@jazzmind/busibox-app 3.0.18

package/dist/lib/authz/permissions.js

@@ -0,0 +1,238 @@
+/**
+ * RBAC Permission Checking Utilities (busibox-portal wrapper)
+ *
+ * Zero Trust Architecture:
+ * All authorization checks are delegated to the authz service via busibox-app.
+ *
+ * For user self-service operations (checking own access, listing own resources),
+ * the session JWT is passed directly to authz - no token exchange required.
+ *
+ * Token exchange is only needed for:
+ * - Admin operations on other users
+ * - Downstream service access (busibox-agents, etc.)
+ */
+import { getUserRoles as busiboxGetUserRoles, hasRole as busiboxHasRole, isAdmin as busiboxIsAdmin, userCanAccessResource, getUserAccessibleResources, } from '@jazzmind/busibox-app';
+import { getAuthzOptions } from './next-client';
+import { getAppByIdFromStore, getAppConfigStoreContextForUser, listAppsFromStore } from '../deploy/app-config';
+/**
+ * Get RBAC options with session JWT for self-service operations.
+ *
+ * Authz now accepts session JWTs directly for self-service operations
+ * (user checking their own access, listing their own resources).
+ * No token exchange is required.
+ *
+ * @param sessionJwt - The user's session JWT
+ * @returns RbacClientOptions with the session JWT as accessToken
+ */
+function getRbacOptionsWithToken(sessionJwt) {
+    // Pass session JWT directly - authz accepts it for self-service operations
+    return {
+        accessToken: sessionJwt,
+        ...getAuthzOptions(),
+    };
+}
+// ============================================================================
+// App-Specific Permission Checks (via authz bindings)
+// ============================================================================
+/**
+ * Check if a user can access a specific app
+ *
+ * Queries the authz service to check if the user has any role
+ * that is bound to the specified app.
+ *
+ * @param userId - User ID to check
+ * @param appId - App ID to check access for
+ * @param accessToken - Optional access token for authenticated check
+ * @returns true if user has permission, false otherwise
+ */
+export async function canAccessApp(userId, appId, accessToken) {
+    try {
+        if (!accessToken) {
+            return false;
+        }
+        // First check if the app exists and is active
+        const appStoreContext = await getAppConfigStoreContextForUser(userId, accessToken);
+        const app = await getAppByIdFromStore(appStoreContext.accessToken, appId);
+        if (!app || !app.isActive) {
+            return false;
+        }
+        // Check if user can access the app via authz bindings
+        const options = accessToken ? getRbacOptionsWithToken(accessToken) : getAuthzOptions();
+        return await userCanAccessResource(userId, 'app', appId, options);
+    }
+    catch (error) {
+        console.error('[PERMISSIONS] Error checking app access:', error);
+        return false;
+    }
+}
+/**
+ * Get all apps a user can access
+ *
+ * Queries the authz service for accessible app IDs, then fetches
+ * app details from the local database.
+ *
+ * @param userId - User ID
+ * @param accessToken - Optional access token for authenticated check
+ * @returns Array of apps the user has permission to access
+ */
+export async function getUserApps(userId, accessToken) {
+    try {
+        if (!accessToken) {
+            return [];
+        }
+        // Get list of app IDs the user can access from authz
+        const options = accessToken ? getRbacOptionsWithToken(accessToken) : getAuthzOptions();
+        const accessibleAppIds = await getUserAccessibleResources(userId, 'app', options);
+        if (accessibleAppIds.length === 0) {
+            return [];
+        }
+        // Fetch app details from app config store
+        const appStoreContext = await getAppConfigStoreContextForUser(userId, accessToken);
+        const accessibleSet = new Set(accessibleAppIds);
+        return (await listAppsFromStore(appStoreContext.accessToken))
+            .filter((app) => app.isActive && accessibleSet.has(app.id))
+            .map((app) => ({
+            id: app.id,
+            name: app.name,
+            description: app.description,
+            type: app.type,
+            url: app.url,
+            iconUrl: app.iconUrl,
+            selectedIcon: app.selectedIcon,
+            displayOrder: app.displayOrder,
+            isActive: app.isActive,
+        }));
+    }
+    catch (error) {
+        console.error('[PERMISSIONS] Error getting user apps:', error);
+        return [];
+    }
+}
+// ============================================================================
+// Role Checks (delegate to busibox-app)
+// ============================================================================
+/**
+ * Get user's roles from authz service
+ *
+ * @deprecated Use busibox-app's getUserRoles() directly
+ */
+export async function getUserRoles(userId) {
+    validateUserId(userId);
+    return busiboxGetUserRoles(userId, getAuthzOptions());
+}
+/**
+ * Get user's role names
+ *
+ * @deprecated Use busibox-app's getUserRoleNames() directly
+ */
+export async function getUserRoleNames(userId) {
+    validateUserId(userId);
+    const roles = await busiboxGetUserRoles(userId, getAuthzOptions());
+    return roles.map(r => r.name);
+}
+/**
+ * Check if user has a specific role
+ *
+ * @deprecated Use busibox-app's hasRole() directly
+ */
+export async function hasRole(userId, roleName) {
+    validateUserId(userId);
+    return busiboxHasRole(userId, roleName, getAuthzOptions());
+}
+/**
+ * Check if user is an admin
+ *
+ * @deprecated Use busibox-app's isAdmin() directly
+ */
+export async function isAdmin(userId) {
+    validateUserId(userId);
+    return busiboxIsAdmin(userId, getAuthzOptions());
+}
+/**
+ * Check if user is a guest
+ *
+ * @deprecated Use busibox-app's isGuest() directly
+ */
+export async function isGuest(userId) {
+    validateUserId(userId);
+    return busiboxHasRole(userId, 'Guest', getAuthzOptions());
+}
+/**
+ * Check if user has any of the specified roles
+ *
+ * @deprecated Use busibox-app's hasAnyRole() directly
+ */
+export async function hasAnyRole(userId, roleNames) {
+    validateUserId(userId);
+    const roles = await busiboxGetUserRoles(userId, getAuthzOptions());
+    const userRoleNames = roles.map(r => r.name);
+    return roleNames.some(roleName => userRoleNames.includes(roleName));
+}
+/**
+ * Check if user has all of the specified roles
+ *
+ * @deprecated Use busibox-app's hasAllRoles() directly
+ */
+export async function hasAllRoles(userId, roleNames) {
+    validateUserId(userId);
+    const roles = await busiboxGetUserRoles(userId, getAuthzOptions());
+    const userRoleNames = roles.map(r => r.name);
+    return roleNames.every(roleName => userRoleNames.includes(roleName));
+}
+// ============================================================================
+// User Status Checks (busibox-portal Prisma-based)
+// ============================================================================
+/**
+ * Check if user is active
+ *
+ * This checks the authz service.
+ */
+export async function isUserActive(userId) {
+    try {
+        const { getUser } = await import('./user-management');
+        const user = await getUser(userId);
+        return user?.status === 'ACTIVE';
+    }
+    catch (error) {
+        console.error('[PERMISSIONS] Error checking user status:', error);
+        return false;
+    }
+}
+/**
+ * Validate that a user ID is a valid UUID format
+ */
+function validateUserId(userId) {
+    const uuidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+    if (!userId || !uuidRegex.test(userId)) {
+        throw new Error(`Invalid user ID format: ${userId}`);
+    }
+}
+/**
+ * Get user with roles from authz service
+ */
+export async function getUserWithRoles(userId) {
+    try {
+        // Validate user ID is a valid UUID before calling RBAC functions
+        validateUserId(userId);
+        const { getUser } = await import('./user-management');
+        const user = await getUser(userId);
+        if (!user) {
+            console.warn(`[PERMISSIONS] getUser returned null for userId: ${userId}`);
+            return null;
+        }
+        return {
+            id: userId,
+            email: user.email,
+            status: user.status,
+            lastLoginAt: user.last_login_at ? new Date(user.last_login_at) : null,
+            createdAt: new Date(user.created_at),
+            updatedAt: new Date(user.updated_at),
+            roles: user.roles || [],
+        };
+    }
+    catch (error) {
+        console.error(`[PERMISSIONS] Error getting user with roles for userId ${userId}:`, error);
+        return null;
+    }
+}
+//# sourceMappingURL=permissions.js.map

package/dist/lib/authz/permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../../src/lib/authz/permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EACL,YAAY,IAAI,mBAAmB,EACnC,OAAO,IAAI,cAAc,EACzB,OAAO,IAAI,cAAc,EACzB,qBAAqB,EACrB,0BAA0B,GAG3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,+BAA+B,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAE/G;;;;;;;;;GASG;AACH,SAAS,uBAAuB,CAAC,UAAkB;IACjD,2EAA2E;IAC3E,OAAO;QACL,WAAW,EAAE,UAAU;QACvB,GAAG,eAAe,EAAE;KACrB,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,sDAAsD;AACtD,+EAA+E;AAE/E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,KAAa,EAAE,WAAoB;IACpF,IAAI,CAAC;QACH,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,8CAA8C;QAC9C,MAAM,eAAe,GAAG,MAAM,+BAA+B,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACnF,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,eAAe,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QAE1E,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,sDAAsD;QACtD,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,uBAAuB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC;QACvF,OAAO,MAAM,qBAAqB,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAE,KAAK,CAAC,CAAC;QACjE,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAc,EAAE,WAAoB;IACpE,IAAI,CAAC;QACH,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,qDAAqD;QACrD,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,uBAAuB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC;QACvF,MAAM,gBAAgB,GAAG,MAAM,0BAA0B,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QAElF,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClC,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,0CAA0C;QAC1C,MAAM,eAAe,GAAG,MAAM,+BAA+B,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACnF,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAChD,OAAO,CAAC,MAAM,iBAAiB,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;aAC1D,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;aAC1D,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACb,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,QAAQ,EAAE,GAAG,CAAC,QAAQ;SACvB,CAAC,CAAC,CAAC;IACR,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,wCAAwC,EAAE,KAAK,CAAC,CAAC;QAC/D,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,wCAAwC;AACxC,+EAA+E;AAE/E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAc;IAC/C,cAAc,CAAC,MAAM,CAAC,CAAC;IACvB,OAAO,mBAAmB,CAAC,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;AACxD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAc;IACnD,cAAc,CAAC,MAAM,CAAC,CAAC;IACvB,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;IACnE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,MAAc,EAAE,QAAgB;IAC5D,cAAc,CAAC,MAAM,CAAC,CAAC;IACvB,OAAO,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,MAAc;IAC1C,cAAc,CAAC,MAAM,CAAC,CAAC;IACvB,OAAO,cAAc,CAAC,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;AACnD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,MAAc;IAC1C,cAAc,CAAC,MAAM,CAAC,CAAC;IACvB,OAAO,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAc,EAAE,SAAmB;IAClE,cAAc,CAAC,MAAM,CAAC,CAAC;IACvB,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;IACnE,MAAM,aAAa,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC7C,OAAO,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AACtE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAc,EAAE,SAAmB;IACnE,cAAc,CAAC,MAAM,CAAC,CAAC;IACvB,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;IACnE,MAAM,aAAa,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC7C,OAAO,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,+EAA+E;AAC/E,mDAAmD;AACnD,+EAA+E;AAE/E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAc;IAC/C,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;QACnC,OAAO,IAAI,EAAE,MAAM,KAAK,QAAQ,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE,KAAK,CAAC,CAAC;QAClE,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,MAAc;IACpC,MAAM,SAAS,GAAG,iEAAiE,CAAC;IACpF,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,2BAA2B,MAAM,EAAE,CAAC,CAAC;IACvD,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAc;IACnD,IAAI,CAAC;QACH,iEAAiE;QACjE,cAAc,CAAC,MAAM,CAAC,CAAC;QAEvB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;QAEnC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,IAAI,CAAC,mDAAmD,MAAM,EAAE,CAAC,CAAC;YAC1E,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO;YACL,EAAE,EAAE,MAAM;YACV,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI;YACrE,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;YACpC,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;YACpC,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;SACxB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,0DAA0D,MAAM,GAAG,EAAE,KAAK,CAAC,CAAC;QAC1F,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/lib/authz/rbac.d.ts

@@ -0,0 +1,320 @@
+/**
+ * RBAC Client for busibox-app
+ *
+ * Centralized RBAC client that queries the authz service.
+ * All Busibox applications should use this client for role/permission checks.
+ *
+ * Authentication:
+ * - For self-service operations (user checking own access), pass the session JWT
+ *   as `accessToken` - authz accepts it directly, no token exchange required.
+ * - For admin operations (accessing other users' data), use an exchanged access
+ *   token with appropriate authz.bindings.* scopes.
+ *
+ * Usage:
+ * ```typescript
+ * import { hasRole, isAdmin, getUserRoles, getUserAccessibleResources } from 'busibox-app';
+ *
+ * // Self-service: pass session JWT directly
+ * const resources = await getUserAccessibleResources(userId, 'app', {
+ *   authzUrl: 'http://authz-api:8010',
+ *   accessToken: sessionJwt,
+ * });
+ *
+ * // Admin: use exchanged access token with scopes
+ * const roles = await getUserRoles('other-user-123', {
+ *   accessToken: adminAccessToken,
+ * });
+ * ```
+ */
+export interface RbacClientOptions {
+    /** User ID (for server-side token acquisition) */
+    userId?: string;
+    /** Custom token acquisition function */
+    getAuthzToken?: (userId: string, audience: string, scopes: string[]) => Promise<string>;
+    /** Override authz service URL */
+    authzUrl?: string;
+    /**
+     * Access token (JWT) for authentication.
+     *
+     * For self-service operations (user accessing their own resources),
+     * you can pass the session JWT directly - authz accepts it.
+     *
+     * For admin operations (accessing other users' resources),
+     * use an exchanged access token with authz.bindings.* scopes.
+     */
+    accessToken?: string;
+}
+export interface Role {
+    id: string;
+    name: string;
+    description?: string | null;
+    scopes?: string[];
+    is_system?: boolean;
+    created_at: string;
+    updated_at: string;
+}
+export interface User {
+    /** User ID (returned as 'id' from authz API) */
+    id: string;
+    /** @deprecated Use 'id' instead. Alias for backwards compatibility. */
+    user_id?: string;
+    email: string;
+    status?: string;
+    display_name?: string | null;
+    first_name?: string | null;
+    last_name?: string | null;
+    avatar_url?: string | null;
+    email_verified_at?: string | null;
+    last_login_at?: string | null;
+    pending_expires_at?: string | null;
+    roles: Role[];
+    created_at: string;
+    updated_at: string;
+}
+export interface UserListResponse {
+    users: User[];
+    pagination: {
+        page: number;
+        limit: number;
+        total_count: number;
+        total_pages: number;
+    };
+}
+export interface CreateUserParams {
+    email: string;
+    role_ids?: string[];
+    status?: 'PENDING' | 'ACTIVE' | 'DEACTIVATED';
+    assigned_by?: string;
+}
+export interface UpdateUserParams {
+    email?: string;
+    status?: 'PENDING' | 'ACTIVE' | 'DEACTIVATED';
+    display_name?: string;
+    first_name?: string;
+    last_name?: string;
+    avatar_url?: string;
+    email_verified_at?: string;
+    last_login_at?: string;
+    pending_expires_at?: string;
+}
+export interface ListUsersParams {
+    page?: number;
+    limit?: number;
+    status?: 'PENDING' | 'ACTIVE' | 'DEACTIVATED';
+    search?: string;
+}
+/**
+ * Admin options type - Zero Trust with optional access token.
+ *
+ * For protected endpoints, accessToken should be provided (obtained via token exchange).
+ * Some endpoints may be public (e.g., role lookups for session validation).
+ */
+export type AdminAuthOptions = RbacClientOptions;
+/**
+ * Get all roles from authz service
+ */
+export declare function listRoles(options?: RbacClientOptions): Promise<Role[]>;
+/**
+ * Get a specific role by ID
+ */
+export declare function getRole(roleId: string, options?: RbacClientOptions): Promise<Role | null>;
+/**
+ * Get a role by name
+ */
+export declare function getRoleByName(roleName: string, options?: RbacClientOptions): Promise<Role | null>;
+/**
+ * List users with pagination and filtering
+ */
+export declare function listUsers(params?: ListUsersParams, options?: RbacClientOptions): Promise<UserListResponse>;
+/**
+ * Get all users (convenience function that pages through all results)
+ */
+export declare function getAllUsers(options?: RbacClientOptions): Promise<User[]>;
+/**
+ * Get a specific user by ID (includes roles)
+ */
+export declare function getUser(userId: string, options?: RbacClientOptions): Promise<User | null>;
+/**
+ * Get a user by email address (includes roles)
+ * Returns null if user not found.
+ */
+export declare function getUserByEmail(email: string, options?: RbacClientOptions): Promise<User | null>;
+/**
+ * Get user's roles
+ */
+export declare function getUserRoles(userId: string, options?: RbacClientOptions): Promise<Role[]>;
+/**
+ * Get user's role names
+ */
+export declare function getUserRoleNames(userId: string, options?: RbacClientOptions): Promise<string[]>;
+/**
+ * Check if user has a specific role
+ */
+export declare function hasRole(userId: string, roleName: string, options?: RbacClientOptions): Promise<boolean>;
+/**
+ * Check if user has any of the specified roles
+ */
+export declare function hasAnyRole(userId: string, roleNames: string[], options?: RbacClientOptions): Promise<boolean>;
+/**
+ * Check if user has all of the specified roles
+ */
+export declare function hasAllRoles(userId: string, roleNames: string[], options?: RbacClientOptions): Promise<boolean>;
+/**
+ * Check if user is an admin
+ */
+export declare function isAdmin(userId: string, options?: RbacClientOptions): Promise<boolean>;
+/**
+ * Check if user is a guest
+ */
+export declare function isGuest(userId: string, options?: RbacClientOptions): Promise<boolean>;
+/**
+ * Create a new role (requires admin token)
+ *
+ * @param name - Role name
+ * @param description - Optional description
+ * @param scopes - Optional OAuth scopes for this role (e.g. ['data.read', 'search.write'])
+ * @param options - RBAC client options with adminToken
+ */
+export declare function createRole(name: string, description: string | null, options: AdminAuthOptions, scopes?: string[]): Promise<Role>;
+/**
+ * Update a role (requires admin token)
+ *
+ * @param roleId - Role UUID
+ * @param updates - Fields to update (name, description, scopes)
+ * @param options - RBAC client options with adminToken
+ */
+export declare function updateRole(roleId: string, updates: {
+    name?: string;
+    description?: string | null;
+    scopes?: string[];
+}, options: AdminAuthOptions): Promise<Role>;
+/**
+ * Delete a role (requires admin token)
+ */
+export declare function deleteRole(roleId: string, options: AdminAuthOptions): Promise<void>;
+/**
+ * Add a role to a user (requires admin token)
+ */
+export declare function addUserRole(userId: string, roleId: string, options: AdminAuthOptions): Promise<void>;
+/**
+ * Remove a role from a user (requires admin token)
+ */
+export declare function removeUserRole(userId: string, roleId: string, options: AdminAuthOptions): Promise<void>;
+/**
+ * Delete a user (requires admin token)
+ */
+export declare function deleteUser(userId: string, options: AdminAuthOptions): Promise<void>;
+/**
+ * Create a new user (requires admin token)
+ */
+export declare function createUser(params: CreateUserParams, options: AdminAuthOptions): Promise<User>;
+/**
+ * Update a user (requires admin token)
+ */
+export declare function updateUser(userId: string, updates: UpdateUserParams, options: AdminAuthOptions): Promise<User>;
+/**
+ * Activate a pending user (requires admin token)
+ */
+export declare function activateUser(userId: string, options: AdminAuthOptions): Promise<User>;
+/**
+ * Deactivate an active user (requires admin token)
+ */
+export declare function deactivateUser(userId: string, options: AdminAuthOptions): Promise<User>;
+/**
+ * Reactivate a deactivated user (requires admin token)
+ */
+export declare function reactivateUser(userId: string, options: AdminAuthOptions): Promise<User>;
+export interface EmailDomainRule {
+    id: string;
+    domain: string;
+    is_allowed: boolean;
+    created_at: string;
+    updated_at: string;
+}
+/**
+ * List email domain rules (requires admin token)
+ */
+export declare function listEmailDomains(options: AdminAuthOptions): Promise<EmailDomainRule[]>;
+/**
+ * Add or update an email domain rule (requires admin token)
+ */
+export declare function addEmailDomain(domain: string, isAllowed: boolean, options: AdminAuthOptions): Promise<EmailDomainRule>;
+/**
+ * Remove an email domain rule (requires admin token)
+ */
+export declare function removeEmailDomain(domain: string, options: AdminAuthOptions): Promise<void>;
+export type ResourceType = 'app' | 'library' | 'document';
+export interface RoleBinding {
+    id: string;
+    role_id: string;
+    resource_type: ResourceType;
+    resource_id: string;
+    permissions?: Record<string, boolean>;
+    created_at: string;
+    created_by?: string | null;
+}
+export interface RoleWithBinding {
+    id: string;
+    name: string;
+    description?: string | null;
+    scopes?: string[];
+    binding_id: string;
+    permissions?: Record<string, boolean>;
+    binding_created_at: string;
+}
+export interface CreateRoleBindingParams {
+    role_id: string;
+    resource_type: ResourceType;
+    resource_id: string;
+    permissions?: Record<string, boolean>;
+}
+export interface ListRoleBindingsParams {
+    role_id?: string;
+    resource_type?: ResourceType;
+    resource_id?: string;
+    limit?: number;
+    offset?: number;
+}
+/**
+ * Create a new role-resource binding (requires admin token)
+ */
+export declare function createRoleBinding(params: CreateRoleBindingParams, options: AdminAuthOptions): Promise<RoleBinding>;
+/**
+ * Get a role binding by ID (requires admin token)
+ */
+export declare function getRoleBinding(bindingId: string, options: AdminAuthOptions): Promise<RoleBinding | null>;
+/**
+ * Delete a role binding by ID (requires admin token)
+ */
+export declare function deleteRoleBinding(bindingId: string, options: AdminAuthOptions): Promise<void>;
+/**
+ * List role bindings with optional filters (requires admin token)
+ */
+export declare function listRoleBindings(params: ListRoleBindingsParams | undefined, options: AdminAuthOptions): Promise<RoleBinding[]>;
+/**
+ * Get all bindings for a specific role (requires admin token)
+ */
+export declare function getRoleResourceBindings(roleId: string, resourceType?: ResourceType, options?: AdminAuthOptions): Promise<RoleBinding[]>;
+/**
+ * Get all roles that have access to a specific resource (requires admin token)
+ */
+export declare function getResourceRoles(resourceType: ResourceType, resourceId: string, options: AdminAuthOptions): Promise<RoleWithBinding[]>;
+/**
+ * Check if a user can access a specific resource (requires admin token)
+ */
+export declare function userCanAccessResource(userId: string, resourceType: ResourceType, resourceId: string, options: AdminAuthOptions): Promise<boolean>;
+/**
+ * Get all resource IDs of a given type that a user can access (requires admin token)
+ */
+export declare function getUserAccessibleResources(userId: string, resourceType: ResourceType, options: AdminAuthOptions): Promise<string[]>;
+/**
+ * Helper: Grant a role access to a resource (creates binding)
+ * Convenience wrapper around createRoleBinding
+ */
+export declare function grantRoleResourceAccess(roleId: string, resourceType: ResourceType, resourceId: string, permissions?: Record<string, boolean>, options?: AdminAuthOptions): Promise<RoleBinding>;
+/**
+ * Helper: Revoke a role's access to a resource (deletes binding)
+ * Finds and deletes the binding for the given role/resource combo
+ */
+export declare function revokeRoleResourceAccess(roleId: string, resourceType: ResourceType, resourceId: string, options: AdminAuthOptions): Promise<boolean>;
+//# sourceMappingURL=rbac.d.ts.map

package/dist/lib/authz/rbac.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac.d.ts","sourceRoot":"","sources":["../../../src/lib/authz/rbac.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAMH,MAAM,WAAW,iBAAiB;IAChC,kDAAkD;IAClD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wCAAwC;IACxC,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACxF,iCAAiC;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,IAAI;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,IAAI;IACnB,gDAAgD;IAChD,EAAE,EAAE,MAAM,CAAC;IACX,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,UAAU,EAAE;QACV,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,aAAa,CAAC;IAC9C,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,aAAa,CAAC;IAC9C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,aAAa,CAAC;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,iBAAiB,CAAC;AA6DjD;;GAEG;AACH,wBAAsB,SAAS,CAAC,OAAO,GAAE,iBAAsB,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAQhF;AAED;;GAEG;AACH,wBAAsB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,iBAAsB,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAQnG;AAED;;GAEG;AACH,wBAAsB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,iBAAsB,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAQ3G;AAMD;;GAEG;AACH,wBAAsB,SAAS,CAC7B,MAAM,GAAE,eAAoB,EAC5B,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,gBAAgB,CAAC,CAiB3B;AAED;;GAEG;AACH,wBAAsB,WAAW,CAAC,OAAO,GAAE,iBAAsB,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAgBlF;AAED;;GAEG;AACH,wBAAsB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,iBAAsB,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAQnG;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,iBAAsB,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAQzG;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,iBAAsB,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAQnG;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,iBAAsB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAGzG;AAMD;;GAEG;AACH,wBAAsB,OAAO,CAC3B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,OAAO,CAAC,CAQlB;AAED;;GAEG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EAAE,EACnB,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,OAAO,CAAC,CASlB;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EAAE,EACnB,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,OAAO,CAAC,CASlB;AAED;;GAEG;AACH,wBAAsB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,iBAAsB,GAAG,OAAO,CAAC,OAAO,CAAC,CAE/F;AAED;;GAEG;AACH,wBAAsB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,iBAAsB,GAAG,OAAO,CAAC,OAAO,CAAC,CAE/F;AAMD;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAC9B,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,GAAG,IAAI,EAC1B,OAAO,EAAE,gBAAgB,EACzB,MAAM,CAAC,EAAE,MAAM,EAAE,GAChB,OAAO,CAAC,IAAI,CAAC,CAOf;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,EAC1E,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,IAAI,CAAC,CAOf;AAED;;GAEG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,IAAI,CAAC,CAKf;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,IAAI,CAAC,CAKf;AAED;;GAEG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,IAAI,CAAC,CAKf;AAED;;GAEG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,IAAI,CAAC,CAKf;AAMD;;GAEG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE,gBAAgB,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,IAAI,CAAC,CAOf;AAED;;GAEG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,gBAAgB,EACzB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,IAAI,CAAC,CAOf;AAED;;GAEG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,IAAI,CAAC,CAMf;AAED;;GAEG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,IAAI,CAAC,CAMf;AAED;;GAEG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,IAAI,CAAC,CAMf;AAMD,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,OAAO,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,eAAe,EAAE,CAAC,CAI5B;AAED;;GAEG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,OAAO,EAClB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,eAAe,CAAC,CAO1B;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,IAAI,CAAC,CAKf;AAMD,MAAM,MAAM,YAAY,GAAG,KAAK,GAAG,SAAS,GAAG,UAAU,CAAC;AAE1D,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,YAAY,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,YAAY,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,YAAY,CAAC;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,uBAAuB,EAC/B,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,WAAW,CAAC,CAOtB;AAED;;GAEG;AACH,wBAAsB,cAAc,CAClC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAQ7B;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,IAAI,CAAC,CAKf;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,sBAAsB,YAAK,EACnC,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,WAAW,EAAE,CAAC,CAaxB;AAED;;GAEG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,WAAW,EAAE,CAAC,CAexB;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,YAAY,EAAE,YAAY,EAC1B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,eAAe,EAAE,CAAC,CAM5B;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,YAAY,EAC1B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,OAAO,CAAC,CAOlB;AAED;;GAEG;AACH,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,YAAY,EAC1B,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,EAAE,CAAC,CAOnB;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,YAAY,EAC1B,UAAU,EAAE,MAAM,EAClB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACrC,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,WAAW,CAAC,CAQtB;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,YAAY,EAC1B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,OAAO,CAAC,CAalB"}