@vorionsys/platform-core 0.1.0

package/dist/security/api-keys/middleware.js

@@ -0,0 +1,392 @@
+/**
+ * API Key Middleware for Fastify
+ *
+ * Provides Fastify middleware for API key authentication:
+ * - Extract API key from Authorization header (Bearer) or X-API-Key header
+ * - Validate and attach key context to request
+ * - Scope enforcement decorator
+ * - Rate limit enforcement
+ *
+ * @packageDocumentation
+ */
+import fp from 'fastify-plugin';
+import { createLogger } from '../../common/logger.js';
+import { Counter, Histogram } from 'prom-client';
+import { vorionRegistry } from '../../common/metrics-registry.js';
+import { ApiKeyValidationErrorCode, } from './types.js';
+import { getApiKeyService, createApiKeyService, } from './service.js';
+const logger = createLogger({ component: 'api-key-middleware' });
+// =============================================================================
+// METRICS
+// =============================================================================
+const apiKeyValidations = new Counter({
+    name: 'vorion_api_key_validations_total',
+    help: 'Total API key validation attempts',
+    labelNames: ['result'],
+    registers: [vorionRegistry],
+});
+const apiKeyRateLimits = new Counter({
+    name: 'vorion_api_key_rate_limits_total',
+    help: 'Total API key rate limit hits',
+    labelNames: ['exceeded'],
+    registers: [vorionRegistry],
+});
+const apiKeyValidationDuration = new Histogram({
+    name: 'vorion_api_key_validation_duration_seconds',
+    help: 'Duration of API key validation',
+    buckets: [0.001, 0.005, 0.01, 0.025, 0.05, 0.1],
+    registers: [vorionRegistry],
+});
+// =============================================================================
+// KEY EXTRACTION
+// =============================================================================
+/**
+ * Extract API key from request headers
+ *
+ * Checks:
+ * 1. X-API-Key header (or custom header)
+ * 2. Authorization: Bearer header (if enabled)
+ *
+ * @param request - Fastify request
+ * @param options - Middleware options
+ * @returns API key string or null
+ */
+function extractApiKey(request, options) {
+    const headerName = options.headerName ?? 'x-api-key';
+    // Check custom header first
+    const customHeader = request.headers[headerName.toLowerCase()];
+    if (customHeader) {
+        return Array.isArray(customHeader) ? customHeader[0] ?? null : customHeader;
+    }
+    // Check Authorization: Bearer header
+    if (options.checkBearerHeader !== false) {
+        const authHeader = request.headers.authorization;
+        if (authHeader?.startsWith('Bearer vak_')) {
+            return authHeader.substring(7);
+        }
+    }
+    return null;
+}
+/**
+ * Get client IP address from request
+ */
+function getClientIp(request) {
+    // Check common proxy headers
+    const forwarded = request.headers['x-forwarded-for'];
+    if (forwarded) {
+        const firstIp = (Array.isArray(forwarded) ? forwarded[0] : forwarded)?.split(',')[0];
+        return firstIp?.trim();
+    }
+    const realIp = request.headers['x-real-ip'];
+    if (realIp) {
+        return Array.isArray(realIp) ? realIp[0] : realIp;
+    }
+    return request.ip;
+}
+// =============================================================================
+// MIDDLEWARE FACTORY
+// =============================================================================
+/**
+ * Create API key authentication middleware
+ *
+ * Validates API keys and attaches context to requests.
+ *
+ * @param options - Middleware options
+ * @returns Fastify preHandler hook
+ *
+ * @example
+ * ```typescript
+ * // Apply to all routes
+ * fastify.addHook('preHandler', apiKeyMiddleware({
+ *   skipPaths: ['/health', '/docs'],
+ *   enforceRateLimit: true,
+ * }));
+ *
+ * // Or apply to specific routes
+ * fastify.route({
+ *   method: 'GET',
+ *   url: '/api/data',
+ *   preHandler: [apiKeyMiddleware()],
+ *   handler: handleData,
+ * });
+ * ```
+ */
+export function apiKeyMiddleware(options = {}) {
+    const service = options.service ?? getApiKeyService();
+    const skipPaths = new Set(options.skipPaths ?? []);
+    const enforceRateLimit = options.enforceRateLimit ?? true;
+    return async (request, reply) => {
+        // Check skip conditions
+        if (skipPaths.has(request.url) || skipPaths.has(request.routeOptions.url ?? '')) {
+            return;
+        }
+        if (options.skip?.(request)) {
+            return;
+        }
+        const startTime = Date.now();
+        try {
+            // Extract API key
+            const rawKey = extractApiKey(request, options);
+            if (!rawKey) {
+                apiKeyValidations.inc({ result: 'missing' });
+                return reply.status(401).send({
+                    error: {
+                        code: 'API_KEY_REQUIRED',
+                        message: 'API key is required',
+                        hint: 'Provide API key via X-API-Key header or Authorization: Bearer header',
+                    },
+                });
+            }
+            // Get client IP for whitelist validation
+            const clientIp = getClientIp(request);
+            // Validate key
+            const validationResult = await service.validate(rawKey, clientIp);
+            const duration = (Date.now() - startTime) / 1000;
+            apiKeyValidationDuration.observe(duration);
+            if (!validationResult.valid) {
+                apiKeyValidations.inc({ result: validationResult.errorCode ?? 'invalid' });
+                const statusCode = getStatusCodeForError(validationResult.errorCode);
+                return reply.status(statusCode).send({
+                    error: {
+                        code: validationResult.errorCode ?? 'API_KEY_INVALID',
+                        message: validationResult.error ?? 'Invalid API key',
+                    },
+                });
+            }
+            const apiKey = validationResult.apiKey;
+            // Check rate limit if enabled
+            let rateLimitState;
+            if (enforceRateLimit) {
+                rateLimitState = await service.checkRateLimit(apiKey);
+                // Set rate limit headers
+                setRateLimitHeaders(reply, rateLimitState, apiKey.rateLimit);
+                if (!rateLimitState.allowed) {
+                    apiKeyValidations.inc({ result: 'rate_limited' });
+                    apiKeyRateLimits.inc({ exceeded: 'true' });
+                    return reply.status(429).send({
+                        error: {
+                            code: 'RATE_LIMIT_EXCEEDED',
+                            message: 'API key rate limit exceeded',
+                            retryAfter: rateLimitState.retryAfter,
+                        },
+                    });
+                }
+                apiKeyRateLimits.inc({ exceeded: 'false' });
+            }
+            // Attach context to request
+            request.apiKeyContext = {
+                apiKey,
+                rateLimitState: rateLimitState ?? {
+                    allowed: true,
+                    remaining: { minute: -1, hour: -1, burst: -1 },
+                    resetAt: { minute: 0, hour: 0, burst: 0 },
+                },
+                validatedAt: new Date(),
+            };
+            apiKeyValidations.inc({ result: 'success' });
+            logger.debug({
+                keyId: apiKey.id,
+                prefix: apiKey.prefix,
+                tenantId: apiKey.tenantId,
+                duration,
+            }, 'API key validated');
+        }
+        catch (error) {
+            apiKeyValidations.inc({ result: 'error' });
+            logger.error({ error }, 'API key middleware error');
+            return reply.status(500).send({
+                error: {
+                    code: 'API_KEY_VALIDATION_ERROR',
+                    message: 'Failed to validate API key',
+                },
+            });
+        }
+    };
+}
+/**
+ * Get HTTP status code for validation error
+ */
+function getStatusCodeForError(errorCode) {
+    switch (errorCode) {
+        case ApiKeyValidationErrorCode.NOT_FOUND:
+        case ApiKeyValidationErrorCode.HASH_MISMATCH:
+        case ApiKeyValidationErrorCode.INVALID_FORMAT:
+            return 401;
+        case ApiKeyValidationErrorCode.REVOKED:
+        case ApiKeyValidationErrorCode.EXPIRED:
+        case ApiKeyValidationErrorCode.IP_NOT_ALLOWED:
+        case ApiKeyValidationErrorCode.INSUFFICIENT_SCOPE:
+            return 403;
+        case ApiKeyValidationErrorCode.RATE_LIMITED:
+            return 429;
+        default:
+            return 401;
+    }
+}
+/**
+ * Set rate limit response headers
+ */
+function setRateLimitHeaders(reply, state, limits) {
+    reply.header('X-RateLimit-Limit-Minute', limits.requestsPerMinute);
+    reply.header('X-RateLimit-Remaining-Minute', state.remaining.minute);
+    reply.header('X-RateLimit-Reset-Minute', Math.ceil(state.resetAt.minute / 1000));
+    reply.header('X-RateLimit-Limit-Hour', limits.requestsPerHour);
+    reply.header('X-RateLimit-Remaining-Hour', state.remaining.hour);
+    reply.header('X-RateLimit-Reset-Hour', Math.ceil(state.resetAt.hour / 1000));
+    if (state.retryAfter !== undefined) {
+        reply.header('Retry-After', state.retryAfter);
+    }
+}
+// =============================================================================
+// SCOPE ENFORCEMENT
+// =============================================================================
+/**
+ * Create scope requirement middleware
+ *
+ * Requires one or more API key scopes.
+ *
+ * @param requiredScopes - Required scope(s)
+ * @param options - Scope requirement options
+ * @returns Fastify preHandler hook
+ *
+ * @example
+ * ```typescript
+ * // Require write scope
+ * fastify.route({
+ *   method: 'POST',
+ *   url: '/api/data',
+ *   preHandler: [apiKeyMiddleware(), requireScopes(['write'])],
+ *   handler: handleCreate,
+ * });
+ *
+ * // Require admin OR write scope
+ * fastify.route({
+ *   method: 'DELETE',
+ *   url: '/api/data/:id',
+ *   preHandler: [apiKeyMiddleware(), requireScopes(['admin', 'write'], { requireAll: false })],
+ *   handler: handleDelete,
+ * });
+ * ```
+ */
+export function requireScopes(requiredScopes, options = {}) {
+    const requireAll = options.requireAll ?? true;
+    return async (request, reply) => {
+        const context = request.apiKeyContext;
+        if (!context) {
+            return reply.status(401).send({
+                error: {
+                    code: 'API_KEY_REQUIRED',
+                    message: 'API key authentication required',
+                },
+            });
+        }
+        const apiKey = context.apiKey;
+        const hasRequiredScopes = requireAll
+            ? requiredScopes.every((scope) => apiKey.scopes.includes(scope))
+            : requiredScopes.some((scope) => apiKey.scopes.includes(scope));
+        if (!hasRequiredScopes) {
+            logger.warn({
+                keyId: apiKey.id,
+                prefix: apiKey.prefix,
+                requiredScopes,
+                actualScopes: apiKey.scopes,
+                requireAll,
+            }, 'Insufficient API key scope');
+            return reply.status(403).send({
+                error: {
+                    code: 'INSUFFICIENT_SCOPE',
+                    message: `API key requires ${requireAll ? 'all' : 'one'} of these scopes: ${requiredScopes.join(', ')}`,
+                    requiredScopes,
+                    actualScopes: apiKey.scopes,
+                },
+            });
+        }
+    };
+}
+/**
+ * Require read scope
+ */
+export function requireReadScope() {
+    return requireScopes(['read']);
+}
+/**
+ * Require write scope
+ */
+export function requireWriteScope() {
+    return requireScopes(['write']);
+}
+/**
+ * Require admin scope
+ */
+export function requireAdminScope() {
+    return requireScopes(['admin']);
+}
+/**
+ * Require webhook scope
+ */
+export function requireWebhookScope() {
+    return requireScopes(['webhook']);
+}
+/**
+ * Require integration scope
+ */
+export function requireIntegrationScope() {
+    return requireScopes(['integration']);
+}
+/**
+ * Fastify plugin for API key authentication
+ *
+ * @example
+ * ```typescript
+ * await fastify.register(apiKeyPlugin, {
+ *   skipPaths: ['/health', '/docs'],
+ *   enforceRateLimit: true,
+ *   global: true,
+ * });
+ * ```
+ */
+export const apiKeyPlugin = fp(async (fastify, options) => {
+    const service = options.service ?? createApiKeyService();
+    // Decorate fastify with service
+    fastify.decorate('apiKeyService', service);
+    // Register global middleware if requested
+    if (options.global) {
+        fastify.addHook('preHandler', apiKeyMiddleware({ ...options, service }));
+    }
+    logger.info({
+        global: options.global,
+        skipPaths: options.skipPaths?.length ?? 0,
+        enforceRateLimit: options.enforceRateLimit ?? true,
+    }, 'API key plugin registered');
+}, {
+    name: 'vorion-api-key',
+    fastify: '5.x',
+});
+// =============================================================================
+// UTILITY FUNCTIONS
+// =============================================================================
+/**
+ * Get API key from request context
+ */
+export function getApiKey(request) {
+    return request.apiKeyContext?.apiKey;
+}
+/**
+ * Get tenant ID from API key context
+ */
+export function getApiKeyTenantId(request) {
+    return request.apiKeyContext?.apiKey.tenantId;
+}
+/**
+ * Check if request has a valid API key
+ */
+export function hasApiKey(request) {
+    return request.apiKeyContext !== undefined;
+}
+/**
+ * Get API key scopes
+ */
+export function getApiKeyScopes(request) {
+    return request.apiKeyContext?.apiKey.scopes ?? [];
+}
+//# sourceMappingURL=middleware.js.map

package/dist/security/api-keys/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../../src/security/api-keys/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAQH,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,EAKL,yBAAyB,GAC1B,MAAM,YAAY,CAAC;AACpB,OAAO,EAGL,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,cAAc,CAAC;AAEtB,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,oBAAoB,EAAE,CAAC,CAAC;AAEjE,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF,MAAM,iBAAiB,GAAG,IAAI,OAAO,CAAC;IACpC,IAAI,EAAE,kCAAkC;IACxC,IAAI,EAAE,mCAAmC;IACzC,UAAU,EAAE,CAAC,QAAQ,CAAU;IAC/B,SAAS,EAAE,CAAC,cAAc,CAAC;CAC5B,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,IAAI,OAAO,CAAC;IACnC,IAAI,EAAE,kCAAkC;IACxC,IAAI,EAAE,+BAA+B;IACrC,UAAU,EAAE,CAAC,UAAU,CAAU;IACjC,SAAS,EAAE,CAAC,cAAc,CAAC;CAC5B,CAAC,CAAC;AAEH,MAAM,wBAAwB,GAAG,IAAI,SAAS,CAAC;IAC7C,IAAI,EAAE,4CAA4C;IAClD,IAAI,EAAE,gCAAgC;IACtC,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC;IAC/C,SAAS,EAAE,CAAC,cAAc,CAAC;CAC5B,CAAC,CAAC;AAqDH,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF;;;;;;;;;;GAUG;AACH,SAAS,aAAa,CACpB,OAAuB,EACvB,OAAgC;IAEhC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,WAAW,CAAC;IAErD,4BAA4B;IAC5B,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/D,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC;IAC9E,CAAC;IAED,qCAAqC;IACrC,IAAI,OAAO,CAAC,iBAAiB,KAAK,KAAK,EAAE,CAAC;QACxC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QACjD,IAAI,UAAU,EAAE,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YAC1C,OAAO,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,OAAuB;IAC1C,6BAA6B;IAC7B,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACrD,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACrF,OAAO,OAAO,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC5C,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACpD,CAAC;IAED,OAAO,OAAO,CAAC,EAAE,CAAC;AACpB,CAAC;AAED,gFAAgF;AAChF,qBAAqB;AACrB,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAAmC,EAAE;IACpE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,gBAAgB,EAAE,CAAC;IACtD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IACnD,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,IAAI,CAAC;IAE1D,OAAO,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAiB,EAAE;QAC3E,wBAAwB;QACxB,IAAI,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC;YAChF,OAAO;QACT,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,IAAI,CAAC;YACH,kBAAkB;YAClB,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,iBAAiB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;gBAC7C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBAC5B,KAAK,EAAE;wBACL,IAAI,EAAE,kBAAkB;wBACxB,OAAO,EAAE,qBAAqB;wBAC9B,IAAI,EAAE,sEAAsE;qBAC7E;iBACF,CAAC,CAAC;YACL,CAAC;YAED,yCAAyC;YACzC,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;YAEtC,eAAe;YACf,MAAM,gBAAgB,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAElE,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC;YACjD,wBAAwB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAE3C,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;gBAC5B,iBAAiB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,gBAAgB,CAAC,SAAS,IAAI,SAAS,EAAE,CAAC,CAAC;gBAE3E,MAAM,UAAU,GAAG,qBAAqB,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;gBAErE,OAAO,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC;oBACnC,KAAK,EAAE;wBACL,IAAI,EAAE,gBAAgB,CAAC,SAAS,IAAI,iBAAiB;wBACrD,OAAO,EAAE,gBAAgB,CAAC,KAAK,IAAI,iBAAiB;qBACrD;iBACF,CAAC,CAAC;YACL,CAAC;YAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAO,CAAC;YAExC,8BAA8B;YAC9B,IAAI,cAAiD,CAAC;YACtD,IAAI,gBAAgB,EAAE,CAAC;gBACrB,cAAc,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;gBAEtD,yBAAyB;gBACzB,mBAAmB,CAAC,KAAK,EAAE,cAAc,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;gBAE7D,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;oBAC5B,iBAAiB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;oBAClD,gBAAgB,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;oBAE3C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;wBAC5B,KAAK,EAAE;4BACL,IAAI,EAAE,qBAAqB;4BAC3B,OAAO,EAAE,6BAA6B;4BACtC,UAAU,EAAE,cAAc,CAAC,UAAU;yBACtC;qBACF,CAAC,CAAC;gBACL,CAAC;gBAED,gBAAgB,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;YAC9C,CAAC;YAED,4BAA4B;YAC5B,OAAO,CAAC,aAAa,GAAG;gBACtB,MAAM;gBACN,cAAc,EAAE,cAAc,IAAI;oBAChC,OAAO,EAAE,IAAI;oBACb,SAAS,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE;oBAC9C,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE;iBAC1C;gBACD,WAAW,EAAE,IAAI,IAAI,EAAE;aACxB,CAAC;YAEF,iBAAiB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YAE7C,MAAM,CAAC,KAAK,CACV;gBACE,KAAK,EAAE,MAAM,CAAC,EAAE;gBAChB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,QAAQ;aACT,EACD,mBAAmB,CACpB,CAAC;QAEJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,iBAAiB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;YAC3C,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,0BAA0B,CAAC,CAAC;YAEpD,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE;oBACL,IAAI,EAAE,0BAA0B;oBAChC,OAAO,EAAE,4BAA4B;iBACtC;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,qBAAqB,CAAC,SAAqC;IAClE,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,yBAAyB,CAAC,SAAS,CAAC;QACzC,KAAK,yBAAyB,CAAC,aAAa,CAAC;QAC7C,KAAK,yBAAyB,CAAC,cAAc;YAC3C,OAAO,GAAG,CAAC;QACb,KAAK,yBAAyB,CAAC,OAAO,CAAC;QACvC,KAAK,yBAAyB,CAAC,OAAO,CAAC;QACvC,KAAK,yBAAyB,CAAC,cAAc,CAAC;QAC9C,KAAK,yBAAyB,CAAC,kBAAkB;YAC/C,OAAO,GAAG,CAAC;QACb,KAAK,yBAAyB,CAAC,YAAY;YACzC,OAAO,GAAG,CAAC;QACb;YACE,OAAO,GAAG,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAC1B,KAAmB,EACnB,KAA4B,EAC5B,MAAkF;IAElF,KAAK,CAAC,MAAM,CAAC,0BAA0B,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACnE,KAAK,CAAC,MAAM,CAAC,8BAA8B,EAAE,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACrE,KAAK,CAAC,MAAM,CAAC,0BAA0B,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC;IACjF,KAAK,CAAC,MAAM,CAAC,wBAAwB,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;IAC/D,KAAK,CAAC,MAAM,CAAC,4BAA4B,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACjE,KAAK,CAAC,MAAM,CAAC,wBAAwB,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC;IAE7E,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACnC,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,oBAAoB;AACpB,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,aAAa,CAC3B,cAA6B,EAC7B,UAAmC,EAAE;IAErC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC;IAE9C,OAAO,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAiB,EAAE;QAC3E,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC;QAEtC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE;oBACL,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EAAE,iCAAiC;iBAC3C;aACF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,MAAM,iBAAiB,GAAG,UAAU;YAClC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAChE,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAElE,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CACT;gBACE,KAAK,EAAE,MAAM,CAAC,EAAE;gBAChB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,cAAc;gBACd,YAAY,EAAE,MAAM,CAAC,MAAM;gBAC3B,UAAU;aACX,EACD,4BAA4B,CAC7B,CAAC;YAEF,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE;oBACL,IAAI,EAAE,oBAAoB;oBAC1B,OAAO,EAAE,oBAAoB,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,qBAAqB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;oBACvG,cAAc;oBACd,YAAY,EAAE,MAAM,CAAC,MAAM;iBAC5B;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AACjC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,aAAa,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;AAClC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,aAAa,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;AAClC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,aAAa,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;AACpC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB;IACrC,OAAO,aAAa,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;AACxC,CAAC;AAcD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,EAAE,CAC5B,KAAK,EAAE,OAAwB,EAAE,OAA4B,EAAE,EAAE;IAC/D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,mBAAmB,EAAE,CAAC;IAEzD,gCAAgC;IAChC,OAAO,CAAC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IAE3C,0CAA0C;IAC1C,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,gBAAgB,CAAC,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,CAAC,IAAI,CACT;QACE,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,MAAM,IAAI,CAAC;QACzC,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,IAAI;KACnD,EACD,2BAA2B,CAC5B,CAAC;AACJ,CAAC,EACD;IACE,IAAI,EAAE,gBAAgB;IACtB,OAAO,EAAE,KAAK;CACf,CACF,CAAC;AAEF,gFAAgF;AAChF,oBAAoB;AACpB,gFAAgF;AAEhF;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,OAAuB;IAC/C,OAAO,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC;AACvC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAuB;IACvD,OAAO,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC;AAChD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,OAAuB;IAC/C,OAAO,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC;AAC7C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,OAAuB;IACrD,OAAO,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;AACpD,CAAC"}

package/dist/security/api-keys/service.d.ts

@@ -0,0 +1,226 @@
+/**
+ * API Key Management Service
+ *
+ * Core service for API key lifecycle management including:
+ * - Cryptographically secure key generation
+ * - Secure key storage (hashed only)
+ * - Key validation with timing-safe comparison
+ * - Scope checking
+ * - Rate limit tracking per key
+ * - Key rotation
+ * - Expiration checking
+ * - Audit logging integration
+ *
+ * Security Design:
+ * - Raw API keys are NEVER stored or logged
+ * - Keys are hashed using SHA-256 before storage
+ * - Validation uses timing-safe comparison
+ * - Key format: vak_${prefix}_${secret}
+ *
+ * @packageDocumentation
+ */
+import { VorionError } from '../../common/errors.js';
+import { type ApiKey, type ApiKeyScope, type CreateApiKeyInput, type UpdateApiKeyInput, type ApiKeyValidationResult, type ApiKeyCreationResult, type ApiKeyListFilters, type ApiKeyRateLimitResult, ApiKeyValidationErrorCode } from './types.js';
+import { type IApiKeyStore } from './store.js';
+import { type ApiKeyMetadataCache } from './cache.js';
+import { SecurityAuditLogger } from '../../audit/security-logger.js';
+/**
+ * Base error class for API key operations
+ */
+export declare class ApiKeyError extends VorionError {
+    code: string;
+    statusCode: number;
+    constructor(message: string, details?: Record<string, unknown>);
+}
+/**
+ * Error thrown when API key validation fails
+ */
+export declare class ApiKeyValidationError extends ApiKeyError {
+    readonly errorCode: ApiKeyValidationErrorCode;
+    code: string;
+    statusCode: number;
+    constructor(message: string, errorCode: ApiKeyValidationErrorCode, details?: Record<string, unknown>);
+}
+/**
+ * Error thrown when rate limit is exceeded
+ */
+export declare class ApiKeyRateLimitError extends ApiKeyError {
+    readonly retryAfter: number;
+    code: string;
+    statusCode: number;
+    constructor(message: string, retryAfter: number, details?: Record<string, unknown>);
+}
+/**
+ * Audit logging interface (legacy - use SecurityAuditLogger for new code)
+ */
+export interface IAuditLogger {
+    record(input: {
+        tenantId: string;
+        eventType: string;
+        actor: {
+            type: 'user' | 'agent' | 'service' | 'system';
+            id: string;
+            name?: string;
+        };
+        target: {
+            type: string;
+            id: string;
+            name?: string;
+        };
+        action: string;
+        outcome: 'success' | 'failure' | 'partial';
+        reason?: string;
+        metadata?: Record<string, unknown>;
+    }): Promise<void>;
+}
+/**
+ * API Key Service Dependencies
+ */
+export interface ApiKeyServiceDependencies {
+    /** API key store */
+    store?: IApiKeyStore;
+    /** Audit logger (legacy) */
+    auditLogger?: IAuditLogger;
+    /** Security audit logger (preferred) */
+    securityLogger?: SecurityAuditLogger;
+    /** API key metadata cache */
+    cache?: ApiKeyMetadataCache;
+}
+/**
+ * API Key Management Service
+ */
+export declare class ApiKeyService {
+    private store;
+    private auditLogger?;
+    private securityLogger;
+    private cache;
+    constructor(deps?: ApiKeyServiceDependencies);
+    /**
+     * Generate a cryptographically secure API key
+     *
+     * Key format: vak_${prefix}_${secret}
+     * - vak: Vorion API Key identifier
+     * - prefix: 8 character alphanumeric identifier (for lookup)
+     * - secret: 43 character base64url encoded random bytes (32 bytes)
+     *
+     * @returns Object with full key and its components
+     */
+    private generateApiKey;
+    /**
+     * Hash an API key using SHA-256
+     */
+    private hashKey;
+    /**
+     * Parse an API key into its components
+     */
+    private parseKey;
+    /**
+     * Create a new API key
+     *
+     * @param input - Key creation parameters
+     * @returns The created key record and raw key (shown only once)
+     */
+    create(input: CreateApiKeyInput): Promise<ApiKeyCreationResult>;
+    /**
+     * Get an API key by ID
+     */
+    getById(id: string, tenantId: string): Promise<ApiKey | null>;
+    /**
+     * Update an API key
+     */
+    update(id: string, tenantId: string, input: UpdateApiKeyInput, updatedBy: string): Promise<ApiKey>;
+    /**
+     * Revoke an API key
+     */
+    revoke(id: string, tenantId: string, revokedBy: string, reason?: string): Promise<ApiKey>;
+    /**
+     * Delete an API key permanently
+     */
+    delete(id: string, tenantId: string, deletedBy: string): Promise<void>;
+    /**
+     * List API keys with filters
+     */
+    list(filters: ApiKeyListFilters): Promise<{
+        keys: ApiKey[];
+        total: number;
+    }>;
+    /**
+     * Validate an API key
+     *
+     * Uses a two-tier caching strategy for performance:
+     * 1. Check in-memory LRU cache (< 0.1ms)
+     * 2. Check Redis cache (< 1-2ms)
+     * 3. Fall back to database lookup (10-30ms)
+     *
+     * Uses timing-safe comparison to prevent timing attacks.
+     *
+     * @param rawKey - The raw API key to validate
+     * @param clientIp - Optional client IP for whitelist validation
+     * @returns Validation result
+     */
+    validate(rawKey: string, clientIp?: string): Promise<ApiKeyValidationResult>;
+    /**
+     * Validate API key from cached metadata
+     *
+     * Performs timing-safe hash comparison and status checks
+     * using cached metadata.
+     */
+    private validateFromCache;
+    /**
+     * Validate API key from full database record
+     *
+     * Used on cache miss after fetching from database.
+     */
+    private validateApiKey;
+    /**
+     * Check if an API key has a required scope
+     */
+    hasScope(apiKey: ApiKey, requiredScope: ApiKeyScope): boolean;
+    /**
+     * Check if an API key has all required scopes
+     */
+    hasAllScopes(apiKey: ApiKey, requiredScopes: ApiKeyScope[]): boolean;
+    /**
+     * Check if an API key has any of the required scopes
+     */
+    hasAnyScope(apiKey: ApiKey, requiredScopes: ApiKeyScope[]): boolean;
+    /**
+     * Check and consume rate limit for an API key
+     */
+    checkRateLimit(apiKey: ApiKey): Promise<ApiKeyRateLimitResult>;
+    /**
+     * Create initial rate limit state
+     */
+    private createInitialRateLimitState;
+    /**
+     * Reset expired windows
+     */
+    private resetExpiredWindows;
+    /**
+     * Rotate an API key (create new key, optionally keep old valid for grace period)
+     *
+     * @param id - ID of the key to rotate
+     * @param tenantId - Tenant ID
+     * @param rotatedBy - User performing the rotation
+     * @param gracePeriodMinutes - Optional grace period to keep old key valid
+     * @returns New key creation result
+     */
+    rotate(id: string, tenantId: string, rotatedBy: string, gracePeriodMinutes?: number): Promise<ApiKeyCreationResult>;
+    /**
+     * Record an audit event
+     */
+    private audit;
+}
+/**
+ * Get the API key service singleton
+ */
+export declare function getApiKeyService(): ApiKeyService;
+/**
+ * Create a new API key service instance
+ */
+export declare function createApiKeyService(deps?: ApiKeyServiceDependencies): ApiKeyService;
+/**
+ * Reset the API key service singleton (for testing)
+ */
+export declare function resetApiKeyService(): void;
+//# sourceMappingURL=service.d.ts.map

package/dist/security/api-keys/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/security/api-keys/service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAKH,OAAO,EAAE,WAAW,EAAoD,MAAM,wBAAwB,CAAC;AACvG,OAAO,EACL,KAAK,MAAM,EACX,KAAK,WAAW,EAEhB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EAEtB,KAAK,qBAAqB,EAC1B,yBAAyB,EAS1B,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,KAAK,YAAY,EAAkB,MAAM,YAAY,CAAC;AAC/D,OAAO,EACL,KAAK,mBAAmB,EAGzB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,mBAAmB,EAGpB,MAAM,gCAAgC,CAAC;AASxC;;GAEG;AACH,qBAAa,WAAY,SAAQ,WAAW;IACjC,IAAI,SAAmB;IACvB,UAAU,SAAO;gBAEd,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAI/D;AAED;;GAEG;AACH,qBAAa,qBAAsB,SAAQ,WAAW;aAMlC,SAAS,EAAE,yBAAyB;IAL7C,IAAI,SAA8B;IAClC,UAAU,SAAO;gBAGxB,OAAO,EAAE,MAAM,EACC,SAAS,EAAE,yBAAyB,EACpD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAKpC;AAED;;GAEG;AACH,qBAAa,oBAAqB,SAAQ,WAAW;aAMjC,UAAU,EAAE,MAAM;IAL3B,IAAI,SAA0B;IAC9B,UAAU,SAAO;gBAGxB,OAAO,EAAE,MAAM,EACC,UAAU,EAAE,MAAM,EAClC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAKpC;AAMD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,KAAK,EAAE;QACZ,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,QAAQ,CAAC;YAAC,EAAE,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QACpF,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QACpD,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;QAC3C,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACpC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnB;AAyBD;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,oBAAoB;IACpB,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,4BAA4B;IAC5B,WAAW,CAAC,EAAE,YAAY,CAAC;IAC3B,wCAAwC;IACxC,cAAc,CAAC,EAAE,mBAAmB,CAAC;IACrC,6BAA6B;IAC7B,KAAK,CAAC,EAAE,mBAAmB,CAAC;CAC7B;AAED;;GAEG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,KAAK,CAAe;IAC5B,OAAO,CAAC,WAAW,CAAC,CAAe;IACnC,OAAO,CAAC,cAAc,CAAsB;IAC5C,OAAO,CAAC,KAAK,CAAsB;gBAEvB,IAAI,GAAE,yBAA8B;IAWhD;;;;;;;;;OASG;IACH,OAAO,CAAC,cAAc;IAiBtB;;OAEG;IACH,OAAO,CAAC,OAAO;IAIf;;OAEG;IACH,OAAO,CAAC,QAAQ;IAoBhB;;;;;OAKG;IACG,MAAM,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAoFrE;;OAEG;IACG,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAUnE;;OAEG;IACG,MAAM,CACV,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,iBAAiB,EACxB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC;IAiFlB;;OAEG;IACG,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAmD/F;;OAEG;IACG,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAmC5E;;OAEG;IACG,IAAI,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAQlF;;;;;;;;;;;;;OAaG;IACG,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAkClF;;;;;OAKG;YACW,iBAAiB;IA2I/B;;;;OAIG;YACW,cAAc;IA8G5B;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,GAAG,OAAO;IAI7D;;OAEG;IACH,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,GAAG,OAAO;IAIpE;;OAEG;IACH,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,GAAG,OAAO;IAQnE;;OAEG;IACG,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IA8FpE;;OAEG;IACH,OAAO,CAAC,2BAA2B;IASnC;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAgB3B;;;;;;;;OAQG;IACG,MAAM,CACV,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,kBAAkB,CAAC,EAAE,MAAM,GAC1B,OAAO,CAAC,oBAAoB,CAAC;IAyFhC;;OAEG;YACW,KAAK;CA+BpB;AAQD;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,aAAa,CAMhD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,CAAC,EAAE,yBAAyB,GAAG,aAAa,CAEnF;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,IAAI,CAGzC"}