@bevel-software/platform-core-backend 0.10.0 → 0.11.0

package/dist/modules/access/access-control.service.d.ts

@@ -1,5 +1,6 @@
 import type { WorkspaceService } from '../workspace/workspace.service.js';
-import type { IAccessControl, AccessTargetKind, GrantPrincipal, GrantSources } from './access-control.interface.js';
+import type { IAccessControl, AccessTargetKind, GrantPrincipal, GrantSources, ResolvedPrincipal } from './access-control.interface.js';
+import { type GroupsIndex } from './group-files.js';
 export declare const ADMIN_CANONICAL = "admin";
 /**
  * Verbs the resolver understands in an `access.md` frontmatter. Each verb
@@ -38,6 +39,24 @@ export declare const EVERYONE_DISPLAY = "Everyone";
 export declare function sourceVerbsFor(verb: Verb): Verb[];
 export declare const RESERVED_ROLE_NAMES: Set<string>;
 export declare const DENY_PREFIX = "deny ";
+/**
+ * Member-entry prefix in roles.yaml that references a GROUP instead of an
+ * email: `- group:Engineering`. Explicit on purpose — membership kind is
+ * never guessed from string shape. Valid on EVERY role including Admin, with
+ * one kept invariant (see `parseRolesYaml`): Admin must always retain at
+ * least one direct email member, so a misconfigured or unreachable directory
+ * can never leave the deployment without a rescuable admin.
+ */
+export declare const GROUP_REF_PREFIX = "group:";
+/**
+ * Explicit ROLE token prefix in access.md entries: `role/<Name>` resolves to
+ * the roles.yaml role only, never a group. A BARE name resolves GROUP-FIRST
+ * and falls back to the role — so `role/` is the escape hatch when a group
+ * shares the role's name. The prefix is reserved in the group name-safety
+ * rules (a group may never be named `role/...`), and every role is also
+ * registered in the principal index under its `role/<canonical>` alias.
+ */
+export declare const ROLE_TOKEN_PREFIX = "role/";
 export declare const USER_REF_REGEX: RegExp;
 export declare const EMAIL_REGEX: RegExp;
 export interface RoleEntry {
@@ -66,10 +85,34 @@ export interface AccessFile {
     entries: Record<Verb, ParsedEntry[]>;
 }
 export declare function isAccessMdPath(p: string): boolean;
+/**
+ * Extensions of node files whose OWN `---` frontmatter can carry access verbs
+ * the resolver enforces (`readOwnEntries` → `parseOwnAccessEntries`). The
+ * SINGLE source of truth for every surface that enumerates candidate files —
+ * the access-declarations scan and the shared `KbReferenceScanner` (which
+ * must scan/rewrite the same set, or a rename strands a live `.tool`
+ * frontmatter grant). `access.md` is covered by `.md`.
+ */
+export declare const ACCESS_FRONTMATTER_EXTENSIONS: readonly [".md", ".tool"];
+/** True when `p` is a file the resolver reads access frontmatter from. */
+export declare function hasAccessFrontmatterExtension(p: string): boolean;
+/**
+ * The PRINCIPAL index — canonical name → member emails. Despite the name it
+ * holds both kinds of named principal after `mergeGroupsIntoRoles` runs:
+ * roles.yaml roles (`kind: 'role'`, the default) and the active group file's
+ * groups (`kind: 'group'`). Grant resolution treats them identically — a
+ * grant names a principal, the principal has member emails — which is what
+ * lets the whole closeness-first resolver work on groups without changes.
+ *
+ * `groupRefs` carries a role's `group:<Name>` member entries between parse
+ * and merge; the merge expands them into `emails`/`byEmail`.
+ */
 interface RolesIndex {
     byCanonical: Map<string, {
         displayName: string;
         emails: Set<string>;
+        groupRefs?: Set<string>;
+        kind?: 'role' | 'group';
     }>;
     byEmail: Map<string, Set<string>>;
 }
@@ -84,7 +127,17 @@ interface YamlErr {
     ok: false;
     error: string;
 }
-export declare function parseYamlSubset(text: string): YamlOk | YamlErr;
+/**
+ * Strip a trailing `# comment` the way the YAML-subset tokeniser reads a
+ * line: a `#` at the start (after only whitespace) or preceded by whitespace
+ * begins a comment. Exported so the reference scanner matches tokens against
+ * the SAME comment rule the resolver parses with (a `- GTM Team  # sales`
+ * entry is the token `GTM Team`, never `GTM Team # sales`).
+ */
+export declare function stripComment(line: string): string;
+export declare function parseYamlSubset(text: string, opts?: {
+    tolerateEmptyKeys?: boolean;
+}): YamlOk | YamlErr;
 export declare function extractFrontmatter(text: string): {
     ok: true;
     frontmatter: string;
@@ -110,6 +163,61 @@ export declare function parseRolesYaml(text: string): {
     ok: false;
     errors: string[];
 };
+/**
+ * Merge the active group source into the principal index and expand role →
+ * group assignments. Mutates `index` in place; returns human-readable
+ * warnings (callers log them — nothing here ever throws, because group
+ * problems must degrade, not brick access resolution).
+ *
+ * Rules (the grant-grammar precedence):
+ *   - Every role is ALSO registered under its explicit `role/<canonical>`
+ *     alias — the token that always resolves to the role.
+ *   - A BARE name resolves GROUP-FIRST: when a group's canonical name
+ *     collides with a role's, the bare key resolves to the GROUP (warned);
+ *     the role stays reachable via `role/<canonical>`.
+ *   - Role `group:<Name>` refs — Admin's included — expand against the
+ *     merged groups; an unknown ref contributes nothing (warned).
+ *   - `byEmail` is rebuilt so each member holds exactly the tokens that
+ *     resolve to a principal they belong to (bare + `role/` alias for roles,
+ *     bare for groups).
+ */
+export declare function mergeGroupsIntoRoles(index: RolesIndex, groups: GroupsIndex, sourceFile: string): string[];
+/**
+ * Health of the ACTIVE groups source as of the last load. `ok: false` means
+ * the source EXISTS but could not be read or parsed — groups contribute
+ * nothing, bare grant tokens fall through to roles, and group-backed denies
+ * drop (the owner's explicit degrade-loudly decision, NOT fail-closed). The
+ * marker is carried on the loaded model and surfaced by the groups admin
+ * endpoints so the Groups page can banner it.
+ */
+export type GroupsHealth = {
+    ok: true;
+} | {
+    ok: false;
+    file: string;
+    reason: string;
+};
+/**
+ * Load the ACTIVE group source through `read` (working tree or at-ref — the
+ * caller supplies the reader, so both model loaders share one mode rule):
+ * `synced-groups.yaml` existing → IdP mode (groups.yaml ignored entirely,
+ * even when the synced file is empty or malformed — falling back would
+ * resurrect retired manual groups); otherwise `groups.yaml` → manual mode.
+ *
+ * `read` returns null for a genuinely-absent file and may THROW for any other
+ * failure. Only ENOENT/ENOTDIR count as absent (the caller may also whitelist
+ * them into null); every other read error — notably a non-absence error on
+ * `synced-groups.yaml` — is treated as a BROKEN source: no groups, no
+ * fallback to the manual file (falling back would resurrect retired groups),
+ * and an `ok: false` health marker. Structural parse failures degrade the
+ * same way; this function never throws.
+ */
+export declare function loadActiveGroups(read: (filename: string) => Promise<string | null>): Promise<{
+    groups: GroupsIndex;
+    sourceFile: string;
+    warnings: string[];
+    health: GroupsHealth;
+}>;
 /**
  * Does an `access.md` body declare access rules — i.e. is the file in the NEW
  * (body-governs-the-folder) format?
@@ -252,16 +360,6 @@ export declare class AccessControlService implements IAccessControl {
         ok: false;
         errors: string[];
     };
-    /**
-     * Advisory scan of folder `access.md` files for references to a role (by
-     * canonical name). See `IAccessControl.referencesToRole` — undercounts node
-     * frontmatter by design; powers the delete warning only, never the rename
-     * gate.
-     */
-    referencesToRole(workspaceId: string, canonicalRole: string): Promise<{
-        path: string;
-        verb: string;
-    }[]>;
     canWrite(workspaceId: string, userEmail: string, relativePath: string): Promise<boolean>;
     canRead(workspaceId: string, userEmail: string, relativePath: string): Promise<boolean>;
     canReadBatch(workspaceId: string, userEmail: string, relativePaths: string[]): Promise<Map<string, boolean>>;
@@ -270,6 +368,7 @@ export declare class AccessControlService implements IAccessControl {
     canOwnerBatch(workspaceId: string, userEmail: string, relativePaths: string[]): Promise<Map<string, boolean>>;
     canOwner(workspaceId: string, userEmail: string, relativePath: string): Promise<boolean>;
     eligibleOwners(workspaceId: string, relativePath: string): Promise<{
+        principals: ResolvedPrincipal[];
         roles: string[];
         users: {
             name: string;
@@ -277,6 +376,7 @@ export declare class AccessControlService implements IAccessControl {
         }[];
     }>;
     eligibleWriters(workspaceId: string, relativePath: string): Promise<{
+        principals: ResolvedPrincipal[];
         roles: string[];
         users: {
             name: string;
@@ -285,6 +385,7 @@ export declare class AccessControlService implements IAccessControl {
     }>;
     eligibleReaders(workspaceId: string, relativePath: string): Promise<{
         restricted: boolean;
+        principals: ResolvedPrincipal[];
         roles: string[];
         users: {
             name: string;
@@ -292,6 +393,7 @@ export declare class AccessControlService implements IAccessControl {
         }[];
     }>;
     eligibleDownloaders(workspaceId: string, relativePath: string): Promise<{
+        principals: ResolvedPrincipal[];
         roles: string[];
         users: {
             name: string;
@@ -306,9 +408,12 @@ export declare class AccessControlService implements IAccessControl {
         name: string;
         email: string;
     }>>;
-    grantSources(workspaceId: string, kind: AccessTargetKind, relativePath: string, principal: GrantPrincipal): Promise<GrantSources>;
+    grantSources(workspaceId: string, kind: AccessTargetKind, relativePath: string, principal: GrantPrincipal, opts?: {
+        tokenMatch?: 'exact' | 'name';
+    }): Promise<GrantSources>;
     kbPrincipals(workspaceId: string): Promise<{
-        plugins: string[];
+        roles: string[];
+        groups: string[];
         people: {
             name: string;
             email: string;
@@ -318,6 +423,16 @@ export declare class AccessControlService implements IAccessControl {
         email: string;
         displayName: string;
     } | null>;
+    /**
+     * `synced-groups.yaml` is MACHINE-OWNED: regenerated wholesale from the
+     * directory mirror and committed by the directory-sync bot. The bot is its
+     * ONLY writer — role/grant resolution never applies to it. That cuts both
+     * ways: the bot needs no role to write it (it isn't in roles.yaml, and on a
+     * protected branch nothing else would make it eligible), and no HUMAN can
+     * hand-edit it through the app (an edit would be silently overwritten by
+     * the next provisioning push anyway).
+     */
+    private machineOwnedWriteRule;
     canWriteAtRef(workspaceId: string, ref: string, userEmail: string, relativePath: string): Promise<boolean | null>;
     canReadAtRef(workspaceId: string, ref: string, userEmail: string, relativePath: string): Promise<boolean | null>;
     canWriteBatchAtRef(workspaceId: string, ref: string, userEmail: string, relativePaths: string[]): Promise<Map<string, boolean> | null>;

package/dist/modules/access/access-control.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"access-control.service.d.ts","sourceRoot":"","sources":["../../../src/modules/access/access-control.service.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,KAAK,EACV,cAAc,EACd,gBAAgB,EAChB,cAAc,EAEd,YAAY,EACb,MAAM,+BAA+B,CAAC;AAyEvC,eAAO,MAAM,eAAe,UAAU,CAAC;AACvC;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,WAAW,iDAAkD,CAAC;AAC3E,MAAM,MAAM,IAAI,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhD,eAAO,MAAM,kBAAkB,aAAa,CAAC;AAC7C,qEAAqE;AACrE,eAAO,MAAM,gBAAgB,aAAa,CAAC;AAE3C;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,EAAE,CASjD;AACD,eAAO,MAAM,mBAAmB,aAAwC,CAAC;AACzE,eAAO,MAAM,WAAW,UAAU,CAAC;AAEnC,eAAO,MAAM,cAAc,QAA6C,CAAC;AACzE,eAAO,MAAM,WAAW,QAAqC,CAAC;AAM9D,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,SAAS,CAAC;AAEhD,MAAM,WAAW,UAAU;IACzB,gFAAgF;IAChF,IAAI,EAAE,MAAM,CAAC;IACb,qDAAqD;IACrD,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;CACtC;AAQD,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAEjD;AAED,UAAU,UAAU;IAClB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;KAAE,CAAC,CAAC;IACvE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;CACnC;AAmCD,KAAK,SAAS,GAAG,MAAM,GAAG,SAAS,EAAE,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GAAG,IAAI,CAAC;AAE5E,UAAU,MAAM;IACd,EAAE,EAAE,IAAI,CAAC;IACT,KAAK,EAAE,SAAS,CAAC;CAClB;AAED,UAAU,OAAO;IACf,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE,MAAM,CAAC;CACf;AAkDD,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAoE9D;AAMD,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,GACX;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAWlE;AAED,gFAAgF;AAChF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAOzD;AAMD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpD;AAMD,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,OAAO,GACX;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,WAAW,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAkCjE;AAMD,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,GACX;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAyEnE;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAQ/D;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,GAAG,IAAI,CAGpF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,GACnB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CA0DtF;AAQD;;;;GAIG;AACH,KAAK,UAAU,GAAG,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;AAE9C;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CA8BrE;AAED;;;;;+DAK+D;AAC/D,MAAM,MAAM,WAAW,GAAG;IAAE,IAAI,EAAE,KAAK,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAqdhF,qBAAa,oBAAqB,YAAW,cAAc;IAoCvD,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS;IApC5B;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA+D;IACrF,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAS;IAE7C;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,QAAQ,CAAC,eAAe,CAG5B;IACJ,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAc;IAExD;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAsB;gBAGpC,gBAAgB,EAAE,gBAAgB,EAClC,SAAS,EAAE,MAAM;IAClC;;;;;OAKG;IACH,gBAAgB,GAAE,SAAS,MAAM,EAAO;IAO1C;;;OAGG;IACH,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI;IAKrC,4EAA4E;YAC9D,gBAAgB;IAiB9B;;;;;;;OAOG;IACH,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE;IAK/E;;;;;OAKG;IACG,gBAAgB,CACpB,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAetC,QAAQ,CACZ,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC;IAMb,OAAO,CACX,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC;IAMb,YAAY,CAChB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAc1B,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAY1B,WAAW,CACf,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC;IAMb,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAY1B,QAAQ,CACZ,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC;IAMb,cAAc,CAClB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,CAAC;IAMnE,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,CAAC;IAMnE,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QAAE,UAAU,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,CAAC;IAaxF,mBAAmB,CACvB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,CAAC;IAMnE,oBAAoB,CACxB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAMlD,mBAAmB,CACvB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAMlD,YAAY,CAChB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,gBAAgB,EACtB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,cAAc,GACxB,OAAO,CAAC,YAAY,CAAC;IAiBlB,YAAY,CAChB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,CAAC;IAqCtE,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAqCnD,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAQpB,YAAY,CAChB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAQpB,kBAAkB,CACtB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAcjC,oBAAoB,CACxB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;IAQ1E,4BAA4B,CAChC,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CACZ,MAAM,EACN;QACE,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QACzC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACpB,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;KAC9B,CACF,GAAG,IAAI,CAAC;YA6BK,SAAS;YA8DT,kBAAkB;YA0ClB,OAAO;IAKrB;;;;;;;OAOG;YACW,cAAc;IAe5B;;;;;OAKG;YACW,mBAAmB;IAYjC;;;;;;;OAOG;YACW,wBAAwB;IAqBtC;;;;OAIG;IACH,OAAO,CAAC,aAAa;IAKrB;;;;OAIG;YACW,SAAS;IAavB;;;;OAIG;YACW,oBAAoB;IAmBlC;;;;;;;;;;;;;;;OAeG;YACW,cAAc;CA8D7B"}
+{"version":3,"file":"access-control.service.d.ts","sourceRoot":"","sources":["../../../src/modules/access/access-control.service.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,KAAK,EACV,cAAc,EACd,gBAAgB,EAChB,cAAc,EAEd,YAAY,EACZ,iBAAiB,EAClB,MAAM,+BAA+B,CAAC;AAKvC,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,kBAAkB,CAAC;AA4E1B,eAAO,MAAM,eAAe,UAAU,CAAC;AACvC;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,WAAW,iDAAkD,CAAC;AAC3E,MAAM,MAAM,IAAI,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhD,eAAO,MAAM,kBAAkB,aAAa,CAAC;AAC7C,qEAAqE;AACrE,eAAO,MAAM,gBAAgB,aAAa,CAAC;AAE3C;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,EAAE,CASjD;AACD,eAAO,MAAM,mBAAmB,aAAwC,CAAC;AACzE,eAAO,MAAM,WAAW,UAAU,CAAC;AACnC;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,WAAW,CAAC;AACzC;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,UAAU,CAAC;AAEzC,eAAO,MAAM,cAAc,QAA6C,CAAC;AACzE,eAAO,MAAM,WAAW,QAAqC,CAAC;AAM9D,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,SAAS,CAAC;AAEhD,MAAM,WAAW,UAAU;IACzB,gFAAgF;IAChF,IAAI,EAAE,MAAM,CAAC;IACb,qDAAqD;IACrD,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;CACtC;AAQD,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAEjD;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,2BAA4B,CAAC;AAEvE,0EAA0E;AAC1E,wBAAgB,6BAA6B,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAEhE;AAED;;;;;;;;;;GAUG;AACH,UAAU,UAAU;IAClB,WAAW,EAAE,GAAG,CACd,MAAM,EACN;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAAC,SAAS,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAC/F,CAAC;IACF,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;CACnC;AA0CD,KAAK,SAAS,GAAG,MAAM,GAAG,SAAS,EAAE,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GAAG,IAAI,CAAC;AAE5E,UAAU,MAAM;IACd,EAAE,EAAE,IAAI,CAAC;IACT,KAAK,EAAE,SAAS,CAAC;CAClB;AAED,UAAU,OAAO;IACf,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAUjD;AAuDD,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE;IAAE,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAAE,GACrC,MAAM,GAAG,OAAO,CAoElB;AAMD,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,GACX;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAWlE;AAED,gFAAgF;AAChF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAOzD;AAMD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpD;AAMD,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,OAAO,GACX;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,WAAW,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CA0CjE;AAMD,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,GACX;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAoGnE;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,WAAW,EACnB,UAAU,EAAE,MAAM,GACjB,MAAM,EAAE,CA2DV;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,YAAY,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAQtF;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,GACjD,OAAO,CAAC;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,YAAY,CAAA;CAAE,CAAC,CAuChG;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAQ/D;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,GAAG,IAAI,CAGpF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,GACnB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CA0DtF;AAQD;;;;GAIG;AACH,KAAK,UAAU,GAAG,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;AAE9C;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CA8BrE;AAED;;;;;+DAK+D;AAC/D,MAAM,MAAM,WAAW,GAAG;IAAE,IAAI,EAAE,KAAK,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAghBhF,qBAAa,oBAAqB,YAAW,cAAc;IAoCvD,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS;IApC5B;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA+D;IACrF,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAS;IAE7C;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,QAAQ,CAAC,eAAe,CAG5B;IACJ,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAc;IAExD;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAsB;gBAGpC,gBAAgB,EAAE,gBAAgB,EAClC,SAAS,EAAE,MAAM;IAClC;;;;;OAKG;IACH,gBAAgB,GAAE,SAAS,MAAM,EAAO;IAO1C;;;OAGG;IACH,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI;IAKrC,4EAA4E;YAC9D,gBAAgB;IAiB9B;;;;;;;OAOG;IACH,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE;IAKzE,QAAQ,CACZ,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC;IAQb,OAAO,CACX,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC;IAMb,YAAY,CAChB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAc1B,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAa1B,WAAW,CACf,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC;IAMb,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAY1B,QAAQ,CACZ,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC;IAMb,cAAc,CAClB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QACT,UAAU,EAAE,iBAAiB,EAAE,CAAC;QAChC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC1C,CAAC;IAMI,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QACT,UAAU,EAAE,iBAAiB,EAAE,CAAC;QAChC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC1C,CAAC;IAMI,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QACT,UAAU,EAAE,OAAO,CAAC;QACpB,UAAU,EAAE,iBAAiB,EAAE,CAAC;QAChC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC1C,CAAC;IAaI,mBAAmB,CACvB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QACT,UAAU,EAAE,iBAAiB,EAAE,CAAC;QAChC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KAC1C,CAAC;IAMI,oBAAoB,CACxB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAMlD,mBAAmB,CACvB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAMlD,YAAY,CAChB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,gBAAgB,EACtB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,cAAc,EACzB,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;KAAE,GACvC,OAAO,CAAC,YAAY,CAAC;IAyBlB,YAAY,CAChB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,CAAC;IA2CtF,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAqCzD;;;;;;;;OAQG;IACH,OAAO,CAAC,qBAAqB;IAKvB,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAUpB,YAAY,CAChB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAQpB,kBAAkB,CACtB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IA0BjC,oBAAoB,CACxB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;IAe1E,4BAA4B,CAChC,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CACZ,MAAM,EACN;QACE,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QACzC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACpB,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;KAC9B,CACF,GAAG,IAAI,CAAC;YA+CK,SAAS;YA4FT,kBAAkB;YA0ClB,OAAO;IAKrB;;;;;;;OAOG;YACW,cAAc;IAe5B;;;;;OAKG;YACW,mBAAmB;IAYjC;;;;;;;OAOG;YACW,wBAAwB;IAqBtC;;;;OAIG;IACH,OAAO,CAAC,aAAa;IAKrB;;;;OAIG;YACW,SAAS;IAavB;;;;OAIG;YACW,oBAAoB;IAmBlC;;;;;;;;;;;;;;;OAeG;YACW,cAAc;CAqF7B"}