@bevel-software/platform-core-backend 0.15.1 → 0.19.0

package/dist/modules/access/access-mutation.service.js

@@ -25,16 +25,20 @@
  *     no last-owner guard and no self-lockout guard. `owner` names who validates a
  *     file/folder, not a stronger privilege tier, so removing the last owner
  *     creates no lockout; and a user may drop their own access (including write),
- *     since admins keep rescue access regardless.
+ *     since admins keep rescue access regardless. The one refusal: the Admin
+ *     role's write at the repository root (see `removesAdminRootWrite`).
  *
  * Paths in/out of this service are REPO-RELATIVE (e.g. `Knowledge/Sales`,
  * `Knowledge/Sales/Deal.md`). The route strips the `<kbDirName>/` prefix once at
  * entry; everything here speaks repo-relative, matching `IAccessControl`.
  */
 import path from 'node:path';
-import { KNOWN_VERBS, ROLE_TOKEN_PREFIX, canonicalRoleName, } from '../access-model/access-grammar.js';
+import { isAbsence } from '../../shared/fs.contract.js';
+import { isTextBytes } from '../workspace/file-readers/text-reader.js';
+import { ADMIN_CANONICAL, KNOWN_VERBS, ROLE_TOKEN_PREFIX, canonicalRoleName, accessFrontmatterExtensionList, } from '../access-model/access-grammar.js';
 import { spliceRevoke, spliceGrant, validatePrincipal, AccessSpliceError, } from '../access-model/access-splice.js';
 import { WorkflowDomainError } from '../../shared/domain-errors.js';
+import { canCarryFrontmatter, FOLDER_GOVERNS_ACCESS_KIND, folderGovernsAccessMessage, } from '@bevel-software/platform-shared';
 /** Bad-request-class mutation failure (invalid principal, unknown role/group, lockout). */
 export class AccessMutationError extends WorkflowDomainError {
     constructor(message, status = 400, payload) {
@@ -49,6 +53,37 @@ export class AccessMutationError extends WorkflowDomainError {
 export function accessMdPathForFolder(repoRelDir) {
     return repoRelDir ? `${repoRelDir}/access.md` : 'access.md';
 }
+/** The refusal for a mutation that would take Admin's write away at the repository root. */
+export const ADMIN_ROOT_WRITE_MESSAGE = 'Admins always keep write access at the root so the deployment cannot lock itself out.';
+/**
+ * Whether revoking or denying `principal` on `verb` (absent = every verb) at
+ * this target touches the Admin ROLE's write at the repository root — the
+ * root folder's `access.md`, or a file directly in the root. The resolver
+ * ignores such a rule anyway (the Admin write floor), so writing it would only
+ * leave a line that says something the app does not do. A bare token matched
+ * `exact` is a group's (or a shadowed name's), never the Admin role. Targets
+ * arrive in one spelling: the routes refuse `.` and `..` segments.
+ */
+export function removesAdminRootWrite(kind, repoRelTarget, principal, verb, tokenMatch) {
+    if (principal.kind !== 'role')
+        return false;
+    if (!touchesRootWrite(kind, repoRelTarget, verb))
+        return false;
+    const canonical = canonicalRoleName(principal.role);
+    const explicit = canonical.startsWith(ROLE_TOKEN_PREFIX);
+    if (!explicit && tokenMatch === 'exact')
+        return false;
+    return (explicit ? canonical.slice(ROLE_TOKEN_PREFIX.length) : canonical) === ADMIN_CANONICAL;
+}
+/** Whether a mutation on `verb` (absent = every verb) at this target reaches write at the repository root. */
+function touchesRootWrite(kind, repoRelTarget, verb) {
+    if (verb !== undefined && verb !== 'write')
+        return false;
+    return kind === 'folder' ? repoRelTarget === '' : !repoRelTarget.includes('/');
+}
+function adminRootWriteRefusal() {
+    return new AccessMutationError(ADMIN_ROOT_WRITE_MESSAGE, 403, { kind: 'admin-root-write' });
+}
 /**
  * The file whose frontmatter governs a node — the node file itself. (A file
  * target edits its OWN frontmatter, not the folder's access.md, so a per-file
@@ -57,6 +92,36 @@ export function accessMdPathForFolder(repoRelDir) {
 export function targetFileForNode(repoRelFile) {
     return repoRelFile;
 }
+/**
+ * Refuse a FILE target that cannot carry frontmatter (see `canCarryFrontmatter`):
+ * splicing a YAML block into a PDF, a presentation or an image corrupts its
+ * bytes, and the rule would never resolve anyway. Such a file takes its
+ * folder's rules, so the refusal names that folder. 422 with kind
+ * `folder-governs-access`, thrown BEFORE the file is read, locked or written.
+ * A folder target, or a Markdown note, passes.
+ */
+export function assertFileCarriesAccessRules(kind, repoRelTarget) {
+    if (kind !== 'file' || fileCarriesAccessRules(repoRelTarget))
+        return;
+    throw folderGovernsAccessError(repoRelTarget);
+}
+/**
+ * The shared predicate over the resolver's REGISTERED extension set — core's
+ * `.md`/`.tool` plus whatever an overlay added at boot — so a file is refused
+ * exactly when the resolver would never read a rule written into it.
+ */
+export function fileCarriesAccessRules(repoRelFile) {
+    return canCarryFrontmatter(repoRelFile, accessFrontmatterExtensionList());
+}
+function folderGovernsAccessError(repoRelTarget) {
+    const folder = governingFolderOf(repoRelTarget);
+    return new AccessMutationError(folderGovernsAccessMessage(folder || 'the whole workspace'), 422, { kind: FOLDER_GOVERNS_ACCESS_KIND, folder });
+}
+/** The repo-relative folder a file sits in (`''` for a file at the repo root). */
+export function governingFolderOf(repoRelFile) {
+    const dir = path.posix.dirname(repoRelFile);
+    return dir === '.' ? '' : dir;
+}
 export class AccessMutationService {
     workspaceService;
     accessControl;
@@ -70,30 +135,94 @@ export class AccessMutationService {
      * Resolve the file we'll actually edit for a (kind, target) pair, repo-relative.
      *   - folder → the folder's `access.md` (block-list form)
      *   - file   → the node file itself (its own frontmatter, scalar form allowed)
+     *
+     * A file that cannot carry frontmatter throws `folder-governs-access`
+     * instead: every mutation resolves its edit path here before reading, so
+     * none of them ever opens such a file.
      */
     fileToEdit(kind, repoRelTarget) {
+        assertFileCarriesAccessRules(kind, repoRelTarget);
         if (kind === 'folder') {
             return { editPath: accessMdPathForFolder(repoRelTarget), allowScalar: false };
         }
         return { editPath: targetFileForNode(repoRelTarget), allowScalar: true };
     }
+    /**
+     * The CONTENT half of the refusal, for the routes to run BEFORE taking the
+     * edit lock: a file target whose bytes are not text (a binary saved as
+     * `.md`) answers `folder-governs-access` without the lock ever being held.
+     * Refusing inside the lock instead makes the route release it without a
+     * commit, and that release discards the path's working-tree changes — which,
+     * right after an upload whose commit is still queued, deletes the upload.
+     * `readOrEmpty` repeats the check under the lock, in case the bytes changed
+     * in between. Folder targets and missing files pass through untouched (the
+     * mutation reports those as before).
+     */
+    async assertTargetHoldsText(workspaceId, kind, repoRelTarget) {
+        if (kind !== 'file')
+            return;
+        const { editPath } = this.fileToEdit(kind, repoRelTarget);
+        let bytes;
+        try {
+            bytes = await this.workspaceService.readFileBinary(workspaceId, this.toWorkspaceRelative(editPath));
+        }
+        catch (err) {
+            if (isAbsence(err))
+                return;
+            throw err;
+        }
+        if (!isTextBytes(bytes))
+            throw folderGovernsAccessError(repoRelTarget);
+    }
+    /**
+     * The same content question, asked by the READ view, which must not fail:
+     * true when the file's bytes are text, so it really can hold rules of its
+     * own.
+     *
+     * ABSENCE is the one failure that answers yes: there is nothing there to
+     * object to, and a target the view is open on is normally about to exist.
+     * Any OTHER read failure (EACCES, EIO) answers NO — the mutations read the
+     * same bytes and would fail on them too, so the view must not offer a field
+     * whose writes cannot land. The dialog degrades to the folder pointer with
+     * the read side intact, which is better than a 500 that shows nothing.
+     * (The mutations use `assertTargetHoldsText`, which rethrows the failure so
+     * the caller sees the real error rather than a refusal.)
+     */
+    async targetHoldsText(workspaceId, repoRelFile) {
+        try {
+            const bytes = await this.workspaceService.readFileBinary(workspaceId, this.toWorkspaceRelative(repoRelFile));
+            return isTextBytes(bytes);
+        }
+        catch (err) {
+            return isAbsence(err);
+        }
+    }
     /**
      * Read the to-be-edited file's current text, or '' when it's an expected
-     * missing file. `allowMissing` is true only where an absent file is normal
-     * (a folder that has no `access.md` yet); there we swallow ENOENT/ENOTDIR.
-     * Every other error — a typoed node target, a transient read failure — is
-     * rethrown so we never treat it as empty and write a brand-new access file.
+     * missing file. An absent file is normal only for a folder (no `access.md`
+     * yet); there we swallow ENOENT/ENOTDIR. Every other error — a typoed node
+     * target, a transient read failure — is rethrown so we never treat it as
+     * empty and write a brand-new access file.
+     *
+     * A FILE target must also hold text (`isTextBytes`: no NUL, valid UTF-8 —
+     * the file tools' own test). A path alone cannot tell a note from a binary
+     * saved as `.md`, so binary content is refused with `folder-governs-access`
+     * here, after the read and before any splice or write.
      */
-    async readOrEmpty(workspaceId, repoRelEditPath, allowMissing) {
+    async readOrEmpty(workspaceId, kind, repoRelTarget, repoRelEditPath) {
         const wsRelative = this.toWorkspaceRelative(repoRelEditPath);
+        if (kind === 'file') {
+            const bytes = await this.workspaceService.readFileBinary(workspaceId, wsRelative);
+            if (!isTextBytes(bytes))
+                throw folderGovernsAccessError(repoRelTarget);
+            return bytes.toString('utf-8');
+        }
         try {
             return await this.workspaceService.readFile(workspaceId, wsRelative);
         }
         catch (err) {
-            const code = err?.code;
-            if (allowMissing && (code === 'ENOENT' || code === 'ENOTDIR')) {
+            if (isAbsence(err))
                 return '';
-            }
             throw err;
         }
     }
@@ -149,7 +278,7 @@ export class AccessMutationService {
     async grant(workspaceId, kind, repoRelTarget, verb, principal) {
         this.assertPrincipalSafe(principal); // injection/shape guard (role-exists is the route's job)
         const { editPath, allowScalar } = this.fileToEdit(kind, repoRelTarget);
-        const current = await this.readOrEmpty(workspaceId, editPath, kind === 'folder');
+        const current = await this.readOrEmpty(workspaceId, kind, repoRelTarget, editPath);
         let result;
         try {
             result = spliceGrant(current, verb, principal, { allowScalar, target: kind === 'folder' ? 'folder' : 'node' });
@@ -195,12 +324,13 @@ export class AccessMutationService {
         // Allow a missing target only for a folder (no access.md yet is normal); a
         // missing FILE node is a bad target and should surface, not silently no-op
         // — same rule grant() uses.
-        const original = await this.readOrEmpty(workspaceId, editPath, kind === 'folder');
+        const original = await this.readOrEmpty(workspaceId, kind, repoRelTarget, editPath);
         // Alias-tolerant vs exact-token matching, decided by group shadowing —
         // see revokeTokenMatch — unless the caller pinned it.
         const tokenMatch = opts?.tokenMatch ?? (await this.revokeTokenMatch(workspaceId, principal));
         let next = original;
         let changed = false;
+        let writeRemoved = false;
         try {
             const verbsToRevoke = verb ? [verb] : KNOWN_VERBS;
             for (const v of verbsToRevoke) {
@@ -210,11 +340,18 @@ export class AccessMutationService {
                 });
                 next = r.text;
                 changed = changed || r.changed;
+                writeRemoved = writeRemoved || (v === 'write' && r.changed);
             }
         }
         catch (err) {
             throw this.toMutationError(err);
         }
+        // Refused only when an Admin write entry would really go: a whole-row
+        // Remove at a root that grants Admin other verbs but no write line (write
+        // comes from the floor) strips those verbs as usual.
+        if (writeRemoved && removesAdminRootWrite(kind, repoRelTarget, principal, verb, tokenMatch)) {
+            throw adminRootWriteRefusal();
+        }
         if (!changed)
             return { changed: false, editPath };
         const wsRelative = this.toWorkspaceRelative(editPath);
@@ -257,11 +394,22 @@ export class AccessMutationService {
     opts) {
         this.assertPrincipalSafe(principal);
         const { editPath, allowScalar } = this.fileToEdit(kind, repoRelTarget);
-        const original = await this.readOrEmpty(workspaceId, editPath, kind === 'folder');
+        const original = await this.readOrEmpty(workspaceId, kind, repoRelTarget, editPath);
         const verbsToDeny = verb ? [verb] : KNOWN_VERBS;
         // Same shadowing-aware matching as revoke(): the strip must not swallow a
         // same-named OTHER principal's grant (bare = group vs role/<name> = role).
         const tokenMatch = opts?.tokenMatch ?? (await this.revokeTokenMatch(workspaceId, principal));
+        if (removesAdminRootWrite(kind, repoRelTarget, principal, verb, tokenMatch)) {
+            throw adminRootWriteRefusal();
+        }
+        // A PERSON who is an admin keeps root write through the floor, so a deny
+        // there could only be rolled back as "ineffective" — refuse it up front
+        // with the reason instead.
+        if (principal.kind === 'user' &&
+            touchesRootWrite(kind, repoRelTarget, verb) &&
+            (await this.accessControl.holdsAdminRootWrite(workspaceId, principal.email))) {
+            throw adminRootWriteRefusal();
+        }
         let next = original;
         try {
             for (const v of verbsToDeny) {

package/dist/modules/access/access-mutation.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"access-mutation.service.js","sourceRoot":"","sources":["../../../src/modules/access/access-mutation.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAI7B,OAAO,EAEL,WAAW,EACX,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,YAAY,EACZ,WAAW,EACX,iBAAiB,EACjB,iBAAiB,GAGlB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAKpE,2FAA2F;AAC3F,MAAM,OAAO,mBAAoB,SAAQ,mBAAmB;IAC1D,YAAY,OAAe,EAAE,MAAM,GAAG,GAAG,EAAE,OAAiC;QAC1E,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAAkB;IACtD,OAAO,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,WAAmB;IACnD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,OAAO,qBAAqB;IAEb;IACA;IACA;IAHnB,YACmB,gBAAkC,EAClC,aAA6B,EAC7B,SAAiB;QAFjB,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,kBAAa,GAAb,aAAa,CAAgB;QAC7B,cAAS,GAAT,SAAS,CAAQ;IACjC,CAAC;IAEJ;;;;OAIG;IACH,UAAU,CAAC,IAAgB,EAAE,aAAqB;QAChD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,OAAO,EAAE,QAAQ,EAAE,qBAAqB,CAAC,aAAa,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;QAChF,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,iBAAiB,CAAC,aAAa,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC3E,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,WAAW,CACvB,WAAmB,EACnB,eAAuB,EACvB,YAAqB;QAErB,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC;QAC7D,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QACvE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,GAAI,GAAoC,EAAE,IAAI,CAAC;YACzD,IAAI,YAAY,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC;gBAC9D,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,mBAAmB,CAAC,YAAoB;QAC9C,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IACvD,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACK,KAAK,CAAC,gBAAgB,CAAC,WAAmB,EAAE,SAAoB;QACtE,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM;YAAE,OAAO,OAAO,CAAC,CAAC,iCAAiC;QAChF,MAAM,SAAS,GAAG,iBAAiB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,iBAAiB,CAAC;YAClD,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC;YAC3C,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QACtE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QACnE,OAAO,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;IACrC,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,KAAK,CACT,WAAmB,EACnB,IAAgB,EAChB,aAAqB,EACrB,IAAU,EACV,SAAoB;QAEpB,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC,yDAAyD;QAC9F,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QACvE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,QAAQ,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC;QACjF,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,WAAW,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACjH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CACnC,WAAW,EACX,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAClC,MAAM,CAAC,IAAI,CACZ,CAAC;YACF,uEAAuE;YACvE,sDAAsD;YACtD,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC;IAC/C,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,MAAM,CACV,WAAmB,EACnB,IAAgB,EAChB,aAAqB,EACrB,SAAoB;IACpB,yEAAyE;IACzE,0CAA0C;IAC1C,gBAAwB;IACxB,8EAA8E;IAC9E,4EAA4E;IAC5E,IAAW;IACX,uEAAuE;IACvE,wEAAwE;IACxE,yEAAyE;IACzE,yEAAyE;IACzE,uBAAuB;IACvB,IAAkC;QAElC,KAAK,gBAAgB,CAAC,CAAC,mEAAmE;QAC1F,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC,wCAAwC;QAC7E,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QAC1D,2EAA2E;QAC3E,2EAA2E;QAC3E,4BAA4B;QAC5B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,QAAQ,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC;QAClF,uEAAuE;QACvE,sDAAsD;QACtD,MAAM,UAAU,GAAG,IAAI,EAAE,UAAU,IAAI,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;QAC7F,IAAI,IAAI,GAAG,QAAQ,CAAC;QACpB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;YAClD,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;gBAC9B,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE;oBACzC,MAAM,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM;oBAC7C,UAAU;iBACX,CAAC,CAAC;gBACH,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;gBACd,OAAO,GAAG,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC;YACjC,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QAElD,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QACtD,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;QACrE,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAE3C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACrC,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,KAAK,CAAC,QAAQ,CACZ,WAAmB,EACnB,IAAgB,EAChB,aAAqB,EACrB,SAAoB,EACpB,IAAW;IACX,2EAA2E;IAC3E,IAAkC;QAElC,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QACpC,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,QAAQ,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC;QAElF,MAAM,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;QAChD,0EAA0E;QAC1E,2EAA2E;QAC3E,MAAM,UAAU,GAAG,IAAI,EAAE,UAAU,IAAI,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;QAC7F,IAAI,IAAI,GAAG,QAAQ,CAAC;QACpB,IAAI,CAAC;YACH,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;gBAC5B,wEAAwE;gBACxE,sDAAsD;gBACtD,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE;oBACtC,MAAM,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM;oBAC7C,UAAU;iBACX,CAAC,CAAC,IAAI,CAAC;gBACR,wCAAwC;gBACxC,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC;YAC1H,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;QAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,uFAAuF;YACvF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QACtC,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QACtD,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;QACrE,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAE3C,wEAAwE;QACxE,wEAAwE;QACxE,yEAAyE;QACzE,0EAA0E;QAC1E,uEAAuE;QACvE,wEAAwE;QACxE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,uBAAuB,CACjD,WAAW,EACX,IAAI,EACJ,aAAa,EACb,SAAS,EACT,IAAI,EACJ,UAAU,CACX,CAAC;QACF,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,WAAW,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;YACzE,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YAC3C,MAAM,IAAI,mBAAmB,CAC3B,4GAA4G,EAC5G,GAAG,EACH,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAC7B,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACrC,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACK,KAAK,CAAC,uBAAuB,CACnC,WAAmB,EACnB,IAAgB,EAChB,aAAqB,EACrB,SAAoB,EACpB,IAAW,EACX,UAAuB;QAEvB,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC;YAC9B,MAAM,KAAK,GAAyC;gBAClD,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,aAAa,CAAC;gBACzE,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,EAAE,aAAa,CAAC;gBAC3E,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,EAAE,aAAa,CAAC;gBACjF,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,EAAE,aAAa,CAAC;aAC5E,CAAC;YACF,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;YAC1C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAChE,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CACnD,WAAW,EACX,IAAI,EACJ,aAAa,EACb,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,EACtC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS,CACxC,CAAC;QACF,OAAO,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9E,CAAC;IAED;;;;;;OAMG;IACK,mBAAmB,CAAC,SAAoB;QAC9C,IAAI,CAAC;YACH,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAEO,eAAe,CAAC,GAAY;QAClC,IAAI,GAAG,YAAY,mBAAmB;YAAE,OAAO,GAAG,CAAC;QACnD,IAAI,GAAG,YAAY,iBAAiB;YAAE,OAAO,IAAI,mBAAmB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACvF,OAAO,IAAI,mBAAmB,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;IAC9F,CAAC;CACF"}
+{"version":3,"file":"access-mutation.service.js","sourceRoot":"","sources":["../../../src/modules/access/access-mutation.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAI7B,OAAO,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,0CAA0C,CAAC;AACvE,OAAO,EAEL,eAAe,EACf,WAAW,EACX,iBAAiB,EACjB,iBAAiB,EACjB,8BAA8B,GAC/B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,YAAY,EACZ,WAAW,EACX,iBAAiB,EACjB,iBAAiB,GAGlB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,iCAAiC,CAAC;AAKzC,2FAA2F;AAC3F,MAAM,OAAO,mBAAoB,SAAQ,mBAAmB;IAC1D,YAAY,OAAe,EAAE,MAAM,GAAG,GAAG,EAAE,OAAiC;QAC1E,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAAkB;IACtD,OAAO,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;AAC9D,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,MAAM,wBAAwB,GACnC,uFAAuF,CAAC;AAE1F;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAgB,EAChB,aAAqB,EACrB,SAAoB,EACpB,IAAsB,EACtB,UAAsB;IAEtB,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/D,MAAM,SAAS,GAAG,iBAAiB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;IACzD,IAAI,CAAC,QAAQ,IAAI,UAAU,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACtD,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,eAAe,CAAC;AAChG,CAAC;AAED,8GAA8G;AAC9G,SAAS,gBAAgB,CAAC,IAAgB,EAAE,aAAqB,EAAE,IAAsB;IACvF,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACzD,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,qBAAqB;IAC5B,OAAO,IAAI,mBAAmB,CAAC,wBAAwB,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,WAAmB;IACnD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAAgB,EAAE,aAAqB;IAClF,IAAI,IAAI,KAAK,MAAM,IAAI,sBAAsB,CAAC,aAAa,CAAC;QAAE,OAAO;IACrE,MAAM,wBAAwB,CAAC,aAAa,CAAC,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,WAAmB;IACxD,OAAO,mBAAmB,CAAC,WAAW,EAAE,8BAA8B,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,wBAAwB,CAAC,aAAqB;IACrD,MAAM,MAAM,GAAG,iBAAiB,CAAC,aAAa,CAAC,CAAC;IAChD,OAAO,IAAI,mBAAmB,CAC5B,0BAA0B,CAAC,MAAM,IAAI,qBAAqB,CAAC,EAC3D,GAAG,EACH,EAAE,IAAI,EAAE,0BAA0B,EAAE,MAAM,EAAE,CAC7C,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,iBAAiB,CAAC,WAAmB;IACnD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC5C,OAAO,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;AAChC,CAAC;AAED,MAAM,OAAO,qBAAqB;IAEb;IACA;IACA;IAHnB,YACmB,gBAAkC,EAClC,aAA6B,EAC7B,SAAiB;QAFjB,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,kBAAa,GAAb,aAAa,CAAgB;QAC7B,cAAS,GAAT,SAAS,CAAQ;IACjC,CAAC;IAEJ;;;;;;;;OAQG;IACH,UAAU,CAAC,IAAgB,EAAE,aAAqB;QAChD,4BAA4B,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QAClD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,OAAO,EAAE,QAAQ,EAAE,qBAAqB,CAAC,aAAa,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;QAChF,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,iBAAiB,CAAC,aAAa,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC3E,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,qBAAqB,CAAC,WAAmB,EAAE,IAAgB,EAAE,aAAqB;QACtF,IAAI,IAAI,KAAK,MAAM;YAAE,OAAO;QAC5B,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QAC1D,IAAI,KAAa,CAAC;QAClB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC;QACtG,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,SAAS,CAAC,GAAG,CAAC;gBAAE,OAAO;YAC3B,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;YAAE,MAAM,wBAAwB,CAAC,aAAa,CAAC,CAAC;IACzE,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,eAAe,CAAC,WAAmB,EAAE,WAAmB;QAC5D,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CACtD,WAAW,EACX,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,CACtC,CAAC;YACF,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACK,KAAK,CAAC,WAAW,CACvB,WAAmB,EACnB,IAAgB,EAChB,aAAqB,EACrB,eAAuB;QAEvB,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC;QAC7D,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;YAClF,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;gBAAE,MAAM,wBAAwB,CAAC,aAAa,CAAC,CAAC;YACvE,OAAO,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QACvE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,SAAS,CAAC,GAAG,CAAC;gBAAE,OAAO,EAAE,CAAC;YAC9B,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,mBAAmB,CAAC,YAAoB;QAC9C,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IACvD,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACK,KAAK,CAAC,gBAAgB,CAAC,WAAmB,EAAE,SAAoB;QACtE,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM;YAAE,OAAO,OAAO,CAAC,CAAC,iCAAiC;QAChF,MAAM,SAAS,GAAG,iBAAiB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,iBAAiB,CAAC;YAClD,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC;YAC3C,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QACtE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QACnE,OAAO,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;IACrC,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,KAAK,CACT,WAAmB,EACnB,IAAgB,EAChB,aAAqB,EACrB,IAAU,EACV,SAAoB;QAEpB,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC,yDAAyD;QAC9F,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QACvE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;QACnF,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,WAAW,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACjH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CACnC,WAAW,EACX,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAClC,MAAM,CAAC,IAAI,CACZ,CAAC;YACF,uEAAuE;YACvE,sDAAsD;YACtD,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC;IAC/C,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,MAAM,CACV,WAAmB,EACnB,IAAgB,EAChB,aAAqB,EACrB,SAAoB;IACpB,yEAAyE;IACzE,0CAA0C;IAC1C,gBAAwB;IACxB,8EAA8E;IAC9E,4EAA4E;IAC5E,IAAW;IACX,uEAAuE;IACvE,wEAAwE;IACxE,yEAAyE;IACzE,yEAAyE;IACzE,uBAAuB;IACvB,IAAkC;QAElC,KAAK,gBAAgB,CAAC,CAAC,mEAAmE;QAC1F,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC,wCAAwC;QAC7E,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QAC1D,2EAA2E;QAC3E,2EAA2E;QAC3E,4BAA4B;QAC5B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;QACpF,uEAAuE;QACvE,sDAAsD;QACtD,MAAM,UAAU,GAAG,IAAI,EAAE,UAAU,IAAI,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;QAC7F,IAAI,IAAI,GAAG,QAAQ,CAAC;QACpB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;YAClD,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;gBAC9B,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE;oBACzC,MAAM,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM;oBAC7C,UAAU;iBACX,CAAC,CAAC;gBACH,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;gBACd,OAAO,GAAG,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC;gBAC/B,YAAY,GAAG,YAAY,IAAI,CAAC,CAAC,KAAK,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;QACD,sEAAsE;QACtE,0EAA0E;QAC1E,qDAAqD;QACrD,IAAI,YAAY,IAAI,qBAAqB,CAAC,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC;YAC5F,MAAM,qBAAqB,EAAE,CAAC;QAChC,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QAElD,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QACtD,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;QACrE,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAE3C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACrC,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,KAAK,CAAC,QAAQ,CACZ,WAAmB,EACnB,IAAgB,EAChB,aAAqB,EACrB,SAAoB,EACpB,IAAW;IACX,2EAA2E;IAC3E,IAAkC;QAElC,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QACpC,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;QAEpF,MAAM,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;QAChD,0EAA0E;QAC1E,2EAA2E;QAC3E,MAAM,UAAU,GAAG,IAAI,EAAE,UAAU,IAAI,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;QAC7F,IAAI,qBAAqB,CAAC,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC;YAC5E,MAAM,qBAAqB,EAAE,CAAC;QAChC,CAAC;QACD,yEAAyE;QACzE,wEAAwE;QACxE,2BAA2B;QAC3B,IACE,SAAS,CAAC,IAAI,KAAK,MAAM;YACzB,gBAAgB,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC;YAC3C,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,mBAAmB,CAAC,WAAW,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,EAC5E,CAAC;YACD,MAAM,qBAAqB,EAAE,CAAC;QAChC,CAAC;QACD,IAAI,IAAI,GAAG,QAAQ,CAAC;QACpB,IAAI,CAAC;YACH,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;gBAC5B,wEAAwE;gBACxE,sDAAsD;gBACtD,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE;oBACtC,MAAM,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM;oBAC7C,UAAU;iBACX,CAAC,CAAC,IAAI,CAAC;gBACR,wCAAwC;gBACxC,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC;YAC1H,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;QAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,uFAAuF;YACvF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QACtC,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QACtD,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;QACrE,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAE3C,wEAAwE;QACxE,wEAAwE;QACxE,yEAAyE;QACzE,0EAA0E;QAC1E,uEAAuE;QACvE,wEAAwE;QACxE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,uBAAuB,CACjD,WAAW,EACX,IAAI,EACJ,aAAa,EACb,SAAS,EACT,IAAI,EACJ,UAAU,CACX,CAAC;QACF,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,WAAW,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;YACzE,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YAC3C,MAAM,IAAI,mBAAmB,CAC3B,4GAA4G,EAC5G,GAAG,EACH,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAC7B,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACrC,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACK,KAAK,CAAC,uBAAuB,CACnC,WAAmB,EACnB,IAAgB,EAChB,aAAqB,EACrB,SAAoB,EACpB,IAAW,EACX,UAAuB;QAEvB,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC;YAC9B,MAAM,KAAK,GAAyC;gBAClD,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,aAAa,CAAC;gBACzE,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,EAAE,aAAa,CAAC;gBAC3E,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,EAAE,aAAa,CAAC;gBACjF,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,EAAE,aAAa,CAAC;aAC5E,CAAC;YACF,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;YAC1C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAChE,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CACnD,WAAW,EACX,IAAI,EACJ,aAAa,EACb,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,EACtC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS,CACxC,CAAC;QACF,OAAO,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9E,CAAC;IAED;;;;;;OAMG;IACK,mBAAmB,CAAC,SAAoB;QAC9C,IAAI,CAAC;YACH,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAEO,eAAe,CAAC,GAAY;QAClC,IAAI,GAAG,YAAY,mBAAmB;YAAE,OAAO,GAAG,CAAC;QACnD,IAAI,GAAG,YAAY,iBAAiB;YAAE,OAAO,IAAI,mBAAmB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACvF,OAAO,IAAI,mBAAmB,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;IAC9F,CAAC;CACF"}

package/dist/modules/access/access-view.d.ts

@@ -0,0 +1,147 @@
+import type { AccessDecisionSource, AccessTargetKind, GrantSource, HolderList, IAccessControl, ResolvedPrincipal } from './access-control.interface.js';
+import { type Verb } from '../access-model/access-grammar.js';
+/**
+ * The resolved access view of one target, as the Manage access dialog reads it
+ * (`GET /api/workspace/:id/access`): the caller's four verdicts, the eligible
+ * principals per verb, and per-principal, per-verb grant sources. Shared by
+ * that route and by `file_stat`'s access roster, so both list the same people.
+ */
+export declare function resolveAccessView(accessControl: IAccessControl, workspaceId: string, repoRelTarget: string, userEmail: string, kind: AccessTargetKind): Promise<{
+    canRead: boolean;
+    canWrite: boolean;
+    canDownload: boolean;
+    canOwner: boolean;
+    eligible: {
+        principals?: ResolvedPrincipal[];
+        roles: string[];
+        users: {
+            name: string;
+            email: string;
+        }[];
+    };
+    readers: {
+        restricted: boolean;
+        principals?: ResolvedPrincipal[];
+        roles: string[];
+        users: {
+            name: string;
+            email: string;
+        }[];
+        publicVia?: string[];
+    };
+    owners: {
+        principals?: ResolvedPrincipal[];
+        roles: string[];
+        users: {
+            name: string;
+            email: string;
+        }[];
+    };
+    downloaders: {
+        principals?: ResolvedPrincipal[];
+        roles: string[];
+        users: {
+            name: string;
+            email: string;
+        }[];
+    };
+    sources: Record<string, Partial<Record<"read" | "write" | "download" | "owner", import("./access-control.interface.js").VerbSources>>>;
+    denials: Record<string, Partial<Record<"read" | "write" | "download" | "owner", GrantSource[]>>>;
+    deniedHere: {
+        principals: ResolvedPrincipal[];
+        users: {
+            name: string;
+            email: string;
+        }[];
+    };
+}>;
+export type AccessView = Awaited<ReturnType<typeof resolveAccessView>>;
+/**
+ * A principal as its grant names it — a group, a role, a plugin principal
+ * (`plugin/<Name>/<verb>`), or a person granted directly. The reduced
+ * {@link RosterEntry} without the sources, for consumers that only need to
+ * know WHO holds a verb: the move confirmation's before/after lists.
+ */
+export interface AccessPrincipalRef {
+    kind: 'group' | 'role' | 'plugin' | 'person';
+    name: string;
+    email?: string;
+}
+/**
+ * The principals holding one verb, in the roster's order — collectives as the
+ * resolver kinded them, then the directly granted people. An older resolver
+ * double omitting `principals` degrades to the name-only `roles` (all roles),
+ * exactly as `accessRoster` does, so the two never disagree about a name.
+ */
+export declare function holderPrincipals(list: HolderList): AccessPrincipalRef[];
+/** One principal holding one verb, with every scope that names it for that verb, closest first. */
+export interface RosterEntry {
+    kind: 'group' | 'role' | 'plugin' | 'person';
+    name: string;
+    email?: string;
+    /**
+     * Where the grant is written, closest (effective) first. Empty when the
+     * principal holds the verb without a line naming it here — the built-in
+     * `everyone` made public by a plugin, for instance.
+     */
+    sources: AccessDecisionSource[];
+}
+export type AccessRoster = Record<Verb, RosterEntry[]>;
+/**
+ * The principals per verb, as the Manage access dialog lists them — groups,
+ * roles, plugin principals, then directly granted people — each with where its
+ * grant comes from.
+ */
+export declare function accessRoster(view: AccessView, kind: AccessTargetKind, repoRelTarget: string): AccessRoster;
+/**
+ * A person named in an access list, plus whether an ACCOUNT exists for that
+ * email yet — `false` until they sign in for the first time.
+ *
+ * Under single sign-on the account is created BY that first sign-in, so a
+ * grant written ahead of time necessarily names an email with no account.
+ * That is a real use case and stays allowed: nothing anywhere gates on this
+ * flag. It exists so the share dialog can put a quiet "hasn't signed in yet"
+ * beside the chip and the row, which is what makes a mistyped address
+ * visible — and it turns true by itself the first time the person signs in,
+ * so the note goes away without anyone editing the grant.
+ */
+export interface AccessViewUser {
+    name: string;
+    email: string;
+    hasAccount: boolean;
+}
+type Labelled<L extends {
+    users: {
+        name: string;
+        email: string;
+    }[];
+}> = Omit<L, 'users'> & {
+    users: AccessViewUser[];
+};
+/** {@link AccessView} with every person carrying {@link AccessViewUser.hasAccount}. */
+export type LabelledAccessView = Omit<AccessView, 'eligible' | 'readers' | 'owners' | 'downloaders' | 'deniedHere'> & {
+    eligible: Labelled<AccessView['eligible']>;
+    readers: Labelled<AccessView['readers']>;
+    owners: Labelled<AccessView['owners']>;
+    downloaders: Labelled<AccessView['downloaders']>;
+    /**
+     * Restricted here, labelled the same way. A `deny` on a mistyped address
+     * restricts nobody and looks fine — this row is where such a typo would
+     * otherwise stay invisible.
+     */
+    deniedHere: Labelled<AccessView['deniedHere']>;
+};
+/**
+ * Every distinct email the view names, canonical (trimmed + lowercased) — the
+ * exact set to look accounts up by, and no more: the lookup is scoped to the
+ * people this one view mentions rather than reading the whole users table.
+ */
+export declare function emailsInView(view: AccessView): string[];
+/**
+ * Mark each person in the view against `accountEmails` (canonical forms, as
+ * {@link emailsInView} produces). Pure: the caller does the one database
+ * lookup, this decides nothing but the label.
+ */
+export declare function labelAccountHolders(view: AccessView, accountEmails: ReadonlySet<string>): LabelledAccessView;
+export {};
+//# sourceMappingURL=access-view.d.ts.map

package/dist/modules/access/access-view.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-view.d.ts","sourceRoot":"","sources":["../../../src/modules/access/access-view.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oBAAoB,EACpB,gBAAgB,EAEhB,WAAW,EAEX,UAAU,EACV,cAAc,EACd,iBAAiB,EAClB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAKL,KAAK,IAAI,EACV,MAAM,mCAAmC,CAAC;AAE3C;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,aAAa,EAAE,cAAc,EAC7B,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0GvB;AAED,MAAM,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC,CAAC;AAOvE;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,UAAU,GAAG,kBAAkB,EAAE,CAMvE;AAED,mGAAmG;AACnG,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,OAAO,EAAE,oBAAoB,EAAE,CAAC;CACjC;AAED,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;AAiBvD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,GAAG,YAAY,CAwB1G;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,KAAK,QAAQ,CAAC,CAAC,SAAS;IAAE,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;CAAE,IAAI,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG;IACzF,KAAK,EAAE,cAAc,EAAE,CAAC;CACzB,CAAC;AAEF,uFAAuF;AACvF,MAAM,MAAM,kBAAkB,GAAG,IAAI,CACnC,UAAU,EACV,UAAU,GAAG,SAAS,GAAG,QAAQ,GAAG,aAAa,GAAG,YAAY,CACjE,GAAG;IACF,QAAQ,EAAE,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;IAC3C,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;IACzC,MAAM,EAAE,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvC,WAAW,EAAE,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC;IACjD;;;;OAIG;IACH,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;CAChD,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,EAAE,CAcvD;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,UAAU,EAChB,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,GACjC,kBAAkB,CAgBpB"}