@abhi1693/medusa-rbac 0.0.1 → 0.0.2

package/.medusa/server/src/lib/access/policy.js

@@ -3,249 +3,62 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.additionalWritePermissions = void 0;
 exports.normalizedPath = normalizedPath;
 exports.policyFor = policyFor;
 exports.isBootstrapRead = isBootstrapRead;
 exports.isSelfProfileUpdate = isSelfProfileUpdate;
 exports.can = can;
+exports.nativeFieldSelection = nativeFieldSelection;
+exports.nativePromotionRuleValue = nativePromotionRuleValue;
 exports.validateFieldSelection = validateFieldSelection;
-exports.additionalWritePermissions = additionalWritePermissions;
 const config_1 = require("./config");
-const native_routes_json_1 = __importDefault(require("./native-routes.json"));
 const native_fields_json_1 = __importDefault(require("./native-fields.json"));
-const read = (...permissions) => ({ permissions });
-const resourcePolicies = {
-    products: {
-        read: read("products.view", "prices.view"),
-        write: read("products.edit"),
-    },
-    "product-variants": {
-        read: read("products.view", "prices.view"),
-        write: read("products.edit"),
-    },
-    "product-categories": {
-        read: read("categories.view"),
-        write: read("categories.manage"),
-    },
-    collections: {
-        read: read("collections.view"),
-        write: read("collections.manage"),
-    },
-    "product-types": {
-        read: read("products.view"),
-        write: read("product_options.manage"),
-    },
-    "product-tags": {
-        read: read("products.view"),
-        write: read("product_options.manage"),
-    },
-    "product-options": {
-        read: read("products.view"),
-        write: read("product_options.manage"),
-    },
-    "product-option-values": {
-        read: read("products.view"),
-        write: read("product_options.manage"),
-    },
-    "price-lists": { read: read("prices.view"), write: read("prices.edit") },
-    "price-preferences": {
-        read: read("prices.view"),
-        write: read("prices.edit"),
-    },
-    "inventory-items": {
-        read: read("inventory.view", "products.view", "prices.view", "stock_locations.view"),
-        write: read("inventory.adjust"),
-    },
-    "stock-locations": {
-        read: read("stock_locations.view"),
-        write: read("stock_locations.manage"),
-    },
-    reservations: {
-        read: read("inventory.view", "products.view", "prices.view"),
-        write: read("inventory.adjust"),
-    },
-    orders: {
-        read: read("orders.view"),
-        write: read("orders.manage"),
-    },
-    "order-changes": {
-        read: read("orders.view"),
-        write: read("orders.manage"),
-    },
-    "draft-orders": {
-        read: read("orders.view"),
-        write: read("orders.manage"),
-    },
-    returns: {
-        read: read("orders.view"),
-        write: read("orders.manage"),
-    },
-    exchanges: {
-        read: read("orders.view"),
-        write: read("orders.manage"),
-    },
-    claims: {
-        read: read("orders.view"),
-        write: read("orders.manage"),
-    },
-    fulfillments: { read: read("orders.view"), write: read("orders.manage") },
-    customers: { read: read("customers.view"), write: read("customers.manage") },
-    "customer-groups": {
-        read: read("customers.view"),
-        write: read("customers.manage"),
-    },
-    payments: { read: read("payments.view"), write: read("payments.capture") },
-    "payment-collections": {
-        read: read("payments.view"),
-        write: read("payments.capture"),
-    },
-    promotions: {
-        read: read("promotions.view"),
-        write: read("promotions.manage"),
-    },
-    campaigns: {
-        read: read("promotions.view"),
-        write: read("promotions.manage"),
-    },
-    uploads: { read: read("media.manage"), write: read("media.manage") },
-};
-const settings = [
-    "stores",
-    "regions",
-    "currencies",
-    "countries",
-    "sales-channels",
-    "shipping-profiles",
-    "shipping-options",
-    "shipping-option-types",
-    "fulfillment-providers",
-    "fulfillment-sets",
-    "tax-regions",
-    "tax-rates",
-    "tax-providers",
-    "return-reasons",
-    "refund-reasons",
-    "locales",
-    "translations",
-];
-for (const resource of settings)
-    resourcePolicies[resource] = {
-        read: read("settings.view"),
-        write: read("settings.manage"),
-    };
-const patterns = native_routes_json_1.default.map((route) => ({
-    ...route,
-    pattern: new RegExp("^" +
-        route.path
-            .split("/")
-            .map((segment) => segment.startsWith(":")
-            ? "[^/]+"
-            : segment.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"))
-            .join("/") +
-        "$", "i"),
-}));
-const bootstrapReads = new Set([
-    "/admin/stores",
-    "/admin/users/me",
-    "/admin/feature-flags",
-    "/admin/plugins",
-    "/admin/access/me",
-]);
+const permissions_1 = require("./permissions");
+const route_facts_1 = require("./route-facts");
+const native_resources_1 = require("./native-resources");
+var write_permissions_1 = require("./write-permissions");
+Object.defineProperty(exports, "additionalWritePermissions", { enumerable: true, get: function () { return write_permissions_1.additionalWritePermissions; } });
 function normalizedPath(url) {
-    const raw = url.split("?")[0];
-    // Express decodes parameter values. Reject encoded separators and ambiguous canonical forms.
-    if (/%(?:2f|5c|2e|25)/i.test(raw) || raw.includes("\\") || raw.includes("//"))
-        return null;
-    return raw.replace(/\/+$/, "").toLowerCase();
+    return (0, route_facts_1.canonicalPath)(url)?.toLowerCase() ?? null;
 }
+/** Structural inspection; request body, scope and payload grants require resolveRequest. */
 function policyFor(method, path) {
-    const verb = method === "HEAD" ? "GET" : method;
-    if (verb === "GET" && bootstrapReads.has(path))
-        return read();
-    if (verb === "GET" && path === "/admin/access/invites")
-        return { permissions: [], superuser: true };
-    if ((verb === "GET" && /^\/admin\/access\/actors\/[^/]+$/.test(path)) ||
-        (["GET", "POST"].includes(verb) &&
-            /^\/admin\/access\/actors\/[^/]+\/[^/]+$/.test(path)))
-        return { permissions: [], superuser: true };
-    if (verb === "GET" && /^\/admin\/access\/roles(?:\/[^/]+)?$/.test(path))
-        return read("roles.view");
-    if (verb === "POST" && path === "/admin/access/evaluate")
-        return { permissions: [], superuser: true };
-    if (verb === "GET" && /^\/admin\/access\/staff(?:\/[^/]+)?$/.test(path))
-        return read("staff.view");
-    if ((verb === "POST" && path === "/admin/access/invites") ||
-        (verb === "DELETE" && /^\/admin\/access\/invites\/[^/]+$/.test(path)) ||
-        (verb === "POST" && path === "/admin/access/roles") ||
-        (["POST", "DELETE"].includes(verb) &&
-            /^\/admin\/access\/roles\/[^/]+$/.test(path)) ||
-        (["POST", "DELETE"].includes(verb) &&
-            /^\/admin\/access\/staff\/[^/]+$/.test(path))) {
-        return { permissions: [], superuser: true };
-    }
-    if (path === "/admin/access/permissions" && verb === "GET")
-        return read("roles.view");
-    if (path === "/admin/access/audit" && verb === "GET")
-        return read("audit.view");
-    // No access to Enterprise APIs, arbitrary workflows, keys, generic search or exports by accident.
-    if (/^\/admin\/(rbac|workflows|workflow-executions|api-keys|search|search-indexes)(\/|$)/.test(path))
-        return null;
-    const route = patterns.find((r) => r.pattern.test(path) && r.methods.includes(verb));
-    if (!route)
-        return null;
-    const resource = path.split("/")[2];
-    if (resource === "users") {
-        if (verb === "GET")
-            return { permissions: ["staff.view"], superuser: true };
-        if ((verb === "POST" &&
-            /^\/admin\/users\/[^/]+(?:\/reset-password)?$/.test(path)) ||
-            (verb === "DELETE" && /^\/admin\/users\/[^/]+$/.test(path)))
-            return { permissions: [], superuser: true };
-        return null;
-    }
-    if (resource === "invites")
-        return { permissions: [], superuser: true };
-    const policies = resourcePolicies[resource];
-    if (!policies)
-        return null;
-    if (path.includes("/export"))
-        return resource === "products"
-            ? read("products.view", "prices.view", "products.export")
-            : null;
-    if (verb === "GET") {
-        return policies.read;
-    }
-    if (/\/refund(?:\/|$)/.test(path))
-        return read("refunds.issue");
-    if (path.includes("/cancel") && ["orders", "draft-orders"].includes(resource))
-        return read("orders.cancel");
-    if (resource === "products" || resource === "product-variants") {
-        if (path.includes("/import"))
-            return read("products.import", "products.create", "products.edit", "prices.edit");
-        if (verb === "DELETE")
-            return read("products.delete");
-        if (path === "/admin/products")
-            return read("products.create");
-    }
-    return policies.write;
+    return (0, native_resources_1.describeNative)(method, path, {})?.policy || null;
 }
 function isBootstrapRead(method, path) {
-    return ["GET", "HEAD"].includes(method) && bootstrapReads.has(path);
+    return (["GET", "HEAD"].includes(method) &&
+        ["authenticated", "public"].includes((0, native_resources_1.describeNative)(method, path)?.access || ""));
 }
 function isSelfProfileUpdate(method, path, userId, body) {
-    return (method === "POST" &&
-        path === `/admin/users/${userId.toLowerCase()}` &&
-        Boolean(body) &&
-        typeof body === "object" &&
-        !Array.isArray(body) &&
-        Object.keys(body).every((key) => ["first_name", "last_name", "avatar_url"].includes(key)));
+    const descriptor = (0, native_resources_1.describeNative)(method, path, body, userId);
+    return Boolean(descriptor?.self);
 }
 function can(principal, policy, context = {}) {
-    return (principal.active &&
-        (!policy.superuser || principal.is_superuser) &&
-        policy.permissions.every((p) => (0, config_1.evaluatePermission)(principal, p, context)));
+    return ((0, permissions_1.isSuperuser)(principal) ||
+        (principal.active &&
+            !policy.superuser &&
+            policy.permissions.every((p) => (0, config_1.evaluatePermission)(principal, p, context))));
+}
+/** Dashboard's group picker only reads member IDs to disable existing choices. */
+function nativeFieldSelection(resource, fields) {
+    return resource === "customer-groups" && fields === "*customers"
+        ? "+customers.id"
+        : fields;
 }
-function validateFieldSelection(resource, fields) {
+/** Native promotion rule picker hydrates a selected sales channel by ID. */
+function nativePromotionRuleValue(resource, params, query) {
+    if (resource === "promotions" &&
+        params.rule_type === "rules" &&
+        params.rule_attribute_id === "sales_channel" &&
+        query.limit === "1" &&
+        query.value === undefined &&
+        typeof query.id === "string" &&
+        /^sc_[a-z0-9]+$/i.test(query.id))
+        return query.id;
+    return undefined;
+}
+function validateFieldSelection(resource, fields, override) {
     if (fields === undefined)
         return true;
     if (typeof fields !== "string" || fields.length > 4000)
@@ -255,17 +68,112 @@ function validateFieldSelection(resource, fields) {
         // Narrow relation IDs requested by native Admin list/count screens.
         collections: ["products.id"],
         "customer-groups": ["customers.id"],
+        // Dashboard 2.22.2 customer detail loads the native addresses relation.
+        customers: ["*addresses", "*groups"],
+        campaigns: ["promotions.id"],
+        "price-lists": [
+            "*prices",
+            "prices.price_set.variant.id",
+            "prices.price_rules.attribute",
+            "prices.price_rules.value",
+        ],
+        // Order summary and timeline request these owning order-module relations.
+        returns: ["*items", "*items.reason"],
+        claims: ["*additional_items"],
+        exchanges: ["*additional_items"],
+        // Native settings and taxonomy detail components select these named links.
+        regions: ["*payment_providers"],
+        "shipping-options": [
+            "service_zone.fulfillment_set.type",
+            "service_zone.fulfillment_set.location.id",
+        ],
+        "product-categories": ["products.id"],
+        "product-options": ["values.id", "values.value", "values.rank"],
+        "stock-locations": [
+            "*sales_channels",
+            "*address",
+            "*fulfillment_sets",
+            "*fulfillment_sets.service_zones",
+            "*fulfillment_sets.service_zones.shipping_options",
+            "*fulfillment_sets.service_zones.shipping_options.shipping_profile",
+            "fulfillment_sets.type",
+            "fulfillment_sets.name",
+            "*fulfillment_sets.service_zones.geo_zones",
+            "fulfillment_sets.service_zones.name",
+            "*fulfillment_sets.service_zones.shipping_options.rules",
+            "*fulfillment_providers",
+        ],
         // Native Admin requests these computed order summaries explicitly.
-        orders: ["payment_status", "fulfillment_status"],
+        orders: [
+            "items.variant.product.shipping_profile.id",
+            "shipping_methods.shipping_option_id",
+            "items.variant.product.title",
+            "*items.variant.inventory",
+            "*items.variant.inventory.location_levels",
+            "*items.variant.inventory_items",
+            "payment_status",
+            "fulfillment_status",
+            // The customer detail order table displays the shipping country.
+            "shipping_address.country_code",
+            "item_discount_total",
+            "discount_subtotal",
+            "shipping_discount_total",
+            "refundable_total",
+            "order_change",
+            "*items.variant.options",
+            "items.variant.manage_inventory",
+            "*items.variant.inventory_items.inventory",
+            "items.variant.inventory_items.required_quantity",
+            "*promotions",
+            "fulfillments.shipping_option.service_zone.fulfillment_set.type",
+            "*fulfillments.items",
+            "*fulfillments.labels",
+            "*payment_collections.payment_sessions",
+            "*payment_collections.payments.refunds.refund_reason",
+            "region.automatic_taxes",
+        ],
         products: [
+            "images.id",
+            "images.url",
+            "images.variants.id",
             "*categories",
+            // Option detail lists the owning Product module join records.
+            "*product_options",
+            // Dashboard's native product detail also expands this linked profile.
+            "*shipping_profile",
             "variants.id",
             "variants.inventory_quantity",
             "variants.inventory_items.inventory.location_levels",
             "variants.inventory_items.required_quantity",
         ],
+        // Dashboard 2.22.2 inventory-detail/constants.ts requests these linked data.
+        // Inventory reads already require product, price and stock-location access.
+        "inventory-items": [
+            "*variants",
+            "*variants.product",
+            "*variants.options",
+            // The location-level table selects only these related location fields.
+            "stock_locations.id",
+            "stock_locations.name",
+        ],
         "product-variants": [
+            "*product.images",
+            "*images",
             "inventory_quantity",
+            "inventory_items.*",
+            "inventory_items.inventory.id",
+            "inventory_items.inventory.title",
+            "inventory_items.inventory.sku",
+            // Reviewed native Variant table/detail expansions. Inventory grants are
+            // checked separately by the Admin middleware.
+            "*inventory_items",
+            "*inventory_items.inventory",
+            "*inventory_items.inventory.location_levels",
+            "*options.option",
+            "*prices.price_rules",
+            "images.id",
+            "images.url",
+            "images.variants.id",
             "product.id",
             "product.title",
             "product.handle",
@@ -274,49 +182,26 @@ function validateFieldSelection(resource, fields) {
             "product.metadata",
         ],
         users: ["id", "email", "first_name", "last_name", "avatar_url"],
+        // Layout list query configuration lives below configurations/query-config.
+        layouts: [
+            "id",
+            "zone",
+            "user_id",
+            "is_system_default",
+            "configuration",
+            "created_at",
+            "updated_at",
+        ],
     };
-    const allowed = new Set([...safe, ...(extra[resource] || [])]);
+    const allowed = new Set(override || [...safe, ...(extra[resource] || [])]);
     return fields.split(",").every((value) => {
         const field = value.trim();
+        // The option detail excludes the products relation; adding it remains denied.
+        if (!override && resource === "product-options" && field === "-products")
+            return true;
         const name = field.replace(/^[+-]/, "");
         // Native Admin also selects reviewed relations without the '*' prefix.
         return allowed.has(name) || allowed.has(`*${name}`);
     });
 }
-function additionalWritePermissions(value, creating = false) {
-    const needed = new Set();
-    const visit = (data, isCreate) => {
-        if (!data || typeof data !== "object")
-            return;
-        if (Array.isArray(data)) {
-            data.forEach((item) => visit(item, isCreate));
-            return;
-        }
-        for (const [key, child] of Object.entries(data)) {
-            if (key === "status" && (!isCreate || child !== "draft"))
-                needed.add("products.publish");
-            if (key === "delete")
-                needed.add("products.delete");
-            if (key === "create")
-                needed.add("products.create");
-            if (["price", "prices", "price_set", "price_sets", "amount"].includes(key))
-                needed.add("prices.edit");
-            if (key === "collection_id")
-                needed.add("collections.manage");
-            if (key === "categories" || key === "category_ids")
-                needed.add("categories.manage");
-            if (["inventory_items", "inventory_quantity"].includes(key) ||
-                (key === "manage_inventory" && (!isCreate || child !== true)) ||
-                (key === "allow_backorder" && (!isCreate || child !== false)))
-                needed.add("inventory.adjust");
-            if (["images", "thumbnail"].includes(key))
-                needed.add("media.manage");
-            // Traverse only native batch/variant envelopes, not arbitrary metadata.
-            if (["variants", "create", "update"].includes(key))
-                visit(child, key === "create" || (key === "variants" && isCreate));
-        }
-    };
-    visit(value, creating);
-    return [...needed];
-}
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicG9saWN5LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vLi4vc3JjL2xpYi9hY2Nlc3MvcG9saWN5LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7O0FBNEpBLHdDQU1DO0FBRUQsOEJBK0VDO0FBRUQsMENBRUM7QUFFRCxrREFnQkM7QUFFRCxrQkFVQztBQUVELHdEQXNDQztBQUVELGdFQXFDQztBQXBXRCxxQ0FBcUU7QUFDckUsOEVBQStDO0FBQy9DLDhFQUErQztBQUkvQyxNQUFNLElBQUksR0FBRyxDQUFDLEdBQUcsV0FBeUIsRUFBVSxFQUFFLENBQUMsQ0FBQyxFQUFFLFdBQVcsRUFBRSxDQUFDLENBQUE7QUFDeEUsTUFBTSxnQkFBZ0IsR0FBb0Q7SUFDeEUsUUFBUSxFQUFFO1FBQ1IsSUFBSSxFQUFFLElBQUksQ0FBQyxlQUFlLEVBQUUsYUFBYSxDQUFDO1FBQzFDLEtBQUssRUFBRSxJQUFJLENBQUMsZUFBZSxDQUFDO0tBQzdCO0lBQ0Qsa0JBQWtCLEVBQUU7UUFDbEIsSUFBSSxFQUFFLElBQUksQ0FBQyxlQUFlLEVBQUUsYUFBYSxDQUFDO1FBQzFDLEtBQUssRUFBRSxJQUFJLENBQUMsZUFBZSxDQUFDO0tBQzdCO0lBQ0Qsb0JBQW9CLEVBQUU7UUFDcEIsSUFBSSxFQUFFLElBQUksQ0FBQyxpQkFBaUIsQ0FBQztRQUM3QixLQUFLLEVBQUUsSUFBSSxDQUFDLG1CQUFtQixDQUFDO0tBQ2pDO0lBQ0QsV0FBVyxFQUFFO1FBQ1gsSUFBSSxFQUFFLElBQUksQ0FBQyxrQkFBa0IsQ0FBQztRQUM5QixLQUFLLEVBQUUsSUFBSSxDQUFDLG9CQUFvQixDQUFDO0tBQ2xDO0lBQ0QsZUFBZSxFQUFFO1FBQ2YsSUFBSSxFQUFFLElBQUksQ0FBQyxlQUFlLENBQUM7UUFDM0IsS0FBSyxFQUFFLElBQUksQ0FBQyx3QkFBd0IsQ0FBQztLQUN0QztJQUNELGNBQWMsRUFBRTtRQUNkLElBQUksRUFBRSxJQUFJLENBQUMsZUFBZSxDQUFDO1FBQzNCLEtBQUssRUFBRSxJQUFJLENBQUMsd0JBQXdCLENBQUM7S0FDdEM7SUFDRCxpQkFBaUIsRUFBRTtRQUNqQixJQUFJLEVBQUUsSUFBSSxDQUFDLGVBQWUsQ0FBQztRQUMzQixLQUFLLEVBQUUsSUFBSSxDQUFDLHdCQUF3QixDQUFDO0tBQ3RDO0lBQ0QsdUJBQXVCLEVBQUU7UUFDdkIsSUFBSSxFQUFFLElBQUksQ0FBQyxlQUFlLENBQUM7UUFDM0IsS0FBSyxFQUFFLElBQUksQ0FBQyx3QkFBd0IsQ0FBQztLQUN0QztJQUNELGFBQWEsRUFBRSxFQUFFLElBQUksRUFBRSxJQUFJLENBQUMsYUFBYSxDQUFDLEVBQUUsS0FBSyxFQUFFLElBQUksQ0FBQyxhQUFhLENBQUMsRUFBRTtJQUN4RSxtQkFBbUIsRUFBRTtRQUNuQixJQUFJLEVBQUUsSUFBSSxDQUFDLGFBQWEsQ0FBQztRQUN6QixLQUFLLEVBQUUsSUFBSSxDQUFDLGFBQWEsQ0FBQztLQUMzQjtJQUNELGlCQUFpQixFQUFFO1FBQ2pCLElBQUksRUFBRSxJQUFJLENBQ1IsZ0JBQWdCLEVBQ2hCLGVBQWUsRUFDZixhQUFhLEVBQ2Isc0JBQXNCLENBQ3ZCO1FBQ0QsS0FBSyxFQUFFLElBQUksQ0FBQyxrQkFBa0IsQ0FBQztLQUNoQztJQUNELGlCQUFpQixFQUFFO1FBQ2pCLElBQUksRUFBRSxJQUFJLENBQUMsc0JBQXNCLENBQUM7UUFDbEMsS0FBSyxFQUFFLElBQUksQ0FBQyx3QkFBd0IsQ0FBQztLQUN0QztJQUNELFlBQVksRUFBRTtRQUNaLElBQUksRUFBRSxJQUFJLENBQUMsZ0JBQWdCLEVBQUUsZUFBZSxFQUFFLGFBQWEsQ0FBQztRQUM1RCxLQUFLLEVBQUUsSUFBSSxDQUFDLGtCQUFrQixDQUFDO0tBQ2hDO0lBQ0QsTUFBTSxFQUFFO1FBQ04sSUFBSSxFQUFFLElBQUksQ0FBQyxhQUFhLENBQUM7UUFDekIsS0FBSyxFQUFFLElBQUksQ0FBQyxlQUFlLENBQUM7S0FDN0I7SUFDRCxlQUFlLEVBQUU7UUFDZixJQUFJLEVBQUUsSUFBSSxDQUFDLGFBQWEsQ0FBQztRQUN6QixLQUFLLEVBQUUsSUFBSSxDQUFDLGVBQWUsQ0FBQztLQUM3QjtJQUNELGNBQWMsRUFBRTtRQUNkLElBQUksRUFBRSxJQUFJLENBQUMsYUFBYSxDQUFDO1FBQ3pCLEtBQUssRUFBRSxJQUFJLENBQUMsZUFBZSxDQUFDO0tBQzdCO0lBQ0QsT0FBTyxFQUFFO1FBQ1AsSUFBSSxFQUFFLElBQUksQ0FBQyxhQUFhLENBQUM7UUFDekIsS0FBSyxFQUFFLElBQUksQ0FBQyxlQUFlLENBQUM7S0FDN0I7SUFDRCxTQUFTLEVBQUU7UUFDVCxJQUFJLEVBQUUsSUFBSSxDQUFDLGFBQWEsQ0FBQztRQUN6QixLQUFLLEVBQUUsSUFBSSxDQUFDLGVBQWUsQ0FBQztLQUM3QjtJQUNELE1BQU0sRUFBRTtRQUNOLElBQUksRUFBRSxJQUFJLENBQUMsYUFBYSxDQUFDO1FBQ3pCLEtBQUssRUFBRSxJQUFJLENBQUMsZUFBZSxDQUFDO0tBQzdCO0lBQ0QsWUFBWSxFQUFFLEVBQUUsSUFBSSxFQUFFLElBQUksQ0FBQyxhQUFhLENBQUMsRUFBRSxLQUFLLEVBQUUsSUFBSSxDQUFDLGVBQWUsQ0FBQyxFQUFFO0lBQ3pFLFNBQVMsRUFBRSxFQUFFLElBQUksRUFBRSxJQUFJLENBQUMsZ0JBQWdCLENBQUMsRUFBRSxLQUFLLEVBQUUsSUFBSSxDQUFDLGtCQUFrQixDQUFDLEVBQUU7SUFDNUUsaUJBQWlCLEVBQUU7UUFDakIsSUFBSSxFQUFFLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQztRQUM1QixLQUFLLEVBQUUsSUFBSSxDQUFDLGtCQUFrQixDQUFDO0tBQ2hDO0lBQ0QsUUFBUSxFQUFFLEVBQUUsSUFBSSxFQUFFLElBQUksQ0FBQyxlQUFlLENBQUMsRUFBRSxLQUFLLEVBQUUsSUFBSSxDQUFDLGtCQUFrQixDQUFDLEVBQUU7SUFDMUUscUJBQXFCLEVBQUU7UUFDckIsSUFBSSxFQUFFLElBQUksQ0FBQyxlQUFlLENBQUM7UUFDM0IsS0FBSyxFQUFFLElBQUksQ0FBQyxrQkFBa0IsQ0FBQztLQUNoQztJQUNELFVBQVUsRUFBRTtRQUNWLElBQUksRUFBRSxJQUFJLENBQUMsaUJBQWlCLENBQUM7UUFDN0IsS0FBSyxFQUFFLElBQUksQ0FBQyxtQkFBbUIsQ0FBQztLQUNqQztJQUNELFNBQVMsRUFBRTtRQUNULElBQUksRUFBRSxJQUFJLENBQUMsaUJBQWlCLENBQUM7UUFDN0IsS0FBSyxFQUFFLElBQUksQ0FBQyxtQkFBbUIsQ0FBQztLQUNqQztJQUNELE9BQU8sRUFBRSxFQUFFLElBQUksRUFBRSxJQUFJLENBQUMsY0FBYyxDQUFDLEVBQUUsS0FBSyxFQUFFLElBQUksQ0FBQyxjQUFjLENBQUMsRUFBRTtDQUNyRSxDQUFBO0FBQ0QsTUFBTSxRQUFRLEdBQUc7SUFDZixRQUFRO0lBQ1IsU0FBUztJQUNULFlBQVk7SUFDWixXQUFXO0lBQ1gsZ0JBQWdCO0lBQ2hCLG1CQUFtQjtJQUNuQixrQkFBa0I7SUFDbEIsdUJBQXVCO0lBQ3ZCLHVCQUF1QjtJQUN2QixrQkFBa0I7SUFDbEIsYUFBYTtJQUNiLFdBQVc7SUFDWCxlQUFlO0lBQ2YsZ0JBQWdCO0lBQ2hCLGdCQUFnQjtJQUNoQixTQUFTO0lBQ1QsY0FBYztDQUNmLENBQUE7QUFDRCxLQUFLLE1BQU0sUUFBUSxJQUFJLFFBQVE7SUFDN0IsZ0JBQWdCLENBQUMsUUFBUSxDQUFDLEdBQUc7UUFDM0IsSUFBSSxFQUFFLElBQUksQ0FBQyxlQUFlLENBQUM7UUFDM0IsS0FBSyxFQUFFLElBQUksQ0FBQyxpQkFBaUIsQ0FBQztLQUMvQixDQUFBO0FBRUgsTUFBTSxRQUFRLEdBQUcsNEJBQVksQ0FBQyxHQUFHLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLENBQUM7SUFDNUMsR0FBRyxLQUFLO0lBQ1IsT0FBTyxFQUFFLElBQUksTUFBTSxDQUNqQixHQUFHO1FBQ0QsS0FBSyxDQUFDLElBQUk7YUFDUCxLQUFLLENBQUMsR0FBRyxDQUFDO2FBQ1YsR0FBRyxDQUFDLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FDZixPQUFPLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQztZQUNyQixDQUFDLENBQUMsT0FBTztZQUNULENBQUMsQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLHFCQUFxQixFQUFFLE1BQU0sQ0FBQyxDQUNuRDthQUNBLElBQUksQ0FBQyxHQUFHLENBQUM7UUFDWixHQUFHLEVBQ0wsR0FBRyxDQUNKO0NBQ0YsQ0FBQyxDQUFDLENBQUE7QUFDSCxNQUFNLGNBQWMsR0FBRyxJQUFJLEdBQUcsQ0FBQztJQUM3QixlQUFlO0lBQ2YsaUJBQWlCO0lBQ2pCLHNCQUFzQjtJQUN0QixnQkFBZ0I7SUFDaEIsa0JBQWtCO0NBQ25CLENBQUMsQ0FBQTtBQUVGLFNBQWdCLGNBQWMsQ0FBQyxHQUFXO0lBQ3hDLE1BQU0sR0FBRyxHQUFHLEdBQUcsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUE7SUFDN0IsNkZBQTZGO0lBQzdGLElBQUksbUJBQW1CLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxJQUFJLEdBQUcsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLElBQUksR0FBRyxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUM7UUFDM0UsT0FBTyxJQUFJLENBQUE7SUFDYixPQUFPLEdBQUcsQ0FBQyxPQUFPLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQyxDQUFDLFdBQVcsRUFBRSxDQUFBO0FBQzlDLENBQUM7QUFFRCxTQUFnQixTQUFTLENBQUMsTUFBYyxFQUFFLElBQVk7SUFDcEQsTUFBTSxJQUFJLEdBQUcsTUFBTSxLQUFLLE1BQU0sQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUE7SUFDL0MsSUFBSSxJQUFJLEtBQUssS0FBSyxJQUFJLGNBQWMsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDO1FBQUUsT0FBTyxJQUFJLEVBQUUsQ0FBQTtJQUM3RCxJQUFJLElBQUksS0FBSyxLQUFLLElBQUksSUFBSSxLQUFLLHVCQUF1QjtRQUNwRCxPQUFPLEVBQUUsV0FBVyxFQUFFLEVBQUUsRUFBRSxTQUFTLEVBQUUsSUFBSSxFQUFFLENBQUE7SUFDN0MsSUFDRSxDQUFDLElBQUksS0FBSyxLQUFLLElBQUksa0NBQWtDLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDO1FBQ2pFLENBQUMsQ0FBQyxLQUFLLEVBQUUsTUFBTSxDQUFDLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQztZQUM3Qix5Q0FBeUMsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUM7UUFFdkQsT0FBTyxFQUFFLFdBQVcsRUFBRSxFQUFFLEVBQUUsU0FBUyxFQUFFLElBQUksRUFBRSxDQUFBO0lBQzdDLElBQUksSUFBSSxLQUFLLEtBQUssSUFBSSxzQ0FBc0MsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDO1FBQ3JFLE9BQU8sSUFBSSxDQUFDLFlBQVksQ0FBQyxDQUFBO0lBQzNCLElBQUksSUFBSSxLQUFLLE1BQU0sSUFBSSxJQUFJLEtBQUssd0JBQXdCO1FBQ3RELE9BQU8sRUFBRSxXQUFXLEVBQUUsRUFBRSxFQUFFLFNBQVMsRUFBRSxJQUFJLEVBQUUsQ0FBQTtJQUM3QyxJQUFJLElBQUksS0FBSyxLQUFLLElBQUksc0NBQXNDLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQztRQUNyRSxPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsQ0FBQTtJQUMzQixJQUNFLENBQUMsSUFBSSxLQUFLLE1BQU0sSUFBSSxJQUFJLEtBQUssdUJBQXVCLENBQUM7UUFDckQsQ0FBQyxJQUFJLEtBQUssUUFBUSxJQUFJLG1DQUFtQyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUNyRSxDQUFDLElBQUksS0FBSyxNQUFNLElBQUksSUFBSSxLQUFLLHFCQUFxQixDQUFDO1FBQ25ELENBQUMsQ0FBQyxNQUFNLEVBQUUsUUFBUSxDQUFDLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQztZQUNoQyxpQ0FBaUMsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDL0MsQ0FBQyxDQUFDLE1BQU0sRUFBRSxRQUFRLENBQUMsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDO1lBQ2hDLGlDQUFpQyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQyxFQUMvQyxDQUFDO1FBQ0QsT0FBTyxFQUFFLFdBQVcsRUFBRSxFQUFFLEVBQUUsU0FBUyxFQUFFLElBQUksRUFBRSxDQUFBO0lBQzdDLENBQUM7SUFDRCxJQUFJLElBQUksS0FBSywyQkFBMkIsSUFBSSxJQUFJLEtBQUssS0FBSztRQUN4RCxPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsQ0FBQTtJQUMzQixJQUFJLElBQUksS0FBSyxxQkFBcUIsSUFBSSxJQUFJLEtBQUssS0FBSztRQUNsRCxPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsQ0FBQTtJQUMzQixrR0FBa0c7SUFDbEcsSUFDRSxxRkFBcUYsQ0FBQyxJQUFJLENBQ3hGLElBQUksQ0FDTDtRQUVELE9BQU8sSUFBSSxDQUFBO0lBQ2IsTUFBTSxLQUFLLEdBQUcsUUFBUSxDQUFDLElBQUksQ0FDekIsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxDQUN4RCxDQUFBO0lBQ0QsSUFBSSxDQUFDLEtBQUs7UUFBRSxPQUFPLElBQUksQ0FBQTtJQUN2QixNQUFNLFFBQVEsR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFBO0lBQ25DLElBQUksUUFBUSxLQUFLLE9BQU8sRUFBRSxDQUFDO1FBQ3pCLElBQUksSUFBSSxLQUFLLEtBQUs7WUFBRSxPQUFPLEVBQUUsV0FBVyxFQUFFLENBQUMsWUFBWSxDQUFDLEVBQUUsU0FBUyxFQUFFLElBQUksRUFBRSxDQUFBO1FBQzNFLElBQ0UsQ0FBQyxJQUFJLEtBQUssTUFBTTtZQUNkLDhDQUE4QyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQztZQUM1RCxDQUFDLElBQUksS0FBSyxRQUFRLElBQUkseUJBQXlCLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDO1lBRTNELE9BQU8sRUFBRSxXQUFXLEVBQUUsRUFBRSxFQUFFLFNBQVMsRUFBRSxJQUFJLEVBQUUsQ0FBQTtRQUM3QyxPQUFPLElBQUksQ0FBQTtJQUNiLENBQUM7SUFDRCxJQUFJLFFBQVEsS0FBSyxTQUFTO1FBQUUsT0FBTyxFQUFFLFdBQVcsRUFBRSxFQUFFLEVBQUUsU0FBUyxFQUFFLElBQUksRUFBRSxDQUFBO0lBQ3ZFLE1BQU0sUUFBUSxHQUFHLGdCQUFnQixDQUFDLFFBQVEsQ0FBQyxDQUFBO0lBQzNDLElBQUksQ0FBQyxRQUFRO1FBQUUsT0FBTyxJQUFJLENBQUE7SUFDMUIsSUFBSSxJQUFJLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQztRQUMxQixPQUFPLFFBQVEsS0FBSyxVQUFVO1lBQzVCLENBQUMsQ0FBQyxJQUFJLENBQUMsZUFBZSxFQUFFLGFBQWEsRUFBRSxpQkFBaUIsQ0FBQztZQUN6RCxDQUFDLENBQUMsSUFBSSxDQUFBO0lBQ1YsSUFBSSxJQUFJLEtBQUssS0FBSyxFQUFFLENBQUM7UUFDbkIsT0FBTyxRQUFRLENBQUMsSUFBSSxDQUFBO0lBQ3RCLENBQUM7SUFDRCxJQUFJLGtCQUFrQixDQUFDLElBQUksQ0FBQyxJQUFJLENBQUM7UUFBRSxPQUFPLElBQUksQ0FBQyxlQUFlLENBQUMsQ0FBQTtJQUMvRCxJQUFJLElBQUksQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsY0FBYyxDQUFDLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQztRQUMzRSxPQUFPLElBQUksQ0FBQyxlQUFlLENBQUMsQ0FBQTtJQUM5QixJQUFJLFFBQVEsS0FBSyxVQUFVLElBQUksUUFBUSxLQUFLLGtCQUFrQixFQUFFLENBQUM7UUFDL0QsSUFBSSxJQUFJLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQztZQUMxQixPQUFPLElBQUksQ0FDVCxpQkFBaUIsRUFDakIsaUJBQWlCLEVBQ2pCLGVBQWUsRUFDZixhQUFhLENBQ2QsQ0FBQTtRQUNILElBQUksSUFBSSxLQUFLLFFBQVE7WUFBRSxPQUFPLElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxDQUFBO1FBQ3JELElBQUksSUFBSSxLQUFLLGlCQUFpQjtZQUFFLE9BQU8sSUFBSSxDQUFDLGlCQUFpQixDQUFDLENBQUE7SUFDaEUsQ0FBQztJQUNELE9BQU8sUUFBUSxDQUFDLEtBQUssQ0FBQTtBQUN2QixDQUFDO0FBRUQsU0FBZ0IsZUFBZSxDQUFDLE1BQWMsRUFBRSxJQUFZO0lBQzFELE9BQU8sQ0FBQyxLQUFLLEVBQUUsTUFBTSxDQUFDLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxJQUFJLGNBQWMsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLENBQUE7QUFDckUsQ0FBQztBQUVELFNBQWdCLG1CQUFtQixDQUNqQyxNQUFjLEVBQ2QsSUFBWSxFQUNaLE1BQWMsRUFDZCxJQUFhO0lBRWIsT0FBTyxDQUNMLE1BQU0sS0FBSyxNQUFNO1FBQ2pCLElBQUksS0FBSyxnQkFBZ0IsTUFBTSxDQUFDLFdBQVcsRUFBRSxFQUFFO1FBQy9DLE9BQU8sQ0FBQyxJQUFJLENBQUM7UUFDYixPQUFPLElBQUksS0FBSyxRQUFRO1FBQ3hCLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUM7UUFDcEIsTUFBTSxDQUFDLElBQUksQ0FBQyxJQUFLLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxHQUFHLEVBQUUsRUFBRSxDQUMvQixDQUFDLFlBQVksRUFBRSxXQUFXLEVBQUUsWUFBWSxDQUFDLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxDQUN4RCxDQUNGLENBQUE7QUFDSCxDQUFDO0FBRUQsU0FBZ0IsR0FBRyxDQUNqQixTQUEwQixFQUMxQixNQUFjLEVBQ2QsVUFBNkIsRUFBRTtJQUUvQixPQUFPLENBQ0wsU0FBUyxDQUFDLE1BQU07UUFDaEIsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxTQUFTLElBQUksU0FBUyxDQUFDLFlBQVksQ0FBQztRQUM3QyxNQUFNLENBQUMsV0FBVyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsSUFBQSwyQkFBa0IsRUFBQyxTQUFTLEVBQUUsQ0FBQyxFQUFFLE9BQU8sQ0FBQyxDQUFDLENBQzNFLENBQUE7QUFDSCxDQUFDO0FBRUQsU0FBZ0Isc0JBQXNCLENBQ3BDLFFBQWdCLEVBQ2hCLE1BQWU7SUFFZixJQUFJLE1BQU0sS0FBSyxTQUFTO1FBQUUsT0FBTyxJQUFJLENBQUE7SUFDckMsSUFBSSxPQUFPLE1BQU0sS0FBSyxRQUFRLElBQUksTUFBTSxDQUFDLE1BQU0sR0FBRyxJQUFJO1FBQUUsT0FBTyxLQUFLLENBQUE7SUFDcEUsTUFBTSxJQUFJLEdBQUksNEJBQXlDLENBQUMsUUFBUSxDQUFDLElBQUksRUFBRSxDQUFBO0lBQ3ZFLE1BQU0sS0FBSyxHQUE2QjtRQUN0QyxvRUFBb0U7UUFDcEUsV0FBVyxFQUFFLENBQUMsYUFBYSxDQUFDO1FBQzVCLGlCQUFpQixFQUFFLENBQUMsY0FBYyxDQUFDO1FBQ25DLG1FQUFtRTtRQUNuRSxNQUFNLEVBQUUsQ0FBQyxnQkFBZ0IsRUFBRSxvQkFBb0IsQ0FBQztRQUNoRCxRQUFRLEVBQUU7WUFDUixhQUFhO1lBQ2IsYUFBYTtZQUNiLDZCQUE2QjtZQUM3QixvREFBb0Q7WUFDcEQsNENBQTRDO1NBQzdDO1FBQ0Qsa0JBQWtCLEVBQUU7WUFDbEIsb0JBQW9CO1lBQ3BCLFlBQVk7WUFDWixlQUFlO1lBQ2YsZ0JBQWdCO1lBQ2hCLGdCQUFnQjtZQUNoQixtQkFBbUI7WUFDbkIsa0JBQWtCO1NBQ25CO1FBQ0QsS0FBSyxFQUFFLENBQUMsSUFBSSxFQUFFLE9BQU8sRUFBRSxZQUFZLEVBQUUsV0FBVyxFQUFFLFlBQVksQ0FBQztLQUNoRSxDQUFBO0lBQ0QsTUFBTSxPQUFPLEdBQUcsSUFBSSxHQUFHLENBQUMsQ0FBQyxHQUFHLElBQUksRUFBRSxHQUFHLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQTtJQUM5RCxPQUFPLE1BQU0sQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsS0FBSyxFQUFFLEVBQUU7UUFDdkMsTUFBTSxLQUFLLEdBQUcsS0FBSyxDQUFDLElBQUksRUFBRSxDQUFBO1FBQzFCLE1BQU0sSUFBSSxHQUFHLEtBQUssQ0FBQyxPQUFPLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQyxDQUFBO1FBQ3ZDLHVFQUF1RTtRQUN2RSxPQUFPLE9BQU8sQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLElBQUksT0FBTyxDQUFDLEdBQUcsQ0FBQyxJQUFJLElBQUksRUFBRSxDQUFDLENBQUE7SUFDckQsQ0FBQyxDQUFDLENBQUE7QUFDSixDQUFDO0FBRUQsU0FBZ0IsMEJBQTBCLENBQ3hDLEtBQWMsRUFDZCxRQUFRLEdBQUcsS0FBSztJQUVoQixNQUFNLE1BQU0sR0FBRyxJQUFJLEdBQUcsRUFBYyxDQUFBO0lBQ3BDLE1BQU0sS0FBSyxHQUFHLENBQUMsSUFBYSxFQUFFLFFBQWlCLEVBQUUsRUFBRTtRQUNqRCxJQUFJLENBQUMsSUFBSSxJQUFJLE9BQU8sSUFBSSxLQUFLLFFBQVE7WUFBRSxPQUFNO1FBQzdDLElBQUksS0FBSyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDO1lBQ3hCLElBQUksQ0FBQyxPQUFPLENBQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLEtBQUssQ0FBQyxJQUFJLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQTtZQUM3QyxPQUFNO1FBQ1IsQ0FBQztRQUNELEtBQUssTUFBTSxDQUFDLEdBQUcsRUFBRSxLQUFLLENBQUMsSUFBSSxNQUFNLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUM7WUFDaEQsSUFBSSxHQUFHLEtBQUssUUFBUSxJQUFJLENBQUMsQ0FBQyxRQUFRLElBQUksS0FBSyxLQUFLLE9BQU8sQ0FBQztnQkFDdEQsTUFBTSxDQUFDLEdBQUcsQ0FBQyxrQkFBa0IsQ0FBQyxDQUFBO1lBQ2hDLElBQUksR0FBRyxLQUFLLFFBQVE7Z0JBQUUsTUFBTSxDQUFDLEdBQUcsQ0FBQyxpQkFBaUIsQ0FBQyxDQUFBO1lBQ25ELElBQUksR0FBRyxLQUFLLFFBQVE7Z0JBQUUsTUFBTSxDQUFDLEdBQUcsQ0FBQyxpQkFBaUIsQ0FBQyxDQUFBO1lBQ25ELElBQ0UsQ0FBQyxPQUFPLEVBQUUsUUFBUSxFQUFFLFdBQVcsRUFBRSxZQUFZLEVBQUUsUUFBUSxDQUFDLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQztnQkFFdEUsTUFBTSxDQUFDLEdBQUcsQ0FBQyxhQUFhLENBQUMsQ0FBQTtZQUMzQixJQUFJLEdBQUcsS0FBSyxlQUFlO2dCQUFFLE1BQU0sQ0FBQyxHQUFHLENBQUMsb0JBQW9CLENBQUMsQ0FBQTtZQUM3RCxJQUFJLEdBQUcsS0FBSyxZQUFZLElBQUksR0FBRyxLQUFLLGNBQWM7Z0JBQ2hELE1BQU0sQ0FBQyxHQUFHLENBQUMsbUJBQW1CLENBQUMsQ0FBQTtZQUNqQyxJQUNFLENBQUMsaUJBQWlCLEVBQUUsb0JBQW9CLENBQUMsQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDO2dCQUN2RCxDQUFDLEdBQUcsS0FBSyxrQkFBa0IsSUFBSSxDQUFDLENBQUMsUUFBUSxJQUFJLEtBQUssS0FBSyxJQUFJLENBQUMsQ0FBQztnQkFDN0QsQ0FBQyxHQUFHLEtBQUssaUJBQWlCLElBQUksQ0FBQyxDQUFDLFFBQVEsSUFBSSxLQUFLLEtBQUssS0FBSyxDQUFDLENBQUM7Z0JBRTdELE1BQU0sQ0FBQyxHQUFHLENBQUMsa0JBQWtCLENBQUMsQ0FBQTtZQUNoQyxJQUFJLENBQUMsUUFBUSxFQUFFLFdBQVcsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUM7Z0JBQUUsTUFBTSxDQUFDLEdBQUcsQ0FBQyxjQUFjLENBQUMsQ0FBQTtZQUNyRSx3RUFBd0U7WUFDeEUsSUFBSSxDQUFDLFVBQVUsRUFBRSxRQUFRLEVBQUUsUUFBUSxDQUFDLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQztnQkFDaEQsS0FBSyxDQUFDLEtBQUssRUFBRSxHQUFHLEtBQUssUUFBUSxJQUFJLENBQUMsR0FBRyxLQUFLLFVBQVUsSUFBSSxRQUFRLENBQUMsQ0FBQyxDQUFBO1FBQ3RFLENBQUM7SUFDSCxDQUFDLENBQUE7SUFDRCxLQUFLLENBQUMsS0FBSyxFQUFFLFFBQVEsQ0FBQyxDQUFBO0lBQ3RCLE9BQU8sQ0FBQyxHQUFHLE1BQU0sQ0FBQyxDQUFBO0FBQ3BCLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicG9saWN5LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vLi4vc3JjL2xpYi9hY2Nlc3MvcG9saWN5LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7OztBQWFBLHdDQUVDO0FBR0QsOEJBRUM7QUFFRCwwQ0FPQztBQUVELGtEQVFDO0FBRUQsa0JBYUM7QUFHRCxvREFPQztBQUdELDREQWdCQztBQUVELHdEQW1KQztBQXhPRCxxQ0FBcUU7QUFDckUsOEVBQStDO0FBQy9DLCtDQUlzQjtBQUN0QiwrQ0FBNkM7QUFDN0MseURBQW1EO0FBQ25ELHlEQUFnRTtBQUF2RCwrSEFBQSwwQkFBMEIsT0FBQTtBQUluQyxTQUFnQixjQUFjLENBQUMsR0FBVztJQUN4QyxPQUFPLElBQUEsMkJBQWEsRUFBQyxHQUFHLENBQUMsRUFBRSxXQUFXLEVBQUUsSUFBSSxJQUFJLENBQUE7QUFDbEQsQ0FBQztBQUVELDRGQUE0RjtBQUM1RixTQUFnQixTQUFTLENBQUMsTUFBYyxFQUFFLElBQVk7SUFDcEQsT0FBTyxJQUFBLGlDQUFjLEVBQUMsTUFBTSxFQUFFLElBQUksRUFBRSxFQUFFLENBQUMsRUFBRSxNQUFNLElBQUksSUFBSSxDQUFBO0FBQ3pELENBQUM7QUFFRCxTQUFnQixlQUFlLENBQUMsTUFBYyxFQUFFLElBQVk7SUFDMUQsT0FBTyxDQUNMLENBQUMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUM7UUFDaEMsQ0FBQyxlQUFlLEVBQUUsUUFBUSxDQUFDLENBQUMsUUFBUSxDQUNsQyxJQUFBLGlDQUFjLEVBQUMsTUFBTSxFQUFFLElBQUksQ0FBQyxFQUFFLE1BQU0sSUFBSSxFQUFFLENBQzNDLENBQ0YsQ0FBQTtBQUNILENBQUM7QUFFRCxTQUFnQixtQkFBbUIsQ0FDakMsTUFBYyxFQUNkLElBQVksRUFDWixNQUFjLEVBQ2QsSUFBYTtJQUViLE1BQU0sVUFBVSxHQUFHLElBQUEsaUNBQWMsRUFBQyxNQUFNLEVBQUUsSUFBSSxFQUFFLElBQUksRUFBRSxNQUFNLENBQUMsQ0FBQTtJQUM3RCxPQUFPLE9BQU8sQ0FBQyxVQUFVLEVBQUUsSUFBSSxDQUFDLENBQUE7QUFDbEMsQ0FBQztBQUVELFNBQWdCLEdBQUcsQ0FDakIsU0FBMEIsRUFDMUIsTUFBYyxFQUNkLFVBQTZCLEVBQUU7SUFFL0IsT0FBTyxDQUNMLElBQUEseUJBQVcsRUFBQyxTQUFTLENBQUM7UUFDdEIsQ0FBQyxTQUFTLENBQUMsTUFBTTtZQUNmLENBQUMsTUFBTSxDQUFDLFNBQVM7WUFDakIsTUFBTSxDQUFDLFdBQVcsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUM3QixJQUFBLDJCQUFrQixFQUFDLFNBQVMsRUFBRSxDQUFDLEVBQUUsT0FBTyxDQUFDLENBQzFDLENBQUMsQ0FDTCxDQUFBO0FBQ0gsQ0FBQztBQUVELGtGQUFrRjtBQUNsRixTQUFnQixvQkFBb0IsQ0FDbEMsUUFBZ0IsRUFDaEIsTUFBUztJQUVULE9BQU8sUUFBUSxLQUFLLGlCQUFpQixJQUFJLE1BQU0sS0FBSyxZQUFZO1FBQzlELENBQUMsQ0FBQyxlQUFlO1FBQ2pCLENBQUMsQ0FBQyxNQUFNLENBQUE7QUFDWixDQUFDO0FBRUQsNEVBQTRFO0FBQzVFLFNBQWdCLHdCQUF3QixDQUN0QyxRQUFnQixFQUNoQixNQUE4QixFQUM5QixLQUF5RDtJQUV6RCxJQUNFLFFBQVEsS0FBSyxZQUFZO1FBQ3pCLE1BQU0sQ0FBQyxTQUFTLEtBQUssT0FBTztRQUM1QixNQUFNLENBQUMsaUJBQWlCLEtBQUssZUFBZTtRQUM1QyxLQUFLLENBQUMsS0FBSyxLQUFLLEdBQUc7UUFDbkIsS0FBSyxDQUFDLEtBQUssS0FBSyxTQUFTO1FBQ3pCLE9BQU8sS0FBSyxDQUFDLEVBQUUsS0FBSyxRQUFRO1FBQzVCLGlCQUFpQixDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1FBRWhDLE9BQU8sS0FBSyxDQUFDLEVBQUUsQ0FBQTtJQUNqQixPQUFPLFNBQVMsQ0FBQTtBQUNsQixDQUFDO0FBRUQsU0FBZ0Isc0JBQXNCLENBQ3BDLFFBQWdCLEVBQ2hCLE1BQWUsRUFDZixRQUE0QjtJQUU1QixJQUFJLE1BQU0sS0FBSyxTQUFTO1FBQUUsT0FBTyxJQUFJLENBQUE7SUFDckMsSUFBSSxPQUFPLE1BQU0sS0FBSyxRQUFRLElBQUksTUFBTSxDQUFDLE1BQU0sR0FBRyxJQUFJO1FBQUUsT0FBTyxLQUFLLENBQUE7SUFDcEUsTUFBTSxJQUFJLEdBQUksNEJBQXlDLENBQUMsUUFBUSxDQUFDLElBQUksRUFBRSxDQUFBO0lBQ3ZFLE1BQU0sS0FBSyxHQUE2QjtRQUN0QyxvRUFBb0U7UUFDcEUsV0FBVyxFQUFFLENBQUMsYUFBYSxDQUFDO1FBQzVCLGlCQUFpQixFQUFFLENBQUMsY0FBYyxDQUFDO1FBQ25DLHdFQUF3RTtRQUN4RSxTQUFTLEVBQUUsQ0FBQyxZQUFZLEVBQUUsU0FBUyxDQUFDO1FBQ3BDLFNBQVMsRUFBRSxDQUFDLGVBQWUsQ0FBQztRQUM1QixhQUFhLEVBQUU7WUFDYixTQUFTO1lBQ1QsNkJBQTZCO1lBQzdCLDhCQUE4QjtZQUM5QiwwQkFBMEI7U0FDM0I7UUFDRCwwRUFBMEU7UUFDMUUsT0FBTyxFQUFFLENBQUMsUUFBUSxFQUFFLGVBQWUsQ0FBQztRQUNwQyxNQUFNLEVBQUUsQ0FBQyxtQkFBbUIsQ0FBQztRQUM3QixTQUFTLEVBQUUsQ0FBQyxtQkFBbUIsQ0FBQztRQUNoQywyRUFBMkU7UUFDM0UsT0FBTyxFQUFFLENBQUMsb0JBQW9CLENBQUM7UUFDL0Isa0JBQWtCLEVBQUU7WUFDbEIsbUNBQW1DO1lBQ25DLDBDQUEwQztTQUMzQztRQUNELG9CQUFvQixFQUFFLENBQUMsYUFBYSxDQUFDO1FBQ3JDLGlCQUFpQixFQUFFLENBQUMsV0FBVyxFQUFFLGNBQWMsRUFBRSxhQUFhLENBQUM7UUFDL0QsaUJBQWlCLEVBQUU7WUFDakIsaUJBQWlCO1lBQ2pCLFVBQVU7WUFDVixtQkFBbUI7WUFDbkIsaUNBQWlDO1lBQ2pDLGtEQUFrRDtZQUNsRCxtRUFBbUU7WUFDbkUsdUJBQXVCO1lBQ3ZCLHVCQUF1QjtZQUN2QiwyQ0FBMkM7WUFDM0MscUNBQXFDO1lBQ3JDLHdEQUF3RDtZQUN4RCx3QkFBd0I7U0FDekI7UUFDRCxtRUFBbUU7UUFDbkUsTUFBTSxFQUFFO1lBQ04sMkNBQTJDO1lBQzNDLHFDQUFxQztZQUNyQyw2QkFBNkI7WUFDN0IsMEJBQTBCO1lBQzFCLDBDQUEwQztZQUMxQyxnQ0FBZ0M7WUFDaEMsZ0JBQWdCO1lBQ2hCLG9CQUFvQjtZQUNwQixpRUFBaUU7WUFDakUsK0JBQStCO1lBQy9CLHFCQUFxQjtZQUNyQixtQkFBbUI7WUFDbkIseUJBQXlCO1lBQ3pCLGtCQUFrQjtZQUNsQixjQUFjO1lBQ2Qsd0JBQXdCO1lBQ3hCLGdDQUFnQztZQUNoQywwQ0FBMEM7WUFDMUMsaURBQWlEO1lBQ2pELGFBQWE7WUFDYixnRUFBZ0U7WUFDaEUscUJBQXFCO1lBQ3JCLHNCQUFzQjtZQUN0Qix1Q0FBdUM7WUFDdkMscURBQXFEO1lBQ3JELHdCQUF3QjtTQUN6QjtRQUNELFFBQVEsRUFBRTtZQUNSLFdBQVc7WUFDWCxZQUFZO1lBQ1osb0JBQW9CO1lBQ3BCLGFBQWE7WUFDYiw4REFBOEQ7WUFDOUQsa0JBQWtCO1lBQ2xCLHNFQUFzRTtZQUN0RSxtQkFBbUI7WUFDbkIsYUFBYTtZQUNiLDZCQUE2QjtZQUM3QixvREFBb0Q7WUFDcEQsNENBQTRDO1NBQzdDO1FBQ0QsNkVBQTZFO1FBQzdFLDRFQUE0RTtRQUM1RSxpQkFBaUIsRUFBRTtZQUNqQixXQUFXO1lBQ1gsbUJBQW1CO1lBQ25CLG1CQUFtQjtZQUNuQix1RUFBdUU7WUFDdkUsb0JBQW9CO1lBQ3BCLHNCQUFzQjtTQUN2QjtRQUNELGtCQUFrQixFQUFFO1lBQ2xCLGlCQUFpQjtZQUNqQixTQUFTO1lBQ1Qsb0JBQW9CO1lBQ3BCLG1CQUFtQjtZQUNuQiw4QkFBOEI7WUFDOUIsaUNBQWlDO1lBQ2pDLCtCQUErQjtZQUMvQix3RUFBd0U7WUFDeEUsOENBQThDO1lBQzlDLGtCQUFrQjtZQUNsQiw0QkFBNEI7WUFDNUIsNENBQTRDO1lBQzVDLGlCQUFpQjtZQUNqQixxQkFBcUI7WUFDckIsV0FBVztZQUNYLFlBQVk7WUFDWixvQkFBb0I7WUFDcEIsWUFBWTtZQUNaLGVBQWU7WUFDZixnQkFBZ0I7WUFDaEIsZ0JBQWdCO1lBQ2hCLG1CQUFtQjtZQUNuQixrQkFBa0I7U0FDbkI7UUFDRCxLQUFLLEVBQUUsQ0FBQyxJQUFJLEVBQUUsT0FBTyxFQUFFLFlBQVksRUFBRSxXQUFXLEVBQUUsWUFBWSxDQUFDO1FBQy9ELDJFQUEyRTtRQUMzRSxPQUFPLEVBQUU7WUFDUCxJQUFJO1lBQ0osTUFBTTtZQUNOLFNBQVM7WUFDVCxtQkFBbUI7WUFDbkIsZUFBZTtZQUNmLFlBQVk7WUFDWixZQUFZO1NBQ2I7S0FDRixDQUFBO0lBQ0QsTUFBTSxPQUFPLEdBQUcsSUFBSSxHQUFHLENBQUMsUUFBUSxJQUFJLENBQUMsR0FBRyxJQUFJLEVBQUUsR0FBRyxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUE7SUFDMUUsT0FBTyxNQUFNLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFO1FBQ3ZDLE1BQU0sS0FBSyxHQUFHLEtBQUssQ0FBQyxJQUFJLEVBQUUsQ0FBQTtRQUMxQiw4RUFBOEU7UUFDOUUsSUFBSSxDQUFDLFFBQVEsSUFBSSxRQUFRLEtBQUssaUJBQWlCLElBQUksS0FBSyxLQUFLLFdBQVc7WUFDdEUsT0FBTyxJQUFJLENBQUE7UUFDYixNQUFNLElBQUksR0FBRyxLQUFLLENBQUMsT0FBTyxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUMsQ0FBQTtRQUN2Qyx1RUFBdUU7UUFDdkUsT0FBTyxPQUFPLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxJQUFJLE9BQU8sQ0FBQyxHQUFHLENBQUMsSUFBSSxJQUFJLEVBQUUsQ0FBQyxDQUFBO0lBQ3JELENBQUMsQ0FBQyxDQUFBO0FBQ0osQ0FBQyJ9

package/.medusa/server/src/lib/access/resources.d.ts

@@ -0,0 +1,107 @@
+import type { MedusaRequest } from "@medusajs/framework/http";
+import type { RouteFacts, RouteMethod, RouteRegistration } from "./route-facts";
+import { type AccessPrincipal } from "./permissions";
+export type AccessMode = "public" | "authenticated" | "active-principal";
+export type ResourceScope = "global" | "personal" | "shared";
+export type CapabilityPolicy = {
+    permissions: readonly string[];
+    superuser?: boolean;
+    access?: AccessMode;
+    scopes?: Partial<Record<ResourceScope, readonly string[]>>;
+};
+export type ProfileAction = {
+    operation: string;
+    fieldResource?: string;
+    payload?: (request: MedusaRequest, operation: OperationDescriptor) => readonly string[] | null | Promise<readonly string[] | null>;
+    scope?: {
+        kind: "boolean";
+        field: string;
+    } | {
+        kind: "personal";
+    };
+    forceFields?: readonly string[];
+    fallbackFields?: {
+        permissions: readonly string[];
+        fields: readonly string[];
+    };
+    self?: {
+        parameter: string;
+        fields: readonly string[];
+        responseFields: readonly string[];
+    };
+    redirect?: {
+        destination: string;
+        parameter: string;
+    };
+};
+export type ResourceProfile = {
+    actions?: Partial<Record<RouteMethod, string | ProfileAction>>;
+    item?: {
+        parameter: string;
+        profile: ResourceProfile;
+    };
+    children?: Readonly<Record<string, ResourceProfile>>;
+};
+export type OperationDescriptor = {
+    facts: RouteFacts;
+    resource: string;
+    operation: string;
+    scope: ResourceScope;
+    params: Record<string, string>;
+    fieldResource: string;
+    actorTypes: readonly string[];
+    access: AccessMode;
+    self: boolean;
+    policy: {
+        permissions: string[];
+        superuser?: boolean;
+    };
+    action: ProfileAction;
+    fields?: readonly string[];
+    fieldRequirements: readonly {
+        pattern: RegExp;
+        permissions: readonly string[];
+    }[];
+};
+export type ResourceDefinition = {
+    key: string;
+    namespace?: string;
+    root: string;
+    profile: ResourceProfile;
+    operations: Readonly<Record<string, CapabilityPolicy>>;
+    actorTypes: readonly string[];
+    fields?: readonly string[];
+    fieldRequirements?: readonly {
+        pattern: RegExp;
+        permissions: readonly string[];
+    }[];
+    resolveScope?: (request: MedusaRequest, operation: {
+        facts: RouteFacts;
+        resource: string;
+        operation: string;
+        params: Record<string, string>;
+    }) => ResourceScope | null | Promise<ResourceScope | null>;
+};
+export declare function defineResource<const T extends ResourceDefinition>(definition: T): T;
+export declare function crudProfile(options?: {
+    parameter?: string;
+    read?: string;
+    create?: string;
+    update?: string;
+    delete?: string;
+    children?: Readonly<Record<string, ResourceProfile>>;
+}): ResourceProfile;
+export declare function commandProfile(operation: string, method?: RouteMethod): ResourceProfile;
+export declare function actorOwnedPreferences(options: {
+    parameter: string;
+    member: string;
+    list: string;
+    sharedField: string;
+}): ResourceProfile;
+export declare function profileAction(profile: ResourceProfile, facts: RouteFacts): ProfileAction | null;
+export declare function resourceRoutes(resource: ResourceDefinition): RouteRegistration[];
+export declare function describeResource(resource: ResourceDefinition, facts: RouteFacts, body?: unknown, actorId?: string, resolvedScope?: ResourceScope): OperationDescriptor | null;
+export declare function describeResources(resources: readonly ResourceDefinition[], method: string, url: string, body?: unknown, actorId?: string): OperationDescriptor | null;
+export declare function operationAllowed(principal: AccessPrincipal | null, operation: OperationDescriptor, allows: (permission: string) => boolean): boolean;
+/** Validate host-owned registrations. Native resources cannot be replaced. */
+export declare function validateResources(value: unknown, permissions: readonly string[], reserved: readonly Pick<ResourceDefinition, "key" | "root" | "namespace">[]): ResourceDefinition[];