlE,IAAAA,GAAO,MAAMK,OAAAA,CAAOmE,EAAE,CAACC,KAAK,CAAC,gCAAA,CAAA,CAAkCC,OAAO,CAAC;wBAC3EC,KAAAA,EAAO;AACLV,4BAAAA,QAAAA;4BACAW,GAAAA,EAAK;AAAC,gCAAA;AAAEC,oCAAAA,KAAAA,EAAON,WAAWO,WAAW;;AAAM,gCAAA;oCAAEC,QAAAA,EAAUR;;AAAa;AAC9E;AACA,qBAAA,CAAA;AAEM,oBAAA,IAAI,CAACvE,IAAAA,EAAM;AACT,wBAAA,MAAM,IAAIP,eAAAA,CAAgB,gCAAA,CAAA;AAClC,oBAAA;oBAEM,IAAI,CAACO,IAAAA,CAAKgF,QAAQ,EAAE;AAClB,wBAAA,MAAM,IAAIvF,eAAAA,CAAgB,gCAAA,CAAA;AAClC,oBAAA;oBAEM,MAAMwF,aAAAA,GAAgB,MAAMrG,UAAAA,CAAW,MAAA,CAAA,CAAQsG,gBAAgB,CAC7DhB,MAAAA,CAAOc,QAAQ,EACfhF,IAAAA,CAAKgF,QAAA,CAAA;AAGP,oBAAA,IAAI,CAACC,aAAAA,EAAe;AAClB,wBAAA,MAAM,IAAIxF,eAAAA,CAAgB,gCAAA,CAAA;AAClC,oBAAA;AAEM,oBAAA,MAAM0F,gBAAAA,GAAmB,MAAMhB,KAAAA,CAAMjC,GAAG,CAAC;wBAAEmC,GAAAA,EAAK;;AAChD,oBAAA,MAAMe,oBAAAA,GAAuBhH,CAAAA,CAAE8D,GAAG,CAACiD,gBAAAA,EAAkB,oBAAA,CAAA;AAErD,oBAAA,IAAIC,oBAAAA,IAAwBpF,IAAAA,CAAKqF,SAAS,KAAK,IAAA,EAAM;AACnD,wBAAA,MAAM,IAAI7F,gBAAAA,CAAiB,qCAAA,CAAA;AACnC,oBAAA;oBAEM,IAAIQ,IAAAA,CAAKsF,OAAO,KAAK,IAAA,EAAM;AACzB,wBAAA,MAAM,IAAI9F,gBAAAA,CAAiB,mDAAA,CAAA;AACnC,oBAAA;AAEM,oBAAA,MAAM+F,OAAOlF,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,yCAAA,EAA2C,gBAAA,CAAA;AAC1E,oBAAA,IAAIqD,SAAS,SAAA,EAAW;wBACtB,OAAOpE,uBAAAA,CAAwBd,OAAAA,EAAQJ,GAAAA,EAAKD,IAAAA,EAAM;AAChDoB,4BAAAA,QAAAA,EAAUL,+BAAAA,CAAgCd,GAAAA;AACpD,yBAAA,CAAA;AACA,oBAAA;oBAEM,OAAOA,GAAAA,CAAI8C,IAAI,CAAC;wBACdC,GAAAA,EAAKpE,UAAAA,CAAW,KAAA,CAAA,CAAO4G,KAAK,CAAC;AAAE5D,4BAAAA,EAAAA,EAAI5B,KAAK4B;;wBACxC5B,IAAAA,EAAM,MAAMD,aAAaC,IAAAA,EAAMC,GAAAA;AACvC,qBAAA,CAAA;AACA,gBAAA;;gBAGI,IAAI;oBACF,MAAMD,IAAAA,GAAO,MAAMpB,UAAAA,CAAW,WAAA,CAAA,CAAa6G,OAAO,CAACxB,QAAAA,EAAUhE,IAAIwE,KAAK,CAAA;oBAEtE,IAAIzE,IAAAA,CAAKsF,OAAO,EAAE;AAChB,wBAAA,MAAM,IAAI5F,cAAAA,CAAe,mDAAA,CAAA;AACjC,oBAAA;AAEM,oBAAA,MAAM6F,OAAOlF,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,yCAAA,EAA2C,gBAAA,CAAA;AAC1E,oBAAA,IAAIqD,SAAS,SAAA,EAAW;wBACtB,OAAOpE,uBAAAA,CAAwBd,OAAAA,EAAQJ,GAAAA,EAAKD,IAAAA,EAAM;AAChDoB,4BAAAA,QAAAA,EAAUL,+BAAAA,CAAgCd,GAAAA;AACpD,yBAAA,CAAA;AACA,oBAAA;oBAEM,OAAOA,GAAAA,CAAI8C,IAAI,CAAC;wBACdC,GAAAA,EAAKpE,UAAAA,CAAW,KAAA,CAAA,CAAO4G,KAAK,CAAC;AAAE5D,4BAAAA,EAAAA,EAAI5B,KAAK4B;;wBACxC5B,IAAAA,EAAM,MAAMD,aAAaC,IAAAA,EAAMC,GAAAA;AACvC,qBAAA,CAAA;AACA,gBAAA,CAAA,CAAM,OAAOyF,KAAAA,EAAO;oBACd,MAAM,IAAIlG,gBAAAA,CAAiBkG,KAAAA,CAAMC,OAAO,CAAA;AAC9C,gBAAA;AACA,YAAA,CAAA;AAEE,YAAA,MAAMC,gBAAe3F,GAAG,EAAA;AACtB,gBAAA,IAAI,CAACA,GAAAA,CAAIE,KAAK,CAACH,IAAI,EAAE;AACnB,oBAAA,MAAM,IAAIR,gBAAAA,CAAiB,kDAAA,CAAA;AACjC,gBAAA;AAEI,gBAAA,MAAMqG,WAAAA,GAAcxF,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,2CAAA,CAAA;AAEtC,gBAAA,MAAM,EAAE4D,eAAe,EAAEd,QAAQ,EAAE,GAAG,MAAM1F,0BAAAA,CAC1CW,GAAAA,CAAIgB,OAAO,CAACI,IAAI,EAChBwE,WAAAA,CAAAA;gBAGF,MAAM7F,IAAAA,GAAO,MAAMK,OAAAA,CAAOmE,EAAA,CACvBC,KAAK,CAAC,gCAAA,CAAA,CACNC,OAAO,CAAC;oBAAEC,KAAAA,EAAO;AAAE/C,wBAAAA,EAAAA,EAAI3B,GAAAA,CAAIE,KAAK,CAACH,IAAI,CAAC4B;AAAE;;gBAE3C,MAAMqD,aAAAA,GAAgB,MAAMrG,UAAAA,CAAW,MAAA,CAAA,CAAQsG,gBAAgB,CAACY,eAAAA,EAAiB9F,KAAKgF,QAAQ,CAAA;AAE9F,gBAAA,IAAI,CAACC,aAAAA,EAAe;AAClB,oBAAA,MAAM,IAAIxF,eAAAA,CAAgB,0CAAA,CAAA;AAChC,gBAAA;AAEI,gBAAA,IAAIqG,oBAAoBd,QAAAA,EAAU;AAChC,oBAAA,MAAM,IAAIvF,eAAAA,CAAgB,gEAAA,CAAA;AAChC,gBAAA;AAEI,gBAAA,MAAMb,WAAW,MAAA,CAAA,CAAQmH,IAAI,CAAC/F,IAAAA,CAAK4B,EAAE,EAAE;AAAEoD,oBAAAA;;AAEzC,gBAAA,MAAMO,OAAOlF,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,yCAAA,EAA2C,gBAAA,CAAA;AAC1E,gBAAA,IAAIqD,SAAS,SAAA,EAAW;oBACtB,OAAOrC,gCAAAA,CAAiC7C,SAAQJ,GAAAA,EAAKD,IAAAA,CAAAA;AAC3D,gBAAA;gBAEI,OAAOC,GAAAA,CAAI8C,IAAI,CAAC;oBACdC,GAAAA,EAAKpE,UAAAA,CAAW,KAAA,CAAA,CAAO4G,KAAK,CAAC;AAAE5D,wBAAAA,EAAAA,EAAI5B,KAAK4B;;oBACxC5B,IAAAA,EAAM,MAAMD,aAAaC,IAAAA,EAAMC,GAAAA;AACrC,iBAAA,CAAA;AACA,YAAA,CAAA;AAEE,YAAA,MAAM+F,eAAc/F,GAAG,EAAA;AACrB,gBAAA,MAAM4F,WAAAA,GAAcxF,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,2CAAA,CAAA;AAEtC,gBAAA,MAAM,EAAE8C,QAAQ,EAAEiB,oBAAoB,EAAEC,IAAI,EAAE,GAAG,MAAM9G,yBAAAA,CACrDa,GAAAA,CAAIgB,OAAO,CAACI,IAAI,EAChBwE,WAAAA,CAAAA;AAGF,gBAAA,IAAIb,aAAaiB,oBAAAA,EAAsB;AACrC,oBAAA,MAAM,IAAIxG,eAAAA,CAAgB,wBAAA,CAAA;AAChC,gBAAA;gBAEI,MAAMO,IAAAA,GAAO,MAAMK,OAAAA,CAAOmE,EAAA,CACvBC,KAAK,CAAC,gCAAA,CAAA,CACNC,OAAO,CAAC;oBAAEC,KAAAA,EAAO;wBAAEwB,kBAAAA,EAAoBD;AAAI;AAAE,iBAAA,CAAA;AAEhD,gBAAA,IAAI,CAAClG,IAAAA,EAAM;AACT,oBAAA,MAAM,IAAIP,eAAAA,CAAgB,yBAAA,CAAA;AAChC,gBAAA;AAEI,gBAAA,MAAMb,WAAW,MAAA,CAAA,CAAQmH,IAAI,CAAC/F,IAAAA,CAAK4B,EAAE,EAAE;oBACrCuE,kBAAAA,EAAoB,IAAA;AACpBnB,oBAAAA;AACN,iBAAA,CAAA;AAEI,gBAAA,MAAMO,OAAOlF,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,yCAAA,EAA2C,gBAAA,CAAA;AAC1E,gBAAA,IAAIqD,SAAS,SAAA,EAAW;oBACtB,OAAOrC,gCAAAA,CAAiC7C,SAAQJ,GAAAA,EAAKD,IAAAA,CAAAA;AAC3D,gBAAA;gBAEI,OAAOC,GAAAA,CAAI8C,IAAI,CAAC;oBACdC,GAAAA,EAAKpE,UAAAA,CAAW,KAAA,CAAA,CAAO4G,KAAK,CAAC;AAAE5D,wBAAAA,EAAAA,EAAI5B,KAAK4B;;oBACxC5B,IAAAA,EAAM,MAAMD,aAAaC,IAAAA,EAAMC,GAAAA;AACrC,iBAAA,CAAA;AACA,YAAA,CAAA;AACE,YAAA,MAAMuB,SAAQvB,GAAG,EAAA;AACf,gBAAA,MAAMsF,OAAOlF,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,yCAAA,EAA2C,gBAAA,CAAA;AAC1E,gBAAA,IAAIqD,SAAS,SAAA,EAAW;AACtB,oBAAA,OAAOtF,IAAImG,QAAQ,EAAA;AACzB,gBAAA;AAEI,gBAAA,MAAMpE,UAAAA,GAAa3B,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,oCAAA,CAAA;gBACrC,MAAMI,UAAAA,GAAaN,UAAAA,EAAYO,MAAAA,EAAQC,IAAAA,IAAQ,mBAAA;;AAG/C,gBAAA,IAAIS,YAAAA,GAAehD,GAAAA,CAAI4C,OAAO,CAACX,GAAG,CAACI,UAAAA,CAAAA;AACnC,gBAAA,IAAI,CAACW,YAAAA,EAAc;AACjBA,oBAAAA,YAAAA,GAAehD,GAAAA,CAAIgB,OAAO,CAACI,IAAI,EAAE4B,YAAAA;AACvC,gBAAA;AAEI,gBAAA,IAAI,CAACA,YAAAA,IAAgB,OAAOA,YAAAA,KAAiB,QAAA,EAAU;oBACrD,OAAOhD,GAAAA,CAAIoG,UAAU,CAAC,uBAAA,CAAA;AAC5B,gBAAA;AAEI,gBAAA,MAAMC,WAAW,MAAMjG,OAAAA,CACpBoB,cAAc,CAAC,mBAAA,CAAA,CACf8E,kBAAkB,CAACtD,YAAAA,CAAAA;AACtB,gBAAA,IAAI,WAAWqD,QAAAA,EAAU;oBACvB,OAAOrG,GAAAA,CAAIuG,YAAY,CAAC,uBAAA,CAAA;AAC9B,gBAAA;gBAEI,MAAMC,MAAAA,GAAS,MAAMpG,OAAAA,CAClBoB,cAAc,CAAC,mBAAA,CAAA,CACfK,mBAAmB,CAACwE,QAAAA,CAASvE,KAAK,CAAA;AACrC,gBAAA,IAAI,WAAW0E,MAAAA,EAAQ;oBACrB,OAAOxG,GAAAA,CAAIuG,YAAY,CAAC,uBAAA,CAAA;AAC9B,gBAAA;AAEI,gBAAA,MAAMrE,kBAAkBlC,GAAAA,CAAIgB,OAAO,CAACmB,MAAM,CAAC,0BAA0B,KAAK,UAAA;gBAC1E,IAAIJ,UAAAA,EAAYK,YAAYF,eAAAA,EAAiB;AAC3C,oBAAA,MAAMM,YAAAA,GAAeC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;oBAC9C3C,GAAAA,CAAI4C,OAAO,CAACC,GAAG,CACbR,YACAgE,QAAAA,CAASvE,KAAK,EACdjD,yBAAAA,CAA0BkD,UAAAA,EAAYS,YAAAA,CAAAA,CAAAA;oBAExC,OAAOxC,GAAAA,CAAI8C,IAAI,CAAC;AAAEC,wBAAAA,GAAAA,EAAKyD,OAAO1E;AAAK,qBAAA,CAAA;AACzC,gBAAA;gBACI,OAAO9B,GAAAA,CAAI8C,IAAI,CAAC;AAAEC,oBAAAA,GAAAA,EAAKyD,OAAO1E,KAAK;AAAEkB,oBAAAA,YAAAA,EAAcqD,SAASvE;;AAChE,YAAA,CAAA;AACE,YAAA,MAAM2E,QAAOzG,GAAG,EAAA;AACd,gBAAA,MAAMsF,OAAOlF,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,yCAAA,EAA2C,gBAAA,CAAA;AAC1E,gBAAA,IAAIqD,SAAS,SAAA,EAAW;AACtB,oBAAA,OAAOtF,IAAImG,QAAQ,EAAA;AACzB,gBAAA;AAEI,gBAAA,IAAI,CAACnG,GAAAA,CAAIE,KAAK,CAACH,IAAI,EAAE;oBACnB,OAAOC,GAAAA,CAAIuG,YAAY,CAAC,wBAAA,CAAA;AAC9B,gBAAA;AAEI,gBAAA,MAAMjD,SAAS5B,MAAAA,CAAO1B,GAAAA,CAAIE,KAAK,CAACH,IAAI,CAAC4B,EAAE,CAAA;AACvC,gBAAA,MAAMI,UAAAA,GAAa3B,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,oCAAA,CAAA;AACrC,gBAAA,MAAMb,OAAOpB,GAAAA,CAAIgB,OAAO,CAACI,IAAI,IAAI,EAAA;gBACjC,MAAMmC,KAAAA,GAAQ,OAAOnC,IAAAA,CAAKmC,KAAK,KAAK,QAAA,GAAWnC,IAAAA,CAAKmC,KAAK,GAAG1C,SAAAA;AAC5D,gBAAA,MAAMF,WAAWF,eAAAA,CAAgBW,IAAAA,CAAAA;gBAEjC,IAAI;oBACF,MAAMiC,oBAAAA,CAAqBjD,OAAAA,EAAQJ,GAAAA,EAAKsD,MAAAA,EAAQ;AAAEC,wBAAAA,KAAAA;AAAO5C,wBAAAA,QAAAA;AAAUS,wBAAAA;;AACzE,gBAAA,CAAA,CAAM,OAAOsF,GAAAA,EAAK;AACZtG,oBAAAA,OAAAA,CAAOuG,GAAG,CAAClB,KAAK,CAAC,kBAAA,EAAoBiB,GAAAA,CAAAA;AAC3C,gBAAA;AAEI,gBAAA,MAAMxE,kBAAkBlC,GAAAA,CAAIgB,OAAO,CAACmB,MAAM,CAAC,0BAA0B,KAAK,UAAA;gBAC1E,IAAIJ,UAAAA,EAAYK,YAAYF,eAAAA,EAAiB;AAC3C,oBAAA,MAAMG,UAAAA,GAAaN,UAAAA,CAAWO,MAAM,EAAEC,IAAAA,IAAQ,mBAAA;AAC9C,oBAAA,MAAMC,YAAAA,GAAeC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;oBAE9C,MAAM,EAAEiE,QAAQC,OAAO,EAAE,GAAGC,aAAAA,EAAe,GAAGjI,0BAC5CkD,UAAAA,EACAS,YAAAA,CAAAA;AAGFxC,oBAAAA,GAAAA,CAAI4C,OAAO,CAACC,GAAG,CAACR,YAAY,EAAA,EAAI;AAAE,wBAAA,GAAGyE,aAAa;AAAEC,wBAAAA,OAAAA,EAAS,IAAIC,IAAAA,CAAK,CAAA;AAAE,qBAAA,CAAA;AAC9E,gBAAA;gBACI,OAAOhH,GAAAA,CAAI8C,IAAI,CAAC;oBAAEmE,EAAAA,EAAI;AAAI,iBAAA,CAAA;AAC9B,YAAA,CAAA;AACE,YAAA,MAAMC,aAAYlH,GAAG,EAAA;AACnB,gBAAA,MAAMsF,OAAOlF,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,yCAAA,EAA2C,gBAAA,CAAA;AAC1E,gBAAA,IAAIqD,SAAS,SAAA,EAAW;AACtB,oBAAA,OAAOtF,IAAImG,QAAQ,EAAA;AACzB,gBAAA;AAEI,gBAAA,IAAI,CAACnG,GAAAA,CAAIE,KAAK,CAACH,IAAI,EAAE;oBACnB,OAAOC,GAAAA,CAAIuG,YAAY,CAAC,wBAAA,CAAA;AAC9B,gBAAA;AAEI,gBAAA,MAAM/C,gBAAAA,GAAmBxD,GAAAA,CAAIE,KAAK,CAACuD,OAAO,EAAE9B,EAAAA;AAC5C,gBAAA,MAAMwF,QAAAA,GAAW,MAAM/G,OAAAA,CACpBoB,cAAc,CAAC,mBAAA,CAAA,CACf4F,YAAY,CAAC1F,MAAAA,CAAO1B,GAAAA,CAAIE,KAAK,CAACH,IAAI,CAAC4B,EAAE,CAAA,CAAA;gBAExC,MAAM0F,IAAAA,GAAOxH,uBACXsH,QAAAA,CAASG,GAAG,CAAC,CAAC7D,OAAAA,GAAY7D,qBAAqB6D,OAAAA,EAASD,gBAAAA,CAAAA,CAAAA,CAAAA;gBAG1D,OAAOxD,GAAAA,CAAI8C,IAAI,CAAC;AAAEuE,oBAAAA;;AACtB,YAAA,CAAA;AACE,YAAA,MAAME,eAAcvH,GAAG,EAAA;AACrB,gBAAA,MAAMsF,OAAOlF,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,yCAAA,EAA2C,gBAAA,CAAA;AAC1E,gBAAA,IAAIqD,SAAS,SAAA,EAAW;AACtB,oBAAA,OAAOtF,IAAImG,QAAQ,EAAA;AACzB,gBAAA;AAEI,gBAAA,IAAI,CAACnG,GAAAA,CAAIE,KAAK,CAACH,IAAI,EAAE;oBACnB,OAAOC,GAAAA,CAAIuG,YAAY,CAAC,wBAAA,CAAA;AAC9B,gBAAA;AAEI,gBAAA,MAAM,EAAE1C,SAAS,EAAE,GAAG7D,IAAIiE,MAAM;AAChC,gBAAA,MAAMuD,OAAAA,GAAU,MAAMpH,OAAAA,CACnBoB,cAAc,CAAC,mBAAA,CAAA,CACfsC,iBAAiB,CAACpC,MAAAA,CAAO1B,IAAIE,KAAK,CAACH,IAAI,CAAC4B,EAAE,CAAA,EAAGkC,SAAAA,CAAAA;AAEhD,gBAAA,IAAI,CAAC2D,OAAAA,EAAS;oBACZ,OAAOxH,GAAAA,CAAImG,QAAQ,CAAC,mBAAA,CAAA;AAC1B,gBAAA;gBAEI,OAAOnG,GAAAA,CAAI8C,IAAI,CAAC;AAAEuE,oBAAAA,IAAAA,EAAM;AAAE,iBAAA,CAAA;AAC9B,YAAA,CAAA;YACE,MAAM7B,OAAAA,CAAAA,CAAQxF,GAAG,EAAEyH,IAAI,EAAA;AACrB,gBAAA,MAAMC,SAAAA,GAAY,MAAMtH,OAAAA,CACrB8D,KAAK,CAAC;oBAAE5C,IAAAA,EAAM,QAAA;oBAAUiB,IAAAA,EAAM,mBAAA;oBAAqB6B,GAAAA,EAAK;AAAO,iBAAA,CAAA,CAC/DnC,GAAG,EAAA;gBAEN,MAAM,CAAC0F,YAAY,GAAG3H,GAAAA,CAAIgB,OAAO,CAAC4G,GAAG,CAACC,KAAK,CAAC,GAAA,CAAA;AAC5C,gBAAA,MAAM7D,QAAAA,GAAW2D,WAAAA,CAAYE,KAAK,CAAC,WAAA,CAAY,CAAC,CAAA,CAAE,CAACA,KAAK,CAAC,GAAA,CAAI,CAAC,CAAA,CAAE;AAEhE,gBAAA,IAAI,CAAC1J,CAAAA,CAAE8D,GAAG,CAACyF,SAAAA,EAAW;AAAC1D,oBAAAA,QAAAA;AAAU,oBAAA;iBAAU,CAAA,EAAG;AAC5C,oBAAA,MAAM,IAAIzE,gBAAAA,CAAiB,2BAAA,CAAA;AACjC,gBAAA;gBAEI,IAAI,CAACa,OAAAA,CAAO4B,MAAM,CAAC8F,MAAM,CAACF,GAAG,CAACG,UAAU,CAAC,MAAA,CAAA,EAAS;oBAChD3H,OAAAA,CAAOuG,GAAG,CAACqB,IAAI,CACb,6NAAA,CAAA;AAER,gBAAA;AAEI,gBAAA,MAAMC,mBAAAA,GAAsB9J,CAAAA,CAAE8D,GAAG,CAACjC,GAAAA,EAAK,gBAAA,CAAA;AACvC,gBAAA,MAAMkI,sBAAAA,GAAyB/J,CAAAA,CAAE8D,GAAG,CAACjC,GAAAA,EAAK,gCAAA,CAAA;AAC1C,gBAAA,MAAMmI,iBAAiBF,mBAAAA,IAAuBC,sBAAAA;AAE9C,gBAAA,IAAIC,mBAAmBtH,SAAAA,EAAW;oBAChC,IAAI;wBACF,MAAM,EAAEuH,QAAAA,EAAUC,gBAAgB,EAAE,GAAGjI,QACpCkI,MAAM,CAAC,mBAAA,CAAA,CACPtG,MAAM,CAAC,UAAA,CAAA;AAEV,wBAAA,MAAMqG,gBAAAA,CAAiBF,cAAAA,EAAgBT,SAAS,CAAC1D,QAAAA,CAAS,CAAA;;AAG1DhE,wBAAAA,GAAAA,CAAIyD,OAAO,GAAGzD,GAAAA,CAAIyD,OAAO,IAAI,EAAA;wBAC7BzD,GAAAA,CAAIyD,OAAO,CAAC8E,KAAK,GAAGvI,IAAIyD,OAAO,CAAC8E,KAAK,IAAI,EAAA;AACzCvI,wBAAAA,GAAAA,CAAIyD,OAAO,CAAC8E,KAAK,CAACC,OAAO,GAAG;AAC1B,4BAAA,GAAGxI,GAAAA,CAAIyD,OAAO,CAAC8E,KAAK,CAACC,OAAO;4BAC5BzE,QAAAA,EAAUoE;AACpB,yBAAA;wBACQnI,GAAAA,CAAIE,KAAK,CAACuI,YAAY,GAAG;4BAAE1E,QAAAA,EAAUoE;AAAc,yBAAA;AAC3D,oBAAA,CAAA,CAAQ,OAAM;wBACN,MAAM,IAAI3I,gBAAgB,+BAAA,EAAiC;4BAAEuE,QAAAA,EAAUoE;AAAc,yBAAA,CAAA;AAC7F,oBAAA;AACA,gBAAA;gBAEI,MAAM,EAAEO,4BAA4B,EAAE,GAAGC,mBAAAA,EAAAA;AACzC,gBAAA,MAAMF,YAAAA,GAAeC,4BAAAA,EAAAA;AAErB,gBAAA,OAAOD,aAAazI,GAAAA,EAAKyH,IAAAA,CAAAA;AAC7B,YAAA,CAAA;AAEE,YAAA,MAAMmB,gBAAe5I,GAAG,EAAA;gBACtB,MAAM,EAAE4E,KAAK,EAAE,GAAG,MAAM1F,0BAAAA,CAA2Bc,GAAAA,CAAIgB,OAAO,CAACI,IAAI,CAAA;AAEnE,gBAAA,MAAMyH,WAAAA,GAAc,MAAMzI,OAAAA,CAAO8D,KAAK,CAAC;oBAAE5C,IAAAA,EAAM,QAAA;oBAAUiB,IAAAA,EAAM;;AAE/D,gBAAA,MAAMuG,aAAAA,GAAgB,MAAMD,WAAAA,CAAY5G,GAAG,CAAC;oBAAEmC,GAAAA,EAAK;;AACnD,gBAAA,MAAMc,gBAAAA,GAAmB,MAAM2D,WAAAA,CAAY5G,GAAG,CAAC;oBAAEmC,GAAAA,EAAK;;;gBAGtD,MAAMrE,IAAAA,GAAO,MAAMK,OAAAA,CAAOmE,EAAA,CACvBC,KAAK,CAAC,gCAAA,CAAA,CACNC,OAAO,CAAC;oBAAEC,KAAAA,EAAO;AAAEE,wBAAAA,KAAAA,EAAOA,MAAMC,WAAW;AAAE;;AAEhD,gBAAA,IAAI,CAAC9E,IAAAA,IAAQA,IAAAA,CAAKsF,OAAO,EAAE;oBACzB,OAAOrF,GAAAA,CAAI8C,IAAI,CAAC;wBAAEmE,EAAAA,EAAI;AAAI,qBAAA,CAAA;AAChC,gBAAA;;gBAGI,MAAM8B,QAAAA,GAAW,MAAMjJ,YAAAA,CAAaC,IAAAA,EAAMC,GAAAA,CAAAA;AAE1C,gBAAA,MAAMkG,qBAAqBjI,MAAAA,CAAO+K,WAAW,CAAC,EAAA,CAAA,CAAIC,QAAQ,CAAC,KAAA,CAAA;AAE3D,gBAAA,MAAMC,wBAAwB/K,CAAAA,CAAE8D,GAAG,CAAC6G,aAAAA,EAAe,0BAA0B,EAAA,CAAA;gBAC7E,MAAMK,SAAAA,GAAY,MAAMxK,UAAAA,CAAW,mBAAA,CAAA,CAAqByK,QAAQ,CAC9DF,qBAAAA,CAAsBxD,OAAO,EAC7B;AACE2D,oBAAAA,GAAAA,EAAKnE,iBAAiBoE,oBAAoB;AAC1CC,oBAAAA,UAAAA,EAAYnJ,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,oBAAA,CAAA;AAC9BuH,oBAAAA,SAAAA,EAAWpJ,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,mBAAA,CAAA;oBAC7BwH,IAAAA,EAAMV,QAAAA;oBACNW,KAAAA,EAAOxD;AACf,iBAAA,CAAA;gBAGI,MAAMyD,WAAAA,GAAc,MAAMhL,UAAAA,CAAW,mBAAA,CAAA,CAAqByK,QAAQ,CAChEF,qBAAAA,CAAsBU,MAAM,EAC5B;oBACEH,IAAAA,EAAMV;AACd,iBAAA,CAAA;AAGI,gBAAA,MAAMc,WAAAA,GAAc;AAClBC,oBAAAA,EAAAA,EAAI/J,KAAK6E,KAAK;oBACdmF,IAAAA,EACEb,qBAAAA,CAAsBa,IAAI,CAACnF,KAAK,IAAIsE,sBAAsBa,IAAI,CAACxH,IAAA,GAC3D,CAAA,EAAG2G,qBAAAA,CAAsBa,IAAI,CAACxH,IAAI,CAAC,EAAE,EAAE2G,qBAAAA,CAAsBa,IAAI,CAACnF,KAAK,CAAC,CAAC,CAAA,GACzE/D,SAAAA;AACNmJ,oBAAAA,OAAAA,EAASd,sBAAsBe,cAAc;oBAC7CC,OAAAA,EAASP,WAAAA;oBACTQ,IAAAA,EAAMhB,SAAAA;oBACNiB,IAAAA,EAAMjB;AACZ,iBAAA;;AAGI,gBAAA,MAAMxK,WAAW,MAAA,CAAA,CAAQmH,IAAI,CAAC/F,IAAAA,CAAK4B,EAAE,EAAE;AAAEuE,oBAAAA;;;gBAGzC,MAAM9F,OAAAA,CAAOkI,MAAM,CAAC,OAAA,CAAA,CAAS+B,OAAO,CAAC,OAAA,CAAA,CAASvH,IAAI,CAAC+G,WAAAA,CAAAA;AAEnD7J,gBAAAA,GAAAA,CAAI8C,IAAI,CAAC;oBAAEmE,EAAAA,EAAI;AAAI,iBAAA,CAAA;AACvB,YAAA,CAAA;AAEE,YAAA,MAAMqD,UAAStK,GAAG,EAAA;AAChB,gBAAA,MAAM6I,WAAAA,GAAc,MAAMzI,OAAAA,CAAO8D,KAAK,CAAC;oBAAE5C,IAAAA,EAAM,QAAA;oBAAUiB,IAAAA,EAAM;;AAE/D,gBAAA,MAAMgI,QAAAA,GAAW,MAAM1B,WAAAA,CAAY5G,GAAG,CAAC;oBAAEmC,GAAAA,EAAK;;gBAE9C,IAAI,CAACmG,QAAAA,CAASC,cAAc,EAAE;AAC5B,oBAAA,MAAM,IAAIjL,gBAAAA,CAAiB,uCAAA,CAAA;AACjC,gBAAA;gBAEI,MAAM,EAAE+K,QAAQ,EAAE,GAAGlK,QAAO4B,MAAM,CAACC,GAAG,CAAC,2BAAA,CAAA;AACvC,gBAAA,MAAMwI,iBAAAA,GAAoB;AAAC,oBAAA,UAAA;AAAY,oBAAA,UAAA;AAAY,oBAAA;AAAQ,iBAAA;;gBAG3D,MAAMC,WAAAA,GAAcpM,OAAAA,CAClBD,MAAAA,CAAOoM,iBAAAA,EAAmBlM,OAAAA,CAAQ+L,UAAUK,aAAAA,CAAAA,GAAiBL,QAAAA,CAASK,aAAa,GAAG,EAAE,CAAA,CAAA;;AAI1F,gBAAA,MAAMC,cAAcC,MAAAA,CAAOC,IAAI,CAAC9K,GAAAA,CAAIgB,OAAO,CAACI,IAAI,CAAA,CAAE2J,MAAM,CAAC,CAAC3G,GAAAA,GAAQ,CAACsG,WAAAA,CAAYM,QAAQ,CAAC5G,GAAAA,CAAAA,CAAAA;gBAExF,IAAIwG,WAAAA,CAAYhK,MAAM,GAAG,CAAA,EAAG;;oBAE1B,MAAM,IAAIpB,gBAAgB,CAAC,oBAAoB,EAAEoL,WAAAA,CAAYK,IAAI,CAAC,IAAA,CAAA,CAAA,CAAO,CAAA;AAC/E,gBAAA;AAEI,gBAAA,MAAMhH,MAAAA,GAAS;oBACb,GAAG9F,CAAAA,CAAE+M,IAAI,CAAClL,GAAAA,CAAIgB,OAAO,CAACI,IAAI,EAAEsJ,WAAAA,CAAY;oBACxC1G,QAAAA,EAAU;AAChB,iBAAA;AAEI,gBAAA,MAAM4B,WAAAA,GAAcxF,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,2CAAA,CAAA;AAEtC,gBAAA,MAAMjD,qBAAqBiF,MAAAA,EAAQ2B,WAAAA,CAAAA;gBAEnC,MAAMuF,IAAAA,GAAO,MAAM/K,OAAAA,CAAOmE,EAAA,CACvBC,KAAK,CAAC,gCAAA,CAAA,CACNC,OAAO,CAAC;oBAAEC,KAAAA,EAAO;AAAEpD,wBAAAA,IAAAA,EAAMiJ,SAASa;AAAY;;AAEjD,gBAAA,IAAI,CAACD,IAAAA,EAAM;AACT,oBAAA,MAAM,IAAI5L,gBAAAA,CAAiB,qCAAA,CAAA;AACjC,gBAAA;AAEI,gBAAA,MAAM,EAAEqF,KAAK,EAAEE,QAAQ,EAAEd,QAAQ,EAAE,GAAGC,MAAAA;AAEtC,gBAAA,MAAMoH,gBAAAA,GAAmB;oBACvB1G,GAAAA,EAAK;AACH,wBAAA;AAAEC,4BAAAA,KAAAA,EAAOA,MAAMC,WAAW;AAAE,yBAAA;AAC5B,wBAAA;AAAEC,4BAAAA,QAAAA,EAAUF,MAAMC,WAAW;AAAE,yBAAA;AAC/B,wBAAA;AAAEC,4BAAAA;AAAQ,yBAAA;AACV,wBAAA;4BAAEF,KAAAA,EAAOE;AAAQ;AAClB;AACP,iBAAA;gBAEI,MAAMwG,oBAAAA,GAAuB,MAAMlL,OAAAA,CAAOmE,EAAE,CAACC,KAAK,CAAC,gCAAA,CAAA,CAAkC+G,KAAK,CAAC;oBACzF7G,KAAAA,EAAO;AAAE,wBAAA,GAAG2G,gBAAgB;AAAErH,wBAAAA;AAAQ;AAC5C,iBAAA,CAAA;AAEI,gBAAA,IAAIsH,uBAAuB,CAAA,EAAG;AAC5B,oBAAA,MAAM,IAAI/L,gBAAAA,CAAiB,qCAAA,CAAA;AACjC,gBAAA;gBAEI,IAAIgL,QAAAA,CAASiB,YAAY,EAAE;oBACzB,MAAMF,oBAAAA,GAAuB,MAAMlL,OAAAA,CAAOmE,EAAE,CAACC,KAAK,CAAC,gCAAA,CAAA,CAAkC+G,KAAK,CAAC;wBACzF7G,KAAAA,EAAO;AAAE,4BAAA,GAAG2G;AAAgB;AACpC,qBAAA,CAAA;AAEM,oBAAA,IAAIC,uBAAuB,CAAA,EAAG;AAC5B,wBAAA,MAAM,IAAI/L,gBAAAA,CAAiB,qCAAA,CAAA;AACnC,oBAAA;AACA,gBAAA;AAEI,gBAAA,MAAMkM,OAAAA,GAAU;AACd,oBAAA,GAAGxH,MAAM;AACTkH,oBAAAA,IAAAA,EAAMA,KAAKxJ,EAAE;AACbiD,oBAAAA,KAAAA,EAAOA,MAAMC,WAAW,EAAA;AACxBC,oBAAAA,QAAAA;oBACAM,SAAAA,EAAW,CAACmF,SAASmB;AAC3B,iBAAA;AAEI,gBAAA,MAAM3L,IAAAA,GAAO,MAAMpB,UAAAA,CAAW,MAAA,CAAA,CAAQgN,GAAG,CAACF,OAAAA,CAAAA;gBAE1C,MAAMG,aAAAA,GAAgB,MAAM9L,YAAAA,CAAaC,IAAAA,EAAMC,GAAAA,CAAAA;gBAE/C,IAAIuK,QAAAA,CAASmB,kBAAkB,EAAE;oBAC/B,IAAI;wBACF,MAAM/M,UAAAA,CAAW,MAAA,CAAA,CAAQkN,qBAAqB,CAACD,aAAAA,CAAAA;AACvD,oBAAA,CAAA,CAAQ,OAAOlF,GAAAA,EAAK;wBACZtG,OAAAA,CAAOuG,GAAG,CAAClB,KAAK,CAACiB,GAAAA,CAAAA;AACjB,wBAAA,MAAM,IAAInH,gBAAAA,CAAiB,kCAAA,CAAA;AACnC,oBAAA;oBAEM,OAAOS,GAAAA,CAAI8C,IAAI,CAAC;wBAAE/C,IAAAA,EAAM6L;AAAa,qBAAA,CAAA;AAC3C,gBAAA;AAEI,gBAAA,MAAMtG,OAAOlF,OAAAA,CAAO4B,MAAM,CAACC,GAAG,CAAC,yCAAA,EAA2C,gBAAA,CAAA;AAC1E,gBAAA,IAAIqD,SAAS,SAAA,EAAW;oBACtB,MAAM3E,QAAAA,GAAWF,gBAAgBT,GAAAA,CAAIgB,OAAO,CAACI,IAAI,CAAA,IAAKnD,OAAOmF,UAAU,EAAA;AAEvE,oBAAA,MAAM7B,OAAAA,GAAU,MAAMnB,OAAAA,CACnBoB,cAAc,CAAC,mBAAA,CAAA,CACfC,oBAAoB,CAACC,MAAAA,CAAO3B,IAAAA,CAAK4B,EAAE,CAAA,EAAGhB,QAAAA,EAAU;wBAC/CW,IAAAA,EAAM,SAAA;AACNH,wBAAAA,QAAAA,EAAUL,+BAAAA,CAAgCd,GAAAA;AACpD,qBAAA,CAAA;oBAEM,MAAM4B,MAAAA,GAAS,MAAMxB,OAAAA,CAClBoB,cAAc,CAAC,mBAAA,CAAA,CACfK,mBAAmB,CAACN,OAAAA,CAAQO,KAAK,CAAA;AACpC,oBAAA,IAAI,WAAWF,MAAAA,EAAQ;AACrB,wBAAA,MAAM,IAAIrC,gBAAAA,CAAiB,qBAAA,CAAA;AACnC,oBAAA;oBAEM,OAAOS,GAAAA,CAAI8C,IAAI,CAAC;AAAEC,wBAAAA,GAAAA,EAAKnB,OAAOE,KAAK;AAAEkB,wBAAAA,YAAAA,EAAczB,QAAQO,KAAK;wBAAE/B,IAAAA,EAAM6L;AAAa,qBAAA,CAAA;AAC3F,gBAAA;gBAEI,MAAM7I,GAAAA,GAAMpE,WAAW,KAAA,CAAA,CAAO4G,KAAK,CAACpH,CAAAA,CAAE+M,IAAI,CAACnL,IAAAA,EAAM;AAAC,oBAAA;AAAK,iBAAA,CAAA,CAAA;gBACvD,OAAOC,GAAAA,CAAI8C,IAAI,CAAC;AAAEC,oBAAAA,GAAAA;oBAAKhD,IAAAA,EAAM6L;AAAa,iBAAA,CAAA;AAC9C,YAAA,CAAA;AAEE,YAAA,MAAME,iBAAAA,CAAAA,CAAkB9L,GAAG,EAAEyH,IAAI,EAAEsE,UAAU,EAAA;gBAC3C,MAAM,EAAEC,cAAcC,iBAAiB,EAAE,GAAG,MAAM7M,6BAAAA,CAA8BY,IAAIwE,KAAK,CAAA;AAEzF,gBAAA,MAAM0H,cAAcvN,UAAAA,CAAW,MAAA,CAAA;AAC/B,gBAAA,MAAMwN,aAAaxN,UAAAA,CAAW,KAAA,CAAA;AAE9B,gBAAA,MAAM,CAACoB,IAAAA,CAAK,GAAG,MAAMmM,WAAAA,CAAYE,QAAQ,CAAC;oBAAEC,OAAAA,EAAS;AAAEJ,wBAAAA;AAAiB;;AAExE,gBAAA,IAAI,CAAClM,IAAAA,EAAM;AACT,oBAAA,MAAM,IAAIP,eAAAA,CAAgB,eAAA,CAAA;AAChC,gBAAA;AAEI,gBAAA,MAAM0M,WAAAA,CAAYpG,IAAI,CAAC/F,IAAAA,CAAK4B,EAAE,EAAE;oBAAEyD,SAAAA,EAAW,IAAA;oBAAM6G,iBAAAA,EAAmB;;AAEtE,gBAAA,IAAIF,UAAAA,EAAY;AACd/L,oBAAAA,GAAAA,CAAI8C,IAAI,CAAC;wBACPC,GAAAA,EAAKoJ,UAAAA,CAAW5G,KAAK,CAAC;AAAE5D,4BAAAA,EAAAA,EAAI5B,KAAK4B;;wBACjC5B,IAAAA,EAAM,MAAMD,aAAaC,IAAAA,EAAMC,GAAAA;AACvC,qBAAA,CAAA;gBACA,CAAA,MAAW;AACL,oBAAA,MAAMuK,QAAAA,GAAW,MAAMnK,OAAAA,CACpB8D,KAAK,CAAC;wBAAE5C,IAAAA,EAAM,QAAA;wBAAUiB,IAAAA,EAAM,mBAAA;wBAAqB6B,GAAAA,EAAK;AAAU,qBAAA,CAAA,CAClEnC,GAAG,EAAA;AAENjC,oBAAAA,GAAAA,CAAIsM,QAAQ,CAAC/B,QAAAA,CAASgC,8BAA8B,IAAI,GAAA,CAAA;AAC9D,gBAAA;AACA,YAAA,CAAA;AAEE,YAAA,MAAMC,uBAAsBxM,GAAG,EAAA;gBAC7B,MAAM,EAAE4E,KAAK,EAAE,GAAG,MAAM3F,iCAAAA,CAAkCe,GAAAA,CAAIgB,OAAO,CAACI,IAAI,CAAA;gBAE1E,MAAMrB,IAAAA,GAAO,MAAMK,OAAAA,CAAOmE,EAAE,CAACC,KAAK,CAAC,gCAAA,CAAA,CAAkCC,OAAO,CAAC;oBAC3EC,KAAAA,EAAO;AAAEE,wBAAAA,KAAAA,EAAOA,MAAMC,WAAW;AAAE;AACzC,iBAAA,CAAA;AAEI,gBAAA,IAAI,CAAC9E,IAAAA,EAAM;oBACT,OAAOC,GAAAA,CAAI8C,IAAI,CAAC;AAAE8B,wBAAAA,KAAAA;wBAAO6H,IAAAA,EAAM;AAAI,qBAAA,CAAA;AACzC,gBAAA;gBAEI,IAAI1M,IAAAA,CAAKqF,SAAS,EAAE;AAClB,oBAAA,MAAM,IAAI7F,gBAAAA,CAAiB,mBAAA,CAAA;AACjC,gBAAA;gBAEI,IAAIQ,IAAAA,CAAKsF,OAAO,EAAE;AAChB,oBAAA,MAAM,IAAI9F,gBAAAA,CAAiB,cAAA,CAAA;AACjC,gBAAA;gBAEI,MAAMZ,UAAAA,CAAW,MAAA,CAAA,CAAQkN,qBAAqB,CAAC9L,IAAAA,CAAAA;AAE/CC,gBAAAA,GAAAA,CAAI8C,IAAI,CAAC;AACP8B,oBAAAA,KAAAA,EAAO7E,KAAK6E,KAAK;oBACjB6H,IAAAA,EAAM;AACZ,iBAAA,CAAA;AACA,YAAA;SACA,CAAA;;;;;;"}

package/dist/server/middlewares/rateLimit.js CHANGED Viewed

@@ -59,7 +59,7 @@ function requireRateLimit() {
 	 * lower-cased, trailing slashes removed so `/api/auth/local` and
 	 * `/api/auth/local/` share one bucket.
 	 */ const normalizeRequestPathForRateLimit = (requestPath)=>{
-        const normalized = path.normalize(requestPath);
+        const normalized = path.posix.normalize(requestPath);
         const lower = toLower(normalized);
         return lower.replace(/\/+$/, '') || '/';
     };

package/dist/server/middlewares/rateLimit.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"rateLimit.js","sources":["../../../server/src/middlewares/rateLimit.js"],"sourcesContent":["'use strict';\n\nconst path = require('path');\nconst utils = require('@strapi/utils');\nconst { isString, has, toLower } = require('lodash/fp');\n\nconst { RateLimitError } = utils.errors;\n\n/*\n Routes where the rate-limit key MUST NOT include a user identifier\n * derived from `ctx.request.body.email`.\n \n On these routes the request body either has no `email` field\n * (e.g. /auth/local uses `identifier`, /auth/reset-password uses\n * `code`, /auth/change-password uses `currentPassword`) or the\n * field is not part of the route contract. Including the\n * attacker-controlled `body.email` in the rate-limit key on these\n * routes lets a caller obtain a fresh key on every request by\n * varying that field, effectively bypassing per-IP throttling.\n \n Comparison uses endsWith so the check is stable under any router\n * mount prefix (e.g. `/api/auth/local`).\n \n @see https://github.com/strapi/strapi/security/advisories/GHSA-7mqx-wwh4-f9fw\n \n When adding a new `rateLimit`-protected auth route whose body does not\n * use `email` as the real identifier, add its path suffix here (or an\n * equivalent `routeUsesEmailIdentifier` rule) so the key cannot be split\n * with arbitrary `body.email` values.\n /\nconst ROUTES_WITHOUT_IDENTIFIER = ['/auth/local', '/auth/reset-password', '/auth/change-password'];\n\nconst isOAuthCallbackPath = (requestPath) => requestPath.includes('/connect/');\n\nconst routeUsesEmailIdentifier = (requestPath) => {\n if (isOAuthCallbackPath(requestPath)) {\n return false;\n }\n\n return !ROUTES_WITHOUT_IDENTIFIER.some((route) => requestPath.endsWith(route));\n};\n\n/\n Paths suitable for route matching and prefix keys: POSIX-normalized,\n * lower-cased, trailing slashes removed so `/api/auth/local` and\n * `/api/auth/local/` share one bucket.\n */\nconst normalizeRequestPathForRateLimit = (requestPath) => {\n const normalized = path.normalize(requestPath);\n const lower = toLower(normalized);\n return lower.replace(/\\/+$/, '') \|\| '/';\n};\n\nconst getEmailIdentifierForKey = (body) => {\n if (!body \|\| !isString(body.email) \|\| body.email === '') {\n return 'unknownIdentifier';\n }\n\n return toLower(body.email);\n};\n\nconst buildPrefixKey = (ctx) => {\n let requestPath;\n if (!isString(ctx.request.path)) {\n requestPath = 'invalidPath';\n } else {\n requestPath = normalizeRequestPathForRateLimit(ctx.request.path);\n if (requestPath === '.' \|\| requestPath === '..') {\n requestPath = 'invalidPath';\n }\n }\n\n if (!routeUsesEmailIdentifier(requestPath)) {\n return `noIdentifier:${requestPath}:${ctx.request.ip}`;\n }\n\n const userIdentifier = getEmailIdentifierForKey(ctx.request.body);\n return `${userIdentifier}:${requestPath}:${ctx.request.ip}`;\n};\n\nconst buildRateLimitLoadConfig = (ctx, rateLimitConfig, routeMiddlewareConfig) => {\n return {\n interval: { min: 5 },\n max: 5,\n ...rateLimitConfig,\n ...routeMiddlewareConfig,\n handler() {\n throw new RateLimitError();\n },\n prefixKey: buildPrefixKey(ctx),\n };\n};\n\nmodule.exports =\n (config, { strapi }) =>\n async (ctx, next) => {\n let rateLimitConfig = strapi.config.get('plugin::users-permissions.ratelimit');\n\n if (!rateLimitConfig) {\n rateLimitConfig = {\n enabled: true,\n };\n }\n\n if (!has('enabled', rateLimitConfig)) {\n rateLimitConfig.enabled = true;\n }\n\n if (rateLimitConfig.enabled === true) {\n const rateLimit = require('koa2-ratelimit').RateLimit;\n\n const loadConfig = buildRateLimitLoadConfig(ctx, rateLimitConfig, config);\n\n return rateLimit.middleware(loadConfig)(ctx, next);\n }\n\n return next();\n };\n\nmodule.exports.buildPrefixKey = buildPrefixKey;\nmodule.exports.ROUTES_WITHOUT_IDENTIFIER = ROUTES_WITHOUT_IDENTIFIER;\nmodule.exports.normalizeRequestPathForRateLimit = normalizeRequestPathForRateLimit;\nmodule.exports.buildRateLimitLoadConfig = buildRateLimitLoadConfig;\n"],"names":["path","require$$0","utils","require$$1","isString","has","toLower","require$$2","RateLimitError","errors","ROUTES_WITHOUT_IDENTIFIER","isOAuthCallbackPath","requestPath","includes","routeUsesEmailIdentifier","some","route","endsWith","normalizeRequestPathForRateLimit","normalized","normalize","lower","replace","getEmailIdentifierForKey","body","email","buildPrefixKey","ctx","request","ip","userIdentifier","buildRateLimitLoadConfig","rateLimitConfig","routeMiddlewareConfig","interval","min","max","handler","prefixKey","rateLimitModule","exports","config","strapi","next","get","enabled","rateLimit","require$$3","RateLimit","loadConfig","middleware"],"mappings":";;;;;;;;;;;;;;;;;;;AAEA,IAAA,MAAMA,IAAAA,GAAOC,6BAAAA;AACb,IAAA,MAAMC,KAAAA,GAAQC,2BAAAA;AACd,IAAA,MAAM,EAAEC,QAAQ,EAAEC,GAAG,EAAEC,OAAO,EAAE,GAAGC,2BAAAA;AAEnC,IAAA,MAAM,EAAEC,cAAc,EAAE,GAAGN,MAAMO,MAAM;AAEvC;;;;;;;;;;;;;;;;;;;;;AAqBA,KACA,MAAMC,yBAAAA,GAA4B;AAAC,QAAA,aAAA;AAAe,QAAA,sBAAA;AAAwB,QAAA;AAAwB,KAAA;AAElG,IAAA,MAAMC,mBAAAA,GAAsB,CAACC,WAAAA,GAAgBA,WAAAA,CAAYC,QAAQ,CAAC,WAAA,CAAA;AAElE,IAAA,MAAMC,2BAA2B,CAACF,WAAAA,GAAAA;AAChC,QAAA,IAAID,oBAAoBC,WAAAA,CAAAA,EAAc;YACpC,OAAO,KAAA;AACX,QAAA;QAEE,OAAO,CAACF,0BAA0BK,IAAI,CAAC,CAACC,KAAAA,GAAUJ,WAAAA,CAAYK,QAAQ,CAACD,KAAAA,CAAAA,CAAAA;AACzE,IAAA,CAAA;AAEA;;;;KAKA,MAAME,mCAAmC,CAACN,WAAAA,GAAAA;~~QACxC~~,MAAMO,UAAAA,GAAanB,IAAAA,CAAKoB,SAAS,~~CAACR~~,WAAAA,CAAAA;~~AAClC~~,QAAA,~~MAAMS~~,~~QAAQf~~,OAAAA,CAAQa,UAAAA,CAAAA;AACtB,QAAA,~~OAAOE~~,KAAAA,CAAMC,OAAO,CAAC,MAAA,EAAQ,EAAA,CAAA,IAAO,GAAA;AACtC,IAAA,CAAA;AAEA,IAAA,MAAMC,2BAA2B,CAACC,IAAAA,GAAAA;QAChC,IAAI,CAACA,IAAAA,IAAQ,~~CAACpB~~,QAAAA,~~CAASoB~~,IAAAA,CAAKC,KAAK,CAAA,IAAKD,IAAAA,CAAKC,KAAK,KAAK,EAAA,EAAI;YACvD,OAAO,mBAAA;AACX,QAAA;QAEE,~~OAAOnB~~,OAAAA,~~CAAQkB~~,KAAKC,KAAK,CAAA;AAC3B,IAAA,CAAA;AAEA,IAAA,MAAMC,iBAAiB,CAACC,GAAAA,GAAAA;QACtB,~~IAAIf~~,WAAAA;AACJ,QAAA,IAAI,CAACR,QAAAA,~~CAASuB~~,GAAAA,CAAIC,OAAO,~~CAAC5B~~,IAAI,CAAA,EAAG;YAC/BY,WAAAA,GAAc,aAAA;QAClB,CAAA,MAAS;AACLA,YAAAA,WAAAA,GAAcM,gCAAAA,~~CAAiCS~~,GAAAA,CAAIC,OAAO,~~CAAC5B~~,IAAI,CAAA;YAC/D,IAAIY,WAAAA,KAAgB,GAAA,IAAOA,WAAAA,KAAgB,IAAA,EAAM;gBAC/CA,WAAAA,GAAc,aAAA;AACpB,YAAA;AACA,QAAA;QAEE,IAAI,CAACE,yBAAyBF,WAAAA,CAAAA,EAAc;YAC1C,OAAO,CAAC,aAAa,EAAEA,WAAAA,CAAY,CAAC,~~EAAEe~~,GAAAA,CAAIC,OAAO,CAACC,EAAE,CAAA,CAAE;AAC1D,QAAA;AAEE,QAAA,MAAMC,cAAAA,GAAiBP,wBAAAA,CAAyBI,GAAAA,CAAIC,OAAO,CAACJ,IAAI,CAAA;QAChE,OAAO,CAAA,EAAGM,cAAAA,CAAe,CAAC,~~EAAElB~~,WAAAA,CAAY,CAAC,~~EAAEe~~,GAAAA,CAAIC,OAAO,CAACC,EAAE,CAAA,CAAE;AAC7D,IAAA,CAAA;IAEA,MAAME,wBAAAA,GAA2B,CAACJ,GAAAA,EAAKK,eAAAA,EAAiBC,qBAAAA,GAAAA;QACtD,OAAO;YACLC,QAAAA,EAAU;gBAAEC,GAAAA,EAAK;AAAC,aAAA;YAClBC,GAAAA,EAAK,CAAA;AACL,YAAA,GAAGJ,eAAe;AAClB,YAAA,GAAGC,qBAAqB;AACxBI,YAAAA,OAAAA,CAAAA,GAAAA;AACE,gBAAA,MAAM,~~IAAI7B~~,cAAAA,EAAAA;AAChB,YAAA,CAAA;~~AACI8B~~,YAAAA,SAAAA,EAAWZ,cAAAA,CAAeC,GAAAA;AAC9B,SAAA;AACA,IAAA,CAAA;IAEAY,kBAAAA,CAAAC,OAAc,GACZ,CAACC,MAAAA,EAAQ,EAAEC,MAAM,EAAE,GACnB,OAAOf,GAAAA,EAAKgB,IAAAA,GAAAA;AACV,YAAA,IAAIX,eAAAA,GAAkBU,MAAAA,CAAOD,MAAM,CAACG,GAAG,CAAC,qCAAA,CAAA;AAExC,YAAA,IAAI,CAACZ,eAAAA,EAAiB;gBACpBA,eAAAA,GAAkB;oBAChBa,OAAAA,EAAS;AACjB,iBAAA;AACA,YAAA;YAEI,IAAI,~~CAACxC~~,GAAAA,CAAI,SAAA,~~EAAW2B~~,eAAAA,CAAAA,EAAkB;AACpCA,gBAAAA,eAAAA,CAAgBa,OAAO,GAAG,IAAA;AAChC,YAAA;YAEI,IAAIb,eAAAA,CAAgBa,OAAO,KAAK,IAAA,EAAM;gBACpC,MAAMC,SAAAA,GAAYC,4BAA0BC,SAAS;gBAErD,MAAMC,UAAAA,GAAalB,wBAAAA,CAAyBJ,GAAAA,EAAKK,eAAAA,EAAiBS,MAAAA,CAAAA;AAElE,gBAAA,OAAOK,SAAAA,CAAUI,UAAU,CAACD,UAAAA,CAAAA,CAAYtB,GAAAA,EAAKgB,IAAAA,CAAAA;AACnD,YAAA;YAEI,OAAOA,IAAAA,EAAAA;AACX,QAAA,CAAA;IAEAJ,kBAAAA,CAAAC,OAAA,CAAAd,cAA6B,GAAGA,cAAAA;IAChCa,kBAAAA,CAAAC,OAAA,~~CAAA9B~~,yBAAwC,GAAGA,yBAAAA;~~IAC3C6B~~,kBAAAA,CAAAC,OAAA,~~CAAAtB~~,gCAA+C,GAAGA,gCAAAA;~~IAClDqB~~,kBAAAA,CAAAC,OAAA,CAAAT,wBAAuC,GAAGA,wBAAAA;;;;;;"}
1	+ {"version":3,"file":"rateLimit.js","sources":["../../../server/src/middlewares/rateLimit.js"],"sourcesContent":["'use strict';\n\nconst path = require('path');\nconst utils = require('@strapi/utils');\nconst { isString, has, toLower } = require('lodash/fp');\n\nconst { RateLimitError } = utils.errors;\n\n/*\n Routes where the rate-limit key MUST NOT include a user identifier\n * derived from `ctx.request.body.email`.\n \n On these routes the request body either has no `email` field\n * (e.g. /auth/local uses `identifier`, /auth/reset-password uses\n * `code`, /auth/change-password uses `currentPassword`) or the\n * field is not part of the route contract. Including the\n * attacker-controlled `body.email` in the rate-limit key on these\n * routes lets a caller obtain a fresh key on every request by\n * varying that field, effectively bypassing per-IP throttling.\n \n Comparison uses endsWith so the check is stable under any router\n * mount prefix (e.g. `/api/auth/local`).\n \n @see https://github.com/strapi/strapi/security/advisories/GHSA-7mqx-wwh4-f9fw\n \n When adding a new `rateLimit`-protected auth route whose body does not\n * use `email` as the real identifier, add its path suffix here (or an\n * equivalent `routeUsesEmailIdentifier` rule) so the key cannot be split\n * with arbitrary `body.email` values.\n /\nconst ROUTES_WITHOUT_IDENTIFIER = ['/auth/local', '/auth/reset-password', '/auth/change-password'];\n\nconst isOAuthCallbackPath = (requestPath) => requestPath.includes('/connect/');\n\nconst routeUsesEmailIdentifier = (requestPath) => {\n if (isOAuthCallbackPath(requestPath)) {\n return false;\n }\n\n return !ROUTES_WITHOUT_IDENTIFIER.some((route) => requestPath.endsWith(route));\n};\n\n/\n Paths suitable for route matching and prefix keys: POSIX-normalized,\n * lower-cased, trailing slashes removed so `/api/auth/local` and\n * `/api/auth/local/` share one bucket.\n */\nconst normalizeRequestPathForRateLimit = (requestPath) => {\n const normalized = path.posix.normalize(requestPath);\n const lower = toLower(normalized);\n return lower.replace(/\\/+$/, '') \|\| '/';\n};\n\nconst getEmailIdentifierForKey = (body) => {\n if (!body \|\| !isString(body.email) \|\| body.email === '') {\n return 'unknownIdentifier';\n }\n\n return toLower(body.email);\n};\n\nconst buildPrefixKey = (ctx) => {\n let requestPath;\n if (!isString(ctx.request.path)) {\n requestPath = 'invalidPath';\n } else {\n requestPath = normalizeRequestPathForRateLimit(ctx.request.path);\n if (requestPath === '.' \|\| requestPath === '..') {\n requestPath = 'invalidPath';\n }\n }\n\n if (!routeUsesEmailIdentifier(requestPath)) {\n return `noIdentifier:${requestPath}:${ctx.request.ip}`;\n }\n\n const userIdentifier = getEmailIdentifierForKey(ctx.request.body);\n return `${userIdentifier}:${requestPath}:${ctx.request.ip}`;\n};\n\nconst buildRateLimitLoadConfig = (ctx, rateLimitConfig, routeMiddlewareConfig) => {\n return {\n interval: { min: 5 },\n max: 5,\n ...rateLimitConfig,\n ...routeMiddlewareConfig,\n handler() {\n throw new RateLimitError();\n },\n prefixKey: buildPrefixKey(ctx),\n };\n};\n\nmodule.exports =\n (config, { strapi }) =>\n async (ctx, next) => {\n let rateLimitConfig = strapi.config.get('plugin::users-permissions.ratelimit');\n\n if (!rateLimitConfig) {\n rateLimitConfig = {\n enabled: true,\n };\n }\n\n if (!has('enabled', rateLimitConfig)) {\n rateLimitConfig.enabled = true;\n }\n\n if (rateLimitConfig.enabled === true) {\n const rateLimit = require('koa2-ratelimit').RateLimit;\n\n const loadConfig = buildRateLimitLoadConfig(ctx, rateLimitConfig, config);\n\n return rateLimit.middleware(loadConfig)(ctx, next);\n }\n\n return next();\n };\n\nmodule.exports.buildPrefixKey = buildPrefixKey;\nmodule.exports.ROUTES_WITHOUT_IDENTIFIER = ROUTES_WITHOUT_IDENTIFIER;\nmodule.exports.normalizeRequestPathForRateLimit = normalizeRequestPathForRateLimit;\nmodule.exports.buildRateLimitLoadConfig = buildRateLimitLoadConfig;\n"],"names":["path","require$$0","utils","require$$1","isString","has","toLower","require$$2","RateLimitError","errors","ROUTES_WITHOUT_IDENTIFIER","isOAuthCallbackPath","requestPath","includes","routeUsesEmailIdentifier","some","route","endsWith","normalizeRequestPathForRateLimit","normalized","posix","normalize","lower","replace","getEmailIdentifierForKey","body","email","buildPrefixKey","ctx","request","ip","userIdentifier","buildRateLimitLoadConfig","rateLimitConfig","routeMiddlewareConfig","interval","min","max","handler","prefixKey","rateLimitModule","exports","config","strapi","next","get","enabled","rateLimit","require$$3","RateLimit","loadConfig","middleware"],"mappings":";;;;;;;;;;;;;;;;;;;AAEA,IAAA,MAAMA,IAAAA,GAAOC,6BAAAA;AACb,IAAA,MAAMC,KAAAA,GAAQC,2BAAAA;AACd,IAAA,MAAM,EAAEC,QAAQ,EAAEC,GAAG,EAAEC,OAAO,EAAE,GAAGC,2BAAAA;AAEnC,IAAA,MAAM,EAAEC,cAAc,EAAE,GAAGN,MAAMO,MAAM;AAEvC;;;;;;;;;;;;;;;;;;;;;AAqBA,KACA,MAAMC,yBAAAA,GAA4B;AAAC,QAAA,aAAA;AAAe,QAAA,sBAAA;AAAwB,QAAA;AAAwB,KAAA;AAElG,IAAA,MAAMC,mBAAAA,GAAsB,CAACC,WAAAA,GAAgBA,WAAAA,CAAYC,QAAQ,CAAC,WAAA,CAAA;AAElE,IAAA,MAAMC,2BAA2B,CAACF,WAAAA,GAAAA;AAChC,QAAA,IAAID,oBAAoBC,WAAAA,CAAAA,EAAc;YACpC,OAAO,KAAA;AACX,QAAA;QAEE,OAAO,CAACF,0BAA0BK,IAAI,CAAC,CAACC,KAAAA,GAAUJ,WAAAA,CAAYK,QAAQ,CAACD,KAAAA,CAAAA,CAAAA;AACzE,IAAA,CAAA;AAEA;;;;KAKA,MAAME,mCAAmC,CAACN,WAAAA,GAAAA;AACxC,QAAA,MAAMO,UAAAA,GAAanB,IAAAA,CAAKoB,KAAK,CAACC,SAAS,CAACT,WAAAA,CAAAA;AACxC,QAAA,MAAMU,QAAQhB,OAAAA,CAAQa,UAAAA,CAAAA;AACtB,QAAA,OAAOG,KAAAA,CAAMC,OAAO,CAAC,MAAA,EAAQ,EAAA,CAAA,IAAO,GAAA;AACtC,IAAA,CAAA;AAEA,IAAA,MAAMC,2BAA2B,CAACC,IAAAA,GAAAA;QAChC,IAAI,CAACA,IAAAA,IAAQ,CAACrB,QAAAA,CAASqB,IAAAA,CAAKC,KAAK,CAAA,IAAKD,IAAAA,CAAKC,KAAK,KAAK,EAAA,EAAI;YACvD,OAAO,mBAAA;AACX,QAAA;QAEE,OAAOpB,OAAAA,CAAQmB,KAAKC,KAAK,CAAA;AAC3B,IAAA,CAAA;AAEA,IAAA,MAAMC,iBAAiB,CAACC,GAAAA,GAAAA;QACtB,IAAIhB,WAAAA;AACJ,QAAA,IAAI,CAACR,QAAAA,CAASwB,GAAAA,CAAIC,OAAO,CAAC7B,IAAI,CAAA,EAAG;YAC/BY,WAAAA,GAAc,aAAA;QAClB,CAAA,MAAS;AACLA,YAAAA,WAAAA,GAAcM,gCAAAA,CAAiCU,GAAAA,CAAIC,OAAO,CAAC7B,IAAI,CAAA;YAC/D,IAAIY,WAAAA,KAAgB,GAAA,IAAOA,WAAAA,KAAgB,IAAA,EAAM;gBAC/CA,WAAAA,GAAc,aAAA;AACpB,YAAA;AACA,QAAA;QAEE,IAAI,CAACE,yBAAyBF,WAAAA,CAAAA,EAAc;YAC1C,OAAO,CAAC,aAAa,EAAEA,WAAAA,CAAY,CAAC,EAAEgB,GAAAA,CAAIC,OAAO,CAACC,EAAE,CAAA,CAAE;AAC1D,QAAA;AAEE,QAAA,MAAMC,cAAAA,GAAiBP,wBAAAA,CAAyBI,GAAAA,CAAIC,OAAO,CAACJ,IAAI,CAAA;QAChE,OAAO,CAAA,EAAGM,cAAAA,CAAe,CAAC,EAAEnB,WAAAA,CAAY,CAAC,EAAEgB,GAAAA,CAAIC,OAAO,CAACC,EAAE,CAAA,CAAE;AAC7D,IAAA,CAAA;IAEA,MAAME,wBAAAA,GAA2B,CAACJ,GAAAA,EAAKK,eAAAA,EAAiBC,qBAAAA,GAAAA;QACtD,OAAO;YACLC,QAAAA,EAAU;gBAAEC,GAAAA,EAAK;AAAC,aAAA;YAClBC,GAAAA,EAAK,CAAA;AACL,YAAA,GAAGJ,eAAe;AAClB,YAAA,GAAGC,qBAAqB;AACxBI,YAAAA,OAAAA,CAAAA,GAAAA;AACE,gBAAA,MAAM,IAAI9B,cAAAA,EAAAA;AAChB,YAAA,CAAA;AACI+B,YAAAA,SAAAA,EAAWZ,cAAAA,CAAeC,GAAAA;AAC9B,SAAA;AACA,IAAA,CAAA;IAEAY,kBAAAA,CAAAC,OAAc,GACZ,CAACC,MAAAA,EAAQ,EAAEC,MAAM,EAAE,GACnB,OAAOf,GAAAA,EAAKgB,IAAAA,GAAAA;AACV,YAAA,IAAIX,eAAAA,GAAkBU,MAAAA,CAAOD,MAAM,CAACG,GAAG,CAAC,qCAAA,CAAA;AAExC,YAAA,IAAI,CAACZ,eAAAA,EAAiB;gBACpBA,eAAAA,GAAkB;oBAChBa,OAAAA,EAAS;AACjB,iBAAA;AACA,YAAA;YAEI,IAAI,CAACzC,GAAAA,CAAI,SAAA,EAAW4B,eAAAA,CAAAA,EAAkB;AACpCA,gBAAAA,eAAAA,CAAgBa,OAAO,GAAG,IAAA;AAChC,YAAA;YAEI,IAAIb,eAAAA,CAAgBa,OAAO,KAAK,IAAA,EAAM;gBACpC,MAAMC,SAAAA,GAAYC,4BAA0BC,SAAS;gBAErD,MAAMC,UAAAA,GAAalB,wBAAAA,CAAyBJ,GAAAA,EAAKK,eAAAA,EAAiBS,MAAAA,CAAAA;AAElE,gBAAA,OAAOK,SAAAA,CAAUI,UAAU,CAACD,UAAAA,CAAAA,CAAYtB,GAAAA,EAAKgB,IAAAA,CAAAA;AACnD,YAAA;YAEI,OAAOA,IAAAA,EAAAA;AACX,QAAA,CAAA;IAEAJ,kBAAAA,CAAAC,OAAA,CAAAd,cAA6B,GAAGA,cAAAA;IAChCa,kBAAAA,CAAAC,OAAA,CAAA/B,yBAAwC,GAAGA,yBAAAA;IAC3C8B,kBAAAA,CAAAC,OAAA,CAAAvB,gCAA+C,GAAGA,gCAAAA;IAClDsB,kBAAAA,CAAAC,OAAA,CAAAT,wBAAuC,GAAGA,wBAAAA;;;;;;"}

package/dist/server/middlewares/rateLimit.mjs CHANGED Viewed

@@ -50,7 +50,7 @@ function requireRateLimit() {
 	 * lower-cased, trailing slashes removed so `/api/auth/local` and
 	 * `/api/auth/local/` share one bucket.
 	 */ const normalizeRequestPathForRateLimit = (requestPath)=>{
-        const normalized = path.normalize(requestPath);
+        const normalized = path.posix.normalize(requestPath);
         const lower = toLower(normalized);
         return lower.replace(/\/+$/, '') || '/';
     };

package/dist/server/middlewares/rateLimit.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"rateLimit.mjs","sources":["../../../server/src/middlewares/rateLimit.js"],"sourcesContent":["'use strict';\n\nconst path = require('path');\nconst utils = require('@strapi/utils');\nconst { isString, has, toLower } = require('lodash/fp');\n\nconst { RateLimitError } = utils.errors;\n\n/*\n Routes where the rate-limit key MUST NOT include a user identifier\n * derived from `ctx.request.body.email`.\n \n On these routes the request body either has no `email` field\n * (e.g. /auth/local uses `identifier`, /auth/reset-password uses\n * `code`, /auth/change-password uses `currentPassword`) or the\n * field is not part of the route contract. Including the\n * attacker-controlled `body.email` in the rate-limit key on these\n * routes lets a caller obtain a fresh key on every request by\n * varying that field, effectively bypassing per-IP throttling.\n \n Comparison uses endsWith so the check is stable under any router\n * mount prefix (e.g. `/api/auth/local`).\n \n @see https://github.com/strapi/strapi/security/advisories/GHSA-7mqx-wwh4-f9fw\n \n When adding a new `rateLimit`-protected auth route whose body does not\n * use `email` as the real identifier, add its path suffix here (or an\n * equivalent `routeUsesEmailIdentifier` rule) so the key cannot be split\n * with arbitrary `body.email` values.\n /\nconst ROUTES_WITHOUT_IDENTIFIER = ['/auth/local', '/auth/reset-password', '/auth/change-password'];\n\nconst isOAuthCallbackPath = (requestPath) => requestPath.includes('/connect/');\n\nconst routeUsesEmailIdentifier = (requestPath) => {\n if (isOAuthCallbackPath(requestPath)) {\n return false;\n }\n\n return !ROUTES_WITHOUT_IDENTIFIER.some((route) => requestPath.endsWith(route));\n};\n\n/\n Paths suitable for route matching and prefix keys: POSIX-normalized,\n * lower-cased, trailing slashes removed so `/api/auth/local` and\n * `/api/auth/local/` share one bucket.\n */\nconst normalizeRequestPathForRateLimit = (requestPath) => {\n const normalized = path.normalize(requestPath);\n const lower = toLower(normalized);\n return lower.replace(/\\/+$/, '') \|\| '/';\n};\n\nconst getEmailIdentifierForKey = (body) => {\n if (!body \|\| !isString(body.email) \|\| body.email === '') {\n return 'unknownIdentifier';\n }\n\n return toLower(body.email);\n};\n\nconst buildPrefixKey = (ctx) => {\n let requestPath;\n if (!isString(ctx.request.path)) {\n requestPath = 'invalidPath';\n } else {\n requestPath = normalizeRequestPathForRateLimit(ctx.request.path);\n if (requestPath === '.' \|\| requestPath === '..') {\n requestPath = 'invalidPath';\n }\n }\n\n if (!routeUsesEmailIdentifier(requestPath)) {\n return `noIdentifier:${requestPath}:${ctx.request.ip}`;\n }\n\n const userIdentifier = getEmailIdentifierForKey(ctx.request.body);\n return `${userIdentifier}:${requestPath}:${ctx.request.ip}`;\n};\n\nconst buildRateLimitLoadConfig = (ctx, rateLimitConfig, routeMiddlewareConfig) => {\n return {\n interval: { min: 5 },\n max: 5,\n ...rateLimitConfig,\n ...routeMiddlewareConfig,\n handler() {\n throw new RateLimitError();\n },\n prefixKey: buildPrefixKey(ctx),\n };\n};\n\nmodule.exports =\n (config, { strapi }) =>\n async (ctx, next) => {\n let rateLimitConfig = strapi.config.get('plugin::users-permissions.ratelimit');\n\n if (!rateLimitConfig) {\n rateLimitConfig = {\n enabled: true,\n };\n }\n\n if (!has('enabled', rateLimitConfig)) {\n rateLimitConfig.enabled = true;\n }\n\n if (rateLimitConfig.enabled === true) {\n const rateLimit = require('koa2-ratelimit').RateLimit;\n\n const loadConfig = buildRateLimitLoadConfig(ctx, rateLimitConfig, config);\n\n return rateLimit.middleware(loadConfig)(ctx, next);\n }\n\n return next();\n };\n\nmodule.exports.buildPrefixKey = buildPrefixKey;\nmodule.exports.ROUTES_WITHOUT_IDENTIFIER = ROUTES_WITHOUT_IDENTIFIER;\nmodule.exports.normalizeRequestPathForRateLimit = normalizeRequestPathForRateLimit;\nmodule.exports.buildRateLimitLoadConfig = buildRateLimitLoadConfig;\n"],"names":["path","require$$0","utils","require$$1","isString","has","toLower","require$$2","RateLimitError","errors","ROUTES_WITHOUT_IDENTIFIER","isOAuthCallbackPath","requestPath","includes","routeUsesEmailIdentifier","some","route","endsWith","normalizeRequestPathForRateLimit","normalized","normalize","lower","replace","getEmailIdentifierForKey","body","email","buildPrefixKey","ctx","request","ip","userIdentifier","buildRateLimitLoadConfig","rateLimitConfig","routeMiddlewareConfig","interval","min","max","handler","prefixKey","rateLimitModule","exports","config","strapi","next","get","enabled","rateLimit","require$$3","RateLimit","loadConfig","middleware"],"mappings":";;;;;;;;;;AAEA,IAAA,MAAMA,IAAAA,GAAOC,YAAAA;AACb,IAAA,MAAMC,KAAAA,GAAQC,UAAAA;AACd,IAAA,MAAM,EAAEC,QAAQ,EAAEC,GAAG,EAAEC,OAAO,EAAE,GAAGC,UAAAA;AAEnC,IAAA,MAAM,EAAEC,cAAc,EAAE,GAAGN,MAAMO,MAAM;AAEvC;;;;;;;;;;;;;;;;;;;;;AAqBA,KACA,MAAMC,yBAAAA,GAA4B;AAAC,QAAA,aAAA;AAAe,QAAA,sBAAA;AAAwB,QAAA;AAAwB,KAAA;AAElG,IAAA,MAAMC,mBAAAA,GAAsB,CAACC,WAAAA,GAAgBA,WAAAA,CAAYC,QAAQ,CAAC,WAAA,CAAA;AAElE,IAAA,MAAMC,2BAA2B,CAACF,WAAAA,GAAAA;AAChC,QAAA,IAAID,oBAAoBC,WAAAA,CAAAA,EAAc;YACpC,OAAO,KAAA;AACX,QAAA;QAEE,OAAO,CAACF,0BAA0BK,IAAI,CAAC,CAACC,KAAAA,GAAUJ,WAAAA,CAAYK,QAAQ,CAACD,KAAAA,CAAAA,CAAAA;AACzE,IAAA,CAAA;AAEA;;;;KAKA,MAAME,mCAAmC,CAACN,WAAAA,GAAAA;~~QACxC~~,MAAMO,UAAAA,GAAanB,IAAAA,CAAKoB,SAAS,~~CAACR~~,WAAAA,CAAAA;~~AAClC~~,QAAA,~~MAAMS~~,~~QAAQf~~,OAAAA,CAAQa,UAAAA,CAAAA;AACtB,QAAA,~~OAAOE~~,KAAAA,CAAMC,OAAO,CAAC,MAAA,EAAQ,EAAA,CAAA,IAAO,GAAA;AACtC,IAAA,CAAA;AAEA,IAAA,MAAMC,2BAA2B,CAACC,IAAAA,GAAAA;QAChC,IAAI,CAACA,IAAAA,IAAQ,~~CAACpB~~,QAAAA,~~CAASoB~~,IAAAA,CAAKC,KAAK,CAAA,IAAKD,IAAAA,CAAKC,KAAK,KAAK,EAAA,EAAI;YACvD,OAAO,mBAAA;AACX,QAAA;QAEE,~~OAAOnB~~,OAAAA,~~CAAQkB~~,KAAKC,KAAK,CAAA;AAC3B,IAAA,CAAA;AAEA,IAAA,MAAMC,iBAAiB,CAACC,GAAAA,GAAAA;QACtB,~~IAAIf~~,WAAAA;AACJ,QAAA,IAAI,CAACR,QAAAA,~~CAASuB~~,GAAAA,CAAIC,OAAO,~~CAAC5B~~,IAAI,CAAA,EAAG;YAC/BY,WAAAA,GAAc,aAAA;QAClB,CAAA,MAAS;AACLA,YAAAA,WAAAA,GAAcM,gCAAAA,~~CAAiCS~~,GAAAA,CAAIC,OAAO,~~CAAC5B~~,IAAI,CAAA;YAC/D,IAAIY,WAAAA,KAAgB,GAAA,IAAOA,WAAAA,KAAgB,IAAA,EAAM;gBAC/CA,WAAAA,GAAc,aAAA;AACpB,YAAA;AACA,QAAA;QAEE,IAAI,CAACE,yBAAyBF,WAAAA,CAAAA,EAAc;YAC1C,OAAO,CAAC,aAAa,EAAEA,WAAAA,CAAY,CAAC,~~EAAEe~~,GAAAA,CAAIC,OAAO,CAACC,EAAE,CAAA,CAAE;AAC1D,QAAA;AAEE,QAAA,MAAMC,cAAAA,GAAiBP,wBAAAA,CAAyBI,GAAAA,CAAIC,OAAO,CAACJ,IAAI,CAAA;QAChE,OAAO,CAAA,EAAGM,cAAAA,CAAe,CAAC,~~EAAElB~~,WAAAA,CAAY,CAAC,~~EAAEe~~,GAAAA,CAAIC,OAAO,CAACC,EAAE,CAAA,CAAE;AAC7D,IAAA,CAAA;IAEA,MAAME,wBAAAA,GAA2B,CAACJ,GAAAA,EAAKK,eAAAA,EAAiBC,qBAAAA,GAAAA;QACtD,OAAO;YACLC,QAAAA,EAAU;gBAAEC,GAAAA,EAAK;AAAC,aAAA;YAClBC,GAAAA,EAAK,CAAA;AACL,YAAA,GAAGJ,eAAe;AAClB,YAAA,GAAGC,qBAAqB;AACxBI,YAAAA,OAAAA,CAAAA,GAAAA;AACE,gBAAA,MAAM,~~IAAI7B~~,cAAAA,EAAAA;AAChB,YAAA,CAAA;~~AACI8B~~,YAAAA,SAAAA,EAAWZ,cAAAA,CAAeC,GAAAA;AAC9B,SAAA;AACA,IAAA,CAAA;IAEAY,SAAAA,CAAAC,OAAc,GACZ,CAACC,MAAAA,EAAQ,EAAEC,MAAM,EAAE,GACnB,OAAOf,GAAAA,EAAKgB,IAAAA,GAAAA;AACV,YAAA,IAAIX,eAAAA,GAAkBU,MAAAA,CAAOD,MAAM,CAACG,GAAG,CAAC,qCAAA,CAAA;AAExC,YAAA,IAAI,CAACZ,eAAAA,EAAiB;gBACpBA,eAAAA,GAAkB;oBAChBa,OAAAA,EAAS;AACjB,iBAAA;AACA,YAAA;YAEI,IAAI,~~CAACxC~~,GAAAA,CAAI,SAAA,~~EAAW2B~~,eAAAA,CAAAA,EAAkB;AACpCA,gBAAAA,eAAAA,CAAgBa,OAAO,GAAG,IAAA;AAChC,YAAA;YAEI,IAAIb,eAAAA,CAAgBa,OAAO,KAAK,IAAA,EAAM;gBACpC,MAAMC,SAAAA,GAAYC,WAA0BC,SAAS;gBAErD,MAAMC,UAAAA,GAAalB,wBAAAA,CAAyBJ,GAAAA,EAAKK,eAAAA,EAAiBS,MAAAA,CAAAA;AAElE,gBAAA,OAAOK,SAAAA,CAAUI,UAAU,CAACD,UAAAA,CAAAA,CAAYtB,GAAAA,EAAKgB,IAAAA,CAAAA;AACnD,YAAA;YAEI,OAAOA,IAAAA,EAAAA;AACX,QAAA,CAAA;IAEAJ,SAAAA,CAAAC,OAAA,CAAAd,cAA6B,GAAGA,cAAAA;IAChCa,SAAAA,CAAAC,OAAA,~~CAAA9B~~,yBAAwC,GAAGA,yBAAAA;~~IAC3C6B~~,SAAAA,CAAAC,OAAA,~~CAAAtB~~,gCAA+C,GAAGA,gCAAAA;~~IAClDqB~~,SAAAA,CAAAC,OAAA,CAAAT,wBAAuC,GAAGA,wBAAAA;;;;;;"}
1	+ {"version":3,"file":"rateLimit.mjs","sources":["../../../server/src/middlewares/rateLimit.js"],"sourcesContent":["'use strict';\n\nconst path = require('path');\nconst utils = require('@strapi/utils');\nconst { isString, has, toLower } = require('lodash/fp');\n\nconst { RateLimitError } = utils.errors;\n\n/*\n Routes where the rate-limit key MUST NOT include a user identifier\n * derived from `ctx.request.body.email`.\n \n On these routes the request body either has no `email` field\n * (e.g. /auth/local uses `identifier`, /auth/reset-password uses\n * `code`, /auth/change-password uses `currentPassword`) or the\n * field is not part of the route contract. Including the\n * attacker-controlled `body.email` in the rate-limit key on these\n * routes lets a caller obtain a fresh key on every request by\n * varying that field, effectively bypassing per-IP throttling.\n \n Comparison uses endsWith so the check is stable under any router\n * mount prefix (e.g. `/api/auth/local`).\n \n @see https://github.com/strapi/strapi/security/advisories/GHSA-7mqx-wwh4-f9fw\n \n When adding a new `rateLimit`-protected auth route whose body does not\n * use `email` as the real identifier, add its path suffix here (or an\n * equivalent `routeUsesEmailIdentifier` rule) so the key cannot be split\n * with arbitrary `body.email` values.\n /\nconst ROUTES_WITHOUT_IDENTIFIER = ['/auth/local', '/auth/reset-password', '/auth/change-password'];\n\nconst isOAuthCallbackPath = (requestPath) => requestPath.includes('/connect/');\n\nconst routeUsesEmailIdentifier = (requestPath) => {\n if (isOAuthCallbackPath(requestPath)) {\n return false;\n }\n\n return !ROUTES_WITHOUT_IDENTIFIER.some((route) => requestPath.endsWith(route));\n};\n\n/\n Paths suitable for route matching and prefix keys: POSIX-normalized,\n * lower-cased, trailing slashes removed so `/api/auth/local` and\n * `/api/auth/local/` share one bucket.\n */\nconst normalizeRequestPathForRateLimit = (requestPath) => {\n const normalized = path.posix.normalize(requestPath);\n const lower = toLower(normalized);\n return lower.replace(/\\/+$/, '') \|\| '/';\n};\n\nconst getEmailIdentifierForKey = (body) => {\n if (!body \|\| !isString(body.email) \|\| body.email === '') {\n return 'unknownIdentifier';\n }\n\n return toLower(body.email);\n};\n\nconst buildPrefixKey = (ctx) => {\n let requestPath;\n if (!isString(ctx.request.path)) {\n requestPath = 'invalidPath';\n } else {\n requestPath = normalizeRequestPathForRateLimit(ctx.request.path);\n if (requestPath === '.' \|\| requestPath === '..') {\n requestPath = 'invalidPath';\n }\n }\n\n if (!routeUsesEmailIdentifier(requestPath)) {\n return `noIdentifier:${requestPath}:${ctx.request.ip}`;\n }\n\n const userIdentifier = getEmailIdentifierForKey(ctx.request.body);\n return `${userIdentifier}:${requestPath}:${ctx.request.ip}`;\n};\n\nconst buildRateLimitLoadConfig = (ctx, rateLimitConfig, routeMiddlewareConfig) => {\n return {\n interval: { min: 5 },\n max: 5,\n ...rateLimitConfig,\n ...routeMiddlewareConfig,\n handler() {\n throw new RateLimitError();\n },\n prefixKey: buildPrefixKey(ctx),\n };\n};\n\nmodule.exports =\n (config, { strapi }) =>\n async (ctx, next) => {\n let rateLimitConfig = strapi.config.get('plugin::users-permissions.ratelimit');\n\n if (!rateLimitConfig) {\n rateLimitConfig = {\n enabled: true,\n };\n }\n\n if (!has('enabled', rateLimitConfig)) {\n rateLimitConfig.enabled = true;\n }\n\n if (rateLimitConfig.enabled === true) {\n const rateLimit = require('koa2-ratelimit').RateLimit;\n\n const loadConfig = buildRateLimitLoadConfig(ctx, rateLimitConfig, config);\n\n return rateLimit.middleware(loadConfig)(ctx, next);\n }\n\n return next();\n };\n\nmodule.exports.buildPrefixKey = buildPrefixKey;\nmodule.exports.ROUTES_WITHOUT_IDENTIFIER = ROUTES_WITHOUT_IDENTIFIER;\nmodule.exports.normalizeRequestPathForRateLimit = normalizeRequestPathForRateLimit;\nmodule.exports.buildRateLimitLoadConfig = buildRateLimitLoadConfig;\n"],"names":["path","require$$0","utils","require$$1","isString","has","toLower","require$$2","RateLimitError","errors","ROUTES_WITHOUT_IDENTIFIER","isOAuthCallbackPath","requestPath","includes","routeUsesEmailIdentifier","some","route","endsWith","normalizeRequestPathForRateLimit","normalized","posix","normalize","lower","replace","getEmailIdentifierForKey","body","email","buildPrefixKey","ctx","request","ip","userIdentifier","buildRateLimitLoadConfig","rateLimitConfig","routeMiddlewareConfig","interval","min","max","handler","prefixKey","rateLimitModule","exports","config","strapi","next","get","enabled","rateLimit","require$$3","RateLimit","loadConfig","middleware"],"mappings":";;;;;;;;;;AAEA,IAAA,MAAMA,IAAAA,GAAOC,YAAAA;AACb,IAAA,MAAMC,KAAAA,GAAQC,UAAAA;AACd,IAAA,MAAM,EAAEC,QAAQ,EAAEC,GAAG,EAAEC,OAAO,EAAE,GAAGC,UAAAA;AAEnC,IAAA,MAAM,EAAEC,cAAc,EAAE,GAAGN,MAAMO,MAAM;AAEvC;;;;;;;;;;;;;;;;;;;;;AAqBA,KACA,MAAMC,yBAAAA,GAA4B;AAAC,QAAA,aAAA;AAAe,QAAA,sBAAA;AAAwB,QAAA;AAAwB,KAAA;AAElG,IAAA,MAAMC,mBAAAA,GAAsB,CAACC,WAAAA,GAAgBA,WAAAA,CAAYC,QAAQ,CAAC,WAAA,CAAA;AAElE,IAAA,MAAMC,2BAA2B,CAACF,WAAAA,GAAAA;AAChC,QAAA,IAAID,oBAAoBC,WAAAA,CAAAA,EAAc;YACpC,OAAO,KAAA;AACX,QAAA;QAEE,OAAO,CAACF,0BAA0BK,IAAI,CAAC,CAACC,KAAAA,GAAUJ,WAAAA,CAAYK,QAAQ,CAACD,KAAAA,CAAAA,CAAAA;AACzE,IAAA,CAAA;AAEA;;;;KAKA,MAAME,mCAAmC,CAACN,WAAAA,GAAAA;AACxC,QAAA,MAAMO,UAAAA,GAAanB,IAAAA,CAAKoB,KAAK,CAACC,SAAS,CAACT,WAAAA,CAAAA;AACxC,QAAA,MAAMU,QAAQhB,OAAAA,CAAQa,UAAAA,CAAAA;AACtB,QAAA,OAAOG,KAAAA,CAAMC,OAAO,CAAC,MAAA,EAAQ,EAAA,CAAA,IAAO,GAAA;AACtC,IAAA,CAAA;AAEA,IAAA,MAAMC,2BAA2B,CAACC,IAAAA,GAAAA;QAChC,IAAI,CAACA,IAAAA,IAAQ,CAACrB,QAAAA,CAASqB,IAAAA,CAAKC,KAAK,CAAA,IAAKD,IAAAA,CAAKC,KAAK,KAAK,EAAA,EAAI;YACvD,OAAO,mBAAA;AACX,QAAA;QAEE,OAAOpB,OAAAA,CAAQmB,KAAKC,KAAK,CAAA;AAC3B,IAAA,CAAA;AAEA,IAAA,MAAMC,iBAAiB,CAACC,GAAAA,GAAAA;QACtB,IAAIhB,WAAAA;AACJ,QAAA,IAAI,CAACR,QAAAA,CAASwB,GAAAA,CAAIC,OAAO,CAAC7B,IAAI,CAAA,EAAG;YAC/BY,WAAAA,GAAc,aAAA;QAClB,CAAA,MAAS;AACLA,YAAAA,WAAAA,GAAcM,gCAAAA,CAAiCU,GAAAA,CAAIC,OAAO,CAAC7B,IAAI,CAAA;YAC/D,IAAIY,WAAAA,KAAgB,GAAA,IAAOA,WAAAA,KAAgB,IAAA,EAAM;gBAC/CA,WAAAA,GAAc,aAAA;AACpB,YAAA;AACA,QAAA;QAEE,IAAI,CAACE,yBAAyBF,WAAAA,CAAAA,EAAc;YAC1C,OAAO,CAAC,aAAa,EAAEA,WAAAA,CAAY,CAAC,EAAEgB,GAAAA,CAAIC,OAAO,CAACC,EAAE,CAAA,CAAE;AAC1D,QAAA;AAEE,QAAA,MAAMC,cAAAA,GAAiBP,wBAAAA,CAAyBI,GAAAA,CAAIC,OAAO,CAACJ,IAAI,CAAA;QAChE,OAAO,CAAA,EAAGM,cAAAA,CAAe,CAAC,EAAEnB,WAAAA,CAAY,CAAC,EAAEgB,GAAAA,CAAIC,OAAO,CAACC,EAAE,CAAA,CAAE;AAC7D,IAAA,CAAA;IAEA,MAAME,wBAAAA,GAA2B,CAACJ,GAAAA,EAAKK,eAAAA,EAAiBC,qBAAAA,GAAAA;QACtD,OAAO;YACLC,QAAAA,EAAU;gBAAEC,GAAAA,EAAK;AAAC,aAAA;YAClBC,GAAAA,EAAK,CAAA;AACL,YAAA,GAAGJ,eAAe;AAClB,YAAA,GAAGC,qBAAqB;AACxBI,YAAAA,OAAAA,CAAAA,GAAAA;AACE,gBAAA,MAAM,IAAI9B,cAAAA,EAAAA;AAChB,YAAA,CAAA;AACI+B,YAAAA,SAAAA,EAAWZ,cAAAA,CAAeC,GAAAA;AAC9B,SAAA;AACA,IAAA,CAAA;IAEAY,SAAAA,CAAAC,OAAc,GACZ,CAACC,MAAAA,EAAQ,EAAEC,MAAM,EAAE,GACnB,OAAOf,GAAAA,EAAKgB,IAAAA,GAAAA;AACV,YAAA,IAAIX,eAAAA,GAAkBU,MAAAA,CAAOD,MAAM,CAACG,GAAG,CAAC,qCAAA,CAAA;AAExC,YAAA,IAAI,CAACZ,eAAAA,EAAiB;gBACpBA,eAAAA,GAAkB;oBAChBa,OAAAA,EAAS;AACjB,iBAAA;AACA,YAAA;YAEI,IAAI,CAACzC,GAAAA,CAAI,SAAA,EAAW4B,eAAAA,CAAAA,EAAkB;AACpCA,gBAAAA,eAAAA,CAAgBa,OAAO,GAAG,IAAA;AAChC,YAAA;YAEI,IAAIb,eAAAA,CAAgBa,OAAO,KAAK,IAAA,EAAM;gBACpC,MAAMC,SAAAA,GAAYC,WAA0BC,SAAS;gBAErD,MAAMC,UAAAA,GAAalB,wBAAAA,CAAyBJ,GAAAA,EAAKK,eAAAA,EAAiBS,MAAAA,CAAAA;AAElE,gBAAA,OAAOK,SAAAA,CAAUI,UAAU,CAACD,UAAAA,CAAAA,CAAYtB,GAAAA,EAAKgB,IAAAA,CAAAA;AACnD,YAAA;YAEI,OAAOA,IAAAA,EAAAA;AACX,QAAA,CAAA;IAEAJ,SAAAA,CAAAC,OAAA,CAAAd,cAA6B,GAAGA,cAAAA;IAChCa,SAAAA,CAAAC,OAAA,CAAA/B,yBAAwC,GAAGA,yBAAAA;IAC3C8B,SAAAA,CAAAC,OAAA,CAAAvB,gCAA+C,GAAGA,gCAAAA;IAClDsB,SAAAA,CAAAC,OAAA,CAAAT,wBAAuC,GAAGA,wBAAAA;;;;;;"}

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@strapi/plugin-users-permissions",
-  "version": "5.52.2",
+  "version": "5.52.3",
   "description": "Protect your API with a full-authentication process based on JWT",
   "homepage": "https://strapi.io",
   "bugs": {
@@ -55,7 +55,7 @@
   "dependencies": {
     "@strapi/design-system": "2.2.4",
     "@strapi/icons": "2.2.4",
-    "@strapi/utils": "5.52.2",
+    "@strapi/utils": "5.52.3",
     "bcryptjs": "2.4.3",
     "formik": "2.4.9",
     "immer": "9.0.21",
@@ -72,8 +72,8 @@
     "zod": "4.4.3"
   },
   "devDependencies": {
-    "@strapi/admin": "5.52.2",
-    "@strapi/strapi": "5.52.2",
+    "@strapi/admin": "5.52.3",
+    "@strapi/strapi": "5.52.3",
     "@testing-library/dom": "10.4.1",
     "@testing-library/jest-dom": "6.9.1",
     "@testing-library/react": "16.3.2",

package/server/src/controllers/auth.js CHANGED Viewed

@@ -373,7 +373,10 @@ module.exports = ({ strapi }) => ({
       const cookieName = upSessions.cookie?.name || 'strapi_up_refresh';
       const isProduction = process.env.NODE_ENV === 'production';
-      const { maxAge, ...cookieOptions } = buildRefreshCookieOptions(upSessions, isProduction);
+      const { maxAge: _maxAge, ...cookieOptions } = buildRefreshCookieOptions(
+        upSessions,
+        isProduction
+      );
       ctx.cookies.set(cookieName, '', { ...cookieOptions, expires: new Date(0) });
     }

package/server/src/middlewares/rateLimit.js CHANGED Viewed

@@ -46,7 +46,7 @@ const routeUsesEmailIdentifier = (requestPath) => {
  * `/api/auth/local/` share one bucket.
  */
 const normalizeRequestPathForRateLimit = (requestPath) => {
-  const normalized = path.normalize(requestPath);
+  const normalized = path.posix.normalize(requestPath);
   const lower = toLower(normalized);
   return lower.replace(/\/+$/, '') || '/';
 };