promptspeak-mcp-server 0.1.0

package/dist/auth/api-key.js

@@ -0,0 +1,202 @@
+/**
+ * API Key Management
+ *
+ * Handles API key generation, validation, and storage.
+ * Keys are stored hashed in SQLite with bcrypt.
+ */
+import * as crypto from 'crypto';
+import bcrypt from 'bcrypt';
+import { getDatabase } from '../symbols/database.js';
+import { createSecureLogger } from '../core/security/index.js';
+const logger = createSecureLogger('ApiKeyManager');
+// ═══════════════════════════════════════════════════════════════════════════
+// INITIALIZATION
+// ═══════════════════════════════════════════════════════════════════════════
+let initialized = false;
+export function initializeApiKeyTable() {
+    if (initialized)
+        return;
+    const db = getDatabase();
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS api_keys (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      key_hash TEXT UNIQUE NOT NULL,
+      key_prefix TEXT NOT NULL,
+      user_id TEXT NOT NULL,
+      name TEXT,
+      scopes TEXT NOT NULL DEFAULT '["read","write"]',
+      rate_limit_tier TEXT DEFAULT 'free',
+      created_at TEXT NOT NULL,
+      last_used_at TEXT,
+      expires_at TEXT,
+      revoked_at TEXT,
+
+      CONSTRAINT valid_prefix CHECK (key_prefix LIKE 'ps_%')
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_api_keys_user ON api_keys(user_id);
+    CREATE INDEX IF NOT EXISTS idx_api_keys_prefix ON api_keys(key_prefix);
+  `);
+    initialized = true;
+}
+// ═══════════════════════════════════════════════════════════════════════════
+// KEY GENERATION
+// ═══════════════════════════════════════════════════════════════════════════
+function generateApiKey(environment = 'live') {
+    const prefix = `ps_${environment}_`;
+    const randomBytes = crypto.randomBytes(24);
+    const key = randomBytes.toString('base64url');
+    return `${prefix}${key}`;
+}
+export async function createApiKey(request) {
+    initializeApiKeyTable();
+    const db = getDatabase();
+    const key = generateApiKey('live');
+    const keyPrefix = key.substring(0, 16);
+    // Hash the key for storage
+    const saltRounds = 12;
+    const keyHash = await bcrypt.hash(key, saltRounds);
+    const scopes = request.scopes || ['read', 'write'];
+    const rateLimitTier = request.rateLimitTier || 'free';
+    const createdAt = new Date().toISOString();
+    let expiresAt = null;
+    if (request.expiresInDays) {
+        const expiryDate = new Date();
+        expiryDate.setDate(expiryDate.getDate() + request.expiresInDays);
+        expiresAt = expiryDate.toISOString();
+    }
+    const stmt = db.prepare(`
+    INSERT INTO api_keys (key_hash, key_prefix, user_id, name, scopes, rate_limit_tier, created_at, expires_at)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+  `);
+    const result = stmt.run(keyHash, keyPrefix, request.userId, request.name || null, JSON.stringify(scopes), rateLimitTier, createdAt, expiresAt);
+    const keyInfo = {
+        id: result.lastInsertRowid,
+        keyPrefix,
+        userId: request.userId,
+        name: request.name || null,
+        scopes,
+        rateLimitTier,
+        createdAt,
+        lastUsedAt: null,
+        expiresAt,
+        revoked: false,
+    };
+    return {
+        key, // Return the plaintext key only at creation
+        keyPrefix,
+        keyInfo,
+    };
+}
+// ═══════════════════════════════════════════════════════════════════════════
+// KEY VALIDATION
+// ═══════════════════════════════════════════════════════════════════════════
+export async function validateApiKey(apiKey) {
+    initializeApiKeyTable();
+    const db = getDatabase();
+    const keyPrefix = apiKey.substring(0, 16);
+    // Find keys with matching prefix (there may be multiple if prefix collision)
+    const stmt = db.prepare(`
+    SELECT id, key_hash, key_prefix, user_id, name, scopes, rate_limit_tier,
+           created_at, last_used_at, expires_at, revoked_at
+    FROM api_keys
+    WHERE key_prefix = ? AND revoked_at IS NULL
+  `);
+    const rows = stmt.all(keyPrefix);
+    if (rows.length === 0) {
+        return null;
+    }
+    // Check each potential match with bcrypt
+    for (const row of rows) {
+        const isValid = await bcrypt.compare(apiKey, row.key_hash);
+        if (isValid) {
+            // Update last used timestamp
+            const updateStmt = db.prepare(`
+        UPDATE api_keys SET last_used_at = ? WHERE id = ?
+      `);
+            updateStmt.run(new Date().toISOString(), row.id);
+            return {
+                id: row.id,
+                keyPrefix: row.key_prefix,
+                userId: row.user_id,
+                name: row.name,
+                scopes: JSON.parse(row.scopes),
+                rateLimitTier: row.rate_limit_tier,
+                createdAt: row.created_at,
+                lastUsedAt: new Date().toISOString(),
+                expiresAt: row.expires_at,
+                revoked: false,
+            };
+        }
+    }
+    return null;
+}
+// ═══════════════════════════════════════════════════════════════════════════
+// KEY MANAGEMENT
+// ═══════════════════════════════════════════════════════════════════════════
+export function listApiKeys(userId) {
+    initializeApiKeyTable();
+    const db = getDatabase();
+    const stmt = db.prepare(`
+    SELECT id, key_prefix, user_id, name, scopes, rate_limit_tier,
+           created_at, last_used_at, expires_at, revoked_at
+    FROM api_keys
+    WHERE user_id = ?
+    ORDER BY created_at DESC
+  `);
+    const rows = stmt.all(userId);
+    return rows.map(row => ({
+        id: row.id,
+        keyPrefix: row.key_prefix,
+        userId: row.user_id,
+        name: row.name,
+        scopes: JSON.parse(row.scopes),
+        rateLimitTier: row.rate_limit_tier,
+        createdAt: row.created_at,
+        lastUsedAt: row.last_used_at,
+        expiresAt: row.expires_at,
+        revoked: row.revoked_at !== null,
+    }));
+}
+export function revokeApiKey(keyId, userId) {
+    initializeApiKeyTable();
+    const db = getDatabase();
+    const stmt = db.prepare(`
+    UPDATE api_keys
+    SET revoked_at = ?
+    WHERE id = ? AND user_id = ? AND revoked_at IS NULL
+  `);
+    const result = stmt.run(new Date().toISOString(), keyId, userId);
+    return result.changes > 0;
+}
+// ═══════════════════════════════════════════════════════════════════════════
+// BOOTSTRAP: Create default API key for development
+// ═══════════════════════════════════════════════════════════════════════════
+export async function ensureDefaultApiKey() {
+    initializeApiKeyTable();
+    const db = getDatabase();
+    // Check if any keys exist for the default user
+    const stmt = db.prepare(`
+    SELECT COUNT(*) as count FROM api_keys WHERE user_id = 'default'
+  `);
+    const result = stmt.get();
+    if (result.count === 0) {
+        // Create a default API key for development
+        const keyResult = await createApiKey({
+            userId: 'default',
+            name: 'Default Development Key',
+            scopes: ['read', 'write', 'delete', 'import', 'admin'],
+            rateLimitTier: 'enterprise',
+        });
+        // SECURITY: Never log full API keys - only log the prefix for correlation
+        // The key is returned to the caller who can display it appropriately
+        logger.unsafe.info('DEFAULT API KEY CREATED', {
+            keyPrefix: keyResult.keyPrefix,
+            userId: 'default',
+            note: 'Key returned to caller - not logged for security',
+        });
+        return keyResult.key;
+    }
+    return null;
+}
+//# sourceMappingURL=api-key.js.map

package/dist/auth/api-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key.js","sourceRoot":"","sources":["../../src/auth/api-key.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE/D,MAAM,MAAM,GAAG,kBAAkB,CAAC,eAAe,CAAC,CAAC;AAiCnD,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,IAAI,WAAW,GAAG,KAAK,CAAC;AAExB,MAAM,UAAU,qBAAqB;IACnC,IAAI,WAAW;QAAE,OAAO;IAExB,MAAM,EAAE,GAAG,WAAW,EAAE,CAAC;IAEzB,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;GAmBP,CAAC,CAAC;IAEH,WAAW,GAAG,IAAI,CAAC;AACrB,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,SAAS,cAAc,CAAC,cAA+B,MAAM;IAC3D,MAAM,MAAM,GAAG,MAAM,WAAW,GAAG,CAAC;IACpC,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC9C,OAAO,GAAG,MAAM,GAAG,GAAG,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAA4B;IAC7D,qBAAqB,EAAE,CAAC;IAExB,MAAM,EAAE,GAAG,WAAW,EAAE,CAAC;IACzB,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEvC,2BAA2B;IAC3B,MAAM,UAAU,GAAG,EAAE,CAAC;IACtB,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAEnD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnD,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,MAAM,CAAC;IACtD,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE3C,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QAC1B,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC;QAC9B,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;QACjE,SAAS,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;IACvC,CAAC;IAED,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC;;;GAGvB,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CACrB,OAAO,EACP,SAAS,EACT,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,IAAI,IAAI,IAAI,EACpB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EACtB,aAAa,EACb,SAAS,EACT,SAAS,CACV,CAAC;IAEF,MAAM,OAAO,GAAe;QAC1B,EAAE,EAAE,MAAM,CAAC,eAAyB;QACpC,SAAS;QACT,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,IAAI;QAC1B,MAAM;QACN,aAAa;QACb,SAAS;QACT,UAAU,EAAE,IAAI;QAChB,SAAS;QACT,OAAO,EAAE,KAAK;KACf,CAAC;IAEF,OAAO;QACL,GAAG,EAAG,4CAA4C;QAClD,SAAS;QACT,OAAO;KACR,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAc;IACjD,qBAAqB,EAAE,CAAC;IAExB,MAAM,EAAE,GAAG,WAAW,EAAE,CAAC;IACzB,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAE1C,6EAA6E;IAC7E,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC;;;;;GAKvB,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAY7B,CAAC;IAEH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,yCAAyC;IACzC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC3D,IAAI,OAAO,EAAE,CAAC;YACZ,6BAA6B;YAC7B,MAAM,UAAU,GAAG,EAAE,CAAC,OAAO,CAAC;;OAE7B,CAAC,CAAC;YACH,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YAEjD,OAAO;gBACL,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,SAAS,EAAE,GAAG,CAAC,UAAU;gBACzB,MAAM,EAAE,GAAG,CAAC,OAAO;gBACnB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;gBAC9B,aAAa,EAAE,GAAG,CAAC,eAAgD;gBACnE,SAAS,EAAE,GAAG,CAAC,UAAU;gBACzB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACpC,SAAS,EAAE,GAAG,CAAC,UAAU;gBACzB,OAAO,EAAE,KAAK;aACf,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,qBAAqB,EAAE,CAAC;IAExB,MAAM,EAAE,GAAG,WAAW,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC;;;;;;GAMvB,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAW1B,CAAC;IAEH,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtB,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,MAAM,EAAE,GAAG,CAAC,OAAO;QACnB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;QAC9B,aAAa,EAAE,GAAG,CAAC,eAAgD;QACnE,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,UAAU,EAAE,GAAG,CAAC,YAAY;QAC5B,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,OAAO,EAAE,GAAG,CAAC,UAAU,KAAK,IAAI;KACjC,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAa,EAAE,MAAc;IACxD,qBAAqB,EAAE,CAAC;IAExB,MAAM,EAAE,GAAG,WAAW,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC;;;;GAIvB,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IACjE,OAAO,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED,8EAA8E;AAC9E,oDAAoD;AACpD,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,qBAAqB,EAAE,CAAC;IAExB,MAAM,EAAE,GAAG,WAAW,EAAE,CAAC;IAEzB,+CAA+C;IAC/C,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC;;GAEvB,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAuB,CAAC;IAE/C,IAAI,MAAM,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;QACvB,2CAA2C;QAC3C,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC;YACnC,MAAM,EAAE,SAAS;YACjB,IAAI,EAAE,yBAAyB;YAC/B,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC;YACtD,aAAa,EAAE,YAAY;SAC5B,CAAC,CAAC;QAEH,0EAA0E;QAC1E,qEAAqE;QACrE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE;YAC5C,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,MAAM,EAAE,SAAS;YACjB,IAAI,EAAE,kDAAkD;SACzD,CAAC,CAAC;QAEH,OAAO,SAAS,CAAC,GAAG,CAAC;IACvB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/auth/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Authentication Module
+ *
+ * Exports API key and OAuth authentication utilities.
+ */
+export * from './api-key.js';
+export * from './oauth.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}

package/dist/auth/index.js

@@ -0,0 +1,8 @@
+/**
+ * Authentication Module
+ *
+ * Exports API key and OAuth authentication utilities.
+ */
+export * from './api-key.js';
+export * from './oauth.js';
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}

package/dist/auth/oauth.d.ts

@@ -0,0 +1,125 @@
+/**
+ * OAuth Token Validation
+ *
+ * Provides OAuth 2.0 Bearer token validation with support for:
+ * - Local JWT validation (self-issued tokens)
+ * - External OAuth provider validation (Auth0, Okta, etc.)
+ */
+import { Result } from '../core/result/index.js';
+/**
+ * Decoded token payload after validation.
+ */
+export interface TokenPayload {
+    /** Subject - usually the user ID */
+    sub: string;
+    /** Issuer - the OAuth provider or this server */
+    iss?: string;
+    /** Audience - intended recipient */
+    aud?: string | string[];
+    /** Expiration time (Unix timestamp) */
+    exp?: number;
+    /** Issued at time (Unix timestamp) */
+    iat?: number;
+    /** Token scopes/permissions */
+    scope?: string;
+    /** Tenant ID for multi-tenant deployments */
+    tenant_id?: string;
+    /** Custom claims */
+    [key: string]: unknown;
+}
+/**
+ * Configuration for OAuth token validation.
+ */
+export interface OAuthConfig {
+    /** Whether OAuth is enabled */
+    enabled: boolean;
+    /** OAuth provider issuer URL (for external validation) */
+    issuer: string;
+    /** Expected audience claim */
+    audience?: string;
+    /** JWT secret for local validation */
+    jwtSecret: string;
+    /** JWT expiry for local token generation */
+    jwtExpiry: string;
+    /** Whether to use external provider for validation */
+    useExternalProvider: boolean;
+    /** Cache duration for external JWKS in milliseconds */
+    jwksCacheDurationMs?: number;
+}
+/**
+ * Validated token information returned to the caller.
+ */
+export interface ValidatedToken {
+    /** The user ID (from sub claim) */
+    userId: string;
+    /** Tenant ID if present */
+    tenantId?: string;
+    /** Token scopes as array */
+    scopes: string[];
+    /** Token expiration time */
+    expiresAt?: Date;
+    /** Raw token payload for additional claims */
+    payload: TokenPayload;
+}
+/**
+ * OAuth Token Validator
+ *
+ * Validates OAuth 2.0 Bearer tokens using either local JWT validation
+ * or external OAuth provider validation.
+ */
+export declare class OAuthTokenValidator {
+    private readonly config;
+    private jwksCache;
+    constructor(config: OAuthConfig);
+    /**
+     * Validates a Bearer token and returns the validated token information.
+     */
+    validate(token: string): Promise<Result<ValidatedToken>>;
+    /**
+     * Validates a token using local JWT verification.
+     */
+    private validateLocalJwt;
+    /**
+     * Validates a token using an external OAuth provider.
+     */
+    private validateWithExternalProvider;
+    /**
+     * Fetches JWKS from the OAuth provider's well-known endpoint.
+     */
+    private fetchJwks;
+    /**
+     * Converts a JWK to PEM format for jwt.verify.
+     */
+    private jwkToPem;
+    /**
+     * Builds a ValidatedToken from the decoded payload.
+     */
+    private buildValidatedToken;
+    /**
+     * Handles JWT verification errors.
+     */
+    private handleJwtError;
+    /** Clears the JWKS cache. */
+    clearJwksCache(): void;
+}
+/**
+ * Generates a local JWT token for testing or development.
+ */
+export declare function generateLocalToken(userId: string, options: {
+    scopes?: string[];
+    tenantId?: string;
+    expiresIn?: string;
+}, config: Pick<OAuthConfig, 'jwtSecret' | 'jwtExpiry' | 'issuer' | 'audience'>): string;
+/**
+ * Creates or returns the singleton OAuthTokenValidator.
+ */
+export declare function getOAuthValidator(config?: OAuthConfig): OAuthTokenValidator;
+/**
+ * Initializes the OAuth validator with configuration.
+ */
+export declare function initializeOAuthValidator(config: OAuthConfig): OAuthTokenValidator;
+/**
+ * Resets the OAuth validator (for testing).
+ */
+export declare function resetOAuthValidator(): void;
+//# sourceMappingURL=oauth.d.ts.map

package/dist/auth/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../src/auth/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,MAAM,EAAiC,MAAM,yBAAyB,CAAC;AAMhF;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,oCAAoC;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,iDAAiD;IACjD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,oCAAoC;IACpC,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,uCAAuC;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,sCAAsC;IACtC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6CAA6C;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oBAAoB;IACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,+BAA+B;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,0DAA0D;IAC1D,MAAM,EAAE,MAAM,CAAC;IACf,8BAA8B;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sCAAsC;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,4CAA4C;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,sDAAsD;IACtD,mBAAmB,EAAE,OAAO,CAAC;IAC7B,uDAAuD;IACvD,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,mCAAmC;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,2BAA2B;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4BAA4B;IAC5B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,4BAA4B;IAC5B,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,8CAA8C;IAC9C,OAAO,EAAE,YAAY,CAAC;CACvB;AAMD;;;;;GAKG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;IACrC,OAAO,CAAC,SAAS,CAA0D;gBAE/D,MAAM,EAAE,WAAW;IAI/B;;OAEG;IACG,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAiB9D;;OAEG;YACW,gBAAgB;IAc9B;;OAEG;YACW,4BAA4B;IAuC1C;;OAEG;YACW,SAAS;IAmCvB;;OAEG;IACH,OAAO,CAAC,QAAQ;IAchB;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAqB3B;;OAEG;IACH,OAAO,CAAC,cAAc;IAuBtB,6BAA6B;IAC7B,cAAc,IAAI,IAAI;CAGvB;AAMD;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE;IACP,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,EACD,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,WAAW,GAAG,QAAQ,GAAG,UAAU,CAAC,GAC3E,MAAM,CAYR;AAQD;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,mBAAmB,CAQ3E;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,WAAW,GAAG,mBAAmB,CAGjF;AAED;;GAEG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C"}

package/dist/auth/oauth.js

@@ -0,0 +1,225 @@
+/**
+ * OAuth Token Validation
+ *
+ * Provides OAuth 2.0 Bearer token validation with support for:
+ * - Local JWT validation (self-issued tokens)
+ * - External OAuth provider validation (Auth0, Okta, etc.)
+ */
+import jwt from 'jsonwebtoken';
+import { success, failure, fromPromise } from '../core/result/index.js';
+// ═══════════════════════════════════════════════════════════════════════════════
+// TOKEN VALIDATOR
+// ═══════════════════════════════════════════════════════════════════════════════
+/**
+ * OAuth Token Validator
+ *
+ * Validates OAuth 2.0 Bearer tokens using either local JWT validation
+ * or external OAuth provider validation.
+ */
+export class OAuthTokenValidator {
+    config;
+    jwksCache = null;
+    constructor(config) {
+        this.config = config;
+    }
+    /**
+     * Validates a Bearer token and returns the validated token information.
+     */
+    async validate(token) {
+        if (!this.config.enabled) {
+            return failure('OAUTH_DISABLED', 'OAuth authentication is not enabled');
+        }
+        if (!token || token.trim() === '') {
+            return failure('INVALID_TOKEN', 'Token is required');
+        }
+        // Choose validation strategy based on configuration
+        if (this.config.useExternalProvider && this.config.issuer) {
+            return this.validateWithExternalProvider(token);
+        }
+        return this.validateLocalJwt(token);
+    }
+    /**
+     * Validates a token using local JWT verification.
+     */
+    async validateLocalJwt(token) {
+        try {
+            const payload = jwt.verify(token, this.config.jwtSecret, {
+                algorithms: ['HS256', 'HS384', 'HS512'],
+                issuer: this.config.issuer || undefined,
+                audience: this.config.audience || undefined,
+            });
+            return this.buildValidatedToken(payload);
+        }
+        catch (error) {
+            return this.handleJwtError(error);
+        }
+    }
+    /**
+     * Validates a token using an external OAuth provider.
+     */
+    async validateWithExternalProvider(token) {
+        const decoded = jwt.decode(token, { complete: true });
+        if (!decoded || typeof decoded === 'string') {
+            return failure('INVALID_TOKEN', 'Unable to decode token');
+        }
+        const { kid } = decoded.header;
+        if (!kid) {
+            return failure('INVALID_TOKEN', 'Token missing key ID (kid)');
+        }
+        const jwksResult = await this.fetchJwks();
+        if (!jwksResult.success) {
+            return jwksResult;
+        }
+        const key = jwksResult.data.find((k) => k.kid === kid);
+        if (!key) {
+            return failure('INVALID_TOKEN', 'Token signed with unknown key');
+        }
+        const pemResult = this.jwkToPem(key);
+        if (!pemResult.success) {
+            return pemResult;
+        }
+        try {
+            const payload = jwt.verify(token, pemResult.data, {
+                algorithms: ['RS256', 'RS384', 'RS512', 'ES256', 'ES384', 'ES512'],
+                issuer: this.config.issuer,
+                audience: this.config.audience || undefined,
+            });
+            return this.buildValidatedToken(payload);
+        }
+        catch (error) {
+            return this.handleJwtError(error);
+        }
+    }
+    /**
+     * Fetches JWKS from the OAuth provider's well-known endpoint.
+     */
+    async fetchJwks() {
+        if (this.jwksCache && Date.now() < this.jwksCache.expiresAt) {
+            return success(this.jwksCache.keys);
+        }
+        const jwksUri = `${this.config.issuer.replace(/\/$/, '')}/.well-known/jwks.json`;
+        const fetchResult = await fromPromise(fetch(jwksUri).then(async (res) => {
+            if (!res.ok) {
+                throw new Error(`Failed to fetch JWKS: ${res.status} ${res.statusText}`);
+            }
+            return res.json();
+        }), 'JWKS_FETCH_FAILED');
+        if (!fetchResult.success) {
+            return failure('JWKS_FETCH_FAILED', `Failed to fetch JWKS from ${jwksUri}: ${fetchResult.error.message}`);
+        }
+        const { keys } = fetchResult.data;
+        if (!keys || !Array.isArray(keys)) {
+            return failure('INVALID_JWKS', 'JWKS response missing keys array');
+        }
+        const cacheDuration = this.config.jwksCacheDurationMs ?? 3600000;
+        this.jwksCache = { keys, expiresAt: Date.now() + cacheDuration };
+        return success(keys);
+    }
+    /**
+     * Converts a JWK to PEM format for jwt.verify.
+     */
+    jwkToPem(jwk) {
+        try {
+            const crypto = require('crypto');
+            const keyObject = crypto.createPublicKey({ key: jwk, format: 'jwk' });
+            const pem = keyObject.export({ type: 'spki', format: 'pem' });
+            return success(pem);
+        }
+        catch (error) {
+            return failure('JWK_CONVERSION_FAILED', `Failed to convert JWK to PEM: ${error instanceof Error ? error.message : 'Unknown error'}`);
+        }
+    }
+    /**
+     * Builds a ValidatedToken from the decoded payload.
+     */
+    buildValidatedToken(payload) {
+        if (!payload.sub) {
+            return failure('INVALID_TOKEN', 'Token missing subject (sub) claim');
+        }
+        let scopes = [];
+        if (typeof payload.scope === 'string') {
+            scopes = payload.scope.split(' ').filter(Boolean);
+        }
+        else if (Array.isArray(payload.scope)) {
+            scopes = payload.scope;
+        }
+        return success({
+            userId: payload.sub,
+            tenantId: payload.tenant_id,
+            scopes,
+            expiresAt: payload.exp ? new Date(payload.exp * 1000) : undefined,
+            payload,
+        });
+    }
+    /**
+     * Handles JWT verification errors.
+     */
+    handleJwtError(error) {
+        if (error instanceof jwt.TokenExpiredError) {
+            return failure('TOKEN_EXPIRED', 'Token has expired', {
+                details: { expiredAt: error.expiredAt },
+            });
+        }
+        if (error instanceof jwt.NotBeforeError) {
+            return failure('TOKEN_NOT_ACTIVE', 'Token is not yet active', {
+                details: { notBefore: error.date },
+            });
+        }
+        if (error instanceof jwt.JsonWebTokenError) {
+            return failure('INVALID_TOKEN', `Invalid token: ${error.message}`);
+        }
+        return failure('TOKEN_VALIDATION_FAILED', `Token validation failed: ${error instanceof Error ? error.message : 'Unknown error'}`);
+    }
+    /** Clears the JWKS cache. */
+    clearJwksCache() {
+        this.jwksCache = null;
+    }
+}
+// ═══════════════════════════════════════════════════════════════════════════════
+// LOCAL TOKEN GENERATION
+// ═══════════════════════════════════════════════════════════════════════════════
+/**
+ * Generates a local JWT token for testing or development.
+ */
+export function generateLocalToken(userId, options, config) {
+    const payload = {
+        sub: userId,
+        iss: config.issuer || 'promptspeak',
+        aud: config.audience || 'promptspeak-api',
+        scope: options.scopes?.join(' ') || 'read write',
+        tenant_id: options.tenantId,
+    };
+    return jwt.sign(payload, config.jwtSecret, {
+        expiresIn: options.expiresIn || config.jwtExpiry || '1h',
+    });
+}
+// ═══════════════════════════════════════════════════════════════════════════════
+// FACTORY
+// ═══════════════════════════════════════════════════════════════════════════════
+let validatorInstance = null;
+/**
+ * Creates or returns the singleton OAuthTokenValidator.
+ */
+export function getOAuthValidator(config) {
+    if (!validatorInstance && config) {
+        validatorInstance = new OAuthTokenValidator(config);
+    }
+    if (!validatorInstance) {
+        throw new Error('OAuthTokenValidator not initialized. Call with config first.');
+    }
+    return validatorInstance;
+}
+/**
+ * Initializes the OAuth validator with configuration.
+ */
+export function initializeOAuthValidator(config) {
+    validatorInstance = new OAuthTokenValidator(config);
+    return validatorInstance;
+}
+/**
+ * Resets the OAuth validator (for testing).
+ */
+export function resetOAuthValidator() {
+    validatorInstance = null;
+}
+//# sourceMappingURL=oauth.js.map

package/dist/auth/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../src/auth/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,GAAG,MAAM,cAAc,CAAC;AAC/B,OAAO,EAAU,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAgEhF,kFAAkF;AAClF,kBAAkB;AAClB,kFAAkF;AAElF;;;;;GAKG;AACH,MAAM,OAAO,mBAAmB;IACb,MAAM,CAAc;IAC7B,SAAS,GAAqD,IAAI,CAAC;IAE3E,YAAY,MAAmB;QAC7B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ,CAAC,KAAa;QAC1B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO,OAAO,CAAC,gBAAgB,EAAE,qCAAqC,CAAC,CAAC;QAC1E,CAAC;QAED,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAClC,OAAO,OAAO,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;QACvD,CAAC;QAED,oDAAoD;QACpD,IAAI,IAAI,CAAC,MAAM,CAAC,mBAAmB,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YAC1D,OAAO,IAAI,CAAC,4BAA4B,CAAC,KAAK,CAAC,CAAC;QAClD,CAAC;QAED,OAAO,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,gBAAgB,CAAC,KAAa;QAC1C,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE;gBACvD,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;gBACvC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,SAAS;gBACvC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,SAAS;aAC5C,CAAiB,CAAC;YAEnB,OAAO,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,4BAA4B,CAAC,KAAa;QACtD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC5C,OAAO,OAAO,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;QAC/B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,OAAO,CAAC,eAAe,EAAE,4BAA4B,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QAC1C,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YACxB,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAgC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;QACtF,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,OAAO,CAAC,eAAe,EAAE,+BAA+B,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YACvB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,EAAE;gBAChD,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;gBAClE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;gBAC1B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,SAAS;aAC5C,CAAiB,CAAC;YAEnB,OAAO,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,SAAS;QACrB,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;YAC5D,OAAO,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC;QAED,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,wBAAwB,CAAC;QAEjF,MAAM,WAAW,GAAG,MAAM,WAAW,CACnC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAChC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;YAC3E,CAAC;YACD,OAAO,GAAG,CAAC,IAAI,EAAqC,CAAC;QACvD,CAAC,CAAC,EACF,mBAAmB,CACpB,CAAC;QAEF,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO,OAAO,CACZ,mBAAmB,EACnB,6BAA6B,OAAO,KAAK,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,CACrE,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC;QAClC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,OAAO,OAAO,CAAC,cAAc,EAAE,kCAAkC,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,mBAAmB,IAAI,OAAO,CAAC;QACjE,IAAI,CAAC,SAAS,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,EAAE,CAAC;QAEjE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IAED;;OAEG;IACK,QAAQ,CAAC,GAAe;QAC9B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;YACjC,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YACtE,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW,CAAC;YACxE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,OAAO,CACZ,uBAAuB,EACvB,iCAAiC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAC5F,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACK,mBAAmB,CAAC,OAAqB;QAC/C,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YACjB,OAAO,OAAO,CAAC,eAAe,EAAE,mCAAmC,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,MAAM,GAAa,EAAE,CAAC;QAC1B,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpD,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACxC,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;QACzB,CAAC;QAED,OAAO,OAAO,CAAC;YACb,MAAM,EAAE,OAAO,CAAC,GAAG;YACnB,QAAQ,EAAE,OAAO,CAAC,SAA+B;YACjD,MAAM;YACN,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;YACjE,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,cAAc,CAAC,KAAc;QACnC,IAAI,KAAK,YAAY,GAAG,CAAC,iBAAiB,EAAE,CAAC;YAC3C,OAAO,OAAO,CAAC,eAAe,EAAE,mBAAmB,EAAE;gBACnD,OAAO,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE;aACxC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,KAAK,YAAY,GAAG,CAAC,cAAc,EAAE,CAAC;YACxC,OAAO,OAAO,CAAC,kBAAkB,EAAE,yBAAyB,EAAE;gBAC5D,OAAO,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,EAAE;aACnC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,KAAK,YAAY,GAAG,CAAC,iBAAiB,EAAE,CAAC;YAC3C,OAAO,OAAO,CAAC,eAAe,EAAE,kBAAkB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,OAAO,OAAO,CACZ,yBAAyB,EACzB,4BAA4B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CACvF,CAAC;IACJ,CAAC;IAED,6BAA6B;IAC7B,cAAc;QACZ,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;IACxB,CAAC;CACF;AAED,kFAAkF;AAClF,yBAAyB;AACzB,kFAAkF;AAElF;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAc,EACd,OAIC,EACD,MAA4E;IAE5E,MAAM,OAAO,GAAiB;QAC5B,GAAG,EAAE,MAAM;QACX,GAAG,EAAE,MAAM,CAAC,MAAM,IAAI,aAAa;QACnC,GAAG,EAAE,MAAM,CAAC,QAAQ,IAAI,iBAAiB;QACzC,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,YAAY;QAChD,SAAS,EAAE,OAAO,CAAC,QAAQ;KAC5B,CAAC;IAEF,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS,EAAE;QACzC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI;KACzD,CAAC,CAAC;AACL,CAAC;AAED,kFAAkF;AAClF,UAAU;AACV,kFAAkF;AAElF,IAAI,iBAAiB,GAA+B,IAAI,CAAC;AAEzD;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAoB;IACpD,IAAI,CAAC,iBAAiB,IAAI,MAAM,EAAE,CAAC;QACjC,iBAAiB,GAAG,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAmB;IAC1D,iBAAiB,GAAG,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACpD,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB;IACjC,iBAAiB,GAAG,IAAI,CAAC;AAC3B,CAAC"}