xypriss 1.1.3 → 1.1.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +13 -13
- package/dist/cjs/mods/security/src/index.js +35 -12
- package/dist/cjs/mods/security/src/index.js.map +1 -1
- package/dist/cjs/src/plugins/modules/PluginEngine.js +378 -0
- package/dist/cjs/src/plugins/modules/PluginEngine.js.map +1 -0
- package/dist/cjs/src/plugins/modules/PluginRegistry.js +339 -0
- package/dist/cjs/src/plugins/modules/PluginRegistry.js.map +1 -0
- package/dist/cjs/src/plugins/modules/builtin/JWTAuthPlugin.js +591 -0
- package/dist/cjs/src/plugins/modules/builtin/JWTAuthPlugin.js.map +1 -0
- package/dist/cjs/src/plugins/modules/builtin/ResponseTimePlugin.js +413 -0
- package/dist/cjs/src/plugins/modules/builtin/ResponseTimePlugin.js.map +1 -0
- package/dist/cjs/src/plugins/modules/builtin/SmartCachePlugin.js +843 -0
- package/dist/cjs/src/plugins/modules/builtin/SmartCachePlugin.js.map +1 -0
- package/dist/cjs/src/plugins/modules/core/CachePlugin.js +1975 -0
- package/dist/cjs/src/plugins/modules/core/CachePlugin.js.map +1 -0
- package/dist/cjs/src/plugins/modules/core/PerformancePlugin.js +894 -0
- package/dist/cjs/src/plugins/modules/core/PerformancePlugin.js.map +1 -0
- package/dist/cjs/src/plugins/modules/core/SecurityPlugin.js +799 -0
- package/dist/cjs/src/plugins/modules/core/SecurityPlugin.js.map +1 -0
- package/dist/cjs/src/plugins/modules/types/PluginTypes.js +47 -0
- package/dist/cjs/src/plugins/modules/types/PluginTypes.js.map +1 -0
- package/dist/cjs/src/server/FastServer.js +22 -3
- package/dist/cjs/src/server/FastServer.js.map +1 -1
- package/dist/cjs/src/server/components/fastapi/PluginManager.js +5 -5
- package/dist/cjs/src/server/components/fastapi/PluginManager.js.map +1 -1
- package/dist/cjs/src/server/components/fastapi/RequestProcessor.js +1 -1
- package/dist/esm/mods/security/src/index.js +14 -10
- package/dist/esm/mods/security/src/index.js.map +1 -1
- package/dist/esm/src/plugins/modules/PluginEngine.js +376 -0
- package/dist/esm/src/plugins/modules/PluginEngine.js.map +1 -0
- package/dist/esm/src/plugins/modules/PluginRegistry.js +337 -0
- package/dist/esm/src/plugins/modules/PluginRegistry.js.map +1 -0
- package/dist/esm/src/plugins/modules/builtin/JWTAuthPlugin.js +589 -0
- package/dist/esm/src/plugins/modules/builtin/JWTAuthPlugin.js.map +1 -0
- package/dist/esm/src/plugins/modules/builtin/ResponseTimePlugin.js +411 -0
- package/dist/esm/src/plugins/modules/builtin/ResponseTimePlugin.js.map +1 -0
- package/dist/esm/src/plugins/modules/builtin/SmartCachePlugin.js +841 -0
- package/dist/esm/src/plugins/modules/builtin/SmartCachePlugin.js.map +1 -0
- package/dist/esm/src/plugins/modules/core/CachePlugin.js +1973 -0
- package/dist/esm/src/plugins/modules/core/CachePlugin.js.map +1 -0
- package/dist/esm/src/plugins/modules/core/PerformancePlugin.js +872 -0
- package/dist/esm/src/plugins/modules/core/PerformancePlugin.js.map +1 -0
- package/dist/esm/src/plugins/modules/core/SecurityPlugin.js +797 -0
- package/dist/esm/src/plugins/modules/core/SecurityPlugin.js.map +1 -0
- package/dist/esm/src/plugins/modules/types/PluginTypes.js +47 -0
- package/dist/esm/src/plugins/modules/types/PluginTypes.js.map +1 -0
- package/dist/esm/src/server/FastServer.js +22 -3
- package/dist/esm/src/server/FastServer.js.map +1 -1
- package/dist/esm/src/server/components/fastapi/PluginManager.js +5 -5
- package/dist/esm/src/server/components/fastapi/PluginManager.js.map +1 -1
- package/dist/esm/src/server/components/fastapi/RequestProcessor.js +1 -1
- package/dist/index.d.ts +5 -0
- package/package.json +1 -1
|
@@ -0,0 +1,591 @@
|
|
|
1
|
+
'use strict';
|
|
2
|
+
|
|
3
|
+
var SecurityPlugin = require('../core/SecurityPlugin.js');
|
|
4
|
+
var PluginTypes = require('../types/PluginTypes.js');
|
|
5
|
+
|
|
6
|
+
/**
|
|
7
|
+
* JWT Authentication Plugin
|
|
8
|
+
*
|
|
9
|
+
* High-performance JWT authentication plugin leveraging XyPrissJS security utilities
|
|
10
|
+
* with <2ms execution time for token validation and user authentication.
|
|
11
|
+
*/
|
|
12
|
+
/**
|
|
13
|
+
* JWT Authentication Plugin for ultra-fast token validation
|
|
14
|
+
*/
|
|
15
|
+
class JWTAuthPlugin extends SecurityPlugin.SecurityPlugin {
|
|
16
|
+
constructor() {
|
|
17
|
+
super(...arguments);
|
|
18
|
+
this.id = "XyPriss.auth.jwt";
|
|
19
|
+
this.name = "JWT Authentication Plugin";
|
|
20
|
+
this.version = "1.0.0";
|
|
21
|
+
this.priority = PluginTypes.PluginPriority.HIGH; // Authentication is high priority
|
|
22
|
+
this.jwtAlgorithm = "HS256";
|
|
23
|
+
this.tokenExpiry = 3600; // 1 hour
|
|
24
|
+
this.issuer = "XyPrissjs";
|
|
25
|
+
this.audience = "XyPrissjs-app";
|
|
26
|
+
// Performance optimization: Token cache for validated tokens
|
|
27
|
+
this.tokenCache = new Map();
|
|
28
|
+
// Rate limiting for authentication attempts
|
|
29
|
+
this.authAttempts = new Map();
|
|
30
|
+
}
|
|
31
|
+
/**
|
|
32
|
+
* Initialize JWT authentication plugin
|
|
33
|
+
*/
|
|
34
|
+
async initializeSecurityPlugin(context) {
|
|
35
|
+
// Get JWT secret from environment or configuration
|
|
36
|
+
this.jwtSecret =
|
|
37
|
+
process.env.JWT_SECRET || context.config.customSettings.jwtSecret;
|
|
38
|
+
if (!this.jwtSecret) {
|
|
39
|
+
throw new Error("JWT secret is required for JWT authentication plugin");
|
|
40
|
+
}
|
|
41
|
+
// Configure JWT settings from context
|
|
42
|
+
if (context.config.customSettings.jwtAlgorithm) {
|
|
43
|
+
this.jwtAlgorithm = context.config.customSettings.jwtAlgorithm;
|
|
44
|
+
}
|
|
45
|
+
if (context.config.customSettings.tokenExpiry) {
|
|
46
|
+
this.tokenExpiry = context.config.customSettings.tokenExpiry;
|
|
47
|
+
}
|
|
48
|
+
if (context.config.customSettings.issuer) {
|
|
49
|
+
this.issuer = context.config.customSettings.issuer;
|
|
50
|
+
}
|
|
51
|
+
if (context.config.customSettings.audience) {
|
|
52
|
+
this.audience = context.config.customSettings.audience;
|
|
53
|
+
}
|
|
54
|
+
// Setup token cache cleanup
|
|
55
|
+
this.setupTokenCacheCleanup();
|
|
56
|
+
// Setup rate limiting cleanup
|
|
57
|
+
this.setupRateLimitingCleanup();
|
|
58
|
+
context.logger.info(`JWT Authentication Plugin initialized with algorithm: ${this.jwtAlgorithm}`);
|
|
59
|
+
}
|
|
60
|
+
/**
|
|
61
|
+
* Execute JWT authentication logic
|
|
62
|
+
*/
|
|
63
|
+
async executeSecurityLogic(context) {
|
|
64
|
+
const { req } = context;
|
|
65
|
+
// Check if authentication is required for this route
|
|
66
|
+
if (!this.requiresAuthentication(req.path)) {
|
|
67
|
+
return { authenticated: false, required: false };
|
|
68
|
+
}
|
|
69
|
+
// Check rate limiting
|
|
70
|
+
const clientIp = req.ip || req.connection?.remoteAddress || "unknown";
|
|
71
|
+
if (this.isRateLimited(clientIp)) {
|
|
72
|
+
throw new Error("Too many authentication attempts. Please try again later.");
|
|
73
|
+
}
|
|
74
|
+
// Extract JWT token
|
|
75
|
+
const token = this.extractJWTToken(req);
|
|
76
|
+
if (!token) {
|
|
77
|
+
this.recordAuthAttempt(clientIp, false);
|
|
78
|
+
throw new Error("Authentication token is required");
|
|
79
|
+
}
|
|
80
|
+
// Check token cache first for performance
|
|
81
|
+
const cachedAuth = this.getCachedAuthentication(token);
|
|
82
|
+
if (cachedAuth) {
|
|
83
|
+
// Update security context with cached data
|
|
84
|
+
context.security.isAuthenticated = true;
|
|
85
|
+
context.security.userId = cachedAuth.userId;
|
|
86
|
+
context.security.roles = cachedAuth.roles;
|
|
87
|
+
context.security.permissions = cachedAuth.permissions;
|
|
88
|
+
return {
|
|
89
|
+
authenticated: true,
|
|
90
|
+
userId: cachedAuth.userId,
|
|
91
|
+
roles: cachedAuth.roles,
|
|
92
|
+
permissions: cachedAuth.permissions,
|
|
93
|
+
source: "cache",
|
|
94
|
+
};
|
|
95
|
+
}
|
|
96
|
+
// Validate JWT token
|
|
97
|
+
const authResult = await this.validateJWTToken(token);
|
|
98
|
+
if (!authResult.valid) {
|
|
99
|
+
this.recordAuthAttempt(clientIp, false);
|
|
100
|
+
throw new Error(authResult.error || "Invalid authentication token");
|
|
101
|
+
}
|
|
102
|
+
// Cache the authentication result
|
|
103
|
+
this.cacheAuthentication(token, authResult.payload);
|
|
104
|
+
// Update security context
|
|
105
|
+
context.security.isAuthenticated = true;
|
|
106
|
+
context.security.userId = authResult.payload.userId;
|
|
107
|
+
context.security.roles = authResult.payload.roles || [];
|
|
108
|
+
context.security.permissions = authResult.payload.permissions || [];
|
|
109
|
+
// Record successful authentication
|
|
110
|
+
this.recordAuthAttempt(clientIp, true);
|
|
111
|
+
return {
|
|
112
|
+
authenticated: true,
|
|
113
|
+
userId: authResult.payload.userId,
|
|
114
|
+
roles: authResult.payload.roles || [],
|
|
115
|
+
permissions: authResult.payload.permissions || [],
|
|
116
|
+
source: "token",
|
|
117
|
+
};
|
|
118
|
+
}
|
|
119
|
+
/**
|
|
120
|
+
* Perform authentication logic
|
|
121
|
+
*/
|
|
122
|
+
async performAuthentication(authData, context) {
|
|
123
|
+
try {
|
|
124
|
+
const result = await this.executeSecurityLogic(context);
|
|
125
|
+
return result.authenticated;
|
|
126
|
+
}
|
|
127
|
+
catch (error) {
|
|
128
|
+
return false;
|
|
129
|
+
}
|
|
130
|
+
}
|
|
131
|
+
/**
|
|
132
|
+
* Perform authorization logic
|
|
133
|
+
*/
|
|
134
|
+
async performAuthorization(context, resource) {
|
|
135
|
+
if (!context.security.isAuthenticated) {
|
|
136
|
+
return false;
|
|
137
|
+
}
|
|
138
|
+
// Check if user has required permissions for the resource
|
|
139
|
+
return await this.checkResourcePermissions(context, resource);
|
|
140
|
+
}
|
|
141
|
+
// ===== JWT-SPECIFIC METHODS =====
|
|
142
|
+
/**
|
|
143
|
+
* Extract JWT token from request
|
|
144
|
+
*/
|
|
145
|
+
extractJWTToken(req) {
|
|
146
|
+
// Check Authorization header
|
|
147
|
+
const authHeader = req.headers.authorization;
|
|
148
|
+
if (authHeader && authHeader.startsWith("Bearer ")) {
|
|
149
|
+
return authHeader.substring(7);
|
|
150
|
+
}
|
|
151
|
+
// Check cookies
|
|
152
|
+
if (req.cookies && req.cookies.token) {
|
|
153
|
+
return req.cookies.token;
|
|
154
|
+
}
|
|
155
|
+
// Check query parameter (less secure, but sometimes needed)
|
|
156
|
+
if (req.query && req.query.token) {
|
|
157
|
+
return req.query.token;
|
|
158
|
+
}
|
|
159
|
+
return null;
|
|
160
|
+
}
|
|
161
|
+
/**
|
|
162
|
+
* Validate JWT token using XyPrissJS Hash utilities
|
|
163
|
+
*/
|
|
164
|
+
async validateJWTToken(token) {
|
|
165
|
+
try {
|
|
166
|
+
// Split token into parts
|
|
167
|
+
const parts = token.split(".");
|
|
168
|
+
if (parts.length !== 3) {
|
|
169
|
+
return { valid: false, error: "Invalid token format" };
|
|
170
|
+
}
|
|
171
|
+
const [headerB64, payloadB64, signatureB64] = parts;
|
|
172
|
+
// Decode header and payload
|
|
173
|
+
const header = JSON.parse(this.base64UrlDecode(headerB64));
|
|
174
|
+
const payload = JSON.parse(this.base64UrlDecode(payloadB64));
|
|
175
|
+
// Verify algorithm
|
|
176
|
+
if (header.alg !== this.jwtAlgorithm) {
|
|
177
|
+
return { valid: false, error: "Invalid algorithm" };
|
|
178
|
+
}
|
|
179
|
+
// Verify signature using XyPrissJS Hash
|
|
180
|
+
const signatureData = `${headerB64}.${payloadB64}`;
|
|
181
|
+
const expectedSignature = this.hashUtil.create(signatureData + this.jwtSecret, {
|
|
182
|
+
algorithm: "sha256",
|
|
183
|
+
outputFormat: "base64",
|
|
184
|
+
});
|
|
185
|
+
const expectedSignatureB64 = this.base64UrlEncode(expectedSignature);
|
|
186
|
+
if (signatureB64 !== expectedSignatureB64) {
|
|
187
|
+
return { valid: false, error: "Invalid signature" };
|
|
188
|
+
}
|
|
189
|
+
// Verify expiration
|
|
190
|
+
if (payload.exp && Date.now() / 1000 > payload.exp) {
|
|
191
|
+
return { valid: false, error: "Token expired" };
|
|
192
|
+
}
|
|
193
|
+
// Verify issuer
|
|
194
|
+
if (payload.iss && payload.iss !== this.issuer) {
|
|
195
|
+
return { valid: false, error: "Invalid issuer" };
|
|
196
|
+
}
|
|
197
|
+
// Verify audience
|
|
198
|
+
if (payload.aud && payload.aud !== this.audience) {
|
|
199
|
+
return { valid: false, error: "Invalid audience" };
|
|
200
|
+
}
|
|
201
|
+
return { valid: true, payload };
|
|
202
|
+
}
|
|
203
|
+
catch (error) {
|
|
204
|
+
return { valid: false, error: error.message };
|
|
205
|
+
}
|
|
206
|
+
}
|
|
207
|
+
/**
|
|
208
|
+
* Check if route requires authentication
|
|
209
|
+
*/
|
|
210
|
+
requiresAuthentication(path) {
|
|
211
|
+
// Public routes that don't require authentication
|
|
212
|
+
const publicRoutes = [
|
|
213
|
+
"/",
|
|
214
|
+
"/health",
|
|
215
|
+
"/login",
|
|
216
|
+
"/register",
|
|
217
|
+
"/public",
|
|
218
|
+
"/XyPriss/health",
|
|
219
|
+
];
|
|
220
|
+
// Check if path starts with any public route
|
|
221
|
+
return !publicRoutes.some((route) => path.startsWith(route));
|
|
222
|
+
}
|
|
223
|
+
/**
|
|
224
|
+
* Check resource permissions (override from SecurityPlugin)
|
|
225
|
+
*/
|
|
226
|
+
async checkResourcePermissions(context, resource) {
|
|
227
|
+
// Simple permission checking - can be enhanced based on requirements
|
|
228
|
+
const userPermissions = context.security.permissions;
|
|
229
|
+
const requiredPermissions = this.getRequiredPermissions(resource);
|
|
230
|
+
return requiredPermissions.every((permission) => userPermissions.includes(permission) ||
|
|
231
|
+
userPermissions.includes("admin"));
|
|
232
|
+
}
|
|
233
|
+
/**
|
|
234
|
+
* Get required permissions for resource
|
|
235
|
+
*/
|
|
236
|
+
getRequiredPermissions(resource) {
|
|
237
|
+
// Map resources to required permissions
|
|
238
|
+
const permissionMap = {
|
|
239
|
+
"/api/users": ["user.read"],
|
|
240
|
+
"/api/users/create": ["user.write"],
|
|
241
|
+
"/api/users/delete": ["user.delete"],
|
|
242
|
+
"/api/admin": ["admin"],
|
|
243
|
+
"/api/reports": ["report.read"],
|
|
244
|
+
};
|
|
245
|
+
return permissionMap[resource] || ["authenticated"];
|
|
246
|
+
}
|
|
247
|
+
// ===== CACHING METHODS =====
|
|
248
|
+
/**
|
|
249
|
+
* Get cached authentication result
|
|
250
|
+
*/
|
|
251
|
+
getCachedAuthentication(token) {
|
|
252
|
+
const cached = this.tokenCache.get(token);
|
|
253
|
+
if (!cached)
|
|
254
|
+
return null;
|
|
255
|
+
// Check if cached token is expired
|
|
256
|
+
if (Date.now() > cached.expiry) {
|
|
257
|
+
this.tokenCache.delete(token);
|
|
258
|
+
return null;
|
|
259
|
+
}
|
|
260
|
+
return cached;
|
|
261
|
+
}
|
|
262
|
+
/**
|
|
263
|
+
* Cache authentication result
|
|
264
|
+
*/
|
|
265
|
+
cacheAuthentication(token, payload) {
|
|
266
|
+
const expiry = Date.now() + this.tokenExpiry * 1000;
|
|
267
|
+
this.tokenCache.set(token, {
|
|
268
|
+
userId: payload.userId || payload.sub,
|
|
269
|
+
roles: payload.roles || [],
|
|
270
|
+
permissions: payload.permissions || [],
|
|
271
|
+
expiry,
|
|
272
|
+
});
|
|
273
|
+
}
|
|
274
|
+
/**
|
|
275
|
+
* Setup token cache cleanup
|
|
276
|
+
*/
|
|
277
|
+
setupTokenCacheCleanup() {
|
|
278
|
+
// Clean up expired tokens every 5 minutes
|
|
279
|
+
setInterval(() => {
|
|
280
|
+
const now = Date.now();
|
|
281
|
+
for (const [token, cached] of this.tokenCache.entries()) {
|
|
282
|
+
if (now > cached.expiry) {
|
|
283
|
+
this.tokenCache.delete(token);
|
|
284
|
+
}
|
|
285
|
+
}
|
|
286
|
+
}, 300000); // 5 minutes
|
|
287
|
+
}
|
|
288
|
+
// ===== RATE LIMITING METHODS =====
|
|
289
|
+
/**
|
|
290
|
+
* Check if IP is rate limited
|
|
291
|
+
*/
|
|
292
|
+
isRateLimited(ip) {
|
|
293
|
+
const attempt = this.authAttempts.get(ip);
|
|
294
|
+
if (!attempt)
|
|
295
|
+
return false;
|
|
296
|
+
// Reset after 15 minutes
|
|
297
|
+
if (Date.now() - attempt.lastAttempt > 900000) {
|
|
298
|
+
this.authAttempts.delete(ip);
|
|
299
|
+
return false;
|
|
300
|
+
}
|
|
301
|
+
return attempt.blocked;
|
|
302
|
+
}
|
|
303
|
+
/**
|
|
304
|
+
* Record authentication attempt
|
|
305
|
+
*/
|
|
306
|
+
recordAuthAttempt(ip, success) {
|
|
307
|
+
const now = Date.now();
|
|
308
|
+
const attempt = this.authAttempts.get(ip) || {
|
|
309
|
+
count: 0,
|
|
310
|
+
lastAttempt: now,
|
|
311
|
+
blocked: false,
|
|
312
|
+
};
|
|
313
|
+
if (success) {
|
|
314
|
+
// Reset on successful authentication
|
|
315
|
+
this.authAttempts.delete(ip);
|
|
316
|
+
}
|
|
317
|
+
else {
|
|
318
|
+
attempt.count++;
|
|
319
|
+
attempt.lastAttempt = now;
|
|
320
|
+
// Block after 5 failed attempts
|
|
321
|
+
if (attempt.count >= 5) {
|
|
322
|
+
attempt.blocked = true;
|
|
323
|
+
}
|
|
324
|
+
this.authAttempts.set(ip, attempt);
|
|
325
|
+
}
|
|
326
|
+
}
|
|
327
|
+
/**
|
|
328
|
+
* Setup rate limiting cleanup
|
|
329
|
+
*/
|
|
330
|
+
setupRateLimitingCleanup() {
|
|
331
|
+
// Clean up old rate limiting records every 10 minutes
|
|
332
|
+
setInterval(() => {
|
|
333
|
+
const now = Date.now();
|
|
334
|
+
for (const [ip, attempt] of this.authAttempts.entries()) {
|
|
335
|
+
if (now - attempt.lastAttempt > 900000) {
|
|
336
|
+
// 15 minutes
|
|
337
|
+
this.authAttempts.delete(ip);
|
|
338
|
+
}
|
|
339
|
+
}
|
|
340
|
+
}, 600000); // 10 minutes
|
|
341
|
+
}
|
|
342
|
+
// ===== UTILITY METHODS =====
|
|
343
|
+
/**
|
|
344
|
+
* Base64 URL decode
|
|
345
|
+
*/
|
|
346
|
+
base64UrlDecode(str) {
|
|
347
|
+
// Add padding if needed
|
|
348
|
+
str += "=".repeat((4 - (str.length % 4)) % 4);
|
|
349
|
+
// Replace URL-safe characters
|
|
350
|
+
str = str.replace(/-/g, "+").replace(/_/g, "/");
|
|
351
|
+
return Buffer.from(str, "base64").toString("utf8");
|
|
352
|
+
}
|
|
353
|
+
/**
|
|
354
|
+
* Base64 URL encode
|
|
355
|
+
*/
|
|
356
|
+
base64UrlEncode(str) {
|
|
357
|
+
return Buffer.from(str)
|
|
358
|
+
.toString("base64")
|
|
359
|
+
.replace(/\+/g, "-")
|
|
360
|
+
.replace(/\//g, "_")
|
|
361
|
+
.replace(/=/g, "");
|
|
362
|
+
}
|
|
363
|
+
// ===== SECURITY VALIDATION OVERRIDES =====
|
|
364
|
+
/**
|
|
365
|
+
* Validate request body for security threats
|
|
366
|
+
*/
|
|
367
|
+
validateRequestBody(body) {
|
|
368
|
+
if (!body || typeof body !== "object") {
|
|
369
|
+
return true; // No body to validate
|
|
370
|
+
}
|
|
371
|
+
try {
|
|
372
|
+
// Check for suspicious patterns in body
|
|
373
|
+
const bodyString = JSON.stringify(body);
|
|
374
|
+
// Check for SQL injection patterns
|
|
375
|
+
const sqlPatterns = [
|
|
376
|
+
/(\b(SELECT|INSERT|UPDATE|DELETE|DROP|CREATE|ALTER|EXEC|UNION)\b)/i,
|
|
377
|
+
/(--|\/\*|\*\/|;)/,
|
|
378
|
+
/(\b(OR|AND)\s+\d+\s*=\s*\d+)/i,
|
|
379
|
+
];
|
|
380
|
+
for (const pattern of sqlPatterns) {
|
|
381
|
+
if (pattern.test(bodyString)) {
|
|
382
|
+
console.warn(`SQL injection pattern detected in request body: ${this.id}`);
|
|
383
|
+
return false;
|
|
384
|
+
}
|
|
385
|
+
}
|
|
386
|
+
// Check for XSS patterns
|
|
387
|
+
const xssPatterns = [
|
|
388
|
+
/<script[^>]*>.*?<\/script>/gi,
|
|
389
|
+
/javascript:/gi,
|
|
390
|
+
/on\w+\s*=/gi,
|
|
391
|
+
/<iframe[^>]*>.*?<\/iframe>/gi,
|
|
392
|
+
];
|
|
393
|
+
for (const pattern of xssPatterns) {
|
|
394
|
+
if (pattern.test(bodyString)) {
|
|
395
|
+
console.warn(`XSS pattern detected in request body: ${this.id}`);
|
|
396
|
+
return false;
|
|
397
|
+
}
|
|
398
|
+
}
|
|
399
|
+
return true;
|
|
400
|
+
}
|
|
401
|
+
catch (error) {
|
|
402
|
+
console.error(`Error validating request body: ${error}`);
|
|
403
|
+
return false;
|
|
404
|
+
}
|
|
405
|
+
}
|
|
406
|
+
/**
|
|
407
|
+
* Validate query parameters for security threats
|
|
408
|
+
*/
|
|
409
|
+
validateQueryParameters(query) {
|
|
410
|
+
if (!query || typeof query !== "object") {
|
|
411
|
+
return true; // No query params to validate
|
|
412
|
+
}
|
|
413
|
+
try {
|
|
414
|
+
for (const [key, value] of Object.entries(query)) {
|
|
415
|
+
if (typeof value === "string") {
|
|
416
|
+
// Check for path traversal
|
|
417
|
+
if (value.includes("../") || value.includes("..\\")) {
|
|
418
|
+
console.warn(`Path traversal detected in query param ${key}: ${this.id}`);
|
|
419
|
+
return false;
|
|
420
|
+
}
|
|
421
|
+
// Check for command injection
|
|
422
|
+
const cmdPatterns = [
|
|
423
|
+
/[;&|`$()]/,
|
|
424
|
+
/\b(cat|ls|pwd|whoami|id|uname|ps|netstat|ifconfig)\b/i,
|
|
425
|
+
];
|
|
426
|
+
for (const pattern of cmdPatterns) {
|
|
427
|
+
if (pattern.test(value)) {
|
|
428
|
+
console.warn(`Command injection pattern detected in query param ${key}: ${this.id}`);
|
|
429
|
+
return false;
|
|
430
|
+
}
|
|
431
|
+
}
|
|
432
|
+
}
|
|
433
|
+
}
|
|
434
|
+
return true;
|
|
435
|
+
}
|
|
436
|
+
catch (error) {
|
|
437
|
+
console.error(`Error validating query parameters: ${error}`);
|
|
438
|
+
return false;
|
|
439
|
+
}
|
|
440
|
+
}
|
|
441
|
+
/**
|
|
442
|
+
* Validate headers for security threats
|
|
443
|
+
*/
|
|
444
|
+
validateHeaders(headers) {
|
|
445
|
+
if (!headers || typeof headers !== "object") {
|
|
446
|
+
return true; // No headers to validate
|
|
447
|
+
}
|
|
448
|
+
try {
|
|
449
|
+
// Check for suspicious user agents
|
|
450
|
+
const userAgent = headers["user-agent"];
|
|
451
|
+
if (userAgent) {
|
|
452
|
+
const suspiciousPatterns = [
|
|
453
|
+
/sqlmap/i,
|
|
454
|
+
/nikto/i,
|
|
455
|
+
/nessus/i,
|
|
456
|
+
/burp/i,
|
|
457
|
+
/scanner/i,
|
|
458
|
+
];
|
|
459
|
+
for (const pattern of suspiciousPatterns) {
|
|
460
|
+
if (pattern.test(userAgent)) {
|
|
461
|
+
console.warn(`Suspicious user agent detected: ${this.id}`);
|
|
462
|
+
return false;
|
|
463
|
+
}
|
|
464
|
+
}
|
|
465
|
+
}
|
|
466
|
+
// Check for header injection
|
|
467
|
+
for (const [key, value] of Object.entries(headers)) {
|
|
468
|
+
if (typeof value === "string") {
|
|
469
|
+
if (value.includes("\r") || value.includes("\n")) {
|
|
470
|
+
console.warn(`Header injection detected in ${key}: ${this.id}`);
|
|
471
|
+
return false;
|
|
472
|
+
}
|
|
473
|
+
}
|
|
474
|
+
}
|
|
475
|
+
return true;
|
|
476
|
+
}
|
|
477
|
+
catch (error) {
|
|
478
|
+
console.error(`Error validating headers: ${error}`);
|
|
479
|
+
return false;
|
|
480
|
+
}
|
|
481
|
+
}
|
|
482
|
+
/**
|
|
483
|
+
* Apply data sanitization rules
|
|
484
|
+
*/
|
|
485
|
+
applySanitizationRules(data) {
|
|
486
|
+
if (!data || typeof data !== "object") {
|
|
487
|
+
return data;
|
|
488
|
+
}
|
|
489
|
+
try {
|
|
490
|
+
// Use fObject for secure data handling
|
|
491
|
+
const secureData = this.secureObjectUtil(data);
|
|
492
|
+
// Get sanitized data
|
|
493
|
+
const sanitized = secureData.getAll();
|
|
494
|
+
// Additional sanitization for JWT-specific data
|
|
495
|
+
if (sanitized.token) {
|
|
496
|
+
// Remove any non-JWT token patterns
|
|
497
|
+
sanitized.token = sanitized.token.replace(/[^A-Za-z0-9._-]/g, "");
|
|
498
|
+
}
|
|
499
|
+
if (sanitized.userId) {
|
|
500
|
+
// Sanitize user ID to alphanumeric only
|
|
501
|
+
sanitized.userId = sanitized.userId
|
|
502
|
+
.toString()
|
|
503
|
+
.replace(/[^A-Za-z0-9-_]/g, "");
|
|
504
|
+
}
|
|
505
|
+
return sanitized;
|
|
506
|
+
}
|
|
507
|
+
catch (error) {
|
|
508
|
+
console.error(`Error applying sanitization rules: ${error}`);
|
|
509
|
+
return data; // Return original data if sanitization fails
|
|
510
|
+
}
|
|
511
|
+
}
|
|
512
|
+
/**
|
|
513
|
+
* Parse authorization header
|
|
514
|
+
*/
|
|
515
|
+
parseAuthorizationHeader(header) {
|
|
516
|
+
try {
|
|
517
|
+
if (header.startsWith("Bearer ")) {
|
|
518
|
+
const token = header.substring(7);
|
|
519
|
+
return {
|
|
520
|
+
type: "bearer",
|
|
521
|
+
token: token,
|
|
522
|
+
userId: null, // Will be extracted from token
|
|
523
|
+
};
|
|
524
|
+
}
|
|
525
|
+
if (header.startsWith("Basic ")) {
|
|
526
|
+
const credentials = Buffer.from(header.substring(6), "base64").toString("utf8");
|
|
527
|
+
const [username, password] = credentials.split(":");
|
|
528
|
+
return {
|
|
529
|
+
type: "basic",
|
|
530
|
+
username,
|
|
531
|
+
password,
|
|
532
|
+
userId: username,
|
|
533
|
+
};
|
|
534
|
+
}
|
|
535
|
+
return null;
|
|
536
|
+
}
|
|
537
|
+
catch (error) {
|
|
538
|
+
console.error(`Error parsing authorization header: ${error}`);
|
|
539
|
+
return null;
|
|
540
|
+
}
|
|
541
|
+
}
|
|
542
|
+
/**
|
|
543
|
+
* Parse authentication cookies
|
|
544
|
+
*/
|
|
545
|
+
parseAuthenticationCookies(cookies) {
|
|
546
|
+
try {
|
|
547
|
+
if (cookies.token) {
|
|
548
|
+
return {
|
|
549
|
+
type: "cookie",
|
|
550
|
+
token: cookies.token,
|
|
551
|
+
userId: null, // Will be extracted from token
|
|
552
|
+
};
|
|
553
|
+
}
|
|
554
|
+
if (cookies.sessionId) {
|
|
555
|
+
return {
|
|
556
|
+
type: "session",
|
|
557
|
+
sessionId: cookies.sessionId,
|
|
558
|
+
userId: null, // Will be extracted from session
|
|
559
|
+
};
|
|
560
|
+
}
|
|
561
|
+
return null;
|
|
562
|
+
}
|
|
563
|
+
catch (error) {
|
|
564
|
+
console.error(`Error parsing authentication cookies: ${error}`);
|
|
565
|
+
return null;
|
|
566
|
+
}
|
|
567
|
+
}
|
|
568
|
+
/**
|
|
569
|
+
* Parse session data
|
|
570
|
+
*/
|
|
571
|
+
parseSessionData(session) {
|
|
572
|
+
try {
|
|
573
|
+
if (session.userId) {
|
|
574
|
+
return {
|
|
575
|
+
type: "session",
|
|
576
|
+
userId: session.userId,
|
|
577
|
+
roles: session.roles || [],
|
|
578
|
+
permissions: session.permissions || [],
|
|
579
|
+
};
|
|
580
|
+
}
|
|
581
|
+
return null;
|
|
582
|
+
}
|
|
583
|
+
catch (error) {
|
|
584
|
+
console.error(`Error parsing session data: ${error}`);
|
|
585
|
+
return null;
|
|
586
|
+
}
|
|
587
|
+
}
|
|
588
|
+
}
|
|
589
|
+
|
|
590
|
+
exports.JWTAuthPlugin = JWTAuthPlugin;
|
|
591
|
+
//# sourceMappingURL=JWTAuthPlugin.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"JWTAuthPlugin.js","sources":["../../../../../../src/plugins/modules/builtin/JWTAuthPlugin.ts"],"sourcesContent":[null],"names":["SecurityPlugin","PluginPriority"],"mappings":";;;;;AAAA;;;;;AAKG;AASH;;AAEG;AACG,MAAO,aAAc,SAAQA,6BAAc,CAAA;AAAjD,IAAA,WAAA,GAAA;;QACoB,IAAE,CAAA,EAAA,GAAG,kBAAkB,CAAC;QACxB,IAAI,CAAA,IAAA,GAAG,2BAA2B,CAAC;QACnC,IAAO,CAAA,OAAA,GAAG,OAAO,CAAC;AAClB,QAAA,IAAA,CAAA,QAAQ,GAAGC,0BAAc,CAAC,IAAI,CAAC;QAIvC,IAAY,CAAA,YAAA,GAAG,OAAO,CAAC;AACvB,QAAA,IAAA,CAAA,WAAW,GAAG,IAAI,CAAC;QACnB,IAAM,CAAA,MAAA,GAAG,WAAW,CAAC;QACrB,IAAQ,CAAA,QAAA,GAAG,eAAe,CAAC;;AAG3B,QAAA,IAAA,CAAA,UAAU,GAQd,IAAI,GAAG,EAAE,CAAC;;AAGN,QAAA,IAAA,CAAA,YAAY,GAOhB,IAAI,GAAG,EAAE,CAAC;KAirBjB;AA/qBG;;AAEG;IACO,MAAM,wBAAwB,CACpC,OAAoC,EAAA;;AAGpC,QAAA,IAAI,CAAC,SAAS;AACV,YAAA,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC;AAEtE,QAAA,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;AACjB,YAAA,MAAM,IAAI,KAAK,CACX,sDAAsD,CACzD,CAAC;SACL;;QAGD,IAAI,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,YAAY,EAAE;YAC5C,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,YAAY,CAAC;SAClE;QAED,IAAI,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE;YAC3C,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,WAAW,CAAC;SAChE;QAED,IAAI,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE;YACtC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC;SACtD;QAED,IAAI,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE;YACxC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC;SAC1D;;QAGD,IAAI,CAAC,sBAAsB,EAAE,CAAC;;QAG9B,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAEhC,OAAO,CAAC,MAAM,CAAC,IAAI,CACf,CAAyD,sDAAA,EAAA,IAAI,CAAC,YAAY,CAAE,CAAA,CAC/E,CAAC;KACL;AAED;;AAEG;IACO,MAAM,oBAAoB,CAChC,OAA+B,EAAA;AAE/B,QAAA,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;;QAGxB,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;YACxC,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;SACpD;;AAGD,QAAA,MAAM,QAAQ,GAAG,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,UAAU,EAAE,aAAa,IAAI,SAAS,CAAC;AACtE,QAAA,IAAI,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE;AAC9B,YAAA,MAAM,IAAI,KAAK,CACX,2DAA2D,CAC9D,CAAC;SACL;;QAGD,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,EAAE;AACR,YAAA,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;AACxC,YAAA,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;SACvD;;QAGD,MAAM,UAAU,GAAG,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;QACvD,IAAI,UAAU,EAAE;;AAEZ,YAAA,OAAO,CAAC,QAAQ,CAAC,eAAe,GAAG,IAAI,CAAC;YACxC,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;YAC5C,OAAO,CAAC,QAAQ,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;YAC1C,OAAO,CAAC,QAAQ,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;YAEtD,OAAO;AACH,gBAAA,aAAa,EAAE,IAAI;gBACnB,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,WAAW,EAAE,UAAU,CAAC,WAAW;AACnC,gBAAA,MAAM,EAAE,OAAO;aAClB,CAAC;SACL;;QAGD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;AACtD,QAAA,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE;AACnB,YAAA,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,IAAI,8BAA8B,CAAC,CAAC;SACvE;;QAGD,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;;AAGpD,QAAA,OAAO,CAAC,QAAQ,CAAC,eAAe,GAAG,IAAI,CAAC;QACxC,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC;AACpD,QAAA,OAAO,CAAC,QAAQ,CAAC,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;AACxD,QAAA,OAAO,CAAC,QAAQ,CAAC,WAAW,GAAG,UAAU,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC;;AAGpE,QAAA,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAEvC,OAAO;AACH,YAAA,aAAa,EAAE,IAAI;AACnB,YAAA,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,MAAM;AACjC,YAAA,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;AACrC,YAAA,WAAW,EAAE,UAAU,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE;AACjD,YAAA,MAAM,EAAE,OAAO;SAClB,CAAC;KACL;AAED;;AAEG;AACO,IAAA,MAAM,qBAAqB,CACjC,QAAa,EACb,OAA+B,EAAA;AAE/B,QAAA,IAAI;YACA,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;YACxD,OAAO,MAAM,CAAC,aAAa,CAAC;SAC/B;QAAC,OAAO,KAAK,EAAE;AACZ,YAAA,OAAO,KAAK,CAAC;SAChB;KACJ;AAED;;AAEG;AACO,IAAA,MAAM,oBAAoB,CAChC,OAA+B,EAC/B,QAAgB,EAAA;AAEhB,QAAA,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,EAAE;AACnC,YAAA,OAAO,KAAK,CAAC;SAChB;;QAGD,OAAO,MAAM,IAAI,CAAC,wBAAwB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;KACjE;;AAID;;AAEG;AACK,IAAA,eAAe,CAAC,GAAQ,EAAA;;AAE5B,QAAA,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QAC7C,IAAI,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE;AAChD,YAAA,OAAO,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;SAClC;;QAGD,IAAI,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE;AAClC,YAAA,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC;SAC5B;;QAGD,IAAI,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE;AAC9B,YAAA,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;SAC1B;AAED,QAAA,OAAO,IAAI,CAAC;KACf;AAED;;AAEG;IACK,MAAM,gBAAgB,CAAC,KAAa,EAAA;AAKxC,QAAA,IAAI;;YAEA,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAC/B,YAAA,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE;gBACpB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;aAC1D;YAED,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,GAAG,KAAK,CAAC;;AAGpD,YAAA,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;AAC3D,YAAA,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC;;YAG7D,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC,YAAY,EAAE;gBAClC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;aACvD;;AAGD,YAAA,MAAM,aAAa,GAAG,CAAA,EAAG,SAAS,CAAI,CAAA,EAAA,UAAU,EAAE,CAAC;AACnD,YAAA,MAAM,iBAAiB,GAAG,IAAI,CAAC,QAAS,CAAC,MAAM,CAC3C,aAAa,GAAG,IAAI,CAAC,SAAS,EAC9B;AACI,gBAAA,SAAS,EAAE,QAAQ;AACnB,gBAAA,YAAY,EAAE,QAAQ;AACzB,aAAA,CACM,CAAC;YAEZ,MAAM,oBAAoB,GACtB,IAAI,CAAC,eAAe,CAAC,iBAAiB,CAAC,CAAC;AAC5C,YAAA,IAAI,YAAY,KAAK,oBAAoB,EAAE;gBACvC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;aACvD;;AAGD,YAAA,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE;gBAChD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;aACnD;;AAGD,YAAA,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,MAAM,EAAE;gBAC5C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;aACpD;;AAGD,YAAA,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,QAAQ,EAAE;gBAC9C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;aACtD;AAED,YAAA,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;SACnC;QAAC,OAAO,KAAU,EAAE;YACjB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;SACjD;KACJ;AAED;;AAEG;AACK,IAAA,sBAAsB,CAAC,IAAY,EAAA;;AAEvC,QAAA,MAAM,YAAY,GAAG;YACjB,GAAG;YACH,SAAS;YACT,QAAQ;YACR,WAAW;YACX,SAAS;YACT,iBAAiB;SACpB,CAAC;;AAGF,QAAA,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;KAChE;AAED;;AAEG;AACO,IAAA,MAAM,wBAAwB,CACpC,OAA+B,EAC/B,QAAgB,EAAA;;AAGhB,QAAA,MAAM,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;QACrD,MAAM,mBAAmB,GAAG,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC;AAElE,QAAA,OAAO,mBAAmB,CAAC,KAAK,CAC5B,CAAC,UAAU,KACP,eAAe,CAAC,QAAQ,CAAC,UAAU,CAAC;AACpC,YAAA,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,CACxC,CAAC;KACL;AAED;;AAEG;AACK,IAAA,sBAAsB,CAAC,QAAgB,EAAA;;AAE3C,QAAA,MAAM,aAAa,GAA6B;YAC5C,YAAY,EAAE,CAAC,WAAW,CAAC;YAC3B,mBAAmB,EAAE,CAAC,YAAY,CAAC;YACnC,mBAAmB,EAAE,CAAC,aAAa,CAAC;YACpC,YAAY,EAAE,CAAC,OAAO,CAAC;YACvB,cAAc,EAAE,CAAC,aAAa,CAAC;SAClC,CAAC;QAEF,OAAO,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;KACvD;;AAID;;AAEG;AACK,IAAA,uBAAuB,CAAC,KAAa,EAAA;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAC1C,QAAA,IAAI,CAAC,MAAM;AAAE,YAAA,OAAO,IAAI,CAAC;;QAGzB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE;AAC5B,YAAA,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9B,YAAA,OAAO,IAAI,CAAC;SACf;AAED,QAAA,OAAO,MAAM,CAAC;KACjB;AAED;;AAEG;IACK,mBAAmB,CAAC,KAAa,EAAE,OAAY,EAAA;AACnD,QAAA,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;AAEpD,QAAA,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE;AACvB,YAAA,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG;AACrC,YAAA,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE;AAC1B,YAAA,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,EAAE;YACtC,MAAM;AACT,SAAA,CAAC,CAAC;KACN;AAED;;AAEG;IACK,sBAAsB,GAAA;;QAE1B,WAAW,CAAC,MAAK;AACb,YAAA,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AACvB,YAAA,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE;AACrD,gBAAA,IAAI,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE;AACrB,oBAAA,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;iBACjC;aACJ;AACL,SAAC,EAAE,MAAM,CAAC,CAAC;KACd;;AAID;;AAEG;AACK,IAAA,aAAa,CAAC,EAAU,EAAA;QAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAC1C,QAAA,IAAI,CAAC,OAAO;AAAE,YAAA,OAAO,KAAK,CAAC;;QAG3B,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,WAAW,GAAG,MAAM,EAAE;AAC3C,YAAA,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAC7B,YAAA,OAAO,KAAK,CAAC;SAChB;QAED,OAAO,OAAO,CAAC,OAAO,CAAC;KAC1B;AAED;;AAEG;IACK,iBAAiB,CAAC,EAAU,EAAE,OAAgB,EAAA;AAClD,QAAA,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI;AACzC,YAAA,KAAK,EAAE,CAAC;AACR,YAAA,WAAW,EAAE,GAAG;AAChB,YAAA,OAAO,EAAE,KAAK;SACjB,CAAC;QAEF,IAAI,OAAO,EAAE;;AAET,YAAA,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;SAChC;aAAM;YACH,OAAO,CAAC,KAAK,EAAE,CAAC;AAChB,YAAA,OAAO,CAAC,WAAW,GAAG,GAAG,CAAC;;AAG1B,YAAA,IAAI,OAAO,CAAC,KAAK,IAAI,CAAC,EAAE;AACpB,gBAAA,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;aAC1B;YAED,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;SACtC;KACJ;AAED;;AAEG;IACK,wBAAwB,GAAA;;QAE5B,WAAW,CAAC,MAAK;AACb,YAAA,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AACvB,YAAA,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE;gBACrD,IAAI,GAAG,GAAG,OAAO,CAAC,WAAW,GAAG,MAAM,EAAE;;AAEpC,oBAAA,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;iBAChC;aACJ;AACL,SAAC,EAAE,MAAM,CAAC,CAAC;KACd;;AAID;;AAEG;AACK,IAAA,eAAe,CAAC,GAAW,EAAA;;AAE/B,QAAA,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;;AAE9C,QAAA,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAChD,QAAA,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;KACtD;AAED;;AAEG;AACK,IAAA,eAAe,CAAC,GAAW,EAAA;AAC/B,QAAA,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;aAClB,QAAQ,CAAC,QAAQ,CAAC;AAClB,aAAA,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;AACnB,aAAA,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;AACnB,aAAA,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;KAC1B;;AAID;;AAEG;AACO,IAAA,mBAAmB,CAAC,IAAS,EAAA;QACnC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE;YACnC,OAAO,IAAI,CAAC;SACf;AAED,QAAA,IAAI;;YAEA,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;;AAGxC,YAAA,MAAM,WAAW,GAAG;gBAChB,mEAAmE;gBACnE,kBAAkB;gBAClB,+BAA+B;aAClC,CAAC;AAEF,YAAA,KAAK,MAAM,OAAO,IAAI,WAAW,EAAE;AAC/B,gBAAA,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE;oBAC1B,OAAO,CAAC,IAAI,CACR,CAAA,gDAAA,EAAmD,IAAI,CAAC,EAAE,CAAE,CAAA,CAC/D,CAAC;AACF,oBAAA,OAAO,KAAK,CAAC;iBAChB;aACJ;;AAGD,YAAA,MAAM,WAAW,GAAG;gBAChB,8BAA8B;gBAC9B,eAAe;gBACf,aAAa;gBACb,8BAA8B;aACjC,CAAC;AAEF,YAAA,KAAK,MAAM,OAAO,IAAI,WAAW,EAAE;AAC/B,gBAAA,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE;oBAC1B,OAAO,CAAC,IAAI,CACR,CAAA,sCAAA,EAAyC,IAAI,CAAC,EAAE,CAAE,CAAA,CACrD,CAAC;AACF,oBAAA,OAAO,KAAK,CAAC;iBAChB;aACJ;AAED,YAAA,OAAO,IAAI,CAAC;SACf;QAAC,OAAO,KAAK,EAAE;AACZ,YAAA,OAAO,CAAC,KAAK,CAAC,kCAAkC,KAAK,CAAA,CAAE,CAAC,CAAC;AACzD,YAAA,OAAO,KAAK,CAAC;SAChB;KACJ;AAED;;AAEG;AACO,IAAA,uBAAuB,CAAC,KAAU,EAAA;QACxC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE;YACrC,OAAO,IAAI,CAAC;SACf;AAED,QAAA,IAAI;AACA,YAAA,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;AAC9C,gBAAA,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE;;AAE3B,oBAAA,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE;wBACjD,OAAO,CAAC,IAAI,CACR,CAA0C,uCAAA,EAAA,GAAG,CAAK,EAAA,EAAA,IAAI,CAAC,EAAE,CAAE,CAAA,CAC9D,CAAC;AACF,wBAAA,OAAO,KAAK,CAAC;qBAChB;;AAGD,oBAAA,MAAM,WAAW,GAAG;wBAChB,WAAW;wBACX,uDAAuD;qBAC1D,CAAC;AAEF,oBAAA,KAAK,MAAM,OAAO,IAAI,WAAW,EAAE;AAC/B,wBAAA,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;4BACrB,OAAO,CAAC,IAAI,CACR,CAAqD,kDAAA,EAAA,GAAG,CAAK,EAAA,EAAA,IAAI,CAAC,EAAE,CAAE,CAAA,CACzE,CAAC;AACF,4BAAA,OAAO,KAAK,CAAC;yBAChB;qBACJ;iBACJ;aACJ;AAED,YAAA,OAAO,IAAI,CAAC;SACf;QAAC,OAAO,KAAK,EAAE;AACZ,YAAA,OAAO,CAAC,KAAK,CAAC,sCAAsC,KAAK,CAAA,CAAE,CAAC,CAAC;AAC7D,YAAA,OAAO,KAAK,CAAC;SAChB;KACJ;AAED;;AAEG;AACO,IAAA,eAAe,CAAC,OAAY,EAAA;QAClC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE;YACzC,OAAO,IAAI,CAAC;SACf;AAED,QAAA,IAAI;;AAEA,YAAA,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;YACxC,IAAI,SAAS,EAAE;AACX,gBAAA,MAAM,kBAAkB,GAAG;oBACvB,SAAS;oBACT,QAAQ;oBACR,SAAS;oBACT,OAAO;oBACP,UAAU;iBACb,CAAC;AAEF,gBAAA,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE;AACtC,oBAAA,IAAI,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE;wBACzB,OAAO,CAAC,IAAI,CACR,CAAA,gCAAA,EAAmC,IAAI,CAAC,EAAE,CAAE,CAAA,CAC/C,CAAC;AACF,wBAAA,OAAO,KAAK,CAAC;qBAChB;iBACJ;aACJ;;AAGD,YAAA,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;AAChD,gBAAA,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE;AAC3B,oBAAA,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;wBAC9C,OAAO,CAAC,IAAI,CACR,CAAgC,6BAAA,EAAA,GAAG,CAAK,EAAA,EAAA,IAAI,CAAC,EAAE,CAAE,CAAA,CACpD,CAAC;AACF,wBAAA,OAAO,KAAK,CAAC;qBAChB;iBACJ;aACJ;AAED,YAAA,OAAO,IAAI,CAAC;SACf;QAAC,OAAO,KAAK,EAAE;AACZ,YAAA,OAAO,CAAC,KAAK,CAAC,6BAA6B,KAAK,CAAA,CAAE,CAAC,CAAC;AACpD,YAAA,OAAO,KAAK,CAAC;SAChB;KACJ;AAED;;AAEG;AACO,IAAA,sBAAsB,CAAC,IAAS,EAAA;QACtC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE;AACnC,YAAA,OAAO,IAAI,CAAC;SACf;AAED,QAAA,IAAI;;YAEA,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAiB,CAAC,IAAI,CAAC,CAAC;;AAGhD,YAAA,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;;AAGtC,YAAA,IAAI,SAAS,CAAC,KAAK,EAAE;;AAEjB,gBAAA,SAAS,CAAC,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CACrC,kBAAkB,EAClB,EAAE,CACL,CAAC;aACL;AAED,YAAA,IAAI,SAAS,CAAC,MAAM,EAAE;;AAElB,gBAAA,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM;AAC9B,qBAAA,QAAQ,EAAE;AACV,qBAAA,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;aACvC;AAED,YAAA,OAAO,SAAS,CAAC;SACpB;QAAC,OAAO,KAAK,EAAE;AACZ,YAAA,OAAO,CAAC,KAAK,CAAC,sCAAsC,KAAK,CAAA,CAAE,CAAC,CAAC;YAC7D,OAAO,IAAI,CAAC;SACf;KACJ;AAED;;AAEG;AACO,IAAA,wBAAwB,CAAC,MAAc,EAAA;AAC7C,QAAA,IAAI;AACA,YAAA,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE;gBAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;gBAClC,OAAO;AACH,oBAAA,IAAI,EAAE,QAAQ;AACd,oBAAA,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,IAAI;iBACf,CAAC;aACL;AAED,YAAA,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE;gBAC7B,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAC3B,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EACnB,QAAQ,CACX,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACnB,gBAAA,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACpD,OAAO;AACH,oBAAA,IAAI,EAAE,OAAO;oBACb,QAAQ;oBACR,QAAQ;AACR,oBAAA,MAAM,EAAE,QAAQ;iBACnB,CAAC;aACL;AAED,YAAA,OAAO,IAAI,CAAC;SACf;QAAC,OAAO,KAAK,EAAE;AACZ,YAAA,OAAO,CAAC,KAAK,CAAC,uCAAuC,KAAK,CAAA,CAAE,CAAC,CAAC;AAC9D,YAAA,OAAO,IAAI,CAAC;SACf;KACJ;AAED;;AAEG;AACO,IAAA,0BAA0B,CAAC,OAAY,EAAA;AAC7C,QAAA,IAAI;AACA,YAAA,IAAI,OAAO,CAAC,KAAK,EAAE;gBACf,OAAO;AACH,oBAAA,IAAI,EAAE,QAAQ;oBACd,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,MAAM,EAAE,IAAI;iBACf,CAAC;aACL;AAED,YAAA,IAAI,OAAO,CAAC,SAAS,EAAE;gBACnB,OAAO;AACH,oBAAA,IAAI,EAAE,SAAS;oBACf,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,MAAM,EAAE,IAAI;iBACf,CAAC;aACL;AAED,YAAA,OAAO,IAAI,CAAC;SACf;QAAC,OAAO,KAAK,EAAE;AACZ,YAAA,OAAO,CAAC,KAAK,CAAC,yCAAyC,KAAK,CAAA,CAAE,CAAC,CAAC;AAChE,YAAA,OAAO,IAAI,CAAC;SACf;KACJ;AAED;;AAEG;AACO,IAAA,gBAAgB,CAAC,OAAY,EAAA;AACnC,QAAA,IAAI;AACA,YAAA,IAAI,OAAO,CAAC,MAAM,EAAE;gBAChB,OAAO;AACH,oBAAA,IAAI,EAAE,SAAS;oBACf,MAAM,EAAE,OAAO,CAAC,MAAM;AACtB,oBAAA,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE;AAC1B,oBAAA,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,EAAE;iBACzC,CAAC;aACL;AAED,YAAA,OAAO,IAAI,CAAC;SACf;QAAC,OAAO,KAAK,EAAE;AACZ,YAAA,OAAO,CAAC,KAAK,CAAC,+BAA+B,KAAK,CAAA,CAAE,CAAC,CAAC;AACtD,YAAA,OAAO,IAAI,CAAC;SACf;KACJ;AACJ;;;;"}
|