iobroker.time-tracker 0.2.0

package/build/lib/services/auth.js

@@ -0,0 +1,381 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var auth_exports = {};
+__export(auth_exports, {
+  checkPasswordPolicy: () => checkPasswordPolicy,
+  createAuthService: () => createAuthService,
+  hashPassword: () => hashPassword,
+  verifyPassword: () => verifyPassword
+});
+module.exports = __toCommonJS(auth_exports);
+var import_node_crypto = require("node:crypto");
+var import_errors = require("../errors");
+var import_audit = require("../db/repositories/audit");
+const DEFAULT_HASH = {
+  cost: 16384,
+  blockSize: 8,
+  parallelization: 1,
+  keyLength: 64
+};
+const HASH_PREFIX = "scrypt";
+function hashPassword(password, options = {}) {
+  var _a, _b, _c, _d;
+  const cost = (_a = options.cost) != null ? _a : DEFAULT_HASH.cost;
+  const blockSize = (_b = options.blockSize) != null ? _b : DEFAULT_HASH.blockSize;
+  const parallelization = (_c = options.parallelization) != null ? _c : DEFAULT_HASH.parallelization;
+  const keyLength = (_d = options.keyLength) != null ? _d : DEFAULT_HASH.keyLength;
+  const salt = (0, import_node_crypto.randomBytes)(16);
+  const derived = (0, import_node_crypto.scryptSync)(password, salt, keyLength, {
+    N: cost,
+    r: blockSize,
+    p: parallelization,
+    maxmem: 256 * cost * blockSize
+  });
+  return [
+    HASH_PREFIX,
+    cost,
+    blockSize,
+    parallelization,
+    keyLength,
+    salt.toString("base64"),
+    derived.toString("base64")
+  ].join("$");
+}
+function verifyPassword(password, stored) {
+  const parts = (stored != null ? stored : "").split("$");
+  if (parts.length !== 7 || parts[0] !== HASH_PREFIX) {
+    return false;
+  }
+  const cost = Number(parts[1]);
+  const blockSize = Number(parts[2]);
+  const parallelization = Number(parts[3]);
+  const keyLength = Number(parts[4]);
+  if (![cost, blockSize, parallelization, keyLength].every((value) => Number.isInteger(value) && value > 0)) {
+    return false;
+  }
+  let expected;
+  try {
+    expected = Buffer.from(parts[6], "base64");
+  } catch {
+    return false;
+  }
+  if (expected.length !== keyLength) {
+    return false;
+  }
+  const derived = (0, import_node_crypto.scryptSync)(password, Buffer.from(parts[5], "base64"), keyLength, {
+    N: cost,
+    r: blockSize,
+    p: parallelization,
+    maxmem: 256 * cost * blockSize
+  });
+  return (0, import_node_crypto.timingSafeEqual)(derived, expected);
+}
+function checkPasswordPolicy(password, policy = {}) {
+  var _a, _b, _c;
+  const minLength = (_a = policy.minLength) != null ? _a : 10;
+  if (password.length < minLength) {
+    return "too_short";
+  }
+  if (((_b = policy.requireLetter) != null ? _b : true) && !/[A-Za-z]/.test(password)) {
+    return "no_letter";
+  }
+  if (((_c = policy.requireDigit) != null ? _c : true) && !/\d/.test(password)) {
+    return "no_digit";
+  }
+  return null;
+}
+function createAuthService(deps) {
+  var _a, _b, _c, _d;
+  const { db, users, settings, secret } = deps;
+  const defaultTtl = (_a = deps.defaultTtlMinutes) != null ? _a : 720;
+  const maxFailed = (_b = deps.maxFailedAttempts) != null ? _b : 10;
+  const lockoutSeconds = ((_c = deps.lockoutMinutes) != null ? _c : 15) * 60;
+  const policy = (_d = deps.policy) != null ? _d : {};
+  const failures = /* @__PURE__ */ new Map();
+  const selectSession = db.prepare(
+    `SELECT id, user_id AS userId, created_at AS createdAt, expires_at AS expiresAt,
+		        user_agent AS userAgent, ip, revoked
+		 FROM sessions WHERE id = ?`
+  );
+  const selectUserSessions = db.prepare(
+    `SELECT id, user_id AS userId, created_at AS createdAt, expires_at AS expiresAt,
+		        user_agent AS userAgent, ip, revoked
+		 FROM sessions WHERE user_id = ? AND revoked = 0 AND expires_at > ?
+		 ORDER BY created_at DESC`
+  );
+  const insertSession = db.prepare(
+    `INSERT INTO sessions (id, user_id, created_at, expires_at, user_agent, ip, revoked)
+		 VALUES (?, ?, ?, ?, ?, ?, 0)`
+  );
+  const revokeSession = db.prepare("UPDATE sessions SET revoked = 1 WHERE id = ?");
+  const revokeUserSessions = db.prepare("UPDATE sessions SET revoked = 1 WHERE user_id = ? AND revoked = 0");
+  const extendSession = db.prepare("UPDATE sessions SET expires_at = ? WHERE id = ?");
+  const purgeSessions = db.prepare("DELETE FROM sessions WHERE expires_at <= ? OR revoked = 1");
+  const hashToken = (token) => (0, import_node_crypto.createHash)("sha256").update(token).digest("hex");
+  const ttlSeconds = () => Math.max(1, Math.round(settings.getNumber("session_ttl_minutes", defaultTtl))) * 60;
+  const publicUser = (user) => ({
+    id: user.id,
+    login: user.login,
+    displayName: user.displayName,
+    locale: user.locale,
+    timezone: user.timezone,
+    mustChangePw: user.mustChangePw
+  });
+  const readSession = (sessionId) => {
+    const row = selectSession.get(sessionId);
+    return row ? { ...row, revoked: row.revoked !== 0 } : null;
+  };
+  return {
+    login(input) {
+      var _a2, _b2;
+      const now = (_a2 = input.now) != null ? _a2 : Math.floor(Date.now() / 1e3);
+      const key = input.login.trim().toLowerCase();
+      const previous = failures.get(key);
+      if (previous && previous.blockedUntil > now) {
+        (0, import_audit.writeAuditLog)(db, {
+          atUtc: now,
+          action: "auth.login_locked",
+          entity: "user",
+          entityId: null,
+          detail: { login: input.login.trim(), blockedUntil: previous.blockedUntil },
+          ip: (_b2 = input.ip) != null ? _b2 : null
+        });
+        return { ok: false, error: "locked_out" };
+      }
+      const registerFailure = (reason, userId) => {
+        var _a3;
+        const expiredLock = previous !== void 0 && previous.blockedUntil > 0 && previous.blockedUntil <= now;
+        const count = previous === void 0 || expiredLock ? 1 : previous.count + 1;
+        const blockedUntil = count >= maxFailed ? now + lockoutSeconds : 0;
+        failures.set(key, { count, blockedUntil });
+        (0, import_audit.writeAuditLog)(db, {
+          atUtc: now,
+          action: "auth.login_failed",
+          entity: "user",
+          entityId: userId,
+          detail: { login: input.login.trim(), reason, attempts: count, blockedUntil },
+          ip: (_a3 = input.ip) != null ? _a3 : null
+        });
+        return { ok: false, error: "invalid_credentials" };
+      };
+      const user = users.findByLogin(input.login);
+      if (!user) {
+        return registerFailure("unknown_user", null);
+      }
+      if (!user.isActive) {
+        return registerFailure("inactive_user", user.id);
+      }
+      if (!user.passwordHash) {
+        return registerFailure("no_password", user.id);
+      }
+      if (!verifyPassword(input.password, user.passwordHash)) {
+        return registerFailure("wrong_password", user.id);
+      }
+      failures.delete(key);
+      const authenticated = user;
+      const token = (0, import_node_crypto.randomBytes)(32).toString("base64url");
+      const sessionId = hashToken(token);
+      const expiresAt = now + ttlSeconds();
+      const run = db.transaction(() => {
+        var _a3, _b3, _c2, _d2;
+        insertSession.run(sessionId, user.id, now, expiresAt, (_a3 = input.userAgent) != null ? _a3 : null, (_b3 = input.ip) != null ? _b3 : null);
+        (0, import_audit.writeAuditLog)(db, {
+          atUtc: now,
+          actorId: user.id,
+          action: "auth.login",
+          entity: "session",
+          entityId: sessionId,
+          detail: { login: user.login, userAgent: (_c2 = input.userAgent) != null ? _c2 : null },
+          ip: (_d2 = input.ip) != null ? _d2 : null
+        });
+      });
+      run();
+      users.recordLogin(user.id, now);
+      return { ok: true, token, csrfToken: this.csrfToken(token), expiresAt, user: publicUser(authenticated) };
+    },
+    logout(input) {
+      var _a2, _b2, _c2;
+      const token = (_b2 = (_a2 = input.token) == null ? void 0 : _a2.trim()) != null ? _b2 : "";
+      if (!token) {
+        return false;
+      }
+      const sessionId = hashToken(token);
+      const session = readSession(sessionId);
+      if (!session || session.revoked) {
+        return false;
+      }
+      const now = (_c2 = input.now) != null ? _c2 : Math.floor(Date.now() / 1e3);
+      const run = db.transaction(() => {
+        var _a3, _b3;
+        revokeSession.run(sessionId);
+        (0, import_audit.writeAuditLog)(db, {
+          atUtc: now,
+          actorId: (_a3 = input.actorId) != null ? _a3 : session.userId,
+          action: "auth.logout",
+          entity: "session",
+          entityId: sessionId,
+          detail: { userId: session.userId },
+          ip: (_b3 = input.ip) != null ? _b3 : null
+        });
+      });
+      run();
+      return true;
+    },
+    authenticate(input) {
+      var _a2, _b2, _c2;
+      const now = (_a2 = input.now) != null ? _a2 : Math.floor(Date.now() / 1e3);
+      const token = (_c2 = (_b2 = input.token) == null ? void 0 : _b2.trim()) != null ? _c2 : "";
+      if (!token) {
+        return { ok: false, error: "no_session" };
+      }
+      const session = readSession(hashToken(token));
+      if (!session || session.revoked) {
+        return { ok: false, error: "no_session" };
+      }
+      if (session.expiresAt <= now) {
+        return { ok: false, error: "session_expired" };
+      }
+      const user = users.findById(session.userId);
+      if (!user || !user.isActive) {
+        return { ok: false, error: "user_inactive" };
+      }
+      const permissions = users.permissions(user.id);
+      if (input.permission && !permissions.includes(input.permission)) {
+        return { ok: false, error: "permission_denied" };
+      }
+      const ttl = ttlSeconds();
+      if (session.expiresAt - now < ttl / 2) {
+        const next = now + ttl;
+        extendSession.run(next, session.id);
+        session.expiresAt = next;
+      }
+      return {
+        ok: true,
+        context: {
+          sessionId: session.id,
+          expiresAt: session.expiresAt,
+          user: publicUser(user),
+          permissions
+        }
+      };
+    },
+    revokeSessions(input) {
+      var _a2;
+      const now = (_a2 = input.now) != null ? _a2 : Math.floor(Date.now() / 1e3);
+      let revoked = 0;
+      const run = db.transaction(() => {
+        revoked = revokeUserSessions.run(input.userId).changes;
+        if (revoked > 0) {
+          (0, import_audit.writeAuditLog)(db, {
+            atUtc: now,
+            actorId: input.actorId,
+            action: "auth.revoke_all",
+            entity: "user",
+            entityId: input.userId,
+            detail: { sessions: revoked }
+          });
+        }
+      });
+      run();
+      return revoked;
+    },
+    sessions(userId, now) {
+      const reference = now != null ? now : Math.floor(Date.now() / 1e3);
+      const rows = selectUserSessions.all(userId, reference);
+      return rows.map((row) => ({ ...row, revoked: row.revoked !== 0 }));
+    },
+    purge(now) {
+      return purgeSessions.run(now != null ? now : Math.floor(Date.now() / 1e3)).changes;
+    },
+    rotateIfDue(input) {
+      var _a2, _b2;
+      const now = (_a2 = input.now) != null ? _a2 : Math.floor(Date.now() / 1e3);
+      const previousId = hashToken((_b2 = input.token) != null ? _b2 : "");
+      const session = readSession(previousId);
+      if (!session || session.revoked || session.expiresAt <= now) {
+        return null;
+      }
+      const threshold = Math.max(900, Math.floor(ttlSeconds() / 2));
+      if (now - session.createdAt < threshold) {
+        return null;
+      }
+      const token = (0, import_node_crypto.randomBytes)(32).toString("base64url");
+      const expiresAt = now + ttlSeconds();
+      db.transaction(() => {
+        revokeSession.run(previousId);
+        insertSession.run(hashToken(token), session.userId, now, expiresAt, session.userAgent, session.ip);
+        (0, import_audit.writeAuditLog)(db, {
+          atUtc: now,
+          action: "auth.session_rotated",
+          entity: "user",
+          entityId: session.userId,
+          detail: { session: hashToken(token) },
+          ip: session.ip
+        });
+      })();
+      return { token, expiresAt };
+    },
+    csrfToken(token) {
+      return (0, import_node_crypto.createHmac)("sha256", secret).update(token).digest("base64url");
+    },
+    verifyCsrf(input) {
+      var _a2, _b2;
+      const expected = this.csrfToken((_a2 = input.token) != null ? _a2 : "");
+      const provided = (_b2 = input.csrfToken) != null ? _b2 : "";
+      if (expected.length !== provided.length) {
+        return false;
+      }
+      return (0, import_node_crypto.timingSafeEqual)(Buffer.from(expected), Buffer.from(provided));
+    },
+    setPassword(input) {
+      var _a2, _b2, _c2, _d2;
+      const violated = checkPasswordPolicy(input.password, policy);
+      if (violated) {
+        throw new import_errors.ValidationError(`password does not fulfil the policy (${violated})`);
+      }
+      const now = (_a2 = input.now) != null ? _a2 : Math.floor(Date.now() / 1e3);
+      const mustChangePw = (_b2 = input.mustChangePw) != null ? _b2 : false;
+      users.update({
+        id: input.userId,
+        patch: { passwordHash: hashPassword(input.password), mustChangePw },
+        reason: mustChangePw ? "password reset by an administrator" : "password changed",
+        actorId: input.actorId,
+        actorIp: (_c2 = input.actorIp) != null ? _c2 : null,
+        now
+      });
+      (0, import_audit.writeAuditLog)(db, {
+        atUtc: now,
+        actorId: input.actorId,
+        action: "auth.password_set",
+        entity: "user",
+        entityId: input.userId,
+        detail: { mustChangePw },
+        ip: (_d2 = input.actorIp) != null ? _d2 : null
+      });
+    }
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  checkPasswordPolicy,
+  createAuthService,
+  hashPassword,
+  verifyPassword
+});
+//# sourceMappingURL=auth.js.map

package/build/lib/services/auth.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/lib/services/auth.ts"],
+  "sourcesContent": ["/**\n * Authentication and session service.\n *\n * Passwords are stored as **scrypt** hashes (params are part of the stored string, so the cost can be raised\n * later without invalidating existing hashes). Sessions use opaque random tokens; only the SHA-256 hash of a\n * token is stored, so a leaked database never exposes usable session tokens.\n *\n * Every login, failed attempt, lockout and logout is audited. Failed attempts are counted per login name and\n * lock the account for a while (process-local, which is what a single adapter instance needs).\n */\n\nimport { createHash, createHmac, randomBytes, scryptSync, timingSafeEqual } from \"node:crypto\";\nimport type { Db } from \"../db/database\";\nimport type { SettingsRepository } from \"../db/repositories/settings\";\nimport type { UserRecord, UsersRepository } from \"../db/repositories/users\";\nimport { ValidationError } from \"../errors\";\nimport { writeAuditLog } from \"../db/repositories/audit\";\n\n/** Cost parameters of a stored password hash. */\nexport interface PasswordHashOptions {\n\t/** CPU/memory cost (`N`) */\n\tcost?: number;\n\t/** Block size (`r`) */\n\tblockSize?: number;\n\t/** Parallelisation (`p`) */\n\tparallelization?: number;\n\t/** Length of the derived key in bytes */\n\tkeyLength?: number;\n}\n\n/** Rules a new password has to fulfil. */\nexport interface PasswordPolicy {\n\t/** Minimum length, default 10 */\n\tminLength?: number;\n\t/** Require at least one digit, default true */\n\trequireDigit?: boolean;\n\t/** Require at least one letter, default true */\n\trequireLetter?: boolean;\n}\n\n/** A user as it may leave the server (never contains hashes). */\nexport interface PublicUser {\n\t/** Primary key */\n\tid: number;\n\t/** Login name */\n\tlogin: string;\n\t/** Shown name */\n\tdisplayName: string;\n\t/** Preferred language */\n\tlocale: string;\n\t/** IANA time zone */\n\ttimezone: string;\n\t/** True while the user has to set a new password */\n\tmustChangePw: boolean;\n}\n\n/** Input for a login. */\nexport interface LoginInput {\n\t/** Login name (case insensitive) */\n\tlogin: string;\n\t/** Plain password */\n\tpassword: string;\n\t/** Browser/device information, stored with the session */\n\tuserAgent?: string | null;\n\t/** Client IP address */\n\tip?: string | null;\n\t/** Instant of the login, defaults to now */\n\tnow?: number;\n}\n\n/** Result of a login attempt. */\nexport type LoginResult =\n\t| {\n\t\t\t/** Login succeeded */\n\t\t\tok: true;\n\t\t\t/** Session token (only returned once, never stored in plain form) */\n\t\t\ttoken: string;\n\t\t\t/** Token that has to be sent back for state changing requests */\n\t\t\tcsrfToken: string;\n\t\t\t/** Instant the session expires, UTC epoch seconds */\n\t\t\texpiresAt: number;\n\t\t\t/** Authenticated user without hashes */\n\t\t\tuser: PublicUser;\n\t  }\n\t| {\n\t\t\t/** Login failed */\n\t\t\tok: false;\n\t\t\t/** Reason, always generic towards the client */\n\t\t\terror: \"invalid_credentials\" | \"locked_out\";\n\t  };\n\n/** Reason why a request was not authenticated. */\nexport type AuthError = \"no_session\" | \"session_expired\" | \"user_inactive\" | \"permission_denied\";\n\n/** Result of authenticating a request. */\nexport type AuthResult =\n\t| {\n\t\t\t/** Session is valid */\n\t\t\tok: true;\n\t\t\t/** Authenticated context */\n\t\t\tcontext: AuthContext;\n\t  }\n\t| {\n\t\t\t/** Session is not usable */\n\t\t\tok: false;\n\t\t\t/** Reason of the rejection */\n\t\t\terror: AuthError;\n\t  };\n\n/** Everything a request handler needs to know about the caller. */\nexport interface AuthContext {\n\t/** Session id (hash of the token) */\n\tsessionId: string;\n\t/** Instant the session expires */\n\texpiresAt: number;\n\t/** Authenticated user without hashes */\n\tuser: PublicUser;\n\t/** Effective permission keys of the user */\n\tpermissions: string[];\n}\n\n/** A session as shown to an administrator (without the token). */\nexport interface SessionInfo {\n\t/** Session id (hash of the token) */\n\tid: string;\n\t/** Owner of the session */\n\tuserId: number;\n\t/** Instant of creation */\n\tcreatedAt: number;\n\t/** Instant of expiry */\n\texpiresAt: number;\n\t/** Browser/device information */\n\tuserAgent: string | null;\n\t/** Client IP address */\n\tip: string | null;\n\t/** True when the session was ended */\n\trevoked: boolean;\n}\n\n/** Data sources of the authentication service. */\nexport interface AuthDeps {\n\t/** Open database handle */\n\tdb: Db;\n\t/** User storage */\n\tusers: UsersRepository;\n\t/** Instance settings (session lifetime) */\n\tsettings: SettingsRepository;\n\t/** Secret used to sign CSRF tokens */\n\tsecret: string;\n\t/** Session lifetime in minutes when the setting is missing (default 720) */\n\tdefaultTtlMinutes?: number;\n\t/** Failed attempts before a login is locked (default 10) */\n\tmaxFailedAttempts?: number;\n\t/** Minutes a login stays locked (default 15) */\n\tlockoutMinutes?: number;\n\t/** Policy for new passwords */\n\tpolicy?: PasswordPolicy;\n}\n\n/** Authentication operations. */\nexport interface AuthService {\n\t/** Verifies a login and opens a session */\n\tlogin(input: LoginInput): LoginResult;\n\t/** Ends a session */\n\tlogout(input: { token: string; actorId?: number | null; ip?: string | null; now?: number }): boolean;\n\t/** Checks a session token, optionally requiring a permission */\n\tauthenticate(input: { token: string; permission?: string; now?: number }): AuthResult;\n\t/**\n\t * Replaces the token of a session that has been in use for a while (specification 4.10: rotation).\n\t *\n\t * @returns the new token and its expiry, or `null` while the session is too young\n\t */\n\trotateIfDue(input: { token: string; now?: number }): { token: string; expiresAt: number } | null;\n\t/** Ends all sessions of a user (e.g. after a password change) */\n\trevokeSessions(input: { userId: number; actorId: number; now?: number }): number;\n\t/** Active sessions of a user */\n\tsessions(userId: number, now?: number): SessionInfo[];\n\t/** Deletes sessions that expired before the given instant */\n\tpurge(now?: number): number;\n\t/** Token that protects state changing requests of a session */\n\tcsrfToken(token: string): string;\n\t/** Checks a CSRF token */\n\tverifyCsrf(input: { token: string; csrfToken: string }): boolean;\n\t/** Sets a new password (hashed) after checking the policy */\n\tsetPassword(input: {\n\t\tuserId: number;\n\t\tpassword: string;\n\t\tmustChangePw?: boolean;\n\t\tactorId: number;\n\t\tactorIp?: string | null;\n\t\tnow?: number;\n\t}): void;\n}\n\n/** Default cost parameters (interactive login, ~50 ms on a modern machine). */\nconst DEFAULT_HASH: Required<PasswordHashOptions> = {\n\tcost: 16384,\n\tblockSize: 8,\n\tparallelization: 1,\n\tkeyLength: 64,\n};\n\nconst HASH_PREFIX = \"scrypt\";\n\n/**\n * Hashes a password with scrypt.\n *\n * @param password - plain password\n * @param options - cost parameters\n * @returns stored representation `scrypt$N$r$p$keyLength$salt$hash`\n */\nexport function hashPassword(password: string, options: PasswordHashOptions = {}): string {\n\tconst cost = options.cost ?? DEFAULT_HASH.cost;\n\tconst blockSize = options.blockSize ?? DEFAULT_HASH.blockSize;\n\tconst parallelization = options.parallelization ?? DEFAULT_HASH.parallelization;\n\tconst keyLength = options.keyLength ?? DEFAULT_HASH.keyLength;\n\tconst salt = randomBytes(16);\n\tconst derived = scryptSync(password, salt, keyLength, {\n\t\tN: cost,\n\t\tr: blockSize,\n\t\tp: parallelization,\n\t\tmaxmem: 256 * cost * blockSize,\n\t});\n\n\treturn [\n\t\tHASH_PREFIX,\n\t\tcost,\n\t\tblockSize,\n\t\tparallelization,\n\t\tkeyLength,\n\t\tsalt.toString(\"base64\"),\n\t\tderived.toString(\"base64\"),\n\t].join(\"$\");\n}\n\n/**\n * Verifies a password against a stored hash.\n *\n * Malformed or unsupported hashes (e.g. an empty column for imported users) never match.\n *\n * @param password - plain password\n * @param stored - stored representation\n * @returns true when the password matches\n */\nexport function verifyPassword(password: string, stored: string): boolean {\n\tconst parts = (stored ?? \"\").split(\"$\");\n\tif (parts.length !== 7 || parts[0] !== HASH_PREFIX) {\n\t\treturn false;\n\t}\n\tconst cost = Number(parts[1]);\n\tconst blockSize = Number(parts[2]);\n\tconst parallelization = Number(parts[3]);\n\tconst keyLength = Number(parts[4]);\n\tif (![cost, blockSize, parallelization, keyLength].every(value => Number.isInteger(value) && value > 0)) {\n\t\treturn false;\n\t}\n\n\tlet expected: Buffer;\n\ttry {\n\t\texpected = Buffer.from(parts[6], \"base64\");\n\t} catch {\n\t\treturn false;\n\t}\n\tif (expected.length !== keyLength) {\n\t\treturn false;\n\t}\n\n\tconst derived = scryptSync(password, Buffer.from(parts[5], \"base64\"), keyLength, {\n\t\tN: cost,\n\t\tr: blockSize,\n\t\tp: parallelization,\n\t\tmaxmem: 256 * cost * blockSize,\n\t});\n\treturn timingSafeEqual(derived, expected);\n}\n\n/**\n * Checks a new password against the policy.\n *\n * @param password - plain password\n * @param policy - rules to apply\n * @returns the violated rule or `null`\n */\nexport function checkPasswordPolicy(password: string, policy: PasswordPolicy = {}): string | null {\n\tconst minLength = policy.minLength ?? 10;\n\tif (password.length < minLength) {\n\t\treturn \"too_short\";\n\t}\n\tif ((policy.requireLetter ?? true) && !/[A-Za-z]/.test(password)) {\n\t\treturn \"no_letter\";\n\t}\n\tif ((policy.requireDigit ?? true) && !/\\d/.test(password)) {\n\t\treturn \"no_digit\";\n\t}\n\treturn null;\n}\n\n/**\n * Creates the authentication service.\n *\n * @param deps - data sources and policy\n * @returns service instance\n */\nexport function createAuthService(deps: AuthDeps): AuthService {\n\tconst { db, users, settings, secret } = deps;\n\tconst defaultTtl = deps.defaultTtlMinutes ?? 720;\n\tconst maxFailed = deps.maxFailedAttempts ?? 10;\n\tconst lockoutSeconds = (deps.lockoutMinutes ?? 15) * 60;\n\tconst policy = deps.policy ?? {};\n\n\t/** Failed attempts per login name (process-local, which is enough for one adapter instance). */\n\tconst failures = new Map<string, { count: number; blockedUntil: number }>();\n\n\tconst selectSession = db.prepare(\n\t\t`SELECT id, user_id AS userId, created_at AS createdAt, expires_at AS expiresAt,\n\t\t        user_agent AS userAgent, ip, revoked\n\t\t FROM sessions WHERE id = ?`,\n\t);\n\tconst selectUserSessions = db.prepare(\n\t\t`SELECT id, user_id AS userId, created_at AS createdAt, expires_at AS expiresAt,\n\t\t        user_agent AS userAgent, ip, revoked\n\t\t FROM sessions WHERE user_id = ? AND revoked = 0 AND expires_at > ?\n\t\t ORDER BY created_at DESC`,\n\t);\n\tconst insertSession = db.prepare(\n\t\t`INSERT INTO sessions (id, user_id, created_at, expires_at, user_agent, ip, revoked)\n\t\t VALUES (?, ?, ?, ?, ?, ?, 0)`,\n\t);\n\tconst revokeSession = db.prepare(\"UPDATE sessions SET revoked = 1 WHERE id = ?\");\n\tconst revokeUserSessions = db.prepare(\"UPDATE sessions SET revoked = 1 WHERE user_id = ? AND revoked = 0\");\n\tconst extendSession = db.prepare(\"UPDATE sessions SET expires_at = ? WHERE id = ?\");\n\tconst purgeSessions = db.prepare(\"DELETE FROM sessions WHERE expires_at <= ? OR revoked = 1\");\n\n\t/**\n\t * Only the hash of a token is stored, so a database leak cannot be replayed.\n\t *\n\t * @param token - session token as it was handed to the client\n\t * @returns SHA-256 hash used as session id\n\t */\n\tconst hashToken = (token: string): string => createHash(\"sha256\").update(token).digest(\"hex\");\n\n\tconst ttlSeconds = (): number =>\n\t\tMath.max(1, Math.round(settings.getNumber(\"session_ttl_minutes\", defaultTtl))) * 60;\n\n\tconst publicUser = (user: UserRecord): PublicUser => ({\n\t\tid: user.id,\n\t\tlogin: user.login,\n\t\tdisplayName: user.displayName,\n\t\tlocale: user.locale,\n\t\ttimezone: user.timezone,\n\t\tmustChangePw: user.mustChangePw,\n\t});\n\n\tconst readSession = (sessionId: string): SessionInfo | null => {\n\t\tconst row = selectSession.get(sessionId) as (Omit<SessionInfo, \"revoked\"> & { revoked: number }) | undefined;\n\t\treturn row ? { ...row, revoked: row.revoked !== 0 } : null;\n\t};\n\n\treturn {\n\t\tlogin(input: LoginInput): LoginResult {\n\t\t\tconst now = input.now ?? Math.floor(Date.now() / 1000);\n\t\t\tconst key = input.login.trim().toLowerCase();\n\t\t\tconst previous = failures.get(key);\n\n\t\t\tif (previous && previous.blockedUntil > now) {\n\t\t\t\twriteAuditLog(db, {\n\t\t\t\t\tatUtc: now,\n\t\t\t\t\taction: \"auth.login_locked\",\n\t\t\t\t\tentity: \"user\",\n\t\t\t\t\tentityId: null,\n\t\t\t\t\tdetail: { login: input.login.trim(), blockedUntil: previous.blockedUntil },\n\t\t\t\t\tip: input.ip ?? null,\n\t\t\t\t});\n\t\t\t\treturn { ok: false, error: \"locked_out\" };\n\t\t\t}\n\n\t\t\t/**\n\t\t\t * Counts a failed attempt and locks the login once the limit is reached.\n\t\t\t *\n\t\t\t * @param reason - internal reason (never sent to the client)\n\t\t\t * @param userId - known user id, `null` when the login is unknown\n\t\t\t * @returns the generic failure result\n\t\t\t */\n\t\t\tconst registerFailure = (reason: string, userId: number | null): LoginResult => {\n\t\t\t\tconst expiredLock = previous !== undefined && previous.blockedUntil > 0 && previous.blockedUntil <= now;\n\t\t\t\tconst count = previous === undefined || expiredLock ? 1 : previous.count + 1;\n\t\t\t\tconst blockedUntil = count >= maxFailed ? now + lockoutSeconds : 0;\n\t\t\t\tfailures.set(key, { count, blockedUntil });\n\n\t\t\t\twriteAuditLog(db, {\n\t\t\t\t\tatUtc: now,\n\t\t\t\t\taction: \"auth.login_failed\",\n\t\t\t\t\tentity: \"user\",\n\t\t\t\t\tentityId: userId,\n\t\t\t\t\tdetail: { login: input.login.trim(), reason, attempts: count, blockedUntil },\n\t\t\t\t\tip: input.ip ?? null,\n\t\t\t\t});\n\t\t\t\treturn { ok: false, error: \"invalid_credentials\" };\n\t\t\t};\n\n\t\t\tconst user = users.findByLogin(input.login);\n\t\t\tif (!user) {\n\t\t\t\treturn registerFailure(\"unknown_user\", null);\n\t\t\t}\n\t\t\tif (!user.isActive) {\n\t\t\t\treturn registerFailure(\"inactive_user\", user.id);\n\t\t\t}\n\t\t\tif (!user.passwordHash) {\n\t\t\t\treturn registerFailure(\"no_password\", user.id);\n\t\t\t}\n\t\t\tif (!verifyPassword(input.password, user.passwordHash)) {\n\t\t\t\treturn registerFailure(\"wrong_password\", user.id);\n\t\t\t}\n\n\t\t\tfailures.delete(key);\n\n\t\t\tconst authenticated = user;\n\n\t\t\tconst token = randomBytes(32).toString(\"base64url\");\n\t\t\tconst sessionId = hashToken(token);\n\t\t\tconst expiresAt = now + ttlSeconds();\n\n\t\t\tconst run = db.transaction((): void => {\n\t\t\t\tinsertSession.run(sessionId, user.id, now, expiresAt, input.userAgent ?? null, input.ip ?? null);\n\t\t\t\twriteAuditLog(db, {\n\t\t\t\t\tatUtc: now,\n\t\t\t\t\tactorId: user.id,\n\t\t\t\t\taction: \"auth.login\",\n\t\t\t\t\tentity: \"session\",\n\t\t\t\t\tentityId: sessionId,\n\t\t\t\t\tdetail: { login: user.login, userAgent: input.userAgent ?? null },\n\t\t\t\t\tip: input.ip ?? null,\n\t\t\t\t});\n\t\t\t});\n\t\t\trun();\n\t\t\tusers.recordLogin(user.id, now);\n\n\t\t\treturn { ok: true, token, csrfToken: this.csrfToken(token), expiresAt, user: publicUser(authenticated) };\n\t\t},\n\n\t\tlogout(input: { token: string; actorId?: number | null; ip?: string | null; now?: number }): boolean {\n\t\t\tconst token = input.token?.trim() ?? \"\";\n\t\t\tif (!token) {\n\t\t\t\treturn false;\n\t\t\t}\n\t\t\tconst sessionId = hashToken(token);\n\t\t\tconst session = readSession(sessionId);\n\t\t\tif (!session || session.revoked) {\n\t\t\t\treturn false;\n\t\t\t}\n\n\t\t\tconst now = input.now ?? Math.floor(Date.now() / 1000);\n\t\t\tconst run = db.transaction((): void => {\n\t\t\t\trevokeSession.run(sessionId);\n\t\t\t\twriteAuditLog(db, {\n\t\t\t\t\tatUtc: now,\n\t\t\t\t\tactorId: input.actorId ?? session.userId,\n\t\t\t\t\taction: \"auth.logout\",\n\t\t\t\t\tentity: \"session\",\n\t\t\t\t\tentityId: sessionId,\n\t\t\t\t\tdetail: { userId: session.userId },\n\t\t\t\t\tip: input.ip ?? null,\n\t\t\t\t});\n\t\t\t});\n\t\t\trun();\n\t\t\treturn true;\n\t\t},\n\n\t\tauthenticate(input: { token: string; permission?: string; now?: number }): AuthResult {\n\t\t\tconst now = input.now ?? Math.floor(Date.now() / 1000);\n\t\t\tconst token = input.token?.trim() ?? \"\";\n\t\t\tif (!token) {\n\t\t\t\treturn { ok: false, error: \"no_session\" };\n\t\t\t}\n\n\t\t\tconst session = readSession(hashToken(token));\n\t\t\tif (!session || session.revoked) {\n\t\t\t\treturn { ok: false, error: \"no_session\" };\n\t\t\t}\n\t\t\tif (session.expiresAt <= now) {\n\t\t\t\treturn { ok: false, error: \"session_expired\" };\n\t\t\t}\n\n\t\t\tconst user = users.findById(session.userId);\n\t\t\tif (!user || !user.isActive) {\n\t\t\t\treturn { ok: false, error: \"user_inactive\" };\n\t\t\t}\n\n\t\t\tconst permissions = users.permissions(user.id);\n\t\t\tif (input.permission && !permissions.includes(input.permission)) {\n\t\t\t\treturn { ok: false, error: \"permission_denied\" };\n\t\t\t}\n\n\t\t\t// sliding renewal: extend the session in its second half\n\t\t\tconst ttl = ttlSeconds();\n\t\t\tif (session.expiresAt - now < ttl / 2) {\n\t\t\t\tconst next = now + ttl;\n\t\t\t\textendSession.run(next, session.id);\n\t\t\t\tsession.expiresAt = next;\n\t\t\t}\n\n\t\t\treturn {\n\t\t\t\tok: true,\n\t\t\t\tcontext: {\n\t\t\t\t\tsessionId: session.id,\n\t\t\t\t\texpiresAt: session.expiresAt,\n\t\t\t\t\tuser: publicUser(user),\n\t\t\t\t\tpermissions,\n\t\t\t\t},\n\t\t\t};\n\t\t},\n\n\t\trevokeSessions(input: { userId: number; actorId: number; now?: number }): number {\n\t\t\tconst now = input.now ?? Math.floor(Date.now() / 1000);\n\t\t\tlet revoked = 0;\n\t\t\tconst run = db.transaction((): void => {\n\t\t\t\trevoked = revokeUserSessions.run(input.userId).changes;\n\t\t\t\tif (revoked > 0) {\n\t\t\t\t\twriteAuditLog(db, {\n\t\t\t\t\t\tatUtc: now,\n\t\t\t\t\t\tactorId: input.actorId,\n\t\t\t\t\t\taction: \"auth.revoke_all\",\n\t\t\t\t\t\tentity: \"user\",\n\t\t\t\t\t\tentityId: input.userId,\n\t\t\t\t\t\tdetail: { sessions: revoked },\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t});\n\t\t\trun();\n\t\t\treturn revoked;\n\t\t},\n\n\t\tsessions(userId: number, now?: number): SessionInfo[] {\n\t\t\tconst reference = now ?? Math.floor(Date.now() / 1000);\n\t\t\tconst rows = selectUserSessions.all(userId, reference) as (Omit<SessionInfo, \"revoked\"> & {\n\t\t\t\trevoked: number;\n\t\t\t})[];\n\t\t\treturn rows.map(row => ({ ...row, revoked: row.revoked !== 0 }));\n\t\t},\n\n\t\tpurge(now?: number): number {\n\t\t\treturn purgeSessions.run(now ?? Math.floor(Date.now() / 1000)).changes;\n\t\t},\n\n\t\trotateIfDue(input: { token: string; now?: number }): { token: string; expiresAt: number } | null {\n\t\t\tconst now = input.now ?? Math.floor(Date.now() / 1000);\n\t\t\tconst previousId = hashToken(input.token ?? \"\");\n\t\t\tconst session = readSession(previousId);\n\t\t\tif (!session || session.revoked || session.expiresAt <= now) {\n\t\t\t\treturn null;\n\t\t\t}\n\n\t\t\t// Only sessions that have really been in use for a while are renewed: half of their lifetime, but at\n\t\t\t// least a quarter of an hour. Otherwise every single request of the web app would churn the row.\n\t\t\tconst threshold = Math.max(900, Math.floor(ttlSeconds() / 2));\n\t\t\tif (now - session.createdAt < threshold) {\n\t\t\t\treturn null;\n\t\t\t}\n\n\t\t\tconst token = randomBytes(32).toString(\"base64url\");\n\t\t\tconst expiresAt = now + ttlSeconds();\n\t\t\tdb.transaction((): void => {\n\t\t\t\t// the old token dies with its row; the user, the session start and the device stay the same\n\t\t\t\trevokeSession.run(previousId);\n\t\t\t\tinsertSession.run(hashToken(token), session.userId, now, expiresAt, session.userAgent, session.ip);\n\t\t\t\twriteAuditLog(db, {\n\t\t\t\t\tatUtc: now,\n\t\t\t\t\taction: \"auth.session_rotated\",\n\t\t\t\t\tentity: \"user\",\n\t\t\t\t\tentityId: session.userId,\n\t\t\t\t\tdetail: { session: hashToken(token) },\n\t\t\t\t\tip: session.ip,\n\t\t\t\t});\n\t\t\t})();\n\t\t\treturn { token, expiresAt };\n\t\t},\n\n\t\tcsrfToken(token: string): string {\n\t\t\treturn createHmac(\"sha256\", secret).update(token).digest(\"base64url\");\n\t\t},\n\n\t\tverifyCsrf(input: { token: string; csrfToken: string }): boolean {\n\t\t\tconst expected = this.csrfToken(input.token ?? \"\");\n\t\t\tconst provided = input.csrfToken ?? \"\";\n\t\t\tif (expected.length !== provided.length) {\n\t\t\t\treturn false;\n\t\t\t}\n\t\t\treturn timingSafeEqual(Buffer.from(expected), Buffer.from(provided));\n\t\t},\n\n\t\tsetPassword(input: {\n\t\t\tuserId: number;\n\t\t\tpassword: string;\n\t\t\tmustChangePw?: boolean;\n\t\t\tactorId: number;\n\t\t\tactorIp?: string | null;\n\t\t\tnow?: number;\n\t\t}): void {\n\t\t\tconst violated = checkPasswordPolicy(input.password, policy);\n\t\t\tif (violated) {\n\t\t\t\tthrow new ValidationError(`password does not fulfil the policy (${violated})`);\n\t\t\t}\n\n\t\t\tconst now = input.now ?? Math.floor(Date.now() / 1000);\n\t\t\tconst mustChangePw = input.mustChangePw ?? false;\n\t\t\t// the user repository audits the change without the hash\n\t\t\tusers.update({\n\t\t\t\tid: input.userId,\n\t\t\t\tpatch: { passwordHash: hashPassword(input.password), mustChangePw },\n\t\t\t\treason: mustChangePw ? \"password reset by an administrator\" : \"password changed\",\n\t\t\t\tactorId: input.actorId,\n\t\t\t\tactorIp: input.actorIp ?? null,\n\t\t\t\tnow,\n\t\t\t});\n\t\t\twriteAuditLog(db, {\n\t\t\t\tatUtc: now,\n\t\t\t\tactorId: input.actorId,\n\t\t\t\taction: \"auth.password_set\",\n\t\t\t\tentity: \"user\",\n\t\t\t\tentityId: input.userId,\n\t\t\t\tdetail: { mustChangePw },\n\t\t\t\tip: input.actorIp ?? null,\n\t\t\t});\n\t\t},\n\t};\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAWA,yBAAiF;AAIjF,oBAAgC;AAChC,mBAA8B;AAmL9B,MAAM,eAA8C;AAAA,EACnD,MAAM;AAAA,EACN,WAAW;AAAA,EACX,iBAAiB;AAAA,EACjB,WAAW;AACZ;AAEA,MAAM,cAAc;AASb,SAAS,aAAa,UAAkB,UAA+B,CAAC,GAAW;AAnN1F;AAoNC,QAAM,QAAO,aAAQ,SAAR,YAAgB,aAAa;AAC1C,QAAM,aAAY,aAAQ,cAAR,YAAqB,aAAa;AACpD,QAAM,mBAAkB,aAAQ,oBAAR,YAA2B,aAAa;AAChE,QAAM,aAAY,aAAQ,cAAR,YAAqB,aAAa;AACpD,QAAM,WAAO,gCAAY,EAAE;AAC3B,QAAM,cAAU,+BAAW,UAAU,MAAM,WAAW;AAAA,IACrD,GAAG;AAAA,IACH,GAAG;AAAA,IACH,GAAG;AAAA,IACH,QAAQ,MAAM,OAAO;AAAA,EACtB,CAAC;AAED,SAAO;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,KAAK,SAAS,QAAQ;AAAA,IACtB,QAAQ,SAAS,QAAQ;AAAA,EAC1B,EAAE,KAAK,GAAG;AACX;AAWO,SAAS,eAAe,UAAkB,QAAyB;AACzE,QAAM,SAAS,0BAAU,IAAI,MAAM,GAAG;AACtC,MAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,aAAa;AACnD,WAAO;AAAA,EACR;AACA,QAAM,OAAO,OAAO,MAAM,CAAC,CAAC;AAC5B,QAAM,YAAY,OAAO,MAAM,CAAC,CAAC;AACjC,QAAM,kBAAkB,OAAO,MAAM,CAAC,CAAC;AACvC,QAAM,YAAY,OAAO,MAAM,CAAC,CAAC;AACjC,MAAI,CAAC,CAAC,MAAM,WAAW,iBAAiB,SAAS,EAAE,MAAM,WAAS,OAAO,UAAU,KAAK,KAAK,QAAQ,CAAC,GAAG;AACxG,WAAO;AAAA,EACR;AAEA,MAAI;AACJ,MAAI;AACH,eAAW,OAAO,KAAK,MAAM,CAAC,GAAG,QAAQ;AAAA,EAC1C,QAAQ;AACP,WAAO;AAAA,EACR;AACA,MAAI,SAAS,WAAW,WAAW;AAClC,WAAO;AAAA,EACR;AAEA,QAAM,cAAU,+BAAW,UAAU,OAAO,KAAK,MAAM,CAAC,GAAG,QAAQ,GAAG,WAAW;AAAA,IAChF,GAAG;AAAA,IACH,GAAG;AAAA,IACH,GAAG;AAAA,IACH,QAAQ,MAAM,OAAO;AAAA,EACtB,CAAC;AACD,aAAO,oCAAgB,SAAS,QAAQ;AACzC;AASO,SAAS,oBAAoB,UAAkB,SAAyB,CAAC,GAAkB;AA3RlG;AA4RC,QAAM,aAAY,YAAO,cAAP,YAAoB;AACtC,MAAI,SAAS,SAAS,WAAW;AAChC,WAAO;AAAA,EACR;AACA,QAAK,YAAO,kBAAP,YAAwB,SAAS,CAAC,WAAW,KAAK,QAAQ,GAAG;AACjE,WAAO;AAAA,EACR;AACA,QAAK,YAAO,iBAAP,YAAuB,SAAS,CAAC,KAAK,KAAK,QAAQ,GAAG;AAC1D,WAAO;AAAA,EACR;AACA,SAAO;AACR;AAQO,SAAS,kBAAkB,MAA6B;AA/S/D;AAgTC,QAAM,EAAE,IAAI,OAAO,UAAU,OAAO,IAAI;AACxC,QAAM,cAAa,UAAK,sBAAL,YAA0B;AAC7C,QAAM,aAAY,UAAK,sBAAL,YAA0B;AAC5C,QAAM,mBAAkB,UAAK,mBAAL,YAAuB,MAAM;AACrD,QAAM,UAAS,UAAK,WAAL,YAAe,CAAC;AAG/B,QAAM,WAAW,oBAAI,IAAqD;AAE1E,QAAM,gBAAgB,GAAG;AAAA,IACxB;AAAA;AAAA;AAAA,EAGD;AACA,QAAM,qBAAqB,GAAG;AAAA,IAC7B;AAAA;AAAA;AAAA;AAAA,EAID;AACA,QAAM,gBAAgB,GAAG;AAAA,IACxB;AAAA;AAAA,EAED;AACA,QAAM,gBAAgB,GAAG,QAAQ,8CAA8C;AAC/E,QAAM,qBAAqB,GAAG,QAAQ,mEAAmE;AACzG,QAAM,gBAAgB,GAAG,QAAQ,iDAAiD;AAClF,QAAM,gBAAgB,GAAG,QAAQ,2DAA2D;AAQ5F,QAAM,YAAY,CAAC,cAA0B,+BAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AAE5F,QAAM,aAAa,MAClB,KAAK,IAAI,GAAG,KAAK,MAAM,SAAS,UAAU,uBAAuB,UAAU,CAAC,CAAC,IAAI;AAElF,QAAM,aAAa,CAAC,UAAkC;AAAA,IACrD,IAAI,KAAK;AAAA,IACT,OAAO,KAAK;AAAA,IACZ,aAAa,KAAK;AAAA,IAClB,QAAQ,KAAK;AAAA,IACb,UAAU,KAAK;AAAA,IACf,cAAc,KAAK;AAAA,EACpB;AAEA,QAAM,cAAc,CAAC,cAA0C;AAC9D,UAAM,MAAM,cAAc,IAAI,SAAS;AACvC,WAAO,MAAM,EAAE,GAAG,KAAK,SAAS,IAAI,YAAY,EAAE,IAAI;AAAA,EACvD;AAEA,SAAO;AAAA,IACN,MAAM,OAAgC;AAvWxC,UAAAA,KAAAC;AAwWG,YAAM,OAAMD,MAAA,MAAM,QAAN,OAAAA,MAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACrD,YAAM,MAAM,MAAM,MAAM,KAAK,EAAE,YAAY;AAC3C,YAAM,WAAW,SAAS,IAAI,GAAG;AAEjC,UAAI,YAAY,SAAS,eAAe,KAAK;AAC5C,wCAAc,IAAI;AAAA,UACjB,OAAO;AAAA,UACP,QAAQ;AAAA,UACR,QAAQ;AAAA,UACR,UAAU;AAAA,UACV,QAAQ,EAAE,OAAO,MAAM,MAAM,KAAK,GAAG,cAAc,SAAS,aAAa;AAAA,UACzE,KAAIC,MAAA,MAAM,OAAN,OAAAA,MAAY;AAAA,QACjB,CAAC;AACD,eAAO,EAAE,IAAI,OAAO,OAAO,aAAa;AAAA,MACzC;AASA,YAAM,kBAAkB,CAAC,QAAgB,WAAuC;AA/XnF,YAAAD;AAgYI,cAAM,cAAc,aAAa,UAAa,SAAS,eAAe,KAAK,SAAS,gBAAgB;AACpG,cAAM,QAAQ,aAAa,UAAa,cAAc,IAAI,SAAS,QAAQ;AAC3E,cAAM,eAAe,SAAS,YAAY,MAAM,iBAAiB;AACjE,iBAAS,IAAI,KAAK,EAAE,OAAO,aAAa,CAAC;AAEzC,wCAAc,IAAI;AAAA,UACjB,OAAO;AAAA,UACP,QAAQ;AAAA,UACR,QAAQ;AAAA,UACR,UAAU;AAAA,UACV,QAAQ,EAAE,OAAO,MAAM,MAAM,KAAK,GAAG,QAAQ,UAAU,OAAO,aAAa;AAAA,UAC3E,KAAIA,MAAA,MAAM,OAAN,OAAAA,MAAY;AAAA,QACjB,CAAC;AACD,eAAO,EAAE,IAAI,OAAO,OAAO,sBAAsB;AAAA,MAClD;AAEA,YAAM,OAAO,MAAM,YAAY,MAAM,KAAK;AAC1C,UAAI,CAAC,MAAM;AACV,eAAO,gBAAgB,gBAAgB,IAAI;AAAA,MAC5C;AACA,UAAI,CAAC,KAAK,UAAU;AACnB,eAAO,gBAAgB,iBAAiB,KAAK,EAAE;AAAA,MAChD;AACA,UAAI,CAAC,KAAK,cAAc;AACvB,eAAO,gBAAgB,eAAe,KAAK,EAAE;AAAA,MAC9C;AACA,UAAI,CAAC,eAAe,MAAM,UAAU,KAAK,YAAY,GAAG;AACvD,eAAO,gBAAgB,kBAAkB,KAAK,EAAE;AAAA,MACjD;AAEA,eAAS,OAAO,GAAG;AAEnB,YAAM,gBAAgB;AAEtB,YAAM,YAAQ,gCAAY,EAAE,EAAE,SAAS,WAAW;AAClD,YAAM,YAAY,UAAU,KAAK;AACjC,YAAM,YAAY,MAAM,WAAW;AAEnC,YAAM,MAAM,GAAG,YAAY,MAAY;AAta1C,YAAAA,KAAAC,KAAAC,KAAAC;AAuaI,sBAAc,IAAI,WAAW,KAAK,IAAI,KAAK,YAAWH,MAAA,MAAM,cAAN,OAAAA,MAAmB,OAAMC,MAAA,MAAM,OAAN,OAAAA,MAAY,IAAI;AAC/F,wCAAc,IAAI;AAAA,UACjB,OAAO;AAAA,UACP,SAAS,KAAK;AAAA,UACd,QAAQ;AAAA,UACR,QAAQ;AAAA,UACR,UAAU;AAAA,UACV,QAAQ,EAAE,OAAO,KAAK,OAAO,YAAWC,MAAA,MAAM,cAAN,OAAAA,MAAmB,KAAK;AAAA,UAChE,KAAIC,MAAA,MAAM,OAAN,OAAAA,MAAY;AAAA,QACjB,CAAC;AAAA,MACF,CAAC;AACD,UAAI;AACJ,YAAM,YAAY,KAAK,IAAI,GAAG;AAE9B,aAAO,EAAE,IAAI,MAAM,OAAO,WAAW,KAAK,UAAU,KAAK,GAAG,WAAW,MAAM,WAAW,aAAa,EAAE;AAAA,IACxG;AAAA,IAEA,OAAO,OAA8F;AAxbvG,UAAAH,KAAAC,KAAAC;AAybG,YAAM,SAAQD,OAAAD,MAAA,MAAM,UAAN,gBAAAA,IAAa,WAAb,OAAAC,MAAuB;AACrC,UAAI,CAAC,OAAO;AACX,eAAO;AAAA,MACR;AACA,YAAM,YAAY,UAAU,KAAK;AACjC,YAAM,UAAU,YAAY,SAAS;AACrC,UAAI,CAAC,WAAW,QAAQ,SAAS;AAChC,eAAO;AAAA,MACR;AAEA,YAAM,OAAMC,MAAA,MAAM,QAAN,OAAAA,MAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACrD,YAAM,MAAM,GAAG,YAAY,MAAY;AApc1C,YAAAF,KAAAC;AAqcI,sBAAc,IAAI,SAAS;AAC3B,wCAAc,IAAI;AAAA,UACjB,OAAO;AAAA,UACP,UAASD,MAAA,MAAM,YAAN,OAAAA,MAAiB,QAAQ;AAAA,UAClC,QAAQ;AAAA,UACR,QAAQ;AAAA,UACR,UAAU;AAAA,UACV,QAAQ,EAAE,QAAQ,QAAQ,OAAO;AAAA,UACjC,KAAIC,MAAA,MAAM,OAAN,OAAAA,MAAY;AAAA,QACjB,CAAC;AAAA,MACF,CAAC;AACD,UAAI;AACJ,aAAO;AAAA,IACR;AAAA,IAEA,aAAa,OAAyE;AApdxF,UAAAD,KAAAC,KAAAC;AAqdG,YAAM,OAAMF,MAAA,MAAM,QAAN,OAAAA,MAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACrD,YAAM,SAAQE,OAAAD,MAAA,MAAM,UAAN,gBAAAA,IAAa,WAAb,OAAAC,MAAuB;AACrC,UAAI,CAAC,OAAO;AACX,eAAO,EAAE,IAAI,OAAO,OAAO,aAAa;AAAA,MACzC;AAEA,YAAM,UAAU,YAAY,UAAU,KAAK,CAAC;AAC5C,UAAI,CAAC,WAAW,QAAQ,SAAS;AAChC,eAAO,EAAE,IAAI,OAAO,OAAO,aAAa;AAAA,MACzC;AACA,UAAI,QAAQ,aAAa,KAAK;AAC7B,eAAO,EAAE,IAAI,OAAO,OAAO,kBAAkB;AAAA,MAC9C;AAEA,YAAM,OAAO,MAAM,SAAS,QAAQ,MAAM;AAC1C,UAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC5B,eAAO,EAAE,IAAI,OAAO,OAAO,gBAAgB;AAAA,MAC5C;AAEA,YAAM,cAAc,MAAM,YAAY,KAAK,EAAE;AAC7C,UAAI,MAAM,cAAc,CAAC,YAAY,SAAS,MAAM,UAAU,GAAG;AAChE,eAAO,EAAE,IAAI,OAAO,OAAO,oBAAoB;AAAA,MAChD;AAGA,YAAM,MAAM,WAAW;AACvB,UAAI,QAAQ,YAAY,MAAM,MAAM,GAAG;AACtC,cAAM,OAAO,MAAM;AACnB,sBAAc,IAAI,MAAM,QAAQ,EAAE;AAClC,gBAAQ,YAAY;AAAA,MACrB;AAEA,aAAO;AAAA,QACN,IAAI;AAAA,QACJ,SAAS;AAAA,UACR,WAAW,QAAQ;AAAA,UACnB,WAAW,QAAQ;AAAA,UACnB,MAAM,WAAW,IAAI;AAAA,UACrB;AAAA,QACD;AAAA,MACD;AAAA,IACD;AAAA,IAEA,eAAe,OAAkE;AAhgBnF,UAAAF;AAigBG,YAAM,OAAMA,MAAA,MAAM,QAAN,OAAAA,MAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACrD,UAAI,UAAU;AACd,YAAM,MAAM,GAAG,YAAY,MAAY;AACtC,kBAAU,mBAAmB,IAAI,MAAM,MAAM,EAAE;AAC/C,YAAI,UAAU,GAAG;AAChB,0CAAc,IAAI;AAAA,YACjB,OAAO;AAAA,YACP,SAAS,MAAM;AAAA,YACf,QAAQ;AAAA,YACR,QAAQ;AAAA,YACR,UAAU,MAAM;AAAA,YAChB,QAAQ,EAAE,UAAU,QAAQ;AAAA,UAC7B,CAAC;AAAA,QACF;AAAA,MACD,CAAC;AACD,UAAI;AACJ,aAAO;AAAA,IACR;AAAA,IAEA,SAAS,QAAgB,KAA6B;AACrD,YAAM,YAAY,oBAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACrD,YAAM,OAAO,mBAAmB,IAAI,QAAQ,SAAS;AAGrD,aAAO,KAAK,IAAI,UAAQ,EAAE,GAAG,KAAK,SAAS,IAAI,YAAY,EAAE,EAAE;AAAA,IAChE;AAAA,IAEA,MAAM,KAAsB;AAC3B,aAAO,cAAc,IAAI,oBAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,CAAC,EAAE;AAAA,IAChE;AAAA,IAEA,YAAY,OAAqF;AAhiBnG,UAAAA,KAAAC;AAiiBG,YAAM,OAAMD,MAAA,MAAM,QAAN,OAAAA,MAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACrD,YAAM,aAAa,WAAUC,MAAA,MAAM,UAAN,OAAAA,MAAe,EAAE;AAC9C,YAAM,UAAU,YAAY,UAAU;AACtC,UAAI,CAAC,WAAW,QAAQ,WAAW,QAAQ,aAAa,KAAK;AAC5D,eAAO;AAAA,MACR;AAIA,YAAM,YAAY,KAAK,IAAI,KAAK,KAAK,MAAM,WAAW,IAAI,CAAC,CAAC;AAC5D,UAAI,MAAM,QAAQ,YAAY,WAAW;AACxC,eAAO;AAAA,MACR;AAEA,YAAM,YAAQ,gCAAY,EAAE,EAAE,SAAS,WAAW;AAClD,YAAM,YAAY,MAAM,WAAW;AACnC,SAAG,YAAY,MAAY;AAE1B,sBAAc,IAAI,UAAU;AAC5B,sBAAc,IAAI,UAAU,KAAK,GAAG,QAAQ,QAAQ,KAAK,WAAW,QAAQ,WAAW,QAAQ,EAAE;AACjG,wCAAc,IAAI;AAAA,UACjB,OAAO;AAAA,UACP,QAAQ;AAAA,UACR,QAAQ;AAAA,UACR,UAAU,QAAQ;AAAA,UAClB,QAAQ,EAAE,SAAS,UAAU,KAAK,EAAE;AAAA,UACpC,IAAI,QAAQ;AAAA,QACb,CAAC;AAAA,MACF,CAAC,EAAE;AACH,aAAO,EAAE,OAAO,UAAU;AAAA,IAC3B;AAAA,IAEA,UAAU,OAAuB;AAChC,iBAAO,+BAAW,UAAU,MAAM,EAAE,OAAO,KAAK,EAAE,OAAO,WAAW;AAAA,IACrE;AAAA,IAEA,WAAW,OAAsD;AArkBnE,UAAAD,KAAAC;AAskBG,YAAM,WAAW,KAAK,WAAUD,MAAA,MAAM,UAAN,OAAAA,MAAe,EAAE;AACjD,YAAM,YAAWC,MAAA,MAAM,cAAN,OAAAA,MAAmB;AACpC,UAAI,SAAS,WAAW,SAAS,QAAQ;AACxC,eAAO;AAAA,MACR;AACA,iBAAO,oCAAgB,OAAO,KAAK,QAAQ,GAAG,OAAO,KAAK,QAAQ,CAAC;AAAA,IACpE;AAAA,IAEA,YAAY,OAOH;AArlBX,UAAAD,KAAAC,KAAAC,KAAAC;AAslBG,YAAM,WAAW,oBAAoB,MAAM,UAAU,MAAM;AAC3D,UAAI,UAAU;AACb,cAAM,IAAI,8BAAgB,wCAAwC,QAAQ,GAAG;AAAA,MAC9E;AAEA,YAAM,OAAMH,MAAA,MAAM,QAAN,OAAAA,MAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACrD,YAAM,gBAAeC,MAAA,MAAM,iBAAN,OAAAA,MAAsB;AAE3C,YAAM,OAAO;AAAA,QACZ,IAAI,MAAM;AAAA,QACV,OAAO,EAAE,cAAc,aAAa,MAAM,QAAQ,GAAG,aAAa;AAAA,QAClE,QAAQ,eAAe,uCAAuC;AAAA,QAC9D,SAAS,MAAM;AAAA,QACf,UAASC,MAAA,MAAM,YAAN,OAAAA,MAAiB;AAAA,QAC1B;AAAA,MACD,CAAC;AACD,sCAAc,IAAI;AAAA,QACjB,OAAO;AAAA,QACP,SAAS,MAAM;AAAA,QACf,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,UAAU,MAAM;AAAA,QAChB,QAAQ,EAAE,aAAa;AAAA,QACvB,KAAIC,MAAA,MAAM,YAAN,OAAAA,MAAiB;AAAA,MACtB,CAAC;AAAA,IACF;AAAA,EACD;AACD;",
+  "names": ["_a", "_b", "_c", "_d"]
+}