ldap-rest 0.13.1 → 0.13.2

package/dist/plugins/auth/hmac.js

@@ -1 +1 @@
-import{createHmac as e,createHash as t,timingSafeEqual as i}from"crypto";import{unauthorized as r}from"../../lib/expressFormatedResponses.js";import s from"../../lib/auth/base.js";class AuthHmac extends s{knownIdentities(){return[...this.services.values()].map(e=>e.name)}identitySource(){return"req.user and req.userName: the service name given in --auth-hmac"}constructor(...e){super(...e),this.name="authHmac",this.roles=["auth"],this.services=new Map;const t=this.config.auth_hmac;this.timeWindow=this.config.auth_hmac_window??12e4,t&&Array.isArray(t)&&t.forEach((e,t)=>{const i=e.split(":");if(i.length>=3){const e=i[0].trim(),r=i[1].trim(),s=i.slice(2).join(":").trim();if(!e||!r||!s)return void this.logger.warn(`Invalid HMAC config at index ${t}: missing id, secret, or name`);r.length<32&&this.logger.warn(`HMAC secret for service "${e}" is too short (minimum 32 characters recommended)`),this.services.set(e,{id:e,secret:r,name:s})}else this.logger.warn(`Invalid HMAC config format at index ${t}: expected "service-id:secret:name"`)}),0===this.services.size?this.logger.warn("No valid HMAC services configured"):(this.logger.info(`HMAC authentication initialized with ${this.services.size} service(s): ${Array.from(this.services.keys()).join(", ")}`),this.logger.info(`Time window for replay protection: ${this.timeWindow}ms`))}authMethod(e,t,i){const s=e.headers.authorization;if(!s||!s.startsWith("HMAC-SHA256 "))return this.logger.warn("Missing or invalid Authorization header (expected HMAC-SHA256)"),r(t);const n=s.substring(12).split(":");if(3!==n.length)return this.logger.warn("Invalid HMAC authorization format (expected service-id:timestamp:signature)"),r(t);const[a,o,c]=n,h=this.services.get(a);if(!h)return this.logger.warn(`Unknown service ID: ${a}`),r(t);const u=parseInt(o,10);if(isNaN(u)||u<=0)return this.logger.warn(`Invalid timestamp: ${o}`),r(t);const m=Date.now(),g=Math.abs(m-u);if(g>this.timeWindow)return this.logger.warn(`Timestamp outside allowed window: ${g}ms (max: ${this.timeWindow}ms) for service ${a}`),r(t);const d=this.calculateBodyHash(e),l=`${e.method.toUpperCase()}|${e.originalUrl||e.url}|${u}|${d}`,f=this.calculateHmac(h.secret,l);if(!this.secureCompare(c,f))return this.logger.warn(`Invalid signature for service ${a} (${h.name}). Expected: ${f.substring(0,8)}..., Got: ${c.substring(0,8)}...`),this.logger.debug(`Signing string: ${l}`),r(t);this.logger.debug(`HMAC authentication successful for service: ${a} (${h.name})`),this.publishIdentity(e,h.name),i()}calculateHmac(t,i){const r=e("sha256",t);return r.update(i),r.digest("hex")}calculateBodyHash(e){const i=e.method.toUpperCase();if("GET"===i||"DELETE"===i||"HEAD"===i)return"";if(e.body){const i="string"==typeof e.body?e.body:JSON.stringify(e.body),r=t("sha256");return r.update(i),r.digest("hex")}return""}secureCompare(e,t){if(e.length!==t.length)return!1;try{const r=Buffer.from(e,"utf8"),s=Buffer.from(t,"utf8");return i(r,s)}catch{return!1}}}export{AuthHmac as default};
+import{createHmac as e,createHash as t,timingSafeEqual as i}from"crypto";import{unauthorized as r}from"../../lib/expressFormatedResponses.js";import s from"../../lib/auth/base.js";class AuthHmac extends s{knownIdentities(){return[...this.services.values()].map(e=>e.name)}identitySource(){return"req.user and req.userName: the service name given in --auth-hmac"}constructor(...e){super(...e),this.name="authHmac",this.roles=["auth"],this.services=new Map;const t=this.config.auth_hmac;this.timeWindow=this.config.auth_hmac_window??12e4,t&&Array.isArray(t)&&t.forEach((e,t)=>{const i=e.split(":");if(i.length>=3){const e=i[0].trim(),r=i[1].trim(),s=i.slice(2).join(":").trim();if(!e||!r||!s)return void this.logger.warn(`Invalid HMAC config at index ${t}: missing id, secret, or name`);r.length<32&&this.logger.warn(`HMAC secret for service "${e}" is too short (minimum 32 characters recommended)`),this.services.set(e,{id:e,secret:r,name:s})}else this.logger.warn(`Invalid HMAC config format at index ${t}: expected "service-id:secret:name"`)}),0===this.services.size?this.logger.warn("No valid HMAC services configured"):(this.logger.info(`HMAC authentication initialized with ${this.services.size} service(s): ${Array.from(this.services.keys()).join(", ")}`),this.logger.info(`Time window for replay protection: ${this.timeWindow}ms`))}authMethod(e,t,i){const s=e.headers.authorization;if(!s||!s.startsWith("HMAC-SHA256 "))return this.logger.warn("Missing or invalid Authorization header (expected HMAC-SHA256)"),r(t);const n=s.substring(12).split(":");if(3!==n.length)return this.logger.warn("Invalid HMAC authorization format (expected service-id:timestamp:signature)"),r(t);const[o,a,c]=n,h=this.services.get(o);if(!h)return this.logger.warn(`Unknown service ID: ${o}`),r(t);const u=parseInt(a,10);if(isNaN(u)||u<=0)return this.logger.warn(`Invalid timestamp: ${a}`),r(t);const d=Date.now(),g=Math.abs(d-u);if(g>this.timeWindow)return this.logger.warn(`Timestamp outside allowed window: ${g}ms (max: ${this.timeWindow}ms) for service ${o}`),r(t);const m=this.calculateBodyHash(e);if(void 0===m)return this.logger.warn(`Refusing ${e.method} ${e.originalUrl||e.url} from service ${o}: its body (${e.headers["content-type"]||"no Content-Type"}) cannot be checked against the signature`),r(t);const l=`${e.method.toUpperCase()}|${e.originalUrl||e.url}|${u}|${m}`,f=this.calculateHmac(h.secret,l);if(!this.secureCompare(c,f))return this.logger.warn(`Invalid signature for service ${o} (${h.name}). Expected: ${f.substring(0,8)}..., Got: ${c.substring(0,8)}...`),this.logger.debug(`Signing string: ${l}`),r(t);this.logger.debug(`HMAC authentication successful for service: ${o} (${h.name})`),this.publishIdentity(e,h.name),i()}calculateHmac(t,i){const r=e("sha256",t);return r.update(i),r.digest("hex")}calculateBodyHash(e){const i=e.method.toUpperCase();if("GET"===i||"DELETE"===i||"HEAD"===i)return"";if(e.body){const i="string"==typeof e.body?e.body:JSON.stringify(e.body),r=t("sha256");return r.update(i),r.digest("hex")}const r=parseInt(e.headers["content-length"]??"",10);return void 0!==e.headers["transfer-encoding"]||r>0?void 0:""}secureCompare(e,t){if(e.length!==t.length)return!1;try{const r=Buffer.from(e,"utf8"),s=Buffer.from(t,"utf8");return i(r,s)}catch{return!1}}}export{AuthHmac as default};

package/dist/src/plugins/auth/hmac.d.ts

@@ -16,7 +16,8 @@ export default class AuthHmac extends AuthBase {
     private calculateHmac;
     /**
      * Calculate SHA256 hash of request body
-     * Returns empty string for GET/DELETE/HEAD methods
+     * Returns empty string for GET/DELETE/HEAD methods, and undefined for a
+     * body no global parser read, which cannot be checked
      */
     private calculateBodyHash;
     /**

package/docs/usage/plugins/auth/hmac.md

@@ -58,6 +58,11 @@ DM_AUTH_HMAC_WINDOW=120000  # Default: 120000ms (2 minutes)
    - `timestamp`: Unix timestamp in milliseconds (e.g., `1698765432000`)
    - `body-hash`: SHA256(request_body) for POST/PATCH/PUT, empty string for GET/DELETE/HEAD
 
+   Only a body the server parses before checking the signature can be signed:
+   `application/json`, `application/x-www-form-urlencoded` and
+   `application/scim+json`. A POST, PATCH or PUT carrying any other body,
+   such as a `multipart/form-data` bulk import upload, is refused with `401`.
+
 2. **Client sends Authorization header:**
 
    ```

package/docs/usage/upgrading.md

@@ -4,6 +4,21 @@ What to check before deploying, newest first. Only releases that need a
 decision or a configuration change appear here; see the
 [CHANGELOG](../../CHANGELOG.md) for everything else.
 
+## To 0.13.2
+
+### HMAC refuses a body it cannot check
+
+**Who is affected:** a client of `core/auth/hmac` that sends a POST, PATCH or
+PUT body other than `application/json`, `application/x-www-form-urlencoded`
+or `application/scim+json` — in particular a bulk import upload
+(`multipart/form-data`).
+
+Such a body is read by its route after the signature is checked, so the
+signature never covered it. The request is now answered `401`, and the
+bundled browser client throws on a `FormData` body instead of signing it
+without its body. The bulk import API, whose upload its route reads, cannot
+be used under HMAC: use another authentication for it.
+
 ## To 0.13.0
 
 ### An OpenID Connect session ends with its access token

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ldap-rest",
-  "version": "0.13.1",
+  "version": "0.13.2",
   "description": "Light directory manager",
   "keywords": [
     "Identity-Manager"

package/static/browser/shared/utils/hmac.js

@@ -96,8 +96,9 @@ class HmacAuthClient {
                 body = options.body;
             }
             else if (options.body instanceof FormData) {
-                // For FormData, we can't easily sign it, so skip body hash
-                body = undefined;
+                // Its encoded bytes are not known here, and the server refuses a
+                // body it cannot check against the signature
+                throw new Error('A FormData body cannot be signed with HMAC');
             }
             else {
                 body = options.body;

package/static/browser/shared/utils/hmac.js.map

@@ -1 +1 @@
-{"version":3,"file":"hmac.js","sources":["../../../../../src/browser/shared/utils/hmac.ts"],"sourcesContent":[null],"names":[],"mappings":"AAAA;;;;AAIG;AAUH;;AAEG;AACH,eAAe,MAAM,CAAC,IAAY,EAAA;AAChC,IAAA,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE;IACjC,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;AACvC,IAAA,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC;AACpE,IAAA,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;IACxD,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;AACrE;AAEA;;AAEG;AACH,eAAe,UAAU,CAAC,MAAc,EAAE,OAAe,EAAA;AACvD,IAAA,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE;IACjC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;IACtC,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;;AAG3C,IAAA,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC7C,KAAK,EACL,OAAO,EACP,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT;;AAGD,IAAA,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,CAAC;AAC1E,IAAA,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;IAC5D,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;AAC1E;AAEA;;;;AAIG;AACI,eAAe,qBAAqB,CACzC,MAAc,EACd,MAAc,EACd,IAAY,EACZ,SAAiB,EACjB,IAAc,EAAA;;IAGd,IAAI,QAAQ,GAAG,EAAE;AACjB,IAAA,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,EAAE;AAExC,IAAA,IACE,IAAI;AACJ,SAAC,WAAW,KAAK,MAAM,IAAI,WAAW,KAAK,OAAO,IAAI,WAAW,KAAK,KAAK,CAAC,EAC5E;AACA,QAAA,MAAM,UAAU,GAAG,OAAO,IAAI,KAAK,QAAQ,GAAG,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;AACzE,QAAA,QAAQ,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC;IACrC;;IAGA,MAAM,aAAa,GAAG,CAAA,EAAG,WAAW,CAAA,CAAA,EAAI,IAAI,CAAA,CAAA,EAAI,SAAS,CAAA,CAAA,EAAI,QAAQ,CAAA,CAAE;;AAGvE,IAAA,OAAO,MAAM,UAAU,CAAC,MAAM,EAAE,aAAa,CAAC;AAChD;AAEA;;;AAGG;MACU,cAAc,CAAA;AAGzB,IAAA,WAAA,CAAY,MAAkB,EAAA;AAC5B,QAAA,IAAI,CAAC,MAAM,GAAG,MAAM;AAEpB,QAAA,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE;AAC1B,YAAA,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC;QAC3C;AAEA,QAAA,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE;AACzD,YAAA,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC;QAC/D;IACF;AAEA;;;;AAIG;AACH,IAAA,MAAM,aAAa,CACjB,MAAc,EACd,IAAY,EACZ,IAAc,EAAA;AAEd,QAAA,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;AAC5B,QAAA,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAC3C,IAAI,CAAC,MAAM,CAAC,MAAM,EAClB,MAAM,EACN,IAAI,EACJ,SAAS,EACT,IAAI,CACL;QAED,OAAO,CAAA,YAAA,EAAe,IAAI,CAAC,MAAM,CAAC,SAAS,CAAA,CAAA,EAAI,SAAS,CAAA,CAAA,EAAI,SAAS,CAAA,CAAE;IACzE;AAEA;;AAEG;AACK,IAAA,WAAW,CAAC,GAAW,EAAA;AAC7B,QAAA,IAAI;AACF,YAAA,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;AACnD,YAAA,OAAO,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM;QACxC;AAAE,QAAA,MAAM;;AAEN,YAAA,OAAO,GAAG;QACZ;IACF;AAEA;;AAEG;AACH,IAAA,MAAM,KAAK,CAAC,GAAW,EAAE,UAAuB,EAAE,EAAA;AAChD,QAAA,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,KAAK;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;;QAGlC,IAAI,IAAI,GAAY,SAAS;AAC7B,QAAA,IAAI,OAAO,CAAC,IAAI,EAAE;AAChB,YAAA,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE;AACpC,gBAAA,IAAI,GAAG,OAAO,CAAC,IAAI;YACrB;AAAO,iBAAA,IAAI,OAAO,CAAC,IAAI,YAAY,QAAQ,EAAE;;gBAE3C,IAAI,GAAG,SAAS;YAClB;iBAAO;AACL,gBAAA,IAAI,GAAG,OAAO,CAAC,IAAI;YACrB;QACF;AAEA,QAAA,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC;QAE/D,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;AAC5C,QAAA,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC;QAExC,OAAO,KAAK,CAAC,GAAG,EAAE;AAChB,YAAA,GAAG,OAAO;YACV,OAAO;AACR,SAAA,CAAC;IACJ;AAEA;;AAEG;IACK,kBAAkB,CACxB,IAAa,EACb,OAAgB,EAAA;QAEhB,IAAI,CAAC,IAAI,EAAE;AACT,YAAA,OAAO,SAAS;QAClB;AAEA,QAAA,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE;AAC5B,YAAA,OAAO,IAAI;QACb;AAEA,QAAA,IAAI,IAAI,YAAY,QAAQ,EAAE;AAC5B,YAAA,OAAO,IAAI;QACb;AAEA,QAAA,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE;AAC5B,YAAA,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC;AAC/C,YAAA,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAC7B;AAEA,QAAA,OAAO,SAAS;IAClB;AAEA;;AAEG;AACH,IAAA,MAAM,GAAG,CAAC,GAAW,EAAE,UAAuB,EAAE,EAAA;AAC9C,QAAA,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACvD;AAEA;;AAEG;IACH,MAAM,IAAI,CACR,GAAW,EACX,IAAc,EACd,UAAuB,EAAE,EAAA;QAEzB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;QAC5C,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC;AAE1D,QAAA,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;AACrB,YAAA,GAAG,OAAO;AACV,YAAA,MAAM,EAAE,MAAM;YACd,OAAO;AACP,YAAA,IAAI,EAAE,WAAW;AAClB,SAAA,CAAC;IACJ;AAEA;;AAEG;IACH,MAAM,GAAG,CACP,GAAW,EACX,IAAc,EACd,UAAuB,EAAE,EAAA;QAEzB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;QAC5C,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC;AAE1D,QAAA,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;AACrB,YAAA,GAAG,OAAO;AACV,YAAA,MAAM,EAAE,KAAK;YACb,OAAO;AACP,YAAA,IAAI,EAAE,WAAW;AAClB,SAAA,CAAC;IACJ;AAEA;;AAEG;AACH,IAAA,MAAM,MAAM,CAAC,GAAW,EAAE,UAAuB,EAAE,EAAA;AACjD,QAAA,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC1D;AAEA;;AAEG;IACH,MAAM,KAAK,CACT,GAAW,EACX,IAAc,EACd,UAAuB,EAAE,EAAA;QAEzB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;QAC5C,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC;AAE1D,QAAA,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;AACrB,YAAA,GAAG,OAAO;AACV,YAAA,MAAM,EAAE,OAAO;YACf,OAAO;AACP,YAAA,IAAI,EAAE,WAAW;AAClB,SAAA,CAAC;IACJ;AACD;AAED;;AAEG;AACG,SAAU,cAAc,CAAC,MAAc,EAAA;AAC3C,IAAA,OAAO,MAAM,CAAC,MAAM,IAAI,EAAE;AAC5B;AAEA;;;AAGG;AACI,eAAe,oBAAoB,CACxC,SAAiB,EAAE,EAAA;AAEnB,IAAA,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC;AACpC,IAAA,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC;AAC7B,IAAA,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;AAC/E;;;;"}
+{"version":3,"file":"hmac.js","sources":["../../../../../src/browser/shared/utils/hmac.ts"],"sourcesContent":[null],"names":[],"mappings":"AAAA;;;;AAIG;AAUH;;AAEG;AACH,eAAe,MAAM,CAAC,IAAY,EAAA;AAChC,IAAA,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE;IACjC,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;AACvC,IAAA,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC;AACpE,IAAA,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;IACxD,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;AACrE;AAEA;;AAEG;AACH,eAAe,UAAU,CAAC,MAAc,EAAE,OAAe,EAAA;AACvD,IAAA,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE;IACjC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;IACtC,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;;AAG3C,IAAA,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC7C,KAAK,EACL,OAAO,EACP,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT;;AAGD,IAAA,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,CAAC;AAC1E,IAAA,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;IAC5D,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;AAC1E;AAEA;;;;AAIG;AACI,eAAe,qBAAqB,CACzC,MAAc,EACd,MAAc,EACd,IAAY,EACZ,SAAiB,EACjB,IAAc,EAAA;;IAGd,IAAI,QAAQ,GAAG,EAAE;AACjB,IAAA,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,EAAE;AAExC,IAAA,IACE,IAAI;AACJ,SAAC,WAAW,KAAK,MAAM,IAAI,WAAW,KAAK,OAAO,IAAI,WAAW,KAAK,KAAK,CAAC,EAC5E;AACA,QAAA,MAAM,UAAU,GAAG,OAAO,IAAI,KAAK,QAAQ,GAAG,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;AACzE,QAAA,QAAQ,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC;IACrC;;IAGA,MAAM,aAAa,GAAG,CAAA,EAAG,WAAW,CAAA,CAAA,EAAI,IAAI,CAAA,CAAA,EAAI,SAAS,CAAA,CAAA,EAAI,QAAQ,CAAA,CAAE;;AAGvE,IAAA,OAAO,MAAM,UAAU,CAAC,MAAM,EAAE,aAAa,CAAC;AAChD;AAEA;;;AAGG;MACU,cAAc,CAAA;AAGzB,IAAA,WAAA,CAAY,MAAkB,EAAA;AAC5B,QAAA,IAAI,CAAC,MAAM,GAAG,MAAM;AAEpB,QAAA,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE;AAC1B,YAAA,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC;QAC3C;AAEA,QAAA,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE;AACzD,YAAA,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC;QAC/D;IACF;AAEA;;;;AAIG;AACH,IAAA,MAAM,aAAa,CACjB,MAAc,EACd,IAAY,EACZ,IAAc,EAAA;AAEd,QAAA,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;AAC5B,QAAA,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAC3C,IAAI,CAAC,MAAM,CAAC,MAAM,EAClB,MAAM,EACN,IAAI,EACJ,SAAS,EACT,IAAI,CACL;QAED,OAAO,CAAA,YAAA,EAAe,IAAI,CAAC,MAAM,CAAC,SAAS,CAAA,CAAA,EAAI,SAAS,CAAA,CAAA,EAAI,SAAS,CAAA,CAAE;IACzE;AAEA;;AAEG;AACK,IAAA,WAAW,CAAC,GAAW,EAAA;AAC7B,QAAA,IAAI;AACF,YAAA,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;AACnD,YAAA,OAAO,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM;QACxC;AAAE,QAAA,MAAM;;AAEN,YAAA,OAAO,GAAG;QACZ;IACF;AAEA;;AAEG;AACH,IAAA,MAAM,KAAK,CAAC,GAAW,EAAE,UAAuB,EAAE,EAAA;AAChD,QAAA,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,KAAK;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;;QAGlC,IAAI,IAAI,GAAY,SAAS;AAC7B,QAAA,IAAI,OAAO,CAAC,IAAI,EAAE;AAChB,YAAA,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE;AACpC,gBAAA,IAAI,GAAG,OAAO,CAAC,IAAI;YACrB;AAAO,iBAAA,IAAI,OAAO,CAAC,IAAI,YAAY,QAAQ,EAAE;;;AAG3C,gBAAA,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC;YAC/D;iBAAO;AACL,gBAAA,IAAI,GAAG,OAAO,CAAC,IAAI;YACrB;QACF;AAEA,QAAA,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC;QAE/D,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;AAC5C,QAAA,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC;QAExC,OAAO,KAAK,CAAC,GAAG,EAAE;AAChB,YAAA,GAAG,OAAO;YACV,OAAO;AACR,SAAA,CAAC;IACJ;AAEA;;AAEG;IACK,kBAAkB,CACxB,IAAa,EACb,OAAgB,EAAA;QAEhB,IAAI,CAAC,IAAI,EAAE;AACT,YAAA,OAAO,SAAS;QAClB;AAEA,QAAA,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE;AAC5B,YAAA,OAAO,IAAI;QACb;AAEA,QAAA,IAAI,IAAI,YAAY,QAAQ,EAAE;AAC5B,YAAA,OAAO,IAAI;QACb;AAEA,QAAA,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE;AAC5B,YAAA,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC;AAC/C,YAAA,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAC7B;AAEA,QAAA,OAAO,SAAS;IAClB;AAEA;;AAEG;AACH,IAAA,MAAM,GAAG,CAAC,GAAW,EAAE,UAAuB,EAAE,EAAA;AAC9C,QAAA,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACvD;AAEA;;AAEG;IACH,MAAM,IAAI,CACR,GAAW,EACX,IAAc,EACd,UAAuB,EAAE,EAAA;QAEzB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;QAC5C,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC;AAE1D,QAAA,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;AACrB,YAAA,GAAG,OAAO;AACV,YAAA,MAAM,EAAE,MAAM;YACd,OAAO;AACP,YAAA,IAAI,EAAE,WAAW;AAClB,SAAA,CAAC;IACJ;AAEA;;AAEG;IACH,MAAM,GAAG,CACP,GAAW,EACX,IAAc,EACd,UAAuB,EAAE,EAAA;QAEzB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;QAC5C,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC;AAE1D,QAAA,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;AACrB,YAAA,GAAG,OAAO;AACV,YAAA,MAAM,EAAE,KAAK;YACb,OAAO;AACP,YAAA,IAAI,EAAE,WAAW;AAClB,SAAA,CAAC;IACJ;AAEA;;AAEG;AACH,IAAA,MAAM,MAAM,CAAC,GAAW,EAAE,UAAuB,EAAE,EAAA;AACjD,QAAA,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC1D;AAEA;;AAEG;IACH,MAAM,KAAK,CACT,GAAW,EACX,IAAc,EACd,UAAuB,EAAE,EAAA;QAEzB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;QAC5C,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC;AAE1D,QAAA,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;AACrB,YAAA,GAAG,OAAO;AACV,YAAA,MAAM,EAAE,OAAO;YACf,OAAO;AACP,YAAA,IAAI,EAAE,WAAW;AAClB,SAAA,CAAC;IACJ;AACD;AAED;;AAEG;AACG,SAAU,cAAc,CAAC,MAAc,EAAA;AAC3C,IAAA,OAAO,MAAM,CAAC,MAAM,IAAI,EAAE;AAC5B;AAEA;;;AAGG;AACI,eAAe,oBAAoB,CACxC,SAAiB,EAAE,EAAA;AAEnB,IAAA,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC;AACpC,IAAA,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC;AAC7B,IAAA,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;AAC/E;;;;"}