@contember/engine-content-api 2.1.0-alpha.9 → 2.1.0-beta.2

package/dist/development/src/acl/PredicateFactory.cjs

@@ -4,13 +4,29 @@ const schema = require("@contember/schema");
 const EvaluatedPredicateReplacer = require("./EvaluatedPredicateReplacer.cjs");
 const getRowLevelPredicatePseudoField = (entity) => entity.primary;
 class PredicateFactory {
-  constructor(permissions, model, variableInjector) {
+  constructor(permissions, model, variableInjector, allPermissions) {
     this.permissions = permissions;
     this.model = model;
     this.variableInjector = variableInjector;
+    this.allPermissions = allPermissions;
   }
-  getFieldPredicate(entity, operation, fieldName) {
-    const permissions = this.permissions[entity.name]?.operations?.[operation];
+  /**
+   * Selects the appropriate permission set based on query context:
+   * - `isRoot === false` (nested/relation context): uses allPermissions (includes through-only permissions)
+   * - `isRoot === true` or `isRoot === undefined` (root or unknown context): uses root-only permissions
+   *
+   * The `undefined` vs `true` distinction matters: `undefined` is the default for callers
+   * that don't track root context, and must fall through to root permissions for safety.
+   */
+  getPermissionsForContext(isRoot) {
+    if (isRoot === false && this.allPermissions) {
+      return this.allPermissions;
+    }
+    return this.permissions;
+  }
+  getFieldPredicate(entity, operation, fieldName, isRoot) {
+    const perms = this.getPermissionsForContext(isRoot);
+    const permissions = perms[entity.name]?.operations?.[operation];
     const predicate = permissions?.[fieldName] ?? false;
     const rowLevelField = getRowLevelPredicatePseudoField(entity);
     const primaryPredicate = permissions?.[rowLevelField] ?? false;
@@ -20,11 +36,13 @@ class PredicateFactory {
       predicate
     };
   }
-  shouldApplyCellLevelPredicate(entity, operation, fieldName) {
+  shouldApplyCellLevelPredicate(entity, operation, fieldName, isRoot) {
+    const perms = this.getPermissionsForContext(isRoot);
     const rowLevelField = getRowLevelPredicatePseudoField(entity);
-    const permissions = this.permissions[entity.name]?.operations?.[operation];
+    const permissions = perms[entity.name]?.operations?.[operation];
     return permissions?.[fieldName] !== permissions?.[rowLevelField];
   }
+  /** Delete predicates are not context-aware — through-permission support is scoped to read operations only. */
   createDeletePredicate(entity) {
     const neverCondition = { [entity.primary]: { never: true } };
     const entityPermissions = this.permissions[entity.name];
@@ -40,8 +58,9 @@ class PredicateFactory {
     }
     return this.buildPredicates(entity, [deletePredicate]);
   }
-  create(entity, operation, fieldNames = [getRowLevelPredicatePseudoField(entity)], relationContext) {
-    const entityPermissions = this.permissions[entity.name];
+  create(entity, operation, fieldNames = [getRowLevelPredicatePseudoField(entity)], relationContext, isRoot) {
+    const perms = this.getPermissionsForContext(isRoot);
+    const entityPermissions = perms[entity.name];
     const neverCondition = { [entity.primary]: { never: true } };
     if (!entityPermissions) {
       return neverCondition;
@@ -57,10 +76,11 @@ class PredicateFactory {
     if (operationPredicates === false) {
       return neverCondition;
     }
-    return this.buildPredicates(entity, operationPredicates, relationContext);
+    return this.buildPredicates(entity, operationPredicates, relationContext, isRoot);
   }
-  buildPredicates(entity, predicates, relationContext) {
-    const entityPermissions = this.permissions[entity.name] ?? {};
+  buildPredicates(entity, predicates, relationContext, isRoot) {
+    const perms = this.getPermissionsForContext(isRoot);
+    const entityPermissions = perms[entity.name] ?? {};
     const predicatesWhere = predicates.reduce(
       (result, name) => {
         if (!entityPermissions.predicates[name]) {
@@ -75,7 +95,7 @@ class PredicateFactory {
       return {};
     }
     const where = predicatesWhere.length === 1 ? predicatesWhere[0] : { and: predicatesWhere };
-    return this.optimizePredicates(where, relationContext);
+    return this.optimizePredicates(where, relationContext, isRoot);
   }
   getRequiredPredicates(fieldNames, fieldPermissions) {
     const predicates = [];
@@ -93,11 +113,11 @@ class PredicateFactory {
     }
     return predicates;
   }
-  optimizePredicates(where, relationContext) {
+  optimizePredicates(where, relationContext, isRoot) {
     if (!relationContext || !relationContext.targetRelation) {
       return where;
     }
-    const sourcePredicate = this.create(relationContext.entity, schema.Acl.Operation.read, [relationContext.relation.name]);
+    const sourcePredicate = this.create(relationContext.entity, schema.Acl.Operation.read, [relationContext.relation.name], void 0, isRoot);
     if (Object.keys(sourcePredicate).length === 0) {
       return where;
     }

package/dist/development/src/acl/PredicateFactory.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"PredicateFactory.cjs","sources":["../../../../../packages/engine-content-api/src/acl/PredicateFactory.ts"],"sourcesContent":["import { Acl, Input, Model } from '@contember/schema'\nimport { VariableInjector } from './VariableInjector'\nimport { EvaluatedPredicateReplacer } from './EvaluatedPredicateReplacer'\n\nconst getRowLevelPredicatePseudoField = (entity: Model.Entity) => entity.primary\n\nexport interface FieldRequiredPredicate {\n\tpredicate: Acl.Predicate\n\tisSameAsPrimary: boolean\n}\n\nexport class PredicateFactory {\n\tconstructor(\n\t\tprivate readonly permissions: Acl.Permissions,\n\t\tprivate readonly model: Model.Schema,\n\t\tprivate readonly variableInjector: VariableInjector,\n\t) {}\n\n\tpublic getFieldPredicate(\n\t\tentity: Model.Entity,\n\t\toperation: Acl.Operation.update | Acl.Operation.read | Acl.Operation.create,\n\t\tfieldName: string,\n\t): FieldRequiredPredicate {\n\t\tconst permissions = this.permissions[entity.name]?.operations?.[operation]\n\t\tconst predicate = permissions?.[fieldName] ?? false\n\t\tconst rowLevelField = getRowLevelPredicatePseudoField(entity)\n\n\t\tconst primaryPredicate = permissions?.[rowLevelField] ?? false\n\t\tconst isSameAsPrimary = predicate === primaryPredicate\n\n\t\treturn {\n\t\t\tisSameAsPrimary,\n\t\t\tpredicate,\n\t\t}\n\t}\n\n\tpublic shouldApplyCellLevelPredicate(\n\t\tentity: Model.Entity,\n\t\toperation: Acl.Operation.read,\n\t\tfieldName: string,\n\t): boolean {\n\t\tconst rowLevelField = getRowLevelPredicatePseudoField(entity)\n\t\tconst permissions = this.permissions[entity.name]?.operations?.[operation]\n\t\treturn permissions?.[fieldName] !== permissions?.[rowLevelField]\n\t}\n\n\tpublic createDeletePredicate(entity: Model.Entity) {\n\t\tconst neverCondition: Input.Where = { [entity.primary]: { never: true } }\n\t\tconst entityPermissions = this.permissions[entity.name]\n\t\tif (!entityPermissions) {\n\t\t\treturn neverCondition\n\t\t}\n\t\tconst deletePredicate = entityPermissions.operations.delete\n\t\tif (deletePredicate === undefined || deletePredicate === false) {\n\t\t\treturn neverCondition\n\t\t}\n\t\tif (deletePredicate === true) {\n\t\t\treturn {}\n\t\t}\n\t\treturn this.buildPredicates(entity, [deletePredicate])\n\t}\n\n\tpublic create(\n\t\tentity: Model.Entity,\n\t\toperation: Acl.Operation.update | Acl.Operation.read | Acl.Operation.create,\n\t\tfieldNames: string[] = [getRowLevelPredicatePseudoField(entity)],\n\t\trelationContext?: Model.AnyRelationContext,\n\t): Input.OptionalWhere {\n\t\tconst entityPermissions: Acl.EntityPermissions = this.permissions[entity.name]\n\t\tconst neverCondition: Input.Where = { [entity.primary]: { never: true } }\n\n\t\tif (!entityPermissions) {\n\t\t\treturn neverCondition\n\t\t}\n\n\t\tif (fieldNames === undefined) {\n\t\t\tfieldNames = [getRowLevelPredicatePseudoField(entity)]\n\t\t}\n\t\tconst fieldPermissions = entityPermissions.operations[operation]\n\t\tif (fieldPermissions === undefined) {\n\t\t\treturn neverCondition\n\t\t}\n\t\tconst operationPredicates = this.getRequiredPredicates(fieldNames, fieldPermissions)\n\t\tif (operationPredicates === false) {\n\t\t\treturn neverCondition\n\t\t}\n\n\t\treturn this.buildPredicates(entity, operationPredicates, relationContext)\n\t}\n\n\tpublic buildPredicates(entity: Model.Entity, predicates: Acl.PredicateReference[], relationContext?: Model.AnyRelationContext): Input.OptionalWhere {\n\t\tconst entityPermissions: Acl.EntityPermissions = this.permissions[entity.name] ?? {}\n\n\t\tconst predicatesWhere: Input.Where[] = predicates.reduce(\n\t\t\t(result: Input.Where[], name: Acl.PredicateReference): Input.Where[] => {\n\t\t\t\tif (!entityPermissions.predicates[name]) {\n\t\t\t\t\tthrow new Error(`${entity.name}: Undefined predicate ${name}`)\n\t\t\t\t}\n\t\t\t\tconst predicateWhere: Input.Where = this.variableInjector.inject(entity, entityPermissions.predicates[name])\n\t\t\t\treturn [...result, predicateWhere]\n\t\t\t},\n\t\t\t[],\n\t\t)\n\t\tif (predicatesWhere.length === 0) {\n\t\t\treturn {}\n\t\t}\n\t\tconst where: Input.Where = predicatesWhere.length === 1 ? predicatesWhere[0] : { and: predicatesWhere }\n\t\treturn this.optimizePredicates(where, relationContext)\n\n\t}\n\n\tprivate getRequiredPredicates(\n\t\tfieldNames: string[],\n\t\tfieldPermissions: Acl.FieldPermissions,\n\t): Acl.PredicateReference[] | false {\n\t\tconst predicates: Acl.PredicateReference[] = []\n\t\tfor (let name of fieldNames) {\n\t\t\tconst fieldPredicate = fieldPermissions[name]\n\t\t\tif (fieldPredicate === undefined || fieldPredicate === false) {\n\t\t\t\treturn false\n\t\t\t}\n\t\t\tif (fieldPredicate === true) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tif (!predicates.includes(fieldPredicate)) {\n\t\t\t\tpredicates.push(fieldPredicate)\n\t\t\t}\n\t\t}\n\t\treturn predicates\n\t}\n\n\tpublic optimizePredicates(where: Input.OptionalWhere, relationContext?: Model.AnyRelationContext) {\n\t\tif (!relationContext || !relationContext.targetRelation) {\n\t\t\treturn where\n\t\t}\n\t\tconst sourcePredicate = this.create(relationContext.entity, Acl.Operation.read, [relationContext.relation.name])\n\t\tif (Object.keys(sourcePredicate).length === 0) {\n\t\t\treturn where\n\t\t}\n\n\t\tconst replacer = new EvaluatedPredicateReplacer(sourcePredicate, relationContext.entity, relationContext.targetRelation)\n\t\treturn replacer.replace(where)\n\t}\n}\n"],"names":["Acl","EvaluatedPredicateReplacer"],"mappings":";;;;AAIA,MAAM,kCAAkC,CAAC,WAAyB,OAAO;AAOlE,MAAM,iBAAiB;AAAA,EAC7B,YACkB,aACA,OACA,kBAChB;AAHgB,SAAA,cAAA;AACA,SAAA,QAAA;AACA,SAAA,mBAAA;AAAA,EAAA;AAAA,EAGX,kBACN,QACA,WACA,WACyB;AACzB,UAAM,cAAc,KAAK,YAAY,OAAO,IAAI,GAAG,aAAa,SAAS;AACnE,UAAA,YAAY,cAAc,SAAS,KAAK;AACxC,UAAA,gBAAgB,gCAAgC,MAAM;AAEtD,UAAA,mBAAmB,cAAc,aAAa,KAAK;AACzD,UAAM,kBAAkB,cAAc;AAE/B,WAAA;AAAA,MACN;AAAA,MACA;AAAA,IACD;AAAA,EAAA;AAAA,EAGM,8BACN,QACA,WACA,WACU;AACJ,UAAA,gBAAgB,gCAAgC,MAAM;AAC5D,UAAM,cAAc,KAAK,YAAY,OAAO,IAAI,GAAG,aAAa,SAAS;AACzE,WAAO,cAAc,SAAS,MAAM,cAAc,aAAa;AAAA,EAAA;AAAA,EAGzD,sBAAsB,QAAsB;AAC5C,UAAA,iBAA8B,EAAE,CAAC,OAAO,OAAO,GAAG,EAAE,OAAO,OAAO;AACxE,UAAM,oBAAoB,KAAK,YAAY,OAAO,IAAI;AACtD,QAAI,CAAC,mBAAmB;AAChB,aAAA;AAAA,IAAA;AAEF,UAAA,kBAAkB,kBAAkB,WAAW;AACjD,QAAA,oBAAoB,UAAa,oBAAoB,OAAO;AACxD,aAAA;AAAA,IAAA;AAER,QAAI,oBAAoB,MAAM;AAC7B,aAAO,CAAC;AAAA,IAAA;AAET,WAAO,KAAK,gBAAgB,QAAQ,CAAC,eAAe,CAAC;AAAA,EAAA;AAAA,EAG/C,OACN,QACA,WACA,aAAuB,CAAC,gCAAgC,MAAM,CAAC,GAC/D,iBACsB;AACtB,UAAM,oBAA2C,KAAK,YAAY,OAAO,IAAI;AACvE,UAAA,iBAA8B,EAAE,CAAC,OAAO,OAAO,GAAG,EAAE,OAAO,OAAO;AAExE,QAAI,CAAC,mBAAmB;AAChB,aAAA;AAAA,IAAA;AAGR,QAAI,eAAe,QAAW;AAChB,mBAAA,CAAC,gCAAgC,MAAM,CAAC;AAAA,IAAA;AAEhD,UAAA,mBAAmB,kBAAkB,WAAW,SAAS;AAC/D,QAAI,qBAAqB,QAAW;AAC5B,aAAA;AAAA,IAAA;AAER,UAAM,sBAAsB,KAAK,sBAAsB,YAAY,gBAAgB;AACnF,QAAI,wBAAwB,OAAO;AAC3B,aAAA;AAAA,IAAA;AAGR,WAAO,KAAK,gBAAgB,QAAQ,qBAAqB,eAAe;AAAA,EAAA;AAAA,EAGlE,gBAAgB,QAAsB,YAAsC,iBAAiE;AACnJ,UAAM,oBAA2C,KAAK,YAAY,OAAO,IAAI,KAAK,CAAC;AAEnF,UAAM,kBAAiC,WAAW;AAAA,MACjD,CAAC,QAAuB,SAAgD;AACvE,YAAI,CAAC,kBAAkB,WAAW,IAAI,GAAG;AACxC,gBAAM,IAAI,MAAM,GAAG,OAAO,IAAI,yBAAyB,IAAI,EAAE;AAAA,QAAA;AAExD,cAAA,iBAA8B,KAAK,iBAAiB,OAAO,QAAQ,kBAAkB,WAAW,IAAI,CAAC;AACpG,eAAA,CAAC,GAAG,QAAQ,cAAc;AAAA,MAClC;AAAA,MACA,CAAA;AAAA,IACD;AACI,QAAA,gBAAgB,WAAW,GAAG;AACjC,aAAO,CAAC;AAAA,IAAA;AAEH,UAAA,QAAqB,gBAAgB,WAAW,IAAI,gBAAgB,CAAC,IAAI,EAAE,KAAK,gBAAgB;AAC/F,WAAA,KAAK,mBAAmB,OAAO,eAAe;AAAA,EAAA;AAAA,EAI9C,sBACP,YACA,kBACmC;AACnC,UAAM,aAAuC,CAAC;AAC9C,aAAS,QAAQ,YAAY;AACtB,YAAA,iBAAiB,iBAAiB,IAAI;AACxC,UAAA,mBAAmB,UAAa,mBAAmB,OAAO;AACtD,eAAA;AAAA,MAAA;AAER,UAAI,mBAAmB,MAAM;AAC5B;AAAA,MAAA;AAED,UAAI,CAAC,WAAW,SAAS,cAAc,GAAG;AACzC,mBAAW,KAAK,cAAc;AAAA,MAAA;AAAA,IAC/B;AAEM,WAAA;AAAA,EAAA;AAAA,EAGD,mBAAmB,OAA4B,iBAA4C;AACjG,QAAI,CAAC,mBAAmB,CAAC,gBAAgB,gBAAgB;AACjD,aAAA;AAAA,IAAA;AAER,UAAM,kBAAkB,KAAK,OAAO,gBAAgB,QAAQA,OAAAA,IAAI,UAAU,MAAM,CAAC,gBAAgB,SAAS,IAAI,CAAC;AAC/G,QAAI,OAAO,KAAK,eAAe,EAAE,WAAW,GAAG;AACvC,aAAA;AAAA,IAAA;AAGR,UAAM,WAAW,IAAIC,sDAA2B,iBAAiB,gBAAgB,QAAQ,gBAAgB,cAAc;AAChH,WAAA,SAAS,QAAQ,KAAK;AAAA,EAAA;AAE/B;;"}
+{"version":3,"file":"PredicateFactory.cjs","sources":["../../../../../packages/engine-content-api/src/acl/PredicateFactory.ts"],"sourcesContent":["import { Acl, Input, Model } from '@contember/schema'\nimport { VariableInjector } from './VariableInjector'\nimport { EvaluatedPredicateReplacer } from './EvaluatedPredicateReplacer'\n\nconst getRowLevelPredicatePseudoField = (entity: Model.Entity) => entity.primary\n\nexport interface FieldRequiredPredicate {\n\tpredicate: Acl.Predicate\n\tisSameAsPrimary: boolean\n}\n\nexport class PredicateFactory {\n\tconstructor(\n\t\tprivate readonly permissions: Acl.Permissions,\n\t\tprivate readonly model: Model.Schema,\n\t\tprivate readonly variableInjector: VariableInjector,\n\t\tprivate readonly allPermissions?: Acl.Permissions,\n\t) {}\n\n\t/**\n\t * Selects the appropriate permission set based on query context:\n\t * - `isRoot === false` (nested/relation context): uses allPermissions (includes through-only permissions)\n\t * - `isRoot === true` or `isRoot === undefined` (root or unknown context): uses root-only permissions\n\t *\n\t * The `undefined` vs `true` distinction matters: `undefined` is the default for callers\n\t * that don't track root context, and must fall through to root permissions for safety.\n\t */\n\tprivate getPermissionsForContext(isRoot?: boolean): Acl.Permissions {\n\t\tif (isRoot === false && this.allPermissions) {\n\t\t\treturn this.allPermissions\n\t\t}\n\t\treturn this.permissions\n\t}\n\n\tpublic getFieldPredicate(\n\t\tentity: Model.Entity,\n\t\toperation: Acl.Operation.update | Acl.Operation.read | Acl.Operation.create,\n\t\tfieldName: string,\n\t\tisRoot?: boolean,\n\t): FieldRequiredPredicate {\n\t\tconst perms = this.getPermissionsForContext(isRoot)\n\t\tconst permissions = perms[entity.name]?.operations?.[operation]\n\t\tconst predicate = permissions?.[fieldName] ?? false\n\t\tconst rowLevelField = getRowLevelPredicatePseudoField(entity)\n\n\t\tconst primaryPredicate = permissions?.[rowLevelField] ?? false\n\t\tconst isSameAsPrimary = predicate === primaryPredicate\n\n\t\treturn {\n\t\t\tisSameAsPrimary,\n\t\t\tpredicate,\n\t\t}\n\t}\n\n\tpublic shouldApplyCellLevelPredicate(\n\t\tentity: Model.Entity,\n\t\toperation: Acl.Operation.read,\n\t\tfieldName: string,\n\t\tisRoot?: boolean,\n\t): boolean {\n\t\tconst perms = this.getPermissionsForContext(isRoot)\n\t\tconst rowLevelField = getRowLevelPredicatePseudoField(entity)\n\t\tconst permissions = perms[entity.name]?.operations?.[operation]\n\t\treturn permissions?.[fieldName] !== permissions?.[rowLevelField]\n\t}\n\n\t/** Delete predicates are not context-aware — through-permission support is scoped to read operations only. */\n\tpublic createDeletePredicate(entity: Model.Entity) {\n\t\tconst neverCondition: Input.Where = { [entity.primary]: { never: true } }\n\t\tconst entityPermissions = this.permissions[entity.name]\n\t\tif (!entityPermissions) {\n\t\t\treturn neverCondition\n\t\t}\n\t\tconst deletePredicate = entityPermissions.operations.delete\n\t\tif (deletePredicate === undefined || deletePredicate === false) {\n\t\t\treturn neverCondition\n\t\t}\n\t\tif (deletePredicate === true) {\n\t\t\treturn {}\n\t\t}\n\t\treturn this.buildPredicates(entity, [deletePredicate])\n\t}\n\n\tpublic create(\n\t\tentity: Model.Entity,\n\t\toperation: Acl.Operation.update | Acl.Operation.read | Acl.Operation.create,\n\t\tfieldNames: string[] = [getRowLevelPredicatePseudoField(entity)],\n\t\trelationContext?: Model.AnyRelationContext,\n\t\tisRoot?: boolean,\n\t): Input.OptionalWhere {\n\t\tconst perms = this.getPermissionsForContext(isRoot)\n\t\tconst entityPermissions: Acl.EntityPermissions = perms[entity.name]\n\t\tconst neverCondition: Input.Where = { [entity.primary]: { never: true } }\n\n\t\tif (!entityPermissions) {\n\t\t\treturn neverCondition\n\t\t}\n\n\t\tif (fieldNames === undefined) {\n\t\t\tfieldNames = [getRowLevelPredicatePseudoField(entity)]\n\t\t}\n\t\tconst fieldPermissions = entityPermissions.operations[operation]\n\t\tif (fieldPermissions === undefined) {\n\t\t\treturn neverCondition\n\t\t}\n\t\tconst operationPredicates = this.getRequiredPredicates(fieldNames, fieldPermissions)\n\t\tif (operationPredicates === false) {\n\t\t\treturn neverCondition\n\t\t}\n\n\t\treturn this.buildPredicates(entity, operationPredicates, relationContext, isRoot)\n\t}\n\n\tpublic buildPredicates(\n\t\tentity: Model.Entity,\n\t\tpredicates: Acl.PredicateReference[],\n\t\trelationContext?: Model.AnyRelationContext,\n\t\tisRoot?: boolean,\n\t): Input.OptionalWhere {\n\t\tconst perms = this.getPermissionsForContext(isRoot)\n\t\tconst entityPermissions: Acl.EntityPermissions = perms[entity.name] ?? {}\n\n\t\tconst predicatesWhere: Input.Where[] = predicates.reduce(\n\t\t\t(result: Input.Where[], name: Acl.PredicateReference): Input.Where[] => {\n\t\t\t\tif (!entityPermissions.predicates[name]) {\n\t\t\t\t\tthrow new Error(`${entity.name}: Undefined predicate ${name}`)\n\t\t\t\t}\n\t\t\t\tconst predicateWhere: Input.Where = this.variableInjector.inject(entity, entityPermissions.predicates[name])\n\t\t\t\treturn [...result, predicateWhere]\n\t\t\t},\n\t\t\t[],\n\t\t)\n\t\tif (predicatesWhere.length === 0) {\n\t\t\treturn {}\n\t\t}\n\t\tconst where: Input.Where = predicatesWhere.length === 1 ? predicatesWhere[0] : { and: predicatesWhere }\n\t\treturn this.optimizePredicates(where, relationContext, isRoot)\n\t}\n\n\tprivate getRequiredPredicates(\n\t\tfieldNames: string[],\n\t\tfieldPermissions: Acl.FieldPermissions,\n\t): Acl.PredicateReference[] | false {\n\t\tconst predicates: Acl.PredicateReference[] = []\n\t\tfor (let name of fieldNames) {\n\t\t\tconst fieldPredicate = fieldPermissions[name]\n\t\t\tif (fieldPredicate === undefined || fieldPredicate === false) {\n\t\t\t\treturn false\n\t\t\t}\n\t\t\tif (fieldPredicate === true) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tif (!predicates.includes(fieldPredicate)) {\n\t\t\t\tpredicates.push(fieldPredicate)\n\t\t\t}\n\t\t}\n\t\treturn predicates\n\t}\n\n\tpublic optimizePredicates(where: Input.OptionalWhere, relationContext?: Model.AnyRelationContext, isRoot?: boolean) {\n\t\tif (!relationContext || !relationContext.targetRelation) {\n\t\t\treturn where\n\t\t}\n\t\tconst sourcePredicate = this.create(relationContext.entity, Acl.Operation.read, [relationContext.relation.name], undefined, isRoot)\n\t\tif (Object.keys(sourcePredicate).length === 0) {\n\t\t\treturn where\n\t\t}\n\n\t\tconst replacer = new EvaluatedPredicateReplacer(sourcePredicate, relationContext.entity, relationContext.targetRelation)\n\t\treturn replacer.replace(where)\n\t}\n}\n"],"names":["Acl","EvaluatedPredicateReplacer"],"mappings":";;;;AAIA,MAAM,kCAAkC,CAAC,WAAyB,OAAO;AAOlE,MAAM,iBAAiB;AAAA,EAC7B,YACkB,aACA,OACA,kBACA,gBAChB;AAJgB,SAAA,cAAA;AACA,SAAA,QAAA;AACA,SAAA,mBAAA;AACA,SAAA,iBAAA;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUK,yBAAyB,QAAmC;AACnE,QAAI,WAAW,SAAS,KAAK,gBAAgB;AAC5C,aAAO,KAAK;AAAA,IACb;AACA,WAAO,KAAK;AAAA,EACb;AAAA,EAEO,kBACN,QACA,WACA,WACA,QACyB;AACzB,UAAM,QAAQ,KAAK,yBAAyB,MAAM;AAClD,UAAM,cAAc,MAAM,OAAO,IAAI,GAAG,aAAa,SAAS;AAC9D,UAAM,YAAY,cAAc,SAAS,KAAK;AAC9C,UAAM,gBAAgB,gCAAgC,MAAM;AAE5D,UAAM,mBAAmB,cAAc,aAAa,KAAK;AACzD,UAAM,kBAAkB,cAAc;AAEtC,WAAO;AAAA,MACN;AAAA,MACA;AAAA,IAAA;AAAA,EAEF;AAAA,EAEO,8BACN,QACA,WACA,WACA,QACU;AACV,UAAM,QAAQ,KAAK,yBAAyB,MAAM;AAClD,UAAM,gBAAgB,gCAAgC,MAAM;AAC5D,UAAM,cAAc,MAAM,OAAO,IAAI,GAAG,aAAa,SAAS;AAC9D,WAAO,cAAc,SAAS,MAAM,cAAc,aAAa;AAAA,EAChE;AAAA;AAAA,EAGO,sBAAsB,QAAsB;AAClD,UAAM,iBAA8B,EAAE,CAAC,OAAO,OAAO,GAAG,EAAE,OAAO,OAAK;AACtE,UAAM,oBAAoB,KAAK,YAAY,OAAO,IAAI;AACtD,QAAI,CAAC,mBAAmB;AACvB,aAAO;AAAA,IACR;AACA,UAAM,kBAAkB,kBAAkB,WAAW;AACrD,QAAI,oBAAoB,UAAa,oBAAoB,OAAO;AAC/D,aAAO;AAAA,IACR;AACA,QAAI,oBAAoB,MAAM;AAC7B,aAAO,CAAA;AAAA,IACR;AACA,WAAO,KAAK,gBAAgB,QAAQ,CAAC,eAAe,CAAC;AAAA,EACtD;AAAA,EAEO,OACN,QACA,WACA,aAAuB,CAAC,gCAAgC,MAAM,CAAC,GAC/D,iBACA,QACsB;AACtB,UAAM,QAAQ,KAAK,yBAAyB,MAAM;AAClD,UAAM,oBAA2C,MAAM,OAAO,IAAI;AAClE,UAAM,iBAA8B,EAAE,CAAC,OAAO,OAAO,GAAG,EAAE,OAAO,OAAK;AAEtE,QAAI,CAAC,mBAAmB;AACvB,aAAO;AAAA,IACR;AAEA,QAAI,eAAe,QAAW;AAC7B,mBAAa,CAAC,gCAAgC,MAAM,CAAC;AAAA,IACtD;AACA,UAAM,mBAAmB,kBAAkB,WAAW,SAAS;AAC/D,QAAI,qBAAqB,QAAW;AACnC,aAAO;AAAA,IACR;AACA,UAAM,sBAAsB,KAAK,sBAAsB,YAAY,gBAAgB;AACnF,QAAI,wBAAwB,OAAO;AAClC,aAAO;AAAA,IACR;AAEA,WAAO,KAAK,gBAAgB,QAAQ,qBAAqB,iBAAiB,MAAM;AAAA,EACjF;AAAA,EAEO,gBACN,QACA,YACA,iBACA,QACsB;AACtB,UAAM,QAAQ,KAAK,yBAAyB,MAAM;AAClD,UAAM,oBAA2C,MAAM,OAAO,IAAI,KAAK,CAAA;AAEvE,UAAM,kBAAiC,WAAW;AAAA,MACjD,CAAC,QAAuB,SAAgD;AACvE,YAAI,CAAC,kBAAkB,WAAW,IAAI,GAAG;AACxC,gBAAM,IAAI,MAAM,GAAG,OAAO,IAAI,yBAAyB,IAAI,EAAE;AAAA,QAC9D;AACA,cAAM,iBAA8B,KAAK,iBAAiB,OAAO,QAAQ,kBAAkB,WAAW,IAAI,CAAC;AAC3G,eAAO,CAAC,GAAG,QAAQ,cAAc;AAAA,MAClC;AAAA,MACA,CAAA;AAAA,IAAC;AAEF,QAAI,gBAAgB,WAAW,GAAG;AACjC,aAAO,CAAA;AAAA,IACR;AACA,UAAM,QAAqB,gBAAgB,WAAW,IAAI,gBAAgB,CAAC,IAAI,EAAE,KAAK,gBAAA;AACtF,WAAO,KAAK,mBAAmB,OAAO,iBAAiB,MAAM;AAAA,EAC9D;AAAA,EAEQ,sBACP,YACA,kBACmC;AACnC,UAAM,aAAuC,CAAA;AAC7C,aAAS,QAAQ,YAAY;AAC5B,YAAM,iBAAiB,iBAAiB,IAAI;AAC5C,UAAI,mBAAmB,UAAa,mBAAmB,OAAO;AAC7D,eAAO;AAAA,MACR;AACA,UAAI,mBAAmB,MAAM;AAC5B;AAAA,MACD;AACA,UAAI,CAAC,WAAW,SAAS,cAAc,GAAG;AACzC,mBAAW,KAAK,cAAc;AAAA,MAC/B;AAAA,IACD;AACA,WAAO;AAAA,EACR;AAAA,EAEO,mBAAmB,OAA4B,iBAA4C,QAAkB;AACnH,QAAI,CAAC,mBAAmB,CAAC,gBAAgB,gBAAgB;AACxD,aAAO;AAAA,IACR;AACA,UAAM,kBAAkB,KAAK,OAAO,gBAAgB,QAAQA,OAAAA,IAAI,UAAU,MAAM,CAAC,gBAAgB,SAAS,IAAI,GAAG,QAAW,MAAM;AAClI,QAAI,OAAO,KAAK,eAAe,EAAE,WAAW,GAAG;AAC9C,aAAO;AAAA,IACR;AAEA,UAAM,WAAW,IAAIC,sDAA2B,iBAAiB,gBAAgB,QAAQ,gBAAgB,cAAc;AACvH,WAAO,SAAS,QAAQ,KAAK;AAAA,EAC9B;AACD;;"}

package/dist/development/src/acl/PredicateFactory.js

@@ -2,13 +2,29 @@ import { Acl } from "@contember/schema";
 import { EvaluatedPredicateReplacer } from "./EvaluatedPredicateReplacer.js";
 const getRowLevelPredicatePseudoField = (entity) => entity.primary;
 class PredicateFactory {
-  constructor(permissions, model, variableInjector) {
+  constructor(permissions, model, variableInjector, allPermissions) {
     this.permissions = permissions;
     this.model = model;
     this.variableInjector = variableInjector;
+    this.allPermissions = allPermissions;
   }
-  getFieldPredicate(entity, operation, fieldName) {
-    const permissions = this.permissions[entity.name]?.operations?.[operation];
+  /**
+   * Selects the appropriate permission set based on query context:
+   * - `isRoot === false` (nested/relation context): uses allPermissions (includes through-only permissions)
+   * - `isRoot === true` or `isRoot === undefined` (root or unknown context): uses root-only permissions
+   *
+   * The `undefined` vs `true` distinction matters: `undefined` is the default for callers
+   * that don't track root context, and must fall through to root permissions for safety.
+   */
+  getPermissionsForContext(isRoot) {
+    if (isRoot === false && this.allPermissions) {
+      return this.allPermissions;
+    }
+    return this.permissions;
+  }
+  getFieldPredicate(entity, operation, fieldName, isRoot) {
+    const perms = this.getPermissionsForContext(isRoot);
+    const permissions = perms[entity.name]?.operations?.[operation];
     const predicate = permissions?.[fieldName] ?? false;
     const rowLevelField = getRowLevelPredicatePseudoField(entity);
     const primaryPredicate = permissions?.[rowLevelField] ?? false;
@@ -18,11 +34,13 @@ class PredicateFactory {
       predicate
     };
   }
-  shouldApplyCellLevelPredicate(entity, operation, fieldName) {
+  shouldApplyCellLevelPredicate(entity, operation, fieldName, isRoot) {
+    const perms = this.getPermissionsForContext(isRoot);
     const rowLevelField = getRowLevelPredicatePseudoField(entity);
-    const permissions = this.permissions[entity.name]?.operations?.[operation];
+    const permissions = perms[entity.name]?.operations?.[operation];
     return permissions?.[fieldName] !== permissions?.[rowLevelField];
   }
+  /** Delete predicates are not context-aware — through-permission support is scoped to read operations only. */
   createDeletePredicate(entity) {
     const neverCondition = { [entity.primary]: { never: true } };
     const entityPermissions = this.permissions[entity.name];
@@ -38,8 +56,9 @@ class PredicateFactory {
     }
     return this.buildPredicates(entity, [deletePredicate]);
   }
-  create(entity, operation, fieldNames = [getRowLevelPredicatePseudoField(entity)], relationContext) {
-    const entityPermissions = this.permissions[entity.name];
+  create(entity, operation, fieldNames = [getRowLevelPredicatePseudoField(entity)], relationContext, isRoot) {
+    const perms = this.getPermissionsForContext(isRoot);
+    const entityPermissions = perms[entity.name];
     const neverCondition = { [entity.primary]: { never: true } };
     if (!entityPermissions) {
       return neverCondition;
@@ -55,10 +74,11 @@ class PredicateFactory {
     if (operationPredicates === false) {
       return neverCondition;
     }
-    return this.buildPredicates(entity, operationPredicates, relationContext);
+    return this.buildPredicates(entity, operationPredicates, relationContext, isRoot);
   }
-  buildPredicates(entity, predicates, relationContext) {
-    const entityPermissions = this.permissions[entity.name] ?? {};
+  buildPredicates(entity, predicates, relationContext, isRoot) {
+    const perms = this.getPermissionsForContext(isRoot);
+    const entityPermissions = perms[entity.name] ?? {};
     const predicatesWhere = predicates.reduce(
       (result, name) => {
         if (!entityPermissions.predicates[name]) {
@@ -73,7 +93,7 @@ class PredicateFactory {
       return {};
     }
     const where = predicatesWhere.length === 1 ? predicatesWhere[0] : { and: predicatesWhere };
-    return this.optimizePredicates(where, relationContext);
+    return this.optimizePredicates(where, relationContext, isRoot);
   }
   getRequiredPredicates(fieldNames, fieldPermissions) {
     const predicates = [];
@@ -91,11 +111,11 @@ class PredicateFactory {
     }
     return predicates;
   }
-  optimizePredicates(where, relationContext) {
+  optimizePredicates(where, relationContext, isRoot) {
     if (!relationContext || !relationContext.targetRelation) {
       return where;
     }
-    const sourcePredicate = this.create(relationContext.entity, Acl.Operation.read, [relationContext.relation.name]);
+    const sourcePredicate = this.create(relationContext.entity, Acl.Operation.read, [relationContext.relation.name], void 0, isRoot);
     if (Object.keys(sourcePredicate).length === 0) {
       return where;
     }

package/dist/development/src/acl/PredicateFactory.js.map

@@ -1 +1 @@
-{"version":3,"file":"PredicateFactory.js","sources":["../../../../../packages/engine-content-api/src/acl/PredicateFactory.ts"],"sourcesContent":["import { Acl, Input, Model } from '@contember/schema'\nimport { VariableInjector } from './VariableInjector'\nimport { EvaluatedPredicateReplacer } from './EvaluatedPredicateReplacer'\n\nconst getRowLevelPredicatePseudoField = (entity: Model.Entity) => entity.primary\n\nexport interface FieldRequiredPredicate {\n\tpredicate: Acl.Predicate\n\tisSameAsPrimary: boolean\n}\n\nexport class PredicateFactory {\n\tconstructor(\n\t\tprivate readonly permissions: Acl.Permissions,\n\t\tprivate readonly model: Model.Schema,\n\t\tprivate readonly variableInjector: VariableInjector,\n\t) {}\n\n\tpublic getFieldPredicate(\n\t\tentity: Model.Entity,\n\t\toperation: Acl.Operation.update | Acl.Operation.read | Acl.Operation.create,\n\t\tfieldName: string,\n\t): FieldRequiredPredicate {\n\t\tconst permissions = this.permissions[entity.name]?.operations?.[operation]\n\t\tconst predicate = permissions?.[fieldName] ?? false\n\t\tconst rowLevelField = getRowLevelPredicatePseudoField(entity)\n\n\t\tconst primaryPredicate = permissions?.[rowLevelField] ?? false\n\t\tconst isSameAsPrimary = predicate === primaryPredicate\n\n\t\treturn {\n\t\t\tisSameAsPrimary,\n\t\t\tpredicate,\n\t\t}\n\t}\n\n\tpublic shouldApplyCellLevelPredicate(\n\t\tentity: Model.Entity,\n\t\toperation: Acl.Operation.read,\n\t\tfieldName: string,\n\t): boolean {\n\t\tconst rowLevelField = getRowLevelPredicatePseudoField(entity)\n\t\tconst permissions = this.permissions[entity.name]?.operations?.[operation]\n\t\treturn permissions?.[fieldName] !== permissions?.[rowLevelField]\n\t}\n\n\tpublic createDeletePredicate(entity: Model.Entity) {\n\t\tconst neverCondition: Input.Where = { [entity.primary]: { never: true } }\n\t\tconst entityPermissions = this.permissions[entity.name]\n\t\tif (!entityPermissions) {\n\t\t\treturn neverCondition\n\t\t}\n\t\tconst deletePredicate = entityPermissions.operations.delete\n\t\tif (deletePredicate === undefined || deletePredicate === false) {\n\t\t\treturn neverCondition\n\t\t}\n\t\tif (deletePredicate === true) {\n\t\t\treturn {}\n\t\t}\n\t\treturn this.buildPredicates(entity, [deletePredicate])\n\t}\n\n\tpublic create(\n\t\tentity: Model.Entity,\n\t\toperation: Acl.Operation.update | Acl.Operation.read | Acl.Operation.create,\n\t\tfieldNames: string[] = [getRowLevelPredicatePseudoField(entity)],\n\t\trelationContext?: Model.AnyRelationContext,\n\t): Input.OptionalWhere {\n\t\tconst entityPermissions: Acl.EntityPermissions = this.permissions[entity.name]\n\t\tconst neverCondition: Input.Where = { [entity.primary]: { never: true } }\n\n\t\tif (!entityPermissions) {\n\t\t\treturn neverCondition\n\t\t}\n\n\t\tif (fieldNames === undefined) {\n\t\t\tfieldNames = [getRowLevelPredicatePseudoField(entity)]\n\t\t}\n\t\tconst fieldPermissions = entityPermissions.operations[operation]\n\t\tif (fieldPermissions === undefined) {\n\t\t\treturn neverCondition\n\t\t}\n\t\tconst operationPredicates = this.getRequiredPredicates(fieldNames, fieldPermissions)\n\t\tif (operationPredicates === false) {\n\t\t\treturn neverCondition\n\t\t}\n\n\t\treturn this.buildPredicates(entity, operationPredicates, relationContext)\n\t}\n\n\tpublic buildPredicates(entity: Model.Entity, predicates: Acl.PredicateReference[], relationContext?: Model.AnyRelationContext): Input.OptionalWhere {\n\t\tconst entityPermissions: Acl.EntityPermissions = this.permissions[entity.name] ?? {}\n\n\t\tconst predicatesWhere: Input.Where[] = predicates.reduce(\n\t\t\t(result: Input.Where[], name: Acl.PredicateReference): Input.Where[] => {\n\t\t\t\tif (!entityPermissions.predicates[name]) {\n\t\t\t\t\tthrow new Error(`${entity.name}: Undefined predicate ${name}`)\n\t\t\t\t}\n\t\t\t\tconst predicateWhere: Input.Where = this.variableInjector.inject(entity, entityPermissions.predicates[name])\n\t\t\t\treturn [...result, predicateWhere]\n\t\t\t},\n\t\t\t[],\n\t\t)\n\t\tif (predicatesWhere.length === 0) {\n\t\t\treturn {}\n\t\t}\n\t\tconst where: Input.Where = predicatesWhere.length === 1 ? predicatesWhere[0] : { and: predicatesWhere }\n\t\treturn this.optimizePredicates(where, relationContext)\n\n\t}\n\n\tprivate getRequiredPredicates(\n\t\tfieldNames: string[],\n\t\tfieldPermissions: Acl.FieldPermissions,\n\t): Acl.PredicateReference[] | false {\n\t\tconst predicates: Acl.PredicateReference[] = []\n\t\tfor (let name of fieldNames) {\n\t\t\tconst fieldPredicate = fieldPermissions[name]\n\t\t\tif (fieldPredicate === undefined || fieldPredicate === false) {\n\t\t\t\treturn false\n\t\t\t}\n\t\t\tif (fieldPredicate === true) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tif (!predicates.includes(fieldPredicate)) {\n\t\t\t\tpredicates.push(fieldPredicate)\n\t\t\t}\n\t\t}\n\t\treturn predicates\n\t}\n\n\tpublic optimizePredicates(where: Input.OptionalWhere, relationContext?: Model.AnyRelationContext) {\n\t\tif (!relationContext || !relationContext.targetRelation) {\n\t\t\treturn where\n\t\t}\n\t\tconst sourcePredicate = this.create(relationContext.entity, Acl.Operation.read, [relationContext.relation.name])\n\t\tif (Object.keys(sourcePredicate).length === 0) {\n\t\t\treturn where\n\t\t}\n\n\t\tconst replacer = new EvaluatedPredicateReplacer(sourcePredicate, relationContext.entity, relationContext.targetRelation)\n\t\treturn replacer.replace(where)\n\t}\n}\n"],"names":[],"mappings":";;AAIA,MAAM,kCAAkC,CAAC,WAAyB,OAAO;AAOlE,MAAM,iBAAiB;AAAA,EAC7B,YACkB,aACA,OACA,kBAChB;AAHgB,SAAA,cAAA;AACA,SAAA,QAAA;AACA,SAAA,mBAAA;AAAA,EAAA;AAAA,EAGX,kBACN,QACA,WACA,WACyB;AACzB,UAAM,cAAc,KAAK,YAAY,OAAO,IAAI,GAAG,aAAa,SAAS;AACnE,UAAA,YAAY,cAAc,SAAS,KAAK;AACxC,UAAA,gBAAgB,gCAAgC,MAAM;AAEtD,UAAA,mBAAmB,cAAc,aAAa,KAAK;AACzD,UAAM,kBAAkB,cAAc;AAE/B,WAAA;AAAA,MACN;AAAA,MACA;AAAA,IACD;AAAA,EAAA;AAAA,EAGM,8BACN,QACA,WACA,WACU;AACJ,UAAA,gBAAgB,gCAAgC,MAAM;AAC5D,UAAM,cAAc,KAAK,YAAY,OAAO,IAAI,GAAG,aAAa,SAAS;AACzE,WAAO,cAAc,SAAS,MAAM,cAAc,aAAa;AAAA,EAAA;AAAA,EAGzD,sBAAsB,QAAsB;AAC5C,UAAA,iBAA8B,EAAE,CAAC,OAAO,OAAO,GAAG,EAAE,OAAO,OAAO;AACxE,UAAM,oBAAoB,KAAK,YAAY,OAAO,IAAI;AACtD,QAAI,CAAC,mBAAmB;AAChB,aAAA;AAAA,IAAA;AAEF,UAAA,kBAAkB,kBAAkB,WAAW;AACjD,QAAA,oBAAoB,UAAa,oBAAoB,OAAO;AACxD,aAAA;AAAA,IAAA;AAER,QAAI,oBAAoB,MAAM;AAC7B,aAAO,CAAC;AAAA,IAAA;AAET,WAAO,KAAK,gBAAgB,QAAQ,CAAC,eAAe,CAAC;AAAA,EAAA;AAAA,EAG/C,OACN,QACA,WACA,aAAuB,CAAC,gCAAgC,MAAM,CAAC,GAC/D,iBACsB;AACtB,UAAM,oBAA2C,KAAK,YAAY,OAAO,IAAI;AACvE,UAAA,iBAA8B,EAAE,CAAC,OAAO,OAAO,GAAG,EAAE,OAAO,OAAO;AAExE,QAAI,CAAC,mBAAmB;AAChB,aAAA;AAAA,IAAA;AAGR,QAAI,eAAe,QAAW;AAChB,mBAAA,CAAC,gCAAgC,MAAM,CAAC;AAAA,IAAA;AAEhD,UAAA,mBAAmB,kBAAkB,WAAW,SAAS;AAC/D,QAAI,qBAAqB,QAAW;AAC5B,aAAA;AAAA,IAAA;AAER,UAAM,sBAAsB,KAAK,sBAAsB,YAAY,gBAAgB;AACnF,QAAI,wBAAwB,OAAO;AAC3B,aAAA;AAAA,IAAA;AAGR,WAAO,KAAK,gBAAgB,QAAQ,qBAAqB,eAAe;AAAA,EAAA;AAAA,EAGlE,gBAAgB,QAAsB,YAAsC,iBAAiE;AACnJ,UAAM,oBAA2C,KAAK,YAAY,OAAO,IAAI,KAAK,CAAC;AAEnF,UAAM,kBAAiC,WAAW;AAAA,MACjD,CAAC,QAAuB,SAAgD;AACvE,YAAI,CAAC,kBAAkB,WAAW,IAAI,GAAG;AACxC,gBAAM,IAAI,MAAM,GAAG,OAAO,IAAI,yBAAyB,IAAI,EAAE;AAAA,QAAA;AAExD,cAAA,iBAA8B,KAAK,iBAAiB,OAAO,QAAQ,kBAAkB,WAAW,IAAI,CAAC;AACpG,eAAA,CAAC,GAAG,QAAQ,cAAc;AAAA,MAClC;AAAA,MACA,CAAA;AAAA,IACD;AACI,QAAA,gBAAgB,WAAW,GAAG;AACjC,aAAO,CAAC;AAAA,IAAA;AAEH,UAAA,QAAqB,gBAAgB,WAAW,IAAI,gBAAgB,CAAC,IAAI,EAAE,KAAK,gBAAgB;AAC/F,WAAA,KAAK,mBAAmB,OAAO,eAAe;AAAA,EAAA;AAAA,EAI9C,sBACP,YACA,kBACmC;AACnC,UAAM,aAAuC,CAAC;AAC9C,aAAS,QAAQ,YAAY;AACtB,YAAA,iBAAiB,iBAAiB,IAAI;AACxC,UAAA,mBAAmB,UAAa,mBAAmB,OAAO;AACtD,eAAA;AAAA,MAAA;AAER,UAAI,mBAAmB,MAAM;AAC5B;AAAA,MAAA;AAED,UAAI,CAAC,WAAW,SAAS,cAAc,GAAG;AACzC,mBAAW,KAAK,cAAc;AAAA,MAAA;AAAA,IAC/B;AAEM,WAAA;AAAA,EAAA;AAAA,EAGD,mBAAmB,OAA4B,iBAA4C;AACjG,QAAI,CAAC,mBAAmB,CAAC,gBAAgB,gBAAgB;AACjD,aAAA;AAAA,IAAA;AAER,UAAM,kBAAkB,KAAK,OAAO,gBAAgB,QAAQ,IAAI,UAAU,MAAM,CAAC,gBAAgB,SAAS,IAAI,CAAC;AAC/G,QAAI,OAAO,KAAK,eAAe,EAAE,WAAW,GAAG;AACvC,aAAA;AAAA,IAAA;AAGR,UAAM,WAAW,IAAI,2BAA2B,iBAAiB,gBAAgB,QAAQ,gBAAgB,cAAc;AAChH,WAAA,SAAS,QAAQ,KAAK;AAAA,EAAA;AAE/B;"}
+{"version":3,"file":"PredicateFactory.js","sources":["../../../../../packages/engine-content-api/src/acl/PredicateFactory.ts"],"sourcesContent":["import { Acl, Input, Model } from '@contember/schema'\nimport { VariableInjector } from './VariableInjector'\nimport { EvaluatedPredicateReplacer } from './EvaluatedPredicateReplacer'\n\nconst getRowLevelPredicatePseudoField = (entity: Model.Entity) => entity.primary\n\nexport interface FieldRequiredPredicate {\n\tpredicate: Acl.Predicate\n\tisSameAsPrimary: boolean\n}\n\nexport class PredicateFactory {\n\tconstructor(\n\t\tprivate readonly permissions: Acl.Permissions,\n\t\tprivate readonly model: Model.Schema,\n\t\tprivate readonly variableInjector: VariableInjector,\n\t\tprivate readonly allPermissions?: Acl.Permissions,\n\t) {}\n\n\t/**\n\t * Selects the appropriate permission set based on query context:\n\t * - `isRoot === false` (nested/relation context): uses allPermissions (includes through-only permissions)\n\t * - `isRoot === true` or `isRoot === undefined` (root or unknown context): uses root-only permissions\n\t *\n\t * The `undefined` vs `true` distinction matters: `undefined` is the default for callers\n\t * that don't track root context, and must fall through to root permissions for safety.\n\t */\n\tprivate getPermissionsForContext(isRoot?: boolean): Acl.Permissions {\n\t\tif (isRoot === false && this.allPermissions) {\n\t\t\treturn this.allPermissions\n\t\t}\n\t\treturn this.permissions\n\t}\n\n\tpublic getFieldPredicate(\n\t\tentity: Model.Entity,\n\t\toperation: Acl.Operation.update | Acl.Operation.read | Acl.Operation.create,\n\t\tfieldName: string,\n\t\tisRoot?: boolean,\n\t): FieldRequiredPredicate {\n\t\tconst perms = this.getPermissionsForContext(isRoot)\n\t\tconst permissions = perms[entity.name]?.operations?.[operation]\n\t\tconst predicate = permissions?.[fieldName] ?? false\n\t\tconst rowLevelField = getRowLevelPredicatePseudoField(entity)\n\n\t\tconst primaryPredicate = permissions?.[rowLevelField] ?? false\n\t\tconst isSameAsPrimary = predicate === primaryPredicate\n\n\t\treturn {\n\t\t\tisSameAsPrimary,\n\t\t\tpredicate,\n\t\t}\n\t}\n\n\tpublic shouldApplyCellLevelPredicate(\n\t\tentity: Model.Entity,\n\t\toperation: Acl.Operation.read,\n\t\tfieldName: string,\n\t\tisRoot?: boolean,\n\t): boolean {\n\t\tconst perms = this.getPermissionsForContext(isRoot)\n\t\tconst rowLevelField = getRowLevelPredicatePseudoField(entity)\n\t\tconst permissions = perms[entity.name]?.operations?.[operation]\n\t\treturn permissions?.[fieldName] !== permissions?.[rowLevelField]\n\t}\n\n\t/** Delete predicates are not context-aware — through-permission support is scoped to read operations only. */\n\tpublic createDeletePredicate(entity: Model.Entity) {\n\t\tconst neverCondition: Input.Where = { [entity.primary]: { never: true } }\n\t\tconst entityPermissions = this.permissions[entity.name]\n\t\tif (!entityPermissions) {\n\t\t\treturn neverCondition\n\t\t}\n\t\tconst deletePredicate = entityPermissions.operations.delete\n\t\tif (deletePredicate === undefined || deletePredicate === false) {\n\t\t\treturn neverCondition\n\t\t}\n\t\tif (deletePredicate === true) {\n\t\t\treturn {}\n\t\t}\n\t\treturn this.buildPredicates(entity, [deletePredicate])\n\t}\n\n\tpublic create(\n\t\tentity: Model.Entity,\n\t\toperation: Acl.Operation.update | Acl.Operation.read | Acl.Operation.create,\n\t\tfieldNames: string[] = [getRowLevelPredicatePseudoField(entity)],\n\t\trelationContext?: Model.AnyRelationContext,\n\t\tisRoot?: boolean,\n\t): Input.OptionalWhere {\n\t\tconst perms = this.getPermissionsForContext(isRoot)\n\t\tconst entityPermissions: Acl.EntityPermissions = perms[entity.name]\n\t\tconst neverCondition: Input.Where = { [entity.primary]: { never: true } }\n\n\t\tif (!entityPermissions) {\n\t\t\treturn neverCondition\n\t\t}\n\n\t\tif (fieldNames === undefined) {\n\t\t\tfieldNames = [getRowLevelPredicatePseudoField(entity)]\n\t\t}\n\t\tconst fieldPermissions = entityPermissions.operations[operation]\n\t\tif (fieldPermissions === undefined) {\n\t\t\treturn neverCondition\n\t\t}\n\t\tconst operationPredicates = this.getRequiredPredicates(fieldNames, fieldPermissions)\n\t\tif (operationPredicates === false) {\n\t\t\treturn neverCondition\n\t\t}\n\n\t\treturn this.buildPredicates(entity, operationPredicates, relationContext, isRoot)\n\t}\n\n\tpublic buildPredicates(\n\t\tentity: Model.Entity,\n\t\tpredicates: Acl.PredicateReference[],\n\t\trelationContext?: Model.AnyRelationContext,\n\t\tisRoot?: boolean,\n\t): Input.OptionalWhere {\n\t\tconst perms = this.getPermissionsForContext(isRoot)\n\t\tconst entityPermissions: Acl.EntityPermissions = perms[entity.name] ?? {}\n\n\t\tconst predicatesWhere: Input.Where[] = predicates.reduce(\n\t\t\t(result: Input.Where[], name: Acl.PredicateReference): Input.Where[] => {\n\t\t\t\tif (!entityPermissions.predicates[name]) {\n\t\t\t\t\tthrow new Error(`${entity.name}: Undefined predicate ${name}`)\n\t\t\t\t}\n\t\t\t\tconst predicateWhere: Input.Where = this.variableInjector.inject(entity, entityPermissions.predicates[name])\n\t\t\t\treturn [...result, predicateWhere]\n\t\t\t},\n\t\t\t[],\n\t\t)\n\t\tif (predicatesWhere.length === 0) {\n\t\t\treturn {}\n\t\t}\n\t\tconst where: Input.Where = predicatesWhere.length === 1 ? predicatesWhere[0] : { and: predicatesWhere }\n\t\treturn this.optimizePredicates(where, relationContext, isRoot)\n\t}\n\n\tprivate getRequiredPredicates(\n\t\tfieldNames: string[],\n\t\tfieldPermissions: Acl.FieldPermissions,\n\t): Acl.PredicateReference[] | false {\n\t\tconst predicates: Acl.PredicateReference[] = []\n\t\tfor (let name of fieldNames) {\n\t\t\tconst fieldPredicate = fieldPermissions[name]\n\t\t\tif (fieldPredicate === undefined || fieldPredicate === false) {\n\t\t\t\treturn false\n\t\t\t}\n\t\t\tif (fieldPredicate === true) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tif (!predicates.includes(fieldPredicate)) {\n\t\t\t\tpredicates.push(fieldPredicate)\n\t\t\t}\n\t\t}\n\t\treturn predicates\n\t}\n\n\tpublic optimizePredicates(where: Input.OptionalWhere, relationContext?: Model.AnyRelationContext, isRoot?: boolean) {\n\t\tif (!relationContext || !relationContext.targetRelation) {\n\t\t\treturn where\n\t\t}\n\t\tconst sourcePredicate = this.create(relationContext.entity, Acl.Operation.read, [relationContext.relation.name], undefined, isRoot)\n\t\tif (Object.keys(sourcePredicate).length === 0) {\n\t\t\treturn where\n\t\t}\n\n\t\tconst replacer = new EvaluatedPredicateReplacer(sourcePredicate, relationContext.entity, relationContext.targetRelation)\n\t\treturn replacer.replace(where)\n\t}\n}\n"],"names":[],"mappings":";;AAIA,MAAM,kCAAkC,CAAC,WAAyB,OAAO;AAOlE,MAAM,iBAAiB;AAAA,EAC7B,YACkB,aACA,OACA,kBACA,gBAChB;AAJgB,SAAA,cAAA;AACA,SAAA,QAAA;AACA,SAAA,mBAAA;AACA,SAAA,iBAAA;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUK,yBAAyB,QAAmC;AACnE,QAAI,WAAW,SAAS,KAAK,gBAAgB;AAC5C,aAAO,KAAK;AAAA,IACb;AACA,WAAO,KAAK;AAAA,EACb;AAAA,EAEO,kBACN,QACA,WACA,WACA,QACyB;AACzB,UAAM,QAAQ,KAAK,yBAAyB,MAAM;AAClD,UAAM,cAAc,MAAM,OAAO,IAAI,GAAG,aAAa,SAAS;AAC9D,UAAM,YAAY,cAAc,SAAS,KAAK;AAC9C,UAAM,gBAAgB,gCAAgC,MAAM;AAE5D,UAAM,mBAAmB,cAAc,aAAa,KAAK;AACzD,UAAM,kBAAkB,cAAc;AAEtC,WAAO;AAAA,MACN;AAAA,MACA;AAAA,IAAA;AAAA,EAEF;AAAA,EAEO,8BACN,QACA,WACA,WACA,QACU;AACV,UAAM,QAAQ,KAAK,yBAAyB,MAAM;AAClD,UAAM,gBAAgB,gCAAgC,MAAM;AAC5D,UAAM,cAAc,MAAM,OAAO,IAAI,GAAG,aAAa,SAAS;AAC9D,WAAO,cAAc,SAAS,MAAM,cAAc,aAAa;AAAA,EAChE;AAAA;AAAA,EAGO,sBAAsB,QAAsB;AAClD,UAAM,iBAA8B,EAAE,CAAC,OAAO,OAAO,GAAG,EAAE,OAAO,OAAK;AACtE,UAAM,oBAAoB,KAAK,YAAY,OAAO,IAAI;AACtD,QAAI,CAAC,mBAAmB;AACvB,aAAO;AAAA,IACR;AACA,UAAM,kBAAkB,kBAAkB,WAAW;AACrD,QAAI,oBAAoB,UAAa,oBAAoB,OAAO;AAC/D,aAAO;AAAA,IACR;AACA,QAAI,oBAAoB,MAAM;AAC7B,aAAO,CAAA;AAAA,IACR;AACA,WAAO,KAAK,gBAAgB,QAAQ,CAAC,eAAe,CAAC;AAAA,EACtD;AAAA,EAEO,OACN,QACA,WACA,aAAuB,CAAC,gCAAgC,MAAM,CAAC,GAC/D,iBACA,QACsB;AACtB,UAAM,QAAQ,KAAK,yBAAyB,MAAM;AAClD,UAAM,oBAA2C,MAAM,OAAO,IAAI;AAClE,UAAM,iBAA8B,EAAE,CAAC,OAAO,OAAO,GAAG,EAAE,OAAO,OAAK;AAEtE,QAAI,CAAC,mBAAmB;AACvB,aAAO;AAAA,IACR;AAEA,QAAI,eAAe,QAAW;AAC7B,mBAAa,CAAC,gCAAgC,MAAM,CAAC;AAAA,IACtD;AACA,UAAM,mBAAmB,kBAAkB,WAAW,SAAS;AAC/D,QAAI,qBAAqB,QAAW;AACnC,aAAO;AAAA,IACR;AACA,UAAM,sBAAsB,KAAK,sBAAsB,YAAY,gBAAgB;AACnF,QAAI,wBAAwB,OAAO;AAClC,aAAO;AAAA,IACR;AAEA,WAAO,KAAK,gBAAgB,QAAQ,qBAAqB,iBAAiB,MAAM;AAAA,EACjF;AAAA,EAEO,gBACN,QACA,YACA,iBACA,QACsB;AACtB,UAAM,QAAQ,KAAK,yBAAyB,MAAM;AAClD,UAAM,oBAA2C,MAAM,OAAO,IAAI,KAAK,CAAA;AAEvE,UAAM,kBAAiC,WAAW;AAAA,MACjD,CAAC,QAAuB,SAAgD;AACvE,YAAI,CAAC,kBAAkB,WAAW,IAAI,GAAG;AACxC,gBAAM,IAAI,MAAM,GAAG,OAAO,IAAI,yBAAyB,IAAI,EAAE;AAAA,QAC9D;AACA,cAAM,iBAA8B,KAAK,iBAAiB,OAAO,QAAQ,kBAAkB,WAAW,IAAI,CAAC;AAC3G,eAAO,CAAC,GAAG,QAAQ,cAAc;AAAA,MAClC;AAAA,MACA,CAAA;AAAA,IAAC;AAEF,QAAI,gBAAgB,WAAW,GAAG;AACjC,aAAO,CAAA;AAAA,IACR;AACA,UAAM,QAAqB,gBAAgB,WAAW,IAAI,gBAAgB,CAAC,IAAI,EAAE,KAAK,gBAAA;AACtF,WAAO,KAAK,mBAAmB,OAAO,iBAAiB,MAAM;AAAA,EAC9D;AAAA,EAEQ,sBACP,YACA,kBACmC;AACnC,UAAM,aAAuC,CAAA;AAC7C,aAAS,QAAQ,YAAY;AAC5B,YAAM,iBAAiB,iBAAiB,IAAI;AAC5C,UAAI,mBAAmB,UAAa,mBAAmB,OAAO;AAC7D,eAAO;AAAA,MACR;AACA,UAAI,mBAAmB,MAAM;AAC5B;AAAA,MACD;AACA,UAAI,CAAC,WAAW,SAAS,cAAc,GAAG;AACzC,mBAAW,KAAK,cAAc;AAAA,MAC/B;AAAA,IACD;AACA,WAAO;AAAA,EACR;AAAA,EAEO,mBAAmB,OAA4B,iBAA4C,QAAkB;AACnH,QAAI,CAAC,mBAAmB,CAAC,gBAAgB,gBAAgB;AACxD,aAAO;AAAA,IACR;AACA,UAAM,kBAAkB,KAAK,OAAO,gBAAgB,QAAQ,IAAI,UAAU,MAAM,CAAC,gBAAgB,SAAS,IAAI,GAAG,QAAW,MAAM;AAClI,QAAI,OAAO,KAAK,eAAe,EAAE,WAAW,GAAG;AAC9C,aAAO;AAAA,IACR;AAEA,UAAM,WAAW,IAAI,2BAA2B,iBAAiB,gBAAgB,QAAQ,gBAAgB,cAAc;AACvH,WAAO,SAAS,QAAQ,KAAK;AAAA,EAC9B;AACD;"}

package/dist/development/src/acl/PredicatesInjector.cjs

@@ -7,13 +7,38 @@ class PredicatesInjector {
     this.schema = schema2;
     this.predicateFactory = predicateFactory;
   }
-  inject(entity, where, relationContext) {
-    const restrictedWhere = this.injectToWhere(where, entity, true);
-    return this.createWhere(entity, void 0, restrictedWhere, relationContext);
+  inject(entity, where, relationContext, ancestorPath) {
+    const isQueryRoot = !relationContext && (!ancestorPath || ancestorPath.length === 0);
+    const restrictedWhere = this.injectToWhere(where, entity, true, relationContext, false, ancestorPath ?? [], isQueryRoot);
+    return this.createWhere(entity, void 0, restrictedWhere, relationContext, false, ancestorPath ?? [], isQueryRoot);
   }
-  createWhere(entity, fieldNames, where, relationContext) {
-    const predicatesWhere = this.predicateFactory.create(entity, schema.Acl.Operation.read, fieldNames, relationContext);
-    where = this.predicateFactory.optimizePredicates(where, relationContext);
+  /**
+   * Finds an ancestor in the path that matches the given relation as a back-reference.
+   * A match occurs when:
+   * 1. The relation we're traversing has the same name as the inverse (targetRelation) of a relation in the ancestor path
+   * 2. AND the entity where our relation is defined matches the targetEntity in the path
+   *    (to prevent false positives when different entities have relations with the same name)
+   */
+  findBackReferencedAncestor(ancestorPath, relationName, relationSourceEntityName) {
+    return ancestorPath.find(
+      (ctx) => ctx.targetRelation?.name === relationName && ctx.targetEntity.name === relationSourceEntityName
+    );
+  }
+  createWhere(entity, fieldNames, where, relationContext, isBackReferenceContext, ancestorPath, isQueryRoot) {
+    const shouldSimplify = isBackReferenceContext === true && ancestorPath !== void 0 && relationContext !== void 0 && this.findBackReferencedAncestor(ancestorPath, relationContext.relation.name, relationContext.entity.name) !== void 0;
+    let predicatesWhere;
+    if (shouldSimplify) {
+      predicatesWhere = { [entity.primary]: { always: true } };
+    } else {
+      const rawPredicate = this.predicateFactory.create(entity, schema.Acl.Operation.read, fieldNames, relationContext, isQueryRoot);
+      predicatesWhere = this.injectPredicatesToPredicate(
+        rawPredicate,
+        entity,
+        isBackReferenceContext ?? false,
+        ancestorPath ?? [],
+        isQueryRoot
+      );
+    }
     const and = [where, predicatesWhere].filter((it) => Object.keys(it).length > 0);
     if (and.length === 0) {
       return {};
@@ -23,16 +48,80 @@ class PredicatesInjector {
     }
     return { and };
   }
-  injectToWhere(where, entity, isRoot, relationContext) {
+  /**
+   * Processes a predicate and injects nested entity predicates for any relation traversals.
+   * This ensures that when a predicate like { department: { company: { name: 'Acme' } } }
+   * is used, the predicates of Department and Company are also applied.
+   */
+  injectPredicatesToPredicate(where, entity, isBackReferenceContext, ancestorPath, isQueryRoot) {
+    const resultWhere = {};
+    if (where.and) {
+      resultWhere.and = where.and.filter((it) => !!it).map((it) => this.injectPredicatesToPredicate(it, entity, isBackReferenceContext, ancestorPath, isQueryRoot));
+    }
+    if (where.or) {
+      resultWhere.or = where.or.filter((it) => !!it).map((it) => this.injectPredicatesToPredicate(it, entity, isBackReferenceContext, ancestorPath, isQueryRoot));
+    }
+    if (where.not) {
+      resultWhere.not = this.injectPredicatesToPredicate(where.not, entity, isBackReferenceContext, ancestorPath, isQueryRoot);
+    }
+    const fields = Object.keys(where).filter((it) => !["and", "or", "not"].includes(it));
+    for (const field of fields) {
+      resultWhere[field] = schemaUtils.acceptFieldVisitor(this.schema, entity, field, {
+        visitColumn: () => where[field],
+        visitRelation: (context) => {
+          const relationWhere = where[field];
+          if (relationWhere === null) {
+            return null;
+          }
+          const isBackReference = this.findBackReferencedAncestor(
+            ancestorPath,
+            context.relation.name,
+            context.entity.name
+          ) !== void 0;
+          const nestedIsBackReferenceContext = isBackReference || isBackReferenceContext;
+          const nestedAncestorPath = [...ancestorPath, context];
+          const processedNestedWhere = this.injectPredicatesToPredicate(
+            relationWhere,
+            context.targetEntity,
+            nestedIsBackReferenceContext,
+            nestedAncestorPath,
+            isQueryRoot
+          );
+          const shouldSimplifyNested = nestedIsBackReferenceContext && this.findBackReferencedAncestor(nestedAncestorPath, context.relation.name, context.entity.name) !== void 0;
+          const targetPredicate = shouldSimplifyNested ? { [context.targetEntity.primary]: { always: true } } : this.predicateFactory.create(context.targetEntity, schema.Acl.Operation.read, void 0, context, isQueryRoot);
+          const primaryKey = context.targetEntity.primary;
+          const nestedIsAlwaysTrue = Object.keys(processedNestedWhere).length === 1 && processedNestedWhere[primaryKey] !== void 0 && processedNestedWhere[primaryKey]?.always === true;
+          const targetIsAlwaysTrue = Object.keys(targetPredicate).length === 1 && targetPredicate[primaryKey] !== void 0 && targetPredicate[primaryKey]?.always === true;
+          if (nestedIsAlwaysTrue && targetIsAlwaysTrue) {
+            return processedNestedWhere;
+          }
+          const parts = [processedNestedWhere, targetPredicate].filter((it) => Object.keys(it).length > 0);
+          if (parts.length === 0) {
+            return {};
+          }
+          if (parts.length === 1) {
+            return parts[0];
+          }
+          return { and: parts };
+        }
+      });
+    }
+    return resultWhere;
+  }
+  injectToWhere(where, entity, isRoot, relationContext, isBackReferenceContext, ancestorPath, isQueryRoot) {
     const resultWhere = {};
     if (where.and) {
-      resultWhere.and = where.and.filter((it) => !!it).map((it) => this.injectToWhere(it, entity, isRoot, relationContext));
+      resultWhere.and = where.and.filter((it) => !!it).map(
+        (it) => this.injectToWhere(it, entity, isRoot, relationContext, isBackReferenceContext, ancestorPath, isQueryRoot)
+      );
     }
     if (where.or) {
-      resultWhere.or = where.or.filter((it) => !!it).map((it) => this.injectToWhere(it, entity, isRoot, relationContext));
+      resultWhere.or = where.or.filter((it) => !!it).map(
+        (it) => this.injectToWhere(it, entity, isRoot, relationContext, isBackReferenceContext, ancestorPath, isQueryRoot)
+      );
     }
     if (where.not) {
-      resultWhere.not = this.injectToWhere(where.not, entity, isRoot, relationContext);
+      resultWhere.not = this.injectToWhere(where.not, entity, isRoot, relationContext, isBackReferenceContext, ancestorPath, isQueryRoot);
     }
     const fields = Object.keys(where).filter((it) => !["and", "or", "not"].includes(it));
     if (fields.length === 0) {
@@ -46,12 +135,15 @@ class PredicatesInjector {
           if (relationWhere === null) {
             return null;
           }
-          return this.injectToWhere(relationWhere, context.targetEntity, false, context);
+          const isBackReference = this.findBackReferencedAncestor(ancestorPath, context.relation.name, context.entity.name) !== void 0;
+          const nestedIsBackReferenceContext = isBackReference || isBackReferenceContext;
+          const nestedAncestorPath = [...ancestorPath, context];
+          return this.injectToWhere(relationWhere, context.targetEntity, false, context, nestedIsBackReferenceContext, nestedAncestorPath, isQueryRoot);
         }
       });
     }
-    const fieldsForPredicate = !isRoot ? fields : fields.filter((it) => this.predicateFactory.shouldApplyCellLevelPredicate(entity, schema.Acl.Operation.read, it));
-    return this.createWhere(entity, fieldsForPredicate, resultWhere, relationContext);
+    const fieldsForPredicate = !isRoot ? fields : fields.filter((it) => this.predicateFactory.shouldApplyCellLevelPredicate(entity, schema.Acl.Operation.read, it, isQueryRoot));
+    return this.createWhere(entity, fieldsForPredicate, resultWhere, relationContext, isBackReferenceContext, ancestorPath, isQueryRoot);
   }
 }
 exports.PredicatesInjector = PredicatesInjector;

package/dist/development/src/acl/PredicatesInjector.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"PredicatesInjector.cjs","sources":["../../../../../packages/engine-content-api/src/acl/PredicatesInjector.ts"],"sourcesContent":["import { Acl, Input, Model, Writable } from '@contember/schema'\nimport { acceptFieldVisitor } from '@contember/schema-utils'\nimport { PredicateFactory } from './PredicateFactory'\n\nexport class PredicatesInjector {\n\tconstructor(private readonly schema: Model.Schema, private readonly predicateFactory: PredicateFactory) {}\n\n\tpublic inject(entity: Model.Entity, where: Input.OptionalWhere, relationContext?: Model.AnyRelationContext): Input.OptionalWhere {\n\t\tconst restrictedWhere = this.injectToWhere(where, entity, true)\n\t\treturn this.createWhere(entity, undefined, restrictedWhere, relationContext)\n\t}\n\n\tprivate createWhere(\n\t\tentity: Model.Entity,\n\t\tfieldNames: string[] | undefined,\n\t\twhere: Input.OptionalWhere,\n\t\trelationContext?: Model.AnyRelationContext,\n\t): Input.OptionalWhere {\n\t\tconst predicatesWhere = this.predicateFactory.create(entity, Acl.Operation.read, fieldNames, relationContext)\n\t\twhere = this.predicateFactory.optimizePredicates(where, relationContext)\n\n\t\tconst and = [where, predicatesWhere].filter(it => Object.keys(it).length > 0)\n\t\tif (and.length === 0) {\n\t\t\treturn {}\n\t\t}\n\t\tif (and.length === 1) {\n\t\t\treturn and[0]\n\t\t}\n\t\treturn { and: and }\n\t}\n\n\tprivate injectToWhere(\n\t\twhere: Input.OptionalWhere,\n\t\tentity: Model.Entity,\n\t\tisRoot: boolean,\n\t\trelationContext?: Model.AnyRelationContext,\n\t): Input.OptionalWhere {\n\t\tconst resultWhere: Writable<Input.OptionalWhere> = {}\n\t\tif (where.and) {\n\t\t\tresultWhere.and = where.and.filter((it): it is Input.Where => !!it).map(it => this.injectToWhere(it, entity, isRoot, relationContext))\n\t\t}\n\t\tif (where.or) {\n\t\t\tresultWhere.or = where.or.filter((it): it is Input.Where => !!it).map(it => this.injectToWhere(it, entity, isRoot, relationContext))\n\t\t}\n\t\tif (where.not) {\n\t\t\tresultWhere.not = this.injectToWhere(where.not, entity, isRoot, relationContext)\n\t\t}\n\n\t\tconst fields = Object.keys(where).filter(it => !['and', 'or', 'not'].includes(it))\n\n\t\tif (fields.length === 0) {\n\t\t\treturn resultWhere\n\t\t}\n\t\tfor (let field of fields) {\n\t\t\tresultWhere[field] = acceptFieldVisitor(this.schema, entity, field, {\n\t\t\t\tvisitColumn: () => where[field],\n\t\t\t\tvisitRelation: context => {\n\t\t\t\t\tconst relationWhere = where[field] as Input.OptionalWhere | null\n\t\t\t\t\tif (relationWhere === null) {\n\t\t\t\t\t\treturn null\n\t\t\t\t\t}\n\t\t\t\t\treturn this.injectToWhere(relationWhere, context.targetEntity, false, context)\n\t\t\t\t},\n\t\t\t})\n\t\t}\n\t\tconst fieldsForPredicate = !isRoot\n\t\t\t? fields\n\t\t\t: fields.filter(it => this.predicateFactory.shouldApplyCellLevelPredicate(entity, Acl.Operation.read, it))\n\n\t\treturn this.createWhere(entity, fieldsForPredicate, resultWhere, relationContext)\n\t}\n\n}\n"],"names":["schema","Acl","acceptFieldVisitor"],"mappings":";;;;AAIO,MAAM,mBAAmB;AAAA,EAC/B,YAA6BA,SAAuC,kBAAoC;AAA3E,SAAA,SAAAA;AAAuC,SAAA,mBAAA;AAAA,EAAA;AAAA,EAE7D,OAAO,QAAsB,OAA4B,iBAAiE;AAChI,UAAM,kBAAkB,KAAK,cAAc,OAAO,QAAQ,IAAI;AAC9D,WAAO,KAAK,YAAY,QAAQ,QAAW,iBAAiB,eAAe;AAAA,EAAA;AAAA,EAGpE,YACP,QACA,YACA,OACA,iBACsB;AAChB,UAAA,kBAAkB,KAAK,iBAAiB,OAAO,QAAQC,OAAI,IAAA,UAAU,MAAM,YAAY,eAAe;AAC5G,YAAQ,KAAK,iBAAiB,mBAAmB,OAAO,eAAe;AAEvE,UAAM,MAAM,CAAC,OAAO,eAAe,EAAE,OAAO,CAAM,OAAA,OAAO,KAAK,EAAE,EAAE,SAAS,CAAC;AACxE,QAAA,IAAI,WAAW,GAAG;AACrB,aAAO,CAAC;AAAA,IAAA;AAEL,QAAA,IAAI,WAAW,GAAG;AACrB,aAAO,IAAI,CAAC;AAAA,IAAA;AAEb,WAAO,EAAE,IAAS;AAAA,EAAA;AAAA,EAGX,cACP,OACA,QACA,QACA,iBACsB;AACtB,UAAM,cAA6C,CAAC;AACpD,QAAI,MAAM,KAAK;AACd,kBAAY,MAAM,MAAM,IAAI,OAAO,CAAC,OAA0B,CAAC,CAAC,EAAE,EAAE,IAAI,QAAM,KAAK,cAAc,IAAI,QAAQ,QAAQ,eAAe,CAAC;AAAA,IAAA;AAEtI,QAAI,MAAM,IAAI;AACb,kBAAY,KAAK,MAAM,GAAG,OAAO,CAAC,OAA0B,CAAC,CAAC,EAAE,EAAE,IAAI,QAAM,KAAK,cAAc,IAAI,QAAQ,QAAQ,eAAe,CAAC;AAAA,IAAA;AAEpI,QAAI,MAAM,KAAK;AACd,kBAAY,MAAM,KAAK,cAAc,MAAM,KAAK,QAAQ,QAAQ,eAAe;AAAA,IAAA;AAGhF,UAAM,SAAS,OAAO,KAAK,KAAK,EAAE,OAAO,CAAA,OAAM,CAAC,CAAC,OAAO,MAAM,KAAK,EAAE,SAAS,EAAE,CAAC;AAE7E,QAAA,OAAO,WAAW,GAAG;AACjB,aAAA;AAAA,IAAA;AAER,aAAS,SAAS,QAAQ;AACzB,kBAAY,KAAK,IAAIC,YAAA,mBAAmB,KAAK,QAAQ,QAAQ,OAAO;AAAA,QACnE,aAAa,MAAM,MAAM,KAAK;AAAA,QAC9B,eAAe,CAAW,YAAA;AACnB,gBAAA,gBAAgB,MAAM,KAAK;AACjC,cAAI,kBAAkB,MAAM;AACpB,mBAAA;AAAA,UAAA;AAER,iBAAO,KAAK,cAAc,eAAe,QAAQ,cAAc,OAAO,OAAO;AAAA,QAAA;AAAA,MAC9E,CACA;AAAA,IAAA;AAEF,UAAM,qBAAqB,CAAC,SACzB,SACA,OAAO,OAAO,CAAA,OAAM,KAAK,iBAAiB,8BAA8B,QAAQD,OAAAA,IAAI,UAAU,MAAM,EAAE,CAAC;AAE1G,WAAO,KAAK,YAAY,QAAQ,oBAAoB,aAAa,eAAe;AAAA,EAAA;AAGlF;;"}
+{"version":3,"file":"PredicatesInjector.cjs","sources":["../../../../../packages/engine-content-api/src/acl/PredicatesInjector.ts"],"sourcesContent":["import { Acl, Input, Model, Writable } from '@contember/schema'\nimport { acceptFieldVisitor } from '@contember/schema-utils'\nimport { PredicateFactory } from './PredicateFactory'\n\nexport class PredicatesInjector {\n\tconstructor(private readonly schema: Model.Schema, private readonly predicateFactory: PredicateFactory) {}\n\n\tpublic inject(\n\t\tentity: Model.Entity,\n\t\twhere: Input.OptionalWhere,\n\t\trelationContext?: Model.AnyRelationContext,\n\t\tancestorPath?: readonly Model.AnyRelationContext[],\n\t): Input.OptionalWhere {\n\t\tconst isQueryRoot = !relationContext && (!ancestorPath || ancestorPath.length === 0)\n\t\tconst restrictedWhere = this.injectToWhere(where, entity, true, relationContext, false, ancestorPath ?? [], isQueryRoot)\n\t\treturn this.createWhere(entity, undefined, restrictedWhere, relationContext, false, ancestorPath ?? [], isQueryRoot)\n\t}\n\n\t/**\n\t * Finds an ancestor in the path that matches the given relation as a back-reference.\n\t * A match occurs when:\n\t * 1. The relation we're traversing has the same name as the inverse (targetRelation) of a relation in the ancestor path\n\t * 2. AND the entity where our relation is defined matches the targetEntity in the path\n\t *    (to prevent false positives when different entities have relations with the same name)\n\t */\n\tprivate findBackReferencedAncestor(\n\t\tancestorPath: readonly Model.AnyRelationContext[],\n\t\trelationName: string,\n\t\trelationSourceEntityName: string,\n\t): Model.AnyRelationContext | undefined {\n\t\treturn ancestorPath.find(ctx =>\n\t\t\tctx.targetRelation?.name === relationName\n\t\t\t&& ctx.targetEntity.name === relationSourceEntityName\n\t\t)\n\t}\n\n\tprivate createWhere(\n\t\tentity: Model.Entity,\n\t\tfieldNames: string[] | undefined,\n\t\twhere: Input.OptionalWhere,\n\t\trelationContext?: Model.AnyRelationContext,\n\t\tisBackReferenceContext?: boolean,\n\t\tancestorPath?: readonly Model.AnyRelationContext[],\n\t\tisQueryRoot?: boolean,\n\t): Input.OptionalWhere {\n\t\t// Simplify predicates when:\n\t\t// 1. We're in a back-reference context (inside a filter that traverses back)\n\t\t// 2. AND the relation we traversed to get here corresponds to a relation in our query path\n\t\t// This ensures we only simplify when the traversed relation actually corresponds\n\t\t// to a relation in our query path (not just any relation to the same entity type)\n\t\tconst shouldSimplify = isBackReferenceContext === true\n\t\t\t&& ancestorPath !== undefined\n\t\t\t&& relationContext !== undefined\n\t\t\t&& this.findBackReferencedAncestor(ancestorPath, relationContext.relation.name, relationContext.entity.name) !== undefined\n\n\t\tlet predicatesWhere: Input.OptionalWhere\n\t\tif (shouldSimplify) {\n\t\t\tpredicatesWhere = { [entity.primary]: { always: true } }\n\t\t} else {\n\t\t\tconst rawPredicate = this.predicateFactory.create(entity, Acl.Operation.read, fieldNames, relationContext, isQueryRoot)\n\t\t\t// Process the predicate to inject nested entity predicates\n\t\t\tpredicatesWhere = this.injectPredicatesToPredicate(\n\t\t\t\trawPredicate,\n\t\t\t\tentity,\n\t\t\t\tisBackReferenceContext ?? false,\n\t\t\t\tancestorPath ?? [],\n\t\t\t\tisQueryRoot,\n\t\t\t)\n\t\t}\n\n\t\tconst and = [where, predicatesWhere].filter(it => Object.keys(it).length > 0)\n\t\tif (and.length === 0) {\n\t\t\treturn {}\n\t\t}\n\t\tif (and.length === 1) {\n\t\t\treturn and[0]\n\t\t}\n\t\treturn { and: and }\n\t}\n\n\t/**\n\t * Processes a predicate and injects nested entity predicates for any relation traversals.\n\t * This ensures that when a predicate like { department: { company: { name: 'Acme' } } }\n\t * is used, the predicates of Department and Company are also applied.\n\t */\n\tprivate injectPredicatesToPredicate(\n\t\twhere: Input.OptionalWhere,\n\t\tentity: Model.Entity,\n\t\tisBackReferenceContext: boolean,\n\t\tancestorPath: readonly Model.AnyRelationContext[],\n\t\tisQueryRoot?: boolean,\n\t): Input.OptionalWhere {\n\t\tconst resultWhere: Writable<Input.OptionalWhere> = {}\n\n\t\tif (where.and) {\n\t\t\tresultWhere.and = where.and\n\t\t\t\t.filter((it): it is Input.Where => !!it)\n\t\t\t\t.map(it => this.injectPredicatesToPredicate(it, entity, isBackReferenceContext, ancestorPath, isQueryRoot))\n\t\t}\n\t\tif (where.or) {\n\t\t\tresultWhere.or = where.or\n\t\t\t\t.filter((it): it is Input.Where => !!it)\n\t\t\t\t.map(it => this.injectPredicatesToPredicate(it, entity, isBackReferenceContext, ancestorPath, isQueryRoot))\n\t\t}\n\t\tif (where.not) {\n\t\t\tresultWhere.not = this.injectPredicatesToPredicate(where.not, entity, isBackReferenceContext, ancestorPath, isQueryRoot)\n\t\t}\n\n\t\tconst fields = Object.keys(where).filter(it => !['and', 'or', 'not'].includes(it))\n\n\t\tfor (const field of fields) {\n\t\t\tresultWhere[field] = acceptFieldVisitor(this.schema, entity, field, {\n\t\t\t\tvisitColumn: () => where[field],\n\t\t\t\tvisitRelation: context => {\n\t\t\t\t\tconst relationWhere = where[field] as Input.OptionalWhere | null\n\t\t\t\t\tif (relationWhere === null) {\n\t\t\t\t\t\treturn null\n\t\t\t\t\t}\n\n\t\t\t\t\t// Check if this relation is a back-reference to somewhere in our ancestor path\n\t\t\t\t\tconst isBackReference = this.findBackReferencedAncestor(\n\t\t\t\t\t\tancestorPath,\n\t\t\t\t\t\tcontext.relation.name,\n\t\t\t\t\t\tcontext.entity.name,\n\t\t\t\t\t) !== undefined\n\t\t\t\t\tconst nestedIsBackReferenceContext = isBackReference || isBackReferenceContext\n\t\t\t\t\tconst nestedAncestorPath: readonly Model.AnyRelationContext[] = [...ancestorPath, context]\n\n\t\t\t\t\t// Recursively process the nested where (always do this to handle deeper nesting)\n\t\t\t\t\tconst processedNestedWhere = this.injectPredicatesToPredicate(\n\t\t\t\t\t\trelationWhere,\n\t\t\t\t\t\tcontext.targetEntity,\n\t\t\t\t\t\tnestedIsBackReferenceContext,\n\t\t\t\t\t\tnestedAncestorPath,\n\t\t\t\t\t\tisQueryRoot,\n\t\t\t\t\t)\n\n\t\t\t\t\t// Check if we should simplify the target entity's predicate\n\t\t\t\t\tconst shouldSimplifyNested = nestedIsBackReferenceContext\n\t\t\t\t\t\t&& this.findBackReferencedAncestor(nestedAncestorPath, context.relation.name, context.entity.name) !== undefined\n\n\t\t\t\t\t// Get target entity's predicate (simplified if back-reference)\n\t\t\t\t\tconst targetPredicate = shouldSimplifyNested\n\t\t\t\t\t\t? { [context.targetEntity.primary]: { always: true } }\n\t\t\t\t\t\t: this.predicateFactory.create(context.targetEntity, Acl.Operation.read, undefined, context, isQueryRoot)\n\n\t\t\t\t\t// Optimization: avoid duplicate { id: always } when both are simplified\n\t\t\t\t\tconst primaryKey = context.targetEntity.primary\n\t\t\t\t\tconst nestedIsAlwaysTrue = Object.keys(processedNestedWhere).length === 1\n\t\t\t\t\t\t&& (processedNestedWhere as Record<string, unknown>)[primaryKey] !== undefined\n\t\t\t\t\t\t&& (processedNestedWhere as Record<string, Record<string, unknown>>)[primaryKey]?.always === true\n\t\t\t\t\tconst targetIsAlwaysTrue = Object.keys(targetPredicate).length === 1\n\t\t\t\t\t\t&& (targetPredicate as Record<string, unknown>)[primaryKey] !== undefined\n\t\t\t\t\t\t&& (targetPredicate as Record<string, Record<string, unknown>>)[primaryKey]?.always === true\n\n\t\t\t\t\tif (nestedIsAlwaysTrue && targetIsAlwaysTrue) {\n\t\t\t\t\t\treturn processedNestedWhere\n\t\t\t\t\t}\n\n\t\t\t\t\t// Combine the processed nested where with target entity's predicate\n\t\t\t\t\tconst parts = [processedNestedWhere, targetPredicate].filter(it => Object.keys(it).length > 0)\n\t\t\t\t\tif (parts.length === 0) {\n\t\t\t\t\t\treturn {}\n\t\t\t\t\t}\n\t\t\t\t\tif (parts.length === 1) {\n\t\t\t\t\t\treturn parts[0]\n\t\t\t\t\t}\n\t\t\t\t\treturn { and: parts }\n\t\t\t\t},\n\t\t\t})\n\t\t}\n\n\t\treturn resultWhere\n\t}\n\n\tprivate injectToWhere(\n\t\twhere: Input.OptionalWhere,\n\t\tentity: Model.Entity,\n\t\tisRoot: boolean,\n\t\trelationContext: Model.AnyRelationContext | undefined,\n\t\tisBackReferenceContext: boolean,\n\t\tancestorPath: readonly Model.AnyRelationContext[],\n\t\tisQueryRoot?: boolean,\n\t): Input.OptionalWhere {\n\t\tconst resultWhere: Writable<Input.OptionalWhere> = {}\n\t\tif (where.and) {\n\t\t\tresultWhere.and = where.and.filter((it): it is Input.Where => !!it).map(it =>\n\t\t\t\tthis.injectToWhere(it, entity, isRoot, relationContext, isBackReferenceContext, ancestorPath, isQueryRoot)\n\t\t\t)\n\t\t}\n\t\tif (where.or) {\n\t\t\tresultWhere.or = where.or.filter((it): it is Input.Where => !!it).map(it =>\n\t\t\t\tthis.injectToWhere(it, entity, isRoot, relationContext, isBackReferenceContext, ancestorPath, isQueryRoot)\n\t\t\t)\n\t\t}\n\t\tif (where.not) {\n\t\t\tresultWhere.not = this.injectToWhere(where.not, entity, isRoot, relationContext, isBackReferenceContext, ancestorPath, isQueryRoot)\n\t\t}\n\n\t\tconst fields = Object.keys(where).filter(it => !['and', 'or', 'not'].includes(it))\n\n\t\tif (fields.length === 0) {\n\t\t\treturn resultWhere\n\t\t}\n\t\tfor (let field of fields) {\n\t\t\tresultWhere[field] = acceptFieldVisitor(this.schema, entity, field, {\n\t\t\t\tvisitColumn: () => where[field],\n\t\t\t\tvisitRelation: context => {\n\t\t\t\t\tconst relationWhere = where[field] as Input.OptionalWhere | null\n\t\t\t\t\tif (relationWhere === null) {\n\t\t\t\t\t\treturn null\n\t\t\t\t\t}\n\t\t\t\t\t// Check if this relation is a back-reference to somewhere in our ancestor path\n\t\t\t\t\tconst isBackReference = this.findBackReferencedAncestor(ancestorPath, context.relation.name, context.entity.name) !== undefined\n\t\t\t\t\t// Once we enter a back-reference context, stay in it for nested relations\n\t\t\t\t\tconst nestedIsBackReferenceContext = isBackReference || isBackReferenceContext\n\t\t\t\t\t// Build extended ancestor path for nested traversal\n\t\t\t\t\tconst nestedAncestorPath: Model.AnyRelationContext[] = [...ancestorPath, context]\n\t\t\t\t\treturn this.injectToWhere(relationWhere, context.targetEntity, false, context, nestedIsBackReferenceContext, nestedAncestorPath, isQueryRoot)\n\t\t\t\t},\n\t\t\t})\n\t\t}\n\t\tconst fieldsForPredicate = !isRoot\n\t\t\t? fields\n\t\t\t: fields.filter(it => this.predicateFactory.shouldApplyCellLevelPredicate(entity, Acl.Operation.read, it, isQueryRoot))\n\n\t\treturn this.createWhere(entity, fieldsForPredicate, resultWhere, relationContext, isBackReferenceContext, ancestorPath, isQueryRoot)\n\t}\n}\n"],"names":["schema","Acl","acceptFieldVisitor"],"mappings":";;;;AAIO,MAAM,mBAAmB;AAAA,EAC/B,YAA6BA,SAAuC,kBAAoC;AAA3E,SAAA,SAAAA;AAAuC,SAAA,mBAAA;AAAA,EAAqC;AAAA,EAElG,OACN,QACA,OACA,iBACA,cACsB;AACtB,UAAM,cAAc,CAAC,oBAAoB,CAAC,gBAAgB,aAAa,WAAW;AAClF,UAAM,kBAAkB,KAAK,cAAc,OAAO,QAAQ,MAAM,iBAAiB,OAAO,gBAAgB,CAAA,GAAI,WAAW;AACvH,WAAO,KAAK,YAAY,QAAQ,QAAW,iBAAiB,iBAAiB,OAAO,gBAAgB,CAAA,GAAI,WAAW;AAAA,EACpH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASQ,2BACP,cACA,cACA,0BACuC;AACvC,WAAO,aAAa;AAAA,MAAK,SACxB,IAAI,gBAAgB,SAAS,gBAC1B,IAAI,aAAa,SAAS;AAAA,IAAA;AAAA,EAE/B;AAAA,EAEQ,YACP,QACA,YACA,OACA,iBACA,wBACA,cACA,aACsB;AAMtB,UAAM,iBAAiB,2BAA2B,QAC9C,iBAAiB,UACjB,oBAAoB,UACpB,KAAK,2BAA2B,cAAc,gBAAgB,SAAS,MAAM,gBAAgB,OAAO,IAAI,MAAM;AAElH,QAAI;AACJ,QAAI,gBAAgB;AACnB,wBAAkB,EAAE,CAAC,OAAO,OAAO,GAAG,EAAE,QAAQ,OAAK;AAAA,IACtD,OAAO;AACN,YAAM,eAAe,KAAK,iBAAiB,OAAO,QAAQC,WAAI,UAAU,MAAM,YAAY,iBAAiB,WAAW;AAEtH,wBAAkB,KAAK;AAAA,QACtB;AAAA,QACA;AAAA,QACA,0BAA0B;AAAA,QAC1B,gBAAgB,CAAA;AAAA,QAChB;AAAA,MAAA;AAAA,IAEF;AAEA,UAAM,MAAM,CAAC,OAAO,eAAe,EAAE,OAAO,CAAA,OAAM,OAAO,KAAK,EAAE,EAAE,SAAS,CAAC;AAC5E,QAAI,IAAI,WAAW,GAAG;AACrB,aAAO,CAAA;AAAA,IACR;AACA,QAAI,IAAI,WAAW,GAAG;AACrB,aAAO,IAAI,CAAC;AAAA,IACb;AACA,WAAO,EAAE,IAAA;AAAA,EACV;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,4BACP,OACA,QACA,wBACA,cACA,aACsB;AACtB,UAAM,cAA6C,CAAA;AAEnD,QAAI,MAAM,KAAK;AACd,kBAAY,MAAM,MAAM,IACtB,OAAO,CAAC,OAA0B,CAAC,CAAC,EAAE,EACtC,IAAI,CAAA,OAAM,KAAK,4BAA4B,IAAI,QAAQ,wBAAwB,cAAc,WAAW,CAAC;AAAA,IAC5G;AACA,QAAI,MAAM,IAAI;AACb,kBAAY,KAAK,MAAM,GACrB,OAAO,CAAC,OAA0B,CAAC,CAAC,EAAE,EACtC,IAAI,CAAA,OAAM,KAAK,4BAA4B,IAAI,QAAQ,wBAAwB,cAAc,WAAW,CAAC;AAAA,IAC5G;AACA,QAAI,MAAM,KAAK;AACd,kBAAY,MAAM,KAAK,4BAA4B,MAAM,KAAK,QAAQ,wBAAwB,cAAc,WAAW;AAAA,IACxH;AAEA,UAAM,SAAS,OAAO,KAAK,KAAK,EAAE,OAAO,CAAA,OAAM,CAAC,CAAC,OAAO,MAAM,KAAK,EAAE,SAAS,EAAE,CAAC;AAEjF,eAAW,SAAS,QAAQ;AAC3B,kBAAY,KAAK,IAAIC,YAAAA,mBAAmB,KAAK,QAAQ,QAAQ,OAAO;AAAA,QACnE,aAAa,MAAM,MAAM,KAAK;AAAA,QAC9B,eAAe,CAAA,YAAW;AACzB,gBAAM,gBAAgB,MAAM,KAAK;AACjC,cAAI,kBAAkB,MAAM;AAC3B,mBAAO;AAAA,UACR;AAGA,gBAAM,kBAAkB,KAAK;AAAA,YAC5B;AAAA,YACA,QAAQ,SAAS;AAAA,YACjB,QAAQ,OAAO;AAAA,UAAA,MACV;AACN,gBAAM,+BAA+B,mBAAmB;AACxD,gBAAM,qBAA0D,CAAC,GAAG,cAAc,OAAO;AAGzF,gBAAM,uBAAuB,KAAK;AAAA,YACjC;AAAA,YACA,QAAQ;AAAA,YACR;AAAA,YACA;AAAA,YACA;AAAA,UAAA;AAID,gBAAM,uBAAuB,gCACzB,KAAK,2BAA2B,oBAAoB,QAAQ,SAAS,MAAM,QAAQ,OAAO,IAAI,MAAM;AAGxG,gBAAM,kBAAkB,uBACrB,EAAE,CAAC,QAAQ,aAAa,OAAO,GAAG,EAAE,QAAQ,WAC5C,KAAK,iBAAiB,OAAO,QAAQ,cAAcD,OAAAA,IAAI,UAAU,MAAM,QAAW,SAAS,WAAW;AAGzG,gBAAM,aAAa,QAAQ,aAAa;AACxC,gBAAM,qBAAqB,OAAO,KAAK,oBAAoB,EAAE,WAAW,KACnE,qBAAiD,UAAU,MAAM,UACjE,qBAAiE,UAAU,GAAG,WAAW;AAC9F,gBAAM,qBAAqB,OAAO,KAAK,eAAe,EAAE,WAAW,KAC9D,gBAA4C,UAAU,MAAM,UAC5D,gBAA4D,UAAU,GAAG,WAAW;AAEzF,cAAI,sBAAsB,oBAAoB;AAC7C,mBAAO;AAAA,UACR;AAGA,gBAAM,QAAQ,CAAC,sBAAsB,eAAe,EAAE,OAAO,CAAA,OAAM,OAAO,KAAK,EAAE,EAAE,SAAS,CAAC;AAC7F,cAAI,MAAM,WAAW,GAAG;AACvB,mBAAO,CAAA;AAAA,UACR;AACA,cAAI,MAAM,WAAW,GAAG;AACvB,mBAAO,MAAM,CAAC;AAAA,UACf;AACA,iBAAO,EAAE,KAAK,MAAA;AAAA,QACf;AAAA,MAAA,CACA;AAAA,IACF;AAEA,WAAO;AAAA,EACR;AAAA,EAEQ,cACP,OACA,QACA,QACA,iBACA,wBACA,cACA,aACsB;AACtB,UAAM,cAA6C,CAAA;AACnD,QAAI,MAAM,KAAK;AACd,kBAAY,MAAM,MAAM,IAAI,OAAO,CAAC,OAA0B,CAAC,CAAC,EAAE,EAAE;AAAA,QAAI,CAAA,OACvE,KAAK,cAAc,IAAI,QAAQ,QAAQ,iBAAiB,wBAAwB,cAAc,WAAW;AAAA,MAAA;AAAA,IAE3G;AACA,QAAI,MAAM,IAAI;AACb,kBAAY,KAAK,MAAM,GAAG,OAAO,CAAC,OAA0B,CAAC,CAAC,EAAE,EAAE;AAAA,QAAI,CAAA,OACrE,KAAK,cAAc,IAAI,QAAQ,QAAQ,iBAAiB,wBAAwB,cAAc,WAAW;AAAA,MAAA;AAAA,IAE3G;AACA,QAAI,MAAM,KAAK;AACd,kBAAY,MAAM,KAAK,cAAc,MAAM,KAAK,QAAQ,QAAQ,iBAAiB,wBAAwB,cAAc,WAAW;AAAA,IACnI;AAEA,UAAM,SAAS,OAAO,KAAK,KAAK,EAAE,OAAO,CAAA,OAAM,CAAC,CAAC,OAAO,MAAM,KAAK,EAAE,SAAS,EAAE,CAAC;AAEjF,QAAI,OAAO,WAAW,GAAG;AACxB,aAAO;AAAA,IACR;AACA,aAAS,SAAS,QAAQ;AACzB,kBAAY,KAAK,IAAIC,YAAAA,mBAAmB,KAAK,QAAQ,QAAQ,OAAO;AAAA,QACnE,aAAa,MAAM,MAAM,KAAK;AAAA,QAC9B,eAAe,CAAA,YAAW;AACzB,gBAAM,gBAAgB,MAAM,KAAK;AACjC,cAAI,kBAAkB,MAAM;AAC3B,mBAAO;AAAA,UACR;AAEA,gBAAM,kBAAkB,KAAK,2BAA2B,cAAc,QAAQ,SAAS,MAAM,QAAQ,OAAO,IAAI,MAAM;AAEtH,gBAAM,+BAA+B,mBAAmB;AAExD,gBAAM,qBAAiD,CAAC,GAAG,cAAc,OAAO;AAChF,iBAAO,KAAK,cAAc,eAAe,QAAQ,cAAc,OAAO,SAAS,8BAA8B,oBAAoB,WAAW;AAAA,QAC7I;AAAA,MAAA,CACA;AAAA,IACF;AACA,UAAM,qBAAqB,CAAC,SACzB,SACA,OAAO,OAAO,CAAA,OAAM,KAAK,iBAAiB,8BAA8B,QAAQD,OAAAA,IAAI,UAAU,MAAM,IAAI,WAAW,CAAC;AAEvH,WAAO,KAAK,YAAY,QAAQ,oBAAoB,aAAa,iBAAiB,wBAAwB,cAAc,WAAW;AAAA,EACpI;AACD;;"}