Commit 17651a7
authored
fix(oidc): Enterprise IdP compatibility — RFC-compliant errors, auth_time, TTL, discovery (#604)
* fix(oidc): hybrid flow stores nonce instead of encrypted session for code exchange
The hybrid flow path in authorize.go stored authToken.FingerPrint (the
raw nonce) instead of authToken.FingerPrintHash (the AES-encrypted
session data) when stashing the code for /oauth/token exchange.
When /oauth/token later calls ValidateBrowserSession on sessionDataSplit[1],
it tries to AES-decrypt the value. Since the nonce is not AES-encrypted,
this always fails for hybrid flow codes.
The other two code paths (code flow at line 520 and oauth_callback at
line 331) correctly store AES-encrypted session values.
* fix(graphql): scope override uses wrong length check in signup and session
The scope override condition in signup.go and session.go checked
len(scope) (the default list, always 3) instead of len(params.Scope),
making it impossible to pass an empty scope list and retain defaults.
Fixed to match the correct pattern already used in login.go.
Added integration tests verifying that an empty Scope slice falls back
to the default scopes (openid, email, profile).
* fix: null pointer in verify_otp, vestigial nonce separator, constant-time token comparison
- verify_otp.go: change `otp == nil && err != nil` to `otp == nil` to
prevent nil pointer dereference when storage returns (nil, nil)
- token.go: only append "@@" + code to nonce when code is non-empty,
avoiding vestigial "uuid@@" in refresh_token grant flow
- revoke_refresh_token.go: use crypto/subtle.ConstantTimeCompare for
token comparison to prevent timing oracle attacks (RFC 7009)
- add integration tests for all three fixes
* fix(graphql): resend_otp uses unsanitized input for OTP lookup and wrong error message
- use sanitized email/phoneNumber locals instead of raw params.Email
and params.PhoneNumber when calling GetOTPByEmail/GetOTPByPhoneNumber
- fix SMS-disabled error message from "email service not enabled" to
"SMS service not enabled"
- add clarifying comment on the MFA/verified guard condition
- add integration tests for sanitized-email resend and SMS error message
* fix(oauth): scope parsing, safe type assertions, and JSON error handling in oauth_callback
- Fix scope parsing to use else-if so comma-delimited scopes aren't
silently overwritten by space-split; handle single-value scopes
- Convert all unsafe type assertions to safe form with ok-checking
across Facebook, LinkedIn, Twitter, Discord, and Roblox processors
- Add error checking for all json.Unmarshal calls that were silently
dropping parse failures (GitHub, Facebook, LinkedIn, Twitter, Roblox)
- Extract parseScopes helper with unit tests covering comma, space,
single-value, and mixed-delimiter inputs
* fix: phone uniqueness in admin update_user, OIDC-compliant logout redirect handling
- Remove stale TODO comment in update_user.go; phone uniqueness check
already exists at lines 198-214 with proper length validation
- Change logout handler to silently ignore invalid post_logout_redirect_uri
per OIDC RP-Initiated Logout §2 instead of returning a JSON 400 error
- Add integration test for duplicate phone number rejection via admin
_update_user mutation
- Add integration test verifying invalid redirect URI no longer produces
a JSON error response
* chore: update pkce flow and oidc
* fix(oauth): RFC-compliant PKCE, redirect_uri validation, and security hardening
- Fix S256 PKCE: tolerate base64url padding in code_challenge (Auth0 compat)
- Fix client_secret bypass: always validate when provided, even with PKCE
- Fix PKCE bypass: reject code_verifier when no code_challenge was registered
- Add redirect_uri validation at token endpoint per RFC 6749 §4.1.3
- URL-encode redirect_uri in state to prevent @@ delimiter injection
- Make authorize state removal synchronous to prevent code reuse race
- Use constant-time comparison for redirect_uri at token endpoint
- Remove code_challenge/state/nonce from authorize handler logs
- Replace leaked err.Error() with generic message in refresh token path
- Fix non-standard error codes (error_binding_json -> invalid_request)
- Fix Makefile dev target: proper multi-line RSA key handling
* docs: comprehensive OAuth2/OIDC guide with IdP vs RP, grant types, PKCE, integration examples
Covers all flows in plain English with architecture diagrams,
code examples (JS, Go, Python), Auth0 enterprise connection setup,
security considerations, and FAQ.
* fix(oidc): frontend redirect handles all response types, modes, and URL-encodes authState
Back channel fix:
- URL-encode all params in authState query string sent to login UI
(redirect_uri, scope, state, etc.) to prevent parsing corruption
Front channel fix (root cause of Auth0 "cannot read undefined 'tenant'"):
- React app now reads response_type and response_mode from URL params
- For response_type=id_token: includes id_token in redirect (was missing entirely)
- For response_type=token: includes access_token, token_type, expires_in
- For hybrid flows: includes code + relevant tokens
- Respects response_mode: uses fragment (#) for implicit flows, query (?) for code flow
- Reads params from both query string and fragment to support all response_modes
- Same-origin redirects now work (previously silently skipped)
- Proper encodeURIComponent on all redirect params
* fix(oidc): store authorization code state when session auto-detected by SDK
Root cause: when /authorize forces re-auth (prompt=login from Auth0) but
the session cookie is still valid, the React SDK auto-detects the session
via the GraphQL session query and redirects immediately — without ever
calling the login mutation. Since SetState(code, ...) only happens in
the login mutation, the code state was never stored, causing /oauth/token
to return "authorization code is invalid or has expired".
Fix:
- Add `state` field to SessionQueryRequest GraphQL schema
- Session resolver now consumes authorize state and stores code state
(same logic as login/signup/verify_otp resolvers)
- React app detects OIDC flow (code in URL) and calls session with
state param before redirecting, ensuring the code state is stored
* fix(oidc): use redirect_uri from URL params, prevent redirect loop on /app
* fix(oidc): handle forceReauth with existing session inline, use authorizer-js
Root cause of all three Auth0 failures (PKCE plain, PKCE disabled,
already-logged-in):
- /authorize with prompt=login cleared the session and sent user to
login UI, but the React SDK auto-detected the session cookie and
redirected immediately without calling the login mutation, so the
authorization code state was never stored in the backend.
Fix (authorize.go):
- When forceReauth is true but a valid session EXISTS, validate it
and proceed with the normal code flow (session rollover + code state
storage + redirect to RP) instead of sending to the login UI.
- Only falls through to login UI when the session is truly invalid.
Fix (Root.tsx):
- Use @authorizerdev/authorizer-js client instead of raw GraphQL fetch
- getSession with state param ensures code state is stored as fallback
- Simplified redirect logic, no infinite loop risk
* fix(oidc): revert forceReauth handler change, fix lives in session resolver + React app
The /authorize forceReauth change caused redirect issues. Reverted to
original behavior (prompt=login clears session, redirects to login UI).
The fix for the "already logged in" case works via:
1. Session resolver (session.go) accepts state param and stores code state
2. React app (Root.tsx) detects OIDC flow and calls getSession(state)
via authorizer-js before redirecting to RP
3. This ensures code state is stored even when SDK auto-detects session
* fix(oidc): prompt=login keeps valid session for inline code state storage
When prompt=login and a valid session cookie exists, the /authorize handler
now keeps the session instead of discarding it. The normal flow validates
the session, performs a rollover, stores the authorization code state, and
redirects directly to the RP — never hitting the login UI.
This fixes the Auth0 back-channel failures (PKCE plain, PKCE disabled,
already-logged-in) caused by the React SDK auto-detecting the session
cookie and redirecting without the login mutation ever storing the code
state.
For max_age=0 or max_age exceeded, the session IS discarded (spec
requires genuine re-authentication based on time).
* fix(oidc): simplify React app redirect — remove async getSession, redirect immediately on token
* fix(oidc): RFC-compliant errors, auth_time, TTL, discovery for Enterprise IdP compat
- Refactor validateAuthorizeRequest to return RFC 6749 error codes
(invalid_request, unauthorized_client, unsupported_response_type)
instead of freeform strings that break Auth0/Okta/Keycloak parsing
- After redirect_uri validation, redirect errors to RP via configured
response_mode instead of returning JSON (RFC 6749 §4.1.2.1)
- Add redirectErrorToRP helper for spec-compliant error redirects
supporting query, fragment, form_post, and web_message modes
- Set AuthTime (claims.IssuedAt) on all token creation paths so
id_token includes auth_time claim per OIDC Core §2 when max_age used
- Normalize token_type to "Bearer" (capitalized) in redirect params
for consistency with token endpoint and strict RP validation
- Add "none" to token_endpoint_auth_methods_supported in discovery
document for PKCE-only public clients (OIDC Core §9)
- Add Cache-Control header to discovery endpoint (public, max-age=3600)
- Add 10-minute TTL to in-memory state store entries matching Redis
provider behavior (RFC 6749 §4.1.2 authorization code expiry)
- Add TTL enforcement to DB state store provider (600s expiry)
- Fix React App.tsx scope default from string to array matching Root.tsx
- Fix React App.tsx redirectURL fallback from window.location.href
(includes query params) to window.location.origin (clean origin)
- Add debug log when response_type=token used with openid scope
- Remove duplicate response_type validation in validateAuthorizeRequest
* fix(oidc): forward nonce in authState for code flow — fixes Auth0 nonce mismatch
The nonce parameter from the RP (Auth0/Okta/Keycloak) was only appended
to authState for implicit flows, not for the code flow. This caused:
1. Auth0 sends /authorize?nonce=ABC&response_type=code
2. Authorizer stores nonce=ABC in state, redirects to /app WITHOUT nonce
3. React app logs user in, redirects back to /authorize — nonce missing
4. Second /authorize visit generates NEW nonce=XYZ (line 242 fallback)
5. Token endpoint returns id_token with nonce=XYZ
6. Auth0 expected nonce=ABC → "unexpected ID Token nonce claim value"
Fix: always append &nonce= to authState before the code/implicit branch,
so the login UI preserves and forwards the RP-provided nonce on the
second /authorize round-trip.
* fix(oidc): don't delete browser session during code exchange at /oauth/token
When the RP (Auth0/Okta/Keycloak) exchanges an authorization code at
/oauth/token, the endpoint was:
1. Deleting the user's browser session (rollover at line 288)
2. Creating a new session + setting a cookie
Both are wrong for the code exchange flow because /oauth/token is called
server-to-server by the RP, not by the user's browser. The cookie goes
to the RP (useless), and the deletion invalidates the session the user's
browser holds from /authorize — causing "record not found" on subsequent
session lookups.
Fix:
- Remove session deletion for authorization_code grant (the /authorize
endpoint already performed its own rollover)
- Only create new browser session + cookie for refresh_token grant
(where the caller IS the user's app holding the refresh token)
- Access/refresh tokens are still persisted for both grant types
(needed for introspection/revocation)
* fix(oidc): forward code_challenge, code_challenge_method, client_id through login UI
Same class of bug as the nonce loss: PKCE parameters and client_id were
not included in authState, so when the React login UI redirects back to
/authorize after authentication, these values were missing.
For PKCE (code_challenge):
1. Auth0 sends /authorize?code_challenge=ABC&code_challenge_method=S256
2. User not logged in → redirect to /app WITHOUT code_challenge
3. After login, second /authorize has empty code_challenge
4. Authorization code stored with empty challenge
5. Auth0 sends code_verifier to /oauth/token → rejected with
"code_verifier was provided but no code_challenge was registered"
For client_id:
Without forwarding, the second /authorize round-trip would have empty
client_id, failing validateAuthorizeRequest with unauthorized_client.
Fix: append code_challenge, code_challenge_method, and client_id to
authState so they survive the login UI round-trip.
Note: code_challenge is a hash (not a secret) — safe to include in URLs.
The code_verifier (the secret) is never in URLs, only in /oauth/token.
* fix(oidc): default code_challenge_method to plain per RFC 7636 §4.2
RFC 7636 §4.2 states: "If no code_challenge_method is present, the
server MUST use 'plain' as the default."
The previous code defaulted to S256, which meant when Auth0 sends a
plain-text code_challenge without specifying the method:
1. /authorize stores challenge as "challenge::S256"
2. /oauth/token SHA-256 hashes the code_verifier
3. Compares hash against the plain-text challenge → mismatch
4. "The code_verifier does not match the code_challenge"
Fixed in both authorize.go (default when storing) and token.go (default
when parsing legacy format without ::method separator).
* fix(oidc): prompt=login must delete session and force re-authentication
OIDC Core §3.1.2.1 requires prompt=login to force re-authentication
even when a valid session exists. The previous code intentionally kept
the session alive for prompt=login to avoid a redirect loop, but this
meant the user was never shown the login form — the React SDK detected
the existing cookie, auto-redirected back to /authorize, which issued
a code immediately without re-authentication.
Fix: when forceReauth is true (prompt=login or max_age=0):
1. Delete the server-side session from memory store
2. Delete the browser session cookie
3. Clear sessionToken so the handler redirects to the login UI
The prompt parameter is intentionally NOT forwarded in authState, so
the second /authorize call (after re-authentication) won't see
prompt=login and won't loop.
Flow after fix:
1. /authorize?prompt=login → delete session+cookie → redirect to /app
2. React app has no session → shows login form
3. User authenticates → login mutation creates new session
4. React redirects to /authorize (without prompt=login)
5. /authorize finds fresh session → issues code → redirects to RP
* Revert "fix(oidc): prompt=login must delete session and force re-authentication"
This reverts commit 2f88665.
* fix(oidc): CSP form-action must include full path URI for form_post mode
The form_post response mode renders an HTML page that auto-submits a
form to the RP's redirect_uri. The CSP form-action directive was only
including the origin (scheme://host), which some browsers reject when
the form action includes a path.
Fix: include both the origin and the path-level URI (without query
string, since CSP source expressions don't support query parameters)
in the form-action directive. This gives:
form-action 'self' https://rp.example.com https://rp.example.com/callback
Also reverts the prompt=login session deletion change — the previous
flow of keeping the session for prompt=login was correct since the
React SDK auto-detects the session. The real issue was this CSP block.
* chore: fix client check + frontend channel
* fix: restore client_id validation, fix tests for RFC-compliant error format
- Restore client_id check in validateAuthorizeRequest that was
accidentally removed during the duplicate response_type cleanup
- Update TestAuthorizeEndpointCompliance to check for RFC 6749 error
codes (invalid_request) instead of freeform error strings
- Update TestTokenEndpointCompliance PKCE test to use explicit ::S256
method separator (default is now plain per RFC 7636 §4.2)
- Update TestClientIDMismatchMetric to expect 200 for dashboard paths
(ClientCheckMiddleware only validates on /graphql route)
* fix: remove client_id from validateAuthorizeRequest, update test
client_id validation is not needed in validateAuthorizeRequest — it is
handled elsewhere. Update test to expect 302 redirect for invalid
client_id at /authorize instead of 400.
* docs: Enterprise OIDC IdP integration guide for Auth0/Okta/Keycloak
Comprehensive guide covering:
- Authorization code flow with PKCE (S256 and plain)
- Nonce handling for backchannel (code) flow — required by Enterprise RPs
- Response modes (query, fragment, form_post, web_message) with CSP details
- Session management during token exchange (auth_code vs refresh_token)
- Auth0, Okta, Keycloak-specific configuration and behavior
- Prompt parameter handling (login, none, consent)
- Troubleshooting common integration failures
- RFC compliance table
* security: fix 7 audit findings — atomic code exchange, CSP nonce, sync session ops
M1 — Atomic GetAndRemoveState (TOCTOU race on authorization code):
Add GetAndRemoveState to Provider interface and all 3 implementations
(in-memory, Redis via Lua EVAL, DB). Token endpoint now uses single
atomic call instead of separate GetState+RemoveState, preventing
authorization code replay under concurrent requests (RFC 6749 §4.1.2).
M2 — Document PKCE requirement for "none" auth method:
Add comment in openid_config.go explaining that "none" requires PKCE;
token endpoint rejects "none" without code_verifier.
M3 — Warning log when PKCE plain method is used:
Log debug message when code_challenge_method defaults to or is
explicitly set to "plain", noting that S256 is recommended since
plain exposes the code_verifier in URL parameters.
L1 — Replace unsafe-inline with nonce-based CSP in form_post:
setFormPostCSP now generates a crypto/rand nonce, returns it, and
sets script-src 'nonce-<value>' instead of 'unsafe-inline'. Template
uses <script nonce="..."> instead of onload attribute. Also restores
the form-action directive with origin+path (was lost in prior commit).
L3 — Synchronous old session deletion in authorize.go:
Replace async go-routine with synchronous call + error logging.
Prevents silent failures during session rollover.
L4 — Synchronous refresh token deletion in token.go:
Same pattern — synchronous with error logging for token rotation.
L5 — Addressed by L1: redirectURI param is now used for form-action CSP.
* chore: fix form actions
* security: fix 20 audit findings — timing attacks, open redirect, CSRF, enumeration
Critical:
- Use crypto/subtle.ConstantTimeCompare for token validation (auth_token.go)
- Validate redirect URI in OAuth callback against allowlist (oauth_callback.go)
- Use atomic GetAndRemoveState in consumeAuthorizeState (oauth_authorize_state.go)
High:
- Remove refresh token from URL query params in OAuth callback
- Require X-Authorizer-Client-ID header for /graphql route
- Add configurable --app-cookie-same-site flag (lax/strict/none), default lax
- Sanitize internal error messages in OAuth callback responses
Medium:
- Add dummy bcrypt on signup "user exists" path (timing equalization)
- Return generic success in resend_otp for non-existent users
- Fix unconditional "Failed" log in resend_otp
- Check delete error in DB GetAndRemoveState for replay prevention
- Fix login MFA: use isEmailLogin instead of isMobileLogin
- Return generic error in verify_otp for user not found / revoked
Low:
- Replace Redis KEYS with SCAN in DeleteAllUserSessions
- Sanitize logout error responses
- Remove client_id from debug log
- Reduce OpenID Discovery cache from 1h to 5m
* feat: add --app-cookie-same-site flag for configurable SameSite attribute
Add AppCookieSameSite config field with CLI flag --app-cookie-same-site
(values: none, lax, strict; default: none).
Default "none" preserves backward compatibility — previously SameSite=None
was hardcoded when AppCookieSecure=true. Operators can now explicitly set
"lax" or "strict" for same-origin deployments to improve CSRF protection.
* chore: check1 parent 41d533b commit 17651a7
42 files changed
Lines changed: 1720 additions & 268 deletions
File tree
- cmd
- docs
- internal
- config
- cookie
- graphql
- graph
- generated
- model
- http_handlers
- integration_tests
- memory_store
- db
- in_memory
- stores
- redis
- token
- web
- app
- src
- pages
- templates
Some content is hidden
Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
3 | 3 | | |
4 | 4 | | |
5 | 5 | | |
6 | | - | |
| 6 | + | |
7 | 7 | | |
8 | 8 | | |
9 | 9 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
1 | 1 | | |
2 | 2 | | |
3 | 3 | | |
4 | | - | |
| 4 | + | |
5 | 5 | | |
6 | 6 | | |
7 | 7 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
167 | 167 | | |
168 | 168 | | |
169 | 169 | | |
| 170 | + | |
170 | 171 | | |
171 | 172 | | |
172 | 173 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
| 1 | + | |
| 2 | + | |
| 3 | + | |
| 4 | + | |
| 5 | + | |
| 6 | + | |
| 7 | + | |
| 8 | + | |
| 9 | + | |
| 10 | + | |
| 11 | + | |
| 12 | + | |
| 13 | + | |
| 14 | + | |
| 15 | + | |
| 16 | + | |
| 17 | + | |
| 18 | + | |
| 19 | + | |
| 20 | + | |
| 21 | + | |
| 22 | + | |
| 23 | + | |
| 24 | + | |
| 25 | + | |
| 26 | + | |
| 27 | + | |
| 28 | + | |
| 29 | + | |
| 30 | + | |
| 31 | + | |
| 32 | + | |
| 33 | + | |
| 34 | + | |
| 35 | + | |
| 36 | + | |
| 37 | + | |
| 38 | + | |
| 39 | + | |
| 40 | + | |
| 41 | + | |
| 42 | + | |
| 43 | + | |
| 44 | + | |
| 45 | + | |
| 46 | + | |
| 47 | + | |
| 48 | + | |
| 49 | + | |
| 50 | + | |
| 51 | + | |
| 52 | + | |
| 53 | + | |
| 54 | + | |
| 55 | + | |
| 56 | + | |
| 57 | + | |
| 58 | + | |
| 59 | + | |
| 60 | + | |
| 61 | + | |
| 62 | + | |
| 63 | + | |
| 64 | + | |
| 65 | + | |
| 66 | + | |
| 67 | + | |
| 68 | + | |
| 69 | + | |
| 70 | + | |
| 71 | + | |
| 72 | + | |
| 73 | + | |
| 74 | + | |
| 75 | + | |
| 76 | + | |
| 77 | + | |
| 78 | + | |
| 79 | + | |
| 80 | + | |
| 81 | + | |
| 82 | + | |
| 83 | + | |
| 84 | + | |
| 85 | + | |
| 86 | + | |
| 87 | + | |
| 88 | + | |
| 89 | + | |
| 90 | + | |
| 91 | + | |
| 92 | + | |
| 93 | + | |
| 94 | + | |
| 95 | + | |
| 96 | + | |
| 97 | + | |
| 98 | + | |
| 99 | + | |
| 100 | + | |
| 101 | + | |
| 102 | + | |
| 103 | + | |
| 104 | + | |
| 105 | + | |
| 106 | + | |
| 107 | + | |
| 108 | + | |
| 109 | + | |
| 110 | + | |
| 111 | + | |
| 112 | + | |
| 113 | + | |
| 114 | + | |
| 115 | + | |
| 116 | + | |
| 117 | + | |
| 118 | + | |
| 119 | + | |
| 120 | + | |
| 121 | + | |
| 122 | + | |
| 123 | + | |
| 124 | + | |
| 125 | + | |
| 126 | + | |
| 127 | + | |
| 128 | + | |
| 129 | + | |
| 130 | + | |
| 131 | + | |
| 132 | + | |
| 133 | + | |
| 134 | + | |
| 135 | + | |
| 136 | + | |
| 137 | + | |
| 138 | + | |
| 139 | + | |
| 140 | + | |
| 141 | + | |
| 142 | + | |
| 143 | + | |
| 144 | + | |
| 145 | + | |
| 146 | + | |
| 147 | + | |
| 148 | + | |
| 149 | + | |
| 150 | + | |
| 151 | + | |
| 152 | + | |
| 153 | + | |
| 154 | + | |
| 155 | + | |
| 156 | + | |
| 157 | + | |
| 158 | + | |
| 159 | + | |
| 160 | + | |
| 161 | + | |
| 162 | + | |
| 163 | + | |
| 164 | + | |
| 165 | + | |
| 166 | + | |
| 167 | + | |
| 168 | + | |
| 169 | + | |
| 170 | + | |
| 171 | + | |
| 172 | + | |
| 173 | + | |
| 174 | + | |
| 175 | + | |
| 176 | + | |
| 177 | + | |
| 178 | + | |
| 179 | + | |
| 180 | + | |
| 181 | + | |
| 182 | + | |
| 183 | + | |
| 184 | + | |
| 185 | + | |
| 186 | + | |
| 187 | + | |
| 188 | + | |
| 189 | + | |
| 190 | + | |
| 191 | + | |
| 192 | + | |
| 193 | + | |
| 194 | + | |
| 195 | + | |
| 196 | + | |
| 197 | + | |
| 198 | + | |
| 199 | + | |
| 200 | + | |
| 201 | + | |
| 202 | + | |
| 203 | + | |
| 204 | + | |
| 205 | + | |
| 206 | + | |
| 207 | + | |
| 208 | + | |
| 209 | + | |
| 210 | + | |
| 211 | + | |
| 212 | + | |
| 213 | + | |
| 214 | + | |
| 215 | + | |
| 216 | + | |
| 217 | + | |
| 218 | + | |
| 219 | + | |
| 220 | + | |
| 221 | + | |
| 222 | + | |
| 223 | + | |
| 224 | + | |
| 225 | + | |
| 226 | + | |
| 227 | + | |
| 228 | + | |
| 229 | + | |
| 230 | + | |
| 231 | + | |
| 232 | + | |
| 233 | + | |
| 234 | + | |
| 235 | + | |
| 236 | + | |
| 237 | + | |
| 238 | + | |
| 239 | + | |
| 240 | + | |
| 241 | + | |
| 242 | + | |
| 243 | + | |
| 244 | + | |
| 245 | + | |
| 246 | + | |
| 247 | + | |
| 248 | + | |
| 249 | + | |
| 250 | + | |
| 251 | + | |
| 252 | + | |
| 253 | + | |
| 254 | + | |
| 255 | + | |
| 256 | + | |
| 257 | + | |
| 258 | + | |
| 259 | + | |
| 260 | + | |
| 261 | + | |
| 262 | + | |
| 263 | + | |
| 264 | + | |
| 265 | + | |
| 266 | + | |
| 267 | + | |
| 268 | + | |
| 269 | + | |
| 270 | + | |
| 271 | + | |
| 272 | + | |
| 273 | + | |
| 274 | + | |
| 275 | + | |
| 276 | + | |
| 277 | + | |
| 278 | + | |
| 279 | + | |
| 280 | + | |
| 281 | + | |
| 282 | + | |
| 283 | + | |
| 284 | + | |
| 285 | + | |
| 286 | + | |
| 287 | + | |
| 288 | + | |
| 289 | + | |
| 290 | + | |
| 291 | + | |
| 292 | + | |
| 293 | + | |
| 294 | + | |
| 295 | + | |
| 296 | + | |
| 297 | + | |
| 298 | + | |
| 299 | + | |
| 300 | + | |
| 301 | + | |
| 302 | + | |
| 303 | + | |
| 304 | + | |
| 305 | + | |
| 306 | + | |
| 307 | + | |
| 308 | + | |
| 309 | + | |
| 310 | + | |
| 311 | + | |
| 312 | + | |
| 313 | + | |
| 314 | + | |
| 315 | + | |
| 316 | + | |
| 317 | + | |
| 318 | + | |
| 319 | + | |
| 320 | + | |
| 321 | + | |
| 322 | + | |
| 323 | + | |
| 324 | + | |
| 325 | + | |
| 326 | + | |
| 327 | + | |
| 328 | + | |
| 329 | + | |
| 330 | + | |
| 331 | + | |
| 332 | + | |
| 333 | + | |
| 334 | + | |
| 335 | + | |
0 commit comments