@acorex-platform/module-security-management-server 0.0.18 → 2.0.0-next.42

package/server/src/lib/effective-access-history/effective-access-history.service.js

@@ -0,0 +1,486 @@
+"use strict";
+//#region ----- Imports -----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EffectiveAccessHistoryService = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const core_1 = require("@acorex-platform/framework-server/core");
+const abstract_1 = require("@acorex-platform/framework-server/jql/abstract");
+const security_1 = require("@acorex-platform/framework-server/security");
+const report_1 = require("@acorex-platform/framework-server/report");
+const module_common_contracts_1 = require("@acorex-platform/module-common-client/contracts");
+const versioning_1 = require("@acorex-platform/module-common-server/versioning");
+const lodash_1 = require("lodash");
+const permission_display_catalog_1 = require("../reports/permission-display-catalog");
+const version_as_of_util_1 = require("./version-as-of.util");
+//#endregion
+//#region ----- Constants -----
+const ROLE_ENTITY = 'SecurityManagement.Role';
+const USER_ENTITY = 'SecurityManagement.User';
+const USER_ROLE_ENTITY = 'SecurityManagement.UserRole';
+const ROLE_PERMISSION_ENTITY = 'SecurityManagement.RolePermission';
+const STREAM_PAGE_SIZE = 500;
+const ENTRY_PAGE_SIZE = 2000;
+/**
+ * v1 scope: grant-assignment history only (UserRole + RolePermission).
+ * Tenant membership / account-holder are assumed for scoring (not reconstructed).
+ */
+const HISTORY_MEMBERSHIP_ASSUMED = true;
+//#endregion
+//#region ----- Effective access history service -----
+/**
+ * Reconstructs historical effective roles/permissions from Change History
+ * (Common.VersionStream / VersionEntry), using the same scope scoring as runtime.
+ *
+ * When an entity type has **no** version streams (common for seed inserts that
+ * bypass history), falls back to current entity rows as open-ended intervals
+ * from `auditInfo.created.at` (or epoch) so “today / current” reports still work.
+ *
+ * v1 does **not** reconstruct TenantUser membership — membership is assumed
+ * (`hasTenantMembership: true`) so reports reflect grant assignment history.
+ */
+let EffectiveAccessHistoryService = class EffectiveAccessHistoryService {
+    constructor(storage) {
+        this.storage = storage;
+    }
+    //#region ----- Public report APIs -----
+    getUserEffectiveRolesInRange(query) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            const context = this.buildContext(query.tenantId, query.applicationId);
+            const range = this.toRange(query.from, query.to);
+            const [roles, userRoleStreams] = yield Promise.all([
+                this.listEntities(ROLE_ENTITY),
+                this.loadEntityStreams(USER_ROLE_ENTITY),
+            ]);
+            const roleById = indexById(roles);
+            const userStreams = userRoleStreams.filter((stream) => streamTouchesUser(stream, query.userId));
+            const keyed = this.collectUserRoleIntervals(userStreams, query.userId, context, range, roleById);
+            return keyed
+                .map((row) => {
+                var _a, _b, _c, _d;
+                const role = roleById.get(row.key);
+                return {
+                    userId: query.userId,
+                    roleId: row.key,
+                    roleName: role ? String((_a = role['name']) !== null && _a !== void 0 ? _a : '') : '',
+                    roleTitle: role ? (0, report_1.resolveDisplayTitle)(role['title']) : '',
+                    validFrom: (_b = (0, version_as_of_util_1.toIso)(row.from)) !== null && _b !== void 0 ? _b : '',
+                    validTo: (0, version_as_of_util_1.toIso)(row.to),
+                    applicationId: (_c = query.applicationId) !== null && _c !== void 0 ? _c : null,
+                    grantId: typeof ((_d = row.meta) === null || _d === void 0 ? void 0 : _d['grantId']) === 'string' ? row.meta['grantId'] : null,
+                };
+            })
+                .sort((a, b) => a.roleName.localeCompare(b.roleName) || a.validFrom.localeCompare(b.validFrom));
+        });
+    }
+    getUserEffectivePermissionsInRange(query) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            const context = this.buildContext(query.tenantId, query.applicationId);
+            const range = this.toRange(query.from, query.to);
+            const [roles, userRoleStreams, rolePermissionStreams] = yield Promise.all([
+                this.listEntities(ROLE_ENTITY),
+                this.loadEntityStreams(USER_ROLE_ENTITY),
+                this.loadEntityStreams(ROLE_PERMISSION_ENTITY),
+            ]);
+            const userStreams = userRoleStreams.filter((stream) => streamTouchesUser(stream, query.userId));
+            const permissionSegments = this.buildPermissionSegmentsForUser(query.userId, userStreams, rolePermissionStreams, roles, context, range);
+            return permissionSegments
+                .filter((row) => (0, permission_display_catalog_1.permissionMatchesContainsSearch)(row.key, query.permissionSearch))
+                .map((row) => {
+                var _a, _b;
+                return ({
+                    userId: query.userId,
+                    permissionKey: row.key,
+                    permission: (0, module_common_contracts_1.resolvePermissionTitleDisplay)(row.key),
+                    validFrom: (_a = (0, version_as_of_util_1.toIso)(row.from)) !== null && _a !== void 0 ? _a : '',
+                    validTo: (0, version_as_of_util_1.toIso)(row.to),
+                    applicationId: (_b = query.applicationId) !== null && _b !== void 0 ? _b : null,
+                });
+            })
+                .sort((a, b) => a.permission.localeCompare(b.permission) ||
+                a.permissionKey.localeCompare(b.permissionKey) ||
+                a.validFrom.localeCompare(b.validFrom));
+        });
+    }
+    getRoleHoldersInRange(query) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c, _d;
+            const context = this.buildContext(query.tenantId, query.applicationId);
+            const range = this.toRange(query.from, query.to);
+            const [roles, users, userRoleStreams] = yield Promise.all([
+                this.listEntities(ROLE_ENTITY),
+                this.listEntities(USER_ENTITY),
+                this.loadEntityStreams(USER_ROLE_ENTITY),
+            ]);
+            const role = indexById(roles).get(query.roleId);
+            if (!role || !(0, security_1.roleAppliesToSession)(role, context)) {
+                return [];
+            }
+            const userById = indexById(users);
+            const roleById = indexById(roles);
+            const roleName = String((_a = role['name']) !== null && _a !== void 0 ? _a : '');
+            const roleTitle = (0, report_1.resolveDisplayTitle)(role['title']);
+            const rows = [];
+            const userIds = collectUserIdsFromStreams(userRoleStreams);
+            for (const userId of userIds) {
+                const userStreams = userRoleStreams.filter((stream) => streamTouchesUser(stream, userId));
+                const keyed = this.collectUserRoleIntervals(userStreams, userId, context, range, roleById).filter((row) => row.key === query.roleId);
+                const user = userById.get(userId);
+                for (const interval of keyed) {
+                    rows.push({
+                        userId,
+                        username: user ? String((_b = user['username']) !== null && _b !== void 0 ? _b : '') : '',
+                        displayName: resolveUserDisplayName(user),
+                        roleId: query.roleId,
+                        roleName,
+                        roleTitle,
+                        validFrom: (_c = (0, version_as_of_util_1.toIso)(interval.from)) !== null && _c !== void 0 ? _c : '',
+                        validTo: (0, version_as_of_util_1.toIso)(interval.to),
+                        applicationId: (_d = query.applicationId) !== null && _d !== void 0 ? _d : null,
+                    });
+                }
+            }
+            return rows.sort((a, b) => a.username.localeCompare(b.username) || a.validFrom.localeCompare(b.validFrom));
+        });
+    }
+    getPermissionHoldersInRange(query) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c;
+            const context = this.buildContext(query.tenantId, query.applicationId);
+            const range = this.toRange(query.from, query.to);
+            const permission = query.permission.trim();
+            if (!permission) {
+                return [];
+            }
+            const [roles, users, userRoleStreams, rolePermissionStreams] = yield Promise.all([
+                this.listEntities(ROLE_ENTITY),
+                this.listEntities(USER_ENTITY),
+                this.loadEntityStreams(USER_ROLE_ENTITY),
+                this.loadEntityStreams(ROLE_PERMISSION_ENTITY),
+            ]);
+            const userById = indexById(users);
+            const rows = [];
+            const userIds = collectUserIdsFromStreams(userRoleStreams);
+            for (const userId of userIds) {
+                const userStreams = userRoleStreams.filter((stream) => streamTouchesUser(stream, userId));
+                const permissionSegments = this.buildPermissionSegmentsForUser(userId, userStreams, rolePermissionStreams, roles, context, range).filter((row) => row.key === permission);
+                const user = userById.get(userId);
+                for (const interval of permissionSegments) {
+                    rows.push({
+                        userId,
+                        username: user ? String((_a = user['username']) !== null && _a !== void 0 ? _a : '') : '',
+                        displayName: resolveUserDisplayName(user),
+                        permissionKey: permission,
+                        permission: (0, module_common_contracts_1.resolvePermissionTitleDisplay)(permission),
+                        validFrom: (_b = (0, version_as_of_util_1.toIso)(interval.from)) !== null && _b !== void 0 ? _b : '',
+                        validTo: (0, version_as_of_util_1.toIso)(interval.to),
+                        applicationId: (_c = query.applicationId) !== null && _c !== void 0 ? _c : null,
+                    });
+                }
+            }
+            return rows.sort((a, b) => a.username.localeCompare(b.username) || a.validFrom.localeCompare(b.validFrom));
+        });
+    }
+    //#endregion
+    //#region ----- Interval builders -----
+    collectUserRoleIntervals(userStreams, userId, context, range, roleById) {
+        var _a, _b;
+        const byRole = new Map();
+        for (const stream of userStreams) {
+            for (const interval of stream.intervals) {
+                if (!interval.state) {
+                    continue;
+                }
+                if (String((_a = interval.state['userId']) !== null && _a !== void 0 ? _a : '') !== userId) {
+                    continue;
+                }
+                if ((0, security_1.scoreUserRoleGrant)(interval.state, context) < 0) {
+                    continue;
+                }
+                const clipped = (0, version_as_of_util_1.clipInterval)(interval, range);
+                if (!clipped) {
+                    continue;
+                }
+                const roleIds = (0, security_1.extractUserRoleIds)(interval.state).filter((roleId) => {
+                    const role = roleById.get(roleId);
+                    return !!role && (0, security_1.roleAppliesToSession)(role, context);
+                });
+                for (const roleId of roleIds) {
+                    const list = (_b = byRole.get(roleId)) !== null && _b !== void 0 ? _b : [];
+                    list.push(clipped);
+                    byRole.set(roleId, list);
+                }
+            }
+        }
+        const rows = [];
+        for (const [roleId, intervals] of byRole) {
+            for (const merged of (0, version_as_of_util_1.mergeTimeIntervals)(intervals)) {
+                rows.push({ key: roleId, from: merged.from, to: merged.to });
+            }
+        }
+        return rows;
+    }
+    buildPermissionSegmentsForUser(userId, userStreams, rolePermissionStreams, roles, context, range) {
+        var _a, _b;
+        const userRoleTimeIntervals = [];
+        for (const stream of userStreams) {
+            for (const interval of stream.intervals) {
+                if (!interval.state || String((_a = interval.state['userId']) !== null && _a !== void 0 ? _a : '') !== userId) {
+                    continue;
+                }
+                const clipped = (0, version_as_of_util_1.clipInterval)(interval, range);
+                if (clipped) {
+                    userRoleTimeIntervals.push(clipped);
+                }
+            }
+        }
+        const rolePermTimeIntervals = [];
+        for (const stream of rolePermissionStreams) {
+            for (const interval of stream.intervals) {
+                if (!interval.state) {
+                    continue;
+                }
+                const clipped = (0, version_as_of_util_1.clipInterval)(interval, range);
+                if (clipped) {
+                    rolePermTimeIntervals.push(clipped);
+                }
+            }
+        }
+        const boundaries = (0, version_as_of_util_1.collectBoundaries)([...userRoleTimeIntervals, ...rolePermTimeIntervals], range);
+        if (boundaries.length < 2) {
+            return [];
+        }
+        const byPermission = new Map();
+        for (let i = 0; i < boundaries.length - 1; i++) {
+            const segmentFrom = boundaries[i];
+            const segmentTo = boundaries[i + 1];
+            if (segmentFrom.getTime() >= segmentTo.getTime()) {
+                continue;
+            }
+            // Evaluate state at the start of the half-open segment.
+            const asOf = segmentFrom;
+            const assignments = this.snapshotsAt(userStreams, asOf).filter((row) => { var _a; return String((_a = row['userId']) !== null && _a !== void 0 ? _a : '') === userId; });
+            const grants = this.snapshotsAt(rolePermissionStreams, asOf);
+            const effectiveRoleIds = (0, security_1.resolveEffectiveRoleIdsFromUserRoles)(assignments, roles, context, {
+                isAccountHolder: false,
+            });
+            if (effectiveRoleIds.length === 0) {
+                continue;
+            }
+            const permissions = (0, security_1.resolvePermissionsFromRoleGrants)(roles, grants, effectiveRoleIds, context);
+            for (const permission of permissions) {
+                const list = (_b = byPermission.get(permission)) !== null && _b !== void 0 ? _b : [];
+                list.push({ from: segmentFrom, to: segmentTo });
+                byPermission.set(permission, list);
+            }
+        }
+        const rows = [];
+        for (const [permission, intervals] of byPermission) {
+            for (const merged of (0, version_as_of_util_1.mergeTimeIntervals)(intervals)) {
+                rows.push({ key: permission, from: merged.from, to: merged.to });
+            }
+        }
+        return rows;
+    }
+    snapshotsAt(streams, asOf) {
+        var _a, _b;
+        const asOfMs = asOf.getTime();
+        const snapshots = [];
+        for (const stream of streams) {
+            let active = null;
+            for (const interval of stream.intervals) {
+                if (interval.from.getTime() > asOfMs) {
+                    break;
+                }
+                const endMs = (_b = (_a = interval.to) === null || _a === void 0 ? void 0 : _a.getTime()) !== null && _b !== void 0 ? _b : Number.POSITIVE_INFINITY;
+                // Half-open [from, to): at exact boundary `to`, the next interval owns the point.
+                if (asOfMs < endMs) {
+                    active = interval.state;
+                    break;
+                }
+            }
+            if (active) {
+                snapshots.push(active);
+            }
+        }
+        return snapshots;
+    }
+    //#endregion
+    //#region ----- History loading -----
+    loadEntityStreams(entityType) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a, _b;
+            const streams = yield this.listStreamsByEntityType(entityType);
+            const bundles = [];
+            for (const stream of streams) {
+                const streamId = String((_a = stream['id']) !== null && _a !== void 0 ? _a : '');
+                const entityId = String((_b = stream['entityId']) !== null && _b !== void 0 ? _b : '');
+                if (!streamId) {
+                    continue;
+                }
+                const entries = yield this.listEntriesForStream(streamId);
+                bundles.push({
+                    streamId,
+                    entityId,
+                    intervals: (0, version_as_of_util_1.buildStateIntervals)(entries),
+                });
+            }
+            if (bundles.length > 0) {
+                return bundles;
+            }
+            return this.synthesizeStreamsFromCurrentEntities(entityType);
+        });
+    }
+    /**
+     * Seed / bulk inserts often have no VersionStream. Treat each current row as
+     * one open-ended state interval so overlap queries still return live grants.
+     */
+    synthesizeStreamsFromCurrentEntities(entityType) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c;
+            const rows = yield this.listEntities(entityType);
+            const bundles = [];
+            for (const row of rows) {
+                const entityId = String((_a = row['id']) !== null && _a !== void 0 ? _a : '');
+                if (!entityId) {
+                    continue;
+                }
+                const createdRaw = (_c = (_b = (0, lodash_1.get)(row, 'auditInfo.created.at')) !== null && _b !== void 0 ? _b : (0, lodash_1.get)(row, 'createdAt')) !== null && _c !== void 0 ? _c : '1970-01-01T00:00:00.000Z';
+                const from = new Date(String(createdRaw));
+                const intervalFrom = Number.isNaN(from.getTime()) ? new Date(0) : from;
+                bundles.push({
+                    streamId: `live:${entityType}:${entityId}`,
+                    entityId,
+                    intervals: [
+                        {
+                            from: intervalFrom,
+                            to: null,
+                            state: row,
+                        },
+                    ],
+                });
+            }
+            return bundles;
+        });
+    }
+    listStreamsByEntityType(entityType) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const items = [];
+            let skip = 0;
+            for (;;) {
+                const page = yield this.storage.query(versioning_1.VERSION_STREAM_ENTITY, (0, abstract_1.bypassAllEntityVisibilityFilters)({
+                    skip,
+                    take: STREAM_PAGE_SIZE,
+                    filter: {
+                        logic: 'and',
+                        filters: [{ field: 'entityType', operator: { type: 'equal' }, value: entityType }],
+                    },
+                }));
+                const batch = (_a = (0, lodash_1.get)(page, 'items', [])) !== null && _a !== void 0 ? _a : [];
+                items.push(...batch);
+                if (batch.length < STREAM_PAGE_SIZE) {
+                    break;
+                }
+                skip += STREAM_PAGE_SIZE;
+            }
+            return items;
+        });
+    }
+    listEntriesForStream(streamId) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const items = [];
+            let skip = 0;
+            for (;;) {
+                const page = yield this.storage.query(versioning_1.VERSION_ENTRY_ENTITY, (0, abstract_1.bypassAllEntityVisibilityFilters)({
+                    skip,
+                    take: ENTRY_PAGE_SIZE,
+                    filter: {
+                        logic: 'and',
+                        filters: [{ field: 'streamId', operator: { type: 'equal' }, value: streamId }],
+                    },
+                    sort: [{ field: 'versionNumber', dir: 'asc' }],
+                }));
+                const batch = (_a = (0, lodash_1.get)(page, 'items', [])) !== null && _a !== void 0 ? _a : [];
+                items.push(...batch);
+                if (batch.length < ENTRY_PAGE_SIZE) {
+                    break;
+                }
+                skip += ENTRY_PAGE_SIZE;
+            }
+            return items;
+        });
+    }
+    listEntities(entityName) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            const result = yield this.storage.query(entityName, (0, abstract_1.bypassAllEntityVisibilityFilters)({ skip: 0, take: 10000 }));
+            const items = (0, lodash_1.get)(result, 'items', []);
+            return Array.isArray(items) ? items : [];
+        });
+    }
+    //#endregion
+    //#region ----- Context helpers -----
+    buildContext(tenantId, applicationId) {
+        return {
+            tenantId,
+            applicationId: applicationId || undefined,
+            hasTenantMembership: HISTORY_MEMBERSHIP_ASSUMED,
+        };
+    }
+    toRange(from, to) {
+        return { from, to };
+    }
+};
+exports.EffectiveAccessHistoryService = EffectiveAccessHistoryService;
+exports.EffectiveAccessHistoryService = EffectiveAccessHistoryService = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [core_1.EntityStorageMiddlewareService])
+], EffectiveAccessHistoryService);
+//#endregion
+//#region ----- Pure helpers -----
+function indexById(rows) {
+    var _a;
+    const map = new Map();
+    for (const row of rows) {
+        const id = String((_a = row['id']) !== null && _a !== void 0 ? _a : '');
+        if (id) {
+            map.set(id, row);
+        }
+    }
+    return map;
+}
+function streamTouchesUser(stream, userId) {
+    return stream.intervals.some((interval) => { var _a; return interval.state && String((_a = interval.state['userId']) !== null && _a !== void 0 ? _a : '') === userId; });
+}
+function collectUserIdsFromStreams(streams) {
+    var _a;
+    const ids = new Set();
+    for (const stream of streams) {
+        for (const interval of stream.intervals) {
+            const userId = interval.state ? String((_a = interval.state['userId']) !== null && _a !== void 0 ? _a : '') : '';
+            if (userId) {
+                ids.add(userId);
+            }
+        }
+    }
+    return [...ids];
+}
+function resolveUserDisplayName(user) {
+    var _a, _b, _c, _d;
+    if (!user) {
+        return '';
+    }
+    const profile = user['profile'];
+    const fromProfile = profile
+        ? (0, report_1.resolveDisplayTitle)((_b = (_a = profile['displayName']) !== null && _a !== void 0 ? _a : profile['title']) !== null && _b !== void 0 ? _b : profile['name'])
+        : '';
+    if (fromProfile) {
+        return fromProfile;
+    }
+    return ((0, report_1.resolveDisplayTitle)(user['displayName']) ||
+        String((_c = user['username']) !== null && _c !== void 0 ? _c : '') ||
+        String((_d = user['email']) !== null && _d !== void 0 ? _d : ''));
+}
+//#endregion
+//# sourceMappingURL=effective-access-history.service.js.map

package/server/src/lib/effective-access-history/effective-access-history.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"effective-access-history.service.js","sourceRoot":"","sources":["../../../../../../../libs/modules/security-management/server/src/lib/effective-access-history/effective-access-history.service.ts"],"names":[],"mappings":";AAAA,6BAA6B;;;;AAE7B,2CAA4C;AAC5C,iEAAwF;AACxF,6EAAkG;AAClG,yEAOoD;AACpD,qEAA+E;AAC/E,sFAAyF;AACzF,iFAG0D;AAC1D,mCAA6B;AAY7B,sFAAwF;AACxF,6DAS8B;AAE9B,YAAY;AAEZ,+BAA+B;AAE/B,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAC9C,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAC9C,MAAM,gBAAgB,GAAG,6BAA6B,CAAC;AACvD,MAAM,sBAAsB,GAAG,mCAAmC,CAAC;AAEnE,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAC7B,MAAM,eAAe,GAAG,IAAI,CAAC;AAE7B;;;GAGG;AACH,MAAM,0BAA0B,GAAG,IAAI,CAAC;AAmBxC,YAAY;AAEZ,sDAAsD;AAEtD;;;;;;;;;;GAUG;AAEI,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;IACxC,YAA6B,OAAuC;QAAvC,YAAO,GAAP,OAAO,CAAgC;IAAG,CAAC;IAExE,wCAAwC;IAElC,4BAA4B,CAChC,KAAqC;;YAErC,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;YACvE,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;YACjD,MAAM,CAAC,KAAK,EAAE,eAAe,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACjD,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC;gBAC9B,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,CAAC;aACzC,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAClC,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CACpD,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CACxC,CAAC;YAEF,MAAM,KAAK,GAAG,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;YACjG,OAAO,KAAK;iBACT,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;;gBACX,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACnC,OAAO;oBACL,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,MAAM,EAAE,GAAG,CAAC,GAAG;oBACf,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAA,IAAI,CAAC,MAAM,CAAC,mCAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;oBAChD,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,IAAA,4BAAmB,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;oBACzD,SAAS,EAAE,MAAA,IAAA,0BAAK,EAAC,GAAG,CAAC,IAAI,CAAC,mCAAI,EAAE;oBAChC,OAAO,EAAE,IAAA,0BAAK,EAAC,GAAG,CAAC,EAAE,CAAC;oBACtB,aAAa,EAAE,MAAA,KAAK,CAAC,aAAa,mCAAI,IAAI;oBAC1C,OAAO,EAAE,OAAO,CAAA,MAAA,GAAG,CAAC,IAAI,0CAAG,SAAS,CAAC,CAAA,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI;iBAC7C,CAAC;YACvC,CAAC,CAAC;iBACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QACpG,CAAC;KAAA;IAEK,kCAAkC,CACtC,KAA2C;;YAE3C,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;YACvE,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;YACjD,MAAM,CAAC,KAAK,EAAE,eAAe,EAAE,qBAAqB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACxE,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC;gBAC9B,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,CAAC;gBACxC,IAAI,CAAC,iBAAiB,CAAC,sBAAsB,CAAC;aAC/C,CAAC,CAAC;YAEH,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CACpD,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CACxC,CAAC;YACF,MAAM,kBAAkB,GAAG,IAAI,CAAC,8BAA8B,CAC5D,KAAK,CAAC,MAAM,EACZ,WAAW,EACX,qBAAqB,EACrB,KAAK,EACL,OAAO,EACP,KAAK,CACN,CAAC;YAEF,OAAO,kBAAkB;iBACtB,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAA,4DAA+B,EAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;iBACjF,GAAG,CACF,CAAC,GAAG,EAAE,EAAE;;gBACN,OAAA,CAAC;oBACC,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,aAAa,EAAE,GAAG,CAAC,GAAG;oBACtB,UAAU,EAAE,IAAA,uDAA6B,EAAC,GAAG,CAAC,GAAG,CAAC;oBAClD,SAAS,EAAE,MAAA,IAAA,0BAAK,EAAC,GAAG,CAAC,IAAI,CAAC,mCAAI,EAAE;oBAChC,OAAO,EAAE,IAAA,0BAAK,EAAC,GAAG,CAAC,EAAE,CAAC;oBACtB,aAAa,EAAE,MAAA,KAAK,CAAC,aAAa,mCAAI,IAAI;iBAC3C,CAA0C,CAAA;aAAA,CAC9C;iBACA,IAAI,CACH,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC;gBACxC,CAAC,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC;gBAC9C,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CACzC,CAAC;QACN,CAAC;KAAA;IAEK,qBAAqB,CAAC,KAA8B;;;YACxD,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;YACvE,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;YACjD,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,eAAe,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACxD,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC;gBAC9B,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC;gBAC9B,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,CAAC;aACzC,CAAC,CAAC;YAEH,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAChD,IAAI,CAAC,IAAI,IAAI,CAAC,IAAA,+BAAoB,EAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;gBAClD,OAAO,EAAE,CAAC;YACZ,CAAC;YAED,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAClC,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAClC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAA,IAAI,CAAC,MAAM,CAAC,mCAAI,EAAE,CAAC,CAAC;YAC5C,MAAM,SAAS,GAAG,IAAA,4BAAmB,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YACrD,MAAM,IAAI,GAA4B,EAAE,CAAC;YAEzC,MAAM,OAAO,GAAG,yBAAyB,CAAC,eAAe,CAAC,CAAC;YAC3D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;gBAC1F,MAAM,KAAK,GAAG,IAAI,CAAC,wBAAwB,CACzC,WAAW,EACX,MAAM,EACN,OAAO,EACP,KAAK,EACL,QAAQ,CACT,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC;gBAE5C,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAClC,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;oBAC7B,IAAI,CAAC,IAAI,CAAC;wBACR,MAAM;wBACN,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAA,IAAI,CAAC,UAAU,CAAC,mCAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;wBACpD,WAAW,EAAE,sBAAsB,CAAC,IAAI,CAAC;wBACzC,MAAM,EAAE,KAAK,CAAC,MAAM;wBACpB,QAAQ;wBACR,SAAS;wBACT,SAAS,EAAE,MAAA,IAAA,0BAAK,EAAC,QAAQ,CAAC,IAAI,CAAC,mCAAI,EAAE;wBACrC,OAAO,EAAE,IAAA,0BAAK,EAAC,QAAQ,CAAC,EAAE,CAAC;wBAC3B,aAAa,EAAE,MAAA,KAAK,CAAC,aAAa,mCAAI,IAAI;qBAC3C,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,OAAO,IAAI,CAAC,IAAI,CACd,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CACzF,CAAC;QACJ,CAAC;KAAA;IAEK,2BAA2B,CAC/B,KAAoC;;;YAEpC,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;YACvE,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;YACjD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YAC3C,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO,EAAE,CAAC;YACZ,CAAC;YAED,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,qBAAqB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBAC/E,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC;gBAC9B,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC;gBAC9B,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,CAAC;gBACxC,IAAI,CAAC,iBAAiB,CAAC,sBAAsB,CAAC;aAC/C,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAClC,MAAM,IAAI,GAAkC,EAAE,CAAC;YAC/C,MAAM,OAAO,GAAG,yBAAyB,CAAC,eAAe,CAAC,CAAC;YAE3D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;gBAC1F,MAAM,kBAAkB,GAAG,IAAI,CAAC,8BAA8B,CAC5D,MAAM,EACN,WAAW,EACX,qBAAqB,EACrB,KAAK,EACL,OAAO,EACP,KAAK,CACN,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC;gBAE1C,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAClC,KAAK,MAAM,QAAQ,IAAI,kBAAkB,EAAE,CAAC;oBAC1C,IAAI,CAAC,IAAI,CAAC;wBACR,MAAM;wBACN,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAA,IAAI,CAAC,UAAU,CAAC,mCAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;wBACpD,WAAW,EAAE,sBAAsB,CAAC,IAAI,CAAC;wBACzC,aAAa,EAAE,UAAU;wBACzB,UAAU,EAAE,IAAA,uDAA6B,EAAC,UAAU,CAAC;wBACrD,SAAS,EAAE,MAAA,IAAA,0BAAK,EAAC,QAAQ,CAAC,IAAI,CAAC,mCAAI,EAAE;wBACrC,OAAO,EAAE,IAAA,0BAAK,EAAC,QAAQ,CAAC,EAAE,CAAC;wBAC3B,aAAa,EAAE,MAAA,KAAK,CAAC,aAAa,mCAAI,IAAI;qBAC3C,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,OAAO,IAAI,CAAC,IAAI,CACd,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CACzF,CAAC;QACJ,CAAC;KAAA;IAED,YAAY;IAEZ,uCAAuC;IAE/B,wBAAwB,CAC9B,WAA2B,EAC3B,MAAc,EACd,OAAgC,EAChC,KAA0B,EAC1B,QAA8C;;QAE9C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAiC,CAAC;QAExD,KAAK,MAAM,MAAM,IAAI,WAAW,EAAE,CAAC;YACjC,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;gBACxC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;oBACpB,SAAS;gBACX,CAAC;gBACD,IAAI,MAAM,CAAC,MAAA,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,mCAAI,EAAE,CAAC,KAAK,MAAM,EAAE,CAAC;oBACtD,SAAS;gBACX,CAAC;gBACD,IAAI,IAAA,6BAAkB,EAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;oBACpD,SAAS;gBACX,CAAC;gBAED,MAAM,OAAO,GAAG,IAAA,iCAAY,EAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;gBAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,SAAS;gBACX,CAAC;gBAED,MAAM,OAAO,GAAG,IAAA,6BAAkB,EAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE;oBACnE,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;oBAClC,OAAO,CAAC,CAAC,IAAI,IAAI,IAAA,+BAAoB,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBACvD,CAAC,CAAC,CAAC;gBAEH,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;oBAC7B,MAAM,IAAI,GAAG,MAAA,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,mCAAI,EAAE,CAAC;oBACtC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;oBACnB,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBAC3B,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAoB,EAAE,CAAC;QACjC,KAAK,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,MAAM,EAAE,CAAC;YACzC,KAAK,MAAM,MAAM,IAAI,IAAA,uCAAkB,EAAC,SAAS,CAAC,EAAE,CAAC;gBACnD,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,8BAA8B,CACpC,MAAc,EACd,WAA2B,EAC3B,qBAAqC,EACrC,KAAgC,EAChC,OAAgC,EAChC,KAA0B;;QAE1B,MAAM,qBAAqB,GAA0B,EAAE,CAAC;QACxD,KAAK,MAAM,MAAM,IAAI,WAAW,EAAE,CAAC;YACjC,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;gBACxC,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,MAAM,CAAC,MAAA,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,mCAAI,EAAE,CAAC,KAAK,MAAM,EAAE,CAAC;oBACzE,SAAS;gBACX,CAAC;gBACD,MAAM,OAAO,GAAG,IAAA,iCAAY,EAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;gBAC9C,IAAI,OAAO,EAAE,CAAC;oBACZ,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACtC,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,qBAAqB,GAA0B,EAAE,CAAC;QACxD,KAAK,MAAM,MAAM,IAAI,qBAAqB,EAAE,CAAC;YAC3C,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;gBACxC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;oBACpB,SAAS;gBACX,CAAC;gBACD,MAAM,OAAO,GAAG,IAAA,iCAAY,EAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;gBAC9C,IAAI,OAAO,EAAE,CAAC;oBACZ,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACtC,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,UAAU,GAAG,IAAA,sCAAiB,EAClC,CAAC,GAAG,qBAAqB,EAAE,GAAG,qBAAqB,CAAC,EACpD,KAAK,CACN,CAAC;QACF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,GAAG,EAAiC,CAAC;QAE9D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC/C,MAAM,WAAW,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAClC,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACpC,IAAI,WAAW,CAAC,OAAO,EAAE,IAAI,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;gBACjD,SAAS;YACX,CAAC;YAED,wDAAwD;YACxD,MAAM,IAAI,GAAG,WAAW,CAAC;YACzB,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,MAAM,CAC5D,CAAC,GAAG,EAAE,EAAE,WAAC,OAAA,MAAM,CAAC,MAAA,GAAG,CAAC,QAAQ,CAAC,mCAAI,EAAE,CAAC,KAAK,MAAM,CAAA,EAAA,CAChD,CAAC;YACF,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;YAC7D,MAAM,gBAAgB,GAAG,IAAA,+CAAoC,EAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE;gBACzF,eAAe,EAAE,KAAK;aACvB,CAAC,CAAC;YACH,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAClC,SAAS;YACX,CAAC;YAED,MAAM,WAAW,GAAG,IAAA,2CAAgC,EAClD,KAAK,EACL,MAAM,EACN,gBAAgB,EAChB,OAAO,CACR,CAAC;YACF,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;gBACrC,MAAM,IAAI,GAAG,MAAA,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,mCAAI,EAAE,CAAC;gBAChD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;gBAChD,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAoB,EAAE,CAAC;QACjC,KAAK,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,IAAI,YAAY,EAAE,CAAC;YACnD,KAAK,MAAM,MAAM,IAAI,IAAA,uCAAkB,EAAC,SAAS,CAAC,EAAE,CAAC;gBACnD,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,WAAW,CACjB,OAAuB,EACvB,IAAU;;QAEV,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC9B,MAAM,SAAS,GAA8B,EAAE,CAAC;QAEhD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,MAAM,GAAmC,IAAI,CAAC;YAClD,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;gBACxC,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC;oBACrC,MAAM;gBACR,CAAC;gBACD,MAAM,KAAK,GAAG,MAAA,MAAA,QAAQ,CAAC,EAAE,0CAAE,OAAO,EAAE,mCAAI,MAAM,CAAC,iBAAiB,CAAC;gBACjE,kFAAkF;gBAClF,IAAI,MAAM,GAAG,KAAK,EAAE,CAAC;oBACnB,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC;oBACxB,MAAM;gBACR,CAAC;YACH,CAAC;YACD,IAAI,MAAM,EAAE,CAAC;gBACX,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,YAAY;IAEZ,qCAAqC;IAEvB,iBAAiB,CAAC,UAAkB;;;YAChD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC;YAC/D,MAAM,OAAO,GAAmB,EAAE,CAAC;YAEnC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAA,MAAM,CAAC,IAAI,CAAC,mCAAI,EAAE,CAAC,CAAC;gBAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAA,MAAM,CAAC,UAAU,CAAC,mCAAI,EAAE,CAAC,CAAC;gBAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,SAAS;gBACX,CAAC;gBACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;gBAC1D,OAAO,CAAC,IAAI,CAAC;oBACX,QAAQ;oBACR,QAAQ;oBACR,SAAS,EAAE,IAAA,wCAAmB,EAAC,OAAO,CAAC;iBACxC,CAAC,CAAC;YACL,CAAC;YAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,OAAO,OAAO,CAAC;YACjB,CAAC;YAED,OAAO,IAAI,CAAC,oCAAoC,CAAC,UAAU,CAAC,CAAC;QAC/D,CAAC;KAAA;IAED;;;OAGG;IACW,oCAAoC,CAAC,UAAkB;;;YACnE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;YACjD,MAAM,OAAO,GAAmB,EAAE,CAAC;YAEnC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAA,GAAG,CAAC,IAAI,CAAC,mCAAI,EAAE,CAAC,CAAC;gBACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,SAAS;gBACX,CAAC;gBAED,MAAM,UAAU,GACd,MAAA,MAAA,IAAA,YAAG,EAAC,GAAG,EAAE,sBAAsB,CAAC,mCAAI,IAAA,YAAG,EAAC,GAAG,EAAE,WAAW,CAAC,mCAAI,0BAA0B,CAAC;gBAC1F,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;gBAC1C,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBAEvE,OAAO,CAAC,IAAI,CAAC;oBACX,QAAQ,EAAE,QAAQ,UAAU,IAAI,QAAQ,EAAE;oBAC1C,QAAQ;oBACR,SAAS,EAAE;wBACT;4BACE,IAAI,EAAE,YAAY;4BAClB,EAAE,EAAE,IAAI;4BACR,KAAK,EAAE,GAAG;yBACX;qBACF;iBACF,CAAC,CAAC;YACL,CAAC;YAED,OAAO,OAAO,CAAC;QACjB,CAAC;KAAA;IAEa,uBAAuB,CAAC,UAAkB;;;YACtD,MAAM,KAAK,GAA8B,EAAE,CAAC;YAC5C,IAAI,IAAI,GAAG,CAAC,CAAC;YAEb,SAAS,CAAC;gBACR,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CACnC,kCAAqB,EACrB,IAAA,2CAAgC,EAAC;oBAC/B,IAAI;oBACJ,IAAI,EAAE,gBAAgB;oBACtB,MAAM,EAAE;wBACN,KAAK,EAAE,KAAK;wBACZ,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;qBACnF;iBACF,CAAC,CACH,CAAC;gBACF,MAAM,KAAK,GAAG,MAAC,IAAA,YAAG,EAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAA+B,mCAAI,EAAE,CAAC;gBAC1E,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;gBACrB,IAAI,KAAK,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;oBACpC,MAAM;gBACR,CAAC;gBACD,IAAI,IAAI,gBAAgB,CAAC;YAC3B,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;KAAA;IAEa,oBAAoB,CAAC,QAAgB;;;YACjD,MAAM,KAAK,GAAuB,EAAE,CAAC;YACrC,IAAI,IAAI,GAAG,CAAC,CAAC;YAEb,SAAS,CAAC;gBACR,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CACnC,iCAAoB,EACpB,IAAA,2CAAgC,EAAC;oBAC/B,IAAI;oBACJ,IAAI,EAAE,eAAe;oBACrB,MAAM,EAAE;wBACN,KAAK,EAAE,KAAK;wBACZ,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;qBAC/E;oBACD,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;iBAC/C,CAAC,CACH,CAAC;gBACF,MAAM,KAAK,GAAG,MAAC,IAAA,YAAG,EAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAAwB,mCAAI,EAAE,CAAC;gBACnE,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;gBACrB,IAAI,KAAK,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;oBACnC,MAAM;gBACR,CAAC;gBACD,IAAI,IAAI,eAAe,CAAC;YAC1B,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;KAAA;IAEa,YAAY,CAAC,UAAkB;;YAC3C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CACrC,UAAU,EACV,IAAA,2CAAgC,EAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAC3D,CAAC;YACF,MAAM,KAAK,GAAG,IAAA,YAAG,EAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAA8B,CAAC;YACpE,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,CAAC;KAAA;IAED,YAAY;IAEZ,qCAAqC;IAE7B,YAAY,CAAC,QAAgB,EAAE,aAAsB;QAC3D,OAAO;YACL,QAAQ;YACR,aAAa,EAAE,aAAa,IAAI,SAAS;YACzC,mBAAmB,EAAE,0BAA0B;SAChD,CAAC;IACJ,CAAC;IAEO,OAAO,CAAC,IAAU,EAAE,EAAQ;QAClC,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACtB,CAAC;CAGF,CAAA;AAjfY,sEAA6B;wCAA7B,6BAA6B;IADzC,IAAA,mBAAU,GAAE;6CAE2B,qCAA8B;GADzD,6BAA6B,CAifzC;AAED,YAAY;AAEZ,kCAAkC;AAElC,SAAS,SAAS,CAAC,IAA+B;;IAChD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAmC,CAAC;IACvD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,EAAE,GAAG,MAAM,CAAC,MAAA,GAAG,CAAC,IAAI,CAAC,mCAAI,EAAE,CAAC,CAAC;QACnC,IAAI,EAAE,EAAE,CAAC;YACP,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAoB,EAAE,MAAc;IAC7D,OAAO,MAAM,CAAC,SAAS,CAAC,IAAI,CAC1B,CAAC,QAAQ,EAAE,EAAE,WAAC,OAAA,QAAQ,CAAC,KAAK,IAAI,MAAM,CAAC,MAAA,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,mCAAI,EAAE,CAAC,KAAK,MAAM,CAAA,EAAA,CAClF,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,OAAuB;;IACxD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAA,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,mCAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,IAAI,MAAM,EAAE,CAAC;gBACX,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAyC;;IACvE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAwC,CAAC;IACvE,MAAM,WAAW,GAAG,OAAO;QACzB,CAAC,CAAC,IAAA,4BAAmB,EAAC,MAAA,MAAA,OAAO,CAAC,aAAa,CAAC,mCAAI,OAAO,CAAC,OAAO,CAAC,mCAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QACpF,CAAC,CAAC,EAAE,CAAC;IACP,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,OAAO,CACL,IAAA,4BAAmB,EAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACxC,MAAM,CAAC,MAAA,IAAI,CAAC,UAAU,CAAC,mCAAI,EAAE,CAAC;QAC9B,MAAM,CAAC,MAAA,IAAI,CAAC,OAAO,CAAC,mCAAI,EAAE,CAAC,CAC5B,CAAC;AACJ,CAAC;AAED,YAAY"}

package/server/src/lib/effective-access-history/effective-access-history.types.d.ts

@@ -0,0 +1,64 @@
+/** Query window for historical effective-access reports (overlap semantics). */
+export interface EffectiveAccessHistoryRangeQuery {
+    tenantId: string;
+    applicationId?: string;
+    from: Date;
+    to: Date;
+}
+export interface UserEffectiveRolesHistoryQuery extends EffectiveAccessHistoryRangeQuery {
+    userId: string;
+}
+export interface UserEffectivePermissionsHistoryQuery extends EffectiveAccessHistoryRangeQuery {
+    userId: string;
+    /** Case-insensitive contains over permission title, description, and key. */
+    permissionSearch?: string;
+}
+export interface RoleHoldersHistoryQuery extends EffectiveAccessHistoryRangeQuery {
+    roleId: string;
+}
+export interface PermissionHoldersHistoryQuery extends EffectiveAccessHistoryRangeQuery {
+    permission: string;
+}
+export interface EffectiveRoleIntervalRow {
+    userId: string;
+    roleId: string;
+    roleName: string;
+    roleTitle: string;
+    validFrom: string;
+    validTo: string | null;
+    applicationId: string | null;
+    grantId: string | null;
+}
+export interface EffectivePermissionIntervalRow {
+    userId: string;
+    /** Stable permission key (search / export identity). */
+    permissionKey: string;
+    /** Display value: i18n title key (translated in report table) or humanized fallback. */
+    permission: string;
+    validFrom: string;
+    validTo: string | null;
+    applicationId: string | null;
+}
+export interface RoleHolderIntervalRow {
+    userId: string;
+    username: string;
+    displayName: string;
+    roleId: string;
+    roleName: string;
+    roleTitle: string;
+    validFrom: string;
+    validTo: string | null;
+    applicationId: string | null;
+}
+export interface PermissionHolderIntervalRow {
+    userId: string;
+    username: string;
+    displayName: string;
+    /** Stable permission key. */
+    permissionKey: string;
+    /** Display value: i18n title key or humanized fallback. */
+    permission: string;
+    validFrom: string;
+    validTo: string | null;
+    applicationId: string | null;
+}

package/server/src/lib/effective-access-history/effective-access-history.types.js

@@ -0,0 +1,5 @@
+"use strict";
+//#region ----- Types -----
+Object.defineProperty(exports, "__esModule", { value: true });
+//#endregion
+//# sourceMappingURL=effective-access-history.types.js.map

package/server/src/lib/effective-access-history/effective-access-history.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"effective-access-history.types.js","sourceRoot":"","sources":["../../../../../../../libs/modules/security-management/server/src/lib/effective-access-history/effective-access-history.types.ts"],"names":[],"mappings":";AAAA,2BAA2B;;AA2E3B,YAAY"}

package/server/src/lib/effective-access-history/version-as-of.util.d.ts

@@ -0,0 +1,37 @@
+/** Half-open time interval `[from, to)`. `to === null` means open-ended. */
+export interface HistoryTimeInterval {
+    from: Date;
+    to: Date | null;
+}
+/** State held over a reconstructed history interval. */
+export interface HistoryStateInterval<T> {
+    from: Date;
+    to: Date | null;
+    state: T;
+}
+export interface VersionEntryLike {
+    versionNumber?: number;
+    changedAt?: string;
+    changeType?: string;
+    snapshotJson?: unknown;
+}
+/** Sort entries ascending by versionNumber, then changedAt. */
+export declare function sortVersionEntries<T extends VersionEntryLike>(entries: T[]): T[];
+/**
+ * Reconstruct entity snapshot at `asOf` from a version stream.
+ * Uses the latest entry with `changedAt <= asOf`. Delete → null.
+ */
+export declare function reconstructSnapshotAt(entries: VersionEntryLike[], asOf: Date): Record<string, unknown> | null;
+/**
+ * Build contiguous state intervals from ordered version entries.
+ * Each Create/Update opens/continues a state until the next entry (or open-ended).
+ */
+export declare function buildStateIntervals(entries: VersionEntryLike[]): HistoryStateInterval<Record<string, unknown> | null>[];
+export declare function intervalsOverlap(a: HistoryTimeInterval, b: HistoryTimeInterval): boolean;
+/** Clip `interval` to `range`; returns null when there is no overlap. */
+export declare function clipInterval(interval: HistoryTimeInterval, range: HistoryTimeInterval): HistoryTimeInterval | null;
+/** Merge overlapping/adjacent intervals (assumes same payload identity). */
+export declare function mergeTimeIntervals(intervals: HistoryTimeInterval[]): HistoryTimeInterval[];
+/** Collect sorted unique boundary timestamps inside/around a range. */
+export declare function collectBoundaries(intervals: HistoryTimeInterval[], range: HistoryTimeInterval): Date[];
+export declare function toIso(date: Date | null | undefined): string | null;