@oneuptime/common 10.2.22 → 10.3.0

package/build/dist/Server/Types/AnalyticsDatabase/ModelPermission.js

@@ -10,13 +10,18 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 var _a, _b;
 import { IsBillingEnabled, getAllEnvVars, } from "../../../Server/EnvironmentConfig";
 import DatabaseRequestType from "../BaseDatabase/DatabaseRequestType";
+import QueryHelper from "../Database/QueryHelper";
 import DatabaseCommonInteractionPropsUtil, { PermissionType, } from "../../../Types/BaseDatabase/DatabaseCommonInteractionPropsUtil";
+import Includes from "../../../Types/BaseDatabase/Includes";
 import SubscriptionPlan from "../../../Types/Billing/SubscriptionPlan";
+import PermissionScope from "../../../Types/Database/AccessControl/PermissionScope";
 import Columns from "../../../Types/Database/Columns";
+import LIMIT_MAX from "../../../Types/Database/LimitMax";
 import BadDataException from "../../../Types/Exception/BadDataException";
 import NotAuthenticatedException from "../../../Types/Exception/NotAuthenticatedException";
 import NotAuthorizedException from "../../../Types/Exception/NotAuthorizedException";
 import PaymentRequiredException from "../../../Types/Exception/PaymentRequiredException";
+import ObjectID from "../../../Types/ObjectID";
 import Permission, { PermissionHelper, } from "../../../Types/Permission";
 import UserType from "../../../Types/UserType";
 import CaptureSpan from "../../Utils/Telemetry/CaptureSpan";
@@ -28,6 +33,8 @@ export default class ModelPermission {
         if (!props.isRoot && !props.isMasterAdmin) {
             this.checkModelLevelPermissions(modelType, props, DatabaseRequestType.Delete);
             query = await this.addTenantScopeToQuery(modelType, query, null, props);
+            // Owned scope: restrict deletes to telemetry from accessible services.
+            query = await this.addOwnedScopeToQuery(modelType, query, props, DatabaseRequestType.Delete);
         }
         return query;
     }
@@ -112,6 +119,13 @@ export default class ModelPermission {
                 // We will check for this permission in recursive function.
                 // check model level permissions.
                 this.checkModelLevelPermissions(modelType, props, DatabaseRequestType.Read);
+                /*
+                 * Apply the `Owned` permission scope filter for telemetry models
+                 * (Log/Span/Metric). Resolves the user's accessible Service IDs
+                 * once and constrains the ClickHouse query with `serviceId IN (...)`.
+                 * See Internal/Docs/PermissionsSimplification.md.
+                 */
+                query = await this.addOwnedScopeToQuery(modelType, query, props, DatabaseRequestType.Read);
                 /*
                  * We will check for this permission in recursive function.
                  * check query permissions.
@@ -294,6 +308,142 @@ export default class ModelPermission {
         }
         return modelPermissions;
     }
+    /*
+     * Mirror of TablePermission.getEffectiveModelPermissions. Adds the
+     * *AllOperationalResources wildcard for @OperationalResource analytics models and the
+     * ReadAllOperationalResources/ReadAllProjectResources runtime alias. See
+     * Internal/Docs/PermissionsSimplification.md.
+     */
+    static getEffectiveModelPermissions(modelType, modelPermissions, type) {
+        const effective = [...modelPermissions];
+        if (effective.includes(Permission.ReadAllProjectResources) &&
+            !effective.includes(Permission.ReadAllOperationalResources)) {
+            effective.push(Permission.ReadAllOperationalResources);
+        }
+        const model = new modelType();
+        if (model.isOperationalResource) {
+            const wildcard = this.getWildcardPermissionForOperation(type);
+            if (wildcard && !effective.includes(wildcard)) {
+                effective.push(wildcard);
+            }
+            if (type === DatabaseRequestType.Read &&
+                !effective.includes(Permission.ReadAllProjectResources)) {
+                effective.push(Permission.ReadAllProjectResources);
+            }
+        }
+        return effective;
+    }
+    static getWildcardPermissionForOperation(type) {
+        switch (type) {
+            case DatabaseRequestType.Read:
+                return Permission.ReadAllOperationalResources;
+            case DatabaseRequestType.Update:
+                return Permission.EditAllOperationalResources;
+            case DatabaseRequestType.Delete:
+                return Permission.DeleteAllOperationalResources;
+            case DatabaseRequestType.Create:
+                return Permission.CreateAllOperationalResources;
+            default:
+                return null;
+        }
+    }
+    /*
+     * `Owned` scope filter for analytics models (Log, Span, Metric). Resolves
+     * the user's accessible Service IDs via the Postgres ServiceOwner* tables
+     * once and injects `serviceId IN (...)` into the ClickHouse query. The
+     * operational per-row owner-join from the Postgres path doesn't scale to
+     * telemetry volume; one Postgres roundtrip + one indexed predicate does.
+     * See Internal/Docs/PermissionsSimplification.md §Telemetry & Analytics.
+     */
+    static async addOwnedScopeToQuery(modelType, query, props, type) {
+        if (props.isRoot || props.isMasterAdmin) {
+            return query;
+        }
+        if (type === DatabaseRequestType.Create) {
+            return query;
+        }
+        /*
+         * Only applies to analytics models that declare @OwnedThrough — today
+         * Log, Span, Metric all do (to Service via serviceId). Anything without
+         * it can't have ownership filtering applied, so we leave the query alone.
+         */
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const model = new modelType();
+        if (!model.ownedThrough) {
+            return query;
+        }
+        const modelPermissions = this.getModelPermissions(modelType, type);
+        const effectivePermissions = this.getEffectiveModelPermissions(modelType, modelPermissions, type);
+        const userPermissions = DatabaseCommonInteractionPropsUtil.getUserPermissions(props, PermissionType.Allow);
+        const applicableRows = userPermissions.filter((p) => {
+            return effectivePermissions.includes(p.permission);
+        });
+        if (applicableRows.length === 0) {
+            return query;
+        }
+        /*
+         * If any applicable row is non-Owned scope, that broader grant wins
+         * and the Owned filter doesn't apply.
+         */
+        const hasNonOwnedGrant = applicableRows.some((p) => {
+            return p.scope !== PermissionScope.Owned;
+        });
+        if (hasNonOwnedGrant) {
+            return query;
+        }
+        /*
+         * Resolve allowed service IDs via the Postgres ServiceOwner* tables.
+         * Lazy require to avoid circular deps with services that extend
+         * DatabaseService.
+         */
+        const ownerTableRegistry = 
+        // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-var-requires
+        require("../Database/Permissions/OwnerTableRegistry").default;
+        const serviceEntry = ownerTableRegistry.get("Service");
+        if (!serviceEntry) {
+            return query;
+        }
+        const allowedServiceIds = new Set();
+        if (props.userId) {
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            const userOwnedRows = await serviceEntry.ownerUserService.findBy({
+                query: Object.assign({ userId: props.userId }, (props.tenantId ? { projectId: props.tenantId } : {})),
+                select: { serviceId: true },
+                props: { isRoot: true },
+                skip: 0,
+                limit: LIMIT_MAX,
+            });
+            for (const row of userOwnedRows) {
+                const id = row.serviceId;
+                if (id) {
+                    allowedServiceIds.add(id.toString());
+                }
+            }
+        }
+        if (props.userTeamIds && props.userTeamIds.length > 0) {
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            const teamOwnedRows = await serviceEntry.ownerTeamService.findBy({
+                query: Object.assign({ teamId: QueryHelper.any(props.userTeamIds) }, (props.tenantId ? { projectId: props.tenantId } : {})),
+                select: { serviceId: true },
+                props: { isRoot: true },
+                skip: 0,
+                limit: LIMIT_MAX,
+            });
+            for (const row of teamOwnedRows) {
+                const id = row.serviceId;
+                if (id) {
+                    allowedServiceIds.add(id.toString());
+                }
+            }
+        }
+        const fkColumn = model.ownedThrough.fkColumn;
+        const idList = allowedServiceIds.size > 0
+            ? Array.from(allowedServiceIds)
+            : [ObjectID.getZeroObjectID().toString()]; // sentinel: match nothing
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        query[fkColumn] = new Includes(idList);
+        return query;
+    }
     static isPublicPermissionAllowed(modelType, type) {
         let isPublicAllowed = false;
         isPublicAllowed = this.getModelPermissions(modelType, type).includes(Permission.Public);
@@ -316,9 +466,16 @@ export default class ModelPermission {
         // 2nd CHECK: Does user have access to CRUD data on this model.
         const userPermissions = DatabaseCommonInteractionPropsUtil.getUserPermissions(props, PermissionType.Allow);
         const modelPermissions = this.getModelPermissions(modelType, type);
+        /*
+         * Mirror of TablePermission's wildcard short-circuit so the analytics
+         * path (ClickHouse-backed Log/Span/Metric) honors the same *AllOperationalResources
+         * permissions and the ReadAllProjectResources runtime alias. See
+         * Internal/Docs/PermissionsSimplification.md.
+         */
+        const effectiveModelPermissions = this.getEffectiveModelPermissions(modelType, modelPermissions, type);
         if (!PermissionHelper.doesPermissionsIntersect(userPermissions.map((userPermission) => {
             return userPermission.permission;
-        }) || [], modelPermissions)) {
+        }) || [], effectiveModelPermissions)) {
             const permissions = PermissionHelper.getPermissionTitles(modelPermissions);
             if (permissions.length === 0) {
                 throw new NotAuthorizedException(`${type} on ${new modelType().singularName} is not allowed.`);

package/build/dist/Server/Types/AnalyticsDatabase/ModelPermission.js.map

@@ -1 +1 @@
-{"version":3,"file":"ModelPermission.js","sourceRoot":"","sources":["../../../../../Server/Types/AnalyticsDatabase/ModelPermission.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,OAAO,EACL,gBAAgB,EAChB,aAAa,GACd,MAAM,mCAAmC,CAAC;AAC3C,OAAO,mBAAmB,MAAM,qCAAqC,CAAC;AAStE,OAAO,kCAAkC,EAAE,EACzC,cAAc,GACf,MAAM,gEAAgE,CAAC;AACxE,OAAO,gBAAgB,MAAM,yCAAyC,CAAC;AACvE,OAAO,OAAO,MAAM,iCAAiC,CAAC;AACtD,OAAO,gBAAgB,MAAM,2CAA2C,CAAC;AACzE,OAAO,yBAAyB,MAAM,oDAAoD,CAAC;AAC3F,OAAO,sBAAsB,MAAM,iDAAiD,CAAC;AACrF,OAAO,wBAAwB,MAAM,mDAAmD,CAAC;AAEzF,OAAO,UAAU,EAAE,EACjB,gBAAgB,GAEjB,MAAM,2BAA2B,CAAC;AACnC,OAAO,QAAQ,MAAM,yBAAyB,CAAC;AAC/C,OAAO,WAAW,MAAM,mCAAmC,CAAC;AAO5D,MAAM,CAAC,OAAO,OAAO,eAAe;IAEd,AAAb,MAAM,CAAC,KAAK,CAAC,qBAAqB,CACvC,SAAiC,EACjC,KAAwB,EACxB,KAAqC;QAErC,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;YACxC,KAAK,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAC1E,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YAC1C,IAAI,CAAC,0BAA0B,CAC7B,SAAS,EACT,KAAK,EACL,mBAAmB,CAAC,MAAM,CAC3B,CAAC;YACF,KAAK,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAC1E,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAGmB,AAAb,MAAM,CAAC,KAAK,CAAC,sBAAsB,CACxC,SAAiC,EACjC,KAAwB,EACxB,IAAgB,EAChB,KAAqC;QAErC,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;YACxC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC,0BAA0B,CAC7B,SAAS,EACT,KAAK,EACL,mBAAmB,CAAC,MAAM,CAC3B,CAAC;QAEF,MAAM,uBAAuB,GAC3B,MAAM,IAAI,CAAC,mBAAmB,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAEhE,KAAK,GAAG,uBAAuB,CAAC,KAAK,CAAC;QAEtC,IAAI,CAAC,0BAA0B,CAC7B,SAAS,EACT,IAAW,EACX,KAAK,EACL,mBAAmB,CAAC,MAAM,CAC3B,CAAC;QAEF,OAAO,KAAK,CAAC;IACf,CAAC;IAGa,AAAP,MAAM,CAAC,sBAAsB,CAClC,SAAiC,EACjC,IAAgB,EAChB,KAAqC;QAErC,yDAAyD;QACzD,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;YACxC,OAAO;QACT,CAAC;QAED,IAAI,CAAC,0BAA0B,CAC7B,SAAS,EACT,KAAK,EACL,mBAAmB,CAAC,MAAM,CAC3B,CAAC;QAEF,IAAI,CAAC,0BAA0B,CAC7B,SAAS,EACT,IAAI,EACJ,KAAK,EACL,mBAAmB,CAAC,MAAM,CAC3B,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,0BAA0B,CACvC,SAAiC,EACjC,IAAgB,EAChB,KAAqC,EACrC,WAAgC;QAEhC,MAAM,KAAK,GAAc,IAAI,SAAS,EAAE,CAAC;QACzC,MAAM,eAAe,GACnB,kCAAkC,CAAC,kBAAkB,CACnD,KAAK,EACL,cAAc,CAAC,KAAK,CACrB,CAAC;QAEJ,MAAM,iBAAiB,GAAY,IAAI,CAAC,4BAA4B,CAClE,SAAS,EACT,eAAe,EACf,WAAW,CACZ,CAAC;QAEF,MAAM,mBAAmB,GACvB,eAAe,CAAC,sBAAsB,EAAE,CAAC;QAE3C,MAAM,YAAY,GAAgC,KAAK,CAAC,eAAe,EAAE,CAAC;QAE1E,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;YAClC,MAAM,GAAG,GAAW,MAAM,CAAC,GAAG,CAAC;YAC/B,IAAK,IAAY,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;gBACrC,SAAS;YACX,CAAC;YAED,IAAI,mBAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtC,SAAS;YACX,CAAC;YAED,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7C,IACE,WAAW,KAAK,mBAAmB,CAAC,MAAM;oBAC1C,MAAM,CAAC,4BAA4B,EACnC,CAAC;oBACD,SAAS,CAAC,6EAA6E;gBACzF,CAAC;gBAED,MAAM,IAAI,gBAAgB,CACxB,0BAA0B,WAAW,OAAO,GAAG,cAAc,KAAK,CAAC,YAAY,EAAE,CAClF,CAAC;YACJ,CAAC;YAED,MAAM,oBAAoB,GACxB,KAAK,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC;YAE3C,IAAI,gBAAgB,IAAI,KAAK,CAAC,WAAW,IAAI,oBAAoB,EAAE,CAAC;gBAClE,IACE,WAAW,KAAK,mBAAmB,CAAC,MAAM;oBAC1C,oBAAoB,CAAC,MAAM,EAC3B,CAAC;oBACD,IACE,CAAC,gBAAgB,CAAC,gCAAgC,CAChD,oBAAoB,CAAC,MAAM,EAC3B,KAAK,CAAC,WAAW,EACjB,aAAa,EAAE,CAChB,EACD,CAAC;wBACD,MAAM,IAAI,wBAAwB,CAChC,8BAA8B;4BAC5B,oBAAoB,CAAC,MAAM;4BAC3B,yBAAyB,CAC5B,CAAC;oBACJ,CAAC;gBACH,CAAC;gBAED,IACE,WAAW,KAAK,mBAAmB,CAAC,IAAI;oBACxC,oBAAoB,CAAC,IAAI,EACzB,CAAC;oBACD,IACE,CAAC,gBAAgB,CAAC,gCAAgC,CAChD,oBAAoB,CAAC,IAAI,EACzB,KAAK,CAAC,WAAW,EACjB,aAAa,EAAE,CAChB,EACD,CAAC;wBACD,MAAM,IAAI,wBAAwB,CAChC,8BAA8B;4BAC5B,oBAAoB,CAAC,IAAI;4BACzB,yBAAyB,CAC5B,CAAC;oBACJ,CAAC;gBACH,CAAC;gBAED,IACE,WAAW,KAAK,mBAAmB,CAAC,MAAM;oBAC1C,oBAAoB,CAAC,MAAM,EAC3B,CAAC;oBACD,IACE,CAAC,gBAAgB,CAAC,gCAAgC,CAChD,oBAAoB,CAAC,MAAM,EAC3B,KAAK,CAAC,WAAW,EACjB,aAAa,EAAE,CAChB,EACD,CAAC;wBACD,MAAM,IAAI,wBAAwB,CAChC,8BAA8B;4BAC5B,oBAAoB,CAAC,MAAM;4BAC3B,yBAAyB,CAC5B,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAGmB,AAAb,MAAM,CAAC,KAAK,CAAC,mBAAmB,CACrC,SAAiC,EACjC,KAAwB,EACxB,MAAiC,EACjC,KAAqC;QAErC,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;YACxC,KAAK,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAC1E,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YAC1C,iCAAiC;YACjC,IAAI,CAAC,qBAAqB,CAAC,SAAS,EAAE,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,CAAC;YAEvE,oBAAoB;YACpB,KAAK,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YAE1E,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,CAAC;gBAChC,2DAA2D;gBAE3D,iCAAiC;gBACjC,IAAI,CAAC,0BAA0B,CAC7B,SAAS,EACT,KAAK,EACL,mBAAmB,CAAC,IAAI,CACzB,CAAC;gBAEF;;;mBAGG;gBACH,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;gBAEnD,IAAI,MAAM,EAAE,CAAC;oBACX,0BAA0B;oBAC1B,IAAI,CAAC,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;gBACvD,CAAC;YACH,CAAC;QACH,CAAC;QAED,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAEnC,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,MAAM,GAER,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;YAChC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QACzB,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC3B,CAAC;IAEO,MAAM,CAAC,cAAc,CAC3B,KAAwB;QAExB,KAAK,GAAG,KAA0B,CAAC;QAEnC,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,MAAM,CAAC,cAAc,CAC3B,MAA0B;QAI1B,OAAO,EAAE,MAAM,EAAE,CAAC;IACpB,CAAC;IAEO,MAAM,CAAC,sBAAsB;QACnC,MAAM,SAAS,GAAkB;YAC/B,KAAK;YACL,WAAW;YACX,WAAW;YACX,WAAW;YACX,SAAS;SACV,CAAC;QAEF,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,MAAM,CAAC,oBAAoB,CACjC,SAAiC,EACjC,KAAwB,EACxB,KAAqC;;QAErC,MAAM,KAAK,GAAc,IAAI,SAAS,EAAE,CAAC;QAEzC,MAAM,eAAe,GACnB,kCAAkC,CAAC,kBAAkB,CACnD,KAAK,EACL,cAAc,CAAC,KAAK,CACrB,CAAC;QAEJ,MAAM,qBAAqB,GAAY,IAAI,CAAC,4BAA4B,CACtE,SAAS,EACT,eAAe,IAAI,EAAE,EACrB,mBAAmB,CAAC,IAAI,CACzB,CAAC;QAEF,MAAM,YAAY,GAAgC,KAAK,CAAC,eAAe,EAAE,CAAC;QAE1E,MAAM,mBAAmB,GACvB,eAAe,CAAC,sBAAsB,EAAE,CAAC;QAE3C,oCAAoC;QAEpC,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;YACxB,IAAI,mBAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtC,SAAS;YACX,CAAC;YAED,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjD,MAAM,MAAM,GAAqC,YAAY,CAAC,IAAI,CAChE,CAAC,IAA0B,EAAE,EAAE;oBAC7B,OAAO,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC;gBAC1B,CAAC,CACF,CAAC;gBAEF,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,IAAI,gBAAgB,CACxB,qBAAqB,KAAK,CAAC,YAAY,MAAM,GAAG,0BAA0B,CAC3E,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,sBAAsB,CAC9B,6CAA6C,GAAG,4CAA4C,gBAAgB,CAAC,mBAAmB,CAC9H,CAAA,MAAA,MAAM,CAAC,aAAa,0CAAE,IAAI,KAAI,EAAE,CACjC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACf,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,2BAA2B,CAG9C,SAAiC,EACjC,KAAwB,EACxB,KAAqC;;QAErC,MAAM,KAAK,GAAc,IAAI,SAAS,EAAE,CAAC;QAEzC,MAAM,YAAY,GAAkB,CAAA,MAAA,KAAK,CAAC,eAAe,EAAE,0CAAE,GAAG,KAAI,IAAI,CAAC;QAEzE,uHAAuH;QACvH,IAAI,YAAY,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,CAAC;YACjE,KAAa,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC;QAChD,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,qBAAqB,CACxC,SAAiC,EACjC,KAAwB,EACxB,MAAiC,EACjC,KAAqC;;QAErC,MAAM,KAAK,GAAc,IAAI,SAAS,EAAE,CAAC;QAEzC,MAAM,YAAY,GAAkB,CAAA,MAAA,KAAK,CAAC,eAAe,EAAE,0CAAE,GAAG,KAAI,IAAI,CAAC;QAEzE,uHAAuH;QACvH,IAAI,YAAY,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,CAAC;YACjE,KAAa,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC;QAChD,CAAC;aAAM,IACL,YAAY;YACZ,KAAK,CAAC,0BAA0B;YAChC,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,oBAAoB,CAAC,EAC/C,CAAC;YACD;;;;eAIG;YAEH,MAAM,OAAO,GAA6B,EAAE,CAAC;YAE7C,IAAI,UAAU,GAAoB,EAAE,CAAC;YAErC,IACE,KAAK,CAAC,0BAA0B;gBAChC,KAAK,CAAC,0BAA0B,CAAC,UAAU,EAC3C,CAAC;gBACD,UAAU,GAAG,MAAA,KAAK,CAAC,0BAA0B,0CAAE,UAAU,CAAC;YAC5D,CAAC;YAED,IAAI,aAAa,GAAiB,IAAI,CAAC;YAEvC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;gBACnC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;oBAClB,SAAS;gBACX,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,uBAAuB,GAC3B,MAAM,IAAI,CAAC,mBAAmB,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,kCAClD,KAAK,KACR,oBAAoB,EAAE,KAAK,EAC3B,QAAQ,EAAE,SAAS,EACnB,0BAA0B,EAAE,KAAK,CAAC,0BAA0B,IAC5D,CAAC;oBACL,OAAO,CAAC,IAAI,mBACN,uBAAuB,CAAC,KAA2B,EACvD,CAAC;gBACL,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,2BAA2B;oBAC3B,aAAa,GAAG,CAAU,CAAC;gBAC7B,CAAC;YACH,CAAC;YAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,sBAAsB,CAC9B,CAAA,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,OAAO;oBACpB,mCAAmC,GAAG,KAAK,CAAC,YAAY,CAC3D,CAAC;YACJ,CAAC;YAED,OAAO,OAAc,CAAC;QACxB,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,MAAM,CAAC,4BAA4B,CACzC,SAAiC,EACjC,eAAsC,EACtC,WAAgC;;QAEhC,MAAM,KAAK,GAAc,IAAI,SAAS,EAAE,CAAC;QACzC,MAAM,YAAY,GAAgC,KAAK,CAAC,eAAe,EAAE,CAAC;QAE1E,MAAM,OAAO,GAAkB,EAAE,CAAC;QAElC,MAAM,WAAW,GAAsB,eAAe,CAAC,GAAG,CACxD,CAAC,IAAoB,EAAE,EAAE;YACvB,OAAO,IAAI,CAAC,UAAU,CAAC;QACzB,CAAC,CACF,CAAC;QAEF,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;YAClC,IAAI,iBAAiB,GAAsB,EAAE,CAAC;YAE9C,IAAI,WAAW,KAAK,mBAAmB,CAAC,IAAI,EAAE,CAAC;gBAC7C,iBAAiB,GAAG,CAAA,MAAA,MAAM,CAAC,aAAa,0CAAE,IAAI,KAAI,EAAE,CAAC;YACvD,CAAC;YAED,IAAI,WAAW,KAAK,mBAAmB,CAAC,MAAM,EAAE,CAAC;gBAC/C,iBAAiB,GAAG,CAAA,MAAA,MAAM,CAAC,aAAa,0CAAE,MAAM,KAAI,EAAE,CAAC;YACzD,CAAC;YAED,IAAI,WAAW,KAAK,mBAAmB,CAAC,MAAM,EAAE,CAAC;gBAC/C,iBAAiB,GAAG,CAAA,MAAA,MAAM,CAAC,aAAa,0CAAE,MAAM,KAAI,EAAE,CAAC;YACzD,CAAC;YAED,IAAI,WAAW,KAAK,mBAAmB,CAAC,MAAM,EAAE,CAAC;gBAC/C,MAAM,IAAI,gBAAgB,CAAC,6BAA6B,CAAC,CAAC;YAC5D,CAAC;YAED,IACE,iBAAiB;gBACjB,gBAAgB,CAAC,wBAAwB,CACvC,WAAW,EACX,iBAAiB,CAClB,EACD,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QAED,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAEO,MAAM,CAAC,qBAAqB,CAClC,SAAiC,EACjC,MAA0B,EAC1B,KAAqC;;QAErC,MAAM,KAAK,GAAc,IAAI,SAAS,EAAE,CAAC;QAEzC,MAAM,eAAe,GACnB,kCAAkC,CAAC,kBAAkB,CACnD,KAAK,EACL,cAAc,CAAC,KAAK,CACrB,CAAC;QAEJ,MAAM,qBAAqB,GAAY,IAAI,CAAC,4BAA4B,CACtE,SAAS,EACT,eAAe,IAAI,EAAE,EACrB,mBAAmB,CAAC,IAAI,CACzB,CAAC;QAEF,MAAM,YAAY,GAAgC,KAAK,CAAC,eAAe,EAAE,CAAC;QAE1E,MAAM,mBAAmB,GACvB,eAAe,CAAC,sBAAsB,EAAE,CAAC;QAE3C,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YACzB,IAAI,mBAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtC,SAAS;YACX,CAAC;YAED,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjD,MAAM,MAAM,GAAqC,YAAY,CAAC,IAAI,CAChE,CAAC,MAA4B,EAAE,EAAE;oBAC/B,OAAO,MAAM,CAAC,GAAG,KAAK,GAAG,CAAC;gBAC5B,CAAC,CACF,CAAC;gBACF,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,IAAI,gBAAgB,CACxB,4CAA4C,GAAG,oCAC7C,KAAK,CAAC,YACR,qDAAqD,YAAY,CAAC,IAAI,CACpE,IAAI,CACL,EAAE,CACJ,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,sBAAsB,CAC9B,8CAA8C,GAAG;6DACE,gBAAgB,CAAC,mBAAmB,CAC3E,CAAA,MAAA,MAAM,CAAC,aAAa,0CAAE,IAAI,KAAI,EAAE,CACjC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzB,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,mBAAmB,CAChC,SAAiC,EACjC,IAAyB;;QAEzB,IAAI,gBAAgB,GAAsB,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAc,IAAI,SAAS,EAAE,CAAC;QAEzC,IAAI,IAAI,KAAK,mBAAmB,CAAC,MAAM,EAAE,CAAC;YACxC,gBAAgB,GAAG,CAAA,MAAA,KAAK,CAAC,aAAa,0CAAE,MAAM,KAAI,EAAE,CAAC;QACvD,CAAC;QAED,IAAI,IAAI,KAAK,mBAAmB,CAAC,MAAM,EAAE,CAAC;YACxC,gBAAgB,GAAG,CAAA,MAAA,KAAK,CAAC,aAAa,0CAAE,MAAM,KAAI,EAAE,CAAC;QACvD,CAAC;QAED,IAAI,IAAI,KAAK,mBAAmB,CAAC,MAAM,EAAE,CAAC;YACxC,gBAAgB,GAAG,CAAA,MAAA,KAAK,CAAC,aAAa,0CAAE,MAAM,KAAI,EAAE,CAAC;QACvD,CAAC;QAED,IAAI,IAAI,KAAK,mBAAmB,CAAC,IAAI,EAAE,CAAC;YACtC,gBAAgB,GAAG,CAAA,MAAA,KAAK,CAAC,aAAa,0CAAE,IAAI,KAAI,EAAE,CAAC;QACrD,CAAC;QAED,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAEO,MAAM,CAAC,yBAAyB,CACtC,SAAiC,EACjC,IAAyB;QAEzB,IAAI,eAAe,GAAY,KAAK,CAAC;QACrC,eAAe,GAAG,IAAI,CAAC,mBAAmB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,QAAQ,CAClE,UAAU,CAAC,MAAM,CAClB,CAAC;QACF,OAAO,eAAe,CAAC;IACzB,CAAC;IAGa,AAAP,MAAM,CAAC,qBAAqB,CACjC,SAAiC,EACjC,KAAqC,EACrC,IAAyB;QAEzB,uFAAuF;QAEvF,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACtE,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,GAAG,EAAE,CAAC;gBACpC,uCAAuC;gBACvC,OAAO;YACT,CAAC;YAED,kFAAkF;YAClF,MAAM,IAAI,yBAAyB,CACjC,sDAAsD,IAAI,cACxD,IAAI,SAAS,EAAE,CAAC,YAClB,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,0BAA0B,CACvC,SAAiC,EACjC,KAAqC,EACrC,IAAyB;;QAEzB,IAAI,CAAC,qBAAqB,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAEnD,+DAA+D;QAC/D,MAAM,eAAe,GACnB,kCAAkC,CAAC,kBAAkB,CACnD,KAAK,EACL,cAAc,CAAC,KAAK,CACrB,CAAC;QACJ,MAAM,gBAAgB,GAAsB,IAAI,CAAC,mBAAmB,CAClE,SAAS,EACT,IAAI,CACL,CAAC;QAEF,IACE,CAAC,gBAAgB,CAAC,wBAAwB,CACxC,eAAe,CAAC,GAAG,CAAC,CAAC,cAA8B,EAAE,EAAE;YACrD,OAAO,cAAc,CAAC,UAAU,CAAC;QACnC,CAAC,CAAC,IAAI,EAAE,EACR,gBAAgB,CACjB,EACD,CAAC;YACD,MAAM,WAAW,GACf,gBAAgB,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;YAEzD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,sBAAsB,CAC9B,GAAG,IAAI,OAAO,IAAI,SAAS,EAAE,CAAC,YAAY,kBAAkB,CAC7D,CAAC;YACJ,CAAC;YAED,MAAM,IAAI,sBAAsB,CAC9B,kCAAkC,IAAI,IACpC,IAAI,SAAS,EAAE,CAAC,YAClB,wCAAwC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACjE,CAAC;QACJ,CAAC;QAED,8BAA8B;QAE9B,IAAI,gBAAgB,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YAC1C,MAAM,KAAK,GAAc,IAAI,SAAS,EAAE,CAAC;YAEzC,IACE,KAAK,CAAC,oBAAoB;gBAC1B,CAAC,KAAK,CAAC,iCAAiC,EACxC,CAAC;gBACD,MAAM,IAAI,wBAAwB,CAChC,gLAAgL,CACjL,CAAC;YACJ,CAAC;YAED,IACE,IAAI,KAAK,mBAAmB,CAAC,MAAM;iBACnC,MAAA,KAAK,CAAC,yBAAyB,0CAAE,MAAM,CAAA,EACvC,CAAC;gBACD,IACE,CAAC,gBAAgB,CAAC,gCAAgC,CAChD,KAAK,CAAC,yBAAyB,CAAC,MAAM,EACtC,KAAK,CAAC,WAAW,EACjB,aAAa,EAAE,CAChB,EACD,CAAC;oBACD,MAAM,IAAI,wBAAwB,CAChC,8BAA8B;wBAC5B,KAAK,CAAC,yBAAyB,CAAC,MAAM;wBACtC,yBAAyB,CAC5B,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,IACE,IAAI,KAAK,mBAAmB,CAAC,MAAM;iBACnC,MAAA,KAAK,CAAC,yBAAyB,0CAAE,MAAM,CAAA,EACvC,CAAC;gBACD,IACE,CAAC,gBAAgB,CAAC,gCAAgC,CAChD,KAAK,CAAC,yBAAyB,CAAC,MAAM,EACtC,KAAK,CAAC,WAAW,EACjB,aAAa,EAAE,CAChB,EACD,CAAC;oBACD,MAAM,IAAI,wBAAwB,CAChC,8BAA8B;wBAC5B,KAAK,CAAC,yBAAyB,CAAC,MAAM;wBACtC,yBAAyB,CAC5B,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,IACE,IAAI,KAAK,mBAAmB,CAAC,MAAM;iBACnC,MAAA,KAAK,CAAC,yBAAyB,0CAAE,MAAM,CAAA,EACvC,CAAC;gBACD,IACE,CAAC,gBAAgB,CAAC,gCAAgC,CAChD,KAAK,CAAC,yBAAyB,CAAC,MAAM,EACtC,KAAK,CAAC,WAAW,EACjB,aAAa,EAAE,CAChB,EACD,CAAC;oBACD,MAAM,IAAI,wBAAwB,CAChC,8BAA8B;wBAC5B,KAAK,CAAC,yBAAyB,CAAC,MAAM;wBACtC,yBAAyB,CAC5B,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,IACE,IAAI,KAAK,mBAAmB,CAAC,IAAI;iBACjC,MAAA,KAAK,CAAC,yBAAyB,0CAAE,IAAI,CAAA,EACrC,CAAC;gBACD,IACE,CAAC,gBAAgB,CAAC,gCAAgC,CAChD,MAAA,KAAK,CAAC,yBAAyB,0CAAE,IAAI,EACrC,KAAK,CAAC,WAAW,EACjB,aAAa,EAAE,CAChB,EACD,CAAC;oBACD,MAAM,IAAI,wBAAwB,CAChC,8BAA8B;yBAC5B,MAAA,KAAK,CAAC,yBAAyB,0CAAE,IAAI,CAAA;wBACrC,yBAAyB,CAC5B,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAvsBqB;IADnB,WAAW,EAAE;;;;kDAoBb;AAGmB;IADnB,WAAW,EAAE;;yEAIN,UAAU,oBAAV,UAAU;;mDA0BjB;AAGa;IADb,WAAW,EAAE;;iEAGN,UAAU,oBAAV,UAAU;;mDAoBjB;AAkHmB;IADnB,WAAW,EAAE;;;;gDAmDb;AA4Ta;IADb,WAAW,EAAE;;;;kDAqBb"}
+{"version":3,"file":"ModelPermission.js","sourceRoot":"","sources":["../../../../../Server/Types/AnalyticsDatabase/ModelPermission.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,OAAO,EACL,gBAAgB,EAChB,aAAa,GACd,MAAM,mCAAmC,CAAC;AAC3C,OAAO,mBAAmB,MAAM,qCAAqC,CAAC;AAGtE,OAAO,WAAW,MAAM,yBAAyB,CAAC;AAOlD,OAAO,kCAAkC,EAAE,EACzC,cAAc,GACf,MAAM,gEAAgE,CAAC;AACxE,OAAO,QAAQ,MAAM,sCAAsC,CAAC;AAC5D,OAAO,gBAAgB,MAAM,yCAAyC,CAAC;AACvE,OAAO,eAAe,MAAM,uDAAuD,CAAC;AACpF,OAAO,OAAO,MAAM,iCAAiC,CAAC;AACtD,OAAO,SAAS,MAAM,kCAAkC,CAAC;AACzD,OAAO,gBAAgB,MAAM,2CAA2C,CAAC;AACzE,OAAO,yBAAyB,MAAM,oDAAoD,CAAC;AAC3F,OAAO,sBAAsB,MAAM,iDAAiD,CAAC;AACrF,OAAO,wBAAwB,MAAM,mDAAmD,CAAC;AACzF,OAAO,QAAQ,MAAM,yBAAyB,CAAC;AAC/C,OAAO,UAAU,EAAE,EACjB,gBAAgB,GAEjB,MAAM,2BAA2B,CAAC;AACnC,OAAO,QAAQ,MAAM,yBAAyB,CAAC;AAC/C,OAAO,WAAW,MAAM,mCAAmC,CAAC;AAO5D,MAAM,CAAC,OAAO,OAAO,eAAe;IAEd,AAAb,MAAM,CAAC,KAAK,CAAC,qBAAqB,CACvC,SAAiC,EACjC,KAAwB,EACxB,KAAqC;QAErC,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;YACxC,KAAK,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAC1E,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YAC1C,IAAI,CAAC,0BAA0B,CAC7B,SAAS,EACT,KAAK,EACL,mBAAmB,CAAC,MAAM,CAC3B,CAAC;YACF,KAAK,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YACxE,uEAAuE;YACvE,KAAK,GAAG,MAAM,IAAI,CAAC,oBAAoB,CACrC,SAAS,EACT,KAAK,EACL,KAAK,EACL,mBAAmB,CAAC,MAAM,CAC3B,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAGmB,AAAb,MAAM,CAAC,KAAK,CAAC,sBAAsB,CACxC,SAAiC,EACjC,KAAwB,EACxB,IAAgB,EAChB,KAAqC;QAErC,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;YACxC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC,0BAA0B,CAC7B,SAAS,EACT,KAAK,EACL,mBAAmB,CAAC,MAAM,CAC3B,CAAC;QAEF,MAAM,uBAAuB,GAC3B,MAAM,IAAI,CAAC,mBAAmB,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAEhE,KAAK,GAAG,uBAAuB,CAAC,KAAK,CAAC;QAEtC,IAAI,CAAC,0BAA0B,CAC7B,SAAS,EACT,IAAW,EACX,KAAK,EACL,mBAAmB,CAAC,MAAM,CAC3B,CAAC;QAEF,OAAO,KAAK,CAAC;IACf,CAAC;IAGa,AAAP,MAAM,CAAC,sBAAsB,CAClC,SAAiC,EACjC,IAAgB,EAChB,KAAqC;QAErC,yDAAyD;QACzD,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;YACxC,OAAO;QACT,CAAC;QAED,IAAI,CAAC,0BAA0B,CAC7B,SAAS,EACT,KAAK,EACL,mBAAmB,CAAC,MAAM,CAC3B,CAAC;QAEF,IAAI,CAAC,0BAA0B,CAC7B,SAAS,EACT,IAAI,EACJ,KAAK,EACL,mBAAmB,CAAC,MAAM,CAC3B,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,0BAA0B,CACvC,SAAiC,EACjC,IAAgB,EAChB,KAAqC,EACrC,WAAgC;QAEhC,MAAM,KAAK,GAAc,IAAI,SAAS,EAAE,CAAC;QACzC,MAAM,eAAe,GACnB,kCAAkC,CAAC,kBAAkB,CACnD,KAAK,EACL,cAAc,CAAC,KAAK,CACrB,CAAC;QAEJ,MAAM,iBAAiB,GAAY,IAAI,CAAC,4BAA4B,CAClE,SAAS,EACT,eAAe,EACf,WAAW,CACZ,CAAC;QAEF,MAAM,mBAAmB,GACvB,eAAe,CAAC,sBAAsB,EAAE,CAAC;QAE3C,MAAM,YAAY,GAAgC,KAAK,CAAC,eAAe,EAAE,CAAC;QAE1E,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;YAClC,MAAM,GAAG,GAAW,MAAM,CAAC,GAAG,CAAC;YAC/B,IAAK,IAAY,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;gBACrC,SAAS;YACX,CAAC;YAED,IAAI,mBAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtC,SAAS;YACX,CAAC;YAED,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7C,IACE,WAAW,KAAK,mBAAmB,CAAC,MAAM;oBAC1C,MAAM,CAAC,4BAA4B,EACnC,CAAC;oBACD,SAAS,CAAC,6EAA6E;gBACzF,CAAC;gBAED,MAAM,IAAI,gBAAgB,CACxB,0BAA0B,WAAW,OAAO,GAAG,cAAc,KAAK,CAAC,YAAY,EAAE,CAClF,CAAC;YACJ,CAAC;YAED,MAAM,oBAAoB,GACxB,KAAK,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC;YAE3C,IAAI,gBAAgB,IAAI,KAAK,CAAC,WAAW,IAAI,oBAAoB,EAAE,CAAC;gBAClE,IACE,WAAW,KAAK,mBAAmB,CAAC,MAAM;oBAC1C,oBAAoB,CAAC,MAAM,EAC3B,CAAC;oBACD,IACE,CAAC,gBAAgB,CAAC,gCAAgC,CAChD,oBAAoB,CAAC,MAAM,EAC3B,KAAK,CAAC,WAAW,EACjB,aAAa,EAAE,CAChB,EACD,CAAC;wBACD,MAAM,IAAI,wBAAwB,CAChC,8BAA8B;4BAC5B,oBAAoB,CAAC,MAAM;4BAC3B,yBAAyB,CAC5B,CAAC;oBACJ,CAAC;gBACH,CAAC;gBAED,IACE,WAAW,KAAK,mBAAmB,CAAC,IAAI;oBACxC,oBAAoB,CAAC,IAAI,EACzB,CAAC;oBACD,IACE,CAAC,gBAAgB,CAAC,gCAAgC,CAChD,oBAAoB,CAAC,IAAI,EACzB,KAAK,CAAC,WAAW,EACjB,aAAa,EAAE,CAChB,EACD,CAAC;wBACD,MAAM,IAAI,wBAAwB,CAChC,8BAA8B;4BAC5B,oBAAoB,CAAC,IAAI;4BACzB,yBAAyB,CAC5B,CAAC;oBACJ,CAAC;gBACH,CAAC;gBAED,IACE,WAAW,KAAK,mBAAmB,CAAC,MAAM;oBAC1C,oBAAoB,CAAC,MAAM,EAC3B,CAAC;oBACD,IACE,CAAC,gBAAgB,CAAC,gCAAgC,CAChD,oBAAoB,CAAC,MAAM,EAC3B,KAAK,CAAC,WAAW,EACjB,aAAa,EAAE,CAChB,EACD,CAAC;wBACD,MAAM,IAAI,wBAAwB,CAChC,8BAA8B;4BAC5B,oBAAoB,CAAC,MAAM;4BAC3B,yBAAyB,CAC5B,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAGmB,AAAb,MAAM,CAAC,KAAK,CAAC,mBAAmB,CACrC,SAAiC,EACjC,KAAwB,EACxB,MAAiC,EACjC,KAAqC;QAErC,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;YACxC,KAAK,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAC1E,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YAC1C,iCAAiC;YACjC,IAAI,CAAC,qBAAqB,CAAC,SAAS,EAAE,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,CAAC;YAEvE,oBAAoB;YACpB,KAAK,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YAE1E,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,CAAC;gBAChC,2DAA2D;gBAE3D,iCAAiC;gBACjC,IAAI,CAAC,0BAA0B,CAC7B,SAAS,EACT,KAAK,EACL,mBAAmB,CAAC,IAAI,CACzB,CAAC;gBAEF;;;;;mBAKG;gBACH,KAAK,GAAG,MAAM,IAAI,CAAC,oBAAoB,CACrC,SAAS,EACT,KAAK,EACL,KAAK,EACL,mBAAmB,CAAC,IAAI,CACzB,CAAC;gBAEF;;;mBAGG;gBACH,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;gBAEnD,IAAI,MAAM,EAAE,CAAC;oBACX,0BAA0B;oBAC1B,IAAI,CAAC,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;gBACvD,CAAC;YACH,CAAC;QACH,CAAC;QAED,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAEnC,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,MAAM,GAER,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;YAChC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QACzB,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC3B,CAAC;IAEO,MAAM,CAAC,cAAc,CAC3B,KAAwB;QAExB,KAAK,GAAG,KAA0B,CAAC;QAEnC,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,MAAM,CAAC,cAAc,CAC3B,MAA0B;QAI1B,OAAO,EAAE,MAAM,EAAE,CAAC;IACpB,CAAC;IAEO,MAAM,CAAC,sBAAsB;QACnC,MAAM,SAAS,GAAkB;YAC/B,KAAK;YACL,WAAW;YACX,WAAW;YACX,WAAW;YACX,SAAS;SACV,CAAC;QAEF,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,MAAM,CAAC,oBAAoB,CACjC,SAAiC,EACjC,KAAwB,EACxB,KAAqC;;QAErC,MAAM,KAAK,GAAc,IAAI,SAAS,EAAE,CAAC;QAEzC,MAAM,eAAe,GACnB,kCAAkC,CAAC,kBAAkB,CACnD,KAAK,EACL,cAAc,CAAC,KAAK,CACrB,CAAC;QAEJ,MAAM,qBAAqB,GAAY,IAAI,CAAC,4BAA4B,CACtE,SAAS,EACT,eAAe,IAAI,EAAE,EACrB,mBAAmB,CAAC,IAAI,CACzB,CAAC;QAEF,MAAM,YAAY,GAAgC,KAAK,CAAC,eAAe,EAAE,CAAC;QAE1E,MAAM,mBAAmB,GACvB,eAAe,CAAC,sBAAsB,EAAE,CAAC;QAE3C,oCAAoC;QAEpC,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;YACxB,IAAI,mBAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtC,SAAS;YACX,CAAC;YAED,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjD,MAAM,MAAM,GAAqC,YAAY,CAAC,IAAI,CAChE,CAAC,IAA0B,EAAE,EAAE;oBAC7B,OAAO,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC;gBAC1B,CAAC,CACF,CAAC;gBAEF,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,IAAI,gBAAgB,CACxB,qBAAqB,KAAK,CAAC,YAAY,MAAM,GAAG,0BAA0B,CAC3E,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,sBAAsB,CAC9B,6CAA6C,GAAG,4CAA4C,gBAAgB,CAAC,mBAAmB,CAC9H,CAAA,MAAA,MAAM,CAAC,aAAa,0CAAE,IAAI,KAAI,EAAE,CACjC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACf,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,2BAA2B,CAG9C,SAAiC,EACjC,KAAwB,EACxB,KAAqC;;QAErC,MAAM,KAAK,GAAc,IAAI,SAAS,EAAE,CAAC;QAEzC,MAAM,YAAY,GAAkB,CAAA,MAAA,KAAK,CAAC,eAAe,EAAE,0CAAE,GAAG,KAAI,IAAI,CAAC;QAEzE,uHAAuH;QACvH,IAAI,YAAY,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,CAAC;YACjE,KAAa,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC;QAChD,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,qBAAqB,CACxC,SAAiC,EACjC,KAAwB,EACxB,MAAiC,EACjC,KAAqC;;QAErC,MAAM,KAAK,GAAc,IAAI,SAAS,EAAE,CAAC;QAEzC,MAAM,YAAY,GAAkB,CAAA,MAAA,KAAK,CAAC,eAAe,EAAE,0CAAE,GAAG,KAAI,IAAI,CAAC;QAEzE,uHAAuH;QACvH,IAAI,YAAY,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,CAAC;YACjE,KAAa,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC;QAChD,CAAC;aAAM,IACL,YAAY;YACZ,KAAK,CAAC,0BAA0B;YAChC,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,oBAAoB,CAAC,EAC/C,CAAC;YACD;;;;eAIG;YAEH,MAAM,OAAO,GAA6B,EAAE,CAAC;YAE7C,IAAI,UAAU,GAAoB,EAAE,CAAC;YAErC,IACE,KAAK,CAAC,0BAA0B;gBAChC,KAAK,CAAC,0BAA0B,CAAC,UAAU,EAC3C,CAAC;gBACD,UAAU,GAAG,MAAA,KAAK,CAAC,0BAA0B,0CAAE,UAAU,CAAC;YAC5D,CAAC;YAED,IAAI,aAAa,GAAiB,IAAI,CAAC;YAEvC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;gBACnC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;oBAClB,SAAS;gBACX,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,uBAAuB,GAC3B,MAAM,IAAI,CAAC,mBAAmB,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,kCAClD,KAAK,KACR,oBAAoB,EAAE,KAAK,EAC3B,QAAQ,EAAE,SAAS,EACnB,0BAA0B,EAAE,KAAK,CAAC,0BAA0B,IAC5D,CAAC;oBACL,OAAO,CAAC,IAAI,mBACN,uBAAuB,CAAC,KAA2B,EACvD,CAAC;gBACL,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,2BAA2B;oBAC3B,aAAa,GAAG,CAAU,CAAC;gBAC7B,CAAC;YACH,CAAC;YAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,sBAAsB,CAC9B,CAAA,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,OAAO;oBACpB,mCAAmC,GAAG,KAAK,CAAC,YAAY,CAC3D,CAAC;YACJ,CAAC;YAED,OAAO,OAAc,CAAC;QACxB,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,MAAM,CAAC,4BAA4B,CACzC,SAAiC,EACjC,eAAsC,EACtC,WAAgC;;QAEhC,MAAM,KAAK,GAAc,IAAI,SAAS,EAAE,CAAC;QACzC,MAAM,YAAY,GAAgC,KAAK,CAAC,eAAe,EAAE,CAAC;QAE1E,MAAM,OAAO,GAAkB,EAAE,CAAC;QAElC,MAAM,WAAW,GAAsB,eAAe,CAAC,GAAG,CACxD,CAAC,IAAoB,EAAE,EAAE;YACvB,OAAO,IAAI,CAAC,UAAU,CAAC;QACzB,CAAC,CACF,CAAC;QAEF,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;YAClC,IAAI,iBAAiB,GAAsB,EAAE,CAAC;YAE9C,IAAI,WAAW,KAAK,mBAAmB,CAAC,IAAI,EAAE,CAAC;gBAC7C,iBAAiB,GAAG,CAAA,MAAA,MAAM,CAAC,aAAa,0CAAE,IAAI,KAAI,EAAE,CAAC;YACvD,CAAC;YAED,IAAI,WAAW,KAAK,mBAAmB,CAAC,MAAM,EAAE,CAAC;gBAC/C,iBAAiB,GAAG,CAAA,MAAA,MAAM,CAAC,aAAa,0CAAE,MAAM,KAAI,EAAE,CAAC;YACzD,CAAC;YAED,IAAI,WAAW,KAAK,mBAAmB,CAAC,MAAM,EAAE,CAAC;gBAC/C,iBAAiB,GAAG,CAAA,MAAA,MAAM,CAAC,aAAa,0CAAE,MAAM,KAAI,EAAE,CAAC;YACzD,CAAC;YAED,IAAI,WAAW,KAAK,mBAAmB,CAAC,MAAM,EAAE,CAAC;gBAC/C,MAAM,IAAI,gBAAgB,CAAC,6BAA6B,CAAC,CAAC;YAC5D,CAAC;YAED,IACE,iBAAiB;gBACjB,gBAAgB,CAAC,wBAAwB,CACvC,WAAW,EACX,iBAAiB,CAClB,EACD,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QAED,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAEO,MAAM,CAAC,qBAAqB,CAClC,SAAiC,EACjC,MAA0B,EAC1B,KAAqC;;QAErC,MAAM,KAAK,GAAc,IAAI,SAAS,EAAE,CAAC;QAEzC,MAAM,eAAe,GACnB,kCAAkC,CAAC,kBAAkB,CACnD,KAAK,EACL,cAAc,CAAC,KAAK,CACrB,CAAC;QAEJ,MAAM,qBAAqB,GAAY,IAAI,CAAC,4BAA4B,CACtE,SAAS,EACT,eAAe,IAAI,EAAE,EACrB,mBAAmB,CAAC,IAAI,CACzB,CAAC;QAEF,MAAM,YAAY,GAAgC,KAAK,CAAC,eAAe,EAAE,CAAC;QAE1E,MAAM,mBAAmB,GACvB,eAAe,CAAC,sBAAsB,EAAE,CAAC;QAE3C,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YACzB,IAAI,mBAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtC,SAAS;YACX,CAAC;YAED,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjD,MAAM,MAAM,GAAqC,YAAY,CAAC,IAAI,CAChE,CAAC,MAA4B,EAAE,EAAE;oBAC/B,OAAO,MAAM,CAAC,GAAG,KAAK,GAAG,CAAC;gBAC5B,CAAC,CACF,CAAC;gBACF,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,IAAI,gBAAgB,CACxB,4CAA4C,GAAG,oCAC7C,KAAK,CAAC,YACR,qDAAqD,YAAY,CAAC,IAAI,CACpE,IAAI,CACL,EAAE,CACJ,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,sBAAsB,CAC9B,8CAA8C,GAAG;6DACE,gBAAgB,CAAC,mBAAmB,CAC3E,CAAA,MAAA,MAAM,CAAC,aAAa,0CAAE,IAAI,KAAI,EAAE,CACjC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzB,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,mBAAmB,CAChC,SAAiC,EACjC,IAAyB;;QAEzB,IAAI,gBAAgB,GAAsB,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAc,IAAI,SAAS,EAAE,CAAC;QAEzC,IAAI,IAAI,KAAK,mBAAmB,CAAC,MAAM,EAAE,CAAC;YACxC,gBAAgB,GAAG,CAAA,MAAA,KAAK,CAAC,aAAa,0CAAE,MAAM,KAAI,EAAE,CAAC;QACvD,CAAC;QAED,IAAI,IAAI,KAAK,mBAAmB,CAAC,MAAM,EAAE,CAAC;YACxC,gBAAgB,GAAG,CAAA,MAAA,KAAK,CAAC,aAAa,0CAAE,MAAM,KAAI,EAAE,CAAC;QACvD,CAAC;QAED,IAAI,IAAI,KAAK,mBAAmB,CAAC,MAAM,EAAE,CAAC;YACxC,gBAAgB,GAAG,CAAA,MAAA,KAAK,CAAC,aAAa,0CAAE,MAAM,KAAI,EAAE,CAAC;QACvD,CAAC;QAED,IAAI,IAAI,KAAK,mBAAmB,CAAC,IAAI,EAAE,CAAC;YACtC,gBAAgB,GAAG,CAAA,MAAA,KAAK,CAAC,aAAa,0CAAE,IAAI,KAAI,EAAE,CAAC;QACrD,CAAC;QAED,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED;;;;;OAKG;IACK,MAAM,CAAC,4BAA4B,CACzC,SAAiC,EACjC,gBAAmC,EACnC,IAAyB;QAEzB,MAAM,SAAS,GAAsB,CAAC,GAAG,gBAAgB,CAAC,CAAC;QAE3D,IACE,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,uBAAuB,CAAC;YACtD,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,2BAA2B,CAAC,EAC3D,CAAC;YACD,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,KAAK,GAAQ,IAAI,SAAS,EAAE,CAAC;QACnC,IAAI,KAAK,CAAC,qBAAqB,EAAE,CAAC;YAChC,MAAM,QAAQ,GACZ,IAAI,CAAC,iCAAiC,CAAC,IAAI,CAAC,CAAC;YAC/C,IAAI,QAAQ,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC9C,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC3B,CAAC;YACD,IACE,IAAI,KAAK,mBAAmB,CAAC,IAAI;gBACjC,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,uBAAuB,CAAC,EACvD,CAAC;gBACD,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,MAAM,CAAC,iCAAiC,CAC9C,IAAyB;QAEzB,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,mBAAmB,CAAC,IAAI;gBAC3B,OAAO,UAAU,CAAC,2BAA2B,CAAC;YAChD,KAAK,mBAAmB,CAAC,MAAM;gBAC7B,OAAO,UAAU,CAAC,2BAA2B,CAAC;YAChD,KAAK,mBAAmB,CAAC,MAAM;gBAC7B,OAAO,UAAU,CAAC,6BAA6B,CAAC;YAClD,KAAK,mBAAmB,CAAC,MAAM;gBAC7B,OAAO,UAAU,CAAC,6BAA6B,CAAC;YAClD;gBACE,OAAO,IAAI,CAAC;QAChB,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,MAAM,CAAC,KAAK,CAAC,oBAAoB,CACvC,SAAiC,EACjC,KAAwB,EACxB,KAAqC,EACrC,IAAyB;QAEzB,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;YACxC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,IAAI,KAAK,mBAAmB,CAAC,MAAM,EAAE,CAAC;YACxC,OAAO,KAAK,CAAC;QACf,CAAC;QAED;;;;WAIG;QACH,8DAA8D;QAC9D,MAAM,KAAK,GAAQ,IAAI,SAAS,EAAE,CAAC;QACnC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;YACxB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,gBAAgB,GAAsB,IAAI,CAAC,mBAAmB,CAClE,SAAS,EACT,IAAI,CACL,CAAC;QACF,MAAM,oBAAoB,GACxB,IAAI,CAAC,4BAA4B,CAAC,SAAS,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAC;QAEvE,MAAM,eAAe,GACnB,kCAAkC,CAAC,kBAAkB,CACnD,KAAK,EACL,cAAc,CAAC,KAAK,CACrB,CAAC;QAEJ,MAAM,cAAc,GAA0B,eAAe,CAAC,MAAM,CAClE,CAAC,CAAiB,EAAE,EAAE;YACpB,OAAO,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACrD,CAAC,CACF,CAAC;QAEF,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,OAAO,KAAK,CAAC;QACf,CAAC;QAED;;;WAGG;QACH,MAAM,gBAAgB,GAAY,cAAc,CAAC,IAAI,CACnD,CAAC,CAAiB,EAAE,EAAE;YACpB,OAAO,CAAC,CAAC,KAAK,KAAK,eAAe,CAAC,KAAK,CAAC;QAC3C,CAAC,CACF,CAAC;QACF,IAAI,gBAAgB,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC;QACf,CAAC;QAED;;;;WAIG;QACH,MAAM,kBAAkB;QAKtB,qGAAqG;QACrG,OAAO,CAAC,4CAA4C,CAAC,CAAC,OAAO,CAAC;QAEhE,MAAM,YAAY,GAQF,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,iBAAiB,GAAgB,IAAI,GAAG,EAAU,CAAC;QAEzD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,8DAA8D;YAC9D,MAAM,aAAa,GACjB,MAAM,YAAY,CAAC,gBAAgB,CAAC,MAAM,CAAC;gBACzC,KAAK,kBACH,MAAM,EAAE,KAAK,CAAC,MAAM,IACjB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACzD;gBACD,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;gBAC3B,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;gBACvB,IAAI,EAAE,CAAC;gBACP,KAAK,EAAE,SAAS;aACjB,CAAC,CAAC;YACL,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;gBAChC,MAAM,EAAE,GAAyB,GAAG,CAAC,SAAS,CAAC;gBAC/C,IAAI,EAAE,EAAE,CAAC;oBACP,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACvC,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtD,8DAA8D;YAC9D,MAAM,aAAa,GACjB,MAAM,YAAY,CAAC,gBAAgB,CAAC,MAAM,CAAC;gBACzC,KAAK,kBACH,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,IACvC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACzD;gBACD,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;gBAC3B,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;gBACvB,IAAI,EAAE,CAAC;gBACP,KAAK,EAAE,SAAS;aACjB,CAAC,CAAC;YACL,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;gBAChC,MAAM,EAAE,GAAyB,GAAG,CAAC,SAAS,CAAC;gBAC/C,IAAI,EAAE,EAAE,CAAC;oBACP,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACvC,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAW,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC;QACrD,MAAM,MAAM,GACV,iBAAiB,CAAC,IAAI,GAAG,CAAC;YACxB,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC;YAC/B,CAAC,CAAC,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,0BAA0B;QAEzE,8DAA8D;QAC7D,KAAa,CAAC,QAAQ,CAAC,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;QAEhD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,MAAM,CAAC,yBAAyB,CACtC,SAAiC,EACjC,IAAyB;QAEzB,IAAI,eAAe,GAAY,KAAK,CAAC;QACrC,eAAe,GAAG,IAAI,CAAC,mBAAmB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,QAAQ,CAClE,UAAU,CAAC,MAAM,CAClB,CAAC;QACF,OAAO,eAAe,CAAC;IACzB,CAAC;IAGa,AAAP,MAAM,CAAC,qBAAqB,CACjC,SAAiC,EACjC,KAAqC,EACrC,IAAyB;QAEzB,uFAAuF;QAEvF,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACtE,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,GAAG,EAAE,CAAC;gBACpC,uCAAuC;gBACvC,OAAO;YACT,CAAC;YAED,kFAAkF;YAClF,MAAM,IAAI,yBAAyB,CACjC,sDAAsD,IAAI,cACxD,IAAI,SAAS,EAAE,CAAC,YAClB,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,0BAA0B,CACvC,SAAiC,EACjC,KAAqC,EACrC,IAAyB;;QAEzB,IAAI,CAAC,qBAAqB,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAEnD,+DAA+D;QAC/D,MAAM,eAAe,GACnB,kCAAkC,CAAC,kBAAkB,CACnD,KAAK,EACL,cAAc,CAAC,KAAK,CACrB,CAAC;QACJ,MAAM,gBAAgB,GAAsB,IAAI,CAAC,mBAAmB,CAClE,SAAS,EACT,IAAI,CACL,CAAC;QAEF;;;;;WAKG;QACH,MAAM,yBAAyB,GAC7B,IAAI,CAAC,4BAA4B,CAAC,SAAS,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAC;QAEvE,IACE,CAAC,gBAAgB,CAAC,wBAAwB,CACxC,eAAe,CAAC,GAAG,CAAC,CAAC,cAA8B,EAAE,EAAE;YACrD,OAAO,cAAc,CAAC,UAAU,CAAC;QACnC,CAAC,CAAC,IAAI,EAAE,EACR,yBAAyB,CAC1B,EACD,CAAC;YACD,MAAM,WAAW,GACf,gBAAgB,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;YAEzD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,sBAAsB,CAC9B,GAAG,IAAI,OAAO,IAAI,SAAS,EAAE,CAAC,YAAY,kBAAkB,CAC7D,CAAC;YACJ,CAAC;YAED,MAAM,IAAI,sBAAsB,CAC9B,kCAAkC,IAAI,IACpC,IAAI,SAAS,EAAE,CAAC,YAClB,wCAAwC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACjE,CAAC;QACJ,CAAC;QAED,8BAA8B;QAE9B,IAAI,gBAAgB,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YAC1C,MAAM,KAAK,GAAc,IAAI,SAAS,EAAE,CAAC;YAEzC,IACE,KAAK,CAAC,oBAAoB;gBAC1B,CAAC,KAAK,CAAC,iCAAiC,EACxC,CAAC;gBACD,MAAM,IAAI,wBAAwB,CAChC,gLAAgL,CACjL,CAAC;YACJ,CAAC;YAED,IACE,IAAI,KAAK,mBAAmB,CAAC,MAAM;iBACnC,MAAA,KAAK,CAAC,yBAAyB,0CAAE,MAAM,CAAA,EACvC,CAAC;gBACD,IACE,CAAC,gBAAgB,CAAC,gCAAgC,CAChD,KAAK,CAAC,yBAAyB,CAAC,MAAM,EACtC,KAAK,CAAC,WAAW,EACjB,aAAa,EAAE,CAChB,EACD,CAAC;oBACD,MAAM,IAAI,wBAAwB,CAChC,8BAA8B;wBAC5B,KAAK,CAAC,yBAAyB,CAAC,MAAM;wBACtC,yBAAyB,CAC5B,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,IACE,IAAI,KAAK,mBAAmB,CAAC,MAAM;iBACnC,MAAA,KAAK,CAAC,yBAAyB,0CAAE,MAAM,CAAA,EACvC,CAAC;gBACD,IACE,CAAC,gBAAgB,CAAC,gCAAgC,CAChD,KAAK,CAAC,yBAAyB,CAAC,MAAM,EACtC,KAAK,CAAC,WAAW,EACjB,aAAa,EAAE,CAChB,EACD,CAAC;oBACD,MAAM,IAAI,wBAAwB,CAChC,8BAA8B;wBAC5B,KAAK,CAAC,yBAAyB,CAAC,MAAM;wBACtC,yBAAyB,CAC5B,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,IACE,IAAI,KAAK,mBAAmB,CAAC,MAAM;iBACnC,MAAA,KAAK,CAAC,yBAAyB,0CAAE,MAAM,CAAA,EACvC,CAAC;gBACD,IACE,CAAC,gBAAgB,CAAC,gCAAgC,CAChD,KAAK,CAAC,yBAAyB,CAAC,MAAM,EACtC,KAAK,CAAC,WAAW,EACjB,aAAa,EAAE,CAChB,EACD,CAAC;oBACD,MAAM,IAAI,wBAAwB,CAChC,8BAA8B;wBAC5B,KAAK,CAAC,yBAAyB,CAAC,MAAM;wBACtC,yBAAyB,CAC5B,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,IACE,IAAI,KAAK,mBAAmB,CAAC,IAAI;iBACjC,MAAA,KAAK,CAAC,yBAAyB,0CAAE,IAAI,CAAA,EACrC,CAAC;gBACD,IACE,CAAC,gBAAgB,CAAC,gCAAgC,CAChD,MAAA,KAAK,CAAC,yBAAyB,0CAAE,IAAI,EACrC,KAAK,CAAC,WAAW,EACjB,aAAa,EAAE,CAChB,EACD,CAAC;oBACD,MAAM,IAAI,wBAAwB,CAChC,8BAA8B;yBAC5B,MAAA,KAAK,CAAC,yBAAyB,0CAAE,IAAI,CAAA;wBACrC,yBAAyB,CAC5B,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAl7BqB;IADnB,WAAW,EAAE;;;;kDA2Bb;AAGmB;IADnB,WAAW,EAAE;;yEAIN,UAAU,oBAAV,UAAU;;mDA0BjB;AAGa;IADb,WAAW,EAAE;;iEAGN,UAAU,oBAAV,UAAU;;mDAoBjB;AAkHmB;IADnB,WAAW,EAAE;;;;gDAgEb;AA0gBa;IADb,WAAW,EAAE;;;;kDAqBb"}

package/build/dist/Server/Types/Database/Permissions/BasePermission.js

@@ -10,6 +10,7 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 import DatabaseRequestType from "../../BaseDatabase/DatabaseRequestType";
 import QueryUtil from "../QueryUtil";
 import AccessControlPermission from "./AccessControlPermission";
+import OwnedScopePermission from "./OwnedScopePermission";
 import PermissionUtil from "./PermissionsUtil";
 import PublicPermission from "./PublicPermission";
 import QueryPermission from "./QueryPermission";
@@ -42,6 +43,14 @@ export default class BasePermission {
                  */
                 QueryPermission.checkQueryPermission(modelType, query, props);
                 query = await AccessControlPermission.addAccessControlIdsToQuery(modelType, query, select, props, type);
+                /*
+                 * Apply the `Owned` permission scope filter (see
+                 * Internal/Docs/PermissionsSimplification.md). When the user's
+                 * applicable permission rows are exclusively Owned-scoped, this
+                 * restricts the query to resources where the user is in *OwnerUser
+                 * or any of their teams is in *OwnerTeam.
+                 */
+                query = await OwnedScopePermission.addOwnedScopeToQuery(modelType, query, props, type);
                 /// Implement Related Permissions.
                 if (model.canAccessIfCanReadOn) {
                     const tableColumnMetadata = model.getTableColumnMetadata(model.canAccessIfCanReadOn);

package/build/dist/Server/Types/Database/Permissions/BasePermission.js.map

@@ -1 +1 @@
-{"version":3,"file":"BasePermission.js","sourceRoot":"","sources":["../../../../../../Server/Types/Database/Permissions/BasePermission.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,mBAAmB,MAAM,wCAAwC,CAAC;AAEzE,OAAO,SAAS,MAAM,cAAc,CAAC;AAErC,OAAO,uBAAuB,MAAM,2BAA2B,CAAC;AAChE,OAAO,cAAc,MAAM,mBAAmB,CAAC;AAC/C,OAAO,gBAAgB,MAAM,oBAAoB,CAAC;AAClD,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,gBAAgB,MAAM,oBAAoB,CAAC;AAClD,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,gBAAgB,MAAM,oBAAoB,CAAC;AAClD,OAAO,eAAe,MAAM,kBAAkB,CAAC;AAI/C,OAAO,eAAe,MAAM,4CAA4C,CAAC;AAEzE,OAAO,WAAW,MAAM,sCAAsC,CAAC;AAM/D,MAAM,CAAC,OAAO,OAAO,cAAc;IAEb,AAAb,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAClC,SAAiC,EACjC,KAAwB,EACxB,MAAiC,EACjC,KAAqC,EACrC,IAAyB;QAEzB,MAAM,KAAK,GAAc,IAAI,SAAS,EAAE,CAAC;QAEzC,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;YACxC,KAAK,GAAG,MAAM,cAAc,CAAC,2BAA2B,CACtD,SAAS,EACT,KAAK,EACL,KAAK,CACN,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YAC1C,iCAAiC;YACjC,gBAAgB,CAAC,qBAAqB,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YAE/D,oBAAoB;YACpB,KAAK,GAAG,MAAM,gBAAgB,CAAC,qBAAqB,CAClD,SAAS,EACT,KAAK,EACL,MAAM,EACN,KAAK,EACL,IAAI,CACL,CAAC;YAEF,wBAAwB;YACxB,KAAK,GAAG,MAAM,eAAe,CAAC,mBAAmB,CAC/C,SAAS,EACT,KAAK,EACL,KAAK,CACN,CAAC;YAEF,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,CAAC;gBAChC,2DAA2D;gBAE3D,iCAAiC;gBACjC,eAAe,CAAC,0BAA0B,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;gBAEnE;;;mBAGG;gBACH,eAAe,CAAC,oBAAoB,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;gBAE9D,KAAK,GAAG,MAAM,uBAAuB,CAAC,0BAA0B,CAC9D,SAAS,EACT,KAAK,EACL,MAAM,EACN,KAAK,EACL,IAAI,CACL,CAAC;gBAEF,kCAAkC;gBAClC,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;oBAC/B,MAAM,mBAAmB,GACvB,KAAK,CAAC,sBAAsB,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;oBAE3D,IACE,mBAAmB;wBACnB,mBAAmB,CAAC,SAAS;wBAC7B,CAAC,mBAAmB,CAAC,IAAI,KAAK,eAAe,CAAC,MAAM;4BAClD,mBAAmB,CAAC,IAAI,KAAK,eAAe,CAAC,WAAW,CAAC,EAC3D,CAAC;wBACD,MAAM,gBAAgB,GACpB,uBAAuB,CAAC,2BAA2B,CACjD,mBAAmB,CAAC,SAAS,EAC7B,EAAE,EACF;4BACE,GAAG,EAAE,IAAI;yBACV,EACD,KAAK,EACL,IAAI,CACL,CAAC;wBAEJ,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;4BAChC,MAAM,wBAAwB,GAC5B,IAAI,mBAAmB,CAAC,SAAS,EAAE,CAAC;4BAErC,KAAa,CAAC,KAAK,CAAC,oBAA8B,CAAC,GAAG;gCACrD,CAAC,wBAAwB,CAAC,sBAAsB,EAAY,CAAC,EAC3D,gBAAgB;6BACnB,CAAC;wBACJ,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,IAAI,MAAM,EAAE,CAAC;oBACX,0BAA0B;oBAC1B,gBAAgB,CAAC,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;oBACjE,eAAe,CAAC,4BAA4B,CAC1C,SAAS,EACT,MAAM,EACN,KAAK,CACN,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,KAAK,GAAG,SAAS,CAAC,cAAc,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAEnD,OAAO,EAAE,KAAK,EAAE,CAAC;IACnB,CAAC;CACF;AA3GqB;IADnB,WAAW,EAAE;;;;4CA2Gb"}
+{"version":3,"file":"BasePermission.js","sourceRoot":"","sources":["../../../../../../Server/Types/Database/Permissions/BasePermission.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,mBAAmB,MAAM,wCAAwC,CAAC;AAEzE,OAAO,SAAS,MAAM,cAAc,CAAC;AAErC,OAAO,uBAAuB,MAAM,2BAA2B,CAAC;AAChE,OAAO,oBAAoB,MAAM,wBAAwB,CAAC;AAC1D,OAAO,cAAc,MAAM,mBAAmB,CAAC;AAC/C,OAAO,gBAAgB,MAAM,oBAAoB,CAAC;AAClD,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,gBAAgB,MAAM,oBAAoB,CAAC;AAClD,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,gBAAgB,MAAM,oBAAoB,CAAC;AAClD,OAAO,eAAe,MAAM,kBAAkB,CAAC;AAI/C,OAAO,eAAe,MAAM,4CAA4C,CAAC;AAEzE,OAAO,WAAW,MAAM,sCAAsC,CAAC;AAM/D,MAAM,CAAC,OAAO,OAAO,cAAc;IAEb,AAAb,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAClC,SAAiC,EACjC,KAAwB,EACxB,MAAiC,EACjC,KAAqC,EACrC,IAAyB;QAEzB,MAAM,KAAK,GAAc,IAAI,SAAS,EAAE,CAAC;QAEzC,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;YACxC,KAAK,GAAG,MAAM,cAAc,CAAC,2BAA2B,CACtD,SAAS,EACT,KAAK,EACL,KAAK,CACN,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YAC1C,iCAAiC;YACjC,gBAAgB,CAAC,qBAAqB,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YAE/D,oBAAoB;YACpB,KAAK,GAAG,MAAM,gBAAgB,CAAC,qBAAqB,CAClD,SAAS,EACT,KAAK,EACL,MAAM,EACN,KAAK,EACL,IAAI,CACL,CAAC;YAEF,wBAAwB;YACxB,KAAK,GAAG,MAAM,eAAe,CAAC,mBAAmB,CAC/C,SAAS,EACT,KAAK,EACL,KAAK,CACN,CAAC;YAEF,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,CAAC;gBAChC,2DAA2D;gBAE3D,iCAAiC;gBACjC,eAAe,CAAC,0BAA0B,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;gBAEnE;;;mBAGG;gBACH,eAAe,CAAC,oBAAoB,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;gBAE9D,KAAK,GAAG,MAAM,uBAAuB,CAAC,0BAA0B,CAC9D,SAAS,EACT,KAAK,EACL,MAAM,EACN,KAAK,EACL,IAAI,CACL,CAAC;gBAEF;;;;;;mBAMG;gBACH,KAAK,GAAG,MAAM,oBAAoB,CAAC,oBAAoB,CACrD,SAAS,EACT,KAAK,EACL,KAAK,EACL,IAAI,CACL,CAAC;gBAEF,kCAAkC;gBAClC,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;oBAC/B,MAAM,mBAAmB,GACvB,KAAK,CAAC,sBAAsB,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;oBAE3D,IACE,mBAAmB;wBACnB,mBAAmB,CAAC,SAAS;wBAC7B,CAAC,mBAAmB,CAAC,IAAI,KAAK,eAAe,CAAC,MAAM;4BAClD,mBAAmB,CAAC,IAAI,KAAK,eAAe,CAAC,WAAW,CAAC,EAC3D,CAAC;wBACD,MAAM,gBAAgB,GACpB,uBAAuB,CAAC,2BAA2B,CACjD,mBAAmB,CAAC,SAAS,EAC7B,EAAE,EACF;4BACE,GAAG,EAAE,IAAI;yBACV,EACD,KAAK,EACL,IAAI,CACL,CAAC;wBAEJ,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;4BAChC,MAAM,wBAAwB,GAC5B,IAAI,mBAAmB,CAAC,SAAS,EAAE,CAAC;4BAErC,KAAa,CAAC,KAAK,CAAC,oBAA8B,CAAC,GAAG;gCACrD,CAAC,wBAAwB,CAAC,sBAAsB,EAAY,CAAC,EAC3D,gBAAgB;6BACnB,CAAC;wBACJ,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,IAAI,MAAM,EAAE,CAAC;oBACX,0BAA0B;oBAC1B,gBAAgB,CAAC,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;oBACjE,eAAe,CAAC,4BAA4B,CAC1C,SAAS,EACT,MAAM,EACN,KAAK,CACN,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,KAAK,GAAG,SAAS,CAAC,cAAc,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAEnD,OAAO,EAAE,KAAK,EAAE,CAAC;IACnB,CAAC;CACF;AAzHqB;IADnB,WAAW,EAAE;;;;4CAyHb"}

package/build/dist/Server/Types/Database/Permissions/OwnedScopePermission.js

@@ -0,0 +1,241 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import DatabaseRequestType from "../../BaseDatabase/DatabaseRequestType";
+import QueryHelper from "../QueryHelper";
+import TablePermission from "./TablePermission";
+import LIMIT_MAX from "../../../../Types/Database/LimitMax";
+import DatabaseCommonInteractionPropsUtil, { PermissionType, } from "../../../../Types/BaseDatabase/DatabaseCommonInteractionPropsUtil";
+import PermissionScope from "../../../../Types/Database/AccessControl/PermissionScope";
+import ObjectID from "../../../../Types/ObjectID";
+import Permission, { PermissionHelper, } from "../../../../Types/Permission";
+import CaptureSpan from "../../../Utils/Telemetry/CaptureSpan";
+/*
+ * Implements the `Owned` permission scope (see
+ * Internal/Docs/PermissionsSimplification.md). When the requesting user's
+ * applicable permission rows are exclusively `Owned`-scoped, this restricts
+ * the query to resources where the user is in *OwnerUser or any of the
+ * user's teams is in *OwnerTeam.
+ *
+ * `All` and `Labels` scoped rows are evaluated elsewhere; if any non-Owned
+ * row also grants the operation, that broader grant wins and this filter
+ * is skipped.
+ */
+export default class OwnedScopePermission {
+    static async addOwnedScopeToQuery(modelType, query, props, type) {
+        if (props.isRoot || props.isMasterAdmin) {
+            return query;
+        }
+        /*
+         * Create has no resource to scope to; auto-owner-on-create lives in the
+         * create path itself, not here.
+         */
+        if (type === DatabaseRequestType.Create) {
+            return query;
+        }
+        const model = new modelType();
+        /*
+         * Owned scope only restricts resources that can carry ownership:
+         * operational resources (own *OwnerUser / *OwnerTeam tables) or
+         * nested resources that inherit ownership via @OwnedThrough. For
+         * everything else (settings / config tables like IncidentState,
+         * Label, Team, etc.) the table-level permission check is the only
+         * gate — Owned has no resources to scope to, so it's a no-op.
+         */
+        if (!model.isOperationalResource && !model.ownedThrough) {
+            return query;
+        }
+        const effectivePermissions = OwnedScopePermission.getEffectivePermissionsForModel(modelType, type);
+        const userPermissions = DatabaseCommonInteractionPropsUtil.getUserPermissions(props, PermissionType.Allow);
+        const applicableRows = userPermissions.filter((p) => {
+            return effectivePermissions.includes(p.permission);
+        });
+        if (applicableRows.length === 0) {
+            /*
+             * No grant applies — the existing table-level check will reject this
+             * request. Leave the query untouched.
+             */
+            return query;
+        }
+        /*
+         * If any applicable row is non-Owned (All / Labels / undefined), it
+         * grants broader access than Owned and the Owned constraint is moot.
+         * Rows for scope-exempt permissions (e.g. ProjectOwner) are also
+         * treated as broader grants regardless of their stored scope, since
+         * scoping doesn't apply to them.
+         */
+        const hasNonOwnedGrant = applicableRows.some((p) => {
+            if (!PermissionHelper.isScopeApplicable(p.permission)) {
+                return true;
+            }
+            return p.scope !== PermissionScope.Owned;
+        });
+        if (hasNonOwnedGrant) {
+            return query;
+        }
+        // All applicable rows are Owned-scoped. Resolve allowed resource IDs.
+        const allowedIds = await OwnedScopePermission.getAllowedResourceIds(modelType, props);
+        if (model.ownedThrough) {
+            /*
+             * Nested resource: ownership inherits via the parent FK. The allowedIds
+             * we computed are the parent's IDs, so filter on the FK column.
+             */
+            const fkColumn = model.ownedThrough.fkColumn;
+            if (allowedIds.length === 0) {
+                // No accessible parents -> match nothing.
+                // eslint-disable-next-line @typescript-eslint/no-explicit-any
+                query._id = QueryHelper.equalTo(ObjectID.getZeroObjectID().toString());
+            }
+            else {
+                // eslint-disable-next-line @typescript-eslint/no-explicit-any
+                query[fkColumn] = QueryHelper.any(allowedIds);
+            }
+        }
+        else if (allowedIds.length === 0) {
+            // Top-level operational resource: no accessible IDs -> match nothing.
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            query._id = QueryHelper.equalTo(ObjectID.getZeroObjectID().toString());
+        }
+        else {
+            // Top-level operational resource: filter on _id.
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            query._id = QueryHelper.any(allowedIds);
+        }
+        return query;
+    }
+    /*
+     * Returns the permissions that should be considered to grant access for
+     * this op/model — model-enumerated plus operational wildcards plus the
+     * ReadAllProjectResources runtime alias. Mirrors the logic in
+     * TablePermission.getEffectiveModelPermissions but exposed here because
+     * we need to filter user-permission rows by this set.
+     */
+    static getEffectivePermissionsForModel(modelType, type) {
+        const modelPermissions = TablePermission.getTablePermission(modelType, type);
+        const effective = [...modelPermissions];
+        if (effective.includes(Permission.ReadAllProjectResources) &&
+            !effective.includes(Permission.ReadAllOperationalResources)) {
+            effective.push(Permission.ReadAllOperationalResources);
+        }
+        const model = new modelType();
+        if (model.isOperationalResource) {
+            const wildcard = OwnedScopePermission.getWildcardPermissionForOperation(type);
+            if (wildcard && !effective.includes(wildcard)) {
+                effective.push(wildcard);
+            }
+            if (type === DatabaseRequestType.Read &&
+                !effective.includes(Permission.ReadAllProjectResources)) {
+                effective.push(Permission.ReadAllProjectResources);
+            }
+        }
+        return effective;
+    }
+    static getWildcardPermissionForOperation(type) {
+        switch (type) {
+            case DatabaseRequestType.Read:
+                return Permission.ReadAllOperationalResources;
+            case DatabaseRequestType.Update:
+                return Permission.EditAllOperationalResources;
+            case DatabaseRequestType.Delete:
+                return Permission.DeleteAllOperationalResources;
+            case DatabaseRequestType.Create:
+                return Permission.CreateAllOperationalResources;
+            default:
+                return null;
+        }
+    }
+    /*
+     * Computes the set of resource IDs the requesting user can access via
+     * ownership: those where they personally sit in *OwnerUser OR where any of
+     * their teams sits in *OwnerTeam.
+     *
+     * For nested models the lookup uses the parent's owner tables and returns
+     * parent IDs (the caller filters the nested query by the parent FK).
+     */
+    static async getAllowedResourceIds(modelType, props) {
+        const model = new modelType();
+        // Determine which model's owner tables to consult.
+        let resolverName;
+        if (model.ownedThrough) {
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            resolverName = model.ownedThrough.parentModel.name;
+        }
+        else {
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            resolverName = modelType.name;
+        }
+        /*
+         * Lazy require to avoid the circular dep cycle: this file is reachable
+         * from DatabaseService at module-load time, and the registry imports
+         * services that extend DatabaseService.
+         */
+        const ownerTableRegistry = 
+        // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-var-requires
+        require("./OwnerTableRegistry").default;
+        const registryEntry = ownerTableRegistry.get(resolverName);
+        if (!registryEntry) {
+            /*
+             * No registered owner tables for this model — Owned scope can't
+             * resolve, so nothing is accessible.
+             */
+            return [];
+        }
+        const seen = new Set();
+        const fkColumn = registryEntry.fkColumn;
+        /*
+         * User-ownership lookup. Skipped for non-user callers (API keys, Probes
+         * with no userId); those evaluate `Owned` as `All` elsewhere.
+         */
+        if (props.userId) {
+            const userOwnedRows = await registryEntry.ownerUserService.findBy({
+                query: Object.assign({ userId: props.userId }, (props.tenantId ? { projectId: props.tenantId } : {})),
+                select: { [fkColumn]: true },
+                props: { isRoot: true },
+                skip: 0,
+                limit: LIMIT_MAX,
+            });
+            for (const row of userOwnedRows) {
+                // eslint-disable-next-line @typescript-eslint/no-explicit-any
+                const value = row[fkColumn];
+                if (value) {
+                    seen.add(value.toString());
+                }
+            }
+        }
+        // Team-ownership lookup.
+        if (props.userTeamIds && props.userTeamIds.length > 0) {
+            const teamOwnedRows = await registryEntry.ownerTeamService.findBy({
+                query: Object.assign({ teamId: QueryHelper.any(props.userTeamIds) }, (props.tenantId ? { projectId: props.tenantId } : {})),
+                select: { [fkColumn]: true },
+                props: { isRoot: true },
+                skip: 0,
+                limit: LIMIT_MAX,
+            });
+            for (const row of teamOwnedRows) {
+                // eslint-disable-next-line @typescript-eslint/no-explicit-any
+                const value = row[fkColumn];
+                if (value) {
+                    seen.add(value.toString());
+                }
+            }
+        }
+        const result = [];
+        for (const id of seen) {
+            result.push(new ObjectID(id));
+        }
+        return result;
+    }
+}
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object, Object, String]),
+    __metadata("design:returntype", Promise)
+], OwnedScopePermission, "addOwnedScopeToQuery", null);
+//# sourceMappingURL=OwnedScopePermission.js.map

package/build/dist/Server/Types/Database/Permissions/OwnedScopePermission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OwnedScopePermission.js","sourceRoot":"","sources":["../../../../../../Server/Types/Database/Permissions/OwnedScopePermission.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,mBAAmB,MAAM,wCAAwC,CAAC;AAEzE,OAAO,WAAW,MAAM,gBAAgB,CAAC;AACzC,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAYhD,OAAO,SAAS,MAAM,qCAAqC,CAAC;AAE5D,OAAO,kCAAkC,EAAE,EACzC,cAAc,GACf,MAAM,mEAAmE,CAAC;AAC3E,OAAO,eAAe,MAAM,0DAA0D,CAAC;AACvF,OAAO,QAAQ,MAAM,4BAA4B,CAAC;AAClD,OAAO,UAAU,EAAE,EACjB,gBAAgB,GAEjB,MAAM,8BAA8B,CAAC;AACtC,OAAO,WAAW,MAAM,sCAAsC,CAAC;AAE/D;;;;;;;;;;GAUG;AACH,MAAM,CAAC,OAAO,OAAO,oBAAoB;IAEnB,AAAb,MAAM,CAAC,KAAK,CAAC,oBAAoB,CACtC,SAAiC,EACjC,KAAwB,EACxB,KAAqC,EACrC,IAAyB;QAEzB,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;YACxC,OAAO,KAAK,CAAC;QACf,CAAC;QAED;;;WAGG;QACH,IAAI,IAAI,KAAK,mBAAmB,CAAC,MAAM,EAAE,CAAC;YACxC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,KAAK,GAAc,IAAI,SAAS,EAAE,CAAC;QAEzC;;;;;;;WAOG;QACH,IAAI,CAAC,KAAK,CAAC,qBAAqB,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;YACxD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,oBAAoB,GACxB,oBAAoB,CAAC,+BAA+B,CAClD,SAAkC,EAClC,IAAI,CACL,CAAC;QAEJ,MAAM,eAAe,GACnB,kCAAkC,CAAC,kBAAkB,CACnD,KAAK,EACL,cAAc,CAAC,KAAK,CACrB,CAAC;QAEJ,MAAM,cAAc,GAA0B,eAAe,CAAC,MAAM,CAClE,CAAC,CAAiB,EAAE,EAAE;YACpB,OAAO,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACrD,CAAC,CACF,CAAC;QAEF,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC;;;eAGG;YACH,OAAO,KAAK,CAAC;QACf,CAAC;QAED;;;;;;WAMG;QACH,MAAM,gBAAgB,GAAY,cAAc,CAAC,IAAI,CACnD,CAAC,CAAiB,EAAE,EAAE;YACpB,IAAI,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;gBACtD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,CAAC,CAAC,KAAK,KAAK,eAAe,CAAC,KAAK,CAAC;QAC3C,CAAC,CACF,CAAC;QACF,IAAI,gBAAgB,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,sEAAsE;QACtE,MAAM,UAAU,GACd,MAAM,oBAAoB,CAAC,qBAAqB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAErE,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;YACvB;;;eAGG;YACH,MAAM,QAAQ,GAAW,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC;YACrD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC5B,0CAA0C;gBAC1C,8DAA8D;gBAC7D,KAAa,CAAC,GAAG,GAAG,WAAW,CAAC,OAAO,CACtC,QAAQ,CAAC,eAAe,EAAE,CAAC,QAAQ,EAAE,CACtC,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,8DAA8D;gBAC7D,KAAa,CAAC,QAAQ,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;aAAM,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,sEAAsE;YACtE,8DAA8D;YAC7D,KAAa,CAAC,GAAG,GAAG,WAAW,CAAC,OAAO,CACtC,QAAQ,CAAC,eAAe,EAAE,CAAC,QAAQ,EAAE,CACtC,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,iDAAiD;YACjD,8DAA8D;YAC7D,KAAa,CAAC,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACnD,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,+BAA+B,CAC5C,SAAgC,EAChC,IAAyB;QAEzB,MAAM,gBAAgB,GACpB,eAAe,CAAC,kBAAkB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACtD,MAAM,SAAS,GAAsB,CAAC,GAAG,gBAAgB,CAAC,CAAC;QAE3D,IACE,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,uBAAuB,CAAC;YACtD,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,2BAA2B,CAAC,EAC3D,CAAC;YACD,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,KAAK,GAAc,IAAI,SAAS,EAAE,CAAC;QACzC,IAAI,KAAK,CAAC,qBAAqB,EAAE,CAAC;YAChC,MAAM,QAAQ,GACZ,oBAAoB,CAAC,iCAAiC,CAAC,IAAI,CAAC,CAAC;YAC/D,IAAI,QAAQ,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC9C,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC3B,CAAC;YACD,IACE,IAAI,KAAK,mBAAmB,CAAC,IAAI;gBACjC,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,uBAAuB,CAAC,EACvD,CAAC;gBACD,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,MAAM,CAAC,iCAAiC,CAC9C,IAAyB;QAEzB,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,mBAAmB,CAAC,IAAI;gBAC3B,OAAO,UAAU,CAAC,2BAA2B,CAAC;YAChD,KAAK,mBAAmB,CAAC,MAAM;gBAC7B,OAAO,UAAU,CAAC,2BAA2B,CAAC;YAChD,KAAK,mBAAmB,CAAC,MAAM;gBAC7B,OAAO,UAAU,CAAC,6BAA6B,CAAC;YAClD,KAAK,mBAAmB,CAAC,MAAM;gBAC7B,OAAO,UAAU,CAAC,6BAA6B,CAAC;YAClD;gBACE,OAAO,IAAI,CAAC;QAChB,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,MAAM,CAAC,KAAK,CAAC,qBAAqB,CACxC,SAAiC,EACjC,KAAqC;QAErC,MAAM,KAAK,GAAc,IAAI,SAAS,EAAE,CAAC;QAEzC,mDAAmD;QACnD,IAAI,YAAoB,CAAC;QACzB,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;YACvB,8DAA8D;YAC9D,YAAY,GAAI,KAAK,CAAC,YAAY,CAAC,WAAmB,CAAC,IAAI,CAAC;QAC9D,CAAC;aAAM,CAAC;YACN,8DAA8D;YAC9D,YAAY,GAAI,SAAiB,CAAC,IAAI,CAAC;QACzC,CAAC;QAED;;;;WAIG;QACH,MAAM,kBAAkB;QACtB,qGAAqG;QACrG,OAAO,CAAC,sBAAsB,CAAC,CAAC,OAAO,CAAC;QAE1C,MAAM,aAAa,GACjB,kBAAkB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACvC,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB;;;eAGG;YACH,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,IAAI,GAAgB,IAAI,GAAG,EAAU,CAAC;QAC5C,MAAM,QAAQ,GAAW,aAAa,CAAC,QAAQ,CAAC;QAEhD;;;WAGG;QACH,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,aAAa,GACjB,MAAM,aAAa,CAAC,gBAAgB,CAAC,MAAM,CAAC;gBAC1C,KAAK,kBACH,MAAM,EAAE,KAAK,CAAC,MAAM,IACjB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACzD;gBACD,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE;gBAC5B,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;gBACvB,IAAI,EAAE,CAAC;gBACP,KAAK,EAAE,SAAS;aACjB,CAAC,CAAC;YACL,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;gBAChC,8DAA8D;gBAC9D,MAAM,KAAK,GAA0B,GAAW,CAAC,QAAQ,CAAC,CAAC;gBAC3D,IAAI,KAAK,EAAE,CAAC;oBACV,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAC7B,CAAC;YACH,CAAC;QACH,CAAC;QAED,yBAAyB;QACzB,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtD,MAAM,aAAa,GACjB,MAAM,aAAa,CAAC,gBAAgB,CAAC,MAAM,CAAC;gBAC1C,KAAK,kBACH,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,IACvC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACzD;gBACD,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE;gBAC5B,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;gBACvB,IAAI,EAAE,CAAC;gBACP,KAAK,EAAE,SAAS;aACjB,CAAC,CAAC;YACL,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;gBAChC,8DAA8D;gBAC9D,MAAM,KAAK,GAA0B,GAAW,CAAC,QAAQ,CAAC,CAAC;gBAC3D,IAAI,KAAK,EAAE,CAAC;oBACV,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAC7B,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAoB,EAAE,CAAC;QACnC,KAAK,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AA5QqB;IADnB,WAAW,EAAE;;;;sDA+Gb"}