@dudousxd/nestjs-authz 0.8.0 → 0.9.0

package/dist/policies/role.policy.js

@@ -0,0 +1,51 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Policy } from '@nestjs/authorization';
+import { AuthzRbac } from '../rbac.js';
+import { AuthzPolicy, superAdminBefore } from './authz-policy.js';
+/**
+ * Persisted (and user-object) roles as an official policy.
+ *
+ * ```ts
+ * @Can(RolePolicy, 'has', roles('admin', 'editor'))   // any of
+ * @Can(RolePolicy, 'hasAll', roles('admin', 'editor')) // all of
+ * ```
+ *
+ * Roles come from `user.roles` / `user.role` (or `resolveRoles`) and from the RBAC
+ * adapter's role store, scoped to the current tenant. Honors `superAdmin`.
+ */
+let RolePolicy = class RolePolicy extends AuthzPolicy {
+    rbac;
+    constructor(rbac) {
+        super();
+        this.rbac = rbac;
+    }
+    /**
+     * Asks only `superAdmin`: the abilities here name roles, not a resource, so the
+     * external decision point is not consulted.
+     */
+    before(user, ability) {
+        return superAdminBefore(user, ability);
+    }
+    /** The user holds any of `roles`. */
+    has(user, ...roles) {
+        return this.rbac.hasAnyRole(user, roles);
+    }
+    /** The user holds every one of `roles`. */
+    hasAll(user, ...roles) {
+        return this.rbac.hasAllRoles(user, roles);
+    }
+};
+RolePolicy = __decorate([
+    Policy(),
+    __metadata("design:paramtypes", [AuthzRbac])
+], RolePolicy);
+export { RolePolicy };
+//# sourceMappingURL=role.policy.js.map

package/dist/policies/role.policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role.policy.js","sourceRoot":"","sources":["../../src/policies/role.policy.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAElE;;;;;;;;;;GAUG;AAEI,IAAM,UAAU,GAAhB,MAAM,UAAW,SAAQ,WAAW;IACZ;IAA7B,YAA6B,IAAe;QAC1C,KAAK,EAAE,CAAC;QADmB,SAAI,GAAJ,IAAI,CAAW;IAE5C,CAAC;IAED;;;OAGG;IACM,MAAM,CAAC,IAAa,EAAE,OAAe;QAC5C,OAAO,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IAED,qCAAqC;IACrC,GAAG,CAAC,IAAa,EAAE,GAAG,KAAe;QACnC,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED,2CAA2C;IAC3C,MAAM,CAAC,IAAa,EAAE,GAAG,KAAe;QACtC,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC;CACF,CAAA;AAtBY,UAAU;IADtB,MAAM,EAAE;qCAE4B,SAAS;GADjC,UAAU,CAsBtB"}

package/dist/policy-index.d.ts

@@ -0,0 +1,51 @@
+import { type Type } from '@nestjs/common';
+import { DiscoveryService, ModuleRef, ModulesContainer } from '@nestjs/core';
+/** One official policy of the application, as the extras see it. */
+export interface IndexedPolicy {
+    policy: Type<unknown>;
+    /** The instance the official registry uses (an `overrideProvider` replacement in tests). */
+    instance: object;
+    /** The resource linked with `@PolicyFor`, if any. */
+    resource: Type<unknown> | undefined;
+}
+/**
+ * The application's official `@Policy()` providers and their resource links. Read-only:
+ * the official `PolicyRegistry` owns registration; this only looks them up for the
+ * extras (resource → policy, `scope()`, ability listings).
+ */
+export declare class PolicyIndex {
+    private readonly discovery;
+    private readonly moduleRef;
+    private readonly modules;
+    /** The last scan, reused while the container's shape (modules, providers) is unchanged. */
+    private cache;
+    constructor(discovery: DiscoveryService, moduleRef: ModuleRef, modules: ModulesContainer);
+    /**
+     * Every official policy registered as a provider, built-ins included. Rescanned when a
+     * module or provider is added (a lazy module) or a policy was not instantiated yet.
+     */
+    all(): IndexedPolicy[];
+    /** Cheap fingerprint of the container: module count and each module's provider count. */
+    private signature;
+    /** Official policies about a resource (built-ins left out). */
+    resourcePolicies(): IndexedPolicy[];
+    /** The policy class linked to a resource class. */
+    policyFor(resource: Type<unknown>): Type<unknown> | undefined;
+    /** The policy class for a resource instance (by its constructor), or for a class. */
+    policyOf(resource: object): Type<unknown> | undefined;
+    /** Linked policy classes defining `ability`, for a check that names no resource. */
+    linkedPoliciesWith(ability: string): Type<unknown>[];
+    /** The policy instance the app uses for `policy`, or `undefined` when it is not registered. */
+    instanceOf(policy: Type<unknown>): object | undefined;
+    /**
+     * Abilities of each resource policy that take no argument after the user (arity
+     * `<= 1`, e.g. `create(user)`), safe to check without a record. `before`, `scope` and
+     * the constructor are not abilities.
+     */
+    classAbilities(): Array<{
+        policy: Type<unknown>;
+        resource: Type<unknown> | undefined;
+        abilities: string[];
+    }>;
+}
+//# sourceMappingURL=policy-index.d.ts.map

package/dist/policy-index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-index.d.ts","sourceRoot":"","sources":["../src/policy-index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAO7E,oEAAoE;AACpE,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACtB,4FAA4F;IAC5F,QAAQ,EAAE,MAAM,CAAC;IACjB,qDAAqD;IACrD,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,SAAS,CAAC;CACrC;AAED;;;;GAIG;AACH,qBACa,WAAW;IAKpB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAN1B,2FAA2F;IAC3F,OAAO,CAAC,KAAK,CAA+D;gBAGzD,SAAS,EAAE,gBAAgB,EAC3B,SAAS,EAAE,SAAS,EACpB,OAAO,EAAE,gBAAgB;IAG5C;;;OAGG;IACH,GAAG,IAAI,aAAa,EAAE;IA6BtB,yFAAyF;IACzF,OAAO,CAAC,SAAS;IAMjB,+DAA+D;IAC/D,gBAAgB,IAAI,aAAa,EAAE;IAInC,mDAAmD;IACnD,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,SAAS;IAI7D,qFAAqF;IACrF,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,SAAS;IAKrD,oFAAoF;IACpF,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE;IAMpD,+FAA+F;IAC/F,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,MAAM,GAAG,SAAS;IAUrD;;;;OAIG;IACH,cAAc,IAAI,KAAK,CAAC;QACtB,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACtB,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,SAAS,CAAC;QACpC,SAAS,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;CAeH"}

package/dist/policy-index.js

@@ -0,0 +1,135 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Injectable } from '@nestjs/common';
+import { DiscoveryService, ModuleRef, ModulesContainer } from '@nestjs/core';
+import { getPolicyResource, policyForResource, policyLinks } from './links.js';
+import { isOfficialPolicy } from './official.js';
+/** Built-in policies that are not about a resource; left out of ability listings. */
+const BUILT_IN = new Set(['RolePolicy', 'PermissionPolicy', 'GatePolicy']);
+/**
+ * The application's official `@Policy()` providers and their resource links. Read-only:
+ * the official `PolicyRegistry` owns registration; this only looks them up for the
+ * extras (resource → policy, `scope()`, ability listings).
+ */
+let PolicyIndex = class PolicyIndex {
+    discovery;
+    moduleRef;
+    modules;
+    /** The last scan, reused while the container's shape (modules, providers) is unchanged. */
+    cache;
+    constructor(discovery, moduleRef, modules) {
+        this.discovery = discovery;
+        this.moduleRef = moduleRef;
+        this.modules = modules;
+    }
+    /**
+     * Every official policy registered as a provider, built-ins included. Rescanned when a
+     * module or provider is added (a lazy module) or a policy was not instantiated yet.
+     */
+    all() {
+        const signature = this.signature();
+        if (this.cache?.signature === signature)
+            return this.cache.policies;
+        const seen = new Set();
+        const out = [];
+        let complete = true;
+        for (const wrapper of this.discovery.getProviders()) {
+            const token = wrapper.token;
+            const key = isOfficialPolicy(token)
+                ? token
+                : !wrapper.isFactory && isOfficialPolicy(wrapper.metatype)
+                    ? wrapper.metatype
+                    : undefined;
+            if (!key || seen.has(key))
+                continue;
+            if (!wrapper.instance || typeof wrapper.instance !== 'object') {
+                complete = false;
+                continue;
+            }
+            seen.add(key);
+            out.push({
+                policy: key,
+                instance: wrapper.instance,
+                resource: getPolicyResource(key),
+            });
+        }
+        this.cache = complete ? { signature, policies: out } : undefined;
+        return out;
+    }
+    /** Cheap fingerprint of the container: module count and each module's provider count. */
+    signature() {
+        let out = String(this.modules.size);
+        for (const module of this.modules.values())
+            out += `,${module.providers.size}`;
+        return out;
+    }
+    /** Official policies about a resource (built-ins left out). */
+    resourcePolicies() {
+        return this.all().filter((p) => !BUILT_IN.has(p.policy.name));
+    }
+    /** The policy class linked to a resource class. */
+    policyFor(resource) {
+        return policyForResource(resource);
+    }
+    /** The policy class for a resource instance (by its constructor), or for a class. */
+    policyOf(resource) {
+        if (typeof resource === 'function')
+            return policyForResource(resource);
+        return policyForResource(resource.constructor);
+    }
+    /** Linked policy classes defining `ability`, for a check that names no resource. */
+    linkedPoliciesWith(ability) {
+        return policyLinks()
+            .map((l) => l.policy)
+            .filter((p) => typeof p.prototype[ability] === 'function');
+    }
+    /** The policy instance the app uses for `policy`, or `undefined` when it is not registered. */
+    instanceOf(policy) {
+        const indexed = this.all().find((p) => p.policy === policy);
+        if (indexed)
+            return indexed.instance;
+        try {
+            return this.moduleRef.get(policy, { strict: false });
+        }
+        catch {
+            return undefined;
+        }
+    }
+    /**
+     * Abilities of each resource policy that take no argument after the user (arity
+     * `<= 1`, e.g. `create(user)`), safe to check without a record. `before`, `scope` and
+     * the constructor are not abilities.
+     */
+    classAbilities() {
+        return this.resourcePolicies().map(({ policy, instance, resource }) => {
+            const abilities = new Set();
+            let proto = Object.getPrototypeOf(instance);
+            while (proto && proto !== Object.prototype) {
+                for (const name of Object.getOwnPropertyNames(proto)) {
+                    if (name === 'constructor' || name === 'before' || name === 'scope')
+                        continue;
+                    const member = instance[name];
+                    if (typeof member === 'function' && member.length <= 1)
+                        abilities.add(name);
+                }
+                proto = Object.getPrototypeOf(proto);
+            }
+            return { policy, resource, abilities: [...abilities] };
+        });
+    }
+};
+PolicyIndex = __decorate([
+    Injectable(),
+    __metadata("design:paramtypes", [DiscoveryService,
+        ModuleRef,
+        ModulesContainer])
+], PolicyIndex);
+export { PolicyIndex };
+//# sourceMappingURL=policy-index.js.map

package/dist/policy-index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-index.js","sourceRoot":"","sources":["../src/policy-index.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAa,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEjD,qFAAqF;AACrF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,kBAAkB,EAAE,YAAY,CAAC,CAAC,CAAC;AAW3E;;;;GAIG;AAEI,IAAM,WAAW,GAAjB,MAAM,WAAW;IAKH;IACA;IACA;IANnB,2FAA2F;IACnF,KAAK,CAA+D;IAE5E,YACmB,SAA2B,EAC3B,SAAoB,EACpB,OAAyB;QAFzB,cAAS,GAAT,SAAS,CAAkB;QAC3B,cAAS,GAAT,SAAS,CAAW;QACpB,YAAO,GAAP,OAAO,CAAkB;IACzC,CAAC;IAEJ;;;OAGG;IACH,GAAG;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,KAAK,EAAE,SAAS,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;QACpE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAW,CAAC;QAChC,MAAM,GAAG,GAAoB,EAAE,CAAC;QAChC,IAAI,QAAQ,GAAG,IAAI,CAAC;QACpB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,CAAC;YACpD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;YAC5B,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC;gBACjC,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,IAAI,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC;oBACxD,CAAC,CAAE,OAAO,CAAC,QAA0B;oBACrC,CAAC,CAAC,SAAS,CAAC;YAChB,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YACpC,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC9D,QAAQ,GAAG,KAAK,CAAC;gBACjB,SAAS;YACX,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,GAAG,CAAC,IAAI,CAAC;gBACP,MAAM,EAAE,GAAG;gBACX,QAAQ,EAAE,OAAO,CAAC,QAAkB;gBACpC,QAAQ,EAAE,iBAAiB,CAAC,GAAG,CAAC;aACjC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACjE,OAAO,GAAG,CAAC;IACb,CAAC;IAED,yFAAyF;IACjF,SAAS;QACf,IAAI,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACpC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;YAAE,GAAG,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QAC/E,OAAO,GAAG,CAAC;IACb,CAAC;IAED,+DAA+D;IAC/D,gBAAgB;QACd,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,mDAAmD;IACnD,SAAS,CAAC,QAAuB;QAC/B,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED,qFAAqF;IACrF,QAAQ,CAAC,QAAgB;QACvB,IAAI,OAAO,QAAQ,KAAK,UAAU;YAAE,OAAO,iBAAiB,CAAC,QAAyB,CAAC,CAAC;QACxF,OAAO,iBAAiB,CAAE,QAA2C,CAAC,WAAW,CAAC,CAAC;IACrF,CAAC;IAED,oFAAoF;IACpF,kBAAkB,CAAC,OAAe;QAChC,OAAO,WAAW,EAAE;aACjB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;aACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAQ,CAAC,CAAC,SAAqC,CAAC,OAAO,CAAC,KAAK,UAAU,CAAC,CAAC;IAC5F,CAAC;IAED,+FAA+F;IAC/F,UAAU,CAAC,MAAqB;QAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;QAC5D,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC,QAAQ,CAAC;QACrC,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW,CAAC;QACjE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,cAAc;QAKZ,OAAO,IAAI,CAAC,gBAAgB,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE;YACpE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;YACpC,IAAI,KAAK,GAAkB,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAC3D,OAAO,KAAK,IAAI,KAAK,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;gBAC3C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;oBACrD,IAAI,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO;wBAAE,SAAS;oBAC9E,MAAM,MAAM,GAAI,QAAoC,CAAC,IAAI,CAAC,CAAC;oBAC3D,IAAI,OAAO,MAAM,KAAK,UAAU,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC;wBAAE,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC9E,CAAC;gBACD,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YACvC,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,GAAG,SAAS,CAAC,EAAE,CAAC;QACzD,CAAC,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AA5GY,WAAW;IADvB,UAAU,EAAE;qCAMmB,gBAAgB;QAChB,SAAS;QACX,gBAAgB;GAPjC,WAAW,CA4GvB"}

package/dist/rbac.d.ts

@@ -0,0 +1,92 @@
+import { type OnModuleInit } from '@nestjs/common';
+import { ModuleRef } from '@nestjs/core';
+import type { ContextAccessor } from './context-accessor.js';
+import type { DecisionProvider } from './decision-provider.js';
+import { PermissionCache } from './permission-cache.js';
+import type { PermissionProvider } from './permission-provider.js';
+import { type RoleProvider } from './role-provider.js';
+import type { AuthzModuleOptions, Resource, User } from './types.js';
+/**
+ * Roles and permissions of a user, from the persisted RBAC seams (`ROLE_PROVIDER`,
+ * `PERMISSION_PROVIDER`, registered by the TypeORM / MikroORM / Prisma / Drizzle adapters)
+ * and from the user object itself (`user.roles` / `user.role`); the optional external
+ * decision point (`DECISION_PROVIDER`); and the ambient user for `Gate` calls made without
+ * one. Shared by `RolePolicy`, `PermissionPolicy`, `AuthzPolicy` and the `Gate`.
+ *
+ * Within one request (a nestjs-context store), a user's permissions and provider roles
+ * are fetched once, however many checks run, in guards and in handlers alike.
+ */
+export declare class AuthzRbac implements OnModuleInit {
+    private readonly context?;
+    private readonly moduleRef?;
+    private readonly permissionProvider?;
+    private readonly roleProvider?;
+    private readonly decisionProvider?;
+    private readonly roleResolver;
+    private readonly resolveUser;
+    private readonly lookups;
+    private authentication;
+    constructor(options: AuthzModuleOptions | undefined, context?: ContextAccessor | undefined, moduleRef?: ModuleRef | undefined, permissionProvider?: PermissionProvider | undefined, roleProvider?: RoleProvider | undefined, decisionProvider?: DecisionProvider | undefined);
+    /**
+     * Finds `@nestjs/authentication`'s `AuthenticationContext` when that optional peer is
+     * installed and its module is imported. The class is the DI token, so the package is
+     * loaded only here, and its absence is not an error.
+     */
+    onModuleInit(): Promise<void>;
+    /**
+     * A provider registered by any module: the injected one, else a non-strict lookup,
+     * memoized, so a global RBAC module or a root-level accessor is found too.
+     */
+    private lookup;
+    /** @internal The nestjs-context accessor, when one is registered. */
+    contextAccessor(): ContextAccessor | undefined;
+    /** The persisted permission seam, when an RBAC adapter registered one. */
+    permissions(): PermissionProvider | undefined;
+    /** The persisted role seam, when an RBAC adapter registered one. */
+    roles(): RoleProvider | undefined;
+    /** The external decision point (Cerbos, OPA, …), when one is registered. */
+    decisions(): DecisionProvider | undefined;
+    /**
+     * The user for a `Gate` call made without one:
+     *
+     * 1. `@nestjs/authentication`'s `AuthenticationContext.user`, when that optional peer is
+     *    installed and its scope is active (a call it handles, or `AuthenticationContext.run()`):
+     *    its answer is final, so a `null` there is a guest;
+     * 2. else, with no authentication scope at all, nestjs-context's user ref, hydrated by
+     *    `resolveUser` when configured (once per `type:id` per request);
+     * 3. else `null` (a guest).
+     */
+    currentUser(): Promise<User>;
+    /**
+     * `AuthenticationContext.user` (`null` for an anonymous call) when its scope is active;
+     * `undefined` without the package or outside its scope. A version that hides the scope is
+     * read as before: a user is an answer, `null` is not.
+     */
+    private authenticatedUser;
+    /** The nestjs-context store for the current request, or `undefined` when there is none. */
+    private requestStore;
+    /**
+     * The per-request {@link PermissionCache} on the nestjs-context store, so every check
+     * in one request shares a single `getPermissions` and `getRoles` fetch per user.
+     * `undefined` without a store.
+     */
+    requestCache(): PermissionCache | undefined;
+    /**
+     * The user's role names: the role resolver's (the user object) and the role provider's,
+     * the latter fetched through `cache` (the request's, by default).
+     */
+    rolesOf(user: User, cache?: PermissionCache | undefined): Promise<Set<string>>;
+    /** True when the user holds any of `roles`. A guest holds none. */
+    hasAnyRole(user: User, roles: readonly string[], cache?: PermissionCache | undefined): Promise<boolean>;
+    /** True when the user holds every one of `roles`. */
+    hasAllRoles(user: User, roles: readonly string[]): Promise<boolean>;
+    /**
+     * True when the permission seam grants `permission` to `user`. With `getPermissions`,
+     * wildcard grants apply (`posts.*` satisfies `posts.update`, `*` anything), fetched
+     * once per `cache` (the request's, by default). A set the provider marks
+     * `exhaustivePermissions` answers on its own; otherwise a miss still asks the
+     * exact-match `hasPermission`. A guest, or no seam, is never granted.
+     */
+    grants(user: User, permission: string, resource?: Resource, cache?: PermissionCache | undefined): Promise<boolean>;
+}
+//# sourceMappingURL=rbac.d.ts.map

package/dist/rbac.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac.d.ts","sourceRoot":"","sources":["../src/rbac.ts"],"names":[],"mappings":"AACA,OAAO,EAAsB,KAAK,YAAY,EAAY,MAAM,gBAAgB,CAAC;AACjF,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,KAAK,EAAE,eAAe,EAAgB,MAAM,uBAAuB,CAAC;AAC3E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAE,KAAK,YAAY,EAA0C,MAAM,oBAAoB,CAAC;AAQ/F,OAAO,KAAK,EAAE,kBAAkB,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAsBrE;;;;;;;;;GASG;AACH,qBACa,SAAU,YAAW,YAAY;IAQD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IACtD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAGvC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IACD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAC1B,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;IAb3E,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;IAC5C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAoC;IAChE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyC;IACjE,OAAO,CAAC,cAAc,CAAwC;gBAGlB,OAAO,EAAE,kBAAkB,GAAG,SAAS,EACvB,OAAO,CAAC,EAAE,eAAe,YAAA,EACtD,SAAS,CAAC,EAAE,SAAS,YAAA,EAGjC,kBAAkB,CAAC,EAAE,kBAAkB,YAAA,EACJ,YAAY,CAAC,EAAE,YAAY,YAAA,EACvB,gBAAgB,CAAC,EAAE,gBAAgB,YAAA;IAM7F;;;;OAIG;IACG,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAoBnC;;;OAGG;IACH,OAAO,CAAC,MAAM;IAcd,qEAAqE;IACrE,eAAe,IAAI,eAAe,GAAG,SAAS;IAI9C,0EAA0E;IAC1E,WAAW,IAAI,kBAAkB,GAAG,SAAS;IAI7C,oEAAoE;IACpE,KAAK,IAAI,YAAY,GAAG,SAAS;IAIjC,4EAA4E;IAC5E,SAAS,IAAI,gBAAgB,GAAG,SAAS;IAIzC;;;;;;;;;OASG;IACG,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;IA4BlC;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAczB,2FAA2F;IAC3F,OAAO,CAAC,YAAY;IAYpB;;;;OAIG;IACH,YAAY,IAAI,eAAe,GAAG,SAAS;IAU3C;;;OAGG;IACG,OAAO,CACX,IAAI,EAAE,IAAI,EACV,KAAK,GAAE,eAAe,GAAG,SAA+B,GACvD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAiBvB,mEAAmE;IAC7D,UAAU,CACd,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,KAAK,CAAC,EAAE,eAAe,GAAG,SAAS,GAClC,OAAO,CAAC,OAAO,CAAC;IAMnB,qDAAqD;IAC/C,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAMzE;;;;;;OAMG;IACG,MAAM,CACV,IAAI,EAAE,IAAI,EACV,UAAU,EAAE,MAAM,EAClB,QAAQ,CAAC,EAAE,QAAQ,EACnB,KAAK,GAAE,eAAe,GAAG,SAA+B,GACvD,OAAO,CAAC,OAAO,CAAC;CAgBpB"}

package/dist/rbac.js

@@ -0,0 +1,293 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { InjectCapability } from '@dudousxd/nestjs-diagnostics/nestjs';
+import { Inject, Injectable, Optional } from '@nestjs/common';
+import { ModuleRef } from '@nestjs/core';
+import { PermissionCache } from './permission-cache.js';
+import { permissionSatisfied } from './permission-matcher.js';
+import { defaultRoleResolver } from './role-provider.js';
+import { AUTHZ_MODULE_OPTIONS, CONTEXT_ACCESSOR, DECISION_PROVIDER, PERMISSION_PROVIDER, ROLE_PROVIDER, } from './tokens.js';
+/**
+ * Key of the per-request {@link PermissionCache} on the nestjs-context store. `Symbol.for`
+ * so every copy of this module shares it.
+ */
+const REQUEST_PERMISSION_CACHE = Symbol.for('@dudousxd/nestjs-authz:request-permission-cache');
+/** Key under which the per-request `resolveUser` results are stashed on the context store. */
+const REQUEST_USERS = Symbol.for('@dudousxd/nestjs-authz:request-users');
+/**
+ * Roles and permissions of a user, from the persisted RBAC seams (`ROLE_PROVIDER`,
+ * `PERMISSION_PROVIDER`, registered by the TypeORM / MikroORM / Prisma / Drizzle adapters)
+ * and from the user object itself (`user.roles` / `user.role`); the optional external
+ * decision point (`DECISION_PROVIDER`); and the ambient user for `Gate` calls made without
+ * one. Shared by `RolePolicy`, `PermissionPolicy`, `AuthzPolicy` and the `Gate`.
+ *
+ * Within one request (a nestjs-context store), a user's permissions and provider roles
+ * are fetched once, however many checks run, in guards and in handlers alike.
+ */
+let AuthzRbac = class AuthzRbac {
+    context;
+    moduleRef;
+    permissionProvider;
+    roleProvider;
+    decisionProvider;
+    roleResolver;
+    resolveUser;
+    lookups = new Map();
+    authentication;
+    constructor(options, context, moduleRef, permissionProvider, roleProvider, decisionProvider) {
+        this.context = context;
+        this.moduleRef = moduleRef;
+        this.permissionProvider = permissionProvider;
+        this.roleProvider = roleProvider;
+        this.decisionProvider = decisionProvider;
+        this.roleResolver = options?.resolveRoles ?? defaultRoleResolver;
+        this.resolveUser = options?.resolveUser;
+    }
+    /**
+     * Finds `@nestjs/authentication`'s `AuthenticationContext` when that optional peer is
+     * installed and its module is imported. The class is the DI token, so the package is
+     * loaded only here, and its absence is not an error.
+     */
+    async onModuleInit() {
+        if (!this.moduleRef || this.authentication)
+            return;
+        let token;
+        try {
+            const specifier = '@nestjs/authentication';
+            token = (await import(specifier))
+                .AuthenticationContext;
+        }
+        catch {
+            return;
+        }
+        if (typeof token !== 'function')
+            return;
+        try {
+            this.authentication = this.moduleRef.get(token, {
+                strict: false,
+            });
+        }
+        catch {
+            this.authentication = undefined;
+        }
+    }
+    /**
+     * A provider registered by any module: the injected one, else a non-strict lookup,
+     * memoized, so a global RBAC module or a root-level accessor is found too.
+     */
+    lookup(token, injected) {
+        if (injected)
+            return injected;
+        const memo = this.lookups.get(token);
+        if (memo)
+            return memo.value;
+        let value;
+        try {
+            value = this.moduleRef?.get(token, { strict: false });
+        }
+        catch {
+            value = undefined;
+        }
+        this.lookups.set(token, { value });
+        return value;
+    }
+    /** @internal The nestjs-context accessor, when one is registered. */
+    contextAccessor() {
+        return this.lookup(CONTEXT_ACCESSOR, this.context);
+    }
+    /** The persisted permission seam, when an RBAC adapter registered one. */
+    permissions() {
+        return this.lookup(PERMISSION_PROVIDER, this.permissionProvider);
+    }
+    /** The persisted role seam, when an RBAC adapter registered one. */
+    roles() {
+        return this.lookup(ROLE_PROVIDER, this.roleProvider);
+    }
+    /** The external decision point (Cerbos, OPA, …), when one is registered. */
+    decisions() {
+        return this.lookup(DECISION_PROVIDER, this.decisionProvider);
+    }
+    /**
+     * The user for a `Gate` call made without one:
+     *
+     * 1. `@nestjs/authentication`'s `AuthenticationContext.user`, when that optional peer is
+     *    installed and its scope is active (a call it handles, or `AuthenticationContext.run()`):
+     *    its answer is final, so a `null` there is a guest;
+     * 2. else, with no authentication scope at all, nestjs-context's user ref, hydrated by
+     *    `resolveUser` when configured (once per `type:id` per request);
+     * 3. else `null` (a guest).
+     */
+    async currentUser() {
+        const authenticated = this.authenticatedUser();
+        if (authenticated !== undefined)
+            return authenticated;
+        const context = this.contextAccessor();
+        if (!context)
+            return null;
+        const ref = context.userRef();
+        if (ref === undefined)
+            return null;
+        const resolveUser = this.resolveUser;
+        if (!resolveUser)
+            return ref;
+        const hydrate = async () => (await resolveUser(ref)) ?? null;
+        const store = this.requestStore();
+        if (!store)
+            return hydrate();
+        let users = store[REQUEST_USERS];
+        if (!(users instanceof Map)) {
+            users = new Map();
+            store[REQUEST_USERS] = users;
+        }
+        const key = `${ref.type}:${typeof ref.id}:${ref.id}`;
+        const cached = users.get(key);
+        if (cached)
+            return cached;
+        const pending = hydrate();
+        users.set(key, pending);
+        pending.catch(() => users.delete(key));
+        return pending;
+    }
+    /**
+     * `AuthenticationContext.user` (`null` for an anonymous call) when its scope is active;
+     * `undefined` without the package or outside its scope. A version that hides the scope is
+     * read as before: a user is an answer, `null` is not.
+     */
+    authenticatedUser() {
+        const authentication = this.authentication;
+        if (!authentication)
+            return undefined;
+        try {
+            const scope = authentication.scope;
+            if (scope && typeof scope === 'object' && 'current' in scope) {
+                return scope.current === undefined ? undefined : (authentication.user ?? null);
+            }
+            return authentication.user ?? undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    /** The nestjs-context store for the current request, or `undefined` when there is none. */
+    requestStore() {
+        const context = this.contextAccessor();
+        if (!context || typeof context.get !== 'function')
+            return undefined;
+        let store;
+        try {
+            store = context.get();
+        }
+        catch {
+            store = undefined;
+        }
+        return store;
+    }
+    /**
+     * The per-request {@link PermissionCache} on the nestjs-context store, so every check
+     * in one request shares a single `getPermissions` and `getRoles` fetch per user.
+     * `undefined` without a store.
+     */
+    requestCache() {
+        const store = this.requestStore();
+        if (!store)
+            return undefined;
+        const existing = store[REQUEST_PERMISSION_CACHE];
+        if (existing instanceof PermissionCache)
+            return existing;
+        const cache = new PermissionCache();
+        store[REQUEST_PERMISSION_CACHE] = cache;
+        return cache;
+    }
+    /**
+     * The user's role names: the role resolver's (the user object) and the role provider's,
+     * the latter fetched through `cache` (the request's, by default).
+     */
+    async rolesOf(user, cache = this.requestCache()) {
+        const out = new Set();
+        if (user == null)
+            return out;
+        const fromResolver = await this.roleResolver(user);
+        if (Array.isArray(fromResolver)) {
+            for (const r of fromResolver)
+                if (typeof r === 'string')
+                    out.add(r);
+        }
+        const provider = this.roles();
+        if (provider) {
+            const fromProvider = await (cache ? cache.getRoles(provider, user) : provider.getRoles(user));
+            if (Array.isArray(fromProvider)) {
+                for (const r of fromProvider)
+                    if (typeof r === 'string')
+                        out.add(r);
+            }
+        }
+        return out;
+    }
+    /** True when the user holds any of `roles`. A guest holds none. */
+    async hasAnyRole(user, roles, cache) {
+        if (user == null || roles.length === 0)
+            return false;
+        const held = await this.rolesOf(user, cache ?? this.requestCache());
+        return roles.some((r) => held.has(r));
+    }
+    /** True when the user holds every one of `roles`. */
+    async hasAllRoles(user, roles) {
+        if (user == null || roles.length === 0)
+            return false;
+        const held = await this.rolesOf(user);
+        return roles.every((r) => held.has(r));
+    }
+    /**
+     * True when the permission seam grants `permission` to `user`. With `getPermissions`,
+     * wildcard grants apply (`posts.*` satisfies `posts.update`, `*` anything), fetched
+     * once per `cache` (the request's, by default). A set the provider marks
+     * `exhaustivePermissions` answers on its own; otherwise a miss still asks the
+     * exact-match `hasPermission`. A guest, or no seam, is never granted.
+     */
+    async grants(user, permission, resource, cache = this.requestCache()) {
+        if (user == null)
+            return false;
+        const provider = this.permissions();
+        if (!provider)
+            return false;
+        if (typeof provider.getPermissions === 'function') {
+            const satisfied = cache
+                ? await cache.satisfies(provider, user, permission)
+                : await (async () => {
+                    const granted = await provider.getPermissions?.(user);
+                    return granted == null ? undefined : permissionSatisfied(granted, permission);
+                })();
+            if (satisfied === true)
+                return true;
+            if (satisfied === false && provider.exhaustivePermissions === true)
+                return false;
+        }
+        return (await provider.hasPermission(user, permission, resource)) === true;
+    }
+};
+AuthzRbac = __decorate([
+    Injectable(),
+    __param(0, Optional()),
+    __param(0, Inject(AUTHZ_MODULE_OPTIONS)),
+    __param(1, InjectCapability('context', 'accessor')),
+    __param(2, Optional()),
+    __param(3, Optional()),
+    __param(3, Inject(PERMISSION_PROVIDER)),
+    __param(4, Optional()),
+    __param(4, Inject(ROLE_PROVIDER)),
+    __param(5, Optional()),
+    __param(5, Inject(DECISION_PROVIDER)),
+    __metadata("design:paramtypes", [Object, Object, ModuleRef, Object, Object, Object])
+], AuthzRbac);
+export { AuthzRbac };
+//# sourceMappingURL=rbac.js.map

package/dist/rbac.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac.js","sourceRoot":"","sources":["../src/rbac.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAqB,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACjF,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAGzC,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D,OAAO,EAAwC,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC/F,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,GACd,MAAM,aAAa,CAAC;AAGrB;;;GAGG;AACH,MAAM,wBAAwB,GAAG,MAAM,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;AAE/F,8FAA8F;AAC9F,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;AAazE;;;;;;;;;GASG;AAEI,IAAM,SAAS,GAAf,MAAM,SAAS;IAQwC;IAC7B;IAGZ;IACmC;IACI;IAbzC,YAAY,CAAe;IAC3B,WAAW,CAAoC;IAC/C,OAAO,GAAG,IAAI,GAAG,EAA8B,CAAC;IACzD,cAAc,CAAwC;IAE9D,YAC4C,OAAuC,EACvB,OAAyB,EACtD,SAAqB,EAGjC,kBAAuC,EACJ,YAA2B,EACvB,gBAAmC;QANjC,YAAO,GAAP,OAAO,CAAkB;QACtD,cAAS,GAAT,SAAS,CAAY;QAGjC,uBAAkB,GAAlB,kBAAkB,CAAqB;QACJ,iBAAY,GAAZ,YAAY,CAAe;QACvB,qBAAgB,GAAhB,gBAAgB,CAAmB;QAE3F,IAAI,CAAC,YAAY,GAAG,OAAO,EAAE,YAAY,IAAI,mBAAmB,CAAC;QACjE,IAAI,CAAC,WAAW,GAAG,OAAO,EAAE,WAAW,CAAC;IAC1C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,cAAc;YAAE,OAAO;QACnD,IAAI,KAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,wBAAwB,CAAC;YAC3C,KAAK,GAAI,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,CAAyC;iBACvE,qBAAqB,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,UAAU;YAAE,OAAO;QACxC,IAAI,CAAC;YACH,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAA4C,EAAE;gBACrF,MAAM,EAAE,KAAK;aACd,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC;QAClC,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,MAAM,CAAI,KAAa,EAAE,QAAuB;QACtD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC,KAAsB,CAAC;QAC7C,IAAI,KAAoB,CAAC;QACzB,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,GAAG,CAAI,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,GAAG,SAAS,CAAC;QACpB,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACnC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,qEAAqE;IACrE,eAAe;QACb,OAAO,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACrD,CAAC;IAED,0EAA0E;IAC1E,WAAW;QACT,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACnE,CAAC;IAED,oEAAoE;IACpE,KAAK;QACH,OAAO,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACvD,CAAC;IAED,4EAA4E;IAC5E,SAAS;QACP,OAAO,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC/D,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,WAAW;QACf,MAAM,aAAa,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/C,IAAI,aAAa,KAAK,SAAS;YAAE,OAAO,aAAa,CAAC;QAEtD,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACvC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;QAC9B,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACnC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACrC,IAAI,CAAC,WAAW;YAAE,OAAO,GAAG,CAAC;QAC7B,MAAM,OAAO,GAAG,KAAK,IAAmB,EAAE,CAAC,CAAC,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC;QAE5E,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAClC,IAAI,CAAC,KAAK;YAAE,OAAO,OAAO,EAAE,CAAC;QAC7B,IAAI,KAAK,GAAG,KAAK,CAAC,aAAa,CAA2C,CAAC;QAC3E,IAAI,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC,EAAE,CAAC;YAC5B,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;YAClB,KAAK,CAAC,aAAa,CAAC,GAAG,KAAK,CAAC;QAC/B,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;QACrD,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,MAAM,OAAO,GAAG,OAAO,EAAE,CAAC;QAC1B,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACxB,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACvC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;OAIG;IACK,iBAAiB;QACvB,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC;QAC3C,IAAI,CAAC,cAAc;YAAE,OAAO,SAAS,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC;YACnC,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;gBAC7D,OAAO,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;YACjF,CAAC;YACD,OAAO,cAAc,CAAC,IAAI,IAAI,SAAS,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,2FAA2F;IACnF,YAAY;QAClB,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACvC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,UAAU;YAAE,OAAO,SAAS,CAAC;QACpE,IAAI,KAA+B,CAAC;QACpC,IAAI,CAAC;YACH,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,GAAG,SAAS,CAAC;QACpB,CAAC;QACD,OAAO,KAA4C,CAAC;IACtD,CAAC;IAED;;;;OAIG;IACH,YAAY;QACV,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAClC,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,MAAM,QAAQ,GAAG,KAAK,CAAC,wBAAwB,CAAC,CAAC;QACjD,IAAI,QAAQ,YAAY,eAAe;YAAE,OAAO,QAAQ,CAAC;QACzD,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;QACpC,KAAK,CAAC,wBAAwB,CAAC,GAAG,KAAK,CAAC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO,CACX,IAAU,EACV,QAAqC,IAAI,CAAC,YAAY,EAAE;QAExD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;QAC9B,IAAI,IAAI,IAAI,IAAI;YAAE,OAAO,GAAG,CAAC;QAC7B,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YAChC,KAAK,MAAM,CAAC,IAAI,YAAY;gBAAE,IAAI,OAAO,CAAC,KAAK,QAAQ;oBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9F,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;gBAChC,KAAK,MAAM,CAAC,IAAI,YAAY;oBAAE,IAAI,OAAO,CAAC,KAAK,QAAQ;wBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,mEAAmE;IACnE,KAAK,CAAC,UAAU,CACd,IAAU,EACV,KAAwB,EACxB,KAAmC;QAEnC,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACrD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;QACpE,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,qDAAqD;IACrD,KAAK,CAAC,WAAW,CAAC,IAAU,EAAE,KAAwB;QACpD,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACrD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACtC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CACV,IAAU,EACV,UAAkB,EAClB,QAAmB,EACnB,QAAqC,IAAI,CAAC,YAAY,EAAE;QAExD,IAAI,IAAI,IAAI,IAAI;YAAE,OAAO,KAAK,CAAC;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACpC,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5B,IAAI,OAAO,QAAQ,CAAC,cAAc,KAAK,UAAU,EAAE,CAAC;YAClD,MAAM,SAAS,GAAG,KAAK;gBACrB,CAAC,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,CAAC;gBACnD,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;oBAChB,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,cAAc,EAAE,CAAC,IAAI,CAAC,CAAC;oBACtD,OAAO,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;gBAChF,CAAC,CAAC,EAAE,CAAC;YACT,IAAI,SAAS,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YACpC,IAAI,SAAS,KAAK,KAAK,IAAI,QAAQ,CAAC,qBAAqB,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAC;QACnF,CAAC;QACD,OAAO,CAAC,MAAM,QAAQ,CAAC,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,KAAK,IAAI,CAAC;IAC7E,CAAC;CACF,CAAA;AA9OY,SAAS;IADrB,UAAU,EAAE;IAQR,WAAA,QAAQ,EAAE,CAAA;IAAE,WAAA,MAAM,CAAC,oBAAoB,CAAC,CAAA;IACxC,WAAA,gBAAgB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAA;IACvC,WAAA,QAAQ,EAAE,CAAA;IACV,WAAA,QAAQ,EAAE,CAAA;IACV,WAAA,MAAM,CAAC,mBAAmB,CAAC,CAAA;IAE3B,WAAA,QAAQ,EAAE,CAAA;IAAE,WAAA,MAAM,CAAC,aAAa,CAAC,CAAA;IACjC,WAAA,QAAQ,EAAE,CAAA;IAAE,WAAA,MAAM,CAAC,iBAAiB,CAAC,CAAA;qDALG,SAAS;GATzC,SAAS,CA8OrB"}