@orthacms/content-server 0.0.0-reserve.0

package/dist/lib/public-api/http/guards/api-token.guard.d.ts

@@ -0,0 +1,32 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { AccessPolicy, ApiTokenService } from '@orthacms/identity-server';
+/**
+ * Authenticates a public content-API request from its `Authorization: Bearer`
+ * token and authorizes it against the token's scope.
+ *
+ * These routes are `@Public()`, so the app-wide session `AuthGuard` passes them
+ * through untouched — this guard is the whole authentication story for them. It
+ * hashes the presented bearer, resolves it via `ApiTokenService.verify` (which
+ * rejects unknown, revoked, and expired tokens identically), and attaches the
+ * verified token as `request.apiToken`.
+ *
+ * Authorization then reuses the **same** machinery as the session routes:
+ * `scopePermissions` turns the token's scope into a permission set, and the
+ * route's `@RequirePermissions(...)` metadata is evaluated against it by the
+ * pure {@link AccessPolicy} — so a route's requirement means exactly the same
+ * thing whether the caller is a logged-in user or a token, and adding a write
+ * route later needs no change here.
+ *
+ * Every authentication failure — no header, wrong scheme, unknown/revoked/
+ * expired token — is one bare 401, so the endpoint can't be used to probe which
+ * tokens exist.
+ */
+export declare class ApiTokenGuard implements CanActivate {
+    private readonly reflector;
+    private readonly tokens;
+    private readonly accessPolicy;
+    constructor(reflector: Reflector, tokens: ApiTokenService, accessPolicy: AccessPolicy);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+}
+//# sourceMappingURL=api-token.guard.d.ts.map

package/dist/lib/public-api/http/guards/api-token.guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-token.guard.d.ts","sourceRoot":"","sources":["../../../../../src/lib/public-api/http/guards/api-token.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,WAAW,EACX,gBAAgB,EAInB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EACH,YAAY,EACZ,eAAe,EAKlB,MAAM,2BAA2B,CAAC;AAMnC;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBACa,aAAc,YAAW,WAAW;IAEzC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,YAAY;gBAFZ,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,eAAe,EACvB,YAAY,EAAE,YAAY;IAGzC,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;CA4CjE"}

package/dist/lib/public-api/http/guards/api-token.guard.js

@@ -0,0 +1,92 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApiTokenGuard = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const identity_server_1 = require("@orthacms/identity-server");
+/** The scheme the `Authorization` header must use, case-insensitively. */
+const BEARER = 'bearer';
+/**
+ * Authenticates a public content-API request from its `Authorization: Bearer`
+ * token and authorizes it against the token's scope.
+ *
+ * These routes are `@Public()`, so the app-wide session `AuthGuard` passes them
+ * through untouched — this guard is the whole authentication story for them. It
+ * hashes the presented bearer, resolves it via `ApiTokenService.verify` (which
+ * rejects unknown, revoked, and expired tokens identically), and attaches the
+ * verified token as `request.apiToken`.
+ *
+ * Authorization then reuses the **same** machinery as the session routes:
+ * `scopePermissions` turns the token's scope into a permission set, and the
+ * route's `@RequirePermissions(...)` metadata is evaluated against it by the
+ * pure {@link AccessPolicy} — so a route's requirement means exactly the same
+ * thing whether the caller is a logged-in user or a token, and adding a write
+ * route later needs no change here.
+ *
+ * Every authentication failure — no header, wrong scheme, unknown/revoked/
+ * expired token — is one bare 401, so the endpoint can't be used to probe which
+ * tokens exist.
+ */
+let ApiTokenGuard = class ApiTokenGuard {
+    reflector;
+    tokens;
+    accessPolicy;
+    constructor(reflector, tokens, accessPolicy) {
+        this.reflector = reflector;
+        this.tokens = tokens;
+        this.accessPolicy = accessPolicy;
+    }
+    async canActivate(context) {
+        const request = context.switchToHttp().getRequest();
+        const secret = bearerFrom(request.headers.authorization);
+        if (!secret) {
+            throw new common_1.UnauthorizedException('Missing `Authorization: Bearer <token>` header.');
+        }
+        const token = await this.tokens.verify(secret);
+        if (!token) {
+            // Unknown, revoked, and expired are one flat 401 — no enumeration
+            // signal, and no hint about which of the three it was.
+            throw new common_1.UnauthorizedException('Invalid API token.');
+        }
+        request.apiToken = {
+            id: token.id,
+            name: token.name,
+            scope: token.scope,
+            workspaceIds: token.workspaceIds,
+            createdBy: token.createdBy ?? null
+        };
+        const required = this.reflector.getAllAndOverride(identity_server_1.PERMISSIONS_KEY, [context.getHandler(), context.getClass()]);
+        if (required && required.length > 0) {
+            // A token acts on its own behalf, not a user's — see `tokenActor`
+            // for why the minting user's role grants are never consulted.
+            const allowed = this.accessPolicy.canAll((0, identity_server_1.tokenActor)(token), required.map((key) => identity_server_1.Permission.create(key)));
+            if (!allowed) {
+                throw new common_1.ForbiddenException('This token’s scope does not allow that operation.');
+            }
+        }
+        return true;
+    }
+};
+exports.ApiTokenGuard = ApiTokenGuard;
+exports.ApiTokenGuard = ApiTokenGuard = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [core_1.Reflector,
+        identity_server_1.ApiTokenService,
+        identity_server_1.AccessPolicy])
+], ApiTokenGuard);
+/**
+ * The raw token out of an `Authorization` header, or `undefined` when the
+ * header is absent, uses another scheme, or carries no value.
+ */
+function bearerFrom(header) {
+    if (!header) {
+        return undefined;
+    }
+    const [scheme, ...rest] = header.trim().split(/\s+/);
+    if (scheme.toLowerCase() !== BEARER) {
+        return undefined;
+    }
+    const value = rest.join(' ');
+    return value.length > 0 ? value : undefined;
+}

package/dist/lib/public-api/http/guards/draft-visibility.guard.d.ts

@@ -0,0 +1,25 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import { AccessPolicy } from '@orthacms/identity-server';
+/**
+ * Gates `?status=draft|any` on **write** scope.
+ *
+ * Every public read defaults to published-only, which is the API's headline
+ * rule. A write-scoped token needs to widen it — otherwise creating a draft
+ * returns a record that is then invisible forever, and the creator cannot poll
+ * its own work. Widening is safe for exactly that caller and no other: a token
+ * that may read drafts is one that could have published them anyway.
+ *
+ * A **guard** rather than a check inside the query service, so the rule has one
+ * home and applies to every route the moment it is added to the controller —
+ * including ones that reach the drafts indirectly (a translations preview, a
+ * relation expansion) and would otherwise each need to remember.
+ *
+ * `content:update` is the probe rather than `content:read`, because read is
+ * exactly what both scopes hold; update is what separates them.
+ */
+export declare class DraftVisibilityGuard implements CanActivate {
+    private readonly policy;
+    constructor(policy: AccessPolicy);
+    canActivate(context: ExecutionContext): boolean;
+}
+//# sourceMappingURL=draft-visibility.guard.d.ts.map

package/dist/lib/public-api/http/guards/draft-visibility.guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"draft-visibility.guard.d.ts","sourceRoot":"","sources":["../../../../../src/lib/public-api/http/guards/draft-visibility.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,WAAW,EACX,gBAAgB,EAGnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACH,YAAY,EAIf,MAAM,2BAA2B,CAAC;AAOnC;;;;;;;;;;;;;;;;GAgBG;AACH,qBACa,oBAAqB,YAAW,WAAW;IACxC,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,YAAY;IAEjD,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO;CA4BlD"}

package/dist/lib/public-api/http/guards/draft-visibility.guard.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DraftVisibilityGuard = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const identity_server_1 = require("@orthacms/identity-server");
+const public_list_entries_query_dto_1 = require("../dto/public-list-entries-query.dto");
+/** The default — and the only visibility a read-only token may ask for. */
+const PUBLISHED = 'published';
+/**
+ * Gates `?status=draft|any` on **write** scope.
+ *
+ * Every public read defaults to published-only, which is the API's headline
+ * rule. A write-scoped token needs to widen it — otherwise creating a draft
+ * returns a record that is then invisible forever, and the creator cannot poll
+ * its own work. Widening is safe for exactly that caller and no other: a token
+ * that may read drafts is one that could have published them anyway.
+ *
+ * A **guard** rather than a check inside the query service, so the rule has one
+ * home and applies to every route the moment it is added to the controller —
+ * including ones that reach the drafts indirectly (a translations preview, a
+ * relation expansion) and would otherwise each need to remember.
+ *
+ * `content:update` is the probe rather than `content:read`, because read is
+ * exactly what both scopes hold; update is what separates them.
+ */
+let DraftVisibilityGuard = class DraftVisibilityGuard {
+    policy;
+    constructor(policy) {
+        this.policy = policy;
+    }
+    canActivate(context) {
+        const request = context.switchToHttp().getRequest();
+        const requested = request.query?.['status'];
+        // Absent, or the default: nothing to authorize. An unrecognised value
+        // is left alone deliberately — the DTO's `@IsIn` turns it into a 400,
+        // and a guard that 403'd first would report the wrong problem.
+        if (typeof requested !== 'string' ||
+            requested === PUBLISHED ||
+            !public_list_entries_query_dto_1.ENTRY_VISIBILITY.includes(requested)) {
+            return true;
+        }
+        const token = request.apiToken;
+        const allowed = !!token &&
+            this.policy.can((0, identity_server_1.tokenActor)(token), identity_server_1.Permission.create(identity_server_1.PERMISSIONS.CONTENT_UPDATE));
+        if (!allowed) {
+            throw new common_1.ForbiddenException(`status=${requested} requires a token with write scope.`);
+        }
+        return true;
+    }
+};
+exports.DraftVisibilityGuard = DraftVisibilityGuard;
+exports.DraftVisibilityGuard = DraftVisibilityGuard = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [identity_server_1.AccessPolicy])
+], DraftVisibilityGuard);

package/dist/lib/public-api/infrastructure/bulk-save-op.d.ts

@@ -0,0 +1,55 @@
+import { BULK_SAVE_OP, type BulkSaveOp } from '../types/public-bulk';
+import type { EntryLocator } from './public-entries.query';
+/**
+ * What one bulk-save item was addressed as — a **discriminated union**, so a
+ * caller that has checked `op` gets the locator without a fallback for a case
+ * the resolver never produces.
+ */
+export type ResolvedBulkSaveOp = {
+    op: typeof BULK_SAVE_OP.Create;
+} | {
+    op: typeof BULK_SAVE_OP.Update;
+    /** Which row the update targets. */
+    locator: EntryLocator;
+    /**
+     * The addressing locale of a group-addressed update — the query
+     * string's `?locale=` on the single-entry route.
+     *
+     * Only ever set for an update, and deliberately so: on a **create**
+     * the item's `locale` stamps the new row, and passing it as an
+     * addressing locale is the exact confusion that let a group-addressed
+     * German update rewrite the English row (see
+     * `PublicEntryWritesService.update`).
+     */
+    locale?: string;
+};
+/** The addressing fields a bulk-save item may carry. */
+interface BulkSaveItemAddress {
+    id?: string;
+    localeGroupId?: string;
+    locale?: string;
+    op?: BulkSaveOp;
+}
+/**
+ * Decide what one bulk-save item does, from how it is addressed.
+ *
+ * A single-entry write says this in its **URL** — `POST /:typeName` creates,
+ * `PATCH /:typeName/:id` updates, `PATCH /:typeName/group/:gid?locale=` updates
+ * a translation. A batch has one URL for every item, so the addressing moves
+ * into the item and this function is the one place that reads it. The rules:
+ *
+ * - `id` → **update** that row. An entry id already names one row, including
+ *   its locale, so no addressing locale is involved.
+ * - neither `id` nor `localeGroupId` → **create**.
+ * - `localeGroupId` alone → genuinely ambiguous, so `op` is **required**:
+ *   `create` adds that record's row in `locale` (joining the group), `update`
+ *   changes the row the group already has there.
+ *
+ * `op` may always be stated explicitly, and disagreeing with the addressing is
+ * an error rather than a silent preference — `{ op: 'create', id }` is a caller
+ * who believes one thing while the request says another, and picking a winner
+ * would make whichever they did not mean happen quietly.
+ */
+export declare function resolveBulkSaveOp(item: BulkSaveItemAddress): ResolvedBulkSaveOp;
+export {};
+//# sourceMappingURL=bulk-save-op.d.ts.map

package/dist/lib/public-api/infrastructure/bulk-save-op.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bulk-save-op.d.ts","sourceRoot":"","sources":["../../../../src/lib/public-api/infrastructure/bulk-save-op.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,KAAK,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAE3D;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GACxB;IAAE,EAAE,EAAE,OAAO,YAAY,CAAC,MAAM,CAAA;CAAE,GAClC;IACI,EAAE,EAAE,OAAO,YAAY,CAAC,MAAM,CAAC;IAC/B,oCAAoC;IACpC,OAAO,EAAE,YAAY,CAAC;IACtB;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAER,wDAAwD;AACxD,UAAU,mBAAmB;IACzB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,EAAE,CAAC,EAAE,UAAU,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,iBAAiB,CAC7B,IAAI,EAAE,mBAAmB,GAC1B,kBAAkB,CA2CpB"}

package/dist/lib/public-api/infrastructure/bulk-save-op.js

@@ -0,0 +1,61 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveBulkSaveOp = resolveBulkSaveOp;
+const common_1 = require("@nestjs/common");
+const public_bulk_1 = require("../types/public-bulk");
+/**
+ * Decide what one bulk-save item does, from how it is addressed.
+ *
+ * A single-entry write says this in its **URL** — `POST /:typeName` creates,
+ * `PATCH /:typeName/:id` updates, `PATCH /:typeName/group/:gid?locale=` updates
+ * a translation. A batch has one URL for every item, so the addressing moves
+ * into the item and this function is the one place that reads it. The rules:
+ *
+ * - `id` → **update** that row. An entry id already names one row, including
+ *   its locale, so no addressing locale is involved.
+ * - neither `id` nor `localeGroupId` → **create**.
+ * - `localeGroupId` alone → genuinely ambiguous, so `op` is **required**:
+ *   `create` adds that record's row in `locale` (joining the group), `update`
+ *   changes the row the group already has there.
+ *
+ * `op` may always be stated explicitly, and disagreeing with the addressing is
+ * an error rather than a silent preference — `{ op: 'create', id }` is a caller
+ * who believes one thing while the request says another, and picking a winner
+ * would make whichever they did not mean happen quietly.
+ */
+function resolveBulkSaveOp(item) {
+    const id = nonEmpty(item.id);
+    const localeGroupId = nonEmpty(item.localeGroupId);
+    if (id && localeGroupId) {
+        throw new common_1.BadRequestException('Pass either `id` or `localeGroupId`, not both — they are two ways of naming the same row.');
+    }
+    if (id) {
+        if (item.op === public_bulk_1.BULK_SAVE_OP.Create) {
+            throw new common_1.BadRequestException('`op: "create"` cannot carry an `id` — an id names an entry that already exists. Drop the id to create, or drop `op` to update it.');
+        }
+        return { op: public_bulk_1.BULK_SAVE_OP.Update, locator: { id } };
+    }
+    if (!localeGroupId) {
+        if (item.op === public_bulk_1.BULK_SAVE_OP.Update) {
+            throw new common_1.BadRequestException('`op: "update"` needs an `id`, or a `localeGroupId` with the `locale` to change.');
+        }
+        return { op: public_bulk_1.BULK_SAVE_OP.Create };
+    }
+    // A group id and nothing else. Both readings are things a caller really
+    // wants, and neither is the obvious default, so ask rather than guess.
+    if (!item.op) {
+        throw new common_1.BadRequestException('This item names a `localeGroupId` but no `id`, so it could either create that record’s row in `locale` or update the row it already has there. Say which with `op: "create"` or `op: "update"`.');
+    }
+    if (item.op === public_bulk_1.BULK_SAVE_OP.Create) {
+        return { op: public_bulk_1.BULK_SAVE_OP.Create };
+    }
+    return {
+        op: public_bulk_1.BULK_SAVE_OP.Update,
+        locator: { localeGroupId },
+        ...(nonEmpty(item.locale) ? { locale: item.locale } : {})
+    };
+}
+/** A present, non-empty string, or `undefined`. */
+function nonEmpty(value) {
+    return typeof value === 'string' && value.length > 0 ? value : undefined;
+}

package/dist/lib/public-api/infrastructure/field-selection.d.ts

@@ -0,0 +1,21 @@
+import type { AnyContentType } from '../../types/content-type';
+/**
+ * Parse a `?fields=` selection into the set of value fields to return, or
+ * `undefined` for "everything" (the parameter absent, or present but empty).
+ *
+ * Selection covers the **`values` bag only** — the envelope (`id`, timestamps,
+ * `publishedAt`, `locale`, `localeGroupId`) is always returned. `id` in
+ * particular is what a consumer needs to fetch the entry again, so letting a
+ * selection drop it would be a foot-gun for no payload saving; the envelope is
+ * a handful of small columns either way, while the weight a caller actually
+ * wants to avoid is in the fields (a richtext body).
+ *
+ * An unrecognised name is a **400**, not a silent drop. A sparse fieldset is an
+ * explicit request, so a typo should say so rather than quietly returning an
+ * entry missing the field the caller asked for. Reference fields (relation and
+ * media) get their own message, because "not selectable *yet*" is a different
+ * fact from "no such field" and points at the API's current limit rather than
+ * at the caller's spelling.
+ */
+export declare function parseFieldSelection(type: AnyContentType, raw: string | undefined): ReadonlySet<string> | undefined;
+//# sourceMappingURL=field-selection.d.ts.map

package/dist/lib/public-api/infrastructure/field-selection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"field-selection.d.ts","sourceRoot":"","sources":["../../../../src/lib/public-api/infrastructure/field-selection.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAU/D;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,mBAAmB,CAC/B,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,MAAM,GAAG,SAAS,GACxB,WAAW,CAAC,MAAM,CAAC,GAAG,SAAS,CAmDjC"}

package/dist/lib/public-api/infrastructure/field-selection.js

@@ -0,0 +1,72 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseFieldSelection = parseFieldSelection;
+const common_1 = require("@nestjs/common");
+const public_entry_row_1 = require("./public-entry-row");
+/**
+ * Upper bound on how many names a `?fields=` list may carry. Generous — no real
+ * content type has this many — but it bounds the parse and the projection a
+ * single request can provoke.
+ */
+const MAX_SELECTED_FIELDS = 100;
+/**
+ * Parse a `?fields=` selection into the set of value fields to return, or
+ * `undefined` for "everything" (the parameter absent, or present but empty).
+ *
+ * Selection covers the **`values` bag only** — the envelope (`id`, timestamps,
+ * `publishedAt`, `locale`, `localeGroupId`) is always returned. `id` in
+ * particular is what a consumer needs to fetch the entry again, so letting a
+ * selection drop it would be a foot-gun for no payload saving; the envelope is
+ * a handful of small columns either way, while the weight a caller actually
+ * wants to avoid is in the fields (a richtext body).
+ *
+ * An unrecognised name is a **400**, not a silent drop. A sparse fieldset is an
+ * explicit request, so a typo should say so rather than quietly returning an
+ * entry missing the field the caller asked for. Reference fields (relation and
+ * media) get their own message, because "not selectable *yet*" is a different
+ * fact from "no such field" and points at the API's current limit rather than
+ * at the caller's spelling.
+ */
+function parseFieldSelection(type, raw) {
+    if (raw === undefined) {
+        return undefined;
+    }
+    const names = [
+        ...new Set(raw
+            .split(',')
+            .map((name) => name.trim())
+            .filter(Boolean))
+    ];
+    if (names.length === 0) {
+        // `?fields=` with nothing in it reads as "no preference", not "no
+        // fields" — an empty `values` bag is never what a caller meant.
+        return undefined;
+    }
+    if (names.length > MAX_SELECTED_FIELDS) {
+        throw new common_1.BadRequestException(`fields: at most ${MAX_SELECTED_FIELDS} names may be selected.`);
+    }
+    for (const name of names) {
+        // `Object.hasOwn`, not `type.fields[name]`: the field map is the host's
+        // plain object literal, passed through untouched, so a bare lookup also
+        // resolves everything it INHERITS. `?fields=constructor` read back
+        // `Object` — a function, so `!spec` was false and the "unknown field"
+        // 400 never fired — and `isPureValueField` then asked for
+        // `Object.type`, `undefined`, which is not a reference type, so the
+        // second 400 never fired either. `constructor` landed in the selected
+        // set and reached the projection builder, which put a class function
+        // into the `.select()` list instead of a column: a 500 out of drizzle
+        // on a public, token-authenticated endpoint. `toString`, `valueOf`,
+        // `hasOwnProperty`, `isPrototypeOf`, `propertyIsEnumerable` and
+        // `toLocaleString` all worked the same way.
+        const spec = Object.hasOwn(type.fields, name)
+            ? type.fields[name]
+            : undefined;
+        if (!spec) {
+            throw new common_1.BadRequestException(`fields: unknown field "${name}" on "${type.name}".`);
+        }
+        if (!(0, public_entry_row_1.isPureValueField)(spec)) {
+            throw new common_1.BadRequestException(`fields: "${name}" is a ${spec.type} field and cannot be selected — this API does not return relation or media values yet.`);
+        }
+    }
+    return new Set(names);
+}