@wizeworks/lens-cloud 0.3.0-alpha.3 → 0.3.0-alpha.5

package/dist/auth/hooks.js

@@ -1,9 +1,11 @@
 import { APIError, createAuthMiddleware, getSessionFromCtx, isAPIError } from "better-auth/api";
 import { isOrgRole } from "@wizeworks/lens-core";
 import { audit } from "../repo/audit.js";
+import { auditScim, billingGuard } from "./billing-hooks.js";
 import { emailChangeOf } from "./email-token.js";
 import { isLegacyHash } from "./password.js";
 import { rememberPasskey, securityAfter } from "./security-notices.js";
+import { pruneProjectRoles } from "../repo/project-roles.js";
 const ROLE_PATHS = new Set(["/organization/invite-member", "/organization/update-member-role", "/organization/add-member"]);
 const NEEDS_ORG = new Set(["/organization/invite-member", "/organization/update-member-role", "/organization/remove-member", "/organization/update", "/organization/leave"]);
 /** Organization changes, as our audit log names them. */
@@ -115,6 +117,7 @@ async function auditOrgChange(deps, ctx) {
     const removed = ctx.request && removedEmailOf.get(ctx.request);
     const detail = { ...Object.fromEntries(Object.entries((ctx.body ?? {})).filter(([k]) => !SECRET_KEYS.includes(k))), ...(removed ? { memberEmail: removed } : {}) };
     await audit(deps.db, orgId, actor ? `user:${actor}` : "system", action, detail, Date.now());
+    await pruneProjectRoles(deps.db, orgId);
 }
 async function auditSsoChange(deps, ctx) {
     const action = SSO_AUDITED[ctx.path];
@@ -128,7 +131,10 @@ async function auditSsoChange(deps, ctx) {
 }
 export function authHooks(deps) {
     return {
-        before: createAuthMiddleware(guard),
+        before: createAuthMiddleware(async (ctx) => {
+            await billingGuard(deps, ctx);
+            return guard(ctx);
+        }),
         after: createAuthMiddleware(async (ctx) => {
             if (isAPIError(ctx.context.returned) || ctx.context.returned instanceof Error)
                 return;
@@ -136,6 +142,7 @@ export function authHooks(deps) {
                 await upgradeHash(ctx);
             await auditOrgChange(deps, ctx);
             await auditSsoChange(deps, ctx);
+            await auditScim(deps, ctx);
             await securityAfter(deps, ctx);
         }),
     };

package/dist/auth/hooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"hooks.js","sourceRoot":"","sources":["../../src/auth/hooks.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAChG,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAEzC,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAKvE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,6BAA6B,EAAE,kCAAkC,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAC5H,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,6BAA6B,EAAE,kCAAkC,EAAE,6BAA6B,EAAE,sBAAsB,EAAE,qBAAqB,CAAC,CAAC,CAAC;AAC7K,yDAAyD;AACzD,MAAM,OAAO,GAA2B;IACtC,sBAAsB,EAAE,YAAY;IACpC,6BAA6B,EAAE,eAAe;IAC9C,iCAAiC,EAAE,eAAe;IAClD,iCAAiC,EAAE,aAAa;IAChD,6BAA6B,EAAE,eAAe;IAC9C,kCAAkC,EAAE,aAAa;IACjD,qBAAqB,EAAE,cAAc;CACtC,CAAC;AACF,MAAM,WAAW,GAAG,CAAC,UAAU,EAAE,aAAa,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;AACpG,gHAAgH;AAChH,MAAM,WAAW,GAA2B;IAC1C,eAAe,EAAE,YAAY;IAC7B,sBAAsB,EAAE,YAAY;IACpC,sBAAsB,EAAE,YAAY;IACpC,oBAAoB,EAAE,YAAY;CACnC,CAAC;AACF,sHAAsH;AACtH,MAAM,QAAQ,GAAG,IAAI,OAAO,EAAkB,CAAC;AAC/C,sGAAsG;AACtG,MAAM,cAAc,GAAG,IAAI,OAAO,EAAkB,CAAC;AAErD,KAAK,UAAU,eAAe,CAAC,GAAY,EAAE,IAA6B;IACxE,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACzC,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,MAAM;QAAE,OAAO;IACpC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC9E,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAqB,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IAC7I,MAAM,KAAK,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IAClF,IAAI,KAAK;QAAE,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAGpE,4HAA4H;AAC5H,KAAK,UAAU,gBAAgB,CAAC,GAAY;IAC1C,MAAM,KAAK,GAAG,aAAa,CAAE,GAAG,CAAC,KAA6C,EAAE,KAAK,CAAC,CAAC;IACvF,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO;IACrD,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IACvE,IAAK,KAAK,EAAE,IAAmD,EAAE,gBAAgB;QAAE,MAAM,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,OAAO,EAAE,yDAAyD,EAAE,CAAC,CAAC;AAChM,CAAC;AAID,kJAAkJ;AAClJ,SAAS,QAAQ,CAAC,IAAY,EAAE,IAA6B;IAC3D,MAAM,MAAM,GAAG,IAAI,KAAK,eAAe,CAAC;IACxC,IAAI,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,+DAA+D,EAAE,CAAC,CAAC;IACzJ,IAAI,MAAM,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,mEAAmE,EAAE,CAAC,CAAC;IACjM,MAAM,IAAI,GAAG,IAAI,CAAC,UAAoB,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAoB,CAAC;IACvC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC,CAAC;IACjJ,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,KAAK,KAAK,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC,CAAC;AAC1L,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,GAAY,EAAE,IAA6B;IACvE,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACxC,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,UAAU;QAAE,OAAO;IACxC,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAqC,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;IACjK,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,GAAG,EAAE,cAAc,IAAI,SAAS,CAAC;IAC3E,IAAI,KAAK;QAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AAC9C,CAAC;AAED,8HAA8H;AAC9H,MAAM,KAAK,GAAO,KAAK,EAAE,GAAG,EAAE,EAAE;IAC9B,IAAI,GAAG,CAAC,IAAI,KAAK,eAAe;QAAE,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC/D,IAAI,GAAG,CAAC,IAAI,KAAK,yBAAyB;QAAE,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC;IACxE,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC,CAAC;QAChE,OAAO,cAAc,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;IACzD,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,iDAAiD,EAAE,CAAC,CAAC;IACpL,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAAC;IACjI,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAAC;IACnJ,IAAI,GAAG,CAAC,IAAI,KAAK,6BAA6B;QAAE,MAAM,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACnF,CAAC,CAAC;AAEF,8DAA8D;AAC9D,KAAK,UAAU,WAAW,CAAC,GAAY;IACrC,MAAM,IAAI,GAAG,GAAG,CAAC,IAA+C,CAAC;IACjE,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO;IAChF,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAG,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAClG,IAAI,KAAK,IAAI,OAAO,EAAE,QAAQ,IAAI,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,MAAM,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;AACpL,CAAC;AAED,SAAS,OAAO,CAAC,GAAY;IAC3B,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,QAAmI,CAAC;IAC1J,OAAO,GAAG,CAAE,GAAG,CAAC,IAA4C,EAAE,cAAc,CAAC,IAAI,CAAC,EAAE,cAAc,IAAI,CAAC,EAAE,MAAM,EAAE,cAAc,IAAI,CAAC,EAAE,UAAU,EAAE,cAAc,CAAC;AACnK,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAc,EAAE,GAAY;IACxD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK;QAAE,OAAO;IAC9B,MAAM,KAAK,GAAG,CAAC,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;IACtD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC9L,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAc,EAAE,GAAY;IACxD,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,MAAM,IAAI,GAAG,CAAC,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjE,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK;QAAE,OAAO;IAC9B,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;IACzD,MAAM,KAAK,GAAG,CAAC,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;IACtD,MAAM,MAAM,GAAG,EAAE,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IACrJ,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAc;IACtC,OAAO;QACL,MAAM,EAAE,oBAAoB,CAAC,KAAK,CAAC;QACnC,KAAK,EAAE,oBAAoB,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACxC,IAAI,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,YAAY,KAAK;gBAAE,OAAO;YACtF,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB;gBAAE,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;YAC1D,MAAM,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAChC,MAAM,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAChC,MAAM,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACjC,CAAC,CAAC;KACH,CAAC;AACJ,CAAC"}
+{"version":3,"file":"hooks.js","sourceRoot":"","sources":["../../src/auth/hooks.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAChG,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAE7D,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAK7D,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,6BAA6B,EAAE,kCAAkC,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAC5H,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,6BAA6B,EAAE,kCAAkC,EAAE,6BAA6B,EAAE,sBAAsB,EAAE,qBAAqB,CAAC,CAAC,CAAC;AAC7K,yDAAyD;AACzD,MAAM,OAAO,GAA2B;IACtC,sBAAsB,EAAE,YAAY;IACpC,6BAA6B,EAAE,eAAe;IAC9C,iCAAiC,EAAE,eAAe;IAClD,iCAAiC,EAAE,aAAa;IAChD,6BAA6B,EAAE,eAAe;IAC9C,kCAAkC,EAAE,aAAa;IACjD,qBAAqB,EAAE,cAAc;CACtC,CAAC;AACF,MAAM,WAAW,GAAG,CAAC,UAAU,EAAE,aAAa,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;AACpG,gHAAgH;AAChH,MAAM,WAAW,GAA2B;IAC1C,eAAe,EAAE,YAAY;IAC7B,sBAAsB,EAAE,YAAY;IACpC,sBAAsB,EAAE,YAAY;IACpC,oBAAoB,EAAE,YAAY;CACnC,CAAC;AACF,sHAAsH;AACtH,MAAM,QAAQ,GAAG,IAAI,OAAO,EAAkB,CAAC;AAC/C,sGAAsG;AACtG,MAAM,cAAc,GAAG,IAAI,OAAO,EAAkB,CAAC;AAErD,KAAK,UAAU,eAAe,CAAC,GAAY,EAAE,IAA6B;IACxE,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACzC,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,MAAM;QAAE,OAAO;IACpC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC9E,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAqB,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IAC7I,MAAM,KAAK,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IAClF,IAAI,KAAK;QAAE,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAGpE,4HAA4H;AAC5H,KAAK,UAAU,gBAAgB,CAAC,GAAY;IAC1C,MAAM,KAAK,GAAG,aAAa,CAAE,GAAG,CAAC,KAA6C,EAAE,KAAK,CAAC,CAAC;IACvF,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO;IACrD,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IACvE,IAAK,KAAK,EAAE,IAAmD,EAAE,gBAAgB;QAAE,MAAM,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,OAAO,EAAE,yDAAyD,EAAE,CAAC,CAAC;AAChM,CAAC;AAID,kJAAkJ;AAClJ,SAAS,QAAQ,CAAC,IAAY,EAAE,IAA6B;IAC3D,MAAM,MAAM,GAAG,IAAI,KAAK,eAAe,CAAC;IACxC,IAAI,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,+DAA+D,EAAE,CAAC,CAAC;IACzJ,IAAI,MAAM,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,mEAAmE,EAAE,CAAC,CAAC;IACjM,MAAM,IAAI,GAAG,IAAI,CAAC,UAAoB,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAoB,CAAC;IACvC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC,CAAC;IACjJ,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,KAAK,KAAK,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC,CAAC;AAC1L,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,GAAY,EAAE,IAA6B;IACvE,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACxC,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,UAAU;QAAE,OAAO;IACxC,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAqC,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;IACjK,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,GAAG,EAAE,cAAc,IAAI,SAAS,CAAC;IAC3E,IAAI,KAAK;QAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AAC9C,CAAC;AAED,8HAA8H;AAC9H,MAAM,KAAK,GAAO,KAAK,EAAE,GAAG,EAAE,EAAE;IAC9B,IAAI,GAAG,CAAC,IAAI,KAAK,eAAe;QAAE,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC/D,IAAI,GAAG,CAAC,IAAI,KAAK,yBAAyB;QAAE,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC;IACxE,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC,CAAC;QAChE,OAAO,cAAc,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;IACzD,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,iDAAiD,EAAE,CAAC,CAAC;IACpL,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAAC;IACjI,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAAC;IACnJ,IAAI,GAAG,CAAC,IAAI,KAAK,6BAA6B;QAAE,MAAM,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACnF,CAAC,CAAC;AAEF,8DAA8D;AAC9D,KAAK,UAAU,WAAW,CAAC,GAAY;IACrC,MAAM,IAAI,GAAG,GAAG,CAAC,IAA+C,CAAC;IACjE,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO;IAChF,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAG,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAClG,IAAI,KAAK,IAAI,OAAO,EAAE,QAAQ,IAAI,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,MAAM,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;AACpL,CAAC;AAED,SAAS,OAAO,CAAC,GAAY;IAC3B,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,QAAmI,CAAC;IAC1J,OAAO,GAAG,CAAE,GAAG,CAAC,IAA4C,EAAE,cAAc,CAAC,IAAI,CAAC,EAAE,cAAc,IAAI,CAAC,EAAE,MAAM,EAAE,cAAc,IAAI,CAAC,EAAE,UAAU,EAAE,cAAc,CAAC;AACnK,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAc,EAAE,GAAY;IACxD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK;QAAE,OAAO;IAC9B,MAAM,KAAK,GAAG,CAAC,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;IACtD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC9L,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC5F,MAAM,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;AAC1C,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAc,EAAE,GAAY;IACxD,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,MAAM,IAAI,GAAG,CAAC,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjE,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK;QAAE,OAAO;IAC9B,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;IACzD,MAAM,KAAK,GAAG,CAAC,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;IACtD,MAAM,MAAM,GAAG,EAAE,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IACrJ,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAc;IACtC,OAAO;QACL,MAAM,EAAE,oBAAoB,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACzC,MAAM,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC,CAAC;QACF,KAAK,EAAE,oBAAoB,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACxC,IAAI,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,YAAY,KAAK;gBAAE,OAAO;YACtF,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB;gBAAE,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;YAC1D,MAAM,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAChC,MAAM,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAChC,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC3B,MAAM,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACjC,CAAC,CAAC;KACH,CAAC;AACJ,CAAC"}

package/dist/auth/join-scope.d.ts

@@ -1,6 +1,6 @@
 import type { Queryable } from "../db/db.js";
 import type { ProjectAccess } from "./principal.js";
-/** Projects whose trace parts this caller may see: the primary project's organization only; a person sees all of it, a read key only its own projects. */
+/** Projects whose trace parts this caller may see: the primary project's organization only; a person sees all of it, a key or app only its own projects. */
 export declare function joinScope(q: Queryable, access: ProjectAccess): Promise<string[]>;
 /** For a share link: what its maker may read now. A maker who left the organization, or is not a person, gets only the shared project. */
 export declare function makerScope(q: Queryable, createdBy: string, orgId: string, projectId: string): Promise<string[]>;

package/dist/auth/join-scope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"join-scope.d.ts","sourceRoot":"","sources":["../../src/auth/join-scope.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAG7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAIpD,0JAA0J;AAC1J,wBAAsB,SAAS,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAItF;AAED,0IAA0I;AAC1I,wBAAsB,UAAU,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAIrH"}
+{"version":3,"file":"join-scope.d.ts","sourceRoot":"","sources":["../../src/auth/join-scope.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAI7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAIpD,4JAA4J;AAC5J,wBAAsB,SAAS,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAMtF;AAED,0IAA0I;AAC1I,wBAAsB,UAAU,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAKrH"}

package/dist/auth/join-scope.js

@@ -1,17 +1,21 @@
 import { membership } from "../repo/orgs.js";
+import { hiddenProjects } from "../repo/project-roles.js";
 import { inOrg, orgProjectIds } from "../repo/trace-join.js";
 const primaryFirst = (primary, ids) => [primary, ...ids.filter((id) => id !== primary)];
-/** Projects whose trace parts this caller may see: the primary project's organization only; a person sees all of it, a read key only its own projects. */
+/** Projects whose trace parts this caller may see: the primary project's organization only; a person sees all of it, a key or app only its own projects. */
 export async function joinScope(q, access) {
     const { project, principal } = access;
-    const ids = principal.kind === "key" ? await inOrg(q, project.orgId, principal.key.projectIds) : await orgProjectIds(q, project.orgId);
-    return primaryFirst(project.id, ids);
+    const own = principal.kind === "key" ? principal.key.projectIds : principal.kind === "app" ? principal.projectIds : null;
+    const hidden = principal.kind === "user" ? await hiddenProjects(q, project.orgId, principal.user.id) : new Set();
+    const ids = own ? await inOrg(q, project.orgId, own) : await orgProjectIds(q, project.orgId);
+    return primaryFirst(project.id, ids.filter((id) => !hidden.has(id)));
 }
 /** For a share link: what its maker may read now. A maker who left the organization, or is not a person, gets only the shared project. */
 export async function makerScope(q, createdBy, orgId, projectId) {
     const userId = createdBy.startsWith("user:") ? createdBy.slice("user:".length) : "";
     if (!userId || !(await membership(q, userId, orgId)))
         return [projectId];
-    return primaryFirst(projectId, await orgProjectIds(q, orgId));
+    const hidden = await hiddenProjects(q, orgId, userId);
+    return primaryFirst(projectId, (await orgProjectIds(q, orgId)).filter((id) => !hidden.has(id)));
 }
 //# sourceMappingURL=join-scope.js.map

package/dist/auth/join-scope.js.map

@@ -1 +1 @@
-{"version":3,"file":"join-scope.js","sourceRoot":"","sources":["../../src/auth/join-scope.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAG7D,MAAM,YAAY,GAAG,CAAC,OAAe,EAAE,GAAsB,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC;AAEnH,0JAA0J;AAC1J,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,CAAY,EAAE,MAAqB;IACjE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IACtC,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACvI,OAAO,YAAY,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;AACvC,CAAC;AAED,0IAA0I;AAC1I,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,CAAY,EAAE,SAAiB,EAAE,KAAa,EAAE,SAAiB;IAChG,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpF,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACzE,OAAO,YAAY,CAAC,SAAS,EAAE,MAAM,aAAa,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;AAChE,CAAC"}
+{"version":3,"file":"join-scope.js","sourceRoot":"","sources":["../../src/auth/join-scope.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAG7D,MAAM,YAAY,GAAG,CAAC,OAAe,EAAE,GAAsB,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC;AAEnH,4JAA4J;AAC5J,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,CAAY,EAAE,MAAqB;IACjE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IACtC,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;IACzH,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAU,CAAC;IACzH,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7F,OAAO,YAAY,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,0IAA0I;AAC1I,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,CAAY,EAAE,SAAiB,EAAE,KAAa,EAAE,SAAiB;IAChG,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpF,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IACtD,OAAO,YAAY,CAAC,SAAS,EAAE,CAAC,MAAM,aAAa,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAClG,CAAC"}

package/dist/auth/oauth-access.d.ts

@@ -0,0 +1,8 @@
+import type { Ctx } from "../app.js";
+import type { AppPrincipal } from "./principal.js";
+/** A connected app's access token: what its grant lets it read now. Undefined when the token, grant, or membership is gone. */
+export declare function appPrincipalOf(ctx: Ctx, token: string): Promise<{
+    orgId: string;
+    principal: AppPrincipal;
+} | undefined>;
+//# sourceMappingURL=oauth-access.d.ts.map

package/dist/auth/oauth-access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-access.d.ts","sourceRoot":"","sources":["../../src/auth/oauth-access.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAMrC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAmBnD,+HAA+H;AAC/H,wBAAsB,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,YAAY,CAAA;CAAE,GAAG,SAAS,CAAC,CAY7H"}

package/dist/auth/oauth-access.js

@@ -0,0 +1,31 @@
+import { grantById } from "../repo/grants.js";
+import { membership } from "../repo/orgs.js";
+import { hiddenProjects } from "../repo/project-roles.js";
+import { inOrg, orgProjectIds } from "../repo/trace-join.js";
+import { GRANT_CLAIM, MCP_SCOPE, mcpResources } from "./oauth.js";
+import { can } from "./roles.js";
+/** The token names our MCP (or no resource, from older clients) and has the read scope. */
+function fitsMcp(ctx, c) {
+    const scopes = typeof c.scope === "string" ? c.scope.split(" ") : [];
+    const aud = c.aud === undefined ? [] : Array.isArray(c.aud) ? c.aud : [c.aud];
+    const ours = new Set(mcpResources(ctx.app.baseUrl(), ctx.app.config.mcpUrl));
+    return scopes.includes(MCP_SCOPE) && aud.every((a) => typeof a === "string" && ours.has(a));
+}
+/** A connected app's access token: what its grant lets it read now. Undefined when the token, grant, or membership is gone. */
+export async function appPrincipalOf(ctx, token) {
+    const claims = (await ctx.app.auth.api.wizelensOAuthVerify({ body: { token } }));
+    if (!claims || !fitsMcp(ctx, claims) || typeof claims[GRANT_CLAIM] !== "string")
+        return undefined;
+    const { db } = ctx.app;
+    const grant = await grantById(db, claims[GRANT_CLAIM], ctx.app.config.now());
+    if (!grant || grant.userId !== claims.sub || grant.clientId !== claims.client_id)
+        return undefined;
+    const m = await membership(db, grant.userId, grant.orgId);
+    if (!m || !can(m.role, "read"))
+        return undefined;
+    const hidden = await hiddenProjects(db, grant.orgId, grant.userId);
+    const projectIds = (grant.allProjects ? await orgProjectIds(db, grant.orgId) : await inOrg(db, grant.orgId, grant.projectIds)).filter((id) => !hidden.has(id));
+    const [client] = await db.query("SELECT name FROM oauth_clients WHERE client_id = $1", [grant.clientId]);
+    return { orgId: grant.orgId, principal: { kind: "app", grantId: grant.id, userId: grant.userId, app: client?.name ?? grant.clientId, projectIds } };
+}
+//# sourceMappingURL=oauth-access.js.map

package/dist/auth/oauth-access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-access.js","sourceRoot":"","sources":["../../src/auth/oauth-access.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAElE,OAAO,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AAUjC,2FAA2F;AAC3F,SAAS,OAAO,CAAC,GAAQ,EAAE,CAAS;IAClC,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7E,OAAO,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9F,CAAC;AAED,+HAA+H;AAC/H,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAQ,EAAE,KAAa;IAC1D,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAkB,CAAC;IAClG,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,OAAO,MAAM,CAAC,WAAW,CAAC,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAClG,MAAM,EAAE,EAAE,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC;IACvB,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7E,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACnG,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC1D,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IACjD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACnE,MAAM,UAAU,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/J,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,KAAK,CAA0B,qDAAqD,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;IAClI,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,IAAI,KAAK,CAAC,QAAQ,EAAE,UAAU,EAAE,EAAE,CAAC;AACtJ,CAAC"}

package/dist/auth/oauth-grant.d.ts

@@ -0,0 +1,5 @@
+import type { BetterAuthPlugin } from "better-auth";
+import type { Db } from "../db/db.js";
+/** The cloud's part of OAuth: which organization and projects a connected app reads, and token checks for the MCP route. */
+export declare function grantPlugin(db: Db): BetterAuthPlugin;
+//# sourceMappingURL=oauth-grant.d.ts.map

package/dist/auth/oauth-grant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-grant.d.ts","sourceRoot":"","sources":["../../src/auth/oauth-grant.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AA+EtC,4HAA4H;AAC5H,wBAAgB,WAAW,CAAC,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAEpD"}

package/dist/auth/oauth-grant.js

@@ -0,0 +1,79 @@
+import { getOAuthProviderApi, verifyOAuthQueryParams } from "@better-auth/oauth-provider";
+import { APIError, createAuthEndpoint, createAuthMiddleware, freshSessionMiddleware } from "better-auth/api";
+import { audit } from "../repo/audit.js";
+import { createGrant } from "../repo/grants.js";
+import { membership } from "../repo/orgs.js";
+import { inOrg } from "../repo/trace-join.js";
+import { OFFLINE_SCOPE } from "./oauth.js";
+const MAX_PROJECTS = 500;
+const bad = (message) => new APIError("BAD_REQUEST", { message });
+/** The app (OAuth client) of a signed query from the consent page. Throws when the signature or its time is off. */
+async function clientOf(query, secret) {
+    if (typeof query !== "string" || !(await verifyOAuthQueryParams(query, secret)))
+        throw bad("This sign-in link is not valid any more. Connect the app again.");
+    const clientId = new URLSearchParams(query).get("client_id");
+    if (!clientId)
+        throw bad("This sign-in link names no app.");
+    return clientId;
+}
+/** The projects chosen: every one of `ids` must be in the organization. */
+async function projectsOf(db, orgId, body) {
+    if (body.allProjects === true)
+        return { allProjects: true, projectIds: [] };
+    const ids = Array.isArray(body.projectIds) ? [...new Set(body.projectIds.filter((x) => typeof x === "string"))] : [];
+    if (ids.length === 0)
+        throw bad("Pick at least one project, or all of them.");
+    if (ids.length > MAX_PROJECTS)
+        throw bad(`Pick at most ${MAX_PROJECTS} projects.`);
+    if ((await inOrg(db, orgId, ids)).length !== ids.length)
+        throw bad("A project is not in this organization.");
+    return { allProjects: false, projectIds: ids };
+}
+/** `POST /wizelens/oauth-grant`: the consent page's choice, saved before the consent itself. Needs a sign-in from the last 15 minutes. */
+const grantEndpoint = (db) => createAuthEndpoint("/wizelens/oauth-grant", { method: "POST", use: [freshSessionMiddleware] }, async (ctx) => {
+    const body = (ctx.body ?? {});
+    const clientId = await clientOf(body.oauth_query, ctx.context.secret);
+    const orgId = typeof body.organizationId === "string" ? body.organizationId : "";
+    const { user, session } = ctx.context.session;
+    if (!orgId || !(await membership(db, user.id, orgId)))
+        throw new APIError("NOT_FOUND", { message: "Organization not found." });
+    const [client] = await db.query("SELECT name FROM oauth_clients WHERE client_id = $1 AND disabled IS NOT TRUE", [clientId]);
+    if (!client)
+        throw bad("This app is not registered any more. Connect it again.");
+    const projects = await projectsOf(db, orgId, body);
+    const now = Date.now();
+    const id = await db.tx(async (q) => {
+        const grantId = await createGrant(q, { userId: user.id, orgId, clientId, ...projects }, session.id, now);
+        await audit(q, orgId, `user:${user.id}`, "app.connect", { app: client.name ?? clientId, clientId, grantId, ...projects }, now);
+        return grantId;
+    });
+    return ctx.json({ id });
+});
+/** `/wizelens/oauth-verify`, server only: the active access token's claims, or null. The MCP route calls it. */
+const verifyEndpoint = () => createAuthEndpoint("/wizelens/oauth-verify", { method: "POST", metadata: { SERVER_ONLY: true } }, async (ctx) => {
+    const token = ctx.body?.token;
+    const opts = ctx.context.getPlugin("oauth-provider")?.options;
+    if (typeof token !== "string" || !opts)
+        return ctx.json(null);
+    try {
+        return ctx.json(await getOAuthProviderApi(ctx, opts).requireActiveAccessToken(token));
+    }
+    catch {
+        return ctx.json(null);
+    }
+});
+/** Every authorization asks for refresh tokens too, so an agent on a schedule keeps its access until the person ends it. */
+const offlineHook = {
+    matcher: (ctx) => ctx.path === "/oauth2/authorize",
+    handler: createAuthMiddleware(async (ctx) => {
+        const scope = typeof ctx.query?.scope === "string" ? ctx.query.scope : undefined;
+        if (!scope || scope.split(" ").includes(OFFLINE_SCOPE))
+            return;
+        return { context: { query: { ...ctx.query, scope: `${scope} ${OFFLINE_SCOPE}` } } };
+    }),
+};
+/** The cloud's part of OAuth: which organization and projects a connected app reads, and token checks for the MCP route. */
+export function grantPlugin(db) {
+    return { id: "wizelens-oauth", endpoints: { wizelensOAuthGrant: grantEndpoint(db), wizelensOAuthVerify: verifyEndpoint() }, hooks: { before: [offlineHook] } };
+}
+//# sourceMappingURL=oauth-grant.js.map

package/dist/auth/oauth-grant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-grant.js","sourceRoot":"","sources":["../../src/auth/oauth-grant.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAE1F,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAE7G,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C,MAAM,YAAY,GAAG,GAAG,CAAC;AASzB,MAAM,GAAG,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,IAAI,QAAQ,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;AAE1E,oHAAoH;AACpH,KAAK,UAAU,QAAQ,CAAC,KAAc,EAAE,MAAc;IACpD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,sBAAsB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAAE,MAAM,GAAG,CAAC,iEAAiE,CAAC,CAAC;IAC9J,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC7D,IAAI,CAAC,QAAQ;QAAE,MAAM,GAAG,CAAC,iCAAiC,CAAC,CAAC;IAC5D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,2EAA2E;AAC3E,KAAK,UAAU,UAAU,CAAC,EAAM,EAAE,KAAa,EAAE,IAAe;IAC9D,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI;QAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IAC5E,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClI,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,GAAG,CAAC,4CAA4C,CAAC,CAAC;IAC9E,IAAI,GAAG,CAAC,MAAM,GAAG,YAAY;QAAE,MAAM,GAAG,CAAC,gBAAgB,YAAY,YAAY,CAAC,CAAC;IACnF,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM;QAAE,MAAM,GAAG,CAAC,wCAAwC,CAAC,CAAC;IAC7G,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;AACjD,CAAC;AAED,0IAA0I;AAC1I,MAAM,aAAa,GAAG,CAAC,EAAM,EAAE,EAAE,CAC/B,kBAAkB,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,sBAAsB,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;IAC3G,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAc,CAAC;IAC3C,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACtE,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;IACjF,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC;IAC9C,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC;IAC/H,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,KAAK,CAA0B,8EAA8E,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrJ,IAAI,CAAC,MAAM;QAAE,MAAM,GAAG,CAAC,wDAAwD,CAAC,CAAC;IACjF,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,QAAQ,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACzG,MAAM,KAAK,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,IAAI,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,IAAI,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;QAC/H,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AAC1B,CAAC,CAAC,CAAC;AAEL,gHAAgH;AAChH,MAAM,cAAc,GAAG,GAAG,EAAE,CAC1B,kBAAkB,CAAC,wBAAwB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;IAC9G,MAAM,KAAK,GAAI,GAAG,CAAC,IAAwC,EAAE,KAAK,CAAC;IACnE,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC9D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,IAAI;QAAE,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC,CAAC;IACxF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,4HAA4H;AAC5H,MAAM,WAAW,GAAG;IAClB,OAAO,EAAE,CAAC,GAAsB,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,mBAAmB;IACrE,OAAO,EAAE,oBAAoB,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QAC1C,MAAM,KAAK,GAAG,OAAO,GAAG,CAAC,KAAK,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACjF,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC;YAAE,OAAO;QAC/D,OAAO,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,GAAG,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,IAAI,aAAa,EAAE,EAAE,EAAE,EAAE,CAAC;IACtF,CAAC,CAAC;CACH,CAAC;AAEF,4HAA4H;AAC5H,MAAM,UAAU,WAAW,CAAC,EAAM;IAChC,OAAO,EAAE,EAAE,EAAE,gBAAgB,EAAE,SAAS,EAAE,EAAE,kBAAkB,EAAE,aAAa,CAAC,EAAE,CAAC,EAAE,mBAAmB,EAAE,cAAc,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE,EAAsB,CAAC;AACrL,CAAC"}

package/dist/auth/oauth-names.d.ts

@@ -0,0 +1,104 @@
+export declare const oauthSchema: {
+    oauthClient: {
+        modelName: string;
+        fields: {
+            createdAt: string;
+            updatedAt: string;
+            clientId: string;
+            clientSecret: string;
+            clientDiscoveryId: string;
+            skipConsent: string;
+            enableEndSession: string;
+            subjectType: string;
+            clientCredentialsScopes: string;
+            userId: string;
+            softwareId: string;
+            softwareVersion: string;
+            softwareStatement: string;
+            redirectUris: string;
+            postLogoutRedirectUris: string;
+            backchannelLogoutUri: string;
+            backchannelLogoutSessionRequired: string;
+            tokenEndpointAuthMethod: string;
+            applicationType: string;
+            jwksUri: string;
+            grantTypes: string;
+            responseTypes: string;
+            requirePKCE: string;
+            dpopBoundAccessTokens: string;
+            referenceId: string;
+        };
+    };
+    oauthResource: {
+        modelName: string;
+        fields: {
+            createdAt: string;
+            updatedAt: string;
+            accessTokenTtl: string;
+            refreshTokenTtl: string;
+            signingAlgorithm: string;
+            signingKeyId: string;
+            allowedScopes: string;
+            customClaims: string;
+            dpopBoundAccessTokensRequired: string;
+            policyVersion: string;
+        };
+    };
+    oauthClientResource: {
+        modelName: string;
+        fields: {
+            clientId: string;
+            resourceId: string;
+            createdAt: string;
+        };
+    };
+    oauthRefreshToken: {
+        modelName: string;
+        fields: {
+            clientId: string;
+            sessionId: string;
+            userId: string;
+            referenceId: string;
+            authorizationCodeId: string;
+            requestedUserInfoClaims: string;
+            expiresAt: string;
+            createdAt: string;
+            rotatedAt: string;
+            rotationReplayResponse: string;
+            rotationReplayExpiresAt: string;
+            authTime: string;
+        };
+    };
+    oauthAccessToken: {
+        modelName: string;
+        fields: {
+            clientId: string;
+            sessionId: string;
+            userId: string;
+            referenceId: string;
+            authorizationCodeId: string;
+            requestedUserInfoClaims: string;
+            refreshId: string;
+            expiresAt: string;
+            createdAt: string;
+        };
+    };
+    oauthConsent: {
+        modelName: string;
+        fields: {
+            createdAt: string;
+            updatedAt: string;
+            clientId: string;
+            userId: string;
+            referenceId: string;
+            requestedUserInfoClaims: string;
+        };
+    };
+    oauthClientAssertion: {
+        modelName: string;
+        fields: {
+            expiresAt: string;
+        };
+    };
+};
+//# sourceMappingURL=oauth-names.d.ts.map

package/dist/auth/oauth-names.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-names.d.ts","sourceRoot":"","sources":["../../src/auth/oauth-names.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA4CC,SAAS;QAA4B,MAAM;YAAI,QAAQ;YAAe,UAAU;YAAiB,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAsBzG,SAAS;QAA6B,MAAM;YAAI,SAAS;;;CAClF,CAAC"}

package/dist/auth/oauth-names.js

@@ -0,0 +1,72 @@
+// Better Auth's OAuth provider models mapped onto our snake_case tables (db/schema-oauth.ts). The schema test checks them too.
+const at = { createdAt: "created_at", updatedAt: "updated_at" };
+const token = { clientId: "client_id", sessionId: "session_id", userId: "user_id", referenceId: "reference_id", authorizationCodeId: "authorization_code_id" };
+export const oauthSchema = {
+    oauthClient: {
+        modelName: "oauth_clients",
+        fields: {
+            ...at,
+            clientId: "client_id",
+            clientSecret: "client_secret",
+            clientDiscoveryId: "client_discovery_id",
+            skipConsent: "skip_consent",
+            enableEndSession: "enable_end_session",
+            subjectType: "subject_type",
+            clientCredentialsScopes: "client_credentials_scopes",
+            userId: "user_id",
+            softwareId: "software_id",
+            softwareVersion: "software_version",
+            softwareStatement: "software_statement",
+            redirectUris: "redirect_uris",
+            postLogoutRedirectUris: "post_logout_redirect_uris",
+            backchannelLogoutUri: "backchannel_logout_uri",
+            backchannelLogoutSessionRequired: "backchannel_logout_session_required",
+            tokenEndpointAuthMethod: "token_endpoint_auth_method",
+            applicationType: "application_type",
+            jwksUri: "jwks_uri",
+            grantTypes: "grant_types",
+            responseTypes: "response_types",
+            requirePKCE: "require_pkce",
+            dpopBoundAccessTokens: "dpop_bound_access_tokens",
+            referenceId: "reference_id",
+        },
+    },
+    oauthResource: {
+        modelName: "oauth_resources",
+        fields: {
+            ...at,
+            accessTokenTtl: "access_token_ttl",
+            refreshTokenTtl: "refresh_token_ttl",
+            signingAlgorithm: "signing_algorithm",
+            signingKeyId: "signing_key_id",
+            allowedScopes: "allowed_scopes",
+            customClaims: "custom_claims",
+            dpopBoundAccessTokensRequired: "dpop_bound_access_tokens_required",
+            policyVersion: "policy_version",
+        },
+    },
+    oauthClientResource: { modelName: "oauth_client_resources", fields: { clientId: "client_id", resourceId: "resource_id", createdAt: "created_at" } },
+    oauthRefreshToken: {
+        modelName: "oauth_refresh_tokens",
+        fields: {
+            ...token,
+            requestedUserInfoClaims: "requested_user_info_claims",
+            expiresAt: "expires_at",
+            createdAt: "created_at",
+            rotatedAt: "rotated_at",
+            rotationReplayResponse: "rotation_replay_response",
+            rotationReplayExpiresAt: "rotation_replay_expires_at",
+            authTime: "auth_time",
+        },
+    },
+    oauthAccessToken: {
+        modelName: "oauth_access_tokens",
+        fields: { ...token, requestedUserInfoClaims: "requested_user_info_claims", refreshId: "refresh_id", expiresAt: "expires_at", createdAt: "created_at" },
+    },
+    oauthConsent: {
+        modelName: "oauth_consents",
+        fields: { ...at, clientId: "client_id", userId: "user_id", referenceId: "reference_id", requestedUserInfoClaims: "requested_user_info_claims" },
+    },
+    oauthClientAssertion: { modelName: "oauth_client_assertions", fields: { expiresAt: "expires_at" } },
+};
+//# sourceMappingURL=oauth-names.js.map

package/dist/auth/oauth-names.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-names.js","sourceRoot":"","sources":["../../src/auth/oauth-names.ts"],"names":[],"mappings":"AAAA,+HAA+H;AAC/H,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;AAChE,MAAM,KAAK,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,CAAC;AAE/J,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,WAAW,EAAE;QACX,SAAS,EAAE,eAAe;QAC1B,MAAM,EAAE;YACN,GAAG,EAAE;YACL,QAAQ,EAAE,WAAW;YACrB,YAAY,EAAE,eAAe;YAC7B,iBAAiB,EAAE,qBAAqB;YACxC,WAAW,EAAE,cAAc;YAC3B,gBAAgB,EAAE,oBAAoB;YACtC,WAAW,EAAE,cAAc;YAC3B,uBAAuB,EAAE,2BAA2B;YACpD,MAAM,EAAE,SAAS;YACjB,UAAU,EAAE,aAAa;YACzB,eAAe,EAAE,kBAAkB;YACnC,iBAAiB,EAAE,oBAAoB;YACvC,YAAY,EAAE,eAAe;YAC7B,sBAAsB,EAAE,2BAA2B;YACnD,oBAAoB,EAAE,wBAAwB;YAC9C,gCAAgC,EAAE,qCAAqC;YACvE,uBAAuB,EAAE,4BAA4B;YACrD,eAAe,EAAE,kBAAkB;YACnC,OAAO,EAAE,UAAU;YACnB,UAAU,EAAE,aAAa;YACzB,aAAa,EAAE,gBAAgB;YAC/B,WAAW,EAAE,cAAc;YAC3B,qBAAqB,EAAE,0BAA0B;YACjD,WAAW,EAAE,cAAc;SAC5B;KACF;IACD,aAAa,EAAE;QACb,SAAS,EAAE,iBAAiB;QAC5B,MAAM,EAAE;YACN,GAAG,EAAE;YACL,cAAc,EAAE,kBAAkB;YAClC,eAAe,EAAE,mBAAmB;YACpC,gBAAgB,EAAE,mBAAmB;YACrC,YAAY,EAAE,gBAAgB;YAC9B,aAAa,EAAE,gBAAgB;YAC/B,YAAY,EAAE,eAAe;YAC7B,6BAA6B,EAAE,mCAAmC;YAClE,aAAa,EAAE,gBAAgB;SAChC;KACF;IACD,mBAAmB,EAAE,EAAE,SAAS,EAAE,wBAAwB,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE;IACnJ,iBAAiB,EAAE;QACjB,SAAS,EAAE,sBAAsB;QACjC,MAAM,EAAE;YACN,GAAG,KAAK;YACR,uBAAuB,EAAE,4BAA4B;YACrD,SAAS,EAAE,YAAY;YACvB,SAAS,EAAE,YAAY;YACvB,SAAS,EAAE,YAAY;YACvB,sBAAsB,EAAE,0BAA0B;YAClD,uBAAuB,EAAE,4BAA4B;YACrD,QAAQ,EAAE,WAAW;SACtB;KACF;IACD,gBAAgB,EAAE;QAChB,SAAS,EAAE,qBAAqB;QAChC,MAAM,EAAE,EAAE,GAAG,KAAK,EAAE,uBAAuB,EAAE,4BAA4B,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE;KACvJ;IACD,YAAY,EAAE;QACZ,SAAS,EAAE,gBAAgB;QAC3B,MAAM,EAAE,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,uBAAuB,EAAE,4BAA4B,EAAE;KAChJ;IACD,oBAAoB,EAAE,EAAE,SAAS,EAAE,yBAAyB,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE;CACpG,CAAC"}

package/dist/auth/oauth.d.ts

@@ -0,0 +1,17 @@
+import type { BetterAuthPlugin } from "better-auth";
+import type { AuthDeps } from "./deps.js";
+/** The one permission a connected app can get: read, like a read key. */
+export declare const MCP_SCOPE = "wizelens:read";
+/** Refresh tokens, so a scheduled agent keeps working after the first hour. Always added (auth/oauth-grant.ts). */
+export declare const OFFLINE_SCOPE = "offline_access";
+export declare const OAUTH_SCOPES: string[];
+/** The access token claim that names the grant (repo/grants.ts) behind it. */
+export declare const GRANT_CLAIM = "wl_grant";
+/** The dashboard pages Better Auth sends people to. The signed query rides in the hash, so it never reaches a server log. */
+export declare const OAUTH_LOGIN_PAGE = "/_wizelens/#/oauth";
+export declare const OAUTH_CONSENT_PAGE = "/_wizelens/#/oauth-consent";
+/** Every address an agent may name as the MCP resource: the cloud's own path, and the MCP origin (bare, with `/`, with `/mcp`). */
+export declare function mcpResources(publicUrl: string, mcpUrl: string | undefined): string[];
+/** OAuth 2.1 for MCP clients: open dynamic registration, PKCE, opaque tokens, one read scope, and consent tied to a grant. */
+export declare function oauthPlugin(deps: AuthDeps): BetterAuthPlugin;
+//# sourceMappingURL=oauth.d.ts.map

package/dist/auth/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../src/auth/oauth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAG1C,yEAAyE;AACzE,eAAO,MAAM,SAAS,kBAAkB,CAAC;AACzC,mHAAmH;AACnH,eAAO,MAAM,aAAa,mBAAmB,CAAC;AAC9C,eAAO,MAAM,YAAY,UAA6B,CAAC;AACvD,8EAA8E;AAC9E,eAAO,MAAM,WAAW,aAAa,CAAC;AACtC,6HAA6H;AAC7H,eAAO,MAAM,gBAAgB,uBAAuB,CAAC;AACrD,eAAO,MAAM,kBAAkB,+BAA+B,CAAC;AAK/D,mIAAmI;AACnI,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAGpF;AAED,8HAA8H;AAC9H,wBAAgB,WAAW,CAAC,IAAI,EAAE,QAAQ,GAAG,gBAAgB,CAwB5D"}

package/dist/auth/oauth.js

@@ -0,0 +1,47 @@
+import { oauthProvider } from "@better-auth/oauth-provider";
+import { pendingGrantId } from "../repo/grants.js";
+import { oauthSchema } from "./oauth-names.js";
+/** The one permission a connected app can get: read, like a read key. */
+export const MCP_SCOPE = "wizelens:read";
+/** Refresh tokens, so a scheduled agent keeps working after the first hour. Always added (auth/oauth-grant.ts). */
+export const OFFLINE_SCOPE = "offline_access";
+export const OAUTH_SCOPES = [MCP_SCOPE, OFFLINE_SCOPE];
+/** The access token claim that names the grant (repo/grants.ts) behind it. */
+export const GRANT_CLAIM = "wl_grant";
+/** The dashboard pages Better Auth sends people to. The signed query rides in the hash, so it never reaches a server log. */
+export const OAUTH_LOGIN_PAGE = "/_wizelens/#/oauth";
+export const OAUTH_CONSENT_PAGE = "/_wizelens/#/oauth-consent";
+const HOUR = 60 * 60;
+const DAY = 24 * HOUR;
+/** Every address an agent may name as the MCP resource: the cloud's own path, and the MCP origin (bare, with `/`, with `/mcp`). */
+export function mcpResources(publicUrl, mcpUrl) {
+    const own = `${publicUrl}/_wizelens/mcp`;
+    return mcpUrl ? [own, mcpUrl, `${mcpUrl}/`, `${mcpUrl}/mcp`] : [own];
+}
+/** OAuth 2.1 for MCP clients: open dynamic registration, PKCE, opaque tokens, one read scope, and consent tied to a grant. */
+export function oauthPlugin(deps) {
+    const resources = mcpResources(deps.publicUrl, deps.mcpUrl);
+    return oauthProvider({
+        schema: oauthSchema,
+        scopes: OAUTH_SCOPES,
+        loginPage: OAUTH_LOGIN_PAGE,
+        consentPage: OAUTH_CONSENT_PAGE,
+        disableJwtPlugin: true,
+        grantTypes: ["authorization_code", "refresh_token"],
+        allowDynamicClientRegistration: true,
+        allowUnauthenticatedClientRegistration: true,
+        clientRegistrationDefaultApplicationType: "infer",
+        clientRegistrationDefaultResources: resources,
+        resources: resources.map((identifier) => ({ identifier, name: "WizeLens MCP", allowedScopes: OAUTH_SCOPES })),
+        resourceSeedMode: "merge",
+        accessTokenExpiresIn: HOUR,
+        refreshTokenExpiresIn: 30 * DAY,
+        clientPrivileges: () => false,
+        postLogin: { page: OAUTH_CONSENT_PAGE, shouldRedirect: () => false, consentReferenceId: ({ session }) => pendingGrantId(deps.db, session.id, Date.now()) },
+        customAccessTokenClaims: ({ referenceId }) => (referenceId ? { [GRANT_CLAIM]: referenceId } : {}),
+        prefix: { opaqueAccessToken: "wl_at_", refreshToken: "wl_rt_" },
+        // Claude and other hosted agents share a few addresses, so the token and register limits are per many people.
+        rateLimit: { token: { window: 60, max: 600 }, register: { window: 60, max: 60 }, authorize: { window: 60, max: 60 } },
+    });
+}
+//# sourceMappingURL=oauth.js.map

package/dist/auth/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../src/auth/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAE5D,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C,yEAAyE;AACzE,MAAM,CAAC,MAAM,SAAS,GAAG,eAAe,CAAC;AACzC,mHAAmH;AACnH,MAAM,CAAC,MAAM,aAAa,GAAG,gBAAgB,CAAC;AAC9C,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;AACvD,8EAA8E;AAC9E,MAAM,CAAC,MAAM,WAAW,GAAG,UAAU,CAAC;AACtC,6HAA6H;AAC7H,MAAM,CAAC,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AACrD,MAAM,CAAC,MAAM,kBAAkB,GAAG,4BAA4B,CAAC;AAE/D,MAAM,IAAI,GAAG,EAAE,GAAG,EAAE,CAAC;AACrB,MAAM,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC;AAEtB,mIAAmI;AACnI,MAAM,UAAU,YAAY,CAAC,SAAiB,EAAE,MAA0B;IACxE,MAAM,GAAG,GAAG,GAAG,SAAS,gBAAgB,CAAC;IACzC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,EAAE,GAAG,MAAM,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AACvE,CAAC;AAED,8HAA8H;AAC9H,MAAM,UAAU,WAAW,CAAC,IAAc;IACxC,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5D,OAAO,aAAa,CAAC;QACnB,MAAM,EAAE,WAAW;QACnB,MAAM,EAAE,YAAY;QACpB,SAAS,EAAE,gBAAgB;QAC3B,WAAW,EAAE,kBAAkB;QAC/B,gBAAgB,EAAE,IAAI;QACtB,UAAU,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QACnD,8BAA8B,EAAE,IAAI;QACpC,sCAAsC,EAAE,IAAI;QAC5C,wCAAwC,EAAE,OAAO;QACjD,kCAAkC,EAAE,SAAS;QAC7C,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC;QAC7G,gBAAgB,EAAE,OAAO;QACzB,oBAAoB,EAAE,IAAI;QAC1B,qBAAqB,EAAE,EAAE,GAAG,GAAG;QAC/B,gBAAgB,EAAE,GAAG,EAAE,CAAC,KAAK;QAC7B,SAAS,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,kBAAkB,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE;QAC1J,uBAAuB,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjG,MAAM,EAAE,EAAE,iBAAiB,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE;QAC/D,8GAA8G;QAC9G,SAAS,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE;KACtH,CAAgC,CAAC;AACpC,CAAC"}

package/dist/auth/options.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../../src/auth/options.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAKrD,OAAO,EAAE,KAAK,QAAQ,EAAW,MAAM,WAAW,CAAC;AAKnD,eAAO,MAAM,cAAc,wBAAwB,CAAC;AACpD,eAAO,MAAM,gBAAgB,yBAAyB,CAAC;AAIvD,yIAAyI;AACzI,wBAAgB,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,IAAI,EAAE;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAc5H;AAED,yIAAyI;AACzI,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAC,iBAAiB,EAAE,kBAAkB,GAAG,mBAAmB,CAAC,CAuB9G;AAED,mIAAmI;AACnI,wBAAgB,cAAc,IAAI,IAAI,CAAC,iBAAiB,EAAE,SAAS,GAAG,SAAS,GAAG,cAAc,CAAC,CAMhG;AAED,gFAAgF;AAChF,wBAAgB,gBAAgB,IAAI,iBAAiB,CAAC,WAAW,CAAC,CAqBjE;AAED,iGAAiG;AACjG,wBAAgB,eAAe,CAAC,IAAI,EAAE,QAAQ,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAU7E"}
+{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../../src/auth/options.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAKrD,OAAO,EAAE,KAAK,QAAQ,EAAW,MAAM,WAAW,CAAC;AAKnD,eAAO,MAAM,cAAc,wBAAwB,CAAC;AACpD,eAAO,MAAM,gBAAgB,yBAAyB,CAAC;AAIvD,yIAAyI;AACzI,wBAAgB,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,IAAI,EAAE;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAc5H;AAED,yIAAyI;AACzI,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAC,iBAAiB,EAAE,kBAAkB,GAAG,mBAAmB,CAAC,CAuB9G;AAED,mIAAmI;AACnI,wBAAgB,cAAc,IAAI,IAAI,CAAC,iBAAiB,EAAE,SAAS,GAAG,SAAS,GAAG,cAAc,CAAC,CAMhG;AAED,gFAAgF;AAChF,wBAAgB,gBAAgB,IAAI,iBAAiB,CAAC,WAAW,CAAC,CAuBjE;AAED,iGAAiG;AACjG,wBAAgB,eAAe,CAAC,IAAI,EAAE,QAAQ,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAU7E"}

package/dist/auth/options.js

@@ -80,6 +80,8 @@ export function rateLimitOptions() {
             "/get-session": { window: 10, max: 60 },
             "/sso/register": { window: 60, max: 5 },
             "/sso/verify-domain": { window: 60, max: 5 },
+            // An identity provider's first sync sends a call per person; tokens are checked on every call.
+            "/scim/v2/*": { window: 60, max: 1200 },
         },
     };
 }

package/dist/auth/options.js.map

@@ -1 +1 @@
-{"version":3,"file":"options.js","sourceRoot":"","sources":["../../src/auth/options.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC9G,OAAO,EAAiB,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC7G,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,CAAC,MAAM,cAAc,GAAG,qBAAqB,CAAC;AACpD,MAAM,CAAC,MAAM,gBAAgB,GAAG,sBAAsB,CAAC;AACvD,MAAM,MAAM,GAAG,EAAE,CAAC;AAClB,MAAM,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AAE7B,yIAAyI;AACzI,MAAM,UAAU,WAAW,CAAC,IAAc,EAAE,YAAqD;IAC/F,OAAO;QACL,GAAG,SAAS;QACZ,gBAAgB,EAAE,UAAU,CAAC,IAAI,CAAC;QAClC,WAAW,EAAE;YACX,OAAO,EAAE,IAAI;YACb,2BAA2B,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC;SAChK;QACD,UAAU,EAAE;YACV,OAAO,EAAE,IAAI;YACb,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,6BAA6B,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClL,YAAY;SACb;KACF,CAAC;AACJ,CAAC;AAED,yIAAyI;AACzI,MAAM,UAAU,YAAY,CAAC,IAAc;IACzC,OAAO;QACL,gBAAgB,EAAE;YAChB,OAAO,EAAE,IAAI;YACb,wBAAwB,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YAC1C,UAAU,EAAE,IAAI;YAChB,iBAAiB,EAAE,EAAE;YACrB,iBAAiB,EAAE,GAAG;YACtB,2BAA2B,EAAE,EAAE,GAAG,MAAM;YACxC,6BAA6B,EAAE,IAAI;YACnC,QAAQ,EAAE,eAAe;YACzB,iBAAiB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC,CAAC;YACrI,eAAe,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC;YACnH,mBAAmB,EAAE,CAAC,EAAE,UAAU,EAAE,gBAAgB,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,gBAAgB,EAAE,KAAK,EAAE,GAAG,gBAAgB,EAAE,EAAE,EAAE,CAAC;SACrI;QACD,iBAAiB,EAAE;YACjB,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YAC9B,2BAA2B,EAAE,IAAI;YACjC,SAAS,EAAE,EAAE,GAAG,MAAM;YACtB,qBAAqB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC;YACrI,sBAAsB,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC;SACxE;KACF,CAAC;AACJ,CAAC;AAED,mIAAmI;AACnI,MAAM,UAAU,cAAc;IAC5B,OAAO;QACL,OAAO,EAAE,EAAE,GAAG,YAAY,EAAE,SAAS,EAAE,EAAE,GAAG,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACzH,OAAO,EAAE,EAAE,GAAG,YAAY,EAAE,kBAAkB,EAAE,IAAI,EAAE;QACtD,YAAY,EAAE,EAAE,GAAG,iBAAiB,EAAE,eAAe,EAAE,QAAQ,EAAE;KAClE,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,gBAAgB;IAC9B,OAAO;QACL,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,UAAU;QACnB,GAAG,cAAc;QACjB,MAAM,EAAE,EAAE;QACV,GAAG,EAAE,GAAG;QACR,WAAW,EAAE;YACX,YAAY,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;YACrC,gBAAgB,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE;YACxC,eAAe,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;YACxC,yBAAyB,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE;YACzD,0BAA0B,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE;YAC1D,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE;YAC1C,eAAe,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE;YAC/C,cAAc,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE;YAC9C,cAAc,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;YACvC,eAAe,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE;YACvC,oBAAoB,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE;SAC7C;KACF,CAAC;AACJ,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,eAAe,CAAC,IAAc;IAC5C,OAAO;QACL,YAAY,EAAE,UAAU;QACxB,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC;QACvD,uBAAuB,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE;QAChE,gBAAgB,EAAE,KAAK;QACvB,kBAAkB,EAAE,KAAK;QACzB,SAAS,EAAE,EAAE,gBAAgB,EAAE,CAAC,gBAAgB,CAAC,EAAE;QACnD,QAAQ,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE;KACnE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"options.js","sourceRoot":"","sources":["../../src/auth/options.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC9G,OAAO,EAAiB,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC7G,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,CAAC,MAAM,cAAc,GAAG,qBAAqB,CAAC;AACpD,MAAM,CAAC,MAAM,gBAAgB,GAAG,sBAAsB,CAAC;AACvD,MAAM,MAAM,GAAG,EAAE,CAAC;AAClB,MAAM,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AAE7B,yIAAyI;AACzI,MAAM,UAAU,WAAW,CAAC,IAAc,EAAE,YAAqD;IAC/F,OAAO;QACL,GAAG,SAAS;QACZ,gBAAgB,EAAE,UAAU,CAAC,IAAI,CAAC;QAClC,WAAW,EAAE;YACX,OAAO,EAAE,IAAI;YACb,2BAA2B,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC;SAChK;QACD,UAAU,EAAE;YACV,OAAO,EAAE,IAAI;YACb,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,6BAA6B,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClL,YAAY;SACb;KACF,CAAC;AACJ,CAAC;AAED,yIAAyI;AACzI,MAAM,UAAU,YAAY,CAAC,IAAc;IACzC,OAAO;QACL,gBAAgB,EAAE;YAChB,OAAO,EAAE,IAAI;YACb,wBAAwB,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YAC1C,UAAU,EAAE,IAAI;YAChB,iBAAiB,EAAE,EAAE;YACrB,iBAAiB,EAAE,GAAG;YACtB,2BAA2B,EAAE,EAAE,GAAG,MAAM;YACxC,6BAA6B,EAAE,IAAI;YACnC,QAAQ,EAAE,eAAe;YACzB,iBAAiB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC,CAAC;YACrI,eAAe,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC;YACnH,mBAAmB,EAAE,CAAC,EAAE,UAAU,EAAE,gBAAgB,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,gBAAgB,EAAE,KAAK,EAAE,GAAG,gBAAgB,EAAE,EAAE,EAAE,CAAC;SACrI;QACD,iBAAiB,EAAE;YACjB,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YAC9B,2BAA2B,EAAE,IAAI;YACjC,SAAS,EAAE,EAAE,GAAG,MAAM;YACtB,qBAAqB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC;YACrI,sBAAsB,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC;SACxE;KACF,CAAC;AACJ,CAAC;AAED,mIAAmI;AACnI,MAAM,UAAU,cAAc;IAC5B,OAAO;QACL,OAAO,EAAE,EAAE,GAAG,YAAY,EAAE,SAAS,EAAE,EAAE,GAAG,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACzH,OAAO,EAAE,EAAE,GAAG,YAAY,EAAE,kBAAkB,EAAE,IAAI,EAAE;QACtD,YAAY,EAAE,EAAE,GAAG,iBAAiB,EAAE,eAAe,EAAE,QAAQ,EAAE;KAClE,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,gBAAgB;IAC9B,OAAO;QACL,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,UAAU;QACnB,GAAG,cAAc;QACjB,MAAM,EAAE,EAAE;QACV,GAAG,EAAE,GAAG;QACR,WAAW,EAAE;YACX,YAAY,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;YACrC,gBAAgB,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE;YACxC,eAAe,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;YACxC,yBAAyB,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE;YACzD,0BAA0B,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE;YAC1D,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE;YAC1C,eAAe,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE;YAC/C,cAAc,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE;YAC9C,cAAc,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;YACvC,eAAe,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE;YACvC,oBAAoB,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE;YAC5C,+FAA+F;YAC/F,YAAY,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE;SACxC;KACF,CAAC;AACJ,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,eAAe,CAAC,IAAc;IAC5C,OAAO;QACL,YAAY,EAAE,UAAU;QACxB,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC;QACvD,uBAAuB,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE;QAChE,gBAAgB,EAAE,KAAK;QACvB,kBAAkB,EAAE,KAAK;QACzB,SAAS,EAAE,EAAE,gBAAgB,EAAE,CAAC,gBAAgB,CAAC,EAAE;QACnD,QAAQ,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE;KACnE,CAAC;AACJ,CAAC"}

package/dist/auth/plugins.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugins.d.ts","sourceRoot":"","sources":["../../src/auth/plugins.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAGpD,OAAO,EAAE,KAAK,QAAQ,EAAW,MAAM,WAAW,CAAC;AA6CnD,eAAO,MAAM,WAAW,SAAU,QAAQ,KAAG,gBAAgB,EAAgI,CAAC"}
+{"version":3,"file":"plugins.d.ts","sourceRoot":"","sources":["../../src/auth/plugins.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAKpD,OAAO,EAAE,KAAK,QAAQ,EAAW,MAAM,WAAW,CAAC;AA+CnD,eAAO,MAAM,WAAW,SAAU,QAAQ,KAAG,gBAAgB,EAU5D,CAAC"}