was-teaching-server 0.9.1

package/dist/corsProxy.js

@@ -0,0 +1,278 @@
+import net from 'node:net';
+import { lookup as dnsLookup } from 'node:dns/promises';
+import { fetch, Agent } from 'undici';
+const PROXY_TIMEOUT_MS = 10_000;
+const MAX_REDIRECTS = 5;
+/**
+ * Upper bound on the response body the proxy will buffer and relay. Caps memory
+ * use per proxied request and refuses to relay an oversized upstream response
+ * (enforced both from a declared `content-length` and while streaming).
+ */
+const PROXY_MAX_RESPONSE_BYTES = 10 * 1024 * 1024;
+/**
+ * True for an IPv4 address in a private, loopback, link-local, or otherwise
+ * non-public range -- the SSRF-sensitive destinations the proxy must refuse
+ * (RFC 1918 private space, `127.0.0.0/8` loopback, `169.254.0.0/16` link-local
+ * -- which covers the `169.254.169.254` cloud-metadata endpoint -- CGNAT, and
+ * multicast/reserved). A syntactically invalid address is treated as blocked.
+ * @param ip {string}
+ * @returns {boolean}
+ */
+function isBlockedIpv4(ip) {
+    const parts = ip.split('.').map(Number);
+    if (parts.length !== 4 ||
+        parts.some(part => !Number.isInteger(part) || part < 0 || part > 255)) {
+        return true;
+    }
+    const [a, b] = parts;
+    return (a === 0 || // 0.0.0.0/8 "this network"
+        a === 10 || // private
+        a === 127 || // loopback
+        (a === 169 && b === 254) || // link-local (incl. cloud metadata)
+        (a === 172 && b >= 16 && b <= 31) || // private
+        (a === 192 && b === 168) || // private
+        (a === 100 && b >= 64 && b <= 127) || // CGNAT (RFC 6598)
+        (a === 192 && b === 0) || // 192.0.0.0/24 IETF protocol assignments
+        a >= 224 // multicast / reserved
+    );
+}
+/**
+ * True for an IPv6 address in a loopback, unspecified, unique-local (`fc00::/7`),
+ * or link-local (`fe80::/10`) range, or an IPv4-mapped/embedded address whose
+ * IPv4 form is blocked. A syntactically invalid address is treated as blocked.
+ * @param ip {string}
+ * @returns {boolean}
+ */
+function isBlockedIpv6(ip) {
+    const lower = ip.toLowerCase();
+    const mapped = lower.match(/(?:^|:)(\d+\.\d+\.\d+\.\d+)$/);
+    if (mapped) {
+        return isBlockedIpv4(mapped[1]);
+    }
+    return (lower === '::' ||
+        lower === '::1' ||
+        lower.startsWith('fe8') || // fe80::/10 link-local
+        lower.startsWith('fe9') ||
+        lower.startsWith('fea') ||
+        lower.startsWith('feb') ||
+        lower.startsWith('fc') || // fc00::/7 unique-local
+        lower.startsWith('fd'));
+}
+/**
+ * True for an IP the proxy must not reach. Unparseable input is blocked
+ * defensively.
+ * @param ip {string}
+ * @returns {boolean}
+ */
+function isBlockedIp(ip) {
+    const family = net.isIP(ip);
+    if (family === 4) {
+        return isBlockedIpv4(ip);
+    }
+    if (family === 6) {
+        return isBlockedIpv6(ip);
+    }
+    return true;
+}
+/**
+ * Parses and validates a single proxy target: `http`/`https` scheme only, and
+ * the host must not resolve to a blocked (private / loopback / link-local)
+ * address. Runs once for the client-supplied URL and again for every redirect
+ * hop, so an allowed public host cannot bounce the proxy to an internal one.
+ * Returns the exact addresses it validated so the caller can pin the upstream
+ * connection to them (closing the DNS-rebinding TOCTOU).
+ * @param target {string}
+ * @returns {Promise<{url: URL, addresses: {address: string, family: number}[]} | {status: number, error: string}>}
+ *   the parsed URL plus its validated addresses when allowed, or the HTTP
+ *   status + message to reject with.
+ */
+async function checkProxyTarget(target) {
+    let parsed;
+    try {
+        parsed = new URL(target);
+    }
+    catch {
+        return { status: 400, error: 'Invalid url query parameter' };
+    }
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+        return {
+            status: 400,
+            error: 'Only http and https URLs may be proxied.'
+        };
+    }
+    // Resolve the host and refuse private / loopback / link-local destinations
+    // (SSRF). `dns.lookup` returns the literal itself for an IP host, so
+    // IP-literal targets are covered too.
+    const hostname = parsed.hostname.replace(/^\[|\]$/g, '');
+    let addresses;
+    try {
+        addresses = await dnsLookup(hostname, { all: true });
+    }
+    catch {
+        return { status: 502, error: 'Unable to resolve proxied host.' };
+    }
+    if (addresses.length === 0 ||
+        addresses.some(({ address }) => isBlockedIp(address))) {
+        return { status: 403, error: 'Proxying to this host is not allowed.' };
+    }
+    return { url: parsed, addresses };
+}
+/**
+ * Builds the undici `connect.lookup` function that pins each upstream socket to
+ * the exact addresses `checkProxyTarget` already validated, keyed by hostname.
+ * The `fetch` still connects using the original hostname (so TLS certificate
+ * validation and SNI keep working) but resolves it only via this map, so a
+ * rebinding attacker cannot swap in a fresh, private address between validation
+ * and connection. A hostname absent from the map is refused (defense in depth:
+ * the agent must never resolve an unpinned host).
+ * @param pins {Map<string, {address: string, family: number}[]>} validated
+ *   addresses keyed by lower-cased hostname.
+ * @returns {LookupFunction} an undici/`net`-compatible lookup callback.
+ */
+export function createPinnedLookup(pins) {
+    return function pinnedLookup(hostname, options, callback) {
+        const entries = pins.get(hostname.toLowerCase());
+        if (!entries || entries.length === 0) {
+            callback(new Error(`Refusing to resolve unpinned host: ${hostname}`));
+            return;
+        }
+        if (options.all) {
+            callback(null, entries);
+            return;
+        }
+        const first = entries[0];
+        callback(null, first.address, first.family);
+    };
+}
+/**
+ * Registers a server-side CORS proxy at `/api/cors`.
+ *
+ * Example:
+ * `/api/cors?url=https%3A%2F%2Fregistry.dcconsortium.org%2F.well-known%2Fopenid-federation`
+ *
+ * SSRF guard: only `http`/`https` URLs are proxied, and the target host is
+ * resolved and rejected when it maps to a private, loopback, or link-local
+ * address (e.g. `http://169.254.169.254/...` cloud-metadata, or an internal
+ * service). Redirects are followed manually (up to `MAX_REDIRECTS` hops) and
+ * every hop is re-validated the same way, so a public host cannot 3xx the
+ * proxy into an internal one. The addresses each hop validated are then pinned
+ * for the actual upstream connection (via a per-request undici `Agent` whose
+ * `connect.lookup` resolves only from that pin map), so a DNS-rebinding
+ * attacker cannot pass validation with a public IP and have the subsequent
+ * `fetch` re-resolve to a private one (closing the TOCTOU). The relayed
+ * response body is capped at `PROXY_MAX_RESPONSE_BYTES`, both from a declared
+ * `content-length` and while streaming. This is an unauthenticated open
+ * endpoint; adding a lightweight auth gate (a shared secret header, an
+ * allowlist of caller origins, or the server's own capability-invocation
+ * check) is a reasonable follow-up.
+ *
+ * @param app - Fastify instance
+ * @param _options - Fastify plugin options
+ */
+export async function initCorsProxyRoutes(app, _options) {
+    app.get('/api/cors', async (request, reply) => {
+        const target = request.query.url;
+        if (!target) {
+            return reply.code(400).send({ error: 'Missing url query parameter' });
+        }
+        const checked = await checkProxyTarget(target);
+        if (!('url' in checked)) {
+            return reply.code(checked.status).send({ error: checked.error });
+        }
+        let current = checked.url;
+        const headers = {};
+        if (typeof request.headers.accept === 'string') {
+            headers.accept = request.headers.accept;
+        }
+        // One undici Agent per proxied request, resolving each hop only via the
+        // addresses that hop already validated. The Agent must stay alive until
+        // the body is fully read, so it is torn down once in the finally below.
+        const pins = new Map();
+        const pinKey = (url) => url.hostname.replace(/^\[|\]$/g, '').toLowerCase();
+        pins.set(pinKey(current), checked.addresses);
+        const agent = new Agent({ connect: { lookup: createPinnedLookup(pins) } });
+        try {
+            for (let hop = 0;; hop++) {
+                const upstream = await fetch(current.href, {
+                    headers,
+                    redirect: 'manual',
+                    signal: AbortSignal.timeout(PROXY_TIMEOUT_MS),
+                    dispatcher: agent
+                });
+                const location = upstream.headers.get('location');
+                if (upstream.status >= 300 && upstream.status < 400 && location) {
+                    if (hop >= MAX_REDIRECTS) {
+                        return reply
+                            .code(502)
+                            .send({ error: 'Too many proxied redirects.' });
+                    }
+                    let next;
+                    try {
+                        next = new URL(location, current);
+                    }
+                    catch {
+                        return reply
+                            .code(502)
+                            .send({ error: 'Invalid redirect from proxied URL.' });
+                    }
+                    const nextChecked = await checkProxyTarget(next.toString());
+                    if (!('url' in nextChecked)) {
+                        return reply
+                            .code(nextChecked.status)
+                            .send({ error: nextChecked.error });
+                    }
+                    current = nextChecked.url;
+                    pins.set(pinKey(current), nextChecked.addresses);
+                    continue;
+                }
+                // Refuse an upstream that declares a body larger than the cap before
+                // reading any of it.
+                const declaredLength = Number(upstream.headers.get('content-length'));
+                if (Number.isFinite(declaredLength) &&
+                    declaredLength > PROXY_MAX_RESPONSE_BYTES) {
+                    return reply
+                        .code(502)
+                        .send({ error: 'Proxied response too large.' });
+                }
+                // Read incrementally so an undeclared (or lying) oversized body is
+                // stopped mid-stream rather than fully buffered. Upstream headers
+                // are copied only after the body is fully read, so a mid-stream
+                // rejection does not carry the upstream's content-type /
+                // content-length on the JSON error response.
+                const chunks = [];
+                if (upstream.body) {
+                    const reader = upstream.body.getReader();
+                    let total = 0;
+                    for (;;) {
+                        const { done, value } = await reader.read();
+                        if (done) {
+                            break;
+                        }
+                        total += value.byteLength;
+                        if (total > PROXY_MAX_RESPONSE_BYTES) {
+                            await reader.cancel();
+                            return reply
+                                .code(502)
+                                .send({ error: 'Proxied response too large.' });
+                        }
+                        chunks.push(Buffer.from(value));
+                    }
+                }
+                upstream.headers.forEach((value, name) => reply.header(name, value));
+                return reply.code(upstream.status).send(Buffer.concat(chunks));
+            }
+        }
+        catch (error) {
+            request.log.warn({ error, target }, 'CORS proxy fetch failed');
+            return reply.code(502).send({ error: 'Unable to fetch proxied URL' });
+        }
+        finally {
+            // destroy(), not close(): early-exit paths (blocked redirect, too
+            // many redirects, oversized content-length) leave upstream bodies
+            // unconsumed, and close() would wait on them. Everything the reply
+            // sends is already buffered, so tearing down the sockets is safe.
+            await agent.destroy();
+        }
+    });
+}
+//# sourceMappingURL=corsProxy.js.map

package/dist/corsProxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"corsProxy.js","sourceRoot":"","sources":["../src/corsProxy.ts"],"names":[],"mappings":"AAEA,OAAO,GAAG,MAAM,UAAU,CAAA;AAC1B,OAAO,EAAE,MAAM,IAAI,SAAS,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAA;AAErC,MAAM,gBAAgB,GAAG,MAAM,CAAA;AAC/B,MAAM,aAAa,GAAG,CAAC,CAAA;AAEvB;;;;GAIG;AACH,MAAM,wBAAwB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AAMjD;;;;;;;;GAQG;AACH,SAAS,aAAa,CAAC,EAAU;IAC/B,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACvC,IACE,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,GAAG,CAAC,EACrE,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAyC,CAAA;IACxD,OAAO,CACL,CAAC,KAAK,CAAC,IAAI,2BAA2B;QACtC,CAAC,KAAK,EAAE,IAAI,UAAU;QACtB,CAAC,KAAK,GAAG,IAAI,WAAW;QACxB,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,oCAAoC;QAChE,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,UAAU;QAC/C,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,UAAU;QACtC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,mBAAmB;QACzD,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,yCAAyC;QACnE,CAAC,IAAI,GAAG,CAAC,uBAAuB;KACjC,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,EAAU;IAC/B,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,EAAE,CAAA;IAC9B,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAA;IAC1D,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAA;IAClC,CAAC;IACD,OAAO,CACL,KAAK,KAAK,IAAI;QACd,KAAK,KAAK,KAAK;QACf,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,uBAAuB;QAClD,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;QACvB,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;QACvB,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;QACvB,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,wBAAwB;QAClD,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CACvB,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,EAAU;IAC7B,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC3B,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACjB,OAAO,aAAa,CAAC,EAAE,CAAC,CAAA;IAC1B,CAAC;IACD,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACjB,OAAO,aAAa,CAAC,EAAE,CAAC,CAAA;IAC1B,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,gBAAgB,CAC7B,MAAc;IAKd,IAAI,MAAW,CAAA;IACf,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAA;IAC9D,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChE,OAAO;YACL,MAAM,EAAE,GAAG;YACX,KAAK,EAAE,0CAA0C;SAClD,CAAA;IACH,CAAC;IAED,2EAA2E;IAC3E,qEAAqE;IACrE,sCAAsC;IACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;IACxD,IAAI,SAAgD,CAAA;IACpD,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAA;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAA;IAClE,CAAC;IACD,IACE,SAAS,CAAC,MAAM,KAAK,CAAC;QACtB,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,EACrD,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAA;IACxE,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;AACnC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAwD;IAExD,OAAO,SAAS,YAAY,CAC1B,QAAgB,EAChB,OAA0B,EAC1B,QAIS;QAET,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAA;QAChD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,QAAQ,CAAC,IAAI,KAAK,CAAC,sCAAsC,QAAQ,EAAE,CAAC,CAAC,CAAA;YACrE,OAAM;QACR,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAChB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;YACvB,OAAM;QACR,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAE,CAAA;QACzB,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;IAC7C,CAA8B,CAAA;AAChC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,GAAoB,EACpB,QAA8B;IAE9B,GAAG,CAAC,GAAG,CACL,WAAW,EACX,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAA;QAEhC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAA;QACvE,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAA;QAC9C,IAAI,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,EAAE,CAAC;YACxB,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,OAAO,GAAG,OAAO,CAAC,GAAG,CAAA;QAEzB,MAAM,OAAO,GAA2B,EAAE,CAAA;QAC1C,IAAI,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/C,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAA;QACzC,CAAC;QAED,wEAAwE;QACxE,wEAAwE;QACxE,wEAAwE;QACxE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAiD,CAAA;QACrE,MAAM,MAAM,GAAG,CAAC,GAAQ,EAAE,EAAE,CAC1B,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;QACpD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;QAC5C,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;QAE1E,IAAI,CAAC;YACH,KAAK,IAAI,GAAG,GAAG,CAAC,GAAI,GAAG,EAAE,EAAE,CAAC;gBAC1B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE;oBACzC,OAAO;oBACP,QAAQ,EAAE,QAAQ;oBAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;oBAC7C,UAAU,EAAE,KAAK;iBAClB,CAAC,CAAA;gBAEF,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;gBACjD,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,EAAE,CAAC;oBAChE,IAAI,GAAG,IAAI,aAAa,EAAE,CAAC;wBACzB,OAAO,KAAK;6BACT,IAAI,CAAC,GAAG,CAAC;6BACT,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAA;oBACnD,CAAC;oBACD,IAAI,IAAS,CAAA;oBACb,IAAI,CAAC;wBACH,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;oBACnC,CAAC;oBAAC,MAAM,CAAC;wBACP,OAAO,KAAK;6BACT,IAAI,CAAC,GAAG,CAAC;6BACT,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAA;oBAC1D,CAAC;oBACD,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;oBAC3D,IAAI,CAAC,CAAC,KAAK,IAAI,WAAW,CAAC,EAAE,CAAC;wBAC5B,OAAO,KAAK;6BACT,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;6BACxB,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC,CAAA;oBACvC,CAAC;oBACD,OAAO,GAAG,WAAW,CAAC,GAAG,CAAA;oBACzB,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC,SAAS,CAAC,CAAA;oBAChD,SAAQ;gBACV,CAAC;gBAED,qEAAqE;gBACrE,qBAAqB;gBACrB,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAA;gBACrE,IACE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC;oBAC/B,cAAc,GAAG,wBAAwB,EACzC,CAAC;oBACD,OAAO,KAAK;yBACT,IAAI,CAAC,GAAG,CAAC;yBACT,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAA;gBACnD,CAAC;gBAED,mEAAmE;gBACnE,kEAAkE;gBAClE,gEAAgE;gBAChE,yDAAyD;gBACzD,6CAA6C;gBAC7C,MAAM,MAAM,GAAa,EAAE,CAAA;gBAC3B,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;oBAClB,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAA;oBACxC,IAAI,KAAK,GAAG,CAAC,CAAA;oBACb,SAAS,CAAC;wBACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;wBAC3C,IAAI,IAAI,EAAE,CAAC;4BACT,MAAK;wBACP,CAAC;wBACD,KAAK,IAAI,KAAK,CAAC,UAAU,CAAA;wBACzB,IAAI,KAAK,GAAG,wBAAwB,EAAE,CAAC;4BACrC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAA;4BACrB,OAAO,KAAK;iCACT,IAAI,CAAC,GAAG,CAAC;iCACT,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAA;wBACnD,CAAC;wBACD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;oBACjC,CAAC;gBACH,CAAC;gBACD,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAA;gBACpE,OAAO,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;YAChE,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,yBAAyB,CAAC,CAAA;YAC9D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAA;QACvE,CAAC;gBAAS,CAAC;YACT,kEAAkE;YAClE,kEAAkE;YAClE,mEAAmE;YACnE,kEAAkE;YAClE,MAAM,KAAK,CAAC,OAAO,EAAE,CAAA;QACvB,CAAC;IACH,CAAC,CACF,CAAA;AACH,CAAC"}

package/dist/digest.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Request Body Integrity (spec "Request Body Integrity (Digest Header)"): binds
+ * a request body to its HTTP Signature via the `Digest` header. Two hooks,
+ * installed by every route group alongside the auth hooks:
+ *
+ * - `captureRawBody` (preParsing) tees the exact body bytes onto
+ *   `request.rawBody` for JSON/text bodies, so the digest can be recomputed
+ *   against what the client actually signed. Re-serializing the parsed body is
+ *   not guaranteed byte-identical, so we keep the raw bytes instead. Streamed
+ *   bodies (multipart uploads, tar imports, raw blobs) are not buffered; instead
+ *   they pass through a hashing transform that verifies the `Digest`
+ *   incrementally at end-of-stream, so large/binary uploads keep streaming yet
+ *   are still bound to the signature.
+ * - `verifyBodyDigest` (preValidation) enforces, for any request carrying a
+ *   `Content-Type`: that the signature covers the `digest` header (MUST), that a
+ *   `Digest` header is present, and -- when the raw body was captured --
+ *   independently recomputes the body digest and compares it (SHOULD). A
+ *   missing, malformed, uncovered, or non-matching digest is rejected with
+ *   `invalid-authorization-header` (400).
+ */
+import type { FastifyReply, FastifyRequest } from 'fastify';
+import { type Readable } from 'node:stream';
+/**
+ * preParsing hook: for JSON/text bodies, tees the incoming payload into
+ * `request.rawBody` while passing the same bytes through to Fastify's content-
+ * type parser (so `verifyBodyDigest` can recompute the digest). Other (streamed)
+ * bodies are not buffered; when the request is signed with a `Digest` they pass
+ * through a `DigestVerifyStream` that verifies that digest incrementally, so a
+ * swapped binary/large body under a valid signed `Digest` is still rejected.
+ * @param request {import('fastify').FastifyRequest}
+ * @param reply {import('fastify').FastifyReply}
+ * @param payload {Readable}   the raw request body stream
+ * @returns {Promise<Readable>}   the stream Fastify should parse
+ */
+export declare function captureRawBody(request: FastifyRequest, _reply: FastifyReply, payload: Readable): Promise<Readable>;
+/**
+ * preValidation hook: enforces the `Digest` header binding for any request that
+ * carries a `Content-Type`. Bodyless requests (no `Content-Type`) and anonymous
+ * reads (no parsed `request.zcap`) are passed through.
+ * @param request {import('fastify').FastifyRequest}
+ * @param reply {import('fastify').FastifyReply}
+ * @returns {Promise<void>}
+ */
+export declare function verifyBodyDigest(request: FastifyRequest, _reply: FastifyReply): Promise<void>;
+//# sourceMappingURL=digest.d.ts.map

package/dist/digest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"digest.d.ts","sourceRoot":"","sources":["../src/digest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAE3D,OAAO,EAA0B,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAA;AAyFnE;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,QAAQ,GAChB,OAAO,CAAC,QAAQ,CAAC,CA0BnB;AAED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,IAAI,CAAC,CAwDf"}

package/dist/digest.js

@@ -0,0 +1,174 @@
+import { verifyHeaderValue } from '@interop/http-digest-header';
+import { PassThrough, Transform } from 'node:stream';
+import { createHash } from 'node:crypto';
+import { isJson } from './lib/isJson.js';
+import { InvalidDigestError } from './errors.js';
+/**
+ * True for the body shapes `verifyBodyDigest` recomputes: JSON
+ * (`application/json` / `+json`) and text. These reach handlers fully parsed
+ * (object / string), so buffering their bytes is cheap; streamed bodies
+ * (multipart, `application/x-tar`) are deliberately excluded.
+ * @param contentType {string | undefined}
+ * @returns {boolean}
+ */
+function isBufferableBody(contentType) {
+    return (isJson({ contentType }) ||
+        (typeof contentType === 'string' && contentType.startsWith('text/')));
+}
+/**
+ * Compares an incrementally-computed SHA-256 digest against a `Digest` header
+ * value, mirroring `@interop/http-digest-header`'s encodings without buffering
+ * the body: the multihash form (`mh=u<base64url(0x12 0x20 <digest>)>`, what WAS
+ * clients send) and the RFC 9651 `SHA-256=<base64>` form (colons stripped).
+ * @param options {object}
+ * @param options.sha256Digest {Buffer}   the computed 32-byte SHA-256 digest
+ * @param options.headerValue {string}   the request's `Digest` header value
+ * @returns {boolean}
+ */
+function digestMatches({ sha256Digest, headerValue }) {
+    const [key = '', rawValue] = headerValue.split(/=(.+)/);
+    if (key === 'mh') {
+        const multihash = Buffer.concat([Buffer.from([0x12, 0x20]), sha256Digest]);
+        return rawValue === `u${multihash.toString('base64url')}`;
+    }
+    if (key.replace('-', '').toLowerCase() === 'sha256') {
+        const expected = (rawValue ?? '').replace(/^:(.*):$/, '$1');
+        return expected === sha256Digest.toString('base64');
+    }
+    // Only SHA-256 is supported (as in the library); anything else cannot match.
+    return false;
+}
+/**
+ * A pass-through Transform that hashes the streamed bytes (SHA-256) and, at
+ * end-of-stream, verifies the accumulated digest against the request's `Digest`
+ * header -- erroring the stream (which fails the write) on a mismatch. This
+ * binds a streamed/binary body to its signed `Digest` without buffering it. A
+ * mismatch surfaces mid-write; consumers that persist the stream remove any
+ * partial output on the resulting error (see the filesystem backend's blob
+ * write).
+ */
+class DigestVerifyStream extends Transform {
+    _hash = createHash('sha256');
+    _digestHeader;
+    constructor(digestHeader) {
+        super();
+        this._digestHeader = digestHeader;
+    }
+    _transform(chunk, _encoding, callback) {
+        this._hash.update(chunk);
+        callback(null, chunk);
+    }
+    _flush(callback) {
+        const matched = digestMatches({
+            sha256Digest: this._hash.digest(),
+            headerValue: this._digestHeader
+        });
+        callback(matched
+            ? null
+            : new InvalidDigestError({
+                detail: 'The `Digest` header does not match the request body.'
+            }));
+    }
+}
+/**
+ * preParsing hook: for JSON/text bodies, tees the incoming payload into
+ * `request.rawBody` while passing the same bytes through to Fastify's content-
+ * type parser (so `verifyBodyDigest` can recompute the digest). Other (streamed)
+ * bodies are not buffered; when the request is signed with a `Digest` they pass
+ * through a `DigestVerifyStream` that verifies that digest incrementally, so a
+ * swapped binary/large body under a valid signed `Digest` is still rejected.
+ * @param request {import('fastify').FastifyRequest}
+ * @param reply {import('fastify').FastifyReply}
+ * @param payload {Readable}   the raw request body stream
+ * @returns {Promise<Readable>}   the stream Fastify should parse
+ */
+export async function captureRawBody(request, _reply, payload) {
+    if (!isBufferableBody(request.headers['content-type'])) {
+        // Streamed (non-buffered) body. Bind it to the signature by hashing it as it
+        // flows; an unsigned/anonymous body (no `Digest`) has nothing to verify.
+        // `parseAuthHeaders` (onRequest) has already run, so `request.zcap` is set
+        // for a signed request.
+        const digestHeader = request.zcap?.digest;
+        if (!digestHeader) {
+            return payload;
+        }
+        const verify = new DigestVerifyStream(digestHeader);
+        payload.on('error', err => verify.destroy(err));
+        return payload.pipe(verify);
+    }
+    const chunks = [];
+    const passthrough = new PassThrough();
+    payload.on('data', chunk => {
+        chunks.push(chunk);
+        passthrough.write(chunk);
+    });
+    payload.on('end', () => {
+        request.rawBody = Buffer.concat(chunks);
+        passthrough.end();
+    });
+    payload.on('error', err => passthrough.destroy(err));
+    return passthrough;
+}
+/**
+ * preValidation hook: enforces the `Digest` header binding for any request that
+ * carries a `Content-Type`. Bodyless requests (no `Content-Type`) and anonymous
+ * reads (no parsed `request.zcap`) are passed through.
+ * @param request {import('fastify').FastifyRequest}
+ * @param reply {import('fastify').FastifyReply}
+ * @returns {Promise<void>}
+ */
+export async function verifyBodyDigest(request, _reply) {
+    // A provisioning-authorized request (onboarding token) is not signed, so
+    // there is no signature to cover a `Digest` header -- nothing to bind.
+    if (request.provisioningAuthorized) {
+        return;
+    }
+    const contentType = request.headers['content-type'];
+    // Bodyless requests carry no Content-Type and no Digest -- nothing to bind.
+    if (!contentType) {
+        return;
+    }
+    // No parsed auth headers: writes require auth (the auth hooks 401 first), so a
+    // bodied request reaching here without `zcap` is a safe method that happens to
+    // carry a Content-Type; leave it to the handler's policy decision.
+    const { zcap } = request;
+    if (!zcap) {
+        return;
+    }
+    // MUST: `digest` is among the signature's covered (signed) headers. Guard the
+    // `headers` param itself: an `Authorization` header that omits `headers="..."`
+    // leaves it undefined, and splitting that would be a 500 rather than the
+    // intended `invalid-authorization-header` (400).
+    if (!zcap.headers || !zcap.headers.split(/\s+/).includes('digest')) {
+        throw new InvalidDigestError({
+            detail: 'The request signature must cover the `digest` header when the ' +
+                'request carries a body.'
+        });
+    }
+    // The `Digest` header itself MUST be present.
+    if (!zcap.digest) {
+        throw new InvalidDigestError({
+            detail: 'A `Digest` header is required when the request carries a body.'
+        });
+    }
+    // SHOULD: independently recompute and compare, when the raw body was captured.
+    // Streamed bodies (multipart, tar import, raw blobs) are not buffered here;
+    // `captureRawBody` has already wrapped them in a `DigestVerifyStream` that
+    // verifies the digest incrementally as the body is consumed.
+    if (request.rawBody === undefined) {
+        return;
+    }
+    const { verified, error } = await verifyHeaderValue({
+        data: request.rawBody,
+        headerValue: zcap.digest
+    });
+    if (!verified) {
+        throw new InvalidDigestError({
+            detail: error
+                ? 'The `Digest` header is malformed or uses an unsupported algorithm.'
+                : 'The `Digest` header does not match the request body.',
+            cause: error
+        });
+    }
+}
+//# sourceMappingURL=digest.js.map

package/dist/digest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"digest.js","sourceRoot":"","sources":["../src/digest.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAA;AAC/D,OAAO,EAAE,WAAW,EAAE,SAAS,EAAiB,MAAM,aAAa,CAAA;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAEhD;;;;;;;GAOG;AACH,SAAS,gBAAgB,CAAC,WAA+B;IACvD,OAAO,CACL,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;QACvB,CAAC,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CACrE,CAAA;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,aAAa,CAAC,EACrB,YAAY,EACZ,WAAW,EAIZ;IACC,MAAM,CAAC,GAAG,GAAG,EAAE,EAAE,QAAQ,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IACvD,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAA;QAC1E,OAAO,QAAQ,KAAK,IAAI,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAA;IAC3D,CAAC;IACD,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;QAC3D,OAAO,QAAQ,KAAK,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IACrD,CAAC;IACD,6EAA6E;IAC7E,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,kBAAmB,SAAQ,SAAS;IACvB,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAA;IAC5B,aAAa,CAAQ;IACtC,YAAY,YAAoB;QAC9B,KAAK,EAAE,CAAA;QACP,IAAI,CAAC,aAAa,GAAG,YAAY,CAAA;IACnC,CAAC;IACQ,UAAU,CACjB,KAAa,EACb,SAAyB,EACzB,QAAuD;QAEvD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACxB,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IACvB,CAAC;IACQ,MAAM,CAAC,QAAwC;QACtD,MAAM,OAAO,GAAG,aAAa,CAAC;YAC5B,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;YACjC,WAAW,EAAE,IAAI,CAAC,aAAa;SAChC,CAAC,CAAA;QACF,QAAQ,CACN,OAAO;YACL,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,IAAI,kBAAkB,CAAC;gBACrB,MAAM,EAAE,sDAAsD;aAC/D,CAAC,CACP,CAAA;IACH,CAAC;CACF;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAuB,EACvB,MAAoB,EACpB,OAAiB;IAEjB,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;QACvD,6EAA6E;QAC7E,yEAAyE;QACzE,2EAA2E;QAC3E,wBAAwB;QACxB,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,EAAE,MAAM,CAAA;QACzC,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,OAAO,CAAA;QAChB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,kBAAkB,CAAC,YAAY,CAAC,CAAA;QACnD,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAA;QAC/C,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAC7B,CAAC;IACD,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAA;IACrC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE;QACzB,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAA;QAC5B,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;IACF,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;QACrB,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QACvC,WAAW,CAAC,GAAG,EAAE,CAAA;IACnB,CAAC,CAAC,CAAA;IACF,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAA;IACpD,OAAO,WAAW,CAAA;AACpB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAuB,EACvB,MAAoB;IAEpB,yEAAyE;IACzE,uEAAuE;IACvE,IAAI,OAAO,CAAC,sBAAsB,EAAE,CAAC;QACnC,OAAM;IACR,CAAC;IACD,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAA;IACnD,4EAA4E;IAC5E,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAM;IACR,CAAC;IACD,+EAA+E;IAC/E,+EAA+E;IAC/E,mEAAmE;IACnE,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAA;IACxB,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAM;IACR,CAAC;IAED,8EAA8E;IAC9E,+EAA+E;IAC/E,yEAAyE;IACzE,iDAAiD;IACjD,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,kBAAkB,CAAC;YAC3B,MAAM,EACJ,gEAAgE;gBAChE,yBAAyB;SAC5B,CAAC,CAAA;IACJ,CAAC;IACD,8CAA8C;IAC9C,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,MAAM,IAAI,kBAAkB,CAAC;YAC3B,MAAM,EAAE,gEAAgE;SACzE,CAAC,CAAA;IACJ,CAAC;IAED,+EAA+E;IAC/E,4EAA4E;IAC5E,2EAA2E;IAC3E,6DAA6D;IAC7D,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAClC,OAAM;IACR,CAAC;IACD,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,MAAM,iBAAiB,CAAC;QAClD,IAAI,EAAE,OAAO,CAAC,OAAO;QACrB,WAAW,EAAE,IAAI,CAAC,MAAM;KACzB,CAAC,CAAA;IACF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,kBAAkB,CAAC;YAC3B,MAAM,EAAE,KAAK;gBACX,CAAC,CAAC,oEAAoE;gBACtE,CAAC,CAAC,sDAAsD;YAC1D,KAAK,EAAE,KAAK;SACb,CAAC,CAAA;IACJ,CAAC;AACH,CAAC"}