@opensaas/stack-core 0.37.0 → 0.38.0

package/dist/access/access-filter.js

@@ -1,139 +1,32 @@
 import { checkAccess, getRelatedListConfig } from './engine.js';
 import { READ_INCLUDE_MAX_DEPTH } from './depth-limits.js';
 import { AccessScopeDepthExceededError } from './errors.js';
-/**
- * Collapse a rich, provenance-carrying include entry down to the plain
- * Prisma-shaped form. A `nested` result that is `depth-exceeded` or
- * `nothing-to-scope` contributes no `include` key — this is the AUTO-include
- * silently stopping, which is correct when no caller asked for anything past
- * this point (see `AccessIncludeResult` doc comment).
- */
-function toPrismaEntry(entry) {
-    const result = {};
-    if (entry.where)
-        result.where = entry.where;
-    if (entry.nested.kind === 'scoped') {
-        const nestedInclude = toPrismaInclude(entry.nested);
-        if (nestedInclude && Object.keys(nestedInclude).length > 0) {
-            result.include = nestedInclude;
-        }
-    }
-    return Object.keys(result).length > 0 ? result : true;
-}
-/**
- * Collapse an `AccessIncludeResult` to the plain Prisma `include` shape used
- * when there is no caller-supplied include to merge against (the direct
- * auto-include path). `nothing-to-scope` and `depth-exceeded` both become
- * `undefined` here — at this call site nothing was explicitly requested past
- * either boundary, so there is nothing to deny.
- */
-export function toPrismaInclude(result) {
-    if (result.kind !== 'scoped')
-        return undefined;
-    const out = {};
-    for (const [key, entry] of Object.entries(result.include)) {
-        out[key] = toPrismaEntry(entry);
-    }
-    return out;
-}
-/**
- * Build the access-controlled include for a list's fields.
- *
- * This allows us to filter relationships at the database level instead of in
- * memory. Returns an {@link AccessIncludeResult} rather than a plain include
- * object so that `mergeIncludeWithAccessControl` can tell a genuine "nothing
- * to scope" apart from "the engine hit its depth cap" (see that type's doc
- * comment and ADR-0022).
- */
-export async function buildIncludeWithAccessControl(fieldConfigs, args, config, depth = 0, 
-// List names already on the path from the root to here. Used to detect
-// relationship cycles (A → B → … → A) and stop the auto-include from
-// re-descending them. Seed it with the root list name at the call site.
-visitedLists = []) {
-    if (depth >= READ_INCLUDE_MAX_DEPTH) {
-        return { kind: 'depth-exceeded' };
-    }
-    // Inside a resolveOutput/virtual-field context we still scope each immediate
-    // relation (its own access `where`), but do not auto-expand INTO its nested
-    // relations — this keeps a single hook-issued read's include from growing
-    // depth-first. Correction (ADR-0023): this does NOT by itself terminate a
-    // cycle, despite what an earlier version of this comment claimed. A
-    // self-referential relation read from inside a hook is a NEW top-level
-    // read, invisible to this function's own recursion — the loop runs through
-    // the hook↔read boundary, not through repeated calls to
-    // `buildIncludeWithAccessControl`. Loop termination is the resolve chain's
-    // job: `field-visibility.ts`'s `resolveReadableFieldValue` refuses to
-    // re-enter a `(list, field)` pair already on the chain. What this check
-    // still does correctly is row-scope the immediate relation rather than
-    // skipping scoping altogether (issue #830's second trigger).
-    const insideResolveOutput = args.context._resolveOutputChain.length > 0;
-    const include = {};
-    let hasRelationships = false;
-    for (const [fieldName, fieldConfig] of Object.entries(fieldConfigs)) {
-        if (fieldConfig?.type === 'relationship' && 'ref' in fieldConfig && fieldConfig.ref) {
-            hasRelationships = true;
-            const relatedConfig = getRelatedListConfig(fieldConfig.ref, config);
-            if (relatedConfig) {
-                // Check query access for the related list
-                const queryAccess = relatedConfig.listConfig.access?.operation?.query;
-                const accessResult = await checkAccess(queryAccess, {
-                    session: args.session,
-                    context: args.context,
-                });
-                // If access is completely denied, exclude this relationship
-                if (accessResult === false) {
-                    continue;
-                }
-                const where = typeof accessResult === 'object' ? accessResult : undefined;
-                // Cycle guard: if the related list already appears on the path from the
-                // root, DO NOT auto-include its relationships again. On a cyclic
-                // readable-relationship graph (A → B → … → A) the depth-first walk would
-                // otherwise re-descend the cycle on every branch, and — combined with the
-                // bare-`true` leaf re-expansion in `mergeIncludeWithAccessControl` — build
-                // an include tree deep/large enough to overflow the call stack in
-                // downstream processing (the RSC serializer's recursive `Map.set`). This
-                // extends the SF-20 (#566) fix: a bare-`true` leaf must resolve to a
-                // genuine single-level fetch, not a re-expansion of the full auto-include.
-                // The relation itself is still included (as a FLAT fetch of its own
-                // columns); only its onward relationships are pruned at the back-edge.
-                let nested = { kind: 'nothing-to-scope' };
-                const relatedListName = relatedConfig.listName;
-                if (!insideResolveOutput && !visitedLists.includes(relatedListName)) {
-                    nested = await buildIncludeWithAccessControl(relatedConfig.listConfig.fields, args, config, depth + 1, [...visitedLists, relatedListName]);
-                }
-                include[fieldName] = { where, nested };
-            }
-        }
-    }
-    return hasRelationships ? { kind: 'scoped', include } : { kind: 'nothing-to-scope' };
+/** A plain object — excludes `null` and arrays, which `typeof x === 'object'` alone would admit. */
+function isPlainObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
 /**
  * Narrow an unknown include value to the structured object form (vs bare `true`
  * or any other primitive). Caller-supplied includes arrive untyped at the
- * runtime boundary, so we validate the shape here rather than casting.
+ * runtime boundary: narrow to a plain object first, then validate each field's
+ * own type before trusting it, rather than casting the whole value wholesale.
  *
  * A numeric `take` on a to-many relation include (a caller-supplied row bound,
  * issue #752) is carried through: it only ever NARROWS the fetched rows and can
- * never widen past the access `where`, so preserving it is access-neutral. The
- * access-controlled include never sets `take` itself — it originates solely
- * from the caller — so `mergeIncludeWithAccessControl` re-attaches it below.
+ * never widen past the access `where`, so preserving it is access-neutral.
  */
 function asEntryObject(value) {
-    if (value && typeof value === 'object') {
-        const obj = value;
-        const where = obj.where;
-        const include = obj.include;
-        const take = obj.take;
-        const entry = {};
-        if (where && typeof where === 'object')
-            entry.where = where;
-        if (include && typeof include === 'object')
-            entry.include = include;
-        if (typeof take === 'number')
-            entry.take = take;
-        return entry;
-    }
-    return null;
+    if (!isPlainObject(value))
+        return null;
+    const { where, include, take } = value;
+    const entry = {};
+    if (isPlainObject(where))
+        entry.where = where;
+    if (isPlainObject(include))
+        entry.include = include;
+    if (typeof take === 'number')
+        entry.take = take;
+    return entry;
 }
 /**
  * AND-combine an access `where` with a caller-supplied nested `where`.
@@ -150,104 +43,75 @@ function andWhere(accessWhere, callerWhere) {
     return accessWhere ?? callerWhere;
 }
 /**
- * Merge a caller-supplied `include` with the access-controlled include — phase-1
- * row/relation scoping for explicit caller selections.
- *
- * The caller's `include` decides WHICH relations to fetch; access control decides
- * WHETHER each relation may be fetched and WITH WHAT filter. Replacing the
- * access-controlled include with the caller's wholesale (the bug in #566) drops
- * every per-relation access `where` and denied-relation exclusion, silently
- * bypassing row-level access on any non-sudo read that passes `include`.
+ * Build the access-scoped `include` for exactly the relations a read
+ * requested, recursing only into branches `requestedInclude` itself names.
  *
- * For each relation the caller asks to include:
- * - If the relation is a config-declared relationship but is ABSENT from the
- *   access-controlled include, its `query` access returned `false` → it is DROPPED
- *   (not fetched).
- * - If it is present (allowed, possibly with a filter), the access entry is used
- *   as the base: the access `where` is AND-combined with any caller-supplied
- *   nested `where`, and nested includes are recursively merged using the related
- *   list's field configs (so deeply-nested selections are filtered at every
- *   level). A bare caller `true` becomes the access-controlled shape (filter +
- *   nested filtered include), never bare `true`.
- * - If the caller names a key that is NOT a config-declared relationship, it is
- *   passed through unchanged (access control does not govern it).
+ * For each key in `requestedInclude`:
+ * - Not a config-declared relationship → access control does not govern it;
+ *   passed through unchanged (e.g. a fragment/caller key that isn't a
+ *   relationship at all).
+ * - A declared relationship whose related list's `query` access denies it
+ *   (`=== false`) → dropped entirely, no matter what the request asked for
+ *   nested beneath it (#566): the caller chooses *which* relations, access
+ *   control chooses *whether* and *with what filter*.
+ * - Otherwise → the access `where` is AND-combined with any caller-supplied
+ *   nested `where` (never replaced — the other half of #566), a
+ *   caller-supplied `take` rides through unchanged (#752), and — the "One
+ *   hop" rule (ADR-0026) — nested relations are scoped ONLY if
+ *   `requestedInclude` itself named a nested `include` here. A bare relation
+ *   (or one with no nested `include`) fetches its own columns and stops: no
+ *   recursive call, no access evaluation on anything beneath it.
  *
- * `accessControlledInclude` is the {@link AccessIncludeResult} for THIS level:
- * - `nothing-to-scope` → nothing to merge against (the list has no
- *   relationships, or we're inside a resolveOutput context where the caller
- *   include is irrelevant to begin with). Pass the caller's include through
- *   unchanged — this is a non-denial outcome, not "every relation denied".
- * - `depth-exceeded` → the engine could not compute a scope for THIS level at
- *   all because it sits at or past `READ_INCLUDE_MAX_DEPTH`. If the caller
- *   named anything here, that is exactly the case that used to pass through
- *   unscoped (issue #830): throw `AccessScopeDepthExceededError` instead. An
- *   empty caller include at this level (nothing further requested) is not an
- *   error — there's simply nothing to do.
- * - `scoped` → the normal per-relation merge below: a declared relationship
- *   ABSENT from the access include was denied (drop it); one PRESENT is used
- *   as the base, AND-combining `where`s and recursing into nested includes.
- *
- * `listKey` and `depth` are carried only to build a useful
- * `AccessScopeDepthExceededError` message; they do not affect merge behaviour.
+ * **Depth is a cost limit, not a cycle guard (ADR-0026).** A `requestedInclude`
+ * is always a finite literal — the caller's own object, or
+ * `foldDeclaredDependencies`'s already-cycle-guarded fold — so this recursion
+ * cannot loop unboundedly on its own; nothing here walks the relationship
+ * graph unprompted. `READ_INCLUDE_MAX_DEPTH` still bounds how deep a request
+ * may reach, fail-closed per ADR-0022: a request naming anything at or past
+ * the cap throws `AccessScopeDepthExceededError` rather than silently
+ * returning less than what was asked for.
  */
-export function mergeIncludeWithAccessControl(callerInclude, accessControlledInclude, fieldConfigs, config, listKey, depth = 0) {
-    if (accessControlledInclude.kind === 'nothing-to-scope') {
-        return callerInclude;
+export async function buildAccessScopedInclude(requestedInclude, fieldConfigs, args, config, listKey, depth = 0) {
+    const requestedKeys = Object.keys(requestedInclude);
+    if (depth >= READ_INCLUDE_MAX_DEPTH && requestedKeys.length > 0) {
+        throw new AccessScopeDepthExceededError(listKey, requestedKeys[0], depth);
     }
-    if (accessControlledInclude.kind === 'depth-exceeded') {
-        const [firstRelationName] = Object.keys(callerInclude);
-        if (firstRelationName !== undefined) {
-            throw new AccessScopeDepthExceededError(listKey, firstRelationName, depth);
-        }
-        return {};
-    }
-    const merged = {};
-    const accessInclude = accessControlledInclude.include;
-    for (const [relationName, callerValue] of Object.entries(callerInclude)) {
+    const result = {};
+    for (const [relationName, requestedValue] of Object.entries(requestedInclude)) {
         const fieldConfig = fieldConfigs[relationName];
         const isDeclaredRelationship = fieldConfig?.type === 'relationship' && 'ref' in fieldConfig && !!fieldConfig.ref;
-        // Not a config-declared relationship → access control does not govern it; pass through unchanged.
         if (!isDeclaredRelationship) {
-            merged[relationName] = callerValue;
-            continue;
-        }
-        const accessEntry = accessInclude[relationName];
-        // Declared relationship absent from the access include → query access denied → drop it.
-        if (accessEntry === undefined) {
+            result[relationName] = requestedValue;
             continue;
         }
-        const callerEntry = asEntryObject(callerValue);
-        // Resolve the related list's field configs so nested includes merge recursively.
         const relatedConfig = getRelatedListConfig(fieldConfig.ref, config);
-        const relatedFields = relatedConfig?.listConfig.fields;
-        const mergedWhere = andWhere(accessEntry.where, callerEntry?.where);
-        let mergedNested;
-        if (callerEntry?.include && relatedFields && relatedConfig) {
-            // Recurse: scope the caller's nested selection against the nested access
-            // result. If that result is 'depth-exceeded', the recursive call itself
-            // throws — the caller named something the engine cannot scope.
-            mergedNested = mergeIncludeWithAccessControl(callerEntry.include, accessEntry.nested, relatedFields, config, relatedConfig.listName, depth + 1);
+        if (!relatedConfig)
+            continue;
+        const queryAccess = relatedConfig.listConfig.access?.operation?.query;
+        const accessResult = await checkAccess(queryAccess, {
+            session: args.session,
+            context: args.context,
+        });
+        if (accessResult === false) {
+            continue;
         }
-        else if (accessEntry.nested.kind === 'scoped') {
-            // Caller selected the relation bare (no nested include); keep the
-            // access-controlled nested include so deeper relations stay filtered.
-            mergedNested = toPrismaInclude(accessEntry.nested);
+        const accessWhere = typeof accessResult === 'object' ? accessResult : undefined;
+        const requestedEntry = asEntryObject(requestedValue);
+        const mergedWhere = andWhere(accessWhere, requestedEntry?.where);
+        let nestedInclude;
+        if (requestedEntry?.include) {
+            nestedInclude = await buildAccessScopedInclude(requestedEntry.include, relatedConfig.listConfig.fields, args, config, relatedConfig.listName, depth + 1);
         }
-        // If the caller's entry has no nested include, a 'depth-exceeded' nested
-        // result is silent here too — nothing was asked for past this point.
         const entry = {};
         if (mergedWhere)
             entry.where = mergedWhere;
-        if (mergedNested && Object.keys(mergedNested).length > 0)
-            entry.include = mergedNested;
-        // Preserve a caller-supplied row bound on the relation (issue #752). It only
-        // narrows, never widens, so it rides on top of the access `where`/include.
-        if (callerEntry?.take !== undefined)
-            entry.take = callerEntry.take;
-        // A bare-`true` relation with no access filter, nested include, or row bound stays `true`.
-        merged[relationName] = Object.keys(entry).length > 0 ? entry : true;
+        if (nestedInclude && Object.keys(nestedInclude).length > 0)
+            entry.include = nestedInclude;
+        if (requestedEntry?.take !== undefined)
+            entry.take = requestedEntry.take;
+        result[relationName] = Object.keys(entry).length > 0 ? entry : true;
     }
-    return merged;
+    return result;
 }
 /**
  * Remove keys that correspond to `virtual` fields from a Prisma `include`

package/dist/access/access-filter.js.map

@@ -1 +1 @@
-{"version":3,"file":"access-filter.js","sourceRoot":"","sources":["../../src/access/access-filter.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAA;AAC1D,OAAO,EAAE,6BAA6B,EAAE,MAAM,aAAa,CAAA;AAoD3D;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,KAAuB;IAC5C,MAAM,MAAM,GAAsD,EAAE,CAAA;IACpE,IAAI,KAAK,CAAC,KAAK;QAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAA;IAC3C,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,aAAa,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACnD,IAAI,aAAa,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3D,MAAM,CAAC,OAAO,GAAG,aAAa,CAAA;QAChC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;AACvD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,MAA2B;IACzD,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IAC9C,MAAM,GAAG,GAAkB,EAAE,CAAA;IAC7B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1D,GAAG,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,CAAA;IACjC,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,YAAyC,EACzC,IAGC,EACD,MAAsB,EACtB,KAAK,GAAW,CAAC;AACjB,uEAAuE;AACvE,qEAAqE;AACrE,wEAAwE;AACxE,YAAY,GAAsB,EAAE;IAEpC,IAAI,KAAK,IAAI,sBAAsB,EAAE,CAAC;QACpC,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAA;IACnC,CAAC;IAED,6EAA6E;IAC7E,4EAA4E;IAC5E,0EAA0E;IAC1E,0EAA0E;IAC1E,oEAAoE;IACpE,uEAAuE;IACvE,2EAA2E;IAC3E,wDAAwD;IACxD,2EAA2E;IAC3E,sEAAsE;IACtE,wEAAwE;IACxE,uEAAuE;IACvE,6DAA6D;IAC7D,MAAM,mBAAmB,GAAG,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC,CAAA;IAEvE,MAAM,OAAO,GAAsB,EAAE,CAAA;IACrC,IAAI,gBAAgB,GAAG,KAAK,CAAA;IAE5B,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACpE,IAAI,WAAW,EAAE,IAAI,KAAK,cAAc,IAAI,KAAK,IAAI,WAAW,IAAI,WAAW,CAAC,GAAG,EAAE,CAAC;YACpF,gBAAgB,GAAG,IAAI,CAAA;YACvB,MAAM,aAAa,GAAG,oBAAoB,CAAC,WAAW,CAAC,GAAa,EAAE,MAAM,CAAC,CAAA;YAE7E,IAAI,aAAa,EAAE,CAAC;gBAClB,0CAA0C;gBAC1C,MAAM,WAAW,GAAG,aAAa,CAAC,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAA;gBACrE,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC,WAAW,EAAE;oBAClD,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,OAAO,EAAE,IAAI,CAAC,OAAO;iBACtB,CAAC,CAAA;gBAEF,4DAA4D;gBAC5D,IAAI,YAAY,KAAK,KAAK,EAAE,CAAC;oBAC3B,SAAQ;gBACV,CAAC;gBAED,MAAM,KAAK,GAAG,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAA;gBAEzE,wEAAwE;gBACxE,iEAAiE;gBACjE,yEAAyE;gBACzE,0EAA0E;gBAC1E,2EAA2E;gBAC3E,kEAAkE;gBAClE,yEAAyE;gBACzE,qEAAqE;gBACrE,2EAA2E;gBAC3E,oEAAoE;gBACpE,uEAAuE;gBACvE,IAAI,MAAM,GAAwB,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAA;gBAC9D,MAAM,eAAe,GAAG,aAAa,CAAC,QAAQ,CAAA;gBAC9C,IAAI,CAAC,mBAAmB,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;oBACpE,MAAM,GAAG,MAAM,6BAA6B,CAC1C,aAAa,CAAC,UAAU,CAAC,MAAM,EAC/B,IAAI,EACJ,MAAM,EACN,KAAK,GAAG,CAAC,EACT,CAAC,GAAG,YAAY,EAAE,eAAe,CAAC,CACnC,CAAA;gBACH,CAAC;gBAED,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;YACxC,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,gBAAgB,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAA;AACtF,CAAC;AAKD;;;;;;;;;;GAUG;AACH,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,KAAgC,CAAA;QAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAA;QACvB,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAA;QAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAA;QACrB,MAAM,KAAK,GAAuB,EAAE,CAAA;QACpC,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,KAAK,CAAC,KAAK,GAAG,KAAqB,CAAA;QAC3E,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,KAAK,CAAC,OAAO,GAAG,OAAwB,CAAA;QACpF,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,KAAK,CAAC,IAAI,GAAG,IAAI,CAAA;QAC/C,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,QAAQ,CACf,WAAqC,EACrC,WAAqC;IAErC,IAAI,WAAW,IAAI,WAAW,EAAE,CAAC;QAC/B,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAA;IAC5C,CAAC;IACD,OAAO,WAAW,IAAI,WAAW,CAAA;AACnC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,MAAM,UAAU,6BAA6B,CAC3C,aAAsC,EACtC,uBAA4C,EAC5C,YAAyC,EACzC,MAAsB,EACtB,OAAe,EACf,KAAK,GAAW,CAAC;IAEjB,IAAI,uBAAuB,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;QACxD,OAAO,aAAa,CAAA;IACtB,CAAC;IAED,IAAI,uBAAuB,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QACtD,MAAM,CAAC,iBAAiB,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QACtD,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,IAAI,6BAA6B,CAAC,OAAO,EAAE,iBAAiB,EAAE,KAAK,CAAC,CAAA;QAC5E,CAAC;QACD,OAAO,EAAE,CAAA;IACX,CAAC;IAED,MAAM,MAAM,GAA4B,EAAE,CAAA;IAC1C,MAAM,aAAa,GAAG,uBAAuB,CAAC,OAAO,CAAA;IAErD,KAAK,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QACxE,MAAM,WAAW,GAAG,YAAY,CAAC,YAAY,CAAC,CAAA;QAC9C,MAAM,sBAAsB,GAC1B,WAAW,EAAE,IAAI,KAAK,cAAc,IAAI,KAAK,IAAI,WAAW,IAAI,CAAC,CAAC,WAAW,CAAC,GAAG,CAAA;QAEnF,kGAAkG;QAClG,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAC5B,MAAM,CAAC,YAAY,CAAC,GAAG,WAAW,CAAA;YAClC,SAAQ;QACV,CAAC;QAED,MAAM,WAAW,GAAG,aAAa,CAAC,YAAY,CAAC,CAAA;QAE/C,wFAAwF;QACxF,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,SAAQ;QACV,CAAC;QAED,MAAM,WAAW,GAAG,aAAa,CAAC,WAAW,CAAC,CAAA;QAE9C,iFAAiF;QACjF,MAAM,aAAa,GAAG,oBAAoB,CAAC,WAAW,CAAC,GAAa,EAAE,MAAM,CAAC,CAAA;QAC7E,MAAM,aAAa,GAAG,aAAa,EAAE,UAAU,CAAC,MAAM,CAAA;QAEtD,MAAM,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC,CAAA;QAEnE,IAAI,YAAiD,CAAA;QACrD,IAAI,WAAW,EAAE,OAAO,IAAI,aAAa,IAAI,aAAa,EAAE,CAAC;YAC3D,yEAAyE;YACzE,wEAAwE;YACxE,+DAA+D;YAC/D,YAAY,GAAG,6BAA6B,CAC1C,WAAW,CAAC,OAAO,EACnB,WAAW,CAAC,MAAM,EAClB,aAAa,EACb,MAAM,EACN,aAAa,CAAC,QAAQ,EACtB,KAAK,GAAG,CAAC,CACV,CAAA;QACH,CAAC;aAAM,IAAI,WAAW,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAChD,kEAAkE;YAClE,sEAAsE;YACtE,YAAY,GAAG,eAAe,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;QACpD,CAAC;QACD,yEAAyE;QACzE,qEAAqE;QAErE,MAAM,KAAK,GAA+E,EAAE,CAAA;QAC5F,IAAI,WAAW;YAAE,KAAK,CAAC,KAAK,GAAG,WAAW,CAAA;QAC1C,IAAI,YAAY,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,KAAK,CAAC,OAAO,GAAG,YAAY,CAAA;QACtF,6EAA6E;QAC7E,2EAA2E;QAC3E,IAAI,WAAW,EAAE,IAAI,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,GAAG,WAAW,CAAC,IAAI,CAAA;QAElE,2FAA2F;QAC3F,MAAM,CAAC,YAAY,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;IACrE,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,6BAA6B,CAC3C,OAA4C,EAC5C,YAAyC,EACzC,MAAsB;IAEtB,IAAI,CAAC,OAAO;QAAE,OAAO,OAAO,CAAA;IAE5B,MAAM,MAAM,GAA4B,EAAE,CAAA;IAE1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,MAAM,WAAW,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;QAErC,uEAAuE;QACvE,IAAI,WAAW,EAAE,OAAO;YAAE,SAAQ;QAElC,MAAM,sBAAsB,GAC1B,WAAW,EAAE,IAAI,KAAK,cAAc,IAAI,KAAK,IAAI,WAAW,IAAI,CAAC,CAAC,WAAW,CAAC,GAAG,CAAA;QACnF,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,CAAA;QAElC,IAAI,sBAAsB,IAAI,KAAK,EAAE,OAAO,EAAE,CAAC;YAC7C,MAAM,aAAa,GAAG,oBAAoB,CAAC,WAAW,CAAC,GAAa,EAAE,MAAM,CAAC,CAAA;YAC7E,IAAI,aAAa,EAAE,CAAC;gBAClB,MAAM,aAAa,GAAG,6BAA6B,CACjD,KAAK,CAAC,OAAO,EACb,aAAa,CAAC,UAAU,CAAC,MAAM,EAC/B,MAAM,CACP,CAAA;gBACD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,GAAI,KAAiC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAA;gBAC/E,SAAQ;YACV,CAAC;QACH,CAAC;QAED,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IACrB,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}
+{"version":3,"file":"access-filter.js","sourceRoot":"","sources":["../../src/access/access-filter.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAA;AAC1D,OAAO,EAAE,6BAA6B,EAAE,MAAM,aAAa,CAAA;AA+B3D,oGAAoG;AACpG,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC7E,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACtC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,KAAK,CAAA;IACtC,MAAM,KAAK,GAAuB,EAAE,CAAA;IACpC,IAAI,aAAa,CAAC,KAAK,CAAC;QAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAA;IAC7C,IAAI,aAAa,CAAC,OAAO,CAAC;QAAE,KAAK,CAAC,OAAO,GAAG,OAAO,CAAA;IACnD,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,KAAK,CAAC,IAAI,GAAG,IAAI,CAAA;IAC/C,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,QAAQ,CACf,WAAqC,EACrC,WAAqC;IAErC,IAAI,WAAW,IAAI,WAAW,EAAE,CAAC;QAC/B,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAA;IAC5C,CAAC;IACD,OAAO,WAAW,IAAI,WAAW,CAAA;AACnC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,gBAAyC,EACzC,YAAyC,EACzC,IAGC,EACD,MAAsB,EACtB,OAAe,EACf,KAAK,GAAW,CAAC;IAEjB,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;IACnD,IAAI,KAAK,IAAI,sBAAsB,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,6BAA6B,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IAC3E,CAAC;IAED,MAAM,MAAM,GAA4B,EAAE,CAAA;IAE1C,KAAK,MAAM,CAAC,YAAY,EAAE,cAAc,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC9E,MAAM,WAAW,GAAG,YAAY,CAAC,YAAY,CAAC,CAAA;QAC9C,MAAM,sBAAsB,GAC1B,WAAW,EAAE,IAAI,KAAK,cAAc,IAAI,KAAK,IAAI,WAAW,IAAI,CAAC,CAAC,WAAW,CAAC,GAAG,CAAA;QAEnF,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAC5B,MAAM,CAAC,YAAY,CAAC,GAAG,cAAc,CAAA;YACrC,SAAQ;QACV,CAAC;QAED,MAAM,aAAa,GAAG,oBAAoB,CAAC,WAAW,CAAC,GAAa,EAAE,MAAM,CAAC,CAAA;QAC7E,IAAI,CAAC,aAAa;YAAE,SAAQ;QAE5B,MAAM,WAAW,GAAG,aAAa,CAAC,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAA;QACrE,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC,WAAW,EAAE;YAClD,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CAAA;QAEF,IAAI,YAAY,KAAK,KAAK,EAAE,CAAC;YAC3B,SAAQ;QACV,CAAC;QAED,MAAM,WAAW,GAAG,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAA;QAC/E,MAAM,cAAc,GAAG,aAAa,CAAC,cAAc,CAAC,CAAA;QACpD,MAAM,WAAW,GAAG,QAAQ,CAAC,WAAW,EAAE,cAAc,EAAE,KAAK,CAAC,CAAA;QAEhE,IAAI,aAAkD,CAAA;QACtD,IAAI,cAAc,EAAE,OAAO,EAAE,CAAC;YAC5B,aAAa,GAAG,MAAM,wBAAwB,CAC5C,cAAc,CAAC,OAAO,EACtB,aAAa,CAAC,UAAU,CAAC,MAAM,EAC/B,IAAI,EACJ,MAAM,EACN,aAAa,CAAC,QAAQ,EACtB,KAAK,GAAG,CAAC,CACV,CAAA;QACH,CAAC;QAED,MAAM,KAAK,GAA+E,EAAE,CAAA;QAC5F,IAAI,WAAW;YAAE,KAAK,CAAC,KAAK,GAAG,WAAW,CAAA;QAC1C,IAAI,aAAa,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,KAAK,CAAC,OAAO,GAAG,aAAa,CAAA;QACzF,IAAI,cAAc,EAAE,IAAI,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,GAAG,cAAc,CAAC,IAAI,CAAA;QAExE,MAAM,CAAC,YAAY,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;IACrE,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,6BAA6B,CAC3C,OAA4C,EAC5C,YAAyC,EACzC,MAAsB;IAEtB,IAAI,CAAC,OAAO;QAAE,OAAO,OAAO,CAAA;IAE5B,MAAM,MAAM,GAA4B,EAAE,CAAA;IAE1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,MAAM,WAAW,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;QAErC,uEAAuE;QACvE,IAAI,WAAW,EAAE,OAAO;YAAE,SAAQ;QAElC,MAAM,sBAAsB,GAC1B,WAAW,EAAE,IAAI,KAAK,cAAc,IAAI,KAAK,IAAI,WAAW,IAAI,CAAC,CAAC,WAAW,CAAC,GAAG,CAAA;QACnF,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,CAAA;QAElC,IAAI,sBAAsB,IAAI,KAAK,EAAE,OAAO,EAAE,CAAC;YAC7C,MAAM,aAAa,GAAG,oBAAoB,CAAC,WAAW,CAAC,GAAa,EAAE,MAAM,CAAC,CAAA;YAC7E,IAAI,aAAa,EAAE,CAAC;gBAClB,MAAM,aAAa,GAAG,6BAA6B,CACjD,KAAK,CAAC,OAAO,EACb,aAAa,CAAC,UAAU,CAAC,MAAM,EAC/B,MAAM,CACP,CAAA;gBACD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,GAAI,KAAiC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAA;gBAC/E,SAAQ;YACV,CAAC;QACH,CAAC;QAED,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IACrB,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}