@synoikia/core 0.8.1 → 0.10.0

package/dist/auth/mcp-auth.js

@@ -1,11 +1,13 @@
 import { eq } from 'drizzle-orm';
-import { createRemoteJWKSet, decodeJwt, jwtVerify } from 'jose';
 import { roleHasInstance } from '../catalog/role-levels.js';
 import { users } from '../db/schema.js';
 import { ConflictError, ValidationError } from '../errors.js';
 import { getSettings } from '../settings.js';
 import { McpTokenService, TOKEN_PREFIX } from './mcp-tokens.js';
 import { ACCESS_PREFIX, canonicalResource } from './oauth.js';
+import { effectiveAuthMethods } from '../instances/manager.js';
+import { externalProvider } from './external.js';
+import { claimedIssuer } from './external-cloudflare.js';
 import { requestOrigin } from '../http/common.js';
 /** The MCP listener's public origin: PUBLIC_MCP_URL, or the request's origin where no security decision
  * depends on it (the approval link back to the same client, sign-in redirects). */
@@ -13,78 +15,13 @@ export function publicMcpBase(ctx, c) {
     return (ctx.config.PUBLIC_MCP_URL ?? requestOrigin(c, ctx.config.TRUST_PROXY)).replace(/\/+$/, '');
 }
 export const resourceUrl = (base, slug) => canonicalResource(`${base}/${slug}`);
-export function effectiveAuthMode(ctx, instanceAuthMode) {
-    return instanceAuthMode ?? getSettings(ctx.db, 'mcp').defaultAuthMode;
-}
 /** The endpoints that accept OAuth (design §6.2), with their resource URLs under `base`. */
 export function oauthEndpoints(ctx, base) {
     return ctx.instances
         .list()
-        .filter((i) => {
-        const mode = effectiveAuthMode(ctx, i.authMode);
-        return mode === 'oauth' || mode === 'bearer+oauth';
-    })
+        .filter((i) => effectiveAuthMethods(ctx.db, i.authMethods).includes('oauth'))
         .map((i) => ({ resource: resourceUrl(base, i.slug), slug: i.slug, name: i.displayName, id: i.id }));
 }
-const jwksCache = new Map();
-const MAX_CLAIM = 120;
-const clip = (v) => (v.length > MAX_CLAIM ? `${v.slice(0, MAX_CLAIM)}…` : v);
-/** A JWT's claimed issuer and audience, unverified, only to explain a rejection: strings only, clipped. */
-function claimedIssuer(token) {
-    let payload;
-    try {
-        payload = decodeJwt(token);
-    }
-    catch {
-        return null;
-    }
-    const { iss, aud } = payload;
-    const auds = (Array.isArray(aud) ? aud : [aud]).filter((a) => typeof a === 'string');
-    return {
-        iss: typeof iss === 'string' ? clip(iss) : undefined,
-        aud: auds.length ? clip(auds.join(',')) : undefined,
-    };
-}
-/** Verifies a `Cf-Access-Jwt-Assertion` (signature, issuer, audience, expiry) and returns who it names
- * or why it was rejected. `keys` replaces the team's key set (tests). */
-export async function checkCloudflareAccess(teamDomain, aud, assertion, keys) {
-    const domain = teamDomain.replace(/^https?:\/\//, '').replace(/\/+$/, '');
-    let jwks = keys ?? jwksCache.get(domain);
-    if (!jwks) {
-        const remote = createRemoteJWKSet(new URL(`https://${domain}/cdn-cgi/access/certs`));
-        jwksCache.set(domain, remote);
-        jwks = remote;
-    }
-    const issuer = `https://${domain}`;
-    try {
-        const { payload } = await jwtVerify(assertion, jwks, { issuer, audience: aud });
-        // A service token's assertion has an empty `sub` and names the token's client ID in `common_name`.
-        // An email must contain `@`, so it can't pose as a service token; one that names nobody is refused.
-        const named = (v) => (typeof v === 'string' && v ? v : undefined);
-        const email = named(payload.email);
-        const service = named(payload.common_name);
-        const who = (email?.includes('@') ? email : undefined) ?? (service && `service:${service}`) ?? named(payload.sub);
-        return who
-            ? { ok: true, who }
-            : { ok: false, reason: 'valid assertion that names nobody (no email, common_name or sub)' };
-    }
-    catch (err) {
-        const why = err instanceof Error ? err.message : String(err);
-        const claimed = claimedIssuer(assertion);
-        if (!claimed)
-            return { ok: false, reason: `${why} (not a JWT)` };
-        // The AUD tag and team domain are not secrets: every assertion Access issues carries them.
-        return {
-            ok: false,
-            reason: `${why} (assertion iss=${claimed.iss ?? '-'} aud=${claimed.aud ?? '-'}; expected iss=${issuer} aud=${aud})`,
-        };
-    }
-}
-/** {@link checkCloudflareAccess}, returning who the assertion names, or null. */
-export async function verifyCloudflareAccess(teamDomain, aud, assertion, keys) {
-    const result = await checkCloudflareAccess(teamDomain, aud, assertion, keys);
-    return result.ok ? result.who : null;
-}
 /** What kind of bearer token this is, for the log: never any part of its value. */
 function describeToken(token) {
     if (token.startsWith(TOKEN_PREFIX))
@@ -112,7 +49,7 @@ function owned(ctx, base, userId, instanceId) {
         return refuse(403, 'insufficient_scope', 'This endpoint is not available to your role', `${base.label}: role of ${user.username} does not include this endpoint`);
     return { ok: true, identity: { ...base, userId: user.id, roleId: user.roleId } };
 }
-/** A user named by the proxy: matched by username, else registered with the default role (design §6.5). */
+/** A user named by the external provider: matched by username, else registered with the default role (design §6.5). */
 async function externalUser(ctx, name) {
     const found = ctx.users.byExternalIdentity(name);
     if (found)
@@ -147,53 +84,49 @@ export function principalLive(ctx, principal, instanceId) {
     return true;
 }
 const unknownUser = (base) => refuse(403, 'forbidden', 'No account matches this identity', `${base.label}: no user has that username and self-registration is off or the name is not a valid username`);
-export async function authenticateMcp(ctx, oauth, c, instance) {
-    const mode = effectiveAuthMode(ctx, instance.authMode);
+/** The configured external provider names the caller, who must match an enabled user (design §6.2, §6.5). */
+async function authenticateExternal(ctx, c, instanceId) {
     const settings = getSettings(ctx.db, 'mcp');
-    if (mode === 'external') {
-        const { teamDomain, aud } = settings.cfAccess;
-        if (teamDomain && aud) {
-            const assertion = c.req.header('cf-access-jwt-assertion');
-            const checked = assertion ? await checkCloudflareAccess(teamDomain, aud, assertion) : null;
-            if (!checked?.ok)
-                return {
-                    ok: false,
-                    status: 401,
-                    error: 'unauthorized',
-                    message: 'Cloudflare Access assertion missing or invalid',
-                    detail: checked
-                        ? `Cloudflare Access assertion rejected: ${checked.reason}`
-                        : 'no Cf-Access-Jwt-Assertion header: the request did not come through the Cloudflare Access application',
-                };
-            const who = checked.who;
-            const base = { kind: 'external', principal: `cf:${who}`, label: `external:${who}`, access: 'write' };
-            const userId = await externalUser(ctx, who);
-            if (!userId)
-                return unknownUser(base);
-            return owned(ctx, base, userId, instance.id);
-        }
-        const header = settings.trustedIdentityHeader;
-        const named = header && c.req.header(header)?.trim().slice(0, 200);
-        if (named) {
-            const base = {
-                kind: 'external',
-                principal: `ext:${named}`,
-                label: `external:${named}`,
-                access: 'write',
-            };
-            const userId = await externalUser(ctx, named);
-            if (!userId)
-                return unknownUser(base);
-            return owned(ctx, base, userId, instance.id);
-        }
-        // Every call belongs to a user (design §6.4): a caller the proxy didn't name is refused.
-        return refuse(401, 'unauthorized', 'The proxy did not identify the caller', header
-            ? `no ${header} header and no Cloudflare Access assertion: anonymous callers are refused`
-            : 'external mode without Cloudflare Access or a trusted identity header: anonymous callers are refused');
+    const provider = externalProvider(settings);
+    if (!provider.configured(settings))
+        return refuse(401, 'unauthorized', 'Authentication required', `${provider.name} is not configured`);
+    const found = await provider.identify(c.req.raw.headers, settings);
+    // Every call belongs to a user (design §6.4): a caller the provider didn't name is refused.
+    if (!found.ok)
+        return refuse(401, 'unauthorized', `${provider.name} did not identify the caller`, found.reason);
+    const who = found.identity;
+    const base = {
+        kind: 'external',
+        principal: `${provider.id}:${who}`,
+        label: `external:${who}`,
+        access: 'write',
+    };
+    const userId = await externalUser(ctx, who);
+    if (!userId)
+        return unknownUser(base);
+    return owned(ctx, base, userId, instanceId);
+}
+export async function authenticateMcp(ctx, oauth, c, instance) {
+    const methods = effectiveAuthMethods(ctx.db, instance.authMethods);
+    const auth = c.req.header('authorization');
+    if (!methods.length) {
+        const detail = 'no client auth method is both enabled globally and allowed on this endpoint';
+        const held = auth?.match(/^Bearer\s+(\S+)$/i)?.[1];
+        // Only a live credential learns why; anyone else gets the answer of an unknown slug.
+        if (held && (ctx.tokens.verify(held) || oauth.verifyAccess(held, '')))
+            return refuse(403, 'forbidden', 'This endpoint accepts no client auth method', detail);
+        return {
+            ok: false,
+            status: 401,
+            error: 'unauthorized',
+            message: 'Authentication required',
+            wwwAuthenticate: 'Bearer',
+            detail,
+        };
     }
-    const allowBearer = mode === 'bearer' || mode === 'bearer+oauth';
+    const allowBearer = methods.includes('bearer');
     // OAuth is off until PUBLIC_MCP_URL is set: its discovery documents must not come from the Host header.
-    const allowOauth = (mode === 'oauth' || mode === 'bearer+oauth') && !!ctx.config.PUBLIC_MCP_URL;
+    const allowOauth = methods.includes('oauth') && !!ctx.config.PUBLIC_MCP_URL;
     const base = publicMcpBase(ctx, c);
     const challenge = (error) => {
         const params = [];
@@ -203,13 +136,21 @@ export async function authenticateMcp(ctx, oauth, c, instance) {
             params.push(`error="${error}"`);
         return params.length ? `Bearer ${params.join(', ')}` : 'Bearer';
     };
-    // A proxy that authenticated the caller is the usual reason a client sends what this mode can't use.
-    const hint = c.req.header('cf-access-jwt-assertion')
-        ? '; the request carries a Cloudflare Access assertion: set the endpoint to External auth to accept it'
+    // A proxy that authenticated the caller is the usual reason a client sends what these methods can't use.
+    const hint = c.req.header('cf-access-jwt-assertion') && !methods.includes('external')
+        ? '; the request carries a Cloudflare Access assertion: enable External client auth for this endpoint to accept it'
         : '';
-    const oauthOff = (mode === 'oauth' || mode === 'bearer+oauth') && !allowOauth ? '; OAuth is off until PUBLIC_MCP_URL is set' : '';
-    const auth = c.req.header('authorization');
+    const oauthOff = methods.includes('oauth') && !allowOauth ? '; OAuth is off until PUBLIC_MCP_URL is set' : '';
+    const accepted = methods.join(', ');
     const token = auth?.match(/^Bearer\s+(\S+)$/i)?.[1];
+    let externalWhy = '';
+    if (!token && methods.includes('external')) {
+        const result = await authenticateExternal(ctx, c, instance.id);
+        // Unnamed, an endpoint that also takes tokens answers with the bearer challenge, so OAuth can start.
+        if (result.ok || result.status === 403 || !(allowBearer || methods.includes('oauth')))
+            return result;
+        externalWhy = `; ${result.detail}`;
+    }
     if (!token)
         return {
             ok: false,
@@ -217,7 +158,7 @@ export async function authenticateMcp(ctx, oauth, c, instance) {
             error: 'unauthorized',
             message: 'Authentication required',
             wwwAuthenticate: challenge(),
-            detail: `${auth ? 'Authorization header is not a bearer token' : 'no Authorization header'}${oauthOff}${hint}`,
+            detail: `${auth ? 'Authorization header is not a bearer token' : 'no Authorization header'}${externalWhy}${oauthOff}${hint}`,
         };
     if (allowBearer && token.startsWith(TOKEN_PREFIX)) {
         const row = ctx.tokens.verify(token);
@@ -274,7 +215,7 @@ export async function authenticateMcp(ctx, oauth, c, instance) {
         error: 'invalid_token',
         message: 'This endpoint does not accept that kind of token',
         wwwAuthenticate: challenge('invalid_token'),
-        detail: `got ${describeToken(token)}, which ${mode} auth does not accept${oauthOff}${hint}`,
+        detail: `got ${describeToken(token)}, which this endpoint's methods (${accepted}) do not accept${oauthOff}${hint}`,
     };
 }
 //# sourceMappingURL=mcp-auth.js.map

package/dist/auth/mcp-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-auth.js","sourceRoot":"","sources":["../../src/auth/mcp-auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAGhE,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAI9D,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AA+BlD;mFACmF;AACnF,MAAM,UAAU,aAAa,CAAC,GAAe,EAAE,CAAU;IACvD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,IAAI,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACrG,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,IAAY,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;AAEhG,MAAM,UAAU,iBAAiB,CAAC,GAAe,EAAE,gBAA+B;IAChF,OAAQ,gBAAoC,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,eAAe,CAAC;AAC7F,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,cAAc,CAAC,GAAe,EAAE,IAAY;IAC1D,OAAO,GAAG,CAAC,SAAS;SACjB,IAAI,EAAE;SACN,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACZ,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;QAChD,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,cAAc,CAAC;IACrD,CAAC,CAAC;SACD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AACxG,CAAC;AAED,MAAM,SAAS,GAAG,IAAI,GAAG,EAAiD,CAAC;AAE3E,MAAM,SAAS,GAAG,GAAG,CAAC;AACtB,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAErF,2GAA2G;AAC3G,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;IAC7B,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IAClG,OAAO;QACL,GAAG,EAAE,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;QACpD,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;KACpD,CAAC;AACJ,CAAC;AAED;yEACyE;AACzE,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,UAAkB,EAClB,GAAW,EACX,SAAiB,EACjB,IAAsB;IAEtB,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1E,IAAI,IAAI,GAAG,IAAI,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,WAAW,MAAM,uBAAuB,CAAC,CAAC,CAAC;QACrF,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC9B,IAAI,GAAG,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,MAAM,EAAE,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;QAChF,mGAAmG;QACnG,oGAAoG;QACpG,MAAM,KAAK,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC3E,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,IAAI,WAAW,OAAO,EAAE,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClH,OAAO,GAAG;YACR,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE;YACnB,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kEAAkE,EAAE,CAAC;IAChG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,cAAc,EAAE,CAAC;QACjE,2FAA2F;QAC3F,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG,GAAG,mBAAmB,OAAO,CAAC,GAAG,IAAI,GAAG,QAAQ,OAAO,CAAC,GAAG,IAAI,GAAG,kBAAkB,MAAM,QAAQ,GAAG,GAAG;SACpH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,UAAkB,EAClB,GAAW,EACX,SAAiB,EACjB,IAAsB;IAEtB,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAC7E,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACvC,CAAC;AAED,mFAAmF;AACnF,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,yBAAyB,CAAC;IACrE,IAAI,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC;QAAE,OAAO,+BAA+B,CAAC;IAC5E,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,OAAO;QAAE,OAAO,kCAAkC,OAAO,CAAC,GAAG,IAAI,GAAG,GAAG,CAAC;IAC5E,OAAO,mCAAmC,CAAC;AAC7C,CAAC;AAID,MAAM,MAAM,GAAG,CAAC,MAAiB,EAAE,KAAa,EAAE,OAAe,EAAE,MAAc,EAAiB,EAAE,CAAC,CAAC;IACpG,EAAE,EAAE,KAAK;IACT,MAAM;IACN,KAAK;IACL,OAAO;IACP,MAAM;CACP,CAAC,CAAC;AAEH,mGAAmG;AACnG,SAAS,KAAK,CAAC,GAAe,EAAE,IAAa,EAAE,MAAiC,EAAE,UAAkB;IAClG,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAChG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ;QACxB,OAAO,MAAM,CACX,GAAG,EACH,WAAW,EACX,gDAAgD,EAChD,GAAG,IAAI,CAAC,KAAK,oBAAoB,CAClC,CAAC;IACJ,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC;QACnD,OAAO,MAAM,CACX,GAAG,EACH,oBAAoB,EACpB,6CAA6C,EAC7C,GAAG,IAAI,CAAC,KAAK,aAAa,IAAI,CAAC,QAAQ,iCAAiC,CACzE,CAAC;IACJ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;AACnF,CAAC;AAED,2GAA2G;AAC3G,KAAK,UAAU,YAAY,CAAC,GAAe,EAAE,IAAY;IACvD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACjD,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC,EAAE,CAAC;IAC3B,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,gBAAgB,EAAE;QAAE,OAAO,SAAS,CAAC;IACpD,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,mGAAmG;QACnG,2BAA2B;QAC3B,IAAI,GAAG,YAAY,aAAa;YAAE,OAAO,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QAChF,IAAI,GAAG,YAAY,eAAe;YAAE,OAAO,SAAS,CAAC;QACrD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,SAAS,CAAC,GAAe,EAAE,QAAqB,EAAE,UAAkB;IAClF,MAAM,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IACpF,OAAO,CACL,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAChH,CAAC;AACJ,CAAC;AAED;sFACsF;AACtF,MAAM,UAAU,aAAa,CAAC,GAAe,EAAE,SAAiB,EAAE,UAAkB;IAClF,IAAI,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,CAAC;IAC5G,IAAI,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,CAAC;IAChH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,IAAa,EAAE,EAAE,CACpC,MAAM,CACJ,GAAG,EACH,WAAW,EACX,kCAAkC,EAClC,GAAG,IAAI,CAAC,KAAK,8FAA8F,CAC5G,CAAC;AAEJ,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAe,EACf,KAAmB,EACnB,CAAU,EACV,QAA+D;IAE/D,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAE5C,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC;QAC9C,IAAI,UAAU,IAAI,GAAG,EAAE,CAAC;YACtB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC;YAC1D,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,qBAAqB,CAAC,UAAU,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC3F,IAAI,CAAC,OAAO,EAAE,EAAE;gBACd,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,GAAG;oBACX,KAAK,EAAE,cAAc;oBACrB,OAAO,EAAE,gDAAgD;oBACzD,MAAM,EAAE,OAAO;wBACb,CAAC,CAAC,yCAAyC,OAAO,CAAC,MAAM,EAAE;wBAC3D,CAAC,CAAC,uGAAuG;iBAC5G,CAAC;YACJ,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;YACxB,MAAM,IAAI,GAAY,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,EAAE,EAAE,KAAK,EAAE,YAAY,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YAC9G,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC5C,IAAI,CAAC,MAAM;gBAAE,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;YACtC,OAAO,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,qBAAqB,CAAC;QAC9C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACnE,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,IAAI,GAAY;gBACpB,IAAI,EAAE,UAAU;gBAChB,SAAS,EAAE,OAAO,KAAK,EAAE;gBACzB,KAAK,EAAE,YAAY,KAAK,EAAE;gBAC1B,MAAM,EAAE,OAAO;aAChB,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,IAAI,CAAC,MAAM;gBAAE,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;YACtC,OAAO,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC/C,CAAC;QACD,yFAAyF;QACzF,OAAO,MAAM,CACX,GAAG,EACH,cAAc,EACd,uCAAuC,EACvC,MAAM;YACJ,CAAC,CAAC,MAAM,MAAM,2EAA2E;YACzF,CAAC,CAAC,qGAAqG,CAC1G,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,cAAc,CAAC;IACjE,wGAAwG;IACxG,MAAM,UAAU,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,cAAc,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC;IAChG,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,CAAC,KAAc,EAAE,EAAE;QACnC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,UAAU;YAAE,MAAM,CAAC,IAAI,CAAC,sBAAsB,IAAI,yCAAyC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC;QACjH,IAAI,KAAK;YAAE,MAAM,CAAC,IAAI,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC;QAC3C,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;IAClE,CAAC,CAAC;IAEF,qGAAqG;IACrG,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,yBAAyB,CAAC;QAClD,CAAC,CAAC,qGAAqG;QACvG,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,QAAQ,GACZ,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,4CAA4C,CAAC,CAAC,CAAC,EAAE,CAAC;IAEnH,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACpD,IAAI,CAAC,KAAK;QACR,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,KAAK,EAAE,cAAc;YACrB,OAAO,EAAE,yBAAyB;YAClC,eAAe,EAAE,SAAS,EAAE;YAC5B,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,4CAA4C,CAAC,CAAC,CAAC,yBAAyB,GAAG,QAAQ,GAAG,IAAI,EAAE;SAC/G,CAAC;IAEJ,IAAI,WAAW,IAAI,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG;YACN,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,GAAG;gBACX,KAAK,EAAE,eAAe;gBACtB,OAAO,EAAE,0BAA0B;gBACnC,eAAe,EAAE,SAAS,CAAC,eAAe,CAAC;gBAC3C,MAAM,EAAE,6CAA6C;aACtD,CAAC;QACJ,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YAC/C,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,GAAG;gBACX,KAAK,EAAE,oBAAoB;gBAC3B,OAAO,EAAE,2CAA2C;gBACpD,MAAM,EAAE,iBAAiB,GAAG,CAAC,IAAI,kCAAkC;aACpE,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CACV,GAAG,EACH,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,GAAG,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAC/F,GAAG,CAAC,SAAS,EACb,QAAQ,CAAC,EAAE,CACZ,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,IAAI,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAClD,MAAM,KAAK,GAAG,KAAK,CAAC,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK;YACR,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,GAAG;gBACX,KAAK,EAAE,eAAe;gBACtB,OAAO,EAAE,0BAA0B;gBACnC,eAAe,EAAE,SAAS,CAAC,eAAe,CAAC;gBAC3C,MAAM,EAAE,mDAAmD;aAC5D,CAAC;QACJ,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;YACtB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,GAAG;gBACX,KAAK,EAAE,oBAAoB;gBAC3B,OAAO,EAAE,8CAA8C;gBACvD,MAAM,EAAE,0BAA0B,KAAK,CAAC,MAAM,CAAC,IAAI,kCAAkC;aACtF,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CACV,GAAG,EACH;YACE,IAAI,EAAE,OAAO;YACb,SAAS,EAAE,SAAS,KAAK,CAAC,OAAO,EAAE;YACnC,KAAK,EAAE,SAAS,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,QAAQ,GAAG;YAC5D,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,EACD,KAAK,CAAC,IAAI,CAAC,EAAE,EACb,QAAQ,CAAC,EAAE,CACZ,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,GAAG;QACX,KAAK,EAAE,eAAe;QACtB,OAAO,EAAE,kDAAkD;QAC3D,eAAe,EAAE,SAAS,CAAC,eAAe,CAAC;QAC3C,MAAM,EAAE,OAAO,aAAa,CAAC,KAAK,CAAC,WAAW,IAAI,wBAAwB,QAAQ,GAAG,IAAI,EAAE;KAC5F,CAAC;AACJ,CAAC"}
+{"version":3,"file":"mcp-auth.js","sourceRoot":"","sources":["../../src/auth/mcp-auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAG9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AA+BlD;mFACmF;AACnF,MAAM,UAAU,aAAa,CAAC,GAAe,EAAE,CAAU;IACvD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,IAAI,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACrG,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,IAAY,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;AAEhG,4FAA4F;AAC5F,MAAM,UAAU,cAAc,CAAC,GAAe,EAAE,IAAY;IAC1D,OAAO,GAAG,CAAC,SAAS;SACjB,IAAI,EAAE;SACN,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;SAC5E,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AACxG,CAAC;AAED,mFAAmF;AACnF,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,yBAAyB,CAAC;IACrE,IAAI,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC;QAAE,OAAO,+BAA+B,CAAC;IAC5E,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,OAAO;QAAE,OAAO,kCAAkC,OAAO,CAAC,GAAG,IAAI,GAAG,GAAG,CAAC;IAC5E,OAAO,mCAAmC,CAAC;AAC7C,CAAC;AAID,MAAM,MAAM,GAAG,CAAC,MAAiB,EAAE,KAAa,EAAE,OAAe,EAAE,MAAc,EAAiB,EAAE,CAAC,CAAC;IACpG,EAAE,EAAE,KAAK;IACT,MAAM;IACN,KAAK;IACL,OAAO;IACP,MAAM;CACP,CAAC,CAAC;AAEH,mGAAmG;AACnG,SAAS,KAAK,CAAC,GAAe,EAAE,IAAa,EAAE,MAAiC,EAAE,UAAkB;IAClG,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAChG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ;QACxB,OAAO,MAAM,CACX,GAAG,EACH,WAAW,EACX,gDAAgD,EAChD,GAAG,IAAI,CAAC,KAAK,oBAAoB,CAClC,CAAC;IACJ,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC;QACnD,OAAO,MAAM,CACX,GAAG,EACH,oBAAoB,EACpB,6CAA6C,EAC7C,GAAG,IAAI,CAAC,KAAK,aAAa,IAAI,CAAC,QAAQ,iCAAiC,CACzE,CAAC;IACJ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;AACnF,CAAC;AAED,uHAAuH;AACvH,KAAK,UAAU,YAAY,CAAC,GAAe,EAAE,IAAY;IACvD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACjD,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC,EAAE,CAAC;IAC3B,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,gBAAgB,EAAE;QAAE,OAAO,SAAS,CAAC;IACpD,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,mGAAmG;QACnG,2BAA2B;QAC3B,IAAI,GAAG,YAAY,aAAa;YAAE,OAAO,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QAChF,IAAI,GAAG,YAAY,eAAe;YAAE,OAAO,SAAS,CAAC;QACrD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,SAAS,CAAC,GAAe,EAAE,QAAqB,EAAE,UAAkB;IAClF,MAAM,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IACpF,OAAO,CACL,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAChH,CAAC;AACJ,CAAC;AAED;sFACsF;AACtF,MAAM,UAAU,aAAa,CAAC,GAAe,EAAE,SAAiB,EAAE,UAAkB;IAClF,IAAI,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,CAAC;IAC5G,IAAI,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,CAAC;IAChH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,IAAa,EAAE,EAAE,CACpC,MAAM,CACJ,GAAG,EACH,WAAW,EACX,kCAAkC,EAClC,GAAG,IAAI,CAAC,KAAK,8FAA8F,CAC5G,CAAC;AAEJ,6GAA6G;AAC7G,KAAK,UAAU,oBAAoB,CAAC,GAAe,EAAE,CAAU,EAAE,UAAkB;IACjF,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC;QAChC,OAAO,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,yBAAyB,EAAE,GAAG,QAAQ,CAAC,IAAI,oBAAoB,CAAC,CAAC;IACtG,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACnE,4FAA4F;IAC5F,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,GAAG,QAAQ,CAAC,IAAI,8BAA8B,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAChH,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC;IAC3B,MAAM,IAAI,GAAY;QACpB,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,GAAG,QAAQ,CAAC,EAAE,IAAI,GAAG,EAAE;QAClC,KAAK,EAAE,YAAY,GAAG,EAAE;QACxB,MAAM,EAAE,OAAO;KAChB,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM;QAAE,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;IACtC,OAAO,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAe,EACf,KAAmB,EACnB,CAAU,EACV,QAA4D;IAE5D,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IACnE,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAE3C,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,6EAA6E,CAAC;QAC7F,MAAM,IAAI,GAAG,IAAI,EAAE,KAAK,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACnD,qFAAqF;QACrF,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACnE,OAAO,MAAM,CAAC,GAAG,EAAE,WAAW,EAAE,6CAA6C,EAAE,MAAM,CAAC,CAAC;QACzF,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,KAAK,EAAE,cAAc;YACrB,OAAO,EAAE,yBAAyB;YAClC,eAAe,EAAE,QAAQ;YACzB,MAAM;SACP,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC/C,wGAAwG;IACxG,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC;IAC5E,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,CAAC,KAAc,EAAE,EAAE;QACnC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,UAAU;YAAE,MAAM,CAAC,IAAI,CAAC,sBAAsB,IAAI,yCAAyC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC;QACjH,IAAI,KAAK;YAAE,MAAM,CAAC,IAAI,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC;QAC3C,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;IAClE,CAAC,CAAC;IAEF,yGAAyG;IACzG,MAAM,IAAI,GACR,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;QACtE,CAAC,CAAC,iHAAiH;QACnH,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,4CAA4C,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9G,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEpC,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACpD,IAAI,WAAW,GAAG,EAAE,CAAC;IACrB,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC/D,qGAAqG;QACrG,IAAI,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,WAAW,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAAE,OAAO,MAAM,CAAC;QACrG,WAAW,GAAG,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;IACrC,CAAC;IACD,IAAI,CAAC,KAAK;QACR,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,KAAK,EAAE,cAAc;YACrB,OAAO,EAAE,yBAAyB;YAClC,eAAe,EAAE,SAAS,EAAE;YAC5B,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,4CAA4C,CAAC,CAAC,CAAC,yBAAyB,GAAG,WAAW,GAAG,QAAQ,GAAG,IAAI,EAAE;SAC7H,CAAC;IAEJ,IAAI,WAAW,IAAI,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG;YACN,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,GAAG;gBACX,KAAK,EAAE,eAAe;gBACtB,OAAO,EAAE,0BAA0B;gBACnC,eAAe,EAAE,SAAS,CAAC,eAAe,CAAC;gBAC3C,MAAM,EAAE,6CAA6C;aACtD,CAAC;QACJ,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YAC/C,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,GAAG;gBACX,KAAK,EAAE,oBAAoB;gBAC3B,OAAO,EAAE,2CAA2C;gBACpD,MAAM,EAAE,iBAAiB,GAAG,CAAC,IAAI,kCAAkC;aACpE,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CACV,GAAG,EACH,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,GAAG,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAC/F,GAAG,CAAC,SAAS,EACb,QAAQ,CAAC,EAAE,CACZ,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,IAAI,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAClD,MAAM,KAAK,GAAG,KAAK,CAAC,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK;YACR,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,GAAG;gBACX,KAAK,EAAE,eAAe;gBACtB,OAAO,EAAE,0BAA0B;gBACnC,eAAe,EAAE,SAAS,CAAC,eAAe,CAAC;gBAC3C,MAAM,EAAE,mDAAmD;aAC5D,CAAC;QACJ,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;YACtB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,GAAG;gBACX,KAAK,EAAE,oBAAoB;gBAC3B,OAAO,EAAE,8CAA8C;gBACvD,MAAM,EAAE,0BAA0B,KAAK,CAAC,MAAM,CAAC,IAAI,kCAAkC;aACtF,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CACV,GAAG,EACH;YACE,IAAI,EAAE,OAAO;YACb,SAAS,EAAE,SAAS,KAAK,CAAC,OAAO,EAAE;YACnC,KAAK,EAAE,SAAS,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,QAAQ,GAAG;YAC5D,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,EACD,KAAK,CAAC,IAAI,CAAC,EAAE,EACb,QAAQ,CAAC,EAAE,CACZ,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,GAAG;QACX,KAAK,EAAE,eAAe;QACtB,OAAO,EAAE,kDAAkD;QAC3D,eAAe,EAAE,SAAS,CAAC,eAAe,CAAC;QAC3C,MAAM,EAAE,OAAO,aAAa,CAAC,KAAK,CAAC,oCAAoC,QAAQ,kBAAkB,QAAQ,GAAG,IAAI,EAAE;KACnH,CAAC;AACJ,CAAC"}

package/dist/auth/oauth.d.ts

@@ -147,7 +147,7 @@ export declare class OAuthService {
             lastLoginAt: Date | null;
             disabled: boolean;
             roleId: string;
-            registeredVia: "oidc" | "external" | "signup" | null;
+            registeredVia: "external" | "oidc" | "signup" | null;
         };
         grantId: string;
         access: "read" | "write";

package/dist/auth/oidc.d.ts

@@ -9,7 +9,7 @@ declare const OidcSettingsSchema: z.ZodObject<{
     scopes: z.ZodDefault<z.ZodString>;
     label: z.ZodDefault<z.ZodString>;
     allowPolicy: z.ZodPrefault<z.ZodObject<{
-        emails: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        emails: z.ZodDefault<z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>]>>>;
         subjects: z.ZodDefault<z.ZodArray<z.ZodString>>;
         group: z.ZodDefault<z.ZodString>;
         groupsClaim: z.ZodDefault<z.ZodString>;

package/dist/auth/oidc.js

@@ -8,9 +8,15 @@ import { ServiceError, ValidationError } from '../errors.js';
 import { signPayload, verifyPayload } from './tokens.js';
 /** Optional OIDC sign-in (design §6.1): code + PKCE, state and nonce; the identity must pass the allow
  * policy and be linked unless auto-provisioning. Used by the admin and MCP-port logins. */
+/** `*@example.com`: any verified address in that exact domain, never its subdomains. */
+const DomainEntrySchema = z
+    .string()
+    .regex(/^\*@(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i, 'Invalid domain entry')
+    .transform((e) => e.toLowerCase());
 const AllowPolicySchema = z
     .object({
-    emails: z.array(z.string().email()).default([]),
+    /** Exact addresses or `*@domain` entries. */
+    emails: z.array(z.union([z.string().email(), DomainEntrySchema])).default([]),
     subjects: z.array(z.string().min(1)).default([]),
     /** Required value in the groups claim (`groupsClaim`, default `groups`). */
     group: z.string().default(''),
@@ -27,6 +33,14 @@ const OidcSettingsSchema = z.object({
     autoProvision: z.boolean().default(false),
 });
 const STATE_TTL_MS = 10 * 60_000;
+function emailAllowed(entries, email) {
+    const address = email.toLowerCase();
+    const domain = address.slice(address.lastIndexOf('@') + 1);
+    return entries.some((e) => {
+        const entry = e.toLowerCase();
+        return entry.startsWith('*@') ? entry.slice(2) === domain : entry === address;
+    });
+}
 const policyIsEmpty = (p) => !p.emails.length && !p.subjects.length && !p.group;
 class OidcError extends ServiceError {
     constructor(code, message) {
@@ -186,7 +200,7 @@ export class OidcService {
             return true; // linking alone decides
         if (policy.subjects.includes(identity.subject))
             return true;
-        if (identity.email && policy.emails.map((e) => e.toLowerCase()).includes(identity.email.toLowerCase()))
+        if (identity.email && emailAllowed(policy.emails, identity.email))
             return true;
         if (policy.group && identity.groups.includes(policy.group))
             return true;

package/dist/auth/oidc.js.map

@@ -1 +1 @@
-{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../../src/auth/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AAGzC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAGzD;2FAC2F;AAE3F,MAAM,iBAAiB,GAAG,CAAC;KACxB,MAAM,CAAC;IACN,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/C,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAChD,4EAA4E;IAC5E,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;CAC1C,CAAC;KACD,QAAQ,CAAC,EAAE,CAAC,CAAC;AAEhB,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE;IACf,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,sBAAsB,CAAC;IAClD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAChC,WAAW,EAAE,iBAAiB;IAC9B,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CAC1C,CAAC,CAAC;AAuBH,MAAM,YAAY,GAAG,EAAE,GAAG,MAAM,CAAC;AACjC,MAAM,aAAa,GAAG,CAAC,CAA8B,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;AAE7G,MAAM,SAAU,SAAQ,YAAY;IAClC,YAAY,IAAY,EAAE,OAAe;QACvC,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5B,CAAC;CACF;AAED,MAAM,OAAO,WAAW;IAIH;IACA;IACA;IAEA;IAPX,MAAM,CAA+C;IAE7D,YACmB,EAAM,EACN,GAAc,EACd,QAAgB;IACjC,gEAAgE;IAC/C,gBAAgB,KAAK;QAJrB,OAAE,GAAF,EAAE,CAAI;QACN,QAAG,GAAH,GAAG,CAAW;QACd,aAAQ,GAAR,QAAQ,CAAQ;QAEhB,kBAAa,GAAb,aAAa,CAAQ;IACrC,CAAC;IAEI,GAAG;QACT,OAAO,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IAC7E,CAAC;IAED,WAAW;QACT,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,OAAO;YACL,GAAG,kBAAkB,CAAC,KAAK,CAAC;gBAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE;gBAClC,aAAa,EAAE,GAAG,CAAC,aAAa;gBAChC,KAAK,EAAG,GAAG,CAAC,WAAyC,EAAE,KAAK,IAAI,KAAK;aACtE,CAAC;YACF,eAAe,EAAE,CAAC,CAAC,GAAG,CAAC,eAAe;SACvC,CAAC;IACJ,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,WAAW,EAAE,EAAE,OAAO,KAAK,IAAI,CAAC;IAC9C,CAAC;IAED,kGAAkG;IAClG,cAAc,CAAC,KAA+D,EAAE,QAA6B,EAAE;QAC7G,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,eAAe,CACvB,cAAc,EACd,uBAAuB,EACvB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CACpE,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,CAAC,aAAa,IAAI,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,eAAe,CACvB,iBAAiB,EACjB,uEAAuE,CACxE,CAAC;QACJ,CAAC;QACD,IAAI,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,eAAe,IAAI,IAAI,CAAC;QAC1D,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI;YAAE,eAAe,GAAG,IAAI,CAAC;aACnD,IAAI,KAAK,CAAC,YAAY;YACzB,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,CAAC,aAAa,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAC,CAAC;QACvG,MAAM,MAAM,GAAG;YACb,EAAE,EAAE,CAAC;YACL,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,eAAe;YACf,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;YACjD,aAAa,EAAE,CAAC,CAAC,aAAa;YAC9B,OAAO,EAAE,CAAC,CAAC,OAAO;SACnB,CAAC;QACF,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;YACtG,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,uBAAuB;gBACjC,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,KAAK,CAAC,MAAM;gBACrB,MAAM,EAAE,EAAE,GAAG,CAAC,EAAE,mBAAmB,EAAE,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE;aACxE,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QACxB,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,aAAa;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,EAAE,OAAO;YAAE,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,6BAA6B,CAAC,CAAC;QACvF,MAAM,MAAM,GAAG,GAAG,CAAC,eAAe;YAChC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,aAAa,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YACtG,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,IAAI,MAAM,IAAI,EAAE,EAAE,CAAC;QAC5D,IAAI,IAAI,CAAC,MAAM,EAAE,GAAG,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QACxD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CACjC,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EACnB,GAAG,CAAC,QAAQ,EACZ,MAAM,EACN,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,EACpD,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAC3E,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,mGAAmG;IACnG,KAAK,CAAC,KAAK,CAAC,KAAwF;QAClG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAG,CAAC;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAc;YACvB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ;YACR,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE;YACzB,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE;YACzB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE;YAC7C,YAAY,EAAE,KAAK,CAAC,WAAW;YAC/B,KAAK,EAAE,QAAQ,CAAC,MAAM;YACtB,cAAc,EAAE,MAAM,IAAI,CAAC,0BAA0B,CAAC,QAAQ,CAAC;YAC/D,qBAAqB,EAAE,MAAM;YAC7B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC,CAAC;QACH,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,WAAW,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,YAAY,CAAC,EAAE,CAAC;IAC9F,CAAC;IAED,0GAA0G;IAC1G,KAAK,CAAC,QAAQ,CACZ,WAAgB,EAChB,UAA8B;QAE9B,MAAM,KAAK,GAAG,aAAa,CAAY,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAClE,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,SAAS,CAAC,YAAY,EAAE,+CAA+C,CAAC,CAAC;QAC/F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC1C,IAAI,MAAgC,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE,WAAW,EAAE;gBACpE,gBAAgB,EAAE,KAAK,CAAC,QAAQ;gBAChC,aAAa,EAAE,KAAK,CAAC,KAAK;gBAC1B,aAAa,EAAE,KAAK,CAAC,KAAK;gBAC1B,eAAe,EAAE,IAAI;aACtB,CAAC,CAAC;YACH,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,mBAAmB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5G,CAAC;QACD,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,4CAA4C,CAAC,CAAC;QAC9F,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAG,CAAC;QACrC,MAAM,SAAS,GAAI,MAAkC,CAAC,QAAQ,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QACxF,MAAM,QAAQ,GAAiB;YAC7B,MAAM,EAAE,MAAM,CAAC,GAAG;YAClB,OAAO,EAAE,MAAM,CAAC,GAAG;YACnB,mGAAmG;YACnG,KAAK,EAAE,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;YACpG,QAAQ,EAAE,OAAO,MAAM,CAAC,kBAAkB,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS;YAC/F,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;SAC9D,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;IAED,SAAS,CAAC,QAAsB;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,EAAE,WAAW,CAAC;QAC/C,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,wBAAwB;QAC3E,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5D,IAAI,QAAQ,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QACpH,IAAI,MAAM,CAAC,KAAK,IAAI,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACxE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,0GAA0G;IAC1G,KAAK,CAAC,WAAW,CAAC,KAAkB,EAAE,QAAsB;QAC1D,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/D,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;QACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACpC,qFAAqF;QACrF,IAAI,CAAC,QAAQ,EAAE,aAAa,IAAI,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE;YAAE,OAAO,IAAI,CAAC;QAC9G,MAAM,IAAI,GACR,CAAC,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YAC5G,MAAM,CAAC;QACT,IAAI,QAAQ,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC;QACvD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE;YAAE,QAAQ,GAAG,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;QAC3E,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC;QAC3D,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9D,OAAO,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC/B,CAAC;CACF"}
+{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../../src/auth/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AAGzC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAGzD;2FAC2F;AAE3F,wFAAwF;AACxF,MAAM,iBAAiB,GAAG,CAAC;KACxB,MAAM,EAAE;KACR,KAAK,CACJ,uFAAuF,EACvF,sBAAsB,CACvB;KACA,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AAErC,MAAM,iBAAiB,GAAG,CAAC;KACxB,MAAM,CAAC;IACN,6CAA6C;IAC7C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC7E,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAChD,4EAA4E;IAC5E,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;CAC1C,CAAC;KACD,QAAQ,CAAC,EAAE,CAAC,CAAC;AAEhB,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE;IACf,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,sBAAsB,CAAC;IAClD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAChC,WAAW,EAAE,iBAAiB;IAC9B,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CAC1C,CAAC,CAAC;AAuBH,MAAM,YAAY,GAAG,EAAE,GAAG,MAAM,CAAC;AACjC,SAAS,YAAY,CAAC,OAAiB,EAAE,KAAa;IACpD,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QACxB,MAAM,KAAK,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC;IAChF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,aAAa,GAAG,CAAC,CAA8B,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;AAE7G,MAAM,SAAU,SAAQ,YAAY;IAClC,YAAY,IAAY,EAAE,OAAe;QACvC,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5B,CAAC;CACF;AAED,MAAM,OAAO,WAAW;IAIH;IACA;IACA;IAEA;IAPX,MAAM,CAA+C;IAE7D,YACmB,EAAM,EACN,GAAc,EACd,QAAgB;IACjC,gEAAgE;IAC/C,gBAAgB,KAAK;QAJrB,OAAE,GAAF,EAAE,CAAI;QACN,QAAG,GAAH,GAAG,CAAW;QACd,aAAQ,GAAR,QAAQ,CAAQ;QAEhB,kBAAa,GAAb,aAAa,CAAQ;IACrC,CAAC;IAEI,GAAG;QACT,OAAO,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IAC7E,CAAC;IAED,WAAW;QACT,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,OAAO;YACL,GAAG,kBAAkB,CAAC,KAAK,CAAC;gBAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE;gBAClC,aAAa,EAAE,GAAG,CAAC,aAAa;gBAChC,KAAK,EAAG,GAAG,CAAC,WAAyC,EAAE,KAAK,IAAI,KAAK;aACtE,CAAC;YACF,eAAe,EAAE,CAAC,CAAC,GAAG,CAAC,eAAe;SACvC,CAAC;IACJ,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,WAAW,EAAE,EAAE,OAAO,KAAK,IAAI,CAAC;IAC9C,CAAC;IAED,kGAAkG;IAClG,cAAc,CAAC,KAA+D,EAAE,QAA6B,EAAE;QAC7G,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,eAAe,CACvB,cAAc,EACd,uBAAuB,EACvB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CACpE,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,CAAC,aAAa,IAAI,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,eAAe,CACvB,iBAAiB,EACjB,uEAAuE,CACxE,CAAC;QACJ,CAAC;QACD,IAAI,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,eAAe,IAAI,IAAI,CAAC;QAC1D,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI;YAAE,eAAe,GAAG,IAAI,CAAC;aACnD,IAAI,KAAK,CAAC,YAAY;YACzB,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,CAAC,aAAa,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAC,CAAC;QACvG,MAAM,MAAM,GAAG;YACb,EAAE,EAAE,CAAC;YACL,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,eAAe;YACf,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;YACjD,aAAa,EAAE,CAAC,CAAC,aAAa;YAC9B,OAAO,EAAE,CAAC,CAAC,OAAO;SACnB,CAAC;QACF,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;YACtG,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,uBAAuB;gBACjC,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,KAAK,CAAC,MAAM;gBACrB,MAAM,EAAE,EAAE,GAAG,CAAC,EAAE,mBAAmB,EAAE,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE;aACxE,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QACxB,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,aAAa;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,EAAE,OAAO;YAAE,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,6BAA6B,CAAC,CAAC;QACvF,MAAM,MAAM,GAAG,GAAG,CAAC,eAAe;YAChC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,aAAa,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YACtG,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,IAAI,MAAM,IAAI,EAAE,EAAE,CAAC;QAC5D,IAAI,IAAI,CAAC,MAAM,EAAE,GAAG,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QACxD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CACjC,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EACnB,GAAG,CAAC,QAAQ,EACZ,MAAM,EACN,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,EACpD,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAC3E,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,mGAAmG;IACnG,KAAK,CAAC,KAAK,CAAC,KAAwF;QAClG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAG,CAAC;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAc;YACvB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ;YACR,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE;YACzB,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE;YACzB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE;YAC7C,YAAY,EAAE,KAAK,CAAC,WAAW;YAC/B,KAAK,EAAE,QAAQ,CAAC,MAAM;YACtB,cAAc,EAAE,MAAM,IAAI,CAAC,0BAA0B,CAAC,QAAQ,CAAC;YAC/D,qBAAqB,EAAE,MAAM;YAC7B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC,CAAC;QACH,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,WAAW,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,YAAY,CAAC,EAAE,CAAC;IAC9F,CAAC;IAED,0GAA0G;IAC1G,KAAK,CAAC,QAAQ,CACZ,WAAgB,EAChB,UAA8B;QAE9B,MAAM,KAAK,GAAG,aAAa,CAAY,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAClE,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,SAAS,CAAC,YAAY,EAAE,+CAA+C,CAAC,CAAC;QAC/F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC1C,IAAI,MAAgC,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE,WAAW,EAAE;gBACpE,gBAAgB,EAAE,KAAK,CAAC,QAAQ;gBAChC,aAAa,EAAE,KAAK,CAAC,KAAK;gBAC1B,aAAa,EAAE,KAAK,CAAC,KAAK;gBAC1B,eAAe,EAAE,IAAI;aACtB,CAAC,CAAC;YACH,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,mBAAmB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5G,CAAC;QACD,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,4CAA4C,CAAC,CAAC;QAC9F,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAG,CAAC;QACrC,MAAM,SAAS,GAAI,MAAkC,CAAC,QAAQ,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QACxF,MAAM,QAAQ,GAAiB;YAC7B,MAAM,EAAE,MAAM,CAAC,GAAG;YAClB,OAAO,EAAE,MAAM,CAAC,GAAG;YACnB,mGAAmG;YACnG,KAAK,EAAE,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;YACpG,QAAQ,EAAE,OAAO,MAAM,CAAC,kBAAkB,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS;YAC/F,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;SAC9D,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;IAED,SAAS,CAAC,QAAsB;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,EAAE,WAAW,CAAC;QAC/C,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,wBAAwB;QAC3E,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5D,IAAI,QAAQ,CAAC,KAAK,IAAI,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/E,IAAI,MAAM,CAAC,KAAK,IAAI,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACxE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,0GAA0G;IAC1G,KAAK,CAAC,WAAW,CAAC,KAAkB,EAAE,QAAsB;QAC1D,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/D,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;QACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACpC,qFAAqF;QACrF,IAAI,CAAC,QAAQ,EAAE,aAAa,IAAI,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE;YAAE,OAAO,IAAI,CAAC;QAC9G,MAAM,IAAI,GACR,CAAC,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YAC5G,MAAM,CAAC;QACT,IAAI,QAAQ,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC;QACvD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE;YAAE,QAAQ,GAAG,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;QAC3E,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC;QAC3D,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9D,OAAO,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC/B,CAAC;CACF"}

package/dist/auth/roles.d.ts

@@ -1,17 +1,15 @@
-import type { LevelTarget, LevelView } from '../catalog/role-levels.js';
+import type { EndpointSwitches, LevelTarget, LevelView } from '../catalog/role-levels.js';
 import type { Db, DbLike } from '../db/index.js';
 import { roles } from '../db/schema.js';
 import type { AccessLevel } from '../gate/access.js';
-/** Roles (design §6.4): the built-in Admin role plus admin-defined ones, each with its endpoints, its
- * maximum levels (`catalog/role-levels.ts`) and three switches. */
+/** Roles (design §6.4): the built-in Admin role plus admin-defined ones, each with its endpoints (three
+ * switches on each), its maximum levels (`catalog/role-levels.ts`) and a role-wide switch. */
 export type RoleRow = typeof roles.$inferSelect;
 export interface PublicRole {
     id: string;
     name: string;
     isAdmin: boolean;
-    canSetOwnLevels: boolean;
-    canManageOwnRules: boolean;
-    canSeeStatus: boolean;
+    canSeeOtherEndpoints: boolean;
 }
 export declare const toPublicRole: (r: RoleRow) => PublicRole;
 export declare class RoleService {
@@ -20,14 +18,17 @@ export declare class RoleService {
     get(id: string, db?: DbLike): RoleRow;
     list(): {
         users: number;
-        instanceIds: string[];
+        endpoints: {
+            instanceId: string;
+            canSetOwnLevels: boolean;
+            canManageOwnRules: boolean;
+            canSeeStatus: boolean;
+        }[];
         isDefault: boolean;
         id: string;
         name: string;
         isAdmin: boolean;
-        canSetOwnLevels: boolean;
-        canManageOwnRules: boolean;
-        canSeeStatus: boolean;
+        canSeeOtherEndpoints: boolean;
     }[];
     create(raw: unknown, actor?: {
         userId?: string;
@@ -38,7 +39,12 @@ export declare class RoleService {
     remove(id: string, actor?: {
         userId?: string;
     }): void;
-    /** Sets the endpoints a role has; levels on a removed endpoint go with it. */
+    /** Sets a role's switches on one of its endpoints; unsent switches keep their value. */
+    setEndpointSwitches(id: string, instanceId: string, raw: unknown, actor?: {
+        userId?: string;
+    }): EndpointSwitches;
+    /** Sets the endpoints a role has; levels on a removed endpoint go with it. New ones start with every
+     * switch off. */
     setInstances(id: string, instanceIds: string[], actor?: {
         userId?: string;
     }): string[];

package/dist/auth/roles.js

@@ -2,7 +2,7 @@ import { randomUUID } from 'node:crypto';
 import { and, asc, count, eq, inArray } from 'drizzle-orm';
 import { z } from 'zod';
 import { writeAudit } from '../audit.js';
-import { levelView, setRoleBulkLevel, setRoleLevel } from '../catalog/role-levels.js';
+import { levelView, roleEndpointSwitches, setRoleBulkLevel, setRoleLevel } from '../catalog/role-levels.js';
 import { pluginInstances, roleInstances, roleLevels, roles, users } from '../db/schema.js';
 import { ConflictError, NotFoundError, ValidationError } from '../errors.js';
 import { ADMIN_ROLE_ID } from '../gate/access.js';
@@ -11,16 +11,23 @@ export const toPublicRole = (r) => ({
     id: r.id,
     name: r.name,
     isAdmin: r.id === ADMIN_ROLE_ID,
-    canSetOwnLevels: r.canSetOwnLevels,
-    canManageOwnRules: r.canManageOwnRules,
-    canSeeStatus: r.canSeeStatus,
+    canSeeOtherEndpoints: r.canSeeOtherEndpoints,
 });
-const RoleInput = z.object({
-    name: z.string().trim().min(1).max(64),
-    canSetOwnLevels: z.boolean().default(false),
-    canManageOwnRules: z.boolean().default(false),
-    canSeeStatus: z.boolean().default(false),
+// No defaults on the patch: zod applies `.default()` inside `.partial()`, which would reset unsent switches.
+const RolePatch = z.object({
+    name: z.string().trim().min(1).max(64).optional(),
+    canSeeOtherEndpoints: z.boolean().optional(),
 });
+const RoleCreate = RolePatch.required({ name: true }).extend({
+    canSeeOtherEndpoints: z.boolean().default(false),
+});
+const EndpointSwitchesPatch = z
+    .object({
+    canSetOwnLevels: z.boolean().optional(),
+    canManageOwnRules: z.boolean().optional(),
+    canSeeStatus: z.boolean().optional(),
+})
+    .refine((p) => Object.keys(p).length > 0, 'Send at least one switch');
 export class RoleService {
     db;
     constructor(db) {
@@ -49,12 +56,19 @@ export class RoleService {
             .map((r) => ({
             ...toPublicRole(r),
             users: members.get(r.id) ?? 0,
-            instanceIds: endpoints.filter((e) => e.roleId === r.id).map((e) => e.instanceId),
+            endpoints: endpoints
+                .filter((e) => e.roleId === r.id)
+                .map(({ instanceId, canSetOwnLevels, canManageOwnRules, canSeeStatus }) => ({
+                instanceId,
+                canSetOwnLevels,
+                canManageOwnRules,
+                canSeeStatus,
+            })),
             isDefault: r.id === defaultRoleId,
         }));
     }
     create(raw, actor = {}) {
-        const input = RoleInput.parse(raw);
+        const input = RoleCreate.parse(raw);
         const id = randomUUID();
         this.db.transaction((tx) => {
             if (tx.select({ id: roles.id }).from(roles).where(eq(roles.name, input.name)).get())
@@ -76,7 +90,7 @@ export class RoleService {
         const before = this.get(id);
         if (before.builtIn)
             throw new ConflictError('built_in_role', 'The Admin role cannot be changed');
-        const input = RoleInput.partial().parse(raw);
+        const input = RolePatch.parse(raw);
         this.db.transaction((tx) => {
             if (input.name && input.name !== before.name) {
                 if (tx.select({ id: roles.id }).from(roles).where(eq(roles.name, input.name)).get())
@@ -116,7 +130,31 @@ export class RoleService {
             });
         });
     }
-    /** Sets the endpoints a role has; levels on a removed endpoint go with it. */
+    /** Sets a role's switches on one of its endpoints; unsent switches keep their value. */
+    setEndpointSwitches(id, instanceId, raw, actor = {}) {
+        const role = this.get(id);
+        if (role.builtIn)
+            throw new ConflictError('built_in_role', 'The Admin role has every switch on');
+        const input = EndpointSwitchesPatch.parse(raw);
+        const scope = and(eq(roleInstances.roleId, id), eq(roleInstances.instanceId, instanceId));
+        return this.db.transaction((tx) => {
+            const before = roleEndpointSwitches(tx, id, instanceId);
+            if (!before)
+                throw new ConflictError('not_in_role', 'Add the endpoint to the role first');
+            tx.update(roleInstances).set(input).where(scope).run();
+            writeAudit(tx, {
+                kind: 'config',
+                instanceId,
+                decision: 'role_endpoint_changed',
+                actorKind: 'user',
+                actorId: actor.userId,
+                detail: { id, before, changes: input },
+            });
+            return { ...before, ...input };
+        });
+    }
+    /** Sets the endpoints a role has; levels on a removed endpoint go with it. New ones start with every
+     * switch off. */
     setInstances(id, instanceIds, actor = {}) {
         const role = this.get(id);
         if (role.builtIn)

package/dist/auth/roles.js.map

@@ -1 +1 @@
-{"version":3,"file":"roles.js","sourceRoot":"","sources":["../../src/auth/roles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAGtF,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAC3F,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC7E,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAElD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAgB7C,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAU,EAAc,EAAE,CAAC,CAAC;IACvD,EAAE,EAAE,CAAC,CAAC,EAAE;IACR,IAAI,EAAE,CAAC,CAAC,IAAI;IACZ,OAAO,EAAE,CAAC,CAAC,EAAE,KAAK,aAAa;IAC/B,eAAe,EAAE,CAAC,CAAC,eAAe;IAClC,iBAAiB,EAAE,CAAC,CAAC,iBAAiB;IACtC,YAAY,EAAE,CAAC,CAAC,YAAY;CAC7B,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACtC,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC3C,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC7C,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACzC,CAAC,CAAC;AAEH,MAAM,OAAO,WAAW;IACO;IAA7B,YAA6B,EAAM;QAAN,OAAE,GAAF,EAAE,CAAI;IAAG,CAAC;IAEvC,GAAG,CAAC,EAAU,EAAE,KAAa,IAAI,CAAC,EAAE;QAClC,MAAM,IAAI,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QACnE,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,aAAa,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI;QACF,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,IAAI,CAAC,EAAE;aACJ,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;aAC5C,IAAI,CAAC,KAAK,CAAC;aACX,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;aACrB,GAAG,EAAE;aACL,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAC/B,CAAC;QACF,MAAM,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,GAAG,EAAE,CAAC;QAC7D,MAAM,aAAa,GAAG,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,aAAa,CAAC;QACrE,OAAO,IAAI,CAAC,EAAE;aACX,MAAM,EAAE;aACR,IAAI,CAAC,KAAK,CAAC;aACX,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;aAC9C,GAAG,EAAE;aACL,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACX,GAAG,YAAY,CAAC,CAAC,CAAC;YAClB,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC;YAC7B,WAAW,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;YAChF,SAAS,EAAE,CAAC,CAAC,EAAE,KAAK,aAAa;SAClC,CAAC,CAAC,CAAC;IACR,CAAC;IAED,MAAM,CAAC,GAAY,EAAE,QAA6B,EAAE;QAClD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;QACxB,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE;gBACjF,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,8BAA8B,CAAC,CAAC;YAC7E,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;iBACb,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;iBAC/C,GAAG,EAAE,CAAC;YACT,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,cAAc;gBACxB,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,KAAK,CAAC,MAAM;gBACrB,MAAM,EAAE,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE;aACzB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,CAAC,EAAU,EAAE,GAAY,EAAE,QAA6B,EAAE;QAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,aAAa,CAAC,eAAe,EAAE,kCAAkC,CAAC,CAAC;QACjG,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC7C,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE;oBACjF,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,8BAA8B,CAAC,CAAC;YAC/E,CAAC;YACD,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;iBACb,GAAG,CAAC,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;iBACxC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;iBACvB,GAAG,EAAE,CAAC;YACT,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,cAAc;gBACxB,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,KAAK,CAAC,MAAM;gBACrB,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE;aAC7D,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,CAAC,EAAU,EAAE,QAA6B,EAAE;QAChD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1B,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,aAAa,CAAC,eAAe,EAAE,kCAAkC,CAAC,CAAC;QAC/F,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,aAAa,KAAK,EAAE;YACvD,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,8DAA8D,CAAC,CAAC;QAC1G,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;YAC1F,IAAI,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,aAAa,CAAC,aAAa,EAAE,GAAG,CAAC,0CAA0C,CAAC,CAAC;YAClG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YAC/C,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,cAAc;gBACxB,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,KAAK,CAAC,MAAM;gBACrB,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;aAChC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,8EAA8E;IAC9E,YAAY,CAAC,EAAU,EAAE,WAAqB,EAAE,QAA6B,EAAE;QAC7E,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1B,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,aAAa,CAAC,eAAe,EAAE,mCAAmC,CAAC,CAAC;QAChG,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,IAAI,GAAG,CACnB,MAAM,CAAC,MAAM;YACX,CAAC,CAAC,IAAI,CAAC,EAAE;iBACJ,MAAM,CAAC,EAAE,EAAE,EAAE,eAAe,CAAC,EAAE,EAAE,CAAC;iBAClC,IAAI,CAAC,eAAe,CAAC;iBACrB,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;iBAC1C,GAAG,EAAE;iBACL,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,CAAC,CAAC,EAAE,CACP,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,IAAI,OAAO,CAAC,MAAM;YAAE,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAE,wBAAwB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChH,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,MAAM,MAAM,GAAG,EAAE;iBACd,MAAM,EAAE;iBACR,IAAI,CAAC,aAAa,CAAC;iBACnB,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;iBACnC,GAAG,EAAE;iBACL,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;YAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1D,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACnB,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC;qBACrB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;qBACpF,GAAG,EAAE,CAAC;gBACT,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC;qBAClB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;qBAC9E,GAAG,EAAE,CAAC;YACX,CAAC;YACD,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAChE,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;YACpE,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,wBAAwB;gBAClC,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,KAAK,CAAC,MAAM;gBACrB,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;aACtC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,gDAAgD;IAChD,MAAM,CAAC,EAAU,EAAE,UAAkB;QACnC,OAAO,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,QAAQ,CACN,EAAU,EACV,UAAkB,EAClB,MAAmB,EACnB,KAAyB,EACzB,QAA6B,EAAE;QAE/B,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAChE,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IACrC,CAAC;IAED,YAAY,CAAC,EAAU,EAAE,UAAkB,EAAE,KAAkB,EAAE,QAA6B,EAAE;QAC9F,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IACrC,CAAC;CACF"}
+{"version":3,"file":"roles.js","sourceRoot":"","sources":["../../src/auth/roles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAG5G,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAC3F,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC7E,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAElD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAc7C,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAU,EAAc,EAAE,CAAC,CAAC;IACvD,EAAE,EAAE,CAAC,CAAC,EAAE;IACR,IAAI,EAAE,CAAC,CAAC,IAAI;IACZ,OAAO,EAAE,CAAC,CAAC,EAAE,KAAK,aAAa;IAC/B,oBAAoB,EAAE,CAAC,CAAC,oBAAoB;CAC7C,CAAC,CAAC;AAEH,6GAA6G;AAC7G,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACjD,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC;AACH,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IAC3D,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACjD,CAAC,CAAC;AACH,MAAM,qBAAqB,GAAG,CAAC;KAC5B,MAAM,CAAC;IACN,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACvC,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACzC,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC;KACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,0BAA0B,CAAC,CAAC;AAExE,MAAM,OAAO,WAAW;IACO;IAA7B,YAA6B,EAAM;QAAN,OAAE,GAAF,EAAE,CAAI;IAAG,CAAC;IAEvC,GAAG,CAAC,EAAU,EAAE,KAAa,IAAI,CAAC,EAAE;QAClC,MAAM,IAAI,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QACnE,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,aAAa,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI;QACF,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,IAAI,CAAC,EAAE;aACJ,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;aAC5C,IAAI,CAAC,KAAK,CAAC;aACX,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;aACrB,GAAG,EAAE;aACL,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAC/B,CAAC;QACF,MAAM,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,GAAG,EAAE,CAAC;QAC7D,MAAM,aAAa,GAAG,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,aAAa,CAAC;QACrE,OAAO,IAAI,CAAC,EAAE;aACX,MAAM,EAAE;aACR,IAAI,CAAC,KAAK,CAAC;aACX,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;aAC9C,GAAG,EAAE;aACL,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACX,GAAG,YAAY,CAAC,CAAC,CAAC;YAClB,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC;YAC7B,SAAS,EAAE,SAAS;iBACjB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;iBAChC,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,eAAe,EAAE,iBAAiB,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;gBAC1E,UAAU;gBACV,eAAe;gBACf,iBAAiB;gBACjB,YAAY;aACb,CAAC,CAAC;YACL,SAAS,EAAE,CAAC,CAAC,EAAE,KAAK,aAAa;SAClC,CAAC,CAAC,CAAC;IACR,CAAC;IAED,MAAM,CAAC,GAAY,EAAE,QAA6B,EAAE;QAClD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;QACxB,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE;gBACjF,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,8BAA8B,CAAC,CAAC;YAC7E,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;iBACb,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;iBAC/C,GAAG,EAAE,CAAC;YACT,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,cAAc;gBACxB,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,KAAK,CAAC,MAAM;gBACrB,MAAM,EAAE,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE;aACzB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,CAAC,EAAU,EAAE,GAAY,EAAE,QAA6B,EAAE;QAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,aAAa,CAAC,eAAe,EAAE,kCAAkC,CAAC,CAAC;QACjG,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC7C,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE;oBACjF,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,8BAA8B,CAAC,CAAC;YAC/E,CAAC;YACD,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;iBACb,GAAG,CAAC,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;iBACxC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;iBACvB,GAAG,EAAE,CAAC;YACT,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,cAAc;gBACxB,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,KAAK,CAAC,MAAM;gBACrB,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE;aAC7D,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,CAAC,EAAU,EAAE,QAA6B,EAAE;QAChD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1B,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,aAAa,CAAC,eAAe,EAAE,kCAAkC,CAAC,CAAC;QAC/F,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,aAAa,KAAK,EAAE;YACvD,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,8DAA8D,CAAC,CAAC;QAC1G,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;YAC1F,IAAI,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,aAAa,CAAC,aAAa,EAAE,GAAG,CAAC,0CAA0C,CAAC,CAAC;YAClG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YAC/C,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,cAAc;gBACxB,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,KAAK,CAAC,MAAM;gBACrB,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;aAChC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,wFAAwF;IACxF,mBAAmB,CAAC,EAAU,EAAE,UAAkB,EAAE,GAAY,EAAE,QAA6B,EAAE;QAC/F,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1B,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,aAAa,CAAC,eAAe,EAAE,oCAAoC,CAAC,CAAC;QACjG,MAAM,KAAK,GAAG,qBAAqB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;QAC1F,OAAO,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YAChC,MAAM,MAAM,GAAG,oBAAoB,CAAC,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC,CAAC;YACxD,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,aAAa,CAAC,aAAa,EAAE,oCAAoC,CAAC,CAAC;YAC1F,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC;YACvD,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,QAAQ;gBACd,UAAU;gBACV,QAAQ,EAAE,uBAAuB;gBACjC,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,KAAK,CAAC,MAAM;gBACrB,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE;aACvC,CAAC,CAAC;YACH,OAAO,EAAE,GAAG,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;QACjC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;qBACiB;IACjB,YAAY,CAAC,EAAU,EAAE,WAAqB,EAAE,QAA6B,EAAE;QAC7E,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1B,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,aAAa,CAAC,eAAe,EAAE,mCAAmC,CAAC,CAAC;QAChG,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,IAAI,GAAG,CACnB,MAAM,CAAC,MAAM;YACX,CAAC,CAAC,IAAI,CAAC,EAAE;iBACJ,MAAM,CAAC,EAAE,EAAE,EAAE,eAAe,CAAC,EAAE,EAAE,CAAC;iBAClC,IAAI,CAAC,eAAe,CAAC;iBACrB,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;iBAC1C,GAAG,EAAE;iBACL,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,CAAC,CAAC,EAAE,CACP,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,IAAI,OAAO,CAAC,MAAM;YAAE,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAE,wBAAwB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChH,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,MAAM,MAAM,GAAG,EAAE;iBACd,MAAM,EAAE;iBACR,IAAI,CAAC,aAAa,CAAC;iBACnB,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;iBACnC,GAAG,EAAE;iBACL,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;YAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1D,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACnB,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC;qBACrB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;qBACpF,GAAG,EAAE,CAAC;gBACT,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC;qBAClB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;qBAC9E,GAAG,EAAE,CAAC;YACX,CAAC;YACD,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAChE,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;YACpE,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,wBAAwB;gBAClC,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,KAAK,CAAC,MAAM;gBACrB,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;aACtC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,gDAAgD;IAChD,MAAM,CAAC,EAAU,EAAE,UAAkB;QACnC,OAAO,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,QAAQ,CACN,EAAU,EACV,UAAkB,EAClB,MAAmB,EACnB,KAAyB,EACzB,QAA6B,EAAE;QAE/B,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAChE,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IACrC,CAAC;IAED,YAAY,CAAC,EAAU,EAAE,UAAkB,EAAE,KAAkB,EAAE,QAA6B,EAAE;QAC9F,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IACrC,CAAC;CACF"}

package/dist/auth/sessions.d.ts

@@ -17,8 +17,6 @@ export declare class SessionService {
     private readonly db;
     private readonly pepper;
     private readonly now;
-    /** When each MCP-port session last proved TOTP (design §5.3); in memory, so a restart asks again. */
-    private readonly totpProofs;
     constructor(db: Db, pepper: Buffer, now?: () => Date);
     hashId(raw: string): string;
     create(userId: string, kind: SessionKind, limits: SessionLimits, meta?: {
@@ -39,9 +37,5 @@ export declare class SessionService {
     revokeKind(userId: string, kind: SessionKind): number;
     /** The user signs out every approval browser at once (Profile page, design §5.3). */
     revokeApprovalBrowsers(userId: string): number;
-    /** Proofs older than `maxAgeMs` are dropped on the way. */
-    recordTotpProof(idHash: string, maxAgeMs: number): void;
-    /** Milliseconds since this session last proved TOTP, or Infinity if it never did. */
-    sinceTotpProof(idHash: string): number;
     purgeExpired(): number;
 }