@verdaccio/auth 8.0.4 → 8.1.0

package/build/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","names":["_debug","_interopRequireDefault","require","_lodash","_verdaccioHtpasswd","_config","_core","_loaders","_signature","_utils","e","__esModule","_typeof","o","Symbol","iterator","constructor","prototype","_toConsumableArray","r","_arrayWithoutHoles","_iterableToArray","_unsupportedIterableToArray","_nonIterableSpread","TypeError","Array","from","isArray","_arrayLikeToArray","ownKeys","t","Object","keys","getOwnPropertySymbols","filter","getOwnPropertyDescriptor","enumerable","push","apply","_objectSpread","arguments","length","forEach","_defineProperty","getOwnPropertyDescriptors","defineProperties","defineProperty","_toPropertyKey","value","configurable","writable","_createForOfIteratorHelper","_n","F","s","n","done","f","a","u","call","next","toString","slice","name","test","_regenerator","toStringTag","i","c","Generator","create","_regeneratorDefine2","p","y","G","v","d","bind","l","GeneratorFunction","GeneratorFunctionPrototype","getPrototypeOf","setPrototypeOf","__proto__","displayName","w","m","_regeneratorDefine","_invoke","asyncGeneratorStep","Promise","resolve","then","_asyncToGenerator","_next","_throw","_classCallCheck","_defineProperties","key","_createClass","_toPrimitive","toPrimitive","String","Number","debug","buildDebug","Auth","exports","config","logger","options","undefined","legacyMergeConfigs","secret","plugins","_init","_callee","_context","loadPlugin","auth","loadDefaultPlugin","applyFallbackPluginMethods","init","authPlugin","HTPasswd","file","info","pluginCategory","PLUGIN_CATEGORY","AUTHENTICATION","error","_loadPlugin","_callee2","_this$config$server$p","_this$config","_context2","asyncLoadPlugin","plugin","authenticate","allow_access","allow_publish","server","pluginPrefix","PLUGIN_PREFIX","getDefaultPluginMethods","changePassword","username","password","newPassword","cb","_this","validPlugins","_","isFunction","isEmpty","errorUtils","getInternalError","SUPPORT_ERRORS","PLUGIN_MISSING_INTERFACE","_iterator","_step","isNil","err","profile","_invalidateToken","_callee3","token","_context3","console","log","invalidateToken","_x","shift","groups","message","isString","isGroupValid","API_ERROR","BAD_FORMAT_USER_GROUP","createRemoteUser","add_user","user","self","method","adduser","warningUtils","emit","Codes","VERWAR006","ok","_ref","callback","_this2","packageName","packageVersion","pkg","assign","version","authUtils","getMatchedPackagesSpec","packages","trace","allow_unpublish","_ref2","_this3","_ref3","_this4","apiJWTmiddleware","_this5","helpers","createAnonymousRemoteUser","_iterator2","_step2","req","res","pause","resume","remote_user","remoteUser","locals","authorization","headers","isAuthHeaderValid","getBadRequest","BAD_AUTH_HEADER","_this5$config","security","isAESLegacy","handleAESMiddleware","handleJWTAPIMiddleware","_parseAuthTokenHeader","parseAuthTokenHeader","scheme","toUpperCase","TOKEN_BASIC","credentials","convertPayloadToBase64","parsedCredentials","parseBasicPayload","BAD_USERNAME_PASSWORD","_ref4","tokenKey","getMiddlewareCredentials","getForbidden","_isRemoteUserValid","isUndefined","webUIJWTmiddleware","_this6","status","statusCode","send","replace","concat","TOKEN_BEARER","verifyJWTPayload","_unused","_ref5","_jwtEncrypt","_callee4","signOptions","real_groups","tokenMetadata","realGroupsValidated","groupedGroups","payload","signedToken","_context4","Set","signPayload","jwtEncrypt","_x2","_x3","aesEncrypt","TOKEN_VALID_LENGTH","aesEncryptDeprecated","Buffer"],"sources":["../src/auth.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport _ from 'lodash';\nimport { HTPasswd } from 'verdaccio-htpasswd';\n\nimport { TOKEN_VALID_LENGTH, createAnonymousRemoteUser, createRemoteUser } from '@verdaccio/config';\nimport type { VerdaccioError, pluginUtils } from '@verdaccio/core';\nimport {\n  API_ERROR,\n  PLUGIN_CATEGORY,\n  PLUGIN_PREFIX,\n  SUPPORT_ERRORS,\n  TOKEN_BASIC,\n  TOKEN_BEARER,\n  authUtils,\n  errorUtils,\n  warningUtils,\n} from '@verdaccio/core';\nimport { asyncLoadPlugin } from '@verdaccio/loaders';\nimport {\n  aesEncrypt,\n  aesEncryptDeprecated,\n  parseBasicPayload,\n  signPayload,\n} from '@verdaccio/signature';\nimport type {\n  AllowAccess,\n  Callback,\n  Config,\n  JWTSignOptions,\n  Logger,\n  PackageAccess,\n  RemoteUser,\n  Security,\n} from '@verdaccio/types';\n\nimport type {\n  $RequestExtend,\n  $ResponseExtend,\n  AESPayload,\n  IAuthMiddleware,\n  NextFunction,\n  TokenEncryption,\n} from './types';\nimport {\n  convertPayloadToBase64,\n  getDefaultPluginMethods,\n  getMiddlewareCredentials,\n  isAESLegacy,\n  isAuthHeaderValid,\n  parseAuthTokenHeader,\n  verifyJWTPayload,\n} from './utils';\n\nconst debug = buildDebug('verdaccio:auth');\n\nclass Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {\n  public config: Config;\n  public secret: string;\n  public logger: Logger;\n  public plugins: pluginUtils.Auth<Config>[];\n  public options: { legacyMergeConfigs: boolean };\n\n  public constructor(config: Config, logger: Logger, options = { legacyMergeConfigs: false }) {\n    this.config = config;\n    this.secret = config.secret;\n    this.logger = logger;\n    this.plugins = [];\n    this.options = options;\n    if (!this.secret) {\n      throw new TypeError('secret it is required value on initialize the auth class');\n    }\n  }\n\n  public async init() {\n    let plugins = await this.loadPlugin();\n\n    debug('auth plugins found %s', plugins.length);\n    // Missing auth config or no loaded plugins -> load default htpasswd plugin\n    // Empty auth config (null) -> just use fallback methods\n    if (this.config.auth !== null && (!plugins || plugins.length === 0)) {\n      plugins = this.loadDefaultPlugin();\n    }\n    this.plugins = plugins;\n\n    this.applyFallbackPluginMethods();\n  }\n\n  private loadDefaultPlugin() {\n    debug('load default auth plugin');\n    let authPlugin;\n    try {\n      authPlugin = new HTPasswd(\n        { file: './htpasswd' },\n        {\n          config: this.config,\n          logger: this.logger,\n        }\n      );\n      this.logger.info(\n        { name: 'verdaccio-htpasswd', pluginCategory: PLUGIN_CATEGORY.AUTHENTICATION },\n        'plugin @{name} successfully loaded (@{pluginCategory})'\n      );\n    } catch (error: any) {\n      debug('error on loading auth htpasswd plugin stack: %o', error);\n      this.logger.info({}, 'no auth plugin has been found');\n      return [];\n    }\n\n    return [authPlugin];\n  }\n\n  private async loadPlugin() {\n    return asyncLoadPlugin<pluginUtils.Auth<Config>>(\n      this.config.auth,\n      {\n        config: this.config,\n        logger: this.logger,\n      },\n      (plugin): boolean => {\n        const { authenticate, allow_access, allow_publish } = plugin;\n\n        return (\n          typeof authenticate !== 'undefined' ||\n          typeof allow_access !== 'undefined' ||\n          typeof allow_publish !== 'undefined'\n        );\n      },\n      this.options.legacyMergeConfigs,\n      this.config?.server?.pluginPrefix ?? PLUGIN_PREFIX,\n      PLUGIN_CATEGORY.AUTHENTICATION\n    );\n  }\n\n  private applyFallbackPluginMethods(): void {\n    this.plugins.push(getDefaultPluginMethods(this.logger));\n  }\n\n  public changePassword(\n    username: string,\n    password: string,\n    newPassword: string,\n    cb: Callback\n  ): void {\n    const validPlugins = _.filter(this.plugins, (plugin) => _.isFunction(plugin.changePassword));\n\n    if (_.isEmpty(validPlugins)) {\n      return cb(errorUtils.getInternalError(SUPPORT_ERRORS.PLUGIN_MISSING_INTERFACE));\n    }\n\n    for (const plugin of validPlugins) {\n      if (_.isNil(plugin) || _.isFunction(plugin.changePassword) === false) {\n        debug('auth plugin does not implement changePassword, trying next one');\n        continue;\n      } else {\n        debug('updating password for %o', username);\n        plugin.changePassword!(username, password, newPassword, (err, profile): void => {\n          if (err) {\n            this.logger.error(\n              { username, err },\n              `An error has been produced\n            updating the password for @{username}. Error: @{err.message}`\n            );\n            return cb(err);\n          }\n\n          debug('updated password for %o was successful', username);\n          return cb(null, profile);\n        });\n      }\n    }\n  }\n\n  public async invalidateToken(token: string) {\n    // eslint-disable-next-line no-console\n    console.log('invalidate token pending to implement', token);\n    return Promise.resolve();\n  }\n\n  public authenticate(\n    username: string,\n    password: string,\n    cb: (error: VerdaccioError | null, user?: RemoteUser) => void\n  ): void {\n    const plugins = this.plugins.slice(0);\n    (function next(): void {\n      const plugin = plugins.shift();\n\n      if (typeof plugin?.authenticate !== 'function') {\n        return next();\n      }\n\n      debug('authenticating %o', username);\n      plugin.authenticate(username, password, function (err: VerdaccioError | null, groups): void {\n        if (err) {\n          debug('authenticating for user %o failed. Error: %o', username, err?.message);\n          return cb(err);\n        }\n\n        // Expect: SKIP if groups is falsey and not an array\n        //         with at least one item (truthy length)\n        // Expect: CONTINUE otherwise (will error if groups is not\n        //         an array, but this is current behavior)\n        // Caveat: STRING (if valid) will pass successfully\n        //         bug give unexpected results\n        // Info: Cannot use `== false to check falsey values`\n        if (!!groups && groups.length !== 0) {\n          // TODO: create a better understanding of expectations\n          if (_.isString(groups)) {\n            throw new TypeError('plugin group error: invalid type for function');\n          }\n          const isGroupValid: boolean = _.isArray(groups);\n          if (!isGroupValid) {\n            throw new TypeError(API_ERROR.BAD_FORMAT_USER_GROUP);\n          }\n\n          debug('authentication for user %o was successfully. Groups: %o', username, groups);\n          return cb(err, createRemoteUser(username, groups));\n        }\n        next();\n      });\n    })();\n  }\n\n  public add_user(\n    user: string,\n    password: string,\n    cb: (error: VerdaccioError | null, user?: RemoteUser) => void\n  ): void {\n    const self = this;\n    const plugins = this.plugins.slice(0);\n    debug('add user %o', user);\n\n    (function next(): void {\n      let method = 'adduser';\n      const plugin = plugins.shift();\n      // @ts-expect-error future major (7.x) should remove this section\n      if (typeof plugin.adduser === 'undefined' && typeof plugin.add_user === 'function') {\n        method = 'add_user';\n        warningUtils.emit(warningUtils.Codes.VERWAR006);\n      }\n      // @ts-ignore\n      if (typeof plugin[method] !== 'function') {\n        next();\n      } else {\n        // TODO: replace by adduser whenever add_user deprecation method has been removed\n        // @ts-ignore\n        plugin[method](\n          user,\n          password,\n          function (err: VerdaccioError | null, ok?: boolean | string): void {\n            if (err) {\n              debug('the user %o could not be added. Error: %o', user, err?.message);\n              return cb(err);\n            }\n            if (ok) {\n              debug('the user %o has been added', user);\n              return self.authenticate(user, password, cb);\n            }\n            debug('user could not be added, skip to next auth plugin');\n            next();\n          }\n        );\n      }\n    })();\n  }\n\n  /**\n   * Allow user to access a package.\n   */\n  public allow_access(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: pluginUtils.AccessCallback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      authUtils.getMatchedPackagesSpec(packageName, this.config.packages)\n    ) as AllowAccess & PackageAccess;\n\n    debug('check access permissions for user %o to package %o', user.name, packageName);\n\n    // Use const instead of function declaration so we can use this.logger\n    const next = (): void => {\n      const plugin = plugins.shift();\n\n      if (typeof plugin?.allow_access !== 'function') {\n        debug('plugin does not implement allow_access');\n        return next();\n      }\n\n      plugin.allow_access(user, pkg, (err: VerdaccioError | null, ok?: boolean): void => {\n        if (err) {\n          debug('forbidden access. Error: %o', err);\n          return callback(err);\n        }\n\n        if (ok) {\n          debug('access was granted');\n          this.logger.trace(\n            { user: user.name, name: pkg.name },\n            `access was granted for @{name} by @{user}`\n          );\n          return callback(null, ok);\n        }\n\n        // cb(null, false) causes next plugin to roll\n        debug('access was denied. Rolling to next plugin');\n        this.logger.trace(\n          { user: user.name, name: pkg.name },\n          `intermediate access denial for @{name} by @{user}, rolling to next plugin`\n        );\n        return next();\n      });\n    };\n\n    return next();\n  }\n\n  public allow_unpublish(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: Callback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      authUtils.getMatchedPackagesSpec(packageName, this.config.packages)\n    );\n\n    debug('check unpublish permissions for user %o to package %o', user.name, packageName);\n\n    // Use const instead of function declaration so we can use this.logger\n    const next = (): void => {\n      const plugin = plugins.shift();\n\n      if (typeof plugin?.allow_unpublish !== 'function') {\n        debug('plugin does not implement allow_unpublish');\n        return next();\n      }\n\n      plugin.allow_unpublish(user, pkg, (err: VerdaccioError | null, ok?: boolean): void => {\n        if (err) {\n          debug('forbidden unpublish. Error: %o', err);\n          return callback(err);\n        }\n\n        // The following is different from the allow_access and allow_publish implementations:\n        // If the packages config is missing an entry for \"unpublish\", the built-in default method\n        // (or a plugin) will return undefined, which will trigger the allow_publish fallback.\n        // (see utils.ts, handleSpecialUnpublish, callback(null, undefined))\n        if (_.isNil(ok) === true) {\n          debug('bypass unpublish for %o, publish will handle the access', packageName);\n          this.logger.trace(\n            { user: user.name, name: pkg.name },\n            `bypass unpublish for @{name} by @{user}, publish will handle the access`\n          );\n          return this.allow_publish({ packageName, packageVersion }, user, callback);\n        }\n\n        if (ok) {\n          debug('unpublish was granted');\n          this.logger.trace(\n            { user: user.name, name: pkg.name },\n            `unpublish was granted for @{name} by @{user}`\n          );\n          return callback(null, ok);\n        }\n\n        // cb(null, false) causes next plugin to roll\n        debug('unpublish was denied. Rolling to next plugin');\n        this.logger.trace(\n          { user: user.name, name: pkg.name },\n          `intermediate unpublish denial for @{name} by @{user}, rolling to next plugin`\n        );\n        return next();\n      });\n    };\n\n    return next();\n  }\n\n  /**\n   * Allow user to publish a package.\n   */\n  public allow_publish(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: Callback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      authUtils.getMatchedPackagesSpec(packageName, this.config.packages)\n    );\n\n    debug('check publish permissions for user %o to package %o', user.name, packageName);\n\n    // Use const instead of function declaration so we can use this.logger\n    const next = (): void => {\n      const plugin = plugins.shift();\n\n      if (typeof plugin?.allow_publish !== 'function') {\n        debug('plugin does not implement allow_publish');\n        return next();\n      }\n\n      plugin.allow_publish(user, pkg, (err: VerdaccioError | null, ok?: boolean): void => {\n        if (err) {\n          debug('forbidden publish. Error: %o', err);\n          return callback(err);\n        }\n\n        if (ok) {\n          debug('publish was granted');\n          this.logger.trace(\n            { user: user.name, name: pkg.name },\n            `publish was granted for @{name} by @{user}`\n          );\n          return callback(null, ok);\n        }\n\n        // cb(null, false) causes next plugin to roll\n        debug('publish was denied. Rolling to next plugin');\n        this.logger.trace(\n          { user: user.name, name: pkg.name },\n          `intermediate publish denial for @{name} by @{user}, rolling to next plugin`\n        );\n        return next();\n      });\n    };\n\n    return next();\n  }\n\n  public apiJWTmiddleware(): any {\n    debug('jwt middleware');\n    const plugins = this.plugins.slice(0);\n    const helpers = { createAnonymousRemoteUser, createRemoteUser };\n    for (const plugin of plugins) {\n      if (plugin.apiJWTmiddleware) {\n        return plugin.apiJWTmiddleware(helpers);\n      }\n    }\n\n    return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction) => {\n      req.pause();\n      const next = function (err?: VerdaccioError): NextFunction {\n        req.resume();\n        // uncomment this to reject users with bad auth headers\n        // return _next.apply(null, arguments)\n        // swallow error, user remains unauthorized\n        // set remoteUserError to indicate that user was attempting authentication\n        if (err) {\n          req.remote_user.error = err.message;\n        }\n\n        return _next() as unknown as NextFunction;\n      };\n\n      // FUTURE: disabled, not removed yet but seems unreacable code\n      // if (this._isRemoteUserValid(req.remote_user)) {\n      //   debug('jwt has a valid authentication header');\n      //   return next();\n      // }\n\n      // in case auth header does not exist we return anonymous function\n      const remoteUser = createAnonymousRemoteUser();\n      req.remote_user = remoteUser;\n      res.locals.remote_user = remoteUser;\n\n      const { authorization } = req.headers;\n      if (_.isNil(authorization)) {\n        debug('jwt, authentication header is missing');\n        return next();\n      }\n\n      if (!isAuthHeaderValid(authorization)) {\n        debug('api middleware authentication heather is invalid');\n        return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n      }\n      const { secret, security } = this.config;\n\n      if (isAESLegacy(security)) {\n        debug('api middleware using legacy auth token');\n        this.handleAESMiddleware(req, security, secret, authorization, next);\n      } else {\n        debug('api middleware using JWT auth token');\n        this.handleJWTAPIMiddleware(req, security, secret, authorization, next);\n      }\n    };\n  }\n\n  private handleJWTAPIMiddleware(\n    req: $RequestExtend,\n    security: Security,\n    secret: string,\n    authorization: string,\n    next: any\n  ): void {\n    debug('handle JWT api middleware');\n    const { scheme, token } = parseAuthTokenHeader(authorization);\n    if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {\n      debug('handle basic token');\n      // this should happen when client tries to login with an existing user\n      const credentials = convertPayloadToBase64(token).toString();\n      const parsedCredentials = parseBasicPayload(credentials);\n      if (!parsedCredentials) {\n        debug('invalid basic credentials format (missing colon separator)');\n        next(errorUtils.getBadRequest(API_ERROR.BAD_USERNAME_PASSWORD));\n        return;\n      }\n      const { user, password, tokenKey } = parsedCredentials as AESPayload;\n      debug('authenticating %o', user);\n      this.authenticate(user, password, (err: VerdaccioError | null, user): void => {\n        if (!err) {\n          debug('generating a remote user');\n          req.remote_user = tokenKey ? { ...user, token: { key: tokenKey } } : user;\n          next();\n        } else {\n          debug('generating anonymous user');\n          req.remote_user = createAnonymousRemoteUser();\n          next(err);\n        }\n      });\n    } else {\n      debug('handle jwt token');\n      const credentials: any = getMiddlewareCredentials(security, secret, authorization);\n      if (credentials) {\n        // if the signature is valid we rely on it\n        req.remote_user = credentials;\n        debug('generating a remote user');\n        next();\n      } else {\n        // with JWT throw 401\n        debug('jwt invalid token');\n        next(errorUtils.getForbidden(API_ERROR.BAD_USERNAME_PASSWORD));\n      }\n    }\n  }\n\n  private handleAESMiddleware(\n    req: $RequestExtend,\n    security: Security,\n    secret: string,\n    authorization: string,\n    next: Function\n  ): void {\n    debug('handle legacy api middleware');\n    debug('api middleware has a secret? %o', typeof secret === 'string');\n    debug('api middleware authorization %o', typeof authorization === 'string');\n    const credentials: any = getMiddlewareCredentials(security, secret, authorization);\n    debug('api middleware credentials %o', credentials?.name);\n    if (credentials) {\n      const { user, password, tokenKey } = credentials;\n      debug('authenticating %o', user);\n      this.authenticate(user, password, (err, user): void => {\n        if (!err) {\n          req.remote_user = tokenKey ? { ...user, token: { key: tokenKey } } : user;\n          debug('generating a remote user');\n          next();\n        } else {\n          req.remote_user = createAnonymousRemoteUser();\n          debug('generating anonymous user');\n          next(err);\n        }\n      });\n    } else {\n      // we force npm client to ask again with basic authentication\n      debug('legacy invalid header');\n      return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n    }\n  }\n\n  private _isRemoteUserValid(remote_user?: RemoteUser): boolean {\n    return _.isUndefined(remote_user) === false && _.isUndefined(remote_user?.name) === false;\n  }\n\n  /**\n   * JWT middleware for WebUI\n   */\n  public webUIJWTmiddleware() {\n    return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction): void => {\n      if (this._isRemoteUserValid(req.remote_user)) {\n        return _next();\n      }\n\n      req.pause();\n      const next = (err: VerdaccioError | void): void => {\n        req.resume();\n        if (err) {\n          req.remote_user.error = err.message;\n          res.status(err.statusCode).send(err.message);\n        }\n\n        return _next();\n      };\n\n      const { authorization } = req.headers;\n      if (_.isNil(authorization)) {\n        return next();\n      }\n\n      if (!isAuthHeaderValid(authorization)) {\n        return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n      }\n\n      const token = (authorization || '').replace(`${TOKEN_BEARER} `, '');\n      if (!token) {\n        return next();\n      }\n\n      let credentials: RemoteUser | undefined;\n      try {\n        credentials = verifyJWTPayload(token, this.config.secret, this.config.security);\n      } catch {\n        // FIXME: intended behaviour, do we want it?\n      }\n\n      if (this._isRemoteUserValid(credentials)) {\n        const { name, groups } = credentials as RemoteUser;\n        req.remote_user = createRemoteUser(name as string, groups);\n      } else {\n        req.remote_user = createAnonymousRemoteUser();\n      }\n\n      next();\n    };\n  }\n\n  public async jwtEncrypt(user: RemoteUser, signOptions: JWTSignOptions): Promise<string> {\n    const { real_groups, name, groups, token: tokenMetadata } = user;\n    debug('jwt encrypt %o', name);\n    const realGroupsValidated = _.isNil(real_groups) ? [] : real_groups;\n    const groupedGroups = _.isNil(groups)\n      ? real_groups\n      : Array.from(new Set([...groups.concat(realGroupsValidated)]));\n    const payload: RemoteUser = {\n      real_groups: realGroupsValidated,\n      name,\n      groups: groupedGroups,\n    };\n    if (tokenMetadata?.key) {\n      payload.token = { key: tokenMetadata.key };\n    }\n    const signedToken: string = await signPayload(payload, this.secret, signOptions);\n\n    return signedToken;\n  }\n\n  /**\n   * Encrypt a string.\n   */\n  public aesEncrypt(value: string): string | void {\n    if (this.secret.length === TOKEN_VALID_LENGTH) {\n      debug('signing with enhanced aes legacy');\n      const token = aesEncrypt(value, this.secret);\n      return token;\n    } else {\n      debug('signing with enhanced aes deprecated legacy');\n      // deprecated aes (legacy) signature, only must be used for legacy version\n      const token = aesEncryptDeprecated(Buffer.from(value), this.secret).toString('base64');\n      return token;\n    }\n  }\n}\n\nexport { Auth };\n"],"mappings":";;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,OAAA,GAAAF,sBAAA,CAAAC,OAAA;AACA,IAAAE,kBAAA,GAAAF,OAAA;AAEA,IAAAG,OAAA,GAAAH,OAAA;AAEA,IAAAI,KAAA,GAAAJ,OAAA;AAWA,IAAAK,QAAA,GAAAL,OAAA;AACA,IAAAM,UAAA,GAAAN,OAAA;AAyBA,IAAAO,MAAA,GAAAP,OAAA;AAQiB,SAAAD,uBAAAS,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,gBAAAA,CAAA;AAAA,SAAAE,QAAAC,CAAA,sCAAAD,OAAA,wBAAAE,MAAA,uBAAAA,MAAA,CAAAC,QAAA,aAAAF,CAAA,kBAAAA,CAAA,gBAAAA,CAAA,WAAAA,CAAA,yBAAAC,MAAA,IAAAD,CAAA,CAAAG,WAAA,KAAAF,MAAA,IAAAD,CAAA,KAAAC,MAAA,CAAAG,SAAA,qBAAAJ,CAAA,KAAAD,OAAA,CAAAC,CAAA;AAAA,SAAAK,mBAAAC,CAAA,WAAAC,kBAAA,CAAAD,CAAA,KAAAE,gBAAA,CAAAF,CAAA,KAAAG,2BAAA,CAAAH,CAAA,KAAAI,kBAAA;AAAA,SAAAA,mBAAA,cAAAC,SAAA;AAAA,SAAAH,iBAAAF,CAAA,8BAAAL,MAAA,YAAAK,CAAA,CAAAL,MAAA,CAAAC,QAAA,aAAAI,CAAA,uBAAAM,KAAA,CAAAC,IAAA,CAAAP,CAAA;AAAA,SAAAC,mBAAAD,CAAA,QAAAM,KAAA,CAAAE,OAAA,CAAAR,CAAA,UAAAS,iBAAA,CAAAT,CAAA;AAAA,SAAAU,QAAAnB,CAAA,EAAAS,CAAA,QAAAW,CAAA,GAAAC,MAAA,CAAAC,IAAA,CAAAtB,CAAA,OAAAqB,MAAA,CAAAE,qBAAA,QAAApB,CAAA,GAAAkB,MAAA,CAAAE,qBAAA,CAAAvB,CAAA,GAAAS,CAAA,KAAAN,CAAA,GAAAA,CAAA,CAAAqB,MAAA,WAAAf,CAAA,WAAAY,MAAA,CAAAI,wBAAA,CAAAzB,CAAA,EAAAS,CAAA,EAAAiB,UAAA,OAAAN,CAAA,CAAAO,IAAA,CAAAC,KAAA,CAAAR,CAAA,EAAAjB,CAAA,YAAAiB,CAAA;AAAA,SAAAS,cAAA7B,CAAA,aAAAS,CAAA,MAAAA,CAAA,GAAAqB,SAAA,CAAAC,MAAA,EAAAtB,CAAA,UAAAW,CAAA,WAAAU,SAAA,CAAArB,CAAA,IAAAqB,SAAA,CAAArB,CAAA,QAAAA,CAAA,OAAAU,OAAA,CAAAE,MAAA,CAAAD,CAAA,OAAAY,OAAA,WAAAvB,CAAA,IAAAwB,eAAA,CAAAjC,CAAA,EAAAS,CAAA,EAAAW,CAAA,CAAAX,CAAA,SAAAY,MAAA,CAAAa,yBAAA,GAAAb,MAAA,CAAAc,gBAAA,CAAAnC,CAAA,EAAAqB,MAAA,CAAAa,yBAAA,CAAAd,CAAA,KAAAD,OAAA,CAAAE,MAAA,CAAAD,CAAA,GAAAY,OAAA,WAAAvB,CAAA,IAAAY,MAAA,CAAAe,cAAA,CAAApC,CAAA,EAAAS,CAAA,EAAAY,MAAA,CAAAI,wBAAA,CAAAL,CAAA,EAAAX,CAAA,iBAAAT,CAAA;AAAA,SAAAiC,gBAAAjC,CAAA,EAAAS,CAAA,EAAAW,CAAA,YAAAX,CAAA,GAAA4B,cAAA,CAAA5B,CAAA,MAAAT,CAAA,GAAAqB,MAAA,CAAAe,cAAA,CAAApC,CAAA,EAAAS,CAAA,IAAA6B,KAAA,EAAAlB,CAAA,EAAAM,UAAA,MAAAa,YAAA,MAAAC,QAAA,UAAAxC,CAAA,CAAAS,CAAA,IAAAW,CAAA,EAAApB,CAAA;AAAA,SAAAyC,2BAAAhC,CAAA,EAAAT,CAAA,QAAAoB,CAAA,yBAAAhB,MAAA,IAAAK,CAAA,CAAAL,MAAA,CAAAC,QAAA,KAAAI,CAAA,qBAAAW,CAAA,QAAAL,KAAA,CAAAE,OAAA,CAAAR,CAAA,MAAAW,CAAA,GAAAR,2BAAA,CAAAH,CAAA,MAAAT,CAAA,IAAAS,CAAA,uBAAAA,CAAA,CAAAsB,MAAA,IAAAX,CAAA,KAAAX,CAAA,GAAAW,CAAA,OAAAsB,EAAA,MAAAC,CAAA,YAAAA,EAAA,eAAAC,CAAA,EAAAD,CAAA,EAAAE,CAAA,WAAAA,EAAA,WAAAH,EAAA,IAAAjC,CAAA,CAAAsB,MAAA,KAAAe,IAAA,WAAAA,IAAA,MAAAR,KAAA,EAAA7B,CAAA,CAAAiC,EAAA,UAAA1C,CAAA,WAAAA,EAAAS,CAAA,UAAAA,CAAA,KAAAsC,CAAA,EAAAJ,CAAA,gBAAA7B,SAAA,iJAAAX,CAAA,EAAA6C,CAAA,OAAAC,CAAA,gBAAAL,CAAA,WAAAA,EAAA,IAAAxB,CAAA,GAAAA,CAAA,CAAA8B,IAAA,CAAAzC,CAAA,MAAAoC,CAAA,WAAAA,EAAA,QAAApC,CAAA,GAAAW,CAAA,CAAA+B,IAAA,WAAAH,CAAA,GAAAvC,CAAA,CAAAqC,IAAA,EAAArC,CAAA,KAAAT,CAAA,WAAAA,EAAAS,CAAA,IAAAwC,CAAA,OAAA9C,CAAA,GAAAM,CAAA,KAAAsC,CAAA,WAAAA,EAAA,UAAAC,CAAA,YAAA5B,CAAA,cAAAA,CAAA,8BAAA6B,CAAA,QAAA9C,CAAA;AAAA,SAAAS,4BAAAH,CAAA,EAAAuC,CAAA,QAAAvC,CAAA,2BAAAA,CAAA,SAAAS,iBAAA,CAAAT,CAAA,EAAAuC,CAAA,OAAA5B,CAAA,MAAAgC,QAAA,CAAAF,IAAA,CAAAzC,CAAA,EAAA4C,KAAA,6BAAAjC,CAAA,IAAAX,CAAA,CAAAH,WAAA,KAAAc,CAAA,GAAAX,CAAA,CAAAH,WAAA,CAAAgD,IAAA,aAAAlC,CAAA,cAAAA,CAAA,GAAAL,KAAA,CAAAC,IAAA,CAAAP,CAAA,oBAAAW,CAAA,+CAAAmC,IAAA,CAAAnC,CAAA,IAAAF,iBAAA,CAAAT,CAAA,EAAAuC,CAAA;AAAA,SAAA9B,kBAAAT,CAAA,EAAAuC,CAAA,aAAAA,CAAA,IAAAA,CAAA,GAAAvC,CAAA,CAAAsB,MAAA,MAAAiB,CAAA,GAAAvC,CAAA,CAAAsB,MAAA,YAAA/B,CAAA,MAAA6C,CAAA,GAAA9B,KAAA,CAAAiC,CAAA,GAAAhD,CAAA,GAAAgD,CAAA,EAAAhD,CAAA,IAAA6C,CAAA,CAAA7C,CAAA,IAAAS,CAAA,CAAAT,CAAA,UAAA6C,CAAA;AAAA,SAAAW,aAAA,IAlDjB,uKAAAxD,CAAA,EAAAoB,CAAA,EAAAX,CAAA,wBAAAL,MAAA,GAAAA,MAAA,OAAAyC,CAAA,GAAApC,CAAA,CAAAJ,QAAA,kBAAAF,CAAA,GAAAM,CAAA,CAAAgD,WAAA,8BAAAC,EAAAjD,CAAA,EAAAoC,CAAA,EAAA1C,CAAA,EAAAuD,CAAA,QAAAC,CAAA,GAAAd,CAAA,IAAAA,CAAA,CAAAtC,SAAA,YAAAqD,SAAA,GAAAf,CAAA,GAAAe,SAAA,EAAAX,CAAA,GAAA5B,MAAA,CAAAwC,MAAA,CAAAF,CAAA,CAAApD,SAAA,UAAAuD,mBAAA,CAAAb,CAAA,uBAAAxC,CAAA,EAAAoC,CAAA,EAAA1C,CAAA,QAAAuD,CAAA,EAAAC,CAAA,EAAAV,CAAA,EAAAF,CAAA,MAAAgB,CAAA,GAAA5D,CAAA,QAAA6D,CAAA,OAAAC,CAAA,KAAAF,CAAA,KAAAlB,CAAA,KAAAqB,CAAA,EAAAlE,CAAA,EAAAgD,CAAA,EAAAmB,CAAA,EAAApB,CAAA,EAAAoB,CAAA,CAAAC,IAAA,CAAApE,CAAA,MAAAmE,CAAA,WAAAA,EAAA/C,CAAA,EAAAX,CAAA,WAAAiD,CAAA,GAAAtC,CAAA,EAAAuC,CAAA,MAAAV,CAAA,GAAAjD,CAAA,EAAAiE,CAAA,CAAApB,CAAA,GAAApC,CAAA,EAAAuC,CAAA,gBAAAmB,EAAA1D,CAAA,EAAAoC,CAAA,SAAAc,CAAA,GAAAlD,CAAA,EAAAwC,CAAA,GAAAJ,CAAA,EAAAzB,CAAA,OAAA4C,CAAA,IAAAjB,CAAA,KAAA5C,CAAA,IAAAiB,CAAA,GAAA2C,CAAA,CAAAhC,MAAA,EAAAX,CAAA,UAAAjB,CAAA,EAAAuD,CAAA,GAAAK,CAAA,CAAA3C,CAAA,GAAA+C,CAAA,GAAAF,CAAA,CAAAF,CAAA,EAAAM,CAAA,GAAAX,CAAA,KAAAjD,CAAA,QAAAN,CAAA,GAAAkE,CAAA,KAAAxB,CAAA,MAAAI,CAAA,GAAAS,CAAA,EAAAC,CAAA,GAAAD,CAAA,YAAAC,CAAA,WAAAD,CAAA,MAAAA,CAAA,MAAA1D,CAAA,IAAA0D,CAAA,OAAAS,CAAA,MAAAhE,CAAA,GAAAM,CAAA,QAAA0D,CAAA,GAAAT,CAAA,QAAAC,CAAA,MAAAM,CAAA,CAAAC,CAAA,GAAArB,CAAA,EAAAoB,CAAA,CAAApB,CAAA,GAAAa,CAAA,OAAAS,CAAA,GAAAE,CAAA,KAAAlE,CAAA,GAAAM,CAAA,QAAAiD,CAAA,MAAAb,CAAA,IAAAA,CAAA,GAAAwB,CAAA,MAAAX,CAAA,MAAAjD,CAAA,EAAAiD,CAAA,MAAAb,CAAA,EAAAoB,CAAA,CAAApB,CAAA,GAAAwB,CAAA,EAAAV,CAAA,cAAAxD,CAAA,IAAAM,CAAA,aAAAuC,CAAA,QAAAgB,CAAA,OAAAnB,CAAA,qBAAA1C,CAAA,EAAA4D,CAAA,EAAAM,CAAA,QAAAtB,CAAA,YAAAjC,SAAA,uCAAAkD,CAAA,UAAAD,CAAA,IAAAI,CAAA,CAAAJ,CAAA,EAAAM,CAAA,GAAAV,CAAA,GAAAI,CAAA,EAAAd,CAAA,GAAAoB,CAAA,GAAAjD,CAAA,GAAAuC,CAAA,OAAA3D,CAAA,GAAAiD,CAAA,MAAAe,CAAA,KAAAN,CAAA,KAAAC,CAAA,GAAAA,CAAA,QAAAA,CAAA,SAAAM,CAAA,CAAApB,CAAA,QAAAsB,CAAA,CAAAR,CAAA,EAAAV,CAAA,KAAAgB,CAAA,CAAApB,CAAA,GAAAI,CAAA,GAAAgB,CAAA,CAAAC,CAAA,GAAAjB,CAAA,aAAAF,CAAA,MAAAW,CAAA,QAAAC,CAAA,KAAAxD,CAAA,YAAAiB,CAAA,GAAAsC,CAAA,CAAAvD,CAAA,WAAAiB,CAAA,GAAAA,CAAA,CAAA8B,IAAA,CAAAQ,CAAA,EAAAT,CAAA,UAAAnC,SAAA,2CAAAM,CAAA,CAAA0B,IAAA,SAAA1B,CAAA,EAAA6B,CAAA,GAAA7B,CAAA,CAAAkB,KAAA,EAAAqB,CAAA,SAAAA,CAAA,oBAAAA,CAAA,KAAAvC,CAAA,GAAAsC,CAAA,eAAAtC,CAAA,CAAA8B,IAAA,CAAAQ,CAAA,GAAAC,CAAA,SAAAV,CAAA,GAAAnC,SAAA,uCAAAX,CAAA,gBAAAwD,CAAA,OAAAD,CAAA,GAAA1D,CAAA,cAAAoB,CAAA,IAAA4C,CAAA,GAAAC,CAAA,CAAApB,CAAA,QAAAI,CAAA,GAAAxC,CAAA,CAAAyC,IAAA,CAAAL,CAAA,EAAAoB,CAAA,OAAAjB,CAAA,kBAAA5B,CAAA,IAAAsC,CAAA,GAAA1D,CAAA,EAAA2D,CAAA,MAAAV,CAAA,GAAA7B,CAAA,cAAA2B,CAAA,mBAAAT,KAAA,EAAAlB,CAAA,EAAA0B,IAAA,EAAAkB,CAAA,SAAAvD,CAAA,EAAAN,CAAA,EAAAuD,CAAA,QAAAT,CAAA,QAAAD,CAAA,gBAAAY,UAAA,cAAAU,kBAAA,cAAAC,2BAAA,KAAAnD,CAAA,GAAAC,MAAA,CAAAmD,cAAA,MAAAb,CAAA,MAAAd,CAAA,IAAAzB,CAAA,CAAAA,CAAA,IAAAyB,CAAA,SAAAiB,mBAAA,CAAA1C,CAAA,OAAAyB,CAAA,iCAAAzB,CAAA,GAAA6B,CAAA,GAAAsB,0BAAA,CAAAhE,SAAA,GAAAqD,SAAA,CAAArD,SAAA,GAAAc,MAAA,CAAAwC,MAAA,CAAAF,CAAA,YAAAZ,EAAA/C,CAAA,WAAAqB,MAAA,CAAAoD,cAAA,GAAApD,MAAA,CAAAoD,cAAA,CAAAzE,CAAA,EAAAuE,0BAAA,KAAAvE,CAAA,CAAA0E,SAAA,GAAAH,0BAAA,EAAAT,mBAAA,CAAA9D,CAAA,EAAAG,CAAA,yBAAAH,CAAA,CAAAO,SAAA,GAAAc,MAAA,CAAAwC,MAAA,CAAAZ,CAAA,GAAAjD,CAAA,WAAAsE,iBAAA,CAAA/D,SAAA,GAAAgE,0BAAA,EAAAT,mBAAA,CAAAb,CAAA,iBAAAsB,0BAAA,GAAAT,mBAAA,CAAAS,0BAAA,iBAAAD,iBAAA,GAAAA,iBAAA,CAAAK,WAAA,wBAAAb,mBAAA,CAAAS,0BAAA,EAAApE,CAAA,wBAAA2D,mBAAA,CAAAb,CAAA,GAAAa,mBAAA,CAAAb,CAAA,EAAA9C,CAAA,gBAAA2D,mBAAA,CAAAb,CAAA,EAAAJ,CAAA,iCAAAiB,mBAAA,CAAAb,CAAA,8DAAAO,YAAA,YAAAA,aAAA,aAAAoB,CAAA,EAAAlB,CAAA,EAAAmB,CAAA,EAAA9B,CAAA;AAAA,SAAAe,oBAAA9D,CAAA,EAAAS,CAAA,EAAAoC,CAAA,EAAAzB,CAAA,QAAAsC,CAAA,GAAArC,MAAA,CAAAe,cAAA,QAAAsB,CAAA,uBAAA1D,CAAA,IAAA0D,CAAA,QAAAI,mBAAA,YAAAgB,mBAAA9E,CAAA,EAAAS,CAAA,EAAAoC,CAAA,EAAAzB,CAAA,aAAAjB,EAAAM,CAAA,EAAAoC,CAAA,IAAAiB,mBAAA,CAAA9D,CAAA,EAAAS,CAAA,YAAAT,CAAA,gBAAA+E,OAAA,CAAAtE,CAAA,EAAAoC,CAAA,EAAA7C,CAAA,SAAAS,CAAA,GAAAiD,CAAA,GAAAA,CAAA,CAAA1D,CAAA,EAAAS,CAAA,IAAA6B,KAAA,EAAAO,CAAA,EAAAnB,UAAA,GAAAN,CAAA,EAAAmB,YAAA,GAAAnB,CAAA,EAAAoB,QAAA,GAAApB,CAAA,MAAApB,CAAA,CAAAS,CAAA,IAAAoC,CAAA,IAAA1C,CAAA,aAAAA,CAAA,cAAAA,CAAA,mBAAA2D,mBAAA,CAAA9D,CAAA,EAAAS,CAAA,EAAAoC,CAAA,EAAAzB,CAAA;AAAA,SAAA4D,mBAAAnC,CAAA,EAAAzB,CAAA,EAAApB,CAAA,EAAAS,CAAA,EAAAN,CAAA,EAAA6C,CAAA,EAAAW,CAAA,cAAAD,CAAA,GAAAb,CAAA,CAAAG,CAAA,EAAAW,CAAA,GAAAV,CAAA,GAAAS,CAAA,CAAApB,KAAA,WAAAO,CAAA,gBAAA7C,CAAA,CAAA6C,CAAA,KAAAa,CAAA,CAAAZ,IAAA,GAAA1B,CAAA,CAAA6B,CAAA,IAAAgC,OAAA,CAAAC,OAAA,CAAAjC,CAAA,EAAAkC,IAAA,CAAA1E,CAAA,EAAAN,CAAA;AAAA,SAAAiF,kBAAAvC,CAAA,6BAAAzB,CAAA,SAAApB,CAAA,GAAA8B,SAAA,aAAAmD,OAAA,WAAAxE,CAAA,EAAAN,CAAA,QAAA6C,CAAA,GAAAH,CAAA,CAAAjB,KAAA,CAAAR,CAAA,EAAApB,CAAA,YAAAqF,MAAAxC,CAAA,IAAAmC,kBAAA,CAAAhC,CAAA,EAAAvC,CAAA,EAAAN,CAAA,EAAAkF,KAAA,EAAAC,MAAA,UAAAzC,CAAA,cAAAyC,OAAAzC,CAAA,IAAAmC,kBAAA,CAAAhC,CAAA,EAAAvC,CAAA,EAAAN,CAAA,EAAAkF,KAAA,EAAAC,MAAA,WAAAzC,CAAA,KAAAwC,KAAA;AAAA,SAAAE,gBAAAvC,CAAA,EAAAH,CAAA,UAAAG,CAAA,YAAAH,CAAA,aAAA/B,SAAA;AAAA,SAAA0E,kBAAAxF,CAAA,EAAAS,CAAA,aAAAW,CAAA,MAAAA,CAAA,GAAAX,CAAA,CAAAsB,MAAA,EAAAX,CAAA,UAAAjB,CAAA,GAAAM,CAAA,CAAAW,CAAA,GAAAjB,CAAA,CAAAuB,UAAA,GAAAvB,CAAA,CAAAuB,UAAA,QAAAvB,CAAA,CAAAoC,YAAA,kBAAApC,CAAA,KAAAA,CAAA,CAAAqC,QAAA,QAAAnB,MAAA,CAAAe,cAAA,CAAApC,CAAA,EAAAqC,cAAA,CAAAlC,CAAA,CAAAsF,GAAA,GAAAtF,CAAA;AAAA,SAAAuF,aAAA1F,CAAA,EAAAS,CAAA,EAAAW,CAAA,WAAAX,CAAA,IAAA+E,iBAAA,CAAAxF,CAAA,CAAAO,SAAA,EAAAE,CAAA,GAAAW,CAAA,IAAAoE,iBAAA,CAAAxF,CAAA,EAAAoB,CAAA,GAAAC,MAAA,CAAAe,cAAA,CAAApC,CAAA,iBAAAwC,QAAA,SAAAxC,CAAA;AAAA,SAAAqC,eAAAjB,CAAA,QAAAsC,CAAA,GAAAiC,YAAA,CAAAvE,CAAA,gCAAAlB,OAAA,CAAAwD,CAAA,IAAAA,CAAA,GAAAA,CAAA;AAAA,SAAAiC,aAAAvE,CAAA,EAAAX,CAAA,oBAAAP,OAAA,CAAAkB,CAAA,MAAAA,CAAA,SAAAA,CAAA,MAAApB,CAAA,GAAAoB,CAAA,CAAAhB,MAAA,CAAAwF,WAAA,kBAAA5F,CAAA,QAAA0D,CAAA,GAAA1D,CAAA,CAAAkD,IAAA,CAAA9B,CAAA,EAAAX,CAAA,gCAAAP,OAAA,CAAAwD,CAAA,UAAAA,CAAA,YAAA5C,SAAA,yEAAAL,CAAA,GAAAoF,MAAA,GAAAC,MAAA,EAAA1E,CAAA;AAoDA,IAAM2E,KAAK,GAAG,IAAAC,iBAAU,EAAC,gBAAgB,CAAC;AAAC,IAErCC,IAAI,GAAAC,OAAA,CAAAD,IAAA;EAOR,SAAAA,KAAmBE,MAAc,EAAEC,MAAc,EAA2C;IAAA,IAAzCC,OAAO,GAAAvE,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAwE,SAAA,GAAAxE,SAAA,MAAG;MAAEyE,kBAAkB,EAAE;IAAM,CAAC;IAAAhB,eAAA,OAAAU,IAAA;IACxF,IAAI,CAACE,MAAM,GAAGA,MAAM;IACpB,IAAI,CAACK,MAAM,GAAGL,MAAM,CAACK,MAAM;IAC3B,IAAI,CAACJ,MAAM,GAAGA,MAAM;IACpB,IAAI,CAACK,OAAO,GAAG,EAAE;IACjB,IAAI,CAACJ,OAAO,GAAGA,OAAO;IACtB,IAAI,CAAC,IAAI,CAACG,MAAM,EAAE;MAChB,MAAM,IAAI1F,SAAS,CAAC,0DAA0D,CAAC;IACjF;EACF;EAAC,OAAA4E,YAAA,CAAAO,IAAA;IAAAR,GAAA;IAAAnD,KAAA;MAAA,IAAAoE,KAAA,GAAAtB,iBAAA,cAAA5B,YAAA,GAAAqB,CAAA,CAED,SAAA8B,QAAA;QAAA,IAAAF,OAAA;QAAA,OAAAjD,YAAA,GAAAoB,CAAA,WAAAgC,QAAA;UAAA,kBAAAA,QAAA,CAAA/D,CAAA;YAAA;cAAA+D,QAAA,CAAA/D,CAAA;cAAA,OACsB,IAAI,CAACgE,UAAU,CAAC,CAAC;YAAA;cAAjCJ,OAAO,GAAAG,QAAA,CAAA1C,CAAA;cAEX6B,KAAK,CAAC,uBAAuB,EAAEU,OAAO,CAAC1E,MAAM,CAAC;cAC9C;cACA;cACA,IAAI,IAAI,CAACoE,MAAM,CAACW,IAAI,KAAK,IAAI,KAAK,CAACL,OAAO,IAAIA,OAAO,CAAC1E,MAAM,KAAK,CAAC,CAAC,EAAE;gBACnE0E,OAAO,GAAG,IAAI,CAACM,iBAAiB,CAAC,CAAC;cACpC;cACA,IAAI,CAACN,OAAO,GAAGA,OAAO;cAEtB,IAAI,CAACO,0BAA0B,CAAC,CAAC;YAAC;cAAA,OAAAJ,QAAA,CAAA5D,CAAA;UAAA;QAAA,GAAA2D,OAAA;MAAA,CACnC;MAAA,SAZYM,IAAIA,CAAA;QAAA,OAAAP,KAAA,CAAA9E,KAAA,OAAAE,SAAA;MAAA;MAAA,OAAJmF,IAAI;IAAA;EAAA;IAAAxB,GAAA;IAAAnD,KAAA,EAcjB,SAAQyE,iBAAiBA,CAAA,EAAG;MAC1BhB,KAAK,CAAC,0BAA0B,CAAC;MACjC,IAAImB,UAAU;MACd,IAAI;QACFA,UAAU,GAAG,IAAIC,2BAAQ,CACvB;UAAEC,IAAI,EAAE;QAAa,CAAC,EACtB;UACEjB,MAAM,EAAE,IAAI,CAACA,MAAM;UACnBC,MAAM,EAAE,IAAI,CAACA;QACf,CACF,CAAC;QACD,IAAI,CAACA,MAAM,CAACiB,IAAI,CACd;UAAE/D,IAAI,EAAE,oBAAoB;UAAEgE,cAAc,EAAEC,qBAAe,CAACC;QAAe,CAAC,EAC9E,wDACF,CAAC;MACH,CAAC,CAAC,OAAOC,KAAU,EAAE;QACnB1B,KAAK,CAAC,iDAAiD,EAAE0B,KAAK,CAAC;QAC/D,IAAI,CAACrB,MAAM,CAACiB,IAAI,CAAC,CAAC,CAAC,EAAE,+BAA+B,CAAC;QACrD,OAAO,EAAE;MACX;MAEA,OAAO,CAACH,UAAU,CAAC;IACrB;EAAC;IAAAzB,GAAA;IAAAnD,KAAA;MAAA,IAAAoF,WAAA,GAAAtC,iBAAA,cAAA5B,YAAA,GAAAqB,CAAA,CAED,SAAA8C,SAAA;QAAA,IAAAC,qBAAA,EAAAC,YAAA;QAAA,OAAArE,YAAA,GAAAoB,CAAA,WAAAkD,SAAA;UAAA,kBAAAA,SAAA,CAAAjF,CAAA;YAAA;cAAA,OAAAiF,SAAA,CAAA9E,CAAA,IACS,IAAA+E,wBAAe,EACpB,IAAI,CAAC5B,MAAM,CAACW,IAAI,EAChB;gBACEX,MAAM,EAAE,IAAI,CAACA,MAAM;gBACnBC,MAAM,EAAE,IAAI,CAACA;cACf,CAAC,EACD,UAAC4B,MAAM,EAAc;gBACnB,IAAQC,YAAY,GAAkCD,MAAM,CAApDC,YAAY;kBAAEC,YAAY,GAAoBF,MAAM,CAAtCE,YAAY;kBAAEC,aAAa,GAAKH,MAAM,CAAxBG,aAAa;gBAEjD,OACE,OAAOF,YAAY,KAAK,WAAW,IACnC,OAAOC,YAAY,KAAK,WAAW,IACnC,OAAOC,aAAa,KAAK,WAAW;cAExC,CAAC,EACD,IAAI,CAAC9B,OAAO,CAACE,kBAAkB,GAAAqB,qBAAA,IAAAC,YAAA,GAC/B,IAAI,CAAC1B,MAAM,cAAA0B,YAAA,gBAAAA,YAAA,GAAXA,YAAA,CAAaO,MAAM,cAAAP,YAAA,uBAAnBA,YAAA,CAAqBQ,YAAY,cAAAT,qBAAA,cAAAA,qBAAA,GAAIU,mBAAa,EAClDf,qBAAe,CAACC,cAClB,CAAC;UAAA;QAAA,GAAAG,QAAA;MAAA,CACF;MAAA,SApBad,UAAUA,CAAA;QAAA,OAAAa,WAAA,CAAA9F,KAAA,OAAAE,SAAA;MAAA;MAAA,OAAV+E,UAAU;IAAA;EAAA;IAAApB,GAAA;IAAAnD,KAAA,EAsBxB,SAAQ0E,0BAA0BA,CAAA,EAAS;MACzC,IAAI,CAACP,OAAO,CAAC9E,IAAI,CAAC,IAAA4G,8BAAuB,EAAC,IAAI,CAACnC,MAAM,CAAC,CAAC;IACzD;EAAC;IAAAX,GAAA;IAAAnD,KAAA,EAED,SAAOkG,cAAcA,CACnBC,QAAgB,EAChBC,QAAgB,EAChBC,WAAmB,EACnBC,EAAY,EACN;MAAA,IAAAC,KAAA;MACN,IAAMC,YAAY,GAAGC,kBAAC,CAACvH,MAAM,CAAC,IAAI,CAACiF,OAAO,EAAE,UAACuB,MAAM;QAAA,OAAKe,kBAAC,CAACC,UAAU,CAAChB,MAAM,CAACQ,cAAc,CAAC;MAAA,EAAC;MAE5F,IAAIO,kBAAC,CAACE,OAAO,CAACH,YAAY,CAAC,EAAE;QAC3B,OAAOF,EAAE,CAACM,gBAAU,CAACC,gBAAgB,CAACC,oBAAc,CAACC,wBAAwB,CAAC,CAAC;MACjF;MAAC,IAAAC,SAAA,GAAA7G,0BAAA,CAEoBqG,YAAY;QAAAS,KAAA;MAAA;QAAjC,KAAAD,SAAA,CAAA1G,CAAA,MAAA2G,KAAA,GAAAD,SAAA,CAAAzG,CAAA,IAAAC,IAAA,GAAmC;UAAA,IAAxBkF,MAAM,GAAAuB,KAAA,CAAAjH,KAAA;UACf,IAAIyG,kBAAC,CAACS,KAAK,CAACxB,MAAM,CAAC,IAAIe,kBAAC,CAACC,UAAU,CAAChB,MAAM,CAACQ,cAAc,CAAC,KAAK,KAAK,EAAE;YACpEzC,KAAK,CAAC,gEAAgE,CAAC;YACvE;UACF,CAAC,MAAM;YACLA,KAAK,CAAC,0BAA0B,EAAE0C,QAAQ,CAAC;YAC3CT,MAAM,CAACQ,cAAc,CAAEC,QAAQ,EAAEC,QAAQ,EAAEC,WAAW,EAAE,UAACc,GAAG,EAAEC,OAAO,EAAW;cAC9E,IAAID,GAAG,EAAE;gBACPZ,KAAI,CAACzC,MAAM,CAACqB,KAAK,CACf;kBAAEgB,QAAQ,EAARA,QAAQ;kBAAEgB,GAAG,EAAHA;gBAAI,CAAC,wGAGnB,CAAC;gBACD,OAAOb,EAAE,CAACa,GAAG,CAAC;cAChB;cAEA1D,KAAK,CAAC,wCAAwC,EAAE0C,QAAQ,CAAC;cACzD,OAAOG,EAAE,CAAC,IAAI,EAAEc,OAAO,CAAC;YAC1B,CAAC,CAAC;UACJ;QACF;MAAC,SAAAD,GAAA;QAAAH,SAAA,CAAAtJ,CAAA,CAAAyJ,GAAA;MAAA;QAAAH,SAAA,CAAAvG,CAAA;MAAA;IACH;EAAC;IAAA0C,GAAA;IAAAnD,KAAA;MAAA,IAAAqH,gBAAA,GAAAvE,iBAAA,cAAA5B,YAAA,GAAAqB,CAAA,CAED,SAAA+E,SAA6BC,KAAa;QAAA,OAAArG,YAAA,GAAAoB,CAAA,WAAAkF,SAAA;UAAA,kBAAAA,SAAA,CAAAjH,CAAA;YAAA;cACxC;cACAkH,OAAO,CAACC,GAAG,CAAC,uCAAuC,EAAEH,KAAK,CAAC;cAAC,OAAAC,SAAA,CAAA9G,CAAA,IACrDiC,OAAO,CAACC,OAAO,CAAC,CAAC;UAAA;QAAA,GAAA0E,QAAA;MAAA,CACzB;MAAA,SAJYK,eAAeA,CAAAC,EAAA;QAAA,OAAAP,gBAAA,CAAA/H,KAAA,OAAAE,SAAA;MAAA;MAAA,OAAfmI,eAAe;IAAA;EAAA;IAAAxE,GAAA;IAAAnD,KAAA,EAM5B,SAAO2F,YAAYA,CACjBQ,QAAgB,EAChBC,QAAgB,EAChBE,EAA6D,EACvD;MACN,IAAMnC,OAAO,GAAG,IAAI,CAACA,OAAO,CAACpD,KAAK,CAAC,CAAC,CAAC;MACrC,CAAC,SAASF,IAAIA,CAAA,EAAS;QACrB,IAAM6E,MAAM,GAAGvB,OAAO,CAAC0D,KAAK,CAAC,CAAC;QAE9B,IAAI,QAAOnC,MAAM,aAANA,MAAM,uBAANA,MAAM,CAAEC,YAAY,MAAK,UAAU,EAAE;UAC9C,OAAO9E,IAAI,CAAC,CAAC;QACf;QAEA4C,KAAK,CAAC,mBAAmB,EAAE0C,QAAQ,CAAC;QACpCT,MAAM,CAACC,YAAY,CAACQ,QAAQ,EAAEC,QAAQ,EAAE,UAAUe,GAA0B,EAAEW,MAAM,EAAQ;UAC1F,IAAIX,GAAG,EAAE;YACP1D,KAAK,CAAC,8CAA8C,EAAE0C,QAAQ,EAAEgB,GAAG,aAAHA,GAAG,uBAAHA,GAAG,CAAEY,OAAO,CAAC;YAC7E,OAAOzB,EAAE,CAACa,GAAG,CAAC;UAChB;;UAEA;UACA;UACA;UACA;UACA;UACA;UACA;UACA,IAAI,CAAC,CAACW,MAAM,IAAIA,MAAM,CAACrI,MAAM,KAAK,CAAC,EAAE;YACnC;YACA,IAAIgH,kBAAC,CAACuB,QAAQ,CAACF,MAAM,CAAC,EAAE;cACtB,MAAM,IAAItJ,SAAS,CAAC,+CAA+C,CAAC;YACtE;YACA,IAAMyJ,YAAqB,GAAGxB,kBAAC,CAAC9H,OAAO,CAACmJ,MAAM,CAAC;YAC/C,IAAI,CAACG,YAAY,EAAE;cACjB,MAAM,IAAIzJ,SAAS,CAAC0J,eAAS,CAACC,qBAAqB,CAAC;YACtD;YAEA1E,KAAK,CAAC,yDAAyD,EAAE0C,QAAQ,EAAE2B,MAAM,CAAC;YAClF,OAAOxB,EAAE,CAACa,GAAG,EAAE,IAAAiB,wBAAgB,EAACjC,QAAQ,EAAE2B,MAAM,CAAC,CAAC;UACpD;UACAjH,IAAI,CAAC,CAAC;QACR,CAAC,CAAC;MACJ,CAAC,EAAE,CAAC;IACN;EAAC;IAAAsC,GAAA;IAAAnD,KAAA,EAED,SAAOqI,QAAQA,CACbC,IAAY,EACZlC,QAAgB,EAChBE,EAA6D,EACvD;MACN,IAAMiC,IAAI,GAAG,IAAI;MACjB,IAAMpE,OAAO,GAAG,IAAI,CAACA,OAAO,CAACpD,KAAK,CAAC,CAAC,CAAC;MACrC0C,KAAK,CAAC,aAAa,EAAE6E,IAAI,CAAC;MAE1B,CAAC,SAASzH,IAAIA,CAAA,EAAS;QACrB,IAAI2H,MAAM,GAAG,SAAS;QACtB,IAAM9C,MAAM,GAAGvB,OAAO,CAAC0D,KAAK,CAAC,CAAC;QAC9B;QACA,IAAI,OAAOnC,MAAM,CAAC+C,OAAO,KAAK,WAAW,IAAI,OAAO/C,MAAM,CAAC2C,QAAQ,KAAK,UAAU,EAAE;UAClFG,MAAM,GAAG,UAAU;UACnBE,kBAAY,CAACC,IAAI,CAACD,kBAAY,CAACE,KAAK,CAACC,SAAS,CAAC;QACjD;QACA;QACA,IAAI,OAAOnD,MAAM,CAAC8C,MAAM,CAAC,KAAK,UAAU,EAAE;UACxC3H,IAAI,CAAC,CAAC;QACR,CAAC,MAAM;UACL;UACA;UACA6E,MAAM,CAAC8C,MAAM,CAAC,CACZF,IAAI,EACJlC,QAAQ,EACR,UAAUe,GAA0B,EAAE2B,EAAqB,EAAQ;YACjE,IAAI3B,GAAG,EAAE;cACP1D,KAAK,CAAC,2CAA2C,EAAE6E,IAAI,EAAEnB,GAAG,aAAHA,GAAG,uBAAHA,GAAG,CAAEY,OAAO,CAAC;cACtE,OAAOzB,EAAE,CAACa,GAAG,CAAC;YAChB;YACA,IAAI2B,EAAE,EAAE;cACNrF,KAAK,CAAC,4BAA4B,EAAE6E,IAAI,CAAC;cACzC,OAAOC,IAAI,CAAC5C,YAAY,CAAC2C,IAAI,EAAElC,QAAQ,EAAEE,EAAE,CAAC;YAC9C;YACA7C,KAAK,CAAC,mDAAmD,CAAC;YAC1D5C,IAAI,CAAC,CAAC;UACR,CACF,CAAC;QACH;MACF,CAAC,EAAE,CAAC;IACN;;IAEA;AACF;AACA;EAFE;IAAAsC,GAAA;IAAAnD,KAAA,EAGA,SAAO4F,YAAYA,CAAAmD,IAAA,EAEjBT,IAAgB,EAChBU,QAAoC,EAC9B;MAAA,IAAAC,MAAA;MAAA,IAHJC,WAAW,GAAAH,IAAA,CAAXG,WAAW;QAAEC,cAAc,GAAAJ,IAAA,CAAdI,cAAc;MAI7B,IAAMhF,OAAO,GAAG,IAAI,CAACA,OAAO,CAACpD,KAAK,CAAC,CAAC,CAAC;MACrC,IAAMqI,GAAG,GAAGrK,MAAM,CAACsK,MAAM,CACvB;QAAErI,IAAI,EAAEkI,WAAW;QAAEI,OAAO,EAAEH;MAAe,CAAC,EAC9CI,eAAS,CAACC,sBAAsB,CAACN,WAAW,EAAE,IAAI,CAACrF,MAAM,CAAC4F,QAAQ,CACpE,CAAgC;MAEhChG,KAAK,CAAC,oDAAoD,EAAE6E,IAAI,CAACtH,IAAI,EAAEkI,WAAW,CAAC;;MAEnF;MACA,IAAMrI,MAAI,GAAG,SAAPA,IAAIA,CAAA,EAAe;QACvB,IAAM6E,MAAM,GAAGvB,OAAO,CAAC0D,KAAK,CAAC,CAAC;QAE9B,IAAI,QAAOnC,MAAM,aAANA,MAAM,uBAANA,MAAM,CAAEE,YAAY,MAAK,UAAU,EAAE;UAC9CnC,KAAK,CAAC,wCAAwC,CAAC;UAC/C,OAAO5C,MAAI,CAAC,CAAC;QACf;QAEA6E,MAAM,CAACE,YAAY,CAAC0C,IAAI,EAAEc,GAAG,EAAE,UAACjC,GAA0B,EAAE2B,EAAY,EAAW;UACjF,IAAI3B,GAAG,EAAE;YACP1D,KAAK,CAAC,6BAA6B,EAAE0D,GAAG,CAAC;YACzC,OAAO6B,QAAQ,CAAC7B,GAAG,CAAC;UACtB;UAEA,IAAI2B,EAAE,EAAE;YACNrF,KAAK,CAAC,oBAAoB,CAAC;YAC3BwF,MAAI,CAACnF,MAAM,CAAC4F,KAAK,CACf;cAAEpB,IAAI,EAAEA,IAAI,CAACtH,IAAI;cAAEA,IAAI,EAAEoI,GAAG,CAACpI;YAAK,CAAC,6CAErC,CAAC;YACD,OAAOgI,QAAQ,CAAC,IAAI,EAAEF,EAAE,CAAC;UAC3B;;UAEA;UACArF,KAAK,CAAC,2CAA2C,CAAC;UAClDwF,MAAI,CAACnF,MAAM,CAAC4F,KAAK,CACf;YAAEpB,IAAI,EAAEA,IAAI,CAACtH,IAAI;YAAEA,IAAI,EAAEoI,GAAG,CAACpI;UAAK,CAAC,6EAErC,CAAC;UACD,OAAOH,MAAI,CAAC,CAAC;QACf,CAAC,CAAC;MACJ,CAAC;MAED,OAAOA,MAAI,CAAC,CAAC;IACf;EAAC;IAAAsC,GAAA;IAAAnD,KAAA,EAED,SAAO2J,eAAeA,CAAAC,KAAA,EAEpBtB,IAAgB,EAChBU,QAAkB,EACZ;MAAA,IAAAa,MAAA;MAAA,IAHJX,WAAW,GAAAU,KAAA,CAAXV,WAAW;QAAEC,cAAc,GAAAS,KAAA,CAAdT,cAAc;MAI7B,IAAMhF,OAAO,GAAG,IAAI,CAACA,OAAO,CAACpD,KAAK,CAAC,CAAC,CAAC;MACrC,IAAMqI,GAAG,GAAGrK,MAAM,CAACsK,MAAM,CACvB;QAAErI,IAAI,EAAEkI,WAAW;QAAEI,OAAO,EAAEH;MAAe,CAAC,EAC9CI,eAAS,CAACC,sBAAsB,CAACN,WAAW,EAAE,IAAI,CAACrF,MAAM,CAAC4F,QAAQ,CACpE,CAAC;MAEDhG,KAAK,CAAC,uDAAuD,EAAE6E,IAAI,CAACtH,IAAI,EAAEkI,WAAW,CAAC;;MAEtF;MACA,IAAMrI,MAAI,GAAG,SAAPA,IAAIA,CAAA,EAAe;QACvB,IAAM6E,MAAM,GAAGvB,OAAO,CAAC0D,KAAK,CAAC,CAAC;QAE9B,IAAI,QAAOnC,MAAM,aAANA,MAAM,uBAANA,MAAM,CAAEiE,eAAe,MAAK,UAAU,EAAE;UACjDlG,KAAK,CAAC,2CAA2C,CAAC;UAClD,OAAO5C,MAAI,CAAC,CAAC;QACf;QAEA6E,MAAM,CAACiE,eAAe,CAACrB,IAAI,EAAEc,GAAG,EAAE,UAACjC,GAA0B,EAAE2B,EAAY,EAAW;UACpF,IAAI3B,GAAG,EAAE;YACP1D,KAAK,CAAC,gCAAgC,EAAE0D,GAAG,CAAC;YAC5C,OAAO6B,QAAQ,CAAC7B,GAAG,CAAC;UACtB;;UAEA;UACA;UACA;UACA;UACA,IAAIV,kBAAC,CAACS,KAAK,CAAC4B,EAAE,CAAC,KAAK,IAAI,EAAE;YACxBrF,KAAK,CAAC,yDAAyD,EAAEyF,WAAW,CAAC;YAC7EW,MAAI,CAAC/F,MAAM,CAAC4F,KAAK,CACf;cAAEpB,IAAI,EAAEA,IAAI,CAACtH,IAAI;cAAEA,IAAI,EAAEoI,GAAG,CAACpI;YAAK,CAAC,2EAErC,CAAC;YACD,OAAO6I,MAAI,CAAChE,aAAa,CAAC;cAAEqD,WAAW,EAAXA,WAAW;cAAEC,cAAc,EAAdA;YAAe,CAAC,EAAEb,IAAI,EAAEU,QAAQ,CAAC;UAC5E;UAEA,IAAIF,EAAE,EAAE;YACNrF,KAAK,CAAC,uBAAuB,CAAC;YAC9BoG,MAAI,CAAC/F,MAAM,CAAC4F,KAAK,CACf;cAAEpB,IAAI,EAAEA,IAAI,CAACtH,IAAI;cAAEA,IAAI,EAAEoI,GAAG,CAACpI;YAAK,CAAC,gDAErC,CAAC;YACD,OAAOgI,QAAQ,CAAC,IAAI,EAAEF,EAAE,CAAC;UAC3B;;UAEA;UACArF,KAAK,CAAC,8CAA8C,CAAC;UACrDoG,MAAI,CAAC/F,MAAM,CAAC4F,KAAK,CACf;YAAEpB,IAAI,EAAEA,IAAI,CAACtH,IAAI;YAAEA,IAAI,EAAEoI,GAAG,CAACpI;UAAK,CAAC,gFAErC,CAAC;UACD,OAAOH,MAAI,CAAC,CAAC;QACf,CAAC,CAAC;MACJ,CAAC;MAED,OAAOA,MAAI,CAAC,CAAC;IACf;;IAEA;AACF;AACA;EAFE;IAAAsC,GAAA;IAAAnD,KAAA,EAGA,SAAO6F,aAAaA,CAAAiE,KAAA,EAElBxB,IAAgB,EAChBU,QAAkB,EACZ;MAAA,IAAAe,MAAA;MAAA,IAHJb,WAAW,GAAAY,KAAA,CAAXZ,WAAW;QAAEC,cAAc,GAAAW,KAAA,CAAdX,cAAc;MAI7B,IAAMhF,OAAO,GAAG,IAAI,CAACA,OAAO,CAACpD,KAAK,CAAC,CAAC,CAAC;MACrC,IAAMqI,GAAG,GAAGrK,MAAM,CAACsK,MAAM,CACvB;QAAErI,IAAI,EAAEkI,WAAW;QAAEI,OAAO,EAAEH;MAAe,CAAC,EAC9CI,eAAS,CAACC,sBAAsB,CAACN,WAAW,EAAE,IAAI,CAACrF,MAAM,CAAC4F,QAAQ,CACpE,CAAC;MAEDhG,KAAK,CAAC,qDAAqD,EAAE6E,IAAI,CAACtH,IAAI,EAAEkI,WAAW,CAAC;;MAEpF;MACA,IAAMrI,MAAI,GAAG,SAAPA,IAAIA,CAAA,EAAe;QACvB,IAAM6E,MAAM,GAAGvB,OAAO,CAAC0D,KAAK,CAAC,CAAC;QAE9B,IAAI,QAAOnC,MAAM,aAANA,MAAM,uBAANA,MAAM,CAAEG,aAAa,MAAK,UAAU,EAAE;UAC/CpC,KAAK,CAAC,yCAAyC,CAAC;UAChD,OAAO5C,MAAI,CAAC,CAAC;QACf;QAEA6E,MAAM,CAACG,aAAa,CAACyC,IAAI,EAAEc,GAAG,EAAE,UAACjC,GAA0B,EAAE2B,EAAY,EAAW;UAClF,IAAI3B,GAAG,EAAE;YACP1D,KAAK,CAAC,8BAA8B,EAAE0D,GAAG,CAAC;YAC1C,OAAO6B,QAAQ,CAAC7B,GAAG,CAAC;UACtB;UAEA,IAAI2B,EAAE,EAAE;YACNrF,KAAK,CAAC,qBAAqB,CAAC;YAC5BsG,MAAI,CAACjG,MAAM,CAAC4F,KAAK,CACf;cAAEpB,IAAI,EAAEA,IAAI,CAACtH,IAAI;cAAEA,IAAI,EAAEoI,GAAG,CAACpI;YAAK,CAAC,8CAErC,CAAC;YACD,OAAOgI,QAAQ,CAAC,IAAI,EAAEF,EAAE,CAAC;UAC3B;;UAEA;UACArF,KAAK,CAAC,4CAA4C,CAAC;UACnDsG,MAAI,CAACjG,MAAM,CAAC4F,KAAK,CACf;YAAEpB,IAAI,EAAEA,IAAI,CAACtH,IAAI;YAAEA,IAAI,EAAEoI,GAAG,CAACpI;UAAK,CAAC,8EAErC,CAAC;UACD,OAAOH,MAAI,CAAC,CAAC;QACf,CAAC,CAAC;MACJ,CAAC;MAED,OAAOA,MAAI,CAAC,CAAC;IACf;EAAC;IAAAsC,GAAA;IAAAnD,KAAA,EAED,SAAOgK,gBAAgBA,CAAA,EAAQ;MAAA,IAAAC,MAAA;MAC7BxG,KAAK,CAAC,gBAAgB,CAAC;MACvB,IAAMU,OAAO,GAAG,IAAI,CAACA,OAAO,CAACpD,KAAK,CAAC,CAAC,CAAC;MACrC,IAAMmJ,OAAO,GAAG;QAAEC,yBAAyB,EAAzBA,iCAAyB;QAAE/B,gBAAgB,EAAhBA;MAAiB,CAAC;MAAC,IAAAgC,UAAA,GAAAjK,0BAAA,CAC3CgE,OAAO;QAAAkG,MAAA;MAAA;QAA5B,KAAAD,UAAA,CAAA9J,CAAA,MAAA+J,MAAA,GAAAD,UAAA,CAAA7J,CAAA,IAAAC,IAAA,GAA8B;UAAA,IAAnBkF,MAAM,GAAA2E,MAAA,CAAArK,KAAA;UACf,IAAI0F,MAAM,CAACsE,gBAAgB,EAAE;YAC3B,OAAOtE,MAAM,CAACsE,gBAAgB,CAACE,OAAO,CAAC;UACzC;QACF;MAAC,SAAA/C,GAAA;QAAAiD,UAAA,CAAA1M,CAAA,CAAAyJ,GAAA;MAAA;QAAAiD,UAAA,CAAA3J,CAAA;MAAA;MAED,OAAO,UAAC6J,GAAmB,EAAEC,GAAoB,EAAExH,KAAmB,EAAK;QACzEuH,GAAG,CAACE,KAAK,CAAC,CAAC;QACX,IAAM3J,IAAI,GAAG,SAAPA,IAAIA,CAAasG,GAAoB,EAAgB;UACzDmD,GAAG,CAACG,MAAM,CAAC,CAAC;UACZ;UACA;UACA;UACA;UACA,IAAItD,GAAG,EAAE;YACPmD,GAAG,CAACI,WAAW,CAACvF,KAAK,GAAGgC,GAAG,CAACY,OAAO;UACrC;UAEA,OAAOhF,KAAK,CAAC,CAAC;QAChB,CAAC;;QAED;QACA;QACA;QACA;QACA;;QAEA;QACA,IAAM4H,UAAU,GAAG,IAAAR,iCAAyB,EAAC,CAAC;QAC9CG,GAAG,CAACI,WAAW,GAAGC,UAAU;QAC5BJ,GAAG,CAACK,MAAM,CAACF,WAAW,GAAGC,UAAU;QAEnC,IAAQE,aAAa,GAAKP,GAAG,CAACQ,OAAO,CAA7BD,aAAa;QACrB,IAAIpE,kBAAC,CAACS,KAAK,CAAC2D,aAAa,CAAC,EAAE;UAC1BpH,KAAK,CAAC,uCAAuC,CAAC;UAC9C,OAAO5C,IAAI,CAAC,CAAC;QACf;QAEA,IAAI,CAAC,IAAAkK,wBAAiB,EAACF,aAAa,CAAC,EAAE;UACrCpH,KAAK,CAAC,kDAAkD,CAAC;UACzD,OAAO5C,IAAI,CAAC+F,gBAAU,CAACoE,aAAa,CAAC9C,eAAS,CAAC+C,eAAe,CAAC,CAAC;QAClE;QACA,IAAAC,aAAA,GAA6BjB,MAAI,CAACpG,MAAM;UAAhCK,MAAM,GAAAgH,aAAA,CAANhH,MAAM;UAAEiH,QAAQ,GAAAD,aAAA,CAARC,QAAQ;QAExB,IAAI,IAAAC,kBAAW,EAACD,QAAQ,CAAC,EAAE;UACzB1H,KAAK,CAAC,wCAAwC,CAAC;UAC/CwG,MAAI,CAACoB,mBAAmB,CAACf,GAAG,EAAEa,QAAQ,EAAEjH,MAAM,EAAE2G,aAAa,EAAEhK,IAAI,CAAC;QACtE,CAAC,MAAM;UACL4C,KAAK,CAAC,qCAAqC,CAAC;UAC5CwG,MAAI,CAACqB,sBAAsB,CAAChB,GAAG,EAAEa,QAAQ,EAAEjH,MAAM,EAAE2G,aAAa,EAAEhK,IAAI,CAAC;QACzE;MACF,CAAC;IACH;EAAC;IAAAsC,GAAA;IAAAnD,KAAA,EAED,SAAQsL,sBAAsBA,CAC5BhB,GAAmB,EACnBa,QAAkB,EAClBjH,MAAc,EACd2G,aAAqB,EACrBhK,IAAS,EACH;MACN4C,KAAK,CAAC,2BAA2B,CAAC;MAClC,IAAA8H,qBAAA,GAA0B,IAAAC,2BAAoB,EAACX,aAAa,CAAC;QAArDY,MAAM,GAAAF,qBAAA,CAANE,MAAM;QAAElE,KAAK,GAAAgE,qBAAA,CAALhE,KAAK;MACrB,IAAIkE,MAAM,CAACC,WAAW,CAAC,CAAC,KAAKC,iBAAW,CAACD,WAAW,CAAC,CAAC,EAAE;QACtDjI,KAAK,CAAC,oBAAoB,CAAC;QAC3B;QACA,IAAMmI,WAAW,GAAG,IAAAC,6BAAsB,EAACtE,KAAK,CAAC,CAACzG,QAAQ,CAAC,CAAC;QAC5D,IAAMgL,iBAAiB,GAAG,IAAAC,4BAAiB,EAACH,WAAW,CAAC;QACxD,IAAI,CAACE,iBAAiB,EAAE;UACtBrI,KAAK,CAAC,4DAA4D,CAAC;UACnE5C,IAAI,CAAC+F,gBAAU,CAACoE,aAAa,CAAC9C,eAAS,CAAC8D,qBAAqB,CAAC,CAAC;UAC/D;QACF;QACA,IAAAC,KAAA,GAAqCH,iBAAiB;UAA9CxD,IAAI,GAAA2D,KAAA,CAAJ3D,IAAI;UAAElC,QAAQ,GAAA6F,KAAA,CAAR7F,QAAQ;UAAE8F,QAAQ,GAAAD,KAAA,CAARC,QAAQ;QAChCzI,KAAK,CAAC,mBAAmB,EAAE6E,IAAI,CAAC;QAChC,IAAI,CAAC3C,YAAY,CAAC2C,IAAI,EAAElC,QAAQ,EAAE,UAACe,GAA0B,EAAEmB,IAAI,EAAW;UAC5E,IAAI,CAACnB,GAAG,EAAE;YACR1D,KAAK,CAAC,0BAA0B,CAAC;YACjC6G,GAAG,CAACI,WAAW,GAAGwB,QAAQ,GAAA3M,aAAA,CAAAA,aAAA,KAAQ+I,IAAI;cAAEf,KAAK,EAAE;gBAAEpE,GAAG,EAAE+I;cAAS;YAAC,KAAK5D,IAAI;YACzEzH,IAAI,CAAC,CAAC;UACR,CAAC,MAAM;YACL4C,KAAK,CAAC,2BAA2B,CAAC;YAClC6G,GAAG,CAACI,WAAW,GAAG,IAAAP,iCAAyB,EAAC,CAAC;YAC7CtJ,IAAI,CAACsG,GAAG,CAAC;UACX;QACF,CAAC,CAAC;MACJ,CAAC,MAAM;QACL1D,KAAK,CAAC,kBAAkB,CAAC;QACzB,IAAMmI,YAAgB,GAAG,IAAAO,+BAAwB,EAAChB,QAAQ,EAAEjH,MAAM,EAAE2G,aAAa,CAAC;QAClF,IAAIe,YAAW,EAAE;UACf;UACAtB,GAAG,CAACI,WAAW,GAAGkB,YAAW;UAC7BnI,KAAK,CAAC,0BAA0B,CAAC;UACjC5C,IAAI,CAAC,CAAC;QACR,CAAC,MAAM;UACL;UACA4C,KAAK,CAAC,mBAAmB,CAAC;UAC1B5C,IAAI,CAAC+F,gBAAU,CAACwF,YAAY,CAAClE,eAAS,CAAC8D,qBAAqB,CAAC,CAAC;QAChE;MACF;IACF;EAAC;IAAA7I,GAAA;IAAAnD,KAAA,EAED,SAAQqL,mBAAmBA,CACzBf,GAAmB,EACnBa,QAAkB,EAClBjH,MAAc,EACd2G,aAAqB,EACrBhK,IAAc,EACR;MACN4C,KAAK,CAAC,8BAA8B,CAAC;MACrCA,KAAK,CAAC,iCAAiC,EAAE,OAAOS,MAAM,KAAK,QAAQ,CAAC;MACpET,KAAK,CAAC,iCAAiC,EAAE,OAAOoH,aAAa,KAAK,QAAQ,CAAC;MAC3E,IAAMe,WAAgB,GAAG,IAAAO,+BAAwB,EAAChB,QAAQ,EAAEjH,MAAM,EAAE2G,aAAa,CAAC;MAClFpH,KAAK,CAAC,+BAA+B,EAAEmI,WAAW,aAAXA,WAAW,uBAAXA,WAAW,CAAE5K,IAAI,CAAC;MACzD,IAAI4K,WAAW,EAAE;QACf,IAAQtD,IAAI,GAAyBsD,WAAW,CAAxCtD,IAAI;UAAElC,QAAQ,GAAewF,WAAW,CAAlCxF,QAAQ;UAAE8F,QAAQ,GAAKN,WAAW,CAAxBM,QAAQ;QAChCzI,KAAK,CAAC,mBAAmB,EAAE6E,IAAI,CAAC;QAChC,IAAI,CAAC3C,YAAY,CAAC2C,IAAI,EAAElC,QAAQ,EAAE,UAACe,GAAG,EAAEmB,IAAI,EAAW;UACrD,IAAI,CAACnB,GAAG,EAAE;YACRmD,GAAG,CAACI,WAAW,GAAGwB,QAAQ,GAAA3M,aAAA,CAAAA,aAAA,KAAQ+I,IAAI;cAAEf,KAAK,EAAE;gBAAEpE,GAAG,EAAE+I;cAAS;YAAC,KAAK5D,IAAI;YACzE7E,KAAK,CAAC,0BAA0B,CAAC;YACjC5C,IAAI,CAAC,CAAC;UACR,CAAC,MAAM;YACLyJ,GAAG,CAACI,WAAW,GAAG,IAAAP,iCAAyB,EAAC,CAAC;YAC7C1G,KAAK,CAAC,2BAA2B,CAAC;YAClC5C,IAAI,CAACsG,GAAG,CAAC;UACX;QACF,CAAC,CAAC;MACJ,CAAC,MAAM;QACL;QACA1D,KAAK,CAAC,uBAAuB,CAAC;QAC9B,OAAO5C,IAAI,CAAC+F,gBAAU,CAACoE,aAAa,CAAC9C,eAAS,CAAC+C,eAAe,CAAC,CAAC;MAClE;IACF;EAAC;IAAA9H,GAAA;IAAAnD,KAAA,EAED,SAAQqM,kBAAkBA,CAAC3B,WAAwB,EAAW;MAC5D,OAAOjE,kBAAC,CAAC6F,WAAW,CAAC5B,WAAW,CAAC,KAAK,KAAK,IAAIjE,kBAAC,CAAC6F,WAAW,CAAC5B,WAAW,aAAXA,WAAW,uBAAXA,WAAW,CAAE1J,IAAI,CAAC,KAAK,KAAK;IAC3F;;IAEA;AACF;AACA;EAFE;IAAAmC,GAAA;IAAAnD,KAAA,EAGA,SAAOuM,kBAAkBA,CAAA,EAAG;MAAA,IAAAC,MAAA;MAC1B,OAAO,UAAClC,GAAmB,EAAEC,GAAoB,EAAExH,KAAmB,EAAW;QAC/E,IAAIyJ,MAAI,CAACH,kBAAkB,CAAC/B,GAAG,CAACI,WAAW,CAAC,EAAE;UAC5C,OAAO3H,KAAK,CAAC,CAAC;QAChB;QAEAuH,GAAG,CAACE,KAAK,CAAC,CAAC;QACX,IAAM3J,IAAI,GAAG,SAAPA,IAAIA,CAAIsG,GAA0B,EAAW;UACjDmD,GAAG,CAACG,MAAM,CAAC,CAAC;UACZ,IAAItD,GAAG,EAAE;YACPmD,GAAG,CAACI,WAAW,CAACvF,KAAK,GAAGgC,GAAG,CAACY,OAAO;YACnCwC,GAAG,CAACkC,MAAM,CAACtF,GAAG,CAACuF,UAAU,CAAC,CAACC,IAAI,CAACxF,GAAG,CAACY,OAAO,CAAC;UAC9C;UAEA,OAAOhF,KAAK,CAAC,CAAC;QAChB,CAAC;QAED,IAAQ8H,aAAa,GAAKP,GAAG,CAACQ,OAAO,CAA7BD,aAAa;QACrB,IAAIpE,kBAAC,CAACS,KAAK,CAAC2D,aAAa,CAAC,EAAE;UAC1B,OAAOhK,IAAI,CAAC,CAAC;QACf;QAEA,IAAI,CAAC,IAAAkK,wBAAiB,EAACF,aAAa,CAAC,EAAE;UACrC,OAAOhK,IAAI,CAAC+F,gBAAU,CAACoE,aAAa,CAAC9C,eAAS,CAAC+C,eAAe,CAAC,CAAC;QAClE;QAEA,IAAM1D,KAAK,GAAG,CAACsD,aAAa,IAAI,EAAE,EAAE+B,OAAO,IAAAC,MAAA,CAAIC,kBAAY,QAAK,EAAE,CAAC;QACnE,IAAI,CAACvF,KAAK,EAAE;UACV,OAAO1G,IAAI,CAAC,CAAC;QACf;QAEA,IAAI+K,WAAmC;QACvC,IAAI;UACFA,WAAW,GAAG,IAAAmB,uBAAgB,EAACxF,KAAK,EAAEiF,MAAI,CAAC3I,MAAM,CAACK,MAAM,EAAEsI,MAAI,CAAC3I,MAAM,CAACsH,QAAQ,CAAC;QACjF,CAAC,CAAC,OAAA6B,OAAA,EAAM;UACN;QAAA;QAGF,IAAIR,MAAI,CAACH,kBAAkB,CAACT,WAAW,CAAC,EAAE;UACxC,IAAAqB,KAAA,GAAyBrB,WAAW;YAA5B5K,IAAI,GAAAiM,KAAA,CAAJjM,IAAI;YAAE8G,MAAM,GAAAmF,KAAA,CAANnF,MAAM;UACpBwC,GAAG,CAACI,WAAW,GAAG,IAAAtC,wBAAgB,EAACpH,IAAI,EAAY8G,MAAM,CAAC;QAC5D,CAAC,MAAM;UACLwC,GAAG,CAACI,WAAW,GAAG,IAAAP,iCAAyB,EAAC,CAAC;QAC/C;QAEAtJ,IAAI,CAAC,CAAC;MACR,CAAC;IACH;EAAC;IAAAsC,GAAA;IAAAnD,KAAA;MAAA,IAAAkN,WAAA,GAAApK,iBAAA,cAAA5B,YAAA,GAAAqB,CAAA,CAED,SAAA4K,SAAwB7E,IAAgB,EAAE8E,WAA2B;QAAA,IAAAC,WAAA,EAAArM,IAAA,EAAA8G,MAAA,EAAAwF,aAAA,EAAAC,mBAAA,EAAAC,aAAA,EAAAC,OAAA,EAAAC,WAAA;QAAA,OAAAxM,YAAA,GAAAoB,CAAA,WAAAqL,SAAA;UAAA,kBAAAA,SAAA,CAAApN,CAAA;YAAA;cAC3D8M,WAAW,GAAyC/E,IAAI,CAAxD+E,WAAW,EAAErM,IAAI,GAAmCsH,IAAI,CAA3CtH,IAAI,EAAE8G,MAAM,GAA2BQ,IAAI,CAArCR,MAAM,EAASwF,aAAa,GAAKhF,IAAI,CAA7Bf,KAAK;cACxC9D,KAAK,CAAC,gBAAgB,EAAEzC,IAAI,CAAC;cACvBuM,mBAAmB,GAAG9G,kBAAC,CAACS,KAAK,CAACmG,WAAW,CAAC,GAAG,EAAE,GAAGA,WAAW;cAC7DG,aAAa,GAAG/G,kBAAC,CAACS,KAAK,CAACY,MAAM,CAAC,GACjCuF,WAAW,GACX5O,KAAK,CAACC,IAAI,CAAC,IAAIkP,GAAG,CAAA1P,kBAAA,CAAK4J,MAAM,CAAC+E,MAAM,CAACU,mBAAmB,CAAC,CAAC,CAAC,CAAC;cAC1DE,OAAmB,GAAG;gBAC1BJ,WAAW,EAAEE,mBAAmB;gBAChCvM,IAAI,EAAJA,IAAI;gBACJ8G,MAAM,EAAE0F;cACV,CAAC;cACD,IAAIF,aAAa,aAAbA,aAAa,eAAbA,aAAa,CAAEnK,GAAG,EAAE;gBACtBsK,OAAO,CAAClG,KAAK,GAAG;kBAAEpE,GAAG,EAAEmK,aAAa,CAACnK;gBAAI,CAAC;cAC5C;cAACwK,SAAA,CAAApN,CAAA;cAAA,OACiC,IAAAsN,sBAAW,EAACJ,OAAO,EAAE,IAAI,CAACvJ,MAAM,EAAEkJ,WAAW,CAAC;YAAA;cAA1EM,WAAmB,GAAAC,SAAA,CAAA/L,CAAA;cAAA,OAAA+L,SAAA,CAAAjN,CAAA,IAElBgN,WAAW;UAAA;QAAA,GAAAP,QAAA;MAAA,CACnB;MAAA,SAlBYW,UAAUA,CAAAC,GAAA,EAAAC,GAAA;QAAA,OAAAd,WAAA,CAAA5N,KAAA,OAAAE,SAAA;MAAA;MAAA,OAAVsO,UAAU;IAAA;IAoBvB;AACF;AACA;EAFE;IAAA3K,GAAA;IAAAnD,KAAA,EAGA,SAAOiO,UAAUA,CAACjO,KAAa,EAAiB;MAC9C,IAAI,IAAI,CAACkE,MAAM,CAACzE,MAAM,KAAKyO,0BAAkB,EAAE;QAC7CzK,KAAK,CAAC,kCAAkC,CAAC;QACzC,IAAM8D,KAAK,GAAG,IAAA0G,qBAAU,EAACjO,KAAK,EAAE,IAAI,CAACkE,MAAM,CAAC;QAC5C,OAAOqD,KAAK;MACd,CAAC,MAAM;QACL9D,KAAK,CAAC,6CAA6C,CAAC;QACpD;QACA,IAAM8D,MAAK,GAAG,IAAA4G,+BAAoB,EAACC,MAAM,CAAC1P,IAAI,CAACsB,KAAK,CAAC,EAAE,IAAI,CAACkE,MAAM,CAAC,CAACpD,QAAQ,CAAC,QAAQ,CAAC;QACtF,OAAOyG,MAAK;MACd;IACF;EAAC;AAAA","ignoreList":[]}
+{"version":3,"file":"auth.js","names":[],"sources":["../src/auth.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport _ from 'lodash';\nimport { HTPasswd } from 'verdaccio-htpasswd';\n\nimport { createAnonymousRemoteUser, createRemoteUser } from '@verdaccio/config';\nimport type { VerdaccioError, pluginUtils } from '@verdaccio/core';\nimport {\n  API_ERROR,\n  PLUGIN_CATEGORY,\n  PLUGIN_PREFIX,\n  SUPPORT_ERRORS,\n  TOKEN_BASIC,\n  TOKEN_BEARER,\n  authUtils,\n  errorUtils,\n  warningUtils,\n} from '@verdaccio/core';\nimport { asyncLoadPlugin } from '@verdaccio/loaders';\nimport { aesEncrypt, parseBasicPayload, signPayload } from '@verdaccio/signature';\nimport type {\n  AllowAccess,\n  Callback,\n  Config,\n  JWTSignOptions,\n  Logger,\n  PackageAccess,\n  RemoteUser,\n  Security,\n} from '@verdaccio/types';\n\nimport type {\n  $RequestExtend,\n  $ResponseExtend,\n  AESPayload,\n  IAuthMiddleware,\n  NextFunction,\n  TokenEncryption,\n} from './types';\nimport {\n  convertPayloadToBase64,\n  getDefaultPluginMethods,\n  getMiddlewareCredentials,\n  isAESLegacy,\n  isAuthHeaderValid,\n  parseAuthTokenHeader,\n  verifyJWTPayload,\n} from './utils';\n\nconst debug = buildDebug('verdaccio:auth');\n\nclass Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {\n  public config: Config;\n  public secret: string;\n  public logger: Logger;\n  public plugins: pluginUtils.Auth<Config>[];\n  public options: { legacyMergeConfigs: boolean };\n\n  public constructor(config: Config, logger: Logger, options = { legacyMergeConfigs: false }) {\n    this.config = config;\n    this.secret = config.secret;\n    this.logger = logger;\n    this.plugins = [];\n    this.options = options;\n    if (!this.secret) {\n      throw new TypeError('secret it is required value on initialize the auth class');\n    }\n  }\n\n  public async init() {\n    let plugins = await this.loadPlugin();\n\n    debug('auth plugins found %s', plugins.length);\n    // Missing auth config or no loaded plugins -> load default htpasswd plugin\n    // Empty auth config (null) -> just use fallback methods\n    if (this.config.auth !== null && (!plugins || plugins.length === 0)) {\n      plugins = this.loadDefaultPlugin();\n    }\n    this.plugins = plugins;\n\n    this.applyFallbackPluginMethods();\n  }\n\n  private loadDefaultPlugin() {\n    debug('load default auth plugin');\n    let authPlugin;\n    try {\n      authPlugin = new HTPasswd(\n        { file: './htpasswd' },\n        {\n          config: this.config,\n          logger: this.logger,\n        }\n      );\n      this.logger.info(\n        { name: 'verdaccio-htpasswd', pluginCategory: PLUGIN_CATEGORY.AUTHENTICATION },\n        'plugin @{name} successfully loaded (@{pluginCategory})'\n      );\n    } catch (error: any) {\n      debug('error on loading auth htpasswd plugin stack: %o', error);\n      this.logger.info({}, 'no auth plugin has been found');\n      return [];\n    }\n\n    return [authPlugin];\n  }\n\n  private async loadPlugin() {\n    return asyncLoadPlugin<pluginUtils.Auth<Config>>(\n      this.config.auth,\n      {\n        config: this.config,\n        logger: this.logger,\n      },\n      (plugin): boolean => {\n        const { authenticate, allow_access, allow_publish } = plugin;\n\n        return (\n          typeof authenticate !== 'undefined' ||\n          typeof allow_access !== 'undefined' ||\n          typeof allow_publish !== 'undefined'\n        );\n      },\n      this.options.legacyMergeConfigs,\n      this.config?.server?.pluginPrefix ?? PLUGIN_PREFIX,\n      PLUGIN_CATEGORY.AUTHENTICATION\n    );\n  }\n\n  private applyFallbackPluginMethods(): void {\n    this.plugins.push(getDefaultPluginMethods(this.logger));\n  }\n\n  public changePassword(\n    username: string,\n    password: string,\n    newPassword: string,\n    cb: Callback\n  ): void {\n    const validPlugins = _.filter(this.plugins, (plugin) => _.isFunction(plugin.changePassword));\n\n    if (_.isEmpty(validPlugins)) {\n      return cb(errorUtils.getInternalError(SUPPORT_ERRORS.PLUGIN_MISSING_INTERFACE));\n    }\n\n    for (const plugin of validPlugins) {\n      if (_.isNil(plugin) || _.isFunction(plugin.changePassword) === false) {\n        debug('auth plugin does not implement changePassword, trying next one');\n        continue;\n      } else {\n        debug('updating password for %o', username);\n        plugin.changePassword!(username, password, newPassword, (err, profile): void => {\n          if (err) {\n            this.logger.error(\n              { username, err },\n              `An error has been produced\n            updating the password for @{username}. Error: @{err.message}`\n            );\n            return cb(err);\n          }\n\n          debug('updated password for %o was successful', username);\n          return cb(null, profile);\n        });\n      }\n    }\n  }\n\n  public async invalidateToken(token: string) {\n    console.log('invalidate token pending to implement', token);\n    return Promise.resolve();\n  }\n\n  public authenticate(\n    username: string,\n    password: string,\n    cb: (error: VerdaccioError | null, user?: RemoteUser) => void\n  ): void {\n    const plugins = this.plugins.slice(0);\n    (function next(): void {\n      const plugin = plugins.shift();\n\n      if (typeof plugin?.authenticate !== 'function') {\n        return next();\n      }\n\n      debug('authenticating %o', username);\n      plugin.authenticate(username, password, function (err: VerdaccioError | null, groups): void {\n        if (err) {\n          debug('authenticating for user %o failed. Error: %o', username, err?.message);\n          return cb(err);\n        }\n\n        // Expect: SKIP if groups is falsey and not an array\n        //         with at least one item (truthy length)\n        // Expect: CONTINUE otherwise (will error if groups is not\n        //         an array, but this is current behavior)\n        // Caveat: STRING (if valid) will pass successfully\n        //         bug give unexpected results\n        // Info: Cannot use `== false to check falsey values`\n        if (!!groups && groups.length !== 0) {\n          // TODO: create a better understanding of expectations\n          if (_.isString(groups)) {\n            throw new TypeError('plugin group error: invalid type for function');\n          }\n          const isGroupValid: boolean = _.isArray(groups);\n          if (!isGroupValid) {\n            throw new TypeError(API_ERROR.BAD_FORMAT_USER_GROUP);\n          }\n\n          debug('authentication for user %o was successfully. Groups: %o', username, groups);\n          return cb(err, createRemoteUser(username, groups));\n        }\n        next();\n      });\n    })();\n  }\n\n  public add_user(\n    user: string,\n    password: string,\n    cb: (error: VerdaccioError | null, user?: RemoteUser) => void\n  ): void {\n    const self = this;\n    const plugins = this.plugins.slice(0);\n    debug('add user %o', user);\n\n    (function next(): void {\n      let method = 'adduser';\n      const plugin = plugins.shift();\n      // @ts-expect-error future major (7.x) should remove this section\n      if (typeof plugin.adduser === 'undefined' && typeof plugin.add_user === 'function') {\n        method = 'add_user';\n        warningUtils.emit(warningUtils.Codes.VERWAR006);\n      }\n      // @ts-ignore\n      if (typeof plugin[method] !== 'function') {\n        next();\n      } else {\n        // TODO: replace by adduser whenever add_user deprecation method has been removed\n        // @ts-ignore\n        plugin[method](\n          user,\n          password,\n          function (err: VerdaccioError | null, ok?: boolean | string): void {\n            if (err) {\n              debug('the user %o could not be added. Error: %o', user, err?.message);\n              return cb(err);\n            }\n            if (ok) {\n              debug('the user %o has been added', user);\n              return self.authenticate(user, password, cb);\n            }\n            debug('user could not be added, skip to next auth plugin');\n            next();\n          }\n        );\n      }\n    })();\n  }\n\n  /**\n   * Allow user to access a package.\n   */\n  public allow_access(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: pluginUtils.AccessCallback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      authUtils.getMatchedPackagesSpec(packageName, this.config.packages)\n    ) as AllowAccess & PackageAccess;\n\n    debug('check access permissions for user %o to package %o', user.name, packageName);\n\n    // Use const instead of function declaration so we can use this.logger\n    const next = (): void => {\n      const plugin = plugins.shift();\n\n      if (typeof plugin?.allow_access !== 'function') {\n        debug('plugin does not implement allow_access');\n        return next();\n      }\n\n      plugin.allow_access(user, pkg, (err: VerdaccioError | null, ok?: boolean): void => {\n        if (err) {\n          debug('forbidden access. Error: %o', err);\n          return callback(err);\n        }\n\n        if (ok) {\n          debug('access was granted');\n          this.logger.trace(\n            { user: user.name, name: pkg.name },\n            `access was granted for @{name} by @{user}`\n          );\n          return callback(null, ok);\n        }\n\n        // cb(null, false) causes next plugin to roll\n        debug('access was denied. Rolling to next plugin');\n        this.logger.trace(\n          { user: user.name, name: pkg.name },\n          `intermediate access denial for @{name} by @{user}, rolling to next plugin`\n        );\n        return next();\n      });\n    };\n\n    return next();\n  }\n\n  public allow_unpublish(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: Callback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      authUtils.getMatchedPackagesSpec(packageName, this.config.packages)\n    );\n\n    debug('check unpublish permissions for user %o to package %o', user.name, packageName);\n\n    // Use const instead of function declaration so we can use this.logger\n    const next = (): void => {\n      const plugin = plugins.shift();\n\n      if (typeof plugin?.allow_unpublish !== 'function') {\n        debug('plugin does not implement allow_unpublish');\n        return next();\n      }\n\n      plugin.allow_unpublish(user, pkg, (err: VerdaccioError | null, ok?: boolean): void => {\n        if (err) {\n          debug('forbidden unpublish. Error: %o', err);\n          return callback(err);\n        }\n\n        // The following is different from the allow_access and allow_publish implementations:\n        // If the packages config is missing an entry for \"unpublish\", the built-in default method\n        // (or a plugin) will return undefined, which will trigger the allow_publish fallback.\n        // (see utils.ts, handleSpecialUnpublish, callback(null, undefined))\n        if (_.isNil(ok) === true) {\n          debug('bypass unpublish for %o, publish will handle the access', packageName);\n          this.logger.trace(\n            { user: user.name, name: pkg.name },\n            `bypass unpublish for @{name} by @{user}, publish will handle the access`\n          );\n          return this.allow_publish({ packageName, packageVersion }, user, callback);\n        }\n\n        if (ok) {\n          debug('unpublish was granted');\n          this.logger.trace(\n            { user: user.name, name: pkg.name },\n            `unpublish was granted for @{name} by @{user}`\n          );\n          return callback(null, ok);\n        }\n\n        // cb(null, false) causes next plugin to roll\n        debug('unpublish was denied. Rolling to next plugin');\n        this.logger.trace(\n          { user: user.name, name: pkg.name },\n          `intermediate unpublish denial for @{name} by @{user}, rolling to next plugin`\n        );\n        return next();\n      });\n    };\n\n    return next();\n  }\n\n  /**\n   * Allow user to publish a package.\n   */\n  public allow_publish(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: Callback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      authUtils.getMatchedPackagesSpec(packageName, this.config.packages)\n    );\n\n    debug('check publish permissions for user %o to package %o', user.name, packageName);\n\n    // Use const instead of function declaration so we can use this.logger\n    const next = (): void => {\n      const plugin = plugins.shift();\n\n      if (typeof plugin?.allow_publish !== 'function') {\n        debug('plugin does not implement allow_publish');\n        return next();\n      }\n\n      plugin.allow_publish(user, pkg, (err: VerdaccioError | null, ok?: boolean): void => {\n        if (err) {\n          debug('forbidden publish. Error: %o', err);\n          return callback(err);\n        }\n\n        if (ok) {\n          debug('publish was granted');\n          this.logger.trace(\n            { user: user.name, name: pkg.name },\n            `publish was granted for @{name} by @{user}`\n          );\n          return callback(null, ok);\n        }\n\n        // cb(null, false) causes next plugin to roll\n        debug('publish was denied. Rolling to next plugin');\n        this.logger.trace(\n          { user: user.name, name: pkg.name },\n          `intermediate publish denial for @{name} by @{user}, rolling to next plugin`\n        );\n        return next();\n      });\n    };\n\n    return next();\n  }\n\n  public apiJWTmiddleware(): any {\n    debug('jwt middleware');\n    const plugins = this.plugins.slice(0);\n    const helpers = { createAnonymousRemoteUser, createRemoteUser };\n    for (const plugin of plugins) {\n      if (plugin.apiJWTmiddleware) {\n        return plugin.apiJWTmiddleware(helpers);\n      }\n    }\n\n    return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction) => {\n      req.pause();\n      const next = function (err?: VerdaccioError): NextFunction {\n        req.resume();\n        // uncomment this to reject users with bad auth headers\n        // return _next.apply(null, arguments)\n        // swallow error, user remains unauthorized\n        // set remoteUserError to indicate that user was attempting authentication\n        if (err) {\n          req.remote_user.error = err.message;\n        }\n\n        return _next() as unknown as NextFunction;\n      };\n\n      // FUTURE: disabled, not removed yet but seems unreacable code\n      // if (this._isRemoteUserValid(req.remote_user)) {\n      //   debug('jwt has a valid authentication header');\n      //   return next();\n      // }\n\n      // in case auth header does not exist we return anonymous function\n      const remoteUser = createAnonymousRemoteUser();\n      req.remote_user = remoteUser;\n      res.locals.remote_user = remoteUser;\n\n      const { authorization } = req.headers;\n      if (_.isNil(authorization)) {\n        debug('jwt, authentication header is missing');\n        return next();\n      }\n\n      if (!isAuthHeaderValid(authorization)) {\n        debug('api middleware authentication heather is invalid');\n        return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n      }\n      const { secret, security } = this.config;\n\n      if (isAESLegacy(security)) {\n        debug('api middleware using legacy auth token');\n        this.handleAESMiddleware(req, security, secret, authorization, next);\n      } else {\n        debug('api middleware using JWT auth token');\n        this.handleJWTAPIMiddleware(req, security, secret, authorization, next);\n      }\n    };\n  }\n\n  private handleJWTAPIMiddleware(\n    req: $RequestExtend,\n    security: Security,\n    secret: string,\n    authorization: string,\n    next: any\n  ): void {\n    debug('handle JWT api middleware');\n    const { scheme, token } = parseAuthTokenHeader(authorization);\n    if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {\n      debug('handle basic token');\n      // this should happen when client tries to login with an existing user\n      const credentials = convertPayloadToBase64(token).toString();\n      const parsedCredentials = parseBasicPayload(credentials);\n      if (!parsedCredentials) {\n        debug('invalid basic credentials format (missing colon separator)');\n        next(errorUtils.getBadRequest(API_ERROR.BAD_USERNAME_PASSWORD));\n        return;\n      }\n      const { user, password, tokenKey } = parsedCredentials as AESPayload;\n      debug('authenticating %o', user);\n      this.authenticate(user, password, (err: VerdaccioError | null, user): void => {\n        if (!err) {\n          debug('generating a remote user');\n          req.remote_user = tokenKey ? { ...user, token: { key: tokenKey } } : user;\n          next();\n        } else {\n          debug('generating anonymous user');\n          req.remote_user = createAnonymousRemoteUser();\n          next(err);\n        }\n      });\n    } else {\n      debug('handle jwt token');\n      const credentials: any = getMiddlewareCredentials(security, secret, authorization);\n      if (credentials) {\n        // if the signature is valid we rely on it\n        req.remote_user = credentials;\n        debug('generating a remote user');\n        next();\n      } else {\n        // with JWT throw 401\n        debug('jwt invalid token');\n        next(errorUtils.getForbidden(API_ERROR.BAD_USERNAME_PASSWORD));\n      }\n    }\n  }\n\n  private handleAESMiddleware(\n    req: $RequestExtend,\n    security: Security,\n    secret: string,\n    authorization: string,\n    next: Function\n  ): void {\n    debug('handle legacy api middleware');\n    debug('api middleware has a secret? %o', typeof secret === 'string');\n    debug('api middleware authorization %o', typeof authorization === 'string');\n    const credentials: any = getMiddlewareCredentials(security, secret, authorization);\n    debug('api middleware credentials %o', credentials?.name);\n    if (credentials) {\n      const { user, password, tokenKey } = credentials;\n      debug('authenticating %o', user);\n      this.authenticate(user, password, (err, user): void => {\n        if (!err) {\n          req.remote_user = tokenKey ? { ...user, token: { key: tokenKey } } : user;\n          debug('generating a remote user');\n          next();\n        } else {\n          req.remote_user = createAnonymousRemoteUser();\n          debug('generating anonymous user');\n          next(err);\n        }\n      });\n    } else {\n      // we force npm client to ask again with basic authentication\n      debug('legacy invalid header');\n      return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n    }\n  }\n\n  private _isRemoteUserValid(remote_user?: RemoteUser): boolean {\n    return _.isUndefined(remote_user) === false && _.isUndefined(remote_user?.name) === false;\n  }\n\n  /**\n   * JWT middleware for WebUI\n   */\n  public webUIJWTmiddleware() {\n    return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction): void => {\n      if (this._isRemoteUserValid(req.remote_user)) {\n        return _next();\n      }\n\n      req.pause();\n      const next = (err: VerdaccioError | void): void => {\n        req.resume();\n        if (err) {\n          req.remote_user.error = err.message;\n          res.status(err.statusCode).send(err.message);\n        }\n\n        return _next();\n      };\n\n      const { authorization } = req.headers;\n      if (_.isNil(authorization)) {\n        return next();\n      }\n\n      if (!isAuthHeaderValid(authorization)) {\n        return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n      }\n\n      const token = (authorization || '').replace(`${TOKEN_BEARER} `, '');\n      if (!token) {\n        return next();\n      }\n\n      let credentials: RemoteUser | undefined;\n      try {\n        credentials = verifyJWTPayload(token, this.config.secret, this.config.security);\n      } catch {\n        // FIXME: intended behaviour, do we want it?\n      }\n\n      if (this._isRemoteUserValid(credentials)) {\n        const { name, groups } = credentials as RemoteUser;\n        req.remote_user = createRemoteUser(name as string, groups);\n      } else {\n        req.remote_user = createAnonymousRemoteUser();\n      }\n\n      next();\n    };\n  }\n\n  public async jwtEncrypt(user: RemoteUser, signOptions: JWTSignOptions): Promise<string> {\n    const { real_groups, name, groups, token: tokenMetadata } = user;\n    debug('jwt encrypt %o', name);\n    const realGroupsValidated = _.isNil(real_groups) ? [] : real_groups;\n    const groupedGroups = _.isNil(groups)\n      ? real_groups\n      : Array.from(new Set([...groups.concat(realGroupsValidated)]));\n    const payload: RemoteUser = {\n      real_groups: realGroupsValidated,\n      name,\n      groups: groupedGroups,\n    };\n    if (tokenMetadata?.key) {\n      payload.token = { key: tokenMetadata.key };\n    }\n    const signedToken: string = await signPayload(payload, this.secret, signOptions);\n\n    return signedToken;\n  }\n\n  /**\n   * Encrypt a string.\n   */\n  public aesEncrypt(value: string): string | void {\n    debug('signing with aes encryption');\n    const token = aesEncrypt(value, this.secret);\n    return token;\n  }\n}\n\nexport { Auth };\n"],"mappings":";;;;;;;;;;;;AAgDA,IAAM,WAAA,GAAA,MAAA,SAAmB,gBAAgB;AAEzC,IAAM,OAAN,MAA+E;CAC7E;CACA;CACA;CACA;CACA;CAEA,YAAmB,QAAgB,QAAgB,UAAU,EAAE,oBAAoB,MAAM,GAAG;EAC1F,KAAK,SAAS;EACd,KAAK,SAAS,OAAO;EACrB,KAAK,SAAS;EACd,KAAK,UAAU,CAAC;EAChB,KAAK,UAAU;EACf,IAAI,CAAC,KAAK,QACR,MAAM,IAAI,UAAU,0DAA0D;CAElF;CAEA,MAAa,OAAO;EAClB,IAAI,UAAU,MAAM,KAAK,WAAW;EAEpC,QAAM,yBAAyB,QAAQ,MAAM;EAG7C,IAAI,KAAK,OAAO,SAAS,SAAS,CAAC,WAAW,QAAQ,WAAW,IAC/D,UAAU,KAAK,kBAAkB;EAEnC,KAAK,UAAU;EAEf,KAAK,2BAA2B;CAClC;CAEA,oBAA4B;EAC1B,QAAM,0BAA0B;EAChC,IAAI;EACJ,IAAI;GACF,aAAa,IAAI,mBAAA,SACf,EAAE,MAAM,aAAa,GACrB;IACE,QAAQ,KAAK;IACb,QAAQ,KAAK;GACf,CACF;GACA,KAAK,OAAO,KACV;IAAE,MAAM;IAAsB,gBAAgB,gBAAA,gBAAgB;GAAe,GAC7E,wDACF;EACF,SAAS,OAAY;GACnB,QAAM,mDAAmD,KAAK;GAC9D,KAAK,OAAO,KAAK,CAAC,GAAG,+BAA+B;GACpD,OAAO,CAAC;EACV;EAEA,OAAO,CAAC,UAAU;CACpB;CAEA,MAAc,aAAa;EACzB,QAAA,GAAA,mBAAA,iBACE,KAAK,OAAO,MACZ;GACE,QAAQ,KAAK;GACb,QAAQ,KAAK;EACf,IACC,WAAoB;GACnB,MAAM,EAAE,cAAc,cAAc,kBAAkB;GAEtD,OACE,OAAO,iBAAiB,eACxB,OAAO,iBAAiB,eACxB,OAAO,kBAAkB;EAE7B,GACA,KAAK,QAAQ,oBACb,KAAK,QAAQ,QAAQ,gBAAgB,gBAAA,eACrC,gBAAA,gBAAgB,cAClB;CACF;CAEA,6BAA2C;EACzC,KAAK,QAAQ,KAAK,cAAA,wBAAwB,KAAK,MAAM,CAAC;CACxD;CAEA,eACE,UACA,UACA,aACA,IACM;EACN,MAAM,eAAe,OAAA,QAAE,OAAO,KAAK,UAAU,WAAW,OAAA,QAAE,WAAW,OAAO,cAAc,CAAC;EAE3F,IAAI,OAAA,QAAE,QAAQ,YAAY,GACxB,OAAO,GAAG,gBAAA,WAAW,iBAAiB,gBAAA,eAAe,wBAAwB,CAAC;EAGhF,KAAK,MAAM,UAAU,cACnB,IAAI,OAAA,QAAE,MAAM,MAAM,KAAK,OAAA,QAAE,WAAW,OAAO,cAAc,MAAM,OAAO;GACpE,QAAM,gEAAgE;GACtE;EACF,OAAO;GACL,QAAM,4BAA4B,QAAQ;GAC1C,OAAO,eAAgB,UAAU,UAAU,cAAc,KAAK,YAAkB;IAC9E,IAAI,KAAK;KACP,KAAK,OAAO,MACV;MAAE;MAAU;KAAI,GAChB;yEAEF;KACA,OAAO,GAAG,GAAG;IACf;IAEA,QAAM,0CAA0C,QAAQ;IACxD,OAAO,GAAG,MAAM,OAAO;GACzB,CAAC;EACH;CAEJ;CAEA,MAAa,gBAAgB,OAAe;EAC1C,QAAQ,IAAI,yCAAyC,KAAK;EAC1D,OAAO,QAAQ,QAAQ;CACzB;CAEA,aACE,UACA,UACA,IACM;EACN,MAAM,UAAU,KAAK,QAAQ,MAAM,CAAC;EACpC,CAAC,SAAS,OAAa;GACrB,MAAM,SAAS,QAAQ,MAAM;GAE7B,IAAI,OAAO,QAAQ,iBAAiB,YAClC,OAAO,KAAK;GAGd,QAAM,qBAAqB,QAAQ;GACnC,OAAO,aAAa,UAAU,UAAU,SAAU,KAA4B,QAAc;IAC1F,IAAI,KAAK;KACP,QAAM,gDAAgD,UAAU,KAAK,OAAO;KAC5E,OAAO,GAAG,GAAG;IACf;IASA,IAAI,CAAC,CAAC,UAAU,OAAO,WAAW,GAAG;KAEnC,IAAI,OAAA,QAAE,SAAS,MAAM,GACnB,MAAM,IAAI,UAAU,+CAA+C;KAGrE,IAAI,CAD0B,OAAA,QAAE,QAAQ,MACnC,GACH,MAAM,IAAI,UAAU,gBAAA,UAAU,qBAAqB;KAGrD,QAAM,2DAA2D,UAAU,MAAM;KACjF,OAAO,GAAG,MAAA,GAAA,kBAAA,kBAAsB,UAAU,MAAM,CAAC;IACnD;IACA,KAAK;GACP,CAAC;EACH,GAAG;CACL;CAEA,SACE,MACA,UACA,IACM;EACN,MAAM,OAAO;EACb,MAAM,UAAU,KAAK,QAAQ,MAAM,CAAC;EACpC,QAAM,eAAe,IAAI;EAEzB,CAAC,SAAS,OAAa;GACrB,IAAI,SAAS;GACb,MAAM,SAAS,QAAQ,MAAM;GAE7B,IAAI,OAAO,OAAO,YAAY,eAAe,OAAO,OAAO,aAAa,YAAY;IAClF,SAAS;IACT,gBAAA,aAAa,KAAK,gBAAA,aAAa,MAAM,SAAS;GAChD;GAEA,IAAI,OAAO,OAAO,YAAY,YAC5B,KAAK;QAIL,OAAO,QACL,MACA,UACA,SAAU,KAA4B,IAA6B;IACjE,IAAI,KAAK;KACP,QAAM,6CAA6C,MAAM,KAAK,OAAO;KACrE,OAAO,GAAG,GAAG;IACf;IACA,IAAI,IAAI;KACN,QAAM,8BAA8B,IAAI;KACxC,OAAO,KAAK,aAAa,MAAM,UAAU,EAAE;IAC7C;IACA,QAAM,mDAAmD;IACzD,KAAK;GACP,CACF;EAEJ,GAAG;CACL;;;;CAKA,aACE,EAAE,aAAa,kBACf,MACA,UACM;EACN,MAAM,UAAU,KAAK,QAAQ,MAAM,CAAC;EACpC,MAAM,MAAM,OAAO,OACjB;GAAE,MAAM;GAAa,SAAS;EAAe,GAC7C,gBAAA,UAAU,uBAAuB,aAAa,KAAK,OAAO,QAAQ,CACpE;EAEA,QAAM,sDAAsD,KAAK,MAAM,WAAW;EAGlF,MAAM,aAAmB;GACvB,MAAM,SAAS,QAAQ,MAAM;GAE7B,IAAI,OAAO,QAAQ,iBAAiB,YAAY;IAC9C,QAAM,wCAAwC;IAC9C,OAAO,KAAK;GACd;GAEA,OAAO,aAAa,MAAM,MAAM,KAA4B,OAAuB;IACjF,IAAI,KAAK;KACP,QAAM,+BAA+B,GAAG;KACxC,OAAO,SAAS,GAAG;IACrB;IAEA,IAAI,IAAI;KACN,QAAM,oBAAoB;KAC1B,KAAK,OAAO,MACV;MAAE,MAAM,KAAK;MAAM,MAAM,IAAI;KAAK,GAClC,2CACF;KACA,OAAO,SAAS,MAAM,EAAE;IAC1B;IAGA,QAAM,2CAA2C;IACjD,KAAK,OAAO,MACV;KAAE,MAAM,KAAK;KAAM,MAAM,IAAI;IAAK,GAClC,2EACF;IACA,OAAO,KAAK;GACd,CAAC;EACH;EAEA,OAAO,KAAK;CACd;CAEA,gBACE,EAAE,aAAa,kBACf,MACA,UACM;EACN,MAAM,UAAU,KAAK,QAAQ,MAAM,CAAC;EACpC,MAAM,MAAM,OAAO,OACjB;GAAE,MAAM;GAAa,SAAS;EAAe,GAC7C,gBAAA,UAAU,uBAAuB,aAAa,KAAK,OAAO,QAAQ,CACpE;EAEA,QAAM,yDAAyD,KAAK,MAAM,WAAW;EAGrF,MAAM,aAAmB;GACvB,MAAM,SAAS,QAAQ,MAAM;GAE7B,IAAI,OAAO,QAAQ,oBAAoB,YAAY;IACjD,QAAM,2CAA2C;IACjD,OAAO,KAAK;GACd;GAEA,OAAO,gBAAgB,MAAM,MAAM,KAA4B,OAAuB;IACpF,IAAI,KAAK;KACP,QAAM,kCAAkC,GAAG;KAC3C,OAAO,SAAS,GAAG;IACrB;IAMA,IAAI,OAAA,QAAE,MAAM,EAAE,MAAM,MAAM;KACxB,QAAM,2DAA2D,WAAW;KAC5E,KAAK,OAAO,MACV;MAAE,MAAM,KAAK;MAAM,MAAM,IAAI;KAAK,GAClC,yEACF;KACA,OAAO,KAAK,cAAc;MAAE;MAAa;KAAe,GAAG,MAAM,QAAQ;IAC3E;IAEA,IAAI,IAAI;KACN,QAAM,uBAAuB;KAC7B,KAAK,OAAO,MACV;MAAE,MAAM,KAAK;MAAM,MAAM,IAAI;KAAK,GAClC,8CACF;KACA,OAAO,SAAS,MAAM,EAAE;IAC1B;IAGA,QAAM,8CAA8C;IACpD,KAAK,OAAO,MACV;KAAE,MAAM,KAAK;KAAM,MAAM,IAAI;IAAK,GAClC,8EACF;IACA,OAAO,KAAK;GACd,CAAC;EACH;EAEA,OAAO,KAAK;CACd;;;;CAKA,cACE,EAAE,aAAa,kBACf,MACA,UACM;EACN,MAAM,UAAU,KAAK,QAAQ,MAAM,CAAC;EACpC,MAAM,MAAM,OAAO,OACjB;GAAE,MAAM;GAAa,SAAS;EAAe,GAC7C,gBAAA,UAAU,uBAAuB,aAAa,KAAK,OAAO,QAAQ,CACpE;EAEA,QAAM,uDAAuD,KAAK,MAAM,WAAW;EAGnF,MAAM,aAAmB;GACvB,MAAM,SAAS,QAAQ,MAAM;GAE7B,IAAI,OAAO,QAAQ,kBAAkB,YAAY;IAC/C,QAAM,yCAAyC;IAC/C,OAAO,KAAK;GACd;GAEA,OAAO,cAAc,MAAM,MAAM,KAA4B,OAAuB;IAClF,IAAI,KAAK;KACP,QAAM,gCAAgC,GAAG;KACzC,OAAO,SAAS,GAAG;IACrB;IAEA,IAAI,IAAI;KACN,QAAM,qBAAqB;KAC3B,KAAK,OAAO,MACV;MAAE,MAAM,KAAK;MAAM,MAAM,IAAI;KAAK,GAClC,4CACF;KACA,OAAO,SAAS,MAAM,EAAE;IAC1B;IAGA,QAAM,4CAA4C;IAClD,KAAK,OAAO,MACV;KAAE,MAAM,KAAK;KAAM,MAAM,IAAI;IAAK,GAClC,4EACF;IACA,OAAO,KAAK;GACd,CAAC;EACH;EAEA,OAAO,KAAK;CACd;CAEA,mBAA+B;EAC7B,QAAM,gBAAgB;EACtB,MAAM,UAAU,KAAK,QAAQ,MAAM,CAAC;EACpC,MAAM,UAAU;GAAE,2BAAA,kBAAA;GAA2B,kBAAA,kBAAA;EAAiB;EAC9D,KAAK,MAAM,UAAU,SACnB,IAAI,OAAO,kBACT,OAAO,OAAO,iBAAiB,OAAO;EAI1C,QAAQ,KAAqB,KAAsB,UAAwB;GACzE,IAAI,MAAM;GACV,MAAM,OAAO,SAAU,KAAoC;IACzD,IAAI,OAAO;IAKX,IAAI,KACF,IAAI,YAAY,QAAQ,IAAI;IAG9B,OAAO,MAAM;GACf;GASA,MAAM,cAAA,GAAA,kBAAA,2BAAuC;GAC7C,IAAI,cAAc;GAClB,IAAI,OAAO,cAAc;GAEzB,MAAM,EAAE,kBAAkB,IAAI;GAC9B,IAAI,OAAA,QAAE,MAAM,aAAa,GAAG;IAC1B,QAAM,uCAAuC;IAC7C,OAAO,KAAK;GACd;GAEA,IAAI,CAAC,cAAA,kBAAkB,aAAa,GAAG;IACrC,QAAM,kDAAkD;IACxD,OAAO,KAAK,gBAAA,WAAW,cAAc,gBAAA,UAAU,eAAe,CAAC;GACjE;GACA,MAAM,EAAE,QAAQ,aAAa,KAAK;GAElC,IAAI,cAAA,YAAY,QAAQ,GAAG;IACzB,QAAM,wCAAwC;IAC9C,KAAK,oBAAoB,KAAK,UAAU,QAAQ,eAAe,IAAI;GACrE,OAAO;IACL,QAAM,qCAAqC;IAC3C,KAAK,uBAAuB,KAAK,UAAU,QAAQ,eAAe,IAAI;GACxE;EACF;CACF;CAEA,uBACE,KACA,UACA,QACA,eACA,MACM;EACN,QAAM,2BAA2B;EACjC,MAAM,EAAE,QAAQ,UAAU,cAAA,qBAAqB,aAAa;EAC5D,IAAI,OAAO,YAAY,MAAM,gBAAA,YAAY,YAAY,GAAG;GACtD,QAAM,oBAAoB;GAG1B,MAAM,qBAAA,GAAA,qBAAA,mBADc,cAAA,uBAAuB,KAAK,EAAE,SACN,CAAW;GACvD,IAAI,CAAC,mBAAmB;IACtB,QAAM,4DAA4D;IAClE,KAAK,gBAAA,WAAW,cAAc,gBAAA,UAAU,qBAAqB,CAAC;IAC9D;GACF;GACA,MAAM,EAAE,MAAM,UAAU,aAAa;GACrC,QAAM,qBAAqB,IAAI;GAC/B,KAAK,aAAa,MAAM,WAAW,KAA4B,SAAe;IAC5E,IAAI,CAAC,KAAK;KACR,QAAM,0BAA0B;KAChC,IAAI,cAAc,WAAW;MAAE,GAAG;MAAM,OAAO,EAAE,KAAK,SAAS;KAAE,IAAI;KACrE,KAAK;IACP,OAAO;KACL,QAAM,2BAA2B;KACjC,IAAI,eAAA,GAAA,kBAAA,2BAAwC;KAC5C,KAAK,GAAG;IACV;GACF,CAAC;EACH,OAAO;GACL,QAAM,kBAAkB;GACxB,MAAM,cAAmB,cAAA,yBAAyB,UAAU,QAAQ,aAAa;GACjF,IAAI,aAAa;IAEf,IAAI,cAAc;IAClB,QAAM,0BAA0B;IAChC,KAAK;GACP,OAAO;IAEL,QAAM,mBAAmB;IACzB,KAAK,gBAAA,WAAW,aAAa,gBAAA,UAAU,qBAAqB,CAAC;GAC/D;EACF;CACF;CAEA,oBACE,KACA,UACA,QACA,eACA,MACM;EACN,QAAM,8BAA8B;EACpC,QAAM,mCAAmC,OAAO,WAAW,QAAQ;EACnE,QAAM,mCAAmC,OAAO,kBAAkB,QAAQ;EAC1E,MAAM,cAAmB,cAAA,yBAAyB,UAAU,QAAQ,aAAa;EACjF,QAAM,iCAAiC,aAAa,IAAI;EACxD,IAAI,aAAa;GACf,MAAM,EAAE,MAAM,UAAU,aAAa;GACrC,QAAM,qBAAqB,IAAI;GAC/B,KAAK,aAAa,MAAM,WAAW,KAAK,SAAe;IACrD,IAAI,CAAC,KAAK;KACR,IAAI,cAAc,WAAW;MAAE,GAAG;MAAM,OAAO,EAAE,KAAK,SAAS;KAAE,IAAI;KACrE,QAAM,0BAA0B;KAChC,KAAK;IACP,OAAO;KACL,IAAI,eAAA,GAAA,kBAAA,2BAAwC;KAC5C,QAAM,2BAA2B;KACjC,KAAK,GAAG;IACV;GACF,CAAC;EACH,OAAO;GAEL,QAAM,uBAAuB;GAC7B,OAAO,KAAK,gBAAA,WAAW,cAAc,gBAAA,UAAU,eAAe,CAAC;EACjE;CACF;CAEA,mBAA2B,aAAmC;EAC5D,OAAO,OAAA,QAAE,YAAY,WAAW,MAAM,SAAS,OAAA,QAAE,YAAY,aAAa,IAAI,MAAM;CACtF;;;;CAKA,qBAA4B;EAC1B,QAAQ,KAAqB,KAAsB,UAA8B;GAC/E,IAAI,KAAK,mBAAmB,IAAI,WAAW,GACzC,OAAO,MAAM;GAGf,IAAI,MAAM;GACV,MAAM,QAAQ,QAAqC;IACjD,IAAI,OAAO;IACX,IAAI,KAAK;KACP,IAAI,YAAY,QAAQ,IAAI;KAC5B,IAAI,OAAO,IAAI,UAAU,EAAE,KAAK,IAAI,OAAO;IAC7C;IAEA,OAAO,MAAM;GACf;GAEA,MAAM,EAAE,kBAAkB,IAAI;GAC9B,IAAI,OAAA,QAAE,MAAM,aAAa,GACvB,OAAO,KAAK;GAGd,IAAI,CAAC,cAAA,kBAAkB,aAAa,GAClC,OAAO,KAAK,gBAAA,WAAW,cAAc,gBAAA,UAAU,eAAe,CAAC;GAGjE,MAAM,SAAS,iBAAiB,IAAI,QAAQ,GAAG,gBAAA,aAAa,IAAI,EAAE;GAClE,IAAI,CAAC,OACH,OAAO,KAAK;GAGd,IAAI;GACJ,IAAI;IACF,cAAc,cAAA,iBAAiB,OAAO,KAAK,OAAO,QAAQ,KAAK,OAAO,QAAQ;GAChF,QAAQ,CAER;GAEA,IAAI,KAAK,mBAAmB,WAAW,GAAG;IACxC,MAAM,EAAE,MAAM,WAAW;IACzB,IAAI,eAAA,GAAA,kBAAA,kBAA+B,MAAgB,MAAM;GAC3D,OACE,IAAI,eAAA,GAAA,kBAAA,2BAAwC;GAG9C,KAAK;EACP;CACF;CAEA,MAAa,WAAW,MAAkB,aAA8C;EACtF,MAAM,EAAE,aAAa,MAAM,QAAQ,OAAO,kBAAkB;EAC5D,QAAM,kBAAkB,IAAI;EAC5B,MAAM,sBAAsB,OAAA,QAAE,MAAM,WAAW,IAAI,CAAC,IAAI;EAIxD,MAAM,UAAsB;GAC1B,aAAa;GACb;GACA,QANoB,OAAA,QAAE,MAAM,MAAM,IAChC,cACA,MAAM,KAAK,IAAI,IAAI,CAAC,GAAG,OAAO,OAAO,mBAAmB,CAAC,CAAC,CAAC;EAK/D;EACA,IAAI,eAAe,KACjB,QAAQ,QAAQ,EAAE,KAAK,cAAc,IAAI;EAI3C,OAAO,OAAA,GAAA,qBAAA,aAFuC,SAAS,KAAK,QAAQ,WAAW;CAGjF;;;;CAKA,WAAkB,OAA8B;EAC9C,QAAM,6BAA6B;EAEnC,QAAA,GAAA,qBAAA,YADyB,OAAO,KAAK,MAC9B;CACT;AACF"}

package/build/auth.mjs

@@ -0,0 +1,423 @@
+import { convertPayloadToBase64, getDefaultPluginMethods, getMiddlewareCredentials, isAESLegacy, isAuthHeaderValid, parseAuthTokenHeader, verifyJWTPayload } from "./utils.mjs";
+import buildDebug from "debug";
+import _ from "lodash";
+import { HTPasswd } from "verdaccio-htpasswd";
+import { createAnonymousRemoteUser, createRemoteUser } from "@verdaccio/config";
+import { API_ERROR, PLUGIN_CATEGORY, PLUGIN_PREFIX, SUPPORT_ERRORS, TOKEN_BASIC, TOKEN_BEARER, authUtils, errorUtils, warningUtils } from "@verdaccio/core";
+import { asyncLoadPlugin } from "@verdaccio/loaders";
+import { aesEncrypt, parseBasicPayload, signPayload } from "@verdaccio/signature";
+//#region src/auth.ts
+var debug = buildDebug("verdaccio:auth");
+var Auth = class {
+	config;
+	secret;
+	logger;
+	plugins;
+	options;
+	constructor(config, logger, options = { legacyMergeConfigs: false }) {
+		this.config = config;
+		this.secret = config.secret;
+		this.logger = logger;
+		this.plugins = [];
+		this.options = options;
+		if (!this.secret) throw new TypeError("secret it is required value on initialize the auth class");
+	}
+	async init() {
+		let plugins = await this.loadPlugin();
+		debug("auth plugins found %s", plugins.length);
+		if (this.config.auth !== null && (!plugins || plugins.length === 0)) plugins = this.loadDefaultPlugin();
+		this.plugins = plugins;
+		this.applyFallbackPluginMethods();
+	}
+	loadDefaultPlugin() {
+		debug("load default auth plugin");
+		let authPlugin;
+		try {
+			authPlugin = new HTPasswd({ file: "./htpasswd" }, {
+				config: this.config,
+				logger: this.logger
+			});
+			this.logger.info({
+				name: "verdaccio-htpasswd",
+				pluginCategory: PLUGIN_CATEGORY.AUTHENTICATION
+			}, "plugin @{name} successfully loaded (@{pluginCategory})");
+		} catch (error) {
+			debug("error on loading auth htpasswd plugin stack: %o", error);
+			this.logger.info({}, "no auth plugin has been found");
+			return [];
+		}
+		return [authPlugin];
+	}
+	async loadPlugin() {
+		return asyncLoadPlugin(this.config.auth, {
+			config: this.config,
+			logger: this.logger
+		}, (plugin) => {
+			const { authenticate, allow_access, allow_publish } = plugin;
+			return typeof authenticate !== "undefined" || typeof allow_access !== "undefined" || typeof allow_publish !== "undefined";
+		}, this.options.legacyMergeConfigs, this.config?.server?.pluginPrefix ?? PLUGIN_PREFIX, PLUGIN_CATEGORY.AUTHENTICATION);
+	}
+	applyFallbackPluginMethods() {
+		this.plugins.push(getDefaultPluginMethods(this.logger));
+	}
+	changePassword(username, password, newPassword, cb) {
+		const validPlugins = _.filter(this.plugins, (plugin) => _.isFunction(plugin.changePassword));
+		if (_.isEmpty(validPlugins)) return cb(errorUtils.getInternalError(SUPPORT_ERRORS.PLUGIN_MISSING_INTERFACE));
+		for (const plugin of validPlugins) if (_.isNil(plugin) || _.isFunction(plugin.changePassword) === false) {
+			debug("auth plugin does not implement changePassword, trying next one");
+			continue;
+		} else {
+			debug("updating password for %o", username);
+			plugin.changePassword(username, password, newPassword, (err, profile) => {
+				if (err) {
+					this.logger.error({
+						username,
+						err
+					}, `An error has been produced
+            updating the password for @{username}. Error: @{err.message}`);
+					return cb(err);
+				}
+				debug("updated password for %o was successful", username);
+				return cb(null, profile);
+			});
+		}
+	}
+	async invalidateToken(token) {
+		console.log("invalidate token pending to implement", token);
+		return Promise.resolve();
+	}
+	authenticate(username, password, cb) {
+		const plugins = this.plugins.slice(0);
+		(function next() {
+			const plugin = plugins.shift();
+			if (typeof plugin?.authenticate !== "function") return next();
+			debug("authenticating %o", username);
+			plugin.authenticate(username, password, function(err, groups) {
+				if (err) {
+					debug("authenticating for user %o failed. Error: %o", username, err?.message);
+					return cb(err);
+				}
+				if (!!groups && groups.length !== 0) {
+					if (_.isString(groups)) throw new TypeError("plugin group error: invalid type for function");
+					if (!_.isArray(groups)) throw new TypeError(API_ERROR.BAD_FORMAT_USER_GROUP);
+					debug("authentication for user %o was successfully. Groups: %o", username, groups);
+					return cb(err, createRemoteUser(username, groups));
+				}
+				next();
+			});
+		})();
+	}
+	add_user(user, password, cb) {
+		const self = this;
+		const plugins = this.plugins.slice(0);
+		debug("add user %o", user);
+		(function next() {
+			let method = "adduser";
+			const plugin = plugins.shift();
+			if (typeof plugin.adduser === "undefined" && typeof plugin.add_user === "function") {
+				method = "add_user";
+				warningUtils.emit(warningUtils.Codes.VERWAR006);
+			}
+			if (typeof plugin[method] !== "function") next();
+			else plugin[method](user, password, function(err, ok) {
+				if (err) {
+					debug("the user %o could not be added. Error: %o", user, err?.message);
+					return cb(err);
+				}
+				if (ok) {
+					debug("the user %o has been added", user);
+					return self.authenticate(user, password, cb);
+				}
+				debug("user could not be added, skip to next auth plugin");
+				next();
+			});
+		})();
+	}
+	/**
+	* Allow user to access a package.
+	*/
+	allow_access({ packageName, packageVersion }, user, callback) {
+		const plugins = this.plugins.slice(0);
+		const pkg = Object.assign({
+			name: packageName,
+			version: packageVersion
+		}, authUtils.getMatchedPackagesSpec(packageName, this.config.packages));
+		debug("check access permissions for user %o to package %o", user.name, packageName);
+		const next = () => {
+			const plugin = plugins.shift();
+			if (typeof plugin?.allow_access !== "function") {
+				debug("plugin does not implement allow_access");
+				return next();
+			}
+			plugin.allow_access(user, pkg, (err, ok) => {
+				if (err) {
+					debug("forbidden access. Error: %o", err);
+					return callback(err);
+				}
+				if (ok) {
+					debug("access was granted");
+					this.logger.trace({
+						user: user.name,
+						name: pkg.name
+					}, `access was granted for @{name} by @{user}`);
+					return callback(null, ok);
+				}
+				debug("access was denied. Rolling to next plugin");
+				this.logger.trace({
+					user: user.name,
+					name: pkg.name
+				}, `intermediate access denial for @{name} by @{user}, rolling to next plugin`);
+				return next();
+			});
+		};
+		return next();
+	}
+	allow_unpublish({ packageName, packageVersion }, user, callback) {
+		const plugins = this.plugins.slice(0);
+		const pkg = Object.assign({
+			name: packageName,
+			version: packageVersion
+		}, authUtils.getMatchedPackagesSpec(packageName, this.config.packages));
+		debug("check unpublish permissions for user %o to package %o", user.name, packageName);
+		const next = () => {
+			const plugin = plugins.shift();
+			if (typeof plugin?.allow_unpublish !== "function") {
+				debug("plugin does not implement allow_unpublish");
+				return next();
+			}
+			plugin.allow_unpublish(user, pkg, (err, ok) => {
+				if (err) {
+					debug("forbidden unpublish. Error: %o", err);
+					return callback(err);
+				}
+				if (_.isNil(ok) === true) {
+					debug("bypass unpublish for %o, publish will handle the access", packageName);
+					this.logger.trace({
+						user: user.name,
+						name: pkg.name
+					}, `bypass unpublish for @{name} by @{user}, publish will handle the access`);
+					return this.allow_publish({
+						packageName,
+						packageVersion
+					}, user, callback);
+				}
+				if (ok) {
+					debug("unpublish was granted");
+					this.logger.trace({
+						user: user.name,
+						name: pkg.name
+					}, `unpublish was granted for @{name} by @{user}`);
+					return callback(null, ok);
+				}
+				debug("unpublish was denied. Rolling to next plugin");
+				this.logger.trace({
+					user: user.name,
+					name: pkg.name
+				}, `intermediate unpublish denial for @{name} by @{user}, rolling to next plugin`);
+				return next();
+			});
+		};
+		return next();
+	}
+	/**
+	* Allow user to publish a package.
+	*/
+	allow_publish({ packageName, packageVersion }, user, callback) {
+		const plugins = this.plugins.slice(0);
+		const pkg = Object.assign({
+			name: packageName,
+			version: packageVersion
+		}, authUtils.getMatchedPackagesSpec(packageName, this.config.packages));
+		debug("check publish permissions for user %o to package %o", user.name, packageName);
+		const next = () => {
+			const plugin = plugins.shift();
+			if (typeof plugin?.allow_publish !== "function") {
+				debug("plugin does not implement allow_publish");
+				return next();
+			}
+			plugin.allow_publish(user, pkg, (err, ok) => {
+				if (err) {
+					debug("forbidden publish. Error: %o", err);
+					return callback(err);
+				}
+				if (ok) {
+					debug("publish was granted");
+					this.logger.trace({
+						user: user.name,
+						name: pkg.name
+					}, `publish was granted for @{name} by @{user}`);
+					return callback(null, ok);
+				}
+				debug("publish was denied. Rolling to next plugin");
+				this.logger.trace({
+					user: user.name,
+					name: pkg.name
+				}, `intermediate publish denial for @{name} by @{user}, rolling to next plugin`);
+				return next();
+			});
+		};
+		return next();
+	}
+	apiJWTmiddleware() {
+		debug("jwt middleware");
+		const plugins = this.plugins.slice(0);
+		const helpers = {
+			createAnonymousRemoteUser,
+			createRemoteUser
+		};
+		for (const plugin of plugins) if (plugin.apiJWTmiddleware) return plugin.apiJWTmiddleware(helpers);
+		return (req, res, _next) => {
+			req.pause();
+			const next = function(err) {
+				req.resume();
+				if (err) req.remote_user.error = err.message;
+				return _next();
+			};
+			const remoteUser = createAnonymousRemoteUser();
+			req.remote_user = remoteUser;
+			res.locals.remote_user = remoteUser;
+			const { authorization } = req.headers;
+			if (_.isNil(authorization)) {
+				debug("jwt, authentication header is missing");
+				return next();
+			}
+			if (!isAuthHeaderValid(authorization)) {
+				debug("api middleware authentication heather is invalid");
+				return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));
+			}
+			const { secret, security } = this.config;
+			if (isAESLegacy(security)) {
+				debug("api middleware using legacy auth token");
+				this.handleAESMiddleware(req, security, secret, authorization, next);
+			} else {
+				debug("api middleware using JWT auth token");
+				this.handleJWTAPIMiddleware(req, security, secret, authorization, next);
+			}
+		};
+	}
+	handleJWTAPIMiddleware(req, security, secret, authorization, next) {
+		debug("handle JWT api middleware");
+		const { scheme, token } = parseAuthTokenHeader(authorization);
+		if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {
+			debug("handle basic token");
+			const parsedCredentials = parseBasicPayload(convertPayloadToBase64(token).toString());
+			if (!parsedCredentials) {
+				debug("invalid basic credentials format (missing colon separator)");
+				next(errorUtils.getBadRequest(API_ERROR.BAD_USERNAME_PASSWORD));
+				return;
+			}
+			const { user, password, tokenKey } = parsedCredentials;
+			debug("authenticating %o", user);
+			this.authenticate(user, password, (err, user) => {
+				if (!err) {
+					debug("generating a remote user");
+					req.remote_user = tokenKey ? {
+						...user,
+						token: { key: tokenKey }
+					} : user;
+					next();
+				} else {
+					debug("generating anonymous user");
+					req.remote_user = createAnonymousRemoteUser();
+					next(err);
+				}
+			});
+		} else {
+			debug("handle jwt token");
+			const credentials = getMiddlewareCredentials(security, secret, authorization);
+			if (credentials) {
+				req.remote_user = credentials;
+				debug("generating a remote user");
+				next();
+			} else {
+				debug("jwt invalid token");
+				next(errorUtils.getForbidden(API_ERROR.BAD_USERNAME_PASSWORD));
+			}
+		}
+	}
+	handleAESMiddleware(req, security, secret, authorization, next) {
+		debug("handle legacy api middleware");
+		debug("api middleware has a secret? %o", typeof secret === "string");
+		debug("api middleware authorization %o", typeof authorization === "string");
+		const credentials = getMiddlewareCredentials(security, secret, authorization);
+		debug("api middleware credentials %o", credentials?.name);
+		if (credentials) {
+			const { user, password, tokenKey } = credentials;
+			debug("authenticating %o", user);
+			this.authenticate(user, password, (err, user) => {
+				if (!err) {
+					req.remote_user = tokenKey ? {
+						...user,
+						token: { key: tokenKey }
+					} : user;
+					debug("generating a remote user");
+					next();
+				} else {
+					req.remote_user = createAnonymousRemoteUser();
+					debug("generating anonymous user");
+					next(err);
+				}
+			});
+		} else {
+			debug("legacy invalid header");
+			return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));
+		}
+	}
+	_isRemoteUserValid(remote_user) {
+		return _.isUndefined(remote_user) === false && _.isUndefined(remote_user?.name) === false;
+	}
+	/**
+	* JWT middleware for WebUI
+	*/
+	webUIJWTmiddleware() {
+		return (req, res, _next) => {
+			if (this._isRemoteUserValid(req.remote_user)) return _next();
+			req.pause();
+			const next = (err) => {
+				req.resume();
+				if (err) {
+					req.remote_user.error = err.message;
+					res.status(err.statusCode).send(err.message);
+				}
+				return _next();
+			};
+			const { authorization } = req.headers;
+			if (_.isNil(authorization)) return next();
+			if (!isAuthHeaderValid(authorization)) return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));
+			const token = (authorization || "").replace(`${TOKEN_BEARER} `, "");
+			if (!token) return next();
+			let credentials;
+			try {
+				credentials = verifyJWTPayload(token, this.config.secret, this.config.security);
+			} catch {}
+			if (this._isRemoteUserValid(credentials)) {
+				const { name, groups } = credentials;
+				req.remote_user = createRemoteUser(name, groups);
+			} else req.remote_user = createAnonymousRemoteUser();
+			next();
+		};
+	}
+	async jwtEncrypt(user, signOptions) {
+		const { real_groups, name, groups, token: tokenMetadata } = user;
+		debug("jwt encrypt %o", name);
+		const realGroupsValidated = _.isNil(real_groups) ? [] : real_groups;
+		const payload = {
+			real_groups: realGroupsValidated,
+			name,
+			groups: _.isNil(groups) ? real_groups : Array.from(new Set([...groups.concat(realGroupsValidated)]))
+		};
+		if (tokenMetadata?.key) payload.token = { key: tokenMetadata.key };
+		return await signPayload(payload, this.secret, signOptions);
+	}
+	/**
+	* Encrypt a string.
+	*/
+	aesEncrypt(value) {
+		debug("signing with aes encryption");
+		return aesEncrypt(value, this.secret);
+	}
+};
+//#endregion
+export { Auth };
+
+//# sourceMappingURL=auth.mjs.map