@portaidentity/server 1.7.3 → 1.9.0

package/dist/rbac/mapping-repository.d.ts

@@ -24,40 +24,79 @@ import type { Role, Permission, UserRole } from './types.js';
  * already-assigned permissions are silently skipped. This allows
  * callers to assign without checking for existing assignments first.
  *
+ * @param applicationId - Authoritative parent application UUID
  * @param roleId - Role UUID
  * @param permissionIds - Array of permission UUIDs to assign
+ * @returns Permission IDs inserted by this request
  */
-export declare function assignPermissionsToRole(roleId: string, permissionIds: string[]): Promise<void>;
+export declare function assignPermissionsToRole(applicationId: string, roleId: string, permissionIds: string[]): Promise<string[]>;
 /**
  * Remove multiple permissions from a role.
  *
  * Silently succeeds if any of the permission IDs are not currently
  * assigned to the role.
  *
+ * @param applicationId - Authoritative parent application UUID
  * @param roleId - Role UUID
  * @param permissionIds - Array of permission UUIDs to remove
+ * @returns Permission IDs removed by this request
  */
-export declare function removePermissionsFromRole(roleId: string, permissionIds: string[]): Promise<void>;
+export declare function removePermissionsFromRole(applicationId: string, roleId: string, permissionIds: string[]): Promise<string[]>;
+/** Records locked for one application-scoped role-permission mutation. */
+export interface LockedRolePermissionTargets {
+    /** Role selected through the route application, or null when it is not a child. */
+    readonly role: Role | null;
+    /** Requested permissions that belong to the same application, ordered by UUID. */
+    readonly permissions: readonly Permission[];
+    /** Requested permission IDs currently assigned to the role, ordered by UUID. */
+    readonly assignedPermissionIds: readonly string[];
+}
+/**
+ * Lock a role and requested permissions before validating and changing mappings.
+ *
+ * Permissions are de-duplicated and sorted before PostgreSQL acquires row locks.
+ * This gives concurrent mapping requests one deterministic lock order. Callers
+ * compare the returned permission IDs with their requested IDs before mutating.
+ *
+ * @param applicationId - Authoritative parent application UUID
+ * @param roleId - Role UUID selected beneath the application
+ * @param permissionIds - Permission UUIDs in the mapping request
+ * @returns The owned role and owned requested permissions
+ */
+export declare function lockRolePermissionTargets(applicationId: string, roleId: string, permissionIds: readonly string[]): Promise<LockedRolePermissionTargets>;
+/**
+ * List users assigned to an application-owned role.
+ *
+ * Mapping mutations call this while holding the role row lock, so concurrent
+ * assignments cannot escape affected-user capture through the role foreign key.
+ *
+ * @param applicationId - Authoritative parent application UUID
+ * @param roleId - Role UUID selected beneath the application
+ * @returns Distinct user UUIDs in stable order
+ */
+export declare function getUserIdsForRole(applicationId: string, roleId: string): Promise<string[]>;
 /**
  * Get all permissions assigned to a role.
  *
  * JOINs role_permissions with permissions table to return full
  * Permission objects, ordered by slug for consistent output.
  *
+ * @param applicationId - Authoritative parent application UUID
  * @param roleId - Role UUID
  * @returns Array of permissions assigned to the role
  */
-export declare function getPermissionsForRole(roleId: string): Promise<Permission[]>;
+export declare function getPermissionsForRole(applicationId: string, roleId: string): Promise<Permission[]>;
 /**
  * Get all roles that have a specific permission assigned.
  *
  * JOINs role_permissions with roles table to return full Role objects,
  * ordered by name for consistent output.
  *
+ * @param applicationId - Authoritative parent application UUID
  * @param permissionId - Permission UUID
  * @returns Array of roles that have this permission
  */
-export declare function getRolesWithPermission(permissionId: string): Promise<Role[]>;
+export declare function getRolesWithPermission(applicationId: string, permissionId: string): Promise<Role[]>;
 /**
  * Assign multiple roles to a user (bulk insert).
  *
@@ -65,21 +104,54 @@ export declare function getRolesWithPermission(permissionId: string): Promise<Ro
  * already-assigned roles are silently skipped. Tracks who performed
  * the assignment via the optional assignedBy parameter.
  *
+ * @param organizationId - Authoritative organization UUID
  * @param userId - User UUID
  * @param roleIds - Array of role UUIDs to assign
  * @param assignedBy - Optional UUID of the admin who performed the assignment
+ * @returns Role IDs inserted by this call
  */
-export declare function assignRolesToUser(userId: string, roleIds: string[], assignedBy?: string): Promise<void>;
+export declare function assignRolesToUser(organizationId: string, userId: string, roleIds: string[], assignedBy?: string): Promise<string[]>;
 /**
  * Remove multiple roles from a user.
  *
  * Silently succeeds if any of the role IDs are not currently
  * assigned to the user.
  *
+ * @param organizationId - Authoritative organization UUID
  * @param userId - User UUID
  * @param roleIds - Array of role UUIDs to remove
+ * @returns Role IDs removed by this call
+ */
+export declare function removeRolesFromUser(organizationId: string, userId: string, roleIds: string[]): Promise<string[]>;
+/** Locked user and role records for one organization-scoped assignment request. */
+export interface LockedUserRoleTargets {
+    /** Target user when it belongs to the route organization. */
+    readonly user: {
+        readonly id: string;
+        readonly status: string;
+    } | null;
+    /** Requested roles found in PostgreSQL, ordered by UUID. */
+    readonly roles: readonly Role[];
+    /** Requested role IDs currently assigned to the user, ordered by UUID. */
+    readonly assignedRoleIds: readonly string[];
+}
+/**
+ * Lock one organization-owned user and requested roles before an assignment change.
+ *
+ * Role IDs are de-duplicated and sorted before locking. The returned collections
+ * let the service reject unknown targets atomically and distinguish removals from
+ * idempotent no-ops.
+ *
+ * @param organizationId - Authoritative organization UUID
+ * @param userId - User UUID beneath the organization
+ * @param roleIds - Role UUIDs in the assignment request
+ * @returns Locked target records and current direct assignments
  */
-export declare function removeRolesFromUser(userId: string, roleIds: string[]): Promise<void>;
+export declare function lockUserRoleTargets(organizationId: string, userId: string, roleIds: readonly string[]): Promise<LockedUserRoleTargets>;
+/** List roles for a user only when the user belongs to the route organization. */
+export declare function getRolesForOrganizationUser(organizationId: string, userId: string): Promise<Role[]>;
+/** List same-application permissions for an organization-owned user. */
+export declare function getPermissionsForOrganizationUser(organizationId: string, userId: string): Promise<Permission[]>;
 /**
  * Get all roles assigned to a user.
  *
@@ -87,9 +159,10 @@ export declare function removeRolesFromUser(userId: string, roleIds: string[]):
  * ordered by name for consistent output.
  *
  * @param userId - User UUID
+ * @param applicationId - Optional application UUID used to scope token authority
  * @returns Array of roles assigned to the user
  */
-export declare function getRolesForUser(userId: string): Promise<Role[]>;
+export declare function getRolesForUser(userId: string, applicationId?: string): Promise<Role[]>;
 /**
  * Get all permissions for a user, resolved through their assigned roles.
  *
@@ -99,22 +172,24 @@ export declare function getRolesForUser(userId: string): Promise<Role[]>;
  * may have the same permission through multiple roles.
  *
  * @param userId - User UUID
+ * @param applicationId - Optional application UUID used to scope token authority
  * @returns Deduplicated array of permissions the user has through their roles
  */
-export declare function getPermissionsForUser(userId: string): Promise<Permission[]>;
+export declare function getPermissionsForUser(userId: string, applicationId?: string): Promise<Permission[]>;
 /**
  * List user-role assignments for a specific role within an organization.
  *
  * Supports pagination for admin UI views showing which users have a
  * particular role. JOINs with users table to filter by organization.
  *
+ * @param applicationId - Authoritative parent application UUID
  * @param roleId - Role UUID
  * @param orgId - Organization UUID (to scope users)
  * @param page - Page number (1-based)
  * @param pageSize - Number of results per page
  * @returns Paginated user-role assignments and total count
  */
-export declare function getUsersWithRole(roleId: string, orgId: string, page: number, pageSize: number): Promise<{
+export declare function getUsersWithRole(applicationId: string, roleId: string, orgId: string, page: number, pageSize: number): Promise<{
     rows: UserRole[];
     total: number;
 }>;

package/dist/rbac/mapping-repository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mapping-repository.d.ts","sourceRoot":"","sources":["../../src/rbac/mapping-repository.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,KAAK,EAAE,IAAI,EAAW,UAAU,EAAiB,QAAQ,EAAe,MAAM,YAAY,CAAC;AAOlG;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,IAAI,CAAC,CAqBf;AAED;;;;;;;;GAQG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,IAAI,CAAC,CAaf;AAED;;;;;;;;GAQG;AACH,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAajF;AAED;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAalF;AAMD;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EAAE,EACjB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CAqBf;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EAAE,GAChB,OAAO,CAAC,IAAI,CAAC,CAaf;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAarE;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAcjF;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CA6B9C"}
+{"version":3,"file":"mapping-repository.d.ts","sourceRoot":"","sources":["../../src/rbac/mapping-repository.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,KAAK,EAAE,IAAI,EAAW,UAAU,EAAiB,QAAQ,EAAe,MAAM,YAAY,CAAC;AAOlG;;;;;;;;;;;GAWG;AACH,wBAAsB,uBAAuB,CAC3C,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,MAAM,EAAE,CAAC,CAiBnB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,yBAAyB,CAC7C,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,MAAM,EAAE,CAAC,CAiBnB;AAED,0EAA0E;AAC1E,MAAM,WAAW,2BAA2B;IAC1C,mFAAmF;IACnF,QAAQ,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAC3B,kFAAkF;IAClF,QAAQ,CAAC,WAAW,EAAE,SAAS,UAAU,EAAE,CAAC;IAC5C,gFAAgF;IAChF,QAAQ,CAAC,qBAAqB,EAAE,SAAS,MAAM,EAAE,CAAC;CACnD;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,yBAAyB,CAC7C,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,SAAS,MAAM,EAAE,GAC/B,OAAO,CAAC,2BAA2B,CAAC,CA8CtC;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAUhG;AAED;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CACzC,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,UAAU,EAAE,CAAC,CAgBvB;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAC1C,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,EAAE,CAAC,CAgBjB;AAMD;;;;;;;;;;;;GAYG;AACH,wBAAsB,iBAAiB,CACrC,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EAAE,EACjB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,EAAE,CAAC,CAiBnB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CACvC,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EAAE,GAChB,OAAO,CAAC,MAAM,EAAE,CAAC,CAgBnB;AAED,mFAAmF;AACnF,MAAM,WAAW,qBAAqB;IACpC,6DAA6D;IAC7D,QAAQ,CAAC,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACvE,4DAA4D;IAC5D,QAAQ,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC;IAChC,0EAA0E;IAC1E,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7C;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,mBAAmB,CACvC,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,SAAS,MAAM,EAAE,GACzB,OAAO,CAAC,qBAAqB,CAAC,CAoChC;AAED,kFAAkF;AAClF,wBAAsB,2BAA2B,CAC/C,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,EAAE,CAAC,CAWjB;AAED,wEAAwE;AACxE,wBAAsB,iCAAiC,CACrD,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,UAAU,EAAE,CAAC,CAcvB;AAED;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAe7F;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,UAAU,EAAE,CAAC,CAmBvB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,gBAAgB,CACpC,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CA+B9C"}

package/dist/rbac/mapping-repository.js

@@ -28,24 +28,25 @@ import { mapRowToRole, mapRowToPermission, mapRowToUserRole } from './types.js';
  * already-assigned permissions are silently skipped. This allows
  * callers to assign without checking for existing assignments first.
  *
+ * @param applicationId - Authoritative parent application UUID
  * @param roleId - Role UUID
  * @param permissionIds - Array of permission UUIDs to assign
+ * @returns Permission IDs inserted by this request
  */
-export async function assignPermissionsToRole(roleId, permissionIds) {
+export async function assignPermissionsToRole(applicationId, roleId, permissionIds) {
     if (permissionIds.length === 0)
-        return;
+        return [];
     const pool = getPool();
-    // Build parameterized VALUES list: ($1, $2), ($1, $3), ($1, $4), ...
-    // $1 is always the roleId, subsequent params are permission IDs
-    const valuesList = [];
-    const params = [roleId];
-    for (let i = 0; i < permissionIds.length; i++) {
-        params.push(permissionIds[i]);
-        valuesList.push(`($1, $${i + 2})`);
-    }
-    await pool.query(`INSERT INTO role_permissions (role_id, permission_id)
-     VALUES ${valuesList.join(', ')}
-     ON CONFLICT DO NOTHING`, params);
+    const result = await pool.query(`INSERT INTO role_permissions (role_id, permission_id)
+     SELECT role.id, permission.id
+     FROM roles role
+     JOIN permissions permission ON permission.application_id = role.application_id
+     WHERE role.application_id = $1
+       AND role.id = $2
+       AND permission.id = ANY($3::uuid[])
+     ON CONFLICT DO NOTHING
+     RETURNING permission_id`, [applicationId, roleId, permissionIds]);
+    return result.rows.map((row) => row.permission_id);
 }
 /**
  * Remove multiple permissions from a role.
@@ -53,17 +54,92 @@ export async function assignPermissionsToRole(roleId, permissionIds) {
  * Silently succeeds if any of the permission IDs are not currently
  * assigned to the role.
  *
+ * @param applicationId - Authoritative parent application UUID
  * @param roleId - Role UUID
  * @param permissionIds - Array of permission UUIDs to remove
+ * @returns Permission IDs removed by this request
  */
-export async function removePermissionsFromRole(roleId, permissionIds) {
+export async function removePermissionsFromRole(applicationId, roleId, permissionIds) {
     if (permissionIds.length === 0)
-        return;
+        return [];
     const pool = getPool();
-    // Build parameterized IN list: $2, $3, $4, ...
-    const placeholders = permissionIds.map((_, i) => `$${i + 2}`).join(', ');
-    const params = [roleId, ...permissionIds];
-    await pool.query(`DELETE FROM role_permissions WHERE role_id = $1 AND permission_id IN (${placeholders})`, params);
+    const result = await pool.query(`DELETE FROM role_permissions mapping
+     USING roles role, permissions permission
+     WHERE mapping.role_id = role.id
+       AND mapping.permission_id = permission.id
+       AND role.application_id = $1
+       AND permission.application_id = $1
+       AND role.id = $2
+       AND permission.id = ANY($3::uuid[])
+     RETURNING mapping.permission_id`, [applicationId, roleId, permissionIds]);
+    return result.rows.map((row) => row.permission_id);
+}
+/**
+ * Lock a role and requested permissions before validating and changing mappings.
+ *
+ * Permissions are de-duplicated and sorted before PostgreSQL acquires row locks.
+ * This gives concurrent mapping requests one deterministic lock order. Callers
+ * compare the returned permission IDs with their requested IDs before mutating.
+ *
+ * @param applicationId - Authoritative parent application UUID
+ * @param roleId - Role UUID selected beneath the application
+ * @param permissionIds - Permission UUIDs in the mapping request
+ * @returns The owned role and owned requested permissions
+ */
+export async function lockRolePermissionTargets(applicationId, roleId, permissionIds) {
+    const pool = getPool();
+    const orderedPermissionIds = [...new Set(permissionIds)].sort();
+    const permissionResult = orderedPermissionIds.length === 0
+        ? { rows: [] }
+        : await pool.query(`SELECT * FROM permissions
+           WHERE application_id = $1 AND id = ANY($2::uuid[])
+           ORDER BY id
+           FOR UPDATE`, [applicationId, orderedPermissionIds]);
+    const roleResult = await pool.query(`SELECT * FROM roles
+     WHERE application_id = $1 AND id = $2
+     FOR UPDATE`, [applicationId, roleId]);
+    if (!roleResult.rows[0]) {
+        return { role: null, permissions: [], assignedPermissionIds: [] };
+    }
+    if (orderedPermissionIds.length === 0) {
+        return {
+            role: mapRowToRole(roleResult.rows[0]),
+            permissions: [],
+            assignedPermissionIds: [],
+        };
+    }
+    const mappingResult = await pool.query(`SELECT mapping.permission_id
+     FROM role_permissions mapping
+     JOIN roles role ON role.id = mapping.role_id
+     JOIN permissions permission ON permission.id = mapping.permission_id
+     WHERE role.application_id = $1
+       AND permission.application_id = $1
+       AND role.id = $2
+       AND mapping.permission_id = ANY($3::uuid[])
+     ORDER BY mapping.permission_id`, [applicationId, roleId, orderedPermissionIds]);
+    return {
+        role: mapRowToRole(roleResult.rows[0]),
+        permissions: permissionResult.rows.map(mapRowToPermission),
+        assignedPermissionIds: mappingResult.rows.map((row) => row.permission_id),
+    };
+}
+/**
+ * List users assigned to an application-owned role.
+ *
+ * Mapping mutations call this while holding the role row lock, so concurrent
+ * assignments cannot escape affected-user capture through the role foreign key.
+ *
+ * @param applicationId - Authoritative parent application UUID
+ * @param roleId - Role UUID selected beneath the application
+ * @returns Distinct user UUIDs in stable order
+ */
+export async function getUserIdsForRole(applicationId, roleId) {
+    const result = await getPool().query(`SELECT DISTINCT assignment.user_id
+     FROM user_roles assignment
+     JOIN roles role ON role.id = assignment.role_id
+     WHERE role.application_id = $1 AND role.id = $2
+     ORDER BY assignment.user_id`, [applicationId, roleId]);
+    return result.rows.map((row) => row.user_id);
 }
 /**
  * Get all permissions assigned to a role.
@@ -71,16 +147,20 @@ export async function removePermissionsFromRole(roleId, permissionIds) {
  * JOINs role_permissions with permissions table to return full
  * Permission objects, ordered by slug for consistent output.
  *
+ * @param applicationId - Authoritative parent application UUID
  * @param roleId - Role UUID
  * @returns Array of permissions assigned to the role
  */
-export async function getPermissionsForRole(roleId) {
+export async function getPermissionsForRole(applicationId, roleId) {
     const pool = getPool();
     const result = await pool.query(`SELECT p.*
      FROM role_permissions rp
+     JOIN roles r ON r.id = rp.role_id
      JOIN permissions p ON p.id = rp.permission_id
-     WHERE rp.role_id = $1
-     ORDER BY p.slug ASC`, [roleId]);
+     WHERE r.application_id = $1
+       AND p.application_id = $1
+       AND rp.role_id = $2
+     ORDER BY p.slug ASC`, [applicationId, roleId]);
     return result.rows.map(mapRowToPermission);
 }
 /**
@@ -89,16 +169,20 @@ export async function getPermissionsForRole(roleId) {
  * JOINs role_permissions with roles table to return full Role objects,
  * ordered by name for consistent output.
  *
+ * @param applicationId - Authoritative parent application UUID
  * @param permissionId - Permission UUID
  * @returns Array of roles that have this permission
  */
-export async function getRolesWithPermission(permissionId) {
+export async function getRolesWithPermission(applicationId, permissionId) {
     const pool = getPool();
     const result = await pool.query(`SELECT r.*
      FROM role_permissions rp
+     JOIN permissions p ON p.id = rp.permission_id
      JOIN roles r ON r.id = rp.role_id
-     WHERE rp.permission_id = $1
-     ORDER BY r.name ASC`, [permissionId]);
+     WHERE p.application_id = $1
+       AND r.application_id = $1
+       AND rp.permission_id = $2
+     ORDER BY r.name ASC`, [applicationId, permissionId]);
     return result.rows.map(mapRowToRole);
 }
 // ===========================================================================
@@ -111,25 +195,26 @@ export async function getRolesWithPermission(permissionId) {
  * already-assigned roles are silently skipped. Tracks who performed
  * the assignment via the optional assignedBy parameter.
  *
+ * @param organizationId - Authoritative organization UUID
  * @param userId - User UUID
  * @param roleIds - Array of role UUIDs to assign
  * @param assignedBy - Optional UUID of the admin who performed the assignment
+ * @returns Role IDs inserted by this call
  */
-export async function assignRolesToUser(userId, roleIds, assignedBy) {
+export async function assignRolesToUser(organizationId, userId, roleIds, assignedBy) {
     if (roleIds.length === 0)
-        return;
+        return [];
     const pool = getPool();
-    // Build parameterized VALUES list
-    // $1 = userId, $2 = assignedBy (or null), subsequent params = roleIds
-    const valuesList = [];
-    const params = [userId, assignedBy ?? null];
-    for (let i = 0; i < roleIds.length; i++) {
-        params.push(roleIds[i]);
-        valuesList.push(`($1, $${i + 3}, $2)`);
-    }
-    await pool.query(`INSERT INTO user_roles (user_id, role_id, assigned_by)
-     VALUES ${valuesList.join(', ')}
-     ON CONFLICT DO NOTHING`, params);
+    const result = await pool.query(`INSERT INTO user_roles (user_id, role_id, assigned_by)
+     SELECT target.id, role.id, $4
+     FROM users target
+     CROSS JOIN roles role
+     WHERE target.organization_id = $1
+       AND target.id = $2
+       AND role.id = ANY($3::uuid[])
+     ON CONFLICT DO NOTHING
+     RETURNING role_id`, [organizationId, userId, roleIds, assignedBy ?? null]);
+    return result.rows.map((row) => row.role_id);
 }
 /**
  * Remove multiple roles from a user.
@@ -137,17 +222,87 @@ export async function assignRolesToUser(userId, roleIds, assignedBy) {
  * Silently succeeds if any of the role IDs are not currently
  * assigned to the user.
  *
+ * @param organizationId - Authoritative organization UUID
  * @param userId - User UUID
  * @param roleIds - Array of role UUIDs to remove
+ * @returns Role IDs removed by this call
  */
-export async function removeRolesFromUser(userId, roleIds) {
+export async function removeRolesFromUser(organizationId, userId, roleIds) {
     if (roleIds.length === 0)
-        return;
+        return [];
     const pool = getPool();
-    // Build parameterized IN list: $2, $3, $4, ...
-    const placeholders = roleIds.map((_, i) => `$${i + 2}`).join(', ');
-    const params = [userId, ...roleIds];
-    await pool.query(`DELETE FROM user_roles WHERE user_id = $1 AND role_id IN (${placeholders})`, params);
+    const result = await pool.query(`DELETE FROM user_roles assignment
+     USING users target, roles role
+     WHERE assignment.user_id = target.id
+       AND assignment.role_id = role.id
+       AND target.organization_id = $1
+       AND target.id = $2
+       AND role.id = ANY($3::uuid[])
+     RETURNING assignment.role_id`, [organizationId, userId, roleIds]);
+    return result.rows.map((row) => row.role_id);
+}
+/**
+ * Lock one organization-owned user and requested roles before an assignment change.
+ *
+ * Role IDs are de-duplicated and sorted before locking. The returned collections
+ * let the service reject unknown targets atomically and distinguish removals from
+ * idempotent no-ops.
+ *
+ * @param organizationId - Authoritative organization UUID
+ * @param userId - User UUID beneath the organization
+ * @param roleIds - Role UUIDs in the assignment request
+ * @returns Locked target records and current direct assignments
+ */
+export async function lockUserRoleTargets(organizationId, userId, roleIds) {
+    const pool = getPool();
+    const userResult = await pool.query(`SELECT id, status FROM users
+     WHERE organization_id = $1 AND id = $2
+     FOR UPDATE`, [organizationId, userId]);
+    if (!userResult.rows[0])
+        return { user: null, roles: [], assignedRoleIds: [] };
+    const orderedRoleIds = [...new Set(roleIds)].sort();
+    if (orderedRoleIds.length === 0) {
+        return { user: userResult.rows[0], roles: [], assignedRoleIds: [] };
+    }
+    const roleResult = await pool.query(`SELECT * FROM roles
+     WHERE id = ANY($1::uuid[])
+     ORDER BY id
+     FOR UPDATE`, [orderedRoleIds]);
+    const assignmentResult = await pool.query(`SELECT assignment.role_id
+     FROM user_roles assignment
+     JOIN users target ON target.id = assignment.user_id
+     WHERE target.organization_id = $1
+       AND target.id = $2
+       AND assignment.role_id = ANY($3::uuid[])
+     ORDER BY assignment.role_id`, [organizationId, userId, orderedRoleIds]);
+    return {
+        user: userResult.rows[0],
+        roles: roleResult.rows.map(mapRowToRole),
+        assignedRoleIds: assignmentResult.rows.map((row) => row.role_id),
+    };
+}
+/** List roles for a user only when the user belongs to the route organization. */
+export async function getRolesForOrganizationUser(organizationId, userId) {
+    const result = await getPool().query(`SELECT role.*
+     FROM users target
+     JOIN user_roles assignment ON assignment.user_id = target.id
+     JOIN roles role ON role.id = assignment.role_id
+     WHERE target.organization_id = $1 AND target.id = $2
+     ORDER BY role.name ASC`, [organizationId, userId]);
+    return result.rows.map(mapRowToRole);
+}
+/** List same-application permissions for an organization-owned user. */
+export async function getPermissionsForOrganizationUser(organizationId, userId) {
+    const result = await getPool().query(`SELECT DISTINCT permission.*
+     FROM users target
+     JOIN user_roles assignment ON assignment.user_id = target.id
+     JOIN roles role ON role.id = assignment.role_id
+     JOIN role_permissions mapping ON mapping.role_id = role.id
+     JOIN permissions permission ON permission.id = mapping.permission_id
+       AND permission.application_id = role.application_id
+     WHERE target.organization_id = $1 AND target.id = $2
+     ORDER BY permission.slug ASC`, [organizationId, userId]);
+    return result.rows.map(mapRowToPermission);
 }
 /**
  * Get all roles assigned to a user.
@@ -156,15 +311,18 @@ export async function removeRolesFromUser(userId, roleIds) {
  * ordered by name for consistent output.
  *
  * @param userId - User UUID
+ * @param applicationId - Optional application UUID used to scope token authority
  * @returns Array of roles assigned to the user
  */
-export async function getRolesForUser(userId) {
+export async function getRolesForUser(userId, applicationId) {
     const pool = getPool();
+    const applicationFilter = applicationId ? ' AND r.application_id = $2' : '';
+    const params = applicationId ? [userId, applicationId] : [userId];
     const result = await pool.query(`SELECT r.*
      FROM user_roles ur
      JOIN roles r ON r.id = ur.role_id
-     WHERE ur.user_id = $1
-     ORDER BY r.name ASC`, [userId]);
+     WHERE ur.user_id = $1${applicationFilter}
+     ORDER BY r.name ASC`, params);
     return result.rows.map(mapRowToRole);
 }
 /**
@@ -176,16 +334,22 @@ export async function getRolesForUser(userId) {
  * may have the same permission through multiple roles.
  *
  * @param userId - User UUID
+ * @param applicationId - Optional application UUID used to scope token authority
  * @returns Deduplicated array of permissions the user has through their roles
  */
-export async function getPermissionsForUser(userId) {
+export async function getPermissionsForUser(userId, applicationId) {
     const pool = getPool();
+    const applicationFilter = applicationId
+        ? ' AND r.application_id = $2 AND p.application_id = $2'
+        : '';
+    const params = applicationId ? [userId, applicationId] : [userId];
     const result = await pool.query(`SELECT DISTINCT p.*
      FROM user_roles ur
+     JOIN roles r ON r.id = ur.role_id
      JOIN role_permissions rp ON rp.role_id = ur.role_id
-     JOIN permissions p ON p.id = rp.permission_id
-     WHERE ur.user_id = $1
-     ORDER BY p.slug ASC`, [userId]);
+     JOIN permissions p ON p.id = rp.permission_id AND p.application_id = r.application_id
+     WHERE ur.user_id = $1${applicationFilter}
+     ORDER BY p.slug ASC`, params);
     return result.rows.map(mapRowToPermission);
 }
 /**
@@ -194,28 +358,31 @@ export async function getPermissionsForUser(userId) {
  * Supports pagination for admin UI views showing which users have a
  * particular role. JOINs with users table to filter by organization.
  *
+ * @param applicationId - Authoritative parent application UUID
  * @param roleId - Role UUID
  * @param orgId - Organization UUID (to scope users)
  * @param page - Page number (1-based)
  * @param pageSize - Number of results per page
  * @returns Paginated user-role assignments and total count
  */
-export async function getUsersWithRole(roleId, orgId, page, pageSize) {
+export async function getUsersWithRole(applicationId, roleId, orgId, page, pageSize) {
     const pool = getPool();
     const offset = (page - 1) * pageSize;
     // Count total matching assignments
     const countResult = await pool.query(`SELECT COUNT(*)::int as count
      FROM user_roles ur
      JOIN users u ON u.id = ur.user_id
-     WHERE ur.role_id = $1 AND u.organization_id = $2`, [roleId, orgId]);
+     JOIN roles r ON r.id = ur.role_id
+     WHERE r.application_id = $1 AND ur.role_id = $2 AND u.organization_id = $3`, [applicationId, roleId, orgId]);
     const total = parseInt(countResult.rows[0].count, 10);
     // Fetch paginated data
     const dataResult = await pool.query(`SELECT ur.*
      FROM user_roles ur
      JOIN users u ON u.id = ur.user_id
-     WHERE ur.role_id = $1 AND u.organization_id = $2
+     JOIN roles r ON r.id = ur.role_id
+     WHERE r.application_id = $1 AND ur.role_id = $2 AND u.organization_id = $3
      ORDER BY ur.created_at DESC
-     LIMIT $3 OFFSET $4`, [roleId, orgId, pageSize, offset]);
+     LIMIT $4 OFFSET $5`, [applicationId, roleId, orgId, pageSize, offset]);
     return {
         rows: dataResult.rows.map(mapRowToUserRole),
         total,

package/dist/rbac/mapping-repository.js.map

@@ -1 +1 @@
-{"version":3,"file":"mapping-repository.js","sourceRoot":"","sources":["../../src/rbac/mapping-repository.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE7C,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEhF,8EAA8E;AAC9E,0BAA0B;AAC1B,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAAc,EACd,aAAuB;IAEvB,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEvC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,qEAAqE;IACrE,gEAAgE;IAChE,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,MAAM,GAAc,CAAC,MAAM,CAAC,CAAC;IAEnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9B,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,IAAI,CAAC,KAAK,CACd;cACU,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;4BACP,EACxB,MAAM,CACP,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,MAAc,EACd,aAAuB;IAEvB,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEvC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,+CAA+C;IAC/C,MAAM,YAAY,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzE,MAAM,MAAM,GAAc,CAAC,MAAM,EAAE,GAAG,aAAa,CAAC,CAAC;IAErD,MAAM,IAAI,CAAC,KAAK,CACd,yEAAyE,YAAY,GAAG,EACxF,MAAM,CACP,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,MAAc;IACxD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;;;yBAIqB,EACrB,CAAC,MAAM,CAAC,CACT,CAAC;IAEF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,YAAoB;IAC/D,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;;;yBAIqB,EACrB,CAAC,YAAY,CAAC,CACf,CAAC;IAEF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;AACvC,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAc,EACd,OAAiB,EACjB,UAAmB;IAEnB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEjC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,kCAAkC;IAClC,sEAAsE;IACtE,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,MAAM,GAAc,CAAC,MAAM,EAAE,UAAU,IAAI,IAAI,CAAC,CAAC;IAEvD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACxB,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,IAAI,CAAC,KAAK,CACd;cACU,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;4BACP,EACxB,MAAM,CACP,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAc,EACd,OAAiB;IAEjB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEjC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,+CAA+C;IAC/C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnE,MAAM,MAAM,GAAc,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC;IAE/C,MAAM,IAAI,CAAC,KAAK,CACd,6DAA6D,YAAY,GAAG,EAC5E,MAAM,CACP,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAc;IAClD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;;;yBAIqB,EACrB,CAAC,MAAM,CAAC,CACT,CAAC;IAEF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,MAAc;IACxD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;;;;yBAKqB,EACrB,CAAC,MAAM,CAAC,CACT,CAAC;IAEF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAc,EACd,KAAa,EACb,IAAY,EACZ,QAAgB;IAEhB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC;IAErC,mCAAmC;IACnC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAClC;;;sDAGkD,EAClD,CAAC,MAAM,EAAE,KAAK,CAAC,CAChB,CAAC;IACF,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAEtD,uBAAuB;IACvB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,KAAK,CACjC;;;;;wBAKoB,EACpB,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAClC,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAC3C,KAAK;KACN,CAAC;AACJ,CAAC"}
+{"version":3,"file":"mapping-repository.js","sourceRoot":"","sources":["../../src/rbac/mapping-repository.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE7C,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEhF,8EAA8E;AAC9E,0BAA0B;AAC1B,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,aAAqB,EACrB,MAAc,EACd,aAAuB;IAEvB,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAE1C,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;;;;;;;6BAQyB,EACzB,CAAC,aAAa,EAAE,MAAM,EAAE,aAAa,CAAC,CACvC,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,aAAqB,EACrB,MAAc,EACd,aAAuB;IAEvB,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAE1C,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;;;;;;;qCAQiC,EACjC,CAAC,aAAa,EAAE,MAAM,EAAE,aAAa,CAAC,CACvC,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;AACrD,CAAC;AAYD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,aAAqB,EACrB,MAAc,EACd,aAAgC;IAEhC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,oBAAoB,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAChE,MAAM,gBAAgB,GACpB,oBAAoB,CAAC,MAAM,KAAK,CAAC;QAC/B,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE;QACd,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CACd;;;sBAGY,EACZ,CAAC,aAAa,EAAE,oBAAoB,CAAC,CACtC,CAAC;IACR,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,KAAK,CACjC;;gBAEY,EACZ,CAAC,aAAa,EAAE,MAAM,CAAC,CACxB,CAAC;IACF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,qBAAqB,EAAE,EAAE,EAAE,CAAC;IACpE,CAAC;IACD,IAAI,oBAAoB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO;YACL,IAAI,EAAE,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACtC,WAAW,EAAE,EAAE;YACf,qBAAqB,EAAE,EAAE;SAC1B,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,KAAK,CACpC;;;;;;;;oCAQgC,EAChC,CAAC,aAAa,EAAE,MAAM,EAAE,oBAAoB,CAAC,CAC9C,CAAC;IACF,OAAO;QACL,IAAI,EAAE,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtC,WAAW,EAAE,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAC1D,qBAAqB,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC;KAC1E,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,aAAqB,EAAE,MAAc;IAC3E,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC,KAAK,CAClC;;;;iCAI6B,EAC7B,CAAC,aAAa,EAAE,MAAM,CAAC,CACxB,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,aAAqB,EACrB,MAAc;IAEd,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;;;;;;yBAOqB,EACrB,CAAC,aAAa,EAAE,MAAM,CAAC,CACxB,CAAC;IAEF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,aAAqB,EACrB,YAAoB;IAEpB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;;;;;;yBAOqB,EACrB,CAAC,aAAa,EAAE,YAAY,CAAC,CAC9B,CAAC;IAEF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;AACvC,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,cAAsB,EACtB,MAAc,EACd,OAAiB,EACjB,UAAmB;IAEnB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEpC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;;;;;;;uBAQmB,EACnB,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,IAAI,IAAI,CAAC,CACtD,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,cAAsB,EACtB,MAAc,EACd,OAAiB;IAEjB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEpC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;;;;;;kCAO8B,EAC9B,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,CAAC,CAClC,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAC/C,CAAC;AAYD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,cAAsB,EACtB,MAAc,EACd,OAA0B;IAE1B,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,KAAK,CACjC;;gBAEY,EACZ,CAAC,cAAc,EAAE,MAAM,CAAC,CACzB,CAAC;IACF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;IAE/E,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;IACtE,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,KAAK,CACjC;;;gBAGY,EACZ,CAAC,cAAc,CAAC,CACjB,CAAC;IACF,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,KAAK,CACvC;;;;;;iCAM6B,EAC7B,CAAC,cAAc,EAAE,MAAM,EAAE,cAAc,CAAC,CACzC,CAAC;IACF,OAAO;QACL,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QACxB,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;QACxC,eAAe,EAAE,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC;KACjE,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,cAAsB,EACtB,MAAc;IAEd,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC,KAAK,CAClC;;;;;4BAKwB,EACxB,CAAC,cAAc,EAAE,MAAM,CAAC,CACzB,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;AACvC,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,cAAsB,EACtB,MAAc;IAEd,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC,KAAK,CAClC;;;;;;;;kCAQ8B,EAC9B,CAAC,cAAc,EAAE,MAAM,CAAC,CACzB,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAc,EAAE,aAAsB;IAC1E,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,iBAAiB,GAAG,aAAa,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAElE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;;4BAGwB,iBAAiB;yBACpB,EACrB,MAAM,CACP,CAAC;IAEF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAc,EACd,aAAsB;IAEtB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,iBAAiB,GAAG,aAAa;QACrC,CAAC,CAAC,sDAAsD;QACxD,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAElE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;;;;4BAKwB,iBAAiB;yBACpB,EACrB,MAAM,CACP,CAAC;IAEF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,aAAqB,EACrB,MAAc,EACd,KAAa,EACb,IAAY,EACZ,QAAgB;IAEhB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC;IAErC,mCAAmC;IACnC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAClC;;;;gFAI4E,EAC5E,CAAC,aAAa,EAAE,MAAM,EAAE,KAAK,CAAC,CAC/B,CAAC;IACF,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAEtD,uBAAuB;IACvB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,KAAK,CACjC;;;;;;wBAMoB,EACpB,CAAC,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CACjD,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAC3C,KAAK;KACN,CAAC;AACJ,CAAC"}