@oneuptime/common 14.0.6 → 14.0.8

package/build/dist/Server/Types/Workflow/Components/Email.js

@@ -12,8 +12,10 @@ import BadDataException from "../../../../Types/Exception/BadDataException";
 import ComponentID from "../../../../Types/Workflow/ComponentID";
 import Components from "../../../../Types/Workflow/Components/Email";
 import nodemailer from "nodemailer";
+import DataSourceEgressGuard from "../../../Utils/DataSource/EgressGuard";
+import PinnedSmtpSocket from "../../../Utils/Mail/PinnedSmtpSocket";
 import CaptureSpan from "../../../Utils/Telemetry/CaptureSpan";
-export default class Email extends ComponentCode {
+class Email extends ComponentCode {
     constructor() {
         super();
         const Component = Components.find((i) => {
@@ -25,7 +27,7 @@ export default class Email extends ComponentCode {
         this.setMetadata(Component);
     }
     async run(args, options) {
-        var _a, _b, _c, _d, _e;
+        var _a, _b, _c, _d;
         const successPort = this.getMetadata().outPorts.find((p) => {
             return p.id === "success";
         });
@@ -81,10 +83,54 @@ export default class Email extends ComponentCode {
                 executePort: errorPort,
             };
         }
+        const smtpHost = args["smtp-host"].toString().trim();
+        // "[fd00::25]" is how an IPv6 literal is usually written next to a port.
+        const bareSmtpHost = smtpHost.replace(/^\[|\]$/g, "");
+        const smtpPort = args["smtp-port"];
         try {
+            /*
+             * The SMTP host is free text typed into the workflow node by any
+             * project member who can edit workflows, and nodemailer's failures
+             * ("Invalid greeting. response=<banner>", refused vs timed out) come
+             * back through the Error port into the workflow log. Unchecked, this
+             * step is a port scanner with banner disclosure for whatever network
+             * the workflow worker runs in.
+             *
+             * Same guard and label as a project's own SMTP server in MailService,
+             * so the same policy: loopback, link-local and cloud metadata are
+             * refused everywhere; private ranges are refused on SaaS and allowed on
+             * self-hosted installs unless DATA_SOURCE_BLOCK_PRIVATE_ADDRESSES=true.
+             * A refusal is thrown inside this try, so it takes the Error port like
+             * any other failure to send, before a socket is opened.
+             */
+            const validatedAddresses = await DataSourceEgressGuard.assertHostnameAllowed(bareSmtpHost, {
+                targetLabel: "SMTP server",
+            });
             const smtpTransport = {
-                host: (_c = args["smtp-host"]) === null || _c === void 0 ? void 0 : _c.toString(),
-                port: args["smtp-port"],
+                /*
+                 * nodemailer still needs the name the user typed: it is what TLS
+                 * sends as SNI and checks the certificate against, on implicit TLS
+                 * and on the STARTTLS upgrade alike. It is never dialed; see
+                 * getSocket.
+                 */
+                host: bareSmtpHost,
+                port: smtpPort,
+                /*
+                 * Connect here, to the addresses just validated, and hand nodemailer
+                 * the open socket. Given the name instead, nodemailer resolves it
+                 * again on its own (dns.resolve4/6, then a process-wide five-minute
+                 * cache), so a DNS answer that changed after the check would choose
+                 * the address actually connected to.
+                 */
+                getSocket: (_options, callback) => {
+                    PinnedSmtpSocket.connect({
+                        host: bareSmtpHost,
+                        port: smtpPort,
+                        addresses: validatedAddresses,
+                        timeoutInMs: Email.CONNECTION_TIMEOUT_IN_MS,
+                        onDone: callback,
+                    });
+                },
             };
             if (args["secure"] === true ||
                 args["secure"] === "true" ||
@@ -104,8 +150,8 @@ export default class Email extends ComponentCode {
             await mailer.sendMail({
                 from: args["from"].toString(),
                 to: args["to"].toString(),
-                subject: ((_d = args["subject"]) === null || _d === void 0 ? void 0 : _d.toString()) || "",
-                html: ((_e = args["email-body"]) === null || _e === void 0 ? void 0 : _e.toString()) || "",
+                subject: ((_c = args["subject"]) === null || _c === void 0 ? void 0 : _c.toString()) || "",
+                html: ((_d = args["email-body"]) === null || _d === void 0 ? void 0 : _d.toString()) || "",
             });
             options.log("Email sent.");
             return Promise.resolve({
@@ -125,6 +171,9 @@ export default class Email extends ComponentCode {
         }
     }
 }
+// nodemailer's own default connection timeout.
+Email.CONNECTION_TIMEOUT_IN_MS = 2 * 60 * 1000;
+export default Email;
 __decorate([
     CaptureSpan(),
     __metadata("design:type", Function),

package/build/dist/Server/Types/Workflow/Components/Email.js.map

@@ -1 +1 @@
-{"version":3,"file":"Email.js","sourceRoot":"","sources":["../../../../../../Server/Types/Workflow/Components/Email.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,aAA4C,MAAM,kBAAkB,CAAC;AAC5E,OAAO,gBAAgB,MAAM,8CAA8C,CAAC;AAG5E,OAAO,WAAW,MAAM,wCAAwC,CAAC;AACjE,OAAO,UAAU,MAAM,6CAA6C,CAAC;AACrE,OAAO,UAA2B,MAAM,YAAY,CAAC;AAErD,OAAO,WAAW,MAAM,sCAAsC,CAAC;AAE/D,MAAM,CAAC,OAAO,OAAO,KAAM,SAAQ,aAAa;IAC9C;QACE,KAAK,EAAE,CAAC;QAER,MAAM,SAAS,GAAkC,UAAU,CAAC,IAAI,CAC9D,CAAC,CAAoB,EAAE,EAAE;YACvB,OAAO,CAAC,CAAC,EAAE,KAAK,WAAW,CAAC,SAAS,CAAC;QACxC,CAAC,CACF,CAAC;QAEF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,gBAAgB,CAAC,sBAAsB,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAC9B,CAAC;IAGqB,AAAN,KAAK,CAAC,GAAG,CACvB,IAAgB,EAChB,OAAmB;;QAEnB,MAAM,WAAW,GAAqB,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,CACpE,CAAC,CAAO,EAAE,EAAE;YACV,OAAO,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC;QAC5B,CAAC,CACF,CAAC;QAEF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,gBAAgB,CAAC,wBAAwB,CAAC,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,SAAS,GAAqB,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,CAClE,CAAC,CAAO,EAAE,EAAE;YACV,OAAO,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC;QAC1B,CAAC,CACF,CAAC;QAEF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,gBAAgB,CAAC,sBAAsB,CAAC,CAAC,CAAC;QACtE,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAChB,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,gBAAgB,CAAC,oBAAoB,CAAC,CAAC,CAAC;QACpE,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;YACjD,MAAM,OAAO,CAAC,OAAO,CACnB,IAAI,gBAAgB,CAAC,gCAAgC,CAAC,CACvD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAClB,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,gBAAgB,CAAC,sBAAsB,CAAC,CAAC,CAAC;QACtE,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,OAAO,CAAC,OAAO,CACnB,IAAI,gBAAgB,CAAC,kCAAkC,CAAC,CACzD,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,QAAQ,EAAE,CAAC;YACvE,MAAM,OAAO,CAAC,OAAO,CACnB,IAAI,gBAAgB,CAAC,qCAAqC,CAAC,CAC5D,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,QAAQ,EAAE,CAAC;YACvE,MAAM,OAAO,CAAC,OAAO,CACnB,IAAI,gBAAgB,CAAC,qCAAqC,CAAC,CAC5D,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACvB,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,gBAAgB,CAAC,qBAAqB,CAAC,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC/D,MAAM,OAAO,CAAC,OAAO,CACnB,IAAI,gBAAgB,CAAC,iCAAiC,CAAC,CACxD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACvB,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,gBAAgB,CAAC,qBAAqB,CAAC,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC/D,IAAI,CAAC,WAAW,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;QAClD,CAAC;QAED,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC/D,MAAM,OAAO,CAAC,OAAO,CACnB,IAAI,gBAAgB,CAAC,iCAAiC,CAAC,CACxD,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GACZ,CAAA,MAAA,IAAI,CAAC,eAAe,CAAC,0CAAE,QAAQ,EAAE,KAAI,SAAS,CAAC;QACjD,MAAM,QAAQ,GACZ,CAAA,MAAA,IAAI,CAAC,eAAe,CAAC,0CAAE,QAAQ,EAAE,KAAI,SAAS,CAAC;QAEjD,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5C,MAAM,YAAY,GAChB,uDAAuD,CAAC;YAE1D,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAE1B,OAAO;gBACL,YAAY,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE;gBACrC,WAAW,EAAE,SAAS;aACvB,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,aAAa,GAA0B;gBAC3C,IAAI,EAAE,MAAA,IAAI,CAAC,WAAW,CAAC,0CAAE,QAAQ,EAAE;gBACnC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAW;aAClC,CAAC;YAEF,IACE,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI;gBACvB,IAAI,CAAC,QAAQ,CAAC,KAAK,MAAM;gBACzB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EACpB,CAAC;gBACD,aAAa,CAAC,MAAM,GAAG,IAAI,CAAC;YAC9B,CAAC;iBAAM,CAAC;gBACN,aAAa,CAAC,MAAM,GAAG,KAAK,CAAC;YAC/B,CAAC;YAED,IAAI,QAAQ,IAAI,QAAQ,EAAE,CAAC;gBACzB,aAAa,CAAC,IAAI,GAAG;oBACnB,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,QAAQ;iBACf,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAgB,UAAU,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;YAEtE,MAAM,MAAM,CAAC,QAAQ,CAAC;gBACpB,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;gBAC7B,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;gBACzB,OAAO,EAAE,CAAA,MAAA,IAAI,CAAC,SAAS,CAAC,0CAAE,QAAQ,EAAE,KAAI,EAAE;gBAC1C,IAAI,EAAE,CAAA,MAAA,IAAI,CAAC,YAAY,CAAC,0CAAE,QAAQ,EAAE,KAAI,EAAE;aAC3C,CAAC,CAAC;YAEH,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAE3B,OAAO,OAAO,CAAC,OAAO,CAAC;gBACrB,YAAY,EAAE,EAAE;gBAChB,WAAW,EAAE,WAAW;aACzB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,YAAY,GAChB,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO;gBACjC,CAAC,CAAC,GAAG,CAAC,OAAO;gBACb,CAAC,CAAC,0BAA0B,CAAC;YAEjC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAE1B,OAAO,OAAO,CAAC,OAAO,CAAC;gBACrB,YAAY,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE;gBACrC,WAAW,EAAE,SAAS;aACvB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF;AArJuB;IADrB,WAAW,EAAE;;;;gCAqJb"}
+{"version":3,"file":"Email.js","sourceRoot":"","sources":["../../../../../../Server/Types/Workflow/Components/Email.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,aAA4C,MAAM,kBAAkB,CAAC;AAC5E,OAAO,gBAAgB,MAAM,8CAA8C,CAAC;AAG5E,OAAO,WAAW,MAAM,wCAAwC,CAAC;AACjE,OAAO,UAAU,MAAM,6CAA6C,CAAC;AACrE,OAAO,UAA2B,MAAM,YAAY,CAAC;AAErD,OAAO,qBAEN,MAAM,uCAAuC,CAAC;AAC/C,OAAO,gBAEN,MAAM,sCAAsC,CAAC;AAC9C,OAAO,WAAW,MAAM,sCAAsC,CAAC;AAE/D,MAAqB,KAAM,SAAQ,aAAa;IAI9C;QACE,KAAK,EAAE,CAAC;QAER,MAAM,SAAS,GAAkC,UAAU,CAAC,IAAI,CAC9D,CAAC,CAAoB,EAAE,EAAE;YACvB,OAAO,CAAC,CAAC,EAAE,KAAK,WAAW,CAAC,SAAS,CAAC;QACxC,CAAC,CACF,CAAC;QAEF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,gBAAgB,CAAC,sBAAsB,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAC9B,CAAC;IAGqB,AAAN,KAAK,CAAC,GAAG,CACvB,IAAgB,EAChB,OAAmB;;QAEnB,MAAM,WAAW,GAAqB,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,CACpE,CAAC,CAAO,EAAE,EAAE;YACV,OAAO,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC;QAC5B,CAAC,CACF,CAAC;QAEF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,gBAAgB,CAAC,wBAAwB,CAAC,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,SAAS,GAAqB,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,CAClE,CAAC,CAAO,EAAE,EAAE;YACV,OAAO,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC;QAC1B,CAAC,CACF,CAAC;QAEF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,gBAAgB,CAAC,sBAAsB,CAAC,CAAC,CAAC;QACtE,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAChB,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,gBAAgB,CAAC,oBAAoB,CAAC,CAAC,CAAC;QACpE,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;YACjD,MAAM,OAAO,CAAC,OAAO,CACnB,IAAI,gBAAgB,CAAC,gCAAgC,CAAC,CACvD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAClB,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,gBAAgB,CAAC,sBAAsB,CAAC,CAAC,CAAC;QACtE,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,OAAO,CAAC,OAAO,CACnB,IAAI,gBAAgB,CAAC,kCAAkC,CAAC,CACzD,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,QAAQ,EAAE,CAAC;YACvE,MAAM,OAAO,CAAC,OAAO,CACnB,IAAI,gBAAgB,CAAC,qCAAqC,CAAC,CAC5D,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,QAAQ,EAAE,CAAC;YACvE,MAAM,OAAO,CAAC,OAAO,CACnB,IAAI,gBAAgB,CAAC,qCAAqC,CAAC,CAC5D,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACvB,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,gBAAgB,CAAC,qBAAqB,CAAC,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC/D,MAAM,OAAO,CAAC,OAAO,CACnB,IAAI,gBAAgB,CAAC,iCAAiC,CAAC,CACxD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACvB,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,gBAAgB,CAAC,qBAAqB,CAAC,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC/D,IAAI,CAAC,WAAW,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;QAClD,CAAC;QAED,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC/D,MAAM,OAAO,CAAC,OAAO,CACnB,IAAI,gBAAgB,CAAC,iCAAiC,CAAC,CACxD,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GACZ,CAAA,MAAA,IAAI,CAAC,eAAe,CAAC,0CAAE,QAAQ,EAAE,KAAI,SAAS,CAAC;QACjD,MAAM,QAAQ,GACZ,CAAA,MAAA,IAAI,CAAC,eAAe,CAAC,0CAAE,QAAQ,EAAE,KAAI,SAAS,CAAC;QAEjD,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5C,MAAM,YAAY,GAChB,uDAAuD,CAAC;YAE1D,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAE1B,OAAO;gBACL,YAAY,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE;gBACrC,WAAW,EAAE,SAAS;aACvB,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAW,IAAI,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;QAC7D,yEAAyE;QACzE,MAAM,YAAY,GAAW,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAW,IAAI,CAAC,WAAW,CAAW,CAAC;QAErD,IAAI,CAAC;YACH;;;;;;;;;;;;;;eAcG;YACH,MAAM,kBAAkB,GACtB,MAAM,qBAAqB,CAAC,qBAAqB,CAAC,YAAY,EAAE;gBAC9D,WAAW,EAAE,aAAa;aAC3B,CAAC,CAAC;YAEL,MAAM,aAAa,GAA0B;gBAC3C;;;;;mBAKG;gBACH,IAAI,EAAE,YAAY;gBAClB,IAAI,EAAE,QAAQ;gBACd;;;;;;mBAMG;gBACH,SAAS,EAAE,CACT,QAA+B,EAC/B,QAA4B,EACtB,EAAE;oBACR,gBAAgB,CAAC,OAAO,CAAC;wBACvB,IAAI,EAAE,YAAY;wBAClB,IAAI,EAAE,QAAQ;wBACd,SAAS,EAAE,kBAAkB;wBAC7B,WAAW,EAAE,KAAK,CAAC,wBAAwB;wBAC3C,MAAM,EAAE,QAAQ;qBACjB,CAAC,CAAC;gBACL,CAAC;aACF,CAAC;YAEF,IACE,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI;gBACvB,IAAI,CAAC,QAAQ,CAAC,KAAK,MAAM;gBACzB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EACpB,CAAC;gBACD,aAAa,CAAC,MAAM,GAAG,IAAI,CAAC;YAC9B,CAAC;iBAAM,CAAC;gBACN,aAAa,CAAC,MAAM,GAAG,KAAK,CAAC;YAC/B,CAAC;YAED,IAAI,QAAQ,IAAI,QAAQ,EAAE,CAAC;gBACzB,aAAa,CAAC,IAAI,GAAG;oBACnB,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,QAAQ;iBACf,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAgB,UAAU,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;YAEtE,MAAM,MAAM,CAAC,QAAQ,CAAC;gBACpB,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;gBAC7B,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;gBACzB,OAAO,EAAE,CAAA,MAAA,IAAI,CAAC,SAAS,CAAC,0CAAE,QAAQ,EAAE,KAAI,EAAE;gBAC1C,IAAI,EAAE,CAAA,MAAA,IAAI,CAAC,YAAY,CAAC,0CAAE,QAAQ,EAAE,KAAI,EAAE;aAC3C,CAAC,CAAC;YAEH,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAE3B,OAAO,OAAO,CAAC,OAAO,CAAC;gBACrB,YAAY,EAAE,EAAE;gBAChB,WAAW,EAAE,WAAW;aACzB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,YAAY,GAChB,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO;gBACjC,CAAC,CAAC,GAAG,CAAC,OAAO;gBACb,CAAC,CAAC,0BAA0B,CAAC;YAEjC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAE1B,OAAO,OAAO,CAAC,OAAO,CAAC;gBACrB,YAAY,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE;gBACrC,WAAW,EAAE,SAAS;aACvB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;;AA1ND,+CAA+C;AACvB,8BAAwB,GAAW,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;eAFtD,KAAK;AAqBF;IADrB,WAAW,EAAE;;;;gCAuMb"}

package/build/dist/Server/Utils/AffectedResources/LinkedAffectedResources.js

@@ -0,0 +1,405 @@
+import QueryHelper from "../../Types/Database/QueryHelper";
+import Alert from "../../../Models/DatabaseModels/Alert";
+import Incident from "../../../Models/DatabaseModels/Incident";
+import ScheduledMaintenance from "../../../Models/DatabaseModels/ScheduledMaintenance";
+import URL from "../../../Types/API/URL";
+import { escapeMarkdownInline } from "../../../Utils/Markdown/MarkdownEscape";
+import { getSloAffectedResourceMarkdownLines, } from "../../../Utils/Slo/SloAffectedResourceMarkdown";
+/*
+ * What an incident, alert or scheduled maintenance event affects, for the
+ * text the server writes about it: the "Resources Affected" section of its
+ * feed items, the Resources Affected row of its emails, and the workspace
+ * summaries.
+ *
+ * The dashboard's Affected Resources cards (AffectedResourcesDisplay) list
+ * every relation the record carries - monitors, hosts, clusters, container
+ * hosts, databases, services, SLOs. The server used to name the monitors
+ * only, so an SLO burn-rate alert's card named its SLO while its on-call
+ * email read "Resources Affected: No resources identified", and an incident
+ * raised against a host named nothing at all. Every one of those writers now
+ * reads the list from here, so they name what the cards show.
+ *
+ * Reads run as root - an owner or on-call email has no user session behind
+ * it - and are held to the record's own project twice: the record is only
+ * read inside that project, and a related row of any other project is left
+ * out. The write hooks reject cross-project links now, but rows saved before
+ * that check existed may still hold one, and naming it would put another
+ * project's resource into this project's feed, Slack and email.
+ *
+ * The caller hands over the service to read with, and the dashboard URL to
+ * link from. Those services import this module, and the owner-notification
+ * workers' tests replace them wholesale; importing them here would drag the
+ * whole service graph into every one of those suites.
+ */
+export var LinkedAffectedResourceType;
+(function (LinkedAffectedResourceType) {
+    LinkedAffectedResourceType["Monitor"] = "Monitor";
+    LinkedAffectedResourceType["Host"] = "Host";
+    LinkedAffectedResourceType["KubernetesCluster"] = "KubernetesCluster";
+    LinkedAffectedResourceType["DockerHost"] = "DockerHost";
+    LinkedAffectedResourceType["PodmanHost"] = "PodmanHost";
+    LinkedAffectedResourceType["ProxmoxCluster"] = "ProxmoxCluster";
+    LinkedAffectedResourceType["VMwareVCenter"] = "VMwareVCenter";
+    LinkedAffectedResourceType["CephCluster"] = "CephCluster";
+    LinkedAffectedResourceType["DockerSwarmCluster"] = "DockerSwarmCluster";
+    LinkedAffectedResourceType["IoTFleet"] = "IoTFleet";
+    LinkedAffectedResourceType["DatabaseServer"] = "DatabaseServer";
+    LinkedAffectedResourceType["NetworkSite"] = "NetworkSite";
+    LinkedAffectedResourceType["Service"] = "Service";
+    LinkedAffectedResourceType["ServiceLevelObjective"] = "ServiceLevelObjective";
+})(LinkedAffectedResourceType || (LinkedAffectedResourceType = {}));
+/*
+ * The categories AffectedResourcesDisplay renders, in the order it renders
+ * them, so a feed item lists resources the way the cards beside it do. The
+ * routes are the ones each resource's own getXLinkInDashboard builds (a test
+ * pins every one that exists); IoT fleets and network sites have none on the
+ * server, so theirs follow the dashboard's RouteMap.
+ *
+ * An alert has a single `monitor`; incidents and scheduled maintenance events
+ * have `monitors`. Each record kind is read for the columns its model has.
+ */
+export const LINKED_AFFECTED_RESOURCE_RELATIONS = [
+    {
+        column: "monitors",
+        type: LinkedAffectedResourceType.Monitor,
+        label: "Monitor",
+        dashboardRoute: "monitors",
+    },
+    {
+        column: "monitor",
+        type: LinkedAffectedResourceType.Monitor,
+        label: "Monitor",
+        dashboardRoute: "monitors",
+    },
+    {
+        column: "hosts",
+        type: LinkedAffectedResourceType.Host,
+        label: "Host",
+        dashboardRoute: "host",
+    },
+    {
+        column: "kubernetesClusters",
+        type: LinkedAffectedResourceType.KubernetesCluster,
+        label: "Kubernetes Cluster",
+        dashboardRoute: "kubernetes",
+    },
+    {
+        column: "dockerHosts",
+        type: LinkedAffectedResourceType.DockerHost,
+        label: "Docker Host",
+        dashboardRoute: "docker",
+    },
+    {
+        column: "podmanHosts",
+        type: LinkedAffectedResourceType.PodmanHost,
+        label: "Podman Host",
+        dashboardRoute: "podman",
+    },
+    {
+        column: "proxmoxClusters",
+        type: LinkedAffectedResourceType.ProxmoxCluster,
+        label: "Proxmox Cluster",
+        dashboardRoute: "proxmox",
+    },
+    {
+        column: "vmwareVCenters",
+        type: LinkedAffectedResourceType.VMwareVCenter,
+        label: "VMware vCenter",
+        dashboardRoute: "vmware",
+    },
+    {
+        column: "cephClusters",
+        type: LinkedAffectedResourceType.CephCluster,
+        label: "Ceph Cluster",
+        dashboardRoute: "ceph",
+    },
+    {
+        column: "dockerSwarmClusters",
+        type: LinkedAffectedResourceType.DockerSwarmCluster,
+        label: "Docker Swarm Cluster",
+        dashboardRoute: "docker-swarm",
+    },
+    {
+        column: "iotFleets",
+        type: LinkedAffectedResourceType.IoTFleet,
+        label: "IoT Fleet",
+        dashboardRoute: "iot",
+    },
+    {
+        column: "databaseServers",
+        type: LinkedAffectedResourceType.DatabaseServer,
+        label: "Database",
+        dashboardRoute: "databases",
+    },
+    {
+        column: "networkSites",
+        type: LinkedAffectedResourceType.NetworkSite,
+        label: "Network Site",
+        dashboardRoute: "network-sites/view",
+    },
+    {
+        column: "services",
+        type: LinkedAffectedResourceType.Service,
+        label: "Service",
+        dashboardRoute: "service",
+    },
+    /*
+     * Last, as on the cards: an SLO is the objective measured over the
+     * resources above it rather than one of them.
+     */
+    {
+        column: "serviceLevelObjectives",
+        type: LinkedAffectedResourceType.ServiceLevelObjective,
+        label: "SLO",
+        dashboardRoute: "slos",
+    },
+];
+function isSameProject(projectId, expected) {
+    if (!projectId) {
+        return false;
+    }
+    return (projectId.toString().trim().toLowerCase() ===
+        expected.toString().trim().toLowerCase());
+}
+export default class LinkedAffectedResources {
+    // The relations `model` carries, in display order.
+    static getRelations(model) {
+        return LINKED_AFFECTED_RESOURCE_RELATIONS.filter((relation) => {
+            return model.hasColumn(relation.column);
+        });
+    }
+    static async readForIncident(data) {
+        return await LinkedAffectedResources.readForIncidents({
+            service: data.service,
+            projectId: data.projectId,
+            incidentIds: [data.incidentId],
+        });
+    }
+    static async readForIncidents(data) {
+        return await LinkedAffectedResources.read({
+            service: data.service,
+            model: new Incident(),
+            projectId: data.projectId,
+            recordIds: data.incidentIds,
+        });
+    }
+    static async readForAlert(data) {
+        return await LinkedAffectedResources.readForAlerts({
+            service: data.service,
+            projectId: data.projectId,
+            alertIds: [data.alertId],
+        });
+    }
+    static async readForAlerts(data) {
+        return await LinkedAffectedResources.read({
+            service: data.service,
+            model: new Alert(),
+            projectId: data.projectId,
+            recordIds: data.alertIds,
+        });
+    }
+    static async readForScheduledMaintenance(data) {
+        return await LinkedAffectedResources.read({
+            service: data.service,
+            model: new ScheduledMaintenance(),
+            projectId: data.projectId,
+            recordIds: [data.scheduledMaintenanceId],
+        });
+    }
+    /*
+     * The resources linked to any of `recordIds`, merged into one list.
+     *
+     * One query per relation rather than one query selecting them all: the
+     * relations are many-to-many, and joining a dozen of them at once returns
+     * the product of their sizes - an incident on 50 monitors and 50 hosts
+     * would come back as 2,500 rows. Read one at a time, the rows add up.
+     */
+    static async read(data) {
+        const recordIds = [];
+        const seenRecordIds = new Set();
+        for (const recordId of data.recordIds) {
+            const key = (recordId === null || recordId === void 0 ? void 0 : recordId.toString()) || "";
+            if (!key || seenRecordIds.has(key)) {
+                continue;
+            }
+            seenRecordIds.add(key);
+            recordIds.push(recordId);
+        }
+        if (recordIds.length === 0) {
+            return [];
+        }
+        const rowsPerRelation = await Promise.all(LinkedAffectedResources.getRelations(data.model).map((relation) => {
+            return data.service.findAllBy({
+                query: {
+                    _id: QueryHelper.any(recordIds),
+                    projectId: data.projectId,
+                },
+                select: {
+                    _id: true,
+                    projectId: true,
+                    [relation.column]: {
+                        _id: true,
+                        name: true,
+                        projectId: true,
+                    },
+                },
+                props: {
+                    isRoot: true,
+                },
+            });
+        }));
+        return LinkedAffectedResources.collect({
+            projectId: data.projectId,
+            records: rowsPerRelation.flatMap((rows) => {
+                return rows || [];
+            }),
+        });
+    }
+    /*
+     * The resources on already-read records, in display order and without
+     * repeats. A related row is kept only when it has an id and belongs to
+     * `projectId`; a row whose project was not read cannot be shown to belong
+     * here, so it is left out too - which also makes a caller that drops
+     * projectId from its select fail loudly in tests rather than quietly
+     * print nothing.
+     */
+    static collect(data) {
+        var _a, _b;
+        const resources = [];
+        const seen = new Set();
+        const records = data.records.filter((record) => {
+            if (!record) {
+                return false;
+            }
+            // A record read without its project is taken to be the caller's.
+            return (!record.projectId || isSameProject(record.projectId, data.projectId));
+        });
+        for (const relation of LINKED_AFFECTED_RESOURCE_RELATIONS) {
+            for (const record of records) {
+                const value = record[relation.column];
+                const rows = Array.isArray(value)
+                    ? value
+                    : value
+                        ? [value]
+                        : [];
+                for (const row of rows) {
+                    const id = ((_a = row === null || row === void 0 ? void 0 : row._id) === null || _a === void 0 ? void 0 : _a.toString()) || "";
+                    if (!row || !id || !isSameProject(row.projectId, data.projectId)) {
+                        continue;
+                    }
+                    const key = `${relation.type}:${id}`;
+                    if (seen.has(key)) {
+                        continue;
+                    }
+                    seen.add(key);
+                    resources.push({
+                        type: relation.type,
+                        id: id,
+                        name: ((_b = row.name) === null || _b === void 0 ? void 0 : _b.toString()) || "",
+                    });
+                }
+            }
+        }
+        return resources;
+    }
+    /*
+     * The names, for plain-text surfaces: emails and workspace summaries.
+     *
+     * `seriesSummary` is an alert's series identity - the pod or container a
+     * grouped monitor raised it for (SeriesLabelDisplay.buildInlineSummary).
+     * It names what broke more precisely than the monitor does, so it takes
+     * the monitor's place at the head of the list rather than joining it.
+     *
+     * A name that repeats (a monitor and a host both called "web-01") is
+     * printed once: this is a sentence, not a table.
+     */
+    static getNames(data) {
+        var _a;
+        const names = [];
+        const seenNames = new Set();
+        const seriesSummary = ((_a = data.seriesSummary) === null || _a === void 0 ? void 0 : _a.trim()) || "";
+        const addName = (name) => {
+            const trimmed = name.trim();
+            if (!trimmed || seenNames.has(trimmed)) {
+                return;
+            }
+            seenNames.add(trimmed);
+            names.push(trimmed);
+        };
+        addName(seriesSummary);
+        for (const resource of data.resources) {
+            if (seriesSummary &&
+                resource.type === LinkedAffectedResourceType.Monitor) {
+                continue;
+            }
+            addName(resource.name);
+        }
+        return names;
+    }
+    // getNames joined with ", ", or `fallback` when there are none.
+    static getText(data) {
+        return (LinkedAffectedResources.getNames({
+            resources: data.resources,
+            seriesSummary: data.seriesSummary,
+        }).join(", ") || data.fallback);
+    }
+    static getDashboardUrl(data) {
+        const relation = LinkedAffectedResources.getRelationForType(data.resource.type);
+        // URL.addRoute mutates, and the caller reuses its dashboard URL.
+        return URL.fromString(data.dashboardUrl.toString()).addRoute(`/${data.projectId.toString()}/${relation.dashboardRoute}/${data.resource.id}`);
+    }
+    /*
+     * The bullets under a feed item's "🌎 Resources Affected" header.
+     *
+     * A monitor keeps the bullet the created feeds have always printed,
+     * `- [<name>](<monitor link>)`, and an SLO keeps `- [SLO <name>](<link>)`
+     * from getSloAffectedResourceMarkdownLines. Every other resource follows
+     * the SLO's shape, `- [Host <name>](<link>)`, so the reader can tell a host
+     * from a cluster from a service.
+     *
+     * Those names are escaped: feeds render without safe mode and the same
+     * markdown goes to Slack and Teams, and a host or cluster name can come
+     * from an agent rather than from someone typing it.
+     */
+    static getMarkdownLines(data) {
+        const lines = [];
+        const slos = [];
+        for (const resource of data.resources) {
+            if (resource.type === LinkedAffectedResourceType.ServiceLevelObjective) {
+                slos.push({
+                    _id: resource.id,
+                    name: resource.name,
+                    // Already held to this project by collect.
+                    projectId: data.projectId,
+                });
+                continue;
+            }
+            const link = LinkedAffectedResources.getDashboardUrl({
+                dashboardUrl: data.dashboardUrl,
+                projectId: data.projectId,
+                resource: resource,
+            }).toString();
+            if (resource.type === LinkedAffectedResourceType.Monitor) {
+                lines.push(`- [${resource.name}](${link})`);
+                continue;
+            }
+            const label = LinkedAffectedResources.getRelationForType(resource.type).label;
+            const escapedName = escapeMarkdownInline(resource.name).trim();
+            lines.push(`- [${escapedName ? `${label} ${escapedName}` : label}](${link})`);
+        }
+        // SLOs are last in the table, so appending them keeps the order.
+        lines.push(...getSloAffectedResourceMarkdownLines({
+            dashboardUrl: data.dashboardUrl,
+            projectId: data.projectId,
+            serviceLevelObjectives: slos,
+        }));
+        return lines;
+    }
+    static getRelationForType(type) {
+        // Every type has at least one entry, so this always finds one.
+        return LINKED_AFFECTED_RESOURCE_RELATIONS.find((relation) => {
+            return relation.type === type;
+        });
+    }
+}
+//# sourceMappingURL=LinkedAffectedResources.js.map

package/build/dist/Server/Utils/AffectedResources/LinkedAffectedResources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"LinkedAffectedResources.js","sourceRoot":"","sources":["../../../../../Server/Utils/AffectedResources/LinkedAffectedResources.ts"],"names":[],"mappings":"AAEA,OAAO,WAAW,MAAM,kCAAkC,CAAC;AAE3D,OAAO,KAAK,MAAM,sCAAsC,CAAC;AAEzD,OAAO,QAAQ,MAAM,yCAAyC,CAAC;AAC/D,OAAO,oBAAoB,MAAM,qDAAqD,CAAC;AACvF,OAAO,GAAG,MAAM,wBAAwB,CAAC;AAEzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAC9E,OAAO,EACL,mCAAmC,GAEpC,MAAM,gDAAgD,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,MAAM,CAAN,IAAY,0BAeX;AAfD,WAAY,0BAA0B;IACpC,iDAAmB,CAAA;IACnB,2CAAa,CAAA;IACb,qEAAuC,CAAA;IACvC,uDAAyB,CAAA;IACzB,uDAAyB,CAAA;IACzB,+DAAiC,CAAA;IACjC,6DAA+B,CAAA;IAC/B,yDAA2B,CAAA;IAC3B,uEAAyC,CAAA;IACzC,mDAAqB,CAAA;IACrB,+DAAiC,CAAA;IACjC,yDAA2B,CAAA;IAC3B,iDAAmB,CAAA;IACnB,6EAA+C,CAAA;AACjD,CAAC,EAfW,0BAA0B,KAA1B,0BAA0B,QAerC;AAkBD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAC7C;IACE;QACE,MAAM,EAAE,UAAU;QAClB,IAAI,EAAE,0BAA0B,CAAC,OAAO;QACxC,KAAK,EAAE,SAAS;QAChB,cAAc,EAAE,UAAU;KAC3B;IACD;QACE,MAAM,EAAE,SAAS;QACjB,IAAI,EAAE,0BAA0B,CAAC,OAAO;QACxC,KAAK,EAAE,SAAS;QAChB,cAAc,EAAE,UAAU;KAC3B;IACD;QACE,MAAM,EAAE,OAAO;QACf,IAAI,EAAE,0BAA0B,CAAC,IAAI;QACrC,KAAK,EAAE,MAAM;QACb,cAAc,EAAE,MAAM;KACvB;IACD;QACE,MAAM,EAAE,oBAAoB;QAC5B,IAAI,EAAE,0BAA0B,CAAC,iBAAiB;QAClD,KAAK,EAAE,oBAAoB;QAC3B,cAAc,EAAE,YAAY;KAC7B;IACD;QACE,MAAM,EAAE,aAAa;QACrB,IAAI,EAAE,0BAA0B,CAAC,UAAU;QAC3C,KAAK,EAAE,aAAa;QACpB,cAAc,EAAE,QAAQ;KACzB;IACD;QACE,MAAM,EAAE,aAAa;QACrB,IAAI,EAAE,0BAA0B,CAAC,UAAU;QAC3C,KAAK,EAAE,aAAa;QACpB,cAAc,EAAE,QAAQ;KACzB;IACD;QACE,MAAM,EAAE,iBAAiB;QACzB,IAAI,EAAE,0BAA0B,CAAC,cAAc;QAC/C,KAAK,EAAE,iBAAiB;QACxB,cAAc,EAAE,SAAS;KAC1B;IACD;QACE,MAAM,EAAE,gBAAgB;QACxB,IAAI,EAAE,0BAA0B,CAAC,aAAa;QAC9C,KAAK,EAAE,gBAAgB;QACvB,cAAc,EAAE,QAAQ;KACzB;IACD;QACE,MAAM,EAAE,cAAc;QACtB,IAAI,EAAE,0BAA0B,CAAC,WAAW;QAC5C,KAAK,EAAE,cAAc;QACrB,cAAc,EAAE,MAAM;KACvB;IACD;QACE,MAAM,EAAE,qBAAqB;QAC7B,IAAI,EAAE,0BAA0B,CAAC,kBAAkB;QACnD,KAAK,EAAE,sBAAsB;QAC7B,cAAc,EAAE,cAAc;KAC/B;IACD;QACE,MAAM,EAAE,WAAW;QACnB,IAAI,EAAE,0BAA0B,CAAC,QAAQ;QACzC,KAAK,EAAE,WAAW;QAClB,cAAc,EAAE,KAAK;KACtB;IACD;QACE,MAAM,EAAE,iBAAiB;QACzB,IAAI,EAAE,0BAA0B,CAAC,cAAc;QAC/C,KAAK,EAAE,UAAU;QACjB,cAAc,EAAE,WAAW;KAC5B;IACD;QACE,MAAM,EAAE,cAAc;QACtB,IAAI,EAAE,0BAA0B,CAAC,WAAW;QAC5C,KAAK,EAAE,cAAc;QACrB,cAAc,EAAE,oBAAoB;KACrC;IACD;QACE,MAAM,EAAE,UAAU;QAClB,IAAI,EAAE,0BAA0B,CAAC,OAAO;QACxC,KAAK,EAAE,SAAS;QAChB,cAAc,EAAE,SAAS;KAC1B;IACD;;;OAGG;IACH;QACE,MAAM,EAAE,wBAAwB;QAChC,IAAI,EAAE,0BAA0B,CAAC,qBAAqB;QACtD,KAAK,EAAE,KAAK;QACZ,cAAc,EAAE,MAAM;KACvB;CACF,CAAC;AAoBJ,SAAS,aAAa,CACpB,SAA+C,EAC/C,QAAkB;IAElB,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,CACL,SAAS,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;QACzC,QAAQ,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CACzC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,OAAO,OAAO,uBAAuB;IAC1C,mDAAmD;IAC5C,MAAM,CAAC,YAAY,CACxB,KAAwB;QAExB,OAAO,kCAAkC,CAAC,MAAM,CAC9C,CAAC,QAAwC,EAAE,EAAE;YAC3C,OAAO,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC1C,CAAC,CACF,CAAC;IACJ,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,IAInC;QACC,OAAO,MAAM,uBAAuB,CAAC,gBAAgB,CAAC;YACpD,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,WAAW,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC;SAC/B,CAAC,CAAC;IACL,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAIpC;QACC,OAAO,MAAM,uBAAuB,CAAC,IAAI,CAAC;YACxC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,KAAK,EAAE,IAAI,QAAQ,EAAE;YACrB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,WAAW;SAC5B,CAAC,CAAC;IACL,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,IAIhC;QACC,OAAO,MAAM,uBAAuB,CAAC,aAAa,CAAC;YACjD,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;SACzB,CAAC,CAAC;IACL,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,IAIjC;QACC,OAAO,MAAM,uBAAuB,CAAC,IAAI,CAAC;YACxC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,KAAK,EAAE,IAAI,KAAK,EAAE;YAClB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,QAAQ;SACzB,CAAC,CAAC;IACL,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,2BAA2B,CAAC,IAI/C;QACC,OAAO,MAAM,uBAAuB,CAAC,IAAI,CAAC;YACxC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,KAAK,EAAE,IAAI,oBAAoB,EAAE;YACjC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC;SACzC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACK,MAAM,CAAC,KAAK,CAAC,IAAI,CAAuC,IAK/D;QACC,MAAM,SAAS,GAAoB,EAAE,CAAC;QACtC,MAAM,aAAa,GAAgB,IAAI,GAAG,EAAU,CAAC;QAErD,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACtC,MAAM,GAAG,GAAW,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,QAAQ,EAAE,KAAI,EAAE,CAAC;YAE/C,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnC,SAAS;YACX,CAAC;YAED,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACvB,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3B,CAAC;QAED,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,eAAe,GACnB,MAAM,OAAO,CAAC,GAAG,CACf,uBAAuB,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAClD,CACE,QAAwC,EACZ,EAAE;YAC9B,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;gBAC5B,KAAK,EAAE;oBACL,GAAG,EAAE,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC;oBAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;iBACM;gBACjC,MAAM,EAAE;oBACN,GAAG,EAAE,IAAI;oBACT,SAAS,EAAE,IAAI;oBACf,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE;wBACjB,GAAG,EAAE,IAAI;wBACT,IAAI,EAAE,IAAI;wBACV,SAAS,EAAE,IAAI;qBAChB;iBAC+B;gBAClC,KAAK,EAAE;oBACL,MAAM,EAAE,IAAI;iBACb;aACF,CAAC,CAAC;QACL,CAAC,CACF,CACF,CAAC;QAEJ,OAAO,uBAAuB,CAAC,OAAO,CAAC;YACrC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE,eAAe,CAAC,OAAO,CAC9B,CAAC,IAAmC,EAAqB,EAAE;gBACzD,OAAO,IAAI,IAAI,EAAE,CAAC;YACpB,CAAC,CACuC;SAC3C,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACI,MAAM,CAAC,OAAO,CAAC,IAGrB;;QACC,MAAM,SAAS,GAAkC,EAAE,CAAC;QACpD,MAAM,IAAI,GAAgB,IAAI,GAAG,EAAU,CAAC;QAE5C,MAAM,OAAO,GAA+B,IAAI,CAAC,OAAO,CAAC,MAAM,CAC7D,CAAC,MAA8C,EAAW,EAAE;YAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,KAAK,CAAC;YACf,CAAC;YAED,iEAAiE;YACjE,OAAO,CACL,CAAC,MAAM,CAAC,SAAS,IAAI,aAAa,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CACrE,CAAC;QACJ,CAAC,CAC4B,CAAC;QAEhC,KAAK,MAAM,QAAQ,IAAI,kCAAkC,EAAE,CAAC;YAC1D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,KAAK,GAAY,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAE/C,MAAM,IAAI,GAAyC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;oBACrE,CAAC,CAAE,KAA8C;oBACjD,CAAC,CAAC,KAAK;wBACL,CAAC,CAAC,CAAC,KAAmB,CAAC;wBACvB,CAAC,CAAC,EAAE,CAAC;gBAET,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;oBACvB,MAAM,EAAE,GAAW,CAAA,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,GAAG,0CAAE,QAAQ,EAAE,KAAI,EAAE,CAAC;oBAE9C,IAAI,CAAC,GAAG,IAAI,CAAC,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;wBACjE,SAAS;oBACX,CAAC;oBAED,MAAM,GAAG,GAAW,GAAG,QAAQ,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;oBAE7C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;wBAClB,SAAS;oBACX,CAAC;oBAED,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBAEd,SAAS,CAAC,IAAI,CAAC;wBACb,IAAI,EAAE,QAAQ,CAAC,IAAI;wBACnB,EAAE,EAAE,EAAE;wBACN,IAAI,EAAE,CAAA,MAAA,GAAG,CAAC,IAAI,0CAAE,QAAQ,EAAE,KAAI,EAAE;qBACjC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;;;;OAUG;IACI,MAAM,CAAC,QAAQ,CAAC,IAGtB;;QACC,MAAM,KAAK,GAAkB,EAAE,CAAC;QAChC,MAAM,SAAS,GAAgB,IAAI,GAAG,EAAU,CAAC;QACjD,MAAM,aAAa,GAAW,CAAA,MAAA,IAAI,CAAC,aAAa,0CAAE,IAAI,EAAE,KAAI,EAAE,CAAC;QAE/D,MAAM,OAAO,GAA2B,CAAC,IAAY,EAAQ,EAAE;YAC7D,MAAM,OAAO,GAAW,IAAI,CAAC,IAAI,EAAE,CAAC;YAEpC,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACvC,OAAO;YACT,CAAC;YAED,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtB,CAAC,CAAC;QAEF,OAAO,CAAC,aAAa,CAAC,CAAC;QAEvB,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACtC,IACE,aAAa;gBACb,QAAQ,CAAC,IAAI,KAAK,0BAA0B,CAAC,OAAO,EACpD,CAAC;gBACD,SAAS;YACX,CAAC;YAED,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,gEAAgE;IACzD,MAAM,CAAC,OAAO,CAAC,IAIrB;QACC,OAAO,CACL,uBAAuB,CAAC,QAAQ,CAAC;YAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,aAAa,EAAE,IAAI,CAAC,aAAa;SAClC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAC/B,CAAC;IACJ,CAAC;IAEM,MAAM,CAAC,eAAe,CAAC,IAI7B;QACC,MAAM,QAAQ,GACZ,uBAAuB,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAEjE,iEAAiE;QACjE,OAAO,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAC1D,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,QAAQ,CAAC,cAAc,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAC/E,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;OAYG;IACI,MAAM,CAAC,gBAAgB,CAAC,IAI9B;QACC,MAAM,KAAK,GAAkB,EAAE,CAAC;QAChC,MAAM,IAAI,GAA0C,EAAE,CAAC;QAEvD,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACtC,IAAI,QAAQ,CAAC,IAAI,KAAK,0BAA0B,CAAC,qBAAqB,EAAE,CAAC;gBACvE,IAAI,CAAC,IAAI,CAAC;oBACR,GAAG,EAAE,QAAQ,CAAC,EAAE;oBAChB,IAAI,EAAE,QAAQ,CAAC,IAAI;oBACnB,2CAA2C;oBAC3C,SAAS,EAAE,IAAI,CAAC,SAAS;iBAC1B,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,MAAM,IAAI,GAAW,uBAAuB,CAAC,eAAe,CAAC;gBAC3D,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,QAAQ,EAAE,QAAQ;aACnB,CAAC,CAAC,QAAQ,EAAE,CAAC;YAEd,IAAI,QAAQ,CAAC,IAAI,KAAK,0BAA0B,CAAC,OAAO,EAAE,CAAC;gBACzD,KAAK,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,IAAI,KAAK,IAAI,GAAG,CAAC,CAAC;gBAC5C,SAAS;YACX,CAAC;YAED,MAAM,KAAK,GAAW,uBAAuB,CAAC,kBAAkB,CAC9D,QAAQ,CAAC,IAAI,CACd,CAAC,KAAK,CAAC;YACR,MAAM,WAAW,GAAW,oBAAoB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;YAEvE,KAAK,CAAC,IAAI,CACR,MAAM,WAAW,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,GAAG,CAClE,CAAC;QACJ,CAAC;QAED,iEAAiE;QACjE,KAAK,CAAC,IAAI,CACR,GAAG,mCAAmC,CAAC;YACrC,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,sBAAsB,EAAE,IAAI;SAC7B,CAAC,CACH,CAAC;QAEF,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,MAAM,CAAC,kBAAkB,CAC/B,IAAgC;QAEhC,+DAA+D;QAC/D,OAAO,kCAAkC,CAAC,IAAI,CAC5C,CAAC,QAAwC,EAAE,EAAE;YAC3C,OAAO,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC;QAChC,CAAC,CACD,CAAC;IACL,CAAC;CACF"}

package/build/dist/Server/Utils/Alert/AlertStateChangeAuthorization.js

@@ -0,0 +1,112 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import Alert from "../../../Models/DatabaseModels/Alert";
+import AlertStateTimeline from "../../../Models/DatabaseModels/AlertStateTimeline";
+import { LIMIT_PER_PROJECT } from "../../../Types/Database/LimitMax";
+import NotAuthorizedException from "../../../Types/Exception/NotAuthorizedException";
+import ObjectID from "../../../Types/ObjectID";
+import AlertService from "../../Services/AlertService";
+import ModelPermission from "../../Types/Database/Permissions/Index";
+import QueryHelper from "../../Types/Database/QueryHelper";
+import { applyAlertSelfPrivacyFilter } from "./AlertPrivacyFilter";
+import CaptureSpan from "../Telemetry/CaptureSpan";
+/*
+ * Whether a caller may change the state of a set of alerts - acknowledge
+ * them, say - when that change is going to be written for them as root.
+ *
+ * Changing an alert's state from its own page takes two writes as the caller:
+ * a new AlertStateTimeline row (table and column permissions only), and then
+ * the alert's currentAlertStateId, which is an Alert UPDATE and so is narrowed
+ * by the caller's label scope, Owned scope and alert privacy. Being able to
+ * read an alert is not enough: a Viewer who is also an AlertMember for one
+ * label can read every alert but change the state of only some. A root write
+ * skips both, so this checks both, for every alert, before anything is
+ * written - the same rule the Microsoft Teams acknowledge action applies to
+ * one alert.
+ */
+export default class AlertStateChangeAuthorization {
+    static async assertCanChangeStateOfAlerts(data) {
+        if (data.props.isRoot || data.alertIds.length === 0) {
+            return;
+        }
+        const probe = new AlertStateTimeline();
+        probe.projectId = data.projectId;
+        probe.alertId = data.alertIds[0];
+        probe.alertStateId = ObjectID.generate();
+        ModelPermission.checkCreatePermissions(AlertStateTimeline, probe, data.props);
+        const alertQuery = {
+            _id: QueryHelper.any(data.alertIds),
+            projectId: data.projectId,
+        };
+        /*
+         * Labelled block and allow rules are decided per record, from the
+         * record's labels.
+         */
+        const alerts = await AlertService.findBy({
+            query: alertQuery,
+            select: {
+                _id: true,
+                labels: {
+                    _id: true,
+                    name: true,
+                },
+            },
+            limit: LIMIT_PER_PROJECT,
+            skip: 0,
+            props: {
+                isRoot: true,
+            },
+        });
+        for (const alert of alerts) {
+            await ModelPermission.checkUpdatePermissionByModel({
+                modelType: Alert,
+                fetchModelWithAccessControlIds: async () => {
+                    return alert;
+                },
+                props: data.props,
+            });
+        }
+        /*
+         * The caller's own update scope (labels, Owned, privacy) as a query:
+         * every alert must still be in it.
+         */
+        const permittedQuery = await ModelPermission.checkUpdateQueryPermissions(Alert, alertQuery, {
+            currentAlertStateId: ObjectID.getZeroObjectID(),
+        }, data.props);
+        const permittedAlerts = await AlertService.findBy({
+            query: applyAlertSelfPrivacyFilter(permittedQuery, data.props),
+            select: {
+                _id: true,
+            },
+            limit: LIMIT_PER_PROJECT,
+            skip: 0,
+            props: {
+                isRoot: true,
+            },
+        });
+        const permittedIds = new Set(permittedAlerts.map((alert) => {
+            var _a;
+            return ((_a = alert._id) === null || _a === void 0 ? void 0 : _a.toString().toLowerCase()) || "";
+        }));
+        const allPermitted = data.alertIds.every((alertId) => {
+            return permittedIds.has(alertId.toString().toLowerCase());
+        });
+        if (!allPermitted) {
+            throw new NotAuthorizedException("You do not have permission to change the state of one or more of these alerts.");
+        }
+    }
+}
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AlertStateChangeAuthorization, "assertCanChangeStateOfAlerts", null);
+//# sourceMappingURL=AlertStateChangeAuthorization.js.map

package/build/dist/Server/Utils/Alert/AlertStateChangeAuthorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AlertStateChangeAuthorization.js","sourceRoot":"","sources":["../../../../../Server/Utils/Alert/AlertStateChangeAuthorization.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,KAAK,MAAM,sCAAsC,CAAC;AACzD,OAAO,kBAAkB,MAAM,mDAAmD,CAAC;AAEnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,sBAAsB,MAAM,iDAAiD,CAAC;AACrF,OAAO,QAAQ,MAAM,yBAAyB,CAAC;AAC/C,OAAO,YAAY,MAAM,6BAA6B,CAAC;AACvD,OAAO,eAAe,MAAM,wCAAwC,CAAC;AAErE,OAAO,WAAW,MAAM,kCAAkC,CAAC;AAC3D,OAAO,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,WAAW,MAAM,0BAA0B,CAAC;AAEnD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,OAAO,OAAO,6BAA6B;IAE5B,AAAb,MAAM,CAAC,KAAK,CAAC,4BAA4B,CAAC,IAIhD;QACC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAuB,IAAI,kBAAkB,EAAE,CAAC;QAC3D,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QACjC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC;QAClC,KAAK,CAAC,YAAY,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAEzC,eAAe,CAAC,sBAAsB,CACpC,kBAAkB,EAClB,KAAK,EACL,IAAI,CAAC,KAAK,CACX,CAAC;QAEF,MAAM,UAAU,GAAiB;YAC/B,GAAG,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;YACnC,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF;;;WAGG;QACH,MAAM,MAAM,GAAiB,MAAM,YAAY,CAAC,MAAM,CAAC;YACrD,KAAK,EAAE,UAAU;YACjB,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;gBACT,MAAM,EAAE;oBACN,GAAG,EAAE,IAAI;oBACT,IAAI,EAAE,IAAI;iBACX;aACF;YACD,KAAK,EAAE,iBAAiB;YACxB,IAAI,EAAE,CAAC;YACP,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,eAAe,CAAC,4BAA4B,CAAC;gBACjD,SAAS,EAAE,KAAK;gBAChB,8BAA8B,EAAE,KAAK,IAAoB,EAAE;oBACzD,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,KAAK,EAAE,IAAI,CAAC,KAAK;aAClB,CAAC,CAAC;QACL,CAAC;QAED;;;WAGG;QACH,MAAM,cAAc,GAClB,MAAM,eAAe,CAAC,2BAA2B,CAC/C,KAAK,EACL,UAAU,EACV;YACE,mBAAmB,EAAE,QAAQ,CAAC,eAAe,EAAE;SAChD,EACD,IAAI,CAAC,KAAK,CACX,CAAC;QAEJ,MAAM,eAAe,GAAiB,MAAM,YAAY,CAAC,MAAM,CAAC;YAC9D,KAAK,EAAE,2BAA2B,CAAC,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC;YAC9D,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;aACV;YACD,KAAK,EAAE,iBAAiB;YACxB,IAAI,EAAE,CAAC;YACP,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,MAAM,YAAY,GAAgB,IAAI,GAAG,CACvC,eAAe,CAAC,GAAG,CAAC,CAAC,KAAY,EAAU,EAAE;;YAC3C,OAAO,CAAA,MAAA,KAAK,CAAC,GAAG,0CAAE,QAAQ,GAAG,WAAW,EAAE,KAAI,EAAE,CAAC;QACnD,CAAC,CAAC,CACH,CAAC;QAEF,MAAM,YAAY,GAAY,IAAI,CAAC,QAAQ,CAAC,KAAK,CAC/C,CAAC,OAAiB,EAAW,EAAE;YAC7B,OAAO,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC5D,CAAC,CACF,CAAC;QAEF,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,sBAAsB,CAC9B,gFAAgF,CACjF,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AAnGqB;IADnB,WAAW,EAAE;;;;uEAmGb"}