@webda/auth 0.0.0-stage → 4.0.0-beta.4

package/lib/provider.js

@@ -0,0 +1,55 @@
+import { useDynamicService } from "@webda/core";
+import { EmailDomainNotAllowed } from "./errors.js";
+/**
+ * @param email - an email address
+ * @returns the lowercased part after the last "@", undefined if none
+ */
+export function emailDomain(email) {
+    const idx = email.lastIndexOf("@");
+    return idx < 0
+        ? undefined
+        : email
+            .substring(idx + 1)
+            .trim()
+            .toLowerCase();
+}
+/**
+ * Apply a provider email policy to a resolved identity without mutating it
+ * @param identity - identity asserted by the provider
+ * @param policy - the provider policy, if any
+ * @returns the identity to use (a copy with emailVerified forced to false when the claim is not trusted)
+ * @throws EmailDomainNotAllowed when the email is missing or its domain is not allowed
+ */
+export function applyEmailPolicy(identity, policy) {
+    if (!policy)
+        return identity;
+    const domain = identity.email ? emailDomain(identity.email) : undefined;
+    const norm = (list) => list.map(d => d.trim().toLowerCase());
+    const trust = policy.trustEmailVerification;
+    let out = identity;
+    if (identity.emailVerified && trust !== undefined && trust !== true) {
+        if (trust === false || !domain || !norm(trust).includes(domain)) {
+            out = { ...identity, emailVerified: false };
+        }
+    }
+    // The allow-list only admits a present, listed and (still) verified email
+    if (policy.allowedEmailDomains &&
+        (!domain || !out.emailVerified || !norm(policy.allowedEmailDomains).includes(domain))) {
+        throw new EmailDomainNotAllowed();
+    }
+    return out;
+}
+/**
+ * @param service - any service
+ * @returns true when it implements AuthProvider
+ */
+export function isAuthProvider(service) {
+    return !!service && typeof service.providerName === "string" && typeof service.getPublicInfo === "function";
+}
+/**
+ * @returns the Authentication service
+ */
+export function useAuthentication() {
+    return useDynamicService("Authentication");
+}
+//# sourceMappingURL=provider.js.map

package/lib/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0D,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAExG,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAgCpD;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACnC,OAAO,GAAG,GAAG,CAAC;QACZ,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,KAAK;aACF,SAAS,CAAC,GAAG,GAAG,CAAC,CAAC;aAClB,IAAI,EAAE;aACN,WAAW,EAAE,CAAC;AACvB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAA0B,EAC1B,MAAuC;IAEvC,IAAI,CAAC,MAAM;QAAE,OAAO,QAAQ,CAAC;IAC7B,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxE,MAAM,IAAI,GAAG,CAAC,IAAc,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG,MAAM,CAAC,sBAAsB,CAAC;IAC5C,IAAI,GAAG,GAAG,QAAQ,CAAC;IACnB,IAAI,QAAQ,CAAC,aAAa,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACpE,IAAI,KAAK,KAAK,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAChE,GAAG,GAAG,EAAE,GAAG,QAAQ,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;QAC9C,CAAC;IACH,CAAC;IACD,0EAA0E;IAC1E,IACE,MAAM,CAAC,mBAAmB;QAC1B,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EACrF,CAAC;QACD,MAAM,IAAI,qBAAqB,EAAE,CAAC;IACpC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,OAAY;IACzC,OAAO,CAAC,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,aAAa,KAAK,UAAU,CAAC;AAC9G,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,iBAAiB,CAAiB,gBAAgB,CAAC,CAAC;AAC7D,CAAC"}

package/lib/test/authtest.d.ts

@@ -0,0 +1,39 @@
+import { WebContext } from "@webda/core";
+import { WebdaApplicationTest } from "@webda/core/lib/test/application.js";
+import { DebugMailer } from "@webda/core/lib/services/debugmailer.service.js";
+/**
+ * Base class for @webda/auth specs
+ */
+export declare abstract class AuthTest extends WebdaApplicationTest {
+    mailer: DebugMailer;
+    /** @override */
+    beforeEach(): Promise<void>;
+    /**
+     * @param body - request body
+     * @returns a fresh web context with a session
+     */
+    ctx(body?: any): Promise<WebContext>;
+    /**
+     * Run code inside a context
+     * @param ctx - context
+     * @param fn - code
+     * @returns fn result
+     */
+    inContext<T>(ctx: WebContext, fn: () => Promise<T>): Promise<T>;
+    /**
+     * Call an operation by id and parse its JSON output.
+     *
+     * Input is passed as the request body: a fresh `WebContext` is created for every call (the
+     * input and the output are cached per context) and carries the session of `ctx`. The session
+     * is copied back to `ctx` afterwards so a login in one call is visible in the next one.
+     * Operations with an input schema receive the body fields as positional arguments, others
+     * receive the body object as their single argument.
+     * @param operationId - e.g. "Auth.Email.Login"
+     * @param input - operation input (request body)
+     * @param ctx - context to reuse (keeps the session between calls)
+     * @param headers - request headers, a JSON request by default
+     * @returns parsed output
+     */
+    op<T = any>(operationId: string, input?: any, ctx?: WebContext, headers?: Record<string, string>): Promise<T>;
+}
+//# sourceMappingURL=authtest.d.ts.map

package/lib/test/authtest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authtest.d.ts","sourceRoot":"","sources":["../../src/test/authtest.ts"],"names":[],"mappings":"AAAA,OAAO,EAA8C,UAAU,EAAE,MAAM,aAAa,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,iDAAiD,CAAC;AAE9E;;GAEG;AACH,8BAAsB,QAAS,SAAQ,oBAAoB;IACzD,MAAM,EAAE,WAAW,CAAC;IAEpB,gBAAgB;IACV,UAAU,kBAIf;IAED;;;OAGG;IACG,GAAG,CAAC,IAAI,GAAE,GAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,CAI7C;IAED;;;;;OAKG;IACH,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAE9D;IAED;;;;;;;;;;;;;OAaG;IACG,EAAE,CAAC,CAAC,GAAG,GAAG,EACd,WAAW,EAAE,MAAM,EACnB,KAAK,GAAE,GAAQ,EACf,GAAG,CAAC,EAAE,UAAU,EAChB,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAA0C,GACvE,OAAO,CAAC,CAAC,CAAC,CAaZ;CACF"}

package/lib/test/authtest.js

@@ -0,0 +1,62 @@
+import { callOperation, HttpContext, runWithContext } from "@webda/core";
+import { WebdaApplicationTest } from "@webda/core/lib/test/application.js";
+/**
+ * Base class for @webda/auth specs
+ */
+export class AuthTest extends WebdaApplicationTest {
+    /** @override */
+    async beforeEach() {
+        await super.beforeEach();
+        this.mailer = this.getService("DefinedMailer");
+        if (this.mailer)
+            this.mailer.sent = [];
+    }
+    /**
+     * @param body - request body
+     * @returns a fresh web context with a session
+     */
+    async ctx(body = {}) {
+        const ctx = await this.newContext(body);
+        ctx.newSession();
+        return ctx;
+    }
+    /**
+     * Run code inside a context
+     * @param ctx - context
+     * @param fn - code
+     * @returns fn result
+     */
+    inContext(ctx, fn) {
+        return runWithContext(ctx, fn);
+    }
+    /**
+     * Call an operation by id and parse its JSON output.
+     *
+     * Input is passed as the request body: a fresh `WebContext` is created for every call (the
+     * input and the output are cached per context) and carries the session of `ctx`. The session
+     * is copied back to `ctx` afterwards so a login in one call is visible in the next one.
+     * Operations with an input schema receive the body fields as positional arguments, others
+     * receive the body object as their single argument.
+     * @param operationId - e.g. "Auth.Email.Login"
+     * @param input - operation input (request body)
+     * @param ctx - context to reuse (keeps the session between calls)
+     * @param headers - request headers, a JSON request by default
+     * @returns parsed output
+     */
+    async op(operationId, input = {}, ctx, headers = { "content-type": "application/json" }) {
+        ctx ?? (ctx = await this.ctx());
+        const http = new HttpContext("test.webda.io", "POST", "/", "http", 80, headers);
+        http.setBody(input);
+        const call = await this.newWebContext(http);
+        call.setSession(ctx.getSession());
+        try {
+            await runWithContext(call, () => callOperation(call, operationId));
+        }
+        finally {
+            ctx.setSession(call.getSession());
+        }
+        const body = call.getResponseBody();
+        return body ? JSON.parse(body.toString()) : undefined;
+    }
+}
+//# sourceMappingURL=authtest.js.map

package/lib/test/authtest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authtest.js","sourceRoot":"","sources":["../../src/test/authtest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,cAAc,EAAc,MAAM,aAAa,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAG3E;;GAEG;AACH,MAAM,OAAgB,QAAS,SAAQ,oBAAoB;IAGzD,gBAAgB;IAChB,KAAK,CAAC,UAAU;QACd,MAAM,KAAK,CAAC,UAAU,EAAE,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,UAAU,CAAM,eAAe,CAAgB,CAAC;QACnE,IAAI,IAAI,CAAC,MAAM;YAAE,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;IACzC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,GAAG,CAAC,IAAI,GAAQ,EAAE;QACtB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAa,IAAI,CAAC,CAAC;QACpD,GAAG,CAAC,UAAU,EAAE,CAAC;QACjB,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;OAKG;IACH,SAAS,CAAI,GAAe,EAAE,EAAoB;QAChD,OAAO,cAAc,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,EAAE,CACN,WAAmB,EACnB,KAAK,GAAQ,EAAE,EACf,GAAgB,EAChB,OAAO,GAA2B,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAExE,GAAG,KAAH,GAAG,GAAK,MAAM,IAAI,CAAC,GAAG,EAAE,EAAC;QACzB,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC,eAAe,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;QAChF,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACpB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAa,IAAI,CAAC,CAAC;QACxD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,cAAc,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;QACrE,CAAC;gBAAS,CAAC;YACT,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxD,CAAC;CACF"}

package/lib/test/emailtest.d.ts

@@ -0,0 +1,25 @@
+import type { TestApplication } from "@webda/core/lib/test/objects.js";
+import { AuthTest } from "./authtest.js";
+import type { Authentication } from "../authentication.service.js";
+import type { EmailPasswordProvider } from "../email/emailpassword.service.js";
+/**
+ * Base class for email/password provider specs, using the full test/config.json
+ */
+export declare abstract class EmailTest extends AuthTest {
+    auth: Authentication;
+    email: EmailPasswordProvider;
+    /** @override */
+    tweakApp(app: TestApplication): Promise<void>;
+    /** @override */
+    beforeEach(): Promise<void>;
+    /**
+     * @returns the url of the last sent email
+     */
+    lastMailUrl(): string;
+    /**
+     * @param url - an emailed link
+     * @returns its token query parameter
+     */
+    tokenOf(url: string): string;
+}
+//# sourceMappingURL=emailtest.d.ts.map

package/lib/test/emailtest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"emailtest.d.ts","sourceRoot":"","sources":["../../src/test/emailtest.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAE/E;;GAEG;AACH,8BAAsB,SAAU,SAAQ,QAAQ;IAC9C,IAAI,EAAE,cAAc,CAAC;IACrB,KAAK,EAAE,qBAAqB,CAAC;IAE7B,gBAAgB;IACV,QAAQ,CAAC,GAAG,EAAE,eAAe,iBAIlC;IAED,gBAAgB;IACV,UAAU,kBASf;IAED;;OAEG;IACH,WAAW,IAAI,MAAM,CAEpB;IAED;;;OAGG;IACH,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE3B;CACF"}

package/lib/test/emailtest.js

@@ -0,0 +1,39 @@
+import { useService } from "@webda/core";
+import { AuthTest } from "./authtest.js";
+import { addStubProviders } from "./stubprovider.js";
+/**
+ * Base class for email/password provider specs, using the full test/config.json
+ */
+export class EmailTest extends AuthTest {
+    /** @override */
+    async tweakApp(app) {
+        await super.tweakApp(app);
+        // test/config.json declares a "google" provider of this type
+        addStubProviders(app, "google");
+    }
+    /** @override */
+    async beforeEach() {
+        await super.beforeEach();
+        this.auth = useService("Authentication");
+        this.email = useService("emailAuth");
+        const params = this.email.getParameters();
+        params.verification = "after";
+        params.throttle = { resendDelay: 14400000, failedBeforeDelay: 3, lockout: 900000 };
+        params.password = { policy: ".{8,}" };
+        this.email.resolve();
+    }
+    /**
+     * @returns the url of the last sent email
+     */
+    lastMailUrl() {
+        return this.mailer.sent[this.mailer.sent.length - 1].replacements.url;
+    }
+    /**
+     * @param url - an emailed link
+     * @returns its token query parameter
+     */
+    tokenOf(url) {
+        return new URL(url, "http://localhost").searchParams.get("token");
+    }
+}
+//# sourceMappingURL=emailtest.js.map

package/lib/test/emailtest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"emailtest.js","sourceRoot":"","sources":["../../src/test/emailtest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAIrD;;GAEG;AACH,MAAM,OAAgB,SAAU,SAAQ,QAAQ;IAI9C,gBAAgB;IAChB,KAAK,CAAC,QAAQ,CAAC,GAAoB;QACjC,MAAM,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC1B,6DAA6D;QAC7D,gBAAgB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAClC,CAAC;IAED,gBAAgB;IAChB,KAAK,CAAC,UAAU;QACd,MAAM,KAAK,CAAC,UAAU,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,gBAAuB,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,WAAkB,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;QAC1C,MAAM,CAAC,YAAY,GAAG,OAAO,CAAC;QAC9B,MAAM,CAAC,QAAQ,GAAG,EAAE,WAAW,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QACnF,MAAM,CAAC,QAAQ,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QACtC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,WAAW;QACT,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC;IACxE,CAAC;IAED;;;OAGG;IACH,OAAO,CAAC,GAAW;QACjB,OAAO,IAAI,GAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACpE,CAAC;CACF"}

package/lib/test/fakeoauth.service.d.ts

@@ -0,0 +1,45 @@
+import type { ResolvedIdentity } from "@webda/core";
+import { type OAuthAuthorizationRequest, type OAuthCallbackRequest, OAuthProvider, OAuthProviderParameters, type OAuthTokenRequest } from "../oauth/oauth.service.js";
+/**
+ * OAuth provider used by the specs: no network, codes and tokens describe the identity
+ *
+ * A code (or token) is `<sub>,<email>,<verified 0|1>[,<provider override>]`; `bad` throws TokenInvalid, a value
+ * starting with `boom` a plain Error whose message contains the value. Every exchange is recorded in `calls`.
+ */
+export declare class FakeOAuthProvider extends OAuthProvider {
+    readonly providerName = "fake";
+    /**
+     * Registered with addModda (no module metadata): build the parameters like a compiled modda would
+     * @param params - raw parameters
+     * @returns the loaded parameters
+     */
+    static createConfiguration(params: any): OAuthProviderParameters;
+    /** Recorded exchanges */
+    calls: {
+        method: string;
+        value: string;
+        request?: any;
+    }[];
+    /**
+     * @param request - authorization request
+     * @returns the fake authorization url
+     */
+    getAuthorizationUrl(request: OAuthAuthorizationRequest): string;
+    /**
+     * @param value - code or token
+     * @param tokens - tokens to attach
+     * @returns the identity it describes
+     */
+    protected identityOf(value: string, tokens?: any): ResolvedIdentity;
+    /**
+     * @param request - callback request
+     * @returns identity
+     */
+    handleCallback(request: OAuthCallbackRequest): Promise<ResolvedIdentity>;
+    /**
+     * @param request - token request
+     * @returns identity
+     */
+    handleToken(request: OAuthTokenRequest): Promise<ResolvedIdentity>;
+}
+//# sourceMappingURL=fakeoauth.service.d.ts.map

package/lib/test/fakeoauth.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fakeoauth.service.d.ts","sourceRoot":"","sources":["../../src/test/fakeoauth.service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,OAAO,EACL,KAAK,yBAAyB,EAC9B,KAAK,oBAAoB,EACzB,aAAa,EACb,uBAAuB,EACvB,KAAK,iBAAiB,EACvB,MAAM,2BAA2B,CAAC;AAEnC;;;;;GAKG;AACH,qBAAa,iBAAkB,SAAQ,aAAa;IAClD,QAAQ,CAAC,YAAY,UAAU;IAE/B;;;;OAIG;IACH,MAAM,CAAC,mBAAmB,CAAC,MAAM,EAAE,GAAG,GAAG,uBAAuB,CAE/D;IAED,yBAAyB;IACzB,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,GAAG,CAAA;KAAE,EAAE,CAAM;IAE/D;;;OAGG;IACH,mBAAmB,CAAC,OAAO,EAAE,yBAAyB,GAAG,MAAM,CAU9D;IAED;;;;OAIG;IACH,SAAS,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,GAAG,GAAG,gBAAgB,CAalE;IAED;;;OAGG;IACG,cAAc,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAG7E;IAED;;;OAGG;IACG,WAAW,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAIvE;CACF"}

package/lib/test/fakeoauth.service.js

@@ -0,0 +1,78 @@
+import { TokenInvalid } from "../errors.js";
+import { OAuthProvider, OAuthProviderParameters } from "../oauth/oauth.service.js";
+/**
+ * OAuth provider used by the specs: no network, codes and tokens describe the identity
+ *
+ * A code (or token) is `<sub>,<email>,<verified 0|1>[,<provider override>]`; `bad` throws TokenInvalid, a value
+ * starting with `boom` a plain Error whose message contains the value. Every exchange is recorded in `calls`.
+ */
+export class FakeOAuthProvider extends OAuthProvider {
+    constructor() {
+        super(...arguments);
+        this.providerName = "fake";
+        /** Recorded exchanges */
+        this.calls = [];
+    }
+    /**
+     * Registered with addModda (no module metadata): build the parameters like a compiled modda would
+     * @param params - raw parameters
+     * @returns the loaded parameters
+     */
+    static createConfiguration(params) {
+        return new OAuthProviderParameters().load(params);
+    }
+    /**
+     * @param request - authorization request
+     * @returns the fake authorization url
+     */
+    getAuthorizationUrl(request) {
+        const url = new URL("https://idp.example/authorize");
+        url.searchParams.set("state", request.state);
+        url.searchParams.set("redirect_uri", request.redirectUri);
+        url.searchParams.set("scope", request.scope.join(" "));
+        url.searchParams.set("client_id", this.parameters.client_id);
+        url.searchParams.set("code_challenge", request.codeChallenge);
+        url.searchParams.set("code_challenge_method", request.codeChallengeMethod);
+        url.searchParams.set("nonce", request.nonce);
+        return url.toString();
+    }
+    /**
+     * @param value - code or token
+     * @param tokens - tokens to attach
+     * @returns the identity it describes
+     */
+    identityOf(value, tokens) {
+        if (value === "bad")
+            throw new TokenInvalid();
+        if (value?.startsWith("boom"))
+            throw new Error(`secret internal failure: ${value}`);
+        const [sub, email, verified, provider] = value.split(",");
+        return {
+            provider: provider ?? this.providerName,
+            providerUid: sub,
+            email: email || undefined,
+            emailVerified: verified === "1",
+            profile: { name: `Fake ${sub}` },
+            tokens: tokens ?? { access_token: `at-${sub}` },
+            amr: ["oauth"]
+        };
+    }
+    /**
+     * @param request - callback request
+     * @returns identity
+     */
+    async handleCallback(request) {
+        this.calls.push({ method: "callback", value: request.code, request });
+        return this.identityOf(request.code);
+    }
+    /**
+     * @param request - token request
+     * @returns identity
+     */
+    async handleToken(request) {
+        const value = request.token ?? request.tokens?.id_token;
+        this.calls.push({ method: "token", value, request });
+        return this.identityOf(value, request.tokens);
+    }
+}
+//# sourceMappingURL=fakeoauth.service.js.map

package/lib/test/fakeoauth.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fakeoauth.service.js","sourceRoot":"","sources":["../../src/test/fakeoauth.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAGL,aAAa,EACb,uBAAuB,EAExB,MAAM,2BAA2B,CAAC;AAEnC;;;;;GAKG;AACH,MAAM,OAAO,iBAAkB,SAAQ,aAAa;IAApD;;QACW,iBAAY,GAAG,MAAM,CAAC;QAW/B,yBAAyB;QACzB,UAAK,GAAuD,EAAE,CAAC;IAwDjE,CAAC;IAlEC;;;;OAIG;IACH,MAAM,CAAC,mBAAmB,CAAC,MAAW;QACpC,OAAO,IAAI,uBAAuB,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpD,CAAC;IAKD;;;OAGG;IACH,mBAAmB,CAAC,OAAkC;QACpD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,+BAA+B,CAAC,CAAC;QACrD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QAC1D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACvD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC7D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;QAC9D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;QAC3E,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7C,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAED;;;;OAIG;IACO,UAAU,CAAC,KAAa,EAAE,MAAY;QAC9C,IAAI,KAAK,KAAK,KAAK;YAAE,MAAM,IAAI,YAAY,EAAE,CAAC;QAC9C,IAAI,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,KAAK,EAAE,CAAC,CAAC;QACpF,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1D,OAAO;YACL,QAAQ,EAAE,QAAQ,IAAI,IAAI,CAAC,YAAY;YACvC,WAAW,EAAE,GAAG;YAChB,KAAK,EAAE,KAAK,IAAI,SAAS;YACzB,aAAa,EAAE,QAAQ,KAAK,GAAG;YAC/B,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,GAAG,EAAE,EAAE;YAChC,MAAM,EAAE,MAAM,IAAI,EAAE,YAAY,EAAE,MAAM,GAAG,EAAE,EAAE;YAC/C,GAAG,EAAE,CAAC,OAAO,CAAC;SACf,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,cAAc,CAAC,OAA6B;QAChD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACtE,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,CAAC,OAA0B;QAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC;QACxD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC;CACF"}

package/lib/test/stubprovider.js

@@ -0,0 +1,37 @@
+import { Service } from "@webda/core";
+/**
+ * @param name - provider name
+ * @returns a minimal AuthProvider service class named `name` (specs call complete() on its behalf)
+ */
+export function stubProvider(name) {
+    return class StubProvider extends Service {
+        constructor() {
+            super(...arguments);
+            this.providerName = name;
+        }
+        /**
+         * @returns public info
+         */
+        getPublicInfo() {
+            return { name, type: "oauth", startUrl: `/auth/${name}` };
+        }
+    };
+}
+/**
+ * Register stub providers in a test application: add `<name>: { type: "WebdaTest/Stub_<name>" }` to the services
+ * @param app - test application
+ * @param names - provider names
+ */
+export function addStubProviders(app, ...names) {
+    for (const name of names) {
+        app.addModda(`WebdaTest/Stub_${name}`, stubProvider(name));
+    }
+}
+/**
+ * @param names - provider names
+ * @returns the services configuration of the stub providers
+ */
+export function stubProvidersConfig(...names) {
+    return Object.fromEntries(names.map(name => [`${name}Stub`, { type: `WebdaTest/Stub_${name}` }]));
+}
+//# sourceMappingURL=stubprovider.js.map

package/lib/test/stubprovider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stubprovider.js","sourceRoot":"","sources":["../../src/test/stubprovider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAGtC;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,OAAO,MAAM,YAAa,SAAQ,OAAO;QAAlC;;YACI,iBAAY,GAAG,IAAI,CAAC;QAQ/B,CAAC;QANC;;WAEG;QACH,aAAa;YACX,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAgB,EAAE,QAAQ,EAAE,SAAS,IAAI,EAAE,EAAE,CAAC;QACrE,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAoB,EAAE,GAAG,KAAe;IACvE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,GAAG,CAAC,QAAQ,CAAC,kBAAkB,IAAI,EAAE,EAAE,YAAY,CAAC,IAAI,CAAQ,CAAC,CAAC;IACpE,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAG,KAAe;IACpD,OAAO,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,MAAM,EAAE,EAAE,IAAI,EAAE,kBAAkB,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AACpG,CAAC"}

package/lib/test/v3.d.ts

@@ -0,0 +1,29 @@
+/** Writes a raw row into a store's backing storage */
+export type RawWriter = (key: string, row: any) => void;
+/**
+ * Seed a v3 email user and its ident RAW (Ruling R1): the v3 layout is written straight into the storage,
+ * bypassing model constructors and serializers
+ * @param write - raw storage writer (MemoryStore storage map, FileStore folder, ...)
+ * @param email - email (normalised)
+ * @param opts - options
+ * @param opts.validated - whether the v3 ident was validated
+ * @param opts.password - clear password hashed into `__password`
+ * @param opts.userId - user uuid
+ * @returns the user uuid
+ */
+export declare function seedV3(write: RawWriter, email: string, opts: {
+    validated: boolean;
+    password: string;
+    userId?: string;
+}): Promise<string>;
+/**
+ * Seed a raw v3 ident `"<uid>_<provider>"`
+ * @param write - raw storage writer
+ * @param uid - provider uid
+ * @param provider - provider
+ * @param userId - owner uuid
+ * @param extra - extra v3 fields
+ * @returns the v3 key
+ */
+export declare function seedV3Ident(write: RawWriter, uid: string, provider: string, userId: string, extra?: any): string;
+//# sourceMappingURL=v3.d.ts.map

package/lib/test/v3.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"v3.d.ts","sourceRoot":"","sources":["../../src/test/v3.ts"],"names":[],"mappings":"AAEA,sDAAsD;AACtD,MAAM,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC;AAExD;;;;;;;;;;GAUG;AACH,wBAAsB,MAAM,CAC1B,KAAK,EAAE,SAAS,EAChB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9D,OAAO,CAAC,MAAM,CAAC,CAmBjB;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,GAAE,GAAQ,GAAG,MAAM,CAIpH"}

package/lib/test/v3.js

@@ -0,0 +1,47 @@
+import { Password } from "@webda/core";
+/**
+ * Seed a v3 email user and its ident RAW (Ruling R1): the v3 layout is written straight into the storage,
+ * bypassing model constructors and serializers
+ * @param write - raw storage writer (MemoryStore storage map, FileStore folder, ...)
+ * @param email - email (normalised)
+ * @param opts - options
+ * @param opts.validated - whether the v3 ident was validated
+ * @param opts.password - clear password hashed into `__password`
+ * @param opts.userId - user uuid
+ * @returns the user uuid
+ */
+export async function seedV3(write, email, opts) {
+    const hash = new Password();
+    await hash.set(opts.password);
+    const userId = opts.userId ?? `v3-${email}`;
+    write(userId, {
+        uuid: userId,
+        __type: "Webda/User",
+        email,
+        displayName: email,
+        __password: hash.__hash,
+        _lastPasswordRecovery: 0
+    });
+    seedV3Ident(write, email, "email", userId, {
+        email,
+        _failedLogin: 1,
+        _lastValidationEmail: 42,
+        ...(opts.validated ? { _validation: "2020-01-01T00:00:00.000Z" } : {})
+    });
+    return userId;
+}
+/**
+ * Seed a raw v3 ident `"<uid>_<provider>"`
+ * @param write - raw storage writer
+ * @param uid - provider uid
+ * @param provider - provider
+ * @param userId - owner uuid
+ * @param extra - extra v3 fields
+ * @returns the v3 key
+ */
+export function seedV3Ident(write, uid, provider, userId, extra = {}) {
+    const key = `${uid}_${provider}`;
+    write(key, { uuid: key, __type: "Webda/Ident", _type: provider, _user: userId, ...extra });
+    return key;
+}
+//# sourceMappingURL=v3.js.map

package/lib/test/v3.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"v3.js","sourceRoot":"","sources":["../../src/test/v3.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAKvC;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,KAAgB,EAChB,KAAa,EACb,IAA+D;IAE/D,MAAM,IAAI,GAAG,IAAI,QAAQ,EAAE,CAAC;IAC5B,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,EAAE,CAAC;IAC5C,KAAK,CAAC,MAAM,EAAE;QACZ,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,YAAY;QACpB,KAAK;QACL,WAAW,EAAE,KAAK;QAClB,UAAU,EAAE,IAAI,CAAC,MAAM;QACvB,qBAAqB,EAAE,CAAC;KACzB,CAAC,CAAC;IACH,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE;QACzC,KAAK;QACL,YAAY,EAAE,CAAC;QACf,oBAAoB,EAAE,EAAE;QACxB,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,0BAA0B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvE,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,KAAgB,EAAE,GAAW,EAAE,QAAgB,EAAE,MAAc,EAAE,KAAK,GAAQ,EAAE;IAC1G,MAAM,GAAG,GAAG,GAAG,GAAG,IAAI,QAAQ,EAAE,CAAC;IACjC,KAAK,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;IAC3F,OAAO,GAAG,CAAC;AACb,CAAC"}

package/lib/throttle.d.ts

@@ -0,0 +1,40 @@
+import type { Ident, IdentThrottle } from "@webda/core";
+/** Login failure state of an ident: its top-level `_loginAttempts` / `_lastLoginAttemptAt` attributes */
+export type LoginAttempts = Pick<Ident, "_loginAttempts" | "_lastLoginAttemptAt">;
+/**
+ * Check if an ident is locked due to too many failed logins
+ * @param s - login failure state (an ident)
+ * @param failedBefore - failures before locking
+ * @param lockoutMs - lock duration after the last attempt
+ * @param now - clock
+ * @returns true while locked
+ */
+export declare function isLocked(s: LoginAttempts, failedBefore: number, lockoutMs: number, now?: number): boolean;
+/**
+ * Record a failure in the login failure state
+ * @param s - login failure state
+ * @param now - clock
+ * @returns state with one more failure
+ */
+export declare function recordFailure(s: LoginAttempts, now?: number): LoginAttempts;
+/**
+ * Clear all login failures
+ * @returns state with failures cleared
+ */
+export declare function resetFailures(): LoginAttempts;
+/**
+ * Check if a message can be sent based on throttle delay
+ * @param t - throttle state
+ * @param delayMs - minimal delay between two emails
+ * @param now - clock
+ * @returns true when an email may be sent
+ */
+export declare function canSend(t: IdentThrottle, delayMs: number, now?: number): boolean;
+/**
+ * Mark that a message was sent
+ * @param t - throttle state
+ * @param now - clock
+ * @returns state with the send timestamp set
+ */
+export declare function markSent(t: IdentThrottle, now?: number): IdentThrottle;
+//# sourceMappingURL=throttle.d.ts.map

package/lib/throttle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"throttle.d.ts","sourceRoot":"","sources":["../src/throttle.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAExD,yGAAyG;AACzG,MAAM,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,EAAE,gBAAgB,GAAG,qBAAqB,CAAC,CAAC;AAElF;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CAAC,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,GAAE,MAAmB,GAAG,OAAO,CAErH;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,aAAa,EAAE,GAAG,GAAE,MAAmB,GAAG,aAAa,CAEvF;AAED;;;GAGG;AACH,wBAAgB,aAAa,IAAI,aAAa,CAE7C;AAED;;;;;;GAMG;AACH,wBAAgB,OAAO,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,GAAE,MAAmB,GAAG,OAAO,CAE5F;AAED;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,CAAC,EAAE,aAAa,EAAE,GAAG,GAAE,MAAmB,GAAG,aAAa,CAElF"}

package/lib/throttle.js

@@ -0,0 +1,47 @@
+/**
+ * Check if an ident is locked due to too many failed logins
+ * @param s - login failure state (an ident)
+ * @param failedBefore - failures before locking
+ * @param lockoutMs - lock duration after the last attempt
+ * @param now - clock
+ * @returns true while locked
+ */
+export function isLocked(s, failedBefore, lockoutMs, now = Date.now()) {
+    return !!s && (s._loginAttempts ?? 0) >= failedBefore && (s._lastLoginAttemptAt ?? 0) + lockoutMs > now;
+}
+/**
+ * Record a failure in the login failure state
+ * @param s - login failure state
+ * @param now - clock
+ * @returns state with one more failure
+ */
+export function recordFailure(s, now = Date.now()) {
+    return { _loginAttempts: (s?._loginAttempts ?? 0) + 1, _lastLoginAttemptAt: now };
+}
+/**
+ * Clear all login failures
+ * @returns state with failures cleared
+ */
+export function resetFailures() {
+    return { _loginAttempts: 0, _lastLoginAttemptAt: undefined };
+}
+/**
+ * Check if a message can be sent based on throttle delay
+ * @param t - throttle state
+ * @param delayMs - minimal delay between two emails
+ * @param now - clock
+ * @returns true when an email may be sent
+ */
+export function canSend(t, delayMs, now = Date.now()) {
+    return !t?.lastSentAt || t.lastSentAt + delayMs < now;
+}
+/**
+ * Mark that a message was sent
+ * @param t - throttle state
+ * @param now - clock
+ * @returns state with the send timestamp set
+ */
+export function markSent(t, now = Date.now()) {
+    return { ...(t ?? {}), lastSentAt: now };
+}
+//# sourceMappingURL=throttle.js.map

package/lib/throttle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"throttle.js","sourceRoot":"","sources":["../src/throttle.ts"],"names":[],"mappings":"AAKA;;;;;;;GAOG;AACH,MAAM,UAAU,QAAQ,CAAC,CAAgB,EAAE,YAAoB,EAAE,SAAiB,EAAE,GAAG,GAAW,IAAI,CAAC,GAAG,EAAE;IAC1G,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,IAAI,YAAY,IAAI,CAAC,CAAC,CAAC,mBAAmB,IAAI,CAAC,CAAC,GAAG,SAAS,GAAG,GAAG,CAAC;AAC1G,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,CAAgB,EAAE,GAAG,GAAW,IAAI,CAAC,GAAG,EAAE;IACtE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC,EAAE,cAAc,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,mBAAmB,EAAE,GAAG,EAAE,CAAC;AACpF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO,EAAE,cAAc,EAAE,CAAC,EAAE,mBAAmB,EAAE,SAAS,EAAE,CAAC;AAC/D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,OAAO,CAAC,CAAgB,EAAE,OAAe,EAAE,GAAG,GAAW,IAAI,CAAC,GAAG,EAAE;IACjF,OAAO,CAAC,CAAC,EAAE,UAAU,IAAI,CAAC,CAAC,UAAU,GAAG,OAAO,GAAG,GAAG,CAAC;AACxD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,CAAgB,EAAE,GAAG,GAAW,IAAI,CAAC,GAAG,EAAE;IACjE,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;AAC3C,CAAC"}