@caelo-cms/provisioning 0.10.59 → 0.10.61

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (13) hide show
  1. package/dist/infra-contract.d.ts +1 -1
  2. package/dist/infra-contract.d.ts.map +1 -1
  3. package/dist/infra-contract.js +10 -1
  4. package/dist/infra-contract.js.map +1 -1
  5. package/dist/operator-access.d.ts +11 -0
  6. package/dist/operator-access.d.ts.map +1 -1
  7. package/dist/operator-access.js +44 -17
  8. package/dist/operator-access.js.map +1 -1
  9. package/package.json +2 -2
  10. package/src/infra-contract.test.ts +4 -3
  11. package/src/infra-contract.ts +10 -1
  12. package/src/operator-access.test.ts +56 -4
  13. package/src/operator-access.ts +45 -16
package/dist/infra-contract.d.ts CHANGED
@@ -20,7 +20,7 @@
20
20
  * whose app-roll references infrastructure an install does not have yet fails
21
21
  * at roll time, after migrations ran.
22
22
  */
23
- export declare const INFRA_CONTRACT_VERSION = 11;
23
+ export declare const INFRA_CONTRACT_VERSION = 12;
24
24
  /**
25
25
  * What each contract version adds, in operator terms — the upgrader's
26
26
  * refusal names the steps an install is missing. Keep one entry per version
package/dist/infra-contract.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"infra-contract.d.ts","sourceRoot":"","sources":["../src/infra-contract.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAgEzC;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAYjE,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAM7E;AAED,uEAAuE;AACvE,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAExE"}
1
+ {"version":3,"file":"infra-contract.d.ts","sourceRoot":"","sources":["../src/infra-contract.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAwEzC;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAajE,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAM7E;AAED,uEAAuE;AACvE,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAExE"}
package/dist/infra-contract.js CHANGED
@@ -21,7 +21,7 @@
21
21
  * whose app-roll references infrastructure an install does not have yet fails
22
22
  * at roll time, after migrations ran.
23
23
  */
24
- export const INFRA_CONTRACT_VERSION = 11;
24
+ export const INFRA_CONTRACT_VERSION = 12;
25
25
  // History (why each bump happened — an install below a number needs the
26
26
  // converge that introduced it):
27
27
  // 1 — epic #696 split: converge vs app-roll.
@@ -83,6 +83,14 @@ export const INFRA_CONTRACT_VERSION = 11;
83
83
  // new env var; the admin gets CAELO_ADMIN_URL and the project's
84
84
  // organisation domain. A new secret, new IAM and a job redeploy —
85
85
  // nothing the in-cloud upgrader may do.
86
+ // 12 — #914 follow-up (#597 PR): Google applies a custom OAuth client
87
+ // for Cloud Run IAP, and programmatic clients, only at project level
88
+ // or above — the admin's own IAP resource refused them with HTTP 400.
89
+ // The operator-access job now sets them in the project's IAP settings,
90
+ // so its SA gets the new custom role `caeloOperatorAccessIapProject`
91
+ // (`iap.projects.getSettings` / `updateSettings`) on the project. New
92
+ // IAM the in-cloud upgrader cannot grant; without it the new job image
93
+ // fails every Google sign-in sync with 403.
86
94
  /**
87
95
  * What each contract version adds, in operator terms — the upgrader's
88
96
  * refusal names the steps an install is missing. Keep one entry per version
@@ -100,6 +108,7 @@ export const INFRA_CONTRACT_STEPS = {
100
108
  9: "the converge job that installs cloud-setup changes from Settings → Updates, and a narrower Cloud Run role for the upgrader (#819)",
101
109
  10: "remote MCP: the OAuth client and seal-key secrets, their IAM, the gateway's secret file and timeout, IAP programmatic-client sync and the load-balancer rules (#806)",
102
110
  11: "Google sign-in: the renamed sign-in client secret, its IAM and mounts, the operator-access job's read access to it, and the admin's URL and organisation domain (#914)",
111
+ 12: "Google sign-in at project level: the operator-access job's permission to set the sign-in client in the project's IAP settings (#914)",
103
112
  };
104
113
  /**
105
114
  * The steps an install at contract `installed` lacks for `target`, oldest
package/dist/infra-contract.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"infra-contract.js","sourceRoot":"","sources":["../src/infra-contract.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAEzC,wEAAwE;AACxE,gCAAgC;AAChC,+CAA+C;AAC/C,sEAAsE;AACtE,2EAA2E;AAC3E,wEAAwE;AACxE,0EAA0E;AAC1E,6EAA6E;AAC7E,yEAAyE;AACzE,eAAe;AACf,0EAA0E;AAC1E,8DAA8D;AAC9D,6EAA6E;AAC7E,qEAAqE;AACrE,2EAA2E;AAC3E,6DAA6D;AAC7D,gEAAgE;AAChE,8EAA8E;AAC9E,yEAAyE;AACzE,wEAAwE;AACxE,4BAA4B;AAC5B,2EAA2E;AAC3E,2EAA2E;AAC3E,4EAA4E;AAC5E,0EAA0E;AAC1E,4EAA4E;AAC5E,wCAAwC;AACxC,4EAA4E;AAC5E,wDAAwD;AACxD,0EAA0E;AAC1E,6EAA6E;AAC7E,oEAAoE;AACpE,+EAA+E;AAC/E,2EAA2E;AAC3E,0EAA0E;AAC1E,mEAAmE;AACnE,2EAA2E;AAC3E,2EAA2E;AAC3E,wEAAwE;AACxE,4EAA4E;AAC5E,yEAAyE;AACzE,yEAAyE;AACzE,yEAAyE;AACzE,6DAA6D;AAC7D,6EAA6E;AAC7E,uEAAuE;AACvE,4EAA4E;AAC5E,yEAAyE;AACzE,wEAAwE;AACxE,0EAA0E;AAC1E,0EAA0E;AAC1E,uEAAuE;AACvE,2EAA2E;AAC3E,2EAA2E;AAC3E,4EAA4E;AAC5E,sEAAsE;AACtE,yEAAyE;AACzE,2EAA2E;AAC3E,sEAAsE;AACtE,wEAAwE;AACxE,8CAA8C;AAE9C;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAqC;IACpE,CAAC,EAAE,6BAA6B;IAChC,CAAC,EAAE,sDAAsD;IACzD,CAAC,EAAE,yDAAyD;IAC5D,CAAC,EAAE,yEAAyE;IAC5E,CAAC,EAAE,mEAAmE;IACtE,CAAC,EAAE,yDAAyD;IAC5D,CAAC,EAAE,wEAAwE;IAC3E,CAAC,EAAE,8EAA8E;IACjF,CAAC,EAAE,mIAAmI;IACtI,EAAE,EAAE,sKAAsK;IAC1K,EAAE,EAAE,wKAAwK;CAC7K,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAiB,EAAE,MAAc;IACjE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7D,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,uBAAuB,CAAC,6BAA6B,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,cAAc,CAAC,SAAiB,EAAE,MAAc;IAC9D,OAAO,iBAAiB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzD,CAAC"}
1
+ {"version":3,"file":"infra-contract.js","sourceRoot":"","sources":["../src/infra-contract.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAEzC,wEAAwE;AACxE,gCAAgC;AAChC,+CAA+C;AAC/C,sEAAsE;AACtE,2EAA2E;AAC3E,wEAAwE;AACxE,0EAA0E;AAC1E,6EAA6E;AAC7E,yEAAyE;AACzE,eAAe;AACf,0EAA0E;AAC1E,8DAA8D;AAC9D,6EAA6E;AAC7E,qEAAqE;AACrE,2EAA2E;AAC3E,6DAA6D;AAC7D,gEAAgE;AAChE,8EAA8E;AAC9E,yEAAyE;AACzE,wEAAwE;AACxE,4BAA4B;AAC5B,2EAA2E;AAC3E,2EAA2E;AAC3E,4EAA4E;AAC5E,0EAA0E;AAC1E,4EAA4E;AAC5E,wCAAwC;AACxC,4EAA4E;AAC5E,wDAAwD;AACxD,0EAA0E;AAC1E,6EAA6E;AAC7E,oEAAoE;AACpE,+EAA+E;AAC/E,2EAA2E;AAC3E,0EAA0E;AAC1E,mEAAmE;AACnE,2EAA2E;AAC3E,2EAA2E;AAC3E,wEAAwE;AACxE,4EAA4E;AAC5E,yEAAyE;AACzE,yEAAyE;AACzE,yEAAyE;AACzE,6DAA6D;AAC7D,6EAA6E;AAC7E,uEAAuE;AACvE,4EAA4E;AAC5E,yEAAyE;AACzE,wEAAwE;AACxE,0EAA0E;AAC1E,0EAA0E;AAC1E,uEAAuE;AACvE,2EAA2E;AAC3E,2EAA2E;AAC3E,4EAA4E;AAC5E,sEAAsE;AACtE,yEAAyE;AACzE,2EAA2E;AAC3E,sEAAsE;AACtE,wEAAwE;AACxE,8CAA8C;AAC9C,uEAAuE;AACvE,2EAA2E;AAC3E,4EAA4E;AAC5E,6EAA6E;AAC7E,2EAA2E;AAC3E,4EAA4E;AAC5E,6EAA6E;AAC7E,kDAAkD;AAElD;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAqC;IACpE,CAAC,EAAE,6BAA6B;IAChC,CAAC,EAAE,sDAAsD;IACzD,CAAC,EAAE,yDAAyD;IAC5D,CAAC,EAAE,yEAAyE;IAC5E,CAAC,EAAE,mEAAmE;IACtE,CAAC,EAAE,yDAAyD;IAC5D,CAAC,EAAE,wEAAwE;IAC3E,CAAC,EAAE,8EAA8E;IACjF,CAAC,EAAE,mIAAmI;IACtI,EAAE,EAAE,sKAAsK;IAC1K,EAAE,EAAE,wKAAwK;IAC5K,EAAE,EAAE,sIAAsI;CAC3I,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAiB,EAAE,MAAc;IACjE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7D,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,uBAAuB,CAAC,6BAA6B,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,cAAc,CAAC,SAAiB,EAAE,MAAc;IAC9D,OAAO,iBAAiB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzD,CAAC"}
package/dist/operator-access.d.ts CHANGED
@@ -11,6 +11,17 @@ export interface CustomRoleSpec {
11
11
  }
12
12
  /** The only IAM-writing rights in this feature, held by the sync job's SA alone. */
13
13
  export declare const OPERATOR_ACCESS_ROLE: CustomRoleSpec;
14
+ /**
15
+ * #914 — the project-level IAP settings, where the job sets the Google
16
+ * sign-in client (`oauthSettings`). Google applies a custom OAuth client for
17
+ * Cloud Run IAP, and programmatic clients, only at project level or above
18
+ * (admin-core security/operator-access/iap-settings.ts). A separate role
19
+ * because it is bound on the PROJECT: `caeloOperatorAccess` there would
20
+ * reach every IAP resource's IAM policy. `iap.projects.*Settings` cover the
21
+ * project-level settings only, no lower level and no IAM policy
22
+ * (roles/iap.settingsAdmin lists the permission per level).
23
+ */
24
+ export declare const OPERATOR_ACCESS_PROJECT_IAP_ROLE: CustomRoleSpec;
14
25
  /** `projects/<project>/roles/<roleId>` — the name IAM bindings reference. */
15
26
  export declare function customRoleName(projectId: string, roleId: string): string;
16
27
  /**
package/dist/operator-access.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"operator-access.d.ts","sourceRoot":"","sources":["../src/operator-access.ts"],"names":[],"mappings":"AA8CA,OAAO,EAA2B,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,KAAK,YAAY,EAA2B,KAAK,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAW3F,OAAO,EAAE,KAAK,WAAW,EAAmB,MAAM,cAAc,CAAC;AAGjE,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;AAErD,sFAAsF;AACtF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;CACzC;AAED,oFAAoF;AACpF,eAAO,MAAM,oBAAoB,EAAE,cAkBlC,CAAC;AAKF,6EAA6E;AAC7E,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAExE;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,CAEhE;AAED,wDAAwD;AACxD,eAAO,MAAM,uBAAuB,2BAA2B,CAAC;AAKhE,2EAA2E;AAC3E,wBAAgB,UAAU,CAAC,QAAQ,EAAE,WAAW,GAAG,MAAM,CAIxD;AAED,+EAA+E;AAC/E,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,GAAG,EACR,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAuCxB;AAUD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wCAAwC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,yDAAyD;IACzD,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,0DAA0D;IAC1D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,0DAA0D;IAC1D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACzC;AAED,mFAAmF;AACnF,eAAO,MAAM,eAAe,sCAAsC,CAAC;AAEnE,gFAAgF;AAChF,eAAO,MAAM,gCAAgC,uCAAuC,CAAC;AAErF,mFAAmF;AACnF,eAAO,MAAM,mCAAmC,uCAAuC,CAAC;AAExF,MAAM,MAAM,wBAAwB,GAChC;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,GAC9C;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5E,sGAAsG;AACtG,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,wBAAwB,EAChC,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAO,GAC/C,OAAO,CAAC,wBAAwB,CAAC,CA0QnC;AAED;;;;;GAKG;AACH,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE;IACJ,QAAQ,CAAC,QAAQ,EAAE,KAAK,GAAG,cAAc,CAAC;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B,EACD,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAA;CAAO,GAChC,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,wBAAwB,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAmFxF"}
1
+ {"version":3,"file":"operator-access.d.ts","sourceRoot":"","sources":["../src/operator-access.ts"],"names":[],"mappings":"AAkDA,OAAO,EAA2B,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,KAAK,YAAY,EAA2B,KAAK,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAW3F,OAAO,EAAE,KAAK,WAAW,EAAmB,MAAM,cAAc,CAAC;AAGjE,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;AAErD,sFAAsF;AACtF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;CACzC;AAED,oFAAoF;AACpF,eAAO,MAAM,oBAAoB,EAAE,cAkBlC,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,gCAAgC,EAAE,cAM9C,CAAC;AAKF,6EAA6E;AAC7E,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAExE;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,CAEhE;AAED,wDAAwD;AACxD,eAAO,MAAM,uBAAuB,2BAA2B,CAAC;AAKhE,2EAA2E;AAC3E,wBAAgB,UAAU,CAAC,QAAQ,EAAE,WAAW,GAAG,MAAM,CAIxD;AAED,+EAA+E;AAC/E,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,GAAG,EACR,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAuCxB;AAUD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wCAAwC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,yDAAyD;IACzD,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,0DAA0D;IAC1D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,0DAA0D;IAC1D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACzC;AAED,mFAAmF;AACnF,eAAO,MAAM,eAAe,sCAAsC,CAAC;AAEnE,gFAAgF;AAChF,eAAO,MAAM,gCAAgC,uCAAuC,CAAC;AAErF,mFAAmF;AACnF,eAAO,MAAM,mCAAmC,uCAAuC,CAAC;AAExF,MAAM,MAAM,wBAAwB,GAChC;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,GAC9C;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5E,sGAAsG;AACtG,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,wBAAwB,EAChC,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAO,GAC/C,OAAO,CAAC,wBAAwB,CAAC,CAiRnC;AAED;;;;;GAKG;AACH,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE;IACJ,QAAQ,CAAC,QAAQ,EAAE,KAAK,GAAG,cAAc,CAAC;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B,EACD,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAA;CAAO,GAChC,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,wBAAwB,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAmFxF"}
package/dist/operator-access.js CHANGED
@@ -6,8 +6,9 @@
6
6
  *
7
7
  * Trust boundary. Who may pass the admin's IAP gate and sign as `caelo-mcp`
8
8
  * follows the Caelo user list; which OAuth client IAP signs people in with
9
- * and accepts programmatically (IAP `oauthSettings`: browser client, its
10
- * secret and `programmaticClients`, #914) follows the Google sign-in client
9
+ * and accepts programmatically (the project's IAP `oauthSettings`: browser
10
+ * client, its secret and `programmaticClients`, #914) follows the Google
11
+ * sign-in client
11
12
  * the Owner configured under Settings → Google sign-in. The admin does NOT
12
13
  * write that: its runtime service account holds no IAM-policy rights. A Cloud Run job with its own
13
14
  * service account (admin-core security/operator-access/sync-job.ts) is the
@@ -21,10 +22,13 @@
21
22
  *
22
23
  * What this ensures, every step idempotent:
23
24
  * 1. the Cloud Scheduler API;
24
- * 2. the custom role `caeloOperatorAccess` (get/setIamPolicy, and
25
- * get/updateSettings for `oauthSettings`);
26
- * 3. the job's service account, bound to that role on exactly the admin's
27
- * IAP resource and the `caelo-mcp` service account, `secretAccessor`
25
+ * 2. the custom roles `caeloOperatorAccess` (get/setIamPolicy, and
26
+ * get/updateSettings on a web service) and `caeloOperatorAccessIapProject`
27
+ * (get/updateSettings of the project's IAP settings, where Google
28
+ * applies a custom OAuth client — admin-core iap-settings.ts);
29
+ * 3. the job's service account, bound to `caeloOperatorAccess` on exactly
30
+ * the admin's IAP resource and the `caelo-mcp` service account, to
31
+ * `caeloOperatorAccessIapProject` on the project, `secretAccessor`
28
32
  * on exactly the Google sign-in client's secret (#914: IAP needs the
29
33
  * client secret too), plus `cloudsql.instanceUser` +
30
34
  * `logging.logWriter`;
@@ -55,17 +59,33 @@ export const OPERATOR_ACCESS_ROLE = {
55
59
  permissions: [
56
60
  "iap.webServices.getIamPolicy",
57
61
  "iap.webServices.setIamPolicy",
58
- // #914 — the admin IAP resource's `oauthSettings` (the install's Google
59
- // sign-in client). IAP settings permissions per resource level:
60
- // cloud.google.com/iap/docs/customizing ("Web Services": getSettings /
61
- // updateSettings); the role is bound on exactly the admin's IAP web
62
- // service, so it reaches no other resource's settings.
62
+ // #914 — the admin IAP resource's own `oauthSettings`, which the job
63
+ // keeps empty so the project's Google sign-in client applies (a client
64
+ // there would override it). IAP settings permissions per resource level:
65
+ // roles/iap.settingsAdmin; the role is bound on exactly the admin's IAP
66
+ // web service, so it reaches no other resource's settings.
63
67
  "iap.webServices.getSettings",
64
68
  "iap.webServices.updateSettings",
65
69
  "iam.serviceAccounts.getIamPolicy",
66
70
  "iam.serviceAccounts.setIamPolicy",
67
71
  ],
68
72
  };
73
+ /**
74
+ * #914 — the project-level IAP settings, where the job sets the Google
75
+ * sign-in client (`oauthSettings`). Google applies a custom OAuth client for
76
+ * Cloud Run IAP, and programmatic clients, only at project level or above
77
+ * (admin-core security/operator-access/iap-settings.ts). A separate role
78
+ * because it is bound on the PROJECT: `caeloOperatorAccess` there would
79
+ * reach every IAP resource's IAM policy. `iap.projects.*Settings` cover the
80
+ * project-level settings only, no lower level and no IAM policy
81
+ * (roles/iap.settingsAdmin lists the permission per level).
82
+ */
83
+ export const OPERATOR_ACCESS_PROJECT_IAP_ROLE = {
84
+ roleId: "caeloOperatorAccessIapProject",
85
+ title: "Caelo operator access: project IAP settings",
86
+ description: "Lets the Caelo operator-access sync job set which OAuth client IAP signs people in with and accepts programmatically (the install's Google sign-in client) in the project's IAP settings. Bound only on the project, only to the job's service account.",
87
+ permissions: ["iap.projects.getSettings", "iap.projects.updateSettings"],
88
+ };
69
89
  /** Custom role an earlier revision bound to the admin run SA on `gcp`; its binding is removed. */
70
90
  const LEGACY_LOOKUP_ROLE_ID = "caeloAdminIapLookup";
71
91
  /** `projects/<project>/roles/<roleId>` — the name IAM bindings reference. */
@@ -172,11 +192,13 @@ export async function ensureOperatorAccessSync(target, deps = {}) {
172
192
  if (!api.ok)
173
193
  return fail("enable cloudscheduler.googleapis.com", api);
174
194
  done.push("Cloud Scheduler API enabled");
175
- // 2. The custom role.
176
- const roleError = await ensureCustomRole(run, projectId, OPERATOR_ACCESS_ROLE);
177
- if (roleError)
178
- return { ok: false, done, error: roleError };
179
- done.push(`custom role ${OPERATOR_ACCESS_ROLE.roleId}`);
195
+ // 2. The custom roles.
196
+ for (const role of [OPERATOR_ACCESS_ROLE, OPERATOR_ACCESS_PROJECT_IAP_ROLE]) {
197
+ const roleError = await ensureCustomRole(run, projectId, role);
198
+ if (roleError)
199
+ return { ok: false, done, error: roleError };
200
+ done.push(`custom role ${role.roleId}`);
201
+ }
180
202
  // 3. The job's own service account and its grants.
181
203
  const saDescribe = await run([
182
204
  "iam",
@@ -241,7 +263,12 @@ export async function ensureOperatorAccessSync(target, deps = {}) {
241
263
  if (!accessor.ok)
242
264
  return fail(`grant the job read access to ${clientSecret}`, accessor);
243
265
  done.push(`job: ${OPERATOR_OAUTH_CLIENT_ACCESSOR_ROLE} on ${clientSecret}`);
244
- for (const role of ["roles/cloudsql.instanceUser", "roles/logging.logWriter"]) {
266
+ for (const role of [
267
+ // #914 — the project's IAP settings: the Google sign-in client.
268
+ customRoleName(projectId, OPERATOR_ACCESS_PROJECT_IAP_ROLE.roleId),
269
+ "roles/cloudsql.instanceUser",
270
+ "roles/logging.logWriter",
271
+ ]) {
245
272
  const r = await retry([
246
273
  "projects",
247
274
  "add-iam-policy-binding",
package/dist/operator-access.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"operator-access.js","sourceRoot":"","sources":["../src/operator-access.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,MAAM,IAAI,aAAa,EAAqB,MAAM,aAAa,CAAC;AACzE,OAAO,EAAqB,SAAS,EAAE,YAAY,EAAc,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EACL,aAAa,EACb,WAAW,EACX,yBAAyB,EACzB,qBAAqB,EACrB,0BAA0B,EAC1B,iCAAiC,EACjC,8BAA8B,EAC9B,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAoB,eAAe,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,iCAAiC,EAAE,MAAM,qBAAqB,CAAC;AAYxE,oFAAoF;AACpF,MAAM,CAAC,MAAM,oBAAoB,GAAmB;IAClD,MAAM,EAAE,qBAAqB;IAC7B,KAAK,EAAE,uBAAuB;IAC9B,WAAW,EACT,0RAA0R;IAC5R,WAAW,EAAE;QACX,8BAA8B;QAC9B,8BAA8B;QAC9B,wEAAwE;QACxE,gEAAgE;QAChE,uEAAuE;QACvE,oEAAoE;QACpE,uDAAuD;QACvD,6BAA6B;QAC7B,gCAAgC;QAChC,kCAAkC;QAClC,kCAAkC;KACnC;CACF,CAAC;AAEF,kGAAkG;AAClG,MAAM,qBAAqB,GAAG,qBAAqB,CAAC;AAEpD,6EAA6E;AAC7E,MAAM,UAAU,cAAc,CAAC,SAAiB,EAAE,MAAc;IAC9D,OAAO,YAAY,SAAS,UAAU,MAAM,EAAE,CAAC;AACjD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAAkB;IACpD,OAAO,CAAC,QAAQ,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,wDAAwD;AACxD,MAAM,CAAC,MAAM,uBAAuB,GAAG,wBAAwB,CAAC;AAEhE,yDAAyD;AACzD,MAAM,eAAe,GAAG,mEAAmE,CAAC;AAE5F,2EAA2E;AAC3E,MAAM,UAAU,UAAU,CAAC,QAAqB;IAC9C,OAAO,QAAQ,CAAC,IAAI,KAAK,WAAW;QAClC,CAAC,CAAC,aAAa,QAAQ,CAAC,MAAM,aAAa,QAAQ,CAAC,OAAO,EAAE;QAC7D,CAAC,CAAC,oBAAoB,QAAQ,CAAC,OAAO,EAAE,CAAC;AAC7C,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAQ,EACR,SAAiB,EACjB,IAAoB;IAEpB,MAAM,OAAO,GAAG,aAAa,SAAS,EAAE,CAAC;IACzC,MAAM,WAAW,GAAG,iBAAiB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAClE,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC;IAChG,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;YACvB,KAAK;YACL,OAAO;YACP,QAAQ;YACR,IAAI,CAAC,MAAM;YACX,OAAO;YACP,WAAW,IAAI,CAAC,KAAK,EAAE;YACvB,iBAAiB,IAAI,CAAC,WAAW,EAAE;YACnC,WAAW;YACX,YAAY;YACZ,SAAS;SACV,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;IAClF,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAGzC,CAAC;IACF,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;QAC1F,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,iBAAiB,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;IACrF,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvE,IAAI,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;QACvB,KAAK;QACL,OAAO;QACP,QAAQ;QACR,IAAI,CAAC,MAAM;QACX,OAAO;QACP,WAAW;QACX,SAAS;KACV,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;AAClF,CAAC;AAED,mFAAmF;AACnF,SAAS,SAAS,CAAC,UAAkB,EAAE,IAAY,EAAE,MAAc;IACjE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,IAAI,CAElD,CAAC;IACF,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AACpG,CAAC;AAyBD,mFAAmF;AACnF,MAAM,CAAC,MAAM,eAAe,GAAG,mCAAmC,CAAC;AAEnE,gFAAgF;AAChF,MAAM,CAAC,MAAM,gCAAgC,GAAG,oCAAoC,CAAC;AAErF,mFAAmF;AACnF,MAAM,CAAC,MAAM,mCAAmC,GAAG,oCAAoC,CAAC;AAMxF,sGAAsG;AACtG,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAgC,EAChC,OAA8C,EAAE;IAEhD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;IACtC,MAAM,KAAK,GAAG,CAAC,IAAc,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACjE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;IAC1C,MAAM,OAAO,GAAG,aAAa,SAAS,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,iCAAiC,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,kBAAkB,KAAK,EAAE,CAAC;IAC5C,MAAM,WAAW,GAAG,kBAAkB,sBAAsB,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC;IAC/E,MAAM,KAAK,GAAG,yBAAyB,CAAC,SAAS,CAAC,CAAC;IACnD,MAAM,UAAU,GAAG,cAAc,CAAC,SAAS,EAAE,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,CAAe,EAA4B,EAAE,CAAC,CAAC;QACzE,EAAE,EAAE,KAAK;QACT,IAAI;QACJ,KAAK,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;KACrC,CAAC,CAAC;IAEH,wDAAwD;IACxD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC;QACpB,UAAU;QACV,QAAQ;QACR,+BAA+B;QAC/B,OAAO;QACP,SAAS;KACV,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,sCAAsC,EAAE,GAAG,CAAC,CAAC;IACtE,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAEzC,sBAAsB;IACtB,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/E,IAAI,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC5D,IAAI,CAAC,IAAI,CAAC,eAAe,oBAAoB,CAAC,MAAM,EAAE,CAAC,CAAC;IAExD,mDAAmD;IACnD,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC;QAC3B,KAAK;QACL,kBAAkB;QAClB,UAAU;QACV,KAAK;QACL,OAAO;QACP,uBAAuB;KACxB,CAAC,CAAC;IACH,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;YACvB,KAAK;YACL,kBAAkB;YAClB,QAAQ;YACR,8BAA8B,CAAC,GAAG,CAAC;YACnC,2CAA2C;YAC3C,oHAAoH;YACpH,OAAO;SACR,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YACtD,OAAO,IAAI,CAAC,UAAU,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,mBAAmB,KAAK,EAAE,CAAC,CAAC;IAEtC,MAAM,SAAS,GAAuC;QACpD;YACE,IAAI,EAAE,GAAG,oBAAoB,CAAC,MAAM,8BAA8B;YAClE,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;SACpF;QACD;YACE,IAAI,EAAE,GAAG,oBAAoB,CAAC,MAAM,OAAO,KAAK,EAAE;YAClD,IAAI,EAAE,CAAC,KAAK,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,KAAK,CAAC;SACnE;KACF,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC;YACpB,GAAG,CAAC,CAAC,IAAI;YACT,YAAY,SAAS,EAAE;YACvB,UAAU,UAAU,EAAE;YACtB,kBAAkB;YAClB,OAAO;YACP,SAAS;YACT,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC;IACD,yEAAyE;IACzE,gEAAgE;IAChE,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC;QAC3B,SAAS;QACT,wBAAwB;QACxB,YAAY;QACZ,YAAY,SAAS,EAAE;QACvB,UAAU,mCAAmC,EAAE;QAC/C,kBAAkB;QAClB,OAAO;QACP,SAAS;QACT,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,gCAAgC,YAAY,EAAE,EAAE,QAAQ,CAAC,CAAC;IACxF,IAAI,CAAC,IAAI,CAAC,QAAQ,mCAAmC,OAAO,YAAY,EAAE,CAAC,CAAC;IAC5E,KAAK,MAAM,IAAI,IAAI,CAAC,6BAA6B,EAAE,yBAAyB,CAAC,EAAE,CAAC;QAC9E,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC;YACpB,UAAU;YACV,wBAAwB;YACxB,SAAS;YACT,YAAY,SAAS,EAAE;YACvB,UAAU,IAAI,EAAE;YAChB,kBAAkB;YAClB,SAAS;YACT,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,iBAAiB,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,iBAAiB,CAAC,CAAC;IAC3C,CAAC;IAED,qEAAqE;IACrE,uDAAuD;IACvD,MAAM,MAAM,GAAsE;QAChF;YACE,IAAI,EAAE,0BAA0B;YAChC,GAAG,EAAE;gBACH,KAAK;gBACL,KAAK;gBACL,gBAAgB;gBAChB,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC;gBACnC,OAAO;gBACP,eAAe;aAChB;YACD,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACxF,IAAI,EAAE,UAAU;SACjB;QACD;YACE,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,CAAC,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,CAAC;YACnF,MAAM,EAAE,CAAC,KAAK,EAAE,kBAAkB,EAAE,2BAA2B,EAAE,KAAK,CAAC;YACvE,IAAI,EAAE,UAAU;SACjB;QACD;YACE,IAAI,EAAE,aAAa;YACnB,GAAG,EAAE,CAAC,UAAU,EAAE,gBAAgB,EAAE,SAAS,EAAE,eAAe,CAAC;YAC/D,MAAM,EAAE,CAAC,UAAU,EAAE,2BAA2B,EAAE,SAAS,CAAC;YAC5D,IAAI,EAAE,cAAc,CAAC,SAAS,EAAE,qBAAqB,CAAC;SACvD;KACF,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,0BAA0B,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;QACxE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC;YAAE,SAAS;QAC7D,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC;YACpB,GAAG,CAAC,CAAC,MAAM;YACX,YAAY,WAAW,EAAE;YACzB,UAAU,CAAC,CAAC,IAAI,EAAE;YAClB,OAAO;YACP,OAAO;YACP,SAAS;YACT,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,sBAAsB,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QACvE,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,wDAAwD;IACxD,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE;QAC/C,SAAS;QACT,GAAG;QACH,mBAAmB,EAAE,KAAK;QAC1B,YAAY,EAAE,uBAAuB;KACtC,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;IAElE,0EAA0E;IAC1E,2DAA2D;IAC3D,MAAM,OAAO,GAAG;QACd,iCAAiC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE;QAC9D,iCAAiC,KAAK,EAAE;QACxC,wCAAwC,mBAAmB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QAC1F,iCAAiC,MAAM,CAAC,YAAY,EAAE;QACtD,GAAG,gCAAgC,IAAI,iCAAiC,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE;QAC1F,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;YACnD,CAAC,CAAC,CAAC,GAAG,eAAe,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACvD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;QACvB,KAAK;QACL,MAAM;QACN,QAAQ;QACR,OAAO;QACP,WAAW,MAAM,CAAC,QAAQ,EAAE;QAC5B,YAAY,MAAM,EAAE;QACpB,OAAO;QACP,qBAAqB,KAAK,EAAE;QAC5B,aAAa,MAAM,CAAC,OAAO,EAAE;QAC7B,YAAY,MAAM,CAAC,MAAM,EAAE;QAC3B,kCAAkC;QAClC,eAAe;QACf,gBAAgB,eAAe,EAAE;QACjC,6EAA6E;QAC7E,qBAAqB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACxC,iBAAiB;QACjB,mBAAmB;QACnB,SAAS;KACV,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,cAAc,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;IAC7D,IAAI,CAAC,IAAI,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC;IAE5B,MAAM,MAAM,GAAoD;QAC9D;YACE,MAAM,EAAE,WAAW;YACnB,IAAI,EAAE,wBAAwB;YAC9B,GAAG,EAAE,yCAAyC;SAC/C;QACD,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,gCAAgC,EAAE;QACxF;YACE,MAAM,EAAE,SAAS;YACjB,IAAI,EAAE,wBAAwB;YAC9B,GAAG,EAAE,kDAAkD;SACxD;KACF,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC;YACpB,KAAK;YACL,MAAM;YACN,wBAAwB;YACxB,OAAO;YACP,YAAY,MAAM,EAAE;YACpB,OAAO;YACP,YAAY,CAAC,CAAC,MAAM,EAAE;YACtB,UAAU,CAAC,CAAC,IAAI,EAAE;YAClB,SAAS;YACT,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,OAAO,OAAO,KAAK,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC;QACtE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,IAAI,OAAO,OAAO,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,QAAQ,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC;IACjD,MAAM,YAAY,GAAG;QACnB,QAAQ;QACR,cAAc,MAAM,EAAE;QACtB,OAAO;QACP,uBAAuB;QACvB,qBAAqB;QACrB,gDAAgD,SAAS,cAAc,MAAM,SAAS,OAAO,MAAM;QACnG,oBAAoB;QACpB,iCAAiC,KAAK,EAAE;QACxC,SAAS;KACV,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC;QACzB,WAAW;QACX,MAAM;QACN,UAAU;QACV,QAAQ;QACR,cAAc,MAAM,EAAE;QACtB,OAAO;QACP,sBAAsB;KACvB,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC;QACxB,WAAW;QACX,MAAM;QACN,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;QACjC,MAAM;QACN,GAAG,YAAY;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,YAAY,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC;IAC1D,IAAI,CAAC,IAAI,CAAC,mBAAmB,QAAQ,EAAE,CAAC,CAAC;IAEzC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,IAOC,EACD,OAA+B,EAAE;IAEjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,OAAO,GAAG,aAAa,IAAI,CAAC,SAAS,EAAE,CAAC;IAC9C,MAAM,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC;QACrB,KAAK;QACL,UAAU;QACV,MAAM;QACN,YAAY,IAAI,CAAC,MAAM,EAAE;QACzB,OAAO;QACP,2BAA2B,MAAM,EAAE;QACnC,+BAA+B;KAChC,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IAC5F,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,wBAAwB,MAAM,8BAA8B,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;SAC9G,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,QAAQ,CAAC,CAAC,CAAW,CAAC;IAC3C,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC;QACzB,KAAK;QACL,UAAU;QACV,UAAU;QACV,YAAY;QACZ,YAAY,IAAI,CAAC,MAAM,EAAE;QACzB,OAAO;QACP,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,YAAY,KAAK,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IACrF,CAAC;IACD,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,GAAG,YAAY,iEAAiE;SACxF,CAAC;IACJ,CAAC;IAED,IAAI,QAAqB,CAAC;IAC1B,IAAI,IAAI,CAAC,QAAQ,KAAK,cAAc,EAAE,CAAC;QACrC,QAAQ,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IAC/E,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC;YACzB,SAAS;YACT,kBAAkB;YAClB,MAAM;YACN,UAAU;YACV,OAAO;YACP,kBAAkB,MAAM,+BAA+B;YACvD,sBAAsB;SACvB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;QAClF,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,oCAAoC,MAAM,oCAAoC,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;aAC1H,CAAC;QACJ,CAAC;QACD,QAAQ,GAAG,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAW,EAAE,CAAC;IACvE,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC;IAC3D,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE;YACN,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ;YACR,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ;YACzC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC;YAChC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;YAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,MAAc;IAC3B,OAAO,MAAM;SACV,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC"}
1
+ {"version":3,"file":"operator-access.js","sourceRoot":"","sources":["../src/operator-access.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,MAAM,IAAI,aAAa,EAAqB,MAAM,aAAa,CAAC;AACzE,OAAO,EAAqB,SAAS,EAAE,YAAY,EAAc,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EACL,aAAa,EACb,WAAW,EACX,yBAAyB,EACzB,qBAAqB,EACrB,0BAA0B,EAC1B,iCAAiC,EACjC,8BAA8B,EAC9B,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAoB,eAAe,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,iCAAiC,EAAE,MAAM,qBAAqB,CAAC;AAYxE,oFAAoF;AACpF,MAAM,CAAC,MAAM,oBAAoB,GAAmB;IAClD,MAAM,EAAE,qBAAqB;IAC7B,KAAK,EAAE,uBAAuB;IAC9B,WAAW,EACT,0RAA0R;IAC5R,WAAW,EAAE;QACX,8BAA8B;QAC9B,8BAA8B;QAC9B,qEAAqE;QACrE,uEAAuE;QACvE,yEAAyE;QACzE,wEAAwE;QACxE,2DAA2D;QAC3D,6BAA6B;QAC7B,gCAAgC;QAChC,kCAAkC;QAClC,kCAAkC;KACnC;CACF,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAmB;IAC9D,MAAM,EAAE,+BAA+B;IACvC,KAAK,EAAE,6CAA6C;IACpD,WAAW,EACT,yPAAyP;IAC3P,WAAW,EAAE,CAAC,0BAA0B,EAAE,6BAA6B,CAAC;CACzE,CAAC;AAEF,kGAAkG;AAClG,MAAM,qBAAqB,GAAG,qBAAqB,CAAC;AAEpD,6EAA6E;AAC7E,MAAM,UAAU,cAAc,CAAC,SAAiB,EAAE,MAAc;IAC9D,OAAO,YAAY,SAAS,UAAU,MAAM,EAAE,CAAC;AACjD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAAkB;IACpD,OAAO,CAAC,QAAQ,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,wDAAwD;AACxD,MAAM,CAAC,MAAM,uBAAuB,GAAG,wBAAwB,CAAC;AAEhE,yDAAyD;AACzD,MAAM,eAAe,GAAG,mEAAmE,CAAC;AAE5F,2EAA2E;AAC3E,MAAM,UAAU,UAAU,CAAC,QAAqB;IAC9C,OAAO,QAAQ,CAAC,IAAI,KAAK,WAAW;QAClC,CAAC,CAAC,aAAa,QAAQ,CAAC,MAAM,aAAa,QAAQ,CAAC,OAAO,EAAE;QAC7D,CAAC,CAAC,oBAAoB,QAAQ,CAAC,OAAO,EAAE,CAAC;AAC7C,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAQ,EACR,SAAiB,EACjB,IAAoB;IAEpB,MAAM,OAAO,GAAG,aAAa,SAAS,EAAE,CAAC;IACzC,MAAM,WAAW,GAAG,iBAAiB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAClE,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC;IAChG,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;YACvB,KAAK;YACL,OAAO;YACP,QAAQ;YACR,IAAI,CAAC,MAAM;YACX,OAAO;YACP,WAAW,IAAI,CAAC,KAAK,EAAE;YACvB,iBAAiB,IAAI,CAAC,WAAW,EAAE;YACnC,WAAW;YACX,YAAY;YACZ,SAAS;SACV,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;IAClF,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAGzC,CAAC;IACF,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;QAC1F,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,iBAAiB,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;IACrF,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvE,IAAI,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;QACvB,KAAK;QACL,OAAO;QACP,QAAQ;QACR,IAAI,CAAC,MAAM;QACX,OAAO;QACP,WAAW;QACX,SAAS;KACV,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;AAClF,CAAC;AAED,mFAAmF;AACnF,SAAS,SAAS,CAAC,UAAkB,EAAE,IAAY,EAAE,MAAc;IACjE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,IAAI,CAElD,CAAC;IACF,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AACpG,CAAC;AAyBD,mFAAmF;AACnF,MAAM,CAAC,MAAM,eAAe,GAAG,mCAAmC,CAAC;AAEnE,gFAAgF;AAChF,MAAM,CAAC,MAAM,gCAAgC,GAAG,oCAAoC,CAAC;AAErF,mFAAmF;AACnF,MAAM,CAAC,MAAM,mCAAmC,GAAG,oCAAoC,CAAC;AAMxF,sGAAsG;AACtG,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAgC,EAChC,OAA8C,EAAE;IAEhD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;IACtC,MAAM,KAAK,GAAG,CAAC,IAAc,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACjE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;IAC1C,MAAM,OAAO,GAAG,aAAa,SAAS,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,iCAAiC,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,kBAAkB,KAAK,EAAE,CAAC;IAC5C,MAAM,WAAW,GAAG,kBAAkB,sBAAsB,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC;IAC/E,MAAM,KAAK,GAAG,yBAAyB,CAAC,SAAS,CAAC,CAAC;IACnD,MAAM,UAAU,GAAG,cAAc,CAAC,SAAS,EAAE,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,CAAe,EAA4B,EAAE,CAAC,CAAC;QACzE,EAAE,EAAE,KAAK;QACT,IAAI;QACJ,KAAK,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;KACrC,CAAC,CAAC;IAEH,wDAAwD;IACxD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC;QACpB,UAAU;QACV,QAAQ;QACR,+BAA+B;QAC/B,OAAO;QACP,SAAS;KACV,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,sCAAsC,EAAE,GAAG,CAAC,CAAC;IACtE,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAEzC,uBAAuB;IACvB,KAAK,MAAM,IAAI,IAAI,CAAC,oBAAoB,EAAE,gCAAgC,CAAC,EAAE,CAAC;QAC5E,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAC/D,IAAI,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QAC5D,IAAI,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED,mDAAmD;IACnD,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC;QAC3B,KAAK;QACL,kBAAkB;QAClB,UAAU;QACV,KAAK;QACL,OAAO;QACP,uBAAuB;KACxB,CAAC,CAAC;IACH,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;YACvB,KAAK;YACL,kBAAkB;YAClB,QAAQ;YACR,8BAA8B,CAAC,GAAG,CAAC;YACnC,2CAA2C;YAC3C,oHAAoH;YACpH,OAAO;SACR,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YACtD,OAAO,IAAI,CAAC,UAAU,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,mBAAmB,KAAK,EAAE,CAAC,CAAC;IAEtC,MAAM,SAAS,GAAuC;QACpD;YACE,IAAI,EAAE,GAAG,oBAAoB,CAAC,MAAM,8BAA8B;YAClE,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;SACpF;QACD;YACE,IAAI,EAAE,GAAG,oBAAoB,CAAC,MAAM,OAAO,KAAK,EAAE;YAClD,IAAI,EAAE,CAAC,KAAK,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,KAAK,CAAC;SACnE;KACF,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC;YACpB,GAAG,CAAC,CAAC,IAAI;YACT,YAAY,SAAS,EAAE;YACvB,UAAU,UAAU,EAAE;YACtB,kBAAkB;YAClB,OAAO;YACP,SAAS;YACT,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC;IACD,yEAAyE;IACzE,gEAAgE;IAChE,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC;QAC3B,SAAS;QACT,wBAAwB;QACxB,YAAY;QACZ,YAAY,SAAS,EAAE;QACvB,UAAU,mCAAmC,EAAE;QAC/C,kBAAkB;QAClB,OAAO;QACP,SAAS;QACT,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,gCAAgC,YAAY,EAAE,EAAE,QAAQ,CAAC,CAAC;IACxF,IAAI,CAAC,IAAI,CAAC,QAAQ,mCAAmC,OAAO,YAAY,EAAE,CAAC,CAAC;IAC5E,KAAK,MAAM,IAAI,IAAI;QACjB,gEAAgE;QAChE,cAAc,CAAC,SAAS,EAAE,gCAAgC,CAAC,MAAM,CAAC;QAClE,6BAA6B;QAC7B,yBAAyB;KAC1B,EAAE,CAAC;QACF,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC;YACpB,UAAU;YACV,wBAAwB;YACxB,SAAS;YACT,YAAY,SAAS,EAAE;YACvB,UAAU,IAAI,EAAE;YAChB,kBAAkB;YAClB,SAAS;YACT,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,iBAAiB,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,iBAAiB,CAAC,CAAC;IAC3C,CAAC;IAED,qEAAqE;IACrE,uDAAuD;IACvD,MAAM,MAAM,GAAsE;QAChF;YACE,IAAI,EAAE,0BAA0B;YAChC,GAAG,EAAE;gBACH,KAAK;gBACL,KAAK;gBACL,gBAAgB;gBAChB,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC;gBACnC,OAAO;gBACP,eAAe;aAChB;YACD,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACxF,IAAI,EAAE,UAAU;SACjB;QACD;YACE,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,CAAC,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,CAAC;YACnF,MAAM,EAAE,CAAC,KAAK,EAAE,kBAAkB,EAAE,2BAA2B,EAAE,KAAK,CAAC;YACvE,IAAI,EAAE,UAAU;SACjB;QACD;YACE,IAAI,EAAE,aAAa;YACnB,GAAG,EAAE,CAAC,UAAU,EAAE,gBAAgB,EAAE,SAAS,EAAE,eAAe,CAAC;YAC/D,MAAM,EAAE,CAAC,UAAU,EAAE,2BAA2B,EAAE,SAAS,CAAC;YAC5D,IAAI,EAAE,cAAc,CAAC,SAAS,EAAE,qBAAqB,CAAC;SACvD;KACF,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,0BAA0B,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;QACxE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC;YAAE,SAAS;QAC7D,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC;YACpB,GAAG,CAAC,CAAC,MAAM;YACX,YAAY,WAAW,EAAE;YACzB,UAAU,CAAC,CAAC,IAAI,EAAE;YAClB,OAAO;YACP,OAAO;YACP,SAAS;YACT,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,sBAAsB,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QACvE,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,wDAAwD;IACxD,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE;QAC/C,SAAS;QACT,GAAG;QACH,mBAAmB,EAAE,KAAK;QAC1B,YAAY,EAAE,uBAAuB;KACtC,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;IAElE,0EAA0E;IAC1E,2DAA2D;IAC3D,MAAM,OAAO,GAAG;QACd,iCAAiC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE;QAC9D,iCAAiC,KAAK,EAAE;QACxC,wCAAwC,mBAAmB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QAC1F,iCAAiC,MAAM,CAAC,YAAY,EAAE;QACtD,GAAG,gCAAgC,IAAI,iCAAiC,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE;QAC1F,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;YACnD,CAAC,CAAC,CAAC,GAAG,eAAe,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACvD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;QACvB,KAAK;QACL,MAAM;QACN,QAAQ;QACR,OAAO;QACP,WAAW,MAAM,CAAC,QAAQ,EAAE;QAC5B,YAAY,MAAM,EAAE;QACpB,OAAO;QACP,qBAAqB,KAAK,EAAE;QAC5B,aAAa,MAAM,CAAC,OAAO,EAAE;QAC7B,YAAY,MAAM,CAAC,MAAM,EAAE;QAC3B,kCAAkC;QAClC,eAAe;QACf,gBAAgB,eAAe,EAAE;QACjC,6EAA6E;QAC7E,qBAAqB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACxC,iBAAiB;QACjB,mBAAmB;QACnB,SAAS;KACV,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,cAAc,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;IAC7D,IAAI,CAAC,IAAI,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC;IAE5B,MAAM,MAAM,GAAoD;QAC9D;YACE,MAAM,EAAE,WAAW;YACnB,IAAI,EAAE,wBAAwB;YAC9B,GAAG,EAAE,yCAAyC;SAC/C;QACD,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,gCAAgC,EAAE;QACxF;YACE,MAAM,EAAE,SAAS;YACjB,IAAI,EAAE,wBAAwB;YAC9B,GAAG,EAAE,kDAAkD;SACxD;KACF,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC;YACpB,KAAK;YACL,MAAM;YACN,wBAAwB;YACxB,OAAO;YACP,YAAY,MAAM,EAAE;YACpB,OAAO;YACP,YAAY,CAAC,CAAC,MAAM,EAAE;YACtB,UAAU,CAAC,CAAC,IAAI,EAAE;YAClB,SAAS;YACT,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,OAAO,OAAO,KAAK,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC;QACtE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,IAAI,OAAO,OAAO,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,QAAQ,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC;IACjD,MAAM,YAAY,GAAG;QACnB,QAAQ;QACR,cAAc,MAAM,EAAE;QACtB,OAAO;QACP,uBAAuB;QACvB,qBAAqB;QACrB,gDAAgD,SAAS,cAAc,MAAM,SAAS,OAAO,MAAM;QACnG,oBAAoB;QACpB,iCAAiC,KAAK,EAAE;QACxC,SAAS;KACV,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC;QACzB,WAAW;QACX,MAAM;QACN,UAAU;QACV,QAAQ;QACR,cAAc,MAAM,EAAE;QACtB,OAAO;QACP,sBAAsB;KACvB,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC;QACxB,WAAW;QACX,MAAM;QACN,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;QACjC,MAAM;QACN,GAAG,YAAY;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,YAAY,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC;IAC1D,IAAI,CAAC,IAAI,CAAC,mBAAmB,QAAQ,EAAE,CAAC,CAAC;IAEzC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,IAOC,EACD,OAA+B,EAAE;IAEjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,OAAO,GAAG,aAAa,IAAI,CAAC,SAAS,EAAE,CAAC;IAC9C,MAAM,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC;QACrB,KAAK;QACL,UAAU;QACV,MAAM;QACN,YAAY,IAAI,CAAC,MAAM,EAAE;QACzB,OAAO;QACP,2BAA2B,MAAM,EAAE;QACnC,+BAA+B;KAChC,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IAC5F,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,wBAAwB,MAAM,8BAA8B,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;SAC9G,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,QAAQ,CAAC,CAAC,CAAW,CAAC;IAC3C,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC;QACzB,KAAK;QACL,UAAU;QACV,UAAU;QACV,YAAY;QACZ,YAAY,IAAI,CAAC,MAAM,EAAE;QACzB,OAAO;QACP,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,YAAY,KAAK,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IACrF,CAAC;IACD,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,GAAG,YAAY,iEAAiE;SACxF,CAAC;IACJ,CAAC;IAED,IAAI,QAAqB,CAAC;IAC1B,IAAI,IAAI,CAAC,QAAQ,KAAK,cAAc,EAAE,CAAC;QACrC,QAAQ,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IAC/E,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC;YACzB,SAAS;YACT,kBAAkB;YAClB,MAAM;YACN,UAAU;YACV,OAAO;YACP,kBAAkB,MAAM,+BAA+B;YACvD,sBAAsB;SACvB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;QAClF,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,oCAAoC,MAAM,oCAAoC,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;aAC1H,CAAC;QACJ,CAAC;QACD,QAAQ,GAAG,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAW,EAAE,CAAC;IACvE,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC;IAC3D,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE;YACN,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ;YACR,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ;YACzC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC;YAChC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;YAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,MAAc;IAC3B,OAAO,MAAM;SACV,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@caelo-cms/provisioning",
3
- "version": "0.10.59",
3
+ "version": "0.10.61",
4
4
  "private": false,
5
5
  "license": "MPL-2.0",
6
6
  "description": "Pulumi-driven provisioning for Caelo CMS — `bunx @caelo-cms/provisioning --provider <self-hosted|gcp|aws|azure>` brings up a TLS-served install with Postgres + storage + secrets manager + the admin + the API gateway.",
@@ -40,7 +40,7 @@
40
40
  "prepublishOnly": "tsc -b --force && bun build ../platform-updater/src/agent-db.ts --target=bun --outfile=dist/agent-db.js && tsc --project stacks/gcp/tsconfig.json && tsc --project stacks/gcp-firebase/tsconfig.json"
41
41
  },
42
42
  "dependencies": {
43
- "@caelo-cms/shared": "^0.10.59",
43
+ "@caelo-cms/shared": "^0.10.61",
44
44
  "@clack/prompts": "1.8.1",
45
45
  "@pulumi/command": "^1",
46
46
  "@pulumi/gcp": "^10",
package/src/infra-contract.test.ts CHANGED
@@ -20,8 +20,8 @@ describe("infrastructure contract steps", () => {
20
20
  );
21
21
  });
22
22
 
23
- it("is at 11: public_role revoke (3), URL-map redirects role (4), no gateway cms_admin login (5), ops-bucket list (6), gateway proxy hops (7), quality-audit job (8), converge job (9), remote MCP (10), Google sign-in (11)", () => {
24
- expect(INFRA_CONTRACT_VERSION).toBe(11);
23
+ it("is at 12: public_role revoke (3), URL-map redirects role (4), no gateway cms_admin login (5), ops-bucket list (6), gateway proxy hops (7), quality-audit job (8), converge job (9), remote MCP (10), Google sign-in (11), project-level sign-in client (12)", () => {
24
+ expect(INFRA_CONTRACT_VERSION).toBe(12);
25
25
  expect(INFRA_CONTRACT_STEPS[3]).toContain("#633");
26
26
  expect(INFRA_CONTRACT_STEPS[4]).toContain("#587");
27
27
  expect(INFRA_CONTRACT_STEPS[5]).toContain("#635");
@@ -31,6 +31,7 @@ describe("infrastructure contract steps", () => {
31
31
  expect(INFRA_CONTRACT_STEPS[9]).toContain("#819");
32
32
  expect(INFRA_CONTRACT_STEPS[10]).toContain("#806");
33
33
  expect(INFRA_CONTRACT_STEPS[11]).toContain("#914");
34
+ expect(INFRA_CONTRACT_STEPS[12]).toContain("project's IAP settings");
34
35
  });
35
36
 
36
37
  it("lists the pending steps oldest first", () => {
@@ -41,6 +42,6 @@ describe("infrastructure contract steps", () => {
41
42
  });
42
43
 
43
44
  it("names a version a newer release added by number", () => {
44
- expect(infraStepsText(11, 12)).toBe("infrastructure step 12 (see that release's notes)");
45
+ expect(infraStepsText(12, 13)).toBe("infrastructure step 13 (see that release's notes)");
45
46
  });
46
47
  });
package/src/infra-contract.ts CHANGED
@@ -22,7 +22,7 @@
22
22
  * whose app-roll references infrastructure an install does not have yet fails
23
23
  * at roll time, after migrations ran.
24
24
  */
25
- export const INFRA_CONTRACT_VERSION = 11;
25
+ export const INFRA_CONTRACT_VERSION = 12;
26
26
 
27
27
  // History (why each bump happened — an install below a number needs the
28
28
  // converge that introduced it):
@@ -85,6 +85,14 @@ export const INFRA_CONTRACT_VERSION = 11;
85
85
  // new env var; the admin gets CAELO_ADMIN_URL and the project's
86
86
  // organisation domain. A new secret, new IAM and a job redeploy —
87
87
  // nothing the in-cloud upgrader may do.
88
+ // 12 — #914 follow-up (#597 PR): Google applies a custom OAuth client
89
+ // for Cloud Run IAP, and programmatic clients, only at project level
90
+ // or above — the admin's own IAP resource refused them with HTTP 400.
91
+ // The operator-access job now sets them in the project's IAP settings,
92
+ // so its SA gets the new custom role `caeloOperatorAccessIapProject`
93
+ // (`iap.projects.getSettings` / `updateSettings`) on the project. New
94
+ // IAM the in-cloud upgrader cannot grant; without it the new job image
95
+ // fails every Google sign-in sync with 403.
88
96
 
89
97
  /**
90
98
  * What each contract version adds, in operator terms — the upgrader's
@@ -103,6 +111,7 @@ export const INFRA_CONTRACT_STEPS: Readonly<Record<number, string>> = {
103
111
  9: "the converge job that installs cloud-setup changes from Settings → Updates, and a narrower Cloud Run role for the upgrader (#819)",
104
112
  10: "remote MCP: the OAuth client and seal-key secrets, their IAM, the gateway's secret file and timeout, IAP programmatic-client sync and the load-balancer rules (#806)",
105
113
  11: "Google sign-in: the renamed sign-in client secret, its IAM and mounts, the operator-access job's read access to it, and the admin's URL and organisation domain (#914)",
114
+ 12: "Google sign-in at project level: the operator-access job's permission to set the sign-in client in the project's IAP settings (#914)",
106
115
  };
107
116
 
108
117
  /**
package/src/operator-access.test.ts CHANGED
@@ -4,7 +4,8 @@
4
4
  * The operator-access sync job's setup (operator-access.ts) against a fake
5
5
  * gcloud. The load-bearing assertions are the trust boundary: only the job's
6
6
  * own service account gets IAM-policy rights, and only on the admin's IAP
7
- * resource and the caelo-mcp account; the admin's run SA ends up able to
7
+ * resource and the caelo-mcp account (plus, #914, the project's IAP
8
+ * settings — never an IAM policy there); the admin's run SA ends up able to
8
9
  * start the job and read its runs — nothing else — and loses what an earlier
9
10
  * revision gave it.
10
11
  */
@@ -15,6 +16,7 @@ import type { GcloudResult } from "./gcloud.js";
15
16
  import {
16
17
  ensureOperatorAccessSync,
17
18
  installIapAllowlist,
19
+ OPERATOR_ACCESS_PROJECT_IAP_ROLE,
18
20
  OPERATOR_ACCESS_ROLE,
19
21
  type OperatorAccessSyncTarget,
20
22
  resolveOperatorAccessTarget,
@@ -38,6 +40,7 @@ function fakeGcloud(answers: Record<string, GcloudResult[]>) {
38
40
  const JOB_SA = "caelo-production-opaccess@p.iam.gserviceaccount.com";
39
41
  const RUN_SA = "caelo-production-run-sa@p.iam.gserviceaccount.com";
40
42
  const CUSTOM = "projects/p/roles/caeloOperatorAccess";
43
+ const PROJECT_IAP = "projects/p/roles/caeloOperatorAccessIapProject";
41
44
 
42
45
  const target: OperatorAccessSyncTarget = {
43
46
  projectId: "p",
@@ -52,6 +55,9 @@ const target: OperatorAccessSyncTarget = {
52
55
  };
53
56
 
54
57
  const roleJson = JSON.stringify({ includedPermissions: [...OPERATOR_ACCESS_ROLE.permissions] });
58
+ const projectRoleJson = JSON.stringify({
59
+ includedPermissions: [...OPERATOR_ACCESS_PROJECT_IAP_ROLE.permissions],
60
+ });
55
61
  const legacyIapPolicy = JSON.stringify({
56
62
  bindings: [{ role: CUSTOM, members: [`serviceAccount:${RUN_SA}`] }],
57
63
  });
@@ -62,6 +68,7 @@ const flagsJson = JSON.stringify({
62
68
  const freshInstall = () =>
63
69
  fakeGcloud({
64
70
  "iam roles describe": [ok(roleJson)],
71
+ "iam roles describe caeloOperatorAccessIapProject": [ok(projectRoleJson)],
65
72
  "iap web get-iam-policy": [ok(legacyIapPolicy)],
66
73
  "iam service-accounts get-iam-policy": [ok("{}")],
67
74
  "projects get-iam-policy": [ok("{}")],
@@ -100,12 +107,45 @@ describe("ensureOperatorAccessSync", () => {
100
107
  role: CUSTOM,
101
108
  },
102
109
  ]);
103
- // Nothing that can write IAM policy goes to the project or to anyone else.
110
+ // Nothing that can write IAM policy goes to the project or to anyone
111
+ // else; the project gets only its IAP settings (#914).
104
112
  expect(
105
113
  grants(calls)
106
114
  .filter((g) => g.on.startsWith("projects"))
107
115
  .map((g) => g.role),
108
- ).toEqual(["roles/cloudsql.instanceUser", "roles/logging.logWriter"]);
116
+ ).toEqual([PROJECT_IAP, "roles/cloudsql.instanceUser", "roles/logging.logWriter"]);
117
+ });
118
+
119
+ it("#914 — lets the job set the project's IAP settings, where Google applies the sign-in client", async () => {
120
+ const { run, calls } = freshInstall();
121
+ const r = await ensureOperatorAccessSync(target, { run, sleep: async () => {} });
122
+ expect(r.ok && r.done).toContain("custom role caeloOperatorAccessIapProject");
123
+ expect(grants(calls).filter((g) => g.role === PROJECT_IAP)).toEqual([
124
+ {
125
+ on: "projects add-iam-policy-binding p",
126
+ member: `serviceAccount:${JOB_SA}`,
127
+ role: PROJECT_IAP,
128
+ },
129
+ ]);
130
+ });
131
+
132
+ it("#914 — creates the project IAP-settings role on an install that predates it", async () => {
133
+ const { run, lines } = fakeGcloud({
134
+ "iam roles describe": [ok(roleJson)],
135
+ "iam roles describe caeloOperatorAccessIapProject": [fail("NOT_FOUND: role")],
136
+ "sql instances list": [ok("caelo-production-pg-1a2b\n")],
137
+ "sql instances describe": [ok(flagsJson)],
138
+ });
139
+ const r = await ensureOperatorAccessSync(target, { run, sleep: async () => {} });
140
+ expect(r.ok).toBe(true);
141
+ expect(lines().filter((l) => l.startsWith("iam roles create"))).toEqual([
142
+ expect.stringContaining(
143
+ "iam roles create caeloOperatorAccessIapProject --project=p --title=Caelo operator access: project IAP settings",
144
+ ),
145
+ ]);
146
+ expect(lines().find((l) => l.startsWith("iam roles create"))).toContain(
147
+ "--permissions=iap.projects.getSettings,iap.projects.updateSettings",
148
+ );
109
149
  });
110
150
 
111
151
  it("leaves the admin's run SA able to start the job and read its runs — nothing else", async () => {
@@ -188,6 +228,7 @@ describe("ensureOperatorAccessSync", () => {
188
228
  it("is idempotent on a converged install: no flag patch, no user create, scheduler updated", async () => {
189
229
  const { run, lines } = fakeGcloud({
190
230
  "iam roles describe": [ok(roleJson)],
231
+ "iam roles describe caeloOperatorAccessIapProject": [ok(projectRoleJson)],
191
232
  "sql instances list": [ok("caelo-production-pg-1a2b\n")],
192
233
  "sql instances describe": [
193
234
  ok(
@@ -215,6 +256,7 @@ describe("ensureOperatorAccessSync", () => {
215
256
  it("fails loudly naming the step, and reports what was already done", async () => {
216
257
  const { run } = fakeGcloud({
217
258
  "iam roles describe": [ok(roleJson)],
259
+ "iam roles describe caeloOperatorAccessIapProject": [ok(projectRoleJson)],
218
260
  "sql instances list": [ok("caelo-production-pg-1a2b\n")],
219
261
  "sql instances describe": [ok(flagsJson)],
220
262
  "run jobs deploy": [fail("PERMISSION_DENIED: run.jobs.create")],
@@ -232,6 +274,7 @@ describe("ensureOperatorAccessSync", () => {
232
274
  it("refuses to guess the Cloud SQL instance", async () => {
233
275
  const { run } = fakeGcloud({
234
276
  "iam roles describe": [ok(roleJson)],
277
+ "iam roles describe caeloOperatorAccessIapProject": [ok(projectRoleJson)],
235
278
  "sql instances list": [ok("caelo-production-pg-a\ncaelo-production-pg-b\n")],
236
279
  });
237
280
  const r = await ensureOperatorAccessSync(target, { run, sleep: async () => {} });
@@ -340,13 +383,22 @@ describe("resolveOperatorAccessTarget", () => {
340
383
  });
341
384
  });
342
385
 
386
+ describe("caeloOperatorAccessIapProject role (#914)", () => {
387
+ it("holds the project-level IAP settings rights — no IAM policy, no lower level", () => {
388
+ expect([...OPERATOR_ACCESS_PROJECT_IAP_ROLE.permissions].sort()).toEqual([
389
+ "iap.projects.getSettings",
390
+ "iap.projects.updateSettings",
391
+ ]);
392
+ });
393
+ });
394
+
343
395
  describe("caeloOperatorAccess role (#806)", () => {
344
396
  it("holds IAM-policy and IAP-settings rights on web services and the MCP SA — nothing else", () => {
345
397
  expect([...OPERATOR_ACCESS_ROLE.permissions].sort()).toEqual([
346
398
  "iam.serviceAccounts.getIamPolicy",
347
399
  "iam.serviceAccounts.setIamPolicy",
348
400
  "iap.webServices.getIamPolicy",
349
- // The admin IAP resource's oauthSettings (Google sign-in, #914).
401
+ // The admin IAP resource's own oauthSettings, kept empty (#914).
350
402
  "iap.webServices.getSettings",
351
403
  "iap.webServices.setIamPolicy",
352
404
  "iap.webServices.updateSettings",
package/src/operator-access.ts CHANGED
@@ -7,8 +7,9 @@
7
7
  *
8
8
  * Trust boundary. Who may pass the admin's IAP gate and sign as `caelo-mcp`
9
9
  * follows the Caelo user list; which OAuth client IAP signs people in with
10
- * and accepts programmatically (IAP `oauthSettings`: browser client, its
11
- * secret and `programmaticClients`, #914) follows the Google sign-in client
10
+ * and accepts programmatically (the project's IAP `oauthSettings`: browser
11
+ * client, its secret and `programmaticClients`, #914) follows the Google
12
+ * sign-in client
12
13
  * the Owner configured under Settings → Google sign-in. The admin does NOT
13
14
  * write that: its runtime service account holds no IAM-policy rights. A Cloud Run job with its own
14
15
  * service account (admin-core security/operator-access/sync-job.ts) is the
@@ -22,10 +23,13 @@
22
23
  *
23
24
  * What this ensures, every step idempotent:
24
25
  * 1. the Cloud Scheduler API;
25
- * 2. the custom role `caeloOperatorAccess` (get/setIamPolicy, and
26
- * get/updateSettings for `oauthSettings`);
27
- * 3. the job's service account, bound to that role on exactly the admin's
28
- * IAP resource and the `caelo-mcp` service account, `secretAccessor`
26
+ * 2. the custom roles `caeloOperatorAccess` (get/setIamPolicy, and
27
+ * get/updateSettings on a web service) and `caeloOperatorAccessIapProject`
28
+ * (get/updateSettings of the project's IAP settings, where Google
29
+ * applies a custom OAuth client — admin-core iap-settings.ts);
30
+ * 3. the job's service account, bound to `caeloOperatorAccess` on exactly
31
+ * the admin's IAP resource and the `caelo-mcp` service account, to
32
+ * `caeloOperatorAccessIapProject` on the project, `secretAccessor`
29
33
  * on exactly the Google sign-in client's secret (#914: IAP needs the
30
34
  * client secret too), plus `cloudsql.instanceUser` +
31
35
  * `logging.logWriter`;
@@ -78,11 +82,11 @@ export const OPERATOR_ACCESS_ROLE: CustomRoleSpec = {
78
82
  permissions: [
79
83
  "iap.webServices.getIamPolicy",
80
84
  "iap.webServices.setIamPolicy",
81
- // #914 — the admin IAP resource's `oauthSettings` (the install's Google
82
- // sign-in client). IAP settings permissions per resource level:
83
- // cloud.google.com/iap/docs/customizing ("Web Services": getSettings /
84
- // updateSettings); the role is bound on exactly the admin's IAP web
85
- // service, so it reaches no other resource's settings.
85
+ // #914 — the admin IAP resource's own `oauthSettings`, which the job
86
+ // keeps empty so the project's Google sign-in client applies (a client
87
+ // there would override it). IAP settings permissions per resource level:
88
+ // roles/iap.settingsAdmin; the role is bound on exactly the admin's IAP
89
+ // web service, so it reaches no other resource's settings.
86
90
  "iap.webServices.getSettings",
87
91
  "iap.webServices.updateSettings",
88
92
  "iam.serviceAccounts.getIamPolicy",
@@ -90,6 +94,24 @@ export const OPERATOR_ACCESS_ROLE: CustomRoleSpec = {
90
94
  ],
91
95
  };
92
96
 
97
+ /**
98
+ * #914 — the project-level IAP settings, where the job sets the Google
99
+ * sign-in client (`oauthSettings`). Google applies a custom OAuth client for
100
+ * Cloud Run IAP, and programmatic clients, only at project level or above
101
+ * (admin-core security/operator-access/iap-settings.ts). A separate role
102
+ * because it is bound on the PROJECT: `caeloOperatorAccess` there would
103
+ * reach every IAP resource's IAM policy. `iap.projects.*Settings` cover the
104
+ * project-level settings only, no lower level and no IAM policy
105
+ * (roles/iap.settingsAdmin lists the permission per level).
106
+ */
107
+ export const OPERATOR_ACCESS_PROJECT_IAP_ROLE: CustomRoleSpec = {
108
+ roleId: "caeloOperatorAccessIapProject",
109
+ title: "Caelo operator access: project IAP settings",
110
+ description:
111
+ "Lets the Caelo operator-access sync job set which OAuth client IAP signs people in with and accepts programmatically (the install's Google sign-in client) in the project's IAP settings. Bound only on the project, only to the job's service account.",
112
+ permissions: ["iap.projects.getSettings", "iap.projects.updateSettings"],
113
+ };
114
+
93
115
  /** Custom role an earlier revision bound to the admin run SA on `gcp`; its binding is removed. */
94
116
  const LEGACY_LOOKUP_ROLE_ID = "caeloAdminIapLookup";
95
117
 
@@ -245,10 +267,12 @@ export async function ensureOperatorAccessSync(
245
267
  if (!api.ok) return fail("enable cloudscheduler.googleapis.com", api);
246
268
  done.push("Cloud Scheduler API enabled");
247
269
 
248
- // 2. The custom role.
249
- const roleError = await ensureCustomRole(run, projectId, OPERATOR_ACCESS_ROLE);
250
- if (roleError) return { ok: false, done, error: roleError };
251
- done.push(`custom role ${OPERATOR_ACCESS_ROLE.roleId}`);
270
+ // 2. The custom roles.
271
+ for (const role of [OPERATOR_ACCESS_ROLE, OPERATOR_ACCESS_PROJECT_IAP_ROLE]) {
272
+ const roleError = await ensureCustomRole(run, projectId, role);
273
+ if (roleError) return { ok: false, done, error: roleError };
274
+ done.push(`custom role ${role.roleId}`);
275
+ }
252
276
 
253
277
  // 3. The job's own service account and its grants.
254
278
  const saDescribe = await run([
@@ -313,7 +337,12 @@ export async function ensureOperatorAccessSync(
313
337
  ]);
314
338
  if (!accessor.ok) return fail(`grant the job read access to ${clientSecret}`, accessor);
315
339
  done.push(`job: ${OPERATOR_OAUTH_CLIENT_ACCESSOR_ROLE} on ${clientSecret}`);
316
- for (const role of ["roles/cloudsql.instanceUser", "roles/logging.logWriter"]) {
340
+ for (const role of [
341
+ // #914 — the project's IAP settings: the Google sign-in client.
342
+ customRoleName(projectId, OPERATOR_ACCESS_PROJECT_IAP_ROLE.roleId),
343
+ "roles/cloudsql.instanceUser",
344
+ "roles/logging.logWriter",
345
+ ]) {
317
346
  const r = await retry([
318
347
  "projects",
319
348
  "add-iam-policy-binding",