@neohm/nestend 5.0.1 → 6.0.0

package/dist/admin/libraries/client.user.data.processor.js

@@ -11,6 +11,7 @@ const access_revocation_1 = require("../../auth/utilities/access.revocation");
 const tenant_user_entity_1 = require("../../auth/entities/tenant.user.entity");
 const user_role_entity_1 = require("../../auth/entities/user.role.entity");
 const tenant_access_1 = require("../../auth/utilities/tenant.access");
+const role_catalogue_1 = require("../../auth/utilities/role.catalogue");
 const system_role_entity_1 = require("../../auth/entities/system.role.entity");
 const audit_action_enum_1 = require("../../common/enums/audit.action.enum");
 const entity_constants_1 = require("../../constants/entity.constants");
@@ -88,10 +89,12 @@ class ClientUserDataProcessor extends user_data_processor_1.UserDataProcessor {
         const heldInTenant = held
             .filter((grant) => grant.tenant_id === this.payload.tenant_id)
             .map((grant) => grant.role_id);
+        const hierarchy = await role_catalogue_1.RoleCatalogue.load(user_entity_1.UserEntity.getRepository().manager);
         const required = tenant_role_policy_1.TenantRolePolicy.tenantUserSaveRole({
-            grantsPrivileged: tenant_role_policy_1.TenantRolePolicy.newPrivilegedGrants(roles, heldInTenant).length > 0,
+            grantsPrivileged: tenant_role_policy_1.TenantRolePolicy.newPrivilegedGrants(roles, hierarchy, heldInTenant)
+                .length > 0,
             emailChanged: tenant_role_policy_1.TenantRolePolicy.emailChanged(this.existing?.email, this.existing ? this.payload.email : undefined),
-            holdsPrivileged: held.some((grant) => tenant_role_policy_1.TenantRolePolicy.isPrivileged(grant.role?.identifier)),
+            holdsPrivileged: held.some((grant) => tenant_role_policy_1.TenantRolePolicy.isPrivileged(grant.role, hierarchy)),
         });
         admin_access_service_1.AdminAccessService.assertHolds(this.access, required, 'Granting a privileged tenant role, or changing the email of an account holding one,');
     }

package/dist/admin/libraries/client.user.data.processor.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.user.data.processor.js","sourceRoot":"","sources":["../../../src/admin/libraries/client.user.data.processor.ts"],"names":[],"mappings":";;;AAAA,2CAAwC;AACxC,qCAA4C;AAC5C,+DAA0D;AAC1D,iEAA6D;AAC7D,oEAA2D;AAI3D,wEAAkE;AAClE,8EAA0E;AAG1E,+EAA0E;AAC1E,2EAAsE;AACtE,sEAAkE;AAClE,+EAA0E;AAE1E,4EAAmE;AACnE,uEAAuE;AACvE,2EAAsE;AACtE,0DAAsD;AACtD,wEAAmE;AAmBnE,MAAa,uBAAwB,SAAQ,uCAAiB;IAO5D,YACmB,MAAgC,EAChC,aAA4B,EAC5B,0BAAsD;QAEvE,KAAK,EAAE,CAAC;QAJS,WAAM,GAAN,MAAM,CAA0B;QAChC,kBAAa,GAAb,aAAa,CAAe;QAC5B,+BAA0B,GAA1B,0BAA0B,CAA4B;QARxD,WAAM,GAAG,IAAI,eAAM,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC;QAE3D,WAAM,GAAwB,IAAI,CAAC;QACnC,aAAQ,GAAsB,IAAI,CAAC;IAQ3C,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAyB;QACrC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;IACrB,CAAC;IAEO,KAAK,CAAC,QAAQ;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAE/B,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,QAAQ,GAAG,MAAM,wBAAU,CAAC,OAAO,CAAC;gBACvC,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,yBAAQ,CAAC,WAAW,EAAE;aACvD,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,QAAQ;gBAChB,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,mCAAmC,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC5B,IAAI,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAGnE,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9D,MAAM,IAAI,CAAC,eAAe,CACxB,IAAI,CAAC,OAAO,CAAC,OAAO,EACpB,IAAI,CAAC,OAAO,CAAC,YAAY,EACzB,SAAS,EACT,MAAM,CACP,CAAC;QACF,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAEzE,IAAI,CAAC,iCAAiC,EAAE,CAAC;QACzC,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IAEO,KAAK,CAAC,cAAc;QAC1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC3E,IAAI,CAAC,MAAM;YACT,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,8BAA8B,CAAC,CAAC;QAEnE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,MAAc;QAC7C,MAAM,QAAQ,GAAG,MAAM,qCAAgB,CAAC,QAAQ,CAAC;YAC/C,OAAO,EAAE,MAAM;YACf,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;SAClC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ;YACX,IAAI,CAAC,cAAc,CACjB,WAAW,EACX,0CAA0C,CAC3C,CAAC;IACN,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,OAA6B,EAC7B,KAAa;QAEb,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;QAClD,IAAI,CAAC,aAAa,CAAC,MAAM;YAAE,OAAO,EAAE,CAAC;QAErC,MAAM,KAAK,GAAG,MAAM,qCAAgB,CAAC,IAAI,CAAC;YACxC,KAAK,EAAE,EAAE,EAAE,EAAE,IAAA,YAAE,EAAC,aAAa,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE;SAClD,CAAC,CAAC;QACH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAE3D,KAAK,MAAM,MAAM,IAAI,aAAa;YAChC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC;gBAC3B,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,SAAS,MAAM,yBAAyB,CAAC,CAAC;QACzE,OAAO,KAAK,CAAC;IACf,CAAC;IAGO,KAAK,CAAC,SAAS,CAAC,KAAyB;QAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ;YACxB,CAAC,CAAC,MAAM,iCAAc,CAAC,IAAI,CAAC;gBACxB,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;gBACpC,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;aAC1B,CAAC;YACJ,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,YAAY,GAAG,IAAI;aACtB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;aAC7D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAEjC,MAAM,QAAQ,GAAG,qCAAgB,CAAC,kBAAkB,CAAC;YACnD,gBAAgB,EACd,qCAAgB,CAAC,mBAAmB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC;YACtE,YAAY,EAAE,qCAAgB,CAAC,YAAY,CACzC,IAAI,CAAC,QAAQ,EAAE,KAAK,EACpB,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAC/C;YACD,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CACnC,qCAAgB,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,CAAC,CACtD;SACF,CAAC,CAAC;QACH,yCAAkB,CAAC,WAAW,CAC5B,IAAI,CAAC,MAAM,EACX,QAAQ,EACR,qFAAqF,CACtF,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,IAAI;QAChB,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,MAAM;QAClB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC;QAE1B,MAAM,QAAQ,GAAG,MAAM,4BAAW,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,wBAAU,CAAC,MAAM,CAAC;YAC7B,SAAS,EAAE,yBAAQ,CAAC,WAAW;YAC/B,eAAe,EAAE,IAAI,CAAC,SAAS;YAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ;YACR,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;SAC5B,CAAC,CAAC;QAGH,MAAM,wBAAU,CAAC,aAAa,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACjE,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,MAAM,4BAAY,CAAC,IAAI,CACrB,GAAG,EACH,IAAI,CAAC,EAAE,EACP,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,QAAQ,IAAI,EAAE,CACpB,CAAC;YACF,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE;gBAChC,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE;aAC9B,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAE5B,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,IAAgB;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC;QAC1B,MAAM,MAAM,GAAG,wBAAU,CAAC,IAAI,CAAC,IAAI,EAAE,uCAAiB,CAAC,OAAO,CAAC,CAAC;QAChE,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC;QAC9B,MAAM,YAAY,GAAG,qCAAgB,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAE3E,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC;QAC5C,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,CAAC;QAC3D,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC;QAC5C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;QAEzC,IAAI,YAAY;YAAE,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAEhD,MAAM,wBAAU,CAAC,aAAa,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACjE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YACxD,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAErB,IAAI,IAAI,CAAC,QAAQ;gBACf,MAAM,4BAAY,CAAC,cAAc,CAC/B,GAAG,EACH,IAAI,CAAC,EAAE,EACP,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,QAAQ,CACd,CAAC;YACJ,IAAI,YAAY,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;gBAC7C,MAAM,oCAAgB,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YACxD,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE;gBAClC,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,eAAe,EAAE,UAAU;gBAC3B,QAAQ,EAAE,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;gBAC9C,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjD,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,GAAkB,EAAE,MAAc;QAC1D,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,iCAAc,EAAE;YAC9C,OAAO,EAAE,MAAM;YACf,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;SAClC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,CAAC;IAEO,KAAK,CACX,GAAkB,EAClB,IAAgB,EAChB,MAAsC,EACtC,OAAgC;QAEhC,OAAO,wBAAU,CAAC,MAAM,CAAC,GAAG,EAAE;YAC5B,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YACvB,UAAU,EAAE,sCAAmB,CAAC,IAAI;YACpC,QAAQ,EAAE,IAAI,CAAC,EAAE;YACjB,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,+BAAW,CAAC,MAAM,CAAC,CAAC,CAAC,+BAAW,CAAC,MAAM;YACxD,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,wBAAU,CAAC,IAAI,CAAC,IAAI,EAAE,uCAAiB,CAAC,OAAO,CAAC;YAC1D,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAQO,KAAK,CAAC,UAAU,CAAC,IAAgB;QAEvC,MAAM,IAAI,GAA+B;YACvC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU,EAAE,IAAI,CAAC,KAAK;YACtB,WAAW,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,EAAE;YACpC,YAAY,EAAE,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE;SAC5C,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,0BAA0B,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,wDAAwD,IAAI,CAAC,KAAK,KAAM,KAAe,CAAC,OAAO,EAAE,CAClG,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AArPD,0DAqPC"}
+{"version":3,"file":"client.user.data.processor.js","sourceRoot":"","sources":["../../../src/admin/libraries/client.user.data.processor.ts"],"names":[],"mappings":";;;AAAA,2CAAwC;AACxC,qCAA4C;AAC5C,+DAA0D;AAC1D,iEAA6D;AAC7D,oEAA2D;AAI3D,wEAAkE;AAClE,8EAA0E;AAG1E,+EAA0E;AAC1E,2EAAsE;AACtE,sEAAkE;AAClE,wEAAoE;AACpE,+EAA0E;AAE1E,4EAAmE;AACnE,uEAAuE;AACvE,2EAAsE;AACtE,0DAAsD;AACtD,wEAAmE;AAmBnE,MAAa,uBAAwB,SAAQ,uCAAiB;IAO5D,YACmB,MAAgC,EAChC,aAA4B,EAC5B,0BAAsD;QAEvE,KAAK,EAAE,CAAC;QAJS,WAAM,GAAN,MAAM,CAA0B;QAChC,kBAAa,GAAb,aAAa,CAAe;QAC5B,+BAA0B,GAA1B,0BAA0B,CAA4B;QARxD,WAAM,GAAG,IAAI,eAAM,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC;QAE3D,WAAM,GAAwB,IAAI,CAAC;QACnC,aAAQ,GAAsB,IAAI,CAAC;IAQ3C,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAyB;QACrC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;IACrB,CAAC;IAEO,KAAK,CAAC,QAAQ;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAE/B,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,QAAQ,GAAG,MAAM,wBAAU,CAAC,OAAO,CAAC;gBACvC,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,yBAAQ,CAAC,WAAW,EAAE;aACvD,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,QAAQ;gBAChB,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,mCAAmC,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC5B,IAAI,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAGnE,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9D,MAAM,IAAI,CAAC,eAAe,CACxB,IAAI,CAAC,OAAO,CAAC,OAAO,EACpB,IAAI,CAAC,OAAO,CAAC,YAAY,EACzB,SAAS,EACT,MAAM,CACP,CAAC;QACF,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAEzE,IAAI,CAAC,iCAAiC,EAAE,CAAC;QACzC,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IAEO,KAAK,CAAC,cAAc;QAC1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC3E,IAAI,CAAC,MAAM;YACT,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,8BAA8B,CAAC,CAAC;QAEnE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,MAAc;QAC7C,MAAM,QAAQ,GAAG,MAAM,qCAAgB,CAAC,QAAQ,CAAC;YAC/C,OAAO,EAAE,MAAM;YACf,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;SAClC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ;YACX,IAAI,CAAC,cAAc,CACjB,WAAW,EACX,0CAA0C,CAC3C,CAAC;IACN,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,OAA6B,EAC7B,KAAa;QAEb,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;QAClD,IAAI,CAAC,aAAa,CAAC,MAAM;YAAE,OAAO,EAAE,CAAC;QAErC,MAAM,KAAK,GAAG,MAAM,qCAAgB,CAAC,IAAI,CAAC;YACxC,KAAK,EAAE,EAAE,EAAE,EAAE,IAAA,YAAE,EAAC,aAAa,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE;SAClD,CAAC,CAAC;QACH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAE3D,KAAK,MAAM,MAAM,IAAI,aAAa;YAChC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC;gBAC3B,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,SAAS,MAAM,yBAAyB,CAAC,CAAC;QACzE,OAAO,KAAK,CAAC;IACf,CAAC;IAGO,KAAK,CAAC,SAAS,CAAC,KAAyB;QAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ;YACxB,CAAC,CAAC,MAAM,iCAAc,CAAC,IAAI,CAAC;gBACxB,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;gBACpC,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;aAC1B,CAAC;YACJ,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,YAAY,GAAG,IAAI;aACtB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;aAC7D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAEjC,MAAM,SAAS,GAAG,MAAM,8BAAa,CAAC,IAAI,CACxC,wBAAU,CAAC,aAAa,EAAE,CAAC,OAAO,CACnC,CAAC;QACF,MAAM,QAAQ,GAAG,qCAAgB,CAAC,kBAAkB,CAAC;YACnD,gBAAgB,EACd,qCAAgB,CAAC,mBAAmB,CAAC,KAAK,EAAE,SAAS,EAAE,YAAY,CAAC;iBACjE,MAAM,GAAG,CAAC;YACf,YAAY,EAAE,qCAAgB,CAAC,YAAY,CACzC,IAAI,CAAC,QAAQ,EAAE,KAAK,EACpB,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAC/C;YACD,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CACnC,qCAAgB,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CACrD;SACF,CAAC,CAAC;QACH,yCAAkB,CAAC,WAAW,CAC5B,IAAI,CAAC,MAAM,EACX,QAAQ,EACR,qFAAqF,CACtF,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,IAAI;QAChB,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,MAAM;QAClB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC;QAE1B,MAAM,QAAQ,GAAG,MAAM,4BAAW,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,wBAAU,CAAC,MAAM,CAAC;YAC7B,SAAS,EAAE,yBAAQ,CAAC,WAAW;YAC/B,eAAe,EAAE,IAAI,CAAC,SAAS;YAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ;YACR,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;SAC5B,CAAC,CAAC;QAGH,MAAM,wBAAU,CAAC,aAAa,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACjE,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,MAAM,4BAAY,CAAC,IAAI,CACrB,GAAG,EACH,IAAI,CAAC,EAAE,EACP,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,QAAQ,IAAI,EAAE,CACpB,CAAC;YACF,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE;gBAChC,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE;aAC9B,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAE5B,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,IAAgB;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC;QAC1B,MAAM,MAAM,GAAG,wBAAU,CAAC,IAAI,CAAC,IAAI,EAAE,uCAAiB,CAAC,OAAO,CAAC,CAAC;QAChE,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC;QAC9B,MAAM,YAAY,GAAG,qCAAgB,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAE3E,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC;QAC5C,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,CAAC;QAC3D,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC;QAC5C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;QAEzC,IAAI,YAAY;YAAE,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAEhD,MAAM,wBAAU,CAAC,aAAa,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACjE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YACxD,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAErB,IAAI,IAAI,CAAC,QAAQ;gBACf,MAAM,4BAAY,CAAC,cAAc,CAC/B,GAAG,EACH,IAAI,CAAC,EAAE,EACP,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,QAAQ,CACd,CAAC;YACJ,IAAI,YAAY,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;gBAC7C,MAAM,oCAAgB,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YACxD,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE;gBAClC,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,eAAe,EAAE,UAAU;gBAC3B,QAAQ,EAAE,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;gBAC9C,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjD,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,GAAkB,EAAE,MAAc;QAC1D,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,iCAAc,EAAE;YAC9C,OAAO,EAAE,MAAM;YACf,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;SAClC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,CAAC;IAEO,KAAK,CACX,GAAkB,EAClB,IAAgB,EAChB,MAAsC,EACtC,OAAgC;QAEhC,OAAO,wBAAU,CAAC,MAAM,CAAC,GAAG,EAAE;YAC5B,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YACvB,UAAU,EAAE,sCAAmB,CAAC,IAAI;YACpC,QAAQ,EAAE,IAAI,CAAC,EAAE;YACjB,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,+BAAW,CAAC,MAAM,CAAC,CAAC,CAAC,+BAAW,CAAC,MAAM;YACxD,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,wBAAU,CAAC,IAAI,CAAC,IAAI,EAAE,uCAAiB,CAAC,OAAO,CAAC;YAC1D,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAQO,KAAK,CAAC,UAAU,CAAC,IAAgB;QAEvC,MAAM,IAAI,GAA+B;YACvC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU,EAAE,IAAI,CAAC,KAAK;YACtB,WAAW,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,EAAE;YACpC,YAAY,EAAE,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE;SAC5C,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,0BAA0B,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,wDAAwD,IAAI,CAAC,KAAK,KAAM,KAAe,CAAC,OAAO,EAAE,CAClG,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AAzPD,0DAyPC"}

package/dist/admin/libraries/permission.data.processor.d.ts

@@ -0,0 +1,16 @@
+import { Repository } from 'typeorm';
+import { CatalogueDataProcessor } from './catalogue.data.processor';
+import { AdminAuthenticatedAccess } from '../../auth/types/auth.types';
+import { PermissionEntity } from '../../auth/entities/permission.entity';
+import { AddPermissionDto } from '../dtos/add.permission.dto';
+export declare class PermissionDataProcessor extends CatalogueDataProcessor<PermissionEntity> {
+    private readonly access;
+    protected readonly label = "permission";
+    protected payload: AddPermissionDto;
+    constructor(access: AdminAuthenticatedAccess);
+    protected repository(): Repository<PermissionEntity>;
+    process(payload: AddPermissionDto): Promise<PermissionEntity>;
+    private validate;
+    private set;
+}
+//# sourceMappingURL=permission.data.processor.d.ts.map

package/dist/admin/libraries/permission.data.processor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission.data.processor.d.ts","sourceRoot":"","sources":["../../../src/admin/libraries/permission.data.processor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAIzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAc9D,qBAAa,uBAAwB,SAAQ,sBAAsB,CAAC,gBAAgB,CAAC;IAIvE,OAAO,CAAC,QAAQ,CAAC,MAAM;IAHnC,SAAS,CAAC,QAAQ,CAAC,KAAK,gBAAgB;IACxC,SAAS,CAAC,OAAO,EAAE,gBAAgB,CAAC;gBAEP,MAAM,EAAE,wBAAwB;IAI7D,SAAS,CAAC,UAAU,IAAI,UAAU,CAAC,gBAAgB,CAAC;IAI9C,OAAO,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;YAMrD,QAAQ;YAcR,GAAG;CA0BlB"}

package/dist/admin/libraries/permission.data.processor.js

@@ -0,0 +1,68 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PermissionDataProcessor = void 0;
+const catalogue_data_processor_1 = require("./catalogue.data.processor");
+const permission_entity_1 = require("../../auth/entities/permission.entity");
+const scope_entity_1 = require("../../auth/entities/scope.entity");
+const audit_action_enum_1 = require("../../common/enums/audit.action.enum");
+const entity_constants_1 = require("../../constants/entity.constants");
+const admin_audit_1 = require("../utilities/admin.audit");
+const AUDITED = [
+    'scope_id',
+    'identifier',
+    'name',
+    'description',
+];
+class PermissionDataProcessor extends catalogue_data_processor_1.CatalogueDataProcessor {
+    constructor(access) {
+        super();
+        this.access = access;
+        this.label = 'permission';
+    }
+    repository() {
+        return permission_entity_1.PermissionEntity.getRepository();
+    }
+    async process(payload) {
+        this.payload = payload;
+        await this.validate();
+        return this.set();
+    }
+    async validate() {
+        const body = this.payload;
+        await this.loadExisting(body.id);
+        this.assertImmutable('identifier', body.identifier);
+        this.assertImmutable('scope_id', body.scope_id);
+        if (this.isNew) {
+            await this.assertUnique('identifier', body.identifier, body.id);
+            if (!(await scope_entity_1.ScopeEntity.existsBy({ id: body.scope_id })))
+                this.setColumnError('scope_id', 'No scope exists for this id');
+        }
+        this.raiseExceptionOnValidationFailure();
+    }
+    async set() {
+        const body = this.payload;
+        const actor = this.access.user;
+        const before = admin_audit_1.AdminAudit.pick(this.existing, AUDITED);
+        const permission = this.existing ?? permission_entity_1.PermissionEntity.create({ created_by: actor.id });
+        if (this.existing)
+            permission.updated_by = actor.id;
+        permission.scope_id = body.scope_id;
+        permission.identifier = body.identifier;
+        permission.name = body.name;
+        permission.description = body.description ?? permission.description ?? '';
+        await this.transaction(async (trx) => {
+            await trx.save(permission);
+            await admin_audit_1.AdminAudit.record(trx, {
+                actor,
+                sourceType: entity_constants_1.baseEntityConstants.permission,
+                sourceId: permission.id,
+                action: before ? audit_action_enum_1.AuditAction.UPDATE : audit_action_enum_1.AuditAction.CREATE,
+                oldValue: before,
+                newValue: admin_audit_1.AdminAudit.pick(permission, AUDITED),
+            });
+        });
+        return permission;
+    }
+}
+exports.PermissionDataProcessor = PermissionDataProcessor;
+//# sourceMappingURL=permission.data.processor.js.map

package/dist/admin/libraries/permission.data.processor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission.data.processor.js","sourceRoot":"","sources":["../../../src/admin/libraries/permission.data.processor.ts"],"names":[],"mappings":";;;AACA,yEAAoE;AAEpE,6EAAyE;AACzE,mEAA+D;AAC/D,4EAAmE;AACnE,uEAAuE;AAEvE,0DAAsD;AAEtD,MAAM,OAAO,GAA+B;IAC1C,UAAU;IACV,YAAY;IACZ,MAAM;IACN,aAAa;CACd,CAAC;AAMF,MAAa,uBAAwB,SAAQ,iDAAwC;IAInF,YAA6B,MAAgC;QAC3D,KAAK,EAAE,CAAC;QADmB,WAAM,GAAN,MAAM,CAA0B;QAH1C,UAAK,GAAG,YAAY,CAAC;IAKxC,CAAC;IAES,UAAU;QAClB,OAAO,oCAAgB,CAAC,aAAa,EAAE,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAyB;QACrC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;IACpB,CAAC;IAEO,KAAK,CAAC,QAAQ;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC;QAE1B,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACpD,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YAChE,IAAI,CAAC,CAAC,MAAM,0BAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACtD,IAAI,CAAC,cAAc,CAAC,UAAU,EAAE,6BAA6B,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,CAAC,iCAAiC,EAAE,CAAC;IAC3C,CAAC;IAEO,KAAK,CAAC,GAAG;QACf,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC;QAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;QAC/B,MAAM,MAAM,GAAG,wBAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACvD,MAAM,UAAU,GACd,IAAI,CAAC,QAAQ,IAAI,oCAAgB,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QAErE,IAAI,IAAI,CAAC,QAAQ;YAAE,UAAU,CAAC,UAAU,GAAG,KAAK,CAAC,EAAE,CAAC;QACpD,UAAU,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QACpC,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QACxC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QAC5B,UAAU,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,UAAU,CAAC,WAAW,IAAI,EAAE,CAAC;QAE1E,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACnC,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC3B,MAAM,wBAAU,CAAC,MAAM,CAAC,GAAG,EAAE;gBAC3B,KAAK;gBACL,UAAU,EAAE,sCAAmB,CAAC,UAAU;gBAC1C,QAAQ,EAAE,UAAU,CAAC,EAAE;gBACvB,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,+BAAW,CAAC,MAAM,CAAC,CAAC,CAAC,+BAAW,CAAC,MAAM;gBACxD,QAAQ,EAAE,MAAM;gBAChB,QAAQ,EAAE,wBAAU,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC;aAC/C,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,OAAO,UAAU,CAAC;IACpB,CAAC;CACF;AA1DD,0DA0DC"}

package/dist/admin/libraries/permission.list.processor.d.ts

@@ -0,0 +1,11 @@
+import { CommonListProcessor } from '../../common/libraries/common.list.processor';
+import { CommonListFilterConfig } from '../../common/types/list.types';
+import { ListFilterService } from '../../common/services/list.filter.service';
+import { PermissionListDto } from '../dtos/permission.list.dto';
+export declare class PermissionListProcessor extends CommonListProcessor {
+    protected readonly listFilterService: ListFilterService;
+    protected config: CommonListFilterConfig;
+    constructor(listFilterService: ListFilterService);
+    process(payload: PermissionListDto): Promise<import("../../common/types/list.types").CommonListResult>;
+}
+//# sourceMappingURL=permission.list.processor.d.ts.map

package/dist/admin/libraries/permission.list.processor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission.list.processor.d.ts","sourceRoot":"","sources":["../../../src/admin/libraries/permission.list.processor.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,8CAA8C,CAAC;AACnF,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAC9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAGhE,qBAAa,uBAAwB,SAAQ,mBAAmB;IA0BlD,SAAS,CAAC,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB;IAzBnE,SAAS,CAAC,MAAM,EAAE,sBAAsB,CAuBtC;gBAE6B,iBAAiB,EAAE,iBAAiB;IAI7D,OAAO,CAAC,OAAO,EAAE,iBAAiB;CAIzC"}

package/dist/admin/libraries/permission.list.processor.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PermissionListProcessor = void 0;
+const sort_direction_enum_1 = require("../../common/enums/sort.direction.enum");
+const filter_value_type_enum_1 = require("../../common/enums/filter.value.type.enum");
+const common_list_processor_1 = require("../../common/libraries/common.list.processor");
+class PermissionListProcessor extends common_list_processor_1.CommonListProcessor {
+    constructor(listFilterService) {
+        super();
+        this.listFilterService = listFilterService;
+        this.config = {
+            query: `sys_permissions p
+      left join sys_scopes s on s.id = p.scope_id`,
+            columns: [
+                { key: 'p.id', identifier: 'id', type: filter_value_type_enum_1.FilterValueTypeEnum.UUID },
+                { key: 'p.identifier', identifier: 'identifier', searchable: true },
+                { key: 'p.name', identifier: 'name', searchable: true },
+                { key: 'p.description', identifier: 'description', searchable: true },
+                {
+                    key: 'p.scope_id',
+                    identifier: 'scope_id',
+                    type: filter_value_type_enum_1.FilterValueTypeEnum.UUID,
+                },
+                { key: 's.identifier', identifier: 'scope_identifier', searchable: true },
+                { key: 's.name', identifier: 'scope_name' },
+                {
+                    key: 'p.created_at',
+                    identifier: 'created_at',
+                    type: filter_value_type_enum_1.FilterValueTypeEnum.DATETIME,
+                },
+            ],
+            predicates: ['p.deleted_at is null'],
+            defaultSort: { field: 'identifier', direction: sort_direction_enum_1.SortDirection.ASC },
+        };
+    }
+    async process(payload) {
+        this.payload = payload;
+        return this.handle();
+    }
+}
+exports.PermissionListProcessor = PermissionListProcessor;
+//# sourceMappingURL=permission.list.processor.js.map

package/dist/admin/libraries/permission.list.processor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission.list.processor.js","sourceRoot":"","sources":["../../../src/admin/libraries/permission.list.processor.ts"],"names":[],"mappings":";;;AAAA,gFAAuE;AACvE,sFAAgF;AAChF,wFAAmF;AAMnF,MAAa,uBAAwB,SAAQ,2CAAmB;IA0B9D,YAA+B,iBAAoC;QACjE,KAAK,EAAE,CAAC;QADqB,sBAAiB,GAAjB,iBAAiB,CAAmB;QAzBzD,WAAM,GAA2B;YACzC,KAAK,EAAE;kDACuC;YAC9C,OAAO,EAAE;gBACP,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,4CAAmB,CAAC,IAAI,EAAE;gBACjE,EAAE,GAAG,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE;gBACnE,EAAE,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE;gBACvD,EAAE,GAAG,EAAE,eAAe,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,IAAI,EAAE;gBACrE;oBACE,GAAG,EAAE,YAAY;oBACjB,UAAU,EAAE,UAAU;oBACtB,IAAI,EAAE,4CAAmB,CAAC,IAAI;iBAC/B;gBACD,EAAE,GAAG,EAAE,cAAc,EAAE,UAAU,EAAE,kBAAkB,EAAE,UAAU,EAAE,IAAI,EAAE;gBACzE,EAAE,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE;gBAC3C;oBACE,GAAG,EAAE,cAAc;oBACnB,UAAU,EAAE,YAAY;oBACxB,IAAI,EAAE,4CAAmB,CAAC,QAAQ;iBACnC;aACF;YACD,UAAU,EAAE,CAAC,sBAAsB,CAAC;YACpC,WAAW,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,mCAAa,CAAC,GAAG,EAAE;SACnE,CAAC;IAIF,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAA0B;QACtC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;IACvB,CAAC;CACF;AAlCD,0DAkCC"}

package/dist/admin/libraries/role.list.processor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role.list.processor.d.ts","sourceRoot":"","sources":["../../../src/admin/libraries/role.list.processor.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,8CAA8C,CAAC;AACnF,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAC9E,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAMpD,qBAAa,iBAAkB,SAAQ,mBAAmB;IAuB5C,SAAS,CAAC,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB;IAtBnE,SAAS,CAAC,MAAM,EAAE,sBAAsB,CAoBtC;gBAE6B,iBAAiB,EAAE,iBAAiB;IAI7D,OAAO,CAAC,OAAO,EAAE,WAAW;CAInC"}
+{"version":3,"file":"role.list.processor.d.ts","sourceRoot":"","sources":["../../../src/admin/libraries/role.list.processor.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,8CAA8C,CAAC;AACnF,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAC9E,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAOpD,qBAAa,iBAAkB,SAAQ,mBAAmB;IAoC5C,SAAS,CAAC,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB;IAnCnE,SAAS,CAAC,MAAM,EAAE,sBAAsB,CAiCtC;gBAE6B,iBAAiB,EAAE,iBAAiB;IAI7D,OAAO,CAAC,OAAO,EAAE,WAAW;CAInC"}

package/dist/admin/libraries/role.list.processor.js

@@ -9,12 +9,25 @@ class RoleListProcessor extends common_list_processor_1.CommonListProcessor {
         super();
         this.listFilterService = listFilterService;
         this.config = {
-            query: 'sys_roles r',
+            query: `sys_roles r
+      left join sys_scopes s on s.id = r.scope_id`,
             columns: [
                 { key: 'r.id', identifier: 'id', type: filter_value_type_enum_1.FilterValueTypeEnum.UUID },
                 { key: 'r.identifier', identifier: 'identifier', searchable: true },
                 { key: 'r.name', identifier: 'name', searchable: true },
                 { key: 'r.description', identifier: 'description', searchable: true },
+                {
+                    key: 'r.scope_id',
+                    identifier: 'scope_id',
+                    type: filter_value_type_enum_1.FilterValueTypeEnum.UUID,
+                },
+                { key: 's.identifier', identifier: 'scope_identifier', searchable: true },
+                { key: 's.name', identifier: 'scope_name' },
+                {
+                    key: 'r.priority',
+                    identifier: 'priority',
+                    type: filter_value_type_enum_1.FilterValueTypeEnum.NUMBER,
+                },
                 {
                     key: 'r.is_active',
                     identifier: 'is_active',

package/dist/admin/libraries/role.list.processor.js.map

@@ -1 +1 @@
-{"version":3,"file":"role.list.processor.js","sourceRoot":"","sources":["../../../src/admin/libraries/role.list.processor.ts"],"names":[],"mappings":";;;AAAA,gFAAuE;AACvE,sFAAgF;AAChF,wFAAmF;AASnF,MAAa,iBAAkB,SAAQ,2CAAmB;IAuBxD,YAA+B,iBAAoC;QACjE,KAAK,EAAE,CAAC;QADqB,sBAAiB,GAAjB,iBAAiB,CAAmB;QAtBzD,WAAM,GAA2B;YACzC,KAAK,EAAE,aAAa;YACpB,OAAO,EAAE;gBACP,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,4CAAmB,CAAC,IAAI,EAAE;gBACjE,EAAE,GAAG,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE;gBACnE,EAAE,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE;gBACvD,EAAE,GAAG,EAAE,eAAe,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,IAAI,EAAE;gBACrE;oBACE,GAAG,EAAE,aAAa;oBAClB,UAAU,EAAE,WAAW;oBACvB,IAAI,EAAE,4CAAmB,CAAC,OAAO;iBAClC;gBACD;oBACE,GAAG,EAAE,cAAc;oBACnB,UAAU,EAAE,YAAY;oBACxB,IAAI,EAAE,4CAAmB,CAAC,QAAQ;iBACnC;aACF;YACD,UAAU,EAAE,CAAC,sBAAsB,CAAC;YACpC,WAAW,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,mCAAa,CAAC,GAAG,EAAE;SAC7D,CAAC;IAIF,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAoB;QAChC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;IACvB,CAAC;CACF;AA/BD,8CA+BC"}
+{"version":3,"file":"role.list.processor.js","sourceRoot":"","sources":["../../../src/admin/libraries/role.list.processor.ts"],"names":[],"mappings":";;;AAAA,gFAAuE;AACvE,sFAAgF;AAChF,wFAAmF;AAUnF,MAAa,iBAAkB,SAAQ,2CAAmB;IAoCxD,YAA+B,iBAAoC;QACjE,KAAK,EAAE,CAAC;QADqB,sBAAiB,GAAjB,iBAAiB,CAAmB;QAnCzD,WAAM,GAA2B;YACzC,KAAK,EAAE;kDACuC;YAC9C,OAAO,EAAE;gBACP,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,4CAAmB,CAAC,IAAI,EAAE;gBACjE,EAAE,GAAG,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE;gBACnE,EAAE,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE;gBACvD,EAAE,GAAG,EAAE,eAAe,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,IAAI,EAAE;gBACrE;oBACE,GAAG,EAAE,YAAY;oBACjB,UAAU,EAAE,UAAU;oBACtB,IAAI,EAAE,4CAAmB,CAAC,IAAI;iBAC/B;gBACD,EAAE,GAAG,EAAE,cAAc,EAAE,UAAU,EAAE,kBAAkB,EAAE,UAAU,EAAE,IAAI,EAAE;gBACzE,EAAE,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE;gBAC3C;oBACE,GAAG,EAAE,YAAY;oBACjB,UAAU,EAAE,UAAU;oBACtB,IAAI,EAAE,4CAAmB,CAAC,MAAM;iBACjC;gBACD;oBACE,GAAG,EAAE,aAAa;oBAClB,UAAU,EAAE,WAAW;oBACvB,IAAI,EAAE,4CAAmB,CAAC,OAAO;iBAClC;gBACD;oBACE,GAAG,EAAE,cAAc;oBACnB,UAAU,EAAE,YAAY;oBACxB,IAAI,EAAE,4CAAmB,CAAC,QAAQ;iBACnC;aACF;YACD,UAAU,EAAE,CAAC,sBAAsB,CAAC;YACpC,WAAW,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,mCAAa,CAAC,GAAG,EAAE;SAC7D,CAAC;IAIF,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAoB;QAChC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;IACvB,CAAC;CACF;AA5CD,8CA4CC"}

package/dist/admin/libraries/system.role.data.processor.d.ts

@@ -11,6 +11,10 @@ export declare class SystemRoleDataProcessor extends CatalogueDataProcessor<Syst
     protected repository(): Repository<SystemRoleEntity>;
     process(payload: AddSystemRoleDto): Promise<SystemRoleEntity>;
     private validate;
+    private get scopeId();
+    private get priority();
+    private movesScopeTop;
+    private validatePermissions;
     private set;
 }
 //# sourceMappingURL=system.role.data.processor.d.ts.map

package/dist/admin/libraries/system.role.data.processor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"system.role.data.processor.d.ts","sourceRoot":"","sources":["../../../src/admin/libraries/system.role.data.processor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAI1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAmB/D,qBAAa,uBAAwB,SAAQ,sBAAsB,CAAC,gBAAgB,CAAC;IAIvE,OAAO,CAAC,QAAQ,CAAC,MAAM;IAHnC,SAAS,CAAC,QAAQ,CAAC,KAAK,UAAU;IAClC,SAAS,CAAC,OAAO,EAAE,gBAAgB,CAAC;gBAEP,MAAM,EAAE,wBAAwB;IAI7D,SAAS,CAAC,UAAU,IAAI,UAAU,CAAC,gBAAgB,CAAC;IAI9C,OAAO,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;YAMrD,QAAQ;YA4BR,GAAG;CAyBlB"}
+{"version":3,"file":"system.role.data.processor.d.ts","sourceRoot":"","sources":["../../../src/admin/libraries/system.role.data.processor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAM,UAAU,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAQ1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAsB/D,qBAAa,uBAAwB,SAAQ,sBAAsB,CAAC,gBAAgB,CAAC;IAIvE,OAAO,CAAC,QAAQ,CAAC,MAAM;IAHnC,SAAS,CAAC,QAAQ,CAAC,KAAK,UAAU;IAClC,SAAS,CAAC,OAAO,EAAE,gBAAgB,CAAC;gBAEP,MAAM,EAAE,wBAAwB;IAI7D,SAAS,CAAC,UAAU,IAAI,UAAU,CAAC,gBAAgB,CAAC;IAI9C,OAAO,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;YAMrD,QAAQ;IAgCtB,OAAO,KAAK,OAAO,GAIlB;IAED,OAAO,KAAK,QAAQ,GAMnB;YAGa,aAAa;YAgBb,mBAAmB;YAiCnB,GAAG;CAsClB"}

package/dist/admin/libraries/system.role.data.processor.js

@@ -1,19 +1,25 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SystemRoleDataProcessor = void 0;
+const typeorm_1 = require("typeorm");
 const catalogue_data_processor_1 = require("./catalogue.data.processor");
 const system_role_entity_1 = require("../../auth/entities/system.role.entity");
+const permission_entity_1 = require("../../auth/entities/permission.entity");
+const scope_entity_1 = require("../../auth/entities/scope.entity");
+const role_service_1 = require("../../auth/services/role.service");
+const role_default_enum_1 = require("../../auth/enums/role.default.enum");
 const global_admin_roles_enum_1 = require("../../auth/enums/global.admin.roles.enum");
 const audit_action_enum_1 = require("../../common/enums/audit.action.enum");
 const entity_constants_1 = require("../../constants/entity.constants");
 const admin_access_service_1 = require("../services/admin.access.service");
 const admin_audit_1 = require("../utilities/admin.audit");
-const tenant_role_policy_1 = require("../utilities/tenant.role.policy");
 const AUDITED = [
     'identifier',
     'name',
     'description',
     'is_active',
+    'scope_id',
+    'priority',
 ];
 class SystemRoleDataProcessor extends catalogue_data_processor_1.CatalogueDataProcessor {
     constructor(access) {
@@ -32,17 +38,67 @@ class SystemRoleDataProcessor extends catalogue_data_processor_1.CatalogueDataPr
     async validate() {
         const body = this.payload;
         await this.loadExisting(body.id);
-        if (tenant_role_policy_1.TenantRolePolicy.isReserved(body.identifier) ||
-            tenant_role_policy_1.TenantRolePolicy.isReserved(this.existing?.identifier))
-            this.setColumnError('identifier', 'This role identifier is reserved and cannot be managed through the API');
         this.assertImmutable('identifier', body.identifier);
-        if (this.isNew)
+        this.assertImmutable('scope_id', body.scope_id);
+        if (this.isNew) {
             await this.assertUnique('identifier', body.identifier, body.id);
+            if (body.scope_id && !(await scope_entity_1.ScopeEntity.existsBy({ id: body.scope_id })))
+                this.setColumnError('scope_id', 'No scope exists for this id');
+        }
+        await this.validatePermissions();
         this.raiseExceptionOnValidationFailure();
         if (this.existing &&
             body.is_active !== undefined &&
             body.is_active !== this.existing.is_active)
             admin_access_service_1.AdminAccessService.assertHolds(this.access, global_admin_roles_enum_1.GlobalAdminRoles.GLOBAL_SUPER_ADMIN, 'Activating or deactivating a tenant role');
+        if (await this.movesScopeTop())
+            admin_access_service_1.AdminAccessService.assertHolds(this.access, global_admin_roles_enum_1.GlobalAdminRoles.GLOBAL_SUPER_ADMIN, "Changing a tenant role's priority, or creating one above its scope's top role,");
+    }
+    get scopeId() {
+        return this.existing
+            ? (this.existing.scope_id ?? null)
+            : (this.payload.scope_id ?? null);
+    }
+    get priority() {
+        return (this.payload.priority ??
+            this.existing?.priority ??
+            Number(role_default_enum_1.RoleDefault.PRIORITY));
+    }
+    async movesScopeTop() {
+        if (this.existing)
+            return (this.payload.priority !== undefined &&
+                this.payload.priority !== this.existing.priority);
+        if (!this.scopeId)
+            return false;
+        const top = await system_role_entity_1.SystemRoleEntity.findOne({
+            where: { scope_id: this.scopeId, is_active: true },
+            order: { priority: 'ASC' },
+            select: { id: true, priority: true },
+        });
+        return !!top && this.priority < top.priority;
+    }
+    async validatePermissions() {
+        const permissionIds = [...new Set(this.payload.permission_ids ?? [])];
+        if (!permissionIds.length)
+            return;
+        const scopeId = this.scopeId;
+        if (!scopeId) {
+            this.setColumnError('permission_ids', 'An unscoped role carries no permissions');
+            return;
+        }
+        const [permissions, children] = await Promise.all([
+            permission_entity_1.PermissionEntity.findBy({ id: (0, typeorm_1.In)(permissionIds) }),
+            scope_entity_1.ScopeEntity.find({ where: { parent_id: scopeId }, select: { id: true } }),
+        ]);
+        const allowed = new Set([scopeId, ...children.map((child) => child.id)]);
+        const byId = new Map(permissions.map((item) => [item.id, item]));
+        for (const permissionId of permissionIds) {
+            const permission = byId.get(permissionId);
+            if (!permission)
+                this.setColumnError('permission_ids', `Permission '${permissionId}' not found`);
+            else if (!allowed.has(permission.scope_id))
+                this.setColumnError('permission_ids', `Permission '${permission.identifier}' is outside this role's scope`);
+        }
     }
     async set() {
         const body = this.payload;
@@ -52,9 +108,13 @@ class SystemRoleDataProcessor extends catalogue_data_processor_1.CatalogueDataPr
         role.name = body.name;
         role.description = body.description ?? role.description ?? '';
         role.is_active = body.is_active ?? role.is_active ?? true;
+        role.scope_id = this.scopeId;
+        role.priority = this.priority;
         role.attributes = role.attributes ?? {};
         await this.transaction(async (trx) => {
             await trx.save(role);
+            if (body.permission_ids)
+                await role_service_1.RoleService.setPermissions(trx, role.id, body.permission_ids, this.access.user.id);
             await admin_audit_1.AdminAudit.record(trx, {
                 actor: this.access.user,
                 sourceType: entity_constants_1.baseEntityConstants.systemRole,
@@ -62,6 +122,9 @@ class SystemRoleDataProcessor extends catalogue_data_processor_1.CatalogueDataPr
                 action: before ? audit_action_enum_1.AuditAction.UPDATE : audit_action_enum_1.AuditAction.CREATE,
                 oldValue: before,
                 newValue: admin_audit_1.AdminAudit.pick(role, AUDITED),
+                ...(body.permission_ids
+                    ? { context: { permission_ids: [...body.permission_ids].sort() } }
+                    : {}),
             });
         });
         return role;

package/dist/admin/libraries/system.role.data.processor.js.map

@@ -1 +1 @@
-{"version":3,"file":"system.role.data.processor.js","sourceRoot":"","sources":["../../../src/admin/libraries/system.role.data.processor.ts"],"names":[],"mappings":";;;AACA,yEAAoE;AAEpE,+EAA0E;AAC1E,sFAA4E;AAC5E,4EAAmE;AACnE,uEAAuE;AAEvE,2EAAsE;AACtE,0DAAsD;AACtD,wEAAmE;AAEnE,MAAM,OAAO,GAA+B;IAC1C,YAAY;IACZ,MAAM;IACN,aAAa;IACb,WAAW;CACZ,CAAC;AASF,MAAa,uBAAwB,SAAQ,iDAAwC;IAInF,YAA6B,MAAgC;QAC3D,KAAK,EAAE,CAAC;QADmB,WAAM,GAAN,MAAM,CAA0B;QAH1C,UAAK,GAAG,MAAM,CAAC;IAKlC,CAAC;IAES,UAAU;QAClB,OAAO,qCAAgB,CAAC,aAAa,EAAE,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAyB;QACrC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;IACpB,CAAC;IAEO,KAAK,CAAC,QAAQ;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC;QAE1B,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjC,IACE,qCAAgB,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;YAC5C,qCAAgB,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC;YAEtD,IAAI,CAAC,cAAc,CACjB,YAAY,EACZ,wEAAwE,CACzE,CAAC;QACJ,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACpD,IAAI,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAChF,IAAI,CAAC,iCAAiC,EAAE,CAAC;QAEzC,IACE,IAAI,CAAC,QAAQ;YACb,IAAI,CAAC,SAAS,KAAK,SAAS;YAC5B,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,QAAQ,CAAC,SAAS;YAE1C,yCAAkB,CAAC,WAAW,CAC5B,IAAI,CAAC,MAAM,EACX,0CAAgB,CAAC,kBAAkB,EACnC,0CAA0C,CAC3C,CAAC;IACN,CAAC;IAEO,KAAK,CAAC,GAAG;QACf,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC;QAC1B,MAAM,MAAM,GAAG,wBAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,qCAAgB,CAAC,MAAM,EAAE,CAAC;QAExD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;QAC9D,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;QAE1D,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC;QAExC,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACnC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,MAAM,wBAAU,CAAC,MAAM,CAAC,GAAG,EAAE;gBAC3B,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;gBACvB,UAAU,EAAE,sCAAmB,CAAC,UAAU;gBAC1C,QAAQ,EAAE,IAAI,CAAC,EAAE;gBACjB,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,+BAAW,CAAC,MAAM,CAAC,CAAC,CAAC,+BAAW,CAAC,MAAM;gBACxD,QAAQ,EAAE,MAAM;gBAChB,QAAQ,EAAE,wBAAU,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;aACzC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAvED,0DAuEC"}
+{"version":3,"file":"system.role.data.processor.js","sourceRoot":"","sources":["../../../src/admin/libraries/system.role.data.processor.ts"],"names":[],"mappings":";;;AAAA,qCAAyC;AACzC,yEAAoE;AAEpE,+EAA0E;AAC1E,6EAAyE;AACzE,mEAA+D;AAC/D,mEAA+D;AAC/D,0EAAiE;AACjE,sFAA4E;AAC5E,4EAAmE;AACnE,uEAAuE;AAEvE,2EAAsE;AACtE,0DAAsD;AAEtD,MAAM,OAAO,GAA+B;IAC1C,YAAY;IACZ,MAAM;IACN,aAAa;IACb,WAAW;IACX,UAAU;IACV,UAAU;CACX,CAAC;AAWF,MAAa,uBAAwB,SAAQ,iDAAwC;IAInF,YAA6B,MAAgC;QAC3D,KAAK,EAAE,CAAC;QADmB,WAAM,GAAN,MAAM,CAA0B;QAH1C,UAAK,GAAG,MAAM,CAAC;IAKlC,CAAC;IAES,UAAU;QAClB,OAAO,qCAAgB,CAAC,aAAa,EAAE,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAyB;QACrC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;IACpB,CAAC;IAEO,KAAK,CAAC,QAAQ;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC;QAE1B,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACpD,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YAChE,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,0BAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACvE,IAAI,CAAC,cAAc,CAAC,UAAU,EAAE,6BAA6B,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACjC,IAAI,CAAC,iCAAiC,EAAE,CAAC;QAEzC,IACE,IAAI,CAAC,QAAQ;YACb,IAAI,CAAC,SAAS,KAAK,SAAS;YAC5B,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,QAAQ,CAAC,SAAS;YAE1C,yCAAkB,CAAC,WAAW,CAC5B,IAAI,CAAC,MAAM,EACX,0CAAgB,CAAC,kBAAkB,EACnC,0CAA0C,CAC3C,CAAC;QACJ,IAAI,MAAM,IAAI,CAAC,aAAa,EAAE;YAC5B,yCAAkB,CAAC,WAAW,CAC5B,IAAI,CAAC,MAAM,EACX,0CAAgB,CAAC,kBAAkB,EACnC,gFAAgF,CACjF,CAAC;IACN,CAAC;IAED,IAAY,OAAO;QACjB,OAAO,IAAI,CAAC,QAAQ;YAClB,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,IAAI,CAAC;YAClC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC;IACtC,CAAC;IAED,IAAY,QAAQ;QAClB,OAAO,CACL,IAAI,CAAC,OAAO,CAAC,QAAQ;YACrB,IAAI,CAAC,QAAQ,EAAE,QAAQ;YACvB,MAAM,CAAC,+BAAW,CAAC,QAAQ,CAAC,CAC7B,CAAC;IACJ,CAAC;IAGO,KAAK,CAAC,aAAa;QACzB,IAAI,IAAI,CAAC,QAAQ;YACf,OAAO,CACL,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS;gBACnC,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,CAAC,QAAQ,CACjD,CAAC;QACJ,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAChC,MAAM,GAAG,GAAG,MAAM,qCAAgB,CAAC,OAAO,CAAC;YACzC,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE;YAClD,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;YAC1B,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;SACrC,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC/C,CAAC;IAGO,KAAK,CAAC,mBAAmB;QAC/B,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,CAAC;QACtE,IAAI,CAAC,aAAa,CAAC,MAAM;YAAE,OAAO;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC7B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,cAAc,CACjB,gBAAgB,EAChB,yCAAyC,CAC1C,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAChD,oCAAgB,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAA,YAAE,EAAC,aAAa,CAAC,EAAE,CAAC;YAClD,0BAAW,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;SAC1E,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACzE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACjE,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;YACzC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAC1C,IAAI,CAAC,UAAU;gBACb,IAAI,CAAC,cAAc,CACjB,gBAAgB,EAChB,eAAe,YAAY,aAAa,CACzC,CAAC;iBACC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC;gBACxC,IAAI,CAAC,cAAc,CACjB,gBAAgB,EAChB,eAAe,UAAU,CAAC,UAAU,gCAAgC,CACrE,CAAC;QACN,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,GAAG;QACf,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC;QAC1B,MAAM,MAAM,GAAG,wBAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,qCAAgB,CAAC,MAAM,EAAE,CAAC;QAExD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;QAC9D,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;QAE1D,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC;QAC7B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAE9B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC;QAExC,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACnC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,IAAI,IAAI,CAAC,cAAc;gBACrB,MAAM,0BAAW,CAAC,cAAc,CAC9B,GAAG,EACH,IAAI,CAAC,EAAE,EACP,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CACpB,CAAC;YACJ,MAAM,wBAAU,CAAC,MAAM,CAAC,GAAG,EAAE;gBAC3B,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;gBACvB,UAAU,EAAE,sCAAmB,CAAC,UAAU;gBAC1C,QAAQ,EAAE,IAAI,CAAC,EAAE;gBACjB,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,+BAAW,CAAC,MAAM,CAAC,CAAC,CAAC,+BAAW,CAAC,MAAM;gBACxD,QAAQ,EAAE,MAAM;gBAChB,QAAQ,EAAE,wBAAU,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;gBACxC,GAAG,CAAC,IAAI,CAAC,cAAc;oBACrB,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE;oBAClE,CAAC,CAAC,EAAE,CAAC;aACR,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAxJD,0DAwJC"}

package/dist/admin/utilities/api.key.role.policy.d.ts

@@ -0,0 +1,4 @@
+export declare class ApiKeyRolePolicy {
+    static errors(roleIds: string[], scopeIds: Set<string>): Promise<string[]>;
+}
+//# sourceMappingURL=api.key.role.policy.d.ts.map

package/dist/admin/utilities/api.key.role.policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.key.role.policy.d.ts","sourceRoot":"","sources":["../../../src/admin/utilities/api.key.role.policy.ts"],"names":[],"mappings":"AAIA,qBAAa,gBAAgB;WAMd,MAAM,CACjB,OAAO,EAAE,MAAM,EAAE,EACjB,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,GACpB,OAAO,CAAC,MAAM,EAAE,CAAC;CAsBrB"}

package/dist/admin/utilities/api.key.role.policy.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApiKeyRolePolicy = void 0;
+const typeorm_1 = require("typeorm");
+const system_role_entity_1 = require("../../auth/entities/system.role.entity");
+class ApiKeyRolePolicy {
+    static async errors(roleIds, scopeIds) {
+        const unique = [...new Set(roleIds)];
+        if (!unique.length)
+            return [];
+        const roles = await system_role_entity_1.SystemRoleEntity.findBy({
+            id: (0, typeorm_1.In)(unique),
+            is_active: true,
+        });
+        const byId = new Map(roles.map((role) => [role.id, role]));
+        const errors = [];
+        for (const roleId of unique) {
+            const role = byId.get(roleId);
+            if (!role)
+                errors.push(`Role '${roleId}' not found or inactive`);
+            else if (!role.scope_id)
+                errors.push(`Role '${role.identifier}' is unscoped; keys hold scoped roles only`);
+            else if (!scopeIds.has(role.scope_id))
+                errors.push(`Role '${role.identifier}' is outside the key's scopes`);
+        }
+        return errors;
+    }
+}
+exports.ApiKeyRolePolicy = ApiKeyRolePolicy;
+//# sourceMappingURL=api.key.role.policy.js.map

package/dist/admin/utilities/api.key.role.policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.key.role.policy.js","sourceRoot":"","sources":["../../../src/admin/utilities/api.key.role.policy.ts"],"names":[],"mappings":";;;AAAA,qCAA6B;AAC7B,+EAA0E;AAG1E,MAAa,gBAAgB;IAM3B,MAAM,CAAC,KAAK,CAAC,MAAM,CACjB,OAAiB,EACjB,QAAqB;QAErB,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,OAAO,EAAE,CAAC;QAE9B,MAAM,KAAK,GAAG,MAAM,qCAAgB,CAAC,MAAM,CAAC;YAC1C,EAAE,EAAE,IAAA,YAAE,EAAC,MAAM,CAAC;YACd,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,KAAK,MAAM,MAAM,IAAI,MAAM,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC9B,IAAI,CAAC,IAAI;gBAAE,MAAM,CAAC,IAAI,CAAC,SAAS,MAAM,yBAAyB,CAAC,CAAC;iBAC5D,IAAI,CAAC,IAAI,CAAC,QAAQ;gBACrB,MAAM,CAAC,IAAI,CACT,SAAS,IAAI,CAAC,UAAU,4CAA4C,CACrE,CAAC;iBACC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;gBACnC,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,+BAA+B,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AA/BD,4CA+BC"}

package/dist/admin/utilities/scope.grants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope.grants.d.ts","sourceRoot":"","sources":["../../../src/admin/utilities/scope.grants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAM,MAAM,SAAS,CAAC;AAM5C,qBAAa,WAAW;WACT,KAAK,CAChB,OAAO,EAAE,aAAa,EACtB,QAAQ,EAAE,MAAM,EAAE,GACjB,OAAO,CAAC,MAAM,CAAC;WAUL,YAAY,CACvB,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CAUvD"}
+{"version":3,"file":"scope.grants.d.ts","sourceRoot":"","sources":["../../../src/admin/utilities/scope.grants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAM,MAAM,SAAS,CAAC;AAW5C,qBAAa,WAAW;WACT,KAAK,CAChB,OAAO,EAAE,aAAa,EACtB,QAAQ,EAAE,MAAM,EAAE,GACjB,OAAO,CAAC,MAAM,CAAC;WAaL,YAAY,CACvB,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CAUvD"}

package/dist/admin/utilities/scope.grants.js

@@ -2,7 +2,9 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ScopeGrants = void 0;
 const typeorm_1 = require("typeorm");
+const api_key_role_entity_1 = require("../../auth/entities/api.key.role.entity");
 const api_scope_entity_1 = require("../../auth/entities/api.scope.entity");
+const user_role_entity_1 = require("../../auth/entities/user.role.entity");
 const scope_entity_1 = require("../../auth/entities/scope.entity");
 const tenant_scope_entity_1 = require("../../auth/entities/tenant.scope.entity");
 class ScopeGrants {
@@ -10,8 +12,11 @@ class ScopeGrants {
         if (!scopeIds.length)
             return 0;
         const where = { scope_id: (0, typeorm_1.In)(scopeIds) };
+        const roleWhere = { role: { scope_id: (0, typeorm_1.In)(scopeIds) } };
         return ((await manager.count(tenant_scope_entity_1.TenantScopeEntity, { where })) +
-            (await manager.count(api_scope_entity_1.ApiScopeEntity, { where })));
+            (await manager.count(api_scope_entity_1.ApiScopeEntity, { where })) +
+            (await manager.count(user_role_entity_1.UserRoleEntity, { where: roleWhere })) +
+            (await manager.count(api_key_role_entity_1.ApiKeyRoleEntity, { where: roleWhere })));
     }
     static async withChildren(manager, scopeId) {
         const children = await manager.find(scope_entity_1.ScopeEntity, {

package/dist/admin/utilities/scope.grants.js.map

@@ -1 +1 @@
-{"version":3,"file":"scope.grants.js","sourceRoot":"","sources":["../../../src/admin/utilities/scope.grants.ts"],"names":[],"mappings":";;;AAAA,qCAA4C;AAC5C,2EAAsE;AACtE,mEAA+D;AAC/D,iFAA4E;AAG5E,MAAa,WAAW;IACtB,MAAM,CAAC,KAAK,CAAC,KAAK,CAChB,OAAsB,EACtB,QAAkB;QAElB,IAAI,CAAC,QAAQ,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,EAAE,QAAQ,EAAE,IAAA,YAAE,EAAC,QAAQ,CAAC,EAAE,CAAC;QACzC,OAAO,CACL,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,uCAAiB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACnD,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,iCAAc,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CACjD,CAAC;IACJ,CAAC;IAGD,MAAM,CAAC,KAAK,CAAC,YAAY,CACvB,OAAsB,EACtB,OAAe;QAEf,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,0BAAW,EAAE;YAC/C,KAAK,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE;YAC7B,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;SACrB,CAAC,CAAC;QACH,OAAO;YACL,QAAQ,EAAE,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACzD,UAAU,EAAE,QAAQ,CAAC,MAAM;SAC5B,CAAC;IACJ,CAAC;CACF;AA3BD,kCA2BC"}
+{"version":3,"file":"scope.grants.js","sourceRoot":"","sources":["../../../src/admin/utilities/scope.grants.ts"],"names":[],"mappings":";;;AAAA,qCAA4C;AAC5C,iFAA2E;AAC3E,2EAAsE;AACtE,2EAAsE;AACtE,mEAA+D;AAC/D,iFAA4E;AAM5E,MAAa,WAAW;IACtB,MAAM,CAAC,KAAK,CAAC,KAAK,CAChB,OAAsB,EACtB,QAAkB;QAElB,IAAI,CAAC,QAAQ,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,EAAE,QAAQ,EAAE,IAAA,YAAE,EAAC,QAAQ,CAAC,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAA,YAAE,EAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACvD,OAAO,CACL,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,uCAAiB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACnD,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,iCAAc,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAChD,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,iCAAc,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;YAC3D,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,sCAAgB,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAC9D,CAAC;IACJ,CAAC;IAGD,MAAM,CAAC,KAAK,CAAC,YAAY,CACvB,OAAsB,EACtB,OAAe;QAEf,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,0BAAW,EAAE;YAC/C,KAAK,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE;YAC7B,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;SACrB,CAAC,CAAC;QACH,OAAO;YACL,QAAQ,EAAE,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACzD,UAAU,EAAE,QAAQ,CAAC,MAAM;SAC5B,CAAC;IACJ,CAAC;CACF;AA9BD,kCA8BC"}

package/dist/admin/utilities/tenant.role.policy.d.ts

@@ -1,11 +1,10 @@
 import { GlobalAdminRoles } from '../../auth/enums/global.admin.roles.enum';
+import { HierarchyRole } from '../../auth/types/rbac.types';
+import { RoleHierarchy } from '../../auth/utilities/role.hierarchy';
 export declare class TenantRolePolicy {
     static isReserved(identifier: string | null | undefined): boolean;
-    static isPrivileged(identifier: string | null | undefined): boolean;
-    static newPrivilegedGrants<R extends {
-        id: string;
-        identifier: string;
-    }>(roles: R[], heldRoleIds?: Iterable<string>): R[];
+    static isPrivileged(role: Pick<HierarchyRole, 'identifier' | 'scope_id' | 'priority'> | null | undefined, hierarchy: RoleHierarchy): boolean;
+    static newPrivilegedGrants<R extends Pick<HierarchyRole, 'id' | 'identifier' | 'scope_id' | 'priority'>>(roles: R[], hierarchy: RoleHierarchy, heldRoleIds?: Iterable<string>): R[];
     static tenantUserSaveRole(input: {
         grantsPrivileged: boolean;
         emailChanged: boolean;

package/dist/admin/utilities/tenant.role.policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenant.role.policy.d.ts","sourceRoot":"","sources":["../../../src/admin/utilities/tenant.role.policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAO5E,qBAAa,gBAAgB;IAE3B,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO;IAKjE,MAAM,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO;IAQnE,MAAM,CAAC,mBAAmB,CAAC,CAAC,SAAS;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,EACrE,KAAK,EAAE,CAAC,EAAE,EACV,WAAW,GAAE,QAAQ,CAAC,MAAM,CAAM,GACjC,CAAC,EAAE;IAYN,MAAM,CAAC,kBAAkB,CAAC,KAAK,EAAE;QAC/B,gBAAgB,EAAE,OAAO,CAAC;QAC1B,YAAY,EAAE,OAAO,CAAC;QACtB,eAAe,EAAE,OAAO,CAAC;KAC1B,GAAG,gBAAgB;IAQpB,MAAM,CAAC,YAAY,CACjB,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAClC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC9B,OAAO;CAIX"}
+{"version":3,"file":"tenant.role.policy.d.ts","sourceRoot":"","sources":["../../../src/admin/utilities/tenant.role.policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAE5E,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAKpE,qBAAa,gBAAgB;IAE3B,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO;IASjE,MAAM,CAAC,YAAY,CACjB,IAAI,EACA,IAAI,CAAC,aAAa,EAAE,YAAY,GAAG,UAAU,GAAG,UAAU,CAAC,GAC3D,IAAI,GACJ,SAAS,EACb,SAAS,EAAE,aAAa,GACvB,OAAO;IAOV,MAAM,CAAC,mBAAmB,CACxB,CAAC,SAAS,IAAI,CACZ,aAAa,EACb,IAAI,GAAG,YAAY,GAAG,UAAU,GAAG,UAAU,CAC9C,EAED,KAAK,EAAE,CAAC,EAAE,EACV,SAAS,EAAE,aAAa,EACxB,WAAW,GAAE,QAAQ,CAAC,MAAM,CAAM,GACjC,CAAC,EAAE;IAaN,MAAM,CAAC,kBAAkB,CAAC,KAAK,EAAE;QAC/B,gBAAgB,EAAE,OAAO,CAAC;QAC1B,YAAY,EAAE,OAAO,CAAC;QACtB,eAAe,EAAE,OAAO,CAAC;KAC1B,GAAG,gBAAgB;IAQpB,MAAM,CAAC,YAAY,CACjB,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAClC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC9B,OAAO;CAIX"}

package/dist/admin/utilities/tenant.role.policy.js

@@ -2,21 +2,22 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.TenantRolePolicy = void 0;
 const global_admin_roles_enum_1 = require("../../auth/enums/global.admin.roles.enum");
-const role_tier_enum_1 = require("../../auth/enums/role.tier.enum");
 const tenant_role_enum_1 = require("../../auth/enums/tenant.role.enum");
 const RESERVED = new Set(Object.values(tenant_role_enum_1.TenantRole));
 class TenantRolePolicy {
     static isReserved(identifier) {
         return !!identifier && RESERVED.has(identifier);
     }
-    static isPrivileged(identifier) {
-        if (!identifier)
+    static isPrivileged(role, hierarchy) {
+        if (!role?.identifier)
             return false;
-        return (RESERVED.has(identifier) || identifier.endsWith(`.${role_tier_enum_1.RoleTier.MANAGER}`));
+        if (RESERVED.has(role.identifier))
+            return true;
+        return !!role.scope_id && hierarchy.isTopRole(role);
     }
-    static newPrivilegedGrants(roles, heldRoleIds = []) {
+    static newPrivilegedGrants(roles, hierarchy, heldRoleIds = []) {
         const held = new Set(heldRoleIds);
-        return roles.filter((role) => !held.has(role.id) && TenantRolePolicy.isPrivileged(role.identifier));
+        return roles.filter((role) => !held.has(role.id) && TenantRolePolicy.isPrivileged(role, hierarchy));
     }
     static tenantUserSaveRole(input) {
         if (input.grantsPrivileged)

package/dist/admin/utilities/tenant.role.policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"tenant.role.policy.js","sourceRoot":"","sources":["../../../src/admin/utilities/tenant.role.policy.ts"],"names":[],"mappings":";;;AAAA,sFAA4E;AAC5E,oEAA2D;AAC3D,wEAA+D;AAE/D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAS,MAAM,CAAC,MAAM,CAAC,6BAAU,CAAC,CAAC,CAAC;AAG5D,MAAa,gBAAgB;IAE3B,MAAM,CAAC,UAAU,CAAC,UAAqC;QACrD,OAAO,CAAC,CAAC,UAAU,IAAI,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAClD,CAAC;IAGD,MAAM,CAAC,YAAY,CAAC,UAAqC;QACvD,IAAI,CAAC,UAAU;YAAE,OAAO,KAAK,CAAC;QAC9B,OAAO,CACL,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,yBAAQ,CAAC,OAAO,EAAE,CAAC,CACxE,CAAC;IACJ,CAAC;IAGD,MAAM,CAAC,mBAAmB,CACxB,KAAU,EACV,cAAgC,EAAE;QAElC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QAClC,OAAO,KAAK,CAAC,MAAM,CACjB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,gBAAgB,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAC/E,CAAC;IACJ,CAAC;IAOD,MAAM,CAAC,kBAAkB,CAAC,KAIzB;QACC,IAAI,KAAK,CAAC,gBAAgB;YAAE,OAAO,0CAAgB,CAAC,kBAAkB,CAAC;QACvE,IAAI,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,eAAe;YAC7C,OAAO,0CAAgB,CAAC,kBAAkB,CAAC;QAC7C,OAAO,0CAAgB,CAAC,YAAY,CAAC;IACvC,CAAC;IAGD,MAAM,CAAC,YAAY,CACjB,OAAkC,EAClC,IAA+B;QAE/B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QACtD,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC;IAC9D,CAAC;CACF;AAjDD,4CAiDC"}
+{"version":3,"file":"tenant.role.policy.js","sourceRoot":"","sources":["../../../src/admin/utilities/tenant.role.policy.ts"],"names":[],"mappings":";;;AAAA,sFAA4E;AAC5E,wEAA+D;AAI/D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAS,MAAM,CAAC,MAAM,CAAC,6BAAU,CAAC,CAAC,CAAC;AAG5D,MAAa,gBAAgB;IAE3B,MAAM,CAAC,UAAU,CAAC,UAAqC;QACrD,OAAO,CAAC,CAAC,UAAU,IAAI,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAClD,CAAC;IAOD,MAAM,CAAC,YAAY,CACjB,IAGa,EACb,SAAwB;QAExB,IAAI,CAAC,IAAI,EAAE,UAAU;YAAE,OAAO,KAAK,CAAC;QACpC,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/C,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACtD,CAAC;IAGD,MAAM,CAAC,mBAAmB,CAMxB,KAAU,EACV,SAAwB,EACxB,cAAgC,EAAE;QAElC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QAClC,OAAO,KAAK,CAAC,MAAM,CACjB,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,gBAAgB,CAAC,YAAY,CAAC,IAAI,EAAE,SAAS,CAAC,CACvE,CAAC;IACJ,CAAC;IAOD,MAAM,CAAC,kBAAkB,CAAC,KAIzB;QACC,IAAI,KAAK,CAAC,gBAAgB;YAAE,OAAO,0CAAgB,CAAC,kBAAkB,CAAC;QACvE,IAAI,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,eAAe;YAC7C,OAAO,0CAAgB,CAAC,kBAAkB,CAAC;QAC7C,OAAO,0CAAgB,CAAC,YAAY,CAAC;IACvC,CAAC;IAGD,MAAM,CAAC,YAAY,CACjB,OAAkC,EAClC,IAA+B;QAE/B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QACtD,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC;IAC9D,CAAC;CACF;AAjED,4CAiEC"}

package/dist/auth/controllers/auth.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.controller.d.ts","sourceRoot":"","sources":["../../../src/auth/controllers/auth.controller.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAElF,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAS1D,qBAGa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IACxC,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IACxC,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,wBAAwB;gBALxB,WAAW,EAAE,WAAW,EACxB,iBAAiB,EAAE,iBAAiB,EACpC,uBAAuB,EAAE,uBAAuB,EAChD,uBAAuB,EAAE,uBAAuB,EAChD,QAAQ,EAAE,oBAAoB,EAC9B,wBAAwB,EAAE,wBAAwB;IAW/D,EAAE,IAAI,OAAO,CAAC,kBAAkB,CAAC;IAwBjC,KAAK,CACD,GAAG,EAAE,QAAQ,EACd,OAAO,EAAE,OAAO,GACtB,OAAO,CAAC,aAAa,CAAC;IAiBnB,WAAW,CACP,GAAG,EAAE,cAAc,EACpB,OAAO,EAAE,OAAO,GACtB,OAAO,CAAC,aAAa,CAAC;IAenB,QAAQ,CACJ,GAAG,EAAE,WAAW,EACjB,OAAO,EAAE,OAAO,GACtB,OAAO,CAAC,aAAa,CAAC;IAiBnB,OAAO,CACH,GAAG,EAAE,eAAe,EACrB,OAAO,EAAE,OAAO,GACtB,OAAO,CAAC,aAAa,CAAC;IAgBnB,MAAM,CAAS,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC;IAchE,cAAc,CACV,GAAG,EAAE,iBAAiB,GAC7B,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC;IAevB,wBAAwB,CACrB,OAAO,EAAE,OAAO,GACtB,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC;IAgBvB,WAAW,CACP,GAAG,EAAE,cAAc,EACpB,OAAO,EAAE,OAAO,GACtB,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC;YAQf,MAAM;CASrB"}
+{"version":3,"file":"auth.controller.d.ts","sourceRoot":"","sources":["../../../src/auth/controllers/auth.controller.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAElF,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAS1D,qBAGa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IACxC,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IACxC,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,wBAAwB;gBALxB,WAAW,EAAE,WAAW,EACxB,iBAAiB,EAAE,iBAAiB,EACpC,uBAAuB,EAAE,uBAAuB,EAChD,uBAAuB,EAAE,uBAAuB,EAChD,QAAQ,EAAE,oBAAoB,EAC9B,wBAAwB,EAAE,wBAAwB;IAW/D,EAAE,IAAI,OAAO,CAAC,kBAAkB,CAAC;IA2BjC,KAAK,CACD,GAAG,EAAE,QAAQ,EACd,OAAO,EAAE,OAAO,GACtB,OAAO,CAAC,aAAa,CAAC;IAiBnB,WAAW,CACP,GAAG,EAAE,cAAc,EACpB,OAAO,EAAE,OAAO,GACtB,OAAO,CAAC,aAAa,CAAC;IAenB,QAAQ,CACJ,GAAG,EAAE,WAAW,EACjB,OAAO,EAAE,OAAO,GACtB,OAAO,CAAC,aAAa,CAAC;IAiBnB,OAAO,CACH,GAAG,EAAE,eAAe,EACrB,OAAO,EAAE,OAAO,GACtB,OAAO,CAAC,aAAa,CAAC;IAgBnB,MAAM,CAAS,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC;IAchE,cAAc,CACV,GAAG,EAAE,iBAAiB,GAC7B,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC;IAevB,wBAAwB,CACrB,OAAO,EAAE,OAAO,GACtB,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC;IAgBvB,WAAW,CACP,GAAG,EAAE,cAAc,EACpB,OAAO,EAAE,OAAO,GACtB,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC;YAQf,MAAM;CASrB"}