@oneuptime/common 12.0.32 → 12.0.34

package/build/dist/Server/Services/ApiKeyPermissionService.js

@@ -7,11 +7,18 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
+import QueryHelper from "../Types/Database/QueryHelper";
+import ApiKeyService from "./ApiKeyService";
 import DatabaseService from "./DatabaseService";
+import DatabaseCommonInteractionPropsUtil, { PermissionType, } from "../../Types/BaseDatabase/DatabaseCommonInteractionPropsUtil";
+import PermissionScope from "../../Types/Database/AccessControl/PermissionScope";
 import LIMIT_MAX, { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
 import BadDataException from "../../Types/Exception/BadDataException";
+import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
 import Model from "../../Models/DatabaseModels/ApiKeyPermission";
 import ObjectID from "../../Types/ObjectID";
+import Permission from "../../Types/Permission";
+import RelationIdUtil from "../Utils/Database/RelationIdUtil";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import InMemoryTTLCache from "../Infrastructure/InMemoryTTLCache";
 /*
@@ -21,17 +28,22 @@ import InMemoryTTLCache from "../Infrastructure/InMemoryTTLCache";
  * (same bound the ApiKeyService key cache accepted).
  */
 const PERMISSIONS_TTL_MS = 60 * 1000;
+const API_KEY_REFERENCE_KEYS = ["apiKeyId", "apiKey"];
+const PROJECT_REFERENCE_KEYS = ["projectId", "project"];
 export class Service extends DatabaseService {
     constructor() {
         super(Model);
         /*
-         * Cache of `apiKeyId -> permission rows`. The API-key auth path builds the
-         * request's tenant permissions from these rows on every request; without it
-         * that's a Postgres findBy (with a labels join) per request.
+         * Cache of `(projectId, apiKeyId) -> permission rows`. Project is part of
+         * the key and the database query deliberately: even a malformed legacy row
+         * that points at another project's API key must never become authority in
+         * the project currently being authenticated.
          */
         this.permissionCache = new InMemoryTTLCache(10000);
+        this.permissionCacheGeneration = 0;
     }
     clearCache() {
+        this.permissionCacheGeneration++;
         this.permissionCache.clear();
     }
     /**
@@ -40,13 +52,15 @@ export class Service extends DatabaseService {
      * miss), so callers never share mutable state with the cache. Use this from
      * the auth hot path instead of calling `findBy` directly.
      */
-    async findPermissionsByApiKeyId(apiKeyId) {
-        const cacheKey = apiKeyId.toString();
+    async findPermissionsByApiKeyId(apiKeyId, projectId) {
+        const cacheKey = `${projectId.toString()}:${apiKeyId.toString()}`;
         let cachedRows = this.permissionCache.get(cacheKey);
         if (cachedRows === undefined) {
+            const queryGeneration = this.permissionCacheGeneration;
             const rows = await this.findBy({
                 query: {
                     apiKeyId: apiKeyId,
+                    projectId: projectId,
                 },
                 select: {
                     permission: true,
@@ -71,7 +85,14 @@ export class Service extends DatabaseService {
                     isBlockPermission: row.isBlockPermission,
                 };
             });
-            this.permissionCache.set(cacheKey, cachedRows, PERMISSIONS_TTL_MS);
+            /*
+             * A permission mutation can commit while this database read is in
+             * flight. The success hook increments the generation after commit; do
+             * not let a pre-commit result repopulate the cache after that clear.
+             */
+            if (queryGeneration === this.permissionCacheGeneration) {
+                this.permissionCache.set(cacheKey, cachedRows, PERMISSIONS_TTL_MS);
+            }
         }
         return cachedRows.map((row) => {
             return {
@@ -83,18 +104,190 @@ export class Service extends DatabaseService {
             };
         });
     }
-    async onBeforeCreate(createBy) {
-        var _a;
-        this.clearCache();
-        if (!createBy.data.apiKeyId) {
+    /**
+     * A request tenant is authoritative. Normalize both scalar and relation
+     * spellings before any lookup so the IDs we validate are exactly the IDs
+     * TypeORM can persist.
+     */
+    normalizeReferencesForCreate(createBy) {
+        const createData = createBy.data;
+        const requestProjectId = createBy.props.tenantId;
+        const dataProjectId = RelationIdUtil.readConsistent(createData, PROJECT_REFERENCE_KEYS, "Project");
+        const projectId = requestProjectId || dataProjectId || undefined;
+        const apiKeyId = RelationIdUtil.readConsistent(createData, API_KEY_REFERENCE_KEYS, "API Key");
+        if (!apiKeyId) {
             throw new BadDataException("API Key ID is required to create permission");
         }
-        if (!createBy.data.projectId) {
+        if (!projectId) {
             throw new BadDataException("Project Id is required to create permission");
         }
+        if (requestProjectId &&
+            dataProjectId &&
+            requestProjectId.toString() !== dataProjectId.toString()) {
+            throw new BadDataException("Invalid API Key ID for this project");
+        }
+        /*
+         * Both relation properties map to the same database columns as their ID
+         * siblings. TypeORM gives the relation object persistence significance of
+         * its own, so validation of only the scalar IDs is not sufficient: two
+         * conflicting values can otherwise pass the hook and the relation can win
+         * during save. From here onward the validated scalar IDs are the only
+         * persistence source of truth.
+         */
+        createBy.data.apiKeyId = apiKeyId;
+        createBy.data.projectId = projectId;
+        delete createBy.data.apiKey;
+        delete createBy.data.project;
+        return { apiKeyId, projectId };
+    }
+    /**
+     * Resolve the relation by both id and tenant in one root query. Looking up
+     * the id alone and trusting the permission row's projectId creates a
+     * cross-tenant foreign-key confused-deputy: the database FK proves the key
+     * exists, but not that the key belongs to this project.
+     */
+    async assertApiKeyBelongsToProject(apiKeyId, projectId) {
+        const apiKey = await ApiKeyService.findOneBy({
+            query: {
+                _id: apiKeyId,
+                projectId: projectId,
+            },
+            select: {
+                _id: true,
+            },
+            props: {
+                isRoot: true,
+            },
+        });
+        if (!apiKey) {
+            throw new BadDataException("Invalid API Key ID for this project");
+        }
+    }
+    getLabelIds(labels) {
+        const labelIds = [];
+        for (const label of labels || []) {
+            const labelReference = label;
+            const labelId = labelReference.id || labelReference._id;
+            if (!labelId) {
+                throw new BadDataException("Every API key permission label must have an ID");
+            }
+            labelIds.push(labelId instanceof ObjectID ? labelId : new ObjectID(labelId));
+        }
+        return labelIds;
+    }
+    hasUnrestrictedPermission(permissions) {
+        return permissions.some((permission) => {
+            return (permission.scope === PermissionScope.All ||
+                (permission.scope !== PermissionScope.Owned &&
+                    permission.labelIds.length === 0));
+        });
+    }
+    /**
+     * Return true only if the caller holds the requested permission over the
+     * entire scope they are trying to delegate. Label-scoped authority can be
+     * delegated only to a subset of those labels; an Owned scope cannot be
+     * transferred to an API key because API keys have no user/team ownership
+     * identity.
+     */
+    isPermissionWithinCallerAuthority(data) {
+        const matchingAllows = data.allowPermissions.filter((permission) => {
+            return (permission.permission === data.permission &&
+                permission.scope !== PermissionScope.Owned);
+        });
+        const matchingBlocks = data.blockPermissions.filter((permission) => {
+            return permission.permission === data.permission;
+        });
+        const requestedLabels = data.requestedLabelIds.map((labelId) => {
+            return labelId.toString();
+        });
+        let isAllowed = this.hasUnrestrictedPermission(matchingAllows);
+        if (!isAllowed && requestedLabels.length > 0) {
+            const allowedLabelIds = new Set();
+            for (const permission of matchingAllows) {
+                for (const labelId of permission.labelIds) {
+                    allowedLabelIds.add(labelId.toString());
+                }
+            }
+            isAllowed = requestedLabels.every((labelId) => {
+                return allowedLabelIds.has(labelId);
+            });
+        }
+        if (!isAllowed) {
+            return false;
+        }
+        if (matchingBlocks.length === 0) {
+            return true;
+        }
+        if (this.hasUnrestrictedPermission(matchingBlocks) ||
+            matchingBlocks.some((permission) => {
+                return permission.scope === PermissionScope.Owned;
+            })) {
+            return false;
+        }
+        /*
+         * An unscoped API-key grant includes every label, including any scope the
+         * caller is blocked from, so even one scoped block makes it too broad.
+         */
+        if (requestedLabels.length === 0) {
+            return false;
+        }
+        const blockedLabelIds = new Set();
+        for (const permission of matchingBlocks) {
+            for (const labelId of permission.labelIds) {
+                blockedLabelIds.add(labelId.toString());
+            }
+        }
+        return requestedLabels.every((labelId) => {
+            return !blockedLabelIds.has(labelId);
+        });
+    }
+    /**
+     * Permission-management is delegation, not a role minting primitive.
+     * Owners may delegate anything. Every other editor, including a project
+     * admin, must themselves hold the exact permission and every label scope
+     * they place on the API key. ProjectAdmin is not an implication of every
+     * permission: destructive and billing permissions intentionally exclude it
+     * in their model ACLs.
+     */
+    assertCallerCanGrantPermission(data) {
+        if (data.props.isRoot || data.props.isMasterAdmin) {
+            return;
+        }
+        const scopedProps = Object.assign(Object.assign({}, data.props), { tenantId: data.projectId });
+        const allowPermissions = DatabaseCommonInteractionPropsUtil.getUserPermissions(scopedProps, PermissionType.Allow);
+        const blockPermissions = DatabaseCommonInteractionPropsUtil.getUserPermissions(scopedProps, PermissionType.Block);
+        const hasProjectOwner = this.isPermissionWithinCallerAuthority({
+            allowPermissions,
+            blockPermissions,
+            permission: Permission.ProjectOwner,
+            requestedLabelIds: [],
+        });
+        if (hasProjectOwner) {
+            return;
+        }
+        if (!this.isPermissionWithinCallerAuthority({
+            allowPermissions,
+            blockPermissions,
+            permission: data.permission,
+            requestedLabelIds: this.getLabelIds(data.labels),
+        })) {
+            throw new NotAuthorizedException("You cannot grant an API key permission beyond your own authority");
+        }
+    }
+    async onBeforeCreate(createBy) {
+        var _a;
+        this.clearCache();
         if (!createBy.data.permission) {
             throw new BadDataException("Permission is required to create permission");
         }
+        const references = this.normalizeReferencesForCreate(createBy);
+        await this.assertApiKeyBelongsToProject(references.apiKeyId, references.projectId);
+        this.assertCallerCanGrantPermission({
+            permission: createBy.data.permission,
+            labels: createBy.data.labels,
+            projectId: references.projectId,
+            props: createBy.props,
+        });
         // check if this permission is already assigned to this team and if yes then throw error.
         const isBlockPermission = createBy.data.isBlockPermission || false;
         const existingPermission = await this.findOneBy({
@@ -149,23 +342,90 @@ export class Service extends DatabaseService {
          * are rare so clearing is cheap.
          */
         this.clearCache();
-        if (updateBy.data.labels && updateBy.data.labels.length > 0) {
-            const existingPermissions = await this.findBy({
-                query: updateBy.query,
-                select: {
-                    _id: true,
-                    labels: true,
-                    isBlockPermission: true,
-                    projectId: true,
-                    apiKeyId: true,
-                    permission: true,
-                },
-                limit: LIMIT_PER_PROJECT,
-                skip: 0,
-                props: {
-                    isRoot: true,
-                },
+        const existingPermissions = await this.findBy({
+            query: updateBy.query,
+            select: {
+                _id: true,
+                labels: true,
+                isBlockPermission: true,
+                projectId: true,
+                apiKeyId: true,
+                permission: true,
+            },
+            limit: LIMIT_PER_PROJECT,
+            skip: 0,
+            props: {
+                isRoot: true,
+            },
+        });
+        const rawUpdatedPermission = updateBy.data.permission;
+        if (rawUpdatedPermission !== undefined &&
+            typeof rawUpdatedPermission !== "string") {
+            throw new BadDataException("Invalid API Key permission");
+        }
+        const updatedPermission = rawUpdatedPermission;
+        const isLabelsUpdateRequested = updateBy.data.labels !== undefined;
+        if (isLabelsUpdateRequested &&
+            updateBy.data.labels !== null &&
+            !Array.isArray(updateBy.data.labels)) {
+            throw new BadDataException("Invalid API Key permission labels");
+        }
+        const updatedLabels = updateBy.data.labels === null
+            ? []
+            : Array.isArray(updateBy.data.labels)
+                ? updateBy.data.labels
+                : undefined;
+        const rawUpdatedIsBlockPermission = updateBy.data.isBlockPermission;
+        if (rawUpdatedIsBlockPermission !== undefined &&
+            typeof rawUpdatedIsBlockPermission !== "boolean") {
+            throw new BadDataException("Invalid API Key block permission value");
+        }
+        const updatedIsBlockPermission = rawUpdatedIsBlockPermission;
+        for (const existingPermission of existingPermissions) {
+            const projectId = existingPermission.projectId;
+            const apiKeyId = existingPermission.apiKeyId;
+            const permission = updatedPermission || existingPermission.permission;
+            if (!projectId || !apiKeyId || !permission) {
+                throw new BadDataException("Invalid API Key permission");
+            }
+            if (updateBy.props.tenantId &&
+                updateBy.props.tenantId.toString() !== projectId.toString()) {
+                throw new BadDataException("Invalid API Key ID for this project");
+            }
+            await this.assertApiKeyBelongsToProject(apiKeyId, projectId);
+            this.assertCallerCanGrantPermission({
+                permission,
+                labels: isLabelsUpdateRequested
+                    ? updatedLabels
+                    : existingPermission.labels,
+                projectId,
+                props: updateBy.props,
             });
+            if (updatedPermission !== undefined ||
+                updatedIsBlockPermission !== undefined) {
+                const duplicatePermission = await this.findOneBy({
+                    query: {
+                        _id: QueryHelper.notEquals(existingPermission.id),
+                        apiKeyId,
+                        projectId,
+                        permission,
+                        isBlockPermission: updatedIsBlockPermission === undefined
+                            ? existingPermission.isBlockPermission || false
+                            : updatedIsBlockPermission,
+                    },
+                    select: {
+                        _id: true,
+                    },
+                    props: {
+                        isRoot: true,
+                    },
+                });
+                if (duplicatePermission) {
+                    throw new BadDataException("This permission is already assigned to this API Key");
+                }
+            }
+        }
+        if (updateBy.data.labels && updateBy.data.labels.length > 0) {
             for (const alreadySavedPermission of existingPermissions) {
                 // check if the
                 const isBlockPermission = alreadySavedPermission.isBlockPermission || false;
@@ -202,11 +462,36 @@ export class Service extends DatabaseService {
         this.clearCache();
         return { deleteBy, carryForward: null };
     }
+    async onCreateSuccess(_onCreate, createdItem) {
+        this.clearCache();
+        return createdItem;
+    }
+    async onUpdateSuccess(onUpdate, _updatedItemIds) {
+        this.clearCache();
+        return onUpdate;
+    }
+    async onDeleteSuccess(onDelete, _itemIdsBeforeDelete) {
+        this.clearCache();
+        return onDelete;
+    }
+    async onCreateError(error) {
+        this.clearCache();
+        return error;
+    }
+    async onUpdateError(error) {
+        this.clearCache();
+        return error;
+    }
+    async onDeleteError(error) {
+        this.clearCache();
+        return error;
+    }
 }
 __decorate([
     CaptureSpan(),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [ObjectID]),
+    __metadata("design:paramtypes", [ObjectID,
+        ObjectID]),
     __metadata("design:returntype", Promise)
 ], Service.prototype, "findPermissionsByApiKeyId", null);
 __decorate([
@@ -227,5 +512,23 @@ __decorate([
     __metadata("design:paramtypes", [Object]),
     __metadata("design:returntype", Promise)
 ], Service.prototype, "onBeforeDelete", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Model]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onCreateSuccess", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Array]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onUpdateSuccess", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Array]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onDeleteSuccess", null);
 export default new Service();
 //# sourceMappingURL=ApiKeyPermissionService.js.map

package/build/dist/Server/Services/ApiKeyPermissionService.js.map

@@ -1 +1 @@
-{"version":3,"file":"ApiKeyPermissionService.js","sourceRoot":"","sources":["../../../../Server/Services/ApiKeyPermissionService.ts"],"names":[],"mappings":";;;;;;;;;AAIA,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,SAAS,EAAE,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AACtE,OAAO,KAAK,MAAM,8CAA8C,CAAC;AAEjE,OAAO,QAAQ,MAAM,sBAAsB,CAAC;AAE5C,OAAO,WAAW,MAAM,gCAAgC,CAAC;AACzD,OAAO,gBAAgB,MAAM,oCAAoC,CAAC;AAElE;;;;;GAKG;AACH,MAAM,kBAAkB,GAAW,EAAE,GAAG,IAAI,CAAC;AAc7C,MAAM,OAAO,OAAQ,SAAQ,eAAsB;IASjD;QACE,KAAK,CAAC,KAAK,CAAC,CAAC;QATf;;;;WAIG;QACK,oBAAe,GACrB,IAAI,gBAAgB,CAAC,KAAM,CAAC,CAAC;IAI/B,CAAC;IAEM,UAAU;QACf,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;IAC/B,CAAC;IAED;;;;;OAKG;IAEU,AAAN,KAAK,CAAC,yBAAyB,CACpC,QAAkB;QAElB,MAAM,QAAQ,GAAW,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAE7C,IAAI,UAAU,GACZ,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAErC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAiB,MAAM,IAAI,CAAC,MAAM,CAAC;gBAC3C,KAAK,EAAE;oBACL,QAAQ,EAAE,QAAQ;iBACnB;gBACD,MAAM,EAAE;oBACN,UAAU,EAAE,IAAI;oBAChB,MAAM,EAAE;wBACN,GAAG,EAAE,IAAI;qBACV;oBACD,iBAAiB,EAAE,IAAI;iBACxB;gBACD,KAAK,EAAE,SAAS;gBAChB,IAAI,EAAE,CAAC;gBACP,KAAK,EAAE;oBACL,MAAM,EAAE,IAAI;iBACb;aACF,CAAC,CAAC;YAEH,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAU,EAA6B,EAAE;;gBAC9D,OAAO;oBACL,UAAU,EAAE,GAAG,CAAC,UAAW;oBAC3B,QAAQ,EAAE,CAAC,MAAA,GAAG,CAAC,MAAM,mCAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAY,EAAE,EAAE;wBAChD,OAAO,KAAK,CAAC,EAAG,CAAC,QAAQ,EAAE,CAAC;oBAC9B,CAAC,CAAC;oBACF,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;iBACzC,CAAC;YACJ,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,kBAAkB,CAAC,CAAC;QACrE,CAAC;QAED,OAAO,UAAU,CAAC,GAAG,CACnB,CAAC,GAA8B,EAAuB,EAAE;YACtD,OAAO;gBACL,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAU,EAAE,EAAE;oBACxC,OAAO,IAAI,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAC1B,CAAC,CAAC;gBACF,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;aACzC,CAAC;QACJ,CAAC,CACF,CAAC;IACJ,CAAC;IAGwB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;;QAEzB,IAAI,CAAC,UAAU,EAAE,CAAC;QAElB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5B,MAAM,IAAI,gBAAgB,CAAC,6CAA6C,CAAC,CAAC;QAC5E,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,gBAAgB,CAAC,6CAA6C,CAAC,CAAC;QAC5E,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YAC9B,MAAM,IAAI,gBAAgB,CAAC,6CAA6C,CAAC,CAAC;QAC5E,CAAC;QAED,yFAAyF;QAEzF,MAAM,iBAAiB,GAAY,QAAQ,CAAC,IAAI,CAAC,iBAAiB,IAAI,KAAK,CAAC;QAE5E,MAAM,kBAAkB,GAAiB,MAAM,IAAI,CAAC,SAAS,CAAC;YAC5D,KAAK,EAAE;gBACL,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ;gBAChC,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,SAAS;gBAClC,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU;gBACpC,iBAAiB,EAAE,iBAAiB;aACrC;YACD,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;aACV;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,IAAI,kBAAkB,EAAE,CAAC;YACvB,MAAM,IAAI,gBAAgB,CACxB,qDAAqD,CACtD,CAAC;QACJ,CAAC;QAED,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5D,eAAe;YAEf,MAAM,kBAAkB,GAAiB,MAAM,IAAI,CAAC,SAAS,CAAC;gBAC5D,KAAK,EAAE;oBACL,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ;oBAChC,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,SAAS;oBAClC,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU;oBACpC,iBAAiB,EAAE,CAAC,iBAAiB;iBACtC;gBACD,MAAM,EAAE;oBACN,GAAG,EAAE,IAAI;oBACT,iBAAiB,EAAE,IAAI;oBACvB,MAAM,EAAE,IAAI;iBACb;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,IAAI;iBACb;aACF,CAAC,CAAC;YAEH,IAAI,kBAAkB,IAAI,CAAC,CAAA,MAAA,kBAAkB,CAAC,MAAM,0CAAE,MAAM,KAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvE,qFAAqF;gBAErF,MAAM,SAAS,GAAW,kBAAkB,CAAC,iBAAiB;oBAC5D,CAAC,CAAC,OAAO;oBACT,CAAC,CAAC,OAAO,CAAC;gBAEZ,MAAM,IAAI,gBAAgB,CACxB,qEAAqE,SAAS,6GAA6G,SAAS,aAAa,CAClN,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IAGwB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;;QAEzB;;;WAGG;QACH,IAAI,CAAC,UAAU,EAAE,CAAC;QAElB,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5D,MAAM,mBAAmB,GAAiB,MAAM,IAAI,CAAC,MAAM,CAAC;gBAC1D,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,MAAM,EAAE;oBACN,GAAG,EAAE,IAAI;oBACT,MAAM,EAAE,IAAI;oBACZ,iBAAiB,EAAE,IAAI;oBACvB,SAAS,EAAE,IAAI;oBACf,QAAQ,EAAE,IAAI;oBACd,UAAU,EAAE,IAAI;iBACjB;gBACD,KAAK,EAAE,iBAAiB;gBACxB,IAAI,EAAE,CAAC;gBACP,KAAK,EAAE;oBACL,MAAM,EAAE,IAAI;iBACb;aACF,CAAC,CAAC;YAEH,KAAK,MAAM,sBAAsB,IAAI,mBAAmB,EAAE,CAAC;gBACzD,eAAe;gBAEf,MAAM,iBAAiB,GACrB,sBAAsB,CAAC,iBAAiB,IAAI,KAAK,CAAC;gBAEpD,MAAM,kBAAkB,GAAiB,MAAM,IAAI,CAAC,SAAS,CAAC;oBAC5D,KAAK,EAAE;wBACL,QAAQ,EAAE,sBAAsB,CAAC,QAAS;wBAC1C,SAAS,EAAE,sBAAsB,CAAC,SAAU;wBAC5C,UAAU,EAAE,sBAAsB,CAAC,UAAW;wBAC9C,iBAAiB,EAAE,CAAC,iBAAiB;qBACtC;oBACD,MAAM,EAAE;wBACN,GAAG,EAAE,IAAI;wBACT,iBAAiB,EAAE,IAAI;wBACvB,MAAM,EAAE,IAAI;wBACZ,UAAU,EAAE,IAAI;qBACjB;oBACD,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;iBACF,CAAC,CAAC;gBAEH,IACE,kBAAkB;oBAClB,CAAC,CAAA,MAAA,kBAAkB,CAAC,MAAM,0CAAE,MAAM,KAAI,CAAC,CAAC,GAAG,CAAC,EAC5C,CAAC;oBACD,qFAAqF;oBAErF,MAAM,SAAS,GAAW,kBAAkB,CAAC,iBAAiB;wBAC5D,CAAC,CAAC,OAAO;wBACT,CAAC,CAAC,OAAO,CAAC;oBAEZ,MAAM,IAAI,gBAAgB,CACxB,8CAA8C,kBAAkB,CAAC,UAAU,WAAW,SAAS,6GAA6G,SAAS,QAAQ,CAC9N,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IAGwB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;CACF;AAnNc;IADZ,WAAW,EAAE;;qCAEF,QAAQ;;wDAkDnB;AAGwB;IADxB,WAAW,EAAE;;;;6CA6Eb;AAGwB;IADxB,WAAW,EAAE;;;;6CAsEb;AAGwB;IADxB,WAAW,EAAE;;;;6CAMb;AAGH,eAAe,IAAI,OAAO,EAAE,CAAC"}
+{"version":3,"file":"ApiKeyPermissionService.js","sourceRoot":"","sources":["../../../../Server/Services/ApiKeyPermissionService.ts"],"names":[],"mappings":";;;;;;;;;AAGA,OAAO,WAAW,MAAM,+BAA+B,CAAC;AAExD,OAAO,aAAa,MAAM,iBAAiB,CAAC;AAC5C,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAEhD,OAAO,kCAAkC,EAAE,EACzC,cAAc,GACf,MAAM,6DAA6D,CAAC;AACrE,OAAO,eAAe,MAAM,oDAAoD,CAAC;AACjF,OAAO,SAAS,EAAE,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AAEtE,OAAO,sBAAsB,MAAM,8CAA8C,CAAC;AAClF,OAAO,KAAK,MAAM,8CAA8C,CAAC;AAEjE,OAAO,QAAQ,MAAM,sBAAsB,CAAC;AAC5C,OAAO,UAA8B,MAAM,wBAAwB,CAAC;AACpE,OAAO,cAAc,MAAM,kCAAkC,CAAC;AAC9D,OAAO,WAAW,MAAM,gCAAgC,CAAC;AACzD,OAAO,gBAAgB,MAAM,oCAAoC,CAAC;AAElE;;;;;GAKG;AACH,MAAM,kBAAkB,GAAW,EAAE,GAAG,IAAI,CAAC;AAE7C,MAAM,sBAAsB,GAAkB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;AACrE,MAAM,sBAAsB,GAAkB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;AAcvE,MAAM,OAAO,OAAQ,SAAQ,eAAsB;IAWjD;QACE,KAAK,CAAC,KAAK,CAAC,CAAC;QAXf;;;;;WAKG;QACK,oBAAe,GACrB,IAAI,gBAAgB,CAAC,KAAM,CAAC,CAAC;QACvB,8BAAyB,GAAW,CAAC,CAAC;IAI9C,CAAC;IAEM,UAAU;QACf,IAAI,CAAC,yBAAyB,EAAE,CAAC;QACjC,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;IAC/B,CAAC;IAED;;;;;OAKG;IAEU,AAAN,KAAK,CAAC,yBAAyB,CACpC,QAAkB,EAClB,SAAmB;QAEnB,MAAM,QAAQ,GAAW,GAAG,SAAS,CAAC,QAAQ,EAAE,IAAI,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC;QAE1E,IAAI,UAAU,GACZ,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAErC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,eAAe,GAAW,IAAI,CAAC,yBAAyB,CAAC;YAC/D,MAAM,IAAI,GAAiB,MAAM,IAAI,CAAC,MAAM,CAAC;gBAC3C,KAAK,EAAE;oBACL,QAAQ,EAAE,QAAQ;oBAClB,SAAS,EAAE,SAAS;iBACrB;gBACD,MAAM,EAAE;oBACN,UAAU,EAAE,IAAI;oBAChB,MAAM,EAAE;wBACN,GAAG,EAAE,IAAI;qBACV;oBACD,iBAAiB,EAAE,IAAI;iBACxB;gBACD,KAAK,EAAE,SAAS;gBAChB,IAAI,EAAE,CAAC;gBACP,KAAK,EAAE;oBACL,MAAM,EAAE,IAAI;iBACb;aACF,CAAC,CAAC;YAEH,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAU,EAA6B,EAAE;;gBAC9D,OAAO;oBACL,UAAU,EAAE,GAAG,CAAC,UAAW;oBAC3B,QAAQ,EAAE,CAAC,MAAA,GAAG,CAAC,MAAM,mCAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAY,EAAE,EAAE;wBAChD,OAAO,KAAK,CAAC,EAAG,CAAC,QAAQ,EAAE,CAAC;oBAC9B,CAAC,CAAC;oBACF,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;iBACzC,CAAC;YACJ,CAAC,CAAC,CAAC;YAEH;;;;eAIG;YACH,IAAI,eAAe,KAAK,IAAI,CAAC,yBAAyB,EAAE,CAAC;gBACvD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,kBAAkB,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;QAED,OAAO,UAAU,CAAC,GAAG,CACnB,CAAC,GAA8B,EAAuB,EAAE;YACtD,OAAO;gBACL,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAU,EAAE,EAAE;oBACxC,OAAO,IAAI,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAC1B,CAAC,CAAC;gBACF,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;aACzC,CAAC;QACJ,CAAC,CACF,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACK,4BAA4B,CAAC,QAAyB;QAI5D,MAAM,UAAU,GACd,QAAQ,CAAC,IAA0C,CAAC;QACtD,MAAM,gBAAgB,GAAyB,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC;QACvE,MAAM,aAAa,GAAoB,cAAc,CAAC,cAAc,CAClE,UAAU,EACV,sBAAsB,EACtB,SAAS,CACV,CAAC;QACF,MAAM,SAAS,GACb,gBAAgB,IAAI,aAAa,IAAI,SAAS,CAAC;QACjD,MAAM,QAAQ,GAAoB,cAAc,CAAC,cAAc,CAC7D,UAAU,EACV,sBAAsB,EACtB,SAAS,CACV,CAAC;QAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,gBAAgB,CAAC,6CAA6C,CAAC,CAAC;QAC5E,CAAC;QAED,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,gBAAgB,CAAC,6CAA6C,CAAC,CAAC;QAC5E,CAAC;QAED,IACE,gBAAgB;YAChB,aAAa;YACb,gBAAgB,CAAC,QAAQ,EAAE,KAAK,aAAa,CAAC,QAAQ,EAAE,EACxD,CAAC;YACD,MAAM,IAAI,gBAAgB,CAAC,qCAAqC,CAAC,CAAC;QACpE,CAAC;QAED;;;;;;;WAOG;QACH,QAAQ,CAAC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAClC,QAAQ,CAAC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QACpC,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;QAC5B,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;QAE7B,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACjC,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,4BAA4B,CACxC,QAAkB,EAClB,SAAmB;QAEnB,MAAM,MAAM,GAAY,MAAM,aAAa,CAAC,SAAS,CAAC;YACpD,KAAK,EAAE;gBACL,GAAG,EAAE,QAAQ;gBACb,SAAS,EAAE,SAAS;aACrB;YACD,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;aACV;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,gBAAgB,CAAC,qCAAqC,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAEO,WAAW,CAAC,MAAgC;QAClD,MAAM,QAAQ,GAAoB,EAAE,CAAC;QAErC,KAAK,MAAM,KAAK,IAAI,MAAM,IAAI,EAAE,EAAE,CAAC;YACjC,MAAM,cAAc,GAEhB,KAAK,CAAC;YACV,MAAM,OAAO,GACX,cAAc,CAAC,EAAE,IAAI,cAAc,CAAC,GAAG,CAAC;YAE1C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,gBAAgB,CACxB,gDAAgD,CACjD,CAAC;YACJ,CAAC;YAED,QAAQ,CAAC,IAAI,CACX,OAAO,YAAY,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,CAC9D,CAAC;QACJ,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,yBAAyB,CAC/B,WAAkC;QAElC,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,UAA0B,EAAW,EAAE;YAC9D,OAAO,CACL,UAAU,CAAC,KAAK,KAAK,eAAe,CAAC,GAAG;gBACxC,CAAC,UAAU,CAAC,KAAK,KAAK,eAAe,CAAC,KAAK;oBACzC,UAAU,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CACpC,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACK,iCAAiC,CAAC,IAKzC;QACC,MAAM,cAAc,GAA0B,IAAI,CAAC,gBAAgB,CAAC,MAAM,CACxE,CAAC,UAA0B,EAAW,EAAE;YACtC,OAAO,CACL,UAAU,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU;gBACzC,UAAU,CAAC,KAAK,KAAK,eAAe,CAAC,KAAK,CAC3C,CAAC;QACJ,CAAC,CACF,CAAC;QACF,MAAM,cAAc,GAA0B,IAAI,CAAC,gBAAgB,CAAC,MAAM,CACxE,CAAC,UAA0B,EAAW,EAAE;YACtC,OAAO,UAAU,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,CAAC;QACnD,CAAC,CACF,CAAC;QAEF,MAAM,eAAe,GAAkB,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAC/D,CAAC,OAAiB,EAAU,EAAE;YAC5B,OAAO,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC5B,CAAC,CACF,CAAC;QAEF,IAAI,SAAS,GAAY,IAAI,CAAC,yBAAyB,CAAC,cAAc,CAAC,CAAC;QAExE,IAAI,CAAC,SAAS,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7C,MAAM,eAAe,GAAgB,IAAI,GAAG,EAAU,CAAC;YACvD,KAAK,MAAM,UAAU,IAAI,cAAc,EAAE,CAAC;gBACxC,KAAK,MAAM,OAAO,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;oBAC1C,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAC1C,CAAC;YACH,CAAC;YACD,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,OAAe,EAAW,EAAE;gBAC7D,OAAO,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACtC,CAAC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IACE,IAAI,CAAC,yBAAyB,CAAC,cAAc,CAAC;YAC9C,cAAc,CAAC,IAAI,CAAC,CAAC,UAA0B,EAAW,EAAE;gBAC1D,OAAO,UAAU,CAAC,KAAK,KAAK,eAAe,CAAC,KAAK,CAAC;YACpD,CAAC,CAAC,EACF,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAED;;;WAGG;QACH,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,eAAe,GAAgB,IAAI,GAAG,EAAU,CAAC;QACvD,KAAK,MAAM,UAAU,IAAI,cAAc,EAAE,CAAC;YACxC,KAAK,MAAM,OAAO,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;gBAC1C,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;QAED,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC,OAAe,EAAW,EAAE;YACxD,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACK,8BAA8B,CAAC,IAKtC;QACC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YAClD,OAAO;QACT,CAAC;QAED,MAAM,WAAW,mCACZ,IAAI,CAAC,KAAK,KACb,QAAQ,EAAE,IAAI,CAAC,SAAS,GACzB,CAAC;QACF,MAAM,gBAAgB,GACpB,kCAAkC,CAAC,kBAAkB,CACnD,WAAW,EACX,cAAc,CAAC,KAAK,CACrB,CAAC;QACJ,MAAM,gBAAgB,GACpB,kCAAkC,CAAC,kBAAkB,CACnD,WAAW,EACX,cAAc,CAAC,KAAK,CACrB,CAAC;QAEJ,MAAM,eAAe,GAAY,IAAI,CAAC,iCAAiC,CAAC;YACtE,gBAAgB;YAChB,gBAAgB;YAChB,UAAU,EAAE,UAAU,CAAC,YAAY;YACnC,iBAAiB,EAAE,EAAE;SACtB,CAAC,CAAC;QAEH,IAAI,eAAe,EAAE,CAAC;YACpB,OAAO;QACT,CAAC;QAED,IACE,CAAC,IAAI,CAAC,iCAAiC,CAAC;YACtC,gBAAgB;YAChB,gBAAgB;YAChB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,iBAAiB,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;SACjD,CAAC,EACF,CAAC;YACD,MAAM,IAAI,sBAAsB,CAC9B,kEAAkE,CACnE,CAAC;QACJ,CAAC;IACH,CAAC;IAGwB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;;QAEzB,IAAI,CAAC,UAAU,EAAE,CAAC;QAElB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YAC9B,MAAM,IAAI,gBAAgB,CAAC,6CAA6C,CAAC,CAAC;QAC5E,CAAC;QAED,MAAM,UAAU,GACd,IAAI,CAAC,4BAA4B,CAAC,QAAQ,CAAC,CAAC;QAE9C,MAAM,IAAI,CAAC,4BAA4B,CACrC,UAAU,CAAC,QAAQ,EACnB,UAAU,CAAC,SAAS,CACrB,CAAC;QACF,IAAI,CAAC,8BAA8B,CAAC;YAClC,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU;YACpC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM;YAC5B,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,KAAK,EAAE,QAAQ,CAAC,KAAK;SACtB,CAAC,CAAC;QAEH,yFAAyF;QAEzF,MAAM,iBAAiB,GAAY,QAAQ,CAAC,IAAI,CAAC,iBAAiB,IAAI,KAAK,CAAC;QAE5E,MAAM,kBAAkB,GAAiB,MAAM,IAAI,CAAC,SAAS,CAAC;YAC5D,KAAK,EAAE;gBACL,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ;gBAChC,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,SAAS;gBAClC,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU;gBACpC,iBAAiB,EAAE,iBAAiB;aACrC;YACD,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;aACV;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,IAAI,kBAAkB,EAAE,CAAC;YACvB,MAAM,IAAI,gBAAgB,CACxB,qDAAqD,CACtD,CAAC;QACJ,CAAC;QAED,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5D,eAAe;YAEf,MAAM,kBAAkB,GAAiB,MAAM,IAAI,CAAC,SAAS,CAAC;gBAC5D,KAAK,EAAE;oBACL,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ;oBAChC,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,SAAS;oBAClC,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU;oBACpC,iBAAiB,EAAE,CAAC,iBAAiB;iBACtC;gBACD,MAAM,EAAE;oBACN,GAAG,EAAE,IAAI;oBACT,iBAAiB,EAAE,IAAI;oBACvB,MAAM,EAAE,IAAI;iBACb;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,IAAI;iBACb;aACF,CAAC,CAAC;YAEH,IAAI,kBAAkB,IAAI,CAAC,CAAA,MAAA,kBAAkB,CAAC,MAAM,0CAAE,MAAM,KAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvE,qFAAqF;gBAErF,MAAM,SAAS,GAAW,kBAAkB,CAAC,iBAAiB;oBAC5D,CAAC,CAAC,OAAO;oBACT,CAAC,CAAC,OAAO,CAAC;gBAEZ,MAAM,IAAI,gBAAgB,CACxB,qEAAqE,SAAS,6GAA6G,SAAS,aAAa,CAClN,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IAGwB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;;QAEzB;;;WAGG;QACH,IAAI,CAAC,UAAU,EAAE,CAAC;QAElB,MAAM,mBAAmB,GAAiB,MAAM,IAAI,CAAC,MAAM,CAAC;YAC1D,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;gBACT,MAAM,EAAE,IAAI;gBACZ,iBAAiB,EAAE,IAAI;gBACvB,SAAS,EAAE,IAAI;gBACf,QAAQ,EAAE,IAAI;gBACd,UAAU,EAAE,IAAI;aACjB;YACD,KAAK,EAAE,iBAAiB;YACxB,IAAI,EAAE,CAAC;YACP,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,MAAM,oBAAoB,GAAY,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC;QAC/D,IACE,oBAAoB,KAAK,SAAS;YAClC,OAAO,oBAAoB,KAAK,QAAQ,EACxC,CAAC;YACD,MAAM,IAAI,gBAAgB,CAAC,4BAA4B,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,iBAAiB,GAA2B,oBAErC,CAAC;QAEd,MAAM,uBAAuB,GAAY,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC;QAC5E,IACE,uBAAuB;YACvB,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI;YAC7B,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EACpC,CAAC;YACD,MAAM,IAAI,gBAAgB,CAAC,mCAAmC,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,aAAa,GACjB,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI;YAC3B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;gBACnC,CAAC,CAAE,QAAQ,CAAC,IAAI,CAAC,MAAkC;gBACnD,CAAC,CAAC,SAAS,CAAC;QAElB,MAAM,2BAA2B,GAC/B,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC;QAClC,IACE,2BAA2B,KAAK,SAAS;YACzC,OAAO,2BAA2B,KAAK,SAAS,EAChD,CAAC;YACD,MAAM,IAAI,gBAAgB,CAAC,wCAAwC,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,wBAAwB,GAC5B,2BAAkD,CAAC;QAErD,KAAK,MAAM,kBAAkB,IAAI,mBAAmB,EAAE,CAAC;YACrD,MAAM,SAAS,GAAyB,kBAAkB,CAAC,SAAS,CAAC;YACrE,MAAM,QAAQ,GAAyB,kBAAkB,CAAC,QAAQ,CAAC;YACnE,MAAM,UAAU,GACd,iBAAiB,IAAI,kBAAkB,CAAC,UAAU,CAAC;YAErD,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;gBAC3C,MAAM,IAAI,gBAAgB,CAAC,4BAA4B,CAAC,CAAC;YAC3D,CAAC;YAED,IACE,QAAQ,CAAC,KAAK,CAAC,QAAQ;gBACvB,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,SAAS,CAAC,QAAQ,EAAE,EAC3D,CAAC;gBACD,MAAM,IAAI,gBAAgB,CAAC,qCAAqC,CAAC,CAAC;YACpE,CAAC;YAED,MAAM,IAAI,CAAC,4BAA4B,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YAC7D,IAAI,CAAC,8BAA8B,CAAC;gBAClC,UAAU;gBACV,MAAM,EAAE,uBAAuB;oBAC7B,CAAC,CAAC,aAAa;oBACf,CAAC,CAAC,kBAAkB,CAAC,MAAM;gBAC7B,SAAS;gBACT,KAAK,EAAE,QAAQ,CAAC,KAAK;aACtB,CAAC,CAAC;YAEH,IACE,iBAAiB,KAAK,SAAS;gBAC/B,wBAAwB,KAAK,SAAS,EACtC,CAAC;gBACD,MAAM,mBAAmB,GAAiB,MAAM,IAAI,CAAC,SAAS,CAAC;oBAC7D,KAAK,EAAE;wBACL,GAAG,EAAE,WAAW,CAAC,SAAS,CAAC,kBAAkB,CAAC,EAAG,CAAC;wBAClD,QAAQ;wBACR,SAAS;wBACT,UAAU;wBACV,iBAAiB,EACf,wBAAwB,KAAK,SAAS;4BACpC,CAAC,CAAC,kBAAkB,CAAC,iBAAiB,IAAI,KAAK;4BAC/C,CAAC,CAAC,wBAAwB;qBAC/B;oBACD,MAAM,EAAE;wBACN,GAAG,EAAE,IAAI;qBACV;oBACD,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;iBACF,CAAC,CAAC;gBAEH,IAAI,mBAAmB,EAAE,CAAC;oBACxB,MAAM,IAAI,gBAAgB,CACxB,qDAAqD,CACtD,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5D,KAAK,MAAM,sBAAsB,IAAI,mBAAmB,EAAE,CAAC;gBACzD,eAAe;gBAEf,MAAM,iBAAiB,GACrB,sBAAsB,CAAC,iBAAiB,IAAI,KAAK,CAAC;gBAEpD,MAAM,kBAAkB,GAAiB,MAAM,IAAI,CAAC,SAAS,CAAC;oBAC5D,KAAK,EAAE;wBACL,QAAQ,EAAE,sBAAsB,CAAC,QAAS;wBAC1C,SAAS,EAAE,sBAAsB,CAAC,SAAU;wBAC5C,UAAU,EAAE,sBAAsB,CAAC,UAAW;wBAC9C,iBAAiB,EAAE,CAAC,iBAAiB;qBACtC;oBACD,MAAM,EAAE;wBACN,GAAG,EAAE,IAAI;wBACT,iBAAiB,EAAE,IAAI;wBACvB,MAAM,EAAE,IAAI;wBACZ,UAAU,EAAE,IAAI;qBACjB;oBACD,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;iBACF,CAAC,CAAC;gBAEH,IACE,kBAAkB;oBAClB,CAAC,CAAA,MAAA,kBAAkB,CAAC,MAAM,0CAAE,MAAM,KAAI,CAAC,CAAC,GAAG,CAAC,EAC5C,CAAC;oBACD,qFAAqF;oBAErF,MAAM,SAAS,GAAW,kBAAkB,CAAC,iBAAiB;wBAC5D,CAAC,CAAC,OAAO;wBACT,CAAC,CAAC,OAAO,CAAC;oBAEZ,MAAM,IAAI,gBAAgB,CACxB,8CAA8C,kBAAkB,CAAC,UAAU,WAAW,SAAS,6GAA6G,SAAS,QAAQ,CAC9N,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IAGwB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IAGwB,AAAN,KAAK,CAAC,eAAe,CACtC,SAA0B,EAC1B,WAAkB;QAElB,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,OAAO,WAAW,CAAC;IACrB,CAAC;IAGwB,AAAN,KAAK,CAAC,eAAe,CACtC,QAAyB,EACzB,eAAgC;QAEhC,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,OAAO,QAAQ,CAAC;IAClB,CAAC;IAGwB,AAAN,KAAK,CAAC,eAAe,CACtC,QAAyB,EACzB,oBAAqC;QAErC,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEkB,KAAK,CAAC,aAAa,CAAC,KAAgB;QACrD,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,OAAO,KAAK,CAAC;IACf,CAAC;IAEkB,KAAK,CAAC,aAAa,CAAC,KAAgB;QACrD,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,OAAO,KAAK,CAAC;IACf,CAAC;IAEkB,KAAK,CAAC,aAAa,CAAC,KAAgB;QACrD,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAnnBc;IADZ,WAAW,EAAE;;qCAEF,QAAQ;QACP,QAAQ;;wDA2DpB;AA0QwB;IADxB,WAAW,EAAE;;;;6CAmFb;AAGwB;IADxB,WAAW,EAAE;;;;6CAqKb;AAGwB;IADxB,WAAW,EAAE;;;;6CAMb;AAGwB;IADxB,WAAW,EAAE;;6CAGC,KAAK;;8CAInB;AAGwB;IADxB,WAAW,EAAE;;6CAGK,KAAK;;8CAIvB;AAGwB;IADxB,WAAW,EAAE;;6CAGU,KAAK;;8CAI5B;AAkBH,eAAe,IAAI,OAAO,EAAE,CAAC"}