@webda/auth 0.0.0-stage → 4.0.0-beta.5

package/lib/oauth/oauth.service.js

@@ -0,0 +1,557 @@
+var __runInitializers = (this && this.__runInitializers) || function (thisArg, initializers, value) {
+    var useValue = arguments.length > 2;
+    for (var i = 0; i < initializers.length; i++) {
+        value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
+    }
+    return useValue ? value : void 0;
+};
+var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
+    function accept(f) { if (f !== void 0 && typeof f !== "function") throw new TypeError("Function expected"); return f; }
+    var kind = contextIn.kind, key = kind === "getter" ? "get" : kind === "setter" ? "set" : "value";
+    var target = !descriptorIn && ctor ? contextIn["static"] ? ctor : ctor.prototype : null;
+    var descriptor = descriptorIn || (target ? Object.getOwnPropertyDescriptor(target, contextIn.name) : {});
+    var _, done = false;
+    for (var i = decorators.length - 1; i >= 0; i--) {
+        var context = {};
+        for (var p in contextIn) context[p] = p === "access" ? {} : contextIn[p];
+        for (var p in contextIn.access) context.access[p] = contextIn.access[p];
+        context.addInitializer = function (f) { if (done) throw new TypeError("Cannot add initializers after decoration has completed"); extraInitializers.push(accept(f || null)); };
+        var result = (0, decorators[i])(kind === "accessor" ? { get: descriptor.get, set: descriptor.set } : descriptor[key], context);
+        if (kind === "accessor") {
+            if (result === void 0) continue;
+            if (result === null || typeof result !== "object") throw new TypeError("Object expected");
+            if (_ = accept(result.get)) descriptor.get = _;
+            if (_ = accept(result.set)) descriptor.set = _;
+            if (_ = accept(result.init)) initializers.unshift(_);
+        }
+        else if (_ = accept(result)) {
+            if (kind === "field") initializers.unshift(_);
+            else descriptor[key] = _;
+        }
+    }
+    if (target) Object.defineProperty(target, contextIn.name, descriptor);
+    done = true;
+};
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { CookieOptions, registerOperation, Route, runAsSystem, runWithContext, SecureCookie, Service, ServiceParameters, useContext, useCrypto, useDynamicService, WebdaError } from "@webda/core";
+import { useAuthentication } from "../provider.js";
+import { IdentLinkedElsewhere, TokenInvalid, UnsupportedMediaType } from "../errors.js";
+/** OAuthProvider parameters */
+export class OAuthProviderParameters extends ServiceParameters {
+    /**
+     * @param params - raw parameters
+     * @returns this
+     */
+    load(params = {}) {
+        super.load(params);
+        this.authorized_uris ?? (this.authorized_uris = []);
+        this.redirects = { success: "/", ...(this.redirects ?? {}) };
+        return this;
+    }
+}
+/** Validity of a pending login, in seconds */
+const PENDING_TTL = 600;
+/**
+ * Maximum length of a login `redirect`: the pending login cookie must stay a single cookie (SecureCookie splits
+ * values above ~4 KB, and the encrypted cookie is about 1.8 times the size of its content)
+ */
+const REDIRECT_MAX = 1024;
+/**
+ * @param err - any error
+ * @returns the code of a WebdaError.HttpError, undefined for anything else
+ */
+function httpErrorCode(err) {
+    return typeof err?.getResponseCode === "function" &&
+        typeof err?.code === "string" &&
+        /^[A-Z][A-Z0-9_]*$/.test(err.code)
+        ? err.code
+        : undefined;
+}
+/**
+ * Loggable reason of an error: library messages may contain tokens or their payload, so only a short code or the
+ * error class name is kept
+ * @param err - any error
+ * @returns a reason without any part of the message
+ */
+export function safeErrorReason(err) {
+    const safe = (value) => typeof value === "string" && /^[A-Za-z0-9_.-]{1,40}$/.test(value);
+    const name = safe(err?.name) ? err.name : "Error";
+    const code = err?.code;
+    if (safe(code) || (typeof code === "number" && Number.isFinite(code))) {
+        return `${name}(${code})`;
+    }
+    return name;
+}
+/** Credentials keys kept from a client `tokens` body */
+const TOKEN_KEYS = ["id_token", "access_token", "refresh_token", "expiry_date", "token_type", "scope"];
+/** Maximum length of a kept credentials value */
+const TOKEN_VALUE_MAX = 4096;
+/**
+ * Keep only the known credentials keys, as bounded strings or finite numbers
+ * @param tokens - client provided credentials
+ * @returns the sanitised credentials
+ */
+export function sanitizeTokens(tokens) {
+    const out = {};
+    for (const key of TOKEN_KEYS) {
+        const value = tokens?.[key];
+        if ((typeof value === "string" && value.length <= TOKEN_VALUE_MAX) ||
+            (typeof value === "number" && Number.isFinite(value))) {
+            out[key] = value;
+        }
+    }
+    return out;
+}
+/**
+ * @param url - absolute or relative url
+ * @param params - query parameters to add
+ * @returns the url with the parameters appended
+ */
+function withQuery(url, params) {
+    const query = new URLSearchParams(params).toString();
+    const hash = url.indexOf("#");
+    const [base, fragment] = hash < 0 ? [url, ""] : [url.substring(0, hash), url.substring(hash)];
+    return `${base}${base.includes("?") ? "&" : "?"}${query}${fragment}`;
+}
+/**
+ * @param url - candidate
+ * @returns the parsed url when it is an absolute http(s) url without credentials
+ */
+function parseHttpUrl(url) {
+    if (typeof url !== "string")
+        return undefined;
+    try {
+        const parsed = new URL(url);
+        if (!["http:", "https:"].includes(parsed.protocol) || parsed.username || parsed.password)
+            return undefined;
+        return parsed;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Constant-time comparison of two secrets
+ * @param a - received value
+ * @param b - expected value
+ * @returns true when equal
+ */
+function sameSecret(a, b) {
+    const left = Buffer.from(a);
+    const right = Buffer.from(b);
+    return left.length === right.length && timingSafeEqual(left, right);
+}
+/**
+ * @param bytes - entropy
+ * @returns a random base64url string
+ */
+function randomSecret(bytes) {
+    return randomBytes(bytes).toString("base64url");
+}
+/**
+ * Base of the OAuth 2.0 / OpenID Connect login providers
+ *
+ * Exposes, under `url` (default `/auth/<providerName>`):
+ * - `GET <url>{?redirect}`: starts a login with a random `state`, a PKCE (S256) verifier and an OpenID `nonce`, kept
+ *   in a dedicated encrypted cookie (10 min, HttpOnly, SameSite=Lax, path `url`), then redirects to the provider;
+ *   `redirect` must match `authorized_uris`
+ * - `GET <url>/callback`: consumes that cookie, checks the state, exchanges the code (`handleCallback`) and hands
+ *   the identity to `Authentication.complete()`; never throws, failures go to `redirects.failure?reason=<CODE>`
+ * - operation `Auth.<Provider>.Token` (`POST auth/<providerName>/token`, JSON body `{ token }` or `{ tokens }`) for
+ *   non-browser clients; it never links an identity to the session user
+ *
+ * Subclasses implement `providerName`, `getAuthorizationUrl`, `handleCallback` and `handleToken`; the provider of the
+ * returned identities is always forced to `providerName`.
+ */
+let OAuthProvider = (() => {
+    var _a;
+    let _classSuper = Service;
+    let _instanceExtraInitializers = [];
+    let _login_decorators;
+    let _callback_decorators;
+    return _a = class OAuthProvider extends _classSuper {
+            /**
+             * Called after a successful `Authentication.complete()` (status ok or mfa_required)
+             * @param _identity - the identity
+             * @param _result - the result
+             * @param _source - browser callback or token operation
+             * @param _request - the token operation request (token operation only)
+             */
+            async onAuthenticated(_identity, _result, _source, _request) {
+                // Hook for providers
+            }
+            /**
+             * @returns false when the provider works without client secret (public clients)
+             */
+            requiresClientSecret() {
+                return true;
+            }
+            /**
+             * @returns the name of the pending login cookie
+             */
+            getCookieName() {
+                return `webda_oauth_${this.providerName}`;
+            }
+            /** @override */
+            resolve() {
+                var _b;
+                super.resolve();
+                (_b = this.parameters).url ?? (_b.url = `/auth/${this.providerName}`);
+                return this;
+            }
+            /** @override */
+            async init() {
+                await super.init();
+                const name = `${this.constructor.name} '${this.getName()}'`;
+                const params = this.parameters;
+                if (!params.client_id) {
+                    throw new Error(`${name} requires the 'client_id' parameter`);
+                }
+                if (this.requiresClientSecret() && !params.client_secret) {
+                    throw new Error(`${name} requires the 'client_secret' parameter`);
+                }
+                if (!params.redirects?.failure) {
+                    throw new Error(`${name} requires the 'redirects.failure' parameter`);
+                }
+                if (!useDynamicService("Authentication")) {
+                    throw new Error(`${name} requires the Authentication service`);
+                }
+                for (const uri of params.authorized_uris ?? []) {
+                    if (!parseHttpUrl(uri)) {
+                        throw new Error(`${name}: authorized_uris entries must be absolute http(s) urls, got '${uri}'`);
+                    }
+                }
+                return this;
+            }
+            /**
+             * Register `Auth.<Provider>.Token`: its id and path depend on the provider name
+             * @override
+             */
+            initOperations() {
+                super.initOperations();
+                const name = this.providerName;
+                const id = this.getOperationId(`Auth.${name.substring(0, 1).toUpperCase()}${name.substring(1)}.Token`);
+                if (!id)
+                    return;
+                registerOperation(id, {
+                    service: this.getName(),
+                    method: "token",
+                    // Schemas are compiled per class: a shared named schema serves every provider
+                    input: "Webda/OAuthTokenRequest",
+                    summary: `Log in with a ${name} token`,
+                    tags: ["Authentication"],
+                    rest: { method: "post", path: `auth/${name}/token` }
+                });
+            }
+            /**
+             * @returns public info
+             */
+            getPublicInfo() {
+                return { name: this.providerName, type: "oauth", startUrl: this.parameters.url ?? `/auth/${this.providerName}` };
+            }
+            /**
+             * Log in with a token obtained by the client from the provider
+             *
+             * Requires a JSON request (a cross-site form or `text/plain` POST is refused). A request carrying a logged-in
+             * session never links the identity to that user: an identity owned by another user is refused
+             * (IDENT_LINKED_ELSEWHERE), a new or unowned one gets a fresh session.
+             * @param token - token (an ID token for OpenID Connect providers)
+             * @param tokens - credentials obtained from the provider (v3 body)
+             * @returns the auth result
+             */
+            async token(token, tokens) {
+                const ctx = useContext();
+                this.requireJson(ctx);
+                if (token !== undefined && (typeof token !== "string" || !token)) {
+                    throw new WebdaError.BadRequest("token must be a non-empty string");
+                }
+                if (tokens !== undefined && (tokens === null || typeof tokens !== "object" || Array.isArray(tokens))) {
+                    throw new WebdaError.BadRequest("tokens must be an object");
+                }
+                if (!token && !tokens) {
+                    throw new WebdaError.BadRequest("token or tokens is required");
+                }
+                // Only known credentials keys are verified, stored or published
+                tokens = tokens ? sanitizeTokens(tokens) : undefined;
+                let identity;
+                try {
+                    identity = this.ownIdentity(this.checkIdentity(await this.handleToken({ token, tokens })));
+                }
+                catch (err) {
+                    if (httpErrorCode(err))
+                        throw err;
+                    // Fail closed: an unexpected verification failure is an invalid token
+                    this.log("WARN", `${this.providerName} token verification failed:`, safeErrorReason(err));
+                    throw new TokenInvalid();
+                }
+                await this.leaveForeignSession(ctx, identity);
+                const result = await useAuthentication().complete(identity);
+                await this.onAuthenticated(identity, result, "token", { token, tokens });
+                return result;
+            }
+            /**
+             * Refuse a request that is not JSON: cross-site requests can only send form or `text/plain` bodies without a
+             * preflight
+             * @param ctx - operation context
+             * @throws UnsupportedMediaType when the HTTP request is not `application/json`
+             */
+            requireJson(ctx) {
+                const http = ctx?.getHttpContext?.();
+                if (!http)
+                    return;
+                const type = `${http.getUniqueHeader?.("content-type", "") ?? ""}`;
+                if (!/^application\/json\s*(;|$)/i.test(type.trim())) {
+                    throw new UnsupportedMediaType();
+                }
+            }
+            /**
+             * The token operation never links: with a logged-in session, an identity owned by another user is refused and a
+             * new or unowned one starts a fresh session
+             * @param ctx - operation context
+             * @param identity - verified identity
+             * @throws IdentLinkedElsewhere when the identity belongs to another user than the session one
+             */
+            async leaveForeignSession(ctx, identity) {
+                if (!ctx?.getSession?.()?.isLogged())
+                    return;
+                const current = ctx.getCurrentUserId();
+                const ident = await runAsSystem(() => useAuthentication().findIdent(identity.provider, identity.providerUid));
+                const owner = ident?.getUser()?.toString();
+                if (owner === current)
+                    return;
+                if (owner) {
+                    throw new IdentLinkedElsewhere();
+                }
+                ctx.newSession();
+            }
+            /**
+             * @param identity - identity returned by the subclass
+             * @returns the identity
+             * @throws TokenInvalid when it has no subject
+             */
+            checkIdentity(identity) {
+                if (!identity?.providerUid || typeof identity.providerUid !== "string") {
+                    throw new TokenInvalid("Provider returned no subject");
+                }
+                return identity;
+            }
+            /**
+             * @param identity - identity returned by the subclass
+             * @returns the identity, always attributed to this provider
+             */
+            ownIdentity(identity) {
+                return {
+                    ...identity,
+                    provider: this.providerName,
+                    amr: identity.amr?.length ? identity.amr : ["oauth"]
+                };
+            }
+            /**
+             * Check a post-login target against `authorized_uris`: same origin, and the listed path or below it; an encoded
+             * slash or backslash in the path is refused
+             * @param redirect - candidate
+             * @returns the normalised url, undefined when not allowed
+             */
+            allowedRedirect(redirect) {
+                if (typeof redirect !== "string" || redirect.length > REDIRECT_MAX || /%2f|%5c/i.test(redirect.split(/[?#]/)[0])) {
+                    return undefined;
+                }
+                const target = parseHttpUrl(redirect);
+                if (!target)
+                    return undefined;
+                for (const uri of this.parameters.authorized_uris ?? []) {
+                    const allowed = parseHttpUrl(uri);
+                    if (!allowed || allowed.origin !== target.origin)
+                        continue;
+                    const path = allowed.pathname;
+                    if (target.pathname === path || target.pathname.startsWith(path.endsWith("/") ? path : `${path}/`)) {
+                        return target.href;
+                    }
+                }
+                return undefined;
+            }
+            /**
+             * @param ctx - web context
+             * @returns the callback url sent to the provider
+             */
+            getRedirectUri(ctx) {
+                return this.parameters.redirect_uri ?? ctx.getHttpContext().getAbsoluteUrl(`${this.parameters.url ?? ""}/callback`);
+            }
+            /**
+             * Set (or clear, without value) the pending login cookie, scoped to the callback path: the path of the effective
+             * redirect_uri, which includes any deployment prefix (API Gateway stage, path-stripping proxy) the routes do not see
+             * @param ctx - web context
+             * @param redirectUri - callback url
+             * @param value - encrypted pending login
+             */
+            sendPendingCookie(ctx, redirectUri, value) {
+                const callback = parseHttpUrl(redirectUri);
+                const options = new CookieOptions({
+                    name: this.getCookieName(),
+                    path: callback?.pathname || "/",
+                    maxAge: value ? PENDING_TTL : 0,
+                    sameSite: "lax",
+                    httpOnly: true
+                }, ctx.getHttpContext());
+                // Secure when the request or the callback is https
+                options.secure = options.secure || callback?.protocol === "https:";
+                if (value) {
+                    SecureCookie.sendCookie(ctx, this.getCookieName(), value, options);
+                }
+                else {
+                    ctx.cookie(this.getCookieName(), "", options);
+                }
+            }
+            /**
+             * Read and clear the pending login cookie
+             * @param ctx - web context
+             * @returns the pending login, undefined when absent, invalid, expired or of another provider
+             */
+            async consumePending(ctx) {
+                const raw = ctx.getHttpContext()?.getCookies?.()?.[this.getCookieName()];
+                // Always cleared, on the path it was set on (the callback): single use
+                this.sendPendingCookie(ctx, this.getRedirectUri(ctx));
+                if (typeof raw !== "string" || !raw)
+                    return undefined;
+                let pending;
+                try {
+                    pending = await useCrypto().decrypt(raw);
+                }
+                catch {
+                    return undefined;
+                }
+                if (!pending ||
+                    pending.provider !== this.providerName ||
+                    typeof pending.state !== "string" ||
+                    typeof pending.verifier !== "string" ||
+                    typeof pending.nonce !== "string" ||
+                    !(Date.now() <= pending.expires)) {
+                    return undefined;
+                }
+                return pending;
+            }
+            /**
+             * Redirect without caching
+             * @param ctx - web context
+             * @param url - target
+             */
+            redirect(ctx, url) {
+                ctx.setHeader("Cache-Control", "no-store");
+                ctx.redirect(url);
+            }
+            /**
+             * @param ctx - web context
+             * @param reason - failure code
+             */
+            fail(ctx, reason) {
+                this.redirect(ctx, withQuery(this.parameters.redirects.failure, { reason }));
+            }
+            /**
+             * Start a login: redirect the browser to the provider
+             * @param ctx - web context
+             */
+            async login(ctx) {
+                try {
+                    const requested = ctx.parameter("redirect");
+                    let redirect;
+                    if (requested !== undefined && requested !== "") {
+                        redirect = this.allowedRedirect(requested);
+                        if (!redirect) {
+                            this.fail(ctx, "REDIRECT_NOT_ALLOWED");
+                            return;
+                        }
+                    }
+                    const pending = {
+                        provider: this.providerName,
+                        state: randomSecret(32),
+                        verifier: randomSecret(32),
+                        nonce: randomSecret(24),
+                        redirect,
+                        redirectUri: this.getRedirectUri(ctx),
+                        expires: Date.now() + PENDING_TTL * 1000
+                    };
+                    const url = await this.getAuthorizationUrl({
+                        state: pending.state,
+                        redirectUri: pending.redirectUri,
+                        scope: this.parameters.scope ?? [],
+                        codeChallenge: createHash("sha256").update(pending.verifier).digest("base64url"),
+                        codeChallengeMethod: "S256",
+                        nonce: pending.nonce
+                    });
+                    this.sendPendingCookie(ctx, pending.redirectUri, await useCrypto().encrypt(pending));
+                    this.redirect(ctx, url);
+                }
+                catch (err) {
+                    this.log("ERROR", `Cannot start ${this.providerName} login:`, safeErrorReason(err));
+                    this.fail(ctx, "OAUTH_ERROR");
+                }
+            }
+            /**
+             * Provider callback: verify the state, exchange the code, complete the login and redirect; never throws
+             * @param ctx - web context
+             */
+            async callback(ctx) {
+                try {
+                    const pending = await this.consumePending(ctx);
+                    const state = ctx.parameter("state");
+                    if (!pending || typeof state !== "string" || !sameSecret(state, pending.state)) {
+                        this.fail(ctx, "STATE_MISMATCH");
+                        return;
+                    }
+                    const code = ctx.parameter("code");
+                    if (ctx.parameter("error") !== undefined || typeof code !== "string" || !code) {
+                        this.fail(ctx, "PROVIDER_ERROR");
+                        return;
+                    }
+                    const result = await runWithContext(ctx, async () => {
+                        const identity = this.ownIdentity(this.checkIdentity(await this.handleCallback({
+                            code,
+                            redirectUri: pending.redirectUri,
+                            codeVerifier: pending.verifier,
+                            nonce: pending.nonce
+                        })));
+                        const res = await useAuthentication().complete(identity);
+                        await this.onAuthenticated(identity, res, "callback");
+                        return res;
+                    });
+                    const target = pending.redirect ?? this.parameters.redirects.success ?? "/";
+                    this.redirect(ctx, result.status === "mfa_required" ? withQuery(target, { mfa: "required" }) : target);
+                }
+                catch (err) {
+                    const code = httpErrorCode(err);
+                    if (!code) {
+                        this.log("ERROR", `${this.providerName} callback failed:`, safeErrorReason(err));
+                    }
+                    this.fail(ctx, code ?? "OAUTH_ERROR");
+                }
+            }
+            constructor() {
+                super(...arguments);
+                __runInitializers(this, _instanceExtraInitializers);
+            }
+        },
+        (() => {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+            _login_decorators = [Route(".{?redirect?}", ["GET"], {
+                    get: {
+                        summary: "Start an OAuth login",
+                        description: "Redirects to the provider; `redirect` must match the provider authorized_uris",
+                        responses: { "302": { description: "Redirect to the provider, or to redirects.failure" } }
+                    }
+                })];
+            _callback_decorators = [Route("./callback{?code?,state?,error?}", ["GET"], {
+                    get: {
+                        summary: "OAuth callback",
+                        description: "Completes the login started by the login route",
+                        responses: { "302": { description: "Redirect to the login target, or to redirects.failure?reason=CODE" } }
+                    }
+                })];
+            __esDecorate(_a, null, _login_decorators, { kind: "method", name: "login", static: false, private: false, access: { has: obj => "login" in obj, get: obj => obj.login }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(_a, null, _callback_decorators, { kind: "method", name: "callback", static: false, private: false, access: { has: obj => "callback" in obj, get: obj => obj.callback }, metadata: _metadata }, null, _instanceExtraInitializers);
+            if (_metadata) Object.defineProperty(_a, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+        })(),
+        _a.Parameters = OAuthProviderParameters,
+        _a;
+})();
+export { OAuthProvider };
+//# sourceMappingURL=oauth.service.js.map

package/lib/oauth/oauth.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.service.js","sourceRoot":"","sources":["../../src/oauth/oauth.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAGL,aAAa,EAGb,iBAAiB,EACjB,KAAK,EACL,WAAW,EACX,cAAc,EACd,YAAY,EACZ,OAAO,EACP,iBAAiB,EACjB,UAAU,EACV,SAAS,EACT,iBAAiB,EAEjB,UAAU,EACX,MAAM,aAAa,CAAC;AACrB,OAAO,EAAqB,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAoExF,+BAA+B;AAC/B,MAAM,OAAO,uBAAwB,SAAQ,iBAAiB;IAsC5D;;;OAGG;IACH,IAAI,CAAC,MAAM,GAAQ,EAAE;QACnB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,IAAI,CAAC,eAAe,KAApB,IAAI,CAAC,eAAe,GAAK,EAAE,EAAC;QAC5B,IAAI,CAAC,SAAS,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;QAC7D,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAoBD,8CAA8C;AAC9C,MAAM,WAAW,GAAG,GAAG,CAAC;AAExB;;;GAGG;AACH,MAAM,YAAY,GAAG,IAAI,CAAC;AAE1B;;;GAGG;AACH,SAAS,aAAa,CAAC,GAAQ;IAC7B,OAAO,OAAO,GAAG,EAAE,eAAe,KAAK,UAAU;QAC/C,OAAO,GAAG,EAAE,IAAI,KAAK,QAAQ;QAC7B,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;QAClC,CAAC,CAAC,GAAG,CAAC,IAAI;QACV,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,GAAQ;IACtC,MAAM,IAAI,GAAG,CAAC,KAAc,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnG,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;IAClD,MAAM,IAAI,GAAG,GAAG,EAAE,IAAI,CAAC;IACvB,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACtE,OAAO,GAAG,IAAI,IAAI,IAAI,GAAG,CAAC;IAC5B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,GAAG,CAAC,UAAU,EAAE,cAAc,EAAE,eAAe,EAAE,aAAa,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;AAEvG,iDAAiD;AACjD,MAAM,eAAe,GAAG,IAAI,CAAC;AAE7B;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,MAAmB;IAChD,MAAM,GAAG,GAAgB,EAAE,CAAC;IAC5B,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;QAC5B,IACE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,IAAI,eAAe,CAAC;YAC9D,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EACrD,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,GAAW,EAAE,MAA8B;IAC5D,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IACrD,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9F,OAAO,GAAG,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,GAAG,QAAQ,EAAE,CAAC;AACvE,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,GAAY;IAChC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC3G,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CAAC,CAAS,EAAE,CAAS;IACtC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7B,OAAO,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACtE,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;;;;GAcG;IACmB,aAAa;;sBAIzB,OAAO;;;;sBAJK,aAIpB,SAAQ,WAAa;YAgCrB;;;;;;eAMG;YACO,KAAK,CAAC,eAAe,CAC7B,SAA2B,EAC3B,OAAmB,EACnB,OAA6B,EAC7B,QAA4B;gBAE5B,qBAAqB;YACvB,CAAC;YAED;;eAEG;YACO,oBAAoB;gBAC5B,OAAO,IAAI,CAAC;YACd,CAAC;YAED;;eAEG;YACO,aAAa;gBACrB,OAAO,eAAe,IAAI,CAAC,YAAY,EAAE,CAAC;YAC5C,CAAC;YAED,gBAAgB;YAChB,OAAO;;gBACL,KAAK,CAAC,OAAO,EAAE,CAAC;gBAChB,MAAA,IAAI,CAAC,UAAU,EAAC,GAAG,QAAH,GAAG,GAAK,SAAS,IAAI,CAAC,YAAY,EAAE,EAAC;gBACrD,OAAO,IAAI,CAAC;YACd,CAAC;YAED,gBAAgB;YAChB,KAAK,CAAC,IAAI;gBACR,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;gBACnB,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,KAAK,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC;gBAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC;gBAC/B,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;oBACtB,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,qCAAqC,CAAC,CAAC;gBAChE,CAAC;gBACD,IAAI,IAAI,CAAC,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;oBACzD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,yCAAyC,CAAC,CAAC;gBACpE,CAAC;gBACD,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC;oBAC/B,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,6CAA6C,CAAC,CAAC;gBACxE,CAAC;gBACD,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,EAAE,CAAC;oBACzC,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,sCAAsC,CAAC,CAAC;gBACjE,CAAC;gBACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,eAAe,IAAI,EAAE,EAAE,CAAC;oBAC/C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;wBACvB,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,iEAAiE,GAAG,GAAG,CAAC,CAAC;oBAClG,CAAC;gBACH,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YAED;;;eAGG;YACH,cAAc;gBACZ,KAAK,CAAC,cAAc,EAAE,CAAC;gBACvB,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC;gBAC/B,MAAM,EAAE,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;gBACvG,IAAI,CAAC,EAAE;oBAAE,OAAO;gBAChB,iBAAiB,CAAC,EAAE,EAAE;oBACpB,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;oBACvB,MAAM,EAAE,OAAO;oBACf,8EAA8E;oBAC9E,KAAK,EAAE,yBAAyB;oBAChC,OAAO,EAAE,iBAAiB,IAAI,QAAQ;oBACtC,IAAI,EAAE,CAAC,gBAAgB,CAAC;oBACxB,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,IAAI,QAAQ,EAAE;iBAC9C,CAAC,CAAC;YACZ,CAAC;YAED;;eAEG;YACH,aAAa;gBACX,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,SAAS,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;YACnH,CAAC;YAED;;;;;;;;;eASG;YACH,KAAK,CAAC,KAAK,CAAC,KAAc,EAAE,MAAoB;gBAC9C,MAAM,GAAG,GAAG,UAAU,EAAO,CAAC;gBAC9B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;gBACtB,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;oBACjE,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,kCAAkC,CAAC,CAAC;gBACtE,CAAC;gBACD,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;oBACrG,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAAC;gBAC9D,CAAC;gBACD,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;oBACtB,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,6BAA6B,CAAC,CAAC;gBACjE,CAAC;gBACD,gEAAgE;gBAChE,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACrD,IAAI,QAA0B,CAAC;gBAC/B,IAAI,CAAC;oBACH,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC7F,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,aAAa,CAAC,GAAG,CAAC;wBAAE,MAAM,GAAG,CAAC;oBAClC,sEAAsE;oBACtE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,YAAY,6BAA6B,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;oBAC1F,MAAM,IAAI,YAAY,EAAE,CAAC;gBAC3B,CAAC;gBACD,MAAM,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;gBAC9C,MAAM,MAAM,GAAG,MAAM,iBAAiB,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBAC5D,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;gBACzE,OAAO,MAAM,CAAC;YAChB,CAAC;YAED;;;;;eAKG;YACO,WAAW,CAAC,GAAQ;gBAC5B,MAAM,IAAI,GAAG,GAAG,EAAE,cAAc,EAAE,EAAE,CAAC;gBACrC,IAAI,CAAC,IAAI;oBAAE,OAAO;gBAClB,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC,cAAc,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;gBACnE,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;oBACrD,MAAM,IAAI,oBAAoB,EAAE,CAAC;gBACnC,CAAC;YACH,CAAC;YAED;;;;;;eAMG;YACO,KAAK,CAAC,mBAAmB,CAAC,GAAQ,EAAE,QAA0B;gBACtE,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE;oBAAE,OAAO;gBAC7C,MAAM,OAAO,GAAG,GAAG,CAAC,gBAAgB,EAAE,CAAC;gBACvC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,CAClC,iBAAiB,EAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,WAAW,CAAC,CAChF,CAAC;gBACF,MAAM,KAAK,GAAG,KAAK,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC;gBAC3C,IAAI,KAAK,KAAK,OAAO;oBAAE,OAAO;gBAC9B,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,IAAI,oBAAoB,EAAE,CAAC;gBACnC,CAAC;gBACD,GAAG,CAAC,UAAU,EAAE,CAAC;YACnB,CAAC;YAED;;;;eAIG;YACO,aAAa,CAAC,QAA0B;gBAChD,IAAI,CAAC,QAAQ,EAAE,WAAW,IAAI,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;oBACvE,MAAM,IAAI,YAAY,CAAC,8BAA8B,CAAC,CAAC;gBACzD,CAAC;gBACD,OAAO,QAAQ,CAAC;YAClB,CAAC;YAED;;;eAGG;YACO,WAAW,CAAC,QAA0B;gBAC9C,OAAO;oBACL,GAAG,QAAQ;oBACX,QAAQ,EAAE,IAAI,CAAC,YAAY;oBAC3B,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;iBACrD,CAAC;YACJ,CAAC;YAED;;;;;eAKG;YACO,eAAe,CAAC,QAAiB;gBACzC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,YAAY,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBACjH,OAAO,SAAS,CAAC;gBACnB,CAAC;gBACD,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;gBACtC,IAAI,CAAC,MAAM;oBAAE,OAAO,SAAS,CAAC;gBAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,eAAe,IAAI,EAAE,EAAE,CAAC;oBACxD,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;oBAClC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;wBAAE,SAAS;oBAC3D,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC;oBAC9B,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC;wBACnG,OAAO,MAAM,CAAC,IAAI,CAAC;oBACrB,CAAC;gBACH,CAAC;gBACD,OAAO,SAAS,CAAC;YACnB,CAAC;YAED;;;eAGG;YACO,cAAc,CAAC,GAAe;gBACtC,OAAO,IAAI,CAAC,UAAU,CAAC,YAAY,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,EAAE,WAAW,CAAC,CAAC;YACtH,CAAC;YAED;;;;;;eAMG;YACO,iBAAiB,CAAC,GAAe,EAAE,WAAmB,EAAE,KAAc;gBAC9E,MAAM,QAAQ,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;gBAC3C,MAAM,OAAO,GAAG,IAAI,aAAa,CAC/B;oBACE,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE;oBAC1B,IAAI,EAAE,QAAQ,EAAE,QAAQ,IAAI,GAAG;oBAC/B,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;oBAC/B,QAAQ,EAAE,KAAK;oBACf,QAAQ,EAAE,IAAI;iBACf,EACD,GAAG,CAAC,cAAc,EAAE,CACrB,CAAC;gBACF,mDAAmD;gBACnD,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,QAAQ,EAAE,QAAQ,KAAK,QAAQ,CAAC;gBACnE,IAAI,KAAK,EAAE,CAAC;oBACV,YAAY,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;gBACrE,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;gBAChD,CAAC;YACH,CAAC;YAED;;;;eAIG;YACO,KAAK,CAAC,cAAc,CAAC,GAAe;gBAC5C,MAAM,GAAG,GAAG,GAAG,CAAC,cAAc,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;gBACzE,uEAAuE;gBACvE,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;gBACtD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG;oBAAE,OAAO,SAAS,CAAC;gBACtD,IAAI,OAAqB,CAAC;gBAC1B,IAAI,CAAC;oBACH,OAAO,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAC3C,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,SAAS,CAAC;gBACnB,CAAC;gBACD,IACE,CAAC,OAAO;oBACR,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,YAAY;oBACtC,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;oBACjC,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ;oBACpC,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;oBACjC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC,OAAO,CAAC,EAChC,CAAC;oBACD,OAAO,SAAS,CAAC;gBACnB,CAAC;gBACD,OAAO,OAAO,CAAC;YACjB,CAAC;YAED;;;;eAIG;YACO,QAAQ,CAAC,GAAe,EAAE,GAAW;gBAC7C,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;gBAC3C,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;YAED;;;eAGG;YACO,IAAI,CAAC,GAAe,EAAE,MAAc;gBAC5C,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;YAC/E,CAAC;YAED;;;eAGG;YAQH,KAAK,CAAC,KAAK,CAAC,GAAe;gBACzB,IAAI,CAAC;oBACH,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;oBAC5C,IAAI,QAA4B,CAAC;oBACjC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;wBAChD,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;wBAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;4BACd,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;4BACvC,OAAO;wBACT,CAAC;oBACH,CAAC;oBACD,MAAM,OAAO,GAAiB;wBAC5B,QAAQ,EAAE,IAAI,CAAC,YAAY;wBAC3B,KAAK,EAAE,YAAY,CAAC,EAAE,CAAC;wBACvB,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC;wBAC1B,KAAK,EAAE,YAAY,CAAC,EAAE,CAAC;wBACvB,QAAQ;wBACR,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC;wBACrC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,GAAG,IAAI;qBACzC,CAAC;oBACF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC;wBACzC,KAAK,EAAE,OAAO,CAAC,KAAK;wBACpB,WAAW,EAAE,OAAO,CAAC,WAAW;wBAChC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE;wBAClC,aAAa,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC;wBAChF,mBAAmB,EAAE,MAAM;wBAC3B,KAAK,EAAE,OAAO,CAAC,KAAK;qBACrB,CAAC,CAAC;oBACH,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,WAAW,EAAE,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;oBACrF,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBAC1B,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,gBAAgB,IAAI,CAAC,YAAY,SAAS,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;oBACpF,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;gBAChC,CAAC;YACH,CAAC;YAED;;;eAGG;YAQH,KAAK,CAAC,QAAQ,CAAC,GAAe;gBAC5B,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;oBAC/C,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;oBACrC,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;wBAC/E,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;wBACjC,OAAO;oBACT,CAAC;oBACD,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;oBACnC,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,SAAS,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;wBAC9E,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;wBACjC,OAAO;oBACT,CAAC;oBACD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;wBAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAC/B,IAAI,CAAC,aAAa,CAChB,MAAM,IAAI,CAAC,cAAc,CAAC;4BACxB,IAAI;4BACJ,WAAW,EAAE,OAAO,CAAC,WAAW;4BAChC,YAAY,EAAE,OAAO,CAAC,QAAQ;4BAC9B,KAAK,EAAE,OAAO,CAAC,KAAK;yBACrB,CAAC,CACH,CACF,CAAC;wBACF,MAAM,GAAG,GAAG,MAAM,iBAAiB,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;wBACzD,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;wBACtD,OAAO,GAAG,CAAC;oBACb,CAAC,CAAC,CAAC;oBACH,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,OAAO,IAAI,GAAG,CAAC;oBAC5E,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,KAAK,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;gBACzG,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;oBAChC,IAAI,CAAC,IAAI,EAAE,CAAC;wBACV,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,YAAY,mBAAmB,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;oBACnF,CAAC;oBACD,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,aAAa,CAAC,CAAC;gBACxC,CAAC;YACH,CAAC;;;gBAzamB,mDAAa;;;;;iCA8UhC,KAAK,CAAC,eAAe,EAAE,CAAC,KAAK,CAAC,EAAE;oBAC/B,GAAG,EAAE;wBACH,OAAO,EAAE,sBAAsB;wBAC/B,WAAW,EAAE,+EAA+E;wBAC5F,SAAS,EAAE,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,mDAAmD,EAAE,EAAE;qBAC3F;iBACF,CAAC;oCAyCD,KAAK,CAAC,kCAAkC,EAAE,CAAC,KAAK,CAAC,EAAE;oBAClD,GAAG,EAAE;wBACH,OAAO,EAAE,gBAAgB;wBACzB,WAAW,EAAE,gDAAgD;wBAC7D,SAAS,EAAE,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,mEAAmE,EAAE,EAAE;qBAC3G;iBACF,CAAC;YA9CF,gKAAM,KAAK,6DAkCV;YAaD,yKAAM,QAAQ,6DAqCb;;;QAlaM,aAAU,GAAG,uBAAwB;;;SAPxB,aAAa"}

package/lib/provider.d.ts

@@ -0,0 +1,53 @@
+import { type ProviderInfo, type ResolvedIdentity, type Service } from "@webda/core";
+import type { Authentication } from "./authentication.service.js";
+/** A login method plugged into {@link Authentication} */
+export interface AuthProvider extends Service {
+    /** Unique provider name, used in ident keys ("email", "google") */
+    readonly providerName: string;
+    /**
+     * @returns what clients see in Auth.Providers
+     */
+    getPublicInfo(): ProviderInfo;
+    /**
+     * Email rules of this provider; when absent, Authentication reads the provider service parameters
+     * @returns the email policy
+     */
+    getEmailPolicy?(): ProviderEmailPolicy;
+}
+/** Per-provider rules on asserted emails; read from the provider service parameters */
+export interface ProviderEmailPolicy {
+    /**
+     * Only identities whose email domain is listed may log in (case-insensitive, exact domain match, no wildcard).
+     * The email must also be verified and trusted (see trustEmailVerification). An empty list refuses everyone.
+     * Undefined means all domains.
+     */
+    allowedEmailDomains?: string[];
+    /**
+     * Whether the provider's emailVerified claim is believed: true (default) = all domains, false = never,
+     * string[] = only these domains.
+     */
+    trustEmailVerification?: boolean | string[];
+}
+/**
+ * @param email - an email address
+ * @returns the lowercased part after the last "@", undefined if none
+ */
+export declare function emailDomain(email: string): string | undefined;
+/**
+ * Apply a provider email policy to a resolved identity without mutating it
+ * @param identity - identity asserted by the provider
+ * @param policy - the provider policy, if any
+ * @returns the identity to use (a copy with emailVerified forced to false when the claim is not trusted)
+ * @throws EmailDomainNotAllowed when the email is missing or its domain is not allowed
+ */
+export declare function applyEmailPolicy(identity: ResolvedIdentity, policy: ProviderEmailPolicy | undefined): ResolvedIdentity;
+/**
+ * @param service - any service
+ * @returns true when it implements AuthProvider
+ */
+export declare function isAuthProvider(service: any): service is AuthProvider;
+/**
+ * @returns the Authentication service
+ */
+export declare function useAuthentication(): Authentication;
+//# sourceMappingURL=provider.d.ts.map

package/lib/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,gBAAgB,EAAE,KAAK,OAAO,EAAqB,MAAM,aAAa,CAAC;AACxG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAGlE,yDAAyD;AACzD,MAAM,WAAW,YAAa,SAAQ,OAAO;IAC3C,mEAAmE;IACnE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;;OAEG;IACH,aAAa,IAAI,YAAY,CAAC;IAC9B;;;OAGG;IACH,cAAc,CAAC,IAAI,mBAAmB,CAAC;CACxC;AAED,uFAAuF;AACvF,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B;;;OAGG;IACH,sBAAsB,CAAC,EAAE,OAAO,GAAG,MAAM,EAAE,CAAC;CAC7C;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAQ7D;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,gBAAgB,EAC1B,MAAM,EAAE,mBAAmB,GAAG,SAAS,GACtC,gBAAgB,CAmBlB;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,GAAG,GAAG,OAAO,IAAI,YAAY,CAEpE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,cAAc,CAElD"}