@verdaccio/auth 6.0.0-6-next.30 → 6.0.0-6-next.31

package/build/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","names":["debug","buildDebug","Auth","constructor","config","secret","plugins","TypeError","init","loadPlugin","length","loadDefaultPlugin","_applyDefaultPlugins","pluginOptions","logger","authPlugin","HTPasswd","file","error","info","asyncLoadPlugin","auth","plugin","authenticate","allow_access","allow_publish","serverSettings","pluginPrefix","push","getDefaultPlugins","changePassword","username","password","newPassword","cb","validPlugins","_","filter","isFunction","isEmpty","errorUtils","getInternalError","SUPPORT_ERRORS","PLUGIN_MISSING_INTERFACE","isNil","err","profile","invalidateToken","token","console","log","Promise","resolve","slice","next","shift","groups","message","isString","isGroupValid","isArray","API_ERROR","BAD_FORMAT_USER_GROUP","createRemoteUser","add_user","user","self","adduser","ok","packageName","packageVersion","callback","pkgAllowAccess","name","version","pkg","Object","assign","getMatchedPackagesSpec","packages","allow_unpublish","arguments","isError","apiJWTmiddleware","helpers","createAnonymousRemoteUser","req","res","_next","pause","resume","remote_user","_isRemoteUserValid","remoteUser","locals","authorization","headers","isAuthHeaderValid","getBadRequest","BAD_AUTH_HEADER","security","isAESLegacy","_handleAESMiddleware","_handleJWTAPIMiddleware","scheme","parseAuthTokenHeader","toUpperCase","TOKEN_BASIC","credentials","convertPayloadToBase64","toString","parseBasicPayload","getMiddlewareCredentials","getForbidden","BAD_USERNAME_PASSWORD","isUndefined","webUIJWTmiddleware","status","statusCode","send","replace","TOKEN_BEARER","verifyJWTPayload","jwtEncrypt","signOptions","real_groups","realGroupsValidated","groupedGroups","Array","from","Set","concat","payload","signPayload","aesEncrypt","value"],"sources":["../src/auth.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { NextFunction, Request, RequestHandler, Response } from 'express';\nimport _ from 'lodash';\nimport { HTPasswd } from 'verdaccio-htpasswd';\n\nimport { createAnonymousRemoteUser, createRemoteUser } from '@verdaccio/config';\nimport {\n  API_ERROR,\n  SUPPORT_ERRORS,\n  TOKEN_BASIC,\n  TOKEN_BEARER,\n  VerdaccioError,\n  errorUtils,\n  pluginUtils,\n} from '@verdaccio/core';\nimport { asyncLoadPlugin } from '@verdaccio/loaders';\nimport { logger } from '@verdaccio/logger';\nimport {\n  AllowAccess,\n  Callback,\n  Config,\n  JWTSignOptions,\n  Logger,\n  PackageAccess,\n  RemoteUser,\n  Security,\n} from '@verdaccio/types';\nimport { getMatchedPackagesSpec, isFunction, isNil } from '@verdaccio/utils';\n\nimport { signPayload } from './jwt-token';\nimport { aesEncrypt } from './legacy-token';\nimport { parseBasicPayload } from './token';\nimport {\n  convertPayloadToBase64,\n  getDefaultPlugins,\n  getMiddlewareCredentials,\n  isAESLegacy,\n  isAuthHeaderValid,\n  parseAuthTokenHeader,\n  verifyJWTPayload,\n} from './utils';\n\nconst debug = buildDebug('verdaccio:auth');\n\nexport interface TokenEncryption {\n  jwtEncrypt(user: RemoteUser, signOptions: JWTSignOptions): Promise<string>;\n  aesEncrypt(buf: string): string | void;\n}\n\nexport interface AESPayload {\n  user: string;\n  password: string;\n}\nexport interface IAuthMiddleware {\n  apiJWTmiddleware(): $NextFunctionVer;\n  webUIJWTmiddleware(): $NextFunctionVer;\n}\n\nexport type $RequestExtend = Request & { remote_user?: any; log: Logger };\nexport type $ResponseExtend = Response & { cookies?: any };\nexport type $NextFunctionVer = NextFunction & any;\n\nclass Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {\n  public config: Config;\n  public secret: string;\n  public plugins: pluginUtils.Auth<Config>[];\n\n  public constructor(config: Config) {\n    this.config = config;\n    this.secret = config.secret;\n    this.plugins = [];\n    if (!this.secret) {\n      throw new TypeError('secret it is required value on initialize the auth class');\n    }\n  }\n\n  public async init() {\n    let plugins = (await this.loadPlugin()) as pluginUtils.Auth<unknown>[];\n    debug('auth plugins found %s', plugins.length);\n    if (!plugins || plugins.length === 0) {\n      plugins = this.loadDefaultPlugin();\n    }\n    this.plugins = plugins;\n\n    this._applyDefaultPlugins();\n  }\n\n  private loadDefaultPlugin() {\n    debug('load default auth plugin');\n    const pluginOptions: pluginUtils.PluginOptions = {\n      config: this.config,\n      logger,\n    };\n    let authPlugin;\n    try {\n      authPlugin = new HTPasswd(\n        { file: './htpasswd' },\n        pluginOptions as any as pluginUtils.PluginOptions\n      );\n    } catch (error: any) {\n      debug('error on loading auth htpasswd plugin stack: %o', error);\n      logger.info({}, 'no auth plugin has been found');\n      return [];\n    }\n\n    return [authPlugin];\n  }\n\n  private async loadPlugin() {\n    return asyncLoadPlugin<pluginUtils.Auth<unknown>>(\n      this.config.auth,\n      {\n        config: this.config,\n        logger,\n      },\n      (plugin): boolean => {\n        const { authenticate, allow_access, allow_publish } = plugin;\n\n        return (\n          typeof authenticate !== 'undefined' ||\n          typeof allow_access !== 'undefined' ||\n          typeof allow_publish !== 'undefined'\n        );\n      },\n      this.config?.serverSettings?.pluginPrefix\n    );\n  }\n\n  private _applyDefaultPlugins(): void {\n    // TODO: rename to applyFallbackPluginMethods\n    this.plugins.push(getDefaultPlugins(logger));\n  }\n\n  public changePassword(\n    username: string,\n    password: string,\n    newPassword: string,\n    cb: Callback\n  ): void {\n    const validPlugins = _.filter(this.plugins, (plugin) => isFunction(plugin.changePassword));\n\n    if (_.isEmpty(validPlugins)) {\n      return cb(errorUtils.getInternalError(SUPPORT_ERRORS.PLUGIN_MISSING_INTERFACE));\n    }\n\n    for (const plugin of validPlugins) {\n      if (isNil(plugin) || isFunction(plugin.changePassword) === false) {\n        debug('auth plugin does not implement changePassword, trying next one');\n        continue;\n      } else {\n        debug('updating password for %o', username);\n        plugin.changePassword!(username, password, newPassword, (err, profile): void => {\n          if (err) {\n            logger.error(\n              { username, err },\n              `An error has been produced\n            updating the password for @{username}. Error: @{err.message}`\n            );\n            return cb(err);\n          }\n\n          debug('updated password for %o was successful', username);\n          return cb(null, profile);\n        });\n      }\n    }\n  }\n\n  public async invalidateToken(token: string) {\n    // eslint-disable-next-line no-console\n    console.log('invalidate token pending to implement', token);\n    return Promise.resolve();\n  }\n\n  public authenticate(\n    username: string,\n    password: string,\n    cb: (error: VerdaccioError | null, user?: RemoteUser) => void\n  ): void {\n    const plugins = this.plugins.slice(0);\n    (function next(): void {\n      const plugin = plugins.shift() as pluginUtils.Auth<Config>;\n\n      if (isFunction(plugin.authenticate) === false) {\n        return next();\n      }\n\n      debug('authenticating %o', username);\n      plugin.authenticate(username, password, function (err: VerdaccioError | null, groups): void {\n        if (err) {\n          debug('authenticating for user %o failed. Error: %o', username, err?.message);\n          return cb(err);\n        }\n\n        // Expect: SKIP if groups is falsey and not an array\n        //         with at least one item (truthy length)\n        // Expect: CONTINUE otherwise (will error if groups is not\n        //         an array, but this is current behavior)\n        // Caveat: STRING (if valid) will pass successfully\n        //         bug give unexpected results\n        // Info: Cannot use `== false to check falsey values`\n        if (!!groups && groups.length !== 0) {\n          // TODO: create a better understanding of expectations\n          if (_.isString(groups)) {\n            throw new TypeError('plugin group error: invalid type for function');\n          }\n          const isGroupValid: boolean = _.isArray(groups);\n          if (!isGroupValid) {\n            throw new TypeError(API_ERROR.BAD_FORMAT_USER_GROUP);\n          }\n\n          debug('authentication for user %o was successfully. Groups: %o', username, groups);\n          return cb(err, createRemoteUser(username, groups));\n        }\n        next();\n      });\n    })();\n  }\n\n  public add_user(\n    user: string,\n    password: string,\n    cb: (error: VerdaccioError | null, user?: RemoteUser) => void\n  ): void {\n    const self = this;\n    const plugins = this.plugins.slice(0);\n    debug('add user %o', user);\n\n    (function next(): void {\n      const plugin = plugins.shift() as pluginUtils.Auth<Config>;\n      if (typeof plugin.adduser !== 'function') {\n        next();\n      } else {\n        // @ts-expect-error future major (7.x) should remove this section\n        if (typeof plugin.adduser === 'undefined' && typeof plugin.add_user === 'function') {\n          throw errorUtils.getInternalError(\n            'add_user method not longer supported, rename to adduser'\n          );\n        }\n\n        plugin.adduser(\n          user,\n          password,\n          function (err: VerdaccioError | null, ok?: boolean | string): void {\n            if (err) {\n              debug('the user  %o could not being added. Error: %o', user, err?.message);\n              return cb(err);\n            }\n            if (ok) {\n              debug('the user %o has been added', user);\n              return self.authenticate(user, password, cb);\n            }\n            next();\n          }\n        );\n      }\n    })();\n  }\n\n  /**\n   * Allow user to access a package.\n   */\n  public allow_access(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: pluginUtils.AccessCallback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkgAllowAccess: AllowAccess = { name: packageName, version: packageVersion };\n    const pkg = Object.assign(\n      {},\n      pkgAllowAccess,\n      getMatchedPackagesSpec(packageName, this.config.packages)\n    ) as AllowAccess & PackageAccess;\n    debug('allow access for %o', packageName);\n\n    (function next(): void {\n      const plugin: pluginUtils.Auth<unknown> = plugins.shift() as pluginUtils.Auth<unknown>;\n\n      if (_.isNil(plugin) || isFunction(plugin.allow_access) === false) {\n        return next();\n      }\n\n      plugin.allow_access!(user, pkg, function (err: VerdaccioError | null, ok?: boolean): void {\n        if (err) {\n          debug('forbidden access for %o. Error: %o', packageName, err?.message);\n          return callback(err);\n        }\n\n        if (ok) {\n          debug('allowed access for %o', packageName);\n          return callback(null, ok);\n        }\n\n        next(); // cb(null, false) causes next plugin to roll\n      });\n    })();\n  }\n\n  public allow_unpublish(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: Callback\n  ): void {\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      getMatchedPackagesSpec(packageName, this.config.packages)\n    );\n    debug('allow unpublish for %o', packageName);\n\n    for (const plugin of this.plugins) {\n      if (_.isNil(plugin) || isFunction(plugin.allow_unpublish) === false) {\n        debug('allow unpublish for %o plugin does not implement allow_unpublish', packageName);\n        continue;\n      } else {\n        // @ts-ignore\n        plugin.allow_unpublish!(user, pkg, (err, ok: boolean): void => {\n          if (err) {\n            debug(\n              'forbidden publish for %o, it will fallback on unpublish permissions',\n              packageName\n            );\n            return callback(err);\n          }\n\n          if (_.isNil(ok) === true) {\n            debug('bypass unpublish for %o, publish will handle the access', packageName);\n            // @ts-ignore\n            // eslint-disable-next-line\n            return this.allow_publish(...arguments);\n          }\n\n          if (ok) {\n            debug('allowed unpublish for %o', packageName);\n            return callback(null, ok);\n          }\n        });\n      }\n    }\n  }\n\n  /**\n   * Allow user to publish a package.\n   */\n  public allow_publish(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: Callback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      getMatchedPackagesSpec(packageName, this.config.packages)\n    ) as any;\n    debug('allow publish for %o init | plugins: %o', packageName, plugins.length);\n\n    (function next(): void {\n      const plugin = plugins.shift();\n\n      if (typeof plugin?.allow_publish !== 'function') {\n        debug('allow publish for %o plugin does not implement allow_publish', packageName);\n        return next();\n      }\n\n      plugin.allow_publish(user, pkg, (err: VerdaccioError | null, ok?: boolean): void => {\n        if (_.isNil(err) === false && _.isError(err)) {\n          debug('forbidden publish for %o', packageName);\n          return callback(err);\n        }\n\n        if (ok) {\n          debug('allowed publish for %o', packageName);\n          return callback(null, ok);\n        }\n\n        debug('allow publish skip validation for %o', packageName);\n        next(); // cb(null, false) causes next plugin to roll\n      });\n    })();\n  }\n\n  public apiJWTmiddleware(): RequestHandler {\n    debug('jwt middleware');\n    const plugins = this.plugins.slice(0);\n    const helpers = { createAnonymousRemoteUser, createRemoteUser };\n    for (const plugin of plugins) {\n      if (plugin.apiJWTmiddleware) {\n        return plugin.apiJWTmiddleware(helpers);\n      }\n    }\n\n    // @ts-ignore\n    return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction) => {\n      req.pause();\n\n      const next = function (err?: VerdaccioError): any {\n        req.resume();\n        // uncomment this to reject users with bad auth headers\n        // return _next.apply(null, arguments)\n        // swallow error, user remains unauthorized\n        // set remoteUserError to indicate that user was attempting authentication\n        if (err) {\n          req.remote_user.error = err.message;\n        }\n\n        return _next();\n      };\n\n      if (this._isRemoteUserValid(req.remote_user)) {\n        debug('jwt has a valid authentication header');\n        return next();\n      }\n\n      // in case auth header does not exist we return anonymous function\n      const remoteUser = createAnonymousRemoteUser();\n      req.remote_user = remoteUser;\n      res.locals.remote_user = remoteUser;\n\n      const { authorization } = req.headers;\n      if (_.isNil(authorization)) {\n        debug('jwt, authentication header is missing');\n        return next();\n      }\n\n      if (!isAuthHeaderValid(authorization)) {\n        debug('api middleware authentication heather is invalid');\n        return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n      }\n      const { secret, security } = this.config;\n\n      if (isAESLegacy(security)) {\n        debug('api middleware using legacy auth token');\n        this._handleAESMiddleware(req, security, secret, authorization, next);\n      } else {\n        debug('api middleware using JWT auth token');\n        this._handleJWTAPIMiddleware(req, security, secret, authorization, next);\n      }\n    };\n  }\n\n  private _handleJWTAPIMiddleware(\n    req: $RequestExtend,\n    security: Security,\n    secret: string,\n    authorization: string,\n    next: Function\n  ): void {\n    debug('handle JWT api middleware');\n    const { scheme, token } = parseAuthTokenHeader(authorization);\n    if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {\n      debug('handle basic token');\n      // this should happen when client tries to login with an existing user\n      const credentials = convertPayloadToBase64(token).toString();\n      const { user, password } = parseBasicPayload(credentials) as AESPayload;\n      debug('authenticating %o', user);\n      this.authenticate(user, password, (err: VerdaccioError | null, user): void => {\n        if (!err) {\n          debug('generating a remote user');\n          req.remote_user = user;\n          next();\n        } else {\n          debug('generating anonymous user');\n          req.remote_user = createAnonymousRemoteUser();\n          next(err);\n        }\n      });\n    } else {\n      debug('handle jwt token');\n      const credentials: any = getMiddlewareCredentials(security, secret, authorization);\n      if (credentials) {\n        // if the signature is valid we rely on it\n        req.remote_user = credentials;\n        debug('generating a remote user');\n        next();\n      } else {\n        // with JWT throw 401\n        debug('jwt invalid token');\n        next(errorUtils.getForbidden(API_ERROR.BAD_USERNAME_PASSWORD));\n      }\n    }\n  }\n\n  private _handleAESMiddleware(\n    req: $RequestExtend,\n    security: Security,\n    secret: string,\n    authorization: string,\n    next: Function\n  ): void {\n    debug('handle legacy api middleware');\n    debug('api middleware secret %o', typeof secret === 'string');\n    debug('api middleware authorization %o', typeof authorization === 'string');\n    const credentials: any = getMiddlewareCredentials(security, secret, authorization);\n    debug('api middleware credentials %o', credentials?.name);\n    if (credentials) {\n      const { user, password } = credentials;\n      debug('authenticating %o', user);\n      this.authenticate(user, password, (err, user): void => {\n        if (!err) {\n          req.remote_user = user;\n          debug('generating a remote user');\n          next();\n        } else {\n          req.remote_user = createAnonymousRemoteUser();\n          debug('generating anonymous user');\n          next(err);\n        }\n      });\n    } else {\n      // we force npm client to ask again with basic authentication\n      debug('legacy invalid header');\n      return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n    }\n  }\n\n  private _isRemoteUserValid(remote_user?: RemoteUser): boolean {\n    return _.isUndefined(remote_user) === false && _.isUndefined(remote_user?.name) === false;\n  }\n\n  /**\n   * JWT middleware for WebUI\n   */\n  public webUIJWTmiddleware(): RequestHandler {\n    // @ts-ignore\n    return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction): void => {\n      if (this._isRemoteUserValid(req.remote_user)) {\n        return _next();\n      }\n\n      req.pause();\n      const next = (err: VerdaccioError | void): void => {\n        req.resume();\n        if (err) {\n          // req.remote_user.error = err.message;\n          res.status(err.statusCode).send(err.message);\n        }\n\n        return _next();\n      };\n\n      const { authorization } = req.headers;\n      if (_.isNil(authorization)) {\n        return next();\n      }\n\n      if (!isAuthHeaderValid(authorization)) {\n        return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n      }\n\n      const token = (authorization || '').replace(`${TOKEN_BEARER} `, '');\n      if (!token) {\n        return next();\n      }\n\n      let credentials: RemoteUser | undefined;\n      try {\n        credentials = verifyJWTPayload(token, this.config.secret);\n      } catch (err: any) {\n        // FIXME: intended behaviour, do we want it?\n      }\n\n      if (this._isRemoteUserValid(credentials)) {\n        const { name, groups } = credentials as RemoteUser;\n        req.remote_user = createRemoteUser(name as string, groups);\n      } else {\n        req.remote_user = createAnonymousRemoteUser();\n      }\n\n      next();\n    };\n  }\n\n  public async jwtEncrypt(user: RemoteUser, signOptions: JWTSignOptions): Promise<string> {\n    const { real_groups, name, groups } = user;\n    debug('jwt encrypt %o', name);\n    const realGroupsValidated = _.isNil(real_groups) ? [] : real_groups;\n    const groupedGroups = _.isNil(groups)\n      ? real_groups\n      : Array.from(new Set([...groups.concat(realGroupsValidated)]));\n    const payload: RemoteUser = {\n      real_groups: realGroupsValidated,\n      name,\n      groups: groupedGroups,\n    };\n\n    const token: string = await signPayload(payload, this.secret, signOptions);\n\n    return token;\n  }\n\n  /**\n   * Encrypt a string.\n   */\n  public aesEncrypt(value: string): string | void {\n    return aesEncrypt(value, this.secret);\n  }\n}\n\nexport { Auth };\n"],"mappings":";;;;;;;AAAA;;AAEA;;AACA;;AAEA;;AACA;;AASA;;AACA;;AAWA;;AAEA;;AACA;;AACA;;AACA;;;;AAUA,MAAMA,KAAK,GAAG,IAAAC,cAAA,EAAW,gBAAX,CAAd;;AAoBA,MAAMC,IAAN,CAA+E;EAKtEC,WAAW,CAACC,MAAD,EAAiB;IACjC,KAAKA,MAAL,GAAcA,MAAd;IACA,KAAKC,MAAL,GAAcD,MAAM,CAACC,MAArB;IACA,KAAKC,OAAL,GAAe,EAAf;;IACA,IAAI,CAAC,KAAKD,MAAV,EAAkB;MAChB,MAAM,IAAIE,SAAJ,CAAc,0DAAd,CAAN;IACD;EACF;;EAEgB,MAAJC,IAAI,GAAG;IAClB,IAAIF,OAAO,GAAI,MAAM,KAAKG,UAAL,EAArB;IACAT,KAAK,CAAC,uBAAD,EAA0BM,OAAO,CAACI,MAAlC,CAAL;;IACA,IAAI,CAACJ,OAAD,IAAYA,OAAO,CAACI,MAAR,KAAmB,CAAnC,EAAsC;MACpCJ,OAAO,GAAG,KAAKK,iBAAL,EAAV;IACD;;IACD,KAAKL,OAAL,GAAeA,OAAf;;IAEA,KAAKM,oBAAL;EACD;;EAEOD,iBAAiB,GAAG;IAC1BX,KAAK,CAAC,0BAAD,CAAL;IACA,MAAMa,aAAwC,GAAG;MAC/CT,MAAM,EAAE,KAAKA,MADkC;MAE/CU,MAAM,EAANA;IAF+C,CAAjD;IAIA,IAAIC,UAAJ;;IACA,IAAI;MACFA,UAAU,GAAG,IAAIC,2BAAJ,CACX;QAAEC,IAAI,EAAE;MAAR,CADW,EAEXJ,aAFW,CAAb;IAID,CALD,CAKE,OAAOK,KAAP,EAAmB;MACnBlB,KAAK,CAAC,iDAAD,EAAoDkB,KAApD,CAAL;;MACAJ,cAAA,CAAOK,IAAP,CAAY,EAAZ,EAAgB,+BAAhB;;MACA,OAAO,EAAP;IACD;;IAED,OAAO,CAACJ,UAAD,CAAP;EACD;;EAEuB,MAAVN,UAAU,GAAG;IAAA;;IACzB,OAAO,IAAAW,wBAAA,EACL,KAAKhB,MAAL,CAAYiB,IADP,EAEL;MACEjB,MAAM,EAAE,KAAKA,MADf;MAEEU,MAAM,EAANA;IAFF,CAFK,EAMJQ,MAAD,IAAqB;MACnB,MAAM;QAAEC,YAAF;QAAgBC,YAAhB;QAA8BC;MAA9B,IAAgDH,MAAtD;MAEA,OACE,OAAOC,YAAP,KAAwB,WAAxB,IACA,OAAOC,YAAP,KAAwB,WADxB,IAEA,OAAOC,aAAP,KAAyB,WAH3B;IAKD,CAdI,kBAeL,KAAKrB,MAfA,0EAeL,aAAasB,cAfR,0DAeL,sBAA6BC,YAfxB,CAAP;EAiBD;;EAEOf,oBAAoB,GAAS;IACnC;IACA,KAAKN,OAAL,CAAasB,IAAb,CAAkB,IAAAC,yBAAA,EAAkBf,cAAlB,CAAlB;EACD;;EAEMgB,cAAc,CACnBC,QADmB,EAEnBC,QAFmB,EAGnBC,WAHmB,EAInBC,EAJmB,EAKb;IACN,MAAMC,YAAY,GAAGC,eAAA,CAAEC,MAAF,CAAS,KAAK/B,OAAd,EAAwBgB,MAAD,IAAY,IAAAgB,iBAAA,EAAWhB,MAAM,CAACQ,cAAlB,CAAnC,CAArB;;IAEA,IAAIM,eAAA,CAAEG,OAAF,CAAUJ,YAAV,CAAJ,EAA6B;MAC3B,OAAOD,EAAE,CAACM,gBAAA,CAAWC,gBAAX,CAA4BC,oBAAA,CAAeC,wBAA3C,CAAD,CAAT;IACD;;IAED,KAAK,MAAMrB,MAAX,IAAqBa,YAArB,EAAmC;MACjC,IAAI,IAAAS,YAAA,EAAMtB,MAAN,KAAiB,IAAAgB,iBAAA,EAAWhB,MAAM,CAACQ,cAAlB,MAAsC,KAA3D,EAAkE;QAChE9B,KAAK,CAAC,gEAAD,CAAL;QACA;MACD,CAHD,MAGO;QACLA,KAAK,CAAC,0BAAD,EAA6B+B,QAA7B,CAAL;QACAT,MAAM,CAACQ,cAAP,CAAuBC,QAAvB,EAAiCC,QAAjC,EAA2CC,WAA3C,EAAwD,CAACY,GAAD,EAAMC,OAAN,KAAwB;UAC9E,IAAID,GAAJ,EAAS;YACP/B,cAAA,CAAOI,KAAP,CACE;cAAEa,QAAF;cAAYc;YAAZ,CADF,EAEG;AACf,yEAHY;;YAKA,OAAOX,EAAE,CAACW,GAAD,CAAT;UACD;;UAED7C,KAAK,CAAC,wCAAD,EAA2C+B,QAA3C,CAAL;UACA,OAAOG,EAAE,CAAC,IAAD,EAAOY,OAAP,CAAT;QACD,CAZD;MAaD;IACF;EACF;;EAE2B,MAAfC,eAAe,CAACC,KAAD,EAAgB;IAC1C;IACAC,OAAO,CAACC,GAAR,CAAY,uCAAZ,EAAqDF,KAArD;IACA,OAAOG,OAAO,CAACC,OAAR,EAAP;EACD;;EAEM7B,YAAY,CACjBQ,QADiB,EAEjBC,QAFiB,EAGjBE,EAHiB,EAIX;IACN,MAAM5B,OAAO,GAAG,KAAKA,OAAL,CAAa+C,KAAb,CAAmB,CAAnB,CAAhB;;IACA,CAAC,SAASC,IAAT,GAAsB;MACrB,MAAMhC,MAAM,GAAGhB,OAAO,CAACiD,KAAR,EAAf;;MAEA,IAAI,IAAAjB,iBAAA,EAAWhB,MAAM,CAACC,YAAlB,MAAoC,KAAxC,EAA+C;QAC7C,OAAO+B,IAAI,EAAX;MACD;;MAEDtD,KAAK,CAAC,mBAAD,EAAsB+B,QAAtB,CAAL;MACAT,MAAM,CAACC,YAAP,CAAoBQ,QAApB,EAA8BC,QAA9B,EAAwC,UAAUa,GAAV,EAAsCW,MAAtC,EAAoD;QAC1F,IAAIX,GAAJ,EAAS;UACP7C,KAAK,CAAC,8CAAD,EAAiD+B,QAAjD,EAA2Dc,GAA3D,aAA2DA,GAA3D,uBAA2DA,GAAG,CAAEY,OAAhE,CAAL;UACA,OAAOvB,EAAE,CAACW,GAAD,CAAT;QACD,CAJyF,CAM1F;QACA;QACA;QACA;QACA;QACA;QACA;;;QACA,IAAI,CAAC,CAACW,MAAF,IAAYA,MAAM,CAAC9C,MAAP,KAAkB,CAAlC,EAAqC;UACnC;UACA,IAAI0B,eAAA,CAAEsB,QAAF,CAAWF,MAAX,CAAJ,EAAwB;YACtB,MAAM,IAAIjD,SAAJ,CAAc,+CAAd,CAAN;UACD;;UACD,MAAMoD,YAAqB,GAAGvB,eAAA,CAAEwB,OAAF,CAAUJ,MAAV,CAA9B;;UACA,IAAI,CAACG,YAAL,EAAmB;YACjB,MAAM,IAAIpD,SAAJ,CAAcsD,eAAA,CAAUC,qBAAxB,CAAN;UACD;;UAED9D,KAAK,CAAC,yDAAD,EAA4D+B,QAA5D,EAAsEyB,MAAtE,CAAL;UACA,OAAOtB,EAAE,CAACW,GAAD,EAAM,IAAAkB,wBAAA,EAAiBhC,QAAjB,EAA2ByB,MAA3B,CAAN,CAAT;QACD;;QACDF,IAAI;MACL,CA3BD;IA4BD,CApCD;EAqCD;;EAEMU,QAAQ,CACbC,IADa,EAEbjC,QAFa,EAGbE,EAHa,EAIP;IACN,MAAMgC,IAAI,GAAG,IAAb;IACA,MAAM5D,OAAO,GAAG,KAAKA,OAAL,CAAa+C,KAAb,CAAmB,CAAnB,CAAhB;IACArD,KAAK,CAAC,aAAD,EAAgBiE,IAAhB,CAAL;;IAEA,CAAC,SAASX,IAAT,GAAsB;MACrB,MAAMhC,MAAM,GAAGhB,OAAO,CAACiD,KAAR,EAAf;;MACA,IAAI,OAAOjC,MAAM,CAAC6C,OAAd,KAA0B,UAA9B,EAA0C;QACxCb,IAAI;MACL,CAFD,MAEO;QACL;QACA,IAAI,OAAOhC,MAAM,CAAC6C,OAAd,KAA0B,WAA1B,IAAyC,OAAO7C,MAAM,CAAC0C,QAAd,KAA2B,UAAxE,EAAoF;UAClF,MAAMxB,gBAAA,CAAWC,gBAAX,CACJ,yDADI,CAAN;QAGD;;QAEDnB,MAAM,CAAC6C,OAAP,CACEF,IADF,EAEEjC,QAFF,EAGE,UAAUa,GAAV,EAAsCuB,EAAtC,EAAmE;UACjE,IAAIvB,GAAJ,EAAS;YACP7C,KAAK,CAAC,+CAAD,EAAkDiE,IAAlD,EAAwDpB,GAAxD,aAAwDA,GAAxD,uBAAwDA,GAAG,CAAEY,OAA7D,CAAL;YACA,OAAOvB,EAAE,CAACW,GAAD,CAAT;UACD;;UACD,IAAIuB,EAAJ,EAAQ;YACNpE,KAAK,CAAC,4BAAD,EAA+BiE,IAA/B,CAAL;YACA,OAAOC,IAAI,CAAC3C,YAAL,CAAkB0C,IAAlB,EAAwBjC,QAAxB,EAAkCE,EAAlC,CAAP;UACD;;UACDoB,IAAI;QACL,CAbH;MAeD;IACF,CA5BD;EA6BD;EAED;AACF;AACA;;;EACS9B,YAAY,CACjB;IAAE6C,WAAF;IAAeC;EAAf,CADiB,EAEjBL,IAFiB,EAGjBM,QAHiB,EAIX;IACN,MAAMjE,OAAO,GAAG,KAAKA,OAAL,CAAa+C,KAAb,CAAmB,CAAnB,CAAhB;IACA,MAAMmB,cAA2B,GAAG;MAAEC,IAAI,EAAEJ,WAAR;MAAqBK,OAAO,EAAEJ;IAA9B,CAApC;IACA,MAAMK,GAAG,GAAGC,MAAM,CAACC,MAAP,CACV,EADU,EAEVL,cAFU,EAGV,IAAAM,6BAAA,EAAuBT,WAAvB,EAAoC,KAAKjE,MAAL,CAAY2E,QAAhD,CAHU,CAAZ;IAKA/E,KAAK,CAAC,qBAAD,EAAwBqE,WAAxB,CAAL;;IAEA,CAAC,SAASf,IAAT,GAAsB;MACrB,MAAMhC,MAAiC,GAAGhB,OAAO,CAACiD,KAAR,EAA1C;;MAEA,IAAInB,eAAA,CAAEQ,KAAF,CAAQtB,MAAR,KAAmB,IAAAgB,iBAAA,EAAWhB,MAAM,CAACE,YAAlB,MAAoC,KAA3D,EAAkE;QAChE,OAAO8B,IAAI,EAAX;MACD;;MAEDhC,MAAM,CAACE,YAAP,CAAqByC,IAArB,EAA2BU,GAA3B,EAAgC,UAAU9B,GAAV,EAAsCuB,EAAtC,EAA0D;QACxF,IAAIvB,GAAJ,EAAS;UACP7C,KAAK,CAAC,oCAAD,EAAuCqE,WAAvC,EAAoDxB,GAApD,aAAoDA,GAApD,uBAAoDA,GAAG,CAAEY,OAAzD,CAAL;UACA,OAAOc,QAAQ,CAAC1B,GAAD,CAAf;QACD;;QAED,IAAIuB,EAAJ,EAAQ;UACNpE,KAAK,CAAC,uBAAD,EAA0BqE,WAA1B,CAAL;UACA,OAAOE,QAAQ,CAAC,IAAD,EAAOH,EAAP,CAAf;QACD;;QAEDd,IAAI,GAXoF,CAWhF;MACT,CAZD;IAaD,CApBD;EAqBD;;EAEM0B,eAAe,CACpB;IAAEX,WAAF;IAAeC;EAAf,CADoB,EAEpBL,IAFoB,EAGpBM,QAHoB,EAId;IACN,MAAMI,GAAG,GAAGC,MAAM,CAACC,MAAP,CACV;MAAEJ,IAAI,EAAEJ,WAAR;MAAqBK,OAAO,EAAEJ;IAA9B,CADU,EAEV,IAAAQ,6BAAA,EAAuBT,WAAvB,EAAoC,KAAKjE,MAAL,CAAY2E,QAAhD,CAFU,CAAZ;IAIA/E,KAAK,CAAC,wBAAD,EAA2BqE,WAA3B,CAAL;;IAEA,KAAK,MAAM/C,MAAX,IAAqB,KAAKhB,OAA1B,EAAmC;MACjC,IAAI8B,eAAA,CAAEQ,KAAF,CAAQtB,MAAR,KAAmB,IAAAgB,iBAAA,EAAWhB,MAAM,CAAC0D,eAAlB,MAAuC,KAA9D,EAAqE;QACnEhF,KAAK,CAAC,kEAAD,EAAqEqE,WAArE,CAAL;QACA;MACD,CAHD,MAGO;QACL;QACA/C,MAAM,CAAC0D,eAAP,CAAwBf,IAAxB,EAA8BU,GAA9B,EAAmC,CAAC9B,GAAD,EAAMuB,EAAN,KAA4B;UAC7D,IAAIvB,GAAJ,EAAS;YACP7C,KAAK,CACH,qEADG,EAEHqE,WAFG,CAAL;YAIA,OAAOE,QAAQ,CAAC1B,GAAD,CAAf;UACD;;UAED,IAAIT,eAAA,CAAEQ,KAAF,CAAQwB,EAAR,MAAgB,IAApB,EAA0B;YACxBpE,KAAK,CAAC,yDAAD,EAA4DqE,WAA5D,CAAL,CADwB,CAExB;YACA;;YACA,OAAO,KAAK5C,aAAL,CAAmB,GAAGwD,SAAtB,CAAP;UACD;;UAED,IAAIb,EAAJ,EAAQ;YACNpE,KAAK,CAAC,0BAAD,EAA6BqE,WAA7B,CAAL;YACA,OAAOE,QAAQ,CAAC,IAAD,EAAOH,EAAP,CAAf;UACD;QACF,CApBD;MAqBD;IACF;EACF;EAED;AACF;AACA;;;EACS3C,aAAa,CAClB;IAAE4C,WAAF;IAAeC;EAAf,CADkB,EAElBL,IAFkB,EAGlBM,QAHkB,EAIZ;IACN,MAAMjE,OAAO,GAAG,KAAKA,OAAL,CAAa+C,KAAb,CAAmB,CAAnB,CAAhB;IACA,MAAMsB,GAAG,GAAGC,MAAM,CAACC,MAAP,CACV;MAAEJ,IAAI,EAAEJ,WAAR;MAAqBK,OAAO,EAAEJ;IAA9B,CADU,EAEV,IAAAQ,6BAAA,EAAuBT,WAAvB,EAAoC,KAAKjE,MAAL,CAAY2E,QAAhD,CAFU,CAAZ;IAIA/E,KAAK,CAAC,yCAAD,EAA4CqE,WAA5C,EAAyD/D,OAAO,CAACI,MAAjE,CAAL;;IAEA,CAAC,SAAS4C,IAAT,GAAsB;MACrB,MAAMhC,MAAM,GAAGhB,OAAO,CAACiD,KAAR,EAAf;;MAEA,IAAI,QAAOjC,MAAP,aAAOA,MAAP,uBAAOA,MAAM,CAAEG,aAAf,MAAiC,UAArC,EAAiD;QAC/CzB,KAAK,CAAC,8DAAD,EAAiEqE,WAAjE,CAAL;QACA,OAAOf,IAAI,EAAX;MACD;;MAEDhC,MAAM,CAACG,aAAP,CAAqBwC,IAArB,EAA2BU,GAA3B,EAAgC,CAAC9B,GAAD,EAA6BuB,EAA7B,KAAoD;QAClF,IAAIhC,eAAA,CAAEQ,KAAF,CAAQC,GAAR,MAAiB,KAAjB,IAA0BT,eAAA,CAAE8C,OAAF,CAAUrC,GAAV,CAA9B,EAA8C;UAC5C7C,KAAK,CAAC,0BAAD,EAA6BqE,WAA7B,CAAL;UACA,OAAOE,QAAQ,CAAC1B,GAAD,CAAf;QACD;;QAED,IAAIuB,EAAJ,EAAQ;UACNpE,KAAK,CAAC,wBAAD,EAA2BqE,WAA3B,CAAL;UACA,OAAOE,QAAQ,CAAC,IAAD,EAAOH,EAAP,CAAf;QACD;;QAEDpE,KAAK,CAAC,sCAAD,EAAyCqE,WAAzC,CAAL;QACAf,IAAI,GAZ8E,CAY1E;MACT,CAbD;IAcD,CAtBD;EAuBD;;EAEM6B,gBAAgB,GAAmB;IACxCnF,KAAK,CAAC,gBAAD,CAAL;IACA,MAAMM,OAAO,GAAG,KAAKA,OAAL,CAAa+C,KAAb,CAAmB,CAAnB,CAAhB;IACA,MAAM+B,OAAO,GAAG;MAAEC,yBAAyB,EAAzBA,iCAAF;MAA6BtB,gBAAgB,EAAhBA;IAA7B,CAAhB;;IACA,KAAK,MAAMzC,MAAX,IAAqBhB,OAArB,EAA8B;MAC5B,IAAIgB,MAAM,CAAC6D,gBAAX,EAA6B;QAC3B,OAAO7D,MAAM,CAAC6D,gBAAP,CAAwBC,OAAxB,CAAP;MACD;IACF,CARuC,CAUxC;;;IACA,OAAO,CAACE,GAAD,EAAsBC,GAAtB,EAA4CC,KAA5C,KAAoE;MACzEF,GAAG,CAACG,KAAJ;;MAEA,MAAMnC,IAAI,GAAG,UAAUT,GAAV,EAAqC;QAChDyC,GAAG,CAACI,MAAJ,GADgD,CAEhD;QACA;QACA;QACA;;QACA,IAAI7C,GAAJ,EAAS;UACPyC,GAAG,CAACK,WAAJ,CAAgBzE,KAAhB,GAAwB2B,GAAG,CAACY,OAA5B;QACD;;QAED,OAAO+B,KAAK,EAAZ;MACD,CAXD;;MAaA,IAAI,KAAKI,kBAAL,CAAwBN,GAAG,CAACK,WAA5B,CAAJ,EAA8C;QAC5C3F,KAAK,CAAC,uCAAD,CAAL;QACA,OAAOsD,IAAI,EAAX;MACD,CAnBwE,CAqBzE;;;MACA,MAAMuC,UAAU,GAAG,IAAAR,iCAAA,GAAnB;MACAC,GAAG,CAACK,WAAJ,GAAkBE,UAAlB;MACAN,GAAG,CAACO,MAAJ,CAAWH,WAAX,GAAyBE,UAAzB;MAEA,MAAM;QAAEE;MAAF,IAAoBT,GAAG,CAACU,OAA9B;;MACA,IAAI5D,eAAA,CAAEQ,KAAF,CAAQmD,aAAR,CAAJ,EAA4B;QAC1B/F,KAAK,CAAC,uCAAD,CAAL;QACA,OAAOsD,IAAI,EAAX;MACD;;MAED,IAAI,CAAC,IAAA2C,yBAAA,EAAkBF,aAAlB,CAAL,EAAuC;QACrC/F,KAAK,CAAC,kDAAD,CAAL;QACA,OAAOsD,IAAI,CAACd,gBAAA,CAAW0D,aAAX,CAAyBrC,eAAA,CAAUsC,eAAnC,CAAD,CAAX;MACD;;MACD,MAAM;QAAE9F,MAAF;QAAU+F;MAAV,IAAuB,KAAKhG,MAAlC;;MAEA,IAAI,IAAAiG,mBAAA,EAAYD,QAAZ,CAAJ,EAA2B;QACzBpG,KAAK,CAAC,wCAAD,CAAL;;QACA,KAAKsG,oBAAL,CAA0BhB,GAA1B,EAA+Bc,QAA/B,EAAyC/F,MAAzC,EAAiD0F,aAAjD,EAAgEzC,IAAhE;MACD,CAHD,MAGO;QACLtD,KAAK,CAAC,qCAAD,CAAL;;QACA,KAAKuG,uBAAL,CAA6BjB,GAA7B,EAAkCc,QAAlC,EAA4C/F,MAA5C,EAAoD0F,aAApD,EAAmEzC,IAAnE;MACD;IACF,CA7CD;EA8CD;;EAEOiD,uBAAuB,CAC7BjB,GAD6B,EAE7Bc,QAF6B,EAG7B/F,MAH6B,EAI7B0F,aAJ6B,EAK7BzC,IAL6B,EAMvB;IACNtD,KAAK,CAAC,2BAAD,CAAL;IACA,MAAM;MAAEwG,MAAF;MAAUxD;IAAV,IAAoB,IAAAyD,4BAAA,EAAqBV,aAArB,CAA1B;;IACA,IAAIS,MAAM,CAACE,WAAP,OAAyBC,iBAAA,CAAYD,WAAZ,EAA7B,EAAwD;MACtD1G,KAAK,CAAC,oBAAD,CAAL,CADsD,CAEtD;;MACA,MAAM4G,WAAW,GAAG,IAAAC,8BAAA,EAAuB7D,KAAvB,EAA8B8D,QAA9B,EAApB;MACA,MAAM;QAAE7C,IAAF;QAAQjC;MAAR,IAAqB,IAAA+E,wBAAA,EAAkBH,WAAlB,CAA3B;MACA5G,KAAK,CAAC,mBAAD,EAAsBiE,IAAtB,CAAL;MACA,KAAK1C,YAAL,CAAkB0C,IAAlB,EAAwBjC,QAAxB,EAAkC,CAACa,GAAD,EAA6BoB,IAA7B,KAA4C;QAC5E,IAAI,CAACpB,GAAL,EAAU;UACR7C,KAAK,CAAC,0BAAD,CAAL;UACAsF,GAAG,CAACK,WAAJ,GAAkB1B,IAAlB;UACAX,IAAI;QACL,CAJD,MAIO;UACLtD,KAAK,CAAC,2BAAD,CAAL;UACAsF,GAAG,CAACK,WAAJ,GAAkB,IAAAN,iCAAA,GAAlB;UACA/B,IAAI,CAACT,GAAD,CAAJ;QACD;MACF,CAVD;IAWD,CAjBD,MAiBO;MACL7C,KAAK,CAAC,kBAAD,CAAL;MACA,MAAM4G,WAAgB,GAAG,IAAAI,gCAAA,EAAyBZ,QAAzB,EAAmC/F,MAAnC,EAA2C0F,aAA3C,CAAzB;;MACA,IAAIa,WAAJ,EAAiB;QACf;QACAtB,GAAG,CAACK,WAAJ,GAAkBiB,WAAlB;QACA5G,KAAK,CAAC,0BAAD,CAAL;QACAsD,IAAI;MACL,CALD,MAKO;QACL;QACAtD,KAAK,CAAC,mBAAD,CAAL;QACAsD,IAAI,CAACd,gBAAA,CAAWyE,YAAX,CAAwBpD,eAAA,CAAUqD,qBAAlC,CAAD,CAAJ;MACD;IACF;EACF;;EAEOZ,oBAAoB,CAC1BhB,GAD0B,EAE1Bc,QAF0B,EAG1B/F,MAH0B,EAI1B0F,aAJ0B,EAK1BzC,IAL0B,EAMpB;IACNtD,KAAK,CAAC,8BAAD,CAAL;IACAA,KAAK,CAAC,0BAAD,EAA6B,OAAOK,MAAP,KAAkB,QAA/C,CAAL;IACAL,KAAK,CAAC,iCAAD,EAAoC,OAAO+F,aAAP,KAAyB,QAA7D,CAAL;IACA,MAAMa,WAAgB,GAAG,IAAAI,gCAAA,EAAyBZ,QAAzB,EAAmC/F,MAAnC,EAA2C0F,aAA3C,CAAzB;IACA/F,KAAK,CAAC,+BAAD,EAAkC4G,WAAlC,aAAkCA,WAAlC,uBAAkCA,WAAW,CAAEnC,IAA/C,CAAL;;IACA,IAAImC,WAAJ,EAAiB;MACf,MAAM;QAAE3C,IAAF;QAAQjC;MAAR,IAAqB4E,WAA3B;MACA5G,KAAK,CAAC,mBAAD,EAAsBiE,IAAtB,CAAL;MACA,KAAK1C,YAAL,CAAkB0C,IAAlB,EAAwBjC,QAAxB,EAAkC,CAACa,GAAD,EAAMoB,IAAN,KAAqB;QACrD,IAAI,CAACpB,GAAL,EAAU;UACRyC,GAAG,CAACK,WAAJ,GAAkB1B,IAAlB;UACAjE,KAAK,CAAC,0BAAD,CAAL;UACAsD,IAAI;QACL,CAJD,MAIO;UACLgC,GAAG,CAACK,WAAJ,GAAkB,IAAAN,iCAAA,GAAlB;UACArF,KAAK,CAAC,2BAAD,CAAL;UACAsD,IAAI,CAACT,GAAD,CAAJ;QACD;MACF,CAVD;IAWD,CAdD,MAcO;MACL;MACA7C,KAAK,CAAC,uBAAD,CAAL;MACA,OAAOsD,IAAI,CAACd,gBAAA,CAAW0D,aAAX,CAAyBrC,eAAA,CAAUsC,eAAnC,CAAD,CAAX;IACD;EACF;;EAEOP,kBAAkB,CAACD,WAAD,EAAoC;IAC5D,OAAOvD,eAAA,CAAE+E,WAAF,CAAcxB,WAAd,MAA+B,KAA/B,IAAwCvD,eAAA,CAAE+E,WAAF,CAAcxB,WAAd,aAAcA,WAAd,uBAAcA,WAAW,CAAElB,IAA3B,MAAqC,KAApF;EACD;EAED;AACF;AACA;;;EACS2C,kBAAkB,GAAmB;IAC1C;IACA,OAAO,CAAC9B,GAAD,EAAsBC,GAAtB,EAA4CC,KAA5C,KAA0E;MAC/E,IAAI,KAAKI,kBAAL,CAAwBN,GAAG,CAACK,WAA5B,CAAJ,EAA8C;QAC5C,OAAOH,KAAK,EAAZ;MACD;;MAEDF,GAAG,CAACG,KAAJ;;MACA,MAAMnC,IAAI,GAAIT,GAAD,IAAsC;QACjDyC,GAAG,CAACI,MAAJ;;QACA,IAAI7C,GAAJ,EAAS;UACP;UACA0C,GAAG,CAAC8B,MAAJ,CAAWxE,GAAG,CAACyE,UAAf,EAA2BC,IAA3B,CAAgC1E,GAAG,CAACY,OAApC;QACD;;QAED,OAAO+B,KAAK,EAAZ;MACD,CARD;;MAUA,MAAM;QAAEO;MAAF,IAAoBT,GAAG,CAACU,OAA9B;;MACA,IAAI5D,eAAA,CAAEQ,KAAF,CAAQmD,aAAR,CAAJ,EAA4B;QAC1B,OAAOzC,IAAI,EAAX;MACD;;MAED,IAAI,CAAC,IAAA2C,yBAAA,EAAkBF,aAAlB,CAAL,EAAuC;QACrC,OAAOzC,IAAI,CAACd,gBAAA,CAAW0D,aAAX,CAAyBrC,eAAA,CAAUsC,eAAnC,CAAD,CAAX;MACD;;MAED,MAAMnD,KAAK,GAAG,CAAC+C,aAAa,IAAI,EAAlB,EAAsByB,OAAtB,CAA+B,GAAEC,kBAAa,GAA9C,EAAkD,EAAlD,CAAd;;MACA,IAAI,CAACzE,KAAL,EAAY;QACV,OAAOM,IAAI,EAAX;MACD;;MAED,IAAIsD,WAAJ;;MACA,IAAI;QACFA,WAAW,GAAG,IAAAc,wBAAA,EAAiB1E,KAAjB,EAAwB,KAAK5C,MAAL,CAAYC,MAApC,CAAd;MACD,CAFD,CAEE,OAAOwC,GAAP,EAAiB,CACjB;MACD;;MAED,IAAI,KAAK+C,kBAAL,CAAwBgB,WAAxB,CAAJ,EAA0C;QACxC,MAAM;UAAEnC,IAAF;UAAQjB;QAAR,IAAmBoD,WAAzB;QACAtB,GAAG,CAACK,WAAJ,GAAkB,IAAA5B,wBAAA,EAAiBU,IAAjB,EAAiCjB,MAAjC,CAAlB;MACD,CAHD,MAGO;QACL8B,GAAG,CAACK,WAAJ,GAAkB,IAAAN,iCAAA,GAAlB;MACD;;MAED/B,IAAI;IACL,CA7CD;EA8CD;;EAEsB,MAAVqE,UAAU,CAAC1D,IAAD,EAAmB2D,WAAnB,EAAiE;IACtF,MAAM;MAAEC,WAAF;MAAepD,IAAf;MAAqBjB;IAArB,IAAgCS,IAAtC;IACAjE,KAAK,CAAC,gBAAD,EAAmByE,IAAnB,CAAL;IACA,MAAMqD,mBAAmB,GAAG1F,eAAA,CAAEQ,KAAF,CAAQiF,WAAR,IAAuB,EAAvB,GAA4BA,WAAxD;IACA,MAAME,aAAa,GAAG3F,eAAA,CAAEQ,KAAF,CAAQY,MAAR,IAClBqE,WADkB,GAElBG,KAAK,CAACC,IAAN,CAAW,IAAIC,GAAJ,CAAQ,CAAC,GAAG1E,MAAM,CAAC2E,MAAP,CAAcL,mBAAd,CAAJ,CAAR,CAAX,CAFJ;IAGA,MAAMM,OAAmB,GAAG;MAC1BP,WAAW,EAAEC,mBADa;MAE1BrD,IAF0B;MAG1BjB,MAAM,EAAEuE;IAHkB,CAA5B;IAMA,MAAM/E,KAAa,GAAG,MAAM,IAAAqF,qBAAA,EAAYD,OAAZ,EAAqB,KAAK/H,MAA1B,EAAkCuH,WAAlC,CAA5B;IAEA,OAAO5E,KAAP;EACD;EAED;AACF;AACA;;;EACSsF,UAAU,CAACC,KAAD,EAA+B;IAC9C,OAAO,IAAAD,uBAAA,EAAWC,KAAX,EAAkB,KAAKlI,MAAvB,CAAP;EACD;;AArhB4E"}
+{"version":3,"file":"auth.js","names":["debug","buildDebug","Auth","constructor","config","secret","plugins","TypeError","init","loadPlugin","length","loadDefaultPlugin","_applyDefaultPlugins","pluginOptions","logger","authPlugin","HTPasswd","file","error","info","asyncLoadPlugin","auth","plugin","authenticate","allow_access","allow_publish","serverSettings","pluginPrefix","push","getDefaultPlugins","changePassword","username","password","newPassword","cb","validPlugins","_","filter","isFunction","isEmpty","errorUtils","getInternalError","SUPPORT_ERRORS","PLUGIN_MISSING_INTERFACE","isNil","err","profile","invalidateToken","token","console","log","Promise","resolve","slice","next","shift","groups","message","isString","isGroupValid","isArray","API_ERROR","BAD_FORMAT_USER_GROUP","createRemoteUser","add_user","user","self","adduser","ok","packageName","packageVersion","callback","pkgAllowAccess","name","version","pkg","Object","assign","getMatchedPackagesSpec","packages","allow_unpublish","arguments","isError","apiJWTmiddleware","helpers","createAnonymousRemoteUser","req","res","_next","pause","resume","remote_user","_isRemoteUserValid","remoteUser","locals","authorization","headers","isAuthHeaderValid","getBadRequest","BAD_AUTH_HEADER","security","isAESLegacy","_handleAESMiddleware","_handleJWTAPIMiddleware","scheme","parseAuthTokenHeader","toUpperCase","TOKEN_BASIC","credentials","convertPayloadToBase64","toString","parseBasicPayload","getMiddlewareCredentials","getForbidden","BAD_USERNAME_PASSWORD","isUndefined","webUIJWTmiddleware","status","statusCode","send","replace","TOKEN_BEARER","verifyJWTPayload","jwtEncrypt","signOptions","real_groups","realGroupsValidated","groupedGroups","Array","from","Set","concat","payload","signPayload","aesEncrypt","value"],"sources":["../src/auth.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { NextFunction, Request, RequestHandler, Response } from 'express';\nimport _ from 'lodash';\nimport { HTPasswd } from 'verdaccio-htpasswd';\n\nimport { createAnonymousRemoteUser, createRemoteUser } from '@verdaccio/config';\nimport {\n  API_ERROR,\n  SUPPORT_ERRORS,\n  TOKEN_BASIC,\n  TOKEN_BEARER,\n  VerdaccioError,\n  errorUtils,\n  pluginUtils,\n} from '@verdaccio/core';\nimport { asyncLoadPlugin } from '@verdaccio/loaders';\nimport { logger } from '@verdaccio/logger';\nimport {\n  AllowAccess,\n  Callback,\n  Config,\n  JWTSignOptions,\n  Logger,\n  PackageAccess,\n  RemoteUser,\n  Security,\n} from '@verdaccio/types';\nimport { getMatchedPackagesSpec, isFunction, isNil } from '@verdaccio/utils';\n\nimport { signPayload } from './jwt-token';\nimport { aesEncrypt } from './legacy-token';\nimport { parseBasicPayload } from './token';\nimport {\n  convertPayloadToBase64,\n  getDefaultPlugins,\n  getMiddlewareCredentials,\n  isAESLegacy,\n  isAuthHeaderValid,\n  parseAuthTokenHeader,\n  verifyJWTPayload,\n} from './utils';\n\nconst debug = buildDebug('verdaccio:auth');\n\nexport interface TokenEncryption {\n  jwtEncrypt(user: RemoteUser, signOptions: JWTSignOptions): Promise<string>;\n  aesEncrypt(buf: string): string | void;\n}\n\nexport interface AESPayload {\n  user: string;\n  password: string;\n}\nexport interface IAuthMiddleware {\n  apiJWTmiddleware(): $NextFunctionVer;\n  webUIJWTmiddleware(): $NextFunctionVer;\n}\n\nexport type $RequestExtend = Request & { remote_user?: any; log: Logger };\nexport type $ResponseExtend = Response & { cookies?: any };\nexport type $NextFunctionVer = NextFunction & any;\n\nclass Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {\n  public config: Config;\n  public secret: string;\n  public plugins: pluginUtils.Auth<Config>[];\n\n  public constructor(config: Config) {\n    this.config = config;\n    this.secret = config.secret;\n    this.plugins = [];\n    if (!this.secret) {\n      throw new TypeError('secret it is required value on initialize the auth class');\n    }\n  }\n\n  public async init() {\n    let plugins = (await this.loadPlugin()) as pluginUtils.Auth<unknown>[];\n    debug('auth plugins found %s', plugins.length);\n    if (!plugins || plugins.length === 0) {\n      plugins = this.loadDefaultPlugin();\n    }\n    this.plugins = plugins;\n\n    this._applyDefaultPlugins();\n  }\n\n  private loadDefaultPlugin() {\n    debug('load default auth plugin');\n    const pluginOptions: pluginUtils.PluginOptions = {\n      config: this.config,\n      logger,\n    };\n    let authPlugin;\n    try {\n      authPlugin = new HTPasswd(\n        { file: './htpasswd' },\n        pluginOptions as any as pluginUtils.PluginOptions\n      );\n    } catch (error: any) {\n      debug('error on loading auth htpasswd plugin stack: %o', error);\n      logger.info({}, 'no auth plugin has been found');\n      return [];\n    }\n\n    return [authPlugin];\n  }\n\n  private async loadPlugin() {\n    return asyncLoadPlugin<pluginUtils.Auth<unknown>>(\n      this.config.auth,\n      {\n        config: this.config,\n        logger,\n      },\n      (plugin): boolean => {\n        const { authenticate, allow_access, allow_publish } = plugin;\n\n        return (\n          typeof authenticate !== 'undefined' ||\n          typeof allow_access !== 'undefined' ||\n          typeof allow_publish !== 'undefined'\n        );\n      },\n      this.config?.serverSettings?.pluginPrefix\n    );\n  }\n\n  private _applyDefaultPlugins(): void {\n    // TODO: rename to applyFallbackPluginMethods\n    this.plugins.push(getDefaultPlugins(logger));\n  }\n\n  public changePassword(\n    username: string,\n    password: string,\n    newPassword: string,\n    cb: Callback\n  ): void {\n    const validPlugins = _.filter(this.plugins, (plugin) => isFunction(plugin.changePassword));\n\n    if (_.isEmpty(validPlugins)) {\n      return cb(errorUtils.getInternalError(SUPPORT_ERRORS.PLUGIN_MISSING_INTERFACE));\n    }\n\n    for (const plugin of validPlugins) {\n      if (isNil(plugin) || isFunction(plugin.changePassword) === false) {\n        debug('auth plugin does not implement changePassword, trying next one');\n        continue;\n      } else {\n        debug('updating password for %o', username);\n        plugin.changePassword!(username, password, newPassword, (err, profile): void => {\n          if (err) {\n            logger.error(\n              { username, err },\n              `An error has been produced\n            updating the password for @{username}. Error: @{err.message}`\n            );\n            return cb(err);\n          }\n\n          debug('updated password for %o was successful', username);\n          return cb(null, profile);\n        });\n      }\n    }\n  }\n\n  public async invalidateToken(token: string) {\n    // eslint-disable-next-line no-console\n    console.log('invalidate token pending to implement', token);\n    return Promise.resolve();\n  }\n\n  public authenticate(\n    username: string,\n    password: string,\n    cb: (error: VerdaccioError | null, user?: RemoteUser) => void\n  ): void {\n    const plugins = this.plugins.slice(0);\n    (function next(): void {\n      const plugin = plugins.shift() as pluginUtils.Auth<Config>;\n\n      if (isFunction(plugin.authenticate) === false) {\n        return next();\n      }\n\n      debug('authenticating %o', username);\n      plugin.authenticate(username, password, function (err: VerdaccioError | null, groups): void {\n        if (err) {\n          debug('authenticating for user %o failed. Error: %o', username, err?.message);\n          return cb(err);\n        }\n\n        // Expect: SKIP if groups is falsey and not an array\n        //         with at least one item (truthy length)\n        // Expect: CONTINUE otherwise (will error if groups is not\n        //         an array, but this is current behavior)\n        // Caveat: STRING (if valid) will pass successfully\n        //         bug give unexpected results\n        // Info: Cannot use `== false to check falsey values`\n        if (!!groups && groups.length !== 0) {\n          // TODO: create a better understanding of expectations\n          if (_.isString(groups)) {\n            throw new TypeError('plugin group error: invalid type for function');\n          }\n          const isGroupValid: boolean = _.isArray(groups);\n          if (!isGroupValid) {\n            throw new TypeError(API_ERROR.BAD_FORMAT_USER_GROUP);\n          }\n\n          debug('authentication for user %o was successfully. Groups: %o', username, groups);\n          return cb(err, createRemoteUser(username, groups));\n        }\n        next();\n      });\n    })();\n  }\n\n  public add_user(\n    user: string,\n    password: string,\n    cb: (error: VerdaccioError | null, user?: RemoteUser) => void\n  ): void {\n    const self = this;\n    const plugins = this.plugins.slice(0);\n    debug('add user %o', user);\n\n    (function next(): void {\n      const plugin = plugins.shift() as pluginUtils.Auth<Config>;\n      if (typeof plugin.adduser !== 'function') {\n        next();\n      } else {\n        // @ts-expect-error future major (7.x) should remove this section\n        if (typeof plugin.adduser === 'undefined' && typeof plugin.add_user === 'function') {\n          throw errorUtils.getInternalError(\n            'add_user method not longer supported, rename to adduser'\n          );\n        }\n\n        plugin.adduser(\n          user,\n          password,\n          function (err: VerdaccioError | null, ok?: boolean | string): void {\n            if (err) {\n              debug('the user  %o could not being added. Error: %o', user, err?.message);\n              return cb(err);\n            }\n            if (ok) {\n              debug('the user %o has been added', user);\n              return self.authenticate(user, password, cb);\n            }\n            next();\n          }\n        );\n      }\n    })();\n  }\n\n  /**\n   * Allow user to access a package.\n   */\n  public allow_access(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: pluginUtils.AccessCallback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkgAllowAccess: AllowAccess = { name: packageName, version: packageVersion };\n    const pkg = Object.assign(\n      {},\n      pkgAllowAccess,\n      getMatchedPackagesSpec(packageName, this.config.packages)\n    ) as AllowAccess & PackageAccess;\n    debug('allow access for %o', packageName);\n\n    (function next(): void {\n      const plugin: pluginUtils.Auth<unknown> = plugins.shift() as pluginUtils.Auth<unknown>;\n\n      if (_.isNil(plugin) || isFunction(plugin.allow_access) === false) {\n        return next();\n      }\n\n      plugin.allow_access!(user, pkg, function (err: VerdaccioError | null, ok?: boolean): void {\n        if (err) {\n          debug('forbidden access for %o. Error: %o', packageName, err?.message);\n          return callback(err);\n        }\n\n        if (ok) {\n          debug('allowed access for %o', packageName);\n          return callback(null, ok);\n        }\n\n        next(); // cb(null, false) causes next plugin to roll\n      });\n    })();\n  }\n\n  public allow_unpublish(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: Callback\n  ): void {\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      getMatchedPackagesSpec(packageName, this.config.packages)\n    );\n    debug('allow unpublish for %o', packageName);\n\n    for (const plugin of this.plugins) {\n      if (_.isNil(plugin) || isFunction(plugin.allow_unpublish) === false) {\n        debug('allow unpublish for %o plugin does not implement allow_unpublish', packageName);\n        continue;\n      } else {\n        // @ts-ignore\n        plugin.allow_unpublish!(user, pkg, (err, ok: boolean): void => {\n          if (err) {\n            debug(\n              'forbidden publish for %o, it will fallback on unpublish permissions',\n              packageName\n            );\n            return callback(err);\n          }\n\n          if (_.isNil(ok) === true) {\n            debug('bypass unpublish for %o, publish will handle the access', packageName);\n            // @ts-ignore\n            // eslint-disable-next-line\n            return this.allow_publish(...arguments);\n          }\n\n          if (ok) {\n            debug('allowed unpublish for %o', packageName);\n            return callback(null, ok);\n          }\n        });\n      }\n    }\n  }\n\n  /**\n   * Allow user to publish a package.\n   */\n  public allow_publish(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: Callback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      getMatchedPackagesSpec(packageName, this.config.packages)\n    ) as any;\n    debug('allow publish for %o init | plugins: %o', packageName, plugins.length);\n\n    (function next(): void {\n      const plugin = plugins.shift();\n\n      if (typeof plugin?.allow_publish !== 'function') {\n        debug('allow publish for %o plugin does not implement allow_publish', packageName);\n        return next();\n      }\n\n      plugin.allow_publish(user, pkg, (err: VerdaccioError | null, ok?: boolean): void => {\n        if (_.isNil(err) === false && _.isError(err)) {\n          debug('forbidden publish for %o', packageName);\n          return callback(err);\n        }\n\n        if (ok) {\n          debug('allowed publish for %o', packageName);\n          return callback(null, ok);\n        }\n\n        debug('allow publish skip validation for %o', packageName);\n        next(); // cb(null, false) causes next plugin to roll\n      });\n    })();\n  }\n\n  public apiJWTmiddleware(): RequestHandler {\n    debug('jwt middleware');\n    const plugins = this.plugins.slice(0);\n    const helpers = { createAnonymousRemoteUser, createRemoteUser };\n    for (const plugin of plugins) {\n      if (plugin.apiJWTmiddleware) {\n        return plugin.apiJWTmiddleware(helpers);\n      }\n    }\n\n    // @ts-ignore\n    return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction) => {\n      req.pause();\n\n      const next = function (err?: VerdaccioError): any {\n        req.resume();\n        // uncomment this to reject users with bad auth headers\n        // return _next.apply(null, arguments)\n        // swallow error, user remains unauthorized\n        // set remoteUserError to indicate that user was attempting authentication\n        if (err) {\n          req.remote_user.error = err.message;\n        }\n\n        return _next();\n      };\n\n      if (this._isRemoteUserValid(req.remote_user)) {\n        debug('jwt has a valid authentication header');\n        return next();\n      }\n\n      // in case auth header does not exist we return anonymous function\n      const remoteUser = createAnonymousRemoteUser();\n      req.remote_user = remoteUser;\n      res.locals.remote_user = remoteUser;\n\n      const { authorization } = req.headers;\n      if (_.isNil(authorization)) {\n        debug('jwt, authentication header is missing');\n        return next();\n      }\n\n      if (!isAuthHeaderValid(authorization)) {\n        debug('api middleware authentication heather is invalid');\n        return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n      }\n      const { secret, security } = this.config;\n\n      if (isAESLegacy(security)) {\n        debug('api middleware using legacy auth token');\n        this._handleAESMiddleware(req, security, secret, authorization, next);\n      } else {\n        debug('api middleware using JWT auth token');\n        this._handleJWTAPIMiddleware(req, security, secret, authorization, next);\n      }\n    };\n  }\n\n  private _handleJWTAPIMiddleware(\n    req: $RequestExtend,\n    security: Security,\n    secret: string,\n    authorization: string,\n    next: Function\n  ): void {\n    debug('handle JWT api middleware');\n    const { scheme, token } = parseAuthTokenHeader(authorization);\n    if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {\n      debug('handle basic token');\n      // this should happen when client tries to login with an existing user\n      const credentials = convertPayloadToBase64(token).toString();\n      const { user, password } = parseBasicPayload(credentials) as AESPayload;\n      debug('authenticating %o', user);\n      this.authenticate(user, password, (err: VerdaccioError | null, user): void => {\n        if (!err) {\n          debug('generating a remote user');\n          req.remote_user = user;\n          next();\n        } else {\n          debug('generating anonymous user');\n          req.remote_user = createAnonymousRemoteUser();\n          next(err);\n        }\n      });\n    } else {\n      debug('handle jwt token');\n      const credentials: any = getMiddlewareCredentials(security, secret, authorization);\n      if (credentials) {\n        // if the signature is valid we rely on it\n        req.remote_user = credentials;\n        debug('generating a remote user');\n        next();\n      } else {\n        // with JWT throw 401\n        debug('jwt invalid token');\n        next(errorUtils.getForbidden(API_ERROR.BAD_USERNAME_PASSWORD));\n      }\n    }\n  }\n\n  private _handleAESMiddleware(\n    req: $RequestExtend,\n    security: Security,\n    secret: string,\n    authorization: string,\n    next: Function\n  ): void {\n    debug('handle legacy api middleware');\n    debug('api middleware secret %o', typeof secret === 'string');\n    debug('api middleware authorization %o', typeof authorization === 'string');\n    const credentials: any = getMiddlewareCredentials(security, secret, authorization);\n    debug('api middleware credentials %o', credentials?.name);\n    if (credentials) {\n      const { user, password } = credentials;\n      debug('authenticating %o', user);\n      this.authenticate(user, password, (err, user): void => {\n        if (!err) {\n          req.remote_user = user;\n          debug('generating a remote user');\n          next();\n        } else {\n          req.remote_user = createAnonymousRemoteUser();\n          debug('generating anonymous user');\n          next(err);\n        }\n      });\n    } else {\n      // we force npm client to ask again with basic authentication\n      debug('legacy invalid header');\n      return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n    }\n  }\n\n  private _isRemoteUserValid(remote_user?: RemoteUser): boolean {\n    return _.isUndefined(remote_user) === false && _.isUndefined(remote_user?.name) === false;\n  }\n\n  /**\n   * JWT middleware for WebUI\n   */\n  public webUIJWTmiddleware(): RequestHandler {\n    // @ts-ignore\n    return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction): void => {\n      if (this._isRemoteUserValid(req.remote_user)) {\n        return _next();\n      }\n\n      req.pause();\n      const next = (err: VerdaccioError | void): void => {\n        req.resume();\n        if (err) {\n          // req.remote_user.error = err.message;\n          res.status(err.statusCode).send(err.message);\n        }\n\n        return _next();\n      };\n\n      const { authorization } = req.headers;\n      if (_.isNil(authorization)) {\n        return next();\n      }\n\n      if (!isAuthHeaderValid(authorization)) {\n        return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n      }\n\n      const token = (authorization || '').replace(`${TOKEN_BEARER} `, '');\n      if (!token) {\n        return next();\n      }\n\n      let credentials: RemoteUser | undefined;\n      try {\n        credentials = verifyJWTPayload(token, this.config.secret);\n      } catch (err: any) {\n        // FIXME: intended behaviour, do we want it?\n      }\n\n      if (this._isRemoteUserValid(credentials)) {\n        const { name, groups } = credentials as RemoteUser;\n        req.remote_user = createRemoteUser(name as string, groups);\n      } else {\n        req.remote_user = createAnonymousRemoteUser();\n      }\n\n      next();\n    };\n  }\n\n  public async jwtEncrypt(user: RemoteUser, signOptions: JWTSignOptions): Promise<string> {\n    const { real_groups, name, groups } = user;\n    debug('jwt encrypt %o', name);\n    const realGroupsValidated = _.isNil(real_groups) ? [] : real_groups;\n    const groupedGroups = _.isNil(groups)\n      ? real_groups\n      : Array.from(new Set([...groups.concat(realGroupsValidated)]));\n    const payload: RemoteUser = {\n      real_groups: realGroupsValidated,\n      name,\n      groups: groupedGroups,\n    };\n\n    const token: string = await signPayload(payload, this.secret, signOptions);\n\n    return token;\n  }\n\n  /**\n   * Encrypt a string.\n   */\n  public aesEncrypt(value: string): string | void {\n    return aesEncrypt(value, this.secret);\n  }\n}\n\nexport { Auth };\n"],"mappings":";;;;;;AAAA;AAEA;AACA;AAEA;AACA;AASA;AACA;AAWA;AAEA;AACA;AACA;AACA;AAQiB;AAEjB,MAAMA,KAAK,GAAG,IAAAC,cAAU,EAAC,gBAAgB,CAAC;AAoB1C,MAAMC,IAAI,CAAqE;EAKtEC,WAAW,CAACC,MAAc,EAAE;IACjC,IAAI,CAACA,MAAM,GAAGA,MAAM;IACpB,IAAI,CAACC,MAAM,GAAGD,MAAM,CAACC,MAAM;IAC3B,IAAI,CAACC,OAAO,GAAG,EAAE;IACjB,IAAI,CAAC,IAAI,CAACD,MAAM,EAAE;MAChB,MAAM,IAAIE,SAAS,CAAC,0DAA0D,CAAC;IACjF;EACF;EAEA,MAAaC,IAAI,GAAG;IAClB,IAAIF,OAAO,GAAI,MAAM,IAAI,CAACG,UAAU,EAAkC;IACtET,KAAK,CAAC,uBAAuB,EAAEM,OAAO,CAACI,MAAM,CAAC;IAC9C,IAAI,CAACJ,OAAO,IAAIA,OAAO,CAACI,MAAM,KAAK,CAAC,EAAE;MACpCJ,OAAO,GAAG,IAAI,CAACK,iBAAiB,EAAE;IACpC;IACA,IAAI,CAACL,OAAO,GAAGA,OAAO;IAEtB,IAAI,CAACM,oBAAoB,EAAE;EAC7B;EAEQD,iBAAiB,GAAG;IAC1BX,KAAK,CAAC,0BAA0B,CAAC;IACjC,MAAMa,aAAwC,GAAG;MAC/CT,MAAM,EAAE,IAAI,CAACA,MAAM;MACnBU,MAAM,EAANA;IACF,CAAC;IACD,IAAIC,UAAU;IACd,IAAI;MACFA,UAAU,GAAG,IAAIC,2BAAQ,CACvB;QAAEC,IAAI,EAAE;MAAa,CAAC,EACtBJ,aAAa,CACd;IACH,CAAC,CAAC,OAAOK,KAAU,EAAE;MACnBlB,KAAK,CAAC,iDAAiD,EAAEkB,KAAK,CAAC;MAC/DJ,cAAM,CAACK,IAAI,CAAC,CAAC,CAAC,EAAE,+BAA+B,CAAC;MAChD,OAAO,EAAE;IACX;IAEA,OAAO,CAACJ,UAAU,CAAC;EACrB;EAEA,MAAcN,UAAU,GAAG;IAAA;IACzB,OAAO,IAAAW,wBAAe,EACpB,IAAI,CAAChB,MAAM,CAACiB,IAAI,EAChB;MACEjB,MAAM,EAAE,IAAI,CAACA,MAAM;MACnBU,MAAM,EAANA;IACF,CAAC,EACAQ,MAAM,IAAc;MACnB,MAAM;QAAEC,YAAY;QAAEC,YAAY;QAAEC;MAAc,CAAC,GAAGH,MAAM;MAE5D,OACE,OAAOC,YAAY,KAAK,WAAW,IACnC,OAAOC,YAAY,KAAK,WAAW,IACnC,OAAOC,aAAa,KAAK,WAAW;IAExC,CAAC,kBACD,IAAI,CAACrB,MAAM,0EAAX,aAAasB,cAAc,0DAA3B,sBAA6BC,YAAY,CAC1C;EACH;EAEQf,oBAAoB,GAAS;IACnC;IACA,IAAI,CAACN,OAAO,CAACsB,IAAI,CAAC,IAAAC,yBAAiB,EAACf,cAAM,CAAC,CAAC;EAC9C;EAEOgB,cAAc,CACnBC,QAAgB,EAChBC,QAAgB,EAChBC,WAAmB,EACnBC,EAAY,EACN;IACN,MAAMC,YAAY,GAAGC,eAAC,CAACC,MAAM,CAAC,IAAI,CAAC/B,OAAO,EAAGgB,MAAM,IAAK,IAAAgB,iBAAU,EAAChB,MAAM,CAACQ,cAAc,CAAC,CAAC;IAE1F,IAAIM,eAAC,CAACG,OAAO,CAACJ,YAAY,CAAC,EAAE;MAC3B,OAAOD,EAAE,CAACM,gBAAU,CAACC,gBAAgB,CAACC,oBAAc,CAACC,wBAAwB,CAAC,CAAC;IACjF;IAEA,KAAK,MAAMrB,MAAM,IAAIa,YAAY,EAAE;MACjC,IAAI,IAAAS,YAAK,EAACtB,MAAM,CAAC,IAAI,IAAAgB,iBAAU,EAAChB,MAAM,CAACQ,cAAc,CAAC,KAAK,KAAK,EAAE;QAChE9B,KAAK,CAAC,gEAAgE,CAAC;QACvE;MACF,CAAC,MAAM;QACLA,KAAK,CAAC,0BAA0B,EAAE+B,QAAQ,CAAC;QAC3CT,MAAM,CAACQ,cAAc,CAAEC,QAAQ,EAAEC,QAAQ,EAAEC,WAAW,EAAE,CAACY,GAAG,EAAEC,OAAO,KAAW;UAC9E,IAAID,GAAG,EAAE;YACP/B,cAAM,CAACI,KAAK,CACV;cAAEa,QAAQ;cAAEc;YAAI,CAAC,EAChB;AACf,yEAAyE,CAC5D;YACD,OAAOX,EAAE,CAACW,GAAG,CAAC;UAChB;UAEA7C,KAAK,CAAC,wCAAwC,EAAE+B,QAAQ,CAAC;UACzD,OAAOG,EAAE,CAAC,IAAI,EAAEY,OAAO,CAAC;QAC1B,CAAC,CAAC;MACJ;IACF;EACF;EAEA,MAAaC,eAAe,CAACC,KAAa,EAAE;IAC1C;IACAC,OAAO,CAACC,GAAG,CAAC,uCAAuC,EAAEF,KAAK,CAAC;IAC3D,OAAOG,OAAO,CAACC,OAAO,EAAE;EAC1B;EAEO7B,YAAY,CACjBQ,QAAgB,EAChBC,QAAgB,EAChBE,EAA6D,EACvD;IACN,MAAM5B,OAAO,GAAG,IAAI,CAACA,OAAO,CAAC+C,KAAK,CAAC,CAAC,CAAC;IACrC,CAAC,SAASC,IAAI,GAAS;MACrB,MAAMhC,MAAM,GAAGhB,OAAO,CAACiD,KAAK,EAA8B;MAE1D,IAAI,IAAAjB,iBAAU,EAAChB,MAAM,CAACC,YAAY,CAAC,KAAK,KAAK,EAAE;QAC7C,OAAO+B,IAAI,EAAE;MACf;MAEAtD,KAAK,CAAC,mBAAmB,EAAE+B,QAAQ,CAAC;MACpCT,MAAM,CAACC,YAAY,CAACQ,QAAQ,EAAEC,QAAQ,EAAE,UAAUa,GAA0B,EAAEW,MAAM,EAAQ;QAC1F,IAAIX,GAAG,EAAE;UACP7C,KAAK,CAAC,8CAA8C,EAAE+B,QAAQ,EAAEc,GAAG,aAAHA,GAAG,uBAAHA,GAAG,CAAEY,OAAO,CAAC;UAC7E,OAAOvB,EAAE,CAACW,GAAG,CAAC;QAChB;;QAEA;QACA;QACA;QACA;QACA;QACA;QACA;QACA,IAAI,CAAC,CAACW,MAAM,IAAIA,MAAM,CAAC9C,MAAM,KAAK,CAAC,EAAE;UACnC;UACA,IAAI0B,eAAC,CAACsB,QAAQ,CAACF,MAAM,CAAC,EAAE;YACtB,MAAM,IAAIjD,SAAS,CAAC,+CAA+C,CAAC;UACtE;UACA,MAAMoD,YAAqB,GAAGvB,eAAC,CAACwB,OAAO,CAACJ,MAAM,CAAC;UAC/C,IAAI,CAACG,YAAY,EAAE;YACjB,MAAM,IAAIpD,SAAS,CAACsD,eAAS,CAACC,qBAAqB,CAAC;UACtD;UAEA9D,KAAK,CAAC,yDAAyD,EAAE+B,QAAQ,EAAEyB,MAAM,CAAC;UAClF,OAAOtB,EAAE,CAACW,GAAG,EAAE,IAAAkB,wBAAgB,EAAChC,QAAQ,EAAEyB,MAAM,CAAC,CAAC;QACpD;QACAF,IAAI,EAAE;MACR,CAAC,CAAC;IACJ,CAAC,GAAG;EACN;EAEOU,QAAQ,CACbC,IAAY,EACZjC,QAAgB,EAChBE,EAA6D,EACvD;IACN,MAAMgC,IAAI,GAAG,IAAI;IACjB,MAAM5D,OAAO,GAAG,IAAI,CAACA,OAAO,CAAC+C,KAAK,CAAC,CAAC,CAAC;IACrCrD,KAAK,CAAC,aAAa,EAAEiE,IAAI,CAAC;IAE1B,CAAC,SAASX,IAAI,GAAS;MACrB,MAAMhC,MAAM,GAAGhB,OAAO,CAACiD,KAAK,EAA8B;MAC1D,IAAI,OAAOjC,MAAM,CAAC6C,OAAO,KAAK,UAAU,EAAE;QACxCb,IAAI,EAAE;MACR,CAAC,MAAM;QACL;QACA,IAAI,OAAOhC,MAAM,CAAC6C,OAAO,KAAK,WAAW,IAAI,OAAO7C,MAAM,CAAC0C,QAAQ,KAAK,UAAU,EAAE;UAClF,MAAMxB,gBAAU,CAACC,gBAAgB,CAC/B,yDAAyD,CAC1D;QACH;QAEAnB,MAAM,CAAC6C,OAAO,CACZF,IAAI,EACJjC,QAAQ,EACR,UAAUa,GAA0B,EAAEuB,EAAqB,EAAQ;UACjE,IAAIvB,GAAG,EAAE;YACP7C,KAAK,CAAC,+CAA+C,EAAEiE,IAAI,EAAEpB,GAAG,aAAHA,GAAG,uBAAHA,GAAG,CAAEY,OAAO,CAAC;YAC1E,OAAOvB,EAAE,CAACW,GAAG,CAAC;UAChB;UACA,IAAIuB,EAAE,EAAE;YACNpE,KAAK,CAAC,4BAA4B,EAAEiE,IAAI,CAAC;YACzC,OAAOC,IAAI,CAAC3C,YAAY,CAAC0C,IAAI,EAAEjC,QAAQ,EAAEE,EAAE,CAAC;UAC9C;UACAoB,IAAI,EAAE;QACR,CAAC,CACF;MACH;IACF,CAAC,GAAG;EACN;;EAEA;AACF;AACA;EACS9B,YAAY,CACjB;IAAE6C,WAAW;IAAEC;EAA8C,CAAC,EAC9DL,IAAgB,EAChBM,QAAoC,EAC9B;IACN,MAAMjE,OAAO,GAAG,IAAI,CAACA,OAAO,CAAC+C,KAAK,CAAC,CAAC,CAAC;IACrC,MAAMmB,cAA2B,GAAG;MAAEC,IAAI,EAAEJ,WAAW;MAAEK,OAAO,EAAEJ;IAAe,CAAC;IAClF,MAAMK,GAAG,GAAGC,MAAM,CAACC,MAAM,CACvB,CAAC,CAAC,EACFL,cAAc,EACd,IAAAM,6BAAsB,EAACT,WAAW,EAAE,IAAI,CAACjE,MAAM,CAAC2E,QAAQ,CAAC,CAC3B;IAChC/E,KAAK,CAAC,qBAAqB,EAAEqE,WAAW,CAAC;IAEzC,CAAC,SAASf,IAAI,GAAS;MACrB,MAAMhC,MAAiC,GAAGhB,OAAO,CAACiD,KAAK,EAA+B;MAEtF,IAAInB,eAAC,CAACQ,KAAK,CAACtB,MAAM,CAAC,IAAI,IAAAgB,iBAAU,EAAChB,MAAM,CAACE,YAAY,CAAC,KAAK,KAAK,EAAE;QAChE,OAAO8B,IAAI,EAAE;MACf;MAEAhC,MAAM,CAACE,YAAY,CAAEyC,IAAI,EAAEU,GAAG,EAAE,UAAU9B,GAA0B,EAAEuB,EAAY,EAAQ;QACxF,IAAIvB,GAAG,EAAE;UACP7C,KAAK,CAAC,oCAAoC,EAAEqE,WAAW,EAAExB,GAAG,aAAHA,GAAG,uBAAHA,GAAG,CAAEY,OAAO,CAAC;UACtE,OAAOc,QAAQ,CAAC1B,GAAG,CAAC;QACtB;QAEA,IAAIuB,EAAE,EAAE;UACNpE,KAAK,CAAC,uBAAuB,EAAEqE,WAAW,CAAC;UAC3C,OAAOE,QAAQ,CAAC,IAAI,EAAEH,EAAE,CAAC;QAC3B;QAEAd,IAAI,EAAE,CAAC,CAAC;MACV,CAAC,CAAC;IACJ,CAAC,GAAG;EACN;;EAEO0B,eAAe,CACpB;IAAEX,WAAW;IAAEC;EAA8C,CAAC,EAC9DL,IAAgB,EAChBM,QAAkB,EACZ;IACN,MAAMI,GAAG,GAAGC,MAAM,CAACC,MAAM,CACvB;MAAEJ,IAAI,EAAEJ,WAAW;MAAEK,OAAO,EAAEJ;IAAe,CAAC,EAC9C,IAAAQ,6BAAsB,EAACT,WAAW,EAAE,IAAI,CAACjE,MAAM,CAAC2E,QAAQ,CAAC,CAC1D;IACD/E,KAAK,CAAC,wBAAwB,EAAEqE,WAAW,CAAC;IAE5C,KAAK,MAAM/C,MAAM,IAAI,IAAI,CAAChB,OAAO,EAAE;MACjC,IAAI8B,eAAC,CAACQ,KAAK,CAACtB,MAAM,CAAC,IAAI,IAAAgB,iBAAU,EAAChB,MAAM,CAAC0D,eAAe,CAAC,KAAK,KAAK,EAAE;QACnEhF,KAAK,CAAC,kEAAkE,EAAEqE,WAAW,CAAC;QACtF;MACF,CAAC,MAAM;QACL;QACA/C,MAAM,CAAC0D,eAAe,CAAEf,IAAI,EAAEU,GAAG,EAAE,CAAC9B,GAAG,EAAEuB,EAAW,KAAW;UAC7D,IAAIvB,GAAG,EAAE;YACP7C,KAAK,CACH,qEAAqE,EACrEqE,WAAW,CACZ;YACD,OAAOE,QAAQ,CAAC1B,GAAG,CAAC;UACtB;UAEA,IAAIT,eAAC,CAACQ,KAAK,CAACwB,EAAE,CAAC,KAAK,IAAI,EAAE;YACxBpE,KAAK,CAAC,yDAAyD,EAAEqE,WAAW,CAAC;YAC7E;YACA;YACA,OAAO,IAAI,CAAC5C,aAAa,CAAC,GAAGwD,SAAS,CAAC;UACzC;UAEA,IAAIb,EAAE,EAAE;YACNpE,KAAK,CAAC,0BAA0B,EAAEqE,WAAW,CAAC;YAC9C,OAAOE,QAAQ,CAAC,IAAI,EAAEH,EAAE,CAAC;UAC3B;QACF,CAAC,CAAC;MACJ;IACF;EACF;;EAEA;AACF;AACA;EACS3C,aAAa,CAClB;IAAE4C,WAAW;IAAEC;EAA8C,CAAC,EAC9DL,IAAgB,EAChBM,QAAkB,EACZ;IACN,MAAMjE,OAAO,GAAG,IAAI,CAACA,OAAO,CAAC+C,KAAK,CAAC,CAAC,CAAC;IACrC,MAAMsB,GAAG,GAAGC,MAAM,CAACC,MAAM,CACvB;MAAEJ,IAAI,EAAEJ,WAAW;MAAEK,OAAO,EAAEJ;IAAe,CAAC,EAC9C,IAAAQ,6BAAsB,EAACT,WAAW,EAAE,IAAI,CAACjE,MAAM,CAAC2E,QAAQ,CAAC,CACnD;IACR/E,KAAK,CAAC,yCAAyC,EAAEqE,WAAW,EAAE/D,OAAO,CAACI,MAAM,CAAC;IAE7E,CAAC,SAAS4C,IAAI,GAAS;MACrB,MAAMhC,MAAM,GAAGhB,OAAO,CAACiD,KAAK,EAAE;MAE9B,IAAI,QAAOjC,MAAM,aAANA,MAAM,uBAANA,MAAM,CAAEG,aAAa,MAAK,UAAU,EAAE;QAC/CzB,KAAK,CAAC,8DAA8D,EAAEqE,WAAW,CAAC;QAClF,OAAOf,IAAI,EAAE;MACf;MAEAhC,MAAM,CAACG,aAAa,CAACwC,IAAI,EAAEU,GAAG,EAAE,CAAC9B,GAA0B,EAAEuB,EAAY,KAAW;QAClF,IAAIhC,eAAC,CAACQ,KAAK,CAACC,GAAG,CAAC,KAAK,KAAK,IAAIT,eAAC,CAAC8C,OAAO,CAACrC,GAAG,CAAC,EAAE;UAC5C7C,KAAK,CAAC,0BAA0B,EAAEqE,WAAW,CAAC;UAC9C,OAAOE,QAAQ,CAAC1B,GAAG,CAAC;QACtB;QAEA,IAAIuB,EAAE,EAAE;UACNpE,KAAK,CAAC,wBAAwB,EAAEqE,WAAW,CAAC;UAC5C,OAAOE,QAAQ,CAAC,IAAI,EAAEH,EAAE,CAAC;QAC3B;QAEApE,KAAK,CAAC,sCAAsC,EAAEqE,WAAW,CAAC;QAC1Df,IAAI,EAAE,CAAC,CAAC;MACV,CAAC,CAAC;IACJ,CAAC,GAAG;EACN;;EAEO6B,gBAAgB,GAAmB;IACxCnF,KAAK,CAAC,gBAAgB,CAAC;IACvB,MAAMM,OAAO,GAAG,IAAI,CAACA,OAAO,CAAC+C,KAAK,CAAC,CAAC,CAAC;IACrC,MAAM+B,OAAO,GAAG;MAAEC,yBAAyB,EAAzBA,iCAAyB;MAAEtB,gBAAgB,EAAhBA;IAAiB,CAAC;IAC/D,KAAK,MAAMzC,MAAM,IAAIhB,OAAO,EAAE;MAC5B,IAAIgB,MAAM,CAAC6D,gBAAgB,EAAE;QAC3B,OAAO7D,MAAM,CAAC6D,gBAAgB,CAACC,OAAO,CAAC;MACzC;IACF;;IAEA;IACA,OAAO,CAACE,GAAmB,EAAEC,GAAoB,EAAEC,KAAmB,KAAK;MACzEF,GAAG,CAACG,KAAK,EAAE;MAEX,MAAMnC,IAAI,GAAG,UAAUT,GAAoB,EAAO;QAChDyC,GAAG,CAACI,MAAM,EAAE;QACZ;QACA;QACA;QACA;QACA,IAAI7C,GAAG,EAAE;UACPyC,GAAG,CAACK,WAAW,CAACzE,KAAK,GAAG2B,GAAG,CAACY,OAAO;QACrC;QAEA,OAAO+B,KAAK,EAAE;MAChB,CAAC;MAED,IAAI,IAAI,CAACI,kBAAkB,CAACN,GAAG,CAACK,WAAW,CAAC,EAAE;QAC5C3F,KAAK,CAAC,uCAAuC,CAAC;QAC9C,OAAOsD,IAAI,EAAE;MACf;;MAEA;MACA,MAAMuC,UAAU,GAAG,IAAAR,iCAAyB,GAAE;MAC9CC,GAAG,CAACK,WAAW,GAAGE,UAAU;MAC5BN,GAAG,CAACO,MAAM,CAACH,WAAW,GAAGE,UAAU;MAEnC,MAAM;QAAEE;MAAc,CAAC,GAAGT,GAAG,CAACU,OAAO;MACrC,IAAI5D,eAAC,CAACQ,KAAK,CAACmD,aAAa,CAAC,EAAE;QAC1B/F,KAAK,CAAC,uCAAuC,CAAC;QAC9C,OAAOsD,IAAI,EAAE;MACf;MAEA,IAAI,CAAC,IAAA2C,yBAAiB,EAACF,aAAa,CAAC,EAAE;QACrC/F,KAAK,CAAC,kDAAkD,CAAC;QACzD,OAAOsD,IAAI,CAACd,gBAAU,CAAC0D,aAAa,CAACrC,eAAS,CAACsC,eAAe,CAAC,CAAC;MAClE;MACA,MAAM;QAAE9F,MAAM;QAAE+F;MAAS,CAAC,GAAG,IAAI,CAAChG,MAAM;MAExC,IAAI,IAAAiG,mBAAW,EAACD,QAAQ,CAAC,EAAE;QACzBpG,KAAK,CAAC,wCAAwC,CAAC;QAC/C,IAAI,CAACsG,oBAAoB,CAAChB,GAAG,EAAEc,QAAQ,EAAE/F,MAAM,EAAE0F,aAAa,EAAEzC,IAAI,CAAC;MACvE,CAAC,MAAM;QACLtD,KAAK,CAAC,qCAAqC,CAAC;QAC5C,IAAI,CAACuG,uBAAuB,CAACjB,GAAG,EAAEc,QAAQ,EAAE/F,MAAM,EAAE0F,aAAa,EAAEzC,IAAI,CAAC;MAC1E;IACF,CAAC;EACH;EAEQiD,uBAAuB,CAC7BjB,GAAmB,EACnBc,QAAkB,EAClB/F,MAAc,EACd0F,aAAqB,EACrBzC,IAAc,EACR;IACNtD,KAAK,CAAC,2BAA2B,CAAC;IAClC,MAAM;MAAEwG,MAAM;MAAExD;IAAM,CAAC,GAAG,IAAAyD,4BAAoB,EAACV,aAAa,CAAC;IAC7D,IAAIS,MAAM,CAACE,WAAW,EAAE,KAAKC,iBAAW,CAACD,WAAW,EAAE,EAAE;MACtD1G,KAAK,CAAC,oBAAoB,CAAC;MAC3B;MACA,MAAM4G,WAAW,GAAG,IAAAC,8BAAsB,EAAC7D,KAAK,CAAC,CAAC8D,QAAQ,EAAE;MAC5D,MAAM;QAAE7C,IAAI;QAAEjC;MAAS,CAAC,GAAG,IAAA+E,wBAAiB,EAACH,WAAW,CAAe;MACvE5G,KAAK,CAAC,mBAAmB,EAAEiE,IAAI,CAAC;MAChC,IAAI,CAAC1C,YAAY,CAAC0C,IAAI,EAAEjC,QAAQ,EAAE,CAACa,GAA0B,EAAEoB,IAAI,KAAW;QAC5E,IAAI,CAACpB,GAAG,EAAE;UACR7C,KAAK,CAAC,0BAA0B,CAAC;UACjCsF,GAAG,CAACK,WAAW,GAAG1B,IAAI;UACtBX,IAAI,EAAE;QACR,CAAC,MAAM;UACLtD,KAAK,CAAC,2BAA2B,CAAC;UAClCsF,GAAG,CAACK,WAAW,GAAG,IAAAN,iCAAyB,GAAE;UAC7C/B,IAAI,CAACT,GAAG,CAAC;QACX;MACF,CAAC,CAAC;IACJ,CAAC,MAAM;MACL7C,KAAK,CAAC,kBAAkB,CAAC;MACzB,MAAM4G,WAAgB,GAAG,IAAAI,gCAAwB,EAACZ,QAAQ,EAAE/F,MAAM,EAAE0F,aAAa,CAAC;MAClF,IAAIa,WAAW,EAAE;QACf;QACAtB,GAAG,CAACK,WAAW,GAAGiB,WAAW;QAC7B5G,KAAK,CAAC,0BAA0B,CAAC;QACjCsD,IAAI,EAAE;MACR,CAAC,MAAM;QACL;QACAtD,KAAK,CAAC,mBAAmB,CAAC;QAC1BsD,IAAI,CAACd,gBAAU,CAACyE,YAAY,CAACpD,eAAS,CAACqD,qBAAqB,CAAC,CAAC;MAChE;IACF;EACF;EAEQZ,oBAAoB,CAC1BhB,GAAmB,EACnBc,QAAkB,EAClB/F,MAAc,EACd0F,aAAqB,EACrBzC,IAAc,EACR;IACNtD,KAAK,CAAC,8BAA8B,CAAC;IACrCA,KAAK,CAAC,0BAA0B,EAAE,OAAOK,MAAM,KAAK,QAAQ,CAAC;IAC7DL,KAAK,CAAC,iCAAiC,EAAE,OAAO+F,aAAa,KAAK,QAAQ,CAAC;IAC3E,MAAMa,WAAgB,GAAG,IAAAI,gCAAwB,EAACZ,QAAQ,EAAE/F,MAAM,EAAE0F,aAAa,CAAC;IAClF/F,KAAK,CAAC,+BAA+B,EAAE4G,WAAW,aAAXA,WAAW,uBAAXA,WAAW,CAAEnC,IAAI,CAAC;IACzD,IAAImC,WAAW,EAAE;MACf,MAAM;QAAE3C,IAAI;QAAEjC;MAAS,CAAC,GAAG4E,WAAW;MACtC5G,KAAK,CAAC,mBAAmB,EAAEiE,IAAI,CAAC;MAChC,IAAI,CAAC1C,YAAY,CAAC0C,IAAI,EAAEjC,QAAQ,EAAE,CAACa,GAAG,EAAEoB,IAAI,KAAW;QACrD,IAAI,CAACpB,GAAG,EAAE;UACRyC,GAAG,CAACK,WAAW,GAAG1B,IAAI;UACtBjE,KAAK,CAAC,0BAA0B,CAAC;UACjCsD,IAAI,EAAE;QACR,CAAC,MAAM;UACLgC,GAAG,CAACK,WAAW,GAAG,IAAAN,iCAAyB,GAAE;UAC7CrF,KAAK,CAAC,2BAA2B,CAAC;UAClCsD,IAAI,CAACT,GAAG,CAAC;QACX;MACF,CAAC,CAAC;IACJ,CAAC,MAAM;MACL;MACA7C,KAAK,CAAC,uBAAuB,CAAC;MAC9B,OAAOsD,IAAI,CAACd,gBAAU,CAAC0D,aAAa,CAACrC,eAAS,CAACsC,eAAe,CAAC,CAAC;IAClE;EACF;EAEQP,kBAAkB,CAACD,WAAwB,EAAW;IAC5D,OAAOvD,eAAC,CAAC+E,WAAW,CAACxB,WAAW,CAAC,KAAK,KAAK,IAAIvD,eAAC,CAAC+E,WAAW,CAACxB,WAAW,aAAXA,WAAW,uBAAXA,WAAW,CAAElB,IAAI,CAAC,KAAK,KAAK;EAC3F;;EAEA;AACF;AACA;EACS2C,kBAAkB,GAAmB;IAC1C;IACA,OAAO,CAAC9B,GAAmB,EAAEC,GAAoB,EAAEC,KAAmB,KAAW;MAC/E,IAAI,IAAI,CAACI,kBAAkB,CAACN,GAAG,CAACK,WAAW,CAAC,EAAE;QAC5C,OAAOH,KAAK,EAAE;MAChB;MAEAF,GAAG,CAACG,KAAK,EAAE;MACX,MAAMnC,IAAI,GAAIT,GAA0B,IAAW;QACjDyC,GAAG,CAACI,MAAM,EAAE;QACZ,IAAI7C,GAAG,EAAE;UACP;UACA0C,GAAG,CAAC8B,MAAM,CAACxE,GAAG,CAACyE,UAAU,CAAC,CAACC,IAAI,CAAC1E,GAAG,CAACY,OAAO,CAAC;QAC9C;QAEA,OAAO+B,KAAK,EAAE;MAChB,CAAC;MAED,MAAM;QAAEO;MAAc,CAAC,GAAGT,GAAG,CAACU,OAAO;MACrC,IAAI5D,eAAC,CAACQ,KAAK,CAACmD,aAAa,CAAC,EAAE;QAC1B,OAAOzC,IAAI,EAAE;MACf;MAEA,IAAI,CAAC,IAAA2C,yBAAiB,EAACF,aAAa,CAAC,EAAE;QACrC,OAAOzC,IAAI,CAACd,gBAAU,CAAC0D,aAAa,CAACrC,eAAS,CAACsC,eAAe,CAAC,CAAC;MAClE;MAEA,MAAMnD,KAAK,GAAG,CAAC+C,aAAa,IAAI,EAAE,EAAEyB,OAAO,CAAE,GAAEC,kBAAa,GAAE,EAAE,EAAE,CAAC;MACnE,IAAI,CAACzE,KAAK,EAAE;QACV,OAAOM,IAAI,EAAE;MACf;MAEA,IAAIsD,WAAmC;MACvC,IAAI;QACFA,WAAW,GAAG,IAAAc,wBAAgB,EAAC1E,KAAK,EAAE,IAAI,CAAC5C,MAAM,CAACC,MAAM,CAAC;MAC3D,CAAC,CAAC,OAAOwC,GAAQ,EAAE;QACjB;MAAA;MAGF,IAAI,IAAI,CAAC+C,kBAAkB,CAACgB,WAAW,CAAC,EAAE;QACxC,MAAM;UAAEnC,IAAI;UAAEjB;QAAO,CAAC,GAAGoD,WAAyB;QAClDtB,GAAG,CAACK,WAAW,GAAG,IAAA5B,wBAAgB,EAACU,IAAI,EAAYjB,MAAM,CAAC;MAC5D,CAAC,MAAM;QACL8B,GAAG,CAACK,WAAW,GAAG,IAAAN,iCAAyB,GAAE;MAC/C;MAEA/B,IAAI,EAAE;IACR,CAAC;EACH;EAEA,MAAaqE,UAAU,CAAC1D,IAAgB,EAAE2D,WAA2B,EAAmB;IACtF,MAAM;MAAEC,WAAW;MAAEpD,IAAI;MAAEjB;IAAO,CAAC,GAAGS,IAAI;IAC1CjE,KAAK,CAAC,gBAAgB,EAAEyE,IAAI,CAAC;IAC7B,MAAMqD,mBAAmB,GAAG1F,eAAC,CAACQ,KAAK,CAACiF,WAAW,CAAC,GAAG,EAAE,GAAGA,WAAW;IACnE,MAAME,aAAa,GAAG3F,eAAC,CAACQ,KAAK,CAACY,MAAM,CAAC,GACjCqE,WAAW,GACXG,KAAK,CAACC,IAAI,CAAC,IAAIC,GAAG,CAAC,CAAC,GAAG1E,MAAM,CAAC2E,MAAM,CAACL,mBAAmB,CAAC,CAAC,CAAC,CAAC;IAChE,MAAMM,OAAmB,GAAG;MAC1BP,WAAW,EAAEC,mBAAmB;MAChCrD,IAAI;MACJjB,MAAM,EAAEuE;IACV,CAAC;IAED,MAAM/E,KAAa,GAAG,MAAM,IAAAqF,qBAAW,EAACD,OAAO,EAAE,IAAI,CAAC/H,MAAM,EAAEuH,WAAW,CAAC;IAE1E,OAAO5E,KAAK;EACd;;EAEA;AACF;AACA;EACSsF,UAAU,CAACC,KAAa,EAAiB;IAC9C,OAAO,IAAAD,uBAAU,EAACC,KAAK,EAAE,IAAI,CAAClI,MAAM,CAAC;EACvC;AACF;AAAC"}

package/build/index.js

@@ -19,11 +19,8 @@ Object.defineProperty(exports, "TokenEncryption", {
     return _auth.TokenEncryption;
   }
 });
-
 var _auth = require("./auth");
-
 var _utils = require("./utils");
-
 Object.keys(_utils).forEach(function (key) {
   if (key === "default" || key === "__esModule") return;
   if (Object.prototype.hasOwnProperty.call(_exportNames, key)) return;
@@ -35,9 +32,7 @@ Object.keys(_utils).forEach(function (key) {
     }
   });
 });
-
 var _legacyToken = require("./legacy-token");
-
 Object.keys(_legacyToken).forEach(function (key) {
   if (key === "default" || key === "__esModule") return;
   if (Object.prototype.hasOwnProperty.call(_exportNames, key)) return;
@@ -49,9 +44,7 @@ Object.keys(_legacyToken).forEach(function (key) {
     }
   });
 });
-
 var _jwtToken = require("./jwt-token");
-
 Object.keys(_jwtToken).forEach(function (key) {
   if (key === "default" || key === "__esModule") return;
   if (Object.prototype.hasOwnProperty.call(_exportNames, key)) return;
@@ -63,9 +56,7 @@ Object.keys(_jwtToken).forEach(function (key) {
     }
   });
 });
-
 var _token = require("./token");
-
 Object.keys(_token).forEach(function (key) {
   if (key === "default" || key === "__esModule") return;
   if (Object.prototype.hasOwnProperty.call(_exportNames, key)) return;

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../src/index.ts"],"sourcesContent":["export { Auth, TokenEncryption } from './auth';\nexport * from './utils';\nexport * from './legacy-token';\nexport * from './jwt-token';\nexport * from './token';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAAA;;AACA;;AAAA;EAAA;EAAA;EAAA;EAAA;IAAA;IAAA;MAAA;IAAA;EAAA;AAAA;;AACA;;AAAA;EAAA;EAAA;EAAA;EAAA;IAAA;IAAA;MAAA;IAAA;EAAA;AAAA;;AACA;;AAAA;EAAA;EAAA;EAAA;EAAA;IAAA;IAAA;MAAA;IAAA;EAAA;AAAA;;AACA;;AAAA;EAAA;EAAA;EAAA;EAAA;IAAA;IAAA;MAAA;IAAA;EAAA;AAAA"}
+{"version":3,"file":"index.js","names":[],"sources":["../src/index.ts"],"sourcesContent":["export { Auth, TokenEncryption } from './auth';\nexport * from './utils';\nexport * from './legacy-token';\nexport * from './jwt-token';\nexport * from './token';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA;AACA;AAAA;EAAA;EAAA;EAAA;EAAA;IAAA;IAAA;MAAA;IAAA;EAAA;AAAA;AACA;AAAA;EAAA;EAAA;EAAA;EAAA;IAAA;IAAA;MAAA;IAAA;EAAA;AAAA;AACA;AAAA;EAAA;EAAA;EAAA;EAAA;IAAA;IAAA;MAAA;IAAA;EAAA;AAAA;AACA;AAAA;EAAA;EAAA;EAAA;EAAA;IAAA;IAAA;MAAA;IAAA;EAAA;AAAA"}

package/build/jwt-token.js

@@ -5,13 +5,9 @@ Object.defineProperty(exports, "__esModule", {
 });
 exports.signPayload = signPayload;
 exports.verifyPayload = verifyPayload;
-
 var _debug = _interopRequireDefault(require("debug"));
-
 var _jsonwebtoken = _interopRequireDefault(require("jsonwebtoken"));
-
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
-
 const debug = (0, _debug.default)('verdaccio:auth:token:jwt');
 /**
  * Sign the payload and return JWT
@@ -20,11 +16,11 @@ const debug = (0, _debug.default)('verdaccio:auth:token:jwt');
  * @param secretOrPrivateKey
  * @param options
  */
-
 async function signPayload(payload, secretOrPrivateKey, options = {}) {
   return new Promise(function (resolve, reject) {
     debug('sign jwt token');
-    return _jsonwebtoken.default.sign(payload, secretOrPrivateKey, // FIXME: upgrade to the latest library and types
+    return _jsonwebtoken.default.sign(payload, secretOrPrivateKey,
+    // FIXME: upgrade to the latest library and types
     // @ts-ignore
     {
       // 1 === 1ms (one millisecond)
@@ -37,7 +33,6 @@ async function signPayload(payload, secretOrPrivateKey, options = {}) {
     });
   });
 }
-
 function verifyPayload(token, secretOrPrivateKey) {
   debug('verify jwt token');
   return _jsonwebtoken.default.verify(token, secretOrPrivateKey);

package/build/jwt-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt-token.js","names":["debug","buildDebug","signPayload","payload","secretOrPrivateKey","options","Promise","resolve","reject","jwt","sign","notBefore","error","token","verifyPayload","verify"],"sources":["../src/jwt-token.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport jwt from 'jsonwebtoken';\n\nimport { JWTSignOptions, RemoteUser } from '@verdaccio/types';\n\nconst debug = buildDebug('verdaccio:auth:token:jwt');\n/**\n * Sign the payload and return JWT\n * https://github.com/auth0/node-jsonwebtoken#jwtsignpayload-secretorprivatekey-options-callback\n * @param payload\n * @param secretOrPrivateKey\n * @param options\n */\nexport async function signPayload(\n  payload: RemoteUser,\n  secretOrPrivateKey: string,\n  options: JWTSignOptions = {}\n): Promise<string> {\n  return new Promise(function (resolve, reject): Promise<string> {\n    debug('sign jwt token');\n    return jwt.sign(\n      payload,\n      secretOrPrivateKey,\n      // FIXME: upgrade to the latest library and types\n      // @ts-ignore\n      {\n        // 1 === 1ms (one millisecond)\n        notBefore: '1', // Make sure the time will not rollback :)\n        ...options,\n      },\n      (error, token: string) => {\n        debug('error on sign jwt token');\n        return error ? reject(error) : resolve(token);\n      }\n    );\n  });\n}\n\nexport function verifyPayload(token: string, secretOrPrivateKey: string): RemoteUser {\n  debug('verify jwt token');\n  return jwt.verify(token, secretOrPrivateKey) as RemoteUser;\n}\n"],"mappings":";;;;;;;;AAAA;;AACA;;;;AAIA,MAAMA,KAAK,GAAG,IAAAC,cAAA,EAAW,0BAAX,CAAd;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AACO,eAAeC,WAAf,CACLC,OADK,EAELC,kBAFK,EAGLC,OAAuB,GAAG,EAHrB,EAIY;EACjB,OAAO,IAAIC,OAAJ,CAAY,UAAUC,OAAV,EAAmBC,MAAnB,EAA4C;IAC7DR,KAAK,CAAC,gBAAD,CAAL;IACA,OAAOS,qBAAA,CAAIC,IAAJ,CACLP,OADK,EAELC,kBAFK,EAGL;IACA;IACA;MACE;MACAO,SAAS,EAAE,GAFb;MAEkB;MAChB,GAAGN;IAHL,CALK,EAUL,CAACO,KAAD,EAAQC,KAAR,KAA0B;MACxBb,KAAK,CAAC,yBAAD,CAAL;MACA,OAAOY,KAAK,GAAGJ,MAAM,CAACI,KAAD,CAAT,GAAmBL,OAAO,CAACM,KAAD,CAAtC;IACD,CAbI,CAAP;EAeD,CAjBM,CAAP;AAkBD;;AAEM,SAASC,aAAT,CAAuBD,KAAvB,EAAsCT,kBAAtC,EAA8E;EACnFJ,KAAK,CAAC,kBAAD,CAAL;EACA,OAAOS,qBAAA,CAAIM,MAAJ,CAAWF,KAAX,EAAkBT,kBAAlB,CAAP;AACD"}
+{"version":3,"file":"jwt-token.js","names":["debug","buildDebug","signPayload","payload","secretOrPrivateKey","options","Promise","resolve","reject","jwt","sign","notBefore","error","token","verifyPayload","verify"],"sources":["../src/jwt-token.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport jwt from 'jsonwebtoken';\n\nimport { JWTSignOptions, RemoteUser } from '@verdaccio/types';\n\nconst debug = buildDebug('verdaccio:auth:token:jwt');\n/**\n * Sign the payload and return JWT\n * https://github.com/auth0/node-jsonwebtoken#jwtsignpayload-secretorprivatekey-options-callback\n * @param payload\n * @param secretOrPrivateKey\n * @param options\n */\nexport async function signPayload(\n  payload: RemoteUser,\n  secretOrPrivateKey: string,\n  options: JWTSignOptions = {}\n): Promise<string> {\n  return new Promise(function (resolve, reject): Promise<string> {\n    debug('sign jwt token');\n    return jwt.sign(\n      payload,\n      secretOrPrivateKey,\n      // FIXME: upgrade to the latest library and types\n      // @ts-ignore\n      {\n        // 1 === 1ms (one millisecond)\n        notBefore: '1', // Make sure the time will not rollback :)\n        ...options,\n      },\n      (error, token: string) => {\n        debug('error on sign jwt token');\n        return error ? reject(error) : resolve(token);\n      }\n    );\n  });\n}\n\nexport function verifyPayload(token: string, secretOrPrivateKey: string): RemoteUser {\n  debug('verify jwt token');\n  return jwt.verify(token, secretOrPrivateKey) as RemoteUser;\n}\n"],"mappings":";;;;;;;AAAA;AACA;AAA+B;AAI/B,MAAMA,KAAK,GAAG,IAAAC,cAAU,EAAC,0BAA0B,CAAC;AACpD;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAeC,WAAW,CAC/BC,OAAmB,EACnBC,kBAA0B,EAC1BC,OAAuB,GAAG,CAAC,CAAC,EACX;EACjB,OAAO,IAAIC,OAAO,CAAC,UAAUC,OAAO,EAAEC,MAAM,EAAmB;IAC7DR,KAAK,CAAC,gBAAgB,CAAC;IACvB,OAAOS,qBAAG,CAACC,IAAI,CACbP,OAAO,EACPC,kBAAkB;IAClB;IACA;IACA;MACE;MACAO,SAAS,EAAE,GAAG;MAAE;MAChB,GAAGN;IACL,CAAC,EACD,CAACO,KAAK,EAAEC,KAAa,KAAK;MACxBb,KAAK,CAAC,yBAAyB,CAAC;MAChC,OAAOY,KAAK,GAAGJ,MAAM,CAACI,KAAK,CAAC,GAAGL,OAAO,CAACM,KAAK,CAAC;IAC/C,CAAC,CACF;EACH,CAAC,CAAC;AACJ;AAEO,SAASC,aAAa,CAACD,KAAa,EAAET,kBAA0B,EAAc;EACnFJ,KAAK,CAAC,kBAAkB,CAAC;EACzB,OAAOS,qBAAG,CAACM,MAAM,CAACF,KAAK,EAAET,kBAAkB,CAAC;AAC9C"}

package/build/legacy-token.js

@@ -6,26 +6,20 @@ Object.defineProperty(exports, "__esModule", {
 exports.aesDecrypt = aesDecrypt;
 exports.aesEncrypt = aesEncrypt;
 exports.defaultAlgorithm = void 0;
-
 var _crypto = require("crypto");
-
 var _debug = _interopRequireDefault(require("debug"));
-
 var _config = require("@verdaccio/config");
-
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
-
 const debug = (0, _debug.default)('verdaccio:auth:token:legacy');
 const defaultAlgorithm = process.env.VERDACCIO_LEGACY_ALGORITHM || 'aes-256-ctr';
 exports.defaultAlgorithm = defaultAlgorithm;
 const inputEncoding = 'utf8';
-const outputEncoding = 'hex'; // For AES, this is always 16
-
-const IV_LENGTH = 16; // Must be 256 bits (32 characters)
+const outputEncoding = 'hex';
+// For AES, this is always 16
+const IV_LENGTH = 16;
+// Must be 256 bits (32 characters)
 // https://stackoverflow.com/questions/50963160/invalid-key-length-in-crypto-createcipheriv#50963356
-
 const VERDACCIO_LEGACY_ENCRYPTION_KEY = process.env.VERDACCIO_LEGACY_ENCRYPTION_KEY;
-
 function aesEncrypt(value, key) {
   // https://nodejs.org/api/crypto.html#crypto_crypto_createcipher_algorithm_password_options
   // https://www.grainger.xyz/changing-from-cipher-to-cipheriv/
@@ -36,33 +30,31 @@ function aesEncrypt(value, key) {
   const isKeyValid = (secretKey === null || secretKey === void 0 ? void 0 : secretKey.length) === _config.TOKEN_VALID_LENGTH;
   debug('length secret key %o', secretKey === null || secretKey === void 0 ? void 0 : secretKey.length);
   debug('is valid secret %o', isKeyValid);
-
   if (!value || !secretKey || !isKeyValid) {
     return;
   }
-
   const cipher = (0, _crypto.createCipheriv)(defaultAlgorithm, secretKey, iv);
-  let encrypted = cipher.update(value, inputEncoding, outputEncoding); // @ts-ignore
-
+  let encrypted = cipher.update(value, inputEncoding, outputEncoding);
+  // @ts-ignore
   encrypted += cipher.final(outputEncoding);
   const token = `${iv.toString('hex')}:${encrypted.toString()}`;
   debug('token generated successfully');
   return Buffer.from(token).toString('base64');
 }
-
 function aesDecrypt(value, key) {
   try {
     const buff = Buffer.from(value, 'base64');
-    const textParts = buff.toString().split(':'); // extract the IV from the first half of the value
-    // @ts-ignore
-
-    const IV = Buffer.from(textParts.shift(), outputEncoding); // extract the encrypted text without the IV
+    const textParts = buff.toString().split(':');
 
+    // extract the IV from the first half of the value
+    // @ts-ignore
+    const IV = Buffer.from(textParts.shift(), outputEncoding);
+    // extract the encrypted text without the IV
     const encryptedText = Buffer.from(textParts.join(':'), outputEncoding);
-    const secretKey = VERDACCIO_LEGACY_ENCRYPTION_KEY || key; // decipher the string
-
-    const decipher = (0, _crypto.createDecipheriv)(defaultAlgorithm, secretKey, IV); // FIXME: fix type here should allow Buffer
-
+    const secretKey = VERDACCIO_LEGACY_ENCRYPTION_KEY || key;
+    // decipher the string
+    const decipher = (0, _crypto.createDecipheriv)(defaultAlgorithm, secretKey, IV);
+    // FIXME: fix type here should allow Buffer
     let decrypted = decipher.update(encryptedText, outputEncoding, inputEncoding);
     decrypted += decipher.final(inputEncoding);
     debug('token decrypted successfully');

package/build/legacy-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"legacy-token.js","names":["debug","buildDebug","defaultAlgorithm","process","env","VERDACCIO_LEGACY_ALGORITHM","inputEncoding","outputEncoding","IV_LENGTH","VERDACCIO_LEGACY_ENCRYPTION_KEY","aesEncrypt","value","key","iv","Buffer","from","randomBytes","secretKey","isKeyValid","length","TOKEN_VALID_LENGTH","cipher","createCipheriv","encrypted","update","final","token","toString","aesDecrypt","buff","textParts","split","IV","shift","encryptedText","join","decipher","createDecipheriv","decrypted","_"],"sources":["../src/legacy-token.ts"],"sourcesContent":["import {\n  BinaryToTextEncoding,\n  CharacterEncoding,\n  createCipheriv,\n  createDecipheriv,\n  randomBytes,\n} from 'crypto';\nimport buildDebug from 'debug';\n\nimport { TOKEN_VALID_LENGTH } from '@verdaccio/config';\n\nconst debug = buildDebug('verdaccio:auth:token:legacy');\n\nexport const defaultAlgorithm = process.env.VERDACCIO_LEGACY_ALGORITHM || 'aes-256-ctr';\nconst inputEncoding: CharacterEncoding = 'utf8';\nconst outputEncoding: BinaryToTextEncoding = 'hex';\n// For AES, this is always 16\nconst IV_LENGTH = 16;\n// Must be 256 bits (32 characters)\n// https://stackoverflow.com/questions/50963160/invalid-key-length-in-crypto-createcipheriv#50963356\nconst VERDACCIO_LEGACY_ENCRYPTION_KEY = process.env.VERDACCIO_LEGACY_ENCRYPTION_KEY;\n\nexport function aesEncrypt(value: string, key: string): string | void {\n  // https://nodejs.org/api/crypto.html#crypto_crypto_createcipher_algorithm_password_options\n  // https://www.grainger.xyz/changing-from-cipher-to-cipheriv/\n  debug('encrypt %o', value);\n  debug('algorithm %o', defaultAlgorithm);\n  const iv = Buffer.from(randomBytes(IV_LENGTH));\n  const secretKey = VERDACCIO_LEGACY_ENCRYPTION_KEY || key;\n  const isKeyValid = secretKey?.length === TOKEN_VALID_LENGTH;\n  debug('length secret key %o', secretKey?.length);\n  debug('is valid secret %o', isKeyValid);\n  if (!value || !secretKey || !isKeyValid) {\n    return;\n  }\n\n  const cipher = createCipheriv(defaultAlgorithm, secretKey, iv);\n  let encrypted = cipher.update(value, inputEncoding, outputEncoding);\n  // @ts-ignore\n  encrypted += cipher.final(outputEncoding);\n  const token = `${iv.toString('hex')}:${encrypted.toString()}`;\n  debug('token generated successfully');\n  return Buffer.from(token).toString('base64');\n}\n\nexport function aesDecrypt(value: string, key: string): string | void {\n  try {\n    const buff = Buffer.from(value, 'base64');\n    const textParts = buff.toString().split(':');\n\n    // extract the IV from the first half of the value\n    // @ts-ignore\n    const IV = Buffer.from(textParts.shift(), outputEncoding);\n    // extract the encrypted text without the IV\n    const encryptedText = Buffer.from(textParts.join(':'), outputEncoding);\n    const secretKey = VERDACCIO_LEGACY_ENCRYPTION_KEY || key;\n    // decipher the string\n    const decipher = createDecipheriv(defaultAlgorithm, secretKey, IV);\n    // FIXME: fix type here should allow Buffer\n    let decrypted = decipher.update(encryptedText as any, outputEncoding, inputEncoding);\n    decrypted += decipher.final(inputEncoding);\n    debug('token decrypted successfully');\n    return decrypted.toString();\n  } catch (_: any) {\n    return;\n  }\n}\n"],"mappings":";;;;;;;;;AAAA;;AAOA;;AAEA;;;;AAEA,MAAMA,KAAK,GAAG,IAAAC,cAAA,EAAW,6BAAX,CAAd;AAEO,MAAMC,gBAAgB,GAAGC,OAAO,CAACC,GAAR,CAAYC,0BAAZ,IAA0C,aAAnE;;AACP,MAAMC,aAAgC,GAAG,MAAzC;AACA,MAAMC,cAAoC,GAAG,KAA7C,C,CACA;;AACA,MAAMC,SAAS,GAAG,EAAlB,C,CACA;AACA;;AACA,MAAMC,+BAA+B,GAAGN,OAAO,CAACC,GAAR,CAAYK,+BAApD;;AAEO,SAASC,UAAT,CAAoBC,KAApB,EAAmCC,GAAnC,EAA+D;EACpE;EACA;EACAZ,KAAK,CAAC,YAAD,EAAeW,KAAf,CAAL;EACAX,KAAK,CAAC,cAAD,EAAiBE,gBAAjB,CAAL;EACA,MAAMW,EAAE,GAAGC,MAAM,CAACC,IAAP,CAAY,IAAAC,mBAAA,EAAYR,SAAZ,CAAZ,CAAX;EACA,MAAMS,SAAS,GAAGR,+BAA+B,IAAIG,GAArD;EACA,MAAMM,UAAU,GAAG,CAAAD,SAAS,SAAT,IAAAA,SAAS,WAAT,YAAAA,SAAS,CAAEE,MAAX,MAAsBC,0BAAzC;EACApB,KAAK,CAAC,sBAAD,EAAyBiB,SAAzB,aAAyBA,SAAzB,uBAAyBA,SAAS,CAAEE,MAApC,CAAL;EACAnB,KAAK,CAAC,oBAAD,EAAuBkB,UAAvB,CAAL;;EACA,IAAI,CAACP,KAAD,IAAU,CAACM,SAAX,IAAwB,CAACC,UAA7B,EAAyC;IACvC;EACD;;EAED,MAAMG,MAAM,GAAG,IAAAC,sBAAA,EAAepB,gBAAf,EAAiCe,SAAjC,EAA4CJ,EAA5C,CAAf;EACA,IAAIU,SAAS,GAAGF,MAAM,CAACG,MAAP,CAAcb,KAAd,EAAqBL,aAArB,EAAoCC,cAApC,CAAhB,CAfoE,CAgBpE;;EACAgB,SAAS,IAAIF,MAAM,CAACI,KAAP,CAAalB,cAAb,CAAb;EACA,MAAMmB,KAAK,GAAI,GAAEb,EAAE,CAACc,QAAH,CAAY,KAAZ,CAAmB,IAAGJ,SAAS,CAACI,QAAV,EAAqB,EAA5D;EACA3B,KAAK,CAAC,8BAAD,CAAL;EACA,OAAOc,MAAM,CAACC,IAAP,CAAYW,KAAZ,EAAmBC,QAAnB,CAA4B,QAA5B,CAAP;AACD;;AAEM,SAASC,UAAT,CAAoBjB,KAApB,EAAmCC,GAAnC,EAA+D;EACpE,IAAI;IACF,MAAMiB,IAAI,GAAGf,MAAM,CAACC,IAAP,CAAYJ,KAAZ,EAAmB,QAAnB,CAAb;IACA,MAAMmB,SAAS,GAAGD,IAAI,CAACF,QAAL,GAAgBI,KAAhB,CAAsB,GAAtB,CAAlB,CAFE,CAIF;IACA;;IACA,MAAMC,EAAE,GAAGlB,MAAM,CAACC,IAAP,CAAYe,SAAS,CAACG,KAAV,EAAZ,EAA+B1B,cAA/B,CAAX,CANE,CAOF;;IACA,MAAM2B,aAAa,GAAGpB,MAAM,CAACC,IAAP,CAAYe,SAAS,CAACK,IAAV,CAAe,GAAf,CAAZ,EAAiC5B,cAAjC,CAAtB;IACA,MAAMU,SAAS,GAAGR,+BAA+B,IAAIG,GAArD,CATE,CAUF;;IACA,MAAMwB,QAAQ,GAAG,IAAAC,wBAAA,EAAiBnC,gBAAjB,EAAmCe,SAAnC,EAA8Ce,EAA9C,CAAjB,CAXE,CAYF;;IACA,IAAIM,SAAS,GAAGF,QAAQ,CAACZ,MAAT,CAAgBU,aAAhB,EAAsC3B,cAAtC,EAAsDD,aAAtD,CAAhB;IACAgC,SAAS,IAAIF,QAAQ,CAACX,KAAT,CAAenB,aAAf,CAAb;IACAN,KAAK,CAAC,8BAAD,CAAL;IACA,OAAOsC,SAAS,CAACX,QAAV,EAAP;EACD,CAjBD,CAiBE,OAAOY,CAAP,EAAe;IACf;EACD;AACF"}
+{"version":3,"file":"legacy-token.js","names":["debug","buildDebug","defaultAlgorithm","process","env","VERDACCIO_LEGACY_ALGORITHM","inputEncoding","outputEncoding","IV_LENGTH","VERDACCIO_LEGACY_ENCRYPTION_KEY","aesEncrypt","value","key","iv","Buffer","from","randomBytes","secretKey","isKeyValid","length","TOKEN_VALID_LENGTH","cipher","createCipheriv","encrypted","update","final","token","toString","aesDecrypt","buff","textParts","split","IV","shift","encryptedText","join","decipher","createDecipheriv","decrypted","_"],"sources":["../src/legacy-token.ts"],"sourcesContent":["import {\n  BinaryToTextEncoding,\n  CharacterEncoding,\n  createCipheriv,\n  createDecipheriv,\n  randomBytes,\n} from 'crypto';\nimport buildDebug from 'debug';\n\nimport { TOKEN_VALID_LENGTH } from '@verdaccio/config';\n\nconst debug = buildDebug('verdaccio:auth:token:legacy');\n\nexport const defaultAlgorithm = process.env.VERDACCIO_LEGACY_ALGORITHM || 'aes-256-ctr';\nconst inputEncoding: CharacterEncoding = 'utf8';\nconst outputEncoding: BinaryToTextEncoding = 'hex';\n// For AES, this is always 16\nconst IV_LENGTH = 16;\n// Must be 256 bits (32 characters)\n// https://stackoverflow.com/questions/50963160/invalid-key-length-in-crypto-createcipheriv#50963356\nconst VERDACCIO_LEGACY_ENCRYPTION_KEY = process.env.VERDACCIO_LEGACY_ENCRYPTION_KEY;\n\nexport function aesEncrypt(value: string, key: string): string | void {\n  // https://nodejs.org/api/crypto.html#crypto_crypto_createcipher_algorithm_password_options\n  // https://www.grainger.xyz/changing-from-cipher-to-cipheriv/\n  debug('encrypt %o', value);\n  debug('algorithm %o', defaultAlgorithm);\n  const iv = Buffer.from(randomBytes(IV_LENGTH));\n  const secretKey = VERDACCIO_LEGACY_ENCRYPTION_KEY || key;\n  const isKeyValid = secretKey?.length === TOKEN_VALID_LENGTH;\n  debug('length secret key %o', secretKey?.length);\n  debug('is valid secret %o', isKeyValid);\n  if (!value || !secretKey || !isKeyValid) {\n    return;\n  }\n\n  const cipher = createCipheriv(defaultAlgorithm, secretKey, iv);\n  let encrypted = cipher.update(value, inputEncoding, outputEncoding);\n  // @ts-ignore\n  encrypted += cipher.final(outputEncoding);\n  const token = `${iv.toString('hex')}:${encrypted.toString()}`;\n  debug('token generated successfully');\n  return Buffer.from(token).toString('base64');\n}\n\nexport function aesDecrypt(value: string, key: string): string | void {\n  try {\n    const buff = Buffer.from(value, 'base64');\n    const textParts = buff.toString().split(':');\n\n    // extract the IV from the first half of the value\n    // @ts-ignore\n    const IV = Buffer.from(textParts.shift(), outputEncoding);\n    // extract the encrypted text without the IV\n    const encryptedText = Buffer.from(textParts.join(':'), outputEncoding);\n    const secretKey = VERDACCIO_LEGACY_ENCRYPTION_KEY || key;\n    // decipher the string\n    const decipher = createDecipheriv(defaultAlgorithm, secretKey, IV);\n    // FIXME: fix type here should allow Buffer\n    let decrypted = decipher.update(encryptedText as any, outputEncoding, inputEncoding);\n    decrypted += decipher.final(inputEncoding);\n    debug('token decrypted successfully');\n    return decrypted.toString();\n  } catch (_: any) {\n    return;\n  }\n}\n"],"mappings":";;;;;;;;AAAA;AAOA;AAEA;AAAuD;AAEvD,MAAMA,KAAK,GAAG,IAAAC,cAAU,EAAC,6BAA6B,CAAC;AAEhD,MAAMC,gBAAgB,GAAGC,OAAO,CAACC,GAAG,CAACC,0BAA0B,IAAI,aAAa;AAAC;AACxF,MAAMC,aAAgC,GAAG,MAAM;AAC/C,MAAMC,cAAoC,GAAG,KAAK;AAClD;AACA,MAAMC,SAAS,GAAG,EAAE;AACpB;AACA;AACA,MAAMC,+BAA+B,GAAGN,OAAO,CAACC,GAAG,CAACK,+BAA+B;AAE5E,SAASC,UAAU,CAACC,KAAa,EAAEC,GAAW,EAAiB;EACpE;EACA;EACAZ,KAAK,CAAC,YAAY,EAAEW,KAAK,CAAC;EAC1BX,KAAK,CAAC,cAAc,EAAEE,gBAAgB,CAAC;EACvC,MAAMW,EAAE,GAAGC,MAAM,CAACC,IAAI,CAAC,IAAAC,mBAAW,EAACR,SAAS,CAAC,CAAC;EAC9C,MAAMS,SAAS,GAAGR,+BAA+B,IAAIG,GAAG;EACxD,MAAMM,UAAU,GAAG,CAAAD,SAAS,aAATA,SAAS,uBAATA,SAAS,CAAEE,MAAM,MAAKC,0BAAkB;EAC3DpB,KAAK,CAAC,sBAAsB,EAAEiB,SAAS,aAATA,SAAS,uBAATA,SAAS,CAAEE,MAAM,CAAC;EAChDnB,KAAK,CAAC,oBAAoB,EAAEkB,UAAU,CAAC;EACvC,IAAI,CAACP,KAAK,IAAI,CAACM,SAAS,IAAI,CAACC,UAAU,EAAE;IACvC;EACF;EAEA,MAAMG,MAAM,GAAG,IAAAC,sBAAc,EAACpB,gBAAgB,EAAEe,SAAS,EAAEJ,EAAE,CAAC;EAC9D,IAAIU,SAAS,GAAGF,MAAM,CAACG,MAAM,CAACb,KAAK,EAAEL,aAAa,EAAEC,cAAc,CAAC;EACnE;EACAgB,SAAS,IAAIF,MAAM,CAACI,KAAK,CAAClB,cAAc,CAAC;EACzC,MAAMmB,KAAK,GAAI,GAAEb,EAAE,CAACc,QAAQ,CAAC,KAAK,CAAE,IAAGJ,SAAS,CAACI,QAAQ,EAAG,EAAC;EAC7D3B,KAAK,CAAC,8BAA8B,CAAC;EACrC,OAAOc,MAAM,CAACC,IAAI,CAACW,KAAK,CAAC,CAACC,QAAQ,CAAC,QAAQ,CAAC;AAC9C;AAEO,SAASC,UAAU,CAACjB,KAAa,EAAEC,GAAW,EAAiB;EACpE,IAAI;IACF,MAAMiB,IAAI,GAAGf,MAAM,CAACC,IAAI,CAACJ,KAAK,EAAE,QAAQ,CAAC;IACzC,MAAMmB,SAAS,GAAGD,IAAI,CAACF,QAAQ,EAAE,CAACI,KAAK,CAAC,GAAG,CAAC;;IAE5C;IACA;IACA,MAAMC,EAAE,GAAGlB,MAAM,CAACC,IAAI,CAACe,SAAS,CAACG,KAAK,EAAE,EAAE1B,cAAc,CAAC;IACzD;IACA,MAAM2B,aAAa,GAAGpB,MAAM,CAACC,IAAI,CAACe,SAAS,CAACK,IAAI,CAAC,GAAG,CAAC,EAAE5B,cAAc,CAAC;IACtE,MAAMU,SAAS,GAAGR,+BAA+B,IAAIG,GAAG;IACxD;IACA,MAAMwB,QAAQ,GAAG,IAAAC,wBAAgB,EAACnC,gBAAgB,EAAEe,SAAS,EAAEe,EAAE,CAAC;IAClE;IACA,IAAIM,SAAS,GAAGF,QAAQ,CAACZ,MAAM,CAACU,aAAa,EAAS3B,cAAc,EAAED,aAAa,CAAC;IACpFgC,SAAS,IAAIF,QAAQ,CAACX,KAAK,CAACnB,aAAa,CAAC;IAC1CN,KAAK,CAAC,8BAA8B,CAAC;IACrC,OAAOsC,SAAS,CAACX,QAAQ,EAAE;EAC7B,CAAC,CAAC,OAAOY,CAAM,EAAE;IACf;EACF;AACF"}

package/build/token.js

@@ -4,14 +4,11 @@ Object.defineProperty(exports, "__esModule", {
   value: true
 });
 exports.parseBasicPayload = parseBasicPayload;
-
 function parseBasicPayload(credentials) {
   const index = credentials.indexOf(':');
-
   if (index < 0) {
     return;
   }
-
   const user = credentials.slice(0, index);
   const password = credentials.slice(index + 1);
   return {

package/build/token.js.map

@@ -1 +1 @@
-{"version":3,"file":"token.js","names":["parseBasicPayload","credentials","index","indexOf","user","slice","password"],"sources":["../src/token.ts"],"sourcesContent":["import { BasicPayload } from './utils';\n\nexport function parseBasicPayload(credentials: string): BasicPayload {\n  const index = credentials.indexOf(':');\n  if (index < 0) {\n    return;\n  }\n\n  const user: string = credentials.slice(0, index);\n  const password: string = credentials.slice(index + 1);\n\n  return { user, password };\n}\n"],"mappings":";;;;;;;AAEO,SAASA,iBAAT,CAA2BC,WAA3B,EAA8D;EACnE,MAAMC,KAAK,GAAGD,WAAW,CAACE,OAAZ,CAAoB,GAApB,CAAd;;EACA,IAAID,KAAK,GAAG,CAAZ,EAAe;IACb;EACD;;EAED,MAAME,IAAY,GAAGH,WAAW,CAACI,KAAZ,CAAkB,CAAlB,EAAqBH,KAArB,CAArB;EACA,MAAMI,QAAgB,GAAGL,WAAW,CAACI,KAAZ,CAAkBH,KAAK,GAAG,CAA1B,CAAzB;EAEA,OAAO;IAAEE,IAAF;IAAQE;EAAR,CAAP;AACD"}
+{"version":3,"file":"token.js","names":["parseBasicPayload","credentials","index","indexOf","user","slice","password"],"sources":["../src/token.ts"],"sourcesContent":["import { BasicPayload } from './utils';\n\nexport function parseBasicPayload(credentials: string): BasicPayload {\n  const index = credentials.indexOf(':');\n  if (index < 0) {\n    return;\n  }\n\n  const user: string = credentials.slice(0, index);\n  const password: string = credentials.slice(index + 1);\n\n  return { user, password };\n}\n"],"mappings":";;;;;;AAEO,SAASA,iBAAiB,CAACC,WAAmB,EAAgB;EACnE,MAAMC,KAAK,GAAGD,WAAW,CAACE,OAAO,CAAC,GAAG,CAAC;EACtC,IAAID,KAAK,GAAG,CAAC,EAAE;IACb;EACF;EAEA,MAAME,IAAY,GAAGH,WAAW,CAACI,KAAK,CAAC,CAAC,EAAEH,KAAK,CAAC;EAChD,MAAMI,QAAgB,GAAGL,WAAW,CAACI,KAAK,CAACH,KAAK,GAAG,CAAC,CAAC;EAErD,OAAO;IAAEE,IAAI;IAAEE;EAAS,CAAC;AAC3B"}

package/build/utils.d.ts

@@ -2,15 +2,15 @@
 import { VerdaccioError, pluginUtils } from '@verdaccio/core';
 import { AuthPackageAllow, Config, Logger, RemoteUser, Security } from '@verdaccio/types';
 import { AESPayload, TokenEncryption } from './auth';
-export declare type BasicPayload = AESPayload | void;
-export declare type AuthMiddlewarePayload = RemoteUser | BasicPayload;
+export type BasicPayload = AESPayload | void;
+export type AuthMiddlewarePayload = RemoteUser | BasicPayload;
 export interface AuthTokenHeader {
     scheme: string;
     token: string;
 }
-export declare type AllowActionCallbackResponse = boolean | undefined;
-export declare type AllowActionCallback = (error: VerdaccioError | null, allowed?: AllowActionCallbackResponse) => void;
-export declare type AllowAction = (user: RemoteUser, pkg: AuthPackageAllow, callback: AllowActionCallback) => void;
+export type AllowActionCallbackResponse = boolean | undefined;
+export type AllowActionCallback = (error: VerdaccioError | null, allowed?: AllowActionCallbackResponse) => void;
+export type AllowAction = (user: RemoteUser, pkg: AuthPackageAllow, callback: AllowActionCallback) => void;
 /**
  * Split authentication header eg: Bearer [secret_token]
  * @param authorizationHeader auth token
@@ -29,7 +29,7 @@ export declare function isAuthHeaderValid(authorization: string): boolean;
  * @returns object of default implementations.
  */
 export declare function getDefaultPlugins(logger: Logger): pluginUtils.Auth<Config>;
-export declare type ActionsAllowed = 'publish' | 'unpublish' | 'access';
+export type ActionsAllowed = 'publish' | 'unpublish' | 'access';
 export declare function allow_action(action: ActionsAllowed, logger: Logger): AllowAction;
 /**
  *