feat: reach an initial working stage

app/server/README.md

@@ -13,7 +13,8 @@ server
 │   ├── schema.ts: Defines the schema for the Headplane configuration.
 ├── headscale/
 │   ├── api-client.ts: Creates the HTTP client that talks to the Headscale API.
-│   ├── config.ts: Loads the Headscale configuration (if available).
+│   ├── config-loader.ts: Loads the Headscale configuration (if available).
+│   ├── config-schema.ts: Defines the schema for the Headscale configuration.
 ├── web/
 │   ├── oidc.ts: Loads and validates an OIDC configuration (if available).
 │   ├── sessions.ts: Initializes the session store and methods to manage it.

app/server/config/loader.ts

@@ -1,7 +1,7 @@
 import { constants, access, readFile } from 'node:fs/promises';
 import { env, exit } from 'node:process';
 import { type } from 'arktype';
-import dotenv, { configDotenv } from 'dotenv';
+import { configDotenv } from 'dotenv';
 import { parseDocument } from 'yaml';
 import log from '~/utils/log';
 import { EnvOverrides, envVariables } from './env';
@@ -17,7 +17,7 @@ import {
 // TODO: Potential for file watching on the configuration
 // But this may not be necessary as a use-case anyways
 export async function loadConfig({ loadEnv, path }: EnvOverrides) {
-	log.debug('config', 'Loading configuration file: %', path);
+	log.debug('config', 'Loading configuration file: %s', path);
 	const valid = await validateConfigPath(path);
 	if (!valid) {
 		exit(1);
@@ -117,7 +117,7 @@ export function validateConfig(config: unknown) {
 	log.debug('config', 'Validating Headplane configuration');
 	const result = headplaneConfig(config);
 	if (result instanceof type.errors) {
-		log.error('config', 'Error parsing Headplane configuration:');
+		log.error('config', 'Error validating Headplane configuration:');
 		for (const [number, error] of result.entries()) {
 			log.error('config', ` - (${number}): ${error.toString()}`);
 		}

app/server/headscale/api-client.ts

@@ -55,7 +55,6 @@ class ApiClient {
 
 		return await request(new URL(url, this.base), {
 			dispatcher: this.agent,
-			throwOnError: false,
 			headers: {
 				...options?.headers,
 				Accept: 'application/json',

app/server/headscale/config-loader.ts

@@ -0,0 +1,211 @@
+import { constants, access, readFile } from 'node:fs/promises';
+import { type } from 'arktype';
+import { parseDocument } from 'yaml';
+import log from '~/utils/log';
+import { headscaleConfig } from './config-schema';
+
+interface ConfigModeAvailable {
+	access: 'rw' | 'ro';
+	// TODO: More attributes
+}
+
+interface ConfigModeUnavailable {
+	access: 'no';
+}
+
+interface PatchConfig {
+	path: string;
+	value: unknown;
+}
+
+// We need a class for the config because we need to be able to
+// support retrieving it via a getter but also be able to
+// patch it and to query it for its mode
+class HeadscaleConfig {
+	private config?: typeof headscaleConfig.infer;
+	private access: 'rw' | 'ro' | 'no';
+
+	constructor(
+		access: 'rw' | 'ro' | 'no',
+		config?: typeof headscaleConfig.infer,
+	) {
+		this.access = access;
+	}
+
+	readable() {
+		return this.access !== 'no';
+	}
+
+	writable() {
+		return this.access === 'rw';
+	}
+
+	get c() {
+		return this.config;
+	}
+
+	// TODO: Implement patching
+	async patch(patches: PatchConfig[]) {
+		return;
+	}
+}
+
+export async function loadHeadscaleConfig(path?: string, strict = true) {
+	if (!path) {
+		log.debug('config', 'No Headscale configuration file was provided');
+		return new HeadscaleConfig('no');
+	}
+
+	log.debug('config', 'Loading Headscale configuration file: %s', path);
+	const { r, w } = await validateConfigPath(path);
+	if (!r) {
+		return new HeadscaleConfig('no');
+	}
+
+	const data = await loadConfigFile(path);
+	if (!data) {
+		return new HeadscaleConfig('no');
+	}
+
+	if (!strict) {
+		return new HeadscaleConfig(w ? 'rw' : 'ro', augmentUnstrictConfig(data));
+	}
+
+	const config = validateConfig(data);
+	if (!config) {
+		return new HeadscaleConfig('no');
+	}
+
+	return new HeadscaleConfig(w ? 'rw' : 'ro', config);
+}
+
+async function validateConfigPath(path: string) {
+	try {
+		await access(path, constants.F_OK | constants.R_OK);
+		log.info(
+			'config',
+			'Found a valid Headscale configuration file at %s',
+			path,
+		);
+	} catch (error) {
+		log.error(
+			'config',
+			'Unable to read a Headscale configuration file at %s',
+			path,
+		);
+		log.error('config', '%s', error);
+		return { w: false, r: false };
+	}
+
+	try {
+		await access(path, constants.F_OK | constants.W_OK);
+		return { w: true, r: true };
+	} catch (error) {
+		log.warn(
+			'config',
+			'Headscale configuration file at %s is not writable',
+			path,
+		);
+		return { w: false, r: true };
+	}
+}
+
+async function loadConfigFile(path: string): Promise<unknown> {
+	log.debug('config', 'Reading Headscale configuration file at %s', path);
+	try {
+		const data = await readFile(path, 'utf8');
+		const configYaml = parseDocument(data);
+		if (configYaml.errors.length > 0) {
+			log.error(
+				'config',
+				'Cannot parse Headscale configuration file at %s',
+				path,
+			);
+			for (const error of configYaml.errors) {
+				log.error('config', ` - ${error.toString()}`);
+			}
+
+			return false;
+		}
+
+		return configYaml.toJSON() as unknown;
+	} catch (e) {
+		log.error(
+			'config',
+			'Error reading Headscale configuration file at %s',
+			path,
+		);
+		log.error('config', '%s', e);
+		return false;
+	}
+}
+
+export function validateConfig(config: unknown) {
+	log.debug('config', 'Validating Headscale configuration');
+	const result = headscaleConfig(config);
+	if (result instanceof type.errors) {
+		log.error('config', 'Error validating Headscale configuration:');
+		for (const [number, error] of result.entries()) {
+			log.error('config', ` - (${number}): ${error.toString()}`);
+		}
+
+		return;
+	}
+
+	return result;
+}
+
+// If config_strict is false, we set the defaults and disable
+// the schema checking for the values that are not present
+function augmentUnstrictConfig(loaded: Partial<typeof headscaleConfig.infer>) {
+	log.debug('config', 'Augmenting Headscale configuration in non-strict mode');
+	const config = {
+		...loaded,
+		tls_letsencrypt_cache_dir:
+			loaded.tls_letsencrypt_cache_dir ?? '/var/www/cache',
+		tls_letsencrypt_challenge_type:
+			loaded.tls_letsencrypt_challenge_type ?? 'HTTP-01',
+		grpc_listen_addr: loaded.grpc_listen_addr ?? ':50443',
+		grpc_allow_insecure: loaded.grpc_allow_insecure ?? false,
+		randomize_client_port: loaded.randomize_client_port ?? false,
+		unix_socket: loaded.unix_socket ?? '/var/run/headscale/headscale.sock',
+		unix_socket_permission: loaded.unix_socket_permission ?? '0770',
+
+		log: loaded.log ?? {
+			level: 'info',
+			format: 'text',
+		},
+
+		logtail: loaded.logtail ?? {
+			enabled: false,
+		},
+
+		prefixes: loaded.prefixes ?? {
+			allocation: 'sequential',
+			v4: '',
+			v6: '',
+		},
+
+		dns: loaded.dns ?? {
+			nameservers: {
+				global: [],
+				split: {},
+			},
+			search_domains: [],
+			extra_records: [],
+			magic_dns: false,
+			base_domain: 'headscale.net',
+		},
+	};
+
+	log.warn('config', 'Headscale configuration was loaded in non-strict mode');
+	log.warn('config', 'This is very dangerous and comes with a few caveats:');
+	log.warn('config', '  - Headplane could very easily crash');
+	log.warn('config', '  - Headplane could break your Headscale installation');
+	log.warn(
+		'config',
+		'  - The UI could throw random errors/show incorrect data',
+	);
+
+	return config as typeof headscaleConfig.infer;
+}

app/server/headscale/config-schema.ts

@@ -0,0 +1,227 @@
+import { type } from 'arktype';
+
+const goBool = type('boolean | "true" | "false"').pipe((v) => {
+	if (v === 'true') return true;
+	if (v === 'false') return false;
+	return v;
+});
+
+const goDuration = type('0 | string').pipe((v) => {
+	return v.toString();
+});
+
+const databaseConfig = type({
+	type: '"sqlite" | "sqlite3"',
+	sqlite: {
+		path: 'string',
+		write_head_log: goBool.default(true),
+		wal_autocheckpoint: 'number = 1000',
+	},
+})
+	.or({
+		type: '"postgres"',
+		postgres: {
+			host: 'string',
+			port: 'number | ""',
+			name: 'string',
+			user: 'string',
+			pass: 'string',
+			max_open_conns: 'number = 10',
+			max_idle_conns: 'number = 10',
+			conn_max_idle_time_secs: 'number = 3600',
+			ssl: goBool.default(false),
+		},
+	})
+	.merge({
+		debug: goBool.default(false),
+		'gorm?': {
+			prepare_stmt: goBool.default(true),
+			parameterized_queries: goBool.default(true),
+			skip_err_record_not_found: goBool.default(true),
+			slow_threshold: 'number = 1000',
+		},
+	});
+
+// Not as strict parsing because we just need the values
+// to be slightly truthy enough to safely modify them
+export type HeadscaleConfig = typeof headscaleConfig.infer;
+export const headscaleConfig = type({
+	server_url: 'string',
+	listen_addr: 'string',
+	'metrics_listen_addr?': 'string',
+	grpc_listen_addr: 'string = ":50433"',
+	grpc_allow_insecure: goBool.default(false),
+	noise: {
+		private_key_path: 'string',
+	},
+	prefixes: {
+		v4: 'string',
+		v6: 'string',
+		allocation: '"sequential" | "random" = "sequential"',
+	},
+	derp: {
+		server: {
+			enabled: goBool.default(true),
+			region_id: 'number?',
+			region_code: 'string?',
+			region_name: 'string?',
+			stun_listen_addr: 'string?',
+			private_key_path: 'string?',
+			ipv4: 'string?',
+			ipv6: 'string?',
+			automatically_add_embedded_derp_region: goBool.default(true),
+		},
+		urls: 'string[]?',
+		paths: 'string[]?',
+		auto_update_enabled: goBool.default(true),
+		update_frequency: goDuration.default('24h'),
+	},
+
+	disable_check_updates: goBool.default(false),
+	ephemeral_node_inactivity_timeout: goDuration.default('30m'),
+	database: databaseConfig,
+
+	acme_url: 'string = "https://acme-v02.api.letsencrypt.org/directory"',
+	acme_email: 'string = ""',
+	tls_letsencrypt_hostname: 'string = ""',
+	tls_letsencrypt_cache_dir: 'string = "/var/lib/headscale/cache"',
+	tls_letsencrypt_challenge_type: 'string = "HTTP-01"',
+	tls_letsencrypt_listen: 'string = ":http"',
+	'tls_cert_path?': 'string',
+	'tls_key_path?': 'string',
+
+	log: type({
+		format: 'string = "text"',
+		level: 'string = "info"',
+	}).default(() => ({ format: 'text', level: 'info' })),
+
+	'policy?': {
+		mode: '"database" | "file" = "file"',
+		path: 'string?',
+	},
+
+	dns: {
+		magic_dns: goBool.default(true),
+		base_domain: 'string = "headscale.net"',
+		nameservers: type({
+			global: type('string[]').default(() => []),
+			split: type('Record<string, string[]>').default(() => ({})),
+		}).default(() => ({ global: [], split: {} })),
+		search_domains: type('string[]').default(() => []),
+		extra_records: type({
+			name: 'string',
+			value: 'string',
+			type: 'string | "A"',
+		})
+			.array()
+			.default(() => []),
+	},
+
+	unix_socket: 'string?',
+	unix_socket_permission: 'string = "0770"',
+
+	'oidc?': {
+		only_start_if_oidc_is_available: goBool.default(false),
+		issuer: 'string',
+		client_id: 'string',
+		client_secret: 'string?',
+		client_secret_path: 'string?',
+		expiry: goDuration.default('180d'),
+		use_expiry_from_token: goBool.default(false),
+		scope: type('string[]').default(() => ['openid', 'email', 'profile']),
+		extra_params: 'Record<string, string>?',
+		allowed_domains: 'string[]?',
+		allowed_groups: 'string[]?',
+		allowed_users: 'string[]?',
+		'pkce?': {
+			enabled: goBool.default(false),
+			method: 'string = "S256"',
+		},
+		map_legacy_users: goBool.default(false),
+	},
+
+	'logtail?': {
+		enabled: goBool.default(false),
+	},
+
+	randomize_client_port: goBool.default(false),
+});
+
+// export function validateConfig(config: unknown, strict: boolean) {
+// 	log.debug('CFGX', 'Validating Headscale configuration...');
+// 	const out = strict
+// 		? headscaleConfig(config)
+// 		: headscaleConfig(augmentUnstrictConfig(config as HeadscaleConfig));
+
+// 	if (out instanceof type.errors) {
+// 		log.error('CFGX', 'Error parsing Headscale configuration:');
+// 		for (const [number, error] of out.entries()) {
+// 			log.error('CFGX', ` (${number}): ${error.toString()}`);
+// 		}
+
+// 		log.error('CFGX', '');
+// 		log.error('CFGX', 'Resolve these issues and try again.');
+// 		log.error('CFGX', 'Headplane will operate without the config');
+// 		log.error('CFGX', '');
+// 		return;
+// 	}
+
+// 	log.debug('CFGX', 'Headscale configuration is valid.');
+// 	return out;
+// }
+
+// // If config_strict is false, we set the defaults and disable
+// // the schema checking for the values that are not present
+// function augmentUnstrictConfig(
+// 	loaded: Partial<HeadscaleConfig>,
+// ): HeadscaleConfig {
+// 	log.debug('CFGX', 'Loaded Headscale configuration in non-strict mode');
+// 	const config = {
+// 		...loaded,
+// 		tls_letsencrypt_cache_dir:
+// 			loaded.tls_letsencrypt_cache_dir ?? '/var/www/cache',
+// 		tls_letsencrypt_challenge_type:
+// 			loaded.tls_letsencrypt_challenge_type ?? 'HTTP-01',
+// 		grpc_listen_addr: loaded.grpc_listen_addr ?? ':50443',
+// 		grpc_allow_insecure: loaded.grpc_allow_insecure ?? false,
+// 		randomize_client_port: loaded.randomize_client_port ?? false,
+// 		unix_socket: loaded.unix_socket ?? '/var/run/headscale/headscale.sock',
+// 		unix_socket_permission: loaded.unix_socket_permission ?? '0770',
+
+// 		log: loaded.log ?? {
+// 			level: 'info',
+// 			format: 'text',
+// 		},
+
+// 		logtail: loaded.logtail ?? {
+// 			enabled: false,
+// 		},
+
+// 		prefixes: loaded.prefixes ?? {
+// 			allocation: 'sequential',
+// 			v4: '',
+// 			v6: '',
+// 		},
+
+// 		dns: loaded.dns ?? {
+// 			nameservers: {
+// 				global: [],
+// 				split: {},
+// 			},
+// 			search_domains: [],
+// 			extra_records: [],
+// 			magic_dns: false,
+// 			base_domain: 'headscale.net',
+// 		},
+// 	};
+
+// 	log.warn('CFGX', 'Loaded Headscale configuration in non-strict mode');
+// 	log.warn('CFGX', 'By using this mode you forfeit GitHub issue support');
+// 	log.warn('CFGX', 'This is very dangerous and comes with a few caveats:');
+// 	log.warn('CFGX', '  Headplane could very easily crash');
+// 	log.warn('CFGX', '  Headplane could break your Headscale installation');
+// 	log.warn('CFGX', '  The UI could throw random errors/show incorrect data');
+// 	log.warn('CFGX', '');
+
+// 	return config as HeadscaleConfig;
+// }

app/server/index.ts

@@ -4,9 +4,15 @@ import log from '~/utils/log';
 import { configureConfig, configureLogger, envVariables } from './config/env';
 import { loadConfig } from './config/loader';
 import { createApiClient } from './headscale/api-client';
-import { exampleMiddleware } from './middleware';
+import { loadHeadscaleConfig } from './headscale/config-loader';
+import { createOidcClient } from './web/oidc';
 import { createSessionStorage } from './web/sessions';
 
+declare global {
+	const __PREFIX__: string;
+	const __VERSION__: string;
+}
+
 // MARK: Side-Effects
 // This module contains a side-effect because everything running here
 // exists for the lifetime of the process, making it appropriate.
@@ -25,9 +31,13 @@ const config = await loadConfig(
 export type LoadContext = typeof appLoadContext;
 const appLoadContext = {
 	config,
+	hs: await loadHeadscaleConfig(
+		config.headscale.config_path,
+		config.headscale.config_strict,
+	),
 
 	// TODO: Better cookie options in config
-	sessionizer: createSessionStorage({
+	sessions: createSessionStorage({
 		name: '_hp_session',
 		maxAge: 60 * 60 * 24, // 24 hours
 		secure: config.server.cookie_secure,
@@ -38,6 +48,8 @@ const appLoadContext = {
 		config.headscale.url,
 		config.headscale.tls_cert_path,
 	),
+
+	oidc: config.oidc ? await createOidcClient(config.oidc) : undefined,
 };
 
 declare module 'react-router' {
@@ -46,16 +58,14 @@ declare module 'react-router' {
 
 export default await createHonoServer({
 	useWebSocket: true,
-	overrideGlobalObjects: true,
+	// overrideGlobalObjects: true,
 
 	getLoadContext(c, { build, mode }) {
 		// This is the place where we can handle reverse proxy translation
 		return appLoadContext;
 	},
 
-	configure(server) {
-		server.use('*', exampleMiddleware());
-	},
+	configure(server) {},
 	listeningListener(info) {
 		console.log(`Server is listening on http://localhost:${info.port}`);
 	},

app/server/middleware.ts

@@ -1,8 +0,0 @@
-import { createMiddleware } from 'hono/factory';
-
-export function exampleMiddleware() {
-	return createMiddleware(async (c, next) => {
-		console.log('accept-language', c.req.header('accept-language'));
-		return next();
-	});
-}

app/server/web/oidc.ts

@@ -0,0 +1,150 @@
+import { readFile } from 'node:fs/promises';
+import * as client from 'openid-client';
+import log from '~/utils/log';
+import type { HeadplaneConfig } from '../config/schema';
+
+async function loadClientSecret(path: string) {
+	// We need to interpolate environment variables into the path
+	// Path formatting can be like ${ENV_NAME}/path/to/secret
+	const matches = path.match(/\${(.*?)}/g);
+	let resolvedPath = path;
+
+	if (matches) {
+		for (const match of matches) {
+			const env = match.slice(2, -1);
+			const value = process.env[env];
+			if (!value) {
+				log.error('config', 'Environment variable %s is not set', env);
+				return;
+			}
+
+			log.debug('config', 'Interpolating %s with %s', match, value);
+			resolvedPath = resolvedPath.replace(match, value);
+		}
+	}
+
+	try {
+		log.debug('config', 'Reading client secret from %s', resolvedPath);
+		const secret = await readFile(resolvedPath, 'utf-8');
+		if (secret.trim().length === 0) {
+			log.error('config', 'Empty OIDC client secret');
+			return;
+		}
+
+		return secret;
+	} catch (error) {
+		log.error('config', 'Failed to read client secret from %s', path);
+		log.error('config', 'Error: %s', error);
+		log.debug('config', 'Error details: %o', error);
+	}
+}
+
+function clientAuthMethod(
+	method: string,
+): (secret: string) => client.ClientAuth {
+	switch (method) {
+		case 'client_secret_post':
+			return client.ClientSecretPost;
+		case 'client_secret_basic':
+			return client.ClientSecretBasic;
+		case 'client_secret_jwt':
+			return client.ClientSecretJwt;
+		default:
+			throw new Error('Invalid client authentication method');
+	}
+}
+
+// Loads and configures an OIDC client to support OIDC authentication.
+// This runs under the assumption the OIDC configuration exists and is valid.
+// If it is invalid, Headplane automatically disables it.
+//
+// TODO: Support custom endpoints instead of relying on OIDC discovery.
+// This will enable us to support servers like GitHub that do not support
+// nor advertise a .well-known endpoint.
+export async function createOidcClient(
+	config: NonNullable<HeadplaneConfig['oidc']>,
+) {
+	// const secret = await loadClientSecret(oidc);
+	const secret = config.client_secret_path
+		? await loadClientSecret(config.client_secret_path)
+		: config.client_secret;
+
+	if (!secret) {
+		log.error('config', 'Missing an OIDC client secret');
+		return;
+	}
+
+	log.debug('config', 'Running OIDC discovery for %s', config.issuer);
+	const oidc = await client.discovery(
+		new URL(config.issuer),
+		config.client_id,
+		secret,
+		clientAuthMethod(config.token_endpoint_auth_method)(secret),
+	);
+
+	const metadata = oidc.serverMetadata();
+	if (!metadata.authorization_endpoint) {
+		log.error(
+			'config',
+			'Issuer discovery did not return `authorization_endpoint`',
+		);
+		log.error('config', 'OIDC server does not support authorization code flow');
+		return;
+	}
+
+	if (!metadata.token_endpoint) {
+		log.error('config', 'Issuer discovery did not return `token_endpoint`');
+		log.error('config', 'OIDC server does not support token exchange');
+		return;
+	}
+
+	// If this field is missing, assume the server supports all response types
+	// and that we can continue safely.
+	if (metadata.response_types_supported) {
+		if (!metadata.response_types_supported.includes('code')) {
+			log.error(
+				'config',
+				'Issuer discovery `response_types_supported` does not include `code`',
+			);
+			log.error('config', 'OIDC server does not support code flow');
+			return;
+		}
+	}
+
+	if (metadata.token_endpoint_auth_methods_supported) {
+		if (
+			!metadata.token_endpoint_auth_methods_supported.includes(
+				config.token_endpoint_auth_method,
+			)
+		) {
+			log.error(
+				'config',
+				'Issuer discovery `token_endpoint_auth_methods_supported` does not include `%s`',
+				config.token_endpoint_auth_method,
+			);
+			log.error(
+				'config',
+				'OIDC server does not support %s',
+				config.token_endpoint_auth_method,
+			);
+			return;
+		}
+	}
+
+	if (!metadata.userinfo_endpoint) {
+		log.error('config', 'Issuer discovery did not return `userinfo_endpoint`');
+		log.error('config', 'OIDC server does not support userinfo endpoint');
+		return;
+	}
+
+	log.debug('config', 'OIDC client created successfully');
+	log.info('config', 'Using %s as the OIDC issuer', config.issuer);
+	log.debug(
+		'config',
+		'Authorization endpoint: %s',
+		metadata.authorization_endpoint,
+	);
+	log.debug('config', 'Token endpoint: %s', metadata.token_endpoint);
+	log.debug('config', 'Userinfo endpoint: %s', metadata.userinfo_endpoint);
+	return oidc;
+}

app/server/web/sessions.ts

@@ -1,4 +1,5 @@
 import {
+	CookieSerializeOptions,
 	Session,
 	SessionStorage,
 	createCookieSessionStorage,
@@ -16,7 +17,7 @@ export interface AuthSession {
 	};
 }
 
-interface OidcFlowSession {
+export interface OidcFlowSession {
 	state: 'flow';
 	oidc: {
 		state: string;
@@ -52,27 +53,36 @@ class Sessionizer {
 		});
 	}
 
+	// This throws on the assumption that auth is already checked correctly
+	// on something that wraps the route calling auth. The top-level routes
+	// that call this are wrapped with try/catch to handle the error.
 	async auth(request: Request) {
 		const cookie = request.headers.get('cookie');
 		const session = await this.storage.getSession(cookie);
 		const type = session.get('state');
 		if (!type) {
-			return false;
+			throw new Error('Session state not found');
 		}
 
 		if (type !== 'auth') {
-			return false;
+			throw new Error('Session is not authenticated');
 		}
 
-		return session as Session<AuthSession>;
+		return session as Session<AuthSession, Error>;
+	}
+
+	getOrCreate<T extends JoinedSession = AuthSession>(request: Request) {
+		return this.storage.getSession(request.headers.get('cookie')) as Promise<
+			Session<T, Error>
+		>;
 	}
 
 	destroy(session: Session) {
 		return this.storage.destroySession(session);
 	}
 
-	commit(session: Session) {
-		return this.storage.commitSession(session);
+	commit(session: Session, options?: CookieSerializeOptions) {
+		return this.storage.commitSession(session, options);
 	}
 }