@conduction/nextcloud-vue 2.119.0 → 2.121.0

package/dist/esm/utils/objectPermissions.js

@@ -0,0 +1,552 @@
+import axios__default from '@nextcloud/axios';
+import { translate } from '@nextcloud/l10n';
+import { prefixUrl } from './headers.js';
+
+/**
+ * SPDX-FileCopyrightText: 2026 Conduction B.V.
+ * SPDX-License-Identifier: EUPL-1.2
+ *
+ * Who holds which right on one OpenRegister object, and where each grant came
+ * from. The reads behind CnObjectPermissionsTab.
+ *
+ * Every function here is a read. Nothing decides who may open an object: the
+ * grant, its provenance, the deny and the inheritance live in OpenRegister, and
+ * these helpers hand on what it answered. A deny is never subtracted from a
+ * grant, a missing answer is never filled with a default, and nothing is
+ * cached: a copy of an access decision is a second decision nobody updates.
+ *
+ * The object's own permission set (`/permissions`) is preferred; an older
+ * OpenRegister answers 404 to it, and then five reads are the fallback:
+ *
+ *   GET {apiBase}/permissions                                  the verb catalogue + deny mode
+ *   GET {apiBase}/objects/{register}/{schema}/{id}/shares      grants written on the object
+ *   GET {apiBase}/permissions/compare-roles?register=          each role and its verbs
+ *   GET {apiBase}/scopes?register=&schema=                     the caller's own verdict + provenance
+ *   GET {apiBase}/permissions/deny-preview?register=&schema=   the deny rules as written
+ *
+ * plus the history read `{...}/{id}/permissions/history?at=` for "who held a
+ * right on a date".
+ *
+ * A failed read answers `null`, never `[]`: "we could not ask" and "nobody
+ * holds this" are opposite answers that would otherwise render as the same
+ * empty table.
+ */
+
+/** The OpenRegister API root a target defaults to. */
+const DEFAULT_API_BASE = '/apps/openregister/api';
+
+/**
+ * Normalise a target to `{register, schema, apiBase}`.
+ *
+ * @param {object} target The object's register, schema and optional apiBase.
+ * @return {{register: string, schema: string, apiBase: string}} The target.
+ */
+function normalise(target = {}) {
+	return {
+		register: String(target.register || ''),
+		schema: String(target.schema || ''),
+		apiBase: String(target.apiBase || DEFAULT_API_BASE).replace(/\/$/, ''),
+	}
+}
+
+/**
+ * GET one path, keeping the status beside the body.
+ *
+ * The status is part of the answer: a 403 on the access set means the reader
+ * may open the object and may not enumerate who else can, which is not a
+ * failed read. A transport failure has no status and reports 0. A non-JSON
+ * body (the SPA shell answering 200) is a failed read, not "no rules".
+ *
+ * @param {string} url    App-absolute URL.
+ * @param {object} params Query parameters.
+ * @return {Promise<{status: number, data: object|null}>} The status and the body.
+ */
+async function readResult(url, params = {}) {
+	try {
+		const response = await axios__default.get(prefixUrl(url), { params });
+		if (typeof response?.data !== 'object' || response.data === null) {
+			return { status: response?.status || 0, data: null }
+		}
+		return { status: response.status || 200, data: response.data }
+	} catch (error) {
+		return { status: error?.response?.status || 0, data: null }
+	}
+}
+
+/**
+ * GET one path, answering null when it cannot be read.
+ *
+ * @param {string} url    App-absolute URL.
+ * @param {object} params Query parameters.
+ * @return {Promise<object|null>} The body, or null.
+ */
+async function read(url, params = {}) {
+	const { data } = await readResult(url, params);
+	return data
+}
+
+/**
+ * The URL of one object, under its target.
+ *
+ * @param {object} target   The target.
+ * @param {string} objectId The object id.
+ * @param {string} [schema] A schema other than the target's.
+ * @return {string} The URL.
+ */
+function objectUrl(target, objectId, schema) {
+	const { register, apiBase } = normalise(target);
+	return `${apiBase}/objects/${register}/${schema || normalise(target).schema}/${objectId}`
+}
+
+/**
+ * The grantable verbs and the deny enforcement mode.
+ *
+ * @param {object} target The target (only `apiBase` is read).
+ * @return {Promise<object|null>} `{permissions, denyEnforcement}`, or null.
+ */
+function fetchPermissionCatalogue(target) {
+	return read(`${normalise(target).apiBase}/permissions`)
+}
+
+/**
+ * The grants written on one object.
+ *
+ * @param {object} target   The target.
+ * @param {string} objectId The object id.
+ * @return {Promise<Array|null>} The grants, or null.
+ */
+async function fetchObjectGrants(target, objectId) {
+	const body = await read(`${objectUrl(target, objectId)}/shares`);
+	if (body === null || !Array.isArray(body.results)) {
+		return null
+	}
+	return body.results
+}
+
+/**
+ * Each role in the register and the verbs it holds.
+ *
+ * @param {object} target The target.
+ * @return {Promise<object|null>} `{roles}`, or null.
+ */
+function fetchRoleGrants(target) {
+	const { apiBase, register } = normalise(target);
+	return read(`${apiBase}/permissions/compare-roles`, { register })
+}
+
+/**
+ * The caller's own effective verbs on the schema, with their provenance.
+ *
+ * The endpoint answers a matrix even when narrowed, so the row is picked by
+ * schema name rather than by position.
+ *
+ * @param {object} target The target.
+ * @return {Promise<object|null>} The scope entry, or null.
+ */
+async function fetchCallerScope(target) {
+	const { apiBase, register, schema } = normalise(target);
+	const body = await read(`${apiBase}/scopes`, { register, schema });
+	if (body === null || !Array.isArray(body.scopes)) {
+		return null
+	}
+	const scope = body.scopes.find((entry) => entry?.schema === schema);
+	if (!scope) {
+		return null
+	}
+	return { user: body.user, isAdmin: body.isAdmin, groups: body.groups, ...scope }
+}
+
+/**
+ * The deny rules as written for the register and schema.
+ *
+ * @param {object} target The target.
+ * @return {Promise<object|null>} `{denyEnforcement, enforcing, rules}`, or null.
+ */
+function fetchDenyRules(target) {
+	const { apiBase, register, schema } = normalise(target);
+	return read(`${apiBase}/permissions/deny-preview`, { register, schema })
+}
+
+/**
+ * The permission set OpenRegister publishes for this object, with its status.
+ *
+ * @param {object} target   The target.
+ * @param {string} objectId The object id.
+ * @return {Promise<{status: number, set: object|null}>} The status and the set.
+ */
+async function fetchObjectPermissions(target, objectId) {
+	const { status, data } = await readResult(`${objectUrl(target, objectId)}/permissions`);
+	if (data === null || Array.isArray(data.holders) === false) {
+		return { status, set: null }
+	}
+	return { status, set: data }
+}
+
+/**
+ * The set as it stood at a moment, from the object's audit trail.
+ *
+ * @param {object} target   The target.
+ * @param {string} objectId The object id.
+ * @param {string} at       An ISO-8601 moment.
+ * @return {Promise<{status: number, history: object|null}>} The status and the history.
+ */
+async function fetchAccessHistory(target, objectId, at) {
+	const { status, data } = await readResult(`${objectUrl(target, objectId)}/permissions/history`, { at });
+	if (data === null || Array.isArray(data.changes) === false) {
+		return { status, history: null }
+	}
+	return { status, history: data }
+}
+
+/**
+ * The end and the area written on one rule, as OpenRegister reported them.
+ *
+ * Neither is compared to anything: whether an expired grant still answers is
+ * resolved in OpenRegister. A role grant carries the whole holder list, so the
+ * entry naming this principal is picked out of it.
+ *
+ * @param {object|Array|string|null} rule      The rule as written.
+ * @param {string}                   principal The holder of the row.
+ * @return {{until: string, scopedTo: object|null}} The end and the area.
+ */
+function constraintsOf(rule, principal) {
+	const none = { until: '', scopedTo: null };
+	if (rule === null || typeof rule !== 'object') {
+		return none
+	}
+
+	let entry = rule;
+	if (Array.isArray(rule)) {
+		entry = rule.find((candidate) => candidate === principal
+			|| (candidate !== null
+				&& typeof candidate === 'object'
+				&& [candidate.principal, candidate.group, candidate.role, candidate.user].includes(principal)));
+	}
+
+	if (entry === null || typeof entry !== 'object' || Array.isArray(entry)) {
+		return none
+	}
+
+	return {
+		until: typeof entry.until === 'string' ? entry.until : '',
+		scopedTo: entry.scopedTo || null,
+	}
+}
+
+/**
+ * One reported rule as a row.
+ *
+ * @param {object}  rule      The rule.
+ * @param {boolean} refusing  Whether the rule takes a right away.
+ * @param {boolean} enforcing Whether refusals are in force.
+ * @return {object} The row.
+ */
+function ruleRow(rule, refusing, enforcing) {
+	const principal = rule?.principal || '';
+	const { until, scopedTo } = constraintsOf(rule?.rule ?? null, principal);
+
+	let source = rule?.level || 'object';
+	if (refusing === true) {
+		source = enforcing === true ? 'deny' : 'staged-deny';
+	}
+
+	return {
+		holder: principal,
+		right: rule?.action || '',
+		source,
+		detail: rule?.role || '',
+		inheritedFrom: rule?.inheritedFrom || '',
+		level: rule?.level || '',
+		role: rule?.role || '',
+		declared: rule?.declared !== false,
+		conditional: rule?.conditional === true,
+		until,
+		scopedTo,
+	}
+}
+
+/**
+ * The object's own permission set as rows. A deny is its own row.
+ *
+ * @param {object|null} set The set from `fetchObjectPermissions`.
+ * @return {Array<object>} The rows.
+ */
+function objectPermissionRows(set) {
+	if (set === null || typeof set !== 'object') {
+		return []
+	}
+
+	const enforcing = set.denyEnforcement === 'enforcing';
+	const rows = [];
+	for (const holder of set.holders || []) {
+		for (const rule of holder?.rules || []) {
+			rows.push(ruleRow(rule, false, enforcing));
+		}
+	}
+	for (const rule of set.denied || []) {
+		rows.push(ruleRow(rule, true, enforcing));
+	}
+	return rows
+}
+
+/**
+ * The set as it stood at the moment asked about.
+ *
+ * `asOf: null` (the trail does not reach back that far) is "unanswered", never
+ * an empty table: an empty table would claim nobody held a right that day.
+ *
+ * @param {object|null} history The history from `fetchAccessHistory`.
+ * @return {{answered: boolean, at: string, rows: Array<object>, setBy: string, changedAfterwardsBy: object|null}} The answer.
+ */
+function asOfRows(history) {
+	const unanswered = { answered: false, at: history?.at || '', rows: [], setBy: '', changedAfterwardsBy: null };
+
+	const asOf = history?.asOf || null;
+	if (asOf === null || typeof asOf !== 'object') {
+		return unanswered
+	}
+
+	const rows = [];
+	for (const holder of asOf.holders || []) {
+		for (const rule of holder?.rules || []) {
+			rows.push(ruleRow(rule, false, false));
+		}
+	}
+
+	return {
+		answered: true,
+		at: asOf.at || history?.at || '',
+		rows,
+		setBy: asOf.setBy || '',
+		changedAfterwardsBy: asOf.changedAfterwardsBy || null,
+	}
+}
+
+/**
+ * All answers as one list of rows. A renderer, not an evaluator: each row
+ * restates ONE reported rule, and no row is the product of two.
+ *
+ * When the object answered for itself the share, role and deny reads are not
+ * replayed on top (the same grant would be counted twice). The caller's own
+ * verdict always rides along last, because it is the one answer about this
+ * reader rather than a rule about everybody.
+ *
+ * @param {object}      answers                   The reads.
+ * @param {object|null} answers.objectPermissions The object's own set.
+ * @param {Array|null}  answers.objectGrants      Grants on the object.
+ * @param {object|null} answers.roleGrants        Roles and their verbs.
+ * @param {object|null} answers.callerScope       The caller's own verdict.
+ * @param {object|null} answers.denyRules         The deny rules.
+ * @return {Array<object>} The rows.
+ */
+function grantRows({ objectPermissions = null, objectGrants, roleGrants, callerScope, denyRules }) {
+	const rows = [];
+
+	if (objectPermissions !== null) {
+		rows.push(...objectPermissionRows(objectPermissions));
+	}
+
+	for (const grant of (objectPermissions === null ? objectGrants : null) || []) {
+		for (const right of grant?.actions || []) {
+			rows.push({
+				holder: grant.principal || grant.userId || grant.groupId || '',
+				right,
+				// `inheritedFrom` is the id of the ancestor, not a source key.
+				source: grant.source || (grant.inheritedFrom ? 'inherited' : 'share'),
+				inheritedFrom: grant.inheritedFrom || '',
+				detail: grant.expires ? String(grant.expires) : '',
+			});
+		}
+	}
+
+	for (const role of (objectPermissions === null ? roleGrants?.roles : null) || []) {
+		for (const right of role?.actions || []) {
+			rows.push({ holder: role.role || '', right, source: 'role', detail: '' });
+		}
+	}
+
+	for (const rule of (objectPermissions === null ? denyRules?.rules : null) || []) {
+		rows.push({
+			holder: rule.principal || '',
+			right: rule.action || '',
+			source: denyRules.enforcing ? 'deny' : 'staged-deny',
+			detail: rule.level ? `${rule.level}: ${rule.subject || ''}` : '',
+		});
+	}
+
+	for (const [right, record] of Object.entries(callerScope?.provenance || {})) {
+		rows.push({
+			holder: callerScope.user || '',
+			right,
+			source: record?.source || 'unknown',
+			granted: record?.granted,
+			detail: record?.role || record?.principal || '',
+			stagedDeny: record?.stagedDeny || null,
+		});
+	}
+
+	return rows
+}
+
+/**
+ * The id a reference carries, as a uuid string or as an expanded object.
+ *
+ * @param {unknown} value The reference.
+ * @return {string} The id, or ''.
+ */
+function referenceId(value) {
+	if (value && typeof value === 'object') {
+		return String(value['@self']?.id ?? value.id ?? value.uuid ?? '')
+	}
+	return String(value ?? '')
+}
+
+/**
+ * The object's decided field rules, and the per-role field rules its TYPE
+ * object declares.
+ *
+ * Two reads, because they answer different questions: `@self.fieldRules` is
+ * what OpenRegister decided for THIS reader, the declaration on the type
+ * object is the rule behind it. Neither is evaluated here.
+ *
+ * @param {object} target          The target.
+ * @param {string} objectId        The object id.
+ * @param {object} config          Where the declaration lives.
+ * @param {string} config.typeField        Field on the object referencing its type object.
+ * @param {string} config.typeSchema       Schema of the type object (same register).
+ * @param {string} [config.declarationField] Field on the type object holding the rules.
+ * @return {Promise<{decided: object|null, declared: Array<object>|null}>} The answer.
+ */
+async function fetchFieldRoleRules(target, objectId, config) {
+	if (!objectId || !config?.typeField || !config?.typeSchema) {
+		return { decided: null, declared: null }
+	}
+
+	const object = await read(objectUrl(target, objectId));
+	if (object === null) {
+		return { decided: null, declared: null }
+	}
+
+	const decided = object['@self']?.fieldRules ?? null;
+	const typeId = referenceId(object[config.typeField]);
+	if (!typeId) {
+		return { decided, declared: null }
+	}
+
+	const type = await read(objectUrl(target, typeId, config.typeSchema));
+	if (type === null) {
+		return { decided, declared: null }
+	}
+
+	const declared = type[config.declarationField || 'fieldRoleRules'];
+	return { decided, declared: Array.isArray(declared) ? declared : [] }
+}
+
+/**
+ * The two things a role rule can do to a field. The spelling is OpenRegister's
+ * contract (`hidden`, `readOnly`); any other rule is dropped.
+ */
+const ROLE_RULES = ['hidden', 'readOnly'];
+
+/**
+ * The reader's word for each field rule.
+ *
+ * @return {object} The labels, by rule id.
+ */
+function roleRuleLabels() {
+	return {
+		hidden: translate('nextcloud-vue', 'Not shown'),
+		readOnly: translate('nextcloud-vue', 'Cannot be changed'),
+	}
+}
+
+/**
+ * A declared list of names, blanks and repeats removed.
+ *
+ * @param {unknown} value The list.
+ * @return {Array<string>} The names.
+ */
+function names(value) {
+	if (Array.isArray(value) === false) {
+		return []
+	}
+	const found = [];
+	value.forEach((entry) => {
+		const name = String(entry ?? '').trim();
+		if (name !== '' && found.includes(name) === false) {
+			found.push(name);
+		}
+	});
+	return found
+}
+
+/**
+ * Whether OpenRegister applied this rule to the reader. False when the object
+ * carries no decision at all (an older OpenRegister), never invented.
+ *
+ * @param {string}      field   The field.
+ * @param {string}      rule    The rule.
+ * @param {object|null} decided The object's `@self.fieldRules`.
+ * @return {boolean} True when the reader met this rule.
+ */
+function appliesToMe(field, rule, decided) {
+	const applied = decided?.[rule];
+	if (Array.isArray(applied) === false) {
+		return false
+	}
+	return applied.map((name) => String(name)).includes(field)
+}
+
+/**
+ * The declared field rules as rows. A row naming no field, or an unknown rule,
+ * is dropped rather than rendered blank.
+ *
+ * @param {Array<object>|null} declared The declaration.
+ * @param {object|null}        decided  The object's `@self.fieldRules`.
+ * @return {Array<object>} The rows.
+ */
+function fieldRoleRows(declared, decided) {
+	if (Array.isArray(declared) === false) {
+		return []
+	}
+
+	return declared
+		.filter((rule) => rule && ROLE_RULES.includes(rule.rule) && typeof rule.field === 'string' && rule.field.trim() !== '')
+		.map((rule) => {
+			const field = rule.field.trim();
+			return {
+				field,
+				rule: rule.rule,
+				groups: names(rule.groups),
+				heldBy: names(rule.heldBy),
+				reason: String(rule.reason ?? '').trim(),
+				appliesToMe: appliesToMe(field, rule.rule, decided),
+			}
+		})
+}
+
+/**
+ * One field-rule row as a whole sentence (whole sentences, so a translator can
+ * reorder the groups).
+ *
+ * @param {object} row One row from `fieldRoleRows`.
+ * @return {string} The sentence.
+ */
+function roleRuleSentence(row) {
+	const groups = row?.groups?.join(', ') ?? '';
+	const heldBy = row?.heldBy?.join(', ') ?? '';
+
+	if (row?.rule === 'hidden' && heldBy !== '') {
+		return translate('nextcloud-vue', '{groups} do not see this field. {heldBy} do.', { groups, heldBy })
+	}
+	if (row?.rule === 'hidden') {
+		return translate('nextcloud-vue', '{groups} do not see this field.', { groups })
+	}
+	if (heldBy !== '') {
+		return translate('nextcloud-vue', '{groups} cannot change this field. {heldBy} can.', { groups, heldBy })
+	}
+	return translate('nextcloud-vue', '{groups} cannot change this field.', { groups })
+}
+
+export { DEFAULT_API_BASE, ROLE_RULES, asOfRows, constraintsOf, fetchAccessHistory, fetchCallerScope, fetchDenyRules, fetchFieldRoleRules, fetchObjectGrants, fetchObjectPermissions, fetchPermissionCatalogue, fetchRoleGrants, fieldRoleRows, grantRows, objectPermissionRows, roleRuleLabels, roleRuleSentence };
+//# sourceMappingURL=objectPermissions.js.map

package/dist/esm/utils/objectPermissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"objectPermissions.js","sources":["../../../src/utils/objectPermissions.js"],"sourcesContent":["/**\n * SPDX-FileCopyrightText: 2026 Conduction B.V.\n * SPDX-License-Identifier: EUPL-1.2\n *\n * Who holds which right on one OpenRegister object, and where each grant came\n * from. The reads behind CnObjectPermissionsTab.\n *\n * Every function here is a read. Nothing decides who may open an object: the\n * grant, its provenance, the deny and the inheritance live in OpenRegister, and\n * these helpers hand on what it answered. A deny is never subtracted from a\n * grant, a missing answer is never filled with a default, and nothing is\n * cached: a copy of an access decision is a second decision nobody updates.\n *\n * The object's own permission set (`/permissions`) is preferred; an older\n * OpenRegister answers 404 to it, and then five reads are the fallback:\n *\n *   GET {apiBase}/permissions                                  the verb catalogue + deny mode\n *   GET {apiBase}/objects/{register}/{schema}/{id}/shares      grants written on the object\n *   GET {apiBase}/permissions/compare-roles?register=          each role and its verbs\n *   GET {apiBase}/scopes?register=&schema=                     the caller's own verdict + provenance\n *   GET {apiBase}/permissions/deny-preview?register=&schema=   the deny rules as written\n *\n * plus the history read `{...}/{id}/permissions/history?at=` for \"who held a\n * right on a date\".\n *\n * A failed read answers `null`, never `[]`: \"we could not ask\" and \"nobody\n * holds this\" are opposite answers that would otherwise render as the same\n * empty table.\n */\nimport axios from '@nextcloud/axios'\nimport { translate as t } from '@nextcloud/l10n'\nimport { prefixUrl } from './headers.js'\n\n/** The OpenRegister API root a target defaults to. */\nexport const DEFAULT_API_BASE = '/apps/openregister/api'\n\n/**\n * Normalise a target to `{register, schema, apiBase}`.\n *\n * @param {object} target The object's register, schema and optional apiBase.\n * @return {{register: string, schema: string, apiBase: string}} The target.\n */\nfunction normalise(target = {}) {\n\treturn {\n\t\tregister: String(target.register || ''),\n\t\tschema: String(target.schema || ''),\n\t\tapiBase: String(target.apiBase || DEFAULT_API_BASE).replace(/\\/$/, ''),\n\t}\n}\n\n/**\n * GET one path, keeping the status beside the body.\n *\n * The status is part of the answer: a 403 on the access set means the reader\n * may open the object and may not enumerate who else can, which is not a\n * failed read. A transport failure has no status and reports 0. A non-JSON\n * body (the SPA shell answering 200) is a failed read, not \"no rules\".\n *\n * @param {string} url    App-absolute URL.\n * @param {object} params Query parameters.\n * @return {Promise<{status: number, data: object|null}>} The status and the body.\n */\nasync function readResult(url, params = {}) {\n\ttry {\n\t\tconst response = await axios.get(prefixUrl(url), { params })\n\t\tif (typeof response?.data !== 'object' || response.data === null) {\n\t\t\treturn { status: response?.status || 0, data: null }\n\t\t}\n\t\treturn { status: response.status || 200, data: response.data }\n\t} catch (error) {\n\t\treturn { status: error?.response?.status || 0, data: null }\n\t}\n}\n\n/**\n * GET one path, answering null when it cannot be read.\n *\n * @param {string} url    App-absolute URL.\n * @param {object} params Query parameters.\n * @return {Promise<object|null>} The body, or null.\n */\nasync function read(url, params = {}) {\n\tconst { data } = await readResult(url, params)\n\treturn data\n}\n\n/**\n * The URL of one object, under its target.\n *\n * @param {object} target   The target.\n * @param {string} objectId The object id.\n * @param {string} [schema] A schema other than the target's.\n * @return {string} The URL.\n */\nfunction objectUrl(target, objectId, schema) {\n\tconst { register, apiBase } = normalise(target)\n\treturn `${apiBase}/objects/${register}/${schema || normalise(target).schema}/${objectId}`\n}\n\n/**\n * The grantable verbs and the deny enforcement mode.\n *\n * @param {object} target The target (only `apiBase` is read).\n * @return {Promise<object|null>} `{permissions, denyEnforcement}`, or null.\n */\nexport function fetchPermissionCatalogue(target) {\n\treturn read(`${normalise(target).apiBase}/permissions`)\n}\n\n/**\n * The grants written on one object.\n *\n * @param {object} target   The target.\n * @param {string} objectId The object id.\n * @return {Promise<Array|null>} The grants, or null.\n */\nexport async function fetchObjectGrants(target, objectId) {\n\tconst body = await read(`${objectUrl(target, objectId)}/shares`)\n\tif (body === null || !Array.isArray(body.results)) {\n\t\treturn null\n\t}\n\treturn body.results\n}\n\n/**\n * Each role in the register and the verbs it holds.\n *\n * @param {object} target The target.\n * @return {Promise<object|null>} `{roles}`, or null.\n */\nexport function fetchRoleGrants(target) {\n\tconst { apiBase, register } = normalise(target)\n\treturn read(`${apiBase}/permissions/compare-roles`, { register })\n}\n\n/**\n * The caller's own effective verbs on the schema, with their provenance.\n *\n * The endpoint answers a matrix even when narrowed, so the row is picked by\n * schema name rather than by position.\n *\n * @param {object} target The target.\n * @return {Promise<object|null>} The scope entry, or null.\n */\nexport async function fetchCallerScope(target) {\n\tconst { apiBase, register, schema } = normalise(target)\n\tconst body = await read(`${apiBase}/scopes`, { register, schema })\n\tif (body === null || !Array.isArray(body.scopes)) {\n\t\treturn null\n\t}\n\tconst scope = body.scopes.find((entry) => entry?.schema === schema)\n\tif (!scope) {\n\t\treturn null\n\t}\n\treturn { user: body.user, isAdmin: body.isAdmin, groups: body.groups, ...scope }\n}\n\n/**\n * The deny rules as written for the register and schema.\n *\n * @param {object} target The target.\n * @return {Promise<object|null>} `{denyEnforcement, enforcing, rules}`, or null.\n */\nexport function fetchDenyRules(target) {\n\tconst { apiBase, register, schema } = normalise(target)\n\treturn read(`${apiBase}/permissions/deny-preview`, { register, schema })\n}\n\n/**\n * The permission set OpenRegister publishes for this object, with its status.\n *\n * @param {object} target   The target.\n * @param {string} objectId The object id.\n * @return {Promise<{status: number, set: object|null}>} The status and the set.\n */\nexport async function fetchObjectPermissions(target, objectId) {\n\tconst { status, data } = await readResult(`${objectUrl(target, objectId)}/permissions`)\n\tif (data === null || Array.isArray(data.holders) === false) {\n\t\treturn { status, set: null }\n\t}\n\treturn { status, set: data }\n}\n\n/**\n * The set as it stood at a moment, from the object's audit trail.\n *\n * @param {object} target   The target.\n * @param {string} objectId The object id.\n * @param {string} at       An ISO-8601 moment.\n * @return {Promise<{status: number, history: object|null}>} The status and the history.\n */\nexport async function fetchAccessHistory(target, objectId, at) {\n\tconst { status, data } = await readResult(`${objectUrl(target, objectId)}/permissions/history`, { at })\n\tif (data === null || Array.isArray(data.changes) === false) {\n\t\treturn { status, history: null }\n\t}\n\treturn { status, history: data }\n}\n\n/**\n * The end and the area written on one rule, as OpenRegister reported them.\n *\n * Neither is compared to anything: whether an expired grant still answers is\n * resolved in OpenRegister. A role grant carries the whole holder list, so the\n * entry naming this principal is picked out of it.\n *\n * @param {object|Array|string|null} rule      The rule as written.\n * @param {string}                   principal The holder of the row.\n * @return {{until: string, scopedTo: object|null}} The end and the area.\n */\nexport function constraintsOf(rule, principal) {\n\tconst none = { until: '', scopedTo: null }\n\tif (rule === null || typeof rule !== 'object') {\n\t\treturn none\n\t}\n\n\tlet entry = rule\n\tif (Array.isArray(rule)) {\n\t\tentry = rule.find((candidate) => candidate === principal\n\t\t\t|| (candidate !== null\n\t\t\t\t&& typeof candidate === 'object'\n\t\t\t\t&& [candidate.principal, candidate.group, candidate.role, candidate.user].includes(principal)))\n\t}\n\n\tif (entry === null || typeof entry !== 'object' || Array.isArray(entry)) {\n\t\treturn none\n\t}\n\n\treturn {\n\t\tuntil: typeof entry.until === 'string' ? entry.until : '',\n\t\tscopedTo: entry.scopedTo || null,\n\t}\n}\n\n/**\n * One reported rule as a row.\n *\n * @param {object}  rule      The rule.\n * @param {boolean} refusing  Whether the rule takes a right away.\n * @param {boolean} enforcing Whether refusals are in force.\n * @return {object} The row.\n */\nfunction ruleRow(rule, refusing, enforcing) {\n\tconst principal = rule?.principal || ''\n\tconst { until, scopedTo } = constraintsOf(rule?.rule ?? null, principal)\n\n\tlet source = rule?.level || 'object'\n\tif (refusing === true) {\n\t\tsource = enforcing === true ? 'deny' : 'staged-deny'\n\t}\n\n\treturn {\n\t\tholder: principal,\n\t\tright: rule?.action || '',\n\t\tsource,\n\t\tdetail: rule?.role || '',\n\t\tinheritedFrom: rule?.inheritedFrom || '',\n\t\tlevel: rule?.level || '',\n\t\trole: rule?.role || '',\n\t\tdeclared: rule?.declared !== false,\n\t\tconditional: rule?.conditional === true,\n\t\tuntil,\n\t\tscopedTo,\n\t}\n}\n\n/**\n * The object's own permission set as rows. A deny is its own row.\n *\n * @param {object|null} set The set from `fetchObjectPermissions`.\n * @return {Array<object>} The rows.\n */\nexport function objectPermissionRows(set) {\n\tif (set === null || typeof set !== 'object') {\n\t\treturn []\n\t}\n\n\tconst enforcing = set.denyEnforcement === 'enforcing'\n\tconst rows = []\n\tfor (const holder of set.holders || []) {\n\t\tfor (const rule of holder?.rules || []) {\n\t\t\trows.push(ruleRow(rule, false, enforcing))\n\t\t}\n\t}\n\tfor (const rule of set.denied || []) {\n\t\trows.push(ruleRow(rule, true, enforcing))\n\t}\n\treturn rows\n}\n\n/**\n * The set as it stood at the moment asked about.\n *\n * `asOf: null` (the trail does not reach back that far) is \"unanswered\", never\n * an empty table: an empty table would claim nobody held a right that day.\n *\n * @param {object|null} history The history from `fetchAccessHistory`.\n * @return {{answered: boolean, at: string, rows: Array<object>, setBy: string, changedAfterwardsBy: object|null}} The answer.\n */\nexport function asOfRows(history) {\n\tconst unanswered = { answered: false, at: history?.at || '', rows: [], setBy: '', changedAfterwardsBy: null }\n\n\tconst asOf = history?.asOf || null\n\tif (asOf === null || typeof asOf !== 'object') {\n\t\treturn unanswered\n\t}\n\n\tconst rows = []\n\tfor (const holder of asOf.holders || []) {\n\t\tfor (const rule of holder?.rules || []) {\n\t\t\trows.push(ruleRow(rule, false, false))\n\t\t}\n\t}\n\n\treturn {\n\t\tanswered: true,\n\t\tat: asOf.at || history?.at || '',\n\t\trows,\n\t\tsetBy: asOf.setBy || '',\n\t\tchangedAfterwardsBy: asOf.changedAfterwardsBy || null,\n\t}\n}\n\n/**\n * All answers as one list of rows. A renderer, not an evaluator: each row\n * restates ONE reported rule, and no row is the product of two.\n *\n * When the object answered for itself the share, role and deny reads are not\n * replayed on top (the same grant would be counted twice). The caller's own\n * verdict always rides along last, because it is the one answer about this\n * reader rather than a rule about everybody.\n *\n * @param {object}      answers                   The reads.\n * @param {object|null} answers.objectPermissions The object's own set.\n * @param {Array|null}  answers.objectGrants      Grants on the object.\n * @param {object|null} answers.roleGrants        Roles and their verbs.\n * @param {object|null} answers.callerScope       The caller's own verdict.\n * @param {object|null} answers.denyRules         The deny rules.\n * @return {Array<object>} The rows.\n */\nexport function grantRows({ objectPermissions = null, objectGrants, roleGrants, callerScope, denyRules }) {\n\tconst rows = []\n\n\tif (objectPermissions !== null) {\n\t\trows.push(...objectPermissionRows(objectPermissions))\n\t}\n\n\tfor (const grant of (objectPermissions === null ? objectGrants : null) || []) {\n\t\tfor (const right of grant?.actions || []) {\n\t\t\trows.push({\n\t\t\t\tholder: grant.principal || grant.userId || grant.groupId || '',\n\t\t\t\tright,\n\t\t\t\t// `inheritedFrom` is the id of the ancestor, not a source key.\n\t\t\t\tsource: grant.source || (grant.inheritedFrom ? 'inherited' : 'share'),\n\t\t\t\tinheritedFrom: grant.inheritedFrom || '',\n\t\t\t\tdetail: grant.expires ? String(grant.expires) : '',\n\t\t\t})\n\t\t}\n\t}\n\n\tfor (const role of (objectPermissions === null ? roleGrants?.roles : null) || []) {\n\t\tfor (const right of role?.actions || []) {\n\t\t\trows.push({ holder: role.role || '', right, source: 'role', detail: '' })\n\t\t}\n\t}\n\n\tfor (const rule of (objectPermissions === null ? denyRules?.rules : null) || []) {\n\t\trows.push({\n\t\t\tholder: rule.principal || '',\n\t\t\tright: rule.action || '',\n\t\t\tsource: denyRules.enforcing ? 'deny' : 'staged-deny',\n\t\t\tdetail: rule.level ? `${rule.level}: ${rule.subject || ''}` : '',\n\t\t})\n\t}\n\n\tfor (const [right, record] of Object.entries(callerScope?.provenance || {})) {\n\t\trows.push({\n\t\t\tholder: callerScope.user || '',\n\t\t\tright,\n\t\t\tsource: record?.source || 'unknown',\n\t\t\tgranted: record?.granted,\n\t\t\tdetail: record?.role || record?.principal || '',\n\t\t\tstagedDeny: record?.stagedDeny || null,\n\t\t})\n\t}\n\n\treturn rows\n}\n\n/**\n * The id a reference carries, as a uuid string or as an expanded object.\n *\n * @param {unknown} value The reference.\n * @return {string} The id, or ''.\n */\nfunction referenceId(value) {\n\tif (value && typeof value === 'object') {\n\t\treturn String(value['@self']?.id ?? value.id ?? value.uuid ?? '')\n\t}\n\treturn String(value ?? '')\n}\n\n/**\n * The object's decided field rules, and the per-role field rules its TYPE\n * object declares.\n *\n * Two reads, because they answer different questions: `@self.fieldRules` is\n * what OpenRegister decided for THIS reader, the declaration on the type\n * object is the rule behind it. Neither is evaluated here.\n *\n * @param {object} target          The target.\n * @param {string} objectId        The object id.\n * @param {object} config          Where the declaration lives.\n * @param {string} config.typeField        Field on the object referencing its type object.\n * @param {string} config.typeSchema       Schema of the type object (same register).\n * @param {string} [config.declarationField] Field on the type object holding the rules.\n * @return {Promise<{decided: object|null, declared: Array<object>|null}>} The answer.\n */\nexport async function fetchFieldRoleRules(target, objectId, config) {\n\tif (!objectId || !config?.typeField || !config?.typeSchema) {\n\t\treturn { decided: null, declared: null }\n\t}\n\n\tconst object = await read(objectUrl(target, objectId))\n\tif (object === null) {\n\t\treturn { decided: null, declared: null }\n\t}\n\n\tconst decided = object['@self']?.fieldRules ?? null\n\tconst typeId = referenceId(object[config.typeField])\n\tif (!typeId) {\n\t\treturn { decided, declared: null }\n\t}\n\n\tconst type = await read(objectUrl(target, typeId, config.typeSchema))\n\tif (type === null) {\n\t\treturn { decided, declared: null }\n\t}\n\n\tconst declared = type[config.declarationField || 'fieldRoleRules']\n\treturn { decided, declared: Array.isArray(declared) ? declared : [] }\n}\n\n/**\n * The two things a role rule can do to a field. The spelling is OpenRegister's\n * contract (`hidden`, `readOnly`); any other rule is dropped.\n */\nexport const ROLE_RULES = ['hidden', 'readOnly']\n\n/**\n * The reader's word for each field rule.\n *\n * @return {object} The labels, by rule id.\n */\nexport function roleRuleLabels() {\n\treturn {\n\t\thidden: t('nextcloud-vue', 'Not shown'),\n\t\treadOnly: t('nextcloud-vue', 'Cannot be changed'),\n\t}\n}\n\n/**\n * A declared list of names, blanks and repeats removed.\n *\n * @param {unknown} value The list.\n * @return {Array<string>} The names.\n */\nfunction names(value) {\n\tif (Array.isArray(value) === false) {\n\t\treturn []\n\t}\n\tconst found = []\n\tvalue.forEach((entry) => {\n\t\tconst name = String(entry ?? '').trim()\n\t\tif (name !== '' && found.includes(name) === false) {\n\t\t\tfound.push(name)\n\t\t}\n\t})\n\treturn found\n}\n\n/**\n * Whether OpenRegister applied this rule to the reader. False when the object\n * carries no decision at all (an older OpenRegister), never invented.\n *\n * @param {string}      field   The field.\n * @param {string}      rule    The rule.\n * @param {object|null} decided The object's `@self.fieldRules`.\n * @return {boolean} True when the reader met this rule.\n */\nfunction appliesToMe(field, rule, decided) {\n\tconst applied = decided?.[rule]\n\tif (Array.isArray(applied) === false) {\n\t\treturn false\n\t}\n\treturn applied.map((name) => String(name)).includes(field)\n}\n\n/**\n * The declared field rules as rows. A row naming no field, or an unknown rule,\n * is dropped rather than rendered blank.\n *\n * @param {Array<object>|null} declared The declaration.\n * @param {object|null}        decided  The object's `@self.fieldRules`.\n * @return {Array<object>} The rows.\n */\nexport function fieldRoleRows(declared, decided) {\n\tif (Array.isArray(declared) === false) {\n\t\treturn []\n\t}\n\n\treturn declared\n\t\t.filter((rule) => rule && ROLE_RULES.includes(rule.rule) && typeof rule.field === 'string' && rule.field.trim() !== '')\n\t\t.map((rule) => {\n\t\t\tconst field = rule.field.trim()\n\t\t\treturn {\n\t\t\t\tfield,\n\t\t\t\trule: rule.rule,\n\t\t\t\tgroups: names(rule.groups),\n\t\t\t\theldBy: names(rule.heldBy),\n\t\t\t\treason: String(rule.reason ?? '').trim(),\n\t\t\t\tappliesToMe: appliesToMe(field, rule.rule, decided),\n\t\t\t}\n\t\t})\n}\n\n/**\n * One field-rule row as a whole sentence (whole sentences, so a translator can\n * reorder the groups).\n *\n * @param {object} row One row from `fieldRoleRows`.\n * @return {string} The sentence.\n */\nexport function roleRuleSentence(row) {\n\tconst groups = row?.groups?.join(', ') ?? ''\n\tconst heldBy = row?.heldBy?.join(', ') ?? ''\n\n\tif (row?.rule === 'hidden' && heldBy !== '') {\n\t\treturn t('nextcloud-vue', '{groups} do not see this field. {heldBy} do.', { groups, heldBy })\n\t}\n\tif (row?.rule === 'hidden') {\n\t\treturn t('nextcloud-vue', '{groups} do not see this field.', { groups })\n\t}\n\tif (heldBy !== '') {\n\t\treturn t('nextcloud-vue', '{groups} cannot change this field. {heldBy} can.', { groups, heldBy })\n\t}\n\treturn t('nextcloud-vue', '{groups} cannot change this field.', { groups })\n}\n"],"names":["axios","t"],"mappings":";;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAIA;AACA;AACY,MAAC,gBAAgB,GAAG,yBAAwB;AACxD;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE;AAChC,CAAC,OAAO;AACR,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;AACzC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;AACrC,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;AACxE,EAAE;AACF,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,EAAE,EAAE;AAC5C,CAAC,IAAI;AACL,EAAE,MAAM,QAAQ,GAAG,MAAMA,cAAK,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,EAAC;AAC9D,EAAE,IAAI,OAAO,QAAQ,EAAE,IAAI,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE;AACpE,GAAG,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;AACvD,GAAG;AACH,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE;AAChE,EAAE,CAAC,OAAO,KAAK,EAAE;AACjB,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;AAC7D,EAAE;AACF,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,EAAE,EAAE;AACtC,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,MAAM,EAAC;AAC/C,CAAC,OAAO,IAAI;AACZ,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,SAAS,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE;AAC7C,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC,MAAM,EAAC;AAChD,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC1F,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,wBAAwB,CAAC,MAAM,EAAE;AACjD,CAAC,OAAO,IAAI,CAAC,CAAC,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;AACxD,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAe,iBAAiB,CAAC,MAAM,EAAE,QAAQ,EAAE;AAC1D,CAAC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,CAAC,EAAE,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAC;AACjE,CAAC,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;AACpD,EAAE,OAAO,IAAI;AACb,EAAE;AACF,CAAC,OAAO,IAAI,CAAC,OAAO;AACpB,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,eAAe,CAAC,MAAM,EAAE;AACxC,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,SAAS,CAAC,MAAM,EAAC;AAChD,CAAC,OAAO,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,0BAA0B,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC;AAClE,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAe,gBAAgB,CAAC,MAAM,EAAE;AAC/C,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,MAAM,EAAC;AACxD,CAAC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAC;AACnE,CAAC,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;AACnD,EAAE,OAAO,IAAI;AACb,EAAE;AACF,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,EAAE,MAAM,KAAK,MAAM,EAAC;AACpE,CAAC,IAAI,CAAC,KAAK,EAAE;AACb,EAAE,OAAO,IAAI;AACb,EAAE;AACF,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,KAAK,EAAE;AACjF,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,cAAc,CAAC,MAAM,EAAE;AACvC,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,MAAM,EAAC;AACxD,CAAC,OAAO,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,yBAAyB,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AACzE,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAe,sBAAsB,CAAC,MAAM,EAAE,QAAQ,EAAE;AAC/D,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,UAAU,CAAC,CAAC,EAAE,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,YAAY,CAAC,EAAC;AACxF,CAAC,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,EAAE;AAC7D,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE;AAC9B,EAAE;AACF,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE;AAC7B,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAe,kBAAkB,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE;AAC/D,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,UAAU,CAAC,CAAC,EAAE,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,oBAAoB,CAAC,EAAE,EAAE,EAAE,EAAE,EAAC;AACxG,CAAC,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,EAAE;AAC7D,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE;AAClC,EAAE;AACF,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE;AACjC,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE;AAC/C,CAAC,MAAM,IAAI,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,GAAE;AAC3C,CAAC,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE;AAChD,EAAE,OAAO,IAAI;AACb,EAAE;AACF;AACA,CAAC,IAAI,KAAK,GAAG,KAAI;AACjB,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;AAC1B,EAAE,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,KAAK,SAAS;AAC1D,OAAO,SAAS,KAAK,IAAI;AACzB,OAAO,OAAO,SAAS,KAAK,QAAQ;AACpC,OAAO,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAC;AACnG,EAAE;AACF;AACA,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;AAC1E,EAAE,OAAO,IAAI;AACb,EAAE;AACF;AACA,CAAC,OAAO;AACR,EAAE,KAAK,EAAE,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,GAAG,KAAK,CAAC,KAAK,GAAG,EAAE;AAC3D,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;AAClC,EAAE;AACF,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE;AAC5C,CAAC,MAAM,SAAS,GAAG,IAAI,EAAE,SAAS,IAAI,GAAE;AACxC,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,aAAa,CAAC,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,SAAS,EAAC;AACzE;AACA,CAAC,IAAI,MAAM,GAAG,IAAI,EAAE,KAAK,IAAI,SAAQ;AACrC,CAAC,IAAI,QAAQ,KAAK,IAAI,EAAE;AACxB,EAAE,MAAM,GAAG,SAAS,KAAK,IAAI,GAAG,MAAM,GAAG,cAAa;AACtD,EAAE;AACF;AACA,CAAC,OAAO;AACR,EAAE,MAAM,EAAE,SAAS;AACnB,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,EAAE;AAC3B,EAAE,MAAM;AACR,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE;AAC1B,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa,IAAI,EAAE;AAC1C,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE;AAC1B,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE;AACxB,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,KAAK,KAAK;AACpC,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,KAAK,IAAI;AACzC,EAAE,KAAK;AACP,EAAE,QAAQ;AACV,EAAE;AACF,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,oBAAoB,CAAC,GAAG,EAAE;AAC1C,CAAC,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE;AAC9C,EAAE,OAAO,EAAE;AACX,EAAE;AACF;AACA,CAAC,MAAM,SAAS,GAAG,GAAG,CAAC,eAAe,KAAK,YAAW;AACtD,CAAC,MAAM,IAAI,GAAG,GAAE;AAChB,CAAC,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,EAAE;AACzC,EAAE,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,KAAK,IAAI,EAAE,EAAE;AAC1C,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,EAAC;AAC7C,GAAG;AACH,EAAE;AACF,CAAC,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE;AACtC,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,EAAC;AAC3C,EAAE;AACF,CAAC,OAAO,IAAI;AACZ,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,QAAQ,CAAC,OAAO,EAAE;AAClC,CAAC,MAAM,UAAU,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,mBAAmB,EAAE,IAAI,GAAE;AAC9G;AACA,CAAC,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,IAAI,KAAI;AACnC,CAAC,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE;AAChD,EAAE,OAAO,UAAU;AACnB,EAAE;AACF;AACA,CAAC,MAAM,IAAI,GAAG,GAAE;AAChB,CAAC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE;AAC1C,EAAE,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,KAAK,IAAI,EAAE,EAAE;AAC1C,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,EAAC;AACzC,GAAG;AACH,EAAE;AACF;AACA,CAAC,OAAO;AACR,EAAE,QAAQ,EAAE,IAAI;AAChB,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,EAAE,IAAI,EAAE;AAClC,EAAE,IAAI;AACN,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;AACzB,EAAE,mBAAmB,EAAE,IAAI,CAAC,mBAAmB,IAAI,IAAI;AACvD,EAAE;AACF,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,SAAS,CAAC,EAAE,iBAAiB,GAAG,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE;AAC1G,CAAC,MAAM,IAAI,GAAG,GAAE;AAChB;AACA,CAAC,IAAI,iBAAiB,KAAK,IAAI,EAAE;AACjC,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,iBAAiB,CAAC,EAAC;AACvD,EAAE;AACF;AACA,CAAC,KAAK,MAAM,KAAK,IAAI,CAAC,iBAAiB,KAAK,IAAI,GAAG,YAAY,GAAG,IAAI,KAAK,EAAE,EAAE;AAC/E,EAAE,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,OAAO,IAAI,EAAE,EAAE;AAC5C,GAAG,IAAI,CAAC,IAAI,CAAC;AACb,IAAI,MAAM,EAAE,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,IAAI,EAAE;AAClE,IAAI,KAAK;AACT;AACA,IAAI,MAAM,EAAE,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,aAAa,GAAG,WAAW,GAAG,OAAO,CAAC;AACzE,IAAI,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,EAAE;AAC5C,IAAI,MAAM,EAAE,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE;AACtD,IAAI,EAAC;AACL,GAAG;AACH,EAAE;AACF;AACA,CAAC,KAAK,MAAM,IAAI,IAAI,CAAC,iBAAiB,KAAK,IAAI,GAAG,UAAU,EAAE,KAAK,GAAG,IAAI,KAAK,EAAE,EAAE;AACnF,EAAE,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,OAAO,IAAI,EAAE,EAAE;AAC3C,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,EAAC;AAC5E,GAAG;AACH,EAAE;AACF;AACA,CAAC,KAAK,MAAM,IAAI,IAAI,CAAC,iBAAiB,KAAK,IAAI,GAAG,SAAS,EAAE,KAAK,GAAG,IAAI,KAAK,EAAE,EAAE;AAClF,EAAE,IAAI,CAAC,IAAI,CAAC;AACZ,GAAG,MAAM,EAAE,IAAI,CAAC,SAAS,IAAI,EAAE;AAC/B,GAAG,KAAK,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;AAC3B,GAAG,MAAM,EAAE,SAAS,CAAC,SAAS,GAAG,MAAM,GAAG,aAAa;AACvD,GAAG,MAAM,EAAE,IAAI,CAAC,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,EAAE;AACnE,GAAG,EAAC;AACJ,EAAE;AACF;AACA,CAAC,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,UAAU,IAAI,EAAE,CAAC,EAAE;AAC9E,EAAE,IAAI,CAAC,IAAI,CAAC;AACZ,GAAG,MAAM,EAAE,WAAW,CAAC,IAAI,IAAI,EAAE;AACjC,GAAG,KAAK;AACR,GAAG,MAAM,EAAE,MAAM,EAAE,MAAM,IAAI,SAAS;AACtC,GAAG,OAAO,EAAE,MAAM,EAAE,OAAO;AAC3B,GAAG,MAAM,EAAE,MAAM,EAAE,IAAI,IAAI,MAAM,EAAE,SAAS,IAAI,EAAE;AAClD,GAAG,UAAU,EAAE,MAAM,EAAE,UAAU,IAAI,IAAI;AACzC,GAAG,EAAC;AACJ,EAAE;AACF;AACA,CAAC,OAAO,IAAI;AACZ,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,WAAW,CAAC,KAAK,EAAE;AAC5B,CAAC,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE;AACzC,EAAE,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;AACnE,EAAE;AACF,CAAC,OAAO,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;AAC3B,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAe,mBAAmB,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE;AACpE,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,EAAE,SAAS,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE;AAC7D,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;AAC1C,EAAE;AACF;AACA,CAAC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAC;AACvD,CAAC,IAAI,MAAM,KAAK,IAAI,EAAE;AACtB,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;AAC1C,EAAE;AACF;AACA,CAAC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,EAAE,UAAU,IAAI,KAAI;AACpD,CAAC,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAC;AACrD,CAAC,IAAI,CAAC,MAAM,EAAE;AACd,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE;AACpC,EAAE;AACF;AACA,CAAC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,EAAC;AACtE,CAAC,IAAI,IAAI,KAAK,IAAI,EAAE;AACpB,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE;AACpC,EAAE;AACF;AACA,CAAC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,gBAAgB,EAAC;AACnE,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,GAAG,EAAE,EAAE;AACtE,CAAC;AACD;AACA;AACA;AACA;AACA;AACY,MAAC,UAAU,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAC;AAChD;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,cAAc,GAAG;AACjC,CAAC,OAAO;AACR,EAAE,MAAM,EAAEC,SAAC,CAAC,eAAe,EAAE,WAAW,CAAC;AACzC,EAAE,QAAQ,EAAEA,SAAC,CAAC,eAAe,EAAE,mBAAmB,CAAC;AACnD,EAAE;AACF,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,KAAK,CAAC,KAAK,EAAE;AACtB,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE;AACrC,EAAE,OAAO,EAAE;AACX,EAAE;AACF,CAAC,MAAM,KAAK,GAAG,GAAE;AACjB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,KAAK;AAC1B,EAAE,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,GAAE;AACzC,EAAE,IAAI,IAAI,KAAK,EAAE,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,KAAK,EAAE;AACrD,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,EAAC;AACnB,GAAG;AACH,EAAE,EAAC;AACH,CAAC,OAAO,KAAK;AACb,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE;AAC3C,CAAC,MAAM,OAAO,GAAG,OAAO,GAAG,IAAI,EAAC;AAChC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,KAAK,EAAE;AACvC,EAAE,OAAO,KAAK;AACd,EAAE;AACF,CAAC,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;AAC3D,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE;AACjD,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,KAAK,EAAE;AACxC,EAAE,OAAO,EAAE;AACX,EAAE;AACF;AACA,CAAC,OAAO,QAAQ;AAChB,GAAG,MAAM,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;AACzH,GAAG,GAAG,CAAC,CAAC,IAAI,KAAK;AACjB,GAAG,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,GAAE;AAClC,GAAG,OAAO;AACV,IAAI,KAAK;AACT,IAAI,IAAI,EAAE,IAAI,CAAC,IAAI;AACnB,IAAI,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;AAC9B,IAAI,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;AAC9B,IAAI,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;AAC5C,IAAI,WAAW,EAAE,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;AACvD,IAAI;AACJ,GAAG,CAAC;AACJ,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,gBAAgB,CAAC,GAAG,EAAE;AACtC,CAAC,MAAM,MAAM,GAAG,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,GAAE;AAC7C,CAAC,MAAM,MAAM,GAAG,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,GAAE;AAC7C;AACA,CAAC,IAAI,GAAG,EAAE,IAAI,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE,EAAE;AAC9C,EAAE,OAAOA,SAAC,CAAC,eAAe,EAAE,8CAA8C,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC/F,EAAE;AACF,CAAC,IAAI,GAAG,EAAE,IAAI,KAAK,QAAQ,EAAE;AAC7B,EAAE,OAAOA,SAAC,CAAC,eAAe,EAAE,iCAAiC,EAAE,EAAE,MAAM,EAAE,CAAC;AAC1E,EAAE;AACF,CAAC,IAAI,MAAM,KAAK,EAAE,EAAE;AACpB,EAAE,OAAOA,SAAC,CAAC,eAAe,EAAE,kDAAkD,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACnG,EAAE;AACF,CAAC,OAAOA,SAAC,CAAC,eAAe,EAAE,oCAAoC,EAAE,EAAE,MAAM,EAAE,CAAC;AAC5E;;;;"}