20231109 1122 credential class (#2300)

* Add CredentialType for acc pol
* Reword ui hints
* Finish account policy
* Clean up artefacts

.gitignore

@@ -19,6 +19,9 @@ tools/orca/example_profiles/small/orca-edited.toml
 # webui things we don't need
 *.d.ts
 
+server/web_ui/*/pkg/*.js
+server/web_ui/*/pkg/*.wasm
+
 # kanidm simple packaging
 deployment-config/
 kanidm_simple_pkg/

libs/client/src/group.rs

@@ -21,6 +21,18 @@ impl KanidmClient {
         .await
     }
 
+    pub async fn group_account_policy_credential_type_minimum_set(
+        &self,
+        id: &str,
+        value: &str,
+    ) -> Result<(), ClientError> {
+        self.perform_put_request(
+            &format!("/v1/group/{}/_attr/credential_type_minimum", id),
+            vec![value.to_string()],
+        )
+        .await
+    }
+
     pub async fn group_account_policy_password_minimum_length_set(
         &self,
         id: &str,

proto/src/constants.rs

@@ -61,6 +61,7 @@ pub const ATTR_CLASSNAME: &str = "classname";
 pub const ATTR_CN: &str = "cn";
 pub const ATTR_COOKIE_PRIVATE_KEY: &str = "cookie_private_key";
 pub const ATTR_CREDENTIAL_UPDATE_INTENT_TOKEN: &str = "credential_update_intent_token";
+pub const ATTR_CREDENTIAL_TYPE_MINIMUM: &str = "credential_type_minimum";
 pub const ATTR_DENIED_NAME: &str = "denied_name";
 pub const ATTR_DESCRIPTION: &str = "description";
 pub const ATTR_DEVICEKEYS: &str = "devicekeys";

proto/src/v1.rs

@@ -1201,6 +1201,21 @@ pub enum CUExtPortal {
     Some(Url),
 }
 
+#[derive(Debug, Clone, Copy, Serialize, Deserialize, ToSchema)]
+pub enum CUCredState {
+    Modifiable,
+    AccessDeny,
+    PolicyDeny,
+    // Disabled,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, ToSchema)]
+pub enum CURegWarning {
+    MfaRequired,
+    PasskeyRequired,
+    Unsatisfiable,
+}
+
 #[derive(Debug, Clone, Serialize, Deserialize, ToSchema)]
 pub struct CUStatus {
     // Display values
@@ -1211,10 +1226,11 @@ pub struct CUStatus {
     pub mfaregstate: CURegState,
     // Display hints + The credential details.
     pub can_commit: bool,
+    pub warnings: Vec<CURegWarning>,
     pub primary: Option<CredentialDetail>,
-    pub primary_can_edit: bool,
+    pub primary_state: CUCredState,
     pub passkeys: Vec<PasskeyDetail>,
-    pub passkeys_can_edit: bool,
+    pub passkeys_state: CUCredState,
 }
 
 #[derive(Debug, Serialize, Deserialize, Clone, PartialEq, Eq, ToSchema)]

server/lib/src/be/dbvalue.rs

@@ -697,6 +697,8 @@ pub enum DbValueSetV2 {
     EcKeyPrivate(Vec<u8>),
     #[serde(rename = "IM")]
     Image(Vec<DbValueImage>),
+    #[serde(rename = "CT")]
+    CredentialType(Vec<u16>),
 }
 
 impl DbValueSetV2 {
@@ -742,7 +744,8 @@ impl DbValueSetV2 {
             DbValueSetV2::AuditLogString(set) => set.len(),
             DbValueSetV2::Image(set) => set.len(),
             DbValueSetV2::EcKeyPrivate(_key) => 1, // here we have to hard code it because the Vec<u8>
-                                                   // represents the bytes of  SINGLE(!) key
+            // represents the bytes of  SINGLE(!) key
+            DbValueSetV2::CredentialType(set) => set.len(),
         }
     }
 

server/lib/src/constants/acp.rs

@@ -1273,18 +1273,21 @@ lazy_static! {
             Attribute::Uuid,
             Attribute::AuthSessionExpiry,
             Attribute::AuthPasswordMinimumLength,
+            Attribute::CredentialTypeMinimum,
             Attribute::PrivilegeExpiry,
         ],
         modify_removed_attrs: vec![
             Attribute::Class,
             Attribute::AuthSessionExpiry,
             Attribute::AuthPasswordMinimumLength,
+            Attribute::CredentialTypeMinimum,
             Attribute::PrivilegeExpiry,
         ],
         modify_present_attrs: vec![
             Attribute::Class,
             Attribute::AuthSessionExpiry,
             Attribute::AuthPasswordMinimumLength,
+            Attribute::CredentialTypeMinimum,
             Attribute::PrivilegeExpiry,
         ],
         modify_classes: vec![

server/lib/src/constants/entries.rs

@@ -62,6 +62,7 @@ pub enum Attribute {
     Cn,
     CookiePrivateKey,
     CredentialUpdateIntentToken,
+    CredentialTypeMinimum,
     DeniedName,
     Description,
     DeviceKeys,
@@ -240,6 +241,7 @@ impl TryFrom<String> for Attribute {
             ATTR_CN => Attribute::Cn,
             ATTR_COOKIE_PRIVATE_KEY => Attribute::CookiePrivateKey,
             ATTR_CREDENTIAL_UPDATE_INTENT_TOKEN => Attribute::CredentialUpdateIntentToken,
+            ATTR_CREDENTIAL_TYPE_MINIMUM => Attribute::CredentialTypeMinimum,
             ATTR_DENIED_NAME => Attribute::DeniedName,
             ATTR_DESCRIPTION => Attribute::Description,
             ATTR_DEVICEKEYS => Attribute::DeviceKeys,
@@ -394,6 +396,7 @@ impl From<Attribute> for &'static str {
             Attribute::Cn => ATTR_CN,
             Attribute::CookiePrivateKey => ATTR_COOKIE_PRIVATE_KEY,
             Attribute::CredentialUpdateIntentToken => ATTR_CREDENTIAL_UPDATE_INTENT_TOKEN,
+            Attribute::CredentialTypeMinimum => ATTR_CREDENTIAL_TYPE_MINIMUM,
             Attribute::DeniedName => ATTR_DENIED_NAME,
             Attribute::Description => ATTR_DESCRIPTION,
             Attribute::DeviceKeys => ATTR_DEVICEKEYS,

server/lib/src/constants/schema.rs

@@ -560,7 +560,7 @@ pub static ref SCHEMA_ATTR_GRANT_UI_HINT: SchemaAttribute = SchemaAttribute {
 pub static ref SCHEMA_ATTR_SYNC_CREDENTIAL_PORTAL: SchemaAttribute = SchemaAttribute {
     uuid: UUID_SCHEMA_ATTR_SYNC_CREDENTIAL_PORTAL,
     name: Attribute::SyncCredentialPortal.into(),
-    description: "The url of an external credential portal for synced accounts to visit to update their credentials.to_string().".to_string(),
+    description: "The url of an external credential portal for synced accounts to visit to update their credentials.".to_string(),
 
     syntax: SyntaxType::Url,
     ..Default::default()
@@ -569,13 +569,23 @@ pub static ref SCHEMA_ATTR_SYNC_CREDENTIAL_PORTAL: SchemaAttribute = SchemaAttri
 pub static ref SCHEMA_ATTR_SYNC_YIELD_AUTHORITY: SchemaAttribute = SchemaAttribute {
     uuid: UUID_SCHEMA_ATTR_SYNC_YIELD_AUTHORITY,
     name: Attribute::SyncYieldAuthority.into(),
-    description: "A set of attributes that have their authority yielded to Kanidm in a sync agreement.to_string().".to_string(),
+    description: "A set of attributes that have their authority yielded to Kanidm in a sync agreement".to_string(),
 
     multivalue: true,
     syntax: SyntaxType::Utf8StringInsensitive,
     ..Default::default()
 };
 
+pub static ref SCHEMA_ATTR_CREDENTIAL_TYPE_MINIMUM: SchemaAttribute = SchemaAttribute {
+    uuid: UUID_SCHEMA_ATTR_CREDENTIAL_TYPE_MINIMUM,
+    name: Attribute::CredentialTypeMinimum.into(),
+    description: "The minimum level of credential type that can satisfy this policy".to_string(),
+
+    multivalue: false,
+    syntax: SyntaxType::CredentialType,
+    ..Default::default()
+};
+
 // === classes ===
 
 pub static ref SCHEMA_CLASS_PERSON: SchemaClass = SchemaClass {
@@ -647,6 +657,7 @@ pub static ref SCHEMA_CLASS_ACCOUNT_POLICY: SchemaClass = SchemaClass {
         Attribute::AuthSessionExpiry.into(),
         Attribute::PrivilegeExpiry.into(),
         Attribute::AuthPasswordMinimumLength.into(),
+        Attribute::CredentialTypeMinimum.into()
     ],
     systemsupplements: vec![Attribute::Group.into()],
     ..Default::default()

server/lib/src/constants/uuids.rs

@@ -247,6 +247,8 @@ pub const UUID_SCHEMA_ATTR_LDAP_ALLOW_UNIX_PW_BIND: Uuid =
 pub const UUID_SCHEMA_CLASS_ACCOUNT_POLICY: Uuid = uuid!("00000000-0000-0000-0000-ffff00000146");
 pub const UUID_SCHEMA_ATTR_AUTH_PASSWORD_MINIMUM_LENGTH: Uuid =
     uuid!("00000000-0000-0000-0000-ffff00000147");
+pub const UUID_SCHEMA_ATTR_CREDENTIAL_TYPE_MINIMUM: Uuid =
+    uuid!("00000000-0000-0000-0000-ffff00000148");
 
 // System and domain infos
 // I'd like to strongly criticise william of the past for making poor choices about these allocations.

server/lib/src/credential/mod.rs

@@ -678,6 +678,13 @@ impl Credential {
         }
     }
 
+    pub fn is_mfa(&self) -> bool {
+        match &self.type_ {
+            CredentialType::Password(_) | CredentialType::GeneratedPassword(_) => false,
+            CredentialType::PasswordMfa(..) | CredentialType::Webauthn(_) => true,
+        }
+    }
+
     #[cfg(test)]
     pub fn verify_password(&self, cleartext: &str) -> Result<bool, OperationError> {
         self.password_ref().and_then(|pw| {

server/lib/src/entry.rs

@@ -59,7 +59,8 @@ use crate::repl::proto::{ReplEntryV1, ReplIncrementalEntryV1};
 
 use crate::schema::{SchemaAttribute, SchemaClass, SchemaTransaction};
 use crate::value::{
-    ApiToken, IndexType, IntentTokenState, Oauth2Session, PartialValue, Session, SyntaxType, Value,
+    ApiToken, CredentialType, IndexType, IntentTokenState, Oauth2Session, PartialValue, Session,
+    SyntaxType, Value,
 };
 use crate::valueset::{self, ValueSet};
 
@@ -2557,6 +2558,13 @@ impl<VALID, STATE> Entry<VALID, STATE> {
         images.iter().next().cloned()
     }
 
+    #[inline(always)]
+    pub fn get_ava_single_credential_type(&self, attr: Attribute) -> Option<CredentialType> {
+        self.attrs
+            .get(attr.as_ref())
+            .and_then(|vs| vs.to_credentialtype_single())
+    }
+
     #[inline(always)]
     pub fn get_ava_as_oauthscopes(&self, attr: Attribute) -> Option<impl Iterator<Item = &str>> {
         self.attrs

server/lib/src/idm/accountpolicy.rs

@@ -1,39 +1,13 @@
 use crate::prelude::*;
+use crate::value::CredentialType;
 // use crate::idm::server::IdmServerProxyWriteTransaction;
 
-#[derive(Copy, Clone, Debug, Ord, PartialOrd, Eq, PartialEq, Default)]
-#[repr(u32)]
-pub(crate) enum CredentialPolicy {
-    #[default]
-    NoPolicy = 0,
-    MfaRequired = 10,
-    PasskeyRequired = 20,
-    AttestedPasskeyRequired = 30,
-    AttestedResidentKeyRequired = 40,
-}
-
-impl From<u32> for CredentialPolicy {
-    fn from(value: u32) -> Self {
-        if value >= CredentialPolicy::AttestedResidentKeyRequired as u32 {
-            CredentialPolicy::AttestedResidentKeyRequired
-        } else if value >= CredentialPolicy::AttestedPasskeyRequired as u32 {
-            CredentialPolicy::AttestedPasskeyRequired
-        } else if value >= CredentialPolicy::PasskeyRequired as u32 {
-            CredentialPolicy::PasskeyRequired
-        } else if value >= CredentialPolicy::MfaRequired as u32 {
-            CredentialPolicy::MfaRequired
-        } else {
-            CredentialPolicy::NoPolicy
-        }
-    }
-}
-
 #[derive(Clone)]
 pub(crate) struct AccountPolicy {
     privilege_expiry: u32,
     authsession_expiry: u32,
     pw_min_length: u32,
-    credential_policy: CredentialPolicy,
+    credential_policy: CredentialType,
 }
 
 impl From<&EntrySealedCommitted> for Option<AccountPolicy> {
@@ -54,7 +28,10 @@ impl From<&EntrySealedCommitted> for Option<AccountPolicy> {
         let pw_min_length = val
             .get_ava_single_uint32(Attribute::AuthPasswordMinimumLength)
             .unwrap_or(PW_MIN_LENGTH);
-        let credential_policy = CredentialPolicy::default();
+
+        let credential_policy = val
+            .get_ava_single_credential_type(Attribute::CredentialTypeMinimum)
+            .unwrap_or(CredentialType::Any);
 
         Some(AccountPolicy {
             privilege_expiry,
@@ -71,7 +48,7 @@ pub(crate) struct ResolvedAccountPolicy {
     privilege_expiry: u32,
     authsession_expiry: u32,
     pw_min_length: u32,
-    credential_policy: CredentialPolicy,
+    credential_policy: CredentialType,
 }
 
 impl ResolvedAccountPolicy {
@@ -84,7 +61,7 @@ impl ResolvedAccountPolicy {
             privilege_expiry: MAXIMUM_AUTH_PRIVILEGE_EXPIRY,
             authsession_expiry: MAXIMUM_AUTH_SESSION_EXPIRY,
             pw_min_length: PW_MIN_LENGTH,
-            credential_policy: CredentialPolicy::default(),
+            credential_policy: CredentialType::Any,
         };
 
         iter.for_each(|acc_pol| {
@@ -124,16 +101,14 @@ impl ResolvedAccountPolicy {
         self.pw_min_length
     }
 
-    /*
-    pub(crate) fn credential_policy(&self) -> CredentialPolicy {
+    pub(crate) fn credential_policy(&self) -> CredentialType {
         self.credential_policy
     }
-    */
 }
 
 #[cfg(test)]
 mod tests {
-    use super::{AccountPolicy, CredentialPolicy, ResolvedAccountPolicy};
+    use super::{AccountPolicy, CredentialType, ResolvedAccountPolicy};
     // use crate::prelude::*;
 
     #[test]
@@ -142,14 +117,14 @@ mod tests {
             privilege_expiry: 100,
             authsession_expiry: 100,
             pw_min_length: 11,
-            credential_policy: CredentialPolicy::MfaRequired,
+            credential_policy: CredentialType::Mfa,
         };
 
         let policy_b = AccountPolicy {
             privilege_expiry: 150,
             authsession_expiry: 50,
             pw_min_length: 15,
-            credential_policy: CredentialPolicy::PasskeyRequired,
+            credential_policy: CredentialType::Passkey,
         };
 
         let rap = ResolvedAccountPolicy::fold_from([policy_a, policy_b].into_iter());
@@ -157,7 +132,7 @@ mod tests {
         assert_eq!(rap.privilege_expiry(), 100);
         assert_eq!(rap.authsession_expiry(), 50);
         assert_eq!(rap.pw_min_length(), 15);
-        assert_eq!(rap.credential_policy, CredentialPolicy::PasskeyRequired);
+        assert_eq!(rap.credential_policy, CredentialType::Passkey);
     }
 
     /*

server/lib/src/idm/credupdatesession.rs

@@ -8,8 +8,8 @@ use sshkey_attest::proto::PublicKey as SshPublicKey;
 
 use hashbrown::HashSet;
 use kanidm_proto::v1::{
-    CUExtPortal, CURegState, CUStatus, CredentialDetail, PasskeyDetail, PasswordFeedback,
-    TotpSecret,
+    CUCredState, CUExtPortal, CURegState, CURegWarning, CUStatus, CredentialDetail, PasskeyDetail,
+    PasswordFeedback, TotpSecret,
 };
 use serde::{Deserialize, Serialize};
 use time::OffsetDateTime;
@@ -25,7 +25,7 @@ use crate::idm::server::{IdmServerCredUpdateTransaction, IdmServerProxyWriteTran
 use crate::prelude::*;
 use crate::server::access::Access;
 use crate::utils::{backup_code_from_random, readable_password_from_random, uuid_from_duration};
-use crate::value::{CredUpdateSessionPerms, IntentTokenState};
+use crate::value::{CredUpdateSessionPerms, CredentialType, IntentTokenState};
 
 use super::accountpolicy::ResolvedAccountPolicy;
 
@@ -85,6 +85,25 @@ impl fmt::Debug for MfaRegState {
     }
 }
 
+#[derive(Debug, Clone, Copy)]
+enum CredentialState {
+    Modifiable,
+    AccessDeny,
+    PolicyDeny,
+    // Disabled,
+}
+
+impl Into<CUCredState> for CredentialState {
+    fn into(self) -> CUCredState {
+        match self {
+            CredentialState::Modifiable => CUCredState::Modifiable,
+            CredentialState::AccessDeny => CUCredState::AccessDeny,
+            CredentialState::PolicyDeny => CUCredState::PolicyDeny,
+            // CredentialState::Disabled => CUCredState::Disabled ,
+        }
+    }
+}
+
 #[derive(Clone)]
 pub(crate) struct CredentialUpdateSession {
     issuer: String,
@@ -99,8 +118,8 @@ pub(crate) struct CredentialUpdateSession {
     ext_cred_portal: CUExtPortal,
 
     // The pw credential as they are being updated
+    primary_state: CredentialState,
     primary: Option<Credential>,
-    primary_can_edit: bool,
 
     // Unix / Sudo PW
     unixcred: Option<Credential>,
@@ -112,7 +131,7 @@ pub(crate) struct CredentialUpdateSession {
 
     // Passkeys that have been configured.
     passkeys: BTreeMap<Uuid, (String, PasskeyV4)>,
-    passkeys_can_edit: bool,
+    passkeys_state: CredentialState,
 
     // Devicekeys
     _devicekeys: BTreeMap<Uuid, (String, DeviceKeyV4)>,
@@ -139,7 +158,9 @@ impl fmt::Debug for CredentialUpdateSession {
             .field("resolved_account_policy", &self.resolved_account_policy)
             .field("intent_token_id", &self.intent_token_id)
             .field("primary.detail()", &primary)
+            .field("primary.state", &self.primary_state)
             .field("passkeys.list()", &passkeys)
+            .field("passkeys.state", &self.passkeys_state)
             .field("mfaregstate", &self.mfaregstate)
             .finish()
     }
@@ -148,31 +169,45 @@ impl fmt::Debug for CredentialUpdateSession {
 impl CredentialUpdateSession {
     // In future this should be a Vec of the issues with the current session so that UI's can highlight
     // properly how to proceed.
-    fn can_commit(&self) -> bool {
+    fn can_commit(&self) -> (bool, Vec<CredentialUpdateSessionStatusWarnings>) {
         // Should be it's own PR and use account policy
+        let mut warnings = Vec::with_capacity(0);
 
-        /*
-        // We'll check policy here in future.
-        let is_primary_valid = match self.primary.as_ref() {
-            Some(Credential {
-                uuid: _,
-                type_: CredentialType::Password(_),
-            }) => {
-                // We refuse password-only auth now.
-                info!("Password only authentication.");
-                false
+        let cred_type_min = self.resolved_account_policy.credential_policy();
+
+        debug!(?cred_type_min);
+
+        match cred_type_min {
+            CredentialType::Any => {}
+            CredentialType::Mfa => {
+                if self
+                    .primary
+                    .as_ref()
+                    .map(|cred| !cred.is_mfa())
+                    // If it's none, then we can proceed because we satisfy mfa on other
+                    // parts.
+                    .unwrap_or(false)
+                {
+                    warnings.push(CredentialUpdateSessionStatusWarnings::MfaRequired);
+                }
             }
-            // So far valid.
-            _ => true,
-        };
+            CredentialType::Passkey => {
+                // NOTE: Technically this is unreachable, but we keep it for correctness.
+                // Primary can't be set at all.
+                if self.primary.is_some() {
+                    warnings.push(CredentialUpdateSessionStatusWarnings::PasskeyRequired);
+                }
+            }
+            // For now these error too.
+            CredentialType::AttestedPasskey
+            | CredentialType::AttestedResidentkey
+            | CredentialType::Invalid => {
+                // special case, must always deny all changes.
+                warnings.push(CredentialUpdateSessionStatusWarnings::Unsatisfiable)
+            }
+        }
 
-        info!("can_commit -> {}", is_primary_valid);
-
-        // For logic later.
-        is_primary_valid
-        */
-
-        true
+        (warnings.is_empty(), warnings)
     }
 }
 
@@ -200,6 +235,23 @@ impl fmt::Debug for MfaRegStateStatus {
     }
 }
 
+#[derive(Debug, PartialEq, Eq, Clone, Copy)]
+pub enum CredentialUpdateSessionStatusWarnings {
+    MfaRequired,
+    PasskeyRequired,
+    Unsatisfiable,
+}
+
+impl Into<CURegWarning> for CredentialUpdateSessionStatusWarnings {
+    fn into(self) -> CURegWarning {
+        match self {
+            CredentialUpdateSessionStatusWarnings::MfaRequired => CURegWarning::MfaRequired,
+            CredentialUpdateSessionStatusWarnings::PasskeyRequired => CURegWarning::PasskeyRequired,
+            CredentialUpdateSessionStatusWarnings::Unsatisfiable => CURegWarning::Unsatisfiable,
+        }
+    }
+}
+
 #[derive(Debug)]
 pub struct CredentialUpdateSessionStatus {
     spn: String,
@@ -209,10 +261,12 @@ pub struct CredentialUpdateSessionStatus {
     // Any info the client needs about mfareg state.
     mfaregstate: MfaRegStateStatus,
     can_commit: bool,
+    // If can_commit is false, this will have warnings populated.
+    warnings: Vec<CredentialUpdateSessionStatusWarnings>,
     primary: Option<CredentialDetail>,
-    primary_can_edit: bool,
+    primary_state: CredentialState,
     passkeys: Vec<PasskeyDetail>,
-    passkeys_can_edit: bool,
+    passkeys_state: CredentialState,
 }
 
 impl CredentialUpdateSessionStatus {
@@ -245,23 +299,27 @@ impl Into<CUStatus> for CredentialUpdateSessionStatus {
                 MfaRegStateStatus::Passkey(r) => CURegState::Passkey(r),
             },
             can_commit: self.can_commit,
+            warnings: self.warnings.into_iter().map(|w| w.into()).collect(),
             primary: self.primary,
-            primary_can_edit: self.primary_can_edit,
+            primary_state: self.primary_state.into(),
             passkeys: self.passkeys,
-            passkeys_can_edit: self.passkeys_can_edit,
+            passkeys_state: self.passkeys_state.into(),
         }
     }
 }
 
 impl From<&CredentialUpdateSession> for CredentialUpdateSessionStatus {
     fn from(session: &CredentialUpdateSession) -> Self {
+        let (can_commit, warnings) = session.can_commit();
+
         CredentialUpdateSessionStatus {
             spn: session.account.spn.clone(),
             displayname: session.account.displayname.clone(),
             ext_cred_portal: session.ext_cred_portal.clone(),
-            can_commit: session.can_commit(),
+            can_commit,
+            warnings,
             primary: session.primary.as_ref().map(|c| c.into()),
-            primary_can_edit: session.primary_can_edit,
+            primary_state: session.primary_state,
             passkeys: session
                 .passkeys
                 .iter()
@@ -270,7 +328,7 @@ impl From<&CredentialUpdateSession> for CredentialUpdateSessionStatus {
                     uuid: *uuid,
                 })
                 .collect(),
-            passkeys_can_edit: session.passkeys_can_edit,
+            passkeys_state: session.passkeys_state,
             mfaregstate: match &session.mfaregstate {
                 MfaRegState::None => MfaRegStateStatus::None,
                 MfaRegState::TotpInit(token) => MfaRegStateStatus::TotpCheck(
@@ -541,19 +599,35 @@ impl<'a> IdmServerProxyWriteTransaction<'a> {
         ct: Duration,
     ) -> Result<(CredentialUpdateSessionToken, CredentialUpdateSessionStatus), OperationError> {
         let ext_cred_portal_can_view = perms.ext_cred_portal_can_view;
-        let primary_can_edit = perms.primary_can_edit;
-        let passkeys_can_edit = perms.passkeys_can_edit;
         let unixcred_can_edit = perms.unixcred_can_edit;
         let sshpubkey_can_edit = perms.sshpubkey_can_edit;
 
+        let cred_type_min = resolved_account_policy.credential_policy();
+
+        let primary_state = if cred_type_min > CredentialType::Mfa {
+            CredentialState::PolicyDeny
+        } else if perms.primary_can_edit {
+            CredentialState::Modifiable
+        } else {
+            CredentialState::AccessDeny
+        };
+
+        let passkeys_state = if cred_type_min > CredentialType::Passkey {
+            CredentialState::PolicyDeny
+        } else if perms.passkeys_can_edit {
+            CredentialState::Modifiable
+        } else {
+            CredentialState::AccessDeny
+        };
+
         // - stash the current state of all associated credentials
-        let primary = if primary_can_edit {
+        let primary = if matches!(primary_state, CredentialState::Modifiable) {
             account.primary.clone()
         } else {
             None
         };
 
-        let passkeys = if passkeys_can_edit {
+        let passkeys = if matches!(passkeys_state, CredentialState::Modifiable) {
             account.passkeys.clone()
         } else {
             BTreeMap::default()
@@ -602,13 +676,13 @@ impl<'a> IdmServerProxyWriteTransaction<'a> {
             intent_token_id,
             ext_cred_portal,
             primary,
-            primary_can_edit,
+            primary_state,
             unixcred,
             unixcred_can_edit,
             sshkeys,
             sshpubkey_can_edit,
             passkeys,
-            passkeys_can_edit,
+            passkeys_state,
             _devicekeys: devicekeys,
             _devicekeys_can_edit: false,
             mfaregstate: MfaRegState::None,
@@ -1009,7 +1083,7 @@ impl<'a> IdmServerProxyWriteTransaction<'a> {
             self.credential_update_commit_common(cust, ct)?;
 
         // Can we actually proceed?
-        if !session.can_commit() {
+        if !session.can_commit().0 {
             admin_error!("Session is unable to commit due to a constraint violation.");
             return Err(OperationError::InvalidState);
         }
@@ -1067,23 +1141,36 @@ impl<'a> IdmServerProxyWriteTransaction<'a> {
             ));
         };
 
-        if session.primary_can_edit {
-            modlist.push_mod(Modify::Purged(Attribute::PrimaryCredential.into()));
-            if let Some(ncred) = &session.primary {
-                let vcred = Value::new_credential("primary", ncred.clone());
-                modlist.push_mod(Modify::Present(Attribute::PrimaryCredential.into(), vcred));
-            };
+        match session.primary_state {
+            CredentialState::Modifiable => {
+                modlist.push_mod(Modify::Purged(Attribute::PrimaryCredential.into()));
+                if let Some(ncred) = &session.primary {
+                    let vcred = Value::new_credential("primary", ncred.clone());
+                    modlist.push_mod(Modify::Present(Attribute::PrimaryCredential.into(), vcred));
+                };
+            }
+            CredentialState::PolicyDeny => {
+                modlist.push_mod(Modify::Purged(Attribute::PrimaryCredential.into()));
+            }
+            // CredentialState::Disabled |
+            CredentialState::AccessDeny => {}
         };
 
-        if session.passkeys_can_edit {
-            // Need to update passkeys.
-            modlist.push_mod(Modify::Purged(Attribute::PassKeys.into()));
-            // Add all the passkeys. If none, nothing will be added! This handles
-            // the delete case quite cleanly :)
-            session.passkeys.iter().for_each(|(uuid, (tag, pk))| {
-                let v_pk = Value::Passkey(*uuid, tag.clone(), pk.clone());
-                modlist.push_mod(Modify::Present(Attribute::PassKeys.into(), v_pk));
-            });
+        match session.passkeys_state {
+            CredentialState::Modifiable => {
+                modlist.push_mod(Modify::Purged(Attribute::PassKeys.into()));
+                // Add all the passkeys. If none, nothing will be added! This handles
+                // the delete case quite cleanly :)
+                session.passkeys.iter().for_each(|(uuid, (tag, pk))| {
+                    let v_pk = Value::Passkey(*uuid, tag.clone(), pk.clone());
+                    modlist.push_mod(Modify::Present(Attribute::PassKeys.into(), v_pk));
+                });
+            }
+            CredentialState::PolicyDeny => {
+                modlist.push_mod(Modify::Purged(Attribute::PassKeys.into()));
+            }
+            // CredentialState::Disabled |
+            CredentialState::AccessDeny => {}
         };
 
         if session.unixcred_can_edit {
@@ -1450,7 +1537,7 @@ impl<'a> IdmServerCredUpdateTransaction<'a> {
         })?;
         trace!(?session);
 
-        if !session.primary_can_edit {
+        if !matches!(session.primary_state, CredentialState::Modifiable) {
             error!("Session does not have permission to modify primary credential");
             return Err(OperationError::AccessDenied);
         };
@@ -1498,7 +1585,7 @@ impl<'a> IdmServerCredUpdateTransaction<'a> {
         })?;
         trace!(?session);
 
-        if !session.primary_can_edit {
+        if !matches!(session.primary_state, CredentialState::Modifiable) {
             error!("Session does not have permission to modify primary credential");
             return Err(OperationError::AccessDenied);
         };
@@ -1532,7 +1619,7 @@ impl<'a> IdmServerCredUpdateTransaction<'a> {
         })?;
         trace!(?session);
 
-        if !session.primary_can_edit {
+        if !matches!(session.primary_state, CredentialState::Modifiable) {
             error!("Session does not have permission to modify primary credential");
             return Err(OperationError::AccessDenied);
         };
@@ -1596,7 +1683,7 @@ impl<'a> IdmServerCredUpdateTransaction<'a> {
         })?;
         trace!(?session);
 
-        if !session.primary_can_edit {
+        if !matches!(session.primary_state, CredentialState::Modifiable) {
             error!("Session does not have permission to modify primary credential");
             return Err(OperationError::AccessDenied);
         };
@@ -1639,7 +1726,7 @@ impl<'a> IdmServerCredUpdateTransaction<'a> {
         })?;
         trace!(?session);
 
-        if !session.primary_can_edit {
+        if !matches!(session.primary_state, CredentialState::Modifiable) {
             error!("Session does not have permission to modify primary credential");
             return Err(OperationError::AccessDenied);
         };
@@ -1677,7 +1764,7 @@ impl<'a> IdmServerCredUpdateTransaction<'a> {
         })?;
         trace!(?session);
 
-        if !session.primary_can_edit {
+        if !matches!(session.primary_state, CredentialState::Modifiable) {
             error!("Session does not have permission to modify primary credential");
             return Err(OperationError::AccessDenied);
         };
@@ -1722,7 +1809,7 @@ impl<'a> IdmServerCredUpdateTransaction<'a> {
         })?;
         trace!(?session);
 
-        if !session.primary_can_edit {
+        if !matches!(session.primary_state, CredentialState::Modifiable) {
             error!("Session does not have permission to modify primary credential");
             return Err(OperationError::AccessDenied);
         };
@@ -1760,7 +1847,7 @@ impl<'a> IdmServerCredUpdateTransaction<'a> {
         })?;
         trace!(?session);
 
-        if !session.passkeys_can_edit {
+        if !matches!(session.passkeys_state, CredentialState::Modifiable) {
             error!("Session does not have permission to modify primary credential");
             return Err(OperationError::AccessDenied);
         };
@@ -1802,7 +1889,7 @@ impl<'a> IdmServerCredUpdateTransaction<'a> {
         })?;
         trace!(?session);
 
-        if !session.passkeys_can_edit {
+        if !matches!(session.passkeys_state, CredentialState::Modifiable) {
             error!("Session does not have permission to modify primary credential");
             return Err(OperationError::AccessDenied);
         };
@@ -1841,7 +1928,7 @@ impl<'a> IdmServerCredUpdateTransaction<'a> {
         })?;
         trace!(?session);
 
-        if !session.passkeys_can_edit {
+        if !matches!(session.passkeys_state, CredentialState::Modifiable) {
             error!("Session does not have permission to modify primary credential");
             return Err(OperationError::AccessDenied);
         };
@@ -1879,7 +1966,7 @@ impl<'a> IdmServerCredUpdateTransaction<'a> {
         })?;
         trace!(?session);
 
-        if !session.primary_can_edit {
+        if !matches!(session.primary_state, CredentialState::Modifiable) {
             error!("Session does not have permission to modify primary credential");
             return Err(OperationError::AccessDenied);
         };
@@ -1904,17 +1991,18 @@ mod tests {
     use webauthn_authenticator_rs::WebauthnAuthenticator;
 
     use super::{
-        CredentialUpdateSessionStatus, CredentialUpdateSessionToken, InitCredentialUpdateEvent,
-        InitCredentialUpdateIntentEvent, MfaRegStateStatus, MAXIMUM_CRED_UPDATE_TTL,
-        MAXIMUM_INTENT_TTL, MINIMUM_INTENT_TTL,
+        CredentialState, CredentialUpdateSessionStatus, CredentialUpdateSessionStatusWarnings,
+        CredentialUpdateSessionToken, InitCredentialUpdateEvent, InitCredentialUpdateIntentEvent,
+        MfaRegStateStatus, MAXIMUM_CRED_UPDATE_TTL, MAXIMUM_INTENT_TTL, MINIMUM_INTENT_TTL,
     };
     use crate::credential::totp::Totp;
     use crate::event::CreateEvent;
     use crate::idm::delayed::DelayedAction;
     use crate::idm::event::{AuthEvent, AuthResult, RegenerateRadiusSecretEvent};
-    use crate::idm::server::{IdmServer, IdmServerDelayed};
+    use crate::idm::server::{IdmServer, IdmServerCredUpdateTransaction, IdmServerDelayed};
     use crate::idm::AuthState;
     use crate::prelude::*;
+    use crate::value::CredentialType;
 
     const TEST_CURRENT_TIME: u64 = 6000;
     const TESTPERSON_UUID: Uuid = uuid!("cf231fea-1a8f-4410-a520-fd9b1a379c86");
@@ -2654,7 +2742,7 @@ mod tests {
         // Intentionally get it wrong.
         let c_status = cutxn
             .credential_primary_check_totp(&cust, ct, chal + 1, "totp")
-            .expect("Failed to update the primary cred password");
+            .expect("Failed to update the primary cred totp");
 
         assert!(matches!(
             c_status.mfaregstate,
@@ -2663,7 +2751,7 @@ mod tests {
 
         let c_status = cutxn
             .credential_primary_check_totp(&cust, ct, chal, "totp")
-            .expect("Failed to update the primary cred password");
+            .expect("Failed to update the primary cred totp");
 
         assert!(matches!(c_status.mfaregstate, MfaRegStateStatus::None));
         assert!(match c_status.primary.as_ref().map(|c| &c.type_) {
@@ -2972,20 +3060,13 @@ mod tests {
     // - remove webauthn
     // - test multiple webauthn token.
 
-    #[idm_test]
-    async fn test_idm_credential_update_onboarding_create_new_passkey(
-        idms: &IdmServer,
-        idms_delayed: &mut IdmServerDelayed,
-    ) {
-        let ct = Duration::from_secs(TEST_CURRENT_TIME);
-
-        let (cust, _) = setup_test_session(idms, ct).await;
-        let cutxn = idms.cred_update_transaction().await;
-        let origin = cutxn.get_origin().clone();
-
-        // Create a soft passkey
-        let mut wa = WebauthnAuthenticator::new(SoftPasskey::new(true));
-
+    async fn create_new_passkey(
+        ct: Duration,
+        origin: &Url,
+        cutxn: &IdmServerCredUpdateTransaction<'_>,
+        cust: &CredentialUpdateSessionToken,
+        wa: &mut WebauthnAuthenticator<SoftPasskey>,
+    ) -> CredentialUpdateSessionStatus {
         // Start the registration
         let c_status = cutxn
             .credential_passkey_init(&cust, ct)
@@ -3020,6 +3101,25 @@ mod tests {
         trace!(?c_status);
         assert!(c_status.passkeys.len() == 1);
 
+        c_status
+    }
+
+    #[idm_test]
+    async fn test_idm_credential_update_onboarding_create_new_passkey(
+        idms: &IdmServer,
+        idms_delayed: &mut IdmServerDelayed,
+    ) {
+        let ct = Duration::from_secs(TEST_CURRENT_TIME);
+
+        let (cust, _) = setup_test_session(idms, ct).await;
+        let cutxn = idms.cred_update_transaction().await;
+        let origin = cutxn.get_origin().clone();
+
+        // Create a soft passkey
+        let mut wa = WebauthnAuthenticator::new(SoftPasskey::new(true));
+
+        let c_status = create_new_passkey(ct, &origin, &cutxn, &cust, &mut wa).await;
+
         // Get the UUID of the passkey here.
         let pk_uuid = c_status.passkeys.first().map(|pkd| pkd.uuid).unwrap();
 
@@ -3126,15 +3226,16 @@ mod tests {
             ext_cred_portal,
             mfaregstate: _,
             can_commit: _,
+            warnings: _,
             primary: _,
-            primary_can_edit,
+            primary_state,
             passkeys: _,
-            passkeys_can_edit,
+            passkeys_state,
         } = custatus;
 
         assert!(matches!(ext_cred_portal, CUExtPortal::Hidden));
-        assert!(!primary_can_edit);
-        assert!(!passkeys_can_edit);
+        assert!(matches!(primary_state, CredentialState::AccessDeny));
+        assert!(matches!(passkeys_state, CredentialState::AccessDeny));
 
         let cutxn = idms.cred_update_transaction().await;
 
@@ -3210,7 +3311,186 @@ mod tests {
         commit_session(idms, ct, cust).await;
     }
 
-    // W_ policy, assert can't remove MFA if it's enforced.
+    // Assert we can't create "just" a password when mfa is required.
+    #[idm_test]
+    async fn test_idm_credential_update_account_policy_mfa_required(
+        idms: &IdmServer,
+        _idms_delayed: &mut IdmServerDelayed,
+    ) {
+        let test_pw = "fo3EitierohF9AelaNgiem0Ei6vup4equo1Oogeevaetehah8Tobeengae3Ci0ooh0uki";
+        let ct = Duration::from_secs(TEST_CURRENT_TIME);
+
+        let mut idms_prox_write = idms.proxy_write(ct).await;
+
+        let modlist = ModifyList::new_purge_and_set(
+            Attribute::CredentialTypeMinimum,
+            CredentialType::Mfa.into(),
+        );
+        idms_prox_write
+            .qs_write
+            .internal_modify_uuid(UUID_IDM_ALL_ACCOUNTS, &modlist)
+            .expect("Unable to change default session exp");
+
+        assert!(idms_prox_write.commit().is_ok());
+        // This now will affect all accounts for the next cred update.
+
+        let (cust, _) = setup_test_session(idms, ct).await;
+
+        let cutxn = idms.cred_update_transaction().await;
+
+        // Get the credential status - this should tell
+        // us the details of the credentials, as well as
+        // if they are ready and valid to commit?
+        let c_status = cutxn
+            .credential_update_status(&cust, ct)
+            .expect("Failed to get the current session status.");
+
+        trace!(?c_status);
+
+        assert!(c_status.primary.is_none());
+
+        // Test initially creating a credential.
+        //   - pw first
+        let c_status = cutxn
+            .credential_primary_set_password(&cust, ct, test_pw)
+            .expect("Failed to update the primary cred password");
+
+        assert!(!c_status.can_commit);
+        assert!(c_status
+            .warnings
+            .contains(&CredentialUpdateSessionStatusWarnings::MfaRequired));
+        // Check reason! Must show "no mfa". We need totp to be added now.
+
+        let c_status = cutxn
+            .credential_primary_init_totp(&cust, ct)
+            .expect("Failed to update the primary cred password");
+
+        // Check the status has the token.
+        let totp_token: Totp = match c_status.mfaregstate {
+            MfaRegStateStatus::TotpCheck(secret) => Some(secret.try_into().unwrap()),
+
+            _ => None,
+        }
+        .expect("Unable to retrieve totp token, invalid state.");
+
+        trace!(?totp_token);
+        let chal = totp_token
+            .do_totp_duration_from_epoch(&ct)
+            .expect("Failed to perform totp step");
+
+        let c_status = cutxn
+            .credential_primary_check_totp(&cust, ct, chal, "totp")
+            .expect("Failed to update the primary cred totp");
+
+        assert!(matches!(c_status.mfaregstate, MfaRegStateStatus::None));
+        assert!(match c_status.primary.as_ref().map(|c| &c.type_) {
+            Some(CredentialDetailType::PasswordMfa(totp, _, 0)) => !totp.is_empty(),
+            _ => false,
+        });
+
+        // Done, can now commit.
+        assert!(c_status.can_commit);
+        assert!(c_status.warnings.is_empty());
+
+        drop(cutxn);
+        commit_session(idms, ct, cust).await;
+
+        // If we remove TOTP, it blocks commit.
+        let (cust, _) = renew_test_session(idms, ct).await;
+        let cutxn = idms.cred_update_transaction().await;
+
+        let c_status = cutxn
+            .credential_primary_remove_totp(&cust, ct, "totp")
+            .expect("Failed to update the primary cred totp");
+
+        assert!(matches!(c_status.mfaregstate, MfaRegStateStatus::None));
+        assert!(matches!(
+            c_status.primary.as_ref().map(|c| &c.type_),
+            Some(CredentialDetailType::Password)
+        ));
+
+        // Delete of the totp forces us back here.
+        assert!(!c_status.can_commit);
+        assert!(c_status
+            .warnings
+            .contains(&CredentialUpdateSessionStatusWarnings::MfaRequired));
+
+        // Passkeys satisfy the policy though
+        let c_status = cutxn
+            .credential_primary_delete(&cust, ct)
+            .expect("Failed to delete the primary credential");
+        assert!(c_status.primary.is_none());
+
+        let origin = cutxn.get_origin().clone();
+        let mut wa = WebauthnAuthenticator::new(SoftPasskey::new(true));
+
+        let c_status = create_new_passkey(ct, &origin, &cutxn, &cust, &mut wa).await;
+
+        assert!(c_status.can_commit);
+        assert!(c_status.warnings.is_empty());
+        assert!(c_status.passkeys.len() == 1);
+
+        drop(cutxn);
+        commit_session(idms, ct, cust).await;
+    }
+
+    #[idm_test]
+    async fn test_idm_credential_update_account_policy_passkey_required(
+        idms: &IdmServer,
+        _idms_delayed: &mut IdmServerDelayed,
+    ) {
+        let test_pw = "fo3EitierohF9AelaNgiem0Ei6vup4equo1Oogeevaetehah8Tobeengae3Ci0ooh0uki";
+        let ct = Duration::from_secs(TEST_CURRENT_TIME);
+
+        let mut idms_prox_write = idms.proxy_write(ct).await;
+
+        let modlist = ModifyList::new_purge_and_set(
+            Attribute::CredentialTypeMinimum,
+            CredentialType::Passkey.into(),
+        );
+        idms_prox_write
+            .qs_write
+            .internal_modify_uuid(UUID_IDM_ALL_ACCOUNTS, &modlist)
+            .expect("Unable to change default session exp");
+
+        assert!(idms_prox_write.commit().is_ok());
+        // This now will affect all accounts for the next cred update.
+
+        let (cust, _) = setup_test_session(idms, ct).await;
+
+        let cutxn = idms.cred_update_transaction().await;
+
+        // Get the credential status - this should tell
+        // us the details of the credentials, as well as
+        // if they are ready and valid to commit?
+        let c_status = cutxn
+            .credential_update_status(&cust, ct)
+            .expect("Failed to get the current session status.");
+
+        trace!(?c_status);
+        assert!(c_status.primary.is_none());
+        assert!(matches!(
+            c_status.primary_state,
+            CredentialState::PolicyDeny
+        ));
+
+        let err = cutxn
+            .credential_primary_set_password(&cust, ct, test_pw)
+            .unwrap_err();
+        assert!(matches!(err, OperationError::AccessDenied));
+
+        let origin = cutxn.get_origin().clone();
+        let mut wa = WebauthnAuthenticator::new(SoftPasskey::new(true));
+
+        let c_status = create_new_passkey(ct, &origin, &cutxn, &cust, &mut wa).await;
+
+        assert!(c_status.can_commit);
+        assert!(c_status.warnings.is_empty());
+        assert!(c_status.passkeys.len() == 1);
+
+        drop(cutxn);
+        commit_session(idms, ct, cust).await;
+    }
 
     // enroll trusted device
     // remove trusted device.

server/lib/src/plugins/protected.rs

@@ -17,7 +17,7 @@ pub struct Protected {}
 
 lazy_static! {
     static ref ALLOWED_ATTRS: HashSet<Attribute> = {
-        let mut m = HashSet::with_capacity(16);
+        let mut m = HashSet::with_capacity(32);
         // Allow modification of some schema class types to allow local extension
         // of schema types.
         //
@@ -35,6 +35,7 @@ lazy_static! {
         // Allow modification of account policy values for dyngroups
         m.insert(Attribute::AuthSessionExpiry);
         m.insert(Attribute::PrivilegeExpiry);
+        m.insert(Attribute::CredentialTypeMinimum);
         m
     };
 }

server/lib/src/repl/proto.rs

@@ -412,6 +412,9 @@ pub enum ReplAttrV1 {
     Image {
         set: Vec<DbValueImage>,
     },
+    CredentialType {
+        set: Vec<u16>,
+    },
 }
 
 #[derive(Serialize, Deserialize, Debug, PartialEq, Eq)]

server/lib/src/schema.rs

@@ -230,6 +230,7 @@ impl SchemaAttribute {
             SyntaxType::TotpSecret => matches!(v, PartialValue::Utf8(_)),
             SyntaxType::AuditLogString => matches!(v, PartialValue::Utf8(_)),
             SyntaxType::Image => matches!(v, PartialValue::Utf8(_)),
+            SyntaxType::CredentialType => matches!(v, PartialValue::CredentialType(_)),
         };
         if r {
             Ok(())
@@ -282,6 +283,7 @@ impl SchemaAttribute {
                 SyntaxType::AuditLogString => matches!(v, Value::Utf8(_)),
                 SyntaxType::EcKeyPrivate => matches!(v, Value::EcKeyPrivate(_)),
                 SyntaxType::Image => matches!(v, Value::Image(_)),
+                SyntaxType::CredentialType => matches!(v, Value::CredentialType(_)),
             };
         if r {
             Ok(())

server/lib/src/server/migrations.rs

@@ -612,6 +612,7 @@ impl<'a> QueryServerWriteTransaction<'a> {
             SCHEMA_ATTR_UNIX_PASSWORD.clone().into(),
             SCHEMA_ATTR_USER_AUTH_TOKEN_SESSION.clone().into(),
             SCHEMA_ATTR_DENIED_NAME.clone().into(),
+            SCHEMA_ATTR_CREDENTIAL_TYPE_MINIMUM.clone().into(),
         ];
 
         let r = idm_schema

server/lib/src/server/mod.rs

@@ -26,7 +26,7 @@ use crate::schema::{
     Schema, SchemaAttribute, SchemaClass, SchemaReadTransaction, SchemaTransaction,
     SchemaWriteTransaction,
 };
-use crate::value::EXTRACT_VAL_DN;
+use crate::value::{CredentialType, EXTRACT_VAL_DN};
 use crate::valueset::uuid_to_proto_string;
 
 use self::access::{
@@ -539,6 +539,9 @@ pub trait QueryServerTransaction<'a> {
                         .ok_or_else(|| OperationError::InvalidAttribute("Invalid Syntax syntax".to_string())),
                     SyntaxType::IndexId => Value::new_indexes(value)
                         .ok_or_else(|| OperationError::InvalidAttribute("Invalid Index syntax".to_string())),
+                    SyntaxType::CredentialType => CredentialType::try_from(value)
+                        .map(Value::CredentialType)
+                        .map_err(|()| OperationError::InvalidAttribute("Invalid CredentialType syntax".to_string())),
                     SyntaxType::Uuid => {
                         // Attempt to resolve this name to a uuid. If it's already a uuid, then
                         // name to uuid will "do the right thing" and give us the Uuid back.
@@ -627,6 +630,13 @@ pub trait QueryServerTransaction<'a> {
                     SyntaxType::IndexId => PartialValue::new_indexes(value).ok_or_else(|| {
                         OperationError::InvalidAttribute("Invalid Index syntax".to_string())
                     }),
+                    SyntaxType::CredentialType => CredentialType::try_from(value)
+                        .map(PartialValue::CredentialType)
+                        .map_err(|()| {
+                            OperationError::InvalidAttribute(
+                                "Invalid CredentialType syntax".to_string(),
+                            )
+                        }),
                     SyntaxType::Uuid => {
                         let un = self.name_to_uuid(value).unwrap_or(UUID_DOES_NOT_EXIST);
                         Ok(PartialValue::Uuid(un))

server/lib/src/value.rs

@@ -259,6 +259,7 @@ pub enum SyntaxType {
     AuditLogString = 32,
     EcKeyPrivate = 33,
     Image = 34,
+    CredentialType = 35,
 }
 
 impl TryFrom<&str> for SyntaxType {
@@ -302,6 +303,7 @@ impl TryFrom<&str> for SyntaxType {
             "APITOKEN" => Ok(SyntaxType::ApiToken),
             "AUDIT_LOG_STRING" => Ok(SyntaxType::AuditLogString),
             "EC_KEY_PRIVATE" => Ok(SyntaxType::EcKeyPrivate),
+            "CREDENTIAL_TYPE" => Ok(SyntaxType::CredentialType),
             _ => Err(()),
         }
     }
@@ -345,10 +347,77 @@ impl fmt::Display for SyntaxType {
             SyntaxType::AuditLogString => "AUDIT_LOG_STRING",
             SyntaxType::EcKeyPrivate => "EC_KEY_PRIVATE",
             SyntaxType::Image => "IMAGE",
+            SyntaxType::CredentialType => "CREDENTIAL_TYPE",
         })
     }
 }
 
+#[derive(
+    Hash,
+    Debug,
+    Clone,
+    Copy,
+    PartialEq,
+    Eq,
+    PartialOrd,
+    Ord,
+    Deserialize,
+    Serialize,
+    TryFromPrimitive,
+    Default,
+)]
+#[repr(u16)]
+pub enum CredentialType {
+    Any = 0,
+    #[default]
+    Mfa = 10,
+    Passkey = 20,
+    AttestedPasskey = 30,
+    AttestedResidentkey = 40,
+    Invalid = u16::MAX,
+}
+
+impl TryFrom<&str> for CredentialType {
+    type Error = ();
+
+    fn try_from(value: &str) -> Result<CredentialType, Self::Error> {
+        match value {
+            "any" => Ok(CredentialType::Any),
+            "mfa" => Ok(CredentialType::Mfa),
+            "passkey" => Ok(CredentialType::Passkey),
+            "attested_passkey" => Ok(CredentialType::AttestedPasskey),
+            "attested_residentkey" => Ok(CredentialType::AttestedResidentkey),
+            "invalid" => Ok(CredentialType::Invalid),
+            _ => Err(()),
+        }
+    }
+}
+
+impl fmt::Display for CredentialType {
+    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+        f.write_str(match self {
+            CredentialType::Any => "any",
+            CredentialType::Mfa => "mfa",
+            CredentialType::Passkey => "passkey",
+            CredentialType::AttestedPasskey => "attested_passkey",
+            CredentialType::AttestedResidentkey => "attested_residentkey",
+            CredentialType::Invalid => "invalid",
+        })
+    }
+}
+
+impl From<CredentialType> for Value {
+    fn from(ct: CredentialType) -> Value {
+        Value::CredentialType(ct)
+    }
+}
+
+impl From<CredentialType> for PartialValue {
+    fn from(ct: CredentialType) -> PartialValue {
+        PartialValue::CredentialType(ct)
+    }
+}
+
 /// A partial value is a key or key subset that can be used to match for equality or substring
 /// against a complete Value within a set in an Entry.
 ///
@@ -395,6 +464,7 @@ pub enum PartialValue {
     DeviceKey(Uuid),
     /// We compare on the value hash
     Image(String),
+    CredentialType(CredentialType),
 }
 
 impl From<SyntaxType> for PartialValue {
@@ -772,6 +842,7 @@ impl PartialValue {
             PartialValue::IntentToken(u) => u.clone(),
             PartialValue::UiHint(u) => (*u as u16).to_string(),
             PartialValue::Image(imagehash) => imagehash.to_owned(),
+            PartialValue::CredentialType(ct) => ct.to_string(),
         }
     }
 
@@ -967,6 +1038,7 @@ pub enum Value {
     EcKeyPrivate(EcKey<Private>),
 
     Image(ImageValue),
+    CredentialType(CredentialType),
 }
 
 impl PartialEq for Value {
@@ -1773,7 +1845,8 @@ impl Value {
             | Value::Oauth2Session(_, _)
             | Value::JwsKeyRs256(_)
             | Value::EcKeyPrivate(_)
-            | Value::UiHint(_) => true,
+            | Value::UiHint(_)
+            | Value::CredentialType(_) => true,
         }
     }
 

server/lib/src/valueset/cred.rs

@@ -1,3 +1,4 @@
+use smolset::SmolSet;
 use std::collections::btree_map::Entry as BTreeEntry;
 use std::collections::BTreeMap;
 
@@ -12,7 +13,7 @@ use crate::repl::proto::{
     ReplAttrV1, ReplCredV1, ReplDeviceKeyV4V1, ReplIntentTokenV1, ReplPasskeyV4V1,
 };
 use crate::schema::SchemaAttribute;
-use crate::value::{CredUpdateSessionPerms, IntentTokenState};
+use crate::value::{CredUpdateSessionPerms, CredentialType, IntentTokenState};
 use crate::valueset::{DbValueSetV2, ValueSet};
 
 #[derive(Debug, Clone)]
@@ -925,3 +926,152 @@ impl ValueSetT for ValueSetDeviceKey {
         Some(&self.map)
     }
 }
+
+#[derive(Debug, Clone)]
+pub struct ValueSetCredentialType {
+    set: SmolSet<[CredentialType; 1]>,
+}
+
+impl ValueSetCredentialType {
+    pub fn new(u: CredentialType) -> Box<Self> {
+        let mut set = SmolSet::new();
+        set.insert(u);
+        Box::new(ValueSetCredentialType { set })
+    }
+
+    pub fn push(&mut self, u: CredentialType) -> bool {
+        self.set.insert(u)
+    }
+
+    pub fn from_dbvs2(data: Vec<u16>) -> Result<ValueSet, OperationError> {
+        let set: Result<_, _> = data.into_iter().map(CredentialType::try_from).collect();
+        let set = set.map_err(|_| OperationError::InvalidValueState)?;
+        Ok(Box::new(ValueSetCredentialType { set }))
+    }
+
+    pub fn from_repl_v1(data: &[u16]) -> Result<ValueSet, OperationError> {
+        let set: Result<_, _> = data.iter().copied().map(CredentialType::try_from).collect();
+        let set = set.map_err(|_| OperationError::InvalidValueState)?;
+        Ok(Box::new(ValueSetCredentialType { set }))
+    }
+
+    // We need to allow this, because rust doesn't allow us to impl FromIterator on foreign
+    // types, and uuid is foreign.
+    #[allow(clippy::should_implement_trait)]
+    pub fn from_iter<T>(iter: T) -> Option<Box<Self>>
+    where
+        T: IntoIterator<Item = CredentialType>,
+    {
+        let set = iter.into_iter().collect();
+        Some(Box::new(ValueSetCredentialType { set }))
+    }
+}
+
+impl ValueSetT for ValueSetCredentialType {
+    fn insert_checked(&mut self, value: Value) -> Result<bool, OperationError> {
+        match value {
+            Value::CredentialType(u) => Ok(self.set.insert(u)),
+            _ => {
+                debug_assert!(false);
+                Err(OperationError::InvalidValueState)
+            }
+        }
+    }
+
+    fn clear(&mut self) {
+        self.set.clear();
+    }
+
+    fn remove(&mut self, pv: &PartialValue, _cid: &Cid) -> bool {
+        match pv {
+            PartialValue::CredentialType(u) => self.set.remove(u),
+            _ => {
+                debug_assert!(false);
+                true
+            }
+        }
+    }
+
+    fn contains(&self, pv: &PartialValue) -> bool {
+        match pv {
+            PartialValue::CredentialType(u) => self.set.contains(u),
+            _ => false,
+        }
+    }
+
+    fn substring(&self, _pv: &PartialValue) -> bool {
+        false
+    }
+
+    fn lessthan(&self, _pv: &PartialValue) -> bool {
+        false
+    }
+
+    fn len(&self) -> usize {
+        self.set.len()
+    }
+
+    fn generate_idx_eq_keys(&self) -> Vec<String> {
+        self.set.iter().map(|u| u.to_string()).collect()
+    }
+
+    fn syntax(&self) -> SyntaxType {
+        SyntaxType::CredentialType
+    }
+
+    fn validate(&self, _schema_attr: &SchemaAttribute) -> bool {
+        true
+    }
+
+    fn to_proto_string_clone_iter(&self) -> Box<dyn Iterator<Item = String> + '_> {
+        Box::new(self.set.iter().map(|ct| ct.to_string()))
+    }
+
+    fn to_db_valueset_v2(&self) -> DbValueSetV2 {
+        DbValueSetV2::CredentialType(self.set.iter().map(|s| *s as u16).collect())
+    }
+
+    fn to_repl_v1(&self) -> ReplAttrV1 {
+        ReplAttrV1::CredentialType {
+            set: self.set.iter().map(|s| *s as u16).collect(),
+        }
+    }
+
+    fn to_partialvalue_iter(&self) -> Box<dyn Iterator<Item = PartialValue> + '_> {
+        Box::new(self.set.iter().copied().map(PartialValue::CredentialType))
+    }
+
+    fn to_value_iter(&self) -> Box<dyn Iterator<Item = Value> + '_> {
+        Box::new(self.set.iter().copied().map(Value::CredentialType))
+    }
+
+    fn equal(&self, other: &ValueSet) -> bool {
+        if let Some(other) = other.as_credentialtype_set() {
+            &self.set == other
+        } else {
+            debug_assert!(false);
+            false
+        }
+    }
+
+    fn merge(&mut self, other: &ValueSet) -> Result<(), OperationError> {
+        if let Some(b) = other.as_credentialtype_set() {
+            mergesets!(self.set, b)
+        } else {
+            debug_assert!(false);
+            Err(OperationError::InvalidValueState)
+        }
+    }
+
+    fn to_credentialtype_single(&self) -> Option<CredentialType> {
+        if self.set.len() == 1 {
+            self.set.iter().copied().take(1).next()
+        } else {
+            None
+        }
+    }
+
+    fn as_credentialtype_set(&self) -> Option<&SmolSet<[CredentialType; 1]>> {
+        Some(&self.set)
+    }
+}

server/lib/src/valueset/mod.rs

@@ -22,14 +22,17 @@ use crate::credential::{totp::Totp, Credential};
 use crate::prelude::*;
 use crate::repl::{cid::Cid, proto::ReplAttrV1};
 use crate::schema::SchemaAttribute;
-use crate::value::{Address, ApiToken, IntentTokenState, Oauth2Session, Session};
+use crate::value::{Address, ApiToken, CredentialType, IntentTokenState, Oauth2Session, Session};
 
 pub use self::address::{ValueSetAddress, ValueSetEmailAddress};
 pub use self::auditlogstring::{ValueSetAuditLogString, AUDIT_LOG_STRING_CAPACITY};
 pub use self::binary::{ValueSetPrivateBinary, ValueSetPublicBinary};
 pub use self::bool::ValueSetBool;
 pub use self::cid::ValueSetCid;
-pub use self::cred::{ValueSetCredential, ValueSetDeviceKey, ValueSetIntentToken, ValueSetPasskey};
+pub use self::cred::{
+    ValueSetCredential, ValueSetCredentialType, ValueSetDeviceKey, ValueSetIntentToken,
+    ValueSetPasskey,
+};
 pub use self::datetime::ValueSetDateTime;
 pub use self::eckey::ValueSetEcKeyPrivate;
 use self::image::ValueSetImage;
@@ -575,6 +578,16 @@ pub trait ValueSetT: std::fmt::Debug + DynClone {
         None
     }
 
+    fn to_credentialtype_single(&self) -> Option<CredentialType> {
+        debug_assert!(false);
+        None
+    }
+
+    fn as_credentialtype_set(&self) -> Option<&SmolSet<[CredentialType; 1]>> {
+        debug_assert!(false);
+        None
+    }
+
     fn repl_merge_valueset(
         &self,
         _older: &ValueSet,
@@ -650,6 +663,7 @@ pub fn from_result_value_iter(
         Value::AuditLogString(c, s) => ValueSetAuditLogString::new((c, s)),
         Value::EcKeyPrivate(k) => ValueSetEcKeyPrivate::new(&k),
         Value::Image(imagevalue) => image::ValueSetImage::new(imagevalue),
+        Value::CredentialType(c) => ValueSetCredentialType::new(c),
         Value::PhoneNumber(_, _)
         | Value::Passkey(_, _, _)
         | Value::DeviceKey(_, _, _)
@@ -716,8 +730,8 @@ pub fn from_value_iter(mut iter: impl Iterator<Item = Value>) -> Result<ValueSet
         Value::TotpSecret(l, t) => ValueSetTotpSecret::new(l, t),
         Value::AuditLogString(c, s) => ValueSetAuditLogString::new((c, s)),
         Value::EcKeyPrivate(k) => ValueSetEcKeyPrivate::new(&k),
-
         Value::Image(imagevalue) => image::ValueSetImage::new(imagevalue),
+        Value::CredentialType(c) => ValueSetCredentialType::new(c),
         Value::PhoneNumber(_, _) => {
             debug_assert!(false);
             return Err(OperationError::InvalidValueState);
@@ -774,6 +788,7 @@ pub fn from_db_valueset_v2(dbvs: DbValueSetV2) -> Result<ValueSet, OperationErro
             Err(OperationError::InvalidValueState)
         }
         DbValueSetV2::Image(set) => ValueSetImage::from_dbvs2(&set),
+        DbValueSetV2::CredentialType(set) => ValueSetCredentialType::from_dbvs2(set),
     }
 }
 
@@ -819,5 +834,6 @@ pub fn from_repl_v1(rv1: &ReplAttrV1) -> Result<ValueSet, OperationError> {
         ReplAttrV1::AuditLogString { map } => ValueSetAuditLogString::from_repl_v1(map),
         ReplAttrV1::EcKeyPrivate { key } => ValueSetEcKeyPrivate::from_repl_v1(key),
         ReplAttrV1::Image { set } => ValueSetImage::from_repl_v1(set),
+        ReplAttrV1::CredentialType { set } => ValueSetCredentialType::from_repl_v1(set),
     }
 }

server/web_ui/admin/pkg/wasmloader_admin.js

@@ -1,7 +0,0 @@
-// loads the module which loads the WASM. It's loaders all the way down.
-import init, { run_app } from '/pkg/kanidmd_web_ui_admin.js';
-async function main() {
-    await init('/pkg/kanidmd_web_ui_admin_bg.wasm');
-    run_app();
-}
-main()

server/web_ui/build_wasm.sh

@@ -32,7 +32,7 @@ if [ -f ./pkg/.gitignore ]; then
 fi
 
 # copy the shared static things
-rsync -av shared/static/* shared/static/* pkg/
+rsync -av shared/static/* admin/static/* user/static/* login_flows/static/* pkg/
 
 
 cd admin

server/web_ui/build_wasm_dev.sh

@@ -1,2 +1,2 @@
 #!/bin/sh
-BUILD_FLAGS="--dev" ./build_wasm.sh
+SKIP_BROTLI=1 BUILD_FLAGS="--dev" ./build_wasm.sh

server/web_ui/login_flows/pkg/wasmloader_login_flows.js

@@ -1,7 +0,0 @@
-// loads the module which loads the WASM. It's loaders all the way down.
-import init, { run_app } from '/pkg/kanidmd_web_ui_login_flows.js';
-async function main() {
-    await init('/pkg/kanidmd_web_ui_login_flows_bg.wasm');
-    run_app();
-}
-main()

server/web_ui/pkg/LICENSE.md

@@ -1,327 +0,0 @@
-# Mozilla Public License Version 2.0
-
-1. Definitions
-
----
-
-1.1. "Contributor" means each individual or legal entity that creates, contributes to the creation
-of, or owns Covered Software.
-
-1.2. "Contributor Version" means the combination of the Contributions of others (if any) used by a
-Contributor and that particular Contributor's Contribution.
-
-1.3. "Contribution" means Covered Software of a particular Contributor.
-
-1.4. "Covered Software" means Source Code Form to which the initial Contributor has attached the
-notice in Exhibit A, the Executable Form of such Source Code Form, and Modifications of such Source
-Code Form, in each case including portions thereof.
-
-1.5. "Incompatible With Secondary Licenses" means
-
-    (a) that the initial Contributor has attached the notice described
-        in Exhibit B to the Covered Software; or
-
-    (b) that the Covered Software was made available under the terms of
-        version 1.1 or earlier of the License, but not also under the
-        terms of a Secondary License.
-
-1.6. "Executable Form" means any form of the work other than Source Code Form.
-
-1.7. "Larger Work" means a work that combines Covered Software with other material, in a separate
-file or files, that is not Covered Software.
-
-1.8. "License" means this document.
-
-1.9. "Licensable" means having the right to grant, to the maximum extent possible, whether at the
-time of the initial grant or subsequently, any and all of the rights conveyed by this License.
-
-1.10. "Modifications" means any of the following:
-
-    (a) any file in Source Code Form that results from an addition to,
-        deletion from, or modification of the contents of Covered
-        Software; or
-
-    (b) any new file in Source Code Form that contains any Covered
-        Software.
-
-1.11. "Patent Claims" of a Contributor means any patent claim(s), including without limitation,
-method, process, and apparatus claims, in any patent Licensable by such Contributor that would be
-infringed, but for the grant of the License, by the making, using, selling, offering for sale,
-having made, import, or transfer of either its Contributions or its Contributor Version.
-
-1.12. "Secondary License" means either the GNU General Public License, Version 2.0, the GNU Lesser
-General Public License, Version 2.1, the GNU Affero General Public License, Version 3.0, or any
-later versions of those licenses.
-
-1.13. "Source Code Form" means the form of the work preferred for making modifications.
-
-1.14. "You" (or "Your") means an individual or a legal entity exercising rights under this License.
-For legal entities, "You" includes any entity that controls, is controlled by, or is under common
-control with You. For purposes of this definition, "control" means (a) the power, direct or
-indirect, to cause the direction or management of such entity, whether by contract or otherwise, or
-(b) ownership of more than fifty percent (50%) of the outstanding shares or beneficial ownership of
-such entity.
-
-2. License Grants and Conditions
-
----
-
-2.1. Grants
-
-Each Contributor hereby grants You a world-wide, royalty-free, non-exclusive license:
-
-(a) under intellectual property rights (other than patent or trademark) Licensable by such
-Contributor to use, reproduce, make available, modify, display, perform, distribute, and otherwise
-exploit its Contributions, either on an unmodified basis, with Modifications, or as part of a Larger
-Work; and
-
-(b) under Patent Claims of such Contributor to make, use, sell, offer for sale, have made, import,
-and otherwise transfer either its Contributions or its Contributor Version.
-
-2.2. Effective Date
-
-The licenses granted in Section 2.1 with respect to any Contribution become effective for each
-Contribution on the date the Contributor first distributes such Contribution.
-
-2.3. Limitations on Grant Scope
-
-The licenses granted in this Section 2 are the only rights granted under this License. No additional
-rights or licenses will be implied from the distribution or licensing of Covered Software under this
-License. Notwithstanding Section 2.1(b) above, no patent license is granted by a Contributor:
-
-(a) for any code that a Contributor has removed from Covered Software; or
-
-(b) for infringements caused by: (i) Your and any other third party's modifications of Covered
-Software, or (ii) the combination of its Contributions with other software (except as part of its
-Contributor Version); or
-
-(c) under Patent Claims infringed by Covered Software in the absence of its Contributions.
-
-This License does not grant any rights in the trademarks, service marks, or logos of any Contributor
-(except as may be necessary to comply with the notice requirements in Section 3.4).
-
-2.4. Subsequent Licenses
-
-No Contributor makes additional grants as a result of Your choice to distribute the Covered Software
-under a subsequent version of this License (see Section 10.2) or under the terms of a Secondary
-License (if permitted under the terms of Section 3.3).
-
-2.5. Representation
-
-Each Contributor represents that the Contributor believes its Contributions are its original
-creation(s) or it has sufficient rights to grant the rights to its Contributions conveyed by this
-License.
-
-2.6. Fair Use
-
-This License is not intended to limit any rights You have under applicable copyright doctrines of
-fair use, fair dealing, or other equivalents.
-
-2.7. Conditions
-
-Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted in Section 2.1.
-
-3. Responsibilities
-
----
-
-3.1. Distribution of Source Form
-
-All distribution of Covered Software in Source Code Form, including any Modifications that You
-create or to which You contribute, must be under the terms of this License. You must inform
-recipients that the Source Code Form of the Covered Software is governed by the terms of this
-License, and how they can obtain a copy of this License. You may not attempt to alter or restrict
-the recipients' rights in the Source Code Form.
-
-3.2. Distribution of Executable Form
-
-If You distribute Covered Software in Executable Form then:
-
-(a) such Covered Software must also be made available in Source Code Form, as described in Section
-3.1, and You must inform recipients of the Executable Form how they can obtain a copy of such Source
-Code Form by reasonable means in a timely manner, at a charge no more than the cost of distribution
-to the recipient; and
-
-(b) You may distribute such Executable Form under the terms of this License, or sublicense it under
-different terms, provided that the license for the Executable Form does not attempt to limit or
-alter the recipients' rights in the Source Code Form under this License.
-
-3.3. Distribution of a Larger Work
-
-You may create and distribute a Larger Work under terms of Your choice, provided that You also
-comply with the requirements of this License for the Covered Software. If the Larger Work is a
-combination of Covered Software with a work governed by one or more Secondary Licenses, and the
-Covered Software is not Incompatible With Secondary Licenses, this License permits You to
-additionally distribute such Covered Software under the terms of such Secondary License(s), so that
-the recipient of the Larger Work may, at their option, further distribute the Covered Software under
-the terms of either this License or such Secondary License(s).
-
-3.4. Notices
-
-You may not remove or alter the substance of any license notices (including copyright notices,
-patent notices, disclaimers of warranty, or limitations of liability) contained within the Source
-Code Form of the Covered Software, except that You may alter any license notices to the extent
-required to remedy known factual inaccuracies.
-
-3.5. Application of Additional Terms
-
-You may choose to offer, and to charge a fee for, warranty, support, indemnity or liability
-obligations to one or more recipients of Covered Software. However, You may do so only on Your own
-behalf, and not on behalf of any Contributor. You must make it absolutely clear that any such
-warranty, support, indemnity, or liability obligation is offered by You alone, and You hereby agree
-to indemnify every Contributor for any liability incurred by such Contributor as a result of
-warranty, support, indemnity or liability terms You offer. You may include additional disclaimers of
-warranty and limitations of liability specific to any jurisdiction.
-
-4. Inability to Comply Due to Statute or Regulation
-
----
-
-If it is impossible for You to comply with any of the terms of this License with respect to some or
-all of the Covered Software due to statute, judicial order, or regulation then You must: (a) comply
-with the terms of this License to the maximum extent possible; and (b) describe the limitations and
-the code they affect. Such description must be placed in a text file included with all distributions
-of the Covered Software under this License. Except to the extent prohibited by statute or
-regulation, such description must be sufficiently detailed for a recipient of ordinary skill to be
-able to understand it.
-
-5. Termination
-
----
-
-5.1. The rights granted under this License will terminate automatically if You fail to comply with
-any of its terms. However, if You become compliant, then the rights granted under this License from
-a particular Contributor are reinstated (a) provisionally, unless and until such Contributor
-explicitly and finally terminates Your grants, and (b) on an ongoing basis, if such Contributor
-fails to notify You of the non-compliance by some reasonable means prior to 60 days after You have
-come back into compliance. Moreover, Your grants from a particular Contributor are reinstated on an
-ongoing basis if such Contributor notifies You of the non-compliance by some reasonable means, this
-is the first time You have received notice of non-compliance with this License from such
-Contributor, and You become compliant prior to 30 days after Your receipt of the notice.
-
-5.2. If You initiate litigation against any entity by asserting a patent infringement claim
-(excluding declaratory judgment actions, counter-claims, and cross-claims) alleging that a
-Contributor Version directly or indirectly infringes any patent, then the rights granted to You by
-any and all Contributors for the Covered Software under Section 2.1 of this License shall terminate.
-
-5.3. In the event of termination under Sections 5.1 or 5.2 above, all end user license agreements
-(excluding distributors and resellers) which have been validly granted by You or Your distributors
-under this License prior to termination shall survive termination.
-
----
-
--
-  -
--
-  6. Disclaimer of Warranty *
-- ------------------------- *
--
-  -
-- Covered Software is provided under this License on an "as is" *
-- basis, without warranty of any kind, either expressed, implied, or *
-- statutory, including, without limitation, warranties that the *
-- Covered Software is free of defects, merchantable, fit for a *
-- particular purpose or non-infringing. The entire risk as to the *
-- quality and performance of the Covered Software is with You. *
-- Should any Covered Software prove defective in any respect, You *
-- (not any Contributor) assume the cost of any necessary servicing, *
-- repair, or correction. This disclaimer of warranty constitutes an *
-- essential part of this License. No use of any Covered Software is *
-- authorized under this License except under this disclaimer. *
--
-  -
-
----
-
----
-
--
-  -
--
-  7. Limitation of Liability *
-- -------------------------- *
--
-  -
-- Under no circumstances and under no legal theory, whether tort *
-- (including negligence), contract, or otherwise, shall any *
-- Contributor, or anyone who distributes Covered Software as *
-- permitted above, be liable to You for any direct, indirect, *
-- special, incidental, or consequential damages of any character *
-- including, without limitation, damages for lost profits, loss of *
-- goodwill, work stoppage, computer failure or malfunction, or any *
-- and all other commercial damages or losses, even if such party *
-- shall have been informed of the possibility of such damages. This *
-- limitation of liability shall not apply to liability for death or *
-- personal injury resulting from such party's negligence to the *
-- extent applicable law prohibits such limitation. Some *
-- jurisdictions do not allow the exclusion or limitation of *
-- incidental or consequential damages, so this exclusion and *
-- limitation may not apply to You. *
--
-  -
-
----
-
-8. Litigation
-
----
-
-Any litigation relating to this License may be brought only in the courts of a jurisdiction where
-the defendant maintains its principal place of business and such litigation shall be governed by
-laws of that jurisdiction, without reference to its conflict-of-law provisions. Nothing in this
-Section shall prevent a party's ability to bring cross-claims or counter-claims.
-
-9. Miscellaneous
-
----
-
-This License represents the complete agreement concerning the subject matter hereof. If any
-provision of this License is held to be unenforceable, such provision shall be reformed only to the
-extent necessary to make it enforceable. Any law or regulation which provides that the language of a
-contract shall be construed against the drafter shall not be used to construe this License against a
-Contributor.
-
-10. Versions of the License
-
----
-
-10.1. New Versions
-
-Mozilla Foundation is the license steward. Except as provided in Section 10.3, no one other than the
-license steward has the right to modify or publish new versions of this License. Each version will
-be given a distinguishing version number.
-
-10.2. Effect of New Versions
-
-You may distribute the Covered Software under the terms of the version of the License under which
-You originally received the Covered Software, or under the terms of any subsequent version published
-by the license steward.
-
-10.3. Modified Versions
-
-If you create software not governed by this License, and you want to create a new license for such
-software, you may create and use a modified version of this License if you rename the license and
-remove any references to the name of the license steward (except to note that such modified license
-differs from this License).
-
-10.4. Distributing Source Code Form that is Incompatible With Secondary Licenses
-
-If You choose to distribute Source Code Form that is Incompatible With Secondary Licenses under the
-terms of this version of the License, the notice described in Exhibit B of this License must be
-attached.
-
-## Exhibit A - Source Code Form License Notice
-
-This Source Code Form is subject to the terms of the Mozilla Public License, v. 2.0. If a copy of
-the MPL was not distributed with this file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-If it is not possible or desirable to put the notice in a particular file, then You may include the
-notice in a location (such as a LICENSE file in a relevant directory) where a recipient would be
-likely to look for such a notice.
-
-You may add additional accurate notices of copyright ownership.
-
-## Exhibit B - "Incompatible With Secondary Licenses" Notice
-
-This Source Code Form is "Incompatible With Secondary Licenses", as defined by the Mozilla Public
-License, v. 2.0.

server/web_ui/pkg/kanidmd_web_ui_admin.js

@@ -223,19 +223,19 @@ function addBorrowedObject(obj) {
 }
 function __wbg_adapter_38(arg0, arg1, arg2) {
     try {
-        wasm._dyn_core__ops__function__FnMut___A____Output___R_as_wasm_bindgen__closure__WasmClosure___describe__invoke__h88228e96f702a93c(arg0, arg1, addBorrowedObject(arg2));
+        wasm._dyn_core__ops__function__FnMut___A____Output___R_as_wasm_bindgen__closure__WasmClosure___describe__invoke__h73d508a13868b8cd(arg0, arg1, addBorrowedObject(arg2));
     } finally {
         heap[stack_pointer++] = undefined;
     }
 }
 
 function __wbg_adapter_41(arg0, arg1, arg2) {
-    wasm._dyn_core__ops__function__FnMut__A____Output___R_as_wasm_bindgen__closure__WasmClosure___describe__invoke__hc231a149f34a8d89(arg0, arg1, addHeapObject(arg2));
+    wasm._dyn_core__ops__function__FnMut__A____Output___R_as_wasm_bindgen__closure__WasmClosure___describe__invoke__h71282a39cf9f54cc(arg0, arg1, addHeapObject(arg2));
 }
 
 function __wbg_adapter_44(arg0, arg1, arg2) {
     try {
-        wasm._dyn_core__ops__function__FnMut___A____Output___R_as_wasm_bindgen__closure__WasmClosure___describe__invoke__h7e547ec1c5ce03a9(arg0, arg1, addBorrowedObject(arg2));
+        wasm._dyn_core__ops__function__FnMut___A____Output___R_as_wasm_bindgen__closure__WasmClosure___describe__invoke__h49ac351fd82edf13(arg0, arg1, addBorrowedObject(arg2));
     } finally {
         heap[stack_pointer++] = undefined;
     }
@@ -397,11 +397,6 @@ function __wbg_get_imports() {
         getInt32Memory0()[arg0 / 4 + 1] = isLikeNone(ret) ? 0 : ret;
         getInt32Memory0()[arg0 / 4 + 0] = !isLikeNone(ret);
     };
-    imports.wbg.__wbg_cachekey_b61393159c57fd7b = function(arg0, arg1) {
-        const ret = getObject(arg1).__yew_subtree_cache_key;
-        getInt32Memory0()[arg0 / 4 + 1] = isLikeNone(ret) ? 0 : ret;
-        getInt32Memory0()[arg0 / 4 + 0] = !isLikeNone(ret);
-    };
     imports.wbg.__wbg_subtreeid_e348577f7ef777e3 = function(arg0, arg1) {
         const ret = getObject(arg1).__yew_subtree_id;
         getInt32Memory0()[arg0 / 4 + 1] = isLikeNone(ret) ? 0 : ret;
@@ -410,6 +405,11 @@ function __wbg_get_imports() {
     imports.wbg.__wbg_setsubtreeid_d32e6327eef1f7fc = function(arg0, arg1) {
         getObject(arg0).__yew_subtree_id = arg1 >>> 0;
     };
+    imports.wbg.__wbg_cachekey_b61393159c57fd7b = function(arg0, arg1) {
+        const ret = getObject(arg1).__yew_subtree_cache_key;
+        getInt32Memory0()[arg0 / 4 + 1] = isLikeNone(ret) ? 0 : ret;
+        getInt32Memory0()[arg0 / 4 + 0] = !isLikeNone(ret);
+    };
     imports.wbg.__wbg_setcachekey_80183b7cfc421143 = function(arg0, arg1) {
         getObject(arg0).__yew_subtree_cache_key = arg1 >>> 0;
     };
@@ -435,6 +435,17 @@ function __wbg_get_imports() {
             wasm.__wbindgen_free(deferred0_0, deferred0_1, 1);
         }
     };
+    imports.wbg.__wbg_queueMicrotask_e5949c35d772a669 = function(arg0) {
+        queueMicrotask(getObject(arg0));
+    };
+    imports.wbg.__wbg_queueMicrotask_2be8b97a81fe4d00 = function(arg0) {
+        const ret = getObject(arg0).queueMicrotask;
+        return addHeapObject(ret);
+    };
+    imports.wbg.__wbindgen_is_function = function(arg0) {
+        const ret = typeof(getObject(arg0)) === 'function';
+        return ret;
+    };
     imports.wbg.__wbg_getwithrefkey_5e6d9547403deab8 = function(arg0, arg1) {
         const ret = getObject(arg0)[getObject(arg1)];
         return addHeapObject(ret);
@@ -444,507 +455,503 @@ function __wbg_get_imports() {
     };
     imports.wbg.__wbg_debug_783a3d4910bc24c7 = function(arg0, arg1) {
         var v0 = getArrayJsValueFromWasm0(arg0, arg1).slice();
-        wasm.__wbindgen_free(arg0, arg1 * 4);
+        wasm.__wbindgen_free(arg0, arg1 * 4, 4);
         console.debug(...v0);
     };
     imports.wbg.__wbg_error_71d6845bf00a930f = function(arg0, arg1) {
         var v0 = getArrayJsValueFromWasm0(arg0, arg1).slice();
-        wasm.__wbindgen_free(arg0, arg1 * 4);
+        wasm.__wbindgen_free(arg0, arg1 * 4, 4);
         console.error(...v0);
     };
     imports.wbg.__wbg_log_1f7f93998ab961f7 = function(arg0, arg1) {
         var v0 = getArrayJsValueFromWasm0(arg0, arg1).slice();
-        wasm.__wbindgen_free(arg0, arg1 * 4);
+        wasm.__wbindgen_free(arg0, arg1 * 4, 4);
         console.log(...v0);
     };
-    imports.wbg.__wbg_body_674aec4c1c0910cd = function(arg0) {
+    imports.wbg.__wbg_body_11da0c1aa9610cb3 = function(arg0) {
         const ret = getObject(arg0).body;
         return isLikeNone(ret) ? 0 : addHeapObject(ret);
     };
-    imports.wbg.__wbg_createElement_4891554b28d3388b = function() { return handleError(function (arg0, arg1, arg2) {
+    imports.wbg.__wbg_createElement_9ce3fdea8322ff34 = function() { return handleError(function (arg0, arg1, arg2) {
         const ret = getObject(arg0).createElement(getStringFromWasm0(arg1, arg2));
         return addHeapObject(ret);
     }, arguments) };
-    imports.wbg.__wbg_createElementNS_119acf9e82482041 = function() { return handleError(function (arg0, arg1, arg2, arg3, arg4) {
+    imports.wbg.__wbg_createElementNS_6a08d8f33e767e18 = function() { return handleError(function (arg0, arg1, arg2, arg3, arg4) {
         const ret = getObject(arg0).createElementNS(arg1 === 0 ? undefined : getStringFromWasm0(arg1, arg2), getStringFromWasm0(arg3, arg4));
         return addHeapObject(ret);
     }, arguments) };
-    imports.wbg.__wbg_createTextNode_2fd22cd7e543f938 = function(arg0, arg1, arg2) {
+    imports.wbg.__wbg_createTextNode_01a7250c5ca46b04 = function(arg0, arg1, arg2) {
         const ret = getObject(arg0).createTextNode(getStringFromWasm0(arg1, arg2));
         return addHeapObject(ret);
     };
-    imports.wbg.__wbg_querySelector_52ded52c20e23921 = function() { return handleError(function (arg0, arg1, arg2) {
+    imports.wbg.__wbg_querySelector_391afe271b8236d5 = function() { return handleError(function (arg0, arg1, arg2) {
         const ret = getObject(arg0).querySelector(getStringFromWasm0(arg1, arg2));
         return isLikeNone(ret) ? 0 : addHeapObject(ret);
     }, arguments) };
-    imports.wbg.__wbg_instanceof_Element_4622f5da1249a3eb = function(arg0) {
+    imports.wbg.__wbg_instanceof_Window_cde2416cf5126a72 = function(arg0) {
         let result;
         try {
-            result = getObject(arg0) instanceof Element;
-        } catch {
+            result = getObject(arg0) instanceof Window;
+        } catch (_) {
             result = false;
         }
         const ret = result;
         return ret;
     };
-    imports.wbg.__wbg_namespaceURI_31718ed49b5343a3 = function(arg0, arg1) {
+    imports.wbg.__wbg_document_183cf1eecfdbffee = function(arg0) {
+        const ret = getObject(arg0).document;
+        return isLikeNone(ret) ? 0 : addHeapObject(ret);
+    };
+    imports.wbg.__wbg_location_61ca61017633c753 = function(arg0) {
+        const ret = getObject(arg0).location;
+        return addHeapObject(ret);
+    };
+    imports.wbg.__wbg_history_56dc869560201113 = function() { return handleError(function (arg0) {
+        const ret = getObject(arg0).history;
+        return addHeapObject(ret);
+    }, arguments) };
+    imports.wbg.__wbg_localStorage_e11f72e996a4f5d9 = function() { return handleError(function (arg0) {
+        const ret = getObject(arg0).localStorage;
+        return isLikeNone(ret) ? 0 : addHeapObject(ret);
+    }, arguments) };
+    imports.wbg.__wbg_sessionStorage_071949dc646bfd35 = function() { return handleError(function (arg0) {
+        const ret = getObject(arg0).sessionStorage;
+        return isLikeNone(ret) ? 0 : addHeapObject(ret);
+    }, arguments) };
+    imports.wbg.__wbg_fetch_8cebc656dc6b11b1 = function(arg0, arg1) {
+        const ret = getObject(arg0).fetch(getObject(arg1));
+        return addHeapObject(ret);
+    };
+    imports.wbg.__wbg_instanceof_Element_6c7af07f5e6c8d69 = function(arg0) {
+        let result;
+        try {
+            result = getObject(arg0) instanceof Element;
+        } catch (_) {
+            result = false;
+        }
+        const ret = result;
+        return ret;
+    };
+    imports.wbg.__wbg_namespaceURI_2dd94d0147ffddf2 = function(arg0, arg1) {
         const ret = getObject(arg1).namespaceURI;
         var ptr1 = isLikeNone(ret) ? 0 : passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
         var len1 = WASM_VECTOR_LEN;
         getInt32Memory0()[arg0 / 4 + 1] = len1;
         getInt32Memory0()[arg0 / 4 + 0] = ptr1;
     };
-    imports.wbg.__wbg_classList_5f2fc1d67656292e = function(arg0) {
+    imports.wbg.__wbg_classList_7fd39dc155235d8a = function(arg0) {
         const ret = getObject(arg0).classList;
         return addHeapObject(ret);
     };
-    imports.wbg.__wbg_setinnerHTML_b089587252408b67 = function(arg0, arg1, arg2) {
+    imports.wbg.__wbg_setinnerHTML_b88bf159b62c2334 = function(arg0, arg1, arg2) {
         getObject(arg0).innerHTML = getStringFromWasm0(arg1, arg2);
     };
-    imports.wbg.__wbg_outerHTML_f7749ceff37b5832 = function(arg0, arg1) {
+    imports.wbg.__wbg_outerHTML_72dcf3aa34725f10 = function(arg0, arg1) {
         const ret = getObject(arg1).outerHTML;
         const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
         const len1 = WASM_VECTOR_LEN;
         getInt32Memory0()[arg0 / 4 + 1] = len1;
         getInt32Memory0()[arg0 / 4 + 0] = ptr1;
     };
-    imports.wbg.__wbg_children_27ed308801b57d3f = function(arg0) {
+    imports.wbg.__wbg_children_af5a3246832628b1 = function(arg0) {
         const ret = getObject(arg0).children;
         return addHeapObject(ret);
     };
-    imports.wbg.__wbg_removeAttribute_d8404da431968808 = function() { return handleError(function (arg0, arg1, arg2) {
+    imports.wbg.__wbg_removeAttribute_dbd76981f9bb9f59 = function() { return handleError(function (arg0, arg1, arg2) {
         getObject(arg0).removeAttribute(getStringFromWasm0(arg1, arg2));
     }, arguments) };
-    imports.wbg.__wbg_setAttribute_e7e80b478b7b8b2f = function() { return handleError(function (arg0, arg1, arg2, arg3, arg4) {
+    imports.wbg.__wbg_setAttribute_aebcae2169f2f869 = function() { return handleError(function (arg0, arg1, arg2, arg3, arg4) {
         getObject(arg0).setAttribute(getStringFromWasm0(arg1, arg2), getStringFromWasm0(arg3, arg4));
     }, arguments) };
-    imports.wbg.__wbg_instanceof_Window_9029196b662bc42a = function(arg0) {
-        let result;
-        try {
-            result = getObject(arg0) instanceof Window;
-        } catch {
-            result = false;
-        }
-        const ret = result;
-        return ret;
-    };
-    imports.wbg.__wbg_document_f7ace2b956f30a4f = function(arg0) {
-        const ret = getObject(arg0).document;
-        return isLikeNone(ret) ? 0 : addHeapObject(ret);
-    };
-    imports.wbg.__wbg_location_56243dba507f472d = function(arg0) {
-        const ret = getObject(arg0).location;
-        return addHeapObject(ret);
-    };
-    imports.wbg.__wbg_history_3c2280e6b2a9316e = function() { return handleError(function (arg0) {
-        const ret = getObject(arg0).history;
-        return addHeapObject(ret);
-    }, arguments) };
-    imports.wbg.__wbg_localStorage_dbac11bd189e9fa0 = function() { return handleError(function (arg0) {
-        const ret = getObject(arg0).localStorage;
-        return isLikeNone(ret) ? 0 : addHeapObject(ret);
-    }, arguments) };
-    imports.wbg.__wbg_sessionStorage_3b863b6e15dd2bdc = function() { return handleError(function (arg0) {
-        const ret = getObject(arg0).sessionStorage;
-        return isLikeNone(ret) ? 0 : addHeapObject(ret);
-    }, arguments) };
-    imports.wbg.__wbg_fetch_336b6f0cb426b46e = function(arg0, arg1) {
-        const ret = getObject(arg0).fetch(getObject(arg1));
-        return addHeapObject(ret);
-    };
-    imports.wbg.__wbg_add_3eafedc4b2a28db0 = function() { return handleError(function (arg0, arg1, arg2) {
-        getObject(arg0).add(getStringFromWasm0(arg1, arg2));
-    }, arguments) };
-    imports.wbg.__wbg_get_2e9aab260014946d = function() { return handleError(function (arg0, arg1, arg2, arg3) {
-        const ret = getObject(arg1).get(getStringFromWasm0(arg2, arg3));
-        var ptr1 = isLikeNone(ret) ? 0 : passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-        var len1 = WASM_VECTOR_LEN;
-        getInt32Memory0()[arg0 / 4 + 1] = len1;
-        getInt32Memory0()[arg0 / 4 + 0] = ptr1;
-    }, arguments) };
-    imports.wbg.__wbg_set_b34caba58723c454 = function() { return handleError(function (arg0, arg1, arg2, arg3, arg4) {
-        getObject(arg0).set(getStringFromWasm0(arg1, arg2), getStringFromWasm0(arg3, arg4));
-    }, arguments) };
-    imports.wbg.__wbg_state_745dc4814d321eb3 = function() { return handleError(function (arg0) {
-        const ret = getObject(arg0).state;
-        return addHeapObject(ret);
-    }, arguments) };
-    imports.wbg.__wbg_pushState_1145414a47c0b629 = function() { return handleError(function (arg0, arg1, arg2, arg3, arg4, arg5) {
-        getObject(arg0).pushState(getObject(arg1), getStringFromWasm0(arg2, arg3), arg4 === 0 ? undefined : getStringFromWasm0(arg4, arg5));
-    }, arguments) };
-    imports.wbg.__wbg_headers_b439dcff02e808e5 = function(arg0) {
-        const ret = getObject(arg0).headers;
-        return addHeapObject(ret);
-    };
-    imports.wbg.__wbg_newwithstrandinit_cad5cd6038c7ff5d = function() { return handleError(function (arg0, arg1, arg2) {
-        const ret = new Request(getStringFromWasm0(arg0, arg1), getObject(arg2));
-        return addHeapObject(ret);
-    }, arguments) };
-    imports.wbg.__wbg_instanceof_Response_fc4327dbfcdf5ced = function(arg0) {
-        let result;
-        try {
-            result = getObject(arg0) instanceof Response;
-        } catch {
-            result = false;
-        }
-        const ret = result;
-        return ret;
-    };
-    imports.wbg.__wbg_status_ac85a3142a84caa2 = function(arg0) {
-        const ret = getObject(arg0).status;
-        return ret;
-    };
-    imports.wbg.__wbg_headers_b70de86b8e989bc0 = function(arg0) {
-        const ret = getObject(arg0).headers;
-        return addHeapObject(ret);
-    };
-    imports.wbg.__wbg_json_2a46ed5b7c4d30d1 = function() { return handleError(function (arg0) {
-        const ret = getObject(arg0).json();
-        return addHeapObject(ret);
-    }, arguments) };
-    imports.wbg.__wbg_instanceof_ShadowRoot_b64337370f59fe2d = function(arg0) {
-        let result;
-        try {
-            result = getObject(arg0) instanceof ShadowRoot;
-        } catch {
-            result = false;
-        }
-        const ret = result;
-        return ret;
-    };
-    imports.wbg.__wbg_host_e1c47c33975060d3 = function(arg0) {
-        const ret = getObject(arg0).host;
-        return addHeapObject(ret);
-    };
-    imports.wbg.__wbg_href_17ed54b321396524 = function(arg0, arg1) {
-        const ret = getObject(arg1).href;
-        const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-        const len1 = WASM_VECTOR_LEN;
-        getInt32Memory0()[arg0 / 4 + 1] = len1;
-        getInt32Memory0()[arg0 / 4 + 0] = ptr1;
-    };
-    imports.wbg.__wbg_pathname_57290e07c6bc0683 = function(arg0, arg1) {
-        const ret = getObject(arg1).pathname;
-        const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-        const len1 = WASM_VECTOR_LEN;
-        getInt32Memory0()[arg0 / 4 + 1] = len1;
-        getInt32Memory0()[arg0 / 4 + 0] = ptr1;
-    };
-    imports.wbg.__wbg_search_2ff3bb9114e0ca34 = function(arg0, arg1) {
-        const ret = getObject(arg1).search;
-        const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-        const len1 = WASM_VECTOR_LEN;
-        getInt32Memory0()[arg0 / 4 + 1] = len1;
-        getInt32Memory0()[arg0 / 4 + 0] = ptr1;
-    };
-    imports.wbg.__wbg_setsearch_16b87f04ea0e6b80 = function(arg0, arg1, arg2) {
-        getObject(arg0).search = getStringFromWasm0(arg1, arg2);
-    };
-    imports.wbg.__wbg_hash_2b57e787945b2db0 = function(arg0, arg1) {
-        const ret = getObject(arg1).hash;
-        const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-        const len1 = WASM_VECTOR_LEN;
-        getInt32Memory0()[arg0 / 4 + 1] = len1;
-        getInt32Memory0()[arg0 / 4 + 0] = ptr1;
-    };
-    imports.wbg.__wbg_sethash_41d6e65816639c62 = function(arg0, arg1, arg2) {
-        getObject(arg0).hash = getStringFromWasm0(arg1, arg2);
-    };
-    imports.wbg.__wbg_new_a76f6bcb38f791ea = function() { return handleError(function (arg0, arg1) {
-        const ret = new URL(getStringFromWasm0(arg0, arg1));
-        return addHeapObject(ret);
-    }, arguments) };
-    imports.wbg.__wbg_newwithbase_79b8cac27ce631ac = function() { return handleError(function (arg0, arg1, arg2, arg3) {
-        const ret = new URL(getStringFromWasm0(arg0, arg1), getStringFromWasm0(arg2, arg3));
-        return addHeapObject(ret);
-    }, arguments) };
-    imports.wbg.__wbg_href_d62a28e4fc1ab948 = function() { return handleError(function (arg0, arg1) {
-        const ret = getObject(arg1).href;
-        const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-        const len1 = WASM_VECTOR_LEN;
-        getInt32Memory0()[arg0 / 4 + 1] = len1;
-        getInt32Memory0()[arg0 / 4 + 0] = ptr1;
-    }, arguments) };
-    imports.wbg.__wbg_sethref_e5626365d7354fea = function() { return handleError(function (arg0, arg1, arg2) {
-        getObject(arg0).href = getStringFromWasm0(arg1, arg2);
-    }, arguments) };
-    imports.wbg.__wbg_pathname_c8fd5c498079312d = function() { return handleError(function (arg0, arg1) {
-        const ret = getObject(arg1).pathname;
-        const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-        const len1 = WASM_VECTOR_LEN;
-        getInt32Memory0()[arg0 / 4 + 1] = len1;
-        getInt32Memory0()[arg0 / 4 + 0] = ptr1;
-    }, arguments) };
-    imports.wbg.__wbg_search_6c3c472e076ee010 = function() { return handleError(function (arg0, arg1) {
-        const ret = getObject(arg1).search;
-        const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-        const len1 = WASM_VECTOR_LEN;
-        getInt32Memory0()[arg0 / 4 + 1] = len1;
-        getInt32Memory0()[arg0 / 4 + 0] = ptr1;
-    }, arguments) };
-    imports.wbg.__wbg_hash_a1a795b89dda8e3d = function() { return handleError(function (arg0, arg1) {
-        const ret = getObject(arg1).hash;
-        const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-        const len1 = WASM_VECTOR_LEN;
-        getInt32Memory0()[arg0 / 4 + 1] = len1;
-        getInt32Memory0()[arg0 / 4 + 0] = ptr1;
-    }, arguments) };
-    imports.wbg.__wbg_bubbles_63572b91f3885ef1 = function(arg0) {
-        const ret = getObject(arg0).bubbles;
-        return ret;
-    };
-    imports.wbg.__wbg_cancelBubble_90d1c3aa2a76cbeb = function(arg0) {
-        const ret = getObject(arg0).cancelBubble;
-        return ret;
-    };
-    imports.wbg.__wbg_composedPath_cf1bb5b8bcff496f = function(arg0) {
-        const ret = getObject(arg0).composedPath();
-        return addHeapObject(ret);
-    };
-    imports.wbg.__wbg_preventDefault_24104f3f0a54546a = function(arg0) {
-        getObject(arg0).preventDefault();
-    };
-    imports.wbg.__wbg_href_47b90f0ddf3ddcd7 = function(arg0, arg1) {
-        const ret = getObject(arg1).href;
-        const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-        const len1 = WASM_VECTOR_LEN;
-        getInt32Memory0()[arg0 / 4 + 1] = len1;
-        getInt32Memory0()[arg0 / 4 + 0] = ptr1;
-    };
-    imports.wbg.__wbg_addEventListener_a5963e26cd7b176b = function() { return handleError(function (arg0, arg1, arg2, arg3, arg4) {
-        getObject(arg0).addEventListener(getStringFromWasm0(arg1, arg2), getObject(arg3), getObject(arg4));
-    }, arguments) };
-    imports.wbg.__wbg_removeEventListener_782040b4432709cb = function() { return handleError(function (arg0, arg1, arg2, arg3, arg4) {
-        getObject(arg0).removeEventListener(getStringFromWasm0(arg1, arg2), getObject(arg3), arg4 !== 0);
-    }, arguments) };
-    imports.wbg.__wbg_parentNode_9e53f8b17eb98c9d = function(arg0) {
-        const ret = getObject(arg0).parentNode;
-        return isLikeNone(ret) ? 0 : addHeapObject(ret);
-    };
-    imports.wbg.__wbg_parentElement_c75962bc9997ea5f = function(arg0) {
-        const ret = getObject(arg0).parentElement;
-        return isLikeNone(ret) ? 0 : addHeapObject(ret);
-    };
-    imports.wbg.__wbg_lastChild_0cee692010bac6c2 = function(arg0) {
-        const ret = getObject(arg0).lastChild;
-        return isLikeNone(ret) ? 0 : addHeapObject(ret);
-    };
-    imports.wbg.__wbg_nextSibling_304d9aac7c2774ae = function(arg0) {
-        const ret = getObject(arg0).nextSibling;
-        return isLikeNone(ret) ? 0 : addHeapObject(ret);
-    };
-    imports.wbg.__wbg_setnodeValue_d1c8382910b45e04 = function(arg0, arg1, arg2) {
-        getObject(arg0).nodeValue = arg1 === 0 ? undefined : getStringFromWasm0(arg1, arg2);
-    };
-    imports.wbg.__wbg_textContent_c5d9e21ee03c63d4 = function(arg0, arg1) {
-        const ret = getObject(arg1).textContent;
-        var ptr1 = isLikeNone(ret) ? 0 : passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-        var len1 = WASM_VECTOR_LEN;
-        getInt32Memory0()[arg0 / 4 + 1] = len1;
-        getInt32Memory0()[arg0 / 4 + 0] = ptr1;
-    };
-    imports.wbg.__wbg_appendChild_51339d4cde00ee22 = function() { return handleError(function (arg0, arg1) {
-        const ret = getObject(arg0).appendChild(getObject(arg1));
-        return addHeapObject(ret);
-    }, arguments) };
-    imports.wbg.__wbg_insertBefore_ffa01d4b747c95fc = function() { return handleError(function (arg0, arg1, arg2) {
-        const ret = getObject(arg0).insertBefore(getObject(arg1), getObject(arg2));
-        return addHeapObject(ret);
-    }, arguments) };
-    imports.wbg.__wbg_removeChild_973429f368206138 = function() { return handleError(function (arg0, arg1) {
-        const ret = getObject(arg0).removeChild(getObject(arg1));
-        return addHeapObject(ret);
-    }, arguments) };
-    imports.wbg.__wbg_setchecked_e5a50baea447b8a8 = function(arg0, arg1) {
-        getObject(arg0).checked = arg1 !== 0;
-    };
-    imports.wbg.__wbg_value_9423da9d988ee8cf = function(arg0, arg1) {
-        const ret = getObject(arg1).value;
-        const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-        const len1 = WASM_VECTOR_LEN;
-        getInt32Memory0()[arg0 / 4 + 1] = len1;
-        getInt32Memory0()[arg0 / 4 + 0] = ptr1;
-    };
-    imports.wbg.__wbg_setvalue_1f95e61cbc382f7f = function(arg0, arg1, arg2) {
-        getObject(arg0).value = getStringFromWasm0(arg1, arg2);
-    };
-    imports.wbg.__wbg_value_3c5f08ffc2b7d6f9 = function(arg0, arg1) {
-        const ret = getObject(arg1).value;
-        const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-        const len1 = WASM_VECTOR_LEN;
-        getInt32Memory0()[arg0 / 4 + 1] = len1;
-        getInt32Memory0()[arg0 / 4 + 0] = ptr1;
-    };
-    imports.wbg.__wbg_setvalue_0dc100d4b9908028 = function(arg0, arg1, arg2) {
-        getObject(arg0).value = getStringFromWasm0(arg1, arg2);
-    };
-    imports.wbg.__wbg_getItem_ed8e218e51f1efeb = function() { return handleError(function (arg0, arg1, arg2, arg3) {
+    imports.wbg.__wbg_getItem_c81cd3ae30cd579a = function() { return handleError(function (arg0, arg1, arg2, arg3) {
         const ret = getObject(arg1).getItem(getStringFromWasm0(arg2, arg3));
         var ptr1 = isLikeNone(ret) ? 0 : passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
         var len1 = WASM_VECTOR_LEN;
         getInt32Memory0()[arg0 / 4 + 1] = len1;
         getInt32Memory0()[arg0 / 4 + 0] = ptr1;
     }, arguments) };
-    imports.wbg.__wbg_removeItem_02359267b311cb85 = function() { return handleError(function (arg0, arg1, arg2) {
+    imports.wbg.__wbg_removeItem_58a487fe7fc070f0 = function() { return handleError(function (arg0, arg1, arg2) {
         getObject(arg0).removeItem(getStringFromWasm0(arg1, arg2));
     }, arguments) };
-    imports.wbg.__wbg_setItem_d002ee486462bfff = function() { return handleError(function (arg0, arg1, arg2, arg3, arg4) {
+    imports.wbg.__wbg_setItem_fe04f524052a3839 = function() { return handleError(function (arg0, arg1, arg2, arg3, arg4) {
         getObject(arg0).setItem(getStringFromWasm0(arg1, arg2), getStringFromWasm0(arg3, arg4));
     }, arguments) };
-    imports.wbg.__wbg_get_44be0491f933a435 = function(arg0, arg1) {
+    imports.wbg.__wbg_setchecked_5757666239434ecd = function(arg0, arg1) {
+        getObject(arg0).checked = arg1 !== 0;
+    };
+    imports.wbg.__wbg_value_5e860795f53217cd = function(arg0, arg1) {
+        const ret = getObject(arg1).value;
+        const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len1 = WASM_VECTOR_LEN;
+        getInt32Memory0()[arg0 / 4 + 1] = len1;
+        getInt32Memory0()[arg0 / 4 + 0] = ptr1;
+    };
+    imports.wbg.__wbg_setvalue_7d187f6cc23d8192 = function(arg0, arg1, arg2) {
+        getObject(arg0).value = getStringFromWasm0(arg1, arg2);
+    };
+    imports.wbg.__wbg_addEventListener_51709b9747ad8980 = function() { return handleError(function (arg0, arg1, arg2, arg3, arg4) {
+        getObject(arg0).addEventListener(getStringFromWasm0(arg1, arg2), getObject(arg3), getObject(arg4));
+    }, arguments) };
+    imports.wbg.__wbg_removeEventListener_5b1e762a7951280a = function() { return handleError(function (arg0, arg1, arg2, arg3, arg4) {
+        getObject(arg0).removeEventListener(getStringFromWasm0(arg1, arg2), getObject(arg3), arg4 !== 0);
+    }, arguments) };
+    imports.wbg.__wbg_state_78eaa7b6ff3123a0 = function() { return handleError(function (arg0) {
+        const ret = getObject(arg0).state;
+        return addHeapObject(ret);
+    }, arguments) };
+    imports.wbg.__wbg_pushState_8eaca41f86b13910 = function() { return handleError(function (arg0, arg1, arg2, arg3, arg4, arg5) {
+        getObject(arg0).pushState(getObject(arg1), getStringFromWasm0(arg2, arg3), arg4 === 0 ? undefined : getStringFromWasm0(arg4, arg5));
+    }, arguments) };
+    imports.wbg.__wbg_href_92490614763f3f7c = function() { return handleError(function (arg0, arg1) {
+        const ret = getObject(arg1).href;
+        const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len1 = WASM_VECTOR_LEN;
+        getInt32Memory0()[arg0 / 4 + 1] = len1;
+        getInt32Memory0()[arg0 / 4 + 0] = ptr1;
+    }, arguments) };
+    imports.wbg.__wbg_sethref_2c377515f8ddd13a = function() { return handleError(function (arg0, arg1, arg2) {
+        getObject(arg0).href = getStringFromWasm0(arg1, arg2);
+    }, arguments) };
+    imports.wbg.__wbg_pathname_cd5a90c8f3ab524a = function() { return handleError(function (arg0, arg1) {
+        const ret = getObject(arg1).pathname;
+        const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len1 = WASM_VECTOR_LEN;
+        getInt32Memory0()[arg0 / 4 + 1] = len1;
+        getInt32Memory0()[arg0 / 4 + 0] = ptr1;
+    }, arguments) };
+    imports.wbg.__wbg_search_08fbba2309a249da = function() { return handleError(function (arg0, arg1) {
+        const ret = getObject(arg1).search;
+        const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len1 = WASM_VECTOR_LEN;
+        getInt32Memory0()[arg0 / 4 + 1] = len1;
+        getInt32Memory0()[arg0 / 4 + 0] = ptr1;
+    }, arguments) };
+    imports.wbg.__wbg_hash_ced9ee31706e591d = function() { return handleError(function (arg0, arg1) {
+        const ret = getObject(arg1).hash;
+        const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len1 = WASM_VECTOR_LEN;
+        getInt32Memory0()[arg0 / 4 + 1] = len1;
+        getInt32Memory0()[arg0 / 4 + 0] = ptr1;
+    }, arguments) };
+    imports.wbg.__wbg_headers_4711243cf3bffca0 = function(arg0) {
+        const ret = getObject(arg0).headers;
+        return addHeapObject(ret);
+    };
+    imports.wbg.__wbg_newwithstrandinit_29038da14d09e330 = function() { return handleError(function (arg0, arg1, arg2) {
+        const ret = new Request(getStringFromWasm0(arg0, arg1), getObject(arg2));
+        return addHeapObject(ret);
+    }, arguments) };
+    imports.wbg.__wbg_instanceof_Response_944e2745b5db71f5 = function(arg0) {
+        let result;
+        try {
+            result = getObject(arg0) instanceof Response;
+        } catch (_) {
+            result = false;
+        }
+        const ret = result;
+        return ret;
+    };
+    imports.wbg.__wbg_status_7841bb47be2a8f16 = function(arg0) {
+        const ret = getObject(arg0).status;
+        return ret;
+    };
+    imports.wbg.__wbg_headers_ea7ef583d1564b08 = function(arg0) {
+        const ret = getObject(arg0).headers;
+        return addHeapObject(ret);
+    };
+    imports.wbg.__wbg_json_7f96c90903ae4155 = function() { return handleError(function (arg0) {
+        const ret = getObject(arg0).json();
+        return addHeapObject(ret);
+    }, arguments) };
+    imports.wbg.__wbg_bubbles_c27af65192eb3569 = function(arg0) {
+        const ret = getObject(arg0).bubbles;
+        return ret;
+    };
+    imports.wbg.__wbg_cancelBubble_ee3f70328e901584 = function(arg0) {
+        const ret = getObject(arg0).cancelBubble;
+        return ret;
+    };
+    imports.wbg.__wbg_composedPath_ee37eece046b69a2 = function(arg0) {
+        const ret = getObject(arg0).composedPath();
+        return addHeapObject(ret);
+    };
+    imports.wbg.__wbg_preventDefault_9299867e06da6909 = function(arg0) {
+        getObject(arg0).preventDefault();
+    };
+    imports.wbg.__wbg_get_9470c6584bbde430 = function() { return handleError(function (arg0, arg1, arg2, arg3) {
+        const ret = getObject(arg1).get(getStringFromWasm0(arg2, arg3));
+        var ptr1 = isLikeNone(ret) ? 0 : passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        var len1 = WASM_VECTOR_LEN;
+        getInt32Memory0()[arg0 / 4 + 1] = len1;
+        getInt32Memory0()[arg0 / 4 + 0] = ptr1;
+    }, arguments) };
+    imports.wbg.__wbg_set_2912c891505cbc22 = function() { return handleError(function (arg0, arg1, arg2, arg3, arg4) {
+        getObject(arg0).set(getStringFromWasm0(arg1, arg2), getStringFromWasm0(arg3, arg4));
+    }, arguments) };
+    imports.wbg.__wbg_parentNode_e1c214fc3f362af0 = function(arg0) {
+        const ret = getObject(arg0).parentNode;
+        return isLikeNone(ret) ? 0 : addHeapObject(ret);
+    };
+    imports.wbg.__wbg_parentElement_592cb54944d3d002 = function(arg0) {
+        const ret = getObject(arg0).parentElement;
+        return isLikeNone(ret) ? 0 : addHeapObject(ret);
+    };
+    imports.wbg.__wbg_lastChild_b17b3c7498d25bd7 = function(arg0) {
+        const ret = getObject(arg0).lastChild;
+        return isLikeNone(ret) ? 0 : addHeapObject(ret);
+    };
+    imports.wbg.__wbg_nextSibling_d029031876ed1b1b = function(arg0) {
+        const ret = getObject(arg0).nextSibling;
+        return isLikeNone(ret) ? 0 : addHeapObject(ret);
+    };
+    imports.wbg.__wbg_setnodeValue_321840a6762ab272 = function(arg0, arg1, arg2) {
+        getObject(arg0).nodeValue = arg1 === 0 ? undefined : getStringFromWasm0(arg1, arg2);
+    };
+    imports.wbg.__wbg_textContent_d69d000f6081b514 = function(arg0, arg1) {
+        const ret = getObject(arg1).textContent;
+        var ptr1 = isLikeNone(ret) ? 0 : passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        var len1 = WASM_VECTOR_LEN;
+        getInt32Memory0()[arg0 / 4 + 1] = len1;
+        getInt32Memory0()[arg0 / 4 + 0] = ptr1;
+    };
+    imports.wbg.__wbg_appendChild_2e6a6c9d1f0d443d = function() { return handleError(function (arg0, arg1) {
+        const ret = getObject(arg0).appendChild(getObject(arg1));
+        return addHeapObject(ret);
+    }, arguments) };
+    imports.wbg.__wbg_insertBefore_bdaeec8969497673 = function() { return handleError(function (arg0, arg1, arg2) {
+        const ret = getObject(arg0).insertBefore(getObject(arg1), getObject(arg2));
+        return addHeapObject(ret);
+    }, arguments) };
+    imports.wbg.__wbg_removeChild_a63022ebbfa6ebf5 = function() { return handleError(function (arg0, arg1) {
+        const ret = getObject(arg0).removeChild(getObject(arg1));
+        return addHeapObject(ret);
+    }, arguments) };
+    imports.wbg.__wbg_instanceof_ShadowRoot_f85f709c953844de = function(arg0) {
+        let result;
+        try {
+            result = getObject(arg0) instanceof ShadowRoot;
+        } catch (_) {
+            result = false;
+        }
+        const ret = result;
+        return ret;
+    };
+    imports.wbg.__wbg_host_73c8e95bf9b31ccd = function(arg0) {
+        const ret = getObject(arg0).host;
+        return addHeapObject(ret);
+    };
+    imports.wbg.__wbg_add_dc5c00591ed65268 = function() { return handleError(function (arg0, arg1, arg2) {
+        getObject(arg0).add(getStringFromWasm0(arg1, arg2));
+    }, arguments) };
+    imports.wbg.__wbg_href_7f944b48b612250e = function(arg0, arg1) {
+        const ret = getObject(arg1).href;
+        const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len1 = WASM_VECTOR_LEN;
+        getInt32Memory0()[arg0 / 4 + 1] = len1;
+        getInt32Memory0()[arg0 / 4 + 0] = ptr1;
+    };
+    imports.wbg.__wbg_pathname_a83d8f2ebefa6791 = function(arg0, arg1) {
+        const ret = getObject(arg1).pathname;
+        const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len1 = WASM_VECTOR_LEN;
+        getInt32Memory0()[arg0 / 4 + 1] = len1;
+        getInt32Memory0()[arg0 / 4 + 0] = ptr1;
+    };
+    imports.wbg.__wbg_search_8c5f74fa2d11377e = function(arg0, arg1) {
+        const ret = getObject(arg1).search;
+        const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len1 = WASM_VECTOR_LEN;
+        getInt32Memory0()[arg0 / 4 + 1] = len1;
+        getInt32Memory0()[arg0 / 4 + 0] = ptr1;
+    };
+    imports.wbg.__wbg_setsearch_a168105ad9dbdb8b = function(arg0, arg1, arg2) {
+        getObject(arg0).search = getStringFromWasm0(arg1, arg2);
+    };
+    imports.wbg.__wbg_hash_f468e7d38a21a76a = function(arg0, arg1) {
+        const ret = getObject(arg1).hash;
+        const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len1 = WASM_VECTOR_LEN;
+        getInt32Memory0()[arg0 / 4 + 1] = len1;
+        getInt32Memory0()[arg0 / 4 + 0] = ptr1;
+    };
+    imports.wbg.__wbg_sethash_7c3032584865b2bd = function(arg0, arg1, arg2) {
+        getObject(arg0).hash = getStringFromWasm0(arg1, arg2);
+    };
+    imports.wbg.__wbg_new_d7cd05d9de7d4000 = function() { return handleError(function (arg0, arg1) {
+        const ret = new URL(getStringFromWasm0(arg0, arg1));
+        return addHeapObject(ret);
+    }, arguments) };
+    imports.wbg.__wbg_newwithbase_604e8dfd42d25665 = function() { return handleError(function (arg0, arg1, arg2, arg3) {
+        const ret = new URL(getStringFromWasm0(arg0, arg1), getStringFromWasm0(arg2, arg3));
+        return addHeapObject(ret);
+    }, arguments) };
+    imports.wbg.__wbg_href_2777cc28ba3aac82 = function(arg0, arg1) {
+        const ret = getObject(arg1).href;
+        const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len1 = WASM_VECTOR_LEN;
+        getInt32Memory0()[arg0 / 4 + 1] = len1;
+        getInt32Memory0()[arg0 / 4 + 0] = ptr1;
+    };
+    imports.wbg.__wbg_value_539db729f551be3a = function(arg0, arg1) {
+        const ret = getObject(arg1).value;
+        const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len1 = WASM_VECTOR_LEN;
+        getInt32Memory0()[arg0 / 4 + 1] = len1;
+        getInt32Memory0()[arg0 / 4 + 0] = ptr1;
+    };
+    imports.wbg.__wbg_setvalue_15231c60278dee22 = function(arg0, arg1, arg2) {
+        getObject(arg0).value = getStringFromWasm0(arg1, arg2);
+    };
+    imports.wbg.__wbg_get_4a9aa5157afeb382 = function(arg0, arg1) {
         const ret = getObject(arg0)[arg1 >>> 0];
         return addHeapObject(ret);
     };
-    imports.wbg.__wbg_length_fff51ee6522a1a18 = function(arg0) {
+    imports.wbg.__wbg_length_cace2e0b3ddc0502 = function(arg0) {
         const ret = getObject(arg0).length;
         return ret;
     };
-    imports.wbg.__wbindgen_is_function = function(arg0) {
-        const ret = typeof(getObject(arg0)) === 'function';
-        return ret;
-    };
-    imports.wbg.__wbg_newnoargs_581967eacc0e2604 = function(arg0, arg1) {
+    imports.wbg.__wbg_newnoargs_ccdcae30fd002262 = function(arg0, arg1) {
         const ret = new Function(getStringFromWasm0(arg0, arg1));
         return addHeapObject(ret);
     };
-    imports.wbg.__wbg_next_526fc47e980da008 = function(arg0) {
+    imports.wbg.__wbg_next_15da6a3df9290720 = function(arg0) {
         const ret = getObject(arg0).next;
         return addHeapObject(ret);
     };
-    imports.wbg.__wbg_next_ddb3312ca1c4e32a = function() { return handleError(function (arg0) {
+    imports.wbg.__wbg_next_1989a20442400aaa = function() { return handleError(function (arg0) {
         const ret = getObject(arg0).next();
         return addHeapObject(ret);
     }, arguments) };
-    imports.wbg.__wbg_done_5c1f01fb660d73b5 = function(arg0) {
+    imports.wbg.__wbg_done_bc26bf4ada718266 = function(arg0) {
         const ret = getObject(arg0).done;
         return ret;
     };
-    imports.wbg.__wbg_value_1695675138684bd5 = function(arg0) {
+    imports.wbg.__wbg_value_0570714ff7d75f35 = function(arg0) {
         const ret = getObject(arg0).value;
         return addHeapObject(ret);
     };
-    imports.wbg.__wbg_iterator_97f0c81209c6c35a = function() {
+    imports.wbg.__wbg_iterator_7ee1a391d310f8e4 = function() {
         const ret = Symbol.iterator;
         return addHeapObject(ret);
     };
-    imports.wbg.__wbg_get_97b561fb56f034b5 = function() { return handleError(function (arg0, arg1) {
+    imports.wbg.__wbg_get_2aff440840bb6202 = function() { return handleError(function (arg0, arg1) {
         const ret = Reflect.get(getObject(arg0), getObject(arg1));
         return addHeapObject(ret);
     }, arguments) };
-    imports.wbg.__wbg_call_cb65541d95d71282 = function() { return handleError(function (arg0, arg1) {
+    imports.wbg.__wbg_call_669127b9d730c650 = function() { return handleError(function (arg0, arg1) {
         const ret = getObject(arg0).call(getObject(arg1));
         return addHeapObject(ret);
     }, arguments) };
-    imports.wbg.__wbg_new_b51585de1b234aff = function() {
+    imports.wbg.__wbg_new_c728d68b8b34487e = function() {
         const ret = new Object();
         return addHeapObject(ret);
     };
-    imports.wbg.__wbg_self_1ff1d729e9aae938 = function() { return handleError(function () {
+    imports.wbg.__wbg_self_3fad056edded10bd = function() { return handleError(function () {
         const ret = self.self;
         return addHeapObject(ret);
     }, arguments) };
-    imports.wbg.__wbg_window_5f4faef6c12b79ec = function() { return handleError(function () {
+    imports.wbg.__wbg_window_a4f46c98a61d4089 = function() { return handleError(function () {
         const ret = window.window;
         return addHeapObject(ret);
     }, arguments) };
-    imports.wbg.__wbg_globalThis_1d39714405582d3c = function() { return handleError(function () {
+    imports.wbg.__wbg_globalThis_17eff828815f7d84 = function() { return handleError(function () {
         const ret = globalThis.globalThis;
         return addHeapObject(ret);
     }, arguments) };
-    imports.wbg.__wbg_global_651f05c6a0944d1c = function() { return handleError(function () {
+    imports.wbg.__wbg_global_46f939f6541643c5 = function() { return handleError(function () {
         const ret = global.global;
         return addHeapObject(ret);
     }, arguments) };
-    imports.wbg.__wbg_from_d7c216d4616bb368 = function(arg0) {
+    imports.wbg.__wbg_from_ba72c50feaf1d8c0 = function(arg0) {
         const ret = Array.from(getObject(arg0));
         return addHeapObject(ret);
     };
-    imports.wbg.__wbg_isArray_4c24b343cb13cfb1 = function(arg0) {
+    imports.wbg.__wbg_isArray_38525be7442aa21e = function(arg0) {
         const ret = Array.isArray(getObject(arg0));
         return ret;
     };
-    imports.wbg.__wbg_instanceof_ArrayBuffer_39ac22089b74fddb = function(arg0) {
+    imports.wbg.__wbg_instanceof_ArrayBuffer_c7cc317e5c29cc0d = function(arg0) {
         let result;
         try {
             result = getObject(arg0) instanceof ArrayBuffer;
-        } catch {
+        } catch (_) {
             result = false;
         }
         const ret = result;
         return ret;
     };
-    imports.wbg.__wbg_instanceof_Error_ab19e20608ea43c7 = function(arg0) {
+    imports.wbg.__wbg_instanceof_Error_9f5881c3c4149389 = function(arg0) {
         let result;
         try {
             result = getObject(arg0) instanceof Error;
-        } catch {
+        } catch (_) {
             result = false;
         }
         const ret = result;
         return ret;
     };
-    imports.wbg.__wbg_message_48bacc5ea57d74ee = function(arg0) {
+    imports.wbg.__wbg_message_35f9b952e1b922e2 = function(arg0) {
         const ret = getObject(arg0).message;
         return addHeapObject(ret);
     };
-    imports.wbg.__wbg_name_8f734cbbd6194153 = function(arg0) {
+    imports.wbg.__wbg_name_e1152a59269f79e5 = function(arg0) {
         const ret = getObject(arg0).name;
         return addHeapObject(ret);
     };
-    imports.wbg.__wbg_toString_1c056108b87ba68b = function(arg0) {
+    imports.wbg.__wbg_toString_d0cefe4046ecb265 = function(arg0) {
         const ret = getObject(arg0).toString();
         return addHeapObject(ret);
     };
-    imports.wbg.__wbg_isSafeInteger_bb8e18dd21c97288 = function(arg0) {
+    imports.wbg.__wbg_isSafeInteger_c38b0a16d0c7cef7 = function(arg0) {
         const ret = Number.isSafeInteger(getObject(arg0));
         return ret;
     };
-    imports.wbg.__wbg_entries_e51f29c7bba0c054 = function(arg0) {
+    imports.wbg.__wbg_entries_6d727b73ee02b7ce = function(arg0) {
         const ret = Object.entries(getObject(arg0));
         return addHeapObject(ret);
     };
-    imports.wbg.__wbg_is_205d914af04a8faa = function(arg0, arg1) {
+    imports.wbg.__wbg_is_c74aa9bb973d6109 = function(arg0, arg1) {
         const ret = Object.is(getObject(arg0), getObject(arg1));
         return ret;
     };
-    imports.wbg.__wbg_resolve_53698b95aaf7fcf8 = function(arg0) {
+    imports.wbg.__wbg_resolve_a3252b2860f0a09e = function(arg0) {
         const ret = Promise.resolve(getObject(arg0));
         return addHeapObject(ret);
     };
-    imports.wbg.__wbg_then_f7e06ee3c11698eb = function(arg0, arg1) {
+    imports.wbg.__wbg_then_89e1c559530b85cf = function(arg0, arg1) {
         const ret = getObject(arg0).then(getObject(arg1));
         return addHeapObject(ret);
     };
-    imports.wbg.__wbg_then_b2267541e2a73865 = function(arg0, arg1, arg2) {
+    imports.wbg.__wbg_then_1bbc9edafd859b06 = function(arg0, arg1, arg2) {
         const ret = getObject(arg0).then(getObject(arg1), getObject(arg2));
         return addHeapObject(ret);
     };
-    imports.wbg.__wbg_buffer_085ec1f694018c4f = function(arg0) {
+    imports.wbg.__wbg_buffer_344d9b41efe96da7 = function(arg0) {
         const ret = getObject(arg0).buffer;
         return addHeapObject(ret);
     };
-    imports.wbg.__wbg_new_8125e318e6245eed = function(arg0) {
+    imports.wbg.__wbg_new_d8a000788389a31e = function(arg0) {
         const ret = new Uint8Array(getObject(arg0));
         return addHeapObject(ret);
     };
-    imports.wbg.__wbg_set_5cf90238115182c3 = function(arg0, arg1, arg2) {
+    imports.wbg.__wbg_set_dcfd613a3420f908 = function(arg0, arg1, arg2) {
         getObject(arg0).set(getObject(arg1), arg2 >>> 0);
     };
-    imports.wbg.__wbg_length_72e2208bbc0efc61 = function(arg0) {
+    imports.wbg.__wbg_length_a5587d6cd79ab197 = function(arg0) {
         const ret = getObject(arg0).length;
         return ret;
     };
-    imports.wbg.__wbg_instanceof_Uint8Array_d8d9cb2b8e8ac1d4 = function(arg0) {
+    imports.wbg.__wbg_instanceof_Uint8Array_19e6f142a5e7e1e1 = function(arg0) {
         let result;
         try {
             result = getObject(arg0) instanceof Uint8Array;
-        } catch {
+        } catch (_) {
             result = false;
         }
         const ret = result;
         return ret;
     };
-    imports.wbg.__wbg_set_092e06b0f9d71865 = function() { return handleError(function (arg0, arg1, arg2) {
+    imports.wbg.__wbg_set_40f7786a25a9cc7e = function() { return handleError(function (arg0, arg1, arg2) {
         const ret = Reflect.set(getObject(arg0), getObject(arg1), getObject(arg2));
         return ret;
     }, arguments) };
@@ -962,16 +969,16 @@ function __wbg_get_imports() {
         const ret = wasm.memory;
         return addHeapObject(ret);
     };
-    imports.wbg.__wbindgen_closure_wrapper1255 = function(arg0, arg1, arg2) {
-        const ret = makeMutClosure(arg0, arg1, 572, __wbg_adapter_38);
+    imports.wbg.__wbindgen_closure_wrapper1236 = function(arg0, arg1, arg2) {
+        const ret = makeMutClosure(arg0, arg1, 558, __wbg_adapter_38);
         return addHeapObject(ret);
     };
-    imports.wbg.__wbindgen_closure_wrapper1369 = function(arg0, arg1, arg2) {
-        const ret = makeMutClosure(arg0, arg1, 625, __wbg_adapter_41);
+    imports.wbg.__wbindgen_closure_wrapper1370 = function(arg0, arg1, arg2) {
+        const ret = makeMutClosure(arg0, arg1, 624, __wbg_adapter_41);
         return addHeapObject(ret);
     };
-    imports.wbg.__wbindgen_closure_wrapper1449 = function(arg0, arg1, arg2) {
-        const ret = makeMutClosure(arg0, arg1, 660, __wbg_adapter_44);
+    imports.wbg.__wbindgen_closure_wrapper1451 = function(arg0, arg1, arg2) {
+        const ret = makeMutClosure(arg0, arg1, 655, __wbg_adapter_44);
         return addHeapObject(ret);
     };
 

server/web_ui/pkg/kanidmd_web_ui_login_flows.js

@@ -232,19 +232,19 @@ function addBorrowedObject(obj) {
 }
 function __wbg_adapter_48(arg0, arg1, arg2) {
     try {
-        wasm._dyn_core__ops__function__FnMut___A____Output___R_as_wasm_bindgen__closure__WasmClosure___describe__invoke__h8deac55eedda0aff(arg0, arg1, addBorrowedObject(arg2));
+        wasm._dyn_core__ops__function__FnMut___A____Output___R_as_wasm_bindgen__closure__WasmClosure___describe__invoke__h7bf04a09fe2e4b23(arg0, arg1, addBorrowedObject(arg2));
     } finally {
         heap[stack_pointer++] = undefined;
     }
 }
 
 function __wbg_adapter_51(arg0, arg1, arg2) {
-    wasm._dyn_core__ops__function__FnMut__A____Output___R_as_wasm_bindgen__closure__WasmClosure___describe__invoke__hc231a149f34a8d89(arg0, arg1, addHeapObject(arg2));
+    wasm._dyn_core__ops__function__FnMut__A____Output___R_as_wasm_bindgen__closure__WasmClosure___describe__invoke__h71282a39cf9f54cc(arg0, arg1, addHeapObject(arg2));
 }
 
 function __wbg_adapter_54(arg0, arg1, arg2) {
     try {
-        wasm._dyn_core__ops__function__FnMut___A____Output___R_as_wasm_bindgen__closure__WasmClosure___describe__invoke__h1119aefff0725253(arg0, arg1, addBorrowedObject(arg2));
+        wasm._dyn_core__ops__function__FnMut___A____Output___R_as_wasm_bindgen__closure__WasmClosure___describe__invoke__h0e38a66b2b075f9c(arg0, arg1, addBorrowedObject(arg2));
     } finally {
         heap[stack_pointer++] = undefined;
     }
@@ -415,11 +415,6 @@ function __wbg_get_imports() {
         getInt32Memory0()[arg0 / 4 + 1] = isLikeNone(ret) ? 0 : ret;
         getInt32Memory0()[arg0 / 4 + 0] = !isLikeNone(ret);
     };
-    imports.wbg.__wbg_cachekey_b61393159c57fd7b = function(arg0, arg1) {
-        const ret = getObject(arg1).__yew_subtree_cache_key;
-        getInt32Memory0()[arg0 / 4 + 1] = isLikeNone(ret) ? 0 : ret;
-        getInt32Memory0()[arg0 / 4 + 0] = !isLikeNone(ret);
-    };
     imports.wbg.__wbg_subtreeid_e348577f7ef777e3 = function(arg0, arg1) {
         const ret = getObject(arg1).__yew_subtree_id;
         getInt32Memory0()[arg0 / 4 + 1] = isLikeNone(ret) ? 0 : ret;
@@ -428,6 +423,11 @@ function __wbg_get_imports() {
     imports.wbg.__wbg_setsubtreeid_d32e6327eef1f7fc = function(arg0, arg1) {
         getObject(arg0).__yew_subtree_id = arg1 >>> 0;
     };
+    imports.wbg.__wbg_cachekey_b61393159c57fd7b = function(arg0, arg1) {
+        const ret = getObject(arg1).__yew_subtree_cache_key;
+        getInt32Memory0()[arg0 / 4 + 1] = isLikeNone(ret) ? 0 : ret;
+        getInt32Memory0()[arg0 / 4 + 0] = !isLikeNone(ret);
+    };
     imports.wbg.__wbg_setcachekey_80183b7cfc421143 = function(arg0, arg1) {
         getObject(arg0).__yew_subtree_cache_key = arg1 >>> 0;
     };
@@ -464,6 +464,17 @@ function __wbg_get_imports() {
     imports.wbg.__wbg_set_20cbc34131e76824 = function(arg0, arg1, arg2) {
         getObject(arg0)[takeObject(arg1)] = takeObject(arg2);
     };
+    imports.wbg.__wbg_queueMicrotask_e5949c35d772a669 = function(arg0) {
+        queueMicrotask(getObject(arg0));
+    };
+    imports.wbg.__wbg_queueMicrotask_2be8b97a81fe4d00 = function(arg0) {
+        const ret = getObject(arg0).queueMicrotask;
+        return addHeapObject(ret);
+    };
+    imports.wbg.__wbindgen_is_function = function(arg0) {
+        const ret = typeof(getObject(arg0)) === 'function';
+        return ret;
+    };
     imports.wbg.__wbg_getwithrefkey_5e6d9547403deab8 = function(arg0, arg1) {
         const ret = getObject(arg0)[getObject(arg1)];
         return addHeapObject(ret);
@@ -473,585 +484,581 @@ function __wbg_get_imports() {
     };
     imports.wbg.__wbg_debug_783a3d4910bc24c7 = function(arg0, arg1) {
         var v0 = getArrayJsValueFromWasm0(arg0, arg1).slice();
-        wasm.__wbindgen_free(arg0, arg1 * 4);
+        wasm.__wbindgen_free(arg0, arg1 * 4, 4);
         console.debug(...v0);
     };
     imports.wbg.__wbg_error_71d6845bf00a930f = function(arg0, arg1) {
         var v0 = getArrayJsValueFromWasm0(arg0, arg1).slice();
-        wasm.__wbindgen_free(arg0, arg1 * 4);
+        wasm.__wbindgen_free(arg0, arg1 * 4, 4);
         console.error(...v0);
     };
     imports.wbg.__wbg_info_0d469cecacab90cb = function(arg0, arg1) {
         var v0 = getArrayJsValueFromWasm0(arg0, arg1).slice();
-        wasm.__wbindgen_free(arg0, arg1 * 4);
+        wasm.__wbindgen_free(arg0, arg1 * 4, 4);
         console.info(...v0);
     };
     imports.wbg.__wbg_log_1f7f93998ab961f7 = function(arg0, arg1) {
         var v0 = getArrayJsValueFromWasm0(arg0, arg1).slice();
-        wasm.__wbindgen_free(arg0, arg1 * 4);
+        wasm.__wbindgen_free(arg0, arg1 * 4, 4);
         console.log(...v0);
     };
     imports.wbg.__wbg_warn_0b90a269a514ae1d = function(arg0, arg1) {
         var v0 = getArrayJsValueFromWasm0(arg0, arg1).slice();
-        wasm.__wbindgen_free(arg0, arg1 * 4);
+        wasm.__wbindgen_free(arg0, arg1 * 4, 4);
         console.warn(...v0);
     };
-    imports.wbg.__wbg_body_674aec4c1c0910cd = function(arg0) {
+    imports.wbg.__wbg_body_11da0c1aa9610cb3 = function(arg0) {
         const ret = getObject(arg0).body;
         return isLikeNone(ret) ? 0 : addHeapObject(ret);
     };
-    imports.wbg.__wbg_createElement_4891554b28d3388b = function() { return handleError(function (arg0, arg1, arg2) {
+    imports.wbg.__wbg_createElement_9ce3fdea8322ff34 = function() { return handleError(function (arg0, arg1, arg2) {
         const ret = getObject(arg0).createElement(getStringFromWasm0(arg1, arg2));
         return addHeapObject(ret);
     }, arguments) };
-    imports.wbg.__wbg_createElementNS_119acf9e82482041 = function() { return handleError(function (arg0, arg1, arg2, arg3, arg4) {
+    imports.wbg.__wbg_createElementNS_6a08d8f33e767e18 = function() { return handleError(function (arg0, arg1, arg2, arg3, arg4) {
         const ret = getObject(arg0).createElementNS(arg1 === 0 ? undefined : getStringFromWasm0(arg1, arg2), getStringFromWasm0(arg3, arg4));
         return addHeapObject(ret);
     }, arguments) };
-    imports.wbg.__wbg_createTextNode_2fd22cd7e543f938 = function(arg0, arg1, arg2) {
+    imports.wbg.__wbg_createTextNode_01a7250c5ca46b04 = function(arg0, arg1, arg2) {
         const ret = getObject(arg0).createTextNode(getStringFromWasm0(arg1, arg2));
         return addHeapObject(ret);
     };
-    imports.wbg.__wbg_getElementById_cc0e0d931b0d9a28 = function(arg0, arg1, arg2) {
+    imports.wbg.__wbg_getElementById_328f8c4a5bb51ba8 = function(arg0, arg1, arg2) {
         const ret = getObject(arg0).getElementById(getStringFromWasm0(arg1, arg2));
         return isLikeNone(ret) ? 0 : addHeapObject(ret);
     };
-    imports.wbg.__wbg_querySelector_52ded52c20e23921 = function() { return handleError(function (arg0, arg1, arg2) {
+    imports.wbg.__wbg_querySelector_391afe271b8236d5 = function() { return handleError(function (arg0, arg1, arg2) {
         const ret = getObject(arg0).querySelector(getStringFromWasm0(arg1, arg2));
         return isLikeNone(ret) ? 0 : addHeapObject(ret);
     }, arguments) };
-    imports.wbg.__wbg_instanceof_Element_4622f5da1249a3eb = function(arg0) {
+    imports.wbg.__wbg_instanceof_Window_cde2416cf5126a72 = function(arg0) {
         let result;
         try {
-            result = getObject(arg0) instanceof Element;
-        } catch {
+            result = getObject(arg0) instanceof Window;
+        } catch (_) {
             result = false;
         }
         const ret = result;
         return ret;
     };
-    imports.wbg.__wbg_namespaceURI_31718ed49b5343a3 = function(arg0, arg1) {
+    imports.wbg.__wbg_document_183cf1eecfdbffee = function(arg0) {
+        const ret = getObject(arg0).document;
+        return isLikeNone(ret) ? 0 : addHeapObject(ret);
+    };
+    imports.wbg.__wbg_location_61ca61017633c753 = function(arg0) {
+        const ret = getObject(arg0).location;
+        return addHeapObject(ret);
+    };
+    imports.wbg.__wbg_history_56dc869560201113 = function() { return handleError(function (arg0) {
+        const ret = getObject(arg0).history;
+        return addHeapObject(ret);
+    }, arguments) };
+    imports.wbg.__wbg_navigator_7078da62d92ff5ad = function(arg0) {
+        const ret = getObject(arg0).navigator;
+        return addHeapObject(ret);
+    };
+    imports.wbg.__wbg_localStorage_e11f72e996a4f5d9 = function() { return handleError(function (arg0) {
+        const ret = getObject(arg0).localStorage;
+        return isLikeNone(ret) ? 0 : addHeapObject(ret);
+    }, arguments) };
+    imports.wbg.__wbg_sessionStorage_071949dc646bfd35 = function() { return handleError(function (arg0) {
+        const ret = getObject(arg0).sessionStorage;
+        return isLikeNone(ret) ? 0 : addHeapObject(ret);
+    }, arguments) };
+    imports.wbg.__wbg_fetch_8cebc656dc6b11b1 = function(arg0, arg1) {
+        const ret = getObject(arg0).fetch(getObject(arg1));
+        return addHeapObject(ret);
+    };
+    imports.wbg.__wbg_instanceof_Element_6c7af07f5e6c8d69 = function(arg0) {
+        let result;
+        try {
+            result = getObject(arg0) instanceof Element;
+        } catch (_) {
+            result = false;
+        }
+        const ret = result;
+        return ret;
+    };
+    imports.wbg.__wbg_namespaceURI_2dd94d0147ffddf2 = function(arg0, arg1) {
         const ret = getObject(arg1).namespaceURI;
         var ptr1 = isLikeNone(ret) ? 0 : passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
         var len1 = WASM_VECTOR_LEN;
         getInt32Memory0()[arg0 / 4 + 1] = len1;
         getInt32Memory0()[arg0 / 4 + 0] = ptr1;
     };
-    imports.wbg.__wbg_classList_5f2fc1d67656292e = function(arg0) {
+    imports.wbg.__wbg_classList_7fd39dc155235d8a = function(arg0) {
         const ret = getObject(arg0).classList;
         return addHeapObject(ret);
     };
-    imports.wbg.__wbg_setinnerHTML_b089587252408b67 = function(arg0, arg1, arg2) {
+    imports.wbg.__wbg_setinnerHTML_b88bf159b62c2334 = function(arg0, arg1, arg2) {
         getObject(arg0).innerHTML = getStringFromWasm0(arg1, arg2);
     };
-    imports.wbg.__wbg_outerHTML_f7749ceff37b5832 = function(arg0, arg1) {
+    imports.wbg.__wbg_outerHTML_72dcf3aa34725f10 = function(arg0, arg1) {
         const ret = getObject(arg1).outerHTML;
         const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
         const len1 = WASM_VECTOR_LEN;
         getInt32Memory0()[arg0 / 4 + 1] = len1;
         getInt32Memory0()[arg0 / 4 + 0] = ptr1;
     };
-    imports.wbg.__wbg_children_27ed308801b57d3f = function(arg0) {
+    imports.wbg.__wbg_children_af5a3246832628b1 = function(arg0) {
         const ret = getObject(arg0).children;
         return addHeapObject(ret);
     };
-    imports.wbg.__wbg_removeAttribute_d8404da431968808 = function() { return handleError(function (arg0, arg1, arg2) {
+    imports.wbg.__wbg_removeAttribute_dbd76981f9bb9f59 = function() { return handleError(function (arg0, arg1, arg2) {
         getObject(arg0).removeAttribute(getStringFromWasm0(arg1, arg2));
     }, arguments) };
-    imports.wbg.__wbg_setAttribute_e7e80b478b7b8b2f = function() { return handleError(function (arg0, arg1, arg2, arg3, arg4) {
+    imports.wbg.__wbg_setAttribute_aebcae2169f2f869 = function() { return handleError(function (arg0, arg1, arg2, arg3, arg4) {
         getObject(arg0).setAttribute(getStringFromWasm0(arg1, arg2), getStringFromWasm0(arg3, arg4));
     }, arguments) };
-    imports.wbg.__wbg_instanceof_Window_9029196b662bc42a = function(arg0) {
-        let result;
-        try {
-            result = getObject(arg0) instanceof Window;
-        } catch {
-            result = false;
-        }
-        const ret = result;
-        return ret;
-    };
-    imports.wbg.__wbg_document_f7ace2b956f30a4f = function(arg0) {
-        const ret = getObject(arg0).document;
-        return isLikeNone(ret) ? 0 : addHeapObject(ret);
-    };
-    imports.wbg.__wbg_location_56243dba507f472d = function(arg0) {
-        const ret = getObject(arg0).location;
-        return addHeapObject(ret);
-    };
-    imports.wbg.__wbg_history_3c2280e6b2a9316e = function() { return handleError(function (arg0) {
-        const ret = getObject(arg0).history;
-        return addHeapObject(ret);
-    }, arguments) };
-    imports.wbg.__wbg_navigator_7c9103698acde322 = function(arg0) {
-        const ret = getObject(arg0).navigator;
-        return addHeapObject(ret);
-    };
-    imports.wbg.__wbg_localStorage_dbac11bd189e9fa0 = function() { return handleError(function (arg0) {
-        const ret = getObject(arg0).localStorage;
-        return isLikeNone(ret) ? 0 : addHeapObject(ret);
-    }, arguments) };
-    imports.wbg.__wbg_sessionStorage_3b863b6e15dd2bdc = function() { return handleError(function (arg0) {
-        const ret = getObject(arg0).sessionStorage;
-        return isLikeNone(ret) ? 0 : addHeapObject(ret);
-    }, arguments) };
-    imports.wbg.__wbg_fetch_336b6f0cb426b46e = function(arg0, arg1) {
-        const ret = getObject(arg0).fetch(getObject(arg1));
-        return addHeapObject(ret);
-    };
-    imports.wbg.__wbg_instanceof_HtmlElement_6f4725d4677c7968 = function(arg0) {
+    imports.wbg.__wbg_instanceof_HtmlElement_d9fe655ad4f1046c = function(arg0) {
         let result;
         try {
             result = getObject(arg0) instanceof HTMLElement;
-        } catch {
+        } catch (_) {
             result = false;
         }
         const ret = result;
         return ret;
     };
-    imports.wbg.__wbg_focus_dbcbbbb2a04c0e1f = function() { return handleError(function (arg0) {
+    imports.wbg.__wbg_focus_bab0841297cb9142 = function() { return handleError(function (arg0) {
         getObject(arg0).focus();
     }, arguments) };
-    imports.wbg.__wbg_add_3eafedc4b2a28db0 = function() { return handleError(function (arg0, arg1, arg2) {
-        getObject(arg0).add(getStringFromWasm0(arg1, arg2));
-    }, arguments) };
-    imports.wbg.__wbg_remove_8ae45e50cb58bb66 = function() { return handleError(function (arg0, arg1, arg2) {
-        getObject(arg0).remove(getStringFromWasm0(arg1, arg2));
-    }, arguments) };
-    imports.wbg.__wbg_get_2e9aab260014946d = function() { return handleError(function (arg0, arg1, arg2, arg3) {
-        const ret = getObject(arg1).get(getStringFromWasm0(arg2, arg3));
-        var ptr1 = isLikeNone(ret) ? 0 : passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-        var len1 = WASM_VECTOR_LEN;
-        getInt32Memory0()[arg0 / 4 + 1] = len1;
-        getInt32Memory0()[arg0 / 4 + 0] = ptr1;
-    }, arguments) };
-    imports.wbg.__wbg_set_b34caba58723c454 = function() { return handleError(function (arg0, arg1, arg2, arg3, arg4) {
-        getObject(arg0).set(getStringFromWasm0(arg1, arg2), getStringFromWasm0(arg3, arg4));
-    }, arguments) };
-    imports.wbg.__wbg_bubbles_63572b91f3885ef1 = function(arg0) {
-        const ret = getObject(arg0).bubbles;
-        return ret;
-    };
-    imports.wbg.__wbg_cancelBubble_90d1c3aa2a76cbeb = function(arg0) {
-        const ret = getObject(arg0).cancelBubble;
-        return ret;
-    };
-    imports.wbg.__wbg_composedPath_cf1bb5b8bcff496f = function(arg0) {
-        const ret = getObject(arg0).composedPath();
-        return addHeapObject(ret);
-    };
-    imports.wbg.__wbg_preventDefault_24104f3f0a54546a = function(arg0) {
-        getObject(arg0).preventDefault();
-    };
-    imports.wbg.__wbg_href_d62a28e4fc1ab948 = function() { return handleError(function (arg0, arg1) {
-        const ret = getObject(arg1).href;
-        const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-        const len1 = WASM_VECTOR_LEN;
-        getInt32Memory0()[arg0 / 4 + 1] = len1;
-        getInt32Memory0()[arg0 / 4 + 0] = ptr1;
-    }, arguments) };
-    imports.wbg.__wbg_sethref_e5626365d7354fea = function() { return handleError(function (arg0, arg1, arg2) {
-        getObject(arg0).href = getStringFromWasm0(arg1, arg2);
-    }, arguments) };
-    imports.wbg.__wbg_pathname_c8fd5c498079312d = function() { return handleError(function (arg0, arg1) {
-        const ret = getObject(arg1).pathname;
-        const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-        const len1 = WASM_VECTOR_LEN;
-        getInt32Memory0()[arg0 / 4 + 1] = len1;
-        getInt32Memory0()[arg0 / 4 + 0] = ptr1;
-    }, arguments) };
-    imports.wbg.__wbg_search_6c3c472e076ee010 = function() { return handleError(function (arg0, arg1) {
-        const ret = getObject(arg1).search;
-        const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-        const len1 = WASM_VECTOR_LEN;
-        getInt32Memory0()[arg0 / 4 + 1] = len1;
-        getInt32Memory0()[arg0 / 4 + 0] = ptr1;
-    }, arguments) };
-    imports.wbg.__wbg_hash_a1a795b89dda8e3d = function() { return handleError(function (arg0, arg1) {
-        const ret = getObject(arg1).hash;
-        const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-        const len1 = WASM_VECTOR_LEN;
-        getInt32Memory0()[arg0 / 4 + 1] = len1;
-        getInt32Memory0()[arg0 / 4 + 0] = ptr1;
-    }, arguments) };
-    imports.wbg.__wbg_replace_5d1d2b7956cafd7b = function() { return handleError(function (arg0, arg1, arg2) {
-        getObject(arg0).replace(getStringFromWasm0(arg1, arg2));
-    }, arguments) };
-    imports.wbg.__wbg_log_1d3ae0273d8f4f8a = function(arg0) {
-        console.log(getObject(arg0));
-    };
-    imports.wbg.__wbg_get_e66794f89dcd7828 = function() { return handleError(function (arg0, arg1) {
+    imports.wbg.__wbg_get_be3f61d062825ba1 = function() { return handleError(function (arg0, arg1) {
         const ret = getObject(arg0).get(getObject(arg1));
         return addHeapObject(ret);
     }, arguments) };
-    imports.wbg.__wbg_state_745dc4814d321eb3 = function() { return handleError(function (arg0) {
-        const ret = getObject(arg0).state;
-        return addHeapObject(ret);
-    }, arguments) };
-    imports.wbg.__wbg_pushState_1145414a47c0b629 = function() { return handleError(function (arg0, arg1, arg2, arg3, arg4, arg5) {
-        getObject(arg0).pushState(getObject(arg1), getStringFromWasm0(arg2, arg3), arg4 === 0 ? undefined : getStringFromWasm0(arg4, arg5));
-    }, arguments) };
-    imports.wbg.__wbg_headers_b439dcff02e808e5 = function(arg0) {
-        const ret = getObject(arg0).headers;
+    imports.wbg.__wbg_credentials_6a08cfc972615f5c = function(arg0) {
+        const ret = getObject(arg0).credentials;
         return addHeapObject(ret);
     };
-    imports.wbg.__wbg_newwithstrandinit_cad5cd6038c7ff5d = function() { return handleError(function (arg0, arg1, arg2) {
-        const ret = new Request(getStringFromWasm0(arg0, arg1), getObject(arg2));
-        return addHeapObject(ret);
-    }, arguments) };
-    imports.wbg.__wbg_instanceof_Response_fc4327dbfcdf5ced = function(arg0) {
-        let result;
-        try {
-            result = getObject(arg0) instanceof Response;
-        } catch {
-            result = false;
-        }
-        const ret = result;
-        return ret;
-    };
-    imports.wbg.__wbg_status_ac85a3142a84caa2 = function(arg0) {
-        const ret = getObject(arg0).status;
-        return ret;
-    };
-    imports.wbg.__wbg_headers_b70de86b8e989bc0 = function(arg0) {
-        const ret = getObject(arg0).headers;
-        return addHeapObject(ret);
-    };
-    imports.wbg.__wbg_json_2a46ed5b7c4d30d1 = function() { return handleError(function (arg0) {
-        const ret = getObject(arg0).json();
-        return addHeapObject(ret);
-    }, arguments) };
-    imports.wbg.__wbg_instanceof_ShadowRoot_b64337370f59fe2d = function(arg0) {
-        let result;
-        try {
-            result = getObject(arg0) instanceof ShadowRoot;
-        } catch {
-            result = false;
-        }
-        const ret = result;
-        return ret;
-    };
-    imports.wbg.__wbg_host_e1c47c33975060d3 = function(arg0) {
-        const ret = getObject(arg0).host;
-        return addHeapObject(ret);
-    };
-    imports.wbg.__wbg_href_17ed54b321396524 = function(arg0, arg1) {
-        const ret = getObject(arg1).href;
-        const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-        const len1 = WASM_VECTOR_LEN;
-        getInt32Memory0()[arg0 / 4 + 1] = len1;
-        getInt32Memory0()[arg0 / 4 + 0] = ptr1;
-    };
-    imports.wbg.__wbg_pathname_57290e07c6bc0683 = function(arg0, arg1) {
-        const ret = getObject(arg1).pathname;
-        const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-        const len1 = WASM_VECTOR_LEN;
-        getInt32Memory0()[arg0 / 4 + 1] = len1;
-        getInt32Memory0()[arg0 / 4 + 0] = ptr1;
-    };
-    imports.wbg.__wbg_search_2ff3bb9114e0ca34 = function(arg0, arg1) {
-        const ret = getObject(arg1).search;
-        const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-        const len1 = WASM_VECTOR_LEN;
-        getInt32Memory0()[arg0 / 4 + 1] = len1;
-        getInt32Memory0()[arg0 / 4 + 0] = ptr1;
-    };
-    imports.wbg.__wbg_hash_2b57e787945b2db0 = function(arg0, arg1) {
-        const ret = getObject(arg1).hash;
-        const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-        const len1 = WASM_VECTOR_LEN;
-        getInt32Memory0()[arg0 / 4 + 1] = len1;
-        getInt32Memory0()[arg0 / 4 + 0] = ptr1;
-    };
-    imports.wbg.__wbg_sethash_41d6e65816639c62 = function(arg0, arg1, arg2) {
-        getObject(arg0).hash = getStringFromWasm0(arg1, arg2);
-    };
-    imports.wbg.__wbg_new_a76f6bcb38f791ea = function() { return handleError(function (arg0, arg1) {
-        const ret = new URL(getStringFromWasm0(arg0, arg1));
-        return addHeapObject(ret);
-    }, arguments) };
-    imports.wbg.__wbg_newwithbase_79b8cac27ce631ac = function() { return handleError(function (arg0, arg1, arg2, arg3) {
-        const ret = new URL(getStringFromWasm0(arg0, arg1), getStringFromWasm0(arg2, arg3));
-        return addHeapObject(ret);
-    }, arguments) };
-    imports.wbg.__wbg_addEventListener_a5963e26cd7b176b = function() { return handleError(function (arg0, arg1, arg2, arg3, arg4) {
-        getObject(arg0).addEventListener(getStringFromWasm0(arg1, arg2), getObject(arg3), getObject(arg4));
-    }, arguments) };
-    imports.wbg.__wbg_removeEventListener_782040b4432709cb = function() { return handleError(function (arg0, arg1, arg2, arg3, arg4) {
-        getObject(arg0).removeEventListener(getStringFromWasm0(arg1, arg2), getObject(arg3), arg4 !== 0);
-    }, arguments) };
-    imports.wbg.__wbg_href_47b90f0ddf3ddcd7 = function(arg0, arg1) {
-        const ret = getObject(arg1).href;
-        const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-        const len1 = WASM_VECTOR_LEN;
-        getInt32Memory0()[arg0 / 4 + 1] = len1;
-        getInt32Memory0()[arg0 / 4 + 0] = ptr1;
-    };
-    imports.wbg.__wbg_value_3c5f08ffc2b7d6f9 = function(arg0, arg1) {
-        const ret = getObject(arg1).value;
-        const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-        const len1 = WASM_VECTOR_LEN;
-        getInt32Memory0()[arg0 / 4 + 1] = len1;
-        getInt32Memory0()[arg0 / 4 + 0] = ptr1;
-    };
-    imports.wbg.__wbg_setvalue_0dc100d4b9908028 = function(arg0, arg1, arg2) {
-        getObject(arg0).value = getStringFromWasm0(arg1, arg2);
-    };
-    imports.wbg.__wbg_getClientExtensionResults_b9108fbba9f54b38 = function(arg0) {
-        const ret = getObject(arg0).getClientExtensionResults();
-        return addHeapObject(ret);
-    };
-    imports.wbg.__wbg_getItem_ed8e218e51f1efeb = function() { return handleError(function (arg0, arg1, arg2, arg3) {
+    imports.wbg.__wbg_getItem_c81cd3ae30cd579a = function() { return handleError(function (arg0, arg1, arg2, arg3) {
         const ret = getObject(arg1).getItem(getStringFromWasm0(arg2, arg3));
         var ptr1 = isLikeNone(ret) ? 0 : passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
         var len1 = WASM_VECTOR_LEN;
         getInt32Memory0()[arg0 / 4 + 1] = len1;
         getInt32Memory0()[arg0 / 4 + 0] = ptr1;
     }, arguments) };
-    imports.wbg.__wbg_removeItem_02359267b311cb85 = function() { return handleError(function (arg0, arg1, arg2) {
+    imports.wbg.__wbg_removeItem_58a487fe7fc070f0 = function() { return handleError(function (arg0, arg1, arg2) {
         getObject(arg0).removeItem(getStringFromWasm0(arg1, arg2));
     }, arguments) };
-    imports.wbg.__wbg_setItem_d002ee486462bfff = function() { return handleError(function (arg0, arg1, arg2, arg3, arg4) {
+    imports.wbg.__wbg_setItem_fe04f524052a3839 = function() { return handleError(function (arg0, arg1, arg2, arg3, arg4) {
         getObject(arg0).setItem(getStringFromWasm0(arg1, arg2), getStringFromWasm0(arg3, arg4));
     }, arguments) };
-    imports.wbg.__wbg_credentials_66b6baa89eb03c21 = function(arg0) {
-        const ret = getObject(arg0).credentials;
+    imports.wbg.__wbg_addEventListener_51709b9747ad8980 = function() { return handleError(function (arg0, arg1, arg2, arg3, arg4) {
+        getObject(arg0).addEventListener(getStringFromWasm0(arg1, arg2), getObject(arg3), getObject(arg4));
+    }, arguments) };
+    imports.wbg.__wbg_removeEventListener_5b1e762a7951280a = function() { return handleError(function (arg0, arg1, arg2, arg3, arg4) {
+        getObject(arg0).removeEventListener(getStringFromWasm0(arg1, arg2), getObject(arg3), arg4 !== 0);
+    }, arguments) };
+    imports.wbg.__wbg_state_78eaa7b6ff3123a0 = function() { return handleError(function (arg0) {
+        const ret = getObject(arg0).state;
+        return addHeapObject(ret);
+    }, arguments) };
+    imports.wbg.__wbg_pushState_8eaca41f86b13910 = function() { return handleError(function (arg0, arg1, arg2, arg3, arg4, arg5) {
+        getObject(arg0).pushState(getObject(arg1), getStringFromWasm0(arg2, arg3), arg4 === 0 ? undefined : getStringFromWasm0(arg4, arg5));
+    }, arguments) };
+    imports.wbg.__wbg_href_92490614763f3f7c = function() { return handleError(function (arg0, arg1) {
+        const ret = getObject(arg1).href;
+        const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len1 = WASM_VECTOR_LEN;
+        getInt32Memory0()[arg0 / 4 + 1] = len1;
+        getInt32Memory0()[arg0 / 4 + 0] = ptr1;
+    }, arguments) };
+    imports.wbg.__wbg_sethref_2c377515f8ddd13a = function() { return handleError(function (arg0, arg1, arg2) {
+        getObject(arg0).href = getStringFromWasm0(arg1, arg2);
+    }, arguments) };
+    imports.wbg.__wbg_pathname_cd5a90c8f3ab524a = function() { return handleError(function (arg0, arg1) {
+        const ret = getObject(arg1).pathname;
+        const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len1 = WASM_VECTOR_LEN;
+        getInt32Memory0()[arg0 / 4 + 1] = len1;
+        getInt32Memory0()[arg0 / 4 + 0] = ptr1;
+    }, arguments) };
+    imports.wbg.__wbg_search_08fbba2309a249da = function() { return handleError(function (arg0, arg1) {
+        const ret = getObject(arg1).search;
+        const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len1 = WASM_VECTOR_LEN;
+        getInt32Memory0()[arg0 / 4 + 1] = len1;
+        getInt32Memory0()[arg0 / 4 + 0] = ptr1;
+    }, arguments) };
+    imports.wbg.__wbg_hash_ced9ee31706e591d = function() { return handleError(function (arg0, arg1) {
+        const ret = getObject(arg1).hash;
+        const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len1 = WASM_VECTOR_LEN;
+        getInt32Memory0()[arg0 / 4 + 1] = len1;
+        getInt32Memory0()[arg0 / 4 + 0] = ptr1;
+    }, arguments) };
+    imports.wbg.__wbg_replace_4f50b38e38ea7fd6 = function() { return handleError(function (arg0, arg1, arg2) {
+        getObject(arg0).replace(getStringFromWasm0(arg1, arg2));
+    }, arguments) };
+    imports.wbg.__wbg_headers_4711243cf3bffca0 = function(arg0) {
+        const ret = getObject(arg0).headers;
         return addHeapObject(ret);
     };
-    imports.wbg.__wbg_parentNode_9e53f8b17eb98c9d = function(arg0) {
+    imports.wbg.__wbg_newwithstrandinit_29038da14d09e330 = function() { return handleError(function (arg0, arg1, arg2) {
+        const ret = new Request(getStringFromWasm0(arg0, arg1), getObject(arg2));
+        return addHeapObject(ret);
+    }, arguments) };
+    imports.wbg.__wbg_instanceof_Response_944e2745b5db71f5 = function(arg0) {
+        let result;
+        try {
+            result = getObject(arg0) instanceof Response;
+        } catch (_) {
+            result = false;
+        }
+        const ret = result;
+        return ret;
+    };
+    imports.wbg.__wbg_status_7841bb47be2a8f16 = function(arg0) {
+        const ret = getObject(arg0).status;
+        return ret;
+    };
+    imports.wbg.__wbg_headers_ea7ef583d1564b08 = function(arg0) {
+        const ret = getObject(arg0).headers;
+        return addHeapObject(ret);
+    };
+    imports.wbg.__wbg_json_7f96c90903ae4155 = function() { return handleError(function (arg0) {
+        const ret = getObject(arg0).json();
+        return addHeapObject(ret);
+    }, arguments) };
+    imports.wbg.__wbg_parentNode_e1c214fc3f362af0 = function(arg0) {
         const ret = getObject(arg0).parentNode;
         return isLikeNone(ret) ? 0 : addHeapObject(ret);
     };
-    imports.wbg.__wbg_parentElement_c75962bc9997ea5f = function(arg0) {
+    imports.wbg.__wbg_parentElement_592cb54944d3d002 = function(arg0) {
         const ret = getObject(arg0).parentElement;
         return isLikeNone(ret) ? 0 : addHeapObject(ret);
     };
-    imports.wbg.__wbg_lastChild_0cee692010bac6c2 = function(arg0) {
+    imports.wbg.__wbg_lastChild_b17b3c7498d25bd7 = function(arg0) {
         const ret = getObject(arg0).lastChild;
         return isLikeNone(ret) ? 0 : addHeapObject(ret);
     };
-    imports.wbg.__wbg_nextSibling_304d9aac7c2774ae = function(arg0) {
+    imports.wbg.__wbg_nextSibling_d029031876ed1b1b = function(arg0) {
         const ret = getObject(arg0).nextSibling;
         return isLikeNone(ret) ? 0 : addHeapObject(ret);
     };
-    imports.wbg.__wbg_setnodeValue_d1c8382910b45e04 = function(arg0, arg1, arg2) {
+    imports.wbg.__wbg_setnodeValue_321840a6762ab272 = function(arg0, arg1, arg2) {
         getObject(arg0).nodeValue = arg1 === 0 ? undefined : getStringFromWasm0(arg1, arg2);
     };
-    imports.wbg.__wbg_textContent_c5d9e21ee03c63d4 = function(arg0, arg1) {
+    imports.wbg.__wbg_textContent_d69d000f6081b514 = function(arg0, arg1) {
         const ret = getObject(arg1).textContent;
         var ptr1 = isLikeNone(ret) ? 0 : passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
         var len1 = WASM_VECTOR_LEN;
         getInt32Memory0()[arg0 / 4 + 1] = len1;
         getInt32Memory0()[arg0 / 4 + 0] = ptr1;
     };
-    imports.wbg.__wbg_appendChild_51339d4cde00ee22 = function() { return handleError(function (arg0, arg1) {
+    imports.wbg.__wbg_appendChild_2e6a6c9d1f0d443d = function() { return handleError(function (arg0, arg1) {
         const ret = getObject(arg0).appendChild(getObject(arg1));
         return addHeapObject(ret);
     }, arguments) };
-    imports.wbg.__wbg_insertBefore_ffa01d4b747c95fc = function() { return handleError(function (arg0, arg1, arg2) {
+    imports.wbg.__wbg_insertBefore_bdaeec8969497673 = function() { return handleError(function (arg0, arg1, arg2) {
         const ret = getObject(arg0).insertBefore(getObject(arg1), getObject(arg2));
         return addHeapObject(ret);
     }, arguments) };
-    imports.wbg.__wbg_removeChild_973429f368206138 = function() { return handleError(function (arg0, arg1) {
+    imports.wbg.__wbg_removeChild_a63022ebbfa6ebf5 = function() { return handleError(function (arg0, arg1) {
         const ret = getObject(arg0).removeChild(getObject(arg1));
         return addHeapObject(ret);
     }, arguments) };
-    imports.wbg.__wbg_instanceof_HtmlInputElement_31b50e0cf542c524 = function(arg0) {
+    imports.wbg.__wbg_instanceof_ShadowRoot_f85f709c953844de = function(arg0) {
         let result;
         try {
-            result = getObject(arg0) instanceof HTMLInputElement;
-        } catch {
+            result = getObject(arg0) instanceof ShadowRoot;
+        } catch (_) {
             result = false;
         }
         const ret = result;
         return ret;
     };
-    imports.wbg.__wbg_checked_5ccb3a66eb054121 = function(arg0) {
+    imports.wbg.__wbg_host_73c8e95bf9b31ccd = function(arg0) {
+        const ret = getObject(arg0).host;
+        return addHeapObject(ret);
+    };
+    imports.wbg.__wbg_getClientExtensionResults_d4b9b581db88e947 = function(arg0) {
+        const ret = getObject(arg0).getClientExtensionResults();
+        return addHeapObject(ret);
+    };
+    imports.wbg.__wbg_log_7811587c4c6d2844 = function(arg0) {
+        console.log(getObject(arg0));
+    };
+    imports.wbg.__wbg_add_dc5c00591ed65268 = function() { return handleError(function (arg0, arg1, arg2) {
+        getObject(arg0).add(getStringFromWasm0(arg1, arg2));
+    }, arguments) };
+    imports.wbg.__wbg_remove_9517d3139a6031f1 = function() { return handleError(function (arg0, arg1, arg2) {
+        getObject(arg0).remove(getStringFromWasm0(arg1, arg2));
+    }, arguments) };
+    imports.wbg.__wbg_href_7f944b48b612250e = function(arg0, arg1) {
+        const ret = getObject(arg1).href;
+        const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len1 = WASM_VECTOR_LEN;
+        getInt32Memory0()[arg0 / 4 + 1] = len1;
+        getInt32Memory0()[arg0 / 4 + 0] = ptr1;
+    };
+    imports.wbg.__wbg_pathname_a83d8f2ebefa6791 = function(arg0, arg1) {
+        const ret = getObject(arg1).pathname;
+        const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len1 = WASM_VECTOR_LEN;
+        getInt32Memory0()[arg0 / 4 + 1] = len1;
+        getInt32Memory0()[arg0 / 4 + 0] = ptr1;
+    };
+    imports.wbg.__wbg_search_8c5f74fa2d11377e = function(arg0, arg1) {
+        const ret = getObject(arg1).search;
+        const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len1 = WASM_VECTOR_LEN;
+        getInt32Memory0()[arg0 / 4 + 1] = len1;
+        getInt32Memory0()[arg0 / 4 + 0] = ptr1;
+    };
+    imports.wbg.__wbg_hash_f468e7d38a21a76a = function(arg0, arg1) {
+        const ret = getObject(arg1).hash;
+        const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len1 = WASM_VECTOR_LEN;
+        getInt32Memory0()[arg0 / 4 + 1] = len1;
+        getInt32Memory0()[arg0 / 4 + 0] = ptr1;
+    };
+    imports.wbg.__wbg_sethash_7c3032584865b2bd = function(arg0, arg1, arg2) {
+        getObject(arg0).hash = getStringFromWasm0(arg1, arg2);
+    };
+    imports.wbg.__wbg_new_d7cd05d9de7d4000 = function() { return handleError(function (arg0, arg1) {
+        const ret = new URL(getStringFromWasm0(arg0, arg1));
+        return addHeapObject(ret);
+    }, arguments) };
+    imports.wbg.__wbg_newwithbase_604e8dfd42d25665 = function() { return handleError(function (arg0, arg1, arg2, arg3) {
+        const ret = new URL(getStringFromWasm0(arg0, arg1), getStringFromWasm0(arg2, arg3));
+        return addHeapObject(ret);
+    }, arguments) };
+    imports.wbg.__wbg_instanceof_HtmlInputElement_8f81a6600ceb1918 = function(arg0) {
+        let result;
+        try {
+            result = getObject(arg0) instanceof HTMLInputElement;
+        } catch (_) {
+            result = false;
+        }
+        const ret = result;
+        return ret;
+    };
+    imports.wbg.__wbg_checked_1ce2f33e2ed42870 = function(arg0) {
         const ret = getObject(arg0).checked;
         return ret;
     };
-    imports.wbg.__wbg_setchecked_e5a50baea447b8a8 = function(arg0, arg1) {
+    imports.wbg.__wbg_setchecked_5757666239434ecd = function(arg0, arg1) {
         getObject(arg0).checked = arg1 !== 0;
     };
-    imports.wbg.__wbg_value_9423da9d988ee8cf = function(arg0, arg1) {
+    imports.wbg.__wbg_value_5e860795f53217cd = function(arg0, arg1) {
         const ret = getObject(arg1).value;
         const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
         const len1 = WASM_VECTOR_LEN;
         getInt32Memory0()[arg0 / 4 + 1] = len1;
         getInt32Memory0()[arg0 / 4 + 0] = ptr1;
     };
-    imports.wbg.__wbg_setvalue_1f95e61cbc382f7f = function(arg0, arg1, arg2) {
+    imports.wbg.__wbg_setvalue_7d187f6cc23d8192 = function(arg0, arg1, arg2) {
         getObject(arg0).value = getStringFromWasm0(arg1, arg2);
     };
-    imports.wbg.__wbg_get_44be0491f933a435 = function(arg0, arg1) {
+    imports.wbg.__wbg_bubbles_c27af65192eb3569 = function(arg0) {
+        const ret = getObject(arg0).bubbles;
+        return ret;
+    };
+    imports.wbg.__wbg_cancelBubble_ee3f70328e901584 = function(arg0) {
+        const ret = getObject(arg0).cancelBubble;
+        return ret;
+    };
+    imports.wbg.__wbg_composedPath_ee37eece046b69a2 = function(arg0) {
+        const ret = getObject(arg0).composedPath();
+        return addHeapObject(ret);
+    };
+    imports.wbg.__wbg_preventDefault_9299867e06da6909 = function(arg0) {
+        getObject(arg0).preventDefault();
+    };
+    imports.wbg.__wbg_get_9470c6584bbde430 = function() { return handleError(function (arg0, arg1, arg2, arg3) {
+        const ret = getObject(arg1).get(getStringFromWasm0(arg2, arg3));
+        var ptr1 = isLikeNone(ret) ? 0 : passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        var len1 = WASM_VECTOR_LEN;
+        getInt32Memory0()[arg0 / 4 + 1] = len1;
+        getInt32Memory0()[arg0 / 4 + 0] = ptr1;
+    }, arguments) };
+    imports.wbg.__wbg_set_2912c891505cbc22 = function() { return handleError(function (arg0, arg1, arg2, arg3, arg4) {
+        getObject(arg0).set(getStringFromWasm0(arg1, arg2), getStringFromWasm0(arg3, arg4));
+    }, arguments) };
+    imports.wbg.__wbg_href_2777cc28ba3aac82 = function(arg0, arg1) {
+        const ret = getObject(arg1).href;
+        const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len1 = WASM_VECTOR_LEN;
+        getInt32Memory0()[arg0 / 4 + 1] = len1;
+        getInt32Memory0()[arg0 / 4 + 0] = ptr1;
+    };
+    imports.wbg.__wbg_value_539db729f551be3a = function(arg0, arg1) {
+        const ret = getObject(arg1).value;
+        const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len1 = WASM_VECTOR_LEN;
+        getInt32Memory0()[arg0 / 4 + 1] = len1;
+        getInt32Memory0()[arg0 / 4 + 0] = ptr1;
+    };
+    imports.wbg.__wbg_setvalue_15231c60278dee22 = function(arg0, arg1, arg2) {
+        getObject(arg0).value = getStringFromWasm0(arg1, arg2);
+    };
+    imports.wbg.__wbg_get_4a9aa5157afeb382 = function(arg0, arg1) {
         const ret = getObject(arg0)[arg1 >>> 0];
         return addHeapObject(ret);
     };
-    imports.wbg.__wbg_length_fff51ee6522a1a18 = function(arg0) {
+    imports.wbg.__wbg_length_cace2e0b3ddc0502 = function(arg0) {
         const ret = getObject(arg0).length;
         return ret;
     };
-    imports.wbg.__wbg_new_898a68150f225f2e = function() {
+    imports.wbg.__wbg_new_08236689f0afb357 = function() {
         const ret = new Array();
         return addHeapObject(ret);
     };
-    imports.wbg.__wbindgen_is_function = function(arg0) {
-        const ret = typeof(getObject(arg0)) === 'function';
-        return ret;
-    };
-    imports.wbg.__wbg_newnoargs_581967eacc0e2604 = function(arg0, arg1) {
+    imports.wbg.__wbg_newnoargs_ccdcae30fd002262 = function(arg0, arg1) {
         const ret = new Function(getStringFromWasm0(arg0, arg1));
         return addHeapObject(ret);
     };
-    imports.wbg.__wbg_next_526fc47e980da008 = function(arg0) {
+    imports.wbg.__wbg_next_15da6a3df9290720 = function(arg0) {
         const ret = getObject(arg0).next;
         return addHeapObject(ret);
     };
-    imports.wbg.__wbg_next_ddb3312ca1c4e32a = function() { return handleError(function (arg0) {
+    imports.wbg.__wbg_next_1989a20442400aaa = function() { return handleError(function (arg0) {
         const ret = getObject(arg0).next();
         return addHeapObject(ret);
     }, arguments) };
-    imports.wbg.__wbg_done_5c1f01fb660d73b5 = function(arg0) {
+    imports.wbg.__wbg_done_bc26bf4ada718266 = function(arg0) {
         const ret = getObject(arg0).done;
         return ret;
     };
-    imports.wbg.__wbg_value_1695675138684bd5 = function(arg0) {
+    imports.wbg.__wbg_value_0570714ff7d75f35 = function(arg0) {
         const ret = getObject(arg0).value;
         return addHeapObject(ret);
     };
-    imports.wbg.__wbg_iterator_97f0c81209c6c35a = function() {
+    imports.wbg.__wbg_iterator_7ee1a391d310f8e4 = function() {
         const ret = Symbol.iterator;
         return addHeapObject(ret);
     };
-    imports.wbg.__wbg_get_97b561fb56f034b5 = function() { return handleError(function (arg0, arg1) {
+    imports.wbg.__wbg_get_2aff440840bb6202 = function() { return handleError(function (arg0, arg1) {
         const ret = Reflect.get(getObject(arg0), getObject(arg1));
         return addHeapObject(ret);
     }, arguments) };
-    imports.wbg.__wbg_call_cb65541d95d71282 = function() { return handleError(function (arg0, arg1) {
+    imports.wbg.__wbg_call_669127b9d730c650 = function() { return handleError(function (arg0, arg1) {
         const ret = getObject(arg0).call(getObject(arg1));
         return addHeapObject(ret);
     }, arguments) };
-    imports.wbg.__wbg_new_b51585de1b234aff = function() {
+    imports.wbg.__wbg_new_c728d68b8b34487e = function() {
         const ret = new Object();
         return addHeapObject(ret);
     };
-    imports.wbg.__wbg_self_1ff1d729e9aae938 = function() { return handleError(function () {
+    imports.wbg.__wbg_self_3fad056edded10bd = function() { return handleError(function () {
         const ret = self.self;
         return addHeapObject(ret);
     }, arguments) };
-    imports.wbg.__wbg_window_5f4faef6c12b79ec = function() { return handleError(function () {
+    imports.wbg.__wbg_window_a4f46c98a61d4089 = function() { return handleError(function () {
         const ret = window.window;
         return addHeapObject(ret);
     }, arguments) };
-    imports.wbg.__wbg_globalThis_1d39714405582d3c = function() { return handleError(function () {
+    imports.wbg.__wbg_globalThis_17eff828815f7d84 = function() { return handleError(function () {
         const ret = globalThis.globalThis;
         return addHeapObject(ret);
     }, arguments) };
-    imports.wbg.__wbg_global_651f05c6a0944d1c = function() { return handleError(function () {
+    imports.wbg.__wbg_global_46f939f6541643c5 = function() { return handleError(function () {
         const ret = global.global;
         return addHeapObject(ret);
     }, arguments) };
-    imports.wbg.__wbg_set_502d29070ea18557 = function(arg0, arg1, arg2) {
+    imports.wbg.__wbg_set_0ac78a2bc07da03c = function(arg0, arg1, arg2) {
         getObject(arg0)[arg1 >>> 0] = takeObject(arg2);
     };
-    imports.wbg.__wbg_from_d7c216d4616bb368 = function(arg0) {
+    imports.wbg.__wbg_from_ba72c50feaf1d8c0 = function(arg0) {
         const ret = Array.from(getObject(arg0));
         return addHeapObject(ret);
     };
-    imports.wbg.__wbg_isArray_4c24b343cb13cfb1 = function(arg0) {
+    imports.wbg.__wbg_isArray_38525be7442aa21e = function(arg0) {
         const ret = Array.isArray(getObject(arg0));
         return ret;
     };
-    imports.wbg.__wbg_push_ca1c26067ef907ac = function(arg0, arg1) {
+    imports.wbg.__wbg_push_fd3233d09cf81821 = function(arg0, arg1) {
         const ret = getObject(arg0).push(getObject(arg1));
         return ret;
     };
-    imports.wbg.__wbg_instanceof_ArrayBuffer_39ac22089b74fddb = function(arg0) {
+    imports.wbg.__wbg_instanceof_ArrayBuffer_c7cc317e5c29cc0d = function(arg0) {
         let result;
         try {
             result = getObject(arg0) instanceof ArrayBuffer;
-        } catch {
+        } catch (_) {
             result = false;
         }
         const ret = result;
         return ret;
     };
-    imports.wbg.__wbg_instanceof_Error_ab19e20608ea43c7 = function(arg0) {
+    imports.wbg.__wbg_instanceof_Error_9f5881c3c4149389 = function(arg0) {
         let result;
         try {
             result = getObject(arg0) instanceof Error;
-        } catch {
+        } catch (_) {
             result = false;
         }
         const ret = result;
         return ret;
     };
-    imports.wbg.__wbg_message_48bacc5ea57d74ee = function(arg0) {
+    imports.wbg.__wbg_message_35f9b952e1b922e2 = function(arg0) {
         const ret = getObject(arg0).message;
         return addHeapObject(ret);
     };
-    imports.wbg.__wbg_name_8f734cbbd6194153 = function(arg0) {
+    imports.wbg.__wbg_name_e1152a59269f79e5 = function(arg0) {
         const ret = getObject(arg0).name;
         return addHeapObject(ret);
     };
-    imports.wbg.__wbg_toString_1c056108b87ba68b = function(arg0) {
+    imports.wbg.__wbg_toString_d0cefe4046ecb265 = function(arg0) {
         const ret = getObject(arg0).toString();
         return addHeapObject(ret);
     };
-    imports.wbg.__wbg_isSafeInteger_bb8e18dd21c97288 = function(arg0) {
+    imports.wbg.__wbg_isSafeInteger_c38b0a16d0c7cef7 = function(arg0) {
         const ret = Number.isSafeInteger(getObject(arg0));
         return ret;
     };
-    imports.wbg.__wbg_entries_e51f29c7bba0c054 = function(arg0) {
+    imports.wbg.__wbg_entries_6d727b73ee02b7ce = function(arg0) {
         const ret = Object.entries(getObject(arg0));
         return addHeapObject(ret);
     };
-    imports.wbg.__wbg_is_205d914af04a8faa = function(arg0, arg1) {
+    imports.wbg.__wbg_is_c74aa9bb973d6109 = function(arg0, arg1) {
         const ret = Object.is(getObject(arg0), getObject(arg1));
         return ret;
     };
-    imports.wbg.__wbg_resolve_53698b95aaf7fcf8 = function(arg0) {
+    imports.wbg.__wbg_resolve_a3252b2860f0a09e = function(arg0) {
         const ret = Promise.resolve(getObject(arg0));
         return addHeapObject(ret);
     };
-    imports.wbg.__wbg_then_f7e06ee3c11698eb = function(arg0, arg1) {
+    imports.wbg.__wbg_then_89e1c559530b85cf = function(arg0, arg1) {
         const ret = getObject(arg0).then(getObject(arg1));
         return addHeapObject(ret);
     };
-    imports.wbg.__wbg_then_b2267541e2a73865 = function(arg0, arg1, arg2) {
+    imports.wbg.__wbg_then_1bbc9edafd859b06 = function(arg0, arg1, arg2) {
         const ret = getObject(arg0).then(getObject(arg1), getObject(arg2));
         return addHeapObject(ret);
     };
-    imports.wbg.__wbg_buffer_085ec1f694018c4f = function(arg0) {
+    imports.wbg.__wbg_buffer_344d9b41efe96da7 = function(arg0) {
         const ret = getObject(arg0).buffer;
         return addHeapObject(ret);
     };
-    imports.wbg.__wbg_newwithbyteoffsetandlength_6da8e527659b86aa = function(arg0, arg1, arg2) {
+    imports.wbg.__wbg_newwithbyteoffsetandlength_2dc04d99088b15e3 = function(arg0, arg1, arg2) {
         const ret = new Uint8Array(getObject(arg0), arg1 >>> 0, arg2 >>> 0);
         return addHeapObject(ret);
     };
-    imports.wbg.__wbg_new_8125e318e6245eed = function(arg0) {
+    imports.wbg.__wbg_new_d8a000788389a31e = function(arg0) {
         const ret = new Uint8Array(getObject(arg0));
         return addHeapObject(ret);
     };
-    imports.wbg.__wbg_set_5cf90238115182c3 = function(arg0, arg1, arg2) {
+    imports.wbg.__wbg_set_dcfd613a3420f908 = function(arg0, arg1, arg2) {
         getObject(arg0).set(getObject(arg1), arg2 >>> 0);
     };
-    imports.wbg.__wbg_length_72e2208bbc0efc61 = function(arg0) {
+    imports.wbg.__wbg_length_a5587d6cd79ab197 = function(arg0) {
         const ret = getObject(arg0).length;
         return ret;
     };
-    imports.wbg.__wbg_instanceof_Uint8Array_d8d9cb2b8e8ac1d4 = function(arg0) {
+    imports.wbg.__wbg_instanceof_Uint8Array_19e6f142a5e7e1e1 = function(arg0) {
         let result;
         try {
             result = getObject(arg0) instanceof Uint8Array;
-        } catch {
+        } catch (_) {
             result = false;
         }
         const ret = result;
         return ret;
     };
-    imports.wbg.__wbg_set_092e06b0f9d71865 = function() { return handleError(function (arg0, arg1, arg2) {
+    imports.wbg.__wbg_set_40f7786a25a9cc7e = function() { return handleError(function (arg0, arg1, arg2) {
         const ret = Reflect.set(getObject(arg0), getObject(arg1), getObject(arg2));
         return ret;
     }, arguments) };
@@ -1075,16 +1082,16 @@ function __wbg_get_imports() {
         const ret = wasm.memory;
         return addHeapObject(ret);
     };
-    imports.wbg.__wbindgen_closure_wrapper1389 = function(arg0, arg1, arg2) {
-        const ret = makeMutClosure(arg0, arg1, 492, __wbg_adapter_48);
+    imports.wbg.__wbindgen_closure_wrapper1410 = function(arg0, arg1, arg2) {
+        const ret = makeMutClosure(arg0, arg1, 503, __wbg_adapter_48);
         return addHeapObject(ret);
     };
-    imports.wbg.__wbindgen_closure_wrapper1772 = function(arg0, arg1, arg2) {
-        const ret = makeMutClosure(arg0, arg1, 634, __wbg_adapter_51);
+    imports.wbg.__wbindgen_closure_wrapper1773 = function(arg0, arg1, arg2) {
+        const ret = makeMutClosure(arg0, arg1, 632, __wbg_adapter_51);
         return addHeapObject(ret);
     };
     imports.wbg.__wbindgen_closure_wrapper1855 = function(arg0, arg1, arg2) {
-        const ret = makeMutClosure(arg0, arg1, 671, __wbg_adapter_54);
+        const ret = makeMutClosure(arg0, arg1, 663, __wbg_adapter_54);
         return addHeapObject(ret);
     };
 

server/web_ui/user/pkg/LICENSE.md

@@ -1,327 +0,0 @@
-# Mozilla Public License Version 2.0
-
-1. Definitions
-
----
-
-1.1. "Contributor" means each individual or legal entity that creates, contributes to the creation
-of, or owns Covered Software.
-
-1.2. "Contributor Version" means the combination of the Contributions of others (if any) used by a
-Contributor and that particular Contributor's Contribution.
-
-1.3. "Contribution" means Covered Software of a particular Contributor.
-
-1.4. "Covered Software" means Source Code Form to which the initial Contributor has attached the
-notice in Exhibit A, the Executable Form of such Source Code Form, and Modifications of such Source
-Code Form, in each case including portions thereof.
-
-1.5. "Incompatible With Secondary Licenses" means
-
-    (a) that the initial Contributor has attached the notice described
-        in Exhibit B to the Covered Software; or
-
-    (b) that the Covered Software was made available under the terms of
-        version 1.1 or earlier of the License, but not also under the
-        terms of a Secondary License.
-
-1.6. "Executable Form" means any form of the work other than Source Code Form.
-
-1.7. "Larger Work" means a work that combines Covered Software with other material, in a separate
-file or files, that is not Covered Software.
-
-1.8. "License" means this document.
-
-1.9. "Licensable" means having the right to grant, to the maximum extent possible, whether at the
-time of the initial grant or subsequently, any and all of the rights conveyed by this License.
-
-1.10. "Modifications" means any of the following:
-
-    (a) any file in Source Code Form that results from an addition to,
-        deletion from, or modification of the contents of Covered
-        Software; or
-
-    (b) any new file in Source Code Form that contains any Covered
-        Software.
-
-1.11. "Patent Claims" of a Contributor means any patent claim(s), including without limitation,
-method, process, and apparatus claims, in any patent Licensable by such Contributor that would be
-infringed, but for the grant of the License, by the making, using, selling, offering for sale,
-having made, import, or transfer of either its Contributions or its Contributor Version.
-
-1.12. "Secondary License" means either the GNU General Public License, Version 2.0, the GNU Lesser
-General Public License, Version 2.1, the GNU Affero General Public License, Version 3.0, or any
-later versions of those licenses.
-
-1.13. "Source Code Form" means the form of the work preferred for making modifications.
-
-1.14. "You" (or "Your") means an individual or a legal entity exercising rights under this License.
-For legal entities, "You" includes any entity that controls, is controlled by, or is under common
-control with You. For purposes of this definition, "control" means (a) the power, direct or
-indirect, to cause the direction or management of such entity, whether by contract or otherwise, or
-(b) ownership of more than fifty percent (50%) of the outstanding shares or beneficial ownership of
-such entity.
-
-2. License Grants and Conditions
-
----
-
-2.1. Grants
-
-Each Contributor hereby grants You a world-wide, royalty-free, non-exclusive license:
-
-(a) under intellectual property rights (other than patent or trademark) Licensable by such
-Contributor to use, reproduce, make available, modify, display, perform, distribute, and otherwise
-exploit its Contributions, either on an unmodified basis, with Modifications, or as part of a Larger
-Work; and
-
-(b) under Patent Claims of such Contributor to make, use, sell, offer for sale, have made, import,
-and otherwise transfer either its Contributions or its Contributor Version.
-
-2.2. Effective Date
-
-The licenses granted in Section 2.1 with respect to any Contribution become effective for each
-Contribution on the date the Contributor first distributes such Contribution.
-
-2.3. Limitations on Grant Scope
-
-The licenses granted in this Section 2 are the only rights granted under this License. No additional
-rights or licenses will be implied from the distribution or licensing of Covered Software under this
-License. Notwithstanding Section 2.1(b) above, no patent license is granted by a Contributor:
-
-(a) for any code that a Contributor has removed from Covered Software; or
-
-(b) for infringements caused by: (i) Your and any other third party's modifications of Covered
-Software, or (ii) the combination of its Contributions with other software (except as part of its
-Contributor Version); or
-
-(c) under Patent Claims infringed by Covered Software in the absence of its Contributions.
-
-This License does not grant any rights in the trademarks, service marks, or logos of any Contributor
-(except as may be necessary to comply with the notice requirements in Section 3.4).
-
-2.4. Subsequent Licenses
-
-No Contributor makes additional grants as a result of Your choice to distribute the Covered Software
-under a subsequent version of this License (see Section 10.2) or under the terms of a Secondary
-License (if permitted under the terms of Section 3.3).
-
-2.5. Representation
-
-Each Contributor represents that the Contributor believes its Contributions are its original
-creation(s) or it has sufficient rights to grant the rights to its Contributions conveyed by this
-License.
-
-2.6. Fair Use
-
-This License is not intended to limit any rights You have under applicable copyright doctrines of
-fair use, fair dealing, or other equivalents.
-
-2.7. Conditions
-
-Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted in Section 2.1.
-
-3. Responsibilities
-
----
-
-3.1. Distribution of Source Form
-
-All distribution of Covered Software in Source Code Form, including any Modifications that You
-create or to which You contribute, must be under the terms of this License. You must inform
-recipients that the Source Code Form of the Covered Software is governed by the terms of this
-License, and how they can obtain a copy of this License. You may not attempt to alter or restrict
-the recipients' rights in the Source Code Form.
-
-3.2. Distribution of Executable Form
-
-If You distribute Covered Software in Executable Form then:
-
-(a) such Covered Software must also be made available in Source Code Form, as described in Section
-3.1, and You must inform recipients of the Executable Form how they can obtain a copy of such Source
-Code Form by reasonable means in a timely manner, at a charge no more than the cost of distribution
-to the recipient; and
-
-(b) You may distribute such Executable Form under the terms of this License, or sublicense it under
-different terms, provided that the license for the Executable Form does not attempt to limit or
-alter the recipients' rights in the Source Code Form under this License.
-
-3.3. Distribution of a Larger Work
-
-You may create and distribute a Larger Work under terms of Your choice, provided that You also
-comply with the requirements of this License for the Covered Software. If the Larger Work is a
-combination of Covered Software with a work governed by one or more Secondary Licenses, and the
-Covered Software is not Incompatible With Secondary Licenses, this License permits You to
-additionally distribute such Covered Software under the terms of such Secondary License(s), so that
-the recipient of the Larger Work may, at their option, further distribute the Covered Software under
-the terms of either this License or such Secondary License(s).
-
-3.4. Notices
-
-You may not remove or alter the substance of any license notices (including copyright notices,
-patent notices, disclaimers of warranty, or limitations of liability) contained within the Source
-Code Form of the Covered Software, except that You may alter any license notices to the extent
-required to remedy known factual inaccuracies.
-
-3.5. Application of Additional Terms
-
-You may choose to offer, and to charge a fee for, warranty, support, indemnity or liability
-obligations to one or more recipients of Covered Software. However, You may do so only on Your own
-behalf, and not on behalf of any Contributor. You must make it absolutely clear that any such
-warranty, support, indemnity, or liability obligation is offered by You alone, and You hereby agree
-to indemnify every Contributor for any liability incurred by such Contributor as a result of
-warranty, support, indemnity or liability terms You offer. You may include additional disclaimers of
-warranty and limitations of liability specific to any jurisdiction.
-
-4. Inability to Comply Due to Statute or Regulation
-
----
-
-If it is impossible for You to comply with any of the terms of this License with respect to some or
-all of the Covered Software due to statute, judicial order, or regulation then You must: (a) comply
-with the terms of this License to the maximum extent possible; and (b) describe the limitations and
-the code they affect. Such description must be placed in a text file included with all distributions
-of the Covered Software under this License. Except to the extent prohibited by statute or
-regulation, such description must be sufficiently detailed for a recipient of ordinary skill to be
-able to understand it.
-
-5. Termination
-
----
-
-5.1. The rights granted under this License will terminate automatically if You fail to comply with
-any of its terms. However, if You become compliant, then the rights granted under this License from
-a particular Contributor are reinstated (a) provisionally, unless and until such Contributor
-explicitly and finally terminates Your grants, and (b) on an ongoing basis, if such Contributor
-fails to notify You of the non-compliance by some reasonable means prior to 60 days after You have
-come back into compliance. Moreover, Your grants from a particular Contributor are reinstated on an
-ongoing basis if such Contributor notifies You of the non-compliance by some reasonable means, this
-is the first time You have received notice of non-compliance with this License from such
-Contributor, and You become compliant prior to 30 days after Your receipt of the notice.
-
-5.2. If You initiate litigation against any entity by asserting a patent infringement claim
-(excluding declaratory judgment actions, counter-claims, and cross-claims) alleging that a
-Contributor Version directly or indirectly infringes any patent, then the rights granted to You by
-any and all Contributors for the Covered Software under Section 2.1 of this License shall terminate.
-
-5.3. In the event of termination under Sections 5.1 or 5.2 above, all end user license agreements
-(excluding distributors and resellers) which have been validly granted by You or Your distributors
-under this License prior to termination shall survive termination.
-
----
-
--
-  -
--
-  6. Disclaimer of Warranty *
-- ------------------------- *
--
-  -
-- Covered Software is provided under this License on an "as is" *
-- basis, without warranty of any kind, either expressed, implied, or *
-- statutory, including, without limitation, warranties that the *
-- Covered Software is free of defects, merchantable, fit for a *
-- particular purpose or non-infringing. The entire risk as to the *
-- quality and performance of the Covered Software is with You. *
-- Should any Covered Software prove defective in any respect, You *
-- (not any Contributor) assume the cost of any necessary servicing, *
-- repair, or correction. This disclaimer of warranty constitutes an *
-- essential part of this License. No use of any Covered Software is *
-- authorized under this License except under this disclaimer. *
--
-  -
-
----
-
----
-
--
-  -
--
-  7. Limitation of Liability *
-- -------------------------- *
--
-  -
-- Under no circumstances and under no legal theory, whether tort *
-- (including negligence), contract, or otherwise, shall any *
-- Contributor, or anyone who distributes Covered Software as *
-- permitted above, be liable to You for any direct, indirect, *
-- special, incidental, or consequential damages of any character *
-- including, without limitation, damages for lost profits, loss of *
-- goodwill, work stoppage, computer failure or malfunction, or any *
-- and all other commercial damages or losses, even if such party *
-- shall have been informed of the possibility of such damages. This *
-- limitation of liability shall not apply to liability for death or *
-- personal injury resulting from such party's negligence to the *
-- extent applicable law prohibits such limitation. Some *
-- jurisdictions do not allow the exclusion or limitation of *
-- incidental or consequential damages, so this exclusion and *
-- limitation may not apply to You. *
--
-  -
-
----
-
-8. Litigation
-
----
-
-Any litigation relating to this License may be brought only in the courts of a jurisdiction where
-the defendant maintains its principal place of business and such litigation shall be governed by
-laws of that jurisdiction, without reference to its conflict-of-law provisions. Nothing in this
-Section shall prevent a party's ability to bring cross-claims or counter-claims.
-
-9. Miscellaneous
-
----
-
-This License represents the complete agreement concerning the subject matter hereof. If any
-provision of this License is held to be unenforceable, such provision shall be reformed only to the
-extent necessary to make it enforceable. Any law or regulation which provides that the language of a
-contract shall be construed against the drafter shall not be used to construe this License against a
-Contributor.
-
-10. Versions of the License
-
----
-
-10.1. New Versions
-
-Mozilla Foundation is the license steward. Except as provided in Section 10.3, no one other than the
-license steward has the right to modify or publish new versions of this License. Each version will
-be given a distinguishing version number.
-
-10.2. Effect of New Versions
-
-You may distribute the Covered Software under the terms of the version of the License under which
-You originally received the Covered Software, or under the terms of any subsequent version published
-by the license steward.
-
-10.3. Modified Versions
-
-If you create software not governed by this License, and you want to create a new license for such
-software, you may create and use a modified version of this License if you rename the license and
-remove any references to the name of the license steward (except to note that such modified license
-differs from this License).
-
-10.4. Distributing Source Code Form that is Incompatible With Secondary Licenses
-
-If You choose to distribute Source Code Form that is Incompatible With Secondary Licenses under the
-terms of this version of the License, the notice described in Exhibit B of this License must be
-attached.
-
-## Exhibit A - Source Code Form License Notice
-
-This Source Code Form is subject to the terms of the Mozilla Public License, v. 2.0. If a copy of
-the MPL was not distributed with this file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-If it is not possible or desirable to put the notice in a particular file, then You may include the
-notice in a location (such as a LICENSE file in a relevant directory) where a recipient would be
-likely to look for such a notice.
-
-You may add additional accurate notices of copyright ownership.
-
-## Exhibit B - "Incompatible With Secondary Licenses" Notice
-
-This Source Code Form is "Incompatible With Secondary Licenses", as defined by the Mozilla Public
-License, v. 2.0.

server/web_ui/user/pkg/wasmloader_login_flows.js

@@ -1,14 +0,0 @@
-// loads the module which loads the WASM. It's loaders all the way down.
-import init, { run_app } from '/pkg/kanidmd_web_ui_login_flows.js';
-async function main() {
-    await init('/pkg/kanidmd_web_ui_login_flows_bg.wasm');
-    run_app();
-}
-main()
-
-// this is used in modals
-export function modal_hide_by_id(m) {
-    var elem = document.getElementById(m);
-    var modal = bootstrap.Modal.getInstance(elem);
-    modal.hide();
-};

server/web_ui/user/pkg/wasmloader_user.js

@@ -1,7 +0,0 @@
-// loads the module which loads the WASM. It's loaders all the way down.
-import init, { run_app } from '/pkg/kanidmd_web_ui_user.js';
-async function main() {
-    await init('/pkg/kanidmd_web_ui_user_bg.wasm');
-    run_app();
-}
-main()

server/web_ui/user/src/credential/reset.rs

@@ -1,7 +1,7 @@
 use gloo::console;
 use kanidm_proto::v1::{
-    CUExtPortal, CUIntentToken, CUSessionToken, CUStatus, CredentialDetail, CredentialDetailType,
-    PasskeyDetail,
+    CUCredState, CUExtPortal, CUIntentToken, CURegWarning, CUSessionToken, CUStatus,
+    CredentialDetail, CredentialDetailType, PasskeyDetail,
 };
 
 use kanidmd_web_ui_shared::constants::{CSS_ALERT_DANGER, URL_USER_HOME};
@@ -350,10 +350,11 @@ impl CredentialResetApp {
             ext_cred_portal,
             mfaregstate: _,
             can_commit,
+            warnings,
             primary,
-            primary_can_edit,
+            primary_state,
             passkeys,
-            passkeys_can_edit,
+            passkeys_state,
         } = status;
 
         let displayname = displayname.clone();
@@ -378,8 +379,41 @@ impl CredentialResetApp {
             }
         };
 
-        let pw_html = self.view_primary(token, primary, *primary_can_edit);
-        let passkey_html = self.view_passkeys(token, passkeys, *passkeys_can_edit);
+        let pw_html = self.view_primary(token, primary, *primary_state);
+        let passkey_html = self.view_passkeys(token, passkeys, *passkeys_state);
+
+        let warnings_html = if warnings.is_empty() {
+            html! { <></> }
+        } else {
+            html! {
+                <>
+                    <hr class="my-4" />
+
+                    { for warnings.iter()
+                        .map(|warning|
+                            match warning {
+                                CURegWarning::MfaRequired => html! {
+                                    <div class="alert alert-warning" role="alert">
+                                        <p>{ "MFA is required for your account. Add TOTP or remove your password in favour of Passkeys." }</p>
+                                    </div>
+                                },
+                                CURegWarning::PasskeyRequired => html! {
+                                    <div class="alert alert-warning" role="alert">
+                                        <p>{ "Passkeys are required for your account." }</p>
+                                    </div>
+                                },
+                                CURegWarning::Unsatisfiable => html! {
+                                    <div class="alert alert-danger" role="alert">
+                                        <p>{ "An account policy conflict has occured and you will not be able to save your credentials" }</p>
+                                        <p>{ "Contact support IMMEDIATELY." }</p>
+                                    </div>
+                                },
+                            }
+                        )
+                    }
+                </>
+            }
+        };
 
         html! {
         <>
@@ -397,6 +431,8 @@ impl CredentialResetApp {
 
                     { ext_cred_portal_html }
 
+                    { warnings_html }
+
                     <hr class="my-4" />
 
                     { passkey_html }
@@ -443,12 +479,12 @@ impl CredentialResetApp {
         &self,
         token: &CUSessionToken,
         primary: &Option<CredentialDetail>,
-        primary_can_edit: bool,
+        primary_state: CUCredState,
     ) -> Html {
         let cb = self.cb.clone();
 
         // match on primary, get type_.
-        let pw_html_inner = if primary_can_edit {
+        let pw_html_inner = if matches!(primary_state, CUCredState::Modifiable) {
             match primary {
                 Some(CredentialDetail {
                     uuid: _,
@@ -556,15 +592,21 @@ impl CredentialResetApp {
             html! {<></>}
         };
 
-        let pw_warn = if primary_can_edit {
-            html! {
-              <>
-                <p>{ "Legacy password paired with other authentication factors." }</p>
-                <p>{ "It is recommended you avoid setting these if possible, as these can be phished or exploited." }</p>
-              </>
+        let pw_warn = match primary_state {
+            CUCredState::Modifiable => {
+                html! {
+                  <>
+                    <p>{ "Legacy password paired with other authentication factors." }</p>
+                    <p>{ "It is recommended you avoid setting these if possible, as these can be phished or exploited." }</p>
+                  </>
+                }
+            }
+            CUCredState::AccessDeny => {
+                html! { <><p> { "You do not have access to modify the Password or TOTP tokens of this account" }</p></> }
+            }
+            CUCredState::PolicyDeny => {
+                html! { <><p> { "Account policy prevents you setting the Password or TOTP tokens of this account" }</p></> }
             }
-        } else {
-            html! { <><p> { "You do not have access to modify the Password or TOTP tokens of this account" }</p></> }
         };
 
         html! {
@@ -582,36 +624,44 @@ impl CredentialResetApp {
         &self,
         token: &CUSessionToken,
         passkeys: &Vec<PasskeyDetail>,
-        passkeys_can_edit: bool,
+        passkeys_state: CUCredState,
     ) -> Html {
         let cb = self.cb.clone();
 
-        let passkey_html_inner = if !passkeys_can_edit {
-            html! { <><p> { "You do not have access to modify the Passkeys of this account" }</p></> }
-        } else if passkeys.is_empty() {
-            html! {
-              <>
-                <p>{ "Strong cryptographic authenticators with self contained multi-factor authentication." }</p>
-                <p>{ "No Passkeys Registered" }</p>
-                <PasskeyModalApp token={ token.clone() } cb={ cb } />
-              </>
+        let passkey_html_inner = match passkeys_state {
+            CUCredState::Modifiable => {
+                if passkeys.is_empty() {
+                    html! {
+                      <>
+                        <p>{ "Strong cryptographic authenticators with self contained multi-factor authentication." }</p>
+                        <p>{ "No Passkeys Registered" }</p>
+                        <PasskeyModalApp token={ token.clone() } cb={ cb } />
+                      </>
+                    }
+                } else {
+                    html! {
+                        <>
+                        <p>{ "Strong cryptographic authenticators with self contained multi-factor authentication." }</p>
+                        { for passkeys.iter()
+                            .map(|detail|
+                                PasskeyRemoveModalApp::render_button(&detail.tag, detail.uuid)
+                            )
+                        }
+                        { for passkeys.iter()
+                            .map(|detail|
+                                html! { <PasskeyRemoveModalApp token={ token.clone() } tag={ detail.tag.clone() } uuid={ detail.uuid } cb={ cb.clone() } /> }
+                            )
+                        }
+                        <PasskeyModalApp token={ token.clone() } cb={ cb.clone() } />
+                        </>
+                    }
+                }
             }
-        } else {
-            html! {
-                <>
-                <p>{ "Strong cryptographic authenticators with self contained multi-factor authentication." }</p>
-                { for passkeys.iter()
-                    .map(|detail|
-                        PasskeyRemoveModalApp::render_button(&detail.tag, detail.uuid)
-                    )
-                }
-                { for passkeys.iter()
-                    .map(|detail|
-                        html! { <PasskeyRemoveModalApp token={ token.clone() } tag={ detail.tag.clone() } uuid={ detail.uuid } cb={ cb.clone() } /> }
-                    )
-                }
-                <PasskeyModalApp token={ token.clone() } cb={ cb.clone() } />
-                </>
+            CUCredState::AccessDeny => {
+                html! { <><p> { "You do not have access to modify the Passkeys of this account" }</p></> }
+            }
+            CUCredState::PolicyDeny => {
+                html! { <><p> { "Account policy prevents you modifying the Passkeys of this account" }</p></> }
             }
         };
 

tools/cli/src/cli/group/account_policy.rs

@@ -6,6 +6,7 @@ impl GroupAccountPolicyOpt {
         match self {
             GroupAccountPolicyOpt::Enable { copt, .. }
             | GroupAccountPolicyOpt::AuthSessionExpiry { copt, .. }
+            | GroupAccountPolicyOpt::CredentialTypeMinimum { copt, .. }
             | GroupAccountPolicyOpt::PasswordMinimumLength { copt, .. }
             | GroupAccountPolicyOpt::PrivilegedSessionExpiry { copt, .. } => copt.debug,
         }
@@ -32,6 +33,17 @@ impl GroupAccountPolicyOpt {
                     println!("Updated authsession expiry.");
                 }
             }
+            GroupAccountPolicyOpt::CredentialTypeMinimum { name, value, copt } => {
+                let client = copt.to_client(OpType::Write).await;
+                if let Err(e) = client
+                    .group_account_policy_credential_type_minimum_set(name, value)
+                    .await
+                {
+                    handle_client_error(e, copt.output_mode);
+                } else {
+                    println!("Updated credential type minimum expiry.");
+                }
+            }
             GroupAccountPolicyOpt::PasswordMinimumLength { name, length, copt } => {
                 let client = copt.to_client(OpType::Write).await;
                 if let Err(e) = client

tools/cli/src/cli/person.rs

@@ -10,7 +10,8 @@ use kanidm_proto::constants::{ATTR_ACCOUNT_EXPIRE, ATTR_ACCOUNT_VALID_FROM};
 use kanidm_proto::messages::{AccountChangeMessage, ConsoleOutputMode, MessageStatus};
 use kanidm_proto::v1::OperationError::PasswordQuality;
 use kanidm_proto::v1::{
-    CUExtPortal, CUIntentToken, CURegState, CUSessionToken, CUStatus, TotpSecret,
+    CUCredState, CUExtPortal, CUIntentToken, CURegState, CURegWarning, CUSessionToken, CUStatus,
+    TotpSecret,
 };
 use kanidm_proto::v1::{CredentialDetail, CredentialDetailType};
 use qrcode::render::unicode;
@@ -890,10 +891,11 @@ fn display_status(status: CUStatus) {
         ext_cred_portal,
         mfaregstate: _,
         can_commit,
+        warnings,
         primary,
-        primary_can_edit,
+        primary_state,
         passkeys,
-        passkeys_can_edit,
+        passkeys_state,
     } = status;
 
     println!("spn: {}", spn);
@@ -902,39 +904,66 @@ fn display_status(status: CUStatus) {
     match ext_cred_portal {
         CUExtPortal::None => {}
         CUExtPortal::Hidden => {
-            println!("Externally Managed: Contact your admin to update your account details.");
+            println!("Externally Managed: Not all features may be avaliable");
+            println!("    Contact your admin for more details.");
         }
         CUExtPortal::Some(url) => {
-            println!(
-                "Externally Managed: Visit {} to update your account details.",
-                url.as_str()
-            );
+            println!("Externally Managed: Not all features may be avaliable");
+            println!("    Visit {} to update your account details.", url.as_str());
         }
     };
 
-    println!("Primary Credential:");
-    if primary_can_edit {
-        if let Some(cred_detail) = &primary {
-            print!("{}", cred_detail);
-        } else {
-            println!("  not set");
-        }
-    } else {
-        println!("  unable to modify");
-    };
-
-    println!("Passkeys:");
-    if passkeys_can_edit {
-        if passkeys.is_empty() {
-            println!("  not set");
-        } else {
-            for pk in passkeys {
-                println!("  {} ({})", pk.tag, pk.uuid);
+    for warning in warnings {
+        print!(" ⚠️   ");
+        match warning {
+            CURegWarning::MfaRequired => {
+                println!("Multifactor authentication required - add totp, or use passkeys");
+            }
+            CURegWarning::PasskeyRequired => {
+                println!("Passkeys required");
+            }
+            CURegWarning::Unsatisfiable => {
+                println!("Account policy is unsatisfiable. Contact your administrator.");
             }
         }
-    } else {
-        println!("  unable to modify");
-    };
+    }
+
+    println!("Primary Credential:");
+
+    match primary_state {
+        CUCredState::Modifiable => {
+            if let Some(cred_detail) = &primary {
+                print!("{}", cred_detail);
+            } else {
+                println!("  not set");
+            }
+        }
+        CUCredState::AccessDeny => {
+            println!("  unable to modify - access denied");
+        }
+        CUCredState::PolicyDeny => {
+            println!("  unable to modify - account policy denied");
+        }
+    }
+
+    println!("Passkeys:");
+    match passkeys_state {
+        CUCredState::Modifiable => {
+            if passkeys.is_empty() {
+                println!("  not set");
+            } else {
+                for pk in passkeys {
+                    println!("  {} ({})", pk.tag, pk.uuid);
+                }
+            }
+        }
+        CUCredState::AccessDeny => {
+            println!("  unable to modify - access denied");
+        }
+        CUCredState::PolicyDeny => {
+            println!("  unable to modify - account policy denied");
+        }
+    }
 
     // We may need to be able to display if there are dangling
     // curegstates, but the cli ui statemachine can match the

tools/cli/src/opt/kanidm.rs

@@ -125,6 +125,14 @@ pub enum GroupAccountPolicyOpt {
         #[clap(flatten)]
         copt: CommonOpt,
     },
+    /// Set the maximum time for session expiry
+    #[clap(name = "credential-type-minimum")]
+    CredentialTypeMinimum {
+        name: String,
+        value: String,
+        #[clap(flatten)]
+        copt: CommonOpt,
+    },
     /// Set the minimum length of passwords for accounts
     #[clap(name = "password-minimum-length")]
     PasswordMinimumLength {