libre-webui 0.22.0 → 0.23.0

package/backend/dist/services/authService.js

@@ -59,11 +59,32 @@ export const parseJwtLifetime = (value = process.env.JWT_EXPIRES_IN) => {
     return '7d';
 };
 export const JWT_EXPIRES_IN = parseJwtLifetime();
+/** The configured JWT lifetime in milliseconds. */
+export const jwtLifetimeMs = (lifetime = JWT_EXPIRES_IN) => {
+    if (typeof lifetime === 'number')
+        return lifetime * 1000;
+    const match = /^(\d+)(ms|s|m|h|d|w|y)$/i.exec(String(lifetime ?? '7d'));
+    if (!match)
+        return 7 * 24 * 60 * 60 * 1000;
+    const amount = Number.parseInt(match[1], 10);
+    const unit = match[2].toLowerCase();
+    const unitMs = {
+        ms: 1,
+        s: 1000,
+        m: 60000,
+        h: 3600000,
+        d: 86400000,
+        w: 7 * 86400000,
+        y: 365 * 86400000,
+    };
+    return amount * (unitMs[unit] ?? 86400000);
+};
 export class AuthService {
     /**
-     * Generate JWT token for user
+     * Generate JWT token for user. When a server-side session id is provided
+     * the token carries it as `sid`, making the token revocable.
      */
-    generateToken(user) {
+    generateToken(user, sessionId) {
         if (user.status !== 'active') {
             throw new Error('Cannot create a session for an inactive account');
         }
@@ -71,9 +92,20 @@ export class AuthService {
             userId: user.id,
             username: user.username,
             role: user.role,
+            ...(sessionId ? { sid: sessionId } : {}),
         };
         return jwt.sign(payload, JWT_SECRET, { expiresIn: JWT_EXPIRES_IN });
     }
+    /**
+     * Create a server-side auth session and mint the JWT bound to it. All
+     * login paths (password, signup bootstrap, OAuth, OIDC) issue through
+     * here so every new token is revocable from the session inventory.
+     */
+    async issueSession(user, metadata) {
+        const { createAuthSession } = await import('./authSessionService.js');
+        const session = await createAuthSession(user.id, metadata, Date.now() + jwtLifetimeMs());
+        return this.generateToken(user, session.id);
+    }
     /**
      * Verify JWT token
      */
@@ -94,7 +126,7 @@ export class AuthService {
     /**
      * Login user
      */
-    async login(username, password) {
+    async login(username, password, metadata) {
         const user = await userModel.verifyPassword(username, password);
         if (!user)
             return null;
@@ -104,7 +136,10 @@ export class AuthService {
         if (userPublic.status !== 'active') {
             return { status: 'pending', user: userPublic };
         }
-        const token = this.generateToken(userPublic);
+        const token = await this.issueSession(userPublic, {
+            kind: 'password',
+            ...metadata,
+        });
         return { status: 'authenticated', user: userPublic, token };
     }
     /**
@@ -152,7 +187,7 @@ export class AuthService {
     /**
      * Signup user
      */
-    async signup(username, password, email) {
+    async signup(username, password, email, metadata) {
         try {
             if (!(await this.canCreateLocalAccount())) {
                 logger.warn('Blocked account creation because registration is disabled');
@@ -175,7 +210,10 @@ export class AuthService {
             if (user.status === 'pending') {
                 return { status: 'pending', user };
             }
-            const token = this.generateToken(user);
+            const token = await this.issueSession(user, {
+                kind: 'signup',
+                ...metadata,
+            });
             return { status: 'authenticated', user, token };
         }
         catch (error) {

package/backend/dist/services/authService.js.map

@@ -1 +1 @@
-{"version":3,"file":"authService.js","sourceRoot":"","sources":["../../src/services/authService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,GAAyB,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,SAAS,EAAc,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAE,gBAAgB,EAAyB,MAAM,uBAAuB,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EACL,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAE5D,MAAM,MAAM,GAAG,YAAY,CAAC,uBAAuB,CAAC,CAAC;AAErD,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AAEtC,iCAAiC;AACjC,IAAI,cAAc,GAAG,OAAO,CAAC;AAC7B,IAAI,CAAC;IACH,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;IACpE,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;IACtE,cAAc,GAAG,WAAW,CAAC,OAAO,CAAC;AACvC,CAAC;AAAC,OAAO,MAAM,EAAE,CAAC;IAChB,MAAM,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;AACzE,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,MAAM,UAAU,GACrB,OAAO,CAAC,GAAG,CAAC,UAAU;IACtB,CAAC,GAAG,EAAE;QACJ,MAAM,eAAe,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACxD,MAAM,CAAC,IAAI,CACT,wEAAwE,CACzE,CAAC;QACF,MAAM,CAAC,IAAI,CACT,4FAA4F,CAC7F,CAAC;QACF,OAAO,eAAe,CAAC;IACzB,CAAC,CAAC,EAAE,CAAC;AAEP,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,EACR,EAAE;IAC5B,MAAM,UAAU,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IACjC,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACrE,IAAI,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAChD,OAAO,UAAsC,CAAC;IAChD,CAAC;IACD,MAAM,CAAC,IAAI,CACT,0CAA0C,UAAU,cAAc,CACnE,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,gBAAgB,EAAE,CAAC;AAwBjD,MAAM,OAAO,WAAW;IACtB;;OAEG;IACH,aAAa,CAAC,IAAgB;QAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,OAAO,GAAG;YACd,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC;QAEF,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC;IACtE,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,KAAa;QACvB,IAAI,CAAC;YACH,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAqB,CAAC;QAC3D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,0EAA0E;YAC1E,mEAAmE;YACnE,yEAAyE;YACzE,IAAI,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBAC9C,MAAM,CAAC,KAAK,CACV,sCAAsC,EACtC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAC/C,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK,CAAC,QAAgB,EAAE,QAAgB;QAC5C,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAChE,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC;QAC7B,IAAI,UAAU,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACnC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QACjD,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QAC7C,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC9D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa;QACjB,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,YAAY,EAAE,CAAC;QAEjD,OAAO;YACL,YAAY,EAAE,IAAI,EAAE,+BAA+B;YACnD,QAAQ,EAAE,SAAS,GAAG,CAAC;YACvB,SAAS;YACT,aAAa,EAAE,qBAAqB,CAAC,SAAS,CAAC;YAC/C,aAAa,EAAE,MAAM,gBAAgB,EAAE;YACvC,OAAO,EAAE,cAAc;YACvB,SAAS,EAAE,gBAAgB,CAAC,eAAe,EAAE;SAC9C,CAAC;IACJ,CAAC;IAED,+DAA+D;IAC/D,2BAA2B;QACzB,OAAO,2BAA2B,EAAE,CAAC;IACvC,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,qBAAqB;QACzB,OAAO,qBAAqB,CAAC,MAAM,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CAAC,KAAa;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAE1B,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACzD,OAAO,IAAI,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACjD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,iBAAiB,CAAC,QAAgB;QACtC,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,OAAO,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,QAAgB,EAChB,QAAgB,EAChB,KAAc;QAEd,IAAI,CAAC;YACH,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAC,EAAE,CAAC;gBAC1C,MAAM,CAAC,IAAI,CACT,2DAA2D,CAC5D,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC;gBAChD,MAAM,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;gBACrE,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,QAAQ,GAAG;gBACf,QAAQ;gBACR,QAAQ;gBACR,KAAK,EAAE,KAAK,IAAI,IAAI,EAAE,mCAAmC;aAC1D,CAAC;YAEF,uEAAuE;YACvE,wEAAwE;YACxE,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,gBAAgB,CAC3C,QAAQ,EACR,IAAI,CAAC,2BAA2B,EAAE,CACnC,CAAC;YACF,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YAEvB,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC9B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YACrC,CAAC;YAED,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;YACvC,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAClD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;YACrC,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC"}
+{"version":3,"file":"authService.js","sourceRoot":"","sources":["../../src/services/authService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,GAAyB,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,SAAS,EAAc,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAE,gBAAgB,EAAyB,MAAM,uBAAuB,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EACL,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAE5D,MAAM,MAAM,GAAG,YAAY,CAAC,uBAAuB,CAAC,CAAC;AAErD,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AAEtC,iCAAiC;AACjC,IAAI,cAAc,GAAG,OAAO,CAAC;AAC7B,IAAI,CAAC;IACH,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;IACpE,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;IACtE,cAAc,GAAG,WAAW,CAAC,OAAO,CAAC;AACvC,CAAC;AAAC,OAAO,MAAM,EAAE,CAAC;IAChB,MAAM,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;AACzE,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,MAAM,UAAU,GACrB,OAAO,CAAC,GAAG,CAAC,UAAU;IACtB,CAAC,GAAG,EAAE;QACJ,MAAM,eAAe,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACxD,MAAM,CAAC,IAAI,CACT,wEAAwE,CACzE,CAAC;QACF,MAAM,CAAC,IAAI,CACT,4FAA4F,CAC7F,CAAC;QACF,OAAO,eAAe,CAAC;IACzB,CAAC,CAAC,EAAE,CAAC;AAEP,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,EACR,EAAE;IAC5B,MAAM,UAAU,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IACjC,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACrE,IAAI,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAChD,OAAO,UAAsC,CAAC;IAChD,CAAC;IACD,MAAM,CAAC,IAAI,CACT,0CAA0C,UAAU,cAAc,CACnE,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,gBAAgB,EAAE,CAAC;AAEjD,mDAAmD;AACnD,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,QAAQ,GAA6B,cAAc,EAC3C,EAAE;IACV,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,QAAQ,GAAG,IAAI,CAAC;IACzD,MAAM,KAAK,GAAG,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,MAAM,GAA2B;QACrC,EAAE,EAAE,CAAC;QACL,CAAC,EAAE,IAAI;QACP,CAAC,EAAE,KAAM;QACT,CAAC,EAAE,OAAS;QACZ,CAAC,EAAE,QAAU;QACb,CAAC,EAAE,CAAC,GAAG,QAAU;QACjB,CAAC,EAAE,GAAG,GAAG,QAAU;KACpB,CAAC;IACF,OAAO,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,QAAU,CAAC,CAAC;AAC/C,CAAC,CAAC;AAgCF,MAAM,OAAO,WAAW;IACtB;;;OAGG;IACH,aAAa,CAAC,IAAgB,EAAE,SAAkB;QAChD,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,OAAO,GAAG;YACd,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzC,CAAC;QAEF,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC;IACtE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY,CAChB,IAAgB,EAChB,QAAyB;QAEzB,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;QACtE,MAAM,OAAO,GAAG,MAAM,iBAAiB,CACrC,IAAI,CAAC,EAAE,EACP,QAAQ,EACR,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,EAAE,CAC7B,CAAC;QACF,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,KAAa;QACvB,IAAI,CAAC;YACH,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAqB,CAAC;QAC3D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,0EAA0E;YAC1E,mEAAmE;YACnE,yEAAyE;YACzE,IAAI,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBAC9C,MAAM,CAAC,KAAK,CACV,sCAAsC,EACtC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAC/C,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK,CACT,QAAgB,EAChB,QAAgB,EAChB,QAA0B;QAE1B,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAChE,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC;QAC7B,IAAI,UAAU,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACnC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QACjD,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE;YAChD,IAAI,EAAE,UAAU;YAChB,GAAG,QAAQ;SACZ,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC9D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa;QACjB,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,YAAY,EAAE,CAAC;QAEjD,OAAO;YACL,YAAY,EAAE,IAAI,EAAE,+BAA+B;YACnD,QAAQ,EAAE,SAAS,GAAG,CAAC;YACvB,SAAS;YACT,aAAa,EAAE,qBAAqB,CAAC,SAAS,CAAC;YAC/C,aAAa,EAAE,MAAM,gBAAgB,EAAE;YACvC,OAAO,EAAE,cAAc;YACvB,SAAS,EAAE,gBAAgB,CAAC,eAAe,EAAE;SAC9C,CAAC;IACJ,CAAC;IAED,+DAA+D;IAC/D,2BAA2B;QACzB,OAAO,2BAA2B,EAAE,CAAC;IACvC,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,qBAAqB;QACzB,OAAO,qBAAqB,CAAC,MAAM,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CAAC,KAAa;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAE1B,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACzD,OAAO,IAAI,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACjD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,iBAAiB,CAAC,QAAgB;QACtC,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,OAAO,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,QAAgB,EAChB,QAAgB,EAChB,KAAc,EACd,QAA0B;QAE1B,IAAI,CAAC;YACH,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAC,EAAE,CAAC;gBAC1C,MAAM,CAAC,IAAI,CACT,2DAA2D,CAC5D,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC;gBAChD,MAAM,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;gBACrE,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,QAAQ,GAAG;gBACf,QAAQ;gBACR,QAAQ;gBACR,KAAK,EAAE,KAAK,IAAI,IAAI,EAAE,mCAAmC;aAC1D,CAAC;YAEF,uEAAuE;YACvE,wEAAwE;YACxE,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,gBAAgB,CAC3C,QAAQ,EACR,IAAI,CAAC,2BAA2B,EAAE,CACnC,CAAC;YACF,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YAEvB,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC9B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YACrC,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE;gBAC1C,IAAI,EAAE,QAAQ;gBACd,GAAG,QAAQ;aACZ,CAAC,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAClD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;YACrC,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC"}

package/backend/dist/services/authSessionService.d.ts

@@ -0,0 +1,34 @@
+import type { StoredAuthSessionRecord } from '../persistence/index.js';
+export declare const SESSION_REVOCATION_TOPIC = "security.sessions.revoked.v1";
+export interface SessionRevocationEvent {
+    version: 1;
+    userId: string;
+    sessionIds: string[];
+}
+export interface SessionIssueMetadata {
+    kind: string;
+    ip?: string | undefined;
+    userAgent?: string | undefined;
+}
+type SessionRevocationListener = (event: SessionRevocationEvent) => void;
+/** Register for advisory revocation events (e.g. to close live sockets). */
+export declare const registerSessionRevocationListener: (listener: SessionRevocationListener) => (() => void);
+export declare const ensureSessionRevocationSubscription: () => Promise<void>;
+export declare const createAuthSession: (userId: string, metadata: SessionIssueMetadata, expiresAt: number) => Promise<StoredAuthSessionRecord>;
+/** A session usable for authentication right now, or null. */
+export declare const getValidSession: (sessionId: string) => Promise<StoredAuthSessionRecord | null>;
+export declare const touchSessionThrottled: (record: StoredAuthSessionRecord) => Promise<void>;
+export declare const listSessionsForUser: (userId: string) => Promise<StoredAuthSessionRecord[]>;
+export declare const findSessionById: (sessionId: string) => Promise<StoredAuthSessionRecord | null>;
+export declare const revokeAuthSession: (sessionId: string, revokedBy: string) => Promise<boolean>;
+/**
+ * Revoke every session for a user (optionally sparing the current one).
+ * Also stamps the invalid-before epoch so legacy tokens without a session
+ * id are rejected too.
+ */
+export declare const revokeAllAuthSessions: (userId: string, revokedBy: string, exceptSessionId?: string) => Promise<string[]>;
+/** Epoch (ms) before which any token for this user is rejected. */
+export declare const getTokenInvalidBefore: (userId: string) => Promise<number>;
+export declare const closeSessionRevocationSubscription: () => Promise<void>;
+export {};
+//# sourceMappingURL=authSessionService.d.ts.map

package/backend/dist/services/authSessionService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authSessionService.d.ts","sourceRoot":"","sources":["../../src/services/authSessionService.ts"],"names":[],"mappings":"AAwCA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAOvE,eAAO,MAAM,wBAAwB,iCAAiC,CAAC;AAEvE,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,CAAC,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC;AASD,KAAK,yBAAyB,GAAG,CAAC,KAAK,EAAE,sBAAsB,KAAK,IAAI,CAAC;AA8BzE,4EAA4E;AAC5E,eAAO,MAAM,iCAAiC,aAClC,yBAAyB,KAClC,CAAC,MAAM,IAAI,CAGb,CAAC;AAEF,eAAO,MAAM,mCAAmC,QAAa,OAAO,CAAC,IAAI,CAkBxE,CAAC;AAwCF,eAAO,MAAM,iBAAiB,WACpB,MAAM,YACJ,oBAAoB,aACnB,MAAM,KAChB,OAAO,CAAC,uBAAuB,CAoBjC,CAAC;AAEF,8DAA8D;AAC9D,eAAO,MAAM,eAAe,cACf,MAAM,KAChB,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAOxC,CAAC;AAEF,eAAO,MAAM,qBAAqB,WACxB,uBAAuB,KAC9B,OAAO,CAAC,IAAI,CAMd,CAAC;AAEF,eAAO,MAAM,mBAAmB,WACtB,MAAM,KACb,OAAO,CAAC,uBAAuB,EAAE,CACQ,CAAC;AAE7C,eAAO,MAAM,eAAe,cACf,MAAM,KAChB,OAAO,CAAC,uBAAuB,GAAG,IAAI,CACI,CAAC;AAE9C,eAAO,MAAM,iBAAiB,cACjB,MAAM,aACN,MAAM,KAChB,OAAO,CAAC,OAAO,CAUjB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,WACxB,MAAM,aACH,MAAM,oBACC,MAAM,KACvB,OAAO,CAAC,MAAM,EAAE,CAalB,CAAC;AAEF,mEAAmE;AACnE,eAAO,MAAM,qBAAqB,WACxB,MAAM,KACb,OAAO,CAAC,MAAM,CAIhB,CAAC;AAEF,eAAO,MAAM,kCAAkC,QAAa,OAAO,CAAC,IAAI,CAKvE,CAAC"}

package/backend/dist/services/authSessionService.js

@@ -0,0 +1,205 @@
+/*
+ * Libre WebUI
+ * Copyright (C) 2025 Kroonen AI, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Server-side auth sessions (IAM-04).
+ *
+ * Every issued JWT is bound to an `auth_sessions` row through its `sid`
+ * claim. The database is authoritative: a revoked or expired row makes the
+ * token unusable on the next request regardless of the JWT lifetime. The
+ * coordinator topic is an advisory fan-out that lets other replicas and live
+ * WebSocket connections react immediately.
+ *
+ * Tokens issued before this feature carry no `sid`. They stay valid until
+ * expiry unless the user (or an administrator) revokes all sessions, which
+ * also records a per-user invalid-before timestamp that rejects any token
+ * minted earlier — so "sign out everywhere" is complete even for legacy
+ * tokens.
+ */
+import { randomUUID } from 'node:crypto';
+import { getInitializedCoordinator } from '../platform/coordination/service.js';
+import { getPersistence } from '../persistence/index.js';
+import { encryptionService } from './encryptionService.js';
+import { getSystemSetting, setSystemSetting } from './systemSettingsService.js';
+import { createLogger } from '../utils/logger.js';
+const logger = createLogger('services:auth-sessions');
+export const SESSION_REVOCATION_TOPIC = 'security.sessions.revoked.v1';
+const LAST_SEEN_THROTTLE_MS = 60000;
+const PURGE_EVERY_N_READS = 1000;
+let readsSincePurge = 0;
+const invalidBeforeKey = (userId) => `auth_token_invalid_before:${userId}`;
+const listeners = new Set();
+let subscription;
+const isRevocationEvent = (value) => {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const candidate = value;
+    return (candidate.version === 1 &&
+        typeof candidate.userId === 'string' &&
+        Array.isArray(candidate.sessionIds) &&
+        candidate.sessionIds.every(id => typeof id === 'string'));
+};
+const dispatch = (event) => {
+    for (const listener of [...listeners]) {
+        try {
+            listener(event);
+        }
+        catch {
+            // The database stays authoritative; a broken consumer must not stop
+            // other live connections from being closed.
+            logger.warn('A session revocation listener failed');
+        }
+    }
+};
+/** Register for advisory revocation events (e.g. to close live sockets). */
+export const registerSessionRevocationListener = (listener) => {
+    listeners.add(listener);
+    return () => listeners.delete(listener);
+};
+export const ensureSessionRevocationSubscription = async () => {
+    const coordinator = getInitializedCoordinator();
+    if (!coordinator)
+        return;
+    if (subscription?.coordinator === coordinator)
+        return;
+    const previous = subscription;
+    subscription = undefined;
+    if (previous)
+        await previous.unsubscribe().catch(() => undefined);
+    const unsubscribe = await coordinator.subscribe(SESSION_REVOCATION_TOPIC, event => {
+        if (!isRevocationEvent(event.payload)) {
+            logger.warn('Ignoring an invalid session revocation message');
+            return;
+        }
+        dispatch(event.payload);
+    });
+    subscription = { coordinator, unsubscribe };
+};
+const publishRevocation = async (userId, sessionIds) => {
+    const event = { version: 1, userId, sessionIds };
+    // Local listeners first: revocation must reach this replica's sockets even
+    // when the coordinator is degraded.
+    dispatch(event);
+    try {
+        const coordinator = getInitializedCoordinator();
+        if (!coordinator)
+            return;
+        await ensureSessionRevocationSubscription();
+        await coordinator.publish(SESSION_REVOCATION_TOPIC, event);
+        await coordinator.revoke(`user-sessions:${userId}`).catch(() => undefined);
+    }
+    catch {
+        // The revoked rows are already committed; every replica enforces them on
+        // its next database read even without the advisory fan-out.
+        logger.warn('Session revocation publication failed');
+    }
+};
+const security = () => getPersistence(encryptionService).repositories.security;
+const purgeOpportunistically = async () => {
+    readsSincePurge += 1;
+    if (readsSincePurge < PURGE_EVERY_N_READS)
+        return;
+    readsSincePurge = 0;
+    try {
+        // Keep expired rows for seven days so the session inventory can show
+        // recently expired devices before they disappear.
+        await security().authSessions.deleteExpired(Date.now() - 7 * 24 * 60 * 60 * 1000);
+    }
+    catch (error) {
+        logger.warn('Expired session purge failed', { error });
+    }
+};
+export const createAuthSession = async (userId, metadata, expiresAt) => {
+    const now = Date.now();
+    const record = {
+        id: randomUUID(),
+        user_id: userId,
+        kind: metadata.kind,
+        ip_hash: null,
+        user_agent: metadata.userAgent?.slice(0, 256) ?? null,
+        created_at: now,
+        last_seen_at: now,
+        expires_at: expiresAt,
+        revoked_at: null,
+        revoked_by: null,
+    };
+    if (metadata.ip) {
+        const { hashClientIp } = await import('./securityAuditService.js');
+        record.ip_hash = hashClientIp(metadata.ip);
+    }
+    await security().authSessions.insert(record);
+    return record;
+};
+/** A session usable for authentication right now, or null. */
+export const getValidSession = async (sessionId) => {
+    const record = await security().authSessions.findById(sessionId);
+    await purgeOpportunistically();
+    if (!record)
+        return null;
+    if (record.revoked_at !== null)
+        return null;
+    if (record.expires_at <= Date.now())
+        return null;
+    return record;
+};
+export const touchSessionThrottled = async (record) => {
+    const now = Date.now();
+    if (now - record.last_seen_at < LAST_SEEN_THROTTLE_MS)
+        return;
+    await security()
+        .authSessions.touch(record.id, now)
+        .catch(() => undefined);
+};
+export const listSessionsForUser = (userId) => security().authSessions.listByUser(userId);
+export const findSessionById = (sessionId) => security().authSessions.findById(sessionId);
+export const revokeAuthSession = async (sessionId, revokedBy) => {
+    const record = await security().authSessions.findById(sessionId);
+    if (!record)
+        return false;
+    const revoked = await security().authSessions.revoke(sessionId, Date.now(), revokedBy);
+    if (revoked)
+        await publishRevocation(record.user_id, [sessionId]);
+    return revoked;
+};
+/**
+ * Revoke every session for a user (optionally sparing the current one).
+ * Also stamps the invalid-before epoch so legacy tokens without a session
+ * id are rejected too.
+ */
+export const revokeAllAuthSessions = async (userId, revokedBy, exceptSessionId) => {
+    const revokedIds = await security().authSessions.revokeAllForUser(userId, Date.now(), revokedBy, exceptSessionId);
+    if (!exceptSessionId) {
+        // A full sign-out invalidates sid-less legacy tokens as well.
+        await setSystemSetting(invalidBeforeKey(userId), String(Date.now()));
+    }
+    if (revokedIds.length > 0)
+        await publishRevocation(userId, revokedIds);
+    return revokedIds;
+};
+/** Epoch (ms) before which any token for this user is rejected. */
+export const getTokenInvalidBefore = async (userId) => {
+    const value = await getSystemSetting(invalidBeforeKey(userId));
+    const parsed = Number.parseInt(value ?? '', 10);
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : 0;
+};
+export const closeSessionRevocationSubscription = async () => {
+    const current = subscription;
+    subscription = undefined;
+    listeners.clear();
+    if (current)
+        await current.unsubscribe().catch(() => undefined);
+};
+//# sourceMappingURL=authSessionService.js.map

package/backend/dist/services/authSessionService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authSessionService.js","sourceRoot":"","sources":["../../src/services/authSessionService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAKzC,OAAO,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAEzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAChF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,MAAM,GAAG,YAAY,CAAC,wBAAwB,CAAC,CAAC;AAEtD,MAAM,CAAC,MAAM,wBAAwB,GAAG,8BAA8B,CAAC;AAcvE,MAAM,qBAAqB,GAAG,KAAM,CAAC;AACrC,MAAM,mBAAmB,GAAG,IAAK,CAAC;AAClC,IAAI,eAAe,GAAG,CAAC,CAAC;AAExB,MAAM,gBAAgB,GAAG,CAAC,MAAc,EAAU,EAAE,CAClD,6BAA6B,MAAM,EAAE,CAAC;AAIxC,MAAM,SAAS,GAAG,IAAI,GAAG,EAA6B,CAAC;AACvD,IAAI,YAES,CAAC;AAEd,MAAM,iBAAiB,GAAG,CAAC,KAAc,EAAmC,EAAE;IAC5E,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9E,MAAM,SAAS,GAAG,KAAgC,CAAC;IACnD,OAAO,CACL,SAAS,CAAC,OAAO,KAAK,CAAC;QACvB,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ;QACpC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC;QACnC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,CAAC,CACzD,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,QAAQ,GAAG,CAAC,KAA6B,EAAQ,EAAE;IACvD,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,SAAS,CAAC,EAAE,CAAC;QACtC,IAAI,CAAC;YACH,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;YACpE,4CAA4C;YAC5C,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;AACH,CAAC,CAAC;AAEF,4EAA4E;AAC5E,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAC/C,QAAmC,EACrB,EAAE;IAChB,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACxB,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAC1C,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,mCAAmC,GAAG,KAAK,IAAmB,EAAE;IAC3E,MAAM,WAAW,GAAG,yBAAyB,EAAE,CAAC;IAChD,IAAI,CAAC,WAAW;QAAE,OAAO;IACzB,IAAI,YAAY,EAAE,WAAW,KAAK,WAAW;QAAE,OAAO;IACtD,MAAM,QAAQ,GAAG,YAAY,CAAC;IAC9B,YAAY,GAAG,SAAS,CAAC;IACzB,IAAI,QAAQ;QAAE,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAClE,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,SAAS,CAC7C,wBAAwB,EACxB,KAAK,CAAC,EAAE;QACN,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACtC,MAAM,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QACD,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC,CACF,CAAC;IACF,YAAY,GAAG,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;AAC9C,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,KAAK,EAC7B,MAAc,EACd,UAAoB,EACL,EAAE;IACjB,MAAM,KAAK,GAA2B,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IACzE,2EAA2E;IAC3E,oCAAoC;IACpC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,yBAAyB,EAAE,CAAC;QAChD,IAAI,CAAC,WAAW;YAAE,OAAO;QACzB,MAAM,mCAAmC,EAAE,CAAC;QAC5C,MAAM,WAAW,CAAC,OAAO,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;QAC3D,MAAM,WAAW,CAAC,MAAM,CAAC,iBAAiB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,4DAA4D;QAC5D,MAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;IACvD,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC;AAE/E,MAAM,sBAAsB,GAAG,KAAK,IAAmB,EAAE;IACvD,eAAe,IAAI,CAAC,CAAC;IACrB,IAAI,eAAe,GAAG,mBAAmB;QAAE,OAAO;IAClD,eAAe,GAAG,CAAC,CAAC;IACpB,IAAI,CAAC;QACH,qEAAqE;QACrE,kDAAkD;QAClD,MAAM,QAAQ,EAAE,CAAC,YAAY,CAAC,aAAa,CACzC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CACrC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACzD,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EACpC,MAAc,EACd,QAA8B,EAC9B,SAAiB,EACiB,EAAE;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAA4B;QACtC,EAAE,EAAE,UAAU,EAAE;QAChB,OAAO,EAAE,MAAM;QACf,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,OAAO,EAAE,IAAI;QACb,UAAU,EAAE,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,IAAI;QACrD,UAAU,EAAE,GAAG;QACf,YAAY,EAAE,GAAG;QACjB,UAAU,EAAE,SAAS;QACrB,UAAU,EAAE,IAAI;QAChB,UAAU,EAAE,IAAI;KACjB,CAAC;IACF,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;QAChB,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;QACnE,MAAM,CAAC,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,QAAQ,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7C,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,8DAA8D;AAC9D,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAClC,SAAiB,EACwB,EAAE;IAC3C,MAAM,MAAM,GAAG,MAAM,QAAQ,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACjE,MAAM,sBAAsB,EAAE,CAAC;IAC/B,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC;IACjD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,EACxC,MAA+B,EAChB,EAAE;IACjB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,GAAG,GAAG,MAAM,CAAC,YAAY,GAAG,qBAAqB;QAAE,OAAO;IAC9D,MAAM,QAAQ,EAAE;SACb,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC;SAClC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAC5B,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,MAAc,EACsB,EAAE,CACtC,QAAQ,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAE7C,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,SAAiB,EACwB,EAAE,CAC3C,QAAQ,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AAE9C,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EACpC,SAAiB,EACjB,SAAiB,EACC,EAAE;IACpB,MAAM,MAAM,GAAG,MAAM,QAAQ,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACjE,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,OAAO,GAAG,MAAM,QAAQ,EAAE,CAAC,YAAY,CAAC,MAAM,CAClD,SAAS,EACT,IAAI,CAAC,GAAG,EAAE,EACV,SAAS,CACV,CAAC;IACF,IAAI,OAAO;QAAE,MAAM,iBAAiB,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IAClE,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,EACxC,MAAc,EACd,SAAiB,EACjB,eAAwB,EACL,EAAE;IACrB,MAAM,UAAU,GAAG,MAAM,QAAQ,EAAE,CAAC,YAAY,CAAC,gBAAgB,CAC/D,MAAM,EACN,IAAI,CAAC,GAAG,EAAE,EACV,SAAS,EACT,eAAe,CAChB,CAAC;IACF,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,8DAA8D;QAC9D,MAAM,gBAAgB,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,iBAAiB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACvE,OAAO,UAAU,CAAC;AACpB,CAAC,CAAC;AAEF,mEAAmE;AACnE,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,EACxC,MAAc,EACG,EAAE;IACnB,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,kCAAkC,GAAG,KAAK,IAAmB,EAAE;IAC1E,MAAM,OAAO,GAAG,YAAY,CAAC;IAC7B,YAAY,GAAG,SAAS,CAAC;IACzB,SAAS,CAAC,KAAK,EAAE,CAAC;IAClB,IAAI,OAAO;QAAE,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAClE,CAAC,CAAC"}

package/backend/dist/services/authorizationService.d.ts

@@ -0,0 +1,64 @@
+import type { ArchiveOwnedResource, GrantPermission, StoredResourceGrantRecord } from '../persistence/index.js';
+export type AuthzAction = 'read' | 'write' | 'manage' | 'use';
+export type FeatureId = 'work' | 'model-download' | 'web-search' | 'agents';
+/** Grantable resource families reuse the portable-archive taxonomy. */
+export type ShareableResourceType = ArchiveOwnedResource;
+export declare const SHAREABLE_RESOURCE_TYPES: readonly ShareableResourceType[];
+export declare const isShareableResourceType: (value: unknown) => value is ShareableResourceType;
+export interface AuthzActor {
+    userId: string;
+    role?: string | undefined;
+    status?: string | undefined;
+}
+export type AuthzResource = {
+    type: 'feature';
+    id: FeatureId;
+} | {
+    type: ShareableResourceType;
+    id: string;
+    ownerUserId?: string;
+};
+export interface AuthzDecision {
+    allowed: boolean;
+    reason: string;
+}
+export declare class AuthorizationError extends Error {
+    readonly statusCode = 403;
+    constructor(message?: string);
+}
+/** Group memberships resolved fresh so removals apply immediately. */
+export declare const resolveGroupIdsForUser: (userId: string) => Promise<string[]>;
+/** Effective grants a user holds on a resource, via user and group rows. */
+export declare const effectiveGrantsFor: (userId: string, resourceType: ShareableResourceType, resourceId: string) => Promise<StoredResourceGrantRecord[]>;
+export declare const authorize: (actor: AuthzActor, action: AuthzAction, resource: AuthzResource) => Promise<AuthzDecision>;
+/** Throwing variant for route and service guards. */
+export declare const requireAuthorized: (actor: AuthzActor, action: AuthzAction, resource: AuthzResource) => Promise<AuthzDecision>;
+export interface EffectiveAccessView {
+    userId: string;
+    role: string | null;
+    status: string | null;
+    groups: Array<{
+        id: string;
+        name: string;
+    }>;
+    features: Record<FeatureId, boolean>;
+    grants: Array<{
+        id: string;
+        resourceType: string;
+        resourceId: string;
+        permission: GrantPermission;
+        via: 'user' | 'group';
+        principalId: string;
+    }>;
+}
+/**
+ * "Why can this user access this?" — the complete effective-access picture
+ * for one user: role, groups, feature gates, and every grant that reaches
+ * them directly or through a group.
+ */
+export declare const explainEffectiveAccess: (user: {
+    id: string;
+    role?: string;
+    status?: string;
+}) => Promise<EffectiveAccessView>;
+//# sourceMappingURL=authorizationService.d.ts.map

package/backend/dist/services/authorizationService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorizationService.d.ts","sourceRoot":"","sources":["../../src/services/authorizationService.ts"],"names":[],"mappings":"AAqCA,OAAO,KAAK,EACV,oBAAoB,EACpB,eAAe,EACf,yBAAyB,EAC1B,MAAM,yBAAyB,CAAC;AAOjC,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE9D,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,gBAAgB,GAAG,YAAY,GAAG,QAAQ,CAAC;AAE5E,uEAAuE;AACvE,MAAM,MAAM,qBAAqB,GAAG,oBAAoB,CAAC;AAEzD,eAAO,MAAM,wBAAwB,EAAE,SAAS,qBAAqB,EAOpE,CAAC;AAEF,eAAO,MAAM,uBAAuB,UAC3B,OAAO,KACb,KAAK,IAAI,qBAEqD,CAAC;AAElE,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,EAAE,EAAE,SAAS,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,qBAAqB,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtE,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,UAAU,OAAO;IAC1B,YAAY,OAAO,SAAkB,EAGpC;CACF;AAOD,sEAAsE;AACtE,eAAO,MAAM,sBAAsB,WAAY,MAAM,KAAG,OAAO,CAAC,MAAM,EAAE,CACzB,CAAC;AAoChD,4EAA4E;AAC5E,eAAO,MAAM,kBAAkB,WACrB,MAAM,gBACA,qBAAqB,cACvB,MAAM,KACjB,OAAO,CAAC,yBAAyB,EAAE,CAQrC,CAAC;AAEF,eAAO,MAAM,SAAS,UACb,UAAU,UACT,WAAW,YACT,aAAa,KACtB,OAAO,CAAC,aAAa,CAsCvB,CAAC;AAEF,qDAAqD;AACrD,eAAO,MAAM,iBAAiB,UACrB,UAAU,UACT,WAAW,YACT,aAAa,KACtB,OAAO,CAAC,aAAa,CAIvB,CAAC;AAEF,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5C,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACrC,MAAM,EAAE,KAAK,CAAC;QACZ,EAAE,EAAE,MAAM,CAAC;QACX,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;QACnB,UAAU,EAAE,eAAe,CAAC;QAC5B,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QACtB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC,CAAC;CACJ;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,SAAgB;IACjD,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,KAAG,OAAO,CAAC,mBAAmB,CA2C9B,CAAC"}

package/backend/dist/services/authorizationService.js

@@ -0,0 +1,176 @@
+/*
+ * Libre WebUI
+ * Copyright (C) 2025 Kroonen AI, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Central authorization (IAM-01).
+ *
+ * One decision point for feature gates and shareable-resource access:
+ *
+ *   role/feature permissions + ownership + direct grants + group grants
+ *     = effective allow
+ *
+ * Feature gates keep their existing semantics (admin always allowed, others
+ * by the admin-controlled mode); the per-feature services now delegate here.
+ * Resource decisions are private by default: the owner has every permission,
+ * other users only what an explicit user or group grant confers. The admin
+ * role deliberately does NOT bypass resource privacy — administration is a
+ * feature-level power, not a content read.
+ *
+ * `explainEffectiveAccess` answers "why can this user access this?" for the
+ * administrator-facing effective-access view.
+ */
+import { getPersistence } from '../persistence/index.js';
+import { encryptionService } from './encryptionService.js';
+import { getWorkAccessMode } from './workAccessService.js';
+import { getModelDownloadMode } from './modelAccessService.js';
+import { getAgentsEnabled } from './agentAccessService.js';
+import { getWebSearchAccessMode } from './webSearchService.js';
+export const SHAREABLE_RESOURCE_TYPES = [
+    'session',
+    'session-folder',
+    'note',
+    'knowledge-collection',
+    'document',
+    'persona',
+];
+export const isShareableResourceType = (value) => typeof value === 'string' &&
+    SHAREABLE_RESOURCE_TYPES.includes(value);
+export class AuthorizationError extends Error {
+    constructor(message = 'Access denied') {
+        super(message);
+        this.statusCode = 403;
+        this.name = 'AuthorizationError';
+    }
+}
+const security = () => getPersistence(encryptionService).repositories.security;
+const archive = () => getPersistence(encryptionService).repositories.resources.archive;
+/** Group memberships resolved fresh so removals apply immediately. */
+export const resolveGroupIdsForUser = (userId) => security().groups.listGroupIdsForUser(userId);
+const permissionSatisfies = (granted, action) => {
+    if (action === 'read' || action === 'use')
+        return true;
+    if (action === 'write')
+        return granted === 'write' || granted === 'admin';
+    return granted === 'admin';
+};
+const featureDecision = async (actor, featureId) => {
+    if (actor.role === 'admin')
+        return { allowed: true, reason: 'admin-role' };
+    switch (featureId) {
+        case 'work':
+            return (await getWorkAccessMode()) === 'all-users'
+                ? { allowed: true, reason: 'feature-open-to-all-users' }
+                : { allowed: false, reason: 'feature-restricted-to-admins' };
+        case 'model-download':
+            return (await getModelDownloadMode()) === 'all-users'
+                ? { allowed: true, reason: 'feature-open-to-all-users' }
+                : { allowed: false, reason: 'feature-restricted-to-admins' };
+        case 'web-search':
+            return (await getWebSearchAccessMode()) === 'all-users'
+                ? { allowed: true, reason: 'feature-open-to-all-users' }
+                : { allowed: false, reason: 'feature-restricted-to-admins' };
+        case 'agents':
+            return (await getAgentsEnabled())
+                ? { allowed: true, reason: 'feature-enabled' }
+                : { allowed: false, reason: 'feature-disabled' };
+    }
+};
+/** Effective grants a user holds on a resource, via user and group rows. */
+export const effectiveGrantsFor = async (userId, resourceType, resourceId) => {
+    const groupIds = await resolveGroupIdsForUser(userId);
+    return security().grants.listEffective(resourceType, resourceId, userId, groupIds);
+};
+export const authorize = async (actor, action, resource) => {
+    if (actor.status !== undefined && actor.status !== 'active') {
+        return { allowed: false, reason: 'inactive-account' };
+    }
+    if (resource.type === 'feature') {
+        return featureDecision(actor, resource.id);
+    }
+    const ownerUserId = resource.ownerUserId ??
+        (await archive().ownerOf(resource.type, resource.id));
+    if (ownerUserId === actor.userId) {
+        return { allowed: true, reason: 'owner' };
+    }
+    if (ownerUserId === null) {
+        return { allowed: false, reason: 'resource-not-found' };
+    }
+    const grants = await effectiveGrantsFor(actor.userId, resource.type, resource.id);
+    const qualifying = grants.find(grant => permissionSatisfies(grant.permission, action));
+    if (qualifying) {
+        return {
+            allowed: true,
+            reason: qualifying.principal_type === 'user' ? 'direct-grant' : 'group-grant',
+        };
+    }
+    return {
+        allowed: false,
+        reason: grants.length > 0 ? 'insufficient-permission' : 'no-grant',
+    };
+};
+/** Throwing variant for route and service guards. */
+export const requireAuthorized = async (actor, action, resource) => {
+    const decision = await authorize(actor, action, resource);
+    if (!decision.allowed)
+        throw new AuthorizationError();
+    return decision;
+};
+/**
+ * "Why can this user access this?" — the complete effective-access picture
+ * for one user: role, groups, feature gates, and every grant that reaches
+ * them directly or through a group.
+ */
+export const explainEffectiveAccess = async (user) => {
+    const actor = {
+        userId: user.id,
+        role: user.role,
+        status: user.status,
+    };
+    const groups = await security().groups.listGroupsForUser(user.id);
+    const [work, modelDownload, webSearch, agents] = await Promise.all([
+        authorize(actor, 'use', { type: 'feature', id: 'work' }),
+        authorize(actor, 'use', { type: 'feature', id: 'model-download' }),
+        authorize(actor, 'use', { type: 'feature', id: 'web-search' }),
+        authorize(actor, 'use', { type: 'feature', id: 'agents' }),
+    ]);
+    const grantRows = [
+        ...(await security().grants.listForPrincipal('user', user.id)),
+    ];
+    for (const group of groups) {
+        grantRows.push(...(await security().grants.listForPrincipal('group', group.id)));
+    }
+    return {
+        userId: user.id,
+        role: user.role ?? null,
+        status: user.status ?? null,
+        groups: groups.map(group => ({ id: group.id, name: group.name })),
+        features: {
+            work: work.allowed,
+            'model-download': modelDownload.allowed,
+            'web-search': webSearch.allowed,
+            agents: agents.allowed,
+        },
+        grants: grantRows.map(grant => ({
+            id: grant.id,
+            resourceType: grant.resource_type,
+            resourceId: grant.resource_id,
+            permission: grant.permission,
+            via: grant.principal_type,
+            principalId: grant.principal_id,
+        })),
+    };
+};
+//# sourceMappingURL=authorizationService.js.map

package/backend/dist/services/authorizationService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorizationService.js","sourceRoot":"","sources":["../../src/services/authorizationService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAMzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAS/D,MAAM,CAAC,MAAM,wBAAwB,GAAqC;IACxE,SAAS;IACT,gBAAgB;IAChB,MAAM;IACN,sBAAsB;IACtB,UAAU;IACV,SAAS;CACV,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,KAAc,EACkB,EAAE,CAClC,OAAO,KAAK,KAAK,QAAQ;IACxB,wBAA8C,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAiBlE,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAE3C,YAAY,OAAO,GAAG,eAAe;QACnC,KAAK,CAAC,OAAO,CAAC,CAAC;QAFR,eAAU,GAAG,GAAG,CAAC;QAGxB,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC;AAE/E,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,cAAc,CAAC,iBAAiB,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC;AAEnE,sEAAsE;AACtE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,MAAc,EAAqB,EAAE,CAC1E,QAAQ,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;AAEhD,MAAM,mBAAmB,GAAG,CAC1B,OAAwB,EACxB,MAAmB,EACV,EAAE;IACX,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,OAAO,KAAK,OAAO,IAAI,OAAO,KAAK,OAAO,CAAC;IAC1E,OAAO,OAAO,KAAK,OAAO,CAAC;AAC7B,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,KAAK,EAC3B,KAAiB,EACjB,SAAoB,EACI,EAAE;IAC1B,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IAC3E,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,MAAM;YACT,OAAO,CAAC,MAAM,iBAAiB,EAAE,CAAC,KAAK,WAAW;gBAChD,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,2BAA2B,EAAE;gBACxD,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;QACjE,KAAK,gBAAgB;YACnB,OAAO,CAAC,MAAM,oBAAoB,EAAE,CAAC,KAAK,WAAW;gBACnD,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,2BAA2B,EAAE;gBACxD,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;QACjE,KAAK,YAAY;YACf,OAAO,CAAC,MAAM,sBAAsB,EAAE,CAAC,KAAK,WAAW;gBACrD,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,2BAA2B,EAAE;gBACxD,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;QACjE,KAAK,QAAQ;YACX,OAAO,CAAC,MAAM,gBAAgB,EAAE,CAAC;gBAC/B,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE;gBAC9C,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACvD,CAAC;AACH,CAAC,CAAC;AAEF,4EAA4E;AAC5E,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EACrC,MAAc,EACd,YAAmC,EACnC,UAAkB,EACoB,EAAE;IACxC,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,MAAM,CAAC,CAAC;IACtD,OAAO,QAAQ,EAAE,CAAC,MAAM,CAAC,aAAa,CACpC,YAAY,EACZ,UAAU,EACV,MAAM,EACN,QAAQ,CACT,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,EAC5B,KAAiB,EACjB,MAAmB,EACnB,QAAuB,EACC,EAAE;IAC1B,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC5D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACxD,CAAC;IAED,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,WAAW,GACf,QAAQ,CAAC,WAAW;QACpB,CAAC,MAAM,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IACxD,IAAI,WAAW,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC5C,CAAC;IACD,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC1D,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,kBAAkB,CACrC,KAAK,CAAC,MAAM,EACZ,QAAQ,CAAC,IAAI,EACb,QAAQ,CAAC,EAAE,CACZ,CAAC;IACF,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CACrC,mBAAmB,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CAC9C,CAAC;IACF,IAAI,UAAU,EAAE,CAAC;QACf,OAAO;YACL,OAAO,EAAE,IAAI;YACb,MAAM,EACJ,UAAU,CAAC,cAAc,KAAK,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa;SACxE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,UAAU;KACnE,CAAC;AACJ,CAAC,CAAC;AAEF,qDAAqD;AACrD,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EACpC,KAAiB,EACjB,MAAmB,EACnB,QAAuB,EACC,EAAE;IAC1B,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC1D,IAAI,CAAC,QAAQ,CAAC,OAAO;QAAE,MAAM,IAAI,kBAAkB,EAAE,CAAC;IACtD,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AAkBF;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,EAAE,IAI5C,EAAgC,EAAE;IACjC,MAAM,KAAK,GAAe;QACxB,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,QAAQ,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClE,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACjE,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;QACxD,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC;QAClE,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC;QAC9D,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;KAC3D,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG;QAChB,GAAG,CAAC,MAAM,QAAQ,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;KAC/D,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,SAAS,CAAC,IAAI,CACZ,GAAG,CAAC,MAAM,QAAQ,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CACjE,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI;QACvB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;QAC3B,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACjE,QAAQ,EAAE;YACR,IAAI,EAAE,IAAI,CAAC,OAAO;YAClB,gBAAgB,EAAE,aAAa,CAAC,OAAO;YACvC,YAAY,EAAE,SAAS,CAAC,OAAO;YAC/B,MAAM,EAAE,MAAM,CAAC,OAAO;SACvB;QACD,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC9B,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,YAAY,EAAE,KAAK,CAAC,aAAa;YACjC,UAAU,EAAE,KAAK,CAAC,WAAW;YAC7B,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,GAAG,EAAE,KAAK,CAAC,cAAc;YACzB,WAAW,EAAE,KAAK,CAAC,YAAY;SAChC,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC,CAAC"}