@backstage-community/plugin-rbac-backend 5.2.10 → 5.3.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 ### Dependencies
 
+## 5.3.0
+
+### Minor Changes
+
+- 53daff0: Roles and permissions were not correctly applied for users and groups with names containing uppercase letters. To address this issue, we now convert user and group references in all user inputs to lowercase. This change migrates `v0` column in `casbin_rule` table in `backstage_plugin_permission` database. Conditions containing claims with uppercase letters are not resolved yet.
+
 ## 5.2.10
 
 ### Patch Changes

package/dist/admin-permissions/admin-creation.cjs.js

@@ -23,7 +23,7 @@ const useAdminsFromConfig = async (admins, enf, auditLogger$1, roleMetadataStora
   const addedGroupPolicies = /* @__PURE__ */ new Map();
   const newGroupPolicies = /* @__PURE__ */ new Map();
   for (const admin of admins) {
-    const entityRef = admin.getString("name");
+    const entityRef = admin.getString("name").toLocaleLowerCase("en-US");
     policiesValidation.validateEntityReference(entityRef);
     addedGroupPolicies.set(entityRef, ADMIN_ROLE_NAME);
     if (!await enf.hasGroupingPolicy(...[entityRef, ADMIN_ROLE_NAME])) {

package/dist/admin-permissions/admin-creation.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin-creation.cjs.js","sources":["../../src/admin-permissions/admin-creation.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport type { Config } from '@backstage/config';\n\nimport { AuditLogger } from '@janus-idp/backstage-plugin-audit-log-node';\nimport { Knex } from 'knex';\n\nimport {\n  HANDLE_RBAC_DATA_STAGE,\n  PermissionAuditInfo,\n  PermissionEvents,\n  RBAC_BACKEND,\n  RoleAuditInfo,\n  RoleEvents,\n} from '../audit-log/audit-logger';\nimport {\n  RoleMetadataDao,\n  RoleMetadataStorage,\n} from '../database/role-metadata';\nimport { removeTheDifference } from '../helper';\nimport { EnforcerDelegate } from '../service/enforcer-delegate';\nimport { validateEntityReference } from '../validation/policies-validation';\n\nexport const ADMIN_ROLE_NAME = 'role:default/rbac_admin';\nexport const ADMIN_ROLE_AUTHOR = 'application configuration';\nconst DEF_ADMIN_ROLE_DESCRIPTION =\n  'The default permission policy for the admin role allows for the creation, deletion, updating, and reading of roles and permission policies.';\n\nconst getAdminRoleMetadata = (): RoleMetadataDao => {\n  const currentDate: Date = new Date();\n  return {\n    source: 'configuration',\n    roleEntityRef: ADMIN_ROLE_NAME,\n    description: DEF_ADMIN_ROLE_DESCRIPTION,\n    author: ADMIN_ROLE_AUTHOR,\n    modifiedBy: ADMIN_ROLE_AUTHOR,\n    lastModified: currentDate.toUTCString(),\n    createdAt: currentDate.toUTCString(),\n  };\n};\n\nexport const useAdminsFromConfig = async (\n  admins: Config[],\n  enf: EnforcerDelegate,\n  auditLogger: AuditLogger,\n  roleMetadataStorage: RoleMetadataStorage,\n  knex: Knex,\n) => {\n  const addedGroupPolicies = new Map<string, string>();\n  const newGroupPolicies = new Map<string, string>();\n\n  for (const admin of admins) {\n    const entityRef = admin.getString('name');\n    validateEntityReference(entityRef);\n\n    addedGroupPolicies.set(entityRef, ADMIN_ROLE_NAME);\n\n    if (!(await enf.hasGroupingPolicy(...[entityRef, ADMIN_ROLE_NAME]))) {\n      newGroupPolicies.set(entityRef, ADMIN_ROLE_NAME);\n    }\n  }\n\n  const adminRoleMeta =\n    await roleMetadataStorage.findRoleMetadata(ADMIN_ROLE_NAME);\n\n  const trx = await knex.transaction();\n  let addedRoleMembers;\n  try {\n    if (!adminRoleMeta) {\n      // even if there are no user, we still create default role metadata for admins\n      await roleMetadataStorage.createRoleMetadata(getAdminRoleMetadata(), trx);\n    } else if (adminRoleMeta.source === 'legacy') {\n      await roleMetadataStorage.updateRoleMetadata(\n        getAdminRoleMetadata(),\n        ADMIN_ROLE_NAME,\n        trx,\n      );\n    }\n\n    addedRoleMembers = Array.from<string[]>(newGroupPolicies.entries());\n    await enf.addGroupingPolicies(\n      addedRoleMembers,\n      getAdminRoleMetadata(),\n      trx,\n    );\n\n    await trx.commit();\n  } catch (error) {\n    await trx.rollback(error);\n    throw error;\n  }\n\n  await auditLogger.auditLog<RoleAuditInfo>({\n    actorId: RBAC_BACKEND,\n    message: `Created or updated role`,\n    eventName: RoleEvents.CREATE_OR_UPDATE_ROLE,\n    metadata: {\n      ...getAdminRoleMetadata(),\n      members: addedRoleMembers.map(gp => gp[0]),\n    },\n    stage: HANDLE_RBAC_DATA_STAGE,\n    status: 'succeeded',\n  });\n\n  const configGroupPolicies = await enf.getFilteredGroupingPolicy(\n    1,\n    ADMIN_ROLE_NAME,\n  );\n\n  await removeTheDifference(\n    configGroupPolicies.map(gp => gp[0]),\n    Array.from<string>(addedGroupPolicies.keys()),\n    'configuration',\n    ADMIN_ROLE_NAME,\n    enf,\n    auditLogger,\n    ADMIN_ROLE_AUTHOR,\n  );\n};\n\nconst addAdminPermissions = async (\n  policies: string[][],\n  enf: EnforcerDelegate,\n  auditLogger: AuditLogger,\n) => {\n  const policiesToAdd: string[][] = [];\n  for (const policy of policies) {\n    if (!(await enf.hasPolicy(...policy))) {\n      policiesToAdd.push(policy);\n    }\n  }\n  await enf.addPolicies(policiesToAdd);\n\n  await auditLogger.auditLog<PermissionAuditInfo>({\n    actorId: RBAC_BACKEND,\n    message: `Created RBAC admin permissions`,\n    eventName: PermissionEvents.CREATE_POLICY,\n    metadata: { policies: policies, source: 'configuration' },\n    stage: HANDLE_RBAC_DATA_STAGE,\n    status: 'succeeded',\n  });\n};\n\nexport const setAdminPermissions = async (\n  enf: EnforcerDelegate,\n  auditLogger: AuditLogger,\n) => {\n  const adminPermissions = [\n    [ADMIN_ROLE_NAME, 'policy-entity', 'read', 'allow'],\n    [ADMIN_ROLE_NAME, 'policy-entity', 'create', 'allow'],\n    [ADMIN_ROLE_NAME, 'policy-entity', 'delete', 'allow'],\n    [ADMIN_ROLE_NAME, 'policy-entity', 'update', 'allow'],\n    // Needed for the RBAC frontend plugin.\n    [ADMIN_ROLE_NAME, 'catalog-entity', 'read', 'allow'],\n  ];\n  await addAdminPermissions(adminPermissions, enf, auditLogger);\n};\n"],"names":["auditLogger","validateEntityReference","RBAC_BACKEND","RoleEvents","HANDLE_RBAC_DATA_STAGE","removeTheDifference","PermissionEvents"],"mappings":";;;;;;AAoCO,MAAM,eAAkB,GAAA;AACxB,MAAM,iBAAoB,GAAA;AACjC,MAAM,0BACJ,GAAA,6IAAA;AAEF,MAAM,uBAAuB,MAAuB;AAClD,EAAM,MAAA,WAAA,uBAAwB,IAAK,EAAA;AACnC,EAAO,OAAA;AAAA,IACL,MAAQ,EAAA,eAAA;AAAA,IACR,aAAe,EAAA,eAAA;AAAA,IACf,WAAa,EAAA,0BAAA;AAAA,IACb,MAAQ,EAAA,iBAAA;AAAA,IACR,UAAY,EAAA,iBAAA;AAAA,IACZ,YAAA,EAAc,YAAY,WAAY,EAAA;AAAA,IACtC,SAAA,EAAW,YAAY,WAAY;AAAA,GACrC;AACF,CAAA;AAEO,MAAM,sBAAsB,OACjC,MAAA,EACA,GACA,EAAAA,aAAA,EACA,qBACA,IACG,KAAA;AACH,EAAM,MAAA,kBAAA,uBAAyB,GAAoB,EAAA;AACnD,EAAM,MAAA,gBAAA,uBAAuB,GAAoB,EAAA;AAEjD,EAAA,KAAA,MAAW,SAAS,MAAQ,EAAA;AAC1B,IAAM,MAAA,SAAA,GAAY,KAAM,CAAA,SAAA,CAAU,MAAM,CAAA;AACxC,IAAAC,0CAAA,CAAwB,SAAS,CAAA;AAEjC,IAAmB,kBAAA,CAAA,GAAA,CAAI,WAAW,eAAe,CAAA;AAEjD,IAAI,IAAA,CAAE,MAAM,GAAI,CAAA,iBAAA,CAAkB,GAAG,CAAC,SAAA,EAAW,eAAe,CAAC,CAAI,EAAA;AACnE,MAAiB,gBAAA,CAAA,GAAA,CAAI,WAAW,eAAe,CAAA;AAAA;AACjD;AAGF,EAAA,MAAM,aACJ,GAAA,MAAM,mBAAoB,CAAA,gBAAA,CAAiB,eAAe,CAAA;AAE5D,EAAM,MAAA,GAAA,GAAM,MAAM,IAAA,CAAK,WAAY,EAAA;AACnC,EAAI,IAAA,gBAAA;AACJ,EAAI,IAAA;AACF,IAAA,IAAI,CAAC,aAAe,EAAA;AAElB,MAAA,MAAM,mBAAoB,CAAA,kBAAA,CAAmB,oBAAqB,EAAA,EAAG,GAAG,CAAA;AAAA,KAC1E,MAAA,IAAW,aAAc,CAAA,MAAA,KAAW,QAAU,EAAA;AAC5C,MAAA,MAAM,mBAAoB,CAAA,kBAAA;AAAA,QACxB,oBAAqB,EAAA;AAAA,QACrB,eAAA;AAAA,QACA;AAAA,OACF;AAAA;AAGF,IAAA,gBAAA,GAAmB,KAAM,CAAA,IAAA,CAAe,gBAAiB,CAAA,OAAA,EAAS,CAAA;AAClE,IAAA,MAAM,GAAI,CAAA,mBAAA;AAAA,MACR,gBAAA;AAAA,MACA,oBAAqB,EAAA;AAAA,MACrB;AAAA,KACF;AAEA,IAAA,MAAM,IAAI,MAAO,EAAA;AAAA,WACV,KAAO,EAAA;AACd,IAAM,MAAA,GAAA,CAAI,SAAS,KAAK,CAAA;AACxB,IAAM,MAAA,KAAA;AAAA;AAGR,EAAA,MAAMD,cAAY,QAAwB,CAAA;AAAA,IACxC,OAAS,EAAAE,wBAAA;AAAA,IACT,OAAS,EAAA,CAAA,uBAAA,CAAA;AAAA,IACT,WAAWC,sBAAW,CAAA,qBAAA;AAAA,IACtB,QAAU,EAAA;AAAA,MACR,GAAG,oBAAqB,EAAA;AAAA,MACxB,SAAS,gBAAiB,CAAA,GAAA,CAAI,CAAM,EAAA,KAAA,EAAA,CAAG,CAAC,CAAC;AAAA,KAC3C;AAAA,IACA,KAAO,EAAAC,kCAAA;AAAA,IACP,MAAQ,EAAA;AAAA,GACT,CAAA;AAED,EAAM,MAAA,mBAAA,GAAsB,MAAM,GAAI,CAAA,yBAAA;AAAA,IACpC,CAAA;AAAA,IACA;AAAA,GACF;AAEA,EAAM,MAAAC,0BAAA;AAAA,IACJ,mBAAoB,CAAA,GAAA,CAAI,CAAM,EAAA,KAAA,EAAA,CAAG,CAAC,CAAC,CAAA;AAAA,IACnC,KAAM,CAAA,IAAA,CAAa,kBAAmB,CAAA,IAAA,EAAM,CAAA;AAAA,IAC5C,eAAA;AAAA,IACA,eAAA;AAAA,IACA,GAAA;AAAA,IACAL,aAAA;AAAA,IACA;AAAA,GACF;AACF;AAEA,MAAM,mBAAsB,GAAA,OAC1B,QACA,EAAA,GAAA,EACAA,aACG,KAAA;AACH,EAAA,MAAM,gBAA4B,EAAC;AACnC,EAAA,KAAA,MAAW,UAAU,QAAU,EAAA;AAC7B,IAAA,IAAI,CAAE,MAAM,GAAA,CAAI,SAAU,CAAA,GAAG,MAAM,CAAI,EAAA;AACrC,MAAA,aAAA,CAAc,KAAK,MAAM,CAAA;AAAA;AAC3B;AAEF,EAAM,MAAA,GAAA,CAAI,YAAY,aAAa,CAAA;AAEnC,EAAA,MAAMA,cAAY,QAA8B,CAAA;AAAA,IAC9C,OAAS,EAAAE,wBAAA;AAAA,IACT,OAAS,EAAA,CAAA,8BAAA,CAAA;AAAA,IACT,WAAWI,4BAAiB,CAAA,aAAA;AAAA,IAC5B,QAAU,EAAA,EAAE,QAAoB,EAAA,MAAA,EAAQ,eAAgB,EAAA;AAAA,IACxD,KAAO,EAAAF,kCAAA;AAAA,IACP,MAAQ,EAAA;AAAA,GACT,CAAA;AACH,CAAA;AAEa,MAAA,mBAAA,GAAsB,OACjC,GAAA,EACA,WACG,KAAA;AACH,EAAA,MAAM,gBAAmB,GAAA;AAAA,IACvB,CAAC,eAAA,EAAiB,eAAiB,EAAA,MAAA,EAAQ,OAAO,CAAA;AAAA,IAClD,CAAC,eAAA,EAAiB,eAAiB,EAAA,QAAA,EAAU,OAAO,CAAA;AAAA,IACpD,CAAC,eAAA,EAAiB,eAAiB,EAAA,QAAA,EAAU,OAAO,CAAA;AAAA,IACpD,CAAC,eAAA,EAAiB,eAAiB,EAAA,QAAA,EAAU,OAAO,CAAA;AAAA;AAAA,IAEpD,CAAC,eAAA,EAAiB,gBAAkB,EAAA,MAAA,EAAQ,OAAO;AAAA,GACrD;AACA,EAAM,MAAA,mBAAA,CAAoB,gBAAkB,EAAA,GAAA,EAAK,WAAW,CAAA;AAC9D;;;;;;;"}
+{"version":3,"file":"admin-creation.cjs.js","sources":["../../src/admin-permissions/admin-creation.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport type { Config } from '@backstage/config';\n\nimport { AuditLogger } from '@janus-idp/backstage-plugin-audit-log-node';\nimport { Knex } from 'knex';\n\nimport {\n  HANDLE_RBAC_DATA_STAGE,\n  PermissionAuditInfo,\n  PermissionEvents,\n  RBAC_BACKEND,\n  RoleAuditInfo,\n  RoleEvents,\n} from '../audit-log/audit-logger';\nimport {\n  RoleMetadataDao,\n  RoleMetadataStorage,\n} from '../database/role-metadata';\nimport { removeTheDifference } from '../helper';\nimport { EnforcerDelegate } from '../service/enforcer-delegate';\nimport { validateEntityReference } from '../validation/policies-validation';\n\nexport const ADMIN_ROLE_NAME = 'role:default/rbac_admin';\nexport const ADMIN_ROLE_AUTHOR = 'application configuration';\nconst DEF_ADMIN_ROLE_DESCRIPTION =\n  'The default permission policy for the admin role allows for the creation, deletion, updating, and reading of roles and permission policies.';\n\nconst getAdminRoleMetadata = (): RoleMetadataDao => {\n  const currentDate: Date = new Date();\n  return {\n    source: 'configuration',\n    roleEntityRef: ADMIN_ROLE_NAME,\n    description: DEF_ADMIN_ROLE_DESCRIPTION,\n    author: ADMIN_ROLE_AUTHOR,\n    modifiedBy: ADMIN_ROLE_AUTHOR,\n    lastModified: currentDate.toUTCString(),\n    createdAt: currentDate.toUTCString(),\n  };\n};\n\nexport const useAdminsFromConfig = async (\n  admins: Config[],\n  enf: EnforcerDelegate,\n  auditLogger: AuditLogger,\n  roleMetadataStorage: RoleMetadataStorage,\n  knex: Knex,\n) => {\n  const addedGroupPolicies = new Map<string, string>();\n  const newGroupPolicies = new Map<string, string>();\n\n  for (const admin of admins) {\n    const entityRef = admin.getString('name').toLocaleLowerCase('en-US');\n    validateEntityReference(entityRef);\n\n    addedGroupPolicies.set(entityRef, ADMIN_ROLE_NAME);\n\n    if (!(await enf.hasGroupingPolicy(...[entityRef, ADMIN_ROLE_NAME]))) {\n      newGroupPolicies.set(entityRef, ADMIN_ROLE_NAME);\n    }\n  }\n\n  const adminRoleMeta =\n    await roleMetadataStorage.findRoleMetadata(ADMIN_ROLE_NAME);\n\n  const trx = await knex.transaction();\n  let addedRoleMembers;\n  try {\n    if (!adminRoleMeta) {\n      // even if there are no user, we still create default role metadata for admins\n      await roleMetadataStorage.createRoleMetadata(getAdminRoleMetadata(), trx);\n    } else if (adminRoleMeta.source === 'legacy') {\n      await roleMetadataStorage.updateRoleMetadata(\n        getAdminRoleMetadata(),\n        ADMIN_ROLE_NAME,\n        trx,\n      );\n    }\n\n    addedRoleMembers = Array.from<string[]>(newGroupPolicies.entries());\n    await enf.addGroupingPolicies(\n      addedRoleMembers,\n      getAdminRoleMetadata(),\n      trx,\n    );\n\n    await trx.commit();\n  } catch (error) {\n    await trx.rollback(error);\n    throw error;\n  }\n\n  await auditLogger.auditLog<RoleAuditInfo>({\n    actorId: RBAC_BACKEND,\n    message: `Created or updated role`,\n    eventName: RoleEvents.CREATE_OR_UPDATE_ROLE,\n    metadata: {\n      ...getAdminRoleMetadata(),\n      members: addedRoleMembers.map(gp => gp[0]),\n    },\n    stage: HANDLE_RBAC_DATA_STAGE,\n    status: 'succeeded',\n  });\n\n  const configGroupPolicies = await enf.getFilteredGroupingPolicy(\n    1,\n    ADMIN_ROLE_NAME,\n  );\n\n  await removeTheDifference(\n    configGroupPolicies.map(gp => gp[0]),\n    Array.from<string>(addedGroupPolicies.keys()),\n    'configuration',\n    ADMIN_ROLE_NAME,\n    enf,\n    auditLogger,\n    ADMIN_ROLE_AUTHOR,\n  );\n};\n\nconst addAdminPermissions = async (\n  policies: string[][],\n  enf: EnforcerDelegate,\n  auditLogger: AuditLogger,\n) => {\n  const policiesToAdd: string[][] = [];\n  for (const policy of policies) {\n    if (!(await enf.hasPolicy(...policy))) {\n      policiesToAdd.push(policy);\n    }\n  }\n  await enf.addPolicies(policiesToAdd);\n\n  await auditLogger.auditLog<PermissionAuditInfo>({\n    actorId: RBAC_BACKEND,\n    message: `Created RBAC admin permissions`,\n    eventName: PermissionEvents.CREATE_POLICY,\n    metadata: { policies: policies, source: 'configuration' },\n    stage: HANDLE_RBAC_DATA_STAGE,\n    status: 'succeeded',\n  });\n};\n\nexport const setAdminPermissions = async (\n  enf: EnforcerDelegate,\n  auditLogger: AuditLogger,\n) => {\n  const adminPermissions = [\n    [ADMIN_ROLE_NAME, 'policy-entity', 'read', 'allow'],\n    [ADMIN_ROLE_NAME, 'policy-entity', 'create', 'allow'],\n    [ADMIN_ROLE_NAME, 'policy-entity', 'delete', 'allow'],\n    [ADMIN_ROLE_NAME, 'policy-entity', 'update', 'allow'],\n    // Needed for the RBAC frontend plugin.\n    [ADMIN_ROLE_NAME, 'catalog-entity', 'read', 'allow'],\n  ];\n  await addAdminPermissions(adminPermissions, enf, auditLogger);\n};\n"],"names":["auditLogger","validateEntityReference","RBAC_BACKEND","RoleEvents","HANDLE_RBAC_DATA_STAGE","removeTheDifference","PermissionEvents"],"mappings":";;;;;;AAoCO,MAAM,eAAkB,GAAA;AACxB,MAAM,iBAAoB,GAAA;AACjC,MAAM,0BACJ,GAAA,6IAAA;AAEF,MAAM,uBAAuB,MAAuB;AAClD,EAAM,MAAA,WAAA,uBAAwB,IAAK,EAAA;AACnC,EAAO,OAAA;AAAA,IACL,MAAQ,EAAA,eAAA;AAAA,IACR,aAAe,EAAA,eAAA;AAAA,IACf,WAAa,EAAA,0BAAA;AAAA,IACb,MAAQ,EAAA,iBAAA;AAAA,IACR,UAAY,EAAA,iBAAA;AAAA,IACZ,YAAA,EAAc,YAAY,WAAY,EAAA;AAAA,IACtC,SAAA,EAAW,YAAY,WAAY;AAAA,GACrC;AACF,CAAA;AAEO,MAAM,sBAAsB,OACjC,MAAA,EACA,GACA,EAAAA,aAAA,EACA,qBACA,IACG,KAAA;AACH,EAAM,MAAA,kBAAA,uBAAyB,GAAoB,EAAA;AACnD,EAAM,MAAA,gBAAA,uBAAuB,GAAoB,EAAA;AAEjD,EAAA,KAAA,MAAW,SAAS,MAAQ,EAAA;AAC1B,IAAA,MAAM,YAAY,KAAM,CAAA,SAAA,CAAU,MAAM,CAAA,CAAE,kBAAkB,OAAO,CAAA;AACnE,IAAAC,0CAAA,CAAwB,SAAS,CAAA;AAEjC,IAAmB,kBAAA,CAAA,GAAA,CAAI,WAAW,eAAe,CAAA;AAEjD,IAAI,IAAA,CAAE,MAAM,GAAI,CAAA,iBAAA,CAAkB,GAAG,CAAC,SAAA,EAAW,eAAe,CAAC,CAAI,EAAA;AACnE,MAAiB,gBAAA,CAAA,GAAA,CAAI,WAAW,eAAe,CAAA;AAAA;AACjD;AAGF,EAAA,MAAM,aACJ,GAAA,MAAM,mBAAoB,CAAA,gBAAA,CAAiB,eAAe,CAAA;AAE5D,EAAM,MAAA,GAAA,GAAM,MAAM,IAAA,CAAK,WAAY,EAAA;AACnC,EAAI,IAAA,gBAAA;AACJ,EAAI,IAAA;AACF,IAAA,IAAI,CAAC,aAAe,EAAA;AAElB,MAAA,MAAM,mBAAoB,CAAA,kBAAA,CAAmB,oBAAqB,EAAA,EAAG,GAAG,CAAA;AAAA,KAC1E,MAAA,IAAW,aAAc,CAAA,MAAA,KAAW,QAAU,EAAA;AAC5C,MAAA,MAAM,mBAAoB,CAAA,kBAAA;AAAA,QACxB,oBAAqB,EAAA;AAAA,QACrB,eAAA;AAAA,QACA;AAAA,OACF;AAAA;AAGF,IAAA,gBAAA,GAAmB,KAAM,CAAA,IAAA,CAAe,gBAAiB,CAAA,OAAA,EAAS,CAAA;AAClE,IAAA,MAAM,GAAI,CAAA,mBAAA;AAAA,MACR,gBAAA;AAAA,MACA,oBAAqB,EAAA;AAAA,MACrB;AAAA,KACF;AAEA,IAAA,MAAM,IAAI,MAAO,EAAA;AAAA,WACV,KAAO,EAAA;AACd,IAAM,MAAA,GAAA,CAAI,SAAS,KAAK,CAAA;AACxB,IAAM,MAAA,KAAA;AAAA;AAGR,EAAA,MAAMD,cAAY,QAAwB,CAAA;AAAA,IACxC,OAAS,EAAAE,wBAAA;AAAA,IACT,OAAS,EAAA,CAAA,uBAAA,CAAA;AAAA,IACT,WAAWC,sBAAW,CAAA,qBAAA;AAAA,IACtB,QAAU,EAAA;AAAA,MACR,GAAG,oBAAqB,EAAA;AAAA,MACxB,SAAS,gBAAiB,CAAA,GAAA,CAAI,CAAM,EAAA,KAAA,EAAA,CAAG,CAAC,CAAC;AAAA,KAC3C;AAAA,IACA,KAAO,EAAAC,kCAAA;AAAA,IACP,MAAQ,EAAA;AAAA,GACT,CAAA;AAED,EAAM,MAAA,mBAAA,GAAsB,MAAM,GAAI,CAAA,yBAAA;AAAA,IACpC,CAAA;AAAA,IACA;AAAA,GACF;AAEA,EAAM,MAAAC,0BAAA;AAAA,IACJ,mBAAoB,CAAA,GAAA,CAAI,CAAM,EAAA,KAAA,EAAA,CAAG,CAAC,CAAC,CAAA;AAAA,IACnC,KAAM,CAAA,IAAA,CAAa,kBAAmB,CAAA,IAAA,EAAM,CAAA;AAAA,IAC5C,eAAA;AAAA,IACA,eAAA;AAAA,IACA,GAAA;AAAA,IACAL,aAAA;AAAA,IACA;AAAA,GACF;AACF;AAEA,MAAM,mBAAsB,GAAA,OAC1B,QACA,EAAA,GAAA,EACAA,aACG,KAAA;AACH,EAAA,MAAM,gBAA4B,EAAC;AACnC,EAAA,KAAA,MAAW,UAAU,QAAU,EAAA;AAC7B,IAAA,IAAI,CAAE,MAAM,GAAA,CAAI,SAAU,CAAA,GAAG,MAAM,CAAI,EAAA;AACrC,MAAA,aAAA,CAAc,KAAK,MAAM,CAAA;AAAA;AAC3B;AAEF,EAAM,MAAA,GAAA,CAAI,YAAY,aAAa,CAAA;AAEnC,EAAA,MAAMA,cAAY,QAA8B,CAAA;AAAA,IAC9C,OAAS,EAAAE,wBAAA;AAAA,IACT,OAAS,EAAA,CAAA,8BAAA,CAAA;AAAA,IACT,WAAWI,4BAAiB,CAAA,aAAA;AAAA,IAC5B,QAAU,EAAA,EAAE,QAAoB,EAAA,MAAA,EAAQ,eAAgB,EAAA;AAAA,IACxD,KAAO,EAAAF,kCAAA;AAAA,IACP,MAAQ,EAAA;AAAA,GACT,CAAA;AACH,CAAA;AAEa,MAAA,mBAAA,GAAsB,OACjC,GAAA,EACA,WACG,KAAA;AACH,EAAA,MAAM,gBAAmB,GAAA;AAAA,IACvB,CAAC,eAAA,EAAiB,eAAiB,EAAA,MAAA,EAAQ,OAAO,CAAA;AAAA,IAClD,CAAC,eAAA,EAAiB,eAAiB,EAAA,QAAA,EAAU,OAAO,CAAA;AAAA,IACpD,CAAC,eAAA,EAAiB,eAAiB,EAAA,QAAA,EAAU,OAAO,CAAA;AAAA,IACpD,CAAC,eAAA,EAAiB,eAAiB,EAAA,QAAA,EAAU,OAAO,CAAA;AAAA;AAAA,IAEpD,CAAC,eAAA,EAAiB,gBAAkB,EAAA,MAAA,EAAQ,OAAO;AAAA,GACrD;AACA,EAAM,MAAA,mBAAA,CAAoB,gBAAkB,EAAA,GAAA,EAAK,WAAW,CAAA;AAC9D;;;;;;;"}

package/dist/file-permissions/csv-file-watcher.cjs.js

@@ -8,6 +8,7 @@ var helper = require('../helper.cjs.js');
 var permissionModel = require('../service/permission-model.cjs.js');
 var policiesValidation = require('../validation/policies-validation.cjs.js');
 var fileWatcher = require('./file-watcher.cjs.js');
+var lowercaseFileAdapter = require('./lowercase-file-adapter.cjs.js');
 
 const CSV_PERMISSION_POLICY_FILE_AUTHOR = "csv permission policy file";
 class CSVFileWatcher extends fileWatcher.AbstractFileWatcher {
@@ -32,12 +33,15 @@ class CSVFileWatcher extends fileWatcher.AbstractFileWatcher {
    */
   parse() {
     const content = this.getCurrentContents();
-    const parser = sync.parse(content, {
+    const data = sync.parse(content, {
       skip_empty_lines: true,
       relax_column_count: true,
       trim: true
     });
-    return parser;
+    for (const policy of data) {
+      helper.transformPolicyGroupToLowercase(policy);
+    }
+    return data;
   }
   /**
    * initialize will initialize the CSV file by loading all of the permission policies and roles into
@@ -56,7 +60,7 @@ class CSVFileWatcher extends fileWatcher.AbstractFileWatcher {
     content = this.parse();
     const tempEnforcer = await casbin.newEnforcer(
       casbin.newModelFromString(permissionModel.MODEL),
-      new casbin.FileAdapter(this.filePath)
+      new lowercaseFileAdapter.LowercaseFileAdapter(this.filePath)
     );
     await this.cleanUpRolesAndPolicies();
     const policiesToAdd = await tempEnforcer.getPolicy();
@@ -124,7 +128,7 @@ class CSVFileWatcher extends fileWatcher.AbstractFileWatcher {
     const newContent = this.parse();
     const tempEnforcer = await casbin.newEnforcer(
       casbin.newModelFromString(permissionModel.MODEL),
-      new casbin.FileAdapter(this.filePath)
+      new lowercaseFileAdapter.LowercaseFileAdapter(this.filePath)
     );
     const currentFlatContent = this.currentContent.flatMap((data) => {
       return helper.policyToString(data);

package/dist/file-permissions/csv-file-watcher.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"csv-file-watcher.cjs.js","sources":["../../src/file-permissions/csv-file-watcher.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport type { LoggerService } from '@backstage/backend-plugin-api';\n\nimport type { AuditLogger } from '@janus-idp/backstage-plugin-audit-log-node';\nimport { Enforcer, FileAdapter, newEnforcer, newModelFromString } from 'casbin';\nimport { parse } from 'csv-parse/sync';\nimport { difference } from 'lodash';\n\nimport {\n  HANDLE_RBAC_DATA_STAGE,\n  PermissionAuditInfo,\n  PermissionEvents,\n  RBAC_BACKEND,\n  RoleAuditInfo,\n  RoleEvents,\n} from '../audit-log/audit-logger';\nimport {\n  RoleMetadataDao,\n  RoleMetadataStorage,\n} from '../database/role-metadata';\nimport {\n  mergeRoleMetadata,\n  metadataStringToPolicy,\n  policyToString,\n  transformArrayToPolicy,\n} from '../helper';\nimport { EnforcerDelegate } from '../service/enforcer-delegate';\nimport { MODEL } from '../service/permission-model';\nimport {\n  checkForDuplicateGroupPolicies,\n  checkForDuplicatePolicies,\n  validateGroupingPolicy,\n  validatePolicy,\n  validateSource,\n} from '../validation/policies-validation';\nimport { AbstractFileWatcher } from './file-watcher';\n\nexport const CSV_PERMISSION_POLICY_FILE_AUTHOR = 'csv permission policy file';\n\ntype CSVFilePolicies = {\n  addedPolicies: string[][];\n  addedGroupPolicies: string[][];\n  removedPolicies: string[][];\n  removedGroupPolicies: string[][];\n};\n\nexport class CSVFileWatcher extends AbstractFileWatcher<string[][]> {\n  private currentContent: string[][];\n  private csvFilePolicies: CSVFilePolicies;\n\n  constructor(\n    filePath: string | undefined,\n    allowReload: boolean,\n    logger: LoggerService,\n    private readonly enforcer: EnforcerDelegate,\n    private readonly roleMetadataStorage: RoleMetadataStorage,\n    private readonly auditLogger: AuditLogger,\n  ) {\n    super(filePath, allowReload, logger);\n    this.currentContent = [];\n    this.csvFilePolicies = {\n      addedPolicies: [],\n      addedGroupPolicies: [],\n      removedPolicies: [],\n      removedGroupPolicies: [],\n    };\n  }\n\n  /**\n   * parse is used to parse the current contents of the CSV file.\n   * @returns The CSV file parsed into a string[][].\n   */\n  parse(): string[][] {\n    const content = this.getCurrentContents();\n    const parser = parse(content, {\n      skip_empty_lines: true,\n      relax_column_count: true,\n      trim: true,\n    });\n\n    return parser;\n  }\n\n  /**\n   * initialize will initialize the CSV file by loading all of the permission policies and roles into\n   * the enforcer.\n   * First, we will remove all roles and permission policies if they do not exist in the temporary file enforcer.\n   * Next, we will add all roles and permission polices if they are new to the CSV file\n   * Finally, we will set the file to be watched if allow reload is set\n   * @param csvFileName The name of the csvFile\n   * @param allowReload Whether or not we will allow reloads of the CSV file\n   */\n  async initialize(): Promise<void> {\n    if (!this.filePath) {\n      return;\n    }\n    let content: string[][] = [];\n    // If the file is set load the file contents\n    content = this.parse();\n\n    const tempEnforcer = await newEnforcer(\n      newModelFromString(MODEL),\n      new FileAdapter(this.filePath),\n    );\n\n    // Check for any old policies that will need to be removed\n    await this.cleanUpRolesAndPolicies();\n\n    // Check for any new policies that need to be added by checking if\n    // the policy does not currently exist in the enforcer\n    const policiesToAdd = await tempEnforcer.getPolicy();\n    const groupPoliciesToAdd = await tempEnforcer.getGroupingPolicy();\n\n    for (const policy of policiesToAdd) {\n      if (!(await this.enforcer.hasPolicy(...policy))) {\n        this.csvFilePolicies.addedPolicies.push(policy);\n      }\n    }\n\n    for (const groupPolicy of groupPoliciesToAdd) {\n      if (!(await this.enforcer.hasGroupingPolicy(...groupPolicy))) {\n        this.csvFilePolicies.addedGroupPolicies.push(groupPolicy);\n      }\n    }\n\n    await this.migrateLegacyMetadata(tempEnforcer);\n\n    // We pass current here because this is during initialization and it has not changed yet\n    await this.updatePolicies(content, tempEnforcer);\n\n    if (this.allowReload) {\n      this.watchFile();\n    }\n  }\n\n  // Check for policies that might need to be updated\n  // This will involve update \"legacy\" source in the role metadata if it exist in both the\n  // temp enforcer (csv file) and a role metadata storage.\n  // We will update role metadata with the new source \"csv-file\"\n  private async migrateLegacyMetadata(tempEnforcer: Enforcer) {\n    let legacyRolesMetadata =\n      await this.roleMetadataStorage.filterRoleMetadata('legacy');\n    const legacyRoles = legacyRolesMetadata.map(meta => meta.roleEntityRef);\n    if (legacyRoles.length > 0) {\n      const legacyGroupPolicies = await tempEnforcer.getFilteredGroupingPolicy(\n        1,\n        ...legacyRoles,\n      );\n      const legacyPolicies = await tempEnforcer.getFilteredPolicy(\n        0,\n        ...legacyRoles,\n      );\n      const legacyRolesFromFile = new Set([\n        ...legacyGroupPolicies.map(gp => gp[1]),\n        ...legacyPolicies.map(p => p[0]),\n      ]);\n      legacyRolesMetadata = legacyRolesMetadata.filter(meta =>\n        legacyRolesFromFile.has(meta.roleEntityRef),\n      );\n      for (const legacyRoleMeta of legacyRolesMetadata) {\n        const nonLegacyRole = mergeRoleMetadata(legacyRoleMeta, {\n          modifiedBy: CSV_PERMISSION_POLICY_FILE_AUTHOR,\n          source: 'csv-file',\n          roleEntityRef: legacyRoleMeta.roleEntityRef,\n        });\n        await this.roleMetadataStorage.updateRoleMetadata(\n          nonLegacyRole,\n          legacyRoleMeta.roleEntityRef,\n        );\n      }\n    }\n  }\n\n  /**\n   * onChange is called whenever there is a change to the CSV file.\n   * It will parse the current and new contents of the CSV file and process the roles and permission policies present.\n   * Afterwards, it will find the difference between the current and new contents of the CSV file\n   * and sort them into added / removed, permission policies / roles.\n   * It will finally call updatePolicies with the new content.\n   */\n  async onChange(): Promise<void> {\n    const newContent = this.parse();\n\n    const tempEnforcer = await newEnforcer(\n      newModelFromString(MODEL),\n      new FileAdapter(this.filePath!),\n    );\n\n    const currentFlatContent = this.currentContent.flatMap(data => {\n      return policyToString(data);\n    });\n    const newFlatContent = newContent.flatMap(data => {\n      return policyToString(data);\n    });\n\n    const diffRemoved = difference(currentFlatContent, newFlatContent); // policy was removed\n    const diffAdded = difference(newFlatContent, currentFlatContent); // policy was added\n\n    await this.migrateLegacyMetadata(tempEnforcer);\n\n    if (diffRemoved.length === 0 && diffAdded.length === 0) {\n      return;\n    }\n\n    diffRemoved.forEach(policy => {\n      const convertedPolicy = metadataStringToPolicy(policy);\n      if (convertedPolicy[0] === 'p') {\n        convertedPolicy.splice(0, 1);\n        this.csvFilePolicies.removedPolicies.push(convertedPolicy);\n      } else if (convertedPolicy[0] === 'g') {\n        convertedPolicy.splice(0, 1);\n        this.csvFilePolicies.removedGroupPolicies.push(convertedPolicy);\n      }\n    });\n\n    diffAdded.forEach(policy => {\n      const convertedPolicy = metadataStringToPolicy(policy);\n      if (convertedPolicy[0] === 'p') {\n        convertedPolicy.splice(0, 1);\n        this.csvFilePolicies.addedPolicies.push(convertedPolicy);\n      } else if (convertedPolicy[0] === 'g') {\n        convertedPolicy.splice(0, 1);\n        this.csvFilePolicies.addedGroupPolicies.push(convertedPolicy);\n      }\n    });\n\n    await this.updatePolicies(newContent, tempEnforcer);\n  }\n\n  /**\n   * updatePolicies is used to update all of the permission policies and roles within a CSV file.\n   * It will check the number of added and removed permissions policies and roles and call the appropriate\n   * methods for these.\n   * It will also update the current contents of the CSV file to the most recent\n   * @param newContent The new content present in the CSV file\n   * @param tempEnforcer Temporary enforcer for checking for duplicates when adding policies\n   */\n  private async updatePolicies(\n    newContent: string[][],\n    tempEnforcer: Enforcer,\n  ): Promise<void> {\n    this.currentContent = newContent;\n\n    if (this.csvFilePolicies.addedPolicies.length > 0)\n      await this.addPermissionPolicies(tempEnforcer);\n    if (this.csvFilePolicies.removedPolicies.length > 0)\n      await this.removePermissionPolicies();\n    if (this.csvFilePolicies.addedGroupPolicies.length > 0)\n      await this.addRoles(tempEnforcer);\n    if (this.csvFilePolicies.removedGroupPolicies.length > 0)\n      await this.removeRoles();\n  }\n\n  /**\n   * addPermissionPolicies will add the new permission policies that are present in the CSV file.\n   * We will attempt to validate the permission policy and log any warnings that are encountered.\n   * If a warning is encountered, we will skip adding the permission policy to the enforcer.\n   * @param tempEnforcer Temporary enforcer for checking for duplicates when adding policies\n   */\n  private async addPermissionPolicies(tempEnforcer: Enforcer): Promise<void> {\n    for (const policy of this.csvFilePolicies.addedPolicies) {\n      const transformedPolicy = transformArrayToPolicy(policy);\n      const metadata = await this.roleMetadataStorage.findRoleMetadata(\n        policy[0],\n      );\n\n      let err = validatePolicy(transformedPolicy);\n      if (err) {\n        this.logger.warn(\n          `Failed to validate policy from file ${this.filePath}. Cause: ${err.message}`,\n        );\n        continue;\n      }\n\n      err = await validateSource('csv-file', metadata);\n      if (err) {\n        this.logger.warn(\n          `Unable to add policy ${policy} from file ${this.filePath}. Cause: ${err.message}`,\n        );\n        continue;\n      }\n\n      err = await checkForDuplicatePolicies(\n        tempEnforcer,\n        policy,\n        this.filePath!,\n      );\n      if (err) {\n        this.logger.warn(err.message);\n        continue;\n      }\n      try {\n        await this.enforcer.addPolicy(policy);\n\n        await this.auditLogger.auditLog<PermissionAuditInfo>({\n          actorId: RBAC_BACKEND,\n          message: `Created policy`,\n          eventName: PermissionEvents.CREATE_POLICY,\n          metadata: { policies: [policy], source: 'csv-file' },\n          stage: HANDLE_RBAC_DATA_STAGE,\n          status: 'succeeded',\n        });\n      } catch (e) {\n        this.logger.warn(\n          `Failed to add or update policy ${policy} after modification ${this.filePath}. Cause: ${e}`,\n        );\n      }\n    }\n\n    this.csvFilePolicies.addedPolicies = [];\n  }\n\n  /**\n   * removePermissionPolicies will remove the permission policies that are no longer present in the CSV file.\n   */\n  private async removePermissionPolicies(): Promise<void> {\n    try {\n      await this.enforcer.removePolicies(this.csvFilePolicies.removedPolicies);\n\n      await this.auditLogger.auditLog<PermissionAuditInfo>({\n        actorId: RBAC_BACKEND,\n        message: `Deleted policies`,\n        eventName: PermissionEvents.DELETE_POLICY,\n        metadata: {\n          policies: this.csvFilePolicies.removedPolicies,\n          source: 'csv-file',\n        },\n        stage: HANDLE_RBAC_DATA_STAGE,\n        status: 'succeeded',\n      });\n    } catch (e) {\n      this.logger.warn(\n        `Failed to remove policies ${JSON.stringify(\n          this.csvFilePolicies.removedPolicies,\n        )} after modification ${this.filePath}. Cause: ${e}`,\n      );\n    }\n    this.csvFilePolicies.removedPolicies = [];\n  }\n\n  /**\n   * addRoles will add the new roles that are present in the CSV file.\n   * We will attempt to validate the role and log any warnings that are encountered.\n   * If a warning is encountered, we will skip adding the role to the enforcer.\n   * @param tempEnforcer Temporary enforcer for checking for duplicates when adding policies\n   */\n  private async addRoles(tempEnforcer: Enforcer): Promise<void> {\n    for (const groupPolicy of this.csvFilePolicies.addedGroupPolicies) {\n      let err = await validateGroupingPolicy(\n        groupPolicy,\n        this.roleMetadataStorage,\n        'csv-file',\n      );\n      if (err) {\n        this.logger.warn(\n          `${err.message}, error originates from file ${this.filePath}`,\n        );\n        continue;\n      }\n\n      err = await checkForDuplicateGroupPolicies(\n        tempEnforcer,\n        groupPolicy,\n        this.filePath!,\n      );\n      if (err) {\n        this.logger.warn(err.message);\n        continue;\n      }\n\n      try {\n        const roleMetadata: RoleMetadataDao = {\n          source: 'csv-file',\n          roleEntityRef: groupPolicy[1],\n          author: CSV_PERMISSION_POLICY_FILE_AUTHOR,\n          modifiedBy: CSV_PERMISSION_POLICY_FILE_AUTHOR,\n        };\n\n        const currentMetadata = await this.roleMetadataStorage.findRoleMetadata(\n          roleMetadata.roleEntityRef,\n        );\n\n        await this.enforcer.addGroupingPolicy(groupPolicy, roleMetadata);\n\n        const eventName = currentMetadata\n          ? RoleEvents.UPDATE_ROLE\n          : RoleEvents.CREATE_ROLE;\n        const message = currentMetadata ? 'Updated role' : 'Created role';\n        await this.auditLogger.auditLog<RoleAuditInfo>({\n          actorId: RBAC_BACKEND,\n          message,\n          eventName,\n          metadata: { ...roleMetadata, members: [groupPolicy[0]] },\n          stage: HANDLE_RBAC_DATA_STAGE,\n          status: 'succeeded',\n        });\n      } catch (e) {\n        this.logger.warn(\n          `Failed to add or update group policy ${groupPolicy} after modification ${this.filePath}. Cause: ${e}`,\n        );\n      }\n    }\n    this.csvFilePolicies.addedGroupPolicies = [];\n  }\n\n  /**\n   * removeRoles will remove the roles that are no longer present in the CSV file.\n   * If the role exists with multiple groups and or users, we will update it role information.\n   * Otherwise, we will remove the role completely.\n   */\n  private async removeRoles(): Promise<void> {\n    for (const groupPolicy of this.csvFilePolicies.removedGroupPolicies) {\n      const roleEntityRef = groupPolicy[1];\n      // this requires knowledge of whether or not it is an update\n      const isUpdate = await this.enforcer.getFilteredGroupingPolicy(\n        1,\n        roleEntityRef,\n      );\n\n      // Need to update the time\n      try {\n        const metadata: RoleMetadataDao = {\n          source: 'csv-file',\n          roleEntityRef,\n          author: CSV_PERMISSION_POLICY_FILE_AUTHOR,\n          modifiedBy: CSV_PERMISSION_POLICY_FILE_AUTHOR,\n        };\n\n        await this.enforcer.removeGroupingPolicy(\n          groupPolicy,\n          metadata,\n          isUpdate.length > 1,\n        );\n\n        const isRolePresent =\n          await this.roleMetadataStorage.findRoleMetadata(roleEntityRef);\n        const eventName = isRolePresent\n          ? RoleEvents.UPDATE_ROLE\n          : RoleEvents.DELETE_ROLE;\n        const message = isRolePresent\n          ? 'Updated role: deleted members'\n          : 'Deleted role';\n        await this.auditLogger.auditLog<RoleAuditInfo>({\n          actorId: RBAC_BACKEND,\n          message,\n          eventName,\n          metadata: { ...metadata, members: [groupPolicy[0]] },\n          stage: HANDLE_RBAC_DATA_STAGE,\n          status: 'succeeded',\n        });\n      } catch (e) {\n        this.logger.warn(\n          `Failed to remove group policy ${groupPolicy} after modification ${this.filePath}. Cause: ${e}`,\n        );\n      }\n    }\n    this.csvFilePolicies.removedGroupPolicies = [];\n  }\n\n  async cleanUpRolesAndPolicies(): Promise<void> {\n    const roleMetadatas =\n      await this.roleMetadataStorage.filterRoleMetadata('csv-file');\n    const fileRoles = roleMetadatas.map(meta => meta.roleEntityRef);\n\n    if (fileRoles.length > 0) {\n      for (const fileRole of fileRoles) {\n        this.csvFilePolicies.removedGroupPolicies.push(\n          ...(await this.enforcer.getFilteredGroupingPolicy(1, fileRole)),\n        );\n        this.csvFilePolicies.removedPolicies.push(\n          ...(await this.enforcer.getFilteredPolicy(0, fileRole)),\n        );\n      }\n    }\n    await this.removePermissionPolicies();\n    await this.removeRoles();\n  }\n}\n"],"names":["AbstractFileWatcher","parse","newEnforcer","newModelFromString","MODEL","FileAdapter","mergeRoleMetadata","policyToString","difference","metadataStringToPolicy","transformArrayToPolicy","validatePolicy","validateSource","checkForDuplicatePolicies","RBAC_BACKEND","PermissionEvents","HANDLE_RBAC_DATA_STAGE","validateGroupingPolicy","checkForDuplicateGroupPolicies","RoleEvents"],"mappings":";;;;;;;;;;;AAmDO,MAAM,iCAAoC,GAAA;AAS1C,MAAM,uBAAuBA,+BAAgC,CAAA;AAAA,EAIlE,YACE,QACA,EAAA,WAAA,EACA,MACiB,EAAA,QAAA,EACA,qBACA,WACjB,EAAA;AACA,IAAM,KAAA,CAAA,QAAA,EAAU,aAAa,MAAM,CAAA;AAJlB,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AACA,IAAA,IAAA,CAAA,mBAAA,GAAA,mBAAA;AACA,IAAA,IAAA,CAAA,WAAA,GAAA,WAAA;AAGjB,IAAA,IAAA,CAAK,iBAAiB,EAAC;AACvB,IAAA,IAAA,CAAK,eAAkB,GAAA;AAAA,MACrB,eAAe,EAAC;AAAA,MAChB,oBAAoB,EAAC;AAAA,MACrB,iBAAiB,EAAC;AAAA,MAClB,sBAAsB;AAAC,KACzB;AAAA;AACF,EAnBQ,cAAA;AAAA,EACA,eAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAwBR,KAAoB,GAAA;AAClB,IAAM,MAAA,OAAA,GAAU,KAAK,kBAAmB,EAAA;AACxC,IAAM,MAAA,MAAA,GAASC,WAAM,OAAS,EAAA;AAAA,MAC5B,gBAAkB,EAAA,IAAA;AAAA,MAClB,kBAAoB,EAAA,IAAA;AAAA,MACpB,IAAM,EAAA;AAAA,KACP,CAAA;AAED,IAAO,OAAA,MAAA;AAAA;AACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,UAA4B,GAAA;AAChC,IAAI,IAAA,CAAC,KAAK,QAAU,EAAA;AAClB,MAAA;AAAA;AAEF,IAAA,IAAI,UAAsB,EAAC;AAE3B,IAAA,OAAA,GAAU,KAAK,KAAM,EAAA;AAErB,IAAA,MAAM,eAAe,MAAMC,kBAAA;AAAA,MACzBC,0BAAmBC,qBAAK,CAAA;AAAA,MACxB,IAAIC,kBAAY,CAAA,IAAA,CAAK,QAAQ;AAAA,KAC/B;AAGA,IAAA,MAAM,KAAK,uBAAwB,EAAA;AAInC,IAAM,MAAA,aAAA,GAAgB,MAAM,YAAA,CAAa,SAAU,EAAA;AACnD,IAAM,MAAA,kBAAA,GAAqB,MAAM,YAAA,CAAa,iBAAkB,EAAA;AAEhE,IAAA,KAAA,MAAW,UAAU,aAAe,EAAA;AAClC,MAAA,IAAI,CAAE,MAAM,IAAA,CAAK,SAAS,SAAU,CAAA,GAAG,MAAM,CAAI,EAAA;AAC/C,QAAK,IAAA,CAAA,eAAA,CAAgB,aAAc,CAAA,IAAA,CAAK,MAAM,CAAA;AAAA;AAChD;AAGF,IAAA,KAAA,MAAW,eAAe,kBAAoB,EAAA;AAC5C,MAAA,IAAI,CAAE,MAAM,IAAA,CAAK,SAAS,iBAAkB,CAAA,GAAG,WAAW,CAAI,EAAA;AAC5D,QAAK,IAAA,CAAA,eAAA,CAAgB,kBAAmB,CAAA,IAAA,CAAK,WAAW,CAAA;AAAA;AAC1D;AAGF,IAAM,MAAA,IAAA,CAAK,sBAAsB,YAAY,CAAA;AAG7C,IAAM,MAAA,IAAA,CAAK,cAAe,CAAA,OAAA,EAAS,YAAY,CAAA;AAE/C,IAAA,IAAI,KAAK,WAAa,EAAA;AACpB,MAAA,IAAA,CAAK,SAAU,EAAA;AAAA;AACjB;AACF;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,sBAAsB,YAAwB,EAAA;AAC1D,IAAA,IAAI,mBACF,GAAA,MAAM,IAAK,CAAA,mBAAA,CAAoB,mBAAmB,QAAQ,CAAA;AAC5D,IAAA,MAAM,WAAc,GAAA,mBAAA,CAAoB,GAAI,CAAA,CAAA,IAAA,KAAQ,KAAK,aAAa,CAAA;AACtE,IAAI,IAAA,WAAA,CAAY,SAAS,CAAG,EAAA;AAC1B,MAAM,MAAA,mBAAA,GAAsB,MAAM,YAAa,CAAA,yBAAA;AAAA,QAC7C,CAAA;AAAA,QACA,GAAG;AAAA,OACL;AACA,MAAM,MAAA,cAAA,GAAiB,MAAM,YAAa,CAAA,iBAAA;AAAA,QACxC,CAAA;AAAA,QACA,GAAG;AAAA,OACL;AACA,MAAM,MAAA,mBAAA,uBAA0B,GAAI,CAAA;AAAA,QAClC,GAAG,mBAAoB,CAAA,GAAA,CAAI,CAAM,EAAA,KAAA,EAAA,CAAG,CAAC,CAAC,CAAA;AAAA,QACtC,GAAG,cAAe,CAAA,GAAA,CAAI,CAAK,CAAA,KAAA,CAAA,CAAE,CAAC,CAAC;AAAA,OAChC,CAAA;AACD,MAAA,mBAAA,GAAsB,mBAAoB,CAAA,MAAA;AAAA,QAAO,CAC/C,IAAA,KAAA,mBAAA,CAAoB,GAAI,CAAA,IAAA,CAAK,aAAa;AAAA,OAC5C;AACA,MAAA,KAAA,MAAW,kBAAkB,mBAAqB,EAAA;AAChD,QAAM,MAAA,aAAA,GAAgBC,yBAAkB,cAAgB,EAAA;AAAA,UACtD,UAAY,EAAA,iCAAA;AAAA,UACZ,MAAQ,EAAA,UAAA;AAAA,UACR,eAAe,cAAe,CAAA;AAAA,SAC/B,CAAA;AACD,QAAA,MAAM,KAAK,mBAAoB,CAAA,kBAAA;AAAA,UAC7B,aAAA;AAAA,UACA,cAAe,CAAA;AAAA,SACjB;AAAA;AACF;AACF;AACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,QAA0B,GAAA;AAC9B,IAAM,MAAA,UAAA,GAAa,KAAK,KAAM,EAAA;AAE9B,IAAA,MAAM,eAAe,MAAMJ,kBAAA;AAAA,MACzBC,0BAAmBC,qBAAK,CAAA;AAAA,MACxB,IAAIC,kBAAY,CAAA,IAAA,CAAK,QAAS;AAAA,KAChC;AAEA,IAAA,MAAM,kBAAqB,GAAA,IAAA,CAAK,cAAe,CAAA,OAAA,CAAQ,CAAQ,IAAA,KAAA;AAC7D,MAAA,OAAOE,sBAAe,IAAI,CAAA;AAAA,KAC3B,CAAA;AACD,IAAM,MAAA,cAAA,GAAiB,UAAW,CAAA,OAAA,CAAQ,CAAQ,IAAA,KAAA;AAChD,MAAA,OAAOA,sBAAe,IAAI,CAAA;AAAA,KAC3B,CAAA;AAED,IAAM,MAAA,WAAA,GAAcC,iBAAW,CAAA,kBAAA,EAAoB,cAAc,CAAA;AACjE,IAAM,MAAA,SAAA,GAAYA,iBAAW,CAAA,cAAA,EAAgB,kBAAkB,CAAA;AAE/D,IAAM,MAAA,IAAA,CAAK,sBAAsB,YAAY,CAAA;AAE7C,IAAA,IAAI,WAAY,CAAA,MAAA,KAAW,CAAK,IAAA,SAAA,CAAU,WAAW,CAAG,EAAA;AACtD,MAAA;AAAA;AAGF,IAAA,WAAA,CAAY,QAAQ,CAAU,MAAA,KAAA;AAC5B,MAAM,MAAA,eAAA,GAAkBC,8BAAuB,MAAM,CAAA;AACrD,MAAI,IAAA,eAAA,CAAgB,CAAC,CAAA,KAAM,GAAK,EAAA;AAC9B,QAAgB,eAAA,CAAA,MAAA,CAAO,GAAG,CAAC,CAAA;AAC3B,QAAK,IAAA,CAAA,eAAA,CAAgB,eAAgB,CAAA,IAAA,CAAK,eAAe,CAAA;AAAA,OAChD,MAAA,IAAA,eAAA,CAAgB,CAAC,CAAA,KAAM,GAAK,EAAA;AACrC,QAAgB,eAAA,CAAA,MAAA,CAAO,GAAG,CAAC,CAAA;AAC3B,QAAK,IAAA,CAAA,eAAA,CAAgB,oBAAqB,CAAA,IAAA,CAAK,eAAe,CAAA;AAAA;AAChE,KACD,CAAA;AAED,IAAA,SAAA,CAAU,QAAQ,CAAU,MAAA,KAAA;AAC1B,MAAM,MAAA,eAAA,GAAkBA,8BAAuB,MAAM,CAAA;AACrD,MAAI,IAAA,eAAA,CAAgB,CAAC,CAAA,KAAM,GAAK,EAAA;AAC9B,QAAgB,eAAA,CAAA,MAAA,CAAO,GAAG,CAAC,CAAA;AAC3B,QAAK,IAAA,CAAA,eAAA,CAAgB,aAAc,CAAA,IAAA,CAAK,eAAe,CAAA;AAAA,OAC9C,MAAA,IAAA,eAAA,CAAgB,CAAC,CAAA,KAAM,GAAK,EAAA;AACrC,QAAgB,eAAA,CAAA,MAAA,CAAO,GAAG,CAAC,CAAA;AAC3B,QAAK,IAAA,CAAA,eAAA,CAAgB,kBAAmB,CAAA,IAAA,CAAK,eAAe,CAAA;AAAA;AAC9D,KACD,CAAA;AAED,IAAM,MAAA,IAAA,CAAK,cAAe,CAAA,UAAA,EAAY,YAAY,CAAA;AAAA;AACpD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAc,cACZ,CAAA,UAAA,EACA,YACe,EAAA;AACf,IAAA,IAAA,CAAK,cAAiB,GAAA,UAAA;AAEtB,IAAI,IAAA,IAAA,CAAK,eAAgB,CAAA,aAAA,CAAc,MAAS,GAAA,CAAA;AAC9C,MAAM,MAAA,IAAA,CAAK,sBAAsB,YAAY,CAAA;AAC/C,IAAI,IAAA,IAAA,CAAK,eAAgB,CAAA,eAAA,CAAgB,MAAS,GAAA,CAAA;AAChD,MAAA,MAAM,KAAK,wBAAyB,EAAA;AACtC,IAAI,IAAA,IAAA,CAAK,eAAgB,CAAA,kBAAA,CAAmB,MAAS,GAAA,CAAA;AACnD,MAAM,MAAA,IAAA,CAAK,SAAS,YAAY,CAAA;AAClC,IAAI,IAAA,IAAA,CAAK,eAAgB,CAAA,oBAAA,CAAqB,MAAS,GAAA,CAAA;AACrD,MAAA,MAAM,KAAK,WAAY,EAAA;AAAA;AAC3B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAc,sBAAsB,YAAuC,EAAA;AACzE,IAAW,KAAA,MAAA,MAAA,IAAU,IAAK,CAAA,eAAA,CAAgB,aAAe,EAAA;AACvD,MAAM,MAAA,iBAAA,GAAoBC,8BAAuB,MAAM,CAAA;AACvD,MAAM,MAAA,QAAA,GAAW,MAAM,IAAA,CAAK,mBAAoB,CAAA,gBAAA;AAAA,QAC9C,OAAO,CAAC;AAAA,OACV;AAEA,MAAI,IAAA,GAAA,GAAMC,kCAAe,iBAAiB,CAAA;AAC1C,MAAA,IAAI,GAAK,EAAA;AACP,QAAA,IAAA,CAAK,MAAO,CAAA,IAAA;AAAA,UACV,CAAuC,oCAAA,EAAA,IAAA,CAAK,QAAQ,CAAA,SAAA,EAAY,IAAI,OAAO,CAAA;AAAA,SAC7E;AACA,QAAA;AAAA;AAGF,MAAM,GAAA,GAAA,MAAMC,iCAAe,CAAA,UAAA,EAAY,QAAQ,CAAA;AAC/C,MAAA,IAAI,GAAK,EAAA;AACP,QAAA,IAAA,CAAK,MAAO,CAAA,IAAA;AAAA,UACV,wBAAwB,MAAM,CAAA,WAAA,EAAc,KAAK,QAAQ,CAAA,SAAA,EAAY,IAAI,OAAO,CAAA;AAAA,SAClF;AACA,QAAA;AAAA;AAGF,MAAA,GAAA,GAAM,MAAMC,4CAAA;AAAA,QACV,YAAA;AAAA,QACA,MAAA;AAAA,QACA,IAAK,CAAA;AAAA,OACP;AACA,MAAA,IAAI,GAAK,EAAA;AACP,QAAK,IAAA,CAAA,MAAA,CAAO,IAAK,CAAA,GAAA,CAAI,OAAO,CAAA;AAC5B,QAAA;AAAA;AAEF,MAAI,IAAA;AACF,QAAM,MAAA,IAAA,CAAK,QAAS,CAAA,SAAA,CAAU,MAAM,CAAA;AAEpC,QAAM,MAAA,IAAA,CAAK,YAAY,QAA8B,CAAA;AAAA,UACnD,OAAS,EAAAC,wBAAA;AAAA,UACT,OAAS,EAAA,CAAA,cAAA,CAAA;AAAA,UACT,WAAWC,4BAAiB,CAAA,aAAA;AAAA,UAC5B,UAAU,EAAE,QAAA,EAAU,CAAC,MAAM,CAAA,EAAG,QAAQ,UAAW,EAAA;AAAA,UACnD,KAAO,EAAAC,kCAAA;AAAA,UACP,MAAQ,EAAA;AAAA,SACT,CAAA;AAAA,eACM,CAAG,EAAA;AACV,QAAA,IAAA,CAAK,MAAO,CAAA,IAAA;AAAA,UACV,kCAAkC,MAAM,CAAA,oBAAA,EAAuB,IAAK,CAAA,QAAQ,YAAY,CAAC,CAAA;AAAA,SAC3F;AAAA;AACF;AAGF,IAAK,IAAA,CAAA,eAAA,CAAgB,gBAAgB,EAAC;AAAA;AACxC;AAAA;AAAA;AAAA,EAKA,MAAc,wBAA0C,GAAA;AACtD,IAAI,IAAA;AACF,MAAA,MAAM,IAAK,CAAA,QAAA,CAAS,cAAe,CAAA,IAAA,CAAK,gBAAgB,eAAe,CAAA;AAEvE,MAAM,MAAA,IAAA,CAAK,YAAY,QAA8B,CAAA;AAAA,QACnD,OAAS,EAAAF,wBAAA;AAAA,QACT,OAAS,EAAA,CAAA,gBAAA,CAAA;AAAA,QACT,WAAWC,4BAAiB,CAAA,aAAA;AAAA,QAC5B,QAAU,EAAA;AAAA,UACR,QAAA,EAAU,KAAK,eAAgB,CAAA,eAAA;AAAA,UAC/B,MAAQ,EAAA;AAAA,SACV;AAAA,QACA,KAAO,EAAAC,kCAAA;AAAA,QACP,MAAQ,EAAA;AAAA,OACT,CAAA;AAAA,aACM,CAAG,EAAA;AACV,MAAA,IAAA,CAAK,MAAO,CAAA,IAAA;AAAA,QACV,6BAA6B,IAAK,CAAA,SAAA;AAAA,UAChC,KAAK,eAAgB,CAAA;AAAA,SACtB,CAAA,oBAAA,EAAuB,IAAK,CAAA,QAAQ,YAAY,CAAC,CAAA;AAAA,OACpD;AAAA;AAEF,IAAK,IAAA,CAAA,eAAA,CAAgB,kBAAkB,EAAC;AAAA;AAC1C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAc,SAAS,YAAuC,EAAA;AAC5D,IAAW,KAAA,MAAA,WAAA,IAAe,IAAK,CAAA,eAAA,CAAgB,kBAAoB,EAAA;AACjE,MAAA,IAAI,MAAM,MAAMC,yCAAA;AAAA,QACd,WAAA;AAAA,QACA,IAAK,CAAA,mBAAA;AAAA,QACL;AAAA,OACF;AACA,MAAA,IAAI,GAAK,EAAA;AACP,QAAA,IAAA,CAAK,MAAO,CAAA,IAAA;AAAA,UACV,CAAG,EAAA,GAAA,CAAI,OAAO,CAAA,6BAAA,EAAgC,KAAK,QAAQ,CAAA;AAAA,SAC7D;AACA,QAAA;AAAA;AAGF,MAAA,GAAA,GAAM,MAAMC,iDAAA;AAAA,QACV,YAAA;AAAA,QACA,WAAA;AAAA,QACA,IAAK,CAAA;AAAA,OACP;AACA,MAAA,IAAI,GAAK,EAAA;AACP,QAAK,IAAA,CAAA,MAAA,CAAO,IAAK,CAAA,GAAA,CAAI,OAAO,CAAA;AAC5B,QAAA;AAAA;AAGF,MAAI,IAAA;AACF,QAAA,MAAM,YAAgC,GAAA;AAAA,UACpC,MAAQ,EAAA,UAAA;AAAA,UACR,aAAA,EAAe,YAAY,CAAC,CAAA;AAAA,UAC5B,MAAQ,EAAA,iCAAA;AAAA,UACR,UAAY,EAAA;AAAA,SACd;AAEA,QAAM,MAAA,eAAA,GAAkB,MAAM,IAAA,CAAK,mBAAoB,CAAA,gBAAA;AAAA,UACrD,YAAa,CAAA;AAAA,SACf;AAEA,QAAA,MAAM,IAAK,CAAA,QAAA,CAAS,iBAAkB,CAAA,WAAA,EAAa,YAAY,CAAA;AAE/D,QAAA,MAAM,SAAY,GAAA,eAAA,GACdC,sBAAW,CAAA,WAAA,GACXA,sBAAW,CAAA,WAAA;AACf,QAAM,MAAA,OAAA,GAAU,kBAAkB,cAAiB,GAAA,cAAA;AACnD,QAAM,MAAA,IAAA,CAAK,YAAY,QAAwB,CAAA;AAAA,UAC7C,OAAS,EAAAL,wBAAA;AAAA,UACT,OAAA;AAAA,UACA,SAAA;AAAA,UACA,QAAA,EAAU,EAAE,GAAG,YAAA,EAAc,SAAS,CAAC,WAAA,CAAY,CAAC,CAAC,CAAE,EAAA;AAAA,UACvD,KAAO,EAAAE,kCAAA;AAAA,UACP,MAAQ,EAAA;AAAA,SACT,CAAA;AAAA,eACM,CAAG,EAAA;AACV,QAAA,IAAA,CAAK,MAAO,CAAA,IAAA;AAAA,UACV,wCAAwC,WAAW,CAAA,oBAAA,EAAuB,IAAK,CAAA,QAAQ,YAAY,CAAC,CAAA;AAAA,SACtG;AAAA;AACF;AAEF,IAAK,IAAA,CAAA,eAAA,CAAgB,qBAAqB,EAAC;AAAA;AAC7C;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAc,WAA6B,GAAA;AACzC,IAAW,KAAA,MAAA,WAAA,IAAe,IAAK,CAAA,eAAA,CAAgB,oBAAsB,EAAA;AACnE,MAAM,MAAA,aAAA,GAAgB,YAAY,CAAC,CAAA;AAEnC,MAAM,MAAA,QAAA,GAAW,MAAM,IAAA,CAAK,QAAS,CAAA,yBAAA;AAAA,QACnC,CAAA;AAAA,QACA;AAAA,OACF;AAGA,MAAI,IAAA;AACF,QAAA,MAAM,QAA4B,GAAA;AAAA,UAChC,MAAQ,EAAA,UAAA;AAAA,UACR,aAAA;AAAA,UACA,MAAQ,EAAA,iCAAA;AAAA,UACR,UAAY,EAAA;AAAA,SACd;AAEA,QAAA,MAAM,KAAK,QAAS,CAAA,oBAAA;AAAA,UAClB,WAAA;AAAA,UACA,QAAA;AAAA,UACA,SAAS,MAAS,GAAA;AAAA,SACpB;AAEA,QAAA,MAAM,aACJ,GAAA,MAAM,IAAK,CAAA,mBAAA,CAAoB,iBAAiB,aAAa,CAAA;AAC/D,QAAA,MAAM,SAAY,GAAA,aAAA,GACdG,sBAAW,CAAA,WAAA,GACXA,sBAAW,CAAA,WAAA;AACf,QAAM,MAAA,OAAA,GAAU,gBACZ,+BACA,GAAA,cAAA;AACJ,QAAM,MAAA,IAAA,CAAK,YAAY,QAAwB,CAAA;AAAA,UAC7C,OAAS,EAAAL,wBAAA;AAAA,UACT,OAAA;AAAA,UACA,SAAA;AAAA,UACA,QAAA,EAAU,EAAE,GAAG,QAAA,EAAU,SAAS,CAAC,WAAA,CAAY,CAAC,CAAC,CAAE,EAAA;AAAA,UACnD,KAAO,EAAAE,kCAAA;AAAA,UACP,MAAQ,EAAA;AAAA,SACT,CAAA;AAAA,eACM,CAAG,EAAA;AACV,QAAA,IAAA,CAAK,MAAO,CAAA,IAAA;AAAA,UACV,iCAAiC,WAAW,CAAA,oBAAA,EAAuB,IAAK,CAAA,QAAQ,YAAY,CAAC,CAAA;AAAA,SAC/F;AAAA;AACF;AAEF,IAAK,IAAA,CAAA,eAAA,CAAgB,uBAAuB,EAAC;AAAA;AAC/C,EAEA,MAAM,uBAAyC,GAAA;AAC7C,IAAA,MAAM,aACJ,GAAA,MAAM,IAAK,CAAA,mBAAA,CAAoB,mBAAmB,UAAU,CAAA;AAC9D,IAAA,MAAM,SAAY,GAAA,aAAA,CAAc,GAAI,CAAA,CAAA,IAAA,KAAQ,KAAK,aAAa,CAAA;AAE9D,IAAI,IAAA,SAAA,CAAU,SAAS,CAAG,EAAA;AACxB,MAAA,KAAA,MAAW,YAAY,SAAW,EAAA;AAChC,QAAA,IAAA,CAAK,gBAAgB,oBAAqB,CAAA,IAAA;AAAA,UACxC,GAAI,MAAM,IAAA,CAAK,QAAS,CAAA,yBAAA,CAA0B,GAAG,QAAQ;AAAA,SAC/D;AACA,QAAA,IAAA,CAAK,gBAAgB,eAAgB,CAAA,IAAA;AAAA,UACnC,GAAI,MAAM,IAAA,CAAK,QAAS,CAAA,iBAAA,CAAkB,GAAG,QAAQ;AAAA,SACvD;AAAA;AACF;AAEF,IAAA,MAAM,KAAK,wBAAyB,EAAA;AACpC,IAAA,MAAM,KAAK,WAAY,EAAA;AAAA;AAE3B;;;;;"}
+{"version":3,"file":"csv-file-watcher.cjs.js","sources":["../../src/file-permissions/csv-file-watcher.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport type { LoggerService } from '@backstage/backend-plugin-api';\n\nimport type { AuditLogger } from '@janus-idp/backstage-plugin-audit-log-node';\nimport { Enforcer, newEnforcer, newModelFromString } from 'casbin';\nimport { parse } from 'csv-parse/sync';\nimport { difference } from 'lodash';\n\nimport {\n  HANDLE_RBAC_DATA_STAGE,\n  PermissionAuditInfo,\n  PermissionEvents,\n  RBAC_BACKEND,\n  RoleAuditInfo,\n  RoleEvents,\n} from '../audit-log/audit-logger';\nimport {\n  RoleMetadataDao,\n  RoleMetadataStorage,\n} from '../database/role-metadata';\nimport {\n  mergeRoleMetadata,\n  metadataStringToPolicy,\n  policyToString,\n  transformArrayToPolicy,\n  transformPolicyGroupToLowercase,\n} from '../helper';\nimport { EnforcerDelegate } from '../service/enforcer-delegate';\nimport { MODEL } from '../service/permission-model';\nimport {\n  checkForDuplicateGroupPolicies,\n  checkForDuplicatePolicies,\n  validateGroupingPolicy,\n  validatePolicy,\n  validateSource,\n} from '../validation/policies-validation';\nimport { AbstractFileWatcher } from './file-watcher';\nimport { LowercaseFileAdapter } from './lowercase-file-adapter';\n\nexport const CSV_PERMISSION_POLICY_FILE_AUTHOR = 'csv permission policy file';\n\ntype CSVFilePolicies = {\n  addedPolicies: string[][];\n  addedGroupPolicies: string[][];\n  removedPolicies: string[][];\n  removedGroupPolicies: string[][];\n};\n\nexport class CSVFileWatcher extends AbstractFileWatcher<string[][]> {\n  private currentContent: string[][];\n  private csvFilePolicies: CSVFilePolicies;\n\n  constructor(\n    filePath: string | undefined,\n    allowReload: boolean,\n    logger: LoggerService,\n    private readonly enforcer: EnforcerDelegate,\n    private readonly roleMetadataStorage: RoleMetadataStorage,\n    private readonly auditLogger: AuditLogger,\n  ) {\n    super(filePath, allowReload, logger);\n    this.currentContent = [];\n    this.csvFilePolicies = {\n      addedPolicies: [],\n      addedGroupPolicies: [],\n      removedPolicies: [],\n      removedGroupPolicies: [],\n    };\n  }\n\n  /**\n   * parse is used to parse the current contents of the CSV file.\n   * @returns The CSV file parsed into a string[][].\n   */\n  parse(): string[][] {\n    const content = this.getCurrentContents();\n    const data = parse(content, {\n      skip_empty_lines: true,\n      relax_column_count: true,\n      trim: true,\n    });\n\n    for (const policy of data) {\n      transformPolicyGroupToLowercase(policy);\n    }\n\n    return data;\n  }\n\n  /**\n   * initialize will initialize the CSV file by loading all of the permission policies and roles into\n   * the enforcer.\n   * First, we will remove all roles and permission policies if they do not exist in the temporary file enforcer.\n   * Next, we will add all roles and permission polices if they are new to the CSV file\n   * Finally, we will set the file to be watched if allow reload is set\n   * @param csvFileName The name of the csvFile\n   * @param allowReload Whether or not we will allow reloads of the CSV file\n   */\n  async initialize(): Promise<void> {\n    if (!this.filePath) {\n      return;\n    }\n    let content: string[][] = [];\n    // If the file is set load the file contents\n    content = this.parse();\n\n    const tempEnforcer = await newEnforcer(\n      newModelFromString(MODEL),\n      new LowercaseFileAdapter(this.filePath),\n    );\n\n    // Check for any old policies that will need to be removed\n    await this.cleanUpRolesAndPolicies();\n\n    // Check for any new policies that need to be added by checking if\n    // the policy does not currently exist in the enforcer\n    const policiesToAdd = await tempEnforcer.getPolicy();\n    const groupPoliciesToAdd = await tempEnforcer.getGroupingPolicy();\n\n    for (const policy of policiesToAdd) {\n      if (!(await this.enforcer.hasPolicy(...policy))) {\n        this.csvFilePolicies.addedPolicies.push(policy);\n      }\n    }\n\n    for (const groupPolicy of groupPoliciesToAdd) {\n      if (!(await this.enforcer.hasGroupingPolicy(...groupPolicy))) {\n        this.csvFilePolicies.addedGroupPolicies.push(groupPolicy);\n      }\n    }\n\n    await this.migrateLegacyMetadata(tempEnforcer);\n\n    // We pass current here because this is during initialization and it has not changed yet\n    await this.updatePolicies(content, tempEnforcer);\n\n    if (this.allowReload) {\n      this.watchFile();\n    }\n  }\n\n  // Check for policies that might need to be updated\n  // This will involve update \"legacy\" source in the role metadata if it exist in both the\n  // temp enforcer (csv file) and a role metadata storage.\n  // We will update role metadata with the new source \"csv-file\"\n  private async migrateLegacyMetadata(tempEnforcer: Enforcer) {\n    let legacyRolesMetadata =\n      await this.roleMetadataStorage.filterRoleMetadata('legacy');\n    const legacyRoles = legacyRolesMetadata.map(meta => meta.roleEntityRef);\n    if (legacyRoles.length > 0) {\n      const legacyGroupPolicies = await tempEnforcer.getFilteredGroupingPolicy(\n        1,\n        ...legacyRoles,\n      );\n      const legacyPolicies = await tempEnforcer.getFilteredPolicy(\n        0,\n        ...legacyRoles,\n      );\n      const legacyRolesFromFile = new Set([\n        ...legacyGroupPolicies.map(gp => gp[1]),\n        ...legacyPolicies.map(p => p[0]),\n      ]);\n      legacyRolesMetadata = legacyRolesMetadata.filter(meta =>\n        legacyRolesFromFile.has(meta.roleEntityRef),\n      );\n      for (const legacyRoleMeta of legacyRolesMetadata) {\n        const nonLegacyRole = mergeRoleMetadata(legacyRoleMeta, {\n          modifiedBy: CSV_PERMISSION_POLICY_FILE_AUTHOR,\n          source: 'csv-file',\n          roleEntityRef: legacyRoleMeta.roleEntityRef,\n        });\n        await this.roleMetadataStorage.updateRoleMetadata(\n          nonLegacyRole,\n          legacyRoleMeta.roleEntityRef,\n        );\n      }\n    }\n  }\n\n  /**\n   * onChange is called whenever there is a change to the CSV file.\n   * It will parse the current and new contents of the CSV file and process the roles and permission policies present.\n   * Afterwards, it will find the difference between the current and new contents of the CSV file\n   * and sort them into added / removed, permission policies / roles.\n   * It will finally call updatePolicies with the new content.\n   */\n  async onChange(): Promise<void> {\n    const newContent = this.parse();\n\n    const tempEnforcer = await newEnforcer(\n      newModelFromString(MODEL),\n      new LowercaseFileAdapter(this.filePath!),\n    );\n\n    const currentFlatContent = this.currentContent.flatMap(data => {\n      return policyToString(data);\n    });\n    const newFlatContent = newContent.flatMap(data => {\n      return policyToString(data);\n    });\n\n    const diffRemoved = difference(currentFlatContent, newFlatContent); // policy was removed\n    const diffAdded = difference(newFlatContent, currentFlatContent); // policy was added\n\n    await this.migrateLegacyMetadata(tempEnforcer);\n\n    if (diffRemoved.length === 0 && diffAdded.length === 0) {\n      return;\n    }\n\n    diffRemoved.forEach(policy => {\n      const convertedPolicy = metadataStringToPolicy(policy);\n      if (convertedPolicy[0] === 'p') {\n        convertedPolicy.splice(0, 1);\n        this.csvFilePolicies.removedPolicies.push(convertedPolicy);\n      } else if (convertedPolicy[0] === 'g') {\n        convertedPolicy.splice(0, 1);\n        this.csvFilePolicies.removedGroupPolicies.push(convertedPolicy);\n      }\n    });\n\n    diffAdded.forEach(policy => {\n      const convertedPolicy = metadataStringToPolicy(policy);\n      if (convertedPolicy[0] === 'p') {\n        convertedPolicy.splice(0, 1);\n        this.csvFilePolicies.addedPolicies.push(convertedPolicy);\n      } else if (convertedPolicy[0] === 'g') {\n        convertedPolicy.splice(0, 1);\n        this.csvFilePolicies.addedGroupPolicies.push(convertedPolicy);\n      }\n    });\n\n    await this.updatePolicies(newContent, tempEnforcer);\n  }\n\n  /**\n   * updatePolicies is used to update all of the permission policies and roles within a CSV file.\n   * It will check the number of added and removed permissions policies and roles and call the appropriate\n   * methods for these.\n   * It will also update the current contents of the CSV file to the most recent\n   * @param newContent The new content present in the CSV file\n   * @param tempEnforcer Temporary enforcer for checking for duplicates when adding policies\n   */\n  private async updatePolicies(\n    newContent: string[][],\n    tempEnforcer: Enforcer,\n  ): Promise<void> {\n    this.currentContent = newContent;\n\n    if (this.csvFilePolicies.addedPolicies.length > 0)\n      await this.addPermissionPolicies(tempEnforcer);\n    if (this.csvFilePolicies.removedPolicies.length > 0)\n      await this.removePermissionPolicies();\n    if (this.csvFilePolicies.addedGroupPolicies.length > 0)\n      await this.addRoles(tempEnforcer);\n    if (this.csvFilePolicies.removedGroupPolicies.length > 0)\n      await this.removeRoles();\n  }\n\n  /**\n   * addPermissionPolicies will add the new permission policies that are present in the CSV file.\n   * We will attempt to validate the permission policy and log any warnings that are encountered.\n   * If a warning is encountered, we will skip adding the permission policy to the enforcer.\n   * @param tempEnforcer Temporary enforcer for checking for duplicates when adding policies\n   */\n  private async addPermissionPolicies(tempEnforcer: Enforcer): Promise<void> {\n    for (const policy of this.csvFilePolicies.addedPolicies) {\n      const transformedPolicy = transformArrayToPolicy(policy);\n      const metadata = await this.roleMetadataStorage.findRoleMetadata(\n        policy[0],\n      );\n\n      let err = validatePolicy(transformedPolicy);\n      if (err) {\n        this.logger.warn(\n          `Failed to validate policy from file ${this.filePath}. Cause: ${err.message}`,\n        );\n        continue;\n      }\n\n      err = await validateSource('csv-file', metadata);\n      if (err) {\n        this.logger.warn(\n          `Unable to add policy ${policy} from file ${this.filePath}. Cause: ${err.message}`,\n        );\n        continue;\n      }\n\n      err = await checkForDuplicatePolicies(\n        tempEnforcer,\n        policy,\n        this.filePath!,\n      );\n      if (err) {\n        this.logger.warn(err.message);\n        continue;\n      }\n      try {\n        await this.enforcer.addPolicy(policy);\n\n        await this.auditLogger.auditLog<PermissionAuditInfo>({\n          actorId: RBAC_BACKEND,\n          message: `Created policy`,\n          eventName: PermissionEvents.CREATE_POLICY,\n          metadata: { policies: [policy], source: 'csv-file' },\n          stage: HANDLE_RBAC_DATA_STAGE,\n          status: 'succeeded',\n        });\n      } catch (e) {\n        this.logger.warn(\n          `Failed to add or update policy ${policy} after modification ${this.filePath}. Cause: ${e}`,\n        );\n      }\n    }\n\n    this.csvFilePolicies.addedPolicies = [];\n  }\n\n  /**\n   * removePermissionPolicies will remove the permission policies that are no longer present in the CSV file.\n   */\n  private async removePermissionPolicies(): Promise<void> {\n    try {\n      await this.enforcer.removePolicies(this.csvFilePolicies.removedPolicies);\n\n      await this.auditLogger.auditLog<PermissionAuditInfo>({\n        actorId: RBAC_BACKEND,\n        message: `Deleted policies`,\n        eventName: PermissionEvents.DELETE_POLICY,\n        metadata: {\n          policies: this.csvFilePolicies.removedPolicies,\n          source: 'csv-file',\n        },\n        stage: HANDLE_RBAC_DATA_STAGE,\n        status: 'succeeded',\n      });\n    } catch (e) {\n      this.logger.warn(\n        `Failed to remove policies ${JSON.stringify(\n          this.csvFilePolicies.removedPolicies,\n        )} after modification ${this.filePath}. Cause: ${e}`,\n      );\n    }\n    this.csvFilePolicies.removedPolicies = [];\n  }\n\n  /**\n   * addRoles will add the new roles that are present in the CSV file.\n   * We will attempt to validate the role and log any warnings that are encountered.\n   * If a warning is encountered, we will skip adding the role to the enforcer.\n   * @param tempEnforcer Temporary enforcer for checking for duplicates when adding policies\n   */\n  private async addRoles(tempEnforcer: Enforcer): Promise<void> {\n    for (const groupPolicy of this.csvFilePolicies.addedGroupPolicies) {\n      let err = await validateGroupingPolicy(\n        groupPolicy,\n        this.roleMetadataStorage,\n        'csv-file',\n      );\n      if (err) {\n        this.logger.warn(\n          `${err.message}, error originates from file ${this.filePath}`,\n        );\n        continue;\n      }\n\n      err = await checkForDuplicateGroupPolicies(\n        tempEnforcer,\n        groupPolicy,\n        this.filePath!,\n      );\n      if (err) {\n        this.logger.warn(err.message);\n        continue;\n      }\n\n      try {\n        const roleMetadata: RoleMetadataDao = {\n          source: 'csv-file',\n          roleEntityRef: groupPolicy[1],\n          author: CSV_PERMISSION_POLICY_FILE_AUTHOR,\n          modifiedBy: CSV_PERMISSION_POLICY_FILE_AUTHOR,\n        };\n\n        const currentMetadata = await this.roleMetadataStorage.findRoleMetadata(\n          roleMetadata.roleEntityRef,\n        );\n\n        await this.enforcer.addGroupingPolicy(groupPolicy, roleMetadata);\n\n        const eventName = currentMetadata\n          ? RoleEvents.UPDATE_ROLE\n          : RoleEvents.CREATE_ROLE;\n        const message = currentMetadata ? 'Updated role' : 'Created role';\n        await this.auditLogger.auditLog<RoleAuditInfo>({\n          actorId: RBAC_BACKEND,\n          message,\n          eventName,\n          metadata: { ...roleMetadata, members: [groupPolicy[0]] },\n          stage: HANDLE_RBAC_DATA_STAGE,\n          status: 'succeeded',\n        });\n      } catch (e) {\n        this.logger.warn(\n          `Failed to add or update group policy ${groupPolicy} after modification ${this.filePath}. Cause: ${e}`,\n        );\n      }\n    }\n    this.csvFilePolicies.addedGroupPolicies = [];\n  }\n\n  /**\n   * removeRoles will remove the roles that are no longer present in the CSV file.\n   * If the role exists with multiple groups and or users, we will update it role information.\n   * Otherwise, we will remove the role completely.\n   */\n  private async removeRoles(): Promise<void> {\n    for (const groupPolicy of this.csvFilePolicies.removedGroupPolicies) {\n      const roleEntityRef = groupPolicy[1];\n      // this requires knowledge of whether or not it is an update\n      const isUpdate = await this.enforcer.getFilteredGroupingPolicy(\n        1,\n        roleEntityRef,\n      );\n\n      // Need to update the time\n      try {\n        const metadata: RoleMetadataDao = {\n          source: 'csv-file',\n          roleEntityRef,\n          author: CSV_PERMISSION_POLICY_FILE_AUTHOR,\n          modifiedBy: CSV_PERMISSION_POLICY_FILE_AUTHOR,\n        };\n\n        await this.enforcer.removeGroupingPolicy(\n          groupPolicy,\n          metadata,\n          isUpdate.length > 1,\n        );\n\n        const isRolePresent =\n          await this.roleMetadataStorage.findRoleMetadata(roleEntityRef);\n        const eventName = isRolePresent\n          ? RoleEvents.UPDATE_ROLE\n          : RoleEvents.DELETE_ROLE;\n        const message = isRolePresent\n          ? 'Updated role: deleted members'\n          : 'Deleted role';\n        await this.auditLogger.auditLog<RoleAuditInfo>({\n          actorId: RBAC_BACKEND,\n          message,\n          eventName,\n          metadata: { ...metadata, members: [groupPolicy[0]] },\n          stage: HANDLE_RBAC_DATA_STAGE,\n          status: 'succeeded',\n        });\n      } catch (e) {\n        this.logger.warn(\n          `Failed to remove group policy ${groupPolicy} after modification ${this.filePath}. Cause: ${e}`,\n        );\n      }\n    }\n    this.csvFilePolicies.removedGroupPolicies = [];\n  }\n\n  async cleanUpRolesAndPolicies(): Promise<void> {\n    const roleMetadatas =\n      await this.roleMetadataStorage.filterRoleMetadata('csv-file');\n    const fileRoles = roleMetadatas.map(meta => meta.roleEntityRef);\n\n    if (fileRoles.length > 0) {\n      for (const fileRole of fileRoles) {\n        this.csvFilePolicies.removedGroupPolicies.push(\n          ...(await this.enforcer.getFilteredGroupingPolicy(1, fileRole)),\n        );\n        this.csvFilePolicies.removedPolicies.push(\n          ...(await this.enforcer.getFilteredPolicy(0, fileRole)),\n        );\n      }\n    }\n    await this.removePermissionPolicies();\n    await this.removeRoles();\n  }\n}\n"],"names":["AbstractFileWatcher","parse","transformPolicyGroupToLowercase","newEnforcer","newModelFromString","MODEL","LowercaseFileAdapter","mergeRoleMetadata","policyToString","difference","metadataStringToPolicy","transformArrayToPolicy","validatePolicy","validateSource","checkForDuplicatePolicies","RBAC_BACKEND","PermissionEvents","HANDLE_RBAC_DATA_STAGE","validateGroupingPolicy","checkForDuplicateGroupPolicies","RoleEvents"],"mappings":";;;;;;;;;;;;AAqDO,MAAM,iCAAoC,GAAA;AAS1C,MAAM,uBAAuBA,+BAAgC,CAAA;AAAA,EAIlE,YACE,QACA,EAAA,WAAA,EACA,MACiB,EAAA,QAAA,EACA,qBACA,WACjB,EAAA;AACA,IAAM,KAAA,CAAA,QAAA,EAAU,aAAa,MAAM,CAAA;AAJlB,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AACA,IAAA,IAAA,CAAA,mBAAA,GAAA,mBAAA;AACA,IAAA,IAAA,CAAA,WAAA,GAAA,WAAA;AAGjB,IAAA,IAAA,CAAK,iBAAiB,EAAC;AACvB,IAAA,IAAA,CAAK,eAAkB,GAAA;AAAA,MACrB,eAAe,EAAC;AAAA,MAChB,oBAAoB,EAAC;AAAA,MACrB,iBAAiB,EAAC;AAAA,MAClB,sBAAsB;AAAC,KACzB;AAAA;AACF,EAnBQ,cAAA;AAAA,EACA,eAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAwBR,KAAoB,GAAA;AAClB,IAAM,MAAA,OAAA,GAAU,KAAK,kBAAmB,EAAA;AACxC,IAAM,MAAA,IAAA,GAAOC,WAAM,OAAS,EAAA;AAAA,MAC1B,gBAAkB,EAAA,IAAA;AAAA,MAClB,kBAAoB,EAAA,IAAA;AAAA,MACpB,IAAM,EAAA;AAAA,KACP,CAAA;AAED,IAAA,KAAA,MAAW,UAAU,IAAM,EAAA;AACzB,MAAAC,sCAAA,CAAgC,MAAM,CAAA;AAAA;AAGxC,IAAO,OAAA,IAAA;AAAA;AACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,UAA4B,GAAA;AAChC,IAAI,IAAA,CAAC,KAAK,QAAU,EAAA;AAClB,MAAA;AAAA;AAEF,IAAA,IAAI,UAAsB,EAAC;AAE3B,IAAA,OAAA,GAAU,KAAK,KAAM,EAAA;AAErB,IAAA,MAAM,eAAe,MAAMC,kBAAA;AAAA,MACzBC,0BAAmBC,qBAAK,CAAA;AAAA,MACxB,IAAIC,yCAAqB,CAAA,IAAA,CAAK,QAAQ;AAAA,KACxC;AAGA,IAAA,MAAM,KAAK,uBAAwB,EAAA;AAInC,IAAM,MAAA,aAAA,GAAgB,MAAM,YAAA,CAAa,SAAU,EAAA;AACnD,IAAM,MAAA,kBAAA,GAAqB,MAAM,YAAA,CAAa,iBAAkB,EAAA;AAEhE,IAAA,KAAA,MAAW,UAAU,aAAe,EAAA;AAClC,MAAA,IAAI,CAAE,MAAM,IAAA,CAAK,SAAS,SAAU,CAAA,GAAG,MAAM,CAAI,EAAA;AAC/C,QAAK,IAAA,CAAA,eAAA,CAAgB,aAAc,CAAA,IAAA,CAAK,MAAM,CAAA;AAAA;AAChD;AAGF,IAAA,KAAA,MAAW,eAAe,kBAAoB,EAAA;AAC5C,MAAA,IAAI,CAAE,MAAM,IAAA,CAAK,SAAS,iBAAkB,CAAA,GAAG,WAAW,CAAI,EAAA;AAC5D,QAAK,IAAA,CAAA,eAAA,CAAgB,kBAAmB,CAAA,IAAA,CAAK,WAAW,CAAA;AAAA;AAC1D;AAGF,IAAM,MAAA,IAAA,CAAK,sBAAsB,YAAY,CAAA;AAG7C,IAAM,MAAA,IAAA,CAAK,cAAe,CAAA,OAAA,EAAS,YAAY,CAAA;AAE/C,IAAA,IAAI,KAAK,WAAa,EAAA;AACpB,MAAA,IAAA,CAAK,SAAU,EAAA;AAAA;AACjB;AACF;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,sBAAsB,YAAwB,EAAA;AAC1D,IAAA,IAAI,mBACF,GAAA,MAAM,IAAK,CAAA,mBAAA,CAAoB,mBAAmB,QAAQ,CAAA;AAC5D,IAAA,MAAM,WAAc,GAAA,mBAAA,CAAoB,GAAI,CAAA,CAAA,IAAA,KAAQ,KAAK,aAAa,CAAA;AACtE,IAAI,IAAA,WAAA,CAAY,SAAS,CAAG,EAAA;AAC1B,MAAM,MAAA,mBAAA,GAAsB,MAAM,YAAa,CAAA,yBAAA;AAAA,QAC7C,CAAA;AAAA,QACA,GAAG;AAAA,OACL;AACA,MAAM,MAAA,cAAA,GAAiB,MAAM,YAAa,CAAA,iBAAA;AAAA,QACxC,CAAA;AAAA,QACA,GAAG;AAAA,OACL;AACA,MAAM,MAAA,mBAAA,uBAA0B,GAAI,CAAA;AAAA,QAClC,GAAG,mBAAoB,CAAA,GAAA,CAAI,CAAM,EAAA,KAAA,EAAA,CAAG,CAAC,CAAC,CAAA;AAAA,QACtC,GAAG,cAAe,CAAA,GAAA,CAAI,CAAK,CAAA,KAAA,CAAA,CAAE,CAAC,CAAC;AAAA,OAChC,CAAA;AACD,MAAA,mBAAA,GAAsB,mBAAoB,CAAA,MAAA;AAAA,QAAO,CAC/C,IAAA,KAAA,mBAAA,CAAoB,GAAI,CAAA,IAAA,CAAK,aAAa;AAAA,OAC5C;AACA,MAAA,KAAA,MAAW,kBAAkB,mBAAqB,EAAA;AAChD,QAAM,MAAA,aAAA,GAAgBC,yBAAkB,cAAgB,EAAA;AAAA,UACtD,UAAY,EAAA,iCAAA;AAAA,UACZ,MAAQ,EAAA,UAAA;AAAA,UACR,eAAe,cAAe,CAAA;AAAA,SAC/B,CAAA;AACD,QAAA,MAAM,KAAK,mBAAoB,CAAA,kBAAA;AAAA,UAC7B,aAAA;AAAA,UACA,cAAe,CAAA;AAAA,SACjB;AAAA;AACF;AACF;AACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,QAA0B,GAAA;AAC9B,IAAM,MAAA,UAAA,GAAa,KAAK,KAAM,EAAA;AAE9B,IAAA,MAAM,eAAe,MAAMJ,kBAAA;AAAA,MACzBC,0BAAmBC,qBAAK,CAAA;AAAA,MACxB,IAAIC,yCAAqB,CAAA,IAAA,CAAK,QAAS;AAAA,KACzC;AAEA,IAAA,MAAM,kBAAqB,GAAA,IAAA,CAAK,cAAe,CAAA,OAAA,CAAQ,CAAQ,IAAA,KAAA;AAC7D,MAAA,OAAOE,sBAAe,IAAI,CAAA;AAAA,KAC3B,CAAA;AACD,IAAM,MAAA,cAAA,GAAiB,UAAW,CAAA,OAAA,CAAQ,CAAQ,IAAA,KAAA;AAChD,MAAA,OAAOA,sBAAe,IAAI,CAAA;AAAA,KAC3B,CAAA;AAED,IAAM,MAAA,WAAA,GAAcC,iBAAW,CAAA,kBAAA,EAAoB,cAAc,CAAA;AACjE,IAAM,MAAA,SAAA,GAAYA,iBAAW,CAAA,cAAA,EAAgB,kBAAkB,CAAA;AAE/D,IAAM,MAAA,IAAA,CAAK,sBAAsB,YAAY,CAAA;AAE7C,IAAA,IAAI,WAAY,CAAA,MAAA,KAAW,CAAK,IAAA,SAAA,CAAU,WAAW,CAAG,EAAA;AACtD,MAAA;AAAA;AAGF,IAAA,WAAA,CAAY,QAAQ,CAAU,MAAA,KAAA;AAC5B,MAAM,MAAA,eAAA,GAAkBC,8BAAuB,MAAM,CAAA;AACrD,MAAI,IAAA,eAAA,CAAgB,CAAC,CAAA,KAAM,GAAK,EAAA;AAC9B,QAAgB,eAAA,CAAA,MAAA,CAAO,GAAG,CAAC,CAAA;AAC3B,QAAK,IAAA,CAAA,eAAA,CAAgB,eAAgB,CAAA,IAAA,CAAK,eAAe,CAAA;AAAA,OAChD,MAAA,IAAA,eAAA,CAAgB,CAAC,CAAA,KAAM,GAAK,EAAA;AACrC,QAAgB,eAAA,CAAA,MAAA,CAAO,GAAG,CAAC,CAAA;AAC3B,QAAK,IAAA,CAAA,eAAA,CAAgB,oBAAqB,CAAA,IAAA,CAAK,eAAe,CAAA;AAAA;AAChE,KACD,CAAA;AAED,IAAA,SAAA,CAAU,QAAQ,CAAU,MAAA,KAAA;AAC1B,MAAM,MAAA,eAAA,GAAkBA,8BAAuB,MAAM,CAAA;AACrD,MAAI,IAAA,eAAA,CAAgB,CAAC,CAAA,KAAM,GAAK,EAAA;AAC9B,QAAgB,eAAA,CAAA,MAAA,CAAO,GAAG,CAAC,CAAA;AAC3B,QAAK,IAAA,CAAA,eAAA,CAAgB,aAAc,CAAA,IAAA,CAAK,eAAe,CAAA;AAAA,OAC9C,MAAA,IAAA,eAAA,CAAgB,CAAC,CAAA,KAAM,GAAK,EAAA;AACrC,QAAgB,eAAA,CAAA,MAAA,CAAO,GAAG,CAAC,CAAA;AAC3B,QAAK,IAAA,CAAA,eAAA,CAAgB,kBAAmB,CAAA,IAAA,CAAK,eAAe,CAAA;AAAA;AAC9D,KACD,CAAA;AAED,IAAM,MAAA,IAAA,CAAK,cAAe,CAAA,UAAA,EAAY,YAAY,CAAA;AAAA;AACpD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAc,cACZ,CAAA,UAAA,EACA,YACe,EAAA;AACf,IAAA,IAAA,CAAK,cAAiB,GAAA,UAAA;AAEtB,IAAI,IAAA,IAAA,CAAK,eAAgB,CAAA,aAAA,CAAc,MAAS,GAAA,CAAA;AAC9C,MAAM,MAAA,IAAA,CAAK,sBAAsB,YAAY,CAAA;AAC/C,IAAI,IAAA,IAAA,CAAK,eAAgB,CAAA,eAAA,CAAgB,MAAS,GAAA,CAAA;AAChD,MAAA,MAAM,KAAK,wBAAyB,EAAA;AACtC,IAAI,IAAA,IAAA,CAAK,eAAgB,CAAA,kBAAA,CAAmB,MAAS,GAAA,CAAA;AACnD,MAAM,MAAA,IAAA,CAAK,SAAS,YAAY,CAAA;AAClC,IAAI,IAAA,IAAA,CAAK,eAAgB,CAAA,oBAAA,CAAqB,MAAS,GAAA,CAAA;AACrD,MAAA,MAAM,KAAK,WAAY,EAAA;AAAA;AAC3B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAc,sBAAsB,YAAuC,EAAA;AACzE,IAAW,KAAA,MAAA,MAAA,IAAU,IAAK,CAAA,eAAA,CAAgB,aAAe,EAAA;AACvD,MAAM,MAAA,iBAAA,GAAoBC,8BAAuB,MAAM,CAAA;AACvD,MAAM,MAAA,QAAA,GAAW,MAAM,IAAA,CAAK,mBAAoB,CAAA,gBAAA;AAAA,QAC9C,OAAO,CAAC;AAAA,OACV;AAEA,MAAI,IAAA,GAAA,GAAMC,kCAAe,iBAAiB,CAAA;AAC1C,MAAA,IAAI,GAAK,EAAA;AACP,QAAA,IAAA,CAAK,MAAO,CAAA,IAAA;AAAA,UACV,CAAuC,oCAAA,EAAA,IAAA,CAAK,QAAQ,CAAA,SAAA,EAAY,IAAI,OAAO,CAAA;AAAA,SAC7E;AACA,QAAA;AAAA;AAGF,MAAM,GAAA,GAAA,MAAMC,iCAAe,CAAA,UAAA,EAAY,QAAQ,CAAA;AAC/C,MAAA,IAAI,GAAK,EAAA;AACP,QAAA,IAAA,CAAK,MAAO,CAAA,IAAA;AAAA,UACV,wBAAwB,MAAM,CAAA,WAAA,EAAc,KAAK,QAAQ,CAAA,SAAA,EAAY,IAAI,OAAO,CAAA;AAAA,SAClF;AACA,QAAA;AAAA;AAGF,MAAA,GAAA,GAAM,MAAMC,4CAAA;AAAA,QACV,YAAA;AAAA,QACA,MAAA;AAAA,QACA,IAAK,CAAA;AAAA,OACP;AACA,MAAA,IAAI,GAAK,EAAA;AACP,QAAK,IAAA,CAAA,MAAA,CAAO,IAAK,CAAA,GAAA,CAAI,OAAO,CAAA;AAC5B,QAAA;AAAA;AAEF,MAAI,IAAA;AACF,QAAM,MAAA,IAAA,CAAK,QAAS,CAAA,SAAA,CAAU,MAAM,CAAA;AAEpC,QAAM,MAAA,IAAA,CAAK,YAAY,QAA8B,CAAA;AAAA,UACnD,OAAS,EAAAC,wBAAA;AAAA,UACT,OAAS,EAAA,CAAA,cAAA,CAAA;AAAA,UACT,WAAWC,4BAAiB,CAAA,aAAA;AAAA,UAC5B,UAAU,EAAE,QAAA,EAAU,CAAC,MAAM,CAAA,EAAG,QAAQ,UAAW,EAAA;AAAA,UACnD,KAAO,EAAAC,kCAAA;AAAA,UACP,MAAQ,EAAA;AAAA,SACT,CAAA;AAAA,eACM,CAAG,EAAA;AACV,QAAA,IAAA,CAAK,MAAO,CAAA,IAAA;AAAA,UACV,kCAAkC,MAAM,CAAA,oBAAA,EAAuB,IAAK,CAAA,QAAQ,YAAY,CAAC,CAAA;AAAA,SAC3F;AAAA;AACF;AAGF,IAAK,IAAA,CAAA,eAAA,CAAgB,gBAAgB,EAAC;AAAA;AACxC;AAAA;AAAA;AAAA,EAKA,MAAc,wBAA0C,GAAA;AACtD,IAAI,IAAA;AACF,MAAA,MAAM,IAAK,CAAA,QAAA,CAAS,cAAe,CAAA,IAAA,CAAK,gBAAgB,eAAe,CAAA;AAEvE,MAAM,MAAA,IAAA,CAAK,YAAY,QAA8B,CAAA;AAAA,QACnD,OAAS,EAAAF,wBAAA;AAAA,QACT,OAAS,EAAA,CAAA,gBAAA,CAAA;AAAA,QACT,WAAWC,4BAAiB,CAAA,aAAA;AAAA,QAC5B,QAAU,EAAA;AAAA,UACR,QAAA,EAAU,KAAK,eAAgB,CAAA,eAAA;AAAA,UAC/B,MAAQ,EAAA;AAAA,SACV;AAAA,QACA,KAAO,EAAAC,kCAAA;AAAA,QACP,MAAQ,EAAA;AAAA,OACT,CAAA;AAAA,aACM,CAAG,EAAA;AACV,MAAA,IAAA,CAAK,MAAO,CAAA,IAAA;AAAA,QACV,6BAA6B,IAAK,CAAA,SAAA;AAAA,UAChC,KAAK,eAAgB,CAAA;AAAA,SACtB,CAAA,oBAAA,EAAuB,IAAK,CAAA,QAAQ,YAAY,CAAC,CAAA;AAAA,OACpD;AAAA;AAEF,IAAK,IAAA,CAAA,eAAA,CAAgB,kBAAkB,EAAC;AAAA;AAC1C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAc,SAAS,YAAuC,EAAA;AAC5D,IAAW,KAAA,MAAA,WAAA,IAAe,IAAK,CAAA,eAAA,CAAgB,kBAAoB,EAAA;AACjE,MAAA,IAAI,MAAM,MAAMC,yCAAA;AAAA,QACd,WAAA;AAAA,QACA,IAAK,CAAA,mBAAA;AAAA,QACL;AAAA,OACF;AACA,MAAA,IAAI,GAAK,EAAA;AACP,QAAA,IAAA,CAAK,MAAO,CAAA,IAAA;AAAA,UACV,CAAG,EAAA,GAAA,CAAI,OAAO,CAAA,6BAAA,EAAgC,KAAK,QAAQ,CAAA;AAAA,SAC7D;AACA,QAAA;AAAA;AAGF,MAAA,GAAA,GAAM,MAAMC,iDAAA;AAAA,QACV,YAAA;AAAA,QACA,WAAA;AAAA,QACA,IAAK,CAAA;AAAA,OACP;AACA,MAAA,IAAI,GAAK,EAAA;AACP,QAAK,IAAA,CAAA,MAAA,CAAO,IAAK,CAAA,GAAA,CAAI,OAAO,CAAA;AAC5B,QAAA;AAAA;AAGF,MAAI,IAAA;AACF,QAAA,MAAM,YAAgC,GAAA;AAAA,UACpC,MAAQ,EAAA,UAAA;AAAA,UACR,aAAA,EAAe,YAAY,CAAC,CAAA;AAAA,UAC5B,MAAQ,EAAA,iCAAA;AAAA,UACR,UAAY,EAAA;AAAA,SACd;AAEA,QAAM,MAAA,eAAA,GAAkB,MAAM,IAAA,CAAK,mBAAoB,CAAA,gBAAA;AAAA,UACrD,YAAa,CAAA;AAAA,SACf;AAEA,QAAA,MAAM,IAAK,CAAA,QAAA,CAAS,iBAAkB,CAAA,WAAA,EAAa,YAAY,CAAA;AAE/D,QAAA,MAAM,SAAY,GAAA,eAAA,GACdC,sBAAW,CAAA,WAAA,GACXA,sBAAW,CAAA,WAAA;AACf,QAAM,MAAA,OAAA,GAAU,kBAAkB,cAAiB,GAAA,cAAA;AACnD,QAAM,MAAA,IAAA,CAAK,YAAY,QAAwB,CAAA;AAAA,UAC7C,OAAS,EAAAL,wBAAA;AAAA,UACT,OAAA;AAAA,UACA,SAAA;AAAA,UACA,QAAA,EAAU,EAAE,GAAG,YAAA,EAAc,SAAS,CAAC,WAAA,CAAY,CAAC,CAAC,CAAE,EAAA;AAAA,UACvD,KAAO,EAAAE,kCAAA;AAAA,UACP,MAAQ,EAAA;AAAA,SACT,CAAA;AAAA,eACM,CAAG,EAAA;AACV,QAAA,IAAA,CAAK,MAAO,CAAA,IAAA;AAAA,UACV,wCAAwC,WAAW,CAAA,oBAAA,EAAuB,IAAK,CAAA,QAAQ,YAAY,CAAC,CAAA;AAAA,SACtG;AAAA;AACF;AAEF,IAAK,IAAA,CAAA,eAAA,CAAgB,qBAAqB,EAAC;AAAA;AAC7C;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAc,WAA6B,GAAA;AACzC,IAAW,KAAA,MAAA,WAAA,IAAe,IAAK,CAAA,eAAA,CAAgB,oBAAsB,EAAA;AACnE,MAAM,MAAA,aAAA,GAAgB,YAAY,CAAC,CAAA;AAEnC,MAAM,MAAA,QAAA,GAAW,MAAM,IAAA,CAAK,QAAS,CAAA,yBAAA;AAAA,QACnC,CAAA;AAAA,QACA;AAAA,OACF;AAGA,MAAI,IAAA;AACF,QAAA,MAAM,QAA4B,GAAA;AAAA,UAChC,MAAQ,EAAA,UAAA;AAAA,UACR,aAAA;AAAA,UACA,MAAQ,EAAA,iCAAA;AAAA,UACR,UAAY,EAAA;AAAA,SACd;AAEA,QAAA,MAAM,KAAK,QAAS,CAAA,oBAAA;AAAA,UAClB,WAAA;AAAA,UACA,QAAA;AAAA,UACA,SAAS,MAAS,GAAA;AAAA,SACpB;AAEA,QAAA,MAAM,aACJ,GAAA,MAAM,IAAK,CAAA,mBAAA,CAAoB,iBAAiB,aAAa,CAAA;AAC/D,QAAA,MAAM,SAAY,GAAA,aAAA,GACdG,sBAAW,CAAA,WAAA,GACXA,sBAAW,CAAA,WAAA;AACf,QAAM,MAAA,OAAA,GAAU,gBACZ,+BACA,GAAA,cAAA;AACJ,QAAM,MAAA,IAAA,CAAK,YAAY,QAAwB,CAAA;AAAA,UAC7C,OAAS,EAAAL,wBAAA;AAAA,UACT,OAAA;AAAA,UACA,SAAA;AAAA,UACA,QAAA,EAAU,EAAE,GAAG,QAAA,EAAU,SAAS,CAAC,WAAA,CAAY,CAAC,CAAC,CAAE,EAAA;AAAA,UACnD,KAAO,EAAAE,kCAAA;AAAA,UACP,MAAQ,EAAA;AAAA,SACT,CAAA;AAAA,eACM,CAAG,EAAA;AACV,QAAA,IAAA,CAAK,MAAO,CAAA,IAAA;AAAA,UACV,iCAAiC,WAAW,CAAA,oBAAA,EAAuB,IAAK,CAAA,QAAQ,YAAY,CAAC,CAAA;AAAA,SAC/F;AAAA;AACF;AAEF,IAAK,IAAA,CAAA,eAAA,CAAgB,uBAAuB,EAAC;AAAA;AAC/C,EAEA,MAAM,uBAAyC,GAAA;AAC7C,IAAA,MAAM,aACJ,GAAA,MAAM,IAAK,CAAA,mBAAA,CAAoB,mBAAmB,UAAU,CAAA;AAC9D,IAAA,MAAM,SAAY,GAAA,aAAA,CAAc,GAAI,CAAA,CAAA,IAAA,KAAQ,KAAK,aAAa,CAAA;AAE9D,IAAI,IAAA,SAAA,CAAU,SAAS,CAAG,EAAA;AACxB,MAAA,KAAA,MAAW,YAAY,SAAW,EAAA;AAChC,QAAA,IAAA,CAAK,gBAAgB,oBAAqB,CAAA,IAAA;AAAA,UACxC,GAAI,MAAM,IAAA,CAAK,QAAS,CAAA,yBAAA,CAA0B,GAAG,QAAQ;AAAA,SAC/D;AACA,QAAA,IAAA,CAAK,gBAAgB,eAAgB,CAAA,IAAA;AAAA,UACnC,GAAI,MAAM,IAAA,CAAK,QAAS,CAAA,iBAAA,CAAkB,GAAG,QAAQ;AAAA,SACvD;AAAA;AACF;AAEF,IAAA,MAAM,KAAK,wBAAyB,EAAA;AACpC,IAAA,MAAM,KAAK,WAAY,EAAA;AAAA;AAE3B;;;;;"}

package/dist/file-permissions/lowercase-file-adapter.cjs.js

@@ -0,0 +1,36 @@
+'use strict';
+
+var casbin = require('casbin');
+
+class LowercaseFileAdapter extends casbin.FileAdapter {
+  async loadPolicy(model) {
+    if (!this.filePath) {
+      return;
+    }
+    await this.loadLowercasePolicyFile(model, casbin.Helper.loadPolicyLine);
+  }
+  transformLineToLowercaseGroupsUsers(line) {
+    if (line.trim().startsWith("g")) {
+      const policyArray = line.split(",");
+      if (policyArray.length >= 1 && policyArray[0].trim().startsWith("g")) {
+        policyArray[1] = policyArray[1].toLocaleLowerCase("en-US");
+      }
+      return policyArray.join(",");
+    }
+    return line;
+  }
+  async loadLowercasePolicyFile(model, handler) {
+    const bodyBuf = await (this.fs ? this.fs : casbin.mustGetDefaultFileSystem()).readFileSync(this.filePath);
+    const lines = bodyBuf.toString().split("\n");
+    lines.forEach((line) => {
+      if (!line) {
+        return;
+      }
+      const lowercasedLine = this.transformLineToLowercaseGroupsUsers(line);
+      handler(lowercasedLine, model);
+    });
+  }
+}
+
+exports.LowercaseFileAdapter = LowercaseFileAdapter;
+//# sourceMappingURL=lowercase-file-adapter.cjs.js.map

package/dist/file-permissions/lowercase-file-adapter.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lowercase-file-adapter.cjs.js","sources":["../../src/file-permissions/lowercase-file-adapter.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { FileAdapter, Helper, Model, mustGetDefaultFileSystem } from 'casbin';\n\nexport class LowercaseFileAdapter extends FileAdapter {\n  public async loadPolicy(model: Model): Promise<void> {\n    if (!this.filePath) {\n      return;\n    }\n    await this.loadLowercasePolicyFile(model, Helper.loadPolicyLine);\n  }\n\n  private transformLineToLowercaseGroupsUsers(line: string): string {\n    if (line.trim().startsWith('g')) {\n      const policyArray = line.split(',');\n      if (policyArray.length >= 1 && policyArray[0].trim().startsWith('g')) {\n        policyArray[1] = policyArray[1].toLocaleLowerCase('en-US');\n      }\n      return policyArray.join(',');\n    }\n    return line;\n  }\n\n  private async loadLowercasePolicyFile(\n    model: Model,\n    handler: (line: string, model: Model) => void,\n  ): Promise<void> {\n    // Reference: https://github.com/casbin/node-casbin/blob/master/src/persist/fileAdapter.ts#L34-#L43\n    const bodyBuf = await (\n      this.fs ? this.fs : mustGetDefaultFileSystem()\n    ).readFileSync(this.filePath);\n    const lines = bodyBuf.toString().split('\\n');\n\n    lines.forEach((line: string) => {\n      if (!line) {\n        return;\n      }\n      const lowercasedLine = this.transformLineToLowercaseGroupsUsers(line);\n      handler(lowercasedLine, model);\n    });\n  }\n}\n"],"names":["FileAdapter","Helper","mustGetDefaultFileSystem"],"mappings":";;;;AAiBO,MAAM,6BAA6BA,kBAAY,CAAA;AAAA,EACpD,MAAa,WAAW,KAA6B,EAAA;AACnD,IAAI,IAAA,CAAC,KAAK,QAAU,EAAA;AAClB,MAAA;AAAA;AAEF,IAAA,MAAM,IAAK,CAAA,uBAAA,CAAwB,KAAO,EAAAC,aAAA,CAAO,cAAc,CAAA;AAAA;AACjE,EAEQ,oCAAoC,IAAsB,EAAA;AAChE,IAAA,IAAI,IAAK,CAAA,IAAA,EAAO,CAAA,UAAA,CAAW,GAAG,CAAG,EAAA;AAC/B,MAAM,MAAA,WAAA,GAAc,IAAK,CAAA,KAAA,CAAM,GAAG,CAAA;AAClC,MAAI,IAAA,WAAA,CAAY,MAAU,IAAA,CAAA,IAAK,WAAY,CAAA,CAAC,EAAE,IAAK,EAAA,CAAE,UAAW,CAAA,GAAG,CAAG,EAAA;AACpE,QAAA,WAAA,CAAY,CAAC,CAAI,GAAA,WAAA,CAAY,CAAC,CAAA,CAAE,kBAAkB,OAAO,CAAA;AAAA;AAE3D,MAAO,OAAA,WAAA,CAAY,KAAK,GAAG,CAAA;AAAA;AAE7B,IAAO,OAAA,IAAA;AAAA;AACT,EAEA,MAAc,uBACZ,CAAA,KAAA,EACA,OACe,EAAA;AAEf,IAAM,MAAA,OAAA,GAAU,MACd,CAAA,IAAA,CAAK,EAAK,GAAA,IAAA,CAAK,KAAKC,+BAAyB,EAAA,EAC7C,YAAa,CAAA,IAAA,CAAK,QAAQ,CAAA;AAC5B,IAAA,MAAM,KAAQ,GAAA,OAAA,CAAQ,QAAS,EAAA,CAAE,MAAM,IAAI,CAAA;AAE3C,IAAM,KAAA,CAAA,OAAA,CAAQ,CAAC,IAAiB,KAAA;AAC9B,MAAA,IAAI,CAAC,IAAM,EAAA;AACT,QAAA;AAAA;AAEF,MAAM,MAAA,cAAA,GAAiB,IAAK,CAAA,mCAAA,CAAoC,IAAI,CAAA;AACpE,MAAA,OAAA,CAAQ,gBAAgB,KAAK,CAAA;AAAA,KAC9B,CAAA;AAAA;AAEL;;;;"}

package/dist/helper.cjs.js

@@ -59,6 +59,16 @@ function transformArrayToPolicy(policyArray) {
   const [entityReference, permission, policy, effect] = policyArray;
   return { entityReference, permission, policy, effect };
 }
+function transformPolicyGroupToLowercase(policyArray) {
+  if (policyArray.length > 1 && policyArray[0].startsWith("g") && (policyArray[1].startsWith("user") || policyArray[1].startsWith("group"))) {
+    policyArray[1] = policyArray[1].toLocaleLowerCase("en-US");
+  }
+}
+function transformRolesGroupToLowercase(roles) {
+  return roles.map(
+    (role) => role.length >= 1 ? [role[0].toLocaleLowerCase("en-US"), ...role.slice(1)] : role
+  );
+}
 function deepSortedEqual(obj1, obj2, excludeFields) {
   let copyObj1;
   let copyObj2;
@@ -166,6 +176,8 @@ exports.policyToString = policyToString;
 exports.processConditionMapping = processConditionMapping;
 exports.removeTheDifference = removeTheDifference;
 exports.transformArrayToPolicy = transformArrayToPolicy;
+exports.transformPolicyGroupToLowercase = transformPolicyGroupToLowercase;
+exports.transformRolesGroupToLowercase = transformRolesGroupToLowercase;
 exports.typedPoliciesToString = typedPoliciesToString;
 exports.typedPolicyToString = typedPolicyToString;
 //# sourceMappingURL=helper.cjs.js.map

package/dist/helper.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"helper.cjs.js","sources":["../src/helper.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { AuthService } from '@backstage/backend-plugin-api';\nimport type { MetadataResponse } from '@backstage/plugin-permission-node';\n\nimport { AuditLogger } from '@janus-idp/backstage-plugin-audit-log-node';\nimport {\n  difference,\n  fromPairs,\n  isArray,\n  isEqual,\n  isPlainObject,\n  omitBy,\n  sortBy,\n  toPairs,\n  ValueKeyIteratee,\n} from 'lodash';\n\nimport {\n  PermissionAction,\n  PermissionInfo,\n  RoleBasedPolicy,\n  RoleConditionalPolicyDecision,\n  Source,\n} from '@backstage-community/plugin-rbac-common';\n\nimport {\n  HANDLE_RBAC_DATA_STAGE,\n  RBAC_BACKEND,\n  RoleAuditInfo,\n  RoleEvents,\n} from './audit-log/audit-logger';\nimport { RoleMetadataDao, RoleMetadataStorage } from './database/role-metadata';\nimport { EnforcerDelegate } from './service/enforcer-delegate';\nimport { PluginPermissionMetadataCollector } from './service/plugin-endpoints';\n\nexport function policyToString(policy: string[]): string {\n  return `[${policy.join(', ')}]`;\n}\n\nexport function typedPolicyToString(policy: string[], type: string): string {\n  return `${type}, ${policy.join(', ')}`;\n}\n\nexport function policiesToString(policies: string[][]): string {\n  const policiesString = policies\n    .map(policy => policyToString(policy))\n    .join(',');\n  return `[${policiesString}]`;\n}\n\nexport function typedPoliciesToString(\n  policies: string[][],\n  type: string,\n): string {\n  const policiesString = policies\n    .map(policy => {\n      return policy.length !== 0 ? typedPolicyToString(policy, type) : '';\n    })\n    .join('\\n');\n  return `\n    ${policiesString}\n  `;\n}\n\nexport function metadataStringToPolicy(policy: string): string[] {\n  return policy.replace('[', '').replace(']', '').split(', ');\n}\n\nexport async function removeTheDifference(\n  originalGroup: string[],\n  addedGroup: string[],\n  source: Source,\n  roleEntityRef: string,\n  enf: EnforcerDelegate,\n  auditLogger: AuditLogger,\n  modifiedBy: string,\n): Promise<void> {\n  originalGroup.sort((a, b) => a.localeCompare(b));\n  addedGroup.sort((a, b) => a.localeCompare(b));\n  const missing = difference(originalGroup, addedGroup);\n\n  const groupPolicies: string[][] = [];\n  for (const missingRole of missing) {\n    groupPolicies.push([missingRole, roleEntityRef]);\n  }\n\n  if (groupPolicies.length === 0) {\n    return;\n  }\n\n  const roleMetadata = { source, modifiedBy, roleEntityRef };\n  await enf.removeGroupingPolicies(groupPolicies, roleMetadata, false);\n\n  const remainingMembers = await enf.getFilteredGroupingPolicy(\n    1,\n    roleEntityRef,\n  );\n  const message =\n    remainingMembers.length > 0\n      ? 'Updated role: deleted members'\n      : 'Deleted role';\n  const eventName =\n    remainingMembers.length > 0\n      ? RoleEvents.UPDATE_ROLE\n      : RoleEvents.DELETE_ROLE;\n  await auditLogger.auditLog<RoleAuditInfo>({\n    actorId: RBAC_BACKEND,\n    message,\n    eventName,\n    metadata: {\n      ...roleMetadata,\n      members: groupPolicies.map(gp => gp[0]),\n    },\n    stage: HANDLE_RBAC_DATA_STAGE,\n    status: 'succeeded',\n  });\n}\n\nexport function transformArrayToPolicy(policyArray: string[]): RoleBasedPolicy {\n  const [entityReference, permission, policy, effect] = policyArray;\n  return { entityReference, permission, policy, effect };\n}\n\nexport function deepSortedEqual(\n  obj1: Record<string, any>,\n  obj2: Record<string, any>,\n  excludeFields?: string[],\n): boolean {\n  let copyObj1;\n  let copyObj2;\n  if (excludeFields) {\n    const excludeFieldsPredicate: ValueKeyIteratee<any> = (_value, key) => {\n      for (const field of excludeFields) {\n        if (key === field) {\n          return true;\n        }\n      }\n      return false;\n    };\n    copyObj1 = omitBy(obj1, excludeFieldsPredicate);\n    copyObj2 = omitBy(obj2, excludeFieldsPredicate);\n  }\n\n  const sortedObj1 = sortBy(toPairs(copyObj1 || obj1), ([key]) => key);\n  const sortedObj2 = sortBy(toPairs(copyObj2 || obj2), ([key]) => key);\n\n  return isEqual(sortedObj1, sortedObj2);\n}\n\nexport function isPermissionAction(action: string): action is PermissionAction {\n  return ['create', 'read', 'update', 'delete', 'use'].includes(\n    action as PermissionAction,\n  );\n}\n\nexport async function buildRoleSourceMap(\n  policies: string[][],\n  roleMetadata: RoleMetadataStorage,\n): Promise<Map<string, Source | undefined>> {\n  return await policies.reduce(\n    async (\n      acc: Promise<Map<string, Source | undefined>>,\n      policy: string[],\n    ): Promise<Map<string, Source | undefined>> => {\n      const roleEntityRef = policy[0];\n      const acummulator = await acc;\n      if (!acummulator.has(roleEntityRef)) {\n        const metadata = await roleMetadata.findRoleMetadata(roleEntityRef);\n        acummulator.set(roleEntityRef, metadata?.source);\n      }\n      return acummulator;\n    },\n    Promise.resolve(new Map<string, Source | undefined>()),\n  );\n}\n\nexport function mergeRoleMetadata(\n  currentMetadata: RoleMetadataDao,\n  newMetadata: RoleMetadataDao,\n): RoleMetadataDao {\n  const mergedMetaData: RoleMetadataDao = { ...currentMetadata };\n  mergedMetaData.lastModified =\n    newMetadata.lastModified ?? new Date().toUTCString();\n  mergedMetaData.modifiedBy = newMetadata.modifiedBy;\n  mergedMetaData.description =\n    newMetadata.description ?? currentMetadata.description;\n  mergedMetaData.roleEntityRef = newMetadata.roleEntityRef;\n  mergedMetaData.source = newMetadata.source;\n  return mergedMetaData;\n}\n\nexport async function processConditionMapping(\n  roleConditionPolicy: RoleConditionalPolicyDecision<PermissionAction>,\n  pluginPermMetaData: PluginPermissionMetadataCollector,\n  auth: AuthService,\n): Promise<RoleConditionalPolicyDecision<PermissionInfo>> {\n  const { token } = await auth.getPluginRequestToken({\n    onBehalfOf: await auth.getOwnServiceCredentials(),\n    targetPluginId: roleConditionPolicy.pluginId,\n  });\n\n  const rule: MetadataResponse | undefined =\n    await pluginPermMetaData.getMetadataByPluginId(\n      roleConditionPolicy.pluginId,\n      token,\n    );\n  if (!rule?.permissions) {\n    throw new Error(\n      `Unable to get permission list for plugin ${roleConditionPolicy.pluginId}`,\n    );\n  }\n\n  const permInfo: PermissionInfo[] = [];\n  for (const action of roleConditionPolicy.permissionMapping) {\n    const perm = rule.permissions.find(\n      permission =>\n        permission.type === 'resource' &&\n        (action === permission.attributes.action ||\n          (action === 'use' && permission.attributes.action === undefined)),\n    );\n    if (!perm) {\n      throw new Error(\n        `Unable to find permission to get permission name for resource type '${\n          roleConditionPolicy.resourceType\n        }' and action ${JSON.stringify(action)}`,\n      );\n    }\n    permInfo.push({ name: perm.name, action });\n  }\n\n  return {\n    ...roleConditionPolicy,\n    permissionMapping: permInfo,\n  };\n}\n\nexport function deepSort(value: any): any {\n  if (isArray(value)) {\n    return sortBy(value.map(deepSort));\n  } else if (isPlainObject(value)) {\n    return fromPairs(\n      sortBy(\n        toPairs(value).map(([k, v]: [string, any]) => [k, deepSort(v)]),\n        0,\n      ),\n    );\n  }\n  return value;\n}\n\nexport function deepSortEqual(obj1: any, obj2: any): boolean {\n  return isEqual(deepSort(obj1), deepSort(obj2));\n}\n"],"names":["auditLogger","difference","RoleEvents","RBAC_BACKEND","HANDLE_RBAC_DATA_STAGE","omitBy","sortBy","toPairs","isEqual","isArray","isPlainObject","fromPairs"],"mappings":";;;;;AAiDO,SAAS,eAAe,MAA0B,EAAA;AACvD,EAAA,OAAO,CAAI,CAAA,EAAA,MAAA,CAAO,IAAK,CAAA,IAAI,CAAC,CAAA,CAAA,CAAA;AAC9B;AAEgB,SAAA,mBAAA,CAAoB,QAAkB,IAAsB,EAAA;AAC1E,EAAA,OAAO,GAAG,IAAI,CAAA,EAAA,EAAK,MAAO,CAAA,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA;AACtC;AAEO,SAAS,iBAAiB,QAA8B,EAAA;AAC7D,EAAM,MAAA,cAAA,GAAiB,SACpB,GAAI,CAAA,CAAA,MAAA,KAAU,eAAe,MAAM,CAAC,CACpC,CAAA,IAAA,CAAK,GAAG,CAAA;AACX,EAAA,OAAO,IAAI,cAAc,CAAA,CAAA,CAAA;AAC3B;AAEgB,SAAA,qBAAA,CACd,UACA,IACQ,EAAA;AACR,EAAM,MAAA,cAAA,GAAiB,QACpB,CAAA,GAAA,CAAI,CAAU,MAAA,KAAA;AACb,IAAA,OAAO,OAAO,MAAW,KAAA,CAAA,GAAI,mBAAoB,CAAA,MAAA,EAAQ,IAAI,CAAI,GAAA,EAAA;AAAA,GAClE,CACA,CAAA,IAAA,CAAK,IAAI,CAAA;AACZ,EAAO,OAAA;AAAA,IAAA,EACH,cAAc;AAAA,EAAA,CAAA;AAEpB;AAEO,SAAS,uBAAuB,MAA0B,EAAA;AAC/D,EAAO,OAAA,MAAA,CAAO,OAAQ,CAAA,GAAA,EAAK,EAAE,CAAA,CAAE,QAAQ,GAAK,EAAA,EAAE,CAAE,CAAA,KAAA,CAAM,IAAI,CAAA;AAC5D;AAEA,eAAsB,oBACpB,aACA,EAAA,UAAA,EACA,QACA,aACA,EAAA,GAAA,EACAA,eACA,UACe,EAAA;AACf,EAAA,aAAA,CAAc,KAAK,CAAC,CAAA,EAAG,MAAM,CAAE,CAAA,aAAA,CAAc,CAAC,CAAC,CAAA;AAC/C,EAAA,UAAA,CAAW,KAAK,CAAC,CAAA,EAAG,MAAM,CAAE,CAAA,aAAA,CAAc,CAAC,CAAC,CAAA;AAC5C,EAAM,MAAA,OAAA,GAAUC,iBAAW,CAAA,aAAA,EAAe,UAAU,CAAA;AAEpD,EAAA,MAAM,gBAA4B,EAAC;AACnC,EAAA,KAAA,MAAW,eAAe,OAAS,EAAA;AACjC,IAAA,aAAA,CAAc,IAAK,CAAA,CAAC,WAAa,EAAA,aAAa,CAAC,CAAA;AAAA;AAGjD,EAAI,IAAA,aAAA,CAAc,WAAW,CAAG,EAAA;AAC9B,IAAA;AAAA;AAGF,EAAA,MAAM,YAAe,GAAA,EAAE,MAAQ,EAAA,UAAA,EAAY,aAAc,EAAA;AACzD,EAAA,MAAM,GAAI,CAAA,sBAAA,CAAuB,aAAe,EAAA,YAAA,EAAc,KAAK,CAAA;AAEnE,EAAM,MAAA,gBAAA,GAAmB,MAAM,GAAI,CAAA,yBAAA;AAAA,IACjC,CAAA;AAAA,IACA;AAAA,GACF;AACA,EAAA,MAAM,OACJ,GAAA,gBAAA,CAAiB,MAAS,GAAA,CAAA,GACtB,+BACA,GAAA,cAAA;AACN,EAAA,MAAM,YACJ,gBAAiB,CAAA,MAAA,GAAS,CACtB,GAAAC,sBAAA,CAAW,cACXA,sBAAW,CAAA,WAAA;AACjB,EAAA,MAAMF,cAAY,QAAwB,CAAA;AAAA,IACxC,OAAS,EAAAG,wBAAA;AAAA,IACT,OAAA;AAAA,IACA,SAAA;AAAA,IACA,QAAU,EAAA;AAAA,MACR,GAAG,YAAA;AAAA,MACH,SAAS,aAAc,CAAA,GAAA,CAAI,CAAM,EAAA,KAAA,EAAA,CAAG,CAAC,CAAC;AAAA,KACxC;AAAA,IACA,KAAO,EAAAC,kCAAA;AAAA,IACP,MAAQ,EAAA;AAAA,GACT,CAAA;AACH;AAEO,SAAS,uBAAuB,WAAwC,EAAA;AAC7E,EAAA,MAAM,CAAC,eAAA,EAAiB,UAAY,EAAA,MAAA,EAAQ,MAAM,CAAI,GAAA,WAAA;AACtD,EAAA,OAAO,EAAE,eAAA,EAAiB,UAAY,EAAA,MAAA,EAAQ,MAAO,EAAA;AACvD;AAEgB,SAAA,eAAA,CACd,IACA,EAAA,IAAA,EACA,aACS,EAAA;AACT,EAAI,IAAA,QAAA;AACJ,EAAI,IAAA,QAAA;AACJ,EAAA,IAAI,aAAe,EAAA;AACjB,IAAM,MAAA,sBAAA,GAAgD,CAAC,MAAA,EAAQ,GAAQ,KAAA;AACrE,MAAA,KAAA,MAAW,SAAS,aAAe,EAAA;AACjC,QAAA,IAAI,QAAQ,KAAO,EAAA;AACjB,UAAO,OAAA,IAAA;AAAA;AACT;AAEF,MAAO,OAAA,KAAA;AAAA,KACT;AACA,IAAW,QAAA,GAAAC,aAAA,CAAO,MAAM,sBAAsB,CAAA;AAC9C,IAAW,QAAA,GAAAA,aAAA,CAAO,MAAM,sBAAsB,CAAA;AAAA;AAGhD,EAAM,MAAA,UAAA,GAAaC,aAAO,CAAAC,cAAA,CAAQ,QAAY,IAAA,IAAI,GAAG,CAAC,CAAC,GAAG,CAAA,KAAM,GAAG,CAAA;AACnE,EAAM,MAAA,UAAA,GAAaD,aAAO,CAAAC,cAAA,CAAQ,QAAY,IAAA,IAAI,GAAG,CAAC,CAAC,GAAG,CAAA,KAAM,GAAG,CAAA;AAEnE,EAAO,OAAAC,cAAA,CAAQ,YAAY,UAAU,CAAA;AACvC;AAEO,SAAS,mBAAmB,MAA4C,EAAA;AAC7E,EAAA,OAAO,CAAC,QAAU,EAAA,MAAA,EAAQ,QAAU,EAAA,QAAA,EAAU,KAAK,CAAE,CAAA,QAAA;AAAA,IACnD;AAAA,GACF;AACF;AAEsB,eAAA,kBAAA,CACpB,UACA,YAC0C,EAAA;AAC1C,EAAA,OAAO,MAAM,QAAS,CAAA,MAAA;AAAA,IACpB,OACE,KACA,MAC6C,KAAA;AAC7C,MAAM,MAAA,aAAA,GAAgB,OAAO,CAAC,CAAA;AAC9B,MAAA,MAAM,cAAc,MAAM,GAAA;AAC1B,MAAA,IAAI,CAAC,WAAA,CAAY,GAAI,CAAA,aAAa,CAAG,EAAA;AACnC,QAAA,MAAM,QAAW,GAAA,MAAM,YAAa,CAAA,gBAAA,CAAiB,aAAa,CAAA;AAClE,QAAY,WAAA,CAAA,GAAA,CAAI,aAAe,EAAA,QAAA,EAAU,MAAM,CAAA;AAAA;AAEjD,MAAO,OAAA,WAAA;AAAA,KACT;AAAA,IACA,OAAQ,CAAA,OAAA,iBAAY,IAAA,GAAA,EAAiC;AAAA,GACvD;AACF;AAEgB,SAAA,iBAAA,CACd,iBACA,WACiB,EAAA;AACjB,EAAM,MAAA,cAAA,GAAkC,EAAE,GAAG,eAAgB,EAAA;AAC7D,EAAA,cAAA,CAAe,eACb,WAAY,CAAA,YAAA,IAAA,iBAAoB,IAAA,IAAA,IAAO,WAAY,EAAA;AACrD,EAAA,cAAA,CAAe,aAAa,WAAY,CAAA,UAAA;AACxC,EAAe,cAAA,CAAA,WAAA,GACb,WAAY,CAAA,WAAA,IAAe,eAAgB,CAAA,WAAA;AAC7C,EAAA,cAAA,CAAe,gBAAgB,WAAY,CAAA,aAAA;AAC3C,EAAA,cAAA,CAAe,SAAS,WAAY,CAAA,MAAA;AACpC,EAAO,OAAA,cAAA;AACT;AAEsB,eAAA,uBAAA,CACpB,mBACA,EAAA,kBAAA,EACA,IACwD,EAAA;AACxD,EAAA,MAAM,EAAE,KAAA,EAAU,GAAA,MAAM,KAAK,qBAAsB,CAAA;AAAA,IACjD,UAAA,EAAY,MAAM,IAAA,CAAK,wBAAyB,EAAA;AAAA,IAChD,gBAAgB,mBAAoB,CAAA;AAAA,GACrC,CAAA;AAED,EAAM,MAAA,IAAA,GACJ,MAAM,kBAAmB,CAAA,qBAAA;AAAA,IACvB,mBAAoB,CAAA,QAAA;AAAA,IACpB;AAAA,GACF;AACF,EAAI,IAAA,CAAC,MAAM,WAAa,EAAA;AACtB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,yCAAA,EAA4C,oBAAoB,QAAQ,CAAA;AAAA,KAC1E;AAAA;AAGF,EAAA,MAAM,WAA6B,EAAC;AACpC,EAAW,KAAA,MAAA,MAAA,IAAU,oBAAoB,iBAAmB,EAAA;AAC1D,IAAM,MAAA,IAAA,GAAO,KAAK,WAAY,CAAA,IAAA;AAAA,MAC5B,CACE,UAAA,KAAA,UAAA,CAAW,IAAS,KAAA,UAAA,KACnB,MAAW,KAAA,UAAA,CAAW,UAAW,CAAA,MAAA,IAC/B,MAAW,KAAA,KAAA,IAAS,UAAW,CAAA,UAAA,CAAW,MAAW,KAAA,KAAA,CAAA;AAAA,KAC5D;AACA,IAAA,IAAI,CAAC,IAAM,EAAA;AACT,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,uEACE,mBAAoB,CAAA,YACtB,gBAAgB,IAAK,CAAA,SAAA,CAAU,MAAM,CAAC,CAAA;AAAA,OACxC;AAAA;AAEF,IAAA,QAAA,CAAS,KAAK,EAAE,IAAA,EAAM,IAAK,CAAA,IAAA,EAAM,QAAQ,CAAA;AAAA;AAG3C,EAAO,OAAA;AAAA,IACL,GAAG,mBAAA;AAAA,IACH,iBAAmB,EAAA;AAAA,GACrB;AACF;AAEO,SAAS,SAAS,KAAiB,EAAA;AACxC,EAAI,IAAAC,cAAA,CAAQ,KAAK,CAAG,EAAA;AAClB,IAAA,OAAOH,aAAO,CAAA,KAAA,CAAM,GAAI,CAAA,QAAQ,CAAC,CAAA;AAAA,GACnC,MAAA,IAAWI,oBAAc,CAAA,KAAK,CAAG,EAAA;AAC/B,IAAO,OAAAC,gBAAA;AAAA,MACLL,aAAA;AAAA,QACEC,cAAQ,CAAA,KAAK,CAAE,CAAA,GAAA,CAAI,CAAC,CAAC,CAAA,EAAG,CAAC,CAAA,KAAqB,CAAC,CAAA,EAAG,QAAS,CAAA,CAAC,CAAC,CAAC,CAAA;AAAA,QAC9D;AAAA;AACF,KACF;AAAA;AAEF,EAAO,OAAA,KAAA;AACT;AAEgB,SAAA,aAAA,CAAc,MAAW,IAAoB,EAAA;AAC3D,EAAA,OAAOC,eAAQ,QAAS,CAAA,IAAI,CAAG,EAAA,QAAA,CAAS,IAAI,CAAC,CAAA;AAC/C;;;;;;;;;;;;;;;;;"}
+{"version":3,"file":"helper.cjs.js","sources":["../src/helper.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { AuthService } from '@backstage/backend-plugin-api';\nimport type { MetadataResponse } from '@backstage/plugin-permission-node';\n\nimport { AuditLogger } from '@janus-idp/backstage-plugin-audit-log-node';\nimport {\n  difference,\n  fromPairs,\n  isArray,\n  isEqual,\n  isPlainObject,\n  omitBy,\n  sortBy,\n  toPairs,\n  ValueKeyIteratee,\n} from 'lodash';\n\nimport {\n  PermissionAction,\n  PermissionInfo,\n  RoleBasedPolicy,\n  RoleConditionalPolicyDecision,\n  Source,\n} from '@backstage-community/plugin-rbac-common';\n\nimport {\n  HANDLE_RBAC_DATA_STAGE,\n  RBAC_BACKEND,\n  RoleAuditInfo,\n  RoleEvents,\n} from './audit-log/audit-logger';\nimport { RoleMetadataDao, RoleMetadataStorage } from './database/role-metadata';\nimport { EnforcerDelegate } from './service/enforcer-delegate';\nimport { PluginPermissionMetadataCollector } from './service/plugin-endpoints';\n\nexport function policyToString(policy: string[]): string {\n  return `[${policy.join(', ')}]`;\n}\n\nexport function typedPolicyToString(policy: string[], type: string): string {\n  return `${type}, ${policy.join(', ')}`;\n}\n\nexport function policiesToString(policies: string[][]): string {\n  const policiesString = policies\n    .map(policy => policyToString(policy))\n    .join(',');\n  return `[${policiesString}]`;\n}\n\nexport function typedPoliciesToString(\n  policies: string[][],\n  type: string,\n): string {\n  const policiesString = policies\n    .map(policy => {\n      return policy.length !== 0 ? typedPolicyToString(policy, type) : '';\n    })\n    .join('\\n');\n  return `\n    ${policiesString}\n  `;\n}\n\nexport function metadataStringToPolicy(policy: string): string[] {\n  return policy.replace('[', '').replace(']', '').split(', ');\n}\n\nexport async function removeTheDifference(\n  originalGroup: string[],\n  addedGroup: string[],\n  source: Source,\n  roleEntityRef: string,\n  enf: EnforcerDelegate,\n  auditLogger: AuditLogger,\n  modifiedBy: string,\n): Promise<void> {\n  originalGroup.sort((a, b) => a.localeCompare(b));\n  addedGroup.sort((a, b) => a.localeCompare(b));\n  const missing = difference(originalGroup, addedGroup);\n\n  const groupPolicies: string[][] = [];\n  for (const missingRole of missing) {\n    groupPolicies.push([missingRole, roleEntityRef]);\n  }\n\n  if (groupPolicies.length === 0) {\n    return;\n  }\n\n  const roleMetadata = { source, modifiedBy, roleEntityRef };\n  await enf.removeGroupingPolicies(groupPolicies, roleMetadata, false);\n\n  const remainingMembers = await enf.getFilteredGroupingPolicy(\n    1,\n    roleEntityRef,\n  );\n  const message =\n    remainingMembers.length > 0\n      ? 'Updated role: deleted members'\n      : 'Deleted role';\n  const eventName =\n    remainingMembers.length > 0\n      ? RoleEvents.UPDATE_ROLE\n      : RoleEvents.DELETE_ROLE;\n  await auditLogger.auditLog<RoleAuditInfo>({\n    actorId: RBAC_BACKEND,\n    message,\n    eventName,\n    metadata: {\n      ...roleMetadata,\n      members: groupPolicies.map(gp => gp[0]),\n    },\n    stage: HANDLE_RBAC_DATA_STAGE,\n    status: 'succeeded',\n  });\n}\n\nexport function transformArrayToPolicy(policyArray: string[]): RoleBasedPolicy {\n  const [entityReference, permission, policy, effect] = policyArray;\n  return { entityReference, permission, policy, effect };\n}\n\nexport function transformPolicyGroupToLowercase(policyArray: string[]) {\n  if (\n    policyArray.length > 1 &&\n    policyArray[0].startsWith('g') &&\n    (policyArray[1].startsWith('user') || policyArray[1].startsWith('group'))\n  ) {\n    policyArray[1] = policyArray[1].toLocaleLowerCase('en-US');\n  }\n}\n\nexport function transformRolesGroupToLowercase(roles: string[][]) {\n  return roles.map(role =>\n    role.length >= 1\n      ? [role[0].toLocaleLowerCase('en-US'), ...role.slice(1)]\n      : role,\n  );\n}\n\nexport function deepSortedEqual(\n  obj1: Record<string, any>,\n  obj2: Record<string, any>,\n  excludeFields?: string[],\n): boolean {\n  let copyObj1;\n  let copyObj2;\n  if (excludeFields) {\n    const excludeFieldsPredicate: ValueKeyIteratee<any> = (_value, key) => {\n      for (const field of excludeFields) {\n        if (key === field) {\n          return true;\n        }\n      }\n      return false;\n    };\n    copyObj1 = omitBy(obj1, excludeFieldsPredicate);\n    copyObj2 = omitBy(obj2, excludeFieldsPredicate);\n  }\n\n  const sortedObj1 = sortBy(toPairs(copyObj1 || obj1), ([key]) => key);\n  const sortedObj2 = sortBy(toPairs(copyObj2 || obj2), ([key]) => key);\n\n  return isEqual(sortedObj1, sortedObj2);\n}\n\nexport function isPermissionAction(action: string): action is PermissionAction {\n  return ['create', 'read', 'update', 'delete', 'use'].includes(\n    action as PermissionAction,\n  );\n}\n\nexport async function buildRoleSourceMap(\n  policies: string[][],\n  roleMetadata: RoleMetadataStorage,\n): Promise<Map<string, Source | undefined>> {\n  return await policies.reduce(\n    async (\n      acc: Promise<Map<string, Source | undefined>>,\n      policy: string[],\n    ): Promise<Map<string, Source | undefined>> => {\n      const roleEntityRef = policy[0];\n      const acummulator = await acc;\n      if (!acummulator.has(roleEntityRef)) {\n        const metadata = await roleMetadata.findRoleMetadata(roleEntityRef);\n        acummulator.set(roleEntityRef, metadata?.source);\n      }\n      return acummulator;\n    },\n    Promise.resolve(new Map<string, Source | undefined>()),\n  );\n}\n\nexport function mergeRoleMetadata(\n  currentMetadata: RoleMetadataDao,\n  newMetadata: RoleMetadataDao,\n): RoleMetadataDao {\n  const mergedMetaData: RoleMetadataDao = { ...currentMetadata };\n  mergedMetaData.lastModified =\n    newMetadata.lastModified ?? new Date().toUTCString();\n  mergedMetaData.modifiedBy = newMetadata.modifiedBy;\n  mergedMetaData.description =\n    newMetadata.description ?? currentMetadata.description;\n  mergedMetaData.roleEntityRef = newMetadata.roleEntityRef;\n  mergedMetaData.source = newMetadata.source;\n  return mergedMetaData;\n}\n\nexport async function processConditionMapping(\n  roleConditionPolicy: RoleConditionalPolicyDecision<PermissionAction>,\n  pluginPermMetaData: PluginPermissionMetadataCollector,\n  auth: AuthService,\n): Promise<RoleConditionalPolicyDecision<PermissionInfo>> {\n  const { token } = await auth.getPluginRequestToken({\n    onBehalfOf: await auth.getOwnServiceCredentials(),\n    targetPluginId: roleConditionPolicy.pluginId,\n  });\n\n  const rule: MetadataResponse | undefined =\n    await pluginPermMetaData.getMetadataByPluginId(\n      roleConditionPolicy.pluginId,\n      token,\n    );\n  if (!rule?.permissions) {\n    throw new Error(\n      `Unable to get permission list for plugin ${roleConditionPolicy.pluginId}`,\n    );\n  }\n\n  const permInfo: PermissionInfo[] = [];\n  for (const action of roleConditionPolicy.permissionMapping) {\n    const perm = rule.permissions.find(\n      permission =>\n        permission.type === 'resource' &&\n        (action === permission.attributes.action ||\n          (action === 'use' && permission.attributes.action === undefined)),\n    );\n    if (!perm) {\n      throw new Error(\n        `Unable to find permission to get permission name for resource type '${\n          roleConditionPolicy.resourceType\n        }' and action ${JSON.stringify(action)}`,\n      );\n    }\n    permInfo.push({ name: perm.name, action });\n  }\n\n  return {\n    ...roleConditionPolicy,\n    permissionMapping: permInfo,\n  };\n}\n\nexport function deepSort(value: any): any {\n  if (isArray(value)) {\n    return sortBy(value.map(deepSort));\n  } else if (isPlainObject(value)) {\n    return fromPairs(\n      sortBy(\n        toPairs(value).map(([k, v]: [string, any]) => [k, deepSort(v)]),\n        0,\n      ),\n    );\n  }\n  return value;\n}\n\nexport function deepSortEqual(obj1: any, obj2: any): boolean {\n  return isEqual(deepSort(obj1), deepSort(obj2));\n}\n"],"names":["auditLogger","difference","RoleEvents","RBAC_BACKEND","HANDLE_RBAC_DATA_STAGE","omitBy","sortBy","toPairs","isEqual","isArray","isPlainObject","fromPairs"],"mappings":";;;;;AAiDO,SAAS,eAAe,MAA0B,EAAA;AACvD,EAAA,OAAO,CAAI,CAAA,EAAA,MAAA,CAAO,IAAK,CAAA,IAAI,CAAC,CAAA,CAAA,CAAA;AAC9B;AAEgB,SAAA,mBAAA,CAAoB,QAAkB,IAAsB,EAAA;AAC1E,EAAA,OAAO,GAAG,IAAI,CAAA,EAAA,EAAK,MAAO,CAAA,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA;AACtC;AAEO,SAAS,iBAAiB,QAA8B,EAAA;AAC7D,EAAM,MAAA,cAAA,GAAiB,SACpB,GAAI,CAAA,CAAA,MAAA,KAAU,eAAe,MAAM,CAAC,CACpC,CAAA,IAAA,CAAK,GAAG,CAAA;AACX,EAAA,OAAO,IAAI,cAAc,CAAA,CAAA,CAAA;AAC3B;AAEgB,SAAA,qBAAA,CACd,UACA,IACQ,EAAA;AACR,EAAM,MAAA,cAAA,GAAiB,QACpB,CAAA,GAAA,CAAI,CAAU,MAAA,KAAA;AACb,IAAA,OAAO,OAAO,MAAW,KAAA,CAAA,GAAI,mBAAoB,CAAA,MAAA,EAAQ,IAAI,CAAI,GAAA,EAAA;AAAA,GAClE,CACA,CAAA,IAAA,CAAK,IAAI,CAAA;AACZ,EAAO,OAAA;AAAA,IAAA,EACH,cAAc;AAAA,EAAA,CAAA;AAEpB;AAEO,SAAS,uBAAuB,MAA0B,EAAA;AAC/D,EAAO,OAAA,MAAA,CAAO,OAAQ,CAAA,GAAA,EAAK,EAAE,CAAA,CAAE,QAAQ,GAAK,EAAA,EAAE,CAAE,CAAA,KAAA,CAAM,IAAI,CAAA;AAC5D;AAEA,eAAsB,oBACpB,aACA,EAAA,UAAA,EACA,QACA,aACA,EAAA,GAAA,EACAA,eACA,UACe,EAAA;AACf,EAAA,aAAA,CAAc,KAAK,CAAC,CAAA,EAAG,MAAM,CAAE,CAAA,aAAA,CAAc,CAAC,CAAC,CAAA;AAC/C,EAAA,UAAA,CAAW,KAAK,CAAC,CAAA,EAAG,MAAM,CAAE,CAAA,aAAA,CAAc,CAAC,CAAC,CAAA;AAC5C,EAAM,MAAA,OAAA,GAAUC,iBAAW,CAAA,aAAA,EAAe,UAAU,CAAA;AAEpD,EAAA,MAAM,gBAA4B,EAAC;AACnC,EAAA,KAAA,MAAW,eAAe,OAAS,EAAA;AACjC,IAAA,aAAA,CAAc,IAAK,CAAA,CAAC,WAAa,EAAA,aAAa,CAAC,CAAA;AAAA;AAGjD,EAAI,IAAA,aAAA,CAAc,WAAW,CAAG,EAAA;AAC9B,IAAA;AAAA;AAGF,EAAA,MAAM,YAAe,GAAA,EAAE,MAAQ,EAAA,UAAA,EAAY,aAAc,EAAA;AACzD,EAAA,MAAM,GAAI,CAAA,sBAAA,CAAuB,aAAe,EAAA,YAAA,EAAc,KAAK,CAAA;AAEnE,EAAM,MAAA,gBAAA,GAAmB,MAAM,GAAI,CAAA,yBAAA;AAAA,IACjC,CAAA;AAAA,IACA;AAAA,GACF;AACA,EAAA,MAAM,OACJ,GAAA,gBAAA,CAAiB,MAAS,GAAA,CAAA,GACtB,+BACA,GAAA,cAAA;AACN,EAAA,MAAM,YACJ,gBAAiB,CAAA,MAAA,GAAS,CACtB,GAAAC,sBAAA,CAAW,cACXA,sBAAW,CAAA,WAAA;AACjB,EAAA,MAAMF,cAAY,QAAwB,CAAA;AAAA,IACxC,OAAS,EAAAG,wBAAA;AAAA,IACT,OAAA;AAAA,IACA,SAAA;AAAA,IACA,QAAU,EAAA;AAAA,MACR,GAAG,YAAA;AAAA,MACH,SAAS,aAAc,CAAA,GAAA,CAAI,CAAM,EAAA,KAAA,EAAA,CAAG,CAAC,CAAC;AAAA,KACxC;AAAA,IACA,KAAO,EAAAC,kCAAA;AAAA,IACP,MAAQ,EAAA;AAAA,GACT,CAAA;AACH;AAEO,SAAS,uBAAuB,WAAwC,EAAA;AAC7E,EAAA,MAAM,CAAC,eAAA,EAAiB,UAAY,EAAA,MAAA,EAAQ,MAAM,CAAI,GAAA,WAAA;AACtD,EAAA,OAAO,EAAE,eAAA,EAAiB,UAAY,EAAA,MAAA,EAAQ,MAAO,EAAA;AACvD;AAEO,SAAS,gCAAgC,WAAuB,EAAA;AACrE,EACE,IAAA,WAAA,CAAY,SAAS,CACrB,IAAA,WAAA,CAAY,CAAC,CAAE,CAAA,UAAA,CAAW,GAAG,CAC5B,KAAA,WAAA,CAAY,CAAC,CAAE,CAAA,UAAA,CAAW,MAAM,CAAK,IAAA,WAAA,CAAY,CAAC,CAAE,CAAA,UAAA,CAAW,OAAO,CACvE,CAAA,EAAA;AACA,IAAA,WAAA,CAAY,CAAC,CAAI,GAAA,WAAA,CAAY,CAAC,CAAA,CAAE,kBAAkB,OAAO,CAAA;AAAA;AAE7D;AAEO,SAAS,+BAA+B,KAAmB,EAAA;AAChE,EAAA,OAAO,KAAM,CAAA,GAAA;AAAA,IAAI,UACf,IAAK,CAAA,MAAA,IAAU,CACX,GAAA,CAAC,KAAK,CAAC,CAAA,CAAE,iBAAkB,CAAA,OAAO,GAAG,GAAG,IAAA,CAAK,KAAM,CAAA,CAAC,CAAC,CACrD,GAAA;AAAA,GACN;AACF;AAEgB,SAAA,eAAA,CACd,IACA,EAAA,IAAA,EACA,aACS,EAAA;AACT,EAAI,IAAA,QAAA;AACJ,EAAI,IAAA,QAAA;AACJ,EAAA,IAAI,aAAe,EAAA;AACjB,IAAM,MAAA,sBAAA,GAAgD,CAAC,MAAA,EAAQ,GAAQ,KAAA;AACrE,MAAA,KAAA,MAAW,SAAS,aAAe,EAAA;AACjC,QAAA,IAAI,QAAQ,KAAO,EAAA;AACjB,UAAO,OAAA,IAAA;AAAA;AACT;AAEF,MAAO,OAAA,KAAA;AAAA,KACT;AACA,IAAW,QAAA,GAAAC,aAAA,CAAO,MAAM,sBAAsB,CAAA;AAC9C,IAAW,QAAA,GAAAA,aAAA,CAAO,MAAM,sBAAsB,CAAA;AAAA;AAGhD,EAAM,MAAA,UAAA,GAAaC,aAAO,CAAAC,cAAA,CAAQ,QAAY,IAAA,IAAI,GAAG,CAAC,CAAC,GAAG,CAAA,KAAM,GAAG,CAAA;AACnE,EAAM,MAAA,UAAA,GAAaD,aAAO,CAAAC,cAAA,CAAQ,QAAY,IAAA,IAAI,GAAG,CAAC,CAAC,GAAG,CAAA,KAAM,GAAG,CAAA;AAEnE,EAAO,OAAAC,cAAA,CAAQ,YAAY,UAAU,CAAA;AACvC;AAEO,SAAS,mBAAmB,MAA4C,EAAA;AAC7E,EAAA,OAAO,CAAC,QAAU,EAAA,MAAA,EAAQ,QAAU,EAAA,QAAA,EAAU,KAAK,CAAE,CAAA,QAAA;AAAA,IACnD;AAAA,GACF;AACF;AAEsB,eAAA,kBAAA,CACpB,UACA,YAC0C,EAAA;AAC1C,EAAA,OAAO,MAAM,QAAS,CAAA,MAAA;AAAA,IACpB,OACE,KACA,MAC6C,KAAA;AAC7C,MAAM,MAAA,aAAA,GAAgB,OAAO,CAAC,CAAA;AAC9B,MAAA,MAAM,cAAc,MAAM,GAAA;AAC1B,MAAA,IAAI,CAAC,WAAA,CAAY,GAAI,CAAA,aAAa,CAAG,EAAA;AACnC,QAAA,MAAM,QAAW,GAAA,MAAM,YAAa,CAAA,gBAAA,CAAiB,aAAa,CAAA;AAClE,QAAY,WAAA,CAAA,GAAA,CAAI,aAAe,EAAA,QAAA,EAAU,MAAM,CAAA;AAAA;AAEjD,MAAO,OAAA,WAAA;AAAA,KACT;AAAA,IACA,OAAQ,CAAA,OAAA,iBAAY,IAAA,GAAA,EAAiC;AAAA,GACvD;AACF;AAEgB,SAAA,iBAAA,CACd,iBACA,WACiB,EAAA;AACjB,EAAM,MAAA,cAAA,GAAkC,EAAE,GAAG,eAAgB,EAAA;AAC7D,EAAA,cAAA,CAAe,eACb,WAAY,CAAA,YAAA,IAAA,iBAAoB,IAAA,IAAA,IAAO,WAAY,EAAA;AACrD,EAAA,cAAA,CAAe,aAAa,WAAY,CAAA,UAAA;AACxC,EAAe,cAAA,CAAA,WAAA,GACb,WAAY,CAAA,WAAA,IAAe,eAAgB,CAAA,WAAA;AAC7C,EAAA,cAAA,CAAe,gBAAgB,WAAY,CAAA,aAAA;AAC3C,EAAA,cAAA,CAAe,SAAS,WAAY,CAAA,MAAA;AACpC,EAAO,OAAA,cAAA;AACT;AAEsB,eAAA,uBAAA,CACpB,mBACA,EAAA,kBAAA,EACA,IACwD,EAAA;AACxD,EAAA,MAAM,EAAE,KAAA,EAAU,GAAA,MAAM,KAAK,qBAAsB,CAAA;AAAA,IACjD,UAAA,EAAY,MAAM,IAAA,CAAK,wBAAyB,EAAA;AAAA,IAChD,gBAAgB,mBAAoB,CAAA;AAAA,GACrC,CAAA;AAED,EAAM,MAAA,IAAA,GACJ,MAAM,kBAAmB,CAAA,qBAAA;AAAA,IACvB,mBAAoB,CAAA,QAAA;AAAA,IACpB;AAAA,GACF;AACF,EAAI,IAAA,CAAC,MAAM,WAAa,EAAA;AACtB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,yCAAA,EAA4C,oBAAoB,QAAQ,CAAA;AAAA,KAC1E;AAAA;AAGF,EAAA,MAAM,WAA6B,EAAC;AACpC,EAAW,KAAA,MAAA,MAAA,IAAU,oBAAoB,iBAAmB,EAAA;AAC1D,IAAM,MAAA,IAAA,GAAO,KAAK,WAAY,CAAA,IAAA;AAAA,MAC5B,CACE,UAAA,KAAA,UAAA,CAAW,IAAS,KAAA,UAAA,KACnB,MAAW,KAAA,UAAA,CAAW,UAAW,CAAA,MAAA,IAC/B,MAAW,KAAA,KAAA,IAAS,UAAW,CAAA,UAAA,CAAW,MAAW,KAAA,KAAA,CAAA;AAAA,KAC5D;AACA,IAAA,IAAI,CAAC,IAAM,EAAA;AACT,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,uEACE,mBAAoB,CAAA,YACtB,gBAAgB,IAAK,CAAA,SAAA,CAAU,MAAM,CAAC,CAAA;AAAA,OACxC;AAAA;AAEF,IAAA,QAAA,CAAS,KAAK,EAAE,IAAA,EAAM,IAAK,CAAA,IAAA,EAAM,QAAQ,CAAA;AAAA;AAG3C,EAAO,OAAA;AAAA,IACL,GAAG,mBAAA;AAAA,IACH,iBAAmB,EAAA;AAAA,GACrB;AACF;AAEO,SAAS,SAAS,KAAiB,EAAA;AACxC,EAAI,IAAAC,cAAA,CAAQ,KAAK,CAAG,EAAA;AAClB,IAAA,OAAOH,aAAO,CAAA,KAAA,CAAM,GAAI,CAAA,QAAQ,CAAC,CAAA;AAAA,GACnC,MAAA,IAAWI,oBAAc,CAAA,KAAK,CAAG,EAAA;AAC/B,IAAO,OAAAC,gBAAA;AAAA,MACLL,aAAA;AAAA,QACEC,cAAQ,CAAA,KAAK,CAAE,CAAA,GAAA,CAAI,CAAC,CAAC,CAAA,EAAG,CAAC,CAAA,KAAqB,CAAC,CAAA,EAAG,QAAS,CAAA,CAAC,CAAC,CAAC,CAAA;AAAA,QAC9D;AAAA;AACF,KACF;AAAA;AAEF,EAAO,OAAA,KAAA;AACT;AAEgB,SAAA,aAAA,CAAc,MAAW,IAAoB,EAAA;AAC3D,EAAA,OAAOC,eAAQ,QAAS,CAAA,IAAI,CAAG,EAAA,QAAA,CAAS,IAAI,CAAC,CAAA;AAC/C;;;;;;;;;;;;;;;;;;;"}

package/dist/providers/connect-providers.cjs.js

@@ -15,7 +15,8 @@ class Connection {
     this.auditLogger = auditLogger;
   }
   async applyRoles(roles) {
-    const stringPolicy = helper.typedPoliciesToString(roles, "g");
+    const lowercasedRoles = helper.transformRolesGroupToLowercase(roles);
+    const stringPolicy = helper.typedPoliciesToString(lowercasedRoles, "g");
     const providerRolesforRemoval = [];
     const tempEnforcer = await casbin.newEnforcer(
       casbin.newModelFromString(permissionModel.MODEL),
@@ -29,7 +30,7 @@ class Connection {
       );
     }
     await this.removeRoles(providerRolesforRemoval, tempEnforcer);
-    await this.addRoles(roles);
+    await this.addRoles(lowercasedRoles);
   }
   async applyPermissions(permissions) {
     const stringPolicy = helper.typedPoliciesToString(permissions, "p");
@@ -83,7 +84,8 @@ class Connection {
     }
   }
   async removeRoles(providerRoles, tempEnforcer) {
-    for (const role of providerRoles) {
+    const lowercasedProviderRoles = helper.transformRolesGroupToLowercase(providerRoles);
+    for (const role of lowercasedProviderRoles) {
       if (!await tempEnforcer.hasGroupingPolicy(...role)) {
         const roleMeta = await this.roleMetadataStorage.findRoleMetadata(
           role[1]

package/dist/providers/connect-providers.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"connect-providers.cjs.js","sources":["../../src/providers/connect-providers.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport type { LoggerService } from '@backstage/backend-plugin-api';\n\nimport type { AuditLogger } from '@janus-idp/backstage-plugin-audit-log-node';\nimport {\n  Enforcer,\n  newEnforcer,\n  newModelFromString,\n  StringAdapter,\n} from 'casbin';\n\nimport type {\n  RBACProvider,\n  RBACProviderConnection,\n} from '@backstage-community/plugin-rbac-node';\n\nimport {\n  HANDLE_RBAC_DATA_STAGE,\n  PermissionAuditInfo,\n  PermissionEvents,\n  RBAC_BACKEND,\n  RoleAuditInfo,\n  RoleEvents,\n} from '../audit-log/audit-logger';\nimport { RoleMetadataStorage } from '../database/role-metadata';\nimport { transformArrayToPolicy, typedPoliciesToString } from '../helper';\nimport { EnforcerDelegate } from '../service/enforcer-delegate';\nimport { MODEL } from '../service/permission-model';\nimport {\n  validateGroupingPolicy,\n  validatePolicy,\n  validateSource,\n} from '../validation/policies-validation';\n\nexport class Connection implements RBACProviderConnection {\n  constructor(\n    private readonly id: string,\n    private readonly enforcer: EnforcerDelegate,\n    private readonly roleMetadataStorage: RoleMetadataStorage,\n    private readonly logger: LoggerService,\n    private readonly auditLogger: AuditLogger,\n  ) {}\n\n  async applyRoles(roles: string[][]): Promise<void> {\n    const stringPolicy = typedPoliciesToString(roles, 'g');\n\n    const providerRolesforRemoval: string[][] = [];\n\n    const tempEnforcer = await newEnforcer(\n      newModelFromString(MODEL),\n      new StringAdapter(stringPolicy),\n    );\n\n    const providerRoles = await this.getProviderRoles();\n\n    await this.enforcer.loadPolicy();\n    // Get the roles for this provider coming from rbac plugin\n    for (const providerRole of providerRoles) {\n      providerRolesforRemoval.push(\n        ...(await this.enforcer.getFilteredGroupingPolicy(1, providerRole)),\n      );\n    }\n\n    // Remove role\n    // role exists in rbac but does not exist in provider\n    await this.removeRoles(providerRolesforRemoval, tempEnforcer);\n\n    // Add the role\n    // role exists in provider but does not exist in rbac\n    await this.addRoles(roles);\n  }\n\n  async applyPermissions(permissions: string[][]): Promise<void> {\n    const stringPolicy = typedPoliciesToString(permissions, 'p');\n\n    const providerPermissions: string[][] = [];\n\n    const tempEnforcer = await newEnforcer(\n      newModelFromString(MODEL),\n      new StringAdapter(stringPolicy),\n    );\n\n    const providerRoles = await this.getProviderRoles();\n\n    await this.enforcer.loadPolicy();\n    // Get the roles for this provider coming from rbac plugin\n    for (const providerRole of providerRoles) {\n      providerPermissions.push(\n        ...(await this.enforcer.getFilteredPolicy(0, providerRole)),\n      );\n    }\n\n    await this.removePermissions(providerPermissions, tempEnforcer);\n\n    await this.addPermissions(permissions);\n  }\n\n  private async addRoles(roles: string[][]): Promise<void> {\n    for (const role of roles) {\n      if (!(await this.enforcer.hasGroupingPolicy(...role))) {\n        const err = await validateGroupingPolicy(\n          role,\n          this.roleMetadataStorage,\n          this.id,\n        );\n\n        if (err) {\n          this.logger.warn(err.message);\n          continue; // Skip adding this role as there was an error\n        }\n\n        let roleMeta = await this.roleMetadataStorage.findRoleMetadata(role[1]);\n\n        const eventName = roleMeta\n          ? RoleEvents.UPDATE_ROLE\n          : RoleEvents.CREATE_ROLE;\n        const message = roleMeta ? 'Updated role' : 'Created role';\n\n        // role does not exist in rbac, create the metadata for it\n        if (!roleMeta) {\n          roleMeta = {\n            modifiedBy: this.id,\n            source: this.id,\n            roleEntityRef: role[1],\n          };\n        }\n\n        await this.enforcer.addGroupingPolicy(role, roleMeta);\n\n        await this.auditLogger.auditLog<RoleAuditInfo>({\n          actorId: RBAC_BACKEND,\n          message,\n          eventName,\n          metadata: { ...roleMeta, members: [role[0]] },\n          stage: HANDLE_RBAC_DATA_STAGE,\n          status: 'succeeded',\n        });\n      }\n    }\n  }\n\n  private async removeRoles(\n    providerRoles: string[][],\n    tempEnforcer: Enforcer,\n  ): Promise<void> {\n    // Remove role\n    // role exists in rbac but does not exist in provider\n    for (const role of providerRoles) {\n      if (!(await tempEnforcer.hasGroupingPolicy(...role))) {\n        const roleMeta = await this.roleMetadataStorage.findRoleMetadata(\n          role[1],\n        );\n\n        const currentRole = await this.enforcer.getFilteredGroupingPolicy(\n          1,\n          role[1],\n        );\n\n        if (!roleMeta) {\n          this.logger.warn('role does not exist');\n          continue;\n        }\n\n        const singleRole = roleMeta && currentRole.length === 1;\n\n        let eventName: string;\n        let message: string;\n\n        // Only one role exists in rbac remove role metadata as well\n        if (singleRole) {\n          eventName = RoleEvents.DELETE_ROLE;\n          message = 'Deleted role';\n          await this.enforcer.removeGroupingPolicy(role, roleMeta);\n\n          await this.auditLogger.auditLog<RoleAuditInfo>({\n            actorId: RBAC_BACKEND,\n            message,\n            eventName,\n            metadata: { ...roleMeta, members: [role[0]] },\n            stage: HANDLE_RBAC_DATA_STAGE,\n            status: 'succeeded',\n          });\n          continue; // Move on to the next role\n        }\n\n        eventName = RoleEvents.UPDATE_ROLE;\n        message = 'Updated role: deleted members';\n        await this.enforcer.removeGroupingPolicy(role, roleMeta, true);\n\n        await this.auditLogger.auditLog<RoleAuditInfo>({\n          actorId: RBAC_BACKEND,\n          message,\n          eventName,\n          metadata: { ...roleMeta, members: [role[0]] },\n          stage: HANDLE_RBAC_DATA_STAGE,\n          status: 'succeeded',\n        });\n      }\n    }\n  }\n\n  private async addPermissions(permissions: string[][]): Promise<void> {\n    for (const permission of permissions) {\n      if (!(await this.enforcer.hasPolicy(...permission))) {\n        const transformedPolicy = transformArrayToPolicy(permission);\n        const metadata = await this.roleMetadataStorage.findRoleMetadata(\n          permission[0],\n        );\n\n        let err = validatePolicy(transformedPolicy);\n        if (err) {\n          this.logger.warn(`Invalid permission policy, ${err}`);\n          continue; // Skip this invalid permission policy\n        }\n\n        err = await validateSource(this.id, metadata);\n        if (err) {\n          this.logger.warn(\n            `Unable to add policy ${permission}. Cause: ${err.message}`,\n          );\n          continue;\n        }\n\n        await this.enforcer.addPolicy(permission);\n\n        await this.auditLogger.auditLog<PermissionAuditInfo>({\n          actorId: RBAC_BACKEND,\n          message: `Created policy`,\n          eventName: PermissionEvents.CREATE_POLICY,\n          metadata: { policies: [permission], source: this.id },\n          stage: HANDLE_RBAC_DATA_STAGE,\n          status: 'succeeded',\n        });\n      }\n    }\n  }\n\n  private async removePermissions(\n    providerPermissions: string[][],\n    tempEnforcer: Enforcer,\n  ): Promise<void> {\n    const removedPermissions: string[][] = [];\n    for (const permission of providerPermissions) {\n      if (!(await tempEnforcer.hasPolicy(...permission))) {\n        await this.enforcer.removePolicy(permission);\n        removedPermissions.push(permission);\n      }\n\n      if (removedPermissions.length > 0) {\n        await this.auditLogger.auditLog<PermissionAuditInfo>({\n          actorId: RBAC_BACKEND,\n          message: `Deleted policies`,\n          eventName: PermissionEvents.DELETE_POLICY,\n          metadata: {\n            policies: removedPermissions,\n            source: this.id,\n          },\n          stage: HANDLE_RBAC_DATA_STAGE,\n          status: 'succeeded',\n        });\n      }\n    }\n  }\n\n  private async getProviderRoles(): Promise<string[]> {\n    const currentRoles = await this.roleMetadataStorage.filterRoleMetadata(\n      this.id,\n    );\n    return currentRoles.map(meta => meta.roleEntityRef);\n  }\n}\n\nexport async function connectRBACProviders(\n  providers: RBACProvider[],\n  enforcer: EnforcerDelegate,\n  roleMetadataStorage: RoleMetadataStorage,\n  logger: LoggerService,\n  auditLogger: AuditLogger,\n) {\n  await Promise.all(\n    providers.map(async provider => {\n      try {\n        const connection = new Connection(\n          provider.getProviderName(),\n          enforcer,\n          roleMetadataStorage,\n          logger,\n          auditLogger,\n        );\n        return provider.connect(connection);\n      } catch (error) {\n        throw new Error(\n          `Unable to connect provider ${provider.getProviderName()}, ${error}`,\n        );\n      }\n    }),\n  );\n}\n"],"names":["typedPoliciesToString","newEnforcer","newModelFromString","MODEL","StringAdapter","validateGroupingPolicy","RoleEvents","RBAC_BACKEND","HANDLE_RBAC_DATA_STAGE","transformArrayToPolicy","validatePolicy","validateSource","PermissionEvents"],"mappings":";;;;;;;;AAgDO,MAAM,UAA6C,CAAA;AAAA,EACxD,WACmB,CAAA,EAAA,EACA,QACA,EAAA,mBAAA,EACA,QACA,WACjB,EAAA;AALiB,IAAA,IAAA,CAAA,EAAA,GAAA,EAAA;AACA,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AACA,IAAA,IAAA,CAAA,mBAAA,GAAA,mBAAA;AACA,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,WAAA,GAAA,WAAA;AAAA;AAChB,EAEH,MAAM,WAAW,KAAkC,EAAA;AACjD,IAAM,MAAA,YAAA,GAAeA,4BAAsB,CAAA,KAAA,EAAO,GAAG,CAAA;AAErD,IAAA,MAAM,0BAAsC,EAAC;AAE7C,IAAA,MAAM,eAAe,MAAMC,kBAAA;AAAA,MACzBC,0BAAmBC,qBAAK,CAAA;AAAA,MACxB,IAAIC,qBAAc,YAAY;AAAA,KAChC;AAEA,IAAM,MAAA,aAAA,GAAgB,MAAM,IAAA,CAAK,gBAAiB,EAAA;AAElD,IAAM,MAAA,IAAA,CAAK,SAAS,UAAW,EAAA;AAE/B,IAAA,KAAA,MAAW,gBAAgB,aAAe,EAAA;AACxC,MAAwB,uBAAA,CAAA,IAAA;AAAA,QACtB,GAAI,MAAM,IAAA,CAAK,QAAS,CAAA,yBAAA,CAA0B,GAAG,YAAY;AAAA,OACnE;AAAA;AAKF,IAAM,MAAA,IAAA,CAAK,WAAY,CAAA,uBAAA,EAAyB,YAAY,CAAA;AAI5D,IAAM,MAAA,IAAA,CAAK,SAAS,KAAK,CAAA;AAAA;AAC3B,EAEA,MAAM,iBAAiB,WAAwC,EAAA;AAC7D,IAAM,MAAA,YAAA,GAAeJ,4BAAsB,CAAA,WAAA,EAAa,GAAG,CAAA;AAE3D,IAAA,MAAM,sBAAkC,EAAC;AAEzC,IAAA,MAAM,eAAe,MAAMC,kBAAA;AAAA,MACzBC,0BAAmBC,qBAAK,CAAA;AAAA,MACxB,IAAIC,qBAAc,YAAY;AAAA,KAChC;AAEA,IAAM,MAAA,aAAA,GAAgB,MAAM,IAAA,CAAK,gBAAiB,EAAA;AAElD,IAAM,MAAA,IAAA,CAAK,SAAS,UAAW,EAAA;AAE/B,IAAA,KAAA,MAAW,gBAAgB,aAAe,EAAA;AACxC,MAAoB,mBAAA,CAAA,IAAA;AAAA,QAClB,GAAI,MAAM,IAAA,CAAK,QAAS,CAAA,iBAAA,CAAkB,GAAG,YAAY;AAAA,OAC3D;AAAA;AAGF,IAAM,MAAA,IAAA,CAAK,iBAAkB,CAAA,mBAAA,EAAqB,YAAY,CAAA;AAE9D,IAAM,MAAA,IAAA,CAAK,eAAe,WAAW,CAAA;AAAA;AACvC,EAEA,MAAc,SAAS,KAAkC,EAAA;AACvD,IAAA,KAAA,MAAW,QAAQ,KAAO,EAAA;AACxB,MAAA,IAAI,CAAE,MAAM,IAAA,CAAK,SAAS,iBAAkB,CAAA,GAAG,IAAI,CAAI,EAAA;AACrD,QAAA,MAAM,MAAM,MAAMC,yCAAA;AAAA,UAChB,IAAA;AAAA,UACA,IAAK,CAAA,mBAAA;AAAA,UACL,IAAK,CAAA;AAAA,SACP;AAEA,QAAA,IAAI,GAAK,EAAA;AACP,UAAK,IAAA,CAAA,MAAA,CAAO,IAAK,CAAA,GAAA,CAAI,OAAO,CAAA;AAC5B,UAAA;AAAA;AAGF,QAAA,IAAI,WAAW,MAAM,IAAA,CAAK,oBAAoB,gBAAiB,CAAA,IAAA,CAAK,CAAC,CAAC,CAAA;AAEtE,QAAA,MAAM,SAAY,GAAA,QAAA,GACdC,sBAAW,CAAA,WAAA,GACXA,sBAAW,CAAA,WAAA;AACf,QAAM,MAAA,OAAA,GAAU,WAAW,cAAiB,GAAA,cAAA;AAG5C,QAAA,IAAI,CAAC,QAAU,EAAA;AACb,UAAW,QAAA,GAAA;AAAA,YACT,YAAY,IAAK,CAAA,EAAA;AAAA,YACjB,QAAQ,IAAK,CAAA,EAAA;AAAA,YACb,aAAA,EAAe,KAAK,CAAC;AAAA,WACvB;AAAA;AAGF,QAAA,MAAM,IAAK,CAAA,QAAA,CAAS,iBAAkB,CAAA,IAAA,EAAM,QAAQ,CAAA;AAEpD,QAAM,MAAA,IAAA,CAAK,YAAY,QAAwB,CAAA;AAAA,UAC7C,OAAS,EAAAC,wBAAA;AAAA,UACT,OAAA;AAAA,UACA,SAAA;AAAA,UACA,QAAA,EAAU,EAAE,GAAG,QAAA,EAAU,SAAS,CAAC,IAAA,CAAK,CAAC,CAAC,CAAE,EAAA;AAAA,UAC5C,KAAO,EAAAC,kCAAA;AAAA,UACP,MAAQ,EAAA;AAAA,SACT,CAAA;AAAA;AACH;AACF;AACF,EAEA,MAAc,WACZ,CAAA,aAAA,EACA,YACe,EAAA;AAGf,IAAA,KAAA,MAAW,QAAQ,aAAe,EAAA;AAChC,MAAA,IAAI,CAAE,MAAM,YAAA,CAAa,iBAAkB,CAAA,GAAG,IAAI,CAAI,EAAA;AACpD,QAAM,MAAA,QAAA,GAAW,MAAM,IAAA,CAAK,mBAAoB,CAAA,gBAAA;AAAA,UAC9C,KAAK,CAAC;AAAA,SACR;AAEA,QAAM,MAAA,WAAA,GAAc,MAAM,IAAA,CAAK,QAAS,CAAA,yBAAA;AAAA,UACtC,CAAA;AAAA,UACA,KAAK,CAAC;AAAA,SACR;AAEA,QAAA,IAAI,CAAC,QAAU,EAAA;AACb,UAAK,IAAA,CAAA,MAAA,CAAO,KAAK,qBAAqB,CAAA;AACtC,UAAA;AAAA;AAGF,QAAM,MAAA,UAAA,GAAa,QAAY,IAAA,WAAA,CAAY,MAAW,KAAA,CAAA;AAEtD,QAAI,IAAA,SAAA;AACJ,QAAI,IAAA,OAAA;AAGJ,QAAA,IAAI,UAAY,EAAA;AACd,UAAA,SAAA,GAAYF,sBAAW,CAAA,WAAA;AACvB,UAAU,OAAA,GAAA,cAAA;AACV,UAAA,MAAM,IAAK,CAAA,QAAA,CAAS,oBAAqB,CAAA,IAAA,EAAM,QAAQ,CAAA;AAEvD,UAAM,MAAA,IAAA,CAAK,YAAY,QAAwB,CAAA;AAAA,YAC7C,OAAS,EAAAC,wBAAA;AAAA,YACT,OAAA;AAAA,YACA,SAAA;AAAA,YACA,QAAA,EAAU,EAAE,GAAG,QAAA,EAAU,SAAS,CAAC,IAAA,CAAK,CAAC,CAAC,CAAE,EAAA;AAAA,YAC5C,KAAO,EAAAC,kCAAA;AAAA,YACP,MAAQ,EAAA;AAAA,WACT,CAAA;AACD,UAAA;AAAA;AAGF,QAAA,SAAA,GAAYF,sBAAW,CAAA,WAAA;AACvB,QAAU,OAAA,GAAA,+BAAA;AACV,QAAA,MAAM,IAAK,CAAA,QAAA,CAAS,oBAAqB,CAAA,IAAA,EAAM,UAAU,IAAI,CAAA;AAE7D,QAAM,MAAA,IAAA,CAAK,YAAY,QAAwB,CAAA;AAAA,UAC7C,OAAS,EAAAC,wBAAA;AAAA,UACT,OAAA;AAAA,UACA,SAAA;AAAA,UACA,QAAA,EAAU,EAAE,GAAG,QAAA,EAAU,SAAS,CAAC,IAAA,CAAK,CAAC,CAAC,CAAE,EAAA;AAAA,UAC5C,KAAO,EAAAC,kCAAA;AAAA,UACP,MAAQ,EAAA;AAAA,SACT,CAAA;AAAA;AACH;AACF;AACF,EAEA,MAAc,eAAe,WAAwC,EAAA;AACnE,IAAA,KAAA,MAAW,cAAc,WAAa,EAAA;AACpC,MAAA,IAAI,CAAE,MAAM,IAAA,CAAK,SAAS,SAAU,CAAA,GAAG,UAAU,CAAI,EAAA;AACnD,QAAM,MAAA,iBAAA,GAAoBC,8BAAuB,UAAU,CAAA;AAC3D,QAAM,MAAA,QAAA,GAAW,MAAM,IAAA,CAAK,mBAAoB,CAAA,gBAAA;AAAA,UAC9C,WAAW,CAAC;AAAA,SACd;AAEA,QAAI,IAAA,GAAA,GAAMC,kCAAe,iBAAiB,CAAA;AAC1C,QAAA,IAAI,GAAK,EAAA;AACP,UAAA,IAAA,CAAK,MAAO,CAAA,IAAA,CAAK,CAA8B,2BAAA,EAAA,GAAG,CAAE,CAAA,CAAA;AACpD,UAAA;AAAA;AAGF,QAAA,GAAA,GAAM,MAAMC,iCAAA,CAAe,IAAK,CAAA,EAAA,EAAI,QAAQ,CAAA;AAC5C,QAAA,IAAI,GAAK,EAAA;AACP,UAAA,IAAA,CAAK,MAAO,CAAA,IAAA;AAAA,YACV,CAAwB,qBAAA,EAAA,UAAU,CAAY,SAAA,EAAA,GAAA,CAAI,OAAO,CAAA;AAAA,WAC3D;AACA,UAAA;AAAA;AAGF,QAAM,MAAA,IAAA,CAAK,QAAS,CAAA,SAAA,CAAU,UAAU,CAAA;AAExC,QAAM,MAAA,IAAA,CAAK,YAAY,QAA8B,CAAA;AAAA,UACnD,OAAS,EAAAJ,wBAAA;AAAA,UACT,OAAS,EAAA,CAAA,cAAA,CAAA;AAAA,UACT,WAAWK,4BAAiB,CAAA,aAAA;AAAA,UAC5B,QAAA,EAAU,EAAE,QAAU,EAAA,CAAC,UAAU,CAAG,EAAA,MAAA,EAAQ,KAAK,EAAG,EAAA;AAAA,UACpD,KAAO,EAAAJ,kCAAA;AAAA,UACP,MAAQ,EAAA;AAAA,SACT,CAAA;AAAA;AACH;AACF;AACF,EAEA,MAAc,iBACZ,CAAA,mBAAA,EACA,YACe,EAAA;AACf,IAAA,MAAM,qBAAiC,EAAC;AACxC,IAAA,KAAA,MAAW,cAAc,mBAAqB,EAAA;AAC5C,MAAA,IAAI,CAAE,MAAM,YAAA,CAAa,SAAU,CAAA,GAAG,UAAU,CAAI,EAAA;AAClD,QAAM,MAAA,IAAA,CAAK,QAAS,CAAA,YAAA,CAAa,UAAU,CAAA;AAC3C,QAAA,kBAAA,CAAmB,KAAK,UAAU,CAAA;AAAA;AAGpC,MAAI,IAAA,kBAAA,CAAmB,SAAS,CAAG,EAAA;AACjC,QAAM,MAAA,IAAA,CAAK,YAAY,QAA8B,CAAA;AAAA,UACnD,OAAS,EAAAD,wBAAA;AAAA,UACT,OAAS,EAAA,CAAA,gBAAA,CAAA;AAAA,UACT,WAAWK,4BAAiB,CAAA,aAAA;AAAA,UAC5B,QAAU,EAAA;AAAA,YACR,QAAU,EAAA,kBAAA;AAAA,YACV,QAAQ,IAAK,CAAA;AAAA,WACf;AAAA,UACA,KAAO,EAAAJ,kCAAA;AAAA,UACP,MAAQ,EAAA;AAAA,SACT,CAAA;AAAA;AACH;AACF;AACF,EAEA,MAAc,gBAAsC,GAAA;AAClD,IAAM,MAAA,YAAA,GAAe,MAAM,IAAA,CAAK,mBAAoB,CAAA,kBAAA;AAAA,MAClD,IAAK,CAAA;AAAA,KACP;AACA,IAAA,OAAO,YAAa,CAAA,GAAA,CAAI,CAAQ,IAAA,KAAA,IAAA,CAAK,aAAa,CAAA;AAAA;AAEtD;AAEA,eAAsB,oBACpB,CAAA,SAAA,EACA,QACA,EAAA,mBAAA,EACA,QACA,WACA,EAAA;AACA,EAAA,MAAM,OAAQ,CAAA,GAAA;AAAA,IACZ,SAAA,CAAU,GAAI,CAAA,OAAM,QAAY,KAAA;AAC9B,MAAI,IAAA;AACF,QAAA,MAAM,aAAa,IAAI,UAAA;AAAA,UACrB,SAAS,eAAgB,EAAA;AAAA,UACzB,QAAA;AAAA,UACA,mBAAA;AAAA,UACA,MAAA;AAAA,UACA;AAAA,SACF;AACA,QAAO,OAAA,QAAA,CAAS,QAAQ,UAAU,CAAA;AAAA,eAC3B,KAAO,EAAA;AACd,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAA8B,2BAAA,EAAA,QAAA,CAAS,eAAgB,EAAC,KAAK,KAAK,CAAA;AAAA,SACpE;AAAA;AACF,KACD;AAAA,GACH;AACF;;;;;"}
+{"version":3,"file":"connect-providers.cjs.js","sources":["../../src/providers/connect-providers.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport type { LoggerService } from '@backstage/backend-plugin-api';\n\nimport type { AuditLogger } from '@janus-idp/backstage-plugin-audit-log-node';\nimport {\n  Enforcer,\n  newEnforcer,\n  newModelFromString,\n  StringAdapter,\n} from 'casbin';\n\nimport type {\n  RBACProvider,\n  RBACProviderConnection,\n} from '@backstage-community/plugin-rbac-node';\n\nimport {\n  HANDLE_RBAC_DATA_STAGE,\n  PermissionAuditInfo,\n  PermissionEvents,\n  RBAC_BACKEND,\n  RoleAuditInfo,\n  RoleEvents,\n} from '../audit-log/audit-logger';\nimport { RoleMetadataStorage } from '../database/role-metadata';\nimport {\n  transformArrayToPolicy,\n  transformRolesGroupToLowercase,\n  typedPoliciesToString,\n} from '../helper';\nimport { EnforcerDelegate } from '../service/enforcer-delegate';\nimport { MODEL } from '../service/permission-model';\nimport {\n  validateGroupingPolicy,\n  validatePolicy,\n  validateSource,\n} from '../validation/policies-validation';\n\nexport class Connection implements RBACProviderConnection {\n  constructor(\n    private readonly id: string,\n    private readonly enforcer: EnforcerDelegate,\n    private readonly roleMetadataStorage: RoleMetadataStorage,\n    private readonly logger: LoggerService,\n    private readonly auditLogger: AuditLogger,\n  ) {}\n\n  async applyRoles(roles: string[][]): Promise<void> {\n    const lowercasedRoles = transformRolesGroupToLowercase(roles);\n    const stringPolicy = typedPoliciesToString(lowercasedRoles, 'g');\n    const providerRolesforRemoval: string[][] = [];\n\n    const tempEnforcer = await newEnforcer(\n      newModelFromString(MODEL),\n      new StringAdapter(stringPolicy),\n    );\n\n    const providerRoles = await this.getProviderRoles();\n\n    await this.enforcer.loadPolicy();\n    // Get the roles for this provider coming from rbac plugin\n    for (const providerRole of providerRoles) {\n      providerRolesforRemoval.push(\n        ...(await this.enforcer.getFilteredGroupingPolicy(1, providerRole)),\n      );\n    }\n\n    // Remove role\n    // role exists in rbac but does not exist in provider\n    await this.removeRoles(providerRolesforRemoval, tempEnforcer);\n\n    // Add the role\n    // role exists in provider but does not exist in rbac\n    await this.addRoles(lowercasedRoles);\n  }\n\n  async applyPermissions(permissions: string[][]): Promise<void> {\n    const stringPolicy = typedPoliciesToString(permissions, 'p');\n\n    const providerPermissions: string[][] = [];\n\n    const tempEnforcer = await newEnforcer(\n      newModelFromString(MODEL),\n      new StringAdapter(stringPolicy),\n    );\n\n    const providerRoles = await this.getProviderRoles();\n\n    await this.enforcer.loadPolicy();\n    // Get the roles for this provider coming from rbac plugin\n    for (const providerRole of providerRoles) {\n      providerPermissions.push(\n        ...(await this.enforcer.getFilteredPolicy(0, providerRole)),\n      );\n    }\n\n    await this.removePermissions(providerPermissions, tempEnforcer);\n\n    await this.addPermissions(permissions);\n  }\n\n  private async addRoles(roles: string[][]): Promise<void> {\n    for (const role of roles) {\n      if (!(await this.enforcer.hasGroupingPolicy(...role))) {\n        const err = await validateGroupingPolicy(\n          role,\n          this.roleMetadataStorage,\n          this.id,\n        );\n\n        if (err) {\n          this.logger.warn(err.message);\n          continue; // Skip adding this role as there was an error\n        }\n\n        let roleMeta = await this.roleMetadataStorage.findRoleMetadata(role[1]);\n\n        const eventName = roleMeta\n          ? RoleEvents.UPDATE_ROLE\n          : RoleEvents.CREATE_ROLE;\n        const message = roleMeta ? 'Updated role' : 'Created role';\n\n        // role does not exist in rbac, create the metadata for it\n        if (!roleMeta) {\n          roleMeta = {\n            modifiedBy: this.id,\n            source: this.id,\n            roleEntityRef: role[1],\n          };\n        }\n\n        await this.enforcer.addGroupingPolicy(role, roleMeta);\n\n        await this.auditLogger.auditLog<RoleAuditInfo>({\n          actorId: RBAC_BACKEND,\n          message,\n          eventName,\n          metadata: { ...roleMeta, members: [role[0]] },\n          stage: HANDLE_RBAC_DATA_STAGE,\n          status: 'succeeded',\n        });\n      }\n    }\n  }\n\n  private async removeRoles(\n    providerRoles: string[][],\n    tempEnforcer: Enforcer,\n  ): Promise<void> {\n    // Remove role\n    // role exists in rbac but does not exist in provider\n    const lowercasedProviderRoles =\n      transformRolesGroupToLowercase(providerRoles);\n    for (const role of lowercasedProviderRoles) {\n      if (!(await tempEnforcer.hasGroupingPolicy(...role))) {\n        const roleMeta = await this.roleMetadataStorage.findRoleMetadata(\n          role[1],\n        );\n\n        const currentRole = await this.enforcer.getFilteredGroupingPolicy(\n          1,\n          role[1],\n        );\n\n        if (!roleMeta) {\n          this.logger.warn('role does not exist');\n          continue;\n        }\n\n        const singleRole = roleMeta && currentRole.length === 1;\n\n        let eventName: string;\n        let message: string;\n\n        // Only one role exists in rbac remove role metadata as well\n        if (singleRole) {\n          eventName = RoleEvents.DELETE_ROLE;\n          message = 'Deleted role';\n          await this.enforcer.removeGroupingPolicy(role, roleMeta);\n\n          await this.auditLogger.auditLog<RoleAuditInfo>({\n            actorId: RBAC_BACKEND,\n            message,\n            eventName,\n            metadata: { ...roleMeta, members: [role[0]] },\n            stage: HANDLE_RBAC_DATA_STAGE,\n            status: 'succeeded',\n          });\n          continue; // Move on to the next role\n        }\n\n        eventName = RoleEvents.UPDATE_ROLE;\n        message = 'Updated role: deleted members';\n        await this.enforcer.removeGroupingPolicy(role, roleMeta, true);\n\n        await this.auditLogger.auditLog<RoleAuditInfo>({\n          actorId: RBAC_BACKEND,\n          message,\n          eventName,\n          metadata: { ...roleMeta, members: [role[0]] },\n          stage: HANDLE_RBAC_DATA_STAGE,\n          status: 'succeeded',\n        });\n      }\n    }\n  }\n\n  private async addPermissions(permissions: string[][]): Promise<void> {\n    for (const permission of permissions) {\n      if (!(await this.enforcer.hasPolicy(...permission))) {\n        const transformedPolicy = transformArrayToPolicy(permission);\n        const metadata = await this.roleMetadataStorage.findRoleMetadata(\n          permission[0],\n        );\n\n        let err = validatePolicy(transformedPolicy);\n        if (err) {\n          this.logger.warn(`Invalid permission policy, ${err}`);\n          continue; // Skip this invalid permission policy\n        }\n\n        err = await validateSource(this.id, metadata);\n        if (err) {\n          this.logger.warn(\n            `Unable to add policy ${permission}. Cause: ${err.message}`,\n          );\n          continue;\n        }\n\n        await this.enforcer.addPolicy(permission);\n\n        await this.auditLogger.auditLog<PermissionAuditInfo>({\n          actorId: RBAC_BACKEND,\n          message: `Created policy`,\n          eventName: PermissionEvents.CREATE_POLICY,\n          metadata: { policies: [permission], source: this.id },\n          stage: HANDLE_RBAC_DATA_STAGE,\n          status: 'succeeded',\n        });\n      }\n    }\n  }\n\n  private async removePermissions(\n    providerPermissions: string[][],\n    tempEnforcer: Enforcer,\n  ): Promise<void> {\n    const removedPermissions: string[][] = [];\n    for (const permission of providerPermissions) {\n      if (!(await tempEnforcer.hasPolicy(...permission))) {\n        await this.enforcer.removePolicy(permission);\n        removedPermissions.push(permission);\n      }\n\n      if (removedPermissions.length > 0) {\n        await this.auditLogger.auditLog<PermissionAuditInfo>({\n          actorId: RBAC_BACKEND,\n          message: `Deleted policies`,\n          eventName: PermissionEvents.DELETE_POLICY,\n          metadata: {\n            policies: removedPermissions,\n            source: this.id,\n          },\n          stage: HANDLE_RBAC_DATA_STAGE,\n          status: 'succeeded',\n        });\n      }\n    }\n  }\n\n  private async getProviderRoles(): Promise<string[]> {\n    const currentRoles = await this.roleMetadataStorage.filterRoleMetadata(\n      this.id,\n    );\n    return currentRoles.map(meta => meta.roleEntityRef);\n  }\n}\n\nexport async function connectRBACProviders(\n  providers: RBACProvider[],\n  enforcer: EnforcerDelegate,\n  roleMetadataStorage: RoleMetadataStorage,\n  logger: LoggerService,\n  auditLogger: AuditLogger,\n) {\n  await Promise.all(\n    providers.map(async provider => {\n      try {\n        const connection = new Connection(\n          provider.getProviderName(),\n          enforcer,\n          roleMetadataStorage,\n          logger,\n          auditLogger,\n        );\n        return provider.connect(connection);\n      } catch (error) {\n        throw new Error(\n          `Unable to connect provider ${provider.getProviderName()}, ${error}`,\n        );\n      }\n    }),\n  );\n}\n"],"names":["transformRolesGroupToLowercase","typedPoliciesToString","newEnforcer","newModelFromString","MODEL","StringAdapter","validateGroupingPolicy","RoleEvents","RBAC_BACKEND","HANDLE_RBAC_DATA_STAGE","transformArrayToPolicy","validatePolicy","validateSource","PermissionEvents"],"mappings":";;;;;;;;AAoDO,MAAM,UAA6C,CAAA;AAAA,EACxD,WACmB,CAAA,EAAA,EACA,QACA,EAAA,mBAAA,EACA,QACA,WACjB,EAAA;AALiB,IAAA,IAAA,CAAA,EAAA,GAAA,EAAA;AACA,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AACA,IAAA,IAAA,CAAA,mBAAA,GAAA,mBAAA;AACA,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,WAAA,GAAA,WAAA;AAAA;AAChB,EAEH,MAAM,WAAW,KAAkC,EAAA;AACjD,IAAM,MAAA,eAAA,GAAkBA,sCAA+B,KAAK,CAAA;AAC5D,IAAM,MAAA,YAAA,GAAeC,4BAAsB,CAAA,eAAA,EAAiB,GAAG,CAAA;AAC/D,IAAA,MAAM,0BAAsC,EAAC;AAE7C,IAAA,MAAM,eAAe,MAAMC,kBAAA;AAAA,MACzBC,0BAAmBC,qBAAK,CAAA;AAAA,MACxB,IAAIC,qBAAc,YAAY;AAAA,KAChC;AAEA,IAAM,MAAA,aAAA,GAAgB,MAAM,IAAA,CAAK,gBAAiB,EAAA;AAElD,IAAM,MAAA,IAAA,CAAK,SAAS,UAAW,EAAA;AAE/B,IAAA,KAAA,MAAW,gBAAgB,aAAe,EAAA;AACxC,MAAwB,uBAAA,CAAA,IAAA;AAAA,QACtB,GAAI,MAAM,IAAA,CAAK,QAAS,CAAA,yBAAA,CAA0B,GAAG,YAAY;AAAA,OACnE;AAAA;AAKF,IAAM,MAAA,IAAA,CAAK,WAAY,CAAA,uBAAA,EAAyB,YAAY,CAAA;AAI5D,IAAM,MAAA,IAAA,CAAK,SAAS,eAAe,CAAA;AAAA;AACrC,EAEA,MAAM,iBAAiB,WAAwC,EAAA;AAC7D,IAAM,MAAA,YAAA,GAAeJ,4BAAsB,CAAA,WAAA,EAAa,GAAG,CAAA;AAE3D,IAAA,MAAM,sBAAkC,EAAC;AAEzC,IAAA,MAAM,eAAe,MAAMC,kBAAA;AAAA,MACzBC,0BAAmBC,qBAAK,CAAA;AAAA,MACxB,IAAIC,qBAAc,YAAY;AAAA,KAChC;AAEA,IAAM,MAAA,aAAA,GAAgB,MAAM,IAAA,CAAK,gBAAiB,EAAA;AAElD,IAAM,MAAA,IAAA,CAAK,SAAS,UAAW,EAAA;AAE/B,IAAA,KAAA,MAAW,gBAAgB,aAAe,EAAA;AACxC,MAAoB,mBAAA,CAAA,IAAA;AAAA,QAClB,GAAI,MAAM,IAAA,CAAK,QAAS,CAAA,iBAAA,CAAkB,GAAG,YAAY;AAAA,OAC3D;AAAA;AAGF,IAAM,MAAA,IAAA,CAAK,iBAAkB,CAAA,mBAAA,EAAqB,YAAY,CAAA;AAE9D,IAAM,MAAA,IAAA,CAAK,eAAe,WAAW,CAAA;AAAA;AACvC,EAEA,MAAc,SAAS,KAAkC,EAAA;AACvD,IAAA,KAAA,MAAW,QAAQ,KAAO,EAAA;AACxB,MAAA,IAAI,CAAE,MAAM,IAAA,CAAK,SAAS,iBAAkB,CAAA,GAAG,IAAI,CAAI,EAAA;AACrD,QAAA,MAAM,MAAM,MAAMC,yCAAA;AAAA,UAChB,IAAA;AAAA,UACA,IAAK,CAAA,mBAAA;AAAA,UACL,IAAK,CAAA;AAAA,SACP;AAEA,QAAA,IAAI,GAAK,EAAA;AACP,UAAK,IAAA,CAAA,MAAA,CAAO,IAAK,CAAA,GAAA,CAAI,OAAO,CAAA;AAC5B,UAAA;AAAA;AAGF,QAAA,IAAI,WAAW,MAAM,IAAA,CAAK,oBAAoB,gBAAiB,CAAA,IAAA,CAAK,CAAC,CAAC,CAAA;AAEtE,QAAA,MAAM,SAAY,GAAA,QAAA,GACdC,sBAAW,CAAA,WAAA,GACXA,sBAAW,CAAA,WAAA;AACf,QAAM,MAAA,OAAA,GAAU,WAAW,cAAiB,GAAA,cAAA;AAG5C,QAAA,IAAI,CAAC,QAAU,EAAA;AACb,UAAW,QAAA,GAAA;AAAA,YACT,YAAY,IAAK,CAAA,EAAA;AAAA,YACjB,QAAQ,IAAK,CAAA,EAAA;AAAA,YACb,aAAA,EAAe,KAAK,CAAC;AAAA,WACvB;AAAA;AAGF,QAAA,MAAM,IAAK,CAAA,QAAA,CAAS,iBAAkB,CAAA,IAAA,EAAM,QAAQ,CAAA;AAEpD,QAAM,MAAA,IAAA,CAAK,YAAY,QAAwB,CAAA;AAAA,UAC7C,OAAS,EAAAC,wBAAA;AAAA,UACT,OAAA;AAAA,UACA,SAAA;AAAA,UACA,QAAA,EAAU,EAAE,GAAG,QAAA,EAAU,SAAS,CAAC,IAAA,CAAK,CAAC,CAAC,CAAE,EAAA;AAAA,UAC5C,KAAO,EAAAC,kCAAA;AAAA,UACP,MAAQ,EAAA;AAAA,SACT,CAAA;AAAA;AACH;AACF;AACF,EAEA,MAAc,WACZ,CAAA,aAAA,EACA,YACe,EAAA;AAGf,IAAM,MAAA,uBAAA,GACJT,sCAA+B,aAAa,CAAA;AAC9C,IAAA,KAAA,MAAW,QAAQ,uBAAyB,EAAA;AAC1C,MAAA,IAAI,CAAE,MAAM,YAAA,CAAa,iBAAkB,CAAA,GAAG,IAAI,CAAI,EAAA;AACpD,QAAM,MAAA,QAAA,GAAW,MAAM,IAAA,CAAK,mBAAoB,CAAA,gBAAA;AAAA,UAC9C,KAAK,CAAC;AAAA,SACR;AAEA,QAAM,MAAA,WAAA,GAAc,MAAM,IAAA,CAAK,QAAS,CAAA,yBAAA;AAAA,UACtC,CAAA;AAAA,UACA,KAAK,CAAC;AAAA,SACR;AAEA,QAAA,IAAI,CAAC,QAAU,EAAA;AACb,UAAK,IAAA,CAAA,MAAA,CAAO,KAAK,qBAAqB,CAAA;AACtC,UAAA;AAAA;AAGF,QAAM,MAAA,UAAA,GAAa,QAAY,IAAA,WAAA,CAAY,MAAW,KAAA,CAAA;AAEtD,QAAI,IAAA,SAAA;AACJ,QAAI,IAAA,OAAA;AAGJ,QAAA,IAAI,UAAY,EAAA;AACd,UAAA,SAAA,GAAYO,sBAAW,CAAA,WAAA;AACvB,UAAU,OAAA,GAAA,cAAA;AACV,UAAA,MAAM,IAAK,CAAA,QAAA,CAAS,oBAAqB,CAAA,IAAA,EAAM,QAAQ,CAAA;AAEvD,UAAM,MAAA,IAAA,CAAK,YAAY,QAAwB,CAAA;AAAA,YAC7C,OAAS,EAAAC,wBAAA;AAAA,YACT,OAAA;AAAA,YACA,SAAA;AAAA,YACA,QAAA,EAAU,EAAE,GAAG,QAAA,EAAU,SAAS,CAAC,IAAA,CAAK,CAAC,CAAC,CAAE,EAAA;AAAA,YAC5C,KAAO,EAAAC,kCAAA;AAAA,YACP,MAAQ,EAAA;AAAA,WACT,CAAA;AACD,UAAA;AAAA;AAGF,QAAA,SAAA,GAAYF,sBAAW,CAAA,WAAA;AACvB,QAAU,OAAA,GAAA,+BAAA;AACV,QAAA,MAAM,IAAK,CAAA,QAAA,CAAS,oBAAqB,CAAA,IAAA,EAAM,UAAU,IAAI,CAAA;AAE7D,QAAM,MAAA,IAAA,CAAK,YAAY,QAAwB,CAAA;AAAA,UAC7C,OAAS,EAAAC,wBAAA;AAAA,UACT,OAAA;AAAA,UACA,SAAA;AAAA,UACA,QAAA,EAAU,EAAE,GAAG,QAAA,EAAU,SAAS,CAAC,IAAA,CAAK,CAAC,CAAC,CAAE,EAAA;AAAA,UAC5C,KAAO,EAAAC,kCAAA;AAAA,UACP,MAAQ,EAAA;AAAA,SACT,CAAA;AAAA;AACH;AACF;AACF,EAEA,MAAc,eAAe,WAAwC,EAAA;AACnE,IAAA,KAAA,MAAW,cAAc,WAAa,EAAA;AACpC,MAAA,IAAI,CAAE,MAAM,IAAA,CAAK,SAAS,SAAU,CAAA,GAAG,UAAU,CAAI,EAAA;AACnD,QAAM,MAAA,iBAAA,GAAoBC,8BAAuB,UAAU,CAAA;AAC3D,QAAM,MAAA,QAAA,GAAW,MAAM,IAAA,CAAK,mBAAoB,CAAA,gBAAA;AAAA,UAC9C,WAAW,CAAC;AAAA,SACd;AAEA,QAAI,IAAA,GAAA,GAAMC,kCAAe,iBAAiB,CAAA;AAC1C,QAAA,IAAI,GAAK,EAAA;AACP,UAAA,IAAA,CAAK,MAAO,CAAA,IAAA,CAAK,CAA8B,2BAAA,EAAA,GAAG,CAAE,CAAA,CAAA;AACpD,UAAA;AAAA;AAGF,QAAA,GAAA,GAAM,MAAMC,iCAAA,CAAe,IAAK,CAAA,EAAA,EAAI,QAAQ,CAAA;AAC5C,QAAA,IAAI,GAAK,EAAA;AACP,UAAA,IAAA,CAAK,MAAO,CAAA,IAAA;AAAA,YACV,CAAwB,qBAAA,EAAA,UAAU,CAAY,SAAA,EAAA,GAAA,CAAI,OAAO,CAAA;AAAA,WAC3D;AACA,UAAA;AAAA;AAGF,QAAM,MAAA,IAAA,CAAK,QAAS,CAAA,SAAA,CAAU,UAAU,CAAA;AAExC,QAAM,MAAA,IAAA,CAAK,YAAY,QAA8B,CAAA;AAAA,UACnD,OAAS,EAAAJ,wBAAA;AAAA,UACT,OAAS,EAAA,CAAA,cAAA,CAAA;AAAA,UACT,WAAWK,4BAAiB,CAAA,aAAA;AAAA,UAC5B,QAAA,EAAU,EAAE,QAAU,EAAA,CAAC,UAAU,CAAG,EAAA,MAAA,EAAQ,KAAK,EAAG,EAAA;AAAA,UACpD,KAAO,EAAAJ,kCAAA;AAAA,UACP,MAAQ,EAAA;AAAA,SACT,CAAA;AAAA;AACH;AACF;AACF,EAEA,MAAc,iBACZ,CAAA,mBAAA,EACA,YACe,EAAA;AACf,IAAA,MAAM,qBAAiC,EAAC;AACxC,IAAA,KAAA,MAAW,cAAc,mBAAqB,EAAA;AAC5C,MAAA,IAAI,CAAE,MAAM,YAAA,CAAa,SAAU,CAAA,GAAG,UAAU,CAAI,EAAA;AAClD,QAAM,MAAA,IAAA,CAAK,QAAS,CAAA,YAAA,CAAa,UAAU,CAAA;AAC3C,QAAA,kBAAA,CAAmB,KAAK,UAAU,CAAA;AAAA;AAGpC,MAAI,IAAA,kBAAA,CAAmB,SAAS,CAAG,EAAA;AACjC,QAAM,MAAA,IAAA,CAAK,YAAY,QAA8B,CAAA;AAAA,UACnD,OAAS,EAAAD,wBAAA;AAAA,UACT,OAAS,EAAA,CAAA,gBAAA,CAAA;AAAA,UACT,WAAWK,4BAAiB,CAAA,aAAA;AAAA,UAC5B,QAAU,EAAA;AAAA,YACR,QAAU,EAAA,kBAAA;AAAA,YACV,QAAQ,IAAK,CAAA;AAAA,WACf;AAAA,UACA,KAAO,EAAAJ,kCAAA;AAAA,UACP,MAAQ,EAAA;AAAA,SACT,CAAA;AAAA;AACH;AACF;AACF,EAEA,MAAc,gBAAsC,GAAA;AAClD,IAAM,MAAA,YAAA,GAAe,MAAM,IAAA,CAAK,mBAAoB,CAAA,kBAAA;AAAA,MAClD,IAAK,CAAA;AAAA,KACP;AACA,IAAA,OAAO,YAAa,CAAA,GAAA,CAAI,CAAQ,IAAA,KAAA,IAAA,CAAK,aAAa,CAAA;AAAA;AAEtD;AAEA,eAAsB,oBACpB,CAAA,SAAA,EACA,QACA,EAAA,mBAAA,EACA,QACA,WACA,EAAA;AACA,EAAA,MAAM,OAAQ,CAAA,GAAA;AAAA,IACZ,SAAA,CAAU,GAAI,CAAA,OAAM,QAAY,KAAA;AAC9B,MAAI,IAAA;AACF,QAAA,MAAM,aAAa,IAAI,UAAA;AAAA,UACrB,SAAS,eAAgB,EAAA;AAAA,UACzB,QAAA;AAAA,UACA,mBAAA;AAAA,UACA,MAAA;AAAA,UACA;AAAA,SACF;AACA,QAAO,OAAA,QAAA,CAAS,QAAQ,UAAU,CAAA;AAAA,eAC3B,KAAO,EAAA;AACd,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAA8B,2BAAA,EAAA,QAAA,CAAS,eAAgB,EAAC,KAAK,KAAK,CAAA;AAAA,SACpE;AAAA;AACF,KACD;AAAA,GACH;AACF;;;;;"}

package/dist/service/policies-rest-api.cjs.js

@@ -316,6 +316,7 @@ class PoliciesServer {
           `Invalid role definition. Cause: ${err.message}`
         );
       }
+      this.transformMemberReferencesToLowercase(roleRaw);
       const rMetadata = await this.roleMetadata.findRoleMetadata(roleRaw.name);
       err = await policiesValidation.validateSource("rest", rMetadata);
       if (err) {
@@ -396,6 +397,8 @@ class PoliciesServer {
           `Invalid new role object. Cause: ${err.message}`
         );
       }
+      this.transformMemberReferencesToLowercase(oldRoleRaw);
+      this.transformMemberReferencesToLowercase(newRoleRaw);
       const oldRole = this.transformRoleToArray(oldRoleRaw);
       const newRole = this.transformRoleToArray(newRoleRaw);
       const credentials = await httpAuth.credentials(request, {
@@ -496,7 +499,7 @@ class PoliciesServer {
         if (request.query.memberReferences) {
           const memberReference = this.getFirstQuery(
             request.query.memberReferences
-          );
+          ).toLocaleLowerCase("en-US");
           const gp = await this.enforcer.getFilteredGroupingPolicy(
             0,
             memberReference,
@@ -838,6 +841,11 @@ class PoliciesServer {
     }
     return roles;
   }
+  transformMemberReferencesToLowercase(role) {
+    role.memberReferences = role.memberReferences.map(
+      (member) => member.toLocaleLowerCase("en-US")
+    );
+  }
   getActionQueries(queryValue) {
     if (!queryValue) {
       return void 0;

package/dist/service/policies-rest-api.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"policies-rest-api.cjs.js","sources":["../../src/service/policies-rest-api.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport type { PermissionsService } from '@backstage/backend-plugin-api';\nimport {\n  ConflictError,\n  InputError,\n  NotAllowedError,\n  NotFoundError,\n  ServiceUnavailableError,\n} from '@backstage/errors';\nimport { createRouter } from '@backstage/plugin-permission-backend';\nimport {\n  AuthorizeResult,\n  PolicyDecision,\n  ResourcePermission,\n} from '@backstage/plugin-permission-common';\nimport { createPermissionIntegrationRouter } from '@backstage/plugin-permission-node';\n\nimport type { AuditLogger } from '@janus-idp/backstage-plugin-audit-log-node';\nimport express from 'express';\nimport type { Request } from 'express-serve-static-core';\nimport { isEmpty, isEqual } from 'lodash';\nimport type { ParsedQs } from 'qs';\n\nimport {\n  PermissionAction,\n  policyEntityCreatePermission,\n  policyEntityDeletePermission,\n  policyEntityPermissions,\n  policyEntityReadPermission,\n  policyEntityUpdatePermission,\n  RESOURCE_TYPE_POLICY_ENTITY,\n  Role,\n  RoleBasedPolicy,\n  RoleConditionalPolicyDecision,\n} from '@backstage-community/plugin-rbac-common';\nimport type { RBACProvider } from '@backstage-community/plugin-rbac-node';\n\nimport {\n  ConditionAuditInfo,\n  ConditionEvents,\n  ListConditionEvents,\n  ListPluginPoliciesEvents,\n  PermissionAuditInfo,\n  PermissionEvents,\n  RoleAuditInfo,\n  RoleEvents,\n  SEND_RESPONSE_STAGE,\n} from '../audit-log/audit-logger';\nimport { auditError as logAuditError } from '../audit-log/rest-errors-interceptor';\nimport { ConditionalStorage } from '../database/conditional-storage';\nimport {\n  daoToMetadata,\n  RoleMetadataDao,\n  RoleMetadataStorage,\n} from '../database/role-metadata';\nimport {\n  buildRoleSourceMap,\n  deepSortedEqual,\n  isPermissionAction,\n  policyToString,\n  processConditionMapping,\n} from '../helper';\nimport { validateRoleCondition } from '../validation/condition-validation';\nimport {\n  validateEntityReference,\n  validatePolicy,\n  validateRole,\n  validateSource,\n} from '../validation/policies-validation';\nimport { EnforcerDelegate } from './enforcer-delegate';\nimport { PluginPermissionMetadataCollector } from './plugin-endpoints';\nimport { RBACRouterOptions } from './policy-builder';\n\nexport class PoliciesServer {\n  constructor(\n    private readonly permissions: PermissionsService,\n    private readonly options: RBACRouterOptions,\n    private readonly enforcer: EnforcerDelegate,\n    private readonly conditionalStorage: ConditionalStorage,\n    private readonly pluginPermMetaData: PluginPermissionMetadataCollector,\n    private readonly roleMetadata: RoleMetadataStorage,\n    private readonly aLog: AuditLogger,\n    private readonly rbacProviders?: RBACProvider[],\n  ) {}\n\n  private async authorize(\n    request: Request,\n    permission: ResourcePermission,\n  ): Promise<PolicyDecision> {\n    const credentials = await this.options.httpAuth.credentials(request, {\n      allow: ['user', 'service'],\n    });\n\n    // allow service to service communication, but only with read permission\n    if (\n      this.options.auth.isPrincipal(credentials, 'service') &&\n      permission !== policyEntityReadPermission\n    ) {\n      throw new NotAllowedError(\n        `Only creadential principal with type 'user' permitted to modify permissions`,\n      );\n    }\n\n    const decision = (\n      await this.permissions.authorize(\n        [{ permission: permission, resourceRef: permission.resourceType }],\n        { credentials },\n      )\n    )[0];\n\n    return decision;\n  }\n\n  async serve(): Promise<express.Router> {\n    const router = await createRouter(this.options);\n\n    const { httpAuth } = this.options;\n\n    if (!httpAuth) {\n      throw new ServiceUnavailableError(\n        'httpAuth not found, ensure the correct configuration for the RBAC plugin',\n      );\n    }\n\n    const permissionsIntegrationRouter = createPermissionIntegrationRouter({\n      resourceType: RESOURCE_TYPE_POLICY_ENTITY,\n      permissions: policyEntityPermissions,\n    });\n    router.use(permissionsIntegrationRouter);\n\n    const isPluginEnabled =\n      this.options.config.getOptionalBoolean('permission.enabled');\n    if (!isPluginEnabled) {\n      return router;\n    }\n\n    router.get('/', async (request, response) => {\n      const decision = await this.authorize(\n        request,\n        policyEntityReadPermission,\n      );\n\n      if (decision.result === AuthorizeResult.DENY) {\n        throw new NotAllowedError(); // 403\n      }\n      response.send({ status: 'Authorized' });\n    });\n\n    // Policy CRUD\n\n    router.get('/policies', async (request, response) => {\n      const decision = await this.authorize(\n        request,\n        policyEntityReadPermission,\n      );\n\n      if (decision.result === AuthorizeResult.DENY) {\n        throw new NotAllowedError(); // 403\n      }\n\n      let policies: string[][];\n      if (this.isPolicyFilterEnabled(request)) {\n        const entityRef = this.getFirstQuery(request.query.entityRef);\n        const permission = this.getFirstQuery(request.query.permission);\n        const policy = this.getFirstQuery(request.query.policy);\n        const effect = this.getFirstQuery(request.query.effect);\n\n        const filter: string[] = [entityRef, permission, policy, effect];\n        policies = await this.enforcer.getFilteredPolicy(0, ...filter);\n      } else {\n        policies = await this.enforcer.getPolicy();\n      }\n\n      const body = await this.transformPolicyArray(...policies);\n\n      await this.aLog.auditLog({\n        message: `Return list permission policies`,\n        eventName: PermissionEvents.GET_POLICY,\n        stage: SEND_RESPONSE_STAGE,\n        status: 'succeeded',\n        request,\n        response: { status: 200, body },\n      });\n\n      response.json(body);\n    });\n\n    router.get(\n      '/policies/:kind/:namespace/:name',\n      async (request, response) => {\n        const decision = await this.authorize(\n          request,\n          policyEntityReadPermission,\n        );\n\n        if (decision.result === AuthorizeResult.DENY) {\n          throw new NotAllowedError(); // 403\n        }\n\n        const entityRef = this.getEntityReference(request);\n\n        const policy = await this.enforcer.getFilteredPolicy(0, entityRef);\n        if (policy.length !== 0) {\n          const body = await this.transformPolicyArray(...policy);\n\n          await this.aLog.auditLog({\n            message: `Return permission policy`,\n            eventName: PermissionEvents.GET_POLICY,\n            stage: SEND_RESPONSE_STAGE,\n            status: 'succeeded',\n            request,\n            response: { status: 200, body },\n          });\n\n          response.json(body);\n        } else {\n          throw new NotFoundError(); // 404\n        }\n      },\n    );\n\n    router.delete(\n      '/policies/:kind/:namespace/:name',\n      async (request, response) => {\n        const decision = await this.authorize(\n          request,\n          policyEntityDeletePermission,\n        );\n\n        if (decision.result === AuthorizeResult.DENY) {\n          throw new NotAllowedError(); // 403\n        }\n\n        const entityRef = this.getEntityReference(request);\n\n        const policyRaw: RoleBasedPolicy[] = request.body;\n        if (isEmpty(policyRaw)) {\n          throw new InputError(`permission policy must be present`); // 400\n        }\n\n        policyRaw.forEach(element => {\n          element.entityReference = entityRef;\n        });\n\n        const processedPolicies = await this.processPolicies(policyRaw, true);\n\n        await this.enforcer.removePolicies(processedPolicies);\n\n        await this.aLog.auditLog<PermissionAuditInfo>({\n          message: `Deleted permission policies`,\n          eventName: PermissionEvents.DELETE_POLICY,\n          metadata: { policies: processedPolicies, source: 'rest' },\n          stage: SEND_RESPONSE_STAGE,\n          status: 'succeeded',\n          request,\n          response: { status: 204 },\n        });\n\n        response.status(204).end();\n      },\n    );\n\n    router.post('/policies', async (request, response) => {\n      const decision = await this.authorize(\n        request,\n        policyEntityCreatePermission,\n      );\n\n      if (decision.result === AuthorizeResult.DENY) {\n        throw new NotAllowedError(); // 403\n      }\n\n      const policyRaw: RoleBasedPolicy[] = request.body;\n\n      if (isEmpty(policyRaw)) {\n        throw new InputError(`permission policy must be present`); // 400\n      }\n\n      const processedPolicies = await this.processPolicies(policyRaw);\n\n      const entityRef = processedPolicies[0][0];\n      const roleMetadata = await this.roleMetadata.findRoleMetadata(entityRef);\n      if (entityRef.startsWith('role:default') && !roleMetadata) {\n        throw new Error(`Corresponding role ${entityRef} was not found`);\n      }\n\n      await this.enforcer.addPolicies(processedPolicies);\n\n      await this.aLog.auditLog<PermissionAuditInfo>({\n        message: `Created permission policies`,\n        eventName: PermissionEvents.CREATE_POLICY,\n        metadata: { policies: processedPolicies, source: 'rest' },\n        stage: SEND_RESPONSE_STAGE,\n        status: 'succeeded',\n        request,\n        response: { status: 201 },\n      });\n\n      response.status(201).end();\n    });\n\n    router.put(\n      '/policies/:kind/:namespace/:name',\n      async (request, response) => {\n        const decision = await this.authorize(\n          request,\n          policyEntityUpdatePermission,\n        );\n\n        if (decision.result === AuthorizeResult.DENY) {\n          throw new NotAllowedError(); // 403\n        }\n\n        const entityRef = this.getEntityReference(request);\n\n        const oldPolicyRaw: RoleBasedPolicy[] = request.body.oldPolicy;\n        if (isEmpty(oldPolicyRaw)) {\n          throw new InputError(`'oldPolicy' object must be present`); // 400\n        }\n        const newPolicyRaw: RoleBasedPolicy[] = request.body.newPolicy;\n        if (isEmpty(newPolicyRaw)) {\n          throw new InputError(`'newPolicy' object must be present`); // 400\n        }\n\n        [...oldPolicyRaw, ...newPolicyRaw].forEach(element => {\n          element.entityReference = entityRef;\n        });\n\n        const processedOldPolicy = await this.processPolicies(\n          oldPolicyRaw,\n          true,\n          'old policy',\n        );\n\n        oldPolicyRaw.sort((a, b) =>\n          a.permission === b.permission\n            ? this.nameSort(a.policy!, b.policy!)\n            : this.nameSort(a.permission!, b.permission!),\n        );\n\n        newPolicyRaw.sort((a, b) =>\n          a.permission === b.permission\n            ? this.nameSort(a.policy!, b.policy!)\n            : this.nameSort(a.permission!, b.permission!),\n        );\n\n        if (\n          isEqual(oldPolicyRaw, newPolicyRaw) &&\n          !oldPolicyRaw.some(isEmpty)\n        ) {\n          response.status(204).end();\n        } else if (oldPolicyRaw.length > newPolicyRaw.length) {\n          throw new InputError(\n            `'oldPolicy' object has more permission policies compared to 'newPolicy' object`,\n          );\n        }\n\n        const processedNewPolicy = await this.processPolicies(\n          newPolicyRaw,\n          false,\n          'new policy',\n        );\n\n        const roleMetadata =\n          await this.roleMetadata.findRoleMetadata(entityRef);\n        if (entityRef.startsWith('role:default') && !roleMetadata) {\n          throw new Error(`Corresponding role ${entityRef} was not found`);\n        }\n\n        await this.enforcer.updatePolicies(\n          processedOldPolicy,\n          processedNewPolicy,\n        );\n\n        await this.aLog.auditLog<PermissionAuditInfo>({\n          message: `Updated permission policies`,\n          eventName: PermissionEvents.UPDATE_POLICY,\n          metadata: { policies: processedNewPolicy, source: 'rest' },\n          stage: SEND_RESPONSE_STAGE,\n          status: 'succeeded',\n          request,\n          response: { status: 200 },\n        });\n\n        response.status(200).end();\n      },\n    );\n\n    // Role CRUD\n\n    router.get('/roles', async (request, response) => {\n      const decision = await this.authorize(\n        request,\n        policyEntityReadPermission,\n      );\n\n      if (decision.result === AuthorizeResult.DENY) {\n        throw new NotAllowedError(); // 403\n      }\n\n      const roles = await this.enforcer.getGroupingPolicy();\n\n      const body = await this.transformRoleArray(...roles);\n\n      await this.aLog.auditLog({\n        message: `Return list roles`,\n        eventName: RoleEvents.GET_ROLE,\n        stage: SEND_RESPONSE_STAGE,\n        status: 'succeeded',\n        request,\n        response: { status: 200, body },\n      });\n\n      response.json(body);\n    });\n\n    router.get('/roles/:kind/:namespace/:name', async (request, response) => {\n      const decision = await this.authorize(\n        request,\n        policyEntityReadPermission,\n      );\n\n      if (decision.result === AuthorizeResult.DENY) {\n        throw new NotAllowedError(); // 403\n      }\n      const roleEntityRef = this.getEntityReference(request, true);\n\n      const role = await this.enforcer.getFilteredGroupingPolicy(\n        1,\n        roleEntityRef,\n      );\n\n      if (role.length !== 0) {\n        const body = await this.transformRoleArray(...role);\n\n        await this.aLog.auditLog({\n          message: `Return ${body[0].name}`,\n          eventName: RoleEvents.GET_ROLE,\n          stage: SEND_RESPONSE_STAGE,\n          status: 'succeeded',\n          request,\n          response: { status: 200, body },\n        });\n\n        response.json(body);\n      } else {\n        throw new NotFoundError(); // 404\n      }\n    });\n\n    router.post('/roles', async (request, response) => {\n      const uniqueItems = new Set<string>();\n      const decision = await this.authorize(\n        request,\n        policyEntityCreatePermission,\n      );\n\n      if (decision.result === AuthorizeResult.DENY) {\n        throw new NotAllowedError(); // 403\n      }\n      const roleRaw: Role = request.body;\n      let err = validateRole(roleRaw);\n      if (err) {\n        throw new InputError( // 400\n          `Invalid role definition. Cause: ${err.message}`,\n        );\n      }\n\n      const rMetadata = await this.roleMetadata.findRoleMetadata(roleRaw.name);\n\n      err = await validateSource('rest', rMetadata);\n      if (err) {\n        throw new NotAllowedError(`Unable to add role: ${err.message}`);\n      }\n\n      const roles = this.transformRoleToArray(roleRaw);\n\n      for (const role of roles) {\n        if (await this.enforcer.hasGroupingPolicy(...role)) {\n          throw new ConflictError(); // 409\n        }\n        const roleString = JSON.stringify(role);\n\n        if (uniqueItems.has(roleString)) {\n          throw new ConflictError(\n            `Duplicate role members found; ${role.at(0)}, ${role.at(\n              1,\n            )} is a duplicate`,\n          );\n        } else {\n          uniqueItems.add(roleString);\n        }\n      }\n\n      const credentials = await httpAuth.credentials(request, {\n        allow: ['user'],\n      });\n      const modifiedBy = credentials.principal.userEntityRef;\n      const metadata: RoleMetadataDao = {\n        roleEntityRef: roleRaw.name,\n        source: 'rest',\n        description: roleRaw.metadata?.description ?? '',\n        author: modifiedBy,\n        modifiedBy,\n      };\n\n      await this.enforcer.addGroupingPolicies(roles, metadata);\n\n      await this.aLog.auditLog<RoleAuditInfo>({\n        message: `Created ${metadata.roleEntityRef}`,\n        eventName: RoleEvents.CREATE_ROLE,\n        metadata: {\n          ...metadata,\n          members: roles.map(gp => gp[0]),\n        },\n        stage: SEND_RESPONSE_STAGE,\n        status: 'succeeded',\n        request,\n        response: { status: 201 },\n      });\n\n      response.status(201).end();\n    });\n\n    router.put('/roles/:kind/:namespace/:name', async (request, response) => {\n      const uniqueItems = new Set<string>();\n      const decision = await this.authorize(\n        request,\n        policyEntityUpdatePermission,\n      );\n\n      if (decision.result === AuthorizeResult.DENY) {\n        throw new NotAllowedError(); // 403\n      }\n      const roleEntityRef = this.getEntityReference(request, true);\n\n      const oldRoleRaw: Role = request.body.oldRole;\n\n      if (!oldRoleRaw) {\n        throw new InputError(`'oldRole' object must be present`); // 400\n      }\n      const newRoleRaw: Role = request.body.newRole;\n      if (!newRoleRaw) {\n        throw new InputError(`'newRole' object must be present`); // 400\n      }\n\n      oldRoleRaw.name = roleEntityRef;\n      let err = validateRole(oldRoleRaw);\n      if (err) {\n        throw new InputError( // 400\n          `Invalid old role object. Cause: ${err.message}`,\n        );\n      }\n      err = validateRole(newRoleRaw);\n      if (err) {\n        throw new InputError( // 400\n          `Invalid new role object. Cause: ${err.message}`,\n        );\n      }\n\n      const oldRole = this.transformRoleToArray(oldRoleRaw);\n      const newRole = this.transformRoleToArray(newRoleRaw);\n      // todo shell we allow newRole with an empty array?...\n\n      const credentials = await httpAuth.credentials(request, {\n        allow: ['user'],\n      });\n\n      const newMetadata: RoleMetadataDao = {\n        ...newRoleRaw.metadata,\n        source: newRoleRaw.metadata?.source ?? 'rest',\n        roleEntityRef: newRoleRaw.name,\n        modifiedBy: credentials.principal.userEntityRef,\n      };\n\n      const oldMetadata =\n        await this.roleMetadata.findRoleMetadata(roleEntityRef);\n      if (!oldMetadata) {\n        throw new NotFoundError(`Unable to find metadata for ${roleEntityRef}`);\n      }\n\n      err = await validateSource('rest', oldMetadata);\n      if (err) {\n        throw new NotAllowedError(`Unable to edit role: ${err.message}`);\n      }\n\n      if (\n        isEqual(oldRole, newRole) &&\n        deepSortedEqual(oldMetadata, newMetadata, [\n          'author',\n          'modifiedBy',\n          'createdAt',\n          'lastModified',\n        ])\n      ) {\n        // no content: old role and new role are equal and their metadata too\n        response.status(204).end();\n        return;\n      }\n\n      for (const role of newRole) {\n        const hasRole = oldRole.some(element => {\n          return isEqual(element, role);\n        });\n        // if the role is already part of old role and is a grouping policy we want to skip returning a conflict error\n        // to allow for other roles to be checked and added\n        if (await this.enforcer.hasGroupingPolicy(...role)) {\n          if (!hasRole) {\n            throw new ConflictError(); // 409\n          }\n        }\n        const roleString = JSON.stringify(role);\n\n        if (uniqueItems.has(roleString)) {\n          throw new ConflictError(\n            `Duplicate role members found; ${role.at(0)}, ${role.at(\n              1,\n            )} is a duplicate`,\n          );\n        } else {\n          uniqueItems.add(roleString);\n        }\n      }\n\n      uniqueItems.clear();\n      for (const role of oldRole) {\n        if (!(await this.enforcer.hasGroupingPolicy(...role))) {\n          throw new NotFoundError(\n            `Member reference: ${role[0]} was not found for role ${roleEntityRef}`,\n          ); // 404\n        }\n        const roleString = JSON.stringify(role);\n\n        if (uniqueItems.has(roleString)) {\n          throw new ConflictError(\n            `Duplicate role members found; ${role.at(0)}, ${role.at(\n              1,\n            )} is a duplicate`,\n          );\n        } else {\n          uniqueItems.add(roleString);\n        }\n      }\n\n      await this.enforcer.updateGroupingPolicies(oldRole, newRole, newMetadata);\n\n      let message = `Updated ${oldMetadata.roleEntityRef}.`;\n      if (newMetadata.roleEntityRef !== oldMetadata.roleEntityRef) {\n        message = `${message}. Role entity reference renamed to ${newMetadata.roleEntityRef}`;\n      }\n      await this.aLog.auditLog<RoleAuditInfo>({\n        message,\n        eventName: RoleEvents.UPDATE_ROLE,\n        metadata: {\n          ...newMetadata,\n          members: newRole.map(gp => gp[0]),\n        },\n        stage: SEND_RESPONSE_STAGE,\n        status: 'succeeded',\n        request,\n        response: { status: 200 },\n      });\n\n      response.status(200).end();\n    });\n\n    router.delete(\n      '/roles/:kind/:namespace/:name',\n      async (request, response) => {\n        const decision = await this.authorize(\n          request,\n          policyEntityDeletePermission,\n        );\n\n        if (decision.result === AuthorizeResult.DENY) {\n          throw new NotAllowedError(); // 403\n        }\n\n        const roleEntityRef = this.getEntityReference(request, true);\n\n        let roleMembers = [];\n        if (request.query.memberReferences) {\n          const memberReference = this.getFirstQuery(\n            request.query.memberReferences!,\n          );\n          const gp = await this.enforcer.getFilteredGroupingPolicy(\n            0,\n            memberReference,\n            roleEntityRef,\n          );\n          if (gp.length > 0) {\n            roleMembers.push(gp[0]);\n          } else {\n            throw new NotFoundError(\n              `role member '${memberReference}' was not found`,\n            ); // 404\n          }\n        } else {\n          roleMembers = await this.enforcer.getFilteredGroupingPolicy(\n            1,\n            roleEntityRef,\n          );\n        }\n\n        for (const role of roleMembers) {\n          if (!(await this.enforcer.hasGroupingPolicy(...role))) {\n            throw new NotFoundError(`role member '${role[0]}' was not found`);\n          }\n        }\n\n        const currentMetadata =\n          await this.roleMetadata.findRoleMetadata(roleEntityRef);\n        const err = await validateSource('rest', currentMetadata);\n        if (err) {\n          throw new NotAllowedError(`Unable to delete role: ${err.message}`);\n        }\n\n        const credentials = await httpAuth.credentials(request, {\n          allow: ['user'],\n        });\n\n        const metadata: RoleMetadataDao = {\n          roleEntityRef,\n          source: 'rest',\n          modifiedBy: credentials.principal.userEntityRef,\n        };\n\n        await this.enforcer.removeGroupingPolicies(\n          roleMembers,\n          metadata,\n          false,\n        );\n\n        await this.aLog.auditLog<RoleAuditInfo>({\n          message: `Deleted ${metadata.roleEntityRef}`,\n          eventName: RoleEvents.DELETE_ROLE,\n          metadata: {\n            ...metadata,\n            members: roleMembers.map(gp => gp[0]),\n          },\n          stage: SEND_RESPONSE_STAGE,\n          status: 'succeeded',\n          request,\n          response: { status: 204 },\n        });\n\n        response.status(204).end();\n      },\n    );\n\n    router.get('/plugins/policies', async (request, response) => {\n      const decision = await this.authorize(\n        request,\n        policyEntityReadPermission,\n      );\n\n      if (decision.result === AuthorizeResult.DENY) {\n        throw new NotAllowedError(); // 403\n      }\n\n      const body = await this.pluginPermMetaData.getPluginPolicies(\n        this.options.auth,\n      );\n\n      await this.aLog.auditLog({\n        message: `Return list plugin policies`,\n        eventName: ListPluginPoliciesEvents.GET_PLUGINS_POLICIES,\n        stage: SEND_RESPONSE_STAGE,\n        status: 'succeeded',\n        request,\n        response: { status: 200, body },\n      });\n\n      response.json(body);\n    });\n\n    router.get('/plugins/condition-rules', async (request, response) => {\n      const decision = await this.authorize(\n        request,\n        policyEntityReadPermission,\n      );\n\n      if (decision.result === AuthorizeResult.DENY) {\n        throw new NotAllowedError(); // 403\n      }\n\n      const body = await this.pluginPermMetaData.getPluginConditionRules(\n        this.options.auth,\n      );\n\n      await this.aLog.auditLog({\n        message: `Return list conditional rules and schemas`,\n        eventName: ListConditionEvents.GET_CONDITION_RULES,\n        stage: SEND_RESPONSE_STAGE,\n        status: 'succeeded',\n        request,\n        response: { status: 200, body },\n      });\n\n      response.json(body);\n    });\n\n    router.get('/roles/conditions', async (request, response) => {\n      const decision = await this.authorize(\n        request,\n        policyEntityReadPermission,\n      );\n\n      if (decision.result === AuthorizeResult.DENY) {\n        throw new NotAllowedError(); // 403\n      }\n\n      const conditions = await this.conditionalStorage.filterConditions(\n        this.getFirstQuery(request.query.roleEntityRef),\n        this.getFirstQuery(request.query.pluginId),\n        this.getFirstQuery(request.query.resourceType),\n        this.getActionQueries(request.query.actions),\n      );\n\n      const body: RoleConditionalPolicyDecision<PermissionAction>[] =\n        conditions.map(condition => {\n          return {\n            ...condition,\n            permissionMapping: condition.permissionMapping.map(pm => pm.action),\n          };\n        });\n\n      await this.aLog.auditLog({\n        message: `Return list conditional permission policies`,\n        eventName: ConditionEvents.GET_CONDITION,\n        stage: SEND_RESPONSE_STAGE,\n        status: 'succeeded',\n        request,\n        response: { status: 200, body },\n      });\n\n      response.json(body);\n    });\n\n    router.post('/roles/conditions', async (request, response) => {\n      const decision = await this.authorize(\n        request,\n        policyEntityCreatePermission,\n      );\n\n      if (decision.result === AuthorizeResult.DENY) {\n        throw new NotAllowedError(); // 403\n      }\n\n      const roleConditionPolicy: RoleConditionalPolicyDecision<PermissionAction> =\n        request.body;\n      validateRoleCondition(roleConditionPolicy);\n\n      const conditionToCreate = await processConditionMapping(\n        roleConditionPolicy,\n        this.pluginPermMetaData,\n        this.options.auth,\n      );\n\n      const id =\n        await this.conditionalStorage.createCondition(conditionToCreate);\n\n      const body = { id: id };\n\n      await this.aLog.auditLog<ConditionAuditInfo>({\n        message: `Created conditional permission policy`,\n        eventName: ConditionEvents.CREATE_CONDITION,\n        metadata: { condition: roleConditionPolicy },\n        stage: SEND_RESPONSE_STAGE,\n        status: 'succeeded',\n        request,\n        response: { status: 201, body },\n      });\n\n      response.status(201).json(body);\n    });\n\n    router.get('/roles/conditions/:id', async (request, response) => {\n      const decision = await this.authorize(\n        request,\n        policyEntityReadPermission,\n      );\n\n      if (decision.result === AuthorizeResult.DENY) {\n        throw new NotAllowedError(); // 403\n      }\n\n      const id: number = parseInt(request.params.id, 10);\n      if (isNaN(id)) {\n        throw new InputError('Id is not a valid number.');\n      }\n\n      const condition = await this.conditionalStorage.getCondition(id);\n      if (!condition) {\n        throw new NotFoundError();\n      }\n\n      const body: RoleConditionalPolicyDecision<PermissionAction> = {\n        ...condition,\n        permissionMapping: condition.permissionMapping.map(pm => pm.action),\n      };\n\n      await this.aLog.auditLog({\n        message: `Return conditional permission policy by id`,\n        eventName: ConditionEvents.GET_CONDITION,\n        stage: SEND_RESPONSE_STAGE,\n        status: 'succeeded',\n        request,\n        response: { status: 200, body },\n      });\n\n      response.json(body);\n    });\n\n    router.delete('/roles/conditions/:id', async (request, response) => {\n      const decision = await this.authorize(\n        request,\n        policyEntityDeletePermission,\n      );\n\n      if (decision.result === AuthorizeResult.DENY) {\n        throw new NotAllowedError(); // 403\n      }\n\n      const id: number = parseInt(request.params.id, 10);\n      if (isNaN(id)) {\n        throw new InputError('Id is not a valid number.');\n      }\n\n      const condition = await this.conditionalStorage.getCondition(id);\n      if (!condition) {\n        throw new NotFoundError(`Condition with id ${id} was not found`);\n      }\n      const conditionToDelete: RoleConditionalPolicyDecision<PermissionAction> =\n        {\n          ...condition,\n          permissionMapping: condition.permissionMapping.map(pm => pm.action),\n        };\n\n      await this.conditionalStorage.deleteCondition(id);\n\n      await this.aLog.auditLog<ConditionAuditInfo>({\n        message: `Deleted conditional permission policy`,\n        eventName: ConditionEvents.DELETE_CONDITION,\n        metadata: { condition: conditionToDelete },\n        stage: SEND_RESPONSE_STAGE,\n        status: 'succeeded',\n        request,\n        response: { status: 204 },\n      });\n\n      response.status(204).end();\n    });\n\n    router.put('/roles/conditions/:id', async (request, response) => {\n      const decision = await this.authorize(\n        request,\n        policyEntityUpdatePermission,\n      );\n\n      if (decision.result === AuthorizeResult.DENY) {\n        throw new NotAllowedError(); // 403\n      }\n\n      const id: number = parseInt(request.params.id, 10);\n      if (isNaN(id)) {\n        throw new InputError('Id is not a valid number.');\n      }\n\n      const roleConditionPolicy: RoleConditionalPolicyDecision<PermissionAction> =\n        request.body;\n\n      validateRoleCondition(roleConditionPolicy);\n\n      const conditionToUpdate = await processConditionMapping(\n        roleConditionPolicy,\n        this.pluginPermMetaData,\n        this.options.auth,\n      );\n\n      await this.conditionalStorage.updateCondition(id, conditionToUpdate);\n\n      await this.aLog.auditLog<ConditionAuditInfo>({\n        message: `Updated conditional permission policy`,\n        eventName: ConditionEvents.UPDATE_CONDITION,\n        metadata: { condition: roleConditionPolicy },\n        stage: SEND_RESPONSE_STAGE,\n        status: 'succeeded',\n        request,\n        response: { status: 200 },\n      });\n\n      response.status(200).end();\n    });\n\n    router.post('/refresh/:id', async (request, response) => {\n      const decision = await this.authorize(\n        request,\n        policyEntityCreatePermission,\n      );\n\n      if (decision.result === AuthorizeResult.DENY) {\n        throw new NotAllowedError(); // 403\n      }\n\n      if (!this.rbacProviders) {\n        throw new NotFoundError(`No RBAC providers were found`);\n      }\n\n      const idProvider = this.rbacProviders.find(provider => {\n        const id = provider.getProviderName();\n        return id === request.params.id;\n      });\n\n      if (!idProvider) {\n        throw new NotFoundError(\n          `The RBAC provider ${request.params.id} was not found`,\n        );\n      }\n\n      await idProvider.refresh();\n      response.status(200).end();\n    });\n\n    router.use(logAuditError(this.aLog));\n\n    return router;\n  }\n\n  getEntityReference(request: Request, role?: boolean): string {\n    const kind = request.params.kind;\n    const namespace = request.params.namespace;\n    const name = request.params.name;\n    const entityRef = `${kind}:${namespace}/${name}`;\n\n    const err = validateEntityReference(entityRef, role);\n    if (err) {\n      throw new InputError(err.message);\n    }\n\n    return entityRef;\n  }\n\n  async transformPolicyArray(\n    ...policies: string[][]\n  ): Promise<RoleBasedPolicy[]> {\n    const roleToSourceMap = await buildRoleSourceMap(\n      policies,\n      this.roleMetadata,\n    );\n\n    const roleBasedPolices: RoleBasedPolicy[] = [];\n    for (const p of policies) {\n      const [entityReference, permission, policy, effect] = p;\n      roleBasedPolices.push({\n        entityReference,\n        permission,\n        policy,\n        effect,\n        metadata: { source: roleToSourceMap.get(entityReference)! },\n      });\n    }\n\n    return roleBasedPolices;\n  }\n\n  async transformRoleArray(...roles: string[][]): Promise<Role[]> {\n    const combinedRoles: { [key: string]: string[] } = {};\n\n    roles.forEach(([value, role]) => {\n      if (combinedRoles.hasOwnProperty(role)) {\n        combinedRoles[role].push(value);\n      } else {\n        combinedRoles[role] = [value];\n      }\n    });\n\n    const result: Role[] = await Promise.all(\n      Object.entries(combinedRoles).map(async ([role, value]) => {\n        const metadataDao = await this.roleMetadata.findRoleMetadata(role);\n        const metadata = metadataDao ? daoToMetadata(metadataDao) : undefined;\n        return Promise.resolve({\n          memberReferences: value,\n          name: role,\n          metadata,\n        });\n      }),\n    );\n    return result;\n  }\n\n  transformPolicyToArray(policy: RoleBasedPolicy): string[] {\n    return [\n      policy.entityReference!,\n      policy.permission!,\n      policy.policy!,\n      policy.effect!,\n    ];\n  }\n\n  transformRoleToArray(role: Role): string[][] {\n    const roles: string[][] = [];\n    for (const entity of role.memberReferences) {\n      roles.push([entity, role.name]);\n    }\n    return roles;\n  }\n\n  getActionQueries(\n    queryValue: string | string[] | ParsedQs | ParsedQs[] | undefined,\n  ): PermissionAction[] | undefined {\n    if (!queryValue) {\n      return undefined;\n    }\n    if (Array.isArray(queryValue)) {\n      const permissionNames: PermissionAction[] = [];\n      for (const permissionQuery of queryValue) {\n        if (\n          typeof permissionQuery === 'string' &&\n          isPermissionAction(permissionQuery)\n        ) {\n          permissionNames.push(permissionQuery);\n        } else {\n          throw new InputError(\n            `Invalid permission action query value: ${permissionQuery}. Permission name should be string.`,\n          );\n        }\n      }\n      return permissionNames;\n    }\n\n    if (typeof queryValue === 'string' && isPermissionAction(queryValue)) {\n      return [queryValue];\n    }\n    throw new InputError(\n      `Invalid permission action query value: ${queryValue}. Permission name should be string.`,\n    );\n  }\n\n  getFirstQuery(\n    queryValue: string | string[] | ParsedQs | ParsedQs[] | undefined,\n  ): string {\n    if (!queryValue) {\n      return '';\n    }\n    if (Array.isArray(queryValue)) {\n      if (typeof queryValue[0] === 'string') {\n        return queryValue[0].toString();\n      }\n      throw new InputError(`This api doesn't support nested query`);\n    }\n\n    if (typeof queryValue === 'string') {\n      return queryValue;\n    }\n    throw new InputError(`This api doesn't support nested query`);\n  }\n\n  isPolicyFilterEnabled(request: Request): boolean {\n    return (\n      !!request.query.entityRef ||\n      !!request.query.permission ||\n      !!request.query.policy ||\n      !!request.query.effect\n    );\n  }\n\n  async processPolicies(\n    policyArray: RoleBasedPolicy[],\n    isOld?: boolean,\n    errorMessage?: string,\n  ): Promise<string[][]> {\n    const policies: string[][] = [];\n    const uniqueItems = new Set<string>();\n    for (const policy of policyArray) {\n      let err = validatePolicy(policy);\n      if (err) {\n        throw new InputError(\n          `Invalid ${errorMessage ?? 'policy'} definition. Cause: ${\n            err.message\n          }`,\n        ); // 400\n      }\n\n      const metadata = await this.roleMetadata.findRoleMetadata(\n        policy.entityReference!,\n      );\n\n      let action = errorMessage ? 'edit' : 'delete';\n      action = isOld ? action : 'add';\n\n      err = await validateSource('rest', metadata);\n      if (err) {\n        throw new NotAllowedError(\n          `Unable to ${action} policy ${policy.entityReference},${policy.permission},${policy.policy},${policy.effect}: ${err.message}`,\n        );\n      }\n\n      const transformedPolicy = this.transformPolicyToArray(policy);\n      if (isOld && !(await this.enforcer.hasPolicy(...transformedPolicy))) {\n        throw new NotFoundError(\n          `Policy '${policyToString(transformedPolicy)}' not found`,\n        ); // 404\n      }\n\n      if (!isOld && (await this.enforcer.hasPolicy(...transformedPolicy))) {\n        throw new ConflictError(\n          `Policy '${policyToString(\n            transformedPolicy,\n          )}' has been already stored`,\n        ); // 409\n      }\n\n      // We want to ensure that there are not duplicate permission policies\n      const rowString = JSON.stringify(transformedPolicy);\n      if (uniqueItems.has(rowString)) {\n        throw new ConflictError(\n          `Duplicate polices found; ${policy.entityReference}, ${policy.permission}, ${policy.policy}, ${policy.effect} is a duplicate`,\n        );\n      } else {\n        uniqueItems.add(rowString);\n        policies.push(transformedPolicy);\n      }\n    }\n    return policies;\n  }\n\n  nameSort(nameA: string, nameB: string): number {\n    if (nameA.toLocaleUpperCase('en-US') < nameB.toLocaleUpperCase('en-US')) {\n      return -1;\n    }\n    if (nameA.toLocaleUpperCase('en-US') > nameB.toLocaleUpperCase('en-US')) {\n      return 1;\n    }\n    return 0;\n  }\n}\n"],"names":["policyEntityReadPermission","NotAllowedError","createRouter","ServiceUnavailableError","createPermissionIntegrationRouter","RESOURCE_TYPE_POLICY_ENTITY","policyEntityPermissions","AuthorizeResult","PermissionEvents","SEND_RESPONSE_STAGE","NotFoundError","policyEntityDeletePermission","isEmpty","InputError","policyEntityCreatePermission","policyEntityUpdatePermission","isEqual","RoleEvents","validateRole","validateSource","ConflictError","deepSortedEqual","ListPluginPoliciesEvents","ListConditionEvents","ConditionEvents","validateRoleCondition","processConditionMapping","logAuditError","validateEntityReference","buildRoleSourceMap","daoToMetadata","isPermissionAction","validatePolicy","policyToString"],"mappings":";;;;;;;;;;;;;;;AAuFO,MAAM,cAAe,CAAA;AAAA,EAC1B,WAAA,CACmB,aACA,OACA,EAAA,QAAA,EACA,oBACA,kBACA,EAAA,YAAA,EACA,MACA,aACjB,EAAA;AARiB,IAAA,IAAA,CAAA,WAAA,GAAA,WAAA;AACA,IAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AACA,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AACA,IAAA,IAAA,CAAA,kBAAA,GAAA,kBAAA;AACA,IAAA,IAAA,CAAA,kBAAA,GAAA,kBAAA;AACA,IAAA,IAAA,CAAA,YAAA,GAAA,YAAA;AACA,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AACA,IAAA,IAAA,CAAA,aAAA,GAAA,aAAA;AAAA;AAChB,EAEH,MAAc,SACZ,CAAA,OAAA,EACA,UACyB,EAAA;AACzB,IAAA,MAAM,cAAc,MAAM,IAAA,CAAK,OAAQ,CAAA,QAAA,CAAS,YAAY,OAAS,EAAA;AAAA,MACnE,KAAA,EAAO,CAAC,MAAA,EAAQ,SAAS;AAAA,KAC1B,CAAA;AAGD,IACE,IAAA,IAAA,CAAK,QAAQ,IAAK,CAAA,WAAA,CAAY,aAAa,SAAS,CAAA,IACpD,eAAeA,2CACf,EAAA;AACA,MAAA,MAAM,IAAIC,sBAAA;AAAA,QACR,CAAA,2EAAA;AAAA,OACF;AAAA;AAGF,IAAM,MAAA,QAAA,GAAA,CACJ,MAAM,IAAA,CAAK,WAAY,CAAA,SAAA;AAAA,MACrB,CAAC,EAAE,UAAA,EAAwB,WAAa,EAAA,UAAA,CAAW,cAAc,CAAA;AAAA,MACjE,EAAE,WAAY;AAAA,OAEhB,CAAC,CAAA;AAEH,IAAO,OAAA,QAAA;AAAA;AACT,EAEA,MAAM,KAAiC,GAAA;AACrC,IAAA,MAAM,MAAS,GAAA,MAAMC,oCAAa,CAAA,IAAA,CAAK,OAAO,CAAA;AAE9C,IAAM,MAAA,EAAE,QAAS,EAAA,GAAI,IAAK,CAAA,OAAA;AAE1B,IAAA,IAAI,CAAC,QAAU,EAAA;AACb,MAAA,MAAM,IAAIC,8BAAA;AAAA,QACR;AAAA,OACF;AAAA;AAGF,IAAA,MAAM,+BAA+BC,sDAAkC,CAAA;AAAA,MACrE,YAAc,EAAAC,4CAAA;AAAA,MACd,WAAa,EAAAC;AAAA,KACd,CAAA;AACD,IAAA,MAAA,CAAO,IAAI,4BAA4B,CAAA;AAEvC,IAAA,MAAM,eACJ,GAAA,IAAA,CAAK,OAAQ,CAAA,MAAA,CAAO,mBAAmB,oBAAoB,CAAA;AAC7D,IAAA,IAAI,CAAC,eAAiB,EAAA;AACpB,MAAO,OAAA,MAAA;AAAA;AAGT,IAAA,MAAA,CAAO,GAAI,CAAA,GAAA,EAAK,OAAO,OAAA,EAAS,QAAa,KAAA;AAC3C,MAAM,MAAA,QAAA,GAAW,MAAM,IAAK,CAAA,SAAA;AAAA,QAC1B,OAAA;AAAA,QACAN;AAAA,OACF;AAEA,MAAI,IAAA,QAAA,CAAS,MAAW,KAAAO,sCAAA,CAAgB,IAAM,EAAA;AAC5C,QAAA,MAAM,IAAIN,sBAAgB,EAAA;AAAA;AAE5B,MAAA,QAAA,CAAS,IAAK,CAAA,EAAE,MAAQ,EAAA,YAAA,EAAc,CAAA;AAAA,KACvC,CAAA;AAID,IAAA,MAAA,CAAO,GAAI,CAAA,WAAA,EAAa,OAAO,OAAA,EAAS,QAAa,KAAA;AACnD,MAAM,MAAA,QAAA,GAAW,MAAM,IAAK,CAAA,SAAA;AAAA,QAC1B,OAAA;AAAA,QACAD;AAAA,OACF;AAEA,MAAI,IAAA,QAAA,CAAS,MAAW,KAAAO,sCAAA,CAAgB,IAAM,EAAA;AAC5C,QAAA,MAAM,IAAIN,sBAAgB,EAAA;AAAA;AAG5B,MAAI,IAAA,QAAA;AACJ,MAAI,IAAA,IAAA,CAAK,qBAAsB,CAAA,OAAO,CAAG,EAAA;AACvC,QAAA,MAAM,SAAY,GAAA,IAAA,CAAK,aAAc,CAAA,OAAA,CAAQ,MAAM,SAAS,CAAA;AAC5D,QAAA,MAAM,UAAa,GAAA,IAAA,CAAK,aAAc,CAAA,OAAA,CAAQ,MAAM,UAAU,CAAA;AAC9D,QAAA,MAAM,MAAS,GAAA,IAAA,CAAK,aAAc,CAAA,OAAA,CAAQ,MAAM,MAAM,CAAA;AACtD,QAAA,MAAM,MAAS,GAAA,IAAA,CAAK,aAAc,CAAA,OAAA,CAAQ,MAAM,MAAM,CAAA;AAEtD,QAAA,MAAM,MAAmB,GAAA,CAAC,SAAW,EAAA,UAAA,EAAY,QAAQ,MAAM,CAAA;AAC/D,QAAA,QAAA,GAAW,MAAM,IAAK,CAAA,QAAA,CAAS,iBAAkB,CAAA,CAAA,EAAG,GAAG,MAAM,CAAA;AAAA,OACxD,MAAA;AACL,QAAW,QAAA,GAAA,MAAM,IAAK,CAAA,QAAA,CAAS,SAAU,EAAA;AAAA;AAG3C,MAAA,MAAM,IAAO,GAAA,MAAM,IAAK,CAAA,oBAAA,CAAqB,GAAG,QAAQ,CAAA;AAExD,MAAM,MAAA,IAAA,CAAK,KAAK,QAAS,CAAA;AAAA,QACvB,OAAS,EAAA,CAAA,+BAAA,CAAA;AAAA,QACT,WAAWO,4BAAiB,CAAA,UAAA;AAAA,QAC5B,KAAO,EAAAC,+BAAA;AAAA,QACP,MAAQ,EAAA,WAAA;AAAA,QACR,OAAA;AAAA,QACA,QAAU,EAAA,EAAE,MAAQ,EAAA,GAAA,EAAK,IAAK;AAAA,OAC/B,CAAA;AAED,MAAA,QAAA,CAAS,KAAK,IAAI,CAAA;AAAA,KACnB,CAAA;AAED,IAAO,MAAA,CAAA,GAAA;AAAA,MACL,kCAAA;AAAA,MACA,OAAO,SAAS,QAAa,KAAA;AAC3B,QAAM,MAAA,QAAA,GAAW,MAAM,IAAK,CAAA,SAAA;AAAA,UAC1B,OAAA;AAAA,UACAT;AAAA,SACF;AAEA,QAAI,IAAA,QAAA,CAAS,MAAW,KAAAO,sCAAA,CAAgB,IAAM,EAAA;AAC5C,UAAA,MAAM,IAAIN,sBAAgB,EAAA;AAAA;AAG5B,QAAM,MAAA,SAAA,GAAY,IAAK,CAAA,kBAAA,CAAmB,OAAO,CAAA;AAEjD,QAAA,MAAM,SAAS,MAAM,IAAA,CAAK,QAAS,CAAA,iBAAA,CAAkB,GAAG,SAAS,CAAA;AACjE,QAAI,IAAA,MAAA,CAAO,WAAW,CAAG,EAAA;AACvB,UAAA,MAAM,IAAO,GAAA,MAAM,IAAK,CAAA,oBAAA,CAAqB,GAAG,MAAM,CAAA;AAEtD,UAAM,MAAA,IAAA,CAAK,KAAK,QAAS,CAAA;AAAA,YACvB,OAAS,EAAA,CAAA,wBAAA,CAAA;AAAA,YACT,WAAWO,4BAAiB,CAAA,UAAA;AAAA,YAC5B,KAAO,EAAAC,+BAAA;AAAA,YACP,MAAQ,EAAA,WAAA;AAAA,YACR,OAAA;AAAA,YACA,QAAU,EAAA,EAAE,MAAQ,EAAA,GAAA,EAAK,IAAK;AAAA,WAC/B,CAAA;AAED,UAAA,QAAA,CAAS,KAAK,IAAI,CAAA;AAAA,SACb,MAAA;AACL,UAAA,MAAM,IAAIC,oBAAc,EAAA;AAAA;AAC1B;AACF,KACF;AAEA,IAAO,MAAA,CAAA,MAAA;AAAA,MACL,kCAAA;AAAA,MACA,OAAO,SAAS,QAAa,KAAA;AAC3B,QAAM,MAAA,QAAA,GAAW,MAAM,IAAK,CAAA,SAAA;AAAA,UAC1B,OAAA;AAAA,UACAC;AAAA,SACF;AAEA,QAAI,IAAA,QAAA,CAAS,MAAW,KAAAJ,sCAAA,CAAgB,IAAM,EAAA;AAC5C,UAAA,MAAM,IAAIN,sBAAgB,EAAA;AAAA;AAG5B,QAAM,MAAA,SAAA,GAAY,IAAK,CAAA,kBAAA,CAAmB,OAAO,CAAA;AAEjD,QAAA,MAAM,YAA+B,OAAQ,CAAA,IAAA;AAC7C,QAAI,IAAAW,cAAA,CAAQ,SAAS,CAAG,EAAA;AACtB,UAAM,MAAA,IAAIC,kBAAW,CAAmC,iCAAA,CAAA,CAAA;AAAA;AAG1D,QAAA,SAAA,CAAU,QAAQ,CAAW,OAAA,KAAA;AAC3B,UAAA,OAAA,CAAQ,eAAkB,GAAA,SAAA;AAAA,SAC3B,CAAA;AAED,QAAA,MAAM,iBAAoB,GAAA,MAAM,IAAK,CAAA,eAAA,CAAgB,WAAW,IAAI,CAAA;AAEpE,QAAM,MAAA,IAAA,CAAK,QAAS,CAAA,cAAA,CAAe,iBAAiB,CAAA;AAEpD,QAAM,MAAA,IAAA,CAAK,KAAK,QAA8B,CAAA;AAAA,UAC5C,OAAS,EAAA,CAAA,2BAAA,CAAA;AAAA,UACT,WAAWL,4BAAiB,CAAA,aAAA;AAAA,UAC5B,QAAU,EAAA,EAAE,QAAU,EAAA,iBAAA,EAAmB,QAAQ,MAAO,EAAA;AAAA,UACxD,KAAO,EAAAC,+BAAA;AAAA,UACP,MAAQ,EAAA,WAAA;AAAA,UACR,OAAA;AAAA,UACA,QAAA,EAAU,EAAE,MAAA,EAAQ,GAAI;AAAA,SACzB,CAAA;AAED,QAAS,QAAA,CAAA,MAAA,CAAO,GAAG,CAAA,CAAE,GAAI,EAAA;AAAA;AAC3B,KACF;AAEA,IAAA,MAAA,CAAO,IAAK,CAAA,WAAA,EAAa,OAAO,OAAA,EAAS,QAAa,KAAA;AACpD,MAAM,MAAA,QAAA,GAAW,MAAM,IAAK,CAAA,SAAA;AAAA,QAC1B,OAAA;AAAA,QACAK;AAAA,OACF;AAEA,MAAI,IAAA,QAAA,CAAS,MAAW,KAAAP,sCAAA,CAAgB,IAAM,EAAA;AAC5C,QAAA,MAAM,IAAIN,sBAAgB,EAAA;AAAA;AAG5B,MAAA,MAAM,YAA+B,OAAQ,CAAA,IAAA;AAE7C,MAAI,IAAAW,cAAA,CAAQ,SAAS,CAAG,EAAA;AACtB,QAAM,MAAA,IAAIC,kBAAW,CAAmC,iCAAA,CAAA,CAAA;AAAA;AAG1D,MAAA,MAAM,iBAAoB,GAAA,MAAM,IAAK,CAAA,eAAA,CAAgB,SAAS,CAAA;AAE9D,MAAA,MAAM,SAAY,GAAA,iBAAA,CAAkB,CAAC,CAAA,CAAE,CAAC,CAAA;AACxC,MAAA,MAAM,YAAe,GAAA,MAAM,IAAK,CAAA,YAAA,CAAa,iBAAiB,SAAS,CAAA;AACvE,MAAA,IAAI,SAAU,CAAA,UAAA,CAAW,cAAc,CAAA,IAAK,CAAC,YAAc,EAAA;AACzD,QAAA,MAAM,IAAI,KAAA,CAAM,CAAsB,mBAAA,EAAA,SAAS,CAAgB,cAAA,CAAA,CAAA;AAAA;AAGjE,MAAM,MAAA,IAAA,CAAK,QAAS,CAAA,WAAA,CAAY,iBAAiB,CAAA;AAEjD,MAAM,MAAA,IAAA,CAAK,KAAK,QAA8B,CAAA;AAAA,QAC5C,OAAS,EAAA,CAAA,2BAAA,CAAA;AAAA,QACT,WAAWL,4BAAiB,CAAA,aAAA;AAAA,QAC5B,QAAU,EAAA,EAAE,QAAU,EAAA,iBAAA,EAAmB,QAAQ,MAAO,EAAA;AAAA,QACxD,KAAO,EAAAC,+BAAA;AAAA,QACP,MAAQ,EAAA,WAAA;AAAA,QACR,OAAA;AAAA,QACA,QAAA,EAAU,EAAE,MAAA,EAAQ,GAAI;AAAA,OACzB,CAAA;AAED,MAAS,QAAA,CAAA,MAAA,CAAO,GAAG,CAAA,CAAE,GAAI,EAAA;AAAA,KAC1B,CAAA;AAED,IAAO,MAAA,CAAA,GAAA;AAAA,MACL,kCAAA;AAAA,MACA,OAAO,SAAS,QAAa,KAAA;AAC3B,QAAM,MAAA,QAAA,GAAW,MAAM,IAAK,CAAA,SAAA;AAAA,UAC1B,OAAA;AAAA,UACAM;AAAA,SACF;AAEA,QAAI,IAAA,QAAA,CAAS,MAAW,KAAAR,sCAAA,CAAgB,IAAM,EAAA;AAC5C,UAAA,MAAM,IAAIN,sBAAgB,EAAA;AAAA;AAG5B,QAAM,MAAA,SAAA,GAAY,IAAK,CAAA,kBAAA,CAAmB,OAAO,CAAA;AAEjD,QAAM,MAAA,YAAA,GAAkC,QAAQ,IAAK,CAAA,SAAA;AACrD,QAAI,IAAAW,cAAA,CAAQ,YAAY,CAAG,EAAA;AACzB,UAAM,MAAA,IAAIC,kBAAW,CAAoC,kCAAA,CAAA,CAAA;AAAA;AAE3D,QAAM,MAAA,YAAA,GAAkC,QAAQ,IAAK,CAAA,SAAA;AACrD,QAAI,IAAAD,cAAA,CAAQ,YAAY,CAAG,EAAA;AACzB,UAAM,MAAA,IAAIC,kBAAW,CAAoC,kCAAA,CAAA,CAAA;AAAA;AAG3D,QAAA,CAAC,GAAG,YAAc,EAAA,GAAG,YAAY,CAAA,CAAE,QAAQ,CAAW,OAAA,KAAA;AACpD,UAAA,OAAA,CAAQ,eAAkB,GAAA,SAAA;AAAA,SAC3B,CAAA;AAED,QAAM,MAAA,kBAAA,GAAqB,MAAM,IAAK,CAAA,eAAA;AAAA,UACpC,YAAA;AAAA,UACA,IAAA;AAAA,UACA;AAAA,SACF;AAEA,QAAa,YAAA,CAAA,IAAA;AAAA,UAAK,CAAC,CAAG,EAAA,CAAA,KACpB,EAAE,UAAe,KAAA,CAAA,CAAE,aACf,IAAK,CAAA,QAAA,CAAS,EAAE,MAAS,EAAA,CAAA,CAAE,MAAO,CAClC,GAAA,IAAA,CAAK,SAAS,CAAE,CAAA,UAAA,EAAa,EAAE,UAAW;AAAA,SAChD;AAEA,QAAa,YAAA,CAAA,IAAA;AAAA,UAAK,CAAC,CAAG,EAAA,CAAA,KACpB,EAAE,UAAe,KAAA,CAAA,CAAE,aACf,IAAK,CAAA,QAAA,CAAS,EAAE,MAAS,EAAA,CAAA,CAAE,MAAO,CAClC,GAAA,IAAA,CAAK,SAAS,CAAE,CAAA,UAAA,EAAa,EAAE,UAAW;AAAA,SAChD;AAEA,QACE,IAAAG,cAAA,CAAQ,cAAc,YAAY,CAAA,IAClC,CAAC,YAAa,CAAA,IAAA,CAAKJ,cAAO,CAC1B,EAAA;AACA,UAAS,QAAA,CAAA,MAAA,CAAO,GAAG,CAAA,CAAE,GAAI,EAAA;AAAA,SAChB,MAAA,IAAA,YAAA,CAAa,MAAS,GAAA,YAAA,CAAa,MAAQ,EAAA;AACpD,UAAA,MAAM,IAAIC,iBAAA;AAAA,YACR,CAAA,8EAAA;AAAA,WACF;AAAA;AAGF,QAAM,MAAA,kBAAA,GAAqB,MAAM,IAAK,CAAA,eAAA;AAAA,UACpC,YAAA;AAAA,UACA,KAAA;AAAA,UACA;AAAA,SACF;AAEA,QAAA,MAAM,YACJ,GAAA,MAAM,IAAK,CAAA,YAAA,CAAa,iBAAiB,SAAS,CAAA;AACpD,QAAA,IAAI,SAAU,CAAA,UAAA,CAAW,cAAc,CAAA,IAAK,CAAC,YAAc,EAAA;AACzD,UAAA,MAAM,IAAI,KAAA,CAAM,CAAsB,mBAAA,EAAA,SAAS,CAAgB,cAAA,CAAA,CAAA;AAAA;AAGjE,QAAA,MAAM,KAAK,QAAS,CAAA,cAAA;AAAA,UAClB,kBAAA;AAAA,UACA;AAAA,SACF;AAEA,QAAM,MAAA,IAAA,CAAK,KAAK,QAA8B,CAAA;AAAA,UAC5C,OAAS,EAAA,CAAA,2BAAA,CAAA;AAAA,UACT,WAAWL,4BAAiB,CAAA,aAAA;AAAA,UAC5B,QAAU,EAAA,EAAE,QAAU,EAAA,kBAAA,EAAoB,QAAQ,MAAO,EAAA;AAAA,UACzD,KAAO,EAAAC,+BAAA;AAAA,UACP,MAAQ,EAAA,WAAA;AAAA,UACR,OAAA;AAAA,UACA,QAAA,EAAU,EAAE,MAAA,EAAQ,GAAI;AAAA,SACzB,CAAA;AAED,QAAS,QAAA,CAAA,MAAA,CAAO,GAAG,CAAA,CAAE,GAAI,EAAA;AAAA;AAC3B,KACF;AAIA,IAAA,MAAA,CAAO,GAAI,CAAA,QAAA,EAAU,OAAO,OAAA,EAAS,QAAa,KAAA;AAChD,MAAM,MAAA,QAAA,GAAW,MAAM,IAAK,CAAA,SAAA;AAAA,QAC1B,OAAA;AAAA,QACAT;AAAA,OACF;AAEA,MAAI,IAAA,QAAA,CAAS,MAAW,KAAAO,sCAAA,CAAgB,IAAM,EAAA;AAC5C,QAAA,MAAM,IAAIN,sBAAgB,EAAA;AAAA;AAG5B,MAAA,MAAM,KAAQ,GAAA,MAAM,IAAK,CAAA,QAAA,CAAS,iBAAkB,EAAA;AAEpD,MAAA,MAAM,IAAO,GAAA,MAAM,IAAK,CAAA,kBAAA,CAAmB,GAAG,KAAK,CAAA;AAEnD,MAAM,MAAA,IAAA,CAAK,KAAK,QAAS,CAAA;AAAA,QACvB,OAAS,EAAA,CAAA,iBAAA,CAAA;AAAA,QACT,WAAWgB,sBAAW,CAAA,QAAA;AAAA,QACtB,KAAO,EAAAR,+BAAA;AAAA,QACP,MAAQ,EAAA,WAAA;AAAA,QACR,OAAA;AAAA,QACA,QAAU,EAAA,EAAE,MAAQ,EAAA,GAAA,EAAK,IAAK;AAAA,OAC/B,CAAA;AAED,MAAA,QAAA,CAAS,KAAK,IAAI,CAAA;AAAA,KACnB,CAAA;AAED,IAAA,MAAA,CAAO,GAAI,CAAA,+BAAA,EAAiC,OAAO,OAAA,EAAS,QAAa,KAAA;AACvE,MAAM,MAAA,QAAA,GAAW,MAAM,IAAK,CAAA,SAAA;AAAA,QAC1B,OAAA;AAAA,QACAT;AAAA,OACF;AAEA,MAAI,IAAA,QAAA,CAAS,MAAW,KAAAO,sCAAA,CAAgB,IAAM,EAAA;AAC5C,QAAA,MAAM,IAAIN,sBAAgB,EAAA;AAAA;AAE5B,MAAA,MAAM,aAAgB,GAAA,IAAA,CAAK,kBAAmB,CAAA,OAAA,EAAS,IAAI,CAAA;AAE3D,MAAM,MAAA,IAAA,GAAO,MAAM,IAAA,CAAK,QAAS,CAAA,yBAAA;AAAA,QAC/B,CAAA;AAAA,QACA;AAAA,OACF;AAEA,MAAI,IAAA,IAAA,CAAK,WAAW,CAAG,EAAA;AACrB,QAAA,MAAM,IAAO,GAAA,MAAM,IAAK,CAAA,kBAAA,CAAmB,GAAG,IAAI,CAAA;AAElD,QAAM,MAAA,IAAA,CAAK,KAAK,QAAS,CAAA;AAAA,UACvB,OAAS,EAAA,CAAA,OAAA,EAAU,IAAK,CAAA,CAAC,EAAE,IAAI,CAAA,CAAA;AAAA,UAC/B,WAAWgB,sBAAW,CAAA,QAAA;AAAA,UACtB,KAAO,EAAAR,+BAAA;AAAA,UACP,MAAQ,EAAA,WAAA;AAAA,UACR,OAAA;AAAA,UACA,QAAU,EAAA,EAAE,MAAQ,EAAA,GAAA,EAAK,IAAK;AAAA,SAC/B,CAAA;AAED,QAAA,QAAA,CAAS,KAAK,IAAI,CAAA;AAAA,OACb,MAAA;AACL,QAAA,MAAM,IAAIC,oBAAc,EAAA;AAAA;AAC1B,KACD,CAAA;AAED,IAAA,MAAA,CAAO,IAAK,CAAA,QAAA,EAAU,OAAO,OAAA,EAAS,QAAa,KAAA;AACjD,MAAM,MAAA,WAAA,uBAAkB,GAAY,EAAA;AACpC,MAAM,MAAA,QAAA,GAAW,MAAM,IAAK,CAAA,SAAA;AAAA,QAC1B,OAAA;AAAA,QACAI;AAAA,OACF;AAEA,MAAI,IAAA,QAAA,CAAS,MAAW,KAAAP,sCAAA,CAAgB,IAAM,EAAA;AAC5C,QAAA,MAAM,IAAIN,sBAAgB,EAAA;AAAA;AAE5B,MAAA,MAAM,UAAgB,OAAQ,CAAA,IAAA;AAC9B,MAAI,IAAA,GAAA,GAAMiB,gCAAa,OAAO,CAAA;AAC9B,MAAA,IAAI,GAAK,EAAA;AACP,QAAA,MAAM,IAAIL,iBAAA;AAAA;AAAA,UACR,CAAA,gCAAA,EAAmC,IAAI,OAAO,CAAA;AAAA,SAChD;AAAA;AAGF,MAAA,MAAM,YAAY,MAAM,IAAA,CAAK,YAAa,CAAA,gBAAA,CAAiB,QAAQ,IAAI,CAAA;AAEvE,MAAM,GAAA,GAAA,MAAMM,iCAAe,CAAA,MAAA,EAAQ,SAAS,CAAA;AAC5C,MAAA,IAAI,GAAK,EAAA;AACP,QAAA,MAAM,IAAIlB,sBAAA,CAAgB,CAAuB,oBAAA,EAAA,GAAA,CAAI,OAAO,CAAE,CAAA,CAAA;AAAA;AAGhE,MAAM,MAAA,KAAA,GAAQ,IAAK,CAAA,oBAAA,CAAqB,OAAO,CAAA;AAE/C,MAAA,KAAA,MAAW,QAAQ,KAAO,EAAA;AACxB,QAAA,IAAI,MAAM,IAAK,CAAA,QAAA,CAAS,iBAAkB,CAAA,GAAG,IAAI,CAAG,EAAA;AAClD,UAAA,MAAM,IAAImB,oBAAc,EAAA;AAAA;AAE1B,QAAM,MAAA,UAAA,GAAa,IAAK,CAAA,SAAA,CAAU,IAAI,CAAA;AAEtC,QAAI,IAAA,WAAA,CAAY,GAAI,CAAA,UAAU,CAAG,EAAA;AAC/B,UAAA,MAAM,IAAIA,oBAAA;AAAA,YACR,iCAAiC,IAAK,CAAA,EAAA,CAAG,CAAC,CAAC,KAAK,IAAK,CAAA,EAAA;AAAA,cACnD;AAAA,aACD,CAAA,eAAA;AAAA,WACH;AAAA,SACK,MAAA;AACL,UAAA,WAAA,CAAY,IAAI,UAAU,CAAA;AAAA;AAC5B;AAGF,MAAA,MAAM,WAAc,GAAA,MAAM,QAAS,CAAA,WAAA,CAAY,OAAS,EAAA;AAAA,QACtD,KAAA,EAAO,CAAC,MAAM;AAAA,OACf,CAAA;AACD,MAAM,MAAA,UAAA,GAAa,YAAY,SAAU,CAAA,aAAA;AACzC,MAAA,MAAM,QAA4B,GAAA;AAAA,QAChC,eAAe,OAAQ,CAAA,IAAA;AAAA,QACvB,MAAQ,EAAA,MAAA;AAAA,QACR,WAAA,EAAa,OAAQ,CAAA,QAAA,EAAU,WAAe,IAAA,EAAA;AAAA,QAC9C,MAAQ,EAAA,UAAA;AAAA,QACR;AAAA,OACF;AAEA,MAAA,MAAM,IAAK,CAAA,QAAA,CAAS,mBAAoB,CAAA,KAAA,EAAO,QAAQ,CAAA;AAEvD,MAAM,MAAA,IAAA,CAAK,KAAK,QAAwB,CAAA;AAAA,QACtC,OAAA,EAAS,CAAW,QAAA,EAAA,QAAA,CAAS,aAAa,CAAA,CAAA;AAAA,QAC1C,WAAWH,sBAAW,CAAA,WAAA;AAAA,QACtB,QAAU,EAAA;AAAA,UACR,GAAG,QAAA;AAAA,UACH,SAAS,KAAM,CAAA,GAAA,CAAI,CAAM,EAAA,KAAA,EAAA,CAAG,CAAC,CAAC;AAAA,SAChC;AAAA,QACA,KAAO,EAAAR,+BAAA;AAAA,QACP,MAAQ,EAAA,WAAA;AAAA,QACR,OAAA;AAAA,QACA,QAAA,EAAU,EAAE,MAAA,EAAQ,GAAI;AAAA,OACzB,CAAA;AAED,MAAS,QAAA,CAAA,MAAA,CAAO,GAAG,CAAA,CAAE,GAAI,EAAA;AAAA,KAC1B,CAAA;AAED,IAAA,MAAA,CAAO,GAAI,CAAA,+BAAA,EAAiC,OAAO,OAAA,EAAS,QAAa,KAAA;AACvE,MAAM,MAAA,WAAA,uBAAkB,GAAY,EAAA;AACpC,MAAM,MAAA,QAAA,GAAW,MAAM,IAAK,CAAA,SAAA;AAAA,QAC1B,OAAA;AAAA,QACAM;AAAA,OACF;AAEA,MAAI,IAAA,QAAA,CAAS,MAAW,KAAAR,sCAAA,CAAgB,IAAM,EAAA;AAC5C,QAAA,MAAM,IAAIN,sBAAgB,EAAA;AAAA;AAE5B,MAAA,MAAM,aAAgB,GAAA,IAAA,CAAK,kBAAmB,CAAA,OAAA,EAAS,IAAI,CAAA;AAE3D,MAAM,MAAA,UAAA,GAAmB,QAAQ,IAAK,CAAA,OAAA;AAEtC,MAAA,IAAI,CAAC,UAAY,EAAA;AACf,QAAM,MAAA,IAAIY,kBAAW,CAAkC,gCAAA,CAAA,CAAA;AAAA;AAEzD,MAAM,MAAA,UAAA,GAAmB,QAAQ,IAAK,CAAA,OAAA;AACtC,MAAA,IAAI,CAAC,UAAY,EAAA;AACf,QAAM,MAAA,IAAIA,kBAAW,CAAkC,gCAAA,CAAA,CAAA;AAAA;AAGzD,MAAA,UAAA,CAAW,IAAO,GAAA,aAAA;AAClB,MAAI,IAAA,GAAA,GAAMK,gCAAa,UAAU,CAAA;AACjC,MAAA,IAAI,GAAK,EAAA;AACP,QAAA,MAAM,IAAIL,iBAAA;AAAA;AAAA,UACR,CAAA,gCAAA,EAAmC,IAAI,OAAO,CAAA;AAAA,SAChD;AAAA;AAEF,MAAA,GAAA,GAAMK,gCAAa,UAAU,CAAA;AAC7B,MAAA,IAAI,GAAK,EAAA;AACP,QAAA,MAAM,IAAIL,iBAAA;AAAA;AAAA,UACR,CAAA,gCAAA,EAAmC,IAAI,OAAO,CAAA;AAAA,SAChD;AAAA;AAGF,MAAM,MAAA,OAAA,GAAU,IAAK,CAAA,oBAAA,CAAqB,UAAU,CAAA;AACpD,MAAM,MAAA,OAAA,GAAU,IAAK,CAAA,oBAAA,CAAqB,UAAU,CAAA;AAGpD,MAAA,MAAM,WAAc,GAAA,MAAM,QAAS,CAAA,WAAA,CAAY,OAAS,EAAA;AAAA,QACtD,KAAA,EAAO,CAAC,MAAM;AAAA,OACf,CAAA;AAED,MAAA,MAAM,WAA+B,GAAA;AAAA,QACnC,GAAG,UAAW,CAAA,QAAA;AAAA,QACd,MAAA,EAAQ,UAAW,CAAA,QAAA,EAAU,MAAU,IAAA,MAAA;AAAA,QACvC,eAAe,UAAW,CAAA,IAAA;AAAA,QAC1B,UAAA,EAAY,YAAY,SAAU,CAAA;AAAA,OACpC;AAEA,MAAA,MAAM,WACJ,GAAA,MAAM,IAAK,CAAA,YAAA,CAAa,iBAAiB,aAAa,CAAA;AACxD,MAAA,IAAI,CAAC,WAAa,EAAA;AAChB,QAAA,MAAM,IAAIH,oBAAA,CAAc,CAA+B,4BAAA,EAAA,aAAa,CAAE,CAAA,CAAA;AAAA;AAGxE,MAAM,GAAA,GAAA,MAAMS,iCAAe,CAAA,MAAA,EAAQ,WAAW,CAAA;AAC9C,MAAA,IAAI,GAAK,EAAA;AACP,QAAA,MAAM,IAAIlB,sBAAA,CAAgB,CAAwB,qBAAA,EAAA,GAAA,CAAI,OAAO,CAAE,CAAA,CAAA;AAAA;AAGjE,MAAA,IACEe,eAAQ,OAAS,EAAA,OAAO,CACxB,IAAAK,sBAAA,CAAgB,aAAa,WAAa,EAAA;AAAA,QACxC,QAAA;AAAA,QACA,YAAA;AAAA,QACA,WAAA;AAAA,QACA;AAAA,OACD,CACD,EAAA;AAEA,QAAS,QAAA,CAAA,MAAA,CAAO,GAAG,CAAA,CAAE,GAAI,EAAA;AACzB,QAAA;AAAA;AAGF,MAAA,KAAA,MAAW,QAAQ,OAAS,EAAA;AAC1B,QAAM,MAAA,OAAA,GAAU,OAAQ,CAAA,IAAA,CAAK,CAAW,OAAA,KAAA;AACtC,UAAO,OAAAL,cAAA,CAAQ,SAAS,IAAI,CAAA;AAAA,SAC7B,CAAA;AAGD,QAAA,IAAI,MAAM,IAAK,CAAA,QAAA,CAAS,iBAAkB,CAAA,GAAG,IAAI,CAAG,EAAA;AAClD,UAAA,IAAI,CAAC,OAAS,EAAA;AACZ,YAAA,MAAM,IAAII,oBAAc,EAAA;AAAA;AAC1B;AAEF,QAAM,MAAA,UAAA,GAAa,IAAK,CAAA,SAAA,CAAU,IAAI,CAAA;AAEtC,QAAI,IAAA,WAAA,CAAY,GAAI,CAAA,UAAU,CAAG,EAAA;AAC/B,UAAA,MAAM,IAAIA,oBAAA;AAAA,YACR,iCAAiC,IAAK,CAAA,EAAA,CAAG,CAAC,CAAC,KAAK,IAAK,CAAA,EAAA;AAAA,cACnD;AAAA,aACD,CAAA,eAAA;AAAA,WACH;AAAA,SACK,MAAA;AACL,UAAA,WAAA,CAAY,IAAI,UAAU,CAAA;AAAA;AAC5B;AAGF,MAAA,WAAA,CAAY,KAAM,EAAA;AAClB,MAAA,KAAA,MAAW,QAAQ,OAAS,EAAA;AAC1B,QAAA,IAAI,CAAE,MAAM,IAAA,CAAK,SAAS,iBAAkB,CAAA,GAAG,IAAI,CAAI,EAAA;AACrD,UAAA,MAAM,IAAIV,oBAAA;AAAA,YACR,CAAqB,kBAAA,EAAA,IAAA,CAAK,CAAC,CAAC,2BAA2B,aAAa,CAAA;AAAA,WACtE;AAAA;AAEF,QAAM,MAAA,UAAA,GAAa,IAAK,CAAA,SAAA,CAAU,IAAI,CAAA;AAEtC,QAAI,IAAA,WAAA,CAAY,GAAI,CAAA,UAAU,CAAG,EAAA;AAC/B,UAAA,MAAM,IAAIU,oBAAA;AAAA,YACR,iCAAiC,IAAK,CAAA,EAAA,CAAG,CAAC,CAAC,KAAK,IAAK,CAAA,EAAA;AAAA,cACnD;AAAA,aACD,CAAA,eAAA;AAAA,WACH;AAAA,SACK,MAAA;AACL,UAAA,WAAA,CAAY,IAAI,UAAU,CAAA;AAAA;AAC5B;AAGF,MAAA,MAAM,IAAK,CAAA,QAAA,CAAS,sBAAuB,CAAA,OAAA,EAAS,SAAS,WAAW,CAAA;AAExE,MAAI,IAAA,OAAA,GAAU,CAAW,QAAA,EAAA,WAAA,CAAY,aAAa,CAAA,CAAA,CAAA;AAClD,MAAI,IAAA,WAAA,CAAY,aAAkB,KAAA,WAAA,CAAY,aAAe,EAAA;AAC3D,QAAA,OAAA,GAAU,CAAG,EAAA,OAAO,CAAsC,mCAAA,EAAA,WAAA,CAAY,aAAa,CAAA,CAAA;AAAA;AAErF,MAAM,MAAA,IAAA,CAAK,KAAK,QAAwB,CAAA;AAAA,QACtC,OAAA;AAAA,QACA,WAAWH,sBAAW,CAAA,WAAA;AAAA,QACtB,QAAU,EAAA;AAAA,UACR,GAAG,WAAA;AAAA,UACH,SAAS,OAAQ,CAAA,GAAA,CAAI,CAAM,EAAA,KAAA,EAAA,CAAG,CAAC,CAAC;AAAA,SAClC;AAAA,QACA,KAAO,EAAAR,+BAAA;AAAA,QACP,MAAQ,EAAA,WAAA;AAAA,QACR,OAAA;AAAA,QACA,QAAA,EAAU,EAAE,MAAA,EAAQ,GAAI;AAAA,OACzB,CAAA;AAED,MAAS,QAAA,CAAA,MAAA,CAAO,GAAG,CAAA,CAAE,GAAI,EAAA;AAAA,KAC1B,CAAA;AAED,IAAO,MAAA,CAAA,MAAA;AAAA,MACL,+BAAA;AAAA,MACA,OAAO,SAAS,QAAa,KAAA;AAC3B,QAAM,MAAA,QAAA,GAAW,MAAM,IAAK,CAAA,SAAA;AAAA,UAC1B,OAAA;AAAA,UACAE;AAAA,SACF;AAEA,QAAI,IAAA,QAAA,CAAS,MAAW,KAAAJ,sCAAA,CAAgB,IAAM,EAAA;AAC5C,UAAA,MAAM,IAAIN,sBAAgB,EAAA;AAAA;AAG5B,QAAA,MAAM,aAAgB,GAAA,IAAA,CAAK,kBAAmB,CAAA,OAAA,EAAS,IAAI,CAAA;AAE3D,QAAA,IAAI,cAAc,EAAC;AACnB,QAAI,IAAA,OAAA,CAAQ,MAAM,gBAAkB,EAAA;AAClC,UAAA,MAAM,kBAAkB,IAAK,CAAA,aAAA;AAAA,YAC3B,QAAQ,KAAM,CAAA;AAAA,WAChB;AACA,UAAM,MAAA,EAAA,GAAK,MAAM,IAAA,CAAK,QAAS,CAAA,yBAAA;AAAA,YAC7B,CAAA;AAAA,YACA,eAAA;AAAA,YACA;AAAA,WACF;AACA,UAAI,IAAA,EAAA,CAAG,SAAS,CAAG,EAAA;AACjB,YAAY,WAAA,CAAA,IAAA,CAAK,EAAG,CAAA,CAAC,CAAC,CAAA;AAAA,WACjB,MAAA;AACL,YAAA,MAAM,IAAIS,oBAAA;AAAA,cACR,gBAAgB,eAAe,CAAA,eAAA;AAAA,aACjC;AAAA;AACF,SACK,MAAA;AACL,UAAc,WAAA,GAAA,MAAM,KAAK,QAAS,CAAA,yBAAA;AAAA,YAChC,CAAA;AAAA,YACA;AAAA,WACF;AAAA;AAGF,QAAA,KAAA,MAAW,QAAQ,WAAa,EAAA;AAC9B,UAAA,IAAI,CAAE,MAAM,IAAA,CAAK,SAAS,iBAAkB,CAAA,GAAG,IAAI,CAAI,EAAA;AACrD,YAAA,MAAM,IAAIA,oBAAc,CAAA,CAAA,aAAA,EAAgB,IAAK,CAAA,CAAC,CAAC,CAAiB,eAAA,CAAA,CAAA;AAAA;AAClE;AAGF,QAAA,MAAM,eACJ,GAAA,MAAM,IAAK,CAAA,YAAA,CAAa,iBAAiB,aAAa,CAAA;AACxD,QAAA,MAAM,GAAM,GAAA,MAAMS,iCAAe,CAAA,MAAA,EAAQ,eAAe,CAAA;AACxD,QAAA,IAAI,GAAK,EAAA;AACP,UAAA,MAAM,IAAIlB,sBAAA,CAAgB,CAA0B,uBAAA,EAAA,GAAA,CAAI,OAAO,CAAE,CAAA,CAAA;AAAA;AAGnE,QAAA,MAAM,WAAc,GAAA,MAAM,QAAS,CAAA,WAAA,CAAY,OAAS,EAAA;AAAA,UACtD,KAAA,EAAO,CAAC,MAAM;AAAA,SACf,CAAA;AAED,QAAA,MAAM,QAA4B,GAAA;AAAA,UAChC,aAAA;AAAA,UACA,MAAQ,EAAA,MAAA;AAAA,UACR,UAAA,EAAY,YAAY,SAAU,CAAA;AAAA,SACpC;AAEA,QAAA,MAAM,KAAK,QAAS,CAAA,sBAAA;AAAA,UAClB,WAAA;AAAA,UACA,QAAA;AAAA,UACA;AAAA,SACF;AAEA,QAAM,MAAA,IAAA,CAAK,KAAK,QAAwB,CAAA;AAAA,UACtC,OAAA,EAAS,CAAW,QAAA,EAAA,QAAA,CAAS,aAAa,CAAA,CAAA;AAAA,UAC1C,WAAWgB,sBAAW,CAAA,WAAA;AAAA,UACtB,QAAU,EAAA;AAAA,YACR,GAAG,QAAA;AAAA,YACH,SAAS,WAAY,CAAA,GAAA,CAAI,CAAM,EAAA,KAAA,EAAA,CAAG,CAAC,CAAC;AAAA,WACtC;AAAA,UACA,KAAO,EAAAR,+BAAA;AAAA,UACP,MAAQ,EAAA,WAAA;AAAA,UACR,OAAA;AAAA,UACA,QAAA,EAAU,EAAE,MAAA,EAAQ,GAAI;AAAA,SACzB,CAAA;AAED,QAAS,QAAA,CAAA,MAAA,CAAO,GAAG,CAAA,CAAE,GAAI,EAAA;AAAA;AAC3B,KACF;AAEA,IAAA,MAAA,CAAO,GAAI,CAAA,mBAAA,EAAqB,OAAO,OAAA,EAAS,QAAa,KAAA;AAC3D,MAAM,MAAA,QAAA,GAAW,MAAM,IAAK,CAAA,SAAA;AAAA,QAC1B,OAAA;AAAA,QACAT;AAAA,OACF;AAEA,MAAI,IAAA,QAAA,CAAS,MAAW,KAAAO,sCAAA,CAAgB,IAAM,EAAA;AAC5C,QAAA,MAAM,IAAIN,sBAAgB,EAAA;AAAA;AAG5B,MAAM,MAAA,IAAA,GAAO,MAAM,IAAA,CAAK,kBAAmB,CAAA,iBAAA;AAAA,QACzC,KAAK,OAAQ,CAAA;AAAA,OACf;AAEA,MAAM,MAAA,IAAA,CAAK,KAAK,QAAS,CAAA;AAAA,QACvB,OAAS,EAAA,CAAA,2BAAA,CAAA;AAAA,QACT,WAAWqB,oCAAyB,CAAA,oBAAA;AAAA,QACpC,KAAO,EAAAb,+BAAA;AAAA,QACP,MAAQ,EAAA,WAAA;AAAA,QACR,OAAA;AAAA,QACA,QAAU,EAAA,EAAE,MAAQ,EAAA,GAAA,EAAK,IAAK;AAAA,OAC/B,CAAA;AAED,MAAA,QAAA,CAAS,KAAK,IAAI,CAAA;AAAA,KACnB,CAAA;AAED,IAAA,MAAA,CAAO,GAAI,CAAA,0BAAA,EAA4B,OAAO,OAAA,EAAS,QAAa,KAAA;AAClE,MAAM,MAAA,QAAA,GAAW,MAAM,IAAK,CAAA,SAAA;AAAA,QAC1B,OAAA;AAAA,QACAT;AAAA,OACF;AAEA,MAAI,IAAA,QAAA,CAAS,MAAW,KAAAO,sCAAA,CAAgB,IAAM,EAAA;AAC5C,QAAA,MAAM,IAAIN,sBAAgB,EAAA;AAAA;AAG5B,MAAM,MAAA,IAAA,GAAO,MAAM,IAAA,CAAK,kBAAmB,CAAA,uBAAA;AAAA,QACzC,KAAK,OAAQ,CAAA;AAAA,OACf;AAEA,MAAM,MAAA,IAAA,CAAK,KAAK,QAAS,CAAA;AAAA,QACvB,OAAS,EAAA,CAAA,yCAAA,CAAA;AAAA,QACT,WAAWsB,+BAAoB,CAAA,mBAAA;AAAA,QAC/B,KAAO,EAAAd,+BAAA;AAAA,QACP,MAAQ,EAAA,WAAA;AAAA,QACR,OAAA;AAAA,QACA,QAAU,EAAA,EAAE,MAAQ,EAAA,GAAA,EAAK,IAAK;AAAA,OAC/B,CAAA;AAED,MAAA,QAAA,CAAS,KAAK,IAAI,CAAA;AAAA,KACnB,CAAA;AAED,IAAA,MAAA,CAAO,GAAI,CAAA,mBAAA,EAAqB,OAAO,OAAA,EAAS,QAAa,KAAA;AAC3D,MAAM,MAAA,QAAA,GAAW,MAAM,IAAK,CAAA,SAAA;AAAA,QAC1B,OAAA;AAAA,QACAT;AAAA,OACF;AAEA,MAAI,IAAA,QAAA,CAAS,MAAW,KAAAO,sCAAA,CAAgB,IAAM,EAAA;AAC5C,QAAA,MAAM,IAAIN,sBAAgB,EAAA;AAAA;AAG5B,MAAM,MAAA,UAAA,GAAa,MAAM,IAAA,CAAK,kBAAmB,CAAA,gBAAA;AAAA,QAC/C,IAAK,CAAA,aAAA,CAAc,OAAQ,CAAA,KAAA,CAAM,aAAa,CAAA;AAAA,QAC9C,IAAK,CAAA,aAAA,CAAc,OAAQ,CAAA,KAAA,CAAM,QAAQ,CAAA;AAAA,QACzC,IAAK,CAAA,aAAA,CAAc,OAAQ,CAAA,KAAA,CAAM,YAAY,CAAA;AAAA,QAC7C,IAAK,CAAA,gBAAA,CAAiB,OAAQ,CAAA,KAAA,CAAM,OAAO;AAAA,OAC7C;AAEA,MAAM,MAAA,IAAA,GACJ,UAAW,CAAA,GAAA,CAAI,CAAa,SAAA,KAAA;AAC1B,QAAO,OAAA;AAAA,UACL,GAAG,SAAA;AAAA,UACH,mBAAmB,SAAU,CAAA,iBAAA,CAAkB,GAAI,CAAA,CAAA,EAAA,KAAM,GAAG,MAAM;AAAA,SACpE;AAAA,OACD,CAAA;AAEH,MAAM,MAAA,IAAA,CAAK,KAAK,QAAS,CAAA;AAAA,QACvB,OAAS,EAAA,CAAA,2CAAA,CAAA;AAAA,QACT,WAAWuB,2BAAgB,CAAA,aAAA;AAAA,QAC3B,KAAO,EAAAf,+BAAA;AAAA,QACP,MAAQ,EAAA,WAAA;AAAA,QACR,OAAA;AAAA,QACA,QAAU,EAAA,EAAE,MAAQ,EAAA,GAAA,EAAK,IAAK;AAAA,OAC/B,CAAA;AAED,MAAA,QAAA,CAAS,KAAK,IAAI,CAAA;AAAA,KACnB,CAAA;AAED,IAAA,MAAA,CAAO,IAAK,CAAA,mBAAA,EAAqB,OAAO,OAAA,EAAS,QAAa,KAAA;AAC5D,MAAM,MAAA,QAAA,GAAW,MAAM,IAAK,CAAA,SAAA;AAAA,QAC1B,OAAA;AAAA,QACAK;AAAA,OACF;AAEA,MAAI,IAAA,QAAA,CAAS,MAAW,KAAAP,sCAAA,CAAgB,IAAM,EAAA;AAC5C,QAAA,MAAM,IAAIN,sBAAgB,EAAA;AAAA;AAG5B,MAAA,MAAM,sBACJ,OAAQ,CAAA,IAAA;AACV,MAAAwB,yCAAA,CAAsB,mBAAmB,CAAA;AAEzC,MAAA,MAAM,oBAAoB,MAAMC,8BAAA;AAAA,QAC9B,mBAAA;AAAA,QACA,IAAK,CAAA,kBAAA;AAAA,QACL,KAAK,OAAQ,CAAA;AAAA,OACf;AAEA,MAAA,MAAM,EACJ,GAAA,MAAM,IAAK,CAAA,kBAAA,CAAmB,gBAAgB,iBAAiB,CAAA;AAEjE,MAAM,MAAA,IAAA,GAAO,EAAE,EAAO,EAAA;AAEtB,MAAM,MAAA,IAAA,CAAK,KAAK,QAA6B,CAAA;AAAA,QAC3C,OAAS,EAAA,CAAA,qCAAA,CAAA;AAAA,QACT,WAAWF,2BAAgB,CAAA,gBAAA;AAAA,QAC3B,QAAA,EAAU,EAAE,SAAA,EAAW,mBAAoB,EAAA;AAAA,QAC3C,KAAO,EAAAf,+BAAA;AAAA,QACP,MAAQ,EAAA,WAAA;AAAA,QACR,OAAA;AAAA,QACA,QAAU,EAAA,EAAE,MAAQ,EAAA,GAAA,EAAK,IAAK;AAAA,OAC/B,CAAA;AAED,MAAA,QAAA,CAAS,MAAO,CAAA,GAAG,CAAE,CAAA,IAAA,CAAK,IAAI,CAAA;AAAA,KAC/B,CAAA;AAED,IAAA,MAAA,CAAO,GAAI,CAAA,uBAAA,EAAyB,OAAO,OAAA,EAAS,QAAa,KAAA;AAC/D,MAAM,MAAA,QAAA,GAAW,MAAM,IAAK,CAAA,SAAA;AAAA,QAC1B,OAAA;AAAA,QACAT;AAAA,OACF;AAEA,MAAI,IAAA,QAAA,CAAS,MAAW,KAAAO,sCAAA,CAAgB,IAAM,EAAA;AAC5C,QAAA,MAAM,IAAIN,sBAAgB,EAAA;AAAA;AAG5B,MAAA,MAAM,EAAa,GAAA,QAAA,CAAS,OAAQ,CAAA,MAAA,CAAO,IAAI,EAAE,CAAA;AACjD,MAAI,IAAA,KAAA,CAAM,EAAE,CAAG,EAAA;AACb,QAAM,MAAA,IAAIY,kBAAW,2BAA2B,CAAA;AAAA;AAGlD,MAAA,MAAM,SAAY,GAAA,MAAM,IAAK,CAAA,kBAAA,CAAmB,aAAa,EAAE,CAAA;AAC/D,MAAA,IAAI,CAAC,SAAW,EAAA;AACd,QAAA,MAAM,IAAIH,oBAAc,EAAA;AAAA;AAG1B,MAAA,MAAM,IAAwD,GAAA;AAAA,QAC5D,GAAG,SAAA;AAAA,QACH,mBAAmB,SAAU,CAAA,iBAAA,CAAkB,GAAI,CAAA,CAAA,EAAA,KAAM,GAAG,MAAM;AAAA,OACpE;AAEA,MAAM,MAAA,IAAA,CAAK,KAAK,QAAS,CAAA;AAAA,QACvB,OAAS,EAAA,CAAA,0CAAA,CAAA;AAAA,QACT,WAAWc,2BAAgB,CAAA,aAAA;AAAA,QAC3B,KAAO,EAAAf,+BAAA;AAAA,QACP,MAAQ,EAAA,WAAA;AAAA,QACR,OAAA;AAAA,QACA,QAAU,EAAA,EAAE,MAAQ,EAAA,GAAA,EAAK,IAAK;AAAA,OAC/B,CAAA;AAED,MAAA,QAAA,CAAS,KAAK,IAAI,CAAA;AAAA,KACnB,CAAA;AAED,IAAA,MAAA,CAAO,MAAO,CAAA,uBAAA,EAAyB,OAAO,OAAA,EAAS,QAAa,KAAA;AAClE,MAAM,MAAA,QAAA,GAAW,MAAM,IAAK,CAAA,SAAA;AAAA,QAC1B,OAAA;AAAA,QACAE;AAAA,OACF;AAEA,MAAI,IAAA,QAAA,CAAS,MAAW,KAAAJ,sCAAA,CAAgB,IAAM,EAAA;AAC5C,QAAA,MAAM,IAAIN,sBAAgB,EAAA;AAAA;AAG5B,MAAA,MAAM,EAAa,GAAA,QAAA,CAAS,OAAQ,CAAA,MAAA,CAAO,IAAI,EAAE,CAAA;AACjD,MAAI,IAAA,KAAA,CAAM,EAAE,CAAG,EAAA;AACb,QAAM,MAAA,IAAIY,kBAAW,2BAA2B,CAAA;AAAA;AAGlD,MAAA,MAAM,SAAY,GAAA,MAAM,IAAK,CAAA,kBAAA,CAAmB,aAAa,EAAE,CAAA;AAC/D,MAAA,IAAI,CAAC,SAAW,EAAA;AACd,QAAA,MAAM,IAAIH,oBAAA,CAAc,CAAqB,kBAAA,EAAA,EAAE,CAAgB,cAAA,CAAA,CAAA;AAAA;AAEjE,MAAA,MAAM,iBACJ,GAAA;AAAA,QACE,GAAG,SAAA;AAAA,QACH,mBAAmB,SAAU,CAAA,iBAAA,CAAkB,GAAI,CAAA,CAAA,EAAA,KAAM,GAAG,MAAM;AAAA,OACpE;AAEF,MAAM,MAAA,IAAA,CAAK,kBAAmB,CAAA,eAAA,CAAgB,EAAE,CAAA;AAEhD,MAAM,MAAA,IAAA,CAAK,KAAK,QAA6B,CAAA;AAAA,QAC3C,OAAS,EAAA,CAAA,qCAAA,CAAA;AAAA,QACT,WAAWc,2BAAgB,CAAA,gBAAA;AAAA,QAC3B,QAAA,EAAU,EAAE,SAAA,EAAW,iBAAkB,EAAA;AAAA,QACzC,KAAO,EAAAf,+BAAA;AAAA,QACP,MAAQ,EAAA,WAAA;AAAA,QACR,OAAA;AAAA,QACA,QAAA,EAAU,EAAE,MAAA,EAAQ,GAAI;AAAA,OACzB,CAAA;AAED,MAAS,QAAA,CAAA,MAAA,CAAO,GAAG,CAAA,CAAE,GAAI,EAAA;AAAA,KAC1B,CAAA;AAED,IAAA,MAAA,CAAO,GAAI,CAAA,uBAAA,EAAyB,OAAO,OAAA,EAAS,QAAa,KAAA;AAC/D,MAAM,MAAA,QAAA,GAAW,MAAM,IAAK,CAAA,SAAA;AAAA,QAC1B,OAAA;AAAA,QACAM;AAAA,OACF;AAEA,MAAI,IAAA,QAAA,CAAS,MAAW,KAAAR,sCAAA,CAAgB,IAAM,EAAA;AAC5C,QAAA,MAAM,IAAIN,sBAAgB,EAAA;AAAA;AAG5B,MAAA,MAAM,EAAa,GAAA,QAAA,CAAS,OAAQ,CAAA,MAAA,CAAO,IAAI,EAAE,CAAA;AACjD,MAAI,IAAA,KAAA,CAAM,EAAE,CAAG,EAAA;AACb,QAAM,MAAA,IAAIY,kBAAW,2BAA2B,CAAA;AAAA;AAGlD,MAAA,MAAM,sBACJ,OAAQ,CAAA,IAAA;AAEV,MAAAY,yCAAA,CAAsB,mBAAmB,CAAA;AAEzC,MAAA,MAAM,oBAAoB,MAAMC,8BAAA;AAAA,QAC9B,mBAAA;AAAA,QACA,IAAK,CAAA,kBAAA;AAAA,QACL,KAAK,OAAQ,CAAA;AAAA,OACf;AAEA,MAAA,MAAM,IAAK,CAAA,kBAAA,CAAmB,eAAgB,CAAA,EAAA,EAAI,iBAAiB,CAAA;AAEnE,MAAM,MAAA,IAAA,CAAK,KAAK,QAA6B,CAAA;AAAA,QAC3C,OAAS,EAAA,CAAA,qCAAA,CAAA;AAAA,QACT,WAAWF,2BAAgB,CAAA,gBAAA;AAAA,QAC3B,QAAA,EAAU,EAAE,SAAA,EAAW,mBAAoB,EAAA;AAAA,QAC3C,KAAO,EAAAf,+BAAA;AAAA,QACP,MAAQ,EAAA,WAAA;AAAA,QACR,OAAA;AAAA,QACA,QAAA,EAAU,EAAE,MAAA,EAAQ,GAAI;AAAA,OACzB,CAAA;AAED,MAAS,QAAA,CAAA,MAAA,CAAO,GAAG,CAAA,CAAE,GAAI,EAAA;AAAA,KAC1B,CAAA;AAED,IAAA,MAAA,CAAO,IAAK,CAAA,cAAA,EAAgB,OAAO,OAAA,EAAS,QAAa,KAAA;AACvD,MAAM,MAAA,QAAA,GAAW,MAAM,IAAK,CAAA,SAAA;AAAA,QAC1B,OAAA;AAAA,QACAK;AAAA,OACF;AAEA,MAAI,IAAA,QAAA,CAAS,MAAW,KAAAP,sCAAA,CAAgB,IAAM,EAAA;AAC5C,QAAA,MAAM,IAAIN,sBAAgB,EAAA;AAAA;AAG5B,MAAI,IAAA,CAAC,KAAK,aAAe,EAAA;AACvB,QAAM,MAAA,IAAIS,qBAAc,CAA8B,4BAAA,CAAA,CAAA;AAAA;AAGxD,MAAA,MAAM,UAAa,GAAA,IAAA,CAAK,aAAc,CAAA,IAAA,CAAK,CAAY,QAAA,KAAA;AACrD,QAAM,MAAA,EAAA,GAAK,SAAS,eAAgB,EAAA;AACpC,QAAO,OAAA,EAAA,KAAO,QAAQ,MAAO,CAAA,EAAA;AAAA,OAC9B,CAAA;AAED,MAAA,IAAI,CAAC,UAAY,EAAA;AACf,QAAA,MAAM,IAAIA,oBAAA;AAAA,UACR,CAAA,kBAAA,EAAqB,OAAQ,CAAA,MAAA,CAAO,EAAE,CAAA,cAAA;AAAA,SACxC;AAAA;AAGF,MAAA,MAAM,WAAW,OAAQ,EAAA;AACzB,MAAS,QAAA,CAAA,MAAA,CAAO,GAAG,CAAA,CAAE,GAAI,EAAA;AAAA,KAC1B,CAAA;AAED,IAAA,MAAA,CAAO,GAAI,CAAAiB,gCAAA,CAAc,IAAK,CAAA,IAAI,CAAC,CAAA;AAEnC,IAAO,OAAA,MAAA;AAAA;AACT,EAEA,kBAAA,CAAmB,SAAkB,IAAwB,EAAA;AAC3D,IAAM,MAAA,IAAA,GAAO,QAAQ,MAAO,CAAA,IAAA;AAC5B,IAAM,MAAA,SAAA,GAAY,QAAQ,MAAO,CAAA,SAAA;AACjC,IAAM,MAAA,IAAA,GAAO,QAAQ,MAAO,CAAA,IAAA;AAC5B,IAAA,MAAM,YAAY,CAAG,EAAA,IAAI,CAAI,CAAA,EAAA,SAAS,IAAI,IAAI,CAAA,CAAA;AAE9C,IAAM,MAAA,GAAA,GAAMC,0CAAwB,CAAA,SAAA,EAAW,IAAI,CAAA;AACnD,IAAA,IAAI,GAAK,EAAA;AACP,MAAM,MAAA,IAAIf,iBAAW,CAAA,GAAA,CAAI,OAAO,CAAA;AAAA;AAGlC,IAAO,OAAA,SAAA;AAAA;AACT,EAEA,MAAM,wBACD,QACyB,EAAA;AAC5B,IAAA,MAAM,kBAAkB,MAAMgB,yBAAA;AAAA,MAC5B,QAAA;AAAA,MACA,IAAK,CAAA;AAAA,KACP;AAEA,IAAA,MAAM,mBAAsC,EAAC;AAC7C,IAAA,KAAA,MAAW,KAAK,QAAU,EAAA;AACxB,MAAA,MAAM,CAAC,eAAA,EAAiB,UAAY,EAAA,MAAA,EAAQ,MAAM,CAAI,GAAA,CAAA;AACtD,MAAA,gBAAA,CAAiB,IAAK,CAAA;AAAA,QACpB,eAAA;AAAA,QACA,UAAA;AAAA,QACA,MAAA;AAAA,QACA,MAAA;AAAA,QACA,UAAU,EAAE,MAAA,EAAQ,eAAgB,CAAA,GAAA,CAAI,eAAe,CAAG;AAAA,OAC3D,CAAA;AAAA;AAGH,IAAO,OAAA,gBAAA;AAAA;AACT,EAEA,MAAM,sBAAsB,KAAoC,EAAA;AAC9D,IAAA,MAAM,gBAA6C,EAAC;AAEpD,IAAA,KAAA,CAAM,OAAQ,CAAA,CAAC,CAAC,KAAA,EAAO,IAAI,CAAM,KAAA;AAC/B,MAAI,IAAA,aAAA,CAAc,cAAe,CAAA,IAAI,CAAG,EAAA;AACtC,QAAc,aAAA,CAAA,IAAI,CAAE,CAAA,IAAA,CAAK,KAAK,CAAA;AAAA,OACzB,MAAA;AACL,QAAc,aAAA,CAAA,IAAI,CAAI,GAAA,CAAC,KAAK,CAAA;AAAA;AAC9B,KACD,CAAA;AAED,IAAM,MAAA,MAAA,GAAiB,MAAM,OAAQ,CAAA,GAAA;AAAA,MACnC,MAAA,CAAO,QAAQ,aAAa,CAAA,CAAE,IAAI,OAAO,CAAC,IAAM,EAAA,KAAK,CAAM,KAAA;AACzD,QAAA,MAAM,WAAc,GAAA,MAAM,IAAK,CAAA,YAAA,CAAa,iBAAiB,IAAI,CAAA;AACjE,QAAA,MAAM,QAAW,GAAA,WAAA,GAAcC,0BAAc,CAAA,WAAW,CAAI,GAAA,KAAA,CAAA;AAC5D,QAAA,OAAO,QAAQ,OAAQ,CAAA;AAAA,UACrB,gBAAkB,EAAA,KAAA;AAAA,UAClB,IAAM,EAAA,IAAA;AAAA,UACN;AAAA,SACD,CAAA;AAAA,OACF;AAAA,KACH;AACA,IAAO,OAAA,MAAA;AAAA;AACT,EAEA,uBAAuB,MAAmC,EAAA;AACxD,IAAO,OAAA;AAAA,MACL,MAAO,CAAA,eAAA;AAAA,MACP,MAAO,CAAA,UAAA;AAAA,MACP,MAAO,CAAA,MAAA;AAAA,MACP,MAAO,CAAA;AAAA,KACT;AAAA;AACF,EAEA,qBAAqB,IAAwB,EAAA;AAC3C,IAAA,MAAM,QAAoB,EAAC;AAC3B,IAAW,KAAA,MAAA,MAAA,IAAU,KAAK,gBAAkB,EAAA;AAC1C,MAAA,KAAA,CAAM,IAAK,CAAA,CAAC,MAAQ,EAAA,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA;AAEhC,IAAO,OAAA,KAAA;AAAA;AACT,EAEA,iBACE,UACgC,EAAA;AAChC,IAAA,IAAI,CAAC,UAAY,EAAA;AACf,MAAO,OAAA,KAAA,CAAA;AAAA;AAET,IAAI,IAAA,KAAA,CAAM,OAAQ,CAAA,UAAU,CAAG,EAAA;AAC7B,MAAA,MAAM,kBAAsC,EAAC;AAC7C,MAAA,KAAA,MAAW,mBAAmB,UAAY,EAAA;AACxC,QAAA,IACE,OAAO,eAAA,KAAoB,QAC3B,IAAAC,yBAAA,CAAmB,eAAe,CAClC,EAAA;AACA,UAAA,eAAA,CAAgB,KAAK,eAAe,CAAA;AAAA,SAC/B,MAAA;AACL,UAAA,MAAM,IAAIlB,iBAAA;AAAA,YACR,0CAA0C,eAAe,CAAA,mCAAA;AAAA,WAC3D;AAAA;AACF;AAEF,MAAO,OAAA,eAAA;AAAA;AAGT,IAAA,IAAI,OAAO,UAAA,KAAe,QAAY,IAAAkB,yBAAA,CAAmB,UAAU,CAAG,EAAA;AACpE,MAAA,OAAO,CAAC,UAAU,CAAA;AAAA;AAEpB,IAAA,MAAM,IAAIlB,iBAAA;AAAA,MACR,0CAA0C,UAAU,CAAA,mCAAA;AAAA,KACtD;AAAA;AACF,EAEA,cACE,UACQ,EAAA;AACR,IAAA,IAAI,CAAC,UAAY,EAAA;AACf,MAAO,OAAA,EAAA;AAAA;AAET,IAAI,IAAA,KAAA,CAAM,OAAQ,CAAA,UAAU,CAAG,EAAA;AAC7B,MAAA,IAAI,OAAO,UAAA,CAAW,CAAC,CAAA,KAAM,QAAU,EAAA;AACrC,QAAO,OAAA,UAAA,CAAW,CAAC,CAAA,CAAE,QAAS,EAAA;AAAA;AAEhC,MAAM,MAAA,IAAIA,kBAAW,CAAuC,qCAAA,CAAA,CAAA;AAAA;AAG9D,IAAI,IAAA,OAAO,eAAe,QAAU,EAAA;AAClC,MAAO,OAAA,UAAA;AAAA;AAET,IAAM,MAAA,IAAIA,kBAAW,CAAuC,qCAAA,CAAA,CAAA;AAAA;AAC9D,EAEA,sBAAsB,OAA2B,EAAA;AAC/C,IAAA,OACE,CAAC,CAAC,OAAA,CAAQ,MAAM,SAChB,IAAA,CAAC,CAAC,OAAQ,CAAA,KAAA,CAAM,UAChB,IAAA,CAAC,CAAC,OAAQ,CAAA,KAAA,CAAM,UAChB,CAAC,CAAC,QAAQ,KAAM,CAAA,MAAA;AAAA;AAEpB,EAEA,MAAM,eAAA,CACJ,WACA,EAAA,KAAA,EACA,YACqB,EAAA;AACrB,IAAA,MAAM,WAAuB,EAAC;AAC9B,IAAM,MAAA,WAAA,uBAAkB,GAAY,EAAA;AACpC,IAAA,KAAA,MAAW,UAAU,WAAa,EAAA;AAChC,MAAI,IAAA,GAAA,GAAMmB,kCAAe,MAAM,CAAA;AAC/B,MAAA,IAAI,GAAK,EAAA;AACP,QAAA,MAAM,IAAInB,iBAAA;AAAA,UACR,CAAW,QAAA,EAAA,YAAA,IAAgB,QAAQ,CAAA,oBAAA,EACjC,IAAI,OACN,CAAA;AAAA,SACF;AAAA;AAGF,MAAM,MAAA,QAAA,GAAW,MAAM,IAAA,CAAK,YAAa,CAAA,gBAAA;AAAA,QACvC,MAAO,CAAA;AAAA,OACT;AAEA,MAAI,IAAA,MAAA,GAAS,eAAe,MAAS,GAAA,QAAA;AACrC,MAAA,MAAA,GAAS,QAAQ,MAAS,GAAA,KAAA;AAE1B,MAAM,GAAA,GAAA,MAAMM,iCAAe,CAAA,MAAA,EAAQ,QAAQ,CAAA;AAC3C,MAAA,IAAI,GAAK,EAAA;AACP,QAAA,MAAM,IAAIlB,sBAAA;AAAA,UACR,aAAa,MAAM,CAAA,QAAA,EAAW,MAAO,CAAA,eAAe,IAAI,MAAO,CAAA,UAAU,CAAI,CAAA,EAAA,MAAA,CAAO,MAAM,CAAI,CAAA,EAAA,MAAA,CAAO,MAAM,CAAA,EAAA,EAAK,IAAI,OAAO,CAAA;AAAA,SAC7H;AAAA;AAGF,MAAM,MAAA,iBAAA,GAAoB,IAAK,CAAA,sBAAA,CAAuB,MAAM,CAAA;AAC5D,MAAI,IAAA,KAAA,IAAS,CAAE,MAAM,IAAA,CAAK,SAAS,SAAU,CAAA,GAAG,iBAAiB,CAAI,EAAA;AACnE,QAAA,MAAM,IAAIS,oBAAA;AAAA,UACR,CAAA,QAAA,EAAWuB,qBAAe,CAAA,iBAAiB,CAAC,CAAA,WAAA;AAAA,SAC9C;AAAA;AAGF,MAAI,IAAA,CAAC,SAAU,MAAM,IAAA,CAAK,SAAS,SAAU,CAAA,GAAG,iBAAiB,CAAI,EAAA;AACnE,QAAA,MAAM,IAAIb,oBAAA;AAAA,UACR,CAAW,QAAA,EAAAa,qBAAA;AAAA,YACT;AAAA,WACD,CAAA,yBAAA;AAAA,SACH;AAAA;AAIF,MAAM,MAAA,SAAA,GAAY,IAAK,CAAA,SAAA,CAAU,iBAAiB,CAAA;AAClD,MAAI,IAAA,WAAA,CAAY,GAAI,CAAA,SAAS,CAAG,EAAA;AAC9B,QAAA,MAAM,IAAIb,oBAAA;AAAA,UACR,CAAA,yBAAA,EAA4B,MAAO,CAAA,eAAe,CAAK,EAAA,EAAA,MAAA,CAAO,UAAU,CAAA,EAAA,EAAK,MAAO,CAAA,MAAM,CAAK,EAAA,EAAA,MAAA,CAAO,MAAM,CAAA,eAAA;AAAA,SAC9G;AAAA,OACK,MAAA;AACL,QAAA,WAAA,CAAY,IAAI,SAAS,CAAA;AACzB,QAAA,QAAA,CAAS,KAAK,iBAAiB,CAAA;AAAA;AACjC;AAEF,IAAO,OAAA,QAAA;AAAA;AACT,EAEA,QAAA,CAAS,OAAe,KAAuB,EAAA;AAC7C,IAAA,IAAI,MAAM,iBAAkB,CAAA,OAAO,IAAI,KAAM,CAAA,iBAAA,CAAkB,OAAO,CAAG,EAAA;AACvE,MAAO,OAAA,CAAA,CAAA;AAAA;AAET,IAAA,IAAI,MAAM,iBAAkB,CAAA,OAAO,IAAI,KAAM,CAAA,iBAAA,CAAkB,OAAO,CAAG,EAAA;AACvE,MAAO,OAAA,CAAA;AAAA;AAET,IAAO,OAAA,CAAA;AAAA;AAEX;;;;"}
+{"version":3,"file":"policies-rest-api.cjs.js","sources":["../../src/service/policies-rest-api.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport type { PermissionsService } from '@backstage/backend-plugin-api';\nimport {\n  ConflictError,\n  InputError,\n  NotAllowedError,\n  NotFoundError,\n  ServiceUnavailableError,\n} from '@backstage/errors';\nimport { createRouter } from '@backstage/plugin-permission-backend';\nimport {\n  AuthorizeResult,\n  PolicyDecision,\n  ResourcePermission,\n} from '@backstage/plugin-permission-common';\nimport { createPermissionIntegrationRouter } from '@backstage/plugin-permission-node';\n\nimport type { AuditLogger } from '@janus-idp/backstage-plugin-audit-log-node';\nimport express from 'express';\nimport type { Request } from 'express-serve-static-core';\nimport { isEmpty, isEqual } from 'lodash';\nimport type { ParsedQs } from 'qs';\n\nimport {\n  PermissionAction,\n  policyEntityCreatePermission,\n  policyEntityDeletePermission,\n  policyEntityPermissions,\n  policyEntityReadPermission,\n  policyEntityUpdatePermission,\n  RESOURCE_TYPE_POLICY_ENTITY,\n  Role,\n  RoleBasedPolicy,\n  RoleConditionalPolicyDecision,\n} from '@backstage-community/plugin-rbac-common';\nimport type { RBACProvider } from '@backstage-community/plugin-rbac-node';\n\nimport {\n  ConditionAuditInfo,\n  ConditionEvents,\n  ListConditionEvents,\n  ListPluginPoliciesEvents,\n  PermissionAuditInfo,\n  PermissionEvents,\n  RoleAuditInfo,\n  RoleEvents,\n  SEND_RESPONSE_STAGE,\n} from '../audit-log/audit-logger';\nimport { auditError as logAuditError } from '../audit-log/rest-errors-interceptor';\nimport { ConditionalStorage } from '../database/conditional-storage';\nimport {\n  daoToMetadata,\n  RoleMetadataDao,\n  RoleMetadataStorage,\n} from '../database/role-metadata';\nimport {\n  buildRoleSourceMap,\n  deepSortedEqual,\n  isPermissionAction,\n  policyToString,\n  processConditionMapping,\n} from '../helper';\nimport { validateRoleCondition } from '../validation/condition-validation';\nimport {\n  validateEntityReference,\n  validatePolicy,\n  validateRole,\n  validateSource,\n} from '../validation/policies-validation';\nimport { EnforcerDelegate } from './enforcer-delegate';\nimport { PluginPermissionMetadataCollector } from './plugin-endpoints';\nimport { RBACRouterOptions } from './policy-builder';\n\nexport class PoliciesServer {\n  constructor(\n    private readonly permissions: PermissionsService,\n    private readonly options: RBACRouterOptions,\n    private readonly enforcer: EnforcerDelegate,\n    private readonly conditionalStorage: ConditionalStorage,\n    private readonly pluginPermMetaData: PluginPermissionMetadataCollector,\n    private readonly roleMetadata: RoleMetadataStorage,\n    private readonly aLog: AuditLogger,\n    private readonly rbacProviders?: RBACProvider[],\n  ) {}\n\n  private async authorize(\n    request: Request,\n    permission: ResourcePermission,\n  ): Promise<PolicyDecision> {\n    const credentials = await this.options.httpAuth.credentials(request, {\n      allow: ['user', 'service'],\n    });\n\n    // allow service to service communication, but only with read permission\n    if (\n      this.options.auth.isPrincipal(credentials, 'service') &&\n      permission !== policyEntityReadPermission\n    ) {\n      throw new NotAllowedError(\n        `Only creadential principal with type 'user' permitted to modify permissions`,\n      );\n    }\n\n    const decision = (\n      await this.permissions.authorize(\n        [{ permission: permission, resourceRef: permission.resourceType }],\n        { credentials },\n      )\n    )[0];\n\n    return decision;\n  }\n\n  async serve(): Promise<express.Router> {\n    const router = await createRouter(this.options);\n\n    const { httpAuth } = this.options;\n\n    if (!httpAuth) {\n      throw new ServiceUnavailableError(\n        'httpAuth not found, ensure the correct configuration for the RBAC plugin',\n      );\n    }\n\n    const permissionsIntegrationRouter = createPermissionIntegrationRouter({\n      resourceType: RESOURCE_TYPE_POLICY_ENTITY,\n      permissions: policyEntityPermissions,\n    });\n    router.use(permissionsIntegrationRouter);\n\n    const isPluginEnabled =\n      this.options.config.getOptionalBoolean('permission.enabled');\n    if (!isPluginEnabled) {\n      return router;\n    }\n\n    router.get('/', async (request, response) => {\n      const decision = await this.authorize(\n        request,\n        policyEntityReadPermission,\n      );\n\n      if (decision.result === AuthorizeResult.DENY) {\n        throw new NotAllowedError(); // 403\n      }\n      response.send({ status: 'Authorized' });\n    });\n\n    // Policy CRUD\n\n    router.get('/policies', async (request, response) => {\n      const decision = await this.authorize(\n        request,\n        policyEntityReadPermission,\n      );\n\n      if (decision.result === AuthorizeResult.DENY) {\n        throw new NotAllowedError(); // 403\n      }\n\n      let policies: string[][];\n      if (this.isPolicyFilterEnabled(request)) {\n        const entityRef = this.getFirstQuery(request.query.entityRef);\n        const permission = this.getFirstQuery(request.query.permission);\n        const policy = this.getFirstQuery(request.query.policy);\n        const effect = this.getFirstQuery(request.query.effect);\n\n        const filter: string[] = [entityRef, permission, policy, effect];\n        policies = await this.enforcer.getFilteredPolicy(0, ...filter);\n      } else {\n        policies = await this.enforcer.getPolicy();\n      }\n\n      const body = await this.transformPolicyArray(...policies);\n\n      await this.aLog.auditLog({\n        message: `Return list permission policies`,\n        eventName: PermissionEvents.GET_POLICY,\n        stage: SEND_RESPONSE_STAGE,\n        status: 'succeeded',\n        request,\n        response: { status: 200, body },\n      });\n\n      response.json(body);\n    });\n\n    router.get(\n      '/policies/:kind/:namespace/:name',\n      async (request, response) => {\n        const decision = await this.authorize(\n          request,\n          policyEntityReadPermission,\n        );\n\n        if (decision.result === AuthorizeResult.DENY) {\n          throw new NotAllowedError(); // 403\n        }\n\n        const entityRef = this.getEntityReference(request);\n\n        const policy = await this.enforcer.getFilteredPolicy(0, entityRef);\n        if (policy.length !== 0) {\n          const body = await this.transformPolicyArray(...policy);\n\n          await this.aLog.auditLog({\n            message: `Return permission policy`,\n            eventName: PermissionEvents.GET_POLICY,\n            stage: SEND_RESPONSE_STAGE,\n            status: 'succeeded',\n            request,\n            response: { status: 200, body },\n          });\n\n          response.json(body);\n        } else {\n          throw new NotFoundError(); // 404\n        }\n      },\n    );\n\n    router.delete(\n      '/policies/:kind/:namespace/:name',\n      async (request, response) => {\n        const decision = await this.authorize(\n          request,\n          policyEntityDeletePermission,\n        );\n\n        if (decision.result === AuthorizeResult.DENY) {\n          throw new NotAllowedError(); // 403\n        }\n\n        const entityRef = this.getEntityReference(request);\n\n        const policyRaw: RoleBasedPolicy[] = request.body;\n        if (isEmpty(policyRaw)) {\n          throw new InputError(`permission policy must be present`); // 400\n        }\n\n        policyRaw.forEach(element => {\n          element.entityReference = entityRef;\n        });\n\n        const processedPolicies = await this.processPolicies(policyRaw, true);\n\n        await this.enforcer.removePolicies(processedPolicies);\n\n        await this.aLog.auditLog<PermissionAuditInfo>({\n          message: `Deleted permission policies`,\n          eventName: PermissionEvents.DELETE_POLICY,\n          metadata: { policies: processedPolicies, source: 'rest' },\n          stage: SEND_RESPONSE_STAGE,\n          status: 'succeeded',\n          request,\n          response: { status: 204 },\n        });\n\n        response.status(204).end();\n      },\n    );\n\n    router.post('/policies', async (request, response) => {\n      const decision = await this.authorize(\n        request,\n        policyEntityCreatePermission,\n      );\n\n      if (decision.result === AuthorizeResult.DENY) {\n        throw new NotAllowedError(); // 403\n      }\n\n      const policyRaw: RoleBasedPolicy[] = request.body;\n\n      if (isEmpty(policyRaw)) {\n        throw new InputError(`permission policy must be present`); // 400\n      }\n\n      const processedPolicies = await this.processPolicies(policyRaw);\n\n      const entityRef = processedPolicies[0][0];\n      const roleMetadata = await this.roleMetadata.findRoleMetadata(entityRef);\n      if (entityRef.startsWith('role:default') && !roleMetadata) {\n        throw new Error(`Corresponding role ${entityRef} was not found`);\n      }\n\n      await this.enforcer.addPolicies(processedPolicies);\n\n      await this.aLog.auditLog<PermissionAuditInfo>({\n        message: `Created permission policies`,\n        eventName: PermissionEvents.CREATE_POLICY,\n        metadata: { policies: processedPolicies, source: 'rest' },\n        stage: SEND_RESPONSE_STAGE,\n        status: 'succeeded',\n        request,\n        response: { status: 201 },\n      });\n\n      response.status(201).end();\n    });\n\n    router.put(\n      '/policies/:kind/:namespace/:name',\n      async (request, response) => {\n        const decision = await this.authorize(\n          request,\n          policyEntityUpdatePermission,\n        );\n\n        if (decision.result === AuthorizeResult.DENY) {\n          throw new NotAllowedError(); // 403\n        }\n\n        const entityRef = this.getEntityReference(request);\n\n        const oldPolicyRaw: RoleBasedPolicy[] = request.body.oldPolicy;\n        if (isEmpty(oldPolicyRaw)) {\n          throw new InputError(`'oldPolicy' object must be present`); // 400\n        }\n        const newPolicyRaw: RoleBasedPolicy[] = request.body.newPolicy;\n        if (isEmpty(newPolicyRaw)) {\n          throw new InputError(`'newPolicy' object must be present`); // 400\n        }\n\n        [...oldPolicyRaw, ...newPolicyRaw].forEach(element => {\n          element.entityReference = entityRef;\n        });\n\n        const processedOldPolicy = await this.processPolicies(\n          oldPolicyRaw,\n          true,\n          'old policy',\n        );\n\n        oldPolicyRaw.sort((a, b) =>\n          a.permission === b.permission\n            ? this.nameSort(a.policy!, b.policy!)\n            : this.nameSort(a.permission!, b.permission!),\n        );\n\n        newPolicyRaw.sort((a, b) =>\n          a.permission === b.permission\n            ? this.nameSort(a.policy!, b.policy!)\n            : this.nameSort(a.permission!, b.permission!),\n        );\n\n        if (\n          isEqual(oldPolicyRaw, newPolicyRaw) &&\n          !oldPolicyRaw.some(isEmpty)\n        ) {\n          response.status(204).end();\n        } else if (oldPolicyRaw.length > newPolicyRaw.length) {\n          throw new InputError(\n            `'oldPolicy' object has more permission policies compared to 'newPolicy' object`,\n          );\n        }\n\n        const processedNewPolicy = await this.processPolicies(\n          newPolicyRaw,\n          false,\n          'new policy',\n        );\n\n        const roleMetadata =\n          await this.roleMetadata.findRoleMetadata(entityRef);\n        if (entityRef.startsWith('role:default') && !roleMetadata) {\n          throw new Error(`Corresponding role ${entityRef} was not found`);\n        }\n\n        await this.enforcer.updatePolicies(\n          processedOldPolicy,\n          processedNewPolicy,\n        );\n\n        await this.aLog.auditLog<PermissionAuditInfo>({\n          message: `Updated permission policies`,\n          eventName: PermissionEvents.UPDATE_POLICY,\n          metadata: { policies: processedNewPolicy, source: 'rest' },\n          stage: SEND_RESPONSE_STAGE,\n          status: 'succeeded',\n          request,\n          response: { status: 200 },\n        });\n\n        response.status(200).end();\n      },\n    );\n\n    // Role CRUD\n\n    router.get('/roles', async (request, response) => {\n      const decision = await this.authorize(\n        request,\n        policyEntityReadPermission,\n      );\n\n      if (decision.result === AuthorizeResult.DENY) {\n        throw new NotAllowedError(); // 403\n      }\n\n      const roles = await this.enforcer.getGroupingPolicy();\n\n      const body = await this.transformRoleArray(...roles);\n\n      await this.aLog.auditLog({\n        message: `Return list roles`,\n        eventName: RoleEvents.GET_ROLE,\n        stage: SEND_RESPONSE_STAGE,\n        status: 'succeeded',\n        request,\n        response: { status: 200, body },\n      });\n\n      response.json(body);\n    });\n\n    router.get('/roles/:kind/:namespace/:name', async (request, response) => {\n      const decision = await this.authorize(\n        request,\n        policyEntityReadPermission,\n      );\n\n      if (decision.result === AuthorizeResult.DENY) {\n        throw new NotAllowedError(); // 403\n      }\n      const roleEntityRef = this.getEntityReference(request, true);\n\n      const role = await this.enforcer.getFilteredGroupingPolicy(\n        1,\n        roleEntityRef,\n      );\n\n      if (role.length !== 0) {\n        const body = await this.transformRoleArray(...role);\n\n        await this.aLog.auditLog({\n          message: `Return ${body[0].name}`,\n          eventName: RoleEvents.GET_ROLE,\n          stage: SEND_RESPONSE_STAGE,\n          status: 'succeeded',\n          request,\n          response: { status: 200, body },\n        });\n\n        response.json(body);\n      } else {\n        throw new NotFoundError(); // 404\n      }\n    });\n\n    router.post('/roles', async (request, response) => {\n      const uniqueItems = new Set<string>();\n      const decision = await this.authorize(\n        request,\n        policyEntityCreatePermission,\n      );\n\n      if (decision.result === AuthorizeResult.DENY) {\n        throw new NotAllowedError(); // 403\n      }\n      const roleRaw: Role = request.body;\n      let err = validateRole(roleRaw);\n      if (err) {\n        throw new InputError( // 400\n          `Invalid role definition. Cause: ${err.message}`,\n        );\n      }\n      this.transformMemberReferencesToLowercase(roleRaw);\n\n      const rMetadata = await this.roleMetadata.findRoleMetadata(roleRaw.name);\n\n      err = await validateSource('rest', rMetadata);\n      if (err) {\n        throw new NotAllowedError(`Unable to add role: ${err.message}`);\n      }\n\n      const roles = this.transformRoleToArray(roleRaw);\n\n      for (const role of roles) {\n        if (await this.enforcer.hasGroupingPolicy(...role)) {\n          throw new ConflictError(); // 409\n        }\n        const roleString = JSON.stringify(role);\n\n        if (uniqueItems.has(roleString)) {\n          throw new ConflictError(\n            `Duplicate role members found; ${role.at(0)}, ${role.at(\n              1,\n            )} is a duplicate`,\n          );\n        } else {\n          uniqueItems.add(roleString);\n        }\n      }\n\n      const credentials = await httpAuth.credentials(request, {\n        allow: ['user'],\n      });\n      const modifiedBy = credentials.principal.userEntityRef;\n      const metadata: RoleMetadataDao = {\n        roleEntityRef: roleRaw.name,\n        source: 'rest',\n        description: roleRaw.metadata?.description ?? '',\n        author: modifiedBy,\n        modifiedBy,\n      };\n\n      await this.enforcer.addGroupingPolicies(roles, metadata);\n\n      await this.aLog.auditLog<RoleAuditInfo>({\n        message: `Created ${metadata.roleEntityRef}`,\n        eventName: RoleEvents.CREATE_ROLE,\n        metadata: {\n          ...metadata,\n          members: roles.map(gp => gp[0]),\n        },\n        stage: SEND_RESPONSE_STAGE,\n        status: 'succeeded',\n        request,\n        response: { status: 201 },\n      });\n\n      response.status(201).end();\n    });\n\n    router.put('/roles/:kind/:namespace/:name', async (request, response) => {\n      const uniqueItems = new Set<string>();\n      const decision = await this.authorize(\n        request,\n        policyEntityUpdatePermission,\n      );\n\n      if (decision.result === AuthorizeResult.DENY) {\n        throw new NotAllowedError(); // 403\n      }\n      const roleEntityRef = this.getEntityReference(request, true);\n\n      const oldRoleRaw: Role = request.body.oldRole;\n\n      if (!oldRoleRaw) {\n        throw new InputError(`'oldRole' object must be present`); // 400\n      }\n      const newRoleRaw: Role = request.body.newRole;\n      if (!newRoleRaw) {\n        throw new InputError(`'newRole' object must be present`); // 400\n      }\n\n      oldRoleRaw.name = roleEntityRef;\n      let err = validateRole(oldRoleRaw);\n      if (err) {\n        throw new InputError( // 400\n          `Invalid old role object. Cause: ${err.message}`,\n        );\n      }\n      err = validateRole(newRoleRaw);\n      if (err) {\n        throw new InputError( // 400\n          `Invalid new role object. Cause: ${err.message}`,\n        );\n      }\n      this.transformMemberReferencesToLowercase(oldRoleRaw);\n      this.transformMemberReferencesToLowercase(newRoleRaw);\n\n      const oldRole = this.transformRoleToArray(oldRoleRaw);\n      const newRole = this.transformRoleToArray(newRoleRaw);\n      // todo shell we allow newRole with an empty array?...\n\n      const credentials = await httpAuth.credentials(request, {\n        allow: ['user'],\n      });\n\n      const newMetadata: RoleMetadataDao = {\n        ...newRoleRaw.metadata,\n        source: newRoleRaw.metadata?.source ?? 'rest',\n        roleEntityRef: newRoleRaw.name,\n        modifiedBy: credentials.principal.userEntityRef,\n      };\n\n      const oldMetadata =\n        await this.roleMetadata.findRoleMetadata(roleEntityRef);\n      if (!oldMetadata) {\n        throw new NotFoundError(`Unable to find metadata for ${roleEntityRef}`);\n      }\n\n      err = await validateSource('rest', oldMetadata);\n      if (err) {\n        throw new NotAllowedError(`Unable to edit role: ${err.message}`);\n      }\n\n      if (\n        isEqual(oldRole, newRole) &&\n        deepSortedEqual(oldMetadata, newMetadata, [\n          'author',\n          'modifiedBy',\n          'createdAt',\n          'lastModified',\n        ])\n      ) {\n        // no content: old role and new role are equal and their metadata too\n        response.status(204).end();\n        return;\n      }\n\n      for (const role of newRole) {\n        const hasRole = oldRole.some(element => {\n          return isEqual(element, role);\n        });\n        // if the role is already part of old role and is a grouping policy we want to skip returning a conflict error\n        // to allow for other roles to be checked and added\n        if (await this.enforcer.hasGroupingPolicy(...role)) {\n          if (!hasRole) {\n            throw new ConflictError(); // 409\n          }\n        }\n        const roleString = JSON.stringify(role);\n\n        if (uniqueItems.has(roleString)) {\n          throw new ConflictError(\n            `Duplicate role members found; ${role.at(0)}, ${role.at(\n              1,\n            )} is a duplicate`,\n          );\n        } else {\n          uniqueItems.add(roleString);\n        }\n      }\n\n      uniqueItems.clear();\n      for (const role of oldRole) {\n        if (!(await this.enforcer.hasGroupingPolicy(...role))) {\n          throw new NotFoundError(\n            `Member reference: ${role[0]} was not found for role ${roleEntityRef}`,\n          ); // 404\n        }\n        const roleString = JSON.stringify(role);\n\n        if (uniqueItems.has(roleString)) {\n          throw new ConflictError(\n            `Duplicate role members found; ${role.at(0)}, ${role.at(\n              1,\n            )} is a duplicate`,\n          );\n        } else {\n          uniqueItems.add(roleString);\n        }\n      }\n\n      await this.enforcer.updateGroupingPolicies(oldRole, newRole, newMetadata);\n\n      let message = `Updated ${oldMetadata.roleEntityRef}.`;\n      if (newMetadata.roleEntityRef !== oldMetadata.roleEntityRef) {\n        message = `${message}. Role entity reference renamed to ${newMetadata.roleEntityRef}`;\n      }\n      await this.aLog.auditLog<RoleAuditInfo>({\n        message,\n        eventName: RoleEvents.UPDATE_ROLE,\n        metadata: {\n          ...newMetadata,\n          members: newRole.map(gp => gp[0]),\n        },\n        stage: SEND_RESPONSE_STAGE,\n        status: 'succeeded',\n        request,\n        response: { status: 200 },\n      });\n\n      response.status(200).end();\n    });\n\n    router.delete(\n      '/roles/:kind/:namespace/:name',\n      async (request, response) => {\n        const decision = await this.authorize(\n          request,\n          policyEntityDeletePermission,\n        );\n\n        if (decision.result === AuthorizeResult.DENY) {\n          throw new NotAllowedError(); // 403\n        }\n\n        const roleEntityRef = this.getEntityReference(request, true);\n\n        let roleMembers = [];\n        if (request.query.memberReferences) {\n          const memberReference = this.getFirstQuery(\n            request.query.memberReferences!,\n          ).toLocaleLowerCase('en-US');\n          const gp = await this.enforcer.getFilteredGroupingPolicy(\n            0,\n            memberReference,\n            roleEntityRef,\n          );\n          if (gp.length > 0) {\n            roleMembers.push(gp[0]);\n          } else {\n            throw new NotFoundError(\n              `role member '${memberReference}' was not found`,\n            ); // 404\n          }\n        } else {\n          roleMembers = await this.enforcer.getFilteredGroupingPolicy(\n            1,\n            roleEntityRef,\n          );\n        }\n\n        for (const role of roleMembers) {\n          if (!(await this.enforcer.hasGroupingPolicy(...role))) {\n            throw new NotFoundError(`role member '${role[0]}' was not found`);\n          }\n        }\n\n        const currentMetadata =\n          await this.roleMetadata.findRoleMetadata(roleEntityRef);\n        const err = await validateSource('rest', currentMetadata);\n        if (err) {\n          throw new NotAllowedError(`Unable to delete role: ${err.message}`);\n        }\n\n        const credentials = await httpAuth.credentials(request, {\n          allow: ['user'],\n        });\n\n        const metadata: RoleMetadataDao = {\n          roleEntityRef,\n          source: 'rest',\n          modifiedBy: credentials.principal.userEntityRef,\n        };\n\n        await this.enforcer.removeGroupingPolicies(\n          roleMembers,\n          metadata,\n          false,\n        );\n\n        await this.aLog.auditLog<RoleAuditInfo>({\n          message: `Deleted ${metadata.roleEntityRef}`,\n          eventName: RoleEvents.DELETE_ROLE,\n          metadata: {\n            ...metadata,\n            members: roleMembers.map(gp => gp[0]),\n          },\n          stage: SEND_RESPONSE_STAGE,\n          status: 'succeeded',\n          request,\n          response: { status: 204 },\n        });\n\n        response.status(204).end();\n      },\n    );\n\n    router.get('/plugins/policies', async (request, response) => {\n      const decision = await this.authorize(\n        request,\n        policyEntityReadPermission,\n      );\n\n      if (decision.result === AuthorizeResult.DENY) {\n        throw new NotAllowedError(); // 403\n      }\n\n      const body = await this.pluginPermMetaData.getPluginPolicies(\n        this.options.auth,\n      );\n\n      await this.aLog.auditLog({\n        message: `Return list plugin policies`,\n        eventName: ListPluginPoliciesEvents.GET_PLUGINS_POLICIES,\n        stage: SEND_RESPONSE_STAGE,\n        status: 'succeeded',\n        request,\n        response: { status: 200, body },\n      });\n\n      response.json(body);\n    });\n\n    router.get('/plugins/condition-rules', async (request, response) => {\n      const decision = await this.authorize(\n        request,\n        policyEntityReadPermission,\n      );\n\n      if (decision.result === AuthorizeResult.DENY) {\n        throw new NotAllowedError(); // 403\n      }\n\n      const body = await this.pluginPermMetaData.getPluginConditionRules(\n        this.options.auth,\n      );\n\n      await this.aLog.auditLog({\n        message: `Return list conditional rules and schemas`,\n        eventName: ListConditionEvents.GET_CONDITION_RULES,\n        stage: SEND_RESPONSE_STAGE,\n        status: 'succeeded',\n        request,\n        response: { status: 200, body },\n      });\n\n      response.json(body);\n    });\n\n    router.get('/roles/conditions', async (request, response) => {\n      const decision = await this.authorize(\n        request,\n        policyEntityReadPermission,\n      );\n\n      if (decision.result === AuthorizeResult.DENY) {\n        throw new NotAllowedError(); // 403\n      }\n\n      const conditions = await this.conditionalStorage.filterConditions(\n        this.getFirstQuery(request.query.roleEntityRef),\n        this.getFirstQuery(request.query.pluginId),\n        this.getFirstQuery(request.query.resourceType),\n        this.getActionQueries(request.query.actions),\n      );\n\n      const body: RoleConditionalPolicyDecision<PermissionAction>[] =\n        conditions.map(condition => {\n          return {\n            ...condition,\n            permissionMapping: condition.permissionMapping.map(pm => pm.action),\n          };\n        });\n\n      await this.aLog.auditLog({\n        message: `Return list conditional permission policies`,\n        eventName: ConditionEvents.GET_CONDITION,\n        stage: SEND_RESPONSE_STAGE,\n        status: 'succeeded',\n        request,\n        response: { status: 200, body },\n      });\n\n      response.json(body);\n    });\n\n    router.post('/roles/conditions', async (request, response) => {\n      const decision = await this.authorize(\n        request,\n        policyEntityCreatePermission,\n      );\n\n      if (decision.result === AuthorizeResult.DENY) {\n        throw new NotAllowedError(); // 403\n      }\n\n      const roleConditionPolicy: RoleConditionalPolicyDecision<PermissionAction> =\n        request.body;\n      validateRoleCondition(roleConditionPolicy);\n\n      const conditionToCreate = await processConditionMapping(\n        roleConditionPolicy,\n        this.pluginPermMetaData,\n        this.options.auth,\n      );\n\n      const id =\n        await this.conditionalStorage.createCondition(conditionToCreate);\n\n      const body = { id: id };\n\n      await this.aLog.auditLog<ConditionAuditInfo>({\n        message: `Created conditional permission policy`,\n        eventName: ConditionEvents.CREATE_CONDITION,\n        metadata: { condition: roleConditionPolicy },\n        stage: SEND_RESPONSE_STAGE,\n        status: 'succeeded',\n        request,\n        response: { status: 201, body },\n      });\n\n      response.status(201).json(body);\n    });\n\n    router.get('/roles/conditions/:id', async (request, response) => {\n      const decision = await this.authorize(\n        request,\n        policyEntityReadPermission,\n      );\n\n      if (decision.result === AuthorizeResult.DENY) {\n        throw new NotAllowedError(); // 403\n      }\n\n      const id: number = parseInt(request.params.id, 10);\n      if (isNaN(id)) {\n        throw new InputError('Id is not a valid number.');\n      }\n\n      const condition = await this.conditionalStorage.getCondition(id);\n      if (!condition) {\n        throw new NotFoundError();\n      }\n\n      const body: RoleConditionalPolicyDecision<PermissionAction> = {\n        ...condition,\n        permissionMapping: condition.permissionMapping.map(pm => pm.action),\n      };\n\n      await this.aLog.auditLog({\n        message: `Return conditional permission policy by id`,\n        eventName: ConditionEvents.GET_CONDITION,\n        stage: SEND_RESPONSE_STAGE,\n        status: 'succeeded',\n        request,\n        response: { status: 200, body },\n      });\n\n      response.json(body);\n    });\n\n    router.delete('/roles/conditions/:id', async (request, response) => {\n      const decision = await this.authorize(\n        request,\n        policyEntityDeletePermission,\n      );\n\n      if (decision.result === AuthorizeResult.DENY) {\n        throw new NotAllowedError(); // 403\n      }\n\n      const id: number = parseInt(request.params.id, 10);\n      if (isNaN(id)) {\n        throw new InputError('Id is not a valid number.');\n      }\n\n      const condition = await this.conditionalStorage.getCondition(id);\n      if (!condition) {\n        throw new NotFoundError(`Condition with id ${id} was not found`);\n      }\n      const conditionToDelete: RoleConditionalPolicyDecision<PermissionAction> =\n        {\n          ...condition,\n          permissionMapping: condition.permissionMapping.map(pm => pm.action),\n        };\n\n      await this.conditionalStorage.deleteCondition(id);\n\n      await this.aLog.auditLog<ConditionAuditInfo>({\n        message: `Deleted conditional permission policy`,\n        eventName: ConditionEvents.DELETE_CONDITION,\n        metadata: { condition: conditionToDelete },\n        stage: SEND_RESPONSE_STAGE,\n        status: 'succeeded',\n        request,\n        response: { status: 204 },\n      });\n\n      response.status(204).end();\n    });\n\n    router.put('/roles/conditions/:id', async (request, response) => {\n      const decision = await this.authorize(\n        request,\n        policyEntityUpdatePermission,\n      );\n\n      if (decision.result === AuthorizeResult.DENY) {\n        throw new NotAllowedError(); // 403\n      }\n\n      const id: number = parseInt(request.params.id, 10);\n      if (isNaN(id)) {\n        throw new InputError('Id is not a valid number.');\n      }\n\n      const roleConditionPolicy: RoleConditionalPolicyDecision<PermissionAction> =\n        request.body;\n\n      validateRoleCondition(roleConditionPolicy);\n\n      const conditionToUpdate = await processConditionMapping(\n        roleConditionPolicy,\n        this.pluginPermMetaData,\n        this.options.auth,\n      );\n\n      await this.conditionalStorage.updateCondition(id, conditionToUpdate);\n\n      await this.aLog.auditLog<ConditionAuditInfo>({\n        message: `Updated conditional permission policy`,\n        eventName: ConditionEvents.UPDATE_CONDITION,\n        metadata: { condition: roleConditionPolicy },\n        stage: SEND_RESPONSE_STAGE,\n        status: 'succeeded',\n        request,\n        response: { status: 200 },\n      });\n\n      response.status(200).end();\n    });\n\n    router.post('/refresh/:id', async (request, response) => {\n      const decision = await this.authorize(\n        request,\n        policyEntityCreatePermission,\n      );\n\n      if (decision.result === AuthorizeResult.DENY) {\n        throw new NotAllowedError(); // 403\n      }\n\n      if (!this.rbacProviders) {\n        throw new NotFoundError(`No RBAC providers were found`);\n      }\n\n      const idProvider = this.rbacProviders.find(provider => {\n        const id = provider.getProviderName();\n        return id === request.params.id;\n      });\n\n      if (!idProvider) {\n        throw new NotFoundError(\n          `The RBAC provider ${request.params.id} was not found`,\n        );\n      }\n\n      await idProvider.refresh();\n      response.status(200).end();\n    });\n\n    router.use(logAuditError(this.aLog));\n\n    return router;\n  }\n\n  getEntityReference(request: Request, role?: boolean): string {\n    const kind = request.params.kind;\n    const namespace = request.params.namespace;\n    const name = request.params.name;\n    const entityRef = `${kind}:${namespace}/${name}`;\n\n    const err = validateEntityReference(entityRef, role);\n    if (err) {\n      throw new InputError(err.message);\n    }\n\n    return entityRef;\n  }\n\n  async transformPolicyArray(\n    ...policies: string[][]\n  ): Promise<RoleBasedPolicy[]> {\n    const roleToSourceMap = await buildRoleSourceMap(\n      policies,\n      this.roleMetadata,\n    );\n\n    const roleBasedPolices: RoleBasedPolicy[] = [];\n    for (const p of policies) {\n      const [entityReference, permission, policy, effect] = p;\n      roleBasedPolices.push({\n        entityReference,\n        permission,\n        policy,\n        effect,\n        metadata: { source: roleToSourceMap.get(entityReference)! },\n      });\n    }\n\n    return roleBasedPolices;\n  }\n\n  async transformRoleArray(...roles: string[][]): Promise<Role[]> {\n    const combinedRoles: { [key: string]: string[] } = {};\n\n    roles.forEach(([value, role]) => {\n      if (combinedRoles.hasOwnProperty(role)) {\n        combinedRoles[role].push(value);\n      } else {\n        combinedRoles[role] = [value];\n      }\n    });\n\n    const result: Role[] = await Promise.all(\n      Object.entries(combinedRoles).map(async ([role, value]) => {\n        const metadataDao = await this.roleMetadata.findRoleMetadata(role);\n        const metadata = metadataDao ? daoToMetadata(metadataDao) : undefined;\n        return Promise.resolve({\n          memberReferences: value,\n          name: role,\n          metadata,\n        });\n      }),\n    );\n    return result;\n  }\n\n  transformPolicyToArray(policy: RoleBasedPolicy): string[] {\n    return [\n      policy.entityReference!,\n      policy.permission!,\n      policy.policy!,\n      policy.effect!,\n    ];\n  }\n\n  transformRoleToArray(role: Role): string[][] {\n    const roles: string[][] = [];\n    for (const entity of role.memberReferences) {\n      roles.push([entity, role.name]);\n    }\n    return roles;\n  }\n\n  transformMemberReferencesToLowercase(role: Role) {\n    role.memberReferences = role.memberReferences.map(member =>\n      member.toLocaleLowerCase('en-US'),\n    );\n  }\n\n  getActionQueries(\n    queryValue: string | string[] | ParsedQs | ParsedQs[] | undefined,\n  ): PermissionAction[] | undefined {\n    if (!queryValue) {\n      return undefined;\n    }\n    if (Array.isArray(queryValue)) {\n      const permissionNames: PermissionAction[] = [];\n      for (const permissionQuery of queryValue) {\n        if (\n          typeof permissionQuery === 'string' &&\n          isPermissionAction(permissionQuery)\n        ) {\n          permissionNames.push(permissionQuery);\n        } else {\n          throw new InputError(\n            `Invalid permission action query value: ${permissionQuery}. Permission name should be string.`,\n          );\n        }\n      }\n      return permissionNames;\n    }\n\n    if (typeof queryValue === 'string' && isPermissionAction(queryValue)) {\n      return [queryValue];\n    }\n    throw new InputError(\n      `Invalid permission action query value: ${queryValue}. Permission name should be string.`,\n    );\n  }\n\n  getFirstQuery(\n    queryValue: string | string[] | ParsedQs | ParsedQs[] | undefined,\n  ): string {\n    if (!queryValue) {\n      return '';\n    }\n    if (Array.isArray(queryValue)) {\n      if (typeof queryValue[0] === 'string') {\n        return queryValue[0].toString();\n      }\n      throw new InputError(`This api doesn't support nested query`);\n    }\n\n    if (typeof queryValue === 'string') {\n      return queryValue;\n    }\n    throw new InputError(`This api doesn't support nested query`);\n  }\n\n  isPolicyFilterEnabled(request: Request): boolean {\n    return (\n      !!request.query.entityRef ||\n      !!request.query.permission ||\n      !!request.query.policy ||\n      !!request.query.effect\n    );\n  }\n\n  async processPolicies(\n    policyArray: RoleBasedPolicy[],\n    isOld?: boolean,\n    errorMessage?: string,\n  ): Promise<string[][]> {\n    const policies: string[][] = [];\n    const uniqueItems = new Set<string>();\n    for (const policy of policyArray) {\n      let err = validatePolicy(policy);\n      if (err) {\n        throw new InputError(\n          `Invalid ${errorMessage ?? 'policy'} definition. Cause: ${\n            err.message\n          }`,\n        ); // 400\n      }\n\n      const metadata = await this.roleMetadata.findRoleMetadata(\n        policy.entityReference!,\n      );\n\n      let action = errorMessage ? 'edit' : 'delete';\n      action = isOld ? action : 'add';\n\n      err = await validateSource('rest', metadata);\n      if (err) {\n        throw new NotAllowedError(\n          `Unable to ${action} policy ${policy.entityReference},${policy.permission},${policy.policy},${policy.effect}: ${err.message}`,\n        );\n      }\n\n      const transformedPolicy = this.transformPolicyToArray(policy);\n      if (isOld && !(await this.enforcer.hasPolicy(...transformedPolicy))) {\n        throw new NotFoundError(\n          `Policy '${policyToString(transformedPolicy)}' not found`,\n        ); // 404\n      }\n\n      if (!isOld && (await this.enforcer.hasPolicy(...transformedPolicy))) {\n        throw new ConflictError(\n          `Policy '${policyToString(\n            transformedPolicy,\n          )}' has been already stored`,\n        ); // 409\n      }\n\n      // We want to ensure that there are not duplicate permission policies\n      const rowString = JSON.stringify(transformedPolicy);\n      if (uniqueItems.has(rowString)) {\n        throw new ConflictError(\n          `Duplicate polices found; ${policy.entityReference}, ${policy.permission}, ${policy.policy}, ${policy.effect} is a duplicate`,\n        );\n      } else {\n        uniqueItems.add(rowString);\n        policies.push(transformedPolicy);\n      }\n    }\n    return policies;\n  }\n\n  nameSort(nameA: string, nameB: string): number {\n    if (nameA.toLocaleUpperCase('en-US') < nameB.toLocaleUpperCase('en-US')) {\n      return -1;\n    }\n    if (nameA.toLocaleUpperCase('en-US') > nameB.toLocaleUpperCase('en-US')) {\n      return 1;\n    }\n    return 0;\n  }\n}\n"],"names":["policyEntityReadPermission","NotAllowedError","createRouter","ServiceUnavailableError","createPermissionIntegrationRouter","RESOURCE_TYPE_POLICY_ENTITY","policyEntityPermissions","AuthorizeResult","PermissionEvents","SEND_RESPONSE_STAGE","NotFoundError","policyEntityDeletePermission","isEmpty","InputError","policyEntityCreatePermission","policyEntityUpdatePermission","isEqual","RoleEvents","validateRole","validateSource","ConflictError","deepSortedEqual","ListPluginPoliciesEvents","ListConditionEvents","ConditionEvents","validateRoleCondition","processConditionMapping","logAuditError","validateEntityReference","buildRoleSourceMap","daoToMetadata","isPermissionAction","validatePolicy","policyToString"],"mappings":";;;;;;;;;;;;;;;AAuFO,MAAM,cAAe,CAAA;AAAA,EAC1B,WAAA,CACmB,aACA,OACA,EAAA,QAAA,EACA,oBACA,kBACA,EAAA,YAAA,EACA,MACA,aACjB,EAAA;AARiB,IAAA,IAAA,CAAA,WAAA,GAAA,WAAA;AACA,IAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AACA,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AACA,IAAA,IAAA,CAAA,kBAAA,GAAA,kBAAA;AACA,IAAA,IAAA,CAAA,kBAAA,GAAA,kBAAA;AACA,IAAA,IAAA,CAAA,YAAA,GAAA,YAAA;AACA,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AACA,IAAA,IAAA,CAAA,aAAA,GAAA,aAAA;AAAA;AAChB,EAEH,MAAc,SACZ,CAAA,OAAA,EACA,UACyB,EAAA;AACzB,IAAA,MAAM,cAAc,MAAM,IAAA,CAAK,OAAQ,CAAA,QAAA,CAAS,YAAY,OAAS,EAAA;AAAA,MACnE,KAAA,EAAO,CAAC,MAAA,EAAQ,SAAS;AAAA,KAC1B,CAAA;AAGD,IACE,IAAA,IAAA,CAAK,QAAQ,IAAK,CAAA,WAAA,CAAY,aAAa,SAAS,CAAA,IACpD,eAAeA,2CACf,EAAA;AACA,MAAA,MAAM,IAAIC,sBAAA;AAAA,QACR,CAAA,2EAAA;AAAA,OACF;AAAA;AAGF,IAAM,MAAA,QAAA,GAAA,CACJ,MAAM,IAAA,CAAK,WAAY,CAAA,SAAA;AAAA,MACrB,CAAC,EAAE,UAAA,EAAwB,WAAa,EAAA,UAAA,CAAW,cAAc,CAAA;AAAA,MACjE,EAAE,WAAY;AAAA,OAEhB,CAAC,CAAA;AAEH,IAAO,OAAA,QAAA;AAAA;AACT,EAEA,MAAM,KAAiC,GAAA;AACrC,IAAA,MAAM,MAAS,GAAA,MAAMC,oCAAa,CAAA,IAAA,CAAK,OAAO,CAAA;AAE9C,IAAM,MAAA,EAAE,QAAS,EAAA,GAAI,IAAK,CAAA,OAAA;AAE1B,IAAA,IAAI,CAAC,QAAU,EAAA;AACb,MAAA,MAAM,IAAIC,8BAAA;AAAA,QACR;AAAA,OACF;AAAA;AAGF,IAAA,MAAM,+BAA+BC,sDAAkC,CAAA;AAAA,MACrE,YAAc,EAAAC,4CAAA;AAAA,MACd,WAAa,EAAAC;AAAA,KACd,CAAA;AACD,IAAA,MAAA,CAAO,IAAI,4BAA4B,CAAA;AAEvC,IAAA,MAAM,eACJ,GAAA,IAAA,CAAK,OAAQ,CAAA,MAAA,CAAO,mBAAmB,oBAAoB,CAAA;AAC7D,IAAA,IAAI,CAAC,eAAiB,EAAA;AACpB,MAAO,OAAA,MAAA;AAAA;AAGT,IAAA,MAAA,CAAO,GAAI,CAAA,GAAA,EAAK,OAAO,OAAA,EAAS,QAAa,KAAA;AAC3C,MAAM,MAAA,QAAA,GAAW,MAAM,IAAK,CAAA,SAAA;AAAA,QAC1B,OAAA;AAAA,QACAN;AAAA,OACF;AAEA,MAAI,IAAA,QAAA,CAAS,MAAW,KAAAO,sCAAA,CAAgB,IAAM,EAAA;AAC5C,QAAA,MAAM,IAAIN,sBAAgB,EAAA;AAAA;AAE5B,MAAA,QAAA,CAAS,IAAK,CAAA,EAAE,MAAQ,EAAA,YAAA,EAAc,CAAA;AAAA,KACvC,CAAA;AAID,IAAA,MAAA,CAAO,GAAI,CAAA,WAAA,EAAa,OAAO,OAAA,EAAS,QAAa,KAAA;AACnD,MAAM,MAAA,QAAA,GAAW,MAAM,IAAK,CAAA,SAAA;AAAA,QAC1B,OAAA;AAAA,QACAD;AAAA,OACF;AAEA,MAAI,IAAA,QAAA,CAAS,MAAW,KAAAO,sCAAA,CAAgB,IAAM,EAAA;AAC5C,QAAA,MAAM,IAAIN,sBAAgB,EAAA;AAAA;AAG5B,MAAI,IAAA,QAAA;AACJ,MAAI,IAAA,IAAA,CAAK,qBAAsB,CAAA,OAAO,CAAG,EAAA;AACvC,QAAA,MAAM,SAAY,GAAA,IAAA,CAAK,aAAc,CAAA,OAAA,CAAQ,MAAM,SAAS,CAAA;AAC5D,QAAA,MAAM,UAAa,GAAA,IAAA,CAAK,aAAc,CAAA,OAAA,CAAQ,MAAM,UAAU,CAAA;AAC9D,QAAA,MAAM,MAAS,GAAA,IAAA,CAAK,aAAc,CAAA,OAAA,CAAQ,MAAM,MAAM,CAAA;AACtD,QAAA,MAAM,MAAS,GAAA,IAAA,CAAK,aAAc,CAAA,OAAA,CAAQ,MAAM,MAAM,CAAA;AAEtD,QAAA,MAAM,MAAmB,GAAA,CAAC,SAAW,EAAA,UAAA,EAAY,QAAQ,MAAM,CAAA;AAC/D,QAAA,QAAA,GAAW,MAAM,IAAK,CAAA,QAAA,CAAS,iBAAkB,CAAA,CAAA,EAAG,GAAG,MAAM,CAAA;AAAA,OACxD,MAAA;AACL,QAAW,QAAA,GAAA,MAAM,IAAK,CAAA,QAAA,CAAS,SAAU,EAAA;AAAA;AAG3C,MAAA,MAAM,IAAO,GAAA,MAAM,IAAK,CAAA,oBAAA,CAAqB,GAAG,QAAQ,CAAA;AAExD,MAAM,MAAA,IAAA,CAAK,KAAK,QAAS,CAAA;AAAA,QACvB,OAAS,EAAA,CAAA,+BAAA,CAAA;AAAA,QACT,WAAWO,4BAAiB,CAAA,UAAA;AAAA,QAC5B,KAAO,EAAAC,+BAAA;AAAA,QACP,MAAQ,EAAA,WAAA;AAAA,QACR,OAAA;AAAA,QACA,QAAU,EAAA,EAAE,MAAQ,EAAA,GAAA,EAAK,IAAK;AAAA,OAC/B,CAAA;AAED,MAAA,QAAA,CAAS,KAAK,IAAI,CAAA;AAAA,KACnB,CAAA;AAED,IAAO,MAAA,CAAA,GAAA;AAAA,MACL,kCAAA;AAAA,MACA,OAAO,SAAS,QAAa,KAAA;AAC3B,QAAM,MAAA,QAAA,GAAW,MAAM,IAAK,CAAA,SAAA;AAAA,UAC1B,OAAA;AAAA,UACAT;AAAA,SACF;AAEA,QAAI,IAAA,QAAA,CAAS,MAAW,KAAAO,sCAAA,CAAgB,IAAM,EAAA;AAC5C,UAAA,MAAM,IAAIN,sBAAgB,EAAA;AAAA;AAG5B,QAAM,MAAA,SAAA,GAAY,IAAK,CAAA,kBAAA,CAAmB,OAAO,CAAA;AAEjD,QAAA,MAAM,SAAS,MAAM,IAAA,CAAK,QAAS,CAAA,iBAAA,CAAkB,GAAG,SAAS,CAAA;AACjE,QAAI,IAAA,MAAA,CAAO,WAAW,CAAG,EAAA;AACvB,UAAA,MAAM,IAAO,GAAA,MAAM,IAAK,CAAA,oBAAA,CAAqB,GAAG,MAAM,CAAA;AAEtD,UAAM,MAAA,IAAA,CAAK,KAAK,QAAS,CAAA;AAAA,YACvB,OAAS,EAAA,CAAA,wBAAA,CAAA;AAAA,YACT,WAAWO,4BAAiB,CAAA,UAAA;AAAA,YAC5B,KAAO,EAAAC,+BAAA;AAAA,YACP,MAAQ,EAAA,WAAA;AAAA,YACR,OAAA;AAAA,YACA,QAAU,EAAA,EAAE,MAAQ,EAAA,GAAA,EAAK,IAAK;AAAA,WAC/B,CAAA;AAED,UAAA,QAAA,CAAS,KAAK,IAAI,CAAA;AAAA,SACb,MAAA;AACL,UAAA,MAAM,IAAIC,oBAAc,EAAA;AAAA;AAC1B;AACF,KACF;AAEA,IAAO,MAAA,CAAA,MAAA;AAAA,MACL,kCAAA;AAAA,MACA,OAAO,SAAS,QAAa,KAAA;AAC3B,QAAM,MAAA,QAAA,GAAW,MAAM,IAAK,CAAA,SAAA;AAAA,UAC1B,OAAA;AAAA,UACAC;AAAA,SACF;AAEA,QAAI,IAAA,QAAA,CAAS,MAAW,KAAAJ,sCAAA,CAAgB,IAAM,EAAA;AAC5C,UAAA,MAAM,IAAIN,sBAAgB,EAAA;AAAA;AAG5B,QAAM,MAAA,SAAA,GAAY,IAAK,CAAA,kBAAA,CAAmB,OAAO,CAAA;AAEjD,QAAA,MAAM,YAA+B,OAAQ,CAAA,IAAA;AAC7C,QAAI,IAAAW,cAAA,CAAQ,SAAS,CAAG,EAAA;AACtB,UAAM,MAAA,IAAIC,kBAAW,CAAmC,iCAAA,CAAA,CAAA;AAAA;AAG1D,QAAA,SAAA,CAAU,QAAQ,CAAW,OAAA,KAAA;AAC3B,UAAA,OAAA,CAAQ,eAAkB,GAAA,SAAA;AAAA,SAC3B,CAAA;AAED,QAAA,MAAM,iBAAoB,GAAA,MAAM,IAAK,CAAA,eAAA,CAAgB,WAAW,IAAI,CAAA;AAEpE,QAAM,MAAA,IAAA,CAAK,QAAS,CAAA,cAAA,CAAe,iBAAiB,CAAA;AAEpD,QAAM,MAAA,IAAA,CAAK,KAAK,QAA8B,CAAA;AAAA,UAC5C,OAAS,EAAA,CAAA,2BAAA,CAAA;AAAA,UACT,WAAWL,4BAAiB,CAAA,aAAA;AAAA,UAC5B,QAAU,EAAA,EAAE,QAAU,EAAA,iBAAA,EAAmB,QAAQ,MAAO,EAAA;AAAA,UACxD,KAAO,EAAAC,+BAAA;AAAA,UACP,MAAQ,EAAA,WAAA;AAAA,UACR,OAAA;AAAA,UACA,QAAA,EAAU,EAAE,MAAA,EAAQ,GAAI;AAAA,SACzB,CAAA;AAED,QAAS,QAAA,CAAA,MAAA,CAAO,GAAG,CAAA,CAAE,GAAI,EAAA;AAAA;AAC3B,KACF;AAEA,IAAA,MAAA,CAAO,IAAK,CAAA,WAAA,EAAa,OAAO,OAAA,EAAS,QAAa,KAAA;AACpD,MAAM,MAAA,QAAA,GAAW,MAAM,IAAK,CAAA,SAAA;AAAA,QAC1B,OAAA;AAAA,QACAK;AAAA,OACF;AAEA,MAAI,IAAA,QAAA,CAAS,MAAW,KAAAP,sCAAA,CAAgB,IAAM,EAAA;AAC5C,QAAA,MAAM,IAAIN,sBAAgB,EAAA;AAAA;AAG5B,MAAA,MAAM,YAA+B,OAAQ,CAAA,IAAA;AAE7C,MAAI,IAAAW,cAAA,CAAQ,SAAS,CAAG,EAAA;AACtB,QAAM,MAAA,IAAIC,kBAAW,CAAmC,iCAAA,CAAA,CAAA;AAAA;AAG1D,MAAA,MAAM,iBAAoB,GAAA,MAAM,IAAK,CAAA,eAAA,CAAgB,SAAS,CAAA;AAE9D,MAAA,MAAM,SAAY,GAAA,iBAAA,CAAkB,CAAC,CAAA,CAAE,CAAC,CAAA;AACxC,MAAA,MAAM,YAAe,GAAA,MAAM,IAAK,CAAA,YAAA,CAAa,iBAAiB,SAAS,CAAA;AACvE,MAAA,IAAI,SAAU,CAAA,UAAA,CAAW,cAAc,CAAA,IAAK,CAAC,YAAc,EAAA;AACzD,QAAA,MAAM,IAAI,KAAA,CAAM,CAAsB,mBAAA,EAAA,SAAS,CAAgB,cAAA,CAAA,CAAA;AAAA;AAGjE,MAAM,MAAA,IAAA,CAAK,QAAS,CAAA,WAAA,CAAY,iBAAiB,CAAA;AAEjD,MAAM,MAAA,IAAA,CAAK,KAAK,QAA8B,CAAA;AAAA,QAC5C,OAAS,EAAA,CAAA,2BAAA,CAAA;AAAA,QACT,WAAWL,4BAAiB,CAAA,aAAA;AAAA,QAC5B,QAAU,EAAA,EAAE,QAAU,EAAA,iBAAA,EAAmB,QAAQ,MAAO,EAAA;AAAA,QACxD,KAAO,EAAAC,+BAAA;AAAA,QACP,MAAQ,EAAA,WAAA;AAAA,QACR,OAAA;AAAA,QACA,QAAA,EAAU,EAAE,MAAA,EAAQ,GAAI;AAAA,OACzB,CAAA;AAED,MAAS,QAAA,CAAA,MAAA,CAAO,GAAG,CAAA,CAAE,GAAI,EAAA;AAAA,KAC1B,CAAA;AAED,IAAO,MAAA,CAAA,GAAA;AAAA,MACL,kCAAA;AAAA,MACA,OAAO,SAAS,QAAa,KAAA;AAC3B,QAAM,MAAA,QAAA,GAAW,MAAM,IAAK,CAAA,SAAA;AAAA,UAC1B,OAAA;AAAA,UACAM;AAAA,SACF;AAEA,QAAI,IAAA,QAAA,CAAS,MAAW,KAAAR,sCAAA,CAAgB,IAAM,EAAA;AAC5C,UAAA,MAAM,IAAIN,sBAAgB,EAAA;AAAA;AAG5B,QAAM,MAAA,SAAA,GAAY,IAAK,CAAA,kBAAA,CAAmB,OAAO,CAAA;AAEjD,QAAM,MAAA,YAAA,GAAkC,QAAQ,IAAK,CAAA,SAAA;AACrD,QAAI,IAAAW,cAAA,CAAQ,YAAY,CAAG,EAAA;AACzB,UAAM,MAAA,IAAIC,kBAAW,CAAoC,kCAAA,CAAA,CAAA;AAAA;AAE3D,QAAM,MAAA,YAAA,GAAkC,QAAQ,IAAK,CAAA,SAAA;AACrD,QAAI,IAAAD,cAAA,CAAQ,YAAY,CAAG,EAAA;AACzB,UAAM,MAAA,IAAIC,kBAAW,CAAoC,kCAAA,CAAA,CAAA;AAAA;AAG3D,QAAA,CAAC,GAAG,YAAc,EAAA,GAAG,YAAY,CAAA,CAAE,QAAQ,CAAW,OAAA,KAAA;AACpD,UAAA,OAAA,CAAQ,eAAkB,GAAA,SAAA;AAAA,SAC3B,CAAA;AAED,QAAM,MAAA,kBAAA,GAAqB,MAAM,IAAK,CAAA,eAAA;AAAA,UACpC,YAAA;AAAA,UACA,IAAA;AAAA,UACA;AAAA,SACF;AAEA,QAAa,YAAA,CAAA,IAAA;AAAA,UAAK,CAAC,CAAG,EAAA,CAAA,KACpB,EAAE,UAAe,KAAA,CAAA,CAAE,aACf,IAAK,CAAA,QAAA,CAAS,EAAE,MAAS,EAAA,CAAA,CAAE,MAAO,CAClC,GAAA,IAAA,CAAK,SAAS,CAAE,CAAA,UAAA,EAAa,EAAE,UAAW;AAAA,SAChD;AAEA,QAAa,YAAA,CAAA,IAAA;AAAA,UAAK,CAAC,CAAG,EAAA,CAAA,KACpB,EAAE,UAAe,KAAA,CAAA,CAAE,aACf,IAAK,CAAA,QAAA,CAAS,EAAE,MAAS,EAAA,CAAA,CAAE,MAAO,CAClC,GAAA,IAAA,CAAK,SAAS,CAAE,CAAA,UAAA,EAAa,EAAE,UAAW;AAAA,SAChD;AAEA,QACE,IAAAG,cAAA,CAAQ,cAAc,YAAY,CAAA,IAClC,CAAC,YAAa,CAAA,IAAA,CAAKJ,cAAO,CAC1B,EAAA;AACA,UAAS,QAAA,CAAA,MAAA,CAAO,GAAG,CAAA,CAAE,GAAI,EAAA;AAAA,SAChB,MAAA,IAAA,YAAA,CAAa,MAAS,GAAA,YAAA,CAAa,MAAQ,EAAA;AACpD,UAAA,MAAM,IAAIC,iBAAA;AAAA,YACR,CAAA,8EAAA;AAAA,WACF;AAAA;AAGF,QAAM,MAAA,kBAAA,GAAqB,MAAM,IAAK,CAAA,eAAA;AAAA,UACpC,YAAA;AAAA,UACA,KAAA;AAAA,UACA;AAAA,SACF;AAEA,QAAA,MAAM,YACJ,GAAA,MAAM,IAAK,CAAA,YAAA,CAAa,iBAAiB,SAAS,CAAA;AACpD,QAAA,IAAI,SAAU,CAAA,UAAA,CAAW,cAAc,CAAA,IAAK,CAAC,YAAc,EAAA;AACzD,UAAA,MAAM,IAAI,KAAA,CAAM,CAAsB,mBAAA,EAAA,SAAS,CAAgB,cAAA,CAAA,CAAA;AAAA;AAGjE,QAAA,MAAM,KAAK,QAAS,CAAA,cAAA;AAAA,UAClB,kBAAA;AAAA,UACA;AAAA,SACF;AAEA,QAAM,MAAA,IAAA,CAAK,KAAK,QAA8B,CAAA;AAAA,UAC5C,OAAS,EAAA,CAAA,2BAAA,CAAA;AAAA,UACT,WAAWL,4BAAiB,CAAA,aAAA;AAAA,UAC5B,QAAU,EAAA,EAAE,QAAU,EAAA,kBAAA,EAAoB,QAAQ,MAAO,EAAA;AAAA,UACzD,KAAO,EAAAC,+BAAA;AAAA,UACP,MAAQ,EAAA,WAAA;AAAA,UACR,OAAA;AAAA,UACA,QAAA,EAAU,EAAE,MAAA,EAAQ,GAAI;AAAA,SACzB,CAAA;AAED,QAAS,QAAA,CAAA,MAAA,CAAO,GAAG,CAAA,CAAE,GAAI,EAAA;AAAA;AAC3B,KACF;AAIA,IAAA,MAAA,CAAO,GAAI,CAAA,QAAA,EAAU,OAAO,OAAA,EAAS,QAAa,KAAA;AAChD,MAAM,MAAA,QAAA,GAAW,MAAM,IAAK,CAAA,SAAA;AAAA,QAC1B,OAAA;AAAA,QACAT;AAAA,OACF;AAEA,MAAI,IAAA,QAAA,CAAS,MAAW,KAAAO,sCAAA,CAAgB,IAAM,EAAA;AAC5C,QAAA,MAAM,IAAIN,sBAAgB,EAAA;AAAA;AAG5B,MAAA,MAAM,KAAQ,GAAA,MAAM,IAAK,CAAA,QAAA,CAAS,iBAAkB,EAAA;AAEpD,MAAA,MAAM,IAAO,GAAA,MAAM,IAAK,CAAA,kBAAA,CAAmB,GAAG,KAAK,CAAA;AAEnD,MAAM,MAAA,IAAA,CAAK,KAAK,QAAS,CAAA;AAAA,QACvB,OAAS,EAAA,CAAA,iBAAA,CAAA;AAAA,QACT,WAAWgB,sBAAW,CAAA,QAAA;AAAA,QACtB,KAAO,EAAAR,+BAAA;AAAA,QACP,MAAQ,EAAA,WAAA;AAAA,QACR,OAAA;AAAA,QACA,QAAU,EAAA,EAAE,MAAQ,EAAA,GAAA,EAAK,IAAK;AAAA,OAC/B,CAAA;AAED,MAAA,QAAA,CAAS,KAAK,IAAI,CAAA;AAAA,KACnB,CAAA;AAED,IAAA,MAAA,CAAO,GAAI,CAAA,+BAAA,EAAiC,OAAO,OAAA,EAAS,QAAa,KAAA;AACvE,MAAM,MAAA,QAAA,GAAW,MAAM,IAAK,CAAA,SAAA;AAAA,QAC1B,OAAA;AAAA,QACAT;AAAA,OACF;AAEA,MAAI,IAAA,QAAA,CAAS,MAAW,KAAAO,sCAAA,CAAgB,IAAM,EAAA;AAC5C,QAAA,MAAM,IAAIN,sBAAgB,EAAA;AAAA;AAE5B,MAAA,MAAM,aAAgB,GAAA,IAAA,CAAK,kBAAmB,CAAA,OAAA,EAAS,IAAI,CAAA;AAE3D,MAAM,MAAA,IAAA,GAAO,MAAM,IAAA,CAAK,QAAS,CAAA,yBAAA;AAAA,QAC/B,CAAA;AAAA,QACA;AAAA,OACF;AAEA,MAAI,IAAA,IAAA,CAAK,WAAW,CAAG,EAAA;AACrB,QAAA,MAAM,IAAO,GAAA,MAAM,IAAK,CAAA,kBAAA,CAAmB,GAAG,IAAI,CAAA;AAElD,QAAM,MAAA,IAAA,CAAK,KAAK,QAAS,CAAA;AAAA,UACvB,OAAS,EAAA,CAAA,OAAA,EAAU,IAAK,CAAA,CAAC,EAAE,IAAI,CAAA,CAAA;AAAA,UAC/B,WAAWgB,sBAAW,CAAA,QAAA;AAAA,UACtB,KAAO,EAAAR,+BAAA;AAAA,UACP,MAAQ,EAAA,WAAA;AAAA,UACR,OAAA;AAAA,UACA,QAAU,EAAA,EAAE,MAAQ,EAAA,GAAA,EAAK,IAAK;AAAA,SAC/B,CAAA;AAED,QAAA,QAAA,CAAS,KAAK,IAAI,CAAA;AAAA,OACb,MAAA;AACL,QAAA,MAAM,IAAIC,oBAAc,EAAA;AAAA;AAC1B,KACD,CAAA;AAED,IAAA,MAAA,CAAO,IAAK,CAAA,QAAA,EAAU,OAAO,OAAA,EAAS,QAAa,KAAA;AACjD,MAAM,MAAA,WAAA,uBAAkB,GAAY,EAAA;AACpC,MAAM,MAAA,QAAA,GAAW,MAAM,IAAK,CAAA,SAAA;AAAA,QAC1B,OAAA;AAAA,QACAI;AAAA,OACF;AAEA,MAAI,IAAA,QAAA,CAAS,MAAW,KAAAP,sCAAA,CAAgB,IAAM,EAAA;AAC5C,QAAA,MAAM,IAAIN,sBAAgB,EAAA;AAAA;AAE5B,MAAA,MAAM,UAAgB,OAAQ,CAAA,IAAA;AAC9B,MAAI,IAAA,GAAA,GAAMiB,gCAAa,OAAO,CAAA;AAC9B,MAAA,IAAI,GAAK,EAAA;AACP,QAAA,MAAM,IAAIL,iBAAA;AAAA;AAAA,UACR,CAAA,gCAAA,EAAmC,IAAI,OAAO,CAAA;AAAA,SAChD;AAAA;AAEF,MAAA,IAAA,CAAK,qCAAqC,OAAO,CAAA;AAEjD,MAAA,MAAM,YAAY,MAAM,IAAA,CAAK,YAAa,CAAA,gBAAA,CAAiB,QAAQ,IAAI,CAAA;AAEvE,MAAM,GAAA,GAAA,MAAMM,iCAAe,CAAA,MAAA,EAAQ,SAAS,CAAA;AAC5C,MAAA,IAAI,GAAK,EAAA;AACP,QAAA,MAAM,IAAIlB,sBAAA,CAAgB,CAAuB,oBAAA,EAAA,GAAA,CAAI,OAAO,CAAE,CAAA,CAAA;AAAA;AAGhE,MAAM,MAAA,KAAA,GAAQ,IAAK,CAAA,oBAAA,CAAqB,OAAO,CAAA;AAE/C,MAAA,KAAA,MAAW,QAAQ,KAAO,EAAA;AACxB,QAAA,IAAI,MAAM,IAAK,CAAA,QAAA,CAAS,iBAAkB,CAAA,GAAG,IAAI,CAAG,EAAA;AAClD,UAAA,MAAM,IAAImB,oBAAc,EAAA;AAAA;AAE1B,QAAM,MAAA,UAAA,GAAa,IAAK,CAAA,SAAA,CAAU,IAAI,CAAA;AAEtC,QAAI,IAAA,WAAA,CAAY,GAAI,CAAA,UAAU,CAAG,EAAA;AAC/B,UAAA,MAAM,IAAIA,oBAAA;AAAA,YACR,iCAAiC,IAAK,CAAA,EAAA,CAAG,CAAC,CAAC,KAAK,IAAK,CAAA,EAAA;AAAA,cACnD;AAAA,aACD,CAAA,eAAA;AAAA,WACH;AAAA,SACK,MAAA;AACL,UAAA,WAAA,CAAY,IAAI,UAAU,CAAA;AAAA;AAC5B;AAGF,MAAA,MAAM,WAAc,GAAA,MAAM,QAAS,CAAA,WAAA,CAAY,OAAS,EAAA;AAAA,QACtD,KAAA,EAAO,CAAC,MAAM;AAAA,OACf,CAAA;AACD,MAAM,MAAA,UAAA,GAAa,YAAY,SAAU,CAAA,aAAA;AACzC,MAAA,MAAM,QAA4B,GAAA;AAAA,QAChC,eAAe,OAAQ,CAAA,IAAA;AAAA,QACvB,MAAQ,EAAA,MAAA;AAAA,QACR,WAAA,EAAa,OAAQ,CAAA,QAAA,EAAU,WAAe,IAAA,EAAA;AAAA,QAC9C,MAAQ,EAAA,UAAA;AAAA,QACR;AAAA,OACF;AAEA,MAAA,MAAM,IAAK,CAAA,QAAA,CAAS,mBAAoB,CAAA,KAAA,EAAO,QAAQ,CAAA;AAEvD,MAAM,MAAA,IAAA,CAAK,KAAK,QAAwB,CAAA;AAAA,QACtC,OAAA,EAAS,CAAW,QAAA,EAAA,QAAA,CAAS,aAAa,CAAA,CAAA;AAAA,QAC1C,WAAWH,sBAAW,CAAA,WAAA;AAAA,QACtB,QAAU,EAAA;AAAA,UACR,GAAG,QAAA;AAAA,UACH,SAAS,KAAM,CAAA,GAAA,CAAI,CAAM,EAAA,KAAA,EAAA,CAAG,CAAC,CAAC;AAAA,SAChC;AAAA,QACA,KAAO,EAAAR,+BAAA;AAAA,QACP,MAAQ,EAAA,WAAA;AAAA,QACR,OAAA;AAAA,QACA,QAAA,EAAU,EAAE,MAAA,EAAQ,GAAI;AAAA,OACzB,CAAA;AAED,MAAS,QAAA,CAAA,MAAA,CAAO,GAAG,CAAA,CAAE,GAAI,EAAA;AAAA,KAC1B,CAAA;AAED,IAAA,MAAA,CAAO,GAAI,CAAA,+BAAA,EAAiC,OAAO,OAAA,EAAS,QAAa,KAAA;AACvE,MAAM,MAAA,WAAA,uBAAkB,GAAY,EAAA;AACpC,MAAM,MAAA,QAAA,GAAW,MAAM,IAAK,CAAA,SAAA;AAAA,QAC1B,OAAA;AAAA,QACAM;AAAA,OACF;AAEA,MAAI,IAAA,QAAA,CAAS,MAAW,KAAAR,sCAAA,CAAgB,IAAM,EAAA;AAC5C,QAAA,MAAM,IAAIN,sBAAgB,EAAA;AAAA;AAE5B,MAAA,MAAM,aAAgB,GAAA,IAAA,CAAK,kBAAmB,CAAA,OAAA,EAAS,IAAI,CAAA;AAE3D,MAAM,MAAA,UAAA,GAAmB,QAAQ,IAAK,CAAA,OAAA;AAEtC,MAAA,IAAI,CAAC,UAAY,EAAA;AACf,QAAM,MAAA,IAAIY,kBAAW,CAAkC,gCAAA,CAAA,CAAA;AAAA;AAEzD,MAAM,MAAA,UAAA,GAAmB,QAAQ,IAAK,CAAA,OAAA;AACtC,MAAA,IAAI,CAAC,UAAY,EAAA;AACf,QAAM,MAAA,IAAIA,kBAAW,CAAkC,gCAAA,CAAA,CAAA;AAAA;AAGzD,MAAA,UAAA,CAAW,IAAO,GAAA,aAAA;AAClB,MAAI,IAAA,GAAA,GAAMK,gCAAa,UAAU,CAAA;AACjC,MAAA,IAAI,GAAK,EAAA;AACP,QAAA,MAAM,IAAIL,iBAAA;AAAA;AAAA,UACR,CAAA,gCAAA,EAAmC,IAAI,OAAO,CAAA;AAAA,SAChD;AAAA;AAEF,MAAA,GAAA,GAAMK,gCAAa,UAAU,CAAA;AAC7B,MAAA,IAAI,GAAK,EAAA;AACP,QAAA,MAAM,IAAIL,iBAAA;AAAA;AAAA,UACR,CAAA,gCAAA,EAAmC,IAAI,OAAO,CAAA;AAAA,SAChD;AAAA;AAEF,MAAA,IAAA,CAAK,qCAAqC,UAAU,CAAA;AACpD,MAAA,IAAA,CAAK,qCAAqC,UAAU,CAAA;AAEpD,MAAM,MAAA,OAAA,GAAU,IAAK,CAAA,oBAAA,CAAqB,UAAU,CAAA;AACpD,MAAM,MAAA,OAAA,GAAU,IAAK,CAAA,oBAAA,CAAqB,UAAU,CAAA;AAGpD,MAAA,MAAM,WAAc,GAAA,MAAM,QAAS,CAAA,WAAA,CAAY,OAAS,EAAA;AAAA,QACtD,KAAA,EAAO,CAAC,MAAM;AAAA,OACf,CAAA;AAED,MAAA,MAAM,WAA+B,GAAA;AAAA,QACnC,GAAG,UAAW,CAAA,QAAA;AAAA,QACd,MAAA,EAAQ,UAAW,CAAA,QAAA,EAAU,MAAU,IAAA,MAAA;AAAA,QACvC,eAAe,UAAW,CAAA,IAAA;AAAA,QAC1B,UAAA,EAAY,YAAY,SAAU,CAAA;AAAA,OACpC;AAEA,MAAA,MAAM,WACJ,GAAA,MAAM,IAAK,CAAA,YAAA,CAAa,iBAAiB,aAAa,CAAA;AACxD,MAAA,IAAI,CAAC,WAAa,EAAA;AAChB,QAAA,MAAM,IAAIH,oBAAA,CAAc,CAA+B,4BAAA,EAAA,aAAa,CAAE,CAAA,CAAA;AAAA;AAGxE,MAAM,GAAA,GAAA,MAAMS,iCAAe,CAAA,MAAA,EAAQ,WAAW,CAAA;AAC9C,MAAA,IAAI,GAAK,EAAA;AACP,QAAA,MAAM,IAAIlB,sBAAA,CAAgB,CAAwB,qBAAA,EAAA,GAAA,CAAI,OAAO,CAAE,CAAA,CAAA;AAAA;AAGjE,MAAA,IACEe,eAAQ,OAAS,EAAA,OAAO,CACxB,IAAAK,sBAAA,CAAgB,aAAa,WAAa,EAAA;AAAA,QACxC,QAAA;AAAA,QACA,YAAA;AAAA,QACA,WAAA;AAAA,QACA;AAAA,OACD,CACD,EAAA;AAEA,QAAS,QAAA,CAAA,MAAA,CAAO,GAAG,CAAA,CAAE,GAAI,EAAA;AACzB,QAAA;AAAA;AAGF,MAAA,KAAA,MAAW,QAAQ,OAAS,EAAA;AAC1B,QAAM,MAAA,OAAA,GAAU,OAAQ,CAAA,IAAA,CAAK,CAAW,OAAA,KAAA;AACtC,UAAO,OAAAL,cAAA,CAAQ,SAAS,IAAI,CAAA;AAAA,SAC7B,CAAA;AAGD,QAAA,IAAI,MAAM,IAAK,CAAA,QAAA,CAAS,iBAAkB,CAAA,GAAG,IAAI,CAAG,EAAA;AAClD,UAAA,IAAI,CAAC,OAAS,EAAA;AACZ,YAAA,MAAM,IAAII,oBAAc,EAAA;AAAA;AAC1B;AAEF,QAAM,MAAA,UAAA,GAAa,IAAK,CAAA,SAAA,CAAU,IAAI,CAAA;AAEtC,QAAI,IAAA,WAAA,CAAY,GAAI,CAAA,UAAU,CAAG,EAAA;AAC/B,UAAA,MAAM,IAAIA,oBAAA;AAAA,YACR,iCAAiC,IAAK,CAAA,EAAA,CAAG,CAAC,CAAC,KAAK,IAAK,CAAA,EAAA;AAAA,cACnD;AAAA,aACD,CAAA,eAAA;AAAA,WACH;AAAA,SACK,MAAA;AACL,UAAA,WAAA,CAAY,IAAI,UAAU,CAAA;AAAA;AAC5B;AAGF,MAAA,WAAA,CAAY,KAAM,EAAA;AAClB,MAAA,KAAA,MAAW,QAAQ,OAAS,EAAA;AAC1B,QAAA,IAAI,CAAE,MAAM,IAAA,CAAK,SAAS,iBAAkB,CAAA,GAAG,IAAI,CAAI,EAAA;AACrD,UAAA,MAAM,IAAIV,oBAAA;AAAA,YACR,CAAqB,kBAAA,EAAA,IAAA,CAAK,CAAC,CAAC,2BAA2B,aAAa,CAAA;AAAA,WACtE;AAAA;AAEF,QAAM,MAAA,UAAA,GAAa,IAAK,CAAA,SAAA,CAAU,IAAI,CAAA;AAEtC,QAAI,IAAA,WAAA,CAAY,GAAI,CAAA,UAAU,CAAG,EAAA;AAC/B,UAAA,MAAM,IAAIU,oBAAA;AAAA,YACR,iCAAiC,IAAK,CAAA,EAAA,CAAG,CAAC,CAAC,KAAK,IAAK,CAAA,EAAA;AAAA,cACnD;AAAA,aACD,CAAA,eAAA;AAAA,WACH;AAAA,SACK,MAAA;AACL,UAAA,WAAA,CAAY,IAAI,UAAU,CAAA;AAAA;AAC5B;AAGF,MAAA,MAAM,IAAK,CAAA,QAAA,CAAS,sBAAuB,CAAA,OAAA,EAAS,SAAS,WAAW,CAAA;AAExE,MAAI,IAAA,OAAA,GAAU,CAAW,QAAA,EAAA,WAAA,CAAY,aAAa,CAAA,CAAA,CAAA;AAClD,MAAI,IAAA,WAAA,CAAY,aAAkB,KAAA,WAAA,CAAY,aAAe,EAAA;AAC3D,QAAA,OAAA,GAAU,CAAG,EAAA,OAAO,CAAsC,mCAAA,EAAA,WAAA,CAAY,aAAa,CAAA,CAAA;AAAA;AAErF,MAAM,MAAA,IAAA,CAAK,KAAK,QAAwB,CAAA;AAAA,QACtC,OAAA;AAAA,QACA,WAAWH,sBAAW,CAAA,WAAA;AAAA,QACtB,QAAU,EAAA;AAAA,UACR,GAAG,WAAA;AAAA,UACH,SAAS,OAAQ,CAAA,GAAA,CAAI,CAAM,EAAA,KAAA,EAAA,CAAG,CAAC,CAAC;AAAA,SAClC;AAAA,QACA,KAAO,EAAAR,+BAAA;AAAA,QACP,MAAQ,EAAA,WAAA;AAAA,QACR,OAAA;AAAA,QACA,QAAA,EAAU,EAAE,MAAA,EAAQ,GAAI;AAAA,OACzB,CAAA;AAED,MAAS,QAAA,CAAA,MAAA,CAAO,GAAG,CAAA,CAAE,GAAI,EAAA;AAAA,KAC1B,CAAA;AAED,IAAO,MAAA,CAAA,MAAA;AAAA,MACL,+BAAA;AAAA,MACA,OAAO,SAAS,QAAa,KAAA;AAC3B,QAAM,MAAA,QAAA,GAAW,MAAM,IAAK,CAAA,SAAA;AAAA,UAC1B,OAAA;AAAA,UACAE;AAAA,SACF;AAEA,QAAI,IAAA,QAAA,CAAS,MAAW,KAAAJ,sCAAA,CAAgB,IAAM,EAAA;AAC5C,UAAA,MAAM,IAAIN,sBAAgB,EAAA;AAAA;AAG5B,QAAA,MAAM,aAAgB,GAAA,IAAA,CAAK,kBAAmB,CAAA,OAAA,EAAS,IAAI,CAAA;AAE3D,QAAA,IAAI,cAAc,EAAC;AACnB,QAAI,IAAA,OAAA,CAAQ,MAAM,gBAAkB,EAAA;AAClC,UAAA,MAAM,kBAAkB,IAAK,CAAA,aAAA;AAAA,YAC3B,QAAQ,KAAM,CAAA;AAAA,WAChB,CAAE,kBAAkB,OAAO,CAAA;AAC3B,UAAM,MAAA,EAAA,GAAK,MAAM,IAAA,CAAK,QAAS,CAAA,yBAAA;AAAA,YAC7B,CAAA;AAAA,YACA,eAAA;AAAA,YACA;AAAA,WACF;AACA,UAAI,IAAA,EAAA,CAAG,SAAS,CAAG,EAAA;AACjB,YAAY,WAAA,CAAA,IAAA,CAAK,EAAG,CAAA,CAAC,CAAC,CAAA;AAAA,WACjB,MAAA;AACL,YAAA,MAAM,IAAIS,oBAAA;AAAA,cACR,gBAAgB,eAAe,CAAA,eAAA;AAAA,aACjC;AAAA;AACF,SACK,MAAA;AACL,UAAc,WAAA,GAAA,MAAM,KAAK,QAAS,CAAA,yBAAA;AAAA,YAChC,CAAA;AAAA,YACA;AAAA,WACF;AAAA;AAGF,QAAA,KAAA,MAAW,QAAQ,WAAa,EAAA;AAC9B,UAAA,IAAI,CAAE,MAAM,IAAA,CAAK,SAAS,iBAAkB,CAAA,GAAG,IAAI,CAAI,EAAA;AACrD,YAAA,MAAM,IAAIA,oBAAc,CAAA,CAAA,aAAA,EAAgB,IAAK,CAAA,CAAC,CAAC,CAAiB,eAAA,CAAA,CAAA;AAAA;AAClE;AAGF,QAAA,MAAM,eACJ,GAAA,MAAM,IAAK,CAAA,YAAA,CAAa,iBAAiB,aAAa,CAAA;AACxD,QAAA,MAAM,GAAM,GAAA,MAAMS,iCAAe,CAAA,MAAA,EAAQ,eAAe,CAAA;AACxD,QAAA,IAAI,GAAK,EAAA;AACP,UAAA,MAAM,IAAIlB,sBAAA,CAAgB,CAA0B,uBAAA,EAAA,GAAA,CAAI,OAAO,CAAE,CAAA,CAAA;AAAA;AAGnE,QAAA,MAAM,WAAc,GAAA,MAAM,QAAS,CAAA,WAAA,CAAY,OAAS,EAAA;AAAA,UACtD,KAAA,EAAO,CAAC,MAAM;AAAA,SACf,CAAA;AAED,QAAA,MAAM,QAA4B,GAAA;AAAA,UAChC,aAAA;AAAA,UACA,MAAQ,EAAA,MAAA;AAAA,UACR,UAAA,EAAY,YAAY,SAAU,CAAA;AAAA,SACpC;AAEA,QAAA,MAAM,KAAK,QAAS,CAAA,sBAAA;AAAA,UAClB,WAAA;AAAA,UACA,QAAA;AAAA,UACA;AAAA,SACF;AAEA,QAAM,MAAA,IAAA,CAAK,KAAK,QAAwB,CAAA;AAAA,UACtC,OAAA,EAAS,CAAW,QAAA,EAAA,QAAA,CAAS,aAAa,CAAA,CAAA;AAAA,UAC1C,WAAWgB,sBAAW,CAAA,WAAA;AAAA,UACtB,QAAU,EAAA;AAAA,YACR,GAAG,QAAA;AAAA,YACH,SAAS,WAAY,CAAA,GAAA,CAAI,CAAM,EAAA,KAAA,EAAA,CAAG,CAAC,CAAC;AAAA,WACtC;AAAA,UACA,KAAO,EAAAR,+BAAA;AAAA,UACP,MAAQ,EAAA,WAAA;AAAA,UACR,OAAA;AAAA,UACA,QAAA,EAAU,EAAE,MAAA,EAAQ,GAAI;AAAA,SACzB,CAAA;AAED,QAAS,QAAA,CAAA,MAAA,CAAO,GAAG,CAAA,CAAE,GAAI,EAAA;AAAA;AAC3B,KACF;AAEA,IAAA,MAAA,CAAO,GAAI,CAAA,mBAAA,EAAqB,OAAO,OAAA,EAAS,QAAa,KAAA;AAC3D,MAAM,MAAA,QAAA,GAAW,MAAM,IAAK,CAAA,SAAA;AAAA,QAC1B,OAAA;AAAA,QACAT;AAAA,OACF;AAEA,MAAI,IAAA,QAAA,CAAS,MAAW,KAAAO,sCAAA,CAAgB,IAAM,EAAA;AAC5C,QAAA,MAAM,IAAIN,sBAAgB,EAAA;AAAA;AAG5B,MAAM,MAAA,IAAA,GAAO,MAAM,IAAA,CAAK,kBAAmB,CAAA,iBAAA;AAAA,QACzC,KAAK,OAAQ,CAAA;AAAA,OACf;AAEA,MAAM,MAAA,IAAA,CAAK,KAAK,QAAS,CAAA;AAAA,QACvB,OAAS,EAAA,CAAA,2BAAA,CAAA;AAAA,QACT,WAAWqB,oCAAyB,CAAA,oBAAA;AAAA,QACpC,KAAO,EAAAb,+BAAA;AAAA,QACP,MAAQ,EAAA,WAAA;AAAA,QACR,OAAA;AAAA,QACA,QAAU,EAAA,EAAE,MAAQ,EAAA,GAAA,EAAK,IAAK;AAAA,OAC/B,CAAA;AAED,MAAA,QAAA,CAAS,KAAK,IAAI,CAAA;AAAA,KACnB,CAAA;AAED,IAAA,MAAA,CAAO,GAAI,CAAA,0BAAA,EAA4B,OAAO,OAAA,EAAS,QAAa,KAAA;AAClE,MAAM,MAAA,QAAA,GAAW,MAAM,IAAK,CAAA,SAAA;AAAA,QAC1B,OAAA;AAAA,QACAT;AAAA,OACF;AAEA,MAAI,IAAA,QAAA,CAAS,MAAW,KAAAO,sCAAA,CAAgB,IAAM,EAAA;AAC5C,QAAA,MAAM,IAAIN,sBAAgB,EAAA;AAAA;AAG5B,MAAM,MAAA,IAAA,GAAO,MAAM,IAAA,CAAK,kBAAmB,CAAA,uBAAA;AAAA,QACzC,KAAK,OAAQ,CAAA;AAAA,OACf;AAEA,MAAM,MAAA,IAAA,CAAK,KAAK,QAAS,CAAA;AAAA,QACvB,OAAS,EAAA,CAAA,yCAAA,CAAA;AAAA,QACT,WAAWsB,+BAAoB,CAAA,mBAAA;AAAA,QAC/B,KAAO,EAAAd,+BAAA;AAAA,QACP,MAAQ,EAAA,WAAA;AAAA,QACR,OAAA;AAAA,QACA,QAAU,EAAA,EAAE,MAAQ,EAAA,GAAA,EAAK,IAAK;AAAA,OAC/B,CAAA;AAED,MAAA,QAAA,CAAS,KAAK,IAAI,CAAA;AAAA,KACnB,CAAA;AAED,IAAA,MAAA,CAAO,GAAI,CAAA,mBAAA,EAAqB,OAAO,OAAA,EAAS,QAAa,KAAA;AAC3D,MAAM,MAAA,QAAA,GAAW,MAAM,IAAK,CAAA,SAAA;AAAA,QAC1B,OAAA;AAAA,QACAT;AAAA,OACF;AAEA,MAAI,IAAA,QAAA,CAAS,MAAW,KAAAO,sCAAA,CAAgB,IAAM,EAAA;AAC5C,QAAA,MAAM,IAAIN,sBAAgB,EAAA;AAAA;AAG5B,MAAM,MAAA,UAAA,GAAa,MAAM,IAAA,CAAK,kBAAmB,CAAA,gBAAA;AAAA,QAC/C,IAAK,CAAA,aAAA,CAAc,OAAQ,CAAA,KAAA,CAAM,aAAa,CAAA;AAAA,QAC9C,IAAK,CAAA,aAAA,CAAc,OAAQ,CAAA,KAAA,CAAM,QAAQ,CAAA;AAAA,QACzC,IAAK,CAAA,aAAA,CAAc,OAAQ,CAAA,KAAA,CAAM,YAAY,CAAA;AAAA,QAC7C,IAAK,CAAA,gBAAA,CAAiB,OAAQ,CAAA,KAAA,CAAM,OAAO;AAAA,OAC7C;AAEA,MAAM,MAAA,IAAA,GACJ,UAAW,CAAA,GAAA,CAAI,CAAa,SAAA,KAAA;AAC1B,QAAO,OAAA;AAAA,UACL,GAAG,SAAA;AAAA,UACH,mBAAmB,SAAU,CAAA,iBAAA,CAAkB,GAAI,CAAA,CAAA,EAAA,KAAM,GAAG,MAAM;AAAA,SACpE;AAAA,OACD,CAAA;AAEH,MAAM,MAAA,IAAA,CAAK,KAAK,QAAS,CAAA;AAAA,QACvB,OAAS,EAAA,CAAA,2CAAA,CAAA;AAAA,QACT,WAAWuB,2BAAgB,CAAA,aAAA;AAAA,QAC3B,KAAO,EAAAf,+BAAA;AAAA,QACP,MAAQ,EAAA,WAAA;AAAA,QACR,OAAA;AAAA,QACA,QAAU,EAAA,EAAE,MAAQ,EAAA,GAAA,EAAK,IAAK;AAAA,OAC/B,CAAA;AAED,MAAA,QAAA,CAAS,KAAK,IAAI,CAAA;AAAA,KACnB,CAAA;AAED,IAAA,MAAA,CAAO,IAAK,CAAA,mBAAA,EAAqB,OAAO,OAAA,EAAS,QAAa,KAAA;AAC5D,MAAM,MAAA,QAAA,GAAW,MAAM,IAAK,CAAA,SAAA;AAAA,QAC1B,OAAA;AAAA,QACAK;AAAA,OACF;AAEA,MAAI,IAAA,QAAA,CAAS,MAAW,KAAAP,sCAAA,CAAgB,IAAM,EAAA;AAC5C,QAAA,MAAM,IAAIN,sBAAgB,EAAA;AAAA;AAG5B,MAAA,MAAM,sBACJ,OAAQ,CAAA,IAAA;AACV,MAAAwB,yCAAA,CAAsB,mBAAmB,CAAA;AAEzC,MAAA,MAAM,oBAAoB,MAAMC,8BAAA;AAAA,QAC9B,mBAAA;AAAA,QACA,IAAK,CAAA,kBAAA;AAAA,QACL,KAAK,OAAQ,CAAA;AAAA,OACf;AAEA,MAAA,MAAM,EACJ,GAAA,MAAM,IAAK,CAAA,kBAAA,CAAmB,gBAAgB,iBAAiB,CAAA;AAEjE,MAAM,MAAA,IAAA,GAAO,EAAE,EAAO,EAAA;AAEtB,MAAM,MAAA,IAAA,CAAK,KAAK,QAA6B,CAAA;AAAA,QAC3C,OAAS,EAAA,CAAA,qCAAA,CAAA;AAAA,QACT,WAAWF,2BAAgB,CAAA,gBAAA;AAAA,QAC3B,QAAA,EAAU,EAAE,SAAA,EAAW,mBAAoB,EAAA;AAAA,QAC3C,KAAO,EAAAf,+BAAA;AAAA,QACP,MAAQ,EAAA,WAAA;AAAA,QACR,OAAA;AAAA,QACA,QAAU,EAAA,EAAE,MAAQ,EAAA,GAAA,EAAK,IAAK;AAAA,OAC/B,CAAA;AAED,MAAA,QAAA,CAAS,MAAO,CAAA,GAAG,CAAE,CAAA,IAAA,CAAK,IAAI,CAAA;AAAA,KAC/B,CAAA;AAED,IAAA,MAAA,CAAO,GAAI,CAAA,uBAAA,EAAyB,OAAO,OAAA,EAAS,QAAa,KAAA;AAC/D,MAAM,MAAA,QAAA,GAAW,MAAM,IAAK,CAAA,SAAA;AAAA,QAC1B,OAAA;AAAA,QACAT;AAAA,OACF;AAEA,MAAI,IAAA,QAAA,CAAS,MAAW,KAAAO,sCAAA,CAAgB,IAAM,EAAA;AAC5C,QAAA,MAAM,IAAIN,sBAAgB,EAAA;AAAA;AAG5B,MAAA,MAAM,EAAa,GAAA,QAAA,CAAS,OAAQ,CAAA,MAAA,CAAO,IAAI,EAAE,CAAA;AACjD,MAAI,IAAA,KAAA,CAAM,EAAE,CAAG,EAAA;AACb,QAAM,MAAA,IAAIY,kBAAW,2BAA2B,CAAA;AAAA;AAGlD,MAAA,MAAM,SAAY,GAAA,MAAM,IAAK,CAAA,kBAAA,CAAmB,aAAa,EAAE,CAAA;AAC/D,MAAA,IAAI,CAAC,SAAW,EAAA;AACd,QAAA,MAAM,IAAIH,oBAAc,EAAA;AAAA;AAG1B,MAAA,MAAM,IAAwD,GAAA;AAAA,QAC5D,GAAG,SAAA;AAAA,QACH,mBAAmB,SAAU,CAAA,iBAAA,CAAkB,GAAI,CAAA,CAAA,EAAA,KAAM,GAAG,MAAM;AAAA,OACpE;AAEA,MAAM,MAAA,IAAA,CAAK,KAAK,QAAS,CAAA;AAAA,QACvB,OAAS,EAAA,CAAA,0CAAA,CAAA;AAAA,QACT,WAAWc,2BAAgB,CAAA,aAAA;AAAA,QAC3B,KAAO,EAAAf,+BAAA;AAAA,QACP,MAAQ,EAAA,WAAA;AAAA,QACR,OAAA;AAAA,QACA,QAAU,EAAA,EAAE,MAAQ,EAAA,GAAA,EAAK,IAAK;AAAA,OAC/B,CAAA;AAED,MAAA,QAAA,CAAS,KAAK,IAAI,CAAA;AAAA,KACnB,CAAA;AAED,IAAA,MAAA,CAAO,MAAO,CAAA,uBAAA,EAAyB,OAAO,OAAA,EAAS,QAAa,KAAA;AAClE,MAAM,MAAA,QAAA,GAAW,MAAM,IAAK,CAAA,SAAA;AAAA,QAC1B,OAAA;AAAA,QACAE;AAAA,OACF;AAEA,MAAI,IAAA,QAAA,CAAS,MAAW,KAAAJ,sCAAA,CAAgB,IAAM,EAAA;AAC5C,QAAA,MAAM,IAAIN,sBAAgB,EAAA;AAAA;AAG5B,MAAA,MAAM,EAAa,GAAA,QAAA,CAAS,OAAQ,CAAA,MAAA,CAAO,IAAI,EAAE,CAAA;AACjD,MAAI,IAAA,KAAA,CAAM,EAAE,CAAG,EAAA;AACb,QAAM,MAAA,IAAIY,kBAAW,2BAA2B,CAAA;AAAA;AAGlD,MAAA,MAAM,SAAY,GAAA,MAAM,IAAK,CAAA,kBAAA,CAAmB,aAAa,EAAE,CAAA;AAC/D,MAAA,IAAI,CAAC,SAAW,EAAA;AACd,QAAA,MAAM,IAAIH,oBAAA,CAAc,CAAqB,kBAAA,EAAA,EAAE,CAAgB,cAAA,CAAA,CAAA;AAAA;AAEjE,MAAA,MAAM,iBACJ,GAAA;AAAA,QACE,GAAG,SAAA;AAAA,QACH,mBAAmB,SAAU,CAAA,iBAAA,CAAkB,GAAI,CAAA,CAAA,EAAA,KAAM,GAAG,MAAM;AAAA,OACpE;AAEF,MAAM,MAAA,IAAA,CAAK,kBAAmB,CAAA,eAAA,CAAgB,EAAE,CAAA;AAEhD,MAAM,MAAA,IAAA,CAAK,KAAK,QAA6B,CAAA;AAAA,QAC3C,OAAS,EAAA,CAAA,qCAAA,CAAA;AAAA,QACT,WAAWc,2BAAgB,CAAA,gBAAA;AAAA,QAC3B,QAAA,EAAU,EAAE,SAAA,EAAW,iBAAkB,EAAA;AAAA,QACzC,KAAO,EAAAf,+BAAA;AAAA,QACP,MAAQ,EAAA,WAAA;AAAA,QACR,OAAA;AAAA,QACA,QAAA,EAAU,EAAE,MAAA,EAAQ,GAAI;AAAA,OACzB,CAAA;AAED,MAAS,QAAA,CAAA,MAAA,CAAO,GAAG,CAAA,CAAE,GAAI,EAAA;AAAA,KAC1B,CAAA;AAED,IAAA,MAAA,CAAO,GAAI,CAAA,uBAAA,EAAyB,OAAO,OAAA,EAAS,QAAa,KAAA;AAC/D,MAAM,MAAA,QAAA,GAAW,MAAM,IAAK,CAAA,SAAA;AAAA,QAC1B,OAAA;AAAA,QACAM;AAAA,OACF;AAEA,MAAI,IAAA,QAAA,CAAS,MAAW,KAAAR,sCAAA,CAAgB,IAAM,EAAA;AAC5C,QAAA,MAAM,IAAIN,sBAAgB,EAAA;AAAA;AAG5B,MAAA,MAAM,EAAa,GAAA,QAAA,CAAS,OAAQ,CAAA,MAAA,CAAO,IAAI,EAAE,CAAA;AACjD,MAAI,IAAA,KAAA,CAAM,EAAE,CAAG,EAAA;AACb,QAAM,MAAA,IAAIY,kBAAW,2BAA2B,CAAA;AAAA;AAGlD,MAAA,MAAM,sBACJ,OAAQ,CAAA,IAAA;AAEV,MAAAY,yCAAA,CAAsB,mBAAmB,CAAA;AAEzC,MAAA,MAAM,oBAAoB,MAAMC,8BAAA;AAAA,QAC9B,mBAAA;AAAA,QACA,IAAK,CAAA,kBAAA;AAAA,QACL,KAAK,OAAQ,CAAA;AAAA,OACf;AAEA,MAAA,MAAM,IAAK,CAAA,kBAAA,CAAmB,eAAgB,CAAA,EAAA,EAAI,iBAAiB,CAAA;AAEnE,MAAM,MAAA,IAAA,CAAK,KAAK,QAA6B,CAAA;AAAA,QAC3C,OAAS,EAAA,CAAA,qCAAA,CAAA;AAAA,QACT,WAAWF,2BAAgB,CAAA,gBAAA;AAAA,QAC3B,QAAA,EAAU,EAAE,SAAA,EAAW,mBAAoB,EAAA;AAAA,QAC3C,KAAO,EAAAf,+BAAA;AAAA,QACP,MAAQ,EAAA,WAAA;AAAA,QACR,OAAA;AAAA,QACA,QAAA,EAAU,EAAE,MAAA,EAAQ,GAAI;AAAA,OACzB,CAAA;AAED,MAAS,QAAA,CAAA,MAAA,CAAO,GAAG,CAAA,CAAE,GAAI,EAAA;AAAA,KAC1B,CAAA;AAED,IAAA,MAAA,CAAO,IAAK,CAAA,cAAA,EAAgB,OAAO,OAAA,EAAS,QAAa,KAAA;AACvD,MAAM,MAAA,QAAA,GAAW,MAAM,IAAK,CAAA,SAAA;AAAA,QAC1B,OAAA;AAAA,QACAK;AAAA,OACF;AAEA,MAAI,IAAA,QAAA,CAAS,MAAW,KAAAP,sCAAA,CAAgB,IAAM,EAAA;AAC5C,QAAA,MAAM,IAAIN,sBAAgB,EAAA;AAAA;AAG5B,MAAI,IAAA,CAAC,KAAK,aAAe,EAAA;AACvB,QAAM,MAAA,IAAIS,qBAAc,CAA8B,4BAAA,CAAA,CAAA;AAAA;AAGxD,MAAA,MAAM,UAAa,GAAA,IAAA,CAAK,aAAc,CAAA,IAAA,CAAK,CAAY,QAAA,KAAA;AACrD,QAAM,MAAA,EAAA,GAAK,SAAS,eAAgB,EAAA;AACpC,QAAO,OAAA,EAAA,KAAO,QAAQ,MAAO,CAAA,EAAA;AAAA,OAC9B,CAAA;AAED,MAAA,IAAI,CAAC,UAAY,EAAA;AACf,QAAA,MAAM,IAAIA,oBAAA;AAAA,UACR,CAAA,kBAAA,EAAqB,OAAQ,CAAA,MAAA,CAAO,EAAE,CAAA,cAAA;AAAA,SACxC;AAAA;AAGF,MAAA,MAAM,WAAW,OAAQ,EAAA;AACzB,MAAS,QAAA,CAAA,MAAA,CAAO,GAAG,CAAA,CAAE,GAAI,EAAA;AAAA,KAC1B,CAAA;AAED,IAAA,MAAA,CAAO,GAAI,CAAAiB,gCAAA,CAAc,IAAK,CAAA,IAAI,CAAC,CAAA;AAEnC,IAAO,OAAA,MAAA;AAAA;AACT,EAEA,kBAAA,CAAmB,SAAkB,IAAwB,EAAA;AAC3D,IAAM,MAAA,IAAA,GAAO,QAAQ,MAAO,CAAA,IAAA;AAC5B,IAAM,MAAA,SAAA,GAAY,QAAQ,MAAO,CAAA,SAAA;AACjC,IAAM,MAAA,IAAA,GAAO,QAAQ,MAAO,CAAA,IAAA;AAC5B,IAAA,MAAM,YAAY,CAAG,EAAA,IAAI,CAAI,CAAA,EAAA,SAAS,IAAI,IAAI,CAAA,CAAA;AAE9C,IAAM,MAAA,GAAA,GAAMC,0CAAwB,CAAA,SAAA,EAAW,IAAI,CAAA;AACnD,IAAA,IAAI,GAAK,EAAA;AACP,MAAM,MAAA,IAAIf,iBAAW,CAAA,GAAA,CAAI,OAAO,CAAA;AAAA;AAGlC,IAAO,OAAA,SAAA;AAAA;AACT,EAEA,MAAM,wBACD,QACyB,EAAA;AAC5B,IAAA,MAAM,kBAAkB,MAAMgB,yBAAA;AAAA,MAC5B,QAAA;AAAA,MACA,IAAK,CAAA;AAAA,KACP;AAEA,IAAA,MAAM,mBAAsC,EAAC;AAC7C,IAAA,KAAA,MAAW,KAAK,QAAU,EAAA;AACxB,MAAA,MAAM,CAAC,eAAA,EAAiB,UAAY,EAAA,MAAA,EAAQ,MAAM,CAAI,GAAA,CAAA;AACtD,MAAA,gBAAA,CAAiB,IAAK,CAAA;AAAA,QACpB,eAAA;AAAA,QACA,UAAA;AAAA,QACA,MAAA;AAAA,QACA,MAAA;AAAA,QACA,UAAU,EAAE,MAAA,EAAQ,eAAgB,CAAA,GAAA,CAAI,eAAe,CAAG;AAAA,OAC3D,CAAA;AAAA;AAGH,IAAO,OAAA,gBAAA;AAAA;AACT,EAEA,MAAM,sBAAsB,KAAoC,EAAA;AAC9D,IAAA,MAAM,gBAA6C,EAAC;AAEpD,IAAA,KAAA,CAAM,OAAQ,CAAA,CAAC,CAAC,KAAA,EAAO,IAAI,CAAM,KAAA;AAC/B,MAAI,IAAA,aAAA,CAAc,cAAe,CAAA,IAAI,CAAG,EAAA;AACtC,QAAc,aAAA,CAAA,IAAI,CAAE,CAAA,IAAA,CAAK,KAAK,CAAA;AAAA,OACzB,MAAA;AACL,QAAc,aAAA,CAAA,IAAI,CAAI,GAAA,CAAC,KAAK,CAAA;AAAA;AAC9B,KACD,CAAA;AAED,IAAM,MAAA,MAAA,GAAiB,MAAM,OAAQ,CAAA,GAAA;AAAA,MACnC,MAAA,CAAO,QAAQ,aAAa,CAAA,CAAE,IAAI,OAAO,CAAC,IAAM,EAAA,KAAK,CAAM,KAAA;AACzD,QAAA,MAAM,WAAc,GAAA,MAAM,IAAK,CAAA,YAAA,CAAa,iBAAiB,IAAI,CAAA;AACjE,QAAA,MAAM,QAAW,GAAA,WAAA,GAAcC,0BAAc,CAAA,WAAW,CAAI,GAAA,KAAA,CAAA;AAC5D,QAAA,OAAO,QAAQ,OAAQ,CAAA;AAAA,UACrB,gBAAkB,EAAA,KAAA;AAAA,UAClB,IAAM,EAAA,IAAA;AAAA,UACN;AAAA,SACD,CAAA;AAAA,OACF;AAAA,KACH;AACA,IAAO,OAAA,MAAA;AAAA;AACT,EAEA,uBAAuB,MAAmC,EAAA;AACxD,IAAO,OAAA;AAAA,MACL,MAAO,CAAA,eAAA;AAAA,MACP,MAAO,CAAA,UAAA;AAAA,MACP,MAAO,CAAA,MAAA;AAAA,MACP,MAAO,CAAA;AAAA,KACT;AAAA;AACF,EAEA,qBAAqB,IAAwB,EAAA;AAC3C,IAAA,MAAM,QAAoB,EAAC;AAC3B,IAAW,KAAA,MAAA,MAAA,IAAU,KAAK,gBAAkB,EAAA;AAC1C,MAAA,KAAA,CAAM,IAAK,CAAA,CAAC,MAAQ,EAAA,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA;AAEhC,IAAO,OAAA,KAAA;AAAA;AACT,EAEA,qCAAqC,IAAY,EAAA;AAC/C,IAAK,IAAA,CAAA,gBAAA,GAAmB,KAAK,gBAAiB,CAAA,GAAA;AAAA,MAAI,CAAA,MAAA,KAChD,MAAO,CAAA,iBAAA,CAAkB,OAAO;AAAA,KAClC;AAAA;AACF,EAEA,iBACE,UACgC,EAAA;AAChC,IAAA,IAAI,CAAC,UAAY,EAAA;AACf,MAAO,OAAA,KAAA,CAAA;AAAA;AAET,IAAI,IAAA,KAAA,CAAM,OAAQ,CAAA,UAAU,CAAG,EAAA;AAC7B,MAAA,MAAM,kBAAsC,EAAC;AAC7C,MAAA,KAAA,MAAW,mBAAmB,UAAY,EAAA;AACxC,QAAA,IACE,OAAO,eAAA,KAAoB,QAC3B,IAAAC,yBAAA,CAAmB,eAAe,CAClC,EAAA;AACA,UAAA,eAAA,CAAgB,KAAK,eAAe,CAAA;AAAA,SAC/B,MAAA;AACL,UAAA,MAAM,IAAIlB,iBAAA;AAAA,YACR,0CAA0C,eAAe,CAAA,mCAAA;AAAA,WAC3D;AAAA;AACF;AAEF,MAAO,OAAA,eAAA;AAAA;AAGT,IAAA,IAAI,OAAO,UAAA,KAAe,QAAY,IAAAkB,yBAAA,CAAmB,UAAU,CAAG,EAAA;AACpE,MAAA,OAAO,CAAC,UAAU,CAAA;AAAA;AAEpB,IAAA,MAAM,IAAIlB,iBAAA;AAAA,MACR,0CAA0C,UAAU,CAAA,mCAAA;AAAA,KACtD;AAAA;AACF,EAEA,cACE,UACQ,EAAA;AACR,IAAA,IAAI,CAAC,UAAY,EAAA;AACf,MAAO,OAAA,EAAA;AAAA;AAET,IAAI,IAAA,KAAA,CAAM,OAAQ,CAAA,UAAU,CAAG,EAAA;AAC7B,MAAA,IAAI,OAAO,UAAA,CAAW,CAAC,CAAA,KAAM,QAAU,EAAA;AACrC,QAAO,OAAA,UAAA,CAAW,CAAC,CAAA,CAAE,QAAS,EAAA;AAAA;AAEhC,MAAM,MAAA,IAAIA,kBAAW,CAAuC,qCAAA,CAAA,CAAA;AAAA;AAG9D,IAAI,IAAA,OAAO,eAAe,QAAU,EAAA;AAClC,MAAO,OAAA,UAAA;AAAA;AAET,IAAM,MAAA,IAAIA,kBAAW,CAAuC,qCAAA,CAAA,CAAA;AAAA;AAC9D,EAEA,sBAAsB,OAA2B,EAAA;AAC/C,IAAA,OACE,CAAC,CAAC,OAAA,CAAQ,MAAM,SAChB,IAAA,CAAC,CAAC,OAAQ,CAAA,KAAA,CAAM,UAChB,IAAA,CAAC,CAAC,OAAQ,CAAA,KAAA,CAAM,UAChB,CAAC,CAAC,QAAQ,KAAM,CAAA,MAAA;AAAA;AAEpB,EAEA,MAAM,eAAA,CACJ,WACA,EAAA,KAAA,EACA,YACqB,EAAA;AACrB,IAAA,MAAM,WAAuB,EAAC;AAC9B,IAAM,MAAA,WAAA,uBAAkB,GAAY,EAAA;AACpC,IAAA,KAAA,MAAW,UAAU,WAAa,EAAA;AAChC,MAAI,IAAA,GAAA,GAAMmB,kCAAe,MAAM,CAAA;AAC/B,MAAA,IAAI,GAAK,EAAA;AACP,QAAA,MAAM,IAAInB,iBAAA;AAAA,UACR,CAAW,QAAA,EAAA,YAAA,IAAgB,QAAQ,CAAA,oBAAA,EACjC,IAAI,OACN,CAAA;AAAA,SACF;AAAA;AAGF,MAAM,MAAA,QAAA,GAAW,MAAM,IAAA,CAAK,YAAa,CAAA,gBAAA;AAAA,QACvC,MAAO,CAAA;AAAA,OACT;AAEA,MAAI,IAAA,MAAA,GAAS,eAAe,MAAS,GAAA,QAAA;AACrC,MAAA,MAAA,GAAS,QAAQ,MAAS,GAAA,KAAA;AAE1B,MAAM,GAAA,GAAA,MAAMM,iCAAe,CAAA,MAAA,EAAQ,QAAQ,CAAA;AAC3C,MAAA,IAAI,GAAK,EAAA;AACP,QAAA,MAAM,IAAIlB,sBAAA;AAAA,UACR,aAAa,MAAM,CAAA,QAAA,EAAW,MAAO,CAAA,eAAe,IAAI,MAAO,CAAA,UAAU,CAAI,CAAA,EAAA,MAAA,CAAO,MAAM,CAAI,CAAA,EAAA,MAAA,CAAO,MAAM,CAAA,EAAA,EAAK,IAAI,OAAO,CAAA;AAAA,SAC7H;AAAA;AAGF,MAAM,MAAA,iBAAA,GAAoB,IAAK,CAAA,sBAAA,CAAuB,MAAM,CAAA;AAC5D,MAAI,IAAA,KAAA,IAAS,CAAE,MAAM,IAAA,CAAK,SAAS,SAAU,CAAA,GAAG,iBAAiB,CAAI,EAAA;AACnE,QAAA,MAAM,IAAIS,oBAAA;AAAA,UACR,CAAA,QAAA,EAAWuB,qBAAe,CAAA,iBAAiB,CAAC,CAAA,WAAA;AAAA,SAC9C;AAAA;AAGF,MAAI,IAAA,CAAC,SAAU,MAAM,IAAA,CAAK,SAAS,SAAU,CAAA,GAAG,iBAAiB,CAAI,EAAA;AACnE,QAAA,MAAM,IAAIb,oBAAA;AAAA,UACR,CAAW,QAAA,EAAAa,qBAAA;AAAA,YACT;AAAA,WACD,CAAA,yBAAA;AAAA,SACH;AAAA;AAIF,MAAM,MAAA,SAAA,GAAY,IAAK,CAAA,SAAA,CAAU,iBAAiB,CAAA;AAClD,MAAI,IAAA,WAAA,CAAY,GAAI,CAAA,SAAS,CAAG,EAAA;AAC9B,QAAA,MAAM,IAAIb,oBAAA;AAAA,UACR,CAAA,yBAAA,EAA4B,MAAO,CAAA,eAAe,CAAK,EAAA,EAAA,MAAA,CAAO,UAAU,CAAA,EAAA,EAAK,MAAO,CAAA,MAAM,CAAK,EAAA,EAAA,MAAA,CAAO,MAAM,CAAA,eAAA;AAAA,SAC9G;AAAA,OACK,MAAA;AACL,QAAA,WAAA,CAAY,IAAI,SAAS,CAAA;AACzB,QAAA,QAAA,CAAS,KAAK,iBAAiB,CAAA;AAAA;AACjC;AAEF,IAAO,OAAA,QAAA;AAAA;AACT,EAEA,QAAA,CAAS,OAAe,KAAuB,EAAA;AAC7C,IAAA,IAAI,MAAM,iBAAkB,CAAA,OAAO,IAAI,KAAM,CAAA,iBAAA,CAAkB,OAAO,CAAG,EAAA;AACvE,MAAO,OAAA,CAAA,CAAA;AAAA;AAET,IAAA,IAAI,MAAM,iBAAkB,CAAA,OAAO,IAAI,KAAM,CAAA,iBAAA,CAAkB,OAAO,CAAG,EAAA;AACvE,MAAO,OAAA,CAAA;AAAA;AAET,IAAO,OAAA,CAAA;AAAA;AAEX;;;;"}

package/migrations/20241108093910_migrations.js

@@ -0,0 +1,35 @@
+/*
+ * Copyright 2024 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+exports.up = async function up(knex) {
+  const casbinExists = await knex.schema.hasTable('casbin_rule');
+  if (casbinExists) {
+    await knex('casbin_rule')
+      .whereNotNull('v0')
+      .where(function groups() {
+        this.where('v0', 'like', 'user:%').orWhere('v0', 'like', 'group:%');
+      })
+      .update({
+        v0: knex.raw('LOWER(??)', ['v0']),
+      });
+  }
+};
+
+/**
+ * @param { import("knex").Knex } knex
+ * @returns { Promise<void> }
+ */
+exports.down = async function down(_knex) {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@backstage-community/plugin-rbac-backend",
-  "version": "5.2.10",
+  "version": "5.3.0",
   "main": "dist/index.cjs.js",
   "types": "dist/index.d.ts",
   "license": "Apache-2.0",