@contember/engine-content-api 1.4.0-rc.8 → 2.0.0-alpha.10

package/dist/development/src/acl/Authorizator.cjs

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const schema = require("@contember/schema");
+class Authorizator {
+  constructor(permissions, defaultCustomPrimary) {
+    this.permissions = permissions;
+    this.defaultCustomPrimary = defaultCustomPrimary;
+  }
+  getEntityPermission(operation, entity) {
+    if (!this.permissions[entity]) {
+      return "no";
+    }
+    const entityPermissions = this.permissions[entity];
+    if (operation === schema.Acl.Operation.delete) {
+      return this.predicateToResult(entityPermissions.operations.delete);
+    }
+    const fieldPermissions = entityPermissions.operations[operation];
+    if (!fieldPermissions) {
+      return "no";
+    }
+    return Object.values(fieldPermissions).filter((it) => !!it).length > 0 ? "yes" : "no";
+  }
+  getFieldPredicate(operation, entity, field) {
+    return this.permissions[entity]?.operations[operation]?.[field] ?? false;
+  }
+  getFieldPermissions(operation, entity, field) {
+    const fieldPermissions = this.getFieldPredicate(operation, entity, field);
+    if (!fieldPermissions) {
+      return "no";
+    }
+    return this.predicateToResult(fieldPermissions);
+  }
+  predicateToResult(predicate) {
+    if (!predicate) {
+      return "no";
+    }
+    if (predicate === true) {
+      return "yes";
+    }
+    return "maybe";
+  }
+  isCustomPrimaryAllowed(entity) {
+    return this.permissions?.[entity]?.operations?.customPrimary ?? this.defaultCustomPrimary;
+  }
+}
+exports.Authorizator = Authorizator;
+//# sourceMappingURL=Authorizator.cjs.map

package/dist/development/src/acl/Authorizator.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"Authorizator.cjs","sources":["../../../../../packages/engine-content-api/src/acl/Authorizator.ts"],"sourcesContent":["import { Acl } from '@contember/schema'\n\n\nexport type AuthorizationResult = 'yes' | 'no' | 'maybe'\n\nexport class Authorizator {\n\tconstructor(\n\t\tprivate readonly permissions: Acl.Permissions,\n\t\tprivate readonly defaultCustomPrimary: boolean,\n\t) {\n\t}\n\n\tgetEntityPermission(operation: Acl.Operation, entity: string): AuthorizationResult {\n\t\tif (!this.permissions[entity]) {\n\t\t\treturn 'no'\n\t\t}\n\t\tconst entityPermissions: Acl.EntityPermissions = this.permissions[entity]\n\n\t\tif (operation === Acl.Operation.delete) {\n\t\t\treturn this.predicateToResult(entityPermissions.operations.delete)\n\t\t}\n\t\tconst fieldPermissions = entityPermissions.operations[operation]\n\t\tif (!fieldPermissions) {\n\t\t\treturn 'no'\n\t\t}\n\t\treturn Object.values(fieldPermissions).filter(it => !!it).length > 0 ? 'yes' : 'no'\n\t}\n\n\tgetFieldPredicate(operation: Acl.Operation.create | Acl.Operation.read | Acl.Operation.update, entity: string, field: string): Acl.Predicate {\n\t\treturn this.permissions[entity]?.operations[operation]?.[field] ?? false\n\t}\n\n\tgetFieldPermissions(operation: Acl.Operation.create | Acl.Operation.read | Acl.Operation.update, entity: string, field: string): AuthorizationResult {\n\t\tconst fieldPermissions = this.getFieldPredicate(operation, entity, field)\n\t\tif (!fieldPermissions) {\n\t\t\treturn 'no'\n\t\t}\n\t\treturn this.predicateToResult(fieldPermissions)\n\t}\n\n\tprivate predicateToResult(predicate: Acl.Predicate | undefined): AuthorizationResult {\n\t\tif (!predicate) {\n\t\t\treturn 'no'\n\t\t}\n\t\tif (predicate === true) {\n\t\t\treturn 'yes'\n\t\t}\n\t\treturn 'maybe'\n\t}\n\n\n\tisCustomPrimaryAllowed(entity: string): boolean {\n\t\treturn this.permissions?.[entity]?.operations?.customPrimary ?? this.defaultCustomPrimary\n\t}\n}\n"],"names":["Acl"],"mappings":";;;AAKO,MAAM,aAAa;AAAA,EACzB,YACkB,aACA,sBAChB;AAFgB,SAAA,cAAA;AACA,SAAA,uBAAA;AAAA,EAElB;AAAA,EAEA,oBAAoB,WAA0B,QAAqC;AAClF,QAAI,CAAC,KAAK,YAAY,MAAM,GAAG;AACvB,aAAA;AAAA,IACR;AACM,UAAA,oBAA2C,KAAK,YAAY,MAAM;AAEpE,QAAA,cAAcA,OAAAA,IAAI,UAAU,QAAQ;AACvC,aAAO,KAAK,kBAAkB,kBAAkB,WAAW,MAAM;AAAA,IAClE;AACM,UAAA,mBAAmB,kBAAkB,WAAW,SAAS;AAC/D,QAAI,CAAC,kBAAkB;AACf,aAAA;AAAA,IACR;AACA,WAAO,OAAO,OAAO,gBAAgB,EAAE,OAAO,CAAA,OAAM,CAAC,CAAC,EAAE,EAAE,SAAS,IAAI,QAAQ;AAAA,EAChF;AAAA,EAEA,kBAAkB,WAA6E,QAAgB,OAA8B;AACrI,WAAA,KAAK,YAAY,MAAM,GAAG,WAAW,SAAS,IAAI,KAAK,KAAK;AAAA,EACpE;AAAA,EAEA,oBAAoB,WAA6E,QAAgB,OAAoC;AACpJ,UAAM,mBAAmB,KAAK,kBAAkB,WAAW,QAAQ,KAAK;AACxE,QAAI,CAAC,kBAAkB;AACf,aAAA;AAAA,IACR;AACO,WAAA,KAAK,kBAAkB,gBAAgB;AAAA,EAC/C;AAAA,EAEQ,kBAAkB,WAA2D;AACpF,QAAI,CAAC,WAAW;AACR,aAAA;AAAA,IACR;AACA,QAAI,cAAc,MAAM;AAChB,aAAA;AAAA,IACR;AACO,WAAA;AAAA,EACR;AAAA,EAGA,uBAAuB,QAAyB;AAC/C,WAAO,KAAK,cAAc,MAAM,GAAG,YAAY,iBAAiB,KAAK;AAAA,EACtE;AACD;;"}

package/dist/development/src/acl/Authorizator.js

@@ -0,0 +1,47 @@
+import { Acl } from "@contember/schema";
+class Authorizator {
+  constructor(permissions, defaultCustomPrimary) {
+    this.permissions = permissions;
+    this.defaultCustomPrimary = defaultCustomPrimary;
+  }
+  getEntityPermission(operation, entity) {
+    if (!this.permissions[entity]) {
+      return "no";
+    }
+    const entityPermissions = this.permissions[entity];
+    if (operation === Acl.Operation.delete) {
+      return this.predicateToResult(entityPermissions.operations.delete);
+    }
+    const fieldPermissions = entityPermissions.operations[operation];
+    if (!fieldPermissions) {
+      return "no";
+    }
+    return Object.values(fieldPermissions).filter((it) => !!it).length > 0 ? "yes" : "no";
+  }
+  getFieldPredicate(operation, entity, field) {
+    return this.permissions[entity]?.operations[operation]?.[field] ?? false;
+  }
+  getFieldPermissions(operation, entity, field) {
+    const fieldPermissions = this.getFieldPredicate(operation, entity, field);
+    if (!fieldPermissions) {
+      return "no";
+    }
+    return this.predicateToResult(fieldPermissions);
+  }
+  predicateToResult(predicate) {
+    if (!predicate) {
+      return "no";
+    }
+    if (predicate === true) {
+      return "yes";
+    }
+    return "maybe";
+  }
+  isCustomPrimaryAllowed(entity) {
+    return this.permissions?.[entity]?.operations?.customPrimary ?? this.defaultCustomPrimary;
+  }
+}
+export {
+  Authorizator
+};
+//# sourceMappingURL=Authorizator.js.map

package/dist/development/src/acl/Authorizator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Authorizator.js","sources":["../../../../../packages/engine-content-api/src/acl/Authorizator.ts"],"sourcesContent":["import { Acl } from '@contember/schema'\n\n\nexport type AuthorizationResult = 'yes' | 'no' | 'maybe'\n\nexport class Authorizator {\n\tconstructor(\n\t\tprivate readonly permissions: Acl.Permissions,\n\t\tprivate readonly defaultCustomPrimary: boolean,\n\t) {\n\t}\n\n\tgetEntityPermission(operation: Acl.Operation, entity: string): AuthorizationResult {\n\t\tif (!this.permissions[entity]) {\n\t\t\treturn 'no'\n\t\t}\n\t\tconst entityPermissions: Acl.EntityPermissions = this.permissions[entity]\n\n\t\tif (operation === Acl.Operation.delete) {\n\t\t\treturn this.predicateToResult(entityPermissions.operations.delete)\n\t\t}\n\t\tconst fieldPermissions = entityPermissions.operations[operation]\n\t\tif (!fieldPermissions) {\n\t\t\treturn 'no'\n\t\t}\n\t\treturn Object.values(fieldPermissions).filter(it => !!it).length > 0 ? 'yes' : 'no'\n\t}\n\n\tgetFieldPredicate(operation: Acl.Operation.create | Acl.Operation.read | Acl.Operation.update, entity: string, field: string): Acl.Predicate {\n\t\treturn this.permissions[entity]?.operations[operation]?.[field] ?? false\n\t}\n\n\tgetFieldPermissions(operation: Acl.Operation.create | Acl.Operation.read | Acl.Operation.update, entity: string, field: string): AuthorizationResult {\n\t\tconst fieldPermissions = this.getFieldPredicate(operation, entity, field)\n\t\tif (!fieldPermissions) {\n\t\t\treturn 'no'\n\t\t}\n\t\treturn this.predicateToResult(fieldPermissions)\n\t}\n\n\tprivate predicateToResult(predicate: Acl.Predicate | undefined): AuthorizationResult {\n\t\tif (!predicate) {\n\t\t\treturn 'no'\n\t\t}\n\t\tif (predicate === true) {\n\t\t\treturn 'yes'\n\t\t}\n\t\treturn 'maybe'\n\t}\n\n\n\tisCustomPrimaryAllowed(entity: string): boolean {\n\t\treturn this.permissions?.[entity]?.operations?.customPrimary ?? this.defaultCustomPrimary\n\t}\n}\n"],"names":[],"mappings":";AAKO,MAAM,aAAa;AAAA,EACzB,YACkB,aACA,sBAChB;AAFgB,SAAA,cAAA;AACA,SAAA,uBAAA;AAAA,EAElB;AAAA,EAEA,oBAAoB,WAA0B,QAAqC;AAClF,QAAI,CAAC,KAAK,YAAY,MAAM,GAAG;AACvB,aAAA;AAAA,IACR;AACM,UAAA,oBAA2C,KAAK,YAAY,MAAM;AAEpE,QAAA,cAAc,IAAI,UAAU,QAAQ;AACvC,aAAO,KAAK,kBAAkB,kBAAkB,WAAW,MAAM;AAAA,IAClE;AACM,UAAA,mBAAmB,kBAAkB,WAAW,SAAS;AAC/D,QAAI,CAAC,kBAAkB;AACf,aAAA;AAAA,IACR;AACA,WAAO,OAAO,OAAO,gBAAgB,EAAE,OAAO,CAAA,OAAM,CAAC,CAAC,EAAE,EAAE,SAAS,IAAI,QAAQ;AAAA,EAChF;AAAA,EAEA,kBAAkB,WAA6E,QAAgB,OAA8B;AACrI,WAAA,KAAK,YAAY,MAAM,GAAG,WAAW,SAAS,IAAI,KAAK,KAAK;AAAA,EACpE;AAAA,EAEA,oBAAoB,WAA6E,QAAgB,OAAoC;AACpJ,UAAM,mBAAmB,KAAK,kBAAkB,WAAW,QAAQ,KAAK;AACxE,QAAI,CAAC,kBAAkB;AACf,aAAA;AAAA,IACR;AACO,WAAA,KAAK,kBAAkB,gBAAgB;AAAA,EAC/C;AAAA,EAEQ,kBAAkB,WAA2D;AACpF,QAAI,CAAC,WAAW;AACR,aAAA;AAAA,IACR;AACA,QAAI,cAAc,MAAM;AAChB,aAAA;AAAA,IACR;AACO,WAAA;AAAA,EACR;AAAA,EAGA,uBAAuB,QAAyB;AAC/C,WAAO,KAAK,cAAc,MAAM,GAAG,YAAY,iBAAiB,KAAK;AAAA,EACtE;AACD;"}

package/dist/development/src/acl/EvaluatedPredicateReplacer.cjs

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const WhereReplacer = require("../mapper/select/optimizer/WhereReplacer.cjs");
+class EvaluatedPredicateReplacer {
+  constructor(evaluatedPredicate, sourceEntity, relation) {
+    this.evaluatedPredicate = evaluatedPredicate;
+    this.sourceEntity = sourceEntity;
+    this.relation = relation;
+  }
+  replace(where) {
+    const result = {};
+    for (const [key, value] of Object.entries(where)) {
+      if (key === "not") {
+        result["not"] = this.replace(value);
+      } else if (key === "and" || key === "or") {
+        result[key] = value.map((it) => this.replace(it));
+      } else if (key === this.relation.name) {
+        result[key] = WhereReplacer.replaceWhere(value, this.evaluatedPredicate, { [this.sourceEntity.primary]: { always: true } });
+      } else {
+        result[key] = value;
+      }
+    }
+    return result;
+  }
+}
+exports.EvaluatedPredicateReplacer = EvaluatedPredicateReplacer;
+//# sourceMappingURL=EvaluatedPredicateReplacer.cjs.map

package/dist/development/src/acl/EvaluatedPredicateReplacer.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"EvaluatedPredicateReplacer.cjs","sources":["../../../../../packages/engine-content-api/src/acl/EvaluatedPredicateReplacer.ts"],"sourcesContent":["import { Input, Model, Writable } from '@contember/schema'\nimport { replaceWhere } from '../mapper/select/optimizer/WhereReplacer'\n\nexport class EvaluatedPredicateReplacer {\n\tconstructor(\n\t\tprivate readonly evaluatedPredicate: Input.OptionalWhere,\n\t\tprivate readonly sourceEntity: Model.Entity,\n\t\tprivate readonly relation: Model.AnyRelation,\n\t) {\n\t}\n\n\tpublic replace(where: Input.OptionalWhere): Input.OptionalWhere {\n\t\tconst result: Writable<Input.OptionalWhere> = {}\n\t\tfor (const [key, value] of Object.entries(where)) {\n\t\t\tif (key === 'not') {\n\t\t\t\tresult['not'] = this.replace(value as Input.OptionalWhere)\n\n\t\t\t} else if (key === 'and' || key === 'or') {\n\t\t\t\tresult[key] = (value as Input.Where[]).map(it => this.replace(it))\n\n\t\t\t} else if (key === this.relation.name) {\n\t\t\t\tresult[key] = replaceWhere(value as Input.Where, this.evaluatedPredicate, { [this.sourceEntity.primary]: { always: true } })\n\n\t\t\t} else {\n\t\t\t\tresult[key] = value\n\t\t\t}\n\n\t\t}\n\t\treturn result\n\t}\n\n}\n"],"names":["replaceWhere"],"mappings":";;;AAGO,MAAM,2BAA2B;AAAA,EACvC,YACkB,oBACA,cACA,UAChB;AAHgB,SAAA,qBAAA;AACA,SAAA,eAAA;AACA,SAAA,WAAA;AAAA,EAElB;AAAA,EAEO,QAAQ,OAAiD;AAC/D,UAAM,SAAwC,CAAA;AAC9C,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,GAAG;AACjD,UAAI,QAAQ,OAAO;AAClB,eAAO,KAAK,IAAI,KAAK,QAAQ,KAA4B;AAAA,MAE/C,WAAA,QAAQ,SAAS,QAAQ,MAAM;AAClC,eAAA,GAAG,IAAK,MAAwB,IAAI,QAAM,KAAK,QAAQ,EAAE,CAAC;AAAA,MAEvD,WAAA,QAAQ,KAAK,SAAS,MAAM;AACtC,eAAO,GAAG,IAAIA,cAAAA,aAAa,OAAsB,KAAK,oBAAoB,EAAE,CAAC,KAAK,aAAa,OAAO,GAAG,EAAE,QAAQ,KAAA,EAAQ,CAAA;AAAA,MAAA,OAErH;AACN,eAAO,GAAG,IAAI;AAAA,MACf;AAAA,IAED;AACO,WAAA;AAAA,EACR;AAED;;"}

package/dist/development/src/acl/EvaluatedPredicateReplacer.js

@@ -0,0 +1,27 @@
+import { replaceWhere } from "../mapper/select/optimizer/WhereReplacer.js";
+class EvaluatedPredicateReplacer {
+  constructor(evaluatedPredicate, sourceEntity, relation) {
+    this.evaluatedPredicate = evaluatedPredicate;
+    this.sourceEntity = sourceEntity;
+    this.relation = relation;
+  }
+  replace(where) {
+    const result = {};
+    for (const [key, value] of Object.entries(where)) {
+      if (key === "not") {
+        result["not"] = this.replace(value);
+      } else if (key === "and" || key === "or") {
+        result[key] = value.map((it) => this.replace(it));
+      } else if (key === this.relation.name) {
+        result[key] = replaceWhere(value, this.evaluatedPredicate, { [this.sourceEntity.primary]: { always: true } });
+      } else {
+        result[key] = value;
+      }
+    }
+    return result;
+  }
+}
+export {
+  EvaluatedPredicateReplacer
+};
+//# sourceMappingURL=EvaluatedPredicateReplacer.js.map

package/dist/development/src/acl/EvaluatedPredicateReplacer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EvaluatedPredicateReplacer.js","sources":["../../../../../packages/engine-content-api/src/acl/EvaluatedPredicateReplacer.ts"],"sourcesContent":["import { Input, Model, Writable } from '@contember/schema'\nimport { replaceWhere } from '../mapper/select/optimizer/WhereReplacer'\n\nexport class EvaluatedPredicateReplacer {\n\tconstructor(\n\t\tprivate readonly evaluatedPredicate: Input.OptionalWhere,\n\t\tprivate readonly sourceEntity: Model.Entity,\n\t\tprivate readonly relation: Model.AnyRelation,\n\t) {\n\t}\n\n\tpublic replace(where: Input.OptionalWhere): Input.OptionalWhere {\n\t\tconst result: Writable<Input.OptionalWhere> = {}\n\t\tfor (const [key, value] of Object.entries(where)) {\n\t\t\tif (key === 'not') {\n\t\t\t\tresult['not'] = this.replace(value as Input.OptionalWhere)\n\n\t\t\t} else if (key === 'and' || key === 'or') {\n\t\t\t\tresult[key] = (value as Input.Where[]).map(it => this.replace(it))\n\n\t\t\t} else if (key === this.relation.name) {\n\t\t\t\tresult[key] = replaceWhere(value as Input.Where, this.evaluatedPredicate, { [this.sourceEntity.primary]: { always: true } })\n\n\t\t\t} else {\n\t\t\t\tresult[key] = value\n\t\t\t}\n\n\t\t}\n\t\treturn result\n\t}\n\n}\n"],"names":[],"mappings":";AAGO,MAAM,2BAA2B;AAAA,EACvC,YACkB,oBACA,cACA,UAChB;AAHgB,SAAA,qBAAA;AACA,SAAA,eAAA;AACA,SAAA,WAAA;AAAA,EAElB;AAAA,EAEO,QAAQ,OAAiD;AAC/D,UAAM,SAAwC,CAAA;AAC9C,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,GAAG;AACjD,UAAI,QAAQ,OAAO;AAClB,eAAO,KAAK,IAAI,KAAK,QAAQ,KAA4B;AAAA,MAE/C,WAAA,QAAQ,SAAS,QAAQ,MAAM;AAClC,eAAA,GAAG,IAAK,MAAwB,IAAI,QAAM,KAAK,QAAQ,EAAE,CAAC;AAAA,MAEvD,WAAA,QAAQ,KAAK,SAAS,MAAM;AACtC,eAAO,GAAG,IAAI,aAAa,OAAsB,KAAK,oBAAoB,EAAE,CAAC,KAAK,aAAa,OAAO,GAAG,EAAE,QAAQ,KAAA,EAAQ,CAAA;AAAA,MAAA,OAErH;AACN,eAAO,GAAG,IAAI;AAAA,MACf;AAAA,IAED;AACO,WAAA;AAAA,EACR;AAED;"}

package/dist/development/src/acl/PermissionFactory.cjs

@@ -0,0 +1,193 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const schemaUtils = require("@contember/schema-utils");
+const object = require("../utils/object.cjs");
+const VariableUtils = require("./VariableUtils.cjs");
+class PermissionFactory {
+  create(schema, roles, prefix) {
+    let result = {};
+    for (let role of roles) {
+      const roleDefinition = schema.acl.roles[role] || { entities: {} };
+      let rolePermissions = this.prefixPredicatesWithRole(schema.model, roleDefinition.entities, prefix || role);
+      if (roleDefinition.inherits) {
+        const inheritedPermissions = this.create(schema, roleDefinition.inherits, prefix || role);
+        rolePermissions = this.mergePermissions(inheritedPermissions, rolePermissions);
+      }
+      result = this.mergePermissions(result, rolePermissions);
+    }
+    result = this.makePrimaryPredicatesUnionOfAllFields(schema.model, result);
+    return result;
+  }
+  prefixPredicatesWithRole(model, permissions, role) {
+    return object.mapObject(permissions, ({ operations, predicates }, entityName) => ({
+      operations,
+      predicates: object.mapObject(predicates, (predicate) => {
+        const predicateDefinitionProcessor = new schemaUtils.PredicateDefinitionProcessor(model);
+        return predicateDefinitionProcessor.process(schemaUtils.getEntity(model, entityName), predicate, {
+          handleColumn: ({ value }) => {
+            if (typeof value === "string") {
+              return VariableUtils.prefixVariable(role, value);
+            }
+            return value;
+          },
+          handleRelation: ({ value }) => {
+            if (typeof value === "string") {
+              return VariableUtils.prefixVariable(role, value);
+            }
+            return value;
+          }
+        });
+      })
+    }));
+  }
+  makePrimaryPredicatesUnionOfAllFields(model, permissions) {
+    return object.mapObject(permissions, (permission, entityName) => {
+      const entity = schemaUtils.getEntity(model, entityName);
+      const entityPredicates = { ...permission.predicates };
+      const entityOperations = { ...permission.operations };
+      const operationNames = ["read", "create", "update"];
+      for (let operation of operationNames) {
+        if (!entityOperations[operation]) {
+          continue;
+        }
+        const fieldPermissions = { ...entityOperations[operation] };
+        entityOperations[operation] = fieldPermissions;
+        if (Object.values(fieldPermissions).some((it) => it === true)) {
+          fieldPermissions[entity.primary] = true;
+        }
+        if (fieldPermissions[entity.primary] === true) {
+          continue;
+        }
+        const predicateReferences = Object.entries(fieldPermissions).filter(([key]) => key !== entity.primary).map(([key, value]) => value).filter((value) => value !== false).filter((value, index, array) => array.indexOf(value) === index);
+        let idPermissions = fieldPermissions[entity.primary] || false;
+        for (let predicateReference of predicateReferences) {
+          const [predicateDefinition, predicate] = this.mergePredicates(
+            entityPredicates,
+            idPermissions,
+            entityPredicates,
+            predicateReference
+          );
+          if (typeof predicate !== "string" || predicateDefinition === void 0) {
+            throw new Error("should not happen");
+          }
+          idPermissions = predicate;
+          entityPredicates[predicate] = predicateDefinition;
+        }
+        fieldPermissions[entity.primary] = idPermissions;
+        entityPredicates[idPermissions] = entityPredicates[idPermissions];
+      }
+      return {
+        operations: entityOperations,
+        predicates: entityPredicates
+      };
+    });
+  }
+  mergePermissions(left, right) {
+    const result = { ...left };
+    for (let entityName in right) {
+      if (result[entityName] !== void 0) {
+        result[entityName] = this.mergeEntityPermissions(result[entityName], right[entityName]);
+      } else {
+        result[entityName] = right[entityName];
+      }
+    }
+    return result;
+  }
+  mergeEntityPermissions(left, right) {
+    let predicates = {};
+    const operations = {};
+    if (left.operations.customPrimary || right.operations.customPrimary) {
+      operations.customPrimary = true;
+    }
+    const operationNames = [
+      "create",
+      "read",
+      "update"
+    ];
+    for (let operation of operationNames) {
+      const leftFieldPermissions = left.operations[operation] || {};
+      const rightFieldPermissions = right.operations[operation] || {};
+      const [operationPredicates, fieldPermissions] = this.mergeFieldPermissions(
+        left.predicates,
+        leftFieldPermissions,
+        right.predicates,
+        rightFieldPermissions
+      );
+      predicates = { ...predicates, ...operationPredicates };
+      if (Object.keys(fieldPermissions).length > 0) {
+        operations[operation] = fieldPermissions;
+      }
+    }
+    const [predicateDefinition, predicate] = this.mergePredicates(
+      left.predicates,
+      left.operations.delete || false,
+      right.predicates,
+      right.operations.delete || false
+    );
+    if (predicate === true) {
+      operations.delete = true;
+    } else if (predicateDefinition !== void 0 && typeof predicate === "string") {
+      predicates[predicate] = predicateDefinition;
+      operations.delete = predicate;
+    }
+    return {
+      predicates,
+      operations
+    };
+  }
+  mergeFieldPermissions(leftPredicates, leftFieldPermissions, rightPredicates, rightFieldPermissions) {
+    const fields = {};
+    const predicates = {};
+    for (let field in { ...leftFieldPermissions, ...rightFieldPermissions }) {
+      const [predicateDefinition, predicate] = this.mergePredicates(
+        leftPredicates,
+        leftFieldPermissions[field] || false,
+        rightPredicates,
+        rightFieldPermissions[field] || false
+      );
+      if (predicate === true) {
+        fields[field] = true;
+      } else if (predicateDefinition !== void 0 && typeof predicate === "string") {
+        fields[field] = predicate;
+        predicates[predicate] = predicateDefinition;
+      }
+    }
+    return [predicates, fields];
+  }
+  mergePredicates(leftPredicates, leftReference, rightPredicates, rightReference) {
+    if (leftReference === true || rightReference === true) {
+      return [void 0, true];
+    }
+    if (leftReference !== false && rightReference !== false) {
+      const leftPredicate = leftPredicates[leftReference];
+      const rightPredicate = rightPredicates[rightReference];
+      if (leftPredicate === rightPredicate) {
+        return [leftPredicate, leftReference];
+      }
+      let predicateName = "__merge__" + leftReference + "__" + rightReference;
+      while (leftPredicates[predicateName]) {
+        predicateName += "_";
+      }
+      return [
+        {
+          or: [leftPredicate, rightPredicate]
+        },
+        predicateName
+      ];
+    } else if (leftReference !== false) {
+      return [leftPredicates[leftReference], leftReference];
+    } else if (rightReference !== false) {
+      let predicateName = rightReference;
+      if (rightPredicates !== leftPredicates) {
+        while (leftPredicates[predicateName]) {
+          predicateName += "_";
+        }
+      }
+      return [rightPredicates[rightReference], predicateName];
+    } else {
+      return [void 0, false];
+    }
+  }
+}
+exports.PermissionFactory = PermissionFactory;
+//# sourceMappingURL=PermissionFactory.cjs.map

package/dist/development/src/acl/PermissionFactory.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermissionFactory.cjs","sources":["../../../../../packages/engine-content-api/src/acl/PermissionFactory.ts"],"sourcesContent":["import { Acl, Model, Schema, Writable } from '@contember/schema'\nimport { getEntity, PredicateDefinitionProcessor } from '@contember/schema-utils'\nimport { mapObject } from '../utils'\nimport { prefixVariable } from './VariableUtils'\n\nexport interface Identity {\n\tprojectRoles: readonly string[]\n}\n\nexport class PermissionFactory {\n\tpublic create(schema: Schema, roles: readonly string[], prefix?: string): Acl.Permissions {\n\t\tlet result: Acl.Permissions = {}\n\t\tfor (let role of roles) {\n\t\t\tconst roleDefinition = schema.acl.roles[role] || { entities: {} }\n\t\t\tlet rolePermissions: Acl.Permissions = this.prefixPredicatesWithRole(schema.model, roleDefinition.entities, prefix || role)\n\t\t\tif (roleDefinition.inherits) {\n\t\t\t\tconst inheritedPermissions = this.create(schema, roleDefinition.inherits, prefix || role)\n\t\t\t\trolePermissions = this.mergePermissions(inheritedPermissions, rolePermissions)\n\t\t\t}\n\t\t\tresult = this.mergePermissions(result, rolePermissions)\n\t\t}\n\t\tresult = this.makePrimaryPredicatesUnionOfAllFields(schema.model, result)\n\n\t\treturn result\n\t}\n\n\tprivate prefixPredicatesWithRole(model: Model.Schema, permissions: Acl.Permissions, role: string): Acl.Permissions {\n\t\treturn mapObject(permissions, ({ operations, predicates }, entityName) => ({\n\t\t\toperations,\n\t\t\tpredicates: mapObject(predicates, predicate => {\n\t\t\t\tconst predicateDefinitionProcessor = new PredicateDefinitionProcessor(model)\n\t\t\t\treturn predicateDefinitionProcessor.process(getEntity(model, entityName), predicate, {\n\t\t\t\t\thandleColumn: ({ value }) => {\n\t\t\t\t\t\tif (typeof value === 'string') {\n\t\t\t\t\t\t\treturn prefixVariable(role, value)\n\t\t\t\t\t\t}\n\t\t\t\t\t\treturn value\n\t\t\t\t\t},\n\t\t\t\t\thandleRelation: ({ value }) => {\n\t\t\t\t\t\tif (typeof value === 'string') {\n\t\t\t\t\t\t\treturn prefixVariable(role, value)\n\t\t\t\t\t\t}\n\t\t\t\t\t\treturn value\n\t\t\t\t\t},\n\t\t\t\t})\n\t\t\t}),\n\t\t}))\n\t}\n\n\tprivate makePrimaryPredicatesUnionOfAllFields(model: Model.Schema, permissions: Acl.Permissions): Acl.Permissions {\n\t\treturn mapObject(permissions, (permission, entityName): Acl.EntityPermissions => {\n\t\t\tconst entity = getEntity(model, entityName)\n\t\t\tconst entityPredicates: Writable<Acl.PredicateMap> = { ...permission.predicates }\n\t\t\tconst entityOperations: Writable<Acl.EntityOperations> = { ...permission.operations }\n\n\t\t\tconst operationNames = ['read', 'create', 'update'] as const\n\t\t\tfor (let operation of operationNames) {\n\t\t\t\tif (!entityOperations[operation]) {\n\t\t\t\t\tcontinue\n\t\t\t\t}\n\t\t\t\tconst fieldPermissions: Writable<Acl.FieldPermissions> = { ...entityOperations[operation] }\n\t\t\t\tentityOperations[operation] = fieldPermissions\n\n\t\t\t\tif (Object.values(fieldPermissions).some(it => it === true)) {\n\t\t\t\t\tfieldPermissions[entity.primary] = true\n\t\t\t\t}\n\t\t\t\tif (fieldPermissions[entity.primary] === true) {\n\t\t\t\t\tcontinue\n\t\t\t\t}\n\t\t\t\tconst predicateReferences: string[] = Object.entries(fieldPermissions)\n\t\t\t\t\t.filter(([key]) => key !== entity.primary)\n\t\t\t\t\t.map(([key, value]) => value)\n\t\t\t\t\t.filter(value => value !== false)\n\t\t\t\t\t.filter((value, index, array): value is string => array.indexOf(value) === index)\n\n\t\t\t\tlet idPermissions: Acl.Predicate = fieldPermissions[entity.primary] || false\n\n\t\t\t\tfor (let predicateReference of predicateReferences) {\n\t\t\t\t\tconst [predicateDefinition, predicate] = this.mergePredicates(\n\t\t\t\t\t\tentityPredicates,\n\t\t\t\t\t\tidPermissions,\n\t\t\t\t\t\tentityPredicates,\n\t\t\t\t\t\tpredicateReference,\n\t\t\t\t\t)\n\t\t\t\t\tif (typeof predicate !== 'string' || predicateDefinition === undefined) {\n\t\t\t\t\t\tthrow new Error('should not happen')\n\t\t\t\t\t}\n\t\t\t\t\tidPermissions = predicate\n\t\t\t\t\tentityPredicates[predicate] = predicateDefinition\n\t\t\t\t}\n\t\t\t\tfieldPermissions[entity.primary] = idPermissions\n\t\t\t\tentityPredicates[idPermissions as Acl.PredicateReference] = entityPredicates[idPermissions as Acl.PredicateReference]\n\t\t\t}\n\t\t\treturn {\n\t\t\t\toperations: entityOperations,\n\t\t\t\tpredicates: entityPredicates,\n\t\t\t}\n\t\t})\n\t}\n\n\tprivate mergePermissions(left: Acl.Permissions, right: Acl.Permissions): Acl.Permissions {\n\t\tconst result = { ...left }\n\t\tfor (let entityName in right) {\n\t\t\tif (result[entityName] !== undefined) {\n\t\t\t\tresult[entityName] = this.mergeEntityPermissions(result[entityName], right[entityName])\n\t\t\t} else {\n\t\t\t\tresult[entityName] = right[entityName]\n\t\t\t}\n\t\t}\n\t\treturn result\n\t}\n\n\tprivate mergeEntityPermissions(left: Acl.EntityPermissions, right: Acl.EntityPermissions): Acl.EntityPermissions {\n\t\tlet predicates: Writable<Acl.PredicateMap> = {}\n\t\tconst operations: Writable<Acl.EntityOperations> = {}\n\t\tif (left.operations.customPrimary || right.operations.customPrimary) {\n\t\t\toperations.customPrimary = true\n\t\t}\n\n\t\tconst operationNames: (keyof Pick<Acl.EntityOperations, 'create' | 'read' | 'update'>)[] = [\n\t\t\t'create',\n\t\t\t'read',\n\t\t\t'update',\n\t\t]\n\n\t\tfor (let operation of operationNames) {\n\t\t\tconst leftFieldPermissions: Acl.FieldPermissions = left.operations[operation] || {}\n\t\t\tconst rightFieldPermissions: Acl.FieldPermissions = right.operations[operation] || {}\n\t\t\tconst [operationPredicates, fieldPermissions] = this.mergeFieldPermissions(\n\t\t\t\tleft.predicates,\n\t\t\t\tleftFieldPermissions,\n\t\t\t\tright.predicates,\n\t\t\t\trightFieldPermissions,\n\t\t\t)\n\t\t\tpredicates = { ...predicates, ...operationPredicates }\n\t\t\tif (Object.keys(fieldPermissions).length > 0) {\n\t\t\t\toperations[operation] = fieldPermissions\n\t\t\t}\n\t\t}\n\n\t\tconst [predicateDefinition, predicate] = this.mergePredicates(\n\t\t\tleft.predicates,\n\t\t\tleft.operations.delete || false,\n\t\t\tright.predicates,\n\t\t\tright.operations.delete || false,\n\t\t)\n\t\tif (predicate === true) {\n\t\t\toperations.delete = true\n\t\t} else if (predicateDefinition !== undefined && typeof predicate === 'string') {\n\t\t\tpredicates[predicate] = predicateDefinition\n\t\t\toperations.delete = predicate\n\t\t}\n\n\t\treturn {\n\t\t\tpredicates: predicates,\n\t\t\toperations: operations,\n\t\t}\n\t}\n\n\tprivate mergeFieldPermissions(\n\t\tleftPredicates: Acl.PredicateMap,\n\t\tleftFieldPermissions: Acl.FieldPermissions,\n\t\trightPredicates: Acl.PredicateMap,\n\t\trightFieldPermissions: Acl.FieldPermissions,\n\t): [Acl.PredicateMap, Acl.FieldPermissions] {\n\t\tconst fields: Writable<Acl.FieldPermissions> = {}\n\t\tconst predicates: Writable<Acl.PredicateMap> = {}\n\n\t\tfor (let field in { ...leftFieldPermissions, ...rightFieldPermissions }) {\n\t\t\tconst [predicateDefinition, predicate] = this.mergePredicates(\n\t\t\t\tleftPredicates,\n\t\t\t\tleftFieldPermissions[field] || false,\n\t\t\t\trightPredicates,\n\t\t\t\trightFieldPermissions[field] || false,\n\t\t\t)\n\t\t\tif (predicate === true) {\n\t\t\t\tfields[field] = true\n\t\t\t} else if (predicateDefinition !== undefined && typeof predicate === 'string') {\n\t\t\t\tfields[field] = predicate\n\t\t\t\tpredicates[predicate] = predicateDefinition\n\t\t\t}\n\t\t}\n\n\t\treturn [predicates, fields]\n\t}\n\n\tprivate mergePredicates(\n\t\tleftPredicates: Acl.PredicateMap,\n\t\tleftReference: Acl.Predicate,\n\t\trightPredicates: Acl.PredicateMap,\n\t\trightReference: Acl.Predicate,\n\t): [Acl.PredicateDefinition, Acl.PredicateReference] | [undefined, boolean] {\n\t\tif (leftReference === true || rightReference === true) {\n\t\t\treturn [undefined, true]\n\t\t}\n\n\t\tif (leftReference !== false && rightReference !== false) {\n\t\t\tconst leftPredicate: Acl.PredicateDefinition = leftPredicates[leftReference]\n\t\t\tconst rightPredicate: Acl.PredicateDefinition = rightPredicates[rightReference]\n\t\t\tif (leftPredicate === rightPredicate) {\n\t\t\t\treturn [leftPredicate, leftReference]\n\t\t\t}\n\n\t\t\tlet predicateName = '__merge__' + leftReference + '__' + rightReference\n\t\t\twhile (leftPredicates[predicateName]) {\n\t\t\t\tpredicateName += '_'\n\t\t\t}\n\t\t\treturn [\n\t\t\t\t{\n\t\t\t\t\tor: [leftPredicate, rightPredicate],\n\t\t\t\t} as Acl.PredicateDefinition,\n\t\t\t\tpredicateName,\n\t\t\t]\n\t\t} else if (leftReference !== false) {\n\t\t\treturn [leftPredicates[leftReference], leftReference]\n\t\t} else if (rightReference !== false) {\n\t\t\tlet predicateName = rightReference\n\t\t\tif (rightPredicates !== leftPredicates) {\n\t\t\t\twhile (leftPredicates[predicateName]) {\n\t\t\t\t\tpredicateName += '_'\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn [rightPredicates[rightReference], predicateName]\n\t\t} else {\n\t\t\treturn [undefined, false]\n\t\t}\n\t}\n}\n"],"names":["mapObject","PredicateDefinitionProcessor","getEntity","prefixVariable"],"mappings":";;;;;AASO,MAAM,kBAAkB;AAAA,EACvB,OAAO,QAAgB,OAA0B,QAAkC;AACzF,QAAI,SAA0B,CAAA;AAC9B,aAAS,QAAQ,OAAO;AACjB,YAAA,iBAAiB,OAAO,IAAI,MAAM,IAAI,KAAK,EAAE,UAAU,CAAA;AACzD,UAAA,kBAAmC,KAAK,yBAAyB,OAAO,OAAO,eAAe,UAAU,UAAU,IAAI;AAC1H,UAAI,eAAe,UAAU;AAC5B,cAAM,uBAAuB,KAAK,OAAO,QAAQ,eAAe,UAAU,UAAU,IAAI;AACtE,0BAAA,KAAK,iBAAiB,sBAAsB,eAAe;AAAA,MAC9E;AACS,eAAA,KAAK,iBAAiB,QAAQ,eAAe;AAAA,IACvD;AACA,aAAS,KAAK,sCAAsC,OAAO,OAAO,MAAM;AAEjE,WAAA;AAAA,EACR;AAAA,EAEQ,yBAAyB,OAAqB,aAA8B,MAA+B;AAClH,WAAOA,OAAAA,UAAU,aAAa,CAAC,EAAE,YAAY,cAAc,gBAAgB;AAAA,MAC1E;AAAA,MACA,YAAYA,OAAU,UAAA,YAAY,CAAa,cAAA;AACxC,cAAA,+BAA+B,IAAIC,yCAA6B,KAAK;AAC3E,eAAO,6BAA6B,QAAQC,YAAAA,UAAU,OAAO,UAAU,GAAG,WAAW;AAAA,UACpF,cAAc,CAAC,EAAE,YAAY;AACxB,gBAAA,OAAO,UAAU,UAAU;AACvB,qBAAAC,cAAA,eAAe,MAAM,KAAK;AAAA,YAClC;AACO,mBAAA;AAAA,UACR;AAAA,UACA,gBAAgB,CAAC,EAAE,YAAY;AAC1B,gBAAA,OAAO,UAAU,UAAU;AACvB,qBAAAA,cAAA,eAAe,MAAM,KAAK;AAAA,YAClC;AACO,mBAAA;AAAA,UACR;AAAA,QAAA,CACA;AAAA,MAAA,CACD;AAAA,IACA,EAAA;AAAA,EACH;AAAA,EAEQ,sCAAsC,OAAqB,aAA+C;AACjH,WAAOH,iBAAU,aAAa,CAAC,YAAY,eAAsC;AAC1E,YAAA,SAASE,YAAAA,UAAU,OAAO,UAAU;AAC1C,YAAM,mBAA+C,EAAE,GAAG,WAAW,WAAW;AAChF,YAAM,mBAAmD,EAAE,GAAG,WAAW,WAAW;AAEpF,YAAM,iBAAiB,CAAC,QAAQ,UAAU,QAAQ;AAClD,eAAS,aAAa,gBAAgB;AACjC,YAAA,CAAC,iBAAiB,SAAS,GAAG;AACjC;AAAA,QACD;AACA,cAAM,mBAAmD,EAAE,GAAG,iBAAiB,SAAS,EAAE;AAC1F,yBAAiB,SAAS,IAAI;AAE1B,YAAA,OAAO,OAAO,gBAAgB,EAAE,KAAK,CAAM,OAAA,OAAO,IAAI,GAAG;AAC3C,2BAAA,OAAO,OAAO,IAAI;AAAA,QACpC;AACA,YAAI,iBAAiB,OAAO,OAAO,MAAM,MAAM;AAC9C;AAAA,QACD;AACA,cAAM,sBAAgC,OAAO,QAAQ,gBAAgB,EACnE,OAAO,CAAC,CAAC,GAAG,MAAM,QAAQ,OAAO,OAAO,EACxC,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,KAAK,EAC3B,OAAO,CAAS,UAAA,UAAU,KAAK,EAC/B,OAAO,CAAC,OAAO,OAAO,UAA2B,MAAM,QAAQ,KAAK,MAAM,KAAK;AAEjF,YAAI,gBAA+B,iBAAiB,OAAO,OAAO,KAAK;AAEvE,iBAAS,sBAAsB,qBAAqB;AACnD,gBAAM,CAAC,qBAAqB,SAAS,IAAI,KAAK;AAAA,YAC7C;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,UAAA;AAED,cAAI,OAAO,cAAc,YAAY,wBAAwB,QAAW;AACjE,kBAAA,IAAI,MAAM,mBAAmB;AAAA,UACpC;AACgB,0BAAA;AAChB,2BAAiB,SAAS,IAAI;AAAA,QAC/B;AACiB,yBAAA,OAAO,OAAO,IAAI;AAClB,yBAAA,aAAuC,IAAI,iBAAiB,aAAuC;AAAA,MACrH;AACO,aAAA;AAAA,QACN,YAAY;AAAA,QACZ,YAAY;AAAA,MAAA;AAAA,IACb,CACA;AAAA,EACF;AAAA,EAEQ,iBAAiB,MAAuB,OAAyC;AAClF,UAAA,SAAS,EAAE,GAAG;AACpB,aAAS,cAAc,OAAO;AACzB,UAAA,OAAO,UAAU,MAAM,QAAW;AAC9B,eAAA,UAAU,IAAI,KAAK,uBAAuB,OAAO,UAAU,GAAG,MAAM,UAAU,CAAC;AAAA,MAAA,OAChF;AACC,eAAA,UAAU,IAAI,MAAM,UAAU;AAAA,MACtC;AAAA,IACD;AACO,WAAA;AAAA,EACR;AAAA,EAEQ,uBAAuB,MAA6B,OAAqD;AAChH,QAAI,aAAyC,CAAA;AAC7C,UAAM,aAA6C,CAAA;AACnD,QAAI,KAAK,WAAW,iBAAiB,MAAM,WAAW,eAAe;AACpE,iBAAW,gBAAgB;AAAA,IAC5B;AAEA,UAAM,iBAAqF;AAAA,MAC1F;AAAA,MACA;AAAA,MACA;AAAA,IAAA;AAGD,aAAS,aAAa,gBAAgB;AACrC,YAAM,uBAA6C,KAAK,WAAW,SAAS,KAAK,CAAA;AACjF,YAAM,wBAA8C,MAAM,WAAW,SAAS,KAAK,CAAA;AACnF,YAAM,CAAC,qBAAqB,gBAAgB,IAAI,KAAK;AAAA,QACpD,KAAK;AAAA,QACL;AAAA,QACA,MAAM;AAAA,QACN;AAAA,MAAA;AAED,mBAAa,EAAE,GAAG,YAAY,GAAG,oBAAoB;AACrD,UAAI,OAAO,KAAK,gBAAgB,EAAE,SAAS,GAAG;AAC7C,mBAAW,SAAS,IAAI;AAAA,MACzB;AAAA,IACD;AAEA,UAAM,CAAC,qBAAqB,SAAS,IAAI,KAAK;AAAA,MAC7C,KAAK;AAAA,MACL,KAAK,WAAW,UAAU;AAAA,MAC1B,MAAM;AAAA,MACN,MAAM,WAAW,UAAU;AAAA,IAAA;AAE5B,QAAI,cAAc,MAAM;AACvB,iBAAW,SAAS;AAAA,IACV,WAAA,wBAAwB,UAAa,OAAO,cAAc,UAAU;AAC9E,iBAAW,SAAS,IAAI;AACxB,iBAAW,SAAS;AAAA,IACrB;AAEO,WAAA;AAAA,MACN;AAAA,MACA;AAAA,IAAA;AAAA,EAEF;AAAA,EAEQ,sBACP,gBACA,sBACA,iBACA,uBAC2C;AAC3C,UAAM,SAAyC,CAAA;AAC/C,UAAM,aAAyC,CAAA;AAE/C,aAAS,SAAS,EAAE,GAAG,sBAAsB,GAAG,yBAAyB;AACxE,YAAM,CAAC,qBAAqB,SAAS,IAAI,KAAK;AAAA,QAC7C;AAAA,QACA,qBAAqB,KAAK,KAAK;AAAA,QAC/B;AAAA,QACA,sBAAsB,KAAK,KAAK;AAAA,MAAA;AAEjC,UAAI,cAAc,MAAM;AACvB,eAAO,KAAK,IAAI;AAAA,MACN,WAAA,wBAAwB,UAAa,OAAO,cAAc,UAAU;AAC9E,eAAO,KAAK,IAAI;AAChB,mBAAW,SAAS,IAAI;AAAA,MACzB;AAAA,IACD;AAEO,WAAA,CAAC,YAAY,MAAM;AAAA,EAC3B;AAAA,EAEQ,gBACP,gBACA,eACA,iBACA,gBAC2E;AACvE,QAAA,kBAAkB,QAAQ,mBAAmB,MAAM;AAC/C,aAAA,CAAC,QAAW,IAAI;AAAA,IACxB;AAEI,QAAA,kBAAkB,SAAS,mBAAmB,OAAO;AAClD,YAAA,gBAAyC,eAAe,aAAa;AACrE,YAAA,iBAA0C,gBAAgB,cAAc;AAC9E,UAAI,kBAAkB,gBAAgB;AAC9B,eAAA,CAAC,eAAe,aAAa;AAAA,MACrC;AAEI,UAAA,gBAAgB,cAAc,gBAAgB,OAAO;AAClD,aAAA,eAAe,aAAa,GAAG;AACpB,yBAAA;AAAA,MAClB;AACO,aAAA;AAAA,QACN;AAAA,UACC,IAAI,CAAC,eAAe,cAAc;AAAA,QACnC;AAAA,QACA;AAAA,MAAA;AAAA,IACD,WACU,kBAAkB,OAAO;AACnC,aAAO,CAAC,eAAe,aAAa,GAAG,aAAa;AAAA,IAAA,WAC1C,mBAAmB,OAAO;AACpC,UAAI,gBAAgB;AACpB,UAAI,oBAAoB,gBAAgB;AAChC,eAAA,eAAe,aAAa,GAAG;AACpB,2BAAA;AAAA,QAClB;AAAA,MACD;AACA,aAAO,CAAC,gBAAgB,cAAc,GAAG,aAAa;AAAA,IAAA,OAChD;AACC,aAAA,CAAC,QAAW,KAAK;AAAA,IACzB;AAAA,EACD;AACD;;"}

package/dist/development/src/acl/PermissionFactory.js

@@ -0,0 +1,193 @@
+import { PredicateDefinitionProcessor, getEntity } from "@contember/schema-utils";
+import { mapObject } from "../utils/object.js";
+import { prefixVariable } from "./VariableUtils.js";
+class PermissionFactory {
+  create(schema, roles, prefix) {
+    let result = {};
+    for (let role of roles) {
+      const roleDefinition = schema.acl.roles[role] || { entities: {} };
+      let rolePermissions = this.prefixPredicatesWithRole(schema.model, roleDefinition.entities, prefix || role);
+      if (roleDefinition.inherits) {
+        const inheritedPermissions = this.create(schema, roleDefinition.inherits, prefix || role);
+        rolePermissions = this.mergePermissions(inheritedPermissions, rolePermissions);
+      }
+      result = this.mergePermissions(result, rolePermissions);
+    }
+    result = this.makePrimaryPredicatesUnionOfAllFields(schema.model, result);
+    return result;
+  }
+  prefixPredicatesWithRole(model, permissions, role) {
+    return mapObject(permissions, ({ operations, predicates }, entityName) => ({
+      operations,
+      predicates: mapObject(predicates, (predicate) => {
+        const predicateDefinitionProcessor = new PredicateDefinitionProcessor(model);
+        return predicateDefinitionProcessor.process(getEntity(model, entityName), predicate, {
+          handleColumn: ({ value }) => {
+            if (typeof value === "string") {
+              return prefixVariable(role, value);
+            }
+            return value;
+          },
+          handleRelation: ({ value }) => {
+            if (typeof value === "string") {
+              return prefixVariable(role, value);
+            }
+            return value;
+          }
+        });
+      })
+    }));
+  }
+  makePrimaryPredicatesUnionOfAllFields(model, permissions) {
+    return mapObject(permissions, (permission, entityName) => {
+      const entity = getEntity(model, entityName);
+      const entityPredicates = { ...permission.predicates };
+      const entityOperations = { ...permission.operations };
+      const operationNames = ["read", "create", "update"];
+      for (let operation of operationNames) {
+        if (!entityOperations[operation]) {
+          continue;
+        }
+        const fieldPermissions = { ...entityOperations[operation] };
+        entityOperations[operation] = fieldPermissions;
+        if (Object.values(fieldPermissions).some((it) => it === true)) {
+          fieldPermissions[entity.primary] = true;
+        }
+        if (fieldPermissions[entity.primary] === true) {
+          continue;
+        }
+        const predicateReferences = Object.entries(fieldPermissions).filter(([key]) => key !== entity.primary).map(([key, value]) => value).filter((value) => value !== false).filter((value, index, array) => array.indexOf(value) === index);
+        let idPermissions = fieldPermissions[entity.primary] || false;
+        for (let predicateReference of predicateReferences) {
+          const [predicateDefinition, predicate] = this.mergePredicates(
+            entityPredicates,
+            idPermissions,
+            entityPredicates,
+            predicateReference
+          );
+          if (typeof predicate !== "string" || predicateDefinition === void 0) {
+            throw new Error("should not happen");
+          }
+          idPermissions = predicate;
+          entityPredicates[predicate] = predicateDefinition;
+        }
+        fieldPermissions[entity.primary] = idPermissions;
+        entityPredicates[idPermissions] = entityPredicates[idPermissions];
+      }
+      return {
+        operations: entityOperations,
+        predicates: entityPredicates
+      };
+    });
+  }
+  mergePermissions(left, right) {
+    const result = { ...left };
+    for (let entityName in right) {
+      if (result[entityName] !== void 0) {
+        result[entityName] = this.mergeEntityPermissions(result[entityName], right[entityName]);
+      } else {
+        result[entityName] = right[entityName];
+      }
+    }
+    return result;
+  }
+  mergeEntityPermissions(left, right) {
+    let predicates = {};
+    const operations = {};
+    if (left.operations.customPrimary || right.operations.customPrimary) {
+      operations.customPrimary = true;
+    }
+    const operationNames = [
+      "create",
+      "read",
+      "update"
+    ];
+    for (let operation of operationNames) {
+      const leftFieldPermissions = left.operations[operation] || {};
+      const rightFieldPermissions = right.operations[operation] || {};
+      const [operationPredicates, fieldPermissions] = this.mergeFieldPermissions(
+        left.predicates,
+        leftFieldPermissions,
+        right.predicates,
+        rightFieldPermissions
+      );
+      predicates = { ...predicates, ...operationPredicates };
+      if (Object.keys(fieldPermissions).length > 0) {
+        operations[operation] = fieldPermissions;
+      }
+    }
+    const [predicateDefinition, predicate] = this.mergePredicates(
+      left.predicates,
+      left.operations.delete || false,
+      right.predicates,
+      right.operations.delete || false
+    );
+    if (predicate === true) {
+      operations.delete = true;
+    } else if (predicateDefinition !== void 0 && typeof predicate === "string") {
+      predicates[predicate] = predicateDefinition;
+      operations.delete = predicate;
+    }
+    return {
+      predicates,
+      operations
+    };
+  }
+  mergeFieldPermissions(leftPredicates, leftFieldPermissions, rightPredicates, rightFieldPermissions) {
+    const fields = {};
+    const predicates = {};
+    for (let field in { ...leftFieldPermissions, ...rightFieldPermissions }) {
+      const [predicateDefinition, predicate] = this.mergePredicates(
+        leftPredicates,
+        leftFieldPermissions[field] || false,
+        rightPredicates,
+        rightFieldPermissions[field] || false
+      );
+      if (predicate === true) {
+        fields[field] = true;
+      } else if (predicateDefinition !== void 0 && typeof predicate === "string") {
+        fields[field] = predicate;
+        predicates[predicate] = predicateDefinition;
+      }
+    }
+    return [predicates, fields];
+  }
+  mergePredicates(leftPredicates, leftReference, rightPredicates, rightReference) {
+    if (leftReference === true || rightReference === true) {
+      return [void 0, true];
+    }
+    if (leftReference !== false && rightReference !== false) {
+      const leftPredicate = leftPredicates[leftReference];
+      const rightPredicate = rightPredicates[rightReference];
+      if (leftPredicate === rightPredicate) {
+        return [leftPredicate, leftReference];
+      }
+      let predicateName = "__merge__" + leftReference + "__" + rightReference;
+      while (leftPredicates[predicateName]) {
+        predicateName += "_";
+      }
+      return [
+        {
+          or: [leftPredicate, rightPredicate]
+        },
+        predicateName
+      ];
+    } else if (leftReference !== false) {
+      return [leftPredicates[leftReference], leftReference];
+    } else if (rightReference !== false) {
+      let predicateName = rightReference;
+      if (rightPredicates !== leftPredicates) {
+        while (leftPredicates[predicateName]) {
+          predicateName += "_";
+        }
+      }
+      return [rightPredicates[rightReference], predicateName];
+    } else {
+      return [void 0, false];
+    }
+  }
+}
+export {
+  PermissionFactory
+};
+//# sourceMappingURL=PermissionFactory.js.map

package/dist/development/src/acl/PermissionFactory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermissionFactory.js","sources":["../../../../../packages/engine-content-api/src/acl/PermissionFactory.ts"],"sourcesContent":["import { Acl, Model, Schema, Writable } from '@contember/schema'\nimport { getEntity, PredicateDefinitionProcessor } from '@contember/schema-utils'\nimport { mapObject } from '../utils'\nimport { prefixVariable } from './VariableUtils'\n\nexport interface Identity {\n\tprojectRoles: readonly string[]\n}\n\nexport class PermissionFactory {\n\tpublic create(schema: Schema, roles: readonly string[], prefix?: string): Acl.Permissions {\n\t\tlet result: Acl.Permissions = {}\n\t\tfor (let role of roles) {\n\t\t\tconst roleDefinition = schema.acl.roles[role] || { entities: {} }\n\t\t\tlet rolePermissions: Acl.Permissions = this.prefixPredicatesWithRole(schema.model, roleDefinition.entities, prefix || role)\n\t\t\tif (roleDefinition.inherits) {\n\t\t\t\tconst inheritedPermissions = this.create(schema, roleDefinition.inherits, prefix || role)\n\t\t\t\trolePermissions = this.mergePermissions(inheritedPermissions, rolePermissions)\n\t\t\t}\n\t\t\tresult = this.mergePermissions(result, rolePermissions)\n\t\t}\n\t\tresult = this.makePrimaryPredicatesUnionOfAllFields(schema.model, result)\n\n\t\treturn result\n\t}\n\n\tprivate prefixPredicatesWithRole(model: Model.Schema, permissions: Acl.Permissions, role: string): Acl.Permissions {\n\t\treturn mapObject(permissions, ({ operations, predicates }, entityName) => ({\n\t\t\toperations,\n\t\t\tpredicates: mapObject(predicates, predicate => {\n\t\t\t\tconst predicateDefinitionProcessor = new PredicateDefinitionProcessor(model)\n\t\t\t\treturn predicateDefinitionProcessor.process(getEntity(model, entityName), predicate, {\n\t\t\t\t\thandleColumn: ({ value }) => {\n\t\t\t\t\t\tif (typeof value === 'string') {\n\t\t\t\t\t\t\treturn prefixVariable(role, value)\n\t\t\t\t\t\t}\n\t\t\t\t\t\treturn value\n\t\t\t\t\t},\n\t\t\t\t\thandleRelation: ({ value }) => {\n\t\t\t\t\t\tif (typeof value === 'string') {\n\t\t\t\t\t\t\treturn prefixVariable(role, value)\n\t\t\t\t\t\t}\n\t\t\t\t\t\treturn value\n\t\t\t\t\t},\n\t\t\t\t})\n\t\t\t}),\n\t\t}))\n\t}\n\n\tprivate makePrimaryPredicatesUnionOfAllFields(model: Model.Schema, permissions: Acl.Permissions): Acl.Permissions {\n\t\treturn mapObject(permissions, (permission, entityName): Acl.EntityPermissions => {\n\t\t\tconst entity = getEntity(model, entityName)\n\t\t\tconst entityPredicates: Writable<Acl.PredicateMap> = { ...permission.predicates }\n\t\t\tconst entityOperations: Writable<Acl.EntityOperations> = { ...permission.operations }\n\n\t\t\tconst operationNames = ['read', 'create', 'update'] as const\n\t\t\tfor (let operation of operationNames) {\n\t\t\t\tif (!entityOperations[operation]) {\n\t\t\t\t\tcontinue\n\t\t\t\t}\n\t\t\t\tconst fieldPermissions: Writable<Acl.FieldPermissions> = { ...entityOperations[operation] }\n\t\t\t\tentityOperations[operation] = fieldPermissions\n\n\t\t\t\tif (Object.values(fieldPermissions).some(it => it === true)) {\n\t\t\t\t\tfieldPermissions[entity.primary] = true\n\t\t\t\t}\n\t\t\t\tif (fieldPermissions[entity.primary] === true) {\n\t\t\t\t\tcontinue\n\t\t\t\t}\n\t\t\t\tconst predicateReferences: string[] = Object.entries(fieldPermissions)\n\t\t\t\t\t.filter(([key]) => key !== entity.primary)\n\t\t\t\t\t.map(([key, value]) => value)\n\t\t\t\t\t.filter(value => value !== false)\n\t\t\t\t\t.filter((value, index, array): value is string => array.indexOf(value) === index)\n\n\t\t\t\tlet idPermissions: Acl.Predicate = fieldPermissions[entity.primary] || false\n\n\t\t\t\tfor (let predicateReference of predicateReferences) {\n\t\t\t\t\tconst [predicateDefinition, predicate] = this.mergePredicates(\n\t\t\t\t\t\tentityPredicates,\n\t\t\t\t\t\tidPermissions,\n\t\t\t\t\t\tentityPredicates,\n\t\t\t\t\t\tpredicateReference,\n\t\t\t\t\t)\n\t\t\t\t\tif (typeof predicate !== 'string' || predicateDefinition === undefined) {\n\t\t\t\t\t\tthrow new Error('should not happen')\n\t\t\t\t\t}\n\t\t\t\t\tidPermissions = predicate\n\t\t\t\t\tentityPredicates[predicate] = predicateDefinition\n\t\t\t\t}\n\t\t\t\tfieldPermissions[entity.primary] = idPermissions\n\t\t\t\tentityPredicates[idPermissions as Acl.PredicateReference] = entityPredicates[idPermissions as Acl.PredicateReference]\n\t\t\t}\n\t\t\treturn {\n\t\t\t\toperations: entityOperations,\n\t\t\t\tpredicates: entityPredicates,\n\t\t\t}\n\t\t})\n\t}\n\n\tprivate mergePermissions(left: Acl.Permissions, right: Acl.Permissions): Acl.Permissions {\n\t\tconst result = { ...left }\n\t\tfor (let entityName in right) {\n\t\t\tif (result[entityName] !== undefined) {\n\t\t\t\tresult[entityName] = this.mergeEntityPermissions(result[entityName], right[entityName])\n\t\t\t} else {\n\t\t\t\tresult[entityName] = right[entityName]\n\t\t\t}\n\t\t}\n\t\treturn result\n\t}\n\n\tprivate mergeEntityPermissions(left: Acl.EntityPermissions, right: Acl.EntityPermissions): Acl.EntityPermissions {\n\t\tlet predicates: Writable<Acl.PredicateMap> = {}\n\t\tconst operations: Writable<Acl.EntityOperations> = {}\n\t\tif (left.operations.customPrimary || right.operations.customPrimary) {\n\t\t\toperations.customPrimary = true\n\t\t}\n\n\t\tconst operationNames: (keyof Pick<Acl.EntityOperations, 'create' | 'read' | 'update'>)[] = [\n\t\t\t'create',\n\t\t\t'read',\n\t\t\t'update',\n\t\t]\n\n\t\tfor (let operation of operationNames) {\n\t\t\tconst leftFieldPermissions: Acl.FieldPermissions = left.operations[operation] || {}\n\t\t\tconst rightFieldPermissions: Acl.FieldPermissions = right.operations[operation] || {}\n\t\t\tconst [operationPredicates, fieldPermissions] = this.mergeFieldPermissions(\n\t\t\t\tleft.predicates,\n\t\t\t\tleftFieldPermissions,\n\t\t\t\tright.predicates,\n\t\t\t\trightFieldPermissions,\n\t\t\t)\n\t\t\tpredicates = { ...predicates, ...operationPredicates }\n\t\t\tif (Object.keys(fieldPermissions).length > 0) {\n\t\t\t\toperations[operation] = fieldPermissions\n\t\t\t}\n\t\t}\n\n\t\tconst [predicateDefinition, predicate] = this.mergePredicates(\n\t\t\tleft.predicates,\n\t\t\tleft.operations.delete || false,\n\t\t\tright.predicates,\n\t\t\tright.operations.delete || false,\n\t\t)\n\t\tif (predicate === true) {\n\t\t\toperations.delete = true\n\t\t} else if (predicateDefinition !== undefined && typeof predicate === 'string') {\n\t\t\tpredicates[predicate] = predicateDefinition\n\t\t\toperations.delete = predicate\n\t\t}\n\n\t\treturn {\n\t\t\tpredicates: predicates,\n\t\t\toperations: operations,\n\t\t}\n\t}\n\n\tprivate mergeFieldPermissions(\n\t\tleftPredicates: Acl.PredicateMap,\n\t\tleftFieldPermissions: Acl.FieldPermissions,\n\t\trightPredicates: Acl.PredicateMap,\n\t\trightFieldPermissions: Acl.FieldPermissions,\n\t): [Acl.PredicateMap, Acl.FieldPermissions] {\n\t\tconst fields: Writable<Acl.FieldPermissions> = {}\n\t\tconst predicates: Writable<Acl.PredicateMap> = {}\n\n\t\tfor (let field in { ...leftFieldPermissions, ...rightFieldPermissions }) {\n\t\t\tconst [predicateDefinition, predicate] = this.mergePredicates(\n\t\t\t\tleftPredicates,\n\t\t\t\tleftFieldPermissions[field] || false,\n\t\t\t\trightPredicates,\n\t\t\t\trightFieldPermissions[field] || false,\n\t\t\t)\n\t\t\tif (predicate === true) {\n\t\t\t\tfields[field] = true\n\t\t\t} else if (predicateDefinition !== undefined && typeof predicate === 'string') {\n\t\t\t\tfields[field] = predicate\n\t\t\t\tpredicates[predicate] = predicateDefinition\n\t\t\t}\n\t\t}\n\n\t\treturn [predicates, fields]\n\t}\n\n\tprivate mergePredicates(\n\t\tleftPredicates: Acl.PredicateMap,\n\t\tleftReference: Acl.Predicate,\n\t\trightPredicates: Acl.PredicateMap,\n\t\trightReference: Acl.Predicate,\n\t): [Acl.PredicateDefinition, Acl.PredicateReference] | [undefined, boolean] {\n\t\tif (leftReference === true || rightReference === true) {\n\t\t\treturn [undefined, true]\n\t\t}\n\n\t\tif (leftReference !== false && rightReference !== false) {\n\t\t\tconst leftPredicate: Acl.PredicateDefinition = leftPredicates[leftReference]\n\t\t\tconst rightPredicate: Acl.PredicateDefinition = rightPredicates[rightReference]\n\t\t\tif (leftPredicate === rightPredicate) {\n\t\t\t\treturn [leftPredicate, leftReference]\n\t\t\t}\n\n\t\t\tlet predicateName = '__merge__' + leftReference + '__' + rightReference\n\t\t\twhile (leftPredicates[predicateName]) {\n\t\t\t\tpredicateName += '_'\n\t\t\t}\n\t\t\treturn [\n\t\t\t\t{\n\t\t\t\t\tor: [leftPredicate, rightPredicate],\n\t\t\t\t} as Acl.PredicateDefinition,\n\t\t\t\tpredicateName,\n\t\t\t]\n\t\t} else if (leftReference !== false) {\n\t\t\treturn [leftPredicates[leftReference], leftReference]\n\t\t} else if (rightReference !== false) {\n\t\t\tlet predicateName = rightReference\n\t\t\tif (rightPredicates !== leftPredicates) {\n\t\t\t\twhile (leftPredicates[predicateName]) {\n\t\t\t\t\tpredicateName += '_'\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn [rightPredicates[rightReference], predicateName]\n\t\t} else {\n\t\t\treturn [undefined, false]\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;AASO,MAAM,kBAAkB;AAAA,EACvB,OAAO,QAAgB,OAA0B,QAAkC;AACzF,QAAI,SAA0B,CAAA;AAC9B,aAAS,QAAQ,OAAO;AACjB,YAAA,iBAAiB,OAAO,IAAI,MAAM,IAAI,KAAK,EAAE,UAAU,CAAA;AACzD,UAAA,kBAAmC,KAAK,yBAAyB,OAAO,OAAO,eAAe,UAAU,UAAU,IAAI;AAC1H,UAAI,eAAe,UAAU;AAC5B,cAAM,uBAAuB,KAAK,OAAO,QAAQ,eAAe,UAAU,UAAU,IAAI;AACtE,0BAAA,KAAK,iBAAiB,sBAAsB,eAAe;AAAA,MAC9E;AACS,eAAA,KAAK,iBAAiB,QAAQ,eAAe;AAAA,IACvD;AACA,aAAS,KAAK,sCAAsC,OAAO,OAAO,MAAM;AAEjE,WAAA;AAAA,EACR;AAAA,EAEQ,yBAAyB,OAAqB,aAA8B,MAA+B;AAClH,WAAO,UAAU,aAAa,CAAC,EAAE,YAAY,cAAc,gBAAgB;AAAA,MAC1E;AAAA,MACA,YAAY,UAAU,YAAY,CAAa,cAAA;AACxC,cAAA,+BAA+B,IAAI,6BAA6B,KAAK;AAC3E,eAAO,6BAA6B,QAAQ,UAAU,OAAO,UAAU,GAAG,WAAW;AAAA,UACpF,cAAc,CAAC,EAAE,YAAY;AACxB,gBAAA,OAAO,UAAU,UAAU;AACvB,qBAAA,eAAe,MAAM,KAAK;AAAA,YAClC;AACO,mBAAA;AAAA,UACR;AAAA,UACA,gBAAgB,CAAC,EAAE,YAAY;AAC1B,gBAAA,OAAO,UAAU,UAAU;AACvB,qBAAA,eAAe,MAAM,KAAK;AAAA,YAClC;AACO,mBAAA;AAAA,UACR;AAAA,QAAA,CACA;AAAA,MAAA,CACD;AAAA,IACA,EAAA;AAAA,EACH;AAAA,EAEQ,sCAAsC,OAAqB,aAA+C;AACjH,WAAO,UAAU,aAAa,CAAC,YAAY,eAAsC;AAC1E,YAAA,SAAS,UAAU,OAAO,UAAU;AAC1C,YAAM,mBAA+C,EAAE,GAAG,WAAW,WAAW;AAChF,YAAM,mBAAmD,EAAE,GAAG,WAAW,WAAW;AAEpF,YAAM,iBAAiB,CAAC,QAAQ,UAAU,QAAQ;AAClD,eAAS,aAAa,gBAAgB;AACjC,YAAA,CAAC,iBAAiB,SAAS,GAAG;AACjC;AAAA,QACD;AACA,cAAM,mBAAmD,EAAE,GAAG,iBAAiB,SAAS,EAAE;AAC1F,yBAAiB,SAAS,IAAI;AAE1B,YAAA,OAAO,OAAO,gBAAgB,EAAE,KAAK,CAAM,OAAA,OAAO,IAAI,GAAG;AAC3C,2BAAA,OAAO,OAAO,IAAI;AAAA,QACpC;AACA,YAAI,iBAAiB,OAAO,OAAO,MAAM,MAAM;AAC9C;AAAA,QACD;AACA,cAAM,sBAAgC,OAAO,QAAQ,gBAAgB,EACnE,OAAO,CAAC,CAAC,GAAG,MAAM,QAAQ,OAAO,OAAO,EACxC,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,KAAK,EAC3B,OAAO,CAAS,UAAA,UAAU,KAAK,EAC/B,OAAO,CAAC,OAAO,OAAO,UAA2B,MAAM,QAAQ,KAAK,MAAM,KAAK;AAEjF,YAAI,gBAA+B,iBAAiB,OAAO,OAAO,KAAK;AAEvE,iBAAS,sBAAsB,qBAAqB;AACnD,gBAAM,CAAC,qBAAqB,SAAS,IAAI,KAAK;AAAA,YAC7C;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,UAAA;AAED,cAAI,OAAO,cAAc,YAAY,wBAAwB,QAAW;AACjE,kBAAA,IAAI,MAAM,mBAAmB;AAAA,UACpC;AACgB,0BAAA;AAChB,2BAAiB,SAAS,IAAI;AAAA,QAC/B;AACiB,yBAAA,OAAO,OAAO,IAAI;AAClB,yBAAA,aAAuC,IAAI,iBAAiB,aAAuC;AAAA,MACrH;AACO,aAAA;AAAA,QACN,YAAY;AAAA,QACZ,YAAY;AAAA,MAAA;AAAA,IACb,CACA;AAAA,EACF;AAAA,EAEQ,iBAAiB,MAAuB,OAAyC;AAClF,UAAA,SAAS,EAAE,GAAG;AACpB,aAAS,cAAc,OAAO;AACzB,UAAA,OAAO,UAAU,MAAM,QAAW;AAC9B,eAAA,UAAU,IAAI,KAAK,uBAAuB,OAAO,UAAU,GAAG,MAAM,UAAU,CAAC;AAAA,MAAA,OAChF;AACC,eAAA,UAAU,IAAI,MAAM,UAAU;AAAA,MACtC;AAAA,IACD;AACO,WAAA;AAAA,EACR;AAAA,EAEQ,uBAAuB,MAA6B,OAAqD;AAChH,QAAI,aAAyC,CAAA;AAC7C,UAAM,aAA6C,CAAA;AACnD,QAAI,KAAK,WAAW,iBAAiB,MAAM,WAAW,eAAe;AACpE,iBAAW,gBAAgB;AAAA,IAC5B;AAEA,UAAM,iBAAqF;AAAA,MAC1F;AAAA,MACA;AAAA,MACA;AAAA,IAAA;AAGD,aAAS,aAAa,gBAAgB;AACrC,YAAM,uBAA6C,KAAK,WAAW,SAAS,KAAK,CAAA;AACjF,YAAM,wBAA8C,MAAM,WAAW,SAAS,KAAK,CAAA;AACnF,YAAM,CAAC,qBAAqB,gBAAgB,IAAI,KAAK;AAAA,QACpD,KAAK;AAAA,QACL;AAAA,QACA,MAAM;AAAA,QACN;AAAA,MAAA;AAED,mBAAa,EAAE,GAAG,YAAY,GAAG,oBAAoB;AACrD,UAAI,OAAO,KAAK,gBAAgB,EAAE,SAAS,GAAG;AAC7C,mBAAW,SAAS,IAAI;AAAA,MACzB;AAAA,IACD;AAEA,UAAM,CAAC,qBAAqB,SAAS,IAAI,KAAK;AAAA,MAC7C,KAAK;AAAA,MACL,KAAK,WAAW,UAAU;AAAA,MAC1B,MAAM;AAAA,MACN,MAAM,WAAW,UAAU;AAAA,IAAA;AAE5B,QAAI,cAAc,MAAM;AACvB,iBAAW,SAAS;AAAA,IACV,WAAA,wBAAwB,UAAa,OAAO,cAAc,UAAU;AAC9E,iBAAW,SAAS,IAAI;AACxB,iBAAW,SAAS;AAAA,IACrB;AAEO,WAAA;AAAA,MACN;AAAA,MACA;AAAA,IAAA;AAAA,EAEF;AAAA,EAEQ,sBACP,gBACA,sBACA,iBACA,uBAC2C;AAC3C,UAAM,SAAyC,CAAA;AAC/C,UAAM,aAAyC,CAAA;AAE/C,aAAS,SAAS,EAAE,GAAG,sBAAsB,GAAG,yBAAyB;AACxE,YAAM,CAAC,qBAAqB,SAAS,IAAI,KAAK;AAAA,QAC7C;AAAA,QACA,qBAAqB,KAAK,KAAK;AAAA,QAC/B;AAAA,QACA,sBAAsB,KAAK,KAAK;AAAA,MAAA;AAEjC,UAAI,cAAc,MAAM;AACvB,eAAO,KAAK,IAAI;AAAA,MACN,WAAA,wBAAwB,UAAa,OAAO,cAAc,UAAU;AAC9E,eAAO,KAAK,IAAI;AAChB,mBAAW,SAAS,IAAI;AAAA,MACzB;AAAA,IACD;AAEO,WAAA,CAAC,YAAY,MAAM;AAAA,EAC3B;AAAA,EAEQ,gBACP,gBACA,eACA,iBACA,gBAC2E;AACvE,QAAA,kBAAkB,QAAQ,mBAAmB,MAAM;AAC/C,aAAA,CAAC,QAAW,IAAI;AAAA,IACxB;AAEI,QAAA,kBAAkB,SAAS,mBAAmB,OAAO;AAClD,YAAA,gBAAyC,eAAe,aAAa;AACrE,YAAA,iBAA0C,gBAAgB,cAAc;AAC9E,UAAI,kBAAkB,gBAAgB;AAC9B,eAAA,CAAC,eAAe,aAAa;AAAA,MACrC;AAEI,UAAA,gBAAgB,cAAc,gBAAgB,OAAO;AAClD,aAAA,eAAe,aAAa,GAAG;AACpB,yBAAA;AAAA,MAClB;AACO,aAAA;AAAA,QACN;AAAA,UACC,IAAI,CAAC,eAAe,cAAc;AAAA,QACnC;AAAA,QACA;AAAA,MAAA;AAAA,IACD,WACU,kBAAkB,OAAO;AACnC,aAAO,CAAC,eAAe,aAAa,GAAG,aAAa;AAAA,IAAA,WAC1C,mBAAmB,OAAO;AACpC,UAAI,gBAAgB;AACpB,UAAI,oBAAoB,gBAAgB;AAChC,eAAA,eAAe,aAAa,GAAG;AACpB,2BAAA;AAAA,QAClB;AAAA,MACD;AACA,aAAO,CAAC,gBAAgB,cAAc,GAAG,aAAa;AAAA,IAAA,OAChD;AACC,aAAA,CAAC,QAAW,KAAK;AAAA,IACzB;AAAA,EACD;AACD;"}