@strapi/plugin-users-permissions 5.52.3 → 5.53.0

package/dist/server/graphql/mutations/auth/reset-password.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"reset-password.mjs","sources":["../../../../../server/src/graphql/mutations/auth/reset-password.js"],"sourcesContent":["'use strict';\n\nconst { toPlainObject } = require('lodash/fp');\n\nconst { checkBadRequest } = require('../../utils');\n\nmodule.exports = ({ nexus, strapi }) => {\n  const { nonNull } = nexus;\n\n  return {\n    type: 'UsersPermissionsLoginPayload',\n\n    args: {\n      password: nonNull('String'),\n      passwordConfirmation: nonNull('String'),\n      code: nonNull('String'),\n    },\n\n    description: 'Reset user password. Confirm with a code (resetToken from forgotPassword)',\n\n    async resolve(parent, args, context) {\n      const { koaContext } = context;\n\n      koaContext.request.body = toPlainObject(args);\n\n      await strapi.plugin('users-permissions').controller('auth').resetPassword(koaContext);\n\n      const output = koaContext.body;\n\n      checkBadRequest(output);\n\n      return {\n        user: output.user || output,\n        jwt: output.jwt,\n      };\n    },\n  };\n};\n"],"names":["toPlainObject","require$$0","checkBadRequest","require$$1","resetPassword","nexus","strapi","nonNull","type","args","password","passwordConfirmation","code","description","resolve","parent","context","koaContext","request","body","plugin","controller","output","user","jwt"],"mappings":";;;;;;;;IAEA,MAAM,EAAEA,aAAa,EAAE,GAAGC,UAAAA;IAE1B,MAAM,EAAEC,eAAe,EAAE,GAAGC,YAAAA,EAAAA;AAE5BC,IAAAA,aAAAA,GAAiB,CAAC,EAAEC,KAAK,EAAEC,MAAM,EAAE,GAAA;QACjC,MAAM,EAAEC,OAAO,EAAE,GAAGF,KAAAA;QAEpB,OAAO;YACLG,IAAAA,EAAM,8BAAA;YAENC,IAAAA,EAAM;AACJC,gBAAAA,QAAAA,EAAUH,OAAAA,CAAQ,QAAA,CAAA;AAClBI,gBAAAA,oBAAAA,EAAsBJ,OAAAA,CAAQ,QAAA,CAAA;AAC9BK,gBAAAA,IAAAA,EAAML,OAAAA,CAAQ,QAAA;AACpB,aAAA;YAEIM,WAAAA,EAAa,2EAAA;AAEb,YAAA,MAAMC,OAAAA,CAAAA,CAAQC,MAAM,EAAEN,IAAI,EAAEO,OAAO,EAAA;gBACjC,MAAM,EAAEC,UAAU,EAAE,GAAGD,OAAAA;AAEvBC,gBAAAA,UAAAA,CAAWC,OAAO,CAACC,IAAI,GAAGnB,aAAAA,CAAcS,IAAAA,CAAAA;gBAExC,MAAMH,MAAAA,CAAOc,MAAM,CAAC,mBAAA,CAAA,CAAqBC,UAAU,CAAC,MAAA,CAAA,CAAQjB,aAAa,CAACa,UAAAA,CAAAA;gBAE1E,MAAMK,MAAAA,GAASL,WAAWE,IAAI;gBAE9BjB,eAAAA,CAAgBoB,MAAAA,CAAAA;gBAEhB,OAAO;oBACLC,IAAAA,EAAMD,MAAAA,CAAOC,IAAI,IAAID,MAAAA;AACrBE,oBAAAA,GAAAA,EAAKF,OAAOE;AACpB,iBAAA;AACA,YAAA;AACA,SAAA;AACA,IAAA,CAAA;;;;;;"}
+{"version":3,"file":"reset-password.mjs","sources":["../../../../../server/src/graphql/mutations/auth/reset-password.js"],"sourcesContent":["'use strict';\n\nconst { toPlainObject } = require('lodash/fp');\n\nconst { checkBadRequest } = require('../../utils');\nconst { createRateLimitRunner } = require('./rate-limit');\n\nmodule.exports = ({ nexus, strapi }) => {\n  const { nonNull } = nexus;\n  const runRateLimit = createRateLimitRunner(strapi, '/auth/reset-password');\n\n  return {\n    type: 'UsersPermissionsLoginPayload',\n\n    args: {\n      password: nonNull('String'),\n      passwordConfirmation: nonNull('String'),\n      code: nonNull('String'),\n    },\n\n    description: 'Reset user password. Confirm with a code (resetToken from forgotPassword)',\n\n    async resolve(parent, args, context) {\n      const { koaContext } = context;\n\n      const output = await runRateLimit(koaContext, { body: toPlainObject(args) }, (ctx) =>\n        strapi.plugin('users-permissions').controller('auth').resetPassword(ctx)\n      );\n\n      checkBadRequest(output);\n\n      return {\n        user: output.user || output,\n        jwt: output.jwt,\n      };\n    },\n  };\n};\n"],"names":["toPlainObject","require$$0","checkBadRequest","require$$1","createRateLimitRunner","require$$2","resetPassword","nexus","strapi","nonNull","runRateLimit","type","args","password","passwordConfirmation","code","description","resolve","parent","context","koaContext","output","body","ctx","plugin","controller","user","jwt"],"mappings":";;;;;;;;;IAEA,MAAM,EAAEA,aAAa,EAAE,GAAGC,UAAAA;IAE1B,MAAM,EAAEC,eAAe,EAAE,GAAGC,YAAAA,EAAAA;IAC5B,MAAM,EAAEC,qBAAqB,EAAE,GAAGC,gBAAAA,EAAAA;AAElCC,IAAAA,aAAAA,GAAiB,CAAC,EAAEC,KAAK,EAAEC,MAAM,EAAE,GAAA;QACjC,MAAM,EAAEC,OAAO,EAAE,GAAGF,KAAAA;QACpB,MAAMG,YAAAA,GAAeN,sBAAsBI,MAAAA,EAAQ,sBAAA,CAAA;QAEnD,OAAO;YACLG,IAAAA,EAAM,8BAAA;YAENC,IAAAA,EAAM;AACJC,gBAAAA,QAAAA,EAAUJ,OAAAA,CAAQ,QAAA,CAAA;AAClBK,gBAAAA,oBAAAA,EAAsBL,OAAAA,CAAQ,QAAA,CAAA;AAC9BM,gBAAAA,IAAAA,EAAMN,OAAAA,CAAQ,QAAA;AACpB,aAAA;YAEIO,WAAAA,EAAa,2EAAA;AAEb,YAAA,MAAMC,OAAAA,CAAAA,CAAQC,MAAM,EAAEN,IAAI,EAAEO,OAAO,EAAA;gBACjC,MAAM,EAAEC,UAAU,EAAE,GAAGD,OAAAA;gBAEvB,MAAME,MAAAA,GAAS,MAAMX,YAAAA,CAAaU,UAAAA,EAAY;AAAEE,oBAAAA,IAAAA,EAAMtB,aAAAA,CAAcY,IAAAA;iBAAK,EAAI,CAACW,GAAAA,GAC5Ef,MAAAA,CAAOgB,MAAM,CAAC,qBAAqBC,UAAU,CAAC,MAAA,CAAA,CAAQnB,aAAa,CAACiB,GAAAA,CAAAA,CAAAA;gBAGtErB,eAAAA,CAAgBmB,MAAAA,CAAAA;gBAEhB,OAAO;oBACLK,IAAAA,EAAML,MAAAA,CAAOK,IAAI,IAAIL,MAAAA;AACrBM,oBAAAA,GAAAA,EAAKN,OAAOM;AACpB,iBAAA;AACA,YAAA;AACA,SAAA;AACA,IAAA,CAAA;;;;;;"}

package/dist/server/services/providers-registry.js

@@ -40,6 +40,9 @@ function requireProvidersRegistry() {
                 },
                 async authCallback ({ accessToken }) {
                     const { body } = await bearerGet('https://discord.com/api/users/@me', accessToken);
+                    if (body.verified !== true) {
+                        throw new Error('Email not verified by Discord');
+                    }
                     const username = body.discriminator && body.discriminator !== '0' ? `${body.username}#${body.discriminator}` : body.username;
                     return {
                         username,
@@ -64,6 +67,9 @@ function requireProvidersRegistry() {
                             fields: 'name,email'
                         }
                     });
+                    if (!body.email) {
+                        throw new Error('Email not verified by Facebook');
+                    }
                     return {
                         username: body.name,
                         email: body.email
@@ -83,6 +89,10 @@ function requireProvidersRegistry() {
                 },
                 async authCallback ({ accessToken }) {
                     const { body } = await fetchJson(`https://oauth2.googleapis.com/tokeninfo?access_token=${encodeURIComponent(accessToken)}`);
+                    const verified = body.verified_email ?? body.email_verified;
+                    if (verified !== true && verified !== 'true') {
+                        throw new Error('Email not verified by Google');
+                    }
                     return {
                         username: body.email.split('@')[0],
                         email: body.email
@@ -107,20 +117,28 @@ function requireProvidersRegistry() {
                             'user-agent': 'strapi'
                         }
                     });
+                    const { body: emailBody } = await bearerGet('https://api.github.com/user/emails', accessToken, {
+                        headers: {
+                            'user-agent': 'strapi'
+                        }
+                    });
                     if (userBody.email) {
+                        const verifiedPublicEmail = Array.isArray(emailBody) ? emailBody.find((entry)=>entry.email === userBody.email && entry.verified === true) : null;
+                        if (!verifiedPublicEmail) {
+                            throw new Error('Email not verified by GitHub');
+                        }
                         return {
                             username: userBody.login,
                             email: userBody.email
                         };
                     }
-                    const { body: emailBody } = await bearerGet('https://api.github.com/user/emails', accessToken, {
-                        headers: {
-                            'user-agent': 'strapi'
-                        }
-                    });
+                    const primaryEmail = Array.isArray(emailBody) ? emailBody.find((email)=>email.primary === true) : null;
+                    if (!primaryEmail || primaryEmail.verified !== true) {
+                        throw new Error('Email not verified by GitHub');
+                    }
                     return {
                         username: userBody.login,
-                        email: Array.isArray(emailBody) ? emailBody.find((email)=>email.primary === true).email : null
+                        email: primaryEmail.email
                     };
                 }
             },
@@ -151,19 +169,27 @@ function requireProvidersRegistry() {
                     secret: '',
                     callbackUrl: `${baseURL}/twitter/callback`
                 },
-                async authCallback ({ accessToken, query, providers }) {
+                async authCallback ({ accessToken, providers, grantResponse }) {
+                    const accessSecret = grantResponse?.access_secret;
+                    const screenName = grantResponse?.raw?.screen_name;
+                    if (!accessSecret) {
+                        throw new Error('Twitter authentication requires a completed OAuth session');
+                    }
                     const { twitterGet } = oauth1.__require();
                     const { body } = await twitterGet({
                         url: 'https://api.twitter.com/1.1/account/verify_credentials.json',
                         accessToken,
-                        accessCredential: query.access_secret,
+                        accessCredential: accessSecret,
                         consumerKey: providers.twitter.key,
                         clientCredential: providers.twitter.secret,
                         qs: {
                             include_email: 'true',
-                            screen_name: query['raw[screen_name]']
+                            screen_name: screenName
                         }
                     });
+                    if (!body.email) {
+                        throw new Error('Email not verified by Twitter');
+                    }
                     return {
                         username: body.screen_name,
                         email: body.email
@@ -204,16 +230,24 @@ function requireProvidersRegistry() {
                         'email'
                     ]
                 },
-                async authCallback ({ accessToken, query }) {
+                async authCallback ({ accessToken, grantResponse }) {
+                    const email = grantResponse?.raw?.email;
+                    const userId = grantResponse?.raw?.user_id;
+                    if (!email || !userId) {
+                        throw new Error('VK authentication requires a completed OAuth session');
+                    }
                     const { body } = await bearerGet('https://api.vk.com/method/users.get', accessToken, {
                         qs: {
-                            user_ids: query.raw.user_id,
+                            user_ids: userId,
                             v: '5.122'
                         }
                     });
+                    if (!body.response?.[0]) {
+                        throw new Error('Invalid VK access token');
+                    }
                     return {
                         username: `${body.response[0].last_name} ${body.response[0].first_name}`,
-                        email: query.raw.email
+                        email
                     };
                 }
             },
@@ -234,9 +268,13 @@ function requireProvidersRegistry() {
                             'Client-Id': providers.twitch.key
                         }
                     });
+                    const email = body.data?.[0]?.email;
+                    if (!email) {
+                        throw new Error('Email not verified by Twitch');
+                    }
                     return {
                         username: body.data[0].login,
-                        email: body.data[0].email
+                        email
                     };
                 }
             },
@@ -255,7 +293,10 @@ function requireProvidersRegistry() {
                 async authCallback ({ accessToken }) {
                     const { body: profileBody } = await bearerGet('https://api.linkedin.com/v2/me', accessToken);
                     const { body: emailBody } = await bearerGet('https://api.linkedin.com/v2/emailAddress?q=members&projection=(elements*(handle~))', accessToken);
-                    const email = emailBody.elements[0]['handle~'];
+                    const email = emailBody.elements[0]?.['handle~'];
+                    if (!email?.emailAddress) {
+                        throw new Error('Email not verified by LinkedIn');
+                    }
                     return {
                         username: profileBody.localizedFirstName,
                         email: email.emailAddress
@@ -276,13 +317,19 @@ function requireProvidersRegistry() {
                         'profile'
                     ]
                 },
-                async authCallback ({ query, providers }) {
+                async authCallback ({ providers, grantResponse }) {
                     const jwksUrl = new URL(providers.cognito.jwksurl);
-                    const idToken = query.id_token;
+                    const idToken = grantResponse?.id_token;
+                    if (!idToken) {
+                        throw new Error('Cognito authentication requires a completed OAuth session');
+                    }
                     const tokenPayload = await verifyJwtWithJwks$1({
                         idToken,
                         jwksUrl
                     });
+                    if (tokenPayload.email_verified !== true) {
+                        throw new Error('Email not verified by Cognito');
+                    }
                     return {
                         username: tokenPayload['cognito:username'],
                         email: tokenPayload.email
@@ -328,6 +375,9 @@ function requireProvidersRegistry() {
                 },
                 async authCallback ({ accessToken, providers }) {
                     const { body } = await bearerGet(`https://${providers.auth0.subdomain}.auth0.com/userinfo`, accessToken);
+                    if (body.email && body.email_verified !== true) {
+                        throw new Error('Email not verified by Auth0');
+                    }
                     const username = body.username || body.nickname || body.name || body.email.split('@')[0];
                     const email = body.email || `${username.replace(/\s+/g, '.')}@strapi.io`;
                     return {
@@ -352,9 +402,13 @@ function requireProvidersRegistry() {
                     const { body } = await bearerGet(`https://${providers.cas.subdomain}/oidc/profile`, accessToken);
                     const username = body.attributes ? body.attributes.strapiusername || body.id || body.sub : body.strapiusername || body.id || body.sub;
                     const email = body.attributes ? body.attributes.strapiemail || body.attributes.email : body.strapiemail || body.email;
+                    const emailVerified = body.email_verified ?? body.attributes?.email_verified;
                     if (!username || !email) {
                         strapi.log.warn(`CAS Response Body did not contain required attributes: ${JSON.stringify(body)}`);
                     }
+                    if (email && emailVerified !== true) {
+                        throw new Error('Email not verified by CAS');
+                    }
                     return {
                         username,
                         email
@@ -374,8 +428,11 @@ function requireProvidersRegistry() {
                     ]
                 },
                 async authCallback ({ accessToken }) {
-                    const { body } = await bearerGet('https://www.patreon.com/api/oauth2/v2/identity?fields[user]=full_name,email', accessToken);
+                    const { body } = await bearerGet('https://www.patreon.com/api/oauth2/v2/identity?fields[user]=full_name,email,is_email_verified', accessToken);
                     const patreonData = body.data.attributes;
+                    if (patreonData.is_email_verified !== true) {
+                        throw new Error('Email not verified by Patreon');
+                    }
                     return {
                         username: patreonData.full_name,
                         email: patreonData.email
@@ -398,6 +455,9 @@ function requireProvidersRegistry() {
                 },
                 async authCallback ({ accessToken, providers }) {
                     const { body } = await bearerGet(`https://${providers.keycloak.subdomain}/protocol/openid-connect/userinfo`, accessToken);
+                    if (body.email_verified !== true) {
+                        throw new Error('Email not verified by Keycloak');
+                    }
                     return {
                         username: body.preferred_username,
                         email: body.email
@@ -424,13 +484,14 @@ function requireProvidersRegistry() {
             remove (name) {
                 delete authProviders[name];
             },
-            async run ({ provider, accessToken, query, providers }) {
+            async run ({ provider, accessToken, query, providers, grantResponse }) {
                 const authProvider = authProviders[provider];
                 assert(authProvider, 'Unknown auth provider');
                 return authProvider.authCallback({
                     accessToken,
                     query,
-                    providers
+                    providers,
+                    grantResponse
                 });
             }
         };

package/dist/server/services/providers-registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"providers-registry.js","sources":["../../../server/src/services/providers-registry.js"],"sourcesContent":["'use strict';\n\nconst { strict: assert } = require('assert');\nconst urljoin = require('url-join');\n\nconst { verifyJwtWithJwks } = require('../utils/verify-jwt-with-jwks');\nconst { bearerGet, fetchJson } = require('../utils/provider-http');\n\nconst initProviders = ({ baseURL }) => ({\n  email: {\n    enabled: true,\n    icon: 'envelope',\n    grantConfig: {},\n  },\n  discord: {\n    enabled: false,\n    icon: 'discord',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/discord/callback`,\n      scope: ['identify', 'email'],\n    },\n    async authCallback({ accessToken }) {\n      const { body } = await bearerGet('https://discord.com/api/users/@me', accessToken);\n      const username =\n        body.discriminator && body.discriminator !== '0'\n          ? `${body.username}#${body.discriminator}`\n          : body.username;\n      return {\n        username,\n        email: body.email,\n      };\n    },\n  },\n  facebook: {\n    enabled: false,\n    icon: 'facebook-square',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/facebook/callback`,\n      scope: ['email'],\n    },\n    async authCallback({ accessToken }) {\n      const { body } = await bearerGet('https://graph.facebook.com/me', accessToken, {\n        qs: { fields: 'name,email' },\n      });\n      return {\n        username: body.name,\n        email: body.email,\n      };\n    },\n  },\n  google: {\n    enabled: false,\n    icon: 'google',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/google/callback`,\n      scope: ['email'],\n    },\n    async authCallback({ accessToken }) {\n      const { body } = await fetchJson(\n        `https://oauth2.googleapis.com/tokeninfo?access_token=${encodeURIComponent(accessToken)}`\n      );\n      return {\n        username: body.email.split('@')[0],\n        email: body.email,\n      };\n    },\n  },\n  github: {\n    enabled: false,\n    icon: 'github',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/github/callback`,\n      scope: ['user', 'user:email'],\n    },\n    async authCallback({ accessToken }) {\n      const { body: userBody } = await bearerGet('https://api.github.com/user', accessToken, {\n        headers: { 'user-agent': 'strapi' },\n      });\n\n      if (userBody.email) {\n        return {\n          username: userBody.login,\n          email: userBody.email,\n        };\n      }\n\n      const { body: emailBody } = await bearerGet(\n        'https://api.github.com/user/emails',\n        accessToken,\n        {\n          headers: { 'user-agent': 'strapi' },\n        }\n      );\n\n      return {\n        username: userBody.login,\n        email: Array.isArray(emailBody)\n          ? emailBody.find((email) => email.primary === true).email\n          : null,\n      };\n    },\n  },\n  microsoft: {\n    enabled: false,\n    icon: 'windows',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/microsoft/callback`,\n      scope: ['user.read'],\n    },\n    async authCallback({ accessToken }) {\n      const { body } = await bearerGet('https://graph.microsoft.com/v1.0/me', accessToken);\n      return {\n        username: body.userPrincipalName,\n        email: body.userPrincipalName,\n      };\n    },\n  },\n\n  twitter: {\n    enabled: false,\n    icon: 'twitter',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/twitter/callback`,\n    },\n    async authCallback({ accessToken, query, providers }) {\n      const { twitterGet } = require('../utils/oauth-connect/oauth1');\n      const { body } = await twitterGet({\n        url: 'https://api.twitter.com/1.1/account/verify_credentials.json',\n        accessToken,\n        accessCredential: query.access_secret,\n        consumerKey: providers.twitter.key,\n        clientCredential: providers.twitter.secret,\n        qs: { include_email: 'true', screen_name: query['raw[screen_name]'] },\n      });\n\n      return {\n        username: body.screen_name,\n        email: body.email,\n      };\n    },\n  },\n  instagram: {\n    enabled: false,\n    icon: 'instagram',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/instagram/callback`,\n      scope: ['user_profile'],\n    },\n    async authCallback({ accessToken }) {\n      const { body } = await bearerGet('https://graph.instagram.com/me', accessToken, {\n        qs: { fields: 'id,username' },\n      });\n      return {\n        username: body.username,\n        email: `${body.username}@strapi.io`,\n      };\n    },\n  },\n  vk: {\n    enabled: false,\n    icon: 'vk',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/vk/callback`,\n      scope: ['email'],\n    },\n    async authCallback({ accessToken, query }) {\n      const { body } = await bearerGet('https://api.vk.com/method/users.get', accessToken, {\n        qs: { user_ids: query.raw.user_id, v: '5.122' },\n      });\n      return {\n        username: `${body.response[0].last_name} ${body.response[0].first_name}`,\n        email: query.raw.email,\n      };\n    },\n  },\n\n  twitch: {\n    enabled: false,\n    icon: 'twitch',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/twitch/callback`,\n      scope: ['user:read:email'],\n    },\n    async authCallback({ accessToken, providers }) {\n      const { body } = await bearerGet('https://api.twitch.tv/helix/users', accessToken, {\n        headers: {\n          'Client-Id': providers.twitch.key,\n        },\n      });\n      return {\n        username: body.data[0].login,\n        email: body.data[0].email,\n      };\n    },\n  },\n\n  linkedin: {\n    enabled: false,\n    icon: 'linkedin',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/linkedin/callback`,\n      scope: ['r_liteprofile', 'r_emailaddress'],\n    },\n    async authCallback({ accessToken }) {\n      const { body: profileBody } = await bearerGet('https://api.linkedin.com/v2/me', accessToken);\n      const { body: emailBody } = await bearerGet(\n        'https://api.linkedin.com/v2/emailAddress?q=members&projection=(elements*(handle~))',\n        accessToken\n      );\n\n      const email = emailBody.elements[0]['handle~'];\n\n      return {\n        username: profileBody.localizedFirstName,\n        email: email.emailAddress,\n      };\n    },\n  },\n\n  cognito: {\n    enabled: false,\n    icon: 'aws',\n    grantConfig: {\n      key: '',\n      secret: '',\n      subdomain: 'my.subdomain.com',\n      callback: `${baseURL}/cognito/callback`,\n      scope: ['email', 'openid', 'profile'],\n    },\n    async authCallback({ query, providers }) {\n      const jwksUrl = new URL(providers.cognito.jwksurl);\n      const idToken = query.id_token;\n      const tokenPayload = await verifyJwtWithJwks({ idToken, jwksUrl });\n      return {\n        username: tokenPayload['cognito:username'],\n        email: tokenPayload.email,\n      };\n    },\n  },\n\n  reddit: {\n    enabled: false,\n    icon: 'reddit',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callback: `${baseURL}/reddit/callback`,\n      scope: ['identity'],\n    },\n    async authCallback({ accessToken }) {\n      const { body } = await bearerGet('https://oauth.reddit.com/api/v1/me', accessToken, {\n        headers: { 'user-agent': 'strapi' },\n      });\n      return {\n        username: body.name,\n        email: `${body.name}@strapi.io`,\n      };\n    },\n  },\n\n  auth0: {\n    enabled: false,\n    icon: '',\n    grantConfig: {\n      key: '',\n      secret: '',\n      subdomain: 'my-tenant.eu',\n      callback: `${baseURL}/auth0/callback`,\n      scope: ['openid', 'email', 'profile'],\n    },\n    async authCallback({ accessToken, providers }) {\n      const { body } = await bearerGet(\n        `https://${providers.auth0.subdomain}.auth0.com/userinfo`,\n        accessToken\n      );\n      const username = body.username || body.nickname || body.name || body.email.split('@')[0];\n      const email = body.email || `${username.replace(/\\s+/g, '.')}@strapi.io`;\n\n      return {\n        username,\n        email,\n      };\n    },\n  },\n\n  cas: {\n    enabled: false,\n    icon: 'book',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callback: `${baseURL}/cas/callback`,\n      scope: ['openid email'],\n      subdomain: 'my.subdomain.com/cas',\n    },\n    async authCallback({ accessToken, providers }) {\n      const { body } = await bearerGet(\n        `https://${providers.cas.subdomain}/oidc/profile`,\n        accessToken\n      );\n      const username = body.attributes\n        ? body.attributes.strapiusername || body.id || body.sub\n        : body.strapiusername || body.id || body.sub;\n      const email = body.attributes\n        ? body.attributes.strapiemail || body.attributes.email\n        : body.strapiemail || body.email;\n      if (!username || !email) {\n        strapi.log.warn(\n          `CAS Response Body did not contain required attributes: ${JSON.stringify(body)}`\n        );\n      }\n      return {\n        username,\n        email,\n      };\n    },\n  },\n\n  patreon: {\n    enabled: false,\n    icon: '',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callback: `${baseURL}/patreon/callback`,\n      scope: ['identity', 'identity[email]'],\n    },\n    async authCallback({ accessToken }) {\n      const { body } = await bearerGet(\n        'https://www.patreon.com/api/oauth2/v2/identity?fields[user]=full_name,email',\n        accessToken\n      );\n      const patreonData = body.data.attributes;\n      return {\n        username: patreonData.full_name,\n        email: patreonData.email,\n      };\n    },\n  },\n  keycloak: {\n    enabled: false,\n    icon: '',\n    grantConfig: {\n      key: '',\n      secret: '',\n      subdomain: 'myKeycloakProvider.com/realms/myrealm',\n      callback: `${baseURL}/keycloak/callback`,\n      scope: ['openid', 'email', 'profile'],\n    },\n    async authCallback({ accessToken, providers }) {\n      const { body } = await bearerGet(\n        `https://${providers.keycloak.subdomain}/protocol/openid-connect/userinfo`,\n        accessToken\n      );\n      return {\n        username: body.preferred_username,\n        email: body.email,\n      };\n    },\n  },\n});\n\nmodule.exports = () => {\n  const apiPrefix = strapi.config.get('api.rest.prefix');\n  const baseURL = urljoin(strapi.config.server.url, apiPrefix, 'auth');\n\n  const authProviders = initProviders({ baseURL });\n\n  return {\n    getAll() {\n      return authProviders;\n    },\n    get(name) {\n      return authProviders[name];\n    },\n    add(name, config) {\n      authProviders[name] = config;\n    },\n    remove(name) {\n      delete authProviders[name];\n    },\n\n    async run({ provider, accessToken, query, providers }) {\n      const authProvider = authProviders[provider];\n\n      assert(authProvider, 'Unknown auth provider');\n\n      return authProvider.authCallback({ accessToken, query, providers });\n    },\n  };\n};\n"],"names":["strict","assert","require$$0","urljoin","require$$1","verifyJwtWithJwks","require$$2","bearerGet","fetchJson","require$$3","initProviders","baseURL","email","enabled","icon","grantConfig","discord","key","secret","callbackUrl","scope","authCallback","accessToken","body","username","discriminator","facebook","qs","fields","name","google","encodeURIComponent","split","github","userBody","headers","login","emailBody","Array","isArray","find","primary","microsoft","userPrincipalName","twitter","query","providers","twitterGet","require$$4","url","accessCredential","access_secret","consumerKey","clientCredential","include_email","screen_name","instagram","vk","user_ids","raw","user_id","v","response","last_name","first_name","twitch","data","linkedin","profileBody","elements","localizedFirstName","emailAddress","cognito","subdomain","callback","jwksUrl","URL","jwksurl","idToken","id_token","tokenPayload","reddit","auth0","nickname","replace","cas","attributes","strapiusername","id","sub","strapiemail","strapi","log","warn","JSON","stringify","patreon","patreonData","full_name","keycloak","preferred_username","providersRegistry","apiPrefix","config","get","server","authProviders","getAll","add","remove","run","provider","authProvider"],"mappings":";;;;;;;;;;;;;;;;;;AAEA,IAAA,MAAM,EAAEA,MAAAA,EAAQC,MAAM,EAAE,GAAGC,2BAAAA;AAC3B,IAAA,MAAMC,OAAAA,GAAUC,2BAAAA;IAEhB,MAAM,qBAAEC,mBAAiB,EAAE,GAAGC,2BAAAA,EAAAA;AAC9B,IAAA,MAAM,EAAEC,SAAS,EAAEC,SAAS,EAAE,GAAGC,sBAAAA,EAAAA;AAEjC,IAAA,MAAMC,gBAAgB,CAAC,EAAEC,OAAO,EAAE,IAAM;YACtCC,KAAAA,EAAO;gBACLC,OAAAA,EAAS,IAAA;gBACTC,IAAAA,EAAM,UAAA;AACNC,gBAAAA,WAAAA,EAAa;AACjB,aAAA;YACEC,OAAAA,EAAS;gBACPH,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,SAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGR,OAAAA,CAAQ,iBAAiB,CAAC;oBAC1CS,KAAAA,EAAO;AAAC,wBAAA,UAAA;AAAY,wBAAA;AAAQ;AAClC,iBAAA;gBACI,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE,EAAA;AAChC,oBAAA,MAAM,EAAEC,IAAI,EAAE,GAAG,MAAMhB,UAAU,mCAAA,EAAqCe,WAAAA,CAAAA;AACtE,oBAAA,MAAME,WACJD,IAAAA,CAAKE,aAAa,IAAIF,IAAAA,CAAKE,aAAa,KAAK,GAAA,GACzC,CAAA,EAAGF,KAAKC,QAAQ,CAAC,CAAC,EAAED,IAAAA,CAAKE,aAAa,CAAA,CAAC,GACvCF,KAAKC,QAAQ;oBACnB,OAAO;AACLA,wBAAAA,QAAAA;AACAZ,wBAAAA,KAAAA,EAAOW,KAAKX;AACpB,qBAAA;AACA,gBAAA;AACA,aAAA;YACEc,QAAAA,EAAU;gBACRb,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,iBAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGR,OAAAA,CAAQ,kBAAkB,CAAC;oBAC3CS,KAAAA,EAAO;AAAC,wBAAA;AAAQ;AACtB,iBAAA;gBACI,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE,EAAA;AAChC,oBAAA,MAAM,EAAEC,IAAI,EAAE,GAAG,MAAMhB,SAAAA,CAAU,iCAAiCe,WAAAA,EAAa;wBAC7EK,EAAAA,EAAI;4BAAEC,MAAAA,EAAQ;AAAY;AAClC,qBAAA,CAAA;oBACM,OAAO;AACLJ,wBAAAA,QAAAA,EAAUD,KAAKM,IAAI;AACnBjB,wBAAAA,KAAAA,EAAOW,KAAKX;AACpB,qBAAA;AACA,gBAAA;AACA,aAAA;YACEkB,MAAAA,EAAQ;gBACNjB,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,QAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGR,OAAAA,CAAQ,gBAAgB,CAAC;oBACzCS,KAAAA,EAAO;AAAC,wBAAA;AAAQ;AACtB,iBAAA;gBACI,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE,EAAA;oBAChC,MAAM,EAAEC,IAAI,EAAE,GAAG,MAAMf,UACrB,CAAC,qDAAqD,EAAEuB,kBAAAA,CAAmBT,WAAAA,CAAAA,CAAAA,CAAa,CAAA;oBAE1F,OAAO;AACLE,wBAAAA,QAAAA,EAAUD,KAAKX,KAAK,CAACoB,KAAK,CAAC,GAAA,CAAI,CAAC,CAAA,CAAE;AAClCpB,wBAAAA,KAAAA,EAAOW,KAAKX;AACpB,qBAAA;AACA,gBAAA;AACA,aAAA;YACEqB,MAAAA,EAAQ;gBACNpB,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,QAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGR,OAAAA,CAAQ,gBAAgB,CAAC;oBACzCS,KAAAA,EAAO;AAAC,wBAAA,MAAA;AAAQ,wBAAA;AAAa;AACnC,iBAAA;gBACI,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE,EAAA;oBAChC,MAAM,EAAEC,MAAMW,QAAQ,EAAE,GAAG,MAAM3B,SAAAA,CAAU,+BAA+Be,WAAAA,EAAa;wBACrFa,OAAAA,EAAS;4BAAE,YAAA,EAAc;AAAQ;AACzC,qBAAA,CAAA;oBAEM,IAAID,QAAAA,CAAStB,KAAK,EAAE;wBAClB,OAAO;AACLY,4BAAAA,QAAAA,EAAUU,SAASE,KAAK;AACxBxB,4BAAAA,KAAAA,EAAOsB,SAAStB;AAC1B,yBAAA;AACA,oBAAA;oBAEM,MAAM,EAAEW,MAAMc,SAAS,EAAE,GAAG,MAAM9B,SAAAA,CAChC,sCACAe,WAAAA,EACA;wBACEa,OAAAA,EAAS;4BAAE,YAAA,EAAc;AAAQ;AAC3C,qBAAA,CAAA;oBAGM,OAAO;AACLX,wBAAAA,QAAAA,EAAUU,SAASE,KAAK;AACxBxB,wBAAAA,KAAAA,EAAO0B,KAAAA,CAAMC,OAAO,CAACF,SAAAA,CAAAA,GACjBA,UAAUG,IAAI,CAAC,CAAC5B,KAAAA,GAAUA,KAAAA,CAAM6B,OAAO,KAAK,IAAA,CAAA,CAAM7B,KAAA,GAClD;AACZ,qBAAA;AACA,gBAAA;AACA,aAAA;YACE8B,SAAAA,EAAW;gBACT7B,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,SAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGR,OAAAA,CAAQ,mBAAmB,CAAC;oBAC5CS,KAAAA,EAAO;AAAC,wBAAA;AAAY;AAC1B,iBAAA;gBACI,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE,EAAA;AAChC,oBAAA,MAAM,EAAEC,IAAI,EAAE,GAAG,MAAMhB,UAAU,qCAAA,EAAuCe,WAAAA,CAAAA;oBACxE,OAAO;AACLE,wBAAAA,QAAAA,EAAUD,KAAKoB,iBAAiB;AAChC/B,wBAAAA,KAAAA,EAAOW,KAAKoB;AACpB,qBAAA;AACA,gBAAA;AACA,aAAA;YAEEC,OAAAA,EAAS;gBACP/B,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,SAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGR,OAAAA,CAAQ,iBAAiB;AAC/C,iBAAA;AACI,gBAAA,MAAMU,cAAa,EAAEC,WAAW,EAAEuB,KAAK,EAAEC,SAAS,EAAE,EAAA;oBAClD,MAAM,EAAEC,UAAU,EAAE,GAAGC,gBAAAA,EAAAA;AACvB,oBAAA,MAAM,EAAEzB,IAAI,EAAE,GAAG,MAAMwB,UAAAA,CAAW;wBAChCE,GAAAA,EAAK,6DAAA;AACL3B,wBAAAA,WAAAA;AACA4B,wBAAAA,gBAAAA,EAAkBL,MAAMM,aAAa;wBACrCC,WAAAA,EAAaN,SAAAA,CAAUF,OAAO,CAAC3B,GAAG;wBAClCoC,gBAAAA,EAAkBP,SAAAA,CAAUF,OAAO,CAAC1B,MAAM;wBAC1CS,EAAAA,EAAI;4BAAE2B,aAAAA,EAAe,MAAA;4BAAQC,WAAAA,EAAaV,KAAK,CAAC,kBAAA;AAAmB;AAC3E,qBAAA,CAAA;oBAEM,OAAO;AACLrB,wBAAAA,QAAAA,EAAUD,KAAKgC,WAAW;AAC1B3C,wBAAAA,KAAAA,EAAOW,KAAKX;AACpB,qBAAA;AACA,gBAAA;AACA,aAAA;YACE4C,SAAAA,EAAW;gBACT3C,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,WAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGR,OAAAA,CAAQ,mBAAmB,CAAC;oBAC5CS,KAAAA,EAAO;AAAC,wBAAA;AAAe;AAC7B,iBAAA;gBACI,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE,EAAA;AAChC,oBAAA,MAAM,EAAEC,IAAI,EAAE,GAAG,MAAMhB,SAAAA,CAAU,kCAAkCe,WAAAA,EAAa;wBAC9EK,EAAAA,EAAI;4BAAEC,MAAAA,EAAQ;AAAa;AACnC,qBAAA,CAAA;oBACM,OAAO;AACLJ,wBAAAA,QAAAA,EAAUD,KAAKC,QAAQ;AACvBZ,wBAAAA,KAAAA,EAAO,CAAA,EAAGW,IAAAA,CAAKC,QAAQ,CAAC,UAAU;AAC1C,qBAAA;AACA,gBAAA;AACA,aAAA;YACEiC,EAAAA,EAAI;gBACF5C,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,IAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGR,OAAAA,CAAQ,YAAY,CAAC;oBACrCS,KAAAA,EAAO;AAAC,wBAAA;AAAQ;AACtB,iBAAA;AACI,gBAAA,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAEuB,KAAK,EAAE,EAAA;AACvC,oBAAA,MAAM,EAAEtB,IAAI,EAAE,GAAG,MAAMhB,SAAAA,CAAU,uCAAuCe,WAAAA,EAAa;wBACnFK,EAAAA,EAAI;4BAAE+B,QAAAA,EAAUb,KAAAA,CAAMc,GAAG,CAACC,OAAO;4BAAEC,CAAAA,EAAG;AAAO;AACrD,qBAAA,CAAA;oBACM,OAAO;AACLrC,wBAAAA,QAAAA,EAAU,GAAGD,IAAAA,CAAKuC,QAAQ,CAAC,CAAA,CAAE,CAACC,SAAS,CAAC,CAAC,EAAExC,KAAKuC,QAAQ,CAAC,CAAA,CAAE,CAACE,UAAU,CAAA,CAAE;wBACxEpD,KAAAA,EAAOiC,KAAAA,CAAMc,GAAG,CAAC/C;AACzB,qBAAA;AACA,gBAAA;AACA,aAAA;YAEEqD,MAAAA,EAAQ;gBACNpD,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,QAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGR,OAAAA,CAAQ,gBAAgB,CAAC;oBACzCS,KAAAA,EAAO;AAAC,wBAAA;AAAkB;AAChC,iBAAA;AACI,gBAAA,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAEwB,SAAS,EAAE,EAAA;AAC3C,oBAAA,MAAM,EAAEvB,IAAI,EAAE,GAAG,MAAMhB,SAAAA,CAAU,qCAAqCe,WAAAA,EAAa;wBACjFa,OAAAA,EAAS;4BACP,WAAA,EAAaW,SAAAA,CAAUmB,MAAM,CAAChD;AACxC;AACA,qBAAA,CAAA;oBACM,OAAO;AACLO,wBAAAA,QAAAA,EAAUD,IAAAA,CAAK2C,IAAI,CAAC,CAAA,CAAE,CAAC9B,KAAK;AAC5BxB,wBAAAA,KAAAA,EAAOW,IAAAA,CAAK2C,IAAI,CAAC,CAAA,CAAE,CAACtD;AAC5B,qBAAA;AACA,gBAAA;AACA,aAAA;YAEEuD,QAAAA,EAAU;gBACRtD,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,UAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGR,OAAAA,CAAQ,kBAAkB,CAAC;oBAC3CS,KAAAA,EAAO;AAAC,wBAAA,eAAA;AAAiB,wBAAA;AAAiB;AAChD,iBAAA;gBACI,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE,EAAA;AAChC,oBAAA,MAAM,EAAEC,IAAAA,EAAM6C,WAAW,EAAE,GAAG,MAAM7D,UAAU,gCAAA,EAAkCe,WAAAA,CAAAA;AAChF,oBAAA,MAAM,EAAEC,IAAAA,EAAMc,SAAS,EAAE,GAAG,MAAM9B,UAChC,oFAAA,EACAe,WAAAA,CAAAA;AAGF,oBAAA,MAAMV,QAAQyB,SAAAA,CAAUgC,QAAQ,CAAC,CAAA,CAAE,CAAC,SAAA,CAAU;oBAE9C,OAAO;AACL7C,wBAAAA,QAAAA,EAAU4C,YAAYE,kBAAkB;AACxC1D,wBAAAA,KAAAA,EAAOA,MAAM2D;AACrB,qBAAA;AACA,gBAAA;AACA,aAAA;YAEEC,OAAAA,EAAS;gBACP3D,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,KAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRuD,SAAAA,EAAW,kBAAA;oBACXC,QAAAA,EAAU,CAAA,EAAG/D,OAAAA,CAAQ,iBAAiB,CAAC;oBACvCS,KAAAA,EAAO;AAAC,wBAAA,OAAA;AAAS,wBAAA,QAAA;AAAU,wBAAA;AAAU;AAC3C,iBAAA;AACI,gBAAA,MAAMC,YAAAA,CAAAA,CAAa,EAAEwB,KAAK,EAAEC,SAAS,EAAE,EAAA;AACrC,oBAAA,MAAM6B,UAAU,IAAIC,GAAAA,CAAI9B,SAAAA,CAAU0B,OAAO,CAACK,OAAO,CAAA;oBACjD,MAAMC,OAAAA,GAAUjC,MAAMkC,QAAQ;oBAC9B,MAAMC,YAAAA,GAAe,MAAM3E,mBAAAA,CAAkB;AAAEyE,wBAAAA,OAAAA;AAASH,wBAAAA;AAAO,qBAAA,CAAA;oBAC/D,OAAO;wBACLnD,QAAAA,EAAUwD,YAAY,CAAC,kBAAA,CAAmB;AAC1CpE,wBAAAA,KAAAA,EAAOoE,aAAapE;AAC5B,qBAAA;AACA,gBAAA;AACA,aAAA;YAEEqE,MAAAA,EAAQ;gBACNpE,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,QAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRwD,QAAAA,EAAU,CAAA,EAAG/D,OAAAA,CAAQ,gBAAgB,CAAC;oBACtCS,KAAAA,EAAO;AAAC,wBAAA;AAAW;AACzB,iBAAA;gBACI,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE,EAAA;AAChC,oBAAA,MAAM,EAAEC,IAAI,EAAE,GAAG,MAAMhB,SAAAA,CAAU,sCAAsCe,WAAAA,EAAa;wBAClFa,OAAAA,EAAS;4BAAE,YAAA,EAAc;AAAQ;AACzC,qBAAA,CAAA;oBACM,OAAO;AACLX,wBAAAA,QAAAA,EAAUD,KAAKM,IAAI;AACnBjB,wBAAAA,KAAAA,EAAO,CAAA,EAAGW,IAAAA,CAAKM,IAAI,CAAC,UAAU;AACtC,qBAAA;AACA,gBAAA;AACA,aAAA;YAEEqD,KAAAA,EAAO;gBACLrE,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,EAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRuD,SAAAA,EAAW,cAAA;oBACXC,QAAAA,EAAU,CAAA,EAAG/D,OAAAA,CAAQ,eAAe,CAAC;oBACrCS,KAAAA,EAAO;AAAC,wBAAA,QAAA;AAAU,wBAAA,OAAA;AAAS,wBAAA;AAAU;AAC3C,iBAAA;AACI,gBAAA,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAEwB,SAAS,EAAE,EAAA;AAC3C,oBAAA,MAAM,EAAEvB,IAAI,EAAE,GAAG,MAAMhB,UACrB,CAAC,QAAQ,EAAEuC,SAAAA,CAAUoC,KAAK,CAACT,SAAS,CAAC,mBAAmB,CAAC,EACzDnD,WAAAA,CAAAA;AAEF,oBAAA,MAAME,WAAWD,IAAAA,CAAKC,QAAQ,IAAID,IAAAA,CAAK4D,QAAQ,IAAI5D,IAAAA,CAAKM,IAAI,IAAIN,KAAKX,KAAK,CAACoB,KAAK,CAAC,GAAA,CAAI,CAAC,CAAA,CAAE;oBACxF,MAAMpB,KAAAA,GAAQW,IAAAA,CAAKX,KAAK,IAAI,CAAA,EAAGY,QAAAA,CAAS4D,OAAO,CAAC,MAAA,EAAQ,GAAA,CAAA,CAAK,UAAU,CAAC;oBAExE,OAAO;AACL5D,wBAAAA,QAAAA;AACAZ,wBAAAA;AACR,qBAAA;AACA,gBAAA;AACA,aAAA;YAEEyE,GAAAA,EAAK;gBACHxE,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,MAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRwD,QAAAA,EAAU,CAAA,EAAG/D,OAAAA,CAAQ,aAAa,CAAC;oBACnCS,KAAAA,EAAO;AAAC,wBAAA;AAAe,qBAAA;oBACvBqD,SAAAA,EAAW;AACjB,iBAAA;AACI,gBAAA,MAAMpD,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAEwB,SAAS,EAAE,EAAA;AAC3C,oBAAA,MAAM,EAAEvB,IAAI,EAAE,GAAG,MAAMhB,UACrB,CAAC,QAAQ,EAAEuC,SAAAA,CAAUuC,GAAG,CAACZ,SAAS,CAAC,aAAa,CAAC,EACjDnD,WAAAA,CAAAA;oBAEF,MAAME,QAAAA,GAAWD,KAAK+D,UAAA,GAClB/D,KAAK+D,UAAU,CAACC,cAAc,IAAIhE,IAAAA,CAAKiE,EAAE,IAAIjE,IAAAA,CAAKkE,GAAA,GAClDlE,IAAAA,CAAKgE,cAAc,IAAIhE,IAAAA,CAAKiE,EAAE,IAAIjE,IAAAA,CAAKkE,GAAG;AAC9C,oBAAA,MAAM7E,QAAQW,IAAAA,CAAK+D,UAAA,GACf/D,IAAAA,CAAK+D,UAAU,CAACI,WAAW,IAAInE,IAAAA,CAAK+D,UAAU,CAAC1E,KAAA,GAC/CW,KAAKmE,WAAW,IAAInE,KAAKX,KAAK;oBAClC,IAAI,CAACY,QAAAA,IAAY,CAACZ,KAAAA,EAAO;wBACvB+E,MAAAA,CAAOC,GAAG,CAACC,IAAI,CACb,CAAC,uDAAuD,EAAEC,IAAAA,CAAKC,SAAS,CAACxE,IAAAA,CAAAA,CAAAA,CAAM,CAAA;AAEzF,oBAAA;oBACM,OAAO;AACLC,wBAAAA,QAAAA;AACAZ,wBAAAA;AACR,qBAAA;AACA,gBAAA;AACA,aAAA;YAEEoF,OAAAA,EAAS;gBACPnF,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,EAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRwD,QAAAA,EAAU,CAAA,EAAG/D,OAAAA,CAAQ,iBAAiB,CAAC;oBACvCS,KAAAA,EAAO;AAAC,wBAAA,UAAA;AAAY,wBAAA;AAAkB;AAC5C,iBAAA;gBACI,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE,EAAA;AAChC,oBAAA,MAAM,EAAEC,IAAI,EAAE,GAAG,MAAMhB,UACrB,6EAAA,EACAe,WAAAA,CAAAA;AAEF,oBAAA,MAAM2E,WAAAA,GAAc1E,IAAAA,CAAK2C,IAAI,CAACoB,UAAU;oBACxC,OAAO;AACL9D,wBAAAA,QAAAA,EAAUyE,YAAYC,SAAS;AAC/BtF,wBAAAA,KAAAA,EAAOqF,YAAYrF;AAC3B,qBAAA;AACA,gBAAA;AACA,aAAA;YACEuF,QAAAA,EAAU;gBACRtF,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,EAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRuD,SAAAA,EAAW,uCAAA;oBACXC,QAAAA,EAAU,CAAA,EAAG/D,OAAAA,CAAQ,kBAAkB,CAAC;oBACxCS,KAAAA,EAAO;AAAC,wBAAA,QAAA;AAAU,wBAAA,OAAA;AAAS,wBAAA;AAAU;AAC3C,iBAAA;AACI,gBAAA,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAEwB,SAAS,EAAE,EAAA;AAC3C,oBAAA,MAAM,EAAEvB,IAAI,EAAE,GAAG,MAAMhB,UACrB,CAAC,QAAQ,EAAEuC,SAAAA,CAAUqD,QAAQ,CAAC1B,SAAS,CAAC,iCAAiC,CAAC,EAC1EnD,WAAAA,CAAAA;oBAEF,OAAO;AACLE,wBAAAA,QAAAA,EAAUD,KAAK6E,kBAAkB;AACjCxF,wBAAAA,KAAAA,EAAOW,KAAKX;AACpB,qBAAA;AACA,gBAAA;AACA;SACA,CAAA;IAEAyF,iBAAAA,GAAiB,IAAA;AACf,QAAA,MAAMC,SAAAA,GAAYX,MAAAA,CAAOY,MAAM,CAACC,GAAG,CAAC,iBAAA,CAAA;QACpC,MAAM7F,OAAAA,GAAUR,QAAQwF,MAAAA,CAAOY,MAAM,CAACE,MAAM,CAACxD,GAAG,EAAEqD,SAAAA,EAAW,MAAA,CAAA;AAE7D,QAAA,MAAMI,gBAAgBhG,aAAAA,CAAc;AAAEC,YAAAA;;QAEtC,OAAO;AACLgG,YAAAA,MAAAA,CAAAA,GAAAA;gBACE,OAAOD,aAAAA;AACb,YAAA,CAAA;AACIF,YAAAA,GAAAA,CAAAA,CAAI3E,IAAI,EAAA;gBACN,OAAO6E,aAAa,CAAC7E,IAAAA,CAAK;AAChC,YAAA,CAAA;YACI+E,GAAAA,CAAAA,CAAI/E,IAAI,EAAE0E,MAAM,EAAA;gBACdG,aAAa,CAAC7E,KAAK,GAAG0E,MAAAA;AAC5B,YAAA,CAAA;AACIM,YAAAA,MAAAA,CAAAA,CAAOhF,IAAI,EAAA;gBACT,OAAO6E,aAAa,CAAC7E,IAAAA,CAAK;AAChC,YAAA,CAAA;YAEI,MAAMiF,GAAAA,CAAAA,CAAI,EAAEC,QAAQ,EAAEzF,WAAW,EAAEuB,KAAK,EAAEC,SAAS,EAAE,EAAA;gBACnD,MAAMkE,YAAAA,GAAeN,aAAa,CAACK,QAAAA,CAAS;AAE5C9G,gBAAAA,MAAAA,CAAO+G,YAAAA,EAAc,uBAAA,CAAA;gBAErB,OAAOA,YAAAA,CAAa3F,YAAY,CAAC;AAAEC,oBAAAA,WAAAA;AAAauB,oBAAAA,KAAAA;AAAOC,oBAAAA;AAAS,iBAAA,CAAA;AACtE,YAAA;AACA,SAAA;AACA,IAAA,CAAA;;;;;;"}
+{"version":3,"file":"providers-registry.js","sources":["../../../server/src/services/providers-registry.js"],"sourcesContent":["'use strict';\n\nconst { strict: assert } = require('assert');\nconst urljoin = require('url-join');\n\nconst { verifyJwtWithJwks } = require('../utils/verify-jwt-with-jwks');\nconst { bearerGet, fetchJson } = require('../utils/provider-http');\n\nconst initProviders = ({ baseURL }) => ({\n  email: {\n    enabled: true,\n    icon: 'envelope',\n    grantConfig: {},\n  },\n  discord: {\n    enabled: false,\n    icon: 'discord',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/discord/callback`,\n      scope: ['identify', 'email'],\n    },\n    async authCallback({ accessToken }) {\n      const { body } = await bearerGet('https://discord.com/api/users/@me', accessToken);\n      if (body.verified !== true) {\n        throw new Error('Email not verified by Discord');\n      }\n      const username =\n        body.discriminator && body.discriminator !== '0'\n          ? `${body.username}#${body.discriminator}`\n          : body.username;\n      return {\n        username,\n        email: body.email,\n      };\n    },\n  },\n  facebook: {\n    enabled: false,\n    icon: 'facebook-square',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/facebook/callback`,\n      scope: ['email'],\n    },\n    async authCallback({ accessToken }) {\n      const { body } = await bearerGet('https://graph.facebook.com/me', accessToken, {\n        qs: { fields: 'name,email' },\n      });\n      if (!body.email) {\n        throw new Error('Email not verified by Facebook');\n      }\n      return {\n        username: body.name,\n        email: body.email,\n      };\n    },\n  },\n  google: {\n    enabled: false,\n    icon: 'google',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/google/callback`,\n      scope: ['email'],\n    },\n    async authCallback({ accessToken }) {\n      const { body } = await fetchJson(\n        `https://oauth2.googleapis.com/tokeninfo?access_token=${encodeURIComponent(accessToken)}`\n      );\n      const verified = body.verified_email ?? body.email_verified;\n      if (verified !== true && verified !== 'true') {\n        throw new Error('Email not verified by Google');\n      }\n      return {\n        username: body.email.split('@')[0],\n        email: body.email,\n      };\n    },\n  },\n  github: {\n    enabled: false,\n    icon: 'github',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/github/callback`,\n      scope: ['user', 'user:email'],\n    },\n    async authCallback({ accessToken }) {\n      const { body: userBody } = await bearerGet('https://api.github.com/user', accessToken, {\n        headers: { 'user-agent': 'strapi' },\n      });\n\n      const { body: emailBody } = await bearerGet(\n        'https://api.github.com/user/emails',\n        accessToken,\n        {\n          headers: { 'user-agent': 'strapi' },\n        }\n      );\n\n      if (userBody.email) {\n        const verifiedPublicEmail = Array.isArray(emailBody)\n          ? emailBody.find((entry) => entry.email === userBody.email && entry.verified === true)\n          : null;\n\n        if (!verifiedPublicEmail) {\n          throw new Error('Email not verified by GitHub');\n        }\n\n        return {\n          username: userBody.login,\n          email: userBody.email,\n        };\n      }\n\n      const primaryEmail = Array.isArray(emailBody)\n        ? emailBody.find((email) => email.primary === true)\n        : null;\n\n      if (!primaryEmail || primaryEmail.verified !== true) {\n        throw new Error('Email not verified by GitHub');\n      }\n\n      return {\n        username: userBody.login,\n        email: primaryEmail.email,\n      };\n    },\n  },\n  microsoft: {\n    enabled: false,\n    icon: 'windows',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/microsoft/callback`,\n      scope: ['user.read'],\n    },\n    async authCallback({ accessToken }) {\n      const { body } = await bearerGet('https://graph.microsoft.com/v1.0/me', accessToken);\n      return {\n        username: body.userPrincipalName,\n        email: body.userPrincipalName,\n      };\n    },\n  },\n\n  twitter: {\n    enabled: false,\n    icon: 'twitter',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/twitter/callback`,\n    },\n    async authCallback({ accessToken, providers, grantResponse }) {\n      const accessSecret = grantResponse?.access_secret;\n      const screenName = grantResponse?.raw?.screen_name;\n\n      if (!accessSecret) {\n        throw new Error('Twitter authentication requires a completed OAuth session');\n      }\n\n      const { twitterGet } = require('../utils/oauth-connect/oauth1');\n      const { body } = await twitterGet({\n        url: 'https://api.twitter.com/1.1/account/verify_credentials.json',\n        accessToken,\n        accessCredential: accessSecret,\n        consumerKey: providers.twitter.key,\n        clientCredential: providers.twitter.secret,\n        qs: { include_email: 'true', screen_name: screenName },\n      });\n\n      if (!body.email) {\n        throw new Error('Email not verified by Twitter');\n      }\n\n      return {\n        username: body.screen_name,\n        email: body.email,\n      };\n    },\n  },\n  instagram: {\n    enabled: false,\n    icon: 'instagram',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/instagram/callback`,\n      scope: ['user_profile'],\n    },\n    async authCallback({ accessToken }) {\n      const { body } = await bearerGet('https://graph.instagram.com/me', accessToken, {\n        qs: { fields: 'id,username' },\n      });\n      return {\n        username: body.username,\n        email: `${body.username}@strapi.io`,\n      };\n    },\n  },\n  vk: {\n    enabled: false,\n    icon: 'vk',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/vk/callback`,\n      scope: ['email'],\n    },\n    async authCallback({ accessToken, grantResponse }) {\n      const email = grantResponse?.raw?.email;\n      const userId = grantResponse?.raw?.user_id;\n\n      if (!email || !userId) {\n        throw new Error('VK authentication requires a completed OAuth session');\n      }\n\n      const { body } = await bearerGet('https://api.vk.com/method/users.get', accessToken, {\n        qs: { user_ids: userId, v: '5.122' },\n      });\n\n      if (!body.response?.[0]) {\n        throw new Error('Invalid VK access token');\n      }\n\n      return {\n        username: `${body.response[0].last_name} ${body.response[0].first_name}`,\n        email,\n      };\n    },\n  },\n\n  twitch: {\n    enabled: false,\n    icon: 'twitch',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/twitch/callback`,\n      scope: ['user:read:email'],\n    },\n    async authCallback({ accessToken, providers }) {\n      const { body } = await bearerGet('https://api.twitch.tv/helix/users', accessToken, {\n        headers: {\n          'Client-Id': providers.twitch.key,\n        },\n      });\n      const email = body.data?.[0]?.email;\n      if (!email) {\n        throw new Error('Email not verified by Twitch');\n      }\n      return {\n        username: body.data[0].login,\n        email,\n      };\n    },\n  },\n\n  linkedin: {\n    enabled: false,\n    icon: 'linkedin',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callbackUrl: `${baseURL}/linkedin/callback`,\n      scope: ['r_liteprofile', 'r_emailaddress'],\n    },\n    async authCallback({ accessToken }) {\n      const { body: profileBody } = await bearerGet('https://api.linkedin.com/v2/me', accessToken);\n      const { body: emailBody } = await bearerGet(\n        'https://api.linkedin.com/v2/emailAddress?q=members&projection=(elements*(handle~))',\n        accessToken\n      );\n\n      const email = emailBody.elements[0]?.['handle~'];\n\n      if (!email?.emailAddress) {\n        throw new Error('Email not verified by LinkedIn');\n      }\n\n      return {\n        username: profileBody.localizedFirstName,\n        email: email.emailAddress,\n      };\n    },\n  },\n\n  cognito: {\n    enabled: false,\n    icon: 'aws',\n    grantConfig: {\n      key: '',\n      secret: '',\n      subdomain: 'my.subdomain.com',\n      callback: `${baseURL}/cognito/callback`,\n      scope: ['email', 'openid', 'profile'],\n    },\n    async authCallback({ providers, grantResponse }) {\n      const jwksUrl = new URL(providers.cognito.jwksurl);\n      const idToken = grantResponse?.id_token;\n\n      if (!idToken) {\n        throw new Error('Cognito authentication requires a completed OAuth session');\n      }\n\n      const tokenPayload = await verifyJwtWithJwks({ idToken, jwksUrl });\n      if (tokenPayload.email_verified !== true) {\n        throw new Error('Email not verified by Cognito');\n      }\n      return {\n        username: tokenPayload['cognito:username'],\n        email: tokenPayload.email,\n      };\n    },\n  },\n\n  reddit: {\n    enabled: false,\n    icon: 'reddit',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callback: `${baseURL}/reddit/callback`,\n      scope: ['identity'],\n    },\n    async authCallback({ accessToken }) {\n      const { body } = await bearerGet('https://oauth.reddit.com/api/v1/me', accessToken, {\n        headers: { 'user-agent': 'strapi' },\n      });\n      return {\n        username: body.name,\n        email: `${body.name}@strapi.io`,\n      };\n    },\n  },\n\n  auth0: {\n    enabled: false,\n    icon: '',\n    grantConfig: {\n      key: '',\n      secret: '',\n      subdomain: 'my-tenant.eu',\n      callback: `${baseURL}/auth0/callback`,\n      scope: ['openid', 'email', 'profile'],\n    },\n    async authCallback({ accessToken, providers }) {\n      const { body } = await bearerGet(\n        `https://${providers.auth0.subdomain}.auth0.com/userinfo`,\n        accessToken\n      );\n      if (body.email && body.email_verified !== true) {\n        throw new Error('Email not verified by Auth0');\n      }\n      const username = body.username || body.nickname || body.name || body.email.split('@')[0];\n      const email = body.email || `${username.replace(/\\s+/g, '.')}@strapi.io`;\n\n      return {\n        username,\n        email,\n      };\n    },\n  },\n\n  cas: {\n    enabled: false,\n    icon: 'book',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callback: `${baseURL}/cas/callback`,\n      scope: ['openid email'],\n      subdomain: 'my.subdomain.com/cas',\n    },\n    async authCallback({ accessToken, providers }) {\n      const { body } = await bearerGet(\n        `https://${providers.cas.subdomain}/oidc/profile`,\n        accessToken\n      );\n      const username = body.attributes\n        ? body.attributes.strapiusername || body.id || body.sub\n        : body.strapiusername || body.id || body.sub;\n      const email = body.attributes\n        ? body.attributes.strapiemail || body.attributes.email\n        : body.strapiemail || body.email;\n      const emailVerified = body.email_verified ?? body.attributes?.email_verified;\n      if (!username || !email) {\n        strapi.log.warn(\n          `CAS Response Body did not contain required attributes: ${JSON.stringify(body)}`\n        );\n      }\n      if (email && emailVerified !== true) {\n        throw new Error('Email not verified by CAS');\n      }\n      return {\n        username,\n        email,\n      };\n    },\n  },\n\n  patreon: {\n    enabled: false,\n    icon: '',\n    grantConfig: {\n      key: '',\n      secret: '',\n      callback: `${baseURL}/patreon/callback`,\n      scope: ['identity', 'identity[email]'],\n    },\n    async authCallback({ accessToken }) {\n      const { body } = await bearerGet(\n        'https://www.patreon.com/api/oauth2/v2/identity?fields[user]=full_name,email,is_email_verified',\n        accessToken\n      );\n      const patreonData = body.data.attributes;\n      if (patreonData.is_email_verified !== true) {\n        throw new Error('Email not verified by Patreon');\n      }\n      return {\n        username: patreonData.full_name,\n        email: patreonData.email,\n      };\n    },\n  },\n  keycloak: {\n    enabled: false,\n    icon: '',\n    grantConfig: {\n      key: '',\n      secret: '',\n      subdomain: 'myKeycloakProvider.com/realms/myrealm',\n      callback: `${baseURL}/keycloak/callback`,\n      scope: ['openid', 'email', 'profile'],\n    },\n    async authCallback({ accessToken, providers }) {\n      const { body } = await bearerGet(\n        `https://${providers.keycloak.subdomain}/protocol/openid-connect/userinfo`,\n        accessToken\n      );\n      if (body.email_verified !== true) {\n        throw new Error('Email not verified by Keycloak');\n      }\n      return {\n        username: body.preferred_username,\n        email: body.email,\n      };\n    },\n  },\n});\n\nmodule.exports = () => {\n  const apiPrefix = strapi.config.get('api.rest.prefix');\n  const baseURL = urljoin(strapi.config.server.url, apiPrefix, 'auth');\n\n  const authProviders = initProviders({ baseURL });\n\n  return {\n    getAll() {\n      return authProviders;\n    },\n    get(name) {\n      return authProviders[name];\n    },\n    add(name, config) {\n      authProviders[name] = config;\n    },\n    remove(name) {\n      delete authProviders[name];\n    },\n\n    async run({ provider, accessToken, query, providers, grantResponse }) {\n      const authProvider = authProviders[provider];\n\n      assert(authProvider, 'Unknown auth provider');\n\n      return authProvider.authCallback({ accessToken, query, providers, grantResponse });\n    },\n  };\n};\n"],"names":["strict","assert","require$$0","urljoin","require$$1","verifyJwtWithJwks","require$$2","bearerGet","fetchJson","require$$3","initProviders","baseURL","email","enabled","icon","grantConfig","discord","key","secret","callbackUrl","scope","authCallback","accessToken","body","verified","Error","username","discriminator","facebook","qs","fields","name","google","encodeURIComponent","verified_email","email_verified","split","github","userBody","headers","emailBody","verifiedPublicEmail","Array","isArray","find","entry","login","primaryEmail","primary","microsoft","userPrincipalName","twitter","providers","grantResponse","accessSecret","access_secret","screenName","raw","screen_name","twitterGet","require$$4","url","accessCredential","consumerKey","clientCredential","include_email","instagram","vk","userId","user_id","user_ids","v","response","last_name","first_name","twitch","data","linkedin","profileBody","elements","emailAddress","localizedFirstName","cognito","subdomain","callback","jwksUrl","URL","jwksurl","idToken","id_token","tokenPayload","reddit","auth0","nickname","replace","cas","attributes","strapiusername","id","sub","strapiemail","emailVerified","strapi","log","warn","JSON","stringify","patreon","patreonData","is_email_verified","full_name","keycloak","preferred_username","providersRegistry","apiPrefix","config","get","server","authProviders","getAll","add","remove","run","provider","query","authProvider"],"mappings":";;;;;;;;;;;;;;;;;;AAEA,IAAA,MAAM,EAAEA,MAAAA,EAAQC,MAAM,EAAE,GAAGC,2BAAAA;AAC3B,IAAA,MAAMC,OAAAA,GAAUC,2BAAAA;IAEhB,MAAM,qBAAEC,mBAAiB,EAAE,GAAGC,2BAAAA,EAAAA;AAC9B,IAAA,MAAM,EAAEC,SAAS,EAAEC,SAAS,EAAE,GAAGC,sBAAAA,EAAAA;AAEjC,IAAA,MAAMC,gBAAgB,CAAC,EAAEC,OAAO,EAAE,IAAM;YACtCC,KAAAA,EAAO;gBACLC,OAAAA,EAAS,IAAA;gBACTC,IAAAA,EAAM,UAAA;AACNC,gBAAAA,WAAAA,EAAa;AACjB,aAAA;YACEC,OAAAA,EAAS;gBACPH,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,SAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGR,OAAAA,CAAQ,iBAAiB,CAAC;oBAC1CS,KAAAA,EAAO;AAAC,wBAAA,UAAA;AAAY,wBAAA;AAAQ;AAClC,iBAAA;gBACI,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE,EAAA;AAChC,oBAAA,MAAM,EAAEC,IAAI,EAAE,GAAG,MAAMhB,UAAU,mCAAA,EAAqCe,WAAAA,CAAAA;oBACtE,IAAIC,IAAAA,CAAKC,QAAQ,KAAK,IAAA,EAAM;AAC1B,wBAAA,MAAM,IAAIC,KAAAA,CAAM,+BAAA,CAAA;AACxB,oBAAA;AACM,oBAAA,MAAMC,WACJH,IAAAA,CAAKI,aAAa,IAAIJ,IAAAA,CAAKI,aAAa,KAAK,GAAA,GACzC,CAAA,EAAGJ,KAAKG,QAAQ,CAAC,CAAC,EAAEH,IAAAA,CAAKI,aAAa,CAAA,CAAC,GACvCJ,KAAKG,QAAQ;oBACnB,OAAO;AACLA,wBAAAA,QAAAA;AACAd,wBAAAA,KAAAA,EAAOW,KAAKX;AACpB,qBAAA;AACA,gBAAA;AACA,aAAA;YACEgB,QAAAA,EAAU;gBACRf,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,iBAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGR,OAAAA,CAAQ,kBAAkB,CAAC;oBAC3CS,KAAAA,EAAO;AAAC,wBAAA;AAAQ;AACtB,iBAAA;gBACI,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE,EAAA;AAChC,oBAAA,MAAM,EAAEC,IAAI,EAAE,GAAG,MAAMhB,SAAAA,CAAU,iCAAiCe,WAAAA,EAAa;wBAC7EO,EAAAA,EAAI;4BAAEC,MAAAA,EAAQ;AAAY;AAClC,qBAAA,CAAA;oBACM,IAAI,CAACP,IAAAA,CAAKX,KAAK,EAAE;AACf,wBAAA,MAAM,IAAIa,KAAAA,CAAM,gCAAA,CAAA;AACxB,oBAAA;oBACM,OAAO;AACLC,wBAAAA,QAAAA,EAAUH,KAAKQ,IAAI;AACnBnB,wBAAAA,KAAAA,EAAOW,KAAKX;AACpB,qBAAA;AACA,gBAAA;AACA,aAAA;YACEoB,MAAAA,EAAQ;gBACNnB,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,QAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGR,OAAAA,CAAQ,gBAAgB,CAAC;oBACzCS,KAAAA,EAAO;AAAC,wBAAA;AAAQ;AACtB,iBAAA;gBACI,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE,EAAA;oBAChC,MAAM,EAAEC,IAAI,EAAE,GAAG,MAAMf,UACrB,CAAC,qDAAqD,EAAEyB,kBAAAA,CAAmBX,WAAAA,CAAAA,CAAAA,CAAa,CAAA;AAE1F,oBAAA,MAAME,QAAAA,GAAWD,IAAAA,CAAKW,cAAc,IAAIX,KAAKY,cAAc;oBAC3D,IAAIX,QAAAA,KAAa,IAAA,IAAQA,QAAAA,KAAa,MAAA,EAAQ;AAC5C,wBAAA,MAAM,IAAIC,KAAAA,CAAM,8BAAA,CAAA;AACxB,oBAAA;oBACM,OAAO;AACLC,wBAAAA,QAAAA,EAAUH,KAAKX,KAAK,CAACwB,KAAK,CAAC,GAAA,CAAI,CAAC,CAAA,CAAE;AAClCxB,wBAAAA,KAAAA,EAAOW,KAAKX;AACpB,qBAAA;AACA,gBAAA;AACA,aAAA;YACEyB,MAAAA,EAAQ;gBACNxB,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,QAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGR,OAAAA,CAAQ,gBAAgB,CAAC;oBACzCS,KAAAA,EAAO;AAAC,wBAAA,MAAA;AAAQ,wBAAA;AAAa;AACnC,iBAAA;gBACI,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE,EAAA;oBAChC,MAAM,EAAEC,MAAMe,QAAQ,EAAE,GAAG,MAAM/B,SAAAA,CAAU,+BAA+Be,WAAAA,EAAa;wBACrFiB,OAAAA,EAAS;4BAAE,YAAA,EAAc;AAAQ;AACzC,qBAAA,CAAA;oBAEM,MAAM,EAAEhB,MAAMiB,SAAS,EAAE,GAAG,MAAMjC,SAAAA,CAChC,sCACAe,WAAAA,EACA;wBACEiB,OAAAA,EAAS;4BAAE,YAAA,EAAc;AAAQ;AAC3C,qBAAA,CAAA;oBAGM,IAAID,QAAAA,CAAS1B,KAAK,EAAE;AAClB,wBAAA,MAAM6B,sBAAsBC,KAAAA,CAAMC,OAAO,CAACH,SAAAA,CAAAA,GACtCA,SAAAA,CAAUI,IAAI,CAAC,CAACC,QAAUA,KAAAA,CAAMjC,KAAK,KAAK0B,QAAAA,CAAS1B,KAAK,IAAIiC,KAAAA,CAAMrB,QAAQ,KAAK,IAAA,CAAA,GAC/E,IAAA;AAEJ,wBAAA,IAAI,CAACiB,mBAAAA,EAAqB;AACxB,4BAAA,MAAM,IAAIhB,KAAAA,CAAM,8BAAA,CAAA;AAC1B,wBAAA;wBAEQ,OAAO;AACLC,4BAAAA,QAAAA,EAAUY,SAASQ,KAAK;AACxBlC,4BAAAA,KAAAA,EAAO0B,SAAS1B;AAC1B,yBAAA;AACA,oBAAA;AAEM,oBAAA,MAAMmC,YAAAA,GAAeL,KAAAA,CAAMC,OAAO,CAACH,SAAAA,CAAAA,GAC/BA,SAAAA,CAAUI,IAAI,CAAC,CAAChC,KAAAA,GAAUA,KAAAA,CAAMoC,OAAO,KAAK,IAAA,CAAA,GAC5C,IAAA;AAEJ,oBAAA,IAAI,CAACD,YAAAA,IAAgBA,YAAAA,CAAavB,QAAQ,KAAK,IAAA,EAAM;AACnD,wBAAA,MAAM,IAAIC,KAAAA,CAAM,8BAAA,CAAA;AACxB,oBAAA;oBAEM,OAAO;AACLC,wBAAAA,QAAAA,EAAUY,SAASQ,KAAK;AACxBlC,wBAAAA,KAAAA,EAAOmC,aAAanC;AAC5B,qBAAA;AACA,gBAAA;AACA,aAAA;YACEqC,SAAAA,EAAW;gBACTpC,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,SAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGR,OAAAA,CAAQ,mBAAmB,CAAC;oBAC5CS,KAAAA,EAAO;AAAC,wBAAA;AAAY;AAC1B,iBAAA;gBACI,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE,EAAA;AAChC,oBAAA,MAAM,EAAEC,IAAI,EAAE,GAAG,MAAMhB,UAAU,qCAAA,EAAuCe,WAAAA,CAAAA;oBACxE,OAAO;AACLI,wBAAAA,QAAAA,EAAUH,KAAK2B,iBAAiB;AAChCtC,wBAAAA,KAAAA,EAAOW,KAAK2B;AACpB,qBAAA;AACA,gBAAA;AACA,aAAA;YAEEC,OAAAA,EAAS;gBACPtC,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,SAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGR,OAAAA,CAAQ,iBAAiB;AAC/C,iBAAA;AACI,gBAAA,MAAMU,cAAa,EAAEC,WAAW,EAAE8B,SAAS,EAAEC,aAAa,EAAE,EAAA;AAC1D,oBAAA,MAAMC,eAAeD,aAAAA,EAAeE,aAAAA;oBACpC,MAAMC,UAAAA,GAAaH,eAAeI,GAAAA,EAAKC,WAAAA;AAEvC,oBAAA,IAAI,CAACJ,YAAAA,EAAc;AACjB,wBAAA,MAAM,IAAI7B,KAAAA,CAAM,2DAAA,CAAA;AACxB,oBAAA;oBAEM,MAAM,EAAEkC,UAAU,EAAE,GAAGC,gBAAAA,EAAAA;AACvB,oBAAA,MAAM,EAAErC,IAAI,EAAE,GAAG,MAAMoC,UAAAA,CAAW;wBAChCE,GAAAA,EAAK,6DAAA;AACLvC,wBAAAA,WAAAA;wBACAwC,gBAAAA,EAAkBR,YAAAA;wBAClBS,WAAAA,EAAaX,SAAAA,CAAUD,OAAO,CAAClC,GAAG;wBAClC+C,gBAAAA,EAAkBZ,SAAAA,CAAUD,OAAO,CAACjC,MAAM;wBAC1CW,EAAAA,EAAI;4BAAEoC,aAAAA,EAAe,MAAA;4BAAQP,WAAAA,EAAaF;AAAU;AAC5D,qBAAA,CAAA;oBAEM,IAAI,CAACjC,IAAAA,CAAKX,KAAK,EAAE;AACf,wBAAA,MAAM,IAAIa,KAAAA,CAAM,+BAAA,CAAA;AACxB,oBAAA;oBAEM,OAAO;AACLC,wBAAAA,QAAAA,EAAUH,KAAKmC,WAAW;AAC1B9C,wBAAAA,KAAAA,EAAOW,KAAKX;AACpB,qBAAA;AACA,gBAAA;AACA,aAAA;YACEsD,SAAAA,EAAW;gBACTrD,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,WAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGR,OAAAA,CAAQ,mBAAmB,CAAC;oBAC5CS,KAAAA,EAAO;AAAC,wBAAA;AAAe;AAC7B,iBAAA;gBACI,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE,EAAA;AAChC,oBAAA,MAAM,EAAEC,IAAI,EAAE,GAAG,MAAMhB,SAAAA,CAAU,kCAAkCe,WAAAA,EAAa;wBAC9EO,EAAAA,EAAI;4BAAEC,MAAAA,EAAQ;AAAa;AACnC,qBAAA,CAAA;oBACM,OAAO;AACLJ,wBAAAA,QAAAA,EAAUH,KAAKG,QAAQ;AACvBd,wBAAAA,KAAAA,EAAO,CAAA,EAAGW,IAAAA,CAAKG,QAAQ,CAAC,UAAU;AAC1C,qBAAA;AACA,gBAAA;AACA,aAAA;YACEyC,EAAAA,EAAI;gBACFtD,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,IAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGR,OAAAA,CAAQ,YAAY,CAAC;oBACrCS,KAAAA,EAAO;AAAC,wBAAA;AAAQ;AACtB,iBAAA;AACI,gBAAA,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE+B,aAAa,EAAE,EAAA;oBAC/C,MAAMzC,KAAAA,GAAQyC,eAAeI,GAAAA,EAAK7C,KAAAA;oBAClC,MAAMwD,MAAAA,GAASf,eAAeI,GAAAA,EAAKY,OAAAA;oBAEnC,IAAI,CAACzD,KAAAA,IAAS,CAACwD,MAAAA,EAAQ;AACrB,wBAAA,MAAM,IAAI3C,KAAAA,CAAM,sDAAA,CAAA;AACxB,oBAAA;AAEM,oBAAA,MAAM,EAAEF,IAAI,EAAE,GAAG,MAAMhB,SAAAA,CAAU,uCAAuCe,WAAAA,EAAa;wBACnFO,EAAAA,EAAI;4BAAEyC,QAAAA,EAAUF,MAAAA;4BAAQG,CAAAA,EAAG;AAAO;AAC1C,qBAAA,CAAA;AAEM,oBAAA,IAAI,CAAChD,IAAAA,CAAKiD,QAAQ,GAAG,EAAE,EAAE;AACvB,wBAAA,MAAM,IAAI/C,KAAAA,CAAM,yBAAA,CAAA;AACxB,oBAAA;oBAEM,OAAO;AACLC,wBAAAA,QAAAA,EAAU,GAAGH,IAAAA,CAAKiD,QAAQ,CAAC,CAAA,CAAE,CAACC,SAAS,CAAC,CAAC,EAAElD,KAAKiD,QAAQ,CAAC,CAAA,CAAE,CAACE,UAAU,CAAA,CAAE;AACxE9D,wBAAAA;AACR,qBAAA;AACA,gBAAA;AACA,aAAA;YAEE+D,MAAAA,EAAQ;gBACN9D,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,QAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGR,OAAAA,CAAQ,gBAAgB,CAAC;oBACzCS,KAAAA,EAAO;AAAC,wBAAA;AAAkB;AAChC,iBAAA;AACI,gBAAA,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE8B,SAAS,EAAE,EAAA;AAC3C,oBAAA,MAAM,EAAE7B,IAAI,EAAE,GAAG,MAAMhB,SAAAA,CAAU,qCAAqCe,WAAAA,EAAa;wBACjFiB,OAAAA,EAAS;4BACP,WAAA,EAAaa,SAAAA,CAAUuB,MAAM,CAAC1D;AACxC;AACA,qBAAA,CAAA;AACM,oBAAA,MAAML,QAAQW,IAAAA,CAAKqD,IAAI,GAAG,EAAE,EAAEhE,KAAAA;AAC9B,oBAAA,IAAI,CAACA,KAAAA,EAAO;AACV,wBAAA,MAAM,IAAIa,KAAAA,CAAM,8BAAA,CAAA;AACxB,oBAAA;oBACM,OAAO;AACLC,wBAAAA,QAAAA,EAAUH,IAAAA,CAAKqD,IAAI,CAAC,CAAA,CAAE,CAAC9B,KAAK;AAC5BlC,wBAAAA;AACR,qBAAA;AACA,gBAAA;AACA,aAAA;YAEEiE,QAAAA,EAAU;gBACRhE,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,UAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRC,WAAAA,EAAa,CAAA,EAAGR,OAAAA,CAAQ,kBAAkB,CAAC;oBAC3CS,KAAAA,EAAO;AAAC,wBAAA,eAAA;AAAiB,wBAAA;AAAiB;AAChD,iBAAA;gBACI,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE,EAAA;AAChC,oBAAA,MAAM,EAAEC,IAAAA,EAAMuD,WAAW,EAAE,GAAG,MAAMvE,UAAU,gCAAA,EAAkCe,WAAAA,CAAAA;AAChF,oBAAA,MAAM,EAAEC,IAAAA,EAAMiB,SAAS,EAAE,GAAG,MAAMjC,UAChC,oFAAA,EACAe,WAAAA,CAAAA;AAGF,oBAAA,MAAMV,QAAQ4B,SAAAA,CAAUuC,QAAQ,CAAC,CAAA,CAAE,GAAG,SAAA,CAAU;oBAEhD,IAAI,CAACnE,OAAOoE,YAAAA,EAAc;AACxB,wBAAA,MAAM,IAAIvD,KAAAA,CAAM,gCAAA,CAAA;AACxB,oBAAA;oBAEM,OAAO;AACLC,wBAAAA,QAAAA,EAAUoD,YAAYG,kBAAkB;AACxCrE,wBAAAA,KAAAA,EAAOA,MAAMoE;AACrB,qBAAA;AACA,gBAAA;AACA,aAAA;YAEEE,OAAAA,EAAS;gBACPrE,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,KAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRiE,SAAAA,EAAW,kBAAA;oBACXC,QAAAA,EAAU,CAAA,EAAGzE,OAAAA,CAAQ,iBAAiB,CAAC;oBACvCS,KAAAA,EAAO;AAAC,wBAAA,OAAA;AAAS,wBAAA,QAAA;AAAU,wBAAA;AAAU;AAC3C,iBAAA;AACI,gBAAA,MAAMC,YAAAA,CAAAA,CAAa,EAAE+B,SAAS,EAAEC,aAAa,EAAE,EAAA;AAC7C,oBAAA,MAAMgC,UAAU,IAAIC,GAAAA,CAAIlC,SAAAA,CAAU8B,OAAO,CAACK,OAAO,CAAA;AACjD,oBAAA,MAAMC,UAAUnC,aAAAA,EAAeoC,QAAAA;AAE/B,oBAAA,IAAI,CAACD,OAAAA,EAAS;AACZ,wBAAA,MAAM,IAAI/D,KAAAA,CAAM,2DAAA,CAAA;AACxB,oBAAA;oBAEM,MAAMiE,YAAAA,GAAe,MAAMrF,mBAAAA,CAAkB;AAAEmF,wBAAAA,OAAAA;AAASH,wBAAAA;AAAO,qBAAA,CAAA;oBAC/D,IAAIK,YAAAA,CAAavD,cAAc,KAAK,IAAA,EAAM;AACxC,wBAAA,MAAM,IAAIV,KAAAA,CAAM,+BAAA,CAAA;AACxB,oBAAA;oBACM,OAAO;wBACLC,QAAAA,EAAUgE,YAAY,CAAC,kBAAA,CAAmB;AAC1C9E,wBAAAA,KAAAA,EAAO8E,aAAa9E;AAC5B,qBAAA;AACA,gBAAA;AACA,aAAA;YAEE+E,MAAAA,EAAQ;gBACN9E,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,QAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRkE,QAAAA,EAAU,CAAA,EAAGzE,OAAAA,CAAQ,gBAAgB,CAAC;oBACtCS,KAAAA,EAAO;AAAC,wBAAA;AAAW;AACzB,iBAAA;gBACI,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE,EAAA;AAChC,oBAAA,MAAM,EAAEC,IAAI,EAAE,GAAG,MAAMhB,SAAAA,CAAU,sCAAsCe,WAAAA,EAAa;wBAClFiB,OAAAA,EAAS;4BAAE,YAAA,EAAc;AAAQ;AACzC,qBAAA,CAAA;oBACM,OAAO;AACLb,wBAAAA,QAAAA,EAAUH,KAAKQ,IAAI;AACnBnB,wBAAAA,KAAAA,EAAO,CAAA,EAAGW,IAAAA,CAAKQ,IAAI,CAAC,UAAU;AACtC,qBAAA;AACA,gBAAA;AACA,aAAA;YAEE6D,KAAAA,EAAO;gBACL/E,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,EAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRiE,SAAAA,EAAW,cAAA;oBACXC,QAAAA,EAAU,CAAA,EAAGzE,OAAAA,CAAQ,eAAe,CAAC;oBACrCS,KAAAA,EAAO;AAAC,wBAAA,QAAA;AAAU,wBAAA,OAAA;AAAS,wBAAA;AAAU;AAC3C,iBAAA;AACI,gBAAA,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE8B,SAAS,EAAE,EAAA;AAC3C,oBAAA,MAAM,EAAE7B,IAAI,EAAE,GAAG,MAAMhB,UACrB,CAAC,QAAQ,EAAE6C,SAAAA,CAAUwC,KAAK,CAACT,SAAS,CAAC,mBAAmB,CAAC,EACzD7D,WAAAA,CAAAA;AAEF,oBAAA,IAAIC,KAAKX,KAAK,IAAIW,IAAAA,CAAKY,cAAc,KAAK,IAAA,EAAM;AAC9C,wBAAA,MAAM,IAAIV,KAAAA,CAAM,6BAAA,CAAA;AACxB,oBAAA;AACM,oBAAA,MAAMC,WAAWH,IAAAA,CAAKG,QAAQ,IAAIH,IAAAA,CAAKsE,QAAQ,IAAItE,IAAAA,CAAKQ,IAAI,IAAIR,KAAKX,KAAK,CAACwB,KAAK,CAAC,GAAA,CAAI,CAAC,CAAA,CAAE;oBACxF,MAAMxB,KAAAA,GAAQW,IAAAA,CAAKX,KAAK,IAAI,CAAA,EAAGc,QAAAA,CAASoE,OAAO,CAAC,MAAA,EAAQ,GAAA,CAAA,CAAK,UAAU,CAAC;oBAExE,OAAO;AACLpE,wBAAAA,QAAAA;AACAd,wBAAAA;AACR,qBAAA;AACA,gBAAA;AACA,aAAA;YAEEmF,GAAAA,EAAK;gBACHlF,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,MAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRkE,QAAAA,EAAU,CAAA,EAAGzE,OAAAA,CAAQ,aAAa,CAAC;oBACnCS,KAAAA,EAAO;AAAC,wBAAA;AAAe,qBAAA;oBACvB+D,SAAAA,EAAW;AACjB,iBAAA;AACI,gBAAA,MAAM9D,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE8B,SAAS,EAAE,EAAA;AAC3C,oBAAA,MAAM,EAAE7B,IAAI,EAAE,GAAG,MAAMhB,UACrB,CAAC,QAAQ,EAAE6C,SAAAA,CAAU2C,GAAG,CAACZ,SAAS,CAAC,aAAa,CAAC,EACjD7D,WAAAA,CAAAA;oBAEF,MAAMI,QAAAA,GAAWH,KAAKyE,UAAA,GAClBzE,KAAKyE,UAAU,CAACC,cAAc,IAAI1E,IAAAA,CAAK2E,EAAE,IAAI3E,IAAAA,CAAK4E,GAAA,GAClD5E,IAAAA,CAAK0E,cAAc,IAAI1E,IAAAA,CAAK2E,EAAE,IAAI3E,IAAAA,CAAK4E,GAAG;AAC9C,oBAAA,MAAMvF,QAAQW,IAAAA,CAAKyE,UAAA,GACfzE,IAAAA,CAAKyE,UAAU,CAACI,WAAW,IAAI7E,IAAAA,CAAKyE,UAAU,CAACpF,KAAA,GAC/CW,KAAK6E,WAAW,IAAI7E,KAAKX,KAAK;AAClC,oBAAA,MAAMyF,gBAAgB9E,IAAAA,CAAKY,cAAc,IAAIZ,IAAAA,CAAKyE,UAAU,EAAE7D,cAAAA;oBAC9D,IAAI,CAACT,QAAAA,IAAY,CAACd,KAAAA,EAAO;wBACvB0F,MAAAA,CAAOC,GAAG,CAACC,IAAI,CACb,CAAC,uDAAuD,EAAEC,IAAAA,CAAKC,SAAS,CAACnF,IAAAA,CAAAA,CAAAA,CAAM,CAAA;AAEzF,oBAAA;oBACM,IAAIX,KAAAA,IAASyF,kBAAkB,IAAA,EAAM;AACnC,wBAAA,MAAM,IAAI5E,KAAAA,CAAM,2BAAA,CAAA;AACxB,oBAAA;oBACM,OAAO;AACLC,wBAAAA,QAAAA;AACAd,wBAAAA;AACR,qBAAA;AACA,gBAAA;AACA,aAAA;YAEE+F,OAAAA,EAAS;gBACP9F,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,EAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRkE,QAAAA,EAAU,CAAA,EAAGzE,OAAAA,CAAQ,iBAAiB,CAAC;oBACvCS,KAAAA,EAAO;AAAC,wBAAA,UAAA;AAAY,wBAAA;AAAkB;AAC5C,iBAAA;gBACI,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE,EAAA;AAChC,oBAAA,MAAM,EAAEC,IAAI,EAAE,GAAG,MAAMhB,UACrB,+FAAA,EACAe,WAAAA,CAAAA;AAEF,oBAAA,MAAMsF,WAAAA,GAAcrF,IAAAA,CAAKqD,IAAI,CAACoB,UAAU;oBACxC,IAAIY,WAAAA,CAAYC,iBAAiB,KAAK,IAAA,EAAM;AAC1C,wBAAA,MAAM,IAAIpF,KAAAA,CAAM,+BAAA,CAAA;AACxB,oBAAA;oBACM,OAAO;AACLC,wBAAAA,QAAAA,EAAUkF,YAAYE,SAAS;AAC/BlG,wBAAAA,KAAAA,EAAOgG,YAAYhG;AAC3B,qBAAA;AACA,gBAAA;AACA,aAAA;YACEmG,QAAAA,EAAU;gBACRlG,OAAAA,EAAS,KAAA;gBACTC,IAAAA,EAAM,EAAA;gBACNC,WAAAA,EAAa;oBACXE,GAAAA,EAAK,EAAA;oBACLC,MAAAA,EAAQ,EAAA;oBACRiE,SAAAA,EAAW,uCAAA;oBACXC,QAAAA,EAAU,CAAA,EAAGzE,OAAAA,CAAQ,kBAAkB,CAAC;oBACxCS,KAAAA,EAAO;AAAC,wBAAA,QAAA;AAAU,wBAAA,OAAA;AAAS,wBAAA;AAAU;AAC3C,iBAAA;AACI,gBAAA,MAAMC,YAAAA,CAAAA,CAAa,EAAEC,WAAW,EAAE8B,SAAS,EAAE,EAAA;AAC3C,oBAAA,MAAM,EAAE7B,IAAI,EAAE,GAAG,MAAMhB,UACrB,CAAC,QAAQ,EAAE6C,SAAAA,CAAU2D,QAAQ,CAAC5B,SAAS,CAAC,iCAAiC,CAAC,EAC1E7D,WAAAA,CAAAA;oBAEF,IAAIC,IAAAA,CAAKY,cAAc,KAAK,IAAA,EAAM;AAChC,wBAAA,MAAM,IAAIV,KAAAA,CAAM,gCAAA,CAAA;AACxB,oBAAA;oBACM,OAAO;AACLC,wBAAAA,QAAAA,EAAUH,KAAKyF,kBAAkB;AACjCpG,wBAAAA,KAAAA,EAAOW,KAAKX;AACpB,qBAAA;AACA,gBAAA;AACA;SACA,CAAA;IAEAqG,iBAAAA,GAAiB,IAAA;AACf,QAAA,MAAMC,SAAAA,GAAYZ,MAAAA,CAAOa,MAAM,CAACC,GAAG,CAAC,iBAAA,CAAA;QACpC,MAAMzG,OAAAA,GAAUR,QAAQmG,MAAAA,CAAOa,MAAM,CAACE,MAAM,CAACxD,GAAG,EAAEqD,SAAAA,EAAW,MAAA,CAAA;AAE7D,QAAA,MAAMI,gBAAgB5G,aAAAA,CAAc;AAAEC,YAAAA;;QAEtC,OAAO;AACL4G,YAAAA,MAAAA,CAAAA,GAAAA;gBACE,OAAOD,aAAAA;AACb,YAAA,CAAA;AACIF,YAAAA,GAAAA,CAAAA,CAAIrF,IAAI,EAAA;gBACN,OAAOuF,aAAa,CAACvF,IAAAA,CAAK;AAChC,YAAA,CAAA;YACIyF,GAAAA,CAAAA,CAAIzF,IAAI,EAAEoF,MAAM,EAAA;gBACdG,aAAa,CAACvF,KAAK,GAAGoF,MAAAA;AAC5B,YAAA,CAAA;AACIM,YAAAA,MAAAA,CAAAA,CAAO1F,IAAI,EAAA;gBACT,OAAOuF,aAAa,CAACvF,IAAAA,CAAK;AAChC,YAAA,CAAA;YAEI,MAAM2F,GAAAA,CAAAA,CAAI,EAAEC,QAAQ,EAAErG,WAAW,EAAEsG,KAAK,EAAExE,SAAS,EAAEC,aAAa,EAAE,EAAA;gBAClE,MAAMwE,YAAAA,GAAeP,aAAa,CAACK,QAAAA,CAAS;AAE5C1H,gBAAAA,MAAAA,CAAO4H,YAAAA,EAAc,uBAAA,CAAA;gBAErB,OAAOA,YAAAA,CAAaxG,YAAY,CAAC;AAAEC,oBAAAA,WAAAA;AAAasG,oBAAAA,KAAAA;AAAOxE,oBAAAA,SAAAA;AAAWC,oBAAAA;;AACxE,YAAA;AACA,SAAA;AACA,IAAA,CAAA;;;;;;"}

package/dist/server/services/providers-registry.mjs

@@ -33,6 +33,9 @@ function requireProvidersRegistry() {
                 },
                 async authCallback ({ accessToken }) {
                     const { body } = await bearerGet('https://discord.com/api/users/@me', accessToken);
+                    if (body.verified !== true) {
+                        throw new Error('Email not verified by Discord');
+                    }
                     const username = body.discriminator && body.discriminator !== '0' ? `${body.username}#${body.discriminator}` : body.username;
                     return {
                         username,
@@ -57,6 +60,9 @@ function requireProvidersRegistry() {
                             fields: 'name,email'
                         }
                     });
+                    if (!body.email) {
+                        throw new Error('Email not verified by Facebook');
+                    }
                     return {
                         username: body.name,
                         email: body.email
@@ -76,6 +82,10 @@ function requireProvidersRegistry() {
                 },
                 async authCallback ({ accessToken }) {
                     const { body } = await fetchJson(`https://oauth2.googleapis.com/tokeninfo?access_token=${encodeURIComponent(accessToken)}`);
+                    const verified = body.verified_email ?? body.email_verified;
+                    if (verified !== true && verified !== 'true') {
+                        throw new Error('Email not verified by Google');
+                    }
                     return {
                         username: body.email.split('@')[0],
                         email: body.email
@@ -100,20 +110,28 @@ function requireProvidersRegistry() {
                             'user-agent': 'strapi'
                         }
                     });
+                    const { body: emailBody } = await bearerGet('https://api.github.com/user/emails', accessToken, {
+                        headers: {
+                            'user-agent': 'strapi'
+                        }
+                    });
                     if (userBody.email) {
+                        const verifiedPublicEmail = Array.isArray(emailBody) ? emailBody.find((entry)=>entry.email === userBody.email && entry.verified === true) : null;
+                        if (!verifiedPublicEmail) {
+                            throw new Error('Email not verified by GitHub');
+                        }
                         return {
                             username: userBody.login,
                             email: userBody.email
                         };
                     }
-                    const { body: emailBody } = await bearerGet('https://api.github.com/user/emails', accessToken, {
-                        headers: {
-                            'user-agent': 'strapi'
-                        }
-                    });
+                    const primaryEmail = Array.isArray(emailBody) ? emailBody.find((email)=>email.primary === true) : null;
+                    if (!primaryEmail || primaryEmail.verified !== true) {
+                        throw new Error('Email not verified by GitHub');
+                    }
                     return {
                         username: userBody.login,
-                        email: Array.isArray(emailBody) ? emailBody.find((email)=>email.primary === true).email : null
+                        email: primaryEmail.email
                     };
                 }
             },
@@ -144,19 +162,27 @@ function requireProvidersRegistry() {
                     secret: '',
                     callbackUrl: `${baseURL}/twitter/callback`
                 },
-                async authCallback ({ accessToken, query, providers }) {
+                async authCallback ({ accessToken, providers, grantResponse }) {
+                    const accessSecret = grantResponse?.access_secret;
+                    const screenName = grantResponse?.raw?.screen_name;
+                    if (!accessSecret) {
+                        throw new Error('Twitter authentication requires a completed OAuth session');
+                    }
                     const { twitterGet } = requireOauth1();
                     const { body } = await twitterGet({
                         url: 'https://api.twitter.com/1.1/account/verify_credentials.json',
                         accessToken,
-                        accessCredential: query.access_secret,
+                        accessCredential: accessSecret,
                         consumerKey: providers.twitter.key,
                         clientCredential: providers.twitter.secret,
                         qs: {
                             include_email: 'true',
-                            screen_name: query['raw[screen_name]']
+                            screen_name: screenName
                         }
                     });
+                    if (!body.email) {
+                        throw new Error('Email not verified by Twitter');
+                    }
                     return {
                         username: body.screen_name,
                         email: body.email
@@ -197,16 +223,24 @@ function requireProvidersRegistry() {
                         'email'
                     ]
                 },
-                async authCallback ({ accessToken, query }) {
+                async authCallback ({ accessToken, grantResponse }) {
+                    const email = grantResponse?.raw?.email;
+                    const userId = grantResponse?.raw?.user_id;
+                    if (!email || !userId) {
+                        throw new Error('VK authentication requires a completed OAuth session');
+                    }
                     const { body } = await bearerGet('https://api.vk.com/method/users.get', accessToken, {
                         qs: {
-                            user_ids: query.raw.user_id,
+                            user_ids: userId,
                             v: '5.122'
                         }
                     });
+                    if (!body.response?.[0]) {
+                        throw new Error('Invalid VK access token');
+                    }
                     return {
                         username: `${body.response[0].last_name} ${body.response[0].first_name}`,
-                        email: query.raw.email
+                        email
                     };
                 }
             },
@@ -227,9 +261,13 @@ function requireProvidersRegistry() {
                             'Client-Id': providers.twitch.key
                         }
                     });
+                    const email = body.data?.[0]?.email;
+                    if (!email) {
+                        throw new Error('Email not verified by Twitch');
+                    }
                     return {
                         username: body.data[0].login,
-                        email: body.data[0].email
+                        email
                     };
                 }
             },
@@ -248,7 +286,10 @@ function requireProvidersRegistry() {
                 async authCallback ({ accessToken }) {
                     const { body: profileBody } = await bearerGet('https://api.linkedin.com/v2/me', accessToken);
                     const { body: emailBody } = await bearerGet('https://api.linkedin.com/v2/emailAddress?q=members&projection=(elements*(handle~))', accessToken);
-                    const email = emailBody.elements[0]['handle~'];
+                    const email = emailBody.elements[0]?.['handle~'];
+                    if (!email?.emailAddress) {
+                        throw new Error('Email not verified by LinkedIn');
+                    }
                     return {
                         username: profileBody.localizedFirstName,
                         email: email.emailAddress
@@ -269,13 +310,19 @@ function requireProvidersRegistry() {
                         'profile'
                     ]
                 },
-                async authCallback ({ query, providers }) {
+                async authCallback ({ providers, grantResponse }) {
                     const jwksUrl = new URL(providers.cognito.jwksurl);
-                    const idToken = query.id_token;
+                    const idToken = grantResponse?.id_token;
+                    if (!idToken) {
+                        throw new Error('Cognito authentication requires a completed OAuth session');
+                    }
                     const tokenPayload = await verifyJwtWithJwks({
                         idToken,
                         jwksUrl
                     });
+                    if (tokenPayload.email_verified !== true) {
+                        throw new Error('Email not verified by Cognito');
+                    }
                     return {
                         username: tokenPayload['cognito:username'],
                         email: tokenPayload.email
@@ -321,6 +368,9 @@ function requireProvidersRegistry() {
                 },
                 async authCallback ({ accessToken, providers }) {
                     const { body } = await bearerGet(`https://${providers.auth0.subdomain}.auth0.com/userinfo`, accessToken);
+                    if (body.email && body.email_verified !== true) {
+                        throw new Error('Email not verified by Auth0');
+                    }
                     const username = body.username || body.nickname || body.name || body.email.split('@')[0];
                     const email = body.email || `${username.replace(/\s+/g, '.')}@strapi.io`;
                     return {
@@ -345,9 +395,13 @@ function requireProvidersRegistry() {
                     const { body } = await bearerGet(`https://${providers.cas.subdomain}/oidc/profile`, accessToken);
                     const username = body.attributes ? body.attributes.strapiusername || body.id || body.sub : body.strapiusername || body.id || body.sub;
                     const email = body.attributes ? body.attributes.strapiemail || body.attributes.email : body.strapiemail || body.email;
+                    const emailVerified = body.email_verified ?? body.attributes?.email_verified;
                     if (!username || !email) {
                         strapi.log.warn(`CAS Response Body did not contain required attributes: ${JSON.stringify(body)}`);
                     }
+                    if (email && emailVerified !== true) {
+                        throw new Error('Email not verified by CAS');
+                    }
                     return {
                         username,
                         email
@@ -367,8 +421,11 @@ function requireProvidersRegistry() {
                     ]
                 },
                 async authCallback ({ accessToken }) {
-                    const { body } = await bearerGet('https://www.patreon.com/api/oauth2/v2/identity?fields[user]=full_name,email', accessToken);
+                    const { body } = await bearerGet('https://www.patreon.com/api/oauth2/v2/identity?fields[user]=full_name,email,is_email_verified', accessToken);
                     const patreonData = body.data.attributes;
+                    if (patreonData.is_email_verified !== true) {
+                        throw new Error('Email not verified by Patreon');
+                    }
                     return {
                         username: patreonData.full_name,
                         email: patreonData.email
@@ -391,6 +448,9 @@ function requireProvidersRegistry() {
                 },
                 async authCallback ({ accessToken, providers }) {
                     const { body } = await bearerGet(`https://${providers.keycloak.subdomain}/protocol/openid-connect/userinfo`, accessToken);
+                    if (body.email_verified !== true) {
+                        throw new Error('Email not verified by Keycloak');
+                    }
                     return {
                         username: body.preferred_username,
                         email: body.email
@@ -417,13 +477,14 @@ function requireProvidersRegistry() {
             remove (name) {
                 delete authProviders[name];
             },
-            async run ({ provider, accessToken, query, providers }) {
+            async run ({ provider, accessToken, query, providers, grantResponse }) {
                 const authProvider = authProviders[provider];
                 assert(authProvider, 'Unknown auth provider');
                 return authProvider.authCallback({
                     accessToken,
                     query,
-                    providers
+                    providers,
+                    grantResponse
                 });
             }
         };