From a4b99d54f3975ed58d019a11530605585d378639 Mon Sep 17 00:00:00 2001 From: panxiao81 Date: Sun, 27 Sep 2026 16:54:54 +0000 Subject: [PATCH] =?UTF-8?q?=E6=8C=89=20DDD=20=E9=87=8D=E6=9E=84=E8=AE=A4?= =?UTF-8?q?=E8=AF=81=E6=B5=81=E7=A8=8B=E5=B9=B6=E5=A4=8D=E7=94=A8=E7=94=A8?= =?UTF-8?q?=E6=88=B7=20bind=20=E5=AE=9E=E7=8E=B0=20LDAP=20=E4=BB=93?= =?UTF-8?q?=E5=82=A8?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- AGENTS.md | 3 + README.md | 31 ++- build.gradle | 1 - docs/ad-login.md | 29 ++- docs/browser-preview.md | 106 --------- docs/images/browser-preview.png | Bin 38248 -> 0 bytes frontend/playwright.config.ts | 2 +- frontend/src/components/SubmitForm.tsx | 23 ++ frontend/src/main.tsx | 190 +--------------- frontend/src/page-context.ts | 32 +++ frontend/src/pages/SignInPage.tsx | 54 +++++ frontend/src/style.css | 93 +------- frontend/tests/preview.spec.ts | 95 -------- scripts/native-smoke.py | 4 +- .../iam/login/ad/AdPasswordVerifier.java | 153 ------------- .../iam/login/ad/DirectoryIdentity.java | 12 - .../application/SignInService.java | 50 +++++ .../port/AuthenticatedUserSession.java | 10 + .../port/PasswordAuthenticator.java | 6 + .../port/PasswordVerificationException.java | 14 ++ .../domain/LoginTransaction.java | 56 +++++ .../iam/login/authentication/domain/User.java | 48 ++++ .../authentication/domain/UserRepository.java | 12 + .../infrastructure/ad/AdEntryMapper.java | 27 +++ .../ad/AdPasswordAuthenticator.java | 91 ++++++++ .../infrastructure}/ad/AdProperties.java | 2 +- .../infrastructure/ad/AdUserEntry.java | 20 ++ .../infrastructure/ad/AdUserRepository.java | 82 +++++++ .../interfaces/web/BrowserSignInState.java | 12 + .../interfaces/web}/PageRenderer.java | 2 +- .../interfaces/web/SignInController.java} | 96 ++++---- .../AuthenticationConfiguration.java | 34 +++ .../configuration/SecurityConfiguration.java | 22 ++ .../login/configuration/WebConfiguration.java | 28 +++ .../login/preview/PreviewConfiguration.java | 44 ---- .../iam/login/preview/PreviewController.java | 129 ----------- .../iam/login/IamLoginApplicationTests.java | 66 +----- .../iam/login/ad/AdIntegrationTests.java | 211 ------------------ .../application/SignInServiceTests.java | 107 +++++++++ .../domain/LoginTransactionTests.java | 44 ++++ .../ad/AdUserRepositoryIntegrationTests.java | 79 +++++++ .../web/SignInIntegrationTests.java | 90 ++++++++ .../iam/login/support/AdDirectoryFixture.java | 100 +++++++++ 43 files changed, 1143 insertions(+), 1167 deletions(-) delete mode 100644 docs/browser-preview.md delete mode 100644 docs/images/browser-preview.png create mode 100644 frontend/src/components/SubmitForm.tsx create mode 100644 frontend/src/page-context.ts create mode 100644 frontend/src/pages/SignInPage.tsx delete mode 100644 frontend/tests/preview.spec.ts delete mode 100644 src/main/java/top/ddupan/iam/login/ad/AdPasswordVerifier.java delete mode 100644 src/main/java/top/ddupan/iam/login/ad/DirectoryIdentity.java create mode 100644 src/main/java/top/ddupan/iam/login/authentication/application/SignInService.java create mode 100644 src/main/java/top/ddupan/iam/login/authentication/application/port/AuthenticatedUserSession.java create mode 100644 src/main/java/top/ddupan/iam/login/authentication/application/port/PasswordAuthenticator.java create mode 100644 src/main/java/top/ddupan/iam/login/authentication/application/port/PasswordVerificationException.java create mode 100644 src/main/java/top/ddupan/iam/login/authentication/domain/LoginTransaction.java create mode 100644 src/main/java/top/ddupan/iam/login/authentication/domain/User.java create mode 100644 src/main/java/top/ddupan/iam/login/authentication/domain/UserRepository.java create mode 100644 src/main/java/top/ddupan/iam/login/authentication/infrastructure/ad/AdEntryMapper.java create mode 100644 src/main/java/top/ddupan/iam/login/authentication/infrastructure/ad/AdPasswordAuthenticator.java rename src/main/java/top/ddupan/iam/login/{ => authentication/infrastructure}/ad/AdProperties.java (76%) create mode 100644 src/main/java/top/ddupan/iam/login/authentication/infrastructure/ad/AdUserEntry.java create mode 100644 src/main/java/top/ddupan/iam/login/authentication/infrastructure/ad/AdUserRepository.java create mode 100644 src/main/java/top/ddupan/iam/login/authentication/interfaces/web/BrowserSignInState.java rename src/main/java/top/ddupan/iam/login/{preview => authentication/interfaces/web}/PageRenderer.java (95%) rename src/main/java/top/ddupan/iam/login/{ad/AdLoginController.java => authentication/interfaces/web/SignInController.java} (54%) create mode 100644 src/main/java/top/ddupan/iam/login/configuration/AuthenticationConfiguration.java create mode 100644 src/main/java/top/ddupan/iam/login/configuration/SecurityConfiguration.java create mode 100644 src/main/java/top/ddupan/iam/login/configuration/WebConfiguration.java delete mode 100644 src/main/java/top/ddupan/iam/login/preview/PreviewConfiguration.java delete mode 100644 src/main/java/top/ddupan/iam/login/preview/PreviewController.java delete mode 100644 src/test/java/top/ddupan/iam/login/ad/AdIntegrationTests.java create mode 100644 src/test/java/top/ddupan/iam/login/authentication/application/SignInServiceTests.java create mode 100644 src/test/java/top/ddupan/iam/login/authentication/domain/LoginTransactionTests.java create mode 100644 src/test/java/top/ddupan/iam/login/authentication/infrastructure/ad/AdUserRepositoryIntegrationTests.java create mode 100644 src/test/java/top/ddupan/iam/login/authentication/interfaces/web/SignInIntegrationTests.java create mode 100644 src/test/java/top/ddupan/iam/login/support/AdDirectoryFixture.java diff --git a/AGENTS.md b/AGENTS.md index 532628c..b27fdf1 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -4,6 +4,9 @@ - 默认中文维护项目文档、commit、issue 和 PR；代码与上游 API 名称保留英文。 - 项目使用 Java 与 Spring；Native 是交付约束，不是可选优化，不引入 Kotlin。 - 日常变更先通过适用的 JVM 测试，不要求每轮执行耗时的 Native 编译与测试；Native 仍为交付目标，在阶段性验收或兼容性风险变化时集中验证。未执行的验证明确报告。 +- 按 DDD 组织 authentication 上下文：领域拥有 User/UserRepository 与认证事务规则，应用层编排，基础设施实现 AD 仓储，Web 仅处理传输与会话；领域和应用层不依赖 Spring/Servlet/LDAP。 +- 用户仓储复用本次用户 bind 的连接，不新增只读服务账号；连接限于当前用例，不保留密码或连接在 HTTP session 中。 +- 选型演示在真实接入后删除，不将演示入口、状态机、验证码或开关保留为应用功能。 - 只实现当前任务范围。Hydra 负责签发，首轮 AD 负责身份和组，本服务独立于 Ayatori。 - 不把 LDAP 密码成功当成完整 MFA 成功；所有因素绑定同一主体与认证事务。 - 不提交凭据、MFA secret、生产配置秘密或包含上述内容的测试输出。 diff --git a/README.md b/README.md index a41f2f3..cb074d6 100644 --- a/README.md +++ b/README.md @@ -54,7 +54,7 @@ npm --prefix frontend run build ``` 测试需要可用的 Docker，生成器配置了 Grafana LGTM Testcontainer。 -包含隔离浏览器原型和 AD 第一因素测试；默认 Spring Security 登录页不是 IAM 登录流程。 +测试覆盖 AD 第一因素、浏览器流程和监控集成。人类登录统一从 `/signin` 进入。 使用 GraalVM 25 验证原生测试与编译： ```sh @@ -67,13 +67,32 @@ Docker 开发使用 `scripts/gradle-in-docker`，默认持久挂载 Gradle 缓 JVM、AOT、Native 测试及原生应用 HTTP 检查已通过，实测范围与资源数据见 [本地验证结果](docs/bootstrap.md#2026-09-25-本地验证结果)。 新增 AD 路径本轮按维护者要求只进行 JVM 验证，不沿用基线的 Native 验收结论。 -真实目录密码与属性/直接所属组读取已通过维护者浏览器验收；MFA 与 Hydra 链路仍待实现。 +重构前的真实目录密码与属性/直接所属组读取已通过维护者浏览器验收；Spring Data LDAP +版本已通过 JVM 和浏览器回归，真实人类复验待反馈。MFA 与 Hydra 链路仍待实现。 -## 浏览器流程预览 +## 领域与代码组织 -人类登录界面采用 React + Vite，参考 Keycloakify 的内联上下文与原生表单提交方式。 -原型默认关闭，仅测试页面切换与局部交互，不执行真实认证。启动、浏览器测试和边界见 -[浏览器流程原型](docs/browser-preview.md)。 +当前限界上下文为 `authentication`，使用 DDD 分层，依赖向领域内部收敛： + +```text +interfaces/web → application → domain +infrastructure/ad → application/port + domain +configuration → 装配上述实现 +``` + +- `authentication/domain`：`User`、`UserRepository`、`LoginTransaction`；稳定主体、组成员关系、 + 登录步骤与期限属于领域模型，不依赖 Spring、Servlet、LDAP 或持久化注解。 +- `authentication/application`：登录用例，编排密码认证、用户仓储查询与事务推进； + `port` 描述密码认证及其用户仓储会话，不暴露 `DirContext`。 +- `authentication/infrastructure/ad`：AD bind、Spring Data LDAP 用户仓储、LDAP 实体与领域映射。 + 使用同一次用户 bind 的连接，查询结束关闭，不新增服务账号，不保存用户密码。 +- `authentication/interfaces/web`：HTTP、CSRF、会话存取和页面数据转换；不定义认证状态规则。 +- `configuration`：Spring 组件装配、安全链、静态资源和 Native hints。 +- `frontend/src`：入口、页面、表单组件和页面数据契约分别维护，只包含真实登录流程。 + +测试分别覆盖领域规则、应用用例、AD 仓储和 Web 行为，LDAP 夹具集中在测试 `support` 包。 +界面采用 React + Vite，Spring 在 HTML 中内联当前步骤上下文，浏览器原生表单 POST， +由服务端决定下一页。不增加前端路由器、模板引擎或 Node 运行服务。 ## AD 第一因素接入 diff --git a/build.gradle b/build.gradle index ad43c2b..2eace16 100644 --- a/build.gradle +++ b/build.gradle @@ -27,7 +27,6 @@ dependencies { implementation 'org.springframework.boot:spring-boot-starter-validation' implementation 'org.springframework.boot:spring-boot-starter-webmvc' implementation 'org.springframework.security:spring-security-webauthn' - implementation 'org.springframework.security:spring-security-ldap' compileOnly 'org.projectlombok:lombok' developmentOnly 'org.springframework.boot:spring-boot-devtools' runtimeOnly 'io.micrometer:micrometer-registry-prometheus' diff --git a/docs/ad-login.md b/docs/ad-login.md index a6e35cc..37771f9 100644 --- a/docs/ad-login.md +++ b/docs/ad-login.md @@ -1,13 +1,17 @@ # AD 第一因素接入 -`/signin` 接收 AD 用户名（sAMAccountName）或本域 UPN，使用 Spring Security -`ActiveDirectoryLdapAuthenticationProvider` 以用户身份执行 LDAPS bind 与目录查询。 +`/signin` 接收 AD 用户名（sAMAccountName）或本域 UPN，通过 Spring LDAP `ContextSource.getContext` 以用户身份执行 LDAPS bind， +随后由 Spring Data LDAP 仓储复用这条已认证连接查询用户与组。 不使用额外目录服务账号，不写入 AD，不复制 Authelia 的绑定密码。 +领域仓储接口为 `UserRepository`，`User` 与 `LoginTransaction` 为领域模型。应用层以 +try-with-resources 管理已认证用户仓储会话；基础设施的 `AdUserRepository` 通过 +`SimpleLdapRepository`、`LdapTemplate`、ODM 实现读取与转换，关闭后不可继续查询。 +`AdUserEntry` 的 LDAP 注解不会进入领域对象。 + 成功后重定向到 `/signin/mfa`，显示目录账号、objectGUID、邮箱、直接所属组及组 DN。 **这是密码因素验收页面，MFA 尚未接入，不是完整登录成功。** 不创建 Spring Security -认证上下文，不调用 Hydra，不替换现役 Go/Authelia/Gitea 登录链路。演示入口 `/preview` -仍完全隔离，默认关闭，演示码不能推进真实认证。 +认证上下文，不调用 Hydra，不替换现役 Go/Authelia/Gitea 登录链路。 ## 目录和组语义 @@ -17,7 +21,8 @@ 不把 Spring 的 `FACTOR_PASSWORD` 当作组。结果排序，不做应用专用组改写。 - 此轮不展开嵌套组、不推导 primaryGroupID，也不宣称与 Authelia 的有效组集合完全一致。 遇到 ranged memberOf 或不同 DN 同名 CN 拒绝映射，不静默丢组或合并不同主体。 -- AD bind 执行密码及账号状态检查；Spring 解析禁用、锁定、密码过期等 AD 子码。 +- AD bind 执行密码及账号状态检查；基础设施层将禁用、锁定、密码过期等 AD 子码转换为 + 应用层认证失败原因，不向领域层泄露 LDAP/Spring 异常。 搜索排除 computer 对象，只接受唯一用户条目和合法 objectGUID/sAMAccountName。 - 邮箱作为目录属性展示，不声称 `email_verified=true`。 @@ -69,7 +74,7 @@ java -Djavax.net.ssl.trustStore=/run/iam/truststore \ 这里 truststore 仅含公开信任锚，口令不是目录密码。保留所需公共根证书；不得禁用 LDAP endpoint identification 或用信任所有证书的 socket factory。连接/读取超时为 3/5 秒。 AD 根范围查询可能返回 DomainDnsZones/ForestDnsZones 等分区 referral；配置为 ignore， -由 Spring AD provider 忽略 partial result，不使用 throw 打断用户查询，也不 follow 转发用户凭据。 +由仓储的 LdapTemplate 忽略 partial result，不使用 throw 打断用户查询，也不 follow 转发用户凭据。 浏览器入口只接受 HTTPS；明文请求返回 426。默认不信任转发头。若以后由代理终结 TLS， 必须配合仅受信代理可达的后端网络和转发头配置，不能公开一个信任任意 forwarded header @@ -86,7 +91,7 @@ AD 根范围查询可能返回 DomainDnsZones/ForestDnsZones 等分区 referral 入口限流、审计、MFA、Hydra 事务和恢复策略。 基础存活检查使用 `/actuator/health/liveness`。Boot 自动配置的 LDAP 健康项并未连接这里 -独立配置的 AD provider，不能把该项当作此认证路径的可用性验证。 +按用户 bind 创建的仓储连接，不能把该项当作此认证路径的可用性验证。 ## 本轮验证边界 @@ -95,12 +100,14 @@ AD 根范围查询可能返回 DomainDnsZones/ForestDnsZones 等分区 referral 仍未完整认证。UnboundID 的 UPN bind 与 AD 子码由测试拦截器模拟，不能替代 Samba AD。 测试证书、私钥与账号全为虚构夹具，不用于实际部署。 -2026-09-25：JVM 测试共 12 项通过（原有 6 项、新增 AD 6 项），`bootJar` 构建通过。 -实际 JVM 使用受信 CA 完成 Samba AD RootDSE 查询，HTTPS 页面返回 200。 +2026-09-25：DDD/Spring Data LDAP 版本通过 20 项 JVM 测试和 `bootJar` 构建， +包含同一次 bind 连接完成仓储查询、用例结束关闭连接、领域规则及监控集成。 +开发 HTTPS 实例已更新为该版本。此前 JVM 使用受信 CA 完成 Samba AD RootDSE 查询。 浏览器已检查登录表单渲染、真实 CSRF 原生 POST 和失败后清空密码；只使用在访问 AD 前 即拒绝的合成外域用户名，不尝试猜测人类密码。浏览器回归共 1 项通过，包含移动端布局。 复现：`IAM_AD_URL=https://验收域名:端口 npm --prefix frontend run test:browser -- ad-login.spec.ts`。 -维护者已在 HTTPS 页面完成真实密码验证，成功到达待 MFA 页面，并反馈目录标识、邮箱与 +重构前，维护者已在 HTTPS 页面完成真实密码验证，成功到达待 MFA 页面，并反馈目录标识、邮箱与 六个直接所属组的查询结果。该验收覆盖 Samba AD 第一因素与属性读取，不表示 MFA、 -嵌套组/主组等价性或 Hydra 登录已完成。不在聊天、命令行或日志中传递人类密码。 +嵌套组/主组等价性或 Hydra 登录已完成。Spring Data LDAP 重构后的真实人类复验仍待反馈。 +不在聊天、命令行或日志中传递人类密码。 新增 AD 路径尚未进行 Native 测试，不能复用旧 UI 原型的 Native 结论。 diff --git a/docs/browser-preview.md b/docs/browser-preview.md deleted file mode 100644 index 1382899..0000000 --- a/docs/browser-preview.md +++ /dev/null @@ -1,106 +0,0 @@ -# 浏览器登录流程原型 - -参考 Keycloakify：Spring 返回 HTML 时内联当前页面上下文，React 用 `createRoot` 渲染， -表单原生 POST 到 Spring，后端按 session 中的步骤校验并返回 303 重定向。 -每次导航重新挂载 React，带 hash 的 JS/CSS 可长期缓存。局部帮助展开不发请求。 - -这是浏览器交互实验，不是身份验证实现：没有 AD 查询、真实密码、TOTP、WebAuthn 或 -Hydra accept；不会创建 Spring Security 登录身份。演示码 **123456** 仅用于切换页面， -不得作为 MFA 实现复用。默认关闭，显式设置 `iam.ui-preview.enabled=true` 才开放 `/preview`。 -所有其他受保护入口仍需认证，Prometheus 权限保持不变。 - -![浏览器交互原型首页](images/browser-preview.png) - -## 本地体验 - -有 Node 24 和 JDK 25 时： - -```sh -cd frontend -npm ci -npm run build -cd .. -./gradlew bootRun --args='--server.address=127.0.0.1 --server.port=18081 --iam.ui-preview.enabled=true' -``` - -访问 。填写称呼，尝试错误演示码，再用 123456 完成。 -后退链接、刷新、重新体验都走服务端流程。启用 DevTools 的 Network 面板观察 document -POST、303、GET；不要勾选 Disable cache，否则无法观察正常的静态资源缓存。 - -Docker 开发： - -```sh -IAM_DOCKER_USE_SUDO=1 scripts/gradle-in-docker bootRun \ - --args='--server.address=127.0.0.1 --server.port=18081 --iam.ui-preview.enabled=true' -``` - -`gradle-in-docker` 先用固定 Node 镜像构建前端，再运行 GraalVM 容器。 -Gradle 缓存默认 `$HOME/.cache/iam-login/gradle`，npm 缓存默认 `$HOME/.cache/iam-login/npm`； -可用 `IAM_GRADLE_CACHE` / `IAM_NPM_CACHE` 指定持久目录。Node 仅参与构建，部署无 Node 服务。 -直接调用 Gradle 时先构建前端；缺少 `frontend/dist/index.html` 会明确失败。 -前端 watch 可用 `npm run watch`，修改后仍需让后端重新复制资源并重启；本轮不实现 HMR 桥接。 - -## 验证 - -```sh -IAM_DOCKER_USE_SUDO=1 scripts/gradle-in-docker test testAot nativeTest nativeCompile -python3 scripts/native-smoke.py -build/native/nativeCompile/iam-login --server.address=127.0.0.1 --server.port=18081 \ - --iam.ui-preview.enabled=true -# 另一个终端，应用保持运行 -cd frontend -npm ci -npx playwright install chromium -npm run test:browser -``` - -浏览器测试覆盖原生页面导航、错误重试、局部交互零请求、无 fetch/XHR、静态 JS 缓存、 -移动端布局、脚本结束标记转义，以及完成预览仍不能访问受保护应用。 -额外计时使用 Chromium 模拟 60ms 网络延迟、1.5Mbps 下载和四倍 CPU slowdown， -用于比较首屏和缓存后的页面切换，不代表真实 LAN、Tailscale 或手机性能。 - -## 实现边界 - -- 页面壳在 `frontend/index.html`，Vite 构建后作为私有 classpath 资源 `ui/index.html` 打包， - 不提供静态 index 入口；控制器仅替换一个固定 JSON 数据位置。 -- Java 使用 JSON 序列化后转义 `<`、`>`、`&` 和 Unicode 行分隔符，避免 `` 逃逸； - React 按文本输出动态内容，不通过 HTML 字符串插入用户名。 -- session 持有演示步骤。表单带 Spring Security CSRF token，缺失被拒绝； - 非当前步骤的提交拒绝，未知/过期 session 的后续页面回到初始步骤。 -- 页面与重定向 `no-store`，静态 hash 资源 public/immutable。CSP 不允许内联可执行脚本。 -- 单 session 仅有一个演示流程，多标签页会共享步骤。正式认证需要独立事务、过期策略、 - 主体与因素绑定；本原型不提供这些保证。 -- 当前采取整页切换，不提前实现 fetch 优化。后续根据测量选择需要局部更新的步骤。 -- 首屏依赖 JavaScript，没有 React SSR、Flight、客户端路由、FreeMarker 或模板引擎。 - 关闭 JavaScript 时显示明确提示，不宣称无 JS 可用。 - -来源：[Keycloakify 入口](https://github.com/keycloakify/keycloakify-starter/blob/main/src/main.tsx)、 -[登录表单](https://github.com/keycloakify/keycloakify/blob/main/src/login/pages/Login.tsx)、 -[Vite 构建](https://vite.dev/guide/build)。 - -## 2026-09-25 本地验证结果 - -本轮应用代码为 `dcf634d`，随后修正 smoke 对 HTML 入口的 Accept 请求头。 -使用固定 GraalVM Java 25.0.2 镜像，构建限制 4 CPU / 8 GiB；原生应用采用默认 O2。 - -| 检查 | 结果 | -|---|---| -| 前端 TypeScript / Vite、bootJar | 通过 | -| JVM test / testAot / nativeTest | 各 6 项，0 失败、0 跳过 | -| Native 应用 smoke | liveness UP；匿名应用及指标 401；认证指标 200；健康请求计数增加 3 | -| 默认关闭 / 显式开启预览 | HTML 请求分别 404 / 200，在同一 Native 构建上实测 | -| Native 上的 Chromium 测试 | 3 项通过，包含整页原生 POST、无 fetch/XHR、缓存、转义与移动端 | -| ELF 文件大小 | 126,291,016 bytes，约 120.44 MiB，不是容器镜像大小 | -| 启动到 liveness 可响应 | 单次 0.351 秒 | -| smoke 请求后 RSS | 148,996 KiB，约 145.50 MiB | -| 模拟限速下的首屏 | 从导航开始到 React 提交 DOM：1,702 ms | -| 模拟限速下的缓存后切换 | Playwright 点击开始到下一页标题可见：560 ms | - -浏览器计时条件为 60ms 网络延迟、1.5Mbps 下载、0.75Mbps 上传及四倍 CPU slowdown。 -这是单次、本机、模拟网络测量，不是生产 SLA，两个计时区间也不同；不据此声称 Native -比 JVM 快多少。原型没有启用 HTTP 压缩，首屏实际下载约 223KB JS；构建日志中的约 70KB -是 gzip 估算，不是本轮实际传输大小。后续页面的 JS `transferSize=0`，确认命中浏览器缓存。 - -本轮没有新增反射补丁。Native 测试日志以及 smoke 的启动、请求、关闭阶段未发现 Native -反射或资源注册错误。生成目录中的配套 `.so` 文件应随 Native 产物保留；这里不承诺单文件 -静态链接交付。AD、真实 MFA、Hydra 和人类验收不在这些结果范围内。 diff --git a/docs/images/browser-preview.png b/docs/images/browser-preview.png deleted file mode 100644 index 29f6957d378d7ff241d95ce513449c65b1b7a55d..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 38248 zcmeFYRa9JE(=OVC1d7`nVqVsB_}uy2|Fm8=6R0h26G#`7rkEt2RYN`E4?u)?tn;O#XYmjVBogYO66#lsI(&;HL8{~LRe`w}o(@XZNr zdO+5K$H`Y5Dt>X=0yKOujW2Ah?GHQp-}XF20=pgGl9@#;DJjmRI6;Zgg`I`uIlq+y zrISfgU_R#FDpAb#D@U5Q=kBf=?~VueC>)E4*^Yf9A)$<6Wb!<5T7V?M1Jzj|V0C$} zL{eHYmsYz40#+s_j1o=F56-2ZJOVh=_d-|bnbvPTpOehYK+JJlo_J~ss^el5Umpy3 zksDTGN4hh9ut5*%L=lmY{s0t8~3VZBVx7~rV13iur$F{ zi-&`j7YTI=<&uP`;?OA4+QYe&Y|52-a3d8`y4kbhuFIpyQ*)E#?2rkw!Gf3#9ttbq zPb@M4>+}FPX~}e=BIY|{bKL5nsPt?74bHP=?uG}Zk0{H<8*ipk&(7JLXvXvM zn|Va({hh)EnJo{l*QNl+BRFJ3zGxUN_n@fXqh@zJYrXU=Pi785S;r4lX${uO4JnL4 z#ww4Kl?v^EOO;w@3C8=+8ZgVIpnLQoVCyrrfGJAR{5ERmNXJ9d#b#?uE2oVj=?iO( zzafbr>&B|B{8SacWyTk;G(q$3>!W2dg-&VQ8UO3aQu<&?q1Q;HoAB9{WwCDz@Ft2# z6v!FrHO=%{jNhxvIFMNx>Co2^M@!&N!mnVXR$p*#?>$Ffjjw5j{z3NjCVMbpdpymJ)hn5oA5 zY@o_13ted};XbouJryI5s@u7zNe;X}JpE z820rd3on;)(PLOL&~AD)OZRQ#I@b1LA-Rno-&$B4jA}NuNI9i%){ICYpvFBvXyiaP zz7%9R6_mac;XIZ!-4|&QN9lRd)!h4SMl3aiNJoDEM>3}hHC0^CDe6*N3B6}vq1=}3 zrqQt!y_;u6JUzrBgnumkbCGR`2LR-{&;zioAqp4LIKWT-(Rsz^s6?&!Hi_Q6hA%3m zb9z2Rx(ooX7l&)+7S~mQ-4g?P?=rTtE_cUe*9bzY|kSyP<_D~8&bGp!W7_lWg`L-+j1WLH*?#n?ZO^{HVOM0X_n z9G|4T4c|KcIr8lEa#PC(D4FIn7+x!;bv0?Csq2OPKCe|o#F(sdKS6ltd>o=$UlzCv^%R=AtBl4YpYOeh5wSNiz#4ysraJL z&YU3T`60R7DjDW+%gaZAblg9EqU4+0Uz*M-XBPBtNWi-+HXhN@j+#`7%hXcB*Y)lv zCoX-0Z_0Ec)>*(}VjLubGh^IU`T860j)WZLj6Zm-*1ugXCOFv1XMBnY$(j$kR7!mF z!e`*cpsh~SxPHv|IsB3@Y;}apsIfqIH*a`8b4|#$Y9KE)ss|kYegCC^^Ka&qKZ?I< zd_pe}%%GX{VS1}zOLoJ?d)+vUbx2se_<@;HfORU`^-&_X^C$g~PeIx(#CyVEM{T}!G>_f|++-x}ZR8wFhc_j<3GY(#_? zxmKGpL{vEaRMqHW>+!16*=iH z9d!_wLDzfAdXH+A0!4r=!OJ3MC+rRN4kfDBG1f|n&!tP=2{I?G-Nff;`rH05F_lVH zbgqBuPnRA&q!J}*Wa;lHi5!c>{2K zCslpw?COUL_q3HQvJ)k3){K9_(0x6*;dm%iOqKN*BViQgG+=PSdltc@q->r4h6~7= zF84S7GGpelC;TrU*NF4~6GZo~Bml5iQC_YDkT5s1vckmX3n>7O>3(k=AiZut=x1Cq z)~ojDb0QR_;;N>Q>_9Q?^OHeaD6pP3FA)MpqkpUnwoB7ONF`*4J z$*5ASFIH}c7L~sIZ_F9S_<_QxMLfU^mi!wD1O@?*zKiq4`Wy1kGi>Ye2Qy0DCk8&7 z1*A9IQGa3YkvGHK{{WQwtWUlu^gkJmoO1nX*FLH60%x=i1DAQQ@RKy(P;L!>ZXp6_ZDcoq2N9Szon<*fQ6te(xcZ+A2 z`WwbIJOPE^j>==$zd-fpIHT4N{#HmQR@RbY3^+IVUAdSUr5N4c&A6Ptmn3YBi zSagkbYcS&kFs|BiT*3bR_X9a*zK13MG;BFn+<6kP$4X0CsaDQ_jcu)oSsO*fjn$;j zrTz6S4xTzsKzFYSkHqiR@(+G`fxr4N|0aBpJ?|^`AqhbgL$`5_f%Sb8VTw+k$^dK#aHZ#K2e1jX~YnG3eH@yt`^=OP;aBu?lBLOe| zHkTr@WjyLB6~mW!BK>dzCw?i6)?w zr=Kti%)ly}gaK=hY-OR_2_MN4F0#&h2?&tM4+cimZV!jy z;qLWw@M9ClU>V|KWR5cGl24)v*yLu%0$B5G95ak0;hKJB$HxB8v2p%0X}7hlP^58I zBPx}P5jT!-K#O29X@=`1g@pN^l6L`i`!y==0&I^0EJHv~06eS@Qq@zfJ_8NVK})c zJiw3=Ht7$nzw-}Tjx44DNF;QBrIJ|x48U=&Fg$Izy=aQS0pwPfY>Ij6)Y1a1B_5PO zS(}GR`KJQhXdksh|64vEKv|v_GKdABpyaT@8lA;>Dnnv?*JKTErc6F8iTtU*p?1+o z0E7smqWy3;3V_6udo{p+3}aCa8VM@I$fGQ$jO!rt>3_HmOxXEvx$DDIMVE0-ksyro zsmRXHwVQhmfbe2|4(XYD0r<;$s`@Oz4#Oh+4O!j50ocF91p)Y9KA6;>Yb${DFM$AT z>x~D86g*$~5*xr{L$!g$^9r*b{PMy|RAtR;2?mVl6?X1H+r5Oj9T;=XZF`pwk>EnZ zJD9`DtVDn(qj3izv&0yw_N3?le`ShCu5S2mT0l!37m7O66VJYKZDjYUdD6~Jeg7~b zDj}3sOd+zKx9}*DtcCOdy|?K^_@?YYf=J;0cqH;fd%6l_Zg{@;W`djB$F`z8QAHMr zybMpI;3G-TpalYLe>VH^_oVotcDGv7g)Y6%(pX>vIiLEMU>gfl!s?N>oP=>+-MP=H zoOQmBuJ(4eY2YwHBF|{}*9)h4VcLLVCgiAtm6g{85b#$YW7iVOb)SrUgPvMg`x;Hg zEChzcMDKiit=JZ>c8*UdXLND6SLG{n7D4zmnjp3Nr|GjZ#U+>Dxm+w-A8z!~Ke8PzR8ZbNO`xUxx;z@& z=&x6IoLV9(TJG+4EbLJen@mOiK~NI8p!4yQMxiIk$52eh6%d6H&)TqD8|d_fMVBje zWBe$5gaEov{jyjkMlXruofBweYo>zB zQ!V2$z)-YI+K3f~vGe~p8<$}M*3E9&V{u~l5k!J8G@eWK+s@FccF6(v8V4bZh1cLJ zz3+tZV{6gGWK-`QrKt#SWx=_oBCpRC!

H*M&c@O7RZ6CwFL*Wzuj|4t@PMYSqCc zJ;`mXRqURLw#9aRNmBT1krSM)PLBf*9gEbE^a81IHT0j62wuz}gzJ3{}fqd|rn z*0R@!JurTc@NEV?Ew0y!3QW-Pf`|q9c4Ez+A)`B~TW!kFa^aedeG>AlZgF0L(W1An z*y{4=3m+dC!%#gHVhK)VhPcV+OzYo;J$%z0k#EW!|+DWF$`k)&du; zS>~IeNud%tbtdC^eu8j0+Km}wL!IWp72rwNM{tCU8W915Ii$n)+%6$hvjkw(BP|PN zGfaHzi>4WCknOlUB#*DZ64mGq(M{XXQ&?!;S+JIBh{HZtE8`L#P8I3a=lm)ct$z+* znj>-1;v(7D6_FLY8jp>b;2q#y9Z9Bo=IgHDq@`lkeBv^o2YuJS-O=-#C;p4pv&r~( zEF(RJEKELqIxaw~p&eGPaaFRX4iXE~n4BVo{UduH6f9$0?APSfb;c0&TLHI>aNiy` zfbAh+u+77V9V3f8kNMmwT<`Y`mrje9nqxC=e6(4nEW3|qsaw{oI804bi(cBU{8;^? z3c7?(9<)*k8Z>JzRE|6K2Hm=CapjpKRRlqCq*<=uGRPNBXQCE;#^%{+R`$?BX7pV zy#?pv5218k%IPoF|LkL&ur=v}H*cZz<2MDzjyK2_HV`zyBlP9SL-T({d%Pfbl~4J% z5$wb%n0vtU{cPorZ%dY5gLTX&W|0)}q+_3{MVgGS_=oNf#U*8F@3onq4|3u6qCaS|I;-Sg~OpXmGBO7K8}eiSe_ zU%wzdL+k!4p>qHAS=kku9>xP*OYWLqz7n6fMR}63wu?T)I1C&&F>Gtpn@9M$Kc*03 zG8eRujH;cpLM0TNT2eq{NxJXf-K9BL-xo#{mw#Kr9T0g7F^T!e}Q)^@v$FZ$r1)5CNDjj~u3Y}p|E7Z=(o;$v~e z7jgS$6Oq5~w)#d?4=tPc$B!fY7qg8JqTz-@(n{2GUD7)Q5EI}B(+z-z-w&spfb%3L zP>bv~-`_dCgpFSIU3KD%`Iq8~ol}Q*$1UjSsToxCoy@S0zr6v+V;pC1)({CiJNle` z!N>ZOALi3OT$Rw&Pi32L1^?fnbY}RE*D1_L<)DDk2f*S$pq!_=+_`tkU#8HaO zBZa<{8YS{V&fJ+$kE|Wvkm2X5Rg+@J>wEEy4T{>lHa3;!)V@@Gnp zK$5o*{EH5-B1499wEwCHG+0|(OI(E?Rw93Sc^OXnT+6!`1Dx@@aHPDi;}S-iYTPhS zKei8H2hqHmh&SYXhwATX58qUz2u>oQQ=aJ$-h846|XHzlFL@G)_-4siveP`m5h}HrpCLPUjUP#Go+crw{O#V8Gu9F_oTl zae(Sl9au6lq^0n0kl003pY1XC;t zhv`mxpW}tfa7D%aIk+zCT~9pcwBy42QK~*@TRAF|0ITC-_kBu*5RQ9qJVK2wup*sF zj1VxofkCRdGTXyhx3^Zuq$!Dp)7o8N2362my@Xq0s^>5ByK$9Z0*8NJX(T*Or~kj7 zAZ)#_YkX^=Q_W7nF4#~9M|nqXG@JOYNC>h#Oj>x`)p8x1-@;%p;6)if z_;-Or2LExmaGdeM2KDS_{lf9VioO;&CS#f%UL|2tFf;j`lL~0KQIplN&g9`nTzIa` zHWO|@OTOp#ZEmmN)A|v<3&*kgcfYCrH}Icffg(v;p^W(jUs$B63(R0@)^#dLCeA*t zd5n#`UYkvHvR1U;0W#(aYJaFDx+WJ~f;>`1ujhXp zCsYNV{Aoi;q76(?_L8Y^Ii#mf`1()pPh8Y=zjw_Rt7>Po9Qa{Le(tfvS5 z^oL2D3l(ilEeF4_c>j@AUl%E>!IFvcSr)cV%wSepx!UjdfYUs^UjSU$QX9-Rd`Kpp zA^+~q1iEqW8y4|qIlb`MWDngsa^L4ZY*IU9Q%_6;`K`$Jy=h?K_`aB!ZMM)aclS3e z|B;ru=fPgD_;|Q-w;9ayZygiPEvs_cf;PwEn$YF$&xq5$?>@2{G84rvUaV$fXg}3^ zaAnQVPRWF$jgeKkOjHi;>W14wBiU~wtzRFwU3@o6p`be8^{_-yDa`g(E@b| zbW#TC$ei2PYK!CDm>5xXmK@khtG`lub*jRuN9v59Uh+@nOMopVK?LmA(=IzfVLbaI zUScSXiOn$D7M#aZ&7p9D!wmnCK&Yn+jlgO?G*D$f{1q7|`qSb~Cp~p0wE>R%GxwLs z-(xK+!m3K1k*eo=WYb^^a8&pu{O(9Wu+bK~2W@q~1bXjx7s`d6xS4*&^)SZ4V(#P5pFo1OG!^kgS#k>V2!{8Oc(Z8 zNlaP1(ELv2Vf=krWb6r!GY6{H;>}JOMwDo|7j1K`xWPzdVz$vyqmjkAJ-vfTeV5+w zfcpFq)F2$Tr~%T4`L1=gwIzQkz;6X=j_CGnyyn{LijhfM(feH)!7m`IM0=oUTMDNT zCzJ$3HG{KwRaAJht)?!$KR7Kop0Ci9+$#sU3t4{p7UJEP*xa;fy%{6CTnX!BN@{E z2lE%zpw~;VwWOB2q)+)FY%nxdqZzP4gESV0P4VCg=TtMh#7Ogm( zm5=vMb9y-CHwbUHV1P!mwL~|o-9B< zFIiiSJBgBqM=d)VLob+B=AfeTyW(w02}wz|Oj?%4+C!8X;StKe=cw%KD-2s0Ou%6% zvmBJ%PKv*tfahMPv1k#B?HcuR#~5k1d2CsC&rj%T+{8^cvQ+Rz@BSk{38Vc=<}&}= z;xEhwifJu6{F_&{y`&7vx!c<|UZf9kG1Knxl zqw4ov_wS}ZP3FQPk&Bh1?M6`?d3=d_i{$DO;_~Dtq+&3K*bR177)nDlVs;k6A7#5z60!+SKDxGDy1Xwrd~J1x*tM1Ht>G!=)(`C0$3%@mSb82l)_cub#MSSS(ZL(~C z)NYGO>Xto(Qiq_Oy=8Gl+RuAKNtNy#SuLv|th%$q@kJaH=wr(~c_DljM}{pv858Up zj!sU{Ge#%23XGkut0~jCPuD+a9$! zb|H+h^|&cQW-N819Rk`n%MKB_C)AhMzETm0_^ZmO$i)r5;r^F9^J0XOo6ABH>jh7} zlHjkKQUgdN^Umzow{0s_D!*7~l63neB+|C{IH)(M&$ppFh`rEMOVDX7;*4mKC zZa%*tW9oUI(P9F&6*V>N4A9P`n3QtJ33XLqYWN$=k$xx~j{vvZ2Bz7eMN;{_F7Q1` zpdU964Q{1tB=5NfX8FwK9fsdtxoa1$Nl3Q2i8GCJVuB!O6VToqpeF^yZiMS8t80|=&d8`scSuGDsqUOm$zX4sQ*l)ur-iU z$Km4=Cj3H0Q@)5G)$2bKHzerh?^j6ns9JvV|FW?%V%DOvh^1oNU1{Q_IcvluO2^;$72Nf&y&=xQgyITJ)%Pd%lm zVqPltKPoXS$4A%grQo?gVo?a zaauVCULKyW!C@c{{md1_5u~Y^V10#rBeQXjA#3LDp51LT1$==&>Zl^e{yYKOxv#Id zXC?BLF+F1>@Gv-ZQ?$qr(ZR$(2otA|UGyc#BmshTPg6=UB+^ivu*yal@v-jKuE(w@ z(Dp*!N1A;~a=lNSKg$!(f!)2rcai8lII9h)`BTghF)uJ7TQ2c3GK+w&YrUP zvq#O!6g)11i2Hc>Magv^k}lQ5-4z^@rqNyn7aeEgmD2J1He{K{qJm@_F3agv6w8Y9 zp5Ndbjna#w_@bPH+n0Dc(+>hAYZ!m`vgdXmJnWcWvv!y=M_vgWg?-&3>{dn0q{}E% zQzklP-`dWuumU0B7foG~>+f>9$fFn$JJwMk*#=ZEdm&%`vHc%T3V`jW2Xu1dzPD94 zhFO=^ykhMy8t-?d!$U^A>1|ofdIlPecMB=m`Z>Q2Utae1X3Oty(+;t+H+{! zSM|E^Et2|uwyAhUqBS?&0k=y9#RaC61qyE71jA0;tt!REke^tnz(LSkyq3trJS`bK zHx);4Qgi`nnDH+^(jBHFjxf#_zuLV>G^0!33Z7^>5w>1I`Hw2x+$QE~S#kF}KCdqN zk5&waOT}&JRo29y@AsDn*IEbvHH#x{;+Yy)>g#K<3R;mcsra>aWi`%V|C0xwa-XV& z<CGWlIBI=gyK**uh0(7{#`Wx!;I&zc@oLFv5zR0U^2J#tk7zuL6Z&Y@ z5%NfZ0PWr`hzi@t@8T%jB5HW#JkRU&0Y&8(Lph zR#_f?4o=8u`CV{IJ36582Jhmz)ltx6z%(XRZ*R_MzIc9qIx;~^r1NgJ!2zEi%kzlj zbh^9xD4ESyQK){e^=O-&{g3gRIgJLpzO{ra&`X->flMa@ICoFKCXB>>L`5ObxQ7 z5UVpI-2L;n`2B|l;ravQy!cjR{;ADpYK1m77Z5?o-MQ+NBC(@bZ@o?N?`tcM>MNo|CLLx! z6u~If7ZzQ%hqfzm`N-KPOiCU((V`nNU|9&h^5t9#R6}(|3}+OI8&avt$+Vr@X6}Pi zuftF-wsCN{+`LYWExqtJW8uiSzT8=2w5!pM%aT@JYzby!_k+#zP>k@mU)gqn0~|6R zOa0;UD*`{0^Zv@VUomp7s>?$uNW(sRA8@=Tx`N{8nsb|U?df8j7Z3sKI9;E zk*6av_xVUj3ed$AMgu7BPKMzN;vbX@#e{`hj#uvM3Zc>LOYCkMyU~^34-oj#M#mt( z@2Z@*xDKKIqU$MQ7pRb)?N)T`3V1z1Q9~Paf3wh{vMXJ-N_>Az>STB8!5nq-H@nD- z#KuQtz0&i_3(EJ$ZFjdA-HNdAhmRPNqy6UoMa>_EEzB6K>;FM5PiF~x9etB=JysFj zAJY+Xv!2?!dt0!b8b;^Z*I>6W;mcQU)X4o!DQJ6mBn6eWJGNqYuF?1eS14!kKD6Yx z@l+I+B*|TF;BQ&|64I6@%8RQ5I!DS^=6UVSu2|>f6;FaDQw~TGfidh!Wg7^t?wpXR{%@Ql^T^k)E*&o)kZ8O2M2t? z76z*Q!0<0$LS(CO*NvMXrSyN`deo&66m-c;o z-IX1aDYrcm(f-mJ!^U6=XHvG^ShHq5akJQAJ@+D2{9?RK(s;L+>bu8@lds#=vgp53 zH(o~^rsn53uN*JKu2y+xrMI($uQ0>lZEwq}eZ1RNb~0d%NiGI2{JV{RPb=ztuOso$okyF#K+k zQ98u%EJK?E#lfNbqNx@R^)ia5xLfLmx!eS$#;Ha>6jW!Pl9&RlzeE#6^Hxq$FL~=m zCxcz^aw1c!H>~lW7*|&5)yn$z<1xL3FQl=gx5bwSHNK;x`q%fmN!P$6v(A541@Y<6bQKlGE@C;;T;VAJvfm|Ir-B;E0?AIFKiy5K!Z;5kUQ1=lohZUNi??MLC zC&j-eFqXqjV2IppY&?IYdoRQ0n#O)kBk+>ZsP|w+Tjf~WTb4l& zzrErR>DRydeqC#KerQ=yY#cG|kU{K%_Oj_96PE|D>T-e`xq- zza`06G1$BpmT=>%XKeBV(kX4Avr7p8{N;M6HUCKbdG^>)*34tqZ$&&s=s7}S=Mp9* zvUzUc=iU|J1W_s`&7s~5YB~oyD3#3uP$rj zZ6abI=qpv5t<%|r?u)n?tHbM_1n%vI9Z=POaRJm0=&gQ>31JNa3~i1dh9TeZ^9wYs zhQp&hn53EDCm;@Ys>DfucW-6r=bSozK8{b5DdyTX)vd%XMv2-YWsORDa1qLnn<)x2 zudFI_xZLl8ap@|{buSB0mx}SzgXk-hv)Z6VVFz9B(kok9(ltR&KF=dr@sJ_Pl^;(r zXP<%qlXz2nmY1(*K-*I9$IWHVuiTs7A_h3<65zV7zRDU_N$>8?Z!*Lge#Y7y54TN- z{4=k%Fg&7vGj#7UjJ-OqnBDTO#ZLy(_=LN=qNVOq-<4Hmas--|IQMDa%)f-8Xc}}K zqwGV6qDd8mjUZEYc&)eG2<@|wz`@0){ZK#GO0-A#4dx33oCo^1O+lfb6ESsTQ}KE6 zRh9~Y>+i7%L=ASvG~5795z0gM^Q^SQ>b9yw3fFt8p3>+h47RI1vqQYLm*G{$#xZh{ zV)FB%c|TvATP)sW`W~d@?`)iDdA?}UMzyPzS@-QX?D&4O_;mc|T0Wb}cPEYHmmNfv ztv`{a9H>4W@0WE3GFT zUFMUU+(=0y{SXztoN1(rDan@EPv<8_%A%KS9f6m3Oup8v@Pa{QM7AD;T*D=gpfaOqAU0u@Wvdio`%ma^KnbQ6EqUA3+ruoJRlj9c`#XrgtT(^Zzzjc%^ zf%rYGV|X_s;bn^+(;(5AdM;b(nI)V#0xf|L1HFxv>VJ|01&-D^b6|Ip##340yoBbL zXZr_6vUHPU!UgEu`;_5FS+H@DVcmr$J2V#NuZksluX0%cDOq8?XY+467e$pWN0ImN z#!D$5-*hjv_$Hec_ccz++_j{FNy3|-%x!ke~&RQI1+LUi&ZPq;-3j}RNMPYZSh3`H--ZxO26|q@W-!?!tbTimxBDw3X?t`Ua zPTcDsSO5v^hi(ngT@`TJHjn3No#(SEF_vXakvptnVLbc5yduJR636Rk%)mfh40kH5 zoYf9`NWXk5)`+I$HrC5|$$fS2ax0#8WvM&g-%EVf99wnoKjX(y96xznxO6cHQMcPS zGkI}*Z-&3X;K$Fh(bA8fbR?Haa%ETU9bG0S^?tp%_LbR?_i{^Zj`luiW*}#U!FG$+ zbiUk%gW-<$jnWOKX9GVF<1#Mt6@@duWpC{{Z?uB{h@~$h;=}Df&5voqEIuC1q!!p@ z2^;j4&1X++1I3L}IXjF#AR+u_73Vvi$31pZA+2J!o5!m5K3i?GrplhBRGGd(q0maV zr>>V*6SqJo59P(hRnhHm%DjIZ*J%*c0k@&h+Ktr$2iYN=JDku-tI`iW1Xp5Lr5J~A z{o%n9Q`QdheK`zkZ@RB>3E;O#an50Ft$1&q%gNwu-|2+ks3B{RRBuIAEq_n;^?eeqJHtTR8y(|a_P+U+K0k2T%wKt; zIX1HH3KL>s*hp+yqxFp1`sU8x@0d*BAgH3cCmv-}N)q{Fm{D0!I;+S%&49|2ca~iI@2`^u&Y;i;!*ahAuh>-4)cBR%W zIE;+s4qb=P_lSRab+wcsOb=fWs6Yc9Ak2*2BzAWrui`UUBfU*9CloDSsE; zpJ@XW;RHI(8HoFNubN;wwsYwoLMF|)r$1anr667GkI#3zJD7=aUE{a4pktNtxWJ<- z7Y1?mk1HeE+Zw3a4&u_Zin7qoG2jZ`DjD1{e;-{L@6>EkXzPxh5vy3#bx&T}IDxuv~ zzALZR|KkX(^X_yV5xzA+GJkW!$uLlb zM+zz)P!Ik?)ysob5PDJMu=R5R@@y5;*Sc`eM>_{R=$E%`j)x)TEt#GH77rz z5jfuK4fppl+m+p?(G_SD<6Zc-AWD&pL$B6mdo{f5EA_nShwb%-qr-!@pELSs**UU= zR`X{kQ@xIJv}*j0&c#wJrHvNH;A<+AH!p628U@POsHki46oMKq$kLz=o86C*6_>Pv zy~m{rBg+l&n(vN%z*>+3uk2CT5(cQWlRVh3k^3zf$C7Q^YtPxn4{*Gw`C-CgZxfZU zF-~|3qd|1}U6FE)(qk~pX1-i_29DZ?G#%gb{Kep{{mi4;vFZ)y!Qk_KaxR~Z4V#4D zw}wh#^I{WQpfu47jBzy^DJCCLc<(B^P`9YuT!((uRs=JoWo(Jo^3->FZ7{iY>ruxX z7TcIi2ps;KrMPu(mfa!v-b{|tCCUAn@KEj7v=p=C_e+8sQ*=u97&qkz!1QlVLf+jM zc`FW)OnVX$Ub>ew??n~S54lNQW%Jm%ZzI&k`;IU5CXzpcUSI9|aE|9v_9wr$5^{FKT1n3ty zWVTpaAzzG4FnK_zEH(|Vx)XKyEc%)tD{SaYZKRk4hJSApWbgcx*xh!!p%|xCIl>;c z(!4g4eZupTewz0Ym!qdHf1QDQ+wHCk@I5u>D@G$6`V4Q0b`jEZq|0dmxywcts!>W z)kX8^+6Em8c6*4e7}sslW5Ki#r5Y~&r26dxFB3r?@8PWjWo}Ct-4={|Y`N71gHVFq zjQ#n$Me44Hah=EvbU6GN%vRZ4Z6+(DOm6>r`Y-E8(>TUzwF^*#3Out1119jubY8sAq#&rtY8s+_i{W0v@GB^!gLvmnp zHkfdHUz!4^Prci0Sr@jJ&Jc8xiShLu3Zq3+dppf^Y-ZJf(m$Lt?Jo#Fq&qkdc~p90 zC;I#>VvA^)0A>X{``g7_EL?X6mR(*3Ah^*4sKFt|cPXA!HyGkrRl&Zbf zcz)NyBade_!lR?Td4Ai?h1l$9c8S9ydv63ktvs*$GiMWOzJJyHxtC3x14G*`U5$xW zcFR`{D+=f2;YCBfyIf}SZjJT(=dYxqN8;{v)SNj4p{G%@*{I#Bmqy1v#|eU0dTsR1 zXLukx2*k^C1XtG6Q>mu)D=ymeuuP>>D;{|L*)!}R;>kTkyfE|7ueFx=D*DWYK(5{R zGLVPOoZjZHmpA_I%x~Xbw}|azv9tbez68b;Rp6rcchZ zC@o!1sPufjx+syAdq15dV8d2Flcg|jvvAw;Q>LsSw{tA`St(%Bz)U~hPBF@2Zg?2- z3ucClm-z|~oC@`*$8INiXfKr;`iSZ8v3>YZA?O1h4`v7dzxnC0^N?J#eb%Q}_@9?E zs%eB1T-PoSqbGPfCn(%%IOk%%^*Xd)nHv-=(yM_wEp<@m@1#B*?ItGl5FRZwbGYtW zt(4EYY&{3ngmBAxc4qOVl9}aSfv4-q5V$oRAdvcH-z80vFKqu{)TDazQ`xGj zC_mkoBQ~%-a_`Q8Mk6PC+<*-dkeHGFR{u$pLAIR2;)mmiIyz2e^0kt34{nX&Xeb-8 zuXih7sSz|<{gb|J$Qbi(%x8!w5f7_~X8xBl5kuD*V0GEjWSEp6$DD-1+~w5mZS!C@ zIZ;7P>kz#nX}OxL2*2QGc2=~XHtcEy?rP^NpDw04oW0YuAILuq4x49r)FXa3_!Mbn zCsJ+OVawvT6=aHVBcVcVZFc!aCi(ghg4{em2Oys)k}qtHEX@Ef&lmbl;H!U2k#TQP zCDlfTol_q=EAA|_-h4FIY&lTQ@k@S>-oW+IKQ0k&+{<9T8siRuCJ^`|E^)5NNyMxB zTLu=Xp+|DRra>~CguCB17IN-975rONSfTw(6D=MRRjA$g{AJ_{^ivVr==L|O>@dZj zBc#;7Wj*BeZaRdnPKi-#>zaY|K2Qj1HDaOatvat5PXTnar>8uMuNbGOT(?!jNpGM3 ztYo_fN57f!6~Etw^j2&NBSHB(z5Az*4secxo#@x`pLL@4W1{-Fki8frIzik z?Zq>@WfK>l&Ow$>E_hpxcy%|3$AG{64{4QlbHc}G>Jp#XJlKJCqL!_f*`KV9I!_t! zrdyZ?%=PA{Hw}iFgE?$x!eYN3POiD`5;$J(t=ww`H=y&^0^8=p$JAk<^CVwO1; zn@LX&?hK;G8L)gFtiMjHc|Yg!jDm>fHEmX=`HsbM(Rj=4x~d3Ydp|$D`el9Pa&%)*QNd!7?Nm+7_+lUNZl*~{UL76`I1tHMhm^zV(|u1d|GC!GXa+fQjk&DWllX!V@% z-wwarI<{!jed*x>Z<3vM5KhzZJ42GCXo0k)M;osSO>UMjUl|~7e>^&F%bo^(>OSDf zA2(tc_fZ1=Lb1`X@N%3+ej=hICkOfSr?+We9Z=?!?cJg*cN<{wc-~?bveoWHTJbFvbR*Y&9>|2AU3RWiLpYz z)jsTYFuYUUX?}TiJ+ugTu@Fvz<=Xz?NH7&54%>q5+HqW30~g$!^!i($U)@ibWD}XO zTMV%5OiYo{6i=;PM`xATCNVSfDLkuY@gW-LWMa@0_PcR2hpBSty(Ia-x|k{FVRd=$ z(K+gAnySsRNfRTleNLcuwB-5^lLiVgm5LBX5ZuCxdUO@s;*Z=F3WrU(p6$B3|EorB z&r@WFz|&yXst82YO)a<3t>=}yuB2Pl1KH&RN+-d&! z7<3~Qk0c{T_b)D5(Z4Qhn}f6-?jrMr!h@!cD~HKPFT=x+U6EcBH$ZQn>a&YoHgG*DH??q2|l-a;qOns&a%IJM2~ke{8Ow}Zxh787@HCI)1U$^K0Auqt{T=IK=Psq(D$7I%nX@d>HXi=3hhTjG@ za=NFNwl=?s6C^9{<-nORyBVt>k+Tl!LWT%0!c;N4s+QuU#A-IKJ*BdfkJN_mmO9ws zR=7)~q`JGICAMUI^;sx{YM8M1y=-zTP!{6*h5rKSib$KKzIFZg<^unN*CnMGqv3qj zyoi#1u}Di4m5ZY6X5W;Xjv{vR6NQ#Gq*7$6&#L0De;Yl@)-gu z)i|8mXyZ}m(w^YPs2Ac!c5u6Qs7#hq_>arbBFU+(mzUeMP7~WiJ%o$UlaKsd5a)QT zGK)5|eBpG+z=Wn$B(_PR-UWUUmcoQvR!ayme%*ATn=PLyILcCY`}3oe4{pDc9v3=8 zYZq77SoToZ+h;!!7&kzC#}tW&H=a%YLGJLCy+Y&y(D~2hqXwe>L1Gsn2MN>tfztK? ziw%YrcML~=sfnIe5d1bR@_0VBUX)Q|_z!mvPBv|+(ZtK0GoAACmh8+HUu1ak=ls~n zrXoaS9AYIxn`KbEZ;)Hitn0Q<-z~|w(=vlmg?dtd<0xz~+0y;kV8+-3mmaPkPb1*r zLr7LF+b?=^A|)-9ym%HT&fcsD!YSnT<+mqs$a&WA zf3f$TQB8JhyJ!#<3&N{Nk*d<93kXODY0`UdDk2@EO9@dC5fG3ry-9CULkB@>klsUw z0HFj3C4@k-pS)|WJ@y*sJLfxVj6KHwv!6c>hw;hGocFx@eO*#9$bnyA&Kv$*0(WbC z1x#C5d%*A9Fmp_>Iy)Q%#PiLk=!54PX?I5}B7|JK=DfRqJum}Wa+bo0i3X0(^@~%< zp{|bnQd*MVa-0#%uXP-UcD}&wJuY0))9A|*;}TJOIjZ`Mf?QX(?^%&VRp75C1d~Rr zn(Y^OT;bmGYLH(6N)5vdblE=oVt(fH(Xl;VCZn4)lW%$?`)g!c`0Ktd$N<=^UwC)8vP&do$<*a{L9<=%I`8wp-XWB#ytL-j5g8@ zs*QJB9NP=`hi|gCZ;5EsE`BM3O^YkB#FM9u*)SFUrd70GmK`0; zKKebW+s6QQWosz+5{C>`d6@MP7OPe}+XVYk`9X#uCxNz{L{v7nkB#6A)Zltdbz`JRQNVxs(z^Z^Kf!Dsfq6umIhFUw@R;s?>8*RBK_`zPhsSFT=+NTB z+*;%Jkwv;C#yt+72U>G;&HBS;YT$oKah#84?>V-?GyMIZugp>|EasC#){-CF?$9o7 zDw8L`x>S6eXSP=6?VNvmu`KKEzIqYT=wk8?J|APgLPp6=7%{lvZs2`(30F*x5! znp7Xnd#kbDrAG-)k#U_fu+i_gON8o<$a=?dN%y5(owMRkx}2dlnO3=rTNN-Z7}w9= zy5i-9X1My2aSx4ALkmh%RwX!Y(SN0`zxGwFdGvlI^wziB7b#l&PfA2QGLoMvjG2AM}Vr~(gwA*xfu+jPBnFC_+FD{#@aDmwEG>5+UO1Bw!A2*gK*g0LLJr8J2Z#>`c-i(s&8edvpflk;L{Enghl+vGNFjl{} zBitmb3P-6MsHZ@wPDpbz>Elnf&jgYgk$+^Z`;hf!d2y@YLS>1hY>FXv}deldL~U?R`S16jp(;?0pP& zdN^hts=fCT0dJZ$La}F(zDQ06F)BI>`vv^ zudTl9YVBTKoGgbT)IZFfw&e5M>G52+re5eReht=zVQ!H_14(T)BC$@stsW3kyQ(6vblJHXZ~sFgpt|8uo#Hf2KfCx7-9p?6z&ZL7>n!tqyVOt(y24-|g8LDK#k zWTjl1OtT=VBAl|`W}P!T-y7D7-Mk>}ERYiZWqb{M9^Noi`g5n<_Z?PSG5Izvb?(;b z=uacGxoDD2nNYO5(YVO8@$#t8(zN+`g2$`{gTU5d+;CDT;gHq#k3jx;gPzS~dDI+r z1yxY2Z#3wS5v+n$68rTBa>c`z@Vn@oY*CP-#)M)g96OTuU|&}LZP2!F|bmboLN>E|K_(8vn2Y9x-3v>-4YPAu^y*5 zM1VeI7f-Xte9*p?Ku#z^@v)pzjgZe(ua-E7mo}d@`*Z5wJ+qJbCHmO%ISc@ zo@16X6aB*~KGt`LtXkIq`TbLp1-&$jobgi(^SD`*)yMw4A_s&X=Hl@83eRBBSr%>^8!k^bBNl=aT zmv7&hRZ91LF;64D>4QYfKj3}tL{XVSv05-xV?lb}ns>L@QS6m{69%%F^3?uoM4!~P z88eC)a^+k-eT-p>Bc}b^wpu`(Oo@|<#Xbm1!<-YSBwCDFvKb)!QbKp*l zbj+_TFvzGe|AQg%M2AKr8Nv$odMQmA3U766TI3YuAoGCp;BCgjjAKd-dZ zeplx4O4J9^XHw(J5Edl^gEe|pk#|0XL!0VtcTM*M&dIzrM_{h@!OBD9qN_%8TB<@; zr>^osZ&J-dv{Qs0DwY6)*%f9j#v*U){QSA+7Yr8_lNPu7(6yoQ3{8%mszVuI#YVcn znEAu!Z}pAL6f?^t4yE=>|JL?0*!Qsam(=dMCC&<|joni7YnRT6(?dA@ShQZy*b)313Ly_IJnwb5e<@R2l9* zGq;qVP@~06O*&&_;`sFMZLiqeNw{!h_*Utn`MSc$xi0srrnSXxbF*mSp&WbF zpW6m52)=tmJDQ^P6p0*(*}4_6dg;kBZBpW*DQgaM)2%ekSp~HA6~116 zivHTUZ}Me1#!UAfgVhRU-l(prX)h+fEQ{AO8^_(OBhw5V3~Z=9r|$cCfH2>rQ06zu z*tsnTevN$!Ic(pFH!R5we)BnLaaBT+pF?-d4t+nmaH2@f7psua=&BHEq1*-xPwOGHFm<6ci}YBYNIH@H&$t(=_d@Fm3MEq9iN8k%GSHjanzLLn!Iw92Yw$NNXFd7>Gj^%%N2%~U$yS@s{=?TApC&c59k z+*gu|t5*vLqeHZgn8bZd6cr1nD;AQoILs=t8?3T;2P?deyYaw^FCJ0g1%2{IQm@^M~xwXXvP1xcq{Qc zL_B_Si%OU>&B9`pBCq&2^g4rAxIArzJfb&6QAJ_7;8<2#7jdf>4%#>{3g^~xv24Dl z!YuaXY?x{8j<=52wVP$4)QJa*&*_0^w&|BMBPIOFi9Dz^%e3wwwk0;zlY0NRg}y; zv-_~W~`AQ!Ey&gb8n*5FEY`o}^2U)m237MsHslM8Q= z_1n=KpB=>s6E<}wLTI_#*b01t0}KOAvvgoAKUUH%sUH~4IPRaC3O`gP-!J#InCMa2 z9lb(MZ-JF%#E$Wh?ZitV(U4RkY8x=jy_Iw0E1ejBdqr)8$5-*~!DxyUw8lHEVa(?x zRID;jJQFLkpG$EXc_gP1;`-2w7|R_NQG;@D5owLeLt#YoOAT>9vxQFE_>v#vnu8eEjNYNPnQSLoLEUmB0yVL*Gyj+%w!Gl7`F+?mXC;!sL!0sInC%Artvr*Wh2 z9>VPnI9S9BCG_uyMJO30sMxnXcqaMSV$fg|x#{+*$~=;8hqG#E?NNewSaPiTH}*pH ztGQ|2h-bNeJI=r`dJ?ZWRl%(Q?wpEfqXD|iGrU-)473FI<%{G;O6Ip=?=Hrc(hSve zG3#{<7I2LYJ^9&~@0v~zF$~XoG`3tCjEstCIJnF?Rk@ic9+RXI zW9uNY{)XX#%;H?N#KM3hxLBng9^>s#xGiSL&0As?5}7GvgcnRCpvWCmRy+`AhxZix z{No3ID=U{rsTtj(JNyDGPl(|$W($v-kuDf$&5Kfh$sRW%wPnHuA-&V`I(0nYl`l(| zkEgD*rrk9cCQ-yaRbMGbQ-hi}=R5LXskRyBbg6e$euFMth-kNU*WT+lGVh=`ZPTPO z(v#^qA)jKk*=+kOCAqoFaG&Hn%cgrQ@n*{%aSlxy?@EIo7~3(^-yh(l<$thhbyGJL zvRBM3Y_+Ak(AT!bQ;L{yYSaiivsD#(v#}M=(IO-CkMaIssriNB>zsujNc=mjL7#`9&qP6{>!3jmCB`^a zOVRBM*EQxtz2ASS&kVD_K35-;PAr9|yBHi9g?+83x`*m^j(hlAce_GfqM8+*IuSOD zw|S$<ZJ2YZa5G{>Ye7Z**3>FrL5twiw~s;F(CtXdynRul}IDz%%b z`QxwPjDFu@60Gn4_AUgylEm5#j3TITA~nP7a)S*XO1f(2a66x^1nqKY zZ!LS^l~uaGt{LR2LhR>1LLtU|R~)sWlQKa}%8FmFy^T95xA?0T@%&xZ#LePJcPH6X zOi&A!e+KPlQdEjvfUV>1Kq?VGuF)IA6m8WK%+#zd@E@5Zu--oO8xHt%Zp(qpx5170 zHcb$S|Gz0QcC6D0-5GoYuPgCqq37Zh)I?X3KTo^~E@q%6{qZqQ<&Gvk`xo=1^@js5 zi;_YhoAg=*ZAM#^28*;Bv3ke@<8Jw(68`+JEDnu@LzUB%cZLc zVcfzNGT8;F3wBR!?er>vkIIeZ{sjV+c&WlgUCzC?CtaFO>>NK!J>70d^>?J297<1p z(xOc`(GqbpPOBqSO#jeGml5VWHZYqlqEfx?FtflaYbIq^NW{c#zeOC@NQr0rohR<^ z@M--7!jC=W7id`CtkYDzLcy@n0__|b?W*3`B2`TR9~!zAqQQm|5T#&5m$;W#kW6uUk)IM>%+pmEP;!ZR5LoY-30ylnUyt-Iqv952EBfe2N z=Mpe1Pt9V99!Qnt*sP+`+PuRNZM8Yo5E)X4h;swn z7C87VHg+(MtaU|hj*FCO2No}9Pdb48T_qIpOT z7)RSqV3qY0!2Fz!@H~DG5MuQ95#E2VEEm$ia(Q-$kbM zN!jK=m&v-lM7F0CH=Cviu`X3&tuii%3}?^BR>bB+{wk}P3h%p450kvoPZrEsFN#P3 zkdL`X#KM96Yy^7fBgn}A{S$o)Muc_b*YJJoQs;fp=^0 z2F_{22|#Pg32Je%QVNvxdUs$vqWl5}jVWoPu=>>+^~0LDjl_N~qlDjX7Y@-U3y{b| z>-~iwl{OMzhiLxOM}19;JE9a4hyG-d5K2O$vVg)mbxVi@hS2 zKO6&j_sCKfIb%%bK-3AYL=Z|7#Psq4CXv$JSsy)iNj;dK2Ugt^jPdcgEy>GdAte&! z50($Jw+R{#8innJ+U^M~n-N#k9S*EW5(v|Bi?SPDyU{#orK#|F6v)mq5ec|EURA#r`Wz2nZkW{3lTG#9jm*aODFL zfx{a9DIGHl-h?!1UoBuQ!yOA&d0qyRPisdT$?Bnw$ih3I_bJ3IzOu*Be3Hj`4ZjKi z`^N@hH#T_{Pk6m`NRiKeR{!qk#^&ZuAq@!R^!ME7hw)GKV|@SsZ`9Y1XBVX%RgnPpiu8+pJBh?73*X*@h|k3dLv*g4D1Bm(zBWHy`+aCNEPeheN?SZ5KApd!Uu1KQbT%tXhXhm) z*dY*Y-nwl+gctTpelMW=U%3D)d<)zsmR4&cElfR%5`EKob(b^KUP9ZXU=uCxhoTC5QEjm;I*@(S~CKS8b|yUKGTP|6(RJSLcXzekAXOvnEYkS^n% z2EZU2b~-MBD}PlI{bZgu5_=Ww z8Ut({9g;?piG1%857@fFbw^#DC zo&*G(|641inBSc-9MwGAYIw|&2S6ErBCm}o-N{KOT#81ngE+& zGs$oRab+lxnxtOwpDUFDa6%KWsD$X@o5tDPdsso5QGrWUbLAF@C3}aM!4x3CX9Qq! zh_~gxG?K)B_%8vB-hXCAdLHXZA^jUWD8-_7GZgE#- zBxdGY&R@Fvt7R;_ZZIx*w*2G3WxMQ-@!uCFDH&P}}!FWQz)lua}w}KW^;{ zjwImDHrV2T=b5gBN#VXD%iX12#CGoOb@MOWe=mc0&#pd1>PKz(-Aa?f=3nsSm=QTgeEFsE^s6E;sVzRJUSRs( zj4wf$2HR<(xG2Cl#2Zc}FhzGP-eiE_6VZwxN4;)Q%> z;qB~<6f}S6t5@htS1HLoVBz@FIBTH+a4Y_8Kpw#yk6)&P{d57uYq*)%&O`DX*#v>7 zvww$;eyiF8(@ddlG9PUsWkFpH)iolD$@%5j2EI!I@xM1~g9aj-Gf3~^yvyG7J zcD7vB=A!M6HezEM4Zu3CEs&C7cDxLeSOAm##0)Um_8`B$9u0Z0#G5zQZPxMM6-V&D zS}j|mx^8faLAPG&#RhDPq|Y{TA!^cM3f}tq>W#C4N@gh_N6D=nf1sb=6>EoS(vVP| z88vvBOa#5K-cy1@IgY_U-K2fx7CvBa`AJp?d-dtt6fS)LW z3o;TD)IzXoOXV01qr7dzen#xWxqy==)(xe!t-*T%28dmC;ta;0+eC5ssJB`!#G)s% z09MvQt+M5@u`?}{U-Q2&r!Nh1x^#AxE9m^7r;VBJyRXUKqyoxw!goQ0qwDt%r$#M` zQIh}{dFen1mQPd=TF_9=gTU7Ys_I4eVeEYfZhfwCsj1I4536oayILXC{V~hYvg-kS zZ?b@qvHD*-S3p@LMS+suj&RXO&wp$*++w7AQTD3j2!(CWrS$5*z?M{q+4%#wqCOL2 znyL*rD6`PjPq*sM0-qr{IA7?aQEZ+xNoa~5j+t==}8Yht~Dv_<6UKvvW-keJ=#F8b*s0cXfv#u9_XMk?8XE zEdI9*cfvQJ!*ERwr+_j)8vDF_crRH?`fStGUwMdL@Q}hnILP-fJ=SM$aNMi0$CzF3 z6PJK3PGI|w_hQF0r2&D4b@to!;N@t-}l35_1$LSn0oLj`QaVDQdnnhbe#1n*VzdPg`;?a7xZi|J9LzDsj}o z4*;f<3ywucxo96WI(3Ac@+i8m5Z3wT<2LR-KFvm}I~|9%;ykc|f0jb?qsT{}&(EF+ zHa6T7PO!4%l#*#EP=4OGy#aP}(c5f%^FdU2eHZVl>J@9DK%=$0=j~bCXq6fGRDbL+ zBV)lsG?DaY-ld(_tv)kcz8JS{O%9+99F%qMpO}~TZEbCj9V*U$YQ!75wf*P}L7YDX zf3ps7{}b325NEsmp|x|Z4YF8`sFP9X61k7yu)A(;jVWn8q6L)}Jq+N5(6t+Sk;G6$+OAgcGqY^^`gRSsz(_IVuM|S}xoy}Vz z^tIK^-;9GEQLP8327^HHz|2FtAN9tU#A@X-Gn+@E0QRR|_}8nN>XG&PmKhq}%W!EB z2)K!ZhxW)73Hvx`;&ord z%4+|>eqwf>$A52fO}GGX#FA+NcTVqN!fV>KA8F#pxD39sdBkdh9~%s>-{ak-lt=;Q zXPg9qghBx5@+IWX=r6dejIg1VOwf9~*NJn*`zQ~kF4%;yI4e7!u%_E1UJ*cQ>B-1K zf|YkmU5c)6OaC4m9P~o%w8pP;R*msFN!HzXn+HHWCjcg9>5eq11cCRi*y>=23Grf1b zJbYdPXao7}V>5aB+jT)ir1lrLfa7;$%T(-#9CdvjZ`Np_w=no$LX!Is^8!7IVx}~+ zrgx`Je&UkFfbM)lJelBb)%h7t9Xu-_=EL#s?!bJ)e-;M;jtcQf{a;YHiGTl3LaG19 zD}aL@w}o_!Oh6Rb^E1_+s}Bl{-vrq+TBM8o3UUd)xP)SnXtsN62Ow4^q_-Bz0TYW{ zJUk`Z0fPsbNV^ZtyUb%9K_!fyzNdKuBeGE>2VsA}qwoI3@@Hfk(e| z{55NcX*u~3xC8`t^h7^JS=J4Ap{QI8c-7Ce+Rz`=0XT-g`z%hnSS;&ZYl+^r%v;^d zKz0ZCczYuY6mK-f{s%N{-$z#NCWhw)fhLJF0Vcjr#C1V(RPpgaY9LT4fQkOzJ1k8e z;3Rk&Nb(OnAj|BL`=G4r{UeB*p!XvGn@|ko6wdZa2>y?E%C~j{Xi8hF2}|6OgWTTZ zWD)+}n-&ct6Q)#zMe7n@!0;NYJ^-8#Qsg~Gp)5~Kv@u_$)EsobXDG;IeQoo!D3dV4SJoFHvhz&##n$q z05W4735dE}@I6`HK*+PXjMdOR0Iefm8jhd=f)eco3^cROwZ`kaSC4(ef|F`n)&2*l z^FrG;5O$)>k^qcG8(-NM0&xmI#Tgcbegs(iy&QzB0|pdiPt-vmdgbSGO}D{r87Irz zV!qqQ6+IaYk{f#-Hp*I)sCtE5H)ak2Np7Y+CZY2N0lY0zASnVD@+r!1HMwWcZyzQ9 z5-KH){2=xxwO+!>2i&l=YDmC(+kFMr{db44T<5#(m;$YhH<6pZhu?-5obYosvde{e z7kO7$@-|*;wFNkb8F);f5%2t#RbZl} z4y*HLxrPyARYNB9p2t{WnIKQQIe9<7 zv+_pf#nuSm?J*}zLm84{>ywf3y)lZr`YXGKijf5+a_wa?%S4U*9IU* z_2;d^adWR{`X)&O)PCpzUSBy8nBe{A+Xs+p-ka&OHBENIE{PxhSd}w-w3dCp?GH$` zpS>mGiuiC8_;Bx_KugU|bCA0>wfZDCS-^2(5M8W-YMvTxfNY==L$bBC2YUPN0M5+T zKeou@OM0M+A|^{~9`1YOW+ATPj271kAmUwZ5(!;L}sf$j85v-6nQIMsVamkOb$1Uz?n((f9!sYH61 zN7tNNLXv>PT_Xt-u!)@{$by9EhCcbqjWnKgng!P$$$AK7znam}JO6XWBDy)+p;8-b0Me!5%kHO_{%KSOUEqL`{P;gD#XRXtUoP`UL?;m7T_Wp50aEaHYS9vI z)T$kw{0Nk#>i1@6?Y&X!zdVR1z}orqNQXapQP|63qkw)v9a3WVPw&DY9w*MC%_3rC z1<*Zy=?mq;N;Vm~1$7+U06D(=|4hCz2v@@Z^jukIEZ+k@_6L08Z8`$P)S&m|WnAqo zw2Sb1;%(_*$q0rAe}lqzS2_O|emOAa3mVsyDQniXO9XDC{Uh>NKt}#kv~A-5c=7*_ z2NZ~VKy}2#B=Gzn!UzIRu07>whnxhY8COvNC?R6v7qtBpOw{0S00{U0gKHz|65#pI zQh>z&@o(_xOG0V=*$As{XHAVQTVGTpH&Eul6_(g0p3KM$w5)gvyx1SlZ3phD#b zfQxjOhPoApopV@acAd&E%j@!*eBy@us0*DJ{IQtDooBMAtf0G@sp-t}X)bl-y=1%A$aDN&^q}*|$_ggI@}t7e?(SkT zM&4rOAiP_J<@@P;W9C``&i2slHmmY27Dl5=$4Q1E#P*HiwmQfVw*61nL>2FzT97aL zV@^m%L*Ah}Au!it$oCDwItv2lPTjt7oGfnY5_rzU#0VUkoc`ZF;Tq$+?e+(I1GuRI zw{!J^sSTR7{z!l?gN=>T)FU^ITH&LF(NUXi`%QM(_xXW?WumWOZvd$UKIjX#jE$gNVKiire3*B1y5h`)#nKJF)PaD*&aFLErEzBY`TnZgIuw1B zNIUr2F6cN~n}9p$2saeA&fJCf7kJn;kmL8*t=HEObtjGq$>|d0@ceE7@^px@qi z6P-8_dcn226Os>uTZtnOml_vk|YD}`O-{IWH^AFNEBdK`b zT4A3dI|8;UM`^GzF@&sRuVv#TCec=0wG}_E9`ZRSk-L`NaL~GLANA7r$|(Sj5SJM+ zH>x?fA$hX5Ku5K^yL^nM8j^U#l>ZeAM-B+H@Sc_?6inTWzGzu7T}#=AIvGp+zLoZnE45 z`Lf;!D_Cv;)iVpyBpI*>fCRU?}YgUprJ2kzs|(V7e5{4K-=`4b{g{ zU={?6Jz$AU5F=h5>i#5VF}o>S*)k0c8Nq`EvH&j%&8Nw)g_3!htlsV1Q^`|MUUz7C z!z0Vc5af0q_FKg|&DNBsVED`J+@Kl8W7Ih%0l!I==nnIpm$1O=BWwXa4`X+3R>L4G zzXx219~SFnRYv?^${oMf$=&5Geu(^i+H$}?%jFV@3AXW2_Y2H+&>h{jEjn6J(PHhs*s}4QR!Gn96{Mi1c zaB2UybA>oDd;?ZimKS2%y#rve)!DlTZCFZv>V*WnAXfF;2SLuJ~Lie z=DTo{NqJXVW-YgcJmNM!G&)&hJfuTTW%^gzG%azLXyp~mLpG$*&(zMiG95|ks}^77 zq^G5=t<(VJ7m?Gp^Wrd$grQU5L)FP_I2_C-gC1?rbGJ*rH)v`iLut}+Q zpAxYD*N7>-)=L+c{JoK_tUlW3eTp`!mBmu={e4Ch$=$D3KT;EtMf@5WuM{*t*5{{( z8kCfwepe)D^C@KU|?9Q7S870PMa6{iUHkr@E)1l-Hg0D>wiQ2Rf-Mpc` z@%V~F0ep{VMHqT5@X5g`aQW`&Yn|8nPDxf1hUSk0OQn4tTH%{C;OJ%Jld!+3fZ8=c@RlCLD{ZYFl_ex!~d93war ziwby|Uir8svDzv__1|Aq1Gp3z6;D5=#HJDYO7RS)THSl>afC`-=Xe1^f#kFVlIe7l7~mE zBxl}mn_FcrTyUD&tk_)U?g0o%%+5X_W-;I=;HD@5B1r}xqqQs9OPTro>2a>oVceLO z>6?~Vs+}$Chu{`4o&h_rkjwJTy!EW7z>vG$WB!=sPzDH~x|NK5&J|aH`{D0Bd6*t7 zVKn#gxp5)x3}@Tb)itEy_sVW314wwiBn>rK*jg5(^lJ?0Pi|hRQ`I#Wb1-u}!))r0 za9SJxg@sEr^zs(01WBKj;=sY7CAb|2?N&)bC!ZvNylpose3*a3G4I(y7j%(P!e?zr z8e+Kf@^lFHlSk+^tK zngKxZXO>r7zw6?z+Q*RD%tK}@9@XC`da{}QDNa>D>cs24HG`)5#uiTM-Ok&A@?A(1 zM&55XdsSr(fqG!6pwMW9O7oYn)G9Fdab*~;9$Le3OvB-v=@Jd^CLp_?=2>kBljWN5 z@Qfx(lzAn8HxpJ; zFTHnB*HHIxDXQc(Ze@S>?{qT9Q@?}i+ zCXgMV2ICLrw)3kw{B{=$25K}S4E4+!H-_=`pKLhw_0e8fi54pqp?gfAuXcqc$n+4# z(&pC?upso}?X;!>BNJmJdzZ@U>Iq|b0?)wh&d$Bo3w}RJz^-B4)-WEKO|C7LC<`q6 zMdj*{wW!J;zx9N#17j87Bdy&E!mb@bJF5RI=b3s9-gQ1&*Icx(Yq^I*qtfdenQ zadW;_MKizzd$?8G=Jt&?BlW}}0a>L8biuItcCr5kITOh;sepPt@GDKPOq)2ztGDKS z0Q{hSh@?5sO;{y%$286?uZ}m9N3y53_8&x?9K={POZnFKAf;O)Qyn9}JU4(^_Q*F%SiBF={04lxm@>Hk zlHnO3?CAg;DPZ$&jhV&;zAc~gxDx6Ms&@qpQ3`p0WB^tJNbk|#!Um{fmxxL8rT13= zGNq#yykXFyfSVT3^Gu%#n8jI`%0`JyhqVz9Jpv;X0L7?G(zn{5ZrNgYZxC4@#Wu~S zr@%6O-W~toj8rZ_8{-p_68P?Zeg$OxpU{84lM8(NJCiXI#(#W*LqR6V!$5*g{VUMV za;?`|tv}Q@00)!IWTPXk{{SqH-bz~Al^?_S997{w^045(3b4)(jFzqlv|HyxPSScJ zT~&GJ?9dx->jy?-_a&5Wb~RL0J-qsiv^~=3HSZl;+i)5_ZZk&-uc;uC$MUr8#{g2z zaQt@_d7k(yAy)uyP6Y%lbuZcL6`p_4!-mC_-15oc6&3(?#P!?2oJPRQsT@5lEhyzO zk(jPX4VfjAn}x6?3#l^T?gNH60V2>O^Ka&k+}=8m9L064En2U%?1n3;K^nsdTIVtVEn?q}Fh}5F)9GI`! z^*S==;f)j{#$hkWm*^|UXa$qV-#g`$mX>Dh8k+ShCQld|C8_@y1=P4JJv6a65%@JO zcke}@kFX~`9YB`G!QtD%kjNEFVBt=m01ihphkX#QV{bbE^v{>5w!6D4UBk@H2~F)KtVV+)nk26@}8|5wo9_ zr(!*>17~)dxTr$;@b(;L(rf`|Th|!v`N4#Q^aSmd!9GZW;S4n>i^k)1Ei{QxWB-6) z>&6L*v^VDaI(fKd-QNbHe-HvV<|;BS#a#9MoXXSm@59#j% z}LQ zRt@v6S*R>S&we^O<-O4L?1T23(spK$Jh43f8Z$}uY-*ycyyCv?OA73N51X-ua6XZeX^j9+&E~i5HI6$x-!f=&gnQi5dep2w*AB9v+z7_3)9t%thFY$(2w{@V_QZMUXH(1 zT1WMjul*>H;WQCR_m~h`RY%BzhR?@0tz5)+WLbn)5|nDDDg@~KEp+`y$@b52}X}m_vG~58y=uN$k?WYFZA$N{w89!;Pj~- z#LoS^XEIJ5%(vyIDNx`HN=cT;4=#7;9S~7(du;=n0t!z6V=jT5m%nW*;L1xnP)ecy zpKF$Tn>_rS7nkH#flAlg3k!Kb79>d{N*K>Ac7H?ya)WG~yYFv0Vr=o|45-9q9ROOn zzP#M~YB`vb8g_ggnifZ5zp&L>eH%$DR}G{+hU+a{uhOim7CSZ%C;b`%>C8-!f1=6h zzMfgZdvU4#7>IG+woF)Erbz-0?~kB~#mJH!`tkeqwW^1k)QZ;b)W{?vyDm^kttTnx zAdR3Ga@1taQIfvVVI(;fl}5hQ?bv=~;;ToU#N-a}8q;$EBBWfL_$}~C-ctB2p2P~F zUmjamvs6nq@_FkFDIow@XeT}#L5ov^4fm1Ep%U`{AAklSn_p=C|ibX4g zZ8zwxCSb?_7Us+kN@c%l2S2_&ZZTAO46tZh*w!_tZ1Mp3;q=nLmoXr@g?|?MlGhd5 z(UrGCK=$2Rl;rG-A@G&dz;;xYd#VpBE0(8SIsLMuBS= zMO;sb_SJH2C@giiVYZJY24D*JHg(6W7~P@=3ML?WAejf)Av|!R1*7I|u7=R!?aMKr z$g|uVs{+m86buq$u|SE7NJ$&11bkWjK#lXreNR)7Q!WnB6Xv8;UEn1t4~Z{Xs}lNI zpJoDIBCg{DPegu_uL?V`if%x4X1NzZuF@p=jkq0`mA^0t*^icUL|Of+13FYA|CSfe zE5`d)GfHg<(6Z|XbaG=Jd_tTfz(E7TGW^`qh^zh;73>*lzR}<^Xu6a~2IR4JdDwmi zNN$#vug}4rWr>Gd5ZZ)iOeIfHQg7G3#vx5YvE$%e_RNrQ4KJ`R5}HoLck&Om@CE zl^NO9MJamj2-ro8k@Ps}Gs?PmXwn?(*UAaLJC(-ZxOMk*pBg zx2My(eh&l$Dzu}mOvS~|9)fjsM`o(+YRwKAn%&lFg+%#1MfGL{ks@r}~z-ql$`(;zAY#g^3#1c}t|93$5IVhQVAe z;N&RTLhy?KEY~xMPo<{^lC}M+u8Z}yp15|OwjO79PjAf0QLMSY&n^&NwATM%Lnmbh zgr4vYZ?CSb>Wz(=)%?UbAXbqmT|{kPj;I^G=$fc33kxSFC+f!J50Q6z#I4~bZq3)v z;lB)h?5St!M`B6g;Vf-#Q*|yrR(0pY3kz0S2@q%a*2>C5&c-gDM6*Wk8(Y(Yg~1kZ zFJI4!X6ynfPC?SwFp>7Lll$8A$S}X9c0L~I*%;CCi?d^imn zmq6(Ka1P~bgSj7-zhs>~Ju~)NXy#Lw4kVmN7UOxRilIJWY>Fi%(7$DQv@*rS}cQuX-hErI$40TcvS8SUKC^=8GeN=vqSo7*}=>(hCCOWkxT90Adxae;7zlKz(3zB*^_iPW-kugBvO!7fI+q8s6>XeM*D7zNMecMB{ z*5!LCqM{0_g}}|`Oj7>uI>40QN#E9%uv0RMv(dW2$u1iO&`65^(#m|QWHtEIbGCDS zULN^YN^p7epgtTkItvRJ4Ti+AmY-|kjy79t_V~q%`YV=G5$e3!HDJtO^+rFCIFfbP z8Bt)Gz0wzBRsN3bw6;=;c#q8EeIKWbba8gGNcjIyFZd?wi)XKhZM$uPfma9@NYyzJ zn2~d)*n*?&JzcAegV`*+y0iuH~-t65ccC8#LlYXElzNm32-%e>KSPLiWvyCq&rg z#E0w9C*{oVdElo#`Awhak;r9T{ZLJFF&JbmK$`CJfyJ-iG3bYa!1R!+yWYu+nA zuT=8qtE^F$z}u1f-rcLY^3yW_L8k?GLSuuUl+a5(EBRJiPl&Z_rjZO9BJbgx2n`p! zTkAsgf|tLpluz2JSf~&_(S@j1$~3=$44_QZZZb5=7vOEaNQ7T@zSBSpkh=2@gHl8} z0_)_>>w50qT?+{Cr@j}lwzb)|4zBTBL>2yFK!ohfrS(fUg?J@ymrzpzsgO(Dx9*gO zHCWA#NSzty>D3-nKE3N(KiXf#pWgVpi$zjT2H%h`Ek!4|J}IxDRHnwJs=NJs=cR%x z_$2@rN=~nrXE}H{Nb5M;<~B1|=1F@vQSaj;-T0||u|8Yld)uAZHYS~t36DNwe%8H( zHeXDubeU8$a1SSd{6-m^FfcF}k9$`iP;+o>%*}-MZp^T3GWW5M{jp^%g2SF(?Bd;7 zL+82N_ysiT_vA_7oxf=04&?w>RajngTDiCOPp7*|&%C719|2kDPqz`M-5yB`uFu=d zn05*z3$e^z_|sLJu;IHI``Xh$7YhRG@h@- z#+Ih-aC;gpQj1zdop~Iae0Q4ak(!$?Yt5LO+j*!kl3c1GK&efVD!+1NcmSvZJrPUL zp1RigC)zA8L+E8}Zg4K66T(*f!l+azUF71VXAdwN&y^x92I4y%NBh_s%mN;=n+}#I zmY6uXKSsT6s@v^e0PkVJDH?!9<$l0bX`>SwE(2W@8nAy9i{appOPe+iNbcO2WPTT>K+d~E-t^D9 zF0oc8!AlDtAKallm3hPJu-B{hPWn0j$%>on)8ETqUu!wHGVKzx@RM7c=BPhaxwAfe zewW?OpFjWqO`uifVVlXtS* zuJ?}B)z$1vi(VXXoZDo*_Sb!W+g+v8>zPz1nXI^fVE*E|mv=rs;$K*_<=n~BH@D`W zZ;1OFr6E%P=WF`;yyxt$?5x|uwWgd7)4gt$y?5^(f3^8jzS}>3m{}xP{jgr#U(){M zr1=+@OsrtM!3VzohC$j*E3e2buhXvN%ZCZG^U4COa&AfKhFgRJ*Ct#$dit`rU+Scj zCOIe8uCDvHa>1lzcgvbpG7Z|lvtBCg^svi$ zk^4V(>z<C$J3&WDW7&57Io@w#K}@A7w7Zu;4oYg}1>bHlrR zyWd$BJh^c3NAf(md2_8xc=E(mwy*#3vAWdzv*-y{R#v;UQTN5|q84~6zGm7`2y7bf z;8~Iyv(YGU+SIvk-@Z&u4UL=`vwPi+SmA=m6I&Pp>VZmtpuzWnnFokL-KBA$O=%Ra zuER9q&;K{q8$sqaDAd1p)awSaA_NkEq!^0?P>_`oxa=#z5i}q-DojC`C;~(D|9|sX h-lsqY8>sMNX0Z4rwfwMQBWS9N!PC{xWt~$(699}KvUmUh diff --git a/frontend/playwright.config.ts b/frontend/playwright.config.ts index 58ec8c4..586bad4 100644 --- a/frontend/playwright.config.ts +++ b/frontend/playwright.config.ts @@ -2,7 +2,7 @@ import { defineConfig } from "@playwright/test"; export default defineConfig({ testDir: "./tests", use: { - baseURL: process.env.IAM_PREVIEW_URL ?? "http://127.0.0.1:18081", + baseURL: process.env.IAM_AD_URL, headless: true, }, }); diff --git a/frontend/src/components/SubmitForm.tsx b/frontend/src/components/SubmitForm.tsx new file mode 100644 index 0000000..b5eee3a --- /dev/null +++ b/frontend/src/components/SubmitForm.tsx @@ -0,0 +1,23 @@ +import { useState, type ReactNode } from "react"; +import type { CsrfToken } from "../page-context"; + +type Props = { + action: string; + csrf: CsrfToken; + label: string; + children?: ReactNode; +}; + +/** Submit a browser document request; the server owns authentication transitions. */ +export function SubmitForm({ action, csrf, label, children }: Props) { + const [pending, setPending] = useState(false); + return ( +

setPending(true)} aria-busy={pending}> + + {children} + +
+ ); +} diff --git a/frontend/src/main.tsx b/frontend/src/main.tsx index af38606..0125aff 100644 --- a/frontend/src/main.tsx +++ b/frontend/src/main.tsx @@ -1,192 +1,8 @@ import { createRoot } from "react-dom/client"; -import { useState, useLayoutEffect, type ReactNode } from "react"; +import { readPageContext } from "./page-context"; +import { SignInPage } from "./pages/SignInPage"; import "./style.css"; -type PageContext = { - step: "identity" | "verification" | "complete" | "password" | "mfa-pending"; - identity?: { username: string; objectGuid: string; email: string; groups: string[]; groupDns: string[] }; - name: string; - error: string; - action: string; - csrf: { name: string; value: string }; -}; - -const context: PageContext = JSON.parse( - document.getElementById("login-context")!.textContent!, -); - -function Form({ children }: { children: ReactNode }) { - const [pending, setPending] = useState(false); - return ( -
setPending(true)} - aria-busy={pending} - > - - {children} - -
- ); -} - -function App() { - useLayoutEffect(() => { performance.mark("iam-page-ready"); }, []); - const [showHelp, setShowHelp] = useState(false); - return ( -
-
- - iam - 预览 - -
-
-
登录交互原型
-
    - {(["identity", "verification", "complete"] as const).map( - (step, i) => ( -
  1. - {i + 1} - {["填写称呼", "模拟验证", "完成"][i]} -
    2. - ), - )} -
- {context.step === "identity" && ( - <> -

从这里开始

-

- 体验一次完整的页面切换。先告诉我们怎么称呼你。 -

- - )} - {context.step === "verification" && ( - <> -

你好，{context.name}

-

- 这是第二步页面。输入演示码 123456{" "} - 继续，也可以试试输入错误的演示码。 -

- - )} - {context.step === "complete" && ( - <> - -

体验完成

-

- {context.name} - ，你已走完页面预览。这没有建立登录身份，也没有向任何应用授权。 -

- - )} - {context.error && ( -

- {context.error} -

- )} -
- {context.step === "identity" && ( - - )} - {context.step === "verification" && ( - - )} -
- {context.step === "verification" && ( - - 返回上一步 - - )} -
- - {showHelp && ( -

不是。这里仅演示页面交互，请勿输入真实密码或 MFA 验证码。

- )} -
-
-
独立 IAM · 页面体验预览
-
- ); -} - -function SignIn() { - useLayoutEffect(() => { performance.mark("iam-page-ready"); }, []); - const identity = context.identity; - return
-
iam
-
-
AD 登录验证
-

{context.step === "password" ? "登录你的账号" : "密码已验证，等待 MFA"}

-

{context.step === "password" - ? "使用 AD 用户名或完整 UPN 登录。" - : `${context.name}，目录验证成功。第二因素尚未接入，本次没有完成登录或向应用授权。`}

- {context.error &&

{context.error}

} - {identity &&
-
账号
{identity.username}
-
目录标识
{identity.objectGuid}
-
邮箱
{identity.email || "未设置"}
-

直接所属组

- {identity.groups.length ?
    {identity.groups.map(group =>
  • {group}
    • )}
:

没有直接所属组。

} -
组 DN
    {identity.groupDns.map(dn =>
  • {dn}
    • )}
-

当前仅读取 memberOf，不展开嵌套组，也不包含主组。

-
} -
{context.step === "password" && <> - - - }
-
-
独立 IAM · AD 接入验证
-
; -} - createRoot(document.getElementById("root")!).render( - context.step === "password" || context.step === "mfa-pending" ? : , + , ); diff --git a/frontend/src/page-context.ts b/frontend/src/page-context.ts new file mode 100644 index 0000000..70a0614 --- /dev/null +++ b/frontend/src/page-context.ts @@ -0,0 +1,32 @@ +export type CsrfToken = { name: string; value: string }; + +type PageBase = { + name: string; + error: string; + action: string; + csrf: CsrfToken; +}; + +export type SignInContext = PageBase & ( + | { step: "password" } + | { + step: "mfa-pending"; + identity: { + username: string; + subjectId: string; + email: string; + groups: string[]; + groupDns: string[]; + }; + } +); + +export function readPageContext(): SignInContext { + const data = document.getElementById("login-context")?.textContent; + if (!data) throw new Error("Missing login page context"); + const context: SignInContext = JSON.parse(data); + if (context.step !== "password" && context.step !== "mfa-pending") { + throw new Error("Unknown login step"); + } + return context; +} diff --git a/frontend/src/pages/SignInPage.tsx b/frontend/src/pages/SignInPage.tsx new file mode 100644 index 0000000..f565cdd --- /dev/null +++ b/frontend/src/pages/SignInPage.tsx @@ -0,0 +1,54 @@ +import { SubmitForm } from "../components/SubmitForm"; +import type { SignInContext } from "../page-context"; + +export function SignInPage({ context }: { context: SignInContext }) { + return ( +
+
iam
+
+
AD 登录验证
+

+ {context.step === "password" ? "登录你的账号" : "密码已验证，等待 MFA"} +

+

+ {context.step === "password" + ? "使用 AD 用户名或完整 UPN 登录。" + : `${context.name}，目录验证成功。第二因素尚未接入，本次没有完成登录或向应用授权。`} +

+ {context.error &&

{context.error}

} + {context.step === "mfa-pending" && ( +
+
+
账号
{context.identity.username}
+
目录标识
{context.identity.subjectId}
+
邮箱
{context.identity.email || "未设置"}
+
+

直接所属组

+ {context.identity.groups.length + ?
    {context.identity.groups.map(group =>
  • {group}
    • )}
+ :

没有直接所属组。

} +
+ 组 DN +
    {context.identity.groupDns.map(dn =>
  • {dn}
    • )}
+
+

当前仅读取 memberOf，不展开嵌套组，也不包含主组。

+
+ )} + + {context.step === "password" && <> + + + } + +
+
独立 IAM · AD 接入验证
+
+ ); +} diff --git a/frontend/src/style.css b/frontend/src/style.css index 3318073..8cb080e 100644 --- a/frontend/src/style.css +++ b/frontend/src/style.css @@ -29,15 +29,6 @@ header { .brand > span:first-child { font-weight: 400; } -.badge { - font-size: 11px; - letter-spacing: 1px; - vertical-align: middle; - margin-left: 14px; - padding: 5px 8px; - border: 1px solid #b7c9be; - border-radius: 5px; -} .card { background: #fff; border: 1px solid #dce4dd; @@ -50,39 +41,6 @@ header { color: #60746a; letter-spacing: 2px; } -.steps { - display: flex; - justify-content: space-between; - padding: 0; - list-style: none; - margin: 25px 0 32px; - gap: 8px; -} -.steps li { - font-size: 12px; - color: #718078; - display: flex; - align-items: center; - gap: 7px; -} -.steps li span { - display: inline-grid; - place-items: center; - width: 23px; - height: 23px; - border: 1px solid #ccd7ce; - border-radius: 50%; - font-size: 11px; -} -.steps [aria-current] { - color: #215542; - font-weight: 650; -} -.steps [aria-current] span { - background: #215542; - color: white; - border-color: #215542; -} h1 { font-size: 27px; letter-spacing: -0.5px; @@ -144,42 +102,12 @@ button { font-size: 14px; line-height: 1.6; } -.back { - display: block; - text-align: center; - font-size: 13px; - margin-top: 18px; - color: #476a58; -} -.help { - border-top: 1px solid #e5ebe6; - margin-top: 28px; - padding-top: 20px; -} -.link { - background: none; - border: 0; - color: #5b7064; - padding: 0; - font-size: 13px; -} -.help p { - font-size: 13px; - line-height: 1.8; - color: #6a756e; - margin-bottom: 0; -} footer { text-align: center; color: #7c887e; font-size: 12px; margin-top: 28px; } -.success { - color: #245b47; - font-size: 30px; - margin-bottom: 12px; -} a:focus-visible, button:focus-visible { outline: 3px solid #a9cbbc; @@ -195,12 +123,6 @@ button:focus-visible { .card { padding: 26px 22px; } - .steps { - gap: 5px; - } - .steps li { - font-size: 11px; - } } @media (prefers-color-scheme: dark) { :root { @@ -211,28 +133,17 @@ button:focus-visible { background: #1e3027; border-color: #344b3d; } - .brand, - .steps [aria-current], - .success { + .brand { color: #b9ddc8; } .intro, - .eyebrow, - .help p, - .link, - .back { + .eyebrow { color: #acbfb2; } - .steps li { - color: #98aa9e; - } input:not([type="hidden"]) { background: #18271f; border-color: #526657; } - .help { - border-color: #3a4d40; - } .error { background: #492b29; color: #ffc3b9; diff --git a/frontend/tests/preview.spec.ts b/frontend/tests/preview.spec.ts deleted file mode 100644 index 7295140..0000000 --- a/frontend/tests/preview.spec.ts +++ /dev/null @@ -1,95 +0,0 @@ -import { test, expect } from "@playwright/test"; - -test("原生 POST 逐页导航，内联上下文，浏览器缓存静态资源", async ({ page }) => { - const xhr: string[] = []; - const posts: string[] = []; - const errors: string[] = []; - page.on("pageerror", (e) => errors.push(e.message)); - page.on("request", (req) => { - if (["fetch", "xhr"].includes(req.resourceType())) xhr.push(req.url()); - if (req.method() === "POST" && req.isNavigationRequest()) - posts.push(req.url()); - }); - await page.goto("/preview"); - await expect(page.getByRole("heading", { name: "从这里开始" })).toBeVisible(); - const scriptUrl = await page.locator("script[src]").getAttribute("src"); - await page.getByRole("button", { name: "这是真实登录吗？" }).click(); - await expect(page.getByText("不是。这里仅演示页面交互")).toBeVisible(); - await page.getByLabel("称呼").fill("预览用户"); - await page.getByRole("button", { name: "继续", exact: true }).click(); - await expect(page).toHaveURL(/\/preview\/verify$/); - await expect( - page.getByRole("heading", { name: "你好，预览用户" }), - ).toBeVisible(); - await page.getByLabel("演示码").fill("000000"); - await page.getByRole("button", { name: "继续", exact: true }).click(); - await expect(page.getByRole("alert")).toContainText("演示码不正确"); - await page.getByLabel("演示码").fill("123456"); - await page.getByRole("button", { name: "继续", exact: true }).click(); - await expect(page.getByRole("heading", { name: "体验完成" })).toBeVisible(); - expect(posts).toHaveLength(3); - expect(xhr).toEqual([]); - expect(errors).toEqual([]); - const timing = await page.evaluate(() => ({ - navigation: performance - .getEntriesByType("navigation") - .map((e) => e.toJSON()), - resources: performance.getEntriesByType("resource").map((e) => e.toJSON()), - })); - const script = timing.resources.find((r) => r.name.endsWith(scriptUrl!)); - expect(script?.transferSize).toBe(0); - await test - .info() - .attach("navigation-and-cache.json", { - body: JSON.stringify(timing, null, 2), - contentType: "application/json", - }); - expect( - ( - await page.request.get("/", { headers: { Accept: "application/json" } }) - ).status(), - ).toBe(401); - await page.getByRole("button", { name: "重新体验" }).click(); - await expect(page.getByRole("heading", { name: "从这里开始" })).toBeVisible(); -}); - -test("移动端与脚本结束标记作为纯文本显示", async ({ page }) => { - await page.setViewportSize({ width: 390, height: 844 }); - await page.goto("/preview"); - const name = ""; - await page.getByLabel("称呼").fill(name); - await page.getByRole("button", { name: "继续", exact: true }).click(); - await expect(page.getByRole("heading")).toHaveText(`你好，${name}`); - expect( - await page.evaluate(() => Reflect.get(window, "__injected")), - ).toBeUndefined(); - expect( - await page.evaluate( - () => document.documentElement.scrollWidth <= innerWidth, - ), - ).toBe(true); - await page.screenshot({ path: "test-results/mobile.png", fullPage: true }); -}); - - -test("受限网络下首屏和缓存后页面切换计时", async ({ page, context }) => { - const cdp = await context.newCDPSession(page); - await cdp.send("Network.enable"); - await cdp.send("Network.emulateNetworkConditions", { - offline: false, latency: 60, downloadThroughput: 1_500_000 / 8, - uploadThroughput: 750_000 / 8, - }); - await cdp.send("Emulation.setCPUThrottlingRate", { rate: 4 }); - await page.goto("/preview"); - await expect(page.getByRole("heading", { name: "从这里开始" })).toBeVisible(); - const cold = await page.evaluate(() => performance.getEntriesByName("iam-page-ready")[0].startTime); - await page.getByLabel("称呼").fill("计时体验"); - const start = performance.now(); - await page.getByRole("button", { name: "继续", exact: true }).click(); - await expect(page.getByRole("heading", { name: "你好，计时体验" })).toBeVisible(); - const warm = performance.now() - start; - const result = { network_latency_ms: 60, download_mbps: 1.5, cpu_slowdown: 4, - cold_navigation_to_react_commit_ms: Math.round(cold), warm_click_to_visible_ms: Math.round(warm) }; - console.log(JSON.stringify(result)); - await test.info().attach("timing.json", { body: JSON.stringify(result, null, 2), contentType: "application/json" }); -}); diff --git a/scripts/native-smoke.py b/scripts/native-smoke.py index 0d7ad00..c51c2ad 100755 --- a/scripts/native-smoke.py +++ b/scripts/native-smoke.py @@ -59,7 +59,7 @@ def main(): def request(path, authenticated=False): headers = {'Accept': 'text/plain' if authenticated and path == '/actuator/prometheus' else 'application/json'} - if path == '/preview': + if path == '/signin': headers['Accept'] = 'text/html' if authenticated: headers['Authorization'] = f'Basic {basic}' @@ -80,7 +80,7 @@ def main(): ready_seconds = time.monotonic() - started assert request('/actuator/prometheus')[0] == 401, 'Anonymous metrics must be rejected' assert request('/')[0] == 401, 'Anonymous application access must be rejected' - assert request('/preview')[0] == 404, 'UI preview must be disabled by default' + assert request('/signin')[0] == 404, 'Sign-in must be disabled without directory configuration' status, before = request('/actuator/prometheus', authenticated=True) assert status == 200, 'Authenticated Prometheus scrape failed' for _ in range(3): diff --git a/src/main/java/top/ddupan/iam/login/ad/AdPasswordVerifier.java b/src/main/java/top/ddupan/iam/login/ad/AdPasswordVerifier.java deleted file mode 100644 index 235ab76..0000000 --- a/src/main/java/top/ddupan/iam/login/ad/AdPasswordVerifier.java +++ /dev/null @@ -1,153 +0,0 @@ -package top.ddupan.iam.login.ad; - -import java.net.URI; -import java.nio.ByteBuffer; -import java.nio.ByteOrder; -import java.util.Arrays; -import java.util.Collection; -import java.util.List; -import java.util.Map; -import java.util.UUID; -import javax.naming.NamingException; -import javax.naming.ldap.LdapName; -import org.springframework.boot.context.properties.EnableConfigurationProperties; -import org.springframework.ldap.core.DirContextAdapter; -import org.springframework.ldap.core.DirContextOperations; -import org.springframework.security.authentication.BadCredentialsException; -import org.springframework.security.authentication.InternalAuthenticationServiceException; -import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; -import org.springframework.security.core.GrantedAuthority; -import org.springframework.security.core.userdetails.User; -import org.springframework.security.core.userdetails.UserDetails; -import org.springframework.security.ldap.authentication.ad.ActiveDirectoryLdapAuthenticationProvider; -import org.springframework.security.ldap.userdetails.UserDetailsContextMapper; -import org.springframework.stereotype.Service; - -/** Invoke explicitly as a first factor; never register this as a web AuthenticationProvider. */ -@Service -@EnableConfigurationProperties(AdProperties.class) -public class AdPasswordVerifier { - private final ActiveDirectoryLdapAuthenticationProvider provider; - private final AdProperties properties; - - public AdPasswordVerifier(AdProperties properties) { - this.properties = properties; - if (!properties.enabled()) { - provider = null; - return; - } - URI uri = URI.create(properties.url()); - if (!"ldaps".equals(uri.getScheme()) || uri.getHost() == null || uri.getUserInfo() != null - || uri.getQuery() != null || uri.getFragment() != null - || properties.domain() == null || properties.domain().isBlank() - || properties.baseDn() == null || properties.baseDn().isBlank()) { - throw new IllegalArgumentException("AD requires an LDAPS URL, domain and base DN"); - } - provider = new ActiveDirectoryLdapAuthenticationProvider( - properties.domain(), properties.url(), properties.baseDn()); - provider.setConvertSubErrorCodesToExceptions(true); - provider.setUseAuthenticationRequestCredentials(false); - provider.setSearchFilter("(&(objectClass=user)(!(objectClass=computer))(userPrincipalName={0}))"); - // AD domain searches include other naming-context references. Ignore them (never follow - // with user credentials); Spring's AD provider already ignores partial-result exceptions. - provider.setContextEnvironmentProperties(Map.of( - "com.sun.jndi.ldap.connect.timeout", "3000", - "com.sun.jndi.ldap.read.timeout", "5000", - "java.naming.ldap.attributes.binary", "objectGUID", - "java.naming.referral", "ignore")); - // Directory groups are mapped independently; do not confuse FACTOR_PASSWORD with a group. - provider.setAuthoritiesPopulator((entry, username) -> List.of()); - provider.setUserDetailsContextMapper(new IdentityMapper()); - } - - public boolean enabled() { return properties.enabled(); } - - public DirectoryIdentity verify(String username, String password) { - if (provider == null) throw new IllegalStateException("AD login is disabled"); - if (username == null || username.isBlank() || username.length() > 256 - || username.contains("\\") || !username.equals(username.strip()) - || (username.contains("@") && !username.toLowerCase(java.util.Locale.ROOT) - .endsWith("@" + properties.domain().toLowerCase(java.util.Locale.ROOT))) - || password == null || password.isEmpty() || password.length() > 1024) { - throw new BadCredentialsException("Invalid credentials"); - } - var token = UsernamePasswordAuthenticationToken.unauthenticated(username, password); - try { - var result = provider.authenticate(token); - try { - return ((IdentityUser) result.getPrincipal()).identity; - } finally { - if (result instanceof org.springframework.security.core.CredentialsContainer credentials) { - credentials.eraseCredentials(); - } - } - } finally { - token.eraseCredentials(); - } - } - - static final class IdentityUser extends User { - final DirectoryIdentity identity; - IdentityUser(DirectoryIdentity identity) { - super(identity.username(), "", List.of()); - this.identity = identity; - } - } - - static final class IdentityMapper implements UserDetailsContextMapper { - @Override - public UserDetails mapUserFromContext(DirContextOperations entry, String username, - Collection authorities) { - try { - // Refuse an incomplete ranged result instead of silently dropping groups. - var ids = entry.getAttributes().getIDs(); - try { - while (ids.hasMore()) { - if (ids.next().toLowerCase(java.util.Locale.ROOT).startsWith("memberof;")) { - throw new IllegalArgumentException("Ranged membership is not supported yet"); - } - } - } finally { ids.close(); } - String account = required(entry, "sAMAccountName"); - String display = entry.getStringAttribute("displayName"); - String email = entry.getStringAttribute("mail"); - String[] membership = entry.getStringAttributes("memberOf"); - List dns = membership == null ? List.of() : Arrays.stream(membership).sorted().toList(); - var groups = new java.util.TreeSet(); - for (String dn : dns) { - var name = new LdapName(dn); - var rdn = name.getRdn(name.size() - 1); - if (!rdn.getType().equalsIgnoreCase("CN")) throw new IllegalArgumentException("Group has no CN"); - if (!groups.add(rdn.getValue().toString())) throw new IllegalArgumentException("Ambiguous group CN"); - } - return new IdentityUser(new DirectoryIdentity( - guid((byte[]) entry.getObjectAttribute("objectGUID")), account, - display == null ? account : display, email == null ? "" : email, - List.copyOf(groups), dns)); - } catch (NamingException | IllegalArgumentException | ClassCastException ex) { - throw new InternalAuthenticationServiceException("Directory identity cannot be mapped", ex); - } - } - - @Override - public void mapUserToContext(UserDetails user, DirContextAdapter context) { - throw new UnsupportedOperationException("Read-only directory integration"); - } - - private static String required(DirContextOperations entry, String attribute) { - String value = entry.getStringAttribute(attribute); - if (value == null || value.isBlank()) throw new IllegalArgumentException("Missing directory attribute"); - return value; - } - } - - static String guid(byte[] bytes) { - if (bytes == null || bytes.length != 16) throw new IllegalArgumentException("Invalid objectGUID"); - var little = ByteBuffer.wrap(bytes).order(ByteOrder.LITTLE_ENDIAN); - long most = Integer.toUnsignedLong(little.getInt()) << 32 - | (long) Short.toUnsignedInt(little.getShort()) << 16 - | Short.toUnsignedInt(little.getShort()); - long least = ByteBuffer.wrap(bytes, 8, 8).getLong(); - return new UUID(most, least).toString(); - } -} diff --git a/src/main/java/top/ddupan/iam/login/ad/DirectoryIdentity.java b/src/main/java/top/ddupan/iam/login/ad/DirectoryIdentity.java deleted file mode 100644 index 28cf372..0000000 --- a/src/main/java/top/ddupan/iam/login/ad/DirectoryIdentity.java +++ /dev/null @@ -1,12 +0,0 @@ -package top.ddupan.iam.login.ad; - -import java.util.List; - -/** Directory key only: deliberately not a Hydra subject or a completed authentication. */ -public record DirectoryIdentity(String objectGuid, String username, String displayName, - String email, List groups, List groupDns) { - public DirectoryIdentity { - groups = List.copyOf(groups); - groupDns = List.copyOf(groupDns); - } -} diff --git a/src/main/java/top/ddupan/iam/login/authentication/application/SignInService.java b/src/main/java/top/ddupan/iam/login/authentication/application/SignInService.java new file mode 100644 index 0000000..c3985e6 --- /dev/null +++ b/src/main/java/top/ddupan/iam/login/authentication/application/SignInService.java @@ -0,0 +1,50 @@ +package top.ddupan.iam.login.authentication.application; + +import java.time.Clock; +import java.util.UUID; +import top.ddupan.iam.login.authentication.application.port.PasswordAuthenticator; +import top.ddupan.iam.login.authentication.domain.UserRepository; +import top.ddupan.iam.login.authentication.application.port.PasswordVerificationException; +import top.ddupan.iam.login.authentication.domain.LoginTransaction; + +/** Coordinates the first-factor use case. HTTP/session/LDAP details stay in adapters. */ +public final class SignInService { + public enum PasswordResult { ACCEPTED, REJECTED, EXPIRED, WRONG_STEP, RETRY_LATER } + private final PasswordAuthenticator authenticator; + private final Clock clock; + private final boolean enabled; + + public SignInService(PasswordAuthenticator authenticator, Clock clock, boolean enabled) { + this.authenticator = authenticator; + this.clock = clock; + this.enabled = enabled; + } + + public boolean enabled() { return enabled; } + public LoginTransaction start() { return LoginTransaction.start(UUID.randomUUID(), clock.instant()); } + public boolean expired(LoginTransaction transaction) { return transaction.expiredAt(clock.instant()); } + + public PasswordResult submitPassword(LoginTransaction transaction, String username, String password) { + if (!enabled) throw new IllegalStateException("Human sign-in is disabled"); + var attempt = transaction.beginPasswordAttempt(clock.instant()); + if (attempt != LoginTransaction.Attempt.ALLOWED) { + return switch (attempt) { + case EXPIRED -> PasswordResult.EXPIRED; + case WRONG_STEP -> PasswordResult.WRONG_STEP; + case RETRY_LATER -> PasswordResult.RETRY_LATER; + case ALLOWED -> throw new IllegalStateException("Unexpected attempt result"); + }; + } + try (var session = authenticator.authenticate(username, password)) { + var identity = session.users().findByLoginName(session.loginName()); + if (identity.isEmpty()) return PasswordResult.REJECTED; + // A slow directory response must not revive an expired transaction. + var verifiedAt = clock.instant(); + if (transaction.expiredAt(verifiedAt)) return PasswordResult.EXPIRED; + transaction.passwordVerified(identity.orElseThrow(), verifiedAt); + return PasswordResult.ACCEPTED; + } catch (PasswordVerificationException | UserRepository.AccessFailure ex) { + return PasswordResult.REJECTED; + } + } +} diff --git a/src/main/java/top/ddupan/iam/login/authentication/application/port/AuthenticatedUserSession.java b/src/main/java/top/ddupan/iam/login/authentication/application/port/AuthenticatedUserSession.java new file mode 100644 index 0000000..bc6aee3 --- /dev/null +++ b/src/main/java/top/ddupan/iam/login/authentication/application/port/AuthenticatedUserSession.java @@ -0,0 +1,10 @@ +package top.ddupan.iam.login.authentication.application.port; + +import top.ddupan.iam.login.authentication.domain.UserRepository; + +/** Uses the authenticated user's connection, without exposing connection or credential objects. */ +public interface AuthenticatedUserSession extends AutoCloseable { + String loginName(); + UserRepository users(); + @Override void close(); +} diff --git a/src/main/java/top/ddupan/iam/login/authentication/application/port/PasswordAuthenticator.java b/src/main/java/top/ddupan/iam/login/authentication/application/port/PasswordAuthenticator.java new file mode 100644 index 0000000..63ee91e --- /dev/null +++ b/src/main/java/top/ddupan/iam/login/authentication/application/port/PasswordAuthenticator.java @@ -0,0 +1,6 @@ +package top.ddupan.iam.login.authentication.application.port; + +/** Password authentication opens a short-lived user repository scope. */ +public interface PasswordAuthenticator { + AuthenticatedUserSession authenticate(String username, String password); +} diff --git a/src/main/java/top/ddupan/iam/login/authentication/application/port/PasswordVerificationException.java b/src/main/java/top/ddupan/iam/login/authentication/application/port/PasswordVerificationException.java new file mode 100644 index 0000000..873e36d --- /dev/null +++ b/src/main/java/top/ddupan/iam/login/authentication/application/port/PasswordVerificationException.java @@ -0,0 +1,14 @@ +package top.ddupan.iam.login.authentication.application.port; + +/** Adapter failures translated into application vocabulary, without vendor exception details. */ +public final class PasswordVerificationException extends RuntimeException { + public enum Reason { REJECTED, DISABLED, LOCKED, PASSWORD_EXPIRED, ACCOUNT_EXPIRED, UNAVAILABLE } + private final Reason reason; + + public PasswordVerificationException(Reason reason) { + super(reason.name()); + this.reason = reason; + } + + public Reason reason() { return reason; } +} diff --git a/src/main/java/top/ddupan/iam/login/authentication/domain/LoginTransaction.java b/src/main/java/top/ddupan/iam/login/authentication/domain/LoginTransaction.java new file mode 100644 index 0000000..5048b81 --- /dev/null +++ b/src/main/java/top/ddupan/iam/login/authentication/domain/LoginTransaction.java @@ -0,0 +1,56 @@ +package top.ddupan.iam.login.authentication.domain; + +import java.time.Duration; +import java.time.Instant; +import java.util.Objects; +import java.util.UUID; + +/** Owns first-factor ordering, lifetime and the identity to which further factors must bind. */ +public final class LoginTransaction { + private static final Duration LIFETIME = Duration.ofMinutes(10); + private static final Duration ATTEMPT_INTERVAL = Duration.ofSeconds(2); + + public enum Step { PASSWORD_REQUIRED, MFA_REQUIRED } + public enum Attempt { ALLOWED, EXPIRED, WRONG_STEP, RETRY_LATER } + + private final UUID id; + private Step step = Step.PASSWORD_REQUIRED; + private Instant expiresAt; + private Instant retryAfter = Instant.MIN; + private User identity; + + private LoginTransaction(UUID id, Instant now) { + this.id = Objects.requireNonNull(id); + this.expiresAt = now.plus(LIFETIME); + } + + public static LoginTransaction start(UUID id, Instant now) { + return new LoginTransaction(id, now); + } + + public Attempt beginPasswordAttempt(Instant now) { + if (expiredAt(now)) return Attempt.EXPIRED; + if (step != Step.PASSWORD_REQUIRED) return Attempt.WRONG_STEP; + if (now.isBefore(retryAfter)) return Attempt.RETRY_LATER; + retryAfter = now.plus(ATTEMPT_INTERVAL); + return Attempt.ALLOWED; + } + + public void passwordVerified(User identity, Instant now) { + if (expiredAt(now) || step != Step.PASSWORD_REQUIRED) { + throw new IllegalStateException("Password verification is not allowed in this transaction state"); + } + this.identity = Objects.requireNonNull(identity); + this.step = Step.MFA_REQUIRED; + this.expiresAt = now.plus(LIFETIME); + } + + public UUID id() { return id; } + public Step step() { return step; } + public boolean expiredAt(Instant now) { return !now.isBefore(expiresAt); } + + public User identity() { + if (identity == null) throw new IllegalStateException("No verified identity yet"); + return identity; + } +} diff --git a/src/main/java/top/ddupan/iam/login/authentication/domain/User.java b/src/main/java/top/ddupan/iam/login/authentication/domain/User.java new file mode 100644 index 0000000..73cd327 --- /dev/null +++ b/src/main/java/top/ddupan/iam/login/authentication/domain/User.java @@ -0,0 +1,48 @@ +package top.ddupan.iam.login.authentication.domain; + +import java.util.List; +import java.util.Objects; + +/** Directory-owned user aggregate. Identity is stable while profile and membership may change. */ +public final class User { + private final UserId id; + private final String username; + private final String displayName; + private final String email; + private final List memberships; + + public User(UserId id, String username, String displayName, String email, List memberships) { + this.id = Objects.requireNonNull(id); + if (username == null || username.isBlank()) throw new IllegalArgumentException("Missing username"); + this.username = username; + this.displayName = Objects.requireNonNull(displayName); + this.email = Objects.requireNonNull(email); + this.memberships = List.copyOf(memberships); + } + + public UserId id() { return id; } + public String username() { return username; } + public String displayName() { return displayName; } + public String email() { return email; } + public List memberships() { return memberships; } + + @Override public boolean equals(Object other) { return other instanceof User user && id.equals(user.id); } + @Override public int hashCode() { return id.hashCode(); } + + public record UserId(String authority, String value) { + public UserId { + if (authority == null || authority.isBlank() || value == null || value.isBlank()) { + throw new IllegalArgumentException("Missing user identifier"); + } + } + } + + /** External group identifiers are opaque to the domain. */ + public record GroupMembership(String name, String externalId) { + public GroupMembership { + if (name == null || name.isBlank() || externalId == null || externalId.isBlank()) { + throw new IllegalArgumentException("Missing group identifier"); + } + } + } +} diff --git a/src/main/java/top/ddupan/iam/login/authentication/domain/UserRepository.java b/src/main/java/top/ddupan/iam/login/authentication/domain/UserRepository.java new file mode 100644 index 0000000..caea6cb --- /dev/null +++ b/src/main/java/top/ddupan/iam/login/authentication/domain/UserRepository.java @@ -0,0 +1,12 @@ +package top.ddupan.iam.login.authentication.domain; + +import java.util.Optional; + +/** Read-only user collection; directory entries and LDAP types never cross this boundary. */ +public interface UserRepository { + Optional findByLoginName(String loginName); + + final class AccessFailure extends RuntimeException { + public AccessFailure() { super("User repository is unavailable or returned an invalid user"); } + } +} diff --git a/src/main/java/top/ddupan/iam/login/authentication/infrastructure/ad/AdEntryMapper.java b/src/main/java/top/ddupan/iam/login/authentication/infrastructure/ad/AdEntryMapper.java new file mode 100644 index 0000000..029a79f --- /dev/null +++ b/src/main/java/top/ddupan/iam/login/authentication/infrastructure/ad/AdEntryMapper.java @@ -0,0 +1,27 @@ +package top.ddupan.iam.login.authentication.infrastructure.ad; + +import java.util.Locale; +import javax.naming.NamingException; +import org.springframework.LdapDataEntry; +import org.springframework.ldap.odm.core.impl.DefaultObjectDirectoryMapper; +import top.ddupan.iam.login.authentication.domain.UserRepository; + +/** Keep Spring's ODM mapping while refusing silently truncated AD group attributes. */ +final class AdEntryMapper extends DefaultObjectDirectoryMapper { + @Override + public T mapFromLdapDataEntry(LdapDataEntry entry, Class type) { + var ids = entry.getAttributes().getIDs(); + try { + while (ids.hasMore()) { + if (ids.next().toLowerCase(Locale.ROOT).startsWith("memberof;")) { + throw new UserRepository.AccessFailure(); + } + } + } catch (NamingException ex) { + throw new UserRepository.AccessFailure(); + } finally { + try { ids.close(); } catch (NamingException ignored) { } + } + return super.mapFromLdapDataEntry(entry, type); + } +} diff --git a/src/main/java/top/ddupan/iam/login/authentication/infrastructure/ad/AdPasswordAuthenticator.java b/src/main/java/top/ddupan/iam/login/authentication/infrastructure/ad/AdPasswordAuthenticator.java new file mode 100644 index 0000000..fa8c7d7 --- /dev/null +++ b/src/main/java/top/ddupan/iam/login/authentication/infrastructure/ad/AdPasswordAuthenticator.java @@ -0,0 +1,91 @@ +package top.ddupan.iam.login.authentication.infrastructure.ad; + +import java.net.URI; +import java.util.Locale; +import java.util.Map; +import java.util.regex.Pattern; +import org.springframework.boot.context.properties.EnableConfigurationProperties; +import org.springframework.data.ldap.repository.support.SimpleLdapRepository; +import org.springframework.ldap.core.LdapTemplate; +import org.springframework.ldap.core.support.LdapContextSource; +import org.springframework.ldap.core.support.SingleContextSource; +import org.springframework.stereotype.Component; +import top.ddupan.iam.login.authentication.application.port.AuthenticatedUserSession; +import top.ddupan.iam.login.authentication.application.port.PasswordAuthenticator; +import top.ddupan.iam.login.authentication.application.port.PasswordVerificationException; +import top.ddupan.iam.login.authentication.application.port.PasswordVerificationException.Reason; + +/** Bind authenticates; the scoped Spring Data repository owns all user and membership reads. */ +@Component +@EnableConfigurationProperties(AdProperties.class) +public final class AdPasswordAuthenticator implements PasswordAuthenticator { + private static final Pattern AD_SUBCODE = Pattern.compile("\\bdata\\s+([0-9a-f]+)", Pattern.CASE_INSENSITIVE); + private final AdProperties properties; + private final LdapContextSource contexts; + + public AdPasswordAuthenticator(AdProperties properties) { + this.properties = properties; + if (!properties.enabled()) { contexts = null; return; } + var uri = URI.create(properties.url()); + if (!"ldaps".equals(uri.getScheme()) || uri.getHost() == null || uri.getUserInfo() != null + || uri.getQuery() != null || uri.getFragment() != null + || properties.domain() == null || properties.domain().isBlank() + || properties.baseDn() == null || properties.baseDn().isBlank()) { + throw new IllegalArgumentException("AD requires an LDAPS URL, domain and base DN"); + } + contexts = new LdapContextSource(); + contexts.setUrl(properties.url()); + contexts.setBase(properties.baseDn()); + contexts.setPooled(false); + contexts.setReferral("ignore"); + contexts.setBaseEnvironmentProperties(Map.of( + "com.sun.jndi.ldap.connect.timeout", "3000", + "com.sun.jndi.ldap.read.timeout", "5000", + "java.naming.ldap.attributes.binary", "objectGUID")); + contexts.afterPropertiesSet(); + } + + @Override + public AuthenticatedUserSession authenticate(String username, String password) { + if (contexts == null) throw new PasswordVerificationException(Reason.UNAVAILABLE); + if (username == null || username.isBlank() || username.length() > 256 + || username.contains("\\") || !username.equals(username.strip()) + || (username.contains("@") && !username.toLowerCase(Locale.ROOT) + .endsWith("@" + properties.domain().toLowerCase(Locale.ROOT))) + || password == null || password.isEmpty() || password.length() > 1024) { + throw new PasswordVerificationException(Reason.REJECTED); + } + String principal = username.contains("@") ? username : username + "@" + properties.domain(); + try { + var connection = new SingleContextSource(contexts.getContext(principal, password)); + try { + var mapper = new AdEntryMapper(); + var operations = new LdapTemplate(connection); + operations.setIgnorePartialResultException(true); + operations.setObjectDirectoryMapper(mapper); + var entries = new SimpleLdapRepository<>(operations, mapper, AdUserEntry.class); + return new AdUserRepository(entries, connection, properties.domain(), principal); + } catch (RuntimeException ex) { + connection.destroy(); + throw ex; + } + } catch (org.springframework.ldap.AuthenticationException ex) { + throw new PasswordVerificationException(reason(ex)); + } catch (org.springframework.ldap.NamingException | org.springframework.dao.DataAccessException ex) { + throw new PasswordVerificationException(Reason.UNAVAILABLE); + } + } + + private static Reason reason(org.springframework.ldap.AuthenticationException exception) { + // Translate AD's diagnostic codes; never expose the diagnostic or credentials to the use case. + var matcher = AD_SUBCODE.matcher(exception.getMessage() == null ? "" : exception.getMessage()); + if (!matcher.find()) return Reason.REJECTED; + return switch (matcher.group(1).toLowerCase(Locale.ROOT)) { + case "533" -> Reason.DISABLED; + case "775" -> Reason.LOCKED; + case "532", "773" -> Reason.PASSWORD_EXPIRED; + case "701" -> Reason.ACCOUNT_EXPIRED; + default -> Reason.REJECTED; + }; + } +} diff --git a/src/main/java/top/ddupan/iam/login/ad/AdProperties.java b/src/main/java/top/ddupan/iam/login/authentication/infrastructure/ad/AdProperties.java similarity index 76% rename from src/main/java/top/ddupan/iam/login/ad/AdProperties.java rename to src/main/java/top/ddupan/iam/login/authentication/infrastructure/ad/AdProperties.java index 6ebcaca..b1441d5 100644 --- a/src/main/java/top/ddupan/iam/login/ad/AdProperties.java +++ b/src/main/java/top/ddupan/iam/login/authentication/infrastructure/ad/AdProperties.java @@ -1,4 +1,4 @@ -package top.ddupan.iam.login.ad; +package top.ddupan.iam.login.authentication.infrastructure.ad; import org.springframework.boot.context.properties.ConfigurationProperties; diff --git a/src/main/java/top/ddupan/iam/login/authentication/infrastructure/ad/AdUserEntry.java b/src/main/java/top/ddupan/iam/login/authentication/infrastructure/ad/AdUserEntry.java new file mode 100644 index 0000000..c562425 --- /dev/null +++ b/src/main/java/top/ddupan/iam/login/authentication/infrastructure/ad/AdUserEntry.java @@ -0,0 +1,20 @@ +package top.ddupan.iam.login.authentication.infrastructure.ad; + +import java.util.List; +import javax.naming.Name; +import lombok.Getter; +import org.springframework.ldap.odm.annotations.Attribute; +import org.springframework.ldap.odm.annotations.Entry; +import org.springframework.ldap.odm.annotations.Id; + +/** Persistence representation, deliberately separate from the domain user. */ +@Getter +@Entry(objectClasses = "user") +public final class AdUserEntry { + @Id private Name dn; + @Attribute(name = "objectGUID", type = Attribute.Type.BINARY) private byte[] objectGuid; + @Attribute(name = "sAMAccountName") private String accountName; + @Attribute(name = "displayName") private String displayName; + @Attribute(name = "mail") private String email; + @Attribute(name = "memberOf") private List memberOf; +} diff --git a/src/main/java/top/ddupan/iam/login/authentication/infrastructure/ad/AdUserRepository.java b/src/main/java/top/ddupan/iam/login/authentication/infrastructure/ad/AdUserRepository.java new file mode 100644 index 0000000..a7e6765 --- /dev/null +++ b/src/main/java/top/ddupan/iam/login/authentication/infrastructure/ad/AdUserRepository.java @@ -0,0 +1,82 @@ +package top.ddupan.iam.login.authentication.infrastructure.ad; + +import java.nio.ByteBuffer; +import java.nio.ByteOrder; +import java.util.List; +import java.util.Optional; +import java.util.TreeMap; +import java.util.UUID; +import javax.naming.NamingException; +import javax.naming.ldap.LdapName; +import org.springframework.data.ldap.repository.LdapRepository; +import org.springframework.ldap.core.support.SingleContextSource; +import top.ddupan.iam.login.authentication.application.port.AuthenticatedUserSession; +import top.ddupan.iam.login.authentication.domain.User; +import top.ddupan.iam.login.authentication.domain.User.GroupMembership; +import top.ddupan.iam.login.authentication.domain.User.UserId; +import top.ddupan.iam.login.authentication.domain.UserRepository; +import static org.springframework.ldap.query.LdapQueryBuilder.query; + +/** One authenticated connection and one Spring Data repository per use-case scope. */ +final class AdUserRepository implements UserRepository, AuthenticatedUserSession { + private final LdapRepository entries; + private final SingleContextSource connection; + private final String authority; + private final String loginName; + private boolean closed; + + AdUserRepository(LdapRepository entries, SingleContextSource connection, + String authority, String loginName) { + this.entries = entries; + this.connection = connection; + this.authority = authority; + this.loginName = loginName; + } + + @Override + public Optional findByLoginName(String name) { + requireOpen(); + try { + return entries.findOne(query().where("objectClass").is("user") + .and("objectClass").not().is("computer") + .and(query().where("sAMAccountName").is(name).or("userPrincipalName").is(name))) + .map(this::toUser); + } catch (org.springframework.ldap.NamingException | org.springframework.dao.DataAccessException | IllegalArgumentException ex) { + throw new UserRepository.AccessFailure(); + } + } + + private User toUser(AdUserEntry entry) { + var groups = new TreeMap(); + for (String dn : entry.getMemberOf() == null ? List.of() : entry.getMemberOf()) { + try { + var name = new LdapName(dn); + var rdn = name.getRdn(name.size() - 1); + if (!rdn.getType().equalsIgnoreCase("CN")) throw new UserRepository.AccessFailure(); + String cn = rdn.getValue().toString(); + if (groups.putIfAbsent(cn, new GroupMembership(cn, dn)) != null) { + throw new UserRepository.AccessFailure(); + } + } catch (NamingException ex) { throw new UserRepository.AccessFailure(); } + } + return new User(new UserId(authority, guid(entry.getObjectGuid())), entry.getAccountName(), + entry.getDisplayName() == null ? entry.getAccountName() : entry.getDisplayName(), + entry.getEmail() == null ? "" : entry.getEmail(), List.copyOf(groups.values())); + } + + static String guid(byte[] bytes) { + if (bytes == null || bytes.length != 16) throw new UserRepository.AccessFailure(); + var little = ByteBuffer.wrap(bytes).order(ByteOrder.LITTLE_ENDIAN); + long most = Integer.toUnsignedLong(little.getInt()) << 32 + | (long) Short.toUnsignedInt(little.getShort()) << 16 + | Short.toUnsignedInt(little.getShort()); + return new UUID(most, ByteBuffer.wrap(bytes, 8, 8).getLong()).toString(); + } + + @Override public String loginName() { requireOpen(); return loginName; } + @Override public UserRepository users() { requireOpen(); return this; } + private void requireOpen() { if (closed) throw new IllegalStateException("User repository scope is closed"); } + @Override public void close() { + if (!closed) { closed = true; connection.destroy(); } + } +} diff --git a/src/main/java/top/ddupan/iam/login/authentication/interfaces/web/BrowserSignInState.java b/src/main/java/top/ddupan/iam/login/authentication/interfaces/web/BrowserSignInState.java new file mode 100644 index 0000000..49ea262 --- /dev/null +++ b/src/main/java/top/ddupan/iam/login/authentication/interfaces/web/BrowserSignInState.java @@ -0,0 +1,12 @@ +package top.ddupan.iam.login.authentication.interfaces.web; + +import top.ddupan.iam.login.authentication.domain.LoginTransaction; + +/** HTTP-session storage plus presentation feedback. Authentication rules live in the aggregate. */ +final class BrowserSignInState { + final LoginTransaction transaction; + String username = ""; + String error = ""; + + BrowserSignInState(LoginTransaction transaction) { this.transaction = transaction; } +} diff --git a/src/main/java/top/ddupan/iam/login/preview/PageRenderer.java b/src/main/java/top/ddupan/iam/login/authentication/interfaces/web/PageRenderer.java similarity index 95% rename from src/main/java/top/ddupan/iam/login/preview/PageRenderer.java rename to src/main/java/top/ddupan/iam/login/authentication/interfaces/web/PageRenderer.java index 0b69f23..e738fd6 100644 --- a/src/main/java/top/ddupan/iam/login/preview/PageRenderer.java +++ b/src/main/java/top/ddupan/iam/login/authentication/interfaces/web/PageRenderer.java @@ -1,4 +1,4 @@ -package top.ddupan.iam.login.preview; +package top.ddupan.iam.login.authentication.interfaces.web; import java.io.IOException; import java.nio.charset.StandardCharsets; diff --git a/src/main/java/top/ddupan/iam/login/ad/AdLoginController.java b/src/main/java/top/ddupan/iam/login/authentication/interfaces/web/SignInController.java similarity index 54% rename from src/main/java/top/ddupan/iam/login/ad/AdLoginController.java rename to src/main/java/top/ddupan/iam/login/authentication/interfaces/web/SignInController.java index 4d18a50..576f7ee 100644 --- a/src/main/java/top/ddupan/iam/login/ad/AdLoginController.java +++ b/src/main/java/top/ddupan/iam/login/authentication/interfaces/web/SignInController.java @@ -1,30 +1,30 @@ -package top.ddupan.iam.login.ad; +package top.ddupan.iam.login.authentication.interfaces.web; import jakarta.servlet.http.HttpServletRequest; import jakarta.servlet.http.HttpSession; -import java.time.Instant; import java.util.Map; import org.springframework.http.HttpStatus; import org.springframework.http.MediaType; import org.springframework.http.ResponseEntity; -import org.springframework.security.core.AuthenticationException; import org.springframework.security.web.csrf.CsrfToken; import org.springframework.web.bind.annotation.GetMapping; import org.springframework.web.bind.annotation.PostMapping; import org.springframework.web.bind.annotation.RequestParam; import org.springframework.web.bind.annotation.RestController; import org.springframework.web.server.ResponseStatusException; -import top.ddupan.iam.login.preview.PageRenderer; +import top.ddupan.iam.login.authentication.application.SignInService; +import top.ddupan.iam.login.authentication.domain.LoginTransaction.Step; +import top.ddupan.iam.login.authentication.domain.User.GroupMembership; -/** Human first-factor PoC. No SecurityContext, MFA acceptance, or Hydra calls. */ +/** Translates browser requests and use-case outcomes; no directory or authentication policy here. */ @RestController -public class AdLoginController { - static final String STATE = AdLoginController.class.getName() + ".state"; - private final AdPasswordVerifier verifier; +public class SignInController { + static final String STATE = SignInController.class.getName() + ".state"; + private final SignInService signIn; private final PageRenderer renderer; - public AdLoginController(AdPasswordVerifier verifier, PageRenderer renderer) { - this.verifier = verifier; + public SignInController(SignInService signIn, PageRenderer renderer) { + this.signIn = signIn; this.renderer = renderer; } @@ -34,7 +34,7 @@ public class AdLoginController { var session = request.getSession(); synchronized (session) { var state = state(session); - if (state.identity != null) return redirect("/signin/mfa"); + if (state.transaction.step() == Step.MFA_REQUIRED) return redirect("/signin/mfa"); return renderer.render(Map.of("step", "password", "name", state.username, "error", state.error, "action", "/signin/password", "csrf", csrf(csrf))); } @@ -48,26 +48,22 @@ public class AdLoginController { var session = request.getSession(false); if (session == null) throw new ResponseStatusException(HttpStatus.CONFLICT); synchronized (session) { - var state = (State) session.getAttribute(STATE); - if (state == null || state.identity != null || state.expires.isBefore(Instant.now())) { - return redirect("/signin"); - } - // Prevent double submissions in this transaction; perimeter rate limits belong at ingress. - if (state.retryAfter.isAfter(Instant.now())) throw new ResponseStatusException(HttpStatus.TOO_MANY_REQUESTS); - state.retryAfter = Instant.now().plusSeconds(2); + var state = (BrowserSignInState) session.getAttribute(STATE); + if (state == null) return redirect("/signin"); state.username = username.length() <= 256 ? username : ""; - try { - var identity = verifier.verify(username, password); - request.changeSessionId(); - state.identity = identity; - state.error = ""; - state.expires = Instant.now().plusSeconds(600); - return redirect("/signin/mfa"); - } catch (AuthenticationException | org.springframework.dao.DataAccessException ex) { - // Neither directory exception details nor passwords enter HTML/session/logs. - state.error = "无法验证账号，请检查凭据与账号状态，或稍后重试。"; - return redirect("/signin"); - } + return switch (signIn.submitPassword(state.transaction, username, password)) { + case ACCEPTED -> { + request.changeSessionId(); + state.error = ""; + yield redirect("/signin/mfa"); + } + case REJECTED -> { + state.error = "无法验证账号，请检查凭据与账号状态，或稍后重试。"; + yield redirect("/signin"); + } + case EXPIRED, WRONG_STEP -> redirect("/signin"); + case RETRY_LATER -> throw new ResponseStatusException(HttpStatus.TOO_MANY_REQUESTS); + }; } } @@ -78,12 +74,14 @@ public class AdLoginController { if (session == null) return redirect("/signin"); synchronized (session) { var state = state(session); - if (state.identity == null) return redirect("/signin"); - var identity = state.identity; - return renderer.render(Map.of("step", "mfa-pending", "name", identity.displayName(), + if (state.transaction.step() != Step.MFA_REQUIRED) return redirect("/signin"); + var user = state.transaction.identity(); + return renderer.render(Map.of("step", "mfa-pending", "name", user.displayName(), "error", "", "action", "/signin/restart", "csrf", csrf(csrf), - "identity", Map.of("username", identity.username(), "objectGuid", identity.objectGuid(), - "email", identity.email(), "groups", identity.groups(), "groupDns", identity.groupDns()))); + "identity", Map.of("username", user.username(), "subjectId", user.id().value(), + "email", user.email(), + "groups", user.memberships().stream().map(GroupMembership::name).toList(), + "groupDns", user.memberships().stream().map(GroupMembership::externalId).toList()))); } } @@ -96,33 +94,25 @@ public class AdLoginController { } private void requireAvailable(HttpServletRequest request) { - if (!verifier.enabled()) throw new ResponseStatusException(HttpStatus.NOT_FOUND); + if (!signIn.enabled()) throw new ResponseStatusException(HttpStatus.NOT_FOUND); if (!request.isSecure()) throw new ResponseStatusException(HttpStatus.UPGRADE_REQUIRED, "HTTPS required"); } + private BrowserSignInState state(HttpSession session) { + var state = (BrowserSignInState) session.getAttribute(STATE); + if (state == null || signIn.expired(state.transaction)) { + state = new BrowserSignInState(signIn.start()); + session.setAttribute(STATE, state); + } + return state; + } + private static Map csrf(CsrfToken token) { return Map.of("name", token.getParameterName(), "value", token.getToken()); } - private static State state(HttpSession session) { - var state = (State) session.getAttribute(STATE); - if (state == null || state.expires.isBefore(Instant.now())) { - state = new State(); - session.setAttribute(STATE, state); - } - return state; - } - private static ResponseEntity redirect(String location) { return ResponseEntity.status(HttpStatus.SEE_OTHER).header("Location", location) .header("Cache-Control", "no-store").build(); } - - static final class State { - String username = ""; - String error = ""; - DirectoryIdentity identity; - Instant expires = Instant.now().plusSeconds(600); - Instant retryAfter = Instant.EPOCH; - } } diff --git a/src/main/java/top/ddupan/iam/login/configuration/AuthenticationConfiguration.java b/src/main/java/top/ddupan/iam/login/configuration/AuthenticationConfiguration.java new file mode 100644 index 0000000..a4369ad --- /dev/null +++ b/src/main/java/top/ddupan/iam/login/configuration/AuthenticationConfiguration.java @@ -0,0 +1,34 @@ +package top.ddupan.iam.login.configuration; + +import java.time.Clock; +import javax.naming.directory.DirContext; +import javax.naming.ldap.LdapContext; +import org.springframework.aot.hint.RuntimeHints; +import org.springframework.aot.hint.RuntimeHintsRegistrar; +import org.springframework.aot.hint.annotation.RegisterReflectionForBinding; +import org.springframework.context.annotation.ImportRuntimeHints; +import org.springframework.ldap.core.DirContextProxy; +import top.ddupan.iam.login.authentication.infrastructure.ad.AdUserEntry; +import org.springframework.context.annotation.Bean; +import org.springframework.context.annotation.Configuration; +import top.ddupan.iam.login.authentication.application.SignInService; +import top.ddupan.iam.login.authentication.application.port.PasswordAuthenticator; +import top.ddupan.iam.login.authentication.infrastructure.ad.AdProperties; + +/** Composition root: dependencies point inward, framework wiring stays outside the model. */ +@Configuration(proxyBeanMethods = false) +@RegisterReflectionForBinding(AdUserEntry.class) +@ImportRuntimeHints(AuthenticationConfiguration.DirectoryHints.class) +class AuthenticationConfiguration { + @Bean + SignInService signInService(PasswordAuthenticator authenticator, AdProperties properties) { + return new SignInService(authenticator, Clock.systemUTC(), properties.enabled()); + } + static class DirectoryHints implements RuntimeHintsRegistrar { + @Override + public void registerHints(RuntimeHints hints, ClassLoader classLoader) { + hints.proxies().registerJdkProxy(LdapContext.class, DirContextProxy.class); + hints.proxies().registerJdkProxy(DirContext.class, DirContextProxy.class); + } + } +} diff --git a/src/main/java/top/ddupan/iam/login/configuration/SecurityConfiguration.java b/src/main/java/top/ddupan/iam/login/configuration/SecurityConfiguration.java new file mode 100644 index 0000000..7375039 --- /dev/null +++ b/src/main/java/top/ddupan/iam/login/configuration/SecurityConfiguration.java @@ -0,0 +1,22 @@ +package top.ddupan.iam.login.configuration; + +import org.springframework.context.annotation.Bean; +import org.springframework.context.annotation.Configuration; +import org.springframework.security.config.Customizer; +import org.springframework.security.config.annotation.web.builders.HttpSecurity; +import org.springframework.security.web.SecurityFilterChain; + +@Configuration(proxyBeanMethods = false) +class SecurityConfiguration { + @Bean + SecurityFilterChain security(HttpSecurity http) throws Exception { + return http.authorizeHttpRequests(auth -> auth + .requestMatchers("/error", "/signin", "/signin/**", "/assets/**", "/actuator/health/**").permitAll() + .anyRequest().authenticated()) + .httpBasic(Customizer.withDefaults()) + .headers(headers -> headers.contentSecurityPolicy(csp -> csp.policyDirectives( + "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; " + + "object-src 'none'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'"))) + .build(); + } +} diff --git a/src/main/java/top/ddupan/iam/login/configuration/WebConfiguration.java b/src/main/java/top/ddupan/iam/login/configuration/WebConfiguration.java new file mode 100644 index 0000000..3ec3acc --- /dev/null +++ b/src/main/java/top/ddupan/iam/login/configuration/WebConfiguration.java @@ -0,0 +1,28 @@ +package top.ddupan.iam.login.configuration; + +import java.time.Duration; +import org.springframework.aot.hint.RuntimeHints; +import org.springframework.aot.hint.RuntimeHintsRegistrar; +import org.springframework.context.annotation.Configuration; +import org.springframework.context.annotation.ImportRuntimeHints; +import org.springframework.http.CacheControl; +import org.springframework.web.servlet.config.annotation.ResourceHandlerRegistry; +import org.springframework.web.servlet.config.annotation.WebMvcConfigurer; + +@Configuration(proxyBeanMethods = false) +@ImportRuntimeHints(WebConfiguration.Resources.class) +class WebConfiguration implements WebMvcConfigurer { + + @Override + public void addResourceHandlers(ResourceHandlerRegistry registry) { + registry.addResourceHandler("/assets/**").addResourceLocations("classpath:/ui/assets/") + .setCacheControl(CacheControl.maxAge(Duration.ofDays(365)).cachePublic().immutable()); + } + + static class Resources implements RuntimeHintsRegistrar { + @Override + public void registerHints(RuntimeHints hints, ClassLoader classLoader) { + hints.resources().registerPattern("ui/**"); + } + } +} diff --git a/src/main/java/top/ddupan/iam/login/preview/PreviewConfiguration.java b/src/main/java/top/ddupan/iam/login/preview/PreviewConfiguration.java deleted file mode 100644 index 99ef53d..0000000 --- a/src/main/java/top/ddupan/iam/login/preview/PreviewConfiguration.java +++ /dev/null @@ -1,44 +0,0 @@ -package top.ddupan.iam.login.preview; - -import java.time.Duration; -import org.springframework.aot.hint.RuntimeHints; -import org.springframework.aot.hint.RuntimeHintsRegistrar; -import org.springframework.context.annotation.Bean; -import org.springframework.context.annotation.Configuration; -import org.springframework.context.annotation.ImportRuntimeHints; -import org.springframework.http.CacheControl; -import org.springframework.security.config.Customizer; -import org.springframework.security.config.annotation.web.builders.HttpSecurity; -import org.springframework.security.web.SecurityFilterChain; -import org.springframework.web.servlet.config.annotation.ResourceHandlerRegistry; -import org.springframework.web.servlet.config.annotation.WebMvcConfigurer; - -@Configuration(proxyBeanMethods = false) -@ImportRuntimeHints(PreviewConfiguration.Resources.class) -class PreviewConfiguration implements WebMvcConfigurer { - @Bean - SecurityFilterChain security(HttpSecurity http) throws Exception { - return http.authorizeHttpRequests(auth -> auth - .requestMatchers("/error", "/signin", "/signin/**", "/preview", "/preview/**", "/assets/**", "/actuator/health/**").permitAll() - .anyRequest().authenticated()) - .formLogin(Customizer.withDefaults()) - .httpBasic(Customizer.withDefaults()) - .headers(headers -> headers.contentSecurityPolicy(csp -> csp.policyDirectives( - "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; " - + "object-src 'none'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'"))) - .build(); - } - - @Override - public void addResourceHandlers(ResourceHandlerRegistry registry) { - registry.addResourceHandler("/assets/**").addResourceLocations("classpath:/ui/assets/") - .setCacheControl(CacheControl.maxAge(Duration.ofDays(365)).cachePublic().immutable()); - } - - static class Resources implements RuntimeHintsRegistrar { - @Override - public void registerHints(RuntimeHints hints, ClassLoader classLoader) { - hints.resources().registerPattern("ui/**"); - } - } -} diff --git a/src/main/java/top/ddupan/iam/login/preview/PreviewController.java b/src/main/java/top/ddupan/iam/login/preview/PreviewController.java deleted file mode 100644 index 0ecee40..0000000 --- a/src/main/java/top/ddupan/iam/login/preview/PreviewController.java +++ /dev/null @@ -1,129 +0,0 @@ -package top.ddupan.iam.login.preview; - -import jakarta.servlet.http.HttpServletRequest; -import jakarta.servlet.http.HttpSession; -import java.util.Map; -import org.springframework.beans.factory.annotation.Value; -import org.springframework.http.HttpStatus; -import org.springframework.http.MediaType; -import org.springframework.http.ResponseEntity; -import org.springframework.security.web.csrf.CsrfToken; -import org.springframework.web.bind.annotation.GetMapping; -import org.springframework.web.bind.annotation.PostMapping; -import org.springframework.web.bind.annotation.RequestParam; -import org.springframework.web.bind.annotation.RestController; -import org.springframework.web.server.ResponseStatusException; - -/** An isolated UI experiment. It never creates an authenticated SecurityContext. */ -@RestController -class PreviewController { - private static final String STATE = PreviewController.class.getName() + ".state"; - private final boolean enabled; - private final PageRenderer renderer; - - PreviewController(@Value("${iam.ui-preview.enabled:false}") boolean enabled, PageRenderer renderer) { - this.enabled = enabled; - this.renderer = renderer; - } - - @GetMapping(value = {"/preview", "/preview/verify", "/preview/complete"}, produces = MediaType.TEXT_HTML_VALUE) - ResponseEntity page(HttpServletRequest request, CsrfToken csrf) { - requireEnabled(); - var session = request.getSession(); - synchronized (session) { - var state = state(session); - var path = request.getRequestURI().substring(request.getContextPath().length()); - if (path.equals("/preview")) { - if (!state.step.equals("identity")) state.error = ""; - state.step = "identity"; - } else if (!path.equals(pathFor(state.step))) { - return redirect(pathFor(state.step)); - } - var context = Map.of("step", state.step, "name", state.name, "error", state.error, - "action", switch (state.step) { - case "identity" -> "/preview/identify"; - case "verification" -> "/preview/verify"; - default -> "/preview/restart"; - }, "csrf", Map.of("name", csrf.getParameterName(), "value", csrf.getToken())); - return renderer.render(context); - } - } - - @PostMapping("/preview/identify") - ResponseEntity identify(@RequestParam(defaultValue = "") String name, HttpSession session) { - requireEnabled(); - synchronized (session) { - var state = state(session); - requireStep(state, "identity"); - if (name.isBlank() || name.length() > 64) { - state.error = "称呼须为 1 到 64 个字符。"; - return redirect("/preview"); - } - state.name = name.strip(); - state.error = ""; - state.step = "verification"; - return redirect("/preview/verify"); - } - } - - @PostMapping("/preview/verify") - ResponseEntity verify(@RequestParam(defaultValue = "") String code, HttpSession session) { - requireEnabled(); - synchronized (session) { - var state = state(session); - requireStep(state, "verification"); - if (!code.equals("123456")) { - state.error = "演示码不正确，请输入 123456。"; - return redirect("/preview/verify"); - } - state.error = ""; - state.step = "complete"; - return redirect("/preview/complete"); - } - } - - @PostMapping("/preview/restart") - ResponseEntity restart(HttpSession session) { - requireEnabled(); - synchronized (session) { - session.removeAttribute(STATE); - return redirect("/preview"); - } - } - - private void requireEnabled() { - if (!enabled) throw new ResponseStatusException(HttpStatus.NOT_FOUND); - } - - private static void requireStep(State state, String step) { - if (!state.step.equals(step)) throw new ResponseStatusException(HttpStatus.CONFLICT, "页面已过期，请重新打开预览"); - } - - private static State state(HttpSession session) { - var state = (State) session.getAttribute(STATE); - if (state == null) { - state = new State(); - session.setAttribute(STATE, state); - } - return state; - } - - private static String pathFor(String step) { - return switch (step) { - case "verification" -> "/preview/verify"; - case "complete" -> "/preview/complete"; - default -> "/preview"; - }; - } - - private static ResponseEntity redirect(String path) { - return ResponseEntity.status(HttpStatus.SEE_OTHER).header("Location", path) - .header("Cache-Control", "no-store").build(); - } - - private static class State { - String step = "identity"; - String name = ""; - String error = ""; - } -} diff --git a/src/test/java/top/ddupan/iam/login/IamLoginApplicationTests.java b/src/test/java/top/ddupan/iam/login/IamLoginApplicationTests.java index abfb7d5..d97fc0e 100644 --- a/src/test/java/top/ddupan/iam/login/IamLoginApplicationTests.java +++ b/src/test/java/top/ddupan/iam/login/IamLoginApplicationTests.java @@ -1,7 +1,6 @@ package top.ddupan.iam.login; import io.micrometer.core.instrument.MeterRegistry; -import java.nio.charset.StandardCharsets; import org.junit.jupiter.api.Test; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Qualifier; @@ -12,8 +11,6 @@ import org.springframework.boot.opentelemetry.autoconfigure.logging.otlp.Transpo import org.springframework.boot.test.context.SpringBootTest; import org.springframework.boot.testcontainers.service.connection.ServiceConnection; import org.springframework.boot.webmvc.test.autoconfigure.AutoConfigureMockMvc; -import org.springframework.http.MediaType; -import org.springframework.mock.web.MockHttpSession; import org.springframework.test.web.servlet.MockMvc; import org.testcontainers.grafana.LgtmStackContainer; import org.testcontainers.junit.jupiter.Container; @@ -21,14 +18,10 @@ import org.testcontainers.junit.jupiter.Testcontainers; import org.testcontainers.utility.DockerImageName; import static org.assertj.core.api.Assertions.assertThat; -import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.csrf; import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get; -import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post; -import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.header; -import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.redirectedUrl; import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status; -@SpringBootTest(properties = "iam.ui-preview.enabled=true") +@SpringBootTest @AutoConfigureMockMvc @AutoConfigureMetrics @AutoConfigureTracing @@ -52,61 +45,8 @@ class IamLoginApplicationTests { MockMvc mvc; @Test - void previewHasInlineContextAndNoCache() throws Exception { - var result = mvc.perform(get("/preview")) - .andExpect(status().isOk()) - .andExpect(header().string("Cache-Control", "no-store")) - .andReturn(); - assertThat(result.getResponse().getContentAsString()).contains("login-context", "identity", "_csrf") - .doesNotContain("__IAM_PAGE_CONTEXT__"); - } - - @Test - void previewRejectsMissingCsrf() throws Exception { - mvc.perform(post("/preview/identify").param("name", "测试")) - .andExpect(status().isForbidden()); - } - - @Test - void previewChecksStepsAndEscapesScriptEndTags() throws Exception { - var session = new MockHttpSession(); - mvc.perform(post("/preview/verify") - .session(session).with(csrf()) - .param("code", "123456")) - .andExpect(status().isConflict()); - mvc.perform(post("/preview/identify") - .session(session).with(csrf()) - .param("name", "")) - .andExpect(status().isSeeOther()); - var html = mvc.perform(get("/preview/verify").session(session)) - .andExpect(status().isOk()).andReturn() - .getResponse().getContentAsString(); - assertThat(html).doesNotContain("") - .contains("\\u003c/script\\u003e"); - } - - @Test - void previewRetriesAndCompletesWithoutAuthenticating() throws Exception { - var session = new MockHttpSession(); - mvc.perform(post("/preview/identify") - .session(session).with(csrf()) - .param("name", "测试")) - .andExpect(redirectedUrl("/preview/verify")); - mvc.perform(post("/preview/verify") - .session(session).with(csrf()) - .param("code", "000000")) - .andExpect(redirectedUrl("/preview/verify")); - var retry = mvc.perform(get("/preview/verify").session(session)) - .andReturn().getResponse(); - assertThat(retry.getContentAsString(StandardCharsets.UTF_8)).contains("演示码不正确"); - mvc.perform(post("/preview/verify") - .session(session).with(csrf()) - .param("code", "123456")) - .andExpect(redirectedUrl("/preview/complete")); - mvc.perform(get("/").session(session) - .accept(MediaType.APPLICATION_JSON)) - .andExpect(status().isUnauthorized()); - assertThat(session.getAttribute("SPRING_SECURITY_CONTEXT")).isNull(); + void signInIsDisabledUntilDirectoryIsConfigured() throws Exception { + mvc.perform(get("/signin").secure(true)).andExpect(status().isNotFound()); } @Test diff --git a/src/test/java/top/ddupan/iam/login/ad/AdIntegrationTests.java b/src/test/java/top/ddupan/iam/login/ad/AdIntegrationTests.java deleted file mode 100644 index 419b63f..0000000 --- a/src/test/java/top/ddupan/iam/login/ad/AdIntegrationTests.java +++ /dev/null @@ -1,211 +0,0 @@ -package top.ddupan.iam.login.ad; - -import com.unboundid.ldap.listener.InMemoryDirectoryServer; -import com.unboundid.ldap.listener.InMemoryDirectoryServerConfig; -import com.unboundid.ldap.listener.InMemoryListenerConfig; -import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSimpleBindRequest; -import com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult; -import com.unboundid.ldap.sdk.SearchResultReference; -import com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor; -import com.unboundid.ldap.sdk.Entry; -import com.unboundid.ldap.sdk.LDAPException; -import com.unboundid.ldap.sdk.ResultCode; -import com.unboundid.ldap.sdk.SimpleBindRequest; -import java.net.InetAddress; -import java.security.KeyStore; -import java.time.Instant; -import javax.net.ssl.KeyManagerFactory; -import javax.net.ssl.SSLContext; -import javax.net.ssl.TrustManagerFactory; -import org.springframework.aot.hint.RuntimeHints; -import org.springframework.aot.hint.RuntimeHintsRegistrar; -import org.springframework.context.annotation.ImportRuntimeHints; -import org.junit.jupiter.api.AfterAll; -import org.junit.jupiter.api.Test; -import org.springframework.beans.factory.annotation.Autowired; -import org.springframework.boot.test.context.SpringBootTest; -import org.springframework.boot.webmvc.test.autoconfigure.AutoConfigureMockMvc; -import org.springframework.http.MediaType; -import org.springframework.mock.web.MockHttpSession; -import org.springframework.security.authentication.DisabledException; -import org.springframework.security.authentication.LockedException; -import org.springframework.security.authentication.BadCredentialsException; -import org.springframework.security.authentication.CredentialsExpiredException; -import org.springframework.test.context.DynamicPropertyRegistry; -import org.springframework.test.context.DynamicPropertySource; -import org.springframework.test.web.servlet.MockMvc; -import static org.assertj.core.api.Assertions.*; -import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.csrf; -import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.*; -import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.*; - -/** Real LDAPS sockets and Spring's AD provider; AD bind/subcode semantics are simulated. */ -@SpringBootTest(properties = {"iam.ad.enabled=true", "iam.ad.domain=example.test", "iam.ad.base-dn=dc=example,dc=test"}) -@AutoConfigureMockMvc -@ImportRuntimeHints(AdIntegrationTests.FixtureHints.class) -class AdIntegrationTests { - static class FixtureHints implements RuntimeHintsRegistrar { - @Override - public void registerHints(RuntimeHints hints, ClassLoader loader) { - hints.resources().registerPattern("ldap/fixture.p12"); - } - } - - static final String BASE = "dc=example,dc=test"; - static final String USER_DN = "cn=Alice," + BASE; - static final byte[] GUID = java.util.HexFormat.of().parseHex("33221100554477668899aabbccddeeff"); - static class Fixture { - static final SSLContext ORIGINAL; - static final InMemoryDirectoryServer LDAP; - static { - try { - ORIGINAL = SSLContext.getDefault(); - var store = KeyStore.getInstance("PKCS12"); - try (var stream = AdIntegrationTests.class.getResourceAsStream("/ldap/fixture.p12")) { - store.load(stream, "fixture-only".toCharArray()); - } - var keys = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm()); - keys.init(store, "fixture-only".toCharArray()); - var trust = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm()); - trust.init(store); - var ssl = SSLContext.getInstance("TLS"); - ssl.init(keys.getKeyManagers(), trust.getTrustManagers(), null); - SSLContext.setDefault(ssl); - var config = new InMemoryDirectoryServerConfig(BASE); - config.setSchema(null); - config.setListenerConfigs(InMemoryListenerConfig.createLDAPSConfig("ldaps", - InetAddress.getByName("127.0.0.1"), 0, ssl.getServerSocketFactory(), ssl.getSocketFactory())); - config.addInMemoryOperationInterceptor(new InMemoryOperationInterceptor() { - @Override - public void processSearchResult(InMemoryInterceptedSearchResult result) { - try { - // Like Samba AD's DomainDnsZones/ForestDnsZones continuation references. - // A client following this reference would fail instead of returning the user. - result.sendSearchReference(new SearchResultReference( - new String[]{"ldap://127.0.0.1:1/DC=other,DC=test"}, null)); - } catch (LDAPException ex) { throw new IllegalStateException(ex); } - } - - @Override - public void processSimpleBindRequest(InMemoryInterceptedSimpleBindRequest request) throws LDAPException { - String name = request.getRequest().getBindDN(); - String subcode = switch (name) { - case "disabled@example.test" -> "533"; - case "locked@example.test" -> "775"; - case "expired@example.test" -> "532"; - default -> null; - }; - if (subcode != null) throw new LDAPException(ResultCode.INVALID_CREDENTIALS, - "80090308: LdapErr: DSID-0C090334, comment: AcceptSecurityContext error, data " + subcode + ", v1db1"); - if (name.equalsIgnoreCase("alice@example.test")) { - request.setRequest(new SimpleBindRequest(USER_DN, request.getRequest().getPassword().getValue())); - } else if (!name.equals(USER_DN)) { - throw new LDAPException(ResultCode.INVALID_CREDENTIALS, "Invalid credentials"); - } - } - }); - LDAP = new InMemoryDirectoryServer(config); - LDAP.startListening(); - LDAP.add(new Entry(BASE, new com.unboundid.ldap.sdk.Attribute("objectClass", "domain"), - new com.unboundid.ldap.sdk.Attribute("dc", "example"))); - LDAP.add(new Entry(USER_DN, - new com.unboundid.ldap.sdk.Attribute("objectClass", "user"), - new com.unboundid.ldap.sdk.Attribute("cn", "Alice"), - new com.unboundid.ldap.sdk.Attribute("sAMAccountName", "alice"), - new com.unboundid.ldap.sdk.Attribute("userPrincipalName", "alice@example.test"), - new com.unboundid.ldap.sdk.Attribute("userPassword", "fixture-password"), - new com.unboundid.ldap.sdk.Attribute("displayName", "Alice "), - new com.unboundid.ldap.sdk.Attribute("mail", "alice@example.test"), - new com.unboundid.ldap.sdk.Attribute("objectGUID", GUID), - new com.unboundid.ldap.sdk.Attribute("memberOf", "CN=gitea-admins," + BASE, "CN=MixedCase," + BASE))); - } catch (Exception ex) { throw new ExceptionInInitializerError(ex); } - } - - } - - @DynamicPropertySource - static void directory(DynamicPropertyRegistry registry) { - registry.add("iam.ad.url", () -> "ldaps://localhost:" + Fixture.LDAP.getListenPort()); - } - - @AfterAll - static void close() { Fixture.LDAP.shutDown(true); SSLContext.setDefault(Fixture.ORIGINAL); } - - @Autowired AdPasswordVerifier verifier; - @Autowired MockMvc mvc; - - @Test - void passwordReadsGuidAndExactGroupsOverTlsDespitePartitionReferrals() { - var identity = verifier.verify("alice", "fixture-password"); - assertThat(identity.objectGuid()).isEqualTo("00112233-4455-6677-8899-aabbccddeeff"); - assertThat(identity.groups()).containsExactly("MixedCase", "gitea-admins"); - assertThat(identity.groupDns()).containsExactly("CN=MixedCase," + BASE, "CN=gitea-admins," + BASE); - assertThat(verifier.verify("alice@example.test", "fixture-password")).isEqualTo(identity); - } - - @Test - void rejectsPasswordsUnknownUsersAndAdAccountStates() { - assertThatThrownBy(() -> verifier.verify("alice", "wrong")).isInstanceOf(BadCredentialsException.class); - assertThatThrownBy(() -> verifier.verify("alice", "")).isInstanceOf(BadCredentialsException.class); - assertThatThrownBy(() -> verifier.verify("unknown", "fixture-password")).isInstanceOf(BadCredentialsException.class); - assertThatThrownBy(() -> verifier.verify("alice@other.test", "fixture-password")).isInstanceOf(BadCredentialsException.class); - assertThatThrownBy(() -> verifier.verify("disabled", "fixture-password")).isInstanceOf(DisabledException.class); - assertThatThrownBy(() -> verifier.verify("locked", "fixture-password")).isInstanceOf(LockedException.class); - assertThatThrownBy(() -> verifier.verify("expired", "fixture-password")).isInstanceOf(CredentialsExpiredException.class); - } - - @Test - void rejectsWrongTlsHostnameAndPlainLdapConfiguration() { - var wrongName = new AdPasswordVerifier(new AdProperties(true, - "ldaps://127.0.0.1:" + Fixture.LDAP.getListenPort(), "example.test", BASE)); - assertThatThrownBy(() -> wrongName.verify("alice", "fixture-password")) - .hasStackTraceContaining("No subject alternative names matching IP address"); - assertThatThrownBy(() -> new AdPasswordVerifier(new AdProperties(true, - "ldap://localhost:389", "example.test", BASE))).isInstanceOf(IllegalArgumentException.class); - } - - @Test - void browserRequiresHttpsCsrfAndOrderedSteps() throws Exception { - mvc.perform(get("/signin")).andExpect(status().isUpgradeRequired()); - mvc.perform(get("/signin/mfa").secure(true)).andExpect(redirectedUrl("/signin")); - mvc.perform(post("/signin/password").secure(true).param("username", "alice") - .param("password", "fixture-password")).andExpect(status().isForbidden()); - } - - @Test - void successfulPasswordRotatesSessionAndStopsBeforeMfa() throws Exception { - var session = new MockHttpSession(); - mvc.perform(get("/signin").secure(true).session(session)).andExpect(status().isOk()); - String oldId = session.getId(); - mvc.perform(post("/signin/password").secure(true).session(session).with(csrf()) - .param("username", "alice").param("password", "fixture-password")) - .andExpect(redirectedUrl("/signin/mfa")); - assertThat(session.getId()).isNotEqualTo(oldId); - var html = mvc.perform(get("/signin/mfa").secure(true).session(session)) - .andExpect(status().isOk()).andExpect(header().string("Cache-Control", "no-store")) - .andReturn().getResponse().getContentAsString(); - assertThat(html).contains("mfa-pending", "gitea-admins", "\\u003c/script\\u003e") - .doesNotContain("fixture-password", ""), + new com.unboundid.ldap.sdk.Attribute("mail", "alice@example.test"), + new com.unboundid.ldap.sdk.Attribute("objectGUID", GUID), + new com.unboundid.ldap.sdk.Attribute("memberOf", "CN=gitea-admins," + BASE, "CN=MixedCase," + BASE))); + } catch (Exception ex) { throw new ExceptionInInitializerError(ex); } + } + + + public String url() { return "ldaps://localhost:" + ldap.getListenPort(); } + public String mismatchedHostnameUrl() { return "ldaps://127.0.0.1:" + ldap.getListenPort(); } + @Override public void close() { ldap.shutDown(true); SSLContext.setDefault(original); } +}