@velaro/cli 1.2.0 → 1.4.8

package/lib/oauth.js

@@ -1,135 +1,149 @@
-/**
- * OAuth 2.0 device authorization flow (RFC 8628) against the Velaro Entra CIAM tenant.
- *
- * Flow:
- *   1. POST /devicecode  → get user_code + verification_uri
- *   2. Show the user the code; poll /token until granted
- *   3. Exchange the Entra access_token for a Velaro JWT via /auth/entra/token
- *   4. Store { velaroToken, velaroExpires, entraRefreshToken } in ~/.velaro/config.json
- *
- * Refresh:
- *   When the Velaro JWT is within 5 minutes of expiring, silently use the stored
- *   Entra refresh_token to get a new access_token and re-exchange for a new Velaro JWT.
- *
- * One-time setup (run once in the Velaro CIAM tenant):
- *   az login --tenant 61de45b3-458d-49a5-913c-501247a6fe4f --allow-no-subscriptions
- *   az ad app create --display-name "Velaro CLI" --sign-in-audience AzureADMyOrg \
- *     --public-client-redirect-uris "https://login.microsoftonline.com/common/oauth2/nativeclient"
- *   az ad app update --id <appId> --set isFallbackPublicClient=true
- *   # Grant admin consent in Azure Portal:
- *   #   api://89bd2fb7-7020-4cfe-a153-1c1ee37903c2/access_as_user (Delegated)
- *   # Then set VELARO_CLI_CLIENT_ID=<appId> or update the constant below.
- */
-
-const TENANT_ID  = '61de45b3-458d-49a5-913c-501247a6fe4f';
-// CIAM tenant uses login.velaro.com, not login.microsoftonline.com
-const AUTHORITY  = `https://login.velaro.com/${TENANT_ID}`;
-const CLIENT_ID  = process.env.VELARO_CLI_CLIENT_ID || 'c0fdce54-e9b4-4427-a021-b2605855ff8b';
-
-const SCOPE = [
-  'api://89bd2fb7-7020-4cfe-a153-1c1ee37903c2/access_as_user',
-  'offline_access',
-  'openid',
-  'profile',
-  'email',
-].join(' ');
-
-const DEVICE_CODE_URL = `${AUTHORITY}/oauth2/v2.0/devicecode`;
-const TOKEN_URL       = `${AUTHORITY}/oauth2/v2.0/token`;
-const FETCH_TIMEOUT   = 10_000;
-
-export async function requestDeviceCode() {
-  const res = await fetch(DEVICE_CODE_URL, {
-    method:  'POST',
-    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-    body:    new URLSearchParams({ client_id: CLIENT_ID, scope: SCOPE }),
-    signal:  AbortSignal.timeout(FETCH_TIMEOUT),
-  });
-
-  const data = await res.json();
-  if (data.error) throw new Error(`Device code request failed: ${data.error_description || data.error}`);
-  return data; // { device_code, user_code, verification_uri, expires_in, interval, message }
-}
-
-export async function pollForToken(deviceCode, intervalSeconds) {
-  let interval = intervalSeconds;
-
-  while (true) {
-    const res = await fetch(TOKEN_URL, {
-      method:  'POST',
-      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-      body:    new URLSearchParams({
-        grant_type:  'urn:ietf:params:oauth:grant-type:device_code',
-        client_id:   CLIENT_ID,
-        device_code: deviceCode,
-      }),
-      signal: AbortSignal.timeout(FETCH_TIMEOUT),
-    });
-
-    const data = await res.json();
-
-    if (data.access_token) return data; // { access_token, refresh_token, expires_in }
-
-    if (data.error === 'authorization_pending') {
-      // normal — keep waiting
-    } else if (data.error === 'slow_down') {
-      interval += 5 + Math.random() * 2; // RFC 8628 §3.5 — add jitter to avoid lockstep
-    } else if (data.error === 'expired_token') {
-      throw new Error('Login timed out — please run velaro login again.');
-    } else if (data.error === 'access_denied') {
-      throw new Error('Login cancelled.');
-    } else {
-      throw new Error(data.error_description || data.error);
-    }
-
-    await sleep(interval * 1000); // sleep at end so first attempt fires immediately
-  }
-}
-
-export async function exchangeForVelaroToken(entraAccessToken, apiBase) {
-  const res = await fetch(`${apiBase}/auth/entra/token`, {
-    method:  'POST',
-    headers: { Authorization: `Bearer ${entraAccessToken}` },
-    signal:  AbortSignal.timeout(FETCH_TIMEOUT),
-  });
-
-  if (!res.ok) {
-    const body = await res.text().catch(() => res.status.toString());
-    throw new Error(`Velaro token exchange failed (${res.status}): ${body}`);
-  }
-
-  return res.json(); // { token: { token, expires }, profile: { SiteId, Name, UserName, ... } }
-}
-
-export async function refreshVelaroToken(credentials) {
-  const res = await fetch(TOKEN_URL, {
-    method:  'POST',
-    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-    body:    new URLSearchParams({
-      grant_type:    'refresh_token',
-      client_id:     CLIENT_ID,
-      refresh_token: credentials.entraRefreshToken,
-    }),
-    signal: AbortSignal.timeout(FETCH_TIMEOUT),
-  });
-
-  const data = await res.json();
-  if (!data.access_token) {
-    throw new Error(`Token refresh failed: ${data.error_description || data.error}`);
-  }
-
-  const velaro = await exchangeForVelaroToken(data.access_token, credentials.apiBase);
-
-  return {
-    ...credentials,
-    velaroToken:       velaro.token.token,
-    velaroExpires:     velaro.token.expires,
-    entraRefreshToken: data.refresh_token || credentials.entraRefreshToken,
-    siteId:            velaro.profile?.SiteId ?? credentials.siteId,
-    userName:          velaro.profile?.Name   ?? credentials.userName,
-  };
-}
-
-function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
+/**
+ * OAuth 2.0 device authorization flow (RFC 8628) against the Velaro Entra CIAM tenant.
+ *
+ * Flow:
+ *   1. POST /devicecode  → get user_code + verification_uri
+ *   2. Show the user the code; poll /token until granted
+ *   3. Exchange the Entra access_token for a Velaro JWT via /auth/entra/token
+ *   4. Store { velaroToken, velaroExpires, entraRefreshToken } in ~/.velaro/config.json
+ *
+ * Refresh:
+ *   When the Velaro JWT is within 5 minutes of expiring, silently use the stored
+ *   Entra refresh_token to get a new access_token and re-exchange for a new Velaro JWT.
+ *
+ * One-time setup (run once in the Velaro CIAM tenant):
+ *   az login --tenant 61de45b3-458d-49a5-913c-501247a6fe4f --allow-no-subscriptions
+ *   az ad app create --display-name "Velaro CLI" --sign-in-audience AzureADMyOrg \
+ *     --public-client-redirect-uris "https://login.microsoftonline.com/common/oauth2/nativeclient"
+ *   az ad app update --id <appId> --set isFallbackPublicClient=true
+ *   # Grant admin consent in Azure Portal:
+ *   #   api://89bd2fb7-7020-4cfe-a153-1c1ee37903c2/access_as_user (Delegated)
+ *   # Then set VELARO_CLI_CLIENT_ID=<appId> or update the constant below.
+ */
+
+const TENANT_ID  = '61de45b3-458d-49a5-913c-501247a6fe4f';
+// CIAM tenant uses login.velaro.com, not login.microsoftonline.com
+const AUTHORITY  = `https://login.velaro.com/${TENANT_ID}`;
+const CLIENT_ID  = process.env.VELARO_CLI_CLIENT_ID || 'c0fdce54-e9b4-4427-a021-b2605855ff8b';
+
+const SCOPE = [
+  'api://89bd2fb7-7020-4cfe-a153-1c1ee37903c2/access_as_user',
+  'offline_access',
+  'openid',
+  'profile',
+  'email',
+].join(' ');
+
+const DEVICE_CODE_URL = `${AUTHORITY}/oauth2/v2.0/devicecode`;
+const TOKEN_URL       = `${AUTHORITY}/oauth2/v2.0/token`;
+const FETCH_TIMEOUT   = 10_000;
+
+export async function requestDeviceCode() {
+  const res = await fetch(DEVICE_CODE_URL, {
+    method:  'POST',
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+    body:    new URLSearchParams({ client_id: CLIENT_ID, scope: SCOPE }),
+    signal:  AbortSignal.timeout(FETCH_TIMEOUT),
+  });
+
+  const data = await res.json();
+  if (data.error) throw new Error(`Device code request failed: ${data.error_description || data.error}`);
+  return data; // { device_code, user_code, verification_uri, expires_in, interval, message }
+}
+
+export async function pollForToken(deviceCode, intervalSeconds) {
+  let interval = intervalSeconds;
+  let consecutiveTransientFailures = 0;
+  const MAX_CONSECUTIVE_TRANSIENT_FAILURES = 6; // ~30-60s of real outage, not one slow response
+
+  while (true) {
+    let data;
+    try {
+      const res = await fetch(TOKEN_URL, {
+        method:  'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body:    new URLSearchParams({
+          grant_type:  'urn:ietf:params:oauth:grant-type:device_code',
+          client_id:   CLIENT_ID,
+          device_code: deviceCode,
+        }),
+        signal: AbortSignal.timeout(FETCH_TIMEOUT),
+      });
+      data = await res.json();
+      consecutiveTransientFailures = 0;
+    } catch (err) {
+      // A single slow response or network blip during the 30-60s the user needs to complete
+      // the browser step must not kill the whole login — retry like any other pending poll.
+      consecutiveTransientFailures++;
+      if (consecutiveTransientFailures >= MAX_CONSECUTIVE_TRANSIENT_FAILURES) {
+        throw new Error(`Login polling failed repeatedly (${err.message}) — check your network and run velaro login again.`);
+      }
+      await sleep(interval * 1000);
+      continue;
+    }
+
+    if (data.access_token) return data; // { access_token, refresh_token, expires_in }
+
+    if (data.error === 'authorization_pending') {
+      // normal — keep waiting
+    } else if (data.error === 'slow_down') {
+      interval += 5 + Math.random() * 2; // RFC 8628 §3.5 — add jitter to avoid lockstep
+    } else if (data.error === 'expired_token') {
+      throw new Error('Login timed out — please run velaro login again.');
+    } else if (data.error === 'access_denied') {
+      throw new Error('Login cancelled.');
+    } else {
+      throw new Error(data.error_description || data.error);
+    }
+
+    await sleep(interval * 1000); // sleep at end so first attempt fires immediately
+  }
+}
+
+export async function exchangeForVelaroToken(entraAccessToken, apiBase) {
+  const res = await fetch(`${apiBase}/auth/entra/token`, {
+    method:  'POST',
+    headers: { Authorization: `Bearer ${entraAccessToken}` },
+    signal:  AbortSignal.timeout(FETCH_TIMEOUT),
+  });
+
+  if (!res.ok) {
+    const body = await res.text().catch(() => res.status.toString());
+    throw new Error(`Velaro token exchange failed (${res.status}): ${body}`);
+  }
+
+  return res.json(); // { token: { token, expires }, profile: { siteId, userName, ... } } -- camelCase, matches ASP.NET Core's default JSON casing
+}
+
+export async function refreshVelaroToken(credentials) {
+  const res = await fetch(TOKEN_URL, {
+    method:  'POST',
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+    body:    new URLSearchParams({
+      grant_type:    'refresh_token',
+      client_id:     CLIENT_ID,
+      refresh_token: credentials.entraRefreshToken,
+    }),
+    signal: AbortSignal.timeout(FETCH_TIMEOUT),
+  });
+
+  const data = await res.json();
+  if (!data.access_token) {
+    throw new Error(`Token refresh failed: ${data.error_description || data.error}`);
+  }
+
+  const velaro = await exchangeForVelaroToken(data.access_token, credentials.apiBase);
+
+  return {
+    ...credentials,
+    velaroToken:       velaro.token.token,
+    velaroExpires:     velaro.token.expires,
+    entraRefreshToken: data.refresh_token || credentials.entraRefreshToken,
+    siteId:            velaro.profile?.siteId   ?? credentials.siteId,
+    userName:          velaro.profile?.userName ?? credentials.userName,
+  };
+}
+
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}

package/lib/run.js

@@ -1,16 +1,21 @@
-import { track } from './track.js';
-
-/** Wraps a yargs command handler with consistent error reporting and usage tracking. */
-export function runCommand(fn) {
-  return async (argv) => {
-    try {
-      await fn(argv);
-      // Fire-and-forget tracking after successful command — never awaited, never blocks
-      const action = argv._.join('.') || 'unknown';
-      track(action);
-    } catch (err) {
-      console.error(`Error: ${err.message}`);
-      process.exit(1);
-    }
-  };
-}
+import { track } from './track.js';
+
+/** Wraps a yargs command handler with consistent error reporting and usage tracking. */
+export function runCommand(fn) {
+  return async (argv) => {
+    try {
+      await fn(argv);
+      // Fire-and-forget tracking after successful command — never awaited, never blocks
+      const action = argv._.join('.') || 'unknown';
+      track(action);
+    } catch (err) {
+      console.error(`Error: ${err.message}`);
+      // process.exit(1) here raced pending handles (open fetch keep-alive sockets, unflushed
+      // stdout) and intermittently crashed with a libuv assertion on Windows
+      // ("Assertion failed: !(handle->flags & UV_HANDLE_CLOSING), file src\win\async.c").
+      // process.exitCode lets the event loop drain naturally before Node exits with the same
+      // code -- same pattern already used in bigcommerce.js/copilotstudio.js/monday.js/notion.js.
+      process.exitCode = 1;
+    }
+  };
+}

package/lib/sharepoint-auth.js

@@ -0,0 +1,138 @@
+/**
+ * SharePoint / Microsoft Graph auth for the Velaro CLI.
+ *
+ * Uses a separate device-code flow against the nocvelaro M365 tenant
+ * (NOT the Velaro CIAM tenant — completely different auth system).
+ *
+ * Tokens stored under config.sharepoint.* in ~/.velaro/config.json.
+ * Run once: velaro sharepoint login
+ * Then: velaro sharepoint read-tracker
+ */
+
+const TENANT_ID  = 'e796b25e-62d7-42c0-bbd0-e8ebd7d972e4'; // nocvelaro.sharepoint.com
+const AUTHORITY  = `https://login.microsoftonline.com/${TENANT_ID}`;
+// Public client app ID — must be registered in nocvelaro tenant with Files.Read delegated consent.
+// Use the Velaro CLI app or a dedicated "Velaro CLI SharePoint" app.
+// Override via VELARO_SP_CLIENT_ID env var.
+const CLIENT_ID  = process.env.VELARO_SP_CLIENT_ID || 'c0fdce54-e9b4-4427-a021-b2605855ff8b';
+
+const SCOPE = [
+  'https://graph.microsoft.com/Files.Read',
+  'https://graph.microsoft.com/Sites.Read.All',
+  'offline_access',
+].join(' ');
+
+const DEVICE_CODE_URL = `${AUTHORITY}/oauth2/v2.0/devicecode`;
+const TOKEN_URL       = `${AUTHORITY}/oauth2/v2.0/token`;
+const FETCH_TIMEOUT   = 15_000;
+
+function sleep(ms) {
+  return new Promise((r) => setTimeout(r, ms));
+}
+
+export async function spRequestDeviceCode() {
+  const res = await fetch(DEVICE_CODE_URL, {
+    method:  'POST',
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+    body:    new URLSearchParams({ client_id: CLIENT_ID, scope: SCOPE }),
+    signal:  AbortSignal.timeout(FETCH_TIMEOUT),
+  });
+  const data = await res.json();
+  if (data.error) throw new Error(`SP device code failed: ${data.error_description || data.error}`);
+  return data; // { device_code, user_code, verification_uri, expires_in, interval, message }
+}
+
+export async function spPollForToken(deviceCode, intervalSeconds) {
+  let interval = intervalSeconds;
+  while (true) {
+    const res = await fetch(TOKEN_URL, {
+      method:  'POST',
+      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+      body:    new URLSearchParams({
+        grant_type:  'urn:ietf:params:oauth:grant-type:device_code',
+        client_id:   CLIENT_ID,
+        device_code: deviceCode,
+      }),
+      signal: AbortSignal.timeout(FETCH_TIMEOUT),
+    });
+    const data = await res.json();
+    if (data.access_token) return data;
+    if (data.error === 'authorization_pending') {
+      // keep waiting
+    } else if (data.error === 'slow_down') {
+      interval += 5;
+    } else if (data.error === 'expired_token') {
+      throw new Error('Login timed out — run velaro sharepoint login again.');
+    } else if (data.error === 'access_denied') {
+      throw new Error('Login cancelled.');
+    } else {
+      throw new Error(data.error_description || data.error);
+    }
+    await sleep(interval * 1000);
+  }
+}
+
+export async function spRefreshToken(refreshToken) {
+  const res = await fetch(TOKEN_URL, {
+    method:  'POST',
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+    body:    new URLSearchParams({
+      grant_type:    'refresh_token',
+      client_id:     CLIENT_ID,
+      refresh_token: refreshToken,
+      scope:         SCOPE,
+    }),
+    signal: AbortSignal.timeout(FETCH_TIMEOUT),
+  });
+  const data = await res.json();
+  if (!data.access_token) {
+    throw new Error(`SP token refresh failed: ${data.error_description || data.error}`);
+  }
+  return data; // { access_token, refresh_token, expires_in }
+}
+
+/**
+ * Returns a valid SharePoint access token, refreshing silently if needed.
+ * Throws if not logged in — caller should catch and prompt velaro sharepoint login.
+ */
+export async function getSpAccessToken(cfg) {
+  const sp = cfg.sharepoint;
+  if (!sp?.refreshToken) {
+    throw new Error('Not logged into SharePoint. Run: velaro sharepoint login');
+  }
+  const expiresAt = sp.expiresAt ? new Date(sp.expiresAt) : new Date(0);
+  const needsRefresh = Date.now() >= expiresAt.getTime() - 5 * 60 * 1000;
+  if (!needsRefresh && sp.accessToken) return { accessToken: sp.accessToken, refreshed: null };
+
+  const data = await spRefreshToken(sp.refreshToken);
+  const newSp = {
+    accessToken:  data.access_token,
+    refreshToken: data.refresh_token || sp.refreshToken,
+    expiresAt:    new Date(Date.now() + data.expires_in * 1000).toISOString(),
+  };
+  return { accessToken: data.access_token, refreshed: newSp };
+}
+
+/**
+ * Downloads a file from SharePoint/OneDrive via Graph API using the file's web URL.
+ * Returns the raw Buffer (binary content).
+ */
+export async function downloadSharePointFile(webUrl, accessToken) {
+  // Graph endpoint: /v1.0/shares/{encoded-url}/driveItem/content
+  const encoded = Buffer.from(`u!${webUrl}`).toString('base64url');
+  const graphUrl = `https://graph.microsoft.com/v1.0/shares/${encoded}/driveItem/content`;
+
+  const res = await fetch(graphUrl, {
+    headers: { Authorization: `Bearer ${accessToken}` },
+    signal: AbortSignal.timeout(30_000),
+    redirect: 'follow',
+  });
+
+  if (!res.ok) {
+    const body = await res.text().catch(() => '');
+    throw new Error(`Graph download failed (${res.status}): ${body.slice(0, 300)}`);
+  }
+
+  const buf = await res.arrayBuffer();
+  return Buffer.from(buf);
+}

package/lib/subscription.js

@@ -1,39 +1,41 @@
-/**
- * Subscription helpers for CLI commands.
- * Provides a clean gate that prints a plan upgrade message instead of
- * throwing a confusing 403/400 from the API.
- */
-
-import { get } from './api.js';
-
-let _cachedSub = null;
-
-export async function getSubscription() {
-  if (!_cachedSub) {
-    _cachedSub = await get('/Subscription');
-  }
-  return _cachedSub;
-}
-
-/**
- * Throws an Error with a friendly upgrade message if the feature flag is off.
- * Usage: await requireFeature('enableAI', 'AI Bots');
- */
-export async function requireFeature(flag, featureName) {
-  const sub = await getSubscription();
-  if (!sub[flag]) {
-    throw new Error(
-      `${featureName} is not enabled on your plan.\n` +
-      `  Upgrade at https://velaro.com/pricing or contact sales@velaro.com.`
-    );
-  }
-  return sub;
-}
-
-/**
- * Returns true/false without throwing — for check/status commands.
- */
-export async function hasFeature(flag) {
-  const sub = await getSubscription();
-  return sub[flag] === true;
-}
+/**
+ * Subscription helpers for CLI commands.
+ * Provides a clean gate that prints a plan upgrade message instead of
+ * throwing a confusing 403/400 from the API.
+ */
+
+import { messagingGet } from './api.js';
+
+let _cachedSub = null;
+
+export async function getSubscription() {
+  // SubscriptionController lives in velaro-messaging, not velaro-admin -- this was calling the
+  // admin API and 404ing on every CLI command that gates on a feature flag (e.g. `kb qna list`).
+  if (!_cachedSub) {
+    _cachedSub = await messagingGet('/Subscription');
+  }
+  return _cachedSub;
+}
+
+/**
+ * Throws an Error with a friendly upgrade message if the feature flag is off.
+ * Usage: await requireFeature('enableAI', 'AI Bots');
+ */
+export async function requireFeature(flag, featureName) {
+  const sub = await getSubscription();
+  if (!sub[flag]) {
+    throw new Error(
+      `${featureName} is not enabled on your plan.\n` +
+      `  Upgrade at https://velaro.com/pricing or contact sales@velaro.com.`
+    );
+  }
+  return sub;
+}
+
+/**
+ * Returns true/false without throwing — for check/status commands.
+ */
+export async function hasFeature(flag) {
+  const sub = await getSubscription();
+  return sub[flag] === true;
+}

package/lib/track.js

@@ -1,35 +1,35 @@
-/**
- * Fire-and-forget CLI usage tracker.
- * Posts a single event to /ToolUsage/cli after each command.
- * Never throws, never blocks — silently dropped on any failure.
- */
-import { readConfig } from './config.js';
-import { createRequire } from 'module';
-
-const require = createRequire(import.meta.url);
-const { version: CLI_VERSION } = require('../package.json');
-
-/**
- * Track a CLI action. Call after a command succeeds.
- * @param {string} action  e.g. "login", "bot.push", "workflow.pull"
- */
-export function track(action) {
-  setImmediate(async () => {
-    try {
-      const creds = readConfig();
-      if (!creds?.velaroToken || !creds?.apiBase) return;
-
-      await fetch(`${creds.apiBase}/ToolUsage/cli`, {
-        method: 'POST',
-        headers: {
-          Authorization: `Bearer ${creds.velaroToken}`,
-          'Content-Type': 'application/json',
-        },
-        body: JSON.stringify({ action, cliVersion: CLI_VERSION }),
-        signal: AbortSignal.timeout(3000),
-      });
-    } catch {
-      // Silently drop — tracking must never surface errors to the user
-    }
-  });
-}
+/**
+ * Fire-and-forget CLI usage tracker.
+ * Posts a single event to /ToolUsage/cli after each command.
+ * Never throws, never blocks — silently dropped on any failure.
+ */
+import { readConfig } from './config.js';
+import { createRequire } from 'module';
+
+const require = createRequire(import.meta.url);
+const { version: CLI_VERSION } = require('../package.json');
+
+/**
+ * Track a CLI action. Call after a command succeeds.
+ * @param {string} action  e.g. "login", "bot.push", "workflow.pull"
+ */
+export function track(action) {
+  setImmediate(async () => {
+    try {
+      const creds = readConfig();
+      if (!creds?.velaroToken || !creds?.apiBase) return;
+
+      await fetch(`${creds.apiBase}/ToolUsage/cli`, {
+        method: 'POST',
+        headers: {
+          Authorization: `Bearer ${creds.velaroToken}`,
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({ action, cliVersion: CLI_VERSION }),
+        signal: AbortSignal.timeout(3000),
+      });
+    } catch {
+      // Silently drop — tracking must never surface errors to the user
+    }
+  });
+}