@toa.io/extensions.exposition 1.0.0-alpha.14 → 1.0.0-alpha.142

package/components/identity.federation/manifest.toa.yaml

@@ -2,41 +2,81 @@ namespace: identity
 name: federation
 
 entity:
+  associated: true
   schema:
     type: object
     properties:
+      authority:
+        description: The authority token is valid for
+        type: string
       iss:
         description: The issuer, or signer, of the token, URI like `https://accounts.google.com`
         type: string
       sub:
-        description: the ID that represents the principal making the request
+        description: The ID that represents the principal making the request
         type: string
     required:
+      - authority
       - iss
       - sub
     additionalProperties: false
-  dependent: true
+  unique:
+    token: [authority, iss, sub]
 
 operations:
   transit:
     concurrency: retry
-  incept:
-    forward: transit
-    query: false
     input:
+      authority*: string
       iss*: string
       sub*: string
-  create:
+  incept:
     input:
-      id*: string
+      authority: string
       credentials*: string
+      id: string
     output:
       id: string
   authenticate:
-    input: string
+    input:
+      authority*: string
+      credentials*: string
     output:
-      identity:
-        id: string
+      properties:
+        identity:
+          properties:
+            id:
+              type: string
+            claims: &claims
+              properties:
+                iss:
+                  type: string
+                aud:
+                  type: string
+                sub:
+                  type: string
+              additionalProperties: true
+              required:
+                - iss
+                - sub
+          required:
+            - id
+            - claims
+    errors:
+      - ERR_NOT_FOUND
+  decode:
+    input: string
+    output: *claims
+
+exposition:
+  /:
+    /:id:
+      POST:
+        map:authority: authority
+        auth:id: id
+        io:input: [credentials]
+        io:output: false
+        endpoint: incept
 
 configuration:
   schema:
@@ -45,15 +85,15 @@ configuration:
       trust:
         type: array
         items:
-          title: Trust Configuration
+          title: Trusted Identity Providers
           type: object
           additionalProperties: false
           properties:
-            issuer:
+            iss:
               description: Allowed origins for a token `iss` field
               type: string
               format: uri
-            audience:
+            aud:
               description: Acceptable `aud` value(s)
               type: array
               items:
@@ -73,13 +113,10 @@ configuration:
               additionalProperties: false
               minProperties: 1
           required:
-            - issuer
-      explicit_identity_creation:
-        description: Force identities to be explicitly created or incept before being used in authentication
-        type: boolean
-        default: true
+            - iss
       principal:
-        description: The value of `sub` of an identity token that will be assigned the `system` Role
+        title: Principal
+        description: Subject that will be assigned the `system` Role
         type: object
         properties:
           iss:
@@ -91,4 +128,13 @@ configuration:
           - iss
           - sub
         additionalProperties: false
+      implicit:
+        title: Implicitly create Identity
+        description: |
+          Enabling this will make Identity inception impossible.
+          DEPRECATED: use `auth:assert`
+        type: boolean
+        default: false
     additionalProperties: false
+
+stash: ~

package/components/identity.federation/operations/authenticate.d.ts

@@ -1,3 +1,14 @@
 import { type Maybe } from '@toa.io/types';
-import type { AuthenticateOutput, Context } from './types';
-export declare const computation: (input: string, context: Context) => Promise<Error | Promise<Maybe<AuthenticateOutput>>>;
+import type { Context, IdToken } from './types';
+export declare const computation: (args_0: Input, context: Context) => Promise<Error | Promise<Maybe<Output>>>;
+interface Input {
+    authority: string;
+    credentials: string;
+}
+interface Output {
+    identity: {
+        id: string;
+        claims: Pick<IdToken, 'iss' | 'sub' | 'aud'>;
+    };
+}
+export {};

package/components/identity.federation/operations/authenticate.js

@@ -4,17 +4,18 @@ exports.computation = void 0;
 const error_value_1 = require("error-value");
 const assertions_as_values_js_1 = require("./lib/assertions-as-values.js");
 const jwt_1 = require("./lib/jwt");
-async function authenticate(input, context) {
-    const { iss, sub } = await (0, jwt_1.validateIdToken)(input, context.configuration.trust);
-    const request = { query: { criteria: `iss==${iss};sub==${sub}` } };
-    let id = (await context.local.observe(request))?.id;
-    if (id === undefined) {
-        if (context.configuration.explicit_identity_creation === true)
-            return (0, error_value_1.Err)('NOT_FOUND');
-        id = (await context.local.transit({ input: { iss, sub } })).id;
-    }
-    return { identity: { id } };
+async function authenticate({ authority, credentials }, context) {
+    const claims = await (0, jwt_1.decode)(credentials, context.configuration.trust, context.stash);
+    const { iss, sub } = claims;
+    context.logs.debug('Token claims', claims);
+    const identity = context.configuration.implicit
+        ? await context.local.ensure({ entity: { authority, iss, sub } })
+        : await context.local.observe({ query: { criteria: `authority==${authority};iss==${iss};sub==${sub}` } });
+    if (identity === null)
+        return ERR_NOT_FOUND;
+    return { identity: { id: identity.id, claims } };
 }
+const ERR_NOT_FOUND = new error_value_1.Err('NOT_FOUND');
 // Exporting as a function returning assertion errors as values
 exports.computation = (0, assertions_as_values_js_1.assertionsAsValues)(authenticate);
 //# sourceMappingURL=authenticate.js.map

package/components/identity.federation/operations/authenticate.js.map

@@ -1 +1 @@
-{"version":3,"file":"authenticate.js","sourceRoot":"","sources":["../source/authenticate.ts"],"names":[],"mappings":";;;AACA,6CAAiC;AACjC,2EAAkE;AAClE,mCAEkB;AAIlB,KAAK,UAAU,YAAY,CAAE,KAAa,EACxC,OAAgB;IAChB,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,IAAA,qBAAe,EAAC,KAAK,EAAE,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAA;IAE9E,MAAM,OAAO,GAAY,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,QAAQ,GAAG,SAAS,GAAG,EAAE,EAAE,EAAE,CAAA;IAE3E,IAAI,EAAE,GAAG,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,CAAA;IAEnD,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QACrB,IAAI,OAAO,CAAC,aAAa,CAAC,0BAA0B,KAAK,IAAI;YAAE,OAAO,IAAA,iBAAG,EAAC,WAAW,CAAC,CAAA;QAEtF,EAAE,GAAG,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAChE,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,CAAA;AAC7B,CAAC;AAED,+DAA+D;AAClD,QAAA,WAAW,GAAG,IAAA,4CAAkB,EAAC,YAAY,CAAC,CAAA"}
+{"version":3,"file":"authenticate.js","sourceRoot":"","sources":["../source/authenticate.ts"],"names":[],"mappings":";;;AACA,6CAAiC;AACjC,2EAAkE;AAClE,mCAAkC;AAGlC,KAAK,UAAU,YAAY,CAAE,EAAE,SAAS,EAAE,WAAW,EAAS,EAAE,OAAgB;IAC9E,MAAM,MAAM,GAAG,MAAM,IAAA,YAAM,EAAC,WAAW,EAAE,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;IACpF,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAA;IAE3B,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,MAAM,CAAC,CAAA;IAE1C,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,CAAC,QAAQ;QAC7C,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC;QACjE,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,cAAc,SAAS,SAAS,GAAG,SAAS,GAAG,EAAE,EAAE,EAAE,CAAC,CAAA;IAE3G,IAAI,QAAQ,KAAK,IAAI;QACnB,OAAO,aAAa,CAAA;IAEtB,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,CAAA;AAClD,CAAC;AAED,MAAM,aAAa,GAAG,IAAI,iBAAG,CAAC,WAAW,CAAC,CAAA;AAE1C,+DAA+D;AAClD,QAAA,WAAW,GAAG,IAAA,4CAAkB,EAAC,YAAY,CAAC,CAAA"}

package/components/identity.federation/operations/decode.d.ts

@@ -0,0 +1,2 @@
+import type { Context, IdToken } from './types';
+export declare const computation: (token: string, context: Context) => Promise<Error | Promise<IdToken>>;

package/{transpiled/directives/octets/Permute.js → components/identity.federation/operations/decode.js}

@@ -23,36 +23,11 @@ var __importStar = (this && this.__importStar) || function (mod) {
     return result;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Permute = void 0;
-const HTTP_1 = require("../../HTTP");
-const schemas = __importStar(require("./schemas"));
-const Directive_1 = require("./Directive");
-class Permute extends Directive_1.Directive {
-    targeted = false;
-    discovery;
-    storage = null;
-    constructor(value, discovery) {
-        super();
-        schemas.permute.validate(value);
-        this.discovery = discovery;
-    }
-    async apply(storage, input) {
-        this.storage ??= await this.discovery;
-        if (input.encoder === null)
-            throw new HTTP_1.NotAcceptable();
-        const path = input.request.url;
-        const list = await input.body();
-        const error = await this.storage.invoke('permute', {
-            input: {
-                storage,
-                path,
-                list
-            }
-        });
-        if (error instanceof Error)
-            throw new HTTP_1.NotFound();
-        return {};
-    }
+exports.computation = void 0;
+const jwt = __importStar(require("./lib/jwt"));
+const assertions_as_values_1 = require("./lib/assertions-as-values");
+async function decode(token, context) {
+    return await jwt.decode(token, context.configuration.trust, context.stash);
 }
-exports.Permute = Permute;
-//# sourceMappingURL=Permute.js.map
+exports.computation = (0, assertions_as_values_1.assertionsAsValues)(decode);
+//# sourceMappingURL=decode.js.map

package/components/identity.federation/operations/decode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decode.js","sourceRoot":"","sources":["../source/decode.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,+CAAgC;AAChC,qEAA+D;AAG/D,KAAK,UAAU,MAAM,CAAE,KAAa,EAAE,OAAgB;IACpD,OAAO,MAAM,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;AAC5E,CAAC;AAEY,QAAA,WAAW,GAAG,IAAA,yCAAkB,EAAC,MAAM,CAAC,CAAA"}

package/components/identity.federation/operations/incept.d.ts

@@ -0,0 +1,10 @@
+import type { Context } from './types';
+export interface Input {
+    authority: string;
+    credentials: string;
+    id?: string;
+}
+export interface Output {
+    id: string;
+}
+export declare const effect: (input: Input, context: Context) => Promise<Error | Promise<Output>>;

package/components/identity.federation/operations/incept.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.effect = void 0;
+const assertions_as_values_js_1 = require("./lib/assertions-as-values.js");
+const jwt_1 = require("./lib/jwt");
+async function incept(input, context) {
+    const { iss, sub } = await (0, jwt_1.decode)(input.credentials, context.configuration.trust, context.stash);
+    const request = { input: { authority: input.authority, iss, sub } };
+    if (input.id !== undefined)
+        request.query = { id: input.id };
+    return await context.local.transit(request);
+}
+exports.effect = (0, assertions_as_values_js_1.assertionsAsValues)(incept);
+//# sourceMappingURL=incept.js.map

package/components/identity.federation/operations/incept.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"incept.js","sourceRoot":"","sources":["../source/incept.ts"],"names":[],"mappings":";;;AAAA,2EAAkE;AAClE,mCAAkC;AAIlC,KAAK,UAAU,MAAM,CAAE,KAAY,EAAE,OAAgB;IACnD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,IAAA,YAAM,EAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;IAChG,MAAM,OAAO,GAA0B,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,EAA+B,EAAE,CAAA;IAEvH,IAAI,KAAK,CAAC,EAAE,KAAK,SAAS;QACxB,OAAO,CAAC,KAAK,GAAG,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAA;IAElC,OAAO,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;AAC7C,CAAC;AAYY,QAAA,MAAM,GAAG,IAAA,4CAAkB,EAAC,MAAM,CAAC,CAAA"}

package/components/identity.federation/operations/lib/assertions-as-values.js

@@ -25,6 +25,7 @@ var __importStar = (this && this.__importStar) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.assertionsAsValues = void 0;
 const assert = __importStar(require("node:assert"));
+const openspan_1 = require("openspan");
 /**
  * Wrapping function that returns assertion errors as function return value
  */
@@ -34,9 +35,10 @@ function assertionsAsValues(fn) {
             return await fn(...args);
         }
         catch (err) {
-            console.error(err);
-            if (err instanceof assert.AssertionError)
+            if (err instanceof assert.AssertionError) {
+                openspan_1.console.error('OIDC Authentication exception', { message: err.message });
                 return err;
+            }
             throw err;
         }
     };

package/components/identity.federation/operations/lib/assertions-as-values.js.map

@@ -1 +1 @@
-{"version":3,"file":"assertions-as-values.js","sourceRoot":"","sources":["../../source/lib/assertions-as-values.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oDAAqC;AAErC;;GAEG;AACH,SAAgB,kBAAkB,CAChC,EAAK;IACL,OAAO,KAAK,EAAE,GAAG,IAAmB,EAAkC,EAAE;QACtE,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,CAAA;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAElB,IAAI,GAAG,YAAY,MAAM,CAAC,cAAc;gBAAE,OAAO,GAAG,CAAA;YAEpD,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC,CAAA;AACH,CAAC;AAbD,gDAaC"}
+{"version":3,"file":"assertions-as-values.js","sourceRoot":"","sources":["../../source/lib/assertions-as-values.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oDAAqC;AACrC,uCAAkC;AAElC;;GAEG;AACH,SAAgB,kBAAkB,CAChC,EAAK;IACL,OAAO,KAAK,EAAE,GAAG,IAAmB,EAAkC,EAAE;QACtE,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,CAAA;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,MAAM,CAAC,cAAc,EAAE,CAAC;gBACzC,kBAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;gBAExE,OAAO,GAAG,CAAA;YACZ,CAAC;YAED,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC,CAAA;AACH,CAAC;AAfD,gDAeC"}

package/components/identity.federation/operations/lib/get.d.ts

@@ -0,0 +1 @@
+export declare function get(url: string, init?: RequestInit): Promise<Response>;

package/components/identity.federation/operations/lib/get.js

@@ -0,0 +1,64 @@
+"use strict";
+/* eslint-disable max-depth */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.get = void 0;
+const node_stream_1 = require("node:stream");
+const consumers_1 = require("node:stream/consumers");
+const ttlcache_1 = __importDefault(require("@isaacs/ttlcache"));
+const http_cache_semantics_1 = __importDefault(require("http-cache-semantics"));
+const cache = new ttlcache_1.default();
+async function get(url, init) {
+    const headers = toRecord(init?.headers);
+    const request = { url, method: 'GET', headers };
+    const cached = cache.get(url);
+    if (cached?.policy.satisfiesWithoutRevalidation(request) === true) {
+        const headers = toHeaders(cached.policy.responseHeaders());
+        return new Response(cached.body, { headers });
+    }
+    const response = await fetch(url, init);
+    const policy = new http_cache_semantics_1.default(request, { status: response.status, headers: toRecord(response.headers) });
+    const ttl = policy.timeToLive();
+    if (policy.storable() && ttl > 0) {
+        const body = await toBuffer(response.body);
+        cache.set(url, { policy, body }, { ttl });
+        return new Response(body, { headers: response.headers });
+    }
+    else
+        return response;
+}
+exports.get = get;
+function toRecord(headers) {
+    if (!(headers instanceof Headers))
+        headers = toHeaders(headers);
+    return Object.fromEntries(headers.entries());
+}
+function toHeaders(values) {
+    const headers = new Headers();
+    if (values === undefined)
+        return headers;
+    if (Array.isArray(values))
+        for (const [name, value] of values)
+            headers.append(name, value);
+    else
+        for (const name in values) {
+            const value = values[name];
+            if (value === undefined)
+                continue;
+            if (Array.isArray(value))
+                for (const v of value)
+                    headers.append(name, v);
+            else
+                headers.append(name, value);
+        }
+    return headers;
+}
+async function toBuffer(body) {
+    if (body === null)
+        return null;
+    const buf = await (0, consumers_1.buffer)(node_stream_1.Readable.fromWeb(body));
+    return Buffer.from(buf);
+}
+//# sourceMappingURL=get.js.map

package/components/identity.federation/operations/lib/get.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get.js","sourceRoot":"","sources":["../../source/lib/get.ts"],"names":[],"mappings":";AAAA,8BAA8B;;;;;;AAE9B,6CAAsC;AACtC,qDAA8C;AAE9C,gEAAoC;AACpC,gFAAyC;AAGzC,MAAM,KAAK,GAAG,IAAI,kBAAK,EAAiB,CAAA;AAEjC,KAAK,UAAU,GAAG,CAAE,GAAW,EAAE,IAAkB;IACxD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACvC,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;IAC/C,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAE7B,IAAI,MAAM,EAAE,MAAM,CAAC,4BAA4B,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;QAClE,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC,CAAA;QAE1D,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;IAC/C,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IACvC,MAAM,MAAM,GAAG,IAAI,8BAAM,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IACpG,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;IAE/B,IAAI,MAAM,CAAC,QAAQ,EAAE,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,IAAsB,CAAC,CAAA;QAE5D,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;QAEzC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;IAC1D,CAAC;;QACC,OAAO,QAAQ,CAAA;AACnB,CAAC;AAvBD,kBAuBC;AAED,SAAS,QAAQ,CAAE,OAA+B;IAChD,IAAI,CAAC,CAAC,OAAO,YAAY,OAAO,CAAC;QAC/B,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;IAE9B,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;AAC9C,CAAC;AAED,SAAS,SAAS,CAAE,MAAgF;IAClG,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAA;IAE7B,IAAI,MAAM,KAAK,SAAS;QACtB,OAAO,OAAO,CAAA;IAEhB,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QACvB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM;YAChC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;;QAE7B,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA;YAE1B,IAAI,KAAK,KAAK,SAAS;gBACrB,SAAQ;YAEV,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBACtB,KAAK,MAAM,CAAC,IAAI,KAAK;oBACnB,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;;gBAEzB,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QAC/B,CAAC;IAEH,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,KAAK,UAAU,QAAQ,CAAE,IAAuC;IAC9D,IAAI,IAAI,KAAK,IAAI;QACf,OAAO,IAAI,CAAA;IAEb,MAAM,GAAG,GAAG,MAAM,IAAA,kBAAM,EAAC,sBAAQ,CAAC,OAAO,CAAC,IAAsB,CAAC,CAAC,CAAA;IAElE,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AACzB,CAAC"}

package/components/identity.federation/operations/lib/jwt.d.ts

@@ -1,5 +1,5 @@
-import { type JwtHeader, type IdToken } from '../types';
-import { type TrustConfiguration } from '../schemas';
+import type { JwtHeader, IdToken, Trust } from '../types';
+import type { Stash } from '@toa.io/types';
 export declare function decodeJwt(token: string): {
     header: unknown;
     payload: unknown;
@@ -8,13 +8,13 @@ export declare function decodeJwt(token: string): {
     signature: string;
 };
 export declare function validateJwtHeader(header: unknown): asserts header is JwtHeader;
-export declare function validateJwtPayload(payload: unknown, trusted: TrustConfiguration[] | undefined, header: JwtHeader): asserts payload is IdToken;
+export declare function validateJwtPayload(payload: unknown, trusted: Trust[], header: JwtHeader): asserts payload is IdToken;
 export declare function validateSignature({ header: { kid, alg }, payload: { iss }, rawHeader, rawPayload, signature, trusted }: {
     readonly header: JwtHeader;
     rawHeader: string;
     readonly payload: IdToken;
     rawPayload: string;
     signature: string;
-    trusted?: TrustConfiguration[];
+    trusted?: Trust[];
 }): Promise<void>;
-export declare function validateIdToken(token: string, trusted?: TrustConfiguration[]): Promise<IdToken>;
+export declare function decode(token: string, trusted: Trust[] | undefined, stash: Stash): Promise<IdToken>;

package/components/identity.federation/operations/lib/jwt.js

@@ -26,9 +26,10 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.validateIdToken = exports.validateSignature = exports.validateJwtPayload = exports.validateJwtHeader = exports.decodeJwt = void 0;
+exports.decode = exports.validateSignature = exports.validateJwtPayload = exports.validateJwtHeader = exports.decodeJwt = void 0;
 const node_crypto_1 = __importDefault(require("node:crypto"));
 const assert = __importStar(require("node:assert"));
+const get_1 = require("./get");
 function decodeJwt(token) {
     const [rawHeader, rawPayload, signature] = token.split('.', 3);
     const header = JSON.parse(Buffer.from(rawHeader, 'base64url').toString());
@@ -44,19 +45,25 @@ function validateJwtHeader(header) {
     assert.ok(!('kid' in header) || typeof header.kid === 'string', 'kid must be a string if present');
 }
 exports.validateJwtHeader = validateJwtHeader;
-function validateJwtPayload(payload, trusted = [], header) {
+function validateJwtPayload(payload, trusted, header) {
     assert.ok(trusted.length > 0, 'No trusted issuers provided');
-    // full list of validations is
+    // the full list of validations is
     // at https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation
     assert.ok(payload !== null && typeof payload === 'object', 'Payload is not an object');
     assert.ok('iss' in payload, 'Payload is missing iss');
     assert.ok(typeof payload.iss === 'string', 'Payload iss is not a string');
     assert.ok('aud' in payload, 'Payload is missing aud');
-    assert.ok(typeof payload.aud === 'string', 'Payload aud is not a string');
-    const issuer = trusted.find((config) => config.issuer === payload.iss);
-    assert.ok(issuer !== undefined &&
-        (issuer.audience === undefined || issuer.audience.some((a) => a === payload.aud),
-            `Unknown issuer / audience: ${payload.iss} / ${payload.aud}`));
+    assert.ok(typeof payload.aud === 'string' ||
+        (Array.isArray(payload.aud) && payload.aud.every((e) => typeof e === 'string')), 'Payload aud is not a string nor an array of strings');
+    const issuer = trusted.find((config) => config.iss === payload.iss);
+    assert.ok(issuer, `Unknown issuer: ${payload.iss}`);
+    if (Array.isArray(issuer.aud)) {
+        const tokenAud = payload.aud;
+        if (typeof tokenAud === 'string')
+            assert.ok(issuer.aud.some((a) => a === tokenAud), `Unknown audience: ${tokenAud}`);
+        else
+            assert.ok(issuer.aud.some((a) => tokenAud.includes(a)), `Unknown audiences: ${tokenAud.join(', ')}`);
+    }
     if (header.alg.startsWith('HS')) {
         const secrets = issuer.secrets;
         assert.ok(secrets, `We don't have known secrets for ${payload.iss}`);
@@ -78,13 +85,14 @@ function validateJwtPayload(payload, trusted = [], header) {
         assert.ok(typeof payload.nbf === 'number', 'Payload nbf is not a number');
         assert.ok(Date.now() >= payload.nbf * 1000, 'Token is not valid yet');
     }
+    if ('jti' in payload)
+        assert.ok(typeof payload.jti === 'string', 'Payload jti is not a string');
 }
 exports.validateJwtPayload = validateJwtPayload;
 async function validateSignature({ header: { kid, alg }, payload: { iss }, rawHeader, rawPayload, signature, trusted = [] }) {
     if (alg.startsWith('HS')) {
         // symmetric algorithm, issuer is validated at this point
-        // eslint-disable-next-line @typescript-eslint/no-non-null-assertion -- `kid` is validated
-        const secrets = trusted.find((c) => c.issuer === iss).secrets[alg];
+        const secrets = trusted.find((c) => c.iss === iss).secrets[alg];
         const secret = kid !== undefined ? secrets[kid] : Object.values(secrets)[0];
         const algorithm = alg.replace(/^HS(\d{3})$/, 'sha$1'); // HS256 -> sha256
         const hmac = node_crypto_1.default.createHmac(algorithm, secret);
@@ -95,19 +103,17 @@ async function validateSignature({ header: { kid, alg }, payload: { iss }, rawHe
         return;
     }
     // Getting issuer public keys
-    const oidcRequest = await fetch(`${iss}/.well-known/openid-configuration`, {
-        cache: 'default'
-    });
+    const oidcRequest = await (0, get_1.get)(new URL('/.well-known/openid-configuration', iss).href);
     assert.ok(oidcRequest.ok, `Failed to fetch OpenID configuration: ${oidcRequest.statusText}`);
     const { jwks_uri: jwksUri } = (await oidcRequest.json());
-    const jwkRequest = await fetch(jwksUri, { cache: 'default' });
+    const jwkRequest = await (0, get_1.get)(jwksUri);
     assert.ok(jwkRequest.ok, `Failed to fetch issuer keys: ${jwkRequest.statusText}`);
     const { keys } = (await jwkRequest.json());
-    // getting corresponding signing key
+    // getting the corresponding signing key
     const signingKeys = keys.filter((k) => k.use === 'sig' && k.alg === alg);
     assert.ok(signingKeys.length > 0, 'No acceptable signing keys found');
-    assert.ok(kid === undefined || signingKeys.length === 1, 'Signing key selection is not deterministic');
-    const signingKey = kid === undefined ? signingKeys.find((k) => k.kid === kid) : keys[0];
+    assert.ok(kid !== undefined || signingKeys.length === 1, 'Signing key selection is not deterministic');
+    const signingKey = kid === undefined ? keys[0] : signingKeys.find((k) => k.kid === kid);
     assert.ok(signingKey, 'Signing key was not found in issuer keys');
     const verifyFunction = node_crypto_1.default.createVerify('RSA-SHA256');
     verifyFunction.write(rawHeader);
@@ -118,10 +124,20 @@ async function validateSignature({ header: { kid, alg }, payload: { iss }, rawHe
     assert.ok(signatureValid, 'Failed to validate signature');
 }
 exports.validateSignature = validateSignature;
-async function validateIdToken(token, trusted) {
+async function validateJti(token, stash) {
+    const key = `identity:federation:jti:${token.jti}`;
+    const used = await stash.exists(key);
+    assert.ok(used === 0, 'Token has already been used');
+    const ttl = token.exp - Math.floor(Date.now() / 1000);
+    await stash.set(key, '1', 'EX', ttl);
+}
+async function decode(token, trusted, stash) {
+    assert.ok(trusted !== undefined, 'No trusted issuers provided');
     const { header, payload, rawHeader, rawPayload, signature } = decodeJwt(token);
     validateJwtHeader(header);
     validateJwtPayload(payload, trusted, header);
+    if (payload.jti !== undefined)
+        await validateJti(payload, stash);
     await validateSignature({
         header,
         rawHeader,
@@ -132,5 +148,5 @@ async function validateIdToken(token, trusted) {
     });
     return payload;
 }
-exports.validateIdToken = validateIdToken;
+exports.decode = decode;
 //# sourceMappingURL=jwt.js.map

package/components/identity.federation/operations/lib/jwt.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../source/lib/jwt.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,8DAAgC;AAChC,oDAAqC;AAIrC,SAAgB,SAAS,CAAE,KAAa;IAOtC,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;IAE9D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAA;IACzE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAA;IAE3E,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,CAAA;AAC9D,CAAC;AAbD,8BAaC;AAED,SAAgB,iBAAiB,CAAE,MAAe;IAChD,MAAM,CAAC,EAAE,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,yBAAyB,CAAC,CAAA;IACnF,MAAM,CAAC,EAAE,CAAC,KAAK,IAAI,MAAM,EAAE,uBAAuB,CAAC,CAAA;IACnD,MAAM,CAAC,EAAE,CAAC,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,4BAA4B,CAAC,CAAA;IACvE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,iBAAiB,EAAE,qBAAqB,MAAM,CAAC,GAAG,EAAE,CAAC,CAAA;IAC9E,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,iCAAiC,CAAC,CAAA;AACpG,CAAC;AAND,8CAMC;AAED,SAAgB,kBAAkB,CAAE,OAAgB,EAClD,UAAgC,EAAE,EAClC,MAAiB;IACjB,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,6BAA6B,CAAC,CAAA;IAE5D,8BAA8B;IAC9B,6EAA6E;IAC7E,MAAM,CAAC,EAAE,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,0BAA0B,CAAC,CAAA;IAEtF,MAAM,CAAC,EAAE,CAAC,KAAK,IAAI,OAAO,EAAE,wBAAwB,CAAC,CAAA;IACrD,MAAM,CAAC,EAAE,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,6BAA6B,CAAC,CAAA;IACzE,MAAM,CAAC,EAAE,CAAC,KAAK,IAAI,OAAO,EAAE,wBAAwB,CAAC,CAAA;IACrD,MAAM,CAAC,EAAE,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,6BAA6B,CAAC,CAAA;IAEzE,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC,GAAG,CAAC,CAAA;IAEtE,MAAM,CAAC,EAAE,CAAC,MAAM,KAAK,SAAS;QAC1B,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC;YAChF,8BAA8B,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;IAElE,IAAI,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAA;QAE9B,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,mCAAmC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;QAEpE,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAEhC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,wBAAwB,MAAM,CAAC,GAAG,EAAE,CAAC,CAAA;QAErD,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;YAChC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,EAAE,aAAa,MAAM,CAAC,GAAG,iBAAiB,MAAM,CAAC,GAAG,EAAE,CAAC,CAAA;IACvF,CAAC;IAED,MAAM,CAAC,EAAE,CAAC,KAAK,IAAI,OAAO,EAAE,wBAAwB,CAAC,CAAA;IACrD,MAAM,CAAC,EAAE,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,6BAA6B,CAAC,CAAA;IAEzE,MAAM,CAAC,EAAE,CAAC,KAAK,IAAI,OAAO,EAAE,wBAAwB,CAAC,CAAA;IACrD,MAAM,CAAC,EAAE,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,6BAA6B,CAAC,CAAA;IACzE,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,EAAE,kBAAkB,CAAC,CAAA;IAE9D,MAAM,CAAC,EAAE,CAAC,KAAK,IAAI,OAAO,EAAE,wBAAwB,CAAC,CAAA;IACrD,MAAM,CAAC,EAAE,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,6BAA6B,CAAC,CAAA;IACzE,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,EAAE,gCAAgC,CAAC,CAAA;IAC7E,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAAA;IAElE,IAAI,KAAK,IAAI,OAAO,EAAE,CAAC;QACrB,MAAM,CAAC,EAAE,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,6BAA6B,CAAC,CAAA;QACzE,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,EAAE,wBAAwB,CAAC,CAAA;IACvE,CAAC;AACH,CAAC;AAjDD,gDAiDC;AAEM,KAAK,UAAU,iBAAiB,CAAE,EACvC,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EACpB,OAAO,EAAE,EAAE,GAAG,EAAE,EAChB,SAAS,EACT,UAAU,EACV,SAAS,EACT,OAAO,GAAG,EAAE,EAQb;IACC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,yDAAyD;QACzD,0FAA0F;QAC1F,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,CAAE,CAAC,OAAQ,CAAC,GAAG,CAAC,CAAA;QACpE,MAAM,MAAM,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3E,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA,CAAC,kBAAkB;QACxE,MAAM,IAAI,GAAG,qBAAM,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;QAEjD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QACtB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAChB,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;QACvB,MAAM,CAAC,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,0BAA0B,CAAC,CAAA;QAEnF,OAAM;IACR,CAAC;IAED,6BAA6B;IAC7B,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,mCAAmC,EAAE;QACzE,KAAK,EAAE,SAAS;KACjB,CAAC,CAAA;IAEF,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EACtB,yCAAyC,WAAW,CAAC,UAAU,EAAE,CAAC,CAAA;IAEpE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,WAAW,CAAC,IAAI,EAAE,CAAyB,CAAA;IAEhF,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAA;IAE7D,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,gCAAgC,UAAU,CAAC,UAAU,EAAE,CAAC,CAAA;IAEjF,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,CAExC,CAAA;IAED,oCAAoC;IACpC,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAA;IAExE,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,kCAAkC,CAAC,CAAA;IAErE,MAAM,CAAC,EAAE,CAAC,GAAG,KAAK,SAAS,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EACrD,4CAA4C,CAAC,CAAA;IAE/C,MAAM,UAAU,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAEvF,MAAM,CAAC,EAAE,CAAC,UAAU,EAAE,0CAA0C,CAAC,CAAA;IAEjE,MAAM,cAAc,GAAG,qBAAM,CAAC,YAAY,CAAC,YAAY,CAAC,CAAA;IAExD,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IAC/B,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACzB,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IAChC,cAAc,CAAC,GAAG,EAAE,CAAA;IAEpB,MAAM,cAAc,GAAG,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,EAC7E,SAAS,EACT,WAAW,CAAC,CAAA;IAEd,MAAM,CAAC,EAAE,CAAC,cAAc,EAAE,8BAA8B,CAAC,CAAA;AAC3D,CAAC;AAzED,8CAyEC;AAEM,KAAK,UAAU,eAAe,CAAE,KAAa,EAClD,OAA8B;IAC9B,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;IAE9E,iBAAiB,CAAC,MAAM,CAAC,CAAA;IACzB,kBAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;IAC5C,MAAM,iBAAiB,CAAC;QACtB,MAAM;QACN,SAAS;QACT,OAAO;QACP,UAAU;QACV,SAAS;QACT,OAAO;KACR,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC;AAhBD,0CAgBC"}
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../source/lib/jwt.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,8DAAgC;AAChC,oDAAqC;AACrC,+BAA2B;AAI3B,SAAgB,SAAS,CAAE,KAAa;IAOtC,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;IAE9D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAA;IACzE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAA;IAE3E,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,CAAA;AAC9D,CAAC;AAbD,8BAaC;AAED,SAAgB,iBAAiB,CAAE,MAAe;IAChD,MAAM,CAAC,EAAE,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,yBAAyB,CAAC,CAAA;IACnF,MAAM,CAAC,EAAE,CAAC,KAAK,IAAI,MAAM,EAAE,uBAAuB,CAAC,CAAA;IACnD,MAAM,CAAC,EAAE,CAAC,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,4BAA4B,CAAC,CAAA;IACvE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,iBAAiB,EAAE,qBAAqB,MAAM,CAAC,GAAG,EAAE,CAAC,CAAA;IAC9E,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,iCAAiC,CAAC,CAAA;AACpG,CAAC;AAND,8CAMC;AAED,SAAgB,kBAAkB,CAAE,OAAgB,EAClD,OAAgB,EAChB,MAAiB;IACjB,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,6BAA6B,CAAC,CAAA;IAE5D,kCAAkC;IAClC,6EAA6E;IAC7E,MAAM,CAAC,EAAE,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,0BAA0B,CAAC,CAAA;IAEtF,MAAM,CAAC,EAAE,CAAC,KAAK,IAAI,OAAO,EAAE,wBAAwB,CAAC,CAAA;IACrD,MAAM,CAAC,EAAE,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,6BAA6B,CAAC,CAAA;IACzE,MAAM,CAAC,EAAE,CAAC,KAAK,IAAI,OAAO,EAAE,wBAAwB,CAAC,CAAA;IACrD,MAAM,CAAC,EAAE,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QACvC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,EAC9F,qDAAqD,CAAC,CAAA;IAEtD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,CAAC,CAAA;IAEnE,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,mBAAmB,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;IAEnD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAA;QAE5B,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAC9B,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,CAAC,EAAE,qBAAqB,QAAQ,EAAE,CAAC,CAAA;;YAElF,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,sBAAsB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACxG,CAAC;IAED,IAAI,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAA;QAE9B,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,mCAAmC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;QAEpE,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAEhC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,wBAAwB,MAAM,CAAC,GAAG,EAAE,CAAC,CAAA;QAErD,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;YAChC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,EAAE,aAAa,MAAM,CAAC,GAAG,iBAAiB,MAAM,CAAC,GAAG,EAAE,CAAC,CAAA;IACvF,CAAC;IAED,MAAM,CAAC,EAAE,CAAC,KAAK,IAAI,OAAO,EAAE,wBAAwB,CAAC,CAAA;IACrD,MAAM,CAAC,EAAE,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,6BAA6B,CAAC,CAAA;IAEzE,MAAM,CAAC,EAAE,CAAC,KAAK,IAAI,OAAO,EAAE,wBAAwB,CAAC,CAAA;IACrD,MAAM,CAAC,EAAE,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,6BAA6B,CAAC,CAAA;IACzE,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,EAAE,kBAAkB,CAAC,CAAA;IAE9D,MAAM,CAAC,EAAE,CAAC,KAAK,IAAI,OAAO,EAAE,wBAAwB,CAAC,CAAA;IACrD,MAAM,CAAC,EAAE,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,6BAA6B,CAAC,CAAA;IACzE,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,EAAE,gCAAgC,CAAC,CAAA;IAC7E,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAAA;IAElE,IAAI,KAAK,IAAI,OAAO,EAAE,CAAC;QACrB,MAAM,CAAC,EAAE,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,6BAA6B,CAAC,CAAA;QACzE,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,EAAE,wBAAwB,CAAC,CAAA;IACvE,CAAC;IAED,IAAI,KAAK,IAAI,OAAO;QAClB,MAAM,CAAC,EAAE,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,6BAA6B,CAAC,CAAA;AAC7E,CAAC;AA7DD,gDA6DC;AAEM,KAAK,UAAU,iBAAiB,CAAE,EACvC,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EACpB,OAAO,EAAE,EAAE,GAAG,EAAE,EAChB,SAAS,EACT,UAAU,EACV,SAAS,EACT,OAAO,GAAG,EAAE,EAQb;IACC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,yDAAyD;QAEzD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAE,CAAC,OAAQ,CAAC,GAAG,CAAC,CAAA;QACjE,MAAM,MAAM,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3E,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA,CAAC,kBAAkB;QACxE,MAAM,IAAI,GAAG,qBAAM,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;QAEjD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QACtB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAChB,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;QACvB,MAAM,CAAC,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,0BAA0B,CAAC,CAAA;QAEnF,OAAM;IACR,CAAC;IAED,6BAA6B;IAC7B,MAAM,WAAW,GAAG,MAAM,IAAA,SAAG,EAAC,IAAI,GAAG,CAAC,mCAAmC,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAA;IAErF,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EACtB,yCAAyC,WAAW,CAAC,UAAU,EAAE,CAAC,CAAA;IAEpE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,WAAW,CAAC,IAAI,EAAE,CAAyB,CAAA;IAEhF,MAAM,UAAU,GAAG,MAAM,IAAA,SAAG,EAAC,OAAO,CAAC,CAAA;IAErC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,gCAAgC,UAAU,CAAC,UAAU,EAAE,CAAC,CAAA;IAEjF,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,CAExC,CAAA;IAED,wCAAwC;IACxC,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAA;IAExE,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,kCAAkC,CAAC,CAAA;IAErE,MAAM,CAAC,EAAE,CAAC,GAAG,KAAK,SAAS,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EACrD,4CAA4C,CAAC,CAAA;IAE/C,MAAM,UAAU,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAA;IAEvF,MAAM,CAAC,EAAE,CAAC,UAAU,EAAE,0CAA0C,CAAC,CAAA;IAEjE,MAAM,cAAc,GAAG,qBAAM,CAAC,YAAY,CAAC,YAAY,CAAC,CAAA;IAExD,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IAC/B,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACzB,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IAChC,cAAc,CAAC,GAAG,EAAE,CAAA;IAEpB,MAAM,cAAc,GAAG,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,EAC7E,SAAS,EACT,WAAW,CAAC,CAAA;IAEd,MAAM,CAAC,EAAE,CAAC,cAAc,EAAE,8BAA8B,CAAC,CAAA;AAC3D,CAAC;AAvED,8CAuEC;AAED,KAAK,UAAU,WAAW,CAAE,KAAc,EAAE,KAAY;IACtD,MAAM,GAAG,GAAG,2BAA2B,KAAK,CAAC,GAAG,EAAE,CAAA;IAClD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IAEpC,MAAM,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,EAAE,6BAA6B,CAAC,CAAA;IAEpD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IAErD,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAA;AACtC,CAAC;AAEM,KAAK,UAAU,MAAM,CAAE,KAAa,EAAE,OAA4B,EAAE,KAAY;IACrF,MAAM,CAAC,EAAE,CAAC,OAAO,KAAK,SAAS,EAAE,6BAA6B,CAAC,CAAA;IAE/D,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;IAE9E,iBAAiB,CAAC,MAAM,CAAC,CAAA;IACzB,kBAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;IAE5C,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS;QAC3B,MAAM,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IAEnC,MAAM,iBAAiB,CAAC;QACtB,MAAM;QACN,SAAS;QACT,OAAO;QACP,UAAU;QACV,SAAS;QACT,OAAO;KACR,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC;AArBD,wBAqBC"}