@sync-in/server 1.10.1 → 2.0.0

package/server/authentication/providers/ldap/auth-provider-ldap.service.js

@@ -0,0 +1,506 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+Object.defineProperty(exports, "AuthProviderLDAP", {
+    enumerable: true,
+    get: function() {
+        return AuthProviderLDAP;
+    }
+});
+const _common = require("@nestjs/common");
+const _ldapts = require("ldapts");
+const _appconstants = require("../../../app.constants");
+const _user = require("../../../applications/users/constants/user");
+const _adminusersmanagerservice = require("../../../applications/users/services/admin-users-manager.service");
+const _usersmanagerservice = require("../../../applications/users/services/users-manager.service");
+const _functions = require("../../../common/functions");
+const _configenvironment = require("../../../configuration/config.environment");
+const _authldapconstants = require("./auth-ldap.constants");
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+let AuthProviderLDAP = class AuthProviderLDAP {
+    async validateUser(loginOrEmail, password, ip, scope) {
+        // Authenticate user via LDAP and sync local user state.
+        // Find user from his login or email
+        let user = await this.usersManager.findUser(this.dbLogin(loginOrEmail), false);
+        if (user) {
+            if (user.isGuest || scope) {
+                // Allow local password authentication for guest users and application scopes (app passwords)
+                return this.usersManager.logUser(user, password, ip, scope);
+            }
+            if (!user.isActive) {
+                this.logger.error({
+                    tag: this.validateUser.name,
+                    msg: `user *${user.login}* is locked`
+                });
+                throw new _common.HttpException('Account locked', _common.HttpStatus.FORBIDDEN);
+            }
+        }
+        let ldapErrorMessage;
+        let entry = false;
+        try {
+            // If a user was found, use the stored login. This allows logging in with an email.
+            entry = await this.checkAuth(user?.login || loginOrEmail, password);
+        } catch (e) {
+            ldapErrorMessage = e.message;
+        }
+        // LDAP auth failed or exception raised
+        if (entry === false) {
+            // If LDAP is unavailable (connectivity/service error), allow local password fallback.
+            // Allow local password authentication for:
+            // - admin users (break-glass access)
+            // - regular users when password authentication fallback is enabled
+            if (user && (user.isAdmin || Boolean(ldapErrorMessage) && this.ldapConfig.options.enablePasswordAuthFallback)) {
+                const localUser = await this.usersManager.logUser(user, password, ip);
+                if (localUser) return localUser;
+            }
+            if (ldapErrorMessage) {
+                throw new _common.HttpException(ldapErrorMessage, _common.HttpStatus.SERVICE_UNAVAILABLE);
+            }
+            return null;
+        }
+        if (!entry[this.ldapConfig.attributes.login] || !entry[this.ldapConfig.attributes.email]) {
+            this.logger.error({
+                tag: this.validateUser.name,
+                msg: `required ldap fields are missing : 
+      [${this.ldapConfig.attributes.login}, ${this.ldapConfig.attributes.email}] => 
+      (${JSON.stringify(entry)})`
+            });
+            return null;
+        }
+        if (!user && !this.ldapConfig.options.autoCreateUser) {
+            this.logger.warn({
+                tag: this.validateUser.name,
+                msg: `User not found and autoCreateUser is disabled`
+            });
+            throw new _common.HttpException('User not found', _common.HttpStatus.UNAUTHORIZED);
+        }
+        const identity = this.createIdentity(entry, password);
+        user = await this.updateOrCreateUser(identity, user);
+        this.usersManager.updateAccesses(user, ip, true).catch((e)=>this.logger.error({
+                tag: this.validateUser.name,
+                msg: `${e}`
+            }));
+        return user;
+    }
+    async checkAuth(login, password) {
+        // Bind and fetch LDAP entry, optionally via service account.
+        const ldapLogin = this.buildLdapLogin(login);
+        // AD: bind directly with the user input (UPN or DOMAIN\user)
+        // Generic LDAP: build DN from login attribute + baseDN
+        const bindUserDN = this.buildBindUserDN(ldapLogin);
+        let error;
+        for (const s of this.ldapConfig.servers){
+            const client = new _ldapts.Client({
+                ...this.clientOptions,
+                url: s
+            });
+            let attemptedBindDN = bindUserDN;
+            try {
+                if (this.hasServiceBind) {
+                    attemptedBindDN = this.ldapConfig.serviceBindDN;
+                    await client.bind(this.ldapConfig.serviceBindDN, this.ldapConfig.serviceBindPassword);
+                    const result = await this.findUserEntry(ldapLogin, client);
+                    if (!result || !result.userDn) {
+                        this.logger.warn({
+                            tag: this.checkAuth.name,
+                            msg: `no LDAP entry found for : ${login}`
+                        });
+                        return false;
+                    }
+                    const { entry, userDn } = result;
+                    attemptedBindDN = userDn;
+                    await client.bind(userDn, password);
+                    return entry;
+                }
+                attemptedBindDN = bindUserDN;
+                await client.bind(bindUserDN, password);
+                return await this.checkAccess(ldapLogin, client, bindUserDN);
+            } catch (e) {
+                error = this.handleBindError(e, attemptedBindDN);
+                if (error instanceof _ldapts.InvalidCredentialsError) {
+                    return false;
+                }
+            } finally{
+                await client.unbind();
+            }
+        }
+        if (error) {
+            this.logger.error({
+                tag: this.checkAuth.name,
+                msg: `${error}`
+            });
+            if (_appconstants.CONNECT_ERROR_CODE.has(error.code)) {
+                throw new Error('Authentication service error');
+            }
+        }
+        return false;
+    }
+    async checkAccess(login, client, bindUserDN) {
+        // Search for the LDAP entry and normalize attributes.
+        const result = await this.findUserEntry(login, client, bindUserDN);
+        return result ? result.entry : false;
+    }
+    async findUserEntry(login, client, bindUserDN) {
+        const searchFilter = this.buildUserFilter(login, this.ldapConfig.filter);
+        try {
+            const { searchEntries } = await client.search(this.ldapConfig.baseDN, {
+                scope: _authldapconstants.LDAP_SEARCH_ATTR.SUB,
+                filter: searchFilter,
+                attributes: _authldapconstants.ALL_LDAP_ATTRIBUTES
+            });
+            if (searchEntries.length === 0) {
+                this.logger.debug({
+                    tag: this.findUserEntry.name,
+                    msg: `search filter : ${searchFilter}`
+                });
+                this.logger.warn({
+                    tag: this.findUserEntry.name,
+                    msg: `no LDAP entry found for : ${login}`
+                });
+                return false;
+            }
+            if (searchEntries.length > 1) {
+                this.logger.warn({
+                    tag: this.findUserEntry.name,
+                    msg: `multiple LDAP entries found for : ${login}, using first one`
+                });
+            }
+            const rawEntry = searchEntries[0];
+            const entry = this.convertToLdapUserEntry(rawEntry);
+            const userDn = rawEntry.dn || bindUserDN;
+            if (this.ldapConfig.options.adminGroup && !this.hasAdminGroup(entry, this.ldapConfig.options.adminGroup)) {
+                if (userDn && await this.isMemberOfGroupOfNames(this.ldapConfig.options.adminGroup, userDn, client)) {
+                    const existing = Array.isArray(entry[_authldapconstants.LDAP_COMMON_ATTR.MEMBER_OF]) ? entry[_authldapconstants.LDAP_COMMON_ATTR.MEMBER_OF] : [];
+                    entry[_authldapconstants.LDAP_COMMON_ATTR.MEMBER_OF] = [
+                        ...new Set([
+                            ...existing,
+                            this.ldapConfig.options.adminGroup
+                        ])
+                    ];
+                }
+            }
+            // Return the first matching entry.
+            return {
+                entry,
+                userDn
+            };
+        } catch (e) {
+            this.logger.debug({
+                tag: this.findUserEntry.name,
+                msg: `search filter : ${searchFilter}`
+            });
+            this.logger.error({
+                tag: this.findUserEntry.name,
+                msg: `${login} : ${e}`
+            });
+            return false;
+        }
+    }
+    async updateOrCreateUser(identity, user) {
+        // Create or update the local user record from LDAP identity.
+        if (user === null) {
+            // Create
+            identity.permissions = this.ldapConfig.options.autoCreatePermissions.join(',');
+            const createdUser = await this.adminUsersManager.createUserOrGuest(identity, identity.role);
+            const freshUser = await this.usersManager.fromUserId(createdUser.id);
+            if (!freshUser) {
+                this.logger.error({
+                    tag: this.updateOrCreateUser.name,
+                    msg: `user was not found : ${createdUser.login} (${createdUser.id})`
+                });
+                throw new _common.HttpException('User not found', _common.HttpStatus.NOT_FOUND);
+            }
+            return freshUser;
+        }
+        if (identity.login !== user.login) {
+            this.logger.error({
+                tag: this.updateOrCreateUser.name,
+                msg: `user login mismatch : ${identity.login} !== ${user.login}`
+            });
+            throw new _common.HttpException('Account matching error', _common.HttpStatus.FORBIDDEN);
+        }
+        // Update: check if user information has changed
+        const identityHasChanged = Object.fromEntries((await Promise.all(Object.keys(identity).map(async (key)=>{
+            if (key === 'password') {
+                const isSame = await (0, _functions.comparePassword)(identity[key], user.password);
+                return isSame ? null : [
+                    key,
+                    identity[key]
+                ];
+            }
+            return identity[key] !== user[key] ? [
+                key,
+                identity[key]
+            ] : null;
+        }))).filter(Boolean));
+        if (Object.keys(identityHasChanged).length > 0) {
+            try {
+                if (identityHasChanged?.role != null) {
+                    if (user.role === _user.USER_ROLE.ADMINISTRATOR && !this.ldapConfig.options.adminGroup) {
+                        // Prevent removing the admin role when adminGroup was removed or not defined
+                        delete identityHasChanged.role;
+                    }
+                }
+                // Update user properties
+                await this.adminUsersManager.updateUserOrGuest(user.id, identityHasChanged);
+                // Extra stuff
+                if (identityHasChanged?.password) {
+                    delete identityHasChanged.password;
+                }
+                Object.assign(user, identityHasChanged);
+                if ('lastName' in identityHasChanged || 'firstName' in identityHasChanged) {
+                    // Force fullName update in the current user model
+                    user.setFullName(true);
+                }
+            } catch (e) {
+                this.logger.warn({
+                    tag: this.updateOrCreateUser.name,
+                    msg: `unable to update user *${user.login}* : ${e}`
+                });
+            }
+        }
+        return user;
+    }
+    convertToLdapUserEntry(entry) {
+        // Normalize memberOf and other LDAP attributes for downstream usage.
+        for (const attr of _authldapconstants.ALL_LDAP_ATTRIBUTES){
+            if (attr === _authldapconstants.LDAP_COMMON_ATTR.MEMBER_OF && entry[attr]) {
+                const values = (Array.isArray(entry[attr]) ? entry[attr] : entry[attr] ? [
+                    entry[attr]
+                ] : []).filter((v)=>typeof v === 'string');
+                const normalized = new Set();
+                for (const value of values){
+                    normalized.add(value);
+                    const cn = value.match(/cn\s*=\s*([^,]+)/i)?.[1]?.trim();
+                    if (cn) {
+                        normalized.add(cn);
+                    }
+                }
+                entry[attr] = Array.from(normalized);
+                continue;
+            }
+            if (Array.isArray(entry[attr])) {
+                // Keep only the first value for all other attributes (e.g., email)
+                entry[attr] = entry[attr].length > 0 ? entry[attr][0] : null;
+            }
+        }
+        return entry;
+    }
+    createIdentity(entry, password) {
+        // Build the local identity payload from LDAP entry.
+        const isAdmin = typeof this.ldapConfig.options.adminGroup === 'string' && this.ldapConfig.options.adminGroup && entry[_authldapconstants.LDAP_COMMON_ATTR.MEMBER_OF]?.includes(this.ldapConfig.options.adminGroup);
+        return {
+            login: this.dbLogin(entry[this.ldapConfig.attributes.login]),
+            email: entry[this.ldapConfig.attributes.email],
+            password: password,
+            role: isAdmin ? _user.USER_ROLE.ADMINISTRATOR : _user.USER_ROLE.USER,
+            ...this.getFirstNameAndLastName(entry)
+        };
+    }
+    getFirstNameAndLastName(entry) {
+        // Resolve name fields with structured and fallback attributes.
+        // 1) Prefer structured attributes
+        if (entry.sn && entry.givenName) {
+            return {
+                firstName: entry.givenName,
+                lastName: entry.sn
+            };
+        }
+        // 2) Fallback to displayName if available
+        if (entry.displayName && entry.displayName.trim()) {
+            return (0, _functions.splitFullName)(entry.displayName);
+        }
+        // 3) Fallback to cn
+        if (entry.cn && entry.cn.trim()) {
+            return (0, _functions.splitFullName)(entry.cn);
+        }
+        // 4) Nothing usable
+        return {
+            firstName: '',
+            lastName: ''
+        };
+    }
+    dbLogin(login) {
+        // Normalize domain-qualified logins to the user part.
+        if (login.includes('\\')) {
+            return login.split('\\').slice(-1)[0];
+        }
+        return login;
+    }
+    buildLdapLogin(login) {
+        // Build the bind login string based on LDAP config.
+        if (this.ldapConfig.attributes.login === _authldapconstants.LDAP_LOGIN_ATTR.UPN) {
+            if (this.ldapConfig.upnSuffix && !login.includes('@')) {
+                return `${login}@${this.ldapConfig.upnSuffix}`;
+            }
+        } else if (this.ldapConfig.attributes.login === _authldapconstants.LDAP_LOGIN_ATTR.SAM) {
+            if (this.ldapConfig.netbiosName && !login.includes('\\')) {
+                return `${this.ldapConfig.netbiosName}\\${login}`;
+            }
+        }
+        return login;
+    }
+    buildBindUserDN(ldapLogin) {
+        return this.isAD ? ldapLogin : `${this.ldapConfig.attributes.login}=${ldapLogin},${this.ldapConfig.baseDN}`;
+    }
+    buildUserFilter(login, extraFilter) {
+        // Build a safe LDAP filter to search for the user entry.
+        // Important: - Values passed to EqualityFilter are auto-escaped by ldapts
+        //            - extraFilter is appended as-is (assumed trusted configuration)
+        // Note: The OR clause differs between AD and generic LDAP.
+        // Handle the case where the sAMAccountName is provided in domain-qualified format (e.g., SYNC_IN\\user)
+        // Note: sAMAccountName is always stored without the domain in Active Directory.
+        const dbLogin = this.dbLogin(login);
+        const or = new _ldapts.OrFilter({
+            filters: this.isAD ? [
+                new _ldapts.EqualityFilter({
+                    attribute: _authldapconstants.LDAP_LOGIN_ATTR.SAM,
+                    value: dbLogin
+                }),
+                new _ldapts.EqualityFilter({
+                    attribute: _authldapconstants.LDAP_LOGIN_ATTR.UPN,
+                    value: dbLogin
+                }),
+                new _ldapts.EqualityFilter({
+                    attribute: _authldapconstants.LDAP_LOGIN_ATTR.MAIL,
+                    value: dbLogin
+                })
+            ] : [
+                new _ldapts.EqualityFilter({
+                    attribute: _authldapconstants.LDAP_LOGIN_ATTR.UID,
+                    value: dbLogin
+                }),
+                new _ldapts.EqualityFilter({
+                    attribute: _authldapconstants.LDAP_LOGIN_ATTR.CN,
+                    value: dbLogin
+                }),
+                new _ldapts.EqualityFilter({
+                    attribute: _authldapconstants.LDAP_LOGIN_ATTR.MAIL,
+                    value: dbLogin
+                })
+            ]
+        });
+        // Convert to LDAP filter string
+        let filterString = new _ldapts.AndFilter({
+            filters: [
+                or
+            ]
+        }).toString();
+        // Optionally append an extra filter from config (trusted source)
+        if (extraFilter && extraFilter.trim()) {
+            filterString = `(&${filterString}${extraFilter})`;
+        }
+        return filterString;
+    }
+    hasAdminGroup(entry, adminGroup) {
+        // Check for the admin group in the normalized `memberOf` list.
+        return Array.isArray(entry[_authldapconstants.LDAP_COMMON_ATTR.MEMBER_OF]) && entry[_authldapconstants.LDAP_COMMON_ATTR.MEMBER_OF].includes(adminGroup);
+    }
+    async isMemberOfGroupOfNames(adminGroup, userDn, client) {
+        // Check groupOfNames membership by querying group entries.
+        // When adminGroup is a DN, search at the group DN; otherwise search under baseDN.
+        const { dn, cn } = this.parseAdminGroup(adminGroup);
+        // Build a filter that matches groupOfNames entries containing the user's DN as a member.
+        const filters = [
+            new _ldapts.EqualityFilter({
+                attribute: _authldapconstants.LDAP_SEARCH_ATTR.OBJECT_CLASS,
+                value: _authldapconstants.LDAP_SEARCH_ATTR.GROUP_OF_NAMES
+            }),
+            new _ldapts.EqualityFilter({
+                attribute: _authldapconstants.LDAP_SEARCH_ATTR.MEMBER,
+                value: userDn
+            })
+        ];
+        // If a CN is available, narrow the query to that specific group name.
+        if (cn) {
+            filters.splice(1, 0, new _ldapts.EqualityFilter({
+                attribute: _authldapconstants.LDAP_COMMON_ATTR.CN,
+                value: cn
+            }));
+        }
+        const filter = new _ldapts.AndFilter({
+            filters
+        }).toString();
+        try {
+            // Use BASE scope for an exact DN lookup, otherwise SUB to scan within baseDN.
+            const { searchEntries } = await client.search(dn || this.ldapConfig.baseDN, {
+                scope: dn ? _authldapconstants.LDAP_SEARCH_ATTR.BASE : _authldapconstants.LDAP_SEARCH_ATTR.SUB,
+                filter,
+                attributes: [
+                    _authldapconstants.LDAP_COMMON_ATTR.CN
+                ]
+            });
+            // Any matching entry implies membership.
+            return searchEntries.length > 0;
+        } catch (e) {
+            this.logger.warn({
+                tag: this.isMemberOfGroupOfNames.name,
+                msg: `${e}`
+            });
+            return false;
+        }
+    }
+    parseAdminGroup(adminGroup) {
+        // Accept either full DN or simple CN and extract what we can for lookups.
+        const looksLikeDn = adminGroup.includes('=') && adminGroup.includes(',');
+        if (!looksLikeDn) {
+            return {
+                cn: adminGroup
+            };
+        }
+        const cn = adminGroup.match(/cn\s*=\s*([^,]+)/i)?.[1]?.trim();
+        return {
+            dn: adminGroup,
+            cn
+        };
+    }
+    handleBindError(error, attemptedBindDN) {
+        // Prefer the most specific LDAP error when multiple errors are returned.
+        if (error?.errors?.length) {
+            for (const err of error.errors){
+                this.logger.warn({
+                    tag: this.handleBindError.name,
+                    msg: `${attemptedBindDN} : ${err}`
+                });
+            }
+            return error.errors[error.errors.length - 1];
+        }
+        this.logger.warn({
+            tag: this.handleBindError.name,
+            msg: `${attemptedBindDN} : ${error}`
+        });
+        return error;
+    }
+    constructor(usersManager, adminUsersManager){
+        this.usersManager = usersManager;
+        this.adminUsersManager = adminUsersManager;
+        this.logger = new _common.Logger(AuthProviderLDAP.name);
+        this.ldapConfig = _configenvironment.configuration.auth.ldap;
+        this.hasServiceBind = Boolean(this.ldapConfig.serviceBindDN && this.ldapConfig.serviceBindPassword);
+        this.isAD = this.ldapConfig.attributes.login === _authldapconstants.LDAP_LOGIN_ATTR.SAM || this.ldapConfig.attributes.login === _authldapconstants.LDAP_LOGIN_ATTR.UPN;
+        this.clientOptions = {
+            timeout: 6000,
+            connectTimeout: 6000,
+            url: ''
+        };
+    }
+};
+AuthProviderLDAP = _ts_decorate([
+    (0, _common.Injectable)(),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof _usersmanagerservice.UsersManager === "undefined" ? Object : _usersmanagerservice.UsersManager,
+        typeof _adminusersmanagerservice.AdminUsersManager === "undefined" ? Object : _adminusersmanagerservice.AdminUsersManager
+    ])
+], AuthProviderLDAP);
+
+//# sourceMappingURL=auth-provider-ldap.service.js.map

package/server/authentication/providers/ldap/auth-provider-ldap.service.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../backend/src/authentication/providers/ldap/auth-provider-ldap.service.ts"],"sourcesContent":["import { HttpException, HttpStatus, Injectable, Logger } from '@nestjs/common'\nimport { AndFilter, Client, ClientOptions, Entry, EqualityFilter, InvalidCredentialsError, OrFilter } from 'ldapts'\nimport { CONNECT_ERROR_CODE } from '../../../app.constants'\nimport { USER_ROLE } from '../../../applications/users/constants/user'\nimport type { CreateUserDto, UpdateUserDto } from '../../../applications/users/dto/create-or-update-user.dto'\nimport { UserModel } from '../../../applications/users/models/user.model'\nimport { AdminUsersManager } from '../../../applications/users/services/admin-users-manager.service'\nimport { UsersManager } from '../../../applications/users/services/users-manager.service'\nimport { comparePassword, splitFullName } from '../../../common/functions'\nimport { configuration } from '../../../configuration/config.environment'\nimport type { AUTH_SCOPE } from '../../constants/scope'\nimport { AuthProvider } from '../auth-providers.models'\nimport type { AuthProviderLDAPConfig } from './auth-ldap.config'\nimport { ALL_LDAP_ATTRIBUTES, LDAP_COMMON_ATTR, LDAP_LOGIN_ATTR, LDAP_SEARCH_ATTR } from './auth-ldap.constants'\n\ntype LdapUserEntry = Entry &\n  Record<LDAP_LOGIN_ATTR | Exclude<(typeof LDAP_COMMON_ATTR)[keyof typeof LDAP_COMMON_ATTR], typeof LDAP_COMMON_ATTR.MEMBER_OF>, string> & {\n    [LDAP_COMMON_ATTR.MEMBER_OF]?: string[]\n  }\n\n@Injectable()\nexport class AuthProviderLDAP implements AuthProvider {\n  private readonly logger = new Logger(AuthProviderLDAP.name)\n  private readonly ldapConfig: AuthProviderLDAPConfig = configuration.auth.ldap\n  private readonly hasServiceBind = Boolean(this.ldapConfig.serviceBindDN && this.ldapConfig.serviceBindPassword)\n  private readonly isAD = this.ldapConfig.attributes.login === LDAP_LOGIN_ATTR.SAM || this.ldapConfig.attributes.login === LDAP_LOGIN_ATTR.UPN\n  private clientOptions: ClientOptions = { timeout: 6000, connectTimeout: 6000, url: '' }\n\n  constructor(\n    private readonly usersManager: UsersManager,\n    private readonly adminUsersManager: AdminUsersManager\n  ) {}\n\n  async validateUser(loginOrEmail: string, password: string, ip?: string, scope?: AUTH_SCOPE): Promise<UserModel> {\n    // Authenticate user via LDAP and sync local user state.\n    // Find user from his login or email\n    let user: UserModel = await this.usersManager.findUser(this.dbLogin(loginOrEmail), false)\n    if (user) {\n      if (user.isGuest || scope) {\n        // Allow local password authentication for guest users and application scopes (app passwords)\n        return this.usersManager.logUser(user, password, ip, scope)\n      }\n      if (!user.isActive) {\n        this.logger.error({ tag: this.validateUser.name, msg: `user *${user.login}* is locked` })\n        throw new HttpException('Account locked', HttpStatus.FORBIDDEN)\n      }\n    }\n    let ldapErrorMessage: string\n    let entry: false | LdapUserEntry = false\n    try {\n      // If a user was found, use the stored login. This allows logging in with an email.\n      entry = await this.checkAuth(user?.login || loginOrEmail, password)\n    } catch (e) {\n      ldapErrorMessage = e.message\n    }\n\n    // LDAP auth failed or exception raised\n    if (entry === false) {\n      // If LDAP is unavailable (connectivity/service error), allow local password fallback.\n      // Allow local password authentication for:\n      // - admin users (break-glass access)\n      // - regular users when password authentication fallback is enabled\n      if (user && (user.isAdmin || (Boolean(ldapErrorMessage) && this.ldapConfig.options.enablePasswordAuthFallback))) {\n        const localUser = await this.usersManager.logUser(user, password, ip)\n        if (localUser) return localUser\n      }\n\n      if (ldapErrorMessage) {\n        throw new HttpException(ldapErrorMessage, HttpStatus.SERVICE_UNAVAILABLE)\n      }\n\n      return null\n    }\n\n    if (!entry[this.ldapConfig.attributes.login] || !entry[this.ldapConfig.attributes.email]) {\n      this.logger.error({\n        tag: this.validateUser.name,\n        msg: `required ldap fields are missing : \n      [${this.ldapConfig.attributes.login}, ${this.ldapConfig.attributes.email}] => \n      (${JSON.stringify(entry)})`\n      })\n      return null\n    }\n\n    if (!user && !this.ldapConfig.options.autoCreateUser) {\n      this.logger.warn({ tag: this.validateUser.name, msg: `User not found and autoCreateUser is disabled` })\n      throw new HttpException('User not found', HttpStatus.UNAUTHORIZED)\n    }\n\n    const identity = this.createIdentity(entry, password)\n    user = await this.updateOrCreateUser(identity, user)\n    this.usersManager.updateAccesses(user, ip, true).catch((e: Error) => this.logger.error({ tag: this.validateUser.name, msg: `${e}` }))\n    return user\n  }\n\n  private async checkAuth(login: string, password: string): Promise<LdapUserEntry | false> {\n    // Bind and fetch LDAP entry, optionally via service account.\n    const ldapLogin = this.buildLdapLogin(login)\n    // AD: bind directly with the user input (UPN or DOMAIN\\user)\n    // Generic LDAP: build DN from login attribute + baseDN\n    const bindUserDN = this.buildBindUserDN(ldapLogin)\n    let error: InvalidCredentialsError | any\n    for (const s of this.ldapConfig.servers) {\n      const client = new Client({ ...this.clientOptions, url: s })\n      let attemptedBindDN = bindUserDN\n      try {\n        if (this.hasServiceBind) {\n          attemptedBindDN = this.ldapConfig.serviceBindDN\n          await client.bind(this.ldapConfig.serviceBindDN, this.ldapConfig.serviceBindPassword)\n          const result = await this.findUserEntry(ldapLogin, client)\n          if (!result || !result.userDn) {\n            this.logger.warn({ tag: this.checkAuth.name, msg: `no LDAP entry found for : ${login}` })\n            return false\n          }\n          const { entry, userDn } = result\n          attemptedBindDN = userDn\n          await client.bind(userDn, password)\n          return entry\n        }\n        attemptedBindDN = bindUserDN\n        await client.bind(bindUserDN, password)\n        return await this.checkAccess(ldapLogin, client, bindUserDN)\n      } catch (e) {\n        error = this.handleBindError(e, attemptedBindDN)\n        if (error instanceof InvalidCredentialsError) {\n          return false\n        }\n      } finally {\n        await client.unbind()\n      }\n    }\n    if (error) {\n      this.logger.error({ tag: this.checkAuth.name, msg: `${error}` })\n      if (CONNECT_ERROR_CODE.has(error.code)) {\n        throw new Error('Authentication service error')\n      }\n    }\n    return false\n  }\n\n  private async checkAccess(login: string, client: Client, bindUserDN?: string): Promise<LdapUserEntry | false> {\n    // Search for the LDAP entry and normalize attributes.\n    const result = await this.findUserEntry(login, client, bindUserDN)\n    return result ? result.entry : false\n  }\n\n  private async findUserEntry(login: string, client: Client, bindUserDN?: string): Promise<{ entry: LdapUserEntry; userDn?: string } | false> {\n    const searchFilter = this.buildUserFilter(login, this.ldapConfig.filter)\n    try {\n      const { searchEntries } = await client.search(this.ldapConfig.baseDN, {\n        scope: LDAP_SEARCH_ATTR.SUB,\n        filter: searchFilter,\n        attributes: ALL_LDAP_ATTRIBUTES\n      })\n\n      if (searchEntries.length === 0) {\n        this.logger.debug({ tag: this.findUserEntry.name, msg: `search filter : ${searchFilter}` })\n        this.logger.warn({ tag: this.findUserEntry.name, msg: `no LDAP entry found for : ${login}` })\n        return false\n      }\n\n      if (searchEntries.length > 1) {\n        this.logger.warn({ tag: this.findUserEntry.name, msg: `multiple LDAP entries found for : ${login}, using first one` })\n      }\n\n      const rawEntry = searchEntries[0]\n      const entry: LdapUserEntry = this.convertToLdapUserEntry(rawEntry)\n      const userDn = (rawEntry as { dn?: string }).dn || bindUserDN\n\n      if (this.ldapConfig.options.adminGroup && !this.hasAdminGroup(entry, this.ldapConfig.options.adminGroup)) {\n        if (userDn && (await this.isMemberOfGroupOfNames(this.ldapConfig.options.adminGroup, userDn, client))) {\n          const existing = Array.isArray(entry[LDAP_COMMON_ATTR.MEMBER_OF]) ? entry[LDAP_COMMON_ATTR.MEMBER_OF] : []\n          entry[LDAP_COMMON_ATTR.MEMBER_OF] = [...new Set([...existing, this.ldapConfig.options.adminGroup])]\n        }\n      }\n\n      // Return the first matching entry.\n      return { entry, userDn }\n    } catch (e) {\n      this.logger.debug({ tag: this.findUserEntry.name, msg: `search filter : ${searchFilter}` })\n      this.logger.error({ tag: this.findUserEntry.name, msg: `${login} : ${e}` })\n      return false\n    }\n  }\n\n  private async updateOrCreateUser(identity: CreateUserDto, user: UserModel): Promise<UserModel> {\n    // Create or update the local user record from LDAP identity.\n    if (user === null) {\n      // Create\n      identity.permissions = this.ldapConfig.options.autoCreatePermissions.join(',')\n      const createdUser = await this.adminUsersManager.createUserOrGuest(identity, identity.role)\n      const freshUser = await this.usersManager.fromUserId(createdUser.id)\n      if (!freshUser) {\n        this.logger.error({ tag: this.updateOrCreateUser.name, msg: `user was not found : ${createdUser.login} (${createdUser.id})` })\n        throw new HttpException('User not found', HttpStatus.NOT_FOUND)\n      }\n      return freshUser\n    }\n\n    if (identity.login !== user.login) {\n      this.logger.error({ tag: this.updateOrCreateUser.name, msg: `user login mismatch : ${identity.login} !== ${user.login}` })\n      throw new HttpException('Account matching error', HttpStatus.FORBIDDEN)\n    }\n\n    // Update: check if user information has changed\n    const identityHasChanged: UpdateUserDto = Object.fromEntries(\n      (\n        await Promise.all(\n          Object.keys(identity).map(async (key: string) => {\n            if (key === 'password') {\n              const isSame = await comparePassword(identity[key], user.password)\n              return isSame ? null : [key, identity[key]]\n            }\n            return identity[key] !== user[key] ? [key, identity[key]] : null\n          })\n        )\n      ).filter(Boolean)\n    )\n\n    if (Object.keys(identityHasChanged).length > 0) {\n      try {\n        if (identityHasChanged?.role != null) {\n          if (user.role === USER_ROLE.ADMINISTRATOR && !this.ldapConfig.options.adminGroup) {\n            // Prevent removing the admin role when adminGroup was removed or not defined\n            delete identityHasChanged.role\n          }\n        }\n\n        // Update user properties\n        await this.adminUsersManager.updateUserOrGuest(user.id, identityHasChanged)\n\n        // Extra stuff\n        if (identityHasChanged?.password) {\n          delete identityHasChanged.password\n        }\n\n        Object.assign(user, identityHasChanged)\n\n        if ('lastName' in identityHasChanged || 'firstName' in identityHasChanged) {\n          // Force fullName update in the current user model\n          user.setFullName(true)\n        }\n      } catch (e) {\n        this.logger.warn({ tag: this.updateOrCreateUser.name, msg: `unable to update user *${user.login}* : ${e}` })\n      }\n    }\n    return user\n  }\n\n  private convertToLdapUserEntry(entry: Entry): LdapUserEntry {\n    // Normalize memberOf and other LDAP attributes for downstream usage.\n    for (const attr of ALL_LDAP_ATTRIBUTES) {\n      if (attr === LDAP_COMMON_ATTR.MEMBER_OF && entry[attr]) {\n        const values = (Array.isArray(entry[attr]) ? entry[attr] : entry[attr] ? [entry[attr]] : []).filter(\n          (v: any) => typeof v === 'string'\n        ) as string[]\n        const normalized = new Set<string>()\n        for (const value of values) {\n          normalized.add(value)\n          const cn = value.match(/cn\\s*=\\s*([^,]+)/i)?.[1]?.trim()\n          if (cn) {\n            normalized.add(cn)\n          }\n        }\n        entry[attr] = Array.from(normalized)\n        continue\n      }\n      if (Array.isArray(entry[attr])) {\n        // Keep only the first value for all other attributes (e.g., email)\n        entry[attr] = entry[attr].length > 0 ? entry[attr][0] : null\n      }\n    }\n    return entry as LdapUserEntry\n  }\n\n  private createIdentity(entry: LdapUserEntry, password: string): CreateUserDto {\n    // Build the local identity payload from LDAP entry.\n    const isAdmin =\n      typeof this.ldapConfig.options.adminGroup === 'string' &&\n      this.ldapConfig.options.adminGroup &&\n      entry[LDAP_COMMON_ATTR.MEMBER_OF]?.includes(this.ldapConfig.options.adminGroup)\n    return {\n      login: this.dbLogin(entry[this.ldapConfig.attributes.login]),\n      email: entry[this.ldapConfig.attributes.email] as string,\n      password: password,\n      role: isAdmin ? USER_ROLE.ADMINISTRATOR : USER_ROLE.USER,\n      ...this.getFirstNameAndLastName(entry)\n    } satisfies CreateUserDto\n  }\n\n  private getFirstNameAndLastName(entry: LdapUserEntry): { firstName: string; lastName: string } {\n    // Resolve name fields with structured and fallback attributes.\n    // 1) Prefer structured attributes\n    if (entry.sn && entry.givenName) {\n      return { firstName: entry.givenName, lastName: entry.sn }\n    }\n    // 2) Fallback to displayName if available\n    if (entry.displayName && entry.displayName.trim()) {\n      return splitFullName(entry.displayName)\n    }\n    // 3) Fallback to cn\n    if (entry.cn && entry.cn.trim()) {\n      return splitFullName(entry.cn)\n    }\n    // 4) Nothing usable\n    return { firstName: '', lastName: '' }\n  }\n\n  private dbLogin(login: string): string {\n    // Normalize domain-qualified logins to the user part.\n    if (login.includes('\\\\')) {\n      return login.split('\\\\').slice(-1)[0]\n    }\n    return login\n  }\n\n  private buildLdapLogin(login: string): string {\n    // Build the bind login string based on LDAP config.\n    if (this.ldapConfig.attributes.login === LDAP_LOGIN_ATTR.UPN) {\n      if (this.ldapConfig.upnSuffix && !login.includes('@')) {\n        return `${login}@${this.ldapConfig.upnSuffix}`\n      }\n    } else if (this.ldapConfig.attributes.login === LDAP_LOGIN_ATTR.SAM) {\n      if (this.ldapConfig.netbiosName && !login.includes('\\\\')) {\n        return `${this.ldapConfig.netbiosName}\\\\${login}`\n      }\n    }\n    return login\n  }\n\n  private buildBindUserDN(ldapLogin: string): string {\n    return this.isAD ? ldapLogin : `${this.ldapConfig.attributes.login}=${ldapLogin},${this.ldapConfig.baseDN}`\n  }\n\n  private buildUserFilter(login: string, extraFilter?: string): string {\n    // Build a safe LDAP filter to search for the user entry.\n    // Important: - Values passed to EqualityFilter are auto-escaped by ldapts\n    //            - extraFilter is appended as-is (assumed trusted configuration)\n    // Note: The OR clause differs between AD and generic LDAP.\n\n    // Handle the case where the sAMAccountName is provided in domain-qualified format (e.g., SYNC_IN\\\\user)\n    // Note: sAMAccountName is always stored without the domain in Active Directory.\n    const dbLogin = this.dbLogin(login)\n\n    const or = new OrFilter({\n      filters: this.isAD\n        ? [\n            new EqualityFilter({ attribute: LDAP_LOGIN_ATTR.SAM, value: dbLogin }),\n            new EqualityFilter({ attribute: LDAP_LOGIN_ATTR.UPN, value: dbLogin }),\n            new EqualityFilter({ attribute: LDAP_LOGIN_ATTR.MAIL, value: dbLogin })\n          ]\n        : [\n            new EqualityFilter({ attribute: LDAP_LOGIN_ATTR.UID, value: dbLogin }),\n            new EqualityFilter({ attribute: LDAP_LOGIN_ATTR.CN, value: dbLogin }),\n            new EqualityFilter({ attribute: LDAP_LOGIN_ATTR.MAIL, value: dbLogin })\n          ]\n    })\n\n    // Convert to LDAP filter string\n    let filterString = new AndFilter({ filters: [or] }).toString()\n\n    // Optionally append an extra filter from config (trusted source)\n    if (extraFilter && extraFilter.trim()) {\n      filterString = `(&${filterString}${extraFilter})`\n    }\n    return filterString\n  }\n\n  private hasAdminGroup(entry: LdapUserEntry, adminGroup: string): boolean {\n    // Check for the admin group in the normalized `memberOf` list.\n    return Array.isArray(entry[LDAP_COMMON_ATTR.MEMBER_OF]) && entry[LDAP_COMMON_ATTR.MEMBER_OF].includes(adminGroup)\n  }\n\n  private async isMemberOfGroupOfNames(adminGroup: string, userDn: string, client: Client): Promise<boolean> {\n    // Check groupOfNames membership by querying group entries.\n    // When adminGroup is a DN, search at the group DN; otherwise search under baseDN.\n    const { dn, cn } = this.parseAdminGroup(adminGroup)\n    // Build a filter that matches groupOfNames entries containing the user's DN as a member.\n    const filters = [\n      new EqualityFilter({ attribute: LDAP_SEARCH_ATTR.OBJECT_CLASS, value: LDAP_SEARCH_ATTR.GROUP_OF_NAMES }),\n      new EqualityFilter({ attribute: LDAP_SEARCH_ATTR.MEMBER, value: userDn })\n    ]\n    // If a CN is available, narrow the query to that specific group name.\n    if (cn) {\n      filters.splice(1, 0, new EqualityFilter({ attribute: LDAP_COMMON_ATTR.CN, value: cn }))\n    }\n    const filter = new AndFilter({ filters }).toString()\n\n    try {\n      // Use BASE scope for an exact DN lookup, otherwise SUB to scan within baseDN.\n      const { searchEntries } = await client.search(dn || this.ldapConfig.baseDN, {\n        scope: dn ? LDAP_SEARCH_ATTR.BASE : LDAP_SEARCH_ATTR.SUB,\n        filter,\n        attributes: [LDAP_COMMON_ATTR.CN]\n      })\n      // Any matching entry implies membership.\n      return searchEntries.length > 0\n    } catch (e) {\n      this.logger.warn({ tag: this.isMemberOfGroupOfNames.name, msg: `${e}` })\n      return false\n    }\n  }\n\n  private parseAdminGroup(adminGroup: string): { dn?: string; cn?: string } {\n    // Accept either full DN or simple CN and extract what we can for lookups.\n    const looksLikeDn = adminGroup.includes('=') && adminGroup.includes(',')\n    if (!looksLikeDn) {\n      return { cn: adminGroup }\n    }\n    const cn = adminGroup.match(/cn\\s*=\\s*([^,]+)/i)?.[1]?.trim()\n    return { dn: adminGroup, cn }\n  }\n\n  private handleBindError(error: any, attemptedBindDN: string): InvalidCredentialsError | any {\n    // Prefer the most specific LDAP error when multiple errors are returned.\n    if (error?.errors?.length) {\n      for (const err of error.errors) {\n        this.logger.warn({ tag: this.handleBindError.name, msg: `${attemptedBindDN} : ${err}` })\n      }\n      return error.errors[error.errors.length - 1]\n    }\n    this.logger.warn({ tag: this.handleBindError.name, msg: `${attemptedBindDN} : ${error}` })\n    return error\n  }\n}\n"],"names":["AuthProviderLDAP","validateUser","loginOrEmail","password","ip","scope","user","usersManager","findUser","dbLogin","isGuest","logUser","isActive","logger","error","tag","name","msg","login","HttpException","HttpStatus","FORBIDDEN","ldapErrorMessage","entry","checkAuth","e","message","isAdmin","Boolean","ldapConfig","options","enablePasswordAuthFallback","localUser","SERVICE_UNAVAILABLE","attributes","email","JSON","stringify","autoCreateUser","warn","UNAUTHORIZED","identity","createIdentity","updateOrCreateUser","updateAccesses","catch","ldapLogin","buildLdapLogin","bindUserDN","buildBindUserDN","s","servers","client","Client","clientOptions","url","attemptedBindDN","hasServiceBind","serviceBindDN","bind","serviceBindPassword","result","findUserEntry","userDn","checkAccess","handleBindError","InvalidCredentialsError","unbind","CONNECT_ERROR_CODE","has","code","Error","searchFilter","buildUserFilter","filter","searchEntries","search","baseDN","LDAP_SEARCH_ATTR","SUB","ALL_LDAP_ATTRIBUTES","length","debug","rawEntry","convertToLdapUserEntry","dn","adminGroup","hasAdminGroup","isMemberOfGroupOfNames","existing","Array","isArray","LDAP_COMMON_ATTR","MEMBER_OF","Set","permissions","autoCreatePermissions","join","createdUser","adminUsersManager","createUserOrGuest","role","freshUser","fromUserId","id","NOT_FOUND","identityHasChanged","Object","fromEntries","Promise","all","keys","map","key","isSame","comparePassword","USER_ROLE","ADMINISTRATOR","updateUserOrGuest","assign","setFullName","attr","values","v","normalized","value","add","cn","match","trim","from","includes","USER","getFirstNameAndLastName","sn","givenName","firstName","lastName","displayName","splitFullName","split","slice","LDAP_LOGIN_ATTR","UPN","upnSuffix","SAM","netbiosName","isAD","extraFilter","or","OrFilter","filters","EqualityFilter","attribute","MAIL","UID","CN","filterString","AndFilter","toString","parseAdminGroup","OBJECT_CLASS","GROUP_OF_NAMES","MEMBER","splice","BASE","looksLikeDn","errors","err","Logger","configuration","auth","ldap","timeout","connectTimeout"],"mappings":";;;;+BAqBaA;;;eAAAA;;;wBArBiD;wBAC6C;8BACxE;sBACT;0CAGQ;qCACL;2BACkB;mCACjB;mCAI2D;;;;;;;;;;AAQlF,IAAA,AAAMA,mBAAN,MAAMA;IAYX,MAAMC,aAAaC,YAAoB,EAAEC,QAAgB,EAAEC,EAAW,EAAEC,KAAkB,EAAsB;QAC9G,wDAAwD;QACxD,oCAAoC;QACpC,IAAIC,OAAkB,MAAM,IAAI,CAACC,YAAY,CAACC,QAAQ,CAAC,IAAI,CAACC,OAAO,CAACP,eAAe;QACnF,IAAII,MAAM;YACR,IAAIA,KAAKI,OAAO,IAAIL,OAAO;gBACzB,6FAA6F;gBAC7F,OAAO,IAAI,CAACE,YAAY,CAACI,OAAO,CAACL,MAAMH,UAAUC,IAAIC;YACvD;YACA,IAAI,CAACC,KAAKM,QAAQ,EAAE;gBAClB,IAAI,CAACC,MAAM,CAACC,KAAK,CAAC;oBAAEC,KAAK,IAAI,CAACd,YAAY,CAACe,IAAI;oBAAEC,KAAK,CAAC,MAAM,EAAEX,KAAKY,KAAK,CAAC,WAAW,CAAC;gBAAC;gBACvF,MAAM,IAAIC,qBAAa,CAAC,kBAAkBC,kBAAU,CAACC,SAAS;YAChE;QACF;QACA,IAAIC;QACJ,IAAIC,QAA+B;QACnC,IAAI;YACF,mFAAmF;YACnFA,QAAQ,MAAM,IAAI,CAACC,SAAS,CAAClB,MAAMY,SAAShB,cAAcC;QAC5D,EAAE,OAAOsB,GAAG;YACVH,mBAAmBG,EAAEC,OAAO;QAC9B;QAEA,uCAAuC;QACvC,IAAIH,UAAU,OAAO;YACnB,sFAAsF;YACtF,2CAA2C;YAC3C,qCAAqC;YACrC,mEAAmE;YACnE,IAAIjB,QAASA,CAAAA,KAAKqB,OAAO,IAAKC,QAAQN,qBAAqB,IAAI,CAACO,UAAU,CAACC,OAAO,CAACC,0BAA0B,GAAI;gBAC/G,MAAMC,YAAY,MAAM,IAAI,CAACzB,YAAY,CAACI,OAAO,CAACL,MAAMH,UAAUC;gBAClE,IAAI4B,WAAW,OAAOA;YACxB;YAEA,IAAIV,kBAAkB;gBACpB,MAAM,IAAIH,qBAAa,CAACG,kBAAkBF,kBAAU,CAACa,mBAAmB;YAC1E;YAEA,OAAO;QACT;QAEA,IAAI,CAACV,KAAK,CAAC,IAAI,CAACM,UAAU,CAACK,UAAU,CAAChB,KAAK,CAAC,IAAI,CAACK,KAAK,CAAC,IAAI,CAACM,UAAU,CAACK,UAAU,CAACC,KAAK,CAAC,EAAE;YACxF,IAAI,CAACtB,MAAM,CAACC,KAAK,CAAC;gBAChBC,KAAK,IAAI,CAACd,YAAY,CAACe,IAAI;gBAC3BC,KAAK,CAAC;OACP,EAAE,IAAI,CAACY,UAAU,CAACK,UAAU,CAAChB,KAAK,CAAC,EAAE,EAAE,IAAI,CAACW,UAAU,CAACK,UAAU,CAACC,KAAK,CAAC;OACxE,EAAEC,KAAKC,SAAS,CAACd,OAAO,CAAC,CAAC;YAC3B;YACA,OAAO;QACT;QAEA,IAAI,CAACjB,QAAQ,CAAC,IAAI,CAACuB,UAAU,CAACC,OAAO,CAACQ,cAAc,EAAE;YACpD,IAAI,CAACzB,MAAM,CAAC0B,IAAI,CAAC;gBAAExB,KAAK,IAAI,CAACd,YAAY,CAACe,IAAI;gBAAEC,KAAK,CAAC,6CAA6C,CAAC;YAAC;YACrG,MAAM,IAAIE,qBAAa,CAAC,kBAAkBC,kBAAU,CAACoB,YAAY;QACnE;QAEA,MAAMC,WAAW,IAAI,CAACC,cAAc,CAACnB,OAAOpB;QAC5CG,OAAO,MAAM,IAAI,CAACqC,kBAAkB,CAACF,UAAUnC;QAC/C,IAAI,CAACC,YAAY,CAACqC,cAAc,CAACtC,MAAMF,IAAI,MAAMyC,KAAK,CAAC,CAACpB,IAAa,IAAI,CAACZ,MAAM,CAACC,KAAK,CAAC;gBAAEC,KAAK,IAAI,CAACd,YAAY,CAACe,IAAI;gBAAEC,KAAK,GAAGQ,GAAG;YAAC;QAClI,OAAOnB;IACT;IAEA,MAAckB,UAAUN,KAAa,EAAEf,QAAgB,EAAkC;QACvF,6DAA6D;QAC7D,MAAM2C,YAAY,IAAI,CAACC,cAAc,CAAC7B;QACtC,6DAA6D;QAC7D,uDAAuD;QACvD,MAAM8B,aAAa,IAAI,CAACC,eAAe,CAACH;QACxC,IAAIhC;QACJ,KAAK,MAAMoC,KAAK,IAAI,CAACrB,UAAU,CAACsB,OAAO,CAAE;YACvC,MAAMC,SAAS,IAAIC,cAAM,CAAC;gBAAE,GAAG,IAAI,CAACC,aAAa;gBAAEC,KAAKL;YAAE;YAC1D,IAAIM,kBAAkBR;YACtB,IAAI;gBACF,IAAI,IAAI,CAACS,cAAc,EAAE;oBACvBD,kBAAkB,IAAI,CAAC3B,UAAU,CAAC6B,aAAa;oBAC/C,MAAMN,OAAOO,IAAI,CAAC,IAAI,CAAC9B,UAAU,CAAC6B,aAAa,EAAE,IAAI,CAAC7B,UAAU,CAAC+B,mBAAmB;oBACpF,MAAMC,SAAS,MAAM,IAAI,CAACC,aAAa,CAAChB,WAAWM;oBACnD,IAAI,CAACS,UAAU,CAACA,OAAOE,MAAM,EAAE;wBAC7B,IAAI,CAAClD,MAAM,CAAC0B,IAAI,CAAC;4BAAExB,KAAK,IAAI,CAACS,SAAS,CAACR,IAAI;4BAAEC,KAAK,CAAC,0BAA0B,EAAEC,OAAO;wBAAC;wBACvF,OAAO;oBACT;oBACA,MAAM,EAAEK,KAAK,EAAEwC,MAAM,EAAE,GAAGF;oBAC1BL,kBAAkBO;oBAClB,MAAMX,OAAOO,IAAI,CAACI,QAAQ5D;oBAC1B,OAAOoB;gBACT;gBACAiC,kBAAkBR;gBAClB,MAAMI,OAAOO,IAAI,CAACX,YAAY7C;gBAC9B,OAAO,MAAM,IAAI,CAAC6D,WAAW,CAAClB,WAAWM,QAAQJ;YACnD,EAAE,OAAOvB,GAAG;gBACVX,QAAQ,IAAI,CAACmD,eAAe,CAACxC,GAAG+B;gBAChC,IAAI1C,iBAAiBoD,+BAAuB,EAAE;oBAC5C,OAAO;gBACT;YACF,SAAU;gBACR,MAAMd,OAAOe,MAAM;YACrB;QACF;QACA,IAAIrD,OAAO;YACT,IAAI,CAACD,MAAM,CAACC,KAAK,CAAC;gBAAEC,KAAK,IAAI,CAACS,SAAS,CAACR,IAAI;gBAAEC,KAAK,GAAGH,OAAO;YAAC;YAC9D,IAAIsD,gCAAkB,CAACC,GAAG,CAACvD,MAAMwD,IAAI,GAAG;gBACtC,MAAM,IAAIC,MAAM;YAClB;QACF;QACA,OAAO;IACT;IAEA,MAAcP,YAAY9C,KAAa,EAAEkC,MAAc,EAAEJ,UAAmB,EAAkC;QAC5G,sDAAsD;QACtD,MAAMa,SAAS,MAAM,IAAI,CAACC,aAAa,CAAC5C,OAAOkC,QAAQJ;QACvD,OAAOa,SAASA,OAAOtC,KAAK,GAAG;IACjC;IAEA,MAAcuC,cAAc5C,KAAa,EAAEkC,MAAc,EAAEJ,UAAmB,EAA8D;QAC1I,MAAMwB,eAAe,IAAI,CAACC,eAAe,CAACvD,OAAO,IAAI,CAACW,UAAU,CAAC6C,MAAM;QACvE,IAAI;YACF,MAAM,EAAEC,aAAa,EAAE,GAAG,MAAMvB,OAAOwB,MAAM,CAAC,IAAI,CAAC/C,UAAU,CAACgD,MAAM,EAAE;gBACpExE,OAAOyE,mCAAgB,CAACC,GAAG;gBAC3BL,QAAQF;gBACRtC,YAAY8C,sCAAmB;YACjC;YAEA,IAAIL,cAAcM,MAAM,KAAK,GAAG;gBAC9B,IAAI,CAACpE,MAAM,CAACqE,KAAK,CAAC;oBAAEnE,KAAK,IAAI,CAAC+C,aAAa,CAAC9C,IAAI;oBAAEC,KAAK,CAAC,gBAAgB,EAAEuD,cAAc;gBAAC;gBACzF,IAAI,CAAC3D,MAAM,CAAC0B,IAAI,CAAC;oBAAExB,KAAK,IAAI,CAAC+C,aAAa,CAAC9C,IAAI;oBAAEC,KAAK,CAAC,0BAA0B,EAAEC,OAAO;gBAAC;gBAC3F,OAAO;YACT;YAEA,IAAIyD,cAAcM,MAAM,GAAG,GAAG;gBAC5B,IAAI,CAACpE,MAAM,CAAC0B,IAAI,CAAC;oBAAExB,KAAK,IAAI,CAAC+C,aAAa,CAAC9C,IAAI;oBAAEC,KAAK,CAAC,kCAAkC,EAAEC,MAAM,iBAAiB,CAAC;gBAAC;YACtH;YAEA,MAAMiE,WAAWR,aAAa,CAAC,EAAE;YACjC,MAAMpD,QAAuB,IAAI,CAAC6D,sBAAsB,CAACD;YACzD,MAAMpB,SAAS,AAACoB,SAA6BE,EAAE,IAAIrC;YAEnD,IAAI,IAAI,CAACnB,UAAU,CAACC,OAAO,CAACwD,UAAU,IAAI,CAAC,IAAI,CAACC,aAAa,CAAChE,OAAO,IAAI,CAACM,UAAU,CAACC,OAAO,CAACwD,UAAU,GAAG;gBACxG,IAAIvB,UAAW,MAAM,IAAI,CAACyB,sBAAsB,CAAC,IAAI,CAAC3D,UAAU,CAACC,OAAO,CAACwD,UAAU,EAAEvB,QAAQX,SAAU;oBACrG,MAAMqC,WAAWC,MAAMC,OAAO,CAACpE,KAAK,CAACqE,mCAAgB,CAACC,SAAS,CAAC,IAAItE,KAAK,CAACqE,mCAAgB,CAACC,SAAS,CAAC,GAAG,EAAE;oBAC1GtE,KAAK,CAACqE,mCAAgB,CAACC,SAAS,CAAC,GAAG;2BAAI,IAAIC,IAAI;+BAAIL;4BAAU,IAAI,CAAC5D,UAAU,CAACC,OAAO,CAACwD,UAAU;yBAAC;qBAAE;gBACrG;YACF;YAEA,mCAAmC;YACnC,OAAO;gBAAE/D;gBAAOwC;YAAO;QACzB,EAAE,OAAOtC,GAAG;YACV,IAAI,CAACZ,MAAM,CAACqE,KAAK,CAAC;gBAAEnE,KAAK,IAAI,CAAC+C,aAAa,CAAC9C,IAAI;gBAAEC,KAAK,CAAC,gBAAgB,EAAEuD,cAAc;YAAC;YACzF,IAAI,CAAC3D,MAAM,CAACC,KAAK,CAAC;gBAAEC,KAAK,IAAI,CAAC+C,aAAa,CAAC9C,IAAI;gBAAEC,KAAK,GAAGC,MAAM,GAAG,EAAEO,GAAG;YAAC;YACzE,OAAO;QACT;IACF;IAEA,MAAckB,mBAAmBF,QAAuB,EAAEnC,IAAe,EAAsB;QAC7F,6DAA6D;QAC7D,IAAIA,SAAS,MAAM;YACjB,SAAS;YACTmC,SAASsD,WAAW,GAAG,IAAI,CAAClE,UAAU,CAACC,OAAO,CAACkE,qBAAqB,CAACC,IAAI,CAAC;YAC1E,MAAMC,cAAc,MAAM,IAAI,CAACC,iBAAiB,CAACC,iBAAiB,CAAC3D,UAAUA,SAAS4D,IAAI;YAC1F,MAAMC,YAAY,MAAM,IAAI,CAAC/F,YAAY,CAACgG,UAAU,CAACL,YAAYM,EAAE;YACnE,IAAI,CAACF,WAAW;gBACd,IAAI,CAACzF,MAAM,CAACC,KAAK,CAAC;oBAAEC,KAAK,IAAI,CAAC4B,kBAAkB,CAAC3B,IAAI;oBAAEC,KAAK,CAAC,qBAAqB,EAAEiF,YAAYhF,KAAK,CAAC,EAAE,EAAEgF,YAAYM,EAAE,CAAC,CAAC,CAAC;gBAAC;gBAC5H,MAAM,IAAIrF,qBAAa,CAAC,kBAAkBC,kBAAU,CAACqF,SAAS;YAChE;YACA,OAAOH;QACT;QAEA,IAAI7D,SAASvB,KAAK,KAAKZ,KAAKY,KAAK,EAAE;YACjC,IAAI,CAACL,MAAM,CAACC,KAAK,CAAC;gBAAEC,KAAK,IAAI,CAAC4B,kBAAkB,CAAC3B,IAAI;gBAAEC,KAAK,CAAC,sBAAsB,EAAEwB,SAASvB,KAAK,CAAC,KAAK,EAAEZ,KAAKY,KAAK,EAAE;YAAC;YACxH,MAAM,IAAIC,qBAAa,CAAC,0BAA0BC,kBAAU,CAACC,SAAS;QACxE;QAEA,gDAAgD;QAChD,MAAMqF,qBAAoCC,OAAOC,WAAW,CAC1D,AACE,CAAA,MAAMC,QAAQC,GAAG,CACfH,OAAOI,IAAI,CAACtE,UAAUuE,GAAG,CAAC,OAAOC;YAC/B,IAAIA,QAAQ,YAAY;gBACtB,MAAMC,SAAS,MAAMC,IAAAA,0BAAe,EAAC1E,QAAQ,CAACwE,IAAI,EAAE3G,KAAKH,QAAQ;gBACjE,OAAO+G,SAAS,OAAO;oBAACD;oBAAKxE,QAAQ,CAACwE,IAAI;iBAAC;YAC7C;YACA,OAAOxE,QAAQ,CAACwE,IAAI,KAAK3G,IAAI,CAAC2G,IAAI,GAAG;gBAACA;gBAAKxE,QAAQ,CAACwE,IAAI;aAAC,GAAG;QAC9D,GACF,EACAvC,MAAM,CAAC9C;QAGX,IAAI+E,OAAOI,IAAI,CAACL,oBAAoBzB,MAAM,GAAG,GAAG;YAC9C,IAAI;gBACF,IAAIyB,oBAAoBL,QAAQ,MAAM;oBACpC,IAAI/F,KAAK+F,IAAI,KAAKe,eAAS,CAACC,aAAa,IAAI,CAAC,IAAI,CAACxF,UAAU,CAACC,OAAO,CAACwD,UAAU,EAAE;wBAChF,6EAA6E;wBAC7E,OAAOoB,mBAAmBL,IAAI;oBAChC;gBACF;gBAEA,yBAAyB;gBACzB,MAAM,IAAI,CAACF,iBAAiB,CAACmB,iBAAiB,CAAChH,KAAKkG,EAAE,EAAEE;gBAExD,cAAc;gBACd,IAAIA,oBAAoBvG,UAAU;oBAChC,OAAOuG,mBAAmBvG,QAAQ;gBACpC;gBAEAwG,OAAOY,MAAM,CAACjH,MAAMoG;gBAEpB,IAAI,cAAcA,sBAAsB,eAAeA,oBAAoB;oBACzE,kDAAkD;oBAClDpG,KAAKkH,WAAW,CAAC;gBACnB;YACF,EAAE,OAAO/F,GAAG;gBACV,IAAI,CAACZ,MAAM,CAAC0B,IAAI,CAAC;oBAAExB,KAAK,IAAI,CAAC4B,kBAAkB,CAAC3B,IAAI;oBAAEC,KAAK,CAAC,uBAAuB,EAAEX,KAAKY,KAAK,CAAC,IAAI,EAAEO,GAAG;gBAAC;YAC5G;QACF;QACA,OAAOnB;IACT;IAEQ8E,uBAAuB7D,KAAY,EAAiB;QAC1D,qEAAqE;QACrE,KAAK,MAAMkG,QAAQzC,sCAAmB,CAAE;YACtC,IAAIyC,SAAS7B,mCAAgB,CAACC,SAAS,IAAItE,KAAK,CAACkG,KAAK,EAAE;gBACtD,MAAMC,SAAS,AAAChC,CAAAA,MAAMC,OAAO,CAACpE,KAAK,CAACkG,KAAK,IAAIlG,KAAK,CAACkG,KAAK,GAAGlG,KAAK,CAACkG,KAAK,GAAG;oBAAClG,KAAK,CAACkG,KAAK;iBAAC,GAAG,EAAE,AAAD,EAAG/C,MAAM,CACjG,CAACiD,IAAW,OAAOA,MAAM;gBAE3B,MAAMC,aAAa,IAAI9B;gBACvB,KAAK,MAAM+B,SAASH,OAAQ;oBAC1BE,WAAWE,GAAG,CAACD;oBACf,MAAME,KAAKF,MAAMG,KAAK,CAAC,sBAAsB,CAAC,EAAE,EAAEC;oBAClD,IAAIF,IAAI;wBACNH,WAAWE,GAAG,CAACC;oBACjB;gBACF;gBACAxG,KAAK,CAACkG,KAAK,GAAG/B,MAAMwC,IAAI,CAACN;gBACzB;YACF;YACA,IAAIlC,MAAMC,OAAO,CAACpE,KAAK,CAACkG,KAAK,GAAG;gBAC9B,mEAAmE;gBACnElG,KAAK,CAACkG,KAAK,GAAGlG,KAAK,CAACkG,KAAK,CAACxC,MAAM,GAAG,IAAI1D,KAAK,CAACkG,KAAK,CAAC,EAAE,GAAG;YAC1D;QACF;QACA,OAAOlG;IACT;IAEQmB,eAAenB,KAAoB,EAAEpB,QAAgB,EAAiB;QAC5E,oDAAoD;QACpD,MAAMwB,UACJ,OAAO,IAAI,CAACE,UAAU,CAACC,OAAO,CAACwD,UAAU,KAAK,YAC9C,IAAI,CAACzD,UAAU,CAACC,OAAO,CAACwD,UAAU,IAClC/D,KAAK,CAACqE,mCAAgB,CAACC,SAAS,CAAC,EAAEsC,SAAS,IAAI,CAACtG,UAAU,CAACC,OAAO,CAACwD,UAAU;QAChF,OAAO;YACLpE,OAAO,IAAI,CAACT,OAAO,CAACc,KAAK,CAAC,IAAI,CAACM,UAAU,CAACK,UAAU,CAAChB,KAAK,CAAC;YAC3DiB,OAAOZ,KAAK,CAAC,IAAI,CAACM,UAAU,CAACK,UAAU,CAACC,KAAK,CAAC;YAC9ChC,UAAUA;YACVkG,MAAM1E,UAAUyF,eAAS,CAACC,aAAa,GAAGD,eAAS,CAACgB,IAAI;YACxD,GAAG,IAAI,CAACC,uBAAuB,CAAC9G,MAAM;QACxC;IACF;IAEQ8G,wBAAwB9G,KAAoB,EAA2C;QAC7F,+DAA+D;QAC/D,kCAAkC;QAClC,IAAIA,MAAM+G,EAAE,IAAI/G,MAAMgH,SAAS,EAAE;YAC/B,OAAO;gBAAEC,WAAWjH,MAAMgH,SAAS;gBAAEE,UAAUlH,MAAM+G,EAAE;YAAC;QAC1D;QACA,0CAA0C;QAC1C,IAAI/G,MAAMmH,WAAW,IAAInH,MAAMmH,WAAW,CAACT,IAAI,IAAI;YACjD,OAAOU,IAAAA,wBAAa,EAACpH,MAAMmH,WAAW;QACxC;QACA,oBAAoB;QACpB,IAAInH,MAAMwG,EAAE,IAAIxG,MAAMwG,EAAE,CAACE,IAAI,IAAI;YAC/B,OAAOU,IAAAA,wBAAa,EAACpH,MAAMwG,EAAE;QAC/B;QACA,oBAAoB;QACpB,OAAO;YAAES,WAAW;YAAIC,UAAU;QAAG;IACvC;IAEQhI,QAAQS,KAAa,EAAU;QACrC,sDAAsD;QACtD,IAAIA,MAAMiH,QAAQ,CAAC,OAAO;YACxB,OAAOjH,MAAM0H,KAAK,CAAC,MAAMC,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE;QACvC;QACA,OAAO3H;IACT;IAEQ6B,eAAe7B,KAAa,EAAU;QAC5C,oDAAoD;QACpD,IAAI,IAAI,CAACW,UAAU,CAACK,UAAU,CAAChB,KAAK,KAAK4H,kCAAe,CAACC,GAAG,EAAE;YAC5D,IAAI,IAAI,CAAClH,UAAU,CAACmH,SAAS,IAAI,CAAC9H,MAAMiH,QAAQ,CAAC,MAAM;gBACrD,OAAO,GAAGjH,MAAM,CAAC,EAAE,IAAI,CAACW,UAAU,CAACmH,SAAS,EAAE;YAChD;QACF,OAAO,IAAI,IAAI,CAACnH,UAAU,CAACK,UAAU,CAAChB,KAAK,KAAK4H,kCAAe,CAACG,GAAG,EAAE;YACnE,IAAI,IAAI,CAACpH,UAAU,CAACqH,WAAW,IAAI,CAAChI,MAAMiH,QAAQ,CAAC,OAAO;gBACxD,OAAO,GAAG,IAAI,CAACtG,UAAU,CAACqH,WAAW,CAAC,EAAE,EAAEhI,OAAO;YACnD;QACF;QACA,OAAOA;IACT;IAEQ+B,gBAAgBH,SAAiB,EAAU;QACjD,OAAO,IAAI,CAACqG,IAAI,GAAGrG,YAAY,GAAG,IAAI,CAACjB,UAAU,CAACK,UAAU,CAAChB,KAAK,CAAC,CAAC,EAAE4B,UAAU,CAAC,EAAE,IAAI,CAACjB,UAAU,CAACgD,MAAM,EAAE;IAC7G;IAEQJ,gBAAgBvD,KAAa,EAAEkI,WAAoB,EAAU;QACnE,yDAAyD;QACzD,0EAA0E;QAC1E,6EAA6E;QAC7E,2DAA2D;QAE3D,wGAAwG;QACxG,gFAAgF;QAChF,MAAM3I,UAAU,IAAI,CAACA,OAAO,CAACS;QAE7B,MAAMmI,KAAK,IAAIC,gBAAQ,CAAC;YACtBC,SAAS,IAAI,CAACJ,IAAI,GACd;gBACE,IAAIK,sBAAc,CAAC;oBAAEC,WAAWX,kCAAe,CAACG,GAAG;oBAAEpB,OAAOpH;gBAAQ;gBACpE,IAAI+I,sBAAc,CAAC;oBAAEC,WAAWX,kCAAe,CAACC,GAAG;oBAAElB,OAAOpH;gBAAQ;gBACpE,IAAI+I,sBAAc,CAAC;oBAAEC,WAAWX,kCAAe,CAACY,IAAI;oBAAE7B,OAAOpH;gBAAQ;aACtE,GACD;gBACE,IAAI+I,sBAAc,CAAC;oBAAEC,WAAWX,kCAAe,CAACa,GAAG;oBAAE9B,OAAOpH;gBAAQ;gBACpE,IAAI+I,sBAAc,CAAC;oBAAEC,WAAWX,kCAAe,CAACc,EAAE;oBAAE/B,OAAOpH;gBAAQ;gBACnE,IAAI+I,sBAAc,CAAC;oBAAEC,WAAWX,kCAAe,CAACY,IAAI;oBAAE7B,OAAOpH;gBAAQ;aACtE;QACP;QAEA,gCAAgC;QAChC,IAAIoJ,eAAe,IAAIC,iBAAS,CAAC;YAAEP,SAAS;gBAACF;aAAG;QAAC,GAAGU,QAAQ;QAE5D,iEAAiE;QACjE,IAAIX,eAAeA,YAAYnB,IAAI,IAAI;YACrC4B,eAAe,CAAC,EAAE,EAAEA,eAAeT,YAAY,CAAC,CAAC;QACnD;QACA,OAAOS;IACT;IAEQtE,cAAchE,KAAoB,EAAE+D,UAAkB,EAAW;QACvE,+DAA+D;QAC/D,OAAOI,MAAMC,OAAO,CAACpE,KAAK,CAACqE,mCAAgB,CAACC,SAAS,CAAC,KAAKtE,KAAK,CAACqE,mCAAgB,CAACC,SAAS,CAAC,CAACsC,QAAQ,CAAC7C;IACxG;IAEA,MAAcE,uBAAuBF,UAAkB,EAAEvB,MAAc,EAAEX,MAAc,EAAoB;QACzG,2DAA2D;QAC3D,kFAAkF;QAClF,MAAM,EAAEiC,EAAE,EAAE0C,EAAE,EAAE,GAAG,IAAI,CAACiC,eAAe,CAAC1E;QACxC,yFAAyF;QACzF,MAAMiE,UAAU;YACd,IAAIC,sBAAc,CAAC;gBAAEC,WAAW3E,mCAAgB,CAACmF,YAAY;gBAAEpC,OAAO/C,mCAAgB,CAACoF,cAAc;YAAC;YACtG,IAAIV,sBAAc,CAAC;gBAAEC,WAAW3E,mCAAgB,CAACqF,MAAM;gBAAEtC,OAAO9D;YAAO;SACxE;QACD,sEAAsE;QACtE,IAAIgE,IAAI;YACNwB,QAAQa,MAAM,CAAC,GAAG,GAAG,IAAIZ,sBAAc,CAAC;gBAAEC,WAAW7D,mCAAgB,CAACgE,EAAE;gBAAE/B,OAAOE;YAAG;QACtF;QACA,MAAMrD,SAAS,IAAIoF,iBAAS,CAAC;YAAEP;QAAQ,GAAGQ,QAAQ;QAElD,IAAI;YACF,8EAA8E;YAC9E,MAAM,EAAEpF,aAAa,EAAE,GAAG,MAAMvB,OAAOwB,MAAM,CAACS,MAAM,IAAI,CAACxD,UAAU,CAACgD,MAAM,EAAE;gBAC1ExE,OAAOgF,KAAKP,mCAAgB,CAACuF,IAAI,GAAGvF,mCAAgB,CAACC,GAAG;gBACxDL;gBACAxC,YAAY;oBAAC0D,mCAAgB,CAACgE,EAAE;iBAAC;YACnC;YACA,yCAAyC;YACzC,OAAOjF,cAAcM,MAAM,GAAG;QAChC,EAAE,OAAOxD,GAAG;YACV,IAAI,CAACZ,MAAM,CAAC0B,IAAI,CAAC;gBAAExB,KAAK,IAAI,CAACyE,sBAAsB,CAACxE,IAAI;gBAAEC,KAAK,GAAGQ,GAAG;YAAC;YACtE,OAAO;QACT;IACF;IAEQuI,gBAAgB1E,UAAkB,EAAgC;QACxE,0EAA0E;QAC1E,MAAMgF,cAAchF,WAAW6C,QAAQ,CAAC,QAAQ7C,WAAW6C,QAAQ,CAAC;QACpE,IAAI,CAACmC,aAAa;YAChB,OAAO;gBAAEvC,IAAIzC;YAAW;QAC1B;QACA,MAAMyC,KAAKzC,WAAW0C,KAAK,CAAC,sBAAsB,CAAC,EAAE,EAAEC;QACvD,OAAO;YAAE5C,IAAIC;YAAYyC;QAAG;IAC9B;IAEQ9D,gBAAgBnD,KAAU,EAAE0C,eAAuB,EAAiC;QAC1F,yEAAyE;QACzE,IAAI1C,OAAOyJ,QAAQtF,QAAQ;YACzB,KAAK,MAAMuF,OAAO1J,MAAMyJ,MAAM,CAAE;gBAC9B,IAAI,CAAC1J,MAAM,CAAC0B,IAAI,CAAC;oBAAExB,KAAK,IAAI,CAACkD,eAAe,CAACjD,IAAI;oBAAEC,KAAK,GAAGuC,gBAAgB,GAAG,EAAEgH,KAAK;gBAAC;YACxF;YACA,OAAO1J,MAAMyJ,MAAM,CAACzJ,MAAMyJ,MAAM,CAACtF,MAAM,GAAG,EAAE;QAC9C;QACA,IAAI,CAACpE,MAAM,CAAC0B,IAAI,CAAC;YAAExB,KAAK,IAAI,CAACkD,eAAe,CAACjD,IAAI;YAAEC,KAAK,GAAGuC,gBAAgB,GAAG,EAAE1C,OAAO;QAAC;QACxF,OAAOA;IACT;IA3YA,YACE,AAAiBP,YAA0B,EAC3C,AAAiB4F,iBAAoC,CACrD;aAFiB5F,eAAAA;aACA4F,oBAAAA;aARFtF,SAAS,IAAI4J,cAAM,CAACzK,iBAAiBgB,IAAI;aACzCa,aAAqC6I,gCAAa,CAACC,IAAI,CAACC,IAAI;aAC5DnH,iBAAiB7B,QAAQ,IAAI,CAACC,UAAU,CAAC6B,aAAa,IAAI,IAAI,CAAC7B,UAAU,CAAC+B,mBAAmB;aAC7FuF,OAAO,IAAI,CAACtH,UAAU,CAACK,UAAU,CAAChB,KAAK,KAAK4H,kCAAe,CAACG,GAAG,IAAI,IAAI,CAACpH,UAAU,CAACK,UAAU,CAAChB,KAAK,KAAK4H,kCAAe,CAACC,GAAG;aACpIzF,gBAA+B;YAAEuH,SAAS;YAAMC,gBAAgB;YAAMvH,KAAK;QAAG;IAKnF;AAyYL"}