agent-tower 0.5.3 → 0.5.4-beta.1

package/dist/middleware/access-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-auth.d.ts","sourceRoot":"","sources":["../../src/middleware/access-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AA4F5D,wBAAsB,cAAc,CAClC,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,YAAY,GAClB,OAAO,CAAC,IAAI,CAAC,CAyBf"}

package/dist/middleware/access-auth.js

@@ -0,0 +1,110 @@
+import { AccessAuthService } from '../services/access-auth.service.js';
+import { INTERNAL_API_TOKEN_HEADER, validateInternalApiToken, } from '../utils/internal-api-token.js';
+import { parsePreviewPath } from '../utils/preview-path.js';
+function firstHeaderValue(value) {
+    return Array.isArray(value) ? value[0] : value;
+}
+function isPublicAccessAuthEndpoint(request) {
+    const pathname = new URL(request.url, 'http://agent-tower.local').pathname;
+    if (pathname === '/api/access-auth/status')
+        return request.method === 'GET';
+    if (pathname === '/api/access-auth/login')
+        return request.method === 'POST';
+    if (pathname === '/api/access-auth/logout')
+        return request.method === 'POST';
+    return false;
+}
+function isPublicEndpoint(request) {
+    const pathname = new URL(request.url, 'http://agent-tower.local').pathname;
+    if (isPublicAccessAuthEndpoint(request))
+        return true;
+    if (pathname === '/api/health')
+        return true;
+    if (pathname === '/api/tunnel/bootstrap')
+        return true;
+    if (pathname === '/api/tunnel/health')
+        return true;
+    return false;
+}
+function isProtectedEndpoint(request) {
+    const pathname = new URL(request.url, 'http://agent-tower.local').pathname;
+    return pathname.startsWith('/api/') || pathname === '/api' || pathname.startsWith('/view/');
+}
+async function hasValidPreviewAccessToken(request) {
+    const parsed = parsePreviewPath(request.url);
+    if (!parsed?.previewToken)
+        return false;
+    return AccessAuthService.validatePreviewAccessToken(parsed.previewToken, parsed.workspaceId);
+}
+function requestOriginMatchesHost(request, value) {
+    let origin;
+    try {
+        origin = new URL(value);
+    }
+    catch {
+        return false;
+    }
+    const host = request.headers.host;
+    if (!host)
+        return false;
+    return origin.host.toLowerCase() === host.toLowerCase();
+}
+function hasValidSameOriginSignal(request) {
+    const origin = firstHeaderValue(request.headers.origin);
+    if (origin)
+        return requestOriginMatchesHost(request, origin);
+    const referer = firstHeaderValue(request.headers.referer);
+    if (referer)
+        return requestOriginMatchesHost(request, referer);
+    return true;
+}
+function shouldCheckCsrf(request) {
+    const method = request.method.toUpperCase();
+    return method !== 'GET' && method !== 'HEAD' && method !== 'OPTIONS';
+}
+function sendUnauthorized(reply) {
+    reply.code(401).send({
+        error: 'Unauthorized',
+        code: 'ACCESS_AUTH_REQUIRED',
+        message: 'Access password required',
+    });
+}
+function sendInvalidInternalToken(reply) {
+    reply.code(401).send({
+        error: 'Unauthorized',
+        code: 'ACCESS_AUTH_INVALID_INTERNAL_TOKEN',
+        message: 'Invalid internal token',
+    });
+}
+function sendCsrfRejected(reply) {
+    reply.code(403).send({
+        error: 'Forbidden',
+        code: 'ACCESS_AUTH_CSRF_REJECTED',
+        message: 'Request origin is not allowed',
+    });
+}
+export async function accessAuthHook(request, reply) {
+    if (!isProtectedEndpoint(request) || isPublicEndpoint(request))
+        return;
+    const internalToken = firstHeaderValue(request.headers[INTERNAL_API_TOKEN_HEADER]);
+    if (internalToken) {
+        if (validateInternalApiToken(internalToken))
+            return;
+        sendInvalidInternalToken(reply);
+        return;
+    }
+    if (!await AccessAuthService.isEnabled())
+        return;
+    if (await hasValidPreviewAccessToken(request))
+        return;
+    const cookieToken = request.cookies[AccessAuthService.cookieName]
+        ?? AccessAuthService.extractCookieFromHeader(request.headers.cookie);
+    if (!await AccessAuthService.validateSessionToken(cookieToken)) {
+        sendUnauthorized(reply);
+        return;
+    }
+    if (shouldCheckCsrf(request) && !hasValidSameOriginSignal(request)) {
+        sendCsrfRejected(reply);
+    }
+}
+//# sourceMappingURL=access-auth.js.map

package/dist/middleware/access-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-auth.js","sourceRoot":"","sources":["../../src/middleware/access-auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,EACL,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAE5D,SAAS,gBAAgB,CAAC,KAAoC;IAC5D,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACjD,CAAC;AAED,SAAS,0BAA0B,CAAC,OAAuB;IACzD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC,QAAQ,CAAC;IAC3E,IAAI,QAAQ,KAAK,yBAAyB;QAAE,OAAO,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC;IAC5E,IAAI,QAAQ,KAAK,wBAAwB;QAAE,OAAO,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC;IAC5E,IAAI,QAAQ,KAAK,yBAAyB;QAAE,OAAO,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC;IAC7E,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAuB;IAC/C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC,QAAQ,CAAC;IAC3E,IAAI,0BAA0B,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,QAAQ,KAAK,aAAa;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,QAAQ,KAAK,uBAAuB;QAAE,OAAO,IAAI,CAAC;IACtD,IAAI,QAAQ,KAAK,oBAAoB;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAuB;IAClD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC,QAAQ,CAAC;IAC3E,OAAO,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;AAC9F,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,OAAuB;IAC/D,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,YAAY;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,iBAAiB,CAAC,0BAA0B,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;AAC/F,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAuB,EAAE,KAAa;IACtE,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,OAAO,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC;AAC1D,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAuB;IACvD,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACxD,IAAI,MAAM;QAAE,OAAO,wBAAwB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAE7D,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1D,IAAI,OAAO;QAAE,OAAO,wBAAwB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAE/D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,OAAuB;IAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;IAC5C,OAAO,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,SAAS,CAAC;AACvE,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAmB;IAC3C,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;QACnB,KAAK,EAAE,cAAc;QACrB,IAAI,EAAE,sBAAsB;QAC5B,OAAO,EAAE,0BAA0B;KACpC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAmB;IACnD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;QACnB,KAAK,EAAE,cAAc;QACrB,IAAI,EAAE,oCAAoC;QAC1C,OAAO,EAAE,wBAAwB;KAClC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAmB;IAC3C,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;QACnB,KAAK,EAAE,WAAW;QAClB,IAAI,EAAE,2BAA2B;QACjC,OAAO,EAAE,+BAA+B;KACzC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAuB,EACvB,KAAmB;IAEnB,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,IAAI,gBAAgB,CAAC,OAAO,CAAC;QAAE,OAAO;IAEvE,MAAM,aAAa,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC,CAAC;IACnF,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,wBAAwB,CAAC,aAAa,CAAC;YAAE,OAAO;QACpD,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAChC,OAAO;IACT,CAAC;IAED,IAAI,CAAC,MAAM,iBAAiB,CAAC,SAAS,EAAE;QAAE,OAAO;IAEjD,IAAI,MAAM,0BAA0B,CAAC,OAAO,CAAC;QAAE,OAAO;IAEtD,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,UAAU,CAAC;WAC5D,iBAAiB,CAAC,uBAAuB,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAEvE,IAAI,CAAC,MAAM,iBAAiB,CAAC,oBAAoB,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/D,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACxB,OAAO;IACT,CAAC;IAED,IAAI,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,EAAE,CAAC;QACnE,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC"}

package/dist/routes/__tests__/files.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=files.test.d.ts.map

package/dist/routes/__tests__/files.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"files.test.d.ts","sourceRoot":"","sources":["../../../src/routes/__tests__/files.test.ts"],"names":[],"mappings":""}

package/dist/routes/__tests__/files.test.js

@@ -0,0 +1,101 @@
+import Fastify from 'fastify';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { filesRoutes } from '../files.js';
+let tempRoot = '';
+let workspaceDir = '';
+let dataDir = '';
+const originalDataDir = process.env.AGENT_TOWER_DATA_DIR;
+async function buildTestApp() {
+    const app = Fastify();
+    await app.register(filesRoutes);
+    return app;
+}
+describe('files routes', () => {
+    beforeEach(() => {
+        tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'agent-tower-files-route-'));
+        workspaceDir = path.join(tempRoot, 'workspace');
+        dataDir = path.join(tempRoot, 'data');
+        fs.mkdirSync(workspaceDir, { recursive: true });
+        fs.mkdirSync(dataDir, { recursive: true });
+        process.env.AGENT_TOWER_DATA_DIR = dataDir;
+    });
+    afterEach(() => {
+        if (originalDataDir === undefined) {
+            delete process.env.AGENT_TOWER_DATA_DIR;
+        }
+        else {
+            process.env.AGENT_TOWER_DATA_DIR = originalDataDir;
+        }
+        if (tempRoot) {
+            fs.rmSync(tempRoot, { recursive: true, force: true });
+        }
+    });
+    it('reads regular workspace files', async () => {
+        fs.writeFileSync(path.join(workspaceDir, 'hello.txt'), 'hello\n', 'utf-8');
+        const app = await buildTestApp();
+        try {
+            const response = await app.inject({
+                method: 'GET',
+                url: `/read?workingDir=${encodeURIComponent(workspaceDir)}&path=hello.txt`,
+            });
+            expect(response.statusCode).toBe(200);
+            expect(response.json()).toMatchObject({ content: 'hello\n' });
+        }
+        finally {
+            await app.close();
+        }
+    });
+    it('blocks browser-readable file APIs from reading the internal API token', async () => {
+        fs.writeFileSync(path.join(dataDir, 'internal-api-token'), 'secret-internal-token\n', 'utf-8');
+        const app = await buildTestApp();
+        try {
+            const response = await app.inject({
+                method: 'GET',
+                url: `/read?workingDir=${encodeURIComponent(dataDir)}&path=internal-api-token`,
+            });
+            expect(response.statusCode).toBe(403);
+            expect(response.json()).toMatchObject({ code: 'INTERNAL_PATH_FORBIDDEN' });
+            expect(response.body).not.toContain('secret-internal-token');
+        }
+        finally {
+            await app.close();
+        }
+    });
+    it('blocks workspace symlinks that point at internal Agent Tower files', async () => {
+        fs.writeFileSync(path.join(dataDir, 'internal-api-token'), 'secret-internal-token\n', 'utf-8');
+        fs.symlinkSync(path.join(dataDir, 'internal-api-token'), path.join(workspaceDir, 'linked-token'), 'file');
+        const app = await buildTestApp();
+        try {
+            const response = await app.inject({
+                method: 'GET',
+                url: `/read?workingDir=${encodeURIComponent(workspaceDir)}&path=linked-token`,
+            });
+            expect(response.statusCode).toBe(403);
+            expect(response.json()).toMatchObject({ code: 'INTERNAL_PATH_FORBIDDEN' });
+            expect(response.body).not.toContain('secret-internal-token');
+        }
+        finally {
+            await app.close();
+        }
+    });
+    it('blocks listing Agent Tower dataDir contents', async () => {
+        fs.writeFileSync(path.join(dataDir, 'data.db'), 'sqlite bytes', 'utf-8');
+        const app = await buildTestApp();
+        try {
+            const response = await app.inject({
+                method: 'GET',
+                url: `/tree?workingDir=${encodeURIComponent(dataDir)}&path=/`,
+            });
+            expect(response.statusCode).toBe(403);
+            expect(response.json()).toMatchObject({ code: 'INTERNAL_PATH_FORBIDDEN' });
+            expect(response.body).not.toContain('data.db');
+        }
+        finally {
+            await app.close();
+        }
+    });
+});
+//# sourceMappingURL=files.test.js.map

package/dist/routes/__tests__/files.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"files.test.js","sourceRoot":"","sources":["../../../src/routes/__tests__/files.test.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,IAAI,QAAQ,GAAG,EAAE,CAAC;AAClB,IAAI,YAAY,GAAG,EAAE,CAAC;AACtB,IAAI,OAAO,GAAG,EAAE,CAAC;AACjB,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;AAEzD,KAAK,UAAU,YAAY;IACzB,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,MAAM,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAChC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,UAAU,CAAC,GAAG,EAAE;QACd,QAAQ,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,0BAA0B,CAAC,CAAC,CAAC;QAC9E,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QAChD,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACtC,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,OAAO,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;QAC1C,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,eAAe,CAAC;QACrD,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACb,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAC3E,MAAM,GAAG,GAAG,MAAM,YAAY,EAAE,CAAC;QAEjC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;gBAChC,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,oBAAoB,kBAAkB,CAAC,YAAY,CAAC,iBAAiB;aAC3E,CAAC,CAAC;YAEH,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;QAChE,CAAC;gBAAS,CAAC;YACT,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,oBAAoB,CAAC,EAAE,yBAAyB,EAAE,OAAO,CAAC,CAAC;QAC/F,MAAM,GAAG,GAAG,MAAM,YAAY,EAAE,CAAC;QAEjC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;gBAChC,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,oBAAoB,kBAAkB,CAAC,OAAO,CAAC,0BAA0B;aAC/E,CAAC,CAAC;YAEH,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAC;YAC3E,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;QAC/D,CAAC;gBAAS,CAAC;YACT,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,oBAAoB,CAAC,EAAE,yBAAyB,EAAE,OAAO,CAAC,CAAC;QAC/F,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,oBAAoB,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC;QAC1G,MAAM,GAAG,GAAG,MAAM,YAAY,EAAE,CAAC;QAEjC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;gBAChC,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,oBAAoB,kBAAkB,CAAC,YAAY,CAAC,oBAAoB;aAC9E,CAAC,CAAC;YAEH,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAC;YAC3E,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;QAC/D,CAAC;gBAAS,CAAC;YACT,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC;QACzE,MAAM,GAAG,GAAG,MAAM,YAAY,EAAE,CAAC;QAEjC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;gBAChC,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,oBAAoB,kBAAkB,CAAC,OAAO,CAAC,SAAS;aAC9D,CAAC,CAAC;YAEH,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAC;YAC3E,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACjD,CAAC;gBAAS,CAAC;YACT,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/routes/__tests__/previews.integration.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=previews.integration.test.d.ts.map

package/dist/routes/__tests__/previews.integration.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"previews.integration.test.d.ts","sourceRoot":"","sources":["../../../src/routes/__tests__/previews.integration.test.ts"],"names":[],"mappings":""}

package/dist/routes/__tests__/previews.integration.test.js

@@ -0,0 +1,269 @@
+import { execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+import http from 'node:http';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import fastifyCookie from '@fastify/cookie';
+import Fastify from 'fastify';
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it } from 'vitest';
+import { INTERNAL_API_TOKEN_ENV, INTERNAL_API_TOKEN_HEADER, } from '../../utils/internal-api-token.js';
+const testDir = fs.mkdtempSync(path.join(os.tmpdir(), 'agent-tower-preview-routes-'));
+const dbPath = path.join(testDir, 'test.db');
+process.env.AGENT_TOWER_DATABASE_URL = `file:${dbPath}`;
+process.env.AGENT_TOWER_DATA_DIR = testDir;
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+const serverRoot = path.resolve(__dirname, '../../..');
+const schemaPath = path.join(serverRoot, 'prisma/schema.prisma');
+let prisma;
+let accessAuthHook;
+let previewRoutes;
+let AccessAuthService;
+async function createPreviewFixtureApp() {
+    const upgradeUrls = [];
+    const targetServer = http.createServer((request, response) => {
+        if (request.url === '/api/echo' && request.method === 'GET') {
+            response.setHeader('content-type', 'application/json');
+            response.end(JSON.stringify({ method: 'GET', ok: true }));
+            return;
+        }
+        if (request.url === '/api/echo' && request.method === 'POST') {
+            const chunks = [];
+            request.on('data', (chunk) => chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)));
+            request.on('end', () => {
+                response.setHeader('content-type', 'application/json');
+                response.end(JSON.stringify({
+                    method: 'POST',
+                    body: Buffer.concat(chunks).toString('utf8'),
+                    ok: true,
+                }));
+            });
+            return;
+        }
+        response.statusCode = 404;
+        response.end('not found');
+    });
+    targetServer.on('upgrade', (request, socket) => {
+        upgradeUrls.push(request.url ?? '');
+        socket.write('HTTP/1.1 101 Switching Protocols\r\nUpgrade: websocket\r\nConnection: Upgrade\r\n\r\n');
+        socket.end();
+    });
+    await new Promise((resolve) => targetServer.listen(0, '127.0.0.1', resolve));
+    const address = targetServer.address();
+    if (!address || typeof address === 'string') {
+        targetServer.close();
+        throw new Error('Failed to start preview fixture server');
+    }
+    const app = Fastify();
+    await app.register(fastifyCookie);
+    app.addHook('onRequest', accessAuthHook);
+    await app.register(previewRoutes);
+    await app.listen({ host: '127.0.0.1', port: 0 });
+    const appAddress = app.server.address();
+    if (!appAddress || typeof appAddress === 'string') {
+        await app.close();
+        targetServer.close();
+        throw new Error('Failed to start preview proxy fixture app');
+    }
+    return {
+        app,
+        appUrl: `http://127.0.0.1:${appAddress.port}`,
+        targetUrl: `http://127.0.0.1:${address.port}`,
+        upgradeUrls,
+        async close() {
+            await app.close();
+            await new Promise((resolve) => targetServer.close(() => resolve()));
+        },
+    };
+}
+async function requestWebSocketUpgrade(url, headers = {}) {
+    const parsed = new URL(url);
+    return new Promise((resolve, reject) => {
+        const request = http.request({
+            protocol: parsed.protocol,
+            hostname: parsed.hostname,
+            port: parsed.port,
+            method: 'GET',
+            path: `${parsed.pathname}${parsed.search}`,
+            headers: {
+                'connection': 'Upgrade',
+                'upgrade': 'websocket',
+                'sec-websocket-key': 'dGhlIHNhbXBsZSBub25jZQ==',
+                'sec-websocket-version': '13',
+                ...headers,
+            },
+        });
+        request.on('upgrade', (response, socket) => {
+            socket.destroy();
+            resolve({
+                statusCode: response.statusCode ?? 0,
+                statusMessage: response.statusMessage ?? '',
+            });
+        });
+        request.on('response', (response) => {
+            response.resume();
+            resolve({
+                statusCode: response.statusCode ?? 0,
+                statusMessage: response.statusMessage ?? '',
+            });
+        });
+        request.on('error', reject);
+        request.end();
+    });
+}
+async function createWorkspace(workspaceId, previewTarget) {
+    const project = await prisma.project.create({
+        data: {
+            name: `Preview project ${workspaceId}`,
+            repoPath: testDir,
+        },
+    });
+    const task = await prisma.task.create({
+        data: {
+            title: `Preview task ${workspaceId}`,
+            projectId: project.id,
+        },
+    });
+    await prisma.workspace.create({
+        data: {
+            id: workspaceId,
+            taskId: task.id,
+            branchName: `preview-${workspaceId}`,
+            worktreePath: testDir,
+            workingDir: testDir,
+            previewTarget,
+        },
+    });
+}
+describe('previewRoutes access auth integration', () => {
+    beforeAll(async () => {
+        execFileSync('pnpm', ['exec', 'prisma', 'db', 'push', '--skip-generate', `--schema=${schemaPath}`], {
+            cwd: serverRoot,
+            env: { ...process.env, AGENT_TOWER_DATABASE_URL: `file:${dbPath}` },
+            stdio: 'pipe',
+        });
+        const middlewareModule = await import('../../middleware/access-auth.js');
+        const routesModule = await import('../previews.js');
+        const serviceModule = await import('../../services/access-auth.service.js');
+        const utilsModule = await import('../../utils/index.js');
+        accessAuthHook = middlewareModule.accessAuthHook;
+        previewRoutes = routesModule.previewRoutes;
+        AccessAuthService = serviceModule.AccessAuthService;
+        prisma = utilsModule.prisma;
+    });
+    beforeEach(async () => {
+        await prisma.workspace.deleteMany();
+        await prisma.task.deleteMany();
+        await prisma.project.deleteMany();
+        await prisma.accessAuthSettings.deleteMany();
+        delete process.env[INTERNAL_API_TOKEN_ENV];
+        AccessAuthService.__test.resetLoginRateLimit();
+    });
+    afterEach(() => {
+        delete process.env[INTERNAL_API_TOKEN_ENV];
+    });
+    afterAll(async () => {
+        await prisma.$disconnect();
+        fs.rmSync(testDir, { recursive: true, force: true });
+    });
+    it('requires browser auth for legacy preview paths and allows tokenized preview API proxy requests', async () => {
+        await AccessAuthService.updateSettings({ enabled: true, newPassword: 'secret-pass' });
+        const fixture = await createPreviewFixtureApp();
+        try {
+            await createWorkspace('workspace-1', fixture.targetUrl);
+            const token = await AccessAuthService.createPreviewAccessToken('workspace-1');
+            const legacyResponse = await fixture.app.inject({
+                method: 'GET',
+                url: '/view/workspace-1/api/echo',
+            });
+            expect(legacyResponse.statusCode).toBe(401);
+            const getResponse = await fixture.app.inject({
+                method: 'GET',
+                url: `/view/workspace-1/__agent_tower_preview/${token}/api/echo`,
+            });
+            expect(getResponse.statusCode).toBe(200);
+            expect(getResponse.json()).toEqual({ method: 'GET', ok: true });
+            const postResponse = await fixture.app.inject({
+                method: 'POST',
+                url: `/view/workspace-1/__agent_tower_preview/${token}/api/echo`,
+                headers: {
+                    origin: 'null',
+                    'content-type': 'application/json',
+                    'x-custom-header': 'preview',
+                },
+                payload: { value: 42 },
+            });
+            expect(postResponse.statusCode).toBe(200);
+            expect(postResponse.json()).toEqual({
+                method: 'POST',
+                body: JSON.stringify({ value: 42 }),
+                ok: true,
+            });
+            expect(postResponse.headers['access-control-allow-origin']).toBe('*');
+            expect(postResponse.headers['access-control-allow-credentials']).toBeUndefined();
+            await expect(requestWebSocketUpgrade(`${fixture.appUrl}/view/workspace-1/__agent_tower_preview/${token}/ws`)).resolves.toMatchObject({ statusCode: 101 });
+            expect(fixture.upgradeUrls).toContain('/ws');
+        }
+        finally {
+            await fixture.close();
+        }
+    });
+    it('rejects preview websocket upgrades with invalid internal token even when preview token is valid', async () => {
+        await AccessAuthService.updateSettings({ enabled: true, newPassword: 'secret-pass' });
+        process.env[INTERNAL_API_TOKEN_ENV] = 'expected-internal-token';
+        const fixture = await createPreviewFixtureApp();
+        try {
+            await createWorkspace('workspace-preview-token', fixture.targetUrl);
+            const token = await AccessAuthService.createPreviewAccessToken('workspace-preview-token');
+            await expect(requestWebSocketUpgrade(`${fixture.appUrl}/view/workspace-preview-token/__agent_tower_preview/${token}/ws`, { [INTERNAL_API_TOKEN_HEADER]: 'wrong-internal-token' })).resolves.toMatchObject({
+                statusCode: 401,
+                statusMessage: 'Invalid Internal Token',
+            });
+            expect(fixture.upgradeUrls).not.toContain('/ws');
+            await expect(requestWebSocketUpgrade(`${fixture.appUrl}/view/workspace-preview-token/__agent_tower_preview/${token}/ws`)).resolves.toMatchObject({ statusCode: 101 });
+            expect(fixture.upgradeUrls).toContain('/ws');
+        }
+        finally {
+            await fixture.close();
+        }
+    });
+    it('rejects preview websocket upgrades with invalid internal token even when access auth cookie is valid', async () => {
+        await AccessAuthService.updateSettings({ enabled: true, newPassword: 'secret-pass' });
+        const login = await AccessAuthService.login('secret-pass');
+        expect(login.sessionToken).toBeTruthy();
+        process.env[INTERNAL_API_TOKEN_ENV] = 'expected-internal-token';
+        const fixture = await createPreviewFixtureApp();
+        try {
+            await createWorkspace('workspace-cookie', fixture.targetUrl);
+            const cookie = `${AccessAuthService.cookieName}=${encodeURIComponent(login.sessionToken ?? '')}`;
+            await expect(requestWebSocketUpgrade(`${fixture.appUrl}/view/workspace-cookie/ws`, {
+                [INTERNAL_API_TOKEN_HEADER]: 'wrong-internal-token',
+                cookie,
+            })).resolves.toMatchObject({
+                statusCode: 401,
+                statusMessage: 'Invalid Internal Token',
+            });
+            expect(fixture.upgradeUrls).not.toContain('/ws');
+            await expect(requestWebSocketUpgrade(`${fixture.appUrl}/view/workspace-cookie/ws`, { cookie })).resolves.toMatchObject({ statusCode: 101 });
+            expect(fixture.upgradeUrls).toContain('/ws');
+        }
+        finally {
+            await fixture.close();
+        }
+    });
+    it('accepts preview websocket upgrades with a valid internal token without browser auth', async () => {
+        await AccessAuthService.updateSettings({ enabled: true, newPassword: 'secret-pass' });
+        process.env[INTERNAL_API_TOKEN_ENV] = 'expected-internal-token';
+        const fixture = await createPreviewFixtureApp();
+        try {
+            await createWorkspace('workspace-internal-token', fixture.targetUrl);
+            await expect(requestWebSocketUpgrade(`${fixture.appUrl}/view/workspace-internal-token/ws`, { [INTERNAL_API_TOKEN_HEADER]: 'expected-internal-token' })).resolves.toMatchObject({ statusCode: 101 });
+            expect(fixture.upgradeUrls).toContain('/ws');
+        }
+        finally {
+            await fixture.close();
+        }
+    });
+});
+//# sourceMappingURL=previews.integration.test.js.map

package/dist/routes/__tests__/previews.integration.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"previews.integration.test.js","sourceRoot":"","sources":["../../../src/routes/__tests__/previews.integration.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,aAAa,MAAM,iBAAiB,CAAC;AAC5C,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE1F,OAAO,EACL,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,mCAAmC,CAAC;AAE3C,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,6BAA6B,CAAC,CAAC,CAAC;AACtF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AAC7C,OAAO,CAAC,GAAG,CAAC,wBAAwB,GAAG,QAAQ,MAAM,EAAE,CAAC;AACxD,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,OAAO,CAAC;AAE3C,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;AAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;AACvD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,sBAAsB,CAAC,CAAC;AAEjE,IAAI,MAAoB,CAAC;AACzB,IAAI,cAA+E,CAAC;AACpF,IAAI,aAA4D,CAAC;AACjE,IAAI,iBAA2F,CAAC;AAEhG,KAAK,UAAU,uBAAuB;IACpC,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QAC3D,IAAI,OAAO,CAAC,GAAG,KAAK,WAAW,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAC5D,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;YACvD,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,IAAI,OAAO,CAAC,GAAG,KAAK,WAAW,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC7D,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAChG,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACrB,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;gBACvD,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;oBAC1B,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAC5C,EAAE,EAAE,IAAI;iBACT,CAAC,CAAC,CAAC;YACN,CAAC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;QAC1B,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IACH,YAAY,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC7C,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;QACpC,MAAM,CAAC,KAAK,CAAC,uFAAuF,CAAC,CAAC;QACtG,MAAM,CAAC,GAAG,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IACnF,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC;IACvC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,YAAY,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,MAAM,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IAClC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IACzC,MAAM,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IAClC,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;IACjD,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;IACxC,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;QAClB,YAAY,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IAED,OAAO;QACL,GAAG;QACH,MAAM,EAAE,oBAAoB,UAAU,CAAC,IAAI,EAAE;QAC7C,SAAS,EAAE,oBAAoB,OAAO,CAAC,IAAI,EAAE;QAC7C,WAAW;QACX,KAAK,CAAC,KAAK;YACT,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC5E,CAAC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,GAAW,EACX,UAAkC,EAAE;IAEpC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAE5B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;YAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE;YAC1C,OAAO,EAAE;gBACP,YAAY,EAAE,SAAS;gBACvB,SAAS,EAAE,WAAW;gBACtB,mBAAmB,EAAE,0BAA0B;gBAC/C,uBAAuB,EAAE,IAAI;gBAC7B,GAAG,OAAO;aACX;SACF,CAAC,CAAC;QAEH,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;YACzC,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO,CAAC;gBACN,UAAU,EAAE,QAAQ,CAAC,UAAU,IAAI,CAAC;gBACpC,aAAa,EAAE,QAAQ,CAAC,aAAa,IAAI,EAAE;aAC5C,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,EAAE;YAClC,QAAQ,CAAC,MAAM,EAAE,CAAC;YAClB,OAAO,CAAC;gBACN,UAAU,EAAE,QAAQ,CAAC,UAAU,IAAI,CAAC;gBACpC,aAAa,EAAE,QAAQ,CAAC,aAAa,IAAI,EAAE;aAC5C,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5B,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,WAAmB,EAAE,aAAqB;IACvE,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QAC1C,IAAI,EAAE;YACJ,IAAI,EAAE,mBAAmB,WAAW,EAAE;YACtC,QAAQ,EAAE,OAAO;SAClB;KACF,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;QACpC,IAAI,EAAE;YACJ,KAAK,EAAE,gBAAgB,WAAW,EAAE;YACpC,SAAS,EAAE,OAAO,CAAC,EAAE;SACtB;KACF,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC;QAC5B,IAAI,EAAE;YACJ,EAAE,EAAE,WAAW;YACf,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,UAAU,EAAE,WAAW,WAAW,EAAE;YACpC,YAAY,EAAE,OAAO;YACrB,UAAU,EAAE,OAAO;YACnB,aAAa;SACd;KACF,CAAC,CAAC;AACL,CAAC;AAED,QAAQ,CAAC,uCAAuC,EAAE,GAAG,EAAE;IACrD,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,YAAY,CACV,MAAM,EACN,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,YAAY,UAAU,EAAE,CAAC,EAC7E;YACE,GAAG,EAAE,UAAU;YACf,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,wBAAwB,EAAE,QAAQ,MAAM,EAAE,EAAE;YACnE,KAAK,EAAE,MAAM;SACd,CACF,CAAC;QAEF,MAAM,gBAAgB,GAAG,MAAM,MAAM,CAAC,iCAAiC,CAAC,CAAC;QACzE,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACpD,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,uCAAuC,CAAC,CAAC;QAC5E,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QACzD,cAAc,GAAG,gBAAgB,CAAC,cAAc,CAAC;QACjD,aAAa,GAAG,YAAY,CAAC,aAAa,CAAC;QAC3C,iBAAiB,GAAG,aAAa,CAAC,iBAAiB,CAAC;QACpD,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,MAAM,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC;QACpC,MAAM,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QAC/B,MAAM,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QAClC,MAAM,MAAM,CAAC,kBAAkB,CAAC,UAAU,EAAE,CAAC;QAC7C,OAAO,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QAC3C,iBAAiB,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,OAAO,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,KAAK,IAAI,EAAE;QAClB,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;QAC3B,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gGAAgG,EAAE,KAAK,IAAI,EAAE;QAC9G,MAAM,iBAAiB,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,CAAC;QACtF,MAAM,OAAO,GAAG,MAAM,uBAAuB,EAAE,CAAC;QAEhD,IAAI,CAAC;YACH,MAAM,eAAe,CAAC,aAAa,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;YACxD,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,wBAAwB,CAAC,aAAa,CAAC,CAAC;YAE9E,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;gBAC9C,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,4BAA4B;aAClC,CAAC,CAAC;YACH,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAE5C,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;gBAC3C,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,2CAA2C,KAAK,WAAW;aACjE,CAAC,CAAC;YACH,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACzC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAEhE,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;gBAC5C,MAAM,EAAE,MAAM;gBACd,GAAG,EAAE,2CAA2C,KAAK,WAAW;gBAChE,OAAO,EAAE;oBACP,MAAM,EAAE,MAAM;oBACd,cAAc,EAAE,kBAAkB;oBAClC,iBAAiB,EAAE,SAAS;iBAC7B;gBACD,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;aACvB,CAAC,CAAC;YACH,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC1C,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC;gBAClC,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;gBACnC,EAAE,EAAE,IAAI;aACT,CAAC,CAAC;YACH,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtE,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,kCAAkC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;YAEjF,MAAM,MAAM,CAAC,uBAAuB,CAClC,GAAG,OAAO,CAAC,MAAM,2CAA2C,KAAK,KAAK,CACvE,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/C,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/C,CAAC;gBAAS,CAAC;YACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iGAAiG,EAAE,KAAK,IAAI,EAAE;QAC/G,MAAM,iBAAiB,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,CAAC;QACtF,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,GAAG,yBAAyB,CAAC;QAChE,MAAM,OAAO,GAAG,MAAM,uBAAuB,EAAE,CAAC;QAEhD,IAAI,CAAC;YACH,MAAM,eAAe,CAAC,yBAAyB,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;YACpE,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,CAAC;YAE1F,MAAM,MAAM,CAAC,uBAAuB,CAClC,GAAG,OAAO,CAAC,MAAM,uDAAuD,KAAK,KAAK,EAClF,EAAE,CAAC,yBAAyB,CAAC,EAAE,sBAAsB,EAAE,CACxD,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC;gBACxB,UAAU,EAAE,GAAG;gBACf,aAAa,EAAE,wBAAwB;aACxC,CAAC,CAAC;YACH,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAEjD,MAAM,MAAM,CAAC,uBAAuB,CAClC,GAAG,OAAO,CAAC,MAAM,uDAAuD,KAAK,KAAK,CACnF,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/C,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/C,CAAC;gBAAS,CAAC;YACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sGAAsG,EAAE,KAAK,IAAI,EAAE;QACpH,MAAM,iBAAiB,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,CAAC;QACtF,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAC3D,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,GAAG,yBAAyB,CAAC;QAChE,MAAM,OAAO,GAAG,MAAM,uBAAuB,EAAE,CAAC;QAEhD,IAAI,CAAC;YACH,MAAM,eAAe,CAAC,kBAAkB,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;YAC7D,MAAM,MAAM,GAAG,GAAG,iBAAiB,CAAC,UAAU,IAAI,kBAAkB,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,CAAC;YAEjG,MAAM,MAAM,CAAC,uBAAuB,CAClC,GAAG,OAAO,CAAC,MAAM,2BAA2B,EAC5C;gBACE,CAAC,yBAAyB,CAAC,EAAE,sBAAsB;gBACnD,MAAM;aACP,CACF,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC;gBACxB,UAAU,EAAE,GAAG;gBACf,aAAa,EAAE,wBAAwB;aACxC,CAAC,CAAC;YACH,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAEjD,MAAM,MAAM,CAAC,uBAAuB,CAClC,GAAG,OAAO,CAAC,MAAM,2BAA2B,EAC5C,EAAE,MAAM,EAAE,CACX,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/C,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/C,CAAC;gBAAS,CAAC;YACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qFAAqF,EAAE,KAAK,IAAI,EAAE;QACnG,MAAM,iBAAiB,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,CAAC;QACtF,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,GAAG,yBAAyB,CAAC;QAChE,MAAM,OAAO,GAAG,MAAM,uBAAuB,EAAE,CAAC;QAEhD,IAAI,CAAC;YACH,MAAM,eAAe,CAAC,0BAA0B,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;YAErE,MAAM,MAAM,CAAC,uBAAuB,CAClC,GAAG,OAAO,CAAC,MAAM,mCAAmC,EACpD,EAAE,CAAC,yBAAyB,CAAC,EAAE,yBAAyB,EAAE,CAC3D,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/C,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/C,CAAC;gBAAS,CAAC;YACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}