@zetra/citrineos-util 1.8.3-fork.1

package/dist/networkconnection/WebsocketNetworkConnection.js

@@ -0,0 +1,474 @@
+import { CacheNamespace, createIdentifier, getStationIdFromIdentifier, getTenantIdFromIdentifier, } from '@citrineos/base';
+import fs from 'fs';
+import * as http from 'http';
+import * as https from 'https';
+import { Duplex } from 'stream';
+import { Logger } from 'tslog';
+import { WebSocket, WebSocketServer } from 'ws';
+export class WebsocketNetworkConnection {
+    _cache;
+    _config;
+    _logger;
+    _identifierConnections = new Map();
+    // websocketServers id as key and http server as value
+    _httpServersMap;
+    _authenticator;
+    _router;
+    _doesChargingStationExistByStationId;
+    constructor(config, cache, authenticator, router, logger, doesChargingStationExistByStationId) {
+        this._cache = cache;
+        this._config = config;
+        this._doesChargingStationExistByStationId = doesChargingStationExistByStationId;
+        this._logger = logger
+            ? logger.getSubLogger({ name: this.constructor.name })
+            : new Logger({ name: this.constructor.name });
+        this._authenticator = authenticator;
+        router.networkHook = this.sendMessage.bind(this);
+        this._router = router;
+        this._httpServersMap = new Map();
+        this._config.util.networkConnection.websocketServers.forEach(async (websocketServerConfig) => {
+            const _httpServer = await this._createAndStartWebsocketServer(websocketServerConfig);
+            this._httpServersMap.set(websocketServerConfig.id, _httpServer);
+        });
+    }
+    /**
+     * Send a message to the charging station specified by the identifier.
+     *
+     * @param {string} identifier - The identifier of the client.
+     * @param {string} message - The message to send.
+     * @return {void} rejects the promise if message fails to send, otherwise returns void.
+     */
+    sendMessage(identifier, message) {
+        return new Promise(async (resolve, reject) => {
+            try {
+                const clientConnection = await this._cache.get(identifier, CacheNamespace.Connections);
+                if (clientConnection) {
+                    const websocketConnection = this._identifierConnections.get(identifier);
+                    if (websocketConnection && websocketConnection.readyState === WebSocket.OPEN) {
+                        websocketConnection.send(message, (error) => {
+                            if (error) {
+                                reject(error); // Reject the promise with the error
+                            }
+                            else {
+                                resolve(); // Resolve the promise with true indicating success
+                            }
+                        });
+                    }
+                    else {
+                        const errorMsg = 'Websocket connection is not ready - ' + identifier;
+                        this._logger.fatal(errorMsg);
+                        websocketConnection?.close(1011, errorMsg);
+                        reject(new Error(errorMsg)); // Reject with a new error
+                    }
+                }
+                else {
+                    const errorMsg = 'Cannot identify client connection for ' + identifier;
+                    // This can happen when a charging station disconnects in the moment a message is trying to send.
+                    // Retry logic on the message sender might not suffice as charging station might connect to different instance.
+                    this._logger.error(errorMsg);
+                    this._identifierConnections
+                        .get(identifier)
+                        ?.close(1011, 'Failed to get connection information for ' + identifier);
+                    reject(new Error(errorMsg)); // Reject with a new error
+                }
+            }
+            catch (error) {
+                reject(error);
+            }
+        });
+    }
+    bindNetworkHook() {
+        return (identifier, message) => this.sendMessage(identifier, message);
+    }
+    async disconnect(tenantId, stationId) {
+        const identifier = createIdentifier(tenantId, stationId);
+        const websocketConnection = this._identifierConnections.get(identifier);
+        if (!websocketConnection) {
+            this._logger.warn(`No websocket connection found for tenantId ${tenantId} and stationId ${stationId}, will still deregister from router.`);
+        }
+        websocketConnection?.close(1000, 'Disconnected by admin request');
+        const deregistered = await this._router?.deregisterConnection(tenantId, stationId);
+        return !!websocketConnection && deregistered;
+    }
+    async shutdown() {
+        this._httpServersMap.forEach((server) => server.close());
+    }
+    /**
+     * Updates certificates for a specific server with the provided TLS key, certificate chain, and optional
+     * root CA.
+     *
+     * @param {string} serverId - The ID of the server to update.
+     * @param {string} tlsKey - The TLS key to set.
+     * @param {string} tlsCertificateChain - The TLS certificate chain to set.
+     * @param {string} [rootCA] - The root CA to set (optional).
+     * @return {void} void
+     */
+    updateTlsCertificates(serverId, tlsKey, tlsCertificateChain, rootCA) {
+        let httpsServer = this._httpServersMap.get(serverId);
+        if (httpsServer && httpsServer instanceof https.Server) {
+            const secureContextOptions = {
+                key: tlsKey,
+                cert: tlsCertificateChain,
+            };
+            if (rootCA) {
+                secureContextOptions.ca = rootCA;
+            }
+            httpsServer.setSecureContext(secureContextOptions);
+            this._logger.info(`Updated TLS certificates in SecureContextOptions for server ${serverId}`);
+        }
+        else {
+            throw new TypeError(`Server ${serverId} is not a https server.`);
+        }
+    }
+    /**
+     * Dynamically adds a new websocket server at runtime and starts it.
+     *
+     * @param {WebsocketServerConfig} websocketServerConfig
+     * @returns {Promise<void>}
+     */
+    async addWebsocketServer(websocketServerConfig) {
+        const httpServer = await this._createAndStartWebsocketServer(websocketServerConfig);
+        this._httpServersMap.set(websocketServerConfig.id, httpServer);
+    }
+    _onHttpRequest(req, res) {
+        if (req.method === 'GET' && req.url === '/health') {
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ status: 'healthy' }));
+        }
+        else {
+            res.writeHead(404, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({
+                message: `Route ${req.method}:${req.url} not found`,
+                error: 'Not Found',
+                statusCode: 404,
+            }));
+        }
+    }
+    /**
+     * Method to validate websocket upgrade requests and pass them to the socket server.
+     *
+     * @param {IncomingMessage} req - The request object.
+     * @param {Duplex} socket - Websocket duplex stream.
+     * @param {Buffer} head - Websocket buffer.
+     * @param {WebSocketServer} wss - Websocket server.
+     * @param {WebsocketServerConfig} websocketServerConfig - websocket server config.
+     */
+    async _upgradeRequest(req, socket, head, wss, websocketServerConfig) {
+        // Failed mTLS and TLS requests are rejected by the server before getting this far
+        this._logger.debug('On upgrade request', req.method, req.url, req.headers, websocketServerConfig);
+        try {
+            // Resolve tenant at upgrade time (query param, path segment, header),
+            // falling back to the server-configured tenant if none provided.
+            const resolvedTenantId = websocketServerConfig.dynamicTenantResolution
+                ? this._extractTenantIdFromRequest(req, websocketServerConfig) ??
+                    websocketServerConfig.tenantId
+                : websocketServerConfig.tenantId;
+            // Attach resolved tenant to request so downstream handlers (connection) can use it
+            req.__resolvedTenantId = resolvedTenantId;
+            const { identifier } = await this._authenticator.authenticate(req, resolvedTenantId, {
+                securityProfile: websocketServerConfig.securityProfile,
+                allowUnknownChargingStations: websocketServerConfig.allowUnknownChargingStations,
+            });
+            this._logger.debug('Successfully registered websocket client', identifier);
+            wss.handleUpgrade(req, socket, head, (ws) => {
+                wss.emit('connection', ws, req);
+            });
+        }
+        catch (error) {
+            /**
+             * See {@link IUpgradeError.terminateConnection}
+             **/
+            error?.terminateConnection?.(socket) || this._terminateConnectionInternalError(socket);
+            this._logger.warn(error);
+        }
+    }
+    /**
+     * Utility function to reject websocket upgrade requests with 500 status code.
+     * @param socket - Websocket duplex stream.
+     */
+    _terminateConnectionInternalError(socket) {
+        socket.write('HTTP/1.1 500 Internal Server Error\r\n');
+        socket.write('\r\n');
+        socket.end();
+        socket.destroy();
+    }
+    /**
+     * Internal method to handle new client connection and ensures supported protocols are used.
+     *
+     * @param {Set<string>} protocols - The set of protocols to handle.
+     * @param {IncomingMessage} _req - The request object.
+     * @param {string} wsServerProtocol - The websocket server protocol.
+     * @return {boolean|string} - Returns the protocol version if successful, otherwise false.
+     */
+    _handleProtocols(protocols, _req, wsServerProtocol) {
+        // Only supports configured protocol version
+        if (protocols.has(wsServerProtocol)) {
+            return wsServerProtocol;
+        }
+        this._logger.error(`Protocol mismatch. Charger supports: [${[...protocols].join(', ')}], but server expects: '${wsServerProtocol}'.`);
+        // Reject the client trying to connect
+        return false;
+    }
+    /**
+     * Internal method to handle the connection event when a WebSocket connection is established.
+     * This happens after successful protocol exchange with client.
+     *
+     * @param {WebSocket} ws - The WebSocket object representing the connection.
+     * @param {WebsocketServerConfig} websocketServerConfig - The websocket server configuration.
+     * @param {number} pingInterval - The ping interval in seconds.
+     * @param {IncomingMessage} req - The request object associated with the connection.
+     * @return {void}
+     */
+    async _onConnection(ws, websocketServerConfig, pingInterval, req) {
+        if (!ws.protocol) {
+            this._logger.debug('Websocket connection without protocol');
+            return;
+        }
+        else {
+            // Pause the WebSocket event emitter until broker is established
+            ws.pause();
+            const stationId = this._getClientIdFromUrl(req.url);
+            // Prefer tenant resolved during upgrade; fallback to server-configured tenant.
+            const tenantId = req.__resolvedTenantId ?? websocketServerConfig.tenantId;
+            const checker = this._doesChargingStationExistByStationId ??
+                this._router.doesChargingStationExistByStationId?.bind(this._router);
+            if (!checker) {
+                throw new Error('No method available to check if charging station exists');
+            }
+            const exists = await checker(tenantId, stationId);
+            if (!exists && !websocketServerConfig.allowUnknownChargingStations) {
+                this._logger.error('Rejecting connection: station %s not found in tenant %s', stationId, tenantId);
+                ws.close(1011, 'Unknown charging station');
+                return;
+            }
+            const identifier = createIdentifier(tenantId, stationId);
+            // Enforce optional per-tenant connection limit if configured
+            const maxConnections = websocketServerConfig.maxConnectionsPerTenant;
+            if (typeof maxConnections === 'number' && maxConnections > 0) {
+                const currentCount = [...this._identifierConnections.keys()].filter((k) => getTenantIdFromIdentifier(k) === tenantId).length;
+                if (currentCount >= maxConnections) {
+                    this._logger.warn(`Tenant ${tenantId} exceeded max connections (${maxConnections}), rejecting ${identifier}`);
+                    ws.close(1013, 'Tenant connection limit exceeded');
+                    return;
+                }
+            }
+            this._identifierConnections.set(identifier, ws);
+            try {
+                // Get IP address of client
+                const ip = req.headers['x-forwarded-for']?.toString().split(',')[0].trim() ||
+                    req.socket.remoteAddress ||
+                    'N/A';
+                const port = req.socket.remotePort;
+                const connLogger = this._logger.getSubLogger({
+                    name: `T${tenantId}:${stationId}`,
+                });
+                connLogger.info('Client websocket connected', identifier, ip, port, ws.protocol);
+                // Register client
+                const websocketConnection = {
+                    id: websocketServerConfig.id,
+                    protocol: ws.protocol,
+                };
+                let registered = await this._cache.set(identifier, JSON.stringify(websocketConnection), CacheNamespace.Connections);
+                registered =
+                    registered && (await this._router.registerConnection(tenantId, stationId, ws.protocol));
+                if (!registered) {
+                    connLogger.fatal('Failed to register websocket client', identifier);
+                    throw new Error('Failed to register websocket client');
+                }
+                connLogger.info('Successfully connected new charging station.', identifier);
+                // Register all websocket events
+                this._registerWebsocketEvents(identifier, ws, pingInterval);
+                // Resume the WebSocket event emitter after events have been subscribed to
+                ws.resume();
+            }
+            catch (error) {
+                this._logger.fatal('Failed to subscribe to message broker for ', identifier);
+                ws.close(1011, 'Failed to subscribe to message broker for ' + identifier);
+            }
+        }
+    }
+    /**
+     * Internal method to register event listeners for the WebSocket connection.
+     *
+     * @param {string} identifier - The unique identifier of the connection, i.e. the combination of tenantId and stationId.
+     * @param {WebSocket} ws - The WebSocket object representing the connection.
+     * @param {number} pingInterval - The ping interval in seconds.
+     * @return {void} This function does not return anything.
+     */
+    _registerWebsocketEvents(identifier, ws, pingInterval) {
+        ws.onerror = (event) => {
+            this._logger.error('Connection error encountered for', identifier, event.error, event.message, event.type);
+            ws.close(1011, event.message);
+        };
+        ws.onmessage = (event) => {
+            this._onMessage(identifier, event.data.toString(), ws.protocol);
+        };
+        ws.once('close', () => {
+            // Unregister client
+            this._logger.info('Connection closed for', identifier);
+            this._cache.remove(identifier, CacheNamespace.Connections);
+            this._identifierConnections.delete(identifier);
+            this._router.deregisterConnection(getTenantIdFromIdentifier(identifier), getStationIdFromIdentifier(identifier));
+        });
+        ws.on('ping', async (message) => {
+            this._logger.debug(`Ping received for ${identifier} with message ${JSON.stringify(message)}`);
+            ws.pong(message);
+        });
+        ws.on('pong', async () => {
+            this._logger.debug('Pong received for', identifier);
+            const clientConnection = await this._cache.get(identifier, CacheNamespace.Connections);
+            if (clientConnection) {
+                // Remove expiration for connection and send ping to client in pingInterval seconds.
+                await this._cache.set(identifier, clientConnection, CacheNamespace.Connections);
+                this._ping(identifier, ws, pingInterval);
+            }
+            else {
+                this._logger.debug('Pong received for', identifier, 'but client is not alive');
+                ws.close(1011, 'Client is not alive');
+            }
+        });
+        this._ping(identifier, ws, pingInterval);
+    }
+    /**
+     * Internal method to handle the incoming message from the websocket client.
+     *
+     * @param {string} identifier - The client identifier.
+     * @param {string} message - The incoming message from the client.
+     * @param {OCPPVersionType} protocol - The OCPP protocol version of the client, 'ocpp1.6' or 'ocpp2.0.1'.
+     * @return {void} This function does not return anything.
+     */
+    _onMessage(identifier, message, protocol) {
+        this._router.onMessage(identifier, message, new Date(), protocol);
+    }
+    /**
+     * Internal method to handle the error event for the WebSocket server.
+     *
+     * @param {WebSocketServer} wss - The WebSocket server instance.
+     * @param {Error} error - The error object.
+     * @return {void} This function does not return anything.
+     */
+    _onError(wss, error) {
+        this._logger.error(error);
+        // TODO: Try to recover the Websocket server
+    }
+    /**
+     * Internal method to handle the event when the WebSocketServer is closed.
+     *
+     * @param {WebSocketServer} wss - The WebSocketServer instance.
+     * @return {void} This function does not return anything.
+     */
+    _onClose(wss) {
+        this._logger.debug('Websocket Server closed');
+        // TODO: Try to recover the Websocket server
+    }
+    /**
+     * Internal method to execute a ping operation on a WebSocket connection after a delay of 60 seconds.
+     *
+     * @param {string} identifier - The identifier of the client connection.
+     * @param {WebSocket} ws - The WebSocket connection to ping.
+     * @param {number} pingInterval - The ping interval in milliseconds.
+     * @return {void} This function does not return anything.
+     */
+    async _ping(identifier, ws, pingInterval) {
+        setTimeout(async () => {
+            const clientConnection = await this._cache.get(identifier, CacheNamespace.Connections);
+            if (clientConnection) {
+                this._logger.debug('Pinging client', identifier);
+                // Set connection expiration and send ping to client
+                await this._cache.set(identifier, clientConnection, CacheNamespace.Connections, pingInterval * 2);
+                ws.ping();
+            }
+            else {
+                ws.close(1011, 'Client is not alive');
+            }
+        }, pingInterval * 1000);
+    }
+    /**
+     *
+     * @param url Http upgrade request url used by charger
+     * @returns Charger identifier
+     */
+    _getClientIdFromUrl(url) {
+        // Remove query string first
+        const pathOnly = url.split('?')[0];
+        return pathOnly.split('/').pop();
+    }
+    /**
+     * Extract tenant id from the incoming upgrade request.
+     * Supported sources (in order): query `tenant`/`tenantId`, header `x-tenant-id`,
+     * path segment (second-last segment if URL is `/tenant/station`).
+     */
+    _extractTenantIdFromRequest(req, config) {
+        try {
+            const rawUrl = req.url ?? '';
+            const url = new URL(rawUrl, 'http://localhost');
+            const segments = url.pathname.split('/').filter(Boolean);
+            // Path segment mapping: assume /.../{pathSegment}/{station}
+            // We look for a mapping of pathSegment to tenantId.
+            if (segments.length >= 2 && config.tenantPathMapping) {
+                const pathSegment = segments[segments.length - 2];
+                if (config.tenantPathMapping[pathSegment]) {
+                    return config.tenantPathMapping[pathSegment];
+                }
+                else {
+                    this._logger.debug(`No mapping found for path segment: ${pathSegment}`);
+                }
+            }
+        }
+        catch (err) {
+            // If parsing fails, ignore and fall back to server-configured tenant
+            this._logger.debug('Failed to extract tenant from request', err);
+        }
+        return undefined;
+    }
+    _generateServerOptions(config) {
+        const serverOptions = {
+            key: fs.readFileSync(config.tlsKeyFilePath),
+            cert: fs.readFileSync(config.tlsCertificateChainFilePath),
+        };
+        if (config.rootCACertificateFilePath) {
+            serverOptions.ca = fs.readFileSync(config.rootCACertificateFilePath);
+        }
+        if (config.securityProfile > 2) {
+            serverOptions.requestCert = true;
+            serverOptions.rejectUnauthorized = true;
+        }
+        else {
+            serverOptions.rejectUnauthorized = false;
+        }
+        return serverOptions;
+    }
+    _createAndStartWebsocketServer(wsConfig) {
+        return new Promise((resolve) => {
+            let httpServer;
+            switch (wsConfig.securityProfile) {
+                case 3: // mTLS
+                case 2: // TLS
+                    httpServer = https.createServer(this._generateServerOptions(wsConfig), this._onHttpRequest.bind(this));
+                    break;
+                case 1:
+                case 0:
+                default:
+                    httpServer = http.createServer(this._onHttpRequest.bind(this));
+                    break;
+            }
+            const wss = new WebSocketServer({
+                noServer: true,
+                handleProtocols: (protocols, req) => this._handleProtocols(protocols, req, wsConfig.protocol),
+                clientTracking: false,
+            });
+            wss.on('connection', (ws, req) => this._onConnection(ws, wsConfig, wsConfig.pingInterval, req));
+            wss.on('error', (server, error) => this._onError(server, error));
+            wss.on('close', (server) => this._onClose(server));
+            httpServer.on('upgrade', (req, socket, head) => this._upgradeRequest(req, socket, head, wss, wsConfig));
+            httpServer.on('error', (error) => wss.emit('error', error));
+            httpServer.on('close', () => wss.emit('close'));
+            const protocol = wsConfig.securityProfile > 1 ? 'wss' : 'ws';
+            httpServer.listen(wsConfig.port, wsConfig.host, () => {
+                this._logger.info(`WebsocketServer running on ${protocol}://${wsConfig.host}:${wsConfig.port}/`);
+                resolve(httpServer);
+            });
+        });
+    }
+}
+//# sourceMappingURL=WebsocketNetworkConnection.js.map

package/dist/networkconnection/WebsocketNetworkConnection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"WebsocketNetworkConnection.js","sourceRoot":"","sources":["../../src/networkconnection/WebsocketNetworkConnection.ts"],"names":[],"mappings":"AAcA,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,0BAA0B,EAC1B,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAGhC,OAAO,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AAE/B,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,IAAI,CAAC;AAGhD,MAAM,OAAO,0BAA0B;IAC3B,MAAM,CAAS;IACf,OAAO,CAAe;IACtB,OAAO,CAAkB;IAC3B,sBAAsB,GAA2B,IAAI,GAAG,EAAE,CAAC;IACnE,sDAAsD;IAC9C,eAAe,CAA0C;IACzD,cAAc,CAAiB;IAC/B,OAAO,CAAiB;IACxB,oCAAoC,CAGtB;IAEtB,YACE,MAAoB,EACpB,KAAa,EACb,aAA6B,EAC7B,MAAsB,EACtB,MAAwB,EACxB,mCAA+F;QAE/F,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,oCAAoC,GAAG,mCAAmC,CAAC;QAChF,IAAI,CAAC,OAAO,GAAG,MAAM;YACnB,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;YACtD,CAAC,CAAC,IAAI,MAAM,CAAU,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,cAAc,GAAG,aAAa,CAAC;QACpC,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QAEtB,IAAI,CAAC,eAAe,GAAG,IAAI,GAAG,EAAsC,CAAC;QACrE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,OAAO,CAAC,KAAK,EAAE,qBAAqB,EAAE,EAAE;YAC3F,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,8BAA8B,CAAC,qBAAqB,CAAC,CAAC;YACrF,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,WAAW,CAAC,UAAkB,EAAE,OAAe;QAC7C,OAAO,IAAI,OAAO,CAAO,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE;YACjD,IAAI,CAAC;gBACH,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,cAAc,CAAC,WAAW,CAAC,CAAC;gBACvF,IAAI,gBAAgB,EAAE,CAAC;oBACrB,MAAM,mBAAmB,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;oBACxE,IAAI,mBAAmB,IAAI,mBAAmB,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;wBAC7E,mBAAmB,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;4BAC1C,IAAI,KAAK,EAAE,CAAC;gCACV,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,oCAAoC;4BACrD,CAAC;iCAAM,CAAC;gCACN,OAAO,EAAE,CAAC,CAAC,mDAAmD;4BAChE,CAAC;wBACH,CAAC,CAAC,CAAC;oBACL,CAAC;yBAAM,CAAC;wBACN,MAAM,QAAQ,GAAG,sCAAsC,GAAG,UAAU,CAAC;wBACrE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;wBAC7B,mBAAmB,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;wBAC3C,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,0BAA0B;oBACzD,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,MAAM,QAAQ,GAAG,wCAAwC,GAAG,UAAU,CAAC;oBACvE,iGAAiG;oBACjG,+GAA+G;oBAC/G,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;oBAC7B,IAAI,CAAC,sBAAsB;yBACxB,GAAG,CAAC,UAAU,CAAC;wBAChB,EAAE,KAAK,CAAC,IAAI,EAAE,2CAA2C,GAAG,UAAU,CAAC,CAAC;oBAC1E,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,0BAA0B;gBACzD,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,CAAC;YAChB,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,eAAe;QACb,OAAO,CAAC,UAAkB,EAAE,OAAe,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACxF,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,QAAgB,EAAE,SAAiB;QAClD,MAAM,UAAU,GAAG,gBAAgB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAEzD,MAAM,mBAAmB,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAExE,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,IAAI,CAAC,OAAO,CAAC,IAAI,CACf,8CAA8C,QAAQ,kBAAkB,SAAS,sCAAsC,CACxH,CAAC;QACJ,CAAC;QACD,mBAAmB,EAAE,KAAK,CAAC,IAAI,EAAE,+BAA+B,CAAC,CAAC;QAClE,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,oBAAoB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAEnF,OAAO,CAAC,CAAC,mBAAmB,IAAI,YAAY,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED;;;;;;;;;OASG;IACH,qBAAqB,CACnB,QAAgB,EAChB,MAAc,EACd,mBAA2B,EAC3B,MAAe;QAEf,IAAI,WAAW,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAErD,IAAI,WAAW,IAAI,WAAW,YAAY,KAAK,CAAC,MAAM,EAAE,CAAC;YACvD,MAAM,oBAAoB,GAAyB;gBACjD,GAAG,EAAE,MAAM;gBACX,IAAI,EAAE,mBAAmB;aAC1B,CAAC;YACF,IAAI,MAAM,EAAE,CAAC;gBACX,oBAAoB,CAAC,EAAE,GAAG,MAAM,CAAC;YACnC,CAAC;YACD,WAAW,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,CAAC;YACnD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,+DAA+D,QAAQ,EAAE,CAAC,CAAC;QAC/F,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,SAAS,CAAC,UAAU,QAAQ,yBAAyB,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,kBAAkB,CAAC,qBAA4C;QACnE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,8BAA8B,CAAC,qBAAqB,CAAC,CAAC;QACpF,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IACjE,CAAC;IAEO,cAAc,CAAC,GAAyB,EAAE,GAAwB;QACxE,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAClD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;QACjD,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;gBACb,OAAO,EAAE,SAAS,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,GAAG,YAAY;gBACnD,KAAK,EAAE,WAAW;gBAClB,UAAU,EAAE,GAAG;aAChB,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,eAAe,CAC3B,GAAyB,EACzB,MAAc,EACd,IAAY,EACZ,GAAoB,EACpB,qBAA4C;QAE5C,kFAAkF;QAClF,IAAI,CAAC,OAAO,CAAC,KAAK,CAChB,oBAAoB,EACpB,GAAG,CAAC,MAAM,EACV,GAAG,CAAC,GAAG,EACP,GAAG,CAAC,OAAO,EACX,qBAAqB,CACtB,CAAC;QAEF,IAAI,CAAC;YACH,sEAAsE;YACtE,iEAAiE;YACjE,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,uBAAuB;gBACpE,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,GAAG,EAAE,qBAAqB,CAAC;oBAC5D,qBAAqB,CAAC,QAAQ;gBAChC,CAAC,CAAC,qBAAqB,CAAC,QAAQ,CAAC;YAEnC,mFAAmF;YAClF,GAAW,CAAC,kBAAkB,GAAG,gBAAgB,CAAC;YAEnD,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,GAAG,EAAE,gBAAgB,EAAE;gBACnF,eAAe,EAAE,qBAAqB,CAAC,eAAe;gBACtD,4BAA4B,EAAE,qBAAqB,CAAC,4BAA4B;aACjF,CAAC,CAAC;YAEH,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAE,UAAU,CAAC,CAAC;YAE3E,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;gBAC1C,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;YAClC,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB;;gBAEI;YACJ,KAAK,EAAE,mBAAmB,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,iCAAiC,CAAC,MAAM,CAAC,CAAC;YACvF,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,iCAAiC,CAAC,MAAc;QACtD,MAAM,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;QACvD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACrB,MAAM,CAAC,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;IAED;;;;;;;OAOG;IACK,gBAAgB,CACtB,SAAsB,EACtB,IAA0B,EAC1B,gBAAiC;QAEjC,4CAA4C;QAC5C,IAAI,SAAS,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACpC,OAAO,gBAAgB,CAAC;QAC1B,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,CAChB,yCAAyC,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,2BAA2B,gBAAgB,IAAI,CAClH,CAAC;QACF,sCAAsC;QACtC,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,aAAa,CACzB,EAAa,EACb,qBAA4C,EAC5C,YAAoB,EACpB,GAAyB;QAEzB,IAAI,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC;YACjB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;aAAM,CAAC;YACN,gEAAgE;YAChE,EAAE,CAAC,KAAK,EAAE,CAAC;YAEX,MAAM,SAAS,GAAG,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAa,CAAC,CAAC;YAC9D,+EAA+E;YAC/E,MAAM,QAAQ,GAAI,GAAW,CAAC,kBAAkB,IAAI,qBAAqB,CAAC,QAAQ,CAAC;YAEnF,MAAM,OAAO,GACX,IAAI,CAAC,oCAAoC;gBACzC,IAAI,CAAC,OAAO,CAAC,mCAAmC,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAEvE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;YAC7E,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YAElD,IAAI,CAAC,MAAM,IAAI,CAAC,qBAAqB,CAAC,4BAA4B,EAAE,CAAC;gBACnE,IAAI,CAAC,OAAO,CAAC,KAAK,CAChB,yDAAyD,EACzD,SAAS,EACT,QAAQ,CACT,CAAC;gBACF,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,0BAA0B,CAAC,CAAC;gBAC3C,OAAO;YACT,CAAC;YAED,MAAM,UAAU,GAAG,gBAAgB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YAEzD,6DAA6D;YAC7D,MAAM,cAAc,GAAG,qBAAqB,CAAC,uBAAuB,CAAC;YACrE,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;gBAC7D,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,CAAC,sBAAsB,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CACjE,CAAC,CAAC,EAAE,EAAE,CAAC,yBAAyB,CAAC,CAAC,CAAC,KAAK,QAAQ,CACjD,CAAC,MAAM,CAAC;gBACT,IAAI,YAAY,IAAI,cAAc,EAAE,CAAC;oBACnC,IAAI,CAAC,OAAO,CAAC,IAAI,CACf,UAAU,QAAQ,8BAA8B,cAAc,gBAAgB,UAAU,EAAE,CAC3F,CAAC;oBACF,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,kCAAkC,CAAC,CAAC;oBACnD,OAAO;gBACT,CAAC;YACH,CAAC;YAED,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YAChD,IAAI,CAAC;gBACH,2BAA2B;gBAC3B,MAAM,EAAE,GACN,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;oBAC/D,GAAG,CAAC,MAAM,CAAC,aAAa;oBACxB,KAAK,CAAC;gBACR,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,UAAoB,CAAC;gBAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;oBAC3C,IAAI,EAAE,IAAI,QAAQ,IAAI,SAAS,EAAE;iBAClC,CAAC,CAAC;gBACH,UAAU,CAAC,IAAI,CAAC,4BAA4B,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC;gBAEjF,kBAAkB;gBAClB,MAAM,mBAAmB,GAAyB;oBAChD,EAAE,EAAE,qBAAqB,CAAC,EAAE;oBAC5B,QAAQ,EAAE,EAAE,CAAC,QAAQ;iBACtB,CAAC;gBACF,IAAI,UAAU,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CACpC,UAAU,EACV,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,EACnC,cAAc,CAAC,WAAW,CAC3B,CAAC;gBACF,UAAU;oBACR,UAAU,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,QAAQ,EAAE,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAC1F,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,UAAU,CAAC,KAAK,CAAC,qCAAqC,EAAE,UAAU,CAAC,CAAC;oBACpE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;gBACzD,CAAC;gBAED,UAAU,CAAC,IAAI,CAAC,8CAA8C,EAAE,UAAU,CAAC,CAAC;gBAE5E,gCAAgC;gBAChC,IAAI,CAAC,wBAAwB,CAAC,UAAU,EAAE,EAAE,EAAE,YAAY,CAAC,CAAC;gBAE5D,0EAA0E;gBAC1E,EAAE,CAAC,MAAM,EAAE,CAAC;YACd,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,4CAA4C,EAAE,UAAU,CAAC,CAAC;gBAC7E,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,4CAA4C,GAAG,UAAU,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,wBAAwB,CAAC,UAAkB,EAAE,EAAa,EAAE,YAAoB;QACtF,EAAE,CAAC,OAAO,GAAG,CAAC,KAAiB,EAAE,EAAE;YACjC,IAAI,CAAC,OAAO,CAAC,KAAK,CAChB,kCAAkC,EAClC,UAAU,EACV,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,IAAI,CACX,CAAC;YACF,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAChC,CAAC,CAAC;QACF,EAAE,CAAC,SAAS,GAAG,CAAC,KAAmB,EAAE,EAAE;YACrC,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,CAAC,QAA2B,CAAC,CAAC;QACrF,CAAC,CAAC;QAEF,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACpB,oBAAoB;YACpB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,uBAAuB,EAAE,UAAU,CAAC,CAAC;YACvD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,cAAc,CAAC,WAAW,CAAC,CAAC;YAC3D,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAC/C,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAC/B,yBAAyB,CAAC,UAAU,CAAC,EACrC,0BAA0B,CAAC,UAAU,CAAC,CACvC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YAC9B,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,qBAAqB,UAAU,iBAAiB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC9F,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnB,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;YACvB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,mBAAmB,EAAE,UAAU,CAAC,CAAC;YACpD,MAAM,gBAAgB,GAAkB,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAC3D,UAAU,EACV,cAAc,CAAC,WAAW,CAC3B,CAAC;YAEF,IAAI,gBAAgB,EAAE,CAAC;gBACrB,oFAAoF;gBACpF,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,gBAAgB,EAAE,cAAc,CAAC,WAAW,CAAC,CAAC;gBAChF,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,EAAE,YAAY,CAAC,CAAC;YAC3C,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,mBAAmB,EAAE,UAAU,EAAE,yBAAyB,CAAC,CAAC;gBAC/E,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;YACxC,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,EAAE,YAAY,CAAC,CAAC;IAC3C,CAAC;IAED;;;;;;;OAOG;IACK,UAAU,CAAC,UAAkB,EAAE,OAAe,EAAE,QAAyB;QAC/E,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;IACpE,CAAC;IAED;;;;;;OAMG;IACK,QAAQ,CAAC,GAAoB,EAAE,KAAY;QACjD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,4CAA4C;IAC9C,CAAC;IAED;;;;;OAKG;IACK,QAAQ,CAAC,GAAoB;QACnC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC9C,4CAA4C;IAC9C,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,KAAK,CAAC,UAAkB,EAAE,EAAa,EAAE,YAAoB;QACzE,UAAU,CAAC,KAAK,IAAI,EAAE;YACpB,MAAM,gBAAgB,GAAkB,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAC3D,UAAU,EACV,cAAc,CAAC,WAAW,CAC3B,CAAC;YACF,IAAI,gBAAgB,EAAE,CAAC;gBACrB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE,UAAU,CAAC,CAAC;gBACjD,oDAAoD;gBACpD,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CACnB,UAAU,EACV,gBAAgB,EAChB,cAAc,CAAC,WAAW,EAC1B,YAAY,GAAG,CAAC,CACjB,CAAC;gBACF,EAAE,CAAC,IAAI,EAAE,CAAC;YACZ,CAAC;iBAAM,CAAC;gBACN,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;YACxC,CAAC;QACH,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC,CAAC;IAC1B,CAAC;IACD;;;;OAIG;IACK,mBAAmB,CAAC,GAAW;QACrC,4BAA4B;QAC5B,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnC,OAAO,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAY,CAAC;IAC7C,CAAC;IAED;;;;OAIG;IACK,2BAA2B,CACjC,GAAyB,EACzB,MAA6B;QAE7B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;YAChD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAEzD,4DAA4D;YAC5D,oDAAoD;YACpD,IAAI,QAAQ,CAAC,MAAM,IAAI,CAAC,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;gBACrD,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBAClD,IAAI,MAAM,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC1C,OAAO,MAAM,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;gBAC/C,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,sCAAsC,WAAW,EAAE,CAAC,CAAC;gBAC1E,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,qEAAqE;YACrE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,uCAAuC,EAAE,GAAG,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,sBAAsB,CAAC,MAA6B;QAC1D,MAAM,aAAa,GAAwB;YACzC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,cAAwB,CAAC;YACrD,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,2BAAqC,CAAC;SACpE,CAAC;QAEF,IAAI,MAAM,CAAC,yBAAyB,EAAE,CAAC;YACrC,aAAa,CAAC,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,yBAAmC,CAAC,CAAC;QACjF,CAAC;QAED,IAAI,MAAM,CAAC,eAAe,GAAG,CAAC,EAAE,CAAC;YAC/B,aAAa,CAAC,WAAW,GAAG,IAAI,CAAC;YACjC,aAAa,CAAC,kBAAkB,GAAG,IAAI,CAAC;QAC1C,CAAC;aAAM,CAAC;YACN,aAAa,CAAC,kBAAkB,GAAG,KAAK,CAAC;QAC3C,CAAC;QAED,OAAO,aAAa,CAAC;IACvB,CAAC;IAEO,8BAA8B,CACpC,QAA+B;QAE/B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,IAAI,UAAsC,CAAC;YAC3C,QAAQ,QAAQ,CAAC,eAAe,EAAE,CAAC;gBACjC,KAAK,CAAC,CAAC,CAAC,OAAO;gBACf,KAAK,CAAC,EAAE,MAAM;oBACZ,UAAU,GAAG,KAAK,CAAC,YAAY,CAC7B,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,EACrC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAC/B,CAAC;oBACF,MAAM;gBACR,KAAK,CAAC,CAAC;gBACP,KAAK,CAAC,CAAC;gBACP;oBACE,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;oBAC/D,MAAM;YACV,CAAC;YAED,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC;gBAC9B,QAAQ,EAAE,IAAI;gBACd,eAAe,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAClC,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,QAAQ,CAAC,QAA2B,CAAC;gBAC7E,cAAc,EAAE,KAAK;aACtB,CAAC,CAAC;YAEH,GAAG,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAC/B,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,CAC7D,CAAC;YACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,MAAW,EAAE,KAAU,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;YAC3E,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,MAAW,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YAExD,UAAU,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAC7C,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,CACvD,CAAC;YACF,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;YAC5D,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YAEhD,MAAM,QAAQ,GAAG,QAAQ,CAAC,eAAe,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7D,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE;gBACnD,IAAI,CAAC,OAAO,CAAC,IAAI,CACf,8BAA8B,QAAQ,MAAM,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,GAAG,CAC9E,CAAC;gBACF,OAAO,CAAC,UAAU,CAAC,CAAC;YACtB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/networkconnection/authenticator/Authenticator.d.ts

@@ -0,0 +1,20 @@
+import type { AuthenticationOptions, IAuthenticator } from '@citrineos/base';
+import type { ILogObj } from 'tslog';
+import { Logger } from 'tslog';
+import { IncomingMessage } from 'http';
+import { UnknownStationFilter } from './UnknownStationFilter.js';
+import { BasicAuthenticationFilter } from './BasicAuthenticationFilter.js';
+import { ConnectedStationFilter } from './ConnectedStationFilter.js';
+import { NetworkProfileFilter } from './NetworkProfileFilter.js';
+export declare class Authenticator implements IAuthenticator {
+    protected _logger: Logger<ILogObj>;
+    private _unknownStationFilter;
+    private _connectedStationFilter;
+    private _networkProfileFilter;
+    private _basicAuthenticationFilter;
+    constructor(unknownStationFilter: UnknownStationFilter, connectedStationFilter: ConnectedStationFilter, networkProfileFilter: NetworkProfileFilter, basicAuthenticationFilter: BasicAuthenticationFilter, logger?: Logger<ILogObj>);
+    authenticate(request: IncomingMessage, tenantId: number, options: AuthenticationOptions): Promise<{
+        identifier: string;
+    }>;
+    private _getClientIdFromUrl;
+}

package/dist/networkconnection/authenticator/Authenticator.js

@@ -0,0 +1,39 @@
+// SPDX-FileCopyrightText: 2025 Contributors to the CitrineOS Project
+//
+// SPDX-License-Identifier: Apache-2.0
+import { Logger } from 'tslog';
+import { IncomingMessage } from 'http';
+import { UnknownStationFilter } from './UnknownStationFilter.js';
+import { BasicAuthenticationFilter } from './BasicAuthenticationFilter.js';
+import { ConnectedStationFilter } from './ConnectedStationFilter.js';
+import { NetworkProfileFilter } from './NetworkProfileFilter.js';
+export class Authenticator {
+    _logger;
+    _unknownStationFilter;
+    _connectedStationFilter;
+    _networkProfileFilter;
+    _basicAuthenticationFilter;
+    constructor(unknownStationFilter, connectedStationFilter, networkProfileFilter, basicAuthenticationFilter, logger) {
+        this._unknownStationFilter = unknownStationFilter;
+        this._connectedStationFilter = connectedStationFilter;
+        this._networkProfileFilter = networkProfileFilter;
+        this._basicAuthenticationFilter = basicAuthenticationFilter;
+        this._logger = logger
+            ? logger.getSubLogger({ name: this.constructor.name })
+            : new Logger({ name: this.constructor.name });
+    }
+    async authenticate(request, tenantId, options) {
+        const identifier = this._getClientIdFromUrl(request.url);
+        this._logger.debug(`Starting authentication for identifier: ${identifier}`);
+        await this._unknownStationFilter.authenticate(tenantId, identifier, request, options);
+        await this._connectedStationFilter.authenticate(tenantId, identifier, request, options);
+        await this._networkProfileFilter.authenticate(tenantId, identifier, request, options);
+        await this._basicAuthenticationFilter.authenticate(tenantId, identifier, request, options);
+        this._logger.debug(`Authentication successful for identifier: ${identifier}`);
+        return { identifier };
+    }
+    _getClientIdFromUrl(url) {
+        return url.split('/').pop();
+    }
+}
+//# sourceMappingURL=Authenticator.js.map

package/dist/networkconnection/authenticator/Authenticator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Authenticator.js","sourceRoot":"","sources":["../../../src/networkconnection/authenticator/Authenticator.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,EAAE;AACF,sCAAsC;AAItC,OAAO,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AAC/B,OAAO,EAAE,eAAe,EAAE,MAAM,MAAM,CAAC;AACvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,MAAM,OAAO,aAAa;IACd,OAAO,CAAkB;IAC3B,qBAAqB,CAAuB;IAC5C,uBAAuB,CAAyB;IAChD,qBAAqB,CAAuB;IAC5C,0BAA0B,CAA4B;IAE9D,YACE,oBAA0C,EAC1C,sBAA8C,EAC9C,oBAA0C,EAC1C,yBAAoD,EACpD,MAAwB;QAExB,IAAI,CAAC,qBAAqB,GAAG,oBAAoB,CAAC;QAClD,IAAI,CAAC,uBAAuB,GAAG,sBAAsB,CAAC;QACtD,IAAI,CAAC,qBAAqB,GAAG,oBAAoB,CAAC;QAClD,IAAI,CAAC,0BAA0B,GAAG,yBAAyB,CAAC;QAC5D,IAAI,CAAC,OAAO,GAAG,MAAM;YACnB,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;YACtD,CAAC,CAAC,IAAI,MAAM,CAAU,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,OAAwB,EACxB,QAAgB,EAChB,OAA8B;QAE9B,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,GAAa,CAAC,CAAC;QACnE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,2CAA2C,UAAU,EAAE,CAAC,CAAC;QAE5E,MAAM,IAAI,CAAC,qBAAqB,CAAC,YAAY,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACtF,MAAM,IAAI,CAAC,uBAAuB,CAAC,YAAY,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACxF,MAAM,IAAI,CAAC,qBAAqB,CAAC,YAAY,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACtF,MAAM,IAAI,CAAC,0BAA0B,CAAC,YAAY,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAE3F,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,6CAA6C,UAAU,EAAE,CAAC,CAAC;QAC9E,OAAO,EAAE,UAAU,EAAE,CAAC;IACxB,CAAC;IAEO,mBAAmB,CAAC,GAAW;QACrC,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAY,CAAC;IACxC,CAAC;CACF"}

package/dist/networkconnection/authenticator/AuthenticatorFilter.d.ts

@@ -0,0 +1,11 @@
+import { IncomingMessage } from 'http';
+import type { ILogObj } from 'tslog';
+import { Logger } from 'tslog';
+import type { AuthenticationOptions } from '@citrineos/base';
+export declare abstract class AuthenticatorFilter {
+    protected _logger: Logger<ILogObj>;
+    protected constructor(logger?: Logger<ILogObj>);
+    protected abstract shouldFilter(options: AuthenticationOptions): boolean;
+    protected abstract filter(tenantId: number, identifier: string, request: IncomingMessage, options?: AuthenticationOptions): Promise<void>;
+    authenticate(tenantId: number, identifier: string, request: IncomingMessage, options: AuthenticationOptions): Promise<void>;
+}

package/dist/networkconnection/authenticator/AuthenticatorFilter.js

@@ -0,0 +1,30 @@
+// SPDX-FileCopyrightText: 2025 Contributors to the CitrineOS Project
+//
+// SPDX-License-Identifier: Apache-2.0
+import { IncomingMessage } from 'http';
+import { Logger } from 'tslog';
+export class AuthenticatorFilter {
+    _logger;
+    constructor(logger) {
+        this._logger = logger
+            ? logger.getSubLogger({ name: this.constructor.name })
+            : new Logger({ name: this.constructor.name });
+    }
+    async authenticate(tenantId, identifier, request, options) {
+        if (this.shouldFilter(options)) {
+            this._logger.debug(`Applying filter for: ${identifier}`);
+            try {
+                await this.filter(tenantId, identifier, request, options);
+                this._logger.debug(`Filter passed for: ${identifier}`);
+            }
+            catch (error) {
+                this._logger.warn(`Filter failed for: ${identifier}`);
+                throw error;
+            }
+        }
+        else {
+            this._logger.debug(`Filter skipped for: ${identifier}`);
+        }
+    }
+}
+//# sourceMappingURL=AuthenticatorFilter.js.map

package/dist/networkconnection/authenticator/AuthenticatorFilter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthenticatorFilter.js","sourceRoot":"","sources":["../../../src/networkconnection/authenticator/AuthenticatorFilter.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,EAAE;AACF,sCAAsC;AACtC,OAAO,EAAE,eAAe,EAAE,MAAM,MAAM,CAAC;AAEvC,OAAO,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AAG/B,MAAM,OAAgB,mBAAmB;IAC7B,OAAO,CAAkB;IAEnC,YAAsB,MAAwB;QAC5C,IAAI,CAAC,OAAO,GAAG,MAAM;YACnB,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;YACtD,CAAC,CAAC,IAAI,MAAM,CAAU,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;IAUD,KAAK,CAAC,YAAY,CAChB,QAAgB,EAChB,UAAkB,EAClB,OAAwB,EACxB,OAA8B;QAE9B,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,wBAAwB,UAAU,EAAE,CAAC,CAAC;YACzD,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC1D,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,sBAAsB,UAAU,EAAE,CAAC,CAAC;YACzD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,UAAU,EAAE,CAAC,CAAC;gBACtD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,uBAAuB,UAAU,EAAE,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;CACF"}

package/dist/networkconnection/authenticator/BasicAuthenticationFilter.d.ts

@@ -0,0 +1,17 @@
+import type { ILogObj } from 'tslog';
+import { Logger } from 'tslog';
+import type { IDeviceModelRepository } from '@citrineos/data';
+import { IncomingMessage } from 'http';
+import { AuthenticatorFilter } from './AuthenticatorFilter.js';
+import type { AuthenticationOptions } from '@citrineos/base';
+/**
+ * Filter used to authenticate incoming HTTP requests based on basic authorization header.
+ * It only applies when the security profile is set to 1 or 2.
+ */
+export declare class BasicAuthenticationFilter extends AuthenticatorFilter {
+    private _deviceModelRepository;
+    constructor(deviceModelRepository: IDeviceModelRepository, logger?: Logger<ILogObj>);
+    protected shouldFilter(options: AuthenticationOptions): boolean;
+    protected filter(tenantId: number, identifier: string, request: IncomingMessage): Promise<void>;
+    private _isPasswordValid;
+}