@toa.io/extensions.exposition 1.0.0-alpha.31 → 1.0.0-alpha.310

package/transpiled/directives/auth/Assert.js

@@ -0,0 +1,33 @@
+import { newid } from '@toa.io/generic';
+import * as http from '../../HTTP/index.js';
+import { Incept } from './Incept.js';
+export class Assert {
+    disabled;
+    constructor(enabled) {
+        if (typeof enabled !== 'boolean')
+            throw new Error('`auth:assert` directive value must be a boolean');
+        this.disabled = !enabled;
+    }
+    /** It admits nobody: it is there to require a credential, not to authorize one. */
+    admits() {
+        return false;
+    }
+    async authorize(identity, context) {
+        if (!this.disabled)
+            await this.incept(context, identity);
+        return false;
+    }
+    async incept(context, identity) {
+        if (context.request.headers.authorization === undefined)
+            throw new http.Unauthorized();
+        if (identity === null) {
+            if (!Incept.acceptable(context))
+                throw new http.Unauthorized();
+            context.identity = await Incept.incept(context, newid());
+            context.pipelines.response.push((response) => {
+                response.status = 201;
+            });
+        }
+    }
+}
+//# sourceMappingURL=Assert.js.map

package/transpiled/directives/auth/Assert.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Assert.js","sourceRoot":"","sources":["../../../source/directives/auth/Assert.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AACvC,OAAO,KAAK,IAAI,MAAM,qBAAqB,CAAA;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAGpC,MAAM,OAAO,MAAM;IACA,QAAQ,CAAS;IAElC,YAAmB,OAAgB;QACjC,IAAI,OAAO,OAAO,KAAK,SAAS;YAC9B,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;QAEpE,IAAI,CAAC,QAAQ,GAAG,CAAC,OAAO,CAAA;IAC1B,CAAC;IAED,mFAAmF;IAC5E,MAAM;QACX,OAAO,KAAK,CAAA;IACd,CAAC;IAEM,KAAK,CAAC,SAAS,CAAC,QAAyB,EAAE,OAAgB;QAChE,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;QAExD,OAAO,KAAK,CAAA;IACd,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,OAAgB,EAAE,QAAyB;QAC9D,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS;YAAE,MAAM,IAAI,IAAI,CAAC,YAAY,EAAE,CAAA;QAEtF,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;gBAAE,MAAM,IAAI,IAAI,CAAC,YAAY,EAAE,CAAA;YAE9D,OAAO,CAAC,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;YAExD,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE;gBAC3C,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAA;YACvB,CAAC,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;CACF"}

package/transpiled/directives/auth/Authorization.d.ts

@@ -1,19 +1,63 @@
-import * as http from '../../HTTP';
-import type { Output } from '../../io';
-import type { Remotes } from '../../Remotes';
-import type { Parameter, DirectiveFamily } from '../../RTD';
-import type { Directive, Extension, Input } from './types';
+import * as http from '../../HTTP/index.ts';
+import type { Output } from '../../io.ts';
+import type { Introspection } from '../../Introspection.ts';
+import type { Remotes } from '../../Remotes.ts';
+import type { Parameter, DirectiveFamily } from '../../RTD/index.ts';
+import type { Host } from '../../Factory.ts';
+import type { Directive, Extension, Context } from './types.ts';
 export declare class Authorization implements DirectiveFamily<Directive, Extension> {
     readonly depends: string[];
     readonly name: string;
     readonly mandatory: boolean;
-    private readonly schemes;
+    private readonly components;
     private readonly discovery;
     private tokens;
     private bans;
+    /** Failed authentications per address, reconciled with the other gateways. */
+    private meter;
+    private sync;
+    mount(host: Host, options: http.Options): void;
+    dispose(): void;
     create(name: string, value: any, remotes: Remotes): Directive;
-    preflight(directives: Directive[], input: Input, parameters: Parameter[]): Promise<Output>;
-    settle(directives: Directive[], request: Input, response: http.OutgoingMessage): Promise<void>;
+    arrange(directives: Directive[]): void;
+    /**
+     * Authentication: who the credential names, if one is presented. A credential belongs to
+     * the request, so it is read once however many calls the request carries.
+     */
+    preflight(context: Context): Promise<void>;
+    /** Authorization: whether that identity may make this call, which every call asks anew. */
+    precall(directives: Directive[], context: Context, parameters: Parameter[]): Promise<Output>;
+    /**
+     * The same disjunction as `precall`, over what can be told without a request. A method no
+     * directive admits, and none is undecided about, is not this caller's to be told about.
+     *
+     * A permission is matched against a path, and a description is not a request to one, so
+     * `permits` has no say here. The call it describes is still checked, which is where a
+     * token's permissions belong.
+     */
+    admits(directives: Directive[], context: Context): Promise<boolean>;
+    /**
+     * What the directives fill in of what the method says about itself. A pass of its own,
+     * and not the caller's: admission is a disjunction and stops at the first that admits,
+     * while what the directives fill is not any one of them's to state alone — and what it
+     * fills is filled from whoever calls, which is what a caller may not send for itself.
+     */
+    explain(directives: Directive[], introspection: Introspection): Introspection;
+    settle(directives: Directive[], context: Context, response: http.OutgoingMessage): Promise<void>;
+    /**
+     * Re-issuing a credential, and refusing a ban, are the request's business: the header
+     * carries one token however many calls were made, and a ban refuses all of them.
+     */
+    depart(context: Context, response: http.OutgoingMessage): Promise<void>;
     private resolve;
+    private permitted;
     private banned;
 }
+/** Whether the permissions admit the method on the path the request is routed by. */
+export declare function permits(permissions: Record<string, string[]>, method: string, pathname: string): boolean;
+/**
+ * Whether the request is one the token's `aud` was issued for. A path is a prefix of the
+ * entry; an origin (empty or `/`) is every path on that host. A URI whose host is not
+ * this request's is not this resource.
+ */
+export declare function audience(audiences: string[], url: URL): boolean;

package/transpiled/directives/auth/Authorization.js

@@ -1,132 +1,304 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.Authorization = void 0;
-const node_assert_1 = __importDefault(require("node:assert"));
-const matchacho_1 = require("matchacho");
-const http = __importStar(require("../../HTTP"));
-const Anonymous_1 = require("./Anonymous");
-const Id_1 = require("./Id");
-const Role_1 = require("./Role");
-const Rule_1 = require("./Rule");
-const Incept_1 = require("./Incept");
-const Echo_1 = require("./Echo");
-const Scheme_1 = require("./Scheme");
-const Delegate_1 = require("./Delegate");
-const split_1 = require("./split");
-const schemes_1 = require("./schemes");
-class Authorization {
+import { match } from 'matchacho';
+import { console } from 'openspan';
+import { Minimatch } from 'minimatch';
+import * as http from '../../HTTP/index.js';
+import { Anonymous } from './Anonymous.js';
+import { Id } from './Id.js';
+import { Role } from './Role.js';
+import { Rule } from './Rule.js';
+import { Incept } from './Incept.js';
+import { Assert } from './Assert.js';
+import { Echo } from './Echo.js';
+import { Scheme } from './Scheme.js';
+import { Delegate } from './Delegate.js';
+import { Federation } from './Federation.js';
+import { Anyone } from './Anyone.js';
+import { Input } from './Input.js';
+import { split } from './split.js';
+import { PRIMARY, UNRECOGNIZED, providers as providersOf } from './schemes.js';
+import { ATOM_GROUP } from '@toa.io/definitions/extensions.exposition';
+import { Quotas, Sync } from '../io/lib/throttle/index.js';
+import { Keys } from '../io/lib/throttle/Keys.js';
+export class Authorization {
     depends = ['Vary'];
     name = 'auth';
     mandatory = true;
-    schemes = {};
+    components = {};
     discovery = {};
     tokens = null;
     bans = null;
+    /** Failed authentications per address, reconciled with the other gateways. */
+    meter = null;
+    sync = null;
+    mount(host, options) {
+        this.sync?.dispose();
+        this.sync = null;
+        this.meter = null;
+        const bouncer = options.bouncer;
+        // keyed by address, which is the deployment's to name, so off until it is set
+        if (bouncer === undefined)
+            return;
+        this.meter = new Quotas({
+            keys: Keys.create([{ method: 'ip', options: BOUNCER }]),
+            requests: bouncer.attempts ?? ATTEMPTS,
+            interval: (bouncer.interval ?? INTERVAL) * 1000,
+            conditional: true, // charged on a rejection, not on a check
+            name: METER
+        });
+        this.sync = new Sync(host.atom(ATOM_GROUP));
+        this.sync.register(this.meter);
+    }
+    dispose() {
+        this.sync?.dispose();
+    }
     create(name, value, remotes) {
-        node_assert_1.default.ok(name in constructors, `Directive 'auth:${name}' is not implemented.`);
+        if (!(name in constructors))
+            throw new Error(`Directive 'auth:${name}' is not implemented`);
         const Class = constructors[name];
         for (const name of REMOTES)
             this.discovery[name] ??= remotes.discover('identity', name);
-        return (0, matchacho_1.match)(Class, Role_1.Role, () => new Role_1.Role(value, this.discovery.roles), Rule_1.Rule, () => new Rule_1.Rule(value, this.create.bind(this)), Incept_1.Incept, () => new Incept_1.Incept(value, this.discovery), () => new Class(value));
+        return match(Class, Role, () => new Role(value, this.discovery.roles), Rule, () => new Rule(value, this.create.bind(this)), Input, () => new Input(value, this.create.bind(this)), Incept, () => new Incept(value, this.discovery), Delegate, () => new Delegate(value, this.discovery.roles), () => new Class(value));
+    }
+    arrange(directives) {
+        directives.sort((a, b) => (a.priority ?? 1) - (b.priority ?? 1));
+    }
+    /**
+     * Authentication: who the credential names, if one is presented. A credential belongs to
+     * the request, so it is read once however many calls the request carries.
+     */
+    async preflight(context) {
+        context.identity = await this.resolve(context);
+        // the outer request, not a procedure it forks: `aud` is where this credential may
+        // appear, and a tool call is still the request to `/.mcp`
+        if (context.identity?.aud !== undefined &&
+            !audience(context.identity.aud, context.url))
+            throw new http.Unauthorized();
     }
-    async preflight(directives, input, parameters) {
-        const identity = await this.resolve(input.authority, input.request.headers.authorization);
-        input.identity = identity;
+    /** Authorization: whether that identity may make this call, which every call asks anew. */
+    async precall(directives, context, parameters) {
+        // `auth:incept` reads the identity out of the reply at settle, so the reply reaches the
+        // gateway as values rather than as the bytes it would otherwise pass on
+        if (directives.some((directive) => directive instanceof Incept))
+            context.reads = true;
         for (const directive of directives) {
-            const allow = await directive.authorize(identity, input, parameters);
+            const allow = await directive.authorize(context.identity, context, parameters);
             if (allow)
-                return directive.reply?.(identity) ?? null;
+                if (this.permitted(context))
+                    return directive.reply?.(context) ?? null;
+                else
+                    throw new http.Forbidden();
         }
-        if (identity === null)
+        if (context.identity === null)
             throw new http.Unauthorized();
         else
             throw new http.Forbidden();
     }
-    async settle(directives, request, response) {
+    /**
+     * The same disjunction as `precall`, over what can be told without a request. A method no
+     * directive admits, and none is undecided about, is not this caller's to be told about.
+     *
+     * A permission is matched against a path, and a description is not a request to one, so
+     * `permits` has no say here. The call it describes is still checked, which is where a
+     * token's permissions belong.
+     */
+    async admits(directives, context) {
+        let untold = false;
+        for (const directive of directives) {
+            const admits = await directive.admits?.(context.identity, context);
+            if (admits === undefined) {
+                untold = true;
+                continue;
+            }
+            if (admits)
+                return true;
+        }
+        return untold;
+    }
+    /**
+     * What the directives fill in of what the method says about itself. A pass of its own,
+     * and not the caller's: admission is a disjunction and stops at the first that admits,
+     * while what the directives fill is not any one of them's to state alone — and what it
+     * fills is filled from whoever calls, which is what a caller may not send for itself.
+     */
+    explain(directives, introspection) {
         for (const directive of directives)
-            await directive.settle?.(request, response);
-        const identity = request.identity;
+            introspection = directive.describe?.(introspection) ?? introspection;
+        return introspection;
+    }
+    async settle(directives, context, response) {
+        await Promise.all(directives.map(async (directive) => directive.settle?.(context, response)));
+    }
+    /**
+     * Re-issuing a credential, and refusing a ban, are the request's business: the header
+     * carries one token however many calls were made, and a ban refuses all of them.
+     */
+    async depart(context, response) {
+        const identity = context.identity;
         if (identity === null)
             return;
-        if (identity.scheme === schemes_1.PRIMARY && !identity.refresh)
+        if (identity.provider === PRIMARY && !identity.refresh)
             return;
-        // Role directive may have already set the value
-        if (identity.roles === undefined)
-            await Role_1.Role.set(identity, this.discovery.roles);
+        // resolving already asked, for any provider but the primary
+        if (context.vetted !== true && (await this.banned(identity)))
+            throw new http.Unauthorized();
+        // a token carries the roles it was issued with, and the refresh is where they are read again;
+        // any other scheme has just read them, unless a Role directive already did
+        if (identity.provider === PRIMARY)
+            identity.roles = await Role.get(identity, this.discovery.roles);
+        else
+            identity.roles ??= await Role.get(identity, this.discovery.roles);
         this.tokens ??= await this.discovery.tokens;
         const token = await this.tokens.invoke('encrypt', {
-            input: { authority: request.authority, identity }
+            input: { authority: context.authority, identity }
         });
         const authorization = `Token ${token}`;
         response.headers ??= new Headers();
         response.headers.set('authorization', authorization);
-        response.headers.append('cache-control', 'no-store');
+        response.headers.set('cache-control', 'no-store');
     }
-    async resolve(authority, authorization) {
+    async resolve(context) {
+        const { authority } = context;
+        const { authorization } = context.request.headers;
         if (authorization === undefined)
             return null;
-        const [scheme, credentials] = (0, split_1.split)(authorization);
-        const provider = schemes_1.PROVIDERS[scheme];
-        if (!(provider in this.discovery))
-            throw new http.Unauthorized(`Unknown authentication scheme '${scheme}'.`);
-        this.schemes[scheme] ??= await this.discovery[provider];
-        const result = await this.schemes[scheme].invoke('authenticate', {
-            input: {
-                authority,
-                credentials
+        const retry = this.meter?.check(context, NONE) ?? 0;
+        if (retry > 0)
+            throw new http.TooManyRequests(retry);
+        const [scheme, credentials] = split(authorization);
+        const candidates = providersOf(scheme);
+        if (candidates === undefined)
+            throw new http.Unauthorized(`Unknown authentication scheme '${scheme}'`);
+        let provider = null;
+        let result = null;
+        // the first provider that does not decline has claimed the credentials, and answers
+        // for them: a rejection from one that never recognized them is not the rejection
+        for (const candidate of candidates) {
+            this.components[candidate] ??= await this.discovery[candidate];
+            const answer = await this.components[candidate].invoke('authenticate', {
+                input: {
+                    scheme,
+                    authority,
+                    credentials
+                }
+            });
+            if (declined(answer))
+                continue;
+            provider = candidate;
+            result = answer;
+            break;
+        }
+        if (result === null || result instanceof Error) {
+            const code = result === null ? UNRECOGNIZED : codeOf(result);
+            if (code !== undefined) {
+                console.info('Authentication failed', { code });
+                context.rejection = code;
             }
-        });
-        if (result instanceof Error)
+            this.meter?.use(context, null);
             return null;
+        }
         const identity = result.identity;
-        if (scheme !== schemes_1.PRIMARY && (await this.banned(identity)))
-            throw new http.Unauthorized();
+        if (provider !== PRIMARY) {
+            if (await this.banned(identity))
+                throw new http.Unauthorized();
+            context.vetted = true;
+        }
         identity.scheme = scheme;
+        identity.provider = provider;
         identity.refresh = result.refresh;
         return identity;
     }
+    permitted(context) {
+        const permissions = context.identity?.permissions;
+        if (permissions === undefined)
+            return true;
+        // the route is matched on the normalized path, so the permission is too
+        return permits(permissions, context.request.method, context.url.pathname);
+    }
     async banned(identity) {
         this.bans ??= await this.discovery.bans;
         const ban = await this.bans.invoke('observe', { query: { id: identity.id } });
         return ban.banned;
     }
 }
-exports.Authorization = Authorization;
+/** Whether a provider says the credentials are not of its kind, so the next is asked. */
+function declined(result) {
+    return result instanceof Error && codeOf(result) === UNRECOGNIZED;
+}
+function codeOf(result) {
+    const code = result.code;
+    return typeof code === 'string' ? code : undefined;
+}
+/** Whether the permissions admit the method on the path the request is routed by. */
+export function permits(permissions, method, pathname) {
+    return Object.entries(permissions).some(([pattern, methods]) => methods.some((allowed) => allowed === '*' || allowed === method) &&
+        glob(pattern).match(pathname));
+}
+/**
+ * Whether the request is one the token's `aud` was issued for. A path is a prefix of the
+ * entry; an origin (empty or `/`) is every path on that host. A URI whose host is not
+ * this request's is not this resource.
+ */
+export function audience(audiences, url) {
+    return audiences.some((value) => covers(value, url));
+}
+function covers(value, url) {
+    if (value.startsWith('/'))
+        return prefixed(value, url.pathname);
+    let resource;
+    try {
+        resource = new URL(value);
+    }
+    catch {
+        return false;
+    }
+    if (resource.hostname !== url.hostname)
+        return false;
+    return prefixed(resource.pathname, url.pathname);
+}
+function prefixed(declared, pathname) {
+    const prefix = declared.endsWith('/') ? declared.slice(0, -1) : declared;
+    if (prefix === '')
+        return true;
+    return pathname === prefix || pathname.startsWith(prefix + '/');
+}
+/**
+ * `minimatch(str, pattern)` compiles the pattern on every call, and a permission is
+ * matched on every request the identity makes. Patterns arrive with an identity, hence
+ * the bound.
+ */
+function glob(pattern) {
+    let compiled = GLOBS.get(pattern);
+    if (compiled === undefined) {
+        if (GLOBS.size >= GLOBS_LIMIT)
+            GLOBS.clear();
+        compiled = new Minimatch(pattern);
+        GLOBS.set(pattern, compiled);
+    }
+    return compiled;
+}
+/** What an address may fail at once, and the seconds it takes to earn them back. */
+const ATTEMPTS = 20;
+const INTERVAL = 60;
+/** Who is speaking when a request cannot be keyed. */
+const BOUNCER = 'Authentication bouncer';
+/** The meter's name in the atom: `atom:exposition:meter:credentials:<address>`. */
+const METER = 'credentials';
+const NONE = [];
+const GLOBS = new Map();
+const GLOBS_LIMIT = 1024;
 const constructors = {
-    anonymous: Anonymous_1.Anonymous,
-    id: Id_1.Id,
-    role: Role_1.Role,
-    rule: Rule_1.Rule,
-    incept: Incept_1.Incept,
-    scheme: Scheme_1.Scheme,
-    echo: Echo_1.Echo,
-    delegate: Delegate_1.Delegate
+    anonymous: Anonymous,
+    anyone: Anyone,
+    id: Id,
+    role: Role,
+    rule: Rule,
+    incept: Incept,
+    assert: Assert,
+    scheme: Scheme,
+    echo: Echo,
+    delegate: Delegate,
+    claims: Federation,
+    input: Input
 };
-const REMOTES = ['basic', 'federation', 'tokens', 'roles', 'bans'];
+const REMOTES = ['basic', 'federation', 'tokens', 'roles', 'bans', 'otp'];
 //# sourceMappingURL=Authorization.js.map

package/transpiled/directives/auth/Authorization.js.map

@@ -1 +1 @@
-{"version":3,"file":"Authorization.js","sourceRoot":"","sources":["../../../source/directives/auth/Authorization.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,8DAAgC;AAChC,yCAAiC;AACjC,iDAAkC;AAClC,2CAAuC;AACvC,6BAAyB;AACzB,iCAA6B;AAC7B,iCAA6B;AAC7B,qCAAiC;AACjC,iCAA6B;AAC7B,qCAAiC;AACjC,yCAAqC;AACrC,mCAA+B;AAC/B,uCAA8C;AAiB9C,MAAa,aAAa;IACR,OAAO,GAAa,CAAC,MAAM,CAAC,CAAA;IAC5B,IAAI,GAAW,MAAM,CAAA;IACrB,SAAS,GAAY,IAAI,CAAA;IAExB,OAAO,GAAG,EAAwB,CAAA;IAClC,SAAS,GAAG,EAA0B,CAAA;IAC/C,MAAM,GAAqB,IAAI,CAAA;IAC/B,IAAI,GAAqB,IAAI,CAAA;IAE9B,MAAM,CAAE,IAAY,EAAE,KAAU,EAAE,OAAgB;QACvD,qBAAM,CAAC,EAAE,CAAC,IAAI,IAAI,YAAY,EAC5B,mBAAmB,IAAI,uBAAuB,CAAC,CAAA;QAEjD,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;QAEhC,KAAK,MAAM,IAAI,IAAI,OAAO;YACxB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;QAE7D,OAAO,IAAA,iBAAK,EAAC,KAAK,EAChB,WAAI,EAAE,GAAG,EAAE,CAAC,IAAI,WAAI,CAAC,KAA0B,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EACtE,WAAI,EAAE,GAAG,EAAE,CAAC,IAAI,WAAI,CAAC,KAA+B,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAC7E,eAAM,EAAE,GAAG,EAAE,CAAC,IAAI,eAAM,CAAC,KAAe,EAAE,IAAI,CAAC,SAAS,CAAC,EACzD,GAAG,EAAE,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAA;IAC3B,CAAC;IAEM,KAAK,CAAC,SAAS,CAAE,UAAuB,EAC7C,KAAY,EACZ,UAAuB;QACvB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;QAEzF,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAA;QAEzB,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,EAAE,UAAU,CAAC,CAAA;YAEpE,IAAI,KAAK;gBACP,OAAO,SAAS,CAAC,KAAK,EAAE,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAA;QAC9C,CAAC;QAED,IAAI,QAAQ,KAAK,IAAI;YACnB,MAAM,IAAI,IAAI,CAAC,YAAY,EAAE,CAAA;;YAE7B,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,CAAA;IAC9B,CAAC;IAEM,KAAK,CAAC,MAAM,CAAE,UAAuB,EAC1C,OAAc,EACd,QAA8B;QAC9B,KAAK,MAAM,SAAS,IAAI,UAAU;YAAE,MAAM,SAAS,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;QAE/E,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;QAEjC,IAAI,QAAQ,KAAK,IAAI;YACnB,OAAM;QAER,IAAI,QAAQ,CAAC,MAAM,KAAK,iBAAO,IAAI,CAAC,QAAQ,CAAC,OAAO;YAClD,OAAM;QAER,gDAAgD;QAChD,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS;YAC9B,MAAM,WAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;QAEhD,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAA;QAE3C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAS,SAAS,EAAE;YACxD,KAAK,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE;SAClD,CAAC,CAAA;QAEF,MAAM,aAAa,GAAG,SAAS,KAAK,EAAE,CAAA;QAEtC,QAAQ,CAAC,OAAO,KAAK,IAAI,OAAO,EAAE,CAAA;QAClC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,aAAa,CAAC,CAAA;QACpD,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAA;IACtD,CAAC;IAEO,KAAK,CAAC,OAAO,CAAE,SAAiB,EAAE,aAAiC;QACzE,IAAI,aAAa,KAAK,SAAS;YAC7B,OAAO,IAAI,CAAA;QAEb,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,IAAA,aAAK,EAAC,aAAa,CAAC,CAAA;QAClD,MAAM,QAAQ,GAAG,mBAAS,CAAC,MAAM,CAAC,CAAA;QAElC,IAAI,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC;YAC/B,MAAM,IAAI,IAAI,CAAC,YAAY,CAAC,kCAAkC,MAAM,IAAI,CAAC,CAAA;QAE3E,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;QAEvD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAuB,cAAc,EAAE;YACrF,KAAK,EAAE;gBACL,SAAS;gBACT,WAAW;aACZ;SACF,CAAC,CAAA;QAEF,IAAI,MAAM,YAAY,KAAK;YAAE,OAAO,IAAI,CAAA;QAExC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAA;QAEhC,IAAI,MAAM,KAAK,iBAAO,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAAE,MAAM,IAAI,IAAI,CAAC,YAAY,EAAE,CAAA;QAEtF,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAA;QACxB,QAAQ,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAA;QAEjC,OAAO,QAAQ,CAAA;IACjB,CAAC;IAEO,KAAK,CAAC,MAAM,CAAE,QAAkB;QACtC,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAA;QAEvC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAM,SAAS,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;QAElF,OAAO,GAAG,CAAC,MAAM,CAAA;IACnB,CAAC;CACF;AAlHD,sCAkHC;AAED,MAAM,YAAY,GAAkE;IAClF,SAAS,EAAE,qBAAS;IACpB,EAAE,EAAE,OAAE;IACN,IAAI,EAAE,WAAI;IACV,IAAI,EAAE,WAAI;IACV,MAAM,EAAE,eAAM;IACd,MAAM,EAAE,eAAM;IACd,IAAI,EAAE,WAAI;IACV,QAAQ,EAAE,mBAAQ;CACnB,CAAA;AAED,MAAM,OAAO,GAAa,CAAC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA"}
+{"version":3,"file":"Authorization.js","sourceRoot":"","sources":["../../../source/directives/auth/Authorization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAA;AAClC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AACrC,OAAO,KAAK,IAAI,MAAM,qBAAqB,CAAA;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,EAAE,EAAE,MAAM,SAAS,CAAA;AAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,KAAK,EAAoB,MAAM,YAAY,CAAA;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,IAAI,WAAW,EAAE,MAAM,cAAc,CAAA;AAC9E,OAAO,EAAE,UAAU,EAAE,MAAM,2CAA2C,CAAA;AACtE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,6BAA6B,CAAA;AAC1D,OAAO,EAAE,IAAI,EAAE,MAAM,4BAA4B,CAAA;AAmBjD,MAAM,OAAO,aAAa;IACR,OAAO,GAAa,CAAC,MAAM,CAAC,CAAA;IAC5B,IAAI,GAAW,MAAM,CAAA;IACrB,SAAS,GAAY,IAAI,CAAA;IAExB,UAAU,GAAe,EAAE,CAAA;IAC3B,SAAS,GAAG,EAA0B,CAAA;IAC/C,MAAM,GAAqB,IAAI,CAAA;IAC/B,IAAI,GAAqB,IAAI,CAAA;IAErC,8EAA8E;IACtE,KAAK,GAAkB,IAAI,CAAA;IAC3B,IAAI,GAAgB,IAAI,CAAA;IAEzB,KAAK,CAAC,IAAU,EAAE,OAAqB;QAC5C,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CAAA;QACpB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAA;QAEjB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAA;QAE/B,8EAA8E;QAC9E,IAAI,OAAO,KAAK,SAAS;YAAE,OAAM;QAEjC,IAAI,CAAC,KAAK,GAAG,IAAI,MAAM,CAAC;YACtB,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;YACvD,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,QAAQ;YACtC,QAAQ,EAAE,CAAC,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC,GAAG,IAAI;YAC/C,WAAW,EAAE,IAAI,EAAE,yCAAyC;YAC5D,IAAI,EAAE,KAAK;SACZ,CAAC,CAAA;QAEF,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAA;QAC3C,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAChC,CAAC;IAEM,OAAO;QACZ,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CAAA;IACtB,CAAC;IAEM,MAAM,CAAC,IAAY,EAAE,KAAU,EAAE,OAAgB;QACtD,IAAI,CAAC,CAAC,IAAI,IAAI,YAAY,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,sBAAsB,CAAC,CAAA;QAEhE,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;QAEhC,KAAK,MAAM,IAAI,IAAI,OAAO;YACxB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;QAE7D,OAAO,KAAK,CACV,KAAK,EACL,IAAI,EACJ,GAAG,EAAE,CAAC,IAAI,IAAI,CAAC,KAA0B,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAChE,IAAI,EACJ,GAAG,EAAE,CAAC,IAAI,IAAI,CAAC,KAA+B,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EACvE,KAAK,EACL,GAAG,EAAE,CAAC,IAAI,KAAK,CAAC,KAAsB,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAC/D,MAAM,EACN,GAAG,EAAE,CAAC,IAAI,MAAM,CAAC,KAAe,EAAE,IAAI,CAAC,SAAS,CAAC,EACjD,QAAQ,EACR,GAAG,EAAE,CAAC,IAAI,QAAQ,CAAC,KAAe,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EACzD,GAAG,EAAE,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CACvB,CAAA;IACH,CAAC;IAEM,OAAO,CAAC,UAAuB;QACpC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAA;IAClE,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,SAAS,CAAC,OAAgB;QACrC,OAAO,CAAC,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QAE9C,kFAAkF;QAClF,0DAA0D;QAC1D,IACE,OAAO,CAAC,QAAQ,EAAE,GAAG,KAAK,SAAS;YACnC,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC;YAE5C,MAAM,IAAI,IAAI,CAAC,YAAY,EAAE,CAAA;IACjC,CAAC;IAED,2FAA2F;IACpF,KAAK,CAAC,OAAO,CAClB,UAAuB,EACvB,OAAgB,EAChB,UAAuB;QAEvB,wFAAwF;QACxF,wEAAwE;QACxE,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,YAAY,MAAM,CAAC;YAAE,OAAO,CAAC,KAAK,GAAG,IAAI,CAAA;QAErF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC,CAAA;YAE9E,IAAI,KAAK;gBACP,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;oBAAE,OAAO,SAAS,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,IAAI,IAAI,CAAA;;oBACjE,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,CAAA;QACnC,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI;YAAE,MAAM,IAAI,IAAI,CAAC,YAAY,EAAE,CAAA;;YACvD,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,CAAA;IACjC,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,MAAM,CAAC,UAAuB,EAAE,OAAgB;QAC3D,IAAI,MAAM,GAAG,KAAK,CAAA;QAElB,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;YAElE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,GAAG,IAAI,CAAA;gBAEb,SAAQ;YACV,CAAC;YAED,IAAI,MAAM;gBAAE,OAAO,IAAI,CAAA;QACzB,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;IAED;;;;;OAKG;IACI,OAAO,CAAC,UAAuB,EAAE,aAA4B;QAClE,KAAK,MAAM,SAAS,IAAI,UAAU;YAChC,aAAa,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC,aAAa,CAAC,IAAI,aAAa,CAAA;QAEtE,OAAO,aAAa,CAAA;IACtB,CAAC;IAEM,KAAK,CAAC,MAAM,CACjB,UAAuB,EACvB,OAAgB,EAChB,QAA8B;QAE9B,MAAM,OAAO,CAAC,GAAG,CACf,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAC3E,CAAA;IACH,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,MAAM,CAAC,OAAgB,EAAE,QAA8B;QAClE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;QAEjC,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAM;QAE7B,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO;YAAE,OAAM;QAE9D,4DAA4D;QAC5D,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC1D,MAAM,IAAI,IAAI,CAAC,YAAY,EAAE,CAAA;QAE/B,8FAA8F;QAC9F,2EAA2E;QAC3E,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO;YAC/B,QAAQ,CAAC,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;;YAC5D,QAAQ,CAAC,KAAK,KAAK,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;QACtE,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAA;QAE3C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAS,SAAS,EAAE;YACxD,KAAK,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE;SAClD,CAAC,CAAA;QAEF,MAAM,aAAa,GAAG,SAAS,KAAK,EAAE,CAAA;QAEtC,QAAQ,CAAC,OAAO,KAAK,IAAI,OAAO,EAAE,CAAA;QAClC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,aAAa,CAAC,CAAA;QACpD,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAA;IACnD,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,OAAgB;QACpC,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAA;QAC7B,MAAM,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAA;QAEjD,IAAI,aAAa,KAAK,SAAS;YAAE,OAAO,IAAI,CAAA;QAE5C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAEnD,IAAI,KAAK,GAAG,CAAC;YAAE,MAAM,IAAI,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;QAEpD,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,CAAA;QAClD,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,CAAC,CAAA;QAEtC,IAAI,UAAU,KAAK,SAAS;YAC1B,MAAM,IAAI,IAAI,CAAC,YAAY,CAAC,kCAAkC,MAAM,GAAG,CAAC,CAAA;QAE1E,IAAI,QAAQ,GAAkB,IAAI,CAAA;QAClC,IAAI,MAAM,GAAgC,IAAI,CAAA;QAE9C,oFAAoF;QACpF,iFAAiF;QACjF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,KAAK,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;YAE9D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAE,CAAC,MAAM,CACrD,cAAc,EACd;gBACE,KAAK,EAAE;oBACL,MAAM;oBACN,SAAS;oBACT,WAAW;iBACZ;aACF,CACF,CAAA;YAED,IAAI,QAAQ,CAAC,MAAM,CAAC;gBAAE,SAAQ;YAE9B,QAAQ,GAAG,SAAS,CAAA;YACpB,MAAM,GAAG,MAAM,CAAA;YAEf,MAAK;QACP,CAAC;QAED,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,YAAY,KAAK,EAAE,CAAC;YAC/C,MAAM,IAAI,GAAG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YAE5D,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,OAAO,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;gBAE/C,OAAO,CAAC,SAAS,GAAG,IAAI,CAAA;YAC1B,CAAC;YAED,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAE9B,OAAO,IAAI,CAAA;QACb,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAA;QAEhC,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;gBAAE,MAAM,IAAI,IAAI,CAAC,YAAY,EAAE,CAAA;YAE9D,OAAO,CAAC,MAAM,GAAG,IAAI,CAAA;QACvB,CAAC;QAED,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAA;QACxB,QAAQ,CAAC,QAAQ,GAAG,QAAS,CAAA;QAC7B,QAAQ,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAA;QAEjC,OAAO,QAAQ,CAAA;IACjB,CAAC;IAEO,SAAS,CAAC,OAAgB;QAChC,MAAM,WAAW,GAAG,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAA;QAEjD,IAAI,WAAW,KAAK,SAAS;YAAE,OAAO,IAAI,CAAA;QAE1C,wEAAwE;QACxE,OAAO,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC3E,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,QAAkB;QACrC,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAA;QAEvC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAM,SAAS,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;QAElF,OAAO,GAAG,CAAC,MAAM,CAAA;IACnB,CAAC;CACF;AAED,yFAAyF;AACzF,SAAS,QAAQ,CAAC,MAA4B;IAC5C,OAAO,MAAM,YAAY,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,YAAY,CAAA;AACnE,CAAC;AAED,SAAS,MAAM,CAAC,MAAa;IAC3B,MAAM,IAAI,GAAsB,MAAsC,CAAC,IAAI,CAAA;IAE3E,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;AACpD,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,OAAO,CACrB,WAAqC,EACrC,MAAc,EACd,QAAgB;IAEhB,OAAO,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,IAAI,CACrC,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,CACrB,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,MAAM,CAAC;QAChE,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAChC,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,SAAmB,EAAE,GAAQ;IACpD,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAA;AACtD,CAAC;AAED,SAAS,MAAM,CAAC,KAAa,EAAE,GAAQ;IACrC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAA;IAE/D,IAAI,QAAa,CAAA;IAEjB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,QAAQ,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAA;IAEpD,OAAO,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAA;AAClD,CAAC;AAED,SAAS,QAAQ,CAAC,QAAgB,EAAE,QAAgB;IAClD,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAA;IAExE,IAAI,MAAM,KAAK,EAAE;QAAE,OAAO,IAAI,CAAA;IAE9B,OAAO,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,CAAA;AACjE,CAAC;AAED;;;;GAIG;AACH,SAAS,IAAI,CAAC,OAAe;IAC3B,IAAI,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAEjC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,IAAI,IAAI,WAAW;YAAE,KAAK,CAAC,KAAK,EAAE,CAAA;QAE5C,QAAQ,GAAG,IAAI,SAAS,CAAC,OAAO,CAAC,CAAA;QAEjC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;IAC9B,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,oFAAoF;AACpF,MAAM,QAAQ,GAAG,EAAE,CAAA;AACnB,MAAM,QAAQ,GAAG,EAAE,CAAA;AAEnB,sDAAsD;AACtD,MAAM,OAAO,GAAG,wBAAwB,CAAA;AAExC,mFAAmF;AACnF,MAAM,KAAK,GAAG,aAAa,CAAA;AAE3B,MAAM,IAAI,GAAgB,EAAE,CAAA;AAE5B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqB,CAAA;AAC1C,MAAM,WAAW,GAAG,IAAI,CAAA;AAExB,MAAM,YAAY,GAAkE;IAClF,SAAS,EAAE,SAAS;IACpB,MAAM,EAAE,MAAM;IACd,EAAE,EAAE,EAAE;IACN,IAAI,EAAE,IAAI;IACV,IAAI,EAAE,IAAI;IACV,MAAM,EAAE,MAAM;IACd,MAAM,EAAE,MAAM;IACd,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,IAAI;IACV,QAAQ,EAAE,QAAQ;IAClB,MAAM,EAAE,UAAU;IAClB,KAAK,EAAE,KAAK;CACb,CAAA;AAED,MAAM,OAAO,GAAa,CAAC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA"}

package/transpiled/directives/auth/Delegate.d.ts

@@ -1,8 +1,17 @@
-import { type Directive, type Identity } from './types';
-import type { Input } from '../../io';
+import type { Introspection } from '../../Introspection.ts';
+import type { Context, Directive, Identity } from './types.ts';
+import type { Component } from '@toa.io/core';
 export declare class Delegate implements Directive {
     private readonly property;
-    constructor(property: string);
-    authorize(identity: Identity | null, context: Input): boolean;
+    private readonly discovery;
+    constructor(property: string, discovery: Promise<Component>);
+    authorize(identity: Identity | null, context: Context): Promise<boolean>;
+    /** It admits whoever there is, and embedding the identity is the request's business. */
+    admits(identity: Identity | null): boolean;
+    /**
+     * It takes an identity, and the property it embeds is that identity's — so a caller has
+     * nothing to put there.
+     */
+    describe(introspection: Introspection): Introspection;
     private embed;
 }

package/transpiled/directives/auth/Delegate.js

@@ -1,29 +1,42 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.Delegate = void 0;
-const HTTP_1 = require("../../HTTP");
-class Delegate {
+import { BadRequest } from '../../HTTP/index.js';
+import { take } from '../../Introspection.js';
+import { Role } from './Role.js';
+export class Delegate {
     property;
-    constructor(property) {
+    discovery;
+    constructor(property, discovery) {
         this.property = property;
+        this.discovery = discovery;
     }
-    authorize(identity, context) {
+    async authorize(identity, context) {
         if (identity === null)
             return false;
+        identity.roles ??= await Role.get(identity, this.discovery);
         context.pipelines.body.push((body) => this.embed(body, identity));
         return true;
     }
+    /** It admits whoever there is, and embedding the identity is the request's business. */
+    admits(identity) {
+        return identity !== null;
+    }
+    /**
+     * It takes an identity, and the property it embeds is that identity's — so a caller has
+     * nothing to put there.
+     */
+    describe(introspection) {
+        take(introspection, this.property);
+        return { ...introspection, authenticated: true };
+    }
     embed(body, identity) {
         if (body === undefined)
             body = {};
         check(body);
-        body[this.property] = identity;
+        body[this.property] = structuredClone(identity);
         return body;
     }
 }
-exports.Delegate = Delegate;
 function check(body) {
     if (typeof body !== 'object' || body === null)
-        throw new HTTP_1.BadRequest('Invalid request body');
+        throw new BadRequest('Invalid request body');
 }
 //# sourceMappingURL=Delegate.js.map

package/transpiled/directives/auth/Delegate.js.map

@@ -1 +1 @@
-{"version":3,"file":"Delegate.js","sourceRoot":"","sources":["../../../source/directives/auth/Delegate.ts"],"names":[],"mappings":";;;AAAA,qCAAuC;AAIvC,MAAa,QAAQ;IACF,QAAQ,CAAQ;IAEjC,YAAoB,QAAgB;QAClC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;IAC1B,CAAC;IAEM,SAAS,CAAE,QAAyB,EAAE,OAAc;QACzD,IAAI,QAAQ,KAAK,IAAI;YACnB,OAAO,KAAK,CAAA;QAEd,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAA;QAEjE,OAAO,IAAI,CAAA;IACb,CAAC;IAEO,KAAK,CAAE,IAAa,EAAE,QAAkB;QAC9C,IAAI,IAAI,KAAK,SAAS;YACpB,IAAI,GAAG,EAAE,CAAA;QAEX,KAAK,CAAC,IAAI,CAAC,CAAA;QACX,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAA;QAE9B,OAAO,IAAI,CAAA;IACb,CAAC;CACF;AAzBD,4BAyBC;AAED,SAAS,KAAK,CAAE,IAAa;IAC3B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAC3C,MAAM,IAAI,iBAAU,CAAC,sBAAsB,CAAC,CAAA;AAChD,CAAC"}
+{"version":3,"file":"Delegate.js","sourceRoot":"","sources":["../../../source/directives/auth/Delegate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAA;AAC7C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAKhC,MAAM,OAAO,QAAQ;IACF,QAAQ,CAAQ;IAChB,SAAS,CAAoB;IAE9C,YAAmB,QAAgB,EAAE,SAA6B;QAChE,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;QACxB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;IAC5B,CAAC;IAEM,KAAK,CAAC,SAAS,CAAC,QAAyB,EAAE,OAAgB;QAChE,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,KAAK,CAAA;QAEnC,QAAQ,CAAC,KAAK,KAAK,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;QAC3D,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAA;QAEjE,OAAO,IAAI,CAAA;IACb,CAAC;IAED,wFAAwF;IACjF,MAAM,CAAC,QAAyB;QACrC,OAAO,QAAQ,KAAK,IAAI,CAAA;IAC1B,CAAC;IAED;;;OAGG;IACI,QAAQ,CAAC,aAA4B;QAC1C,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAA;QAElC,OAAO,EAAE,GAAG,aAAa,EAAE,aAAa,EAAE,IAAI,EAAE,CAAA;IAClD,CAAC;IAEO,KAAK,CAAC,IAAa,EAAE,QAAkB;QAC7C,IAAI,IAAI,KAAK,SAAS;YAAE,IAAI,GAAG,EAAE,CAAA;QAEjC,KAAK,CAAC,IAAI,CAAC,CAAA;QACX,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAA;QAE/C,OAAO,IAAI,CAAA;IACb,CAAC;CACF;AAED,SAAS,KAAK,CAAC,IAAa;IAC1B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAC3C,MAAM,IAAI,UAAU,CAAC,sBAAsB,CAAC,CAAA;AAChD,CAAC"}

package/transpiled/directives/auth/Echo.d.ts

@@ -1,6 +1,8 @@
-import { type OutgoingMessage } from '../../HTTP';
-import { type Directive, type Identity } from './types';
+import type { OutgoingMessage } from '../../HTTP/index.ts';
+import type { Directive, Identity, Context } from './types.ts';
 export declare class Echo implements Directive {
-    authorize(identity: Identity | null): boolean;
-    reply(identity: Identity | null): OutgoingMessage;
+    authorize(identity: Identity | null, context: Context): boolean;
+    /** What `authorize` answers, without inventing the identity it would go on to invent. */
+    admits(identity: Identity | null, context: Context): boolean;
+    reply(context: Context): OutgoingMessage;
 }