@proteinjs/user-server 1.18.0 → 1.20.0

package/dist/test/DevLoginBootstrapRoles.test.js

@@ -0,0 +1,491 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+var db_1 = require("@proteinjs/db");
+var logger_1 = require("@proteinjs/logger");
+var reflection_1 = require("@proteinjs/reflection");
+var user_1 = require("@proteinjs/user");
+var devLoginHarness_1 = require("./devLoginHarness");
+var UserServerTestEnvironment_1 = require("./UserServerTestEnvironment");
+var testEnv = new UserServerTestEnvironment_1.UserServerTestEnvironment();
+/**
+ * `DEV_BOOTSTRAP_ROLES` — the dev role-bootstrap door INSIDE `/dev/login`. A fresh development
+ * database has one admin at most (the first-admin door) and every other account is role-less —
+ * so a consumer's `adminGrantOnly` roles needed a manual admin act on every fresh database. The
+ * same door, the same two gates, one more variable: `email:role[,role];email:role…` — on a hit
+ * whose resolved address is listed, the listed roles the account does not hold are granted, once
+ * each:
+ *  - behind the door's existing two gates (DEVELOPMENT AND DEV_AUTO_LOGIN_EMAIL): closed = 404 as
+ *    before, and the variable changes nothing;
+ *  - only for the request whose resolved address equals a listed address exactly (case-normalized
+ *    the way every account email is) — every other address is untouched;
+ *  - idempotent: a role the account holds is reported `held`, never re-granted, never re-audited;
+ *    nothing is EVER revoked (a role the list does not name stays);
+ *  - admin-grant-only roles are granted (that is the point — a fresh development database has no
+ *    admin to grant them); break-glass and roles the catalog does not know are REFUSED and named;
+ *  - each grant is audited like any grant (a role_grant_event row; actor = the account itself);
+ *  - the outcome is ONE marker line, `[dev-bootstrap] <email>: granted …; held …; refused …`, the
+ *    line provisioning tooling reads back from the server log as its proof.
+ * Outcomes are asserted on the rows (roles, audit), the marker line on the logger (it IS the
+ * contract its readers parse).
+ */
+var ENV_EMAIL = 'dev@test.local';
+var TEAM_EMAIL = 'team@test.local';
+var OPS_EMAIL = 'ops@test.local';
+var ROLES_ENV = "".concat(TEAM_EMAIL, ":staff,dev;").concat(OPS_EMAIL, ":ops");
+var userRow = function (email) { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+    switch (_a.label) {
+        case 0: return [4 /*yield*/, (0, db_1.getDbAsSystem)().get(user_1.tables.User, { email: email })];
+        case 1: return [2 /*return*/, _a.sent()];
+    }
+}); }); };
+var auditRows = function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+    switch (_a.label) {
+        case 0: return [4 /*yield*/, (0, db_1.getDbAsSystem)().query(user_1.tables.RoleGrantEvent, {})];
+        case 1: return [2 /*return*/, _a.sent()];
+    }
+}); }); };
+var adminRows = function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+    switch (_a.label) {
+        case 0: return [4 /*yield*/, (0, db_1.getDbAsSystem)().query(user_1.tables.User, {})];
+        case 1: return [2 /*return*/, (_a.sent()).filter(function (user) { var _a; return ((_a = user.roles) !== null && _a !== void 0 ? _a : []).includes('admin'); })];
+    }
+}); }); };
+describe('devLogin — the DEV_BOOTSTRAP_ROLES role-bootstrap door', function () {
+    var originalEnv = {
+        DEVELOPMENT: process.env.DEVELOPMENT,
+        DEV_AUTO_LOGIN_EMAIL: process.env.DEV_AUTO_LOGIN_EMAIL,
+        DEV_BOOTSTRAP_ADMIN_EMAIL: process.env.DEV_BOOTSTRAP_ADMIN_EMAIL,
+        DEV_BOOTSTRAP_ROLES: process.env.DEV_BOOTSTRAP_ROLES,
+    };
+    var infoSpy;
+    var markerLines = function () {
+        return infoSpy.mock.calls
+            .map(function (call) { var _a, _b; return String((_b = (_a = call[0]) === null || _a === void 0 ? void 0 : _a.message) !== null && _b !== void 0 ? _b : ''); })
+            .filter(function (message) { return message.startsWith('[dev-bootstrap]'); });
+    };
+    beforeAll(function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, testEnv.beforeAll()];
+                case 1:
+                    _a.sent();
+                    // A consumer's catalog shape: 'staff' is admin-grant-only, 'dev'/'ops' plain.
+                    reflection_1.SourceRepository.get().objectCache['@proteinjs/user/RoleCatalogEntry'] = [
+                        { role: 'staff', description: 'Staff member', adminGrantOnly: true },
+                        { role: 'dev', description: 'Developer tooling' },
+                        { role: 'ops', description: 'Operations' },
+                    ];
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    afterAll(function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, testEnv.afterAll()];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    beforeEach(function () { return __awaiter(void 0, void 0, void 0, function () {
+        var db;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    process.env.DEVELOPMENT = 'true';
+                    process.env.DEV_AUTO_LOGIN_EMAIL = ENV_EMAIL;
+                    delete process.env.DEV_BOOTSTRAP_ADMIN_EMAIL;
+                    process.env.DEV_BOOTSTRAP_ROLES = ROLES_ENV;
+                    infoSpy = jest.spyOn(logger_1.Logger.prototype, 'info');
+                    db = (0, db_1.getDbAsSystem)();
+                    return [4 /*yield*/, db.delete(user_1.tables.RoleGrantEvent, {})];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, db.delete(user_1.tables.User, {})];
+                case 2:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    afterEach(function () {
+        infoSpy.mockRestore();
+        for (var _i = 0, _a = Object.entries(originalEnv); _i < _a.length; _i++) {
+            var _b = _a[_i], key = _b[0], value = _b[1];
+            if (value === undefined) {
+                delete process.env[key];
+            }
+            else {
+                process.env[key] = value;
+            }
+        }
+    });
+    it('a fresh database + a listed address: the account is created carrying the listed roles (the admin-grant-only one included), one audit row per role, logged in, and the marker line names the grants', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var _a, outcome, team, events;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    _a = expect;
+                    return [4 /*yield*/, userRow(TEAM_EMAIL)];
+                case 1:
+                    _a.apply(void 0, [_b.sent()]).toBeUndefined();
+                    return [4 /*yield*/, (0, devLoginHarness_1.invokeDevLogin)({ email: TEAM_EMAIL })];
+                case 2:
+                    outcome = _b.sent();
+                    expect(outcome.loggedInAs).toBe(TEAM_EMAIL);
+                    expect(outcome.sessionSaved).toBe(true);
+                    expect(outcome.redirect).toBe('/');
+                    return [4 /*yield*/, userRow(TEAM_EMAIL)];
+                case 3:
+                    team = _b.sent();
+                    expect(team.roles).toEqual(['staff', 'dev']);
+                    return [4 /*yield*/, auditRows()];
+                case 4:
+                    events = _b.sent();
+                    expect(events.map(function (e) { return ({ actor: e.actor, target: e.target, role: e.role, action: e.action }); })).toEqual(expect.arrayContaining([
+                        { actor: team.id, target: team.id, role: 'staff', action: 'grant' },
+                        { actor: team.id, target: team.id, role: 'dev', action: 'grant' },
+                    ]));
+                    expect(events).toHaveLength(2);
+                    expect(markerLines()).toEqual([
+                        "[dev-bootstrap] ".concat(TEAM_EMAIL, ": granted staff, dev; held (none); refused (none)"),
+                    ]);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('a second hit for the same address writes nothing: the roles stand, the audit trail is unchanged, the marker line reports them held', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var outcome, _a, _b;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0: return [4 /*yield*/, (0, devLoginHarness_1.invokeDevLogin)({ email: TEAM_EMAIL })];
+                case 1:
+                    _c.sent();
+                    infoSpy.mockClear();
+                    return [4 /*yield*/, (0, devLoginHarness_1.invokeDevLogin)({ email: TEAM_EMAIL })];
+                case 2:
+                    outcome = _c.sent();
+                    expect(outcome.loggedInAs).toBe(TEAM_EMAIL);
+                    _a = expect;
+                    return [4 /*yield*/, userRow(TEAM_EMAIL)];
+                case 3:
+                    _a.apply(void 0, [(_c.sent()).roles]).toEqual(['staff', 'dev']);
+                    _b = expect;
+                    return [4 /*yield*/, auditRows()];
+                case 4:
+                    _b.apply(void 0, [_c.sent()]).toHaveLength(2);
+                    expect(markerLines()).toEqual([
+                        "[dev-bootstrap] ".concat(TEAM_EMAIL, ": granted (none); held staff, dev; refused (none)"),
+                    ]);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('an existing account holding one listed role and one unlisted role: only the missing role is granted, the unlisted one stays — the door never revokes', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var _a, events;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0: return [4 /*yield*/, testEnv.createUser({ name: 'Team', email: TEAM_EMAIL, roles: ['dev', 'sessions'] })];
+                case 1:
+                    _b.sent();
+                    return [4 /*yield*/, (0, devLoginHarness_1.invokeDevLogin)({ email: TEAM_EMAIL })];
+                case 2:
+                    _b.sent();
+                    _a = expect;
+                    return [4 /*yield*/, userRow(TEAM_EMAIL)];
+                case 3:
+                    _a.apply(void 0, [(_b.sent()).roles]).toEqual(['dev', 'sessions', 'staff']);
+                    return [4 /*yield*/, auditRows()];
+                case 4:
+                    events = _b.sent();
+                    expect(events).toHaveLength(1);
+                    expect(events[0]).toMatchObject({ role: 'staff', action: 'grant' });
+                    expect(markerLines()).toEqual(["[dev-bootstrap] ".concat(TEAM_EMAIL, ": granted staff; held dev; refused (none)")]);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('an address the list does not name: an ordinary account, no grant, no audit row, no marker line — and the listed addresses stay uncreated', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var outcome, _a, _b, _c, _d;
+        return __generator(this, function (_e) {
+            switch (_e.label) {
+                case 0: return [4 /*yield*/, (0, devLoginHarness_1.invokeDevLogin)({ email: 'agent@test.local' })];
+                case 1:
+                    outcome = _e.sent();
+                    expect(outcome.loggedInAs).toBe('agent@test.local');
+                    _a = expect;
+                    return [4 /*yield*/, userRow('agent@test.local')];
+                case 2:
+                    _a.apply(void 0, [(_e.sent()).roles]).toEqual([]);
+                    _b = expect;
+                    return [4 /*yield*/, auditRows()];
+                case 3:
+                    _b.apply(void 0, [_e.sent()]).toHaveLength(0);
+                    expect(markerLines()).toEqual([]);
+                    _c = expect;
+                    return [4 /*yield*/, userRow(TEAM_EMAIL)];
+                case 4:
+                    _c.apply(void 0, [_e.sent()]).toBeUndefined();
+                    _d = expect;
+                    return [4 /*yield*/, userRow(OPS_EMAIL)];
+                case 5:
+                    _d.apply(void 0, [_e.sent()]).toBeUndefined();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('each listed address gets ITS roles only — the second entry never inherits the first', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var _a, _b;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0: return [4 /*yield*/, (0, devLoginHarness_1.invokeDevLogin)({ email: OPS_EMAIL })];
+                case 1:
+                    _c.sent();
+                    _a = expect;
+                    return [4 /*yield*/, userRow(OPS_EMAIL)];
+                case 2:
+                    _a.apply(void 0, [(_c.sent()).roles]).toEqual(['ops']);
+                    _b = expect;
+                    return [4 /*yield*/, auditRows()];
+                case 3:
+                    _b.apply(void 0, [_c.sent()]).toHaveLength(1);
+                    expect(markerLines()).toEqual(["[dev-bootstrap] ".concat(OPS_EMAIL, ": granted ops; held (none); refused (none)")]);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('the match is case-normalized like every account email, and the grammar tolerates whitespace around every token', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var _a, _b;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0:
+                    process.env.DEV_BOOTSTRAP_ROLES = " Team@Test.local : staff , dev ; ".concat(OPS_EMAIL, ": ops ");
+                    return [4 /*yield*/, (0, devLoginHarness_1.invokeDevLogin)({ email: 'team@test.local' })];
+                case 1:
+                    _c.sent();
+                    _a = expect;
+                    return [4 /*yield*/, userRow(TEAM_EMAIL)];
+                case 2:
+                    _a.apply(void 0, [(_c.sent()).roles]).toEqual(['staff', 'dev']);
+                    _b = expect;
+                    return [4 /*yield*/, auditRows()];
+                case 3:
+                    _b.apply(void 0, [_c.sent()]).toHaveLength(2);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('a role the catalog does not know is refused and named; the known roles in the same entry are still granted', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var _a, _b;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0:
+                    process.env.DEV_BOOTSTRAP_ROLES = "".concat(TEAM_EMAIL, ":staff,no-such-role");
+                    return [4 /*yield*/, (0, devLoginHarness_1.invokeDevLogin)({ email: TEAM_EMAIL })];
+                case 1:
+                    _c.sent();
+                    _a = expect;
+                    return [4 /*yield*/, userRow(TEAM_EMAIL)];
+                case 2:
+                    _a.apply(void 0, [(_c.sent()).roles]).toEqual(['staff']);
+                    _b = expect;
+                    return [4 /*yield*/, auditRows()];
+                case 3:
+                    _b.apply(void 0, [_c.sent()]).toHaveLength(1);
+                    expect(markerLines()).toEqual([
+                        "[dev-bootstrap] ".concat(TEAM_EMAIL, ": granted staff; held (none); refused no-such-role (unknown role)"),
+                    ]);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it("break-glass is never this door's to grant: 'admin' in the list is refused and named (the first-admin door is the one path)", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var _a, _b, _c;
+        return __generator(this, function (_d) {
+            switch (_d.label) {
+                case 0:
+                    process.env.DEV_BOOTSTRAP_ROLES = "".concat(TEAM_EMAIL, ":admin,dev");
+                    return [4 /*yield*/, (0, devLoginHarness_1.invokeDevLogin)({ email: TEAM_EMAIL })];
+                case 1:
+                    _d.sent();
+                    _a = expect;
+                    return [4 /*yield*/, userRow(TEAM_EMAIL)];
+                case 2:
+                    _a.apply(void 0, [(_d.sent()).roles]).toEqual(['dev']);
+                    _b = expect;
+                    return [4 /*yield*/, adminRows()];
+                case 3:
+                    _b.apply(void 0, [_d.sent()]).toHaveLength(0);
+                    _c = expect;
+                    return [4 /*yield*/, auditRows()];
+                case 4:
+                    _c.apply(void 0, [(_d.sent()).map(function (e) { return e.role; })]).toEqual(['dev']);
+                    expect(markerLines()).toEqual([
+                        "[dev-bootstrap] ".concat(TEAM_EMAIL, ": granted dev; held (none); refused admin (break-glass)"),
+                    ]);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('the default path is a request for DEV_AUTO_LOGIN_EMAIL: when that address is listed, the default account carries the roles', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var outcome, _a, _b;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0:
+                    process.env.DEV_BOOTSTRAP_ROLES = "".concat(ENV_EMAIL, ":dev");
+                    return [4 /*yield*/, (0, devLoginHarness_1.invokeDevLogin)()];
+                case 1:
+                    outcome = _c.sent();
+                    expect(outcome.loggedInAs).toBe(ENV_EMAIL);
+                    _a = expect;
+                    return [4 /*yield*/, userRow(ENV_EMAIL)];
+                case 2:
+                    _a.apply(void 0, [(_c.sent()).roles]).toEqual(['dev']);
+                    _b = expect;
+                    return [4 /*yield*/, auditRows()];
+                case 3:
+                    _b.apply(void 0, [_c.sent()]).toHaveLength(1);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('composes with the first-admin door: the same address listed in both gets admin first, then its roles — three audited grants, one account', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var _a, _b, _c;
+        return __generator(this, function (_d) {
+            switch (_d.label) {
+                case 0:
+                    process.env.DEV_BOOTSTRAP_ADMIN_EMAIL = TEAM_EMAIL;
+                    return [4 /*yield*/, (0, devLoginHarness_1.invokeDevLogin)({ email: TEAM_EMAIL })];
+                case 1:
+                    _d.sent();
+                    _a = expect;
+                    return [4 /*yield*/, userRow(TEAM_EMAIL)];
+                case 2:
+                    _a.apply(void 0, [(_d.sent()).roles]).toEqual(['admin', 'staff', 'dev']);
+                    _b = expect;
+                    return [4 /*yield*/, auditRows()];
+                case 3:
+                    _b.apply(void 0, [_d.sent()]).toHaveLength(3);
+                    _c = expect;
+                    return [4 /*yield*/, adminRows()];
+                case 4:
+                    _c.apply(void 0, [_d.sent()]).toHaveLength(1);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('with the variable unset a listed address is an ordinary account — the omission is the safety (a deployment outside development never sets it)', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var _a, _b;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0:
+                    delete process.env.DEV_BOOTSTRAP_ROLES;
+                    return [4 /*yield*/, (0, devLoginHarness_1.invokeDevLogin)({ email: TEAM_EMAIL })];
+                case 1:
+                    _c.sent();
+                    _a = expect;
+                    return [4 /*yield*/, userRow(TEAM_EMAIL)];
+                case 2:
+                    _a.apply(void 0, [(_c.sent()).roles]).toEqual([]);
+                    _b = expect;
+                    return [4 /*yield*/, auditRows()];
+                case 3:
+                    _b.apply(void 0, [_c.sent()]).toHaveLength(0);
+                    expect(markerLines()).toEqual([]);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('malformed entries (no colon, no roles) are ignored; the well-formed entries beside them are honored', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var _a, _b, _c;
+        return __generator(this, function (_d) {
+            switch (_d.label) {
+                case 0:
+                    process.env.DEV_BOOTSTRAP_ROLES = "garbage;".concat(OPS_EMAIL, ":;").concat(TEAM_EMAIL, ":dev;:ops");
+                    return [4 /*yield*/, (0, devLoginHarness_1.invokeDevLogin)({ email: TEAM_EMAIL })];
+                case 1:
+                    _d.sent();
+                    return [4 /*yield*/, (0, devLoginHarness_1.invokeDevLogin)({ email: OPS_EMAIL })];
+                case 2:
+                    _d.sent();
+                    _a = expect;
+                    return [4 /*yield*/, userRow(TEAM_EMAIL)];
+                case 3:
+                    _a.apply(void 0, [(_d.sent()).roles]).toEqual(['dev']);
+                    _b = expect;
+                    return [4 /*yield*/, userRow(OPS_EMAIL)];
+                case 4:
+                    _b.apply(void 0, [(_d.sent()).roles]).toEqual([]);
+                    _c = expect;
+                    return [4 /*yield*/, auditRows()];
+                case 5:
+                    _c.apply(void 0, [_d.sent()]).toHaveLength(1);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it.each([['DEVELOPMENT'], ['DEV_AUTO_LOGIN_EMAIL']])('gate closed (%s unset): 404 exactly as before — no session, no account, no grant; the variable changes nothing', function (gate) { return __awaiter(void 0, void 0, void 0, function () {
+        var outcome, _a, _b;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0:
+                    delete process.env[gate];
+                    return [4 /*yield*/, (0, devLoginHarness_1.invokeDevLogin)({ email: TEAM_EMAIL })];
+                case 1:
+                    outcome = _c.sent();
+                    expect(outcome.status).toBe(404);
+                    expect(outcome.loggedInAs).toBeUndefined();
+                    expect(outcome.sessionSaved).toBe(false);
+                    _a = expect;
+                    return [4 /*yield*/, userRow(TEAM_EMAIL)];
+                case 2:
+                    _a.apply(void 0, [_c.sent()]).toBeUndefined();
+                    _b = expect;
+                    return [4 /*yield*/, auditRows()];
+                case 3:
+                    _b.apply(void 0, [_c.sent()]).toHaveLength(0);
+                    expect(markerLines()).toEqual([]);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+});
+//# sourceMappingURL=DevLoginBootstrapRoles.test.js.map

package/dist/test/DevLoginBootstrapRoles.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DevLoginBootstrapRoles.test.js","sourceRoot":"","sources":["../../test/DevLoginBootstrapRoles.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oCAA8C;AAC9C,4CAA2C;AAC3C,oDAAyD;AACzD,wCAA2D;AAC3D,qDAAmD;AACnD,yEAAwE;AAExE,IAAM,OAAO,GAAG,IAAI,qDAAyB,EAAE,CAAC;AAEhD;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,IAAM,SAAS,GAAG,gBAAgB,CAAC;AACnC,IAAM,UAAU,GAAG,iBAAiB,CAAC;AACrC,IAAM,SAAS,GAAG,gBAAgB,CAAC;AACnC,IAAM,SAAS,GAAG,UAAG,UAAU,wBAAc,SAAS,SAAM,CAAC;AAI7D,IAAM,OAAO,GAAG,UAAO,KAAa;;gBAAK,qBAAM,IAAA,kBAAa,GAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,KAAK,OAAA,EAAE,CAAC,EAAA;gBAAjD,sBAAA,SAAiD,EAAA;;SAAA,CAAC;AAC3F,IAAM,SAAS,GAAG;;gBAAY,qBAAM,IAAA,kBAAa,GAAE,CAAC,KAAK,CAAC,aAAM,CAAC,cAAc,EAAE,EAAE,CAAC,EAAA;gBAAtD,sBAAA,SAAsD,EAAA;;SAAA,CAAC;AACrF,IAAM,SAAS,GAAG;;gBACf,qBAAM,IAAA,kBAAa,GAAE,CAAC,KAAK,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,CAAC,EAAA;gBAA7C,sBAAA,CAAC,SAA4C,CAAC,CAAC,MAAM,CAAC,UAAC,IAAI,YAAK,OAAA,CAAC,MAAA,IAAI,CAAC,KAAK,mCAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA,EAAA,CAAC,EAAA;;SAAA,CAAC;AAExG,QAAQ,CAAC,wDAAwD,EAAE;IACjE,IAAM,WAAW,GAAG;QAClB,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW;QACpC,oBAAoB,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;QACtD,yBAAyB,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB;QAChE,mBAAmB,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB;KACrD,CAAC;IACF,IAAI,OAAyB,CAAC;IAC9B,IAAM,WAAW,GAAG;QAClB,OAAA,OAAO,CAAC,IAAI,CAAC,KAAK;aACf,GAAG,CAAC,UAAC,IAAI,gBAAK,OAAA,MAAM,CAAC,MAAA,MAAC,IAAI,CAAC,CAAC,CAA0B,0CAAE,OAAO,mCAAI,EAAE,CAAC,CAAA,EAAA,CAAC;aACvE,MAAM,CAAC,UAAC,OAAO,IAAK,OAAA,OAAO,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAArC,CAAqC,CAAC;IAF7D,CAE6D,CAAC;IAEhE,SAAS,CAAC;;;wBACR,qBAAM,OAAO,CAAC,SAAS,EAAE,EAAA;;oBAAzB,SAAyB,CAAC;oBAC1B,8EAA8E;oBAC7E,6BAAgB,CAAC,GAAG,EAA2C,CAAC,WAAW,CAAC,kCAAkC,CAAC,GAAG;wBACjH,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,cAAc,EAAE,IAAI,EAAsB;wBACxF,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,mBAAmB,EAAsB;wBACrE,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,YAAY,EAAsB;qBAC/D,CAAC;;;;SACH,CAAC,CAAC;IAEH,QAAQ,CAAC;;;wBACP,qBAAM,OAAO,CAAC,QAAQ,EAAE,EAAA;;oBAAxB,SAAwB,CAAC;;;;SAC1B,CAAC,CAAC;IAEH,UAAU,CAAC;;;;;oBACT,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG,MAAM,CAAC;oBACjC,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,SAAS,CAAC;oBAC7C,OAAO,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;oBAC7C,OAAO,CAAC,GAAG,CAAC,mBAAmB,GAAG,SAAS,CAAC;oBAC5C,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,eAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;oBAEzC,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;oBAC3B,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,cAAc,EAAE,EAAE,CAAC,EAAA;;oBAA1C,SAA0C,CAAC;oBAC3C,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,CAAC,EAAA;;oBAAhC,SAAgC,CAAC;;;;SAClC,CAAC,CAAC;IAEH,SAAS,CAAC;QACR,OAAO,CAAC,WAAW,EAAE,CAAC;QACtB,KAA2B,UAA2B,EAA3B,KAAA,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAA3B,cAA2B,EAA3B,IAA2B,EAAE;YAA7C,IAAA,WAAY,EAAX,GAAG,QAAA,EAAE,KAAK,QAAA;YACpB,IAAI,KAAK,KAAK,SAAS,EAAE;gBACvB,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;aACzB;iBAAM;gBACL,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;aAC1B;SACF;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oMAAoM,EAAE;;;;;oBACvM,KAAA,MAAM,CAAA;oBAAC,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAA;;oBAAhC,kBAAO,SAAyB,EAAC,CAAC,aAAa,EAAE,CAAC;oBAElC,qBAAM,IAAA,gCAAc,EAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAA;;oBAArD,OAAO,GAAG,SAA2C;oBAE3D,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;oBAC5C,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACxC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACtB,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAA;;oBAAhC,IAAI,GAAG,SAAyB;oBACtC,MAAM,CAAC,IAAK,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;oBAC/B,qBAAM,SAAS,EAAE,EAAA;;oBAA1B,MAAM,GAAG,SAAiB;oBAChC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,UAAC,CAAC,IAAK,OAAA,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,EAAtE,CAAsE,CAAC,CAAC,CAAC,OAAO,CACvG,MAAM,CAAC,eAAe,CAAC;wBACrB,EAAE,KAAK,EAAE,IAAK,CAAC,EAAE,EAAE,MAAM,EAAE,IAAK,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE;wBACrE,EAAE,KAAK,EAAE,IAAK,CAAC,EAAE,EAAE,MAAM,EAAE,IAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE;qBACpE,CAAC,CACH,CAAC;oBACF,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;oBAC/B,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC;wBAC5B,0BAAmB,UAAU,sDAAmD;qBACjF,CAAC,CAAC;;;;SACJ,CAAC,CAAC;IAEH,EAAE,CAAC,oIAAoI,EAAE;;;;wBACvI,qBAAM,IAAA,gCAAc,EAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAA;;oBAA3C,SAA2C,CAAC;oBAC5C,OAAO,CAAC,SAAS,EAAE,CAAC;oBAEJ,qBAAM,IAAA,gCAAc,EAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAA;;oBAArD,OAAO,GAAG,SAA2C;oBAE3D,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;oBAC5C,KAAA,MAAM,CAAA;oBAAE,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAA;;oBAAjC,kBAAO,CAAC,SAAyB,CAAE,CAAC,KAAK,EAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;oBACrE,KAAA,MAAM,CAAA;oBAAC,qBAAM,SAAS,EAAE,EAAA;;oBAAxB,kBAAO,SAAiB,EAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;oBAC1C,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC;wBAC5B,0BAAmB,UAAU,sDAAmD;qBACjF,CAAC,CAAC;;;;SACJ,CAAC,CAAC;IAEH,EAAE,CAAC,sJAAsJ,EAAE;;;;wBACzJ,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC,EAAA;;oBAAzF,SAAyF,CAAC;oBAE1F,qBAAM,IAAA,gCAAc,EAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAA;;oBAA3C,SAA2C,CAAC;oBAE5C,KAAA,MAAM,CAAA;oBAAE,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAA;;oBAAjC,kBAAO,CAAC,SAAyB,CAAE,CAAC,KAAK,EAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;oBAClE,qBAAM,SAAS,EAAE,EAAA;;oBAA1B,MAAM,GAAG,SAAiB;oBAChC,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;oBAC/B,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;oBACpE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,0BAAmB,UAAU,8CAA2C,CAAC,CAAC,CAAC;;;;SAC3G,CAAC,CAAC;IAEH,EAAE,CAAC,0IAA0I,EAAE;;;;wBAC7H,qBAAM,IAAA,gCAAc,EAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,EAAA;;oBAA7D,OAAO,GAAG,SAAmD;oBAEnE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;oBACpD,KAAA,MAAM,CAAA;oBAAE,qBAAM,OAAO,CAAC,kBAAkB,CAAC,EAAA;;oBAAzC,kBAAO,CAAC,SAAiC,CAAE,CAAC,KAAK,EAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;oBAC/D,KAAA,MAAM,CAAA;oBAAC,qBAAM,SAAS,EAAE,EAAA;;oBAAxB,kBAAO,SAAiB,EAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;oBAC1C,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;oBAClC,KAAA,MAAM,CAAA;oBAAC,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAA;;oBAAhC,kBAAO,SAAyB,EAAC,CAAC,aAAa,EAAE,CAAC;oBAClD,KAAA,MAAM,CAAA;oBAAC,qBAAM,OAAO,CAAC,SAAS,CAAC,EAAA;;oBAA/B,kBAAO,SAAwB,EAAC,CAAC,aAAa,EAAE,CAAC;;;;SAClD,CAAC,CAAC;IAEH,EAAE,CAAC,qFAAqF,EAAE;;;;wBACxF,qBAAM,IAAA,gCAAc,EAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAA;;oBAA1C,SAA0C,CAAC;oBAE3C,KAAA,MAAM,CAAA;oBAAE,qBAAM,OAAO,CAAC,SAAS,CAAC,EAAA;;oBAAhC,kBAAO,CAAC,SAAwB,CAAE,CAAC,KAAK,EAAC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;oBAC3D,KAAA,MAAM,CAAA;oBAAC,qBAAM,SAAS,EAAE,EAAA;;oBAAxB,kBAAO,SAAiB,EAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;oBAC1C,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,0BAAmB,SAAS,+CAA4C,CAAC,CAAC,CAAC;;;;SAC3G,CAAC,CAAC;IAEH,EAAE,CAAC,gHAAgH,EAAE;;;;;oBACnH,OAAO,CAAC,GAAG,CAAC,mBAAmB,GAAG,2CAAoC,SAAS,WAAQ,CAAC;oBAExF,qBAAM,IAAA,gCAAc,EAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,EAAA;;oBAAlD,SAAkD,CAAC;oBAEnD,KAAA,MAAM,CAAA;oBAAE,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAA;;oBAAjC,kBAAO,CAAC,SAAyB,CAAE,CAAC,KAAK,EAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;oBACrE,KAAA,MAAM,CAAA;oBAAC,qBAAM,SAAS,EAAE,EAAA;;oBAAxB,kBAAO,SAAiB,EAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;;;;SAC3C,CAAC,CAAC;IAEH,EAAE,CAAC,4GAA4G,EAAE;;;;;oBAC/G,OAAO,CAAC,GAAG,CAAC,mBAAmB,GAAG,UAAG,UAAU,wBAAqB,CAAC;oBAErE,qBAAM,IAAA,gCAAc,EAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAA;;oBAA3C,SAA2C,CAAC;oBAE5C,KAAA,MAAM,CAAA;oBAAE,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAA;;oBAAjC,kBAAO,CAAC,SAAyB,CAAE,CAAC,KAAK,EAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;oBAC9D,KAAA,MAAM,CAAA;oBAAC,qBAAM,SAAS,EAAE,EAAA;;oBAAxB,kBAAO,SAAiB,EAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;oBAC1C,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC;wBAC5B,0BAAmB,UAAU,sEAAmE;qBACjG,CAAC,CAAC;;;;SACJ,CAAC,CAAC;IAEH,EAAE,CAAC,4HAA4H,EAAE;;;;;oBAC/H,OAAO,CAAC,GAAG,CAAC,mBAAmB,GAAG,UAAG,UAAU,eAAY,CAAC;oBAE5D,qBAAM,IAAA,gCAAc,EAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAA;;oBAA3C,SAA2C,CAAC;oBAE5C,KAAA,MAAM,CAAA;oBAAE,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAA;;oBAAjC,kBAAO,CAAC,SAAyB,CAAE,CAAC,KAAK,EAAC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;oBAC5D,KAAA,MAAM,CAAA;oBAAC,qBAAM,SAAS,EAAE,EAAA;;oBAAxB,kBAAO,SAAiB,EAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;oBAC1C,KAAA,MAAM,CAAA;oBAAE,qBAAM,SAAS,EAAE,EAAA;;oBAAzB,kBAAO,CAAC,SAAiB,CAAC,CAAC,GAAG,CAAC,UAAC,CAAC,IAAK,OAAA,CAAC,CAAC,IAAI,EAAN,CAAM,CAAC,EAAC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;oBAChE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC;wBAC5B,0BAAmB,UAAU,4DAAyD;qBACvF,CAAC,CAAC;;;;SACJ,CAAC,CAAC;IAEH,EAAE,CAAC,4HAA4H,EAAE;;;;;oBAC/H,OAAO,CAAC,GAAG,CAAC,mBAAmB,GAAG,UAAG,SAAS,SAAM,CAAC;oBAErC,qBAAM,IAAA,gCAAc,GAAE,EAAA;;oBAAhC,OAAO,GAAG,SAAsB;oBAEtC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBAC3C,KAAA,MAAM,CAAA;oBAAE,qBAAM,OAAO,CAAC,SAAS,CAAC,EAAA;;oBAAhC,kBAAO,CAAC,SAAwB,CAAE,CAAC,KAAK,EAAC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;oBAC3D,KAAA,MAAM,CAAA;oBAAC,qBAAM,SAAS,EAAE,EAAA;;oBAAxB,kBAAO,SAAiB,EAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;;;;SAC3C,CAAC,CAAC;IAEH,EAAE,CAAC,0IAA0I,EAAE;;;;;oBAC7I,OAAO,CAAC,GAAG,CAAC,yBAAyB,GAAG,UAAU,CAAC;oBAEnD,qBAAM,IAAA,gCAAc,EAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAA;;oBAA3C,SAA2C,CAAC;oBAE5C,KAAA,MAAM,CAAA;oBAAE,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAA;;oBAAjC,kBAAO,CAAC,SAAyB,CAAE,CAAC,KAAK,EAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;oBAC9E,KAAA,MAAM,CAAA;oBAAC,qBAAM,SAAS,EAAE,EAAA;;oBAAxB,kBAAO,SAAiB,EAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;oBAC1C,KAAA,MAAM,CAAA;oBAAC,qBAAM,SAAS,EAAE,EAAA;;oBAAxB,kBAAO,SAAiB,EAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;;;;SAC3C,CAAC,CAAC;IAEH,EAAE,CAAC,+IAA+I,EAAE;;;;;oBAClJ,OAAO,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;oBAEvC,qBAAM,IAAA,gCAAc,EAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAA;;oBAA3C,SAA2C,CAAC;oBAE5C,KAAA,MAAM,CAAA;oBAAE,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAA;;oBAAjC,kBAAO,CAAC,SAAyB,CAAE,CAAC,KAAK,EAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;oBACvD,KAAA,MAAM,CAAA;oBAAC,qBAAM,SAAS,EAAE,EAAA;;oBAAxB,kBAAO,SAAiB,EAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;oBAC1C,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;;;;SACnC,CAAC,CAAC;IAEH,EAAE,CAAC,qGAAqG,EAAE;;;;;oBACxG,OAAO,CAAC,GAAG,CAAC,mBAAmB,GAAG,kBAAW,SAAS,eAAK,UAAU,cAAW,CAAC;oBAEjF,qBAAM,IAAA,gCAAc,EAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAA;;oBAA3C,SAA2C,CAAC;oBAC5C,qBAAM,IAAA,gCAAc,EAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAA;;oBAA1C,SAA0C,CAAC;oBAE3C,KAAA,MAAM,CAAA;oBAAE,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAA;;oBAAjC,kBAAO,CAAC,SAAyB,CAAE,CAAC,KAAK,EAAC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;oBAC5D,KAAA,MAAM,CAAA;oBAAE,qBAAM,OAAO,CAAC,SAAS,CAAC,EAAA;;oBAAhC,kBAAO,CAAC,SAAwB,CAAE,CAAC,KAAK,EAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;oBACtD,KAAA,MAAM,CAAA;oBAAC,qBAAM,SAAS,EAAE,EAAA;;oBAAxB,kBAAO,SAAiB,EAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;;;;SAC3C,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAClD,gHAAgH,EAChH,UAAO,IAAI;;;;;oBACT,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBAET,qBAAM,IAAA,gCAAc,EAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAA;;oBAArD,OAAO,GAAG,SAA2C;oBAE3D,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACjC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,aAAa,EAAE,CAAC;oBAC3C,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACzC,KAAA,MAAM,CAAA;oBAAC,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAA;;oBAAhC,kBAAO,SAAyB,EAAC,CAAC,aAAa,EAAE,CAAC;oBAClD,KAAA,MAAM,CAAA;oBAAC,qBAAM,SAAS,EAAE,EAAA;;oBAAxB,kBAAO,SAAiB,EAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;oBAC1C,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;;;;SACnC,CACF,CAAC;AACJ,CAAC,CAAC,CAAC"}