@webda/auth 0.0.0-stage → 4.0.0-beta.5

package/LICENSE

@@ -0,0 +1,166 @@
+                   GNU LESSER GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+
+  This version of the GNU Lesser General Public License incorporates
+the terms and conditions of version 3 of the GNU General Public
+License, supplemented by the additional permissions listed below.
+
+  0. Additional Definitions.
+
+  As used herein, "this License" refers to version 3 of the GNU Lesser
+General Public License, and the "GNU GPL" refers to version 3 of the GNU
+General Public License.
+
+  "The Library" refers to a covered work governed by this License,
+other than an Application or a Combined Work as defined below.
+
+  An "Application" is any work that makes use of an interface provided
+by the Library, but which is not otherwise based on the Library.
+Defining a subclass of a class defined by the Library is deemed a mode
+of using an interface provided by the Library.
+
+  A "Combined Work" is a work produced by combining or linking an
+Application with the Library.  The particular version of the Library
+with which the Combined Work was made is also called the "Linked
+Version".
+
+  The "Minimal Corresponding Source" for a Combined Work means the
+Corresponding Source for the Combined Work, excluding any source code
+for portions of the Combined Work that, considered in isolation, are
+based on the Application, and not on the Linked Version.
+
+  The "Corresponding Application Code" for a Combined Work means the
+object code and/or source code for the Application, including any data
+and utility programs needed for reproducing the Combined Work from the
+Application, but excluding the System Libraries of the Combined Work.
+
+  1. Exception to Section 3 of the GNU GPL.
+
+  You may convey a covered work under sections 3 and 4 of this License
+without being bound by section 3 of the GNU GPL.
+
+  2. Conveying Modified Versions.
+
+  If you modify a copy of the Library, and, in your modifications, a
+facility refers to a function or data to be supplied by an Application
+that uses the facility (other than as an argument passed when the
+facility is invoked), then you may convey a copy of the modified
+version:
+
+   a) under this License, provided that you make a good faith effort to
+   ensure that, in the event an Application does not supply the
+   function or data, the facility still operates, and performs
+   whatever part of its purpose remains meaningful, or
+
+   b) under the GNU GPL, with none of the additional permissions of
+   this License applicable to that copy.
+
+  3. Object Code Incorporating Material from Library Header Files.
+
+  The object code form of an Application may incorporate material from
+a header file that is part of the Library.  You may convey such object
+code under terms of your choice, provided that, if the incorporated
+material is not limited to numerical parameters, data structure
+layouts and accessors, or small macros, inline functions and templates
+(ten or fewer lines in length), you do both of the following:
+
+   a) Give prominent notice with each copy of the object code that the
+   Library is used in it and that the Library and its use are
+   covered by this License.
+
+   b) Accompany the object code with a copy of the GNU GPL and this license
+   document.
+
+  4. Combined Works.
+
+  You may convey a Combined Work under terms of your choice that,
+taken together, effectively do not restrict modification of the
+portions of the Library contained in the Combined Work and reverse
+engineering for debugging such modifications, if you also do each of
+the following:
+
+   a) Give prominent notice with each copy of the Combined Work that
+   the Library is used in it and that the Library and its use are
+   covered by this License.
+
+   b) Accompany the Combined Work with a copy of the GNU GPL and this license
+   document.
+
+   c) For a Combined Work that displays copyright notices during
+   execution, include the copyright notice for the Library among
+   these notices, as well as a reference directing the user to the
+   copies of the GNU GPL and this license document.
+
+   d) Do one of the following:
+
+       0) Convey the Minimal Corresponding Source under the terms of this
+       License, and the Corresponding Application Code in a form
+       suitable for, and under terms that permit, the user to
+       recombine or relink the Application with a modified version of
+       the Linked Version to produce a modified Combined Work, in the
+       manner specified by section 6 of the GNU GPL for conveying
+       Corresponding Source.
+
+       1) Use a suitable shared library mechanism for linking with the
+       Library.  A suitable mechanism is one that (a) uses at run time
+       a copy of the Library already present on the user's computer
+       system, and (b) will operate properly with a modified version
+       of the Library that is interface-compatible with the Linked
+       Version.
+
+   e) Provide Installation Information, but only if you would otherwise
+   be required to provide such information under section 6 of the
+   GNU GPL, and only to the extent that such information is
+   necessary to install and execute a modified version of the
+   Combined Work produced by recombining or relinking the
+   Application with a modified version of the Linked Version. (If
+   you use option 4d0, the Installation Information must accompany
+   the Minimal Corresponding Source and Corresponding Application
+   Code. If you use option 4d1, you must provide the Installation
+   Information in the manner specified by section 6 of the GNU GPL
+   for conveying Corresponding Source.)
+
+  5. Combined Libraries.
+
+  You may place library facilities that are a work based on the
+Library side by side in a single library together with other library
+facilities that are not Applications and are not covered by this
+License, and convey such a combined library under terms of your
+choice, if you do both of the following:
+
+   a) Accompany the combined library with a copy of the same work based
+   on the Library, uncombined with any other library facilities,
+   conveyed under the terms of this License.
+
+   b) Give prominent notice with the combined library that part of it
+   is a work based on the Library, and explaining where to find the
+   accompanying uncombined form of the same work.
+
+  6. Revised Versions of the GNU Lesser General Public License.
+
+  The Free Software Foundation may publish revised and/or new versions
+of the GNU Lesser General Public License from time to time. Such new
+versions will be similar in spirit to the present version, but may
+differ in detail to address new problems or concerns.
+
+  Each version is given a distinguishing version number. If the
+Library as you received it specifies that a certain numbered version
+of the GNU Lesser General Public License "or any later version"
+applies to it, you have the option of following the terms and
+conditions either of that published version or of any later version
+published by the Free Software Foundation. If the Library as you
+received it does not specify a version number of the GNU Lesser
+General Public License, you may choose any version of the GNU Lesser
+General Public License ever published by the Free Software Foundation.
+
+  If the Library as you received it specifies that a proxy can decide
+whether future versions of the GNU Lesser General Public License shall
+apply, that proxy's public statement of acceptance of any version is
+permanent authorization for you to choose that version for the
+Library.
+

package/README.md

@@ -1,3 +1,27 @@
-# Temporary Holding Version
+# @webda/auth
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Authentication for Webda: login providers, account linking, access/refresh tokens, email + password with verification
+and recovery, and v3 data compatibility.
+
+## Install
+
+```bash
+pnpm add @webda/auth
+```
+
+## Minimal configuration
+
+```jsonc
+{
+  "services": {
+    "Authentication": { "type": "Webda/Authentication" },
+    "emailAuth": { "type": "Webda/EmailPasswordProvider", "mailer": "Mailer" },
+    "db": { "type": "MemoryStore", "models": ["Webda/User", "Webda/Ident", "Webda/RefreshToken"] }
+  }
+}
+```
+
+## Documentation
+
+- [Authentication](../../docs/pages/Security/Authentication.md)
+- [v3 to v4 migration](../../docs/pages/Migration/Authentication-v3-to-v4.md)

package/lib/authentication.service.d.ts

@@ -0,0 +1,286 @@
+import { type AuthenticationEvents, type AuthResult, Counter, Ident, type IAuthenticationService, type IssuedTokens, type ProviderInfo, type ResolvedIdentity, Service, ServiceParameters, type User } from "@webda/core";
+import type { ModelClass } from "@webda/models";
+import { type AuthProvider, type ProviderEmailPolicy } from "./provider.js";
+/** Account linking policy for unauthenticated logins matching an existing email */
+export type LinkingPolicy = "never" | "verified" | "always";
+/** v3 data compatibility options */
+export interface AuthenticationCompatibility {
+    /**
+     * Read and write v3 data layouts
+     * @default true
+     */
+    v3?: boolean;
+}
+/** Counts of one kind of migrated records */
+export interface MigrationCounts {
+    /** Records migrated (or that would be, in a dry run) */
+    migrated: number;
+    /** Records that look like v3 data but are not migrated (unrecognised key, foreign row) */
+    skipped: number;
+    /** Keys of the records whose migration failed */
+    failed: string[];
+}
+/** Result of `webda auth migrate` */
+export interface MigrationReport {
+    /** v3 ident records */
+    idents: MigrationCounts;
+    /** Users whose stored record still has the v3 `__password` */
+    users: MigrationCounts;
+    /** Nothing was written */
+    dryRun: boolean;
+    /** Set when the ident passes stopped at the pass limit with records still migrating: run the command again */
+    incomplete?: boolean;
+}
+/** Authentication methods (amr) that are a primary factor: a second factor only counts on top of one of them */
+export declare const PRIMARY_FACTORS: readonly string[];
+/** Authentication parameters */
+export declare class AuthenticationParameters extends ServiceParameters {
+    /**
+     * User model
+     * @default "Webda/User"
+     */
+    userModel?: string;
+    /**
+     * Ident model
+     * @default "Webda/Ident"
+     */
+    identModel?: string;
+    /**
+     * Linking policy
+     * @default "verified"
+     */
+    linking?: LinkingPolicy;
+    /**
+     * Allow automatic registration of new users
+     * @default true
+     */
+    registration?: boolean;
+    /**
+     * v3 data compatibility
+     * @default { "v3": true }
+     */
+    compatibility?: AuthenticationCompatibility;
+    /**
+     * @param params - raw parameters
+     * @returns this
+     */
+    load(params?: any): this;
+}
+/**
+ * Shared authentication logic: providers hand a ResolvedIdentity to complete()
+ * @WebdaModda Authentication
+ */
+export declare class Authentication<T extends AuthenticationParameters = AuthenticationParameters> extends Service<T, AuthenticationEvents> implements IAuthenticationService {
+    static Parameters: typeof AuthenticationParameters;
+    protected metrics?: {
+        login?: Counter;
+        logout?: Counter;
+        registration?: Counter;
+    };
+    protected providerMap: Map<string, AuthProvider>;
+    /**
+     * @returns the configured user model
+     */
+    getUserModel(): ModelClass<User>;
+    /**
+     * @returns the configured ident model
+     */
+    getIdentModel(): ModelClass<Ident>;
+    /** @override */
+    resolve(): this;
+    /** @override */
+    init(): Promise<this>;
+    /**
+     * Collect every service implementing {@link AuthProvider}
+     * @throws Error when two providers share the same name
+     */
+    protected discoverProviders(): void;
+    /** @override */
+    stop(): Promise<void>;
+    /**
+     * @param name - provider name
+     * @returns the provider
+     */
+    getProvider(name: string): AuthProvider | undefined;
+    /**
+     * @param name - provider name
+     * @returns the email policy of that provider, undefined for unknown providers or without policy
+     */
+    protected emailPolicyFor(name: string): ProviderEmailPolicy | undefined;
+    /**
+     * @returns public info of every provider
+     */
+    getProviders(): ProviderInfo[];
+    /**
+     * List available login methods
+     * @returns providers
+     */
+    providers(): ProviderInfo[];
+    /**
+     * Current user
+     * @returns public entry of the logged user
+     */
+    me(): Promise<any>;
+    /** @override */
+    initMetrics(): void;
+    /**
+     * Find an ident; with `compatibility.v3`, a miss falls back to the v3 record `"<uid>_<provider>"`, upgraded on
+     * the fly
+     * @param provider - provider
+     * @param providerUid - uid
+     * @returns the ident when it exists
+     */
+    protected findIdent(provider: string, providerUid: string): Promise<Ident | undefined>;
+    /**
+     * MFA methods enabled for a user (implemented by sub-project 4)
+     * @param user - user
+     * @returns enabled methods, empty when MFA is off
+     */
+    protected mfaMethods(user: User): string[];
+    /**
+     * Create and save a user for an identity
+     * @param identity - resolved identity
+     * @param data - extra profile data
+     * @param ctx - request context (complete() runs as system, so it passes the real one)
+     * @returns the user
+     */
+    registerUser(identity: ResolvedIdentity, data?: any, ctx?: any): Promise<User>;
+    /**
+     * Complete a login for an identity proven by a provider
+     * @param identity - resolved identity
+     * @param options - complete options
+     * @param options.newUser - identity.user was just created by the provider: its first ident is not a "link"
+     * @returns the result
+     * @throws IdentLinkedElsewhere when the ident belongs to another user than the logged one
+     * @throws AccountExists when the email matches an account the linking policy does not allow
+     * @throws RegistrationDisabled when a new user is needed but registration is off
+     * @throws WebdaError.BadRequest when `identity.provider` is not a registered AuthProvider
+     */
+    complete(identity: ResolvedIdentity, options?: {
+        newUser?: boolean;
+    }): Promise<AuthResult>;
+    /**
+     * Apply the email policy of the identity provider (complete() does it too, idempotently)
+     * Lets a provider refuse an identity before creating anything
+     * @param identity - resolved identity
+     * @returns the identity to use
+     * @throws EmailDomainNotAllowed when the policy refuses it
+     * @throws WebdaError.BadRequest when `identity.provider` is not a registered AuthProvider: an unknown name would
+     * escape the email policy of the provider it impersonates
+     */
+    applyPolicy(identity: ResolvedIdentity): ResolvedIdentity;
+    /**
+     * Body of {@link complete}, running as system with the request context passed explicitly
+     * @param identity - resolved identity
+     * @param ctx - request context
+     * @param retried - already retried after a concurrent creation
+     * @param newUser - identity.user was just created by the provider: its first ident is not a "link"
+     * @returns the result
+     */
+    protected completeAs(identity: ResolvedIdentity, ctx: any, retried: boolean, newUser?: boolean): Promise<AuthResult>;
+    /**
+     * @param userId - uuid
+     * @returns the user
+     */
+    protected loadUser(userId: string): Promise<User>;
+    /**
+     * Write the session, issue tokens, emit Login
+     * @param user - user or uuid
+     * @param ident - ident used
+     * @param identity - resolved identity
+     * @param ctx - request context (complete() runs as system, so it passes the real one)
+     * @returns the result
+     */
+    protected establish(user: User | string, ident: Ident, identity: ResolvedIdentity, ctx?: any): Promise<AuthResult>;
+    /**
+     * Patch storing new provider tokens encrypted; also drops plaintext tokens left by an earlier v4 beta (`__tokens`)
+     * @param ident - the ident
+     * @param tokens - tokens from the provider, if any
+     * @returns the attributes to patch
+     */
+    protected tokensUpdate(ident: Ident, tokens: any): Promise<any>;
+    /**
+     * @returns the logged user id
+     * @throws WebdaError.Unauthorized when no fully logged session exists
+     */
+    protected requireUser(): string;
+    /**
+     * Logout and revoke the current refresh family; also abandons a pending MFA session
+     */
+    logout(): Promise<void>;
+    /**
+     * Exchange a refresh token
+     * @param refreshToken - refresh token
+     * @returns new tokens
+     */
+    refresh(refreshToken: string): Promise<IssuedTokens>;
+    /**
+     * List the current user's idents; with `compatibility.v3`, listing upgrades the user's v3 ident records first
+     * @returns idents of the current user
+     */
+    idents(): Promise<{
+        provider: string;
+        providerUid: string;
+        email?: string;
+        verifiedAt?: Date;
+        lastUsedAt?: Date;
+    }[]>;
+    /**
+     * @param userId - user
+     * @returns all idents owned by the user
+     */
+    protected listIdents(userId: string): Promise<Ident[]>;
+    /**
+     * Remove one of the current user's idents
+     * @param provider - provider
+     * @param providerUid - uid
+     * @throws LastLoginMethod when no usable login method would remain (non-email idents, plus email idents when the
+     * user has a password), or when it would remove the last email ident of a user with a password
+     */
+    unlink(provider: string, providerUid: string): Promise<void>;
+    /**
+     * Migrate v3 authentication data to the v4 layout
+     *
+     * Idents: every v3 record (`"<providerUid>_<provider>"` key) is upgraded to its `"<providerUid>:<provider>"`
+     * record (emails normalised) then deleted; with a custom ident model, the v3 rows typed as the core
+     * `Webda/Ident` are found through its repository too. Upgrading shifts position-based paging, so passes run
+     * until one upgrades nothing. Users: a user whose stored record still has the v3 `__password` is saved again in
+     * the v4 `password` shape. Idempotent: a second run migrates nothing. Failures are reported by key and logged,
+     * the migration goes on.
+     *
+     * Operator notes:
+     * - A v3 ident whose upgraded key another user already holds (e.g. two v3 email keys differing only by case) is
+     *   reported in `idents.failed` (IDENT_CONFLICT) and kept: decide which user keeps the email, then delete or
+     *   rename the other v3 row and run the command again.
+     * - A malformed ident key in the store stops the scan: remove that row manually.
+     * - Re-running is always safe: migrated records are not touched again.
+     * @param dryRun - only count, write nothing
+     * @param batch - page size of the scans
+     * @returns the report
+     */
+    migrate(
+    /** @description Only count the records to migrate, write nothing */
+    dryRun?: boolean, 
+    /** @description Page size of the store scans */
+    batch?: number): Promise<MigrationReport>;
+    /**
+     * Enumerate the v3 ident rows: through the ident model, and through the core `Ident` repository when the
+     * ident model is a subclass (its queries only see rows typed as itself or its subclasses)
+     * @param pageSize - page size
+     * @returns the v3 keys found, each once per pass
+     */
+    protected legacyIdentKeys(pageSize: number): AsyncGenerator<string>;
+    /**
+     * Upgrade the v3 idents
+     * @param report - report to fill
+     * @param pageSize - page size
+     */
+    protected migrateIdents(report: MigrationReport, pageSize: number): Promise<void>;
+    /**
+     * Save again the users whose stored record still has the v3 `__password`
+     * @param report - report to fill
+     * @param pageSize - page size
+     */
+    protected migrateUsers(report: MigrationReport, pageSize: number): Promise<void>;
+}
+//# sourceMappingURL=authentication.service.d.ts.map

package/lib/authentication.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authentication.service.d.ts","sourceRoot":"","sources":["../src/authentication.service.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,UAAU,EAEf,OAAO,EACP,KAAK,EACL,KAAK,sBAAsB,EAC3B,KAAK,YAAY,EAEjB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EAGrB,OAAO,EACP,iBAAiB,EAKjB,KAAK,IAAI,EAGV,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAGhD,OAAO,EAAE,KAAK,YAAY,EAAoC,KAAK,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAE9G,mFAAmF;AACnF,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,UAAU,GAAG,QAAQ,CAAC;AAE5D,oCAAoC;AACpC,MAAM,WAAW,2BAA2B;IAC1C;;;OAGG;IACH,EAAE,CAAC,EAAE,OAAO,CAAC;CACd;AAED,6CAA6C;AAC7C,MAAM,WAAW,eAAe;IAC9B,wDAAwD;IACxD,QAAQ,EAAE,MAAM,CAAC;IACjB,0FAA0F;IAC1F,OAAO,EAAE,MAAM,CAAC;IAChB,iDAAiD;IACjD,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,qCAAqC;AACrC,MAAM,WAAW,eAAe;IAC9B,uBAAuB;IACvB,MAAM,EAAE,eAAe,CAAC;IACxB,8DAA8D;IAC9D,KAAK,EAAE,eAAe,CAAC;IACvB,0BAA0B;IAC1B,MAAM,EAAE,OAAO,CAAC;IAChB,8GAA8G;IAC9G,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,gHAAgH;AAChH,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAAqB,CAAC;AAenE,gCAAgC;AAChC,qBAAa,wBAAyB,SAAQ,iBAAiB;IAC7D;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;OAGG;IACH,aAAa,CAAC,EAAE,2BAA2B,CAAC;IAE5C;;;OAGG;IACH,IAAI,CAAC,MAAM,GAAE,GAAQ,GAAG,IAAI,CAQ3B;CACF;AAED;;;GAGG;AACH,qBAAa,cAAc,CAAC,CAAC,SAAS,wBAAwB,GAAG,wBAAwB,CACvF,SAAQ,OAAO,CAAC,CAAC,EAAE,oBAAoB,CACvC,YAAW,sBAAsB;IAEjC,MAAM,CAAC,UAAU,kCAA4B;IAE7C,UAAkB,OAAO,CAAC,EAAE;QAC1B,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,YAAY,CAAC,EAAE,OAAO,CAAC;KACxB,CAAC;IAEF,SAAS,CAAC,WAAW,4BAAmC;IAExD;;OAEG;IACH,YAAY,IAAI,UAAU,CAAC,IAAI,CAAC,CAE/B;IAED;;OAEG;IACH,aAAa,IAAI,UAAU,CAAC,KAAK,CAAC,CAEjC;IAED,gBAAgB;IAChB,OAAO,IAAI,IAAI,CAUd;IAED,gBAAgB;IACV,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAK1B;IAED;;;OAGG;IACH,SAAS,CAAC,iBAAiB,IAAI,IAAI,CAWlC;IAED,gBAAgB;IACV,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAG1B;IAED;;;OAGG;IACH,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAElD;IAED;;;OAGG;IACH,SAAS,CAAC,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,mBAAmB,GAAG,SAAS,CAuBtE;IAED;;OAEG;IACH,YAAY,IAAI,YAAY,EAAE,CAE7B;IAED;;;OAGG;IAEH,SAAS,IAAI,YAAY,EAAE,CAE1B;IAED;;;OAGG;IAEG,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,CAQvB;IAED,gBAAgB;IAChB,WAAW,IAAI,IAAI,CAgBlB;IAED;;;;;;OAMG;IACH,UAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC,CAyB3F;IAED;;;;OAIG;IACH,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,EAAE,CAGzC;IAED;;;;;;OAMG;IACG,YAAY,CAAC,QAAQ,EAAE,gBAAgB,EAAE,IAAI,GAAE,GAAQ,EAAE,GAAG,GAAE,GAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoB1G;IAED;;;;;;;;;;OAUG;IACG,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,EAAE,OAAO,GAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CAInG;IAED;;;;;;;;OAQG;IACH,WAAW,CAAC,QAAQ,EAAE,gBAAgB,GAAG,gBAAgB,CAKxD;IAED;;;;;;;OAOG;IACH,UAAgB,UAAU,CACxB,QAAQ,EAAE,gBAAgB,EAC1B,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,OAAe,GACvB,OAAO,CAAC,UAAU,CAAC,CA8FrB;IAED;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEhD;IAED;;;;;;;OAOG;IACH,UAAgB,SAAS,CACvB,IAAI,EAAE,IAAI,GAAG,MAAM,EACnB,KAAK,EAAE,KAAK,EACZ,QAAQ,EAAE,gBAAgB,EAC1B,GAAG,GAAE,GAAuB,GAC3B,OAAO,CAAC,UAAU,CAAC,CAqCrB;IAED;;;;;OAKG;IACH,UAAgB,YAAY,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAOpE;IAED;;;OAGG;IACH,SAAS,CAAC,WAAW,IAAI,MAAM,CAM9B;IAED;;OAEG;IAEG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAa5B;IAED;;;;OAIG;IAEG,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAGzD;IAED;;;OAGG;IAEG,MAAM,IAAI,OAAO,CACrB;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,IAAI,CAAC;QAAC,UAAU,CAAC,EAAE,IAAI,CAAA;KAAE,EAAE,CAClG,CASA;IAED;;;OAGG;IACH,UAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CA6B3D;IAED;;;;;;OAMG;IAEG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA4BjE;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IAKG,OAAO;IACX,oEAAoE;IACpE,MAAM,GAAE,OAAe;IACvB,gDAAgD;IAChD,KAAK,GAAE,MAAY,GAClB,OAAO,CAAC,eAAe,CAAC,CAa1B;IAED;;;;;OAKG;IACH,UAAiB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAiCzE;IAED;;;;OAIG;IACH,UAAgB,aAAa,CAAC,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA2CtF;IAED;;;;OAIG;IACH,UAAgB,YAAY,CAAC,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAarF;CACF"}