@jantstack/adonis-authz 1.1.0 → 2.4.0-alpha.1

package/build/stubs/scopes_outbox_migration.stub

@@ -0,0 +1,57 @@
+{{{
+  exports({ to: app.migrationsPath('create_authz_scope_outbox_table.ts') })
+}}}
+import { BaseSchema } from '@adonisjs/lucid/schema'
+
+/**
+ * La OUTBOX del árbol de scopes (@jantstack/adonis-authz, 3b-2d).
+ *
+ * NO es una tabla del motor: es tuya. La publica el paquete porque
+ * `sqlScopeOutbox()` lee estas columnas, pero el contrato es el puerto
+ * `ScopeOutbox`, no esta tabla — cámbiala si tu cola vive en otro sitio.
+ *
+ * Para qué: con `scopes.outbox` declarada, `authorization.scopes.attached/
+ * moved/detached` NO escriben en el backend. Encolan aquí, dentro de TU
+ * transacción, y `node ace authz:scopes:relay` lo aplica después. Sin eso,
+ * un `rollback` de tu transacción deja el árbol del backend adelantado al
+ * tuyo y —en el driver openfga con `hierarchy: 'facts'`, donde FGA es quien
+ * decide— eso es una escalada persistente que tu base no puede ver.
+ *
+ * Las filas aplicadas se MARCAN (`applied_at`), no se borran: la cola es
+ * también el registro de qué se propagó y cuándo. Púrgalas tú cuando
+ * quieras.
+ */
+export default class extends BaseSchema {
+  async up() {
+    this.schema.createTable('authz_scope_outbox', (table) => {
+      table.increments('id').primary()
+      // 'attached' | 'moved' | 'detached'.
+      table.string('op', 10).notNullable().collate('utf8mb4_bin')
+      // La identidad CANÓNICA del scope (la que devolvió tu resolveChain),
+      // con las decisiones de motor del paquete: varchar(64) utf8mb4_bin,
+      // para que un alias del uuid no se funda con otra fila.
+      table.string('child_type', 20).notNullable().collate('utf8mb4_bin')
+      table.string('child_uuid', 64).notNullable().collate('utf8mb4_bin')
+      // Nulos en 'detached' (no hay padre); 'app' con uuid nulo es la raíz.
+      table.string('parent_type', 20).nullable().collate('utf8mb4_bin')
+      table.string('parent_uuid', 64).nullable().collate('utf8mb4_bin')
+      // Quién lo ordenó, si el call-site lo declaró.
+      table.string('actor_type', 50).nullable().collate('utf8mb4_bin')
+      table.string('actor_uuid', 64).nullable().collate('utf8mb4_bin')
+      // Intentos fallidos y la última causa: el relay nunca es silencioso.
+      // Agotados los intentos (`sqlScopeOutbox({ maxAttempts })`, 5 por
+      // defecto) la fila queda APARCADA: deja de reintentarse, sale por
+      // `dead()` y el relay la reporta en todas las pasadas. Se queda aquí
+      // —el árbol del backend está divergente en ese nodo— hasta que la mires.
+      table.integer('attempts').notNullable().defaultTo(0)
+      table.text('last_error').nullable()
+      table.timestamp('created_at').notNullable()
+      table.timestamp('applied_at').nullable()
+      table.index(['applied_at', 'id'], 'authz_scope_outbox_pending_idx')
+    })
+  }
+
+  async down() {
+    this.schema.dropTable('authz_scope_outbox')
+  }
+}

package/package.json

@@ -1,17 +1,16 @@
 {
   "name": "@jantstack/adonis-authz",
-  "version": "1.1.0",
+  "version": "2.4.0-alpha.1",
   "description": "Driver-based authorization engine for AdonisJS + Lucid: hierarchical scopes with downward inheritance, explicit denies, expiring assignments and polymorphic holders. Ships a self-contained database driver and an OpenFGA driver, both judged by the same executable contract suite.",
   "type": "module",
   "license": "MIT",
-  "author": "Jose Tenorio",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/JantStack/adonis-authz.git"
+    "url": "git+https://github.com/jantstack/adonis-authz.git"
   },
-  "homepage": "https://github.com/JantStack/adonis-authz#readme",
+  "homepage": "https://github.com/jantstack/adonis-authz#readme",
   "bugs": {
-    "url": "https://github.com/JantStack/adonis-authz/issues"
+    "url": "https://github.com/jantstack/adonis-authz/issues"
   },
   "keywords": [
     "adonisjs",
@@ -43,9 +42,12 @@
   "types": "./build/index.d.ts",
   "exports": {
     ".": "./build/index.js",
+    "./openfga": "./build/src/openfga.js",
     "./authz_provider": "./build/providers/authz_provider.js",
     "./services/main": "./build/services/main.js",
-    "./app_access_middleware": "./build/src/middleware/app_access_middleware.js",
+    "./services/relations": "./build/services/relations.js",
+    "./app_access_middleware": "./build/src/http/app_access_middleware.js",
+    "./resource_access_middleware": "./build/src/http/resource_access_middleware.js",
     "./commands": "./build/commands/main.js",
     "./commands/*": "./build/commands/*.js",
     "./testing": "./build/src/testing/main.js",
@@ -61,7 +63,10 @@
     "prepublishOnly": "npm run build",
     "copy:stubs": "mkdir -p build/stubs/config && cp stubs/*.stub build/stubs/ && cp stubs/config/*.stub build/stubs/config/",
     "check:purity": "node scripts/check_purity.mjs",
-    "test": "node --import @poppinss/ts-exec bin/test.ts",
+    "test": "npm run check:purity && node --import @poppinss/ts-exec bin/test.ts",
+    "test:sqlite-file": "TEST_DB=sqlite-file npm test",
+    "test:pg": "TEST_DB=pg npm test",
+    "test:mysql": "TEST_DB=mysql npm test",
     "typecheck:build": "tsc --noEmit"
   },
   "peerDependencies": {
@@ -87,6 +92,8 @@
     "@types/node": "^22.19.1",
     "better-sqlite3": "^13.0.1",
     "luxon": "^3.7.2",
+    "mysql2": "^3.24.2",
+    "pg": "^8.23.0",
     "typescript": "~5.9.3"
   },
   "publishConfig": {

package/build/commands/openfga_import.d.ts

@@ -1,28 +0,0 @@
-import { BaseCommand } from '@adonisjs/core/ace';
-import { CommandOptions } from '@adonisjs/core/types/ace';
-/**
- * Migra los HECHOS del driver `database` a un store OpenFGA: copia las
- * asignaciones vigentes (authz_assignments) y los denies (authz_denies)
- * como tuples. El catálogo y la jerarquía no migran: son metadata local
- * para ambos drivers.
- *
- * Proceso completo database → openfga:
- *   1. Levantar el servidor (profile openfga del compose).
- *   2. node ace openfga:provision            → store + model (ids al .env)
- *   3. node ace openfga:import [--dry-run]   → copia los hechos
- *   4. AUTHZ_DRIVER=openfga + reiniciar api/worker.
- *
- * Idempotente (re-ejecutar no duplica) y no destructivo (las tablas
- * locales quedan intactas → rollback = volver a AUTHZ_DRIVER=database).
- */
-export default class OpenFgaImport extends BaseCommand {
-    static commandName: string;
-    static description: string;
-    static options: CommandOptions;
-    url: string | undefined;
-    storeId: string | undefined;
-    modelId: string | undefined;
-    dryRun: boolean | undefined;
-    run(): Promise<void>;
-}
-//# sourceMappingURL=openfga_import.d.ts.map

package/build/commands/openfga_import.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"openfga_import.d.ts","sourceRoot":"","sources":["../../commands/openfga_import.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAS,MAAM,oBAAoB,CAAA;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAA;AAEzD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,OAAO,OAAO,aAAc,SAAQ,WAAW;IACpD,MAAM,CAAC,WAAW,SAAmB;IACrC,MAAM,CAAC,WAAW,SAAgF;IAElG,MAAM,CAAC,OAAO,EAAE,cAAc,CAE7B;IAGO,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;IAGvB,OAAO,EAAE,MAAM,GAAG,SAAS,CAAA;IAG3B,OAAO,EAAE,MAAM,GAAG,SAAS,CAAA;IAG3B,MAAM,EAAE,OAAO,GAAG,SAAS,CAAA;IAE7B,GAAG;CA+BV"}

package/build/commands/openfga_import.js

@@ -1,74 +0,0 @@
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-import { BaseCommand, flags } from '@adonisjs/core/ace';
-/**
- * Migra los HECHOS del driver `database` a un store OpenFGA: copia las
- * asignaciones vigentes (authz_assignments) y los denies (authz_denies)
- * como tuples. El catálogo y la jerarquía no migran: son metadata local
- * para ambos drivers.
- *
- * Proceso completo database → openfga:
- *   1. Levantar el servidor (profile openfga del compose).
- *   2. node ace openfga:provision            → store + model (ids al .env)
- *   3. node ace openfga:import [--dry-run]   → copia los hechos
- *   4. AUTHZ_DRIVER=openfga + reiniciar api/worker.
- *
- * Idempotente (re-ejecutar no duplica) y no destructivo (las tablas
- * locales quedan intactas → rollback = volver a AUTHZ_DRIVER=database).
- */
-export default class OpenFgaImport extends BaseCommand {
-    static commandName = 'openfga:import';
-    static description = 'Copy authz facts (assignments/denies) from the database driver into OpenFGA';
-    static options = {
-        startApp: true,
-    };
-    async run() {
-        const config = this.app.config.get('authorization');
-        const apiUrl = this.url ?? config?.openfga?.url;
-        const storeId = this.storeId ?? config?.openfga?.storeId;
-        if (!apiUrl || !storeId) {
-            this.logger.error('Faltan la URL o el store: --url/--store-id o OPENFGA_URL/OPENFGA_STORE_ID (ver openfga:provision)');
-            this.exitCode = 1;
-            return;
-        }
-        const { importAuthzFactsToOpenFga } = await import('../src/drivers/openfga_driver.js');
-        const holderTypes = config?.holderTypes ?? {};
-        const result = await importAuthzFactsToOpenFga({
-            apiUrl,
-            storeId,
-            modelId: this.modelId ?? config?.openfga?.modelId,
-            dryRun: this.dryRun ?? false,
-            holderTypes,
-        });
-        const verb = result.dryRun ? 'Se escribirían' : 'Escritos';
-        this.logger.success(`${verb} ${result.assignments} assignments y ${result.denies} denies ` +
-            `(${result.skippedExpired} asignaciones ya expiradas omitidas).`);
-        if (!result.dryRun) {
-            this.logger.log('Siguiente paso: AUTHZ_DRIVER=openfga y reiniciar api/worker.');
-        }
-    }
-}
-__decorate([
-    flags.string({ description: 'OpenFGA API URL (defaults to OPENFGA_URL)' }),
-    __metadata("design:type", Object)
-], OpenFgaImport.prototype, "url", void 0);
-__decorate([
-    flags.string({ alias: 's', description: 'Store id (defaults to OPENFGA_STORE_ID)' }),
-    __metadata("design:type", Object)
-], OpenFgaImport.prototype, "storeId", void 0);
-__decorate([
-    flags.string({ description: 'Model id (defaults to OPENFGA_MODEL_ID)' }),
-    __metadata("design:type", Object)
-], OpenFgaImport.prototype, "modelId", void 0);
-__decorate([
-    flags.boolean({ description: 'Count what would be written, without writing' }),
-    __metadata("design:type", Object)
-], OpenFgaImport.prototype, "dryRun", void 0);
-//# sourceMappingURL=openfga_import.js.map

package/build/commands/openfga_import.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"openfga_import.js","sourceRoot":"","sources":["../../commands/openfga_import.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAGvD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,OAAO,OAAO,aAAc,SAAQ,WAAW;IACpD,MAAM,CAAC,WAAW,GAAG,gBAAgB,CAAA;IACrC,MAAM,CAAC,WAAW,GAAG,6EAA6E,CAAA;IAElG,MAAM,CAAC,OAAO,GAAmB;QAC/B,QAAQ,EAAE,IAAI;KACf,CAAA;IAcD,KAAK,CAAC,GAAG;QACP,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAQ,CAAA;QAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,MAAM,EAAE,OAAO,EAAE,GAAG,CAAA;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,MAAM,EAAE,OAAO,EAAE,OAAO,CAAA;QACxD,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,mGAAmG,CACpG,CAAA;YACD,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAA;YACjB,OAAM;QACR,CAAC;QAED,MAAM,EAAE,yBAAyB,EAAE,GAAG,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAA;QACtF,MAAM,WAAW,GAAG,MAAM,EAAE,WAAW,IAAI,EAAE,CAAA;QAC7C,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC;YAC7C,MAAM;YACN,OAAO;YACP,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,MAAM,EAAE,OAAO,EAAE,OAAO;YACjD,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK;YAC5B,WAAW;SACZ,CAAC,CAAA;QAEF,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,UAAU,CAAA;QAC1D,IAAI,CAAC,MAAM,CAAC,OAAO,CACjB,GAAG,IAAI,IAAI,MAAM,CAAC,WAAW,kBAAkB,MAAM,CAAC,MAAM,UAAU;YACpE,IAAI,MAAM,CAAC,cAAc,uCAAuC,CACnE,CAAA;QACD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAA;QACjF,CAAC;IACH,CAAC;;AAzCO;IADP,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,2CAA2C,EAAE,CAAC;;0CAC5C;AAGvB;IADP,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,yCAAyC,EAAE,CAAC;;8CAClD;AAG3B;IADP,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,yCAAyC,EAAE,CAAC;;8CACtC;AAG3B;IADP,KAAK,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,8CAA8C,EAAE,CAAC;;6CAC5C"}

package/build/src/catalog.d.ts

@@ -1,3 +0,0 @@
-import type { CatalogSpec } from './types.js';
-export declare function syncAuthzCatalog(catalog: CatalogSpec): Promise<void>;
-//# sourceMappingURL=catalog.d.ts.map

package/build/src/catalog.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../../src/catalog.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AA+B7C,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CA8E1E"}

package/build/src/catalog.js

@@ -1,103 +0,0 @@
-import db from '@adonisjs/lucid/services/db';
-import { Exception } from '@adonisjs/core/exceptions';
-import { v7 as uuidv7 } from 'uuid';
-/**
- * Sincroniza un catálogo (roles + permisos + vínculos) a las tablas `authz_*`.
- *
- * Idempotente y aditivo (mismo contrato que el organization_acl_seeder): lo
- * existente se respeta, solo se insertan los diffs nuevos. Quitar algo del
- * catálogo NO lo borra de DB (limpieza explícita vía migración).
- *
- * Lo usan el seeder del nivel app (`app_acl_seeder`) y el harness de la
- * suite de contrato. El catálogo es metadata compartida entre drivers:
- * un driver externo (openfga) materializa aparte solo los hechos.
- */
-/**
- * Slugs válidos del catálogo: minúsculas, dígitos y . _ - con `:` opcional
- * (gramática recurso:accion). Prohibidos `~` y `|`: son los caracteres de
- * encoding/separador del driver openfga — un slug que los contenga
- * corrompería el mapeo de bindings.
- */
-const CATALOG_SLUG_FORMAT = /^[a-z0-9][a-z0-9_.-]*(:[a-z0-9][a-z0-9_.-]*)?$/;
-function assertValidSlug(kind, slug) {
-    if (!CATALOG_SLUG_FORMAT.test(slug)) {
-        throw new Exception(`Slug de ${kind} inválido: '${slug}'. Formato: minúsculas/dígitos/._- ` +
-            `con ':' único opcional (recurso:accion); '~' y '|' están prohibidos.`, { status: 500 });
-    }
-}
-export async function syncAuthzCatalog(catalog) {
-    for (const perm of catalog.permissions)
-        assertValidSlug('permiso', perm.slug);
-    for (const role of catalog.roles)
-        assertValidSlug('rol', role.slug);
-    // Todo o nada. Un fallo a mitad (una constraint, la conexión) dejaba el
-    // catálogo escrito a medias: roles sin sus permisos, es decir holders que
-    // "tienen" un rol que no concede nada. Es idempotente y re-ejecutarlo lo
-    // arreglaba, pero mientras tanto la autorización respondía de menos.
-    await db.transaction(async (trx) => {
-        // 1. Permisos: upsert por slug.
-        for (const perm of catalog.permissions) {
-            const existing = await trx.from('authz_permissions').where('slug', perm.slug).first();
-            if (existing)
-                continue;
-            await trx.table('authz_permissions').insert({
-                uuid: uuidv7(),
-                slug: perm.slug,
-                description: perm.description ?? null,
-                created_at: new Date(),
-                updated_at: new Date(),
-            });
-        }
-        const dbPerms = await trx
-            .from('authz_permissions')
-            .whereIn('slug', catalog.permissions.map((p) => p.slug))
-            .select('uuid', 'slug');
-        const permUuidBySlug = new Map(dbPerms.map((p) => [p.slug, p.uuid]));
-        // 2. Roles: upsert por (slug, scope_type).
-        for (const role of catalog.roles) {
-            const existing = await trx
-                .from('authz_roles')
-                .where('slug', role.slug)
-                .where('scope_type', role.scopeType)
-                .first();
-            const roleUuid = existing?.uuid ?? role.uuid ?? uuidv7();
-            if (!existing) {
-                await trx.table('authz_roles').insert({
-                    uuid: roleUuid,
-                    slug: role.slug,
-                    name: role.name ?? role.slug,
-                    description: role.description ?? null,
-                    scope_type: role.scopeType,
-                    rank: role.rank ?? 0,
-                    created_at: new Date(),
-                    updated_at: new Date(),
-                });
-            }
-            else if (role.rank !== undefined && existing.rank !== role.rank) {
-                // El rank es metadata de policy: el config manda (a diferencia de los
-                // vínculos, que son aditivos).
-                await trx.from('authz_roles').where('uuid', roleUuid).update({ rank: role.rank });
-            }
-            // 3. Vínculos rol→permiso: upsert por par.
-            for (const permSlug of role.permissions) {
-                const permUuid = permUuidBySlug.get(permSlug);
-                if (!permUuid)
-                    continue;
-                const linked = await trx
-                    .from('authz_role_permissions')
-                    .where('role_uuid', roleUuid)
-                    .where('permission_uuid', permUuid)
-                    .first();
-                if (linked)
-                    continue;
-                await trx.table('authz_role_permissions').insert({
-                    uuid: uuidv7(),
-                    role_uuid: roleUuid,
-                    permission_uuid: permUuid,
-                    created_at: new Date(),
-                });
-            }
-        }
-    });
-}
-//# sourceMappingURL=catalog.js.map

package/build/src/catalog.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"catalog.js","sourceRoot":"","sources":["../../src/catalog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,6BAA6B,CAAA;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AACrD,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAA;AAGnC;;;;;;;;;;GAUG;AACH;;;;;GAKG;AACH,MAAM,mBAAmB,GAAG,gDAAgD,CAAA;AAE5E,SAAS,eAAe,CAAC,IAAY,EAAE,IAAY;IACjD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,SAAS,CACjB,WAAW,IAAI,eAAe,IAAI,qCAAqC;YACrE,sEAAsE,EACxE,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAoB;IACzD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,WAAW;QAAE,eAAe,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;IAC7E,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK;QAAE,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;IAEnE,wEAAwE;IACxE,0EAA0E;IAC1E,yEAAyE;IACzE,qEAAqE;IACrE,MAAM,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACjC,gCAAgC;QAChC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACvC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAA;YACrF,IAAI,QAAQ;gBAAE,SAAQ;YACtB,MAAM,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC;gBAC1C,IAAI,EAAE,MAAM,EAAE;gBACd,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;gBACrC,UAAU,EAAE,IAAI,IAAI,EAAE;gBACtB,UAAU,EAAE,IAAI,IAAI,EAAE;aACvB,CAAC,CAAA;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,GAAG;aACtB,IAAI,CAAC,mBAAmB,CAAC;aACzB,OAAO,CACN,MAAM,EACN,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CACvC;aACA,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QACzB,MAAM,cAAc,GAAG,IAAI,GAAG,CAAiB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAEzF,2CAA2C;QAC3C,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAG,MAAM,GAAG;iBACvB,IAAI,CAAC,aAAa,CAAC;iBACnB,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC;iBACxB,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC;iBACnC,KAAK,EAAE,CAAA;YAEV,MAAM,QAAQ,GAAG,QAAQ,EAAE,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,MAAM,EAAE,CAAA;YACxD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC;oBACpC,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI;oBAC5B,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;oBACrC,UAAU,EAAE,IAAI,CAAC,SAAS;oBAC1B,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC;oBACpB,UAAU,EAAE,IAAI,IAAI,EAAE;oBACtB,UAAU,EAAE,IAAI,IAAI,EAAE;iBACvB,CAAC,CAAA;YACJ,CAAC;iBAAM,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;gBAClE,sEAAsE;gBACtE,+BAA+B;gBAC/B,MAAM,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;YACnF,CAAC;YAED,2CAA2C;YAC3C,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACxC,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;gBAC7C,IAAI,CAAC,QAAQ;oBAAE,SAAQ;gBAEvB,MAAM,MAAM,GAAG,MAAM,GAAG;qBACrB,IAAI,CAAC,wBAAwB,CAAC;qBAC9B,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC;qBAC5B,KAAK,CAAC,iBAAiB,EAAE,QAAQ,CAAC;qBAClC,KAAK,EAAE,CAAA;gBACV,IAAI,MAAM;oBAAE,SAAQ;gBAEpB,MAAM,GAAG,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,MAAM,CAAC;oBAC/C,IAAI,EAAE,MAAM,EAAE;oBACd,SAAS,EAAE,QAAQ;oBACnB,eAAe,EAAE,QAAQ;oBACzB,UAAU,EAAE,IAAI,IAAI,EAAE;iBACvB,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/build/src/middleware/app_access_middleware.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"app_access_middleware.d.ts","sourceRoot":"","sources":["../../../src/middleware/app_access_middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAA;AAKvD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,OAAO,OAAO,mBAAmB;IAChC,MAAM,CACV,GAAG,EAAE,WAAW,EAChB,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAO;CAqDvD"}

package/build/src/middleware/app_access_middleware.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"app_access_middleware.js","sourceRoot":"","sources":["../../../src/middleware/app_access_middleware.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AACrD,OAAO,aAAa,MAAM,wBAAwB,CAAA;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAEvC;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,OAAO,OAAO,mBAAmB;IACtC,KAAK,CAAC,MAAM,CACV,GAAgB,EAChB,IAAY,EACZ,UAAkD,EAAE;QAEpD,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACzC,MAAM,IAAI,SAAS,CAAC,qDAAqD,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAC7F,CAAC;QAED,MAAM,MAAM,GAAI,GAAW,CAAC,IAAI,EAAE,IAA6D,CAAA;QAC/F,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAA;QAC9F,CAAC;QAED,mEAAmE;QACnE,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAA;QACnC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,SAAS,CAAC,mEAAmE,EAAE;gBACvF,MAAM,EAAE,GAAG;aACZ,CAAC,CAAA;QACJ,CAAC;QAED,kEAAkE;QAClE,wEAAwE;QACxE,yEAAyE;QACzE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,SAAS,CACjB,cAAc,KAAK,mEAAmE;gBACpF,sCAAsC,EACxC,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;QACH,CAAC;QAED,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAA;QAElD,IAAI,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;YACrF,OAAO,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAC5B,OAAO,EAAE,sBAAsB;gBAC/B,UAAU,EAAE,GAAG;gBACf,MAAM,EAAE,EAAE;aACX,CAAC,CAAA;QACJ,CAAC;QAED,IACE,OAAO,CAAC,UAAU;YAClB,CAAC,CAAC,MAAM,aAAa,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,EACxE,CAAC;YACD,OAAO,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAC5B,OAAO,EAAE,sBAAsB;gBAC/B,UAAU,EAAE,GAAG;gBACf,MAAM,EAAE,EAAE;aACX,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,IAAI,EAAE,CAAA;IACf,CAAC;CACF"}