@webda/auth 0.0.0-stage → 4.0.0-beta.11
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +166 -0
- package/README.md +59 -2
- package/lib/authentication.service.d.ts +322 -0
- package/lib/authentication.service.d.ts.map +1 -0
- package/lib/authentication.service.js +978 -0
- package/lib/authentication.service.js.map +1 -0
- package/lib/certificate/certificate.service.d.ts +139 -0
- package/lib/certificate/certificate.service.d.ts.map +1 -0
- package/lib/certificate/certificate.service.js +343 -0
- package/lib/certificate/certificate.service.js.map +1 -0
- package/lib/compat/upgrade.d.ts +71 -0
- package/lib/compat/upgrade.d.ts.map +1 -0
- package/lib/compat/upgrade.js +200 -0
- package/lib/compat/upgrade.js.map +1 -0
- package/lib/email/emailpassword.service.d.ts +249 -0
- package/lib/email/emailpassword.service.d.ts.map +1 -0
- package/lib/email/emailpassword.service.js +714 -0
- package/lib/email/emailpassword.service.js.map +1 -0
- package/lib/email/tokens.d.ts +36 -0
- package/lib/email/tokens.d.ts.map +1 -0
- package/lib/email/tokens.js +46 -0
- package/lib/email/tokens.js.map +1 -0
- package/lib/errors.d.ts +53 -0
- package/lib/errors.d.ts.map +1 -0
- package/lib/errors.js +74 -0
- package/lib/errors.js.map +1 -0
- package/lib/index.d.ts +12 -0
- package/lib/index.d.ts.map +1 -0
- package/lib/index.js +12 -0
- package/lib/index.js.map +1 -0
- package/lib/mfa/secondfactor.service.d.ts +44 -0
- package/lib/mfa/secondfactor.service.d.ts.map +1 -0
- package/lib/mfa/secondfactor.service.js +38 -0
- package/lib/mfa/secondfactor.service.js.map +1 -0
- package/lib/mfa/totp.service.d.ts +41 -0
- package/lib/mfa/totp.service.d.ts.map +1 -0
- package/lib/mfa/totp.service.js +63 -0
- package/lib/mfa/totp.service.js.map +1 -0
- package/lib/oauth/oauth.service.d.ts +296 -0
- package/lib/oauth/oauth.service.d.ts.map +1 -0
- package/lib/oauth/oauth.service.js +560 -0
- package/lib/oauth/oauth.service.js.map +1 -0
- package/lib/provider.d.ts +53 -0
- package/lib/provider.d.ts.map +1 -0
- package/lib/provider.js +55 -0
- package/lib/provider.js.map +1 -0
- package/lib/test/authtest.d.ts +39 -0
- package/lib/test/authtest.d.ts.map +1 -0
- package/lib/test/authtest.js +62 -0
- package/lib/test/authtest.js.map +1 -0
- package/lib/test/emailtest.d.ts +25 -0
- package/lib/test/emailtest.d.ts.map +1 -0
- package/lib/test/emailtest.js +42 -0
- package/lib/test/emailtest.js.map +1 -0
- package/lib/test/fakeoauth.service.d.ts +45 -0
- package/lib/test/fakeoauth.service.d.ts.map +1 -0
- package/lib/test/fakeoauth.service.js +78 -0
- package/lib/test/fakeoauth.service.js.map +1 -0
- package/lib/test/mfauser.fixture.model.d.ts +11 -0
- package/lib/test/mfauser.fixture.model.d.ts.map +1 -0
- package/lib/test/mfauser.fixture.model.js +44 -0
- package/lib/test/mfauser.fixture.model.js.map +1 -0
- package/lib/test/stubprovider.d.ts +35 -0
- package/lib/test/stubprovider.d.ts.map +1 -0
- package/lib/test/stubprovider.js +46 -0
- package/lib/test/stubprovider.js.map +1 -0
- package/lib/test/v3.d.ts +29 -0
- package/lib/test/v3.d.ts.map +1 -0
- package/lib/test/v3.js +47 -0
- package/lib/test/v3.js.map +1 -0
- package/lib/throttle.d.ts +41 -0
- package/lib/throttle.d.ts.map +1 -0
- package/lib/throttle.js +49 -0
- package/lib/throttle.js.map +1 -0
- package/package.json +69 -3
- package/test/config.json +23 -0
- package/webda.module.json +891 -0
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"authentication.service.js","sourceRoot":"","sources":["../src/authentication.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,EAGL,OAAO,EACP,OAAO,EACP,KAAK,EACL,cAAc,EACd,GAAG,EACH,qBAAqB,EAErB,gBAAgB,EAGhB,SAAS,EAGT,oBAAoB,EACpB,WAAW,EACX,OAAO,EACP,iBAAiB,EACjB,UAAU,EACV,OAAO,EACP,QAAQ,EACR,gBAAgB,EAChB,UAAU,EAEV,kBAAkB,EAClB,UAAU,EACX,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,aAAa,EACb,aAAa,EACb,oBAAoB,EACpB,eAAe,EACf,aAAa,EACb,aAAa,EACb,oBAAoB,EACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAC3G,OAAO,EAAqB,gBAAgB,EAAE,cAAc,EAA4B,MAAM,eAAe,CAAC;AAoC9G,gHAAgH;AAChH,MAAM,CAAC,MAAM,eAAe,GAAsB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AAEnE;;;GAGG;AACH,SAAS,aAAa,CAAC,QAA0B;IAC/C,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAChE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,QAAQ,CAAC;IACrC,OAAO,IAAwB,CAAC;AAClC,CAAC;AAED,4CAA4C;AAC5C,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAEjC,gCAAgC;AAChC,MAAM,OAAO,wBAAyB,SAAQ,iBAAiB;IA2B7D;;;OAGG;IACH,IAAI,CAAC,MAAM,GAAQ,EAAE;QACnB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,IAAI,CAAC,SAAS,KAAd,IAAI,CAAC,SAAS,GAAK,YAAY,EAAC;QAChC,IAAI,CAAC,UAAU,KAAf,IAAI,CAAC,UAAU,GAAK,aAAa,EAAC;QAClC,IAAI,CAAC,OAAO,KAAZ,IAAI,CAAC,OAAO,GAAK,UAAU,EAAC;QAC5B,IAAI,CAAC,YAAY,KAAjB,IAAI,CAAC,YAAY,GAAK,IAAI,EAAC;QAC3B,IAAI,CAAC,aAAa,KAAlB,IAAI,CAAC,aAAa,GAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED;;;GAGG;IACU,cAAc;;sBACjB,OAAO;;;;;;;;;sBADJ,cACX,SAAQ,WAAgC;;;gBAW9B,gBAAW,IAZV,mDAAc,EAYD,IAAI,GAAG,EAAwB,EAAC;YA25B1D,CAAC;YAx5BC;;eAEG;YACH,YAAY;gBACV,OAAO,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAgC,CAAC;YAC5E,CAAC;YAED;;eAEG;YACH,aAAa;gBACX,OAAO,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAiC,CAAC;YAC9E,CAAC;YAED,gBAAgB;YAChB,OAAO;gBACL,KAAK,CAAC,OAAO,EAAE,CAAC;gBAChB,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACzB,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;gBACtC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;gBAC7C,MAAM,eAAe,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,MAAM,CAClE,QAAQ,CAAC,EAAE,CACT,QAAQ,CAAC,QAAQ,KAAK,WAAW;oBACjC,qBAAqB,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,OAAO,KAAK,OAAO,CAChF,CAAC;gBACF,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC/B,MAAM,IAAI,UAAU,CAAC,SAAS,CAC5B,oBAAoB,EACpB,GAAG,QAAQ,CAAC,UAAU,6CAA6C,CACpE,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,iBAAiB,GAAG,eAAe,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC;gBACvD,gBAAgB,CACd,IAAI,CAAC,iBAAiB;oBACpB,CAAC,CAAC;wBACE,KAAK,EAAE,QAAQ,CAAC,UAAU;wBAC1B,SAAS,EAAE,IAAI,CAAC,iBAAiB;wBACjC,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC;qBAChF;oBACH,CAAC,CAAC,SAAS,CACd,CAAC;gBACF,oBAAoB,CAAC;oBACnB,OAAO,EAAE,KAAK,EAAE,EAAU,EAAE,EAAE;wBAC5B,MAAM,GAAG,GAAI,IAAI,CAAC,YAAY,EAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;wBACjD,OAAO,CAAC,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;oBAC5D,CAAC;iBACF,CAAC,CAAC;gBACH,OAAO,IAAI,CAAC;YACd,CAAC;YAED,gBAAgB;YAChB,KAAK,CAAC,IAAI;gBACR,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;gBACnB,2DAA2D;gBAC3D,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACzB,OAAO,IAAI,CAAC;YACd,CAAC;YAED;;;eAGG;YACO,iBAAiB;gBACzB,yGAAyG;gBACzG,MAAM,SAAS,GAAG,IAAI,GAAG,EAAwB,CAAC;gBAClD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;oBAC7D,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC;wBAAE,SAAS;oBACvC,IAAI,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;wBACxC,MAAM,IAAI,KAAK,CAAC,4BAA4B,OAAO,CAAC,YAAY,GAAG,CAAC,CAAC;oBACvE,CAAC;oBACD,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;gBAC/C,CAAC;gBACD,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;YAC/B,CAAC;YAED,gBAAgB;YAChB,KAAK,CAAC,IAAI;gBACR,oBAAoB,CAAC,SAAS,CAAC,CAAC;gBAChC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;YACrB,CAAC;YAED;;;eAGG;YACH,WAAW,CAAC,IAAY;gBACtB,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACpC,CAAC;YAED;;;eAGG;YACO,cAAc,CAAC,IAAY;gBACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;gBACxC,IAAI,CAAC,QAAQ;oBAAE,OAAO,SAAS,CAAC;gBAChC,IAAI,OAAO,QAAQ,CAAC,cAAc,KAAK,UAAU;oBAAE,OAAO,QAAQ,CAAC,cAAc,EAAE,CAAC;gBACpF,MAAM,MAAM,GAAQ,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC;gBAC/C,IAAI,CAAC,MAAM;oBAAE,OAAO,SAAS,CAAC;gBAC9B,MAAM,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,GAAG,MAAM,CAAC;gBAC/D,MAAM,OAAO,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;gBACxF,IAAI,mBAAmB,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,CAAC;oBACvE,MAAM,IAAI,KAAK,CAAC,sCAAsC,IAAI,2CAA2C,CAAC,CAAC;gBACzG,CAAC;gBACD,IACE,sBAAsB,KAAK,SAAS;oBACpC,OAAO,sBAAsB,KAAK,SAAS;oBAC3C,CAAC,OAAO,CAAC,sBAAsB,CAAC,EAChC,CAAC;oBACD,MAAM,IAAI,KAAK,CACb,sCAAsC,IAAI,yDAAyD,CACpG,CAAC;gBACJ,CAAC;gBACD,OAAO,mBAAmB,KAAK,SAAS,IAAI,sBAAsB,KAAK,SAAS;oBAC9E,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,CAAC;YACtD,CAAC;YAED;;eAEG;YACH,YAAY;gBACV,OAAO,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC;YACpE,CAAC;YAED;;;eAGG;YAEH,SAAS;gBACP,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;YAC7B,CAAC;YAED;;;eAGG;YAEH,KAAK,CAAC,EAAE;gBACN,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;gBACzB,MAAM,IAAI,GAAS,GAAG,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;gBACzF,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,MAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;gBACjD,CAAC;gBACD,MAAM,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAS,CAAC,CAAC;gBACvE,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC;YAC9B,CAAC;YAED,gBAAgB;YAChB,WAAW;gBACT,KAAK,CAAC,WAAW,EAAE,CAAC;gBACpB,IAAI,CAAC,OAAO,KAAZ,IAAI,CAAC,OAAO,GAAK,EAAE,EAAC;gBACpB,IAAI,CAAC,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,SAAS,CAAU,OAAO,EAAE;oBACpD,IAAI,EAAE,YAAY;oBAClB,IAAI,EAAE,sCAAsC;oBAC5C,UAAU,EAAE,CAAC,UAAU,CAAC;iBACzB,CAAC,CAAC;gBACH,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,CAAU,OAAO,EAAE;oBACrD,IAAI,EAAE,aAAa;oBACnB,IAAI,EAAE,0BAA0B;iBACjC,CAAC,CAAC;gBACH,IAAI,CAAC,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,SAAS,CAAU,OAAO,EAAE;oBAC3D,IAAI,EAAE,mBAAmB;oBACzB,IAAI,EAAE,6CAA6C;oBACnD,UAAU,EAAE,CAAC,UAAU,CAAC;iBACzB,CAAC,CAAC;YACL,CAAC;YAED;;;;;;eAMG;YACO,KAAK,CAAC,SAAS,CAAC,QAAgB,EAAE,WAAmB;gBAC7D,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;gBACxC,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;gBAC7D,IAAI,MAAM,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;oBACvB,OAAO,GAAG,CAAC,GAAG,EAAE,CAAC;gBACnB,CAAC;gBACD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,EAAE,EAAE,CAAC;oBACvC,OAAO,SAAS,CAAC;gBACnB,CAAC;gBACD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,QAAQ,CAAQ,CAAC,CAAC;gBACvE,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;oBAC7B,OAAO,SAAS,CAAC;gBACnB,CAAC;gBACD,iGAAiG;gBACjG,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBACrD,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,UAAU,CAAC,EAAE,CAAC;oBACnC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,+CAA+C,QAAQ,aAAa,CAAC,CAAC;oBACvF,OAAO,SAAS,CAAC;gBACnB,CAAC;gBACD,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;gBACpE,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;oBACrE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,QAAQ,6CAA6C,CAAC,CAAC;oBAC/E,OAAO,SAAS,CAAC;gBACnB,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC;YAED;;;;eAIG;YACO,UAAU,CAAC,IAAU;gBAC7B,MAAM,GAAG,GAAoB,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAE,IAAY,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC1G,OAAO,GAAG,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,CAAC;YAED;;;;;;eAMG;YACH,KAAK,CAAC,YAAY,CAAC,QAA0B,EAAE,IAAI,GAAQ,EAAE,EAAE,GAAG,GAAQ,UAAU,EAAO;gBACzF,MAAM,IAAI,GAAS,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,MAAM,CACjD;oBACE,GAAG,IAAI;oBACP,KAAK,EAAE,QAAQ,CAAC,KAAK;oBACrB,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,QAAQ,CAAC,OAAO,EAAE,IAAI;oBACvD,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE;iBACpB,EACR,KAAK,CACN,CAAC;gBACF,MAAM,IAAI,CAAC,IAAI,CAAC,yBAAyB,EAAE;oBACzC,OAAO,EAAE,GAAG;oBACZ,IAAI;oBACJ,IAAI;oBACJ,OAAO,EAAE,GAAG,QAAQ,CAAC,WAAW,IAAI,QAAQ,CAAC,QAAQ,EAAE;oBACvD,QAAQ,EAAE,aAAa,CAAC,QAAQ,CAAC;iBAC3B,CAAC,CAAC;gBACV,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;gBAClB,IAAI,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACjE,OAAO,IAAI,CAAC;YACd,CAAC;YAED;;;;;;;;;;eAUG;YACH,KAAK,CAAC,QAAQ,CAAC,QAA0B,EAAE,OAAO,GAA0B,EAAE;gBAC5E,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;gBACtC,MAAM,GAAG,GAAG,UAAU,EAAO,CAAC;gBAC9B,OAAO,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;YACrF,CAAC;YAED;;;;eAIG;YACH,KAAK,CAAC,YAAY,CAAC,QAA0B;gBAC3C,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;gBACtC,MAAM,GAAG,GAAG,UAAU,EAAO,CAAC;gBAC9B,MAAM,MAAM,GAAuB,GAAG,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;gBACrG,IAAI,CAAC,MAAM;oBAAE,MAAM,IAAI,UAAU,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC;gBACjE,OAAO,WAAW,CAAC,KAAK,IAAI,EAAE;oBAC5B,IAAI,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;oBAC1E,IAAI,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC;wBACrB,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,KAAK,MAAM;4BAAE,MAAM,IAAI,oBAAoB,EAAE,CAAC;wBAC5E,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;oBAC9B,CAAC;oBACD,IAAI,KAAK,EAAE,CAAC;wBACV,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;wBACtB,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;oBACrB,CAAC;yBAAM,CAAC;wBACN,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;4BACjC,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC;4BACrD,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;4BACxE,SAAS,EAAE,QAAQ,CAAC,OAAO;4BAC3B,UAAU,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;yBACrD,CAAC,CAAC;wBACV,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;wBACtB,IAAI,CAAC;4BACH,MAAM,KAAK,CAAC,aAAa,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;wBAC5C,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACb,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;gCAAE,MAAM,GAAG,CAAC;4BACrF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;4BAC7E,IAAI,MAAM,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,MAAM;gCAAE,MAAM,IAAI,oBAAoB,EAAE,CAAC;4BAC/E,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;wBAC9B,CAAC;oBACH,CAAC;oBACD,MAAM,IAAI,CAAC,IAAI,CAAC,uBAAuB,EAAE;wBACvC,OAAO,EAAE,GAAG;wBACZ,IAAI,EAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;wBACjC,KAAK;qBACC,CAAC,CAAC;oBACV,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;gBAC9B,CAAC,CAAC,CAAC;YACL,CAAC;YAED;;;;;;;;eAQG;YACH,WAAW,CAAC,QAA0B;gBACpC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;oBAC1C,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,0BAA0B,QAAQ,EAAE,QAAQ,GAAG,CAAC,CAAC;gBACnF,CAAC;gBACD,OAAO,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC5E,CAAC;YAED;;;;;;;eAOG;YACO,KAAK,CAAC,UAAU,CACxB,QAA0B,EAC1B,GAAQ,EACR,OAAgB,EAChB,OAAO,GAAY,KAAK;gBAExB,MAAM,aAAa,GAAuB,GAAG,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC5G,IAAI,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;gBAC1E,IAAI,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC;oBACrB,IAAI,aAAa,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,KAAK,aAAa,EAAE,CAAC;wBAClE,MAAM,IAAI,oBAAoB,EAAE,CAAC;oBACnC,CAAC;oBACD,6GAA6G;oBAC7G,IAAI,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;wBAC5E,MAAM,IAAI,aAAa,EAAE,CAAC;oBAC5B,CAAC;oBACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;gBAC1E,CAAC;gBACD,+FAA+F;gBAC/F,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC;gBACzB,IAAI,IAAI,GAAqB,QAAQ,CAAC,IAAI,CAAC;gBAC3C,IAAI,MAAM,GAAuB,aAAa,IAAI,IAAI,EAAE,OAAO,EAAE,CAAC;gBAClE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAChF,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC5E,IAAI,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC;gBACtD,IAAI,UAA4B,CAAC;gBACjC,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;gBACvC,kGAAkG;gBAClG,MAAM,KAAK,GACT,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC/G,IAAI,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC;oBACrB,IAAI,MAAM,KAAK,OAAO,IAAI,CAAC,MAAM,KAAK,UAAU,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;wBAC7E,MAAM,IAAI,aAAa,EAAE,CAAC;oBAC5B,CAAC;oBACD,MAAM,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;oBAC1B,MAAM,GAAG,IAAI,CAAC;gBAChB,CAAC;gBACD,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC;wBAClC,MAAM,IAAI,oBAAoB,EAAE,CAAC;oBACnC,CAAC;oBACD,+FAA+F;oBAC/F,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;wBACjF,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;oBAC1D,CAAC;oBACD,IAAI,GAAG,UAAU,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;oBAC/D,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC1B,CAAC;gBACD,IAAI,KAAK,EAAE,CAAC;oBACV,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;oBACtB,yDAAyD;oBACzD,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC;wBAC3B,KAAK,CAAC,UAAU,KAAhB,KAAK,CAAC,UAAU,GAAK,IAAI,IAAI,EAAE,EAAC;oBAClC,CAAC;yBAAM,CAAC;wBACN,uEAAuE;wBACvE,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;oBAC9C,CAAC;oBACD,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;gBACrB,CAAC;qBAAM,CAAC;oBACN,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;wBACjC,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC;wBACrD,KAAK;wBACL,SAAS,EAAE,QAAQ,CAAC,OAAO;wBAC3B,UAAU,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;qBACrD,CAAC,CAAC;oBACV,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;oBACtB,4CAA4C;oBAC5C,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;wBACpB,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;oBAC1C,CAAC;oBACD,IAAI,CAAC;wBACH,MAAM,KAAK,CAAC,aAAa,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;oBAC5C,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,IAAI,CAAC,OAAO,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;4BACrF,uGAAuG;4BACvG,MAAM,UAAU,EAAE,MAAM,EAAE,CAAC;4BAC3B,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;wBACvD,CAAC;wBACD,MAAM,GAAG,CAAC;oBACZ,CAAC;gBACH,CAAC;gBACD,+EAA+E;gBAC/E,IAAI,KAAK,IAAI,CAAC,UAAU,IAAI,QAAQ,CAAC,aAAa,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;oBACpF,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;wBACvC,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC;wBAC5B,KAAK;wBACL,UAAU,EAAE,IAAI,IAAI,EAAE;qBAChB,CAAC,CAAC;oBACV,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;oBACtB,MAAM,KAAK;yBACR,aAAa,EAAE;yBACf,MAAM,CAAC,KAAK,CAAC;yBACb,KAAK,CAAC,GAAG,CAAC,EAAE;wBACX,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;4BAAE,MAAM,GAAG,CAAC;oBACvF,CAAC,CAAC,CAAC;gBACP,CAAC;gBACD,IAAI,MAAM,EAAE,CAAC;oBACX,MAAM,IAAI,CAAC,IAAI,CAAC,uBAAuB,EAAE;wBACvC,OAAO,EAAE,GAAG;wBACZ,IAAI,EAAE,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;wBAC3C,KAAK;qBACC,CAAC,CAAC;gBACZ,CAAC;gBACD,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;YAC9D,CAAC;YAED;;;eAGG;YACO,QAAQ,CAAC,MAAc;gBAC/B,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC;YAC/C,CAAC;YAED;;;;;;;eAOG;YACO,KAAK,CAAC,SAAS,CACvB,IAAmB,EACnB,KAAY,EACZ,QAA0B,EAC1B,GAAG,GAAQ,UAAU,EAAO;gBAE5B,MAAM,OAAO,GAAS,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBAClF,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;gBACjC,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC;gBACjC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;gBACzC,mFAAmF;gBACnF,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,IAAI,EAAE,CAAC;gBAC/B,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;gBACtG,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;gBAC9E,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;gBAChG,iGAAiG;gBACjG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC5B,gEAAgE;gBAChE,MAAM,MAAM,GAAQ;oBAClB,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC5D,GAAG,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;iBACrD,CAAC;gBACF,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;oBACtB,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;wBAC/B,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;oBAClC,CAAC;oBACD,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC;gBAC7C,CAAC;gBACD,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YACxF,CAAC;YAED;;;;;;;;;;eAUG;YACO,KAAK,CAAC,MAAM,CACpB,OAAa,EACb,KAAY,EACZ,OAAY,EACZ,GAAQ,EACR,QAAgB,EAChB,QAA2B,EAC3B,MAAM,GAAQ,EAAE;gBAEhB,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;gBACjC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;gBAC/D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC/D,MAAM,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE;oBACtC,OAAO,EAAE,GAAG;oBACZ,MAAM;oBACN,IAAI,EAAE,OAAO;oBACb,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE;oBACxB,KAAK;oBACL,QAAQ;oBACR,mFAAmF;oBACnF,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;iBACvG,CAAC,CAAC;gBACV,IAAI,OAAO,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;oBAC/B,MAAM,IAAI,CAAC,IAAI,CAAC,4BAA4B,EAAE;wBAC5C,OAAO,EAAE,GAAG;wBACZ,IAAI,EAAE,OAAO;wBACb,MAAM;wBACN,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;qBAChE,CAAC,CAAC;gBACZ,CAAC;gBACD,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACvC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,aAAa,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC;YACpE,CAAC;YAED;;;;;;;eAOG;YACO,KAAK,CAAC,WAAW,CACzB,GAAQ,EACR,MAAiB,EACjB,MAA0B,EAC1B,IAAwB;gBAExB,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;gBACzB,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC;gBACjC,MAAM,IAAI,GAAS,GAAG,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC;gBACxC,MAAM,YAAY,GAAG,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,SAAS,CAAC;gBACjE,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,YAAY,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;oBACzG,MAAM,IAAI,UAAU,CAAC,YAAY,CAAC,wBAAwB,CAAC,CAAC;gBAC9D,CAAC;gBACD,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,eAAe,CAAC,IAAI,OAAO,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;oBACvF,MAAM,IAAI,UAAU,CAAC,YAAY,CAAC,yBAAyB,CAAC,CAAC;gBAC/D,CAAC;gBACD,IACE,MAAM,KAAK,QAAQ;oBACnB,GAAG,CAAC,aAAa,EAAE,CAAC,YAAY;oBAChC,CAAC,CAAC,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC,aAAa,EAAE,CAAC,YAAY,GAAG,IAAI,CAAC,EAC1F,CAAC;oBACD,MAAM,IAAI,UAAU,CAAC,YAAY,CAAC,2BAA2B,CAAC,CAAC;gBACjE,CAAC;gBACD,IAAI,MAAW,CAAC;gBAChB,IAAI,CAAC;oBACH,MAAM,GAAG,MAAM,IAAI,EAAE,CAAC;gBACxB,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;wBAClC,MAAM,IAAI,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;oBACtG,CAAC;oBACD,MAAM,GAAG,CAAC;gBACZ,CAAC;gBACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBACzB,MAAM,IAAI,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;oBACrG,MAAM,MAAM,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC;oBAC1C,MAAM,WAAW,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;oBAC3D,OAAO,CAAC,GAAG,GAAG,UAAU,CAAC;oBACzB,OAAO,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,KAAK,MAAM,CAAC,EAAE,MAAO,CAAC,CAAC;oBAC5F,OAAO,EAAE,GAAG,MAAM,EAAE,GAAG,CAAC,MAAM,WAAW,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5E,CAAC;gBACD,IAAI,YAAY,IAAI,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;oBACxC,OAAO,EAAE,GAAG,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9E,CAAC;gBACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBACzB,MAAM,IAAI,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;gBACxG,CAAC;gBACD,OAAO,MAAM,CAAC;YAChB,CAAC;YAED;;;;eAIG;YACH,KAAK,CAAC,oBAAoB,CAAC,GAAa;gBACtC,MAAM,GAAG,GAAG,UAAU,EAAO,CAAC;gBAC9B,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC;gBACjC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC;oBAC1B,MAAM,IAAI,aAAa,EAAE,CAAC;gBAC5B,CAAC;gBACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;gBAC9B,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC5D,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;gBAC7C,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;gBAC5C,IAAI,UAAU,EAAE,CAAC;oBACf,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;wBAChC,MAAM,IAAI,aAAa,EAAE,CAAC;oBAC5B,CAAC;gBACH,CAAC;qBAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtD,MAAM,IAAI,aAAa,EAAE,CAAC;gBAC5B,CAAC;gBACD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;gBAClC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;gBACzF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;gBAC9B,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE;oBACvC,QAAQ;oBACR,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,GAAG,GAAG,CAAC;oBACrC,GAAG,EAAE,UAAU;oBACf,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;iBAC3C,CAAC,CAAC;gBACH,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;gBACxB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC1D,CAAC;YAED;;;;;eAKG;YACO,KAAK,CAAC,YAAY,CAAC,KAAY,EAAE,MAAW;gBACpD,IAAI,CAAC,MAAM;oBAAE,OAAO,EAAE,CAAC;gBACvB,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC/B,OAAO;oBACL,MAAM,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE;oBACnD,GAAG,CAAE,KAAa,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACrE,CAAC;YACJ,CAAC;YAED;;;eAGG;YACO,WAAW;gBACnB,MAAM,GAAG,GAAG,UAAU,EAAO,CAAC;gBAC9B,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC;oBAClC,MAAM,IAAI,UAAU,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC;gBACtD,CAAC;gBACD,OAAO,GAAG,CAAC,gBAAgB,EAAE,CAAC;YAChC,CAAC;YAED;;eAEG;YAEH,KAAK,CAAC,MAAM;gBACV,MAAM,GAAG,GAAG,UAAU,EAAO,CAAC;gBAC9B,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC;gBACjC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC;oBAClD,MAAM,IAAI,UAAU,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC;gBACtD,CAAC;gBACD,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;gBACrC,IAAI,MAAM,EAAE,CAAC;oBACX,MAAM,WAAW,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC3E,CAAC;gBACD,MAAM,IAAI,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,OAAO,EAAE,GAAG,EAAS,CAAC,CAAC;gBAClE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;gBAC5B,GAAG,CAAC,UAAU,EAAE,CAAC;YACnB,CAAC;YAED;;;;eAIG;YAEH,KAAK,CAAC,OAAO,CAAC,YAAoB;gBAChC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;gBACzG,OAAO,MAAM,CAAC;YAChB,CAAC;YAED;;;eAGG;YAEH,KAAK,CAAC,MAAM;gBAGV,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;gBAClC,OAAO,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBAC/C,QAAQ,EAAE,CAAC,CAAC,QAAQ;oBACpB,WAAW,EAAE,CAAC,CAAC,WAAW;oBAC1B,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,UAAU,EAAE,CAAC,CAAC,UAAU;oBACxB,UAAU,EAAE,CAAC,CAAC,UAAU;iBACzB,CAAC,CAAC,CAAC;YACN,CAAC;YAED;;;eAGG;YACO,KAAK,CAAC,UAAU,CAAC,MAAc;gBACvC,OAAO,WAAW,CAAC,KAAK,IAAI,EAAE;oBAC5B,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;oBACxC,MAAM,MAAM,GAAG,CAAC,MAAM,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;oBACvE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,EAAE,CAAC;wBACxC,OAAO,MAAM,CAAC;oBAChB,CAAC;oBACD,0EAA0E;oBAC1E,MAAM,MAAM,GAAG,IAAI,GAAG,EAAiB,CAAC;oBACxC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;wBAC3B,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,CAAC;4BAC1B,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,CAAC;wBACrC,CAAC;6BAAM,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,EAAE,EAAE,CAAC;4BAC7C,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,UAAU,CAAC;gCAAE,SAAS;4BAChD,IAAI,QAAe,CAAC;4BACpB,IAAI,CAAC;gCACH,QAAQ,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;4BACnD,CAAC;4BAAC,OAAO,GAAG,EAAE,CAAC;gCACb,IAAI,CAAC,CAAC,GAAG,YAAY,aAAa,CAAC;oCAAE,MAAM,GAAG,CAAC;gCAC/C,8FAA8F;gCAC9F,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,KAAK,CAAC,YAAY,EAAE,+CAA+C,CAAC,CAAC;gCAClG,SAAS;4BACX,CAAC;4BACD,+DAA+D;4BAC/D,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;gCAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;wBAChF,CAAC;oBACH,CAAC;oBACD,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC9B,CAAC,CAAC,CAAC;YACL,CAAC;YAED;;;;;;eAMG;YAEH,KAAK,CAAC,MAAM,CAAC,QAAgB,EAAE,WAAmB;gBAChD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;gBAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;gBAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC;gBAC1F,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;gBACnD,CAAC;gBACD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC;gBACnD,MAAM,IAAI,GAAS,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAC/C,MAAM,YAAY,GAAG,CAAC,CAAE,IAAY,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,CAAC;gBAC/D,2FAA2F;gBAC3F,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,YAAY,CAAC,CAAC;gBAC7E,MAAM,SAAS,GAAG,QAAQ,KAAK,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;gBACvF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,YAAY,IAAI,SAAS,CAAC,EAAE,CAAC;oBACvD,MAAM,IAAI,eAAe,EAAE,CAAC;gBAC9B,CAAC;gBACD,MAAM,WAAW,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC/C,8FAA8F;gBAC9F,MAAM,KAAK,GAAG;oBACZ,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE;oBACtB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,UAAU,EAAE,MAAM,CAAC,UAAU;oBAC7B,UAAU,EAAE,MAAM,CAAC,UAAU;oBAC7B,MAAM;iBACP,CAAC;gBACF,MAAM,IAAI,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAS,CAAC,CAAC;YAC5F,CAAC;YAED;;;;;;;;;;;;;;;;;;;eAmBG;YAKH,KAAK,CAAC,OAAO;YACX,oEAAoE;YACpE,MAAM,GAAY,KAAK;YACvB,gDAAgD;YAChD,KAAK,GAAW,GAAG;gBAEnB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;gBAC/D,MAAM,MAAM,GAAoB;oBAC9B,MAAM,EAAE,CAAC,CAAC,MAAM;oBAChB,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE;oBAC/C,KAAK,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE;iBAC/C,CAAC;gBACF,MAAM,WAAW,CAAC,KAAK,IAAI,EAAE;oBAC3B,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;oBAC3C,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAC5C,CAAC,CAAC,CAAC;gBACH,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,0BAA0B,EAAE,MAAM,CAAC,CAAC;gBACrD,OAAO,MAAM,CAAC;YAChB,CAAC;YAED;;;;;eAKG;YACO,KAAK,CAAC,CAAC,eAAe,CAAC,QAAgB;gBAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;gBACxC,MAAM,MAAM,GAAwB,CAAC,UAAU,CAAC,CAAC;gBACjD,IAAK,UAAkB,KAAK,KAAK,EAAE,CAAC;oBAClC,IAAI,CAAC;wBACH,IAAI,KAAK,CAAC,aAAa,EAAE;4BAAE,MAAM,CAAC,IAAI,CAAC,KAAY,CAAC,CAAC;oBACvD,CAAC;oBAAC,MAAM,CAAC;wBACP,6EAA6E;oBAC/E,CAAC;gBACH,CAAC;gBACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;gBAC/B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;oBAC3B,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,EAAE,SAAS,QAAQ,EAAE,CAAC,CAAC;oBACtD,OAAO,IAAI,EAAE,CAAC;wBACZ,IAAI,IAA2B,CAAC;wBAChC,IAAI,CAAC;4BACH,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;wBAC3B,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACb,MAAM,UAAU,GAAI,KAAa,CAAC,QAAQ,EAAE,UAAU,IAAI,KAAK,CAAC,IAAI,CAAC;4BACrE,MAAM,KAAK,GAAQ,IAAI,KAAK,CAC1B,mBAAmB,UAAU,0BAA0B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI;gCACjG,iGAAiG,CACpG,CAAC;4BACF,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC;4BAClB,MAAM,KAAK,CAAC;wBACd,CAAC;wBACD,IAAI,IAAI,CAAC,IAAI;4BAAE,MAAM;wBACrB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;wBACtC,IAAI,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;4BAAE,SAAS;wBACjD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;wBACd,MAAM,GAAG,CAAC;oBACZ,CAAC;gBACH,CAAC;YACH,CAAC;YAED;;;;eAIG;YACO,KAAK,CAAC,aAAa,CAAC,MAAuB,EAAE,QAAgB;gBACrE,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;gBACxC,MAAM,MAAM,GAAG,IAAI,GAAG,EAA6C,CAAC;gBACpE,IAAI,IAAI,GAAG,CAAC,CAAC;gBACb,IAAI,QAAgB,CAAC;gBACrB,GAAG,CAAC;oBACF,QAAQ,GAAG,CAAC,CAAC;oBACb,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;wBACvD,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,UAAU,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS;4BAAE,SAAS;wBAC9E,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;4BACzB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;4BAC3B,SAAS;wBACX,CAAC;wBACD,uGAAuG;wBACvG,6FAA6F;wBAC7F,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,GAAU,CAAC,CAAC;wBACvC,MAAM,GAAG,GAAG,MAAM,GAAG;6BAClB,GAAG,EAAE;6BACL,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,GAAG,0CAA0C,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;wBAC3G,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,CAAC;4BACpC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;4BAC3B,SAAS;wBACX,CAAC;wBACD,IAAI,CAAC;4BACH,MAAM,YAAY,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;4BAC/D,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;4BAC5B,QAAQ,EAAE,CAAC;wBACb,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACb,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;4BAC1B,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,GAAG,kBAAkB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;wBAChG,CAAC;oBACH,CAAC;oBACD,IAAI,EAAE,CAAC;oBACP,wDAAwD;gBAC1D,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,IAAI,QAAQ,GAAG,CAAC,IAAI,IAAI,GAAG,oBAAoB,EAAE;gBACxE,IAAI,QAAQ,GAAG,CAAC,IAAI,IAAI,IAAI,oBAAoB,EAAE,CAAC;oBACjD,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC;oBACzB,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,iCAAiC,IAAI,uBAAuB,CAAC,CAAC;gBACjF,CAAC;gBACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;oBAClC,IAAI,KAAK,KAAK,QAAQ;wBAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;;wBAClD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9B,CAAC;YACH,CAAC;YAED;;;;eAIG;YACO,KAAK,CAAC,YAAY,CAAC,MAAuB,EAAE,QAAgB;gBACpE,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC,SAAS,QAAQ,EAAE,CAAC,EAAE,CAAC;oBAC1E,IAAI,CAAE,IAAY,CAAC,kBAAkB,CAAC;wBAAE,SAAS;oBACjD,IAAI,CAAC;wBACH,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;4BACnB,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;wBACpB,CAAC;wBACD,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;oBAC1B,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;wBACzC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,IAAI,CAAC,OAAO,EAAE,kBAAkB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;oBAC1G,CAAC;gBACH,CAAC;YACH,CAAC;;;;qCAtxBA,SAAS,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,CAAC;8BASpF,SAAS,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC;kCA8ftE,SAAS,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,CAAC;mCAqB/E,SAAS,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,CAAC;kCAUjF,SAAS,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,CAAC;kCAwD9E,SAAS,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,CAAC;mCAmDtF,OAAO,CAAC,cAAc,EAAE;oBACvB,WAAW,EAAE,sDAAsD;oBACnE,KAAK,EAAE,aAAa;iBACrB,CAAC;YAnpBF,4KAAA,SAAS,6DAER;YAOD,uJAAM,EAAE,6DAQP;YAsfD,mKAAM,MAAM,6DAaX;YAQD,sKAAM,OAAO,6DAGZ;YAOD,mKAAM,MAAM,6DAWX;YA6CD,mKAAM,MAAM,6DA4BX;YA0BD,sKAAM,OAAO,6DAkBZ;;;QAnzBM,aAAU,GAAG,wBAAyB;;;SAJlC,cAAc"}
|
|
@@ -0,0 +1,139 @@
|
|
|
1
|
+
import { type AuthResult, type CertificateResolution, type CertificateResolver, type ClientCertificate, type Context, type ProviderInfo, type ResolvedIdentity, Service, ServiceParameters } from "@webda/core";
|
|
2
|
+
import { type AuthProvider } from "../provider.js";
|
|
3
|
+
/** Certificate field identifying its owner */
|
|
4
|
+
export type CertificateIdentityField = "fingerprint256" | "subject.CN" | "san.email" | "san.uri";
|
|
5
|
+
/** CertificateProvider parameters */
|
|
6
|
+
export declare class CertificateProviderParameters extends ServiceParameters {
|
|
7
|
+
/**
|
|
8
|
+
* `factor` only adds `mtls` to a session already authenticated as the certificate's linked user.
|
|
9
|
+
* @default "login"
|
|
10
|
+
*/
|
|
11
|
+
mode: "login" | "factor";
|
|
12
|
+
/**
|
|
13
|
+
* Certificate field used as ident uid: the SHA-256 fingerprint pins one certificate, the other fields survive a
|
|
14
|
+
* certificate renewal
|
|
15
|
+
* @default "fingerprint256"
|
|
16
|
+
*/
|
|
17
|
+
identityField: CertificateIdentityField;
|
|
18
|
+
/**
|
|
19
|
+
* Only certificates whose issuer common name or distinguished name ("O=Webda, CN=ca") is listed are accepted,
|
|
20
|
+
* undefined accepts every issuer trusted by the TLS layer
|
|
21
|
+
*/
|
|
22
|
+
allowedIssuers?: string[];
|
|
23
|
+
/**
|
|
24
|
+
* Only certificates whose subject distinguished name ("O=Webda, CN=alice") matches one of these regular
|
|
25
|
+
* expressions are accepted, undefined accepts every subject
|
|
26
|
+
*/
|
|
27
|
+
allowedSubjects?: string[];
|
|
28
|
+
/**
|
|
29
|
+
* Register a user on the first request of an unknown certificate; otherwise the certificate has to be linked to
|
|
30
|
+
* a logged user with `Auth.Certificate.Link`
|
|
31
|
+
* @default false
|
|
32
|
+
*/
|
|
33
|
+
autoRegister: boolean;
|
|
34
|
+
/**
|
|
35
|
+
* Roles of the certificate sessions by subject attribute: `{ "OU=admins": ["admin"] }` gives the role admin to
|
|
36
|
+
* certificates having an OU admins
|
|
37
|
+
*/
|
|
38
|
+
roles?: Record<string, string[]>;
|
|
39
|
+
/**
|
|
40
|
+
* How long a certificate resolved to a user is remembered, in milliseconds (0 disables the cache)
|
|
41
|
+
* @default 60000
|
|
42
|
+
*/
|
|
43
|
+
cacheTtl: number;
|
|
44
|
+
/**
|
|
45
|
+
* @param params - raw parameters
|
|
46
|
+
* @returns this
|
|
47
|
+
*/
|
|
48
|
+
load(params?: any): this;
|
|
49
|
+
}
|
|
50
|
+
/**
|
|
51
|
+
* Login with a TLS client certificate (mTLS)
|
|
52
|
+
*
|
|
53
|
+
* The certificate is verified by the HttpServer (`clientCa`) or by a trusted reverse proxy (`clientCertHeader`):
|
|
54
|
+
* this provider maps verified certificates to users. In login mode, each request carrying the certificate of a
|
|
55
|
+
* known user gets a stateless session with the provider "certificate" and the authentication method "mtls". In
|
|
56
|
+
* factor mode, it adds "mtls" only to an existing session for the same user on that request.
|
|
57
|
+
*
|
|
58
|
+
* Exposes the operation `Auth.Certificate.Link` (`POST auth/certificate/link`) linking the presented certificate to
|
|
59
|
+
* the logged user.
|
|
60
|
+
*
|
|
61
|
+
* @WebdaModda CertificateProvider
|
|
62
|
+
*/
|
|
63
|
+
export declare class CertificateProvider<T extends CertificateProviderParameters = CertificateProviderParameters> extends Service<T> implements AuthProvider, CertificateResolver {
|
|
64
|
+
static Parameters: typeof CertificateProviderParameters;
|
|
65
|
+
readonly providerName: string;
|
|
66
|
+
/** @returns how certificate authentication contributes to a session */
|
|
67
|
+
get mode(): "login" | "factor";
|
|
68
|
+
/** Certificates resolved to a user, by ident uid */
|
|
69
|
+
protected cache: Map<string, {
|
|
70
|
+
value: CertificateResolution;
|
|
71
|
+
expires: number;
|
|
72
|
+
}>;
|
|
73
|
+
/** Listeners to remove on stop */
|
|
74
|
+
protected unsubscribers: (() => void)[];
|
|
75
|
+
/** @override */
|
|
76
|
+
resolve(): this;
|
|
77
|
+
/** @override */
|
|
78
|
+
init(): Promise<this>;
|
|
79
|
+
/** @override */
|
|
80
|
+
stop(): Promise<void>;
|
|
81
|
+
/**
|
|
82
|
+
* @returns what clients see in Auth.Providers
|
|
83
|
+
*/
|
|
84
|
+
getPublicInfo(): ProviderInfo;
|
|
85
|
+
/**
|
|
86
|
+
* Whether a certificate is accepted: valid now, from an allowed issuer, with an allowed subject
|
|
87
|
+
* @param cert - client certificate
|
|
88
|
+
* @returns true when accepted
|
|
89
|
+
*/
|
|
90
|
+
isAccepted(cert: ClientCertificate): boolean;
|
|
91
|
+
/**
|
|
92
|
+
* Identity asserted by a certificate
|
|
93
|
+
* @param cert - client certificate
|
|
94
|
+
* @returns the identity, undefined when the certificate lacks the identity field
|
|
95
|
+
*/
|
|
96
|
+
getIdentity(cert: ClientCertificate): ResolvedIdentity | undefined;
|
|
97
|
+
/**
|
|
98
|
+
* Roles given by the `roles` parameter to a certificate
|
|
99
|
+
* @param cert - client certificate
|
|
100
|
+
* @returns the roles, undefined when none
|
|
101
|
+
*/
|
|
102
|
+
getRoles(cert: ClientCertificate): string[] | undefined;
|
|
103
|
+
/**
|
|
104
|
+
* Resolve a verified certificate into a user, registering one when `autoRegister` is set
|
|
105
|
+
* @param cert - verified client certificate
|
|
106
|
+
* @param context - context of the request, its session is not loaded yet
|
|
107
|
+
* @returns the user, undefined when the certificate is refused or unknown
|
|
108
|
+
*/
|
|
109
|
+
resolveCertificate(cert: ClientCertificate, context: Context): Promise<CertificateResolution | undefined>;
|
|
110
|
+
/**
|
|
111
|
+
* User owning a certificate ident, cached for `cacheTtl`
|
|
112
|
+
* @param providerUid - ident uid
|
|
113
|
+
* @returns the user and ident ids, undefined when the certificate is not linked
|
|
114
|
+
*/
|
|
115
|
+
protected findUser(providerUid: string): Promise<CertificateResolution | undefined>;
|
|
116
|
+
/**
|
|
117
|
+
* @param providerUid - ident uid
|
|
118
|
+
* @param value - resolution to cache
|
|
119
|
+
*/
|
|
120
|
+
protected remember(providerUid: string, value: CertificateResolution): void;
|
|
121
|
+
/**
|
|
122
|
+
* Register the user of an unknown certificate through `Authentication.complete()` (linking and registration
|
|
123
|
+
* policies apply), when `autoRegister` is set
|
|
124
|
+
* @param identity - identity of the certificate
|
|
125
|
+
* @param context - context of the request
|
|
126
|
+
* @returns the new user and ident ids, undefined when not registered
|
|
127
|
+
*/
|
|
128
|
+
protected register(identity: ResolvedIdentity, context: Context): Promise<CertificateResolution | undefined>;
|
|
129
|
+
/**
|
|
130
|
+
* Link the client certificate of the request to the logged user
|
|
131
|
+
* @returns the auth result
|
|
132
|
+
* @throws WebdaError.Unauthorized when no user is logged
|
|
133
|
+
* @throws WebdaError.Forbidden when the request has no verified, accepted certificate with the identity field
|
|
134
|
+
*/
|
|
135
|
+
link(): Promise<AuthResult | {
|
|
136
|
+
status: "linked";
|
|
137
|
+
}>;
|
|
138
|
+
}
|
|
139
|
+
//# sourceMappingURL=certificate.service.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"certificate.service.d.ts","sourceRoot":"","sources":["../../src/certificate/certificate.service.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,UAAU,EACf,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,OAAO,EAIZ,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,OAAO,EACP,iBAAiB,EAQlB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,KAAK,YAAY,EAAqB,MAAM,gBAAgB,CAAC;AAEtE,8CAA8C;AAC9C,MAAM,MAAM,wBAAwB,GAAG,gBAAgB,GAAG,YAAY,GAAG,WAAW,GAAG,SAAS,CAAC;AAEjG,qCAAqC;AACrC,qBAAa,6BAA8B,SAAQ,iBAAiB;IAClE;;;OAGG;IACH,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAC;IACzB;;;;OAIG;IACH,aAAa,EAAE,wBAAwB,CAAC;IACxC;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B;;;;OAIG;IACH,YAAY,EAAE,OAAO,CAAC;IACtB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACjC;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;;OAGG;IACH,IAAI,CAAC,MAAM,GAAE,GAAQ,GAAG,IAAI,CAO3B;CACF;AAKD;;;;;;;;;;;;GAYG;AACH,qBAAa,mBAAmB,CAAC,CAAC,SAAS,6BAA6B,GAAG,6BAA6B,CACtG,SAAQ,OAAO,CAAC,CAAC,CACjB,YAAW,YAAY,EAAE,mBAAmB;IAE5C,MAAM,CAAC,UAAU,uCAAiC;IAElD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAiB;IAE9C,uEAAuE;IACvE,IAAI,IAAI,IAAI,OAAO,GAAG,QAAQ,CAE7B;IAED,oDAAoD;IACpD,SAAS,CAAC,KAAK;eAA4B,qBAAqB;iBAAW,MAAM;OAAM;IACvF,kCAAkC;IAClC,SAAS,CAAC,aAAa,EAAE,CAAC,MAAM,IAAI,CAAC,EAAE,CAAM;IAE7C,gBAAgB;IAChB,OAAO,IAAI,IAAI,CAId;IAED,gBAAgB;IACV,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAc1B;IAED,gBAAgB;IACV,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAO1B;IAED;;OAEG;IACH,aAAa,IAAI,YAAY,CAE5B;IAED;;;;OAIG;IACH,UAAU,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAgB3C;IAED;;;;OAIG;IACH,WAAW,CAAC,IAAI,EAAE,iBAAiB,GAAG,gBAAgB,GAAG,SAAS,CAiCjE;IAED;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,EAAE,GAAG,SAAS,CAUtD;IAED;;;;;OAKG;IACG,kBAAkB,CAAC,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAU9G;IAED;;;;OAIG;IACH,UAAgB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAiBxF;IAED;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAQ1E;IAED;;;;;;OAMG;IACH,UAAgB,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAuBjH;IAED;;;;;OAKG;IAEG,IAAI,IAAI,OAAO,CAAC,UAAU,GAAG;QAAE,MAAM,EAAE,QAAQ,CAAA;KAAE,CAAC,CAmBvD;CACF"}
|
|
@@ -0,0 +1,343 @@
|
|
|
1
|
+
var __runInitializers = (this && this.__runInitializers) || function (thisArg, initializers, value) {
|
|
2
|
+
var useValue = arguments.length > 2;
|
|
3
|
+
for (var i = 0; i < initializers.length; i++) {
|
|
4
|
+
value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
|
|
5
|
+
}
|
|
6
|
+
return useValue ? value : void 0;
|
|
7
|
+
};
|
|
8
|
+
var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
|
|
9
|
+
function accept(f) { if (f !== void 0 && typeof f !== "function") throw new TypeError("Function expected"); return f; }
|
|
10
|
+
var kind = contextIn.kind, key = kind === "getter" ? "get" : kind === "setter" ? "set" : "value";
|
|
11
|
+
var target = !descriptorIn && ctor ? contextIn["static"] ? ctor : ctor.prototype : null;
|
|
12
|
+
var descriptor = descriptorIn || (target ? Object.getOwnPropertyDescriptor(target, contextIn.name) : {});
|
|
13
|
+
var _, done = false;
|
|
14
|
+
for (var i = decorators.length - 1; i >= 0; i--) {
|
|
15
|
+
var context = {};
|
|
16
|
+
for (var p in contextIn) context[p] = p === "access" ? {} : contextIn[p];
|
|
17
|
+
for (var p in contextIn.access) context.access[p] = contextIn.access[p];
|
|
18
|
+
context.addInitializer = function (f) { if (done) throw new TypeError("Cannot add initializers after decoration has completed"); extraInitializers.push(accept(f || null)); };
|
|
19
|
+
var result = (0, decorators[i])(kind === "accessor" ? { get: descriptor.get, set: descriptor.set } : descriptor[key], context);
|
|
20
|
+
if (kind === "accessor") {
|
|
21
|
+
if (result === void 0) continue;
|
|
22
|
+
if (result === null || typeof result !== "object") throw new TypeError("Object expected");
|
|
23
|
+
if (_ = accept(result.get)) descriptor.get = _;
|
|
24
|
+
if (_ = accept(result.set)) descriptor.set = _;
|
|
25
|
+
if (_ = accept(result.init)) initializers.unshift(_);
|
|
26
|
+
}
|
|
27
|
+
else if (_ = accept(result)) {
|
|
28
|
+
if (kind === "field") initializers.unshift(_);
|
|
29
|
+
else descriptor[key] = _;
|
|
30
|
+
}
|
|
31
|
+
}
|
|
32
|
+
if (target) Object.defineProperty(target, contextIn.name, descriptor);
|
|
33
|
+
done = true;
|
|
34
|
+
};
|
|
35
|
+
import { Ident, Operation, Service, ServiceParameters, Session, WebdaError, registerCertificateResolver, runAsSystem, runWithContext, useCertificateResolver, useContext } from "@webda/core";
|
|
36
|
+
import { useAuthentication } from "../provider.js";
|
|
37
|
+
/** CertificateProvider parameters */
|
|
38
|
+
export class CertificateProviderParameters extends ServiceParameters {
|
|
39
|
+
/**
|
|
40
|
+
* @param params - raw parameters
|
|
41
|
+
* @returns this
|
|
42
|
+
*/
|
|
43
|
+
load(params = {}) {
|
|
44
|
+
super.load(params);
|
|
45
|
+
this.mode ?? (this.mode = "login");
|
|
46
|
+
this.identityField ?? (this.identityField = "fingerprint256");
|
|
47
|
+
this.autoRegister ?? (this.autoRegister = false);
|
|
48
|
+
this.cacheTtl ?? (this.cacheTtl = 60000);
|
|
49
|
+
return this;
|
|
50
|
+
}
|
|
51
|
+
}
|
|
52
|
+
/** Maximum number of certificates kept in the resolution cache */
|
|
53
|
+
const CACHE_MAX = 10000;
|
|
54
|
+
/**
|
|
55
|
+
* Login with a TLS client certificate (mTLS)
|
|
56
|
+
*
|
|
57
|
+
* The certificate is verified by the HttpServer (`clientCa`) or by a trusted reverse proxy (`clientCertHeader`):
|
|
58
|
+
* this provider maps verified certificates to users. In login mode, each request carrying the certificate of a
|
|
59
|
+
* known user gets a stateless session with the provider "certificate" and the authentication method "mtls". In
|
|
60
|
+
* factor mode, it adds "mtls" only to an existing session for the same user on that request.
|
|
61
|
+
*
|
|
62
|
+
* Exposes the operation `Auth.Certificate.Link` (`POST auth/certificate/link`) linking the presented certificate to
|
|
63
|
+
* the logged user.
|
|
64
|
+
*
|
|
65
|
+
* @WebdaModda CertificateProvider
|
|
66
|
+
*/
|
|
67
|
+
let CertificateProvider = (() => {
|
|
68
|
+
var _a;
|
|
69
|
+
let _classSuper = Service;
|
|
70
|
+
let _instanceExtraInitializers = [];
|
|
71
|
+
let _link_decorators;
|
|
72
|
+
return _a = class CertificateProvider extends _classSuper {
|
|
73
|
+
constructor() {
|
|
74
|
+
super(...arguments);
|
|
75
|
+
this.providerName = (__runInitializers(this, _instanceExtraInitializers), "certificate");
|
|
76
|
+
/** Certificates resolved to a user, by ident uid */
|
|
77
|
+
this.cache = new Map();
|
|
78
|
+
/** Listeners to remove on stop */
|
|
79
|
+
this.unsubscribers = [];
|
|
80
|
+
}
|
|
81
|
+
/** @returns how certificate authentication contributes to a session */
|
|
82
|
+
get mode() {
|
|
83
|
+
return this.parameters.mode;
|
|
84
|
+
}
|
|
85
|
+
/** @override */
|
|
86
|
+
resolve() {
|
|
87
|
+
super.resolve();
|
|
88
|
+
registerCertificateResolver(this);
|
|
89
|
+
return this;
|
|
90
|
+
}
|
|
91
|
+
/** @override */
|
|
92
|
+
async init() {
|
|
93
|
+
await super.init();
|
|
94
|
+
const auth = useAuthentication();
|
|
95
|
+
if (auth) {
|
|
96
|
+
// An unlinked certificate stops authenticating at once on this instance (after cacheTtl on the others)
|
|
97
|
+
const onUnlinked = (evt) => {
|
|
98
|
+
if (evt?.ident?.provider === this.providerName) {
|
|
99
|
+
this.cache.delete(evt.ident.providerUid);
|
|
100
|
+
}
|
|
101
|
+
};
|
|
102
|
+
auth.on("Authentication.Unlinked", onUnlinked);
|
|
103
|
+
this.unsubscribers.push(() => auth.off("Authentication.Unlinked", onUnlinked));
|
|
104
|
+
}
|
|
105
|
+
return this;
|
|
106
|
+
}
|
|
107
|
+
/** @override */
|
|
108
|
+
async stop() {
|
|
109
|
+
this.unsubscribers.forEach(u => u());
|
|
110
|
+
this.unsubscribers = [];
|
|
111
|
+
if (useCertificateResolver() === this) {
|
|
112
|
+
registerCertificateResolver(undefined);
|
|
113
|
+
}
|
|
114
|
+
await super.stop();
|
|
115
|
+
}
|
|
116
|
+
/**
|
|
117
|
+
* @returns what clients see in Auth.Providers
|
|
118
|
+
*/
|
|
119
|
+
getPublicInfo() {
|
|
120
|
+
return { name: this.providerName, type: "certificate" };
|
|
121
|
+
}
|
|
122
|
+
/**
|
|
123
|
+
* Whether a certificate is accepted: valid now, from an allowed issuer, with an allowed subject
|
|
124
|
+
* @param cert - client certificate
|
|
125
|
+
* @returns true when accepted
|
|
126
|
+
*/
|
|
127
|
+
isAccepted(cert) {
|
|
128
|
+
const now = Date.now();
|
|
129
|
+
if (cert.validFrom?.getTime() > now || cert.validTo?.getTime() < now) {
|
|
130
|
+
return false;
|
|
131
|
+
}
|
|
132
|
+
const { allowedIssuers, allowedSubjects } = this.parameters;
|
|
133
|
+
if (allowedIssuers) {
|
|
134
|
+
const names = [cert.issuerDN, ...values(cert.issuer.CN)];
|
|
135
|
+
if (!allowedIssuers.some(issuer => names.includes(issuer))) {
|
|
136
|
+
return false;
|
|
137
|
+
}
|
|
138
|
+
}
|
|
139
|
+
if (allowedSubjects && !allowedSubjects.some(pattern => new RegExp(pattern).test(cert.subjectDN))) {
|
|
140
|
+
return false;
|
|
141
|
+
}
|
|
142
|
+
return true;
|
|
143
|
+
}
|
|
144
|
+
/**
|
|
145
|
+
* Identity asserted by a certificate
|
|
146
|
+
* @param cert - client certificate
|
|
147
|
+
* @returns the identity, undefined when the certificate lacks the identity field
|
|
148
|
+
*/
|
|
149
|
+
getIdentity(cert) {
|
|
150
|
+
const email = sanValues(cert, "email")[0];
|
|
151
|
+
let providerUid;
|
|
152
|
+
switch (this.parameters.identityField) {
|
|
153
|
+
case "subject.CN":
|
|
154
|
+
providerUid = values(cert.subject.CN)[0];
|
|
155
|
+
break;
|
|
156
|
+
case "san.email":
|
|
157
|
+
providerUid = email ? Ident.normalizeEmail(email) : undefined;
|
|
158
|
+
break;
|
|
159
|
+
case "san.uri":
|
|
160
|
+
providerUid = sanValues(cert, "URI")[0];
|
|
161
|
+
break;
|
|
162
|
+
default:
|
|
163
|
+
providerUid = cert.fingerprint256?.replace(/:/g, "").toLowerCase();
|
|
164
|
+
}
|
|
165
|
+
if (!providerUid) {
|
|
166
|
+
return undefined;
|
|
167
|
+
}
|
|
168
|
+
return {
|
|
169
|
+
provider: this.providerName,
|
|
170
|
+
// Ident uids cannot contain ":" (URIs do)
|
|
171
|
+
providerUid: providerUid.replace(/%/g, "%25").replace(/:/g, "%3A"),
|
|
172
|
+
email,
|
|
173
|
+
emailVerified: false,
|
|
174
|
+
amr: ["mtls"],
|
|
175
|
+
profile: {
|
|
176
|
+
subject: cert.subject,
|
|
177
|
+
issuer: cert.issuer,
|
|
178
|
+
serialNumber: cert.serialNumber,
|
|
179
|
+
fingerprint256: cert.fingerprint256
|
|
180
|
+
}
|
|
181
|
+
};
|
|
182
|
+
}
|
|
183
|
+
/**
|
|
184
|
+
* Roles given by the `roles` parameter to a certificate
|
|
185
|
+
* @param cert - client certificate
|
|
186
|
+
* @returns the roles, undefined when none
|
|
187
|
+
*/
|
|
188
|
+
getRoles(cert) {
|
|
189
|
+
const roles = new Set();
|
|
190
|
+
for (const [match, granted] of Object.entries(this.parameters.roles ?? {})) {
|
|
191
|
+
const idx = match.indexOf("=");
|
|
192
|
+
if (idx < 0)
|
|
193
|
+
continue;
|
|
194
|
+
if (values(cert.subject[match.substring(0, idx).trim()]).includes(match.substring(idx + 1).trim())) {
|
|
195
|
+
granted.forEach(role => roles.add(role));
|
|
196
|
+
}
|
|
197
|
+
}
|
|
198
|
+
return roles.size ? [...roles] : undefined;
|
|
199
|
+
}
|
|
200
|
+
/**
|
|
201
|
+
* Resolve a verified certificate into a user, registering one when `autoRegister` is set
|
|
202
|
+
* @param cert - verified client certificate
|
|
203
|
+
* @param context - context of the request, its session is not loaded yet
|
|
204
|
+
* @returns the user, undefined when the certificate is refused or unknown
|
|
205
|
+
*/
|
|
206
|
+
async resolveCertificate(cert, context) {
|
|
207
|
+
if (!cert?.verified || !this.isAccepted(cert)) {
|
|
208
|
+
return undefined;
|
|
209
|
+
}
|
|
210
|
+
const identity = this.getIdentity(cert);
|
|
211
|
+
if (!identity) {
|
|
212
|
+
return undefined;
|
|
213
|
+
}
|
|
214
|
+
const found = (await this.findUser(identity.providerUid)) ?? (await this.register(identity, context));
|
|
215
|
+
return found ? { ...found, roles: this.getRoles(cert) } : undefined;
|
|
216
|
+
}
|
|
217
|
+
/**
|
|
218
|
+
* User owning a certificate ident, cached for `cacheTtl`
|
|
219
|
+
* @param providerUid - ident uid
|
|
220
|
+
* @returns the user and ident ids, undefined when the certificate is not linked
|
|
221
|
+
*/
|
|
222
|
+
async findUser(providerUid) {
|
|
223
|
+
const cached = this.cache.get(providerUid);
|
|
224
|
+
if (cached && cached.expires > Date.now()) {
|
|
225
|
+
return cached.value;
|
|
226
|
+
}
|
|
227
|
+
this.cache.delete(providerUid);
|
|
228
|
+
const ident = await runAsSystem(async () => {
|
|
229
|
+
const ref = useAuthentication().getIdentModel().ref(Ident.key(providerUid, this.providerName));
|
|
230
|
+
return (await ref.exists()) ? ref.get() : undefined;
|
|
231
|
+
});
|
|
232
|
+
const userId = ident?.getUser()?.toString();
|
|
233
|
+
if (!ident || !userId) {
|
|
234
|
+
return undefined;
|
|
235
|
+
}
|
|
236
|
+
const value = { userId, identId: ident.getUUID() };
|
|
237
|
+
this.remember(providerUid, value);
|
|
238
|
+
return value;
|
|
239
|
+
}
|
|
240
|
+
/**
|
|
241
|
+
* @param providerUid - ident uid
|
|
242
|
+
* @param value - resolution to cache
|
|
243
|
+
*/
|
|
244
|
+
remember(providerUid, value) {
|
|
245
|
+
if (!this.parameters.cacheTtl) {
|
|
246
|
+
return;
|
|
247
|
+
}
|
|
248
|
+
if (this.cache.size >= CACHE_MAX) {
|
|
249
|
+
this.cache.clear();
|
|
250
|
+
}
|
|
251
|
+
this.cache.set(providerUid, { value, expires: Date.now() + this.parameters.cacheTtl });
|
|
252
|
+
}
|
|
253
|
+
/**
|
|
254
|
+
* Register the user of an unknown certificate through `Authentication.complete()` (linking and registration
|
|
255
|
+
* policies apply), when `autoRegister` is set
|
|
256
|
+
* @param identity - identity of the certificate
|
|
257
|
+
* @param context - context of the request
|
|
258
|
+
* @returns the new user and ident ids, undefined when not registered
|
|
259
|
+
*/
|
|
260
|
+
async register(identity, context) {
|
|
261
|
+
if (this.mode === "factor" || !this.parameters.autoRegister) {
|
|
262
|
+
return undefined;
|
|
263
|
+
}
|
|
264
|
+
// The request session is not loaded yet: complete() logs a scratch session in
|
|
265
|
+
const ctx = context;
|
|
266
|
+
const previous = ctx.getSession();
|
|
267
|
+
const session = new Session();
|
|
268
|
+
ctx.setSession(session);
|
|
269
|
+
try {
|
|
270
|
+
const result = await runWithContext(ctx, () => useAuthentication().complete(identity));
|
|
271
|
+
if (result.status !== "ok" || !session.userId) {
|
|
272
|
+
return undefined;
|
|
273
|
+
}
|
|
274
|
+
const value = { userId: session.userId, identId: session.identUsed };
|
|
275
|
+
this.remember(identity.providerUid, value);
|
|
276
|
+
return value;
|
|
277
|
+
}
|
|
278
|
+
catch (err) {
|
|
279
|
+
this.log("WARN", `Cannot register the client certificate ${identity.providerUid}`, err?.message);
|
|
280
|
+
return undefined;
|
|
281
|
+
}
|
|
282
|
+
finally {
|
|
283
|
+
ctx.setSession(previous);
|
|
284
|
+
}
|
|
285
|
+
}
|
|
286
|
+
/**
|
|
287
|
+
* Link the client certificate of the request to the logged user
|
|
288
|
+
* @returns the auth result
|
|
289
|
+
* @throws WebdaError.Unauthorized when no user is logged
|
|
290
|
+
* @throws WebdaError.Forbidden when the request has no verified, accepted certificate with the identity field
|
|
291
|
+
*/
|
|
292
|
+
async link() {
|
|
293
|
+
const ctx = useContext();
|
|
294
|
+
if (!ctx.getSession()?.isLogged()) {
|
|
295
|
+
throw new WebdaError.Unauthorized("Login required");
|
|
296
|
+
}
|
|
297
|
+
const cert = ctx.getHttpContext?.()?.getClientCertificate?.();
|
|
298
|
+
if (!cert?.verified || !this.isAccepted(cert)) {
|
|
299
|
+
throw new WebdaError.Forbidden("A verified client certificate is required");
|
|
300
|
+
}
|
|
301
|
+
const identity = this.getIdentity(cert);
|
|
302
|
+
if (!identity) {
|
|
303
|
+
throw new WebdaError.Forbidden(`The client certificate has no ${this.parameters.identityField}`);
|
|
304
|
+
}
|
|
305
|
+
if (this.mode === "factor") {
|
|
306
|
+
const result = await useAuthentication().linkIdentity(identity);
|
|
307
|
+
this.cache.delete(identity.providerUid);
|
|
308
|
+
return result;
|
|
309
|
+
}
|
|
310
|
+
return useAuthentication().complete(identity);
|
|
311
|
+
}
|
|
312
|
+
},
|
|
313
|
+
(() => {
|
|
314
|
+
const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
|
|
315
|
+
_link_decorators = [Operation({ id: "Auth.Certificate.Link", rest: { method: "post", path: "auth/certificate/link" } })];
|
|
316
|
+
__esDecorate(_a, null, _link_decorators, { kind: "method", name: "link", static: false, private: false, access: { has: obj => "link" in obj, get: obj => obj.link }, metadata: _metadata }, null, _instanceExtraInitializers);
|
|
317
|
+
if (_metadata) Object.defineProperty(_a, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
|
|
318
|
+
})(),
|
|
319
|
+
_a.Parameters = CertificateProviderParameters,
|
|
320
|
+
_a;
|
|
321
|
+
})();
|
|
322
|
+
export { CertificateProvider };
|
|
323
|
+
/**
|
|
324
|
+
* @param value - an attribute value
|
|
325
|
+
* @returns the values as a list
|
|
326
|
+
*/
|
|
327
|
+
function values(value) {
|
|
328
|
+
if (value === undefined)
|
|
329
|
+
return [];
|
|
330
|
+
return Array.isArray(value) ? value : [value];
|
|
331
|
+
}
|
|
332
|
+
/**
|
|
333
|
+
* @param cert - client certificate
|
|
334
|
+
* @param type - subject alternative name type ("email", "URI", "DNS")
|
|
335
|
+
* @returns the names of that type
|
|
336
|
+
*/
|
|
337
|
+
function sanValues(cert, type) {
|
|
338
|
+
const prefix = `${type.toLowerCase()}:`;
|
|
339
|
+
return (cert.san ?? [])
|
|
340
|
+
.filter(name => name.toLowerCase().startsWith(prefix))
|
|
341
|
+
.map(name => name.substring(prefix.length));
|
|
342
|
+
}
|
|
343
|
+
//# sourceMappingURL=certificate.service.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"certificate.service.js","sourceRoot":"","sources":["../../src/certificate/certificate.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,EAML,KAAK,EACL,SAAS,EAIT,OAAO,EACP,iBAAiB,EACjB,OAAO,EACP,UAAU,EACV,2BAA2B,EAC3B,WAAW,EACX,cAAc,EACd,sBAAsB,EACtB,UAAU,EACX,MAAM,aAAa,CAAC;AACrB,OAAO,EAAqB,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAKtE,qCAAqC;AACrC,MAAM,OAAO,6BAA8B,SAAQ,iBAAiB;IAuClE;;;OAGG;IACH,IAAI,CAAC,MAAM,GAAQ,EAAE;QACnB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,IAAI,CAAC,IAAI,KAAT,IAAI,CAAC,IAAI,GAAK,OAAO,EAAC;QACtB,IAAI,CAAC,aAAa,KAAlB,IAAI,CAAC,aAAa,GAAK,gBAAgB,EAAC;QACxC,IAAI,CAAC,YAAY,KAAjB,IAAI,CAAC,YAAY,GAAK,KAAK,EAAC;QAC5B,IAAI,CAAC,QAAQ,KAAb,IAAI,CAAC,QAAQ,GAAK,KAAK,EAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,kEAAkE;AAClE,MAAM,SAAS,GAAG,KAAK,CAAC;AAExB;;;;;;;;;;;;GAYG;IACU,mBAAmB;;sBACtB,OAAO;;;sBADJ,mBACX,SAAQ,WAAU;;;gBAKT,iBAAY,IANV,mDAAmB,EAME,aAAa,EAAC;gBAO9C,oDAAoD;gBAC1C,UAAK,GAAG,IAAI,GAAG,EAA6D,CAAC;gBACvF,kCAAkC;gBACxB,kBAAa,GAAmB,EAAE,CAAC;YA8O/C,CAAC;YAtPC,uEAAuE;YACvE,IAAI,IAAI;gBACN,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAC9B,CAAC;YAOD,gBAAgB;YAChB,OAAO;gBACL,KAAK,CAAC,OAAO,EAAE,CAAC;gBAChB,2BAA2B,CAAC,IAAI,CAAC,CAAC;gBAClC,OAAO,IAAI,CAAC;YACd,CAAC;YAED,gBAAgB;YAChB,KAAK,CAAC,IAAI;gBACR,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;gBACnB,MAAM,IAAI,GAAG,iBAAiB,EAAE,CAAC;gBACjC,IAAI,IAAI,EAAE,CAAC;oBACT,uGAAuG;oBACvG,MAAM,UAAU,GAAG,CAAC,GAAQ,EAAE,EAAE;wBAC9B,IAAI,GAAG,EAAE,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;4BAC/C,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;wBAC3C,CAAC;oBACH,CAAC,CAAC;oBACF,IAAI,CAAC,EAAE,CAAC,yBAAgC,EAAE,UAAU,CAAC,CAAC;oBACtD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,yBAAgC,EAAE,UAAU,CAAC,CAAC,CAAC;gBACxF,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YAED,gBAAgB;YAChB,KAAK,CAAC,IAAI;gBACR,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;gBACrC,IAAI,CAAC,aAAa,GAAG,EAAE,CAAC;gBACxB,IAAI,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC;oBACtC,2BAA2B,CAAC,SAAS,CAAC,CAAC;gBACzC,CAAC;gBACD,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;YACrB,CAAC;YAED;;eAEG;YACH,aAAa;gBACX,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;YAC1D,CAAC;YAED;;;;eAIG;YACH,UAAU,CAAC,IAAuB;gBAChC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBACvB,IAAI,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,GAAG,IAAI,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,GAAG,EAAE,CAAC;oBACrE,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,MAAM,EAAE,cAAc,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;gBAC5D,IAAI,cAAc,EAAE,CAAC;oBACnB,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;oBACzD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;wBAC3D,OAAO,KAAK,CAAC;oBACf,CAAC;gBACH,CAAC;gBACD,IAAI,eAAe,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;oBAClG,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YAED;;;;eAIG;YACH,WAAW,CAAC,IAAuB;gBACjC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC1C,IAAI,WAA+B,CAAC;gBACpC,QAAQ,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC;oBACtC,KAAK,YAAY;wBACf,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;wBACzC,MAAM;oBACR,KAAK,WAAW;wBACd,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;wBAC9D,MAAM;oBACR,KAAK,SAAS;wBACZ,WAAW,GAAG,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;wBACxC,MAAM;oBACR;wBACE,WAAW,GAAG,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;gBACvE,CAAC;gBACD,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,OAAO,SAAS,CAAC;gBACnB,CAAC;gBACD,OAAO;oBACL,QAAQ,EAAE,IAAI,CAAC,YAAY;oBAC3B,0CAA0C;oBAC1C,WAAW,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;oBAClE,KAAK;oBACL,aAAa,EAAE,KAAK;oBACpB,GAAG,EAAE,CAAC,MAAM,CAAC;oBACb,OAAO,EAAE;wBACP,OAAO,EAAE,IAAI,CAAC,OAAO;wBACrB,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,YAAY,EAAE,IAAI,CAAC,YAAY;wBAC/B,cAAc,EAAE,IAAI,CAAC,cAAc;qBACpC;iBACF,CAAC;YACJ,CAAC;YAED;;;;eAIG;YACH,QAAQ,CAAC,IAAuB;gBAC9B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;gBAChC,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;oBAC3E,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;oBAC/B,IAAI,GAAG,GAAG,CAAC;wBAAE,SAAS;oBACtB,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;wBACnG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;oBAC3C,CAAC;gBACH,CAAC;gBACD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7C,CAAC;YAED;;;;;eAKG;YACH,KAAK,CAAC,kBAAkB,CAAC,IAAuB,EAAE,OAAgB;gBAChE,IAAI,CAAC,IAAI,EAAE,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC9C,OAAO,SAAS,CAAC;gBACnB,CAAC;gBACD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;gBACxC,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,OAAO,SAAS,CAAC;gBACnB,CAAC;gBACD,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;gBACtG,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YACtE,CAAC;YAED;;;;eAIG;YACO,KAAK,CAAC,QAAQ,CAAC,WAAmB;gBAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBAC3C,IAAI,MAAM,IAAI,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;oBAC1C,OAAO,MAAM,CAAC,KAAK,CAAC;gBACtB,CAAC;gBACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;gBAC/B,MAAM,KAAK,GAAsB,MAAM,WAAW,CAAC,KAAK,IAAI,EAAE;oBAC5D,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAC,aAAa,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;oBAC/F,OAAO,CAAC,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;gBACtD,CAAC,CAAC,CAAC;gBACH,MAAM,MAAM,GAAG,KAAK,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC;gBAC5C,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;oBACtB,OAAO,SAAS,CAAC;gBACnB,CAAC;gBACD,MAAM,KAAK,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;gBACnD,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;gBAClC,OAAO,KAAK,CAAC;YACf,CAAC;YAED;;;eAGG;YACO,QAAQ,CAAC,WAAmB,EAAE,KAA4B;gBAClE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;oBAC9B,OAAO;gBACT,CAAC;gBACD,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,SAAS,EAAE,CAAC;oBACjC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;gBACrB,CAAC;gBACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;YACzF,CAAC;YAED;;;;;;eAMG;YACO,KAAK,CAAC,QAAQ,CAAC,QAA0B,EAAE,OAAgB;gBACnE,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC;oBAC5D,OAAO,SAAS,CAAC;gBACnB,CAAC;gBACD,8EAA8E;gBAC9E,MAAM,GAAG,GAAG,OAA2B,CAAC;gBACxC,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC;gBAClC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;gBAC9B,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;gBACxB,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,iBAAiB,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;oBACvF,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;wBAC9C,OAAO,SAAS,CAAC;oBACnB,CAAC;oBACD,MAAM,KAAK,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;oBACrE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;oBAC3C,OAAO,KAAK,CAAC;gBACf,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,0CAA0C,QAAQ,CAAC,WAAW,EAAE,EAAG,GAAa,EAAE,OAAO,CAAC,CAAC;oBAC5G,OAAO,SAAS,CAAC;gBACnB,CAAC;wBAAS,CAAC;oBACT,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;gBAC3B,CAAC;YACH,CAAC;YAED;;;;;eAKG;YAEH,KAAK,CAAC,IAAI;gBACR,MAAM,GAAG,GAAG,UAAU,EAAO,CAAC;gBAC9B,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC;oBAClC,MAAM,IAAI,UAAU,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC;gBACtD,CAAC;gBACD,MAAM,IAAI,GAAkC,GAAG,CAAC,cAAc,EAAE,EAAE,EAAE,oBAAoB,EAAE,EAAE,CAAC;gBAC7F,IAAI,CAAC,IAAI,EAAE,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC9C,MAAM,IAAI,UAAU,CAAC,SAAS,CAAC,2CAA2C,CAAC,CAAC;gBAC9E,CAAC;gBACD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;gBACxC,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,IAAI,UAAU,CAAC,SAAS,CAAC,iCAAiC,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC;gBACnG,CAAC;gBACD,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC3B,MAAM,MAAM,GAAG,MAAM,iBAAiB,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;oBAChE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;oBACxC,OAAO,MAAM,CAAC;gBAChB,CAAC;gBACD,OAAO,iBAAiB,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAChD,CAAC;;;;gCApBA,SAAS,CAAC,EAAE,EAAE,EAAE,uBAAuB,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,EAAE,EAAE,CAAC;YACpG,6JAAM,IAAI,6DAmBT;;;QAzPM,aAAU,GAAG,6BAA8B;;;SAJvC,mBAAmB;AAgQhC;;;GAGG;AACH,SAAS,MAAM,CAAC,KAAoC;IAClD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,IAAuB,EAAE,IAAY;IACtD,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC;IACxC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;SACrD,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;AAChD,CAAC"}
|
|
@@ -0,0 +1,71 @@
|
|
|
1
|
+
import { Ident } from "@webda/core";
|
|
2
|
+
import type { ModelClass } from "@webda/models";
|
|
3
|
+
/**
|
|
4
|
+
* v3 ident records
|
|
5
|
+
*
|
|
6
|
+
* v3 stored idents under `"<providerUid>_<provider>"` (plain JSON, `__type: "Webda/Ident"`, `uuid` kept in the
|
|
7
|
+
* body). The core `Ident` repository addresses and queries them through `Ident.parseLegacyUID` (a model-level
|
|
8
|
+
* legacy key hook): they load as `Ident` instances without `providerUid`, recognised by `ident.getLegacyUID()`.
|
|
9
|
+
* Nothing else may use such an instance: it must go through {@link upgradeIdent} first.
|
|
10
|
+
*/
|
|
11
|
+
/**
|
|
12
|
+
* @param providerUid - uid on the provider
|
|
13
|
+
* @param provider - provider name
|
|
14
|
+
* @returns the v3 key `"<providerUid>_<provider>"`
|
|
15
|
+
*/
|
|
16
|
+
export declare function legacyKey(providerUid: string, provider: string): string;
|
|
17
|
+
/**
|
|
18
|
+
* Split a v3 key on its LAST "_" (provider names never contain "_", emails may)
|
|
19
|
+
* @param uuid - v3 key
|
|
20
|
+
* @returns the parts, or undefined when not a v3 key
|
|
21
|
+
*/
|
|
22
|
+
export declare function splitLegacyKey(uuid: string): {
|
|
23
|
+
providerUid: string;
|
|
24
|
+
provider: string;
|
|
25
|
+
} | undefined;
|
|
26
|
+
/**
|
|
27
|
+
* Whether a row loaded under a v3 key really is a v3 ident of this application
|
|
28
|
+
*
|
|
29
|
+
* The row must be an instance of the ident model, carry a v3 key and be stored untyped, as `Webda/Ident`, or as
|
|
30
|
+
* the ident model, one of its ancestors or transitive subclasses: a v3-looking key of a shared store may hold
|
|
31
|
+
* another model's row.
|
|
32
|
+
* @param row - the loaded row
|
|
33
|
+
* @param IdentModel - ident model of the application
|
|
34
|
+
* @returns true for a v3 ident
|
|
35
|
+
*/
|
|
36
|
+
export declare function isLegacyIdent(row: any, IdentModel?: ModelClass<Ident>): row is Ident;
|
|
37
|
+
/**
|
|
38
|
+
* Upgrade a v3 ident: create the `"<providerUid>:<provider>"` record, then delete the v3 one
|
|
39
|
+
*
|
|
40
|
+
* Idempotent and crash-safe: when the new record already exists (an earlier upgrade stopped before the delete,
|
|
41
|
+
* or a concurrent one won) it is kept as is and only the v3 record is deleted. Field map: `_user` → owner,
|
|
42
|
+
* `_validation` → `verifiedAt`, `_lastUsed` → `lastUsedAt`, `_failedLogin` → `_loginAttempts`,
|
|
43
|
+
* `_lastFailedLogin` → `_lastLoginAttemptAt` (number or date; absent, the count is treated as an expired lock),
|
|
44
|
+
* `_lastValidationEmail` → `_throttle.lastSentAt`; `email`, `__profile` are kept, `__tokens` is encrypted into `tokens`; provider is
|
|
45
|
+
* `provider ?? _type ?? key suffix`, providerUid the key prefix (normalised for the email provider: v3 kept the
|
|
46
|
+
* email case). Callers run it as system.
|
|
47
|
+
* @throws Error when `legacy` is not a v3 ident (see {@link isLegacyIdent})
|
|
48
|
+
* @throws IdentConflict when the upgraded key exists, or is created concurrently, with another owner: the v3
|
|
49
|
+
* record is kept for a manual resolution
|
|
50
|
+
* @param legacy - a v3 ident (`legacy.getLegacyUID()` is set)
|
|
51
|
+
* @param IdentModel - ident model of the application
|
|
52
|
+
* @param options - options
|
|
53
|
+
* @param options.dryRun - run the checks only: nothing is written, the returned ident is not saved
|
|
54
|
+
* @returns the upgraded ident
|
|
55
|
+
*/
|
|
56
|
+
export declare function upgradeIdent(legacy: Ident, IdentModel?: ModelClass<Ident>, options?: {
|
|
57
|
+
dryRun?: boolean;
|
|
58
|
+
}): Promise<Ident>;
|
|
59
|
+
/**
|
|
60
|
+
* Enumerate the v3 idents of a store, for a batch migration (`webda auth migrate`)
|
|
61
|
+
*
|
|
62
|
+
* Iterates the ident model (all idents, the v3 ones are filtered client side: they lack `providerUid`, which
|
|
63
|
+
* stores cannot portably query for) and yields only the v3 records. Pass each to {@link upgradeIdent}.
|
|
64
|
+
* Upgrading deletes records, which shifts offset-based pagination (memory and file stores page by position):
|
|
65
|
+
* a migration upgrading while iterating must run passes until one yields nothing (upgrades are idempotent).
|
|
66
|
+
* @param IdentModel - ident model of the application
|
|
67
|
+
* @param query - optional WebdaQL filter, e.g. `"_user = 'uid'"`
|
|
68
|
+
* @returns the v3 idents
|
|
69
|
+
*/
|
|
70
|
+
export declare function legacyIdents(IdentModel?: ModelClass<Ident>, query?: string): AsyncGenerator<Ident>;
|
|
71
|
+
//# sourceMappingURL=upgrade.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"upgrade.d.ts","sourceRoot":"","sources":["../../src/compat/upgrade.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAGhD;;;;;;;GAOG;AAEH;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEvE;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAElG;AAyBD;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,GAAE,UAAU,CAAC,KAAK,CAAgB,GAAG,GAAG,IAAI,KAAK,CAMlG;AAyCD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,KAAK,EACb,UAAU,GAAE,UAAU,CAAC,KAAK,CAAgB,EAC5C,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GACjC,OAAO,CAAC,KAAK,CAAC,CAqDhB;AAED;;;;;;;;;;GAUG;AACH,wBAAuB,YAAY,CACjC,UAAU,GAAE,UAAU,CAAC,KAAK,CAAgB,EAC5C,KAAK,GAAE,MAAW,GACjB,cAAc,CAAC,KAAK,CAAC,CAMvB"}
|