@structured-world/gitlab-mcp 5.7.0 → 5.8.0

package/dist/oauth/endpoints/authorize.js

@@ -0,0 +1,414 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authorizeHandler = authorizeHandler;
+exports.pollHandler = pollHandler;
+const config_1 = require("../config");
+const session_store_1 = require("../session-store");
+const gitlab_device_flow_1 = require("../gitlab-device-flow");
+const token_utils_1 = require("../token-utils");
+const metadata_1 = require("./metadata");
+const logger_1 = require("../../logger");
+async function authorizeHandler(req, res) {
+    const config = (0, config_1.loadOAuthConfig)();
+    if (!config) {
+        res.status(500).json({
+            error: "server_error",
+            error_description: "OAuth not configured",
+        });
+        return;
+    }
+    const { client_id, redirect_uri, response_type, state, code_challenge, code_challenge_method } = req.query;
+    if (response_type !== "code") {
+        res.status(400).json({
+            error: "unsupported_response_type",
+            error_description: 'Only "code" response type is supported',
+        });
+        return;
+    }
+    if (!client_id) {
+        res.status(400).json({
+            error: "invalid_request",
+            error_description: "client_id is required",
+        });
+        return;
+    }
+    if (!code_challenge) {
+        res.status(400).json({
+            error: "invalid_request",
+            error_description: "code_challenge is required (PKCE)",
+        });
+        return;
+    }
+    if (code_challenge_method !== "S256") {
+        res.status(400).json({
+            error: "invalid_request",
+            error_description: 'code_challenge_method must be "S256"',
+        });
+        return;
+    }
+    try {
+        const deviceResponse = await (0, gitlab_device_flow_1.initiateDeviceFlow)(config);
+        const flowState = (0, token_utils_1.generateRandomString)(32);
+        session_store_1.sessionStore.storeDeviceFlow(flowState, {
+            deviceCode: deviceResponse.device_code,
+            userCode: deviceResponse.user_code,
+            verificationUri: deviceResponse.verification_uri,
+            verificationUriComplete: deviceResponse.verification_uri_complete,
+            expiresAt: Date.now() + deviceResponse.expires_in * 1000,
+            interval: deviceResponse.interval,
+            clientId: client_id,
+            codeChallenge: code_challenge,
+            codeChallengeMethod: code_challenge_method,
+            state: state ?? "",
+            redirectUri: redirect_uri,
+        });
+        logger_1.logger.info({
+            flowState: flowState.substring(0, 8) + "...",
+            userCode: deviceResponse.user_code,
+        }, "Device flow initiated for authorization");
+        const baseUrl = (0, metadata_1.getBaseUrl)(req);
+        const html = getDeviceFlowHTML({
+            userCode: deviceResponse.user_code,
+            verificationUri: deviceResponse.verification_uri,
+            verificationUriComplete: deviceResponse.verification_uri_complete,
+            flowState,
+            pollUrl: `${baseUrl}/oauth/poll`,
+            expiresIn: deviceResponse.expires_in,
+        });
+        res.setHeader("Content-Type", "text/html");
+        res.send(html);
+    }
+    catch (error) {
+        logger_1.logger.error({ err: error }, "Failed to initiate device flow");
+        res.status(500).json({
+            error: "server_error",
+            error_description: "Failed to initiate authentication",
+        });
+    }
+}
+async function pollHandler(req, res) {
+    const config = (0, config_1.loadOAuthConfig)();
+    if (!config) {
+        res.status(500).json({ error: "server_error" });
+        return;
+    }
+    const { flow_state } = req.query;
+    if (!flow_state) {
+        res
+            .status(400)
+            .json({ status: "failed", error: "Missing flow_state" });
+        return;
+    }
+    const flow = session_store_1.sessionStore.getDeviceFlow(flow_state);
+    if (!flow) {
+        res.status(400).json({ status: "expired", error: "Flow not found" });
+        return;
+    }
+    if (Date.now() > flow.expiresAt) {
+        session_store_1.sessionStore.deleteDeviceFlow(flow_state);
+        res
+            .status(400)
+            .json({ status: "expired", error: "Device code expired" });
+        return;
+    }
+    try {
+        const tokenResponse = await (0, gitlab_device_flow_1.pollDeviceFlowOnce)(flow.deviceCode, config);
+        if (tokenResponse) {
+            const userInfo = await (0, gitlab_device_flow_1.getGitLabUser)(tokenResponse.access_token);
+            const sessionId = (0, token_utils_1.generateSessionId)();
+            const now = Date.now();
+            const authCode = (0, token_utils_1.generateAuthorizationCode)();
+            session_store_1.sessionStore.storeAuthCode({
+                code: authCode,
+                sessionId,
+                clientId: flow.clientId,
+                codeChallenge: flow.codeChallenge,
+                codeChallengeMethod: flow.codeChallengeMethod,
+                redirectUri: flow.redirectUri,
+                expiresAt: now + 10 * 60 * 1000,
+            });
+            session_store_1.sessionStore.createSession({
+                id: sessionId,
+                mcpAccessToken: "",
+                mcpRefreshToken: "",
+                mcpTokenExpiry: 0,
+                gitlabAccessToken: tokenResponse.access_token,
+                gitlabRefreshToken: tokenResponse.refresh_token,
+                gitlabTokenExpiry: (0, token_utils_1.calculateTokenExpiry)(tokenResponse.expires_in),
+                gitlabUserId: userInfo.id,
+                gitlabUsername: userInfo.username,
+                clientId: flow.clientId,
+                scopes: ["mcp:tools", "mcp:resources"],
+                createdAt: now,
+                updatedAt: now,
+            });
+            session_store_1.sessionStore.deleteDeviceFlow(flow_state);
+            logger_1.logger.info({
+                sessionId: sessionId.substring(0, 8) + "...",
+                userId: userInfo.id,
+                username: userInfo.username,
+            }, "Device flow authorization completed");
+            const response = {
+                status: "complete",
+                redirect_uri: flow.redirectUri,
+                code: authCode,
+                state: flow.state ? flow.state : undefined,
+            };
+            res.json(response);
+        }
+        else {
+            res.json({ status: "pending" });
+        }
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : "Unknown error";
+        if (message.includes("expired") || message.includes("denied") || message.includes("invalid")) {
+            session_store_1.sessionStore.deleteDeviceFlow(flow_state);
+            res.json({ status: "failed", error: message });
+        }
+        else {
+            logger_1.logger.warn({ err: error }, "Device flow poll error");
+            res.json({ status: "pending" });
+        }
+    }
+}
+function getDeviceFlowHTML(params) {
+    const linkUrl = params.verificationUriComplete ?? params.verificationUri;
+    return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>GitLab MCP - Authentication</title>
+  <style>
+    * {
+      box-sizing: border-box;
+      margin: 0;
+      padding: 0;
+    }
+    body {
+      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, sans-serif;
+      max-width: 600px;
+      margin: 0 auto;
+      padding: 40px 20px;
+      background: #f5f5f5;
+      min-height: 100vh;
+    }
+    .container {
+      background: white;
+      padding: 40px;
+      border-radius: 12px;
+      box-shadow: 0 2px 10px rgba(0,0,0,0.1);
+    }
+    h1 {
+      color: #333;
+      margin-bottom: 20px;
+      font-size: 24px;
+    }
+    p {
+      color: #666;
+      line-height: 1.6;
+      margin-bottom: 16px;
+    }
+    .code-container {
+      background: #f8f9fa;
+      border: 2px dashed #ddd;
+      border-radius: 8px;
+      padding: 24px;
+      margin: 24px 0;
+      text-align: center;
+    }
+    .code {
+      font-size: 36px;
+      font-weight: bold;
+      letter-spacing: 6px;
+      color: #333;
+      font-family: 'Courier New', monospace;
+    }
+    .code-label {
+      font-size: 12px;
+      color: #888;
+      text-transform: uppercase;
+      margin-bottom: 8px;
+    }
+    .link-button {
+      display: inline-block;
+      background: #fc6d26;
+      color: white;
+      padding: 14px 28px;
+      border-radius: 6px;
+      text-decoration: none;
+      font-weight: 500;
+      margin: 16px 0;
+      transition: background 0.2s;
+    }
+    .link-button:hover {
+      background: #e24329;
+    }
+    .status {
+      padding: 16px;
+      border-radius: 8px;
+      margin: 24px 0;
+      font-weight: 500;
+    }
+    .status.pending {
+      background: #fff3cd;
+      color: #856404;
+      border: 1px solid #ffeeba;
+    }
+    .status.success {
+      background: #d4edda;
+      color: #155724;
+      border: 1px solid #c3e6cb;
+    }
+    .status.error {
+      background: #f8d7da;
+      color: #721c24;
+      border: 1px solid #f5c6cb;
+    }
+    .instructions {
+      background: #e8f4fd;
+      border-left: 4px solid #0366d6;
+      padding: 16px;
+      margin: 24px 0;
+      border-radius: 0 8px 8px 0;
+    }
+    .instructions ol {
+      margin-left: 20px;
+    }
+    .instructions li {
+      margin: 8px 0;
+      color: #444;
+    }
+    .timer {
+      font-size: 14px;
+      color: #888;
+      margin-top: 16px;
+    }
+    .gitlab-logo {
+      width: 40px;
+      height: 40px;
+      margin-bottom: 16px;
+    }
+  </style>
+</head>
+<body>
+  <div class="container">
+    <svg class="gitlab-logo" viewBox="0 0 380 380" xmlns="http://www.w3.org/2000/svg">
+      <path d="M190.2 350.2l62.5-192.5H127.7l62.5 192.5z" fill="#e24329"/>
+      <path d="M190.2 350.2l-62.5-192.5H38.4l151.8 192.5z" fill="#fc6d26"/>
+      <path d="M38.4 157.7L9.1 247.6c-2.7 8.2.1 17.2 6.9 22.5l174.2 126.6L38.4 157.7z" fill="#fca326"/>
+      <path d="M38.4 157.7h89.3L91.4 48.5c-3.3-10.2-17.8-10.2-21.1 0L38.4 157.7z" fill="#e24329"/>
+      <path d="M190.2 350.2l62.5-192.5h89.3L190.2 350.2z" fill="#fc6d26"/>
+      <path d="M342 157.7l29.3 89.9c2.7 8.2-.1 17.2-6.9 22.5L190.2 396.7 342 157.7z" fill="#fca326"/>
+      <path d="M342 157.7h-89.3l36.3-109.2c3.3-10.2 17.8-10.2 21.1 0L342 157.7z" fill="#e24329"/>
+    </svg>
+
+    <h1>Authenticate with GitLab</h1>
+
+    <p>To complete authentication, visit GitLab and enter the code below:</p>
+
+    <div class="code-container">
+      <div class="code-label">Your Code</div>
+      <div class="code">${params.userCode}</div>
+    </div>
+
+    <div style="text-align: center;">
+      <a href="${linkUrl}" target="_blank" rel="noopener" class="link-button">
+        Open GitLab Authentication Page
+      </a>
+    </div>
+
+    <div class="instructions">
+      <strong>Instructions:</strong>
+      <ol>
+        <li>Click the button above to open GitLab</li>
+        <li>Sign in to your GitLab account if needed</li>
+        <li>Enter the code shown above</li>
+        <li>Click "Authorize" to grant access</li>
+        <li>Return here - you'll be redirected automatically</li>
+      </ol>
+    </div>
+
+    <div id="status" class="status pending">
+      Waiting for authentication...
+    </div>
+
+    <div class="timer" id="timer">
+      Code expires in <span id="countdown">${params.expiresIn}</span> seconds
+    </div>
+  </div>
+
+  <script>
+    const pollUrl = '${params.pollUrl}?flow_state=${params.flowState}';
+    const pollInterval = 5000; // 5 seconds
+    let countdown = ${params.expiresIn};
+
+    // Update countdown timer
+    const countdownEl = document.getElementById('countdown');
+    const timerInterval = setInterval(() => {
+      countdown--;
+      if (countdown <= 0) {
+        clearInterval(timerInterval);
+        document.getElementById('status').className = 'status error';
+        document.getElementById('status').textContent = 'Code expired. Please refresh to try again.';
+        document.getElementById('timer').style.display = 'none';
+      } else {
+        countdownEl.textContent = countdown;
+      }
+    }, 1000);
+
+    // Poll for completion
+    async function poll() {
+      try {
+        const response = await fetch(pollUrl);
+        const data = await response.json();
+
+        const statusEl = document.getElementById('status');
+
+        if (data.status === 'complete') {
+          clearInterval(timerInterval);
+          statusEl.className = 'status success';
+          statusEl.textContent = 'Authentication successful! Redirecting...';
+
+          // Build redirect URL with authorization code
+          if (data.redirect_uri) {
+            const redirectUrl = new URL(data.redirect_uri);
+            redirectUrl.searchParams.set('code', data.code);
+            if (data.state) {
+              redirectUrl.searchParams.set('state', data.state);
+            }
+
+            // Redirect after a brief delay
+            setTimeout(() => {
+              window.location.href = redirectUrl.toString();
+            }, 1000);
+          }
+          return;
+        }
+
+        if (data.status === 'failed' || data.status === 'expired') {
+          clearInterval(timerInterval);
+          statusEl.className = 'status error';
+          statusEl.textContent = 'Authentication failed: ' + (data.error || 'Unknown error');
+          document.getElementById('timer').style.display = 'none';
+          return;
+        }
+
+        // Still pending, continue polling
+        setTimeout(poll, pollInterval);
+
+      } catch (error) {
+        console.error('Poll error:', error);
+        // Continue polling on transient errors
+        setTimeout(poll, pollInterval);
+      }
+    }
+
+    // Start polling
+    setTimeout(poll, pollInterval);
+  </script>
+</body>
+</html>`;
+}
+//# sourceMappingURL=authorize.js.map

package/dist/oauth/endpoints/authorize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../../../src/oauth/endpoints/authorize.ts"],"names":[],"mappings":";;AA6CA,4CAkGC;AAWD,kCAiHC;AA5PD,sCAA4C;AAC5C,oDAAgD;AAChD,8DAA8F;AAC9F,gDAKwB;AACxB,yCAAwC;AACxC,yCAAsC;AAoB/B,KAAK,UAAU,gBAAgB,CAAC,GAAY,EAAE,GAAa;IAChE,MAAM,MAAM,GAAG,IAAA,wBAAe,GAAE,CAAC;IACjC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,cAAc;YACrB,iBAAiB,EAAE,sBAAsB;SAC1C,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAGD,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,KAAK,EAAE,cAAc,EAAE,qBAAqB,EAAE,GAC5F,GAAG,CAAC,KAA2C,CAAC;IAGlD,IAAI,aAAa,KAAK,MAAM,EAAE,CAAC;QAC7B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,2BAA2B;YAClC,iBAAiB,EAAE,wCAAwC;SAC5D,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,iBAAiB;YACxB,iBAAiB,EAAE,uBAAuB;SAC3C,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAGD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,iBAAiB;YACxB,iBAAiB,EAAE,mCAAmC;SACvD,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,IAAI,qBAAqB,KAAK,MAAM,EAAE,CAAC;QACrC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,iBAAiB;YACxB,iBAAiB,EAAE,sCAAsC;SAC1D,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QAEH,MAAM,cAAc,GAAG,MAAM,IAAA,uCAAkB,EAAC,MAAM,CAAC,CAAC;QAGxD,MAAM,SAAS,GAAG,IAAA,kCAAoB,EAAC,EAAE,CAAC,CAAC;QAG3C,4BAAY,CAAC,eAAe,CAAC,SAAS,EAAE;YACtC,UAAU,EAAE,cAAc,CAAC,WAAW;YACtC,QAAQ,EAAE,cAAc,CAAC,SAAS;YAClC,eAAe,EAAE,cAAc,CAAC,gBAAgB;YAChD,uBAAuB,EAAE,cAAc,CAAC,yBAAyB;YACjE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,CAAC,UAAU,GAAG,IAAI;YACxD,QAAQ,EAAE,cAAc,CAAC,QAAQ;YACjC,QAAQ,EAAE,SAAS;YACnB,aAAa,EAAE,cAAc;YAC7B,mBAAmB,EAAE,qBAAqB;YAC1C,KAAK,EAAE,KAAK,IAAI,EAAE;YAClB,WAAW,EAAE,YAAY;SAC1B,CAAC,CAAC;QAEH,eAAM,CAAC,IAAI,CACT;YACE,SAAS,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK;YAC5C,QAAQ,EAAE,cAAc,CAAC,SAAS;SACnC,EACD,yCAAyC,CAC1C,CAAC;QAGF,MAAM,OAAO,GAAG,IAAA,qBAAU,EAAC,GAAG,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,iBAAiB,CAAC;YAC7B,QAAQ,EAAE,cAAc,CAAC,SAAS;YAClC,eAAe,EAAE,cAAc,CAAC,gBAAgB;YAChD,uBAAuB,EAAE,cAAc,CAAC,yBAAyB;YACjE,SAAS;YACT,OAAO,EAAE,GAAG,OAAO,aAAa;YAChC,SAAS,EAAE,cAAc,CAAC,UAAU;SACrC,CAAC,CAAC;QAEH,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAC3C,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,eAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAc,EAAE,EAAE,gCAAgC,CAAC,CAAC;QACxE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,cAAc;YACrB,iBAAiB,EAAE,mCAAmC;SACvD,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAWM,KAAK,UAAU,WAAW,CAAC,GAAY,EAAE,GAAa;IAC3D,MAAM,MAAM,GAAG,IAAA,wBAAe,GAAE,CAAC;IACjC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAA4B,CAAC,CAAC;QAC1E,OAAO;IACT,CAAC;IAED,MAAM,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC,KAAgC,CAAC;IAE5D,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,GAAG;aACA,MAAM,CAAC,GAAG,CAAC;aACX,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,oBAAoB,EAA4B,CAAC,CAAC;QACrF,OAAO;IACT,CAAC;IAED,MAAM,IAAI,GAAG,4BAAY,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;IAEpD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,gBAAgB,EAA4B,CAAC,CAAC;QAC/F,OAAO;IACT,CAAC;IAGD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAChC,4BAAY,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC1C,GAAG;aACA,MAAM,CAAC,GAAG,CAAC;aACX,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,qBAAqB,EAA4B,CAAC,CAAC;QACvF,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QAEH,MAAM,aAAa,GAAG,MAAM,IAAA,uCAAkB,EAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAExE,IAAI,aAAa,EAAE,CAAC;YAElB,MAAM,QAAQ,GAAG,MAAM,IAAA,kCAAa,EAAC,aAAa,CAAC,YAAY,CAAC,CAAC;YAEjE,MAAM,SAAS,GAAG,IAAA,+BAAiB,GAAE,CAAC;YACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAGvB,MAAM,QAAQ,GAAG,IAAA,uCAAyB,GAAE,CAAC;YAG7C,4BAAY,CAAC,aAAa,CAAC;gBACzB,IAAI,EAAE,QAAQ;gBACd,SAAS;gBACT,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;gBAC7C,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,SAAS,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;aAChC,CAAC,CAAC;YAIH,4BAAY,CAAC,aAAa,CAAC;gBACzB,EAAE,EAAE,SAAS;gBACb,cAAc,EAAE,EAAE;gBAClB,eAAe,EAAE,EAAE;gBACnB,cAAc,EAAE,CAAC;gBACjB,iBAAiB,EAAE,aAAa,CAAC,YAAY;gBAC7C,kBAAkB,EAAE,aAAa,CAAC,aAAa;gBAC/C,iBAAiB,EAAE,IAAA,kCAAoB,EAAC,aAAa,CAAC,UAAU,CAAC;gBACjE,YAAY,EAAE,QAAQ,CAAC,EAAE;gBACzB,cAAc,EAAE,QAAQ,CAAC,QAAQ;gBACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,MAAM,EAAE,CAAC,WAAW,EAAE,eAAe,CAAC;gBACtC,SAAS,EAAE,GAAG;gBACd,SAAS,EAAE,GAAG;aACf,CAAC,CAAC;YAGH,4BAAY,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;YAE1C,eAAM,CAAC,IAAI,CACT;gBACE,SAAS,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK;gBAC5C,MAAM,EAAE,QAAQ,CAAC,EAAE;gBACnB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;aAC5B,EACD,qCAAqC,CACtC,CAAC;YAGF,MAAM,QAAQ,GAA2B;gBACvC,MAAM,EAAE,UAAU;gBAClB,YAAY,EAAE,IAAI,CAAC,WAAW;gBAC9B,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;aAC3C,CAAC;YAEF,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrB,CAAC;aAAM,CAAC;YAEN,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAA4B,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;QAGzE,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7F,4BAAY,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;YAC1C,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAA4B,CAAC,CAAC;QAC3E,CAAC;aAAM,CAAC;YAEN,eAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAc,EAAE,EAAE,wBAAwB,CAAC,CAAC;YAC/D,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAA4B,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;AACH,CAAC;AAcD,SAAS,iBAAiB,CAAC,MAA4B;IACrD,MAAM,OAAO,GAAG,MAAM,CAAC,uBAAuB,IAAI,MAAM,CAAC,eAAe,CAAC;IAEzE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0BAwIiB,MAAM,CAAC,QAAQ;;;;iBAIxB,OAAO;;;;;;;;;;;;;;;;;;;;;6CAqBqB,MAAM,CAAC,SAAS;;;;;uBAKtC,MAAM,CAAC,OAAO,eAAe,MAAM,CAAC,SAAS;;sBAE9C,MAAM,CAAC,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAmE9B,CAAC;AACT,CAAC"}

package/dist/oauth/endpoints/index.d.ts

@@ -0,0 +1,3 @@
+export { metadataHandler, healthHandler, getBaseUrl } from "./metadata";
+export { authorizeHandler, pollHandler } from "./authorize";
+export { tokenHandler } from "./token";

package/dist/oauth/endpoints/index.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.tokenHandler = exports.pollHandler = exports.authorizeHandler = exports.getBaseUrl = exports.healthHandler = exports.metadataHandler = void 0;
+var metadata_1 = require("./metadata");
+Object.defineProperty(exports, "metadataHandler", { enumerable: true, get: function () { return metadata_1.metadataHandler; } });
+Object.defineProperty(exports, "healthHandler", { enumerable: true, get: function () { return metadata_1.healthHandler; } });
+Object.defineProperty(exports, "getBaseUrl", { enumerable: true, get: function () { return metadata_1.getBaseUrl; } });
+var authorize_1 = require("./authorize");
+Object.defineProperty(exports, "authorizeHandler", { enumerable: true, get: function () { return authorize_1.authorizeHandler; } });
+Object.defineProperty(exports, "pollHandler", { enumerable: true, get: function () { return authorize_1.pollHandler; } });
+var token_1 = require("./token");
+Object.defineProperty(exports, "tokenHandler", { enumerable: true, get: function () { return token_1.tokenHandler; } });
+//# sourceMappingURL=index.js.map

package/dist/oauth/endpoints/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/oauth/endpoints/index.ts"],"names":[],"mappings":";;;AAMA,uCAAwE;AAA/D,2GAAA,eAAe,OAAA;AAAE,yGAAA,aAAa,OAAA;AAAE,sGAAA,UAAU,OAAA;AACnD,yCAA4D;AAAnD,6GAAA,gBAAgB,OAAA;AAAE,wGAAA,WAAW,OAAA;AACtC,iCAAuC;AAA9B,qGAAA,YAAY,OAAA"}

package/dist/oauth/endpoints/metadata.d.ts

@@ -0,0 +1,4 @@
+import { Request, Response } from "express";
+export declare function getBaseUrl(req: Request): string;
+export declare function metadataHandler(req: Request, res: Response): void;
+export declare function healthHandler(req: Request, res: Response): void;

package/dist/oauth/endpoints/metadata.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getBaseUrl = getBaseUrl;
+exports.metadataHandler = metadataHandler;
+exports.healthHandler = healthHandler;
+const config_1 = require("../../config");
+function getBaseUrl(req) {
+    const forwardedProto = req.get("x-forwarded-proto");
+    const protocol = forwardedProto ?? req.protocol ?? "http";
+    const forwardedHost = req.get("x-forwarded-host");
+    const host = forwardedHost ?? req.get("host") ?? `${config_1.HOST}:${config_1.PORT}`;
+    return `${protocol}://${host}`;
+}
+function metadataHandler(req, res) {
+    const baseUrl = getBaseUrl(req);
+    const metadata = {
+        issuer: baseUrl,
+        authorization_endpoint: `${baseUrl}/authorize`,
+        token_endpoint: `${baseUrl}/token`,
+        response_types_supported: ["code"],
+        grant_types_supported: ["authorization_code", "refresh_token"],
+        code_challenge_methods_supported: ["S256"],
+        token_endpoint_auth_methods_supported: ["none"],
+        scopes_supported: ["mcp:tools", "mcp:resources"],
+        mcp_version: "2025-03-26",
+    };
+    res.json(metadata);
+}
+function healthHandler(req, res) {
+    res.json({
+        status: "ok",
+        mode: "oauth",
+        timestamp: new Date().toISOString(),
+    });
+}
+//# sourceMappingURL=metadata.js.map

package/dist/oauth/endpoints/metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.js","sourceRoot":"","sources":["../../../src/oauth/endpoints/metadata.ts"],"names":[],"mappings":";;AAoBA,gCAUC;AAaD,0CAsCC;AAUD,sCAMC;AAvFD,yCAA0C;AAU1C,SAAgB,UAAU,CAAC,GAAY;IAErC,MAAM,cAAc,GAAG,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,cAAc,IAAI,GAAG,CAAC,QAAQ,IAAI,MAAM,CAAC;IAG1D,MAAM,aAAa,GAAG,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,aAAa,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,aAAI,IAAI,aAAI,EAAE,CAAC;IAEnE,OAAO,GAAG,QAAQ,MAAM,IAAI,EAAE,CAAC;AACjC,CAAC;AAaD,SAAgB,eAAe,CAAC,GAAY,EAAE,GAAa;IACzD,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAGhC,MAAM,QAAQ,GAAG;QAEf,MAAM,EAAE,OAAO;QAGf,sBAAsB,EAAE,GAAG,OAAO,YAAY;QAG9C,cAAc,EAAE,GAAG,OAAO,QAAQ;QAGlC,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAGlC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QAG9D,gCAAgC,EAAE,CAAC,MAAM,CAAC;QAI1C,qCAAqC,EAAE,CAAC,MAAM,CAAC;QAG/C,gBAAgB,EAAE,CAAC,WAAW,EAAE,eAAe,CAAC;QAMhD,WAAW,EAAE,YAAY;KAC1B,CAAC;IAEF,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACrB,CAAC;AAUD,SAAgB,aAAa,CAAC,GAAY,EAAE,GAAa;IACvD,GAAG,CAAC,IAAI,CAAC;QACP,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,OAAO;QACb,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC,CAAC;AACL,CAAC"}

package/dist/oauth/endpoints/token.d.ts

@@ -0,0 +1,2 @@
+import { Request, Response } from "express";
+export declare function tokenHandler(req: Request, res: Response): Promise<void>;

package/dist/oauth/endpoints/token.js

@@ -0,0 +1,159 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.tokenHandler = tokenHandler;
+const config_1 = require("../config");
+const session_store_1 = require("../session-store");
+const token_utils_1 = require("../token-utils");
+const gitlab_device_flow_1 = require("../gitlab-device-flow");
+const metadata_1 = require("./metadata");
+const logger_1 = require("../../logger");
+async function tokenHandler(req, res) {
+    const config = (0, config_1.loadOAuthConfig)();
+    if (!config) {
+        sendError(res, 500, "server_error", "OAuth not configured");
+        return;
+    }
+    const { grant_type } = req.body;
+    switch (grant_type) {
+        case "authorization_code":
+            await handleAuthorizationCode(req, res, config);
+            break;
+        case "refresh_token":
+            await handleRefreshToken(req, res, config);
+            break;
+        default:
+            sendError(res, 400, "unsupported_grant_type", `Grant type "${grant_type}" is not supported`);
+    }
+}
+async function handleAuthorizationCode(req, res, config) {
+    const { code, code_verifier, redirect_uri } = req.body;
+    if (!code) {
+        sendError(res, 400, "invalid_request", "Missing authorization code");
+        return;
+    }
+    if (!code_verifier) {
+        sendError(res, 400, "invalid_request", "Missing code_verifier (PKCE required)");
+        return;
+    }
+    const authCode = session_store_1.sessionStore.getAuthCode(code);
+    if (!authCode) {
+        sendError(res, 400, "invalid_grant", "Invalid or expired authorization code");
+        return;
+    }
+    if (Date.now() > authCode.expiresAt) {
+        session_store_1.sessionStore.deleteAuthCode(code);
+        sendError(res, 400, "invalid_grant", "Authorization code has expired");
+        return;
+    }
+    if (!(0, token_utils_1.verifyCodeChallenge)(code_verifier, authCode.codeChallenge, authCode.codeChallengeMethod)) {
+        sendError(res, 400, "invalid_grant", "Invalid code_verifier");
+        return;
+    }
+    if (authCode.redirectUri && redirect_uri !== authCode.redirectUri) {
+        sendError(res, 400, "invalid_grant", "redirect_uri does not match");
+        return;
+    }
+    const session = session_store_1.sessionStore.getSession(authCode.sessionId);
+    if (!session) {
+        sendError(res, 400, "invalid_grant", "Session not found");
+        return;
+    }
+    const baseUrl = (0, metadata_1.getBaseUrl)(req);
+    const accessToken = (0, token_utils_1.createJWT)({
+        iss: baseUrl,
+        sub: session.gitlabUserId.toString(),
+        aud: authCode.clientId,
+        sid: session.id,
+        scope: session.scopes.join(" "),
+        gitlab_user: session.gitlabUsername,
+    }, config.sessionSecret, config.tokenTtl);
+    const refreshToken = (0, token_utils_1.generateRefreshToken)();
+    session_store_1.sessionStore.updateSession(session.id, {
+        mcpAccessToken: accessToken,
+        mcpRefreshToken: refreshToken,
+        mcpTokenExpiry: (0, token_utils_1.calculateTokenExpiry)(config.tokenTtl),
+    });
+    session_store_1.sessionStore.deleteAuthCode(code);
+    logger_1.logger.info({
+        sessionId: session.id.substring(0, 8) + "...",
+        userId: session.gitlabUserId,
+    }, "MCP tokens issued via authorization_code grant");
+    const response = {
+        access_token: accessToken,
+        token_type: "Bearer",
+        expires_in: config.tokenTtl,
+        refresh_token: refreshToken,
+        scope: session.scopes.join(" "),
+    };
+    res.json(response);
+}
+async function handleRefreshToken(req, res, config) {
+    const { refresh_token } = req.body;
+    if (!refresh_token) {
+        sendError(res, 400, "invalid_request", "Missing refresh_token");
+        return;
+    }
+    const session = session_store_1.sessionStore.getSessionByRefreshToken(refresh_token);
+    if (!session) {
+        sendError(res, 400, "invalid_grant", "Invalid refresh token");
+        return;
+    }
+    let updatedSession = session;
+    if ((0, token_utils_1.isTokenExpiringSoon)(session.gitlabTokenExpiry)) {
+        try {
+            const newTokens = await (0, gitlab_device_flow_1.refreshGitLabToken)(session.gitlabRefreshToken, config);
+            session_store_1.sessionStore.updateSession(session.id, {
+                gitlabAccessToken: newTokens.access_token,
+                gitlabRefreshToken: newTokens.refresh_token,
+                gitlabTokenExpiry: (0, token_utils_1.calculateTokenExpiry)(newTokens.expires_in),
+            });
+            const refreshedSession = session_store_1.sessionStore.getSession(session.id);
+            if (!refreshedSession) {
+                sendError(res, 400, "invalid_grant", "Session lost during refresh");
+                return;
+            }
+            updatedSession = refreshedSession;
+            logger_1.logger.debug({ sessionId: session.id.substring(0, 8) + "..." }, "GitLab token refreshed");
+        }
+        catch (error) {
+            logger_1.logger.error({ err: error }, "Failed to refresh GitLab token");
+            sendError(res, 400, "invalid_grant", "Failed to refresh underlying GitLab token");
+            return;
+        }
+    }
+    const baseUrl = (0, metadata_1.getBaseUrl)(req);
+    const accessToken = (0, token_utils_1.createJWT)({
+        iss: baseUrl,
+        sub: updatedSession.gitlabUserId.toString(),
+        aud: updatedSession.clientId,
+        sid: updatedSession.id,
+        scope: updatedSession.scopes.join(" "),
+        gitlab_user: updatedSession.gitlabUsername,
+    }, config.sessionSecret, config.tokenTtl);
+    const newRefreshToken = (0, token_utils_1.generateRefreshToken)();
+    session_store_1.sessionStore.updateSession(updatedSession.id, {
+        mcpAccessToken: accessToken,
+        mcpRefreshToken: newRefreshToken,
+        mcpTokenExpiry: (0, token_utils_1.calculateTokenExpiry)(config.tokenTtl),
+    });
+    logger_1.logger.info({
+        sessionId: updatedSession.id.substring(0, 8) + "...",
+        userId: updatedSession.gitlabUserId,
+    }, "MCP tokens refreshed via refresh_token grant");
+    const response = {
+        access_token: accessToken,
+        token_type: "Bearer",
+        expires_in: config.tokenTtl,
+        refresh_token: newRefreshToken,
+        scope: updatedSession.scopes.join(" "),
+    };
+    res.json(response);
+}
+function sendError(res, status, error, description) {
+    const response = {
+        error,
+        error_description: description,
+    };
+    res.status(status).json(response);
+}
+//# sourceMappingURL=token.js.map

package/dist/oauth/endpoints/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../../src/oauth/endpoints/token.ts"],"names":[],"mappings":";;AAmCA,oCAqBC;AA5CD,sCAAyD;AACzD,oDAAgD;AAChD,gDAMwB;AACxB,8DAA2D;AAC3D,yCAAwC;AACxC,yCAAsC;AAY/B,KAAK,UAAU,YAAY,CAAC,GAAY,EAAE,GAAa;IAC5D,MAAM,MAAM,GAAG,IAAA,wBAAe,GAAE,CAAC;IACjC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,cAAc,EAAE,sBAAsB,CAAC,CAAC;QAC5D,OAAO;IACT,CAAC;IAED,MAAM,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC,IAA+B,CAAC;IAE3D,QAAQ,UAAU,EAAE,CAAC;QACnB,KAAK,oBAAoB;YACvB,MAAM,uBAAuB,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YAChD,MAAM;QAER,KAAK,eAAe;YAClB,MAAM,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YAC3C,MAAM;QAER;YACE,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,wBAAwB,EAAE,eAAe,UAAU,oBAAoB,CAAC,CAAC;IACjG,CAAC;AACH,CAAC;AAQD,KAAK,UAAU,uBAAuB,CACpC,GAAY,EACZ,GAAa,EACb,MAAmB;IAEnB,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,YAAY,EAAE,GAAG,GAAG,CAAC,IAIjD,CAAC;IAGF,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,4BAA4B,CAAC,CAAC;QACrE,OAAO;IACT,CAAC;IAED,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,uCAAuC,CAAC,CAAC;QAChF,OAAO;IACT,CAAC;IAGD,MAAM,QAAQ,GAAG,4BAAY,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,uCAAuC,CAAC,CAAC;QAC9E,OAAO;IACT,CAAC;IAGD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAC;QACpC,4BAAY,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAClC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,gCAAgC,CAAC,CAAC;QACvE,OAAO;IACT,CAAC;IAGD,IAAI,CAAC,IAAA,iCAAmB,EAAC,aAAa,EAAE,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC9F,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,uBAAuB,CAAC,CAAC;QAC9D,OAAO;IACT,CAAC;IAGD,IAAI,QAAQ,CAAC,WAAW,IAAI,YAAY,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC;QAClE,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,6BAA6B,CAAC,CAAC;QACpE,OAAO;IACT,CAAC;IAGD,MAAM,OAAO,GAAG,4BAAY,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC5D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,mBAAmB,CAAC,CAAC;QAC1D,OAAO;IACT,CAAC;IAGD,MAAM,OAAO,GAAG,IAAA,qBAAU,EAAC,GAAG,CAAC,CAAC;IAEhC,MAAM,WAAW,GAAG,IAAA,uBAAS,EAC3B;QACE,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,OAAO,CAAC,YAAY,CAAC,QAAQ,EAAE;QACpC,GAAG,EAAE,QAAQ,CAAC,QAAQ;QACtB,GAAG,EAAE,OAAO,CAAC,EAAE;QACf,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAC/B,WAAW,EAAE,OAAO,CAAC,cAAc;KACpC,EACD,MAAM,CAAC,aAAa,EACpB,MAAM,CAAC,QAAQ,CAChB,CAAC;IAEF,MAAM,YAAY,GAAG,IAAA,kCAAoB,GAAE,CAAC;IAG5C,4BAAY,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,EAAE;QACrC,cAAc,EAAE,WAAW;QAC3B,eAAe,EAAE,YAAY;QAC7B,cAAc,EAAE,IAAA,kCAAoB,EAAC,MAAM,CAAC,QAAQ,CAAC;KACtD,CAAC,CAAC;IAGH,4BAAY,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;IAElC,eAAM,CAAC,IAAI,CACT;QACE,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK;QAC7C,MAAM,EAAE,OAAO,CAAC,YAAY;KAC7B,EACD,gDAAgD,CACjD,CAAC;IAGF,MAAM,QAAQ,GAAqB;QACjC,YAAY,EAAE,WAAW;QACzB,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE,MAAM,CAAC,QAAQ;QAC3B,aAAa,EAAE,YAAY;QAC3B,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;KAChC,CAAC;IAEF,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACrB,CAAC;AAQD,KAAK,UAAU,kBAAkB,CAAC,GAAY,EAAE,GAAa,EAAE,MAAmB;IAChF,MAAM,EAAE,aAAa,EAAE,GAAG,GAAG,CAAC,IAAkC,CAAC;IAEjE,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,uBAAuB,CAAC,CAAC;QAChE,OAAO;IACT,CAAC;IAGD,MAAM,OAAO,GAAG,4BAAY,CAAC,wBAAwB,CAAC,aAAa,CAAC,CAAC;IACrE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,uBAAuB,CAAC,CAAC;QAC9D,OAAO;IACT,CAAC;IAGD,IAAI,cAAc,GAAiB,OAAO,CAAC;IAE3C,IAAI,IAAA,iCAAmB,EAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACnD,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,IAAA,uCAAkB,EAAC,OAAO,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;YAE/E,4BAAY,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,EAAE;gBACrC,iBAAiB,EAAE,SAAS,CAAC,YAAY;gBACzC,kBAAkB,EAAE,SAAS,CAAC,aAAa;gBAC3C,iBAAiB,EAAE,IAAA,kCAAoB,EAAC,SAAS,CAAC,UAAU,CAAC;aAC9D,CAAC,CAAC;YAGH,MAAM,gBAAgB,GAAG,4BAAY,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC7D,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACtB,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,6BAA6B,CAAC,CAAC;gBACpE,OAAO;YACT,CAAC;YACD,cAAc,GAAG,gBAAgB,CAAC;YAElC,eAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,EAAE,EAAE,wBAAwB,CAAC,CAAC;QAC5F,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,eAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAc,EAAE,EAAE,gCAAgC,CAAC,CAAC;YACxE,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,2CAA2C,CAAC,CAAC;YAClF,OAAO;QACT,CAAC;IACH,CAAC;IAGD,MAAM,OAAO,GAAG,IAAA,qBAAU,EAAC,GAAG,CAAC,CAAC;IAEhC,MAAM,WAAW,GAAG,IAAA,uBAAS,EAC3B;QACE,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,cAAc,CAAC,YAAY,CAAC,QAAQ,EAAE;QAC3C,GAAG,EAAE,cAAc,CAAC,QAAQ;QAC5B,GAAG,EAAE,cAAc,CAAC,EAAE;QACtB,KAAK,EAAE,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QACtC,WAAW,EAAE,cAAc,CAAC,cAAc;KAC3C,EACD,MAAM,CAAC,aAAa,EACpB,MAAM,CAAC,QAAQ,CAChB,CAAC;IAEF,MAAM,eAAe,GAAG,IAAA,kCAAoB,GAAE,CAAC;IAG/C,4BAAY,CAAC,aAAa,CAAC,cAAc,CAAC,EAAE,EAAE;QAC5C,cAAc,EAAE,WAAW;QAC3B,eAAe,EAAE,eAAe;QAChC,cAAc,EAAE,IAAA,kCAAoB,EAAC,MAAM,CAAC,QAAQ,CAAC;KACtD,CAAC,CAAC;IAEH,eAAM,CAAC,IAAI,CACT;QACE,SAAS,EAAE,cAAc,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK;QACpD,MAAM,EAAE,cAAc,CAAC,YAAY;KACpC,EACD,8CAA8C,CAC/C,CAAC;IAGF,MAAM,QAAQ,GAAqB;QACjC,YAAY,EAAE,WAAW;QACzB,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE,MAAM,CAAC,QAAQ;QAC3B,aAAa,EAAE,eAAe;QAC9B,KAAK,EAAE,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;KACvC,CAAC;IAEF,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACrB,CAAC;AAKD,SAAS,SAAS,CAAC,GAAa,EAAE,MAAc,EAAE,KAAa,EAAE,WAAmB;IAClF,MAAM,QAAQ,GAAuB;QACnC,KAAK;QACL,iBAAiB,EAAE,WAAW;KAC/B,CAAC;IACF,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACpC,CAAC"}