@marinoscar/platform-api 0.1.0-next.3 → 0.1.0-next.5

package/dist/sharing/groups/group-invites.service.js

@@ -0,0 +1,463 @@
+"use strict";
+// =============================================================================
+// GroupInvitesService: invitations to a group (issue #728, PP-7.1)
+// =============================================================================
+//
+// An invite names an e-mail address (stored lower-cased) and the role the
+// invitee gets. Its state is derived from its timestamps WHEN IT IS READ:
+//
+//   accepted_at set  -> accepted      declined_at set -> declined
+//   revoked_at set   -> revoked       expires_at past -> expired
+//   otherwise        -> pending
+//
+// so no cron sweeps expired invites. `group_invites_pending_uniq_idx` (raw SQL)
+// allows ONE pending row per (group, address): a second invite is 409
+// `INVITE_PENDING`, while a declined or revoked address can be invited again.
+// An expired pending row would still hold the index, so creating an invite
+// first closes the address's expired rows (marks them revoked).
+//
+// The invitee answers from `GET /api/groups/invites/mine` (every organization
+// they belong to) with accept or decline. The address must be the caller's:
+// anyone else's invite is 404. An expired invite is 410 `INVITE_EXPIRED`.
+//
+// The `groups.invitation` notification is dispatched AFTER the invite's
+// transaction commits, outside it: to the account when the address has one,
+// else to the address (`notifyAddress`).
+// =============================================================================
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GroupInvitesService = exports.GROUP_INVITES_CLOCK = void 0;
+exports.inviteStatus = inviteStatus;
+exports.toGroupInviteDto = toGroupInviteDto;
+const common_1 = require("@nestjs/common");
+const index_1 = require("../../otel-core/index");
+const sharing_tx_1 = require("../data/sharing-tx");
+const errors_1 = require("../errors");
+const events_1 = require("../events");
+const ports_1 = require("../ports");
+const sharing_options_1 = require("../sharing.options");
+const group_common_1 = require("./group-common");
+const group_membership_service_1 = require("./group-membership.service");
+const sharing_effects_1 = require("./sharing-effects");
+const DAY_MS = 24 * 60 * 60 * 1000;
+/**
+ * Optional injection token of the invites' clock (ms since epoch); tests inject one.
+ *
+ * @stability experimental
+ */
+exports.GROUP_INVITES_CLOCK = Symbol.for('@marinoscar/platform/sharing/GROUP_INVITES_CLOCK');
+/**
+ * The status of an invite row at `now`, derived from its timestamps.
+ *
+ * @param row - the invite's timestamps.
+ * @param now - the instant to judge expiry at.
+ * @returns the status.
+ *
+ * @stability experimental
+ */
+function inviteStatus(row, now) {
+    if (row.acceptedAt)
+        return 'accepted';
+    if (row.declinedAt)
+        return 'declined';
+    if (row.revokedAt)
+        return 'revoked';
+    if (row.expiresAt && row.expiresAt.getTime() <= now.getTime())
+        return 'expired';
+    return 'pending';
+}
+/** The `where` of a row that is still open (neither accepted, declined nor revoked). */
+const OPEN = { acceptedAt: null, declinedAt: null, revokedAt: null };
+/**
+ * One invite row as a group admin sees it.
+ *
+ * @param row - the `group_invites` row.
+ * @param now - the instant its status is judged at.
+ * @returns the wire shape.
+ *
+ * @stability experimental
+ */
+function toGroupInviteDto(row, now) {
+    return {
+        id: row.id,
+        groupId: row.groupId,
+        orgId: row.orgId,
+        email: row.email,
+        role: row.role,
+        status: inviteStatus(row, now),
+        invitedById: row.invitedById,
+        expiresAt: (0, group_common_1.iso)(row.expiresAt),
+        acceptedAt: (0, group_common_1.iso)(row.acceptedAt),
+        declinedAt: (0, group_common_1.iso)(row.declinedAt),
+        revokedAt: (0, group_common_1.iso)(row.revokedAt),
+        createdAt: (0, group_common_1.iso)(row.createdAt),
+    };
+}
+/** The organizations a principal belongs to and may act in, active one first. */
+function orgsOf(principal) {
+    const listed = (principal.memberships ?? []).filter((m) => m.status !== 'suspended').map((m) => m.orgId);
+    const all = principal.activeOrgId ? [principal.activeOrgId, ...listed] : listed;
+    return [...new Set(all)];
+}
+/**
+ * Invitations to groups: the admin routes and the invitee's answers.
+ *
+ * @stability experimental
+ */
+let GroupInvitesService = class GroupInvitesService {
+    data;
+    options;
+    membership;
+    effects;
+    tenancy;
+    clock;
+    constructor(data, options, membership, effects, tenancy, clock = Date.now) {
+        this.data = data;
+        this.options = options;
+        this.membership = membership;
+        this.effects = effects;
+        this.tenancy = tenancy;
+        this.clock = clock;
+    }
+    now() {
+        return new Date(this.clock());
+    }
+    /**
+     * `GET /api/groups/:id/invites`.
+     *
+     * @param principal - the caller (group `admin`, or `groups:admin`).
+     * @param groupId - the group.
+     * @param query - page, and `pending` (default) or `all`.
+     * @returns a page of invites, newest first.
+     */
+    async list(principal, groupId, query) {
+        const orgId = (0, group_common_1.requireActiveOrg)(principal);
+        const now = this.now();
+        return this.data.runInOrg({ orgId, userId: principal.userId }, async (raw) => {
+            const tx = (0, sharing_tx_1.asSharingTx)(raw);
+            await this.membership.access(tx, principal, orgId, groupId, 'admin');
+            const where = query.status === 'all'
+                ? { groupId }
+                : { groupId, ...OPEN, OR: [{ expiresAt: null }, { expiresAt: { gt: now } }] };
+            const total = await tx.groupInvite.count({ where });
+            const rows = await tx.groupInvite.findMany({
+                where,
+                orderBy: [{ createdAt: 'desc' }, { id: 'asc' }],
+                skip: (query.page - 1) * query.pageSize,
+                take: query.pageSize,
+            });
+            return (0, group_common_1.paged)(rows.map((row) => toGroupInviteDto(row, now)), total, query.page, query.pageSize);
+        });
+    }
+    /** Whether an address may be invited into `orgId` (multi mode: a member, or invited to the org). */
+    async addressInOrg(tx, orgId, email, now) {
+        const user = await tx.user.findFirst({ where: { email: { equals: email, mode: 'insensitive' } }, select: { id: true, isActive: true } });
+        const member = user
+            ? await tx.membership.findFirst({ where: { orgId, userId: user.id, status: 'active' }, select: { userId: true } })
+            : null;
+        if (member)
+            return { userId: user.id, allowed: true };
+        if ((this.tenancy?.mode() ?? 'single') === 'single')
+            return { userId: user?.id ?? null, allowed: true };
+        const orgInvite = await tx.invite.findFirst({
+            where: { orgId, email, status: 'pending', OR: [{ expiresAt: null }, { expiresAt: { gt: now } }] },
+            select: { orgId: true },
+        });
+        return { userId: user?.id ?? null, allowed: orgInvite !== null };
+    }
+    /**
+     * `POST /api/groups/:id/invites`.
+     *
+     * @param principal - the caller (group `admin`, or `groups:admin`).
+     * @param groupId - the group.
+     * @param input - the address and role.
+     * @returns the invite.
+     * @throws UnprocessableEntityException 422 `NOT_AN_ORG_MEMBER` (multi mode).
+     * @throws UnprocessableEntityException 422 `GROUP_ROLE_UNKNOWN`.
+     * @throws ConflictException 409 `INVITE_PENDING` or `ALREADY_A_MEMBER`.
+     */
+    async create(principal, groupId, input) {
+        const orgId = (0, group_common_1.requireActiveOrg)(principal);
+        (0, group_common_1.requireGroupRole)(input.role);
+        const now = this.now();
+        const ttl = this.options.groups.inviteTtlDays;
+        const result = await this.data.runInOrg({ orgId, userId: principal.userId }, async (raw) => {
+            const tx = (0, sharing_tx_1.asSharingTx)(raw);
+            const { group } = await this.membership.access(tx, principal, orgId, groupId, 'admin');
+            const recipient = await this.addressInOrg(tx, orgId, input.email, now);
+            if (!recipient.allowed)
+                throw (0, errors_1.notAnOrgMember)();
+            if (recipient.userId) {
+                const already = await tx.groupMember.findUnique({ where: { groupId_userId: { groupId, userId: recipient.userId } } });
+                if (already)
+                    throw (0, errors_1.conflict)(errors_1.SHARING_ERROR_REASONS.ALREADY_A_MEMBER, 'That person is already a member of the group');
+            }
+            // An expired pending row still holds group_invites_pending_uniq_idx: close it.
+            await tx.groupInvite.updateMany({
+                where: { groupId, email: input.email, ...OPEN, expiresAt: { lte: now } },
+                data: { revokedAt: now },
+            });
+            let invite;
+            try {
+                invite = await tx.groupInvite.create({
+                    data: {
+                        groupId,
+                        orgId,
+                        email: input.email,
+                        role: input.role,
+                        invitedById: principal.userId,
+                        expiresAt: ttl === null ? null : new Date(now.getTime() + ttl * DAY_MS),
+                    },
+                });
+            }
+            catch (error) {
+                if ((0, group_common_1.isUniqueViolation)(error)) {
+                    throw (0, errors_1.conflict)(errors_1.SHARING_ERROR_REASONS.INVITE_PENDING, 'That address already has a pending invitation to this group');
+                }
+                throw error;
+            }
+            await (0, group_common_1.writeAudit)(tx, {
+                orgId,
+                actorUserId: principal.userId,
+                action: 'group:invite_created',
+                groupId,
+                meta: { inviteId: invite.id, role: invite.role, existingAccount: recipient.userId !== null },
+            });
+            return { invite, groupName: group.name, recipientUserId: recipient.userId };
+        });
+        // After the commit, outside the transaction (CLAUDE.md invariant).
+        this.effects.committed({
+            op: 'invite_create',
+            event: {
+                name: events_1.SHARING_EVENTS.INVITE_CREATED,
+                payload: { orgId, groupId, actorUserId: principal.userId, inviteId: result.invite.id, role: result.invite.role },
+            },
+        });
+        this.effects.notifyInvitation({ userId: result.recipientUserId, email: result.invite.email }, {
+            recipientEmail: result.invite.email,
+            groupName: result.groupName,
+            role: result.invite.role,
+            ...(principal.email ? { invitedBy: principal.email } : {}),
+            ...(result.invite.expiresAt ? { expiresAt: result.invite.expiresAt.toISOString() } : {}),
+        }, result.invite.id);
+        return toGroupInviteDto(result.invite, now);
+    }
+    /**
+     * `DELETE /api/groups/:id/invites/:inviteId`: revokes a pending invite.
+     *
+     * @param principal - the caller (group `admin`, or `groups:admin`).
+     * @param groupId - the group.
+     * @param inviteId - the invite.
+     * @throws NotFoundException 404 when the group has no such invite.
+     * @throws ConflictException 409 `INVITE_NOT_PENDING` when it was already answered or revoked.
+     */
+    async revoke(principal, groupId, inviteId) {
+        const orgId = (0, group_common_1.requireActiveOrg)(principal);
+        const now = this.now();
+        await this.data.runInOrg({ orgId, userId: principal.userId }, async (raw) => {
+            const tx = (0, sharing_tx_1.asSharingTx)(raw);
+            await this.membership.access(tx, principal, orgId, groupId, 'admin');
+            const invite = await tx.groupInvite.findFirst({ where: { id: inviteId, groupId } });
+            if (!invite)
+                throw (0, errors_1.inviteNotFound)();
+            const status = inviteStatus(invite, now);
+            if (status !== 'pending' && status !== 'expired') {
+                throw (0, errors_1.conflict)(errors_1.SHARING_ERROR_REASONS.INVITE_NOT_PENDING, `The invitation is already ${status}`);
+            }
+            await tx.groupInvite.update({ where: { id: inviteId }, data: { revokedAt: now } });
+            await (0, group_common_1.writeAudit)(tx, { orgId, actorUserId: principal.userId, action: 'group:invite_revoked', groupId, meta: { inviteId } });
+        });
+        this.effects.committed({ op: 'invite_revoke' });
+    }
+    /**
+     * `GET /api/groups/invites/mine`: pending, unexpired invites to the
+     * caller's (verified) address, in every organization the caller belongs to.
+     *
+     * @param principal - the caller.
+     * @returns newest first.
+     */
+    async mine(principal) {
+        const email = principal.email.toLowerCase();
+        const now = this.now();
+        const items = [];
+        for (const orgId of orgsOf(principal)) {
+            const rows = await this.data.runInOrg({ orgId, userId: principal.userId }, (raw) => (0, sharing_tx_1.asSharingTx)(raw).groupInvite.findMany({
+                where: { orgId, email, ...OPEN, OR: [{ expiresAt: null }, { expiresAt: { gt: now } }] },
+                include: { group: { select: { name: true } } },
+                orderBy: { createdAt: 'desc' },
+                take: 100,
+            }));
+            for (const row of rows) {
+                items.push({
+                    id: row.id,
+                    groupId: row.groupId,
+                    groupName: row.group.name,
+                    orgId: row.orgId,
+                    role: row.role,
+                    invitedById: row.invitedById,
+                    expiresAt: (0, group_common_1.iso)(row.expiresAt),
+                    createdAt: (0, group_common_1.iso)(row.createdAt),
+                });
+            }
+        }
+        items.sort((a, b) => b.createdAt.localeCompare(a.createdAt));
+        return { items };
+    }
+    /** Finds the caller's invite in one of its organizations, or throws 404 / 410. */
+    async answerable(principal, inviteId, now) {
+        const email = principal.email.toLowerCase();
+        for (const orgId of orgsOf(principal)) {
+            const invite = await this.data.runInOrg({ orgId, userId: principal.userId }, (raw) => (0, sharing_tx_1.asSharingTx)(raw).groupInvite.findFirst({ where: { id: inviteId, orgId } }));
+            if (!invite)
+                continue;
+            // Someone else's invite is indistinguishable from no invite.
+            if (invite.email !== email)
+                throw (0, errors_1.inviteNotFound)();
+            const status = inviteStatus(invite, now);
+            if (status === 'expired')
+                throw (0, errors_1.inviteExpired)();
+            if (status !== 'pending')
+                throw (0, errors_1.inviteNotFound)();
+            return { orgId, invite };
+        }
+        throw (0, errors_1.inviteNotFound)();
+    }
+    /**
+     * `POST /api/groups/invites/:inviteId/accept`: joins the group with the
+     * invite's role. Accepting when already a member keeps the current role.
+     *
+     * @param principal - the caller, whose address the invite names.
+     * @param inviteId - the invite.
+     * @returns the membership.
+     * @throws NotFoundException 404 for another address's invite, an unknown or an answered one.
+     * @throws GoneException 410 `INVITE_EXPIRED`.
+     * @throws ConflictException 409 `GROUP_FULL`.
+     */
+    async accept(principal, inviteId) {
+        const now = this.now();
+        const { orgId, invite } = await this.answerable(principal, inviteId, now);
+        const groupId = invite.groupId;
+        const result = await this.data.runInOrg({ orgId, userId: principal.userId }, async (raw) => {
+            const tx = (0, sharing_tx_1.asSharingTx)(raw);
+            await (0, group_common_1.lockGroup)(tx, groupId);
+            // Re-check under the lock: a concurrent revoke or second accept loses.
+            const fresh = await tx.groupInvite.findFirst({ where: { id: inviteId, orgId, ...OPEN } });
+            if (!fresh)
+                throw (0, errors_1.inviteNotFound)();
+            if (inviteStatus(fresh, now) === 'expired')
+                throw (0, errors_1.inviteExpired)();
+            const existing = await tx.groupMember.findUnique({ where: { groupId_userId: { groupId, userId: principal.userId } } });
+            let role = existing?.role ?? fresh.role;
+            if (!existing) {
+                if ((await tx.groupMember.count({ where: { groupId } })) >= this.options.groups.maxMembersPerGroup) {
+                    throw (0, errors_1.conflict)(errors_1.SHARING_ERROR_REASONS.GROUP_FULL, 'The group has reached its member limit');
+                }
+                const created = await tx.groupMember.create({
+                    data: { groupId, orgId, userId: principal.userId, role: fresh.role, addedById: fresh.invitedById },
+                });
+                role = created.role;
+            }
+            await tx.groupInvite.update({ where: { id: inviteId }, data: { acceptedAt: now, acceptedById: principal.userId } });
+            await (0, group_common_1.writeAudit)(tx, {
+                orgId,
+                actorUserId: principal.userId,
+                action: 'group:invite_accepted',
+                groupId,
+                meta: { inviteId, role, alreadyMember: existing !== null },
+            });
+            return { role, joined: !existing };
+        });
+        const base = { orgId, groupId, actorUserId: principal.userId };
+        this.effects.committed({
+            op: 'invite_accept',
+            invalidate: [principal.userId],
+            events: [
+                { name: events_1.SHARING_EVENTS.INVITE_ACCEPTED, payload: { ...base, inviteId, role: result.role } },
+                ...(result.joined
+                    ? [{ name: events_1.SHARING_EVENTS.MEMBER_ADDED, payload: { ...base, userId: principal.userId, role: result.role, previousRole: null } }]
+                    : []),
+            ],
+        });
+        return { groupId, orgId, role: result.role };
+    }
+    /**
+     * `POST /api/groups/invites/:inviteId/decline`.
+     *
+     * @param principal - the caller, whose address the invite names.
+     * @param inviteId - the invite.
+     * @throws NotFoundException 404 for another address's invite, an unknown or an answered one.
+     * @throws GoneException 410 `INVITE_EXPIRED`.
+     */
+    async decline(principal, inviteId) {
+        const now = this.now();
+        const { orgId, invite } = await this.answerable(principal, inviteId, now);
+        await this.data.runInOrg({ orgId, userId: principal.userId }, async (raw) => {
+            const tx = (0, sharing_tx_1.asSharingTx)(raw);
+            const { count } = await tx.groupInvite.updateMany({ where: { id: inviteId, orgId, ...OPEN }, data: { declinedAt: now } });
+            if (count === 0)
+                throw (0, errors_1.inviteNotFound)();
+            await (0, group_common_1.writeAudit)(tx, { orgId, actorUserId: principal.userId, action: 'group:invite_declined', groupId: invite.groupId, meta: { inviteId } });
+        });
+        this.effects.committed({ op: 'invite_decline' });
+    }
+};
+exports.GroupInvitesService = GroupInvitesService;
+__decorate([
+    (0, index_1.Trace)('sharing.group.invites.list'),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String, Object]),
+    __metadata("design:returntype", Promise)
+], GroupInvitesService.prototype, "list", null);
+__decorate([
+    (0, index_1.Trace)('sharing.group.invites.create'),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String, Object]),
+    __metadata("design:returntype", Promise)
+], GroupInvitesService.prototype, "create", null);
+__decorate([
+    (0, index_1.Trace)('sharing.group.invites.revoke'),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String, String]),
+    __metadata("design:returntype", Promise)
+], GroupInvitesService.prototype, "revoke", null);
+__decorate([
+    (0, index_1.Trace)('sharing.group.invites.mine'),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], GroupInvitesService.prototype, "mine", null);
+__decorate([
+    (0, index_1.Trace)('sharing.group.invites.accept'),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String]),
+    __metadata("design:returntype", Promise)
+], GroupInvitesService.prototype, "accept", null);
+__decorate([
+    (0, index_1.Trace)('sharing.group.invites.decline'),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String]),
+    __metadata("design:returntype", Promise)
+], GroupInvitesService.prototype, "decline", null);
+exports.GroupInvitesService = GroupInvitesService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(ports_1.SHARING_DATA)),
+    __param(1, (0, common_1.Inject)(sharing_options_1.SHARING_OPTIONS)),
+    __param(4, (0, common_1.Optional)()),
+    __param(4, (0, common_1.Inject)(ports_1.SHARING_TENANCY)),
+    __param(5, (0, common_1.Optional)()),
+    __param(5, (0, common_1.Inject)(exports.GROUP_INVITES_CLOCK)),
+    __metadata("design:paramtypes", [Object, Object, group_membership_service_1.GroupMembershipService,
+        sharing_effects_1.SharingEffects, Object, Function])
+], GroupInvitesService);
+//# sourceMappingURL=group-invites.service.js.map

package/dist/sharing/groups/group-invites.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"group-invites.service.js","sourceRoot":"","sources":["../../../src/sharing/groups/group-invites.service.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,mEAAmE;AACnE,gFAAgF;AAChF,EAAE;AACF,0EAA0E;AAC1E,0EAA0E;AAC1E,EAAE;AACF,kEAAkE;AAClE,iEAAiE;AACjE,gCAAgC;AAChC,EAAE;AACF,gFAAgF;AAChF,sEAAsE;AACtE,8EAA8E;AAC9E,2EAA2E;AAC3E,gEAAgE;AAChE,EAAE;AACF,8EAA8E;AAC9E,4EAA4E;AAC5E,0EAA0E;AAC1E,EAAE;AACF,wEAAwE;AACxE,4EAA4E;AAC5E,yCAAyC;AACzC,gFAAgF;;;;;;;;;;;;;;;AA2ChF,oCASC;AAcD,4CAeC;AA/ED,2CAA8D;AAa9D,iDAA8C;AAC9C,mDAAsF;AACtF,sCAA2G;AAC3G,sCAA2C;AAC3C,oCAAoG;AACpG,wDAAwF;AACxF,iDAA0H;AAC1H,yEAAoE;AACpE,uDAAmD;AAEnD,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnC;;;;GAIG;AACU,QAAA,mBAAmB,GAAkB,MAAM,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;AAEjH;;;;;;;;GAQG;AACH,SAAgB,YAAY,CAC1B,GAAyG,EACzG,GAAS;IAET,IAAI,GAAG,CAAC,UAAU;QAAE,OAAO,UAAU,CAAC;IACtC,IAAI,GAAG,CAAC,UAAU;QAAE,OAAO,UAAU,CAAC;IACtC,IAAI,GAAG,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACpC,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE;QAAE,OAAO,SAAS,CAAC;IAChF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,wFAAwF;AACxF,MAAM,IAAI,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAW,CAAC;AAE9E;;;;;;;;GAQG;AACH,SAAgB,gBAAgB,CAAC,GAAmB,EAAE,GAAS;IAC7D,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,MAAM,EAAE,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC;QAC9B,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,SAAS,EAAE,IAAA,kBAAG,EAAC,GAAG,CAAC,SAAS,CAAC;QAC7B,UAAU,EAAE,IAAA,kBAAG,EAAC,GAAG,CAAC,UAAU,CAAC;QAC/B,UAAU,EAAE,IAAA,kBAAG,EAAC,GAAG,CAAC,UAAU,CAAC;QAC/B,SAAS,EAAE,IAAA,kBAAG,EAAC,GAAG,CAAC,SAAS,CAAC;QAC7B,SAAS,EAAE,IAAA,kBAAG,EAAC,GAAG,CAAC,SAAS,CAAE;KAC/B,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,SAAS,MAAM,CAAC,SAAoB;IAClC,MAAM,MAAM,GAAG,CAAC,SAAS,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACzG,MAAM,GAAG,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAChF,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED;;;;GAIG;AAEI,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAEW;IACG;IACzB;IACA;IACqC;IACI;IAN5D,YACyC,IAAqB,EAClB,OAAqC,EAC9D,UAAkC,EAClC,OAAuB,EACc,OAAwB,EACpB,QAAsB,IAAI,CAAC,GAAG;QALjD,SAAI,GAAJ,IAAI,CAAiB;QAClB,YAAO,GAAP,OAAO,CAA8B;QAC9D,eAAU,GAAV,UAAU,CAAwB;QAClC,YAAO,GAAP,OAAO,CAAgB;QACc,YAAO,GAAP,OAAO,CAAiB;QACpB,UAAK,GAAL,KAAK,CAAyB;IACvF,CAAC;IAEI,GAAG;QACT,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IAChC,CAAC;IAED;;;;;;;OAOG;IAEG,AAAN,KAAK,CAAC,IAAI,CAAC,SAAoB,EAAE,OAAe,EAAE,KAA2B;QAC3E,MAAM,KAAK,GAAG,IAAA,+BAAgB,EAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC3E,MAAM,EAAE,GAAG,IAAA,wBAAW,EAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YACrE,MAAM,KAAK,GACT,KAAK,CAAC,MAAM,KAAK,KAAK;gBACpB,CAAC,CAAC,EAAE,OAAO,EAAE;gBACb,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC;YAClF,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YACpD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC;gBACzC,KAAK;gBACL,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;gBAC/C,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,QAAQ;gBACvC,IAAI,EAAE,KAAK,CAAC,QAAQ;aACrB,CAAC,CAAC;YACH,OAAO,IAAA,oBAAK,EAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QACjG,CAAC,CAAC,CAAC;IACL,CAAC;IAED,oGAAoG;IAC5F,KAAK,CAAC,YAAY,CAAC,EAAa,EAAE,KAAa,EAAE,KAAa,EAAE,GAAS;QAC/E,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QACzI,MAAM,MAAM,GAAG,IAAI;YACjB,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;YAClH,CAAC,CAAC,IAAI,CAAC;QACT,IAAI,MAAM;YAAE,OAAO,EAAE,MAAM,EAAE,IAAK,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACvD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC,KAAK,QAAQ;YAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACxG,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC;YAC1C,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,EAAE;YACjG,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;SACxB,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,IAAI,EAAE,OAAO,EAAE,SAAS,KAAK,IAAI,EAAE,CAAC;IACnE,CAAC;IAED;;;;;;;;;;OAUG;IAEG,AAAN,KAAK,CAAC,MAAM,CAAC,SAAoB,EAAE,OAAe,EAAE,KAA6B;QAC/E,MAAM,KAAK,GAAG,IAAA,+BAAgB,EAAC,SAAS,CAAC,CAAC;QAC1C,IAAA,+BAAgB,EAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC;QAE9C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACzF,MAAM,EAAE,GAAG,IAAA,wBAAW,EAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YACvF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACvE,IAAI,CAAC,SAAS,CAAC,OAAO;gBAAE,MAAM,IAAA,uBAAc,GAAE,CAAC;YAC/C,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;gBACrB,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;gBACtH,IAAI,OAAO;oBAAE,MAAM,IAAA,iBAAQ,EAAC,8BAAqB,CAAC,gBAAgB,EAAE,8CAA8C,CAAC,CAAC;YACtH,CAAC;YAED,+EAA+E;YAC/E,MAAM,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC;gBAC9B,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;gBACxE,IAAI,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE;aACzB,CAAC,CAAC;YACH,IAAI,MAAsB,CAAC;YAC3B,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC;oBACnC,IAAI,EAAE;wBACJ,OAAO;wBACP,KAAK;wBACL,KAAK,EAAE,KAAK,CAAC,KAAK;wBAClB,IAAI,EAAE,KAAK,CAAC,IAAI;wBAChB,WAAW,EAAE,SAAS,CAAC,MAAM;wBAC7B,SAAS,EAAE,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,GAAG,GAAG,MAAM,CAAC;qBACxE;iBACF,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,IAAA,gCAAiB,EAAC,KAAK,CAAC,EAAE,CAAC;oBAC7B,MAAM,IAAA,iBAAQ,EAAC,8BAAqB,CAAC,cAAc,EAAE,6DAA6D,CAAC,CAAC;gBACtH,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,IAAA,yBAAU,EAAC,EAAE,EAAE;gBACnB,KAAK;gBACL,WAAW,EAAE,SAAS,CAAC,MAAM;gBAC7B,MAAM,EAAE,sBAAsB;gBAC9B,OAAO;gBACP,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,eAAe,EAAE,SAAS,CAAC,MAAM,KAAK,IAAI,EAAE;aAC7F,CAAC,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,EAAE,eAAe,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;QAC9E,CAAC,CAAC,CAAC;QAEH,mEAAmE;QACnE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;YACrB,EAAE,EAAE,eAAe;YACnB,KAAK,EAAE;gBACL,IAAI,EAAE,uBAAc,CAAC,cAAc;gBACnC,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;aACjH;SACF,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAC3B,EAAE,MAAM,EAAE,MAAM,CAAC,eAAe,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,EAC9D;YACE,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK;YACnC,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI;YACxB,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzF,EACD,MAAM,CAAC,MAAM,CAAC,EAAE,CACjB,CAAC;QACF,OAAO,gBAAgB,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;;;;OAQG;IAEG,AAAN,KAAK,CAAC,MAAM,CAAC,SAAoB,EAAE,OAAe,EAAE,QAAgB;QAClE,MAAM,KAAK,GAAG,IAAA,+BAAgB,EAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC1E,MAAM,EAAE,GAAG,IAAA,wBAAW,EAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YACrE,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;YACpF,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAA,uBAAc,GAAE,CAAC;YACpC,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YACzC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACjD,MAAM,IAAA,iBAAQ,EAAC,8BAAqB,CAAC,kBAAkB,EAAE,6BAA6B,MAAM,EAAE,CAAC,CAAC;YAClG,CAAC;YACD,MAAM,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YACnF,MAAM,IAAA,yBAAU,EAAC,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC9H,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC;IAClD,CAAC;IAED;;;;;;OAMG;IAEG,AAAN,KAAK,CAAC,IAAI,CAAC,SAAoB;QAC7B,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,KAAK,GAAuB,EAAE,CAAC;QACrC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CACjF,IAAA,wBAAW,EAAC,GAAG,CAAC,CAAC,WAAW,CAAC,QAAQ,CAA+C;gBAClF,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,EAAE;gBACvF,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE;gBAC9C,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE;gBAC9B,IAAI,EAAE,GAAG;aACV,CAAC,CACH,CAAC;YACF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,KAAK,CAAC,IAAI,CAAC;oBACT,EAAE,EAAE,GAAG,CAAC,EAAE;oBACV,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI;oBACzB,KAAK,EAAE,GAAG,CAAC,KAAK;oBAChB,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,WAAW,EAAE,GAAG,CAAC,WAAW;oBAC5B,SAAS,EAAE,IAAA,kBAAG,EAAC,GAAG,CAAC,SAAS,CAAC;oBAC7B,SAAS,EAAE,IAAA,kBAAG,EAAC,GAAG,CAAC,SAAS,CAAE;iBAC/B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QAC7D,OAAO,EAAE,KAAK,EAAE,CAAC;IACnB,CAAC;IAED,kFAAkF;IAC1E,KAAK,CAAC,UAAU,CAAC,SAAoB,EAAE,QAAgB,EAAE,GAAS;QACxE,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QAC5C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CACnF,IAAA,wBAAW,EAAC,GAAG,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,CAC3E,CAAC;YACF,IAAI,CAAC,MAAM;gBAAE,SAAS;YACtB,6DAA6D;YAC7D,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK;gBAAE,MAAM,IAAA,uBAAc,GAAE,CAAC;YACnD,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YACzC,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAM,IAAA,sBAAa,GAAE,CAAC;YAChD,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAM,IAAA,uBAAc,GAAE,CAAC;YACjD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAC3B,CAAC;QACD,MAAM,IAAA,uBAAc,GAAE,CAAC;IACzB,CAAC;IAED;;;;;;;;;;OAUG;IAEG,AAAN,KAAK,CAAC,MAAM,CAAC,SAAoB,EAAE,QAAgB;QACjD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC1E,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAE/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACzF,MAAM,EAAE,GAAG,IAAA,wBAAW,EAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,IAAA,wBAAS,EAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YAC7B,uEAAuE;YACvE,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,CAAC;YAC1F,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAA,uBAAc,GAAE,CAAC;YACnC,IAAI,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,SAAS;gBAAE,MAAM,IAAA,sBAAa,GAAE,CAAC;YAElE,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;YACvH,IAAI,IAAI,GAAG,QAAQ,EAAE,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC;YACxC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,IAAI,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;oBACnG,MAAM,IAAA,iBAAQ,EAAC,8BAAqB,CAAC,UAAU,EAAE,wCAAwC,CAAC,CAAC;gBAC7F,CAAC;gBACD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC;oBAC1C,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,WAAW,EAAE;iBACnG,CAAC,CAAC;gBACH,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;YACtB,CAAC;YACD,MAAM,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,YAAY,EAAE,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACpH,MAAM,IAAA,yBAAU,EAAC,EAAE,EAAE;gBACnB,KAAK;gBACL,WAAW,EAAE,SAAS,CAAC,MAAM;gBAC7B,MAAM,EAAE,uBAAuB;gBAC/B,OAAO;gBACP,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,KAAK,IAAI,EAAE;aAC3D,CAAC,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC;QACrC,CAAC,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;QAC/D,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;YACrB,EAAE,EAAE,eAAe;YACnB,UAAU,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC;YAC9B,MAAM,EAAE;gBACN,EAAE,IAAI,EAAE,uBAAc,CAAC,eAAe,EAAE,OAAO,EAAE,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE;gBAC3F,GAAG,CAAC,MAAM,CAAC,MAAM;oBACf,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,uBAAc,CAAC,YAAY,EAAE,OAAO,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,CAAC;oBAChI,CAAC,CAAC,EAAE,CAAC;aACR;SACF,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAC/C,CAAC;IAED;;;;;;;OAOG;IAEG,AAAN,KAAK,CAAC,OAAO,CAAC,SAAoB,EAAE,QAAgB;QAClD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC1E,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC1E,MAAM,EAAE,GAAG,IAAA,wBAAW,EAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YAC1H,IAAI,KAAK,KAAK,CAAC;gBAAE,MAAM,IAAA,uBAAc,GAAE,CAAC;YACxC,MAAM,IAAA,yBAAU,EAAC,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,uBAAuB,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC/I,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACnD,CAAC;CACF,CAAA;AAnTY,kDAAmB;AAuBxB;IADL,IAAA,aAAK,EAAC,4BAA4B,CAAC;;;;+CAoBnC;AA6BK;IADL,IAAA,aAAK,EAAC,8BAA8B,CAAC;;;;iDAsErC;AAYK;IADL,IAAA,aAAK,EAAC,8BAA8B,CAAC;;;;iDAiBrC;AAUK;IADL,IAAA,aAAK,EAAC,4BAA4B,CAAC;;;;+CA6BnC;AAgCK;IADL,IAAA,aAAK,EAAC,8BAA8B,CAAC;;;;iDAgDrC;AAWK;IADL,IAAA,aAAK,EAAC,+BAA+B,CAAC;;;;kDAWtC;8BAlTU,mBAAmB;IAD/B,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,oBAAY,CAAC,CAAA;IACpB,WAAA,IAAA,eAAM,EAAC,iCAAe,CAAC,CAAA;IAGvB,WAAA,IAAA,iBAAQ,GAAE,CAAA;IAAE,WAAA,IAAA,eAAM,EAAC,uBAAe,CAAC,CAAA;IACnC,WAAA,IAAA,iBAAQ,GAAE,CAAA;IAAE,WAAA,IAAA,eAAM,EAAC,2BAAmB,CAAC,CAAA;qDAHX,iDAAsB;QACzB,gCAAc;GAL/B,mBAAmB,CAmT/B"}

package/dist/sharing/groups/group-membership.service.d.ts

@@ -0,0 +1,108 @@
+import type { AddGroupMemberInput, GroupMemberDto, GroupMemberList, GroupRole, PageQuery } from '@marinoscar/platform-contract/sharing';
+import type { Principal } from '../../core/index';
+import { type GroupMemberRow, type GroupRow, type UserRow } from '../data/sharing-tx';
+import { type SharingDataPort } from '../ports';
+import { type ResolvedSharingModuleOptions } from '../sharing.options';
+import { MemberLookupThrottle } from './member-lookup-throttle';
+import { SharingEffects } from './sharing-effects';
+/**
+ * What `GroupMembershipService.access` found.
+ *
+ * @stability experimental
+ */
+export interface GroupAccess {
+    /** The group row. */
+    group: GroupRow;
+    /** The caller's role in it, or `null` (a `groups:admin` holder who is not a member). */
+    myRole: GroupRole | null;
+}
+/** A member row with the user columns the response shows. */
+type MemberWithUser = GroupMemberRow & {
+    user: Pick<UserRow, 'email' | 'displayName' | 'providerDisplayName'>;
+};
+/**
+ * One member row (with its user columns) as the API returns it.
+ *
+ * @param row - the `group_members` row with `user`.
+ * @returns the wire shape.
+ *
+ * @stability experimental
+ */
+export declare function toGroupMemberDto(row: MemberWithUser): GroupMemberDto;
+/**
+ * Group access decisions, the last-admin rule and the member routes.
+ *
+ * @stability experimental
+ */
+export declare class GroupMembershipService {
+    private readonly data;
+    private readonly options;
+    private readonly throttle;
+    private readonly effects;
+    constructor(data: SharingDataPort, options: ResolvedSharingModuleOptions, throttle: MemberLookupThrottle, effects: SharingEffects);
+    /**
+     * Loads a group of the caller's active organization and checks the caller
+     * may act on it. Runs inside the caller's org-scoped transaction.
+     *
+     * @param client - the org-scoped transaction client.
+     * @param principal - the caller.
+     * @param orgId - the caller's active organization.
+     * @param groupId - the group.
+     * @param need - `member` (read) or `admin` (manage).
+     * @returns the group and the caller's role.
+     * @throws NotFoundException (404) when the group does not exist or the caller may not see it.
+     * @throws ForbiddenException (403) when the caller is a member without the `admin` role.
+     */
+    access(client: unknown, principal: Principal, orgId: string, groupId: string, need: 'member' | 'admin'): Promise<GroupAccess>;
+    /** Counts the members of a locked group whose role can `manage` it (`admin`, and any role registered with that action). */
+    private adminCount;
+    /**
+     * `GET /api/groups/:id/members`: admins first, then by join date.
+     *
+     * @param principal - the caller (member, or `groups:admin`).
+     * @param groupId - the group.
+     * @param query - the page.
+     * @returns a page of members.
+     */
+    list(principal: Principal, groupId: string, query: PageQuery): Promise<GroupMemberList>;
+    /**
+     * `POST /api/groups/:id/members`: adds a member of the organization, by
+     * user id or by e-mail. A failed lookup by e-mail counts against the
+     * caller's throttle.
+     *
+     * @param principal - the caller (group `admin`, or `groups:admin`).
+     * @param groupId - the group.
+     * @param input - `email` or `userId`, and the role.
+     * @returns the new member.
+     * @throws HttpException 429 `LOOKUP_THROTTLED` after too many failed lookups by e-mail.
+     * @throws UnprocessableEntityException 422 `NOT_AN_ORG_MEMBER` or `GROUP_ROLE_UNKNOWN`.
+     * @throws ConflictException 409 `ALREADY_A_MEMBER` or `GROUP_FULL`.
+     */
+    add(principal: Principal, groupId: string, input: AddGroupMemberInput): Promise<GroupMemberDto>;
+    /**
+     * `PATCH /api/groups/:id/members/:userId`: changes a member's role. The
+     * last `admin` cannot be demoted.
+     *
+     * @param principal - the caller (group `admin`, or `groups:admin`).
+     * @param groupId - the group.
+     * @param userId - the member.
+     * @param role - the new role.
+     * @returns the member.
+     * @throws ConflictException 409 `LAST_GROUP_ADMIN`.
+     */
+    changeRole(principal: Principal, groupId: string, userId: string, role: GroupRole): Promise<GroupMemberDto>;
+    /**
+     * `DELETE /api/groups/:id/members/:userId`: a member leaves (self, needs
+     * only `groups:read`) or a group admin removes them (needs `groups:write`).
+     * The last `admin` cannot leave.
+     *
+     * @param principal - the caller.
+     * @param groupId - the group.
+     * @param userId - the member to remove (the caller's own id to leave).
+     * @throws ForbiddenException 403 when removing someone else without `groups:write`.
+     * @throws ConflictException 409 `LAST_GROUP_ADMIN`.
+     */
+    remove(principal: Principal, groupId: string, userId: string): Promise<void>;
+}
+export {};
+//# sourceMappingURL=group-membership.service.d.ts.map

package/dist/sharing/groups/group-membership.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"group-membership.service.d.ts","sourceRoot":"","sources":["../../../src/sharing/groups/group-membership.service.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EACV,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,SAAS,EACT,SAAS,EACV,MAAM,uCAAuC,CAAC;AAE/C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAElD,OAAO,EAAe,KAAK,cAAc,EAAE,KAAK,QAAQ,EAAkB,KAAK,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAanH,OAAO,EAAgB,KAAK,eAAe,EAAE,MAAM,UAAU,CAAC;AAC9D,OAAO,EAAmB,KAAK,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAGxF,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,qBAAqB;IACrB,KAAK,EAAE,QAAQ,CAAC;IAChB,wFAAwF;IACxF,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC;CAC1B;AAED,6DAA6D;AAC7D,KAAK,cAAc,GAAG,cAAc,GAAG;IAAE,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,aAAa,GAAG,qBAAqB,CAAC,CAAA;CAAE,CAAC;AAIhH;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,cAAc,CAUpE;AAED;;;;GAIG;AACH,qBACa,sBAAsB;IAET,OAAO,CAAC,QAAQ,CAAC,IAAI;IAClB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACjD,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAHe,IAAI,EAAE,eAAe,EAClB,OAAO,EAAE,4BAA4B,EAC9D,QAAQ,EAAE,oBAAoB,EAC9B,OAAO,EAAE,cAAc;IAG1C;;;;;;;;;;;;OAYG;IACG,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;IAenI,2HAA2H;YAC7G,UAAU;IAIxB;;;;;;;OAOG;IAEG,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,eAAe,CAAC;IAmB7F;;;;;;;;;;;;OAYG;IAEG,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC;IAiErG;;;;;;;;;;OAUG;IAEG,UAAU,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,cAAc,CAAC;IA2CjH;;;;;;;;;;OAUG;IAEG,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAkCnF"}