@abhi1693/medusa-rbac 0.0.1 → 0.0.2

package/.medusa/server/src/lib/access/resources.js

@@ -0,0 +1,363 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defineResource = defineResource;
+exports.crudProfile = crudProfile;
+exports.commandProfile = commandProfile;
+exports.actorOwnedPreferences = actorOwnedPreferences;
+exports.profileAction = profileAction;
+exports.resourceRoutes = resourceRoutes;
+exports.describeResource = describeResource;
+exports.describeResources = describeResources;
+exports.operationAllowed = operationAllowed;
+exports.validateResources = validateResources;
+const route_facts_1 = require("./route-facts");
+const permissions_1 = require("./permissions");
+const immutable_config_1 = require("./immutable-config");
+const identifier = /^[a-z][a-z0-9_-]{0,63}$/;
+const parameter = /^[a-z][a-z0-9_]{0,63}$/;
+const own = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+const safeName = (name) => identifier.test(name) &&
+    !["constructor", "prototype", "__proto__"].includes(name);
+const record = (value) => Boolean(value) && typeof value === "object" && !Array.isArray(value);
+const keys = (value, allowed) => Object.keys(value).every((key) => allowed.includes(key));
+const strings = (value) => Array.isArray(value) &&
+    value.length <= 500 &&
+    value.every((item) => typeof item === "string" && item.length > 0 && item.length <= 200);
+function defineResource(definition) {
+    return definition;
+}
+function crudProfile(options = {}) {
+    const read = options.read || "read";
+    return {
+        actions: { GET: read, POST: options.create || "create" },
+        item: {
+            parameter: options.parameter || "id",
+            profile: {
+                actions: {
+                    GET: read,
+                    POST: options.update || "update",
+                    DELETE: options.delete || "delete",
+                },
+                children: options.children,
+            },
+        },
+    };
+}
+function commandProfile(operation, method = "POST") {
+    return { actions: { [method]: operation } };
+}
+function actorOwnedPreferences(options) {
+    return {
+        children: { [options.list]: { actions: { GET: "read" } } },
+        item: {
+            parameter: options.parameter,
+            profile: {
+                children: {
+                    [options.member]: {
+                        actions: {
+                            GET: "read",
+                            POST: {
+                                operation: "save",
+                                scope: { kind: "boolean", field: options.sharedField },
+                            },
+                            DELETE: { operation: "reset", scope: { kind: "personal" } },
+                        },
+                    },
+                },
+            },
+        },
+    };
+}
+function profileAction(profile, facts) {
+    let node = profile;
+    for (const segment of facts.segments) {
+        if (segment.kind === "literal") {
+            const next = node.children && own(node.children, segment.value)
+                ? node.children[segment.value]
+                : undefined;
+            if (!next)
+                return null;
+            node = next;
+        }
+        else {
+            if (!node.item || node.item.parameter !== segment.name)
+                return null;
+            node = node.item.profile;
+        }
+    }
+    const action = node.actions?.[facts.method];
+    return typeof action === "string" ? { operation: action } : action || null;
+}
+function resourceRoutes(resource) {
+    const routes = [];
+    const visit = (profile, path) => {
+        if (profile.actions)
+            routes.push({ path, methods: Object.keys(profile.actions) });
+        for (const [member, child] of Object.entries(profile.children || {}))
+            visit(child, `${path}/${member}`);
+        if (profile.item)
+            visit(profile.item.profile, `${path}/:${profile.item.parameter}`);
+    };
+    visit(resource.profile, `/${resource.namespace || "admin"}/${resource.root}`);
+    return routes;
+}
+function describeResource(resource, facts, body, actorId, resolvedScope) {
+    const action = profileAction(resource.profile, facts);
+    if (!action)
+        return null;
+    const capability = own(resource.operations, action.operation)
+        ? resource.operations[action.operation]
+        : undefined;
+    if (!capability)
+        return null;
+    let scope = "global";
+    if (action.scope?.kind === "personal")
+        scope = "personal";
+    if (action.scope?.kind === "boolean") {
+        if (!body || typeof body !== "object" || Array.isArray(body))
+            return null;
+        const flag = body[action.scope.field];
+        if (flag !== undefined && typeof flag !== "boolean")
+            return null;
+        scope = flag === true ? "shared" : "personal";
+    }
+    scope = resolvedScope || scope;
+    const scoped = capability.scopes?.[scope];
+    if (capability.scopes && !scoped)
+        return null;
+    const self = Boolean(action.self &&
+        actorId &&
+        own(facts.params, action.self.parameter) &&
+        actorId === facts.params[action.self.parameter] &&
+        body &&
+        typeof body === "object" &&
+        !Array.isArray(body) &&
+        Object.keys(body).every((key) => action.self.fields.includes(key)));
+    return {
+        facts,
+        resource: resource.key,
+        operation: action.operation,
+        scope,
+        params: facts.params,
+        fieldResource: action.fieldResource || resource.key,
+        actorTypes: resource.actorTypes,
+        access: self ? "authenticated" : capability.access || "active-principal",
+        self,
+        policy: self
+            ? { permissions: [] }
+            : {
+                permissions: [...capability.permissions, ...(scoped || [])],
+                ...(capability.superuser ? { superuser: true } : {}),
+            },
+        action: self
+            ? { ...action, forceFields: action.self.responseFields }
+            : action,
+        fields: resource.fields,
+        fieldRequirements: resource.fieldRequirements || [],
+    };
+}
+function describeResources(resources, method, url, body, actorId) {
+    const facts = (0, route_facts_1.matchRoute)(resources.flatMap(resourceRoutes), method, url);
+    if (!facts)
+        return null;
+    const resource = resources.find((definition) => definition.root === facts.root &&
+        (definition.namespace || "admin") === facts.namespace);
+    return describeResource(resource, facts, body, actorId);
+}
+function operationAllowed(principal, operation, allows) {
+    if (operation.access === "public")
+        return (operation.policy.permissions.length === 0 && !operation.policy.superuser);
+    if (principal &&
+        (0, permissions_1.isSuperuser)(principal) &&
+        operation.facts.namespace === "admin")
+        return true;
+    return Boolean(principal &&
+        operation.actorTypes.includes(principal.actor_type) &&
+        (operation.access === "authenticated" || principal.active) &&
+        (!operation.policy.superuser || (0, permissions_1.isSuperuser)(principal)) &&
+        operation.policy.permissions.every(allows));
+}
+/** Validate host-owned registrations. Native resources cannot be replaced. */
+function validateResources(value, permissions, reserved) {
+    const invalid = () => {
+        throw new Error("Invalid, conflicting or reserved resource registration");
+    };
+    if (!Array.isArray(value) || value.length > 100)
+        return invalid();
+    const resourceKeys = new Set(reserved.map((resource) => resource.key));
+    const roots = new Set(reserved.map((resource) => `${resource.namespace || "admin"}/${resource.root}`));
+    const registered = new Set(permissions);
+    const permissionList = (list) => strings(list) && list.every((permission) => registered.has(permission));
+    for (const definition of value) {
+        if (!record(definition) ||
+            !keys(definition, [
+                "key",
+                "namespace",
+                "root",
+                "profile",
+                "operations",
+                "actorTypes",
+                "fields",
+                "fieldRequirements",
+                "resolveScope",
+            ]) ||
+            typeof definition.key !== "string" ||
+            !safeName(definition.key) ||
+            typeof definition.root !== "string" ||
+            !safeName(definition.root) ||
+            (definition.namespace !== undefined &&
+                (typeof definition.namespace !== "string" ||
+                    !safeName(definition.namespace))) ||
+            !strings(definition.actorTypes) ||
+            !definition.actorTypes.length ||
+            !record(definition.operations) ||
+            !Object.keys(definition.operations).length ||
+            (definition.fields !== undefined && !strings(definition.fields)) ||
+            (definition.resolveScope !== undefined &&
+                typeof definition.resolveScope !== "function"))
+            return invalid();
+        const root = `${definition.namespace || "admin"}/${definition.root}`;
+        if (resourceKeys.has(definition.key) || roots.has(root))
+            return invalid();
+        resourceKeys.add(definition.key);
+        roots.add(root);
+        for (const [operation, capability] of Object.entries(definition.operations)) {
+            if (!safeName(operation) ||
+                !record(capability) ||
+                !keys(capability, ["permissions", "superuser", "access", "scopes"]) ||
+                !permissionList(capability.permissions) ||
+                (capability.superuser !== undefined &&
+                    typeof capability.superuser !== "boolean") ||
+                (capability.access !== undefined &&
+                    !["public", "authenticated", "active-principal"].includes(capability.access)))
+                return invalid();
+            if (capability.access === "public" &&
+                (capability.permissions.length > 0 ||
+                    capability.superuser === true ||
+                    capability.scopes !== undefined))
+                return invalid();
+            if (capability.scopes !== undefined &&
+                (!record(capability.scopes) ||
+                    !Object.keys(capability.scopes).length ||
+                    Object.entries(capability.scopes).some(([scope, grants]) => !["global", "personal", "shared"].includes(scope) ||
+                        !permissionList(grants))))
+                return invalid();
+        }
+        if (definition.fieldRequirements !== undefined &&
+            (!Array.isArray(definition.fieldRequirements) ||
+                definition.fieldRequirements.length > 100 ||
+                definition.fieldRequirements.some((requirement) => !record(requirement) ||
+                    !keys(requirement, ["pattern", "permissions"]) ||
+                    !(requirement.pattern instanceof RegExp) ||
+                    requirement.pattern.global ||
+                    requirement.pattern.sticky ||
+                    !permissionList(requirement.permissions))))
+            return invalid();
+        const seen = new Set();
+        const validateProfile = (profile, depth, bound) => {
+            if (depth > 12 ||
+                !record(profile) ||
+                seen.has(profile) ||
+                !keys(profile, ["actions", "item", "children"]) ||
+                !Object.keys(profile).length)
+                return invalid();
+            seen.add(profile);
+            if (profile.actions !== undefined) {
+                if (!record(profile.actions) || !Object.keys(profile.actions).length)
+                    return invalid();
+                for (const [method, rawAction] of Object.entries(profile.actions)) {
+                    if (!["GET", "POST", "PUT", "PATCH", "DELETE"].includes(method))
+                        return invalid();
+                    const action = typeof rawAction === "string" ? { operation: rawAction } : rawAction;
+                    if (!record(action) ||
+                        !keys(action, [
+                            "operation",
+                            "fieldResource",
+                            "payload",
+                            "scope",
+                            "forceFields",
+                            "fallbackFields",
+                            "self",
+                            "redirect",
+                        ]) ||
+                        typeof action.operation !== "string" ||
+                        !own(definition.operations, action.operation) ||
+                        (action.fieldResource !== undefined &&
+                            (typeof action.fieldResource !== "string" ||
+                                !safeName(action.fieldResource))) ||
+                        (action.payload !== undefined &&
+                            typeof action.payload !== "function") ||
+                        (action.forceFields !== undefined && !strings(action.forceFields)))
+                        return invalid();
+                    if (action.scope !== undefined &&
+                        (!record(action.scope) ||
+                            !keys(action.scope, ["kind", "field"]) ||
+                            !["personal", "boolean"].includes(action.scope.kind) ||
+                            (action.scope.kind === "boolean" &&
+                                (typeof action.scope.field !== "string" ||
+                                    !parameter.test(action.scope.field)))))
+                        return invalid();
+                    if (action.fallbackFields !== undefined &&
+                        (!record(action.fallbackFields) ||
+                            !keys(action.fallbackFields, ["permissions", "fields"]) ||
+                            !permissionList(action.fallbackFields.permissions) ||
+                            !strings(action.fallbackFields.fields)))
+                        return invalid();
+                    if (action.self !== undefined &&
+                        (!record(action.self) ||
+                            !keys(action.self, ["parameter", "fields", "responseFields"]) ||
+                            typeof action.self.parameter !== "string" ||
+                            !parameter.test(action.self.parameter) ||
+                            !bound.includes(action.self.parameter) ||
+                            !strings(action.self.fields) ||
+                            !strings(action.self.responseFields)))
+                        return invalid();
+                    if (action.redirect !== undefined &&
+                        (!record(action.redirect) ||
+                            !keys(action.redirect, ["destination", "parameter"]) ||
+                            typeof action.redirect.destination !== "string" ||
+                            !/^\/(?:[a-z0-9_-]+|:[a-z][a-z0-9_]*)(?:\/(?:[a-z0-9_-]+|:[a-z][a-z0-9_]*))*$/.test(action.redirect.destination) ||
+                            typeof action.redirect.parameter !== "string" ||
+                            !parameter.test(action.redirect.parameter) ||
+                            !bound.includes(action.redirect.parameter)))
+                        return invalid();
+                }
+            }
+            if (profile.children !== undefined) {
+                if (!record(profile.children) || !Object.keys(profile.children).length)
+                    return invalid();
+                for (const [member, child] of Object.entries(profile.children)) {
+                    if (!safeName(member))
+                        return invalid();
+                    validateProfile(child, depth + 1, bound);
+                }
+            }
+            if (profile.item !== undefined) {
+                if (!record(profile.item) ||
+                    !keys(profile.item, ["parameter", "profile"]) ||
+                    typeof profile.item.parameter !== "string" ||
+                    !parameter.test(profile.item.parameter) ||
+                    !safeName(profile.item.parameter))
+                    return invalid();
+                validateProfile(profile.item.profile, depth + 1, [
+                    ...bound,
+                    profile.item.parameter,
+                ]);
+            }
+            seen.delete(profile);
+        };
+        validateProfile(definition.profile, 0, []);
+        const routes = resourceRoutes(definition);
+        if (!routes.length ||
+            routes.length > 500 ||
+            routes.some((route) => {
+                const params = route.path
+                    .split("/")
+                    .filter((segment) => segment.startsWith(":"));
+                return new Set(params).size !== params.length;
+            }))
+            return invalid();
+    }
+    return (0, immutable_config_1.immutableConfig)(value);
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVzb3VyY2VzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vLi4vc3JjL2xpYi9hY2Nlc3MvcmVzb3VyY2VzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBK0ZBLHdDQUlDO0FBRUQsa0NBeUJDO0FBRUQsd0NBS0M7QUFFRCxzREEwQkM7QUFFRCxzQ0FvQkM7QUFFRCx3Q0FjQztBQUVELDRDQXdEQztBQUVELDhDQWVDO0FBRUQsNENBc0JDO0FBR0QsOENBc09DO0FBamhCRCwrQ0FBMEM7QUFDMUMsK0NBQWlFO0FBQ2pFLHlEQUFvRDtBQUVwRCxNQUFNLFVBQVUsR0FBRyx5QkFBeUIsQ0FBQTtBQUM1QyxNQUFNLFNBQVMsR0FBRyx3QkFBd0IsQ0FBQTtBQUMxQyxNQUFNLEdBQUcsR0FBRyxDQUFDLEtBQWEsRUFBRSxHQUFXLEVBQUUsRUFBRSxDQUN6QyxNQUFNLENBQUMsU0FBUyxDQUFDLGNBQWMsQ0FBQyxJQUFJLENBQUMsS0FBSyxFQUFFLEdBQUcsQ0FBQyxDQUFBO0FBQ2xELE1BQU0sUUFBUSxHQUFHLENBQUMsSUFBWSxFQUFFLEVBQUUsQ0FDaEMsVUFBVSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUM7SUFDckIsQ0FBQyxDQUFDLGFBQWEsRUFBRSxXQUFXLEVBQUUsV0FBVyxDQUFDLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxDQUFBO0FBQzNELE1BQU0sTUFBTSxHQUFHLENBQUMsS0FBYyxFQUFvQyxFQUFFLENBQ2xFLE9BQU8sQ0FBQyxLQUFLLENBQUMsSUFBSSxPQUFPLEtBQUssS0FBSyxRQUFRLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFBO0FBQ3RFLE1BQU0sSUFBSSxHQUFHLENBQUMsS0FBYSxFQUFFLE9BQTBCLEVBQUUsRUFBRSxDQUN6RCxNQUFNLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLEdBQUcsRUFBRSxFQUFFLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFBO0FBQzFELE1BQU0sT0FBTyxHQUFHLENBQUMsS0FBYyxFQUFxQixFQUFFLENBQ3BELEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDO0lBQ3BCLEtBQUssQ0FBQyxNQUFNLElBQUksR0FBRztJQUNuQixLQUFLLENBQUMsS0FBSyxDQUNULENBQUMsSUFBSSxFQUFFLEVBQUUsQ0FBQyxPQUFPLElBQUksS0FBSyxRQUFRLElBQUksSUFBSSxDQUFDLE1BQU0sR0FBRyxDQUFDLElBQUksSUFBSSxDQUFDLE1BQU0sSUFBSSxHQUFHLENBQzVFLENBQUE7QUF5RUgsU0FBZ0IsY0FBYyxDQUM1QixVQUFhO0lBRWIsT0FBTyxVQUFVLENBQUE7QUFDbkIsQ0FBQztBQUVELFNBQWdCLFdBQVcsQ0FDekIsVUFPSSxFQUFFO0lBRU4sTUFBTSxJQUFJLEdBQUcsT0FBTyxDQUFDLElBQUksSUFBSSxNQUFNLENBQUE7SUFDbkMsT0FBTztRQUNMLE9BQU8sRUFBRSxFQUFFLEdBQUcsRUFBRSxJQUFJLEVBQUUsSUFBSSxFQUFFLE9BQU8sQ0FBQyxNQUFNLElBQUksUUFBUSxFQUFFO1FBQ3hELElBQUksRUFBRTtZQUNKLFNBQVMsRUFBRSxPQUFPLENBQUMsU0FBUyxJQUFJLElBQUk7WUFDcEMsT0FBTyxFQUFFO2dCQUNQLE9BQU8sRUFBRTtvQkFDUCxHQUFHLEVBQUUsSUFBSTtvQkFDVCxJQUFJLEVBQUUsT0FBTyxDQUFDLE1BQU0sSUFBSSxRQUFRO29CQUNoQyxNQUFNLEVBQUUsT0FBTyxDQUFDLE1BQU0sSUFBSSxRQUFRO2lCQUNuQztnQkFDRCxRQUFRLEVBQUUsT0FBTyxDQUFDLFFBQVE7YUFDM0I7U0FDRjtLQUNGLENBQUE7QUFDSCxDQUFDO0FBRUQsU0FBZ0IsY0FBYyxDQUM1QixTQUFpQixFQUNqQixTQUFzQixNQUFNO0lBRTVCLE9BQU8sRUFBRSxPQUFPLEVBQUUsRUFBRSxDQUFDLE1BQU0sQ0FBQyxFQUFFLFNBQVMsRUFBRSxFQUFFLENBQUE7QUFDN0MsQ0FBQztBQUVELFNBQWdCLHFCQUFxQixDQUFDLE9BS3JDO0lBQ0MsT0FBTztRQUNMLFFBQVEsRUFBRSxFQUFFLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxFQUFFLEVBQUUsT0FBTyxFQUFFLEVBQUUsR0FBRyxFQUFFLE1BQU0sRUFBRSxFQUFFLEVBQUU7UUFDMUQsSUFBSSxFQUFFO1lBQ0osU0FBUyxFQUFFLE9BQU8sQ0FBQyxTQUFTO1lBQzVCLE9BQU8sRUFBRTtnQkFDUCxRQUFRLEVBQUU7b0JBQ1IsQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLEVBQUU7d0JBQ2hCLE9BQU8sRUFBRTs0QkFDUCxHQUFHLEVBQUUsTUFBTTs0QkFDWCxJQUFJLEVBQUU7Z0NBQ0osU0FBUyxFQUFFLE1BQU07Z0NBQ2pCLEtBQUssRUFBRSxFQUFFLElBQUksRUFBRSxTQUFTLEVBQUUsS0FBSyxFQUFFLE9BQU8sQ0FBQyxXQUFXLEVBQUU7NkJBQ3ZEOzRCQUNELE1BQU0sRUFBRSxFQUFFLFNBQVMsRUFBRSxPQUFPLEVBQUUsS0FBSyxFQUFFLEVBQUUsSUFBSSxFQUFFLFVBQVUsRUFBRSxFQUFFO3lCQUM1RDtxQkFDRjtpQkFDRjthQUNGO1NBQ0Y7S0FDRixDQUFBO0FBQ0gsQ0FBQztBQUVELFNBQWdCLGFBQWEsQ0FDM0IsT0FBd0IsRUFDeEIsS0FBaUI7SUFFakIsSUFBSSxJQUFJLEdBQUcsT0FBTyxDQUFBO0lBQ2xCLEtBQUssTUFBTSxPQUFPLElBQUksS0FBSyxDQUFDLFFBQVEsRUFBRSxDQUFDO1FBQ3JDLElBQUksT0FBTyxDQUFDLElBQUksS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUMvQixNQUFNLElBQUksR0FDUixJQUFJLENBQUMsUUFBUSxJQUFJLEdBQUcsQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLE9BQU8sQ0FBQyxLQUFLLENBQUM7Z0JBQ2hELENBQUMsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUM7Z0JBQzlCLENBQUMsQ0FBQyxTQUFTLENBQUE7WUFDZixJQUFJLENBQUMsSUFBSTtnQkFBRSxPQUFPLElBQUksQ0FBQTtZQUN0QixJQUFJLEdBQUcsSUFBSSxDQUFBO1FBQ2IsQ0FBQzthQUFNLENBQUM7WUFDTixJQUFJLENBQUMsSUFBSSxDQUFDLElBQUksSUFBSSxJQUFJLENBQUMsSUFBSSxDQUFDLFNBQVMsS0FBSyxPQUFPLENBQUMsSUFBSTtnQkFBRSxPQUFPLElBQUksQ0FBQTtZQUNuRSxJQUFJLEdBQUcsSUFBSSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUE7UUFDMUIsQ0FBQztJQUNILENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBRyxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUMsS0FBSyxDQUFDLE1BQXFCLENBQUMsQ0FBQTtJQUMxRCxPQUFPLE9BQU8sTUFBTSxLQUFLLFFBQVEsQ0FBQyxDQUFDLENBQUMsRUFBRSxTQUFTLEVBQUUsTUFBTSxFQUFFLENBQUMsQ0FBQyxDQUFDLE1BQU0sSUFBSSxJQUFJLENBQUE7QUFDNUUsQ0FBQztBQUVELFNBQWdCLGNBQWMsQ0FDNUIsUUFBNEI7SUFFNUIsTUFBTSxNQUFNLEdBQXdCLEVBQUUsQ0FBQTtJQUN0QyxNQUFNLEtBQUssR0FBRyxDQUFDLE9BQXdCLEVBQUUsSUFBWSxFQUFFLEVBQUU7UUFDdkQsSUFBSSxPQUFPLENBQUMsT0FBTztZQUNqQixNQUFNLENBQUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFFLE9BQU8sRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDLENBQUE7UUFDOUQsS0FBSyxNQUFNLENBQUMsTUFBTSxFQUFFLEtBQUssQ0FBQyxJQUFJLE1BQU0sQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLFFBQVEsSUFBSSxFQUFFLENBQUM7WUFDbEUsS0FBSyxDQUFDLEtBQUssRUFBRSxHQUFHLElBQUksSUFBSSxNQUFNLEVBQUUsQ0FBQyxDQUFBO1FBQ25DLElBQUksT0FBTyxDQUFDLElBQUk7WUFDZCxLQUFLLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsR0FBRyxJQUFJLEtBQUssT0FBTyxDQUFDLElBQUksQ0FBQyxTQUFTLEVBQUUsQ0FBQyxDQUFBO0lBQ3JFLENBQUMsQ0FBQTtJQUNELEtBQUssQ0FBQyxRQUFRLENBQUMsT0FBTyxFQUFFLElBQUksUUFBUSxDQUFDLFNBQVMsSUFBSSxPQUFPLElBQUksUUFBUSxDQUFDLElBQUksRUFBRSxDQUFDLENBQUE7SUFDN0UsT0FBTyxNQUFNLENBQUE7QUFDZixDQUFDO0FBRUQsU0FBZ0IsZ0JBQWdCLENBQzlCLFFBQTRCLEVBQzVCLEtBQWlCLEVBQ2pCLElBQWMsRUFDZCxPQUFnQixFQUNoQixhQUE2QjtJQUU3QixNQUFNLE1BQU0sR0FBRyxhQUFhLENBQUMsUUFBUSxDQUFDLE9BQU8sRUFBRSxLQUFLLENBQUMsQ0FBQTtJQUNyRCxJQUFJLENBQUMsTUFBTTtRQUFFLE9BQU8sSUFBSSxDQUFBO0lBQ3hCLE1BQU0sVUFBVSxHQUFHLEdBQUcsQ0FBQyxRQUFRLENBQUMsVUFBVSxFQUFFLE1BQU0sQ0FBQyxTQUFTLENBQUM7UUFDM0QsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQztRQUN2QyxDQUFDLENBQUMsU0FBUyxDQUFBO0lBQ2IsSUFBSSxDQUFDLFVBQVU7UUFBRSxPQUFPLElBQUksQ0FBQTtJQUM1QixJQUFJLEtBQUssR0FBa0IsUUFBUSxDQUFBO0lBQ25DLElBQUksTUFBTSxDQUFDLEtBQUssRUFBRSxJQUFJLEtBQUssVUFBVTtRQUFFLEtBQUssR0FBRyxVQUFVLENBQUE7SUFDekQsSUFBSSxNQUFNLENBQUMsS0FBSyxFQUFFLElBQUksS0FBSyxTQUFTLEVBQUUsQ0FBQztRQUNyQyxJQUFJLENBQUMsSUFBSSxJQUFJLE9BQU8sSUFBSSxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQztZQUFFLE9BQU8sSUFBSSxDQUFBO1FBQ3pFLE1BQU0sSUFBSSxHQUFJLElBQWdDLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsQ0FBQTtRQUNsRSxJQUFJLElBQUksS0FBSyxTQUFTLElBQUksT0FBTyxJQUFJLEtBQUssU0FBUztZQUFFLE9BQU8sSUFBSSxDQUFBO1FBQ2hFLEtBQUssR0FBRyxJQUFJLEtBQUssSUFBSSxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLFVBQVUsQ0FBQTtJQUMvQyxDQUFDO0lBQ0QsS0FBSyxHQUFHLGFBQWEsSUFBSSxLQUFLLENBQUE7SUFDOUIsTUFBTSxNQUFNLEdBQUcsVUFBVSxDQUFDLE1BQU0sRUFBRSxDQUFDLEtBQUssQ0FBQyxDQUFBO0lBQ3pDLElBQUksVUFBVSxDQUFDLE1BQU0sSUFBSSxDQUFDLE1BQU07UUFBRSxPQUFPLElBQUksQ0FBQTtJQUM3QyxNQUFNLElBQUksR0FBRyxPQUFPLENBQ2xCLE1BQU0sQ0FBQyxJQUFJO1FBQ1gsT0FBTztRQUNQLEdBQUcsQ0FBQyxLQUFLLENBQUMsTUFBTSxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDO1FBQ3hDLE9BQU8sS0FBSyxLQUFLLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDO1FBQy9DLElBQUk7UUFDSixPQUFPLElBQUksS0FBSyxRQUFRO1FBQ3hCLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUM7UUFDcEIsTUFBTSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxHQUFHLEVBQUUsRUFBRSxDQUFDLE1BQU0sQ0FBQyxJQUFLLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUNwRSxDQUFBO0lBQ0QsT0FBTztRQUNMLEtBQUs7UUFDTCxRQUFRLEVBQUUsUUFBUSxDQUFDLEdBQUc7UUFDdEIsU0FBUyxFQUFFLE1BQU0sQ0FBQyxTQUFTO1FBQzNCLEtBQUs7UUFDTCxNQUFNLEVBQUUsS0FBSyxDQUFDLE1BQU07UUFDcEIsYUFBYSxFQUFFLE1BQU0sQ0FBQyxhQUFhLElBQUksUUFBUSxDQUFDLEdBQUc7UUFDbkQsVUFBVSxFQUFFLFFBQVEsQ0FBQyxVQUFVO1FBQy9CLE1BQU0sRUFBRSxJQUFJLENBQUMsQ0FBQyxDQUFDLGVBQWUsQ0FBQyxDQUFDLENBQUMsVUFBVSxDQUFDLE1BQU0sSUFBSSxrQkFBa0I7UUFDeEUsSUFBSTtRQUNKLE1BQU0sRUFBRSxJQUFJO1lBQ1YsQ0FBQyxDQUFDLEVBQUUsV0FBVyxFQUFFLEVBQUUsRUFBRTtZQUNyQixDQUFDLENBQUM7Z0JBQ0UsV0FBVyxFQUFFLENBQUMsR0FBRyxVQUFVLENBQUMsV0FBVyxFQUFFLEdBQUcsQ0FBQyxNQUFNLElBQUksRUFBRSxDQUFDLENBQUM7Z0JBQzNELEdBQUcsQ0FBQyxVQUFVLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxFQUFFLFNBQVMsRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO2FBQ3JEO1FBQ0wsTUFBTSxFQUFFLElBQUk7WUFDVixDQUFDLENBQUMsRUFBRSxHQUFHLE1BQU0sRUFBRSxXQUFXLEVBQUUsTUFBTSxDQUFDLElBQUssQ0FBQyxjQUFjLEVBQUU7WUFDekQsQ0FBQyxDQUFDLE1BQU07UUFDVixNQUFNLEVBQUUsUUFBUSxDQUFDLE1BQU07UUFDdkIsaUJBQWlCLEVBQUUsUUFBUSxDQUFDLGlCQUFpQixJQUFJLEVBQUU7S0FDcEQsQ0FBQTtBQUNILENBQUM7QUFFRCxTQUFnQixpQkFBaUIsQ0FDL0IsU0FBd0MsRUFDeEMsTUFBYyxFQUNkLEdBQVcsRUFDWCxJQUFjLEVBQ2QsT0FBZ0I7SUFFaEIsTUFBTSxLQUFLLEdBQUcsSUFBQSx3QkFBVSxFQUFDLFNBQVMsQ0FBQyxPQUFPLENBQUMsY0FBYyxDQUFDLEVBQUUsTUFBTSxFQUFFLEdBQUcsQ0FBQyxDQUFBO0lBQ3hFLElBQUksQ0FBQyxLQUFLO1FBQUUsT0FBTyxJQUFJLENBQUE7SUFDdkIsTUFBTSxRQUFRLEdBQUcsU0FBUyxDQUFDLElBQUksQ0FDN0IsQ0FBQyxVQUFVLEVBQUUsRUFBRSxDQUNiLFVBQVUsQ0FBQyxJQUFJLEtBQUssS0FBSyxDQUFDLElBQUk7UUFDOUIsQ0FBQyxVQUFVLENBQUMsU0FBUyxJQUFJLE9BQU8sQ0FBQyxLQUFLLEtBQUssQ0FBQyxTQUFTLENBQ3ZELENBQUE7SUFDRixPQUFPLGdCQUFnQixDQUFDLFFBQVEsRUFBRSxLQUFLLEVBQUUsSUFBSSxFQUFFLE9BQU8sQ0FBQyxDQUFBO0FBQ3pELENBQUM7QUFFRCxTQUFnQixnQkFBZ0IsQ0FDOUIsU0FBaUMsRUFDakMsU0FBOEIsRUFDOUIsTUFBdUM7SUFFdkMsSUFBSSxTQUFTLENBQUMsTUFBTSxLQUFLLFFBQVE7UUFDL0IsT0FBTyxDQUNMLFNBQVMsQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLE1BQU0sS0FBSyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FDekUsQ0FBQTtJQUNILElBQ0UsU0FBUztRQUNULElBQUEseUJBQVcsRUFBQyxTQUFTLENBQUM7UUFDdEIsU0FBUyxDQUFDLEtBQUssQ0FBQyxTQUFTLEtBQUssT0FBTztRQUVyQyxPQUFPLElBQUksQ0FBQTtJQUNiLE9BQU8sT0FBTyxDQUNaLFNBQVM7UUFDVCxTQUFTLENBQUMsVUFBVSxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsVUFBVSxDQUFDO1FBQ25ELENBQUMsU0FBUyxDQUFDLE1BQU0sS0FBSyxlQUFlLElBQUksU0FBUyxDQUFDLE1BQU0sQ0FBQztRQUMxRCxDQUFDLENBQUMsU0FBUyxDQUFDLE1BQU0sQ0FBQyxTQUFTLElBQUksSUFBQSx5QkFBVyxFQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQ3ZELFNBQVMsQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsQ0FDM0MsQ0FBQTtBQUNILENBQUM7QUFFRCw4RUFBOEU7QUFDOUUsU0FBZ0IsaUJBQWlCLENBQy9CLEtBQWMsRUFDZCxXQUE4QixFQUM5QixRQUEyRTtJQUUzRSxNQUFNLE9BQU8sR0FBRyxHQUFVLEVBQUU7UUFDMUIsTUFBTSxJQUFJLEtBQUssQ0FBQyx3REFBd0QsQ0FBQyxDQUFBO0lBQzNFLENBQUMsQ0FBQTtJQUNELElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxJQUFJLEtBQUssQ0FBQyxNQUFNLEdBQUcsR0FBRztRQUFFLE9BQU8sT0FBTyxFQUFFLENBQUE7SUFDakUsTUFBTSxZQUFZLEdBQUcsSUFBSSxHQUFHLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUE7SUFDdEUsTUFBTSxLQUFLLEdBQUcsSUFBSSxHQUFHLENBQ25CLFFBQVEsQ0FBQyxHQUFHLENBQ1YsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLEdBQUcsUUFBUSxDQUFDLFNBQVMsSUFBSSxPQUFPLElBQUksUUFBUSxDQUFDLElBQUksRUFBRSxDQUNsRSxDQUNGLENBQUE7SUFDRCxNQUFNLFVBQVUsR0FBRyxJQUFJLEdBQUcsQ0FBQyxXQUFXLENBQUMsQ0FBQTtJQUN2QyxNQUFNLGNBQWMsR0FBRyxDQUFDLElBQWEsRUFBRSxFQUFFLENBQ3ZDLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsVUFBVSxFQUFFLEVBQUUsQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUE7SUFDekUsS0FBSyxNQUFNLFVBQVUsSUFBSSxLQUFLLEVBQUUsQ0FBQztRQUMvQixJQUNFLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQztZQUNuQixDQUFDLElBQUksQ0FBQyxVQUFVLEVBQUU7Z0JBQ2hCLEtBQUs7Z0JBQ0wsV0FBVztnQkFDWCxNQUFNO2dCQUNOLFNBQVM7Z0JBQ1QsWUFBWTtnQkFDWixZQUFZO2dCQUNaLFFBQVE7Z0JBQ1IsbUJBQW1CO2dCQUNuQixjQUFjO2FBQ2YsQ0FBQztZQUNGLE9BQU8sVUFBVSxDQUFDLEdBQUcsS0FBSyxRQUFRO1lBQ2xDLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxHQUFHLENBQUM7WUFDekIsT0FBTyxVQUFVLENBQUMsSUFBSSxLQUFLLFFBQVE7WUFDbkMsQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQztZQUMxQixDQUFDLFVBQVUsQ0FBQyxTQUFTLEtBQUssU0FBUztnQkFDakMsQ0FBQyxPQUFPLFVBQVUsQ0FBQyxTQUFTLEtBQUssUUFBUTtvQkFDdkMsQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUM7WUFDckMsQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLFVBQVUsQ0FBQztZQUMvQixDQUFDLFVBQVUsQ0FBQyxVQUFVLENBQUMsTUFBTTtZQUM3QixDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUMsVUFBVSxDQUFDO1lBQzlCLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsVUFBVSxDQUFDLENBQUMsTUFBTTtZQUMxQyxDQUFDLFVBQVUsQ0FBQyxNQUFNLEtBQUssU0FBUyxJQUFJLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUMsQ0FBQztZQUNoRSxDQUFDLFVBQVUsQ0FBQyxZQUFZLEtBQUssU0FBUztnQkFDcEMsT0FBTyxVQUFVLENBQUMsWUFBWSxLQUFLLFVBQVUsQ0FBQztZQUVoRCxPQUFPLE9BQU8sRUFBRSxDQUFBO1FBQ2xCLE1BQU0sSUFBSSxHQUFHLEdBQUcsVUFBVSxDQUFDLFNBQVMsSUFBSSxPQUFPLElBQUksVUFBVSxDQUFDLElBQUksRUFBRSxDQUFBO1FBQ3BFLElBQUksWUFBWSxDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDLElBQUksS0FBSyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUM7WUFBRSxPQUFPLE9BQU8sRUFBRSxDQUFBO1FBQ3pFLFlBQVksQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQyxDQUFBO1FBQ2hDLEtBQUssQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLENBQUE7UUFDZixLQUFLLE1BQU0sQ0FBQyxTQUFTLEVBQUUsVUFBVSxDQUFDLElBQUksTUFBTSxDQUFDLE9BQU8sQ0FDbEQsVUFBVSxDQUFDLFVBQVUsQ0FDdEIsRUFBRSxDQUFDO1lBQ0YsSUFDRSxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUM7Z0JBQ3BCLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQztnQkFDbkIsQ0FBQyxJQUFJLENBQUMsVUFBVSxFQUFFLENBQUMsYUFBYSxFQUFFLFdBQVcsRUFBRSxRQUFRLEVBQUUsUUFBUSxDQUFDLENBQUM7Z0JBQ25FLENBQUMsY0FBYyxDQUFDLFVBQVUsQ0FBQyxXQUFXLENBQUM7Z0JBQ3ZDLENBQUMsVUFBVSxDQUFDLFNBQVMsS0FBSyxTQUFTO29CQUNqQyxPQUFPLFVBQVUsQ0FBQyxTQUFTLEtBQUssU0FBUyxDQUFDO2dCQUM1QyxDQUFDLFVBQVUsQ0FBQyxNQUFNLEtBQUssU0FBUztvQkFDOUIsQ0FBQyxDQUFDLFFBQVEsRUFBRSxlQUFlLEVBQUUsa0JBQWtCLENBQUMsQ0FBQyxRQUFRLENBQ3ZELFVBQVUsQ0FBQyxNQUFnQixDQUM1QixDQUFDO2dCQUVKLE9BQU8sT0FBTyxFQUFFLENBQUE7WUFDbEIsSUFDRSxVQUFVLENBQUMsTUFBTSxLQUFLLFFBQVE7Z0JBQzlCLENBQUUsVUFBVSxDQUFDLFdBQXdCLENBQUMsTUFBTSxHQUFHLENBQUM7b0JBQzlDLFVBQVUsQ0FBQyxTQUFTLEtBQUssSUFBSTtvQkFDN0IsVUFBVSxDQUFDLE1BQU0sS0FBSyxTQUFTLENBQUM7Z0JBRWxDLE9BQU8sT0FBTyxFQUFFLENBQUE7WUFDbEIsSUFDRSxVQUFVLENBQUMsTUFBTSxLQUFLLFNBQVM7Z0JBQy9CLENBQUMsQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQztvQkFDekIsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUMsQ0FBQyxNQUFNO29CQUN0QyxNQUFNLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUMsQ0FBQyxJQUFJLENBQ3BDLENBQUMsQ0FBQyxLQUFLLEVBQUUsTUFBTSxDQUFDLEVBQUUsRUFBRSxDQUNsQixDQUFDLENBQUMsUUFBUSxFQUFFLFVBQVUsRUFBRSxRQUFRLENBQUMsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDO3dCQUNqRCxDQUFDLGNBQWMsQ0FBQyxNQUFNLENBQUMsQ0FDMUIsQ0FBQztnQkFFSixPQUFPLE9BQU8sRUFBRSxDQUFBO1FBQ3BCLENBQUM7UUFDRCxJQUNFLFVBQVUsQ0FBQyxpQkFBaUIsS0FBSyxTQUFTO1lBQzFDLENBQUMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxpQkFBaUIsQ0FBQztnQkFDM0MsVUFBVSxDQUFDLGlCQUFpQixDQUFDLE1BQU0sR0FBRyxHQUFHO2dCQUN6QyxVQUFVLENBQUMsaUJBQWlCLENBQUMsSUFBSSxDQUMvQixDQUFDLFdBQVcsRUFBRSxFQUFFLENBQ2QsQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDO29CQUNwQixDQUFDLElBQUksQ0FBQyxXQUFXLEVBQUUsQ0FBQyxTQUFTLEVBQUUsYUFBYSxDQUFDLENBQUM7b0JBQzlDLENBQUMsQ0FBQyxXQUFXLENBQUMsT0FBTyxZQUFZLE1BQU0sQ0FBQztvQkFDeEMsV0FBVyxDQUFDLE9BQU8sQ0FBQyxNQUFNO29CQUMxQixXQUFXLENBQUMsT0FBTyxDQUFDLE1BQU07b0JBQzFCLENBQUMsY0FBYyxDQUFDLFdBQVcsQ0FBQyxXQUFXLENBQUMsQ0FDM0MsQ0FBQztZQUVKLE9BQU8sT0FBTyxFQUFFLENBQUE7UUFDbEIsTUFBTSxJQUFJLEdBQUcsSUFBSSxHQUFHLEVBQVUsQ0FBQTtRQUM5QixNQUFNLGVBQWUsR0FBRyxDQUN0QixPQUFnQixFQUNoQixLQUFhLEVBQ2IsS0FBd0IsRUFDbEIsRUFBRTtZQUNSLElBQ0UsS0FBSyxHQUFHLEVBQUU7Z0JBQ1YsQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDO2dCQUNoQixJQUFJLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQztnQkFDakIsQ0FBQyxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUMsU0FBUyxFQUFFLE1BQU0sRUFBRSxVQUFVLENBQUMsQ0FBQztnQkFDL0MsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDLE1BQU07Z0JBRTVCLE9BQU8sT0FBTyxFQUFFLENBQUE7WUFDbEIsSUFBSSxDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsQ0FBQTtZQUNqQixJQUFJLE9BQU8sQ0FBQyxPQUFPLEtBQUssU0FBUyxFQUFFLENBQUM7Z0JBQ2xDLElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLENBQUMsTUFBTTtvQkFDbEUsT0FBTyxPQUFPLEVBQUUsQ0FBQTtnQkFDbEIsS0FBSyxNQUFNLENBQUMsTUFBTSxFQUFFLFNBQVMsQ0FBQyxJQUFJLE1BQU0sQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7b0JBQ2xFLElBQUksQ0FBQyxDQUFDLEtBQUssRUFBRSxNQUFNLEVBQUUsS0FBSyxFQUFFLE9BQU8sRUFBRSxRQUFRLENBQUMsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDO3dCQUM3RCxPQUFPLE9BQU8sRUFBRSxDQUFBO29CQUNsQixNQUFNLE1BQU0sR0FDVixPQUFPLFNBQVMsS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLEVBQUUsU0FBUyxFQUFFLFNBQVMsRUFBRSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUE7b0JBQ3RFLElBQ0UsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDO3dCQUNmLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRTs0QkFDWixXQUFXOzRCQUNYLGVBQWU7NEJBQ2YsU0FBUzs0QkFDVCxPQUFPOzRCQUNQLGFBQWE7NEJBQ2IsZ0JBQWdCOzRCQUNoQixNQUFNOzRCQUNOLFVBQVU7eUJBQ1gsQ0FBQzt3QkFDRixPQUFPLE1BQU0sQ0FBQyxTQUFTLEtBQUssUUFBUTt3QkFDcEMsQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDLFVBQW9CLEVBQUUsTUFBTSxDQUFDLFNBQVMsQ0FBQzt3QkFDdkQsQ0FBQyxNQUFNLENBQUMsYUFBYSxLQUFLLFNBQVM7NEJBQ2pDLENBQUMsT0FBTyxNQUFNLENBQUMsYUFBYSxLQUFLLFFBQVE7Z0NBQ3ZDLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsQ0FBQyxDQUFDO3dCQUNyQyxDQUFDLE1BQU0sQ0FBQyxPQUFPLEtBQUssU0FBUzs0QkFDM0IsT0FBTyxNQUFNLENBQUMsT0FBTyxLQUFLLFVBQVUsQ0FBQzt3QkFDdkMsQ0FBQyxNQUFNLENBQUMsV0FBVyxLQUFLLFNBQVMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLENBQUM7d0JBRWxFLE9BQU8sT0FBTyxFQUFFLENBQUE7b0JBQ2xCLElBQ0UsTUFBTSxDQUFDLEtBQUssS0FBSyxTQUFTO3dCQUMxQixDQUFDLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUM7NEJBQ3BCLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxLQUFLLEVBQUUsQ0FBQyxNQUFNLEVBQUUsT0FBTyxDQUFDLENBQUM7NEJBQ3RDLENBQUMsQ0FBQyxVQUFVLEVBQUUsU0FBUyxDQUFDLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsSUFBYyxDQUFDOzRCQUM5RCxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsSUFBSSxLQUFLLFNBQVM7Z0NBQzlCLENBQUMsT0FBTyxNQUFNLENBQUMsS0FBSyxDQUFDLEtBQUssS0FBSyxRQUFRO29DQUNyQyxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUM7d0JBRTVDLE9BQU8sT0FBTyxFQUFFLENBQUE7b0JBQ2xCLElBQ0UsTUFBTSxDQUFDLGNBQWMsS0FBSyxTQUFTO3dCQUNuQyxDQUFDLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxjQUFjLENBQUM7NEJBQzdCLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxjQUFjLEVBQUUsQ0FBQyxhQUFhLEVBQUUsUUFBUSxDQUFDLENBQUM7NEJBQ3ZELENBQUMsY0FBYyxDQUFDLE1BQU0sQ0FBQyxjQUFjLENBQUMsV0FBVyxDQUFDOzRCQUNsRCxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsY0FBYyxDQUFDLE1BQU0sQ0FBQyxDQUFDO3dCQUV6QyxPQUFPLE9BQU8sRUFBRSxDQUFBO29CQUNsQixJQUNFLE1BQU0sQ0FBQyxJQUFJLEtBQUssU0FBUzt3QkFDekIsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDOzRCQUNuQixDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxFQUFFLENBQUMsV0FBVyxFQUFFLFFBQVEsRUFBRSxnQkFBZ0IsQ0FBQyxDQUFDOzRCQUM3RCxPQUFPLE1BQU0sQ0FBQyxJQUFJLENBQUMsU0FBUyxLQUFLLFFBQVE7NEJBQ3pDLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQzs0QkFDdEMsQ0FBQyxLQUFLLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDOzRCQUN0QyxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQzs0QkFDNUIsQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxjQUFjLENBQUMsQ0FBQzt3QkFFdkMsT0FBTyxPQUFPLEVBQUUsQ0FBQTtvQkFDbEIsSUFDRSxNQUFNLENBQUMsUUFBUSxLQUFLLFNBQVM7d0JBQzdCLENBQUMsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQzs0QkFDdkIsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLFFBQVEsRUFBRSxDQUFDLGFBQWEsRUFBRSxXQUFXLENBQUMsQ0FBQzs0QkFDcEQsT0FBTyxNQUFNLENBQUMsUUFBUSxDQUFDLFdBQVcsS0FBSyxRQUFROzRCQUMvQyxDQUFDLDZFQUE2RSxDQUFDLElBQUksQ0FDakYsTUFBTSxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQzVCOzRCQUNELE9BQU8sTUFBTSxDQUFDLFFBQVEsQ0FBQyxTQUFTLEtBQUssUUFBUTs0QkFDN0MsQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDOzRCQUMxQyxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsQ0FBQzt3QkFFN0MsT0FBTyxPQUFPLEVBQUUsQ0FBQTtnQkFDcEIsQ0FBQztZQUNILENBQUM7WUFDRCxJQUFJLE9BQU8sQ0FBQyxRQUFRLEtBQUssU0FBUyxFQUFFLENBQUM7Z0JBQ25DLElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLENBQUMsTUFBTTtvQkFDcEUsT0FBTyxPQUFPLEVBQUUsQ0FBQTtnQkFDbEIsS0FBSyxNQUFNLENBQUMsTUFBTSxFQUFFLEtBQUssQ0FBQyxJQUFJLE1BQU0sQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7b0JBQy9ELElBQUksQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDO3dCQUFFLE9BQU8sT0FBTyxFQUFFLENBQUE7b0JBQ3ZDLGVBQWUsQ0FBQyxLQUFLLEVBQUUsS0FBSyxHQUFHLENBQUMsRUFBRSxLQUFLLENBQUMsQ0FBQTtnQkFDMUMsQ0FBQztZQUNILENBQUM7WUFDRCxJQUFJLE9BQU8sQ0FBQyxJQUFJLEtBQUssU0FBUyxFQUFFLENBQUM7Z0JBQy9CLElBQ0UsQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQztvQkFDckIsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRSxDQUFDLFdBQVcsRUFBRSxTQUFTLENBQUMsQ0FBQztvQkFDN0MsT0FBTyxPQUFPLENBQUMsSUFBSSxDQUFDLFNBQVMsS0FBSyxRQUFRO29CQUMxQyxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUM7b0JBQ3ZDLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDO29CQUVqQyxPQUFPLE9BQU8sRUFBRSxDQUFBO2dCQUNsQixlQUFlLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsS0FBSyxHQUFHLENBQUMsRUFBRTtvQkFDL0MsR0FBRyxLQUFLO29CQUNSLE9BQU8sQ0FBQyxJQUFJLENBQUMsU0FBUztpQkFDdkIsQ0FBQyxDQUFBO1lBQ0osQ0FBQztZQUNELElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLENBQUE7UUFDdEIsQ0FBQyxDQUFBO1FBQ0QsZUFBZSxDQUFDLFVBQVUsQ0FBQyxPQUFPLEVBQUUsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFBO1FBQzFDLE1BQU0sTUFBTSxHQUFHLGNBQWMsQ0FBQyxVQUFnQyxDQUFDLENBQUE7UUFDL0QsSUFDRSxDQUFDLE1BQU0sQ0FBQyxNQUFNO1lBQ2QsTUFBTSxDQUFDLE1BQU0sR0FBRyxHQUFHO1lBQ25CLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRTtnQkFDcEIsTUFBTSxNQUFNLEdBQUcsS0FBSyxDQUFDLElBQUk7cUJBQ3RCLEtBQUssQ0FBQyxHQUFHLENBQUM7cUJBQ1YsTUFBTSxDQUFDLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUE7Z0JBQy9DLE9BQU8sSUFBSSxHQUFHLENBQUMsTUFBTSxDQUFDLENBQUMsSUFBSSxLQUFLLE1BQU0sQ0FBQyxNQUFNLENBQUE7WUFDL0MsQ0FBQyxDQUFDO1lBRUYsT0FBTyxPQUFPLEVBQUUsQ0FBQTtJQUNwQixDQUFDO0lBQ0QsT0FBTyxJQUFBLGtDQUFlLEVBQUMsS0FBSyxDQUF5QixDQUFBO0FBQ3ZELENBQUMifQ==

package/.medusa/server/src/lib/access/route-facts.d.ts

@@ -0,0 +1,24 @@
+export type RouteMethod = "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
+export type RouteRegistration = {
+    path: string;
+    methods: readonly string[];
+};
+export type RouteSegment = {
+    kind: "literal";
+    value: string;
+} | {
+    kind: "parameter";
+    name: string;
+    value: string;
+};
+export type RouteFacts = {
+    template: string;
+    method: string;
+    namespace: string;
+    root: string;
+    segments: RouteSegment[];
+    params: Record<string, string>;
+};
+export declare function canonicalPath(url: string): string | null;
+export declare function createRouteMatcher(registrations: readonly RouteRegistration[]): (method: string, url: string) => RouteFacts | null;
+export declare function matchRoute(registrations: readonly RouteRegistration[], method: string, url: string): RouteFacts | null;

package/.medusa/server/src/lib/access/route-facts.js

@@ -0,0 +1,77 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.canonicalPath = canonicalPath;
+exports.createRouteMatcher = createRouteMatcher;
+exports.matchRoute = matchRoute;
+function canonicalPath(url) {
+    const raw = url.split("?")[0];
+    if (!raw.startsWith("/") ||
+        /%(?:2f|5c|2e|25)/i.test(raw) ||
+        raw.includes("\\") ||
+        raw.includes("//"))
+        return null;
+    try {
+        decodeURIComponent(raw);
+        return raw.replace(/\/+$/, "");
+    }
+    catch {
+        return null;
+    }
+}
+function createRouteMatcher(registrations) {
+    const index = new Map();
+    for (const registration of registrations) {
+        const parts = registration.path.split("/").slice(1);
+        for (const method of registration.methods) {
+            const key = `${method}:${parts.length}`;
+            const group = index.get(key) || [];
+            group.push({ route: { path: registration.path }, parts });
+            index.set(key, group);
+        }
+    }
+    for (const group of index.values())
+        group.sort((left, right) => {
+            for (let i = 0; i < left.parts.length; i++) {
+                const difference = Number(left.parts[i].startsWith(":")) -
+                    Number(right.parts[i].startsWith(":"));
+                if (difference)
+                    return difference;
+            }
+            return left.route.path.localeCompare(right.route.path);
+        });
+    return (method, url) => {
+        const path = canonicalPath(url);
+        if (!path)
+            return null;
+        const values = path.split("/").slice(1);
+        const verb = method === "HEAD" ? "GET" : method;
+        const candidates = index.get(`${verb}:${values.length}`) || [];
+        for (const { route, parts } of candidates) {
+            if (!parts.every((part, i) => part.startsWith(":") ||
+                part.toLowerCase() === values[i].toLowerCase()))
+                continue;
+            const params = {};
+            const segments = parts.map((part, i) => {
+                if (!part.startsWith(":"))
+                    return { kind: "literal", value: part.toLowerCase() };
+                const name = part.slice(1);
+                const value = decodeURIComponent(values[i]);
+                params[name] = value;
+                return { kind: "parameter", name, value };
+            });
+            return {
+                template: route.path,
+                method: verb,
+                namespace: parts.length > 1 ? parts[0].toLowerCase() : "",
+                root: (parts[1] || parts[0]).toLowerCase(),
+                segments: segments.slice(2),
+                params,
+            };
+        }
+        return null;
+    };
+}
+function matchRoute(registrations, method, url) {
+    return createRouteMatcher(registrations)(method, url);
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm91dGUtZmFjdHMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi9zcmMvbGliL2FjY2Vzcy9yb3V0ZS1mYWN0cy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOztBQWNBLHNDQWVDO0FBRUQsZ0RBNkRDO0FBRUQsZ0NBTUM7QUF0RkQsU0FBZ0IsYUFBYSxDQUFDLEdBQVc7SUFDdkMsTUFBTSxHQUFHLEdBQUcsR0FBRyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQTtJQUM3QixJQUNFLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQyxHQUFHLENBQUM7UUFDcEIsbUJBQW1CLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQztRQUM3QixHQUFHLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQztRQUNsQixHQUFHLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQztRQUVsQixPQUFPLElBQUksQ0FBQTtJQUNiLElBQUksQ0FBQztRQUNILGtCQUFrQixDQUFDLEdBQUcsQ0FBQyxDQUFBO1FBQ3ZCLE9BQU8sR0FBRyxDQUFDLE9BQU8sQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLENBQUE7SUFDaEMsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE9BQU8sSUFBSSxDQUFBO0lBQ2IsQ0FBQztBQUNILENBQUM7QUFFRCxTQUFnQixrQkFBa0IsQ0FDaEMsYUFBMkM7SUFFM0MsTUFBTSxLQUFLLEdBQUcsSUFBSSxHQUFHLEVBR2xCLENBQUE7SUFDSCxLQUFLLE1BQU0sWUFBWSxJQUFJLGFBQWEsRUFBRSxDQUFDO1FBQ3pDLE1BQU0sS0FBSyxHQUFHLFlBQVksQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQTtRQUNuRCxLQUFLLE1BQU0sTUFBTSxJQUFJLFlBQVksQ0FBQyxPQUFPLEVBQUUsQ0FBQztZQUMxQyxNQUFNLEdBQUcsR0FBRyxHQUFHLE1BQU0sSUFBSSxLQUFLLENBQUMsTUFBTSxFQUFFLENBQUE7WUFDdkMsTUFBTSxLQUFLLEdBQUcsS0FBSyxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsSUFBSSxFQUFFLENBQUE7WUFDbEMsS0FBSyxDQUFDLElBQUksQ0FBQyxFQUFFLEtBQUssRUFBRSxFQUFFLElBQUksRUFBRSxZQUFZLENBQUMsSUFBSSxFQUFFLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQTtZQUN6RCxLQUFLLENBQUMsR0FBRyxDQUFDLEdBQUcsRUFBRSxLQUFLLENBQUMsQ0FBQTtRQUN2QixDQUFDO0lBQ0gsQ0FBQztJQUNELEtBQUssTUFBTSxLQUFLLElBQUksS0FBSyxDQUFDLE1BQU0sRUFBRTtRQUNoQyxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUMsSUFBSSxFQUFFLEtBQUssRUFBRSxFQUFFO1lBQ3pCLEtBQUssSUFBSSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLE1BQU0sRUFBRSxDQUFDLEVBQUUsRUFBRSxDQUFDO2dCQUMzQyxNQUFNLFVBQVUsR0FDZCxNQUFNLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDLENBQUM7b0JBQ3JDLE1BQU0sQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLFVBQVUsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFBO2dCQUN4QyxJQUFJLFVBQVU7b0JBQUUsT0FBTyxVQUFVLENBQUE7WUFDbkMsQ0FBQztZQUNELE9BQU8sSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsYUFBYSxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUE7UUFDeEQsQ0FBQyxDQUFDLENBQUE7SUFDSixPQUFPLENBQUMsTUFBYyxFQUFFLEdBQVcsRUFBcUIsRUFBRTtRQUN4RCxNQUFNLElBQUksR0FBRyxhQUFhLENBQUMsR0FBRyxDQUFDLENBQUE7UUFDL0IsSUFBSSxDQUFDLElBQUk7WUFBRSxPQUFPLElBQUksQ0FBQTtRQUN0QixNQUFNLE1BQU0sR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQTtRQUN2QyxNQUFNLElBQUksR0FBRyxNQUFNLEtBQUssTUFBTSxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQTtRQUMvQyxNQUFNLFVBQVUsR0FBRyxLQUFLLENBQUMsR0FBRyxDQUFDLEdBQUcsSUFBSSxJQUFJLE1BQU0sQ0FBQyxNQUFNLEVBQUUsQ0FBQyxJQUFJLEVBQUUsQ0FBQTtRQUM5RCxLQUFLLE1BQU0sRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFLElBQUksVUFBVSxFQUFFLENBQUM7WUFDMUMsSUFDRSxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQ1YsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxFQUFFLEVBQUUsQ0FDVixJQUFJLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQztnQkFDcEIsSUFBSSxDQUFDLFdBQVcsRUFBRSxLQUFLLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQyxXQUFXLEVBQUUsQ0FDakQ7Z0JBRUQsU0FBUTtZQUNWLE1BQU0sTUFBTSxHQUEyQixFQUFFLENBQUE7WUFDekMsTUFBTSxRQUFRLEdBQUcsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDLEVBQWdCLEVBQUU7Z0JBQ25ELElBQUksQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQztvQkFDdkIsT0FBTyxFQUFFLElBQUksRUFBRSxTQUFTLEVBQUUsS0FBSyxFQUFFLElBQUksQ0FBQyxXQUFXLEVBQUUsRUFBRSxDQUFBO2dCQUN2RCxNQUFNLElBQUksR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFBO2dCQUMxQixNQUFNLEtBQUssR0FBRyxrQkFBa0IsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQTtnQkFDM0MsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLEtBQUssQ0FBQTtnQkFDcEIsT0FBTyxFQUFFLElBQUksRUFBRSxXQUFXLEVBQUUsSUFBSSxFQUFFLEtBQUssRUFBRSxDQUFBO1lBQzNDLENBQUMsQ0FBQyxDQUFBO1lBQ0YsT0FBTztnQkFDTCxRQUFRLEVBQUUsS0FBSyxDQUFDLElBQUk7Z0JBQ3BCLE1BQU0sRUFBRSxJQUFJO2dCQUNaLFNBQVMsRUFBRSxLQUFLLENBQUMsTUFBTSxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLFdBQVcsRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFO2dCQUN6RCxJQUFJLEVBQUUsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLElBQUksS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsV0FBVyxFQUFFO2dCQUMxQyxRQUFRLEVBQUUsUUFBUSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7Z0JBQzNCLE1BQU07YUFDUCxDQUFBO1FBQ0gsQ0FBQztRQUNELE9BQU8sSUFBSSxDQUFBO0lBQ2IsQ0FBQyxDQUFBO0FBQ0gsQ0FBQztBQUVELFNBQWdCLFVBQVUsQ0FDeEIsYUFBMkMsRUFDM0MsTUFBYyxFQUNkLEdBQVc7SUFFWCxPQUFPLGtCQUFrQixDQUFDLGFBQWEsQ0FBQyxDQUFDLE1BQU0sRUFBRSxHQUFHLENBQUMsQ0FBQTtBQUN2RCxDQUFDIn0=

package/.medusa/server/src/lib/access/write-permissions.d.ts

@@ -0,0 +1,2 @@
+import type { Permission } from "./permissions";
+export declare function additionalWritePermissions(value: unknown, creating?: boolean): Permission[];

package/.medusa/server/src/lib/access/write-permissions.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.additionalWritePermissions = additionalWritePermissions;
+function additionalWritePermissions(value, creating = false) {
+    const needed = new Set();
+    const visit = (data, isCreate) => {
+        if (!data || typeof data !== "object")
+            return;
+        if (Array.isArray(data)) {
+            data.forEach((item) => visit(item, isCreate));
+            return;
+        }
+        for (const [key, child] of Object.entries(data)) {
+            if (key === "status" && (!isCreate || child !== "draft"))
+                needed.add("products.publish");
+            if (key === "delete")
+                needed.add("products.delete");
+            if (key === "create")
+                needed.add("products.create");
+            if (["price", "prices", "price_set", "price_sets", "amount"].includes(key))
+                needed.add("prices.edit");
+            if (key === "collection_id")
+                needed.add("collections.manage");
+            if (key === "categories" || key === "category_ids")
+                needed.add("categories.manage");
+            if (["inventory_items", "inventory_quantity"].includes(key) ||
+                (key === "manage_inventory" && (!isCreate || child !== true)) ||
+                (key === "allow_backorder" && (!isCreate || child !== false)))
+                needed.add("inventory.adjust");
+            if (["images", "thumbnail"].includes(key))
+                needed.add("media.manage");
+            // Traverse only native batch/variant envelopes, not arbitrary metadata.
+            if (["variants", "create", "update"].includes(key))
+                visit(child, key === "create" || (key === "variants" && isCreate));
+        }
+    };
+    visit(value, creating);
+    return [...needed];
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoid3JpdGUtcGVybWlzc2lvbnMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi9zcmMvbGliL2FjY2Vzcy93cml0ZS1wZXJtaXNzaW9ucy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOztBQUVBLGdFQXFDQztBQXJDRCxTQUFnQiwwQkFBMEIsQ0FDeEMsS0FBYyxFQUNkLFFBQVEsR0FBRyxLQUFLO0lBRWhCLE1BQU0sTUFBTSxHQUFHLElBQUksR0FBRyxFQUFjLENBQUE7SUFDcEMsTUFBTSxLQUFLLEdBQUcsQ0FBQyxJQUFhLEVBQUUsUUFBaUIsRUFBRSxFQUFFO1FBQ2pELElBQUksQ0FBQyxJQUFJLElBQUksT0FBTyxJQUFJLEtBQUssUUFBUTtZQUFFLE9BQU07UUFDN0MsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUM7WUFDeEIsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDLElBQUksRUFBRSxFQUFFLENBQUMsS0FBSyxDQUFDLElBQUksRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFBO1lBQzdDLE9BQU07UUFDUixDQUFDO1FBQ0QsS0FBSyxNQUFNLENBQUMsR0FBRyxFQUFFLEtBQUssQ0FBQyxJQUFJLE1BQU0sQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQztZQUNoRCxJQUFJLEdBQUcsS0FBSyxRQUFRLElBQUksQ0FBQyxDQUFDLFFBQVEsSUFBSSxLQUFLLEtBQUssT0FBTyxDQUFDO2dCQUN0RCxNQUFNLENBQUMsR0FBRyxDQUFDLGtCQUFrQixDQUFDLENBQUE7WUFDaEMsSUFBSSxHQUFHLEtBQUssUUFBUTtnQkFBRSxNQUFNLENBQUMsR0FBRyxDQUFDLGlCQUFpQixDQUFDLENBQUE7WUFDbkQsSUFBSSxHQUFHLEtBQUssUUFBUTtnQkFBRSxNQUFNLENBQUMsR0FBRyxDQUFDLGlCQUFpQixDQUFDLENBQUE7WUFDbkQsSUFDRSxDQUFDLE9BQU8sRUFBRSxRQUFRLEVBQUUsV0FBVyxFQUFFLFlBQVksRUFBRSxRQUFRLENBQUMsQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDO2dCQUV0RSxNQUFNLENBQUMsR0FBRyxDQUFDLGFBQWEsQ0FBQyxDQUFBO1lBQzNCLElBQUksR0FBRyxLQUFLLGVBQWU7Z0JBQUUsTUFBTSxDQUFDLEdBQUcsQ0FBQyxvQkFBb0IsQ0FBQyxDQUFBO1lBQzdELElBQUksR0FBRyxLQUFLLFlBQVksSUFBSSxHQUFHLEtBQUssY0FBYztnQkFDaEQsTUFBTSxDQUFDLEdBQUcsQ0FBQyxtQkFBbUIsQ0FBQyxDQUFBO1lBQ2pDLElBQ0UsQ0FBQyxpQkFBaUIsRUFBRSxvQkFBb0IsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUM7Z0JBQ3ZELENBQUMsR0FBRyxLQUFLLGtCQUFrQixJQUFJLENBQUMsQ0FBQyxRQUFRLElBQUksS0FBSyxLQUFLLElBQUksQ0FBQyxDQUFDO2dCQUM3RCxDQUFDLEdBQUcsS0FBSyxpQkFBaUIsSUFBSSxDQUFDLENBQUMsUUFBUSxJQUFJLEtBQUssS0FBSyxLQUFLLENBQUMsQ0FBQztnQkFFN0QsTUFBTSxDQUFDLEdBQUcsQ0FBQyxrQkFBa0IsQ0FBQyxDQUFBO1lBQ2hDLElBQUksQ0FBQyxRQUFRLEVBQUUsV0FBVyxDQUFDLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQztnQkFBRSxNQUFNLENBQUMsR0FBRyxDQUFDLGNBQWMsQ0FBQyxDQUFBO1lBQ3JFLHdFQUF3RTtZQUN4RSxJQUFJLENBQUMsVUFBVSxFQUFFLFFBQVEsRUFBRSxRQUFRLENBQUMsQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDO2dCQUNoRCxLQUFLLENBQUMsS0FBSyxFQUFFLEdBQUcsS0FBSyxRQUFRLElBQUksQ0FBQyxHQUFHLEtBQUssVUFBVSxJQUFJLFFBQVEsQ0FBQyxDQUFDLENBQUE7UUFDdEUsQ0FBQztJQUNILENBQUMsQ0FBQTtJQUNELEtBQUssQ0FBQyxLQUFLLEVBQUUsUUFBUSxDQUFDLENBQUE7SUFDdEIsT0FBTyxDQUFDLEdBQUcsTUFBTSxDQUFDLENBQUE7QUFDcEIsQ0FBQyJ9

package/.medusa/server/src/modules/access-control/service.d.ts

@@ -170,14 +170,18 @@ declare class AccessControlService extends AccessControlService_base {
         roles: import("../../lib/access/roles").ConfiguredRoleDefinition[];
         ids: string[];
         actors: import("../..").ActorProvider[];
+        resources: import("../..").ResourceDefinition[];
         contextResolvers: ((request: MedusaRequest) => PermissionContext | Promise<PermissionContext>)[];
         policyFor(method: string, path: string): import("../../lib/access/policy").Policy | null;
+        resolveRequest(request: MedusaRequest): Promise<import("../..").OperationDescriptor | null>;
     };
     permissionDefinitions(): import("../../lib/access/config").PermissionDefinition[];
     validatePermissions(values: unknown): string[];
     validateRules(values: unknown): PermissionRule[];
     private validateEditableRoleName;
+    /** Static inspection only; never a substitute for request resolution and enforcement. */
     policyFor(method: string, path: string): import("../../lib/access/policy").Policy | null;
+    resolveRequest(request: MedusaRequest): Promise<import("../..").OperationDescriptor | null>;
     permissionContext(request: MedusaRequest): Promise<PermissionContext>;
     validateActor(actor: ActorReference, request: MedusaRequest): Promise<void>;
     principalForRequest(request: MedusaRequest): Promise<AccessPrincipal | null>;