From dcf634d805a928e073b09b9df3b4d4547fcc9fbd Mon Sep 17 00:00:00 2001 From: panxiao81 Date: Fri, 25 Sep 2026 19:44:39 +0000 Subject: [PATCH 1/9] =?UTF-8?q?=E8=AF=95=E9=AA=8C=20React=20=E5=86=85?= =?UTF-8?q?=E8=81=94=E4=B8=8A=E4=B8=8B=E6=96=87=E4=B8=8E=E5=8E=9F=E7=94=9F?= =?UTF-8?q?=E8=A1=A8=E5=8D=95=E7=99=BB=E5=BD=95=E6=B5=81=E7=A8=8B?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .gitignore | 6 + README.md | 10 +- build.gradle | 12 + docs/bootstrap.md | 3 + docs/browser-preview.md | 79 + docs/images/browser-preview.png | Bin 0 -> 38248 bytes frontend/index.html | 17 + frontend/package-lock.json | 1280 +++++++++++++++++ frontend/package.json | 22 + frontend/playwright.config.ts | 8 + frontend/src/main.tsx | 159 ++ frontend/src/style.css | 240 ++++ frontend/src/vite-env.d.ts | 1 + frontend/tests/preview.spec.ts | 95 ++ frontend/tsconfig.json | 13 + frontend/vite.config.ts | 6 + scripts/frontend-in-docker | 16 + scripts/gradle-in-docker | 2 + scripts/native-smoke.py | 1 + .../login/preview/PreviewConfiguration.java | 44 + .../iam/login/preview/PreviewController.java | 146 ++ .../reachability-metadata.json | 0 .../iam/login/IamLoginApplicationTests.java | 115 +- 23 files changed, 2253 insertions(+), 22 deletions(-) create mode 100644 docs/browser-preview.md create mode 100644 docs/images/browser-preview.png create mode 100644 frontend/index.html create mode 100644 frontend/package-lock.json create mode 100644 frontend/package.json create mode 100644 frontend/playwright.config.ts create mode 100644 frontend/src/main.tsx create mode 100644 frontend/src/style.css create mode 100644 frontend/src/vite-env.d.ts create mode 100644 frontend/tests/preview.spec.ts create mode 100644 frontend/tsconfig.json create mode 100644 frontend/vite.config.ts create mode 100755 scripts/frontend-in-docker create mode 100644 src/main/java/top/ddupan/iam/login/preview/PreviewConfiguration.java create mode 100644 src/main/java/top/ddupan/iam/login/preview/PreviewController.java rename src/main/resources/META-INF/native-image/top.ddupan.iam/{iam-login => iam-login-manual}/reachability-metadata.json (100%) diff --git a/.gitignore b/.gitignore index 5539fbd..5916b60 100644 --- a/.gitignore +++ b/.gitignore @@ -42,3 +42,9 @@ out/ *.log __pycache__/ + +frontend/node_modules/ +frontend/dist/ +frontend/test-results/ +frontend/playwright-report/ +.playwright-cli/ diff --git a/README.md b/README.md index ea94c8f..6c61f1d 100644 --- a/README.md +++ b/README.md @@ -46,12 +46,14 @@ Native 构建与原生二进制上的认证测试是交付要求；JVM 测试通 [项目初始化](docs/bootstrap.md)。使用 JDK 25 执行： ```sh +npm --prefix frontend ci +npm --prefix frontend run build ./gradlew test testAot ./gradlew bootRun ``` 测试需要可用的 Docker，生成器配置了 Grafana LGTM Testcontainer。 -当前只有默认应用和上下文测试，默认 Spring Security 登录页不是可用的 IAM 登录流程。 +当前有隔离的浏览器交互原型与上下文测试，默认 Spring Security 登录页不是可用的 IAM 登录流程。 使用 GraalVM 25 验证原生测试与编译： ```sh @@ -64,3 +66,9 @@ Docker 开发使用 `scripts/gradle-in-docker`，默认持久挂载 Gradle 缓 JVM、AOT、Native 测试及原生应用 HTTP 检查已通过，实测范围与资源数据见 [本地验证结果](docs/bootstrap.md#2026-09-25-本地验证结果)。 AD、MFA 与 Hydra 认证链路仍待实现与验收。 + +## 浏览器流程预览 + +人类登录界面采用 React + Vite，参考 Keycloakify 的内联上下文与原生表单提交方式。 +原型默认关闭，仅测试页面切换与局部交互，不执行真实认证。启动、浏览器测试和边界见 +[浏览器流程原型](docs/browser-preview.md)。 diff --git a/build.gradle b/build.gradle index 5680496..2eace16 100644 --- a/build.gradle +++ b/build.gradle @@ -71,3 +71,15 @@ graalvmNative { } } } + +// Vite owns the HTML and hashed assets; only the controller can serve the page shell. +// Build it with `npm ci && npm run build` in frontend/ before invoking Gradle. +tasks.named('processResources') { + inputs.files(fileTree('frontend/dist')) + doFirst { + if (!file('frontend/dist/index.html').exists()) { + throw new GradleException('Missing UI build: run npm ci && npm run build in frontend/') + } + } + from('frontend/dist') { into 'ui' } +} diff --git a/docs/bootstrap.md b/docs/bootstrap.md index ad12073..fdc51b9 100644 --- a/docs/bootstrap.md +++ b/docs/bootstrap.md @@ -126,3 +126,6 @@ Prometheus 注册器中的 CPU 时间计数器并断言数值有效，避免后 这是一次本地 smoke 测量，启动耗时含检查器轮询，RSS 不是峰值或负载预算，ELF 大小不等于 运行镜像大小。未验证 AD、MFA、Hydra、目录就绪或 OTLP 后端数据查询，也尚未接入 CI。 运行报告生成在 `build/reports/native-smoke/result.json`，不提交运行日志或构建产物。 + +手写 Native 补丁位于 `META-INF/native-image/top.ddupan.iam/iam-login-manual/`， +与 Spring AOT 生成的 `iam-login/` 目录分开，避免 `bootJar` 中同名元数据冲突。 diff --git a/docs/browser-preview.md b/docs/browser-preview.md new file mode 100644 index 0000000..8c8468a --- /dev/null +++ b/docs/browser-preview.md @@ -0,0 +1,79 @@ +# 浏览器登录流程原型 + +参考 Keycloakify：Spring 返回 HTML 时内联当前页面上下文，React 用 `createRoot` 渲染， +表单原生 POST 到 Spring，后端按 session 中的步骤校验并返回 303 重定向。 +每次导航重新挂载 React，带 hash 的 JS/CSS 可长期缓存。局部帮助展开不发请求。 + +这是浏览器交互实验，不是身份验证实现：没有 AD 查询、真实密码、TOTP、WebAuthn 或 +Hydra accept；不会创建 Spring Security 登录身份。演示码 **123456** 仅用于切换页面， +不得作为 MFA 实现复用。默认关闭，显式设置 `iam.ui-preview.enabled=true` 才开放 `/preview`。 +所有其他受保护入口仍需认证，Prometheus 权限保持不变。 + +![浏览器交互原型首页](images/browser-preview.png) + +## 本地体验 + +有 Node 24 和 JDK 25 时： + +```sh +cd frontend +npm ci +npm run build +cd .. +./gradlew bootRun --args='--server.address=127.0.0.1 --server.port=18081 --iam.ui-preview.enabled=true' +``` + +访问 。填写称呼，尝试错误演示码，再用 123456 完成。 +后退链接、刷新、重新体验都走服务端流程。启用 DevTools 的 Network 面板观察 document +POST、303、GET；不要勾选 Disable cache，否则无法观察正常的静态资源缓存。 + +Docker 开发： + +```sh +IAM_DOCKER_USE_SUDO=1 scripts/gradle-in-docker bootRun \ + --args='--server.address=127.0.0.1 --server.port=18081 --iam.ui-preview.enabled=true' +``` + +`gradle-in-docker` 先用固定 Node 镜像构建前端，再运行 GraalVM 容器。 +Gradle 缓存默认 `$HOME/.cache/iam-login/gradle`，npm 缓存默认 `$HOME/.cache/iam-login/npm`； +可用 `IAM_GRADLE_CACHE` / `IAM_NPM_CACHE` 指定持久目录。Node 仅参与构建，部署无 Node 服务。 +直接调用 Gradle 时先构建前端；缺少 `frontend/dist/index.html` 会明确失败。 +前端 watch 可用 `npm run watch`，修改后仍需让后端重新复制资源并重启；本轮不实现 HMR 桥接。 + +## 验证 + +```sh +IAM_DOCKER_USE_SUDO=1 scripts/gradle-in-docker test testAot nativeTest nativeCompile +python3 scripts/native-smoke.py +build/native/nativeCompile/iam-login --server.address=127.0.0.1 --server.port=18081 \ + --iam.ui-preview.enabled=true +# 另一个终端，应用保持运行 +cd frontend +npm ci +npx playwright install chromium +npm run test:browser +``` + +浏览器测试覆盖原生页面导航、错误重试、局部交互零请求、无 fetch/XHR、静态 JS 缓存、 +移动端布局、脚本结束标记转义，以及完成预览仍不能访问受保护应用。 +额外计时使用 Chromium 模拟 60ms 网络延迟、1.5Mbps 下载和四倍 CPU slowdown， +用于比较首屏和缓存后的页面切换，不代表真实 LAN、Tailscale 或手机性能。 + +## 实现边界 + +- 页面壳在 `frontend/index.html`，Vite 构建后作为私有 classpath 资源 `ui/index.html` 打包， + 不提供静态 index 入口；控制器仅替换一个固定 JSON 数据位置。 +- Java 使用 JSON 序列化后转义 `<`、`>`、`&` 和 Unicode 行分隔符，避免 `` 逃逸； + React 按文本输出动态内容，不通过 HTML 字符串插入用户名。 +- session 持有演示步骤。表单带 Spring Security CSRF token，缺失被拒绝； + 非当前步骤的提交拒绝，未知/过期 session 的后续页面回到初始步骤。 +- 页面与重定向 `no-store`，静态 hash 资源 public/immutable。CSP 不允许内联可执行脚本。 +- 单 session 仅有一个演示流程，多标签页会共享步骤。正式认证需要独立事务、过期策略、 + 主体与因素绑定；本原型不提供这些保证。 +- 当前采取整页切换，不提前实现 fetch 优化。后续根据测量选择需要局部更新的步骤。 +- 首屏依赖 JavaScript，没有 React SSR、Flight、客户端路由、FreeMarker 或模板引擎。 + 关闭 JavaScript 时显示明确提示，不宣称无 JS 可用。 + +来源：[Keycloakify 入口](https://github.com/keycloakify/keycloakify-starter/blob/main/src/main.tsx)、 +[登录表单](https://github.com/keycloakify/keycloakify/blob/main/src/login/pages/Login.tsx)、 +[Vite 构建](https://vite.dev/guide/build)。 diff --git a/docs/images/browser-preview.png b/docs/images/browser-preview.png new file mode 100644 index 0000000000000000000000000000000000000000..29f6957d378d7ff241d95ce513449c65b1b7a55d GIT binary patch literal 38248 zcmeFYRa9JE(=OVC1d7`nVqVsB_}uy2|Fm8=6R0h26G#`7rkEt2RYN`E4?u)?tn;O#XYmjVBogYO66#lsI(&;HL8{~LRe`w}o(@XZNr zdO+5K$H`Y5Dt>X=0yKOujW2Ah?GHQp-}XF20=pgGl9@#;DJjmRI6;Zgg`I`uIlq+y zrISfgU_R#FDpAb#D@U5Q=kBf=?~VueC>)E4*^Yf9A)$<6Wb!<5T7V?M1Jzj|V0C$} zL{eHYmsYz40#+s_j1o=F56-2ZJOVh=_d-|bnbvPTpOehYK+JJlo_J~ss^el5Umpy3 zksDTGN4hh9ut5*%L=lmY{s0t8~3VZBVx7~rV13iur$F{ zi-&`j7YTI=<&uP`;?OA4+QYe&Y|52-a3d8`y4kbhuFIpyQ*)E#?2rkw!Gf3#9ttbq zPb@M4>+}FPX~}e=BIY|{bKL5nsPt?74bHP=?uG}Zk0{H<8*ipk&(7JLXvXvM zn|Va({hh)EnJo{l*QNl+BRFJ3zGxUN_n@fXqh@zJYrXU=Pi785S;r4lX${uO4JnL4 z#ww4Kl?v^EOO;w@3C8=+8ZgVIpnLQoVCyrrfGJAR{5ERmNXJ9d#b#?uE2oVj=?iO( zzafbr>&B|B{8SacWyTk;G(q$3>!W2dg-&VQ8UO3aQu<&?q1Q;HoAB9{WwCDz@Ft2# z6v!FrHO=%{jNhxvIFMNx>Co2^M@!&N!mnVXR$p*#?>$Ffjjw5j{z3NjCVMbpdpymJ)hn5oA5 zY@o_13ted};XbouJryI5s@u7zNe;X}JpE z820rd3on;)(PLOL&~AD)OZRQ#I@b1LA-Rno-&$B4jA}NuNI9i%){ICYpvFBvXyiaP zz7%9R6_mac;XIZ!-4|&QN9lRd)!h4SMl3aiNJoDEM>3}hHC0^CDe6*N3B6}vq1=}3 zrqQt!y_;u6JUzrBgnumkbCGR`2LR-{&;zioAqp4LIKWT-(Rsz^s6?&!Hi_Q6hA%3m zb9z2Rx(ooX7l&)+7S~mQ-4g?P?=rTtE_cUe*9bzY|kSyP<_D~8&bGp!W7_lWg`L-+j1WLH*?#n?ZO^{HVOM0X_n z9G|4T4c|KcIr8lEa#PC(D4FIn7+x!;bv0?Csq2OPKCe|o#F(sdKS6ltd>o=$UlzCv^%R=AtBl4YpYOeh5wSNiz#4ysraJL z&YU3T`60R7DjDW+%gaZAblg9EqU4+0Uz*M-XBPBtNWi-+HXhN@j+#`7%hXcB*Y)lv zCoX-0Z_0Ec)>*(}VjLubGh^IU`T860j)WZLj6Zm-*1ugXCOFv1XMBnY$(j$kR7!mF z!e`*cpsh~SxPHv|IsB3@Y;}apsIfqIH*a`8b4|#$Y9KE)ss|kYegCC^^Ka&qKZ?I< zd_pe}%%GX{VS1}zOLoJ?d)+vUbx2se_<@;HfORU`^-&_X^C$g~PeIx(#CyVEM{T}!G>_f|++-x}ZR8wFhc_j<3GY(#_? zxmKGpL{vEaRMqHW>+!16*=iH z9d!_wLDzfAdXH+A0!4r=!OJ3MC+rRN4kfDBG1f|n&!tP=2{I?G-Nff;`rH05F_lVH zbgqBuPnRA&q!J}*Wa;lHi5!c>{2K zCslpw?COUL_q3HQvJ)k3){K9_(0x6*;dm%iOqKN*BViQgG+=PSdltc@q->r4h6~7= zF84S7GGpelC;TrU*NF4~6GZo~Bml5iQC_YDkT5s1vckmX3n>7O>3(k=AiZut=x1Cq z)~ojDb0QR_;;N>Q>_9Q?^OHeaD6pP3FA)MpqkpUnwoB7ONF`*4J z$*5ASFIH}c7L~sIZ_F9S_<_QxMLfU^mi!wD1O@?*zKiq4`Wy1kGi>Ye2Qy0DCk8&7 z1*A9IQGa3YkvGHK{{WQwtWUlu^gkJmoO1nX*FLH60%x=i1DAQQ@RKy(P;L!>ZXp6_ZDcoq2N9Szon<*fQ6te(xcZ+A2 z`WwbIJOPE^j>==$zd-fpIHT4N{#HmQR@RbY3^+IVUAdSUr5N4c&A6Ptmn3YBi zSagkbYcS&kFs|BiT*3bR_X9a*zK13MG;BFn+<6kP$4X0CsaDQ_jcu)oSsO*fjn$;j zrTz6S4xTzsKzFYSkHqiR@(+G`fxr4N|0aBpJ?|^`AqhbgL$`5_f%Sb8VTw+k$^dK#aHZ#K2e1jX~YnG3eH@yt`^=OP;aBu?lBLOe| zHkTr@WjyLB6~mW!BK>dzCw?i6)?w zr=Kti%)ly}gaK=hY-OR_2_MN4F0#&h2?&tM4+cimZV!jy z;qLWw@M9ClU>V|KWR5cGl24)v*yLu%0$B5G95ak0;hKJB$HxB8v2p%0X}7hlP^58I zBPx}P5jT!-K#O29X@=`1g@pN^l6L`i`!y==0&I^0EJHv~06eS@Qq@zfJ_8NVK})c zJiw3=Ht7$nzw-}Tjx44DNF;QBrIJ|x48U=&Fg$Izy=aQS0pwPfY>Ij6)Y1a1B_5PO zS(}GR`KJQhXdksh|64vEKv|v_GKdABpyaT@8lA;>Dnnv?*JKTErc6F8iTtU*p?1+o z0E7smqWy3;3V_6udo{p+3}aCa8VM@I$fGQ$jO!rt>3_HmOxXEvx$DDIMVE0-ksyro zsmRXHwVQhmfbe2|4(XYD0r<;$s`@Oz4#Oh+4O!j50ocF91p)Y9KA6;>Yb${DFM$AT z>x~D86g*$~5*xr{L$!g$^9r*b{PMy|RAtR;2?mVl6?X1H+r5Oj9T;=XZF`pwk>EnZ zJD9`DtVDn(qj3izv&0yw_N3?le`ShCu5S2mT0l!37m7O66VJYKZDjYUdD6~Jeg7~b zDj}3sOd+zKx9}*DtcCOdy|?K^_@?YYf=J;0cqH;fd%6l_Zg{@;W`djB$F`z8QAHMr zybMpI;3G-TpalYLe>VH^_oVotcDGv7g)Y6%(pX>vIiLEMU>gfl!s?N>oP=>+-MP=H zoOQmBuJ(4eY2YwHBF|{}*9)h4VcLLVCgiAtm6g{85b#$YW7iVOb)SrUgPvMg`x;Hg zEChzcMDKiit=JZ>c8*UdXLND6SLG{n7D4zmnjp3Nr|GjZ#U+>Dxm+w-A8z!~Ke8PzR8ZbNO`xUxx;z@& z=&x6IoLV9(TJG+4EbLJen@mOiK~NI8p!4yQMxiIk$52eh6%d6H&)TqD8|d_fMVBje zWBe$5gaEov{jyjkMlXruofBweYo>zB zQ!V2$z)-YI+K3f~vGe~p8<$}M*3E9&V{u~l5k!J8G@eWK+s@FccF6(v8V4bZh1cLJ zz3+tZV{6gGWK-`QrKt#SWx=_oBCpRC!

H*M&c@O7RZ6CwFL*Wzuj|4t@PMYSqCc zJ;`mXRqURLw#9aRNmBT1krSM)PLBf*9gEbE^a81IHT0j62wuz}gzJ3{}fqd|rn z*0R@!JurTc@NEV?Ew0y!3QW-Pf`|q9c4Ez+A)`B~TW!kFa^aedeG>AlZgF0L(W1An z*y{4=3m+dC!%#gHVhK)VhPcV+OzYo;J$%z0k#EW!|+DWF$`k)&du; zS>~IeNud%tbtdC^eu8j0+Km}wL!IWp72rwNM{tCU8W915Ii$n)+%6$hvjkw(BP|PN zGfaHzi>4WCknOlUB#*DZ64mGq(M{XXQ&?!;S+JIBh{HZtE8`L#P8I3a=lm)ct$z+* znj>-1;v(7D6_FLY8jp>b;2q#y9Z9Bo=IgHDq@`lkeBv^o2YuJS-O=-#C;p4pv&r~( zEF(RJEKELqIxaw~p&eGPaaFRX4iXE~n4BVo{UduH6f9$0?APSfb;c0&TLHI>aNiy` zfbAh+u+77V9V3f8kNMmwT<`Y`mrje9nqxC=e6(4nEW3|qsaw{oI804bi(cBU{8;^? z3c7?(9<)*k8Z>JzRE|6K2Hm=CapjpKRRlqCq*<=uGRPNBXQCE;#^%{+R`$?BX7pV zy#?pv5218k%IPoF|LkL&ur=v}H*cZz<2MDzjyK2_HV`zyBlP9SL-T({d%Pfbl~4J% z5$wb%n0vtU{cPorZ%dY5gLTX&W|0)}q+_3{MVgGS_=oNf#U*8F@3onq4|3u6qCaS|I;-Sg~OpXmGBO7K8}eiSe_ zU%wzdL+k!4p>qHAS=kku9>xP*OYWLqz7n6fMR}63wu?T)I1C&&F>Gtpn@9M$Kc*03 zG8eRujH;cpLM0TNT2eq{NxJXf-K9BL-xo#{mw#Kr9T0g7F^T!e}Q)^@v$FZ$r1)5CNDjj~u3Y}p|E7Z=(o;$v~e z7jgS$6Oq5~w)#d?4=tPc$B!fY7qg8JqTz-@(n{2GUD7)Q5EI}B(+z-z-w&spfb%3L zP>bv~-`_dCgpFSIU3KD%`Iq8~ol}Q*$1UjSsToxCoy@S0zr6v+V;pC1)({CiJNle` z!N>ZOALi3OT$Rw&Pi32L1^?fnbY}RE*D1_L<)DDk2f*S$pq!_=+_`tkU#8HaO zBZa<{8YS{V&fJ+$kE|Wvkm2X5Rg+@J>wEEy4T{>lHa3;!)V@@Gnp zK$5o*{EH5-B1499wEwCHG+0|(OI(E?Rw93Sc^OXnT+6!`1Dx@@aHPDi;}S-iYTPhS zKei8H2hqHmh&SYXhwATX58qUz2u>oQQ=aJ$-h846|XHzlFL@G)_-4siveP`m5h}HrpCLPUjUP#Go+crw{O#V8Gu9F_oTl zae(Sl9au6lq^0n0kl003pY1XC;t zhv`mxpW}tfa7D%aIk+zCT~9pcwBy42QK~*@TRAF|0ITC-_kBu*5RQ9qJVK2wup*sF zj1VxofkCRdGTXyhx3^Zuq$!Dp)7o8N2362my@Xq0s^>5ByK$9Z0*8NJX(T*Or~kj7 zAZ)#_YkX^=Q_W7nF4#~9M|nqXG@JOYNC>h#Oj>x`)p8x1-@;%p;6)if z_;-Or2LExmaGdeM2KDS_{lf9VioO;&CS#f%UL|2tFf;j`lL~0KQIplN&g9`nTzIa` zHWO|@OTOp#ZEmmN)A|v<3&*kgcfYCrH}Icffg(v;p^W(jUs$B63(R0@)^#dLCeA*t zd5n#`UYkvHvR1U;0W#(aYJaFDx+WJ~f;>`1ujhXp zCsYNV{Aoi;q76(?_L8Y^Ii#mf`1()pPh8Y=zjw_Rt7>Po9Qa{Le(tfvS5 z^oL2D3l(ilEeF4_c>j@AUl%E>!IFvcSr)cV%wSepx!UjdfYUs^UjSU$QX9-Rd`Kpp zA^+~q1iEqW8y4|qIlb`MWDngsa^L4ZY*IU9Q%_6;`K`$Jy=h?K_`aB!ZMM)aclS3e z|B;ru=fPgD_;|Q-w;9ayZygiPEvs_cf;PwEn$YF$&xq5$?>@2{G84rvUaV$fXg}3^ zaAnQVPRWF$jgeKkOjHi;>W14wBiU~wtzRFwU3@o6p`be8^{_-yDa`g(E@b| zbW#TC$ei2PYK!CDm>5xXmK@khtG`lub*jRuN9v59Uh+@nOMopVK?LmA(=IzfVLbaI zUScSXiOn$D7M#aZ&7p9D!wmnCK&Yn+jlgO?G*D$f{1q7|`qSb~Cp~p0wE>R%GxwLs z-(xK+!m3K1k*eo=WYb^^a8&pu{O(9Wu+bK~2W@q~1bXjx7s`d6xS4*&^)SZ4V(#P5pFo1OG!^kgS#k>V2!{8Oc(Z8 zNlaP1(ELv2Vf=krWb6r!GY6{H;>}JOMwDo|7j1K`xWPzdVz$vyqmjkAJ-vfTeV5+w zfcpFq)F2$Tr~%T4`L1=gwIzQkz;6X=j_CGnyyn{LijhfM(feH)!7m`IM0=oUTMDNT zCzJ$3HG{KwRaAJht)?!$KR7Kop0Ci9+$#sU3t4{p7UJEP*xa;fy%{6CTnX!BN@{E z2lE%zpw~;VwWOB2q)+)FY%nxdqZzP4gESV0P4VCg=TtMh#7Ogm( zm5=vMb9y-CHwbUHV1P!mwL~|o-9B< zFIiiSJBgBqM=d)VLob+B=AfeTyW(w02}wz|Oj?%4+C!8X;StKe=cw%KD-2s0Ou%6% zvmBJ%PKv*tfahMPv1k#B?HcuR#~5k1d2CsC&rj%T+{8^cvQ+Rz@BSk{38Vc=<}&}= z;xEhwifJu6{F_&{y`&7vx!c<|UZf9kG1Knxl zqw4ov_wS}ZP3FQPk&Bh1?M6`?d3=d_i{$DO;_~Dtq+&3K*bR177)nDlVs;k6A7#5z60!+SKDxGDy1Xwrd~J1x*tM1Ht>G!=)(`C0$3%@mSb82l)_cub#MSSS(ZL(~C z)NYGO>Xto(Qiq_Oy=8Gl+RuAKNtNy#SuLv|th%$q@kJaH=wr(~c_DljM}{pv858Up zj!sU{Ge#%23XGkut0~jCPuD+a9$! zb|H+h^|&cQW-N819Rk`n%MKB_C)AhMzETm0_^ZmO$i)r5;r^F9^J0XOo6ABH>jh7} zlHjkKQUgdN^Umzow{0s_D!*7~l63neB+|C{IH)(M&$ppFh`rEMOVDX7;*4mKC zZa%*tW9oUI(P9F&6*V>N4A9P`n3QtJ33XLqYWN$=k$xx~j{vvZ2Bz7eMN;{_F7Q1` zpdU964Q{1tB=5NfX8FwK9fsdtxoa1$Nl3Q2i8GCJVuB!O6VToqpeF^yZiMS8t80|=&d8`scSuGDsqUOm$zX4sQ*l)ur-iU z$Km4=Cj3H0Q@)5G)$2bKHzerh?^j6ns9JvV|FW?%V%DOvh^1oNU1{Q_IcvluO2^;$72Nf&y&=xQgyITJ)%Pd%lm zVqPltKPoXS$4A%grQo?gVo?a zaauVCULKyW!C@c{{md1_5u~Y^V10#rBeQXjA#3LDp51LT1$==&>Zl^e{yYKOxv#Id zXC?BLF+F1>@Gv-ZQ?$qr(ZR$(2otA|UGyc#BmshTPg6=UB+^ivu*yal@v-jKuE(w@ z(Dp*!N1A;~a=lNSKg$!(f!)2rcai8lII9h)`BTghF)uJ7TQ2c3GK+w&YrUP zvq#O!6g)11i2Hc>Magv^k}lQ5-4z^@rqNyn7aeEgmD2J1He{K{qJm@_F3agv6w8Y9 zp5Ndbjna#w_@bPH+n0Dc(+>hAYZ!m`vgdXmJnWcWvv!y=M_vgWg?-&3>{dn0q{}E% zQzklP-`dWuumU0B7foG~>+f>9$fFn$JJwMk*#=ZEdm&%`vHc%T3V`jW2Xu1dzPD94 zhFO=^ykhMy8t-?d!$U^A>1|ofdIlPecMB=m`Z>Q2Utae1X3Oty(+;t+H+{! zSM|E^Et2|uwyAhUqBS?&0k=y9#RaC61qyE71jA0;tt!REke^tnz(LSkyq3trJS`bK zHx);4Qgi`nnDH+^(jBHFjxf#_zuLV>G^0!33Z7^>5w>1I`Hw2x+$QE~S#kF}KCdqN zk5&waOT}&JRo29y@AsDn*IEbvHH#x{;+Yy)>g#K<3R;mcsra>aWi`%V|C0xwa-XV& z<CGWlIBI=gyK**uh0(7{#`Wx!;I&zc@oLFv5zR0U^2J#tk7zuL6Z&Y@ z5%NfZ0PWr`hzi@t@8T%jB5HW#JkRU&0Y&8(Lph zR#_f?4o=8u`CV{IJ36582Jhmz)ltx6z%(XRZ*R_MzIc9qIx;~^r1NgJ!2zEi%kzlj zbh^9xD4ESyQK){e^=O-&{g3gRIgJLpzO{ra&`X->flMa@ICoFKCXB>>L`5ObxQ7 z5UVpI-2L;n`2B|l;ravQy!cjR{;ADpYK1m77Z5?o-MQ+NBC(@bZ@o?N?`tcM>MNo|CLLx! z6u~If7ZzQ%hqfzm`N-KPOiCU((V`nNU|9&h^5t9#R6}(|3}+OI8&avt$+Vr@X6}Pi zuftF-wsCN{+`LYWExqtJW8uiSzT8=2w5!pM%aT@JYzby!_k+#zP>k@mU)gqn0~|6R zOa0;UD*`{0^Zv@VUomp7s>?$uNW(sRA8@=Tx`N{8nsb|U?df8j7Z3sKI9;E zk*6av_xVUj3ed$AMgu7BPKMzN;vbX@#e{`hj#uvM3Zc>LOYCkMyU~^34-oj#M#mt( z@2Z@*xDKKIqU$MQ7pRb)?N)T`3V1z1Q9~Paf3wh{vMXJ-N_>Az>STB8!5nq-H@nD- z#KuQtz0&i_3(EJ$ZFjdA-HNdAhmRPNqy6UoMa>_EEzB6K>;FM5PiF~x9etB=JysFj zAJY+Xv!2?!dt0!b8b;^Z*I>6W;mcQU)X4o!DQJ6mBn6eWJGNqYuF?1eS14!kKD6Yx z@l+I+B*|TF;BQ&|64I6@%8RQ5I!DS^=6UVSu2|>f6;FaDQw~TGfidh!Wg7^t?wpXR{%@Ql^T^k)E*&o)kZ8O2M2t? z76z*Q!0<0$LS(CO*NvMXrSyN`deo&66m-c;o z-IX1aDYrcm(f-mJ!^U6=XHvG^ShHq5akJQAJ@+D2{9?RK(s;L+>bu8@lds#=vgp53 zH(o~^rsn53uN*JKu2y+xrMI($uQ0>lZEwq}eZ1RNb~0d%NiGI2{JV{RPb=ztuOso$okyF#K+k zQ98u%EJK?E#lfNbqNx@R^)ia5xLfLmx!eS$#;Ha>6jW!Pl9&RlzeE#6^Hxq$FL~=m zCxcz^aw1c!H>~lW7*|&5)yn$z<1xL3FQl=gx5bwSHNK;x`q%fmN!P$6v(A541@Y<6bQKlGE@C;;T;VAJvfm|Ir-B;E0?AIFKiy5K!Z;5kUQ1=lohZUNi??MLC zC&j-eFqXqjV2IppY&?IYdoRQ0n#O)kBk+>ZsP|w+Tjf~WTb4l& zzrErR>DRydeqC#KerQ=yY#cG|kU{K%_Oj_96PE|D>T-e`xq- zza`06G1$BpmT=>%XKeBV(kX4Avr7p8{N;M6HUCKbdG^>)*34tqZ$&&s=s7}S=Mp9* zvUzUc=iU|J1W_s`&7s~5YB~oyD3#3uP$rj zZ6abI=qpv5t<%|r?u)n?tHbM_1n%vI9Z=POaRJm0=&gQ>31JNa3~i1dh9TeZ^9wYs zhQp&hn53EDCm;@Ys>DfucW-6r=bSozK8{b5DdyTX)vd%XMv2-YWsORDa1qLnn<)x2 zudFI_xZLl8ap@|{buSB0mx}SzgXk-hv)Z6VVFz9B(kok9(ltR&KF=dr@sJ_Pl^;(r zXP<%qlXz2nmY1(*K-*I9$IWHVuiTs7A_h3<65zV7zRDU_N$>8?Z!*Lge#Y7y54TN- z{4=k%Fg&7vGj#7UjJ-OqnBDTO#ZLy(_=LN=qNVOq-<4Hmas--|IQMDa%)f-8Xc}}K zqwGV6qDd8mjUZEYc&)eG2<@|wz`@0){ZK#GO0-A#4dx33oCo^1O+lfb6ESsTQ}KE6 zRh9~Y>+i7%L=ASvG~5795z0gM^Q^SQ>b9yw3fFt8p3>+h47RI1vqQYLm*G{$#xZh{ zV)FB%c|TvATP)sW`W~d@?`)iDdA?}UMzyPzS@-QX?D&4O_;mc|T0Wb}cPEYHmmNfv ztv`{a9H>4W@0WE3GFT zUFMUU+(=0y{SXztoN1(rDan@EPv<8_%A%KS9f6m3Oup8v@Pa{QM7AD;T*D=gpfaOqAU0u@Wvdio`%ma^KnbQ6EqUA3+ruoJRlj9c`#XrgtT(^Zzzjc%^ zf%rYGV|X_s;bn^+(;(5AdM;b(nI)V#0xf|L1HFxv>VJ|01&-D^b6|Ip##340yoBbL zXZr_6vUHPU!UgEu`;_5FS+H@DVcmr$J2V#NuZksluX0%cDOq8?XY+467e$pWN0ImN z#!D$5-*hjv_$Hec_ccz++_j{FNy3|-%x!ke~&RQI1+LUi&ZPq;-3j}RNMPYZSh3`H--ZxO26|q@W-!?!tbTimxBDw3X?t`Ua zPTcDsSO5v^hi(ngT@`TJHjn3No#(SEF_vXakvptnVLbc5yduJR636Rk%)mfh40kH5 zoYf9`NWXk5)`+I$HrC5|$$fS2ax0#8WvM&g-%EVf99wnoKjX(y96xznxO6cHQMcPS zGkI}*Z-&3X;K$Fh(bA8fbR?Haa%ETU9bG0S^?tp%_LbR?_i{^Zj`luiW*}#U!FG$+ zbiUk%gW-<$jnWOKX9GVF<1#Mt6@@duWpC{{Z?uB{h@~$h;=}Df&5voqEIuC1q!!p@ z2^;j4&1X++1I3L}IXjF#AR+u_73Vvi$31pZA+2J!o5!m5K3i?GrplhBRGGd(q0maV zr>>V*6SqJo59P(hRnhHm%DjIZ*J%*c0k@&h+Ktr$2iYN=JDku-tI`iW1Xp5Lr5J~A z{o%n9Q`QdheK`zkZ@RB>3E;O#an50Ft$1&q%gNwu-|2+ks3B{RRBuIAEq_n;^?eeqJHtTR8y(|a_P+U+K0k2T%wKt; zIX1HH3KL>s*hp+yqxFp1`sU8x@0d*BAgH3cCmv-}N)q{Fm{D0!I;+S%&49|2ca~iI@2`^u&Y;i;!*ahAuh>-4)cBR%W zIE;+s4qb=P_lSRab+wcsOb=fWs6Yc9Ak2*2BzAWrui`UUBfU*9CloDSsE; zpJ@XW;RHI(8HoFNubN;wwsYwoLMF|)r$1anr667GkI#3zJD7=aUE{a4pktNtxWJ<- z7Y1?mk1HeE+Zw3a4&u_Zin7qoG2jZ`DjD1{e;-{L@6>EkXzPxh5vy3#bx&T}IDxuv~ zzALZR|KkX(^X_yV5xzA+GJkW!$uLlb zM+zz)P!Ik?)ysob5PDJMu=R5R@@y5;*Sc`eM>_{R=$E%`j)x)TEt#GH77rz z5jfuK4fppl+m+p?(G_SD<6Zc-AWD&pL$B6mdo{f5EA_nShwb%-qr-!@pELSs**UU= zR`X{kQ@xIJv}*j0&c#wJrHvNH;A<+AH!p628U@POsHki46oMKq$kLz=o86C*6_>Pv zy~m{rBg+l&n(vN%z*>+3uk2CT5(cQWlRVh3k^3zf$C7Q^YtPxn4{*Gw`C-CgZxfZU zF-~|3qd|1}U6FE)(qk~pX1-i_29DZ?G#%gb{Kep{{mi4;vFZ)y!Qk_KaxR~Z4V#4D zw}wh#^I{WQpfu47jBzy^DJCCLc<(B^P`9YuT!((uRs=JoWo(Jo^3->FZ7{iY>ruxX z7TcIi2ps;KrMPu(mfa!v-b{|tCCUAn@KEj7v=p=C_e+8sQ*=u97&qkz!1QlVLf+jM zc`FW)OnVX$Ub>ew??n~S54lNQW%Jm%ZzI&k`;IU5CXzpcUSI9|aE|9v_9wr$5^{FKT1n3ty zWVTpaAzzG4FnK_zEH(|Vx)XKyEc%)tD{SaYZKRk4hJSApWbgcx*xh!!p%|xCIl>;c z(!4g4eZupTewz0Ym!qdHf1QDQ+wHCk@I5u>D@G$6`V4Q0b`jEZq|0dmxywcts!>W z)kX8^+6Em8c6*4e7}sslW5Ki#r5Y~&r26dxFB3r?@8PWjWo}Ct-4={|Y`N71gHVFq zjQ#n$Me44Hah=EvbU6GN%vRZ4Z6+(DOm6>r`Y-E8(>TUzwF^*#3Out1119jubY8sAq#&rtY8s+_i{W0v@GB^!gLvmnp zHkfdHUz!4^Prci0Sr@jJ&Jc8xiShLu3Zq3+dppf^Y-ZJf(m$Lt?Jo#Fq&qkdc~p90 zC;I#>VvA^)0A>X{``g7_EL?X6mR(*3Ah^*4sKFt|cPXA!HyGkrRl&Zbf zcz)NyBade_!lR?Td4Ai?h1l$9c8S9ydv63ktvs*$GiMWOzJJyHxtC3x14G*`U5$xW zcFR`{D+=f2;YCBfyIf}SZjJT(=dYxqN8;{v)SNj4p{G%@*{I#Bmqy1v#|eU0dTsR1 zXLukx2*k^C1XtG6Q>mu)D=ymeuuP>>D;{|L*)!}R;>kTkyfE|7ueFx=D*DWYK(5{R zGLVPOoZjZHmpA_I%x~Xbw}|azv9tbez68b;Rp6rcchZ zC@o!1sPufjx+syAdq15dV8d2Flcg|jvvAw;Q>LsSw{tA`St(%Bz)U~hPBF@2Zg?2- z3ucClm-z|~oC@`*$8INiXfKr;`iSZ8v3>YZA?O1h4`v7dzxnC0^N?J#eb%Q}_@9?E zs%eB1T-PoSqbGPfCn(%%IOk%%^*Xd)nHv-=(yM_wEp<@m@1#B*?ItGl5FRZwbGYtW zt(4EYY&{3ngmBAxc4qOVl9}aSfv4-q5V$oRAdvcH-z80vFKqu{)TDazQ`xGj zC_mkoBQ~%-a_`Q8Mk6PC+<*-dkeHGFR{u$pLAIR2;)mmiIyz2e^0kt34{nX&Xeb-8 zuXih7sSz|<{gb|J$Qbi(%x8!w5f7_~X8xBl5kuD*V0GEjWSEp6$DD-1+~w5mZS!C@ zIZ;7P>kz#nX}OxL2*2QGc2=~XHtcEy?rP^NpDw04oW0YuAILuq4x49r)FXa3_!Mbn zCsJ+OVawvT6=aHVBcVcVZFc!aCi(ghg4{em2Oys)k}qtHEX@Ef&lmbl;H!U2k#TQP zCDlfTol_q=EAA|_-h4FIY&lTQ@k@S>-oW+IKQ0k&+{<9T8siRuCJ^`|E^)5NNyMxB zTLu=Xp+|DRra>~CguCB17IN-975rONSfTw(6D=MRRjA$g{AJ_{^ivVr==L|O>@dZj zBc#;7Wj*BeZaRdnPKi-#>zaY|K2Qj1HDaOatvat5PXTnar>8uMuNbGOT(?!jNpGM3 ztYo_fN57f!6~Etw^j2&NBSHB(z5Az*4secxo#@x`pLL@4W1{-Fki8frIzik z?Zq>@WfK>l&Ow$>E_hpxcy%|3$AG{64{4QlbHc}G>Jp#XJlKJCqL!_f*`KV9I!_t! zrdyZ?%=PA{Hw}iFgE?$x!eYN3POiD`5;$J(t=ww`H=y&^0^8=p$JAk<^CVwO1; zn@LX&?hK;G8L)gFtiMjHc|Yg!jDm>fHEmX=`HsbM(Rj=4x~d3Ydp|$D`el9Pa&%)*QNd!7?Nm+7_+lUNZl*~{UL76`I1tHMhm^zV(|u1d|GC!GXa+fQjk&DWllX!V@% z-wwarI<{!jed*x>Z<3vM5KhzZJ42GCXo0k)M;osSO>UMjUl|~7e>^&F%bo^(>OSDf zA2(tc_fZ1=Lb1`X@N%3+ej=hICkOfSr?+We9Z=?!?cJg*cN<{wc-~?bveoWHTJbFvbR*Y&9>|2AU3RWiLpYz z)jsTYFuYUUX?}TiJ+ugTu@Fvz<=Xz?NH7&54%>q5+HqW30~g$!^!i($U)@ibWD}XO zTMV%5OiYo{6i=;PM`xATCNVSfDLkuY@gW-LWMa@0_PcR2hpBSty(Ia-x|k{FVRd=$ z(K+gAnySsRNfRTleNLcuwB-5^lLiVgm5LBX5ZuCxdUO@s;*Z=F3WrU(p6$B3|EorB z&r@WFz|&yXst82YO)a<3t>=}yuB2Pl1KH&RN+-d&! z7<3~Qk0c{T_b)D5(Z4Qhn}f6-?jrMr!h@!cD~HKPFT=x+U6EcBH$ZQn>a&YoHgG*DH??q2|l-a;qOns&a%IJM2~ke{8Ow}Zxh787@HCI)1U$^K0Auqt{T=IK=Psq(D$7I%nX@d>HXi=3hhTjG@ za=NFNwl=?s6C^9{<-nORyBVt>k+Tl!LWT%0!c;N4s+QuU#A-IKJ*BdfkJN_mmO9ws zR=7)~q`JGICAMUI^;sx{YM8M1y=-zTP!{6*h5rKSib$KKzIFZg<^unN*CnMGqv3qj zyoi#1u}Di4m5ZY6X5W;Xjv{vR6NQ#Gq*7$6&#L0De;Yl@)-gu z)i|8mXyZ}m(w^YPs2Ac!c5u6Qs7#hq_>arbBFU+(mzUeMP7~WiJ%o$UlaKsd5a)QT zGK)5|eBpG+z=Wn$B(_PR-UWUUmcoQvR!ayme%*ATn=PLyILcCY`}3oe4{pDc9v3=8 zYZq77SoToZ+h;!!7&kzC#}tW&H=a%YLGJLCy+Y&y(D~2hqXwe>L1Gsn2MN>tfztK? ziw%YrcML~=sfnIe5d1bR@_0VBUX)Q|_z!mvPBv|+(ZtK0GoAACmh8+HUu1ak=ls~n zrXoaS9AYIxn`KbEZ;)Hitn0Q<-z~|w(=vlmg?dtd<0xz~+0y;kV8+-3mmaPkPb1*r zLr7LF+b?=^A|)-9ym%HT&fcsD!YSnT<+mqs$a&WA zf3f$TQB8JhyJ!#<3&N{Nk*d<93kXODY0`UdDk2@EO9@dC5fG3ry-9CULkB@>klsUw z0HFj3C4@k-pS)|WJ@y*sJLfxVj6KHwv!6c>hw;hGocFx@eO*#9$bnyA&Kv$*0(WbC z1x#C5d%*A9Fmp_>Iy)Q%#PiLk=!54PX?I5}B7|JK=DfRqJum}Wa+bo0i3X0(^@~%< zp{|bnQd*MVa-0#%uXP-UcD}&wJuY0))9A|*;}TJOIjZ`Mf?QX(?^%&VRp75C1d~Rr zn(Y^OT;bmGYLH(6N)5vdblE=oVt(fH(Xl;VCZn4)lW%$?`)g!c`0Ktd$N<=^UwC)8vP&do$<*a{L9<=%I`8wp-XWB#ytL-j5g8@ zs*QJB9NP=`hi|gCZ;5EsE`BM3O^YkB#FM9u*)SFUrd70GmK`0; zKKebW+s6QQWosz+5{C>`d6@MP7OPe}+XVYk`9X#uCxNz{L{v7nkB#6A)Zltdbz`JRQNVxs(z^Z^Kf!Dsfq6umIhFUw@R;s?>8*RBK_`zPhsSFT=+NTB z+*;%Jkwv;C#yt+72U>G;&HBS;YT$oKah#84?>V-?GyMIZugp>|EasC#){-CF?$9o7 zDw8L`x>S6eXSP=6?VNvmu`KKEzIqYT=wk8?J|APgLPp6=7%{lvZs2`(30F*x5! znp7Xnd#kbDrAG-)k#U_fu+i_gON8o<$a=?dN%y5(owMRkx}2dlnO3=rTNN-Z7}w9= zy5i-9X1My2aSx4ALkmh%RwX!Y(SN0`zxGwFdGvlI^wziB7b#l&PfA2QGLoMvjG2AM}Vr~(gwA*xfu+jPBnFC_+FD{#@aDmwEG>5+UO1Bw!A2*gK*g0LLJr8J2Z#>`c-i(s&8edvpflk;L{Enghl+vGNFjl{} zBitmb3P-6MsHZ@wPDpbz>Elnf&jgYgk$+^Z`;hf!d2y@YLS>1hY>FXv}deldL~U?R`S16jp(;?0pP& zdN^hts=fCT0dJZ$La}F(zDQ06F)BI>`vv^ zudTl9YVBTKoGgbT)IZFfw&e5M>G52+re5eReht=zVQ!H_14(T)BC$@stsW3kyQ(6vblJHXZ~sFgpt|8uo#Hf2KfCx7-9p?6z&ZL7>n!tqyVOt(y24-|g8LDK#k zWTjl1OtT=VBAl|`W}P!T-y7D7-Mk>}ERYiZWqb{M9^Noi`g5n<_Z?PSG5Izvb?(;b z=uacGxoDD2nNYO5(YVO8@$#t8(zN+`g2$`{gTU5d+;CDT;gHq#k3jx;gPzS~dDI+r z1yxY2Z#3wS5v+n$68rTBa>c`z@Vn@oY*CP-#)M)g96OTuU|&}LZP2!F|bmboLN>E|K_(8vn2Y9x-3v>-4YPAu^y*5 zM1VeI7f-Xte9*p?Ku#z^@v)pzjgZe(ua-E7mo}d@`*Z5wJ+qJbCHmO%ISc@ zo@16X6aB*~KGt`LtXkIq`TbLp1-&$jobgi(^SD`*)yMw4A_s&X=Hl@83eRBBSr%>^8!k^bBNl=aT zmv7&hRZ91LF;64D>4QYfKj3}tL{XVSv05-xV?lb}ns>L@QS6m{69%%F^3?uoM4!~P z88eC)a^+k-eT-p>Bc}b^wpu`(Oo@|<#Xbm1!<-YSBwCDFvKb)!QbKp*l zbj+_TFvzGe|AQg%M2AKr8Nv$odMQmA3U766TI3YuAoGCp;BCgjjAKd-dZ zeplx4O4J9^XHw(J5Edl^gEe|pk#|0XL!0VtcTM*M&dIzrM_{h@!OBD9qN_%8TB<@; zr>^osZ&J-dv{Qs0DwY6)*%f9j#v*U){QSA+7Yr8_lNPu7(6yoQ3{8%mszVuI#YVcn znEAu!Z}pAL6f?^t4yE=>|JL?0*!Qsam(=dMCC&<|joni7YnRT6(?dA@ShQZy*b)313Ly_IJnwb5e<@R2l9* zGq;qVP@~06O*&&_;`sFMZLiqeNw{!h_*Utn`MSc$xi0srrnSXxbF*mSp&WbF zpW6m52)=tmJDQ^P6p0*(*}4_6dg;kBZBpW*DQgaM)2%ekSp~HA6~116 zivHTUZ}Me1#!UAfgVhRU-l(prX)h+fEQ{AO8^_(OBhw5V3~Z=9r|$cCfH2>rQ06zu z*tsnTevN$!Ic(pFH!R5we)BnLaaBT+pF?-d4t+nmaH2@f7psua=&BHEq1*-xPwOGHFm<6ci}YBYNIH@H&$t(=_d@Fm3MEq9iN8k%GSHjanzLLn!Iw92Yw$NNXFd7>Gj^%%N2%~U$yS@s{=?TApC&c59k z+*gu|t5*vLqeHZgn8bZd6cr1nD;AQoILs=t8?3T;2P?deyYaw^FCJ0g1%2{IQm@^M~xwXXvP1xcq{Qc zL_B_Si%OU>&B9`pBCq&2^g4rAxIArzJfb&6QAJ_7;8<2#7jdf>4%#>{3g^~xv24Dl z!YuaXY?x{8j<=52wVP$4)QJa*&*_0^w&|BMBPIOFi9Dz^%e3wwwk0;zlY0NRg}y; zv-_~W~`AQ!Ey&gb8n*5FEY`o}^2U)m237MsHslM8Q= z_1n=KpB=>s6E<}wLTI_#*b01t0}KOAvvgoAKUUH%sUH~4IPRaC3O`gP-!J#InCMa2 z9lb(MZ-JF%#E$Wh?ZitV(U4RkY8x=jy_Iw0E1ejBdqr)8$5-*~!DxyUw8lHEVa(?x zRID;jJQFLkpG$EXc_gP1;`-2w7|R_NQG;@D5owLeLt#YoOAT>9vxQFE_>v#vnu8eEjNYNPnQSLoLEUmB0yVL*Gyj+%w!Gl7`F+?mXC;!sL!0sInC%Artvr*Wh2 z9>VPnI9S9BCG_uyMJO30sMxnXcqaMSV$fg|x#{+*$~=;8hqG#E?NNewSaPiTH}*pH ztGQ|2h-bNeJI=r`dJ?ZWRl%(Q?wpEfqXD|iGrU-)473FI<%{G;O6Ip=?=Hrc(hSve zG3#{<7I2LYJ^9&~@0v~zF$~XoG`3tCjEstCIJnF?Rk@ic9+RXI zW9uNY{)XX#%;H?N#KM3hxLBng9^>s#xGiSL&0As?5}7GvgcnRCpvWCmRy+`AhxZix z{No3ID=U{rsTtj(JNyDGPl(|$W($v-kuDf$&5Kfh$sRW%wPnHuA-&V`I(0nYl`l(| zkEgD*rrk9cCQ-yaRbMGbQ-hi}=R5LXskRyBbg6e$euFMth-kNU*WT+lGVh=`ZPTPO z(v#^qA)jKk*=+kOCAqoFaG&Hn%cgrQ@n*{%aSlxy?@EIo7~3(^-yh(l<$thhbyGJL zvRBM3Y_+Ak(AT!bQ;L{yYSaiivsD#(v#}M=(IO-CkMaIssriNB>zsujNc=mjL7#`9&qP6{>!3jmCB`^a zOVRBM*EQxtz2ASS&kVD_K35-;PAr9|yBHi9g?+83x`*m^j(hlAce_GfqM8+*IuSOD zw|S$<ZJ2YZa5G{>Ye7Z**3>FrL5twiw~s;F(CtXdynRul}IDz%%b z`QxwPjDFu@60Gn4_AUgylEm5#j3TITA~nP7a)S*XO1f(2a66x^1nqKY zZ!LS^l~uaGt{LR2LhR>1LLtU|R~)sWlQKa}%8FmFy^T95xA?0T@%&xZ#LePJcPH6X zOi&A!e+KPlQdEjvfUV>1Kq?VGuF)IA6m8WK%+#zd@E@5Zu--oO8xHt%Zp(qpx5170 zHcb$S|Gz0QcC6D0-5GoYuPgCqq37Zh)I?X3KTo^~E@q%6{qZqQ<&Gvk`xo=1^@js5 zi;_YhoAg=*ZAM#^28*;Bv3ke@<8Jw(68`+JEDnu@LzUB%cZLc zVcfzNGT8;F3wBR!?er>vkIIeZ{sjV+c&WlgUCzC?CtaFO>>NK!J>70d^>?J297<1p z(xOc`(GqbpPOBqSO#jeGml5VWHZYqlqEfx?FtflaYbIq^NW{c#zeOC@NQr0rohR<^ z@M--7!jC=W7id`CtkYDzLcy@n0__|b?W*3`B2`TR9~!zAqQQm|5T#&5m$;W#kW6uUk)IM>%+pmEP;!ZR5LoY-30ylnUyt-Iqv952EBfe2N z=Mpe1Pt9V99!Qnt*sP+`+PuRNZM8Yo5E)X4h;swn z7C87VHg+(MtaU|hj*FCO2No}9Pdb48T_qIpOT z7)RSqV3qY0!2Fz!@H~DG5MuQ95#E2VEEm$ia(Q-$kbM zN!jK=m&v-lM7F0CH=Cviu`X3&tuii%3}?^BR>bB+{wk}P3h%p450kvoPZrEsFN#P3 zkdL`X#KM96Yy^7fBgn}A{S$o)Muc_b*YJJoQs;fp=^0 z2F_{22|#Pg32Je%QVNvxdUs$vqWl5}jVWoPu=>>+^~0LDjl_N~qlDjX7Y@-U3y{b| z>-~iwl{OMzhiLxOM}19;JE9a4hyG-d5K2O$vVg)mbxVi@hS2 zKO6&j_sCKfIb%%bK-3AYL=Z|7#Psq4CXv$JSsy)iNj;dK2Ugt^jPdcgEy>GdAte&! z50($Jw+R{#8innJ+U^M~n-N#k9S*EW5(v|Bi?SPDyU{#orK#|F6v)mq5ec|EURA#r`Wz2nZkW{3lTG#9jm*aODFL zfx{a9DIGHl-h?!1UoBuQ!yOA&d0qyRPisdT$?Bnw$ih3I_bJ3IzOu*Be3Hj`4ZjKi z`^N@hH#T_{Pk6m`NRiKeR{!qk#^&ZuAq@!R^!ME7hw)GKV|@SsZ`9Y1XBVX%RgnPpiu8+pJBh?73*X*@h|k3dLv*g4D1Bm(zBWHy`+aCNEPeheN?SZ5KApd!Uu1KQbT%tXhXhm) z*dY*Y-nwl+gctTpelMW=U%3D)d<)zsmR4&cElfR%5`EKob(b^KUP9ZXU=uCxhoTC5QEjm;I*@(S~CKS8b|yUKGTP|6(RJSLcXzekAXOvnEYkS^n% z2EZU2b~-MBD}PlI{bZgu5_=Ww z8Ut({9g;?piG1%857@fFbw^#DC zo&*G(|641inBSc-9MwGAYIw|&2S6ErBCm}o-N{KOT#81ngE+& zGs$oRab+lxnxtOwpDUFDa6%KWsD$X@o5tDPdsso5QGrWUbLAF@C3}aM!4x3CX9Qq! zh_~gxG?K)B_%8vB-hXCAdLHXZA^jUWD8-_7GZgE#- zBxdGY&R@Fvt7R;_ZZIx*w*2G3WxMQ-@!uCFDH&P}}!FWQz)lua}w}KW^;{ zjwImDHrV2T=b5gBN#VXD%iX12#CGoOb@MOWe=mc0&#pd1>PKz(-Aa?f=3nsSm=QTgeEFsE^s6E;sVzRJUSRs( zj4wf$2HR<(xG2Cl#2Zc}FhzGP-eiE_6VZwxN4;)Q%> z;qB~<6f}S6t5@htS1HLoVBz@FIBTH+a4Y_8Kpw#yk6)&P{d57uYq*)%&O`DX*#v>7 zvww$;eyiF8(@ddlG9PUsWkFpH)iolD$@%5j2EI!I@xM1~g9aj-Gf3~^yvyG7J zcD7vB=A!M6HezEM4Zu3CEs&C7cDxLeSOAm##0)Um_8`B$9u0Z0#G5zQZPxMM6-V&D zS}j|mx^8faLAPG&#RhDPq|Y{TA!^cM3f}tq>W#C4N@gh_N6D=nf1sb=6>EoS(vVP| z88vvBOa#5K-cy1@IgY_U-K2fx7CvBa`AJp?d-dtt6fS)LW z3o;TD)IzXoOXV01qr7dzen#xWxqy==)(xe!t-*T%28dmC;ta;0+eC5ssJB`!#G)s% z09MvQt+M5@u`?}{U-Q2&r!Nh1x^#AxE9m^7r;VBJyRXUKqyoxw!goQ0qwDt%r$#M` zQIh}{dFen1mQPd=TF_9=gTU7Ys_I4eVeEYfZhfwCsj1I4536oayILXC{V~hYvg-kS zZ?b@qvHD*-S3p@LMS+suj&RXO&wp$*++w7AQTD3j2!(CWrS$5*z?M{q+4%#wqCOL2 znyL*rD6`PjPq*sM0-qr{IA7?aQEZ+xNoa~5j+t==}8Yht~Dv_<6UKvvW-keJ=#F8b*s0cXfv#u9_XMk?8XE zEdI9*cfvQJ!*ERwr+_j)8vDF_crRH?`fStGUwMdL@Q}hnILP-fJ=SM$aNMi0$CzF3 z6PJK3PGI|w_hQF0r2&D4b@to!;N@t-}l35_1$LSn0oLj`QaVDQdnnhbe#1n*VzdPg`;?a7xZi|J9LzDsj}o z4*;f<3ywucxo96WI(3Ac@+i8m5Z3wT<2LR-KFvm}I~|9%;ykc|f0jb?qsT{}&(EF+ zHa6T7PO!4%l#*#EP=4OGy#aP}(c5f%^FdU2eHZVl>J@9DK%=$0=j~bCXq6fGRDbL+ zBV)lsG?DaY-ld(_tv)kcz8JS{O%9+99F%qMpO}~TZEbCj9V*U$YQ!75wf*P}L7YDX zf3ps7{}b325NEsmp|x|Z4YF8`sFP9X61k7yu)A(;jVWn8q6L)}Jq+N5(6t+Sk;G6$+OAgcGqY^^`gRSsz(_IVuM|S}xoy}Vz z^tIK^-;9GEQLP8327^HHz|2FtAN9tU#A@X-Gn+@E0QRR|_}8nN>XG&PmKhq}%W!EB z2)K!ZhxW)73Hvx`;&ord z%4+|>eqwf>$A52fO}GGX#FA+NcTVqN!fV>KA8F#pxD39sdBkdh9~%s>-{ak-lt=;Q zXPg9qghBx5@+IWX=r6dejIg1VOwf9~*NJn*`zQ~kF4%;yI4e7!u%_E1UJ*cQ>B-1K zf|YkmU5c)6OaC4m9P~o%w8pP;R*msFN!HzXn+HHWCjcg9>5eq11cCRi*y>=23Grf1b zJbYdPXao7}V>5aB+jT)ir1lrLfa7;$%T(-#9CdvjZ`Np_w=no$LX!Is^8!7IVx}~+ zrgx`Je&UkFfbM)lJelBb)%h7t9Xu-_=EL#s?!bJ)e-;M;jtcQf{a;YHiGTl3LaG19 zD}aL@w}o_!Oh6Rb^E1_+s}Bl{-vrq+TBM8o3UUd)xP)SnXtsN62Ow4^q_-Bz0TYW{ zJUk`Z0fPsbNV^ZtyUb%9K_!fyzNdKuBeGE>2VsA}qwoI3@@Hfk(e| z{55NcX*u~3xC8`t^h7^JS=J4Ap{QI8c-7Ce+Rz`=0XT-g`z%hnSS;&ZYl+^r%v;^d zKz0ZCczYuY6mK-f{s%N{-$z#NCWhw)fhLJF0Vcjr#C1V(RPpgaY9LT4fQkOzJ1k8e z;3Rk&Nb(OnAj|BL`=G4r{UeB*p!XvGn@|ko6wdZa2>y?E%C~j{Xi8hF2}|6OgWTTZ zWD)+}n-&ct6Q)#zMe7n@!0;NYJ^-8#Qsg~Gp)5~Kv@u_$)EsobXDG;IeQoo!D3dV4SJoFHvhz&##n$q z05W4735dE}@I6`HK*+PXjMdOR0Iefm8jhd=f)eco3^cROwZ`kaSC4(ef|F`n)&2*l z^FrG;5O$)>k^qcG8(-NM0&xmI#Tgcbegs(iy&QzB0|pdiPt-vmdgbSGO}D{r87Irz zV!qqQ6+IaYk{f#-Hp*I)sCtE5H)ak2Np7Y+CZY2N0lY0zASnVD@+r!1HMwWcZyzQ9 z5-KH){2=xxwO+!>2i&l=YDmC(+kFMr{db44T<5#(m;$YhH<6pZhu?-5obYosvde{e z7kO7$@-|*;wFNkb8F);f5%2t#RbZl} z4y*HLxrPyARYNB9p2t{WnIKQQIe9<7 zv+_pf#nuSm?J*}zLm84{>ywf3y)lZr`YXGKijf5+a_wa?%S4U*9IU* z_2;d^adWR{`X)&O)PCpzUSBy8nBe{A+Xs+p-ka&OHBENIE{PxhSd}w-w3dCp?GH$` zpS>mGiuiC8_;Bx_KugU|bCA0>wfZDCS-^2(5M8W-YMvTxfNY==L$bBC2YUPN0M5+T zKeou@OM0M+A|^{~9`1YOW+ATPj271kAmUwZ5(!;L}sf$j85v-6nQIMsVamkOb$1Uz?n((f9!sYH61 zN7tNNLXv>PT_Xt-u!)@{$by9EhCcbqjWnKgng!P$$$AK7znam}JO6XWBDy)+p;8-b0Me!5%kHO_{%KSOUEqL`{P;gD#XRXtUoP`UL?;m7T_Wp50aEaHYS9vI z)T$kw{0Nk#>i1@6?Y&X!zdVR1z}orqNQXapQP|63qkw)v9a3WVPw&DY9w*MC%_3rC z1<*Zy=?mq;N;Vm~1$7+U06D(=|4hCz2v@@Z^jukIEZ+k@_6L08Z8`$P)S&m|WnAqo zw2Sb1;%(_*$q0rAe}lqzS2_O|emOAa3mVsyDQniXO9XDC{Uh>NKt}#kv~A-5c=7*_ z2NZ~VKy}2#B=Gzn!UzIRu07>whnxhY8COvNC?R6v7qtBpOw{0S00{U0gKHz|65#pI zQh>z&@o(_xOG0V=*$As{XHAVQTVGTpH&Eul6_(g0p3KM$w5)gvyx1SlZ3phD#b zfQxjOhPoApopV@acAd&E%j@!*eBy@us0*DJ{IQtDooBMAtf0G@sp-t}X)bl-y=1%A$aDN&^q}*|$_ggI@}t7e?(SkT zM&4rOAiP_J<@@P;W9C``&i2slHmmY27Dl5=$4Q1E#P*HiwmQfVw*61nL>2FzT97aL zV@^m%L*Ah}Au!it$oCDwItv2lPTjt7oGfnY5_rzU#0VUkoc`ZF;Tq$+?e+(I1GuRI zw{!J^sSTR7{z!l?gN=>T)FU^ITH&LF(NUXi`%QM(_xXW?WumWOZvd$UKIjX#jE$gNVKiire3*B1y5h`)#nKJF)PaD*&aFLErEzBY`TnZgIuw1B zNIUr2F6cN~n}9p$2saeA&fJCf7kJn;kmL8*t=HEObtjGq$>|d0@ceE7@^px@qi z6P-8_dcn226Os>uTZtnOml_vk|YD}`O-{IWH^AFNEBdK`b zT4A3dI|8;UM`^GzF@&sRuVv#TCec=0wG}_E9`ZRSk-L`NaL~GLANA7r$|(Sj5SJM+ zH>x?fA$hX5Ku5K^yL^nM8j^U#l>ZeAM-B+H@Sc_?6inTWzGzu7T}#=AIvGp+zLoZnE45 z`Lf;!D_Cv;)iVpyBpI*>fCRU?}YgUprJ2kzs|(V7e5{4K-=`4b{g{ zU={?6Jz$AU5F=h5>i#5VF}o>S*)k0c8Nq`EvH&j%&8Nw)g_3!htlsV1Q^`|MUUz7C z!z0Vc5af0q_FKg|&DNBsVED`J+@Kl8W7Ih%0l!I==nnIpm$1O=BWwXa4`X+3R>L4G zzXx219~SFnRYv?^${oMf$=&5Geu(^i+H$}?%jFV@3AXW2_Y2H+&>h{jEjn6J(PHhs*s}4QR!Gn96{Mi1c zaB2UybA>oDd;?ZimKS2%y#rve)!DlTZCFZv>V*WnAXfF;2SLuJ~Lie z=DTo{NqJXVW-YgcJmNM!G&)&hJfuTTW%^gzG%azLXyp~mLpG$*&(zMiG95|ks}^77 zq^G5=t<(VJ7m?Gp^Wrd$grQU5L)FP_I2_C-gC1?rbGJ*rH)v`iLut}+Q zpAxYD*N7>-)=L+c{JoK_tUlW3eTp`!mBmu={e4Ch$=$D3KT;EtMf@5WuM{*t*5{{( z8kCfwepe)D^C@KU|?9Q7S870PMa6{iUHkr@E)1l-Hg0D>wiQ2Rf-Mpc` z@%V~F0ep{VMHqT5@X5g`aQW`&Yn|8nPDxf1hUSk0OQn4tTH%{C;OJ%Jld!+3fZ8=c@RlCLD{ZYFl_ex!~d93war ziwby|Uir8svDzv__1|Aq1Gp3z6;D5=#HJDYO7RS)THSl>afC`-=Xe1^f#kFVlIe7l7~mE zBxl}mn_FcrTyUD&tk_)U?g0o%%+5X_W-;I=;HD@5B1r}xqqQs9OPTro>2a>oVceLO z>6?~Vs+}$Chu{`4o&h_rkjwJTy!EW7z>vG$WB!=sPzDH~x|NK5&J|aH`{D0Bd6*t7 zVKn#gxp5)x3}@Tb)itEy_sVW314wwiBn>rK*jg5(^lJ?0Pi|hRQ`I#Wb1-u}!))r0 za9SJxg@sEr^zs(01WBKj;=sY7CAb|2?N&)bC!ZvNylpose3*a3G4I(y7j%(P!e?zr z8e+Kf@^lFHlSk+^tK zngKxZXO>r7zw6?z+Q*RD%tK}@9@XC`da{}QDNa>D>cs24HG`)5#uiTM-Ok&A@?A(1 zM&55XdsSr(fqG!6pwMW9O7oYn)G9Fdab*~;9$Le3OvB-v=@Jd^CLp_?=2>kBljWN5 z@Qfx(lzAn8HxpJ; zFTHnB*HHIxDXQc(Ze@S>?{qT9Q@?}i+ zCXgMV2ICLrw)3kw{B{=$25K}S4E4+!H-_=`pKLhw_0e8fi54pqp?gfAuXcqc$n+4# z(&pC?upso}?X;!>BNJmJdzZ@U>Iq|b0?)wh&d$Bo3w}RJz^-B4)-WEKO|C7LC<`q6 zMdj*{wW!J;zx9N#17j87Bdy&E!mb@bJF5RI=b3s9-gQ1&*Icx(Yq^I*qtfdenQ zadW;_MKizzd$?8G=Jt&?BlW}}0a>L8biuItcCr5kITOh;sepPt@GDKPOq)2ztGDKS z0Q{hSh@?5sO;{y%$286?uZ}m9N3y53_8&x?9K={POZnFKAf;O)Qyn9}JU4(^_Q*F%SiBF={04lxm@>Hk zlHnO3?CAg;DPZ$&jhV&;zAc~gxDx6Ms&@qpQ3`p0WB^tJNbk|#!Um{fmxxL8rT13= zGNq#yykXFyfSVT3^Gu%#n8jI`%0`JyhqVz9Jpv;X0L7?G(zn{5ZrNgYZxC4@#Wu~S zr@%6O-W~toj8rZ_8{-p_68P?Zeg$OxpU{84lM8(NJCiXI#(#W*LqR6V!$5*g{VUMV za;?`|tv}Q@00)!IWTPXk{{SqH-bz~Al^?_S997{w^045(3b4)(jFzqlv|HyxPSScJ zT~&GJ?9dx->jy?-_a&5Wb~RL0J-qsiv^~=3HSZl;+i)5_ZZk&-uc;uC$MUr8#{g2z zaQt@_d7k(yAy)uyP6Y%lbuZcL6`p_4!-mC_-15oc6&3(?#P!?2oJPRQsT@5lEhyzO zk(jPX4VfjAn}x6?3#l^T?gNH60V2>O^Ka&k+}=8m9L064En2U%?1n3;K^nsdTIVtVEn?q}Fh}5F)9GI`! z^*S==;f)j{#$hkWm*^|UXa$qV-#g`$mX>Dh8k+ShCQld|C8_@y1=P4JJv6a65%@JO zcke}@kFX~`9YB`G!QtD%kjNEFVBt=m01ihphkX#QV{bbE^v{>5w!6D4UBk@H2~F)KtVV+)nk26@}8|5wo9_ zr(!*>17~)dxTr$;@b(;L(rf`|Th|!v`N4#Q^aSmd!9GZW;S4n>i^k)1Ei{QxWB-6) z>&6L*v^VDaI(fKd-QNbHe-HvV<|;BS#a#9MoXXSm@59#j% z}LQ zRt@v6S*R>S&we^O<-O4L?1T23(spK$Jh43f8Z$}uY-*ycyyCv?OA73N51X-ua6XZeX^j9+&E~i5HI6$x-!f=&gnQi5dep2w*AB9v+z7_3)9t%thFY$(2w{@V_QZMUXH(1 zT1WMjul*>H;WQCR_m~h`RY%BzhR?@0tz5)+WLbn)5|nDDDg@~KEp+`y$@b52}X}m_vG~58y=uN$k?WYFZA$N{w89!;Pj~- z#LoS^XEIJ5%(vyIDNx`HN=cT;4=#7;9S~7(du;=n0t!z6V=jT5m%nW*;L1xnP)ecy zpKF$Tn>_rS7nkH#flAlg3k!Kb79>d{N*K>Ac7H?ya)WG~yYFv0Vr=o|45-9q9ROOn zzP#M~YB`vb8g_ggnifZ5zp&L>eH%$DR}G{+hU+a{uhOim7CSZ%C;b`%>C8-!f1=6h zzMfgZdvU4#7>IG+woF)Erbz-0?~kB~#mJH!`tkeqwW^1k)QZ;b)W{?vyDm^kttTnx zAdR3Ga@1taQIfvVVI(;fl}5hQ?bv=~;;ToU#N-a}8q;$EBBWfL_$}~C-ctB2p2P~F zUmjamvs6nq@_FkFDIow@XeT}#L5ov^4fm1Ep%U`{AAklSn_p=C|ibX4g zZ8zwxCSb?_7Us+kN@c%l2S2_&ZZTAO46tZh*w!_tZ1Mp3;q=nLmoXr@g?|?MlGhd5 z(UrGCK=$2Rl;rG-A@G&dz;;xYd#VpBE0(8SIsLMuBS= zMO;sb_SJH2C@giiVYZJY24D*JHg(6W7~P@=3ML?WAejf)Av|!R1*7I|u7=R!?aMKr z$g|uVs{+m86buq$u|SE7NJ$&11bkWjK#lXreNR)7Q!WnB6Xv8;UEn1t4~Z{Xs}lNI zpJoDIBCg{DPegu_uL?V`if%x4X1NzZuF@p=jkq0`mA^0t*^icUL|Of+13FYA|CSfe zE5`d)GfHg<(6Z|XbaG=Jd_tTfz(E7TGW^`qh^zh;73>*lzR}<^Xu6a~2IR4JdDwmi zNN$#vug}4rWr>Gd5ZZ)iOeIfHQg7G3#vx5YvE$%e_RNrQ4KJ`R5}HoLck&Om@CE zl^NO9MJamj2-ro8k@Ps}Gs?PmXwn?(*UAaLJC(-ZxOMk*pBg zx2My(eh&l$Dzu}mOvS~|9)fjsM`o(+YRwKAn%&lFg+%#1MfGL{ks@r}~z-ql$`(;zAY#g^3#1c}t|93$5IVhQVAe z;N&RTLhy?KEY~xMPo<{^lC}M+u8Z}yp15|OwjO79PjAf0QLMSY&n^&NwATM%Lnmbh zgr4vYZ?CSb>Wz(=)%?UbAXbqmT|{kPj;I^G=$fc33kxSFC+f!J50Q6z#I4~bZq3)v z;lB)h?5St!M`B6g;Vf-#Q*|yrR(0pY3kz0S2@q%a*2>C5&c-gDM6*Wk8(Y(Yg~1kZ zFJI4!X6ynfPC?SwFp>7Lll$8A$S}X9c0L~I*%;CCi?d^imn zmq6(Ka1P~bgSj7-zhs>~Ju~)NXy#Lw4kVmN7UOxRilIJWY>Fi%(7$DQv@*rS}cQuX-hErI$40TcvS8SUKC^=8GeN=vqSo7*}=>(hCCOWkxT90Adxae;7zlKz(3zB*^_iPW-kugBvO!7fI+q8s6>XeM*D7zNMecMB{ z*5!LCqM{0_g}}|`Oj7>uI>40QN#E9%uv0RMv(dW2$u1iO&`65^(#m|QWHtEIbGCDS zULN^YN^p7epgtTkItvRJ4Ti+AmY-|kjy79t_V~q%`YV=G5$e3!HDJtO^+rFCIFfbP z8Bt)Gz0wzBRsN3bw6;=;c#q8EeIKWbba8gGNcjIyFZd?wi)XKhZM$uPfma9@NYyzJ zn2~d)*n*?&JzcAegV`*+y0iuH~-t65ccC8#LlYXElzNm32-%e>KSPLiWvyCq&rg z#E0w9C*{oVdElo#`Awhak;r9T{ZLJFF&JbmK$`CJfyJ-iG3bYa!1R!+yWYu+nA zuT=8qtE^F$z}u1f-rcLY^3yW_L8k?GLSuuUl+a5(EBRJiPl&Z_rjZO9BJbgx2n`p! zTkAsgf|tLpluz2JSf~&_(S@j1$~3=$44_QZZZb5=7vOEaNQ7T@zSBSpkh=2@gHl8} z0_)_>>w50qT?+{Cr@j}lwzb)|4zBTBL>2yFK!ohfrS(fUg?J@ymrzpzsgO(Dx9*gO zHCWA#NSzty>D3-nKE3N(KiXf#pWgVpi$zjT2H%h`Ek!4|J}IxDRHnwJs=NJs=cR%x z_$2@rN=~nrXE}H{Nb5M;<~B1|=1F@vQSaj;-T0||u|8Yld)uAZHYS~t36DNwe%8H( zHeXDubeU8$a1SSd{6-m^FfcF}k9$`iP;+o>%*}-MZp^T3GWW5M{jp^%g2SF(?Bd;7 zL+82N_ysiT_vA_7oxf=04&?w>RajngTDiCOPp7*|&%C719|2kDPqz`M-5yB`uFu=d zn05*z3$e^z_|sLJu;IHI``Xh$7YhRG@h@- z#+Ih-aC;gpQj1zdop~Iae0Q4ak(!$?Yt5LO+j*!kl3c1GK&efVD!+1NcmSvZJrPUL zp1RigC)zA8L+E8}Zg4K66T(*f!l+azUF71VXAdwN&y^x92I4y%NBh_s%mN;=n+}#I zmY6uXKSsT6s@v^e0PkVJDH?!9<$l0bX`>SwE(2W@8nAy9i{appOPe+iNbcO2WPTT>K+d~E-t^D9 zF0oc8!AlDtAKallm3hPJu-B{hPWn0j$%>on)8ETqUu!wHGVKzx@RM7c=BPhaxwAfe zewW?OpFjWqO`uifVVlXtS* zuJ?}B)z$1vi(VXXoZDo*_Sb!W+g+v8>zPz1nXI^fVE*E|mv=rs;$K*_<=n~BH@D`W zZ;1OFr6E%P=WF`;yyxt$?5x|uwWgd7)4gt$y?5^(f3^8jzS}>3m{}xP{jgr#U(){M zr1=+@OsrtM!3VzohC$j*E3e2buhXvN%ZCZG^U4COa&AfKhFgRJ*Ct#$dit`rU+Scj zCOIe8uCDvHa>1lzcgvbpG7Z|lvtBCg^svi$ zk^4V(>z<C$J3&WDW7&57Io@w#K}@A7w7Zu;4oYg}1>bHlrR zyWd$BJh^c3NAf(md2_8xc=E(mwy*#3vAWdzv*-y{R#v;UQTN5|q84~6zGm7`2y7bf z;8~Iyv(YGU+SIvk-@Z&u4UL=`vwPi+SmA=m6I&Pp>VZmtpuzWnnFokL-KBA$O=%Ra zuER9q&;K{q8$sqaDAd1p)awSaA_NkEq!^0?P>_`oxa=#z5i}q-DojC`C;~(D|9|sX h-lsqY8>sMNX0Z4rwfwMQBWS9N!PC{xWt~$(699}KvUmUh literal 0 HcmV?d00001 diff --git a/frontend/index.html b/frontend/index.html new file mode 100644 index 0000000..5e16d5b --- /dev/null +++ b/frontend/index.html @@ -0,0 +1,17 @@ + + + + + + + 登录体验预览 · IAM + + +

+ + + + + diff --git a/frontend/package-lock.json b/frontend/package-lock.json new file mode 100644 index 0000000..57bc869 --- /dev/null +++ b/frontend/package-lock.json @@ -0,0 +1,1280 @@ +{ + "name": "iam-login-ui", + "version": "0.0.1", + "lockfileVersion": 3, + "requires": true, + "packages": { + "": { + "name": "iam-login-ui", + "version": "0.0.1", + "dependencies": { + "react": "19.3.0", + "react-dom": "19.3.0" + }, + "devDependencies": { + "@playwright/test": "1.63.0", + "@types/react": "^19.2.0", + "@types/react-dom": "^19.2.0", + "typescript": "7.0.2", + "vite": "8.3.1" + } + }, + "node_modules/@oxc-project/types": { + "version": "0.151.0", + "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.151.0.tgz", + "integrity": "sha512-J1yXrIlNDZVzE3ada310xeAw7nH8yCAyLPuUIsjKatFPmfn5bS1oW+cM+QsGOtVWd5nhSpbwZWx/rue+r5Z+PA==", + "dev": true, + "license": "MIT", + "funding": { + "url": "https://github.com/sponsors/oxc-project" + } + }, + "node_modules/@playwright/test": { + "version": "1.63.0", + "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.63.0.tgz", + "integrity": "sha512-oxMK4vllB9RK5NQ2l1pq1IfOf2AvnEuj/vYGDj0H2nMtmtZpKtCwt/l00GEO6xjGfpBNAvjovvYdCm50dRQkpQ==", + "dev": true, + "license": "Apache-2.0", + "dependencies": { + "playwright": "1.63.0" + }, + "bin": { + "playwright": "cli.js" + }, + "engines": { + "node": ">=20" + } + }, + "node_modules/@rolldown/binding-android-arm-eabi": { + "version": "1.2.11", + "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm-eabi/-/binding-android-arm-eabi-1.2.11.tgz", + "integrity": "sha512-A5kXfGKvKWWZE0TtPrfsvT+q4Y5d1QG8gGUzpYjGydM+fARM9MuX90PrXYXe0XbsDVgyxxNzHo6giCj90bsFNw==", + "cpu": [ + "arm" + ], + "dev": true, + "license": "MIT", + "optional": true, + "os": [ + "android" + ], + "engines": { + "node": "^20.19.0 || >=22.12.0" + } + }, + "node_modules/@rolldown/binding-android-arm64": { + "version": "1.2.11", + "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.2.11.tgz", + "integrity": "sha512-z6cTycz+iJ4PVkuL4HHW4DfTfoeU/2nqYYuSOrTmH7yHK5Y0LCOnA03V4ZNxavyVaU1oOqUgIg2klN/s+USGOA==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "MIT", + "optional": true, + "os": [ + "android" + ], + "engines": { + "node": "^20.19.0 || >=22.12.0" + } + }, + "node_modules/@rolldown/binding-darwin-arm64": { + "version": "1.2.11", + "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.2.11.tgz", + "integrity": "sha512-jShvqNtP6vDC6/A5JOAzbVV+DkgHqhl/ScVCJEbt+TUY6QYz7YnXcrg3sLtFBniro0f/Ld50ZwCWA6f7KYD1nQ==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "MIT", + "optional": true, + "os": [ + "darwin" + ], + "engines": { + "node": "^20.19.0 || >=22.12.0" + } + }, + "node_modules/@rolldown/binding-darwin-x64": { + "version": "1.2.11", + "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.2.11.tgz", + "integrity": "sha512-f2i2xiNWq1Z1l2++q2fuhZRdLAT3aqxD6vRNm1RAxpUoBcdqNB3C0s1Bt+K+PbEx2F5F4gQp6hqKkphCY/xF9w==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "MIT", + "optional": true, + "os": [ + "darwin" + ], + "engines": { + "node": "^20.19.0 || >=22.12.0" + } + }, + "node_modules/@rolldown/binding-freebsd-x64": { + "version": "1.2.11", + "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.2.11.tgz", + "integrity": "sha512-4Ir5FSOKIAMr4r0kExpt1s3bMgzJU3rA45AYOHtQpls0oNeqcYBKrWMlckrYH4KCfGLfkfn1tN1dmZPMVsdXow==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "MIT", + "optional": true, + "os": [ + "freebsd" + ], + "engines": { + "node": "^20.19.0 || >=22.12.0" + } + }, + "node_modules/@rolldown/binding-linux-arm-gnueabihf": { + "version": "1.2.11", + "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.2.11.tgz", + "integrity": "sha512-/gnRDM+39BROzAN/k1OZjDPnDMcZxB/0EUxKjONO5yVkNEvlsoMDrxGNKgZi/ttFriS2gwlDNzB65pvNbFOXIQ==", + "cpu": [ + "arm" + ], + "dev": true, + "license": "MIT", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": "^20.19.0 || >=22.12.0" + } + }, + "node_modules/@rolldown/binding-linux-arm64-gnu": { + "version": "1.2.11", + "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.2.11.tgz", + "integrity": "sha512-PFaK8HwvAHbaKbBcDNQihjMKYvFnA5hiENx/l5tphTDz1E0WFp32l0A7aq7lyUwGsRw/xSrNIy/gIK4thrSCrw==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "MIT", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": "^20.19.0 || >=22.12.0" + } + }, + "node_modules/@rolldown/binding-linux-arm64-musl": { + "version": "1.2.11", + "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.2.11.tgz", + "integrity": "sha512-AskzJUIKRLPxkruR1wLKewGbOw+EYfU/9lOrBFj4AFrEA8hPpKFnODWNu2WLaNs0QNkEb9QIJufmVZZIL/bJlg==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "MIT", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": "^20.19.0 || >=22.12.0" + } + }, + "node_modules/@rolldown/binding-linux-ppc64-gnu": { + "version": "1.2.11", + "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.2.11.tgz", + "integrity": "sha512-qlUGAheh2yh8afH7QBgx0PrRHN85hKnNd78x8MeMhXivuevgd8vgf6/CstOzmNKY/lLTHvNTrPy98cLnAugzJw==", + "cpu": [ + "ppc64" + ], + "dev": true, + "license": "MIT", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": "^20.19.0 || >=22.12.0" + } + }, + "node_modules/@rolldown/binding-linux-s390x-gnu": { + "version": "1.2.11", + "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.2.11.tgz", + "integrity": "sha512-secpEad+0vCbSfn8upFySkDskv+bGPk3THSDS9Y89yc4rb4kzqHp8Dmyd9BkQW4SnhNXBZCl/6CrO//hZahNJQ==", + "cpu": [ + "s390x" + ], + "dev": true, + "license": "MIT", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": "^20.19.0 || >=22.12.0" + } + }, + "node_modules/@rolldown/binding-linux-x64-gnu": { + "version": "1.2.11", + "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.2.11.tgz", + "integrity": "sha512-mOVBT3dPpkWm8XBWPmU4bf+U6dYDLeMo/9ojUmis4N0L5uu10qra5vOyngZ7/PSdoE4G9KvRt4bloRxNjLas7A==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "MIT", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": "^20.19.0 || >=22.12.0" + } + }, + "node_modules/@rolldown/binding-linux-x64-musl": { + "version": "1.2.11", + "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.2.11.tgz", + "integrity": "sha512-Is78i9A8Ui4SqcxUwFJ9uMmjDn58IbVTjFWYdQestFEgeuEmHMLGNriXnVJKkwG2YiZjw8cP0zCTyDMdDGtOOg==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "MIT", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": "^20.19.0 || >=22.12.0" + } + }, + "node_modules/@rolldown/binding-openharmony-arm64": { + "version": "1.2.11", + "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.2.11.tgz", + "integrity": "sha512-dUCXneZ87INUMyQ0D+C0HrEBNUPNXHaPmU5GTjyKTJEiussw9Kaj5Ln8UztPe4epV/ffvgNBEadksdYhmW6xJA==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "MIT", + "optional": true, + "os": [ + "openharmony" + ], + "engines": { + "node": "^20.19.0 || >=22.12.0" + } + }, + "node_modules/@rolldown/binding-win32-arm64-msvc": { + "version": "1.2.11", + "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.2.11.tgz", + "integrity": "sha512-jByxb6qfd+bH1xUd0qnfFnb17i9sWBPY2tOavJ0l3tdr3OTu+Kvtm8cd/JV5nFt657b1VqGltxg9olOEfofXWw==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "MIT", + "optional": true, + "os": [ + "win32" + ], + "engines": { + "node": "^20.19.0 || >=22.12.0" + } + }, + "node_modules/@rolldown/binding-win32-x64-msvc": { + "version": "1.2.11", + "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.2.11.tgz", + "integrity": "sha512-/PzKqzAJ03i19oy2ItPvyvaVjOjBCNnfaJs8yvUdGBKmiESgnrJSQ2awd81QzFbbnAmu7YO9ZnJrDCb9VSJPRA==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "MIT", + "optional": true, + "os": [ + "win32" + ], + "engines": { + "node": "^20.19.0 || >=22.12.0" + } + }, + "node_modules/@rolldown/pluginutils": { + "version": "1.0.1", + "resolved": "https://registry.npmjs.org/@rolldown/pluginutils/-/pluginutils-1.0.1.tgz", + "integrity": "sha512-2j9bGt5Jh8hj+vPtgzPtl72j0yRxHAyumoo6TNfAjsLB04UtpSvPbPcDcBMxz7n+9CYB0c1GxQFxYRg2jimqGw==", + "dev": true, + "license": "MIT" + }, + "node_modules/@types/react": { + "version": "19.3.0", + "resolved": "https://registry.npmjs.org/@types/react/-/react-19.3.0.tgz", + "integrity": "sha512-N0rFCuH9YoxG9/m61l9MfpJKfmLOVU0em7ipIz6TRgSSkvReLB9vL85GB+yr8Bs5leqpvg96JSwF4ZS1s4viQg==", + "dev": true, + "license": "MIT", + "dependencies": { + "csstype": "^3.2.2" + } + }, + "node_modules/@types/react-dom": { + "version": "19.3.0", + "resolved": "https://registry.npmjs.org/@types/react-dom/-/react-dom-19.3.0.tgz", + "integrity": "sha512-ZI7bU42mZXXKHn/qNLEw2IrbiINU7X5+vfgdixBHkCNpYWXjKgfQ/P+uyGb5CjOLB9UcnTeg3rylQtV2hym44Q==", + "dev": true, + "license": "MIT", + "peerDependencies": { + "@types/react": "^19.3.0" + } + }, + "node_modules/@typescript/typescript-aix-ppc64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-aix-ppc64/-/typescript-aix-ppc64-7.0.2.tgz", + "integrity": "sha512-MTKKkWB7p/0E9xi1d1tHtZ5PiLkGEMIq88pK2CubZjOsLtYTLqhgIgi6zepFa+9GHZ6h05NMCkQxGKiPXMxXtQ==", + "cpu": [ + "ppc64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "aix" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-darwin-arm64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-darwin-arm64/-/typescript-darwin-arm64-7.0.2.tgz", + "integrity": "sha512-gowzar9MwS/aRWp6f3a4KUqzRjAZjOsmGNCM6LcTgXum+dBfgsBVMN+AgvOCCbguXyick6LJhpBszxMebJ8syA==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "darwin" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-darwin-x64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-darwin-x64/-/typescript-darwin-x64-7.0.2.tgz", + "integrity": "sha512-SZ9xZInqApNlNGc9s0W1VSsktYSOe9cFqNOIqmN1Gs8SmkjKZYFt017G4VwPxASInODuAdbTW7sXiFUf893RgA==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "darwin" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-freebsd-arm64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-freebsd-arm64/-/typescript-freebsd-arm64-7.0.2.tgz", + "integrity": "sha512-W5NH4y/J0plIIS5b2xvTEkU7JFxyqdMAOgf+Ilhl0vHQXKO5dZoxd+C/jEtq56c4F3wk71RB4BMRQ2XdI+bwYQ==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "freebsd" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-freebsd-x64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-freebsd-x64/-/typescript-freebsd-x64-7.0.2.tgz", + "integrity": "sha512-UMGDx5sTpzNw3WiPebH7l90IWfJggEd+egHt/q6p7/Cm3zqoV7VxkGXt+3DxPIw8CcmvAB0j3sVVfbhX+M4Tpw==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "freebsd" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-linux-arm": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-arm/-/typescript-linux-arm-7.0.2.tgz", + "integrity": "sha512-gffT3xPz9sR7j/YJExkyPntrI0P2EP9XbOyWzth2/Gs0RstK+90RBcO0ncXoXy/beYll1SXw846Nf2zdnEz0QQ==", + "cpu": [ + "arm" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-linux-arm64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-arm64/-/typescript-linux-arm64-7.0.2.tgz", + "integrity": "sha512-Qh4eU4/y3yDjnfjjyPYihMj5/ODIlmt+Bzu17OI+fiSRDW57QmU5SiN63exPRNJPKUzcc1INa1NXdrJ+MqHjUQ==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-linux-loong64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-loong64/-/typescript-linux-loong64-7.0.2.tgz", + "integrity": "sha512-uEHck9i8hoAzXPiYRib1O7miOnz23SxIeVl6F4LXox+qov1K35jHcEW6VHKvZI+pyvl7fZEP4MCU5LYvIq1GuQ==", + "cpu": [ + "loong64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-linux-mips64el": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-mips64el/-/typescript-linux-mips64el-7.0.2.tgz", + "integrity": "sha512-R4KvAMnE43W5Qeqb0Ly56O3mWMWIAgsMyz36DCaycd5nbg/9kzm0liw3JocfRqyJY0KPmzFjbswozXyW0DnIYA==", + "cpu": [ + "mips64el" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-linux-ppc64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-ppc64/-/typescript-linux-ppc64-7.0.2.tgz", + "integrity": "sha512-DORx5b3sd/4S7eayxm4FQv+A7CrkUIGRaHiwI8oiHTAI1fAPWhF4J0vAlkC8biAlHSVVwxMQ3tjZ2/DVbnQiiA==", + "cpu": [ + "ppc64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-linux-riscv64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-riscv64/-/typescript-linux-riscv64-7.0.2.tgz", + "integrity": "sha512-wf0jqEDOjrPRnKwYRyyJDRo11KMbvMFrU+q4zqKyChODBzvlkbhNQfKvLxQCcwTpdDaXSHZTVuh0JoCrKCUMHQ==", + "cpu": [ + "riscv64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-linux-s390x": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-s390x/-/typescript-linux-s390x-7.0.2.tgz", + "integrity": "sha512-IkwJc3L7yhytWd/ewjyxNDfOmswCm9GWMJT/ue/dU4aZNbwZeYAetq42VyLmsmSjvoX7z74X6ZaYCtzAr0EuGw==", + "cpu": [ + "s390x" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-linux-x64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-x64/-/typescript-linux-x64-7.0.2.tgz", + "integrity": "sha512-EYdf2cNg7rgCWJnxCdJ+F3V39O8ihb37eHAu1LK8oAFizgTQbPOK7zHHXbPt8rX24COqODXeI3sIf0fCXG7H/A==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-netbsd-arm64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-netbsd-arm64/-/typescript-netbsd-arm64-7.0.2.tgz", + "integrity": "sha512-+polYF4MF04aPpO5FTkHran9yUQDSXqy5GiSDKpsll5jy3l3+g9QLhpf39T+ePtefhXLOGrLl0QIjkQP6VnelA==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "netbsd" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-netbsd-x64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-netbsd-x64/-/typescript-netbsd-x64-7.0.2.tgz", + "integrity": "sha512-8YIT0EHM/3dq10ZOVF/A7pc/YSMtbcecct4rWtexrnSCHOPcpC2KTLXfTCR6vDpnSiY12heNb1GiN/wu+T/FyA==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "netbsd" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-openbsd-arm64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-openbsd-arm64/-/typescript-openbsd-arm64-7.0.2.tgz", + "integrity": "sha512-APT8+ClYnuYm1u9+kgGXoMj2VzWzcymwh2gNSQVySHfkRDGOTVkoWLjCmOQSaO+PoqQ57B0flRp9SA+7GnnkzQ==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "openbsd" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-openbsd-x64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-openbsd-x64/-/typescript-openbsd-x64-7.0.2.tgz", + "integrity": "sha512-yX7s+Q0Dln0Dt9tEzZsAjXXR/+ytBM7AlglaqyeMPxQszJ1JhlJdZ6jLA+IzldHtflX81em7lDao1xXu+aRRkg==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "openbsd" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-sunos-x64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-sunos-x64/-/typescript-sunos-x64-7.0.2.tgz", + "integrity": "sha512-dLJDGaLZ1D4HPQn62u1n8mBDkJREwMsAkCdkwd4Ieqw+x3TUyTsqY0YiBCtE6H6OzzgGk3iuZ3vFWRS+E8/d1g==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "sunos" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-win32-arm64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-win32-arm64/-/typescript-win32-arm64-7.0.2.tgz", + "integrity": "sha512-Gyl1Vy6OsWesLzmq+EP0Fb7b4Nid5232AvcA2SFcdYreldpNtYFFofPjnt62y9hQy7VTaZp65ICJjuAQRaVcIQ==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "win32" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-win32-x64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-win32-x64/-/typescript-win32-x64-7.0.2.tgz", + "integrity": "sha512-0BQ3HkAHHlKLSp1qRvf3SUhGpGsDuhB/jgFw75guyqbxJqEaS0Cw/VFO8i2nHglJUzQCRtMMR/IBAKE3ETMC4g==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "win32" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/csstype": { + "version": "3.2.3", + "resolved": "https://registry.npmjs.org/csstype/-/csstype-3.2.3.tgz", + "integrity": "sha512-z1HGKcYy2xA8AGQfwrn0PAy+PB7X/GSj3UVJW9qKyn43xWa+gl5nXmU4qqLMRzWVLFC8KusUX8T/0kCiOYpAIQ==", + "dev": true, + "license": "MIT" + }, + "node_modules/detect-libc": { + "version": "2.1.2", + "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz", + "integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==", + "dev": true, + "license": "Apache-2.0", + "engines": { + "node": ">=8" + } + }, + "node_modules/fdir": { + "version": "6.5.0", + "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz", + "integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=12.0.0" + }, + "peerDependencies": { + "picomatch": "^3 || ^4" + }, + "peerDependenciesMeta": { + "picomatch": { + "optional": true + } + } + }, + "node_modules/fsevents": { + "version": "2.3.3", + "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz", + "integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==", + "dev": true, + "hasInstallScript": true, + "license": "MIT", + "optional": true, + "os": [ + "darwin" + ], + "engines": { + "node": "^8.16.0 || ^10.6.0 || >=11.0.0" + } + }, + "node_modules/lightningcss": { + "version": "1.33.0", + "resolved": "https://registry.npmjs.org/lightningcss/-/lightningcss-1.33.0.tgz", + "integrity": "sha512-WkUDrojuJs0xkgGf2udWxa3yGBRxPtxUkB79i6aCZLRgc7PM8fZe9TosfPDcvEpQZbuFASnHYmRLBLUbmLOIIA==", + "dev": true, + "license": "MPL-2.0", + "dependencies": { + "detect-libc": "^2.0.3" + }, + "engines": { + "node": ">= 12.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/parcel" + }, + "optionalDependencies": { + "lightningcss-android-arm64": "1.33.0", + "lightningcss-darwin-arm64": "1.33.0", + "lightningcss-darwin-x64": "1.33.0", + "lightningcss-freebsd-x64": "1.33.0", + "lightningcss-linux-arm-gnueabihf": "1.33.0", + "lightningcss-linux-arm64-gnu": "1.33.0", + "lightningcss-linux-arm64-musl": "1.33.0", + "lightningcss-linux-x64-gnu": "1.33.0", + "lightningcss-linux-x64-musl": "1.33.0", + "lightningcss-win32-arm64-msvc": "1.33.0", + "lightningcss-win32-x64-msvc": "1.33.0" + } + }, + "node_modules/lightningcss-android-arm64": { + "version": "1.33.0", + "resolved": "https://registry.npmjs.org/lightningcss-android-arm64/-/lightningcss-android-arm64-1.33.0.tgz", + "integrity": "sha512-gEpRTalKdosp4Bb8qWtc2iOgE5SeIHlpS1up9bFq2wAyYhl1UdTObYiHe98zEM9SQvSoqQZ1IQD0JNpg3Ml5pg==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "MPL-2.0", + "optional": true, + "os": [ + "android" + ], + "engines": { + "node": ">= 12.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/parcel" + } + }, + "node_modules/lightningcss-darwin-arm64": { + "version": "1.33.0", + "resolved": "https://registry.npmjs.org/lightningcss-darwin-arm64/-/lightningcss-darwin-arm64-1.33.0.tgz", + "integrity": "sha512-Sciaz8eenNTKn9b3t7+xr0ipTp9YxKQY4npwQ3mrRuL0BAVHBLyZxofhaKBAVtzmtRZ/zTyo0/to4B1uWG/Djg==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "MPL-2.0", + "optional": true, + "os": [ + "darwin" + ], + "engines": { + "node": ">= 12.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/parcel" + } + }, + "node_modules/lightningcss-darwin-x64": { + "version": "1.33.0", + "resolved": "https://registry.npmjs.org/lightningcss-darwin-x64/-/lightningcss-darwin-x64-1.33.0.tgz", + "integrity": "sha512-Z5UPAxzrjlWNNyGy6i65cJzzvgJ5D3T6wMvs+gWpY9d7qRhANrxqAp6LhxIgZhWEw18RfJTGcRxjuLIBr+m8XQ==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "MPL-2.0", + "optional": true, + "os": [ + "darwin" + ], + "engines": { + "node": ">= 12.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/parcel" + } + }, + "node_modules/lightningcss-freebsd-x64": { + "version": "1.33.0", + "resolved": "https://registry.npmjs.org/lightningcss-freebsd-x64/-/lightningcss-freebsd-x64-1.33.0.tgz", + "integrity": "sha512-QQM/Ti/hQajJwCY+RiWuCZ9sdtI/XQk7nDK5vC8kkdwixezOlDgvDx7+RT+QjK6FcFT4MpsuoBnHIo/O3StRRg==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "MPL-2.0", + "optional": true, + "os": [ + "freebsd" + ], + "engines": { + "node": ">= 12.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/parcel" + } + }, + "node_modules/lightningcss-linux-arm-gnueabihf": { + "version": "1.33.0", + "resolved": "https://registry.npmjs.org/lightningcss-linux-arm-gnueabihf/-/lightningcss-linux-arm-gnueabihf-1.33.0.tgz", + "integrity": "sha512-N7FVBe6iS24MlM6R/4RBTxGhQheZGs7tiQ9U32UtF75NzP5Q7xWPRqLBCKxlRQRk3rY1jCIPLzx7WzOhuUIRLQ==", + "cpu": [ + "arm" + ], + "dev": true, + "license": "MPL-2.0", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">= 12.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/parcel" + } + }, + "node_modules/lightningcss-linux-arm64-gnu": { + "version": "1.33.0", + "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-gnu/-/lightningcss-linux-arm64-gnu-1.33.0.tgz", + "integrity": "sha512-j2v/itmy4HlNxlc6voKXYgBqNi0Ng2LShg4z7GufpEgs05P+2suBVyi9I6YHq5uoVFx9ETin3eCEhLVyXGQnKg==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "MPL-2.0", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">= 12.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/parcel" + } + }, + "node_modules/lightningcss-linux-arm64-musl": { + "version": "1.33.0", + "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-musl/-/lightningcss-linux-arm64-musl-1.33.0.tgz", + "integrity": "sha512-yiO5ROMuYQgXbC60yjZU5CYSFZGKXL0HFATXt9mHJn1+zW55oCtMI9NfcVhYLMFDL7gV7oBPon/EmMMGg2OvtQ==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "MPL-2.0", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">= 12.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/parcel" + } + }, + "node_modules/lightningcss-linux-x64-gnu": { + "version": "1.33.0", + "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-gnu/-/lightningcss-linux-x64-gnu-1.33.0.tgz", + "integrity": "sha512-ar+Ju7LmcN0Jo4FpL4hpFybwNG9/3A/Br5KW2n2jyODg3MEZXaDYADdemoNS+BDNfMgKvylJLj4S5tyRActuAg==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "MPL-2.0", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">= 12.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/parcel" + } + }, + "node_modules/lightningcss-linux-x64-musl": { + "version": "1.33.0", + "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-musl/-/lightningcss-linux-x64-musl-1.33.0.tgz", + "integrity": "sha512-RYiYbkokw0trfKqqzfF55lginwEPrD3OJDfTuJzFs1MK6iFnDenaz1fqLLtX4ITG3OktJQXOeTaw1awrBAlZPw==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "MPL-2.0", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">= 12.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/parcel" + } + }, + "node_modules/lightningcss-win32-arm64-msvc": { + "version": "1.33.0", + "resolved": "https://registry.npmjs.org/lightningcss-win32-arm64-msvc/-/lightningcss-win32-arm64-msvc-1.33.0.tgz", + "integrity": "sha512-1K+MPfLSFVpphzpdbfkhlWk6wBrTObBzS2T6db10PNOZgR9GoVsAWzwNyuhUYYbTp23j+4RrncfujZ4uAzXvwA==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "MPL-2.0", + "optional": true, + "os": [ + "win32" + ], + "engines": { + "node": ">= 12.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/parcel" + } + }, + "node_modules/lightningcss-win32-x64-msvc": { + "version": "1.33.0", + "resolved": "https://registry.npmjs.org/lightningcss-win32-x64-msvc/-/lightningcss-win32-x64-msvc-1.33.0.tgz", + "integrity": "sha512-OlEICDx/Xl0FqSp4bry8zFnCvGpig3Gl4gCquvYwHuqJKEC1+n9NgDniFvqHGmMv1ZkqDJrDqKKSykTDX+ehuA==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "MPL-2.0", + "optional": true, + "os": [ + "win32" + ], + "engines": { + "node": ">= 12.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/parcel" + } + }, + "node_modules/nanoid": { + "version": "3.3.19", + "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.19.tgz", + "integrity": "sha512-Y2tUNy4ouw6tq5oDSKeQYGOyhkUBhNOcGV/02KC+6kd9eDGqdZd++mjMiIDilrBYvjEnCYvVtsuHCuP+okSfug==", + "dev": true, + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/ai" + } + ], + "license": "MIT", + "bin": { + "nanoid": "bin/nanoid.cjs" + }, + "engines": { + "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1" + } + }, + "node_modules/picocolors": { + "version": "1.1.1", + "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz", + "integrity": "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==", + "dev": true, + "license": "ISC" + }, + "node_modules/picomatch": { + "version": "4.0.7", + "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.7.tgz", + "integrity": "sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=12" + }, + "funding": { + "url": "https://github.com/sponsors/jonschlinkert" + } + }, + "node_modules/playwright": { + "version": "1.63.0", + "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.63.0.tgz", + "integrity": "sha512-+7ziBLidS4NaNCdt57SUDT+wYmmd5fmiQejUic/kb+YsYSCPyOOE9sebzMjNmQrsnNpDJqd4WHvV/8lfKfUDUg==", + "dev": true, + "license": "Apache-2.0", + "dependencies": { + "playwright-core": "1.63.0" + }, + "bin": { + "playwright": "cli.js" + }, + "engines": { + "node": ">=20" + } + }, + "node_modules/playwright-core": { + "version": "1.63.0", + "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.63.0.tgz", + "integrity": "sha512-rYCsBF/M5HjUch52bbtVONEFjv6Xu8sm8h72dNlR5bzIE1fvC/bxgspzkjSfU+MweEMmPM8KJebG6nnyxo5mCg==", + "dev": true, + "license": "Apache-2.0", + "bin": { + "playwright-core": "cli.js" + }, + "engines": { + "node": ">=20" + } + }, + "node_modules/postcss": { + "version": "8.5.28", + "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.28.tgz", + "integrity": "sha512-RRuzqDtt5Y9h3quz5hWhK+TPnsmVs6WwSU6LkJMeY4HstUEDuYTG8UJSdawMRzmzAtV+KEoG8N3Qg2qLy5vM/A==", + "dev": true, + "funding": [ + { + "type": "opencollective", + "url": "https://opencollective.com/postcss/" + }, + { + "type": "tidelift", + "url": "https://tidelift.com/funding/github/npm/postcss" + }, + { + "type": "github", + "url": "https://github.com/sponsors/ai" + } + ], + "license": "MIT", + "dependencies": { + "nanoid": "^3.3.18", + "picocolors": "^1.1.1", + "source-map-js": "^1.2.1" + }, + "engines": { + "node": "^10 || ^12 || >=14" + } + }, + "node_modules/react": { + "version": "19.3.0", + "resolved": "https://registry.npmjs.org/react/-/react-19.3.0.tgz", + "integrity": "sha512-E8LUcbtBWt20bbl2YoHfx4ZDBdxVTfOKtCZn9cDSJ4l6/nuoApcpIBcj47t2wZoVX8g2ZHuMHbiShgCR1T5Sog==", + "license": "MIT", + "engines": { + "node": ">=0.10.0" + } + }, + "node_modules/react-dom": { + "version": "19.3.0", + "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-19.3.0.tgz", + "integrity": "sha512-JDk8dgif51OjFoDE70+OT9ICyYr+69HlmihNwp1+Nsfbna3t5sIiCa9ZJktDmQ4/1b/rn26hIAR2uYXDMr5r0Q==", + "license": "MIT", + "dependencies": { + "scheduler": "^0.28.0" + }, + "peerDependencies": { + "react": "^19.3.0" + } + }, + "node_modules/rolldown": { + "version": "1.2.11", + "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.2.11.tgz", + "integrity": "sha512-qpSwIyz0jHQq5qXBTNxFmE6664rJ7O+4TvPFOiOaBSrz8IOHc1koKKSqTM2H6u1UG1+TveuC6vaDHKXFOvb1Kw==", + "dev": true, + "license": "MIT", + "dependencies": { + "@oxc-project/types": "=0.151.0", + "@rolldown/pluginutils": "^1.0.0" + }, + "bin": { + "rolldown": "bin/cli.mjs" + }, + "engines": { + "node": "^20.19.0 || >=22.12.0" + }, + "optionalDependencies": { + "@rolldown/binding-android-arm-eabi": "1.2.11", + "@rolldown/binding-android-arm64": "1.2.11", + "@rolldown/binding-darwin-arm64": "1.2.11", + "@rolldown/binding-darwin-x64": "1.2.11", + "@rolldown/binding-freebsd-x64": "1.2.11", + "@rolldown/binding-linux-arm-gnueabihf": "1.2.11", + "@rolldown/binding-linux-arm64-gnu": "1.2.11", + "@rolldown/binding-linux-arm64-musl": "1.2.11", + "@rolldown/binding-linux-ppc64-gnu": "1.2.11", + "@rolldown/binding-linux-s390x-gnu": "1.2.11", + "@rolldown/binding-linux-x64-gnu": "1.2.11", + "@rolldown/binding-linux-x64-musl": "1.2.11", + "@rolldown/binding-openharmony-arm64": "1.2.11", + "@rolldown/binding-win32-arm64-msvc": "1.2.11", + "@rolldown/binding-win32-x64-msvc": "1.2.11" + } + }, + "node_modules/scheduler": { + "version": "0.28.0", + "resolved": "https://registry.npmjs.org/scheduler/-/scheduler-0.28.0.tgz", + "integrity": "sha512-juorfCmIkIw8tT+p5BXSm6PJjQF/ycEYmKyzURCIt/RaZIhL+PulbQ9Yu2z1HdOJDdqDTlxA1+xKBmHXJsczAw==", + "license": "MIT" + }, + "node_modules/source-map-js": { + "version": "1.2.1", + "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz", + "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==", + "dev": true, + "license": "BSD-3-Clause", + "engines": { + "node": ">=0.10.0" + } + }, + "node_modules/tinyglobby": { + "version": "0.2.17", + "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.17.tgz", + "integrity": "sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==", + "dev": true, + "license": "MIT", + "dependencies": { + "fdir": "^6.5.0", + "picomatch": "^4.0.4" + }, + "engines": { + "node": ">=12.0.0" + }, + "funding": { + "url": "https://github.com/sponsors/SuperchupuDev" + } + }, + "node_modules/typescript": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/typescript/-/typescript-7.0.2.tgz", + "integrity": "sha512-8FYau96o3NKOhbjKi/qNvG/W5jhzxkbdm5sj9AbZ/5T5sWqn3hJgLfGx27sRKZWTvyzCP8dLRBTf5tBTSRVUNA==", + "dev": true, + "license": "Apache-2.0", + "bin": { + "tsc": "bin/tsc" + }, + "engines": { + "node": ">=16.20.0" + }, + "optionalDependencies": { + "@typescript/typescript-aix-ppc64": "7.0.2", + "@typescript/typescript-darwin-arm64": "7.0.2", + "@typescript/typescript-darwin-x64": "7.0.2", + "@typescript/typescript-freebsd-arm64": "7.0.2", + "@typescript/typescript-freebsd-x64": "7.0.2", + "@typescript/typescript-linux-arm": "7.0.2", + "@typescript/typescript-linux-arm64": "7.0.2", + "@typescript/typescript-linux-loong64": "7.0.2", + "@typescript/typescript-linux-mips64el": "7.0.2", + "@typescript/typescript-linux-ppc64": "7.0.2", + "@typescript/typescript-linux-riscv64": "7.0.2", + "@typescript/typescript-linux-s390x": "7.0.2", + "@typescript/typescript-linux-x64": "7.0.2", + "@typescript/typescript-netbsd-arm64": "7.0.2", + "@typescript/typescript-netbsd-x64": "7.0.2", + "@typescript/typescript-openbsd-arm64": "7.0.2", + "@typescript/typescript-openbsd-x64": "7.0.2", + "@typescript/typescript-sunos-x64": "7.0.2", + "@typescript/typescript-win32-arm64": "7.0.2", + "@typescript/typescript-win32-x64": "7.0.2" + } + }, + "node_modules/vite": { + "version": "8.3.1", + "resolved": "https://registry.npmjs.org/vite/-/vite-8.3.1.tgz", + "integrity": "sha512-/bvH9E9tmCXRGp2uXY3WbOldqpTwFkbha/8ANaEQ6VkxhH60KyqLwgZq6lG2y+4uT55x9+9eUHMpQ7uGnOCKjA==", + "dev": true, + "license": "MIT", + "dependencies": { + "lightningcss": "^1.33.0", + "picomatch": "^4.0.7", + "postcss": "^8.5.28", + "rolldown": "~1.2.9", + "tinyglobby": "^0.2.17" + }, + "bin": { + "vite": "bin/vite.js" + }, + "engines": { + "node": "^20.19.0 || >=22.12.0" + }, + "funding": { + "url": "https://github.com/vitejs/vite?sponsor=1" + }, + "optionalDependencies": { + "fsevents": "~2.3.3" + }, + "peerDependencies": { + "@types/node": "^20.19.0 || >=22.12.0", + "@vitejs/devtools": "^0.7.1", + "esbuild": "^0.27.0 || ^0.28.0", + "jiti": ">=1.21.0", + "less": "^4.0.0", + "sass": "^1.70.0", + "sass-embedded": "^1.70.0", + "stylus": ">=0.54.8", + "sugarss": "^5.0.0", + "terser": "^5.16.0", + "tsx": "^4.8.1", + "yaml": "^2.4.2" + }, + "peerDependenciesMeta": { + "@types/node": { + "optional": true + }, + "@vitejs/devtools": { + "optional": true + }, + "esbuild": { + "optional": true + }, + "jiti": { + "optional": true + }, + "less": { + "optional": true + }, + "sass": { + "optional": true + }, + "sass-embedded": { + "optional": true + }, + "stylus": { + "optional": true + }, + "sugarss": { + "optional": true + }, + "terser": { + "optional": true + }, + "tsx": { + "optional": true + }, + "yaml": { + "optional": true + } + } + } + } +} diff --git a/frontend/package.json b/frontend/package.json new file mode 100644 index 0000000..ebb6bf4 --- /dev/null +++ b/frontend/package.json @@ -0,0 +1,22 @@ +{ + "name": "iam-login-ui", + "private": true, + "version": "0.0.1", + "type": "module", + "scripts": { + "build": "tsc --noEmit && vite build", + "watch": "vite build --watch", + "test:browser": "playwright test" + }, + "dependencies": { + "react": "19.3.0", + "react-dom": "19.3.0" + }, + "devDependencies": { + "vite": "8.3.1", + "typescript": "7.0.2", + "@types/react": "^19.2.0", + "@types/react-dom": "^19.2.0", + "@playwright/test": "1.63.0" + } +} diff --git a/frontend/playwright.config.ts b/frontend/playwright.config.ts new file mode 100644 index 0000000..58ec8c4 --- /dev/null +++ b/frontend/playwright.config.ts @@ -0,0 +1,8 @@ +import { defineConfig } from "@playwright/test"; +export default defineConfig({ + testDir: "./tests", + use: { + baseURL: process.env.IAM_PREVIEW_URL ?? "http://127.0.0.1:18081", + headless: true, + }, +}); diff --git a/frontend/src/main.tsx b/frontend/src/main.tsx new file mode 100644 index 0000000..deb662b --- /dev/null +++ b/frontend/src/main.tsx @@ -0,0 +1,159 @@ +import { createRoot } from "react-dom/client"; +import { useState, useLayoutEffect, type ReactNode } from "react"; +import "./style.css"; + +type PageContext = { + step: "identity" | "verification" | "complete"; + name: string; + error: string; + action: string; + csrf: { name: string; value: string }; +}; + +const context: PageContext = JSON.parse( + document.getElementById("login-context")!.textContent!, +); + +function Form({ children }: { children: ReactNode }) { + const [pending, setPending] = useState(false); + return ( +
setPending(true)} + aria-busy={pending} + > + + {children} + +
+ ); +} + +function App() { + useLayoutEffect(() => { performance.mark("iam-page-ready"); }, []); + const [showHelp, setShowHelp] = useState(false); + return ( +
+
+ + iam + 预览 + +
+
+
登录交互原型
+
    + {(["identity", "verification", "complete"] as const).map( + (step, i) => ( +
  1. + {i + 1} + {["填写称呼", "模拟验证", "完成"][i]} +
    2. + ), + )} +
+ {context.step === "identity" && ( + <> +

从这里开始

+

+ 体验一次完整的页面切换。先告诉我们怎么称呼你。 +

+ + )} + {context.step === "verification" && ( + <> +

你好，{context.name}

+

+ 这是第二步页面。输入演示码 123456{" "} + 继续，也可以试试输入错误的演示码。 +

+ + )} + {context.step === "complete" && ( + <> + +

体验完成

+

+ {context.name} + ，你已走完页面预览。这没有建立登录身份，也没有向任何应用授权。 +

+ + )} + {context.error && ( +

+ {context.error} +

+ )} +
+ {context.step === "identity" && ( + + )} + {context.step === "verification" && ( + + )} +
+ {context.step === "verification" && ( + + 返回上一步 + + )} +
+ + {showHelp && ( +

不是。这里仅演示页面交互，请勿输入真实密码或 MFA 验证码。

+ )} +
+
+
独立 IAM · 页面体验预览
+
+ ); +} + +createRoot(document.getElementById("root")!).render(); diff --git a/frontend/src/style.css b/frontend/src/style.css new file mode 100644 index 0000000..9df008c --- /dev/null +++ b/frontend/src/style.css @@ -0,0 +1,240 @@ +:root { + font-family: Inter, "Noto Sans SC", system-ui, sans-serif; + color: #182826; + background: #f3f5f1; + font-synthesis: none; + font-size: 16px; +} +* { + box-sizing: border-box; +} +body { + margin: 0; +} +main { + max-width: 520px; + margin: 0 auto; + padding: 40px 20px 28px; +} +header { + margin-bottom: 40px; +} +.brand { + font-size: 32px; + font-weight: 750; + letter-spacing: -2px; + color: #285448; + text-decoration: none; +} +.brand > span:first-child { + font-weight: 400; +} +.badge { + font-size: 11px; + letter-spacing: 1px; + vertical-align: middle; + margin-left: 14px; + padding: 5px 8px; + border: 1px solid #b7c9be; + border-radius: 5px; +} +.card { + background: #fff; + border: 1px solid #dce4dd; + border-radius: 18px; + padding: 36px; + box-shadow: 0 12px 40px #173f2510; +} +.eyebrow { + font-size: 12px; + color: #60746a; + letter-spacing: 2px; +} +.steps { + display: flex; + justify-content: space-between; + padding: 0; + list-style: none; + margin: 25px 0 32px; + gap: 8px; +} +.steps li { + font-size: 12px; + color: #718078; + display: flex; + align-items: center; + gap: 7px; +} +.steps li span { + display: inline-grid; + place-items: center; + width: 23px; + height: 23px; + border: 1px solid #ccd7ce; + border-radius: 50%; + font-size: 11px; +} +.steps [aria-current] { + color: #215542; + font-weight: 650; +} +.steps [aria-current] span { + background: #215542; + color: white; + border-color: #215542; +} +h1 { + font-size: 27px; + letter-spacing: -0.5px; + line-height: 1.35; + margin: 0 0 12px; + overflow-wrap: anywhere; +} +.intro { + font-size: 14px; + color: #60716a; + line-height: 1.8; + margin: 0 0 25px; +} +label { + display: block; + font-size: 14px; + font-weight: 600; +} +input:not([type="hidden"]) { + display: block; + width: 100%; + border: 1px solid #bdccc1; + border-radius: 8px; + padding: 13px 14px; + margin: 9px 0 22px; + font: inherit; + color: inherit; + background: #fff; +} +input:focus { + outline: 3px solid #a9cbbc; + outline-offset: 2px; +} +button { + font: inherit; + cursor: pointer; +} +.primary { + width: 100%; + border: 0; + background: #245b47; + color: #fff; + font-weight: 600; + border-radius: 8px; + padding: 13px; +} +.primary:hover { + background: #194734; +} +.primary:disabled { + opacity: 0.65; + cursor: wait; +} +.error { + color: #9e302b; + background: #fff0ed; + padding: 12px; + border-radius: 8px; + font-size: 14px; + line-height: 1.6; +} +.back { + display: block; + text-align: center; + font-size: 13px; + margin-top: 18px; + color: #476a58; +} +.help { + border-top: 1px solid #e5ebe6; + margin-top: 28px; + padding-top: 20px; +} +.link { + background: none; + border: 0; + color: #5b7064; + padding: 0; + font-size: 13px; +} +.help p { + font-size: 13px; + line-height: 1.8; + color: #6a756e; + margin-bottom: 0; +} +footer { + text-align: center; + color: #7c887e; + font-size: 12px; + margin-top: 28px; +} +.success { + color: #245b47; + font-size: 30px; + margin-bottom: 12px; +} +a:focus-visible, +button:focus-visible { + outline: 3px solid #a9cbbc; + outline-offset: 3px; +} +@media (max-width: 480px) { + main { + padding-top: 24px; + } + header { + margin-bottom: 24px; + } + .card { + padding: 26px 22px; + } + .steps { + gap: 5px; + } + .steps li { + font-size: 11px; + } +} +@media (prefers-color-scheme: dark) { + :root { + background: #14221c; + color: #edf4ee; + } + .card { + background: #1e3027; + border-color: #344b3d; + } + .brand, + .steps [aria-current], + .success { + color: #b9ddc8; + } + .intro, + .eyebrow, + .help p, + .link, + .back { + color: #acbfb2; + } + .steps li { + color: #98aa9e; + } + input:not([type="hidden"]) { + background: #18271f; + border-color: #526657; + } + .help { + border-color: #3a4d40; + } + .error { + background: #492b29; + color: #ffc3b9; + } +} diff --git a/frontend/src/vite-env.d.ts b/frontend/src/vite-env.d.ts new file mode 100644 index 0000000..11f02fe --- /dev/null +++ b/frontend/src/vite-env.d.ts @@ -0,0 +1 @@ +/// diff --git a/frontend/tests/preview.spec.ts b/frontend/tests/preview.spec.ts new file mode 100644 index 0000000..7295140 --- /dev/null +++ b/frontend/tests/preview.spec.ts @@ -0,0 +1,95 @@ +import { test, expect } from "@playwright/test"; + +test("原生 POST 逐页导航，内联上下文，浏览器缓存静态资源", async ({ page }) => { + const xhr: string[] = []; + const posts: string[] = []; + const errors: string[] = []; + page.on("pageerror", (e) => errors.push(e.message)); + page.on("request", (req) => { + if (["fetch", "xhr"].includes(req.resourceType())) xhr.push(req.url()); + if (req.method() === "POST" && req.isNavigationRequest()) + posts.push(req.url()); + }); + await page.goto("/preview"); + await expect(page.getByRole("heading", { name: "从这里开始" })).toBeVisible(); + const scriptUrl = await page.locator("script[src]").getAttribute("src"); + await page.getByRole("button", { name: "这是真实登录吗？" }).click(); + await expect(page.getByText("不是。这里仅演示页面交互")).toBeVisible(); + await page.getByLabel("称呼").fill("预览用户"); + await page.getByRole("button", { name: "继续", exact: true }).click(); + await expect(page).toHaveURL(/\/preview\/verify$/); + await expect( + page.getByRole("heading", { name: "你好，预览用户" }), + ).toBeVisible(); + await page.getByLabel("演示码").fill("000000"); + await page.getByRole("button", { name: "继续", exact: true }).click(); + await expect(page.getByRole("alert")).toContainText("演示码不正确"); + await page.getByLabel("演示码").fill("123456"); + await page.getByRole("button", { name: "继续", exact: true }).click(); + await expect(page.getByRole("heading", { name: "体验完成" })).toBeVisible(); + expect(posts).toHaveLength(3); + expect(xhr).toEqual([]); + expect(errors).toEqual([]); + const timing = await page.evaluate(() => ({ + navigation: performance + .getEntriesByType("navigation") + .map((e) => e.toJSON()), + resources: performance.getEntriesByType("resource").map((e) => e.toJSON()), + })); + const script = timing.resources.find((r) => r.name.endsWith(scriptUrl!)); + expect(script?.transferSize).toBe(0); + await test + .info() + .attach("navigation-and-cache.json", { + body: JSON.stringify(timing, null, 2), + contentType: "application/json", + }); + expect( + ( + await page.request.get("/", { headers: { Accept: "application/json" } }) + ).status(), + ).toBe(401); + await page.getByRole("button", { name: "重新体验" }).click(); + await expect(page.getByRole("heading", { name: "从这里开始" })).toBeVisible(); +}); + +test("移动端与脚本结束标记作为纯文本显示", async ({ page }) => { + await page.setViewportSize({ width: 390, height: 844 }); + await page.goto("/preview"); + const name = ""; + await page.getByLabel("称呼").fill(name); + await page.getByRole("button", { name: "继续", exact: true }).click(); + await expect(page.getByRole("heading")).toHaveText(`你好，${name}`); + expect( + await page.evaluate(() => Reflect.get(window, "__injected")), + ).toBeUndefined(); + expect( + await page.evaluate( + () => document.documentElement.scrollWidth <= innerWidth, + ), + ).toBe(true); + await page.screenshot({ path: "test-results/mobile.png", fullPage: true }); +}); + + +test("受限网络下首屏和缓存后页面切换计时", async ({ page, context }) => { + const cdp = await context.newCDPSession(page); + await cdp.send("Network.enable"); + await cdp.send("Network.emulateNetworkConditions", { + offline: false, latency: 60, downloadThroughput: 1_500_000 / 8, + uploadThroughput: 750_000 / 8, + }); + await cdp.send("Emulation.setCPUThrottlingRate", { rate: 4 }); + await page.goto("/preview"); + await expect(page.getByRole("heading", { name: "从这里开始" })).toBeVisible(); + const cold = await page.evaluate(() => performance.getEntriesByName("iam-page-ready")[0].startTime); + await page.getByLabel("称呼").fill("计时体验"); + const start = performance.now(); + await page.getByRole("button", { name: "继续", exact: true }).click(); + await expect(page.getByRole("heading", { name: "你好，计时体验" })).toBeVisible(); + const warm = performance.now() - start; + const result = { network_latency_ms: 60, download_mbps: 1.5, cpu_slowdown: 4, + cold_navigation_to_react_commit_ms: Math.round(cold), warm_click_to_visible_ms: Math.round(warm) }; + console.log(JSON.stringify(result)); + await test.info().attach("timing.json", { body: JSON.stringify(result, null, 2), contentType: "application/json" }); +}); diff --git a/frontend/tsconfig.json b/frontend/tsconfig.json new file mode 100644 index 0000000..3164401 --- /dev/null +++ b/frontend/tsconfig.json @@ -0,0 +1,13 @@ +{ + "compilerOptions": { + "target": "ES2022", + "lib": ["ES2022", "DOM", "DOM.Iterable"], + "module": "ESNext", + "moduleResolution": "Bundler", + "jsx": "react-jsx", + "strict": true, + "noEmit": true, + "skipLibCheck": true + }, + "include": ["src"] +} diff --git a/frontend/vite.config.ts b/frontend/vite.config.ts new file mode 100644 index 0000000..bd6b3a0 --- /dev/null +++ b/frontend/vite.config.ts @@ -0,0 +1,6 @@ +import { defineConfig } from "vite"; + +export default defineConfig({ + base: "/", + build: { outDir: "dist", emptyOutDir: true }, +}); diff --git a/scripts/frontend-in-docker b/scripts/frontend-in-docker new file mode 100755 index 0000000..c3358a7 --- /dev/null +++ b/scripts/frontend-in-docker @@ -0,0 +1,16 @@ +#!/usr/bin/env bash +set -euo pipefail +repo_root=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd) +cache_dir=${IAM_NPM_CACHE:-${XDG_CACHE_HOME:-$HOME/.cache}/iam-login/npm} +mkdir -p -- "$cache_dir" +cache_dir=$(cd -- "$cache_dir" && pwd) +docker_cmd=(docker) +if [[ ${IAM_DOCKER_USE_SUDO:-0} == 1 ]]; then + docker_cmd=(sudo -n docker) +fi +exec "${docker_cmd[@]}" run --rm --network host \ + --cpus 2 --memory 1g --user "$(id -u):$(id -g)" \ + -e HOME=/npm -e npm_config_cache=/npm \ + -v "$cache_dir:/npm" -v "$repo_root:/workspace" \ + -w /workspace/frontend node@sha256:d8e448a56fc63242f70026718378bd4b00f8c82e78d20eefb199224a4d8e33d8 \ + sh -c 'npm ci --no-audit --no-fund && npm run build' diff --git a/scripts/gradle-in-docker b/scripts/gradle-in-docker index d681d2f..2f882da 100755 --- a/scripts/gradle-in-docker +++ b/scripts/gradle-in-docker @@ -13,6 +13,8 @@ if (($# == 0)); then set -- test fi +"$repo_root/scripts/frontend-in-docker" + # Linux host networking is needed for Testcontainers' published ports. exec "${docker_cmd[@]}" run --rm --network host \ --cpus "${IAM_BUILD_CPUS:-4}" --memory "${IAM_BUILD_MEMORY:-8g}" \ diff --git a/scripts/native-smoke.py b/scripts/native-smoke.py index f5ef364..05d51fe 100755 --- a/scripts/native-smoke.py +++ b/scripts/native-smoke.py @@ -78,6 +78,7 @@ def main(): ready_seconds = time.monotonic() - started assert request('/actuator/prometheus')[0] == 401, 'Anonymous metrics must be rejected' assert request('/')[0] == 401, 'Anonymous application access must be rejected' + assert request('/preview')[0] == 404, 'UI preview must be disabled by default' status, before = request('/actuator/prometheus', authenticated=True) assert status == 200, 'Authenticated Prometheus scrape failed' for _ in range(3): diff --git a/src/main/java/top/ddupan/iam/login/preview/PreviewConfiguration.java b/src/main/java/top/ddupan/iam/login/preview/PreviewConfiguration.java new file mode 100644 index 0000000..04babb3 --- /dev/null +++ b/src/main/java/top/ddupan/iam/login/preview/PreviewConfiguration.java @@ -0,0 +1,44 @@ +package top.ddupan.iam.login.preview; + +import java.time.Duration; +import org.springframework.aot.hint.RuntimeHints; +import org.springframework.aot.hint.RuntimeHintsRegistrar; +import org.springframework.context.annotation.Bean; +import org.springframework.context.annotation.Configuration; +import org.springframework.context.annotation.ImportRuntimeHints; +import org.springframework.http.CacheControl; +import org.springframework.security.config.Customizer; +import org.springframework.security.config.annotation.web.builders.HttpSecurity; +import org.springframework.security.web.SecurityFilterChain; +import org.springframework.web.servlet.config.annotation.ResourceHandlerRegistry; +import org.springframework.web.servlet.config.annotation.WebMvcConfigurer; + +@Configuration(proxyBeanMethods = false) +@ImportRuntimeHints(PreviewConfiguration.Resources.class) +class PreviewConfiguration implements WebMvcConfigurer { + @Bean + SecurityFilterChain security(HttpSecurity http) throws Exception { + return http.authorizeHttpRequests(auth -> auth + .requestMatchers("/error", "/preview", "/preview/**", "/assets/**", "/actuator/health/**").permitAll() + .anyRequest().authenticated()) + .formLogin(Customizer.withDefaults()) + .httpBasic(Customizer.withDefaults()) + .headers(headers -> headers.contentSecurityPolicy(csp -> csp.policyDirectives( + "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; " + + "object-src 'none'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'"))) + .build(); + } + + @Override + public void addResourceHandlers(ResourceHandlerRegistry registry) { + registry.addResourceHandler("/assets/**").addResourceLocations("classpath:/ui/assets/") + .setCacheControl(CacheControl.maxAge(Duration.ofDays(365)).cachePublic().immutable()); + } + + static class Resources implements RuntimeHintsRegistrar { + @Override + public void registerHints(RuntimeHints hints, ClassLoader classLoader) { + hints.resources().registerPattern("ui/**"); + } + } +} diff --git a/src/main/java/top/ddupan/iam/login/preview/PreviewController.java b/src/main/java/top/ddupan/iam/login/preview/PreviewController.java new file mode 100644 index 0000000..423f243 --- /dev/null +++ b/src/main/java/top/ddupan/iam/login/preview/PreviewController.java @@ -0,0 +1,146 @@ +package top.ddupan.iam.login.preview; + +import jakarta.servlet.http.HttpServletRequest; +import jakarta.servlet.http.HttpSession; +import java.io.IOException; +import java.nio.charset.StandardCharsets; +import java.util.Map; +import org.springframework.beans.factory.annotation.Value; +import org.springframework.core.io.ClassPathResource; +import org.springframework.http.HttpStatus; +import org.springframework.http.MediaType; +import org.springframework.http.ResponseEntity; +import org.springframework.security.web.csrf.CsrfToken; +import org.springframework.web.bind.annotation.GetMapping; +import org.springframework.web.bind.annotation.PostMapping; +import org.springframework.web.bind.annotation.RequestParam; +import org.springframework.web.bind.annotation.RestController; +import org.springframework.web.server.ResponseStatusException; +import tools.jackson.databind.json.JsonMapper; + +/** An isolated UI experiment. It never creates an authenticated SecurityContext. */ +@RestController +class PreviewController { + private static final String STATE = PreviewController.class.getName() + ".state"; + private static final String SLOT = "__IAM_PAGE_CONTEXT__"; + private final boolean enabled; + private final String shell; + private final JsonMapper json = JsonMapper.builder().build(); + + PreviewController(@Value("${iam.ui-preview.enabled:false}") boolean enabled) throws IOException { + this.enabled = enabled; + this.shell = new ClassPathResource("ui/index.html").getContentAsString(StandardCharsets.UTF_8); + if (shell.indexOf(SLOT) < 0 || shell.indexOf(SLOT) != shell.lastIndexOf(SLOT)) { + throw new IllegalStateException("Expected exactly one UI context slot"); + } + } + + @GetMapping(value = {"/preview", "/preview/verify", "/preview/complete"}, produces = MediaType.TEXT_HTML_VALUE) + ResponseEntity page(HttpServletRequest request, CsrfToken csrf) { + requireEnabled(); + var session = request.getSession(); + synchronized (session) { + var state = state(session); + var path = request.getRequestURI().substring(request.getContextPath().length()); + if (path.equals("/preview")) { + if (!state.step.equals("identity")) state.error = ""; + state.step = "identity"; + } else if (!path.equals(pathFor(state.step))) { + return redirect(pathFor(state.step)); + } + var context = Map.of("step", state.step, "name", state.name, "error", state.error, + "action", switch (state.step) { + case "identity" -> "/preview/identify"; + case "verification" -> "/preview/verify"; + default -> "/preview/restart"; + }, "csrf", Map.of("name", csrf.getParameterName(), "value", csrf.getToken())); + return ResponseEntity.ok().header("Cache-Control", "no-store") + .contentType(MediaType.TEXT_HTML).body(shell.replace(SLOT, htmlSafeJson(context))); + } + } + + @PostMapping("/preview/identify") + ResponseEntity identify(@RequestParam(defaultValue = "") String name, HttpSession session) { + requireEnabled(); + synchronized (session) { + var state = state(session); + requireStep(state, "identity"); + if (name.isBlank() || name.length() > 64) { + state.error = "称呼须为 1 到 64 个字符。"; + return redirect("/preview"); + } + state.name = name.strip(); + state.error = ""; + state.step = "verification"; + return redirect("/preview/verify"); + } + } + + @PostMapping("/preview/verify") + ResponseEntity verify(@RequestParam(defaultValue = "") String code, HttpSession session) { + requireEnabled(); + synchronized (session) { + var state = state(session); + requireStep(state, "verification"); + if (!code.equals("123456")) { + state.error = "演示码不正确，请输入 123456。"; + return redirect("/preview/verify"); + } + state.error = ""; + state.step = "complete"; + return redirect("/preview/complete"); + } + } + + @PostMapping("/preview/restart") + ResponseEntity restart(HttpSession session) { + requireEnabled(); + synchronized (session) { + session.removeAttribute(STATE); + return redirect("/preview"); + } + } + + private void requireEnabled() { + if (!enabled) throw new ResponseStatusException(HttpStatus.NOT_FOUND); + } + + private static void requireStep(State state, String step) { + if (!state.step.equals(step)) throw new ResponseStatusException(HttpStatus.CONFLICT, "页面已过期，请重新打开预览"); + } + + private static State state(HttpSession session) { + var state = (State) session.getAttribute(STATE); + if (state == null) { + state = new State(); + session.setAttribute(STATE, state); + } + return state; + } + + private static String pathFor(String step) { + return switch (step) { + case "verification" -> "/preview/verify"; + case "complete" -> "/preview/complete"; + default -> "/preview"; + }; + } + + private static ResponseEntity redirect(String path) { + return ResponseEntity.status(HttpStatus.SEE_OTHER).header("Location", path) + .header("Cache-Control", "no-store").build(); + } + + String htmlSafeJson(Object value) { + // JSON in a script data block still participates in HTML parsing. + return json.writeValueAsString(value).replace("<", "\\u003c") + .replace(">", "\\u003e").replace("&", "\\u0026") + .replace("\u2028", "\\u2028").replace("\u2029", "\\u2029"); + } + + private static class State { + String step = "identity"; + String name = ""; + String error = ""; + } +} diff --git a/src/main/resources/META-INF/native-image/top.ddupan.iam/iam-login/reachability-metadata.json b/src/main/resources/META-INF/native-image/top.ddupan.iam/iam-login-manual/reachability-metadata.json similarity index 100% rename from src/main/resources/META-INF/native-image/top.ddupan.iam/iam-login/reachability-metadata.json rename to src/main/resources/META-INF/native-image/top.ddupan.iam/iam-login-manual/reachability-metadata.json diff --git a/src/test/java/top/ddupan/iam/login/IamLoginApplicationTests.java b/src/test/java/top/ddupan/iam/login/IamLoginApplicationTests.java index 1619289..abfb7d5 100644 --- a/src/test/java/top/ddupan/iam/login/IamLoginApplicationTests.java +++ b/src/test/java/top/ddupan/iam/login/IamLoginApplicationTests.java @@ -1,6 +1,7 @@ package top.ddupan.iam.login; import io.micrometer.core.instrument.MeterRegistry; +import java.nio.charset.StandardCharsets; import org.junit.jupiter.api.Test; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Qualifier; @@ -10,42 +11,114 @@ import org.springframework.boot.opentelemetry.autoconfigure.logging.otlp.OtlpLog import org.springframework.boot.opentelemetry.autoconfigure.logging.otlp.Transport; import org.springframework.boot.test.context.SpringBootTest; import org.springframework.boot.testcontainers.service.connection.ServiceConnection; +import org.springframework.boot.webmvc.test.autoconfigure.AutoConfigureMockMvc; +import org.springframework.http.MediaType; +import org.springframework.mock.web.MockHttpSession; +import org.springframework.test.web.servlet.MockMvc; import org.testcontainers.grafana.LgtmStackContainer; import org.testcontainers.junit.jupiter.Container; import org.testcontainers.junit.jupiter.Testcontainers; import org.testcontainers.utility.DockerImageName; import static org.assertj.core.api.Assertions.assertThat; +import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.csrf; +import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get; +import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post; +import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.header; +import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.redirectedUrl; +import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status; -@SpringBootTest +@SpringBootTest(properties = "iam.ui-preview.enabled=true") +@AutoConfigureMockMvc @AutoConfigureMetrics @AutoConfigureTracing @Testcontainers class IamLoginApplicationTests { - // Field-based service connections are recreated by the test context in AOT mode. - @Container - @ServiceConnection - static final LgtmStackContainer grafanaLgtm = new LgtmStackContainer( - DockerImageName.parse(TestcontainersConfiguration.LGTM_IMAGE)); + // Field-based service connections are recreated by the test context in AOT mode. + @Container + @ServiceConnection + static final LgtmStackContainer grafanaLgtm = new LgtmStackContainer( + DockerImageName.parse(TestcontainersConfiguration.LGTM_IMAGE)); - @Autowired - OtlpLoggingConnectionDetails loggingConnectionDetails; + @Autowired + OtlpLoggingConnectionDetails loggingConnectionDetails; - @Autowired - @Qualifier("prometheusMeterRegistry") - MeterRegistry prometheus; + @Autowired + @Qualifier("prometheusMeterRegistry") + MeterRegistry prometheus; - @Test - void processCpuTimeCanBeRead() { - assertThat(prometheus.get("process.cpu.time").functionCounter().count()).isFinite().isNotNegative(); - } + @Autowired + MockMvc mvc; - @Test - void loggingConnectionUsesRunningContainer() { - assertThat(grafanaLgtm.isRunning()).isTrue(); - assertThat(loggingConnectionDetails.getUrl(Transport.HTTP)) - .isEqualTo(grafanaLgtm.getOtlpHttpUrl() + "/v1/logs"); - } + @Test + void previewHasInlineContextAndNoCache() throws Exception { + var result = mvc.perform(get("/preview")) + .andExpect(status().isOk()) + .andExpect(header().string("Cache-Control", "no-store")) + .andReturn(); + assertThat(result.getResponse().getContentAsString()).contains("login-context", "identity", "_csrf") + .doesNotContain("__IAM_PAGE_CONTEXT__"); + } + + @Test + void previewRejectsMissingCsrf() throws Exception { + mvc.perform(post("/preview/identify").param("name", "测试")) + .andExpect(status().isForbidden()); + } + + @Test + void previewChecksStepsAndEscapesScriptEndTags() throws Exception { + var session = new MockHttpSession(); + mvc.perform(post("/preview/verify") + .session(session).with(csrf()) + .param("code", "123456")) + .andExpect(status().isConflict()); + mvc.perform(post("/preview/identify") + .session(session).with(csrf()) + .param("name", "")) + .andExpect(status().isSeeOther()); + var html = mvc.perform(get("/preview/verify").session(session)) + .andExpect(status().isOk()).andReturn() + .getResponse().getContentAsString(); + assertThat(html).doesNotContain("") + .contains("\\u003c/script\\u003e"); + } + + @Test + void previewRetriesAndCompletesWithoutAuthenticating() throws Exception { + var session = new MockHttpSession(); + mvc.perform(post("/preview/identify") + .session(session).with(csrf()) + .param("name", "测试")) + .andExpect(redirectedUrl("/preview/verify")); + mvc.perform(post("/preview/verify") + .session(session).with(csrf()) + .param("code", "000000")) + .andExpect(redirectedUrl("/preview/verify")); + var retry = mvc.perform(get("/preview/verify").session(session)) + .andReturn().getResponse(); + assertThat(retry.getContentAsString(StandardCharsets.UTF_8)).contains("演示码不正确"); + mvc.perform(post("/preview/verify") + .session(session).with(csrf()) + .param("code", "123456")) + .andExpect(redirectedUrl("/preview/complete")); + mvc.perform(get("/").session(session) + .accept(MediaType.APPLICATION_JSON)) + .andExpect(status().isUnauthorized()); + assertThat(session.getAttribute("SPRING_SECURITY_CONTEXT")).isNull(); + } + + @Test + void processCpuTimeCanBeRead() { + assertThat(prometheus.get("process.cpu.time").functionCounter().count()).isFinite().isNotNegative(); + } + + @Test + void loggingConnectionUsesRunningContainer() { + assertThat(grafanaLgtm.isRunning()).isTrue(); + assertThat(loggingConnectionDetails.getUrl(Transport.HTTP)) + .isEqualTo(grafanaLgtm.getOtlpHttpUrl() + "/v1/logs"); + } } From 2840f58397e4fc66a62c81baa06c63041c7d3d40 Mon Sep 17 00:00:00 2001 From: panxiao81 Date: Fri, 25 Sep 2026 20:13:32 +0000 Subject: [PATCH 2/9] =?UTF-8?q?=E8=AE=B0=E5=BD=95=E6=B5=8F=E8=A7=88?= =?UTF-8?q?=E5=99=A8=E5=8E=9F=E5=9E=8B=E7=9A=84=20Native=20=E4=B8=8E?= =?UTF-8?q?=E9=A1=B5=E9=9D=A2=E5=88=87=E6=8D=A2=E5=AE=9E=E6=B5=8B?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- docs/browser-preview.md | 27 +++++++++++++++++++++++++++ scripts/native-smoke.py | 2 ++ 2 files changed, 29 insertions(+) diff --git a/docs/browser-preview.md b/docs/browser-preview.md index 8c8468a..1382899 100644 --- a/docs/browser-preview.md +++ b/docs/browser-preview.md @@ -77,3 +77,30 @@ npm run test:browser 来源：[Keycloakify 入口](https://github.com/keycloakify/keycloakify-starter/blob/main/src/main.tsx)、 [登录表单](https://github.com/keycloakify/keycloakify/blob/main/src/login/pages/Login.tsx)、 [Vite 构建](https://vite.dev/guide/build)。 + +## 2026-09-25 本地验证结果 + +本轮应用代码为 `dcf634d`，随后修正 smoke 对 HTML 入口的 Accept 请求头。 +使用固定 GraalVM Java 25.0.2 镜像，构建限制 4 CPU / 8 GiB；原生应用采用默认 O2。 + +| 检查 | 结果 | +|---|---| +| 前端 TypeScript / Vite、bootJar | 通过 | +| JVM test / testAot / nativeTest | 各 6 项，0 失败、0 跳过 | +| Native 应用 smoke | liveness UP；匿名应用及指标 401；认证指标 200；健康请求计数增加 3 | +| 默认关闭 / 显式开启预览 | HTML 请求分别 404 / 200，在同一 Native 构建上实测 | +| Native 上的 Chromium 测试 | 3 项通过，包含整页原生 POST、无 fetch/XHR、缓存、转义与移动端 | +| ELF 文件大小 | 126,291,016 bytes，约 120.44 MiB，不是容器镜像大小 | +| 启动到 liveness 可响应 | 单次 0.351 秒 | +| smoke 请求后 RSS | 148,996 KiB，约 145.50 MiB | +| 模拟限速下的首屏 | 从导航开始到 React 提交 DOM：1,702 ms | +| 模拟限速下的缓存后切换 | Playwright 点击开始到下一页标题可见：560 ms | + +浏览器计时条件为 60ms 网络延迟、1.5Mbps 下载、0.75Mbps 上传及四倍 CPU slowdown。 +这是单次、本机、模拟网络测量，不是生产 SLA，两个计时区间也不同；不据此声称 Native +比 JVM 快多少。原型没有启用 HTTP 压缩，首屏实际下载约 223KB JS；构建日志中的约 70KB +是 gzip 估算，不是本轮实际传输大小。后续页面的 JS `transferSize=0`，确认命中浏览器缓存。 + +本轮没有新增反射补丁。Native 测试日志以及 smoke 的启动、请求、关闭阶段未发现 Native +反射或资源注册错误。生成目录中的配套 `.so` 文件应随 Native 产物保留；这里不承诺单文件 +静态链接交付。AD、真实 MFA、Hydra 和人类验收不在这些结果范围内。 diff --git a/scripts/native-smoke.py b/scripts/native-smoke.py index 05d51fe..0d7ad00 100755 --- a/scripts/native-smoke.py +++ b/scripts/native-smoke.py @@ -59,6 +59,8 @@ def main(): def request(path, authenticated=False): headers = {'Accept': 'text/plain' if authenticated and path == '/actuator/prometheus' else 'application/json'} + if path == '/preview': + headers['Accept'] = 'text/html' if authenticated: headers['Authorization'] = f'Basic {basic}' req = urllib.request.Request(base_url + path, headers=headers) From d14151928dd0c6c870c9f0d631813573fde2fccc Mon Sep 17 00:00:00 2001 From: panxiao81 Date: Fri, 25 Sep 2026 21:06:39 +0000 Subject: [PATCH 3/9] =?UTF-8?q?=E6=8E=A5=E5=85=A5=20AD=20=E5=AF=86?= =?UTF-8?q?=E7=A0=81=E9=AA=8C=E8=AF=81=E4=B8=8E=E7=9B=B4=E6=8E=A5=E6=89=80?= =?UTF-8?q?=E5=B1=9E=E7=BB=84=EF=BC=8C=E4=BF=9D=E7=95=99=E5=BE=85=20MFA=20?= =?UTF-8?q?=E8=BE=B9=E7=95=8C?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- AGENTS.md | 2 +- README.md | 16 +- build.gradle | 1 + docs/ad-login.md | 102 +++++++++ docs/native-validation.md | 3 + frontend/index.html | 4 +- frontend/src/main.tsx | 41 +++- frontend/src/style.css | 4 + .../iam/login/ad/AdLoginController.java | 128 +++++++++++ .../iam/login/ad/AdPasswordVerifier.java | 151 +++++++++++++ .../top/ddupan/iam/login/ad/AdProperties.java | 6 + .../iam/login/ad/DirectoryIdentity.java | 12 ++ .../iam/login/preview/PageRenderer.java | 32 +++ .../login/preview/PreviewConfiguration.java | 2 +- .../iam/login/preview/PreviewController.java | 25 +-- .../iam/login/ad/AdIntegrationTests.java | 199 ++++++++++++++++++ src/test/resources/ldap/README.md | 4 + src/test/resources/ldap/fixture.p12 | Bin 0 -> 2547 bytes 18 files changed, 699 insertions(+), 33 deletions(-) create mode 100644 docs/ad-login.md create mode 100644 src/main/java/top/ddupan/iam/login/ad/AdLoginController.java create mode 100644 src/main/java/top/ddupan/iam/login/ad/AdPasswordVerifier.java create mode 100644 src/main/java/top/ddupan/iam/login/ad/AdProperties.java create mode 100644 src/main/java/top/ddupan/iam/login/ad/DirectoryIdentity.java create mode 100644 src/main/java/top/ddupan/iam/login/preview/PageRenderer.java create mode 100644 src/test/java/top/ddupan/iam/login/ad/AdIntegrationTests.java create mode 100644 src/test/resources/ldap/README.md create mode 100644 src/test/resources/ldap/fixture.p12 diff --git a/AGENTS.md b/AGENTS.md index ee834b7..532628c 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -3,7 +3,7 @@ - 后续修改必须新建分支并提交 PR；未经维护者明确指示，不直接推 main、不自行合并。 - 默认中文维护项目文档、commit、issue 和 PR；代码与上游 API 名称保留英文。 - 项目使用 Java 与 Spring；Native 是交付约束，不是可选优化，不引入 Kotlin。 -- 变更需通过适用的 JVM 测试和 Native 集成测试；未执行的验证明确报告。 +- 日常变更先通过适用的 JVM 测试，不要求每轮执行耗时的 Native 编译与测试；Native 仍为交付目标，在阶段性验收或兼容性风险变化时集中验证。未执行的验证明确报告。 - 只实现当前任务范围。Hydra 负责签发，首轮 AD 负责身份和组，本服务独立于 Ayatori。 - 不把 LDAP 密码成功当成完整 MFA 成功；所有因素绑定同一主体与认证事务。 - 不提交凭据、MFA secret、生产配置秘密或包含上述内容的测试输出。 diff --git a/README.md b/README.md index 6c61f1d..30a3446 100644 --- a/README.md +++ b/README.md @@ -1,7 +1,7 @@ # iam-login 独立 IAM 的登录与认证服务，以 Java、Spring Security 和 GraalVM Native 实现，作为 -Hydra 的 Login/Consent 应用。当前已生成 Spring Initializr 骨架，尚未实现 AD、MFA 与 Hydra 登录链路。 +Hydra 的 Login/Consent 应用。已实现 AD 密码与直接所属组查询，以及等待 MFA 的浏览器页面；MFA 与 Hydra 登录链路仍待实现。 ## 职责与边界 @@ -34,7 +34,8 @@ Hydra 的 Login/Consent 应用。当前已生成 Spring Initializr 骨架，尚 4.1.1 和 Gradle；Spring Security 等库由 Boot BOM 管理，插件版本在 build.gradle 中固定。 Native 使用 GraalVM 25。 -Native 构建与原生二进制上的认证测试是交付要求；JVM 测试通过或 native 编译成功都不 +日常改动先跑 JVM 测试，不要求每轮编译 Native。Native 构建与原生二进制上的认证测试 +留在阶段性验收；JVM 测试通过或 native 编译成功都不 单独构成验收。Keycloak 可作为流程与安全边界参考，不以它采用 Quarkus 作为 native 兼容性证据，不直接引入其服务端 SPI 和模型。 @@ -53,7 +54,7 @@ npm --prefix frontend run build ``` 测试需要可用的 Docker，生成器配置了 Grafana LGTM Testcontainer。 -当前有隔离的浏览器交互原型与上下文测试，默认 Spring Security 登录页不是可用的 IAM 登录流程。 +包含隔离浏览器原型和 AD 第一因素测试；默认 Spring Security 登录页不是 IAM 登录流程。 使用 GraalVM 25 验证原生测试与编译： ```sh @@ -65,10 +66,17 @@ Docker 开发使用 `scripts/gradle-in-docker`，默认持久挂载 Gradle 缓 原生应用可用 `python3 scripts/native-smoke.py` 检查启动、默认访问控制和 HTTP 指标。 JVM、AOT、Native 测试及原生应用 HTTP 检查已通过，实测范围与资源数据见 [本地验证结果](docs/bootstrap.md#2026-09-25-本地验证结果)。 -AD、MFA 与 Hydra 认证链路仍待实现与验收。 +新增 AD 路径本轮按维护者要求只进行 JVM 验证，不沿用基线的 Native 验收结论。 +真实目录密码和组结果需人类验收；MFA 与 Hydra 链路仍待实现。 ## 浏览器流程预览 人类登录界面采用 React + Vite，参考 Keycloakify 的内联上下文与原生表单提交方式。 原型默认关闭，仅测试页面切换与局部交互，不执行真实认证。启动、浏览器测试和边界见 [浏览器流程原型](docs/browser-preview.md)。 + +## AD 第一因素接入 + +真实入口为 `/signin`，默认关闭且要求 HTTPS。密码验证通过后显示 AD 身份与直接所属组， +停在等待 MFA 状态，不建立完整登录身份或接受 Hydra challenge。 +配置、组语义、HTTPS 与验收边界见 [AD 接入](docs/ad-login.md)。 diff --git a/build.gradle b/build.gradle index 2eace16..ad43c2b 100644 --- a/build.gradle +++ b/build.gradle @@ -27,6 +27,7 @@ dependencies { implementation 'org.springframework.boot:spring-boot-starter-validation' implementation 'org.springframework.boot:spring-boot-starter-webmvc' implementation 'org.springframework.security:spring-security-webauthn' + implementation 'org.springframework.security:spring-security-ldap' compileOnly 'org.projectlombok:lombok' developmentOnly 'org.springframework.boot:spring-boot-devtools' runtimeOnly 'io.micrometer:micrometer-registry-prometheus' diff --git a/docs/ad-login.md b/docs/ad-login.md new file mode 100644 index 0000000..e197ad8 --- /dev/null +++ b/docs/ad-login.md @@ -0,0 +1,102 @@ +# AD 第一因素接入 + +`/signin` 接收 AD 用户名（sAMAccountName）或本域 UPN，使用 Spring Security +`ActiveDirectoryLdapAuthenticationProvider` 以用户身份执行 LDAPS bind 与目录查询。 +不使用额外目录服务账号，不写入 AD，不复制 Authelia 的绑定密码。 + +成功后重定向到 `/signin/mfa`，显示目录账号、objectGUID、邮箱、直接所属组及组 DN。 +**这是密码因素验收页面，MFA 尚未接入，不是完整登录成功。** 不创建 Spring Security +认证上下文，不调用 Hydra，不替换现役 Go/Authelia/Gitea 登录链路。演示入口 `/preview` +仍完全隔离，默认关闭，演示码不能推进真实认证。 + +## 目录和组语义 + +- AD 是身份和组权威。objectGUID 按 AD 混合字节序解析为标准 UUID，作为目录稳定键； + 不是已确定的 Hydra `sub`。切换前仍须处理现役 issuer/sub 哈希的主体连续性。 +- 从 `memberOf` 读取直接成员关系，保留原始 DN；CN 保留大小写，不添加 `ROLE_`， + 不把 Spring 的 `FACTOR_PASSWORD` 当作组。结果排序，不做应用专用组改写。 +- 此轮不展开嵌套组、不推导 primaryGroupID，也不宣称与 Authelia 的有效组集合完全一致。 + 遇到 ranged memberOf 或不同 DN 同名 CN 拒绝映射，不静默丢组或合并不同主体。 +- AD bind 执行密码及账号状态检查；Spring 解析禁用、锁定、密码过期等 AD 子码。 + 搜索排除 computer 对象，只接受唯一用户条目和合法 objectGUID/sAMAccountName。 +- 邮箱作为目录属性展示，不声称 `email_verified=true`。 + +## 启用 + +正常 JVM 构建： + +```sh +IAM_DOCKER_USE_SUDO=1 scripts/gradle-in-docker test bootJar +``` + +Gradle 与 npm 缓存默认持久挂载，可用 `IAM_GRADLE_CACHE`、`IAM_NPM_CACHE` 指定目录。 +日常迭代不必每轮跑 Native；新增 AD/JNDI/TLS 路径的原生验收留到阶段性验证。 + +运行时配置（非秘密）： + +```yaml +iam: + ad: + enabled: true + url: ldaps://dc1.ad.ddupan.top:636 + domain: ad.ddupan.top + base-dn: DC=ad,DC=ddupan,DC=top +server: + port: 18082 + ssl: + enabled: true + certificate: file:/run/iam/browser.crt + certificate-private-key: file:/run/iam/browser.key + servlet: + session: + cookie: + secure: true + same-site: lax +``` + +证书与私钥使用外部受管文件，不加入仓库。开发验收可使用本机的 Tailscale HTTPS 域名 +及相应证书；用匹配证书的主机名打开，不能用 LAN IP 替代域名后跳过警告。 +部署与证书自动续期归 homelab-infra，此轮本地运行不是生产部署。 + +LDAPS 使用默认 JSSE 信任库并执行服务端域名校验。Samba 当前证书由 OpenBao 内部 CA +签发，需把**公开 CA** 加入运行用 truststore，并通过 JVM 参数指定： + +```sh +java -Djavax.net.ssl.trustStore=/run/iam/truststore \ + -Djavax.net.ssl.trustStorePassword=changeit -jar iam-login.jar +``` + +这里 truststore 仅含公开信任锚，口令不是目录密码。保留所需公共根证书；不得禁用 +LDAP endpoint identification 或用信任所有证书的 socket factory。连接/读取超时为 3/5 秒。 + +浏览器入口只接受 HTTPS；明文请求返回 426。默认不信任转发头。若以后由代理终结 TLS， +必须配合仅受信代理可达的后端网络和转发头配置，不能公开一个信任任意 forwarded header +的 HTTP 端口。当前开发验收由应用直接终结 TLS。 + +## 状态与操作 + +原生表单 POST 带 Spring CSRF token；服务端决定下一页。密码成功后轮换 session ID， +只保存目录身份快照和十分钟期限，不保存密码；重启或“退出并重新验证”清除事务。 +页面禁止缓存，内联 JSON 转义 HTML 结束标记。失败页面不披露目录内部异常。 + +当前每个 session 只保留一份事务，多标签页会共享状态。两秒提交间隔仅用于同事务的 +重复提交，不是账号/IP 限流；此 PoC 仅供受控 LAN/Tailscale 验收，生产发布前仍需完善 +入口限流、审计、MFA、Hydra 事务和恢复策略。 + +基础存活检查使用 `/actuator/health/liveness`。Boot 自动配置的 LDAP 健康项并未连接这里 +独立配置的 AD provider，不能把该项当作此认证路径的可用性验证。 + +## 本轮验证边界 + +隔离测试使用真实 TLS、LDAP bind 和搜索，校验正确/错误密码、未知账号、AD 账号状态 +子码、GUID 字节序、组名、错误 TLS 主机名、CSRF、HTTPS、会话轮换、超时和密码成功后 +仍未完整认证。UnboundID 的 UPN bind 与 AD 子码由测试拦截器模拟，不能替代 Samba AD。 +测试证书、私钥与账号全为虚构夹具，不用于实际部署。 + +2026-09-25：JVM 测试共 12 项通过（原有 6 项、新增 AD 6 项），`bootJar` 构建通过。 +实际 JVM 使用受信 CA 完成 Samba AD RootDSE 查询，HTTPS 页面返回 200。 +浏览器已检查登录表单渲染、真实 CSRF 原生 POST 和失败后清空密码；只使用在访问 AD 前 +即拒绝的合成外域用户名，不尝试猜测人类密码。 +实际人类密码与组结果仍需维护者 +在 HTTPS 页面输入凭据验收，不在聊天、命令行或日志中传递人类密码。 +新增 AD 路径尚未进行 Native 测试，不能复用旧 UI 原型的 Native 结论。 diff --git a/docs/native-validation.md b/docs/native-validation.md index 6232430..a39c230 100644 --- a/docs/native-validation.md +++ b/docs/native-validation.md @@ -20,6 +20,9 @@ WebAuthn 集成；TOTP、恢复方式与已有 Authelia MFA 的迁移方式需 - Hydra admin 保持内部访问，业务日志不得包含密码、MFA secret、token 或 challenge。 - 原生二进制与隔离 Hydra 完成授权码链路，再验证现有 Gitea 账号及权限。 +日常迭代以 JVM 测试为准，不要求每轮执行 Native 编译。Native 验证安排在阶段性验收 +或新增反射、JNDI、TLS 等兼容性风险时集中进行；记录尚未覆盖的新路径。 + ## Native 与监控 - CI 构建 Native 产物并对该产物执行集成测试；测试报告区分 JVM 与 Native。 diff --git a/frontend/index.html b/frontend/index.html index 5e16d5b..4b65779 100644 --- a/frontend/index.html +++ b/frontend/index.html @@ -4,11 +4,11 @@ - 登录体验预览 · IAM + 登录 · IAM
- + diff --git a/frontend/src/main.tsx b/frontend/src/main.tsx index deb662b..af38606 100644 --- a/frontend/src/main.tsx +++ b/frontend/src/main.tsx @@ -3,7 +3,8 @@ import { useState, useLayoutEffect, type ReactNode } from "react"; import "./style.css"; type PageContext = { - step: "identity" | "verification" | "complete"; + step: "identity" | "verification" | "complete" | "password" | "mfa-pending"; + identity?: { username: string; objectGuid: string; email: string; groups: string[]; groupDns: string[] }; name: string; error: string; action: string; @@ -32,8 +33,8 @@ function Form({ children }: { children: ReactNode }) { @@ -156,4 +157,36 @@ function App() { ); } -createRoot(document.getElementById("root")!).render(); +function SignIn() { + useLayoutEffect(() => { performance.mark("iam-page-ready"); }, []); + const identity = context.identity; + return
+
iam
+
+
AD 登录验证
+

{context.step === "password" ? "登录你的账号" : "密码已验证，等待 MFA"}

+

{context.step === "password" + ? "使用 AD 用户名或完整 UPN 登录。" + : `${context.name}，目录验证成功。第二因素尚未接入，本次没有完成登录或向应用授权。`}

+ {context.error &&

{context.error}

} + {identity &&
+
账号
{identity.username}
+
目录标识
{identity.objectGuid}
+
邮箱
{identity.email || "未设置"}
+

直接所属组

+ {identity.groups.length ?
    {identity.groups.map(group =>
  • {group}
    • )}
:

没有直接所属组。

} +
组 DN
    {identity.groupDns.map(dn =>
  • {dn}
    • )}
+

当前仅读取 memberOf，不展开嵌套组，也不包含主组。

+
} +
{context.step === "password" && <> + + + }
+
+
独立 IAM · AD 接入验证
+
; +} + +createRoot(document.getElementById("root")!).render( + context.step === "password" || context.step === "mfa-pending" ? : , +); diff --git a/frontend/src/style.css b/frontend/src/style.css index 9df008c..3318073 100644 --- a/frontend/src/style.css +++ b/frontend/src/style.css @@ -238,3 +238,7 @@ button:focus-visible { color: #ffc3b9; } } + +.directory-result { overflow-wrap: anywhere; } +.directory-result dd { margin: 0 0 1rem; } +.directory-result h2 { font-size: 1rem; } diff --git a/src/main/java/top/ddupan/iam/login/ad/AdLoginController.java b/src/main/java/top/ddupan/iam/login/ad/AdLoginController.java new file mode 100644 index 0000000..4d18a50 --- /dev/null +++ b/src/main/java/top/ddupan/iam/login/ad/AdLoginController.java @@ -0,0 +1,128 @@ +package top.ddupan.iam.login.ad; + +import jakarta.servlet.http.HttpServletRequest; +import jakarta.servlet.http.HttpSession; +import java.time.Instant; +import java.util.Map; +import org.springframework.http.HttpStatus; +import org.springframework.http.MediaType; +import org.springframework.http.ResponseEntity; +import org.springframework.security.core.AuthenticationException; +import org.springframework.security.web.csrf.CsrfToken; +import org.springframework.web.bind.annotation.GetMapping; +import org.springframework.web.bind.annotation.PostMapping; +import org.springframework.web.bind.annotation.RequestParam; +import org.springframework.web.bind.annotation.RestController; +import org.springframework.web.server.ResponseStatusException; +import top.ddupan.iam.login.preview.PageRenderer; + +/** Human first-factor PoC. No SecurityContext, MFA acceptance, or Hydra calls. */ +@RestController +public class AdLoginController { + static final String STATE = AdLoginController.class.getName() + ".state"; + private final AdPasswordVerifier verifier; + private final PageRenderer renderer; + + public AdLoginController(AdPasswordVerifier verifier, PageRenderer renderer) { + this.verifier = verifier; + this.renderer = renderer; + } + + @GetMapping(value = "/signin", produces = MediaType.TEXT_HTML_VALUE) + ResponseEntity page(HttpServletRequest request, CsrfToken csrf) { + requireAvailable(request); + var session = request.getSession(); + synchronized (session) { + var state = state(session); + if (state.identity != null) return redirect("/signin/mfa"); + return renderer.render(Map.of("step", "password", "name", state.username, + "error", state.error, "action", "/signin/password", "csrf", csrf(csrf))); + } + } + + @PostMapping("/signin/password") + ResponseEntity password(HttpServletRequest request, + @RequestParam(defaultValue = "") String username, + @RequestParam(defaultValue = "") String password) { + requireAvailable(request); + var session = request.getSession(false); + if (session == null) throw new ResponseStatusException(HttpStatus.CONFLICT); + synchronized (session) { + var state = (State) session.getAttribute(STATE); + if (state == null || state.identity != null || state.expires.isBefore(Instant.now())) { + return redirect("/signin"); + } + // Prevent double submissions in this transaction; perimeter rate limits belong at ingress. + if (state.retryAfter.isAfter(Instant.now())) throw new ResponseStatusException(HttpStatus.TOO_MANY_REQUESTS); + state.retryAfter = Instant.now().plusSeconds(2); + state.username = username.length() <= 256 ? username : ""; + try { + var identity = verifier.verify(username, password); + request.changeSessionId(); + state.identity = identity; + state.error = ""; + state.expires = Instant.now().plusSeconds(600); + return redirect("/signin/mfa"); + } catch (AuthenticationException | org.springframework.dao.DataAccessException ex) { + // Neither directory exception details nor passwords enter HTML/session/logs. + state.error = "无法验证账号，请检查凭据与账号状态，或稍后重试。"; + return redirect("/signin"); + } + } + } + + @GetMapping(value = "/signin/mfa", produces = MediaType.TEXT_HTML_VALUE) + ResponseEntity pending(HttpServletRequest request, CsrfToken csrf) { + requireAvailable(request); + var session = request.getSession(false); + if (session == null) return redirect("/signin"); + synchronized (session) { + var state = state(session); + if (state.identity == null) return redirect("/signin"); + var identity = state.identity; + return renderer.render(Map.of("step", "mfa-pending", "name", identity.displayName(), + "error", "", "action", "/signin/restart", "csrf", csrf(csrf), + "identity", Map.of("username", identity.username(), "objectGuid", identity.objectGuid(), + "email", identity.email(), "groups", identity.groups(), "groupDns", identity.groupDns()))); + } + } + + @PostMapping("/signin/restart") + ResponseEntity restart(HttpServletRequest request) { + requireAvailable(request); + var session = request.getSession(false); + if (session != null) session.invalidate(); + return redirect("/signin"); + } + + private void requireAvailable(HttpServletRequest request) { + if (!verifier.enabled()) throw new ResponseStatusException(HttpStatus.NOT_FOUND); + if (!request.isSecure()) throw new ResponseStatusException(HttpStatus.UPGRADE_REQUIRED, "HTTPS required"); + } + + private static Map csrf(CsrfToken token) { + return Map.of("name", token.getParameterName(), "value", token.getToken()); + } + + private static State state(HttpSession session) { + var state = (State) session.getAttribute(STATE); + if (state == null || state.expires.isBefore(Instant.now())) { + state = new State(); + session.setAttribute(STATE, state); + } + return state; + } + + private static ResponseEntity redirect(String location) { + return ResponseEntity.status(HttpStatus.SEE_OTHER).header("Location", location) + .header("Cache-Control", "no-store").build(); + } + + static final class State { + String username = ""; + String error = ""; + DirectoryIdentity identity; + Instant expires = Instant.now().plusSeconds(600); + Instant retryAfter = Instant.EPOCH; + } +} diff --git a/src/main/java/top/ddupan/iam/login/ad/AdPasswordVerifier.java b/src/main/java/top/ddupan/iam/login/ad/AdPasswordVerifier.java new file mode 100644 index 0000000..debad04 --- /dev/null +++ b/src/main/java/top/ddupan/iam/login/ad/AdPasswordVerifier.java @@ -0,0 +1,151 @@ +package top.ddupan.iam.login.ad; + +import java.net.URI; +import java.nio.ByteBuffer; +import java.nio.ByteOrder; +import java.util.Arrays; +import java.util.Collection; +import java.util.List; +import java.util.Map; +import java.util.UUID; +import javax.naming.NamingException; +import javax.naming.ldap.LdapName; +import org.springframework.boot.context.properties.EnableConfigurationProperties; +import org.springframework.ldap.core.DirContextAdapter; +import org.springframework.ldap.core.DirContextOperations; +import org.springframework.security.authentication.BadCredentialsException; +import org.springframework.security.authentication.InternalAuthenticationServiceException; +import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; +import org.springframework.security.core.GrantedAuthority; +import org.springframework.security.core.userdetails.User; +import org.springframework.security.core.userdetails.UserDetails; +import org.springframework.security.ldap.authentication.ad.ActiveDirectoryLdapAuthenticationProvider; +import org.springframework.security.ldap.userdetails.UserDetailsContextMapper; +import org.springframework.stereotype.Service; + +/** Invoke explicitly as a first factor; never register this as a web AuthenticationProvider. */ +@Service +@EnableConfigurationProperties(AdProperties.class) +public class AdPasswordVerifier { + private final ActiveDirectoryLdapAuthenticationProvider provider; + private final AdProperties properties; + + public AdPasswordVerifier(AdProperties properties) { + this.properties = properties; + if (!properties.enabled()) { + provider = null; + return; + } + URI uri = URI.create(properties.url()); + if (!"ldaps".equals(uri.getScheme()) || uri.getHost() == null || uri.getUserInfo() != null + || uri.getQuery() != null || uri.getFragment() != null + || properties.domain() == null || properties.domain().isBlank() + || properties.baseDn() == null || properties.baseDn().isBlank()) { + throw new IllegalArgumentException("AD requires an LDAPS URL, domain and base DN"); + } + provider = new ActiveDirectoryLdapAuthenticationProvider( + properties.domain(), properties.url(), properties.baseDn()); + provider.setConvertSubErrorCodesToExceptions(true); + provider.setUseAuthenticationRequestCredentials(false); + provider.setSearchFilter("(&(objectClass=user)(!(objectClass=computer))(userPrincipalName={0}))"); + provider.setContextEnvironmentProperties(Map.of( + "com.sun.jndi.ldap.connect.timeout", "3000", + "com.sun.jndi.ldap.read.timeout", "5000", + "java.naming.ldap.attributes.binary", "objectGUID", + "java.naming.referral", "throw")); + // Directory groups are mapped independently; do not confuse FACTOR_PASSWORD with a group. + provider.setAuthoritiesPopulator((entry, username) -> List.of()); + provider.setUserDetailsContextMapper(new IdentityMapper()); + } + + public boolean enabled() { return properties.enabled(); } + + public DirectoryIdentity verify(String username, String password) { + if (provider == null) throw new IllegalStateException("AD login is disabled"); + if (username == null || username.isBlank() || username.length() > 256 + || username.contains("\\") || !username.equals(username.strip()) + || (username.contains("@") && !username.toLowerCase(java.util.Locale.ROOT) + .endsWith("@" + properties.domain().toLowerCase(java.util.Locale.ROOT))) + || password == null || password.isEmpty() || password.length() > 1024) { + throw new BadCredentialsException("Invalid credentials"); + } + var token = UsernamePasswordAuthenticationToken.unauthenticated(username, password); + try { + var result = provider.authenticate(token); + try { + return ((IdentityUser) result.getPrincipal()).identity; + } finally { + if (result instanceof org.springframework.security.core.CredentialsContainer credentials) { + credentials.eraseCredentials(); + } + } + } finally { + token.eraseCredentials(); + } + } + + static final class IdentityUser extends User { + final DirectoryIdentity identity; + IdentityUser(DirectoryIdentity identity) { + super(identity.username(), "", List.of()); + this.identity = identity; + } + } + + static final class IdentityMapper implements UserDetailsContextMapper { + @Override + public UserDetails mapUserFromContext(DirContextOperations entry, String username, + Collection authorities) { + try { + // Refuse an incomplete ranged result instead of silently dropping groups. + var ids = entry.getAttributes().getIDs(); + try { + while (ids.hasMore()) { + if (ids.next().toLowerCase(java.util.Locale.ROOT).startsWith("memberof;")) { + throw new IllegalArgumentException("Ranged membership is not supported yet"); + } + } + } finally { ids.close(); } + String account = required(entry, "sAMAccountName"); + String display = entry.getStringAttribute("displayName"); + String email = entry.getStringAttribute("mail"); + String[] membership = entry.getStringAttributes("memberOf"); + List dns = membership == null ? List.of() : Arrays.stream(membership).sorted().toList(); + var groups = new java.util.TreeSet(); + for (String dn : dns) { + var name = new LdapName(dn); + var rdn = name.getRdn(name.size() - 1); + if (!rdn.getType().equalsIgnoreCase("CN")) throw new IllegalArgumentException("Group has no CN"); + if (!groups.add(rdn.getValue().toString())) throw new IllegalArgumentException("Ambiguous group CN"); + } + return new IdentityUser(new DirectoryIdentity( + guid((byte[]) entry.getObjectAttribute("objectGUID")), account, + display == null ? account : display, email == null ? "" : email, + List.copyOf(groups), dns)); + } catch (NamingException | IllegalArgumentException | ClassCastException ex) { + throw new InternalAuthenticationServiceException("Directory identity cannot be mapped", ex); + } + } + + @Override + public void mapUserToContext(UserDetails user, DirContextAdapter context) { + throw new UnsupportedOperationException("Read-only directory integration"); + } + + private static String required(DirContextOperations entry, String attribute) { + String value = entry.getStringAttribute(attribute); + if (value == null || value.isBlank()) throw new IllegalArgumentException("Missing directory attribute"); + return value; + } + } + + static String guid(byte[] bytes) { + if (bytes == null || bytes.length != 16) throw new IllegalArgumentException("Invalid objectGUID"); + var little = ByteBuffer.wrap(bytes).order(ByteOrder.LITTLE_ENDIAN); + long most = Integer.toUnsignedLong(little.getInt()) << 32 + | (long) Short.toUnsignedInt(little.getShort()) << 16 + | Short.toUnsignedInt(little.getShort()); + long least = ByteBuffer.wrap(bytes, 8, 8).getLong(); + return new UUID(most, least).toString(); + } +} diff --git a/src/main/java/top/ddupan/iam/login/ad/AdProperties.java b/src/main/java/top/ddupan/iam/login/ad/AdProperties.java new file mode 100644 index 0000000..6ebcaca --- /dev/null +++ b/src/main/java/top/ddupan/iam/login/ad/AdProperties.java @@ -0,0 +1,6 @@ +package top.ddupan.iam.login.ad; + +import org.springframework.boot.context.properties.ConfigurationProperties; + +@ConfigurationProperties("iam.ad") +public record AdProperties(boolean enabled, String url, String domain, String baseDn) {} diff --git a/src/main/java/top/ddupan/iam/login/ad/DirectoryIdentity.java b/src/main/java/top/ddupan/iam/login/ad/DirectoryIdentity.java new file mode 100644 index 0000000..28cf372 --- /dev/null +++ b/src/main/java/top/ddupan/iam/login/ad/DirectoryIdentity.java @@ -0,0 +1,12 @@ +package top.ddupan.iam.login.ad; + +import java.util.List; + +/** Directory key only: deliberately not a Hydra subject or a completed authentication. */ +public record DirectoryIdentity(String objectGuid, String username, String displayName, + String email, List groups, List groupDns) { + public DirectoryIdentity { + groups = List.copyOf(groups); + groupDns = List.copyOf(groupDns); + } +} diff --git a/src/main/java/top/ddupan/iam/login/preview/PageRenderer.java b/src/main/java/top/ddupan/iam/login/preview/PageRenderer.java new file mode 100644 index 0000000..0b69f23 --- /dev/null +++ b/src/main/java/top/ddupan/iam/login/preview/PageRenderer.java @@ -0,0 +1,32 @@ +package top.ddupan.iam.login.preview; + +import java.io.IOException; +import java.nio.charset.StandardCharsets; +import org.springframework.core.io.ClassPathResource; +import org.springframework.http.MediaType; +import org.springframework.http.ResponseEntity; +import org.springframework.stereotype.Component; +import tools.jackson.databind.json.JsonMapper; + +/** Shared HTML shell; the page context is data, never executable JavaScript. */ +@Component +public class PageRenderer { + private static final String SLOT = "__IAM_PAGE_CONTEXT__"; + private final String shell; + private final JsonMapper json = JsonMapper.builder().build(); + + public PageRenderer() throws IOException { + shell = new ClassPathResource("ui/index.html").getContentAsString(StandardCharsets.UTF_8); + if (shell.indexOf(SLOT) < 0 || shell.indexOf(SLOT) != shell.lastIndexOf(SLOT)) { + throw new IllegalStateException("Expected exactly one UI context slot"); + } + } + + public ResponseEntity render(Object context) { + String safe = json.writeValueAsString(context).replace("<", "\\u003c") + .replace(">", "\\u003e").replace("&", "\\u0026") + .replace("\u2028", "\\u2028").replace("\u2029", "\\u2029"); + return ResponseEntity.ok().header("Cache-Control", "no-store") + .contentType(MediaType.TEXT_HTML).body(shell.replace(SLOT, safe)); + } +} diff --git a/src/main/java/top/ddupan/iam/login/preview/PreviewConfiguration.java b/src/main/java/top/ddupan/iam/login/preview/PreviewConfiguration.java index 04babb3..99ef53d 100644 --- a/src/main/java/top/ddupan/iam/login/preview/PreviewConfiguration.java +++ b/src/main/java/top/ddupan/iam/login/preview/PreviewConfiguration.java @@ -19,7 +19,7 @@ class PreviewConfiguration implements WebMvcConfigurer { @Bean SecurityFilterChain security(HttpSecurity http) throws Exception { return http.authorizeHttpRequests(auth -> auth - .requestMatchers("/error", "/preview", "/preview/**", "/assets/**", "/actuator/health/**").permitAll() + .requestMatchers("/error", "/signin", "/signin/**", "/preview", "/preview/**", "/assets/**", "/actuator/health/**").permitAll() .anyRequest().authenticated()) .formLogin(Customizer.withDefaults()) .httpBasic(Customizer.withDefaults()) diff --git a/src/main/java/top/ddupan/iam/login/preview/PreviewController.java b/src/main/java/top/ddupan/iam/login/preview/PreviewController.java index 423f243..0ecee40 100644 --- a/src/main/java/top/ddupan/iam/login/preview/PreviewController.java +++ b/src/main/java/top/ddupan/iam/login/preview/PreviewController.java @@ -2,11 +2,8 @@ package top.ddupan.iam.login.preview; import jakarta.servlet.http.HttpServletRequest; import jakarta.servlet.http.HttpSession; -import java.io.IOException; -import java.nio.charset.StandardCharsets; import java.util.Map; import org.springframework.beans.factory.annotation.Value; -import org.springframework.core.io.ClassPathResource; import org.springframework.http.HttpStatus; import org.springframework.http.MediaType; import org.springframework.http.ResponseEntity; @@ -16,23 +13,17 @@ import org.springframework.web.bind.annotation.PostMapping; import org.springframework.web.bind.annotation.RequestParam; import org.springframework.web.bind.annotation.RestController; import org.springframework.web.server.ResponseStatusException; -import tools.jackson.databind.json.JsonMapper; /** An isolated UI experiment. It never creates an authenticated SecurityContext. */ @RestController class PreviewController { private static final String STATE = PreviewController.class.getName() + ".state"; - private static final String SLOT = "__IAM_PAGE_CONTEXT__"; private final boolean enabled; - private final String shell; - private final JsonMapper json = JsonMapper.builder().build(); + private final PageRenderer renderer; - PreviewController(@Value("${iam.ui-preview.enabled:false}") boolean enabled) throws IOException { + PreviewController(@Value("${iam.ui-preview.enabled:false}") boolean enabled, PageRenderer renderer) { this.enabled = enabled; - this.shell = new ClassPathResource("ui/index.html").getContentAsString(StandardCharsets.UTF_8); - if (shell.indexOf(SLOT) < 0 || shell.indexOf(SLOT) != shell.lastIndexOf(SLOT)) { - throw new IllegalStateException("Expected exactly one UI context slot"); - } + this.renderer = renderer; } @GetMapping(value = {"/preview", "/preview/verify", "/preview/complete"}, produces = MediaType.TEXT_HTML_VALUE) @@ -54,8 +45,7 @@ class PreviewController { case "verification" -> "/preview/verify"; default -> "/preview/restart"; }, "csrf", Map.of("name", csrf.getParameterName(), "value", csrf.getToken())); - return ResponseEntity.ok().header("Cache-Control", "no-store") - .contentType(MediaType.TEXT_HTML).body(shell.replace(SLOT, htmlSafeJson(context))); + return renderer.render(context); } } @@ -131,13 +121,6 @@ class PreviewController { .header("Cache-Control", "no-store").build(); } - String htmlSafeJson(Object value) { - // JSON in a script data block still participates in HTML parsing. - return json.writeValueAsString(value).replace("<", "\\u003c") - .replace(">", "\\u003e").replace("&", "\\u0026") - .replace("\u2028", "\\u2028").replace("\u2029", "\\u2029"); - } - private static class State { String step = "identity"; String name = ""; diff --git a/src/test/java/top/ddupan/iam/login/ad/AdIntegrationTests.java b/src/test/java/top/ddupan/iam/login/ad/AdIntegrationTests.java new file mode 100644 index 0000000..948bbe3 --- /dev/null +++ b/src/test/java/top/ddupan/iam/login/ad/AdIntegrationTests.java @@ -0,0 +1,199 @@ +package top.ddupan.iam.login.ad; + +import com.unboundid.ldap.listener.InMemoryDirectoryServer; +import com.unboundid.ldap.listener.InMemoryDirectoryServerConfig; +import com.unboundid.ldap.listener.InMemoryListenerConfig; +import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSimpleBindRequest; +import com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor; +import com.unboundid.ldap.sdk.Entry; +import com.unboundid.ldap.sdk.LDAPException; +import com.unboundid.ldap.sdk.ResultCode; +import com.unboundid.ldap.sdk.SimpleBindRequest; +import java.net.InetAddress; +import java.security.KeyStore; +import java.time.Instant; +import javax.net.ssl.KeyManagerFactory; +import javax.net.ssl.SSLContext; +import javax.net.ssl.TrustManagerFactory; +import org.springframework.aot.hint.RuntimeHints; +import org.springframework.aot.hint.RuntimeHintsRegistrar; +import org.springframework.context.annotation.ImportRuntimeHints; +import org.junit.jupiter.api.AfterAll; +import org.junit.jupiter.api.Test; +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.boot.test.context.SpringBootTest; +import org.springframework.boot.webmvc.test.autoconfigure.AutoConfigureMockMvc; +import org.springframework.http.MediaType; +import org.springframework.mock.web.MockHttpSession; +import org.springframework.security.authentication.DisabledException; +import org.springframework.security.authentication.LockedException; +import org.springframework.security.authentication.BadCredentialsException; +import org.springframework.security.authentication.CredentialsExpiredException; +import org.springframework.test.context.DynamicPropertyRegistry; +import org.springframework.test.context.DynamicPropertySource; +import org.springframework.test.web.servlet.MockMvc; +import static org.assertj.core.api.Assertions.*; +import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.csrf; +import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.*; +import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.*; + +/** Real LDAPS sockets and Spring's AD provider; AD bind/subcode semantics are simulated. */ +@SpringBootTest(properties = {"iam.ad.enabled=true", "iam.ad.domain=example.test", "iam.ad.base-dn=dc=example,dc=test"}) +@AutoConfigureMockMvc +@ImportRuntimeHints(AdIntegrationTests.FixtureHints.class) +class AdIntegrationTests { + static class FixtureHints implements RuntimeHintsRegistrar { + @Override + public void registerHints(RuntimeHints hints, ClassLoader loader) { + hints.resources().registerPattern("ldap/fixture.p12"); + } + } + + static final String BASE = "dc=example,dc=test"; + static final String USER_DN = "cn=Alice," + BASE; + static final byte[] GUID = java.util.HexFormat.of().parseHex("33221100554477668899aabbccddeeff"); + static class Fixture { + static final SSLContext ORIGINAL; + static final InMemoryDirectoryServer LDAP; + static { + try { + ORIGINAL = SSLContext.getDefault(); + var store = KeyStore.getInstance("PKCS12"); + try (var stream = AdIntegrationTests.class.getResourceAsStream("/ldap/fixture.p12")) { + store.load(stream, "fixture-only".toCharArray()); + } + var keys = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm()); + keys.init(store, "fixture-only".toCharArray()); + var trust = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm()); + trust.init(store); + var ssl = SSLContext.getInstance("TLS"); + ssl.init(keys.getKeyManagers(), trust.getTrustManagers(), null); + SSLContext.setDefault(ssl); + var config = new InMemoryDirectoryServerConfig(BASE); + config.setSchema(null); + config.setListenerConfigs(InMemoryListenerConfig.createLDAPSConfig("ldaps", + InetAddress.getByName("127.0.0.1"), 0, ssl.getServerSocketFactory(), ssl.getSocketFactory())); + config.addInMemoryOperationInterceptor(new InMemoryOperationInterceptor() { + @Override + public void processSimpleBindRequest(InMemoryInterceptedSimpleBindRequest request) throws LDAPException { + String name = request.getRequest().getBindDN(); + String subcode = switch (name) { + case "disabled@example.test" -> "533"; + case "locked@example.test" -> "775"; + case "expired@example.test" -> "532"; + default -> null; + }; + if (subcode != null) throw new LDAPException(ResultCode.INVALID_CREDENTIALS, + "80090308: LdapErr: DSID-0C090334, comment: AcceptSecurityContext error, data " + subcode + ", v1db1"); + if (name.equalsIgnoreCase("alice@example.test")) { + request.setRequest(new SimpleBindRequest(USER_DN, request.getRequest().getPassword().getValue())); + } else if (!name.equals(USER_DN)) { + throw new LDAPException(ResultCode.INVALID_CREDENTIALS, "Invalid credentials"); + } + } + }); + LDAP = new InMemoryDirectoryServer(config); + LDAP.startListening(); + LDAP.add(new Entry(BASE, new com.unboundid.ldap.sdk.Attribute("objectClass", "domain"), + new com.unboundid.ldap.sdk.Attribute("dc", "example"))); + LDAP.add(new Entry(USER_DN, + new com.unboundid.ldap.sdk.Attribute("objectClass", "user"), + new com.unboundid.ldap.sdk.Attribute("cn", "Alice"), + new com.unboundid.ldap.sdk.Attribute("sAMAccountName", "alice"), + new com.unboundid.ldap.sdk.Attribute("userPrincipalName", "alice@example.test"), + new com.unboundid.ldap.sdk.Attribute("userPassword", "fixture-password"), + new com.unboundid.ldap.sdk.Attribute("displayName", "Alice "), + new com.unboundid.ldap.sdk.Attribute("mail", "alice@example.test"), + new com.unboundid.ldap.sdk.Attribute("objectGUID", GUID), + new com.unboundid.ldap.sdk.Attribute("memberOf", "CN=gitea-admins," + BASE, "CN=MixedCase," + BASE))); + } catch (Exception ex) { throw new ExceptionInInitializerError(ex); } + } + + } + + @DynamicPropertySource + static void directory(DynamicPropertyRegistry registry) { + registry.add("iam.ad.url", () -> "ldaps://localhost:" + Fixture.LDAP.getListenPort()); + } + + @AfterAll + static void close() { Fixture.LDAP.shutDown(true); SSLContext.setDefault(Fixture.ORIGINAL); } + + @Autowired AdPasswordVerifier verifier; + @Autowired MockMvc mvc; + + @Test + void passwordReadsGuidAndExactGroupsOverTls() { + var identity = verifier.verify("alice", "fixture-password"); + assertThat(identity.objectGuid()).isEqualTo("00112233-4455-6677-8899-aabbccddeeff"); + assertThat(identity.groups()).containsExactly("MixedCase", "gitea-admins"); + assertThat(identity.groupDns()).containsExactly("CN=MixedCase," + BASE, "CN=gitea-admins," + BASE); + assertThat(verifier.verify("alice@example.test", "fixture-password")).isEqualTo(identity); + } + + @Test + void rejectsPasswordsUnknownUsersAndAdAccountStates() { + assertThatThrownBy(() -> verifier.verify("alice", "wrong")).isInstanceOf(BadCredentialsException.class); + assertThatThrownBy(() -> verifier.verify("alice", "")).isInstanceOf(BadCredentialsException.class); + assertThatThrownBy(() -> verifier.verify("unknown", "fixture-password")).isInstanceOf(BadCredentialsException.class); + assertThatThrownBy(() -> verifier.verify("alice@other.test", "fixture-password")).isInstanceOf(BadCredentialsException.class); + assertThatThrownBy(() -> verifier.verify("disabled", "fixture-password")).isInstanceOf(DisabledException.class); + assertThatThrownBy(() -> verifier.verify("locked", "fixture-password")).isInstanceOf(LockedException.class); + assertThatThrownBy(() -> verifier.verify("expired", "fixture-password")).isInstanceOf(CredentialsExpiredException.class); + } + + @Test + void rejectsWrongTlsHostnameAndPlainLdapConfiguration() { + var wrongName = new AdPasswordVerifier(new AdProperties(true, + "ldaps://127.0.0.1:" + Fixture.LDAP.getListenPort(), "example.test", BASE)); + assertThatThrownBy(() -> wrongName.verify("alice", "fixture-password")) + .hasStackTraceContaining("No subject alternative names matching IP address"); + assertThatThrownBy(() -> new AdPasswordVerifier(new AdProperties(true, + "ldap://localhost:389", "example.test", BASE))).isInstanceOf(IllegalArgumentException.class); + } + + @Test + void browserRequiresHttpsCsrfAndOrderedSteps() throws Exception { + mvc.perform(get("/signin")).andExpect(status().isUpgradeRequired()); + mvc.perform(get("/signin/mfa").secure(true)).andExpect(redirectedUrl("/signin")); + mvc.perform(post("/signin/password").secure(true).param("username", "alice") + .param("password", "fixture-password")).andExpect(status().isForbidden()); + } + + @Test + void successfulPasswordRotatesSessionAndStopsBeforeMfa() throws Exception { + var session = new MockHttpSession(); + mvc.perform(get("/signin").secure(true).session(session)).andExpect(status().isOk()); + String oldId = session.getId(); + mvc.perform(post("/signin/password").secure(true).session(session).with(csrf()) + .param("username", "alice").param("password", "fixture-password")) + .andExpect(redirectedUrl("/signin/mfa")); + assertThat(session.getId()).isNotEqualTo(oldId); + var html = mvc.perform(get("/signin/mfa").secure(true).session(session)) + .andExpect(status().isOk()).andExpect(header().string("Cache-Control", "no-store")) + .andReturn().getResponse().getContentAsString(); + assertThat(html).contains("mfa-pending", "gitea-admins", "\\u003c/script\\u003e") + .doesNotContain("fixture-password", "` 逃逸； - React 按文本输出动态内容，不通过 HTML 字符串插入用户名。 -- session 持有演示步骤。表单带 Spring Security CSRF token，缺失被拒绝； - 非当前步骤的提交拒绝，未知/过期 session 的后续页面回到初始步骤。 -- 页面与重定向 `no-store`，静态 hash 资源 public/immutable。CSP 不允许内联可执行脚本。 -- 单 session 仅有一个演示流程，多标签页会共享步骤。正式认证需要独立事务、过期策略、 - 主体与因素绑定；本原型不提供这些保证。 -- 当前采取整页切换，不提前实现 fetch 优化。后续根据测量选择需要局部更新的步骤。 -- 首屏依赖 JavaScript，没有 React SSR、Flight、客户端路由、FreeMarker 或模板引擎。 - 关闭 JavaScript 时显示明确提示，不宣称无 JS 可用。 - -来源：[Keycloakify 入口](https://github.com/keycloakify/keycloakify-starter/blob/main/src/main.tsx)、 -[登录表单](https://github.com/keycloakify/keycloakify/blob/main/src/login/pages/Login.tsx)、 -[Vite 构建](https://vite.dev/guide/build)。 - -## 2026-09-25 本地验证结果 - -本轮应用代码为 `dcf634d`，随后修正 smoke 对 HTML 入口的 Accept 请求头。 -使用固定 GraalVM Java 25.0.2 镜像，构建限制 4 CPU / 8 GiB；原生应用采用默认 O2。 - -| 检查 | 结果 | -|---|---| -| 前端 TypeScript / Vite、bootJar | 通过 | -| JVM test / testAot / nativeTest | 各 6 项，0 失败、0 跳过 | -| Native 应用 smoke | liveness UP；匿名应用及指标 401；认证指标 200；健康请求计数增加 3 | -| 默认关闭 / 显式开启预览 | HTML 请求分别 404 / 200，在同一 Native 构建上实测 | -| Native 上的 Chromium 测试 | 3 项通过，包含整页原生 POST、无 fetch/XHR、缓存、转义与移动端 | -| ELF 文件大小 | 126,291,016 bytes，约 120.44 MiB，不是容器镜像大小 | -| 启动到 liveness 可响应 | 单次 0.351 秒 | -| smoke 请求后 RSS | 148,996 KiB，约 145.50 MiB | -| 模拟限速下的首屏 | 从导航开始到 React 提交 DOM：1,702 ms | -| 模拟限速下的缓存后切换 | Playwright 点击开始到下一页标题可见：560 ms | - -浏览器计时条件为 60ms 网络延迟、1.5Mbps 下载、0.75Mbps 上传及四倍 CPU slowdown。 -这是单次、本机、模拟网络测量，不是生产 SLA，两个计时区间也不同；不据此声称 Native -比 JVM 快多少。原型没有启用 HTTP 压缩，首屏实际下载约 223KB JS；构建日志中的约 70KB -是 gzip 估算，不是本轮实际传输大小。后续页面的 JS `transferSize=0`，确认命中浏览器缓存。 - -本轮没有新增反射补丁。Native 测试日志以及 smoke 的启动、请求、关闭阶段未发现 Native -反射或资源注册错误。生成目录中的配套 `.so` 文件应随 Native 产物保留；这里不承诺单文件 -静态链接交付。AD、真实 MFA、Hydra 和人类验收不在这些结果范围内。 diff --git a/docs/images/browser-preview.png b/docs/images/browser-preview.png deleted file mode 100644 index 29f6957d378d7ff241d95ce513449c65b1b7a55d..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 38248 zcmeFYRa9JE(=OVC1d7`nVqVsB_}uy2|Fm8=6R0h26G#`7rkEt2RYN`E4?u)?tn;O#XYmjVBogYO66#lsI(&;HL8{~LRe`w}o(@XZNr zdO+5K$H`Y5Dt>X=0yKOujW2Ah?GHQp-}XF20=pgGl9@#;DJjmRI6;Zgg`I`uIlq+y zrISfgU_R#FDpAb#D@U5Q=kBf=?~VueC>)E4*^Yf9A)$<6Wb!<5T7V?M1Jzj|V0C$} zL{eHYmsYz40#+s_j1o=F56-2ZJOVh=_d-|bnbvPTpOehYK+JJlo_J~ss^el5Umpy3 zksDTGN4hh9ut5*%L=lmY{s0t8~3VZBVx7~rV13iur$F{ zi-&`j7YTI=<&uP`;?OA4+QYe&Y|52-a3d8`y4kbhuFIpyQ*)E#?2rkw!Gf3#9ttbq zPb@M4>+}FPX~}e=BIY|{bKL5nsPt?74bHP=?uG}Zk0{H<8*ipk&(7JLXvXvM zn|Va({hh)EnJo{l*QNl+BRFJ3zGxUN_n@fXqh@zJYrXU=Pi785S;r4lX${uO4JnL4 z#ww4Kl?v^EOO;w@3C8=+8ZgVIpnLQoVCyrrfGJAR{5ERmNXJ9d#b#?uE2oVj=?iO( zzafbr>&B|B{8SacWyTk;G(q$3>!W2dg-&VQ8UO3aQu<&?q1Q;HoAB9{WwCDz@Ft2# z6v!FrHO=%{jNhxvIFMNx>Co2^M@!&N!mnVXR$p*#?>$Ffjjw5j{z3NjCVMbpdpymJ)hn5oA5 zY@o_13ted};XbouJryI5s@u7zNe;X}JpE z820rd3on;)(PLOL&~AD)OZRQ#I@b1LA-Rno-&$B4jA}NuNI9i%){ICYpvFBvXyiaP zz7%9R6_mac;XIZ!-4|&QN9lRd)!h4SMl3aiNJoDEM>3}hHC0^CDe6*N3B6}vq1=}3 zrqQt!y_;u6JUzrBgnumkbCGR`2LR-{&;zioAqp4LIKWT-(Rsz^s6?&!Hi_Q6hA%3m zb9z2Rx(ooX7l&)+7S~mQ-4g?P?=rTtE_cUe*9bzY|kSyP<_D~8&bGp!W7_lWg`L-+j1WLH*?#n?ZO^{HVOM0X_n z9G|4T4c|KcIr8lEa#PC(D4FIn7+x!;bv0?Csq2OPKCe|o#F(sdKS6ltd>o=$UlzCv^%R=AtBl4YpYOeh5wSNiz#4ysraJL z&YU3T`60R7DjDW+%gaZAblg9EqU4+0Uz*M-XBPBtNWi-+HXhN@j+#`7%hXcB*Y)lv zCoX-0Z_0Ec)>*(}VjLubGh^IU`T860j)WZLj6Zm-*1ugXCOFv1XMBnY$(j$kR7!mF z!e`*cpsh~SxPHv|IsB3@Y;}apsIfqIH*a`8b4|#$Y9KE)ss|kYegCC^^Ka&qKZ?I< zd_pe}%%GX{VS1}zOLoJ?d)+vUbx2se_<@;HfORU`^-&_X^C$g~PeIx(#CyVEM{T}!G>_f|++-x}ZR8wFhc_j<3GY(#_? zxmKGpL{vEaRMqHW>+!16*=iH z9d!_wLDzfAdXH+A0!4r=!OJ3MC+rRN4kfDBG1f|n&!tP=2{I?G-Nff;`rH05F_lVH zbgqBuPnRA&q!J}*Wa;lHi5!c>{2K zCslpw?COUL_q3HQvJ)k3){K9_(0x6*;dm%iOqKN*BViQgG+=PSdltc@q->r4h6~7= zF84S7GGpelC;TrU*NF4~6GZo~Bml5iQC_YDkT5s1vckmX3n>7O>3(k=AiZut=x1Cq z)~ojDb0QR_;;N>Q>_9Q?^OHeaD6pP3FA)MpqkpUnwoB7ONF`*4J z$*5ASFIH}c7L~sIZ_F9S_<_QxMLfU^mi!wD1O@?*zKiq4`Wy1kGi>Ye2Qy0DCk8&7 z1*A9IQGa3YkvGHK{{WQwtWUlu^gkJmoO1nX*FLH60%x=i1DAQQ@RKy(P;L!>ZXp6_ZDcoq2N9Szon<*fQ6te(xcZ+A2 z`WwbIJOPE^j>==$zd-fpIHT4N{#HmQR@RbY3^+IVUAdSUr5N4c&A6Ptmn3YBi zSagkbYcS&kFs|BiT*3bR_X9a*zK13MG;BFn+<6kP$4X0CsaDQ_jcu)oSsO*fjn$;j zrTz6S4xTzsKzFYSkHqiR@(+G`fxr4N|0aBpJ?|^`AqhbgL$`5_f%Sb8VTw+k$^dK#aHZ#K2e1jX~YnG3eH@yt`^=OP;aBu?lBLOe| zHkTr@WjyLB6~mW!BK>dzCw?i6)?w zr=Kti%)ly}gaK=hY-OR_2_MN4F0#&h2?&tM4+cimZV!jy z;qLWw@M9ClU>V|KWR5cGl24)v*yLu%0$B5G95ak0;hKJB$HxB8v2p%0X}7hlP^58I zBPx}P5jT!-K#O29X@=`1g@pN^l6L`i`!y==0&I^0EJHv~06eS@Qq@zfJ_8NVK})c zJiw3=Ht7$nzw-}Tjx44DNF;QBrIJ|x48U=&Fg$Izy=aQS0pwPfY>Ij6)Y1a1B_5PO zS(}GR`KJQhXdksh|64vEKv|v_GKdABpyaT@8lA;>Dnnv?*JKTErc6F8iTtU*p?1+o z0E7smqWy3;3V_6udo{p+3}aCa8VM@I$fGQ$jO!rt>3_HmOxXEvx$DDIMVE0-ksyro zsmRXHwVQhmfbe2|4(XYD0r<;$s`@Oz4#Oh+4O!j50ocF91p)Y9KA6;>Yb${DFM$AT z>x~D86g*$~5*xr{L$!g$^9r*b{PMy|RAtR;2?mVl6?X1H+r5Oj9T;=XZF`pwk>EnZ zJD9`DtVDn(qj3izv&0yw_N3?le`ShCu5S2mT0l!37m7O66VJYKZDjYUdD6~Jeg7~b zDj}3sOd+zKx9}*DtcCOdy|?K^_@?YYf=J;0cqH;fd%6l_Zg{@;W`djB$F`z8QAHMr zybMpI;3G-TpalYLe>VH^_oVotcDGv7g)Y6%(pX>vIiLEMU>gfl!s?N>oP=>+-MP=H zoOQmBuJ(4eY2YwHBF|{}*9)h4VcLLVCgiAtm6g{85b#$YW7iVOb)SrUgPvMg`x;Hg zEChzcMDKiit=JZ>c8*UdXLND6SLG{n7D4zmnjp3Nr|GjZ#U+>Dxm+w-A8z!~Ke8PzR8ZbNO`xUxx;z@& z=&x6IoLV9(TJG+4EbLJen@mOiK~NI8p!4yQMxiIk$52eh6%d6H&)TqD8|d_fMVBje zWBe$5gaEov{jyjkMlXruofBweYo>zB zQ!V2$z)-YI+K3f~vGe~p8<$}M*3E9&V{u~l5k!J8G@eWK+s@FccF6(v8V4bZh1cLJ zz3+tZV{6gGWK-`QrKt#SWx=_oBCpRC!

H*M&c@O7RZ6CwFL*Wzuj|4t@PMYSqCc zJ;`mXRqURLw#9aRNmBT1krSM)PLBf*9gEbE^a81IHT0j62wuz}gzJ3{}fqd|rn z*0R@!JurTc@NEV?Ew0y!3QW-Pf`|q9c4Ez+A)`B~TW!kFa^aedeG>AlZgF0L(W1An z*y{4=3m+dC!%#gHVhK)VhPcV+OzYo;J$%z0k#EW!|+DWF$`k)&du; zS>~IeNud%tbtdC^eu8j0+Km}wL!IWp72rwNM{tCU8W915Ii$n)+%6$hvjkw(BP|PN zGfaHzi>4WCknOlUB#*DZ64mGq(M{XXQ&?!;S+JIBh{HZtE8`L#P8I3a=lm)ct$z+* znj>-1;v(7D6_FLY8jp>b;2q#y9Z9Bo=IgHDq@`lkeBv^o2YuJS-O=-#C;p4pv&r~( zEF(RJEKELqIxaw~p&eGPaaFRX4iXE~n4BVo{UduH6f9$0?APSfb;c0&TLHI>aNiy` zfbAh+u+77V9V3f8kNMmwT<`Y`mrje9nqxC=e6(4nEW3|qsaw{oI804bi(cBU{8;^? z3c7?(9<)*k8Z>JzRE|6K2Hm=CapjpKRRlqCq*<=uGRPNBXQCE;#^%{+R`$?BX7pV zy#?pv5218k%IPoF|LkL&ur=v}H*cZz<2MDzjyK2_HV`zyBlP9SL-T({d%Pfbl~4J% z5$wb%n0vtU{cPorZ%dY5gLTX&W|0)}q+_3{MVgGS_=oNf#U*8F@3onq4|3u6qCaS|I;-Sg~OpXmGBO7K8}eiSe_ zU%wzdL+k!4p>qHAS=kku9>xP*OYWLqz7n6fMR}63wu?T)I1C&&F>Gtpn@9M$Kc*03 zG8eRujH;cpLM0TNT2eq{NxJXf-K9BL-xo#{mw#Kr9T0g7F^T!e}Q)^@v$FZ$r1)5CNDjj~u3Y}p|E7Z=(o;$v~e z7jgS$6Oq5~w)#d?4=tPc$B!fY7qg8JqTz-@(n{2GUD7)Q5EI}B(+z-z-w&spfb%3L zP>bv~-`_dCgpFSIU3KD%`Iq8~ol}Q*$1UjSsToxCoy@S0zr6v+V;pC1)({CiJNle` z!N>ZOALi3OT$Rw&Pi32L1^?fnbY}RE*D1_L<)DDk2f*S$pq!_=+_`tkU#8HaO zBZa<{8YS{V&fJ+$kE|Wvkm2X5Rg+@J>wEEy4T{>lHa3;!)V@@Gnp zK$5o*{EH5-B1499wEwCHG+0|(OI(E?Rw93Sc^OXnT+6!`1Dx@@aHPDi;}S-iYTPhS zKei8H2hqHmh&SYXhwATX58qUz2u>oQQ=aJ$-h846|XHzlFL@G)_-4siveP`m5h}HrpCLPUjUP#Go+crw{O#V8Gu9F_oTl zae(Sl9au6lq^0n0kl003pY1XC;t zhv`mxpW}tfa7D%aIk+zCT~9pcwBy42QK~*@TRAF|0ITC-_kBu*5RQ9qJVK2wup*sF zj1VxofkCRdGTXyhx3^Zuq$!Dp)7o8N2362my@Xq0s^>5ByK$9Z0*8NJX(T*Or~kj7 zAZ)#_YkX^=Q_W7nF4#~9M|nqXG@JOYNC>h#Oj>x`)p8x1-@;%p;6)if z_;-Or2LExmaGdeM2KDS_{lf9VioO;&CS#f%UL|2tFf;j`lL~0KQIplN&g9`nTzIa` zHWO|@OTOp#ZEmmN)A|v<3&*kgcfYCrH}Icffg(v;p^W(jUs$B63(R0@)^#dLCeA*t zd5n#`UYkvHvR1U;0W#(aYJaFDx+WJ~f;>`1ujhXp zCsYNV{Aoi;q76(?_L8Y^Ii#mf`1()pPh8Y=zjw_Rt7>Po9Qa{Le(tfvS5 z^oL2D3l(ilEeF4_c>j@AUl%E>!IFvcSr)cV%wSepx!UjdfYUs^UjSU$QX9-Rd`Kpp zA^+~q1iEqW8y4|qIlb`MWDngsa^L4ZY*IU9Q%_6;`K`$Jy=h?K_`aB!ZMM)aclS3e z|B;ru=fPgD_;|Q-w;9ayZygiPEvs_cf;PwEn$YF$&xq5$?>@2{G84rvUaV$fXg}3^ zaAnQVPRWF$jgeKkOjHi;>W14wBiU~wtzRFwU3@o6p`be8^{_-yDa`g(E@b| zbW#TC$ei2PYK!CDm>5xXmK@khtG`lub*jRuN9v59Uh+@nOMopVK?LmA(=IzfVLbaI zUScSXiOn$D7M#aZ&7p9D!wmnCK&Yn+jlgO?G*D$f{1q7|`qSb~Cp~p0wE>R%GxwLs z-(xK+!m3K1k*eo=WYb^^a8&pu{O(9Wu+bK~2W@q~1bXjx7s`d6xS4*&^)SZ4V(#P5pFo1OG!^kgS#k>V2!{8Oc(Z8 zNlaP1(ELv2Vf=krWb6r!GY6{H;>}JOMwDo|7j1K`xWPzdVz$vyqmjkAJ-vfTeV5+w zfcpFq)F2$Tr~%T4`L1=gwIzQkz;6X=j_CGnyyn{LijhfM(feH)!7m`IM0=oUTMDNT zCzJ$3HG{KwRaAJht)?!$KR7Kop0Ci9+$#sU3t4{p7UJEP*xa;fy%{6CTnX!BN@{E z2lE%zpw~;VwWOB2q)+)FY%nxdqZzP4gESV0P4VCg=TtMh#7Ogm( zm5=vMb9y-CHwbUHV1P!mwL~|o-9B< zFIiiSJBgBqM=d)VLob+B=AfeTyW(w02}wz|Oj?%4+C!8X;StKe=cw%KD-2s0Ou%6% zvmBJ%PKv*tfahMPv1k#B?HcuR#~5k1d2CsC&rj%T+{8^cvQ+Rz@BSk{38Vc=<}&}= z;xEhwifJu6{F_&{y`&7vx!c<|UZf9kG1Knxl zqw4ov_wS}ZP3FQPk&Bh1?M6`?d3=d_i{$DO;_~Dtq+&3K*bR177)nDlVs;k6A7#5z60!+SKDxGDy1Xwrd~J1x*tM1Ht>G!=)(`C0$3%@mSb82l)_cub#MSSS(ZL(~C z)NYGO>Xto(Qiq_Oy=8Gl+RuAKNtNy#SuLv|th%$q@kJaH=wr(~c_DljM}{pv858Up zj!sU{Ge#%23XGkut0~jCPuD+a9$! zb|H+h^|&cQW-N819Rk`n%MKB_C)AhMzETm0_^ZmO$i)r5;r^F9^J0XOo6ABH>jh7} zlHjkKQUgdN^Umzow{0s_D!*7~l63neB+|C{IH)(M&$ppFh`rEMOVDX7;*4mKC zZa%*tW9oUI(P9F&6*V>N4A9P`n3QtJ33XLqYWN$=k$xx~j{vvZ2Bz7eMN;{_F7Q1` zpdU964Q{1tB=5NfX8FwK9fsdtxoa1$Nl3Q2i8GCJVuB!O6VToqpeF^yZiMS8t80|=&d8`scSuGDsqUOm$zX4sQ*l)ur-iU z$Km4=Cj3H0Q@)5G)$2bKHzerh?^j6ns9JvV|FW?%V%DOvh^1oNU1{Q_IcvluO2^;$72Nf&y&=xQgyITJ)%Pd%lm zVqPltKPoXS$4A%grQo?gVo?a zaauVCULKyW!C@c{{md1_5u~Y^V10#rBeQXjA#3LDp51LT1$==&>Zl^e{yYKOxv#Id zXC?BLF+F1>@Gv-ZQ?$qr(ZR$(2otA|UGyc#BmshTPg6=UB+^ivu*yal@v-jKuE(w@ z(Dp*!N1A;~a=lNSKg$!(f!)2rcai8lII9h)`BTghF)uJ7TQ2c3GK+w&YrUP zvq#O!6g)11i2Hc>Magv^k}lQ5-4z^@rqNyn7aeEgmD2J1He{K{qJm@_F3agv6w8Y9 zp5Ndbjna#w_@bPH+n0Dc(+>hAYZ!m`vgdXmJnWcWvv!y=M_vgWg?-&3>{dn0q{}E% zQzklP-`dWuumU0B7foG~>+f>9$fFn$JJwMk*#=ZEdm&%`vHc%T3V`jW2Xu1dzPD94 zhFO=^ykhMy8t-?d!$U^A>1|ofdIlPecMB=m`Z>Q2Utae1X3Oty(+;t+H+{! zSM|E^Et2|uwyAhUqBS?&0k=y9#RaC61qyE71jA0;tt!REke^tnz(LSkyq3trJS`bK zHx);4Qgi`nnDH+^(jBHFjxf#_zuLV>G^0!33Z7^>5w>1I`Hw2x+$QE~S#kF}KCdqN zk5&waOT}&JRo29y@AsDn*IEbvHH#x{;+Yy)>g#K<3R;mcsra>aWi`%V|C0xwa-XV& z<CGWlIBI=gyK**uh0(7{#`Wx!;I&zc@oLFv5zR0U^2J#tk7zuL6Z&Y@ z5%NfZ0PWr`hzi@t@8T%jB5HW#JkRU&0Y&8(Lph zR#_f?4o=8u`CV{IJ36582Jhmz)ltx6z%(XRZ*R_MzIc9qIx;~^r1NgJ!2zEi%kzlj zbh^9xD4ESyQK){e^=O-&{g3gRIgJLpzO{ra&`X->flMa@ICoFKCXB>>L`5ObxQ7 z5UVpI-2L;n`2B|l;ravQy!cjR{;ADpYK1m77Z5?o-MQ+NBC(@bZ@o?N?`tcM>MNo|CLLx! z6u~If7ZzQ%hqfzm`N-KPOiCU((V`nNU|9&h^5t9#R6}(|3}+OI8&avt$+Vr@X6}Pi zuftF-wsCN{+`LYWExqtJW8uiSzT8=2w5!pM%aT@JYzby!_k+#zP>k@mU)gqn0~|6R zOa0;UD*`{0^Zv@VUomp7s>?$uNW(sRA8@=Tx`N{8nsb|U?df8j7Z3sKI9;E zk*6av_xVUj3ed$AMgu7BPKMzN;vbX@#e{`hj#uvM3Zc>LOYCkMyU~^34-oj#M#mt( z@2Z@*xDKKIqU$MQ7pRb)?N)T`3V1z1Q9~Paf3wh{vMXJ-N_>Az>STB8!5nq-H@nD- z#KuQtz0&i_3(EJ$ZFjdA-HNdAhmRPNqy6UoMa>_EEzB6K>;FM5PiF~x9etB=JysFj zAJY+Xv!2?!dt0!b8b;^Z*I>6W;mcQU)X4o!DQJ6mBn6eWJGNqYuF?1eS14!kKD6Yx z@l+I+B*|TF;BQ&|64I6@%8RQ5I!DS^=6UVSu2|>f6;FaDQw~TGfidh!Wg7^t?wpXR{%@Ql^T^k)E*&o)kZ8O2M2t? z76z*Q!0<0$LS(CO*NvMXrSyN`deo&66m-c;o z-IX1aDYrcm(f-mJ!^U6=XHvG^ShHq5akJQAJ@+D2{9?RK(s;L+>bu8@lds#=vgp53 zH(o~^rsn53uN*JKu2y+xrMI($uQ0>lZEwq}eZ1RNb~0d%NiGI2{JV{RPb=ztuOso$okyF#K+k zQ98u%EJK?E#lfNbqNx@R^)ia5xLfLmx!eS$#;Ha>6jW!Pl9&RlzeE#6^Hxq$FL~=m zCxcz^aw1c!H>~lW7*|&5)yn$z<1xL3FQl=gx5bwSHNK;x`q%fmN!P$6v(A541@Y<6bQKlGE@C;;T;VAJvfm|Ir-B;E0?AIFKiy5K!Z;5kUQ1=lohZUNi??MLC zC&j-eFqXqjV2IppY&?IYdoRQ0n#O)kBk+>ZsP|w+Tjf~WTb4l& zzrErR>DRydeqC#KerQ=yY#cG|kU{K%_Oj_96PE|D>T-e`xq- zza`06G1$BpmT=>%XKeBV(kX4Avr7p8{N;M6HUCKbdG^>)*34tqZ$&&s=s7}S=Mp9* zvUzUc=iU|J1W_s`&7s~5YB~oyD3#3uP$rj zZ6abI=qpv5t<%|r?u)n?tHbM_1n%vI9Z=POaRJm0=&gQ>31JNa3~i1dh9TeZ^9wYs zhQp&hn53EDCm;@Ys>DfucW-6r=bSozK8{b5DdyTX)vd%XMv2-YWsORDa1qLnn<)x2 zudFI_xZLl8ap@|{buSB0mx}SzgXk-hv)Z6VVFz9B(kok9(ltR&KF=dr@sJ_Pl^;(r zXP<%qlXz2nmY1(*K-*I9$IWHVuiTs7A_h3<65zV7zRDU_N$>8?Z!*Lge#Y7y54TN- z{4=k%Fg&7vGj#7UjJ-OqnBDTO#ZLy(_=LN=qNVOq-<4Hmas--|IQMDa%)f-8Xc}}K zqwGV6qDd8mjUZEYc&)eG2<@|wz`@0){ZK#GO0-A#4dx33oCo^1O+lfb6ESsTQ}KE6 zRh9~Y>+i7%L=ASvG~5795z0gM^Q^SQ>b9yw3fFt8p3>+h47RI1vqQYLm*G{$#xZh{ zV)FB%c|TvATP)sW`W~d@?`)iDdA?}UMzyPzS@-QX?D&4O_;mc|T0Wb}cPEYHmmNfv ztv`{a9H>4W@0WE3GFT zUFMUU+(=0y{SXztoN1(rDan@EPv<8_%A%KS9f6m3Oup8v@Pa{QM7AD;T*D=gpfaOqAU0u@Wvdio`%ma^KnbQ6EqUA3+ruoJRlj9c`#XrgtT(^Zzzjc%^ zf%rYGV|X_s;bn^+(;(5AdM;b(nI)V#0xf|L1HFxv>VJ|01&-D^b6|Ip##340yoBbL zXZr_6vUHPU!UgEu`;_5FS+H@DVcmr$J2V#NuZksluX0%cDOq8?XY+467e$pWN0ImN z#!D$5-*hjv_$Hec_ccz++_j{FNy3|-%x!ke~&RQI1+LUi&ZPq;-3j}RNMPYZSh3`H--ZxO26|q@W-!?!tbTimxBDw3X?t`Ua zPTcDsSO5v^hi(ngT@`TJHjn3No#(SEF_vXakvptnVLbc5yduJR636Rk%)mfh40kH5 zoYf9`NWXk5)`+I$HrC5|$$fS2ax0#8WvM&g-%EVf99wnoKjX(y96xznxO6cHQMcPS zGkI}*Z-&3X;K$Fh(bA8fbR?Haa%ETU9bG0S^?tp%_LbR?_i{^Zj`luiW*}#U!FG$+ zbiUk%gW-<$jnWOKX9GVF<1#Mt6@@duWpC{{Z?uB{h@~$h;=}Df&5voqEIuC1q!!p@ z2^;j4&1X++1I3L}IXjF#AR+u_73Vvi$31pZA+2J!o5!m5K3i?GrplhBRGGd(q0maV zr>>V*6SqJo59P(hRnhHm%DjIZ*J%*c0k@&h+Ktr$2iYN=JDku-tI`iW1Xp5Lr5J~A z{o%n9Q`QdheK`zkZ@RB>3E;O#an50Ft$1&q%gNwu-|2+ks3B{RRBuIAEq_n;^?eeqJHtTR8y(|a_P+U+K0k2T%wKt; zIX1HH3KL>s*hp+yqxFp1`sU8x@0d*BAgH3cCmv-}N)q{Fm{D0!I;+S%&49|2ca~iI@2`^u&Y;i;!*ahAuh>-4)cBR%W zIE;+s4qb=P_lSRab+wcsOb=fWs6Yc9Ak2*2BzAWrui`UUBfU*9CloDSsE; zpJ@XW;RHI(8HoFNubN;wwsYwoLMF|)r$1anr667GkI#3zJD7=aUE{a4pktNtxWJ<- z7Y1?mk1HeE+Zw3a4&u_Zin7qoG2jZ`DjD1{e;-{L@6>EkXzPxh5vy3#bx&T}IDxuv~ zzALZR|KkX(^X_yV5xzA+GJkW!$uLlb zM+zz)P!Ik?)ysob5PDJMu=R5R@@y5;*Sc`eM>_{R=$E%`j)x)TEt#GH77rz z5jfuK4fppl+m+p?(G_SD<6Zc-AWD&pL$B6mdo{f5EA_nShwb%-qr-!@pELSs**UU= zR`X{kQ@xIJv}*j0&c#wJrHvNH;A<+AH!p628U@POsHki46oMKq$kLz=o86C*6_>Pv zy~m{rBg+l&n(vN%z*>+3uk2CT5(cQWlRVh3k^3zf$C7Q^YtPxn4{*Gw`C-CgZxfZU zF-~|3qd|1}U6FE)(qk~pX1-i_29DZ?G#%gb{Kep{{mi4;vFZ)y!Qk_KaxR~Z4V#4D zw}wh#^I{WQpfu47jBzy^DJCCLc<(B^P`9YuT!((uRs=JoWo(Jo^3->FZ7{iY>ruxX z7TcIi2ps;KrMPu(mfa!v-b{|tCCUAn@KEj7v=p=C_e+8sQ*=u97&qkz!1QlVLf+jM zc`FW)OnVX$Ub>ew??n~S54lNQW%Jm%ZzI&k`;IU5CXzpcUSI9|aE|9v_9wr$5^{FKT1n3ty zWVTpaAzzG4FnK_zEH(|Vx)XKyEc%)tD{SaYZKRk4hJSApWbgcx*xh!!p%|xCIl>;c z(!4g4eZupTewz0Ym!qdHf1QDQ+wHCk@I5u>D@G$6`V4Q0b`jEZq|0dmxywcts!>W z)kX8^+6Em8c6*4e7}sslW5Ki#r5Y~&r26dxFB3r?@8PWjWo}Ct-4={|Y`N71gHVFq zjQ#n$Me44Hah=EvbU6GN%vRZ4Z6+(DOm6>r`Y-E8(>TUzwF^*#3Out1119jubY8sAq#&rtY8s+_i{W0v@GB^!gLvmnp zHkfdHUz!4^Prci0Sr@jJ&Jc8xiShLu3Zq3+dppf^Y-ZJf(m$Lt?Jo#Fq&qkdc~p90 zC;I#>VvA^)0A>X{``g7_EL?X6mR(*3Ah^*4sKFt|cPXA!HyGkrRl&Zbf zcz)NyBade_!lR?Td4Ai?h1l$9c8S9ydv63ktvs*$GiMWOzJJyHxtC3x14G*`U5$xW zcFR`{D+=f2;YCBfyIf}SZjJT(=dYxqN8;{v)SNj4p{G%@*{I#Bmqy1v#|eU0dTsR1 zXLukx2*k^C1XtG6Q>mu)D=ymeuuP>>D;{|L*)!}R;>kTkyfE|7ueFx=D*DWYK(5{R zGLVPOoZjZHmpA_I%x~Xbw}|azv9tbez68b;Rp6rcchZ zC@o!1sPufjx+syAdq15dV8d2Flcg|jvvAw;Q>LsSw{tA`St(%Bz)U~hPBF@2Zg?2- z3ucClm-z|~oC@`*$8INiXfKr;`iSZ8v3>YZA?O1h4`v7dzxnC0^N?J#eb%Q}_@9?E zs%eB1T-PoSqbGPfCn(%%IOk%%^*Xd)nHv-=(yM_wEp<@m@1#B*?ItGl5FRZwbGYtW zt(4EYY&{3ngmBAxc4qOVl9}aSfv4-q5V$oRAdvcH-z80vFKqu{)TDazQ`xGj zC_mkoBQ~%-a_`Q8Mk6PC+<*-dkeHGFR{u$pLAIR2;)mmiIyz2e^0kt34{nX&Xeb-8 zuXih7sSz|<{gb|J$Qbi(%x8!w5f7_~X8xBl5kuD*V0GEjWSEp6$DD-1+~w5mZS!C@ zIZ;7P>kz#nX}OxL2*2QGc2=~XHtcEy?rP^NpDw04oW0YuAILuq4x49r)FXa3_!Mbn zCsJ+OVawvT6=aHVBcVcVZFc!aCi(ghg4{em2Oys)k}qtHEX@Ef&lmbl;H!U2k#TQP zCDlfTol_q=EAA|_-h4FIY&lTQ@k@S>-oW+IKQ0k&+{<9T8siRuCJ^`|E^)5NNyMxB zTLu=Xp+|DRra>~CguCB17IN-975rONSfTw(6D=MRRjA$g{AJ_{^ivVr==L|O>@dZj zBc#;7Wj*BeZaRdnPKi-#>zaY|K2Qj1HDaOatvat5PXTnar>8uMuNbGOT(?!jNpGM3 ztYo_fN57f!6~Etw^j2&NBSHB(z5Az*4secxo#@x`pLL@4W1{-Fki8frIzik z?Zq>@WfK>l&Ow$>E_hpxcy%|3$AG{64{4QlbHc}G>Jp#XJlKJCqL!_f*`KV9I!_t! zrdyZ?%=PA{Hw}iFgE?$x!eYN3POiD`5;$J(t=ww`H=y&^0^8=p$JAk<^CVwO1; zn@LX&?hK;G8L)gFtiMjHc|Yg!jDm>fHEmX=`HsbM(Rj=4x~d3Ydp|$D`el9Pa&%)*QNd!7?Nm+7_+lUNZl*~{UL76`I1tHMhm^zV(|u1d|GC!GXa+fQjk&DWllX!V@% z-wwarI<{!jed*x>Z<3vM5KhzZJ42GCXo0k)M;osSO>UMjUl|~7e>^&F%bo^(>OSDf zA2(tc_fZ1=Lb1`X@N%3+ej=hICkOfSr?+We9Z=?!?cJg*cN<{wc-~?bveoWHTJbFvbR*Y&9>|2AU3RWiLpYz z)jsTYFuYUUX?}TiJ+ugTu@Fvz<=Xz?NH7&54%>q5+HqW30~g$!^!i($U)@ibWD}XO zTMV%5OiYo{6i=;PM`xATCNVSfDLkuY@gW-LWMa@0_PcR2hpBSty(Ia-x|k{FVRd=$ z(K+gAnySsRNfRTleNLcuwB-5^lLiVgm5LBX5ZuCxdUO@s;*Z=F3WrU(p6$B3|EorB z&r@WFz|&yXst82YO)a<3t>=}yuB2Pl1KH&RN+-d&! z7<3~Qk0c{T_b)D5(Z4Qhn}f6-?jrMr!h@!cD~HKPFT=x+U6EcBH$ZQn>a&YoHgG*DH??q2|l-a;qOns&a%IJM2~ke{8Ow}Zxh787@HCI)1U$^K0Auqt{T=IK=Psq(D$7I%nX@d>HXi=3hhTjG@ za=NFNwl=?s6C^9{<-nORyBVt>k+Tl!LWT%0!c;N4s+QuU#A-IKJ*BdfkJN_mmO9ws zR=7)~q`JGICAMUI^;sx{YM8M1y=-zTP!{6*h5rKSib$KKzIFZg<^unN*CnMGqv3qj zyoi#1u}Di4m5ZY6X5W;Xjv{vR6NQ#Gq*7$6&#L0De;Yl@)-gu z)i|8mXyZ}m(w^YPs2Ac!c5u6Qs7#hq_>arbBFU+(mzUeMP7~WiJ%o$UlaKsd5a)QT zGK)5|eBpG+z=Wn$B(_PR-UWUUmcoQvR!ayme%*ATn=PLyILcCY`}3oe4{pDc9v3=8 zYZq77SoToZ+h;!!7&kzC#}tW&H=a%YLGJLCy+Y&y(D~2hqXwe>L1Gsn2MN>tfztK? ziw%YrcML~=sfnIe5d1bR@_0VBUX)Q|_z!mvPBv|+(ZtK0GoAACmh8+HUu1ak=ls~n zrXoaS9AYIxn`KbEZ;)Hitn0Q<-z~|w(=vlmg?dtd<0xz~+0y;kV8+-3mmaPkPb1*r zLr7LF+b?=^A|)-9ym%HT&fcsD!YSnT<+mqs$a&WA zf3f$TQB8JhyJ!#<3&N{Nk*d<93kXODY0`UdDk2@EO9@dC5fG3ry-9CULkB@>klsUw z0HFj3C4@k-pS)|WJ@y*sJLfxVj6KHwv!6c>hw;hGocFx@eO*#9$bnyA&Kv$*0(WbC z1x#C5d%*A9Fmp_>Iy)Q%#PiLk=!54PX?I5}B7|JK=DfRqJum}Wa+bo0i3X0(^@~%< zp{|bnQd*MVa-0#%uXP-UcD}&wJuY0))9A|*;}TJOIjZ`Mf?QX(?^%&VRp75C1d~Rr zn(Y^OT;bmGYLH(6N)5vdblE=oVt(fH(Xl;VCZn4)lW%$?`)g!c`0Ktd$N<=^UwC)8vP&do$<*a{L9<=%I`8wp-XWB#ytL-j5g8@ zs*QJB9NP=`hi|gCZ;5EsE`BM3O^YkB#FM9u*)SFUrd70GmK`0; zKKebW+s6QQWosz+5{C>`d6@MP7OPe}+XVYk`9X#uCxNz{L{v7nkB#6A)Zltdbz`JRQNVxs(z^Z^Kf!Dsfq6umIhFUw@R;s?>8*RBK_`zPhsSFT=+NTB z+*;%Jkwv;C#yt+72U>G;&HBS;YT$oKah#84?>V-?GyMIZugp>|EasC#){-CF?$9o7 zDw8L`x>S6eXSP=6?VNvmu`KKEzIqYT=wk8?J|APgLPp6=7%{lvZs2`(30F*x5! znp7Xnd#kbDrAG-)k#U_fu+i_gON8o<$a=?dN%y5(owMRkx}2dlnO3=rTNN-Z7}w9= zy5i-9X1My2aSx4ALkmh%RwX!Y(SN0`zxGwFdGvlI^wziB7b#l&PfA2QGLoMvjG2AM}Vr~(gwA*xfu+jPBnFC_+FD{#@aDmwEG>5+UO1Bw!A2*gK*g0LLJr8J2Z#>`c-i(s&8edvpflk;L{Enghl+vGNFjl{} zBitmb3P-6MsHZ@wPDpbz>Elnf&jgYgk$+^Z`;hf!d2y@YLS>1hY>FXv}deldL~U?R`S16jp(;?0pP& zdN^hts=fCT0dJZ$La}F(zDQ06F)BI>`vv^ zudTl9YVBTKoGgbT)IZFfw&e5M>G52+re5eReht=zVQ!H_14(T)BC$@stsW3kyQ(6vblJHXZ~sFgpt|8uo#Hf2KfCx7-9p?6z&ZL7>n!tqyVOt(y24-|g8LDK#k zWTjl1OtT=VBAl|`W}P!T-y7D7-Mk>}ERYiZWqb{M9^Noi`g5n<_Z?PSG5Izvb?(;b z=uacGxoDD2nNYO5(YVO8@$#t8(zN+`g2$`{gTU5d+;CDT;gHq#k3jx;gPzS~dDI+r z1yxY2Z#3wS5v+n$68rTBa>c`z@Vn@oY*CP-#)M)g96OTuU|&}LZP2!F|bmboLN>E|K_(8vn2Y9x-3v>-4YPAu^y*5 zM1VeI7f-Xte9*p?Ku#z^@v)pzjgZe(ua-E7mo}d@`*Z5wJ+qJbCHmO%ISc@ zo@16X6aB*~KGt`LtXkIq`TbLp1-&$jobgi(^SD`*)yMw4A_s&X=Hl@83eRBBSr%>^8!k^bBNl=aT zmv7&hRZ91LF;64D>4QYfKj3}tL{XVSv05-xV?lb}ns>L@QS6m{69%%F^3?uoM4!~P z88eC)a^+k-eT-p>Bc}b^wpu`(Oo@|<#Xbm1!<-YSBwCDFvKb)!QbKp*l zbj+_TFvzGe|AQg%M2AKr8Nv$odMQmA3U766TI3YuAoGCp;BCgjjAKd-dZ zeplx4O4J9^XHw(J5Edl^gEe|pk#|0XL!0VtcTM*M&dIzrM_{h@!OBD9qN_%8TB<@; zr>^osZ&J-dv{Qs0DwY6)*%f9j#v*U){QSA+7Yr8_lNPu7(6yoQ3{8%mszVuI#YVcn znEAu!Z}pAL6f?^t4yE=>|JL?0*!Qsam(=dMCC&<|joni7YnRT6(?dA@ShQZy*b)313Ly_IJnwb5e<@R2l9* zGq;qVP@~06O*&&_;`sFMZLiqeNw{!h_*Utn`MSc$xi0srrnSXxbF*mSp&WbF zpW6m52)=tmJDQ^P6p0*(*}4_6dg;kBZBpW*DQgaM)2%ekSp~HA6~116 zivHTUZ}Me1#!UAfgVhRU-l(prX)h+fEQ{AO8^_(OBhw5V3~Z=9r|$cCfH2>rQ06zu z*tsnTevN$!Ic(pFH!R5we)BnLaaBT+pF?-d4t+nmaH2@f7psua=&BHEq1*-xPwOGHFm<6ci}YBYNIH@H&$t(=_d@Fm3MEq9iN8k%GSHjanzLLn!Iw92Yw$NNXFd7>Gj^%%N2%~U$yS@s{=?TApC&c59k z+*gu|t5*vLqeHZgn8bZd6cr1nD;AQoILs=t8?3T;2P?deyYaw^FCJ0g1%2{IQm@^M~xwXXvP1xcq{Qc zL_B_Si%OU>&B9`pBCq&2^g4rAxIArzJfb&6QAJ_7;8<2#7jdf>4%#>{3g^~xv24Dl z!YuaXY?x{8j<=52wVP$4)QJa*&*_0^w&|BMBPIOFi9Dz^%e3wwwk0;zlY0NRg}y; zv-_~W~`AQ!Ey&gb8n*5FEY`o}^2U)m237MsHslM8Q= z_1n=KpB=>s6E<}wLTI_#*b01t0}KOAvvgoAKUUH%sUH~4IPRaC3O`gP-!J#InCMa2 z9lb(MZ-JF%#E$Wh?ZitV(U4RkY8x=jy_Iw0E1ejBdqr)8$5-*~!DxyUw8lHEVa(?x zRID;jJQFLkpG$EXc_gP1;`-2w7|R_NQG;@D5owLeLt#YoOAT>9vxQFE_>v#vnu8eEjNYNPnQSLoLEUmB0yVL*Gyj+%w!Gl7`F+?mXC;!sL!0sInC%Artvr*Wh2 z9>VPnI9S9BCG_uyMJO30sMxnXcqaMSV$fg|x#{+*$~=;8hqG#E?NNewSaPiTH}*pH ztGQ|2h-bNeJI=r`dJ?ZWRl%(Q?wpEfqXD|iGrU-)473FI<%{G;O6Ip=?=Hrc(hSve zG3#{<7I2LYJ^9&~@0v~zF$~XoG`3tCjEstCIJnF?Rk@ic9+RXI zW9uNY{)XX#%;H?N#KM3hxLBng9^>s#xGiSL&0As?5}7GvgcnRCpvWCmRy+`AhxZix z{No3ID=U{rsTtj(JNyDGPl(|$W($v-kuDf$&5Kfh$sRW%wPnHuA-&V`I(0nYl`l(| zkEgD*rrk9cCQ-yaRbMGbQ-hi}=R5LXskRyBbg6e$euFMth-kNU*WT+lGVh=`ZPTPO z(v#^qA)jKk*=+kOCAqoFaG&Hn%cgrQ@n*{%aSlxy?@EIo7~3(^-yh(l<$thhbyGJL zvRBM3Y_+Ak(AT!bQ;L{yYSaiivsD#(v#}M=(IO-CkMaIssriNB>zsujNc=mjL7#`9&qP6{>!3jmCB`^a zOVRBM*EQxtz2ASS&kVD_K35-;PAr9|yBHi9g?+83x`*m^j(hlAce_GfqM8+*IuSOD zw|S$<ZJ2YZa5G{>Ye7Z**3>FrL5twiw~s;F(CtXdynRul}IDz%%b z`QxwPjDFu@60Gn4_AUgylEm5#j3TITA~nP7a)S*XO1f(2a66x^1nqKY zZ!LS^l~uaGt{LR2LhR>1LLtU|R~)sWlQKa}%8FmFy^T95xA?0T@%&xZ#LePJcPH6X zOi&A!e+KPlQdEjvfUV>1Kq?VGuF)IA6m8WK%+#zd@E@5Zu--oO8xHt%Zp(qpx5170 zHcb$S|Gz0QcC6D0-5GoYuPgCqq37Zh)I?X3KTo^~E@q%6{qZqQ<&Gvk`xo=1^@js5 zi;_YhoAg=*ZAM#^28*;Bv3ke@<8Jw(68`+JEDnu@LzUB%cZLc zVcfzNGT8;F3wBR!?er>vkIIeZ{sjV+c&WlgUCzC?CtaFO>>NK!J>70d^>?J297<1p z(xOc`(GqbpPOBqSO#jeGml5VWHZYqlqEfx?FtflaYbIq^NW{c#zeOC@NQr0rohR<^ z@M--7!jC=W7id`CtkYDzLcy@n0__|b?W*3`B2`TR9~!zAqQQm|5T#&5m$;W#kW6uUk)IM>%+pmEP;!ZR5LoY-30ylnUyt-Iqv952EBfe2N z=Mpe1Pt9V99!Qnt*sP+`+PuRNZM8Yo5E)X4h;swn z7C87VHg+(MtaU|hj*FCO2No}9Pdb48T_qIpOT z7)RSqV3qY0!2Fz!@H~DG5MuQ95#E2VEEm$ia(Q-$kbM zN!jK=m&v-lM7F0CH=Cviu`X3&tuii%3}?^BR>bB+{wk}P3h%p450kvoPZrEsFN#P3 zkdL`X#KM96Yy^7fBgn}A{S$o)Muc_b*YJJoQs;fp=^0 z2F_{22|#Pg32Je%QVNvxdUs$vqWl5}jVWoPu=>>+^~0LDjl_N~qlDjX7Y@-U3y{b| z>-~iwl{OMzhiLxOM}19;JE9a4hyG-d5K2O$vVg)mbxVi@hS2 zKO6&j_sCKfIb%%bK-3AYL=Z|7#Psq4CXv$JSsy)iNj;dK2Ugt^jPdcgEy>GdAte&! z50($Jw+R{#8innJ+U^M~n-N#k9S*EW5(v|Bi?SPDyU{#orK#|F6v)mq5ec|EURA#r`Wz2nZkW{3lTG#9jm*aODFL zfx{a9DIGHl-h?!1UoBuQ!yOA&d0qyRPisdT$?Bnw$ih3I_bJ3IzOu*Be3Hj`4ZjKi z`^N@hH#T_{Pk6m`NRiKeR{!qk#^&ZuAq@!R^!ME7hw)GKV|@SsZ`9Y1XBVX%RgnPpiu8+pJBh?73*X*@h|k3dLv*g4D1Bm(zBWHy`+aCNEPeheN?SZ5KApd!Uu1KQbT%tXhXhm) z*dY*Y-nwl+gctTpelMW=U%3D)d<)zsmR4&cElfR%5`EKob(b^KUP9ZXU=uCxhoTC5QEjm;I*@(S~CKS8b|yUKGTP|6(RJSLcXzekAXOvnEYkS^n% z2EZU2b~-MBD}PlI{bZgu5_=Ww z8Ut({9g;?piG1%857@fFbw^#DC zo&*G(|641inBSc-9MwGAYIw|&2S6ErBCm}o-N{KOT#81ngE+& zGs$oRab+lxnxtOwpDUFDa6%KWsD$X@o5tDPdsso5QGrWUbLAF@C3}aM!4x3CX9Qq! zh_~gxG?K)B_%8vB-hXCAdLHXZA^jUWD8-_7GZgE#- zBxdGY&R@Fvt7R;_ZZIx*w*2G3WxMQ-@!uCFDH&P}}!FWQz)lua}w}KW^;{ zjwImDHrV2T=b5gBN#VXD%iX12#CGoOb@MOWe=mc0&#pd1>PKz(-Aa?f=3nsSm=QTgeEFsE^s6E;sVzRJUSRs( zj4wf$2HR<(xG2Cl#2Zc}FhzGP-eiE_6VZwxN4;)Q%> z;qB~<6f}S6t5@htS1HLoVBz@FIBTH+a4Y_8Kpw#yk6)&P{d57uYq*)%&O`DX*#v>7 zvww$;eyiF8(@ddlG9PUsWkFpH)iolD$@%5j2EI!I@xM1~g9aj-Gf3~^yvyG7J zcD7vB=A!M6HezEM4Zu3CEs&C7cDxLeSOAm##0)Um_8`B$9u0Z0#G5zQZPxMM6-V&D zS}j|mx^8faLAPG&#RhDPq|Y{TA!^cM3f}tq>W#C4N@gh_N6D=nf1sb=6>EoS(vVP| z88vvBOa#5K-cy1@IgY_U-K2fx7CvBa`AJp?d-dtt6fS)LW z3o;TD)IzXoOXV01qr7dzen#xWxqy==)(xe!t-*T%28dmC;ta;0+eC5ssJB`!#G)s% z09MvQt+M5@u`?}{U-Q2&r!Nh1x^#AxE9m^7r;VBJyRXUKqyoxw!goQ0qwDt%r$#M` zQIh}{dFen1mQPd=TF_9=gTU7Ys_I4eVeEYfZhfwCsj1I4536oayILXC{V~hYvg-kS zZ?b@qvHD*-S3p@LMS+suj&RXO&wp$*++w7AQTD3j2!(CWrS$5*z?M{q+4%#wqCOL2 znyL*rD6`PjPq*sM0-qr{IA7?aQEZ+xNoa~5j+t==}8Yht~Dv_<6UKvvW-keJ=#F8b*s0cXfv#u9_XMk?8XE zEdI9*cfvQJ!*ERwr+_j)8vDF_crRH?`fStGUwMdL@Q}hnILP-fJ=SM$aNMi0$CzF3 z6PJK3PGI|w_hQF0r2&D4b@to!;N@t-}l35_1$LSn0oLj`QaVDQdnnhbe#1n*VzdPg`;?a7xZi|J9LzDsj}o z4*;f<3ywucxo96WI(3Ac@+i8m5Z3wT<2LR-KFvm}I~|9%;ykc|f0jb?qsT{}&(EF+ zHa6T7PO!4%l#*#EP=4OGy#aP}(c5f%^FdU2eHZVl>J@9DK%=$0=j~bCXq6fGRDbL+ zBV)lsG?DaY-ld(_tv)kcz8JS{O%9+99F%qMpO}~TZEbCj9V*U$YQ!75wf*P}L7YDX zf3ps7{}b325NEsmp|x|Z4YF8`sFP9X61k7yu)A(;jVWn8q6L)}Jq+N5(6t+Sk;G6$+OAgcGqY^^`gRSsz(_IVuM|S}xoy}Vz z^tIK^-;9GEQLP8327^HHz|2FtAN9tU#A@X-Gn+@E0QRR|_}8nN>XG&PmKhq}%W!EB z2)K!ZhxW)73Hvx`;&ord z%4+|>eqwf>$A52fO}GGX#FA+NcTVqN!fV>KA8F#pxD39sdBkdh9~%s>-{ak-lt=;Q zXPg9qghBx5@+IWX=r6dejIg1VOwf9~*NJn*`zQ~kF4%;yI4e7!u%_E1UJ*cQ>B-1K zf|YkmU5c)6OaC4m9P~o%w8pP;R*msFN!HzXn+HHWCjcg9>5eq11cCRi*y>=23Grf1b zJbYdPXao7}V>5aB+jT)ir1lrLfa7;$%T(-#9CdvjZ`Np_w=no$LX!Is^8!7IVx}~+ zrgx`Je&UkFfbM)lJelBb)%h7t9Xu-_=EL#s?!bJ)e-;M;jtcQf{a;YHiGTl3LaG19 zD}aL@w}o_!Oh6Rb^E1_+s}Bl{-vrq+TBM8o3UUd)xP)SnXtsN62Ow4^q_-Bz0TYW{ zJUk`Z0fPsbNV^ZtyUb%9K_!fyzNdKuBeGE>2VsA}qwoI3@@Hfk(e| z{55NcX*u~3xC8`t^h7^JS=J4Ap{QI8c-7Ce+Rz`=0XT-g`z%hnSS;&ZYl+^r%v;^d zKz0ZCczYuY6mK-f{s%N{-$z#NCWhw)fhLJF0Vcjr#C1V(RPpgaY9LT4fQkOzJ1k8e z;3Rk&Nb(OnAj|BL`=G4r{UeB*p!XvGn@|ko6wdZa2>y?E%C~j{Xi8hF2}|6OgWTTZ zWD)+}n-&ct6Q)#zMe7n@!0;NYJ^-8#Qsg~Gp)5~Kv@u_$)EsobXDG;IeQoo!D3dV4SJoFHvhz&##n$q z05W4735dE}@I6`HK*+PXjMdOR0Iefm8jhd=f)eco3^cROwZ`kaSC4(ef|F`n)&2*l z^FrG;5O$)>k^qcG8(-NM0&xmI#Tgcbegs(iy&QzB0|pdiPt-vmdgbSGO}D{r87Irz zV!qqQ6+IaYk{f#-Hp*I)sCtE5H)ak2Np7Y+CZY2N0lY0zASnVD@+r!1HMwWcZyzQ9 z5-KH){2=xxwO+!>2i&l=YDmC(+kFMr{db44T<5#(m;$YhH<6pZhu?-5obYosvde{e z7kO7$@-|*;wFNkb8F);f5%2t#RbZl} z4y*HLxrPyARYNB9p2t{WnIKQQIe9<7 zv+_pf#nuSm?J*}zLm84{>ywf3y)lZr`YXGKijf5+a_wa?%S4U*9IU* z_2;d^adWR{`X)&O)PCpzUSBy8nBe{A+Xs+p-ka&OHBENIE{PxhSd}w-w3dCp?GH$` zpS>mGiuiC8_;Bx_KugU|bCA0>wfZDCS-^2(5M8W-YMvTxfNY==L$bBC2YUPN0M5+T zKeou@OM0M+A|^{~9`1YOW+ATPj271kAmUwZ5(!;L}sf$j85v-6nQIMsVamkOb$1Uz?n((f9!sYH61 zN7tNNLXv>PT_Xt-u!)@{$by9EhCcbqjWnKgng!P$$$AK7znam}JO6XWBDy)+p;8-b0Me!5%kHO_{%KSOUEqL`{P;gD#XRXtUoP`UL?;m7T_Wp50aEaHYS9vI z)T$kw{0Nk#>i1@6?Y&X!zdVR1z}orqNQXapQP|63qkw)v9a3WVPw&DY9w*MC%_3rC z1<*Zy=?mq;N;Vm~1$7+U06D(=|4hCz2v@@Z^jukIEZ+k@_6L08Z8`$P)S&m|WnAqo zw2Sb1;%(_*$q0rAe}lqzS2_O|emOAa3mVsyDQniXO9XDC{Uh>NKt}#kv~A-5c=7*_ z2NZ~VKy}2#B=Gzn!UzIRu07>whnxhY8COvNC?R6v7qtBpOw{0S00{U0gKHz|65#pI zQh>z&@o(_xOG0V=*$As{XHAVQTVGTpH&Eul6_(g0p3KM$w5)gvyx1SlZ3phD#b zfQxjOhPoApopV@acAd&E%j@!*eBy@us0*DJ{IQtDooBMAtf0G@sp-t}X)bl-y=1%A$aDN&^q}*|$_ggI@}t7e?(SkT zM&4rOAiP_J<@@P;W9C``&i2slHmmY27Dl5=$4Q1E#P*HiwmQfVw*61nL>2FzT97aL zV@^m%L*Ah}Au!it$oCDwItv2lPTjt7oGfnY5_rzU#0VUkoc`ZF;Tq$+?e+(I1GuRI zw{!J^sSTR7{z!l?gN=>T)FU^ITH&LF(NUXi`%QM(_xXW?WumWOZvd$UKIjX#jE$gNVKiire3*B1y5h`)#nKJF)PaD*&aFLErEzBY`TnZgIuw1B zNIUr2F6cN~n}9p$2saeA&fJCf7kJn;kmL8*t=HEObtjGq$>|d0@ceE7@^px@qi z6P-8_dcn226Os>uTZtnOml_vk|YD}`O-{IWH^AFNEBdK`b zT4A3dI|8;UM`^GzF@&sRuVv#TCec=0wG}_E9`ZRSk-L`NaL~GLANA7r$|(Sj5SJM+ zH>x?fA$hX5Ku5K^yL^nM8j^U#l>ZeAM-B+H@Sc_?6inTWzGzu7T}#=AIvGp+zLoZnE45 z`Lf;!D_Cv;)iVpyBpI*>fCRU?}YgUprJ2kzs|(V7e5{4K-=`4b{g{ zU={?6Jz$AU5F=h5>i#5VF}o>S*)k0c8Nq`EvH&j%&8Nw)g_3!htlsV1Q^`|MUUz7C z!z0Vc5af0q_FKg|&DNBsVED`J+@Kl8W7Ih%0l!I==nnIpm$1O=BWwXa4`X+3R>L4G zzXx219~SFnRYv?^${oMf$=&5Geu(^i+H$}?%jFV@3AXW2_Y2H+&>h{jEjn6J(PHhs*s}4QR!Gn96{Mi1c zaB2UybA>oDd;?ZimKS2%y#rve)!DlTZCFZv>V*WnAXfF;2SLuJ~Lie z=DTo{NqJXVW-YgcJmNM!G&)&hJfuTTW%^gzG%azLXyp~mLpG$*&(zMiG95|ks}^77 zq^G5=t<(VJ7m?Gp^Wrd$grQU5L)FP_I2_C-gC1?rbGJ*rH)v`iLut}+Q zpAxYD*N7>-)=L+c{JoK_tUlW3eTp`!mBmu={e4Ch$=$D3KT;EtMf@5WuM{*t*5{{( z8kCfwepe)D^C@KU|?9Q7S870PMa6{iUHkr@E)1l-Hg0D>wiQ2Rf-Mpc` z@%V~F0ep{VMHqT5@X5g`aQW`&Yn|8nPDxf1hUSk0OQn4tTH%{C;OJ%Jld!+3fZ8=c@RlCLD{ZYFl_ex!~d93war ziwby|Uir8svDzv__1|Aq1Gp3z6;D5=#HJDYO7RS)THSl>afC`-=Xe1^f#kFVlIe7l7~mE zBxl}mn_FcrTyUD&tk_)U?g0o%%+5X_W-;I=;HD@5B1r}xqqQs9OPTro>2a>oVceLO z>6?~Vs+}$Chu{`4o&h_rkjwJTy!EW7z>vG$WB!=sPzDH~x|NK5&J|aH`{D0Bd6*t7 zVKn#gxp5)x3}@Tb)itEy_sVW314wwiBn>rK*jg5(^lJ?0Pi|hRQ`I#Wb1-u}!))r0 za9SJxg@sEr^zs(01WBKj;=sY7CAb|2?N&)bC!ZvNylpose3*a3G4I(y7j%(P!e?zr z8e+Kf@^lFHlSk+^tK zngKxZXO>r7zw6?z+Q*RD%tK}@9@XC`da{}QDNa>D>cs24HG`)5#uiTM-Ok&A@?A(1 zM&55XdsSr(fqG!6pwMW9O7oYn)G9Fdab*~;9$Le3OvB-v=@Jd^CLp_?=2>kBljWN5 z@Qfx(lzAn8HxpJ; zFTHnB*HHIxDXQc(Ze@S>?{qT9Q@?}i+ zCXgMV2ICLrw)3kw{B{=$25K}S4E4+!H-_=`pKLhw_0e8fi54pqp?gfAuXcqc$n+4# z(&pC?upso}?X;!>BNJmJdzZ@U>Iq|b0?)wh&d$Bo3w}RJz^-B4)-WEKO|C7LC<`q6 zMdj*{wW!J;zx9N#17j87Bdy&E!mb@bJF5RI=b3s9-gQ1&*Icx(Yq^I*qtfdenQ zadW;_MKizzd$?8G=Jt&?BlW}}0a>L8biuItcCr5kITOh;sepPt@GDKPOq)2ztGDKS z0Q{hSh@?5sO;{y%$286?uZ}m9N3y53_8&x?9K={POZnFKAf;O)Qyn9}JU4(^_Q*F%SiBF={04lxm@>Hk zlHnO3?CAg;DPZ$&jhV&;zAc~gxDx6Ms&@qpQ3`p0WB^tJNbk|#!Um{fmxxL8rT13= zGNq#yykXFyfSVT3^Gu%#n8jI`%0`JyhqVz9Jpv;X0L7?G(zn{5ZrNgYZxC4@#Wu~S zr@%6O-W~toj8rZ_8{-p_68P?Zeg$OxpU{84lM8(NJCiXI#(#W*LqR6V!$5*g{VUMV za;?`|tv}Q@00)!IWTPXk{{SqH-bz~Al^?_S997{w^045(3b4)(jFzqlv|HyxPSScJ zT~&GJ?9dx->jy?-_a&5Wb~RL0J-qsiv^~=3HSZl;+i)5_ZZk&-uc;uC$MUr8#{g2z zaQt@_d7k(yAy)uyP6Y%lbuZcL6`p_4!-mC_-15oc6&3(?#P!?2oJPRQsT@5lEhyzO zk(jPX4VfjAn}x6?3#l^T?gNH60V2>O^Ka&k+}=8m9L064En2U%?1n3;K^nsdTIVtVEn?q}Fh}5F)9GI`! z^*S==;f)j{#$hkWm*^|UXa$qV-#g`$mX>Dh8k+ShCQld|C8_@y1=P4JJv6a65%@JO zcke}@kFX~`9YB`G!QtD%kjNEFVBt=m01ihphkX#QV{bbE^v{>5w!6D4UBk@H2~F)KtVV+)nk26@}8|5wo9_ zr(!*>17~)dxTr$;@b(;L(rf`|Th|!v`N4#Q^aSmd!9GZW;S4n>i^k)1Ei{QxWB-6) z>&6L*v^VDaI(fKd-QNbHe-HvV<|;BS#a#9MoXXSm@59#j% z}LQ zRt@v6S*R>S&we^O<-O4L?1T23(spK$Jh43f8Z$}uY-*ycyyCv?OA73N51X-ua6XZeX^j9+&E~i5HI6$x-!f=&gnQi5dep2w*AB9v+z7_3)9t%thFY$(2w{@V_QZMUXH(1 zT1WMjul*>H;WQCR_m~h`RY%BzhR?@0tz5)+WLbn)5|nDDDg@~KEp+`y$@b52}X}m_vG~58y=uN$k?WYFZA$N{w89!;Pj~- z#LoS^XEIJ5%(vyIDNx`HN=cT;4=#7;9S~7(du;=n0t!z6V=jT5m%nW*;L1xnP)ecy zpKF$Tn>_rS7nkH#flAlg3k!Kb79>d{N*K>Ac7H?ya)WG~yYFv0Vr=o|45-9q9ROOn zzP#M~YB`vb8g_ggnifZ5zp&L>eH%$DR}G{+hU+a{uhOim7CSZ%C;b`%>C8-!f1=6h zzMfgZdvU4#7>IG+woF)Erbz-0?~kB~#mJH!`tkeqwW^1k)QZ;b)W{?vyDm^kttTnx zAdR3Ga@1taQIfvVVI(;fl}5hQ?bv=~;;ToU#N-a}8q;$EBBWfL_$}~C-ctB2p2P~F zUmjamvs6nq@_FkFDIow@XeT}#L5ov^4fm1Ep%U`{AAklSn_p=C|ibX4g zZ8zwxCSb?_7Us+kN@c%l2S2_&ZZTAO46tZh*w!_tZ1Mp3;q=nLmoXr@g?|?MlGhd5 z(UrGCK=$2Rl;rG-A@G&dz;;xYd#VpBE0(8SIsLMuBS= zMO;sb_SJH2C@giiVYZJY24D*JHg(6W7~P@=3ML?WAejf)Av|!R1*7I|u7=R!?aMKr z$g|uVs{+m86buq$u|SE7NJ$&11bkWjK#lXreNR)7Q!WnB6Xv8;UEn1t4~Z{Xs}lNI zpJoDIBCg{DPegu_uL?V`if%x4X1NzZuF@p=jkq0`mA^0t*^icUL|Of+13FYA|CSfe zE5`d)GfHg<(6Z|XbaG=Jd_tTfz(E7TGW^`qh^zh;73>*lzR}<^Xu6a~2IR4JdDwmi zNN$#vug}4rWr>Gd5ZZ)iOeIfHQg7G3#vx5YvE$%e_RNrQ4KJ`R5}HoLck&Om@CE zl^NO9MJamj2-ro8k@Ps}Gs?PmXwn?(*UAaLJC(-ZxOMk*pBg zx2My(eh&l$Dzu}mOvS~|9)fjsM`o(+YRwKAn%&lFg+%#1MfGL{ks@r}~z-ql$`(;zAY#g^3#1c}t|93$5IVhQVAe z;N&RTLhy?KEY~xMPo<{^lC}M+u8Z}yp15|OwjO79PjAf0QLMSY&n^&NwATM%Lnmbh zgr4vYZ?CSb>Wz(=)%?UbAXbqmT|{kPj;I^G=$fc33kxSFC+f!J50Q6z#I4~bZq3)v z;lB)h?5St!M`B6g;Vf-#Q*|yrR(0pY3kz0S2@q%a*2>C5&c-gDM6*Wk8(Y(Yg~1kZ zFJI4!X6ynfPC?SwFp>7Lll$8A$S}X9c0L~I*%;CCi?d^imn zmq6(Ka1P~bgSj7-zhs>~Ju~)NXy#Lw4kVmN7UOxRilIJWY>Fi%(7$DQv@*rS}cQuX-hErI$40TcvS8SUKC^=8GeN=vqSo7*}=>(hCCOWkxT90Adxae;7zlKz(3zB*^_iPW-kugBvO!7fI+q8s6>XeM*D7zNMecMB{ z*5!LCqM{0_g}}|`Oj7>uI>40QN#E9%uv0RMv(dW2$u1iO&`65^(#m|QWHtEIbGCDS zULN^YN^p7epgtTkItvRJ4Ti+AmY-|kjy79t_V~q%`YV=G5$e3!HDJtO^+rFCIFfbP z8Bt)Gz0wzBRsN3bw6;=;c#q8EeIKWbba8gGNcjIyFZd?wi)XKhZM$uPfma9@NYyzJ zn2~d)*n*?&JzcAegV`*+y0iuH~-t65ccC8#LlYXElzNm32-%e>KSPLiWvyCq&rg z#E0w9C*{oVdElo#`Awhak;r9T{ZLJFF&JbmK$`CJfyJ-iG3bYa!1R!+yWYu+nA zuT=8qtE^F$z}u1f-rcLY^3yW_L8k?GLSuuUl+a5(EBRJiPl&Z_rjZO9BJbgx2n`p! zTkAsgf|tLpluz2JSf~&_(S@j1$~3=$44_QZZZb5=7vOEaNQ7T@zSBSpkh=2@gHl8} z0_)_>>w50qT?+{Cr@j}lwzb)|4zBTBL>2yFK!ohfrS(fUg?J@ymrzpzsgO(Dx9*gO zHCWA#NSzty>D3-nKE3N(KiXf#pWgVpi$zjT2H%h`Ek!4|J}IxDRHnwJs=NJs=cR%x z_$2@rN=~nrXE}H{Nb5M;<~B1|=1F@vQSaj;-T0||u|8Yld)uAZHYS~t36DNwe%8H( zHeXDubeU8$a1SSd{6-m^FfcF}k9$`iP;+o>%*}-MZp^T3GWW5M{jp^%g2SF(?Bd;7 zL+82N_ysiT_vA_7oxf=04&?w>RajngTDiCOPp7*|&%C719|2kDPqz`M-5yB`uFu=d zn05*z3$e^z_|sLJu;IHI``Xh$7YhRG@h@- z#+Ih-aC;gpQj1zdop~Iae0Q4ak(!$?Yt5LO+j*!kl3c1GK&efVD!+1NcmSvZJrPUL zp1RigC)zA8L+E8}Zg4K66T(*f!l+azUF71VXAdwN&y^x92I4y%NBh_s%mN;=n+}#I zmY6uXKSsT6s@v^e0PkVJDH?!9<$l0bX`>SwE(2W@8nAy9i{appOPe+iNbcO2WPTT>K+d~E-t^D9 zF0oc8!AlDtAKallm3hPJu-B{hPWn0j$%>on)8ETqUu!wHGVKzx@RM7c=BPhaxwAfe zewW?OpFjWqO`uifVVlXtS* zuJ?}B)z$1vi(VXXoZDo*_Sb!W+g+v8>zPz1nXI^fVE*E|mv=rs;$K*_<=n~BH@D`W zZ;1OFr6E%P=WF`;yyxt$?5x|uwWgd7)4gt$y?5^(f3^8jzS}>3m{}xP{jgr#U(){M zr1=+@OsrtM!3VzohC$j*E3e2buhXvN%ZCZG^U4COa&AfKhFgRJ*Ct#$dit`rU+Scj zCOIe8uCDvHa>1lzcgvbpG7Z|lvtBCg^svi$ zk^4V(>z<C$J3&WDW7&57Io@w#K}@A7w7Zu;4oYg}1>bHlrR zyWd$BJh^c3NAf(md2_8xc=E(mwy*#3vAWdzv*-y{R#v;UQTN5|q84~6zGm7`2y7bf z;8~Iyv(YGU+SIvk-@Z&u4UL=`vwPi+SmA=m6I&Pp>VZmtpuzWnnFokL-KBA$O=%Ra zuER9q&;K{q8$sqaDAd1p)awSaA_NkEq!^0?P>_`oxa=#z5i}q-DojC`C;~(D|9|sX h-lsqY8>sMNX0Z4rwfwMQBWS9N!PC{xWt~$(699}KvUmUh diff --git a/frontend/playwright.config.ts b/frontend/playwright.config.ts index 58ec8c4..586bad4 100644 --- a/frontend/playwright.config.ts +++ b/frontend/playwright.config.ts @@ -2,7 +2,7 @@ import { defineConfig } from "@playwright/test"; export default defineConfig({ testDir: "./tests", use: { - baseURL: process.env.IAM_PREVIEW_URL ?? "http://127.0.0.1:18081", + baseURL: process.env.IAM_AD_URL, headless: true, }, }); diff --git a/frontend/src/components/SubmitForm.tsx b/frontend/src/components/SubmitForm.tsx new file mode 100644 index 0000000..b5eee3a --- /dev/null +++ b/frontend/src/components/SubmitForm.tsx @@ -0,0 +1,23 @@ +import { useState, type ReactNode } from "react"; +import type { CsrfToken } from "../page-context"; + +type Props = { + action: string; + csrf: CsrfToken; + label: string; + children?: ReactNode; +}; + +/** Submit a browser document request; the server owns authentication transitions. */ +export function SubmitForm({ action, csrf, label, children }: Props) { + const [pending, setPending] = useState(false); + return ( +

setPending(true)} aria-busy={pending}> + + {children} + +
+ ); +} diff --git a/frontend/src/main.tsx b/frontend/src/main.tsx index af38606..0125aff 100644 --- a/frontend/src/main.tsx +++ b/frontend/src/main.tsx @@ -1,192 +1,8 @@ import { createRoot } from "react-dom/client"; -import { useState, useLayoutEffect, type ReactNode } from "react"; +import { readPageContext } from "./page-context"; +import { SignInPage } from "./pages/SignInPage"; import "./style.css"; -type PageContext = { - step: "identity" | "verification" | "complete" | "password" | "mfa-pending"; - identity?: { username: string; objectGuid: string; email: string; groups: string[]; groupDns: string[] }; - name: string; - error: string; - action: string; - csrf: { name: string; value: string }; -}; - -const context: PageContext = JSON.parse( - document.getElementById("login-context")!.textContent!, -); - -function Form({ children }: { children: ReactNode }) { - const [pending, setPending] = useState(false); - return ( -
setPending(true)} - aria-busy={pending} - > - - {children} - -
- ); -} - -function App() { - useLayoutEffect(() => { performance.mark("iam-page-ready"); }, []); - const [showHelp, setShowHelp] = useState(false); - return ( -
-
- - iam - 预览 - -
-
-
登录交互原型
-
    - {(["identity", "verification", "complete"] as const).map( - (step, i) => ( -
  1. - {i + 1} - {["填写称呼", "模拟验证", "完成"][i]} -
    2. - ), - )} -
- {context.step === "identity" && ( - <> -

从这里开始

-

- 体验一次完整的页面切换。先告诉我们怎么称呼你。 -

- - )} - {context.step === "verification" && ( - <> -

你好，{context.name}

-

- 这是第二步页面。输入演示码 123456{" "} - 继续，也可以试试输入错误的演示码。 -

- - )} - {context.step === "complete" && ( - <> - -

体验完成

-

- {context.name} - ，你已走完页面预览。这没有建立登录身份，也没有向任何应用授权。 -

- - )} - {context.error && ( -

- {context.error} -

- )} -
- {context.step === "identity" && ( - - )} - {context.step === "verification" && ( - - )} -
- {context.step === "verification" && ( - - 返回上一步 - - )} -
- - {showHelp && ( -

不是。这里仅演示页面交互，请勿输入真实密码或 MFA 验证码。

- )} -
-
-
独立 IAM · 页面体验预览
-
- ); -} - -function SignIn() { - useLayoutEffect(() => { performance.mark("iam-page-ready"); }, []); - const identity = context.identity; - return
-
iam
-
-
AD 登录验证
-

{context.step === "password" ? "登录你的账号" : "密码已验证，等待 MFA"}

-

{context.step === "password" - ? "使用 AD 用户名或完整 UPN 登录。" - : `${context.name}，目录验证成功。第二因素尚未接入，本次没有完成登录或向应用授权。`}

- {context.error &&

{context.error}

} - {identity &&
-
账号
{identity.username}
-
目录标识
{identity.objectGuid}
-
邮箱
{identity.email || "未设置"}
-

直接所属组

- {identity.groups.length ?
    {identity.groups.map(group =>
  • {group}
    • )}
:

没有直接所属组。

} -
组 DN
    {identity.groupDns.map(dn =>
  • {dn}
    • )}
-

当前仅读取 memberOf，不展开嵌套组，也不包含主组。

-
} -
{context.step === "password" && <> - - - }
-
-
独立 IAM · AD 接入验证
-
; -} - createRoot(document.getElementById("root")!).render( - context.step === "password" || context.step === "mfa-pending" ? : , + , ); diff --git a/frontend/src/page-context.ts b/frontend/src/page-context.ts new file mode 100644 index 0000000..70a0614 --- /dev/null +++ b/frontend/src/page-context.ts @@ -0,0 +1,32 @@ +export type CsrfToken = { name: string; value: string }; + +type PageBase = { + name: string; + error: string; + action: string; + csrf: CsrfToken; +}; + +export type SignInContext = PageBase & ( + | { step: "password" } + | { + step: "mfa-pending"; + identity: { + username: string; + subjectId: string; + email: string; + groups: string[]; + groupDns: string[]; + }; + } +); + +export function readPageContext(): SignInContext { + const data = document.getElementById("login-context")?.textContent; + if (!data) throw new Error("Missing login page context"); + const context: SignInContext = JSON.parse(data); + if (context.step !== "password" && context.step !== "mfa-pending") { + throw new Error("Unknown login step"); + } + return context; +} diff --git a/frontend/src/pages/SignInPage.tsx b/frontend/src/pages/SignInPage.tsx new file mode 100644 index 0000000..f565cdd --- /dev/null +++ b/frontend/src/pages/SignInPage.tsx @@ -0,0 +1,54 @@ +import { SubmitForm } from "../components/SubmitForm"; +import type { SignInContext } from "../page-context"; + +export function SignInPage({ context }: { context: SignInContext }) { + return ( +
+
iam
+
+
AD 登录验证
+

+ {context.step === "password" ? "登录你的账号" : "密码已验证，等待 MFA"} +

+

+ {context.step === "password" + ? "使用 AD 用户名或完整 UPN 登录。" + : `${context.name}，目录验证成功。第二因素尚未接入，本次没有完成登录或向应用授权。`} +

+ {context.error &&

{context.error}

} + {context.step === "mfa-pending" && ( +
+
+
账号
{context.identity.username}
+
目录标识
{context.identity.subjectId}
+
邮箱
{context.identity.email || "未设置"}
+
+

直接所属组

+ {context.identity.groups.length + ?
    {context.identity.groups.map(group =>
  • {group}
    • )}
+ :

没有直接所属组。

} +
+ 组 DN +
    {context.identity.groupDns.map(dn =>
  • {dn}
    • )}
+
+

当前仅读取 memberOf，不展开嵌套组，也不包含主组。

+
+ )} + + {context.step === "password" && <> + + + } + +
+
独立 IAM · AD 接入验证
+
+ ); +} diff --git a/frontend/src/style.css b/frontend/src/style.css index 3318073..8cb080e 100644 --- a/frontend/src/style.css +++ b/frontend/src/style.css @@ -29,15 +29,6 @@ header { .brand > span:first-child { font-weight: 400; } -.badge { - font-size: 11px; - letter-spacing: 1px; - vertical-align: middle; - margin-left: 14px; - padding: 5px 8px; - border: 1px solid #b7c9be; - border-radius: 5px; -} .card { background: #fff; border: 1px solid #dce4dd; @@ -50,39 +41,6 @@ header { color: #60746a; letter-spacing: 2px; } -.steps { - display: flex; - justify-content: space-between; - padding: 0; - list-style: none; - margin: 25px 0 32px; - gap: 8px; -} -.steps li { - font-size: 12px; - color: #718078; - display: flex; - align-items: center; - gap: 7px; -} -.steps li span { - display: inline-grid; - place-items: center; - width: 23px; - height: 23px; - border: 1px solid #ccd7ce; - border-radius: 50%; - font-size: 11px; -} -.steps [aria-current] { - color: #215542; - font-weight: 650; -} -.steps [aria-current] span { - background: #215542; - color: white; - border-color: #215542; -} h1 { font-size: 27px; letter-spacing: -0.5px; @@ -144,42 +102,12 @@ button { font-size: 14px; line-height: 1.6; } -.back { - display: block; - text-align: center; - font-size: 13px; - margin-top: 18px; - color: #476a58; -} -.help { - border-top: 1px solid #e5ebe6; - margin-top: 28px; - padding-top: 20px; -} -.link { - background: none; - border: 0; - color: #5b7064; - padding: 0; - font-size: 13px; -} -.help p { - font-size: 13px; - line-height: 1.8; - color: #6a756e; - margin-bottom: 0; -} footer { text-align: center; color: #7c887e; font-size: 12px; margin-top: 28px; } -.success { - color: #245b47; - font-size: 30px; - margin-bottom: 12px; -} a:focus-visible, button:focus-visible { outline: 3px solid #a9cbbc; @@ -195,12 +123,6 @@ button:focus-visible { .card { padding: 26px 22px; } - .steps { - gap: 5px; - } - .steps li { - font-size: 11px; - } } @media (prefers-color-scheme: dark) { :root { @@ -211,28 +133,17 @@ button:focus-visible { background: #1e3027; border-color: #344b3d; } - .brand, - .steps [aria-current], - .success { + .brand { color: #b9ddc8; } .intro, - .eyebrow, - .help p, - .link, - .back { + .eyebrow { color: #acbfb2; } - .steps li { - color: #98aa9e; - } input:not([type="hidden"]) { background: #18271f; border-color: #526657; } - .help { - border-color: #3a4d40; - } .error { background: #492b29; color: #ffc3b9; diff --git a/frontend/tests/preview.spec.ts b/frontend/tests/preview.spec.ts deleted file mode 100644 index 7295140..0000000 --- a/frontend/tests/preview.spec.ts +++ /dev/null @@ -1,95 +0,0 @@ -import { test, expect } from "@playwright/test"; - -test("原生 POST 逐页导航，内联上下文，浏览器缓存静态资源", async ({ page }) => { - const xhr: string[] = []; - const posts: string[] = []; - const errors: string[] = []; - page.on("pageerror", (e) => errors.push(e.message)); - page.on("request", (req) => { - if (["fetch", "xhr"].includes(req.resourceType())) xhr.push(req.url()); - if (req.method() === "POST" && req.isNavigationRequest()) - posts.push(req.url()); - }); - await page.goto("/preview"); - await expect(page.getByRole("heading", { name: "从这里开始" })).toBeVisible(); - const scriptUrl = await page.locator("script[src]").getAttribute("src"); - await page.getByRole("button", { name: "这是真实登录吗？" }).click(); - await expect(page.getByText("不是。这里仅演示页面交互")).toBeVisible(); - await page.getByLabel("称呼").fill("预览用户"); - await page.getByRole("button", { name: "继续", exact: true }).click(); - await expect(page).toHaveURL(/\/preview\/verify$/); - await expect( - page.getByRole("heading", { name: "你好，预览用户" }), - ).toBeVisible(); - await page.getByLabel("演示码").fill("000000"); - await page.getByRole("button", { name: "继续", exact: true }).click(); - await expect(page.getByRole("alert")).toContainText("演示码不正确"); - await page.getByLabel("演示码").fill("123456"); - await page.getByRole("button", { name: "继续", exact: true }).click(); - await expect(page.getByRole("heading", { name: "体验完成" })).toBeVisible(); - expect(posts).toHaveLength(3); - expect(xhr).toEqual([]); - expect(errors).toEqual([]); - const timing = await page.evaluate(() => ({ - navigation: performance - .getEntriesByType("navigation") - .map((e) => e.toJSON()), - resources: performance.getEntriesByType("resource").map((e) => e.toJSON()), - })); - const script = timing.resources.find((r) => r.name.endsWith(scriptUrl!)); - expect(script?.transferSize).toBe(0); - await test - .info() - .attach("navigation-and-cache.json", { - body: JSON.stringify(timing, null, 2), - contentType: "application/json", - }); - expect( - ( - await page.request.get("/", { headers: { Accept: "application/json" } }) - ).status(), - ).toBe(401); - await page.getByRole("button", { name: "重新体验" }).click(); - await expect(page.getByRole("heading", { name: "从这里开始" })).toBeVisible(); -}); - -test("移动端与脚本结束标记作为纯文本显示", async ({ page }) => { - await page.setViewportSize({ width: 390, height: 844 }); - await page.goto("/preview"); - const name = ""; - await page.getByLabel("称呼").fill(name); - await page.getByRole("button", { name: "继续", exact: true }).click(); - await expect(page.getByRole("heading")).toHaveText(`你好，${name}`); - expect( - await page.evaluate(() => Reflect.get(window, "__injected")), - ).toBeUndefined(); - expect( - await page.evaluate( - () => document.documentElement.scrollWidth <= innerWidth, - ), - ).toBe(true); - await page.screenshot({ path: "test-results/mobile.png", fullPage: true }); -}); - - -test("受限网络下首屏和缓存后页面切换计时", async ({ page, context }) => { - const cdp = await context.newCDPSession(page); - await cdp.send("Network.enable"); - await cdp.send("Network.emulateNetworkConditions", { - offline: false, latency: 60, downloadThroughput: 1_500_000 / 8, - uploadThroughput: 750_000 / 8, - }); - await cdp.send("Emulation.setCPUThrottlingRate", { rate: 4 }); - await page.goto("/preview"); - await expect(page.getByRole("heading", { name: "从这里开始" })).toBeVisible(); - const cold = await page.evaluate(() => performance.getEntriesByName("iam-page-ready")[0].startTime); - await page.getByLabel("称呼").fill("计时体验"); - const start = performance.now(); - await page.getByRole("button", { name: "继续", exact: true }).click(); - await expect(page.getByRole("heading", { name: "你好，计时体验" })).toBeVisible(); - const warm = performance.now() - start; - const result = { network_latency_ms: 60, download_mbps: 1.5, cpu_slowdown: 4, - cold_navigation_to_react_commit_ms: Math.round(cold), warm_click_to_visible_ms: Math.round(warm) }; - console.log(JSON.stringify(result)); - await test.info().attach("timing.json", { body: JSON.stringify(result, null, 2), contentType: "application/json" }); -}); diff --git a/scripts/native-smoke.py b/scripts/native-smoke.py index 0d7ad00..c51c2ad 100755 --- a/scripts/native-smoke.py +++ b/scripts/native-smoke.py @@ -59,7 +59,7 @@ def main(): def request(path, authenticated=False): headers = {'Accept': 'text/plain' if authenticated and path == '/actuator/prometheus' else 'application/json'} - if path == '/preview': + if path == '/signin': headers['Accept'] = 'text/html' if authenticated: headers['Authorization'] = f'Basic {basic}' @@ -80,7 +80,7 @@ def main(): ready_seconds = time.monotonic() - started assert request('/actuator/prometheus')[0] == 401, 'Anonymous metrics must be rejected' assert request('/')[0] == 401, 'Anonymous application access must be rejected' - assert request('/preview')[0] == 404, 'UI preview must be disabled by default' + assert request('/signin')[0] == 404, 'Sign-in must be disabled without directory configuration' status, before = request('/actuator/prometheus', authenticated=True) assert status == 200, 'Authenticated Prometheus scrape failed' for _ in range(3): diff --git a/src/main/java/top/ddupan/iam/login/ad/AdPasswordVerifier.java b/src/main/java/top/ddupan/iam/login/ad/AdPasswordVerifier.java deleted file mode 100644 index 235ab76..0000000 --- a/src/main/java/top/ddupan/iam/login/ad/AdPasswordVerifier.java +++ /dev/null @@ -1,153 +0,0 @@ -package top.ddupan.iam.login.ad; - -import java.net.URI; -import java.nio.ByteBuffer; -import java.nio.ByteOrder; -import java.util.Arrays; -import java.util.Collection; -import java.util.List; -import java.util.Map; -import java.util.UUID; -import javax.naming.NamingException; -import javax.naming.ldap.LdapName; -import org.springframework.boot.context.properties.EnableConfigurationProperties; -import org.springframework.ldap.core.DirContextAdapter; -import org.springframework.ldap.core.DirContextOperations; -import org.springframework.security.authentication.BadCredentialsException; -import org.springframework.security.authentication.InternalAuthenticationServiceException; -import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; -import org.springframework.security.core.GrantedAuthority; -import org.springframework.security.core.userdetails.User; -import org.springframework.security.core.userdetails.UserDetails; -import org.springframework.security.ldap.authentication.ad.ActiveDirectoryLdapAuthenticationProvider; -import org.springframework.security.ldap.userdetails.UserDetailsContextMapper; -import org.springframework.stereotype.Service; - -/** Invoke explicitly as a first factor; never register this as a web AuthenticationProvider. */ -@Service -@EnableConfigurationProperties(AdProperties.class) -public class AdPasswordVerifier { - private final ActiveDirectoryLdapAuthenticationProvider provider; - private final AdProperties properties; - - public AdPasswordVerifier(AdProperties properties) { - this.properties = properties; - if (!properties.enabled()) { - provider = null; - return; - } - URI uri = URI.create(properties.url()); - if (!"ldaps".equals(uri.getScheme()) || uri.getHost() == null || uri.getUserInfo() != null - || uri.getQuery() != null || uri.getFragment() != null - || properties.domain() == null || properties.domain().isBlank() - || properties.baseDn() == null || properties.baseDn().isBlank()) { - throw new IllegalArgumentException("AD requires an LDAPS URL, domain and base DN"); - } - provider = new ActiveDirectoryLdapAuthenticationProvider( - properties.domain(), properties.url(), properties.baseDn()); - provider.setConvertSubErrorCodesToExceptions(true); - provider.setUseAuthenticationRequestCredentials(false); - provider.setSearchFilter("(&(objectClass=user)(!(objectClass=computer))(userPrincipalName={0}))"); - // AD domain searches include other naming-context references. Ignore them (never follow - // with user credentials); Spring's AD provider already ignores partial-result exceptions. - provider.setContextEnvironmentProperties(Map.of( - "com.sun.jndi.ldap.connect.timeout", "3000", - "com.sun.jndi.ldap.read.timeout", "5000", - "java.naming.ldap.attributes.binary", "objectGUID", - "java.naming.referral", "ignore")); - // Directory groups are mapped independently; do not confuse FACTOR_PASSWORD with a group. - provider.setAuthoritiesPopulator((entry, username) -> List.of()); - provider.setUserDetailsContextMapper(new IdentityMapper()); - } - - public boolean enabled() { return properties.enabled(); } - - public DirectoryIdentity verify(String username, String password) { - if (provider == null) throw new IllegalStateException("AD login is disabled"); - if (username == null || username.isBlank() || username.length() > 256 - || username.contains("\\") || !username.equals(username.strip()) - || (username.contains("@") && !username.toLowerCase(java.util.Locale.ROOT) - .endsWith("@" + properties.domain().toLowerCase(java.util.Locale.ROOT))) - || password == null || password.isEmpty() || password.length() > 1024) { - throw new BadCredentialsException("Invalid credentials"); - } - var token = UsernamePasswordAuthenticationToken.unauthenticated(username, password); - try { - var result = provider.authenticate(token); - try { - return ((IdentityUser) result.getPrincipal()).identity; - } finally { - if (result instanceof org.springframework.security.core.CredentialsContainer credentials) { - credentials.eraseCredentials(); - } - } - } finally { - token.eraseCredentials(); - } - } - - static final class IdentityUser extends User { - final DirectoryIdentity identity; - IdentityUser(DirectoryIdentity identity) { - super(identity.username(), "", List.of()); - this.identity = identity; - } - } - - static final class IdentityMapper implements UserDetailsContextMapper { - @Override - public UserDetails mapUserFromContext(DirContextOperations entry, String username, - Collection authorities) { - try { - // Refuse an incomplete ranged result instead of silently dropping groups. - var ids = entry.getAttributes().getIDs(); - try { - while (ids.hasMore()) { - if (ids.next().toLowerCase(java.util.Locale.ROOT).startsWith("memberof;")) { - throw new IllegalArgumentException("Ranged membership is not supported yet"); - } - } - } finally { ids.close(); } - String account = required(entry, "sAMAccountName"); - String display = entry.getStringAttribute("displayName"); - String email = entry.getStringAttribute("mail"); - String[] membership = entry.getStringAttributes("memberOf"); - List dns = membership == null ? List.of() : Arrays.stream(membership).sorted().toList(); - var groups = new java.util.TreeSet(); - for (String dn : dns) { - var name = new LdapName(dn); - var rdn = name.getRdn(name.size() - 1); - if (!rdn.getType().equalsIgnoreCase("CN")) throw new IllegalArgumentException("Group has no CN"); - if (!groups.add(rdn.getValue().toString())) throw new IllegalArgumentException("Ambiguous group CN"); - } - return new IdentityUser(new DirectoryIdentity( - guid((byte[]) entry.getObjectAttribute("objectGUID")), account, - display == null ? account : display, email == null ? "" : email, - List.copyOf(groups), dns)); - } catch (NamingException | IllegalArgumentException | ClassCastException ex) { - throw new InternalAuthenticationServiceException("Directory identity cannot be mapped", ex); - } - } - - @Override - public void mapUserToContext(UserDetails user, DirContextAdapter context) { - throw new UnsupportedOperationException("Read-only directory integration"); - } - - private static String required(DirContextOperations entry, String attribute) { - String value = entry.getStringAttribute(attribute); - if (value == null || value.isBlank()) throw new IllegalArgumentException("Missing directory attribute"); - return value; - } - } - - static String guid(byte[] bytes) { - if (bytes == null || bytes.length != 16) throw new IllegalArgumentException("Invalid objectGUID"); - var little = ByteBuffer.wrap(bytes).order(ByteOrder.LITTLE_ENDIAN); - long most = Integer.toUnsignedLong(little.getInt()) << 32 - | (long) Short.toUnsignedInt(little.getShort()) << 16 - | Short.toUnsignedInt(little.getShort()); - long least = ByteBuffer.wrap(bytes, 8, 8).getLong(); - return new UUID(most, least).toString(); - } -} diff --git a/src/main/java/top/ddupan/iam/login/ad/DirectoryIdentity.java b/src/main/java/top/ddupan/iam/login/ad/DirectoryIdentity.java deleted file mode 100644 index 28cf372..0000000 --- a/src/main/java/top/ddupan/iam/login/ad/DirectoryIdentity.java +++ /dev/null @@ -1,12 +0,0 @@ -package top.ddupan.iam.login.ad; - -import java.util.List; - -/** Directory key only: deliberately not a Hydra subject or a completed authentication. */ -public record DirectoryIdentity(String objectGuid, String username, String displayName, - String email, List groups, List groupDns) { - public DirectoryIdentity { - groups = List.copyOf(groups); - groupDns = List.copyOf(groupDns); - } -} diff --git a/src/main/java/top/ddupan/iam/login/authentication/application/SignInService.java b/src/main/java/top/ddupan/iam/login/authentication/application/SignInService.java new file mode 100644 index 0000000..c3985e6 --- /dev/null +++ b/src/main/java/top/ddupan/iam/login/authentication/application/SignInService.java @@ -0,0 +1,50 @@ +package top.ddupan.iam.login.authentication.application; + +import java.time.Clock; +import java.util.UUID; +import top.ddupan.iam.login.authentication.application.port.PasswordAuthenticator; +import top.ddupan.iam.login.authentication.domain.UserRepository; +import top.ddupan.iam.login.authentication.application.port.PasswordVerificationException; +import top.ddupan.iam.login.authentication.domain.LoginTransaction; + +/** Coordinates the first-factor use case. HTTP/session/LDAP details stay in adapters. */ +public final class SignInService { + public enum PasswordResult { ACCEPTED, REJECTED, EXPIRED, WRONG_STEP, RETRY_LATER } + private final PasswordAuthenticator authenticator; + private final Clock clock; + private final boolean enabled; + + public SignInService(PasswordAuthenticator authenticator, Clock clock, boolean enabled) { + this.authenticator = authenticator; + this.clock = clock; + this.enabled = enabled; + } + + public boolean enabled() { return enabled; } + public LoginTransaction start() { return LoginTransaction.start(UUID.randomUUID(), clock.instant()); } + public boolean expired(LoginTransaction transaction) { return transaction.expiredAt(clock.instant()); } + + public PasswordResult submitPassword(LoginTransaction transaction, String username, String password) { + if (!enabled) throw new IllegalStateException("Human sign-in is disabled"); + var attempt = transaction.beginPasswordAttempt(clock.instant()); + if (attempt != LoginTransaction.Attempt.ALLOWED) { + return switch (attempt) { + case EXPIRED -> PasswordResult.EXPIRED; + case WRONG_STEP -> PasswordResult.WRONG_STEP; + case RETRY_LATER -> PasswordResult.RETRY_LATER; + case ALLOWED -> throw new IllegalStateException("Unexpected attempt result"); + }; + } + try (var session = authenticator.authenticate(username, password)) { + var identity = session.users().findByLoginName(session.loginName()); + if (identity.isEmpty()) return PasswordResult.REJECTED; + // A slow directory response must not revive an expired transaction. + var verifiedAt = clock.instant(); + if (transaction.expiredAt(verifiedAt)) return PasswordResult.EXPIRED; + transaction.passwordVerified(identity.orElseThrow(), verifiedAt); + return PasswordResult.ACCEPTED; + } catch (PasswordVerificationException | UserRepository.AccessFailure ex) { + return PasswordResult.REJECTED; + } + } +} diff --git a/src/main/java/top/ddupan/iam/login/authentication/application/port/AuthenticatedUserSession.java b/src/main/java/top/ddupan/iam/login/authentication/application/port/AuthenticatedUserSession.java new file mode 100644 index 0000000..bc6aee3 --- /dev/null +++ b/src/main/java/top/ddupan/iam/login/authentication/application/port/AuthenticatedUserSession.java @@ -0,0 +1,10 @@ +package top.ddupan.iam.login.authentication.application.port; + +import top.ddupan.iam.login.authentication.domain.UserRepository; + +/** Uses the authenticated user's connection, without exposing connection or credential objects. */ +public interface AuthenticatedUserSession extends AutoCloseable { + String loginName(); + UserRepository users(); + @Override void close(); +} diff --git a/src/main/java/top/ddupan/iam/login/authentication/application/port/PasswordAuthenticator.java b/src/main/java/top/ddupan/iam/login/authentication/application/port/PasswordAuthenticator.java new file mode 100644 index 0000000..63ee91e --- /dev/null +++ b/src/main/java/top/ddupan/iam/login/authentication/application/port/PasswordAuthenticator.java @@ -0,0 +1,6 @@ +package top.ddupan.iam.login.authentication.application.port; + +/** Password authentication opens a short-lived user repository scope. */ +public interface PasswordAuthenticator { + AuthenticatedUserSession authenticate(String username, String password); +} diff --git a/src/main/java/top/ddupan/iam/login/authentication/application/port/PasswordVerificationException.java b/src/main/java/top/ddupan/iam/login/authentication/application/port/PasswordVerificationException.java new file mode 100644 index 0000000..873e36d --- /dev/null +++ b/src/main/java/top/ddupan/iam/login/authentication/application/port/PasswordVerificationException.java @@ -0,0 +1,14 @@ +package top.ddupan.iam.login.authentication.application.port; + +/** Adapter failures translated into application vocabulary, without vendor exception details. */ +public final class PasswordVerificationException extends RuntimeException { + public enum Reason { REJECTED, DISABLED, LOCKED, PASSWORD_EXPIRED, ACCOUNT_EXPIRED, UNAVAILABLE } + private final Reason reason; + + public PasswordVerificationException(Reason reason) { + super(reason.name()); + this.reason = reason; + } + + public Reason reason() { return reason; } +} diff --git a/src/main/java/top/ddupan/iam/login/authentication/domain/LoginTransaction.java b/src/main/java/top/ddupan/iam/login/authentication/domain/LoginTransaction.java new file mode 100644 index 0000000..5048b81 --- /dev/null +++ b/src/main/java/top/ddupan/iam/login/authentication/domain/LoginTransaction.java @@ -0,0 +1,56 @@ +package top.ddupan.iam.login.authentication.domain; + +import java.time.Duration; +import java.time.Instant; +import java.util.Objects; +import java.util.UUID; + +/** Owns first-factor ordering, lifetime and the identity to which further factors must bind. */ +public final class LoginTransaction { + private static final Duration LIFETIME = Duration.ofMinutes(10); + private static final Duration ATTEMPT_INTERVAL = Duration.ofSeconds(2); + + public enum Step { PASSWORD_REQUIRED, MFA_REQUIRED } + public enum Attempt { ALLOWED, EXPIRED, WRONG_STEP, RETRY_LATER } + + private final UUID id; + private Step step = Step.PASSWORD_REQUIRED; + private Instant expiresAt; + private Instant retryAfter = Instant.MIN; + private User identity; + + private LoginTransaction(UUID id, Instant now) { + this.id = Objects.requireNonNull(id); + this.expiresAt = now.plus(LIFETIME); + } + + public static LoginTransaction start(UUID id, Instant now) { + return new LoginTransaction(id, now); + } + + public Attempt beginPasswordAttempt(Instant now) { + if (expiredAt(now)) return Attempt.EXPIRED; + if (step != Step.PASSWORD_REQUIRED) return Attempt.WRONG_STEP; + if (now.isBefore(retryAfter)) return Attempt.RETRY_LATER; + retryAfter = now.plus(ATTEMPT_INTERVAL); + return Attempt.ALLOWED; + } + + public void passwordVerified(User identity, Instant now) { + if (expiredAt(now) || step != Step.PASSWORD_REQUIRED) { + throw new IllegalStateException("Password verification is not allowed in this transaction state"); + } + this.identity = Objects.requireNonNull(identity); + this.step = Step.MFA_REQUIRED; + this.expiresAt = now.plus(LIFETIME); + } + + public UUID id() { return id; } + public Step step() { return step; } + public boolean expiredAt(Instant now) { return !now.isBefore(expiresAt); } + + public User identity() { + if (identity == null) throw new IllegalStateException("No verified identity yet"); + return identity; + } +} diff --git a/src/main/java/top/ddupan/iam/login/authentication/domain/User.java b/src/main/java/top/ddupan/iam/login/authentication/domain/User.java new file mode 100644 index 0000000..73cd327 --- /dev/null +++ b/src/main/java/top/ddupan/iam/login/authentication/domain/User.java @@ -0,0 +1,48 @@ +package top.ddupan.iam.login.authentication.domain; + +import java.util.List; +import java.util.Objects; + +/** Directory-owned user aggregate. Identity is stable while profile and membership may change. */ +public final class User { + private final UserId id; + private final String username; + private final String displayName; + private final String email; + private final List memberships; + + public User(UserId id, String username, String displayName, String email, List memberships) { + this.id = Objects.requireNonNull(id); + if (username == null || username.isBlank()) throw new IllegalArgumentException("Missing username"); + this.username = username; + this.displayName = Objects.requireNonNull(displayName); + this.email = Objects.requireNonNull(email); + this.memberships = List.copyOf(memberships); + } + + public UserId id() { return id; } + public String username() { return username; } + public String displayName() { return displayName; } + public String email() { return email; } + public List memberships() { return memberships; } + + @Override public boolean equals(Object other) { return other instanceof User user && id.equals(user.id); } + @Override public int hashCode() { return id.hashCode(); } + + public record UserId(String authority, String value) { + public UserId { + if (authority == null || authority.isBlank() || value == null || value.isBlank()) { + throw new IllegalArgumentException("Missing user identifier"); + } + } + } + + /** External group identifiers are opaque to the domain. */ + public record GroupMembership(String name, String externalId) { + public GroupMembership { + if (name == null || name.isBlank() || externalId == null || externalId.isBlank()) { + throw new IllegalArgumentException("Missing group identifier"); + } + } + } +} diff --git a/src/main/java/top/ddupan/iam/login/authentication/domain/UserRepository.java b/src/main/java/top/ddupan/iam/login/authentication/domain/UserRepository.java new file mode 100644 index 0000000..caea6cb --- /dev/null +++ b/src/main/java/top/ddupan/iam/login/authentication/domain/UserRepository.java @@ -0,0 +1,12 @@ +package top.ddupan.iam.login.authentication.domain; + +import java.util.Optional; + +/** Read-only user collection; directory entries and LDAP types never cross this boundary. */ +public interface UserRepository { + Optional findByLoginName(String loginName); + + final class AccessFailure extends RuntimeException { + public AccessFailure() { super("User repository is unavailable or returned an invalid user"); } + } +} diff --git a/src/main/java/top/ddupan/iam/login/authentication/infrastructure/ad/AdEntryMapper.java b/src/main/java/top/ddupan/iam/login/authentication/infrastructure/ad/AdEntryMapper.java new file mode 100644 index 0000000..029a79f --- /dev/null +++ b/src/main/java/top/ddupan/iam/login/authentication/infrastructure/ad/AdEntryMapper.java @@ -0,0 +1,27 @@ +package top.ddupan.iam.login.authentication.infrastructure.ad; + +import java.util.Locale; +import javax.naming.NamingException; +import org.springframework.LdapDataEntry; +import org.springframework.ldap.odm.core.impl.DefaultObjectDirectoryMapper; +import top.ddupan.iam.login.authentication.domain.UserRepository; + +/** Keep Spring's ODM mapping while refusing silently truncated AD group attributes. */ +final class AdEntryMapper extends DefaultObjectDirectoryMapper { + @Override + public T mapFromLdapDataEntry(LdapDataEntry entry, Class type) { + var ids = entry.getAttributes().getIDs(); + try { + while (ids.hasMore()) { + if (ids.next().toLowerCase(Locale.ROOT).startsWith("memberof;")) { + throw new UserRepository.AccessFailure(); + } + } + } catch (NamingException ex) { + throw new UserRepository.AccessFailure(); + } finally { + try { ids.close(); } catch (NamingException ignored) { } + } + return super.mapFromLdapDataEntry(entry, type); + } +} diff --git a/src/main/java/top/ddupan/iam/login/authentication/infrastructure/ad/AdPasswordAuthenticator.java b/src/main/java/top/ddupan/iam/login/authentication/infrastructure/ad/AdPasswordAuthenticator.java new file mode 100644 index 0000000..fa8c7d7 --- /dev/null +++ b/src/main/java/top/ddupan/iam/login/authentication/infrastructure/ad/AdPasswordAuthenticator.java @@ -0,0 +1,91 @@ +package top.ddupan.iam.login.authentication.infrastructure.ad; + +import java.net.URI; +import java.util.Locale; +import java.util.Map; +import java.util.regex.Pattern; +import org.springframework.boot.context.properties.EnableConfigurationProperties; +import org.springframework.data.ldap.repository.support.SimpleLdapRepository; +import org.springframework.ldap.core.LdapTemplate; +import org.springframework.ldap.core.support.LdapContextSource; +import org.springframework.ldap.core.support.SingleContextSource; +import org.springframework.stereotype.Component; +import top.ddupan.iam.login.authentication.application.port.AuthenticatedUserSession; +import top.ddupan.iam.login.authentication.application.port.PasswordAuthenticator; +import top.ddupan.iam.login.authentication.application.port.PasswordVerificationException; +import top.ddupan.iam.login.authentication.application.port.PasswordVerificationException.Reason; + +/** Bind authenticates; the scoped Spring Data repository owns all user and membership reads. */ +@Component +@EnableConfigurationProperties(AdProperties.class) +public final class AdPasswordAuthenticator implements PasswordAuthenticator { + private static final Pattern AD_SUBCODE = Pattern.compile("\\bdata\\s+([0-9a-f]+)", Pattern.CASE_INSENSITIVE); + private final AdProperties properties; + private final LdapContextSource contexts; + + public AdPasswordAuthenticator(AdProperties properties) { + this.properties = properties; + if (!properties.enabled()) { contexts = null; return; } + var uri = URI.create(properties.url()); + if (!"ldaps".equals(uri.getScheme()) || uri.getHost() == null || uri.getUserInfo() != null + || uri.getQuery() != null || uri.getFragment() != null + || properties.domain() == null || properties.domain().isBlank() + || properties.baseDn() == null || properties.baseDn().isBlank()) { + throw new IllegalArgumentException("AD requires an LDAPS URL, domain and base DN"); + } + contexts = new LdapContextSource(); + contexts.setUrl(properties.url()); + contexts.setBase(properties.baseDn()); + contexts.setPooled(false); + contexts.setReferral("ignore"); + contexts.setBaseEnvironmentProperties(Map.of( + "com.sun.jndi.ldap.connect.timeout", "3000", + "com.sun.jndi.ldap.read.timeout", "5000", + "java.naming.ldap.attributes.binary", "objectGUID")); + contexts.afterPropertiesSet(); + } + + @Override + public AuthenticatedUserSession authenticate(String username, String password) { + if (contexts == null) throw new PasswordVerificationException(Reason.UNAVAILABLE); + if (username == null || username.isBlank() || username.length() > 256 + || username.contains("\\") || !username.equals(username.strip()) + || (username.contains("@") && !username.toLowerCase(Locale.ROOT) + .endsWith("@" + properties.domain().toLowerCase(Locale.ROOT))) + || password == null || password.isEmpty() || password.length() > 1024) { + throw new PasswordVerificationException(Reason.REJECTED); + } + String principal = username.contains("@") ? username : username + "@" + properties.domain(); + try { + var connection = new SingleContextSource(contexts.getContext(principal, password)); + try { + var mapper = new AdEntryMapper(); + var operations = new LdapTemplate(connection); + operations.setIgnorePartialResultException(true); + operations.setObjectDirectoryMapper(mapper); + var entries = new SimpleLdapRepository<>(operations, mapper, AdUserEntry.class); + return new AdUserRepository(entries, connection, properties.domain(), principal); + } catch (RuntimeException ex) { + connection.destroy(); + throw ex; + } + } catch (org.springframework.ldap.AuthenticationException ex) { + throw new PasswordVerificationException(reason(ex)); + } catch (org.springframework.ldap.NamingException | org.springframework.dao.DataAccessException ex) { + throw new PasswordVerificationException(Reason.UNAVAILABLE); + } + } + + private static Reason reason(org.springframework.ldap.AuthenticationException exception) { + // Translate AD's diagnostic codes; never expose the diagnostic or credentials to the use case. + var matcher = AD_SUBCODE.matcher(exception.getMessage() == null ? "" : exception.getMessage()); + if (!matcher.find()) return Reason.REJECTED; + return switch (matcher.group(1).toLowerCase(Locale.ROOT)) { + case "533" -> Reason.DISABLED; + case "775" -> Reason.LOCKED; + case "532", "773" -> Reason.PASSWORD_EXPIRED; + case "701" -> Reason.ACCOUNT_EXPIRED; + default -> Reason.REJECTED; + }; + } +} diff --git a/src/main/java/top/ddupan/iam/login/ad/AdProperties.java b/src/main/java/top/ddupan/iam/login/authentication/infrastructure/ad/AdProperties.java similarity index 76% rename from src/main/java/top/ddupan/iam/login/ad/AdProperties.java rename to src/main/java/top/ddupan/iam/login/authentication/infrastructure/ad/AdProperties.java index 6ebcaca..b1441d5 100644 --- a/src/main/java/top/ddupan/iam/login/ad/AdProperties.java +++ b/src/main/java/top/ddupan/iam/login/authentication/infrastructure/ad/AdProperties.java @@ -1,4 +1,4 @@ -package top.ddupan.iam.login.ad; +package top.ddupan.iam.login.authentication.infrastructure.ad; import org.springframework.boot.context.properties.ConfigurationProperties; diff --git a/src/main/java/top/ddupan/iam/login/authentication/infrastructure/ad/AdUserEntry.java b/src/main/java/top/ddupan/iam/login/authentication/infrastructure/ad/AdUserEntry.java new file mode 100644 index 0000000..c562425 --- /dev/null +++ b/src/main/java/top/ddupan/iam/login/authentication/infrastructure/ad/AdUserEntry.java @@ -0,0 +1,20 @@ +package top.ddupan.iam.login.authentication.infrastructure.ad; + +import java.util.List; +import javax.naming.Name; +import lombok.Getter; +import org.springframework.ldap.odm.annotations.Attribute; +import org.springframework.ldap.odm.annotations.Entry; +import org.springframework.ldap.odm.annotations.Id; + +/** Persistence representation, deliberately separate from the domain user. */ +@Getter +@Entry(objectClasses = "user") +public final class AdUserEntry { + @Id private Name dn; + @Attribute(name = "objectGUID", type = Attribute.Type.BINARY) private byte[] objectGuid; + @Attribute(name = "sAMAccountName") private String accountName; + @Attribute(name = "displayName") private String displayName; + @Attribute(name = "mail") private String email; + @Attribute(name = "memberOf") private List memberOf; +} diff --git a/src/main/java/top/ddupan/iam/login/authentication/infrastructure/ad/AdUserRepository.java b/src/main/java/top/ddupan/iam/login/authentication/infrastructure/ad/AdUserRepository.java new file mode 100644 index 0000000..a7e6765 --- /dev/null +++ b/src/main/java/top/ddupan/iam/login/authentication/infrastructure/ad/AdUserRepository.java @@ -0,0 +1,82 @@ +package top.ddupan.iam.login.authentication.infrastructure.ad; + +import java.nio.ByteBuffer; +import java.nio.ByteOrder; +import java.util.List; +import java.util.Optional; +import java.util.TreeMap; +import java.util.UUID; +import javax.naming.NamingException; +import javax.naming.ldap.LdapName; +import org.springframework.data.ldap.repository.LdapRepository; +import org.springframework.ldap.core.support.SingleContextSource; +import top.ddupan.iam.login.authentication.application.port.AuthenticatedUserSession; +import top.ddupan.iam.login.authentication.domain.User; +import top.ddupan.iam.login.authentication.domain.User.GroupMembership; +import top.ddupan.iam.login.authentication.domain.User.UserId; +import top.ddupan.iam.login.authentication.domain.UserRepository; +import static org.springframework.ldap.query.LdapQueryBuilder.query; + +/** One authenticated connection and one Spring Data repository per use-case scope. */ +final class AdUserRepository implements UserRepository, AuthenticatedUserSession { + private final LdapRepository entries; + private final SingleContextSource connection; + private final String authority; + private final String loginName; + private boolean closed; + + AdUserRepository(LdapRepository entries, SingleContextSource connection, + String authority, String loginName) { + this.entries = entries; + this.connection = connection; + this.authority = authority; + this.loginName = loginName; + } + + @Override + public Optional findByLoginName(String name) { + requireOpen(); + try { + return entries.findOne(query().where("objectClass").is("user") + .and("objectClass").not().is("computer") + .and(query().where("sAMAccountName").is(name).or("userPrincipalName").is(name))) + .map(this::toUser); + } catch (org.springframework.ldap.NamingException | org.springframework.dao.DataAccessException | IllegalArgumentException ex) { + throw new UserRepository.AccessFailure(); + } + } + + private User toUser(AdUserEntry entry) { + var groups = new TreeMap(); + for (String dn : entry.getMemberOf() == null ? List.of() : entry.getMemberOf()) { + try { + var name = new LdapName(dn); + var rdn = name.getRdn(name.size() - 1); + if (!rdn.getType().equalsIgnoreCase("CN")) throw new UserRepository.AccessFailure(); + String cn = rdn.getValue().toString(); + if (groups.putIfAbsent(cn, new GroupMembership(cn, dn)) != null) { + throw new UserRepository.AccessFailure(); + } + } catch (NamingException ex) { throw new UserRepository.AccessFailure(); } + } + return new User(new UserId(authority, guid(entry.getObjectGuid())), entry.getAccountName(), + entry.getDisplayName() == null ? entry.getAccountName() : entry.getDisplayName(), + entry.getEmail() == null ? "" : entry.getEmail(), List.copyOf(groups.values())); + } + + static String guid(byte[] bytes) { + if (bytes == null || bytes.length != 16) throw new UserRepository.AccessFailure(); + var little = ByteBuffer.wrap(bytes).order(ByteOrder.LITTLE_ENDIAN); + long most = Integer.toUnsignedLong(little.getInt()) << 32 + | (long) Short.toUnsignedInt(little.getShort()) << 16 + | Short.toUnsignedInt(little.getShort()); + return new UUID(most, ByteBuffer.wrap(bytes, 8, 8).getLong()).toString(); + } + + @Override public String loginName() { requireOpen(); return loginName; } + @Override public UserRepository users() { requireOpen(); return this; } + private void requireOpen() { if (closed) throw new IllegalStateException("User repository scope is closed"); } + @Override public void close() { + if (!closed) { closed = true; connection.destroy(); } + } +} diff --git a/src/main/java/top/ddupan/iam/login/authentication/interfaces/web/BrowserSignInState.java b/src/main/java/top/ddupan/iam/login/authentication/interfaces/web/BrowserSignInState.java new file mode 100644 index 0000000..49ea262 --- /dev/null +++ b/src/main/java/top/ddupan/iam/login/authentication/interfaces/web/BrowserSignInState.java @@ -0,0 +1,12 @@ +package top.ddupan.iam.login.authentication.interfaces.web; + +import top.ddupan.iam.login.authentication.domain.LoginTransaction; + +/** HTTP-session storage plus presentation feedback. Authentication rules live in the aggregate. */ +final class BrowserSignInState { + final LoginTransaction transaction; + String username = ""; + String error = ""; + + BrowserSignInState(LoginTransaction transaction) { this.transaction = transaction; } +} diff --git a/src/main/java/top/ddupan/iam/login/preview/PageRenderer.java b/src/main/java/top/ddupan/iam/login/authentication/interfaces/web/PageRenderer.java similarity index 95% rename from src/main/java/top/ddupan/iam/login/preview/PageRenderer.java rename to src/main/java/top/ddupan/iam/login/authentication/interfaces/web/PageRenderer.java index 0b69f23..e738fd6 100644 --- a/src/main/java/top/ddupan/iam/login/preview/PageRenderer.java +++ b/src/main/java/top/ddupan/iam/login/authentication/interfaces/web/PageRenderer.java @@ -1,4 +1,4 @@ -package top.ddupan.iam.login.preview; +package top.ddupan.iam.login.authentication.interfaces.web; import java.io.IOException; import java.nio.charset.StandardCharsets; diff --git a/src/main/java/top/ddupan/iam/login/ad/AdLoginController.java b/src/main/java/top/ddupan/iam/login/authentication/interfaces/web/SignInController.java similarity index 54% rename from src/main/java/top/ddupan/iam/login/ad/AdLoginController.java rename to src/main/java/top/ddupan/iam/login/authentication/interfaces/web/SignInController.java index 4d18a50..576f7ee 100644 --- a/src/main/java/top/ddupan/iam/login/ad/AdLoginController.java +++ b/src/main/java/top/ddupan/iam/login/authentication/interfaces/web/SignInController.java @@ -1,30 +1,30 @@ -package top.ddupan.iam.login.ad; +package top.ddupan.iam.login.authentication.interfaces.web; import jakarta.servlet.http.HttpServletRequest; import jakarta.servlet.http.HttpSession; -import java.time.Instant; import java.util.Map; import org.springframework.http.HttpStatus; import org.springframework.http.MediaType; import org.springframework.http.ResponseEntity; -import org.springframework.security.core.AuthenticationException; import org.springframework.security.web.csrf.CsrfToken; import org.springframework.web.bind.annotation.GetMapping; import org.springframework.web.bind.annotation.PostMapping; import org.springframework.web.bind.annotation.RequestParam; import org.springframework.web.bind.annotation.RestController; import org.springframework.web.server.ResponseStatusException; -import top.ddupan.iam.login.preview.PageRenderer; +import top.ddupan.iam.login.authentication.application.SignInService; +import top.ddupan.iam.login.authentication.domain.LoginTransaction.Step; +import top.ddupan.iam.login.authentication.domain.User.GroupMembership; -/** Human first-factor PoC. No SecurityContext, MFA acceptance, or Hydra calls. */ +/** Translates browser requests and use-case outcomes; no directory or authentication policy here. */ @RestController -public class AdLoginController { - static final String STATE = AdLoginController.class.getName() + ".state"; - private final AdPasswordVerifier verifier; +public class SignInController { + static final String STATE = SignInController.class.getName() + ".state"; + private final SignInService signIn; private final PageRenderer renderer; - public AdLoginController(AdPasswordVerifier verifier, PageRenderer renderer) { - this.verifier = verifier; + public SignInController(SignInService signIn, PageRenderer renderer) { + this.signIn = signIn; this.renderer = renderer; } @@ -34,7 +34,7 @@ public class AdLoginController { var session = request.getSession(); synchronized (session) { var state = state(session); - if (state.identity != null) return redirect("/signin/mfa"); + if (state.transaction.step() == Step.MFA_REQUIRED) return redirect("/signin/mfa"); return renderer.render(Map.of("step", "password", "name", state.username, "error", state.error, "action", "/signin/password", "csrf", csrf(csrf))); } @@ -48,26 +48,22 @@ public class AdLoginController { var session = request.getSession(false); if (session == null) throw new ResponseStatusException(HttpStatus.CONFLICT); synchronized (session) { - var state = (State) session.getAttribute(STATE); - if (state == null || state.identity != null || state.expires.isBefore(Instant.now())) { - return redirect("/signin"); - } - // Prevent double submissions in this transaction; perimeter rate limits belong at ingress. - if (state.retryAfter.isAfter(Instant.now())) throw new ResponseStatusException(HttpStatus.TOO_MANY_REQUESTS); - state.retryAfter = Instant.now().plusSeconds(2); + var state = (BrowserSignInState) session.getAttribute(STATE); + if (state == null) return redirect("/signin"); state.username = username.length() <= 256 ? username : ""; - try { - var identity = verifier.verify(username, password); - request.changeSessionId(); - state.identity = identity; - state.error = ""; - state.expires = Instant.now().plusSeconds(600); - return redirect("/signin/mfa"); - } catch (AuthenticationException | org.springframework.dao.DataAccessException ex) { - // Neither directory exception details nor passwords enter HTML/session/logs. - state.error = "无法验证账号，请检查凭据与账号状态，或稍后重试。"; - return redirect("/signin"); - } + return switch (signIn.submitPassword(state.transaction, username, password)) { + case ACCEPTED -> { + request.changeSessionId(); + state.error = ""; + yield redirect("/signin/mfa"); + } + case REJECTED -> { + state.error = "无法验证账号，请检查凭据与账号状态，或稍后重试。"; + yield redirect("/signin"); + } + case EXPIRED, WRONG_STEP -> redirect("/signin"); + case RETRY_LATER -> throw new ResponseStatusException(HttpStatus.TOO_MANY_REQUESTS); + }; } } @@ -78,12 +74,14 @@ public class AdLoginController { if (session == null) return redirect("/signin"); synchronized (session) { var state = state(session); - if (state.identity == null) return redirect("/signin"); - var identity = state.identity; - return renderer.render(Map.of("step", "mfa-pending", "name", identity.displayName(), + if (state.transaction.step() != Step.MFA_REQUIRED) return redirect("/signin"); + var user = state.transaction.identity(); + return renderer.render(Map.of("step", "mfa-pending", "name", user.displayName(), "error", "", "action", "/signin/restart", "csrf", csrf(csrf), - "identity", Map.of("username", identity.username(), "objectGuid", identity.objectGuid(), - "email", identity.email(), "groups", identity.groups(), "groupDns", identity.groupDns()))); + "identity", Map.of("username", user.username(), "subjectId", user.id().value(), + "email", user.email(), + "groups", user.memberships().stream().map(GroupMembership::name).toList(), + "groupDns", user.memberships().stream().map(GroupMembership::externalId).toList()))); } } @@ -96,33 +94,25 @@ public class AdLoginController { } private void requireAvailable(HttpServletRequest request) { - if (!verifier.enabled()) throw new ResponseStatusException(HttpStatus.NOT_FOUND); + if (!signIn.enabled()) throw new ResponseStatusException(HttpStatus.NOT_FOUND); if (!request.isSecure()) throw new ResponseStatusException(HttpStatus.UPGRADE_REQUIRED, "HTTPS required"); } + private BrowserSignInState state(HttpSession session) { + var state = (BrowserSignInState) session.getAttribute(STATE); + if (state == null || signIn.expired(state.transaction)) { + state = new BrowserSignInState(signIn.start()); + session.setAttribute(STATE, state); + } + return state; + } + private static Map csrf(CsrfToken token) { return Map.of("name", token.getParameterName(), "value", token.getToken()); } - private static State state(HttpSession session) { - var state = (State) session.getAttribute(STATE); - if (state == null || state.expires.isBefore(Instant.now())) { - state = new State(); - session.setAttribute(STATE, state); - } - return state; - } - private static ResponseEntity redirect(String location) { return ResponseEntity.status(HttpStatus.SEE_OTHER).header("Location", location) .header("Cache-Control", "no-store").build(); } - - static final class State { - String username = ""; - String error = ""; - DirectoryIdentity identity; - Instant expires = Instant.now().plusSeconds(600); - Instant retryAfter = Instant.EPOCH; - } } diff --git a/src/main/java/top/ddupan/iam/login/configuration/AuthenticationConfiguration.java b/src/main/java/top/ddupan/iam/login/configuration/AuthenticationConfiguration.java new file mode 100644 index 0000000..a4369ad --- /dev/null +++ b/src/main/java/top/ddupan/iam/login/configuration/AuthenticationConfiguration.java @@ -0,0 +1,34 @@ +package top.ddupan.iam.login.configuration; + +import java.time.Clock; +import javax.naming.directory.DirContext; +import javax.naming.ldap.LdapContext; +import org.springframework.aot.hint.RuntimeHints; +import org.springframework.aot.hint.RuntimeHintsRegistrar; +import org.springframework.aot.hint.annotation.RegisterReflectionForBinding; +import org.springframework.context.annotation.ImportRuntimeHints; +import org.springframework.ldap.core.DirContextProxy; +import top.ddupan.iam.login.authentication.infrastructure.ad.AdUserEntry; +import org.springframework.context.annotation.Bean; +import org.springframework.context.annotation.Configuration; +import top.ddupan.iam.login.authentication.application.SignInService; +import top.ddupan.iam.login.authentication.application.port.PasswordAuthenticator; +import top.ddupan.iam.login.authentication.infrastructure.ad.AdProperties; + +/** Composition root: dependencies point inward, framework wiring stays outside the model. */ +@Configuration(proxyBeanMethods = false) +@RegisterReflectionForBinding(AdUserEntry.class) +@ImportRuntimeHints(AuthenticationConfiguration.DirectoryHints.class) +class AuthenticationConfiguration { + @Bean + SignInService signInService(PasswordAuthenticator authenticator, AdProperties properties) { + return new SignInService(authenticator, Clock.systemUTC(), properties.enabled()); + } + static class DirectoryHints implements RuntimeHintsRegistrar { + @Override + public void registerHints(RuntimeHints hints, ClassLoader classLoader) { + hints.proxies().registerJdkProxy(LdapContext.class, DirContextProxy.class); + hints.proxies().registerJdkProxy(DirContext.class, DirContextProxy.class); + } + } +} diff --git a/src/main/java/top/ddupan/iam/login/configuration/SecurityConfiguration.java b/src/main/java/top/ddupan/iam/login/configuration/SecurityConfiguration.java new file mode 100644 index 0000000..7375039 --- /dev/null +++ b/src/main/java/top/ddupan/iam/login/configuration/SecurityConfiguration.java @@ -0,0 +1,22 @@ +package top.ddupan.iam.login.configuration; + +import org.springframework.context.annotation.Bean; +import org.springframework.context.annotation.Configuration; +import org.springframework.security.config.Customizer; +import org.springframework.security.config.annotation.web.builders.HttpSecurity; +import org.springframework.security.web.SecurityFilterChain; + +@Configuration(proxyBeanMethods = false) +class SecurityConfiguration { + @Bean + SecurityFilterChain security(HttpSecurity http) throws Exception { + return http.authorizeHttpRequests(auth -> auth + .requestMatchers("/error", "/signin", "/signin/**", "/assets/**", "/actuator/health/**").permitAll() + .anyRequest().authenticated()) + .httpBasic(Customizer.withDefaults()) + .headers(headers -> headers.contentSecurityPolicy(csp -> csp.policyDirectives( + "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; " + + "object-src 'none'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'"))) + .build(); + } +} diff --git a/src/main/java/top/ddupan/iam/login/configuration/WebConfiguration.java b/src/main/java/top/ddupan/iam/login/configuration/WebConfiguration.java new file mode 100644 index 0000000..3ec3acc --- /dev/null +++ b/src/main/java/top/ddupan/iam/login/configuration/WebConfiguration.java @@ -0,0 +1,28 @@ +package top.ddupan.iam.login.configuration; + +import java.time.Duration; +import org.springframework.aot.hint.RuntimeHints; +import org.springframework.aot.hint.RuntimeHintsRegistrar; +import org.springframework.context.annotation.Configuration; +import org.springframework.context.annotation.ImportRuntimeHints; +import org.springframework.http.CacheControl; +import org.springframework.web.servlet.config.annotation.ResourceHandlerRegistry; +import org.springframework.web.servlet.config.annotation.WebMvcConfigurer; + +@Configuration(proxyBeanMethods = false) +@ImportRuntimeHints(WebConfiguration.Resources.class) +class WebConfiguration implements WebMvcConfigurer { + + @Override + public void addResourceHandlers(ResourceHandlerRegistry registry) { + registry.addResourceHandler("/assets/**").addResourceLocations("classpath:/ui/assets/") + .setCacheControl(CacheControl.maxAge(Duration.ofDays(365)).cachePublic().immutable()); + } + + static class Resources implements RuntimeHintsRegistrar { + @Override + public void registerHints(RuntimeHints hints, ClassLoader classLoader) { + hints.resources().registerPattern("ui/**"); + } + } +} diff --git a/src/main/java/top/ddupan/iam/login/preview/PreviewConfiguration.java b/src/main/java/top/ddupan/iam/login/preview/PreviewConfiguration.java deleted file mode 100644 index 99ef53d..0000000 --- a/src/main/java/top/ddupan/iam/login/preview/PreviewConfiguration.java +++ /dev/null @@ -1,44 +0,0 @@ -package top.ddupan.iam.login.preview; - -import java.time.Duration; -import org.springframework.aot.hint.RuntimeHints; -import org.springframework.aot.hint.RuntimeHintsRegistrar; -import org.springframework.context.annotation.Bean; -import org.springframework.context.annotation.Configuration; -import org.springframework.context.annotation.ImportRuntimeHints; -import org.springframework.http.CacheControl; -import org.springframework.security.config.Customizer; -import org.springframework.security.config.annotation.web.builders.HttpSecurity; -import org.springframework.security.web.SecurityFilterChain; -import org.springframework.web.servlet.config.annotation.ResourceHandlerRegistry; -import org.springframework.web.servlet.config.annotation.WebMvcConfigurer; - -@Configuration(proxyBeanMethods = false) -@ImportRuntimeHints(PreviewConfiguration.Resources.class) -class PreviewConfiguration implements WebMvcConfigurer { - @Bean - SecurityFilterChain security(HttpSecurity http) throws Exception { - return http.authorizeHttpRequests(auth -> auth - .requestMatchers("/error", "/signin", "/signin/**", "/preview", "/preview/**", "/assets/**", "/actuator/health/**").permitAll() - .anyRequest().authenticated()) - .formLogin(Customizer.withDefaults()) - .httpBasic(Customizer.withDefaults()) - .headers(headers -> headers.contentSecurityPolicy(csp -> csp.policyDirectives( - "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; " - + "object-src 'none'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'"))) - .build(); - } - - @Override - public void addResourceHandlers(ResourceHandlerRegistry registry) { - registry.addResourceHandler("/assets/**").addResourceLocations("classpath:/ui/assets/") - .setCacheControl(CacheControl.maxAge(Duration.ofDays(365)).cachePublic().immutable()); - } - - static class Resources implements RuntimeHintsRegistrar { - @Override - public void registerHints(RuntimeHints hints, ClassLoader classLoader) { - hints.resources().registerPattern("ui/**"); - } - } -} diff --git a/src/main/java/top/ddupan/iam/login/preview/PreviewController.java b/src/main/java/top/ddupan/iam/login/preview/PreviewController.java deleted file mode 100644 index 0ecee40..0000000 --- a/src/main/java/top/ddupan/iam/login/preview/PreviewController.java +++ /dev/null @@ -1,129 +0,0 @@ -package top.ddupan.iam.login.preview; - -import jakarta.servlet.http.HttpServletRequest; -import jakarta.servlet.http.HttpSession; -import java.util.Map; -import org.springframework.beans.factory.annotation.Value; -import org.springframework.http.HttpStatus; -import org.springframework.http.MediaType; -import org.springframework.http.ResponseEntity; -import org.springframework.security.web.csrf.CsrfToken; -import org.springframework.web.bind.annotation.GetMapping; -import org.springframework.web.bind.annotation.PostMapping; -import org.springframework.web.bind.annotation.RequestParam; -import org.springframework.web.bind.annotation.RestController; -import org.springframework.web.server.ResponseStatusException; - -/** An isolated UI experiment. It never creates an authenticated SecurityContext. */ -@RestController -class PreviewController { - private static final String STATE = PreviewController.class.getName() + ".state"; - private final boolean enabled; - private final PageRenderer renderer; - - PreviewController(@Value("${iam.ui-preview.enabled:false}") boolean enabled, PageRenderer renderer) { - this.enabled = enabled; - this.renderer = renderer; - } - - @GetMapping(value = {"/preview", "/preview/verify", "/preview/complete"}, produces = MediaType.TEXT_HTML_VALUE) - ResponseEntity page(HttpServletRequest request, CsrfToken csrf) { - requireEnabled(); - var session = request.getSession(); - synchronized (session) { - var state = state(session); - var path = request.getRequestURI().substring(request.getContextPath().length()); - if (path.equals("/preview")) { - if (!state.step.equals("identity")) state.error = ""; - state.step = "identity"; - } else if (!path.equals(pathFor(state.step))) { - return redirect(pathFor(state.step)); - } - var context = Map.of("step", state.step, "name", state.name, "error", state.error, - "action", switch (state.step) { - case "identity" -> "/preview/identify"; - case "verification" -> "/preview/verify"; - default -> "/preview/restart"; - }, "csrf", Map.of("name", csrf.getParameterName(), "value", csrf.getToken())); - return renderer.render(context); - } - } - - @PostMapping("/preview/identify") - ResponseEntity identify(@RequestParam(defaultValue = "") String name, HttpSession session) { - requireEnabled(); - synchronized (session) { - var state = state(session); - requireStep(state, "identity"); - if (name.isBlank() || name.length() > 64) { - state.error = "称呼须为 1 到 64 个字符。"; - return redirect("/preview"); - } - state.name = name.strip(); - state.error = ""; - state.step = "verification"; - return redirect("/preview/verify"); - } - } - - @PostMapping("/preview/verify") - ResponseEntity verify(@RequestParam(defaultValue = "") String code, HttpSession session) { - requireEnabled(); - synchronized (session) { - var state = state(session); - requireStep(state, "verification"); - if (!code.equals("123456")) { - state.error = "演示码不正确，请输入 123456。"; - return redirect("/preview/verify"); - } - state.error = ""; - state.step = "complete"; - return redirect("/preview/complete"); - } - } - - @PostMapping("/preview/restart") - ResponseEntity restart(HttpSession session) { - requireEnabled(); - synchronized (session) { - session.removeAttribute(STATE); - return redirect("/preview"); - } - } - - private void requireEnabled() { - if (!enabled) throw new ResponseStatusException(HttpStatus.NOT_FOUND); - } - - private static void requireStep(State state, String step) { - if (!state.step.equals(step)) throw new ResponseStatusException(HttpStatus.CONFLICT, "页面已过期，请重新打开预览"); - } - - private static State state(HttpSession session) { - var state = (State) session.getAttribute(STATE); - if (state == null) { - state = new State(); - session.setAttribute(STATE, state); - } - return state; - } - - private static String pathFor(String step) { - return switch (step) { - case "verification" -> "/preview/verify"; - case "complete" -> "/preview/complete"; - default -> "/preview"; - }; - } - - private static ResponseEntity redirect(String path) { - return ResponseEntity.status(HttpStatus.SEE_OTHER).header("Location", path) - .header("Cache-Control", "no-store").build(); - } - - private static class State { - String step = "identity"; - String name = ""; - String error = ""; - } -} diff --git a/src/test/java/top/ddupan/iam/login/IamLoginApplicationTests.java b/src/test/java/top/ddupan/iam/login/IamLoginApplicationTests.java index abfb7d5..d97fc0e 100644 --- a/src/test/java/top/ddupan/iam/login/IamLoginApplicationTests.java +++ b/src/test/java/top/ddupan/iam/login/IamLoginApplicationTests.java @@ -1,7 +1,6 @@ package top.ddupan.iam.login; import io.micrometer.core.instrument.MeterRegistry; -import java.nio.charset.StandardCharsets; import org.junit.jupiter.api.Test; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Qualifier; @@ -12,8 +11,6 @@ import org.springframework.boot.opentelemetry.autoconfigure.logging.otlp.Transpo import org.springframework.boot.test.context.SpringBootTest; import org.springframework.boot.testcontainers.service.connection.ServiceConnection; import org.springframework.boot.webmvc.test.autoconfigure.AutoConfigureMockMvc; -import org.springframework.http.MediaType; -import org.springframework.mock.web.MockHttpSession; import org.springframework.test.web.servlet.MockMvc; import org.testcontainers.grafana.LgtmStackContainer; import org.testcontainers.junit.jupiter.Container; @@ -21,14 +18,10 @@ import org.testcontainers.junit.jupiter.Testcontainers; import org.testcontainers.utility.DockerImageName; import static org.assertj.core.api.Assertions.assertThat; -import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.csrf; import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get; -import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post; -import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.header; -import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.redirectedUrl; import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status; -@SpringBootTest(properties = "iam.ui-preview.enabled=true") +@SpringBootTest @AutoConfigureMockMvc @AutoConfigureMetrics @AutoConfigureTracing @@ -52,61 +45,8 @@ class IamLoginApplicationTests { MockMvc mvc; @Test - void previewHasInlineContextAndNoCache() throws Exception { - var result = mvc.perform(get("/preview")) - .andExpect(status().isOk()) - .andExpect(header().string("Cache-Control", "no-store")) - .andReturn(); - assertThat(result.getResponse().getContentAsString()).contains("login-context", "identity", "_csrf") - .doesNotContain("__IAM_PAGE_CONTEXT__"); - } - - @Test - void previewRejectsMissingCsrf() throws Exception { - mvc.perform(post("/preview/identify").param("name", "测试")) - .andExpect(status().isForbidden()); - } - - @Test - void previewChecksStepsAndEscapesScriptEndTags() throws Exception { - var session = new MockHttpSession(); - mvc.perform(post("/preview/verify") - .session(session).with(csrf()) - .param("code", "123456")) - .andExpect(status().isConflict()); - mvc.perform(post("/preview/identify") - .session(session).with(csrf()) - .param("name", "")) - .andExpect(status().isSeeOther()); - var html = mvc.perform(get("/preview/verify").session(session)) - .andExpect(status().isOk()).andReturn() - .getResponse().getContentAsString(); - assertThat(html).doesNotContain("") - .contains("\\u003c/script\\u003e"); - } - - @Test - void previewRetriesAndCompletesWithoutAuthenticating() throws Exception { - var session = new MockHttpSession(); - mvc.perform(post("/preview/identify") - .session(session).with(csrf()) - .param("name", "测试")) - .andExpect(redirectedUrl("/preview/verify")); - mvc.perform(post("/preview/verify") - .session(session).with(csrf()) - .param("code", "000000")) - .andExpect(redirectedUrl("/preview/verify")); - var retry = mvc.perform(get("/preview/verify").session(session)) - .andReturn().getResponse(); - assertThat(retry.getContentAsString(StandardCharsets.UTF_8)).contains("演示码不正确"); - mvc.perform(post("/preview/verify") - .session(session).with(csrf()) - .param("code", "123456")) - .andExpect(redirectedUrl("/preview/complete")); - mvc.perform(get("/").session(session) - .accept(MediaType.APPLICATION_JSON)) - .andExpect(status().isUnauthorized()); - assertThat(session.getAttribute("SPRING_SECURITY_CONTEXT")).isNull(); + void signInIsDisabledUntilDirectoryIsConfigured() throws Exception { + mvc.perform(get("/signin").secure(true)).andExpect(status().isNotFound()); } @Test diff --git a/src/test/java/top/ddupan/iam/login/ad/AdIntegrationTests.java b/src/test/java/top/ddupan/iam/login/ad/AdIntegrationTests.java deleted file mode 100644 index 419b63f..0000000 --- a/src/test/java/top/ddupan/iam/login/ad/AdIntegrationTests.java +++ /dev/null @@ -1,211 +0,0 @@ -package top.ddupan.iam.login.ad; - -import com.unboundid.ldap.listener.InMemoryDirectoryServer; -import com.unboundid.ldap.listener.InMemoryDirectoryServerConfig; -import com.unboundid.ldap.listener.InMemoryListenerConfig; -import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSimpleBindRequest; -import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult; -import com.unboundid.ldap.sdk.SearchResultReference; -import com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor; -import com.unboundid.ldap.sdk.Entry; -import com.unboundid.ldap.sdk.LDAPException; -import com.unboundid.ldap.sdk.ResultCode; -import com.unboundid.ldap.sdk.SimpleBindRequest; -import java.net.InetAddress; -import java.security.KeyStore; -import java.time.Instant; -import javax.net.ssl.KeyManagerFactory; -import javax.net.ssl.SSLContext; -import javax.net.ssl.TrustManagerFactory; -import org.springframework.aot.hint.RuntimeHints; -import org.springframework.aot.hint.RuntimeHintsRegistrar; -import org.springframework.context.annotation.ImportRuntimeHints; -import org.junit.jupiter.api.AfterAll; -import org.junit.jupiter.api.Test; -import org.springframework.beans.factory.annotation.Autowired; -import org.springframework.boot.test.context.SpringBootTest; -import org.springframework.boot.webmvc.test.autoconfigure.AutoConfigureMockMvc; -import org.springframework.http.MediaType; -import org.springframework.mock.web.MockHttpSession; -import org.springframework.security.authentication.DisabledException; -import org.springframework.security.authentication.LockedException; -import org.springframework.security.authentication.BadCredentialsException; -import org.springframework.security.authentication.CredentialsExpiredException; -import org.springframework.test.context.DynamicPropertyRegistry; -import org.springframework.test.context.DynamicPropertySource; -import org.springframework.test.web.servlet.MockMvc; -import static org.assertj.core.api.Assertions.*; -import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.csrf; -import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.*; -import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.*; - -/** Real LDAPS sockets and Spring's AD provider; AD bind/subcode semantics are simulated. */ -@SpringBootTest(properties = {"iam.ad.enabled=true", "iam.ad.domain=example.test", "iam.ad.base-dn=dc=example,dc=test"}) -@AutoConfigureMockMvc -@ImportRuntimeHints(AdIntegrationTests.FixtureHints.class) -class AdIntegrationTests { - static class FixtureHints implements RuntimeHintsRegistrar { - @Override - public void registerHints(RuntimeHints hints, ClassLoader loader) { - hints.resources().registerPattern("ldap/fixture.p12"); - } - } - - static final String BASE = "dc=example,dc=test"; - static final String USER_DN = "cn=Alice," + BASE; - static final byte[] GUID = java.util.HexFormat.of().parseHex("33221100554477668899aabbccddeeff"); - static class Fixture { - static final SSLContext ORIGINAL; - static final InMemoryDirectoryServer LDAP; - static { - try { - ORIGINAL = SSLContext.getDefault(); - var store = KeyStore.getInstance("PKCS12"); - try (var stream = AdIntegrationTests.class.getResourceAsStream("/ldap/fixture.p12")) { - store.load(stream, "fixture-only".toCharArray()); - } - var keys = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm()); - keys.init(store, "fixture-only".toCharArray()); - var trust = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm()); - trust.init(store); - var ssl = SSLContext.getInstance("TLS"); - ssl.init(keys.getKeyManagers(), trust.getTrustManagers(), null); - SSLContext.setDefault(ssl); - var config = new InMemoryDirectoryServerConfig(BASE); - config.setSchema(null); - config.setListenerConfigs(InMemoryListenerConfig.createLDAPSConfig("ldaps", - InetAddress.getByName("127.0.0.1"), 0, ssl.getServerSocketFactory(), ssl.getSocketFactory())); - config.addInMemoryOperationInterceptor(new InMemoryOperationInterceptor() { - @Override - public void processSearchResult(InMemoryInterceptedSearchResult result) { - try { - // Like Samba AD's DomainDnsZones/ForestDnsZones continuation references. - // A client following this reference would fail instead of returning the user. - result.sendSearchReference(new SearchResultReference( - new String[]{"ldap://127.0.0.1:1/DC=other,DC=test"}, null)); - } catch (LDAPException ex) { throw new IllegalStateException(ex); } - } - - @Override - public void processSimpleBindRequest(InMemoryInterceptedSimpleBindRequest request) throws LDAPException { - String name = request.getRequest().getBindDN(); - String subcode = switch (name) { - case "disabled@example.test" -> "533"; - case "locked@example.test" -> "775"; - case "expired@example.test" -> "532"; - default -> null; - }; - if (subcode != null) throw new LDAPException(ResultCode.INVALID_CREDENTIALS, - "80090308: LdapErr: DSID-0C090334, comment: AcceptSecurityContext error, data " + subcode + ", v1db1"); - if (name.equalsIgnoreCase("alice@example.test")) { - request.setRequest(new SimpleBindRequest(USER_DN, request.getRequest().getPassword().getValue())); - } else if (!name.equals(USER_DN)) { - throw new LDAPException(ResultCode.INVALID_CREDENTIALS, "Invalid credentials"); - } - } - }); - LDAP = new InMemoryDirectoryServer(config); - LDAP.startListening(); - LDAP.add(new Entry(BASE, new com.unboundid.ldap.sdk.Attribute("objectClass", "domain"), - new com.unboundid.ldap.sdk.Attribute("dc", "example"))); - LDAP.add(new Entry(USER_DN, - new com.unboundid.ldap.sdk.Attribute("objectClass", "user"), - new com.unboundid.ldap.sdk.Attribute("cn", "Alice"), - new com.unboundid.ldap.sdk.Attribute("sAMAccountName", "alice"), - new com.unboundid.ldap.sdk.Attribute("userPrincipalName", "alice@example.test"), - new com.unboundid.ldap.sdk.Attribute("userPassword", "fixture-password"), - new com.unboundid.ldap.sdk.Attribute("displayName", "Alice "), - new com.unboundid.ldap.sdk.Attribute("mail", "alice@example.test"), - new com.unboundid.ldap.sdk.Attribute("objectGUID", GUID), - new com.unboundid.ldap.sdk.Attribute("memberOf", "CN=gitea-admins," + BASE, "CN=MixedCase," + BASE))); - } catch (Exception ex) { throw new ExceptionInInitializerError(ex); } - } - - } - - @DynamicPropertySource - static void directory(DynamicPropertyRegistry registry) { - registry.add("iam.ad.url", () -> "ldaps://localhost:" + Fixture.LDAP.getListenPort()); - } - - @AfterAll - static void close() { Fixture.LDAP.shutDown(true); SSLContext.setDefault(Fixture.ORIGINAL); } - - @Autowired AdPasswordVerifier verifier; - @Autowired MockMvc mvc; - - @Test - void passwordReadsGuidAndExactGroupsOverTlsDespitePartitionReferrals() { - var identity = verifier.verify("alice", "fixture-password"); - assertThat(identity.objectGuid()).isEqualTo("00112233-4455-6677-8899-aabbccddeeff"); - assertThat(identity.groups()).containsExactly("MixedCase", "gitea-admins"); - assertThat(identity.groupDns()).containsExactly("CN=MixedCase," + BASE, "CN=gitea-admins," + BASE); - assertThat(verifier.verify("alice@example.test", "fixture-password")).isEqualTo(identity); - } - - @Test - void rejectsPasswordsUnknownUsersAndAdAccountStates() { - assertThatThrownBy(() -> verifier.verify("alice", "wrong")).isInstanceOf(BadCredentialsException.class); - assertThatThrownBy(() -> verifier.verify("alice", "")).isInstanceOf(BadCredentialsException.class); - assertThatThrownBy(() -> verifier.verify("unknown", "fixture-password")).isInstanceOf(BadCredentialsException.class); - assertThatThrownBy(() -> verifier.verify("alice@other.test", "fixture-password")).isInstanceOf(BadCredentialsException.class); - assertThatThrownBy(() -> verifier.verify("disabled", "fixture-password")).isInstanceOf(DisabledException.class); - assertThatThrownBy(() -> verifier.verify("locked", "fixture-password")).isInstanceOf(LockedException.class); - assertThatThrownBy(() -> verifier.verify("expired", "fixture-password")).isInstanceOf(CredentialsExpiredException.class); - } - - @Test - void rejectsWrongTlsHostnameAndPlainLdapConfiguration() { - var wrongName = new AdPasswordVerifier(new AdProperties(true, - "ldaps://127.0.0.1:" + Fixture.LDAP.getListenPort(), "example.test", BASE)); - assertThatThrownBy(() -> wrongName.verify("alice", "fixture-password")) - .hasStackTraceContaining("No subject alternative names matching IP address"); - assertThatThrownBy(() -> new AdPasswordVerifier(new AdProperties(true, - "ldap://localhost:389", "example.test", BASE))).isInstanceOf(IllegalArgumentException.class); - } - - @Test - void browserRequiresHttpsCsrfAndOrderedSteps() throws Exception { - mvc.perform(get("/signin")).andExpect(status().isUpgradeRequired()); - mvc.perform(get("/signin/mfa").secure(true)).andExpect(redirectedUrl("/signin")); - mvc.perform(post("/signin/password").secure(true).param("username", "alice") - .param("password", "fixture-password")).andExpect(status().isForbidden()); - } - - @Test - void successfulPasswordRotatesSessionAndStopsBeforeMfa() throws Exception { - var session = new MockHttpSession(); - mvc.perform(get("/signin").secure(true).session(session)).andExpect(status().isOk()); - String oldId = session.getId(); - mvc.perform(post("/signin/password").secure(true).session(session).with(csrf()) - .param("username", "alice").param("password", "fixture-password")) - .andExpect(redirectedUrl("/signin/mfa")); - assertThat(session.getId()).isNotEqualTo(oldId); - var html = mvc.perform(get("/signin/mfa").secure(true).session(session)) - .andExpect(status().isOk()).andExpect(header().string("Cache-Control", "no-store")) - .andReturn().getResponse().getContentAsString(); - assertThat(html).contains("mfa-pending", "gitea-admins", "\\u003c/script\\u003e") - .doesNotContain("fixture-password", ""), + new com.unboundid.ldap.sdk.Attribute("mail", "alice@example.test"), + new com.unboundid.ldap.sdk.Attribute("objectGUID", GUID), + new com.unboundid.ldap.sdk.Attribute("memberOf", "CN=gitea-admins," + BASE, "CN=MixedCase," + BASE))); + } catch (Exception ex) { throw new ExceptionInInitializerError(ex); } + } + + + public String url() { return "ldaps://localhost:" + ldap.getListenPort(); } + public String mismatchedHostnameUrl() { return "ldaps://127.0.0.1:" + ldap.getListenPort(); } + @Override public void close() { ldap.shutDown(true); SSLContext.setDefault(original); } +} From bccb331d8b97e168678ff2348c6db14a3898989e Mon Sep 17 00:00:00 2001 From: panxiao81 Date: Sun, 27 Sep 2026 17:34:07 +0000 Subject: [PATCH 8/9] =?UTF-8?q?=E5=B0=86=E7=99=BB=E5=BD=95=E8=AE=A4?= =?UTF-8?q?=E8=AF=81=E4=B8=8E=E4=BC=9A=E8=AF=9D=E7=AE=A1=E7=90=86=E4=BA=A4?= =?UTF-8?q?=E8=BF=98=20Spring=20Security?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- AGENTS.md | 5 +- README.md | 19 ++-- docs/ad-login.md | 38 ++++--- .../application/SignInService.java | 50 -------- .../application/VerifyPassword.java | 22 ++++ .../domain/LoginTransaction.java | 56 --------- .../DirectoryAuthenticationProvider.java | 44 +++++++ .../security/DirectoryPrincipal.java | 12 ++ .../interfaces/web/BrowserSignInState.java | 12 -- .../interfaces/web/PageRenderer.java | 2 +- .../web/SignInAvailabilityFilter.java | 35 ++++++ .../interfaces/web/SignInController.java | 106 +++-------------- .../AuthenticationConfiguration.java | 8 +- .../configuration/SecurityConfiguration.java | 55 ++++++++- .../iam/login/IamLoginApplicationTests.java | 3 + .../application/SignInServiceTests.java | 107 ------------------ .../application/VerifyPasswordTests.java | 49 ++++++++ .../domain/LoginTransactionTests.java | 44 ------- .../web/SignInIntegrationTests.java | 80 +++++++++++-- 19 files changed, 347 insertions(+), 400 deletions(-) delete mode 100644 src/main/java/top/ddupan/iam/login/authentication/application/SignInService.java create mode 100644 src/main/java/top/ddupan/iam/login/authentication/application/VerifyPassword.java delete mode 100644 src/main/java/top/ddupan/iam/login/authentication/domain/LoginTransaction.java create mode 100644 src/main/java/top/ddupan/iam/login/authentication/infrastructure/security/DirectoryAuthenticationProvider.java create mode 100644 src/main/java/top/ddupan/iam/login/authentication/infrastructure/security/DirectoryPrincipal.java delete mode 100644 src/main/java/top/ddupan/iam/login/authentication/interfaces/web/BrowserSignInState.java create mode 100644 src/main/java/top/ddupan/iam/login/authentication/interfaces/web/SignInAvailabilityFilter.java delete mode 100644 src/test/java/top/ddupan/iam/login/authentication/application/SignInServiceTests.java create mode 100644 src/test/java/top/ddupan/iam/login/authentication/application/VerifyPasswordTests.java delete mode 100644 src/test/java/top/ddupan/iam/login/authentication/domain/LoginTransactionTests.java diff --git a/AGENTS.md b/AGENTS.md index b27fdf1..66c97b8 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -4,11 +4,12 @@ - 默认中文维护项目文档、commit、issue 和 PR；代码与上游 API 名称保留英文。 - 项目使用 Java 与 Spring；Native 是交付约束，不是可选优化，不引入 Kotlin。 - 日常变更先通过适用的 JVM 测试，不要求每轮执行耗时的 Native 编译与测试；Native 仍为交付目标，在阶段性验收或兼容性风险变化时集中验证。未执行的验证明确报告。 -- 按 DDD 组织 authentication 上下文：领域拥有 User/UserRepository 与认证事务规则，应用层编排，基础设施实现 AD 仓储，Web 仅处理传输与会话；领域和应用层不依赖 Spring/Servlet/LDAP。 +- 按 DDD 组织 authentication 上下文：领域拥有 User/UserRepository，应用层编排目录认证与读取，基础设施实现 AD 仓储与 Security Provider，Web 仅渲染页面；领域和应用层不依赖 Spring/Servlet/LDAP。 - 用户仓储复用本次用户 bind 的连接，不新增只读服务账号；连接限于当前用例，不保留密码或连接在 HTTP session 中。 - 选型演示在真实接入后删除，不将演示入口、状态机、验证码或开关保留为应用功能。 - 只实现当前任务范围。Hydra 负责签发，首轮 AD 负责身份和组，本服务独立于 Ayatori。 -- 不把 LDAP 密码成功当成完整 MFA 成功；所有因素绑定同一主体与认证事务。 +- React 只替换 Spring Security 默认登录 UI；表单认证、SecurityContext、因素状态、会话轮换与退出交给框架，不自建登录状态机。 +- LDAP 密码成功可以建立仅含密码因素的 SecurityContext，但不等于完整 MFA 或 Hydra 授权；受保护操作必须检查所需因素。 - 不提交凭据、MFA secret、生产配置秘密或包含上述内容的测试输出。 - 生产部署配置属于 homelab-infra；本仓库初始化不授权切换现役登录入口。 - 文档区分计划、实现、Native 实测和人类验收，禁止将代码存在当成部署证据。 diff --git a/README.md b/README.md index cb074d6..a278a2c 100644 --- a/README.md +++ b/README.md @@ -75,27 +75,30 @@ JVM、AOT、Native 测试及原生应用 HTTP 检查已通过，实测范围与 当前限界上下文为 `authentication`，使用 DDD 分层，依赖向领域内部收敛： ```text -interfaces/web → application → domain +interfaces/web → infrastructure/security（principal）+ domain +infrastructure/security → application → domain infrastructure/ad → application/port + domain configuration → 装配上述实现 ``` -- `authentication/domain`：`User`、`UserRepository`、`LoginTransaction`；稳定主体、组成员关系、 - 登录步骤与期限属于领域模型，不依赖 Spring、Servlet、LDAP 或持久化注解。 -- `authentication/application`：登录用例，编排密码认证、用户仓储查询与事务推进； +- `authentication/domain`：`User`、`UserRepository`；稳定主体与组成员关系属于领域模型，不依赖 Spring、Servlet、LDAP 或持久化注解。 +- `authentication/application`：`VerifyPassword` 用例，编排密码认证与同连接用户仓储查询； `port` 描述密码认证及其用户仓储会话，不暴露 `DirContext`。 - `authentication/infrastructure/ad`：AD bind、Spring Data LDAP 用户仓储、LDAP 实体与领域映射。 使用同一次用户 bind 的连接，查询结束关闭，不新增服务账号，不保存用户密码。 -- `authentication/interfaces/web`：HTTP、CSRF、会话存取和页面数据转换；不定义认证状态规则。 +- `authentication/infrastructure/security`：Provider 将目录用户转换为仅含密码因素的认证结果。 +- `authentication/interfaces/web`：登录页面与上下文转换；不处理密码 POST、认证会话或退出。 - `configuration`：Spring 组件装配、安全链、静态资源和 Native hints。 - `frontend/src`：入口、页面、表单组件和页面数据契约分别维护，只包含真实登录流程。 -测试分别覆盖领域规则、应用用例、AD 仓储和 Web 行为，LDAP 夹具集中在测试 `support` 包。 +测试覆盖应用用例、AD 仓储和完整 Spring Security 过滤器链，LDAP 夹具集中在测试 `support` 包。 界面采用 React + Vite，Spring 在 HTML 中内联当前步骤上下文，浏览器原生表单 POST， -由服务端决定下一页。不增加前端路由器、模板引擎或 Node 运行服务。 +表单由 Spring Security `formLogin` 处理，框架维护因素、SecurityContext、会话轮换和退出。 +React 只替换默认登录 UI，不增加前端路由器、模板引擎或 Node 运行服务。 ## AD 第一因素接入 真实入口为 `/signin`，默认关闭且要求 HTTPS。密码验证通过后显示 AD 身份与直接所属组， -停在等待 MFA 状态，不建立完整登录身份或接受 Hydra challenge。 +保存仅含 `FACTOR_PASSWORD` 的认证结果，停在等待 MFA 状态。待 MFA 页要求十分钟内的密码因素； +其他应用入口暂时全部拒绝，不能凭密码因素接受 Hydra challenge。监控 Basic 认证使用独立无状态安全链。 配置、组语义、HTTPS 与验收边界见 [AD 接入](docs/ad-login.md)。 diff --git a/docs/ad-login.md b/docs/ad-login.md index 37771f9..21e1327 100644 --- a/docs/ad-login.md +++ b/docs/ad-login.md @@ -4,14 +4,15 @@ 随后由 Spring Data LDAP 仓储复用这条已认证连接查询用户与组。 不使用额外目录服务账号，不写入 AD，不复制 Authelia 的绑定密码。 -领域仓储接口为 `UserRepository`，`User` 与 `LoginTransaction` 为领域模型。应用层以 +领域仓储接口为 `UserRepository`，`User` 为领域模型。`VerifyPassword` 应用用例以 try-with-resources 管理已认证用户仓储会话；基础设施的 `AdUserRepository` 通过 `SimpleLdapRepository`、`LdapTemplate`、ODM 实现读取与转换，关闭后不可继续查询。 `AdUserEntry` 的 LDAP 注解不会进入领域对象。 成功后重定向到 `/signin/mfa`，显示目录账号、objectGUID、邮箱、直接所属组及组 DN。 -**这是密码因素验收页面，MFA 尚未接入，不是完整登录成功。** 不创建 Spring Security -认证上下文，不调用 Hydra，不替换现役 Go/Authelia/Gitea 登录链路。 +**这是密码因素验收页面，MFA 尚未接入，不是完整登录成功。** Spring Security 保存 +仅含 `FACTOR_PASSWORD` 的认证结果；其余应用请求使用 `denyAll`，不调用 Hydra， +不替换现役 Go/Authelia/Gitea 登录链路。 ## 目录和组语义 @@ -82,13 +83,20 @@ AD 根范围查询可能返回 DomainDnsZones/ForestDnsZones 等分区 referral ## 状态与操作 -原生表单 POST 带 Spring CSRF token；服务端决定下一页。密码成功后轮换 session ID， -只保存目录身份快照和十分钟期限，不保存密码；重启或“退出并重新验证”清除事务。 -页面禁止缓存，内联 JSON 转义 HTML 结束标记。失败页面不披露目录内部异常。 +React 只渲染登录页面与待 MFA 页面，原生表单 POST 由 Spring Security `formLogin` +接收。`DirectoryAuthenticationProvider` 调用目录用例并返回不含密码的 principal 和 +带签发时间的 `FACTOR_PASSWORD`；目录组只保留在身份快照中，不映射为本服务权限。 +框架负责 CSRF、成功/失败跳转、SecurityContext 持久化、session ID 轮换以及 POST logout。 +`/signin/restart` 是框架 logout 地址；不再维护 LoginTransaction 或另一份浏览器认证状态。 -当前每个 session 只保留一份事务，多标签页会共享状态。两秒提交间隔仅用于同事务的 -重复提交，不是账号/IP 限流；此 PoC 仅供受控 LAN/Tailscale 验收，生产发布前仍需完善 -入口限流、审计、MFA、Hydra 事务和恢复策略。 +待 MFA 页通过框架的 `validDuration` 要求密码因素在十分钟内完成，过期后需要重新认证。 +这不是完整登录会话的过期策略。MFA 与 Hydra 尚未实现，其余应用入口当前拒绝所有访问。 +`/actuator/**` 使用独立无状态 Basic 安全链，人类密码因素不能用于读取监控端点， +监控账号也不能借 Basic 进入人类登录流程。 + +移除原来事务内的两秒提交间隔；它不是有效的账号/IP 限流。此 PoC 仍仅供受控 +LAN/Tailscale 验收，生产发布前需完善入口限流、审计、MFA、Hydra challenge 和恢复策略。 +页面禁止缓存，内联 JSON 转义 HTML 结束标记。错误页面只显示统一消息。 基础存活检查使用 `/actuator/health/liveness`。Boot 自动配置的 LDAP 健康项并未连接这里 按用户 bind 创建的仓储连接，不能把该项当作此认证路径的可用性验证。 @@ -96,18 +104,18 @@ AD 根范围查询可能返回 DomainDnsZones/ForestDnsZones 等分区 referral ## 本轮验证边界 隔离测试使用真实 TLS、LDAP bind 和搜索，校验正确/错误密码、未知账号、AD 账号状态 -子码、GUID 字节序、组名、错误 TLS 主机名、CSRF、HTTPS、会话轮换、超时和密码成功后 -仍未完整认证。UnboundID 的 UPN bind 与 AD 子码由测试拦截器模拟，不能替代 Samba AD。 +子码、GUID 字节序、组名、错误 TLS 主机名、CSRF、HTTPS、会话轮换、因素过期和密码成功后 +仍不能访问受保护应用入口。UnboundID 的 UPN bind 与 AD 子码由测试拦截器模拟，不能替代 Samba AD。 测试证书、私钥与账号全为虚构夹具，不用于实际部署。 -2026-09-25：DDD/Spring Data LDAP 版本通过 20 项 JVM 测试和 `bootJar` 构建， -包含同一次 bind 连接完成仓储查询、用例结束关闭连接、领域规则及监控集成。 -开发 HTTPS 实例已更新为该版本。此前 JVM 使用受信 CA 完成 Samba AD RootDSE 查询。 +2026-09-27：Spring Security 重构通过 18 项 JVM 测试和 `bootJar` 构建，覆盖 +密码因素的保存与有效期、会话轮换、退出、未完成 MFA 的访问限制，以及监控安全链隔离。 +此前 JVM 使用受信 CA 完成 Samba AD RootDSE 查询。 浏览器已检查登录表单渲染、真实 CSRF 原生 POST 和失败后清空密码；只使用在访问 AD 前 即拒绝的合成外域用户名，不尝试猜测人类密码。浏览器回归共 1 项通过，包含移动端布局。 复现：`IAM_AD_URL=https://验收域名:端口 npm --prefix frontend run test:browser -- ad-login.spec.ts`。 重构前，维护者已在 HTTPS 页面完成真实密码验证，成功到达待 MFA 页面，并反馈目录标识、邮箱与 六个直接所属组的查询结果。该验收覆盖 Samba AD 第一因素与属性读取，不表示 MFA、 -嵌套组/主组等价性或 Hydra 登录已完成。Spring Data LDAP 重构后的真实人类复验仍待反馈。 +嵌套组/主组等价性或 Hydra 登录已完成。Spring Security 重构后的真实人类复验仍待反馈。 不在聊天、命令行或日志中传递人类密码。 新增 AD 路径尚未进行 Native 测试，不能复用旧 UI 原型的 Native 结论。 diff --git a/src/main/java/top/ddupan/iam/login/authentication/application/SignInService.java b/src/main/java/top/ddupan/iam/login/authentication/application/SignInService.java deleted file mode 100644 index c3985e6..0000000 --- a/src/main/java/top/ddupan/iam/login/authentication/application/SignInService.java +++ /dev/null @@ -1,50 +0,0 @@ -package top.ddupan.iam.login.authentication.application; - -import java.time.Clock; -import java.util.UUID; -import top.ddupan.iam.login.authentication.application.port.PasswordAuthenticator; -import top.ddupan.iam.login.authentication.domain.UserRepository; -import top.ddupan.iam.login.authentication.application.port.PasswordVerificationException; -import top.ddupan.iam.login.authentication.domain.LoginTransaction; - -/** Coordinates the first-factor use case. HTTP/session/LDAP details stay in adapters. */ -public final class SignInService { - public enum PasswordResult { ACCEPTED, REJECTED, EXPIRED, WRONG_STEP, RETRY_LATER } - private final PasswordAuthenticator authenticator; - private final Clock clock; - private final boolean enabled; - - public SignInService(PasswordAuthenticator authenticator, Clock clock, boolean enabled) { - this.authenticator = authenticator; - this.clock = clock; - this.enabled = enabled; - } - - public boolean enabled() { return enabled; } - public LoginTransaction start() { return LoginTransaction.start(UUID.randomUUID(), clock.instant()); } - public boolean expired(LoginTransaction transaction) { return transaction.expiredAt(clock.instant()); } - - public PasswordResult submitPassword(LoginTransaction transaction, String username, String password) { - if (!enabled) throw new IllegalStateException("Human sign-in is disabled"); - var attempt = transaction.beginPasswordAttempt(clock.instant()); - if (attempt != LoginTransaction.Attempt.ALLOWED) { - return switch (attempt) { - case EXPIRED -> PasswordResult.EXPIRED; - case WRONG_STEP -> PasswordResult.WRONG_STEP; - case RETRY_LATER -> PasswordResult.RETRY_LATER; - case ALLOWED -> throw new IllegalStateException("Unexpected attempt result"); - }; - } - try (var session = authenticator.authenticate(username, password)) { - var identity = session.users().findByLoginName(session.loginName()); - if (identity.isEmpty()) return PasswordResult.REJECTED; - // A slow directory response must not revive an expired transaction. - var verifiedAt = clock.instant(); - if (transaction.expiredAt(verifiedAt)) return PasswordResult.EXPIRED; - transaction.passwordVerified(identity.orElseThrow(), verifiedAt); - return PasswordResult.ACCEPTED; - } catch (PasswordVerificationException | UserRepository.AccessFailure ex) { - return PasswordResult.REJECTED; - } - } -} diff --git a/src/main/java/top/ddupan/iam/login/authentication/application/VerifyPassword.java b/src/main/java/top/ddupan/iam/login/authentication/application/VerifyPassword.java new file mode 100644 index 0000000..c4363fa --- /dev/null +++ b/src/main/java/top/ddupan/iam/login/authentication/application/VerifyPassword.java @@ -0,0 +1,22 @@ +package top.ddupan.iam.login.authentication.application; + +import top.ddupan.iam.login.authentication.application.port.PasswordAuthenticator; +import top.ddupan.iam.login.authentication.application.port.PasswordVerificationException; +import top.ddupan.iam.login.authentication.application.port.PasswordVerificationException.Reason; +import top.ddupan.iam.login.authentication.domain.User; + +/** Resolves the user through the same authenticated directory connection. */ +public final class VerifyPassword { + private final PasswordAuthenticator authenticator; + + public VerifyPassword(PasswordAuthenticator authenticator) { + this.authenticator = authenticator; + } + + public User verify(String username, String password) { + try (var session = authenticator.authenticate(username, password)) { + return session.users().findByLoginName(session.loginName()) + .orElseThrow(() -> new PasswordVerificationException(Reason.REJECTED)); + } + } +} diff --git a/src/main/java/top/ddupan/iam/login/authentication/domain/LoginTransaction.java b/src/main/java/top/ddupan/iam/login/authentication/domain/LoginTransaction.java deleted file mode 100644 index 5048b81..0000000 --- a/src/main/java/top/ddupan/iam/login/authentication/domain/LoginTransaction.java +++ /dev/null @@ -1,56 +0,0 @@ -package top.ddupan.iam.login.authentication.domain; - -import java.time.Duration; -import java.time.Instant; -import java.util.Objects; -import java.util.UUID; - -/** Owns first-factor ordering, lifetime and the identity to which further factors must bind. */ -public final class LoginTransaction { - private static final Duration LIFETIME = Duration.ofMinutes(10); - private static final Duration ATTEMPT_INTERVAL = Duration.ofSeconds(2); - - public enum Step { PASSWORD_REQUIRED, MFA_REQUIRED } - public enum Attempt { ALLOWED, EXPIRED, WRONG_STEP, RETRY_LATER } - - private final UUID id; - private Step step = Step.PASSWORD_REQUIRED; - private Instant expiresAt; - private Instant retryAfter = Instant.MIN; - private User identity; - - private LoginTransaction(UUID id, Instant now) { - this.id = Objects.requireNonNull(id); - this.expiresAt = now.plus(LIFETIME); - } - - public static LoginTransaction start(UUID id, Instant now) { - return new LoginTransaction(id, now); - } - - public Attempt beginPasswordAttempt(Instant now) { - if (expiredAt(now)) return Attempt.EXPIRED; - if (step != Step.PASSWORD_REQUIRED) return Attempt.WRONG_STEP; - if (now.isBefore(retryAfter)) return Attempt.RETRY_LATER; - retryAfter = now.plus(ATTEMPT_INTERVAL); - return Attempt.ALLOWED; - } - - public void passwordVerified(User identity, Instant now) { - if (expiredAt(now) || step != Step.PASSWORD_REQUIRED) { - throw new IllegalStateException("Password verification is not allowed in this transaction state"); - } - this.identity = Objects.requireNonNull(identity); - this.step = Step.MFA_REQUIRED; - this.expiresAt = now.plus(LIFETIME); - } - - public UUID id() { return id; } - public Step step() { return step; } - public boolean expiredAt(Instant now) { return !now.isBefore(expiresAt); } - - public User identity() { - if (identity == null) throw new IllegalStateException("No verified identity yet"); - return identity; - } -} diff --git a/src/main/java/top/ddupan/iam/login/authentication/infrastructure/security/DirectoryAuthenticationProvider.java b/src/main/java/top/ddupan/iam/login/authentication/infrastructure/security/DirectoryAuthenticationProvider.java new file mode 100644 index 0000000..e177365 --- /dev/null +++ b/src/main/java/top/ddupan/iam/login/authentication/infrastructure/security/DirectoryAuthenticationProvider.java @@ -0,0 +1,44 @@ +package top.ddupan.iam.login.authentication.infrastructure.security; + +import java.util.List; +import org.springframework.security.authentication.AuthenticationProvider; +import org.springframework.security.authentication.BadCredentialsException; +import org.springframework.security.authentication.InternalAuthenticationServiceException; +import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; +import org.springframework.security.core.Authentication; +import org.springframework.security.core.authority.FactorGrantedAuthority; +import top.ddupan.iam.login.authentication.application.VerifyPassword; +import top.ddupan.iam.login.authentication.application.port.PasswordVerificationException; +import top.ddupan.iam.login.authentication.domain.UserRepository; + +/** Bridges directory authentication into Spring Security's form-login lifecycle. */ +public final class DirectoryAuthenticationProvider implements AuthenticationProvider { + private final VerifyPassword passwords; + + public DirectoryAuthenticationProvider(VerifyPassword passwords) { + this.passwords = passwords; + } + + @Override + public Authentication authenticate(Authentication request) { + try { + var user = passwords.verify(request.getName(), + request.getCredentials() instanceof String password ? password : null); + // Directory groups remain profile data, not local application authorities. + return UsernamePasswordAuthenticationToken.authenticated(new DirectoryPrincipal(user), null, + List.of(FactorGrantedAuthority.fromAuthority(FactorGrantedAuthority.PASSWORD_AUTHORITY))); + } catch (PasswordVerificationException ex) { + if (ex.reason() == PasswordVerificationException.Reason.UNAVAILABLE) { + throw new InternalAuthenticationServiceException("Directory unavailable"); + } + throw new BadCredentialsException("Unable to verify credentials"); + } catch (UserRepository.AccessFailure ex) { + throw new InternalAuthenticationServiceException("Directory unavailable"); + } + } + + @Override + public boolean supports(Class authentication) { + return UsernamePasswordAuthenticationToken.class.equals(authentication); + } +} diff --git a/src/main/java/top/ddupan/iam/login/authentication/infrastructure/security/DirectoryPrincipal.java b/src/main/java/top/ddupan/iam/login/authentication/infrastructure/security/DirectoryPrincipal.java new file mode 100644 index 0000000..01e1ee4 --- /dev/null +++ b/src/main/java/top/ddupan/iam/login/authentication/infrastructure/security/DirectoryPrincipal.java @@ -0,0 +1,12 @@ +package top.ddupan.iam.login.authentication.infrastructure.security; + +import org.springframework.security.core.AuthenticatedPrincipal; +import top.ddupan.iam.login.authentication.domain.User; + +/** An immutable directory snapshot; never contains credentials or connections. */ +public record DirectoryPrincipal(User user) implements AuthenticatedPrincipal { + @Override + public String getName() { + return user.id().authority() + ":" + user.id().value(); + } +} diff --git a/src/main/java/top/ddupan/iam/login/authentication/interfaces/web/BrowserSignInState.java b/src/main/java/top/ddupan/iam/login/authentication/interfaces/web/BrowserSignInState.java deleted file mode 100644 index 49ea262..0000000 --- a/src/main/java/top/ddupan/iam/login/authentication/interfaces/web/BrowserSignInState.java +++ /dev/null @@ -1,12 +0,0 @@ -package top.ddupan.iam.login.authentication.interfaces.web; - -import top.ddupan.iam.login.authentication.domain.LoginTransaction; - -/** HTTP-session storage plus presentation feedback. Authentication rules live in the aggregate. */ -final class BrowserSignInState { - final LoginTransaction transaction; - String username = ""; - String error = ""; - - BrowserSignInState(LoginTransaction transaction) { this.transaction = transaction; } -} diff --git a/src/main/java/top/ddupan/iam/login/authentication/interfaces/web/PageRenderer.java b/src/main/java/top/ddupan/iam/login/authentication/interfaces/web/PageRenderer.java index e738fd6..d057063 100644 --- a/src/main/java/top/ddupan/iam/login/authentication/interfaces/web/PageRenderer.java +++ b/src/main/java/top/ddupan/iam/login/authentication/interfaces/web/PageRenderer.java @@ -27,6 +27,6 @@ public class PageRenderer { .replace(">", "\\u003e").replace("&", "\\u0026") .replace("\u2028", "\\u2028").replace("\u2029", "\\u2029"); return ResponseEntity.ok().header("Cache-Control", "no-store") - .contentType(MediaType.TEXT_HTML).body(shell.replace(SLOT, safe)); + .contentType(new MediaType(MediaType.TEXT_HTML, StandardCharsets.UTF_8)).body(shell.replace(SLOT, safe)); } } diff --git a/src/main/java/top/ddupan/iam/login/authentication/interfaces/web/SignInAvailabilityFilter.java b/src/main/java/top/ddupan/iam/login/authentication/interfaces/web/SignInAvailabilityFilter.java new file mode 100644 index 0000000..9dd8b64 --- /dev/null +++ b/src/main/java/top/ddupan/iam/login/authentication/interfaces/web/SignInAvailabilityFilter.java @@ -0,0 +1,35 @@ +package top.ddupan.iam.login.authentication.interfaces.web; + +import java.io.IOException; +import jakarta.servlet.FilterChain; +import jakarta.servlet.ServletException; +import jakarta.servlet.http.HttpServletRequest; +import jakarta.servlet.http.HttpServletResponse; +import org.springframework.web.filter.OncePerRequestFilter; + +/** Rejects disabled or plaintext sign-in before any credentials reach authentication. */ +public final class SignInAvailabilityFilter extends OncePerRequestFilter { + private final boolean enabled; + + public SignInAvailabilityFilter(boolean enabled) { + this.enabled = enabled; + } + + @Override + protected boolean shouldNotFilter(HttpServletRequest request) { + String path = request.getServletPath(); + if (path.isEmpty()) path = request.getRequestURI().substring(request.getContextPath().length()); + return !path.equals("/signin") && !path.startsWith("/signin/"); + } + + @Override + protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, + FilterChain chain) throws ServletException, IOException { + if (!enabled || !request.isSecure()) { + response.setHeader("Cache-Control", "no-store"); + response.setStatus(enabled ? 426 : 404); + return; + } + chain.doFilter(request, response); + } +} diff --git a/src/main/java/top/ddupan/iam/login/authentication/interfaces/web/SignInController.java b/src/main/java/top/ddupan/iam/login/authentication/interfaces/web/SignInController.java index 576f7ee..5a8b411 100644 --- a/src/main/java/top/ddupan/iam/login/authentication/interfaces/web/SignInController.java +++ b/src/main/java/top/ddupan/iam/login/authentication/interfaces/web/SignInController.java @@ -1,118 +1,44 @@ package top.ddupan.iam.login.authentication.interfaces.web; -import jakarta.servlet.http.HttpServletRequest; -import jakarta.servlet.http.HttpSession; import java.util.Map; -import org.springframework.http.HttpStatus; import org.springframework.http.MediaType; import org.springframework.http.ResponseEntity; +import org.springframework.security.core.annotation.AuthenticationPrincipal; import org.springframework.security.web.csrf.CsrfToken; import org.springframework.web.bind.annotation.GetMapping; -import org.springframework.web.bind.annotation.PostMapping; import org.springframework.web.bind.annotation.RequestParam; import org.springframework.web.bind.annotation.RestController; -import org.springframework.web.server.ResponseStatusException; -import top.ddupan.iam.login.authentication.application.SignInService; -import top.ddupan.iam.login.authentication.domain.LoginTransaction.Step; import top.ddupan.iam.login.authentication.domain.User.GroupMembership; +import top.ddupan.iam.login.authentication.infrastructure.security.DirectoryPrincipal; -/** Translates browser requests and use-case outcomes; no directory or authentication policy here. */ +/** Renders Spring Security's login pages; form processing belongs to the security filters. */ @RestController public class SignInController { - static final String STATE = SignInController.class.getName() + ".state"; - private final SignInService signIn; private final PageRenderer renderer; - public SignInController(SignInService signIn, PageRenderer renderer) { - this.signIn = signIn; + public SignInController(PageRenderer renderer) { this.renderer = renderer; } @GetMapping(value = "/signin", produces = MediaType.TEXT_HTML_VALUE) - ResponseEntity page(HttpServletRequest request, CsrfToken csrf) { - requireAvailable(request); - var session = request.getSession(); - synchronized (session) { - var state = state(session); - if (state.transaction.step() == Step.MFA_REQUIRED) return redirect("/signin/mfa"); - return renderer.render(Map.of("step", "password", "name", state.username, - "error", state.error, "action", "/signin/password", "csrf", csrf(csrf))); - } - } - - @PostMapping("/signin/password") - ResponseEntity password(HttpServletRequest request, - @RequestParam(defaultValue = "") String username, - @RequestParam(defaultValue = "") String password) { - requireAvailable(request); - var session = request.getSession(false); - if (session == null) throw new ResponseStatusException(HttpStatus.CONFLICT); - synchronized (session) { - var state = (BrowserSignInState) session.getAttribute(STATE); - if (state == null) return redirect("/signin"); - state.username = username.length() <= 256 ? username : ""; - return switch (signIn.submitPassword(state.transaction, username, password)) { - case ACCEPTED -> { - request.changeSessionId(); - state.error = ""; - yield redirect("/signin/mfa"); - } - case REJECTED -> { - state.error = "无法验证账号，请检查凭据与账号状态，或稍后重试。"; - yield redirect("/signin"); - } - case EXPIRED, WRONG_STEP -> redirect("/signin"); - case RETRY_LATER -> throw new ResponseStatusException(HttpStatus.TOO_MANY_REQUESTS); - }; - } + ResponseEntity page(@RequestParam(required = false) String error, CsrfToken csrf) { + return renderer.render(Map.of("step", "password", "name", "", + "error", error == null ? "" : "无法验证账号，请检查凭据与账号状态，或稍后重试。", + "action", "/signin/password", "csrf", csrf(csrf))); } @GetMapping(value = "/signin/mfa", produces = MediaType.TEXT_HTML_VALUE) - ResponseEntity pending(HttpServletRequest request, CsrfToken csrf) { - requireAvailable(request); - var session = request.getSession(false); - if (session == null) return redirect("/signin"); - synchronized (session) { - var state = state(session); - if (state.transaction.step() != Step.MFA_REQUIRED) return redirect("/signin"); - var user = state.transaction.identity(); - return renderer.render(Map.of("step", "mfa-pending", "name", user.displayName(), - "error", "", "action", "/signin/restart", "csrf", csrf(csrf), - "identity", Map.of("username", user.username(), "subjectId", user.id().value(), - "email", user.email(), - "groups", user.memberships().stream().map(GroupMembership::name).toList(), - "groupDns", user.memberships().stream().map(GroupMembership::externalId).toList()))); - } - } - - @PostMapping("/signin/restart") - ResponseEntity restart(HttpServletRequest request) { - requireAvailable(request); - var session = request.getSession(false); - if (session != null) session.invalidate(); - return redirect("/signin"); - } - - private void requireAvailable(HttpServletRequest request) { - if (!signIn.enabled()) throw new ResponseStatusException(HttpStatus.NOT_FOUND); - if (!request.isSecure()) throw new ResponseStatusException(HttpStatus.UPGRADE_REQUIRED, "HTTPS required"); - } - - private BrowserSignInState state(HttpSession session) { - var state = (BrowserSignInState) session.getAttribute(STATE); - if (state == null || signIn.expired(state.transaction)) { - state = new BrowserSignInState(signIn.start()); - session.setAttribute(STATE, state); - } - return state; + ResponseEntity pending(@AuthenticationPrincipal DirectoryPrincipal principal, CsrfToken csrf) { + var user = principal.user(); + return renderer.render(Map.of("step", "mfa-pending", "name", user.displayName(), + "error", "", "action", "/signin/restart", "csrf", csrf(csrf), + "identity", Map.of("username", user.username(), "subjectId", user.id().value(), + "email", user.email(), + "groups", user.memberships().stream().map(GroupMembership::name).toList(), + "groupDns", user.memberships().stream().map(GroupMembership::externalId).toList()))); } private static Map csrf(CsrfToken token) { return Map.of("name", token.getParameterName(), "value", token.getToken()); } - - private static ResponseEntity redirect(String location) { - return ResponseEntity.status(HttpStatus.SEE_OTHER).header("Location", location) - .header("Cache-Control", "no-store").build(); - } } diff --git a/src/main/java/top/ddupan/iam/login/configuration/AuthenticationConfiguration.java b/src/main/java/top/ddupan/iam/login/configuration/AuthenticationConfiguration.java index a4369ad..0c432d2 100644 --- a/src/main/java/top/ddupan/iam/login/configuration/AuthenticationConfiguration.java +++ b/src/main/java/top/ddupan/iam/login/configuration/AuthenticationConfiguration.java @@ -1,6 +1,5 @@ package top.ddupan.iam.login.configuration; -import java.time.Clock; import javax.naming.directory.DirContext; import javax.naming.ldap.LdapContext; import org.springframework.aot.hint.RuntimeHints; @@ -11,9 +10,8 @@ import org.springframework.ldap.core.DirContextProxy; import top.ddupan.iam.login.authentication.infrastructure.ad.AdUserEntry; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; -import top.ddupan.iam.login.authentication.application.SignInService; +import top.ddupan.iam.login.authentication.application.VerifyPassword; import top.ddupan.iam.login.authentication.application.port.PasswordAuthenticator; -import top.ddupan.iam.login.authentication.infrastructure.ad.AdProperties; /** Composition root: dependencies point inward, framework wiring stays outside the model. */ @Configuration(proxyBeanMethods = false) @@ -21,8 +19,8 @@ import top.ddupan.iam.login.authentication.infrastructure.ad.AdProperties; @ImportRuntimeHints(AuthenticationConfiguration.DirectoryHints.class) class AuthenticationConfiguration { @Bean - SignInService signInService(PasswordAuthenticator authenticator, AdProperties properties) { - return new SignInService(authenticator, Clock.systemUTC(), properties.enabled()); + VerifyPassword verifyPassword(PasswordAuthenticator authenticator) { + return new VerifyPassword(authenticator); } static class DirectoryHints implements RuntimeHintsRegistrar { @Override diff --git a/src/main/java/top/ddupan/iam/login/configuration/SecurityConfiguration.java b/src/main/java/top/ddupan/iam/login/configuration/SecurityConfiguration.java index 7375039..48d4241 100644 --- a/src/main/java/top/ddupan/iam/login/configuration/SecurityConfiguration.java +++ b/src/main/java/top/ddupan/iam/login/configuration/SecurityConfiguration.java @@ -1,19 +1,68 @@ package top.ddupan.iam.login.configuration; +import java.time.Duration; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; +import org.springframework.core.annotation.Order; +import org.springframework.http.HttpStatus; +import org.springframework.security.authentication.ProviderManager; +import org.springframework.security.authorization.AuthorizationManagerFactories; import org.springframework.security.config.Customizer; import org.springframework.security.config.annotation.web.builders.HttpSecurity; +import org.springframework.security.config.annotation.authorization.EnableMultiFactorAuthentication; import org.springframework.security.web.SecurityFilterChain; +import org.springframework.security.web.access.intercept.RequestAuthorizationContext; +import org.springframework.security.web.authentication.HttpStatusEntryPoint; +import org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint; +import org.springframework.security.web.csrf.CsrfFilter; +import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher; +import top.ddupan.iam.login.authentication.application.VerifyPassword; +import top.ddupan.iam.login.authentication.infrastructure.ad.AdProperties; +import top.ddupan.iam.login.authentication.infrastructure.security.DirectoryAuthenticationProvider; +import top.ddupan.iam.login.authentication.interfaces.web.SignInAvailabilityFilter; @Configuration(proxyBeanMethods = false) +@EnableMultiFactorAuthentication(authorities = {}) class SecurityConfiguration { + // Operational Basic authentication is isolated from human first-factor authentication. @Bean - SecurityFilterChain security(HttpSecurity http) throws Exception { - return http.authorizeHttpRequests(auth -> auth - .requestMatchers("/error", "/signin", "/signin/**", "/assets/**", "/actuator/health/**").permitAll() + @Order(1) + SecurityFilterChain management(HttpSecurity http) throws Exception { + return http.securityMatcher("/actuator/**") + .authorizeHttpRequests(auth -> auth + .requestMatchers("/actuator/health/**").permitAll() .anyRequest().authenticated()) + .securityContext(context -> context.securityContextRepository( + new org.springframework.security.web.context.NullSecurityContextRepository())) + .sessionManagement(session -> session.sessionCreationPolicy( + org.springframework.security.config.http.SessionCreationPolicy.STATELESS)) .httpBasic(Customizer.withDefaults()) + .build(); + } + + @Bean + @Order(2) + SecurityFilterChain browser(HttpSecurity http, VerifyPassword passwords, AdProperties ad) throws Exception { + var passwordFactor = AuthorizationManagerFactories.multiFactor() + .requireFactor(factor -> factor.passwordAuthority().validDuration(Duration.ofMinutes(10))) + .build(); + return http + .authenticationManager(new ProviderManager(new DirectoryAuthenticationProvider(passwords))) + .addFilterBefore(new SignInAvailabilityFilter(ad.enabled()), CsrfFilter.class) + .authorizeHttpRequests(auth -> auth + .requestMatchers("/error", "/signin", "/signin/password", "/assets/**").permitAll() + .requestMatchers("/signin/mfa").access(passwordFactor.authenticated()) + // No complete MFA or Hydra acceptance exists yet. Fail closed until those are implemented. + .anyRequest().denyAll()) + .formLogin(form -> form.loginPage("/signin").loginProcessingUrl("/signin/password") + .defaultSuccessUrl("/signin/mfa", true).failureUrl("/signin?error")) + .logout(logout -> logout.logoutUrl("/signin/restart").logoutSuccessUrl("/signin")) + .exceptionHandling(exceptions -> exceptions + .defaultAuthenticationEntryPointFor(new LoginUrlAuthenticationEntryPoint("/signin"), + PathPatternRequestMatcher.withDefaults().matcher("/signin/**")) + .defaultAuthenticationEntryPointFor(new HttpStatusEntryPoint(HttpStatus.UNAUTHORIZED), + org.springframework.security.web.util.matcher.AnyRequestMatcher.INSTANCE)) + .requestCache(cache -> cache.disable()) .headers(headers -> headers.contentSecurityPolicy(csp -> csp.policyDirectives( "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; " + "object-src 'none'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'"))) diff --git a/src/test/java/top/ddupan/iam/login/IamLoginApplicationTests.java b/src/test/java/top/ddupan/iam/login/IamLoginApplicationTests.java index d97fc0e..fa16d00 100644 --- a/src/test/java/top/ddupan/iam/login/IamLoginApplicationTests.java +++ b/src/test/java/top/ddupan/iam/login/IamLoginApplicationTests.java @@ -47,6 +47,9 @@ class IamLoginApplicationTests { @Test void signInIsDisabledUntilDirectoryIsConfigured() throws Exception { mvc.perform(get("/signin").secure(true)).andExpect(status().isNotFound()); + mvc.perform(org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post("/signin/password") + .secure(true).with(org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.csrf())) + .andExpect(status().isNotFound()); } @Test diff --git a/src/test/java/top/ddupan/iam/login/authentication/application/SignInServiceTests.java b/src/test/java/top/ddupan/iam/login/authentication/application/SignInServiceTests.java deleted file mode 100644 index fe58d75..0000000 --- a/src/test/java/top/ddupan/iam/login/authentication/application/SignInServiceTests.java +++ /dev/null @@ -1,107 +0,0 @@ -package top.ddupan.iam.login.authentication.application; - -import java.time.Clock; -import java.time.Instant; -import java.time.ZoneId; -import java.time.ZoneOffset; -import java.util.List; -import java.util.Optional; -import java.util.concurrent.atomic.AtomicInteger; -import org.junit.jupiter.api.Test; -import top.ddupan.iam.login.authentication.application.port.AuthenticatedUserSession; -import top.ddupan.iam.login.authentication.application.port.PasswordVerificationException; -import top.ddupan.iam.login.authentication.domain.LoginTransaction; -import top.ddupan.iam.login.authentication.domain.User; -import top.ddupan.iam.login.authentication.domain.UserRepository; -import static org.assertj.core.api.Assertions.*; - -class SignInServiceTests { - static final User ALICE = new User(new User.UserId("directory", "alice-id"), "alice", "Alice", "", List.of()); - - @Test - void verifiesPasswordThenReadsTheBoundUserAndClosesTheRepositoryScope() { - var scope = new Scope(name -> { - assertThat(name).isEqualTo("alice@directory"); - return Optional.of(ALICE); - }); - var service = new SignInService((username, password) -> scope, new TestClock(), true); - var transaction = service.start(); - assertThat(service.submitPassword(transaction, "alice", "secret")).isEqualTo(SignInService.PasswordResult.ACCEPTED); - assertThat(scope.closed).isTrue(); - assertThat(transaction.step()).isEqualTo(LoginTransaction.Step.MFA_REQUIRED); - assertThat(transaction.identity()).isEqualTo(ALICE); - } - - @Test - void failedAuthenticationDoesNotAdvanceTheTransaction() { - var service = new SignInService((username, password) -> { - throw new PasswordVerificationException(PasswordVerificationException.Reason.REJECTED); - }, new TestClock(), true); - var transaction = service.start(); - assertThat(service.submitPassword(transaction, "alice", "wrong")).isEqualTo(SignInService.PasswordResult.REJECTED); - assertThat(transaction.step()).isEqualTo(LoginTransaction.Step.PASSWORD_REQUIRED); - } - - @Test - void missingUserDoesNotAuthenticateAndStillClosesTheScope() { - var scope = new Scope(name -> Optional.empty()); - var service = new SignInService((username, password) -> scope, new TestClock(), true); - var transaction = service.start(); - assertThat(service.submitPassword(transaction, "alice", "secret")).isEqualTo(SignInService.PasswordResult.REJECTED); - assertThat(scope.closed).isTrue(); - assertThat(transaction.step()).isEqualTo(LoginTransaction.Step.PASSWORD_REQUIRED); - } - - @Test - void expiredAndRepeatedAttemptsDoNotCallTheDirectory() { - var calls = new AtomicInteger(); - var clock = new TestClock(); - var service = new SignInService((username, password) -> { - calls.incrementAndGet(); - throw new PasswordVerificationException(PasswordVerificationException.Reason.REJECTED); - }, clock, true); - var transaction = service.start(); - service.submitPassword(transaction, "alice", "wrong"); - assertThat(service.submitPassword(transaction, "alice", "wrong")).isEqualTo(SignInService.PasswordResult.RETRY_LATER); - clock.now = clock.now.plusSeconds(600); - assertThat(service.submitPassword(transaction, "alice", "wrong")).isEqualTo(SignInService.PasswordResult.EXPIRED); - assertThat(calls.get()).isEqualTo(1); - } - - @Test - void aSlowRepositoryCannotReviveAnExpiredTransaction() { - var clock = new TestClock(); - var scope = new Scope(name -> { clock.now = clock.now.plusSeconds(600); return Optional.of(ALICE); }); - var service = new SignInService((username, password) -> scope, clock, true); - var transaction = service.start(); - assertThat(service.submitPassword(transaction, "alice", "secret")).isEqualTo(SignInService.PasswordResult.EXPIRED); - assertThat(transaction.step()).isEqualTo(LoginTransaction.Step.PASSWORD_REQUIRED); - assertThat(scope.closed).isTrue(); - } - - @Test - void repositoryFailureClosesTheScopeWithoutPromotingIdentity() { - var scope = new Scope(name -> { throw new UserRepository.AccessFailure(); }); - var service = new SignInService((username, password) -> scope, new TestClock(), true); - var transaction = service.start(); - assertThat(service.submitPassword(transaction, "alice", "secret")).isEqualTo(SignInService.PasswordResult.REJECTED); - assertThat(transaction.step()).isEqualTo(LoginTransaction.Step.PASSWORD_REQUIRED); - assertThat(scope.closed).isTrue(); - } - - private static final class Scope implements AuthenticatedUserSession { - private final UserRepository users; - boolean closed; - Scope(UserRepository users) { this.users = users; } - @Override public String loginName() { return "alice@directory"; } - @Override public UserRepository users() { return users; } - @Override public void close() { closed = true; } - } - - private static final class TestClock extends Clock { - Instant now = Instant.parse("2026-01-01T00:00:00Z"); - @Override public Instant instant() { return now; } - @Override public ZoneId getZone() { return ZoneOffset.UTC; } - @Override public Clock withZone(ZoneId zone) { return Clock.fixed(now, zone); } - } -} diff --git a/src/test/java/top/ddupan/iam/login/authentication/application/VerifyPasswordTests.java b/src/test/java/top/ddupan/iam/login/authentication/application/VerifyPasswordTests.java new file mode 100644 index 0000000..729b91c --- /dev/null +++ b/src/test/java/top/ddupan/iam/login/authentication/application/VerifyPasswordTests.java @@ -0,0 +1,49 @@ +package top.ddupan.iam.login.authentication.application; + +import java.util.List; +import java.util.Optional; +import org.junit.jupiter.api.Test; +import top.ddupan.iam.login.authentication.application.port.AuthenticatedUserSession; +import top.ddupan.iam.login.authentication.application.port.PasswordVerificationException; +import top.ddupan.iam.login.authentication.domain.User; +import top.ddupan.iam.login.authentication.domain.UserRepository; +import static org.assertj.core.api.Assertions.*; + +class VerifyPasswordTests { + static final User ALICE = new User(new User.UserId("directory", "alice-id"), "alice", "Alice", "", List.of()); + + @Test + void readsTheBoundUserAndClosesTheConnection() { + var scope = new Scope(name -> { + assertThat(name).isEqualTo("alice@directory"); + return Optional.of(ALICE); + }); + assertThat(new VerifyPassword((username, password) -> scope).verify("alice", "secret")).isEqualTo(ALICE); + assertThat(scope.closed).isTrue(); + } + + @Test + void missingUserClosesTheConnectionAndRejectsAuthentication() { + var scope = new Scope(name -> Optional.empty()); + assertThatThrownBy(() -> new VerifyPassword((u, p) -> scope).verify("alice", "secret")) + .isInstanceOf(PasswordVerificationException.class); + assertThat(scope.closed).isTrue(); + } + + @Test + void repositoryFailureStillClosesTheConnection() { + var scope = new Scope(name -> { throw new UserRepository.AccessFailure(); }); + assertThatThrownBy(() -> new VerifyPassword((u, p) -> scope).verify("alice", "secret")) + .isInstanceOf(UserRepository.AccessFailure.class); + assertThat(scope.closed).isTrue(); + } + + private static final class Scope implements AuthenticatedUserSession { + private final UserRepository users; + boolean closed; + Scope(UserRepository users) { this.users = users; } + @Override public String loginName() { return "alice@directory"; } + @Override public UserRepository users() { return users; } + @Override public void close() { closed = true; } + } +} diff --git a/src/test/java/top/ddupan/iam/login/authentication/domain/LoginTransactionTests.java b/src/test/java/top/ddupan/iam/login/authentication/domain/LoginTransactionTests.java deleted file mode 100644 index 1586e01..0000000 --- a/src/test/java/top/ddupan/iam/login/authentication/domain/LoginTransactionTests.java +++ /dev/null @@ -1,44 +0,0 @@ -package top.ddupan.iam.login.authentication.domain; - -import java.time.Instant; -import java.util.List; -import java.util.UUID; -import org.junit.jupiter.api.Test; -import static org.assertj.core.api.Assertions.*; - -class LoginTransactionTests { - static final Instant NOW = Instant.parse("2026-01-01T00:00:00Z"); - static final User ALICE = new User(new User.UserId("directory", "alice-id"), "alice", "Alice", "", List.of()); - - @Test - void passwordVerificationBindsIdentityAndOnlyAdvancesToMfa() { - var transaction = LoginTransaction.start(UUID.randomUUID(), NOW); - assertThat(transaction.beginPasswordAttempt(NOW)).isEqualTo(LoginTransaction.Attempt.ALLOWED); - transaction.passwordVerified(ALICE, NOW); - assertThat(transaction.step()).isEqualTo(LoginTransaction.Step.MFA_REQUIRED); - assertThat(transaction.identity()).isEqualTo(ALICE); - assertThat(transaction.beginPasswordAttempt(NOW.plusSeconds(3))).isEqualTo(LoginTransaction.Attempt.WRONG_STEP); - var bob = new User(new User.UserId("directory", "bob-id"), "bob", "Bob", "", List.of()); - assertThatThrownBy(() -> transaction.passwordVerified(bob, NOW.plusSeconds(3))) - .isInstanceOf(IllegalStateException.class); - assertThat(transaction.identity()).isEqualTo(ALICE); - } - - @Test - void expiredTransactionsCannotAcceptAPasswordResult() { - var transaction = LoginTransaction.start(UUID.randomUUID(), NOW); - assertThat(transaction.beginPasswordAttempt(NOW.plusSeconds(600))).isEqualTo(LoginTransaction.Attempt.EXPIRED); - assertThatThrownBy(() -> transaction.passwordVerified(ALICE, NOW.plusSeconds(600))) - .isInstanceOf(IllegalStateException.class); - } - - @Test - void attemptsAreSeparatedWithoutAdvancingAuthentication() { - var transaction = LoginTransaction.start(UUID.randomUUID(), NOW); - assertThat(transaction.beginPasswordAttempt(NOW)).isEqualTo(LoginTransaction.Attempt.ALLOWED); - assertThat(transaction.beginPasswordAttempt(NOW.plusSeconds(1))).isEqualTo(LoginTransaction.Attempt.RETRY_LATER); - assertThat(transaction.beginPasswordAttempt(NOW.plusSeconds(2))).isEqualTo(LoginTransaction.Attempt.ALLOWED); - assertThat(transaction.step()).isEqualTo(LoginTransaction.Step.PASSWORD_REQUIRED); - assertThatThrownBy(transaction::identity).isInstanceOf(IllegalStateException.class); - } -} diff --git a/src/test/java/top/ddupan/iam/login/authentication/interfaces/web/SignInIntegrationTests.java b/src/test/java/top/ddupan/iam/login/authentication/interfaces/web/SignInIntegrationTests.java index 1463adf..7798312 100644 --- a/src/test/java/top/ddupan/iam/login/authentication/interfaces/web/SignInIntegrationTests.java +++ b/src/test/java/top/ddupan/iam/login/authentication/interfaces/web/SignInIntegrationTests.java @@ -10,6 +10,11 @@ import org.springframework.beans.factory.annotation.Autowired; import org.springframework.boot.test.context.SpringBootTest; import org.springframework.boot.webmvc.test.autoconfigure.AutoConfigureMockMvc; import org.springframework.http.MediaType; +import java.time.Instant; +import java.util.List; +import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; +import org.springframework.security.core.authority.FactorGrantedAuthority; +import org.springframework.security.core.context.SecurityContext; import org.springframework.mock.web.MockHttpSession; import org.springframework.test.context.DynamicPropertyRegistry; import org.springframework.test.context.DynamicPropertySource; @@ -20,8 +25,10 @@ import static org.springframework.test.web.servlet.request.MockMvcRequestBuilder import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.*; /** Real LDAPS sockets and Spring Data LDAP; AD bind/subcode semantics are simulated. */ -@SpringBootTest(properties = {"iam.ad.enabled=true", "iam.ad.domain=example.test", "iam.ad.base-dn=dc=example,dc=test"}) +@SpringBootTest(properties = {"iam.ad.enabled=true", "iam.ad.domain=example.test", "iam.ad.base-dn=dc=example,dc=test", + "management.otlp.metrics.export.enabled=false", "spring.security.user.name=fixture-monitor", "spring.security.user.password=fixture-monitor-password"}) @AutoConfigureMockMvc +@org.springframework.boot.micrometer.metrics.test.autoconfigure.AutoConfigureMetrics @ImportRuntimeHints(SignInIntegrationTests.FixtureHints.class) class SignInIntegrationTests { static class FixtureHints implements RuntimeHintsRegistrar { @@ -67,9 +74,12 @@ class SignInIntegrationTests { .andReturn().getResponse().getContentAsString(); assertThat(html).contains("mfa-pending", "gitea-admins", "\\u003c/script\\u003e") .doesNotContain("fixture-password", "