@brightchain/brightchain-api-lib 0.24.1 → 0.26.0

package/src/lib/auth/aclDocumentStore.js

@@ -0,0 +1,155 @@
+"use strict";
+/**
+ * ACL Document Store - stores and retrieves Write ACL documents as signed blocks.
+ *
+ * Follows the PoolACLStore pattern: each ACL document is serialized to JSON
+ * (without creatorSignature), signed with the admin's ECDSA key, and stored
+ * as a block. On retrieval, the signature is verified against the signer's
+ * public key before the document is returned.
+ *
+ * Version chaining: each update references the previous ACL block ID via
+ * `previousVersionBlockId`, forming an auditable linked list.
+ *
+ * @see Requirements 2.1, 2.2, 2.3, 2.4, 2.5, 2.6
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AclDocumentStore = void 0;
+const tslib_1 = require("tslib");
+const brightchain_lib_1 = require("@brightchain/brightchain-lib");
+const crypto = tslib_1.__importStar(require("crypto"));
+const ecdsaNodeAuthenticator_1 = require("./ecdsaNodeAuthenticator");
+/**
+ * Stores and retrieves Write ACL documents as signed blocks.
+ *
+ * Uses an in-memory Map for block storage, following the PoolACLStore
+ * pattern. Block IDs are SHA-256 hashes of the stored content.
+ *
+ * @see Requirements 2.1, 2.2, 2.3, 2.4, 2.5, 2.6
+ */
+class AclDocumentStore {
+    blocks = new Map();
+    authenticator;
+    constructor(authenticator) {
+        this.authenticator = authenticator ?? new ecdsaNodeAuthenticator_1.ECDSANodeAuthenticator();
+    }
+    /**
+     * Serialize an ACL document to JSON, sign it, and store as a block.
+     * Returns the block ID (SHA-256 hex of the stored content).
+     *
+     * The document is serialized using the shared serializeAclDocument helper
+     * (which handles Date → ISO string and Uint8Array → hex encoding).
+     * The creatorSignature field is excluded from the signed payload;
+     * the signature is stored separately in the SignedAclDocumentBlock envelope.
+     *
+     * @param doc - The ACL document to store (creatorSignature is ignored; a fresh signature is computed)
+     * @param signerPrivateKey - The admin's raw 32-byte secp256k1 private key
+     * @returns The block ID (SHA-256 hex digest)
+     * @see Requirements 2.1, 2.2, 2.3
+     */
+    async storeAclDocument(doc, signerPrivateKey) {
+        // Serialize the document (the serialization includes creatorSignature,
+        // but we strip it for signing to match the PoolACLStore pattern)
+        const docForSigning = {
+            ...doc,
+            creatorSignature: new Uint8Array(0), // zero-length placeholder for signing
+        };
+        const aclJson = (0, brightchain_lib_1.serializeAclDocument)(docForSigning);
+        const aclBytes = new TextEncoder().encode(aclJson);
+        // Sign the serialized JSON
+        const signature = await this.authenticator.signChallenge(aclBytes, signerPrivateKey);
+        // Derive the signer's public key
+        const ecdh = crypto.createECDH('secp256k1');
+        ecdh.setPrivateKey(Buffer.from(signerPrivateKey));
+        const publicKey = new Uint8Array(ecdh.getPublicKey());
+        const publicKeyHex = Buffer.from(publicKey).toString('hex');
+        const signedBlock = {
+            aclJson,
+            signatures: [
+                {
+                    publicKeyHex,
+                    signature: Buffer.from(signature).toString('hex'),
+                },
+            ],
+        };
+        const blockBytes = new TextEncoder().encode(JSON.stringify(signedBlock));
+        const blockId = this.computeBlockId(blockBytes);
+        this.blocks.set(blockId, blockBytes);
+        return blockId;
+    }
+    /**
+     * Load an ACL document from a stored block, verifying the signature.
+     * Throws if the block doesn't exist or the signature is invalid.
+     *
+     * @param blockId - The block ID to load
+     * @returns The deserialized and verified ACL document
+     * @throws AclSignatureVerificationError if signature verification fails
+     * @see Requirements 2.3, 2.4
+     */
+    async loadAclDocument(blockId) {
+        const blockBytes = this.blocks.get(blockId);
+        if (!blockBytes) {
+            throw new Error(`ACL document block not found: ${blockId}`);
+        }
+        const signedBlock = JSON.parse(new TextDecoder().decode(blockBytes));
+        if (signedBlock.signatures.length === 0) {
+            throw new brightchain_lib_1.AclSignatureVerificationError(blockId, 'ACL document block has no signatures');
+        }
+        // Verify the first signature
+        const firstSig = signedBlock.signatures[0];
+        const publicKey = new Uint8Array(Buffer.from(firstSig.publicKeyHex, 'hex'));
+        const signatureBytes = new Uint8Array(Buffer.from(firstSig.signature, 'hex'));
+        const aclBytes = new TextEncoder().encode(signedBlock.aclJson);
+        const isValid = await this.authenticator.verifySignature(aclBytes, signatureBytes, publicKey);
+        if (!isValid) {
+            throw new brightchain_lib_1.AclSignatureVerificationError(blockId, 'Signature verification failed');
+        }
+        // Deserialize the ACL document
+        const doc = (0, brightchain_lib_1.deserializeAclDocument)(signedBlock.aclJson);
+        // Attach the verified signature as the creatorSignature
+        doc.creatorSignature = signatureBytes;
+        return doc;
+    }
+    /**
+     * Update an ACL document: validates version increment, sets
+     * previousVersionBlockId to the current block ID, and stores
+     * the new version.
+     *
+     * @param currentBlockId - The block ID of the current ACL document
+     * @param updatedDoc - The updated ACL document
+     * @param signerPrivateKey - The admin's raw 32-byte secp256k1 private key
+     * @returns The new block ID
+     * @throws AclVersionConflictError if version is not strictly greater
+     * @see Requirements 2.5, 2.6
+     */
+    async updateAclDocument(currentBlockId, updatedDoc, signerPrivateKey) {
+        // Load and verify the current document
+        const currentDoc = await this.loadAclDocument(currentBlockId);
+        // Validate version increment (must be strictly greater)
+        if (updatedDoc.version <= currentDoc.version) {
+            throw new brightchain_lib_1.AclVersionConflictError(currentDoc.version, updatedDoc.version, updatedDoc.scope.dbName, updatedDoc.scope.collectionName);
+        }
+        // Set chain reference to the current block
+        const chainedDoc = {
+            ...updatedDoc,
+            previousVersionBlockId: currentBlockId,
+        };
+        return this.storeAclDocument(chainedDoc, signerPrivateKey);
+    }
+    /**
+     * Check whether a block exists in the store.
+     */
+    hasBlock(blockId) {
+        return this.blocks.has(blockId);
+    }
+    /**
+     * Compute a block ID as the SHA-256 hex digest of the content.
+     */
+    computeBlockId(content) {
+        return crypto
+            .createHash('sha256')
+            .update(Buffer.from(content))
+            .digest('hex');
+    }
+}
+exports.AclDocumentStore = AclDocumentStore;
+//# sourceMappingURL=aclDocumentStore.js.map

package/src/lib/auth/aclDocumentStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aclDocumentStore.js","sourceRoot":"","sources":["../../../../../brightchain-api-lib/src/lib/auth/aclDocumentStore.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;;AAEH,kEAMsC;AACtC,uDAAiC;AAEjC,qEAAkE;AAelE;;;;;;;GAOG;AACH,MAAa,gBAAgB;IACR,MAAM,GAAG,IAAI,GAAG,EAAsB,CAAC;IACzC,aAAa,CAAyB;IAEvD,YAAY,aAAsC;QAChD,IAAI,CAAC,aAAa,GAAG,aAAa,IAAI,IAAI,+CAAsB,EAAE,CAAC;IACrE,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,gBAAgB,CACpB,GAAiB,EACjB,gBAA4B;QAE5B,uEAAuE;QACvE,iEAAiE;QACjE,MAAM,aAAa,GAAiB;YAClC,GAAG,GAAG;YACN,gBAAgB,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,sCAAsC;SAC5E,CAAC;QACF,MAAM,OAAO,GAAG,IAAA,sCAAoB,EAAC,aAAa,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAEnD,2BAA2B;QAC3B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CACtD,QAAQ,EACR,gBAAgB,CACjB,CAAC;QAEF,iCAAiC;QACjC,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAC5C,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAClD,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;QACtD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAE5D,MAAM,WAAW,GAA2B;YAC1C,OAAO;YACP,UAAU,EAAE;gBACV;oBACE,YAAY;oBACZ,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;iBAClD;aACF;SACF,CAAC;QAEF,MAAM,UAAU,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;QACzE,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAErC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,eAAe,CAAC,OAAe;QACnC,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,iCAAiC,OAAO,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,WAAW,GAA2B,IAAI,CAAC,KAAK,CACpD,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CACrC,CAAC;QAEF,IAAI,WAAW,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,+CAA6B,CACrC,OAAO,EACP,sCAAsC,CACvC,CAAC;QACJ,CAAC;QAED,6BAA6B;QAC7B,MAAM,QAAQ,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC3C,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC;QAC5E,MAAM,cAAc,GAAG,IAAI,UAAU,CACnC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,CACvC,CAAC;QACF,MAAM,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAE/D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CACtD,QAAQ,EACR,cAAc,EACd,SAAS,CACV,CAAC;QAEF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,+CAA6B,CACrC,OAAO,EACP,+BAA+B,CAChC,CAAC;QACJ,CAAC;QAED,+BAA+B;QAC/B,MAAM,GAAG,GAAG,IAAA,wCAAsB,EAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAExD,wDAAwD;QACxD,GAAG,CAAC,gBAAgB,GAAG,cAAc,CAAC;QAEtC,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,iBAAiB,CACrB,cAAsB,EACtB,UAAwB,EACxB,gBAA4B;QAE5B,uCAAuC;QACvC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC;QAE9D,wDAAwD;QACxD,IAAI,UAAU,CAAC,OAAO,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;YAC7C,MAAM,IAAI,yCAAuB,CAC/B,UAAU,CAAC,OAAO,EAClB,UAAU,CAAC,OAAO,EAClB,UAAU,CAAC,KAAK,CAAC,MAAM,EACvB,UAAU,CAAC,KAAK,CAAC,cAAc,CAChC,CAAC;QACJ,CAAC;QAED,2CAA2C;QAC3C,MAAM,UAAU,GAAiB;YAC/B,GAAG,UAAU;YACb,sBAAsB,EAAE,cAAc;SACvC,CAAC;QAEF,OAAO,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;IAC7D,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,OAAe;QACtB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAED;;OAEG;IACK,cAAc,CAAC,OAAmB;QACxC,OAAO,MAAM;aACV,UAAU,CAAC,QAAQ,CAAC;aACpB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;aAC5B,MAAM,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;CACF;AA/KD,4CA+KC"}

package/src/lib/auth/index.d.ts

@@ -1,7 +1,11 @@
+export * from './aclDocumentStore';
 export * from './aclEnforcedAvailability';
 export * from './aclEnforcedBlockStore';
 export * from './ecdsaNodeAuthenticator';
 export * from './poolAclBootstrap';
 export * from './poolAclStore';
 export { InsufficientQuorumError, PoolACLUpdater, type ACLUpdateProposal, } from './poolAclUpdater';
+export * from './writeAclApiRouter';
+export * from './writeAclAuditLogger';
+export * from './writeProofMiddleware';
 //# sourceMappingURL=index.d.ts.map

package/src/lib/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../brightchain-api-lib/src/lib/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,2BAA2B,CAAC;AAC1C,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,OAAO,EACL,uBAAuB,EACvB,cAAc,EACd,KAAK,iBAAiB,GACvB,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../brightchain-api-lib/src/lib/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,OAAO,EACL,uBAAuB,EACvB,cAAc,EACd,KAAK,iBAAiB,GACvB,MAAM,kBAAkB,CAAC;AAC1B,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,wBAAwB,CAAC"}

package/src/lib/auth/index.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PoolACLUpdater = exports.InsufficientQuorumError = void 0;
 const tslib_1 = require("tslib");
+tslib_1.__exportStar(require("./aclDocumentStore"), exports);
 tslib_1.__exportStar(require("./aclEnforcedAvailability"), exports);
 tslib_1.__exportStar(require("./aclEnforcedBlockStore"), exports);
 tslib_1.__exportStar(require("./ecdsaNodeAuthenticator"), exports);
@@ -10,4 +11,7 @@ tslib_1.__exportStar(require("./poolAclStore"), exports);
 var poolAclUpdater_1 = require("./poolAclUpdater");
 Object.defineProperty(exports, "InsufficientQuorumError", { enumerable: true, get: function () { return poolAclUpdater_1.InsufficientQuorumError; } });
 Object.defineProperty(exports, "PoolACLUpdater", { enumerable: true, get: function () { return poolAclUpdater_1.PoolACLUpdater; } });
+tslib_1.__exportStar(require("./writeAclApiRouter"), exports);
+tslib_1.__exportStar(require("./writeAclAuditLogger"), exports);
+tslib_1.__exportStar(require("./writeProofMiddleware"), exports);
 //# sourceMappingURL=index.js.map

package/src/lib/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../brightchain-api-lib/src/lib/auth/index.ts"],"names":[],"mappings":";;;;AAAA,oEAA0C;AAC1C,kEAAwC;AACxC,mEAAyC;AACzC,6DAAmC;AACnC,yDAA+B;AAC/B,mDAI0B;AAHxB,yHAAA,uBAAuB,OAAA;AACvB,gHAAA,cAAc,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../brightchain-api-lib/src/lib/auth/index.ts"],"names":[],"mappings":";;;;AAAA,6DAAmC;AACnC,oEAA0C;AAC1C,kEAAwC;AACxC,mEAAyC;AACzC,6DAAmC;AACnC,yDAA+B;AAC/B,mDAI0B;AAHxB,yHAAA,uBAAuB,OAAA;AACvB,gHAAA,cAAc,OAAA;AAGhB,8DAAoC;AACpC,gEAAsC;AACtC,iEAAuC"}

package/src/lib/auth/writeAclApiRouter.d.ts

@@ -0,0 +1,32 @@
+/**
+ * @fileoverview WriteAclApiRouter - Express router for Write ACL management endpoints.
+ *
+ * Provides REST API endpoints for managing Write ACLs, mounted alongside
+ * the existing `createDbRouter`. All mutating endpoints require
+ * `X-Acl-Admin-Signature` (hex-encoded ECDSA signature) and
+ * `X-Acl-Admin-PublicKey` headers from an ACL administrator.
+ *
+ * @see BrightDB Write ACLs design, WriteAclApiRouter section
+ * @see Requirements 9.1, 9.2, 9.3, 9.4, 9.5, 9.6
+ */
+import type { IAclDocument, ICapabilityToken, IWriteAclAuditLogger, IWriteAclService } from '@brightchain/brightchain-lib';
+import { Router } from 'express';
+/**
+ * Interface for the ACL manager operations needed by the router.
+ * Extends IWriteAclService with mutation methods.
+ */
+export interface IWriteAclApiManager extends IWriteAclService {
+    setAcl(aclDoc: IAclDocument, adminSignature: Uint8Array, adminPublicKey: Uint8Array): Promise<string>;
+    addWriter(dbName: string, collectionName: string | undefined, writerPublicKey: Uint8Array, adminSignature: Uint8Array, adminPublicKey: Uint8Array): Promise<string>;
+    removeWriter(dbName: string, collectionName: string | undefined, writerPublicKey: Uint8Array, adminSignature: Uint8Array, adminPublicKey: Uint8Array): Promise<string>;
+    issueCapabilityToken(token: ICapabilityToken, adminSignature: Uint8Array): Promise<ICapabilityToken>;
+}
+/**
+ * Factory function that creates an Express router for Write ACL management.
+ *
+ * @param aclManager - The WriteAclManager (or any IWriteAclApiManager) to delegate to
+ * @param auditLogger - Optional WriteAclAuditLogger for logging ACL events
+ * @returns An Express Router with ACL management endpoints
+ */
+export declare function createWriteAclApiRouter(aclManager: IWriteAclApiManager, auditLogger?: IWriteAclAuditLogger): Router;
+//# sourceMappingURL=writeAclApiRouter.d.ts.map

package/src/lib/auth/writeAclApiRouter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"writeAclApiRouter.d.ts","sourceRoot":"","sources":["../../../../../brightchain-api-lib/src/lib/auth/writeAclApiRouter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,gBAAgB,EAChB,oBAAoB,EACpB,gBAAgB,EACjB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAqB,MAAM,EAAE,MAAM,SAAS,CAAC;AAEpD;;;GAGG;AACH,MAAM,WAAW,mBAAoB,SAAQ,gBAAgB;IAC3D,MAAM,CACJ,MAAM,EAAE,YAAY,EACpB,cAAc,EAAE,UAAU,EAC1B,cAAc,EAAE,UAAU,GACzB,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,SAAS,CACP,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,eAAe,EAAE,UAAU,EAC3B,cAAc,EAAE,UAAU,EAC1B,cAAc,EAAE,UAAU,GACzB,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,YAAY,CACV,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,eAAe,EAAE,UAAU,EAC3B,cAAc,EAAE,UAAU,EAC1B,cAAc,EAAE,UAAU,GACzB,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,oBAAoB,CAClB,KAAK,EAAE,gBAAgB,EACvB,cAAc,EAAE,UAAU,GACzB,OAAO,CAAC,gBAAgB,CAAC,CAAC;CAC9B;AAyCD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,mBAAmB,EAC/B,WAAW,CAAC,EAAE,oBAAoB,GACjC,MAAM,CA2WR"}

package/src/lib/auth/writeAclApiRouter.js

@@ -0,0 +1,348 @@
+"use strict";
+/**
+ * @fileoverview WriteAclApiRouter - Express router for Write ACL management endpoints.
+ *
+ * Provides REST API endpoints for managing Write ACLs, mounted alongside
+ * the existing `createDbRouter`. All mutating endpoints require
+ * `X-Acl-Admin-Signature` (hex-encoded ECDSA signature) and
+ * `X-Acl-Admin-PublicKey` headers from an ACL administrator.
+ *
+ * @see BrightDB Write ACLs design, WriteAclApiRouter section
+ * @see Requirements 9.1, 9.2, 9.3, 9.4, 9.5, 9.6
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createWriteAclApiRouter = createWriteAclApiRouter;
+const express_1 = require("express");
+/**
+ * Extract and validate admin credentials from request headers.
+ * Returns the admin signature and public key as Uint8Arrays, or
+ * sends HTTP 403 and returns undefined.
+ */
+function extractAdminCredentials(req, res) {
+    const signatureHex = req.headers['x-acl-admin-signature'];
+    const publicKeyHex = req.headers['x-acl-admin-publickey'];
+    if (!signatureHex || !publicKeyHex) {
+        res.status(403).json({
+            error: 'Missing admin credentials',
+            message: 'X-Acl-Admin-Signature and X-Acl-Admin-PublicKey headers are required for this operation',
+        });
+        return undefined;
+    }
+    try {
+        const adminSignature = Uint8Array.from(Buffer.from(signatureHex, 'hex'));
+        const adminPublicKey = Uint8Array.from(Buffer.from(publicKeyHex, 'hex'));
+        return { adminSignature, adminPublicKey };
+    }
+    catch {
+        res.status(403).json({
+            error: 'Invalid admin credentials',
+            message: 'X-Acl-Admin-Signature and X-Acl-Admin-PublicKey must be valid hex-encoded values',
+        });
+        return undefined;
+    }
+}
+/**
+ * Factory function that creates an Express router for Write ACL management.
+ *
+ * @param aclManager - The WriteAclManager (or any IWriteAclApiManager) to delegate to
+ * @param auditLogger - Optional WriteAclAuditLogger for logging ACL events
+ * @returns An Express Router with ACL management endpoints
+ */
+function createWriteAclApiRouter(aclManager, auditLogger) {
+    const router = (0, express_1.Router)();
+    // ─── GET endpoints: Retrieve current Write_ACL ──────────────────────
+    /** GET /acl/:dbName — Get database-level Write_ACL. @see Requirement 9.1 */
+    router.get('/acl/:dbName', (req, res) => {
+        try {
+            const dbName = req.params['dbName'];
+            const aclDoc = aclManager.getAclDocument(dbName);
+            if (!aclDoc) {
+                res.status(404).json({
+                    error: 'ACL not found',
+                    message: `No Write_ACL configured for database "${dbName}"`,
+                });
+                return;
+            }
+            res.json(serializeAclForResponse(aclDoc));
+        }
+        catch (error) {
+            res.status(500).json({ error: error.message });
+        }
+    });
+    /** GET /acl/:dbName/:collectionName — Get collection-level Write_ACL. @see Requirement 9.1 */
+    router.get('/acl/:dbName/:collectionName', (req, res) => {
+        try {
+            const dbName = req.params['dbName'];
+            const collectionName = req.params['collectionName'];
+            const aclDoc = aclManager.getAclDocument(dbName, collectionName);
+            if (!aclDoc) {
+                res.status(404).json({
+                    error: 'ACL not found',
+                    message: `No Write_ACL configured for "${dbName}/${collectionName}"`,
+                });
+                return;
+            }
+            res.json(serializeAclForResponse(aclDoc));
+        }
+        catch (error) {
+            res.status(500).json({ error: error.message });
+        }
+    });
+    // ─── PUT endpoints: Set/update Write_ACL ────────────────────────────
+    /** PUT /acl/:dbName — Set/update database-level Write_ACL. @see Requirements 9.2, 9.6 */
+    router.put('/acl/:dbName', async (req, res) => {
+        const credentials = extractAdminCredentials(req, res);
+        if (!credentials)
+            return;
+        try {
+            const dbName = req.params['dbName'];
+            const aclDoc = parseAclFromRequest(req.body, dbName);
+            const key = await aclManager.setAcl(aclDoc, credentials.adminSignature, credentials.adminPublicKey);
+            if (auditLogger) {
+                auditLogger.logAclModification(Buffer.from(credentials.adminPublicKey).toString('hex'), 'setAcl', 'database', dbName);
+            }
+            res.json({ success: true, key });
+        }
+        catch (error) {
+            handleAclError(error, res);
+        }
+    });
+    /** PUT /acl/:dbName/:collectionName — Set/update collection-level Write_ACL. @see Requirements 9.2, 9.6 */
+    router.put('/acl/:dbName/:collectionName', async (req, res) => {
+        const credentials = extractAdminCredentials(req, res);
+        if (!credentials)
+            return;
+        try {
+            const dbName = req.params['dbName'];
+            const collectionName = req.params['collectionName'];
+            const aclDoc = parseAclFromRequest(req.body, dbName, collectionName);
+            const key = await aclManager.setAcl(aclDoc, credentials.adminSignature, credentials.adminPublicKey);
+            if (auditLogger) {
+                auditLogger.logAclModification(Buffer.from(credentials.adminPublicKey).toString('hex'), 'setAcl', 'collection', dbName, collectionName);
+            }
+            res.json({ success: true, key });
+        }
+        catch (error) {
+            handleAclError(error, res);
+        }
+    });
+    // ─── POST endpoints: Add authorized writer ──────────────────────────
+    /** POST /acl/:dbName/writers — Add an Authorized_Writer (database). @see Requirements 9.3, 9.6 */
+    router.post('/acl/:dbName/writers', async (req, res) => {
+        const credentials = extractAdminCredentials(req, res);
+        if (!credentials)
+            return;
+        try {
+            const dbName = req.params['dbName'];
+            const writerPublicKeyHex = req.body?.publicKeyHex;
+            if (!writerPublicKeyHex) {
+                res
+                    .status(400)
+                    .json({ error: 'Missing publicKeyHex in request body' });
+                return;
+            }
+            const writerPublicKey = Uint8Array.from(Buffer.from(writerPublicKeyHex, 'hex'));
+            const key = await aclManager.addWriter(dbName, undefined, writerPublicKey, credentials.adminSignature, credentials.adminPublicKey);
+            if (auditLogger) {
+                auditLogger.logAclModification(Buffer.from(credentials.adminPublicKey).toString('hex'), 'addWriter', writerPublicKeyHex, dbName);
+            }
+            res.json({ success: true, key });
+        }
+        catch (error) {
+            handleAclError(error, res);
+        }
+    });
+    /** POST /acl/:dbName/:collectionName/writers — Add an Authorized_Writer (collection). @see Requirements 9.3, 9.6 */
+    router.post('/acl/:dbName/:collectionName/writers', async (req, res) => {
+        const credentials = extractAdminCredentials(req, res);
+        if (!credentials)
+            return;
+        try {
+            const dbName = req.params['dbName'];
+            const collectionName = req.params['collectionName'];
+            const writerPublicKeyHex = req.body?.publicKeyHex;
+            if (!writerPublicKeyHex) {
+                res
+                    .status(400)
+                    .json({ error: 'Missing publicKeyHex in request body' });
+                return;
+            }
+            const writerPublicKey = Uint8Array.from(Buffer.from(writerPublicKeyHex, 'hex'));
+            const key = await aclManager.addWriter(dbName, collectionName, writerPublicKey, credentials.adminSignature, credentials.adminPublicKey);
+            if (auditLogger) {
+                auditLogger.logAclModification(Buffer.from(credentials.adminPublicKey).toString('hex'), 'addWriter', writerPublicKeyHex, dbName, collectionName);
+            }
+            res.json({ success: true, key });
+        }
+        catch (error) {
+            handleAclError(error, res);
+        }
+    });
+    // ─── DELETE endpoints: Remove authorized writer ─────────────────────
+    /** DELETE /acl/:dbName/writers/:publicKeyHex — Remove an Authorized_Writer (database). @see Requirements 9.4, 9.6 */
+    router.delete('/acl/:dbName/writers/:publicKeyHex', async (req, res) => {
+        const credentials = extractAdminCredentials(req, res);
+        if (!credentials)
+            return;
+        try {
+            const dbName = req.params['dbName'];
+            const publicKeyHex = req.params['publicKeyHex'];
+            const writerPublicKey = Uint8Array.from(Buffer.from(publicKeyHex, 'hex'));
+            const key = await aclManager.removeWriter(dbName, undefined, writerPublicKey, credentials.adminSignature, credentials.adminPublicKey);
+            if (auditLogger) {
+                auditLogger.logAclModification(Buffer.from(credentials.adminPublicKey).toString('hex'), 'removeWriter', publicKeyHex, dbName);
+            }
+            res.json({ success: true, key });
+        }
+        catch (error) {
+            handleAclError(error, res);
+        }
+    });
+    /** DELETE /acl/:dbName/:collectionName/writers/:publicKeyHex — Remove an Authorized_Writer (collection). @see Requirements 9.4, 9.6 */
+    router.delete('/acl/:dbName/:collectionName/writers/:publicKeyHex', async (req, res) => {
+        const credentials = extractAdminCredentials(req, res);
+        if (!credentials)
+            return;
+        try {
+            const dbName = req.params['dbName'];
+            const collectionName = req.params['collectionName'];
+            const publicKeyHex = req.params['publicKeyHex'];
+            const writerPublicKey = Uint8Array.from(Buffer.from(publicKeyHex, 'hex'));
+            const key = await aclManager.removeWriter(dbName, collectionName, writerPublicKey, credentials.adminSignature, credentials.adminPublicKey);
+            if (auditLogger) {
+                auditLogger.logAclModification(Buffer.from(credentials.adminPublicKey).toString('hex'), 'removeWriter', publicKeyHex, dbName, collectionName);
+            }
+            res.json({ success: true, key });
+        }
+        catch (error) {
+            handleAclError(error, res);
+        }
+    });
+    // ─── POST endpoints: Issue capability token ─────────────────────────
+    /** POST /acl/:dbName/tokens — Issue a Capability_Token (database). @see Requirements 9.5, 9.6 */
+    router.post('/acl/:dbName/tokens', async (req, res) => {
+        const credentials = extractAdminCredentials(req, res);
+        if (!credentials)
+            return;
+        try {
+            const dbName = req.params['dbName'];
+            const token = parseCapabilityTokenFromRequest(req.body, dbName);
+            const issuedToken = await aclManager.issueCapabilityToken(token, credentials.adminSignature);
+            if (auditLogger) {
+                auditLogger.logCapabilityTokenIssued(Buffer.from(token.granteePublicKey).toString('hex'), token.scope, token.expiresAt, Buffer.from(credentials.adminPublicKey).toString('hex'));
+            }
+            res.json({
+                success: true,
+                token: serializeTokenForResponse(issuedToken),
+            });
+        }
+        catch (error) {
+            handleAclError(error, res);
+        }
+    });
+    /** POST /acl/:dbName/:collectionName/tokens — Issue a Capability_Token (collection). @see Requirements 9.5, 9.6 */
+    router.post('/acl/:dbName/:collectionName/tokens', async (req, res) => {
+        const credentials = extractAdminCredentials(req, res);
+        if (!credentials)
+            return;
+        try {
+            const dbName = req.params['dbName'];
+            const collectionName = req.params['collectionName'];
+            const token = parseCapabilityTokenFromRequest(req.body, dbName, collectionName);
+            const issuedToken = await aclManager.issueCapabilityToken(token, credentials.adminSignature);
+            if (auditLogger) {
+                auditLogger.logCapabilityTokenIssued(Buffer.from(token.granteePublicKey).toString('hex'), token.scope, token.expiresAt, Buffer.from(credentials.adminPublicKey).toString('hex'));
+            }
+            res.json({
+                success: true,
+                token: serializeTokenForResponse(issuedToken),
+            });
+        }
+        catch (error) {
+            handleAclError(error, res);
+        }
+    });
+    return router;
+}
+// ─── Helper functions ───────────────────────────────────────────────
+/** Map known ACL error types to appropriate HTTP status codes. */
+function handleAclError(error, res) {
+    const name = error.constructor.name;
+    if (name === 'AclAdminRequiredError' ||
+        name === 'CapabilityTokenInvalidError' ||
+        name === 'CapabilityTokenExpiredError' ||
+        name === 'AclSignatureVerificationError') {
+        res.status(403).json({ error: name, message: error.message });
+        return;
+    }
+    if (name === 'AclVersionConflictError') {
+        res.status(409).json({ error: name, message: error.message });
+        return;
+    }
+    if (name === 'LastAdministratorError' || name === 'WriterNotInPoolError') {
+        res.status(400).json({ error: name, message: error.message });
+        return;
+    }
+    res.status(500).json({ error: 'InternalError', message: error.message });
+}
+/** Parse an ACL document from a request body, injecting scope from URL params. */
+function parseAclFromRequest(body, dbName, collectionName) {
+    return {
+        documentId: body['documentId'] ?? '',
+        writeMode: body['writeMode'],
+        authorizedWriters: (body['authorizedWriters'] ?? []).map((hex) => Uint8Array.from(Buffer.from(hex, 'hex'))),
+        aclAdministrators: (body['aclAdministrators'] ?? []).map((hex) => Uint8Array.from(Buffer.from(hex, 'hex'))),
+        scope: { dbName, collectionName },
+        version: body['version'] ?? 1,
+        createdAt: body['createdAt']
+            ? new Date(body['createdAt'])
+            : new Date(),
+        updatedAt: body['updatedAt']
+            ? new Date(body['updatedAt'])
+            : new Date(),
+        creatorPublicKey: body['creatorPublicKey']
+            ? Uint8Array.from(Buffer.from(body['creatorPublicKey'], 'hex'))
+            : new Uint8Array(0),
+        creatorSignature: body['creatorSignature']
+            ? Uint8Array.from(Buffer.from(body['creatorSignature'], 'hex'))
+            : new Uint8Array(0),
+        previousVersionBlockId: body['previousVersionBlockId'],
+    };
+}
+/** Parse a capability token from a request body, injecting scope from URL params. */
+function parseCapabilityTokenFromRequest(body, dbName, collectionName) {
+    return {
+        granteePublicKey: Uint8Array.from(Buffer.from(body['granteePublicKey'] ?? '', 'hex')),
+        scope: { dbName, collectionName },
+        expiresAt: new Date(body['expiresAt'] ?? new Date().toISOString()),
+        grantorSignature: Uint8Array.from(Buffer.from(body['grantorSignature'] ?? '', 'hex')),
+        grantorPublicKey: Uint8Array.from(Buffer.from(body['grantorPublicKey'] ?? '', 'hex')),
+    };
+}
+/** Serialize an ACL document for JSON response (Uint8Array → hex strings). */
+function serializeAclForResponse(aclDoc) {
+    return {
+        documentId: aclDoc.documentId,
+        writeMode: aclDoc.writeMode,
+        authorizedWriters: aclDoc.authorizedWriters.map((w) => Buffer.from(w).toString('hex')),
+        aclAdministrators: aclDoc.aclAdministrators.map((a) => Buffer.from(a).toString('hex')),
+        scope: aclDoc.scope,
+        version: aclDoc.version,
+        createdAt: aclDoc.createdAt.toISOString(),
+        updatedAt: aclDoc.updatedAt.toISOString(),
+        creatorPublicKey: Buffer.from(aclDoc.creatorPublicKey).toString('hex'),
+        creatorSignature: Buffer.from(aclDoc.creatorSignature).toString('hex'),
+        previousVersionBlockId: aclDoc.previousVersionBlockId,
+    };
+}
+/** Serialize a capability token for JSON response (Uint8Array → hex strings). */
+function serializeTokenForResponse(token) {
+    return {
+        granteePublicKey: Buffer.from(token.granteePublicKey).toString('hex'),
+        scope: token.scope,
+        expiresAt: token.expiresAt.toISOString(),
+        grantorSignature: Buffer.from(token.grantorSignature).toString('hex'),
+        grantorPublicKey: Buffer.from(token.grantorPublicKey).toString('hex'),
+    };
+}
+//# sourceMappingURL=writeAclApiRouter.js.map

package/src/lib/auth/writeAclApiRouter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"writeAclApiRouter.js","sourceRoot":"","sources":["../../../../../brightchain-api-lib/src/lib/auth/writeAclApiRouter.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;AAsFH,0DA8WC;AA5bD,qCAAoD;AAgCpD;;;;GAIG;AACH,SAAS,uBAAuB,CAC9B,GAAY,EACZ,GAAa;IAEb,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,uBAAuB,CAE3C,CAAC;IACd,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,uBAAuB,CAE3C,CAAC;IAEd,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY,EAAE,CAAC;QACnC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,2BAA2B;YAClC,OAAO,EACL,yFAAyF;SAC5F,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC;QACzE,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC;QACzE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,2BAA2B;YAClC,OAAO,EACL,kFAAkF;SACrF,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,uBAAuB,CACrC,UAA+B,EAC/B,WAAkC;IAElC,MAAM,MAAM,GAAG,IAAA,gBAAM,GAAE,CAAC;IAExB,uEAAuE;IAEvE,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,GAAY,EAAE,GAAa,EAAQ,EAAE;QAC/D,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAW,CAAC;YAC9C,MAAM,MAAM,GAAG,UAAU,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;YACjD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,eAAe;oBACtB,OAAO,EAAE,yCAAyC,MAAM,GAAG;iBAC5D,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,8FAA8F;IAC9F,MAAM,CAAC,GAAG,CACR,8BAA8B,EAC9B,CAAC,GAAY,EAAE,GAAa,EAAQ,EAAE;QACpC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAW,CAAC;YAC9C,MAAM,cAAc,GAAG,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAW,CAAC;YAC9D,MAAM,MAAM,GAAG,UAAU,CAAC,cAAc,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;YACjE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,eAAe;oBACtB,OAAO,EAAE,gCAAgC,MAAM,IAAI,cAAc,GAAG;iBACrE,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC,CACF,CAAC;IAEF,uEAAuE;IAEvE,yFAAyF;IACzF,MAAM,CAAC,GAAG,CACR,cAAc,EACd,KAAK,EAAE,GAAY,EAAE,GAAa,EAAiB,EAAE;QACnD,MAAM,WAAW,GAAG,uBAAuB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACtD,IAAI,CAAC,WAAW;YAAE,OAAO;QAEzB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAW,CAAC;YAC9C,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACrD,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,MAAM,CACjC,MAAM,EACN,WAAW,CAAC,cAAc,EAC1B,WAAW,CAAC,cAAc,CAC3B,CAAC;YAEF,IAAI,WAAW,EAAE,CAAC;gBAChB,WAAW,CAAC,kBAAkB,CAC5B,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EACvD,QAAQ,EACR,UAAU,EACV,MAAM,CACP,CAAC;YACJ,CAAC;YAED,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,cAAc,CAAC,KAAc,EAAE,GAAG,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CACF,CAAC;IAEF,2GAA2G;IAC3G,MAAM,CAAC,GAAG,CACR,8BAA8B,EAC9B,KAAK,EAAE,GAAY,EAAE,GAAa,EAAiB,EAAE;QACnD,MAAM,WAAW,GAAG,uBAAuB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACtD,IAAI,CAAC,WAAW;YAAE,OAAO;QAEzB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAW,CAAC;YAC9C,MAAM,cAAc,GAAG,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAW,CAAC;YAC9D,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;YACrE,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,MAAM,CACjC,MAAM,EACN,WAAW,CAAC,cAAc,EAC1B,WAAW,CAAC,cAAc,CAC3B,CAAC;YAEF,IAAI,WAAW,EAAE,CAAC;gBAChB,WAAW,CAAC,kBAAkB,CAC5B,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EACvD,QAAQ,EACR,YAAY,EACZ,MAAM,EACN,cAAc,CACf,CAAC;YACJ,CAAC;YAED,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,cAAc,CAAC,KAAc,EAAE,GAAG,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CACF,CAAC;IAEF,uEAAuE;IAEvE,kGAAkG;IAClG,MAAM,CAAC,IAAI,CACT,sBAAsB,EACtB,KAAK,EAAE,GAAY,EAAE,GAAa,EAAiB,EAAE;QACnD,MAAM,WAAW,GAAG,uBAAuB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACtD,IAAI,CAAC,WAAW;YAAE,OAAO;QAEzB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAW,CAAC;YAC9C,MAAM,kBAAkB,GAAG,GAAG,CAAC,IAAI,EAAE,YAAsB,CAAC;YAC5D,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACxB,GAAG;qBACA,MAAM,CAAC,GAAG,CAAC;qBACX,IAAI,CAAC,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC,CAAC;gBAC3D,OAAO;YACT,CAAC;YACD,MAAM,eAAe,GAAG,UAAU,CAAC,IAAI,CACrC,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,CAAC,CACvC,CAAC;YAEF,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,SAAS,CACpC,MAAM,EACN,SAAS,EACT,eAAe,EACf,WAAW,CAAC,cAAc,EAC1B,WAAW,CAAC,cAAc,CAC3B,CAAC;YAEF,IAAI,WAAW,EAAE,CAAC;gBAChB,WAAW,CAAC,kBAAkB,CAC5B,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EACvD,WAAW,EACX,kBAAkB,EAClB,MAAM,CACP,CAAC;YACJ,CAAC;YAED,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,cAAc,CAAC,KAAc,EAAE,GAAG,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CACF,CAAC;IAEF,oHAAoH;IACpH,MAAM,CAAC,IAAI,CACT,sCAAsC,EACtC,KAAK,EAAE,GAAY,EAAE,GAAa,EAAiB,EAAE;QACnD,MAAM,WAAW,GAAG,uBAAuB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACtD,IAAI,CAAC,WAAW;YAAE,OAAO;QAEzB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAW,CAAC;YAC9C,MAAM,cAAc,GAAG,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAW,CAAC;YAC9D,MAAM,kBAAkB,GAAG,GAAG,CAAC,IAAI,EAAE,YAAsB,CAAC;YAC5D,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACxB,GAAG;qBACA,MAAM,CAAC,GAAG,CAAC;qBACX,IAAI,CAAC,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC,CAAC;gBAC3D,OAAO;YACT,CAAC;YACD,MAAM,eAAe,GAAG,UAAU,CAAC,IAAI,CACrC,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,CAAC,CACvC,CAAC;YAEF,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,SAAS,CACpC,MAAM,EACN,cAAc,EACd,eAAe,EACf,WAAW,CAAC,cAAc,EAC1B,WAAW,CAAC,cAAc,CAC3B,CAAC;YAEF,IAAI,WAAW,EAAE,CAAC;gBAChB,WAAW,CAAC,kBAAkB,CAC5B,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EACvD,WAAW,EACX,kBAAkB,EAClB,MAAM,EACN,cAAc,CACf,CAAC;YACJ,CAAC;YAED,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,cAAc,CAAC,KAAc,EAAE,GAAG,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CACF,CAAC;IAEF,uEAAuE;IAEvE,qHAAqH;IACrH,MAAM,CAAC,MAAM,CACX,oCAAoC,EACpC,KAAK,EAAE,GAAY,EAAE,GAAa,EAAiB,EAAE;QACnD,MAAM,WAAW,GAAG,uBAAuB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACtD,IAAI,CAAC,WAAW;YAAE,OAAO;QAEzB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAW,CAAC;YAC9C,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,cAAc,CAAW,CAAC;YAC1D,MAAM,eAAe,GAAG,UAAU,CAAC,IAAI,CACrC,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CACjC,CAAC;YAEF,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,YAAY,CACvC,MAAM,EACN,SAAS,EACT,eAAe,EACf,WAAW,CAAC,cAAc,EAC1B,WAAW,CAAC,cAAc,CAC3B,CAAC;YAEF,IAAI,WAAW,EAAE,CAAC;gBAChB,WAAW,CAAC,kBAAkB,CAC5B,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EACvD,cAAc,EACd,YAAY,EACZ,MAAM,CACP,CAAC;YACJ,CAAC;YAED,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,cAAc,CAAC,KAAc,EAAE,GAAG,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CACF,CAAC;IAEF,uIAAuI;IACvI,MAAM,CAAC,MAAM,CACX,oDAAoD,EACpD,KAAK,EAAE,GAAY,EAAE,GAAa,EAAiB,EAAE;QACnD,MAAM,WAAW,GAAG,uBAAuB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACtD,IAAI,CAAC,WAAW;YAAE,OAAO;QAEzB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAW,CAAC;YAC9C,MAAM,cAAc,GAAG,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAW,CAAC;YAC9D,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,cAAc,CAAW,CAAC;YAC1D,MAAM,eAAe,GAAG,UAAU,CAAC,IAAI,CACrC,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CACjC,CAAC;YAEF,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,YAAY,CACvC,MAAM,EACN,cAAc,EACd,eAAe,EACf,WAAW,CAAC,cAAc,EAC1B,WAAW,CAAC,cAAc,CAC3B,CAAC;YAEF,IAAI,WAAW,EAAE,CAAC;gBAChB,WAAW,CAAC,kBAAkB,CAC5B,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EACvD,cAAc,EACd,YAAY,EACZ,MAAM,EACN,cAAc,CACf,CAAC;YACJ,CAAC;YAED,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,cAAc,CAAC,KAAc,EAAE,GAAG,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CACF,CAAC;IAEF,uEAAuE;IAEvE,iGAAiG;IACjG,MAAM,CAAC,IAAI,CACT,qBAAqB,EACrB,KAAK,EAAE,GAAY,EAAE,GAAa,EAAiB,EAAE;QACnD,MAAM,WAAW,GAAG,uBAAuB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACtD,IAAI,CAAC,WAAW;YAAE,OAAO;QAEzB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAW,CAAC;YAC9C,MAAM,KAAK,GAAG,+BAA+B,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAEhE,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,oBAAoB,CACvD,KAAK,EACL,WAAW,CAAC,cAAc,CAC3B,CAAC;YAEF,IAAI,WAAW,EAAE,CAAC;gBAChB,WAAW,CAAC,wBAAwB,CAClC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EACnD,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,SAAS,EACf,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CACxD,CAAC;YACJ,CAAC;YAED,GAAG,CAAC,IAAI,CAAC;gBACP,OAAO,EAAE,IAAI;gBACb,KAAK,EAAE,yBAAyB,CAAC,WAAW,CAAC;aAC9C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,cAAc,CAAC,KAAc,EAAE,GAAG,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CACF,CAAC;IAEF,mHAAmH;IACnH,MAAM,CAAC,IAAI,CACT,qCAAqC,EACrC,KAAK,EAAE,GAAY,EAAE,GAAa,EAAiB,EAAE;QACnD,MAAM,WAAW,GAAG,uBAAuB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACtD,IAAI,CAAC,WAAW;YAAE,OAAO;QAEzB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAW,CAAC;YAC9C,MAAM,cAAc,GAAG,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAW,CAAC;YAC9D,MAAM,KAAK,GAAG,+BAA+B,CAC3C,GAAG,CAAC,IAAI,EACR,MAAM,EACN,cAAc,CACf,CAAC;YAEF,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,oBAAoB,CACvD,KAAK,EACL,WAAW,CAAC,cAAc,CAC3B,CAAC;YAEF,IAAI,WAAW,EAAE,CAAC;gBAChB,WAAW,CAAC,wBAAwB,CAClC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EACnD,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,SAAS,EACf,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CACxD,CAAC;YACJ,CAAC;YAED,GAAG,CAAC,IAAI,CAAC;gBACP,OAAO,EAAE,IAAI;gBACb,KAAK,EAAE,yBAAyB,CAAC,WAAW,CAAC;aAC9C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,cAAc,CAAC,KAAc,EAAE,GAAG,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CACF,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,uEAAuE;AAEvE,kEAAkE;AAClE,SAAS,cAAc,CAAC,KAAY,EAAE,GAAa;IACjD,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC;IACpC,IACE,IAAI,KAAK,uBAAuB;QAChC,IAAI,KAAK,6BAA6B;QACtC,IAAI,KAAK,6BAA6B;QACtC,IAAI,KAAK,+BAA+B,EACxC,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9D,OAAO;IACT,CAAC;IACD,IAAI,IAAI,KAAK,yBAAyB,EAAE,CAAC;QACvC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9D,OAAO;IACT,CAAC;IACD,IAAI,IAAI,KAAK,wBAAwB,IAAI,IAAI,KAAK,sBAAsB,EAAE,CAAC;QACzE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9D,OAAO;IACT,CAAC;IACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,kFAAkF;AAClF,SAAS,mBAAmB,CAC1B,IAA6B,EAC7B,MAAc,EACd,cAAuB;IAEvB,OAAO;QACL,UAAU,EAAG,IAAI,CAAC,YAAY,CAAY,IAAI,EAAE;QAChD,SAAS,EAAE,IAAI,CAAC,WAAW,CAA8B;QACzD,iBAAiB,EAAE,CAAE,IAAI,CAAC,mBAAmB,CAAc,IAAI,EAAE,CAAC,CAAC,GAAG,CACpE,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAClD;QACD,iBAAiB,EAAE,CAAE,IAAI,CAAC,mBAAmB,CAAc,IAAI,EAAE,CAAC,CAAC,GAAG,CACpE,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAClD;QACD,KAAK,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE;QACjC,OAAO,EAAG,IAAI,CAAC,SAAS,CAAY,IAAI,CAAC;QACzC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC;YAC1B,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,CAAW,CAAC;YACvC,CAAC,CAAC,IAAI,IAAI,EAAE;QACd,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC;YAC1B,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,CAAW,CAAC;YACvC,CAAC,CAAC,IAAI,IAAI,EAAE;QACd,gBAAgB,EAAE,IAAI,CAAC,kBAAkB,CAAC;YACxC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAW,EAAE,KAAK,CAAC,CAAC;YACzE,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC;QACrB,gBAAgB,EAAE,IAAI,CAAC,kBAAkB,CAAC;YACxC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAW,EAAE,KAAK,CAAC,CAAC;YACzE,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC;QACrB,sBAAsB,EAAE,IAAI,CAAC,wBAAwB,CAExC;KACd,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,SAAS,+BAA+B,CACtC,IAA6B,EAC7B,MAAc,EACd,cAAuB;IAEvB,OAAO;QACL,gBAAgB,EAAE,UAAU,CAAC,IAAI,CAC/B,MAAM,CAAC,IAAI,CAAE,IAAI,CAAC,kBAAkB,CAAY,IAAI,EAAE,EAAE,KAAK,CAAC,CAC/D;QACD,KAAK,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE;QACjC,SAAS,EAAE,IAAI,IAAI,CAChB,IAAI,CAAC,WAAW,CAAY,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAC1D;QACD,gBAAgB,EAAE,UAAU,CAAC,IAAI,CAC/B,MAAM,CAAC,IAAI,CAAE,IAAI,CAAC,kBAAkB,CAAY,IAAI,EAAE,EAAE,KAAK,CAAC,CAC/D;QACD,gBAAgB,EAAE,UAAU,CAAC,IAAI,CAC/B,MAAM,CAAC,IAAI,CAAE,IAAI,CAAC,kBAAkB,CAAY,IAAI,EAAE,EAAE,KAAK,CAAC,CAC/D;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,SAAS,uBAAuB,CAC9B,MAAoB;IAEpB,OAAO;QACL,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACpD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAC/B;QACD,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACpD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAC/B;QACD,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE;QACzC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE;QACzC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QACtE,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QACtE,sBAAsB,EAAE,MAAM,CAAC,sBAAsB;KACtD,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,SAAS,yBAAyB,CAChC,KAAuB;IAEvB,OAAO;QACL,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QACrE,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE;QACxC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QACrE,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;KACtE,CAAC;AACJ,CAAC"}