@preventive/triage 1.0.0-alpha.5 → 1.0.0-alpha.50

package/server-managed/team-app.ts

@@ -0,0 +1,134 @@
+// Whether each team's sidebar entry opens collapsed to its App findings,
+// decided before the catalog is sent so the first paint is already final. A
+// team is classified from the same filtered, published workspace its view
+// loads. Results are keyed by the catalog's own content keys: an unchanged
+// catalog reuses them, and every change that can move a result also changes
+// the catalog revision that clients refresh on.
+//
+// The same read names the reports a restricted reader would find nothing in:
+// under -deps or -security the catalog leaves those out of the team's list.
+// Readers with both permissions keep every report, empty or not.
+//
+// A team that is not App also says how many of its reports open in App mode
+// on their own, and its findings for the badge it collapses to. None is as
+// uniform as an App team, and collapses like one. A team mixing App and non-App
+// reports stays expanded, and so does one whose reports each open as App but
+// whose combined workspace does not (contradicting verdicts, say): it has App
+// findings, and only expanded does it show that they fail to combine.
+import { reportEntries } from '@preventive/report'
+import { type TeamAppMetadata, managedTeamAppMetadata } from '../common/managed/team-app.js'
+import type { BlobStore } from './blob-store.ts'
+import type { ManagedDb, TeamReportAccessSnapshot, UserTeam } from './db.ts'
+import type { WorkspaceShareSnapshot } from './workspace-shares.ts'
+import { TeamReportsError, loadTeamReportsResponse } from './team-reports.ts'
+
+export type { TeamAppMetadata }
+export interface TeamWorkspaceSummary { app: TeamAppMetadata; empty: readonly string[] }
+const NO_APP: TeamWorkspaceSummary = { app: { appMode: false }, empty: [] }
+
+const CACHE_MAX_ENTRIES = 4096
+// Each workspace build already reads four reports at a time.
+const CLASSIFY_CONCURRENCY = 2
+const caches = new WeakMap<ManagedDb, Map<string, TeamWorkspaceSummary>>()
+const pendingJobs = new WeakMap<ManagedDb, Map<string, Promise<TeamWorkspaceSummary | null>>>()
+
+// Published reports with their content keys, and the team's own key (access,
+// scopes and links). Equal keys describe the same filtered workspace, whoever
+// reads it, so accounts with the same access share one classification.
+export function teamAppKey(team: UserTeam): string {
+  return JSON.stringify([team.cacheKey ?? null, published(team).map(report => [report.id, report.cacheKey]).toSorted()])
+}
+
+function published(team: UserTeam) {
+  return team.reports.filter(report => report.visible !== false)
+}
+
+function remember(db: ManagedDb, key: string, summary: TeamWorkspaceSummary): TeamWorkspaceSummary {
+  let cache = caches.get(db)
+  if (!cache) { cache = new Map(); caches.set(db, cache) }
+  cache.delete(key)
+  cache.set(key, summary)
+  for (const oldest of cache.keys()) {
+    if (cache.size <= CACHE_MAX_ENTRIES) break
+    cache.delete(oldest)
+  }
+  return summary
+}
+
+function isLinks(data: unknown): boolean {
+  const record = data as { source?: unknown; links?: unknown } | null
+  return record?.source === 'links' && Array.isArray(record.links)
+}
+
+// A links document counts by its links, every other report by its findings.
+function hasContent(data: unknown): boolean {
+  if (isLinks(data)) return (data as { links: unknown[] }).links.length > 0
+  return (reportEntries(data) ?? []).some(entry => !Array.isArray(entry) || entry.length > 0)
+}
+
+// Null when the team cannot be classified right now: its catalog went stale,
+// the access snapshot is gone, or storage failed. The sidebar then keeps the
+// team expanded and lists every report, and a later catalog asks again.
+// Oversized and unreadable workspaces never have an App view, so they are
+// remembered as such, hiding nothing.
+async function classify(db: ManagedDb, store: BlobStore, key: string, team: UserTeam,
+  snapshot: () => Promise<TeamReportAccessSnapshot | null>): Promise<TeamWorkspaceSummary | null> {
+  const cached = caches.get(db)?.get(key)
+  if (cached) return remember(db, key, cached)
+  const ids = new Set(published(team).map(report => report.id))
+  if (ids.size === 0) return remember(db, key, NO_APP)
+  let jobs = pendingJobs.get(db)
+  if (!jobs) { jobs = new Map(); pendingJobs.set(db, jobs) }
+  const existing = jobs.get(key)
+  if (existing) return existing
+  const job = (async () => {
+    const access = await snapshot()
+    // A catalog read before a concurrent publication names another report set.
+    if (!access?.teamId || access.reports.length !== ids.size || access.reports.some(report => !ids.has(report.id))) return null
+    const body = JSON.parse((await loadTeamReportsResponse(db, store, access)).toString('utf8')) as {
+      reports: { id: string; filename: string; data: unknown }[]; links?: string[][]
+    }
+    const restricted = access.reports.some(report => !report.permissions.dependencies || !report.permissions.security)
+    const empty = restricted ? body.reports.filter(report => !hasContent(report.data)).map(report => report.id) : []
+    const links = body.links ?? []
+    const app = managedTeamAppMetadata(Object.assign(body.reports, { links }), { countFindings: true })
+    if (app.appMode) return remember(db, key, { app, empty })
+    const appReports = body.reports.filter(report => !isLinks(report.data)
+      && managedTeamAppMetadata(Object.assign([report], { links })).appMode).length
+    return remember(db, key, { app: { ...app, appReports }, empty })
+  })().catch((error: unknown) => {
+    if (error instanceof TeamReportsError && [413, 422].includes(error.status)) return remember(db, key, NO_APP)
+    if (!(error instanceof TeamReportsError)) console.warn('managed: team App classification failed:', error)
+    return null
+  })
+  jobs.set(key, job)
+  try { return await job } finally { jobs.delete(key) }
+}
+
+// The catalog's view of a classified team: its App classification, and its
+// reports without the ones its restricted reader would find empty.
+export function withWorkspaceSummary<T extends { reports: readonly { id: string }[] }>(team: T, summary: TeamWorkspaceSummary | null | undefined) {
+  const empty = new Set(summary?.empty)
+  return { ...team, app: summary?.app ?? null, reports: team.reports.filter(report => !empty.has(report.id)) }
+}
+
+// Classify a user's catalog, keyed by teamAppKey. `known` carries results from
+// an earlier read of the same request, so only changed teams are classified.
+export async function teamAppStates(db: ManagedDb, store: BlobStore, sessionId: string, teams: readonly UserTeam[],
+  known: ReadonlyMap<string, TeamWorkspaceSummary | null> = new Map()): Promise<Map<string, TeamWorkspaceSummary | null>> {
+  const states = new Map(known)
+  const missing = [...new Map(teams.map(team => [teamAppKey(team), team])).entries()].filter(([key]) => !states.has(key))
+  let next = 0
+  await Promise.all(Array.from({ length: Math.min(CLASSIFY_CONCURRENCY, missing.length) }, async () => {
+    while (next < missing.length) {
+      const [key, team] = missing[next++]!
+      states.set(key, await classify(db, store, key, team, () => db.getTeamReportAccessSnapshot(sessionId, Date.now(), team.id)))
+    }
+  }))
+  return states
+}
+
+// A public link's workspace is its own access snapshot.
+export function sharedTeamApp(db: ManagedDb, store: BlobStore, snapshot: WorkspaceShareSnapshot): Promise<TeamWorkspaceSummary | null> {
+  return classify(db, store, JSON.stringify(['share', teamAppKey(snapshot.team)]), snapshot.team, () => Promise.resolve(snapshot))
+}

package/server-managed/team-catalog.ts

@@ -0,0 +1,7 @@
+import { createHash } from 'node:crypto'
+
+// Version only this user's visible catalog, including access and content keys.
+// REST and the live feed must describe exactly the same snapshot.
+export function teamCatalogRevision(teams: readonly unknown[]): string {
+  return createHash('sha256').update(JSON.stringify(teams)).digest('base64url')
+}

package/server-managed/team-feed.ts

@@ -0,0 +1,180 @@
+import type { ServerResponse } from 'node:http'
+import { setTimeout as delay } from 'node:timers/promises'
+import type { ManagedHttpDeps } from './http.ts'
+import type { StoredUser, TeamReportAccessSnapshot } from './db.ts'
+import { TeamReportsError, annotationRevisionDigest, teamAnnotationRevision, teamSnapshotKey, teamWorkspaceFindingIds } from './team-reports.ts'
+import type { WorkspaceShareFeedState } from './workspace-shares.ts'
+
+// Short database reads work across instances without pinning a Neon connection.
+// All polling belongs to the awaited request; nothing runs after it completes.
+const TEAM_FEED_POLL_MS = 3_000
+export const TEAM_FEED_LIFETIME_MS = 240_000 // below the configured Vercel 300s
+const HEARTBEAT_MS = 15_000
+
+type FeedOptions = { pollMs?: number; lifetimeMs?: number }
+type Publish = (event: 'teams' | 'triage', revision: string | undefined) => boolean
+
+// Public capabilities remain scoped to their single shared workspace.
+export async function serveTeamFeed(res: ServerResponse, deps: ManagedHttpDeps,
+  snapshot: TeamReportAccessSnapshot, recheck: () => Promise<void>,
+  options: FeedOptions & { readState?: () => Promise<WorkspaceShareFeedState | null> } = {}): Promise<void> {
+  let ids: string[] | undefined
+  let previous: WorkspaceShareFeedState | undefined
+  const sameAccess = (a: WorkspaceShareFeedState, b?: WorkspaceShareFeedState) => a.grant === b?.grant && a.catalog === b.catalog
+  const readState = async () => {
+    const state = await options.readState!()
+    if (!state) throw new TeamReportsError(404, 'workspace-changed')
+    return state
+  }
+  await serveFeed(res, deps, async publish => {
+    const state = options.readState ? await readState() : undefined
+    // The first poll still compares the full snapshot loaded before the stream.
+    // Unchanged polls validate the live grant without reading report catalogs.
+    if (state && sameAccess(state, previous)) {
+      if (state.annotations === previous!.annotations) return
+    } else await recheck()
+    ids ??= [...await teamWorkspaceFindingIds(deps.db, deps.reportStore, snapshot)]
+    const triage = await deps.db.getAnnotationRevision(ids)
+    const after = options.readState ? await readState() : undefined
+    if (!after || !sameAccess(after, state)) await recheck()
+    publish('triage', triage)
+    // A write during the read must remain pending for the following poll.
+    if (after?.annotations === state?.annotations) previous = after
+  }, options)
+}
+
+// Membership and content notifications cover all of the user's teams. Only
+// the focused team needs report parsing or annotation reads; null is the
+// catalog-only subscription used on landing and management pages.
+export async function serveUserTeamFeed(res: ServerResponse, deps: ManagedHttpDeps,
+  sessionId: string, user: StoredUser, teamId: string | null, options: FeedOptions & { reportId?: string | null } = {}): Promise<void> {
+  let ids: string[] = [], visibilityKey: string | undefined
+  let focused: TeamReportAccessSnapshot | undefined
+  let previousState: { catalog: number; annotations: number } | undefined
+  const checkUser = (current: { user: Pick<StoredUser, 'id' | 'role'> } | null) => {
+    if (!current) throw new TeamReportsError(401, 'unauthenticated')
+    if (current.user.id !== user.id || current.user.role !== user.role || current.user.role === 'none') {
+      throw new TeamReportsError(403, 'access-changed')
+    }
+  }
+  await serveFeed(res, deps, async publish => {
+    const state = await deps.db.getFeedState(sessionId, Date.now())
+    checkUser(state)
+    if (state!.catalog === previousState?.catalog && (!teamId || state!.annotations === previousState?.annotations)) return
+    if (teamId && focused !== undefined && state!.catalog === previousState?.catalog) {
+      // Annotation changes cannot change visibility. Read only this workspace's
+      // IDs, then fence against concurrent access/content changes before sending.
+      const triage = await teamAnnotationRevision(deps.db, focused, ids)
+      const after = await deps.db.getFeedState(sessionId, Date.now())
+      checkUser(after)
+      if (after!.catalog !== state!.catalog) return
+      publish('triage', triage)
+      if (after!.annotations === state!.annotations) previousState = state!
+      return
+    }
+    const catalog = await deps.db.getUserTeamFeedSnapshot(sessionId, Date.now())
+    checkUser(catalog)
+    // The session read again after the catalog, as the catalog is published
+    // next: one statement, as the poll's own check is.
+    checkUser(await deps.db.getFeedState(sessionId, Date.now()))
+    // Publish catalog state before loading any report blobs. A slow or broken
+    // focused report must not hide membership/content changes from the client.
+    if (!publish('teams', catalog!.revision)) return
+    if (!teamId) {
+      // A mutation during the snapshot must cause a fresh read next poll.
+      const current = await deps.db.getFeedState(sessionId, Date.now())
+      checkUser(current)
+      if (current!.catalog === state!.catalog) previousState = state!
+      return
+    }
+    let triage: string | undefined
+    const snapshot = await deps.db.getTeamReportAccessSnapshot(sessionId, Date.now(), teamId, options.reportId)
+    if (!snapshot) throw new TeamReportsError(401, 'unauthenticated')
+    checkUser(snapshot)
+    const key = teamSnapshotKey(snapshot)
+    if (key !== visibilityKey) {
+      try {
+        ids = snapshot.teamId ? [...await teamWorkspaceFindingIds(deps.db, deps.reportStore, snapshot)] : []
+        visibilityKey = key
+      } catch {
+        // Missing, malformed or temporarily unavailable blobs only suspend
+        // triage. Retry visibility on the next poll, even for the same key.
+        publish('triage', undefined)
+        return
+      }
+    }
+    // As GET /api/teams/:id/annotations answers it, so that a client holding
+    // that answer knows this tells nothing new.
+    if (snapshot.teamId) triage = await teamAnnotationRevision(deps.db, snapshot, ids)
+    const current = await deps.db.getTeamReportAccessSnapshot(sessionId, Date.now(), teamId, options.reportId)
+    // A concurrent access/content change discards only the annotation read.
+    checkUser(current)
+    if (!current || teamSnapshotKey(current) !== key) return
+    publish('triage', triage)
+    focused = snapshot.teamId ? snapshot : undefined
+    const after = await deps.db.getFeedState(sessionId, Date.now())
+    checkUser(after)
+    if (after!.catalog === state!.catalog && after!.annotations === state!.annotations) previousState = state!
+  }, { ...options, triageRevision: true })
+}
+
+// With `triageRevision`, a triage event tells its revision's digest, as the
+// focused team's annotations answer it; else none, as a public share's.
+async function serveFeed(res: ServerResponse, deps: ManagedHttpDeps, read: (publish: Publish) => Promise<void>,
+  { pollMs = TEAM_FEED_POLL_MS, lifetimeMs = TEAM_FEED_LIFETIME_MS, triageRevision = false }: FeedOptions & { triageRevision?: boolean }): Promise<void> {
+  const controller = new AbortController()
+  const close = () => controller.abort()
+  res.once('close', close)
+  const deadline = setTimeout(close, lifetimeMs)
+  const stopped = () => controller.signal.aborted || res.destroyed || deps.isShuttingDown()
+  // Notifications carry no annotation bodies, finding IDs, or global cursors.
+  // The catalog's opaque version, and a focused team's annotation revision's
+  // digest, let clients reuse an identical REST snapshot; every connection
+  // still confirms current access, including after reconnects.
+  function write(frame: string): boolean {
+    if (stopped()) return false
+    if (res.write(frame)) return true
+    // Slow consumers reconnect and read current state; never queue a backlog.
+    res.destroy()
+    return false
+  }
+  try {
+    if (stopped()) return
+    res.writeHead(200, { 'content-type': 'text/event-stream; charset=utf-8',
+      'cache-control': 'private, no-store, no-transform', 'x-accel-buffering': 'no',
+      'x-content-type-options': 'nosniff', 'referrer-policy': 'no-referrer' })
+    res.flushHeaders()
+    let heartbeat = Date.now()
+    const previous = new Map<string, string>()
+    const publish: Publish = (event, revision) => {
+      if (stopped()) return false
+      if (revision === undefined) { previous.delete(event); return true }
+      if (revision === previous.get(event)) return true
+      const data = event === 'teams' ? JSON.stringify({ revision }) : triageRevision ? JSON.stringify({ revision: annotationRevisionDigest(revision) }) : '{}'
+      if (!write(`event: ${event}\ndata: ${data}\n\n`)) return false
+      previous.set(event, revision)
+      heartbeat = Date.now()
+      return true
+    }
+    while (!stopped()) {
+      if (deps.db.withRequest) await deps.db.withRequest(() => read(publish))
+      else await read(publish)
+      if (stopped()) break
+      if (Date.now() - heartbeat >= HEARTBEAT_MS) {
+        if (!write(': keepalive\n\n')) break
+        heartbeat = Date.now()
+      }
+      await delay(pollMs, undefined, { signal: controller.signal }).catch(error => {
+        if (!controller.signal.aborted) throw error
+      })
+    }
+  } catch (error) {
+    if (!res.headersSent) throw error
+    if (error instanceof TeamReportsError) write('event: close\ndata: {}\n\n')
+    else if (!stopped()) throw error
+  } finally {
+    clearTimeout(deadline)
+    res.off('close', close)
+    if (res.headersSent && !res.destroyed) res.end()
+  }
+}

package/server-managed/team-npm-scopes.ts

@@ -0,0 +1,106 @@
+// npm scopes a team lists: its members, whatever their role, may read that
+// scope's private packages in the npm viewer (npm-packages.ts), as admins and
+// managers may read any. Hidden teams grant nothing, as for their content.
+import { MAX_TEAM_NPM_SCOPES, normalizeNpmScope } from '../common/managed/npm-packages.js'
+import type { Role } from '../common/managed/roles.ts'
+import { gathered, reviewsIn } from './dependency-reviews.ts'
+import { ManagedMutationError } from './management.ts'
+import type { ManagedSql } from './sql.ts'
+
+export const TEAM_NPM_SCOPE_SCHEMA = `
+CREATE TABLE IF NOT EXISTS managed_team_npm_scope (
+  team_id TEXT NOT NULL REFERENCES managed_team(id) ON DELETE CASCADE,
+  scope   TEXT NOT NULL,
+  PRIMARY KEY (team_id, scope)
+) STRICT;
+`
+
+export interface TeamNpmScopeStore {
+  // Every team's scopes, sorted, keyed by team id; teams without any are absent.
+  listTeamNpmScopes(): Promise<Record<string, string[]>>
+  // Replaces a team's scopes; admin only. Answers what changed, or null for no team.
+  setTeamNpmScopes(sessionId: string, teamId: string, scopes: unknown): Promise<{ added: string[]; removed: string[] } | null>
+  // The scopes a user's visible teams list.
+  listUserNpmScopes(userId: string): Promise<string[]>
+  // Whether any visible team lists the scope: whoever reads its packages,
+  // they are the instance's own, whose new releases aren't flagged (http.ts).
+  hasTeamNpmScope(scope: string): Promise<boolean>
+  // Who session `sessionId` names now, as readSession reads it, their own
+  // or, where `viewerSessionId` names an admin's own one, a view of it: their
+  // role, the scopes their teams list (listUserNpmScopes), and whether they
+  // read the dependency reviews published to team `teamId`
+  // (dependency-reviews.ts reviewsIn); in one statement, as a list of a
+  // team's reviews asks again once npm is read. Null where it names none.
+  getNpmReviewReader(sessionId: string, viewerSessionId: string | null, now: number, teamId: string): Promise<NpmReviewReader | null>
+}
+export interface NpmReviewReader { id: string; role: Role; scopes: string[]; readsTeam: boolean }
+
+// Each distinct scope, normalized; a list with one npm could not publish
+// under, or too many, is refused whole.
+export function parseTeamNpmScopes(input: unknown): string[] {
+  if (!Array.isArray(input)) throw new ManagedMutationError(400, 'bad-scopes')
+  const scopes = new Set<string>()
+  for (const value of input) {
+    const scope = normalizeNpmScope(value)
+    if (scope === null) throw new ManagedMutationError(400, 'bad-scope')
+    scopes.add(scope)
+  }
+  if (scopes.size > MAX_TEAM_NPM_SCOPES) throw new ManagedMutationError(400, 'too-many-scopes')
+  return [...scopes].toSorted()
+}
+
+export function teamNpmScopeMethods(db: ManagedSql): TeamNpmScopeStore {
+  return {
+    async listTeamNpmScopes() {
+      const rows = await db.prepare('SELECT team_id AS teamId, scope FROM managed_team_npm_scope ORDER BY team_id, scope').all() as { teamId: string; scope: string }[]
+      const result: Record<string, string[]> = {}
+      for (const { teamId, scope } of rows) (result[teamId] ??= []).push(scope)
+      return result
+    },
+    async setTeamNpmScopes(sessionId, teamId, input) {
+      const user = await db.prepare(`SELECT u.role FROM managed_session s JOIN managed_user u ON u.id = s.user_id
+        WHERE s.id = ? AND s.expires_at > ?`).get(sessionId, Date.now()) as { role: string } | undefined
+      if (!user) throw new ManagedMutationError(401, 'unauthenticated')
+      if (user.role !== 'admin') throw new ManagedMutationError(403, 'forbidden')
+      const scopes = parseTeamNpmScopes(input)
+      if (!await db.prepare('SELECT id FROM managed_team WHERE id = ?').get(teamId)) return null
+      const current = (await db.prepare('SELECT scope FROM managed_team_npm_scope WHERE team_id = ?').all(teamId) as { scope: string }[]).map(row => row.scope)
+      const removed = current.filter(scope => !scopes.includes(scope)).toSorted()
+      const added = scopes.filter(scope => !current.includes(scope))
+      for (const scope of removed) await db.prepare('DELETE FROM managed_team_npm_scope WHERE team_id = ? AND scope = ?').run(teamId, scope)
+      for (const scope of added) await db.prepare('INSERT INTO managed_team_npm_scope (team_id, scope) VALUES (?, ?)').run(teamId, scope)
+      return { added, removed }
+    },
+    async listUserNpmScopes(userId) {
+      const rows = await db.prepare(`SELECT DISTINCT ns.scope FROM managed_team_user tu
+        JOIN managed_team t ON t.id = tu.team_id AND t.hidden = 0
+        JOIN managed_team_npm_scope ns ON ns.team_id = tu.team_id
+        WHERE tu.user_id = ? ORDER BY ns.scope`).all(userId) as { scope: string }[]
+      return rows.map(row => row.scope)
+    },
+    getNpmReviewReader: (sessionId, viewerSessionId, now, teamId) => npmReviewReader(db, sessionId, viewerSessionId, now, teamId),
+    async hasTeamNpmScope(scope) {
+      return !!await db.prepare(`SELECT 1 AS listed FROM managed_team_npm_scope ns
+        JOIN managed_team t ON t.id = ns.team_id AND t.hidden = 0
+        WHERE ns.scope = ? LIMIT 1`).get(scope)
+    },
+  }
+}
+
+// getNpmReviewReader's statement, its session held to what readSession's
+// own are (db-methods.ts selectOwnSessionStmt, selectViewSessionStmt).
+async function npmReviewReader(db: ManagedSql, sessionId: string, viewerSessionId: string | null, now: number, teamId: string): Promise<NpmReviewReader | null> {
+  const row = await db.prepare(`WITH reader AS (
+      SELECT u.id AS id, u.role AS role FROM managed_session s JOIN managed_user u ON u.id = s.user_id
+      WHERE s.id = ? AND s.expires_at > ? AND ((? IS NULL AND s.viewer_session IS NULL) OR (s.viewer_session = ? AND EXISTS (
+        SELECT 1 FROM managed_session p JOIN managed_user a ON a.id = p.user_id
+        WHERE p.id = s.viewer_session AND p.expires_at > ? AND p.viewer_session IS NULL AND a.role = 'admin')))
+    )
+    SELECT v.id AS id, v.role AS role,
+      (SELECT json_group_array(x.scope ORDER BY x.scope) FROM (SELECT DISTINCT ns.scope AS scope FROM managed_team_user tu
+        JOIN managed_team t ON t.id = tu.team_id AND t.hidden = 0 JOIN managed_team_npm_scope ns ON ns.team_id = tu.team_id
+        WHERE tu.user_id = v.id) x) AS scopes,
+      CASE WHEN EXISTS (SELECT 1 FROM managed_team t JOIN managed_user u ON u.id = v.id WHERE t.id = ? AND ${reviewsIn(false)}) THEN 1 ELSE 0 END AS readsTeam
+    FROM reader v`).get(sessionId, now, viewerSessionId, viewerSessionId, now, teamId) as { id: string; role: Role; scopes: unknown; readsTeam: unknown } | undefined
+  return row ? { id: row.id, role: row.role, scopes: gathered<string>(row.scopes), readsTeam: Number(row.readsTeam) === 1 } : null
+}