@viktorbarzin/auth 0.0.0-stage → 1.0.0

package/dist/authentik.js

@@ -0,0 +1,115 @@
+import { DEFAULTS } from "./config.js";
+/** The provider did not give an answer this module can believe. */
+export class AuthentikUnavailable extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "AuthentikUnavailable";
+    }
+}
+/**
+ * The app cannot ask at all: no API URL or token configured. A configuration
+ * error, not an outage, so callers that keep the last answer through an
+ * outage must not keep it through this.
+ */
+export class AuthentikNotConfigured extends AuthentikUnavailable {
+    constructor(message) {
+        super(message);
+        this.name = "AuthentikNotConfigured";
+    }
+}
+export function createAuthentikClient(cfg) {
+    const apiUrl = cfg.apiUrl?.replace(/\/+$/, "") ?? null;
+    const timeoutMs = cfg.timeoutMs ?? DEFAULTS.authentikTimeoutMs;
+    async function call(token, path, init = {}) {
+        if (!apiUrl)
+            throw new AuthentikNotConfigured("no Authentik API URL configured");
+        if (!token)
+            throw new AuthentikNotConfigured("no Authentik API token configured");
+        const headers = new Headers(init.headers);
+        headers.set("authorization", `Bearer ${token}`);
+        headers.set("accept", "application/json");
+        try {
+            return await fetch(`${apiUrl}/api/v3${path}`, {
+                ...init,
+                headers,
+                signal: AbortSignal.timeout(timeoutMs),
+            });
+        }
+        catch (err) {
+            throw new AuthentikUnavailable(`unreachable: ${String(err)}`);
+        }
+    }
+    async function readResults(response, what) {
+        // Any status but 200 is "cannot say": a token missing a permission
+        // answers 403, and reading that as "not a member" would lock people out.
+        if (response.status !== 200) {
+            throw new AuthentikUnavailable(`${what} answered ${response.status}`);
+        }
+        let body;
+        try {
+            body = await response.json();
+        }
+        catch {
+            throw new AuthentikUnavailable(`${what} did not answer JSON`);
+        }
+        const results = body?.results;
+        if (!Array.isArray(results)) {
+            throw new AuthentikUnavailable(`${what} answered something other than a list`);
+        }
+        return results;
+    }
+    async function usersGroupPk() {
+        if (cfg.usersGroupPk)
+            return cfg.usersGroupPk;
+        const query = new URLSearchParams({ name: cfg.usersGroup });
+        const response = await call(cfg.readerToken, `/core/groups/?${query}`);
+        for (const raw of await readResults(response, "group lookup")) {
+            const group = raw;
+            if (group.name === cfg.usersGroup && typeof group.pk === "string")
+                return group.pk;
+        }
+        throw new AuthentikUnavailable(`group "${cfg.usersGroup}" was not found`);
+    }
+    return {
+        async findUser(sub, username) {
+            const query = new URLSearchParams({ username, include_groups: "true" });
+            const response = await call(cfg.readerToken, `/core/users/?${query}`);
+            for (const raw of await readResults(response, "user lookup")) {
+                const found = raw;
+                if (found.username !== username || found.uid !== sub)
+                    continue;
+                if (typeof found.pk !== "number")
+                    continue;
+                const groups = Array.isArray(found.groups_obj)
+                    ? found.groups_obj
+                        .map((group) => group?.name)
+                        .filter((name) => typeof name === "string")
+                    : [];
+                return {
+                    pk: found.pk,
+                    uid: sub,
+                    username,
+                    isActive: found.is_active === true,
+                    groups,
+                };
+            }
+            return null;
+        },
+        usersGroupPk,
+        async addToUsersGroup(userPk) {
+            const groupPk = await usersGroupPk();
+            const response = await call(cfg.approverToken, `/core/groups/${encodeURIComponent(groupPk)}/add_user/`, {
+                method: "POST",
+                headers: { "content-type": "application/json" },
+                body: JSON.stringify({ pk: userPk }),
+            });
+            if (response.status !== 204 && response.status !== 200) {
+                cfg.logger?.warning("adding a user to the users group failed", {
+                    status: response.status,
+                    group: cfg.usersGroup,
+                });
+                throw new AuthentikUnavailable(`add_user answered ${response.status}`);
+            }
+        },
+    };
+}

package/dist/config.d.ts

@@ -0,0 +1,120 @@
+/** The configuration an app passes to createAppAuth, and the types it gets back. */
+import type { Logger } from "@viktorbarzin/log";
+import type { PgDatabase, PgQueryResultHKT } from "drizzle-orm/pg-core";
+import type { Registry } from "prom-client";
+/** Any Drizzle Postgres database whose schema includes the tables in @viktorbarzin/auth/schema. */
+export type AuthDb = PgDatabase<PgQueryResultHKT, Record<string, unknown>>;
+export interface AuthUser {
+    /** OIDC `sub`; null only for the dev user. */
+    sub: string | null;
+    /** `preferred_username`. */
+    username: string;
+    via: "session" | "token" | "dev";
+    /** In the users, admins or agents group, as of the last check. */
+    member: boolean;
+    /** In the admins group. */
+    admin: boolean;
+}
+export interface AccessStatus {
+    signedIn: boolean;
+    username: string | null;
+    member: boolean;
+    admin: boolean;
+    /** Set while an access request is waiting. */
+    requestedAt: string | null;
+}
+export interface PendingRequestView {
+    sub: string;
+    username: string;
+    email: string | null;
+    name: string | null;
+    requestedAt: string;
+}
+export interface GroupNames {
+    users: string;
+    admins: string;
+    agents?: string | null;
+}
+export interface AuthentikSettings {
+    /** The provider's base URL; `/api/v3` is appended. Null: re-checks fail closed. */
+    apiUrl: string | null;
+    /** A token that may view users and the users group (membership re-checks). */
+    readerToken: string | null;
+    /** A token that may only add users to the users group (approvals). */
+    approverToken: string | null;
+    /** The users group's pk; looked up by name when null. */
+    usersGroupPk: string | null;
+    timeoutMs?: number;
+}
+export interface OidcClientSettings {
+    /** The provider's `.well-known/openid-configuration` URL. */
+    discoveryUrl: string;
+    clientId: string;
+    clientSecret: string;
+}
+export interface AppAuthConfig<TExtra extends object = Record<never, never>> {
+    /** Shown by Better Auth, e.g. "Starter". */
+    appName: string;
+    /** DNS-label slug: cookie prefix, logger prefix and placeholder emails derive from it. */
+    appSlug: string;
+    db: () => AuthDb;
+    /** Exact origins; [0] is Better Auth's baseURL. Also the CSRF allow-list. */
+    publicOrigins: string[];
+    /** Signs session cookies and OAuth state. */
+    betterAuthSecret: string | null;
+    /** Null turns browser sign-in off (dev and tests on devUser). */
+    oidc: OidcClientSettings | null;
+    providerId?: string;
+    basePath?: string;
+    scopes?: string[];
+    sessionMaxAgeSeconds?: number;
+    cookiePrefix?: string;
+    /** The header the ingress sets to the client address (Traefik's real-ip plugin). */
+    clientIpHeader?: string;
+    /** Client IDs accepted as `aud` on bearer tokens. Defaults to [oidc.clientId]. */
+    apiTokenAudiences?: string[];
+    authentik: AuthentikSettings;
+    groups: GroupNames;
+    /** The provider's anonymous auto-login identity. */
+    guestUsername?: string;
+    membershipMaxAgeMs?: number;
+    adminRecheckMaxAgeMs?: number;
+    /** "request": a non-member gets an access_requests row. "open": the provider adds people to the group. */
+    signup: "request" | "open";
+    /**
+     * A stand-in user (member and admin) for callers with no session or token,
+     * for local dev and tests. Ignored, with an ERROR log, whenever `oidc` is
+     * set. The app passes it only in development and test.
+     */
+    devUser?: string | null;
+    /** Extra per-user fields, looked up on every resolved request and once at sign-in. */
+    enrich?: (db: AuthDb, who: {
+        sub: string | null;
+        username: string;
+    }) => Promise<TExtra>;
+    /** GET paths that get the CSRF origin check (SSE streams). */
+    streamPaths?: string[];
+    metrics?: {
+        registry?: Registry;
+        prefix?: string;
+    };
+    /** Logger names are `<loggerPrefix>.auth` etc. Defaults to appSlug. */
+    loggerPrefix?: string;
+    /** Overrides the loggers entirely (tests). */
+    logger?: Logger;
+}
+export declare const DEFAULTS: {
+    readonly providerId: "authentik";
+    readonly basePath: "/api/auth";
+    readonly scopes: readonly ["openid", "profile", "email"];
+    /** ADR-0001: sessions have an absolute cap of 7 days. */
+    readonly sessionMaxAgeSeconds: number;
+    readonly clientIpHeader: "x-real-ip";
+    readonly guestUsername: "guest";
+    /** ADR-0001: membership is re-asked after 15 minutes. */
+    readonly membershipMaxAgeMs: number;
+    readonly adminRecheckMaxAgeMs: number;
+    readonly streamPaths: readonly ["/api/events"];
+    readonly metricsPrefix: "auth";
+    readonly authentikTimeoutMs: 5000;
+};

package/dist/config.js

@@ -0,0 +1,15 @@
+export const DEFAULTS = {
+    providerId: "authentik",
+    basePath: "/api/auth",
+    scopes: ["openid", "profile", "email"],
+    /** ADR-0001: sessions have an absolute cap of 7 days. */
+    sessionMaxAgeSeconds: 7 * 24 * 60 * 60,
+    clientIpHeader: "x-real-ip",
+    guestUsername: "guest",
+    /** ADR-0001: membership is re-asked after 15 minutes. */
+    membershipMaxAgeMs: 15 * 60 * 1000,
+    adminRecheckMaxAgeMs: 60 * 1000,
+    streamPaths: ["/api/events"],
+    metricsPrefix: "auth",
+    authentikTimeoutMs: 5_000,
+};

package/dist/csrf.d.ts

@@ -0,0 +1,7 @@
+/** True for requests the origin check applies to. */
+export declare function needsOriginCheck(request: Request, streamPaths?: readonly string[]): boolean;
+/**
+ * True when the request may proceed. `allowed` empty means the request URL's
+ * own origin (dev, tests).
+ */
+export declare function isSameOriginRequest(request: Request, allowed: string[], streamPaths?: string[]): boolean;

package/dist/csrf.js

@@ -0,0 +1,45 @@
+/**
+ * CSRF protection: an explicit check of where a request comes from, for
+ * server functions, cookie-authenticated server routes and SSE streams.
+ *
+ * A request is checked when it can change state (any method but GET, HEAD,
+ * OPTIONS) or opens a stream path. Sibling sites on one registrable domain
+ * share SameSite=Lax cookies, so SameSite alone does not stop them. A checked
+ * request passes when:
+ * - it carries a bearer token (no ambient credential; identity then comes
+ *   from the token only), or
+ * - the browser says `Sec-Fetch-Site: same-origin`, or
+ * - its `Origin` is one of the allowed origins exactly (scheme, host, port), or
+ * - it carries neither header nor a cookie (a non-browser client with nothing
+ *   ambient to abuse).
+ * Everything else is refused, including `Origin: null`.
+ */
+import { bearerToken } from "@viktorbarzin/oidc-token";
+import { DEFAULTS } from "./config.js";
+const SAFE_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
+/** True for requests the origin check applies to. */
+export function needsOriginCheck(request, streamPaths = DEFAULTS.streamPaths) {
+    if (!SAFE_METHODS.has(request.method.toUpperCase()))
+        return true;
+    return streamPaths.includes(new URL(request.url).pathname);
+}
+/**
+ * True when the request may proceed. `allowed` empty means the request URL's
+ * own origin (dev, tests).
+ */
+export function isSameOriginRequest(request, allowed, streamPaths) {
+    if (!needsOriginCheck(request, streamPaths))
+        return true;
+    if (bearerToken(request) !== null)
+        return true;
+    const headers = request.headers;
+    const fetchSite = headers.get("sec-fetch-site");
+    if (fetchSite !== null)
+        return fetchSite === "same-origin";
+    const origin = headers.get("origin");
+    if (origin !== null) {
+        const origins = allowed.length > 0 ? allowed : [new URL(request.url).origin];
+        return origins.includes(origin);
+    }
+    return headers.get("cookie") === null;
+}

package/dist/index.d.ts

@@ -0,0 +1,8 @@
+export { type AppAuth, type BetterAuthInstance, createAppAuth, DISABLED_PATHS, } from "./app-auth.js";
+export { type AuthentikClient, AuthentikNotConfigured, AuthentikUnavailable, type AuthentikUser, createAuthentikClient, } from "./authentik.js";
+export type { AccessStatus, AppAuthConfig, AuthDb, AuthentikSettings, AuthUser, GroupNames, OidcClientSettings, PendingRequestView, } from "./config.js";
+export { DEFAULTS } from "./config.js";
+export { isSameOriginRequest, needsOriginCheck } from "./csrf.js";
+export { type Membership, type MembershipOptions, membershipFromGroups, } from "./membership.js";
+export { type AuthMetrics, authMetrics } from "./metrics.js";
+export { safeReturnPath } from "./return-path.js";

package/dist/index.js

@@ -0,0 +1,7 @@
+export { createAppAuth, DISABLED_PATHS, } from "./app-auth.js";
+export { AuthentikNotConfigured, AuthentikUnavailable, createAuthentikClient, } from "./authentik.js";
+export { DEFAULTS } from "./config.js";
+export { isSameOriginRequest, needsOriginCheck } from "./csrf.js";
+export { membershipFromGroups, } from "./membership.js";
+export { authMetrics } from "./metrics.js";
+export { safeReturnPath } from "./return-path.js";

package/dist/membership.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Membership: may this subject use the app, and administer it?
+ *
+ * Each request re-checks group membership with the provider once the stored
+ * answer is older than 15 minutes, so removing someone takes effect within
+ * that window. Web sign-in requests no `offline_access`, so the provider
+ * issues no refresh token; this re-check is the app's "refresh".
+ *
+ * The first answer comes from the verified id_token's `groups` claim at
+ * sign-in (or a bearer token's), so a fresh sign-in needs no API call.
+ *
+ * Failure direction: when the provider cannot answer (network error, any
+ * status but 200), the last answer stands. Only an answer the provider gave
+ * can remove access; with no earlier answer the subject is not a member. A
+ * missing API URL or reader token is different: the app could never
+ * re-check, so that case fails closed and logs an ERROR on every re-check.
+ */
+import type { Logger } from "@viktorbarzin/log";
+import { type AuthentikClient } from "./authentik.js";
+import type { AuthDb, GroupNames } from "./config.js";
+import type { AuthMetrics } from "./metrics.js";
+import { type AccessRequest, type MemberCheck } from "./schema.js";
+export interface Membership {
+    member: boolean;
+    admin: boolean;
+}
+/** Members are in the users, admins or agents group; admins are in the admins group. */
+export declare function membershipFromGroups(groups: readonly string[], cfg: GroupNames): Membership;
+export declare function readMemberCheck(db: AuthDb, sub: string): Promise<MemberCheck | null>;
+export declare function saveMemberCheck(db: AuthDb, sub: string, username: string, membership: Membership, source: "id_token" | "token" | "api", checkedAt?: Date): Promise<void>;
+/**
+ * Record an answer that came with a verified token (`groups` claim). A token
+ * without the claim says nothing about membership and changes nothing.
+ */
+export declare function recordClaimedGroups(db: AuthDb, sub: string, username: string, groups: unknown, source: "id_token" | "token", cfg: GroupNames): Promise<void>;
+export interface MembershipOptions {
+    /** Re-ask when the stored answer is older than this. 0 forces a fresh answer. */
+    maxAgeMs?: number;
+    now?: () => number;
+}
+export interface MembershipChecker {
+    current(db: AuthDb, sub: string, username: string, opts?: MembershipOptions): Promise<Membership>;
+}
+export declare function createMembershipChecker(deps: {
+    authentik: () => AuthentikClient;
+    groups: () => GroupNames;
+    defaultMaxAgeMs: () => number;
+    metrics: () => AuthMetrics;
+    log: Logger;
+}): MembershipChecker;
+export interface RequestDetails {
+    sub: string;
+    username: string;
+    email: string | null;
+    name: string | null;
+}
+/** File (or refresh) a pending request. An approved request is left alone. */
+export declare function fileAccessRequest(db: AuthDb, details: RequestDetails): Promise<void>;
+export declare function getAccessRequest(db: AuthDb, sub: string): Promise<AccessRequest | null>;

package/dist/membership.js

@@ -0,0 +1,118 @@
+import { eq } from "drizzle-orm";
+import { AuthentikNotConfigured, AuthentikUnavailable, } from "./authentik.js";
+import { accessRequests, memberChecks, } from "./schema.js";
+/** Members are in the users, admins or agents group; admins are in the admins group. */
+export function membershipFromGroups(groups, cfg) {
+    const set = new Set(groups);
+    const admin = set.has(cfg.admins);
+    const agent = cfg.agents ? set.has(cfg.agents) : false;
+    return { member: admin || agent || set.has(cfg.users), admin };
+}
+export async function readMemberCheck(db, sub) {
+    const rows = await db
+        .select()
+        .from(memberChecks)
+        .where(eq(memberChecks.sub, sub))
+        .limit(1);
+    return rows[0] ?? null;
+}
+export async function saveMemberCheck(db, sub, username, membership, source, checkedAt = new Date()) {
+    await db
+        .insert(memberChecks)
+        .values({ sub, username, ...membership, source, checkedAt })
+        .onConflictDoUpdate({
+        target: memberChecks.sub,
+        set: { username, ...membership, source, checkedAt },
+    });
+}
+/**
+ * Record an answer that came with a verified token (`groups` claim). A token
+ * without the claim says nothing about membership and changes nothing.
+ */
+export async function recordClaimedGroups(db, sub, username, groups, source, cfg) {
+    if (!Array.isArray(groups))
+        return;
+    const names = groups.filter((g) => typeof g === "string");
+    await saveMemberCheck(db, sub, username, membershipFromGroups(names, cfg), source);
+}
+export function createMembershipChecker(deps) {
+    const inFlight = new Map();
+    async function recheck(db, sub, username, last) {
+        try {
+            const user = await deps.authentik().findUser(sub, username);
+            const answer = user?.isActive === true
+                ? membershipFromGroups(user.groups, deps.groups())
+                : { member: false, admin: false };
+            deps.metrics().membershipChecks.inc({
+                outcome: answer.member ? "member" : "removed",
+            });
+            if (last?.member && !answer.member)
+                deps.log.info("membership: no longer a member", {
+                    sub,
+                    user: username,
+                });
+            await saveMemberCheck(db, sub, username, answer, "api");
+            return answer;
+        }
+        catch (err) {
+            if (err instanceof AuthentikNotConfigured) {
+                deps.metrics().membershipChecks.inc({ outcome: "misconfigured" });
+                deps.log.error("membership: cannot re-check, access refused", {
+                    sub,
+                    user: username,
+                    error: err.message,
+                });
+                return { member: false, admin: false };
+            }
+            if (!(err instanceof AuthentikUnavailable))
+                throw err;
+            deps.metrics().membershipChecks.inc({ outcome: "unreachable" });
+            deps.log.warning("membership: cannot check, the last answer stands", {
+                sub,
+                user: username,
+                error: err.message,
+            });
+            return last
+                ? { member: last.member, admin: last.admin }
+                : { member: false, admin: false };
+        }
+    }
+    return {
+        async current(db, sub, username, opts = {}) {
+            const maxAge = opts.maxAgeMs ?? deps.defaultMaxAgeMs();
+            const now = opts.now ?? Date.now;
+            const last = await readMemberCheck(db, sub);
+            if (last && maxAge > 0 && now() - last.checkedAt.getTime() < maxAge) {
+                return { member: last.member, admin: last.admin };
+            }
+            const pending = inFlight.get(sub);
+            if (pending)
+                return pending;
+            const started = recheck(db, sub, username, last).finally(() => inFlight.delete(sub));
+            inFlight.set(sub, started);
+            return started;
+        },
+    };
+}
+/** File (or refresh) a pending request. An approved request is left alone. */
+export async function fileAccessRequest(db, details) {
+    await db
+        .insert(accessRequests)
+        .values({ ...details, status: "pending" })
+        .onConflictDoUpdate({
+        target: accessRequests.sub,
+        set: {
+            username: details.username,
+            email: details.email,
+            name: details.name,
+        },
+    });
+}
+export async function getAccessRequest(db, sub) {
+    const rows = await db
+        .select()
+        .from(accessRequests)
+        .where(eq(accessRequests.sub, sub))
+        .limit(1);
+    return rows[0] ?? null;
+}

package/dist/metrics.d.ts

@@ -0,0 +1,14 @@
+import { type Counter, type Registry } from "prom-client";
+export interface AuthMetrics {
+    /** Re-checks: member, removed, unreachable (last answer stood), misconfigured (refused). */
+    membershipChecks: Counter<"outcome">;
+    /** Bearer-token verifications: ok, or why one was refused. */
+    tokenVerifications: Counter<"outcome">;
+    csrfRejections: Counter<string>;
+    /** Sign-ins: member, pending, or guest (sent back with prompt=login). */
+    signIns: Counter<"outcome">;
+}
+export declare function authMetrics(opts?: {
+    registry?: Registry;
+    prefix?: string;
+}): AuthMetrics;

package/dist/metrics.js

@@ -0,0 +1,19 @@
+/** Identity metrics, registered once per registry and prefix. */
+import { getRegistry } from "@viktorbarzin/metrics";
+import client, {} from "prom-client";
+function counter(registry, name, help, labelNames) {
+    const existing = registry.getSingleMetric(name);
+    if (existing)
+        return existing;
+    return new client.Counter({ name, help, labelNames, registers: [registry] });
+}
+export function authMetrics(opts = {}) {
+    const registry = opts.registry ?? getRegistry();
+    const p = opts.prefix ?? "auth";
+    return {
+        membershipChecks: counter(registry, `${p}_membership_checks_total`, "Membership re-checks against the identity provider by outcome.", ["outcome"]),
+        tokenVerifications: counter(registry, `${p}_api_token_verifications_total`, "Bearer-token verifications by outcome.", ["outcome"]),
+        csrfRejections: counter(registry, `${p}_csrf_rejections_total`, "Requests refused by the CSRF origin check.", []),
+        signIns: counter(registry, `${p}_sign_ins_total`, "OIDC sign-ins completed by outcome.", ["outcome"]),
+    };
+}

package/dist/return-path.d.ts

@@ -0,0 +1,16 @@
+/** Where to send a browser after sign-in: same-origin paths only. */
+/**
+ * A relative path inside the app to return to after sign-in, or "/".
+ * Refuses absolute and protocol-relative URLs (no open redirect). The check
+ * runs on the normalised result too: dot segments collapse, so `/.//evil`
+ * normalises to `//evil`.
+ */
+export declare function safeReturnPath(raw: string | null | undefined): string;
+/** Marks a sign-in that already asked the provider for `prompt=login`. */
+export declare const LOGIN_PARAM = "login";
+export declare function signInPaths(basePath: string): {
+    start: string;
+    finish: string;
+    error: string;
+};
+export declare function pathWithReturn(path: string, returnTo: string, login: boolean): string;

package/dist/return-path.js

@@ -0,0 +1,40 @@
+/** Where to send a browser after sign-in: same-origin paths only. */
+/** True for a value a browser would resolve against another host. */
+function leavesOrigin(path) {
+    return path.startsWith("//") || path.startsWith("/\\");
+}
+/**
+ * A relative path inside the app to return to after sign-in, or "/".
+ * Refuses absolute and protocol-relative URLs (no open redirect). The check
+ * runs on the normalised result too: dot segments collapse, so `/.//evil`
+ * normalises to `//evil`.
+ */
+export function safeReturnPath(raw) {
+    if (!raw || !raw.startsWith("/") || leavesOrigin(raw))
+        return "/";
+    try {
+        const url = new URL(raw, "http://app.invalid");
+        if (url.origin !== "http://app.invalid")
+            return "/";
+        const path = `${url.pathname}${url.search}`;
+        return leavesOrigin(path) ? "/" : path;
+    }
+    catch {
+        return "/";
+    }
+}
+/** Marks a sign-in that already asked the provider for `prompt=login`. */
+export const LOGIN_PARAM = "login";
+export function signInPaths(basePath) {
+    return {
+        start: `${basePath}/start`,
+        finish: `${basePath}/finish`,
+        error: `${basePath}/error`,
+    };
+}
+export function pathWithReturn(path, returnTo, login) {
+    const query = new URLSearchParams({ return: safeReturnPath(returnTo) });
+    if (login)
+        query.set(LOGIN_PARAM, "1");
+    return `${path}?${query}`;
+}