quidproquo-webserver 0.1.19 → 0.1.21

package/lib/commonjs/types/OpenApiDocument.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OpenApiDocument.js","sourceRoot":"","sources":["../../../src/types/OpenApiDocument.ts"],"names":[],"mappings":"","sourcesContent":["import { JsonSchema } from '../config/types/JsonSchema';\n\n// The slice of OpenAPI 3.1 this framework emits. Anything the generator does not\n// produce (callbacks, links, examples) is deliberately absent rather than typed loosely.\nexport type OpenApiParameter = {\n  name: string;\n  in: 'path' | 'query';\n  required: boolean;\n  schema: JsonSchema;\n  description?: string;\n};\n\nexport type OpenApiMediaType = { schema: JsonSchema };\n\nexport type OpenApiRequestBody = {\n  required: boolean;\n  content: { 'application/json': OpenApiMediaType };\n};\n\nexport type OpenApiResponse = {\n  description: string;\n  content?: { 'application/json': OpenApiMediaType };\n};\n\nexport type OpenApiSecurityRequirement = Record<string, string[]>;\n\nexport type OpenApiOperation = {\n  operationId: string;\n  summary?: string;\n  description?: string;\n  tags?: string[];\n  parameters?: OpenApiParameter[];\n  requestBody?: OpenApiRequestBody;\n  responses: Record<string, OpenApiResponse>;\n  security?: OpenApiSecurityRequirement[];\n};\n\nexport type OpenApiPathItem = Partial<Record<'get' | 'post' | 'put' | 'patch' | 'delete' | 'options' | 'head', OpenApiOperation>>;\n\nexport type OpenApiSecurityScheme = { type: 'http'; scheme: 'bearer'; bearerFormat: 'JWT' } | { type: 'apiKey'; in: 'header'; name: string };\n\nexport type OpenApiInfo = {\n  title: string;\n  version: string;\n  description?: string;\n};\n\nexport type OpenApiDocument = {\n  openapi: '3.1.0';\n  info: OpenApiInfo;\n  servers: { url: string }[];\n  paths: Record<string, OpenApiPathItem>;\n  components: {\n    securitySchemes: Record<string, OpenApiSecurityScheme>;\n  };\n};\n"]}

package/lib/commonjs/types/index.d.ts

@@ -3,6 +3,7 @@ export * from './constants';
 export * from './EmailSendEvent';
 export * from './ExecuteServiceFunctionEvent';
 export * from './HTTPEvent';
+export * from './OpenApiDocument';
 export * from './SEOEvent';
 export * from './StorageDriveEvent';
 export * from './WebsocketEvent';

package/lib/commonjs/types/index.js

@@ -19,6 +19,7 @@ __exportStar(require("./constants"), exports);
 __exportStar(require("./EmailSendEvent"), exports);
 __exportStar(require("./ExecuteServiceFunctionEvent"), exports);
 __exportStar(require("./HTTPEvent"), exports);
+__exportStar(require("./OpenApiDocument"), exports);
 __exportStar(require("./SEOEvent"), exports);
 __exportStar(require("./StorageDriveEvent"), exports);
 __exportStar(require("./WebsocketEvent"), exports);

package/lib/commonjs/types/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/types/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,6DAA2C;AAC3C,8CAA4B;AAC5B,mDAAiC;AACjC,gEAA8C;AAC9C,8CAA4B;AAC5B,6CAA2B;AAC3B,sDAAoC;AACpC,mDAAiC","sourcesContent":["export * from './CloudflareDnsDeployEvent';\nexport * from './constants';\nexport * from './EmailSendEvent';\nexport * from './ExecuteServiceFunctionEvent';\nexport * from './HTTPEvent';\nexport * from './SEOEvent';\nexport * from './StorageDriveEvent';\nexport * from './WebsocketEvent';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/types/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,6DAA2C;AAC3C,8CAA4B;AAC5B,mDAAiC;AACjC,gEAA8C;AAC9C,8CAA4B;AAC5B,oDAAkC;AAClC,6CAA2B;AAC3B,sDAAoC;AACpC,mDAAiC","sourcesContent":["export * from './CloudflareDnsDeployEvent';\nexport * from './constants';\nexport * from './EmailSendEvent';\nexport * from './ExecuteServiceFunctionEvent';\nexport * from './HTTPEvent';\nexport * from './OpenApiDocument';\nexport * from './SEOEvent';\nexport * from './StorageDriveEvent';\nexport * from './WebsocketEvent';\n"]}

package/lib/commonjs/utils/headerUtils.d.ts

@@ -1,12 +1,13 @@
 import { AskResponse, QPQConfig } from 'quidproquo-core';
-import { RouteOptions, ServiceAllowedOrigin } from '../config/settings/route';
+import { RouteOptions } from '../config/settings/route';
+import { DomainResolver } from '../domain/types/DomainResolver';
 import { SeoEvent } from '../types';
 import { HTTPEvent, HttpEventHeaders } from '../types/HTTPEvent';
 export declare const getHeaderValue: (header: string, headers: HttpEventHeaders) => string | null;
 export declare function askReadRequiredHeader(event: HTTPEvent, requiredHeader: string): AskResponse<string>;
 export declare function askReadRequiredHeaders(event: HTTPEvent, requiredHeaders: string[]): AskResponse<string[]>;
 export declare const getAccessTokenFromHeaders: (headers: HttpEventHeaders) => string | undefined;
-export declare const convertContentSecurityPolicyEntryToString: (baseDomain: string, allowedOrigin: ServiceAllowedOrigin | string) => string;
-export declare const getAllowedOrigins: (qpqConfig: QPQConfig, route: RouteOptions) => string[];
-export declare const getCorsHeaders: (qpqConfig: QPQConfig, route: RouteOptions, reqHeaders: HttpEventHeaders) => HttpEventHeaders;
+/** Site roots first (primary leads, so it is the fallback origin), then default and route entries, all lowercased. */
+export declare const getAllowedOrigins: (qpqConfig: QPQConfig, route: RouteOptions, resolver?: DomainResolver) => string[];
+export declare const getCorsHeaders: (qpqConfig: QPQConfig, route: RouteOptions, reqHeaders: HttpEventHeaders, resolver?: DomainResolver) => HttpEventHeaders;
 export declare const isBot: (event: HTTPEvent | SeoEvent<any>) => boolean;

package/lib/commonjs/utils/headerUtils.js

@@ -1,9 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isBot = exports.getCorsHeaders = exports.getAllowedOrigins = exports.convertContentSecurityPolicyEntryToString = exports.getAccessTokenFromHeaders = exports.getHeaderValue = void 0;
+exports.isBot = exports.getCorsHeaders = exports.getAllowedOrigins = exports.getAccessTokenFromHeaders = exports.getHeaderValue = void 0;
 exports.askReadRequiredHeader = askReadRequiredHeader;
 exports.askReadRequiredHeaders = askReadRequiredHeaders;
 const quidproquo_core_1 = require("quidproquo-core");
+const resolveHosts_1 = require("../domain/logic/host/resolveHosts");
+const resolveOrigins_1 = require("../domain/logic/origin/resolveOrigins");
 const types_1 = require("../types");
 const qpqConfigAccessorsUtils_1 = require("./qpqConfigAccessorsUtils");
 const getHeaderValue = (header, headers) => {
@@ -33,40 +35,25 @@ const getAccessTokenFromHeaders = (headers) => {
     return authToken;
 };
 exports.getAccessTokenFromHeaders = getAccessTokenFromHeaders;
-const convertContentSecurityPolicyEntryToString = (baseDomain, allowedOrigin) => {
-    if (typeof allowedOrigin === 'string') {
-        return allowedOrigin;
-    }
-    // Otherwise its a QpqServiceContentSecurityPolicy
-    const domain = allowedOrigin.domain || baseDomain;
-    const protocol = allowedOrigin.protocol || 'https';
-    if (allowedOrigin.service) {
-        return `${protocol}://${allowedOrigin.api}.${allowedOrigin.service}.${domain}`;
-    }
-    return `${protocol}://${allowedOrigin.api}.${domain}`;
-};
-exports.convertContentSecurityPolicyEntryToString = convertContentSecurityPolicyEntryToString;
-const getAllowedOrigins = (qpqConfig, route) => {
-    const baseDomain = (0, qpqConfigAccessorsUtils_1.getBaseDomainName)(qpqConfig);
-    // Root domain
-    const rootDomain = `https://${baseDomain}`;
-    // generic settings
-    const defaultRouteSettings = (0, qpqConfigAccessorsUtils_1.getDefaultRouteSettings)(qpqConfig);
-    const defaultAllowedOrigins = defaultRouteSettings.reduce((acc, cur) => [...acc, ...(cur.routeOptions.allowedOrigins || []).map((ao) => (0, exports.convertContentSecurityPolicyEntryToString)(baseDomain, ao))], []);
-    // Route specific
-    const routeAllowedOrigins = (route.allowedOrigins || []).map((ao) => (0, exports.convertContentSecurityPolicyEntryToString)(baseDomain, ao));
-    // Return the allowed origins
-    const allAllowedOrigins = [rootDomain, ...defaultAllowedOrigins, ...routeAllowedOrigins].map((o) => o.toLowerCase());
-    return allAllowedOrigins;
+/** Site roots first (primary leads, so it is the fallback origin), then default and route entries, all lowercased. */
+const getAllowedOrigins = (qpqConfig, route, resolver) => {
+    const rootOrigins = (0, resolveHosts_1.resolveHosts)(qpqConfig, {}, resolver).map((host) => `https://${host}`);
+    const defaultAllowedOrigins = (0, qpqConfigAccessorsUtils_1.getDefaultRouteSettings)(qpqConfig).flatMap((setting) => (setting.routeOptions.allowedOrigins || []).flatMap((entry) => (0, resolveOrigins_1.resolveOrigins)(qpqConfig, entry, resolver)));
+    const routeAllowedOrigins = (route.allowedOrigins || []).flatMap((entry) => (0, resolveOrigins_1.resolveOrigins)(qpqConfig, entry, resolver));
+    return [...rootOrigins, ...defaultAllowedOrigins, ...routeAllowedOrigins].map((origin) => origin.toLowerCase());
 };
 exports.getAllowedOrigins = getAllowedOrigins;
-const getCorsHeaders = (qpqConfig, route, reqHeaders) => {
+const getCorsHeaders = (qpqConfig, route, reqHeaders, resolver) => {
     var _a;
     const origin = (0, exports.getHeaderValue)('origin', reqHeaders) || '';
-    const allowedOrigins = (0, exports.getAllowedOrigins)(qpqConfig, route);
+    const allowedOrigins = (0, exports.getAllowedOrigins)(qpqConfig, route, resolver);
     const allowCredentials = !!((_a = route.routeAuthSettings) === null || _a === void 0 ? void 0 : _a.userDirectoryName);
     // If we have an auth endpoint, then we don't let wildcard origins access the API for security reasons
-    const allowOrigin = (!allowCredentials ? allowedOrigins.find((ao) => origin === ao || ao === '*') : allowedOrigins.find((ao) => origin === ao)) || allowedOrigins[0];
+    // A service with no domain declares nothing browser-facing, so an open origin is the
+    // only sensible fallback (the storage-drive cors default makes the same call).
+    const allowOrigin = (!allowCredentials ? allowedOrigins.find((ao) => origin === ao || ao === '*') : allowedOrigins.find((ao) => origin === ao)) ||
+        allowedOrigins[0] ||
+        '*';
     // Reflect exactly what the preflight asks for instead of a blanket '*'. A
     // literal '*' is invalid once credentials are allowed (browsers reject it),
     // so echoing the requested headers/method keeps authenticated routes working

package/lib/commonjs/utils/headerUtils.js.map

@@ -1 +1 @@
-{"version":3,"file":"headerUtils.js","sourceRoot":"","sources":["../../../src/utils/headerUtils.ts"],"names":[],"mappings":";;;AAkBA,sDAOC;AAED,wDAIC;AA/BD,qDAA+F;AAG/F,oCAAoD;AAEpD,uEAAuF;AAEhF,MAAM,cAAc,GAAG,CAAC,MAAc,EAAE,OAAyB,EAAiB,EAAE;IACzF,MAAM,aAAa,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,aAAa,CAAC,CAAC;IAE1F,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,OAAO,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC;AACxC,CAAC,CAAC;AATW,QAAA,cAAc,kBASzB;AAEF,QAAe,CAAC,CAAC,qBAAqB,CAAC,KAAgB,EAAE,cAAsB;IAC7E,MAAM,MAAM,GAAG,IAAA,sBAAc,EAAC,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,KAAK,CAAC,CAAC,IAAA,+BAAa,EAAC,+BAAa,CAAC,QAAQ,EAAE,UAAU,cAAc,YAAY,CAAC,CAAC;IAC5F,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,QAAe,CAAC,CAAC,sBAAsB,CAAC,KAAgB,EAAE,eAAyB;IACjF,OAAO,KAAK,CAAC,CAAC,IAAA,wBAAM,EAAC,eAAe,EAAE,QAAQ,CAAC,EAAE,MAAc;QAC7D,OAAO,KAAK,CAAC,CAAC,qBAAqB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,MAAM,yBAAyB,GAAG,CAAC,OAAyB,EAAsB,EAAE;IACzF,MAAM,mBAAmB,GAAG,IAAA,sBAAc,EAAC,eAAe,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IAC3E,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAE7D,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AALW,QAAA,yBAAyB,6BAKpC;AAEK,MAAM,yCAAyC,GAAG,CAAC,UAAkB,EAAE,aAA4C,EAAU,EAAE;IACpI,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,kDAAkD;IAClD,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,IAAI,UAAU,CAAC;IAElD,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,IAAI,OAAO,CAAC;IAEnD,IAAI,aAAa,CAAC,OAAO,EAAE,CAAC;QAC1B,OAAO,GAAG,QAAQ,MAAM,aAAa,CAAC,GAAG,IAAI,aAAa,CAAC,OAAO,IAAI,MAAM,EAAE,CAAC;IACjF,CAAC;IAED,OAAO,GAAG,QAAQ,MAAM,aAAa,CAAC,GAAG,IAAI,MAAM,EAAE,CAAC;AACxD,CAAC,CAAC;AAfW,QAAA,yCAAyC,6CAepD;AAEK,MAAM,iBAAiB,GAAG,CAAC,SAAoB,EAAE,KAAmB,EAAY,EAAE;IACvF,MAAM,UAAU,GAAG,IAAA,2CAAiB,EAAC,SAAS,CAAC,CAAC;IAChD,cAAc;IACd,MAAM,UAAU,GAAG,WAAW,UAAU,EAAE,CAAC;IAE3C,mBAAmB;IACnB,MAAM,oBAAoB,GAAG,IAAA,iDAAuB,EAAC,SAAS,CAAC,CAAC;IAEhE,MAAM,qBAAqB,GAAG,oBAAoB,CAAC,MAAM,CACvD,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAA,iDAAyC,EAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,EACzI,EAAc,CACf,CAAC;IAEF,iBAAiB;IACjB,MAAM,mBAAmB,GAAG,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAA,iDAAyC,EAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC;IAEhI,6BAA6B;IAC7B,MAAM,iBAAiB,GAAG,CAAC,UAAU,EAAE,GAAG,qBAAqB,EAAE,GAAG,mBAAmB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAErH,OAAO,iBAAiB,CAAC;AAC3B,CAAC,CAAC;AApBW,QAAA,iBAAiB,qBAoB5B;AAEK,MAAM,cAAc,GAAG,CAAC,SAAoB,EAAE,KAAmB,EAAE,UAA4B,EAAoB,EAAE;;IAC1H,MAAM,MAAM,GAAG,IAAA,sBAAc,EAAC,QAAQ,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC;IAE1D,MAAM,cAAc,GAAG,IAAA,yBAAiB,EAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAE3D,MAAM,gBAAgB,GAAG,CAAC,CAAC,CAAA,MAAA,KAAK,CAAC,iBAAiB,0CAAE,iBAAiB,CAAA,CAAC;IAEtE,sGAAsG;IACtG,MAAM,WAAW,GACf,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,KAAK,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,IAAI,cAAc,CAAC,CAAC,CAAC,CAAC;IAEnJ,0EAA0E;IAC1E,4EAA4E;IAC5E,6EAA6E;IAC7E,yEAAyE;IACzE,iFAAiF;IACjF,MAAM,gBAAgB,GAAG,IAAA,sBAAc,EAAC,gCAAgC,EAAE,UAAU,CAAC,CAAC;IACtF,MAAM,eAAe,GAAG,IAAA,sBAAc,EAAC,+BAA+B,EAAE,UAAU,CAAC,CAAC;IAEpF,OAAO;QACL,8BAA8B,EAAE,gBAAgB,IAAI,6BAA6B;QACjF,8BAA8B,EAAE,eAAe,IAAI,wCAAwC;QAC3F,6BAA6B,EAAE,WAAW;QAC1C,kCAAkC,EAAE,GAAG,gBAAgB,EAAE;QACzD,IAAI,EAAE,uEAAuE;KAC9E,CAAC;AACJ,CAAC,CAAC;AA1BW,QAAA,cAAc,kBA0BzB;AAEK,MAAM,KAAK,GAAG,CAAC,KAAgC,EAAW,EAAE;IACjE,OAAO,KAAK,CAAC,OAAO,CAAC,sBAAc,CAAC,KAAK,MAAM,CAAC;AAClD,CAAC,CAAC;AAFW,QAAA,KAAK,SAEhB","sourcesContent":["import { askMap, AskResponse, askThrowError, ErrorTypeEnum, QPQConfig } from 'quidproquo-core';\n\nimport { RouteOptions, ServiceAllowedOrigin } from '../config/settings/route';\nimport { qpqHeaderIsBot, SeoEvent } from '../types';\nimport { HTTPEvent, HttpEventHeaders } from '../types/HTTPEvent';\nimport { getBaseDomainName, getDefaultRouteSettings } from './qpqConfigAccessorsUtils';\n\nexport const getHeaderValue = (header: string, headers: HttpEventHeaders): string | null => {\n  const headerAsLower = header.toLowerCase();\n  const realHeaderKey = Object.keys(headers).find((k) => k.toLowerCase() === headerAsLower);\n\n  if (!realHeaderKey) {\n    return null;\n  }\n\n  return headers[realHeaderKey] || null;\n};\n\nexport function* askReadRequiredHeader(event: HTTPEvent, requiredHeader: string): AskResponse<string> {\n  const header = getHeaderValue(requiredHeader, event.headers);\n  if (!header) {\n    return yield* askThrowError(ErrorTypeEnum.NotFound, `Header ${requiredHeader} not found`);\n  }\n\n  return header;\n}\n\nexport function* askReadRequiredHeaders(event: HTTPEvent, requiredHeaders: string[]): AskResponse<string[]> {\n  return yield* askMap(requiredHeaders, function* (header: string) {\n    return yield* askReadRequiredHeader(event, header);\n  });\n}\n\nexport const getAccessTokenFromHeaders = (headers: HttpEventHeaders): string | undefined => {\n  const authorizationHeader = getHeaderValue('authorization', headers) || '';\n  const [authType, authToken] = authorizationHeader.split(' ');\n\n  return authToken;\n};\n\nexport const convertContentSecurityPolicyEntryToString = (baseDomain: string, allowedOrigin: ServiceAllowedOrigin | string): string => {\n  if (typeof allowedOrigin === 'string') {\n    return allowedOrigin;\n  }\n\n  // Otherwise its a QpqServiceContentSecurityPolicy\n  const domain = allowedOrigin.domain || baseDomain;\n\n  const protocol = allowedOrigin.protocol || 'https';\n\n  if (allowedOrigin.service) {\n    return `${protocol}://${allowedOrigin.api}.${allowedOrigin.service}.${domain}`;\n  }\n\n  return `${protocol}://${allowedOrigin.api}.${domain}`;\n};\n\nexport const getAllowedOrigins = (qpqConfig: QPQConfig, route: RouteOptions): string[] => {\n  const baseDomain = getBaseDomainName(qpqConfig);\n  // Root domain\n  const rootDomain = `https://${baseDomain}`;\n\n  // generic settings\n  const defaultRouteSettings = getDefaultRouteSettings(qpqConfig);\n\n  const defaultAllowedOrigins = defaultRouteSettings.reduce(\n    (acc, cur) => [...acc, ...(cur.routeOptions.allowedOrigins || []).map((ao) => convertContentSecurityPolicyEntryToString(baseDomain, ao))],\n    [] as string[],\n  );\n\n  // Route specific\n  const routeAllowedOrigins = (route.allowedOrigins || []).map((ao) => convertContentSecurityPolicyEntryToString(baseDomain, ao));\n\n  // Return the allowed origins\n  const allAllowedOrigins = [rootDomain, ...defaultAllowedOrigins, ...routeAllowedOrigins].map((o) => o.toLowerCase());\n\n  return allAllowedOrigins;\n};\n\nexport const getCorsHeaders = (qpqConfig: QPQConfig, route: RouteOptions, reqHeaders: HttpEventHeaders): HttpEventHeaders => {\n  const origin = getHeaderValue('origin', reqHeaders) || '';\n\n  const allowedOrigins = getAllowedOrigins(qpqConfig, route);\n\n  const allowCredentials = !!route.routeAuthSettings?.userDirectoryName;\n\n  // If we have an auth endpoint, then we don't let wildcard origins access the API for security reasons\n  const allowOrigin =\n    (!allowCredentials ? allowedOrigins.find((ao) => origin === ao || ao === '*') : allowedOrigins.find((ao) => origin === ao)) || allowedOrigins[0];\n\n  // Reflect exactly what the preflight asks for instead of a blanket '*'. A\n  // literal '*' is invalid once credentials are allowed (browsers reject it),\n  // so echoing the requested headers/method keeps authenticated routes working\n  // while staying scoped to the real request. The security boundary is the\n  // origin check above; these two just describe what that trusted origin may send.\n  const requestedHeaders = getHeaderValue('access-control-request-headers', reqHeaders);\n  const requestedMethod = getHeaderValue('access-control-request-method', reqHeaders);\n\n  return {\n    'Access-Control-Allow-Headers': requestedHeaders || 'Authorization, Content-Type',\n    'Access-Control-Allow-Methods': requestedMethod || 'GET, POST, PUT, PATCH, DELETE, OPTIONS',\n    'Access-Control-Allow-Origin': allowOrigin,\n    'Access-Control-Allow-Credentials': `${allowCredentials}`,\n    Vary: 'Origin, Access-Control-Request-Headers, Access-Control-Request-Method',\n  };\n};\n\nexport const isBot = (event: HTTPEvent | SeoEvent<any>): boolean => {\n  return event.headers[qpqHeaderIsBot] === 'true';\n};\n"]}
+{"version":3,"file":"headerUtils.js","sourceRoot":"","sources":["../../../src/utils/headerUtils.ts"],"names":[],"mappings":";;;AAqBA,sDAOC;AAED,wDAIC;AAlCD,qDAA+F;AAG/F,oEAAiE;AACjE,0EAAuE;AAEvE,oCAAoD;AAEpD,uEAAoE;AAE7D,MAAM,cAAc,GAAG,CAAC,MAAc,EAAE,OAAyB,EAAiB,EAAE;IACzF,MAAM,aAAa,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,aAAa,CAAC,CAAC;IAE1F,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,OAAO,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC;AACxC,CAAC,CAAC;AATW,QAAA,cAAc,kBASzB;AAEF,QAAe,CAAC,CAAC,qBAAqB,CAAC,KAAgB,EAAE,cAAsB;IAC7E,MAAM,MAAM,GAAG,IAAA,sBAAc,EAAC,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,KAAK,CAAC,CAAC,IAAA,+BAAa,EAAC,+BAAa,CAAC,QAAQ,EAAE,UAAU,cAAc,YAAY,CAAC,CAAC;IAC5F,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,QAAe,CAAC,CAAC,sBAAsB,CAAC,KAAgB,EAAE,eAAyB;IACjF,OAAO,KAAK,CAAC,CAAC,IAAA,wBAAM,EAAC,eAAe,EAAE,QAAQ,CAAC,EAAE,MAAc;QAC7D,OAAO,KAAK,CAAC,CAAC,qBAAqB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,MAAM,yBAAyB,GAAG,CAAC,OAAyB,EAAsB,EAAE;IACzF,MAAM,mBAAmB,GAAG,IAAA,sBAAc,EAAC,eAAe,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IAC3E,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAE7D,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AALW,QAAA,yBAAyB,6BAKpC;AAEF,sHAAsH;AAC/G,MAAM,iBAAiB,GAAG,CAAC,SAAoB,EAAE,KAAmB,EAAE,QAAyB,EAAY,EAAE;IAClH,MAAM,WAAW,GAAG,IAAA,2BAAY,EAAC,SAAS,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IAE3F,MAAM,qBAAqB,GAAG,IAAA,iDAAuB,EAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CACnF,CAAC,OAAO,CAAC,YAAY,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAA,+BAAc,EAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAC3G,CAAC;IAEF,MAAM,mBAAmB,GAAG,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAA,+BAAc,EAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;IAExH,OAAO,CAAC,GAAG,WAAW,EAAE,GAAG,qBAAqB,EAAE,GAAG,mBAAmB,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;AAClH,CAAC,CAAC;AAVW,QAAA,iBAAiB,qBAU5B;AAEK,MAAM,cAAc,GAAG,CAC5B,SAAoB,EACpB,KAAmB,EACnB,UAA4B,EAC5B,QAAyB,EACP,EAAE;;IACpB,MAAM,MAAM,GAAG,IAAA,sBAAc,EAAC,QAAQ,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC;IAE1D,MAAM,cAAc,GAAG,IAAA,yBAAiB,EAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IAErE,MAAM,gBAAgB,GAAG,CAAC,CAAC,CAAA,MAAA,KAAK,CAAC,iBAAiB,0CAAE,iBAAiB,CAAA,CAAC;IAEtE,sGAAsG;IACtG,qFAAqF;IACrF,+EAA+E;IAC/E,MAAM,WAAW,GACf,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,KAAK,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC;QAC3H,cAAc,CAAC,CAAC,CAAC;QACjB,GAAG,CAAC;IAEN,0EAA0E;IAC1E,4EAA4E;IAC5E,6EAA6E;IAC7E,yEAAyE;IACzE,iFAAiF;IACjF,MAAM,gBAAgB,GAAG,IAAA,sBAAc,EAAC,gCAAgC,EAAE,UAAU,CAAC,CAAC;IACtF,MAAM,eAAe,GAAG,IAAA,sBAAc,EAAC,+BAA+B,EAAE,UAAU,CAAC,CAAC;IAEpF,OAAO;QACL,8BAA8B,EAAE,gBAAgB,IAAI,6BAA6B;QACjF,8BAA8B,EAAE,eAAe,IAAI,wCAAwC;QAC3F,6BAA6B,EAAE,WAAW;QAC1C,kCAAkC,EAAE,GAAG,gBAAgB,EAAE;QACzD,IAAI,EAAE,uEAAuE;KAC9E,CAAC;AACJ,CAAC,CAAC;AAnCW,QAAA,cAAc,kBAmCzB;AAEK,MAAM,KAAK,GAAG,CAAC,KAAgC,EAAW,EAAE;IACjE,OAAO,KAAK,CAAC,OAAO,CAAC,sBAAc,CAAC,KAAK,MAAM,CAAC;AAClD,CAAC,CAAC;AAFW,QAAA,KAAK,SAEhB","sourcesContent":["import { askMap, AskResponse, askThrowError, ErrorTypeEnum, QPQConfig } from 'quidproquo-core';\n\nimport { RouteOptions } from '../config/settings/route';\nimport { resolveHosts } from '../domain/logic/host/resolveHosts';\nimport { resolveOrigins } from '../domain/logic/origin/resolveOrigins';\nimport { DomainResolver } from '../domain/types/DomainResolver';\nimport { qpqHeaderIsBot, SeoEvent } from '../types';\nimport { HTTPEvent, HttpEventHeaders } from '../types/HTTPEvent';\nimport { getDefaultRouteSettings } from './qpqConfigAccessorsUtils';\n\nexport const getHeaderValue = (header: string, headers: HttpEventHeaders): string | null => {\n  const headerAsLower = header.toLowerCase();\n  const realHeaderKey = Object.keys(headers).find((k) => k.toLowerCase() === headerAsLower);\n\n  if (!realHeaderKey) {\n    return null;\n  }\n\n  return headers[realHeaderKey] || null;\n};\n\nexport function* askReadRequiredHeader(event: HTTPEvent, requiredHeader: string): AskResponse<string> {\n  const header = getHeaderValue(requiredHeader, event.headers);\n  if (!header) {\n    return yield* askThrowError(ErrorTypeEnum.NotFound, `Header ${requiredHeader} not found`);\n  }\n\n  return header;\n}\n\nexport function* askReadRequiredHeaders(event: HTTPEvent, requiredHeaders: string[]): AskResponse<string[]> {\n  return yield* askMap(requiredHeaders, function* (header: string) {\n    return yield* askReadRequiredHeader(event, header);\n  });\n}\n\nexport const getAccessTokenFromHeaders = (headers: HttpEventHeaders): string | undefined => {\n  const authorizationHeader = getHeaderValue('authorization', headers) || '';\n  const [authType, authToken] = authorizationHeader.split(' ');\n\n  return authToken;\n};\n\n/** Site roots first (primary leads, so it is the fallback origin), then default and route entries, all lowercased. */\nexport const getAllowedOrigins = (qpqConfig: QPQConfig, route: RouteOptions, resolver?: DomainResolver): string[] => {\n  const rootOrigins = resolveHosts(qpqConfig, {}, resolver).map((host) => `https://${host}`);\n\n  const defaultAllowedOrigins = getDefaultRouteSettings(qpqConfig).flatMap((setting) =>\n    (setting.routeOptions.allowedOrigins || []).flatMap((entry) => resolveOrigins(qpqConfig, entry, resolver)),\n  );\n\n  const routeAllowedOrigins = (route.allowedOrigins || []).flatMap((entry) => resolveOrigins(qpqConfig, entry, resolver));\n\n  return [...rootOrigins, ...defaultAllowedOrigins, ...routeAllowedOrigins].map((origin) => origin.toLowerCase());\n};\n\nexport const getCorsHeaders = (\n  qpqConfig: QPQConfig,\n  route: RouteOptions,\n  reqHeaders: HttpEventHeaders,\n  resolver?: DomainResolver,\n): HttpEventHeaders => {\n  const origin = getHeaderValue('origin', reqHeaders) || '';\n\n  const allowedOrigins = getAllowedOrigins(qpqConfig, route, resolver);\n\n  const allowCredentials = !!route.routeAuthSettings?.userDirectoryName;\n\n  // If we have an auth endpoint, then we don't let wildcard origins access the API for security reasons\n  // A service with no domain declares nothing browser-facing, so an open origin is the\n  // only sensible fallback (the storage-drive cors default makes the same call).\n  const allowOrigin =\n    (!allowCredentials ? allowedOrigins.find((ao) => origin === ao || ao === '*') : allowedOrigins.find((ao) => origin === ao)) ||\n    allowedOrigins[0] ||\n    '*';\n\n  // Reflect exactly what the preflight asks for instead of a blanket '*'. A\n  // literal '*' is invalid once credentials are allowed (browsers reject it),\n  // so echoing the requested headers/method keeps authenticated routes working\n  // while staying scoped to the real request. The security boundary is the\n  // origin check above; these two just describe what that trusted origin may send.\n  const requestedHeaders = getHeaderValue('access-control-request-headers', reqHeaders);\n  const requestedMethod = getHeaderValue('access-control-request-method', reqHeaders);\n\n  return {\n    'Access-Control-Allow-Headers': requestedHeaders || 'Authorization, Content-Type',\n    'Access-Control-Allow-Methods': requestedMethod || 'GET, POST, PUT, PATCH, DELETE, OPTIONS',\n    'Access-Control-Allow-Origin': allowOrigin,\n    'Access-Control-Allow-Credentials': `${allowCredentials}`,\n    Vary: 'Origin, Access-Control-Request-Headers, Access-Control-Request-Method',\n  };\n};\n\nexport const isBot = (event: HTTPEvent | SeoEvent<any>): boolean => {\n  return event.headers[qpqHeaderIsBot] === 'true';\n};\n"]}

package/lib/commonjs/utils/index.d.ts

@@ -1,8 +1,11 @@
+export * from '../configUtils';
+export * from '../domain/logic';
 export * from './headerUtils';
 export * from './httpEventUtils';
 export * from './jwtUtils';
 export * from './mergeRouteUtils';
 export * from './networkRequestUtils';
+export * from './openApi';
 export * from './pathUtils';
 export * from './preformNetworkRequest';
 export * from './qpqConfigAccessorsUtils';

package/lib/commonjs/utils/index.js

@@ -14,11 +14,14 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("../configUtils"), exports);
+__exportStar(require("../domain/logic"), exports);
 __exportStar(require("./headerUtils"), exports);
 __exportStar(require("./httpEventUtils"), exports);
 __exportStar(require("./jwtUtils"), exports);
 __exportStar(require("./mergeRouteUtils"), exports);
 __exportStar(require("./networkRequestUtils"), exports);
+__exportStar(require("./openApi"), exports);
 __exportStar(require("./pathUtils"), exports);
 __exportStar(require("./preformNetworkRequest"), exports);
 __exportStar(require("./qpqConfigAccessorsUtils"), exports);

package/lib/commonjs/utils/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/utils/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,gDAA8B;AAC9B,mDAAiC;AACjC,6CAA2B;AAC3B,oDAAkC;AAClC,wDAAsC;AACtC,8CAA4B;AAC5B,0DAAwC;AACxC,4DAA0C;AAC1C,6CAA2B;AAC3B,wDAAsC","sourcesContent":["export * from './headerUtils';\nexport * from './httpEventUtils';\nexport * from './jwtUtils';\nexport * from './mergeRouteUtils';\nexport * from './networkRequestUtils';\nexport * from './pathUtils';\nexport * from './preformNetworkRequest';\nexport * from './qpqConfigAccessorsUtils';\nexport * from './urlUtils';\nexport * from './websocketEventUtils';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/utils/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,iDAA+B;AAC/B,kDAAgC;AAChC,gDAA8B;AAC9B,mDAAiC;AACjC,6CAA2B;AAC3B,oDAAkC;AAClC,wDAAsC;AACtC,4CAA0B;AAC1B,8CAA4B;AAC5B,0DAAwC;AACxC,4DAA0C;AAC1C,6CAA2B;AAC3B,wDAAsC","sourcesContent":["export * from '../configUtils';\nexport * from '../domain/logic';\nexport * from './headerUtils';\nexport * from './httpEventUtils';\nexport * from './jwtUtils';\nexport * from './mergeRouteUtils';\nexport * from './networkRequestUtils';\nexport * from './openApi';\nexport * from './pathUtils';\nexport * from './preformNetworkRequest';\nexport * from './qpqConfigAccessorsUtils';\nexport * from './urlUtils';\nexport * from './websocketEventUtils';\n"]}

package/lib/commonjs/utils/mergeRouteUtils.js

@@ -11,9 +11,12 @@ const mergeRouteAuthSettings = (routeAuthSettingsA, routeAuthSettingsB) => {
 };
 exports.mergeRouteAuthSettings = mergeRouteAuthSettings;
 const mergeRouteOptions = (routeOptionsA, routeOptionsB) => {
+    var _a;
     return {
         allowedOrigins: [...new Set([...(routeOptionsB.allowedOrigins || []), ...(routeOptionsA.allowedOrigins || [])])],
         routeAuthSettings: (0, exports.mergeRouteAuthSettings)(routeOptionsA.routeAuthSettings, routeOptionsB.routeAuthSettings),
+        // Schemas describe one route, they are never shared defaults, so the more specific side wins outright
+        schema: (_a = routeOptionsB.schema) !== null && _a !== void 0 ? _a : routeOptionsA.schema,
     };
 };
 exports.mergeRouteOptions = mergeRouteOptions;

package/lib/commonjs/utils/mergeRouteUtils.js.map

@@ -1 +1 @@
-{"version":3,"file":"mergeRouteUtils.js","sourceRoot":"","sources":["../../../src/utils/mergeRouteUtils.ts"],"names":[],"mappings":";;;AAIA,uEAAoE;AAE7D,MAAM,sBAAsB,GAAG,CAAC,kBAAsC,EAAE,kBAAsC,EAAqB,EAAE;IAC1I,OAAO;QACL,iBAAiB,EAAE,CAAA,kBAAkB,aAAlB,kBAAkB,uBAAlB,kBAAkB,CAAE,iBAAiB,MAAI,kBAAkB,aAAlB,kBAAkB,uBAAlB,kBAAkB,CAAE,iBAAiB,CAAA;QACjG,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAA,kBAAkB,aAAlB,kBAAkB,uBAAlB,kBAAkB,CAAE,MAAM,KAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAA,kBAAkB,aAAlB,kBAAkB,uBAAlB,kBAAkB,CAAE,MAAM,KAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAEpG,OAAO,EAAE,CAAC,GAAG,CAAC,CAAA,kBAAkB,aAAlB,kBAAkB,uBAAlB,kBAAkB,CAAE,OAAO,KAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAA,kBAAkB,aAAlB,kBAAkB,uBAAlB,kBAAkB,CAAE,OAAO,KAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAC9F,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CACxB,GAAG,CAAC,SAAS,CACX,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,CAAC,eAAe,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW,CAC3I,KAAK,KAAK,CACd;KACF,CAAC;AACJ,CAAC,CAAC;AAZW,QAAA,sBAAsB,0BAYjC;AAEK,MAAM,iBAAiB,GAAG,CAAC,aAA2B,EAAE,aAA2B,EAAgB,EAAE;IAC1G,OAAO;QACL,cAAc,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,cAAc,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,aAAa,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAChH,iBAAiB,EAAE,IAAA,8BAAsB,EAAC,aAAa,CAAC,iBAAiB,EAAE,aAAa,CAAC,iBAAiB,CAAC;KAC5G,CAAC;AACJ,CAAC,CAAC;AALW,QAAA,iBAAiB,qBAK5B;AAEK,MAAM,oBAAoB,GAAG,CAAC,SAAiB,EAAE,WAA2C,EAAE,SAAoB,EAAgB,EAAE;IACzI,sEAAsE;IACtE,YAAY;IACZ,MAAM,cAAc,GAAG,IAAA,iDAAuB,EAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IACrF,MAAM,YAAY,GAAG,WAAW,CAAC,OAAO,CAAC;IAEzC,OAAO,CAAC,GAAG,cAAc,EAAE,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,IAAA,yBAAiB,EAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAkB,CAAC,CAAC;AACjH,CAAC,CAAC;AAPW,QAAA,oBAAoB,wBAO/B","sourcesContent":["import { QPQConfig } from 'quidproquo-core';\n\nimport { RouteAuthSettings, RouteQPQWebServerConfigSetting } from '../config/settings/route';\nimport { RouteOptions } from '../config/settings/route';\nimport { getDefaultRouteSettings } from './qpqConfigAccessorsUtils';\n\nexport const mergeRouteAuthSettings = (routeAuthSettingsA?: RouteAuthSettings, routeAuthSettingsB?: RouteAuthSettings): RouteAuthSettings => {\n  return {\n    userDirectoryName: routeAuthSettingsB?.userDirectoryName || routeAuthSettingsA?.userDirectoryName,\n    scopes: [...new Set([...(routeAuthSettingsB?.scopes || []), ...(routeAuthSettingsA?.scopes || [])])],\n\n    apiKeys: [...(routeAuthSettingsB?.apiKeys || []), ...(routeAuthSettingsA?.apiKeys || [])].filter(\n      (apiKeyRef, index, arr) =>\n        arr.findIndex(\n          (item) => item.name === apiKeyRef.name && item.applicationName === apiKeyRef.applicationName && item.serviceName === apiKeyRef.serviceName,\n        ) === index,\n    ),\n  };\n};\n\nexport const mergeRouteOptions = (routeOptionsA: RouteOptions, routeOptionsB: RouteOptions): RouteOptions => {\n  return {\n    allowedOrigins: [...new Set([...(routeOptionsB.allowedOrigins || []), ...(routeOptionsA.allowedOrigins || [])])],\n    routeAuthSettings: mergeRouteAuthSettings(routeOptionsA.routeAuthSettings, routeOptionsB.routeAuthSettings),\n  };\n};\n\nexport const mergeAllRouteOptions = (activeApi: string, routeConfig: RouteQPQWebServerConfigSetting, qpqConfig: QPQConfig): RouteOptions => {\n  // TODO: This needs to filter active route on the current route Config\n  // activeApi\n  const defaultOptions = getDefaultRouteSettings(qpqConfig).map((o) => o.routeOptions);\n  const routeOptions = routeConfig.options;\n\n  return [...defaultOptions, routeOptions].reduce((acc, opt) => mergeRouteOptions(acc, opt), {} as RouteOptions);\n};\n"]}
+{"version":3,"file":"mergeRouteUtils.js","sourceRoot":"","sources":["../../../src/utils/mergeRouteUtils.ts"],"names":[],"mappings":";;;AAIA,uEAAoE;AAE7D,MAAM,sBAAsB,GAAG,CAAC,kBAAsC,EAAE,kBAAsC,EAAqB,EAAE;IAC1I,OAAO;QACL,iBAAiB,EAAE,CAAA,kBAAkB,aAAlB,kBAAkB,uBAAlB,kBAAkB,CAAE,iBAAiB,MAAI,kBAAkB,aAAlB,kBAAkB,uBAAlB,kBAAkB,CAAE,iBAAiB,CAAA;QACjG,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAA,kBAAkB,aAAlB,kBAAkB,uBAAlB,kBAAkB,CAAE,MAAM,KAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAA,kBAAkB,aAAlB,kBAAkB,uBAAlB,kBAAkB,CAAE,MAAM,KAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAEpG,OAAO,EAAE,CAAC,GAAG,CAAC,CAAA,kBAAkB,aAAlB,kBAAkB,uBAAlB,kBAAkB,CAAE,OAAO,KAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAA,kBAAkB,aAAlB,kBAAkB,uBAAlB,kBAAkB,CAAE,OAAO,KAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAC9F,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CACxB,GAAG,CAAC,SAAS,CACX,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,CAAC,eAAe,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW,CAC3I,KAAK,KAAK,CACd;KACF,CAAC;AACJ,CAAC,CAAC;AAZW,QAAA,sBAAsB,0BAYjC;AAEK,MAAM,iBAAiB,GAAG,CAAC,aAA2B,EAAE,aAA2B,EAAgB,EAAE;;IAC1G,OAAO;QACL,cAAc,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,cAAc,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,aAAa,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAChH,iBAAiB,EAAE,IAAA,8BAAsB,EAAC,aAAa,CAAC,iBAAiB,EAAE,aAAa,CAAC,iBAAiB,CAAC;QAE3G,sGAAsG;QACtG,MAAM,EAAE,MAAA,aAAa,CAAC,MAAM,mCAAI,aAAa,CAAC,MAAM;KACrD,CAAC;AACJ,CAAC,CAAC;AARW,QAAA,iBAAiB,qBAQ5B;AAEK,MAAM,oBAAoB,GAAG,CAAC,SAAiB,EAAE,WAA2C,EAAE,SAAoB,EAAgB,EAAE;IACzI,sEAAsE;IACtE,YAAY;IACZ,MAAM,cAAc,GAAG,IAAA,iDAAuB,EAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IACrF,MAAM,YAAY,GAAG,WAAW,CAAC,OAAO,CAAC;IAEzC,OAAO,CAAC,GAAG,cAAc,EAAE,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,IAAA,yBAAiB,EAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAkB,CAAC,CAAC;AACjH,CAAC,CAAC;AAPW,QAAA,oBAAoB,wBAO/B","sourcesContent":["import { QPQConfig } from 'quidproquo-core';\n\nimport { RouteAuthSettings, RouteQPQWebServerConfigSetting } from '../config/settings/route';\nimport { RouteOptions } from '../config/settings/route';\nimport { getDefaultRouteSettings } from './qpqConfigAccessorsUtils';\n\nexport const mergeRouteAuthSettings = (routeAuthSettingsA?: RouteAuthSettings, routeAuthSettingsB?: RouteAuthSettings): RouteAuthSettings => {\n  return {\n    userDirectoryName: routeAuthSettingsB?.userDirectoryName || routeAuthSettingsA?.userDirectoryName,\n    scopes: [...new Set([...(routeAuthSettingsB?.scopes || []), ...(routeAuthSettingsA?.scopes || [])])],\n\n    apiKeys: [...(routeAuthSettingsB?.apiKeys || []), ...(routeAuthSettingsA?.apiKeys || [])].filter(\n      (apiKeyRef, index, arr) =>\n        arr.findIndex(\n          (item) => item.name === apiKeyRef.name && item.applicationName === apiKeyRef.applicationName && item.serviceName === apiKeyRef.serviceName,\n        ) === index,\n    ),\n  };\n};\n\nexport const mergeRouteOptions = (routeOptionsA: RouteOptions, routeOptionsB: RouteOptions): RouteOptions => {\n  return {\n    allowedOrigins: [...new Set([...(routeOptionsB.allowedOrigins || []), ...(routeOptionsA.allowedOrigins || [])])],\n    routeAuthSettings: mergeRouteAuthSettings(routeOptionsA.routeAuthSettings, routeOptionsB.routeAuthSettings),\n\n    // Schemas describe one route, they are never shared defaults, so the more specific side wins outright\n    schema: routeOptionsB.schema ?? routeOptionsA.schema,\n  };\n};\n\nexport const mergeAllRouteOptions = (activeApi: string, routeConfig: RouteQPQWebServerConfigSetting, qpqConfig: QPQConfig): RouteOptions => {\n  // TODO: This needs to filter active route on the current route Config\n  // activeApi\n  const defaultOptions = getDefaultRouteSettings(qpqConfig).map((o) => o.routeOptions);\n  const routeOptions = routeConfig.options;\n\n  return [...defaultOptions, routeOptions].reduce((acc, opt) => mergeRouteOptions(acc, opt), {} as RouteOptions);\n};\n"]}

package/lib/commonjs/utils/openApi/OpenApiDocumentOptions.d.ts

@@ -0,0 +1,2 @@
+import { OpenApiInfo } from '../../types/OpenApiDocument';
+export type OpenApiDocumentOptions = Partial<OpenApiInfo>;

package/lib/commonjs/utils/openApi/OpenApiDocumentOptions.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=OpenApiDocumentOptions.js.map

package/lib/commonjs/utils/openApi/OpenApiDocumentOptions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OpenApiDocumentOptions.js","sourceRoot":"","sources":["../../../../src/utils/openApi/OpenApiDocumentOptions.ts"],"names":[],"mappings":"","sourcesContent":["import { OpenApiInfo } from '../../types/OpenApiDocument';\n\n// The parts of the document that are prose rather than derived from the routes.\n// Every field falls back to something sensible taken from the service config.\nexport type OpenApiDocumentOptions = Partial<OpenApiInfo>;\n"]}

package/lib/commonjs/utils/openApi/buildOpenApiDocument.d.ts

@@ -0,0 +1,5 @@
+import { QPQConfig } from 'quidproquo-core';
+import { DomainResolver } from '../../domain/types/DomainResolver';
+import { OpenApiDocument } from '../../types/OpenApiDocument';
+import { OpenApiDocumentOptions } from './OpenApiDocumentOptions';
+export declare const buildOpenApiDocument: (qpqConfig: QPQConfig, options?: OpenApiDocumentOptions, resolver?: DomainResolver) => OpenApiDocument;

package/lib/commonjs/utils/openApi/buildOpenApiDocument.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildOpenApiDocument = void 0;
+const quidproquo_core_1 = require("quidproquo-core");
+const resolveHosts_1 = require("../../domain/logic/host/resolveHosts");
+const mergeRouteUtils_1 = require("../mergeRouteUtils");
+const qpqConfigAccessorsUtils_1 = require("../qpqConfigAccessorsUtils");
+const buildOpenApiOperation_1 = require("./buildOpenApiOperation");
+const buildOpenApiSecurity_1 = require("./buildOpenApiSecurity");
+// Every live api on every root is a server the operations can be called on. Deployed, an
+// api domain is shared by every service in the application and each service is mounted
+// under its module name (the api gateway base path mapping), so the url carries that path.
+// A service with no domain (nothing browser-facing, local only) lists none.
+const buildServers = (qpqConfig, resolver) => {
+    const serviceName = quidproquo_core_1.qpqCoreUtils.getApplicationModuleName(qpqConfig);
+    return (0, qpqConfigAccessorsUtils_1.getApiConfigs)(qpqConfig)
+        .filter((api) => !api.deprecated)
+        .flatMap((api) => (0, resolveHosts_1.resolveHosts)(qpqConfig, { subdomain: api.apiSubdomain }, resolver).map((host) => ({ url: `https://${host}/${serviceName}` })));
+};
+// Only schemes some operation actually references make it into components, so a
+// service with no auth publishes no dangling security definitions.
+const buildSecuritySchemes = (paths) => {
+    const used = new Set(Object.values(paths)
+        .flatMap((pathItem) => Object.values(pathItem))
+        .flatMap((operation) => { var _a; return (_a = operation.security) !== null && _a !== void 0 ? _a : []; })
+        .flatMap((requirement) => Object.keys(requirement)));
+    return Object.fromEntries(Object.entries(buildOpenApiSecurity_1.openApiSecuritySchemes).filter(([name]) => used.has(name)));
+};
+// Walk every route in the config and describe it. Routes are plain data, so this
+// runs anywhere the config does: at deploy time, in a processor, or in a test.
+const buildOpenApiDocument = (qpqConfig, options = {}, resolver) => {
+    var _a, _b, _c;
+    const paths = {};
+    for (const route of (0, qpqConfigAccessorsUtils_1.getAllRoutes)(qpqConfig)) {
+        const routeOptions = (0, mergeRouteUtils_1.mergeAllRouteOptions)('', route, qpqConfig);
+        if ((_a = routeOptions.schema) === null || _a === void 0 ? void 0 : _a.hidden) {
+            continue;
+        }
+        const verb = route.method.toLowerCase();
+        paths[route.path] = Object.assign(Object.assign({}, paths[route.path]), { [verb]: (0, buildOpenApiOperation_1.buildOpenApiOperation)(route, routeOptions) });
+    }
+    return {
+        openapi: '3.1.0',
+        info: {
+            title: (_b = options.title) !== null && _b !== void 0 ? _b : `${quidproquo_core_1.qpqCoreUtils.getApplicationName(qpqConfig)} ${quidproquo_core_1.qpqCoreUtils.getApplicationModuleName(qpqConfig)}`,
+            version: (_c = options.version) !== null && _c !== void 0 ? _c : '1.0.0',
+            description: options.description,
+        },
+        servers: buildServers(qpqConfig, resolver),
+        paths,
+        components: { securitySchemes: buildSecuritySchemes(paths) },
+    };
+};
+exports.buildOpenApiDocument = buildOpenApiDocument;
+//# sourceMappingURL=buildOpenApiDocument.js.map

package/lib/commonjs/utils/openApi/buildOpenApiDocument.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildOpenApiDocument.js","sourceRoot":"","sources":["../../../../src/utils/openApi/buildOpenApiDocument.ts"],"names":[],"mappings":";;;AAAA,qDAA0D;AAE1D,uEAAoE;AAGpE,wDAA0D;AAC1D,wEAAyE;AACzE,mEAAgE;AAChE,iEAAgE;AAKhE,yFAAyF;AACzF,uFAAuF;AACvF,2FAA2F;AAC3F,4EAA4E;AAC5E,MAAM,YAAY,GAAG,CAAC,SAAoB,EAAE,QAAyB,EAAqB,EAAE;IAC1F,MAAM,WAAW,GAAG,8BAAY,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC;IAErE,OAAO,IAAA,uCAAa,EAAC,SAAS,CAAC;SAC5B,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC;SAChC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAA,2BAAY,EAAC,SAAS,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,YAAY,EAAE,EAAE,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,WAAW,IAAI,IAAI,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AACrJ,CAAC,CAAC;AAEF,gFAAgF;AAChF,mEAAmE;AACnE,MAAM,oBAAoB,GAAG,CAAC,KAAsC,EAAyC,EAAE;IAC7G,MAAM,IAAI,GAAG,IAAI,GAAG,CAClB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;SACjB,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;SAC9C,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE,WAAC,OAAA,MAAA,SAAS,CAAC,QAAQ,mCAAI,EAAE,CAAA,EAAA,CAAC;SAChD,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CACtD,CAAC;IAEF,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,6CAAsB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACvG,CAAC,CAAC;AAEF,iFAAiF;AACjF,+EAA+E;AACxE,MAAM,oBAAoB,GAAG,CAAC,SAAoB,EAAE,UAAkC,EAAE,EAAE,QAAyB,EAAmB,EAAE;;IAC7I,MAAM,KAAK,GAAoC,EAAE,CAAC;IAElD,KAAK,MAAM,KAAK,IAAI,IAAA,sCAAY,EAAC,SAAS,CAAC,EAAE,CAAC;QAC5C,MAAM,YAAY,GAAG,IAAA,sCAAoB,EAAC,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QAChE,IAAI,MAAA,YAAY,CAAC,MAAM,0CAAE,MAAM,EAAE,CAAC;YAChC,SAAS;QACX,CAAC;QAED,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,WAAW,EAAc,CAAC;QACpD,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,mCAAQ,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAE,CAAC,IAAI,CAAC,EAAE,IAAA,6CAAqB,EAAC,KAAK,EAAE,YAAY,CAAC,GAAE,CAAC;IACnG,CAAC;IAED,OAAO;QACL,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE;YACJ,KAAK,EAAE,MAAA,OAAO,CAAC,KAAK,mCAAI,GAAG,8BAAY,CAAC,kBAAkB,CAAC,SAAS,CAAC,IAAI,8BAAY,CAAC,wBAAwB,CAAC,SAAS,CAAC,EAAE;YAC3H,OAAO,EAAE,MAAA,OAAO,CAAC,OAAO,mCAAI,OAAO;YACnC,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC;QACD,OAAO,EAAE,YAAY,CAAC,SAAS,EAAE,QAAQ,CAAC;QAC1C,KAAK;QACL,UAAU,EAAE,EAAE,eAAe,EAAE,oBAAoB,CAAC,KAAK,CAAC,EAAE;KAC7D,CAAC;AACJ,CAAC,CAAC;AAxBW,QAAA,oBAAoB,wBAwB/B","sourcesContent":["import { QPQConfig, qpqCoreUtils } from 'quidproquo-core';\n\nimport { resolveHosts } from '../../domain/logic/host/resolveHosts';\nimport { DomainResolver } from '../../domain/types/DomainResolver';\nimport { OpenApiDocument, OpenApiPathItem, OpenApiSecurityScheme } from '../../types/OpenApiDocument';\nimport { mergeAllRouteOptions } from '../mergeRouteUtils';\nimport { getAllRoutes, getApiConfigs } from '../qpqConfigAccessorsUtils';\nimport { buildOpenApiOperation } from './buildOpenApiOperation';\nimport { openApiSecuritySchemes } from './buildOpenApiSecurity';\nimport { OpenApiDocumentOptions } from './OpenApiDocumentOptions';\n\ntype HttpVerb = keyof OpenApiPathItem;\n\n// Every live api on every root is a server the operations can be called on. Deployed, an\n// api domain is shared by every service in the application and each service is mounted\n// under its module name (the api gateway base path mapping), so the url carries that path.\n// A service with no domain (nothing browser-facing, local only) lists none.\nconst buildServers = (qpqConfig: QPQConfig, resolver?: DomainResolver): { url: string }[] => {\n  const serviceName = qpqCoreUtils.getApplicationModuleName(qpqConfig);\n\n  return getApiConfigs(qpqConfig)\n    .filter((api) => !api.deprecated)\n    .flatMap((api) => resolveHosts(qpqConfig, { subdomain: api.apiSubdomain }, resolver).map((host) => ({ url: `https://${host}/${serviceName}` })));\n};\n\n// Only schemes some operation actually references make it into components, so a\n// service with no auth publishes no dangling security definitions.\nconst buildSecuritySchemes = (paths: Record<string, OpenApiPathItem>): Record<string, OpenApiSecurityScheme> => {\n  const used = new Set(\n    Object.values(paths)\n      .flatMap((pathItem) => Object.values(pathItem))\n      .flatMap((operation) => operation.security ?? [])\n      .flatMap((requirement) => Object.keys(requirement)),\n  );\n\n  return Object.fromEntries(Object.entries(openApiSecuritySchemes).filter(([name]) => used.has(name)));\n};\n\n// Walk every route in the config and describe it. Routes are plain data, so this\n// runs anywhere the config does: at deploy time, in a processor, or in a test.\nexport const buildOpenApiDocument = (qpqConfig: QPQConfig, options: OpenApiDocumentOptions = {}, resolver?: DomainResolver): OpenApiDocument => {\n  const paths: Record<string, OpenApiPathItem> = {};\n\n  for (const route of getAllRoutes(qpqConfig)) {\n    const routeOptions = mergeAllRouteOptions('', route, qpqConfig);\n    if (routeOptions.schema?.hidden) {\n      continue;\n    }\n\n    const verb = route.method.toLowerCase() as HttpVerb;\n    paths[route.path] = { ...paths[route.path], [verb]: buildOpenApiOperation(route, routeOptions) };\n  }\n\n  return {\n    openapi: '3.1.0',\n    info: {\n      title: options.title ?? `${qpqCoreUtils.getApplicationName(qpqConfig)} ${qpqCoreUtils.getApplicationModuleName(qpqConfig)}`,\n      version: options.version ?? '1.0.0',\n      description: options.description,\n    },\n    servers: buildServers(qpqConfig, resolver),\n    paths,\n    components: { securitySchemes: buildSecuritySchemes(paths) },\n  };\n};\n"]}

package/lib/commonjs/utils/openApi/buildOpenApiOperation.d.ts

@@ -0,0 +1,4 @@
+import { RouteOptions } from '../../config/settings/route';
+import { RouteQPQWebServerConfigSetting } from '../../config/settings/route';
+import { OpenApiOperation } from '../../types/OpenApiDocument';
+export declare const buildOpenApiOperation: (route: RouteQPQWebServerConfigSetting, options: RouteOptions) => OpenApiOperation;

package/lib/commonjs/utils/openApi/buildOpenApiOperation.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildOpenApiOperation = void 0;
+const buildOpenApiPathParameters_1 = require("./buildOpenApiPathParameters");
+const buildOpenApiQueryParameters_1 = require("./buildOpenApiQueryParameters");
+const buildOpenApiSecurity_1 = require("./buildOpenApiSecurity");
+// `get_v1_widgets_id` style: stable across deploys and unique per method+path,
+// which is all client generators need from it.
+const toOperationId = (method, path) => [method.toLowerCase(), ...path.replace(/[{}]/g, '').split('/').filter(Boolean)].join('_');
+const buildResponses = (options) => {
+    var _a;
+    const { schema, routeAuthSettings } = options;
+    const responses = {
+        '200': (schema === null || schema === void 0 ? void 0 : schema.responseJsonSchema)
+            ? { description: 'Success', content: { 'application/json': { schema: schema.responseJsonSchema } } }
+            : { description: 'Success' },
+    };
+    if ((routeAuthSettings === null || routeAuthSettings === void 0 ? void 0 : routeAuthSettings.userDirectoryName) || ((_a = routeAuthSettings === null || routeAuthSettings === void 0 ? void 0 : routeAuthSettings.apiKeys) === null || _a === void 0 ? void 0 : _a.length)) {
+        responses['401'] = { description: 'Missing or invalid credentials' };
+    }
+    // Only routes that validate input can reject it; a plain route has no 422 path
+    if ((schema === null || schema === void 0 ? void 0 : schema.bodyJsonSchema) || (schema === null || schema === void 0 ? void 0 : schema.queryJsonSchema)) {
+        responses['422'] = { description: 'Request failed validation' };
+    }
+    return responses;
+};
+// One route becomes one operation. `options` is the route's options after the
+// service defaults have been merged in, so auth requirements are the real ones.
+const buildOpenApiOperation = (route, options) => {
+    const { schema } = options;
+    const parameters = [...(0, buildOpenApiPathParameters_1.buildOpenApiPathParameters)(route.path), ...(0, buildOpenApiQueryParameters_1.buildOpenApiQueryParameters)(schema === null || schema === void 0 ? void 0 : schema.queryJsonSchema)];
+    const security = (0, buildOpenApiSecurity_1.buildOpenApiSecurity)(options.routeAuthSettings);
+    return {
+        operationId: toOperationId(route.method, route.path),
+        summary: schema === null || schema === void 0 ? void 0 : schema.summary,
+        description: schema === null || schema === void 0 ? void 0 : schema.description,
+        tags: schema === null || schema === void 0 ? void 0 : schema.tags,
+        parameters: parameters.length ? parameters : undefined,
+        requestBody: (schema === null || schema === void 0 ? void 0 : schema.bodyJsonSchema) ? { required: true, content: { 'application/json': { schema: schema.bodyJsonSchema } } } : undefined,
+        responses: buildResponses(options),
+        security: security.length ? security : undefined,
+    };
+};
+exports.buildOpenApiOperation = buildOpenApiOperation;
+//# sourceMappingURL=buildOpenApiOperation.js.map

package/lib/commonjs/utils/openApi/buildOpenApiOperation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildOpenApiOperation.js","sourceRoot":"","sources":["../../../../src/utils/openApi/buildOpenApiOperation.ts"],"names":[],"mappings":";;;AAGA,6EAA0E;AAC1E,+EAA4E;AAC5E,iEAA8D;AAE9D,+EAA+E;AAC/E,+CAA+C;AAC/C,MAAM,aAAa,GAAG,CAAC,MAAc,EAAE,IAAY,EAAU,EAAE,CAC7D,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE5F,MAAM,cAAc,GAAG,CAAC,OAAqB,EAAmC,EAAE;;IAChF,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,GAAG,OAAO,CAAC;IAE9C,MAAM,SAAS,GAAoC;QACjD,KAAK,EAAE,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,kBAAkB;YAC/B,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,kBAAkB,EAAE,EAAE,EAAE;YACpG,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE;KAC/B,CAAC;IAEF,IAAI,CAAA,iBAAiB,aAAjB,iBAAiB,uBAAjB,iBAAiB,CAAE,iBAAiB,MAAI,MAAA,iBAAiB,aAAjB,iBAAiB,uBAAjB,iBAAiB,CAAE,OAAO,0CAAE,MAAM,CAAA,EAAE,CAAC;QAC/E,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,WAAW,EAAE,gCAAgC,EAAE,CAAC;IACvE,CAAC;IAED,+EAA+E;IAC/E,IAAI,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,cAAc,MAAI,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,eAAe,CAAA,EAAE,CAAC;QACtD,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,WAAW,EAAE,2BAA2B,EAAE,CAAC;IAClE,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF,8EAA8E;AAC9E,gFAAgF;AACzE,MAAM,qBAAqB,GAAG,CAAC,KAAqC,EAAE,OAAqB,EAAoB,EAAE;IACtH,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC3B,MAAM,UAAU,GAAG,CAAC,GAAG,IAAA,uDAA0B,EAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,IAAA,yDAA2B,EAAC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,eAAe,CAAC,CAAC,CAAC;IACxH,MAAM,QAAQ,GAAG,IAAA,2CAAoB,EAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAEjE,OAAO;QACL,WAAW,EAAE,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC;QACpD,OAAO,EAAE,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,OAAO;QACxB,WAAW,EAAE,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,WAAW;QAChC,IAAI,EAAE,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,IAAI;QAClB,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;QACtD,WAAW,EAAE,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,cAAc,EAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,cAAc,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS;QACxI,SAAS,EAAE,cAAc,CAAC,OAAO,CAAC;QAClC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;KACjD,CAAC;AACJ,CAAC,CAAC;AAfW,QAAA,qBAAqB,yBAehC","sourcesContent":["import { RouteOptions } from '../../config/settings/route';\nimport { RouteQPQWebServerConfigSetting } from '../../config/settings/route';\nimport { OpenApiOperation, OpenApiResponse } from '../../types/OpenApiDocument';\nimport { buildOpenApiPathParameters } from './buildOpenApiPathParameters';\nimport { buildOpenApiQueryParameters } from './buildOpenApiQueryParameters';\nimport { buildOpenApiSecurity } from './buildOpenApiSecurity';\n\n// `get_v1_widgets_id` style: stable across deploys and unique per method+path,\n// which is all client generators need from it.\nconst toOperationId = (method: string, path: string): string =>\n  [method.toLowerCase(), ...path.replace(/[{}]/g, '').split('/').filter(Boolean)].join('_');\n\nconst buildResponses = (options: RouteOptions): Record<string, OpenApiResponse> => {\n  const { schema, routeAuthSettings } = options;\n\n  const responses: Record<string, OpenApiResponse> = {\n    '200': schema?.responseJsonSchema\n      ? { description: 'Success', content: { 'application/json': { schema: schema.responseJsonSchema } } }\n      : { description: 'Success' },\n  };\n\n  if (routeAuthSettings?.userDirectoryName || routeAuthSettings?.apiKeys?.length) {\n    responses['401'] = { description: 'Missing or invalid credentials' };\n  }\n\n  // Only routes that validate input can reject it; a plain route has no 422 path\n  if (schema?.bodyJsonSchema || schema?.queryJsonSchema) {\n    responses['422'] = { description: 'Request failed validation' };\n  }\n\n  return responses;\n};\n\n// One route becomes one operation. `options` is the route's options after the\n// service defaults have been merged in, so auth requirements are the real ones.\nexport const buildOpenApiOperation = (route: RouteQPQWebServerConfigSetting, options: RouteOptions): OpenApiOperation => {\n  const { schema } = options;\n  const parameters = [...buildOpenApiPathParameters(route.path), ...buildOpenApiQueryParameters(schema?.queryJsonSchema)];\n  const security = buildOpenApiSecurity(options.routeAuthSettings);\n\n  return {\n    operationId: toOperationId(route.method, route.path),\n    summary: schema?.summary,\n    description: schema?.description,\n    tags: schema?.tags,\n    parameters: parameters.length ? parameters : undefined,\n    requestBody: schema?.bodyJsonSchema ? { required: true, content: { 'application/json': { schema: schema.bodyJsonSchema } } } : undefined,\n    responses: buildResponses(options),\n    security: security.length ? security : undefined,\n  };\n};\n"]}

package/lib/commonjs/utils/openApi/buildOpenApiPathParameters.d.ts

@@ -0,0 +1,2 @@
+import { OpenApiParameter } from '../../types/OpenApiDocument';
+export declare const buildOpenApiPathParameters: (path: string) => OpenApiParameter[];

package/lib/commonjs/utils/openApi/buildOpenApiPathParameters.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildOpenApiPathParameters = void 0;
+// Route paths already use OpenAPI's `{param}` template syntax, so the path itself
+// is the source of truth for path parameters. They are always strings on the wire.
+const buildOpenApiPathParameters = (path) => [...path.matchAll(/\{([^}]+)\}/g)].map(([, name]) => ({
+    name,
+    in: 'path',
+    required: true,
+    schema: { type: 'string' },
+}));
+exports.buildOpenApiPathParameters = buildOpenApiPathParameters;
+//# sourceMappingURL=buildOpenApiPathParameters.js.map

package/lib/commonjs/utils/openApi/buildOpenApiPathParameters.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildOpenApiPathParameters.js","sourceRoot":"","sources":["../../../../src/utils/openApi/buildOpenApiPathParameters.ts"],"names":[],"mappings":";;;AAEA,kFAAkF;AAClF,mFAAmF;AAC5E,MAAM,0BAA0B,GAAG,CAAC,IAAY,EAAsB,EAAE,CAC7E,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IACpD,IAAI;IACJ,EAAE,EAAE,MAAM;IACV,QAAQ,EAAE,IAAI;IACd,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;CAC3B,CAAC,CAAC,CAAC;AANO,QAAA,0BAA0B,8BAMjC","sourcesContent":["import { OpenApiParameter } from '../../types/OpenApiDocument';\n\n// Route paths already use OpenAPI's `{param}` template syntax, so the path itself\n// is the source of truth for path parameters. They are always strings on the wire.\nexport const buildOpenApiPathParameters = (path: string): OpenApiParameter[] =>\n  [...path.matchAll(/\\{([^}]+)\\}/g)].map(([, name]) => ({\n    name,\n    in: 'path',\n    required: true,\n    schema: { type: 'string' },\n  }));\n"]}

package/lib/commonjs/utils/openApi/buildOpenApiQueryParameters.d.ts

@@ -0,0 +1,3 @@
+import { JsonSchema } from '../../config/types/JsonSchema';
+import { OpenApiParameter } from '../../types/OpenApiDocument';
+export declare const buildOpenApiQueryParameters: (querySchema?: JsonSchema) => OpenApiParameter[];

package/lib/commonjs/utils/openApi/buildOpenApiQueryParameters.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildOpenApiQueryParameters = void 0;
+const isJsonSchema = (value) => typeof value === 'object' && value !== null;
+// A query schema is declared as one object schema, but OpenAPI wants one parameter
+// per key. Only the top-level properties can be unpacked; a query schema that is
+// not an object (or has none) contributes nothing rather than something wrong.
+const buildOpenApiQueryParameters = (querySchema) => {
+    const properties = querySchema === null || querySchema === void 0 ? void 0 : querySchema.properties;
+    if (!isJsonSchema(properties)) {
+        return [];
+    }
+    const required = Array.isArray(querySchema === null || querySchema === void 0 ? void 0 : querySchema.required) ? querySchema.required : [];
+    return Object.entries(properties)
+        .filter((entry) => isJsonSchema(entry[1]))
+        .map(([name, schema]) => ({
+        name,
+        in: 'query',
+        required: required.includes(name),
+        schema,
+        description: typeof schema.description === 'string' ? schema.description : undefined,
+    }));
+};
+exports.buildOpenApiQueryParameters = buildOpenApiQueryParameters;
+//# sourceMappingURL=buildOpenApiQueryParameters.js.map

package/lib/commonjs/utils/openApi/buildOpenApiQueryParameters.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildOpenApiQueryParameters.js","sourceRoot":"","sources":["../../../../src/utils/openApi/buildOpenApiQueryParameters.ts"],"names":[],"mappings":";;;AAGA,MAAM,YAAY,GAAG,CAAC,KAAc,EAAuB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AAE1G,mFAAmF;AACnF,iFAAiF;AACjF,+EAA+E;AACxE,MAAM,2BAA2B,GAAG,CAAC,WAAwB,EAAsB,EAAE;IAC1F,MAAM,UAAU,GAAG,WAAW,aAAX,WAAW,uBAAX,WAAW,CAAE,UAAU,CAAC;IAC3C,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,aAAX,WAAW,uBAAX,WAAW,CAAE,QAAQ,CAAC,CAAC,CAAC,CAAE,WAAW,CAAC,QAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;IAEhG,OAAO,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;SAC9B,MAAM,CAAC,CAAC,KAAK,EAAiC,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;SACxE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QACxB,IAAI;QACJ,EAAE,EAAE,OAAO;QACX,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;QACjC,MAAM;QACN,WAAW,EAAE,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;KACrF,CAAC,CAAC,CAAC;AACR,CAAC,CAAC;AAjBW,QAAA,2BAA2B,+BAiBtC","sourcesContent":["import { JsonSchema } from '../../config/types/JsonSchema';\nimport { OpenApiParameter } from '../../types/OpenApiDocument';\n\nconst isJsonSchema = (value: unknown): value is JsonSchema => typeof value === 'object' && value !== null;\n\n// A query schema is declared as one object schema, but OpenAPI wants one parameter\n// per key. Only the top-level properties can be unpacked; a query schema that is\n// not an object (or has none) contributes nothing rather than something wrong.\nexport const buildOpenApiQueryParameters = (querySchema?: JsonSchema): OpenApiParameter[] => {\n  const properties = querySchema?.properties;\n  if (!isJsonSchema(properties)) {\n    return [];\n  }\n\n  const required = Array.isArray(querySchema?.required) ? (querySchema.required as string[]) : [];\n\n  return Object.entries(properties)\n    .filter((entry): entry is [string, JsonSchema] => isJsonSchema(entry[1]))\n    .map(([name, schema]) => ({\n      name,\n      in: 'query',\n      required: required.includes(name),\n      schema,\n      description: typeof schema.description === 'string' ? schema.description : undefined,\n    }));\n};\n"]}

package/lib/commonjs/utils/openApi/buildOpenApiSecurity.d.ts

@@ -0,0 +1,4 @@
+import { RouteAuthSettings } from '../../config/settings/route';
+import { OpenApiSecurityRequirement, OpenApiSecurityScheme } from '../../types/OpenApiDocument';
+export declare const buildOpenApiSecurity: (routeAuthSettings?: RouteAuthSettings) => OpenApiSecurityRequirement[];
+export declare const openApiSecuritySchemes: Record<string, OpenApiSecurityScheme>;

package/lib/commonjs/utils/openApi/buildOpenApiSecurity.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.openApiSecuritySchemes = exports.buildOpenApiSecurity = void 0;
+const openApiSecuritySchemeNames_1 = require("./openApiSecuritySchemeNames");
+// Mirrors what askValidateRouteAuth actually checks: a user directory means a JWT in
+// the Authorization header, api keys mean the x-api-key header. Either satisfies the
+// route, so they are listed as alternatives rather than both required.
+const buildOpenApiSecurity = (routeAuthSettings) => {
+    var _a, _b;
+    const requirements = [];
+    if (routeAuthSettings === null || routeAuthSettings === void 0 ? void 0 : routeAuthSettings.userDirectoryName) {
+        requirements.push({ [openApiSecuritySchemeNames_1.OPEN_API_BEARER_AUTH]: (_a = routeAuthSettings.scopes) !== null && _a !== void 0 ? _a : [] });
+    }
+    if ((_b = routeAuthSettings === null || routeAuthSettings === void 0 ? void 0 : routeAuthSettings.apiKeys) === null || _b === void 0 ? void 0 : _b.length) {
+        requirements.push({ [openApiSecuritySchemeNames_1.OPEN_API_API_KEY_AUTH]: [] });
+    }
+    return requirements;
+};
+exports.buildOpenApiSecurity = buildOpenApiSecurity;
+exports.openApiSecuritySchemes = {
+    [openApiSecuritySchemeNames_1.OPEN_API_BEARER_AUTH]: { type: 'http', scheme: 'bearer', bearerFormat: 'JWT' },
+    [openApiSecuritySchemeNames_1.OPEN_API_API_KEY_AUTH]: { type: 'apiKey', in: 'header', name: 'x-api-key' },
+};
+//# sourceMappingURL=buildOpenApiSecurity.js.map

package/lib/commonjs/utils/openApi/buildOpenApiSecurity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildOpenApiSecurity.js","sourceRoot":"","sources":["../../../../src/utils/openApi/buildOpenApiSecurity.ts"],"names":[],"mappings":";;;AAEA,6EAA2F;AAE3F,qFAAqF;AACrF,qFAAqF;AACrF,uEAAuE;AAChE,MAAM,oBAAoB,GAAG,CAAC,iBAAqC,EAAgC,EAAE;;IAC1G,MAAM,YAAY,GAAiC,EAAE,CAAC;IAEtD,IAAI,iBAAiB,aAAjB,iBAAiB,uBAAjB,iBAAiB,CAAE,iBAAiB,EAAE,CAAC;QACzC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,iDAAoB,CAAC,EAAE,MAAA,iBAAiB,CAAC,MAAM,mCAAI,EAAE,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,IAAI,MAAA,iBAAiB,aAAjB,iBAAiB,uBAAjB,iBAAiB,CAAE,OAAO,0CAAE,MAAM,EAAE,CAAC;QACvC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,kDAAqB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC,CAAC;AAZW,QAAA,oBAAoB,wBAY/B;AAEW,QAAA,sBAAsB,GAA0C;IAC3E,CAAC,iDAAoB,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE;IAC/E,CAAC,kDAAqB,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE;CAC7E,CAAC","sourcesContent":["import { RouteAuthSettings } from '../../config/settings/route';\nimport { OpenApiSecurityRequirement, OpenApiSecurityScheme } from '../../types/OpenApiDocument';\nimport { OPEN_API_API_KEY_AUTH, OPEN_API_BEARER_AUTH } from './openApiSecuritySchemeNames';\n\n// Mirrors what askValidateRouteAuth actually checks: a user directory means a JWT in\n// the Authorization header, api keys mean the x-api-key header. Either satisfies the\n// route, so they are listed as alternatives rather than both required.\nexport const buildOpenApiSecurity = (routeAuthSettings?: RouteAuthSettings): OpenApiSecurityRequirement[] => {\n  const requirements: OpenApiSecurityRequirement[] = [];\n\n  if (routeAuthSettings?.userDirectoryName) {\n    requirements.push({ [OPEN_API_BEARER_AUTH]: routeAuthSettings.scopes ?? [] });\n  }\n\n  if (routeAuthSettings?.apiKeys?.length) {\n    requirements.push({ [OPEN_API_API_KEY_AUTH]: [] });\n  }\n\n  return requirements;\n};\n\nexport const openApiSecuritySchemes: Record<string, OpenApiSecurityScheme> = {\n  [OPEN_API_BEARER_AUTH]: { type: 'http', scheme: 'bearer', bearerFormat: 'JWT' },\n  [OPEN_API_API_KEY_AUTH]: { type: 'apiKey', in: 'header', name: 'x-api-key' },\n};\n"]}

package/lib/commonjs/utils/openApi/index.d.ts

@@ -0,0 +1,7 @@
+export * from './buildOpenApiDocument';
+export * from './buildOpenApiOperation';
+export * from './buildOpenApiPathParameters';
+export * from './buildOpenApiQueryParameters';
+export * from './buildOpenApiSecurity';
+export * from './OpenApiDocumentOptions';
+export * from './openApiSecuritySchemeNames';

package/lib/commonjs/utils/openApi/index.js

@@ -0,0 +1,24 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./buildOpenApiDocument"), exports);
+__exportStar(require("./buildOpenApiOperation"), exports);
+__exportStar(require("./buildOpenApiPathParameters"), exports);
+__exportStar(require("./buildOpenApiQueryParameters"), exports);
+__exportStar(require("./buildOpenApiSecurity"), exports);
+__exportStar(require("./OpenApiDocumentOptions"), exports);
+__exportStar(require("./openApiSecuritySchemeNames"), exports);
+//# sourceMappingURL=index.js.map

package/lib/commonjs/utils/openApi/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/utils/openApi/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,yDAAuC;AACvC,0DAAwC;AACxC,+DAA6C;AAC7C,gEAA8C;AAC9C,yDAAuC;AACvC,2DAAyC;AACzC,+DAA6C","sourcesContent":["export * from './buildOpenApiDocument';\nexport * from './buildOpenApiOperation';\nexport * from './buildOpenApiPathParameters';\nexport * from './buildOpenApiQueryParameters';\nexport * from './buildOpenApiSecurity';\nexport * from './OpenApiDocumentOptions';\nexport * from './openApiSecuritySchemeNames';\n"]}

package/lib/commonjs/utils/openApi/openApiSecuritySchemeNames.d.ts

@@ -0,0 +1,2 @@
+export declare const OPEN_API_BEARER_AUTH = "bearerAuth";
+export declare const OPEN_API_API_KEY_AUTH = "apiKeyAuth";

package/lib/commonjs/utils/openApi/openApiSecuritySchemeNames.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OPEN_API_API_KEY_AUTH = exports.OPEN_API_BEARER_AUTH = void 0;
+// Keys under components.securitySchemes; operations reference them by name.
+exports.OPEN_API_BEARER_AUTH = 'bearerAuth';
+exports.OPEN_API_API_KEY_AUTH = 'apiKeyAuth';
+//# sourceMappingURL=openApiSecuritySchemeNames.js.map

package/lib/commonjs/utils/openApi/openApiSecuritySchemeNames.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openApiSecuritySchemeNames.js","sourceRoot":"","sources":["../../../../src/utils/openApi/openApiSecuritySchemeNames.ts"],"names":[],"mappings":";;;AAAA,4EAA4E;AAC/D,QAAA,oBAAoB,GAAG,YAAY,CAAC;AACpC,QAAA,qBAAqB,GAAG,YAAY,CAAC","sourcesContent":["// Keys under components.securitySchemes; operations reference them by name.\nexport const OPEN_API_BEARER_AUTH = 'bearerAuth';\nexport const OPEN_API_API_KEY_AUTH = 'apiKeyAuth';\n"]}