@webda/core 4.0.0-beta.3 → 4.0.0-beta.4

package/lib/services/oauth.js

@@ -1,405 +0,0 @@
-var __runInitializers = (this && this.__runInitializers) || function (thisArg, initializers, value) {
-    var useValue = arguments.length > 2;
-    for (var i = 0; i < initializers.length; i++) {
-        value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
-    }
-    return useValue ? value : void 0;
-};
-var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
-    function accept(f) { if (f !== void 0 && typeof f !== "function") throw new TypeError("Function expected"); return f; }
-    var kind = contextIn.kind, key = kind === "getter" ? "get" : kind === "setter" ? "set" : "value";
-    var target = !descriptorIn && ctor ? contextIn["static"] ? ctor : ctor.prototype : null;
-    var descriptor = descriptorIn || (target ? Object.getOwnPropertyDescriptor(target, contextIn.name) : {});
-    var _, done = false;
-    for (var i = decorators.length - 1; i >= 0; i--) {
-        var context = {};
-        for (var p in contextIn) context[p] = p === "access" ? {} : contextIn[p];
-        for (var p in contextIn.access) context.access[p] = contextIn.access[p];
-        context.addInitializer = function (f) { if (done) throw new TypeError("Cannot add initializers after decoration has completed"); extraInitializers.push(accept(f || null)); };
-        var result = (0, decorators[i])(kind === "accessor" ? { get: descriptor.get, set: descriptor.set } : descriptor[key], context);
-        if (kind === "accessor") {
-            if (result === void 0) continue;
-            if (result === null || typeof result !== "object") throw new TypeError("Object expected");
-            if (_ = accept(result.get)) descriptor.get = _;
-            if (_ = accept(result.set)) descriptor.set = _;
-            if (_ = accept(result.init)) initializers.unshift(_);
-        }
-        else if (_ = accept(result)) {
-            if (kind === "field") initializers.unshift(_);
-            else descriptor[key] = _;
-        }
-    }
-    if (target) Object.defineProperty(target, contextIn.name, descriptor);
-    done = true;
-};
-import * as WebdaError from "../errors/errors.js";
-import { Service } from "./service.js";
-import { getUuid } from "@webda/utils";
-import { Route } from "../rest/irest.js";
-import { Counter } from "../metrics/metrics.js";
-import { RegExpStringValidator } from "@webda/utils";
-import { ServiceParameters } from "../services/serviceparameters.js";
-import { useService } from "../core/hooks.js";
-/** Parameters for OAuth services including client credentials, scopes, and redirect URIs */
-export class OAuthServiceParameters extends ServiceParameters {
-    /**
-     * Scope to request on OAuth flow
-     *
-     * @defaut ["email"]
-     */
-    scope;
-    /**
-     * If set to true it will add a ${url}/scope
-     * So client can anticipate the requested scope
-     *
-     * This is useful when using the client api to generate
-     * token. This way the service can request the wanted scope
-     *
-     * @default false
-     */
-    exposeScope;
-    /**
-     * List of URIs authorized for redirect post authorization
-     *
-     * @default []
-     */
-    authorized_uris;
-    /**
-     * Default redirect_uri
-     *
-     * @default ${url}/callback
-     */
-    redirect_uri;
-    /**
-     * Allow direct connection without a referer
-     *
-     * @default false
-     */
-    no_referer;
-    /**
-     * Name of the authentication service to use if exist
-     * @default Authentication
-     */
-    authenticationService;
-    /**
-     * Load parameters with defaults for scopes, auth service, and URI settings
-     * @param params - the service parameters
-     * @returns the result
-     */
-    load(params) {
-        super.load(params);
-        this.scope ??= ["email"];
-        this.exposeScope ??= false;
-        this.authenticationService ??= "Authentication";
-        this.authorized_uris ??= [];
-        this.no_referer ??= false;
-        return this;
-    }
-}
-/**
- * OAuth service implementing the default OAuth workflow
- * It is abstract as it does not manage any provider as is
- */
-let OAuthService = (() => {
-    let _classSuper = Service;
-    let _instanceExtraInitializers = [];
-    let __redirect_decorators;
-    return class OAuthService extends _classSuper {
-        static {
-            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
-            __redirect_decorators = [Route(".{?redirect?}", ["GET"], {
-                    get: {
-                        description: "Log with a ${name} account",
-                        summary: "Redirect to ${name}",
-                        operationId: "logInWith${name}",
-                        responses: {
-                            "302": { description: "" },
-                            "400": { description: "Missing token" }
-                        }
-                    }
-                })];
-            __esDecorate(this, null, __redirect_decorators, { kind: "method", name: "_redirect", static: false, private: false, access: { has: obj => "_redirect" in obj, get: obj => obj._redirect }, metadata: _metadata }, null, _instanceExtraInitializers);
-            if (_metadata) Object.defineProperty(this, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
-        }
-        _authenticationService = __runInitializers(this, _instanceExtraInitializers);
-        authorized_uris;
-        /**
-         * Ensure default parameter url
-         * @param name - the service name
-         * @param params - the service parameters
-         */
-        constructor(name, params) {
-            super(name, params);
-            this.parameters.url ??= this.getDefaultUrl();
-        }
-        /** Initialize OAuth-specific metrics for tracking logins */
-        initMetrics() {
-            super.initMetrics();
-            this.metrics.login = this.getMetric(Counter, {
-                name: "oauth_login",
-                help: "count the number of login",
-                labelNames: ["method"]
-            });
-        }
-        /**
-         * Allow callback referer to access this url no matter what
-         * @param context - the execution context
-         * @returns true if the condition is met
-         */
-        async checkRequest(context) {
-            // Only authorize url from this service
-            if (!context.getHttpContext().getRelativeUri().startsWith(this.parameters.url)) {
-                return false;
-            }
-            const regexps = this.getCallbackReferer();
-            let valid = false;
-            const referer = context.getHttpContext().getUniqueHeader("referer", "");
-            if (this.parameters.no_referer && referer === "") {
-                return true;
-            }
-            for (const i in regexps) {
-                valid = referer.match(regexps[i]) !== null;
-                if (valid) {
-                    break;
-                }
-            }
-            return valid;
-        }
-        /**
-         * Resolve dynamic dependancy
-         * @returns this for chaining
-         */
-        resolve() {
-            super.resolve();
-            this.parameters.with(params => {
-                if (params.url === undefined) {
-                    params.url = this.getDefaultUrl();
-                }
-                if (params.authorized_uris === undefined) {
-                    this.log("WARN", "Not defining authorized_uris is a security risk");
-                }
-                else {
-                    this.authorized_uris = new RegExpStringValidator(params.authorized_uris);
-                }
-                this._authenticationService = useService(this.parameters.authenticationService);
-            });
-            return this;
-        }
-        /**
-         * Get OAuth callback query parameters
-         * @returns the result
-         */
-        getCallbackQueryParams() {
-            return [
-                {
-                    name: "code",
-                    required: true
-                },
-                {
-                    name: "scope",
-                    required: true
-                },
-                {
-                    name: "state",
-                    required: true
-                }
-            ];
-        }
-        /**
-         * Register callback + optional token/scope routes.
-         *
-         * `_redirect` is declared via `@Route` below. The callback query string
-         * depends on {@link getCallbackQueryParams} (subclass-overridable), and
-         * the token/scope routes are conditional on {@link hasToken} and
-         * `parameters.exposeScope`, so those three stay programmatic.
-         *
-         * @returns this for chaining
-         */
-        async init() {
-            await super.init();
-            const name = this.getName();
-            this.addRoute(this.parameters.url +
-                "/callback{?" +
-                this.getCallbackQueryParams()
-                    .map(param => param.name + (param.required ? "" : "?"))
-                    .join(",") +
-                "}", ["GET"], this._callback, {
-                get: {
-                    description: `Get result from ${name} Authentication`,
-                    summary: `Use the token provide to validate with ${name} the user`,
-                    operationId: `callbackFrom${name}`,
-                    responses: {
-                        "204": {
-                            description: ""
-                        },
-                        "400": {
-                            description: "Missing token"
-                        }
-                    }
-                }
-            });
-            if (this.hasToken()) {
-                this.addRoute(this.parameters.url + "/token", ["POST"], this._token, {
-                    post: {
-                        description: `Log with a ${name} token`,
-                        summary: `Use the token provide to validate with ${name} the user`,
-                        operationId: `verify${name}Token`,
-                        responses: {
-                            "204": {
-                                description: ""
-                            },
-                            "400": {
-                                description: "Missing token"
-                            }
-                        }
-                    }
-                });
-            }
-            if (this.parameters.exposeScope) {
-                this.addRoute(this.parameters.url + "/scope", ["GET"], this._scope, {
-                    get: {
-                        description: `List ${name} auth scope for this apps`,
-                        summary: "Retrieve the scope intended to be used with this auth",
-                        operationId: `get${name}Scope`,
-                        responses: {
-                            "204": {
-                                description: ""
-                            },
-                            "400": {
-                                description: "Missing token"
-                            }
-                        }
-                    }
-                });
-            }
-            return this;
-        }
-        /**
-         * Expose the scope used by the authentication
-         * @param ctx - the operation context
-         */
-        _scope(ctx) {
-            ctx.write(this.parameters.scope);
-        }
-        /**
-         * Define if this provider allow authentication by tokens
-         * @returns true if the condition is met
-         */
-        hasToken() {
-            return false;
-        }
-        /**
-         * Check if the url is authorized
-         * @param redirect - the redirect URL
-         * @param context - the execution context
-         * @returns true if the condition is met
-         */
-        isAuthorizedUri(redirect, context) {
-            return (!this.parameters.authorized_uris || // If no authorized_uris defined, allow all
-                this.authorized_uris?.validate(redirect) || // If redirect is included in authorized_uris
-                (this.parameters.no_referer && !context.getHttpContext().getUniqueHeader("referer"))); // If no_referer is allowed
-        }
-        /**
-         * Inject the provider name into openapi template replacements so the
-         * `${name}` placeholders in `@Route` metadata resolve per-instance.
-         *
-         * @returns replacements map merged with defaults
-         */
-        getOpenApiReplacements() {
-            return { ...super.getOpenApiReplacements(), name: this.getName() };
-        }
-        /**
-         * Redirect to the OAuth provider
-         *
-         * The calling url must be and authorized_uris if defined
-         * @param ctx - the operation context
-         */
-        _redirect(ctx) {
-            // implement default behavior
-            const redirect_uri = this.parameters.redirect_uri || `${ctx.getHttpContext().getAbsoluteUrl()}/callback`;
-            const redirect = ctx.getParameters().redirect || ctx.getHttpContext().getHeaders().referer;
-            if (!this.isAuthorizedUri(redirect, ctx)) {
-                throw new WebdaError.Unauthorized("Unauthorized redirect parameter");
-            }
-            const session = ctx.getSession();
-            session.oauth ??= {};
-            // Generate 2 random uuid: nonce and state
-            session.oauth.state = getUuid("base64");
-            // Redirect to the calling uri
-            session.oauth.redirect = redirect;
-            ctx.redirect(this.generateAuthUrl(redirect_uri, session.oauth.state, ctx));
-        }
-        /**
-         * Handle a token return
-         *
-         * This is private to avoid any override
-         * @param context - the execution context
-         */
-        async _token(context) {
-            const res = await this.handleToken(context);
-            await this.handleReturn(context, res.identId, res.profile);
-            await this.emit("OAuth.Callback", {
-                ...res,
-                type: "token",
-                provider: this.getName(),
-                context
-            });
-            this.metrics.login.inc({ method: "token" });
-        }
-        /**
-         * Handle a standard url callback
-         *
-         * This is private to avoid any override
-         * @param ctx - the operation context
-         */
-        async _callback(ctx) {
-            const res = await this.handleCallback(ctx);
-            await this.handleReturn(ctx, res.identId, res.profile);
-            await this.emit("OAuth.Callback", {
-                ...res,
-                type: "callback",
-                provider: this.getName(),
-                context: ctx
-            });
-            this.metrics.login.inc({ method: "callback" });
-        }
-        /**
-         * Once approved by the OAuth provider this will do the common task
-         * @param ctx - the operation context
-         * @param identId - the identity identifier
-         * @param profile - the user profile
-         * @param _tokens - the authentication tokens
-         */
-        async handleReturn(ctx, identId, profile, _tokens = undefined) {
-            // If no identId has been provided error
-            if (!identId) {
-                throw new WebdaError.Forbidden("No identId provided by the OAuth provider");
-            }
-            const session = ctx.getSession();
-            session.oauth ??= {};
-            // If authentication service then create a User/Ident couple
-            if (this._authenticationService) {
-                // Should call the onIdentLogin()
-                await this._authenticationService.onIdentLogin(ctx, this.getName().toLowerCase(), identId, profile);
-            }
-            else {
-                // Login in session
-                ctx.getSession().login(identId, identId);
-                // Store the profile retrieved
-                session.oauth.profile = profile;
-            }
-            // Redirect to our targets
-            if (session.oauth.redirect) {
-                ctx.redirect(session.oauth.redirect);
-            }
-            else {
-                ctx.write("Your authentication is successful");
-            }
-            // Clean variables from session
-            session.oauth.state = undefined;
-            session.oauth.redirect = undefined;
-        }
-    };
-})();
-export { OAuthService };
-//# sourceMappingURL=oauth.js.map

package/lib/services/oauth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../src/services/oauth.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,KAAK,UAAU,MAAM,qBAAqB,CAAC;AAElD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAiB,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAExD,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAe,UAAU,EAAE,MAAM,kBAAkB,CAAC;AA4B3D,4FAA4F;AAC5F,MAAM,OAAO,sBAAuB,SAAQ,iBAAiB;IAU3D;;;;OAIG;IACH,KAAK,CAAW;IAChB;;;;;;;;OAQG;IACH,WAAW,CAAU;IACrB;;;;OAIG;IACH,eAAe,CAAY;IAC3B;;;;OAIG;IACH,YAAY,CAAU;IACtB;;;;OAIG;IACH,UAAU,CAAU;IAEpB;;;OAGG;IACH,qBAAqB,CAAS;IAE9B;;;;OAIG;IACH,IAAI,CAAC,MAAW;QACd,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,IAAI,CAAC,KAAK,KAAK,CAAC,OAAO,CAAC,CAAC;QACzB,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC;QAC3B,IAAI,CAAC,qBAAqB,KAAK,gBAAgB,CAAC;QAChD,IAAI,CAAC,eAAe,KAAK,EAAE,CAAC;QAC5B,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AA6BD;;;GAGG;IACmB,YAAY;sBAIxB,OAAO;;;iBAJK,YAIpB,SAAQ,WAAa;;;qCAiOpB,KAAK,CAAC,eAAe,EAAE,CAAC,KAAK,CAAC,EAAE;oBAC/B,GAAG,EAAE;wBACH,WAAW,EAAE,4BAA4B;wBACzC,OAAO,EAAE,qBAAqB;wBAC9B,WAAW,EAAE,kBAAkB;wBAC/B,SAAS,EAAE;4BACT,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE;4BAC1B,KAAK,EAAE,EAAE,WAAW,EAAE,eAAe,EAAE;yBACxC;qBACF;iBACF,CAAC;YACF,8KAAA,SAAS,6DAgBR;;;QAzPD,sBAAsB,GAPF,mDAAY,CAOO;QAQvC,eAAe,CAAwB;QAEvC;;;;WAIG;QACH,YAAY,IAAY,EAAE,MAAY;YACpC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACpB,IAAI,CAAC,UAAU,CAAC,GAAG,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;QAC/C,CAAC;QAED,4DAA4D;QAC5D,WAAW;YACT,KAAK,CAAC,WAAW,EAAE,CAAC;YACpB,IAAI,CAAC,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE;gBAC3C,IAAI,EAAE,aAAa;gBACnB,IAAI,EAAE,2BAA2B;gBACjC,UAAU,EAAE,CAAC,QAAQ,CAAC;aACvB,CAAC,CAAC;QACL,CAAC;QAED;;;;WAIG;QACH,KAAK,CAAC,YAAY,CAAC,OAAmB;YACpC,uCAAuC;YACvC,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,cAAc,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/E,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC1C,IAAI,KAAK,GAAG,KAAK,CAAC;YAClB,MAAM,OAAO,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,eAAe,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YACxE,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;gBACjD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;gBAC3C,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM;gBACR,CAAC;YACH,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAED;;;WAGG;QACH,OAAO;YACL,KAAK,CAAC,OAAO,EAAE,CAAC;YAChB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;gBAC5B,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;oBAC7B,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;gBACpC,CAAC;gBACD,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;oBACzC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,iDAAiD,CAAC,CAAC;gBACtE,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,eAAe,GAAG,IAAI,qBAAqB,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;gBAC3E,CAAC;gBACD,IAAI,CAAC,sBAAsB,GAAG,UAAU,CACtC,IAAI,CAAC,UAAU,CAAC,qBAA0C,CAC9B,CAAC;YACjC,CAAC,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAED;;;WAGG;QACH,sBAAsB;YACpB,OAAO;gBACL;oBACE,IAAI,EAAE,MAAM;oBACZ,QAAQ,EAAE,IAAI;iBACf;gBACD;oBACE,IAAI,EAAE,OAAO;oBACb,QAAQ,EAAE,IAAI;iBACf;gBACD;oBACE,IAAI,EAAE,OAAO;oBACb,QAAQ,EAAE,IAAI;iBACf;aACF,CAAC;QACJ,CAAC;QAED;;;;;;;;;WASG;QACH,KAAK,CAAC,IAAI;YACR,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;YACnB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAE5B,IAAI,CAAC,QAAQ,CACX,IAAI,CAAC,UAAU,CAAC,GAAG;gBACjB,aAAa;gBACb,IAAI,CAAC,sBAAsB,EAAE;qBAC1B,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;qBACtD,IAAI,CAAC,GAAG,CAAC;gBACZ,GAAG,EACL,CAAC,KAAK,CAAC,EACP,IAAI,CAAC,SAAS,EACd;gBACE,GAAG,EAAE;oBACH,WAAW,EAAE,mBAAmB,IAAI,iBAAiB;oBACrD,OAAO,EAAE,0CAA0C,IAAI,WAAW;oBAClE,WAAW,EAAE,eAAe,IAAI,EAAE;oBAClC,SAAS,EAAE;wBACT,KAAK,EAAE;4BACL,WAAW,EAAE,EAAE;yBAChB;wBACD,KAAK,EAAE;4BACL,WAAW,EAAE,eAAe;yBAC7B;qBACF;iBACF;aACF,CACF,CAAC;YAEF,IAAI,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;gBACpB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,GAAG,QAAQ,EAAE,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE;oBACnE,IAAI,EAAE;wBACJ,WAAW,EAAE,cAAc,IAAI,QAAQ;wBACvC,OAAO,EAAE,0CAA0C,IAAI,WAAW;wBAClE,WAAW,EAAE,SAAS,IAAI,OAAO;wBACjC,SAAS,EAAE;4BACT,KAAK,EAAE;gCACL,WAAW,EAAE,EAAE;6BAChB;4BACD,KAAK,EAAE;gCACL,WAAW,EAAE,eAAe;6BAC7B;yBACF;qBACF;iBACF,CAAC,CAAC;YACL,CAAC;YAED,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC;gBAChC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,GAAG,QAAQ,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE;oBAClE,GAAG,EAAE;wBACH,WAAW,EAAE,QAAQ,IAAI,2BAA2B;wBACpD,OAAO,EAAE,uDAAuD;wBAChE,WAAW,EAAE,MAAM,IAAI,OAAO;wBAC9B,SAAS,EAAE;4BACT,KAAK,EAAE;gCACL,WAAW,EAAE,EAAE;6BAChB;4BACD,KAAK,EAAE;gCACL,WAAW,EAAE,eAAe;6BAC7B;yBACF;qBACF;iBACF,CAAC,CAAC;YACL,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED;;;WAGG;QACH,MAAM,CAAC,GAAqB;YAC1B,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;QAED;;;WAGG;QACH,QAAQ;YACN,OAAO,KAAK,CAAC;QACf,CAAC;QAED;;;;;WAKG;QACH,eAAe,CAAC,QAAgB,EAAE,OAAmB;YACnD,OAAO,CACL,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,IAAI,2CAA2C;gBAC/E,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI,6CAA6C;gBACzF,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CACrF,CAAC,CAAC,2BAA2B;QAChC,CAAC;QAED;;;;;WAKG;QACH,sBAAsB;YACpB,OAAO,EAAE,GAAG,KAAK,CAAC,sBAAsB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QACrE,CAAC;QAED;;;;;WAKG;QAYH,SAAS,CAAC,GAAe;YACvB,6BAA6B;YAC7B,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC,YAAY,IAAI,GAAG,GAAG,CAAC,cAAc,EAAE,CAAC,cAAc,EAAE,WAAW,CAAC;YACzG,MAAM,QAAQ,GAAG,GAAG,CAAC,aAAa,EAAE,CAAC,QAAQ,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC,UAAU,EAAE,CAAC,OAAO,CAAC;YAE3F,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,UAAU,CAAC,YAAY,CAAC,iCAAiC,CAAC,CAAC;YACvE,CAAC;YAED,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,EAAgB,CAAC;YAC/C,OAAO,CAAC,KAAK,KAAK,EAAE,CAAC;YACrB,0CAA0C;YAC1C,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;YACxC,8BAA8B;YAC9B,OAAO,CAAC,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAC;YAClC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QAC7E,CAAC;QAED;;;;;WAKG;QACK,KAAK,CAAC,MAAM,CAAC,OAAmB;YACtC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YAC3D,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAmB;gBACjD,GAAG,GAAG;gBACN,IAAI,EAAE,OAAO;gBACb,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE;gBACxB,OAAO;aACR,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9C,CAAC;QAED;;;;;WAKG;QACK,KAAK,CAAC,SAAS,CAAC,GAAe;YACrC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;YAC3C,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YACvD,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE;gBAChC,GAAG,GAAG;gBACN,IAAI,EAAE,UAAU;gBAChB,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE;gBACxB,OAAO,EAAE,GAAG;aACb,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;QACjD,CAAC;QAED;;;;;;WAMG;QACH,KAAK,CAAC,YAAY,CAAC,GAAe,EAAE,OAAe,EAAE,OAAY,EAAE,OAAO,GAAQ,SAAS;YACzF,wCAAwC;YACxC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,UAAU,CAAC,SAAS,CAAC,2CAA2C,CAAC,CAAC;YAC9E,CAAC;YAED,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,EAAgB,CAAC;YAC/C,OAAO,CAAC,KAAK,KAAK,EAAE,CAAC;YACrB,4DAA4D;YAC5D,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;gBAChC,iCAAiC;gBACjC,MAAM,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YACtG,CAAC;iBAAM,CAAC;gBACN,mBAAmB;gBACnB,GAAG,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACzC,8BAA8B;gBAC9B,OAAO,CAAC,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;YAClC,CAAC;YAED,0BAA0B;YAC1B,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;gBAC3B,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACvC,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;YACjD,CAAC;YACD,+BAA+B;YAC/B,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC;YAChC,OAAO,CAAC,KAAK,CAAC,QAAQ,GAAG,SAAS,CAAC;QACrC,CAAC;;;SAzUmB,YAAY"}