@atlasauth/emulator-core 0.1.0 → 0.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/adopt.d.ts +50 -0
- package/dist/adopt.js +57 -0
- package/dist/adopt.js.map +1 -0
- package/dist/coverage.d.ts +15 -0
- package/dist/coverage.js +31 -0
- package/dist/coverage.js.map +1 -0
- package/dist/crypto-util.d.ts +10 -0
- package/dist/crypto-util.js +76 -0
- package/dist/crypto-util.js.map +1 -0
- package/dist/engine.d.ts +33 -2
- package/dist/engine.js +53 -8
- package/dist/engine.js.map +1 -1
- package/dist/error-catalog.js +8 -0
- package/dist/error-catalog.js.map +1 -1
- package/dist/event-gate.d.ts +3 -0
- package/dist/event-gate.js +372 -0
- package/dist/event-gate.js.map +1 -0
- package/dist/generic.js +9 -1
- package/dist/generic.js.map +1 -1
- package/dist/handlers/approvals.d.ts +2 -0
- package/dist/handlers/approvals.js +365 -0
- package/dist/handlers/approvals.js.map +1 -0
- package/dist/handlers/authz.d.ts +2 -0
- package/dist/handlers/authz.js +347 -0
- package/dist/handlers/authz.js.map +1 -0
- package/dist/handlers/billing.d.ts +2 -0
- package/dist/handlers/billing.js +398 -0
- package/dist/handlers/billing.js.map +1 -0
- package/dist/handlers/connections.d.ts +2 -0
- package/dist/handlers/connections.js +332 -0
- package/dist/handlers/connections.js.map +1 -0
- package/dist/handlers/device.d.ts +47 -0
- package/dist/handlers/device.js +648 -0
- package/dist/handlers/device.js.map +1 -0
- package/dist/handlers/federation.d.ts +2 -0
- package/dist/handlers/federation.js +481 -0
- package/dist/handlers/federation.js.map +1 -0
- package/dist/handlers/governance.d.ts +2 -0
- package/dist/handlers/governance.js +460 -0
- package/dist/handlers/governance.js.map +1 -0
- package/dist/handlers/hooks.js +4 -1
- package/dist/handlers/hooks.js.map +1 -1
- package/dist/handlers/index.d.ts +5 -1
- package/dist/handlers/index.js +32 -3
- package/dist/handlers/index.js.map +1 -1
- package/dist/handlers/keys.js +6 -1
- package/dist/handlers/keys.js.map +1 -1
- package/dist/handlers/machines.js +55 -8
- package/dist/handlers/machines.js.map +1 -1
- package/dist/handlers/messaging.d.ts +4 -0
- package/dist/handlers/messaging.js +486 -0
- package/dist/handlers/messaging.js.map +1 -0
- package/dist/handlers/oauth-flows.d.ts +28 -0
- package/dist/handlers/oauth-flows.js +419 -0
- package/dist/handlers/oauth-flows.js.map +1 -0
- package/dist/handlers/oauth.d.ts +75 -0
- package/dist/handlers/oauth.js +608 -0
- package/dist/handlers/oauth.js.map +1 -0
- package/dist/handlers/passkeys.d.ts +3 -0
- package/dist/handlers/passkeys.js +293 -0
- package/dist/handlers/passkeys.js.map +1 -0
- package/dist/handlers/platform.d.ts +15 -0
- package/dist/handlers/platform.js +454 -0
- package/dist/handlers/platform.js.map +1 -0
- package/dist/handlers/round2.d.ts +8 -0
- package/dist/handlers/round2.js +372 -0
- package/dist/handlers/round2.js.map +1 -0
- package/dist/handlers/scim.d.ts +2 -0
- package/dist/handlers/scim.js +408 -0
- package/dist/handlers/scim.js.map +1 -0
- package/dist/handlers/sessions.d.ts +7 -3
- package/dist/handlers/sessions.js +55 -25
- package/dist/handlers/sessions.js.map +1 -1
- package/dist/handlers/support.d.ts +20 -0
- package/dist/handlers/support.js +62 -0
- package/dist/handlers/support.js.map +1 -0
- package/dist/handlers/users.js +4 -0
- package/dist/handlers/users.js.map +1 -1
- package/dist/handlers/workflows.d.ts +2 -0
- package/dist/handlers/workflows.js +428 -0
- package/dist/handlers/workflows.js.map +1 -0
- package/dist/index.d.ts +8 -0
- package/dist/index.js +23 -1
- package/dist/index.js.map +1 -1
- package/dist/jws.d.ts +41 -0
- package/dist/jws.js +133 -0
- package/dist/jws.js.map +1 -0
- package/dist/messages.d.ts +7 -0
- package/dist/messages.js +8 -4
- package/dist/messages.js.map +1 -1
- package/dist/parity-bin.js +3 -1
- package/dist/parity-bin.js.map +1 -1
- package/dist/parity-routes.d.ts +14 -0
- package/dist/parity-routes.js +421 -0
- package/dist/parity-routes.js.map +1 -0
- package/dist/parity.d.ts +10 -3
- package/dist/parity.js +14 -5
- package/dist/parity.js.map +1 -1
- package/dist/tokens.d.ts +17 -0
- package/dist/tokens.js +46 -0
- package/dist/tokens.js.map +1 -1
- package/dist/webauthn-virtual.d.ts +70 -0
- package/dist/webauthn-virtual.js +186 -0
- package/dist/webauthn-virtual.js.map +1 -0
- package/dist/webhook-ext.d.ts +16 -0
- package/dist/webhook-ext.js +218 -0
- package/dist/webhook-ext.js.map +1 -0
- package/dist/webhooks.d.ts +3 -0
- package/dist/webhooks.js +37 -3
- package/dist/webhooks.js.map +1 -1
- package/package.json +2 -2
|
@@ -0,0 +1,347 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.authzHandlers = authzHandlers;
|
|
4
|
+
const errors_1 = require("../errors");
|
|
5
|
+
const store_1 = require("../store");
|
|
6
|
+
const support_1 = require("./support");
|
|
7
|
+
const util_1 = require("./util");
|
|
8
|
+
/**
|
|
9
|
+
* Authorization introspection on the engine's own state: `POST /v1/authz/explain` (why a user has or lacks a permission,
|
|
10
|
+
* with every contributing role), `POST /v1/authz/rbac/check` (the same check, written to the decision log),
|
|
11
|
+
* `POST /v1/authz/what_if` (replay the logged decisions under a candidate role edit and see what flips), managed FGA sync
|
|
12
|
+
* (memberships and org roles become tuples in one store, with backfill, runs and purge) and the authorization event feed.
|
|
13
|
+
* Layers the emulator has no data for (groups, resource roles, ABAC, access policies, FGA checks) are reported as
|
|
14
|
+
* `skipped` with a reason and never decide, exactly as a layer that errored would not.
|
|
15
|
+
*/
|
|
16
|
+
const LAYERS = ['rbac', 'org_roles', 'groups', 'resource_roles', 'abac', 'access_policies', 'fga'];
|
|
17
|
+
const MAX_WAIT_MS = 25_000;
|
|
18
|
+
const REPLAY_LIMIT_DEFAULT = 2000;
|
|
19
|
+
const REPLAY_LIMIT_MAX = 10_000;
|
|
20
|
+
const bad = (message, param) => new errors_1.EmulatorError('VALIDATION_FAILED', message, param);
|
|
21
|
+
const st = (0, support_1.engineState)((e) => ({
|
|
22
|
+
decisions: new store_1.Table('authz_decisions', e.clock.now, 'azd'),
|
|
23
|
+
whatIf: new store_1.Table('authz_what_if_runs', e.clock.now, 'wif'),
|
|
24
|
+
runs: new store_1.Table('fga_sync_runs', e.clock.now, 'fsr'),
|
|
25
|
+
events: [],
|
|
26
|
+
seq: 0,
|
|
27
|
+
config: { enabled: false, store_id: null, memberships: true, org_roles: true, groups: true, updated_at: null },
|
|
28
|
+
managed: new Map(),
|
|
29
|
+
}));
|
|
30
|
+
const permMatches = (have, want) => have === want || have === '*' || (have.endsWith(':*') && want.startsWith(have.slice(0, -1)));
|
|
31
|
+
/** What a user's organization roles grant for one permission, optionally under role edits (`edits`: role key -> { add, remove }). */
|
|
32
|
+
function rbac(e, userId, permission, organizationId, edits) {
|
|
33
|
+
const contributions = [];
|
|
34
|
+
for (const m of e.db.memberships.filter((x) => x.user_id === userId && (!organizationId || x.organization_id === organizationId))) {
|
|
35
|
+
const role = e.db.roles.find((r) => r.key === m.role);
|
|
36
|
+
const edit = edits?.get(m.role);
|
|
37
|
+
const perms = (role?.permissions ?? []).filter((p) => !edit?.remove.includes(p)).concat(edit?.add ?? []);
|
|
38
|
+
const matched = perms.some((p) => permMatches(p, permission));
|
|
39
|
+
contributions.push({ layer: 'rbac', effect: 'allow', matched, permission, via: { kind: 'org_role', key: m.role, organization_id: m.organization_id } });
|
|
40
|
+
}
|
|
41
|
+
return { allowed: contributions.some((c) => c.matched), contributions };
|
|
42
|
+
}
|
|
43
|
+
function explain(e, userId, permission, organizationId) {
|
|
44
|
+
if (!e.db.users.get(userId))
|
|
45
|
+
throw (0, errors_1.notFound)('User');
|
|
46
|
+
const r = rbac(e, userId, permission, organizationId);
|
|
47
|
+
const skipped = (reason) => ({ status: 'skipped', effect: 'none', reason, contributions: [] });
|
|
48
|
+
const layers = { rbac: { status: 'evaluated', effect: r.allowed ? 'allow' : 'none', contributions: r.contributions }, org_roles: skipped('No delegated roles in the emulator.') };
|
|
49
|
+
for (const l of LAYERS.slice(2))
|
|
50
|
+
layers[l] = skipped(`The emulator holds no ${l.replace('_', ' ')} data.`);
|
|
51
|
+
const deciding = r.contributions.filter((c) => c.matched);
|
|
52
|
+
const decision = r.allowed ? 'allow' : 'deny';
|
|
53
|
+
return { object: 'authz_explanation', subject: { id: userId }, permission, organization_id: organizationId ?? null, decision, combination: 'deny_overrides', summary: r.allowed ? `Allowed by ${deciding.map((c) => c.via.key).join(', ')}.` : 'No layer allows this: denied by default.', deciding, layers, evaluated_at: e.clock.now() };
|
|
54
|
+
}
|
|
55
|
+
function pushEvent(e, kind, storeId, source, data) {
|
|
56
|
+
const s = st(e);
|
|
57
|
+
s.events.push({ object: 'authz_event', id: e.db.newId('azev'), seq: ++s.seq, kind, store_id: storeId, store_revision: s.seq, source, data, created_at: e.clock.now() });
|
|
58
|
+
}
|
|
59
|
+
const parseEdits = (body) => {
|
|
60
|
+
const roles = body.candidate?.rbac?.roles;
|
|
61
|
+
if (roles === undefined)
|
|
62
|
+
return undefined;
|
|
63
|
+
if (!Array.isArray(roles) || !roles.length || roles.length > 200)
|
|
64
|
+
throw bad('candidate.rbac.roles must list 1-200 role edits.', 'candidate.rbac.roles');
|
|
65
|
+
const out = new Map();
|
|
66
|
+
roles.forEach((r, i) => {
|
|
67
|
+
if (!r || typeof r !== 'object' || (r.type !== 'org_role' && r.type !== 'app_role'))
|
|
68
|
+
throw bad('type must be org_role or app_role.', `candidate.rbac.roles[${i}].type`);
|
|
69
|
+
if (typeof r.key !== 'string' || !r.key)
|
|
70
|
+
throw bad('key is required.', `candidate.rbac.roles[${i}].key`);
|
|
71
|
+
const list = (v, f) => {
|
|
72
|
+
if (v === undefined)
|
|
73
|
+
return [];
|
|
74
|
+
if (!Array.isArray(v) || v.some((x) => typeof x !== 'string'))
|
|
75
|
+
throw bad(`${f} must be a list of permissions.`, `candidate.rbac.roles[${i}].${f}`);
|
|
76
|
+
return v;
|
|
77
|
+
};
|
|
78
|
+
const prev = out.get(r.key) ?? { add: [], remove: [] };
|
|
79
|
+
out.set(r.key, { add: [...prev.add, ...list(r.add_permissions, 'add_permissions')], remove: [...prev.remove, ...list(r.remove_permissions, 'remove_permissions')] });
|
|
80
|
+
});
|
|
81
|
+
return out;
|
|
82
|
+
};
|
|
83
|
+
const desiredTuples = (e) => {
|
|
84
|
+
const cfg = st(e).config;
|
|
85
|
+
const out = [];
|
|
86
|
+
for (const m of e.db.memberships.all()) {
|
|
87
|
+
const u = e.db.users.get(m.user_id);
|
|
88
|
+
if (!u || u.deleted)
|
|
89
|
+
continue;
|
|
90
|
+
if (cfg.memberships)
|
|
91
|
+
out.push({ user: `user:${m.user_id}`, relation: 'member', object: `organization:${m.organization_id}` });
|
|
92
|
+
if (cfg.org_roles && m.role)
|
|
93
|
+
out.push({ user: `user:${m.user_id}`, relation: String(m.role).replace(/^org:/, ''), object: `organization:${m.organization_id}` });
|
|
94
|
+
}
|
|
95
|
+
return out;
|
|
96
|
+
};
|
|
97
|
+
const tupleKey = (t) => `${t.user}|${t.relation}|${t.object}`;
|
|
98
|
+
/** One sync run: write what should exist; with `repair`, also delete managed tuples that no longer should. Only managed tuples are ever touched. */
|
|
99
|
+
function runSync(e, kind, repair) {
|
|
100
|
+
const s = st(e);
|
|
101
|
+
const now = e.clock.now();
|
|
102
|
+
const want = new Map(desiredTuples(e).map((t) => [tupleKey(t), t]));
|
|
103
|
+
let written = 0;
|
|
104
|
+
let deleted = 0;
|
|
105
|
+
for (const [k, t] of want) {
|
|
106
|
+
if (s.managed.has(k))
|
|
107
|
+
continue;
|
|
108
|
+
s.managed.set(k, t);
|
|
109
|
+
written++;
|
|
110
|
+
pushEvent(e, 'tuple_written', s.config.store_id, 'sync', { ...t });
|
|
111
|
+
e.webhooks.emit('fga.tuple_written', { object: 'fga_tuple_batch', store_id: s.config.store_id, store_revision: null, source: 'sync', count: 1, tuples: [{ ...t }] });
|
|
112
|
+
}
|
|
113
|
+
if (repair) {
|
|
114
|
+
for (const [k, t] of [...s.managed]) {
|
|
115
|
+
if (want.has(k))
|
|
116
|
+
continue;
|
|
117
|
+
s.managed.delete(k);
|
|
118
|
+
deleted++;
|
|
119
|
+
pushEvent(e, 'tuple_deleted', s.config.store_id, 'sync', { ...t });
|
|
120
|
+
e.webhooks.emit('fga.tuple_deleted', { object: 'fga_tuple_batch', store_id: s.config.store_id, store_revision: null, source: 'sync', count: 1, tuples: [{ ...t }] });
|
|
121
|
+
}
|
|
122
|
+
}
|
|
123
|
+
const run = s.runs.insert({ kind, status: 'completed', store_id: s.config.store_id, repair, written, deleted, managed: s.managed.size, error: null, created_at: now, completed_at: now });
|
|
124
|
+
pushEvent(e, 'sync_run', s.config.store_id, 'sync', { run_id: run.id, written, deleted });
|
|
125
|
+
e.webhooks.emit('fga_sync.completed', { object: 'fga_sync_run', id: run.id, store_id: s.config.store_id, written, deleted });
|
|
126
|
+
return run;
|
|
127
|
+
}
|
|
128
|
+
const runView = (r) => ({ object: 'fga_sync_run', id: r.id, kind: r.kind, status: r.status, store_id: r.store_id, repair: r.repair, tuples_written: r.written, tuples_deleted: r.deleted, managed_tuples: r.managed, error: r.error, created_at: r.created_at, completed_at: r.completed_at });
|
|
129
|
+
const statusView = (e) => {
|
|
130
|
+
const s = st(e);
|
|
131
|
+
const last = s.runs.all()[0];
|
|
132
|
+
return { object: 'fga_sync', enabled: s.config.enabled, store_id: s.config.store_id, memberships: s.config.memberships, org_roles: s.config.org_roles, groups: s.config.groups, managed_tuples: s.managed.size, last_run: last ? runView(last) : null, updated_at: s.config.updated_at };
|
|
133
|
+
};
|
|
134
|
+
const storeExists = (e, id) => !!e.generic.get('fga/stores')?.get(id);
|
|
135
|
+
function authzHandlers() {
|
|
136
|
+
const whatIfView = (r, full) => ({ object: 'authz_what_if_run', id: r.id, status: 'completed', created_at: r.created_at, window: r.window, evaluated: r.evaluated, changed: r.changed, flipped_to_allow: r.flipped_to_allow, flipped_to_deny: r.flipped_to_deny, truncated: r.truncated, not_evaluated: r.not_evaluated, ...(full ? { samples: r.samples } : {}) });
|
|
137
|
+
return [
|
|
138
|
+
{
|
|
139
|
+
method: 'POST',
|
|
140
|
+
pattern: '/v1/authz/explain',
|
|
141
|
+
scope: 'authz_decisions:read',
|
|
142
|
+
handler: (c) => {
|
|
143
|
+
const id = c.body.subject?.id;
|
|
144
|
+
if (typeof id !== 'string' || !id)
|
|
145
|
+
throw bad('subject.id is required.', 'subject.id');
|
|
146
|
+
const permission = c.body.permission ?? c.body.action;
|
|
147
|
+
if (typeof permission !== 'string' || !permission)
|
|
148
|
+
throw bad('permission (or action) is required.', 'permission');
|
|
149
|
+
if (c.body.organization_id !== undefined && typeof c.body.organization_id !== 'string')
|
|
150
|
+
throw bad('organization_id must be a string.', 'organization_id');
|
|
151
|
+
return { body: explain(c.engine, id, permission, c.body.organization_id) };
|
|
152
|
+
},
|
|
153
|
+
},
|
|
154
|
+
{
|
|
155
|
+
// The same role check, written to the decision log (the corpus what-if replays).
|
|
156
|
+
method: 'POST',
|
|
157
|
+
pattern: '/v1/authz/rbac/check',
|
|
158
|
+
scope: 'authz_decisions:read',
|
|
159
|
+
handler: (c) => {
|
|
160
|
+
const e = c.engine;
|
|
161
|
+
const id = c.body.subject?.id;
|
|
162
|
+
if (typeof id !== 'string' || !id)
|
|
163
|
+
throw bad('subject.id is required.', 'subject.id');
|
|
164
|
+
if (typeof c.body.permission !== 'string' || !c.body.permission)
|
|
165
|
+
throw bad('permission is required.', 'permission');
|
|
166
|
+
if (!e.db.users.get(id))
|
|
167
|
+
throw (0, errors_1.notFound)('User');
|
|
168
|
+
const r = rbac(e, id, c.body.permission, c.body.organization_id);
|
|
169
|
+
const held = r.contributions.filter((x) => x.matched);
|
|
170
|
+
st(e).decisions.insert({ source: 'rbac', user_id: id, permission: c.body.permission, organization_id: c.body.organization_id ?? null, allowed: r.allowed, at: e.clock.now() });
|
|
171
|
+
return { body: { object: 'rbac_check', allowed: r.allowed, decision: r.allowed ? 'allow' : 'deny', grants: held.map((h) => h.via.key), rules: held } };
|
|
172
|
+
},
|
|
173
|
+
},
|
|
174
|
+
{
|
|
175
|
+
method: 'POST',
|
|
176
|
+
pattern: '/v1/authz/what_if',
|
|
177
|
+
scope: 'authz_decisions:read',
|
|
178
|
+
handler: (c) => {
|
|
179
|
+
const e = c.engine;
|
|
180
|
+
const cand = c.body.candidate;
|
|
181
|
+
if (!cand || typeof cand !== 'object' || Array.isArray(cand))
|
|
182
|
+
throw bad('candidate is required.', 'candidate');
|
|
183
|
+
const edits = parseEdits(c.body);
|
|
184
|
+
const notEvaluated = [];
|
|
185
|
+
for (const k of ['abac', 'fga', 'access_policy'])
|
|
186
|
+
if (cand[k] !== undefined)
|
|
187
|
+
notEvaluated.push(k);
|
|
188
|
+
if (cand.fga !== undefined && (!cand.fga || typeof cand.fga.store_id !== 'string' || !cand.fga.store_id))
|
|
189
|
+
throw bad('candidate.fga.store_id is required.', 'candidate.fga.store_id');
|
|
190
|
+
if (!edits && !notEvaluated.length)
|
|
191
|
+
throw bad('candidate needs at least one of abac, rbac, fga, access_policy.', 'candidate');
|
|
192
|
+
const until = c.body.until === undefined ? e.clock.now() : Date.parse(String(c.body.until));
|
|
193
|
+
const days = (0, support_1.intIn)(c.body.days, 'days', 1, 30, 7);
|
|
194
|
+
const since = c.body.since === undefined ? until - days * 86_400_000 : Date.parse(String(c.body.since));
|
|
195
|
+
if (Number.isNaN(until) || Number.isNaN(since))
|
|
196
|
+
throw bad('since and until must be ISO 8601 times.', 'since');
|
|
197
|
+
if (since >= until)
|
|
198
|
+
throw bad('since must be before until.', 'since');
|
|
199
|
+
if (until - since > 31 * 86_400_000)
|
|
200
|
+
throw bad('The window can be at most 31 days.', 'since');
|
|
201
|
+
const limit = (0, support_1.intIn)(c.body.limit, 'limit', 1, REPLAY_LIMIT_MAX, REPLAY_LIMIT_DEFAULT);
|
|
202
|
+
const all = st(e).decisions.all().filter((d) => d.at >= since && d.at <= until);
|
|
203
|
+
const rows = all.slice(0, limit);
|
|
204
|
+
const flips = [];
|
|
205
|
+
let toAllow = 0;
|
|
206
|
+
let toDeny = 0;
|
|
207
|
+
for (const d of rows) {
|
|
208
|
+
if (!edits)
|
|
209
|
+
break;
|
|
210
|
+
const next = rbac(e, d.user_id, d.permission, d.organization_id ?? undefined, edits).allowed;
|
|
211
|
+
if (next === d.allowed)
|
|
212
|
+
continue;
|
|
213
|
+
next ? toAllow++ : toDeny++;
|
|
214
|
+
flips.push({ decision_id: d.id, user_id: d.user_id, permission: d.permission, organization_id: d.organization_id, before: d.allowed ? 'allow' : 'deny', after: next ? 'allow' : 'deny' });
|
|
215
|
+
}
|
|
216
|
+
const result = { evaluated: rows.length, changed: flips.length, flipped_to_allow: toAllow, flipped_to_deny: toDeny, truncated: all.length > rows.length, not_evaluated: notEvaluated, samples: flips.slice(0, 25), window: { since, until } };
|
|
217
|
+
if (c.body.save === false)
|
|
218
|
+
return { body: { object: 'authz_what_if_run', id: null, status: 'completed', created_at: e.clock.now(), ...result } };
|
|
219
|
+
const row = st(e).whatIf.insert({ ...result, created_at: e.clock.now() });
|
|
220
|
+
return { status: 201, body: whatIfView(row, true) };
|
|
221
|
+
},
|
|
222
|
+
},
|
|
223
|
+
{ method: 'GET', pattern: '/v1/authz/what_if', scope: 'authz_decisions:read', handler: (c) => (0, util_1.listReply)(c, st(c.engine).whatIf.all(), (r) => whatIfView(r, false)) },
|
|
224
|
+
{
|
|
225
|
+
method: 'GET',
|
|
226
|
+
pattern: '/v1/authz/what_if/:id',
|
|
227
|
+
scope: 'authz_decisions:read',
|
|
228
|
+
handler: (c) => {
|
|
229
|
+
const r = st(c.engine).whatIf.get(c.params.id);
|
|
230
|
+
if (!r)
|
|
231
|
+
throw (0, errors_1.notFound)('What-if run');
|
|
232
|
+
return { body: whatIfView(r, true) };
|
|
233
|
+
},
|
|
234
|
+
},
|
|
235
|
+
{
|
|
236
|
+
method: 'DELETE',
|
|
237
|
+
pattern: '/v1/authz/what_if/:id',
|
|
238
|
+
scope: 'authz_decisions:write',
|
|
239
|
+
handler: (c) => {
|
|
240
|
+
if (!st(c.engine).whatIf.delete(c.params.id ?? ''))
|
|
241
|
+
throw (0, errors_1.notFound)('What-if run');
|
|
242
|
+
return { body: { object: 'authz_what_if_run', id: c.params.id, deleted: true } };
|
|
243
|
+
},
|
|
244
|
+
},
|
|
245
|
+
// ── managed FGA sync ──
|
|
246
|
+
{ method: 'GET', pattern: '/v1/fga/sync', scope: 'fga:read', handler: (c) => ({ body: statusView(c.engine) }) },
|
|
247
|
+
{
|
|
248
|
+
method: 'PUT',
|
|
249
|
+
pattern: '/v1/fga/sync',
|
|
250
|
+
scope: 'fga:write',
|
|
251
|
+
handler: (c) => {
|
|
252
|
+
const e = c.engine;
|
|
253
|
+
const s = st(e);
|
|
254
|
+
const b = c.body;
|
|
255
|
+
for (const k of ['enabled', 'memberships', 'org_roles', 'groups'])
|
|
256
|
+
if (b[k] !== undefined && typeof b[k] !== 'boolean')
|
|
257
|
+
throw bad(`${k} must be true or false.`, k);
|
|
258
|
+
const storeId = b.store_id === undefined ? s.config.store_id : b.store_id;
|
|
259
|
+
if (storeId !== null && (typeof storeId !== 'string' || !storeExists(e, storeId)))
|
|
260
|
+
throw bad('store_id must be an existing FGA store.', 'store_id');
|
|
261
|
+
// Owned tuples live in one store: it cannot change under them.
|
|
262
|
+
if (storeId !== s.config.store_id && s.managed.size)
|
|
263
|
+
throw new errors_1.EmulatorError('CONFLICT', 'The sync owns tuples in the current store. Purge them before changing the store.', 'store_id');
|
|
264
|
+
const enabled = b.enabled ?? s.config.enabled;
|
|
265
|
+
if (enabled && !storeId)
|
|
266
|
+
throw bad('Enabling sync needs a store_id.', 'store_id');
|
|
267
|
+
const turningOn = enabled && !s.config.enabled;
|
|
268
|
+
Object.assign(s.config, { enabled, store_id: storeId, memberships: b.memberships ?? s.config.memberships, org_roles: b.org_roles ?? s.config.org_roles, groups: b.groups ?? s.config.groups, updated_at: e.clock.now() });
|
|
269
|
+
if (turningOn)
|
|
270
|
+
runSync(e, 'initial', false);
|
|
271
|
+
return { body: statusView(e) };
|
|
272
|
+
},
|
|
273
|
+
},
|
|
274
|
+
{
|
|
275
|
+
method: 'POST',
|
|
276
|
+
pattern: '/v1/fga/sync/backfill',
|
|
277
|
+
scope: 'fga:write',
|
|
278
|
+
handler: (c) => {
|
|
279
|
+
const e = c.engine;
|
|
280
|
+
if (c.body.repair !== undefined && typeof c.body.repair !== 'boolean')
|
|
281
|
+
throw bad('repair must be a boolean.', 'repair');
|
|
282
|
+
if (!st(e).config.enabled || !st(e).config.store_id)
|
|
283
|
+
throw bad('Enable sync with a store before running a backfill.', 'enabled');
|
|
284
|
+
return { status: 202, body: runView(runSync(e, 'backfill', c.body.repair === true)) };
|
|
285
|
+
},
|
|
286
|
+
},
|
|
287
|
+
{ method: 'GET', pattern: '/v1/fga/sync/runs', scope: 'fga:read', handler: (c) => (0, util_1.listReply)(c, st(c.engine).runs.all(), runView) },
|
|
288
|
+
{
|
|
289
|
+
method: 'GET',
|
|
290
|
+
pattern: '/v1/fga/sync/runs/:id',
|
|
291
|
+
scope: 'fga:read',
|
|
292
|
+
handler: (c) => {
|
|
293
|
+
const r = st(c.engine).runs.get(c.params.id);
|
|
294
|
+
if (!r)
|
|
295
|
+
throw (0, errors_1.notFound)('Sync run');
|
|
296
|
+
return { body: runView(r) };
|
|
297
|
+
},
|
|
298
|
+
},
|
|
299
|
+
{
|
|
300
|
+
// Remove only the tuples the sync wrote, and forget them. Sync must be off.
|
|
301
|
+
method: 'POST',
|
|
302
|
+
pattern: '/v1/fga/sync/purge',
|
|
303
|
+
scope: 'fga:write',
|
|
304
|
+
handler: (c) => {
|
|
305
|
+
const e = c.engine;
|
|
306
|
+
const s = st(e);
|
|
307
|
+
if (c.body.confirm !== true)
|
|
308
|
+
throw bad('Send confirm: true to remove the tuples the sync wrote.', 'confirm');
|
|
309
|
+
if (!s.config.store_id)
|
|
310
|
+
throw (0, errors_1.notFound)('Sync store');
|
|
311
|
+
if (s.config.enabled)
|
|
312
|
+
throw new errors_1.EmulatorError('CONFLICT', 'Disable sync before purging.');
|
|
313
|
+
const n = s.managed.size;
|
|
314
|
+
for (const t of s.managed.values())
|
|
315
|
+
pushEvent(e, 'tuple_deleted', s.config.store_id, 'sync', { ...t });
|
|
316
|
+
s.managed.clear();
|
|
317
|
+
return { body: { object: 'fga.sync_purge', store_id: s.config.store_id, deleted: n, released: 0 } };
|
|
318
|
+
},
|
|
319
|
+
},
|
|
320
|
+
// ── the authorization event feed ──
|
|
321
|
+
{
|
|
322
|
+
method: 'GET',
|
|
323
|
+
pattern: '/v1/authz/events',
|
|
324
|
+
scope: 'fga:read',
|
|
325
|
+
handler: async (c) => {
|
|
326
|
+
const e = c.engine;
|
|
327
|
+
const s = st(e);
|
|
328
|
+
const rawAfter = c.query.get('after');
|
|
329
|
+
const after = rawAfter === 'latest' ? s.seq : rawAfter === null ? 0 : Number(rawAfter);
|
|
330
|
+
if (!Number.isInteger(after) || after < 0)
|
|
331
|
+
throw bad('after must be a sequence number or "latest".', 'after');
|
|
332
|
+
const limit = (0, support_1.intIn)(c.query.get('limit') ?? undefined, 'limit', 1, 500, 100);
|
|
333
|
+
const waitMs = (0, support_1.intIn)(c.query.get('wait_ms') ?? undefined, 'wait_ms', 0, MAX_WAIT_MS, 0);
|
|
334
|
+
const kinds = c.query.get('kinds')?.split(',').filter(Boolean);
|
|
335
|
+
const store = c.query.get('store_id');
|
|
336
|
+
const pick = () => s.events.filter((x) => x.seq > after && (!kinds || kinds.includes(x.kind)) && (!store || x.store_id === store));
|
|
337
|
+
const deadline = Date.now() + waitMs;
|
|
338
|
+
while (!pick().length && Date.now() < deadline)
|
|
339
|
+
await new Promise((r) => setTimeout(r, 25));
|
|
340
|
+
const all = pick();
|
|
341
|
+
const page = all.slice(0, limit);
|
|
342
|
+
return { body: { object: 'list', data: page, has_more: all.length > limit, next_after: page.length ? page[page.length - 1].seq : after } };
|
|
343
|
+
},
|
|
344
|
+
},
|
|
345
|
+
];
|
|
346
|
+
}
|
|
347
|
+
//# sourceMappingURL=authz.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"authz.js","sourceRoot":"","sources":["../../src/handlers/authz.ts"],"names":[],"mappings":";;AAmJA,sCAiLC;AAlUD,sCAAoD;AAEpD,oCAAiC;AACjC,uCAA+C;AAC/C,iCAAmC;AAEnC;;;;;;;GAOG;AACH,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,iBAAiB,EAAE,KAAK,CAAU,CAAC;AAC5G,MAAM,WAAW,GAAG,MAAM,CAAC;AAC3B,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAClC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEhC,MAAM,GAAG,GAAG,CAAC,OAAe,EAAE,KAAa,EAAE,EAAE,CAAC,IAAI,sBAAa,CAAC,mBAAmB,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AAgBvG,MAAM,EAAE,GAAG,IAAA,qBAAW,EAAC,CAAC,CAAS,EAAc,EAAE,CAAC,CAAC;IACjD,SAAS,EAAE,IAAI,aAAK,CAAC,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC;IAC3D,MAAM,EAAE,IAAI,aAAK,CAAC,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC;IAC3D,IAAI,EAAE,IAAI,aAAK,CAAC,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC;IACpD,MAAM,EAAE,EAAE;IACV,GAAG,EAAE,CAAC;IACN,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE;IAC9G,OAAO,EAAE,IAAI,GAAG,EAAE;CACnB,CAAC,CAAC,CAAC;AAEJ,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,IAAY,EAAW,EAAE,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAE1J,qIAAqI;AACrI,SAAS,IAAI,CAAC,CAAS,EAAE,MAAc,EAAE,UAAkB,EAAE,cAAuB,EAAE,KAAwD;IAC5I,MAAM,aAAa,GAAU,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,MAAM,IAAI,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,eAAe,KAAK,cAAc,CAAC,CAAC,EAAE,CAAC;QAClI,MAAM,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,KAAK,GAAG,CAAE,IAAI,EAAE,WAAoC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QACnI,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;QAC9D,aAAa,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;IAC1J,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,CAAC;AAC1E,CAAC;AAED,SAAS,OAAO,CAAC,CAAS,EAAE,MAAc,EAAE,UAAkB,EAAE,cAAkC;IAChG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,MAAM,IAAA,iBAAQ,EAAC,MAAM,CAAC,CAAC;IACpD,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,CAAC,MAAc,EAAO,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5G,MAAM,MAAM,GAAQ,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,qCAAqC,CAAC,EAAE,CAAC;IACvL,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAAE,MAAM,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC3G,MAAM,QAAQ,GAAG,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;IAC9C,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,eAAe,EAAE,cAAc,IAAI,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,0CAA0C,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC;AAC7U,CAAC;AAED,SAAS,SAAS,CAAC,CAAS,EAAE,IAAY,EAAE,OAAsB,EAAE,MAAc,EAAE,IAAS;IAC3F,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IAChB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AAC1K,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,IAAS,EAAgE,EAAE;IAC7F,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC;IAC1C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,GAAG,CAAC,kDAAkD,EAAE,sBAAsB,CAAC,CAAC;IACxJ,MAAM,GAAG,GAAG,IAAI,GAAG,EAA+C,CAAC;IACnE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAM,EAAE,CAAS,EAAE,EAAE;QAClC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC;YAAE,MAAM,GAAG,CAAC,oCAAoC,EAAE,wBAAwB,CAAC,QAAQ,CAAC,CAAC;QACxK,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,GAAG;YAAE,MAAM,GAAG,CAAC,kBAAkB,EAAE,wBAAwB,CAAC,OAAO,CAAC,CAAC;QACzG,MAAM,IAAI,GAAG,CAAC,CAAU,EAAE,CAAS,EAAY,EAAE;YAC/C,IAAI,CAAC,KAAK,SAAS;gBAAE,OAAO,EAAE,CAAC;YAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;gBAAE,MAAM,GAAG,CAAC,GAAG,CAAC,iCAAiC,EAAE,wBAAwB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACnJ,OAAO,CAAa,CAAC;QACvB,CAAC,CAAC;QACF,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACvD,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,kBAAkB,EAAE,oBAAoB,CAAC,CAAC,EAAE,CAAC,CAAC;IACvK,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,CAAS,EAAW,EAAE;IAC3C,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACzB,MAAM,GAAG,GAAY,EAAE,CAAC;IACxB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO;YAAE,SAAS;QAC9B,IAAI,GAAG,CAAC,WAAW;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;QAC9H,IAAI,GAAG,CAAC,SAAS,IAAI,CAAC,CAAC,IAAI;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;IACnK,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AACF,MAAM,QAAQ,GAAG,CAAC,CAAQ,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;AAErE,oJAAoJ;AACpJ,SAAS,OAAO,CAAC,CAAS,EAAE,IAA4B,EAAE,MAAe;IACvE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IAChB,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,SAAS;QAC/B,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACpB,OAAO,EAAE,CAAC;QACV,SAAS,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACnE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACvK,CAAC;IACD,IAAI,MAAM,EAAE,CAAC;QACX,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;YACpC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,SAAS;YAC1B,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACpB,OAAO,EAAE,CAAC;YACV,SAAS,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YACnE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACvK,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1L,SAAS,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IAC1F,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7H,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,CAAM,EAAO,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;AACzS,MAAM,UAAU,GAAG,CAAC,CAAS,EAAO,EAAE;IACpC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IAChB,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;AAC3R,CAAC,CAAC;AACF,MAAM,WAAW,GAAG,CAAC,CAAS,EAAE,EAAU,EAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;AAE/F,SAAgB,aAAa;IAC3B,MAAM,UAAU,GAAG,CAAC,CAAM,EAAE,IAAa,EAAO,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,EAAE,eAAe,EAAE,CAAC,CAAC,eAAe,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACvX,OAAO;QACL;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,mBAAmB;YAC5B,KAAK,EAAE,sBAAsB;YAC7B,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;gBAC9B,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,EAAE;oBAAE,MAAM,GAAG,CAAC,yBAAyB,EAAE,YAAY,CAAC,CAAC;gBACtF,MAAM,UAAU,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;gBACtD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,UAAU;oBAAE,MAAM,GAAG,CAAC,qCAAqC,EAAE,YAAY,CAAC,CAAC;gBAClH,IAAI,CAAC,CAAC,IAAI,CAAC,eAAe,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,KAAK,QAAQ;oBAAE,MAAM,GAAG,CAAC,mCAAmC,EAAE,iBAAiB,CAAC,CAAC;gBAC1J,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YAC7E,CAAC;SACF;QACD;YACE,iFAAiF;YACjF,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,sBAAsB;YAC/B,KAAK,EAAE,sBAAsB;YAC7B,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;gBAC9B,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,EAAE;oBAAE,MAAM,GAAG,CAAC,yBAAyB,EAAE,YAAY,CAAC,CAAC;gBACtF,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU;oBAAE,MAAM,GAAG,CAAC,yBAAyB,EAAE,YAAY,CAAC,CAAC;gBACpH,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;oBAAE,MAAM,IAAA,iBAAQ,EAAC,MAAM,CAAC,CAAC;gBAChD,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;gBACjE,MAAM,IAAI,GAAG,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;gBACtD,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,IAAI,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBAC/K,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;YACzJ,CAAC;SACF;QACD;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,mBAAmB;YAC5B,KAAK,EAAE,sBAAsB;YAC7B,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;gBAC9B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;oBAAE,MAAM,GAAG,CAAC,wBAAwB,EAAE,WAAW,CAAC,CAAC;gBAC/G,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACjC,MAAM,YAAY,GAAa,EAAE,CAAC;gBAClC,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,eAAe,CAAC;oBAAE,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;wBAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClG,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;oBAAE,MAAM,GAAG,CAAC,qCAAqC,EAAE,wBAAwB,CAAC,CAAC;gBACrL,IAAI,CAAC,KAAK,IAAI,CAAC,YAAY,CAAC,MAAM;oBAAE,MAAM,GAAG,CAAC,iEAAiE,EAAE,WAAW,CAAC,CAAC;gBAC9H,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC5F,MAAM,IAAI,GAAG,IAAA,eAAK,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;gBAClD,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;gBACxG,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;oBAAE,MAAM,GAAG,CAAC,yCAAyC,EAAE,OAAO,CAAC,CAAC;gBAC9G,IAAI,KAAK,IAAI,KAAK;oBAAE,MAAM,GAAG,CAAC,6BAA6B,EAAE,OAAO,CAAC,CAAC;gBACtE,IAAI,KAAK,GAAG,KAAK,GAAG,EAAE,GAAG,UAAU;oBAAE,MAAM,GAAG,CAAC,oCAAoC,EAAE,OAAO,CAAC,CAAC;gBAC9F,MAAM,KAAK,GAAG,IAAA,eAAK,EAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,gBAAgB,EAAE,oBAAoB,CAAC,CAAC;gBACtF,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,IAAI,CAAC,CAAC,EAAE,IAAI,KAAK,CAAC,CAAC;gBAChF,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;gBACjC,MAAM,KAAK,GAAU,EAAE,CAAC;gBACxB,IAAI,OAAO,GAAG,CAAC,CAAC;gBAChB,IAAI,MAAM,GAAG,CAAC,CAAC;gBACf,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;oBACrB,IAAI,CAAC,KAAK;wBAAE,MAAM;oBAClB,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,eAAe,IAAI,SAAS,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC;oBAC7F,IAAI,IAAI,KAAK,CAAC,CAAC,OAAO;wBAAE,SAAS;oBACjC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;oBAC5B,KAAK,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,eAAe,EAAE,CAAC,CAAC,eAAe,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC5L,CAAC;gBACD,MAAM,MAAM,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;gBAC9O,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK;oBAAE,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC;gBACjJ,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBAC1E,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;YACtD,CAAC;SACF;QACD,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,KAAK,EAAE,sBAAsB,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAS,EAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE;QACpK;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,uBAAuB;YAChC,KAAK,EAAE,sBAAsB;YAC7B,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC/C,IAAI,CAAC,CAAC;oBAAE,MAAM,IAAA,iBAAQ,EAAC,aAAa,CAAC,CAAC;gBACtC,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;YACvC,CAAC;SACF;QACD;YACE,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,uBAAuB;YAChC,KAAK,EAAE,uBAAuB;YAC9B,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;oBAAE,MAAM,IAAA,iBAAQ,EAAC,aAAa,CAAC,CAAC;gBAClF,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;YACnF,CAAC;SACF;QACD,yBAAyB;QACzB,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE;QAC/G;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,cAAc;YACvB,KAAK,EAAE,WAAW;YAClB,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;gBAChB,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,CAAU;oBAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS;wBAAE,MAAM,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,CAAC,CAAC,CAAC;gBAC7K,MAAM,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAC1E,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;oBAAE,MAAM,GAAG,CAAC,yCAAyC,EAAE,UAAU,CAAC,CAAC;gBACpJ,+DAA+D;gBAC/D,IAAI,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI;oBAAE,MAAM,IAAI,sBAAa,CAAC,UAAU,EAAE,kFAAkF,EAAE,UAAU,CAAC,CAAC;gBACzL,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;gBAC9C,IAAI,OAAO,IAAI,CAAC,OAAO;oBAAE,MAAM,GAAG,CAAC,iCAAiC,EAAE,UAAU,CAAC,CAAC;gBAClF,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;gBAC/C,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBAC1N,IAAI,SAAS;oBAAE,OAAO,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;gBAC5C,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,CAAC;SACF;QACD;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,uBAAuB;YAChC,KAAK,EAAE,WAAW;YAClB,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS;oBAAE,MAAM,GAAG,CAAC,2BAA2B,EAAE,QAAQ,CAAC,CAAC;gBACxH,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ;oBAAE,MAAM,GAAG,CAAC,qDAAqD,EAAE,SAAS,CAAC,CAAC;gBACjI,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,EAAE,CAAC;YACxF,CAAC;SACF;QACD,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAS,EAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC,EAAE;QAClI;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,uBAAuB;YAChC,KAAK,EAAE,UAAU;YACjB,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC7C,IAAI,CAAC,CAAC;oBAAE,MAAM,IAAA,iBAAQ,EAAC,UAAU,CAAC,CAAC;gBACnC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9B,CAAC;SACF;QACD;YACE,4EAA4E;YAC5E,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,oBAAoB;YAC7B,KAAK,EAAE,WAAW;YAClB,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;gBAChB,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,IAAI;oBAAE,MAAM,GAAG,CAAC,yDAAyD,EAAE,SAAS,CAAC,CAAC;gBAC7G,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ;oBAAE,MAAM,IAAA,iBAAQ,EAAC,YAAY,CAAC,CAAC;gBACrD,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO;oBAAE,MAAM,IAAI,sBAAa,CAAC,UAAU,EAAE,8BAA8B,CAAC,CAAC;gBAC1F,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;gBACzB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE;oBAAE,SAAS,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBACvG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBAClB,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC;YACtG,CAAC;SACF;QACD,qCAAqC;QACrC;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,kBAAkB;YAC3B,KAAK,EAAE,UAAU;YACjB,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACnB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;gBAChB,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACtC,MAAM,KAAK,GAAG,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBACvF,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;oBAAE,MAAM,GAAG,CAAC,8CAA8C,EAAE,OAAO,CAAC,CAAC;gBAC9G,MAAM,KAAK,GAAG,IAAA,eAAK,EAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;gBAC7E,MAAM,MAAM,GAAG,IAAA,eAAK,EAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,SAAS,EAAE,SAAS,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;gBACxF,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAC/D,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBACtC,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC;gBACnI,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;gBACrC,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ;oBAAE,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;gBAC5F,MAAM,GAAG,GAAG,IAAI,EAAE,CAAC;gBACnB,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;gBACjC,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,GAAG,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;YAC9I,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}
|