@vorionsys/security 1.0.0

package/dist/security/service-auth/service-auth-middleware.js

@@ -0,0 +1,461 @@
+/**
+ * Service Authentication Middleware
+ *
+ * Fastify preHandler middleware for service-to-service authentication.
+ * Validates HMAC signatures in request headers and optionally issues JWT tokens.
+ *
+ * @packageDocumentation
+ */
+import { createLogger } from '../../common/logger.js';
+import { UnauthorizedError, ForbiddenError } from '../../common/errors.js';
+import { getServiceAccountManager, ServiceAccountStatus, ServiceAccountRevokedError, ServiceAccountSuspendedError, } from './service-account.js';
+import { getServiceTokenService, SERVICE_AUTH_HEADERS, } from './service-token.js';
+const logger = createLogger({ component: 'service-auth-middleware' });
+// =============================================================================
+// ERRORS
+// =============================================================================
+/**
+ * Service authentication error
+ */
+export class ServiceAuthError extends UnauthorizedError {
+    code = 'SERVICE_AUTH_ERROR';
+    constructor(message, details) {
+        super(message, details);
+        this.name = 'ServiceAuthError';
+    }
+}
+/**
+ * Missing authentication headers error
+ */
+export class MissingAuthHeadersError extends ServiceAuthError {
+    code = 'MISSING_AUTH_HEADERS';
+    constructor() {
+        super('Missing required service authentication headers');
+        this.name = 'MissingAuthHeadersError';
+    }
+}
+/**
+ * Invalid signature error
+ */
+export class InvalidServiceSignatureError extends ServiceAuthError {
+    code = 'INVALID_SERVICE_SIGNATURE';
+    constructor(reason) {
+        super(reason ? `Invalid service signature: ${reason}` : 'Invalid service signature');
+        this.name = 'InvalidServiceSignatureError';
+    }
+}
+/**
+ * IP not allowed error
+ */
+export class IpNotAllowedError extends ForbiddenError {
+    code = 'IP_NOT_ALLOWED';
+    constructor(clientId, ip) {
+        super(`IP address not allowed for service: ${ip}`, { clientId, ip });
+        this.name = 'IpNotAllowedError';
+    }
+}
+/**
+ * Insufficient permissions error
+ */
+export class InsufficientPermissionsError extends ForbiddenError {
+    code = 'INSUFFICIENT_PERMISSIONS';
+    constructor(required, actual) {
+        super('Insufficient permissions for this operation', { required, actual });
+        this.name = 'InsufficientPermissionsError';
+    }
+}
+// =============================================================================
+// MIDDLEWARE FACTORY
+// =============================================================================
+/**
+ * Create service authentication middleware
+ */
+export function createServiceAuthMiddleware(options = {}) {
+    const { accountManager = getServiceAccountManager(), allowTokenAuth = true, issueToken = false, skipPaths = [], skipFn, validateIpWhitelist = true, requiredPermissions = [], anyPermissions = [], onError, } = options;
+    // Lazy-load token service to allow deferred initialization
+    const getTokenSvc = () => {
+        if (options.tokenService) {
+            return options.tokenService;
+        }
+        try {
+            return getServiceTokenService();
+        }
+        catch {
+            return null;
+        }
+    };
+    return async function serviceAuthMiddleware(request, reply) {
+        // Check if path should be skipped
+        if (skipPaths.some((path) => request.url.startsWith(path))) {
+            return;
+        }
+        // Check custom skip function
+        if (skipFn && skipFn(request)) {
+            return;
+        }
+        const authRequest = request;
+        try {
+            let authContext = null;
+            // Try token-based authentication first (if enabled)
+            if (allowTokenAuth) {
+                const tokenService = getTokenSvc();
+                if (tokenService) {
+                    authContext = await tryTokenAuth(request, tokenService, accountManager);
+                }
+            }
+            // Fall back to signature-based authentication
+            if (!authContext) {
+                const tokenService = getTokenSvc();
+                authContext = await trySignatureAuth(request, accountManager, tokenService, issueToken);
+            }
+            if (!authContext) {
+                throw new MissingAuthHeadersError();
+            }
+            // Validate IP whitelist if enabled
+            if (validateIpWhitelist && authContext.serviceAccount.ipWhitelist?.length) {
+                const clientIp = request.ip;
+                if (!authContext.serviceAccount.ipWhitelist.includes(clientIp)) {
+                    logger.warn({ clientId: authContext.clientId, ip: clientIp }, 'Service auth rejected: IP not in whitelist');
+                    throw new IpNotAllowedError(authContext.clientId, clientIp);
+                }
+            }
+            // Validate required permissions
+            if (requiredPermissions.length > 0) {
+                const hasAllRequired = requiredPermissions.every((perm) => authContext.permissions.includes('*') ||
+                    authContext.permissions.includes(perm) ||
+                    hasWildcardPermission(authContext.permissions, perm));
+                if (!hasAllRequired) {
+                    throw new InsufficientPermissionsError(requiredPermissions, authContext.permissions);
+                }
+            }
+            // Validate any permissions
+            if (anyPermissions.length > 0) {
+                const hasAny = anyPermissions.some((perm) => authContext.permissions.includes('*') ||
+                    authContext.permissions.includes(perm) ||
+                    hasWildcardPermission(authContext.permissions, perm));
+                if (!hasAny) {
+                    throw new InsufficientPermissionsError(anyPermissions, authContext.permissions);
+                }
+            }
+            // Attach auth context to request
+            authRequest.serviceAuth = authContext;
+            logger.debug({
+                clientId: authContext.clientId,
+                tenantId: authContext.tenantId,
+                authMethod: authContext.authMethod,
+                path: request.url,
+            }, 'Service authentication successful');
+        }
+        catch (error) {
+            if (onError) {
+                await onError(error, request, reply);
+                return;
+            }
+            logger.warn({
+                error: error.message,
+                path: request.url,
+                ip: request.ip,
+            }, 'Service authentication failed');
+            throw error;
+        }
+    };
+}
+/**
+ * Try token-based authentication
+ */
+async function tryTokenAuth(request, tokenService, accountManager) {
+    const authHeader = request.headers.authorization;
+    if (!authHeader?.startsWith('Bearer ')) {
+        return null;
+    }
+    const token = authHeader.slice(7);
+    const result = await tokenService.verifyToken(token);
+    if (!result.valid || !result.payload) {
+        if (result.error) {
+            logger.debug({ error: result.error }, 'Token verification failed');
+        }
+        return null;
+    }
+    // Verify the service account still exists and is active
+    const account = await accountManager.findAccount(result.payload.sub);
+    if (!account) {
+        logger.warn({ clientId: result.payload.sub }, 'Service account not found for valid token');
+        return null;
+    }
+    if (account.status === ServiceAccountStatus.REVOKED) {
+        throw new ServiceAccountRevokedError(account.clientId);
+    }
+    if (account.status === ServiceAccountStatus.SUSPENDED) {
+        throw new ServiceAccountSuspendedError(account.clientId);
+    }
+    return {
+        serviceAccount: account,
+        clientId: account.clientId,
+        tenantId: account.tenantId,
+        serviceName: account.name,
+        permissions: account.permissions,
+        authMethod: 'token',
+        token,
+        tokenPayload: result.payload,
+    };
+}
+/**
+ * Try signature-based authentication
+ */
+async function trySignatureAuth(request, accountManager, tokenService, issueToken) {
+    const headers = request.headers;
+    // Extract service auth headers
+    const clientId = getHeaderValue(headers, SERVICE_AUTH_HEADERS.SERVICE_ID);
+    const signature = getHeaderValue(headers, SERVICE_AUTH_HEADERS.SERVICE_SIGNATURE);
+    const timestampStr = getHeaderValue(headers, SERVICE_AUTH_HEADERS.SERVICE_TIMESTAMP);
+    // If no service headers, return null (might be token auth)
+    if (!clientId && !signature && !timestampStr) {
+        return null;
+    }
+    // If partial headers, that's an error
+    if (!clientId || !signature || !timestampStr) {
+        throw new MissingAuthHeadersError();
+    }
+    const timestamp = parseInt(timestampStr, 10);
+    if (isNaN(timestamp)) {
+        throw new InvalidServiceSignatureError('Invalid timestamp format');
+    }
+    // Get the service account
+    const account = await accountManager.findAccount(clientId);
+    if (!account) {
+        // Use generic error to prevent enumeration
+        throw new InvalidServiceSignatureError('Invalid credentials');
+    }
+    if (account.status === ServiceAccountStatus.REVOKED) {
+        throw new ServiceAccountRevokedError(clientId);
+    }
+    if (account.status === ServiceAccountStatus.SUSPENDED) {
+        throw new ServiceAccountSuspendedError(clientId);
+    }
+    // We need the plaintext secret to verify, but we only have the hash
+    // The signature is created using the plaintext secret, so we need to
+    // store a verification key or use a different approach
+    //
+    // For HMAC verification, the client sends:
+    // - signature = HMAC(timestamp + method + path + body, clientSecret)
+    //
+    // We can't reverse the hash, so we need to:
+    // 1. Store a separate verification key (not recommended - defeats purpose)
+    // 2. Use the hashed secret as the HMAC key (both sides must agree)
+    //
+    // We'll use approach 2: both client and server use the same derivation
+    // The client must hash their secret before using it for HMAC
+    // Get request body as string
+    let bodyStr = '';
+    if (request.body) {
+        if (typeof request.body === 'string') {
+            bodyStr = request.body;
+        }
+        else if (Buffer.isBuffer(request.body)) {
+            bodyStr = request.body.toString('utf8');
+        }
+        else {
+            bodyStr = JSON.stringify(request.body);
+        }
+    }
+    if (!tokenService) {
+        throw new Error('Token service required for signature verification');
+    }
+    // Verify the signature using the hashed secret
+    // Note: Client must also use hashed secret for HMAC
+    const verifyResult = tokenService.verifySignature({
+        clientSecret: account.clientSecret, // Using hashed secret as HMAC key
+        providedSignature: signature,
+        timestamp,
+        method: request.method,
+        path: request.url.split('?')[0], // Path without query string
+        body: bodyStr,
+    });
+    if (!verifyResult.valid) {
+        throw new InvalidServiceSignatureError(verifyResult.error);
+    }
+    // Update last used timestamp
+    accountManager['store'].updateLastUsed(clientId).catch((err) => {
+        logger.error({ err, clientId }, 'Failed to update lastUsedAt');
+    });
+    // Optionally issue a token
+    let token;
+    if (issueToken && tokenService) {
+        token = await tokenService.createToken({
+            clientId: account.clientId,
+            tenantId: account.tenantId,
+            serviceName: account.name,
+            permissions: account.permissions,
+            ipAddress: request.ip,
+        });
+    }
+    return {
+        serviceAccount: account,
+        clientId: account.clientId,
+        tenantId: account.tenantId,
+        serviceName: account.name,
+        permissions: account.permissions,
+        authMethod: 'signature',
+        token,
+    };
+}
+/**
+ * Helper to get header value (handles arrays)
+ */
+function getHeaderValue(headers, name) {
+    const value = headers[name] ?? headers[name.toLowerCase()];
+    if (Array.isArray(value)) {
+        return value[0] ?? null;
+    }
+    return value ?? null;
+}
+/**
+ * Check if permissions list contains a wildcard that matches the required permission
+ */
+function hasWildcardPermission(permissions, required) {
+    for (const perm of permissions) {
+        if (perm.endsWith(':*')) {
+            const prefix = perm.slice(0, -1); // Remove '*'
+            if (required.startsWith(prefix)) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+// =============================================================================
+// HELPER MIDDLEWARE FACTORIES
+// =============================================================================
+/**
+ * Create middleware that requires specific permissions
+ */
+export function requireServicePermissions(permissions, options = { all: true }) {
+    const baseOptions = options.all
+        ? { requiredPermissions: permissions }
+        : { anyPermissions: permissions };
+    return createServiceAuthMiddleware(baseOptions);
+}
+/**
+ * Create middleware that requires any of the specified permissions
+ */
+export function requireAnyServicePermission(permissions) {
+    return createServiceAuthMiddleware({ anyPermissions: permissions });
+}
+/**
+ * Create middleware that validates service belongs to a specific tenant
+ */
+export function requireServiceTenant(tenantId) {
+    return async function (request, reply) {
+        const authRequest = request;
+        if (!authRequest.serviceAuth) {
+            throw new ServiceAuthError('Service authentication required');
+        }
+        if (authRequest.serviceAuth.tenantId !== tenantId) {
+            throw new ForbiddenError('Service not authorized for this tenant', {
+                serviceTenant: authRequest.serviceAuth.tenantId,
+                requiredTenant: tenantId,
+            });
+        }
+    };
+}
+// =============================================================================
+// REQUEST HELPERS
+// =============================================================================
+/**
+ * Get service auth context from request
+ */
+export function getServiceAuth(request) {
+    return request.serviceAuth;
+}
+/**
+ * Require service auth context from request
+ */
+export function requireServiceAuth(request) {
+    const auth = getServiceAuth(request);
+    if (!auth) {
+        throw new ServiceAuthError('Service authentication required');
+    }
+    return auth;
+}
+/**
+ * Check if request has service auth
+ */
+export function hasServiceAuth(request) {
+    return !!request.serviceAuth;
+}
+/**
+ * Get service client ID from request
+ */
+export function getServiceClientId(request) {
+    return getServiceAuth(request)?.clientId;
+}
+/**
+ * Get service tenant ID from request
+ */
+export function getServiceTenantId(request) {
+    return getServiceAuth(request)?.tenantId;
+}
+/**
+ * Get service permissions from request
+ */
+export function getServicePermissions(request) {
+    return getServiceAuth(request)?.permissions ?? [];
+}
+/**
+ * Check if service has a specific permission
+ */
+export function serviceHasPermission(request, permission) {
+    const permissions = getServicePermissions(request);
+    if (permissions.includes('*')) {
+        return true;
+    }
+    if (permissions.includes(permission)) {
+        return true;
+    }
+    return hasWildcardPermission(permissions, permission);
+}
+// =============================================================================
+// FASTIFY PLUGIN
+// =============================================================================
+import fp from 'fastify-plugin';
+/**
+ * Service auth Fastify plugin
+ */
+const serviceAuthPluginAsync = async (fastify, options) => {
+    const { global = false, decorateRequest = true, ...middlewareOptions } = options;
+    // Create middleware
+    const middleware = createServiceAuthMiddleware(middlewareOptions);
+    // Register globally if requested
+    if (global) {
+        fastify.addHook('preHandler', middleware);
+    }
+    // Decorate request with helpers
+    if (decorateRequest) {
+        fastify.decorateRequest('serviceAuth', null);
+        fastify.decorateRequest('getServiceAuth', function () {
+            return getServiceAuth(this);
+        });
+        fastify.decorateRequest('requireServiceAuth', function () {
+            return requireServiceAuth(this);
+        });
+        fastify.decorateRequest('hasServiceAuth', function () {
+            return hasServiceAuth(this);
+        });
+        fastify.decorateRequest('serviceHasPermission', function (permission) {
+            return serviceHasPermission(this, permission);
+        });
+    }
+    // Decorate fastify with middleware factory
+    fastify.decorate('serviceAuthMiddleware', createServiceAuthMiddleware);
+    fastify.decorate('requireServicePermissions', requireServicePermissions);
+    fastify.decorate('requireAnyServicePermission', requireAnyServicePermission);
+    logger.info({ global }, 'Service auth plugin registered');
+};
+/**
+ * Service auth Fastify plugin
+ */
+export const serviceAuthPlugin = fp(serviceAuthPluginAsync, {
+    name: 'service-auth',
+    fastify: '>=4.x',
+});
+//# sourceMappingURL=service-auth-middleware.js.map

package/dist/security/service-auth/service-auth-middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-auth-middleware.js","sourceRoot":"","sources":["../../../src/security/service-auth/service-auth-middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC3E,OAAO,EAEL,wBAAwB,EACxB,oBAAoB,EAEpB,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAEL,sBAAsB,EACtB,oBAAoB,GAErB,MAAM,oBAAoB,CAAC;AAE5B,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,yBAAyB,EAAE,CAAC,CAAC;AA6DtE,gFAAgF;AAChF,SAAS;AACT,gFAAgF;AAEhF;;GAEG;AACH,MAAM,OAAO,gBAAiB,SAAQ,iBAAiB;IAC5C,IAAI,GAAG,oBAAoB,CAAC;IAErC,YAAY,OAAe,EAAE,OAAiC;QAC5D,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,uBAAwB,SAAQ,gBAAgB;IAClD,IAAI,GAAG,sBAAsB,CAAC;IAEvC;QACE,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,4BAA6B,SAAQ,gBAAgB;IACvD,IAAI,GAAG,2BAA2B,CAAC;IAE5C,YAAY,MAAe;QACzB,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,8BAA8B,MAAM,EAAE,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC;QACrF,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,iBAAkB,SAAQ,cAAc;IAC1C,IAAI,GAAG,gBAAgB,CAAC;IAEjC,YAAY,QAAgB,EAAE,EAAU;QACtC,KAAK,CAAC,uCAAuC,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,4BAA6B,SAAQ,cAAc;IACrD,IAAI,GAAG,0BAA0B,CAAC;IAE3C,YAAY,QAAkB,EAAE,MAAgB;QAC9C,KAAK,CAAC,6CAA6C,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3E,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;AAED,gFAAgF;AAChF,qBAAqB;AACrB,gFAAgF;AAEhF;;GAEG;AACH,MAAM,UAAU,2BAA2B,CACzC,UAAwC,EAAE;IAE1C,MAAM,EACJ,cAAc,GAAG,wBAAwB,EAAE,EAC3C,cAAc,GAAG,IAAI,EACrB,UAAU,GAAG,KAAK,EAClB,SAAS,GAAG,EAAE,EACd,MAAM,EACN,mBAAmB,GAAG,IAAI,EAC1B,mBAAmB,GAAG,EAAE,EACxB,cAAc,GAAG,EAAE,EACnB,OAAO,GACR,GAAG,OAAO,CAAC;IAEZ,2DAA2D;IAC3D,MAAM,WAAW,GAAG,GAAG,EAAE;QACvB,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YACzB,OAAO,OAAO,CAAC,YAAY,CAAC;QAC9B,CAAC;QACD,IAAI,CAAC;YACH,OAAO,sBAAsB,EAAE,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC;IAEF,OAAO,KAAK,UAAU,qBAAqB,CACzC,OAAuB,EACvB,KAAmB;QAEnB,kCAAkC;QAClC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC3D,OAAO;QACT,CAAC;QAED,6BAA6B;QAC7B,IAAI,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,OAAO;QACT,CAAC;QAED,MAAM,WAAW,GAAG,OAAsC,CAAC;QAE3D,IAAI,CAAC;YACH,IAAI,WAAW,GAA8B,IAAI,CAAC;YAElD,oDAAoD;YACpD,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,YAAY,GAAG,WAAW,EAAE,CAAC;gBACnC,IAAI,YAAY,EAAE,CAAC;oBACjB,WAAW,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;gBAC1E,CAAC;YACH,CAAC;YAED,8CAA8C;YAC9C,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,MAAM,YAAY,GAAG,WAAW,EAAE,CAAC;gBACnC,WAAW,GAAG,MAAM,gBAAgB,CAClC,OAAO,EACP,cAAc,EACd,YAAY,EACZ,UAAU,CACX,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,MAAM,IAAI,uBAAuB,EAAE,CAAC;YACtC,CAAC;YAED,mCAAmC;YACnC,IAAI,mBAAmB,IAAI,WAAW,CAAC,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC;gBAC1E,MAAM,QAAQ,GAAG,OAAO,CAAC,EAAE,CAAC;gBAC5B,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC/D,MAAM,CAAC,IAAI,CACT,EAAE,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,EAChD,4CAA4C,CAC7C,CAAC;oBACF,MAAM,IAAI,iBAAiB,CAAC,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;gBAC9D,CAAC;YACH,CAAC;YAED,gCAAgC;YAChC,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnC,MAAM,cAAc,GAAG,mBAAmB,CAAC,KAAK,CAC9C,CAAC,IAAI,EAAE,EAAE,CACP,WAAY,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC;oBACtC,WAAY,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC;oBACvC,qBAAqB,CAAC,WAAY,CAAC,WAAW,EAAE,IAAI,CAAC,CACxD,CAAC;gBAEF,IAAI,CAAC,cAAc,EAAE,CAAC;oBACpB,MAAM,IAAI,4BAA4B,CAAC,mBAAmB,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC;gBACvF,CAAC;YACH,CAAC;YAED,2BAA2B;YAC3B,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9B,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAChC,CAAC,IAAI,EAAE,EAAE,CACP,WAAY,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC;oBACtC,WAAY,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC;oBACvC,qBAAqB,CAAC,WAAY,CAAC,WAAW,EAAE,IAAI,CAAC,CACxD,CAAC;gBAEF,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,IAAI,4BAA4B,CAAC,cAAc,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC;gBAClF,CAAC;YACH,CAAC;YAED,iCAAiC;YACjC,WAAW,CAAC,WAAW,GAAG,WAAW,CAAC;YAEtC,MAAM,CAAC,KAAK,CACV;gBACE,QAAQ,EAAE,WAAW,CAAC,QAAQ;gBAC9B,QAAQ,EAAE,WAAW,CAAC,QAAQ;gBAC9B,UAAU,EAAE,WAAW,CAAC,UAAU;gBAClC,IAAI,EAAE,OAAO,CAAC,GAAG;aAClB,EACD,mCAAmC,CACpC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,OAAO,CAAC,KAAc,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;gBAC9C,OAAO;YACT,CAAC;YAED,MAAM,CAAC,IAAI,CACT;gBACE,KAAK,EAAG,KAAe,CAAC,OAAO;gBAC/B,IAAI,EAAE,OAAO,CAAC,GAAG;gBACjB,EAAE,EAAE,OAAO,CAAC,EAAE;aACf,EACD,+BAA+B,CAChC,CAAC;YAEF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,YAAY,CACzB,OAAuB,EACvB,YAAiC,EACjC,cAAqC;IAErC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;IAEjD,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAErD,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,2BAA2B,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,wDAAwD;IACxD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAErE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,2CAA2C,CAAC,CAAC;QAC3F,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,oBAAoB,CAAC,OAAO,EAAE,CAAC;QACpD,MAAM,IAAI,0BAA0B,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzD,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,oBAAoB,CAAC,SAAS,EAAE,CAAC;QACtD,MAAM,IAAI,4BAA4B,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO;QACL,cAAc,EAAE,OAAO;QACvB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,WAAW,EAAE,OAAO,CAAC,IAAI;QACzB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,UAAU,EAAE,OAAO;QACnB,KAAK;QACL,YAAY,EAAE,MAAM,CAAC,OAAO;KAC7B,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,gBAAgB,CAC7B,OAAuB,EACvB,cAAqC,EACrC,YAAwC,EACxC,UAAmB;IAEnB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAwD,CAAC;IAEjF,+BAA+B;IAC/B,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,EAAE,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAC1E,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,EAAE,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;IAClF,MAAM,YAAY,GAAG,cAAc,CAAC,OAAO,EAAE,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;IAErF,2DAA2D;IAC3D,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,IAAI,CAAC,YAAY,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sCAAsC;IACtC,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,IAAI,CAAC,YAAY,EAAE,CAAC;QAC7C,MAAM,IAAI,uBAAuB,EAAE,CAAC;IACtC,CAAC;IAED,MAAM,SAAS,GAAG,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,4BAA4B,CAAC,0BAA0B,CAAC,CAAC;IACrE,CAAC;IAED,0BAA0B;IAC1B,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAE3D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,2CAA2C;QAC3C,MAAM,IAAI,4BAA4B,CAAC,qBAAqB,CAAC,CAAC;IAChE,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,oBAAoB,CAAC,OAAO,EAAE,CAAC;QACpD,MAAM,IAAI,0BAA0B,CAAC,QAAQ,CAAC,CAAC;IACjD,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,oBAAoB,CAAC,SAAS,EAAE,CAAC;QACtD,MAAM,IAAI,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IACnD,CAAC;IAED,oEAAoE;IACpE,qEAAqE;IACrE,uDAAuD;IACvD,EAAE;IACF,2CAA2C;IAC3C,qEAAqE;IACrE,EAAE;IACF,4CAA4C;IAC5C,2EAA2E;IAC3E,mEAAmE;IACnE,EAAE;IACF,uEAAuE;IACvE,6DAA6D;IAE7D,6BAA6B;IAC7B,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrC,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;QACzB,CAAC;aAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC1C,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,+CAA+C;IAC/C,oDAAoD;IACpD,MAAM,YAAY,GAAG,YAAY,CAAC,eAAe,CAAC;QAChD,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,kCAAkC;QACtE,iBAAiB,EAAE,SAAS;QAC5B,SAAS;QACT,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,4BAA4B;QAC7D,IAAI,EAAE,OAAO;KACd,CAAC,CAAC;IAEH,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACxB,MAAM,IAAI,4BAA4B,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IAC7D,CAAC;IAED,6BAA6B;IAC7B,cAAc,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,GAAU,EAAE,EAAE;QACpE,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,6BAA6B,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,2BAA2B;IAC3B,IAAI,KAAyB,CAAC;IAC9B,IAAI,UAAU,IAAI,YAAY,EAAE,CAAC;QAC/B,KAAK,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC;YACrC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,WAAW,EAAE,OAAO,CAAC,IAAI;YACzB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,SAAS,EAAE,OAAO,CAAC,EAAE;SACtB,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,cAAc,EAAE,OAAO;QACvB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,WAAW,EAAE,OAAO,CAAC,IAAI;QACzB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,UAAU,EAAE,WAAW;QACvB,KAAK;KACN,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CACrB,OAAsD,EACtD,IAAY;IAEZ,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC1B,CAAC;IACD,OAAO,KAAK,IAAI,IAAI,CAAC;AACvB,CAAC;AAED;;GAEG;AACH,SAAS,qBAAqB,CAAC,WAAqB,EAAE,QAAgB;IACpE,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa;YAC/C,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChC,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gFAAgF;AAChF,8BAA8B;AAC9B,gFAAgF;AAEhF;;GAEG;AACH,MAAM,UAAU,yBAAyB,CACvC,WAAqB,EACrB,UAA6B,EAAE,GAAG,EAAE,IAAI,EAAE;IAE1C,MAAM,WAAW,GAAiC,OAAO,CAAC,GAAG;QAC3D,CAAC,CAAC,EAAE,mBAAmB,EAAE,WAAW,EAAE;QACtC,CAAC,CAAC,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC;IAEpC,OAAO,2BAA2B,CAAC,WAAW,CAAC,CAAC;AAClD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B,CAAC,WAAqB;IAC/D,OAAO,2BAA2B,CAAC,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;AACtE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,OAAO,KAAK,WAAW,OAAuB,EAAE,KAAmB;QACjE,MAAM,WAAW,GAAG,OAAsC,CAAC;QAE3D,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC;YAC7B,MAAM,IAAI,gBAAgB,CAAC,iCAAiC,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,WAAW,CAAC,WAAW,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAClD,MAAM,IAAI,cAAc,CAAC,wCAAwC,EAAE;gBACjE,aAAa,EAAE,WAAW,CAAC,WAAW,CAAC,QAAQ;gBAC/C,cAAc,EAAE,QAAQ;aACzB,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,kBAAkB;AAClB,gFAAgF;AAEhF;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,OAAuB;IACpD,OAAQ,OAAuC,CAAC,WAAW,CAAC;AAC9D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAuB;IACxD,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,gBAAgB,CAAC,iCAAiC,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,OAAuB;IACpD,OAAO,CAAC,CAAE,OAAuC,CAAC,WAAW,CAAC;AAChE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAuB;IACxD,OAAO,cAAc,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC;AAC3C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAuB;IACxD,OAAO,cAAc,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC;AAC3C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAuB;IAC3D,OAAO,cAAc,CAAC,OAAO,CAAC,EAAE,WAAW,IAAI,EAAE,CAAC;AACpD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAuB,EAAE,UAAkB;IAC9E,MAAM,WAAW,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAEnD,IAAI,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,qBAAqB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;AACxD,CAAC;AAED,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAahC;;GAEG;AACH,MAAM,sBAAsB,GAAiD,KAAK,EAChF,OAAwB,EACxB,OAAiC,EACjC,EAAE;IACF,MAAM,EAAE,MAAM,GAAG,KAAK,EAAE,eAAe,GAAG,IAAI,EAAE,GAAG,iBAAiB,EAAE,GAAG,OAAO,CAAC;IAEjF,oBAAoB;IACpB,MAAM,UAAU,GAAG,2BAA2B,CAAC,iBAAiB,CAAC,CAAC;IAElE,iCAAiC;IACjC,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IAC5C,CAAC;IAED,gCAAgC;IAChC,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO,CAAC,eAAe,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QAC7C,OAAO,CAAC,eAAe,CAAC,gBAAgB,EAAE;YACxC,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,eAAe,CAAC,oBAAoB,EAAE;YAC5C,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,eAAe,CAAC,gBAAgB,EAAE;YACxC,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,eAAe,CAAC,sBAAsB,EAAE,UAE9C,UAAkB;YAElB,OAAO,oBAAoB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,2CAA2C;IAC3C,OAAO,CAAC,QAAQ,CAAC,uBAAuB,EAAE,2BAA2B,CAAC,CAAC;IACvE,OAAO,CAAC,QAAQ,CAAC,2BAA2B,EAAE,yBAAyB,CAAC,CAAC;IACzE,OAAO,CAAC,QAAQ,CAAC,6BAA6B,EAAE,2BAA2B,CAAC,CAAC;IAE7E,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,gCAAgC,CAAC,CAAC;AAC5D,CAAC,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC,sBAAsB,EAAE;IAC1D,IAAI,EAAE,cAAc;IACpB,OAAO,EAAE,OAAO;CACjB,CAAC,CAAC"}