raffel 1.1.52 → 1.1.57
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/middleware/policy/principal/anonymous.d.ts +31 -0
- package/dist/middleware/policy/principal/anonymous.d.ts.map +1 -0
- package/dist/middleware/policy/principal/anonymous.js +11 -0
- package/dist/middleware/policy/principal/anonymous.js.map +1 -0
- package/dist/middleware/policy/principal/index.d.ts +1 -0
- package/dist/middleware/policy/principal/index.d.ts.map +1 -1
- package/dist/middleware/policy/principal/index.js +1 -0
- package/dist/middleware/policy/principal/index.js.map +1 -1
- package/dist/middleware/policy/principal/oauth2.d.ts.map +1 -1
- package/dist/middleware/policy/principal/oauth2.js +7 -2
- package/dist/middleware/policy/principal/oauth2.js.map +1 -1
- package/dist/middleware/policy/principal/oidc.d.ts.map +1 -1
- package/dist/middleware/policy/principal/oidc.js +5 -2
- package/dist/middleware/policy/principal/oidc.js.map +1 -1
- package/dist/middleware/policy/principal/session.d.ts.map +1 -1
- package/dist/middleware/policy/principal/session.js +8 -2
- package/dist/middleware/policy/principal/session.js.map +1 -1
- package/dist/server/discovery-utils.d.ts.map +1 -1
- package/dist/server/discovery-utils.js +10 -1
- package/dist/server/discovery-utils.js.map +1 -1
- package/package.json +1 -1
|
@@ -0,0 +1,31 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Shared anonymous principal used by all default principal resolvers when the
|
|
3
|
+
* request has no authenticated identity (no auth interceptor ran, or the
|
|
4
|
+
* session has no logged-in user).
|
|
5
|
+
*
|
|
6
|
+
* Returning this instead of throwing prevents a co-located policy on a
|
|
7
|
+
* `meta.auth: 'none'` route (e.g. `/health/live`) from crashing the request
|
|
8
|
+
* with HTTP 500 — see the regression fixed alongside this constant.
|
|
9
|
+
*
|
|
10
|
+
* Authors that want to forbid anonymous access on a route must either:
|
|
11
|
+
* - set `meta.auth: 'required'` so an auth interceptor runs first, or
|
|
12
|
+
* - declare an explicit `defaultMode: 'deny'` policy that does not include
|
|
13
|
+
* `'*'` (or this principal) in its `principals` allow list.
|
|
14
|
+
*
|
|
15
|
+
* Note: the engine compiles every principal set with the wildcard `'*'`
|
|
16
|
+
* (see `engine/compile.ts`), so any `principals: ['*']` policy — including
|
|
17
|
+
* co-located folder cascades — will match anonymous requests. Use explicit
|
|
18
|
+
* `principals` patterns or `public: true` on the co-located policy to opt
|
|
19
|
+
* anonymous traffic out.
|
|
20
|
+
*
|
|
21
|
+
* The principal MUST NOT be deeply frozen — the engine caches
|
|
22
|
+
* `_compiledSet` on it during evaluation, which would throw under
|
|
23
|
+
* `Object.freeze`. We freeze only the inner `attrs` object so callers cannot
|
|
24
|
+
* accidentally mutate the anonymous marker; the `scopes` and `groups` arrays
|
|
25
|
+
* stay mutable to match the `Principal` interface and avoid TS readonly
|
|
26
|
+
* friction — nothing in the engine mutates them.
|
|
27
|
+
*/
|
|
28
|
+
import type { Principal } from '../types.js';
|
|
29
|
+
export declare const ANONYMOUS_PRINCIPAL: Principal;
|
|
30
|
+
export declare function isAnonymousPrincipal(principal: Principal | undefined | null): boolean;
|
|
31
|
+
//# sourceMappingURL=anonymous.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"anonymous.d.ts","sourceRoot":"","sources":["../../../../src/middleware/policy/principal/anonymous.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAE5C,eAAO,MAAM,mBAAmB,EAAE,SAMjC,CAAA;AAED,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,SAAS,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAErF"}
|
|
@@ -0,0 +1,11 @@
|
|
|
1
|
+
export const ANONYMOUS_PRINCIPAL = {
|
|
2
|
+
id: 'anonymous',
|
|
3
|
+
tenantId: null,
|
|
4
|
+
scopes: [],
|
|
5
|
+
groups: [],
|
|
6
|
+
attrs: Object.freeze({ anonymous: true }),
|
|
7
|
+
};
|
|
8
|
+
export function isAnonymousPrincipal(principal) {
|
|
9
|
+
return principal?.id === ANONYMOUS_PRINCIPAL.id;
|
|
10
|
+
}
|
|
11
|
+
//# sourceMappingURL=anonymous.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"anonymous.js","sourceRoot":"","sources":["../../../../src/middleware/policy/principal/anonymous.ts"],"names":[],"mappings":"AA6BA,MAAM,CAAC,MAAM,mBAAmB,GAAc;IAC5C,EAAE,EAAE,WAAW;IACf,QAAQ,EAAE,IAAI;IACd,MAAM,EAAE,EAAE;IACV,MAAM,EAAE,EAAE;IACV,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;CAC1C,CAAA;AAED,MAAM,UAAU,oBAAoB,CAAC,SAAuC;IAC1E,OAAO,SAAS,EAAE,EAAE,KAAK,mBAAmB,CAAC,EAAE,CAAA;AACjD,CAAC"}
|
|
@@ -17,4 +17,5 @@ export declare function createPrincipalResolver(config: PrincipalConfig): Princi
|
|
|
17
17
|
export { createSessionPrincipalResolver } from './session.js';
|
|
18
18
|
export { createOAuth2PrincipalResolver } from './oauth2.js';
|
|
19
19
|
export { createOidcPrincipalResolver } from './oidc.js';
|
|
20
|
+
export { ANONYMOUS_PRINCIPAL, isAnonymousPrincipal } from './anonymous.js';
|
|
20
21
|
//# sourceMappingURL=index.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/middleware/policy/principal/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,2BAA2B,CAAA;AACxD,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAmB,MAAM,aAAa,CAAA;AAK9E,MAAM,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,OAAO,KAAK,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;AAehF,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,eAAe,GAAG,iBAAiB,CAMlF;AAED,OAAO,EAAE,8BAA8B,EAAE,MAAM,cAAc,CAAA;AAC7D,OAAO,EAAE,6BAA6B,EAAE,MAAM,aAAa,CAAA;AAC3D,OAAO,EAAE,2BAA2B,EAAE,MAAM,WAAW,CAAA"}
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/middleware/policy/principal/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,2BAA2B,CAAA;AACxD,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAmB,MAAM,aAAa,CAAA;AAK9E,MAAM,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,OAAO,KAAK,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;AAehF,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,eAAe,GAAG,iBAAiB,CAMlF;AAED,OAAO,EAAE,8BAA8B,EAAE,MAAM,cAAc,CAAA;AAC7D,OAAO,EAAE,6BAA6B,EAAE,MAAM,aAAa,CAAA;AAC3D,OAAO,EAAE,2BAA2B,EAAE,MAAM,WAAW,CAAA;AACvD,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAA"}
|
|
@@ -35,4 +35,5 @@ export function createPrincipalResolver(config) {
|
|
|
35
35
|
export { createSessionPrincipalResolver } from './session.js';
|
|
36
36
|
export { createOAuth2PrincipalResolver } from './oauth2.js';
|
|
37
37
|
export { createOidcPrincipalResolver } from './oidc.js';
|
|
38
|
+
export { ANONYMOUS_PRINCIPAL, isAnonymousPrincipal } from './anonymous.js';
|
|
38
39
|
//# sourceMappingURL=index.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/middleware/policy/principal/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,EAAE,6BAA6B,EAAE,MAAM,aAAa,CAAA;AAC3D,OAAO,EAAE,2BAA2B,EAAE,MAAM,WAAW,CAAA;AACvD,OAAO,EAAE,8BAA8B,EAAE,MAAM,cAAc,CAAA;AAI7D,MAAM,QAAQ,GAA4E;IACxF,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE;QACjB,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;QACtE,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAA;QACtB,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;IAC3C,CAAC;IACD,OAAO,EAAE,8BAA8B;IACvC,MAAM,EAAE,6BAA6B;IACrC,IAAI,EAAE,2BAA2B;CAClC,CAAA;AAED,MAAM,UAAU,uBAAuB,CAAC,MAAuB;IAC7D,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACrC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,CAAC,IAAI,yBAAyB,CAAC,CAAA;IACrF,CAAC;IACD,OAAO,OAAO,CAAC,MAAM,CAAC,CAAA;AACxB,CAAC;AAED,OAAO,EAAE,8BAA8B,EAAE,MAAM,cAAc,CAAA;AAC7D,OAAO,EAAE,6BAA6B,EAAE,MAAM,aAAa,CAAA;AAC3D,OAAO,EAAE,2BAA2B,EAAE,MAAM,WAAW,CAAA"}
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/middleware/policy/principal/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,EAAE,6BAA6B,EAAE,MAAM,aAAa,CAAA;AAC3D,OAAO,EAAE,2BAA2B,EAAE,MAAM,WAAW,CAAA;AACvD,OAAO,EAAE,8BAA8B,EAAE,MAAM,cAAc,CAAA;AAI7D,MAAM,QAAQ,GAA4E;IACxF,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE;QACjB,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;QACtE,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAA;QACtB,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;IAC3C,CAAC;IACD,OAAO,EAAE,8BAA8B;IACvC,MAAM,EAAE,6BAA6B;IACrC,IAAI,EAAE,2BAA2B;CAClC,CAAA;AAED,MAAM,UAAU,uBAAuB,CAAC,MAAuB;IAC7D,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACrC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,CAAC,IAAI,yBAAyB,CAAC,CAAA;IACrF,CAAC;IACD,OAAO,OAAO,CAAC,MAAM,CAAC,CAAA;AACxB,CAAC;AAED,OAAO,EAAE,8BAA8B,EAAE,MAAM,cAAc,CAAA;AAC7D,OAAO,EAAE,6BAA6B,EAAE,MAAM,aAAa,CAAA;AAC3D,OAAO,EAAE,2BAA2B,EAAE,MAAM,WAAW,CAAA;AACvD,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAA"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"oauth2.d.ts","sourceRoot":"","sources":["../../../../src/middleware/policy/principal/oauth2.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,KAAK,EAAa,eAAe,EAAE,MAAM,aAAa,CAAA;AAC7D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;
|
|
1
|
+
{"version":3,"file":"oauth2.d.ts","sourceRoot":"","sources":["../../../../src/middleware/policy/principal/oauth2.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,KAAK,EAAa,eAAe,EAAE,MAAM,aAAa,CAAA;AAC7D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAqBnD,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,eAAe,GAAG,iBAAiB,CAMxF"}
|
|
@@ -13,11 +13,16 @@
|
|
|
13
13
|
* Override via `principal: { from: 'oauth2', map: (rawAuth, ctx) => Principal }`.
|
|
14
14
|
*/
|
|
15
15
|
import { derivePolicyPrincipalFromAuth } from '../../../auth/principal.js';
|
|
16
|
+
import { ANONYMOUS_PRINCIPAL } from './anonymous.js';
|
|
16
17
|
function defaultMap(ctx) {
|
|
17
18
|
const auth = ctx.auth;
|
|
18
19
|
if (!auth?.authenticated) {
|
|
19
|
-
|
|
20
|
-
|
|
20
|
+
// Unauthenticated request → anonymous principal. Policies that want to
|
|
21
|
+
// restrict to authenticated callers must filter via their own patterns
|
|
22
|
+
// (e.g. explicit allow rules or `defaultMode: 'deny'`). Throwing here
|
|
23
|
+
// would surface as HTTP 500 INTERNAL_ERROR and break K8s probes against
|
|
24
|
+
// `meta.auth: 'none'` routes that still carry co-located policies.
|
|
25
|
+
return ANONYMOUS_PRINCIPAL;
|
|
21
26
|
}
|
|
22
27
|
try {
|
|
23
28
|
return derivePolicyPrincipalFromAuth(auth);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"oauth2.js","sourceRoot":"","sources":["../../../../src/middleware/policy/principal/oauth2.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAA;
|
|
1
|
+
{"version":3,"file":"oauth2.js","sourceRoot":"","sources":["../../../../src/middleware/policy/principal/oauth2.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAA;AAG1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AAEpD,SAAS,UAAU,CAAC,GAAY;IAC9B,MAAM,IAAI,GAAG,GAAG,CAAC,IAA+B,CAAA;IAChD,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,CAAC;QACzB,uEAAuE;QACvE,uEAAuE;QACvE,sEAAsE;QACtE,wEAAwE;QACxE,mEAAmE;QACnE,OAAO,mBAAmB,CAAA;IAC5B,CAAC;IAED,IAAI,CAAC;QACH,OAAO,6BAA6B,CAAC,IAAI,CAAC,CAAA;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAA;IAC7F,CAAC;AACH,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,MAAuB;IACnE,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAA;QACtB,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC1C,CAAC;IACD,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;AACvC,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"oidc.d.ts","sourceRoot":"","sources":["../../../../src/middleware/policy/principal/oidc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,KAAK,EAAa,eAAe,EAAE,MAAM,aAAa,CAAA;AAC7D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;
|
|
1
|
+
{"version":3,"file":"oidc.d.ts","sourceRoot":"","sources":["../../../../src/middleware/policy/principal/oidc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,KAAK,EAAa,eAAe,EAAE,MAAM,aAAa,CAAA;AAC7D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAmBnD,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,eAAe,GAAG,iBAAiB,CAMtF"}
|
|
@@ -13,11 +13,14 @@
|
|
|
13
13
|
* attrs ← full claims
|
|
14
14
|
*/
|
|
15
15
|
import { derivePolicyPrincipalFromAuth } from '../../../auth/principal.js';
|
|
16
|
+
import { ANONYMOUS_PRINCIPAL } from './anonymous.js';
|
|
16
17
|
function defaultMap(ctx) {
|
|
17
18
|
const auth = ctx.auth;
|
|
18
19
|
if (!auth?.authenticated) {
|
|
19
|
-
|
|
20
|
-
|
|
20
|
+
// See oauth2.ts — unauthenticated requests resolve to the anonymous
|
|
21
|
+
// principal so co-located policies can decide what to do instead of the
|
|
22
|
+
// request crashing the principal resolver with an HTTP 500.
|
|
23
|
+
return ANONYMOUS_PRINCIPAL;
|
|
21
24
|
}
|
|
22
25
|
try {
|
|
23
26
|
return derivePolicyPrincipalFromAuth(auth, { preferClaimsSub: true });
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../../../../src/middleware/policy/principal/oidc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAA;
|
|
1
|
+
{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../../../../src/middleware/policy/principal/oidc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAA;AAG1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AAEpD,SAAS,UAAU,CAAC,GAAY;IAC9B,MAAM,IAAI,GAAG,GAAG,CAAC,IAA+B,CAAA;IAChD,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,CAAC;QACzB,oEAAoE;QACpE,wEAAwE;QACxE,4DAA4D;QAC5D,OAAO,mBAAmB,CAAA;IAC5B,CAAC;IAED,IAAI,CAAC;QACH,OAAO,6BAA6B,CAAC,IAAI,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAA;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAA;IAC3F,CAAC;AACH,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,MAAuB;IACjE,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAA;QACtB,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC1C,CAAC;IACD,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;AACvC,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../../src/middleware/policy/principal/session.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAa,eAAe,EAAE,MAAM,aAAa,CAAA;AAC7D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;
|
|
1
|
+
{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../../src/middleware/policy/principal/session.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAa,eAAe,EAAE,MAAM,aAAa,CAAA;AAC7D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AA8BnD,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,eAAe,GAAG,iBAAiB,CASzF"}
|
|
@@ -6,12 +6,18 @@
|
|
|
6
6
|
*
|
|
7
7
|
* Override via `principal: { from: 'session', map: (raw, ctx) => Principal }`.
|
|
8
8
|
*/
|
|
9
|
+
import { ANONYMOUS_PRINCIPAL } from './anonymous.js';
|
|
9
10
|
function defaultMap(ctx) {
|
|
10
11
|
const session = ctx.session;
|
|
11
12
|
const user = session?.data?.user;
|
|
12
13
|
if (!user || typeof user.id !== 'string') {
|
|
13
|
-
|
|
14
|
-
|
|
14
|
+
// No logged-in user → anonymous principal. Co-located policies on a
|
|
15
|
+
// `meta.auth: 'none'` route (e.g. /health/live) used to crash here with a
|
|
16
|
+
// plain Error that bubbled all the way up as HTTP 500 INTERNAL_ERROR,
|
|
17
|
+
// killing the pod after the K8s probe failed. Returning the anonymous
|
|
18
|
+
// principal lets the engine evaluate (or skip, when the route is marked
|
|
19
|
+
// public by discovery-utils) instead of crashing the request.
|
|
20
|
+
return ANONYMOUS_PRINCIPAL;
|
|
15
21
|
}
|
|
16
22
|
return {
|
|
17
23
|
id: user.id,
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"session.js","sourceRoot":"","sources":["../../../../src/middleware/policy/principal/session.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;
|
|
1
|
+
{"version":3,"file":"session.js","sourceRoot":"","sources":["../../../../src/middleware/policy/principal/session.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AAQpD,SAAS,UAAU,CAAC,GAAY;IAC9B,MAAM,OAAO,GAAI,GAA4C,CAAC,OAAO,CAAA;IACrE,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,EAAE,IAAI,CAAA;IAChC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;QACzC,oEAAoE;QACpE,0EAA0E;QAC1E,sEAAsE;QACtE,sEAAsE;QACtE,wEAAwE;QACxE,8DAA8D;QAC9D,OAAO,mBAAmB,CAAA;IAC5B,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI;QAC/B,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;QAC1D,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;QAC1D,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAA;AACH,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,MAAuB;IACpE,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAA;QACtB,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,MAAM,OAAO,GAAI,GAA4C,CAAC,OAAO,CAAA;YACrE,OAAO,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAA;QACtC,CAAC,CAAA;IACH,CAAC;IACD,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;AACvC,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"discovery-utils.d.ts","sourceRoot":"","sources":["../../src/server/discovery-utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,KAAK,EAAE,WAAW,EAAiD,MAAM,mBAAmB,CAAA;AACnG,OAAO,KAAK,EAAE,cAAc,EAAiB,MAAM,wBAAwB,CAAA;AAC3E,OAAO,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AACrF,OAAO,KAAK,EAAE,eAAe,EAAe,MAAM,sBAAsB,CAAA;AAIxE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAA;AACxE,OAAO,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAA;AAIlF,MAAM,WAAW,+BAA+B;IAC9C,SAAS,EAAE,eAAe,CAAA;CAC3B;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAgED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EACvC,UAAU,EAAE,+BAA+B,GAAG,SAAS,EACvD,mBAAmB,CAAC,EAAE,MAAM,EAC5B,SAAS,CAAC,EAAE,wBAAwB,GACnC,OAAO,CAaT;AAED;;;;GAIG;AACH,wBAAgB,sCAAsC,CACpD,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EACvC,UAAU,EAAE,+BAA+B,GAAG,SAAS,EACvD,mBAAmB,CAAC,EAAE,MAAM,EAC5B,YAAY,CAAC,EAAE,qBAAqB,GACnC,WAAW,EAAE,CAGf;
|
|
1
|
+
{"version":3,"file":"discovery-utils.d.ts","sourceRoot":"","sources":["../../src/server/discovery-utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,KAAK,EAAE,WAAW,EAAiD,MAAM,mBAAmB,CAAA;AACnG,OAAO,KAAK,EAAE,cAAc,EAAiB,MAAM,wBAAwB,CAAA;AAC3E,OAAO,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AACrF,OAAO,KAAK,EAAE,eAAe,EAAe,MAAM,sBAAsB,CAAA;AAIxE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAA;AACxE,OAAO,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAA;AAIlF,MAAM,WAAW,+BAA+B;IAC9C,SAAS,EAAE,eAAe,CAAA;CAC3B;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAgED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EACvC,UAAU,EAAE,+BAA+B,GAAG,SAAS,EACvD,mBAAmB,CAAC,EAAE,MAAM,EAC5B,SAAS,CAAC,EAAE,wBAAwB,GACnC,OAAO,CAaT;AAED;;;;GAIG;AACH,wBAAgB,sCAAsC,CACpD,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EACvC,UAAU,EAAE,+BAA+B,GAAG,SAAS,EACvD,mBAAmB,CAAC,EAAE,MAAM,EAC5B,YAAY,CAAC,EAAE,qBAAqB,GACnC,WAAW,EAAE,CAGf;AA0BD;;GAEG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,eAAe,EACvB,QAAQ,EAAE,QAAQ,EAClB,cAAc,EAAE,cAAc,EAC9B,kBAAkB,EAAE,WAAW,EAAE,EACjC,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE;IACrB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,WAAW,GAAG,QAAQ,GAAG,OAAO,CAAA;IACtC,QAAQ,EAAE,MAAM,CAAA;CACjB,KAAK,IAAI,EACV,UAAU,CAAC,EAAE,+BAA+B,GAC3C,IAAI,CA8DN;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAO9E;AAuBD;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,iBAAiB,GAC7B;IACD,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAA;IACzB,KAAK,EAAE,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAA;IAC5B,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,CAAA;CACxB,CAMA"}
|
|
@@ -83,7 +83,16 @@ export function buildCoLocatedAuthzInterceptorsForName(name, policies, policyHoo
|
|
|
83
83
|
return [policyHook.bootstrap.interceptorFactory(name, { action: name, ...policyConfig })];
|
|
84
84
|
}
|
|
85
85
|
function buildCoLocatedAuthzInterceptors(route, policyHook) {
|
|
86
|
-
|
|
86
|
+
// Routes declared as public (`meta.auth: 'none'`) must not have their
|
|
87
|
+
// co-located policy enforced: an anonymous K8s probe (or any unauthenticated
|
|
88
|
+
// request) would otherwise flow into the policy interceptor with no
|
|
89
|
+
// principal context. Forwarding `public: true` here matches the author's
|
|
90
|
+
// explicit intent — they opted the route out of authentication, so the
|
|
91
|
+
// policy engine treats it as public too. Authors that still want policy
|
|
92
|
+
// enforcement on an auth-free route can call `.authz({ public: false })`
|
|
93
|
+
// explicitly via the builder API to override.
|
|
94
|
+
const policyConfig = route.meta?.auth === 'none' ? { public: true } : undefined;
|
|
95
|
+
return buildCoLocatedAuthzInterceptorsForName(route.name, route.coLocatedPolicies, policyHook, route.filePath, policyConfig);
|
|
87
96
|
}
|
|
88
97
|
/**
|
|
89
98
|
* Register discovered handlers from file-system
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"discovery-utils.js","sourceRoot":"","sources":["../../src/server/discovery-utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAMxC,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAA;AAC9D,OAAO,EAAE,+BAA+B,EAAE,MAAM,2BAA2B,CAAA;AAC3E,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAIjD,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAA;AAYrC,SAAS,eAAe,CAAC,MAAc,EAAE,iBAAyB;IAChE,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,IAAI,QAAQ,CAAA;IACzC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,CAAA;IAChC,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,KAAK,IAAI,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;AACxG,CAAC;AAED,SAAS,mBAAmB,CAC1B,MAAc,EACd,SAA+C;IAE/C,IAAI,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;IAC1D,MAAM,QAAQ,GAAa,EAAE,CAAA;IAE7B,IAAI,SAAS,EAAE,KAAK,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QACtD,KAAK,KAAK,EAAE,CAAA;QACZ,KAAK,CAAC,MAAM,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;QAChC,QAAQ,CAAC,IAAI,CAAC,SAAS,SAAS,CAAC,KAAK,EAAE,CAAC,CAAA;IAC3C,CAAC;IACD,IAAI,SAAS,EAAE,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QAC1D,KAAK,KAAK,EAAE,CAAA;QACZ,KAAK,CAAC,QAAQ,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;QACpC,QAAQ,CAAC,IAAI,CAAC,WAAW,SAAS,CAAC,OAAO,EAAE,CAAC,CAAA;IAC/C,CAAC;IACD,IAAI,SAAS,EAAE,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QAC5D,KAAK,KAAK,EAAE,CAAA;QACZ,KAAK,CAAC,SAAS,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;QACtC,QAAQ,CAAC,IAAI,CAAC,YAAY,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAA;IACjD,CAAC;IAED,OAAO;QACL,KAAK;QACL,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;KACxB,CAAA;AACH,CAAC;AAED,SAAS,4BAA4B,CACnC,QAA2B,EAC3B,SAAoC;IAEpC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAA;IAC9C,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,wEAAwE;QACxE,sEAAsE;QACtE,gEAAgE;QAChE,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;IACrC,CAAC;IAED,OAAO,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QAC/C,MAAM,EACJ,SAAS,EAAE,aAAa,EACxB,cAAc,EAAE,kBAAkB,EAClC,GAAG,IAAI,EACR,GAAG,MAAM,CAAA;QACV,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,mBAAmB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;QAC7D,OAAO;YACL,GAAG,IAAI;YACP,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3B,EAAE,EAAE,MAAM,eAAe,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,EAAE,EAAE;SACtD,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAC1C,IAAY,EACZ,QAAuC,EACvC,UAAuD,EACvD,mBAA4B,EAC5B,SAAoC;IAEpC,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAA;IAC7B,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACpD,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,CAAA;IAC1C,IAAI,OAAO,MAAM,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QAC7C,MAAM,CAAC,IAAI,CACT,EAAE,IAAI,EAAE,QAAQ,EAAE,mBAAmB,EAAE,EACvC,+FAA+F,CAChG,CAAA;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,CAAC,WAAW,CAAC,4BAA4B,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAA;IACrE,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sCAAsC,CACpD,IAAY,EACZ,QAAuC,EACvC,UAAuD,EACvD,mBAA4B,EAC5B,YAAoC;IAEpC,IAAI,CAAC,4BAA4B,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,mBAAmB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAAE,OAAO,EAAE,CAAA;IAC9G,OAAO,CAAC,UAAW,CAAC,SAAS,CAAC,kBAAkB,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,YAAY,EAAE,CAAC,CAAC,CAAA;AAC5F,CAAC;AAED,SAAS,+BAA+B,CACtC,KAAkB,EAClB,UAAuD;IAEvD,OAAO,sCAAsC,CAC3C,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,iBAAiB,EACvB,UAAU,EACV,KAAK,CAAC,QAAQ,
|
|
1
|
+
{"version":3,"file":"discovery-utils.js","sourceRoot":"","sources":["../../src/server/discovery-utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAMxC,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAA;AAC9D,OAAO,EAAE,+BAA+B,EAAE,MAAM,2BAA2B,CAAA;AAC3E,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAIjD,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAA;AAYrC,SAAS,eAAe,CAAC,MAAc,EAAE,iBAAyB;IAChE,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,IAAI,QAAQ,CAAA;IACzC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,CAAA;IAChC,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,KAAK,IAAI,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;AACxG,CAAC;AAED,SAAS,mBAAmB,CAC1B,MAAc,EACd,SAA+C;IAE/C,IAAI,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;IAC1D,MAAM,QAAQ,GAAa,EAAE,CAAA;IAE7B,IAAI,SAAS,EAAE,KAAK,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QACtD,KAAK,KAAK,EAAE,CAAA;QACZ,KAAK,CAAC,MAAM,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;QAChC,QAAQ,CAAC,IAAI,CAAC,SAAS,SAAS,CAAC,KAAK,EAAE,CAAC,CAAA;IAC3C,CAAC;IACD,IAAI,SAAS,EAAE,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QAC1D,KAAK,KAAK,EAAE,CAAA;QACZ,KAAK,CAAC,QAAQ,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;QACpC,QAAQ,CAAC,IAAI,CAAC,WAAW,SAAS,CAAC,OAAO,EAAE,CAAC,CAAA;IAC/C,CAAC;IACD,IAAI,SAAS,EAAE,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QAC5D,KAAK,KAAK,EAAE,CAAA;QACZ,KAAK,CAAC,SAAS,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;QACtC,QAAQ,CAAC,IAAI,CAAC,YAAY,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAA;IACjD,CAAC;IAED,OAAO;QACL,KAAK;QACL,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;KACxB,CAAA;AACH,CAAC;AAED,SAAS,4BAA4B,CACnC,QAA2B,EAC3B,SAAoC;IAEpC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAA;IAC9C,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,wEAAwE;QACxE,sEAAsE;QACtE,gEAAgE;QAChE,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;IACrC,CAAC;IAED,OAAO,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QAC/C,MAAM,EACJ,SAAS,EAAE,aAAa,EACxB,cAAc,EAAE,kBAAkB,EAClC,GAAG,IAAI,EACR,GAAG,MAAM,CAAA;QACV,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,mBAAmB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;QAC7D,OAAO;YACL,GAAG,IAAI;YACP,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3B,EAAE,EAAE,MAAM,eAAe,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,EAAE,EAAE;SACtD,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAC1C,IAAY,EACZ,QAAuC,EACvC,UAAuD,EACvD,mBAA4B,EAC5B,SAAoC;IAEpC,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAA;IAC7B,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACpD,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,CAAA;IAC1C,IAAI,OAAO,MAAM,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QAC7C,MAAM,CAAC,IAAI,CACT,EAAE,IAAI,EAAE,QAAQ,EAAE,mBAAmB,EAAE,EACvC,+FAA+F,CAChG,CAAA;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,CAAC,WAAW,CAAC,4BAA4B,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAA;IACrE,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sCAAsC,CACpD,IAAY,EACZ,QAAuC,EACvC,UAAuD,EACvD,mBAA4B,EAC5B,YAAoC;IAEpC,IAAI,CAAC,4BAA4B,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,mBAAmB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAAE,OAAO,EAAE,CAAA;IAC9G,OAAO,CAAC,UAAW,CAAC,SAAS,CAAC,kBAAkB,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,YAAY,EAAE,CAAC,CAAC,CAAA;AAC5F,CAAC;AAED,SAAS,+BAA+B,CACtC,KAAkB,EAClB,UAAuD;IAEvD,sEAAsE;IACtE,6EAA6E;IAC7E,oEAAoE;IACpE,yEAAyE;IACzE,uEAAuE;IACvE,wEAAwE;IACxE,yEAAyE;IACzE,8CAA8C;IAC9C,MAAM,YAAY,GAChB,KAAK,CAAC,IAAI,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;IAE5D,OAAO,sCAAsC,CAC3C,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,iBAAiB,EACvB,UAAU,EACV,KAAK,CAAC,QAAQ,EACd,YAAY,CACb,CAAA;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAAuB,EACvB,QAAkB,EAClB,cAA8B,EAC9B,kBAAiC,EACjC,YAIU,EACV,UAA4C;IAE5C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClC,uEAAuE;QACvE,sEAAsE;QACtE,kEAAkE;QAClE,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,KAAK,CACV,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,EAC9C,wEAAwE,CACzE,CAAA;YACD,SAAQ;QACV,CAAC;QAED,wCAAwC;QACxC,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAA;QACxD,MAAM,iBAAiB,GAAG,+BAA+B,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;QAC5E,MAAM,YAAY,GAAG,CAAC,GAAG,kBAAkB,EAAE,GAAG,iBAAiB,EAAE,GAAG,iBAAiB,CAAC,CAAA;QAExF,6BAA6B;QAC7B,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;YAC5C,MAAM,MAAM,GAAkB,EAAE,CAAA;YAChC,IAAI,KAAK,CAAC,WAAW;gBAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC,WAAW,CAAA;YACvD,IAAI,KAAK,CAAC,YAAY;gBAAE,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,YAAY,CAAA;YAC1D,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QAC7C,CAAC;QAED,yBAAyB;QACzB,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAC/B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,QAAQ;gBAClC,CAAC,CAAC,+BAA+B,CAAC,KAAK,CAAC,OAA2B,CAAC;gBACpE,CAAC,CAAC,KAAK,CAAC,OAA2B,CAAA;YACrC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE;gBACtC,WAAW,EAAE,KAAK,CAAC,IAAI,EAAE,WAAW;gBACpC,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO;gBAC5B,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ;gBAC9B,UAAU,EAAE,KAAK,CAAC,IAAI,EAAE,UAAU;gBAClC,iBAAiB,EAAE,KAAK,CAAC,IAAI,EAAE,iBAAiB;gBAChD,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO;gBAC5B,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI;gBACtB,YAAY,EAAE,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;aACjE,CAAC,CAAA;YACF,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAA;QACnF,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACnC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAwB,EAAE;gBAC1D,WAAW,EAAE,KAAK,CAAC,IAAI,EAAE,WAAW;gBACpC,SAAS,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS;gBAChC,YAAY,EAAE,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;aACjE,CAAC,CAAA;YACF,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAA;QAChF,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAClC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAuB,EAAE;gBACxD,WAAW,EAAE,KAAK,CAAC,IAAI,EAAE,WAAW;gBACpC,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ;gBAC9B,WAAW,EAAE,KAAK,CAAC,IAAI,EAAE,WAAW;gBACpC,mBAAmB,EAAE,KAAK,CAAC,IAAI,EAAE,mBAAmB;gBACpD,YAAY,EAAE,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;aACjE,CAAC,CAAA;YACF,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAA;QAC/E,CAAC;QAED,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,oBAAoB,CAAC,CAAA;IAC5E,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,aAAqB,EAAE,OAAe;IACnE,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IAChC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA,CAAC,uBAAuB;QAC3D,OAAO,aAAa,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;IACzC,CAAC;IACD,OAAO,aAAa,KAAK,OAAO,CAAA;AAClC,CAAC;AAED;;;GAGG;AACH,SAAS,oBAAoB,CAC3B,aAAqB,EACrB,UAA+C;IAE/C,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,CAAA;IAC1B,MAAM,OAAO,GAAQ,EAAE,CAAA;IACvB,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1D,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,OAAO,CAAC;YAAE,SAAQ;QACrD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAA;QACxB,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACrB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB,CACtC,aAAqB,EACrB,WAA8B;IAM9B,OAAO;QACL,MAAM,EAAE,oBAAoB,CAAkB,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC;QAChF,KAAK,EAAE,oBAAoB,CAAsB,aAAa,EAAE,WAAW,CAAC,KAAK,CAAC;QAClF,KAAK,EAAE,oBAAoB,CAAiB,aAAa,EAAE,WAAW,CAAC,KAAK,CAAC;KAC9E,CAAA;AACH,CAAC"}
|