@strapi/plugin-users-permissions 5.52.2 → 5.53.0

package/dist/server/services/providers-registry.mjs

@@ -33,6 +33,9 @@ function requireProvidersRegistry() {
                 },
                 async authCallback ({ accessToken }) {
                     const { body } = await bearerGet('https://discord.com/api/users/@me', accessToken);
+                    if (body.verified !== true) {
+                        throw new Error('Email not verified by Discord');
+                    }
                     const username = body.discriminator && body.discriminator !== '0' ? `${body.username}#${body.discriminator}` : body.username;
                     return {
                         username,
@@ -57,6 +60,9 @@ function requireProvidersRegistry() {
                             fields: 'name,email'
                         }
                     });
+                    if (!body.email) {
+                        throw new Error('Email not verified by Facebook');
+                    }
                     return {
                         username: body.name,
                         email: body.email
@@ -76,6 +82,10 @@ function requireProvidersRegistry() {
                 },
                 async authCallback ({ accessToken }) {
                     const { body } = await fetchJson(`https://oauth2.googleapis.com/tokeninfo?access_token=${encodeURIComponent(accessToken)}`);
+                    const verified = body.verified_email ?? body.email_verified;
+                    if (verified !== true && verified !== 'true') {
+                        throw new Error('Email not verified by Google');
+                    }
                     return {
                         username: body.email.split('@')[0],
                         email: body.email
@@ -100,20 +110,28 @@ function requireProvidersRegistry() {
                             'user-agent': 'strapi'
                         }
                     });
+                    const { body: emailBody } = await bearerGet('https://api.github.com/user/emails', accessToken, {
+                        headers: {
+                            'user-agent': 'strapi'
+                        }
+                    });
                     if (userBody.email) {
+                        const verifiedPublicEmail = Array.isArray(emailBody) ? emailBody.find((entry)=>entry.email === userBody.email && entry.verified === true) : null;
+                        if (!verifiedPublicEmail) {
+                            throw new Error('Email not verified by GitHub');
+                        }
                         return {
                             username: userBody.login,
                             email: userBody.email
                         };
                     }
-                    const { body: emailBody } = await bearerGet('https://api.github.com/user/emails', accessToken, {
-                        headers: {
-                            'user-agent': 'strapi'
-                        }
-                    });
+                    const primaryEmail = Array.isArray(emailBody) ? emailBody.find((email)=>email.primary === true) : null;
+                    if (!primaryEmail || primaryEmail.verified !== true) {
+                        throw new Error('Email not verified by GitHub');
+                    }
                     return {
                         username: userBody.login,
-                        email: Array.isArray(emailBody) ? emailBody.find((email)=>email.primary === true).email : null
+                        email: primaryEmail.email
                     };
                 }
             },
@@ -144,19 +162,27 @@ function requireProvidersRegistry() {
                     secret: '',
                     callbackUrl: `${baseURL}/twitter/callback`
                 },
-                async authCallback ({ accessToken, query, providers }) {
+                async authCallback ({ accessToken, providers, grantResponse }) {
+                    const accessSecret = grantResponse?.access_secret;
+                    const screenName = grantResponse?.raw?.screen_name;
+                    if (!accessSecret) {
+                        throw new Error('Twitter authentication requires a completed OAuth session');
+                    }
                     const { twitterGet } = requireOauth1();
                     const { body } = await twitterGet({
                         url: 'https://api.twitter.com/1.1/account/verify_credentials.json',
                         accessToken,
-                        accessCredential: query.access_secret,
+                        accessCredential: accessSecret,
                         consumerKey: providers.twitter.key,
                         clientCredential: providers.twitter.secret,
                         qs: {
                             include_email: 'true',
-                            screen_name: query['raw[screen_name]']
+                            screen_name: screenName
                         }
                     });
+                    if (!body.email) {
+                        throw new Error('Email not verified by Twitter');
+                    }
                     return {
                         username: body.screen_name,
                         email: body.email
@@ -197,16 +223,24 @@ function requireProvidersRegistry() {
                         'email'
                     ]
                 },
-                async authCallback ({ accessToken, query }) {
+                async authCallback ({ accessToken, grantResponse }) {
+                    const email = grantResponse?.raw?.email;
+                    const userId = grantResponse?.raw?.user_id;
+                    if (!email || !userId) {
+                        throw new Error('VK authentication requires a completed OAuth session');
+                    }
                     const { body } = await bearerGet('https://api.vk.com/method/users.get', accessToken, {
                         qs: {
-                            user_ids: query.raw.user_id,
+                            user_ids: userId,
                             v: '5.122'
                         }
                     });
+                    if (!body.response?.[0]) {
+                        throw new Error('Invalid VK access token');
+                    }
                     return {
                         username: `${body.response[0].last_name} ${body.response[0].first_name}`,
-                        email: query.raw.email
+                        email
                     };
                 }
             },
@@ -227,9 +261,13 @@ function requireProvidersRegistry() {
                             'Client-Id': providers.twitch.key
                         }
                     });
+                    const email = body.data?.[0]?.email;
+                    if (!email) {
+                        throw new Error('Email not verified by Twitch');
+                    }
                     return {
                         username: body.data[0].login,
-                        email: body.data[0].email
+                        email
                     };
                 }
             },
@@ -248,7 +286,10 @@ function requireProvidersRegistry() {
                 async authCallback ({ accessToken }) {
                     const { body: profileBody } = await bearerGet('https://api.linkedin.com/v2/me', accessToken);
                     const { body: emailBody } = await bearerGet('https://api.linkedin.com/v2/emailAddress?q=members&projection=(elements*(handle~))', accessToken);
-                    const email = emailBody.elements[0]['handle~'];
+                    const email = emailBody.elements[0]?.['handle~'];
+                    if (!email?.emailAddress) {
+                        throw new Error('Email not verified by LinkedIn');
+                    }
                     return {
                         username: profileBody.localizedFirstName,
                         email: email.emailAddress
@@ -269,13 +310,19 @@ function requireProvidersRegistry() {
                         'profile'
                     ]
                 },
-                async authCallback ({ query, providers }) {
+                async authCallback ({ providers, grantResponse }) {
                     const jwksUrl = new URL(providers.cognito.jwksurl);
-                    const idToken = query.id_token;
+                    const idToken = grantResponse?.id_token;
+                    if (!idToken) {
+                        throw new Error('Cognito authentication requires a completed OAuth session');
+                    }
                     const tokenPayload = await verifyJwtWithJwks({
                         idToken,
                         jwksUrl
                     });
+                    if (tokenPayload.email_verified !== true) {
+                        throw new Error('Email not verified by Cognito');
+                    }
                     return {
                         username: tokenPayload['cognito:username'],
                         email: tokenPayload.email
@@ -321,6 +368,9 @@ function requireProvidersRegistry() {
                 },
                 async authCallback ({ accessToken, providers }) {
                     const { body } = await bearerGet(`https://${providers.auth0.subdomain}.auth0.com/userinfo`, accessToken);
+                    if (body.email && body.email_verified !== true) {
+                        throw new Error('Email not verified by Auth0');
+                    }
                     const username = body.username || body.nickname || body.name || body.email.split('@')[0];
                     const email = body.email || `${username.replace(/\s+/g, '.')}@strapi.io`;
                     return {
@@ -345,9 +395,13 @@ function requireProvidersRegistry() {
                     const { body } = await bearerGet(`https://${providers.cas.subdomain}/oidc/profile`, accessToken);
                     const username = body.attributes ? body.attributes.strapiusername || body.id || body.sub : body.strapiusername || body.id || body.sub;
                     const email = body.attributes ? body.attributes.strapiemail || body.attributes.email : body.strapiemail || body.email;
+                    const emailVerified = body.email_verified ?? body.attributes?.email_verified;
                     if (!username || !email) {
                         strapi.log.warn(`CAS Response Body did not contain required attributes: ${JSON.stringify(body)}`);
                     }
+                    if (email && emailVerified !== true) {
+                        throw new Error('Email not verified by CAS');
+                    }
                     return {
                         username,
                         email
@@ -367,8 +421,11 @@ function requireProvidersRegistry() {
                     ]
                 },
                 async authCallback ({ accessToken }) {
-                    const { body } = await bearerGet('https://www.patreon.com/api/oauth2/v2/identity?fields[user]=full_name,email', accessToken);
+                    const { body } = await bearerGet('https://www.patreon.com/api/oauth2/v2/identity?fields[user]=full_name,email,is_email_verified', accessToken);
                     const patreonData = body.data.attributes;
+                    if (patreonData.is_email_verified !== true) {
+                        throw new Error('Email not verified by Patreon');
+                    }
                     return {
                         username: patreonData.full_name,
                         email: patreonData.email
@@ -391,6 +448,9 @@ function requireProvidersRegistry() {
                 },
                 async authCallback ({ accessToken, providers }) {
                     const { body } = await bearerGet(`https://${providers.keycloak.subdomain}/protocol/openid-connect/userinfo`, accessToken);
+                    if (body.email_verified !== true) {
+                        throw new Error('Email not verified by Keycloak');
+                    }
                     return {
                         username: body.preferred_username,
                         email: body.email
@@ -417,13 +477,14 @@ function requireProvidersRegistry() {
             remove (name) {
                 delete authProviders[name];
             },
-            async run ({ provider, accessToken, query, providers }) {
+            async run ({ provider, accessToken, query, providers, grantResponse }) {
                 const authProvider = authProviders[provider];
                 assert(authProvider, 'Unknown auth provider');
                 return authProvider.authCallback({
                     accessToken,
                     query,
-                    providers
+                    providers,
+                    grantResponse
                 });
             }
         };

package/dist/server/services/providers-registry.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"providers-registry.mjs","sources":["../../../server/src/services/providers-registry.js"],"sourcesContent":["'use strict';\n\nconst { strict: assert } = require('assert');\nconst urljoin = require('url-join');\n\nconst { verifyJwtWithJwks } = require('../utils/verify-jwt-with-jwks');\nconst { bearerGet, fetchJson } = require('../utils/provider-http');\n\nconst initProviders = ({ baseURL }) => ({\n  email: {\n    enabled: true,\n    icon: 'envelope',\n    grantConfig: {},\n  },\n  discord: {\n    enabled: false,\n    icon: 'discord',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/discord/callback`,\n      scope: ['identify', 'email'],\n    },\n    async authCallback({ accessToken }) {\n      const { body } = await bearerGet('https://discord.com/api/users/@me', accessToken);\n      const username =\n        body.discriminator && body.discriminator !== '0'\n          ? `${body.username}#${body.discriminator}`\n          : body.username;\n      return {\n        username,\n        email: body.email,\n      };\n    },\n  },\n  facebook: {\n    enabled: false,\n    icon: 'facebook-square',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/facebook/callback`,\n      scope: ['email'],\n    },\n    async authCallback({ accessToken }) {\n      const { body } = await bearerGet('https://graph.facebook.com/me', accessToken, {\n        qs: { fields: 'name,email' },\n      });\n      return {\n        username: body.name,\n        email: body.email,\n      };\n    },\n  },\n  google: {\n    enabled: false,\n    icon: 'google',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/google/callback`,\n      scope: ['email'],\n    },\n    async authCallback({ accessToken }) {\n      const { body } = await fetchJson(\n        `https://oauth2.googleapis.com/tokeninfo?access_token=${encodeURIComponent(accessToken)}`\n      );\n      return {\n        username: body.email.split('@')[0],\n        email: body.email,\n      };\n    },\n  },\n  github: {\n    enabled: false,\n    icon: 'github',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/github/callback`,\n      scope: ['user', 'user:email'],\n    },\n    async authCallback({ accessToken }) {\n      const { body: userBody } = await bearerGet('https://api.github.com/user', accessToken, {\n        headers: { 'user-agent': 'strapi' },\n      });\n\n      if (userBody.email) {\n        return {\n          username: userBody.login,\n          email: userBody.email,\n        };\n      }\n\n      const { body: emailBody } = await bearerGet(\n        'https://api.github.com/user/emails',\n        accessToken,\n        {\n          headers: { 'user-agent': 'strapi' },\n        }\n      );\n\n      return {\n        username: userBody.login,\n        email: Array.isArray(emailBody)\n          ? emailBody.find((email) => email.primary === true).email\n          : null,\n      };\n    },\n  },\n  microsoft: {\n    enabled: false,\n    icon: 'windows',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/microsoft/callback`,\n      scope: ['user.read'],\n    },\n    async authCallback({ accessToken }) {\n      const { body } = await bearerGet('https://graph.microsoft.com/v1.0/me', accessToken);\n      return {\n        username: body.userPrincipalName,\n        email: body.userPrincipalName,\n      };\n    },\n  },\n\n  twitter: {\n    enabled: false,\n    icon: 'twitter',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/twitter/callback`,\n    },\n    async authCallback({ accessToken, query, providers }) {\n      const { twitterGet } = require('../utils/oauth-connect/oauth1');\n      const { body } = await twitterGet({\n        url: 'https://api.twitter.com/1.1/account/verify_credentials.json',\n        accessToken,\n        accessCredential: query.access_secret,\n        consumerKey: providers.twitter.key,\n        clientCredential: providers.twitter.secret,\n        qs: { include_email: 'true', screen_name: query['raw[screen_name]'] },\n      });\n\n      return {\n        username: body.screen_name,\n        email: body.email,\n      };\n    },\n  },\n  instagram: {\n    enabled: false,\n    icon: 'instagram',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/instagram/callback`,\n      scope: ['user_profile'],\n    },\n    async authCallback({ accessToken }) {\n      const { body } = await bearerGet('https://graph.instagram.com/me', accessToken, {\n        qs: { fields: 'id,username' },\n      });\n      return {\n        username: body.username,\n        email: `${body.username}@strapi.io`,\n      };\n    },\n  },\n  vk: {\n    enabled: false,\n    icon: 'vk',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/vk/callback`,\n      scope: ['email'],\n    },\n    async authCallback({ accessToken, query }) {\n      const { body } = await bearerGet('https://api.vk.com/method/users.get', accessToken, {\n        qs: { user_ids: query.raw.user_id, v: '5.122' },\n      });\n      return {\n        username: `${body.response[0].last_name} ${body.response[0].first_name}`,\n        email: query.raw.email,\n      };\n    },\n  },\n\n  twitch: {\n    enabled: false,\n    icon: 'twitch',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/twitch/callback`,\n      scope: ['user:read:email'],\n    },\n    async authCallback({ accessToken, providers }) {\n      const { body } = await bearerGet('https://api.twitch.tv/helix/users', accessToken, {\n        headers: {\n          'Client-Id': providers.twitch.key,\n        },\n      });\n      return {\n        username: body.data[0].login,\n        email: body.data[0].email,\n      };\n    },\n  },\n\n  linkedin: {\n    enabled: false,\n    icon: 'linkedin',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/linkedin/callback`,\n      scope: ['r_liteprofile', 'r_emailaddress'],\n    },\n    async authCallback({ accessToken }) {\n      const { body: profileBody } = await bearerGet('https://api.linkedin.com/v2/me', accessToken);\n      const { body: emailBody } = await bearerGet(\n        'https://api.linkedin.com/v2/emailAddress?q=members&projection=(elements*(handle~))',\n        accessToken\n      );\n\n      const email = emailBody.elements[0]['handle~'];\n\n      return {\n        username: profileBody.localizedFirstName,\n        email: email.emailAddress,\n      };\n    },\n  },\n\n  cognito: {\n    enabled: false,\n    icon: 'aws',\n    grantConfig: {\n      key: '',\n      secret: '',\n      subdomain: 'my.subdomain.com',\n      callback: `${baseURL}/cognito/callback`,\n      scope: ['email', 'openid', 'profile'],\n    },\n    async authCallback({ query, providers }) {\n      const jwksUrl = new URL(providers.cognito.jwksurl);\n      const idToken = query.id_token;\n      const tokenPayload = await verifyJwtWithJwks({ idToken, jwksUrl });\n      return {\n        username: tokenPayload['cognito:username'],\n        email: tokenPayload.email,\n      };\n    },\n  },\n\n  reddit: {\n    enabled: false,\n    icon: 'reddit',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callback: `${baseURL}/reddit/callback`,\n      scope: ['identity'],\n    },\n    async authCallback({ accessToken }) {\n      const { body } = await bearerGet('https://oauth.reddit.com/api/v1/me', accessToken, {\n        headers: { 'user-agent': 'strapi' },\n      });\n      return {\n        username: body.name,\n        email: `${body.name}@strapi.io`,\n      };\n    },\n  },\n\n  auth0: {\n    enabled: false,\n    icon: '',\n    grantConfig: {\n      key: '',\n      secret: '',\n      subdomain: 'my-tenant.eu',\n      callback: `${baseURL}/auth0/callback`,\n      scope: ['openid', 'email', 'profile'],\n    },\n    async authCallback({ accessToken, providers }) {\n      const { body } = await bearerGet(\n        `https://${providers.auth0.subdomain}.auth0.com/userinfo`,\n        accessToken\n      );\n      const username = body.username || body.nickname || body.name || body.email.split('@')[0];\n      const email = body.email || `${username.replace(/\\s+/g, '.')}@strapi.io`;\n\n      return {\n        username,\n        email,\n      };\n    },\n  },\n\n  cas: {\n    enabled: false,\n    icon: 'book',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callback: `${baseURL}/cas/callback`,\n      scope: ['openid email'],\n      subdomain: 'my.subdomain.com/cas',\n    },\n    async authCallback({ accessToken, providers }) {\n      const { body } = await bearerGet(\n        `https://${providers.cas.subdomain}/oidc/profile`,\n        accessToken\n      );\n      const username = body.attributes\n        ? body.attributes.strapiusername || body.id || body.sub\n        : body.strapiusername || body.id || body.sub;\n      const email = body.attributes\n        ? body.attributes.strapiemail || body.attributes.email\n        : body.strapiemail || body.email;\n      if (!username || !email) {\n        strapi.log.warn(\n          `CAS Response Body did not contain required attributes: ${JSON.stringify(body)}`\n        );\n      }\n      return {\n        username,\n        email,\n      };\n    },\n  },\n\n  patreon: {\n    enabled: false,\n    icon: '',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callback: `${baseURL}/patreon/callback`,\n      scope: ['identity', 'identity[email]'],\n    },\n    async authCallback({ accessToken }) {\n      const { body } = await bearerGet(\n        'https://www.patreon.com/api/oauth2/v2/identity?fields[user]=full_name,email',\n        accessToken\n      );\n      const patreonData = body.data.attributes;\n      return {\n        username: patreonData.full_name,\n        email: patreonData.email,\n      };\n    },\n  },\n  keycloak: {\n    enabled: false,\n    icon: '',\n    grantConfig: {\n      key: '',\n      secret: '',\n      subdomain: 'myKeycloakProvider.com/realms/myrealm',\n      callback: `${baseURL}/keycloak/callback`,\n      scope: ['openid', 'email', 'profile'],\n    },\n    async authCallback({ accessToken, providers }) {\n      const { body } = await bearerGet(\n        `https://${providers.keycloak.subdomain}/protocol/openid-connect/userinfo`,\n        accessToken\n      );\n      return {\n        username: body.preferred_username,\n        email: body.email,\n      };\n    },\n  },\n});\n\nmodule.exports = () => {\n  const apiPrefix = strapi.config.get('api.rest.prefix');\n  const baseURL = urljoin(strapi.config.server.url, apiPrefix, 'auth');\n\n  const authProviders = initProviders({ baseURL });\n\n  return {\n    getAll() {\n      return authProviders;\n    },\n    get(name) {\n      return authProviders[name];\n    },\n    add(name, config) {\n      authProviders[name] = config;\n    },\n    remove(name) {\n      delete authProviders[name];\n    },\n\n    async run({ provider, accessToken, query, providers }) {\n      const authProvider = authProviders[provider];\n\n      assert(authProvider, 'Unknown auth provider');\n\n      return authProvider.authCallback({ accessToken, query, providers });\n    },\n  };\n};\n"],"names":["strict","assert","require$$0","urljoin","require$$1","verifyJwtWithJwks","require$$2","bearerGet","fetchJson","require$$3","initProviders","baseURL","email","enabled","icon","grantConfig","discord","key","secret","callbackUrl","scope","authCallback","accessToken","body","username","discriminator","facebook","qs","fields","name","google","encodeURIComponent","split","github","userBody","headers","login","emailBody","Array","isArray","find","primary","microsoft","userPrincipalName","twitter","query","providers","twitterGet","require$$4","url","accessCredential","access_secret","consumerKey","clientCredential","include_email","screen_name","instagram","vk","user_ids","raw","user_id","v","response","last_name","first_name","twitch","data","linkedin","profileBody","elements","localizedFirstName","emailAddress","cognito","subdomain","callback","jwksUrl","URL","jwksurl","idToken","id_token","tokenPayload","reddit","auth0","nickname","replace","cas","attributes","strapiusername","id","sub","strapiemail","strapi","log","warn","JSON","stringify","patreon","patreonData","full_name","keycloak","preferred_username","providersRegistry","apiPrefix","config","get","server","authProviders","getAll","add","remove","run","provider","authProvider"],"mappings":";;;;;;;;;;;AAEA,IAAA,MAAM,EAAEA,MAAAA,EAAQC,MAAM,EAAE,GAAGC,UAAAA;AAC3B,IAAA,MAAMC,OAAAA,GAAUC,UAAAA;IAEhB,MAAM,EAAEC,iBAAiB,EAAE,GAAGC,wBAAAA,EAAAA;AAC9B,IAAA,MAAM,EAAEC,SAAS,EAAEC,SAAS,EAAE,GAAGC,mBAAAA,EAAAA;AAEjC,IAAA,MAAMC,gBAAgB,CAAC,EAAEC,OAAO,EAAE,IAAM;YACtCC,KAAAA,EAAO;gBACLC,OAAAA,EAAS,IAAA;gBACTC,IAAAA,EAAM,UAAA;AACNC,gBAAAA,WAAAA,EAAa;AACjB,aAAA;YACEC,OAAAA,EAAS;gBACPH,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,SAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGR,OAAAA,CAAQ,iBAAiB,CAAC;oBAC1CS,KAAAA,EAAO;AAAC,wBAAA,UAAA;AAAY,wBAAA;AAAQ;AAClC,iBAAA;gBACI,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE,EAAA;AAChC,oBAAA,MAAM,EAAEC,IAAI,EAAE,GAAG,MAAMhB,UAAU,mCAAA,EAAqCe,WAAAA,CAAAA;AACtE,oBAAA,MAAME,WACJD,IAAAA,CAAKE,aAAa,IAAIF,IAAAA,CAAKE,aAAa,KAAK,GAAA,GACzC,CAAA,EAAGF,KAAKC,QAAQ,CAAC,CAAC,EAAED,IAAAA,CAAKE,aAAa,CAAA,CAAC,GACvCF,KAAKC,QAAQ;oBACnB,OAAO;AACLA,wBAAAA,QAAAA;AACAZ,wBAAAA,KAAAA,EAAOW,KAAKX;AACpB,qBAAA;AACA,gBAAA;AACA,aAAA;YACEc,QAAAA,EAAU;gBACRb,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,iBAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGR,OAAAA,CAAQ,kBAAkB,CAAC;oBAC3CS,KAAAA,EAAO;AAAC,wBAAA;AAAQ;AACtB,iBAAA;gBACI,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE,EAAA;AAChC,oBAAA,MAAM,EAAEC,IAAI,EAAE,GAAG,MAAMhB,SAAAA,CAAU,iCAAiCe,WAAAA,EAAa;wBAC7EK,EAAAA,EAAI;4BAAEC,MAAAA,EAAQ;AAAY;AAClC,qBAAA,CAAA;oBACM,OAAO;AACLJ,wBAAAA,QAAAA,EAAUD,KAAKM,IAAI;AACnBjB,wBAAAA,KAAAA,EAAOW,KAAKX;AACpB,qBAAA;AACA,gBAAA;AACA,aAAA;YACEkB,MAAAA,EAAQ;gBACNjB,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,QAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGR,OAAAA,CAAQ,gBAAgB,CAAC;oBACzCS,KAAAA,EAAO;AAAC,wBAAA;AAAQ;AACtB,iBAAA;gBACI,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE,EAAA;oBAChC,MAAM,EAAEC,IAAI,EAAE,GAAG,MAAMf,UACrB,CAAC,qDAAqD,EAAEuB,kBAAAA,CAAmBT,WAAAA,CAAAA,CAAAA,CAAa,CAAA;oBAE1F,OAAO;AACLE,wBAAAA,QAAAA,EAAUD,KAAKX,KAAK,CAACoB,KAAK,CAAC,GAAA,CAAI,CAAC,CAAA,CAAE;AAClCpB,wBAAAA,KAAAA,EAAOW,KAAKX;AACpB,qBAAA;AACA,gBAAA;AACA,aAAA;YACEqB,MAAAA,EAAQ;gBACNpB,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,QAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGR,OAAAA,CAAQ,gBAAgB,CAAC;oBACzCS,KAAAA,EAAO;AAAC,wBAAA,MAAA;AAAQ,wBAAA;AAAa;AACnC,iBAAA;gBACI,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE,EAAA;oBAChC,MAAM,EAAEC,MAAMW,QAAQ,EAAE,GAAG,MAAM3B,SAAAA,CAAU,+BAA+Be,WAAAA,EAAa;wBACrFa,OAAAA,EAAS;4BAAE,YAAA,EAAc;AAAQ;AACzC,qBAAA,CAAA;oBAEM,IAAID,QAAAA,CAAStB,KAAK,EAAE;wBAClB,OAAO;AACLY,4BAAAA,QAAAA,EAAUU,SAASE,KAAK;AACxBxB,4BAAAA,KAAAA,EAAOsB,SAAStB;AAC1B,yBAAA;AACA,oBAAA;oBAEM,MAAM,EAAEW,MAAMc,SAAS,EAAE,GAAG,MAAM9B,SAAAA,CAChC,sCACAe,WAAAA,EACA;wBACEa,OAAAA,EAAS;4BAAE,YAAA,EAAc;AAAQ;AAC3C,qBAAA,CAAA;oBAGM,OAAO;AACLX,wBAAAA,QAAAA,EAAUU,SAASE,KAAK;AACxBxB,wBAAAA,KAAAA,EAAO0B,KAAAA,CAAMC,OAAO,CAACF,SAAAA,CAAAA,GACjBA,UAAUG,IAAI,CAAC,CAAC5B,KAAAA,GAAUA,KAAAA,CAAM6B,OAAO,KAAK,IAAA,CAAA,CAAM7B,KAAA,GAClD;AACZ,qBAAA;AACA,gBAAA;AACA,aAAA;YACE8B,SAAAA,EAAW;gBACT7B,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,SAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGR,OAAAA,CAAQ,mBAAmB,CAAC;oBAC5CS,KAAAA,EAAO;AAAC,wBAAA;AAAY;AAC1B,iBAAA;gBACI,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE,EAAA;AAChC,oBAAA,MAAM,EAAEC,IAAI,EAAE,GAAG,MAAMhB,UAAU,qCAAA,EAAuCe,WAAAA,CAAAA;oBACxE,OAAO;AACLE,wBAAAA,QAAAA,EAAUD,KAAKoB,iBAAiB;AAChC/B,wBAAAA,KAAAA,EAAOW,KAAKoB;AACpB,qBAAA;AACA,gBAAA;AACA,aAAA;YAEEC,OAAAA,EAAS;gBACP/B,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,SAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGR,OAAAA,CAAQ,iBAAiB;AAC/C,iBAAA;AACI,gBAAA,MAAMU,cAAa,EAAEC,WAAW,EAAEuB,KAAK,EAAEC,SAAS,EAAE,EAAA;oBAClD,MAAM,EAAEC,UAAU,EAAE,GAAGC,aAAAA,EAAAA;AACvB,oBAAA,MAAM,EAAEzB,IAAI,EAAE,GAAG,MAAMwB,UAAAA,CAAW;wBAChCE,GAAAA,EAAK,6DAAA;AACL3B,wBAAAA,WAAAA;AACA4B,wBAAAA,gBAAAA,EAAkBL,MAAMM,aAAa;wBACrCC,WAAAA,EAAaN,SAAAA,CAAUF,OAAO,CAAC3B,GAAG;wBAClCoC,gBAAAA,EAAkBP,SAAAA,CAAUF,OAAO,CAAC1B,MAAM;wBAC1CS,EAAAA,EAAI;4BAAE2B,aAAAA,EAAe,MAAA;4BAAQC,WAAAA,EAAaV,KAAK,CAAC,kBAAA;AAAmB;AAC3E,qBAAA,CAAA;oBAEM,OAAO;AACLrB,wBAAAA,QAAAA,EAAUD,KAAKgC,WAAW;AAC1B3C,wBAAAA,KAAAA,EAAOW,KAAKX;AACpB,qBAAA;AACA,gBAAA;AACA,aAAA;YACE4C,SAAAA,EAAW;gBACT3C,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,WAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGR,OAAAA,CAAQ,mBAAmB,CAAC;oBAC5CS,KAAAA,EAAO;AAAC,wBAAA;AAAe;AAC7B,iBAAA;gBACI,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE,EAAA;AAChC,oBAAA,MAAM,EAAEC,IAAI,EAAE,GAAG,MAAMhB,SAAAA,CAAU,kCAAkCe,WAAAA,EAAa;wBAC9EK,EAAAA,EAAI;4BAAEC,MAAAA,EAAQ;AAAa;AACnC,qBAAA,CAAA;oBACM,OAAO;AACLJ,wBAAAA,QAAAA,EAAUD,KAAKC,QAAQ;AACvBZ,wBAAAA,KAAAA,EAAO,CAAA,EAAGW,IAAAA,CAAKC,QAAQ,CAAC,UAAU;AAC1C,qBAAA;AACA,gBAAA;AACA,aAAA;YACEiC,EAAAA,EAAI;gBACF5C,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,IAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGR,OAAAA,CAAQ,YAAY,CAAC;oBACrCS,KAAAA,EAAO;AAAC,wBAAA;AAAQ;AACtB,iBAAA;AACI,gBAAA,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAEuB,KAAK,EAAE,EAAA;AACvC,oBAAA,MAAM,EAAEtB,IAAI,EAAE,GAAG,MAAMhB,SAAAA,CAAU,uCAAuCe,WAAAA,EAAa;wBACnFK,EAAAA,EAAI;4BAAE+B,QAAAA,EAAUb,KAAAA,CAAMc,GAAG,CAACC,OAAO;4BAAEC,CAAAA,EAAG;AAAO;AACrD,qBAAA,CAAA;oBACM,OAAO;AACLrC,wBAAAA,QAAAA,EAAU,GAAGD,IAAAA,CAAKuC,QAAQ,CAAC,CAAA,CAAE,CAACC,SAAS,CAAC,CAAC,EAAExC,KAAKuC,QAAQ,CAAC,CAAA,CAAE,CAACE,UAAU,CAAA,CAAE;wBACxEpD,KAAAA,EAAOiC,KAAAA,CAAMc,GAAG,CAAC/C;AACzB,qBAAA;AACA,gBAAA;AACA,aAAA;YAEEqD,MAAAA,EAAQ;gBACNpD,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,QAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGR,OAAAA,CAAQ,gBAAgB,CAAC;oBACzCS,KAAAA,EAAO;AAAC,wBAAA;AAAkB;AAChC,iBAAA;AACI,gBAAA,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAEwB,SAAS,EAAE,EAAA;AAC3C,oBAAA,MAAM,EAAEvB,IAAI,EAAE,GAAG,MAAMhB,SAAAA,CAAU,qCAAqCe,WAAAA,EAAa;wBACjFa,OAAAA,EAAS;4BACP,WAAA,EAAaW,SAAAA,CAAUmB,MAAM,CAAChD;AACxC;AACA,qBAAA,CAAA;oBACM,OAAO;AACLO,wBAAAA,QAAAA,EAAUD,IAAAA,CAAK2C,IAAI,CAAC,CAAA,CAAE,CAAC9B,KAAK;AAC5BxB,wBAAAA,KAAAA,EAAOW,IAAAA,CAAK2C,IAAI,CAAC,CAAA,CAAE,CAACtD;AAC5B,qBAAA;AACA,gBAAA;AACA,aAAA;YAEEuD,QAAAA,EAAU;gBACRtD,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,UAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGR,OAAAA,CAAQ,kBAAkB,CAAC;oBAC3CS,KAAAA,EAAO;AAAC,wBAAA,eAAA;AAAiB,wBAAA;AAAiB;AAChD,iBAAA;gBACI,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE,EAAA;AAChC,oBAAA,MAAM,EAAEC,IAAAA,EAAM6C,WAAW,EAAE,GAAG,MAAM7D,UAAU,gCAAA,EAAkCe,WAAAA,CAAAA;AAChF,oBAAA,MAAM,EAAEC,IAAAA,EAAMc,SAAS,EAAE,GAAG,MAAM9B,UAChC,oFAAA,EACAe,WAAAA,CAAAA;AAGF,oBAAA,MAAMV,QAAQyB,SAAAA,CAAUgC,QAAQ,CAAC,CAAA,CAAE,CAAC,SAAA,CAAU;oBAE9C,OAAO;AACL7C,wBAAAA,QAAAA,EAAU4C,YAAYE,kBAAkB;AACxC1D,wBAAAA,KAAAA,EAAOA,MAAM2D;AACrB,qBAAA;AACA,gBAAA;AACA,aAAA;YAEEC,OAAAA,EAAS;gBACP3D,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,KAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRuD,SAAAA,EAAW,kBAAA;oBACXC,QAAAA,EAAU,CAAA,EAAG/D,OAAAA,CAAQ,iBAAiB,CAAC;oBACvCS,KAAAA,EAAO;AAAC,wBAAA,OAAA;AAAS,wBAAA,QAAA;AAAU,wBAAA;AAAU;AAC3C,iBAAA;AACI,gBAAA,MAAMC,YAAAA,CAAAA,CAAa,EAAEwB,KAAK,EAAEC,SAAS,EAAE,EAAA;AACrC,oBAAA,MAAM6B,UAAU,IAAIC,GAAAA,CAAI9B,SAAAA,CAAU0B,OAAO,CAACK,OAAO,CAAA;oBACjD,MAAMC,OAAAA,GAAUjC,MAAMkC,QAAQ;oBAC9B,MAAMC,YAAAA,GAAe,MAAM3E,iBAAAA,CAAkB;AAAEyE,wBAAAA,OAAAA;AAASH,wBAAAA;AAAO,qBAAA,CAAA;oBAC/D,OAAO;wBACLnD,QAAAA,EAAUwD,YAAY,CAAC,kBAAA,CAAmB;AAC1CpE,wBAAAA,KAAAA,EAAOoE,aAAapE;AAC5B,qBAAA;AACA,gBAAA;AACA,aAAA;YAEEqE,MAAAA,EAAQ;gBACNpE,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,QAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRwD,QAAAA,EAAU,CAAA,EAAG/D,OAAAA,CAAQ,gBAAgB,CAAC;oBACtCS,KAAAA,EAAO;AAAC,wBAAA;AAAW;AACzB,iBAAA;gBACI,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE,EAAA;AAChC,oBAAA,MAAM,EAAEC,IAAI,EAAE,GAAG,MAAMhB,SAAAA,CAAU,sCAAsCe,WAAAA,EAAa;wBAClFa,OAAAA,EAAS;4BAAE,YAAA,EAAc;AAAQ;AACzC,qBAAA,CAAA;oBACM,OAAO;AACLX,wBAAAA,QAAAA,EAAUD,KAAKM,IAAI;AACnBjB,wBAAAA,KAAAA,EAAO,CAAA,EAAGW,IAAAA,CAAKM,IAAI,CAAC,UAAU;AACtC,qBAAA;AACA,gBAAA;AACA,aAAA;YAEEqD,KAAAA,EAAO;gBACLrE,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,EAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRuD,SAAAA,EAAW,cAAA;oBACXC,QAAAA,EAAU,CAAA,EAAG/D,OAAAA,CAAQ,eAAe,CAAC;oBACrCS,KAAAA,EAAO;AAAC,wBAAA,QAAA;AAAU,wBAAA,OAAA;AAAS,wBAAA;AAAU;AAC3C,iBAAA;AACI,gBAAA,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAEwB,SAAS,EAAE,EAAA;AAC3C,oBAAA,MAAM,EAAEvB,IAAI,EAAE,GAAG,MAAMhB,UACrB,CAAC,QAAQ,EAAEuC,SAAAA,CAAUoC,KAAK,CAACT,SAAS,CAAC,mBAAmB,CAAC,EACzDnD,WAAAA,CAAAA;AAEF,oBAAA,MAAME,WAAWD,IAAAA,CAAKC,QAAQ,IAAID,IAAAA,CAAK4D,QAAQ,IAAI5D,IAAAA,CAAKM,IAAI,IAAIN,KAAKX,KAAK,CAACoB,KAAK,CAAC,GAAA,CAAI,CAAC,CAAA,CAAE;oBACxF,MAAMpB,KAAAA,GAAQW,IAAAA,CAAKX,KAAK,IAAI,CAAA,EAAGY,QAAAA,CAAS4D,OAAO,CAAC,MAAA,EAAQ,GAAA,CAAA,CAAK,UAAU,CAAC;oBAExE,OAAO;AACL5D,wBAAAA,QAAAA;AACAZ,wBAAAA;AACR,qBAAA;AACA,gBAAA;AACA,aAAA;YAEEyE,GAAAA,EAAK;gBACHxE,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,MAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRwD,QAAAA,EAAU,CAAA,EAAG/D,OAAAA,CAAQ,aAAa,CAAC;oBACnCS,KAAAA,EAAO;AAAC,wBAAA;AAAe,qBAAA;oBACvBqD,SAAAA,EAAW;AACjB,iBAAA;AACI,gBAAA,MAAMpD,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAEwB,SAAS,EAAE,EAAA;AAC3C,oBAAA,MAAM,EAAEvB,IAAI,EAAE,GAAG,MAAMhB,UACrB,CAAC,QAAQ,EAAEuC,SAAAA,CAAUuC,GAAG,CAACZ,SAAS,CAAC,aAAa,CAAC,EACjDnD,WAAAA,CAAAA;oBAEF,MAAME,QAAAA,GAAWD,KAAK+D,UAAA,GAClB/D,KAAK+D,UAAU,CAACC,cAAc,IAAIhE,IAAAA,CAAKiE,EAAE,IAAIjE,IAAAA,CAAKkE,GAAA,GAClDlE,IAAAA,CAAKgE,cAAc,IAAIhE,IAAAA,CAAKiE,EAAE,IAAIjE,IAAAA,CAAKkE,GAAG;AAC9C,oBAAA,MAAM7E,QAAQW,IAAAA,CAAK+D,UAAA,GACf/D,IAAAA,CAAK+D,UAAU,CAACI,WAAW,IAAInE,IAAAA,CAAK+D,UAAU,CAAC1E,KAAA,GAC/CW,KAAKmE,WAAW,IAAInE,KAAKX,KAAK;oBAClC,IAAI,CAACY,QAAAA,IAAY,CAACZ,KAAAA,EAAO;wBACvB+E,MAAAA,CAAOC,GAAG,CAACC,IAAI,CACb,CAAC,uDAAuD,EAAEC,IAAAA,CAAKC,SAAS,CAACxE,IAAAA,CAAAA,CAAAA,CAAM,CAAA;AAEzF,oBAAA;oBACM,OAAO;AACLC,wBAAAA,QAAAA;AACAZ,wBAAAA;AACR,qBAAA;AACA,gBAAA;AACA,aAAA;YAEEoF,OAAAA,EAAS;gBACPnF,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,EAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRwD,QAAAA,EAAU,CAAA,EAAG/D,OAAAA,CAAQ,iBAAiB,CAAC;oBACvCS,KAAAA,EAAO;AAAC,wBAAA,UAAA;AAAY,wBAAA;AAAkB;AAC5C,iBAAA;gBACI,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE,EAAA;AAChC,oBAAA,MAAM,EAAEC,IAAI,EAAE,GAAG,MAAMhB,UACrB,6EAAA,EACAe,WAAAA,CAAAA;AAEF,oBAAA,MAAM2E,WAAAA,GAAc1E,IAAAA,CAAK2C,IAAI,CAACoB,UAAU;oBACxC,OAAO;AACL9D,wBAAAA,QAAAA,EAAUyE,YAAYC,SAAS;AAC/BtF,wBAAAA,KAAAA,EAAOqF,YAAYrF;AAC3B,qBAAA;AACA,gBAAA;AACA,aAAA;YACEuF,QAAAA,EAAU;gBACRtF,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,EAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRuD,SAAAA,EAAW,uCAAA;oBACXC,QAAAA,EAAU,CAAA,EAAG/D,OAAAA,CAAQ,kBAAkB,CAAC;oBACxCS,KAAAA,EAAO;AAAC,wBAAA,QAAA;AAAU,wBAAA,OAAA;AAAS,wBAAA;AAAU;AAC3C,iBAAA;AACI,gBAAA,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAEwB,SAAS,EAAE,EAAA;AAC3C,oBAAA,MAAM,EAAEvB,IAAI,EAAE,GAAG,MAAMhB,UACrB,CAAC,QAAQ,EAAEuC,SAAAA,CAAUqD,QAAQ,CAAC1B,SAAS,CAAC,iCAAiC,CAAC,EAC1EnD,WAAAA,CAAAA;oBAEF,OAAO;AACLE,wBAAAA,QAAAA,EAAUD,KAAK6E,kBAAkB;AACjCxF,wBAAAA,KAAAA,EAAOW,KAAKX;AACpB,qBAAA;AACA,gBAAA;AACA;SACA,CAAA;IAEAyF,iBAAAA,GAAiB,IAAA;AACf,QAAA,MAAMC,SAAAA,GAAYX,MAAAA,CAAOY,MAAM,CAACC,GAAG,CAAC,iBAAA,CAAA;QACpC,MAAM7F,OAAAA,GAAUR,QAAQwF,MAAAA,CAAOY,MAAM,CAACE,MAAM,CAACxD,GAAG,EAAEqD,SAAAA,EAAW,MAAA,CAAA;AAE7D,QAAA,MAAMI,gBAAgBhG,aAAAA,CAAc;AAAEC,YAAAA;;QAEtC,OAAO;AACLgG,YAAAA,MAAAA,CAAAA,GAAAA;gBACE,OAAOD,aAAAA;AACb,YAAA,CAAA;AACIF,YAAAA,GAAAA,CAAAA,CAAI3E,IAAI,EAAA;gBACN,OAAO6E,aAAa,CAAC7E,IAAAA,CAAK;AAChC,YAAA,CAAA;YACI+E,GAAAA,CAAAA,CAAI/E,IAAI,EAAE0E,MAAM,EAAA;gBACdG,aAAa,CAAC7E,KAAK,GAAG0E,MAAAA;AAC5B,YAAA,CAAA;AACIM,YAAAA,MAAAA,CAAAA,CAAOhF,IAAI,EAAA;gBACT,OAAO6E,aAAa,CAAC7E,IAAAA,CAAK;AAChC,YAAA,CAAA;YAEI,MAAMiF,GAAAA,CAAAA,CAAI,EAAEC,QAAQ,EAAEzF,WAAW,EAAEuB,KAAK,EAAEC,SAAS,EAAE,EAAA;gBACnD,MAAMkE,YAAAA,GAAeN,aAAa,CAACK,QAAAA,CAAS;AAE5C9G,gBAAAA,MAAAA,CAAO+G,YAAAA,EAAc,uBAAA,CAAA;gBAErB,OAAOA,YAAAA,CAAa3F,YAAY,CAAC;AAAEC,oBAAAA,WAAAA;AAAauB,oBAAAA,KAAAA;AAAOC,oBAAAA;AAAS,iBAAA,CAAA;AACtE,YAAA;AACA,SAAA;AACA,IAAA,CAAA;;;;;;"}
+{"version":3,"file":"providers-registry.mjs","sources":["../../../server/src/services/providers-registry.js"],"sourcesContent":["'use strict';\n\nconst { strict: assert } = require('assert');\nconst urljoin = require('url-join');\n\nconst { verifyJwtWithJwks } = require('../utils/verify-jwt-with-jwks');\nconst { bearerGet, fetchJson } = require('../utils/provider-http');\n\nconst initProviders = ({ baseURL }) => ({\n  email: {\n    enabled: true,\n    icon: 'envelope',\n    grantConfig: {},\n  },\n  discord: {\n    enabled: false,\n    icon: 'discord',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/discord/callback`,\n      scope: ['identify', 'email'],\n    },\n    async authCallback({ accessToken }) {\n      const { body } = await bearerGet('https://discord.com/api/users/@me', accessToken);\n      if (body.verified !== true) {\n        throw new Error('Email not verified by Discord');\n      }\n      const username =\n        body.discriminator && body.discriminator !== '0'\n          ? `${body.username}#${body.discriminator}`\n          : body.username;\n      return {\n        username,\n        email: body.email,\n      };\n    },\n  },\n  facebook: {\n    enabled: false,\n    icon: 'facebook-square',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/facebook/callback`,\n      scope: ['email'],\n    },\n    async authCallback({ accessToken }) {\n      const { body } = await bearerGet('https://graph.facebook.com/me', accessToken, {\n        qs: { fields: 'name,email' },\n      });\n      if (!body.email) {\n        throw new Error('Email not verified by Facebook');\n      }\n      return {\n        username: body.name,\n        email: body.email,\n      };\n    },\n  },\n  google: {\n    enabled: false,\n    icon: 'google',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/google/callback`,\n      scope: ['email'],\n    },\n    async authCallback({ accessToken }) {\n      const { body } = await fetchJson(\n        `https://oauth2.googleapis.com/tokeninfo?access_token=${encodeURIComponent(accessToken)}`\n      );\n      const verified = body.verified_email ?? body.email_verified;\n      if (verified !== true && verified !== 'true') {\n        throw new Error('Email not verified by Google');\n      }\n      return {\n        username: body.email.split('@')[0],\n        email: body.email,\n      };\n    },\n  },\n  github: {\n    enabled: false,\n    icon: 'github',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/github/callback`,\n      scope: ['user', 'user:email'],\n    },\n    async authCallback({ accessToken }) {\n      const { body: userBody } = await bearerGet('https://api.github.com/user', accessToken, {\n        headers: { 'user-agent': 'strapi' },\n      });\n\n      const { body: emailBody } = await bearerGet(\n        'https://api.github.com/user/emails',\n        accessToken,\n        {\n          headers: { 'user-agent': 'strapi' },\n        }\n      );\n\n      if (userBody.email) {\n        const verifiedPublicEmail = Array.isArray(emailBody)\n          ? emailBody.find((entry) => entry.email === userBody.email && entry.verified === true)\n          : null;\n\n        if (!verifiedPublicEmail) {\n          throw new Error('Email not verified by GitHub');\n        }\n\n        return {\n          username: userBody.login,\n          email: userBody.email,\n        };\n      }\n\n      const primaryEmail = Array.isArray(emailBody)\n        ? emailBody.find((email) => email.primary === true)\n        : null;\n\n      if (!primaryEmail || primaryEmail.verified !== true) {\n        throw new Error('Email not verified by GitHub');\n      }\n\n      return {\n        username: userBody.login,\n        email: primaryEmail.email,\n      };\n    },\n  },\n  microsoft: {\n    enabled: false,\n    icon: 'windows',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/microsoft/callback`,\n      scope: ['user.read'],\n    },\n    async authCallback({ accessToken }) {\n      const { body } = await bearerGet('https://graph.microsoft.com/v1.0/me', accessToken);\n      return {\n        username: body.userPrincipalName,\n        email: body.userPrincipalName,\n      };\n    },\n  },\n\n  twitter: {\n    enabled: false,\n    icon: 'twitter',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/twitter/callback`,\n    },\n    async authCallback({ accessToken, providers, grantResponse }) {\n      const accessSecret = grantResponse?.access_secret;\n      const screenName = grantResponse?.raw?.screen_name;\n\n      if (!accessSecret) {\n        throw new Error('Twitter authentication requires a completed OAuth session');\n      }\n\n      const { twitterGet } = require('../utils/oauth-connect/oauth1');\n      const { body } = await twitterGet({\n        url: 'https://api.twitter.com/1.1/account/verify_credentials.json',\n        accessToken,\n        accessCredential: accessSecret,\n        consumerKey: providers.twitter.key,\n        clientCredential: providers.twitter.secret,\n        qs: { include_email: 'true', screen_name: screenName },\n      });\n\n      if (!body.email) {\n        throw new Error('Email not verified by Twitter');\n      }\n\n      return {\n        username: body.screen_name,\n        email: body.email,\n      };\n    },\n  },\n  instagram: {\n    enabled: false,\n    icon: 'instagram',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/instagram/callback`,\n      scope: ['user_profile'],\n    },\n    async authCallback({ accessToken }) {\n      const { body } = await bearerGet('https://graph.instagram.com/me', accessToken, {\n        qs: { fields: 'id,username' },\n      });\n      return {\n        username: body.username,\n        email: `${body.username}@strapi.io`,\n      };\n    },\n  },\n  vk: {\n    enabled: false,\n    icon: 'vk',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/vk/callback`,\n      scope: ['email'],\n    },\n    async authCallback({ accessToken, grantResponse }) {\n      const email = grantResponse?.raw?.email;\n      const userId = grantResponse?.raw?.user_id;\n\n      if (!email || !userId) {\n        throw new Error('VK authentication requires a completed OAuth session');\n      }\n\n      const { body } = await bearerGet('https://api.vk.com/method/users.get', accessToken, {\n        qs: { user_ids: userId, v: '5.122' },\n      });\n\n      if (!body.response?.[0]) {\n        throw new Error('Invalid VK access token');\n      }\n\n      return {\n        username: `${body.response[0].last_name} ${body.response[0].first_name}`,\n        email,\n      };\n    },\n  },\n\n  twitch: {\n    enabled: false,\n    icon: 'twitch',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/twitch/callback`,\n      scope: ['user:read:email'],\n    },\n    async authCallback({ accessToken, providers }) {\n      const { body } = await bearerGet('https://api.twitch.tv/helix/users', accessToken, {\n        headers: {\n          'Client-Id': providers.twitch.key,\n        },\n      });\n      const email = body.data?.[0]?.email;\n      if (!email) {\n        throw new Error('Email not verified by Twitch');\n      }\n      return {\n        username: body.data[0].login,\n        email,\n      };\n    },\n  },\n\n  linkedin: {\n    enabled: false,\n    icon: 'linkedin',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/linkedin/callback`,\n      scope: ['r_liteprofile', 'r_emailaddress'],\n    },\n    async authCallback({ accessToken }) {\n      const { body: profileBody } = await bearerGet('https://api.linkedin.com/v2/me', accessToken);\n      const { body: emailBody } = await bearerGet(\n        'https://api.linkedin.com/v2/emailAddress?q=members&projection=(elements*(handle~))',\n        accessToken\n      );\n\n      const email = emailBody.elements[0]?.['handle~'];\n\n      if (!email?.emailAddress) {\n        throw new Error('Email not verified by LinkedIn');\n      }\n\n      return {\n        username: profileBody.localizedFirstName,\n        email: email.emailAddress,\n      };\n    },\n  },\n\n  cognito: {\n    enabled: false,\n    icon: 'aws',\n    grantConfig: {\n      key: '',\n      secret: '',\n      subdomain: 'my.subdomain.com',\n      callback: `${baseURL}/cognito/callback`,\n      scope: ['email', 'openid', 'profile'],\n    },\n    async authCallback({ providers, grantResponse }) {\n      const jwksUrl = new URL(providers.cognito.jwksurl);\n      const idToken = grantResponse?.id_token;\n\n      if (!idToken) {\n        throw new Error('Cognito authentication requires a completed OAuth session');\n      }\n\n      const tokenPayload = await verifyJwtWithJwks({ idToken, jwksUrl });\n      if (tokenPayload.email_verified !== true) {\n        throw new Error('Email not verified by Cognito');\n      }\n      return {\n        username: tokenPayload['cognito:username'],\n        email: tokenPayload.email,\n      };\n    },\n  },\n\n  reddit: {\n    enabled: false,\n    icon: 'reddit',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callback: `${baseURL}/reddit/callback`,\n      scope: ['identity'],\n    },\n    async authCallback({ accessToken }) {\n      const { body } = await bearerGet('https://oauth.reddit.com/api/v1/me', accessToken, {\n        headers: { 'user-agent': 'strapi' },\n      });\n      return {\n        username: body.name,\n        email: `${body.name}@strapi.io`,\n      };\n    },\n  },\n\n  auth0: {\n    enabled: false,\n    icon: '',\n    grantConfig: {\n      key: '',\n      secret: '',\n      subdomain: 'my-tenant.eu',\n      callback: `${baseURL}/auth0/callback`,\n      scope: ['openid', 'email', 'profile'],\n    },\n    async authCallback({ accessToken, providers }) {\n      const { body } = await bearerGet(\n        `https://${providers.auth0.subdomain}.auth0.com/userinfo`,\n        accessToken\n      );\n      if (body.email && body.email_verified !== true) {\n        throw new Error('Email not verified by Auth0');\n      }\n      const username = body.username || body.nickname || body.name || body.email.split('@')[0];\n      const email = body.email || `${username.replace(/\\s+/g, '.')}@strapi.io`;\n\n      return {\n        username,\n        email,\n      };\n    },\n  },\n\n  cas: {\n    enabled: false,\n    icon: 'book',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callback: `${baseURL}/cas/callback`,\n      scope: ['openid email'],\n      subdomain: 'my.subdomain.com/cas',\n    },\n    async authCallback({ accessToken, providers }) {\n      const { body } = await bearerGet(\n        `https://${providers.cas.subdomain}/oidc/profile`,\n        accessToken\n      );\n      const username = body.attributes\n        ? body.attributes.strapiusername || body.id || body.sub\n        : body.strapiusername || body.id || body.sub;\n      const email = body.attributes\n        ? body.attributes.strapiemail || body.attributes.email\n        : body.strapiemail || body.email;\n      const emailVerified = body.email_verified ?? body.attributes?.email_verified;\n      if (!username || !email) {\n        strapi.log.warn(\n          `CAS Response Body did not contain required attributes: ${JSON.stringify(body)}`\n        );\n      }\n      if (email && emailVerified !== true) {\n        throw new Error('Email not verified by CAS');\n      }\n      return {\n        username,\n        email,\n      };\n    },\n  },\n\n  patreon: {\n    enabled: false,\n    icon: '',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callback: `${baseURL}/patreon/callback`,\n      scope: ['identity', 'identity[email]'],\n    },\n    async authCallback({ accessToken }) {\n      const { body } = await bearerGet(\n        'https://www.patreon.com/api/oauth2/v2/identity?fields[user]=full_name,email,is_email_verified',\n        accessToken\n      );\n      const patreonData = body.data.attributes;\n      if (patreonData.is_email_verified !== true) {\n        throw new Error('Email not verified by Patreon');\n      }\n      return {\n        username: patreonData.full_name,\n        email: patreonData.email,\n      };\n    },\n  },\n  keycloak: {\n    enabled: false,\n    icon: '',\n    grantConfig: {\n      key: '',\n      secret: '',\n      subdomain: 'myKeycloakProvider.com/realms/myrealm',\n      callback: `${baseURL}/keycloak/callback`,\n      scope: ['openid', 'email', 'profile'],\n    },\n    async authCallback({ accessToken, providers }) {\n      const { body } = await bearerGet(\n        `https://${providers.keycloak.subdomain}/protocol/openid-connect/userinfo`,\n        accessToken\n      );\n      if (body.email_verified !== true) {\n        throw new Error('Email not verified by Keycloak');\n      }\n      return {\n        username: body.preferred_username,\n        email: body.email,\n      };\n    },\n  },\n});\n\nmodule.exports = () => {\n  const apiPrefix = strapi.config.get('api.rest.prefix');\n  const baseURL = urljoin(strapi.config.server.url, apiPrefix, 'auth');\n\n  const authProviders = initProviders({ baseURL });\n\n  return {\n    getAll() {\n      return authProviders;\n    },\n    get(name) {\n      return authProviders[name];\n    },\n    add(name, config) {\n      authProviders[name] = config;\n    },\n    remove(name) {\n      delete authProviders[name];\n    },\n\n    async run({ provider, accessToken, query, providers, grantResponse }) {\n      const authProvider = authProviders[provider];\n\n      assert(authProvider, 'Unknown auth provider');\n\n      return authProvider.authCallback({ accessToken, query, providers, grantResponse });\n    },\n  };\n};\n"],"names":["strict","assert","require$$0","urljoin","require$$1","verifyJwtWithJwks","require$$2","bearerGet","fetchJson","require$$3","initProviders","baseURL","email","enabled","icon","grantConfig","discord","key","secret","callbackUrl","scope","authCallback","accessToken","body","verified","Error","username","discriminator","facebook","qs","fields","name","google","encodeURIComponent","verified_email","email_verified","split","github","userBody","headers","emailBody","verifiedPublicEmail","Array","isArray","find","entry","login","primaryEmail","primary","microsoft","userPrincipalName","twitter","providers","grantResponse","accessSecret","access_secret","screenName","raw","screen_name","twitterGet","require$$4","url","accessCredential","consumerKey","clientCredential","include_email","instagram","vk","userId","user_id","user_ids","v","response","last_name","first_name","twitch","data","linkedin","profileBody","elements","emailAddress","localizedFirstName","cognito","subdomain","callback","jwksUrl","URL","jwksurl","idToken","id_token","tokenPayload","reddit","auth0","nickname","replace","cas","attributes","strapiusername","id","sub","strapiemail","emailVerified","strapi","log","warn","JSON","stringify","patreon","patreonData","is_email_verified","full_name","keycloak","preferred_username","providersRegistry","apiPrefix","config","get","server","authProviders","getAll","add","remove","run","provider","query","authProvider"],"mappings":";;;;;;;;;;;AAEA,IAAA,MAAM,EAAEA,MAAAA,EAAQC,MAAM,EAAE,GAAGC,UAAAA;AAC3B,IAAA,MAAMC,OAAAA,GAAUC,UAAAA;IAEhB,MAAM,EAAEC,iBAAiB,EAAE,GAAGC,wBAAAA,EAAAA;AAC9B,IAAA,MAAM,EAAEC,SAAS,EAAEC,SAAS,EAAE,GAAGC,mBAAAA,EAAAA;AAEjC,IAAA,MAAMC,gBAAgB,CAAC,EAAEC,OAAO,EAAE,IAAM;YACtCC,KAAAA,EAAO;gBACLC,OAAAA,EAAS,IAAA;gBACTC,IAAAA,EAAM,UAAA;AACNC,gBAAAA,WAAAA,EAAa;AACjB,aAAA;YACEC,OAAAA,EAAS;gBACPH,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,SAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGR,OAAAA,CAAQ,iBAAiB,CAAC;oBAC1CS,KAAAA,EAAO;AAAC,wBAAA,UAAA;AAAY,wBAAA;AAAQ;AAClC,iBAAA;gBACI,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE,EAAA;AAChC,oBAAA,MAAM,EAAEC,IAAI,EAAE,GAAG,MAAMhB,UAAU,mCAAA,EAAqCe,WAAAA,CAAAA;oBACtE,IAAIC,IAAAA,CAAKC,QAAQ,KAAK,IAAA,EAAM;AAC1B,wBAAA,MAAM,IAAIC,KAAAA,CAAM,+BAAA,CAAA;AACxB,oBAAA;AACM,oBAAA,MAAMC,WACJH,IAAAA,CAAKI,aAAa,IAAIJ,IAAAA,CAAKI,aAAa,KAAK,GAAA,GACzC,CAAA,EAAGJ,KAAKG,QAAQ,CAAC,CAAC,EAAEH,IAAAA,CAAKI,aAAa,CAAA,CAAC,GACvCJ,KAAKG,QAAQ;oBACnB,OAAO;AACLA,wBAAAA,QAAAA;AACAd,wBAAAA,KAAAA,EAAOW,KAAKX;AACpB,qBAAA;AACA,gBAAA;AACA,aAAA;YACEgB,QAAAA,EAAU;gBACRf,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,iBAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGR,OAAAA,CAAQ,kBAAkB,CAAC;oBAC3CS,KAAAA,EAAO;AAAC,wBAAA;AAAQ;AACtB,iBAAA;gBACI,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE,EAAA;AAChC,oBAAA,MAAM,EAAEC,IAAI,EAAE,GAAG,MAAMhB,SAAAA,CAAU,iCAAiCe,WAAAA,EAAa;wBAC7EO,EAAAA,EAAI;4BAAEC,MAAAA,EAAQ;AAAY;AAClC,qBAAA,CAAA;oBACM,IAAI,CAACP,IAAAA,CAAKX,KAAK,EAAE;AACf,wBAAA,MAAM,IAAIa,KAAAA,CAAM,gCAAA,CAAA;AACxB,oBAAA;oBACM,OAAO;AACLC,wBAAAA,QAAAA,EAAUH,KAAKQ,IAAI;AACnBnB,wBAAAA,KAAAA,EAAOW,KAAKX;AACpB,qBAAA;AACA,gBAAA;AACA,aAAA;YACEoB,MAAAA,EAAQ;gBACNnB,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,QAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGR,OAAAA,CAAQ,gBAAgB,CAAC;oBACzCS,KAAAA,EAAO;AAAC,wBAAA;AAAQ;AACtB,iBAAA;gBACI,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE,EAAA;oBAChC,MAAM,EAAEC,IAAI,EAAE,GAAG,MAAMf,UACrB,CAAC,qDAAqD,EAAEyB,kBAAAA,CAAmBX,WAAAA,CAAAA,CAAAA,CAAa,CAAA;AAE1F,oBAAA,MAAME,QAAAA,GAAWD,IAAAA,CAAKW,cAAc,IAAIX,KAAKY,cAAc;oBAC3D,IAAIX,QAAAA,KAAa,IAAA,IAAQA,QAAAA,KAAa,MAAA,EAAQ;AAC5C,wBAAA,MAAM,IAAIC,KAAAA,CAAM,8BAAA,CAAA;AACxB,oBAAA;oBACM,OAAO;AACLC,wBAAAA,QAAAA,EAAUH,KAAKX,KAAK,CAACwB,KAAK,CAAC,GAAA,CAAI,CAAC,CAAA,CAAE;AAClCxB,wBAAAA,KAAAA,EAAOW,KAAKX;AACpB,qBAAA;AACA,gBAAA;AACA,aAAA;YACEyB,MAAAA,EAAQ;gBACNxB,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,QAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGR,OAAAA,CAAQ,gBAAgB,CAAC;oBACzCS,KAAAA,EAAO;AAAC,wBAAA,MAAA;AAAQ,wBAAA;AAAa;AACnC,iBAAA;gBACI,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE,EAAA;oBAChC,MAAM,EAAEC,MAAMe,QAAQ,EAAE,GAAG,MAAM/B,SAAAA,CAAU,+BAA+Be,WAAAA,EAAa;wBACrFiB,OAAAA,EAAS;4BAAE,YAAA,EAAc;AAAQ;AACzC,qBAAA,CAAA;oBAEM,MAAM,EAAEhB,MAAMiB,SAAS,EAAE,GAAG,MAAMjC,SAAAA,CAChC,sCACAe,WAAAA,EACA;wBACEiB,OAAAA,EAAS;4BAAE,YAAA,EAAc;AAAQ;AAC3C,qBAAA,CAAA;oBAGM,IAAID,QAAAA,CAAS1B,KAAK,EAAE;AAClB,wBAAA,MAAM6B,sBAAsBC,KAAAA,CAAMC,OAAO,CAACH,SAAAA,CAAAA,GACtCA,SAAAA,CAAUI,IAAI,CAAC,CAACC,QAAUA,KAAAA,CAAMjC,KAAK,KAAK0B,QAAAA,CAAS1B,KAAK,IAAIiC,KAAAA,CAAMrB,QAAQ,KAAK,IAAA,CAAA,GAC/E,IAAA;AAEJ,wBAAA,IAAI,CAACiB,mBAAAA,EAAqB;AACxB,4BAAA,MAAM,IAAIhB,KAAAA,CAAM,8BAAA,CAAA;AAC1B,wBAAA;wBAEQ,OAAO;AACLC,4BAAAA,QAAAA,EAAUY,SAASQ,KAAK;AACxBlC,4BAAAA,KAAAA,EAAO0B,SAAS1B;AAC1B,yBAAA;AACA,oBAAA;AAEM,oBAAA,MAAMmC,YAAAA,GAAeL,KAAAA,CAAMC,OAAO,CAACH,SAAAA,CAAAA,GAC/BA,SAAAA,CAAUI,IAAI,CAAC,CAAChC,KAAAA,GAAUA,KAAAA,CAAMoC,OAAO,KAAK,IAAA,CAAA,GAC5C,IAAA;AAEJ,oBAAA,IAAI,CAACD,YAAAA,IAAgBA,YAAAA,CAAavB,QAAQ,KAAK,IAAA,EAAM;AACnD,wBAAA,MAAM,IAAIC,KAAAA,CAAM,8BAAA,CAAA;AACxB,oBAAA;oBAEM,OAAO;AACLC,wBAAAA,QAAAA,EAAUY,SAASQ,KAAK;AACxBlC,wBAAAA,KAAAA,EAAOmC,aAAanC;AAC5B,qBAAA;AACA,gBAAA;AACA,aAAA;YACEqC,SAAAA,EAAW;gBACTpC,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,SAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGR,OAAAA,CAAQ,mBAAmB,CAAC;oBAC5CS,KAAAA,EAAO;AAAC,wBAAA;AAAY;AAC1B,iBAAA;gBACI,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE,EAAA;AAChC,oBAAA,MAAM,EAAEC,IAAI,EAAE,GAAG,MAAMhB,UAAU,qCAAA,EAAuCe,WAAAA,CAAAA;oBACxE,OAAO;AACLI,wBAAAA,QAAAA,EAAUH,KAAK2B,iBAAiB;AAChCtC,wBAAAA,KAAAA,EAAOW,KAAK2B;AACpB,qBAAA;AACA,gBAAA;AACA,aAAA;YAEEC,OAAAA,EAAS;gBACPtC,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,SAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGR,OAAAA,CAAQ,iBAAiB;AAC/C,iBAAA;AACI,gBAAA,MAAMU,cAAa,EAAEC,WAAW,EAAE8B,SAAS,EAAEC,aAAa,EAAE,EAAA;AAC1D,oBAAA,MAAMC,eAAeD,aAAAA,EAAeE,aAAAA;oBACpC,MAAMC,UAAAA,GAAaH,eAAeI,GAAAA,EAAKC,WAAAA;AAEvC,oBAAA,IAAI,CAACJ,YAAAA,EAAc;AACjB,wBAAA,MAAM,IAAI7B,KAAAA,CAAM,2DAAA,CAAA;AACxB,oBAAA;oBAEM,MAAM,EAAEkC,UAAU,EAAE,GAAGC,aAAAA,EAAAA;AACvB,oBAAA,MAAM,EAAErC,IAAI,EAAE,GAAG,MAAMoC,UAAAA,CAAW;wBAChCE,GAAAA,EAAK,6DAAA;AACLvC,wBAAAA,WAAAA;wBACAwC,gBAAAA,EAAkBR,YAAAA;wBAClBS,WAAAA,EAAaX,SAAAA,CAAUD,OAAO,CAAClC,GAAG;wBAClC+C,gBAAAA,EAAkBZ,SAAAA,CAAUD,OAAO,CAACjC,MAAM;wBAC1CW,EAAAA,EAAI;4BAAEoC,aAAAA,EAAe,MAAA;4BAAQP,WAAAA,EAAaF;AAAU;AAC5D,qBAAA,CAAA;oBAEM,IAAI,CAACjC,IAAAA,CAAKX,KAAK,EAAE;AACf,wBAAA,MAAM,IAAIa,KAAAA,CAAM,+BAAA,CAAA;AACxB,oBAAA;oBAEM,OAAO;AACLC,wBAAAA,QAAAA,EAAUH,KAAKmC,WAAW;AAC1B9C,wBAAAA,KAAAA,EAAOW,KAAKX;AACpB,qBAAA;AACA,gBAAA;AACA,aAAA;YACEsD,SAAAA,EAAW;gBACTrD,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,WAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGR,OAAAA,CAAQ,mBAAmB,CAAC;oBAC5CS,KAAAA,EAAO;AAAC,wBAAA;AAAe;AAC7B,iBAAA;gBACI,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE,EAAA;AAChC,oBAAA,MAAM,EAAEC,IAAI,EAAE,GAAG,MAAMhB,SAAAA,CAAU,kCAAkCe,WAAAA,EAAa;wBAC9EO,EAAAA,EAAI;4BAAEC,MAAAA,EAAQ;AAAa;AACnC,qBAAA,CAAA;oBACM,OAAO;AACLJ,wBAAAA,QAAAA,EAAUH,KAAKG,QAAQ;AACvBd,wBAAAA,KAAAA,EAAO,CAAA,EAAGW,IAAAA,CAAKG,QAAQ,CAAC,UAAU;AAC1C,qBAAA;AACA,gBAAA;AACA,aAAA;YACEyC,EAAAA,EAAI;gBACFtD,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,IAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGR,OAAAA,CAAQ,YAAY,CAAC;oBACrCS,KAAAA,EAAO;AAAC,wBAAA;AAAQ;AACtB,iBAAA;AACI,gBAAA,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE+B,aAAa,EAAE,EAAA;oBAC/C,MAAMzC,KAAAA,GAAQyC,eAAeI,GAAAA,EAAK7C,KAAAA;oBAClC,MAAMwD,MAAAA,GAASf,eAAeI,GAAAA,EAAKY,OAAAA;oBAEnC,IAAI,CAACzD,KAAAA,IAAS,CAACwD,MAAAA,EAAQ;AACrB,wBAAA,MAAM,IAAI3C,KAAAA,CAAM,sDAAA,CAAA;AACxB,oBAAA;AAEM,oBAAA,MAAM,EAAEF,IAAI,EAAE,GAAG,MAAMhB,SAAAA,CAAU,uCAAuCe,WAAAA,EAAa;wBACnFO,EAAAA,EAAI;4BAAEyC,QAAAA,EAAUF,MAAAA;4BAAQG,CAAAA,EAAG;AAAO;AAC1C,qBAAA,CAAA;AAEM,oBAAA,IAAI,CAAChD,IAAAA,CAAKiD,QAAQ,GAAG,EAAE,EAAE;AACvB,wBAAA,MAAM,IAAI/C,KAAAA,CAAM,yBAAA,CAAA;AACxB,oBAAA;oBAEM,OAAO;AACLC,wBAAAA,QAAAA,EAAU,GAAGH,IAAAA,CAAKiD,QAAQ,CAAC,CAAA,CAAE,CAACC,SAAS,CAAC,CAAC,EAAElD,KAAKiD,QAAQ,CAAC,CAAA,CAAE,CAACE,UAAU,CAAA,CAAE;AACxE9D,wBAAAA;AACR,qBAAA;AACA,gBAAA;AACA,aAAA;YAEE+D,MAAAA,EAAQ;gBACN9D,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,QAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGR,OAAAA,CAAQ,gBAAgB,CAAC;oBACzCS,KAAAA,EAAO;AAAC,wBAAA;AAAkB;AAChC,iBAAA;AACI,gBAAA,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE8B,SAAS,EAAE,EAAA;AAC3C,oBAAA,MAAM,EAAE7B,IAAI,EAAE,GAAG,MAAMhB,SAAAA,CAAU,qCAAqCe,WAAAA,EAAa;wBACjFiB,OAAAA,EAAS;4BACP,WAAA,EAAaa,SAAAA,CAAUuB,MAAM,CAAC1D;AACxC;AACA,qBAAA,CAAA;AACM,oBAAA,MAAML,QAAQW,IAAAA,CAAKqD,IAAI,GAAG,EAAE,EAAEhE,KAAAA;AAC9B,oBAAA,IAAI,CAACA,KAAAA,EAAO;AACV,wBAAA,MAAM,IAAIa,KAAAA,CAAM,8BAAA,CAAA;AACxB,oBAAA;oBACM,OAAO;AACLC,wBAAAA,QAAAA,EAAUH,IAAAA,CAAKqD,IAAI,CAAC,CAAA,CAAE,CAAC9B,KAAK;AAC5BlC,wBAAAA;AACR,qBAAA;AACA,gBAAA;AACA,aAAA;YAEEiE,QAAAA,EAAU;gBACRhE,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,UAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGR,OAAAA,CAAQ,kBAAkB,CAAC;oBAC3CS,KAAAA,EAAO;AAAC,wBAAA,eAAA;AAAiB,wBAAA;AAAiB;AAChD,iBAAA;gBACI,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE,EAAA;AAChC,oBAAA,MAAM,EAAEC,IAAAA,EAAMuD,WAAW,EAAE,GAAG,MAAMvE,UAAU,gCAAA,EAAkCe,WAAAA,CAAAA;AAChF,oBAAA,MAAM,EAAEC,IAAAA,EAAMiB,SAAS,EAAE,GAAG,MAAMjC,UAChC,oFAAA,EACAe,WAAAA,CAAAA;AAGF,oBAAA,MAAMV,QAAQ4B,SAAAA,CAAUuC,QAAQ,CAAC,CAAA,CAAE,GAAG,SAAA,CAAU;oBAEhD,IAAI,CAACnE,OAAOoE,YAAAA,EAAc;AACxB,wBAAA,MAAM,IAAIvD,KAAAA,CAAM,gCAAA,CAAA;AACxB,oBAAA;oBAEM,OAAO;AACLC,wBAAAA,QAAAA,EAAUoD,YAAYG,kBAAkB;AACxCrE,wBAAAA,KAAAA,EAAOA,MAAMoE;AACrB,qBAAA;AACA,gBAAA;AACA,aAAA;YAEEE,OAAAA,EAAS;gBACPrE,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,KAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRiE,SAAAA,EAAW,kBAAA;oBACXC,QAAAA,EAAU,CAAA,EAAGzE,OAAAA,CAAQ,iBAAiB,CAAC;oBACvCS,KAAAA,EAAO;AAAC,wBAAA,OAAA;AAAS,wBAAA,QAAA;AAAU,wBAAA;AAAU;AAC3C,iBAAA;AACI,gBAAA,MAAMC,YAAAA,CAAAA,CAAa,EAAE+B,SAAS,EAAEC,aAAa,EAAE,EAAA;AAC7C,oBAAA,MAAMgC,UAAU,IAAIC,GAAAA,CAAIlC,SAAAA,CAAU8B,OAAO,CAACK,OAAO,CAAA;AACjD,oBAAA,MAAMC,UAAUnC,aAAAA,EAAeoC,QAAAA;AAE/B,oBAAA,IAAI,CAACD,OAAAA,EAAS;AACZ,wBAAA,MAAM,IAAI/D,KAAAA,CAAM,2DAAA,CAAA;AACxB,oBAAA;oBAEM,MAAMiE,YAAAA,GAAe,MAAMrF,iBAAAA,CAAkB;AAAEmF,wBAAAA,OAAAA;AAASH,wBAAAA;AAAO,qBAAA,CAAA;oBAC/D,IAAIK,YAAAA,CAAavD,cAAc,KAAK,IAAA,EAAM;AACxC,wBAAA,MAAM,IAAIV,KAAAA,CAAM,+BAAA,CAAA;AACxB,oBAAA;oBACM,OAAO;wBACLC,QAAAA,EAAUgE,YAAY,CAAC,kBAAA,CAAmB;AAC1C9E,wBAAAA,KAAAA,EAAO8E,aAAa9E;AAC5B,qBAAA;AACA,gBAAA;AACA,aAAA;YAEE+E,MAAAA,EAAQ;gBACN9E,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,QAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRkE,QAAAA,EAAU,CAAA,EAAGzE,OAAAA,CAAQ,gBAAgB,CAAC;oBACtCS,KAAAA,EAAO;AAAC,wBAAA;AAAW;AACzB,iBAAA;gBACI,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE,EAAA;AAChC,oBAAA,MAAM,EAAEC,IAAI,EAAE,GAAG,MAAMhB,SAAAA,CAAU,sCAAsCe,WAAAA,EAAa;wBAClFiB,OAAAA,EAAS;4BAAE,YAAA,EAAc;AAAQ;AACzC,qBAAA,CAAA;oBACM,OAAO;AACLb,wBAAAA,QAAAA,EAAUH,KAAKQ,IAAI;AACnBnB,wBAAAA,KAAAA,EAAO,CAAA,EAAGW,IAAAA,CAAKQ,IAAI,CAAC,UAAU;AACtC,qBAAA;AACA,gBAAA;AACA,aAAA;YAEE6D,KAAAA,EAAO;gBACL/E,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,EAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRiE,SAAAA,EAAW,cAAA;oBACXC,QAAAA,EAAU,CAAA,EAAGzE,OAAAA,CAAQ,eAAe,CAAC;oBACrCS,KAAAA,EAAO;AAAC,wBAAA,QAAA;AAAU,wBAAA,OAAA;AAAS,wBAAA;AAAU;AAC3C,iBAAA;AACI,gBAAA,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE8B,SAAS,EAAE,EAAA;AAC3C,oBAAA,MAAM,EAAE7B,IAAI,EAAE,GAAG,MAAMhB,UACrB,CAAC,QAAQ,EAAE6C,SAAAA,CAAUwC,KAAK,CAACT,SAAS,CAAC,mBAAmB,CAAC,EACzD7D,WAAAA,CAAAA;AAEF,oBAAA,IAAIC,KAAKX,KAAK,IAAIW,IAAAA,CAAKY,cAAc,KAAK,IAAA,EAAM;AAC9C,wBAAA,MAAM,IAAIV,KAAAA,CAAM,6BAAA,CAAA;AACxB,oBAAA;AACM,oBAAA,MAAMC,WAAWH,IAAAA,CAAKG,QAAQ,IAAIH,IAAAA,CAAKsE,QAAQ,IAAItE,IAAAA,CAAKQ,IAAI,IAAIR,KAAKX,KAAK,CAACwB,KAAK,CAAC,GAAA,CAAI,CAAC,CAAA,CAAE;oBACxF,MAAMxB,KAAAA,GAAQW,IAAAA,CAAKX,KAAK,IAAI,CAAA,EAAGc,QAAAA,CAASoE,OAAO,CAAC,MAAA,EAAQ,GAAA,CAAA,CAAK,UAAU,CAAC;oBAExE,OAAO;AACLpE,wBAAAA,QAAAA;AACAd,wBAAAA;AACR,qBAAA;AACA,gBAAA;AACA,aAAA;YAEEmF,GAAAA,EAAK;gBACHlF,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,MAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRkE,QAAAA,EAAU,CAAA,EAAGzE,OAAAA,CAAQ,aAAa,CAAC;oBACnCS,KAAAA,EAAO;AAAC,wBAAA;AAAe,qBAAA;oBACvB+D,SAAAA,EAAW;AACjB,iBAAA;AACI,gBAAA,MAAM9D,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE8B,SAAS,EAAE,EAAA;AAC3C,oBAAA,MAAM,EAAE7B,IAAI,EAAE,GAAG,MAAMhB,UACrB,CAAC,QAAQ,EAAE6C,SAAAA,CAAU2C,GAAG,CAACZ,SAAS,CAAC,aAAa,CAAC,EACjD7D,WAAAA,CAAAA;oBAEF,MAAMI,QAAAA,GAAWH,KAAKyE,UAAA,GAClBzE,KAAKyE,UAAU,CAACC,cAAc,IAAI1E,IAAAA,CAAK2E,EAAE,IAAI3E,IAAAA,CAAK4E,GAAA,GAClD5E,IAAAA,CAAK0E,cAAc,IAAI1E,IAAAA,CAAK2E,EAAE,IAAI3E,IAAAA,CAAK4E,GAAG;AAC9C,oBAAA,MAAMvF,QAAQW,IAAAA,CAAKyE,UAAA,GACfzE,IAAAA,CAAKyE,UAAU,CAACI,WAAW,IAAI7E,IAAAA,CAAKyE,UAAU,CAACpF,KAAA,GAC/CW,KAAK6E,WAAW,IAAI7E,KAAKX,KAAK;AAClC,oBAAA,MAAMyF,gBAAgB9E,IAAAA,CAAKY,cAAc,IAAIZ,IAAAA,CAAKyE,UAAU,EAAE7D,cAAAA;oBAC9D,IAAI,CAACT,QAAAA,IAAY,CAACd,KAAAA,EAAO;wBACvB0F,MAAAA,CAAOC,GAAG,CAACC,IAAI,CACb,CAAC,uDAAuD,EAAEC,IAAAA,CAAKC,SAAS,CAACnF,IAAAA,CAAAA,CAAAA,CAAM,CAAA;AAEzF,oBAAA;oBACM,IAAIX,KAAAA,IAASyF,kBAAkB,IAAA,EAAM;AACnC,wBAAA,MAAM,IAAI5E,KAAAA,CAAM,2BAAA,CAAA;AACxB,oBAAA;oBACM,OAAO;AACLC,wBAAAA,QAAAA;AACAd,wBAAAA;AACR,qBAAA;AACA,gBAAA;AACA,aAAA;YAEE+F,OAAAA,EAAS;gBACP9F,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,EAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRkE,QAAAA,EAAU,CAAA,EAAGzE,OAAAA,CAAQ,iBAAiB,CAAC;oBACvCS,KAAAA,EAAO;AAAC,wBAAA,UAAA;AAAY,wBAAA;AAAkB;AAC5C,iBAAA;gBACI,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE,EAAA;AAChC,oBAAA,MAAM,EAAEC,IAAI,EAAE,GAAG,MAAMhB,UACrB,+FAAA,EACAe,WAAAA,CAAAA;AAEF,oBAAA,MAAMsF,WAAAA,GAAcrF,IAAAA,CAAKqD,IAAI,CAACoB,UAAU;oBACxC,IAAIY,WAAAA,CAAYC,iBAAiB,KAAK,IAAA,EAAM;AAC1C,wBAAA,MAAM,IAAIpF,KAAAA,CAAM,+BAAA,CAAA;AACxB,oBAAA;oBACM,OAAO;AACLC,wBAAAA,QAAAA,EAAUkF,YAAYE,SAAS;AAC/BlG,wBAAAA,KAAAA,EAAOgG,YAAYhG;AAC3B,qBAAA;AACA,gBAAA;AACA,aAAA;YACEmG,QAAAA,EAAU;gBACRlG,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,EAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRiE,SAAAA,EAAW,uCAAA;oBACXC,QAAAA,EAAU,CAAA,EAAGzE,OAAAA,CAAQ,kBAAkB,CAAC;oBACxCS,KAAAA,EAAO;AAAC,wBAAA,QAAA;AAAU,wBAAA,OAAA;AAAS,wBAAA;AAAU;AAC3C,iBAAA;AACI,gBAAA,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE8B,SAAS,EAAE,EAAA;AAC3C,oBAAA,MAAM,EAAE7B,IAAI,EAAE,GAAG,MAAMhB,UACrB,CAAC,QAAQ,EAAE6C,SAAAA,CAAU2D,QAAQ,CAAC5B,SAAS,CAAC,iCAAiC,CAAC,EAC1E7D,WAAAA,CAAAA;oBAEF,IAAIC,IAAAA,CAAKY,cAAc,KAAK,IAAA,EAAM;AAChC,wBAAA,MAAM,IAAIV,KAAAA,CAAM,gCAAA,CAAA;AACxB,oBAAA;oBACM,OAAO;AACLC,wBAAAA,QAAAA,EAAUH,KAAKyF,kBAAkB;AACjCpG,wBAAAA,KAAAA,EAAOW,KAAKX;AACpB,qBAAA;AACA,gBAAA;AACA;SACA,CAAA;IAEAqG,iBAAAA,GAAiB,IAAA;AACf,QAAA,MAAMC,SAAAA,GAAYZ,MAAAA,CAAOa,MAAM,CAACC,GAAG,CAAC,iBAAA,CAAA;QACpC,MAAMzG,OAAAA,GAAUR,QAAQmG,MAAAA,CAAOa,MAAM,CAACE,MAAM,CAACxD,GAAG,EAAEqD,SAAAA,EAAW,MAAA,CAAA;AAE7D,QAAA,MAAMI,gBAAgB5G,aAAAA,CAAc;AAAEC,YAAAA;;QAEtC,OAAO;AACL4G,YAAAA,MAAAA,CAAAA,GAAAA;gBACE,OAAOD,aAAAA;AACb,YAAA,CAAA;AACIF,YAAAA,GAAAA,CAAAA,CAAIrF,IAAI,EAAA;gBACN,OAAOuF,aAAa,CAACvF,IAAAA,CAAK;AAChC,YAAA,CAAA;YACIyF,GAAAA,CAAAA,CAAIzF,IAAI,EAAEoF,MAAM,EAAA;gBACdG,aAAa,CAACvF,KAAK,GAAGoF,MAAAA;AAC5B,YAAA,CAAA;AACIM,YAAAA,MAAAA,CAAAA,CAAO1F,IAAI,EAAA;gBACT,OAAOuF,aAAa,CAACvF,IAAAA,CAAK;AAChC,YAAA,CAAA;YAEI,MAAM2F,GAAAA,CAAAA,CAAI,EAAEC,QAAQ,EAAErG,WAAW,EAAEsG,KAAK,EAAExE,SAAS,EAAEC,aAAa,EAAE,EAAA;gBAClE,MAAMwE,YAAAA,GAAeP,aAAa,CAACK,QAAAA,CAAS;AAE5C1H,gBAAAA,MAAAA,CAAO4H,YAAAA,EAAc,uBAAA,CAAA;gBAErB,OAAOA,YAAAA,CAAaxG,YAAY,CAAC;AAAEC,oBAAAA,WAAAA;AAAasG,oBAAAA,KAAAA;AAAOxE,oBAAAA,SAAAA;AAAWC,oBAAAA;;AACxE,YAAA;AACA,SAAA;AACA,IAAA,CAAA;;;;;;"}

package/dist/server/services/providers.js

@@ -25,8 +25,8 @@ function requireProviders() {
 	   * Helper to get profiles
 	   *
 	   * @param {String}   provider
-	   */ const getProfile = async (provider, query)=>{
-            const accessToken = query.access_token || query.code || query.oauth_token;
+	   */ const getProfile = async (provider, oauthData, { grantResponse } = {})=>{
+            const accessToken = oauthData.access_token || oauthData.code || oauthData.oauth_token;
             const providers = await strapi.store({
                 type: 'plugin',
                 name: 'users-permissions',
@@ -34,9 +34,10 @@ function requireProviders() {
             }).get();
             return getService('providers-registry').run({
                 provider,
-                query,
+                query: oauthData,
                 accessToken,
-                providers
+                providers,
+                grantResponse
             });
         };
         /**
@@ -47,13 +48,16 @@ function requireProviders() {
 	   * @param {String}    accessToken
 	   *
 	   * @return  {*}
-	   */ const connect = async (provider, query)=>{
-            const accessToken = query.access_token || query.code || query.oauth_token;
-            if (!accessToken) {
+	   */ const connect = async (provider, oauthData, { grantResponse } = {})=>{
+            const accessToken = oauthData.access_token || oauthData.code || oauthData.oauth_token;
+            const idToken = oauthData.id_token;
+            if (!accessToken && !idToken) {
                 throw new Error('No access_token.');
             }
             // Get the profile.
-            const profile = await getProfile(provider, query);
+            const profile = await getProfile(provider, oauthData, {
+                grantResponse
+            });
             const email = _.toLower(profile.email);
             // We need at least the mail.
             if (!email) {

package/dist/server/services/providers.js.map

@@ -1 +1 @@
-{"version":3,"file":"providers.js","sources":["../../../server/src/services/providers.js"],"sourcesContent":["'use strict';\n\n/**\n * Module dependencies\n */\n\n// Public node modules.\nconst _ = require('lodash');\nconst urlJoin = require('url-join');\n\nconst { getService, findValidUsername } = require('../utils');\n\nmodule.exports = ({ strapi }) => {\n  /**\n   * Helper to get profiles\n   *\n   * @param {String}   provider\n   */\n\n  const getProfile = async (provider, query) => {\n    const accessToken = query.access_token || query.code || query.oauth_token;\n\n    const providers = await strapi\n      .store({ type: 'plugin', name: 'users-permissions', key: 'grant' })\n      .get();\n\n    return getService('providers-registry').run({\n      provider,\n      query,\n      accessToken,\n      providers,\n    });\n  };\n\n  /**\n   * Connect thanks to a third-party provider.\n   *\n   *\n   * @param {String}    provider\n   * @param {String}    accessToken\n   *\n   * @return  {*}\n   */\n\n  const connect = async (provider, query) => {\n    const accessToken = query.access_token || query.code || query.oauth_token;\n\n    if (!accessToken) {\n      throw new Error('No access_token.');\n    }\n\n    // Get the profile.\n    const profile = await getProfile(provider, query);\n\n    const email = _.toLower(profile.email);\n\n    // We need at least the mail.\n    if (!email) {\n      throw new Error('Email was not available.');\n    }\n\n    const users = await strapi.db.query('plugin::users-permissions.user').findMany({\n      where: { email },\n    });\n\n    const advancedSettings = await strapi\n      .store({ type: 'plugin', name: 'users-permissions', key: 'advanced' })\n      .get();\n\n    const user = _.find(users, { provider });\n\n    if (_.isEmpty(user) && !advancedSettings.allow_register) {\n      throw new Error('Register action is actually not available.');\n    }\n\n    if (!_.isEmpty(user)) {\n      return user;\n    }\n\n    if (users.length && advancedSettings.unique_email) {\n      throw new Error('Email is already taken.');\n    }\n\n    // Retrieve default role.\n    const defaultRole = await strapi.db\n      .query('plugin::users-permissions.role')\n      .findOne({ where: { type: advancedSettings.default_role } });\n\n    // Username: prefer profile, else email prefix; findValidUsername ensures valid + unique\n    const base = (profile.username && profile.username.trim()) || email.split('@')[0];\n    const username = await findValidUsername(base);\n\n    // Create the new user.\n    const newUser = {\n      ...profile,\n      username, // use the generated or provided username\n      email, // overwrite with lowercased email\n      provider,\n      role: defaultRole.id,\n      confirmed: true,\n    };\n\n    const createdUser = await strapi.db\n      .query('plugin::users-permissions.user')\n      .create({ data: newUser });\n\n    return createdUser;\n  };\n\n  const buildRedirectUri = (provider = '') => {\n    const apiPrefix = strapi.config.get('api.rest.prefix');\n    return urlJoin(\n      strapi.config.get('server.absoluteUrl'),\n      apiPrefix,\n      'connect',\n      provider,\n      'callback'\n    );\n  };\n\n  return {\n    connect,\n    buildRedirectUri,\n  };\n};\n"],"names":["_","require$$0","urlJoin","require$$1","getService","findValidUsername","require$$2","providers","strapi","getProfile","provider","query","accessToken","access_token","code","oauth_token","store","type","name","key","get","run","connect","Error","profile","email","toLower","users","db","findMany","where","advancedSettings","user","find","isEmpty","allow_register","length","unique_email","defaultRole","findOne","default_role","base","username","trim","split","newUser","role","id","confirmed","createdUser","create","data","buildRedirectUri","apiPrefix","config"],"mappings":";;;;;;;;;;;;;;;;AAEA;;AAEA;AAGA,IAAA,MAAMA,CAAAA,GAAIC,2BAAAA;AACV,IAAA,MAAMC,OAAAA,GAAUC,2BAAAA;AAEhB,IAAA,MAAM,EAAEC,UAAU,EAAEC,iBAAiB,EAAE,GAAGC,eAAAA,EAAAA;IAE1CC,SAAAA,GAAiB,CAAC,EAAEC,MAAM,EAAE,GAAA;AAC5B;;;;OAME,MAAMC,UAAAA,GAAa,OAAOC,QAAAA,EAAUC,KAAAA,GAAAA;YAClC,MAAMC,WAAAA,GAAcD,MAAME,YAAY,IAAIF,MAAMG,IAAI,IAAIH,MAAMI,WAAW;AAEzE,YAAA,MAAMR,SAAAA,GAAY,MAAMC,MAAAA,CACrBQ,KAAK,CAAC;gBAAEC,IAAAA,EAAM,QAAA;gBAAUC,IAAAA,EAAM,mBAAA;gBAAqBC,GAAAA,EAAK;AAAO,aAAA,CAAA,CAC/DC,GAAG,EAAA;YAEN,OAAOhB,UAAAA,CAAW,oBAAA,CAAA,CAAsBiB,GAAG,CAAC;AAC1CX,gBAAAA,QAAAA;AACAC,gBAAAA,KAAAA;AACAC,gBAAAA,WAAAA;AACAL,gBAAAA;AACN,aAAA,CAAA;AACA,QAAA,CAAA;AAEA;;;;;;;;OAUE,MAAMe,OAAAA,GAAU,OAAOZ,QAAAA,EAAUC,KAAAA,GAAAA;YAC/B,MAAMC,WAAAA,GAAcD,MAAME,YAAY,IAAIF,MAAMG,IAAI,IAAIH,MAAMI,WAAW;AAEzE,YAAA,IAAI,CAACH,WAAAA,EAAa;AAChB,gBAAA,MAAM,IAAIW,KAAAA,CAAM,kBAAA,CAAA;AACtB,YAAA;;YAGI,MAAMC,OAAAA,GAAU,MAAMf,UAAAA,CAAWC,QAAAA,EAAUC,KAAAA,CAAAA;AAE3C,YAAA,MAAMc,KAAAA,GAAQzB,CAAAA,CAAE0B,OAAO,CAACF,QAAQC,KAAK,CAAA;;AAGrC,YAAA,IAAI,CAACA,KAAAA,EAAO;AACV,gBAAA,MAAM,IAAIF,KAAAA,CAAM,0BAAA,CAAA;AACtB,YAAA;YAEI,MAAMI,KAAAA,GAAQ,MAAMnB,MAAAA,CAAOoB,EAAE,CAACjB,KAAK,CAAC,gCAAA,CAAA,CAAkCkB,QAAQ,CAAC;gBAC7EC,KAAAA,EAAO;AAAEL,oBAAAA;AAAK;AACpB,aAAA,CAAA;AAEI,YAAA,MAAMM,gBAAAA,GAAmB,MAAMvB,MAAAA,CAC5BQ,KAAK,CAAC;gBAAEC,IAAAA,EAAM,QAAA;gBAAUC,IAAAA,EAAM,mBAAA;gBAAqBC,GAAAA,EAAK;AAAU,aAAA,CAAA,CAClEC,GAAG,EAAA;AAEN,YAAA,MAAMY,IAAAA,GAAOhC,CAAAA,CAAEiC,IAAI,CAACN,KAAAA,EAAO;AAAEjB,gBAAAA;AAAQ,aAAA,CAAA;AAErC,YAAA,IAAIV,EAAEkC,OAAO,CAACF,SAAS,CAACD,gBAAAA,CAAiBI,cAAc,EAAE;AACvD,gBAAA,MAAM,IAAIZ,KAAAA,CAAM,4CAAA,CAAA;AACtB,YAAA;AAEI,YAAA,IAAI,CAACvB,CAAAA,CAAEkC,OAAO,CAACF,IAAAA,CAAAA,EAAO;gBACpB,OAAOA,IAAAA;AACb,YAAA;AAEI,YAAA,IAAIL,KAAAA,CAAMS,MAAM,IAAIL,gBAAAA,CAAiBM,YAAY,EAAE;AACjD,gBAAA,MAAM,IAAId,KAAAA,CAAM,yBAAA,CAAA;AACtB,YAAA;;YAGI,MAAMe,WAAAA,GAAc,MAAM9B,MAAAA,CAAOoB,EAAA,CAC9BjB,KAAK,CAAC,gCAAA,CAAA,CACN4B,OAAO,CAAC;gBAAET,KAAAA,EAAO;AAAEb,oBAAAA,IAAAA,EAAMc,iBAAiBS;AAAY;;;AAGzD,YAAA,MAAMC,IAAAA,GAAQjB,OAAAA,CAAQkB,QAAQ,IAAIlB,OAAAA,CAAQkB,QAAQ,CAACC,IAAI,MAAOlB,KAAAA,CAAMmB,KAAK,CAAC,GAAA,CAAI,CAAC,CAAA,CAAE;YACjF,MAAMF,QAAAA,GAAW,MAAMrC,iBAAAA,CAAkBoC,IAAAA,CAAAA;;AAGzC,YAAA,MAAMI,OAAAA,GAAU;AACd,gBAAA,GAAGrB,OAAO;AACVkB,gBAAAA,QAAAA;AACAjB,gBAAAA,KAAAA;AACAf,gBAAAA,QAAAA;AACAoC,gBAAAA,IAAAA,EAAMR,YAAYS,EAAE;gBACpBC,SAAAA,EAAW;AACjB,aAAA;YAEI,MAAMC,WAAAA,GAAc,MAAMzC,MAAAA,CAAOoB,EAAA,CAC9BjB,KAAK,CAAC,gCAAA,CAAA,CACNuC,MAAM,CAAC;gBAAEC,IAAAA,EAAMN;;YAElB,OAAOI,WAAAA;AACX,QAAA,CAAA;QAEE,MAAMG,gBAAAA,GAAmB,CAAC1C,QAAAA,GAAW,EAAE,GAAA;AACrC,YAAA,MAAM2C,SAAAA,GAAY7C,MAAAA,CAAO8C,MAAM,CAAClC,GAAG,CAAC,iBAAA,CAAA;YACpC,OAAOlB,OAAAA,CACLM,OAAO8C,MAAM,CAAClC,GAAG,CAAC,oBAAA,CAAA,EAClBiC,SAAAA,EACA,SAAA,EACA3C,QAAAA,EACA,UAAA,CAAA;AAEN,QAAA,CAAA;QAEE,OAAO;AACLY,YAAAA,OAAAA;AACA8B,YAAAA;AACJ,SAAA;AACA,IAAA,CAAA;;;;;;"}
+{"version":3,"file":"providers.js","sources":["../../../server/src/services/providers.js"],"sourcesContent":["'use strict';\n\n/**\n * Module dependencies\n */\n\n// Public node modules.\nconst _ = require('lodash');\nconst urlJoin = require('url-join');\n\nconst { getService, findValidUsername } = require('../utils');\n\nmodule.exports = ({ strapi }) => {\n  /**\n   * Helper to get profiles\n   *\n   * @param {String}   provider\n   */\n\n  const getProfile = async (provider, oauthData, { grantResponse } = {}) => {\n    const accessToken = oauthData.access_token || oauthData.code || oauthData.oauth_token;\n\n    const providers = await strapi\n      .store({ type: 'plugin', name: 'users-permissions', key: 'grant' })\n      .get();\n\n    return getService('providers-registry').run({\n      provider,\n      query: oauthData,\n      accessToken,\n      providers,\n      grantResponse,\n    });\n  };\n\n  /**\n   * Connect thanks to a third-party provider.\n   *\n   *\n   * @param {String}    provider\n   * @param {String}    accessToken\n   *\n   * @return  {*}\n   */\n\n  const connect = async (provider, oauthData, { grantResponse } = {}) => {\n    const accessToken = oauthData.access_token || oauthData.code || oauthData.oauth_token;\n    const idToken = oauthData.id_token;\n\n    if (!accessToken && !idToken) {\n      throw new Error('No access_token.');\n    }\n\n    // Get the profile.\n    const profile = await getProfile(provider, oauthData, { grantResponse });\n\n    const email = _.toLower(profile.email);\n\n    // We need at least the mail.\n    if (!email) {\n      throw new Error('Email was not available.');\n    }\n\n    const users = await strapi.db.query('plugin::users-permissions.user').findMany({\n      where: { email },\n    });\n\n    const advancedSettings = await strapi\n      .store({ type: 'plugin', name: 'users-permissions', key: 'advanced' })\n      .get();\n\n    const user = _.find(users, { provider });\n\n    if (_.isEmpty(user) && !advancedSettings.allow_register) {\n      throw new Error('Register action is actually not available.');\n    }\n\n    if (!_.isEmpty(user)) {\n      return user;\n    }\n\n    if (users.length && advancedSettings.unique_email) {\n      throw new Error('Email is already taken.');\n    }\n\n    // Retrieve default role.\n    const defaultRole = await strapi.db\n      .query('plugin::users-permissions.role')\n      .findOne({ where: { type: advancedSettings.default_role } });\n\n    // Username: prefer profile, else email prefix; findValidUsername ensures valid + unique\n    const base = (profile.username && profile.username.trim()) || email.split('@')[0];\n    const username = await findValidUsername(base);\n\n    // Create the new user.\n    const newUser = {\n      ...profile,\n      username, // use the generated or provided username\n      email, // overwrite with lowercased email\n      provider,\n      role: defaultRole.id,\n      confirmed: true,\n    };\n\n    const createdUser = await strapi.db\n      .query('plugin::users-permissions.user')\n      .create({ data: newUser });\n\n    return createdUser;\n  };\n\n  const buildRedirectUri = (provider = '') => {\n    const apiPrefix = strapi.config.get('api.rest.prefix');\n    return urlJoin(\n      strapi.config.get('server.absoluteUrl'),\n      apiPrefix,\n      'connect',\n      provider,\n      'callback'\n    );\n  };\n\n  return {\n    connect,\n    buildRedirectUri,\n  };\n};\n"],"names":["_","require$$0","urlJoin","require$$1","getService","findValidUsername","require$$2","providers","strapi","getProfile","provider","oauthData","grantResponse","accessToken","access_token","code","oauth_token","store","type","name","key","get","run","query","connect","idToken","id_token","Error","profile","email","toLower","users","db","findMany","where","advancedSettings","user","find","isEmpty","allow_register","length","unique_email","defaultRole","findOne","default_role","base","username","trim","split","newUser","role","id","confirmed","createdUser","create","data","buildRedirectUri","apiPrefix","config"],"mappings":";;;;;;;;;;;;;;;;AAEA;;AAEA;AAGA,IAAA,MAAMA,CAAAA,GAAIC,2BAAAA;AACV,IAAA,MAAMC,OAAAA,GAAUC,2BAAAA;AAEhB,IAAA,MAAM,EAAEC,UAAU,EAAEC,iBAAiB,EAAE,GAAGC,eAAAA,EAAAA;IAE1CC,SAAAA,GAAiB,CAAC,EAAEC,MAAM,EAAE,GAAA;AAC5B;;;;OAME,MAAMC,UAAAA,GAAa,OAAOC,QAAAA,EAAUC,SAAAA,EAAW,EAAEC,aAAa,EAAE,GAAG,EAAE,GAAA;YACnE,MAAMC,WAAAA,GAAcF,UAAUG,YAAY,IAAIH,UAAUI,IAAI,IAAIJ,UAAUK,WAAW;AAErF,YAAA,MAAMT,SAAAA,GAAY,MAAMC,MAAAA,CACrBS,KAAK,CAAC;gBAAEC,IAAAA,EAAM,QAAA;gBAAUC,IAAAA,EAAM,mBAAA;gBAAqBC,GAAAA,EAAK;AAAO,aAAA,CAAA,CAC/DC,GAAG,EAAA;YAEN,OAAOjB,UAAAA,CAAW,oBAAA,CAAA,CAAsBkB,GAAG,CAAC;AAC1CZ,gBAAAA,QAAAA;gBACAa,KAAAA,EAAOZ,SAAAA;AACPE,gBAAAA,WAAAA;AACAN,gBAAAA,SAAAA;AACAK,gBAAAA;AACN,aAAA,CAAA;AACA,QAAA,CAAA;AAEA;;;;;;;;OAUE,MAAMY,OAAAA,GAAU,OAAOd,QAAAA,EAAUC,SAAAA,EAAW,EAAEC,aAAa,EAAE,GAAG,EAAE,GAAA;YAChE,MAAMC,WAAAA,GAAcF,UAAUG,YAAY,IAAIH,UAAUI,IAAI,IAAIJ,UAAUK,WAAW;YACrF,MAAMS,OAAAA,GAAUd,UAAUe,QAAQ;YAElC,IAAI,CAACb,WAAAA,IAAe,CAACY,OAAAA,EAAS;AAC5B,gBAAA,MAAM,IAAIE,KAAAA,CAAM,kBAAA,CAAA;AACtB,YAAA;;AAGI,YAAA,MAAMC,OAAAA,GAAU,MAAMnB,UAAAA,CAAWC,QAAAA,EAAUC,SAAAA,EAAW;AAAEC,gBAAAA;;AAExD,YAAA,MAAMiB,KAAAA,GAAQ7B,CAAAA,CAAE8B,OAAO,CAACF,QAAQC,KAAK,CAAA;;AAGrC,YAAA,IAAI,CAACA,KAAAA,EAAO;AACV,gBAAA,MAAM,IAAIF,KAAAA,CAAM,0BAAA,CAAA;AACtB,YAAA;YAEI,MAAMI,KAAAA,GAAQ,MAAMvB,MAAAA,CAAOwB,EAAE,CAACT,KAAK,CAAC,gCAAA,CAAA,CAAkCU,QAAQ,CAAC;gBAC7EC,KAAAA,EAAO;AAAEL,oBAAAA;AAAK;AACpB,aAAA,CAAA;AAEI,YAAA,MAAMM,gBAAAA,GAAmB,MAAM3B,MAAAA,CAC5BS,KAAK,CAAC;gBAAEC,IAAAA,EAAM,QAAA;gBAAUC,IAAAA,EAAM,mBAAA;gBAAqBC,GAAAA,EAAK;AAAU,aAAA,CAAA,CAClEC,GAAG,EAAA;AAEN,YAAA,MAAMe,IAAAA,GAAOpC,CAAAA,CAAEqC,IAAI,CAACN,KAAAA,EAAO;AAAErB,gBAAAA;AAAQ,aAAA,CAAA;AAErC,YAAA,IAAIV,EAAEsC,OAAO,CAACF,SAAS,CAACD,gBAAAA,CAAiBI,cAAc,EAAE;AACvD,gBAAA,MAAM,IAAIZ,KAAAA,CAAM,4CAAA,CAAA;AACtB,YAAA;AAEI,YAAA,IAAI,CAAC3B,CAAAA,CAAEsC,OAAO,CAACF,IAAAA,CAAAA,EAAO;gBACpB,OAAOA,IAAAA;AACb,YAAA;AAEI,YAAA,IAAIL,KAAAA,CAAMS,MAAM,IAAIL,gBAAAA,CAAiBM,YAAY,EAAE;AACjD,gBAAA,MAAM,IAAId,KAAAA,CAAM,yBAAA,CAAA;AACtB,YAAA;;YAGI,MAAMe,WAAAA,GAAc,MAAMlC,MAAAA,CAAOwB,EAAA,CAC9BT,KAAK,CAAC,gCAAA,CAAA,CACNoB,OAAO,CAAC;gBAAET,KAAAA,EAAO;AAAEhB,oBAAAA,IAAAA,EAAMiB,iBAAiBS;AAAY;;;AAGzD,YAAA,MAAMC,IAAAA,GAAQjB,OAAAA,CAAQkB,QAAQ,IAAIlB,OAAAA,CAAQkB,QAAQ,CAACC,IAAI,MAAOlB,KAAAA,CAAMmB,KAAK,CAAC,GAAA,CAAI,CAAC,CAAA,CAAE;YACjF,MAAMF,QAAAA,GAAW,MAAMzC,iBAAAA,CAAkBwC,IAAAA,CAAAA;;AAGzC,YAAA,MAAMI,OAAAA,GAAU;AACd,gBAAA,GAAGrB,OAAO;AACVkB,gBAAAA,QAAAA;AACAjB,gBAAAA,KAAAA;AACAnB,gBAAAA,QAAAA;AACAwC,gBAAAA,IAAAA,EAAMR,YAAYS,EAAE;gBACpBC,SAAAA,EAAW;AACjB,aAAA;YAEI,MAAMC,WAAAA,GAAc,MAAM7C,MAAAA,CAAOwB,EAAA,CAC9BT,KAAK,CAAC,gCAAA,CAAA,CACN+B,MAAM,CAAC;gBAAEC,IAAAA,EAAMN;;YAElB,OAAOI,WAAAA;AACX,QAAA,CAAA;QAEE,MAAMG,gBAAAA,GAAmB,CAAC9C,QAAAA,GAAW,EAAE,GAAA;AACrC,YAAA,MAAM+C,SAAAA,GAAYjD,MAAAA,CAAOkD,MAAM,CAACrC,GAAG,CAAC,iBAAA,CAAA;YACpC,OAAOnB,OAAAA,CACLM,OAAOkD,MAAM,CAACrC,GAAG,CAAC,oBAAA,CAAA,EAClBoC,SAAAA,EACA,SAAA,EACA/C,QAAAA,EACA,UAAA,CAAA;AAEN,QAAA,CAAA;QAEE,OAAO;AACLc,YAAAA,OAAAA;AACAgC,YAAAA;AACJ,SAAA;AACA,IAAA,CAAA;;;;;;"}

package/dist/server/services/providers.mjs

@@ -18,8 +18,8 @@ function requireProviders() {
 	   * Helper to get profiles
 	   *
 	   * @param {String}   provider
-	   */ const getProfile = async (provider, query)=>{
-            const accessToken = query.access_token || query.code || query.oauth_token;
+	   */ const getProfile = async (provider, oauthData, { grantResponse } = {})=>{
+            const accessToken = oauthData.access_token || oauthData.code || oauthData.oauth_token;
             const providers = await strapi.store({
                 type: 'plugin',
                 name: 'users-permissions',
@@ -27,9 +27,10 @@ function requireProviders() {
             }).get();
             return getService('providers-registry').run({
                 provider,
-                query,
+                query: oauthData,
                 accessToken,
-                providers
+                providers,
+                grantResponse
             });
         };
         /**
@@ -40,13 +41,16 @@ function requireProviders() {
 	   * @param {String}    accessToken
 	   *
 	   * @return  {*}
-	   */ const connect = async (provider, query)=>{
-            const accessToken = query.access_token || query.code || query.oauth_token;
-            if (!accessToken) {
+	   */ const connect = async (provider, oauthData, { grantResponse } = {})=>{
+            const accessToken = oauthData.access_token || oauthData.code || oauthData.oauth_token;
+            const idToken = oauthData.id_token;
+            if (!accessToken && !idToken) {
                 throw new Error('No access_token.');
             }
             // Get the profile.
-            const profile = await getProfile(provider, query);
+            const profile = await getProfile(provider, oauthData, {
+                grantResponse
+            });
             const email = _.toLower(profile.email);
             // We need at least the mail.
             if (!email) {

package/dist/server/services/providers.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"providers.mjs","sources":["../../../server/src/services/providers.js"],"sourcesContent":["'use strict';\n\n/**\n * Module dependencies\n */\n\n// Public node modules.\nconst _ = require('lodash');\nconst urlJoin = require('url-join');\n\nconst { getService, findValidUsername } = require('../utils');\n\nmodule.exports = ({ strapi }) => {\n  /**\n   * Helper to get profiles\n   *\n   * @param {String}   provider\n   */\n\n  const getProfile = async (provider, query) => {\n    const accessToken = query.access_token || query.code || query.oauth_token;\n\n    const providers = await strapi\n      .store({ type: 'plugin', name: 'users-permissions', key: 'grant' })\n      .get();\n\n    return getService('providers-registry').run({\n      provider,\n      query,\n      accessToken,\n      providers,\n    });\n  };\n\n  /**\n   * Connect thanks to a third-party provider.\n   *\n   *\n   * @param {String}    provider\n   * @param {String}    accessToken\n   *\n   * @return  {*}\n   */\n\n  const connect = async (provider, query) => {\n    const accessToken = query.access_token || query.code || query.oauth_token;\n\n    if (!accessToken) {\n      throw new Error('No access_token.');\n    }\n\n    // Get the profile.\n    const profile = await getProfile(provider, query);\n\n    const email = _.toLower(profile.email);\n\n    // We need at least the mail.\n    if (!email) {\n      throw new Error('Email was not available.');\n    }\n\n    const users = await strapi.db.query('plugin::users-permissions.user').findMany({\n      where: { email },\n    });\n\n    const advancedSettings = await strapi\n      .store({ type: 'plugin', name: 'users-permissions', key: 'advanced' })\n      .get();\n\n    const user = _.find(users, { provider });\n\n    if (_.isEmpty(user) && !advancedSettings.allow_register) {\n      throw new Error('Register action is actually not available.');\n    }\n\n    if (!_.isEmpty(user)) {\n      return user;\n    }\n\n    if (users.length && advancedSettings.unique_email) {\n      throw new Error('Email is already taken.');\n    }\n\n    // Retrieve default role.\n    const defaultRole = await strapi.db\n      .query('plugin::users-permissions.role')\n      .findOne({ where: { type: advancedSettings.default_role } });\n\n    // Username: prefer profile, else email prefix; findValidUsername ensures valid + unique\n    const base = (profile.username && profile.username.trim()) || email.split('@')[0];\n    const username = await findValidUsername(base);\n\n    // Create the new user.\n    const newUser = {\n      ...profile,\n      username, // use the generated or provided username\n      email, // overwrite with lowercased email\n      provider,\n      role: defaultRole.id,\n      confirmed: true,\n    };\n\n    const createdUser = await strapi.db\n      .query('plugin::users-permissions.user')\n      .create({ data: newUser });\n\n    return createdUser;\n  };\n\n  const buildRedirectUri = (provider = '') => {\n    const apiPrefix = strapi.config.get('api.rest.prefix');\n    return urlJoin(\n      strapi.config.get('server.absoluteUrl'),\n      apiPrefix,\n      'connect',\n      provider,\n      'callback'\n    );\n  };\n\n  return {\n    connect,\n    buildRedirectUri,\n  };\n};\n"],"names":["_","require$$0","urlJoin","require$$1","getService","findValidUsername","require$$2","providers","strapi","getProfile","provider","query","accessToken","access_token","code","oauth_token","store","type","name","key","get","run","connect","Error","profile","email","toLower","users","db","findMany","where","advancedSettings","user","find","isEmpty","allow_register","length","unique_email","defaultRole","findOne","default_role","base","username","trim","split","newUser","role","id","confirmed","createdUser","create","data","buildRedirectUri","apiPrefix","config"],"mappings":";;;;;;;;;AAEA;;AAEA;AAGA,IAAA,MAAMA,CAAAA,GAAIC,UAAAA;AACV,IAAA,MAAMC,OAAAA,GAAUC,UAAAA;AAEhB,IAAA,MAAM,EAAEC,UAAU,EAAEC,iBAAiB,EAAE,GAAGC,YAAAA,EAAAA;IAE1CC,SAAAA,GAAiB,CAAC,EAAEC,MAAM,EAAE,GAAA;AAC5B;;;;OAME,MAAMC,UAAAA,GAAa,OAAOC,QAAAA,EAAUC,KAAAA,GAAAA;YAClC,MAAMC,WAAAA,GAAcD,MAAME,YAAY,IAAIF,MAAMG,IAAI,IAAIH,MAAMI,WAAW;AAEzE,YAAA,MAAMR,SAAAA,GAAY,MAAMC,MAAAA,CACrBQ,KAAK,CAAC;gBAAEC,IAAAA,EAAM,QAAA;gBAAUC,IAAAA,EAAM,mBAAA;gBAAqBC,GAAAA,EAAK;AAAO,aAAA,CAAA,CAC/DC,GAAG,EAAA;YAEN,OAAOhB,UAAAA,CAAW,oBAAA,CAAA,CAAsBiB,GAAG,CAAC;AAC1CX,gBAAAA,QAAAA;AACAC,gBAAAA,KAAAA;AACAC,gBAAAA,WAAAA;AACAL,gBAAAA;AACN,aAAA,CAAA;AACA,QAAA,CAAA;AAEA;;;;;;;;OAUE,MAAMe,OAAAA,GAAU,OAAOZ,QAAAA,EAAUC,KAAAA,GAAAA;YAC/B,MAAMC,WAAAA,GAAcD,MAAME,YAAY,IAAIF,MAAMG,IAAI,IAAIH,MAAMI,WAAW;AAEzE,YAAA,IAAI,CAACH,WAAAA,EAAa;AAChB,gBAAA,MAAM,IAAIW,KAAAA,CAAM,kBAAA,CAAA;AACtB,YAAA;;YAGI,MAAMC,OAAAA,GAAU,MAAMf,UAAAA,CAAWC,QAAAA,EAAUC,KAAAA,CAAAA;AAE3C,YAAA,MAAMc,KAAAA,GAAQzB,CAAAA,CAAE0B,OAAO,CAACF,QAAQC,KAAK,CAAA;;AAGrC,YAAA,IAAI,CAACA,KAAAA,EAAO;AACV,gBAAA,MAAM,IAAIF,KAAAA,CAAM,0BAAA,CAAA;AACtB,YAAA;YAEI,MAAMI,KAAAA,GAAQ,MAAMnB,MAAAA,CAAOoB,EAAE,CAACjB,KAAK,CAAC,gCAAA,CAAA,CAAkCkB,QAAQ,CAAC;gBAC7EC,KAAAA,EAAO;AAAEL,oBAAAA;AAAK;AACpB,aAAA,CAAA;AAEI,YAAA,MAAMM,gBAAAA,GAAmB,MAAMvB,MAAAA,CAC5BQ,KAAK,CAAC;gBAAEC,IAAAA,EAAM,QAAA;gBAAUC,IAAAA,EAAM,mBAAA;gBAAqBC,GAAAA,EAAK;AAAU,aAAA,CAAA,CAClEC,GAAG,EAAA;AAEN,YAAA,MAAMY,IAAAA,GAAOhC,CAAAA,CAAEiC,IAAI,CAACN,KAAAA,EAAO;AAAEjB,gBAAAA;AAAQ,aAAA,CAAA;AAErC,YAAA,IAAIV,EAAEkC,OAAO,CAACF,SAAS,CAACD,gBAAAA,CAAiBI,cAAc,EAAE;AACvD,gBAAA,MAAM,IAAIZ,KAAAA,CAAM,4CAAA,CAAA;AACtB,YAAA;AAEI,YAAA,IAAI,CAACvB,CAAAA,CAAEkC,OAAO,CAACF,IAAAA,CAAAA,EAAO;gBACpB,OAAOA,IAAAA;AACb,YAAA;AAEI,YAAA,IAAIL,KAAAA,CAAMS,MAAM,IAAIL,gBAAAA,CAAiBM,YAAY,EAAE;AACjD,gBAAA,MAAM,IAAId,KAAAA,CAAM,yBAAA,CAAA;AACtB,YAAA;;YAGI,MAAMe,WAAAA,GAAc,MAAM9B,MAAAA,CAAOoB,EAAA,CAC9BjB,KAAK,CAAC,gCAAA,CAAA,CACN4B,OAAO,CAAC;gBAAET,KAAAA,EAAO;AAAEb,oBAAAA,IAAAA,EAAMc,iBAAiBS;AAAY;;;AAGzD,YAAA,MAAMC,IAAAA,GAAQjB,OAAAA,CAAQkB,QAAQ,IAAIlB,OAAAA,CAAQkB,QAAQ,CAACC,IAAI,MAAOlB,KAAAA,CAAMmB,KAAK,CAAC,GAAA,CAAI,CAAC,CAAA,CAAE;YACjF,MAAMF,QAAAA,GAAW,MAAMrC,iBAAAA,CAAkBoC,IAAAA,CAAAA;;AAGzC,YAAA,MAAMI,OAAAA,GAAU;AACd,gBAAA,GAAGrB,OAAO;AACVkB,gBAAAA,QAAAA;AACAjB,gBAAAA,KAAAA;AACAf,gBAAAA,QAAAA;AACAoC,gBAAAA,IAAAA,EAAMR,YAAYS,EAAE;gBACpBC,SAAAA,EAAW;AACjB,aAAA;YAEI,MAAMC,WAAAA,GAAc,MAAMzC,MAAAA,CAAOoB,EAAA,CAC9BjB,KAAK,CAAC,gCAAA,CAAA,CACNuC,MAAM,CAAC;gBAAEC,IAAAA,EAAMN;;YAElB,OAAOI,WAAAA;AACX,QAAA,CAAA;QAEE,MAAMG,gBAAAA,GAAmB,CAAC1C,QAAAA,GAAW,EAAE,GAAA;AACrC,YAAA,MAAM2C,SAAAA,GAAY7C,MAAAA,CAAO8C,MAAM,CAAClC,GAAG,CAAC,iBAAA,CAAA;YACpC,OAAOlB,OAAAA,CACLM,OAAO8C,MAAM,CAAClC,GAAG,CAAC,oBAAA,CAAA,EAClBiC,SAAAA,EACA,SAAA,EACA3C,QAAAA,EACA,UAAA,CAAA;AAEN,QAAA,CAAA;QAEE,OAAO;AACLY,YAAAA,OAAAA;AACA8B,YAAAA;AACJ,SAAA;AACA,IAAA,CAAA;;;;;;"}
+{"version":3,"file":"providers.mjs","sources":["../../../server/src/services/providers.js"],"sourcesContent":["'use strict';\n\n/**\n * Module dependencies\n */\n\n// Public node modules.\nconst _ = require('lodash');\nconst urlJoin = require('url-join');\n\nconst { getService, findValidUsername } = require('../utils');\n\nmodule.exports = ({ strapi }) => {\n  /**\n   * Helper to get profiles\n   *\n   * @param {String}   provider\n   */\n\n  const getProfile = async (provider, oauthData, { grantResponse } = {}) => {\n    const accessToken = oauthData.access_token || oauthData.code || oauthData.oauth_token;\n\n    const providers = await strapi\n      .store({ type: 'plugin', name: 'users-permissions', key: 'grant' })\n      .get();\n\n    return getService('providers-registry').run({\n      provider,\n      query: oauthData,\n      accessToken,\n      providers,\n      grantResponse,\n    });\n  };\n\n  /**\n   * Connect thanks to a third-party provider.\n   *\n   *\n   * @param {String}    provider\n   * @param {String}    accessToken\n   *\n   * @return  {*}\n   */\n\n  const connect = async (provider, oauthData, { grantResponse } = {}) => {\n    const accessToken = oauthData.access_token || oauthData.code || oauthData.oauth_token;\n    const idToken = oauthData.id_token;\n\n    if (!accessToken && !idToken) {\n      throw new Error('No access_token.');\n    }\n\n    // Get the profile.\n    const profile = await getProfile(provider, oauthData, { grantResponse });\n\n    const email = _.toLower(profile.email);\n\n    // We need at least the mail.\n    if (!email) {\n      throw new Error('Email was not available.');\n    }\n\n    const users = await strapi.db.query('plugin::users-permissions.user').findMany({\n      where: { email },\n    });\n\n    const advancedSettings = await strapi\n      .store({ type: 'plugin', name: 'users-permissions', key: 'advanced' })\n      .get();\n\n    const user = _.find(users, { provider });\n\n    if (_.isEmpty(user) && !advancedSettings.allow_register) {\n      throw new Error('Register action is actually not available.');\n    }\n\n    if (!_.isEmpty(user)) {\n      return user;\n    }\n\n    if (users.length && advancedSettings.unique_email) {\n      throw new Error('Email is already taken.');\n    }\n\n    // Retrieve default role.\n    const defaultRole = await strapi.db\n      .query('plugin::users-permissions.role')\n      .findOne({ where: { type: advancedSettings.default_role } });\n\n    // Username: prefer profile, else email prefix; findValidUsername ensures valid + unique\n    const base = (profile.username && profile.username.trim()) || email.split('@')[0];\n    const username = await findValidUsername(base);\n\n    // Create the new user.\n    const newUser = {\n      ...profile,\n      username, // use the generated or provided username\n      email, // overwrite with lowercased email\n      provider,\n      role: defaultRole.id,\n      confirmed: true,\n    };\n\n    const createdUser = await strapi.db\n      .query('plugin::users-permissions.user')\n      .create({ data: newUser });\n\n    return createdUser;\n  };\n\n  const buildRedirectUri = (provider = '') => {\n    const apiPrefix = strapi.config.get('api.rest.prefix');\n    return urlJoin(\n      strapi.config.get('server.absoluteUrl'),\n      apiPrefix,\n      'connect',\n      provider,\n      'callback'\n    );\n  };\n\n  return {\n    connect,\n    buildRedirectUri,\n  };\n};\n"],"names":["_","require$$0","urlJoin","require$$1","getService","findValidUsername","require$$2","providers","strapi","getProfile","provider","oauthData","grantResponse","accessToken","access_token","code","oauth_token","store","type","name","key","get","run","query","connect","idToken","id_token","Error","profile","email","toLower","users","db","findMany","where","advancedSettings","user","find","isEmpty","allow_register","length","unique_email","defaultRole","findOne","default_role","base","username","trim","split","newUser","role","id","confirmed","createdUser","create","data","buildRedirectUri","apiPrefix","config"],"mappings":";;;;;;;;;AAEA;;AAEA;AAGA,IAAA,MAAMA,CAAAA,GAAIC,UAAAA;AACV,IAAA,MAAMC,OAAAA,GAAUC,UAAAA;AAEhB,IAAA,MAAM,EAAEC,UAAU,EAAEC,iBAAiB,EAAE,GAAGC,YAAAA,EAAAA;IAE1CC,SAAAA,GAAiB,CAAC,EAAEC,MAAM,EAAE,GAAA;AAC5B;;;;OAME,MAAMC,UAAAA,GAAa,OAAOC,QAAAA,EAAUC,SAAAA,EAAW,EAAEC,aAAa,EAAE,GAAG,EAAE,GAAA;YACnE,MAAMC,WAAAA,GAAcF,UAAUG,YAAY,IAAIH,UAAUI,IAAI,IAAIJ,UAAUK,WAAW;AAErF,YAAA,MAAMT,SAAAA,GAAY,MAAMC,MAAAA,CACrBS,KAAK,CAAC;gBAAEC,IAAAA,EAAM,QAAA;gBAAUC,IAAAA,EAAM,mBAAA;gBAAqBC,GAAAA,EAAK;AAAO,aAAA,CAAA,CAC/DC,GAAG,EAAA;YAEN,OAAOjB,UAAAA,CAAW,oBAAA,CAAA,CAAsBkB,GAAG,CAAC;AAC1CZ,gBAAAA,QAAAA;gBACAa,KAAAA,EAAOZ,SAAAA;AACPE,gBAAAA,WAAAA;AACAN,gBAAAA,SAAAA;AACAK,gBAAAA;AACN,aAAA,CAAA;AACA,QAAA,CAAA;AAEA;;;;;;;;OAUE,MAAMY,OAAAA,GAAU,OAAOd,QAAAA,EAAUC,SAAAA,EAAW,EAAEC,aAAa,EAAE,GAAG,EAAE,GAAA;YAChE,MAAMC,WAAAA,GAAcF,UAAUG,YAAY,IAAIH,UAAUI,IAAI,IAAIJ,UAAUK,WAAW;YACrF,MAAMS,OAAAA,GAAUd,UAAUe,QAAQ;YAElC,IAAI,CAACb,WAAAA,IAAe,CAACY,OAAAA,EAAS;AAC5B,gBAAA,MAAM,IAAIE,KAAAA,CAAM,kBAAA,CAAA;AACtB,YAAA;;AAGI,YAAA,MAAMC,OAAAA,GAAU,MAAMnB,UAAAA,CAAWC,QAAAA,EAAUC,SAAAA,EAAW;AAAEC,gBAAAA;;AAExD,YAAA,MAAMiB,KAAAA,GAAQ7B,CAAAA,CAAE8B,OAAO,CAACF,QAAQC,KAAK,CAAA;;AAGrC,YAAA,IAAI,CAACA,KAAAA,EAAO;AACV,gBAAA,MAAM,IAAIF,KAAAA,CAAM,0BAAA,CAAA;AACtB,YAAA;YAEI,MAAMI,KAAAA,GAAQ,MAAMvB,MAAAA,CAAOwB,EAAE,CAACT,KAAK,CAAC,gCAAA,CAAA,CAAkCU,QAAQ,CAAC;gBAC7EC,KAAAA,EAAO;AAAEL,oBAAAA;AAAK;AACpB,aAAA,CAAA;AAEI,YAAA,MAAMM,gBAAAA,GAAmB,MAAM3B,MAAAA,CAC5BS,KAAK,CAAC;gBAAEC,IAAAA,EAAM,QAAA;gBAAUC,IAAAA,EAAM,mBAAA;gBAAqBC,GAAAA,EAAK;AAAU,aAAA,CAAA,CAClEC,GAAG,EAAA;AAEN,YAAA,MAAMe,IAAAA,GAAOpC,CAAAA,CAAEqC,IAAI,CAACN,KAAAA,EAAO;AAAErB,gBAAAA;AAAQ,aAAA,CAAA;AAErC,YAAA,IAAIV,EAAEsC,OAAO,CAACF,SAAS,CAACD,gBAAAA,CAAiBI,cAAc,EAAE;AACvD,gBAAA,MAAM,IAAIZ,KAAAA,CAAM,4CAAA,CAAA;AACtB,YAAA;AAEI,YAAA,IAAI,CAAC3B,CAAAA,CAAEsC,OAAO,CAACF,IAAAA,CAAAA,EAAO;gBACpB,OAAOA,IAAAA;AACb,YAAA;AAEI,YAAA,IAAIL,KAAAA,CAAMS,MAAM,IAAIL,gBAAAA,CAAiBM,YAAY,EAAE;AACjD,gBAAA,MAAM,IAAId,KAAAA,CAAM,yBAAA,CAAA;AACtB,YAAA;;YAGI,MAAMe,WAAAA,GAAc,MAAMlC,MAAAA,CAAOwB,EAAA,CAC9BT,KAAK,CAAC,gCAAA,CAAA,CACNoB,OAAO,CAAC;gBAAET,KAAAA,EAAO;AAAEhB,oBAAAA,IAAAA,EAAMiB,iBAAiBS;AAAY;;;AAGzD,YAAA,MAAMC,IAAAA,GAAQjB,OAAAA,CAAQkB,QAAQ,IAAIlB,OAAAA,CAAQkB,QAAQ,CAACC,IAAI,MAAOlB,KAAAA,CAAMmB,KAAK,CAAC,GAAA,CAAI,CAAC,CAAA,CAAE;YACjF,MAAMF,QAAAA,GAAW,MAAMzC,iBAAAA,CAAkBwC,IAAAA,CAAAA;;AAGzC,YAAA,MAAMI,OAAAA,GAAU;AACd,gBAAA,GAAGrB,OAAO;AACVkB,gBAAAA,QAAAA;AACAjB,gBAAAA,KAAAA;AACAnB,gBAAAA,QAAAA;AACAwC,gBAAAA,IAAAA,EAAMR,YAAYS,EAAE;gBACpBC,SAAAA,EAAW;AACjB,aAAA;YAEI,MAAMC,WAAAA,GAAc,MAAM7C,MAAAA,CAAOwB,EAAA,CAC9BT,KAAK,CAAC,gCAAA,CAAA,CACN+B,MAAM,CAAC;gBAAEC,IAAAA,EAAMN;;YAElB,OAAOI,WAAAA;AACX,QAAA,CAAA;QAEE,MAAMG,gBAAAA,GAAmB,CAAC9C,QAAAA,GAAW,EAAE,GAAA;AACrC,YAAA,MAAM+C,SAAAA,GAAYjD,MAAAA,CAAOkD,MAAM,CAACrC,GAAG,CAAC,iBAAA,CAAA;YACpC,OAAOnB,OAAAA,CACLM,OAAOkD,MAAM,CAACrC,GAAG,CAAC,oBAAA,CAAA,EAClBoC,SAAAA,EACA,SAAA,EACA/C,QAAAA,EACA,UAAA,CAAA;AAEN,QAAA,CAAA;QAEE,OAAO;AACLc,YAAAA,OAAAA;AACAgC,YAAAA;AACJ,SAAA;AACA,IAAA,CAAA;;;;;;"}

package/dist/server/services/user.js

@@ -27,10 +27,11 @@ function requireUser() {
 	 */ const crypto = require$$0__default$1.default;
     const bcrypt = require$$1__default$1.default;
     const urlJoin = require$$2__default.default;
-    const { sanitize } = require$$1__default.default;
-    const { toNumber, getOr } = require$$0__default.default;
+    const { sanitize, ALLOWED_QUERY_PARAM_KEYS } = require$$1__default.default;
+    const { toNumber, getOr, pick } = require$$0__default.default;
     const { getService } = index.__require();
     const USER_MODEL_UID = 'plugin::users-permissions.user';
+    const pickAllowedQueryParams = pick(ALLOWED_QUERY_PARAM_KEYS);
     const getSessionManager = ()=>{
         const manager = strapi.sessionManager;
         return manager ?? null;
@@ -41,9 +42,8 @@ function requireUser() {
 	   *
 	   * @return {Promise}
 	   */ count (params) {
-                return strapi1.db.query(USER_MODEL_UID).count({
-                    where: params
-                });
+                const query = strapi1.get('query-params').transform(USER_MODEL_UID, pickAllowedQueryParams(params ?? {}));
+                return strapi1.db.query(USER_MODEL_UID).count(query);
             },
             /**
 	   * Hashes password fields in the provided values object if they are present.
@@ -112,7 +112,7 @@ function requireUser() {
 	   * Promise to fetch a/an user.
 	   * @return {Promise}
 	   */ fetch (id, params) {
-                const query = strapi1.get('query-params').transform(USER_MODEL_UID, params ?? {});
+                const query = strapi1.get('query-params').transform(USER_MODEL_UID, pickAllowedQueryParams(params ?? {}));
                 return strapi1.db.query(USER_MODEL_UID).findOne({
                     ...query,
                     where: {
@@ -142,7 +142,7 @@ function requireUser() {
 	   * Promise to fetch all users.
 	   * @return {Promise}
 	   */ fetchAll (params) {
-                const query = strapi1.get('query-params').transform(USER_MODEL_UID, params ?? {});
+                const query = strapi1.get('query-params').transform(USER_MODEL_UID, pickAllowedQueryParams(params ?? {}));
                 return strapi1.db.query(USER_MODEL_UID).findMany(query);
             },
             /**