@carlonicora/nestjs-neo4jsonapi 6.5.0 → 6.5.2

package/dist/foundations/user/controllers/user.controller.js

@@ -45,6 +45,17 @@ let UserController = class UserController {
         this.relevancyService = relevancyService;
         this.cypherService = cypherService;
     }
+    /** Platform administrator: the global Administrator role. */
+    isPlatformAdmin(user) {
+        return this.security.isUserInRoles({ user: user, roles: [system_roles_1.RoleId.Administrator] });
+    }
+    /** Administrator OR CompanyAdministrator. */
+    isAnyAdmin(user) {
+        return this.security.isUserInRoles({
+            user: user,
+            roles: [system_roles_1.RoleId.Administrator, system_roles_1.RoleId.CompanyAdministrator],
+        });
+    }
     async findBySearch(request, reply, query, search, includeDeleted, contentIds) {
         const isAdmin = this.security.isUserInRoles({
             user: request.user,
@@ -80,10 +91,24 @@ let UserController = class UserController {
         });
         reply.send(response);
     }
-    async findOneByEmail(email) {
-        return this.users.findByEmail({ email: email });
+    /**
+     * Admin lookup (the user editor's duplicate-email check). Bound to the
+     * caller's company: a user of another company answers 404, like a missing
+     * one. Only a platform administrator looks up across companies.
+     */
+    async findOneByEmail(request, email) {
+        if (this.isPlatformAdmin(request.user))
+            return this.users.findByEmailInCompany({ email: email });
+        const companyId = request.user?.companyId;
+        if (!companyId)
+            throw new common_1.ForbiddenException("No company in context");
+        return this.users.findByEmailInCompany({ email: email, companyId: companyId });
     }
     async findByCompany(request, reply, companyId, query, search, includeDeleted, isDeleted) {
+        // The URL company replaces the CLS company below, so only the caller's own
+        // company (or a platform administrator) may be listed.
+        if (request.user?.companyId !== companyId && !this.isPlatformAdmin(request.user))
+            throw new common_1.ForbiddenException("You cannot list the users of another company");
         this.clsService.set("companyId", companyId);
         const response = await this.users.findManyByCompany({
             query: query,
@@ -95,24 +120,37 @@ let UserController = class UserController {
         reply.send(response);
     }
     async createUser(request, body, reply, lng) {
-        try {
-            await this.users.expectNotExists({ email: body.data.attributes.email });
-        }
-        catch {
-            return this.users.findByEmail({ email: body.data.attributes.email });
-        }
+        // 409 when the email is taken. It used to answer with that user's full
+        // record, whatever company they belonged to.
+        await this.users.expectNotExists({ email: body.data.attributes.email });
         let forceCompanyAdmin = false;
         if (!body.included?.length) {
             if (!body.data.relationships?.company?.data?.id)
                 throw new common_1.HttpException("A new user needs a company relationship or an included company", common_1.HttpStatus.BAD_REQUEST);
+            // A CompanyAdministrator creates users in their own company only: any
+            // other id would let them mint an account (with roles) in another tenant.
+            if (body.data.relationships.company.data.id !== request.user?.companyId && !this.isPlatformAdmin(request.user))
+                throw new common_1.ForbiddenException("You cannot create users in another company");
             await this.companyService.validate({
                 companyId: body.data.relationships.company.data.id,
             });
         }
         else {
-            await this.companyService.createCompanyFromDTO({
-                data: body.included[0],
-            });
+            // Creating a company (with its credit balances) together with its first
+            // administrator is a platform operation. The new user always lands in
+            // that new company: before, the relationship could name any existing
+            // company and plant a CompanyAdministrator there.
+            if (!this.isPlatformAdmin(request.user))
+                throw new common_1.ForbiddenException("Only a platform administrator can create a company with a user");
+            const includedCompany = body.included[0];
+            const relatedCompanyId = body.data.relationships?.company?.data?.id;
+            if (relatedCompanyId && relatedCompanyId !== includedCompany.id)
+                throw new common_1.HttpException("The user's company must be the included company", common_1.HttpStatus.BAD_REQUEST);
+            await this.companyService.createCompanyFromDTO({ data: includedCompany });
+            body.data.relationships = {
+                ...body.data.relationships,
+                company: { data: { type: company_meta_1.companyMeta.endpoint, id: includedCompany.id } },
+            };
             forceCompanyAdmin = true;
         }
         const response = await this.users.createUser({
@@ -123,26 +161,31 @@ let UserController = class UserController {
         reply.send(response);
     }
     async put(request, userId, body, reply) {
-        if (request.user.userId !== userId)
-            this.security.validateAdmin({ user: request.user });
-        const isAdmin = this.security.isUserInRoles({
-            user: request.user,
-            roles: [system_roles_1.RoleId.Administrator, system_roles_1.RoleId.CompanyAdministrator],
-        });
+        const isCurrentUser = request.user.userId === userId;
+        const isAdmin = this.isAnyAdmin(request.user);
+        if (!isCurrentUser && !isAdmin)
+            throw new common_1.ForbiddenException("You are not allowed to edit this user");
+        // Not self: the repository only reaches a user BELONGING_TO the CLS company.
         const response = await this.users.putUser({
             data: body.data,
             isAdmin: isAdmin,
-            isCurrentUser: request.user.userId === userId,
+            isCurrentUser: isCurrentUser,
         });
         reply.send(response);
     }
     async reactivateUser(request, userId, reply) {
         this.security.validateAdmin({ user: request.user });
-        const response = await this.users.reactivate({ userId: userId });
+        const response = await this.users.reactivate({
+            userId: userId,
+            isPlatformAdmin: this.isPlatformAdmin(request.user),
+        });
         reply.send(response);
     }
     async updateUserAvatar(request, userId, body, reply) {
-        const response = await this.users.patchAvatar({ data: body.data });
+        const isSelf = request.user?.userId === userId;
+        if (!isSelf && !this.isAnyAdmin(request.user))
+            throw new common_1.ForbiddenException("You are not allowed to edit this user");
+        const response = await this.users.patchAvatar({ data: body.data, isSelf: isSelf });
         reply.send(response);
     }
     /**
@@ -159,7 +202,10 @@ let UserController = class UserController {
         reply.send(response);
     }
     async updateUserRates(request, userId, body, reply) {
-        const response = await this.users.patchRate({ data: body.data });
+        const response = await this.users.patchRate({
+            data: body.data,
+            isPlatformAdmin: this.isPlatformAdmin(request.user),
+        });
         reply.send(response);
     }
     async sendInvitationEmail(request, userId) {
@@ -167,8 +213,12 @@ let UserController = class UserController {
         await this.users.sendInvitationEmail({ userId: userId });
     }
     async delete(request, userId) {
+        if (!this.isAnyAdmin(request.user))
+            throw new common_1.ForbiddenException("You are not allowed to delete this user");
+        // Non-platform callers only reach users BELONGING_TO their CLS company.
         await this.users.deleteUser({
             userId: userId,
+            isPlatformAdmin: this.isPlatformAdmin(request.user),
         });
     }
     async findUserByRole(req, query, roleId, notInRole, search) {
@@ -190,33 +240,42 @@ let UserController = class UserController {
             isAdmin: isAdmin,
         });
     }
+    /**
+     * Role grants are never self-service.
+     * - Administrator is a PLATFORM grant: only a platform administrator may
+     *   give or take it.
+     * - Any other role: Administrator or CompanyAdministrator. A
+     *   CompanyAdministrator acts inside their CLS company only; the repository
+     *   matches the target user through BELONGS_TO that company.
+     */
+    assertCanManageRole(req, roleId) {
+        if (roleId === system_roles_1.RoleId.Administrator) {
+            if (!this.isPlatformAdmin(req.user))
+                throw new common_1.ForbiddenException("Only a platform administrator can manage the Administrator role");
+            return;
+        }
+        if (!this.isAnyAdmin(req.user))
+            throw new common_1.ForbiddenException("You are not allowed to manage roles");
+        if (!this.isPlatformAdmin(req.user) && !this.clsService.get("companyId"))
+            throw new common_1.ForbiddenException("You are not allowed to manage roles");
+    }
     async addUserToRole(req, roleId, userId, reply) {
-        const isAdmin = this.security.isUserInRoles({
-            user: req.user,
-            roles: [system_roles_1.RoleId.Administrator, system_roles_1.RoleId.CompanyAdministrator],
-        });
-        if (!isAdmin && req.user.userId !== userId)
-            throw new common_1.HttpException("You are not allowed to edit this user", common_1.HttpStatus.FORBIDDEN);
+        this.assertCanManageRole(req, roleId);
         const response = await this.users.addUserToRole({
             userId: userId,
             roleId: roleId,
-            returnsFull: isAdmin || req.user.userId === userId,
+            returnsFull: true,
         });
         reply.send(response);
         await this.cacheService.invalidateByElement(user_meta_1.userMeta.endpoint, userId);
         await this.cacheService.invalidateByElement(role_meta_1.roleMeta.endpoint, roleId);
     }
     async removeUserToRole(req, roleId, userId) {
-        const isAdmin = this.security.isUserInRoles({
-            user: req.user,
-            roles: [system_roles_1.RoleId.Administrator, system_roles_1.RoleId.CompanyAdministrator],
-        });
-        if (!isAdmin && req.user.userId !== userId)
-            throw new common_1.HttpException("You are not allowed to edit this user", common_1.HttpStatus.FORBIDDEN);
+        this.assertCanManageRole(req, roleId);
         await this.users.removeUserFromRole({
             roleId: roleId,
             userId: userId,
-            returnsFull: isAdmin || req.user.userId === userId,
+            returnsFull: true,
         });
         await this.cacheService.invalidateByElement(user_meta_1.userMeta.endpoint, userId);
         await this.cacheService.invalidateByElement(role_meta_1.roleMeta.endpoint, roleId);
@@ -260,9 +319,11 @@ __decorate([
 ], UserController.prototype, "findFullUser", null);
 __decorate([
     (0, common_1.Get)(`${user_meta_1.userMeta.endpoint}/email/:email`),
-    __param(0, (0, common_1.Param)("email")),
+    (0, roles_decorator_1.Roles)(system_roles_1.RoleId.Administrator, system_roles_1.RoleId.CompanyAdministrator),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Param)("email")),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String]),
+    __metadata("design:paramtypes", [Object, String]),
     __metadata("design:returntype", Promise)
 ], UserController.prototype, "findOneByEmail", null);
 __decorate([
@@ -291,7 +352,10 @@ __decorate([
     __metadata("design:returntype", Promise)
 ], UserController.prototype, "createUser", null);
 __decorate([
-    (0, common_1.Put)(`${user_meta_1.userMeta.endpoint}/:userId`),
+    (0, common_1.Put)(`${user_meta_1.userMeta.endpoint}/:userId`)
+    // The service writes body.data.id: it must be the URL id (412 otherwise).
+    ,
+    (0, validate_id_decorator_1.ValidateId)("userId"),
     (0, cache_invalidate_decorator_1.CacheInvalidate)(user_meta_1.userMeta, "userId"),
     __param(0, (0, common_1.Request)()),
     __param(1, (0, common_1.Param)("userId")),
@@ -313,6 +377,7 @@ __decorate([
 ], UserController.prototype, "reactivateUser", null);
 __decorate([
     (0, common_1.Patch)(`${user_meta_1.userMeta.endpoint}/:userId/avatar`),
+    (0, validate_id_decorator_1.ValidateId)("userId"),
     (0, cache_invalidate_decorator_1.CacheInvalidate)(user_meta_1.userMeta, "userId"),
     __param(0, (0, common_1.Request)()),
     __param(1, (0, common_1.Param)("userId")),
@@ -337,6 +402,7 @@ __decorate([
 __decorate([
     (0, common_1.Patch)(`${user_meta_1.userMeta.endpoint}/:userId/rates`),
     (0, roles_decorator_1.Roles)(system_roles_1.RoleId.CompanyAdministrator),
+    (0, validate_id_decorator_1.ValidateId)("userId"),
     (0, cache_invalidate_decorator_1.CacheInvalidate)(user_meta_1.userMeta, "userId"),
     __param(0, (0, common_1.Request)()),
     __param(1, (0, common_1.Param)("userId")),

package/dist/foundations/user/controllers/user.controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"user.controller.js","sourceRoot":"","sources":["../../../../src/foundations/user/controllers/user.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAkBwB;AACxB,yEAAgE;AAChE,sGAAwF;AACxF,4FAA8E;AAC9E,0EAAqE;AACrE,uFAAmF;AAGnF,2CAAwC;AACxC,gFAAmE;AAEnE,8EAA0E;AAE1E,sEAAkE;AAClE,4EAAwE;AACxE,sEAAkE;AAClE,kFAA8E;AAC9E,6DAAyD;AACzD,iFAA2E;AAC3E,qFAA+E;AAC/E,6EAAuE;AACvE,iEAA4D;AAC5D,+DAA0D;AAC1D,6DAAyD;AAEzD,yEAAoE;AACpE,2DAAuD;AAIhD,IAAM,cAAc,GAApB,MAAM,cAAc;IACzB,YACmB,KAAkB,EAClB,QAAyB,EACzB,cAA8B,EAC9B,YAA0B,EAC1B,UAAsB,EACtB,gBAAwC,EACxC,aAAgC;QANhC,UAAK,GAAL,KAAK,CAAa;QAClB,aAAQ,GAAR,QAAQ,CAAiB;QACzB,mBAAc,GAAd,cAAc,CAAgB;QAC9B,iBAAY,GAAZ,YAAY,CAAc;QAC1B,eAAU,GAAV,UAAU,CAAY;QACtB,qBAAgB,GAAhB,gBAAgB,CAAwB;QACxC,kBAAa,GAAb,aAAa,CAAmB;IAChD,CAAC;IAGE,AAAN,KAAK,CAAC,YAAY,CACT,OAA6B,EAC7B,KAAmB,EACjB,KAAU,EACF,MAAe,EACP,cAAwB,EAC5B,UAAmB;QAExC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC;YAC1C,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,KAAK,EAAE,CAAC,qBAAM,CAAC,aAAa,EAAE,qBAAM,CAAC,oBAAoB,CAAC;SAC3D,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC;QACb,IAAI,UAAU,EAAE,CAAC;YACf,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACpG,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;gBACnC,KAAK,EAAE,KAAK;gBACZ,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE,OAAO;gBAChB,cAAc,EAAE,cAAc,IAAI,KAAK;aACxC,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IAGK,AAAN,KAAK,CAAC,eAAe,CAAY,GAAQ,EAAmB,MAAc;QACxE,IAAI,MAAM,KAAK,IAAI;YAAE,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC;QAE/C,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,qBAAM,CAAC,aAAa,CAAC,EAAE,CAAC;YAChF,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAE9D,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;YACnC,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;IACL,CAAC;IAGK,AAAN,KAAK,CAAC,YAAY,CAAQ,OAA6B,EAAS,KAAmB;QACjF,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;QAEpC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;YAC7C,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;QAEH,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IAGK,AAAN,KAAK,CAAC,cAAc,CAAiB,KAAa;QAChD,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAClD,CAAC;IAGK,AAAN,KAAK,CAAC,aAAa,CACV,OAA6B,EAC7B,KAAmB,EACN,SAAiB,EAC5B,KAAU,EACF,MAAe,EACP,cAAwB,EAC7B,SAAmB;QAEvC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAE5C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC;YAClD,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,MAAM;YACZ,SAAS,EAAE,SAAS,IAAI,KAAK;YAC7B,cAAc,EAAE,cAAc,IAAI,KAAK;YACvC,SAAS,EAAE,SAAS;SACrB,CAAC,CAAC;QAEH,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IAKK,AAAN,KAAK,CAAC,UAAU,CACP,OAAY,EACX,IAAiB,EAClB,KAAmB,EACZ,GAAY;QAE1B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;QAC1E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,iBAAiB,GAAG,KAAK,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;YAC3B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;gBAC7C,MAAM,IAAI,sBAAa,CACrB,gEAAgE,EAChE,mBAAU,CAAC,WAAW,CACvB,CAAC;YACJ,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC;gBACjC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;aACnD,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,CAAC,cAAc,CAAC,oBAAoB,CAAC;gBAC7C,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAuB;aAC7C,CAAC,CAAC;YACH,iBAAiB,GAAG,IAAI,CAAC;QAC3B,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;YAC3C,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,iBAAiB,EAAE,iBAAiB;YACpC,QAAQ,EAAE,GAAG,IAAI,IAAI;SACtB,CAAC,CAAC;QAEH,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IAIK,AAAN,KAAK,CAAC,GAAG,CACI,OAAY,EACN,MAAc,EACvB,IAAgB,EACjB,KAAmB;QAE1B,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,MAAM;YAAE,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAExF,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC;YAC1C,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,KAAK,EAAE,CAAC,qBAAM,CAAC,aAAa,EAAE,qBAAM,CAAC,oBAAoB,CAAC;SAC3D,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;YACxC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,OAAO;YAChB,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,MAAM;SAC9C,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IAIK,AAAN,KAAK,CAAC,cAAc,CAAY,OAAY,EAAmB,MAAc,EAAS,KAAmB;QACvG,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAEpD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACjE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IAIK,AAAN,KAAK,CAAC,gBAAgB,CACT,OAAY,EACN,MAAc,EACvB,IAAwB,EACzB,KAAmB;QAE1B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACnE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IAED;;;OAGG;IAIG,AAAN,KAAK,CAAC,kBAAkB,CACX,OAAY,EACN,MAAc,EACvB,IAA0B,EAC3B,KAAmB;QAE1B,IAAI,OAAO,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM;YAAE,MAAM,IAAI,2BAAkB,CAAC,uCAAuC,CAAC,CAAC;QAE3G,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC;YAC9C,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,qBAAM,CAAC,aAAa,CAAC,EAAE,CAAC;SAC5F,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IAKK,AAAN,KAAK,CAAC,eAAe,CACR,OAAY,EACN,MAAc,EACvB,IAAsB,EACvB,KAAmB;QAE1B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACjE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IAKK,AAAN,KAAK,CAAC,mBAAmB,CAAY,OAAY,EAAmB,MAAc;QAChF,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3D,CAAC;IAKK,AAAN,KAAK,CAAC,MAAM,CAAQ,OAAY,EAAmB,MAAc;QAC/D,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;YAC1B,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;IACL,CAAC;IAIK,AAAN,KAAK,CAAC,cAAc,CACP,GAAQ,EACV,KAAU,EACF,MAAc,EACX,SAAmB,EACtB,MAAe;QAEhC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC;YAC1C,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,KAAK,EAAE,CAAC,qBAAM,CAAC,aAAa,EAAE,qBAAM,CAAC,oBAAoB,CAAC;SAC3D,CAAC,CAAC;QACH,IAAI,SAAS;YACX,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC;gBACpC,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,MAAM;gBACZ,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE,OAAO;aACjB,CAAC,CAAC;QAEL,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;YACjC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,KAAK;YACZ,OAAO,EAAE,OAAO;SACjB,CAAC,CAAC;IACL,CAAC;IAIK,AAAN,KAAK,CAAC,aAAa,CACN,GAAQ,EACF,MAAc,EACd,MAAc,EACxB,KAAmB;QAE1B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC;YAC1C,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,KAAK,EAAE,CAAC,qBAAM,CAAC,aAAa,EAAE,qBAAM,CAAC,oBAAoB,CAAC;SAC3D,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,MAAM;YACxC,MAAM,IAAI,sBAAa,CAAC,uCAAuC,EAAE,mBAAU,CAAC,SAAS,CAAC,CAAC;QAEzF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC;YAC9C,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,MAAM;YACd,WAAW,EAAE,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,MAAM;SACnD,CAAC,CAAC;QAEH,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrB,MAAM,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAC,oBAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACvE,MAAM,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAC,oBAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACzE,CAAC;IAIK,AAAN,KAAK,CAAC,gBAAgB,CAAY,GAAQ,EAAmB,MAAc,EAAmB,MAAc;QAC1G,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC;YAC1C,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,KAAK,EAAE,CAAC,qBAAM,CAAC,aAAa,EAAE,qBAAM,CAAC,oBAAoB,CAAC;SAC3D,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,MAAM;YACxC,MAAM,IAAI,sBAAa,CAAC,uCAAuC,EAAE,mBAAU,CAAC,SAAS,CAAC,CAAC;QAEzF,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC;YAClC,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,MAAM;YACd,WAAW,EAAE,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,MAAM;SACnD,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAC,oBAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACvE,MAAM,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAC,oBAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACzE,CAAC;IAGK,AAAN,KAAK,CAAC,8BAA8B,CAAU,KAAU,EAAsB,SAAiB;QAC7F,OAAO,MAAM,IAAI,CAAC,gBAAgB,CAAC,iBAAiB,CAAC;YACnD,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,EAAE,EAAE,SAAS;YACb,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAzTY,wCAAc;AAYnB;IADL,IAAA,YAAG,EAAC,oBAAQ,CAAC,QAAQ,CAAC;IAEpB,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,GAAE,CAAA;IACP,WAAA,IAAA,cAAK,EAAC,QAAQ,CAAC,CAAA;IACf,WAAA,IAAA,cAAK,EAAC,gBAAgB,CAAC,CAAA;IACvB,WAAA,IAAA,cAAK,EAAC,YAAY,CAAC,CAAA;;;;kDAoBrB;AAGK;IADL,IAAA,YAAG,EAAC,GAAG,oBAAQ,CAAC,QAAQ,UAAU,CAAC;IACb,WAAA,IAAA,gBAAO,GAAE,CAAA;IAAY,WAAA,IAAA,cAAK,EAAC,QAAQ,CAAC,CAAA;;;;qDAS1D;AAGK;IADL,IAAA,YAAG,EAAC,GAAG,oBAAQ,CAAC,QAAQ,UAAU,CAAC;IAChB,WAAA,IAAA,YAAG,GAAE,CAAA;IAAiC,WAAA,IAAA,YAAG,GAAE,CAAA;;;;kDAQ9D;AAGK;IADL,IAAA,YAAG,EAAC,GAAG,oBAAQ,CAAC,QAAQ,eAAe,CAAC;IACnB,WAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;;;;oDAEnC;AAGK;IADL,IAAA,YAAG,EAAC,GAAG,0BAAW,CAAC,QAAQ,eAAe,oBAAQ,CAAC,QAAQ,EAAE,CAAC;IAE5D,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,WAAW,CAAC,CAAA;IAClB,WAAA,IAAA,cAAK,GAAE,CAAA;IACP,WAAA,IAAA,cAAK,EAAC,QAAQ,CAAC,CAAA;IACf,WAAA,IAAA,cAAK,EAAC,gBAAgB,CAAC,CAAA;IACvB,WAAA,IAAA,cAAK,EAAC,WAAW,CAAC,CAAA;;;;mDAapB;AAKK;IAHL,IAAA,aAAI,EAAC,oBAAQ,CAAC,QAAQ,CAAC;IACvB,IAAA,uBAAK,EAAC,qBAAM,CAAC,aAAa,EAAE,qBAAM,CAAC,oBAAoB,CAAC;IACxD,IAAA,4CAAe,EAAC,oBAAQ,CAAC;IAEvB,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,KAAK,CAAC,CAAA;;6CAFC,2BAAW;;gDAkC1B;AAIK;IAFL,IAAA,YAAG,EAAC,GAAG,oBAAQ,CAAC,QAAQ,UAAU,CAAC;IACnC,IAAA,4CAAe,EAAC,oBAAQ,EAAE,QAAQ,CAAC;IAEjC,WAAA,IAAA,gBAAO,GAAE,CAAA;IACT,WAAA,IAAA,cAAK,EAAC,QAAQ,CAAC,CAAA;IACf,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qDADQ,yBAAU;;yCAgBzB;AAIK;IAFL,IAAA,cAAK,EAAC,GAAG,oBAAQ,CAAC,QAAQ,UAAU,CAAC;IACrC,IAAA,4CAAe,EAAC,oBAAQ,EAAE,QAAQ,CAAC;IACd,WAAA,IAAA,gBAAO,GAAE,CAAA;IAAgB,WAAA,IAAA,cAAK,EAAC,QAAQ,CAAC,CAAA;IAAkB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;oDAKpF;AAIK;IAFL,IAAA,cAAK,EAAC,GAAG,oBAAQ,CAAC,QAAQ,iBAAiB,CAAC;IAC5C,IAAA,4CAAe,EAAC,oBAAQ,EAAE,QAAQ,CAAC;IAEjC,WAAA,IAAA,gBAAO,GAAE,CAAA;IACT,WAAA,IAAA,cAAK,EAAC,QAAQ,CAAC,CAAA;IACf,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qDADQ,0CAAkB;;sDAKjC;AASK;IAHL,IAAA,cAAK,EAAC,GAAG,oBAAQ,CAAC,QAAQ,mBAAmB,CAAC;IAC9C,IAAA,kCAAU,EAAC,QAAQ,CAAC;IACpB,IAAA,4CAAe,EAAC,oBAAQ,EAAE,QAAQ,CAAC;IAEjC,WAAA,IAAA,gBAAO,GAAE,CAAA;IACT,WAAA,IAAA,cAAK,EAAC,QAAQ,CAAC,CAAA;IACf,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qDADQ,8CAAoB;;wDAUnC;AAKK;IAHL,IAAA,cAAK,EAAC,GAAG,oBAAQ,CAAC,QAAQ,gBAAgB,CAAC;IAC3C,IAAA,uBAAK,EAAC,qBAAM,CAAC,oBAAoB,CAAC;IAClC,IAAA,4CAAe,EAAC,oBAAQ,EAAE,QAAQ,CAAC;IAEjC,WAAA,IAAA,gBAAO,GAAE,CAAA;IACT,WAAA,IAAA,cAAK,EAAC,QAAQ,CAAC,CAAA;IACf,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qDADQ,sCAAgB;;qDAK/B;AAKK;IAHL,IAAA,iBAAQ,EAAC,mBAAU,CAAC,UAAU,CAAC;IAC/B,IAAA,aAAI,EAAC,GAAG,oBAAQ,CAAC,QAAQ,gCAAgC,CAAC;IAC1D,IAAA,4CAAe,EAAC,oBAAQ,EAAE,QAAQ,CAAC;IACT,WAAA,IAAA,gBAAO,GAAE,CAAA;IAAgB,WAAA,IAAA,cAAK,EAAC,QAAQ,CAAC,CAAA;;;;yDAGlE;AAKK;IAHL,IAAA,iBAAQ,EAAC,mBAAU,CAAC,UAAU,CAAC;IAC/B,IAAA,eAAM,EAAC,GAAG,oBAAQ,CAAC,QAAQ,UAAU,CAAC;IACtC,IAAA,4CAAe,EAAC,oBAAQ,EAAE,QAAQ,CAAC;IACtB,WAAA,IAAA,YAAG,GAAE,CAAA;IAAgB,WAAA,IAAA,cAAK,EAAC,QAAQ,CAAC,CAAA;;;;4CAIjD;AAIK;IAFL,IAAA,kBAAS,EAAC,6BAAY,CAAC;IACvB,IAAA,YAAG,EAAC,GAAG,oBAAQ,CAAC,QAAQ,YAAY,oBAAQ,CAAC,QAAQ,EAAE,CAAC;IAEtD,WAAA,IAAA,gBAAO,GAAE,CAAA;IACT,WAAA,IAAA,cAAK,GAAE,CAAA;IACP,WAAA,IAAA,cAAK,EAAC,QAAQ,CAAC,CAAA;IACf,WAAA,IAAA,cAAK,EAAC,WAAW,CAAC,CAAA;IAClB,WAAA,IAAA,cAAK,EAAC,QAAQ,CAAC,CAAA;;;;oDAoBjB;AAIK;IAFL,IAAA,kBAAS,EAAC,6BAAY,CAAC;IACvB,IAAA,aAAI,EAAC,GAAG,oBAAQ,CAAC,QAAQ,YAAY,oBAAQ,CAAC,QAAQ,UAAU,CAAC;IAE/D,WAAA,IAAA,gBAAO,GAAE,CAAA;IACT,WAAA,IAAA,cAAK,EAAC,QAAQ,CAAC,CAAA;IACf,WAAA,IAAA,cAAK,EAAC,QAAQ,CAAC,CAAA;IACf,WAAA,IAAA,YAAG,GAAE,CAAA;;;;mDAmBP;AAIK;IAFL,IAAA,kBAAS,EAAC,6BAAY,CAAC;IACvB,IAAA,eAAM,EAAC,GAAG,oBAAQ,CAAC,QAAQ,YAAY,oBAAQ,CAAC,QAAQ,UAAU,CAAC;IAC5C,WAAA,IAAA,gBAAO,GAAE,CAAA;IAAY,WAAA,IAAA,cAAK,EAAC,QAAQ,CAAC,CAAA;IAAkB,WAAA,IAAA,cAAK,EAAC,QAAQ,CAAC,CAAA;;;;sDAiB5F;AAGK;IADL,IAAA,YAAG,EAAC,GAAG,0BAAW,CAAC,QAAQ,4BAA4B,CAAC;IACnB,WAAA,IAAA,cAAK,GAAE,CAAA;IAAc,WAAA,IAAA,cAAK,EAAC,WAAW,CAAC,CAAA;;;;oEAM5E;yBAxTU,cAAc;IAF1B,IAAA,mBAAU,GAAE;IACZ,IAAA,kBAAS,EAAC,6BAAY,CAAC;qCAGI,0BAAW;QACR,kCAAe;QACT,gCAAc;QAChB,4BAAY;QACd,uBAAU;QACJ,oCAAgB;QACnB,uCAAiB;GARxC,cAAc,CAyT1B"}
+{"version":3,"file":"user.controller.js","sourceRoot":"","sources":["../../../../src/foundations/user/controllers/user.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAkBwB;AACxB,yEAAgE;AAChE,sGAAwF;AACxF,4FAA8E;AAC9E,0EAAqE;AACrE,uFAAmF;AAGnF,2CAAwC;AACxC,gFAAmE;AAEnE,8EAA0E;AAE1E,sEAAkE;AAClE,4EAAwE;AACxE,sEAAkE;AAClE,kFAA8E;AAC9E,6DAAyD;AACzD,iFAA2E;AAC3E,qFAA+E;AAC/E,6EAAuE;AACvE,iEAA4D;AAC5D,+DAA0D;AAC1D,6DAAyD;AAEzD,yEAAoE;AACpE,2DAAuD;AAIhD,IAAM,cAAc,GAApB,MAAM,cAAc;IACzB,YACmB,KAAkB,EAClB,QAAyB,EACzB,cAA8B,EAC9B,YAA0B,EAC1B,UAAsB,EACtB,gBAAwC,EACxC,aAAgC;QANhC,UAAK,GAAL,KAAK,CAAa;QAClB,aAAQ,GAAR,QAAQ,CAAiB;QACzB,mBAAc,GAAd,cAAc,CAAgB;QAC9B,iBAAY,GAAZ,YAAY,CAAc;QAC1B,eAAU,GAAV,UAAU,CAAY;QACtB,qBAAgB,GAAhB,gBAAgB,CAAwB;QACxC,kBAAa,GAAb,aAAa,CAAmB;IAChD,CAAC;IAEJ,6DAA6D;IACrD,eAAe,CAAC,IAAS;QAC/B,OAAO,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,qBAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,6CAA6C;IACrC,UAAU,CAAC,IAAS;QAC1B,OAAO,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC;YACjC,IAAI,EAAE,IAAI;YACV,KAAK,EAAE,CAAC,qBAAM,CAAC,aAAa,EAAE,qBAAM,CAAC,oBAAoB,CAAC;SAC3D,CAAC,CAAC;IACL,CAAC;IAGK,AAAN,KAAK,CAAC,YAAY,CACT,OAA6B,EAC7B,KAAmB,EACjB,KAAU,EACF,MAAe,EACP,cAAwB,EAC5B,UAAmB;QAExC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC;YAC1C,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,KAAK,EAAE,CAAC,qBAAM,CAAC,aAAa,EAAE,qBAAM,CAAC,oBAAoB,CAAC;SAC3D,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC;QACb,IAAI,UAAU,EAAE,CAAC;YACf,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACpG,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;gBACnC,KAAK,EAAE,KAAK;gBACZ,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE,OAAO;gBAChB,cAAc,EAAE,cAAc,IAAI,KAAK;aACxC,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IAGK,AAAN,KAAK,CAAC,eAAe,CAAY,GAAQ,EAAmB,MAAc;QACxE,IAAI,MAAM,KAAK,IAAI;YAAE,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC;QAE/C,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,qBAAM,CAAC,aAAa,CAAC,EAAE,CAAC;YAChF,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAE9D,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;YACnC,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;IACL,CAAC;IAGK,AAAN,KAAK,CAAC,YAAY,CAAQ,OAA6B,EAAS,KAAmB;QACjF,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;QAEpC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;YAC7C,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;QAEH,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IAED;;;;OAIG;IAGG,AAAN,KAAK,CAAC,cAAc,CAAQ,OAA6B,EAAkB,KAAa;QACtF,IAAI,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAEjG,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;QAC1C,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,2BAAkB,CAAC,uBAAuB,CAAC,CAAC;QAEtE,OAAO,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;IACjF,CAAC;IAGK,AAAN,KAAK,CAAC,aAAa,CACV,OAA6B,EAC7B,KAAmB,EACN,SAAiB,EAC5B,KAAU,EACF,MAAe,EACP,cAAwB,EAC7B,SAAmB;QAEvC,2EAA2E;QAC3E,uDAAuD;QACvD,IAAI,OAAO,CAAC,IAAI,EAAE,SAAS,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC;YAC9E,MAAM,IAAI,2BAAkB,CAAC,8CAA8C,CAAC,CAAC;QAE/E,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAE5C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC;YAClD,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,MAAM;YACZ,SAAS,EAAE,SAAS,IAAI,KAAK;YAC7B,cAAc,EAAE,cAAc,IAAI,KAAK;YACvC,SAAS,EAAE,SAAS;SACrB,CAAC,CAAC;QAEH,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IAKK,AAAN,KAAK,CAAC,UAAU,CACP,OAAY,EACX,IAAiB,EAClB,KAAmB,EACZ,GAAY;QAE1B,uEAAuE;QACvE,6CAA6C;QAC7C,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;QAExE,IAAI,iBAAiB,GAAG,KAAK,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;YAC3B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;gBAC7C,MAAM,IAAI,sBAAa,CACrB,gEAAgE,EAChE,mBAAU,CAAC,WAAW,CACvB,CAAC;YACJ,sEAAsE;YACtE,0EAA0E;YAC1E,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,OAAO,CAAC,IAAI,EAAE,SAAS,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC;gBAC5G,MAAM,IAAI,2BAAkB,CAAC,4CAA4C,CAAC,CAAC;YAC7E,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC;gBACjC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;aACnD,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,wEAAwE;YACxE,sEAAsE;YACtE,qEAAqE;YACrE,kDAAkD;YAClD,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC;gBACrC,MAAM,IAAI,2BAAkB,CAAC,gEAAgE,CAAC,CAAC;YAEjG,MAAM,eAAe,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAuB,CAAC;YAC/D,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;YACpE,IAAI,gBAAgB,IAAI,gBAAgB,KAAK,eAAe,CAAC,EAAE;gBAC7D,MAAM,IAAI,sBAAa,CAAC,iDAAiD,EAAE,mBAAU,CAAC,WAAW,CAAC,CAAC;YAErG,MAAM,IAAI,CAAC,cAAc,CAAC,oBAAoB,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;YAC1E,IAAI,CAAC,IAAI,CAAC,aAAa,GAAG;gBACxB,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa;gBAC1B,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,0BAAW,CAAC,QAAQ,EAAE,EAAE,EAAE,eAAe,CAAC,EAAE,EAAE,EAAE;aACxC,CAAC;YACpC,iBAAiB,GAAG,IAAI,CAAC;QAC3B,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;YAC3C,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,iBAAiB,EAAE,iBAAiB;YACpC,QAAQ,EAAE,GAAG,IAAI,IAAI;SACtB,CAAC,CAAC;QAEH,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IAMK,AAAN,KAAK,CAAC,GAAG,CACI,OAAY,EACN,MAAc,EACvB,IAAgB,EACjB,KAAmB;QAE1B,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC;QACrD,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAE9C,IAAI,CAAC,aAAa,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,2BAAkB,CAAC,uCAAuC,CAAC,CAAC;QAEtG,6EAA6E;QAC7E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;YACxC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,OAAO;YAChB,aAAa,EAAE,aAAa;SAC7B,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IAIK,AAAN,KAAK,CAAC,cAAc,CAAY,OAAY,EAAmB,MAAc,EAAS,KAAmB;QACvG,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAEpD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;YAC3C,MAAM,EAAE,MAAM;YACd,eAAe,EAAE,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC;SACpD,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IAKK,AAAN,KAAK,CAAC,gBAAgB,CACT,OAAY,EACN,MAAc,EACvB,IAAwB,EACzB,KAAmB;QAE1B,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;QAC/C,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC;YAC3C,MAAM,IAAI,2BAAkB,CAAC,uCAAuC,CAAC,CAAC;QAExE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACnF,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IAED;;;OAGG;IAIG,AAAN,KAAK,CAAC,kBAAkB,CACX,OAAY,EACN,MAAc,EACvB,IAA0B,EAC3B,KAAmB;QAE1B,IAAI,OAAO,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM;YAAE,MAAM,IAAI,2BAAkB,CAAC,uCAAuC,CAAC,CAAC;QAE3G,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC;YAC9C,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,qBAAM,CAAC,aAAa,CAAC,EAAE,CAAC;SAC5F,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IAMK,AAAN,KAAK,CAAC,eAAe,CACR,OAAY,EACN,MAAc,EACvB,IAAsB,EACvB,KAAmB;QAE1B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;YAC1C,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,eAAe,EAAE,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC;SACpD,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IAKK,AAAN,KAAK,CAAC,mBAAmB,CAAY,OAAY,EAAmB,MAAc;QAChF,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3D,CAAC;IAKK,AAAN,KAAK,CAAC,MAAM,CAAQ,OAAY,EAAmB,MAAc;QAC/D,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,2BAAkB,CAAC,yCAAyC,CAAC,CAAC;QAE5G,wEAAwE;QACxE,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;YAC1B,MAAM,EAAE,MAAM;YACd,eAAe,EAAE,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAIK,AAAN,KAAK,CAAC,cAAc,CACP,GAAQ,EACV,KAAU,EACF,MAAc,EACX,SAAmB,EACtB,MAAe;QAEhC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC;YAC1C,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,KAAK,EAAE,CAAC,qBAAM,CAAC,aAAa,EAAE,qBAAM,CAAC,oBAAoB,CAAC;SAC3D,CAAC,CAAC;QACH,IAAI,SAAS;YACX,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC;gBACpC,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,MAAM;gBACZ,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE,OAAO;aACjB,CAAC,CAAC;QAEL,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;YACjC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,KAAK;YACZ,OAAO,EAAE,OAAO;SACjB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACK,mBAAmB,CAAC,GAAQ,EAAE,MAAc;QAClD,IAAI,MAAM,KAAK,qBAAM,CAAC,aAAa,EAAE,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC;gBACjC,MAAM,IAAI,2BAAkB,CAAC,iEAAiE,CAAC,CAAC;YAClG,OAAO;QACT,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,2BAAkB,CAAC,qCAAqC,CAAC,CAAC;QAEpG,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC;YACtE,MAAM,IAAI,2BAAkB,CAAC,qCAAqC,CAAC,CAAC;IACxE,CAAC;IAIK,AAAN,KAAK,CAAC,aAAa,CACN,GAAQ,EACF,MAAc,EACd,MAAc,EACxB,KAAmB;QAE1B,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAEtC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC;YAC9C,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,MAAM;YACd,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QAEH,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrB,MAAM,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAC,oBAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACvE,MAAM,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAC,oBAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACzE,CAAC;IAIK,AAAN,KAAK,CAAC,gBAAgB,CAAY,GAAQ,EAAmB,MAAc,EAAmB,MAAc;QAC1G,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAEtC,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC;YAClC,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,MAAM;YACd,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAC,oBAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACvE,MAAM,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAC,oBAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACzE,CAAC;IAGK,AAAN,KAAK,CAAC,8BAA8B,CAAU,KAAU,EAAsB,SAAiB;QAC7F,OAAO,MAAM,IAAI,CAAC,gBAAgB,CAAC,iBAAiB,CAAC;YACnD,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,EAAE,EAAE,SAAS;YACb,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAhYY,wCAAc;AAyBnB;IADL,IAAA,YAAG,EAAC,oBAAQ,CAAC,QAAQ,CAAC;IAEpB,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,GAAE,CAAA;IACP,WAAA,IAAA,cAAK,EAAC,QAAQ,CAAC,CAAA;IACf,WAAA,IAAA,cAAK,EAAC,gBAAgB,CAAC,CAAA;IACvB,WAAA,IAAA,cAAK,EAAC,YAAY,CAAC,CAAA;;;;kDAoBrB;AAGK;IADL,IAAA,YAAG,EAAC,GAAG,oBAAQ,CAAC,QAAQ,UAAU,CAAC;IACb,WAAA,IAAA,gBAAO,GAAE,CAAA;IAAY,WAAA,IAAA,cAAK,EAAC,QAAQ,CAAC,CAAA;;;;qDAS1D;AAGK;IADL,IAAA,YAAG,EAAC,GAAG,oBAAQ,CAAC,QAAQ,UAAU,CAAC;IAChB,WAAA,IAAA,YAAG,GAAE,CAAA;IAAiC,WAAA,IAAA,YAAG,GAAE,CAAA;;;;kDAQ9D;AASK;IAFL,IAAA,YAAG,EAAC,GAAG,oBAAQ,CAAC,QAAQ,eAAe,CAAC;IACxC,IAAA,uBAAK,EAAC,qBAAM,CAAC,aAAa,EAAE,qBAAM,CAAC,oBAAoB,CAAC;IACnC,WAAA,IAAA,YAAG,GAAE,CAAA;IAAiC,WAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;;;;oDAOzE;AAGK;IADL,IAAA,YAAG,EAAC,GAAG,0BAAW,CAAC,QAAQ,eAAe,oBAAQ,CAAC,QAAQ,EAAE,CAAC;IAE5D,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,WAAW,CAAC,CAAA;IAClB,WAAA,IAAA,cAAK,GAAE,CAAA;IACP,WAAA,IAAA,cAAK,EAAC,QAAQ,CAAC,CAAA;IACf,WAAA,IAAA,cAAK,EAAC,gBAAgB,CAAC,CAAA;IACvB,WAAA,IAAA,cAAK,EAAC,WAAW,CAAC,CAAA;;;;mDAkBpB;AAKK;IAHL,IAAA,aAAI,EAAC,oBAAQ,CAAC,QAAQ,CAAC;IACvB,IAAA,uBAAK,EAAC,qBAAM,CAAC,aAAa,EAAE,qBAAM,CAAC,oBAAoB,CAAC;IACxD,IAAA,4CAAe,EAAC,oBAAQ,CAAC;IAEvB,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,KAAK,CAAC,CAAA;;6CAFC,2BAAW;;gDAkD1B;AAMK;IAJL,IAAA,YAAG,EAAC,GAAG,oBAAQ,CAAC,QAAQ,UAAU,CAAC;IACpC,0EAA0E;;IACzE,IAAA,kCAAU,EAAC,QAAQ,CAAC;IACpB,IAAA,4CAAe,EAAC,oBAAQ,EAAE,QAAQ,CAAC;IAEjC,WAAA,IAAA,gBAAO,GAAE,CAAA;IACT,WAAA,IAAA,cAAK,EAAC,QAAQ,CAAC,CAAA;IACf,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qDADQ,yBAAU;;yCAezB;AAIK;IAFL,IAAA,cAAK,EAAC,GAAG,oBAAQ,CAAC,QAAQ,UAAU,CAAC;IACrC,IAAA,4CAAe,EAAC,oBAAQ,EAAE,QAAQ,CAAC;IACd,WAAA,IAAA,gBAAO,GAAE,CAAA;IAAgB,WAAA,IAAA,cAAK,EAAC,QAAQ,CAAC,CAAA;IAAkB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;oDAQpF;AAKK;IAHL,IAAA,cAAK,EAAC,GAAG,oBAAQ,CAAC,QAAQ,iBAAiB,CAAC;IAC5C,IAAA,kCAAU,EAAC,QAAQ,CAAC;IACpB,IAAA,4CAAe,EAAC,oBAAQ,EAAE,QAAQ,CAAC;IAEjC,WAAA,IAAA,gBAAO,GAAE,CAAA;IACT,WAAA,IAAA,cAAK,EAAC,QAAQ,CAAC,CAAA;IACf,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qDADQ,0CAAkB;;sDASjC;AASK;IAHL,IAAA,cAAK,EAAC,GAAG,oBAAQ,CAAC,QAAQ,mBAAmB,CAAC;IAC9C,IAAA,kCAAU,EAAC,QAAQ,CAAC;IACpB,IAAA,4CAAe,EAAC,oBAAQ,EAAE,QAAQ,CAAC;IAEjC,WAAA,IAAA,gBAAO,GAAE,CAAA;IACT,WAAA,IAAA,cAAK,EAAC,QAAQ,CAAC,CAAA;IACf,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qDADQ,8CAAoB;;wDAUnC;AAMK;IAJL,IAAA,cAAK,EAAC,GAAG,oBAAQ,CAAC,QAAQ,gBAAgB,CAAC;IAC3C,IAAA,uBAAK,EAAC,qBAAM,CAAC,oBAAoB,CAAC;IAClC,IAAA,kCAAU,EAAC,QAAQ,CAAC;IACpB,IAAA,4CAAe,EAAC,oBAAQ,EAAE,QAAQ,CAAC;IAEjC,WAAA,IAAA,gBAAO,GAAE,CAAA;IACT,WAAA,IAAA,cAAK,EAAC,QAAQ,CAAC,CAAA;IACf,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qDADQ,sCAAgB;;qDAQ/B;AAKK;IAHL,IAAA,iBAAQ,EAAC,mBAAU,CAAC,UAAU,CAAC;IAC/B,IAAA,aAAI,EAAC,GAAG,oBAAQ,CAAC,QAAQ,gCAAgC,CAAC;IAC1D,IAAA,4CAAe,EAAC,oBAAQ,EAAE,QAAQ,CAAC;IACT,WAAA,IAAA,gBAAO,GAAE,CAAA;IAAgB,WAAA,IAAA,cAAK,EAAC,QAAQ,CAAC,CAAA;;;;yDAGlE;AAKK;IAHL,IAAA,iBAAQ,EAAC,mBAAU,CAAC,UAAU,CAAC;IAC/B,IAAA,eAAM,EAAC,GAAG,oBAAQ,CAAC,QAAQ,UAAU,CAAC;IACtC,IAAA,4CAAe,EAAC,oBAAQ,EAAE,QAAQ,CAAC;IACtB,WAAA,IAAA,YAAG,GAAE,CAAA;IAAgB,WAAA,IAAA,cAAK,EAAC,QAAQ,CAAC,CAAA;;;;4CAQjD;AAIK;IAFL,IAAA,kBAAS,EAAC,6BAAY,CAAC;IACvB,IAAA,YAAG,EAAC,GAAG,oBAAQ,CAAC,QAAQ,YAAY,oBAAQ,CAAC,QAAQ,EAAE,CAAC;IAEtD,WAAA,IAAA,gBAAO,GAAE,CAAA;IACT,WAAA,IAAA,cAAK,GAAE,CAAA;IACP,WAAA,IAAA,cAAK,EAAC,QAAQ,CAAC,CAAA;IACf,WAAA,IAAA,cAAK,EAAC,WAAW,CAAC,CAAA;IAClB,WAAA,IAAA,cAAK,EAAC,QAAQ,CAAC,CAAA;;;;oDAoBjB;AAyBK;IAFL,IAAA,kBAAS,EAAC,6BAAY,CAAC;IACvB,IAAA,aAAI,EAAC,GAAG,oBAAQ,CAAC,QAAQ,YAAY,oBAAQ,CAAC,QAAQ,UAAU,CAAC;IAE/D,WAAA,IAAA,gBAAO,GAAE,CAAA;IACT,WAAA,IAAA,cAAK,EAAC,QAAQ,CAAC,CAAA;IACf,WAAA,IAAA,cAAK,EAAC,QAAQ,CAAC,CAAA;IACf,WAAA,IAAA,YAAG,GAAE,CAAA;;;;mDAaP;AAIK;IAFL,IAAA,kBAAS,EAAC,6BAAY,CAAC;IACvB,IAAA,eAAM,EAAC,GAAG,oBAAQ,CAAC,QAAQ,YAAY,oBAAQ,CAAC,QAAQ,UAAU,CAAC;IAC5C,WAAA,IAAA,gBAAO,GAAE,CAAA;IAAY,WAAA,IAAA,cAAK,EAAC,QAAQ,CAAC,CAAA;IAAkB,WAAA,IAAA,cAAK,EAAC,QAAQ,CAAC,CAAA;;;;sDAW5F;AAGK;IADL,IAAA,YAAG,EAAC,GAAG,0BAAW,CAAC,QAAQ,4BAA4B,CAAC;IACnB,WAAA,IAAA,cAAK,GAAE,CAAA;IAAc,WAAA,IAAA,cAAK,EAAC,WAAW,CAAC,CAAA;;;;oEAM5E;yBA/XU,cAAc;IAF1B,IAAA,mBAAU,GAAE;IACZ,IAAA,kBAAS,EAAC,6BAAY,CAAC;qCAGI,0BAAW;QACR,kCAAe;QACT,gCAAc;QAChB,4BAAY;QACd,uBAAU;QACJ,oCAAgB;QACnB,uCAAiB;GARxC,cAAc,CAgY1B"}

package/dist/foundations/user/repositories/user.repository.d.ts

@@ -47,6 +47,17 @@ export declare class UserRepository extends AbstractRepository<User, typeof User
         };
     }>;
     constructor(neo4j: Neo4jService, securityService: SecurityService, clsService: ClsService, userCypherService: UserCypherService);
+    /**
+     * Binds `user` to `$userId` ONLY when that user belongs to the request
+     * company (`$companyId`, from CLS). With no company in context
+     * `$companyId` is null and the fragment matches nothing, so a by-id write
+     * can never reach a user of another tenant.
+     *
+     * Used with `query.query =` (assigned, not appended): the initQuery
+     * preamble also requires the CALLER to belong to the company, which a
+     * platform administrator acting through the x-companyid header does not.
+     */
+    protected companyScopedUserMatch(): string;
     /**
      * `AbstractRepository.onModuleInit` creates the constraints and indexes
      * declared by the descriptor. `defineEntity` only ever emits the `id` UNIQUE
@@ -159,12 +170,22 @@ export declare class UserRepository extends AbstractRepository<User, typeof User
         userId: string;
         source: SignupSource;
     }): Promise<void>;
+    /**
+     * `isPlatformAdmin` reaches any user by id; otherwise only a user belonging
+     * to the request company is reactivated (see `companyScopedUserMatch`).
+     */
     reactivate(params: {
         userId: string;
+        isPlatformAdmin?: boolean;
     }): Promise<void>;
+    /**
+     * `isPlatformAdmin` reaches any user by id; otherwise only a user belonging
+     * to the request company is updated (see `companyScopedUserMatch`).
+     */
     patchRate(params: {
         userId: string;
         rate: number;
+        isPlatformAdmin?: boolean;
     }): Promise<void>;
     patchLanguage(params: {
         userId: string;
@@ -179,12 +200,26 @@ export declare class UserRepository extends AbstractRepository<User, typeof User
         userId?: string;
         email?: string;
     }): Promise<User | undefined>;
+    /**
+     * `isSelf` (the controller has checked the caller IS `userId`) matches the
+     * user by id, so a platform administrator without a company can still set
+     * their own avatar. Anyone else's avatar is reachable only inside the
+     * request company (see `companyScopedUserMatch`).
+     */
     patchAvatar(params: {
         userId: string;
         avatar: string;
+        isSelf?: boolean;
     }): Promise<void>;
+    /**
+     * Soft-deletes a user. `isPlatformAdmin` reaches any user by id; otherwise
+     * only a user belonging to the request company (`$companyId`) is deleted.
+     * The previous unbound `MATCH (company:Company)` matched every company, so
+     * any caller could soft-delete any user on the platform.
+     */
     deleteUser(params: {
         userId: string;
+        isPlatformAdmin?: boolean;
     }): Promise<void>;
     addUserToRole(params: {
         userId: string;

package/dist/foundations/user/repositories/user.repository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.repository.d.ts","sourceRoot":"","sources":["../../../../src/foundations/user/repositories/user.repository.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,OAAO,EAAE,sBAAsB,EAAE,MAAM,2DAA2D,CAAC;AACnG,OAAO,EAAE,kBAAkB,EAAE,MAAM,mDAAmD,CAAC;AACvF,OAAO,EAAE,YAAY,EAAE,MAAM,4CAA4C,CAAC;AAC1E,OAAO,EAAE,eAAe,EAAE,MAAM,kDAAkD,CAAC;AAYnF,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAEhE,OAAO,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AAE5E,OAAO,EAAwB,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAExF;;;;;;;;;;;;;;GAcG;AACH,qBACa,cAAe,SAAQ,kBAAkB,CAAC,IAAI,EAAE,OAAO,cAAc,CAAC,aAAa,CAAC;IAO7F,SAAS,CAAC,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB;IANzD,SAAS,CAAC,QAAQ,CAAC,UAAU;;;;;;;;;;;;;;;;;;;;;;OAAkB;gBAG7C,KAAK,EAAE,YAAY,EACnB,eAAe,EAAE,eAAe,EAChC,UAAU,EAAE,UAAU,EACH,iBAAiB,EAAE,iBAAiB;IAKzD;;;;;;;OAOG;IACG,YAAY;IAQZ,gBAAgB,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE;IAmB9D,eAAe,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAuBhE;;;;OAIG;IACG,qBAAqB,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IA+BhE,YAAY,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAsDvD,YAAY,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IA0B3E,WAAW,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAgC/E,UAAU,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAuBnD,QAAQ,CAAC,MAAM,EAAE;QACrB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,MAAM,CAAC,EAAE,sBAAsB,CAAC;KACjC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAgDb,oBAAoB,CAAC,MAAM,EAAE;QACjC,UAAU,EAAE,MAAM,EAAE,CAAC;QACrB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,cAAc,CAAC,EAAE,OAAO,CAAC;KAC1B,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAuBb,iBAAiB,CAAC,MAAM,EAAE;QAC9B,SAAS,EAAE,MAAM,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,MAAM,CAAC,EAAE,sBAAsB,CAAC;KACjC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAoBb,UAAU,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,sBAAsB,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IA0BtG,aAAa,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,sBAAsB,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IA+BzG,UAAU,CAAC,MAAM,EAAE;QACvB,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;KAC7B,GAAG,OAAO,CAAC,IAAI,CAAC;IAyDX,SAAS,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBpD,OAAO,CAAC,MAAM,EAAE;QACpB,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,iFAAiF;QACjF,MAAM,CAAC,EAAE,OAAO,CAAC;KAClB,GAAG,OAAO,CAAC,IAAI,CAAC;IAuEX,YAAY,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAiB9E;;;OAGG;IACG,eAAe,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,YAAY,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAsBhF,UAAU,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBrD,SAAS,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBlE,aAAa,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAqBhF;;;;OAIG;IACG,eAAe,CAAC,MAAM,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;IAuBvF,WAAW,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBtE,UAAU,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBrD,aAAa,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IA4BxE,kBAAkB,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAqBnF;;;OAGG;IACG,0BAA0B,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;IAiBnD;;;OAGG;IACG,mCAAmC,CAAC,MAAM,EAAE;QAAE,gBAAgB,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IA0BhG;;;OAGG;IACG,qBAAqB,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;CAmB5E"}
+{"version":3,"file":"user.repository.d.ts","sourceRoot":"","sources":["../../../../src/foundations/user/repositories/user.repository.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,OAAO,EAAE,sBAAsB,EAAE,MAAM,2DAA2D,CAAC;AACnG,OAAO,EAAE,kBAAkB,EAAE,MAAM,mDAAmD,CAAC;AACvF,OAAO,EAAE,YAAY,EAAE,MAAM,4CAA4C,CAAC;AAC1E,OAAO,EAAE,eAAe,EAAE,MAAM,kDAAkD,CAAC;AAYnF,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAEhE,OAAO,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AAE5E,OAAO,EAAwB,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAExF;;;;;;;;;;;;;;GAcG;AACH,qBACa,cAAe,SAAQ,kBAAkB,CAAC,IAAI,EAAE,OAAO,cAAc,CAAC,aAAa,CAAC;IAO7F,SAAS,CAAC,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB;IANzD,SAAS,CAAC,QAAQ,CAAC,UAAU;;;;;;;;;;;;;;;;;;;;;;OAAkB;gBAG7C,KAAK,EAAE,YAAY,EACnB,eAAe,EAAE,eAAe,EAChC,UAAU,EAAE,UAAU,EACH,iBAAiB,EAAE,iBAAiB;IAKzD;;;;;;;;;OASG;IACH,SAAS,CAAC,sBAAsB,IAAI,MAAM;IAO1C;;;;;;;OAOG;IACG,YAAY;IAQZ,gBAAgB,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE;IAmB9D,eAAe,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAuBhE;;;;OAIG;IACG,qBAAqB,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IA+BhE,YAAY,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAsDvD,YAAY,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IA0B3E,WAAW,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAgC/E,UAAU,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAuBnD,QAAQ,CAAC,MAAM,EAAE;QACrB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,MAAM,CAAC,EAAE,sBAAsB,CAAC;KACjC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAgDb,oBAAoB,CAAC,MAAM,EAAE;QACjC,UAAU,EAAE,MAAM,EAAE,CAAC;QACrB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,cAAc,CAAC,EAAE,OAAO,CAAC;KAC1B,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAuBb,iBAAiB,CAAC,MAAM,EAAE;QAC9B,SAAS,EAAE,MAAM,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,MAAM,CAAC,EAAE,sBAAsB,CAAC;KACjC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAoBb,UAAU,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,sBAAsB,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IA0BtG,aAAa,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,sBAAsB,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IA+BzG,UAAU,CAAC,MAAM,EAAE;QACvB,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;KAC7B,GAAG,OAAO,CAAC,IAAI,CAAC;IAyDX,SAAS,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBpD,OAAO,CAAC,MAAM,EAAE;QACpB,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,iFAAiF;QACjF,MAAM,CAAC,EAAE,OAAO,CAAC;KAClB,GAAG,OAAO,CAAC,IAAI,CAAC;IAkFX,YAAY,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAiB9E;;;OAGG;IACG,eAAe,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,YAAY,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAsBtF;;;OAGG;IACG,UAAU,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBtF;;;OAGG;IACG,SAAS,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAkB7F,aAAa,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAqBhF;;;;OAIG;IACG,eAAe,CAAC,MAAM,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;IAuB7F;;;;;OAKG;IACG,WAAW,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAkB9F;;;;;OAKG;IACG,UAAU,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBhF,aAAa,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IA4BxE,kBAAkB,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAwBnF;;;OAGG;IACG,0BAA0B,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;IAiBnD;;;OAGG;IACG,mCAAmC,CAAC,MAAM,EAAE;QAAE,gBAAgB,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IA0BhG;;;OAGG;IACG,qBAAqB,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;CAmB5E"}

package/dist/foundations/user/repositories/user.repository.js

@@ -49,6 +49,22 @@ let UserRepository = class UserRepository extends abstract_repository_1.Abstract
         this.userCypherService = userCypherService;
         this.descriptor = user_1.UserDescriptor;
     }
+    /**
+     * Binds `user` to `$userId` ONLY when that user belongs to the request
+     * company (`$companyId`, from CLS). With no company in context
+     * `$companyId` is null and the fragment matches nothing, so a by-id write
+     * can never reach a user of another tenant.
+     *
+     * Used with `query.query =` (assigned, not appended): the initQuery
+     * preamble also requires the CALLER to belong to the company, which a
+     * platform administrator acting through the x-companyid header does not.
+     */
+    companyScopedUserMatch() {
+        return `
+      MATCH (company:Company {id: $companyId})
+      MATCH (user:User {id: $userId})-[:BELONGS_TO]->(company)
+    `;
+    }
     /**
      * `AbstractRepository.onModuleInit` creates the constraints and indexes
      * declared by the descriptor. `defineEntity` only ever emits the `id` UNIQUE
@@ -483,10 +499,19 @@ let UserRepository = class UserRepository extends abstract_repository_1.Abstract
         // anyone else's user this match is what confines a CompanyAdministrator to
         // their own company. Roles are company-scoped, so the role block below stays
         // gated on the company being matched.
+        //
+        // When the caller edits SOMEONE ELSE the user must also BELONG_TO that
+        // company: matching the company alone left `user` unbound to it, so a
+        // CompanyAdministrator could rewrite the email/password of any user on the
+        // platform by id.
         const scopeToCompany = !!query.queryParams.companyId || !params.isSelf;
         query.query = `
-      ${scopeToCompany ? `MATCH (company:Company {id: $companyId})` : ``}
-      MATCH (user:User {id: $userId})
+      ${!params.isSelf
+            ? this.companyScopedUserMatch()
+            : `
+            ${scopeToCompany ? `MATCH (company:Company {id: $companyId})` : ``}
+            MATCH (user:User {id: $userId})
+          `}
       SET ${setClauses.join(", ")}
 
       ${scopeToCompany && params.isAdmin && params.roles !== undefined
@@ -541,18 +566,26 @@ let UserRepository = class UserRepository extends abstract_repository_1.Abstract
     `;
         await this.neo4j.writeOne(query);
     }
+    /**
+     * `isPlatformAdmin` reaches any user by id; otherwise only a user belonging
+     * to the request company is reactivated (see `companyScopedUserMatch`).
+     */
     async reactivate(params) {
         const query = this.neo4j.initQuery();
         query.queryParams = {
             ...query.queryParams,
             userId: params.userId,
         };
-        query.query += `
-      MATCH (user:User {id: $userId})
+        query.query = `
+      ${params.isPlatformAdmin ? `MATCH (user:User {id: $userId})` : this.companyScopedUserMatch()}
       SET user.isDeleted = false
     `;
         await this.neo4j.writeOne(query);
     }
+    /**
+     * `isPlatformAdmin` reaches any user by id; otherwise only a user belonging
+     * to the request company is updated (see `companyScopedUserMatch`).
+     */
     async patchRate(params) {
         const query = this.neo4j.initQuery();
         query.queryParams = {
@@ -560,8 +593,8 @@ let UserRepository = class UserRepository extends abstract_repository_1.Abstract
             userId: params.userId,
             rate: params.rate,
         };
-        query.query += `
-      MATCH (user:User {id: $userId})
+        query.query = `
+      ${params.isPlatformAdmin ? `MATCH (user:User {id: $userId})` : this.companyScopedUserMatch()}
       SET user.rate = $rate,
           user.updatedAt = datetime()
     `;
@@ -608,6 +641,12 @@ let UserRepository = class UserRepository extends abstract_repository_1.Abstract
     `;
         return (await this.neo4j.readOne(query)) ?? undefined;
     }
+    /**
+     * `isSelf` (the controller has checked the caller IS `userId`) matches the
+     * user by id, so a platform administrator without a company can still set
+     * their own avatar. Anyone else's avatar is reachable only inside the
+     * request company (see `companyScopedUserMatch`).
+     */
     async patchAvatar(params) {
         const query = this.neo4j.initQuery();
         query.queryParams = {
@@ -615,13 +654,19 @@ let UserRepository = class UserRepository extends abstract_repository_1.Abstract
             userId: params.userId,
             avatar: params.avatar,
         };
-        query.query += `
-      MATCH (user:User {id: $userId})
+        query.query = `
+      ${params.isSelf ? `MATCH (user:User {id: $userId})` : this.companyScopedUserMatch()}
       SET user.avatar = $avatar,
           user.updatedAt = datetime()
     `;
         await this.neo4j.writeOne(query);
     }
+    /**
+     * Soft-deletes a user. `isPlatformAdmin` reaches any user by id; otherwise
+     * only a user belonging to the request company (`$companyId`) is deleted.
+     * The previous unbound `MATCH (company:Company)` matched every company, so
+     * any caller could soft-delete any user on the platform.
+     */
     async deleteUser(params) {
         const query = this.neo4j.initQuery();
         query.queryParams = {
@@ -629,10 +674,9 @@ let UserRepository = class UserRepository extends abstract_repository_1.Abstract
             userId: params.userId,
         };
         query.query = `
-      MATCH (company:Company)
-      MATCH (user:User {id: $userId})-[:BELONGS_TO]->(company)
-        SET user.isDeleted = true
-      `;
+      ${params.isPlatformAdmin ? `MATCH (user:User {id: $userId})` : this.companyScopedUserMatch()}
+      SET user.isDeleted = true
+    `;
         await this.neo4j.writeOne(query);
     }
     async addUserToRole(params) {
@@ -668,9 +712,12 @@ let UserRepository = class UserRepository extends abstract_repository_1.Abstract
             userId: params.userId,
             administratorRoleId: system_roles_1.RoleId.Administrator,
         };
+        // A company role is removed only from a user who BELONGS_TO the request
+        // company, mirroring the grant in addUserToRole. Administrator lives on the
+        // platform membership (no IN_COMPANY) and needs no company.
         query.query += `
       MATCH (user:User {id: $userId})-[:HAS_MEMBERSHIP]->(rm_ms:Membership)
-      WHERE (rm_ms)-[:IN_COMPANY]->(:Company {id: $companyId})
+      WHERE ((user)-[:BELONGS_TO]->(:Company {id: $companyId}) AND (rm_ms)-[:IN_COMPANY]->(:Company {id: $companyId}))
          OR ($roleId = $administratorRoleId AND NOT (rm_ms)-[:IN_COMPANY]->(:Company))
       MATCH (rm_ms)-[rel:HAS_ROLE]->(:Role {id: $roleId})
       DELETE rel