@memberjunction/core-entities 6.2.0-edge.5 → 6.2.0-edge.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/.tsbuildinfo +1 -1
- package/dist/custom/MJConversationDetailEntityExtended.d.ts +27 -3
- package/dist/custom/MJConversationDetailEntityExtended.d.ts.map +1 -1
- package/dist/custom/MJConversationDetailEntityExtended.js +96 -13
- package/dist/custom/MJConversationDetailEntityExtended.js.map +1 -1
- package/dist/custom/MJQueryEntityExtended.d.ts +37 -1
- package/dist/custom/MJQueryEntityExtended.d.ts.map +1 -1
- package/dist/custom/MJQueryEntityExtended.js +92 -5
- package/dist/custom/MJQueryEntityExtended.js.map +1 -1
- package/dist/custom/MJUserViewEntityExtended.d.ts +39 -4
- package/dist/custom/MJUserViewEntityExtended.d.ts.map +1 -1
- package/dist/custom/MJUserViewEntityExtended.js +111 -18
- package/dist/custom/MJUserViewEntityExtended.js.map +1 -1
- package/dist/custom/approvals.d.ts +55 -0
- package/dist/custom/approvals.d.ts.map +1 -0
- package/dist/custom/approvals.js +120 -0
- package/dist/custom/approvals.js.map +1 -0
- package/dist/engines/knowledgeHubMetadata.d.ts +8 -3
- package/dist/engines/knowledgeHubMetadata.d.ts.map +1 -1
- package/dist/engines/knowledgeHubMetadata.js +19 -2
- package/dist/engines/knowledgeHubMetadata.js.map +1 -1
- package/dist/generated/entities/__mj.d.ts +2385 -72
- package/dist/generated/entities/__mj.d.ts.map +1 -1
- package/dist/generated/entities/__mj.js +3487 -67
- package/dist/generated/entities/__mj.js.map +1 -1
- package/dist/index.d.ts +1 -0
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +1 -0
- package/dist/index.js.map +1 -1
- package/package.json +6 -6
|
@@ -28,9 +28,15 @@ import { MJConversationDetailEntity } from '../generated/entity_subclasses.js';
|
|
|
28
28
|
* The system user is exempt from these authorship rules, since server code writes on people's behalf, but it still
|
|
29
29
|
* needs to own the conversation or hold a grant on it, as before: some server paths elevate an anonymous visitor to
|
|
30
30
|
* the system user (MJ#4791), and this gate keeps those paths out of other people's conversations, so no transaction
|
|
31
|
-
* variable may set the row or conversation it writes ({@link ACCESS_GATED_FIELDS}) for it either.
|
|
32
|
-
*
|
|
33
|
-
*
|
|
31
|
+
* variable may set the row or conversation it writes ({@link ACCESS_GATED_FIELDS}) for it either.
|
|
32
|
+
*
|
|
33
|
+
* **Only the server writes an agent's reply** (A19, second half). A reply (`Role` `AI` or `Error`) is created, and
|
|
34
|
+
* what it says ({@link REPLY_FIELDS}) changed, only on an instance server code marked with
|
|
35
|
+
* {@link MarkServerAuthoredReply}. The marker is not a field: no GraphQL input, `OldValues___` or transaction
|
|
36
|
+
* variable reaches it, so a person's save of a reply is refused whatever its user, and so is an unmarked save as the
|
|
37
|
+
* system user. A marked write still needs its context user (the person the reply is for, or whoever runs a
|
|
38
|
+
* host-driven turn) to own the conversation or hold a grant on it, so being the system user grants nothing new.
|
|
39
|
+
* Pinning, hiding, the owner's rating and other bookkeeping keep the conversation-level rules.
|
|
34
40
|
* MJ's permissions engine has no native primitive for per-field row-conditional
|
|
35
41
|
* write rules, so this gate lives here rather than in `MJ: Entity Permissions`.
|
|
36
42
|
*
|
|
@@ -40,6 +46,18 @@ import { MJConversationDetailEntity } from '../generated/entity_subclasses.js';
|
|
|
40
46
|
* round trips for permission lookups.
|
|
41
47
|
*/
|
|
42
48
|
export declare class MJConversationDetailEntityExtended extends MJConversationDetailEntity {
|
|
49
|
+
private serverAuthoredReply;
|
|
50
|
+
/**
|
|
51
|
+
* Marks this instance as server code writing an agent's reply, so it may create a reply (`Role` `AI` or `Error`)
|
|
52
|
+
* and change what one says. Call it before `Save()`; it stays on the instance for every later save, like
|
|
53
|
+
* `SetCloneContext()`. The context user still needs to own the conversation or hold a grant on it.
|
|
54
|
+
*
|
|
55
|
+
* It is not a field: no GraphQL input, `OldValues___` or transaction variable can set it, and the browser's copy of
|
|
56
|
+
* this class never sends it. It has no effect on a person's message.
|
|
57
|
+
*/
|
|
58
|
+
MarkServerAuthoredReply(): void;
|
|
59
|
+
/** Whether {@link MarkServerAuthoredReply} was called on this instance. */
|
|
60
|
+
get IsServerAuthoredReply(): boolean;
|
|
43
61
|
Save(options?: EntitySaveOptions): Promise<boolean>;
|
|
44
62
|
Delete(options?: EntityDeleteOptions): Promise<boolean>;
|
|
45
63
|
private currentUserMayWrite;
|
|
@@ -51,6 +69,12 @@ export declare class MJConversationDetailEntityExtended extends MJConversationDe
|
|
|
51
69
|
* key and the base save decide, as before.
|
|
52
70
|
*/
|
|
53
71
|
private accessRefusal;
|
|
72
|
+
/**
|
|
73
|
+
* Why this write would put words in an agent's mouth, or `null` when it does not: an unmarked save that creates a
|
|
74
|
+
* reply, turns a message into one, or changes what one says ({@link REPLY_FIELDS}). Applies to every user, the
|
|
75
|
+
* system user included. Deleting a reply keeps the conversation-level rules.
|
|
76
|
+
*/
|
|
77
|
+
private replyRefusal;
|
|
54
78
|
/**
|
|
55
79
|
* Why this write breaks the rules for people's messages (see the class doc), or `null` when it does not. On a new
|
|
56
80
|
* message from a grantee with no `UserID`, fills in the grantee's.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"MJConversationDetailEntityExtended.d.ts","sourceRoot":"","sources":["../../src/custom/MJConversationDetailEntityExtended.ts"],"names":[],"mappings":"AAAA,OAAO,EAGH,mBAAmB,EAEnB,iBAAiB,EAKpB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,0BAA0B,EAAwB,MAAM,gCAAgC,CAAC;
|
|
1
|
+
{"version":3,"file":"MJConversationDetailEntityExtended.d.ts","sourceRoot":"","sources":["../../src/custom/MJConversationDetailEntityExtended.ts"],"names":[],"mappings":"AAAA,OAAO,EAGH,mBAAmB,EAEnB,iBAAiB,EAKpB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,0BAA0B,EAAwB,MAAM,gCAAgC,CAAC;AAuFlG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,qBACa,kCAAmC,SAAQ,0BAA0B;IAC9E,OAAO,CAAC,mBAAmB,CAAS;IAEpC;;;;;;;OAOG;IACI,uBAAuB,IAAI,IAAI;IAItC,2EAA2E;IAC3E,IAAW,qBAAqB,IAAI,OAAO,CAE1C;IAEc,IAAI,CAAC,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC;IAYnD,MAAM,CAAC,OAAO,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC;YAOxD,mBAAmB;IA2DjC;;;;;;OAMG;YACW,aAAa;IAoB3B;;;;OAIG;IACH,OAAO,CAAC,YAAY;IAWpB;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAOzB,wGAAwG;IACxG,OAAO,CAAC,WAAW;IAgBnB;;;OAGG;IACH,OAAO,CAAC,aAAa;IA2BrB,iHAAiH;IACjH,OAAO,CAAC,aAAa;IASrB,2GAA2G;YAC7F,kBAAkB;IAahC;;;OAGG;IACH,OAAO,CAAC,6BAA6B;IAOrC,OAAO,CAAC,YAAY;IAIpB,sGAAsG;IACtG,OAAO,CAAC,iBAAiB;IAKzB;;;;;;;;OAQG;IACH,OAAO,CAAC,YAAY;CASvB;AAED,6FAA6F;AAC7F,wBAAgB,sCAAsC,IAAI,IAAI,CAE7D"}
|
|
@@ -28,14 +28,49 @@ const AUTHORED_FIELDS = ['UserID', 'Role', 'Message', 'ArtifactID', 'ArtifactVer
|
|
|
28
28
|
*/
|
|
29
29
|
const PLACEMENT_FIELDS = ['ConversationID', 'BranchID'];
|
|
30
30
|
/**
|
|
31
|
-
* The fields the access
|
|
32
|
-
*
|
|
33
|
-
*
|
|
34
|
-
*
|
|
31
|
+
* The fields the access and reply-authorship rules, which hold for everyone (including the system user unless
|
|
32
|
+
* explicitly marked), decide on: which row is written (`ID`; an update's SQL is rebuilt with the variable's value at
|
|
33
|
+
* submit, so it would write another row), its conversation, its role (`Role` — a transaction variable setting `AI` or
|
|
34
|
+
* `Error` at submit would bypass the unmarked reply check), and the owner's rating. A transaction variable sets its
|
|
35
|
+
* field at submit, after the gate has run, so none of these may take its value from one.
|
|
35
36
|
*/
|
|
36
|
-
const ACCESS_GATED_FIELDS = ['ID', 'ConversationID', ...OWNER_ONLY_RATING_FIELDS];
|
|
37
|
-
/**
|
|
38
|
-
|
|
37
|
+
const ACCESS_GATED_FIELDS = ['ID', 'ConversationID', 'Role', ...OWNER_ONLY_RATING_FIELDS];
|
|
38
|
+
/**
|
|
39
|
+
* {@link ACCESS_GATED_FIELDS} plus `BranchID` (placement on a fork) and the remaining {@link AUTHORED_FIELDS}
|
|
40
|
+
* (`Role` is already in {@link ACCESS_GATED_FIELDS}), which the authorship rules decide on and the system user skips.
|
|
41
|
+
*/
|
|
42
|
+
const GATED_FIELDS = [
|
|
43
|
+
...ACCESS_GATED_FIELDS,
|
|
44
|
+
'BranchID',
|
|
45
|
+
...AUTHORED_FIELDS.filter(field => field !== 'Role')
|
|
46
|
+
];
|
|
47
|
+
/**
|
|
48
|
+
* The fields of an agent's reply (`Role` `AI` or `Error`) that say what the agent said, who said it, and where it sits:
|
|
49
|
+
* the authored fields ({@link AUTHORED_FIELDS}: `UserID`, `Role`, `Message`, `ArtifactID`, `ArtifactVersionID`,
|
|
50
|
+
* `MediaType`, `ParentID`), plus its conversation (`ConversationID`) and fork (`BranchID`), its agent (`AgentID`),
|
|
51
|
+
* its status (`Status`) and error (`Error`), the form (`ResponseForm`), commands (`ActionableCommands`,
|
|
52
|
+
* `AutomaticCommands`), suggested replies (`SuggestedResponses`) and reflection (`ReflectionInsights`) it offers, and
|
|
53
|
+
* the turn timing and external reference (`CompletionTime`, `ExternalID`). Only a server write marked with
|
|
54
|
+
* {@link MJConversationDetailEntityExtended.MarkServerAuthoredReply} changes them. Pinning, hiding, the owner's rating
|
|
55
|
+
* and the other bookkeeping keep the conversation-level rules.
|
|
56
|
+
*/
|
|
57
|
+
const REPLY_FIELDS = [
|
|
58
|
+
...AUTHORED_FIELDS,
|
|
59
|
+
'ConversationID',
|
|
60
|
+
'BranchID',
|
|
61
|
+
'AgentID',
|
|
62
|
+
'Status',
|
|
63
|
+
'Error',
|
|
64
|
+
'ResponseForm',
|
|
65
|
+
'ActionableCommands',
|
|
66
|
+
'AutomaticCommands',
|
|
67
|
+
'SuggestedResponses',
|
|
68
|
+
'ReflectionInsights',
|
|
69
|
+
'CompletionTime',
|
|
70
|
+
'ExternalID'
|
|
71
|
+
];
|
|
72
|
+
/** The refusal for a write that would put words in an agent's mouth. */
|
|
73
|
+
const REPLY_REFUSAL = "Only the server writes an agent's reply.";
|
|
39
74
|
/**
|
|
40
75
|
* Whether a `Role` value is a person's message. Compared the way validation and the database's CHECK constraint
|
|
41
76
|
* compare it (trimmed, any case), so `'user'` or `'User '`, which both store, cannot slip past these rules.
|
|
@@ -43,6 +78,11 @@ const GATED_FIELDS = [...ACCESS_GATED_FIELDS, 'BranchID', ...AUTHORED_FIELDS];
|
|
|
43
78
|
function isPersonRole(role) {
|
|
44
79
|
return role != null && EntityFieldInfo.NormalizeValueListValue(role) === 'user';
|
|
45
80
|
}
|
|
81
|
+
/** Whether a `Role` value is an agent's reply (`AI` or `Error`), compared as {@link isPersonRole} compares. */
|
|
82
|
+
function isReplyRole(role) {
|
|
83
|
+
const normalized = role == null ? null : EntityFieldInfo.NormalizeValueListValue(role);
|
|
84
|
+
return normalized === 'ai' || normalized === 'error';
|
|
85
|
+
}
|
|
46
86
|
/**
|
|
47
87
|
* Server-side defense-in-depth for conversation sharing. The Angular chat UI
|
|
48
88
|
* disables the message input when the current user only holds `View` access,
|
|
@@ -71,9 +111,15 @@ function isPersonRole(role) {
|
|
|
71
111
|
* The system user is exempt from these authorship rules, since server code writes on people's behalf, but it still
|
|
72
112
|
* needs to own the conversation or hold a grant on it, as before: some server paths elevate an anonymous visitor to
|
|
73
113
|
* the system user (MJ#4791), and this gate keeps those paths out of other people's conversations, so no transaction
|
|
74
|
-
* variable may set the row or conversation it writes ({@link ACCESS_GATED_FIELDS}) for it either.
|
|
75
|
-
*
|
|
76
|
-
*
|
|
114
|
+
* variable may set the row or conversation it writes ({@link ACCESS_GATED_FIELDS}) for it either.
|
|
115
|
+
*
|
|
116
|
+
* **Only the server writes an agent's reply** (A19, second half). A reply (`Role` `AI` or `Error`) is created, and
|
|
117
|
+
* what it says ({@link REPLY_FIELDS}) changed, only on an instance server code marked with
|
|
118
|
+
* {@link MarkServerAuthoredReply}. The marker is not a field: no GraphQL input, `OldValues___` or transaction
|
|
119
|
+
* variable reaches it, so a person's save of a reply is refused whatever its user, and so is an unmarked save as the
|
|
120
|
+
* system user. A marked write still needs its context user (the person the reply is for, or whoever runs a
|
|
121
|
+
* host-driven turn) to own the conversation or hold a grant on it, so being the system user grants nothing new.
|
|
122
|
+
* Pinning, hiding, the owner's rating and other bookkeeping keep the conversation-level rules.
|
|
77
123
|
* MJ's permissions engine has no native primitive for per-field row-conditional
|
|
78
124
|
* write rules, so this gate lives here rather than in `MJ: Entity Permissions`.
|
|
79
125
|
*
|
|
@@ -83,6 +129,25 @@ function isPersonRole(role) {
|
|
|
83
129
|
* round trips for permission lookups.
|
|
84
130
|
*/
|
|
85
131
|
let MJConversationDetailEntityExtended = class MJConversationDetailEntityExtended extends MJConversationDetailEntity {
|
|
132
|
+
constructor() {
|
|
133
|
+
super(...arguments);
|
|
134
|
+
this.serverAuthoredReply = false;
|
|
135
|
+
}
|
|
136
|
+
/**
|
|
137
|
+
* Marks this instance as server code writing an agent's reply, so it may create a reply (`Role` `AI` or `Error`)
|
|
138
|
+
* and change what one says. Call it before `Save()`; it stays on the instance for every later save, like
|
|
139
|
+
* `SetCloneContext()`. The context user still needs to own the conversation or hold a grant on it.
|
|
140
|
+
*
|
|
141
|
+
* It is not a field: no GraphQL input, `OldValues___` or transaction variable can set it, and the browser's copy of
|
|
142
|
+
* this class never sends it. It has no effect on a person's message.
|
|
143
|
+
*/
|
|
144
|
+
MarkServerAuthoredReply() {
|
|
145
|
+
this.serverAuthoredReply = true;
|
|
146
|
+
}
|
|
147
|
+
/** Whether {@link MarkServerAuthoredReply} was called on this instance. */
|
|
148
|
+
get IsServerAuthoredReply() {
|
|
149
|
+
return this.serverAuthoredReply;
|
|
150
|
+
}
|
|
86
151
|
async Save(options) {
|
|
87
152
|
const callerUserID = this.UserID; // the gate may fill in a grantee's; a save that fails keeps the caller's
|
|
88
153
|
if (!(await this.currentUserMayWrite('save'))) {
|
|
@@ -116,10 +181,12 @@ let MJConversationDetailEntityExtended = class MJConversationDetailEntityExtende
|
|
|
116
181
|
// the conversation or hold a grant on it: some server paths elevate an anonymous visitor to the system user
|
|
117
182
|
// (MJ#4791), and this gate is what keeps those paths out of other people's conversations.
|
|
118
183
|
const isSystemUser = WellKnownUserSource.Instance.IsSystemUser(user);
|
|
119
|
-
|
|
184
|
+
const variableGated = isSystemUser ? ACCESS_GATED_FIELDS : GATED_FIELDS;
|
|
185
|
+
const touchesReply = isReplyRole(this.Role) || isReplyRole(this.originalFieldText('Role'));
|
|
186
|
+
if (operation === 'save' && this.fieldSetByTransactionVariable(touchesReply && !this.serverAuthoredReply ? [...variableGated, ...REPLY_FIELDS] : variableGated)) {
|
|
120
187
|
// A transaction variable sets its field after this check has passed, at submit, to any value an earlier
|
|
121
188
|
// item in the group produced: a message would be checked as one row, author or conversation and saved as
|
|
122
|
-
// another.
|
|
189
|
+
// another, and an unmarked save could rewrite what an agent's reply says.
|
|
123
190
|
this.recordDenied('A conversation message cannot take its values from a transaction variable.', resultType);
|
|
124
191
|
return false;
|
|
125
192
|
}
|
|
@@ -134,7 +201,8 @@ let MJConversationDetailEntityExtended = class MJConversationDetailEntityExtende
|
|
|
134
201
|
try {
|
|
135
202
|
const access = await UserMayWriteConversation(provider, user, this.ConversationID);
|
|
136
203
|
const refusal = (await this.accessRefusal(provider, access))
|
|
137
|
-
?? (isSystemUser ? null : this.authorshipRefusal(operation, user, access.IsOwner))
|
|
204
|
+
?? (isSystemUser ? null : this.authorshipRefusal(operation, user, access.IsOwner))
|
|
205
|
+
?? this.replyRefusal(operation);
|
|
138
206
|
if (refusal) {
|
|
139
207
|
this.recordDenied(refusal, resultType);
|
|
140
208
|
return false;
|
|
@@ -176,6 +244,21 @@ let MJConversationDetailEntityExtended = class MJConversationDetailEntityExtende
|
|
|
176
244
|
}
|
|
177
245
|
return null;
|
|
178
246
|
}
|
|
247
|
+
/**
|
|
248
|
+
* Why this write would put words in an agent's mouth, or `null` when it does not: an unmarked save that creates a
|
|
249
|
+
* reply, turns a message into one, or changes what one says ({@link REPLY_FIELDS}). Applies to every user, the
|
|
250
|
+
* system user included. Deleting a reply keeps the conversation-level rules.
|
|
251
|
+
*/
|
|
252
|
+
replyRefusal(operation) {
|
|
253
|
+
if (operation === 'delete' || this.serverAuthoredReply) {
|
|
254
|
+
return null;
|
|
255
|
+
}
|
|
256
|
+
if (!this.IsSaved) {
|
|
257
|
+
return isReplyRole(this.Role) ? REPLY_REFUSAL : null;
|
|
258
|
+
}
|
|
259
|
+
const touchesReply = isReplyRole(this.originalFieldText('Role')) || isReplyRole(this.Role);
|
|
260
|
+
return touchesReply && REPLY_FIELDS.some((name) => this.isFieldDirty(name)) ? REPLY_REFUSAL : null;
|
|
261
|
+
}
|
|
179
262
|
/**
|
|
180
263
|
* Why this write breaks the rules for people's messages (see the class doc), or `null` when it does not. On a new
|
|
181
264
|
* message from a grantee with no `UserID`, fills in the grantee's.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"MJConversationDetailEntityExtended.js","sourceRoot":"","sources":["../../src/custom/MJConversationDetailEntityExtended.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EACH,UAAU,EACV,gBAAgB,EAEhB,eAAe,EAGf,QAAQ,EAER,mBAAmB,EACtB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,0BAA0B,EAAwB,MAAM,gCAAgC,CAAC;AAClG,OAAO,EAA6B,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAEhG;;;;;GAKG;AACH,MAAM,wBAAwB,GAAG,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;AAEhE;;;;;GAKG;AACH,MAAM,eAAe,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,mBAAmB,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;AAElH;;;GAGG;AACH,MAAM,gBAAgB,GAAG,CAAC,gBAAgB,EAAE,UAAU,CAAC,CAAC;AAExD
|
|
1
|
+
{"version":3,"file":"MJConversationDetailEntityExtended.js","sourceRoot":"","sources":["../../src/custom/MJConversationDetailEntityExtended.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EACH,UAAU,EACV,gBAAgB,EAEhB,eAAe,EAGf,QAAQ,EAER,mBAAmB,EACtB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,0BAA0B,EAAwB,MAAM,gCAAgC,CAAC;AAClG,OAAO,EAA6B,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAEhG;;;;;GAKG;AACH,MAAM,wBAAwB,GAAG,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;AAEhE;;;;;GAKG;AACH,MAAM,eAAe,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,mBAAmB,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;AAElH;;;GAGG;AACH,MAAM,gBAAgB,GAAG,CAAC,gBAAgB,EAAE,UAAU,CAAC,CAAC;AAExD;;;;;;GAMG;AACH,MAAM,mBAAmB,GAAG,CAAC,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,GAAG,wBAAwB,CAAC,CAAC;AAE1F;;;GAGG;AACH,MAAM,YAAY,GAAG;IACjB,GAAG,mBAAmB;IACtB,UAAU;IACV,GAAG,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,MAAM,CAAC;CACvD,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,YAAY,GAAG;IACjB,GAAG,eAAe;IAClB,gBAAgB;IAChB,UAAU;IACV,SAAS;IACT,QAAQ;IACR,OAAO;IACP,cAAc;IACd,oBAAoB;IACpB,mBAAmB;IACnB,oBAAoB;IACpB,oBAAoB;IACpB,gBAAgB;IAChB,YAAY;CACf,CAAC;AAEF,wEAAwE;AACxE,MAAM,aAAa,GAAG,0CAA0C,CAAC;AAEjE;;;GAGG;AACH,SAAS,YAAY,CAAC,IAA+B;IACjD,OAAO,IAAI,IAAI,IAAI,IAAI,eAAe,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC;AACpF,CAAC;AAED,+GAA+G;AAC/G,SAAS,WAAW,CAAC,IAA+B;IAChD,MAAM,UAAU,GAAG,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC;IACvF,OAAO,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,OAAO,CAAC;AACzD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEI,IAAM,kCAAkC,GAAxC,MAAM,kCAAmC,SAAQ,0BAA0B;IAA3E;;QACK,wBAAmB,GAAG,KAAK,CAAC;IAsQxC,CAAC;IApQG;;;;;;;OAOG;IACI,uBAAuB;QAC1B,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;IACpC,CAAC;IAED,2EAA2E;IAC3E,IAAW,qBAAqB;QAC5B,OAAO,IAAI,CAAC,mBAAmB,CAAC;IACpC,CAAC;IAEQ,KAAK,CAAC,IAAI,CAAC,OAA2B;QAC3C,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,yEAAyE;QAC3G,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAC5C,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC;QAC/B,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;IAEQ,KAAK,CAAC,MAAM,CAAC,OAA6B;QAC/C,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC9C,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,OAAO,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,SAA4B;QAC1D,MAAM,UAAU,GACZ,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC3E,MAAM,QAAQ,GAAG,IAAI,CAAC,aAA6C,CAAC;QACpE,IAAI,QAAQ,EAAE,YAAY,KAAK,UAAU,EAAE,CAAC;YACxC,sEAAsE;YACtE,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC;QACrC,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,8DAA8D;YAC9D,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,gHAAgH;QAChH,4GAA4G;QAC5G,0FAA0F;QAC1F,MAAM,YAAY,GAAG,mBAAmB,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACrE,MAAM,aAAa,GAAG,YAAY,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,YAAY,CAAC;QACxE,MAAM,YAAY,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3F,IAAI,SAAS,KAAK,MAAM,IAAI,IAAI,CAAC,6BAA6B,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,GAAG,aAAa,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC;YAC9J,wGAAwG;YACxG,yGAAyG;YACzG,0EAA0E;YAC1E,IAAI,CAAC,YAAY,CAAC,4EAA4E,EAAE,UAAU,CAAC,CAAC;YAC5G,OAAO,KAAK,CAAC;QACjB,CAAC;QAED,2FAA2F;QAC3F,yFAAyF;QACzF,oFAAoF;QACpF,wFAAwF;QACxF,oFAAoF;QACpF,IAAI,UAAU,KAAK,QAAQ,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC/C,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;YACnF,MAAM,OAAO,GAAG,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;mBACrD,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;mBAC/E,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;YACpC,IAAI,OAAO,EAAE,CAAC;gBACV,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;gBACvC,OAAO,KAAK,CAAC;YACjB,CAAC;YACD,OAAO,IAAI,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,QAAQ,CACJ,gEAAgE;gBAC5D,IAAI,SAAS,oBAAoB,IAAI,CAAC,cAAc,UAAU,IAAI,CAAC,EAAE,MAAM,OAAO,EAAE,CAC3F,CAAC;YACF,uEAAuE;YACvE,IAAI,CAAC,YAAY,CAAC,4CAA4C,EAAE,UAAU,CAAC,CAAC;YAC5E,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,aAAa,CAAC,QAA2B,EAAE,MAAiC;QACtF,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,kEAAkE;QAClE,mEAAmE;QACnE,6DAA6D;QAC7D,yDAAyD;QACzD,IAAI,wBAAwB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACnE,OAAO,wFAAwF,CAAC;QACpG,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO,MAAM,CAAC,MAAM,IAAI,oBAAoB,CAAC;QACjD,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC9D,OAAO,8CAA8C,CAAC;QAC1D,CAAC;QACD,OAAO,IAAI,CAAC;IAChB,CAAC;IAED;;;;OAIG;IACK,YAAY,CAAC,SAA4B;QAC7C,IAAI,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACrD,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAChB,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;QACzD,CAAC;QACD,MAAM,YAAY,GAAG,WAAW,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3F,OAAO,YAAY,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;IACvG,CAAC;IAED;;;OAGG;IACK,iBAAiB,CAAC,SAA4B,EAAE,IAAc,EAAE,OAAgB;QACpF,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC9F,CAAC;IAED,wGAAwG;IAChG,WAAW,CAAC,IAAc,EAAE,OAAgB;QAChD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACf,oGAAoG;YACpG,yGAAyG;YACzG,sCAAsC;YACtC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACX,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;YAC1B,CAAC;YACD,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,OAAO,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,0CAA0C,CAAC;IAChG,CAAC;IAED;;;OAGG;IACK,aAAa,CAAC,IAAc,EAAE,OAAgB;QAClD,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/D,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACtE,OAAO,qCAAqC,CAAC;QACjD,CAAC;QACD,IAAI,CAAC,SAAS,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC3D,4GAA4G;YAC5G,iFAAiF;YACjF,OAAO,4DAA4D,CAAC;QACxE,CAAC;QACD,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC9E,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YAC1C,OAAO,uDAAuD,CAAC;QACnE,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YACnF,OAAO,0CAA0C,CAAC;QACtD,CAAC;QACD,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,iHAAiH;IACzG,aAAa,CAAC,IAAc,EAAE,OAAgB;QAClD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;YAClD,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,sEAAsE,CAAC;IACjF,CAAC;IAED,2GAA2G;IACnG,KAAK,CAAC,kBAAkB,CAAC,QAA2B;QACxD,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC9E,IAAI,CAAC,UAAU,EAAE,CAAC;YACd,QAAQ,CACJ,oFAAoF,IAAI,CAAC,cAAc,GAAG;gBACtG,iCAAiC,CACxC,CAAC;YACF,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAuB,mBAAmB,EAAE,UAAU,CAAC,CAAC;QAC3G,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAClD,CAAC;IAED;;;OAGG;IACK,6BAA6B,CAAC,MAAgB;QAClD,OAAO,CAAC,CAAC,IAAI,CAAC,gBAAgB,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;YACjD,MAAM,IAAI,GAAG,CAAC,CAAC,YAAY,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YACzG,OAAO,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;IACP,CAAC;IAEO,YAAY,CAAC,IAAY;QAC7B,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC;IAC9C,CAAC;IAED,sGAAsG;IAC9F,iBAAiB,CAAC,IAAY;QAClC,MAAM,QAAQ,GAAY,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC;QAC9D,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IACjF,CAAC;IAED;;;;;;;;OAQG;IACK,YAAY,CAAC,OAAe,EAAE,IAAoC;QACtE,MAAM,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACtC,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC;QACvB,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;QACnB,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;QACzB,MAAM,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;QAC9B,MAAM,CAAC,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC;CACJ,CAAA;AAvQY,kCAAkC;IAD9C,aAAa,CAAC,UAAU,EAAE,0BAA0B,CAAC;GACzC,kCAAkC,CAuQ9C;;AAED,6FAA6F;AAC7F,MAAM,UAAU,sCAAsC;IAClD,sBAAsB;AAC1B,CAAC"}
|
|
@@ -1,4 +1,5 @@
|
|
|
1
|
-
import { UserInfo, QueryCacheConfig } from "@memberjunction/core";
|
|
1
|
+
import { UserInfo, QueryCacheConfig, EntityInfo, FieldSecurityViolation } from "@memberjunction/core";
|
|
2
|
+
import { SQLScreeningDialect } from "@memberjunction/global";
|
|
2
3
|
import { MJQueryEntity, MJQueryFieldEntity, MJQueryParameterEntity, MJQueryEntityEntity, MJQueryPermissionEntity, MJQueryDependencyEntity, MJQueryCategoryEntity } from "../generated/entity_subclasses.js";
|
|
3
4
|
import type { DatabasePlatform } from "@memberjunction/core";
|
|
4
5
|
/**
|
|
@@ -61,6 +62,41 @@ export declare class MJQueryEntityExtended extends MJQueryEntity {
|
|
|
61
62
|
canRun: boolean;
|
|
62
63
|
deniedEntities: string[];
|
|
63
64
|
};
|
|
65
|
+
/**
|
|
66
|
+
* SECURITY — the run-time half of {@link UserCanRun}: the checks that need the SQL a run will
|
|
67
|
+
* actually execute, after composition and template rendering. Call it with that SQL in addition
|
|
68
|
+
* to {@link UserCanRun}, never instead of it.
|
|
69
|
+
*
|
|
70
|
+
* 1. A query with `MJ: Query Permissions` rows is authorized by its role list alone: a user who
|
|
71
|
+
* holds one of those roles may run it whatever it reads (stored-procedure semantics), and one
|
|
72
|
+
* who holds none may not.
|
|
73
|
+
* 2. Otherwise every entity whose base view or base table the SQL reads as a relation must be
|
|
74
|
+
* readable by the user ({@link FieldSecuritySQLGate.RelationEntities}). These come from the
|
|
75
|
+
* SQL, so a query whose `QueryEntities` rows are missing or stale is still checked. SQL that
|
|
76
|
+
* cannot be read is refused for a user who cannot read every entity in the catalog.
|
|
77
|
+
* 3. The SQL must not reference a field the user is denied anywhere it could leak one: the
|
|
78
|
+
* select list, WHERE, JOIN, GROUP BY, ORDER BY or HAVING, inside expressions and aggregates
|
|
79
|
+
* included. A whole-row construct (`SELECT *`, `alias.*`) over an entity the user is denied a
|
|
80
|
+
* field on, and SQL that cannot be read, are refused too ({@link FieldSecuritySQLGate.FindViolation}).
|
|
81
|
+
* So is a relation that is not a CTE or a catalog entity's base view or base table (a custom
|
|
82
|
+
* view, synonym, table-valued function, temp table or cross-database name), whose reads
|
|
83
|
+
* cannot be checked. A user denied no field on any entity is not scanned.
|
|
84
|
+
*
|
|
85
|
+
* The result never names a denied field, so a refusal says only that the query cannot be run.
|
|
86
|
+
* `QueryFields` metadata plays no part: it is documentation, not a security source.
|
|
87
|
+
*
|
|
88
|
+
* @param user The user the query runs for
|
|
89
|
+
* @param renderedSQL The SQL the run will execute
|
|
90
|
+
* @param catalog Every entity the executing provider knows
|
|
91
|
+
* @param dialect The database dialect the SQL runs under
|
|
92
|
+
*/
|
|
93
|
+
UserCanRunRenderedSQL(user: UserInfo, renderedSQL: string, catalog: readonly EntityInfo[], dialect: SQLScreeningDialect): {
|
|
94
|
+
canRun: boolean;
|
|
95
|
+
deniedEntities: string[];
|
|
96
|
+
fieldSecurityViolation?: FieldSecurityViolation;
|
|
97
|
+
};
|
|
98
|
+
/** The catalog entities this query's `QueryEntities` rows name; stale rows are left out. */
|
|
99
|
+
private declaredEntities;
|
|
64
100
|
/** Whether this query has been formally approved for production use */
|
|
65
101
|
get IsApproved(): boolean;
|
|
66
102
|
/**
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"MJQueryEntityExtended.d.ts","sourceRoot":"","sources":["../../src/custom/MJQueryEntityExtended.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,QAAQ,EAAE,gBAAgB,EAAqB,MAAM,sBAAsB,CAAC;
|
|
1
|
+
{"version":3,"file":"MJQueryEntityExtended.d.ts","sourceRoot":"","sources":["../../src/custom/MJQueryEntityExtended.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,QAAQ,EAAE,gBAAgB,EAAqB,UAAU,EAAwB,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC3J,OAAO,EAA0C,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AACrG,OAAO,EACH,aAAa,EACb,kBAAkB,EAClB,sBAAsB,EACtB,mBAAmB,EACnB,uBAAuB,EACvB,uBAAuB,EACvB,qBAAqB,EACxB,MAAM,gCAAgC,CAAC;AAExC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAE7D;;;;;;;GAOG;AACH,qBACa,qBAAsB,SAAQ,aAAa;IAIpD,2CAA2C;IAC3C,IAAW,WAAW,IAAI,kBAAkB,EAAE,CAE7C;IAED,+CAA+C;IAC/C,IAAW,eAAe,IAAI,sBAAsB,EAAE,CAErD;IAED,6CAA6C;IAC7C,IAAW,aAAa,IAAI,mBAAmB,EAAE,CAEhD;IAED,4CAA4C;IAC5C,IAAW,gBAAgB,IAAI,uBAAuB,EAAE,CAEvD;IAED,oGAAoG;IACpG,IAAW,iBAAiB,IAAI,uBAAuB,EAAE,CAExD;IAED,+EAA+E;IAC/E,IAAW,eAAe,IAAI,uBAAuB,EAAE,CAEtD;IAID,6EAA6E;IAC7E,IAAW,cAAc,IAAI,qBAAqB,GAAG,SAAS,CAG7D;IAED,OAAO,CAAC,aAAa,CAAuB;IAE5C;;;OAGG;IACH,IAAW,YAAY,IAAI,MAAM,CAKhC;IAED;;OAEG;IACI,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM;IAmBpD;;;;;OAKG;IACI,qBAAqB,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO;IAkBrD;;;;;;;;;;;;;;;OAeG;IACI,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,cAAc,EAAE,MAAM,EAAE,CAAA;KAAE;IA2ExG;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACI,qBAAqB,CACxB,IAAI,EAAE,QAAQ,EACd,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,SAAS,UAAU,EAAE,EAC9B,OAAO,EAAE,mBAAmB,GAC7B;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,cAAc,EAAE,MAAM,EAAE,CAAC;QAAC,sBAAsB,CAAC,EAAE,sBAAsB,CAAA;KAAE;IA0BjG,4FAA4F;IAC5F,OAAO,CAAC,gBAAgB;IAcxB,uEAAuE;IACvE,IAAW,UAAU,IAAI,OAAO,CAE/B;IAED;;;OAGG;IACH,IAAW,YAAY,IAAI,OAAO,CAEjC;IAID;;;;;OAKG;IACI,cAAc,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM;IAgBzD,OAAO,CAAC,YAAY,CAAiC;IAErD;;;;OAIG;IACH,IAAW,WAAW,IAAI,gBAAgB,CAuBzC;IAED,OAAO,CAAC,uBAAuB;CAqBlC"}
|
|
@@ -4,8 +4,8 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
|
|
|
4
4
|
else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
|
|
5
5
|
return c > 3 && r && Object.defineProperty(target, key, r), r;
|
|
6
6
|
};
|
|
7
|
-
import { BaseEntity } from "@memberjunction/core";
|
|
8
|
-
import { RegisterClass, UUIDsEqual } from "@memberjunction/global";
|
|
7
|
+
import { BaseEntity, FieldSecuritySQLGate } from "@memberjunction/core";
|
|
8
|
+
import { IndexByUUID, RegisterClass, UUIDsEqual } from "@memberjunction/global";
|
|
9
9
|
import { MJQueryEntity } from "../generated/entity_subclasses.js";
|
|
10
10
|
import { QueryEngine } from "../engines/QueryEngine.js";
|
|
11
11
|
/**
|
|
@@ -131,6 +131,29 @@ let MJQueryEntityExtended = class MJQueryEntityExtended extends MJQueryEntity {
|
|
|
131
131
|
if (!this.UserHasRunPermissions(user)) {
|
|
132
132
|
return { canRun: false, deniedEntities: [] };
|
|
133
133
|
}
|
|
134
|
+
const deniedEntities = [];
|
|
135
|
+
const queryEntities = this.QueryEntities;
|
|
136
|
+
const md = this.ProviderToUse;
|
|
137
|
+
// Step 1b: Any referenced AlternateBaseView that is disabled or missing cannot execute
|
|
138
|
+
// regardless of whether the query has explicit QueryPermissions (stored-procedure semantics
|
|
139
|
+
// do not re-enable a disabled SQL view whose SELECT grant was revoked).
|
|
140
|
+
if (queryEntities && queryEntities.length > 0) {
|
|
141
|
+
for (const qe of queryEntities) {
|
|
142
|
+
if (!qe.AlternateBaseViewID)
|
|
143
|
+
continue;
|
|
144
|
+
const entityInfo = md.EntityByID(qe.EntityID);
|
|
145
|
+
if (!entityInfo)
|
|
146
|
+
continue;
|
|
147
|
+
const abv = IndexByUUID(entityInfo.AlternateBaseViews ?? []).Get(qe.AlternateBaseViewID);
|
|
148
|
+
if (!abv || !abv.IsUsable) {
|
|
149
|
+
const label = abv?.Name ?? qe.AlternateBaseView ?? qe.AlternateBaseViewID;
|
|
150
|
+
deniedEntities.push(`${entityInfo.Name} (AlternateBaseView '${label}' is unavailable)`);
|
|
151
|
+
}
|
|
152
|
+
}
|
|
153
|
+
if (deniedEntities.length > 0) {
|
|
154
|
+
return { canRun: false, deniedEntities };
|
|
155
|
+
}
|
|
156
|
+
}
|
|
134
157
|
// Step 2: Explicit Query Permissions override entity checks for this query
|
|
135
158
|
// and all its dependencies (stored-procedure semantics)
|
|
136
159
|
const permissions = this.QueryPermissions;
|
|
@@ -138,10 +161,7 @@ let MJQueryEntityExtended = class MJQueryEntityExtended extends MJQueryEntity {
|
|
|
138
161
|
return { canRun: true, deniedEntities: [] };
|
|
139
162
|
}
|
|
140
163
|
// Step 3: No explicit permissions — check entity read access
|
|
141
|
-
const deniedEntities = [];
|
|
142
|
-
const queryEntities = this.QueryEntities;
|
|
143
164
|
if (queryEntities && queryEntities.length > 0) {
|
|
144
|
-
const md = this.ProviderToUse;
|
|
145
165
|
for (const qe of queryEntities) {
|
|
146
166
|
const entityInfo = md.EntityByID(qe.EntityID);
|
|
147
167
|
if (!entityInfo)
|
|
@@ -169,6 +189,73 @@ let MJQueryEntityExtended = class MJQueryEntityExtended extends MJQueryEntity {
|
|
|
169
189
|
}
|
|
170
190
|
return { canRun: deniedEntities.length === 0, deniedEntities };
|
|
171
191
|
}
|
|
192
|
+
/**
|
|
193
|
+
* SECURITY — the run-time half of {@link UserCanRun}: the checks that need the SQL a run will
|
|
194
|
+
* actually execute, after composition and template rendering. Call it with that SQL in addition
|
|
195
|
+
* to {@link UserCanRun}, never instead of it.
|
|
196
|
+
*
|
|
197
|
+
* 1. A query with `MJ: Query Permissions` rows is authorized by its role list alone: a user who
|
|
198
|
+
* holds one of those roles may run it whatever it reads (stored-procedure semantics), and one
|
|
199
|
+
* who holds none may not.
|
|
200
|
+
* 2. Otherwise every entity whose base view or base table the SQL reads as a relation must be
|
|
201
|
+
* readable by the user ({@link FieldSecuritySQLGate.RelationEntities}). These come from the
|
|
202
|
+
* SQL, so a query whose `QueryEntities` rows are missing or stale is still checked. SQL that
|
|
203
|
+
* cannot be read is refused for a user who cannot read every entity in the catalog.
|
|
204
|
+
* 3. The SQL must not reference a field the user is denied anywhere it could leak one: the
|
|
205
|
+
* select list, WHERE, JOIN, GROUP BY, ORDER BY or HAVING, inside expressions and aggregates
|
|
206
|
+
* included. A whole-row construct (`SELECT *`, `alias.*`) over an entity the user is denied a
|
|
207
|
+
* field on, and SQL that cannot be read, are refused too ({@link FieldSecuritySQLGate.FindViolation}).
|
|
208
|
+
* So is a relation that is not a CTE or a catalog entity's base view or base table (a custom
|
|
209
|
+
* view, synonym, table-valued function, temp table or cross-database name), whose reads
|
|
210
|
+
* cannot be checked. A user denied no field on any entity is not scanned.
|
|
211
|
+
*
|
|
212
|
+
* The result never names a denied field, so a refusal says only that the query cannot be run.
|
|
213
|
+
* `QueryFields` metadata plays no part: it is documentation, not a security source.
|
|
214
|
+
*
|
|
215
|
+
* @param user The user the query runs for
|
|
216
|
+
* @param renderedSQL The SQL the run will execute
|
|
217
|
+
* @param catalog Every entity the executing provider knows
|
|
218
|
+
* @param dialect The database dialect the SQL runs under
|
|
219
|
+
*/
|
|
220
|
+
UserCanRunRenderedSQL(user, renderedSQL, catalog, dialect) {
|
|
221
|
+
const permissions = this.QueryPermissions;
|
|
222
|
+
if (permissions && permissions.length > 0) {
|
|
223
|
+
return { canRun: this.UserHasRunPermissions(user), deniedEntities: [] };
|
|
224
|
+
}
|
|
225
|
+
const read = FieldSecuritySQLGate.RelationEntities(renderedSQL, catalog, dialect);
|
|
226
|
+
if (read === null && catalog.some(e => !e.GetUserPermisions(user)?.CanRead)) {
|
|
227
|
+
const unreadable = { Kind: 'Unresolvable', Reference: 'the SQL could not be read', Entity: null };
|
|
228
|
+
return { canRun: false, deniedEntities: [], fieldSecurityViolation: unreadable };
|
|
229
|
+
}
|
|
230
|
+
const deniedEntities = (read ?? []).filter(e => !e.GetUserPermisions(user)?.CanRead).map(e => e.Name);
|
|
231
|
+
if (deniedEntities.length > 0) {
|
|
232
|
+
return { canRun: false, deniedEntities };
|
|
233
|
+
}
|
|
234
|
+
const violation = FieldSecuritySQLGate.FindViolation(renderedSQL, {
|
|
235
|
+
User: user,
|
|
236
|
+
Dialect: dialect,
|
|
237
|
+
Catalog: catalog,
|
|
238
|
+
ReadEntities: [...this.declaredEntities(catalog), ...(read ?? [])],
|
|
239
|
+
RefuseUnknownRelations: true,
|
|
240
|
+
});
|
|
241
|
+
return violation
|
|
242
|
+
? { canRun: false, deniedEntities: [], fieldSecurityViolation: violation }
|
|
243
|
+
: { canRun: true, deniedEntities: [] };
|
|
244
|
+
}
|
|
245
|
+
/** The catalog entities this query's `QueryEntities` rows name; stale rows are left out. */
|
|
246
|
+
declaredEntities(catalog) {
|
|
247
|
+
const queryEntities = this.QueryEntities ?? [];
|
|
248
|
+
if (queryEntities.length === 0)
|
|
249
|
+
return [];
|
|
250
|
+
const byID = IndexByUUID(catalog);
|
|
251
|
+
const declared = [];
|
|
252
|
+
for (const qe of queryEntities) {
|
|
253
|
+
const entity = byID.Get(qe.EntityID);
|
|
254
|
+
if (entity)
|
|
255
|
+
declared.push(entity);
|
|
256
|
+
}
|
|
257
|
+
return declared;
|
|
258
|
+
}
|
|
172
259
|
// ─── Status Checks ──────────────────────────────────────────────────────────
|
|
173
260
|
/** Whether this query has been formally approved for production use */
|
|
174
261
|
get IsApproved() {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"MJQueryEntityExtended.js","sourceRoot":"","sources":["../../src/custom/MJQueryEntityExtended.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,UAAU,
|
|
1
|
+
{"version":3,"file":"MJQueryEntityExtended.js","sourceRoot":"","sources":["../../src/custom/MJQueryEntityExtended.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,UAAU,EAA6D,oBAAoB,EAA0B,MAAM,sBAAsB,CAAC;AAC3J,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,UAAU,EAAuB,MAAM,wBAAwB,CAAC;AACrG,OAAO,EACH,aAAa,EAOhB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAGrD;;;;;;;GAOG;AAEI,IAAM,qBAAqB,GAA3B,MAAM,qBAAsB,SAAQ,aAAa;IAAjD;QAEH,+EAA+E;;QAwCvE,kBAAa,GAAkB,IAAI,CAAC;QAmQ5C,+EAA+E;QAEvE,iBAAY,GAA4B,IAAI,CAAC;IAqDzD,CAAC;IAhWG,2CAA2C;IAC3C,IAAW,WAAW;QAClB,OAAO,WAAW,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,+CAA+C;IAC/C,IAAW,eAAe;QACtB,OAAO,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,6CAA6C;IAC7C,IAAW,aAAa;QACpB,OAAO,WAAW,CAAC,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1F,CAAC;IAED,4CAA4C;IAC5C,IAAW,gBAAgB;QACvB,OAAO,WAAW,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,oGAAoG;IACpG,IAAW,iBAAiB;QACxB,OAAO,WAAW,CAAC,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACzF,CAAC;IAED,+EAA+E;IAC/E,IAAW,eAAe;QACtB,OAAO,WAAW,CAAC,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,gBAAgB,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAClG,CAAC;IAED,+EAA+E;IAE/E,6EAA6E;IAC7E,IAAW,cAAc;QACrB,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,OAAO,SAAS,CAAC;QACvC,OAAO,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;IACxF,CAAC;IAID;;;OAGG;IACH,IAAW,YAAY;QACnB,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;YAC9B,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,IAAI,CAAC,aAAa,CAAC;IAC9B,CAAC;IAED;;OAEG;IACI,iBAAiB,CAAC,UAAkB;QACvC,IAAI,CAAC,UAAU;YAAE,OAAO,EAAE,CAAC;QAE3B,MAAM,UAAU,GAAG,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC;QACnD,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,IAAI,SAAS,GAAkB,UAAU,CAAC;QAE1C,OAAO,SAAS,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,SAAU,CAAC,CAAC,CAAC;YAC/D,IAAI,CAAC,GAAG;gBAAE,MAAM;YAChB,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC3B,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC;QAC7B,CAAC;QAED,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAED,+EAA+E;IAE/E;;;;;OAKG;IACI,qBAAqB,CAAC,IAAc;QACvC,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC;QAE1C,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,IAAI,IAAI,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACzB,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBACpC,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;oBAC5F,OAAO,IAAI,CAAC;gBAChB,CAAC;YACL,CAAC;QACL,CAAC;QAED,OAAO,KAAK,CAAC;IACjB,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACI,UAAU,CAAC,IAAc,EAAE,QAAsB;QACpD,cAAc;QACd,MAAM,OAAO,GAAG,QAAQ,IAAI,IAAI,GAAG,EAAU,CAAC;QAC9C,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC;QAChD,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAErB,4CAA4C;QAC5C,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC;QACjD,CAAC;QAED,MAAM,cAAc,GAAa,EAAE,CAAC;QACpC,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;QACzC,MAAM,EAAE,GAAG,IAAI,CAAC,aAA6C,CAAC;QAE9D,uFAAuF;QACvF,4FAA4F;QAC5F,wEAAwE;QACxE,IAAI,aAAa,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,KAAK,MAAM,EAAE,IAAI,aAAa,EAAE,CAAC;gBAC7B,IAAI,CAAC,EAAE,CAAC,mBAAmB;oBAAE,SAAS;gBACtC,MAAM,UAAU,GAAG,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;gBAC9C,IAAI,CAAC,UAAU;oBAAE,SAAS;gBAC1B,MAAM,GAAG,GAAG,WAAW,CAAC,UAAU,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC;gBACzF,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;oBACxB,MAAM,KAAK,GAAG,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC,iBAAiB,IAAI,EAAE,CAAC,mBAAmB,CAAC;oBAC1E,cAAc,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,IAAI,wBAAwB,KAAK,mBAAmB,CAAC,CAAC;gBAC5F,CAAC;YACL,CAAC;YACD,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5B,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;YAC7C,CAAC;QACL,CAAC;QAED,2EAA2E;QAC3E,wDAAwD;QACxD,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC;QAC1C,IAAI,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC;QAChD,CAAC;QAED,6DAA6D;QAC7D,IAAI,aAAa,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,KAAK,MAAM,EAAE,IAAI,aAAa,EAAE,CAAC;gBAC7B,MAAM,UAAU,GAAG,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;gBAC9C,IAAI,CAAC,UAAU;oBAAE,SAAS,CAAE,yBAAyB;gBAErD,MAAM,KAAK,GAAG,UAAU,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;gBACjD,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;oBAC3B,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;gBACzC,CAAC;YACL,CAAC;QACL,CAAC;QAED,qDAAqD;QACrD,MAAM,YAAY,GAAG,IAAI,CAAC,iBAAiB,CAAC;QAC5C,IAAI,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1C,MAAM,UAAU,GAAG,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC;YAChD,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;gBAC7B,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;gBAC9E,IAAI,CAAC,QAAQ;oBAAE,SAAS,CAAE,8BAA8B;gBAExD,MAAM,SAAS,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBACrD,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;oBACpB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,GAAG,cAAc,EAAE,GAAG,SAAS,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC/F,CAAC;gBACD,cAAc,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,cAAc,CAAC,CAAC;YACrD,CAAC;QACL,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,cAAc,EAAE,CAAC;IACnE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACI,qBAAqB,CACxB,IAAc,EACd,WAAmB,EACnB,OAA8B,EAC9B,OAA4B;QAE5B,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC;QAC1C,IAAI,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC;QAC5E,CAAC;QACD,MAAM,IAAI,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAClF,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC;YAC1E,MAAM,UAAU,GAA2B,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,2BAA2B,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC1H,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,sBAAsB,EAAE,UAAU,EAAE,CAAC;QACrF,CAAC;QACD,MAAM,cAAc,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtG,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;QAC7C,CAAC;QACD,MAAM,SAAS,GAAG,oBAAoB,CAAC,aAAa,CAAC,WAAW,EAAE;YAC9D,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,OAAO;YAChB,YAAY,EAAE,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;YAClE,sBAAsB,EAAE,IAAI;SAC/B,CAAC,CAAC;QACH,OAAO,SAAS;YACZ,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,sBAAsB,EAAE,SAAS,EAAE;YAC1E,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC;IAC/C,CAAC;IAED,4FAA4F;IACpF,gBAAgB,CAAC,OAA8B;QACnD,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;QAC/C,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QAClC,MAAM,QAAQ,GAAiB,EAAE,CAAC;QAClC,KAAK,MAAM,EAAE,IAAI,aAAa,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;YACrC,IAAI,MAAM;gBAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,QAAQ,CAAC;IACpB,CAAC;IAED,+EAA+E;IAE/E,uEAAuE;IACvE,IAAW,UAAU;QACjB,OAAO,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC;IACtC,CAAC;IAED;;;OAGG;IACH,IAAW,YAAY;QACnB,OAAO,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC;IAC5C,CAAC;IAED,+EAA+E;IAE/E;;;;;OAKG;IACI,cAAc,CAAC,QAA0B;QAC5C,MAAM,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC;QAEhC,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC;QACrE,IAAI,OAAO,EAAE,CAAC;YACV,MAAM,KAAK,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAC3B,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,CAAC,CACnF,CAAC;YACF,IAAI,KAAK,EAAE,GAAG;gBAAE,OAAO,KAAK,CAAC,GAAG,CAAC;QACrC,CAAC;QAED,OAAO,IAAI,CAAC,GAAG,CAAC;IACpB,CAAC;IAMD;;;;OAIG;IACH,IAAW,WAAW;QAClB,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,YAAY,CAAC;QAC7B,CAAC;QAED,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,IAAI,CAAC,YAAY,GAAG;gBAChB,OAAO,EAAE,IAAI;gBACb,UAAU,EAAE,IAAI,CAAC,eAAe,IAAI,EAAE;gBACtC,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,SAAS;gBAC5C,QAAQ,EAAE,OAAO;aACpB,CAAC;YACF,OAAO,IAAI,CAAC,YAAY,CAAC;QAC7B,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,uBAAuB,EAAE,CAAC;QACjD,IAAI,SAAS,EAAE,CAAC;YACZ,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;YAC9B,OAAO,IAAI,CAAC,YAAY,CAAC;QAC7B,CAAC;QAED,IAAI,CAAC,YAAY,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC,YAAY,CAAC;IAC7B,CAAC;IAEO,uBAAuB;QAC3B,MAAM,UAAU,GAAG,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC;QACnD,IAAI,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC;QAE5B,OAAO,KAAK,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,KAAM,CAAC,CAAC,CAAC;YAC3D,IAAI,CAAC,GAAG;gBAAE,MAAM;YAEhB,IAAI,GAAG,CAAC,mBAAmB,IAAI,GAAG,CAAC,uBAAuB,EAAE,CAAC;gBACzD,OAAO;oBACH,OAAO,EAAE,IAAI;oBACb,UAAU,EAAE,GAAG,CAAC,sBAAsB,IAAI,EAAE;oBAC5C,YAAY,EAAE,GAAG,CAAC,mBAAmB,IAAI,SAAS;oBAClD,QAAQ,EAAE,OAAO;oBACjB,mBAAmB,EAAE,IAAI;iBAC5B,CAAC;YACN,CAAC;YACD,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC;QACzB,CAAC;QACD,OAAO,IAAI,CAAC;IAChB,CAAC;CACJ,CAAA;AApWY,qBAAqB;IADjC,aAAa,CAAC,UAAU,EAAE,aAAa,CAAC;GAC5B,qBAAqB,CAoWjC"}
|
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import { BaseInfo, EntityInfo, EntityFieldInfo, UserInfo, EntitySaveOptions } from "@memberjunction/core";
|
|
1
|
+
import { BaseInfo, EntityInfo, EntityFieldInfo, UserInfo, EntitySaveOptions, ValidationResult } from "@memberjunction/core";
|
|
2
2
|
import { MJUserViewEntity, MJUserViewEntity_IColumnFormat as ColumnFormat, MJUserViewEntity_IGridSortSetting as ViewGridSortSetting, MJUserViewEntity_IGridColumnSetting as ViewGridColumnSetting, MJUserViewEntity_IGridAggregatesConfig as ViewGridAggregatesConfig, MJUserViewEntity_IGridAggregateDisplay as ViewGridAggregateDisplay, MJUserViewEntity_IDisplayState as ViewDisplayState, MJUserViewEntity_ITimelineState as ViewTimelineState } from "../generated/entity_subclasses.js";
|
|
3
3
|
export declare class MJUserViewEntityExtended extends MJUserViewEntity {
|
|
4
4
|
private _ViewEntityInfo;
|
|
@@ -57,6 +57,16 @@ export declare class MJUserViewEntityExtended extends MJUserViewEntity {
|
|
|
57
57
|
* @param config The timeline configuration to set
|
|
58
58
|
*/
|
|
59
59
|
setTimelineConfig(config: ViewTimelineState): void;
|
|
60
|
+
/**
|
|
61
|
+
* Semantic `Name` of the alternate base view (`MJ: Entity Alternate Base Views.Name`)
|
|
62
|
+
* pinned in `DisplayState.alternateBaseView`, or `null` when this view reads from the
|
|
63
|
+
* entity's canonical `BaseView`.
|
|
64
|
+
*/
|
|
65
|
+
get AlternateBaseView(): string | null;
|
|
66
|
+
/**
|
|
67
|
+
* Updates or clears the pinned `alternateBaseView` in `DisplayState`.
|
|
68
|
+
*/
|
|
69
|
+
set AlternateBaseView(value: string | null);
|
|
60
70
|
/**
|
|
61
71
|
* Check if a specific view mode is enabled.
|
|
62
72
|
* By default, all modes are enabled unless explicitly disabled.
|
|
@@ -114,6 +124,13 @@ export declare class MJUserViewEntityExtended extends MJUserViewEntity {
|
|
|
114
124
|
Load(ID: string, EntityRelationshipsToLoad?: string[]): Promise<boolean>;
|
|
115
125
|
Delete(): Promise<boolean>;
|
|
116
126
|
Save(options?: EntitySaveOptions): Promise<boolean>;
|
|
127
|
+
/**
|
|
128
|
+
* Adds the checks on the view's declared `Properties`: unique, non-empty names; a known type; a
|
|
129
|
+
* target field of the view's entity with an operator that suits the type; and each default valid
|
|
130
|
+
* for the type. A view with no properties validates exactly as before.
|
|
131
|
+
*/
|
|
132
|
+
Validate(): ValidationResult;
|
|
133
|
+
private validateProperties;
|
|
117
134
|
SetDefaultsFromEntity(e: EntityInfo): Promise<void>;
|
|
118
135
|
NewRecord(): boolean;
|
|
119
136
|
/**
|
|
@@ -140,6 +157,23 @@ export declare class MJUserViewEntityExtended extends MJUserViewEntity {
|
|
|
140
157
|
* infrastructure will be enabled from the UpdateWhereClause() method.
|
|
141
158
|
*/
|
|
142
159
|
protected get SmartFilterImplemented(): boolean;
|
|
160
|
+
/**
|
|
161
|
+
* True when no Smart Filter WHERE clause has been generated. Null and blank are the same state: the
|
|
162
|
+
* server's generator can return '' (or a model's whitespace), and `WhereClause = SmartFilterWhereClause`
|
|
163
|
+
* then makes the view return EVERY row.
|
|
164
|
+
*/
|
|
165
|
+
private get smartFilterWhereClauseBlank();
|
|
166
|
+
/**
|
|
167
|
+
* True when the view has a Smart Filter to apply (enabled, with a prompt) but no clause. A re-save of the same
|
|
168
|
+
* prompt leaves no field dirty, so without this Save() would never retry, and the view would return every row
|
|
169
|
+
* until someone edited the prompt. With it, the view's next save regenerates the clause.
|
|
170
|
+
*/
|
|
171
|
+
private get smartFilterPending();
|
|
172
|
+
/**
|
|
173
|
+
* True when `DisplayState.alternateBaseView` changed compared to the persisted `DisplayState` OldValue.
|
|
174
|
+
* Used to re-evaluate SmartFilterWhereClause against the new base view context on Save.
|
|
175
|
+
*/
|
|
176
|
+
private get alternateBaseViewDirty();
|
|
143
177
|
Set(FieldName: string, Value: any): void;
|
|
144
178
|
/**
|
|
145
179
|
* Create a where clause for SQL from the structured filter state JSON information
|
|
@@ -188,10 +222,11 @@ export declare class MJUserViewEntityExtended extends MJUserViewEntity {
|
|
|
188
222
|
}]
|
|
189
223
|
}`;
|
|
190
224
|
*/
|
|
225
|
+
static GenerateWhereClauseFromFilterState(FilterState: string | Record<string, unknown>, entityInfo: EntityInfo): string;
|
|
191
226
|
protected GenerateWhereClause(FilterState: string, entityInfo: EntityInfo): string;
|
|
192
|
-
private
|
|
193
|
-
private
|
|
194
|
-
private
|
|
227
|
+
private static wrapQuotesStatic;
|
|
228
|
+
private static convertFilterToSQLStatic;
|
|
229
|
+
private static processFilterGroupStatic;
|
|
195
230
|
}
|
|
196
231
|
export declare class ViewInfo {
|
|
197
232
|
/**
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"MJUserViewEntityExtended.d.ts","sourceRoot":"","sources":["../../src/custom/MJUserViewEntityExtended.ts"],"names":[],"mappings":"AACA,OAAO,EAAwB,QAAQ,EAAE,UAAU,EAAE,eAAe,EAAU,QAAQ,EAAE,iBAAiB,
|
|
1
|
+
{"version":3,"file":"MJUserViewEntityExtended.d.ts","sourceRoot":"","sources":["../../src/custom/MJUserViewEntityExtended.ts"],"names":[],"mappings":"AACA,OAAO,EAAwB,QAAQ,EAAE,UAAU,EAAE,eAAe,EAAU,QAAQ,EAAE,iBAAiB,EAAsJ,gBAAgB,EAAwE,MAAM,sBAAsB,CAAC;AACpX,OAAO,EACH,gBAAgB,EAChB,8BAA8B,IAAI,YAAY,EAC9C,iCAAiC,IAAI,mBAAmB,EACxD,mCAAmC,IAAI,qBAAqB,EAC5D,sCAAsC,IAAI,wBAAwB,EAClE,sCAAsC,IAAI,wBAAwB,EAIlE,8BAA8B,IAAI,gBAAgB,EAClD,+BAA+B,IAAI,iBAAiB,EAMvD,MAAM,gCAAgC,CAAC;AAIxC,qBACa,wBAAyB,SAAQ,gBAAgB;IAC1D,OAAO,CAAC,eAAe,CAAmB;IAE1C;;;;;;;OAOG;IACH,IAAW,MAAM,IAAI,cAAc,EAAE,CAMpC;IAED;;;;OAIG;IACH,IAAW,OAAO,IAAI,cAAc,EAAE,CAwBrC;IAED;;;;;OAKG;IACH,IAAW,cAAc,IAAI,UAAU,CAStC;IAED,IAAW,YAAY,IAAI,YAAY,EAAE,CAQxC;IAED,IAAW,aAAa,IAAI,MAAM,CAsBjC;IAED;;;OAGG;IACH,OAAO,CAAC,yBAAyB;IAejC;;;;OAIG;IACH,IAAW,kBAAkB,IAAI,gBAAgB,GAAG,IAAI,CAUvD;IAED;;;OAGG;IACI,eAAe,CAAC,KAAK,EAAE,gBAAgB,GAAG,IAAI;IAIrD;;OAEG;IACH,IAAW,eAAe,IAAI,MAAM,GAAG,OAAO,GAAG,UAAU,CAE1D;IAED;;;OAGG;IACH,IAAW,cAAc,IAAI,iBAAiB,GAAG,IAAI,CAEpD;IAED;;;;OAIG;IACI,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI;IAMzD;;;;OAIG;IACH,IAAW,iBAAiB,IAAI,MAAM,GAAG,IAAI,CAK5C;IAED;;OAEG;IACH,IAAW,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAWhD;IAED;;;;OAIG;IACI,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,UAAU,GAAG,OAAO;IAMtE;;;;;OAKG;IACI,2BAA2B,IAAI,MAAM,GAAG,IAAI;IAuBnD;;;OAGG;IACI,sBAAsB,IAAI,eAAe,EAAE;IAOnC,YAAY,CAAC,IAAI,EAAE,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC;IAexD;;;;;;;;OAQG;IACH,IAAW,WAAW,IAAI,OAAO,CAKhC;IACD,OAAO,CAAC,kBAAkB,CAAgB;IAG1C;;OAEG;IACH,IAAW,WAAW,IAAI,OAAO,CAKhC;IACD,OAAO,CAAC,oBAAoB;IA2B5B,OAAO,CAAC,kBAAkB,CAAgB;IAG1C;;;;;;;OAOG;IACH,IAAW,aAAa,IAAI,OAAO,CAKlC;IACD,OAAO,CAAC,oBAAoB,CAAgB;IAG5C,SAAS,CAAC,0BAA0B;IAMpC,OAAO,CAAC,sBAAsB;IAmB9B,OAAO,CAAC,oBAAoB;IAqB5B;;OAEG;IACH,IAAW,kBAAkB,IAAI,MAAM,CAStC;IACD,OAAO,CAAC,mBAAmB,CAAe;IAE3B,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,yBAAyB,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAiBxE,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC;IAsB1B,IAAI,CAAC,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC;IAyClE;;;;OAIG;IACa,QAAQ,IAAI,gBAAgB;IAO5C,OAAO,CAAC,kBAAkB;IAgBb,qBAAqB,CAAC,CAAC,EAAE,UAAU;IAiBvC,SAAS,IAAI,OAAO;IA6B7B;;;;;;;;OAQG;IACU,iBAAiB,CAAC,gBAAgB,CAAC,EAAE,OAAO;IAmDzD;;;;OAIG;IACU,8BAA8B,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAC,CAAC;IAI5I;;;OAGG;IACH,SAAS,KAAK,sBAAsB,IAAI,OAAO,CAE9C;IAED;;;;OAIG;IACH,OAAO,KAAK,2BAA2B,GAEtC;IAED;;;;OAIG;IACH,OAAO,KAAK,kBAAkB,GAG7B;IAED;;;OAGG;IACH,OAAO,KAAK,sBAAsB,GASjC;IAEe,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,IAAI;IAexD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8CG;WACW,kCAAkC,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,EAAE,UAAU,GAAG,MAAM;IAK/H,SAAS,CAAC,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,GAAG,MAAM;IAIlF,OAAO,CAAC,MAAM,CAAC,gBAAgB;IAI/B,OAAO,CAAC,MAAM,CAAC,wBAAwB;IAkEvC,OAAO,CAAC,MAAM,CAAC,wBAAwB;CAiC1C;AAED,qBAAa,QAAQ;IACjB;;;;;;;;OAQG;WACU,eAAe,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,wBAAwB,EAAE,CAAC;IAa5G;;;;OAIG;WACU,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAYzD;;;;;;;;;OASG;WACU,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAWrG;;;;;;;;;OASG;WACU,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAUhH;AAED;;GAEG;AACH,qBAAa,cAAe,SAAQ,QAAQ;IACxC,sBAAsB;IACtB,EAAE,EAAE,MAAM,CAAO;IACjB,iBAAiB;IACjB,IAAI,EAAE,MAAM,CAAO;IACnB,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAO;IAC1B,2DAA2D;IAC3D,eAAe,CAAC,EAAE,MAAM,CAAO;IAC/B,+BAA+B;IAC/B,MAAM,EAAE,OAAO,CAAO;IACtB,6BAA6B;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAO;IACrB,yBAAyB;IACzB,UAAU,CAAC,EAAE,MAAM,CAAO;IAG1B,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAAO;IACvC,iDAAiD;IACjD,IAAI,CAAC,EAAE,MAAM,CAAO;IACpB,2BAA2B;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAO;IACxB,2BAA2B;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAO;IAExB,sCAAsC;IACtC,MAAM,CAAC,EAAE,YAAY,CAAO;IAE5B,6DAA6D;IAC7D,WAAW,EAAE,eAAe,CAAO;gBAEtB,QAAQ,GAAE,GAAU;CAIpC;AAED,eAAO,MAAM,mBAAmB;;;CAGtB,CAAC;AAEX,MAAM,MAAM,mBAAmB,GAAG,OAAO,mBAAmB,CAAC,MAAM,OAAO,mBAAmB,CAAC,CAAC;AAG/F,qBAAa,cAAe,SAAQ,QAAQ;IACxC,aAAa,EAAE,mBAAmB,CAAO;IAEzC,KAAK,EAAE,MAAM,CAAO;IACpB,QAAQ,EAAE,MAAM,CAAO;IACvB,KAAK,EAAE,MAAM,CAAO;IAEpB,OAAO,EAAE,cAAc,EAAE,CAAK;gBAEjB,QAAQ,GAAE,GAAU;CAUpC;AAED,eAAO,MAAM,qBAAqB;;;CAGxB,CAAC;AAEX,MAAM,MAAM,qBAAqB,GAAG,OAAO,qBAAqB,CAAC,MAAM,OAAO,qBAAqB,CAAC,CAAC;AAErG,qBAAa,YAAa,SAAQ,QAAQ;IACtC,KAAK,EAAE,MAAM,CAAO;IACpB,SAAS,EAAE,qBAAqB,CAAO;gBAE1B,QAAQ,GAAE,GAAU;CAOpC;AAED;;;GAGG;AACH,qBAAa,aAAa;IACtB,qDAAqD;IACrD,YAAY,CAAC,EAAE,mBAAmB,EAAE,CAAC;IACrC,gEAAgE;IAChE,cAAc,CAAC,EAAE,qBAAqB,EAAE,CAAC;IACzC,6CAA6C;IAC7C,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,uDAAuD;IACvD,UAAU,CAAC,EAAE,wBAAwB,CAAC;CACzC;AAED;;GAEG;AACH,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,wBAAwB,CAWxE,CAAC"}
|