@memberjunction/core 6.2.0-edge.4 → 6.2.0-edge.6

package/dist/generic/entityValueFieldSecurity.js

@@ -0,0 +1,250 @@
+import { CurrentFieldSecurityGeneration, FieldSecurityError, ReadableFieldsTransportKey } from './entityInfo.js';
+import { RecordChangeFieldSecurityProjector } from './recordChangeFieldSecurity.js';
+/**
+ * Returns `values` without the keys `denied` names, matched case- and whitespace-insensitively.
+ *
+ * `denied` is a denied-field set as {@link EntityInfo.GetDeniedReadFields} builds it: lowercased,
+ * holding both the `Name` and the `CodeName` of every denied field. Because the match is against
+ * the row's OWN keys, a row keyed by either spelling, in any case, is narrowed.
+ *
+ * Returns a shallow COPY when a key was removed and the original object by reference when none
+ * was, so a row that is already narrow costs nothing. The input is never modified, which is what
+ * makes this safe on frozen, shared cache rows.
+ */
+export function OmitDeniedFieldKeys(values, denied) {
+    if (!values || typeof values !== 'object' || !denied || denied.size === 0) {
+        return values;
+    }
+    const source = values;
+    let copy = null;
+    for (const key of Object.keys(source)) {
+        if (!denied.has(key.trim().toLowerCase())) {
+            continue;
+        }
+        copy ??= { ...source };
+        delete copy[key];
+    }
+    return (copy ?? values);
+}
+/**
+ * Returns `values` without the keys `entity`'s own user may not read, for a payload built from
+ * that entity and sent to another tier (a graph save, a companion's wire form).
+ *
+ * The object already holds no denied value (its hydration points and `NewRecord` leave such
+ * fields not loaded), so `GetAll()` normally omits them by itself. This is the backstop for a key
+ * put back on the object without the readability check, which `SetMany` permits: the receiving
+ * tier refuses a restricted caller's input that names a field they may not read, so sending one
+ * fails the whole save.
+ *
+ * Returns the original object when nothing was removed, and a shallow copy otherwise.
+ */
+export function OmitFieldsUnreadableByActiveUser(entity, values) {
+    if (!values || typeof values !== 'object') {
+        return values;
+    }
+    const source = values;
+    let copy = null;
+    for (const key of Object.keys(source)) {
+        if (entity.IsFieldReadableByActiveUser(key)) {
+            continue;
+        }
+        copy ??= { ...source };
+        delete copy[key];
+    }
+    return (copy ?? values);
+}
+/**
+ * The denied-READ set for `user` on `entityInfo`, or null when field security does not apply:
+ * it applies to neither the entity nor an IS-A ancestor, there is no user, or the user is denied nothing.
+ */
+function deniedReadFieldsFor(entityInfo, user) {
+    if (!entityInfo.FieldLevelSecurityApplies) {
+        return null;
+    }
+    const denied = entityInfo.GetDeniedReadFields(user);
+    return denied.size > 0 ? denied : null;
+}
+/** The names of the fields a caller with this denied set may read, for {@link ReadableFieldsTransportKey}. */
+function readableFieldNames(entityInfo, denied) {
+    return entityInfo.Fields
+        .filter((f) => !denied.has(f.Name.trim().toLowerCase()))
+        .map((f) => f.Name);
+}
+/** Field-security narrowing for one row: omission plus the optional readable-fields marker. */
+function narrowRow(row, denied, readable) {
+    const narrowed = OmitDeniedFieldKeys(row, denied);
+    if (!readable) {
+        return narrowed;
+    }
+    const withMarker = narrowed === row
+        ? { ...row }
+        : narrowed;
+    withMarker[ReadableFieldsTransportKey] = readable;
+    return withMarker;
+}
+/**
+ * Projects a plain object of entity field values down to what `user` may READ.
+ *
+ * **The one output projection every transport uses**, so that no transport can apply only half
+ * of it. Three things are applied, matching what the GraphQL resolvers' field mapping does:
+ *
+ * 1. **Denied read fields are omitted**, under both the `Name` and `CodeName` spellings and in any
+ *    case, because callers reach here with rows keyed either way. Omitted rather than nulled:
+ *    a null is indistinguishable from a real value.
+ * 2. **{@link ReadableFieldsTransportKey}** is appended when `includeReadableFields` is set and
+ *    the caller is denied something (see the option).
+ * 3. **The Record Changes payload projection**, which is keyed on the entity each ROW is about
+ *    rather than on the entity being queried. `MJ: Record Changes` normally has field security
+ *    off, so step 1 is a no-op for it, while its payload columns carry other entities' values.
+ *
+ * An entity object built for a restricted user does not hold denied values in the first place,
+ * so on that path this is defence in depth. It is the primary control for values that did not
+ * come from such an object: a system-identity load, a raw provider row, or a cached payload.
+ *
+ * Returns a COPY whenever anything changed, and the original object by reference when nothing
+ * did, so unrestricted callers pay nothing and frozen cache rows are never written to.
+ *
+ * @param provider Metadata source, used to resolve the per-row target entity for Record Changes.
+ * @param entityInfo The entity the values belong to. When absent the values are returned unchanged.
+ * @param values The field values. Never modified.
+ * **Fails open on a missing user.** With no `user` the values are returned unchanged, full width.
+ * That is deliberate: a browser or other single-user client has no per-call user to pass, and
+ * server-internal code running without one is trusted with full values. It also means a
+ * server-side transport that forgets to pass the caller sends everything, so every request-path
+ * caller must pass the requesting user.
+ *
+ * @param user The caller. When absent the values are returned unchanged (see above).
+ * @param options See {@link ProjectEntityValuesOptions}.
+ */
+export function ProjectEntityValuesForUser(provider, entityInfo, values, user, options) {
+    if (!values || typeof values !== 'object' || !entityInfo || !user) {
+        return values;
+    }
+    const projected = ProjectEntityValueRowsForUser(provider, entityInfo, [values], user, options);
+    return projected?.[0] ?? values;
+}
+/**
+ * Array form of {@link ProjectEntityValuesForUser}. The denied set, the readable-fields list and
+ * the Record Changes projector are each built ONCE for the whole set: the projector memoizes its
+ * per-entity lookups for its own lifetime, and a denied set walks every field of the entity, so
+ * building either per row turns a per-request cost into a per-row one.
+ *
+ * Returns the ORIGINAL array when no row needed changing. Fails open on a missing user, as
+ * {@link ProjectEntityValuesForUser} does.
+ */
+export function ProjectEntityValueRowsForUser(provider, entityInfo, rows, user, options) {
+    if (!rows?.length || !entityInfo || !user) {
+        return rows;
+    }
+    const denied = deniedReadFieldsFor(entityInfo, user);
+    const isRecordChanges = RecordChangeFieldSecurityProjector.IsRecordChangesEntity(entityInfo);
+    if (!denied && !isRecordChanges) {
+        return rows;
+    }
+    let projected = rows;
+    if (denied) {
+        const readable = options?.includeReadableFields ? readableFieldNames(entityInfo, denied) : null;
+        projected = rows.map((row) => narrowRow(row, denied, readable));
+    }
+    if (isRecordChanges) {
+        projected = new RecordChangeFieldSecurityProjector(provider, user).ProjectRows(projected);
+    }
+    return projected.some((row, i) => row !== rows[i]) ? projected : rows;
+}
+/**
+ * Keys a transport adds to client input that are not entity fields, and that
+ * {@link AssertClientInputWritableForUser} therefore must not treat as unknown.
+ */
+export const ClientInputTransportKeys = [
+    'OldValues___',
+    ReadableFieldsTransportKey,
+    'RestoreContext___',
+    'CloneContext___',
+    // The companion payload key, spelled out rather than imported: the module that defines it
+    // imports BaseEntity, which imports this module, and this array is built at load time.
+    'Companions___',
+    '__typename',
+];
+/**
+ * The wording for refusing a key in client input. Deliberately the SAME for a key that names a
+ * field the caller cannot read and a key that names no field at all, so the refusal cannot be
+ * used to learn which columns exist.
+ */
+export function FieldSecurityClientInputMessage(key, entityName) {
+    return `Field '${key}' cannot be written on entity '${entityName}'.`;
+}
+/** {@link ClientInputTransportKeys}, lowercased and trimmed, as {@link AssertClientInputWritableForUser} matches them. */
+const NORMALIZED_CLIENT_INPUT_TRANSPORT_KEYS = new Set(ClientInputTransportKeys.map((k) => k.trim().toLowerCase()));
+const knownFieldKeysCache = new WeakMap();
+/** Every key that names a field of `entityInfo` or of an IS-A ancestor, lowercased, by Name and CodeName. */
+function knownFieldKeys(entityInfo) {
+    const fields = entityInfo.Fields;
+    const chain = entityInfo.ParentChain ?? [];
+    const generation = CurrentFieldSecurityGeneration();
+    const memo = knownFieldKeysCache.get(entityInfo);
+    if (memo && memo.fields === fields && memo.chain === chain && memo.generation === generation) {
+        return memo.keys;
+    }
+    const keys = new Set();
+    for (const entity of [entityInfo, ...chain]) {
+        for (const f of entity.Fields) {
+            keys.add(f.Name.trim().toLowerCase());
+            keys.add(f.CodeName.trim().toLowerCase());
+        }
+    }
+    knownFieldKeysCache.set(entityInfo, { fields, chain, generation, keys });
+    return keys;
+}
+/** Whether `normalized` is a transport key, built in or one the caller added. */
+function isAllowedTransportKey(normalized, additional) {
+    return NORMALIZED_CLIENT_INPUT_TRANSPORT_KEYS.has(normalized) || (additional?.has(normalized) ?? false);
+}
+/**
+ * The write-side gate for transports that apply client input with `SetMany`: throws a
+ * {@link FieldSecurityError} when the input carries a key the caller may not send.
+ *
+ * Applies only to a caller who is denied at least one field on the entity. For that caller, a key
+ * is refused when it names a field they cannot READ, or when it names no field at all; both get
+ * the identical {@link FieldSecurityClientInputMessage}. Treating unknown keys the same way is
+ * what keeps the refusal from revealing whether a column exists: refusing only denied keys would
+ * answer "does `Salary` exist?" for any key a caller cares to try.
+ *
+ * Rejection rather than silent removal: a client holding a denied value can only have fabricated
+ * it, because no response it received contained one, so there is no legitimate request to save.
+ *
+ * Keys in {@link ClientInputTransportKeys}, and any in `options.additionalAllowedKeys`, are
+ * accepted. Matching is case- and whitespace-insensitive, by Name and CodeName, like `SetMany`.
+ * Callers who are denied nothing, or input for an entity without field security, are unaffected,
+ * so `SetMany`'s ordinary handling of unknown keys still applies to them.
+ *
+ * @param entityInfo The entity the input will be applied to.
+ * **Fails open on a missing user.** With no `user` the gate does nothing, so server-internal
+ * code, and a client with no per-call user, are unaffected. A server-side transport applying a
+ * request's input must therefore pass the requesting user, or nothing is checked.
+ *
+ * @param values The client input. Never modified.
+ * @param user The caller. When absent the gate does nothing (see above).
+ * @param options See {@link ClientInputGateOptions}.
+ */
+export function AssertClientInputWritableForUser(entityInfo, values, user, options) {
+    if (!values || typeof values !== 'object' || !entityInfo || !user) {
+        return;
+    }
+    const denied = deniedReadFieldsFor(entityInfo, user);
+    if (!denied) {
+        return;
+    }
+    const extra = options?.additionalAllowedKeys;
+    const additional = extra && extra.length > 0 ? new Set(extra.map((k) => k.trim().toLowerCase())) : null;
+    const known = knownFieldKeys(entityInfo);
+    for (const key of Object.keys(values)) {
+        const normalized = key.trim().toLowerCase();
+        if (isAllowedTransportKey(normalized, additional)) {
+            continue;
+        }
+        if (denied.has(normalized) || !known.has(normalized)) {
+            throw new FieldSecurityError(key, entityInfo.Name, FieldSecurityClientInputMessage(key, entityInfo.Name));
+        }
+    }
+}
+//# sourceMappingURL=entityValueFieldSecurity.js.map

package/dist/generic/entityValueFieldSecurity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entityValueFieldSecurity.js","sourceRoot":"","sources":["../../src/generic/entityValueFieldSecurity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,8BAA8B,EAA+B,kBAAkB,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAC;AAE3I,OAAO,EAAE,kCAAkC,EAA8B,MAAM,6BAA6B,CAAC;AAoB7G;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAmB,MAAS,EAAE,MAA8C;IAC3G,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,MAAM,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,MAAiC,CAAC;IACjD,IAAI,IAAI,GAAmC,IAAI,CAAC;IAChD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YACxC,SAAS;QACb,CAAC;QACD,IAAI,KAAK,EAAE,GAAG,MAAM,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,CAAC,IAAI,IAAI,MAAM,CAAM,CAAC;AACjC,CAAC;AAOD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gCAAgC,CAAmB,MAAkC,EAAE,MAAS;IAC5G,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,MAAM,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,MAAiC,CAAC;IACjD,IAAI,IAAI,GAAmC,IAAI,CAAC;IAChD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,IAAI,MAAM,CAAC,2BAA2B,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1C,SAAS;QACb,CAAC;QACD,IAAI,KAAK,EAAE,GAAG,MAAM,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,CAAC,IAAI,IAAI,MAAM,CAAM,CAAC;AACjC,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAAC,UAAsB,EAAE,IAAc;IAC/D,IAAI,CAAC,UAAU,CAAC,yBAAyB,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACpD,OAAO,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3C,CAAC;AAED,8GAA8G;AAC9G,SAAS,kBAAkB,CAAC,UAAsB,EAAE,MAA2B;IAC3E,OAAO,UAAU,CAAC,MAAM;SACnB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;SACvD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED,+FAA+F;AAC/F,SAAS,SAAS,CAAmB,GAAM,EAAE,MAA2B,EAAE,QAAyB;IAC/F,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACZ,OAAO,QAAQ,CAAC;IACpB,CAAC;IACD,MAAM,UAAU,GAA4B,QAAQ,KAAK,GAAG;QACxD,CAAC,CAAC,EAAE,GAAI,GAA+B,EAAE;QACzC,CAAC,CAAE,QAAoC,CAAC;IAC5C,UAAU,CAAC,0BAA0B,CAAC,GAAG,QAAQ,CAAC;IAClD,OAAO,UAAe,CAAC;AAC3B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,UAAU,0BAA0B,CACtC,QAAoC,EACpC,UAAyC,EACzC,MAA4B,EAC5B,IAAiC,EACjC,OAAoC;IAEpC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,EAAE,CAAC;QAChE,OAAO,MAAM,CAAC;IAClB,CAAC;IACD,MAAM,SAAS,GAAG,6BAA6B,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC/F,OAAO,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;AACpC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,6BAA6B,CACzC,QAAoC,EACpC,UAAyC,EACzC,IAA4B,EAC5B,IAAiC,EACjC,OAAoC;IAEpC,IAAI,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,MAAM,GAAG,mBAAmB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACrD,MAAM,eAAe,GAAG,kCAAkC,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAC7F,IAAI,CAAC,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,IAAI,SAAS,GAAQ,IAAI,CAAC;IAC1B,IAAI,MAAM,EAAE,CAAC;QACT,MAAM,QAAQ,GAAG,OAAO,EAAE,qBAAqB,CAAC,CAAC,CAAC,kBAAkB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAChG,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,eAAe,EAAE,CAAC;QAClB,SAAS,GAAG,IAAI,kCAAkC,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1E,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAsB;IACvD,cAAc;IACd,0BAA0B;IAC1B,mBAAmB;IACnB,iBAAiB;IACjB,0FAA0F;IAC1F,uFAAuF;IACvF,eAAe;IACf,YAAY;CACf,CAAC;AAQF;;;;GAIG;AACH,MAAM,UAAU,+BAA+B,CAAC,GAAW,EAAE,UAAkB;IAC3E,OAAO,UAAU,GAAG,kCAAkC,UAAU,IAAI,CAAC;AACzE,CAAC;AAED,0HAA0H;AAC1H,MAAM,sCAAsC,GAAwB,IAAI,GAAG,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAczI,MAAM,mBAAmB,GAAG,IAAI,OAAO,EAAkC,CAAC;AAE1E,6GAA6G;AAC7G,SAAS,cAAc,CAAC,UAAsB;IAC1C,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IACjC,MAAM,KAAK,GAAG,UAAU,CAAC,WAAW,IAAI,EAAE,CAAC;IAC3C,MAAM,UAAU,GAAG,8BAA8B,EAAE,CAAC;IACpD,MAAM,IAAI,GAAG,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,IAAI,IAAI,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QAC3F,OAAO,IAAI,CAAC,IAAI,CAAC;IACrB,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,MAAM,IAAI,CAAC,UAAU,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;QAC1C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAC5B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;YACtC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC9C,CAAC;IACL,CAAC;IACD,mBAAmB,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;IACzE,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,iFAAiF;AACjF,SAAS,qBAAqB,CAAC,UAAkB,EAAE,UAAsC;IACrF,OAAO,sCAAsC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,CAAC;AAC5G,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,gCAAgC,CAC5C,UAAyC,EACzC,MAAkD,EAClD,IAAiC,EACjC,OAAgC;IAEhC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,EAAE,CAAC;QAChE,OAAO;IACX,CAAC;IACD,MAAM,MAAM,GAAG,mBAAmB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,EAAE,CAAC;QACV,OAAO;IACX,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,EAAE,qBAAqB,CAAC;IAC7C,MAAM,UAAU,GAAG,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxG,MAAM,KAAK,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;IACzC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC5C,IAAI,qBAAqB,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC;YAChD,SAAS;QACb,CAAC;QACD,IAAI,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,kBAAkB,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,EAAE,+BAA+B,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9G,CAAC;IACL,CAAC;AACL,CAAC"}

package/dist/generic/fieldSecuritySQLGate.d.ts

@@ -0,0 +1,350 @@
+import { SQLScreeningDialect } from '@memberjunction/global';
+import { EntityInfo, FieldSecurityError } from './entityInfo.js';
+import { UserInfo } from './securityInfo.js';
+/** Why {@link FieldSecuritySQLGate} refuses a piece of SQL. */
+export type FieldSecurityViolationKind = 'DeniedField' | 'WholeRow' | 'Unresolvable' | 'UnknownRelation';
+/** One reason {@link FieldSecuritySQLGate.FindViolation} refuses a piece of SQL. */
+export interface FieldSecurityViolation {
+    Kind: FieldSecurityViolationKind;
+    /**
+     * `DeniedField`: the reference as the database reads it (a quoted identifier's bare name; on
+     * PostgreSQL an unquoted name in lower case). `WholeRow`: the construct, such as `FOR JSON`.
+     * `Unresolvable`: why the text could not be read. `UnknownRelation`: the relation the catalog
+     * does not know.
+     */
+    Reference: string;
+    /** The entity whose denial the reference reaches; null when the text could not be read. */
+    Entity: EntityInfo | null;
+}
+/** What {@link FieldSecuritySQLGate} needs to judge one piece of SQL for one user. */
+export interface FieldSecuritySQLContext {
+    /** The acting user. */
+    User: UserInfo;
+    /** The dialect whose lexical rules the database applies to the text. */
+    Dialect: SQLScreeningDialect;
+    /** Every entity the provider knows, so base views and tables named in the text are recognized. */
+    Catalog: readonly EntityInfo[];
+    /**
+     * For a filter, sort or aggregate fragment: the entity whose view the fragment runs against.
+     * Its columns can be named without a qualifier, so its denied fields are always checked.
+     */
+    TargetEntity?: EntityInfo | null;
+    /** Entities the SQL is known to read beyond those its text names, such as a query's declared entities. */
+    ReadEntities?: readonly EntityInfo[];
+    /**
+     * For a whole statement, such as a saved query's SQL: refuse, for a user carrying any field
+     * denial, a relation that is not a CTE and not the base view or base table of a catalog entity
+     * (a custom view, synonym, table-valued function, temp table, or a name in another schema or
+     * database), and `EXEC`/`CALL`. What such a relation reads cannot be checked.
+     */
+    RefuseUnknownRelations?: boolean;
+}
+/**
+ * SECURITY — the field-level security gate for SQL text a caller authors: RunView filters, sorts and
+ * aggregate expressions, a saved view's stored clauses, dataset item filters, and the rendered SQL
+ * of a saved query.
+ *
+ * Output projection alone is not enough. A user denied `Salary` who can write
+ * `ExtraFilter: "Salary > 200000"`, sort by it, or aggregate `MIN(Salary)` reconstructs its values
+ * from which rows come back. This gate refuses such text before it reaches the cache or the
+ * database, for every caller: client requests, agents and actions alike.
+ *
+ * ## How it reads the text
+ *
+ * The text is split into tokens with the database's own lexical rules
+ * (`ScanSQLForScreening`), so a name inside a string literal or a comment is not a reference, and a
+ * `[bracketed]` or `"quoted"` name is read as the bare name it is. Every unquoted word and quoted
+ * identifier is then compared with every denied field of every entity the SQL reads:
+ * - the entity the fragment filters (its columns can be named unqualified);
+ * - the entities whose base view or base table the text names, such as a subquery's FROM;
+ * - any entities the caller says the SQL reads.
+ *
+ * A name matches a denied field by the rule `IdentifierMatches` states, or when the two are equal
+ * after Unicode compatibility folding, accent stripping and case folding, the comparisons a
+ * database collation can make. So a look-alike spelling that the database would still resolve to
+ * the denied column is refused too. Each name is compared on its own, so one denied name inside
+ * another can never hide it.
+ *
+ * A reference qualified by an alias or view name that binds only to entities whose denied set
+ * does not hold that name is not a reference to a denied field. An unknown qualifier is checked
+ * against every restricted entity.
+ *
+ * ## Whole-row constructs
+ *
+ * For a user denied something on an entity the SQL reads, constructs that read a whole row without
+ * naming its columns are refused: `SELECT *` and `alias.*` (except directly inside `EXISTS (…)`
+ * whose body has no set operation or row-picking ORDER BY), `FOR JSON`, `FOR XML`, any function of
+ * `*` other than `COUNT(*)`/`COUNT_BIG(*)` (for example `CHECKSUM(*)`), `NATURAL JOIN`, a column
+ * alias list on such a relation, and a relation or its alias used as a value (PostgreSQL's
+ * whole-row reference, as in `row_to_json(e)` or `TABLE vw`). A user with no denials on the
+ * entities read is not affected; ordinary subqueries keep working.
+ *
+ * ## Failing closed
+ *
+ * Text the scanner cannot read the way the database does is refused for any user who carries a
+ * denial on an entity the SQL could read. So is a name holding a control, format or
+ * default-ignorable character (a zero-width joiner, a direction mark), which a collation may give
+ * no weight to.
+ *
+ * ## Unknown columns
+ *
+ * A reference to a column that does not exist reaches the database, which rejects it. For a user
+ * carrying denials, {@link FieldSecuritySQLGate.ErrorForInvalidColumn} turns that rejection into the
+ * same {@link FieldSecurityError} a denied column gets, so the two cannot be told apart.
+ */
+export declare class FieldSecuritySQLGate {
+    /**
+     * The first reason `sql` must be refused for `context.User`, or null when it may run.
+     *
+     * @param sql A filter, sort or aggregate fragment, or a whole statement
+     * @param context The user, dialect, catalog and the entities the SQL is known to read
+     */
+    static FindViolation(sql: string | null | undefined, context: FieldSecuritySQLContext): FieldSecurityViolation | null;
+    /**
+     * The first reason the sort fragment `orderBy` must be refused for `context.User`, or null.
+     * Everything {@link FindViolation} refuses, and, for a user denied a field on
+     * `context.TargetEntity`, a sort item that is a column position (`3 DESC`). A position names a
+     * column of the select list without spelling it, and an entity-object read selects every
+     * column, so `ORDER BY 3` can sort by a denied field. It is refused as a whole-row construct.
+     */
+    static FindSortViolation(orderBy: string | null | undefined, context: FieldSecuritySQLContext): FieldSecurityViolation | null;
+    /**
+     * Throws a {@link FieldSecurityError} when {@link FindViolation} refuses `sql`. The error names
+     * `entityName`, the entity the caller is reading, never the entity a subquery reaches, so a
+     * refusal says nothing a "no such column" error would not.
+     */
+    static AssertAllowed(sql: string | null | undefined, context: FieldSecuritySQLContext, entityName: string): void;
+    /**
+     * Checks a whole statement, such as a saved query's rendered SQL, against the denied fields of
+     * every entity it reads. The entities come from the base views and tables the text names, plus
+     * `readEntities`. References are checked wherever they appear: the select list, WHERE, JOIN,
+     * GROUP BY, ORDER BY and HAVING. For a user carrying any field denial, a relation the catalog
+     * does not know is refused too ({@link FieldSecuritySQLContext.RefuseUnknownRelations}).
+     * Throws a {@link FieldSecurityError} on the first violation, naming the entity whose denial
+     * it reached (or `fallbackEntityName` when none).
+     */
+    static AssertStatementAllowed(sql: string, user: UserInfo, catalog: readonly EntityInfo[], dialect: SQLScreeningDialect, readEntities?: readonly EntityInfo[], fallbackEntityName?: string): void;
+    /** The error a violation raises, naming `entityName`. */
+    static ErrorForViolation(violation: FieldSecurityViolation, entityName: string): FieldSecurityError;
+    /**
+     * For a user carrying field denials on `entity`, the {@link FieldSecurityError} a database's
+     * "no such column" rejection becomes, so a column that does not exist and a column that is
+     * denied produce the same error. Null when the user carries no denials there, or the error is
+     * not a "no such column" rejection.
+     *
+     * Reads SQL Server's `Invalid column name 'x'` and `The multi-part identifier "a.x" could not be
+     * bound`, and PostgreSQL's `column "x" does not exist` and `column a.x does not exist`.
+     */
+    static ErrorForInvalidColumn(error: unknown, entity: EntityInfo | null | undefined, user: UserInfo | null | undefined): FieldSecurityError | null;
+    /**
+     * The entities whose base view or base table `sql` reads as a relation: a name after FROM, JOIN
+     * or APPLY, or in a FROM list, wherever it appears (subqueries and CTE bodies included), with
+     * schema qualifiers skipped. A name in a literal or a comment is not a relation. A bare name
+     * shared by entities in several schemas yields each of them, so the set never misses a read.
+     * A relation inside a parenthesized join and PostgreSQL's `FROM ONLY x` count too. Null when
+     * the text cannot be read the way the database reads it.
+     */
+    static RelationEntities(sql: string | null | undefined, catalog: readonly EntityInfo[], dialect: SQLScreeningDialect): EntityInfo[] | null;
+    /** True when `user` is denied at least one field on at least one of `entities`. */
+    static UserCarriesDenials(entities: Iterable<EntityInfo | null | undefined>, user: UserInfo): boolean;
+    /**
+     * True when `user` is denied at least one field on any entity of `catalog`.
+     *
+     * Memoized per (catalog, user): after the first call it costs a few comparisons. The memo is
+     * discarded when the catalog array changes length, when the field-security generation moves
+     * (an entity rebuilt, a flag assigned, a cache invalidated; see
+     * `CurrentFieldSecurityGeneration`) or when the user's roles change, which are everything the
+     * answer depends on. A catalog swapped for a new array starts a new memo.
+     */
+    static CatalogHasDenialsForUser(catalog: readonly EntityInfo[] | null | undefined, user: UserInfo): boolean;
+    /**
+     * Every field `user` may not read across `catalog`: one `entityID:field,field` entry per
+     * entity on which the user is denied something, sorted. '' for a user denied nothing.
+     * Memoized exactly as {@link CatalogHasDenialsForUser}.
+     */
+    static CatalogDenialProfileKey(catalog: readonly EntityInfo[] | null | undefined, user: UserInfo): string;
+    /** The current summary for (`catalog`, `user`), rebuilt when any part of its key moved. */
+    private static catalogDenialSummary;
+    /** The uncached walk behind {@link CatalogDenialProfileKey}. */
+    private static buildDenialProfileKey;
+    /**
+     * The column a database "no such column" message names, or null. A qualified name gives its
+     * last part, which is what the gate reports for the same reference.
+     */
+    private static invalidColumnName;
+    /** Longest prefix of a database error message scanned for a column name. */
+    private static readonly maxErrorMessageScanLength;
+    /** The last dot-separated part of an identifier path, unquoted and unescaped. */
+    private static lastIdentifierPart;
+    /**
+     * The identifier path in a PostgreSQL `column <path> does not exist` message (for example
+     * `e.salry` or `"E"."Salry"`), or null. Scanned by hand rather than with a regular expression:
+     * the path's parts may themselves contain dots, and a pattern that allows that backtracks
+     * exponentially on crafted input.
+     */
+    private static postgresColumnPath;
+    /**
+     * Index just past an identifier path starting at `start`: a run of non-space characters in
+     * which double-quoted segments (with `""` escapes) may contain spaces. Returns `start` when no
+     * path starts there, and -1 for an unterminated quote.
+     */
+    private static identifierPathEnd;
+    /**
+     * The first call of a function the dialect forbids in caller SQL (one that runs SQL given as a
+     * string, reads files or other databases), or null. What such a call reads cannot be checked.
+     */
+    private static findDynamicSQLCall;
+    /**
+     * True when the user carries a denial on any entity the SQL could read: the target, the
+     * declared read entities (checked directly, as they need not be catalog members), or any
+     * catalog entity, since the text can name any of them. The catalog answer is memoized
+     * ({@link CatalogHasDenialsForUser}).
+     *
+     * Deliberately catalog-wide rather than "the target and read entities only". Which other
+     * entities a fragment reads is only known once its text has been read the way the database
+     * reads it: a subquery, a parenthesized join, a schema-qualified or bracketed name, or a name
+     * spelled with look-alike characters all reach another entity's view. And text that cannot be
+     * read at all, a dynamic-SQL call or an invisible character must be refused for such a user
+     * whatever it appears to name. Every one of those checks needs the tokens, so a user with a
+     * denial anywhere has every fragment tokenized; {@link analyze} then derives the read set, and
+     * a fragment whose read set carries none of the user's denials passes without the
+     * denied-name and whole-row checks.
+     */
+    private static mayReadRestrictedEntity;
+    /** Builds the relation bindings, the restricted set and its denied names. */
+    private static analyze;
+    /** Adds `entity` to the restricted set when the user is denied a field on it. */
+    private static addIfRestricted;
+    /** Records each relation the text names, its alias, and which of them are restricted. */
+    private static bindRelations;
+    /** Binds a qualifier to entities. */
+    private static bind;
+    /**
+     * Whether the relation name at `i` declares a relation: it follows FROM, JOIN or APPLY, or a
+     * comma in a FROM list, with any `schema .` / `database . schema .` qualifiers, a PostgreSQL
+     * `ONLY`, and the parentheses of a parenthesized join skipped.
+     */
+    private static isRelationDeclaration;
+    /** Whether the token at `j` is a FROM, JOIN or APPLY keyword, or a comma in a FROM list. */
+    private static introducesRelation;
+    /** The index of the first part of the dotted name that ends at `i` (`db . schema . name`). */
+    private static qualifierStart;
+    /**
+     * The clause keyword that governs the token at `i` at its own parenthesis depth: the nearest
+     * preceding SELECT, FROM, JOIN, WHERE, ON, GROUP, ORDER or HAVING at that depth. Inside the
+     * parentheses of a parenthesized join (`FROM (a x, b y)`) with no such keyword, `from`.
+     */
+    private static clauseAt;
+    /** Whether the `(` at `j` opens a parenthesized join: it stands where a relation is declared. */
+    private static opensJoinGroup;
+    /**
+     * The first relation the statement reads that is not a CTE and not the base view or base table
+     * of a catalog entity, or a stored-procedure call; null when there is none. A name qualified by
+     * a schema no entity of that name lives in, or by a database, is unknown; so is a function in
+     * a relation position (`FROM f(…)`).
+     */
+    private static findUnknownRelation;
+    /**
+     * Whether the name at `i` is the last part of a relation the statement reads: after FROM (of a
+     * SELECT, not `EXTRACT(… FROM x)` or `IS DISTINCT FROM x`), JOIN, APPLY, a FROM-list comma or
+     * PostgreSQL's `TABLE`, past qualifiers, `ONLY`, `LATERAL` and join-group parentheses.
+     */
+    private static isRelationTarget;
+    /** Whether a token is `ONLY` or `LATERAL`. */
+    private static isRelationModifier;
+    /** Whether the FROM at `j` is a SELECT's FROM clause. */
+    private static isSelectFrom;
+    /**
+     * Whether the relation whose last name part is at `i` is a CTE or a catalog entity's base view
+     * or base table, in that entity's schema when qualified.
+     */
+    private static isKnownRelation;
+    /**
+     * The folded names of the CTEs a statement defines: a name after WITH, RECURSIVE or a comma
+     * that is followed by an optional column list, AS, an optional `[NOT] MATERIALIZED`, and `(`.
+     */
+    private static cteNames;
+    /** Whether the tokens from `j` are `[(columns)] AS [NOT] [MATERIALIZED] (`. */
+    private static opensCTEBody;
+    /** The index of the `)` that closes the `(` at `open`, or -1. */
+    private static closingParen;
+    /**
+     * Whether the body of the `EXISTS (` whose parenthesis is at `open` has, at its own depth, a
+     * word that makes a `SELECT *` there read column values ({@link EXISTS_ROW_READING_WORDS}).
+     * An unclosed body counts as one that does.
+     */
+    private static existsBodyReadsRows;
+    /** The index of the alias after the relation at `i` (`x a`, `x AS a`), or null. */
+    private static aliasIndexAfter;
+    /** The first reference to a denied field, honoring qualifiers that bind to known entities. */
+    private static findDeniedReference;
+    /**
+     * The denied names a reference at `i` could reach: those of the entities its qualifier binds to,
+     * or every restricted entity's when it is unqualified or its qualifier is unknown.
+     */
+    private static candidatesFor;
+    /**
+     * A sort item of `orderBy` that is a column position, as a whole-row violation, or null. Only
+     * for a user denied a field on the target entity. An item counts when its first token, inside
+     * any opening parentheses, is a number.
+     */
+    private static findSortByPosition;
+    /** The first whole-row construct, or null. */
+    private static findWholeRowConstruct;
+    /** The whole-row construct that starts at token `i`, or null. */
+    private static wholeRowConstructAt;
+    /**
+     * What a `*` at `i` reads: null for a multiplication, `COUNT(*)`, `EXISTS (SELECT *` whose body
+     * has no set operation or row-picking ORDER BY at its own depth, or `alias.*` whose alias binds
+     * only to entities the user is denied nothing on.
+     */
+    private static starConstruct;
+    /**
+     * A restricted relation name or alias used other than as a declaration or a qualifier (`x.`):
+     * a whole-row value on PostgreSQL, or a column alias list after the declaration.
+     */
+    private static relationValueConstruct;
+    /** Whether a token can end the left operand of a multiplication. */
+    private static endsOperand;
+    /** Whether a token can start the right operand of a multiplication. */
+    private static startsOperand;
+    /**
+     * The name a "no such column" error would give for `name` as `sql` writes it, so a denied
+     * column is reported exactly as an unknown one. On PostgreSQL, MJ quotes a capitalized or
+     * dot-qualified word before the database sees it (`AutoQuoteLeavesWordBare`), so the error
+     * names such a word as written; a word left bare is folded to lower case. A quoted name, and
+     * every name on SQL Server, is reported as written. The first token spelled `name` decides.
+     *
+     * @param sql The caller's SQL
+     * @param name The reference as the database reads it
+     * @param dialect The dialect the SQL runs under
+     */
+    static ReportedColumnName(sql: string, name: string, dialect: SQLScreeningDialect): string;
+    /** A reference's name as {@link ReportedColumnName} gives it. */
+    private static reportedName;
+    private static isName;
+    private static isWord;
+    private static isSymbol;
+    /** Folded base view and base table names of every entity in the catalog. */
+    private static relationIndex;
+}
+/**
+ * An identifier reduced to the form a database collation may compare it in: Unicode compatibility
+ * decomposition (a KELVIN SIGN reads as `K`, a full-width letter as its ASCII form), accents and
+ * other combining marks removed, control, format and default-ignorable characters (zero-width
+ * joiners, direction marks, a soft hyphen) removed, case folded through upper case (`ß` and `ẞ` both read `ss`, a
+ * final `ς` reads `σ`), and surrounding spaces trimmed.
+ */
+export declare function FoldIdentifier(name: string): string;
+/**
+ * Whether a reference as written may name `fieldName` on some database: by the rule
+ * `IdentifierMatches` states, or when both fold to the same form ({@link FoldIdentifier}). Looser
+ * than any collation, so a security check that refuses on it never lets through a reference the
+ * database would resolve to the field.
+ */
+export declare function ReferenceMayNameField(reference: string, fieldName: string): boolean;
+/** The message for a whole-row construct refused for a user carrying field denials. */
+export declare function FieldSecurityWholeRowMessage(construct: string, entityName: string): string;
+/** The message for SQL that could not be read well enough to check against field permissions. */
+export declare function FieldSecurityUnresolvableSQLMessage(entityName: string): string;
+//# sourceMappingURL=fieldSecuritySQLGate.d.ts.map

package/dist/generic/fieldSecuritySQLGate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fieldSecuritySQLGate.d.ts","sourceRoot":"","sources":["../../src/generic/fieldSecuritySQLGate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsC,mBAAmB,EAAqB,MAAM,wBAAwB,CAAC;AAEpH,OAAO,EAAkC,UAAU,EAAE,kBAAkB,EAA6B,MAAM,cAAc,CAAC;AACzH,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C,+DAA+D;AAC/D,MAAM,MAAM,0BAA0B,GAAG,aAAa,GAAG,UAAU,GAAG,cAAc,GAAG,iBAAiB,CAAC;AAEzG,oFAAoF;AACpF,MAAM,WAAW,sBAAsB;IACnC,IAAI,EAAE,0BAA0B,CAAC;IACjC;;;;;OAKG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,2FAA2F;IAC3F,MAAM,EAAE,UAAU,GAAG,IAAI,CAAC;CAC7B;AAED,sFAAsF;AACtF,MAAM,WAAW,uBAAuB;IACpC,uBAAuB;IACvB,IAAI,EAAE,QAAQ,CAAC;IACf,wEAAwE;IACxE,OAAO,EAAE,mBAAmB,CAAC;IAC7B,kGAAkG;IAClG,OAAO,EAAE,SAAS,UAAU,EAAE,CAAC;IAC/B;;;OAGG;IACH,YAAY,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;IACjC,0GAA0G;IAC1G,YAAY,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;IACrC;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;CACpC;AAyFD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AACH,qBAAa,oBAAoB;IAC7B;;;;;OAKG;WACW,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,OAAO,EAAE,uBAAuB,GAAG,sBAAsB,GAAG,IAAI;IA6B5H;;;;;;OAMG;WACW,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,OAAO,EAAE,uBAAuB,GAAG,sBAAsB,GAAG,IAAI;IAIpI;;;;OAIG;WACW,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,OAAO,EAAE,uBAAuB,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;IAOvH;;;;;;;;OAQG;WACW,sBAAsB,CAChC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,QAAQ,EACd,OAAO,EAAE,SAAS,UAAU,EAAE,EAC9B,OAAO,EAAE,mBAAmB,EAC5B,YAAY,CAAC,EAAE,SAAS,UAAU,EAAE,EACpC,kBAAkB,SAAU,GAC7B,IAAI;IASP,yDAAyD;WAC3C,iBAAiB,CAAC,SAAS,EAAE,sBAAsB,EAAE,UAAU,EAAE,MAAM,GAAG,kBAAkB;IAW1G;;;;;;;;OAQG;WACW,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,GAAG,SAAS,EAAE,IAAI,EAAE,QAAQ,GAAG,IAAI,GAAG,SAAS,GAAG,kBAAkB,GAAG,IAAI;IASxJ;;;;;;;OAOG;WACW,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,OAAO,EAAE,SAAS,UAAU,EAAE,EAAE,OAAO,EAAE,mBAAmB,GAAG,UAAU,EAAE,GAAG,IAAI;IAiBjJ,mFAAmF;WACrE,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,UAAU,GAAG,IAAI,GAAG,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO;IAS5G;;;;;;;;OAQG;WACW,wBAAwB,CAAC,OAAO,EAAE,SAAS,UAAU,EAAE,GAAG,IAAI,GAAG,SAAS,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO;IAIlH;;;;OAIG;WACW,uBAAuB,CAAC,OAAO,EAAE,SAAS,UAAU,EAAE,GAAG,IAAI,GAAG,SAAS,EAAE,IAAI,EAAE,QAAQ,GAAG,MAAM;IAShH,2FAA2F;IAC3F,OAAO,CAAC,MAAM,CAAC,oBAAoB;IAuBnC,gEAAgE;IAChE,OAAO,CAAC,MAAM,CAAC,qBAAqB;IAYpC;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,iBAAiB;IAqBhC,4EAA4E;IAC5E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAQ;IAEzD,iFAAiF;IACjF,OAAO,CAAC,MAAM,CAAC,kBAAkB;IAKjC;;;;;OAKG;IACH,OAAO,CAAC,MAAM,CAAC,kBAAkB;IAgBjC;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,iBAAiB;IAiBhC;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,kBAAkB;IAWjC;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,MAAM,CAAC,uBAAuB;IAWtC,6EAA6E;IAC7E,OAAO,CAAC,MAAM,CAAC,OAAO;IAiCtB,iFAAiF;IACjF,OAAO,CAAC,MAAM,CAAC,eAAe;IAQ9B,yFAAyF;IACzF,OAAO,CAAC,MAAM,CAAC,aAAa;IAiB5B,qCAAqC;IACrC,OAAO,CAAC,MAAM,CAAC,IAAI;IAQnB;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,qBAAqB;IAQpC,4FAA4F;IAC5F,OAAO,CAAC,MAAM,CAAC,kBAAkB;IAOjC,8FAA8F;IAC9F,OAAO,CAAC,MAAM,CAAC,cAAc;IAQ7B;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ;IAiBvB,iGAAiG;IACjG,OAAO,CAAC,MAAM,CAAC,cAAc;IAM7B;;;;;OAKG;IACH,OAAO,CAAC,MAAM,CAAC,mBAAmB;IAclC;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,gBAAgB;IAa/B,8CAA8C;IAC9C,OAAO,CAAC,MAAM,CAAC,kBAAkB;IAIjC,yDAAyD;IACzD,OAAO,CAAC,MAAM,CAAC,YAAY;IAM3B;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,eAAe;IAY9B;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ;IAavB,+EAA+E;IAC/E,OAAO,CAAC,MAAM,CAAC,YAAY;IAc3B,iEAAiE;IACjE,OAAO,CAAC,MAAM,CAAC,YAAY;IAS3B;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,mBAAmB;IAalC,mFAAmF;IACnF,OAAO,CAAC,MAAM,CAAC,eAAe;IAS9B,8FAA8F;IAC9F,OAAO,CAAC,MAAM,CAAC,mBAAmB;IAalC;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,aAAa;IAU5B;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,kBAAkB;IAwBjC,8CAA8C;IAC9C,OAAO,CAAC,MAAM,CAAC,qBAAqB;IAWpC,iEAAiE;IACjE,OAAO,CAAC,MAAM,CAAC,mBAAmB;IAelC;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,aAAa;IAmB5B;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,sBAAsB;IAerC,oEAAoE;IACpE,OAAO,CAAC,MAAM,CAAC,WAAW;IAM1B,uEAAuE;IACvE,OAAO,CAAC,MAAM,CAAC,aAAa;IAM5B;;;;;;;;;;OAUG;WACW,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,GAAG,MAAM;IAKjG,iEAAiE;IACjE,OAAO,CAAC,MAAM,CAAC,YAAY;IAO3B,OAAO,CAAC,MAAM,CAAC,MAAM;IAIrB,OAAO,CAAC,MAAM,CAAC,MAAM;IAIrB,OAAO,CAAC,MAAM,CAAC,QAAQ;IAIvB,4EAA4E;IAC5E,OAAO,CAAC,MAAM,CAAC,aAAa;CAe/B;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAEnF;AAED,uFAAuF;AACvF,wBAAgB,4BAA4B,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAE1F;AAED,iGAAiG;AACjG,wBAAgB,mCAAmC,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE9E"}