mindoodb 0.0.85 → 0.0.86

package/dist/server/SystemAdminAuth.js

@@ -0,0 +1,228 @@
+"use strict";
+/**
+ * System admin authentication service.
+ *
+ * Reuses the existing `AuthenticationService` by providing a
+ * `SystemAdminDirectory` adapter that derives user lookup data from
+ * the capabilities section of `config.json` rather than a tenant
+ * directory.  Challenges require both username and publicsignkey so
+ * the issued JWT can carry both fields for capability matching.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SystemAdminAuthService = void 0;
+const idGeneration_1 = require("../core/utils/idGeneration");
+const serverConfig_1 = require("./serverConfig");
+// ---------------------------------------------------------------------------
+// SystemAdminAuthService
+// ---------------------------------------------------------------------------
+class SystemAdminAuthService {
+    constructor(cryptoAdapter, config, options) {
+        this.challenges = new Map();
+        this.cryptoAdapter = cryptoAdapter;
+        this.principals = (0, serverConfig_1.extractAllPrincipals)(config);
+        this.allowTenantCreationWildcardPrincipal =
+            (0, serverConfig_1.hasTenantCreationWildcardPrincipal)(config);
+        this.isTenantAdminSigningKey = options?.isTenantAdminSigningKey;
+        this.jwtSecret =
+            options?.jwtSecret ?? cryptoAdapter.getRandomValues(new Uint8Array(32));
+        this.challengeExpirationMs = options?.challengeExpirationMs ?? 5 * 60 * 1000;
+        this.tokenExpirationMs = options?.tokenExpirationMs ?? 60 * 60 * 1000;
+    }
+    /**
+     * Hot-swap the principal list from a new config.
+     * In-flight challenges and existing JWTs remain valid (same HMAC secret);
+     * removed principals will fail the CapabilityMatcher check on their next request.
+     */
+    reloadPrincipals(config) {
+        this.principals = (0, serverConfig_1.extractAllPrincipals)(config);
+        this.allowTenantCreationWildcardPrincipal =
+            (0, serverConfig_1.hasTenantCreationWildcardPrincipal)(config);
+    }
+    /**
+     * Generate a challenge for a system admin.
+     * Both `username` and `publicsignkey` are required so we can bind
+     * the issued JWT to a specific keypair.
+     */
+    async generateChallenge(username, publicsignkey) {
+        const normalizedUsername = username.toLowerCase();
+        const found = this.principals.some((p) => p.username.toLowerCase() === normalizedUsername &&
+            p.publicsignkey === publicsignkey);
+        if (!found &&
+            !this.allowTenantCreationWildcardPrincipal &&
+            !this.isTenantAdminSigningKey?.(publicsignkey)) {
+            throw new Error("Unknown system admin principal");
+        }
+        const challenge = (0, idGeneration_1.generateRandomUuid)();
+        const now = Date.now();
+        this.challenges.set(challenge, {
+            challenge,
+            username,
+            publicsignkey,
+            createdAt: now,
+            expiresAt: now + this.challengeExpirationMs,
+            used: false,
+        });
+        this.cleanupExpiredChallenges();
+        this.evictChallengesOverCap();
+        return challenge;
+    }
+    /**
+     * Verify a signed challenge and return a JWT containing both
+     * `sub` (username) and `publicsignkey`.
+     */
+    async authenticate(challenge, signature) {
+        const stored = this.challenges.get(challenge);
+        if (!stored) {
+            return { success: false, error: "Challenge not found or expired" };
+        }
+        if (Date.now() > stored.expiresAt) {
+            this.challenges.delete(challenge);
+            return { success: false, error: "Challenge expired" };
+        }
+        if (stored.used) {
+            return { success: false, error: "Challenge already used" };
+        }
+        stored.used = true;
+        const isValid = await this.verifySignature(challenge, signature, stored.publicsignkey);
+        if (!isValid) {
+            return { success: false, error: "Invalid signature" };
+        }
+        const token = await this.generateToken(stored.username, stored.publicsignkey);
+        return { success: true, token };
+    }
+    /**
+     * Validate and decode a system admin JWT.
+     */
+    async validateToken(token) {
+        const parts = token.split(".");
+        if (parts.length !== 3)
+            return null;
+        const [headerB64, payloadB64, signatureB64] = parts;
+        try {
+            // Pin the JWT algorithm to HS256 (audit, Low: alg pinning): reject any
+            // other declared `alg` to block algorithm-confusion attacks.
+            const header = JSON.parse(this.base64UrlDecode(headerB64));
+            if (header.alg !== "HS256")
+                return null;
+            const subtle = this.cryptoAdapter.getSubtle();
+            const signingKey = await subtle.importKey("raw", this.jwtSecret.buffer, { name: "HMAC", hash: "SHA-256" }, false, ["verify"]);
+            const dataToVerify = new TextEncoder().encode(`${headerB64}.${payloadB64}`);
+            const sig = this.base64UrlToUint8Array(signatureB64);
+            const isValid = await subtle.verify("HMAC", signingKey, sig.buffer.slice(sig.byteOffset, sig.byteOffset + sig.byteLength), dataToVerify.buffer);
+            if (!isValid)
+                return null;
+            const payload = JSON.parse(this.base64UrlDecode(payloadB64));
+            const now = Math.floor(Date.now() / 1000);
+            if (payload.exp < now)
+                return null;
+            return payload;
+        }
+        catch {
+            return null;
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Private helpers
+    // -----------------------------------------------------------------------
+    async verifySignature(message, signature, publicKeyPem) {
+        const subtle = this.cryptoAdapter.getSubtle();
+        try {
+            const pemContents = publicKeyPem
+                .replace(/-----BEGIN PUBLIC KEY-----/g, "")
+                .replace(/-----END PUBLIC KEY-----/g, "")
+                .replace(/\s/g, "");
+            const keyData = this.base64ToUint8Array(pemContents);
+            const publicKey = await subtle.importKey("spki", keyData.buffer, { name: "Ed25519" }, false, ["verify"]);
+            const messageBytes = new TextEncoder().encode(message);
+            return await subtle.verify({ name: "Ed25519" }, publicKey, signature.buffer.slice(signature.byteOffset, signature.byteOffset + signature.byteLength), messageBytes.buffer);
+        }
+        catch {
+            return false;
+        }
+    }
+    async generateToken(username, publicsignkey) {
+        const subtle = this.cryptoAdapter.getSubtle();
+        const now = Math.floor(Date.now() / 1000);
+        const payload = {
+            sub: username,
+            publicsignkey,
+            iat: now,
+            exp: now + Math.floor(this.tokenExpirationMs / 1000),
+        };
+        const header = { alg: "HS256", typ: "JWT" };
+        const headerB64 = this.base64UrlEncode(JSON.stringify(header));
+        const payloadB64 = this.base64UrlEncode(JSON.stringify(payload));
+        const signingKey = await subtle.importKey("raw", this.jwtSecret.buffer, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+        const dataToSign = new TextEncoder().encode(`${headerB64}.${payloadB64}`);
+        const signature = await subtle.sign("HMAC", signingKey, dataToSign.buffer);
+        const signatureB64 = this.uint8ArrayToBase64Url(new Uint8Array(signature));
+        return `${headerB64}.${payloadB64}.${signatureB64}`;
+    }
+    cleanupExpiredChallenges() {
+        const now = Date.now();
+        for (const [key, ch] of this.challenges) {
+            if (ch.expiresAt < now) {
+                this.challenges.delete(key);
+            }
+        }
+    }
+    /**
+     * Bound the challenge map (DoS guard): if still over the cap after expiry
+     * cleanup, drop the oldest entries (Map preserves insertion order).
+     */
+    evictChallengesOverCap() {
+        let overflow = this.challenges.size - SystemAdminAuthService.MAX_CHALLENGES;
+        if (overflow <= 0)
+            return;
+        for (const key of this.challenges.keys()) {
+            if (overflow-- <= 0)
+                break;
+            this.challenges.delete(key);
+        }
+    }
+    // Base64 utilities
+    base64UrlEncode(str) {
+        const base64 = btoa(str);
+        return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+    }
+    base64UrlDecode(str) {
+        let base64 = str.replace(/-/g, "+").replace(/_/g, "/");
+        while (base64.length % 4)
+            base64 += "=";
+        return atob(base64);
+    }
+    uint8ArrayToBase64Url(bytes) {
+        let binary = "";
+        for (let i = 0; i < bytes.length; i++) {
+            binary += String.fromCharCode(bytes[i]);
+        }
+        const base64 = btoa(binary);
+        return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+    }
+    base64UrlToUint8Array(str) {
+        let base64 = str.replace(/-/g, "+").replace(/_/g, "/");
+        while (base64.length % 4)
+            base64 += "=";
+        const binary = atob(base64);
+        const bytes = new Uint8Array(binary.length);
+        for (let i = 0; i < binary.length; i++) {
+            bytes[i] = binary.charCodeAt(i);
+        }
+        return bytes;
+    }
+    base64ToUint8Array(base64) {
+        const binary = atob(base64);
+        const bytes = new Uint8Array(binary.length);
+        for (let i = 0; i < binary.length; i++) {
+            bytes[i] = binary.charCodeAt(i);
+        }
+        return bytes;
+    }
+}
+exports.SystemAdminAuthService = SystemAdminAuthService;
+/**
+ * Hard cap on outstanding challenges (DoS guard). Challenge creation is
+ * unauthenticated, so bound the map and evict oldest-first on overflow.
+ */
+SystemAdminAuthService.MAX_CHALLENGES = 10000;
+//# sourceMappingURL=SystemAdminAuth.js.map

package/dist/server/SystemAdminAuth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SystemAdminAuth.js","sourceRoot":"","sources":["../../src/server/SystemAdminAuth.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;AAEH,6DAAgE;AAGhE,iDAGwB;AAsBxB,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E,MAAa,sBAAsB;IAoBjC,YACE,aAA4B,EAC5B,MAAoB,EACpB,OAKC;QA3BK,eAAU,GAAiC,IAAI,GAAG,EAAE,CAAC;QA6B3D,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,UAAU,GAAG,IAAA,mCAAoB,EAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,CAAC,oCAAoC;YACvC,IAAA,iDAAkC,EAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,uBAAuB,GAAG,OAAO,EAAE,uBAAuB,CAAC;QAChE,IAAI,CAAC,SAAS;YACZ,OAAO,EAAE,SAAS,IAAI,aAAa,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1E,IAAI,CAAC,qBAAqB,GAAG,OAAO,EAAE,qBAAqB,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAC7E,IAAI,CAAC,iBAAiB,GAAG,OAAO,EAAE,iBAAiB,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACxE,CAAC;IAED;;;;OAIG;IACH,gBAAgB,CAAC,MAAoB;QACnC,IAAI,CAAC,UAAU,GAAG,IAAA,mCAAoB,EAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,CAAC,oCAAoC;YACvC,IAAA,iDAAkC,EAAC,MAAM,CAAC,CAAC;IAC/C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,iBAAiB,CACrB,QAAgB,EAChB,aAAqB;QAErB,MAAM,kBAAkB,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;QAElD,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAChC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,kBAAkB;YAC/C,CAAC,CAAC,aAAa,KAAK,aAAa,CACpC,CAAC;QACF,IACE,CAAC,KAAK;YACN,CAAC,IAAI,CAAC,oCAAoC;YAC1C,CAAC,IAAI,CAAC,uBAAuB,EAAE,CAAC,aAAa,CAAC,EAC9C,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,SAAS,GAAG,IAAA,iCAAkB,GAAE,CAAC;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE;YAC7B,SAAS;YACT,QAAQ;YACR,aAAa;YACb,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG,GAAG,IAAI,CAAC,qBAAqB;YAC3C,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QAEH,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAChC,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC9B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,CAChB,SAAiB,EACjB,SAAqB;QAErB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC;QACrE,CAAC;QAED,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YAClC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAClC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;QACxD,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;QAC7D,CAAC;QAED,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;QAEnB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CACxC,SAAS,EACT,SAAS,EACT,MAAM,CAAC,aAAa,CACrB,CAAC;QAEF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;QACxD,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;QAC9E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CACjB,KAAa;QAEb,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAEpC,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,GAAG,KAAK,CAAC;QAEpD,IAAI,CAAC;YACH,uEAAuE;YACvE,6DAA6D;YAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAqB,CAAC;YAC/E,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO;gBAAE,OAAO,IAAI,CAAC;YAExC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC;YAC9C,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,IAAI,CAAC,SAAS,CAAC,MAAqB,EACpC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;YAEF,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAC3C,GAAG,SAAS,IAAI,UAAU,EAAE,CAC7B,CAAC;YACF,MAAM,GAAG,GAAG,IAAI,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;YAErD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CACjC,MAAM,EACN,UAAU,EACV,GAAG,CAAC,MAAM,CAAC,KAAK,CACd,GAAG,CAAC,UAAU,EACd,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,CACjB,EAChB,YAAY,CAAC,MAAqB,CACnC,CAAC;YAEF,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAE1B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CACN,CAAC;YAE7B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAC1C,IAAI,OAAO,CAAC,GAAG,GAAG,GAAG;gBAAE,OAAO,IAAI,CAAC;YAEnC,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,kBAAkB;IAClB,0EAA0E;IAElE,KAAK,CAAC,eAAe,CAC3B,OAAe,EACf,SAAqB,EACrB,YAAoB;QAEpB,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC;QAE9C,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,YAAY;iBAC7B,OAAO,CAAC,6BAA6B,EAAE,EAAE,CAAC;iBAC1C,OAAO,CAAC,2BAA2B,EAAE,EAAE,CAAC;iBACxC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAEtB,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;YAErD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,SAAS,CACtC,MAAM,EACN,OAAO,CAAC,MAAqB,EAC7B,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;YAEF,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACvD,OAAO,MAAM,MAAM,CAAC,MAAM,CACxB,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,SAAS,EACT,SAAS,CAAC,MAAM,CAAC,KAAK,CACpB,SAAS,CAAC,UAAU,EACpB,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAC7B,EAChB,YAAY,CAAC,MAAqB,CACnC,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,aAAa,CACzB,QAAgB,EAChB,aAAqB;QAErB,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAE1C,MAAM,OAAO,GAA4B;YACvC,GAAG,EAAE,QAAQ;YACb,aAAa;YACb,GAAG,EAAE,GAAG;YACR,GAAG,EAAE,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;SACrD,CAAC;QAEF,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;QAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QAEjE,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,IAAI,CAAC,SAAS,CAAC,MAAqB,EACpC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;QAEF,MAAM,UAAU,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CACzC,GAAG,SAAS,IAAI,UAAU,EAAE,CAC7B,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,CACjC,MAAM,EACN,UAAU,EACV,UAAU,CAAC,MAAqB,CACjC,CAAC;QAEF,MAAM,YAAY,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;QAC3E,OAAO,GAAG,SAAS,IAAI,UAAU,IAAI,YAAY,EAAE,CAAC;IACtD,CAAC;IAEO,wBAAwB;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACxC,IAAI,EAAE,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;gBACvB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,sBAAsB;QAC5B,IAAI,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,sBAAsB,CAAC,cAAc,CAAC;QAC5E,IAAI,QAAQ,IAAI,CAAC;YAAE,OAAO;QAC1B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;YACzC,IAAI,QAAQ,EAAE,IAAI,CAAC;gBAAE,MAAM;YAC3B,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,mBAAmB;IAEX,eAAe,CAAC,GAAW;QACjC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC1E,CAAC;IAEO,eAAe,CAAC,GAAW;QACjC,IAAI,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACvD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,GAAG,CAAC;QACxC,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IAEO,qBAAqB,CAAC,KAAiB;QAC7C,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1C,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC1E,CAAC;IAEO,qBAAqB,CAAC,GAAW;QACvC,IAAI,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACvD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,GAAG,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,kBAAkB,CAAC,MAAc;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;;AA1UH,wDA2UC;AAzUC;;;GAGG;AACqB,qCAAc,GAAG,KAAM,AAAT,CAAU"}

package/dist/server/TenantManager.d.ts

@@ -0,0 +1,330 @@
+/**
+ * TenantManager handles loading, caching, and registration of tenants.
+ *
+ * Uses a global server identity (one per server, not per tenant) for
+ * authenticating with remote servers and opening tenant directories.
+ *
+ * When a tenant has a $publicinfos key (sent during publishToServer), the
+ * manager creates a real BaseMindooTenant for directory reading. User
+ * authentication is then validated against the admin-signed directory DB
+ * rather than a static JSON config.
+ *
+ * When no $publicinfos key is available, a SimpleMindooDirectory backed
+ * by config.json users[] is used as a fallback (useful for tests).
+ *
+ * A CompositeMindooDirectory wraps whichever directory source is used and
+ * also checks the global trusted-servers list, enabling server-to-server
+ * auth without servers being in each tenant's user directory.
+ */
+import { AuthenticationService } from "../core/appendonlystores/network/AuthenticationService";
+import { ServerNetworkContentAddressedStore } from "../appendonlystores/network/ServerNetworkContentAddressedStore";
+import type { ServerPeerTokenResolver, ServerTrustedWitnessResolver } from "../appendonlystores/network/ServerNetworkContentAddressedStore";
+import type { WitnessSigner } from "../core/crypto/WitnessReceipt";
+import type { TimestampProvider } from "../core/accesscontrol/timestamp/TimestampProvider";
+import type { MindooTenant, MindooTenantDirectory, ContentAddressedStore, DirectoryUserLookup } from "../core/types";
+import { StoreKind } from "../core/types";
+import type { PrivateUserId } from "../core/userid";
+import type { CryptoAdapter } from "../core/crypto/CryptoAdapter";
+import type { ServerDataStore, ServerStoreProvider, TenantStoreFactory } from "./ServerDataStore";
+import type { TenantConfig, TenantContext, RegisterTenantRequest, TrustedServer } from "./types";
+export interface LoadedTenant {
+    context: TenantContext;
+    storeFactory: TenantStoreFactory;
+    authService: AuthenticationService;
+    directory: MindooTenantDirectory;
+    mindooTenant?: MindooTenant;
+    serverStores: Map<string, ServerNetworkContentAddressedStore>;
+}
+export interface RegisterTenantResult {
+    context: TenantContext;
+    created: boolean;
+}
+export declare class SimpleMindooDirectory implements Pick<MindooTenantDirectory, "getUserPublicKeys" | "isUserRevoked" | "validatePublicSigningKey" | "getUserBySigningPublicKey"> {
+    /** Canonical index: entries are identified by their signing public key. */
+    private usersByKey;
+    /**
+     * Backward-compat index by documentation-only username, populated only for
+     * config entries that carry a `username`. Lets legacy username-based
+     * challenges keep resolving; `username` is never required.
+     */
+    private usersByUsername;
+    private revokedUsers;
+    private adminSigningPublicKey;
+    constructor(config: TenantConfig);
+    getUserPublicKeys(username: string): Promise<{
+        signingPublicKey: string;
+        encryptionPublicKey: string;
+    } | null>;
+    getUserBySigningPublicKey(publicKey: string): Promise<DirectoryUserLookup | null>;
+    private toLookup;
+    isUserRevoked(username: string): Promise<boolean>;
+    validatePublicSigningKey(publicKey: string, _opts?: {
+        forceRefresh?: boolean;
+    }): Promise<boolean>;
+}
+export interface TenantManagerOptions {
+    /** Server identity, trusted servers, key bag and tenant configs. */
+    dataStore: ServerDataStore;
+    /** Content-addressed stores of every tenant database. */
+    storeProvider: ServerStoreProvider;
+    cryptoAdapter: CryptoAdapter;
+    /** Unlocks the server identity's private keys and the server key bag. */
+    serverPassword?: string;
+    /**
+     * HMAC secret for a tenant's sync tokens. Without it every loaded tenant
+     * gets a random secret, so tokens die with the process — fine for one
+     * server process, wrong for a host that spreads one tenant over several
+     * instances which must accept each other's tokens.
+     */
+    jwtSecretForTenant?: (tenantId: string) => Promise<Uint8Array>;
+    /**
+     * Source of a tenant's `$publicinfos` keys when they are not kept in this
+     * manager's own `server.keybag` (e.g. a host instance that serves one
+     * tenant database and gets the keys from a central registry).
+     */
+    publicInfosKeysResolver?: (tenantId: string) => Promise<Uint8Array[]>;
+}
+export interface ExecutePendingPurgesOptions {
+    /**
+     * Only purge in these databases; requests for other databases stay
+     * unprocessed in this manager's registry. For hosts that serve a subset of
+     * a tenant's databases per instance.
+     */
+    dbIds?: ReadonlySet<string>;
+}
+/**
+ * TenantManager is responsible for:
+ * - Loading the global server identity and trusted servers
+ * - Loading tenant configurations from disk
+ * - Caching loaded tenants
+ * - Registering new tenants
+ * - Managing tenant stores and authentication services
+ * - Creating a real MindooDB tenant for directory reading (when keys available)
+ * - Runtime management of trusted servers
+ */
+export declare class TenantManager {
+    private readonly dataStore;
+    private readonly storeProvider;
+    private serverPassword;
+    private cryptoAdapter;
+    private readonly jwtSecretForTenant;
+    private readonly publicInfosKeysResolver;
+    private loadedTenants;
+    private serverIdentity;
+    private trustedServers;
+    /** Lazily-built, cached witness signer (server's Ed25519 signing identity). */
+    private witnessSigner;
+    /** Lazily-imported RSA private key for peer replication (see getServerEncryptionPrivateKey). */
+    private serverEncryptionPrivateKey;
+    /** Peer wiring handed down to every server store; see setPeerAccessControl. */
+    private peerAccessControl;
+    /** Per-tenant persistent registry of executed purges (docs/accesscontrol.md §13). */
+    private purgedDocRegistries;
+    /** In-flight purge executions, keyed by normalized tenant id (serializes runs). */
+    private purgeInFlight;
+    constructor(options: TenantManagerOptions);
+    getServerIdentity(): PrivateUserId | null;
+    getServerPublicInfo(): TrustedServer | null;
+    /**
+     * Teach every server store how to recognise a trusted peer.
+     *
+     * `MindooDBServer` calls this once at startup. Two hooks, both required for
+     * peer replication to be correct:
+     *
+     * - `peerTokenResolver` lets a peer's cluster-level JWT through the tenant
+     *   sync routes. A peer holds no per-tenant grant, so without it the mirror
+     *   would need a second replication protocol; with it the peer reuses the
+     *   client one and the store skips the per-user gates that do not apply to a
+     *   full replica.
+     * - `trustedWitnessResolver` decides whose witness receipts may be preserved
+     *   instead of re-stamped (convergence invariant 3). Without it a replicated
+     *   entry would get a fresh `receivedAt` on every hop and "trusted time"
+     *   would mean "time it reached the last server".
+     *
+     * Must be called before the first {@link getServerStore}, since stores are
+     * cached per tenant and database.
+     */
+    setPeerAccessControl(options: {
+        peerTokenResolver?: ServerPeerTokenResolver;
+        trustedWitnessResolver?: ServerTrustedWitnessResolver;
+    }): void;
+    /**
+     * Database ids this server holds for a tenant (on Node, the directories in
+     * `{dataDir}/{tenantId}/stores`). Used by peer replication to mirror every
+     * database rather than a configured subset.
+     */
+    listDatabases(tenantId: string): string[];
+    /**
+     * The server's own RSA private key, imported for decryption.
+     *
+     * Peer replication needs it because the remote wraps transported entries to
+     * this server's `encryptionPublicKey` (the one in its `trusted-servers.json`),
+     * exactly as it would wrap them for a client.
+     */
+    getServerEncryptionPrivateKey(): Promise<CryptoKey | undefined>;
+    /**
+     * Build (and cache) the server's witness identity used to stamp receipts on
+     * accepted entries (docs/accesscontrol.md §5.3). Returns undefined when the
+     * server identity or its unlock password is unavailable, in which case the
+     * server runs in pre-access-control mode (no stamping, no Tier 1 advertised).
+     */
+    getWitnessSigner(): Promise<WitnessSigner | undefined>;
+    /**
+     * Build the trusted-time provider that stamps receipts on accepted entries
+     * (docs/accesscontrol.md §5.3, §13). v1 wraps the server's Ed25519 witness
+     * identity; returns undefined when no witness signer is available, leaving the
+     * server in pre-access-control mode.
+     */
+    getTimestampProvider(): Promise<TimestampProvider | undefined>;
+    listTrustedServers(): TrustedServer[];
+    addTrustedServer(server: TrustedServer): void;
+    /**
+     * Add or replace a trusted server by name.
+     *
+     * Peer CRUD needs an upsert: `addTrustedServer` throws on an existing name,
+     * which is right for `add-to-network` (a silent overwrite of a peer's keys
+     * would be a trust change disguised as a config edit) but wrong for the admin
+     * API, where changing a peer's url or role is the common case.
+     */
+    saveTrustedServer(server: TrustedServer): void;
+    removeTrustedServer(name: string): boolean;
+    private persistTrustedServers;
+    private loadServerKeyBag;
+    private createServerKeyBag;
+    private saveServerKeyBag;
+    private bytesToBase64;
+    private mergeUniqueKeys;
+    private computePublicInfosFingerprint;
+    /**
+     * The data-store key of a tenant's directory. Tenant ids reach this from
+     * request paths, so anything that could address another key is refused.
+     */
+    private tenantKey;
+    private tenantConfigKey;
+    private readTenantConfig;
+    private writeTenantConfig;
+    private decryptEncryptedPublicInfosKey;
+    private resolveIncomingPublicInfosKey;
+    private getStoredPublicInfosKeys;
+    private persistTenantPublicInfosKey;
+    /**
+     * All stored `$publicinfos` AES key versions for a tenant from `server.keybag`.
+     * Empty when the tenant was never published or the server keybag is locked.
+     */
+    getPublicInfosKeysForTenant(tenantId: string): Promise<Uint8Array[]>;
+    listTenantPublicInfosFingerprints(tenantId: string): Promise<string[]>;
+    registerTenant(request: RegisterTenantRequest): Promise<RegisterTenantResult>;
+    getTenant(tenantId: string): Promise<LoadedTenant>;
+    tenantExists(tenantId: string): boolean;
+    /**
+     * Read the tenant's registered admin signing key without fully loading the
+     * tenant. Returns `null` if the tenant is missing or the config is unreadable.
+     */
+    getTenantAdminSigningPublicKey(tenantId: string): string | null;
+    /**
+     * True when `publicsignkey` is the registered tenant-admin signing key for
+     * `tenantId` (PEM whitespace-insensitive).
+     */
+    isTenantAdminSigningKeyFor(tenantId: string, publicsignkey: string): boolean;
+    /**
+     * True when `publicsignkey` is the registered admin signing key of any
+     * tenant on this server. Used to issue a system JWT so that admin can
+     * DELETE their own tenant; other `/system/*` routes stay capability-gated.
+     */
+    isRegisteredTenantAdminSigningKey(publicsignkey: string): boolean;
+    listTenants(): string[];
+    /**
+     * Update operator-owned fields of an existing tenant configuration.
+     * Only the fields present in `updates` are overwritten.
+     */
+    updateTenantConfig(tenantId: string, updates: Partial<Pick<TenantConfig, "defaultStoreType">>): void;
+    removeTenant(tenantId: string): Promise<void>;
+    getServerStore(tenantId: string, dbId: string, storeKind: StoreKind): Promise<ServerNetworkContentAddressedStore>;
+    /**
+     * Build a Tier 1 evaluator closure for a server store, or undefined when the
+     * directory cannot evaluate access (e.g. config-based directory without the
+     * access-control state chain). The closure resolves `$author` for non-create
+     * ops by reading the document's `doc_create` entry creator key from the local
+     * store (metadata only, no decryption) and comparing it to the change author.
+     */
+    /**
+     * The witness's Tier 1 gate. The evaluation itself is shared with the peer
+     * listener, which has to run it for entries that never reach a witness at
+     * all — see `core/accesscontrol/tier1Evaluator.ts`.
+     */
+    private buildTier1Evaluator;
+    /**
+     * Builtin `userdirectory` write invariant: admin may create/delete, only the
+     * owning person may change. `username_hash` is read from the decrypted
+     * `doc_create` payload (`$publicinfos`). Personal documents are sealed to
+     * their owner and therefore undecryptable here, so they are owned by whoever
+     * signed their `doc_create` — `resolveCreatorSigningKey` answers that from
+     * the entry chain alone.
+     */
+    private buildUserdirectoryWriteContext;
+    private findCreateEntry;
+    /**
+     * Build a database-open evaluator closure for a server store, or undefined
+     * when the directory cannot evaluate the database-open policy (e.g. a
+     * config-based directory without the access-control state chain). When the
+     * tenant policy is `"directory-restricted"`, this rejects sync for any
+     * database id that is not in the allowlist; `"directory"` is always allowed
+     * and the tenant admin is exempt (resolved from the principal signing key).
+     */
+    private buildDbAccessEvaluator;
+    /**
+     * Build a remote-wipe resolver closure for a server store, or undefined when
+     * the directory does not support wipe directives (docs/accesscontrol.md §6.5).
+     * Maps a wipe-targeted signing key to the admin-signed grant document id so
+     * the server can serve only that document to the targeted device.
+     */
+    private buildWipeGrantDocIdResolver;
+    /**
+     * Build a per-user revoked-key blacklist resolver for a server store, or
+     * undefined when the directory cannot resolve revoked keys (e.g. a
+     * config-based directory). Maps the authenticated principal's signing key to
+     * the set of decryption key ids revoked for them at the directory head
+     * (docs/accesscontrol.md §13).
+     */
+    private buildRevokedKeyResolver;
+    getStore(tenantId: string, dbId: string, storeKind: StoreKind): Promise<ContentAddressedStore>;
+    /**
+     * Documents purged from `dbId` on this server (the persistent purge
+     * registry). Peer pull replication refuses their entries.
+     */
+    getPurgedDocIds(tenantId: string, dbId: string): ReadonlySet<string>;
+    /** The (lazily-loaded, cached) purge registry for a tenant. */
+    private getPurgedDocRegistry;
+    /**
+     * Execute any not-yet-processed document-history purge requests for a tenant
+     * (docs/accesscontrol.md §13). Reads the admin-signed purge requests from the
+     * tenant directory (server-readable `$publicinfos` envelope), physically
+     * purges each requested document's history from the tenant's `docs` and
+     * `attachments` stores, and records the purge in the persistent registry so
+     * (a) it is never executed twice and (b) re-pushes of the purged docs are
+     * rejected at sync time.
+     *
+     * No-op when the server cannot read the directory (config-based fallback, or
+     * the directory does not expose the purge reader). Runs are serialized per
+     * tenant; concurrent callers share the in-flight promise.
+     */
+    executePendingPurges(tenantId: string, options?: ExecutePendingPurgesOptions): Promise<void>;
+    private executePendingPurgesInternal;
+    /**
+     * Purge one document from a database's docs and attachment stores. Attachment
+     * chunks still referenced by another document are kept (see
+     * `purgeDocumentHistory.ts`). Failures are logged, never thrown.
+     */
+    private purgeDocumentFromDatabase;
+    getAuthService(tenantId: string): Promise<AuthenticationService>;
+    getCryptoAdapter(): CryptoAdapter;
+    reloadTenant(tenantId: string): Promise<LoadedTenant>;
+    clearCache(): void;
+    private loadTenant;
+    /**
+     * Create a real BaseMindooTenant for directory reading using the global
+     * server identity.
+     */
+    private createDirectoryTenant;
+}
+//# sourceMappingURL=TenantManager.d.ts.map

package/dist/server/TenantManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantManager.d.ts","sourceRoot":"","sources":["../../src/server/TenantManager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAC/F,OAAO,EAAE,kCAAkC,EAAE,MAAM,gEAAgE,CAAC;AACpH,OAAO,KAAK,EAMV,uBAAuB,EACvB,4BAA4B,EAC7B,MAAM,gEAAgE,CAAC;AAGxE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAEnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mDAAmD,CAAC;AAO3F,OAAO,KAAK,EACV,YAAY,EACZ,qBAAqB,EACrB,qBAAqB,EAMrB,mBAAmB,EAGpB,MAAM,eAAe,CAAC;AACvB,OAAO,EAEL,SAAS,EAEV,MAAM,eAAe,CAAC;AAOvB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAGlE,OAAO,KAAK,EACV,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EACV,YAAY,EACZ,aAAa,EACb,qBAAqB,EAErB,aAAa,EACd,MAAM,SAAS,CAAC;AAMjB,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,aAAa,CAAC;IACvB,YAAY,EAAE,kBAAkB,CAAC;IACjC,WAAW,EAAE,qBAAqB,CAAC;IACnC,SAAS,EAAE,qBAAqB,CAAC;IACjC,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,kCAAkC,CAAC,CAAC;CAC/D;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,aAAa,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;CAClB;AAoBD,qBAAa,qBAAsB,YAAW,IAAI,CAChD,qBAAqB,EACnB,mBAAmB,GACnB,eAAe,GACf,0BAA0B,GAC1B,2BAA2B,CAC9B;IACC,2EAA2E;IAC3E,OAAO,CAAC,UAAU,CAAsC;IACxD;;;;OAIG;IACH,OAAO,CAAC,eAAe,CAAsC;IAC7D,OAAO,CAAC,YAAY,CAA0B;IAC9C,OAAO,CAAC,qBAAqB,CAAS;gBAE1B,MAAM,EAAE,YAAY;IAe1B,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QACjD,gBAAgB,EAAE,MAAM,CAAC;QACzB,mBAAmB,EAAE,MAAM,CAAC;KAC7B,GAAG,IAAI,CAAC;IAeH,yBAAyB,CAC7B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAetC,OAAO,CAAC,QAAQ;IAeV,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIjD,wBAAwB,CAC5B,SAAS,EAAE,MAAM,EACjB,KAAK,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAA;KAAE,GACjC,OAAO,CAAC,OAAO,CAAC;CAgBpB;AAsSD,MAAM,WAAW,oBAAoB;IACnC,oEAAoE;IACpE,SAAS,EAAE,eAAe,CAAC;IAC3B,yDAAyD;IACzD,aAAa,EAAE,mBAAmB,CAAC;IACnC,aAAa,EAAE,aAAa,CAAC;IAC7B,yEAAyE;IACzE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/D;;;;OAIG;IACH,uBAAuB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;CACvE;AAED,MAAM,WAAW,2BAA2B;IAC1C;;;;OAIG;IACH,KAAK,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC7B;AAED;;;;;;;;;GASG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkB;IAC5C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAsB;IACpD,OAAO,CAAC,cAAc,CAAqB;IAC3C,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA6C;IAChF,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAkD;IAC1F,OAAO,CAAC,aAAa,CAAwC;IAE7D,OAAO,CAAC,cAAc,CAA8B;IACpD,OAAO,CAAC,cAAc,CAAuB;IAC7C,+EAA+E;IAC/E,OAAO,CAAC,aAAa,CAA4B;IACjD,gGAAgG;IAChG,OAAO,CAAC,0BAA0B,CAAwB;IAC1D,+EAA+E;IAC/E,OAAO,CAAC,iBAAiB,CAGlB;IACP,qFAAqF;IACrF,OAAO,CAAC,mBAAmB,CAA6C;IACxE,mFAAmF;IACnF,OAAO,CAAC,aAAa,CAAyC;gBAElD,OAAO,EAAE,oBAAoB;IAmCzC,iBAAiB,IAAI,aAAa,GAAG,IAAI;IAIzC,mBAAmB,IAAI,aAAa,GAAG,IAAI;IAW3C;;;;;;;;;;;;;;;;;;OAkBG;IACH,oBAAoB,CAAC,OAAO,EAAE;QAC5B,iBAAiB,CAAC,EAAE,uBAAuB,CAAC;QAC5C,sBAAsB,CAAC,EAAE,4BAA4B,CAAC;KACvD,GAAG,IAAI;IAIR;;;;OAIG;IACH,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE;IAIzC;;;;;;OAMG;IACG,6BAA6B,IAAI,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;IAsBrE;;;;;OAKG;IACG,gBAAgB,IAAI,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;IA0B5D;;;;;OAKG;IACG,oBAAoB,IAAI,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC;IAUpE,kBAAkB,IAAI,aAAa,EAAE;IAIrC,gBAAgB,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI;IAY7C;;;;;;;OAOG;IACH,iBAAiB,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI;IAa9C,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAW1C,OAAO,CAAC,qBAAqB;YAOf,gBAAgB;YAiBhB,kBAAkB;YAgBlB,gBAAgB;IAI9B,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,eAAe;YAcT,6BAA6B;IAW3C;;;OAGG;IACH,OAAO,CAAC,SAAS;IAejB,OAAO,CAAC,eAAe;IAIvB,OAAO,CAAC,gBAAgB;IAKxB,OAAO,CAAC,iBAAiB;YAOX,8BAA8B;YAqC9B,6BAA6B;YAgB7B,wBAAwB;YAoBxB,2BAA2B;IAoBzC;;;OAGG;IACG,2BAA2B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAIpE,iCAAiC,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAiBtE,cAAc,CAClB,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,oBAAoB,CAAC;IAwD1B,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAcxD,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAKvC;;;OAGG;IACH,8BAA8B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAoB/D;;;OAGG;IACH,0BAA0B,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO;IAK5E;;;;OAIG;IACH,iCAAiC,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO;IASjE,WAAW,IAAI,MAAM,EAAE;IAOvB;;;OAGG;IACH,kBAAkB,CAChB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC,GACvD,IAAI;IAgBD,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA4B7C,cAAc,CAClB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,SAAS,GACnB,OAAO,CAAC,kCAAkC,CAAC;IAqE9C;;;;;;OAMG;IACH;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAU3B;;;;;;;OAOG;IACH,OAAO,CAAC,8BAA8B;YA8BxB,eAAe;IAkB7B;;;;;;;OAOG;IACH,OAAO,CAAC,sBAAsB;IAkB9B;;;;;OAKG;IACH,OAAO,CAAC,2BAA2B;IASnC;;;;;;OAMG;IACH,OAAO,CAAC,uBAAuB;IAgBzB,QAAQ,CACZ,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,SAAS,GACnB,OAAO,CAAC,qBAAqB,CAAC;IAKjC;;;OAGG;IACH,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC;IAIpE,+DAA+D;IAC/D,OAAO,CAAC,oBAAoB;IAa5B;;;;;;;;;;;;OAYG;IACG,oBAAoB,CACxB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,2BAA2B,GACpC,OAAO,CAAC,IAAI,CAAC;YAWF,4BAA4B;IAwF1C;;;;OAIG;YACW,yBAAyB;IAqBjC,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAKtE,gBAAgB,IAAI,aAAa;IAI3B,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAM3D,UAAU,IAAI,IAAI;YASJ,UAAU;IAyFxB;;;OAGG;YACW,qBAAqB;CA6CpC"}