botmux 3.14.0 → 3.16.0

package/dist/dashboard/events-sse.d.ts

@@ -0,0 +1,60 @@
+/**
+ * P1-8：`/events` 管理 SSE 的身份寿命绑定。
+ *
+ * SSE 的门禁只在建立连接的那一刻跑过一次，之后帧是**服务端主动推**的，请求门禁
+ * 再也没有机会说话。于是登出 / token rotate / 平台解绑之后，旧连接照旧收帧——不
+ * 只是「多看了会话板一会儿」，而是会收到 **吊销之后新产生的** 数据：会话行里的
+ * `riffAccessUrl` 是 Riff 沙箱的写凭据，rotate 的本意就是让旧链接失效，结果旧
+ * SSE 把 rotate 之后新签的写凭据继续送给上一任持有者。
+ *
+ * 这里给每条流两层保护：
+ *  1. **推送前复核**：每帧写出前重查 authSession 是否仍有效，失效就结束响应，
+ *    这一帧不写。哪怕主动关闭那条路径漏掉了某个入口（新增的吊销来源），也不会
+ *    把新数据送出去。
+ *  2. **主动关闭**：建流时登记进 authSession→连接索引，吊销时遍历 destroy，
+ *    不等下一帧、不等心跳。
+ *
+ * 匿名（publicReadOnly）连接没有认证会话，不属于任何身份，行为保持原样。
+ */
+import type { ServerResponse } from 'node:http';
+/**
+ * 这条流的受众口径，必须与 REST 门禁同源：
+ *  - `management`：本机管理 cookie（legacy owner），能力等同 `/api/*` 全集。
+ *  - `workbench`：只有工作台能力的身份（飞书 H5 会话、平台注入角色，owner 也算）
+ *    —— 走 `decideWorkbenchH5Auth` 窄门禁，能力表里**没有** `/api/schedules`。
+ *  - `anonymous`：`publicReadOnly` 下的无身份访客，走既有的脱敏投影。
+ */
+export type DashboardEventAudience = 'management' | 'workbench' | 'anonymous';
+/**
+ * P1-14 姊妹项：`/events` 的推送必须服从与 REST 同一份能力表。
+ *
+ * `GET /api/schedules` 对 Workbench-only 身份是明确的 401（排程行带 `prompt`
+ * 业务指令与 `workingDir` 仓库/客户路径，`schedule.fired` 还带 `error` 原文），
+ * 但 SSE 的门禁只在建流那一刻跑过一次，之后帧是服务端主动推的——于是同一份数据
+ * 换个管子照样出去了。这里在写出前按受众整类丢弃 `schedule.*`：REST 说不行的，
+ * SSE 也一帧不给。
+ *
+ * 匿名 public-read 不变（`/api/schedules` 在 publicReadOnly 允许表里，帧由
+ * dashboard.ts 做同款脱敏）；management 不变。
+ */
+export declare function dashboardEventVisibleTo(event: string, audience: DashboardEventAudience): boolean;
+export interface DashboardEventsStreamOptions {
+    res: ServerResponse;
+    /** 本流归属的认证会话；匿名 public-read 连接为 null。 */
+    authSessionId: string | null;
+    /** 本流的受众能力口径。必填：漏传就等于默默放宽，所以不给缺省值。 */
+    audience: DashboardEventAudience;
+    /** 认证会话是否仍然有效（H5 会话表 / 活跃 token / 平台绑定的统一口径）。 */
+    isAuthSessionLive: (authSessionId: string) => boolean;
+    /** 登记进 authSession→长连接索引，返回注销闭包。 */
+    bind?: (authSessionId: string, close: () => void) => () => void;
+}
+export interface DashboardEventsStream {
+    /** 写一帧；身份已失效或流已关闭时返回 false 且不写任何字节。 */
+    write(event: string, data: unknown): boolean;
+    /** 客户端断开 / 服务端吊销后的清理（幂等）。 */
+    dispose(): void;
+    readonly closed: boolean;
+}
+export declare function createDashboardEventsStream(options: DashboardEventsStreamOptions): DashboardEventsStream;
+//# sourceMappingURL=events-sse.d.ts.map

package/dist/dashboard/events-sse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"events-sse.d.ts","sourceRoot":"","sources":["../../src/dashboard/events-sse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEhD;;;;;;GAMG;AACH,MAAM,MAAM,sBAAsB,GAAG,YAAY,GAAG,WAAW,GAAG,WAAW,CAAC;AAE9E;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,sBAAsB,GAAG,OAAO,CAGhG;AAED,MAAM,WAAW,4BAA4B;IAC3C,GAAG,EAAE,cAAc,CAAC;IACpB,yCAAyC;IACzC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,sCAAsC;IACtC,QAAQ,EAAE,sBAAsB,CAAC;IACjC,iDAAiD;IACjD,iBAAiB,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC;IACtD,oCAAoC;IACpC,IAAI,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,IAAI,KAAK,MAAM,IAAI,CAAC;CACjE;AAED,MAAM,WAAW,qBAAqB;IACpC,uCAAuC;IACvC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;IAC7C,6BAA6B;IAC7B,OAAO,IAAI,IAAI,CAAC;IAChB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,4BAA4B,GAAG,qBAAqB,CAyCxG"}

package/dist/dashboard/events-sse.js

@@ -0,0 +1,63 @@
+/**
+ * P1-14 姊妹项：`/events` 的推送必须服从与 REST 同一份能力表。
+ *
+ * `GET /api/schedules` 对 Workbench-only 身份是明确的 401（排程行带 `prompt`
+ * 业务指令与 `workingDir` 仓库/客户路径，`schedule.fired` 还带 `error` 原文），
+ * 但 SSE 的门禁只在建流那一刻跑过一次，之后帧是服务端主动推的——于是同一份数据
+ * 换个管子照样出去了。这里在写出前按受众整类丢弃 `schedule.*`：REST 说不行的，
+ * SSE 也一帧不给。
+ *
+ * 匿名 public-read 不变（`/api/schedules` 在 publicReadOnly 允许表里，帧由
+ * dashboard.ts 做同款脱敏）；management 不变。
+ */
+export function dashboardEventVisibleTo(event, audience) {
+    if (audience !== 'workbench')
+        return true;
+    return !(event === 'schedule' || event.startsWith('schedule.'));
+}
+export function createDashboardEventsStream(options) {
+    let closed = false;
+    let unbind;
+    const dispose = () => {
+        if (closed)
+            return;
+        closed = true;
+        unbind?.();
+        unbind = undefined;
+    };
+    const revoke = () => {
+        if (closed)
+            return;
+        dispose();
+        // end() 而不是 destroy()：给浏览器一个干净的流结束，EventSource 会按
+        // `retry:` 重连，重连那一跳会被正常的 401 门禁挡住并弹登录态。
+        try {
+            options.res.end();
+        }
+        catch { /* already torn down */ }
+    };
+    if (options.authSessionId && options.bind) {
+        unbind = options.bind(options.authSessionId, revoke);
+    }
+    return {
+        get closed() { return closed; },
+        dispose,
+        write(event, data) {
+            if (closed || options.res.writableEnded)
+                return false;
+            const authSessionId = options.authSessionId;
+            // 先复核身份寿命：即使这一帧本来就要被能力过滤掉，也要借它发现流已经该关了。
+            if (authSessionId && !options.isAuthSessionLive(authSessionId)) {
+                revoke();
+                return false;
+            }
+            // 能力过滤放在写出前、且放在 stream 内部而不是调用方：调用方可以忘，
+            // 这里忘不了。
+            if (!dashboardEventVisibleTo(event, options.audience))
+                return false;
+            options.res.write(`event: ${event}\ndata: ${JSON.stringify(data)}\n\n`);
+            return true;
+        },
+    };
+}
+//# sourceMappingURL=events-sse.js.map

package/dist/dashboard/events-sse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"events-sse.js","sourceRoot":"","sources":["../../src/dashboard/events-sse.ts"],"names":[],"mappings":"AA6BA;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAa,EAAE,QAAgC;IACrF,IAAI,QAAQ,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,CAAC,CAAC,KAAK,KAAK,UAAU,IAAI,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;AAClE,CAAC;AAsBD,MAAM,UAAU,2BAA2B,CAAC,OAAqC;IAC/E,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,MAAgC,CAAC;IAErC,MAAM,OAAO,GAAG,GAAS,EAAE;QACzB,IAAI,MAAM;YAAE,OAAO;QACnB,MAAM,GAAG,IAAI,CAAC;QACd,MAAM,EAAE,EAAE,CAAC;QACX,MAAM,GAAG,SAAS,CAAC;IACrB,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,GAAS,EAAE;QACxB,IAAI,MAAM;YAAE,OAAO;QACnB,OAAO,EAAE,CAAC;QACV,kDAAkD;QAClD,wCAAwC;QACxC,IAAI,CAAC;YAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,uBAAuB,CAAC,CAAC;IAC9D,CAAC,CAAC;IAEF,IAAI,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QAC1C,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACvD,CAAC;IAED,OAAO;QACL,IAAI,MAAM,KAAK,OAAO,MAAM,CAAC,CAAC,CAAC;QAC/B,OAAO;QACP,KAAK,CAAC,KAAK,EAAE,IAAI;YACf,IAAI,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa;gBAAE,OAAO,KAAK,CAAC;YACtD,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;YAC5C,wCAAwC;YACxC,IAAI,aAAa,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC/D,MAAM,EAAE,CAAC;gBACT,OAAO,KAAK,CAAC;YACf,CAAC;YACD,wCAAwC;YACxC,SAAS;YACT,IAAI,CAAC,uBAAuB,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC;gBAAE,OAAO,KAAK,CAAC;YACpE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,WAAW,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACxE,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/dashboard/h5-auth.d.ts

@@ -0,0 +1,256 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { Brand } from '../im/lark/lark-hosts.js';
+import { type ControlAuditSink } from './control-audit.js';
+export declare const DASHBOARD_SESSION_COOKIE = "botmux_dashboard_session";
+export declare const DEFAULT_DASHBOARD_SESSION_TTL_MS: number;
+export declare const DASHBOARD_H5_CLIENT_TIMEOUT_MS = 8000;
+/** Upper bound for the configured reverse-proxy hop count. Deployments chain a
+ *  handful of proxies at most; a typo of `99` must not turn into "trust the
+ *  whole client-supplied chain". */
+export declare const DASHBOARD_H5_MAX_TRUSTED_PROXY_HOPS = 8;
+export interface DashboardH5AuthConfig {
+    enabled: boolean;
+    brand: Brand;
+    appId: string;
+    appSecret: string;
+    allowedOpenIds: readonly string[];
+    entryPath: string;
+    sessionTtlMs: number;
+    secureCookies: boolean;
+    /**
+     * How many reverse-proxy hops sit in front of this dashboard and may be
+     * trusted to have written `x-forwarded-for`. `0` (the default, and the only
+     * safe value for a directly-exposed dashboard) means the header is ignored
+     * outright and the socket peer address is the client. Required rather than
+     * optional so every construction site states its proxy posture.
+     */
+    trustedProxyHops: number;
+}
+export interface DashboardAuthIdentity {
+    kind: 'feishu-h5';
+    userId: string;
+    authSessionId: string;
+    issuedAt: number;
+    expiresAt: number;
+}
+export interface FeishuH5CodeExchanger {
+    exchange(code: string, signal?: AbortSignal): Promise<{
+        openId: string;
+    }>;
+}
+export type DashboardSessionEndReason = 'expired' | 'logout';
+export interface DashboardSessionStoreOptions {
+    ttlMs?: number;
+    now?: () => number;
+    randomToken?: () => string;
+    setTimer?: typeof setTimeout;
+    clearTimer?: typeof clearTimeout;
+}
+/**
+ * In-memory fixed-expiry Dashboard sessions. Only SHA-256 token digests are
+ * retained; the opaque browser cookie value exists only during Set-Cookie and
+ * request parsing. A dashboard restart intentionally signs everyone out.
+ */
+export declare class DashboardSessionStore {
+    private readonly sessionsByHash;
+    private readonly hashesById;
+    private readonly listeners;
+    private readonly ttlMs;
+    private readonly now;
+    private readonly randomToken;
+    private readonly schedule;
+    private readonly cancel;
+    constructor(opts?: DashboardSessionStoreOptions);
+    create(userId: string): {
+        token: string;
+        identity: DashboardAuthIdentity;
+    };
+    resolveToken(token: string | undefined): DashboardAuthIdentity | null;
+    revokeToken(token: string | undefined): boolean;
+    revokeAuthSession(authSessionId: string, reason?: DashboardSessionEndReason): boolean;
+    /** Whether this auth session is still alive (present and unexpired). Used as
+     *  the revocation check for capabilities minted under the session (P1-5); a
+     *  due-but-unswept session is expired inline so the answer is authoritative. */
+    liveAuthSession(authSessionId: string): boolean;
+    sweepExpired(): number;
+    onEnd(listener: (identity: DashboardAuthIdentity, reason: DashboardSessionEndReason) => void): () => void;
+    private expireHash;
+    private endHash;
+    private publicIdentity;
+}
+export declare function validOpenId(value: string): boolean;
+export declare function parseNamedCookie(header: string | undefined, name: string): string | undefined;
+export declare function dashboardSessionCookie(token: string, ttlMs: number, secure?: boolean): string;
+export declare function clearDashboardSessionCookie(secure?: boolean): string;
+export declare function resolveDashboardH5AuthConfig(env?: NodeJS.ProcessEnv): DashboardH5AuthConfig;
+export interface FeishuH5CodeExchangerOptions {
+    fetchImpl?: typeof fetch;
+    timeoutMs?: number;
+}
+/**
+ * Feishu H5 `requestAccess` / `requestAuthCode` compatible exchange. Tokens
+ * from Feishu stay in local variables long enough to fetch `open_id` and are
+ * never cached, logged, returned, or copied into the Dashboard session.
+ */
+export declare function createFeishuH5CodeExchanger(config: Pick<DashboardH5AuthConfig, 'brand' | 'appId' | 'appSecret'>, opts?: FeishuH5CodeExchangerOptions): FeishuH5CodeExchanger;
+export declare const DASHBOARD_H5_EXCHANGE_WINDOW_MS = 60000;
+export declare const DASHBOARD_H5_EXCHANGE_MAX_PER_IP_PER_WINDOW = 10;
+export declare const DASHBOARD_H5_EXCHANGE_MAX_CONCURRENT = 4;
+/** Ceiling for the endpoint as a whole, across every source address. The
+ *  per-IP window alone bounds one client; this bounds the endpoint when the
+ *  attacker has many source addresses (or one trusted proxy in front of many
+ *  forged client addresses). */
+export declare const DASHBOARD_H5_EXCHANGE_MAX_GLOBAL_PER_WINDOW = 60;
+/** Hard cap on tracked per-IP buckets. Reaching it evicts the least recently
+ *  used bucket (O(1)); it never degrades into a per-request full-table scan. */
+export declare const DASHBOARD_H5_EXCHANGE_MAX_TRACKED_IPS = 4096;
+/**
+ * Rate-limit bucket key for the public exchange endpoint, resolved under a
+ * TRUSTED-PROXY discipline (`proxy-addr` semantics, zero dependencies).
+ *
+ * `x-forwarded-for` is client-supplied text: anyone can send it, and each
+ * proxy only appends. Trusting the leftmost hop therefore hands an attacker an
+ * unlimited supply of distinct bucket keys — a per-IP limiter you can opt out
+ * of by typing a new IP, plus an attacker-driven tracking table.
+ *
+ * So the chain is read from the end WE control: `[socket peer, ...forwarded
+ * reversed]`, and `trustedProxyHops` says how many of those leading entries
+ * were written by infrastructure we trust. The first entry past them is the
+ * client. With the default `0` the header is never consulted at all; with `1`
+ * only the rightmost `x-forwarded-for` entry counts — the one the single
+ * trusted proxy wrote itself — so any value the client prepended sits beyond
+ * the trusted window and can never become a bucket key. A shorter-than-
+ * configured chain falls back to the furthest address actually present, which
+ * is at worst the direct peer.
+ *
+ * The value is only ever an opaque bucket key: it grants nothing.
+ */
+export declare function dashboardH5ClientIp(req: IncomingMessage, trustedProxyHops?: number): string;
+export interface DashboardH5ExchangeGateOptions {
+    now?: () => number;
+    windowMs?: number;
+    maxPerIpPerWindow?: number;
+    maxGlobalPerWindow?: number;
+    maxConcurrent?: number;
+    maxTrackedIps?: number;
+    maxSpentCodes?: number;
+    spentCodeTtlMs?: number;
+    pruneIntervalMs?: number;
+}
+export type H5ExchangeAdmission = {
+    ok: true;
+} | {
+    ok: false;
+    retryAfterMs: number;
+};
+/**
+ * In-process brakes for the public, unauthenticated H5 exchange endpoint.
+ * One exchange can cost up to three open-platform requests, so several
+ * independent limits apply (LocateRateLimiter-style, zero dependencies).
+ *
+ * The admission half (`admit`/`prune`) is deliberately generic and is reused by
+ * the other pre-auth public surface, `GET /workbench-ticket/<ticket>` (see
+ * dashboard/workbench-ticket.ts), with its own budgets; only the code-specific
+ * halves (`share`/`markSpent`) are exchange-only:
+ *
+ *  - per-IP sliding window (`admit`) — only admitted hits consume slots, so
+ *    a refused burst cannot lock a NAT'd office out forever;
+ *  - global sliding window (`admit`) — the same endpoint-wide ceiling in
+ *    requests-per-window, so "many source addresses" is not a way around the
+ *    per-IP budget. It is checked AFTER the per-IP budget and consumed only on
+ *    admission, so one noisy client can spend at most its own per-IP quota out
+ *    of the shared pool. Implemented as a fixed-size ring of admission
+ *    timestamps: exact sliding-window semantics with an honest Retry-After, in
+ *    O(1) per request and O(cap) memory;
+ *  - bounded IP tracking — the table never exceeds `maxTrackedIps`; a new
+ *    bucket past the cap evicts the least recently used one in O(1). Pruning
+ *    idle buckets (`prune`) is a memory tidy-up on a timer, NOT the bound, so
+ *    a saturated table can never turn into a full-table scan per request;
+ *  - single-flight per code plus a global in-flight cap (`share`) —
+ *    concurrent duplicates of one code join the same upstream flight, and
+ *    distinct codes beyond the cap are fast-rejected rather than queued so
+ *    spam cannot stack pending exchanges on the dashboard event loop;
+ *  - spent-code memory (`markSpent`/`isSpent`) — a code that already minted a
+ *    session is refused outright afterwards, so "one-time" holds for a
+ *    sequential replay too, not just for the concurrent window. Only the code
+ *    DIGEST is kept (never the code, never the session token), with a TTL and
+ *    its own bounded LRU.
+ *
+ * The clock is injectable for tests.
+ */
+export declare class DashboardH5ExchangeGate {
+    /** Insertion-ordered ⇒ iteration starts at the least recently used bucket. */
+    private readonly hitsByIp;
+    private readonly inFlightByKey;
+    /** code digest → expiry. Uniform TTL ⇒ insertion order is also expiry order. */
+    private readonly spentByKey;
+    private readonly globalHits;
+    private globalNext;
+    private globalFilled;
+    private readonly now;
+    private readonly windowMs;
+    private readonly maxPerIpPerWindow;
+    private readonly maxTrackedIps;
+    private readonly maxSpentCodes;
+    private readonly spentCodeTtlMs;
+    private readonly maxConcurrent;
+    private readonly pruneIntervalMs;
+    private lastPruneAt;
+    private sweeps;
+    constructor(opts?: DashboardH5ExchangeGateOptions);
+    /**
+     * Per-IP then endpoint-wide sliding-window admission. Refusals carry an
+     * honest Retry-After and consume nothing — neither budget, and (for an
+     * unknown IP) not a tracking-table slot either.
+     */
+    admit(ip: string): H5ExchangeAdmission;
+    /** `null` when the endpoint-wide window still has room. */
+    private globalRetryAfterMs;
+    /** Store a bucket at the young end of the LRU, evicting the oldest if the
+     *  table is full. Constant time: `delete` + `set` re-inserts, and at most one
+     *  entry is dropped per new key. */
+    private remember;
+    /** Remember that this code digest already minted a session. */
+    markSpent(key: string): void;
+    /** Whether this code digest already minted a session (within the TTL). */
+    isSpent(key: string): boolean;
+    /**
+     * Single-flight + global concurrency. A key already in flight joins the
+     * existing promise (never re-hits the open platform, exempt from the cap);
+     * a new key beyond `maxConcurrent` is refused for a fast 429.
+     */
+    share<T>(key: string, start: () => Promise<T>): {
+        ok: true;
+        result: Promise<T>;
+    } | {
+        ok: false;
+        retryAfterMs: number;
+    };
+    /** Drop IP buckets and spent-code digests that have left their window. The
+     *  one full-table pass in this class — on a timer, never per request. */
+    prune(): void;
+    trackedIpCount(): number;
+    inFlightCount(): number;
+    spentCodeCount(): number;
+    /** Full-table sweeps performed so far. Diagnostic: this must stay flat as
+     *  request volume grows, otherwise admission has become O(table). */
+    sweepCount(): number;
+}
+export interface DashboardH5AuthControllerOptions {
+    config: DashboardH5AuthConfig;
+    sessions: DashboardSessionStore;
+    exchanger?: FeishuH5CodeExchanger;
+    exchangeGate?: DashboardH5ExchangeGate;
+    audit: ControlAuditSink;
+}
+export interface DashboardH5AuthController {
+    entryPath: string;
+    exchangePath: string;
+    sessionPath: string;
+    logoutPath: string;
+    resolve(req: IncomingMessage): DashboardAuthIdentity | null;
+    handle(req: IncomingMessage, res: ServerResponse, url: URL): Promise<boolean>;
+}
+export declare function safeDashboardH5ReturnTo(value: string | null | undefined): string;
+export declare function createDashboardH5AuthController(opts: DashboardH5AuthControllerOptions): DashboardH5AuthController;
+//# sourceMappingURL=h5-auth.d.ts.map

package/dist/dashboard/h5-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"h5-auth.d.ts","sourceRoot":"","sources":["../../src/dashboard/h5-auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAEtD,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,oBAAoB,CAAC;AAG5B,eAAO,MAAM,wBAAwB,6BAA6B,CAAC;AACnE,eAAO,MAAM,gCAAgC,QAAc,CAAC;AAC5D,eAAO,MAAM,8BAA8B,OAAQ,CAAC;AAIpD;;oCAEoC;AACpC,eAAO,MAAM,mCAAmC,IAAI,CAAC;AAErD,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,KAAK,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;IACvB;;;;;;OAMG;IACH,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC3E;AAED,MAAM,MAAM,yBAAyB,GAAG,SAAS,GAAG,QAAQ,CAAC;AAO7D,MAAM,WAAW,4BAA4B;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,MAAM,CAAC;IAC3B,QAAQ,CAAC,EAAE,OAAO,UAAU,CAAC;IAC7B,UAAU,CAAC,EAAE,OAAO,YAAY,CAAC;CAClC;AAgBD;;;;GAIG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA6C;IAC5E,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA6B;IACxD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA2F;IACrH,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAe;IAC3C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoB;IAC7C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsB;gBAEjC,IAAI,GAAE,4BAAiC;IASnD,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,qBAAqB,CAAA;KAAE;IAqB1E,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,qBAAqB,GAAG,IAAI;IAYrE,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO;IAK/C,iBAAiB,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,GAAE,yBAAoC,GAAG,OAAO;IAK/F;;oFAEgF;IAChF,eAAe,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO;IAY/C,YAAY,IAAI,MAAM;IAQtB,KAAK,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,qBAAqB,EAAE,MAAM,EAAE,yBAAyB,KAAK,IAAI,GAAG,MAAM,IAAI;IAKzG,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,OAAO;IAaf,OAAO,CAAC,cAAc;CASvB;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAElD;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAQ7F;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,UAAQ,GAAG,MAAM,CAG3F;AAED,wBAAgB,2BAA2B,CAAC,MAAM,UAAQ,GAAG,MAAM,CAElE;AAED,wBAAgB,4BAA4B,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,qBAAqB,CA4BxG;AAED,MAAM,WAAW,4BAA4B;IAC3C,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAQD;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,IAAI,CAAC,qBAAqB,EAAE,OAAO,GAAG,OAAO,GAAG,WAAW,CAAC,EACpE,IAAI,GAAE,4BAAiC,GACtC,qBAAqB,CA8DvB;AAED,eAAO,MAAM,+BAA+B,QAAS,CAAC;AACtD,eAAO,MAAM,2CAA2C,KAAK,CAAC;AAC9D,eAAO,MAAM,oCAAoC,IAAI,CAAC;AACtD;;;gCAGgC;AAChC,eAAO,MAAM,2CAA2C,KAAK,CAAC;AAC9D;gFACgF;AAChF,eAAO,MAAM,qCAAqC,OAAQ,CAAC;AAY3D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,eAAe,EAAE,gBAAgB,SAAI,GAAG,MAAM,CAetF;AAED,MAAM,WAAW,8BAA8B;IAC7C,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,MAAM,mBAAmB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC;AAErF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,qBAAa,uBAAuB;IAClC,8EAA8E;IAC9E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+B;IACxD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAuC;IACrE,gFAAgF;IAChF,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA6B;IACxD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAW;IACtC,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;IAC3C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,MAAM,CAAK;gBAEP,IAAI,GAAE,8BAAmC;IAcrD;;;;OAIG;IACH,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,mBAAmB;IA2BtC,2DAA2D;IAC3D,OAAO,CAAC,kBAAkB;IAO1B;;wCAEoC;IACpC,OAAO,CAAC,QAAQ;IAQhB,+DAA+D;IAC/D,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAQ5B,0EAA0E;IAC1E,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAU7B;;;;OAIG;IACH,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACzC;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA;KAAE,GAChC;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE;IAevC;6EACyE;IACzE,KAAK,IAAI,IAAI;IAeb,cAAc,IAAI,MAAM;IACxB,aAAa,IAAI,MAAM;IACvB,cAAc,IAAI,MAAM;IACxB;yEACqE;IACrE,UAAU,IAAI,MAAM;CACrB;AAED,MAAM,WAAW,gCAAgC;IAC/C,MAAM,EAAE,qBAAqB,CAAC;IAC9B,QAAQ,EAAE,qBAAqB,CAAC;IAChC,SAAS,CAAC,EAAE,qBAAqB,CAAC;IAClC,YAAY,CAAC,EAAE,uBAAuB,CAAC;IACvC,KAAK,EAAE,gBAAgB,CAAC;CACzB;AAED,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,GAAG,EAAE,eAAe,GAAG,qBAAqB,GAAG,IAAI,CAAC;IAC5D,MAAM,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC/E;AAoCD,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAchF;AAmDD,wBAAgB,+BAA+B,CAAC,IAAI,EAAE,gCAAgC,GAAG,yBAAyB,CA4MjH"}