@stratum-hq/lib 1.3.0 → 1.5.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/crypto.d.ts +6 -2
- package/dist/crypto.d.ts.map +1 -1
- package/dist/crypto.js +33 -13
- package/dist/crypto.js.map +1 -1
- package/dist/index.d.ts +3 -2
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +6 -1
- package/dist/index.js.map +1 -1
- package/dist/migrations/028_ancestry_path_prefix_index.sql +12 -0
- package/dist/migrations/029_tenant_parent_cycle_guard.sql +62 -0
- package/dist/migrations/030_redact_url_credentials_audit.sql +112 -0
- package/dist/pool-helpers.d.ts.map +1 -1
- package/dist/pool-helpers.js +20 -4
- package/dist/pool-helpers.js.map +1 -1
- package/dist/services/abac-service.d.ts +1 -1
- package/dist/services/abac-service.d.ts.map +1 -1
- package/dist/services/abac-service.js +17 -11
- package/dist/services/abac-service.js.map +1 -1
- package/dist/services/api-key-service.d.ts +6 -0
- package/dist/services/api-key-service.d.ts.map +1 -1
- package/dist/services/api-key-service.js +55 -8
- package/dist/services/api-key-service.js.map +1 -1
- package/dist/services/audit-service.d.ts.map +1 -1
- package/dist/services/audit-service.js +2 -1
- package/dist/services/audit-service.js.map +1 -1
- package/dist/services/config-service.d.ts.map +1 -1
- package/dist/services/config-service.js +5 -10
- package/dist/services/config-service.js.map +1 -1
- package/dist/services/consent-service.d.ts +2 -2
- package/dist/services/consent-service.d.ts.map +1 -1
- package/dist/services/consent-service.js +6 -1
- package/dist/services/consent-service.js.map +1 -1
- package/dist/services/event-service.d.ts.map +1 -1
- package/dist/services/event-service.js +3 -2
- package/dist/services/event-service.js.map +1 -1
- package/dist/services/key-rotation-service.d.ts +18 -1
- package/dist/services/key-rotation-service.d.ts.map +1 -1
- package/dist/services/key-rotation-service.js +57 -9
- package/dist/services/key-rotation-service.js.map +1 -1
- package/dist/services/permission-service.d.ts.map +1 -1
- package/dist/services/permission-service.js +16 -15
- package/dist/services/permission-service.js.map +1 -1
- package/dist/services/region-service.d.ts.map +1 -1
- package/dist/services/region-service.js +8 -7
- package/dist/services/region-service.js.map +1 -1
- package/dist/services/role-service.d.ts.map +1 -1
- package/dist/services/role-service.js +19 -0
- package/dist/services/role-service.js.map +1 -1
- package/dist/services/tenant-service.d.ts +22 -0
- package/dist/services/tenant-service.d.ts.map +1 -1
- package/dist/services/tenant-service.js +47 -31
- package/dist/services/tenant-service.js.map +1 -1
- package/dist/services/usage-service.d.ts.map +1 -1
- package/dist/services/usage-service.js +2 -0
- package/dist/services/usage-service.js.map +1 -1
- package/dist/services/webhook-service.d.ts.map +1 -1
- package/dist/services/webhook-service.js +11 -1
- package/dist/services/webhook-service.js.map +1 -1
- package/dist/stratum-tables.d.ts +12 -0
- package/dist/stratum-tables.d.ts.map +1 -0
- package/dist/stratum-tables.js +31 -0
- package/dist/stratum-tables.js.map +1 -0
- package/dist/stratum.d.ts +5 -0
- package/dist/stratum.d.ts.map +1 -1
- package/dist/stratum.js +55 -11
- package/dist/stratum.js.map +1 -1
- package/dist/url-redaction.d.ts +9 -0
- package/dist/url-redaction.d.ts.map +1 -0
- package/dist/url-redaction.js +32 -0
- package/dist/url-redaction.js.map +1 -0
- package/dist/validation.d.ts +25 -0
- package/dist/validation.d.ts.map +1 -0
- package/dist/validation.js +23 -0
- package/dist/validation.js.map +1 -0
- package/package.json +5 -5
package/dist/crypto.d.ts
CHANGED
|
@@ -4,6 +4,10 @@ export declare function encrypt(plaintext: string): string;
|
|
|
4
4
|
* Falls back to STRATUM_ENCRYPTION_KEY_PREVIOUS if primary key decryption fails,
|
|
5
5
|
* enabling dual-key reads during rolling deployments. */
|
|
6
6
|
export declare function decrypt(encrypted: string): string;
|
|
7
|
-
/**
|
|
8
|
-
|
|
7
|
+
/** Encrypts a value with the key derived from `keyMaterial`.
|
|
8
|
+
* Key rotation uses it because it must not read or change process.env. */
|
|
9
|
+
export declare function encryptWithKeyMaterial(plaintext: string, keyMaterial: string): string;
|
|
10
|
+
/** Returns the plaintext, or null when the value does not decrypt with the key derived from `keyMaterial`.
|
|
11
|
+
* Key rotation uses the null result to try the next key instead of failing. */
|
|
12
|
+
export declare function decryptWithKeyMaterial(encrypted: string, keyMaterial: string): string | null;
|
|
9
13
|
//# sourceMappingURL=crypto.d.ts.map
|
package/dist/crypto.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAoFA,qFAAqF;AACrF,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED;;yDAEyD;AACzD,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAcjD;AAED;0EAC0E;AAC1E,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAErF;AAED;+EAC+E;AAC/E,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM5F"}
|
package/dist/crypto.js
CHANGED
|
@@ -5,24 +5,33 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
|
|
|
5
5
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
6
6
|
exports.encrypt = encrypt;
|
|
7
7
|
exports.decrypt = decrypt;
|
|
8
|
-
exports.
|
|
8
|
+
exports.encryptWithKeyMaterial = encryptWithKeyMaterial;
|
|
9
|
+
exports.decryptWithKeyMaterial = decryptWithKeyMaterial;
|
|
9
10
|
const node_crypto_1 = __importDefault(require("node:crypto"));
|
|
10
11
|
const ALGORITHM = "aes-256-gcm";
|
|
11
12
|
const IV_LENGTH = 12;
|
|
12
13
|
const AUTH_TAG_LENGTH = 16;
|
|
13
14
|
const CURRENT_KEY_VERSION = "v1";
|
|
14
|
-
//
|
|
15
|
-
// unset
|
|
15
|
+
// Built-in key material is allowed only in local development and test runs
|
|
16
|
+
// (an unset NODE_ENV counts as development). Every other environment, staging
|
|
17
|
+
// and preview included, must supply real key material or refuse to start.
|
|
18
|
+
function nodeEnvRequiringKeyMaterial() {
|
|
19
|
+
const nodeEnv = process.env.NODE_ENV || "development";
|
|
20
|
+
return nodeEnv === "development" || nodeEnv === "test" ? null : nodeEnv;
|
|
21
|
+
}
|
|
22
|
+
// Fixed, public salt used only in development and test when STRATUM_HKDF_SALT
|
|
23
|
+
// is unset. It must stay stable: a per-process salt would make every value
|
|
16
24
|
// encrypted by an earlier process (or another replica) undecryptable. An HKDF
|
|
17
|
-
// salt is not secret; the key material is.
|
|
25
|
+
// salt is not secret; the key material is. Every other environment requires an
|
|
18
26
|
// explicit STRATUM_HKDF_SALT.
|
|
19
27
|
const NON_PRODUCTION_DEFAULT_SALT = "stratum-non-production-hkdf-salt-v1";
|
|
20
28
|
const HKDF_SALT = (() => {
|
|
21
29
|
if (process.env.STRATUM_HKDF_SALT) {
|
|
22
30
|
return Buffer.from(process.env.STRATUM_HKDF_SALT, "hex");
|
|
23
31
|
}
|
|
24
|
-
|
|
25
|
-
|
|
32
|
+
const strictEnv = nodeEnvRequiringKeyMaterial();
|
|
33
|
+
if (strictEnv) {
|
|
34
|
+
throw new Error(`STRATUM_HKDF_SALT must be set in ${strictEnv}`);
|
|
26
35
|
}
|
|
27
36
|
return Buffer.from(NON_PRODUCTION_DEFAULT_SALT, "utf8");
|
|
28
37
|
})();
|
|
@@ -34,10 +43,11 @@ function getEncryptionKey() {
|
|
|
34
43
|
if (envKey) {
|
|
35
44
|
return hkdfDeriveKey(envKey);
|
|
36
45
|
}
|
|
37
|
-
|
|
38
|
-
|
|
46
|
+
const strictEnv = nodeEnvRequiringKeyMaterial();
|
|
47
|
+
if (strictEnv) {
|
|
48
|
+
throw new Error(`STRATUM_ENCRYPTION_KEY must be set in ${strictEnv}`);
|
|
39
49
|
}
|
|
40
|
-
//
|
|
50
|
+
// Development and test only fallback
|
|
41
51
|
return hkdfDeriveKey("stratum-dev-key");
|
|
42
52
|
}
|
|
43
53
|
function deriveKey(keyMaterial) {
|
|
@@ -95,9 +105,19 @@ function decrypt(encrypted) {
|
|
|
95
105
|
throw err;
|
|
96
106
|
}
|
|
97
107
|
}
|
|
98
|
-
/**
|
|
99
|
-
|
|
100
|
-
|
|
101
|
-
return encryptWithKey(plaintext, deriveKey(
|
|
108
|
+
/** Encrypts a value with the key derived from `keyMaterial`.
|
|
109
|
+
* Key rotation uses it because it must not read or change process.env. */
|
|
110
|
+
function encryptWithKeyMaterial(plaintext, keyMaterial) {
|
|
111
|
+
return encryptWithKey(plaintext, deriveKey(keyMaterial));
|
|
112
|
+
}
|
|
113
|
+
/** Returns the plaintext, or null when the value does not decrypt with the key derived from `keyMaterial`.
|
|
114
|
+
* Key rotation uses the null result to try the next key instead of failing. */
|
|
115
|
+
function decryptWithKeyMaterial(encrypted, keyMaterial) {
|
|
116
|
+
try {
|
|
117
|
+
return decryptWithKey(encrypted, deriveKey(keyMaterial));
|
|
118
|
+
}
|
|
119
|
+
catch {
|
|
120
|
+
return null;
|
|
121
|
+
}
|
|
102
122
|
}
|
|
103
123
|
//# sourceMappingURL=crypto.js.map
|
package/dist/crypto.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":";;;;;
|
|
1
|
+
{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":";;;;;AAqFA,0BAEC;AAKD,0BAcC;AAID,wDAEC;AAID,wDAMC;AA1HD,8DAAiC;AAEjC,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAEjC,2EAA2E;AAC3E,8EAA8E;AAC9E,0EAA0E;AAC1E,SAAS,2BAA2B;IAClC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,aAAa,CAAC;IACtD,OAAO,OAAO,KAAK,aAAa,IAAI,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;AAC1E,CAAC;AAED,8EAA8E;AAC9E,2EAA2E;AAC3E,8EAA8E;AAC9E,+EAA+E;AAC/E,8BAA8B;AAC9B,MAAM,2BAA2B,GAAG,qCAAqC,CAAC;AAE1E,MAAM,SAAS,GAAW,CAAC,GAAG,EAAE;IAC9B,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,SAAS,GAAG,2BAA2B,EAAE,CAAC;IAChD,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,oCAAoC,SAAS,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,MAAM,CAAC,CAAC;AAC1D,CAAC,CAAC,EAAE,CAAC;AAEL,SAAS,aAAa,CAAC,WAAmB,EAAE,IAAI,GAAG,iBAAiB;IAClE,OAAO,MAAM,CAAC,IAAI,CAChB,qBAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,CACjF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB;IACvB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACxF,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IACD,MAAM,SAAS,GAAG,2BAA2B,EAAE,CAAC;IAChD,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,yCAAyC,SAAS,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,qCAAqC;IACrC,OAAO,aAAa,CAAC,iBAAiB,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,SAAS,CAAC,WAAmB;IACpC,OAAO,aAAa,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,cAAc,CAAC,SAAiB,EAAE,GAAW;IACpD,MAAM,EAAE,GAAG,qBAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,qBAAM,CAAC,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC,CAAC;IAC7F,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACpF,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IACpC,OAAO,GAAG,mBAAmB,IAAI,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AAChH,CAAC;AAED,SAAS,cAAc,CAAC,SAAiB,EAAE,GAAW;IACpD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,KAAa,EAAE,UAAkB,EAAE,aAAqB,CAAC;IAC7D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACnD,sCAAsC;QACtC,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,aAAa,CAAC,GAAG,KAAyC,CAAC;IACnF,CAAC;SAAM,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,gCAAgC;QAChC,CAAC,KAAK,EAAE,UAAU,EAAE,aAAa,CAAC,GAAG,KAAiC,CAAC;IACzE,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,qBAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC,CAAC;IACjG,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC7B,OAAO,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAC/E,CAAC;AAED,qFAAqF;AACrF,SAAgB,OAAO,CAAC,SAAiB;IACvC,OAAO,cAAc,CAAC,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC;AACvD,CAAC;AAED;;yDAEyD;AACzD,SAAgB,OAAO,CAAC,SAAiB;IACvC,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC;QAChE,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,OAAO,cAAc,CAAC,SAAS,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;YAC/D,CAAC;YAAC,MAAM,CAAC;gBACP,8CAA8C;YAChD,CAAC;QACH,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;0EAC0E;AAC1E,SAAgB,sBAAsB,CAAC,SAAiB,EAAE,WAAmB;IAC3E,OAAO,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED;+EAC+E;AAC/E,SAAgB,sBAAsB,CAAC,SAAiB,EAAE,WAAmB;IAC3E,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
|
package/dist/index.d.ts
CHANGED
|
@@ -1,17 +1,18 @@
|
|
|
1
1
|
export { Stratum, type StratumOptions } from "./stratum.js";
|
|
2
2
|
export { migrate, type MigrateOptions } from "./migrate.js";
|
|
3
3
|
export { migrateAllSchemas, type MigrateSchemasOptions, type MigrateSchemasResult, } from "./migrate-schemas.js";
|
|
4
|
+
export { STRATUM_TABLES } from "./stratum-tables.js";
|
|
4
5
|
export { withClient, withTransaction } from "./pool-helpers.js";
|
|
5
6
|
export { runScopedJob, type ScopedJobFn, type RunScopedJobOptions, } from "./scoped-job.js";
|
|
6
7
|
export { verifyWebhookSignature, signWebhookPayload, DEFAULT_WEBHOOK_TOLERANCE_SECONDS, type VerifyWebhookOptions, } from "./webhook-signature.js";
|
|
7
8
|
export { traced, getTracer, isTracingEnabled } from "./telemetry.js";
|
|
8
|
-
export { ErrorCode, StratumError, TenantNotFoundError, TenantAlreadyExistsError, TenantHasChildrenError, TenantCycleDetectedError, TenantArchivedError, TenantSuspendedError, TenantPendingError, TenantProvisioningError, InvalidTenantStateError, TenantContextNotFoundError, IsolationViolationError, IsolationStrategyUnsupportedError, PermissionLockedError, PermissionNotFoundError, PermissionRevocationDeniedError, ConfigLockedError, ConfigNotFoundError, ValidationError, UnauthorizedError, ForbiddenError, WebhookNotFoundError, WebhookDeliveryError, WebhookUrlValidationError, AbacPolicyNotFoundError, InvalidAbacOperatorError, AbacPolicyLockedError, } from "@stratum-hq/core";
|
|
9
|
+
export { ErrorCode, StratumError, TenantNotFoundError, TenantAlreadyExistsError, TenantHasChildrenError, TenantCycleDetectedError, TenantArchivedError, TenantSuspendedError, TenantPendingError, TenantProvisioningError, InvalidTenantStateError, TenantContextNotFoundError, IsolationViolationError, IsolationStrategyUnsupportedError, PermissionLockedError, PermissionNotFoundError, PermissionRevocationDeniedError, ConfigLockedError, ConfigNotFoundError, ValidationError, UnauthorizedError, ForbiddenError, RegionInUseError, RegionNotActiveError, WebhookNotFoundError, WebhookDeliveryError, WebhookUrlValidationError, RegionNotFoundError, AbacPolicyNotFoundError, InvalidAbacOperatorError, AbacPolicyLockedError, } from "@stratum-hq/core";
|
|
9
10
|
export type { TenantNode, TenantContext, CreateTenantInput, UpdateTenantInput, MoveTenantInput, PaginationInput, PaginatedResult, ConfigEntry, SetConfigInput, BatchSetConfigEntry, ResolvedConfigEntry, ResolvedConfig, PermissionPolicy, CreatePermissionInput, UpdatePermissionInput, ResolvedPermission, } from "@stratum-hq/core";
|
|
10
11
|
export { RateLimiter, MemoryRateLimitStore } from "./services/rate-limit-service.js";
|
|
11
12
|
export type { RateLimit, RateLimitResult, RateLimitState, RateLimitStore, RateLimitResolver, RateLimiterOptions, } from "./services/rate-limit-service.js";
|
|
12
13
|
export type { ApiKeyRecord, CreatedApiKey, ValidatedApiKey, CreateApiKeyOptions } from "./services/api-key-service.js";
|
|
13
14
|
export type { BatchCreateResult } from "./services/tenant-service.js";
|
|
14
|
-
export type { KeyRotationResult } from "./services/key-rotation-service.js";
|
|
15
|
+
export type { KeyRotationResult, KeyRotationUnreadableRow } from "./services/key-rotation-service.js";
|
|
15
16
|
export type { DeliveryStats } from "./services/event-service.js";
|
|
16
17
|
export type { Role, CreateRoleInput, UpdateRoleInput } from "./services/role-service.js";
|
|
17
18
|
export type { AuditContext, AuditEntry, AuditLogQuery, RecordAuditEventInput } from "@stratum-hq/core";
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EACL,iBAAiB,EACjB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,GAC1B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EACL,YAAY,EACZ,KAAK,WAAW,EAChB,KAAK,mBAAmB,GACzB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,iCAAiC,EACjC,KAAK,oBAAoB,GAC1B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAKrE,OAAO,EACL,SAAS,EACT,YAAY,EACZ,mBAAmB,EACnB,wBAAwB,EACxB,sBAAsB,EACtB,wBAAwB,EACxB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,uBAAuB,EACvB,uBAAuB,EACvB,0BAA0B,EAC1B,uBAAuB,EACvB,iCAAiC,EACjC,qBAAqB,EACrB,uBAAuB,EACvB,+BAA+B,EAC/B,iBAAiB,EACjB,mBAAmB,EACnB,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,oBAAoB,EACpB,oBAAoB,EACpB,yBAAyB,EACzB,uBAAuB,EACvB,wBAAwB,EACxB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAG1B,YAAY,EACV,UAAU,EACV,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,eAAe,EACf,WAAW,EACX,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACrF,YAAY,EACV,SAAS,EACT,eAAe,EACf,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,kCAAkC,CAAC;AAE1C,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACvH,YAAY,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACtE,YAAY,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EACL,iBAAiB,EACjB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,GAC1B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EACL,YAAY,EACZ,KAAK,WAAW,EAChB,KAAK,mBAAmB,GACzB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,iCAAiC,EACjC,KAAK,oBAAoB,GAC1B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAKrE,OAAO,EACL,SAAS,EACT,YAAY,EACZ,mBAAmB,EACnB,wBAAwB,EACxB,sBAAsB,EACtB,wBAAwB,EACxB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,uBAAuB,EACvB,uBAAuB,EACvB,0BAA0B,EAC1B,uBAAuB,EACvB,iCAAiC,EACjC,qBAAqB,EACrB,uBAAuB,EACvB,+BAA+B,EAC/B,iBAAiB,EACjB,mBAAmB,EACnB,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,yBAAyB,EACzB,mBAAmB,EACnB,uBAAuB,EACvB,wBAAwB,EACxB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAG1B,YAAY,EACV,UAAU,EACV,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,eAAe,EACf,WAAW,EACX,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACrF,YAAY,EACV,SAAS,EACT,eAAe,EACf,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,kCAAkC,CAAC;AAE1C,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACvH,YAAY,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACtE,YAAY,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AACtG,YAAY,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAGzF,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAGvG,YAAY,EACV,gBAAgB,EAChB,UAAU,EACV,cAAc,EACd,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACxD,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -1,12 +1,14 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.noopLogger = exports.defaultLogger = exports.MemoryRateLimitStore = exports.RateLimiter = exports.AbacPolicyLockedError = exports.InvalidAbacOperatorError = exports.AbacPolicyNotFoundError = exports.WebhookUrlValidationError = exports.WebhookDeliveryError = exports.WebhookNotFoundError = exports.ForbiddenError = exports.UnauthorizedError = exports.ValidationError = exports.ConfigNotFoundError = exports.ConfigLockedError = exports.PermissionRevocationDeniedError = exports.PermissionNotFoundError = exports.PermissionLockedError = exports.IsolationStrategyUnsupportedError = exports.IsolationViolationError = exports.TenantContextNotFoundError = exports.InvalidTenantStateError = exports.TenantProvisioningError = exports.TenantPendingError = exports.TenantSuspendedError = exports.TenantArchivedError = exports.TenantCycleDetectedError = exports.TenantHasChildrenError = exports.TenantAlreadyExistsError = exports.TenantNotFoundError = exports.StratumError = exports.ErrorCode = exports.isTracingEnabled = exports.getTracer = exports.traced = exports.DEFAULT_WEBHOOK_TOLERANCE_SECONDS = exports.signWebhookPayload = exports.verifyWebhookSignature = exports.runScopedJob = exports.withTransaction = exports.withClient = exports.migrateAllSchemas = exports.migrate = exports.Stratum = void 0;
|
|
3
|
+
exports.noopLogger = exports.defaultLogger = exports.MemoryRateLimitStore = exports.RateLimiter = exports.AbacPolicyLockedError = exports.InvalidAbacOperatorError = exports.AbacPolicyNotFoundError = exports.RegionNotFoundError = exports.WebhookUrlValidationError = exports.WebhookDeliveryError = exports.WebhookNotFoundError = exports.RegionNotActiveError = exports.RegionInUseError = exports.ForbiddenError = exports.UnauthorizedError = exports.ValidationError = exports.ConfigNotFoundError = exports.ConfigLockedError = exports.PermissionRevocationDeniedError = exports.PermissionNotFoundError = exports.PermissionLockedError = exports.IsolationStrategyUnsupportedError = exports.IsolationViolationError = exports.TenantContextNotFoundError = exports.InvalidTenantStateError = exports.TenantProvisioningError = exports.TenantPendingError = exports.TenantSuspendedError = exports.TenantArchivedError = exports.TenantCycleDetectedError = exports.TenantHasChildrenError = exports.TenantAlreadyExistsError = exports.TenantNotFoundError = exports.StratumError = exports.ErrorCode = exports.isTracingEnabled = exports.getTracer = exports.traced = exports.DEFAULT_WEBHOOK_TOLERANCE_SECONDS = exports.signWebhookPayload = exports.verifyWebhookSignature = exports.runScopedJob = exports.withTransaction = exports.withClient = exports.STRATUM_TABLES = exports.migrateAllSchemas = exports.migrate = exports.Stratum = void 0;
|
|
4
4
|
var stratum_js_1 = require("./stratum.js");
|
|
5
5
|
Object.defineProperty(exports, "Stratum", { enumerable: true, get: function () { return stratum_js_1.Stratum; } });
|
|
6
6
|
var migrate_js_1 = require("./migrate.js");
|
|
7
7
|
Object.defineProperty(exports, "migrate", { enumerable: true, get: function () { return migrate_js_1.migrate; } });
|
|
8
8
|
var migrate_schemas_js_1 = require("./migrate-schemas.js");
|
|
9
9
|
Object.defineProperty(exports, "migrateAllSchemas", { enumerable: true, get: function () { return migrate_schemas_js_1.migrateAllSchemas; } });
|
|
10
|
+
var stratum_tables_js_1 = require("./stratum-tables.js");
|
|
11
|
+
Object.defineProperty(exports, "STRATUM_TABLES", { enumerable: true, get: function () { return stratum_tables_js_1.STRATUM_TABLES; } });
|
|
10
12
|
var pool_helpers_js_1 = require("./pool-helpers.js");
|
|
11
13
|
Object.defineProperty(exports, "withClient", { enumerable: true, get: function () { return pool_helpers_js_1.withClient; } });
|
|
12
14
|
Object.defineProperty(exports, "withTransaction", { enumerable: true, get: function () { return pool_helpers_js_1.withTransaction; } });
|
|
@@ -46,9 +48,12 @@ Object.defineProperty(exports, "ConfigNotFoundError", { enumerable: true, get: f
|
|
|
46
48
|
Object.defineProperty(exports, "ValidationError", { enumerable: true, get: function () { return core_1.ValidationError; } });
|
|
47
49
|
Object.defineProperty(exports, "UnauthorizedError", { enumerable: true, get: function () { return core_1.UnauthorizedError; } });
|
|
48
50
|
Object.defineProperty(exports, "ForbiddenError", { enumerable: true, get: function () { return core_1.ForbiddenError; } });
|
|
51
|
+
Object.defineProperty(exports, "RegionInUseError", { enumerable: true, get: function () { return core_1.RegionInUseError; } });
|
|
52
|
+
Object.defineProperty(exports, "RegionNotActiveError", { enumerable: true, get: function () { return core_1.RegionNotActiveError; } });
|
|
49
53
|
Object.defineProperty(exports, "WebhookNotFoundError", { enumerable: true, get: function () { return core_1.WebhookNotFoundError; } });
|
|
50
54
|
Object.defineProperty(exports, "WebhookDeliveryError", { enumerable: true, get: function () { return core_1.WebhookDeliveryError; } });
|
|
51
55
|
Object.defineProperty(exports, "WebhookUrlValidationError", { enumerable: true, get: function () { return core_1.WebhookUrlValidationError; } });
|
|
56
|
+
Object.defineProperty(exports, "RegionNotFoundError", { enumerable: true, get: function () { return core_1.RegionNotFoundError; } });
|
|
52
57
|
Object.defineProperty(exports, "AbacPolicyNotFoundError", { enumerable: true, get: function () { return core_1.AbacPolicyNotFoundError; } });
|
|
53
58
|
Object.defineProperty(exports, "InvalidAbacOperatorError", { enumerable: true, get: function () { return core_1.InvalidAbacOperatorError; } });
|
|
54
59
|
Object.defineProperty(exports, "AbacPolicyLockedError", { enumerable: true, get: function () { return core_1.AbacPolicyLockedError; } });
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,2CAA4D;AAAnD,qGAAA,OAAO,OAAA;AAChB,2CAA4D;AAAnD,qGAAA,OAAO,OAAA;AAChB,2DAI8B;AAH5B,uHAAA,iBAAiB,OAAA;AAInB,qDAAgE;AAAvD,6GAAA,UAAU,OAAA;AAAE,kHAAA,eAAe,OAAA;AACpC,iDAIyB;AAHvB,6GAAA,YAAY,OAAA;AAId,+DAKgC;AAJ9B,8HAAA,sBAAsB,OAAA;AACtB,0HAAA,kBAAkB,OAAA;AAClB,yIAAA,iCAAiC,OAAA;AAGnC,+CAAqE;AAA5D,sGAAA,MAAM,OAAA;AAAE,yGAAA,SAAS,OAAA;AAAE,gHAAA,gBAAgB,OAAA;AAE5C,kFAAkF;AAClF,+EAA+E;AAC/E,8EAA8E;AAC9E,
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,2CAA4D;AAAnD,qGAAA,OAAO,OAAA;AAChB,2CAA4D;AAAnD,qGAAA,OAAO,OAAA;AAChB,2DAI8B;AAH5B,uHAAA,iBAAiB,OAAA;AAInB,yDAAqD;AAA5C,mHAAA,cAAc,OAAA;AACvB,qDAAgE;AAAvD,6GAAA,UAAU,OAAA;AAAE,kHAAA,eAAe,OAAA;AACpC,iDAIyB;AAHvB,6GAAA,YAAY,OAAA;AAId,+DAKgC;AAJ9B,8HAAA,sBAAsB,OAAA;AACtB,0HAAA,kBAAkB,OAAA;AAClB,yIAAA,iCAAiC,OAAA;AAGnC,+CAAqE;AAA5D,sGAAA,MAAM,OAAA;AAAE,yGAAA,SAAS,OAAA;AAAE,gHAAA,gBAAgB,OAAA;AAE5C,kFAAkF;AAClF,+EAA+E;AAC/E,8EAA8E;AAC9E,yCAgC0B;AA/BxB,iGAAA,SAAS,OAAA;AACT,oGAAA,YAAY,OAAA;AACZ,2GAAA,mBAAmB,OAAA;AACnB,gHAAA,wBAAwB,OAAA;AACxB,8GAAA,sBAAsB,OAAA;AACtB,gHAAA,wBAAwB,OAAA;AACxB,2GAAA,mBAAmB,OAAA;AACnB,4GAAA,oBAAoB,OAAA;AACpB,0GAAA,kBAAkB,OAAA;AAClB,+GAAA,uBAAuB,OAAA;AACvB,+GAAA,uBAAuB,OAAA;AACvB,kHAAA,0BAA0B,OAAA;AAC1B,+GAAA,uBAAuB,OAAA;AACvB,yHAAA,iCAAiC,OAAA;AACjC,6GAAA,qBAAqB,OAAA;AACrB,+GAAA,uBAAuB,OAAA;AACvB,uHAAA,+BAA+B,OAAA;AAC/B,yGAAA,iBAAiB,OAAA;AACjB,2GAAA,mBAAmB,OAAA;AACnB,uGAAA,eAAe,OAAA;AACf,yGAAA,iBAAiB,OAAA;AACjB,sGAAA,cAAc,OAAA;AACd,wGAAA,gBAAgB,OAAA;AAChB,4GAAA,oBAAoB,OAAA;AACpB,4GAAA,oBAAoB,OAAA;AACpB,4GAAA,oBAAoB,OAAA;AACpB,iHAAA,yBAAyB,OAAA;AACzB,2GAAA,mBAAmB,OAAA;AACnB,+GAAA,uBAAuB,OAAA;AACvB,gHAAA,wBAAwB,OAAA;AACxB,6GAAA,qBAAqB,OAAA;AAuBvB,0EAAqF;AAA5E,oHAAA,WAAW,OAAA;AAAE,6HAAA,oBAAoB,OAAA;AA2B1C,yCAAwD;AAA/C,0GAAA,aAAa,OAAA;AAAE,uGAAA,UAAU,OAAA"}
|
|
@@ -0,0 +1,12 @@
|
|
|
1
|
+
-- Migration 028: Index ancestry_path for subtree queries.
|
|
2
|
+
--
|
|
3
|
+
-- getDescendants and the CASCADE revocations in permission-service and
|
|
4
|
+
-- abac-service select a subtree by the prefix of ancestry_path. text_pattern_ops
|
|
5
|
+
-- lets a btree index serve a prefix LIKE whatever the database collation is.
|
|
6
|
+
-- Without this index, every subtree query scans the whole tenants table.
|
|
7
|
+
--
|
|
8
|
+
-- This statement blocks writes to tenants until the index is built. On a large
|
|
9
|
+
-- table, an operator can build it first with CREATE INDEX CONCURRENTLY and the
|
|
10
|
+
-- same name and definition. IF NOT EXISTS then skips this statement.
|
|
11
|
+
CREATE INDEX IF NOT EXISTS idx_tenant_ancestry_path_prefix
|
|
12
|
+
ON tenants (ancestry_path text_pattern_ops);
|
|
@@ -0,0 +1,62 @@
|
|
|
1
|
+
-- Migration 029: Refuse a parent_id that makes a tenant its own ancestor.
|
|
2
|
+
--
|
|
3
|
+
-- The tenant tree must stay a tree whoever writes to it. The library already
|
|
4
|
+
-- checks for cycles before a move; this BEFORE trigger enforces the same rule
|
|
5
|
+
-- in the database. It walks up from the new parent and refuses the row when the
|
|
6
|
+
-- walk reaches the row itself. The walk remembers the ids it has seen, so it
|
|
7
|
+
-- also ends on a cycle that is already in the data.
|
|
8
|
+
--
|
|
9
|
+
-- It fires on every write that sets parent_id or slug, including the
|
|
10
|
+
-- `slug = slug` updates that carry ancestry_ltree down a subtree (024). A cycle
|
|
11
|
+
-- already present in the data therefore stops the first write that touches it
|
|
12
|
+
-- with this error, instead of carrying the ltree around the loop. It is named
|
|
13
|
+
-- so that it runs before maintain_tenant_ancestry_ltree (BEFORE triggers run in
|
|
14
|
+
-- name order).
|
|
15
|
+
--
|
|
16
|
+
-- The walk must see the whole chain even when the writer is under row-level
|
|
17
|
+
-- security (019), where a session sees only its own tenant row. SECURITY
|
|
18
|
+
-- DEFINER would not help: FORCE ROW LEVEL SECURITY applies to the table owner
|
|
19
|
+
-- too, and the recommended owner is the application role without BYPASSRLS.
|
|
20
|
+
-- The function therefore turns on the 019 bypass setting for its own duration
|
|
21
|
+
-- only (a function SET clause is restored when the function exits, on error
|
|
22
|
+
-- too). The function reads nothing back to the caller: it returns the row it
|
|
23
|
+
-- was given or raises. search_path is pinned below to pg_catalog and the
|
|
24
|
+
-- schema this migration runs in, which is where 001 created tenants.
|
|
25
|
+
CREATE OR REPLACE FUNCTION refuse_tenant_parent_cycle()
|
|
26
|
+
RETURNS TRIGGER
|
|
27
|
+
SET app.bypass_rls = 'on'
|
|
28
|
+
AS $$
|
|
29
|
+
BEGIN
|
|
30
|
+
IF NEW.parent_id = NEW.id OR EXISTS (
|
|
31
|
+
WITH RECURSIVE up(id, parent_id, seen) AS (
|
|
32
|
+
SELECT t.id, t.parent_id, ARRAY[t.id]
|
|
33
|
+
FROM tenants t
|
|
34
|
+
WHERE t.id = NEW.parent_id
|
|
35
|
+
UNION ALL
|
|
36
|
+
SELECT t.id, t.parent_id, up.seen || t.id
|
|
37
|
+
FROM tenants t
|
|
38
|
+
JOIN up ON t.id = up.parent_id
|
|
39
|
+
WHERE t.id <> ALL (up.seen)
|
|
40
|
+
)
|
|
41
|
+
SELECT 1 FROM up WHERE up.id = NEW.id
|
|
42
|
+
) THEN
|
|
43
|
+
RAISE EXCEPTION 'tenant % cannot be its own ancestor (parent_id cycle)', NEW.id
|
|
44
|
+
USING ERRCODE = 'check_violation';
|
|
45
|
+
END IF;
|
|
46
|
+
RETURN NEW;
|
|
47
|
+
END;
|
|
48
|
+
$$ language 'plpgsql';
|
|
49
|
+
|
|
50
|
+
DO $pin$ BEGIN
|
|
51
|
+
EXECUTE format(
|
|
52
|
+
'ALTER FUNCTION refuse_tenant_parent_cycle() SET search_path = pg_catalog, %I',
|
|
53
|
+
current_schema()
|
|
54
|
+
);
|
|
55
|
+
END $pin$;
|
|
56
|
+
|
|
57
|
+
DROP TRIGGER IF EXISTS guard_tenant_parent_cycle ON tenants;
|
|
58
|
+
CREATE TRIGGER guard_tenant_parent_cycle
|
|
59
|
+
BEFORE INSERT OR UPDATE OF parent_id, slug ON tenants
|
|
60
|
+
FOR EACH ROW
|
|
61
|
+
WHEN (NEW.parent_id IS NOT NULL)
|
|
62
|
+
EXECUTE FUNCTION refuse_tenant_parent_cycle();
|
|
@@ -0,0 +1,112 @@
|
|
|
1
|
+
-- Migration 030: Redact URLs in existing webhook and region audit rows.
|
|
2
|
+
--
|
|
3
|
+
-- Webhook and region audit rows used to record the full webhook URL and
|
|
4
|
+
-- control-plane URL. Userinfo, query string and fragment can carry access
|
|
5
|
+
-- tokens, and some providers put the secret in the path. New rows record
|
|
6
|
+
-- `scheme://host/` when the path is empty or "/", and otherwise
|
|
7
|
+
-- `scheme://host/#fp=<first 12 hex characters of sha256(path)>`, so rows for
|
|
8
|
+
-- different endpoints stay distinguishable. A URL without a host (for example
|
|
9
|
+
-- `mailto:`) is recorded as "[REDACTED]". This migration applies the same
|
|
10
|
+
-- reduction to rows written before that change, using the same expression as
|
|
11
|
+
-- the write path, and leaves values already in that form unchanged, so running
|
|
12
|
+
-- it again changes nothing. The rest of each audit row is kept.
|
|
13
|
+
--
|
|
14
|
+
-- Runs under bypass so row-level security (019) does not hide rows from the
|
|
15
|
+
-- migration role.
|
|
16
|
+
SET LOCAL app.bypass_rls = 'on';
|
|
17
|
+
|
|
18
|
+
UPDATE audit_logs AS a
|
|
19
|
+
SET after_state = jsonb_set(a.after_state, '{url}', to_jsonb(r.redacted))
|
|
20
|
+
FROM (
|
|
21
|
+
SELECT id,
|
|
22
|
+
CASE
|
|
23
|
+
WHEN v ~ '^[A-Za-z][A-Za-z0-9+.-]*://[^/?#@]+/#fp=[0-9a-f]{12}$' THEN v
|
|
24
|
+
WHEN m IS NULL OR m[2] = '' THEN '[REDACTED]'
|
|
25
|
+
WHEN m[3] IN ('', '/') THEN m[1] || m[2] || '/'
|
|
26
|
+
ELSE m[1] || m[2] || '/#fp=' || left(encode(sha256(convert_to(m[3], 'UTF8')), 'hex'), 12)
|
|
27
|
+
END AS redacted
|
|
28
|
+
FROM (
|
|
29
|
+
SELECT id, after_state->>'url' AS v,
|
|
30
|
+
regexp_match(after_state->>'url', '^([A-Za-z][A-Za-z0-9+.-]*://)(?:[^/?#]*@)?([^/?#]*)([^?#]*)') AS m
|
|
31
|
+
FROM audit_logs
|
|
32
|
+
WHERE resource_type = 'webhook'
|
|
33
|
+
AND action LIKE 'webhook.%'
|
|
34
|
+
AND after_state IS NOT NULL
|
|
35
|
+
AND jsonb_typeof(after_state) = 'object'
|
|
36
|
+
AND jsonb_typeof(after_state->'url') = 'string'
|
|
37
|
+
) AS s
|
|
38
|
+
) AS r
|
|
39
|
+
WHERE a.id = r.id
|
|
40
|
+
AND a.after_state->>'url' IS DISTINCT FROM r.redacted;
|
|
41
|
+
|
|
42
|
+
UPDATE audit_logs AS a
|
|
43
|
+
SET before_state = jsonb_set(a.before_state, '{url}', to_jsonb(r.redacted))
|
|
44
|
+
FROM (
|
|
45
|
+
SELECT id,
|
|
46
|
+
CASE
|
|
47
|
+
WHEN v ~ '^[A-Za-z][A-Za-z0-9+.-]*://[^/?#@]+/#fp=[0-9a-f]{12}$' THEN v
|
|
48
|
+
WHEN m IS NULL OR m[2] = '' THEN '[REDACTED]'
|
|
49
|
+
WHEN m[3] IN ('', '/') THEN m[1] || m[2] || '/'
|
|
50
|
+
ELSE m[1] || m[2] || '/#fp=' || left(encode(sha256(convert_to(m[3], 'UTF8')), 'hex'), 12)
|
|
51
|
+
END AS redacted
|
|
52
|
+
FROM (
|
|
53
|
+
SELECT id, before_state->>'url' AS v,
|
|
54
|
+
regexp_match(before_state->>'url', '^([A-Za-z][A-Za-z0-9+.-]*://)(?:[^/?#]*@)?([^/?#]*)([^?#]*)') AS m
|
|
55
|
+
FROM audit_logs
|
|
56
|
+
WHERE resource_type = 'webhook'
|
|
57
|
+
AND action LIKE 'webhook.%'
|
|
58
|
+
AND before_state IS NOT NULL
|
|
59
|
+
AND jsonb_typeof(before_state) = 'object'
|
|
60
|
+
AND jsonb_typeof(before_state->'url') = 'string'
|
|
61
|
+
) AS s
|
|
62
|
+
) AS r
|
|
63
|
+
WHERE a.id = r.id
|
|
64
|
+
AND a.before_state->>'url' IS DISTINCT FROM r.redacted;
|
|
65
|
+
|
|
66
|
+
UPDATE audit_logs AS a
|
|
67
|
+
SET after_state = jsonb_set(a.after_state, '{control_plane_url}', to_jsonb(r.redacted))
|
|
68
|
+
FROM (
|
|
69
|
+
SELECT id,
|
|
70
|
+
CASE
|
|
71
|
+
WHEN v ~ '^[A-Za-z][A-Za-z0-9+.-]*://[^/?#@]+/#fp=[0-9a-f]{12}$' THEN v
|
|
72
|
+
WHEN m IS NULL OR m[2] = '' THEN '[REDACTED]'
|
|
73
|
+
WHEN m[3] IN ('', '/') THEN m[1] || m[2] || '/'
|
|
74
|
+
ELSE m[1] || m[2] || '/#fp=' || left(encode(sha256(convert_to(m[3], 'UTF8')), 'hex'), 12)
|
|
75
|
+
END AS redacted
|
|
76
|
+
FROM (
|
|
77
|
+
SELECT id, after_state->>'control_plane_url' AS v,
|
|
78
|
+
regexp_match(after_state->>'control_plane_url', '^([A-Za-z][A-Za-z0-9+.-]*://)(?:[^/?#]*@)?([^/?#]*)([^?#]*)') AS m
|
|
79
|
+
FROM audit_logs
|
|
80
|
+
WHERE resource_type = 'region'
|
|
81
|
+
AND action LIKE 'region.%'
|
|
82
|
+
AND after_state IS NOT NULL
|
|
83
|
+
AND jsonb_typeof(after_state) = 'object'
|
|
84
|
+
AND jsonb_typeof(after_state->'control_plane_url') = 'string'
|
|
85
|
+
) AS s
|
|
86
|
+
) AS r
|
|
87
|
+
WHERE a.id = r.id
|
|
88
|
+
AND a.after_state->>'control_plane_url' IS DISTINCT FROM r.redacted;
|
|
89
|
+
|
|
90
|
+
UPDATE audit_logs AS a
|
|
91
|
+
SET before_state = jsonb_set(a.before_state, '{control_plane_url}', to_jsonb(r.redacted))
|
|
92
|
+
FROM (
|
|
93
|
+
SELECT id,
|
|
94
|
+
CASE
|
|
95
|
+
WHEN v ~ '^[A-Za-z][A-Za-z0-9+.-]*://[^/?#@]+/#fp=[0-9a-f]{12}$' THEN v
|
|
96
|
+
WHEN m IS NULL OR m[2] = '' THEN '[REDACTED]'
|
|
97
|
+
WHEN m[3] IN ('', '/') THEN m[1] || m[2] || '/'
|
|
98
|
+
ELSE m[1] || m[2] || '/#fp=' || left(encode(sha256(convert_to(m[3], 'UTF8')), 'hex'), 12)
|
|
99
|
+
END AS redacted
|
|
100
|
+
FROM (
|
|
101
|
+
SELECT id, before_state->>'control_plane_url' AS v,
|
|
102
|
+
regexp_match(before_state->>'control_plane_url', '^([A-Za-z][A-Za-z0-9+.-]*://)(?:[^/?#]*@)?([^/?#]*)([^?#]*)') AS m
|
|
103
|
+
FROM audit_logs
|
|
104
|
+
WHERE resource_type = 'region'
|
|
105
|
+
AND action LIKE 'region.%'
|
|
106
|
+
AND before_state IS NOT NULL
|
|
107
|
+
AND jsonb_typeof(before_state) = 'object'
|
|
108
|
+
AND jsonb_typeof(before_state->'control_plane_url') = 'string'
|
|
109
|
+
) AS s
|
|
110
|
+
) AS r
|
|
111
|
+
WHERE a.id = r.id
|
|
112
|
+
AND a.before_state->>'control_plane_url' IS DISTINCT FROM r.redacted;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"pool-helpers.d.ts","sourceRoot":"","sources":["../src/pool-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;
|
|
1
|
+
{"version":3,"file":"pool-helpers.d.ts","sourceRoot":"","sources":["../src/pool-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AAuCpB,wBAAsB,UAAU,CAAC,CAAC,EAChC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,GACxC,OAAO,CAAC,CAAC,CAAC,CAeZ;AAED,wBAAsB,eAAe,CAAC,CAAC,EACrC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,GACxC,OAAO,CAAC,CAAC,CAAC,CAeZ"}
|
package/dist/pool-helpers.js
CHANGED
|
@@ -23,8 +23,23 @@ async function enterBypass(client) {
|
|
|
23
23
|
// set_config('app.bypass_rls', 'on', true).
|
|
24
24
|
await client.query("SET LOCAL app.bypass_rls = 'on'");
|
|
25
25
|
}
|
|
26
|
+
// A failed ROLLBACK must not replace the caller's error. Callers map error
|
|
27
|
+
// codes such as 23505, so the original error must reach them unchanged. The
|
|
28
|
+
// ROLLBACK error goes to client.release instead: a truthy argument makes
|
|
29
|
+
// pg-pool destroy the connection, so no later caller gets a connection in an
|
|
30
|
+
// unknown transaction state.
|
|
31
|
+
async function rollback(client) {
|
|
32
|
+
try {
|
|
33
|
+
await client.query("ROLLBACK");
|
|
34
|
+
return undefined;
|
|
35
|
+
}
|
|
36
|
+
catch (err) {
|
|
37
|
+
return err instanceof Error ? err : new Error(String(err));
|
|
38
|
+
}
|
|
39
|
+
}
|
|
26
40
|
async function withClient(pool, fn) {
|
|
27
41
|
const client = await pool.connect();
|
|
42
|
+
let rollbackErr;
|
|
28
43
|
try {
|
|
29
44
|
await client.query("BEGIN");
|
|
30
45
|
await enterBypass(client);
|
|
@@ -33,15 +48,16 @@ async function withClient(pool, fn) {
|
|
|
33
48
|
return result;
|
|
34
49
|
}
|
|
35
50
|
catch (err) {
|
|
36
|
-
await client
|
|
51
|
+
rollbackErr = await rollback(client);
|
|
37
52
|
throw err;
|
|
38
53
|
}
|
|
39
54
|
finally {
|
|
40
|
-
client.release();
|
|
55
|
+
client.release(rollbackErr);
|
|
41
56
|
}
|
|
42
57
|
}
|
|
43
58
|
async function withTransaction(pool, fn) {
|
|
44
59
|
const client = await pool.connect();
|
|
60
|
+
let rollbackErr;
|
|
45
61
|
try {
|
|
46
62
|
await client.query("BEGIN");
|
|
47
63
|
await enterBypass(client);
|
|
@@ -50,11 +66,11 @@ async function withTransaction(pool, fn) {
|
|
|
50
66
|
return result;
|
|
51
67
|
}
|
|
52
68
|
catch (err) {
|
|
53
|
-
await client
|
|
69
|
+
rollbackErr = await rollback(client);
|
|
54
70
|
throw err;
|
|
55
71
|
}
|
|
56
72
|
finally {
|
|
57
|
-
client.release();
|
|
73
|
+
client.release(rollbackErr);
|
|
58
74
|
}
|
|
59
75
|
}
|
|
60
76
|
//# sourceMappingURL=pool-helpers.js.map
|
package/dist/pool-helpers.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"pool-helpers.js","sourceRoot":"","sources":["../src/pool-helpers.ts"],"names":[],"mappings":";;
|
|
1
|
+
{"version":3,"file":"pool-helpers.js","sourceRoot":"","sources":["../src/pool-helpers.ts"],"names":[],"mappings":";;AAuCA,gCAkBC;AAED,0CAkBC;AA3ED,gFAAgF;AAChF,4EAA4E;AAC5E,8EAA8E;AAC9E,iFAAiF;AACjF,wBAAwB;AACxB,EAAE;AACF,8EAA8E;AAC9E,+EAA+E;AAC/E,+EAA+E;AAC/E,gFAAgF;AAChF,iEAAiE;AACjE,kDAAkD;AAClD,EAAE;AACF,gFAAgF;AAChF,gFAAgF;AAEhF,KAAK,UAAU,WAAW,CAAC,MAAqB;IAC9C,2EAA2E;IAC3E,gDAAgD;IAChD,4CAA4C;IAC5C,MAAM,MAAM,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;AACxD,CAAC;AAED,2EAA2E;AAC3E,4EAA4E;AAC5E,yEAAyE;AACzE,6EAA6E;AAC7E,6BAA6B;AAC7B,KAAK,UAAU,QAAQ,CAAC,MAAqB;IAC3C,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC/B,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,UAAU,CAC9B,IAAa,EACb,EAAyC;IAEzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;IACpC,IAAI,WAA8B,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5B,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,eAAe,CACnC,IAAa,EACb,EAAyC;IAEzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;IACpC,IAAI,WAA8B,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5B,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC"}
|
|
@@ -28,7 +28,7 @@ export declare function evaluateAbac(pool: pg.Pool, tenantId: string, request: A
|
|
|
28
28
|
* Create a new ABAC policy for a tenant.
|
|
29
29
|
* Rejects if an ancestor policy with the same composite key is LOCKED.
|
|
30
30
|
*/
|
|
31
|
-
export declare function createAbacPolicy(pool: pg.Pool, tenantId: string,
|
|
31
|
+
export declare function createAbacPolicy(pool: pg.Pool, tenantId: string, rawInput: CreateAbacPolicyInput): Promise<AbacPolicy>;
|
|
32
32
|
/**
|
|
33
33
|
* Get all ABAC policies owned by a tenant (non-resolved, own policies only).
|
|
34
34
|
*/
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"abac-service.d.ts","sourceRoot":"","sources":["../../src/services/abac-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;
|
|
1
|
+
{"version":3,"file":"abac-service.d.ts","sourceRoot":"","sources":["../../src/services/abac-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AAIpB,OAAO,EAEL,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EAOxB,MAAM,kBAAkB,CAAC;AAM1B;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,OAAO,CAsCT;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,OAAO,CAKT;AAMD;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAgE/B;AAMD;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,oBAAoB,CAAC,CAyF/B;AAMD;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,qBAAqB,GAC9B,OAAO,CAAC,UAAU,CAAC,CAyCrB;AAED;;GAEG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,UAAU,EAAE,CAAC,CAQvB;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAiDf"}
|
|
@@ -8,6 +8,8 @@ exports.createAbacPolicy = createAbacPolicy;
|
|
|
8
8
|
exports.getAbacPolicies = getAbacPolicies;
|
|
9
9
|
exports.deleteAbacPolicy = deleteAbacPolicy;
|
|
10
10
|
const pool_helpers_js_1 = require("../pool-helpers.js");
|
|
11
|
+
const tenant_service_js_1 = require("./tenant-service.js");
|
|
12
|
+
const validation_js_1 = require("../validation.js");
|
|
11
13
|
const core_1 = require("@stratum-hq/core");
|
|
12
14
|
// ---------------------------------------------------------------------------
|
|
13
15
|
// Pure evaluation functions
|
|
@@ -207,13 +209,11 @@ async function evaluateAbac(pool, tenantId, request) {
|
|
|
207
209
|
* Create a new ABAC policy for a tenant.
|
|
208
210
|
* Rejects if an ancestor policy with the same composite key is LOCKED.
|
|
209
211
|
*/
|
|
210
|
-
async function createAbacPolicy(pool, tenantId,
|
|
212
|
+
async function createAbacPolicy(pool, tenantId, rawInput) {
|
|
213
|
+
const input = (0, validation_js_1.parseInput)(core_1.CreateAbacPolicyInputSchema, rawInput);
|
|
211
214
|
return (0, pool_helpers_js_1.withTransaction)(pool, async (client) => {
|
|
212
|
-
const
|
|
213
|
-
|
|
214
|
-
throw new core_1.TenantNotFoundError(tenantId);
|
|
215
|
-
}
|
|
216
|
-
const ancestorIds = (0, core_1.parseAncestryPath)(tenantRes.rows[0].ancestry_path);
|
|
215
|
+
const tenant = await (0, tenant_service_js_1.loadActiveTenant)(client, tenantId);
|
|
216
|
+
const ancestorIds = (0, core_1.parseAncestryPath)(tenant.ancestry_path);
|
|
217
217
|
if (ancestorIds.length > 0) {
|
|
218
218
|
const lockedRes = await client.query(`SELECT * FROM abac_policies
|
|
219
219
|
WHERE tenant_id = ANY($1)
|
|
@@ -263,13 +263,19 @@ async function deleteAbacPolicy(pool, tenantId, policyId) {
|
|
|
263
263
|
}
|
|
264
264
|
const policy = existing.rows[0];
|
|
265
265
|
// Cascade: delete from all descendants. Match descendants by the stable,
|
|
266
|
-
// ID-based ancestry_path
|
|
267
|
-
// every descendant) so revocation reaches all current descendants
|
|
266
|
+
// ID-based ancestry_path so revocation reaches all current descendants
|
|
268
267
|
// regardless of any slug rename. ancestry_ltree is derived from slugs and
|
|
269
|
-
// must not scope revocation.
|
|
268
|
+
// must not scope revocation. A prefix match lets
|
|
269
|
+
// idx_tenant_ancestry_path_prefix (028) serve the query.
|
|
270
|
+
await (0, tenant_service_js_1.lockTree)(client, "shared");
|
|
271
|
+
const tenantRes = await client.query(`SELECT ancestry_path FROM tenants WHERE id = $1`, [tenantId]);
|
|
272
|
+
// A concurrent purge can remove the tenant after the policy was read.
|
|
273
|
+
if (tenantRes.rows.length === 0) {
|
|
274
|
+
throw new core_1.TenantNotFoundError(tenantId);
|
|
275
|
+
}
|
|
276
|
+
const subtreePath = (0, core_1.appendToPath)(tenantRes.rows[0].ancestry_path, tenantId);
|
|
270
277
|
const descendantsRes = await client.query(`SELECT id FROM tenants
|
|
271
|
-
WHERE
|
|
272
|
-
AND (ancestry_path LIKE '%/' || $1 || '/%' OR ancestry_path LIKE '%/' || $1)`, [tenantId]);
|
|
278
|
+
WHERE ancestry_path = $1 OR ancestry_path LIKE $2`, [subtreePath, `${subtreePath}/%`]);
|
|
273
279
|
const descendantIds = descendantsRes.rows.map((r) => r.id);
|
|
274
280
|
if (descendantIds.length > 0) {
|
|
275
281
|
await client.query(`DELETE FROM abac_policies
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"abac-service.js","sourceRoot":"","sources":["../../src/services/abac-service.ts"],"names":[],"mappings":";;
|
|
1
|
+
{"version":3,"file":"abac-service.js","sourceRoot":"","sources":["../../src/services/abac-service.ts"],"names":[],"mappings":";;AA6BA,8CAyCC;AAMD,wCAQC;AAUD,kDAmEC;AAaD,oCA6FC;AAUD,4CA6CC;AAKD,0CAWC;AAMD,4CAqDC;AA5YD,wDAAiE;AACjE,2DAAiE;AACjE,oDAA8C;AAC9C,2CAc0B;AAE1B,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E;;;;GAIG;AACH,SAAgB,iBAAiB,CAC/B,SAAwB,EACxB,OAAgC;IAEhC,IAAI,CAAC,CAAC,SAAS,CAAC,SAAS,IAAI,OAAO,CAAC,EAAE,CAAC;QACtC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC;IAE5B,QAAQ,SAAS,CAAC,QAAQ,EAAE,CAAC;QAC3B,KAAK,IAAI;YACP,OAAO,IAAI,KAAK,GAAG,CAAC;QAEtB,KAAK,KAAK;YACR,OAAO,IAAI,KAAK,GAAG,CAAC;QAEtB,KAAK,IAAI;YACP,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAElD,KAAK,QAAQ;YACX,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAEnD,KAAK,UAAU;YACb,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAEnD,KAAK,IAAI;YACP,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,IAAI,GAAG,GAAG,CAAC;QAE3E,KAAK,KAAK;YACR,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,IAAI,IAAI,GAAG,CAAC;QAE5E,KAAK,IAAI;YACP,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,IAAI,GAAG,GAAG,CAAC;QAE3E,KAAK,KAAK;YACR,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,IAAI,IAAI,GAAG,CAAC;QAE5E;YACE,MAAM,IAAI,+BAAwB,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,cAAc,CAC5B,MAAkB,EAClB,OAAgC;IAEhC,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,8EAA8E;AAC9E,0BAA0B;AAC1B,8EAA8E;AAE9E;;;GAGG;AACI,KAAK,UAAU,mBAAmB,CACvC,IAAa,EACb,QAAgB;IAEhB,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAClC,iDAAiD,EACjD,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,0BAAmB,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,YAAY,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;QACrD,MAAM,WAAW,GAAG,IAAA,wBAAiB,EAAC,YAAY,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,CAAC,GAAG,WAAW,EAAE,QAAQ,CAAC,CAAC;QAE1C,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,KAAK,CACpC,8EAA8E,EAC9E,CAAC,MAAM,CAAC,CACT,CAAC;QAEF,+CAA+C;QAC/C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAwB,CAAC;QACjD,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;YACxB,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACvB,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC5C,IAAI,IAAI,EAAE,CAAC;gBACT,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACpB,CAAC;QACH,CAAC;QAED,qEAAqE;QACrE,wEAAwE;QACxE,4EAA4E;QAC5E,0EAA0E;QAC1E,wEAAwE;QACxE,+DAA+D;QAC/D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAgC,CAAC;QAE5D,KAAK,MAAM,eAAe,IAAI,MAAM,EAAE,CAAC;YACrC,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;YAErD,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;gBAC9B,MAAM,YAAY,GAAG,GAAG,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC/E,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;gBAErD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,gBAAgB,KAAK,eAAe,CAAC,EAAE,CAAC;oBAC7E,yDAAyD;oBACzD,SAAS;gBACX,CAAC;gBAED,MAAM,cAAc,GAAuB;oBACzC,MAAM;oBACN,gBAAgB,EAAE,eAAe;oBACjC,MAAM,EAAE,MAAM,CAAC,IAAI,KAAK,QAAQ;oBAChC,SAAS,EAAE,MAAM,CAAC,IAAI,KAAK,WAAW;iBACvC,CAAC;gBACF,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,KAAK,eAAe,CAAC,CAAC;gBAClF,WAAW,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,GAAG,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;GAMG;AACI,KAAK,UAAU,YAAY,CAChC,IAAa,EACb,QAAgB,EAChB,OAA8B;IAE9B,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAE3D,wEAAwE;IACxE,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE;QAC9C,MAAM,aAAa,GACjB,MAAM,CAAC,aAAa,KAAK,GAAG;YAC5B,MAAM,CAAC,aAAa,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,IAAI,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QACrF,MAAM,WAAW,GACf,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC;QAC5D,OAAO,aAAa,IAAI,WAAW,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC1D,CAAC;IAED,8EAA8E;IAC9E,4EAA4E;IAC5E,2EAA2E;IAC3E,2EAA2E;IAC3E,4BAA4B;IAC5B,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,MAAM,WAAW,GAAG,CAAC,GAAW,EAAE,EAAE,CAClC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;IAC5D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3D,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC9C,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5D,IAAI,WAAW,CAAC,GAAG,CAAC;YAAE,SAAS;QAC/B,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;YAC/D,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACnB,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3D,OAAO,CAAC,WAAW,GAAG,EAAE,CAAC,GAAG,KAAK,CAAC;IACpC,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,YAAY,GAAG,EAAE,CAAC,GAAG,KAAK,CAAC;IACrC,CAAC;IAED,MAAM,sBAAsB,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAC1D,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAC1D,CAAC;IACF,IAAI,sBAAsB,EAAE,CAAC;QAC3B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAC3D,CAAC;IAED,8BAA8B;IAC9B,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAC/B,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,QAAQ,CAChD,CAAC;IAEF,wCAAwC;IACxC,MAAM,YAAY,GAAyB,EAAE,CAAC;IAC9C,MAAM,WAAW,GAAyB,EAAE,CAAC;IAE7C,KAAK,MAAM,QAAQ,IAAI,MAAM,EAAE,CAAC;QAC9B,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;YAC7C,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBACtC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC7B,CAAC;iBAAM,CAAC;gBACN,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO;YACL,OAAO,EAAE,KAAK;YACd,cAAc,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM;YACrC,MAAM,EAAE,eAAe;SACxB,CAAC;IACJ,CAAC;IAED,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO;YACL,OAAO,EAAE,IAAI;YACb,cAAc,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM;YACtC,MAAM,EAAE,gBAAgB;SACzB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;AAC1D,CAAC;AAED,8EAA8E;AAC9E,OAAO;AACP,8EAA8E;AAE9E;;;GAGG;AACI,KAAK,UAAU,gBAAgB,CACpC,IAAa,EACb,QAAgB,EAChB,QAA+B;IAE/B,MAAM,KAAK,GAAG,IAAA,0BAAU,EAAC,kCAA2B,EAAE,QAAQ,CAAC,CAAC;IAChE,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,MAAM,GAAG,MAAM,IAAA,oCAAgB,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAExD,MAAM,WAAW,GAAG,IAAA,wBAAiB,EAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAC5D,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAClC;;;;;+BAKuB,EACvB,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,CAC7D,CAAC;YACF,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9B,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACjC,MAAM,IAAI,4BAAqB,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;;mBAGa,EACb;YACE,QAAQ;YACR,KAAK,CAAC,IAAI;YACV,KAAK,CAAC,aAAa;YACnB,KAAK,CAAC,MAAM;YACZ,KAAK,CAAC,MAAM;YACZ,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC;YAChC,KAAK,CAAC,QAAQ,IAAI,CAAC;YACnB,KAAK,CAAC,IAAI,IAAI,WAAW;SAC1B,CACF,CAAC;QAEF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,eAAe,CACnC,IAAa,EACb,QAAgB;IAEhB,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,yFAAyF,EACzF,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,gBAAgB,CACpC,IAAa,EACb,QAAgB,EAChB,QAAgB;IAEhB,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,8DAA8D,EAC9D,CAAC,QAAQ,EAAE,QAAQ,CAAC,CACrB,CAAC;QACF,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,8BAAuB,CAAC,QAAQ,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAEhC,yEAAyE;QACzE,uEAAuE;QACvE,0EAA0E;QAC1E,iDAAiD;QACjD,yDAAyD;QACzD,MAAM,IAAA,4BAAQ,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACjC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAClC,iDAAiD,EACjD,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,sEAAsE;QACtE,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,0BAAmB,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;QACD,MAAM,WAAW,GAAG,IAAA,mBAAY,EAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QAC5E,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,KAAK,CACvC;yDACmD,EACnD,CAAC,WAAW,EAAE,GAAG,WAAW,IAAI,CAAC,CAClC,CAAC;QACF,MAAM,aAAa,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAE3D,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,MAAM,CAAC,KAAK,CAChB;;;;yBAIiB,EACjB,CAAC,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAClE,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,CAAC,KAAK,CAChB,yCAAyC,EACzC,CAAC,QAAQ,CAAC,CACX,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}
|
|
@@ -65,6 +65,12 @@ export declare function getApiKey(pool: pg.Pool, id: string): Promise<{
|
|
|
65
65
|
revoked_at: Date | null;
|
|
66
66
|
expires_at: Date | null;
|
|
67
67
|
} | null>;
|
|
68
|
+
/**
|
|
69
|
+
* List the unrevoked keys not used for `dormantDays` days.
|
|
70
|
+
* validateApiKey refreshes last_used_at at most once a minute, so a key can
|
|
71
|
+
* look up to one minute older than its latest use. That does not change a
|
|
72
|
+
* result measured in days.
|
|
73
|
+
*/
|
|
68
74
|
export declare function listDormantKeys(pool: pg.Pool, dormantDays?: number): Promise<Array<{
|
|
69
75
|
id: string;
|
|
70
76
|
tenant_id: string | null;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"api-key-service.d.ts","sourceRoot":"","sources":["../../src/services/api-key-service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,IAAI,CAAC;
|
|
1
|
+
{"version":3,"file":"api-key-service.d.ts","sourceRoot":"","sources":["../../src/services/api-key-service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,IAAI,CAAC;AAKpB,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,UAAU,EAAE,IAAI,CAAC;IACjB,YAAY,EAAE,IAAI,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,UAAU,EAAE,IAAI,CAAC;IACjB,8DAA8D;IAC9D,aAAa,EAAE,MAAM,CAAC;CACvB;AAiCD,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAK7G;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAwBD,wBAAsB,YAAY,CAChC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,aAAa,CAAC,EAAE,MAAM,GAAG,mBAAmB,EAC5C,SAAS,CAAC,EAAE,IAAI,GACf,OAAO,CAAC,aAAa,CAAC,CA0BxB;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAeD,wBAAsB,cAAc,CAClC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAqFjC;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQjF;AAED,wBAAsB,YAAY,CAChC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,aAAa,CAAC,CAyDxB;AAED,wBAAsB,WAAW,CAC/B,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,UAAU,EAAE,IAAI,CAAC;IAAC,YAAY,EAAE,IAAI,GAAG,IAAI,CAAC;IAAC,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IAAC,UAAU,EAAE,IAAI,GAAG,IAAI,CAAA;CAAE,CAAC,CAAC,CAgB9K;AAED;;;;GAIG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,EAAE,EAAE,MAAM,GACT,OAAO,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,UAAU,EAAE,IAAI,CAAC;IAAC,YAAY,EAAE,IAAI,GAAG,IAAI,CAAC;IAAC,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IAAC,UAAU,EAAE,IAAI,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,CAAC,CAS9K;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,WAAW,GAAE,MAAW,GACvB,OAAO,CAAC,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,YAAY,EAAE,IAAI,GAAG,IAAI,CAAC;IAAC,UAAU,EAAE,IAAI,CAAA;CAAE,CAAC,CAAC,CAY5H"}
|