@restorecommerce/acs-client 0.4.18 → 0.5.2

package/lib/acs/resolver.js

@@ -12,7 +12,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.whatIsAllowed = exports.isAllowed = exports.accessRequest = exports.isAllowedRequest = void 0;
 const _ = require("lodash");
 const interfaces_1 = require("./interfaces");
-const interfaces_2 = require("./interfaces");
 const logger_1 = require("../logger");
 const config_1 = require("../config");
 const utils_1 = require("../utils");
@@ -22,82 +21,80 @@ const subjectIsUnauthenticated = (subject) => {
     return !!subject
         && 'unauthenticated' in subject && subject['unauthenticated'];
 };
-const whatIsAllowedRequest = (subject, resources, action, authZ, useCache) => __awaiter(void 0, void 0, void 0, function* () {
+const whatIsAllowedRequest = (subject, resource, action, ctx, useCache) => __awaiter(void 0, void 0, void 0, function* () {
     if (subjectIsUnauthenticated(subject)) {
         const grpcConfig = config_1.cfg.get('client:acs-srv');
         const acsClient = new grpc_client_1.GrpcClient(grpcConfig, logger_1.default);
         const acs = acsClient['acs-srv'];
         return yield new authz_1.UnAuthZ(acs).whatIsAllowed({
             target: {
-                action, resources, subject: subject
+                subject: subject, resource, action
             },
             context: {
                 security: {}
             }
-        }, useCache);
+        }, ctx, useCache);
     }
     else {
-        return yield authZ.whatIsAllowed({
+        return yield authz_1.authZ.whatIsAllowed({
             context: {
                 security: {}
             },
             target: {
-                action,
-                resources,
-                subject
+                subject,
+                resource,
+                action
             }
-        }, useCache);
+        }, ctx, useCache);
     }
 });
-const isReadRequest = (object) => {
-    return 'entity' in object;
-};
-const isAllowedRequest = (subject, resources, action, authZ, useCache) => __awaiter(void 0, void 0, void 0, function* () {
+const isAllowedRequest = (subject, resource, action, ctx, useCache) => __awaiter(void 0, void 0, void 0, function* () {
     if (subjectIsUnauthenticated(subject)) {
         const grpcConfig = config_1.cfg.get('client:acs-srv');
         const acsClient = new grpc_client_1.GrpcClient(grpcConfig, logger_1.default);
         const acs = acsClient['acs-srv'];
         return yield new authz_1.UnAuthZ(acs).isAllowed({
             target: {
-                action, resources, subject: subject
+                subject: subject, resource, action
             },
             context: {
                 security: {}
             }
-        }, useCache);
+        }, ctx, useCache);
     }
     else {
-        return yield authZ.isAllowed({
+        return yield authz_1.authZ.isAllowed({
             context: {
                 security: {}
             },
             target: {
-                action,
-                resources,
-                subject
+                subject,
+                resource,
+                action
             }
-        }, useCache);
+        }, ctx, useCache);
     }
 });
 exports.isAllowedRequest = isAllowedRequest;
 /**
  * It turns an API request as can be found in typical Web frameworks like express, koa etc.
- * into a proper ACS request. For write operations it uses `isAllowed()` and for read operations
- * it uses `whatIsAllowed()`. For the latter it extends the filter provided in the `ReadRequst`
+ * into a proper ACS request. For `whatIsAllowed` operation it returns the filters
  * to enforce the applicapble poilicies. The response is `Decision`
  * or policy set reverse query `PolicySetRQ` depending on the requeste operation `isAllowed()` or
  * `whatIsAllowed()` respectively.
- * @param {Subject | ApiKey} subject Contains subject information or ApiKey
- * @param {any | any[] | ReadRequest} request request object of type any for resource or ReadRequest
+ * @param {Subject} subject Contains subject information or ApiKey
+ * @param {Resource[]} resource Contains resource name, resource instance and optional resource properties
  * @param {AuthZAction} action Action to be performed on resource
- * @param {ACSAuthZ} authZ ACS Authorization Object containing grpc client connection for `access-control-srv`
- * @param {string} entity entity name optional
- * @param {string} resourceNameSpace resource name space optional
+ * @param {ACSClientContext} ctx Context containing Subject and Context Resources for ACS
+ * @param {Operation} operation Operation to perform `isAllowed` or `whatIsAllowed`,
+ * if this param is missing defaults to `isAllowed` operation
+ * @param {Database} database database used either `arangoDB` or `postgres`,
+ * if this param is missing defaults to `arangoDB`
  * @param {boolean} useCache by default ACS caching is used, if set to false then ACS cache
  * is not used and ACS request is made to `access-control-srv`
  * @returns {DecisionResponse | PolicySetRQResponse}
  */
-const accessRequest = (subject, request, action, authZ, entity, resourceNameSpace, useCache = true) => __awaiter(void 0, void 0, void 0, function* () {
+const accessRequest = (subject, resource, action, ctx, operation, database, useCache = true) => __awaiter(void 0, void 0, void 0, function* () {
     // when subject is not passed (if auth header is not set)
     if (_.isEmpty(subject)) {
         subject = { unauthenticated: true };
@@ -131,40 +128,53 @@ const accessRequest = (subject, request, action, authZ, entity, resourceNameSpac
     if (_.isEmpty(subject)) {
         return { decision: interfaces_1.Decision.DENY, operation_status: utils_1.generateOperationStatus(config_1.errors.USER_NOT_LOGGED_IN.code, config_1.errors.USER_NOT_LOGGED_IN.message) };
     }
-    let resources = [];
     let subjectID;
     let targetScope = subject.scope;
     // resolve userID by token
     if (subject && subject.id) {
         subjectID = subject.id;
     }
-    if (!entity) {
-        entity = request.entity;
+    if (!_.isArray(resource)) {
+        resource = [resource];
+    }
+    if (_.isEmpty(resource)) {
+        const msg = `Access not allowed for request with subject:${subjectID}, ` +
+            `resource:${resource}, action:${action}, target_scope:${targetScope}; the response was INDETERMINATE`;
+        const details = 'Entity missing';
+        logger_1.default.verbose(msg);
+        logger_1.default.verbose('Details:', { details });
+        return { decision: interfaces_1.Decision.DENY, operation_status: utils_1.generateOperationStatus(Number(config_1.errors.ACTION_NOT_ALLOWED.code), msg) };
+    }
+    // default ACS operation is isAllowed
+    if (!operation) {
+        operation = interfaces_1.Operation.isAllowed;
+    }
+    // default database is arangoDB
+    if (!database) {
+        database = 'arangoDB';
+    }
+    // ctx.resources
+    if (ctx.resources && !_.isArray(ctx.resources)) {
+        ctx.resources = [ctx.resources];
     }
-    let resourceWithNS = resourceNameSpace ? `${resourceNameSpace}.${entity}` : entity;
-    // for read operations
-    if (action == interfaces_2.AuthZAction.READ && isReadRequest(request)
-        // for action create or modify with read request to get policySetRQ
-        || ((action == interfaces_2.AuthZAction.CREATE || action == interfaces_2.AuthZAction.MODIFY) && isReadRequest(request))) {
-        const resourceName = request.entity;
+    // whatIsAllowed Operation
+    if (operation === interfaces_1.Operation.whatIsAllowed) {
+        // const resourceName = request.entity;
         let policySetResponse;
         try {
             // retrieving set of applicable policies/rules from ACS
             // Note: it is assumed that there is only one policy set
-            policySetResponse = yield whatIsAllowedRequest(subClone, [{
-                    type: resourceName,
-                    namespace: request.namespace
-                }], [action], authZ, useCache);
+            policySetResponse = yield whatIsAllowedRequest(subClone, resource, action, ctx, useCache);
         }
         catch (err) {
-            logger_1.default.error('Error calling whatIsAllowed:', { message: err.message });
+            logger_1.default.error('Error calling whatIsAllowed operation', { message: err.message });
             logger_1.default.error('Error stack', err.stack);
             return { decision: interfaces_1.Decision.DENY, operation_status: utils_1.generateOperationStatus(err.code, err.message) };
         }
         // handle case if policySet is empty
         if ((!policySetResponse || _.isEmpty(policySetResponse.policy_sets)) && authzEnforced) {
             const msg = `Access not allowed for request with subject:${subjectID}, ` +
-                `resource:${resourceWithNS}, action:${action}, target_scope:${targetScope}; the response was INDETERMINATE`;
+                `resource:${resource}, action:${action}, target_scope:${targetScope}; the response was INDETERMINATE`;
             const details = 'no matching policy/rule could be found';
             logger_1.default.verbose(msg);
             logger_1.default.verbose('Details:', { details });
@@ -172,74 +182,43 @@ const accessRequest = (subject, request, action, authZ, entity, resourceNameSpac
         }
         if ((!policySetResponse || _.isEmpty(policySetResponse.policy_sets)) && !authzEnforced) {
             logger_1.default.verbose(`The Access response was INDETERMIATE for a request with subject:` +
-                `${subjectID}, resource:${resourceWithNS}, action:${action}, target_scope:${targetScope} ` +
+                `${subjectID}, resource:${resource}, action:${action}, target_scope:${targetScope} ` +
                 `as no matching policy/rule could be found, but since ACS enforcement ` +
                 `config is disabled overriding the ACS result`);
         }
-        // extend input filter to enforce applicable policies
-        let permissionArguments = yield utils_1.buildFilterPermissions(policySetResponse.policy_sets[0], subClone, request, authZ, request.database);
-        if (!permissionArguments && authzEnforced) {
-            const msg = `Access not allowed for request with subject:${subjectID}, ` +
-                `resource:${resourceWithNS}, action:${action}, target_scope:${targetScope}; the response was DENY`;
-            const details = `Subject:${subjectID} does not have access to target scope ${targetScope}}`;
-            logger_1.default.verbose(msg);
-            logger_1.default.verbose('Details:', { details });
-            return { decision: interfaces_1.Decision.DENY, operation_status: utils_1.generateOperationStatus(Number(config_1.errors.ACTION_NOT_ALLOWED.code), msg) };
-        }
-        if (!permissionArguments && !authzEnforced) {
-            logger_1.default.verbose(`The Access response was DENY for a request from subject:${subjectID}, ` +
-                `resource:${resourceWithNS}, action:${action}, target_scope:${targetScope}, ` +
-                `but since ACS enforcement config is disabled overriding the ACS result`);
+        // create filters to enforce applicable policies and custom query / args if applicable
+        const resourceFilters = yield utils_1.createEntityFilterMap(resource, policySetResponse, ctx.resources, action, subClone, subjectID, authzEnforced, targetScope, database);
+        if (resourceFilters.decision) {
+            return resourceFilters;
         }
-        // below fix is to convert the input filter to object only if it is already a structrue
-        // i.e. struct filter containing `fileds` property
-        if (request.args && request.args.filters && !_.isEmpty(request.args.filters)) {
-            if (_.isArray(request.args.filters)) {
-                for (let filter of request.args.filters) {
-                    if (!_.isArray(permissionArguments.filters)) {
-                        permissionArguments.filters = [filter];
-                    }
-                    permissionArguments.filters.push(filter);
-                }
-            }
-            else {
-                if (!_.isArray(permissionArguments.filters)) {
-                    permissionArguments.filters = [permissionArguments.filters];
-                }
-                permissionArguments.filters.push(request.args.filters);
-            }
-        }
-        Object.assign(request.args, permissionArguments);
+        policySetResponse.filters = resourceFilters.entityFilterMap;
+        policySetResponse.custom_query_args = resourceFilters.customQueryArgs;
         policySetResponse.decision = interfaces_1.Decision.PERMIT; // Adding Permit to read response (since we no longer throw errorrs)
         policySetResponse.operation_status = utils_1.generateOperationStatus(200, 'success');
         return policySetResponse;
     }
-    if (!_.isArray(request)) {
-        resources = [request];
+    let resourceList = [];
+    resource.forEach((resourceObj) => {
+        resourceList.push(resourceObj.resource);
+    });
+    let resourceString;
+    if (resourceList.length === 1) {
+        resourceString = resourceList[0];
     }
     else {
-        resources = request;
+        resourceString = JSON.stringify(resourceList);
     }
     // default deny
     let decisionResponse = { decision: interfaces_1.Decision.DENY, operation_status: { code: 0, message: '' } };
-    let resourceList = [];
-    // for write operations
-    if (!_.isEmpty(resources) || action === interfaces_2.AuthZAction.DELETE ||
-        action === interfaces_2.AuthZAction.EXECUTE || action === interfaces_2.AuthZAction.DROP) {
-        // add type and namespace
-        for (let resource of resources) {
-            resourceList.push({
-                fields: _.keys(resource),
-                instance: resource,
-                type: entity,
-                namespace: resourceNameSpace
-            });
-        }
+    // isAllowed operation
+    if (operation === interfaces_1.Operation.isAllowed) {
         // authorization
         try {
-            decisionResponse = yield exports.isAllowedRequest(subClone, resourceList, action, authZ, useCache);
+            decisionResponse = yield exports.isAllowedRequest(subClone, resource, action, ctx, useCache);
         }
         catch (err) {
+            logger_1.default.error('Error calling isAllowed operation', { message: err.message });
+            logger_1.default.error('Error stack', err.stack);
             return { decision: interfaces_1.Decision.DENY, operation_status: utils_1.generateOperationStatus(err.code, err.message) };
         }
         if (decisionResponse && decisionResponse.decision != interfaces_1.Decision.PERMIT && authzEnforced) {
@@ -251,7 +230,7 @@ const accessRequest = (subject, request, action, authZ, entity, resourceNameSpac
                 details = `Subject:${subjectID} does not have access to requested target scope ${targetScope}`;
             }
             const msg = `Access not allowed for request with subject:${subjectID}, ` +
-                `resource:${resourceWithNS}, action:${action}, target_scope:${targetScope}; the response was ${decisionResponse.decision}`;
+                `resource:${resourceString}, action:${action}, target_scope:${targetScope}; the response was ${decisionResponse.decision}`;
             logger_1.default.verbose(msg);
             logger_1.default.verbose('Details:', { details });
             return { decision: interfaces_1.Decision.DENY, operation_status: utils_1.generateOperationStatus(Number(config_1.errors.ACTION_NOT_ALLOWED.code), msg) };
@@ -266,7 +245,7 @@ const accessRequest = (subject, request, action, authZ, entity, resourceNameSpac
             details = `Subject:${subjectID} does not have access to requested target scope ${targetScope}`;
         }
         logger_1.default.verbose(`Access not allowed for request with subject:${subjectID}, ` +
-            `resource:${resourceWithNS}, action:${action}, target_scope:${targetScope}; the response was ${decisionResponse.decision}`);
+            `resource:${resourceString}, action:${action}, target_scope:${targetScope}; the response was ${decisionResponse.decision}`);
         logger_1.default.verbose(`${details}, Overriding the ACS result as ACS enforce config is disabled`);
         decisionResponse.decision = interfaces_1.Decision.PERMIT;
     }

package/lib/acs/resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolver.js","sourceRoot":"","sources":["../../src/acs/resolver.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,4BAA4B;AAC5B,6CAGsB;AACtB,6CAA2C;AAC3C,sCAA+B;AAC/B,sCAAwC;AACxC,oCAA2E;AAC3E,8DAA0D;AAC1D,mCAA4C;AAG5C,MAAM,wBAAwB,GAAG,CAAC,OAAY,EAAqC,EAAE;IACnF,OAAO,CAAC,CAAC,OAAO;WACX,iBAAiB,IAAI,OAAO,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAClE,CAAC,CAAC;AAEF,MAAM,oBAAoB,GAAG,CAAO,OAAgB,EAClD,SAAqB,EAAE,MAAqB,EAAE,KAAe,EAAE,QAAiB,EAAE,EAAE;IACpF,IAAI,wBAAwB,CAAC,OAAO,CAAC,EAAE;QACrC,MAAM,UAAU,GAAG,YAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,IAAI,wBAAU,CAAC,UAAU,EAAE,gBAAM,CAAC,CAAC;QACrD,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;QACjC,OAAO,MAAM,IAAI,eAAO,CAAC,GAAG,CAAC,CAAC,aAAa,CAAC;YAC1C,MAAM,EAAE;gBACN,MAAM,EAAE,SAAS,EAAE,OAAO,EAAG,OAA+B;aAC7D;YACD,OAAO,EAAE;gBACP,QAAQ,EAAE,EAAE;aACb;SACF,EAAE,QAAQ,CAAC,CAAC;KACd;SAAM;QACL,OAAO,MAAM,KAAK,CAAC,aAAa,CAAC;YAC/B,OAAO,EAAE;gBACP,QAAQ,EAAE,EAAE;aACb;YACD,MAAM,EAAE;gBACN,MAAM;gBACN,SAAS;gBACT,OAAO;aACR;SACF,EAAE,QAAQ,CAAC,CAAC;KACd;AACH,CAAC,CAAA,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,MAAW,EAAyB,EAAE;IAC3D,OAAO,QAAQ,IAAI,MAAM,CAAC;AAC5B,CAAC,CAAC;AAEK,MAAM,gBAAgB,GAAG,CAAO,OAAsC,EAC3E,SAAqB,EAAE,MAAmB,EAAE,KAAe,EAAE,QAAiB,EAA6B,EAAE;IAC7G,IAAI,wBAAwB,CAAC,OAAO,CAAC,EAAE;QACrC,MAAM,UAAU,GAAG,YAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,IAAI,wBAAU,CAAC,UAAU,EAAE,gBAAM,CAAC,CAAC;QACrD,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;QACjC,OAAO,MAAM,IAAI,eAAO,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC;YACtC,MAAM,EAAE;gBACN,MAAM,EAAE,SAAS,EAAE,OAAO,EAAG,OAA+B;aAC7D;YACD,OAAO,EAAE;gBACP,QAAQ,EAAE,EAAE;aACb;SACF,EAAE,QAAQ,CAAC,CAAC;KACd;SAAM;QACL,OAAO,MAAM,KAAK,CAAC,SAAS,CAAC;YAC3B,OAAO,EAAE;gBACP,QAAQ,EAAE,EAAE;aACb;YACD,MAAM,EAAE;gBACN,MAAM;gBACN,SAAS;gBACT,OAAO;aACR;SACF,EAAE,QAAQ,CAAC,CAAC;KACd;AACH,CAAC,CAAA,CAAC;AA1BW,QAAA,gBAAgB,oBA0B3B;AAEF;;;;;;;;;;;;;;;;GAgBG;AACI,MAAM,aAAa,GAAG,CAAO,OAAgB,EAClD,OAAkC,EAAE,MAAmB,EAAE,KAAe,EAAE,MAAe,EACzF,iBAA0B,EAAE,QAAQ,GAAG,IAAI,EAAmD,EAAE;IAChG,yDAAyD;IACzD,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;QACtB,OAAO,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;KACrC;IACD,IAAI,QAAQ,GAAG,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,KAAK,CAAC;IACV,IAAI,OAAO,IAAI,OAAO,CAAC,KAAK,EAAE;QAC5B,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;KACvB;IACD,4BAA4B;IAC5B,IAAI,KAAK,EAAE;QACT,MAAM,gBAAgB,GAAG,YAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;QAC1D,IAAI,gBAAgB,KAAK,KAAK,EAAE;YAC9B,OAAO,EAAE,QAAQ,EAAE,qBAAQ,CAAC,MAAM,EAAE,gBAAgB,EAAE,+BAAuB,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,CAAC;SACjG;KACF;IACD,IAAI,YAAY,GAAG,YAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACpD,IAAI,aAAa,GAAG,YAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACrD,iFAAiF;IACjF,8BAA8B;IAC9B,IAAI,YAAY,KAAK,SAAS,EAAE;QAC9B,YAAY,GAAG,IAAI,CAAC;KACrB;IACD,IAAI,aAAa,KAAK,SAAS,EAAE;QAC/B,aAAa,GAAG,IAAI,CAAC;KACtB;IACD,+BAA+B;IAC/B,IAAI,CAAC,YAAY,EAAE;QACjB,OAAO,EAAE,QAAQ,EAAE,qBAAQ,CAAC,MAAM,EAAE,gBAAgB,EAAE,+BAAuB,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,CAAC;KACjG;IAED,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;QACtB,OAAO,EAAE,QAAQ,EAAE,qBAAQ,CAAC,IAAI,EAAE,gBAAgB,EAAE,+BAAuB,CAAC,eAAM,CAAC,kBAAkB,CAAC,IAAI,EAAE,eAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;KAClJ;IAED,IAAI,SAAS,GAAU,EAAE,CAAC;IAC1B,IAAI,SAAS,CAAC;IACd,IAAI,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC;IAChC,0BAA0B;IAC1B,IAAI,OAAO,IAAI,OAAO,CAAC,EAAE,EAAE;QACzB,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC;KACxB;IACD,IAAI,CAAC,MAAM,EAAE;QACX,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;KACzB;IACD,IAAI,cAAc,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,iBAAiB,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IACnF,sBAAsB;IACtB,IAAI,MAAM,IAAI,wBAAW,CAAC,IAAI,IAAI,aAAa,CAAC,OAAO,CAAC;QACtD,mEAAmE;WAChE,CAAC,CAAC,MAAM,IAAI,wBAAW,CAAC,MAAM,IAAI,MAAM,IAAI,wBAAW,CAAC,MAAM,CAAC,IAAI,aAAa,CAAC,OAAO,CAAC,CAAC,EAAE;QAC/F,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC;QACpC,IAAI,iBAAsC,CAAC;QAC3C,IAAI;YACF,uDAAuD;YACvD,wDAAwD;YACxD,iBAAiB,GAAG,MAAM,oBAAoB,CAAC,QAAQ,EAAE,CAAC;oBACxD,IAAI,EAAE,YAAY;oBAClB,SAAS,EAAG,OAAuB,CAAC,SAAS;iBAC9C,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;SAChC;QAAC,OAAO,GAAG,EAAE;YACZ,gBAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACvE,gBAAM,CAAC,KAAK,CAAC,aAAa,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;YACvC,OAAO,EAAE,QAAQ,EAAE,qBAAQ,CAAC,IAAI,EAAE,gBAAgB,EAAE,+BAAuB,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;SACtG;QAED,oCAAoC;QACpC,IAAI,CAAC,CAAC,iBAAiB,IAAI,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC,IAAI,aAAa,EAAE;YACrF,MAAM,GAAG,GAAG,+CAA+C,SAAS,IAAI;gBACtE,YAAY,cAAc,YAAY,MAAM,kBAAkB,WAAW,kCAAkC,CAAC;YAC9G,MAAM,OAAO,GAAG,wCAAwC,CAAC;YACzD,gBAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACpB,gBAAM,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YACxC,OAAO,EAAE,QAAQ,EAAE,qBAAQ,CAAC,IAAI,EAAE,gBAAgB,EAAE,+BAAuB,CAAC,MAAM,CAAC,eAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;SAC5H;QAED,IAAI,CAAC,CAAC,iBAAiB,IAAI,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE;YACtF,gBAAM,CAAC,OAAO,CAAC,kEAAkE;gBAC/E,GAAG,SAAS,cAAc,cAAc,YAAY,MAAM,kBAAkB,WAAW,GAAG;gBAC1F,uEAAuE;gBACvE,8CAA8C,CAAC,CAAC;SACnD;QACD,qDAAqD;QACrD,IAAI,mBAAmB,GAAG,MAAM,8BAAsB,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QACrI,IAAI,CAAC,mBAAmB,IAAI,aAAa,EAAE;YACzC,MAAM,GAAG,GAAG,+CAA+C,SAAS,IAAI;gBACtE,YAAY,cAAc,YAAY,MAAM,kBAAkB,WAAW,yBAAyB,CAAC;YACrG,MAAM,OAAO,GAAG,WAAW,SAAS,yCAAyC,WAAW,GAAG,CAAC;YAC5F,gBAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACpB,gBAAM,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YACxC,OAAO,EAAE,QAAQ,EAAE,qBAAQ,CAAC,IAAI,EAAE,gBAAgB,EAAE,+BAAuB,CAAC,MAAM,CAAC,eAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;SAC5H;QAED,IAAI,CAAC,mBAAmB,IAAI,CAAC,aAAa,EAAE;YAC1C,gBAAM,CAAC,OAAO,CAAC,2DAA2D,SAAS,IAAI;gBACrF,YAAY,cAAc,YAAY,MAAM,kBAAkB,WAAW,IAAI;gBAC7E,wEAAwE,CAAC,CAAC;SAC7E;QAED,uFAAuF;QACvF,kDAAkD;QAClD,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;YAC5E,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;gBACnC,KAAK,IAAI,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE;oBACvC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE;wBAC3C,mBAAmB,CAAC,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC;qBACxC;oBACD,mBAAmB,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;iBAC1C;aACF;iBAAM;gBACL,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE;oBAC3C,mBAAmB,CAAC,OAAO,GAAG,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;iBAC7D;gBACD,mBAAmB,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;aACxD;SACF;QACD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;QACjD,iBAAiB,CAAC,QAAQ,GAAG,qBAAQ,CAAC,MAAM,CAAC,CAAC,oEAAoE;QAClH,iBAAiB,CAAC,gBAAgB,GAAG,+BAAuB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC7E,OAAO,iBAAiB,CAAC;KAC1B;IAED,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;QACvB,SAAS,GAAG,CAAC,OAAO,CAAC,CAAC;KACvB;SAAM;QACL,SAAS,GAAG,OAAO,CAAC;KACrB;IAED,eAAe;IACf,IAAI,gBAAgB,GAAqB,EAAE,QAAQ,EAAE,qBAAQ,CAAC,IAAI,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC;IACjH,IAAI,YAAY,GAAG,EAAE,CAAC;IACtB,uBAAuB;IACvB,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,MAAM,KAAK,wBAAW,CAAC,MAAM;QACxD,MAAM,KAAK,wBAAW,CAAC,OAAO,IAAI,MAAM,KAAK,wBAAW,CAAC,IAAI,EAAE;QAC/D,yBAAyB;QACzB,KAAK,IAAI,QAAQ,IAAI,SAAS,EAAE;YAC9B,YAAY,CAAC,IAAI,CAAC;gBAChB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;gBACxB,QAAQ,EAAE,QAAQ;gBAClB,IAAI,EAAE,MAAM;gBACZ,SAAS,EAAE,iBAAiB;aAC7B,CAAC,CAAC;SACJ;QACD,gBAAgB;QAChB,IAAI;YACF,gBAAgB,GAAG,MAAM,wBAAgB,CAAC,QAAmB,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;SACvG;QAAC,OAAO,GAAG,EAAE;YACZ,OAAO,EAAE,QAAQ,EAAE,qBAAQ,CAAC,IAAI,EAAE,gBAAgB,EAAE,+BAAuB,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;SACtG;QAED,IAAI,gBAAgB,IAAI,gBAAgB,CAAC,QAAQ,IAAI,qBAAQ,CAAC,MAAM,IAAI,aAAa,EAAE;YACrF,IAAI,OAAO,GAAG,EAAE,CAAC;YACjB,IAAI,gBAAgB,CAAC,QAAQ,KAAK,qBAAQ,CAAC,aAAa,EAAE;gBACxD,OAAO,GAAG,qCAAqC,CAAC;aACjD;iBAAM,IAAI,gBAAgB,CAAC,QAAQ,KAAK,qBAAQ,CAAC,IAAI,EAAE;gBACtD,OAAO,GAAG,WAAW,SAAS,mDAAmD,WAAW,EAAE,CAAC;aAChG;YACD,MAAM,GAAG,GAAG,+CAA+C,SAAS,IAAI;gBACtE,YAAY,cAAc,YAAY,MAAM,kBAAkB,WAAW,sBAAsB,gBAAgB,CAAC,QAAQ,EAAE,CAAC;YAC7H,gBAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACpB,gBAAM,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YACxC,OAAO,EAAE,QAAQ,EAAE,qBAAQ,CAAC,IAAI,EAAE,gBAAgB,EAAE,+BAAuB,CAAC,MAAM,CAAC,eAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;SAC5H;KACF;IACD,IAAI,CAAC,aAAa,IAAI,gBAAgB,IAAI,gBAAgB,CAAC,QAAQ,IAAI,qBAAQ,CAAC,MAAM,EAAE;QACtF,IAAI,OAAO,GAAG,EAAE,CAAC;QACjB,IAAI,gBAAgB,CAAC,QAAQ,KAAK,qBAAQ,CAAC,aAAa,EAAE;YACxD,OAAO,GAAG,qCAAqC,CAAC;SACjD;aAAM,IAAI,gBAAgB,CAAC,QAAQ,KAAK,qBAAQ,CAAC,IAAI,EAAE;YACtD,OAAO,GAAG,WAAW,SAAS,mDAAmD,WAAW,EAAE,CAAC;SAChG;QACD,gBAAM,CAAC,OAAO,CAAC,+CAA+C,SAAS,IAAI;YACzE,YAAY,cAAc,YAAY,MAAM,kBAAkB,WAAW,sBAAsB,gBAAgB,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC9H,gBAAM,CAAC,OAAO,CAAC,GAAG,OAAO,+DAA+D,CAAC,CAAC;QAC1F,gBAAgB,CAAC,QAAQ,GAAG,qBAAQ,CAAC,MAAM,CAAC;KAC7C;IACD,OAAO,gBAAgB,CAAC;AAC1B,CAAC,CAAA,CAAC;AAnLW,QAAA,aAAa,iBAmLxB;AAEF;;;;;;GAMG;AACI,MAAM,SAAS,GAAG,CAAO,OAAmB,EACjD,KAAe,EAA6B,EAAE;IAC9C,IAAI,iBAAmC,CAAC;IACxC,IAAI;QACF,iBAAiB,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;KACxD;IAAC,OAAO,GAAG,EAAE;QACZ,gBAAM,CAAC,KAAK,CAAC,yCAAyC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QACrE,gBAAM,CAAC,KAAK,CAAC,aAAa,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QACvC,OAAO,EAAE,QAAQ,EAAE,qBAAQ,CAAC,IAAI,EAAE,gBAAgB,EAAE,+BAAuB,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;KACtG;IAED,OAAO,iBAAiB,CAAC;AAC3B,CAAC,CAAA,CAAC;AAZW,QAAA,SAAS,aAYpB;AAEF;;;;;;GAMG;AACI,MAAM,aAAa,GAAG,CAAO,OAAmB,EACrD,KAAe,EAAgC,EAAE;IACjD,IAAI,qBAA0C,CAAC;IAC/C,IAAI;QACF,qBAAqB,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;KAChE;IAAC,OAAO,GAAG,EAAE;QACZ,gBAAM,CAAC,KAAK,CAAC,6CAA6C,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QACzE,gBAAM,CAAC,KAAK,CAAC,aAAa,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QACvC,OAAO,EAAE,QAAQ,EAAE,qBAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,gBAAgB,EAAE,+BAAuB,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;KACvH;IAED,OAAO,qBAAqB,CAAC;AAC/B,CAAC,CAAA,CAAC;AAZW,QAAA,aAAa,iBAYxB"}
+{"version":3,"file":"resolver.js","sourceRoot":"","sources":["../../src/acs/resolver.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,4BAA4B;AAC5B,6CAGsB;AAEtB,sCAA+B;AAC/B,sCAAwC;AACxC,oCAA6F;AAC7F,8DAA0D;AAC1D,mCAAmD;AAGnD,MAAM,wBAAwB,GAAG,CAAC,OAAY,EAAqC,EAAE;IACnF,OAAO,CAAC,CAAC,OAAO;WACX,iBAAiB,IAAI,OAAO,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAClE,CAAC,CAAC;AAEF,MAAM,oBAAoB,GAAG,CAAO,OAAgB,EAAE,QAAoB,EACxE,MAAmB,EAAE,GAAqB,EAAE,QAAiB,EAAE,EAAE;IACjE,IAAI,wBAAwB,CAAC,OAAO,CAAC,EAAE;QACrC,MAAM,UAAU,GAAG,YAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,IAAI,wBAAU,CAAC,UAAU,EAAE,gBAAM,CAAC,CAAC;QACrD,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;QACjC,OAAO,MAAM,IAAI,eAAO,CAAC,GAAG,CAAC,CAAC,aAAa,CAAC;YAC1C,MAAM,EAAE;gBACN,OAAO,EAAG,OAA+B,EAAE,QAAQ,EAAE,MAAM;aAC5D;YACD,OAAO,EAAE;gBACP,QAAQ,EAAE,EAAE;aACb;SACF,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;KACnB;SAAM;QACL,OAAO,MAAM,aAAK,CAAC,aAAa,CAAC;YAC/B,OAAO,EAAE;gBACP,QAAQ,EAAE,EAAE;aACb;YACD,MAAM,EAAE;gBACN,OAAO;gBACP,QAAQ;gBACR,MAAM;aACP;SACF,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;KACnB;AACH,CAAC,CAAA,CAAC;AAEK,MAAM,gBAAgB,GAAG,CAAO,OAAgB,EACrD,QAAoB,EAAE,MAAmB,EAAE,GAAqB,EAAE,QAAiB,EAA6B,EAAE;IAClH,IAAI,wBAAwB,CAAC,OAAO,CAAC,EAAE;QACrC,MAAM,UAAU,GAAG,YAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,IAAI,wBAAU,CAAC,UAAU,EAAE,gBAAM,CAAC,CAAC;QACrD,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;QACjC,OAAO,MAAM,IAAI,eAAO,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC;YACtC,MAAM,EAAE;gBACN,OAAO,EAAG,OAA+B,EAAE,QAAQ,EAAE,MAAM;aAC5D;YACD,OAAO,EAAE;gBACP,QAAQ,EAAE,EAAE;aACb;SACF,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;KACnB;SAAM;QACL,OAAO,MAAM,aAAK,CAAC,SAAS,CAAC;YAC3B,OAAO,EAAE;gBACP,QAAQ,EAAE,EAAE;aACb;YACD,MAAM,EAAE;gBACN,OAAO;gBACP,QAAQ;gBACR,MAAM;aACP;SACF,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;KACnB;AACH,CAAC,CAAA,CAAC;AA1BW,QAAA,gBAAgB,oBA0B3B;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACI,MAAM,aAAa,GAAG,CAAO,OAAgB,EAAE,QAAoB,EACxE,MAAmB,EAAE,GAAqB,EAAE,SAAqB,EACjE,QAAkC,EAAE,QAAQ,GAAG,IAAI,EAAmD,EAAE;IACxG,yDAAyD;IACzD,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;QACtB,OAAO,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;KACrC;IACD,IAAI,QAAQ,GAAG,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,KAAK,CAAC;IACV,IAAI,OAAO,IAAI,OAAO,CAAC,KAAK,EAAE;QAC5B,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;KACvB;IACD,4BAA4B;IAC5B,IAAI,KAAK,EAAE;QACT,MAAM,gBAAgB,GAAG,YAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;QAC1D,IAAI,gBAAgB,KAAK,KAAK,EAAE;YAC9B,OAAO,EAAE,QAAQ,EAAE,qBAAQ,CAAC,MAAM,EAAE,gBAAgB,EAAE,+BAAuB,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,CAAC;SACjG;KACF;IACD,IAAI,YAAY,GAAG,YAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACpD,IAAI,aAAa,GAAG,YAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACrD,iFAAiF;IACjF,8BAA8B;IAC9B,IAAI,YAAY,KAAK,SAAS,EAAE;QAC9B,YAAY,GAAG,IAAI,CAAC;KACrB;IACD,IAAI,aAAa,KAAK,SAAS,EAAE;QAC/B,aAAa,GAAG,IAAI,CAAC;KACtB;IACD,+BAA+B;IAC/B,IAAI,CAAC,YAAY,EAAE;QACjB,OAAO,EAAE,QAAQ,EAAE,qBAAQ,CAAC,MAAM,EAAE,gBAAgB,EAAE,+BAAuB,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,CAAC;KACjG;IAED,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;QACtB,OAAO,EAAE,QAAQ,EAAE,qBAAQ,CAAC,IAAI,EAAE,gBAAgB,EAAE,+BAAuB,CAAC,eAAM,CAAC,kBAAkB,CAAC,IAAI,EAAE,eAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;KAClJ;IAED,IAAI,SAAS,CAAC;IACd,IAAI,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC;IAChC,0BAA0B;IAC1B,IAAI,OAAO,IAAI,OAAO,CAAC,EAAE,EAAE;QACzB,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC;KACxB;IAED,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;QACxB,QAAQ,GAAG,CAAC,QAAQ,CAAC,CAAC;KACvB;IAED,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;QACvB,MAAM,GAAG,GAAG,+CAA+C,SAAS,IAAI;YACtE,YAAY,QAAQ,YAAY,MAAM,kBAAkB,WAAW,kCAAkC,CAAC;QACxG,MAAM,OAAO,GAAG,gBAAgB,CAAC;QACjC,gBAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpB,gBAAM,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACxC,OAAO,EAAE,QAAQ,EAAE,qBAAQ,CAAC,IAAI,EAAE,gBAAgB,EAAE,+BAAuB,CAAC,MAAM,CAAC,eAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;KAC5H;IAED,qCAAqC;IACrC,IAAI,CAAC,SAAS,EAAE;QACd,SAAS,GAAG,sBAAS,CAAC,SAAS,CAAC;KACjC;IAED,+BAA+B;IAC/B,IAAI,CAAC,QAAQ,EAAE;QACb,QAAQ,GAAG,UAAU,CAAC;KACvB;IAED,gBAAgB;IAChB,IAAI,GAAG,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE;QAC9C,GAAG,CAAC,SAAS,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;KACjC;IAED,0BAA0B;IAC1B,IAAI,SAAS,KAAK,sBAAS,CAAC,aAAa,EAAE;QACzC,uCAAuC;QACvC,IAAI,iBAAsC,CAAC;QAC3C,IAAI;YACF,uDAAuD;YACvD,wDAAwD;YACxD,iBAAiB,GAAG,MAAM,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;SAC3F;QAAC,OAAO,GAAG,EAAE;YACZ,gBAAM,CAAC,KAAK,CAAC,uCAAuC,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YAChF,gBAAM,CAAC,KAAK,CAAC,aAAa,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;YACvC,OAAO,EAAE,QAAQ,EAAE,qBAAQ,CAAC,IAAI,EAAE,gBAAgB,EAAE,+BAAuB,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;SACtG;QAED,oCAAoC;QACpC,IAAI,CAAC,CAAC,iBAAiB,IAAI,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC,IAAI,aAAa,EAAE;YACrF,MAAM,GAAG,GAAG,+CAA+C,SAAS,IAAI;gBACtE,YAAY,QAAQ,YAAY,MAAM,kBAAkB,WAAW,kCAAkC,CAAC;YACxG,MAAM,OAAO,GAAG,wCAAwC,CAAC;YACzD,gBAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACpB,gBAAM,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YACxC,OAAO,EAAE,QAAQ,EAAE,qBAAQ,CAAC,IAAI,EAAE,gBAAgB,EAAE,+BAAuB,CAAC,MAAM,CAAC,eAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;SAC5H;QAED,IAAI,CAAC,CAAC,iBAAiB,IAAI,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE;YACtF,gBAAM,CAAC,OAAO,CAAC,kEAAkE;gBAC/E,GAAG,SAAS,cAAc,QAAQ,YAAY,MAAM,kBAAkB,WAAW,GAAG;gBACpF,uEAAuE;gBACvE,8CAA8C,CAAC,CAAC;SACnD;QAED,sFAAsF;QACtF,MAAM,eAAe,GAAG,MAAM,6BAAqB,CAAC,QAAQ,EAAE,iBAAiB,EAC7E,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAEpF,IAAK,eAAoC,CAAC,QAAQ,EAAE;YAClD,OAAO,eAAmC,CAAC;SAC5C;QAED,iBAAiB,CAAC,OAAO,GAAI,eAAqC,CAAC,eAAe,CAAC;QACnF,iBAAiB,CAAC,iBAAiB,GAAI,eAAqC,CAAC,eAAe,CAAC;QAC7F,iBAAiB,CAAC,QAAQ,GAAG,qBAAQ,CAAC,MAAM,CAAC,CAAC,oEAAoE;QAClH,iBAAiB,CAAC,gBAAgB,GAAG,+BAAuB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC7E,OAAO,iBAAiB,CAAC;KAC1B;IAED,IAAI,YAAY,GAAG,EAAE,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE;QAC/B,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IACH,IAAI,cAAc,CAAC;IACnB,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE;QAC7B,cAAc,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;KAClC;SAAM;QACL,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;KAC/C;IACD,eAAe;IACf,IAAI,gBAAgB,GAAqB,EAAE,QAAQ,EAAE,qBAAQ,CAAC,IAAI,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC;IACjH,sBAAsB;IACtB,IAAI,SAAS,KAAK,sBAAS,CAAC,SAAS,EAAE;QACrC,gBAAgB;QAChB,IAAI;YACF,gBAAgB,GAAG,MAAM,wBAAgB,CAAC,QAAmB,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;SACjG;QAAC,OAAO,GAAG,EAAE;YACZ,gBAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YAC5E,gBAAM,CAAC,KAAK,CAAC,aAAa,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;YACvC,OAAO,EAAE,QAAQ,EAAE,qBAAQ,CAAC,IAAI,EAAE,gBAAgB,EAAE,+BAAuB,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;SACtG;QAED,IAAI,gBAAgB,IAAI,gBAAgB,CAAC,QAAQ,IAAI,qBAAQ,CAAC,MAAM,IAAI,aAAa,EAAE;YACrF,IAAI,OAAO,GAAG,EAAE,CAAC;YACjB,IAAI,gBAAgB,CAAC,QAAQ,KAAK,qBAAQ,CAAC,aAAa,EAAE;gBACxD,OAAO,GAAG,qCAAqC,CAAC;aACjD;iBAAM,IAAI,gBAAgB,CAAC,QAAQ,KAAK,qBAAQ,CAAC,IAAI,EAAE;gBACtD,OAAO,GAAG,WAAW,SAAS,mDAAmD,WAAW,EAAE,CAAC;aAChG;YACD,MAAM,GAAG,GAAG,+CAA+C,SAAS,IAAI;gBACtE,YAAY,cAAc,YAAY,MAAM,kBAAkB,WAAW,sBAAsB,gBAAgB,CAAC,QAAQ,EAAE,CAAC;YAC7H,gBAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACpB,gBAAM,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YACxC,OAAO,EAAE,QAAQ,EAAE,qBAAQ,CAAC,IAAI,EAAE,gBAAgB,EAAE,+BAAuB,CAAC,MAAM,CAAC,eAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;SAC5H;KACF;IACD,IAAI,CAAC,aAAa,IAAI,gBAAgB,IAAI,gBAAgB,CAAC,QAAQ,IAAI,qBAAQ,CAAC,MAAM,EAAE;QACtF,IAAI,OAAO,GAAG,EAAE,CAAC;QACjB,IAAI,gBAAgB,CAAC,QAAQ,KAAK,qBAAQ,CAAC,aAAa,EAAE;YACxD,OAAO,GAAG,qCAAqC,CAAC;SACjD;aAAM,IAAI,gBAAgB,CAAC,QAAQ,KAAK,qBAAQ,CAAC,IAAI,EAAE;YACtD,OAAO,GAAG,WAAW,SAAS,mDAAmD,WAAW,EAAE,CAAC;SAChG;QACD,gBAAM,CAAC,OAAO,CAAC,+CAA+C,SAAS,IAAI;YACzE,YAAY,cAAc,YAAY,MAAM,kBAAkB,WAAW,sBAAsB,gBAAgB,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC9H,gBAAM,CAAC,OAAO,CAAC,GAAG,OAAO,+DAA+D,CAAC,CAAC;QAC1F,gBAAgB,CAAC,QAAQ,GAAG,qBAAQ,CAAC,MAAM,CAAC;KAC7C;IACD,OAAO,gBAAgB,CAAC;AAC1B,CAAC,CAAA,CAAC;AAzKW,QAAA,aAAa,iBAyKxB;AAEF;;;;;;GAMG;AACI,MAAM,SAAS,GAAG,CAAO,OAAmB,EACjD,KAAe,EAA6B,EAAE;IAC9C,IAAI,iBAAmC,CAAC;IACxC,IAAI;QACF,iBAAiB,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;KACxD;IAAC,OAAO,GAAG,EAAE;QACZ,gBAAM,CAAC,KAAK,CAAC,yCAAyC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QACrE,gBAAM,CAAC,KAAK,CAAC,aAAa,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QACvC,OAAO,EAAE,QAAQ,EAAE,qBAAQ,CAAC,IAAI,EAAE,gBAAgB,EAAE,+BAAuB,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;KACtG;IAED,OAAO,iBAAiB,CAAC;AAC3B,CAAC,CAAA,CAAC;AAZW,QAAA,SAAS,aAYpB;AAEF;;;;;;GAMG;AACI,MAAM,aAAa,GAAG,CAAO,OAAmB,EACrD,KAAe,EAAgC,EAAE;IACjD,IAAI,qBAA0C,CAAC;IAC/C,IAAI;QACF,qBAAqB,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;KAChE;IAAC,OAAO,GAAG,EAAE;QACZ,gBAAM,CAAC,KAAK,CAAC,6CAA6C,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QACzE,gBAAM,CAAC,KAAK,CAAC,aAAa,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QACvC,OAAO,EAAE,QAAQ,EAAE,qBAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,gBAAgB,EAAE,+BAAuB,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;KACvH;IAED,OAAO,qBAAqB,CAAC;AAC/B,CAAC,CAAA,CAAC;AAZW,QAAA,aAAa,iBAYxB"}

package/lib/utils.d.ts

@@ -1,10 +1,39 @@
-import { RoleAssociation, UserScope, Subject, PolicySetRQ } from './acs/interfaces';
+import { RoleAssociation, UserScope, Subject, PolicySetRQ, PolicySetRQResponse, Attribute, EnityFilterMap, CustomQueryArgs, DecisionResponse, Resource, AuthZAction, ResolvedSubject } from './acs/interfaces';
 import { QueryArguments, UserQueryArguments } from './acs/resolver';
-import { ACSAuthZ } from './acs/authz';
 export declare const reduceRoleAssociations: (roleAssociations: RoleAssociation[], scopeID: string) => Promise<UserScope>;
 export declare const handleError: (err: string | Error | any) => any;
-export declare const buildFilterPermissions: (policySet: PolicySetRQ, subject: Subject, reqResources: any, authZ: ACSAuthZ, database?: string) => Promise<QueryArguments | UserQueryArguments>;
+export declare const buildFilterPermissions: (policySet: PolicySetRQ, subject: ResolvedSubject, reqResources: any, database: string) => Promise<QueryArguments | UserQueryArguments>;
 export declare const generateOperationStatus: (code?: number, message?: string) => {
     code: number;
     message: string;
 };
+/**
+ * Check if the attributes of a resources from a rule, policy
+ * or policy set match the attributes from a request.
+ *
+ * @param ruleAttributes
+ * @param requestAttributes
+ */
+export declare const attributesMatch: (ruleAttributes: Attribute[], requestAttributes: Attribute[]) => boolean;
+export interface FilterMapResponse {
+    entityFilterMap: EnityFilterMap[];
+    customQueryArgs: CustomQueryArgs[];
+}
+/**
+ * creates entity filters and custom query / arguments for the entity list provided
+ * It iterates through each entity and filter the applicable policies and
+ * provide them to buildFilterPermissions to create filters for each of the entities requested
+ *
+ * @param {Entity[]} entity Contains entity name, entity instance and optional entity properties
+ * @param {PolicSetResponse} policySetResponse contains set of applicable policies for entities list
+ * @param {any} resources context resources
+ * @param {AuthZAction} action Action to be performed on resource
+ * @param {Subject} subject Contains subject information or ApiKey
+ * @param {string} subjectID resolved subject identifier from token
+ * @param {boolean} authzEnforced authorization enforcement flag
+ * @param {string} targetScope target scope
+ * @param {Database} database database used either `arangoDB` or `postgres`,
+ * if this param is missing defaults to `arangoDB`
+ *
+ */
+export declare const createEntityFilterMap: (resource: Resource[], policySetResponse: PolicySetRQResponse, resources: any, action: AuthZAction, subject: Subject, subjectID: string, authzEnforced: boolean, targetScope: string, database: 'arangoDB' | 'postgres') => Promise<FilterMapResponse | DecisionResponse>;

package/lib/utils.js

@@ -9,13 +9,14 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.generateOperationStatus = exports.buildFilterPermissions = exports.handleError = exports.reduceRoleAssociations = void 0;
+exports.createEntityFilterMap = exports.attributesMatch = exports.generateOperationStatus = exports.buildFilterPermissions = exports.handleError = exports.reduceRoleAssociations = void 0;
 const interfaces_1 = require("./acs/interfaces");
 const _ = require("lodash");
 const config_1 = require("./config");
 const nodeEval = require("node-eval");
 const logger_1 = require("./logger");
 const cache_1 = require("./acs/cache");
+const authz_1 = require("./acs/authz");
 const reduceRoleAssociations = (roleAssociations, scopeID) => __awaiter(void 0, void 0, void 0, function* () {
     const urns = config_1.cfg.get('authorization:urns');
     const scope = {
@@ -232,7 +233,7 @@ const buildQueryFromTarget = (target, effect, userTotalScope, urns, userConditio
         }
     }
     const scopingAttribute = _.find(subject, (attribute) => attribute.id == urns.roleScopingEntity);
-    if (!!scopingAttribute && effect == interfaces_1.Effect.PERMIT && !database) { // note: there is currently no query to exclude scopes
+    if (!!scopingAttribute && effect == interfaces_1.Effect.PERMIT && database === 'arangoDB') { // note: there is currently no query to exclude scopes
         // userTotalScope is an array accumulated scopes for each rule
         if (userCondition) {
             filter = [];
@@ -305,7 +306,7 @@ const buildQueryFromTarget = (target, effect, userTotalScope, urns, userConditio
     query.userCondition = userCondition;
     return query;
 };
-const buildFilterPermissions = (policySet, subject, reqResources, authZ, database) => __awaiter(void 0, void 0, void 0, function* () {
+const buildFilterPermissions = (policySet, subject, reqResources, database) => __awaiter(void 0, void 0, void 0, function* () {
     let hierarchical_scopes = subject && subject.hierarchical_scopes ? subject.hierarchical_scopes : [];
     let role_associations = subject && subject.role_associations ? subject.role_associations : [];
     if (_.isEmpty(role_associations) || _.isEmpty(hierarchical_scopes)) {
@@ -461,4 +462,169 @@ const generateOperationStatus = (code, message) => {
     };
 };
 exports.generateOperationStatus = generateOperationStatus;
+/**
+ * Check if the attributes of a resources from a rule, policy
+ * or policy set match the attributes from a request.
+ *
+ * @param ruleAttributes
+ * @param requestAttributes
+ */
+const attributesMatch = (ruleAttributes, requestAttributes) => {
+    for (let attribute of ruleAttributes) {
+        const id = attribute.id;
+        const value = attribute.value;
+        const match = !!requestAttributes.find((requestAttribute) => {
+            // return requestAttribute.id == id && requestAttribute.value == value;
+            if (requestAttribute.id == id && requestAttribute.value == value) {
+                return true;
+            }
+            else if (requestAttribute.id == id) {
+                // rule entity
+                let pattern = value.substring(value.lastIndexOf(':') + 1);
+                let nsEntityArray = pattern.split('.');
+                // firstElement could be either entity or namespace
+                let nsOrEntity = nsEntityArray[0];
+                let entityRegexValue = nsEntityArray[nsEntityArray.length - 1];
+                let reqNS, ruleNS;
+                if (nsOrEntity.toUpperCase() != entityRegexValue.toUpperCase()) {
+                    // rule name space is present
+                    ruleNS = nsOrEntity.toUpperCase();
+                }
+                // request entity
+                let reqValue = requestAttribute.value;
+                const reqAttributeNS = reqValue.substring(0, reqValue.lastIndexOf(':'));
+                const ruleAttributeNS = value.substring(0, value.lastIndexOf(':'));
+                // verify namespace before entity name
+                if (reqAttributeNS != ruleAttributeNS) {
+                    return false;
+                }
+                let reqPattern = reqValue.substring(reqValue.lastIndexOf(':') + 1);
+                let reqNSEntityArray = reqPattern.split('.');
+                // firstElement could be either entity or namespace
+                let reqNSOrEntity = reqNSEntityArray[0];
+                let requestEntityValue = reqNSEntityArray[reqNSEntityArray.length - 1];
+                if (reqNSOrEntity.toUpperCase() != requestEntityValue.toUpperCase()) {
+                    // request name space is present
+                    reqNS = reqNSOrEntity.toUpperCase();
+                }
+                if ((reqNS && ruleNS && (reqNS === ruleNS)) || (!reqNS && !ruleNS)) {
+                    const reExp = new RegExp(entityRegexValue);
+                    if (requestEntityValue.match(reExp)) {
+                        return true;
+                    }
+                }
+            }
+            else {
+                return false;
+            }
+        });
+        if (!match) {
+            return false;
+        }
+    }
+    return true;
+};
+exports.attributesMatch = attributesMatch;
+/**
+ * creates entity filters and custom query / arguments for the entity list provided
+ * It iterates through each entity and filter the applicable policies and
+ * provide them to buildFilterPermissions to create filters for each of the entities requested
+ *
+ * @param {Entity[]} entity Contains entity name, entity instance and optional entity properties
+ * @param {PolicSetResponse} policySetResponse contains set of applicable policies for entities list
+ * @param {any} resources context resources
+ * @param {AuthZAction} action Action to be performed on resource
+ * @param {Subject} subject Contains subject information or ApiKey
+ * @param {string} subjectID resolved subject identifier from token
+ * @param {boolean} authzEnforced authorization enforcement flag
+ * @param {string} targetScope target scope
+ * @param {Database} database database used either `arangoDB` or `postgres`,
+ * if this param is missing defaults to `arangoDB`
+ *
+ */
+const createEntityFilterMap = (resource, policySetResponse, resources, action, subject, subjectID, authzEnforced, targetScope, database) => __awaiter(void 0, void 0, void 0, function* () {
+    let entityFilterMap = [];
+    let customQueryArgs = [];
+    for (let resourceObj of resource) {
+        let resourcenameNameSpace = resourceObj.resource;
+        let resourceNameSpace, resourceName;
+        if (resourcenameNameSpace && resourcenameNameSpace.indexOf('.') > -1) {
+            resourceNameSpace = resourcenameNameSpace.slice(0, resourcenameNameSpace.lastIndexOf('.'));
+            // resource name from `.` till end, when no end index is specified for
+            // slice api it returns till end of string
+            resourceName = resourcenameNameSpace.slice(resourcenameNameSpace.lastIndexOf('.') + 1);
+        }
+        else {
+            resourceName = resourcenameNameSpace;
+        }
+        const resourceType = authz_1.formatResourceType(resourceName, resourceNameSpace);
+        const urns = config_1.cfg.get('authorization:urns');
+        const resourceValueURN = (urns === null || urns === void 0 ? void 0 : urns.model) + `:${resourceType}`;
+        let resourcePolicies = { policy_sets: [{ policies: [] }] };
+        const resourceAttributes = [{ id: urns === null || urns === void 0 ? void 0 : urns.entity, value: resourceValueURN }];
+        if (policySetResponse && policySetResponse.policy_sets && policySetResponse.policy_sets.length > 0) {
+            policySetResponse.policy_sets.forEach((policySet) => {
+                var _a, _b, _c;
+                const policies = policySet.policies;
+                // check if the policy and rule set is applicable to the enitity
+                if (policies && policies.length > 0) {
+                    for (let policy of policies) {
+                        const policyTargetResources = (_a = policy === null || policy === void 0 ? void 0 : policy.target) === null || _a === void 0 ? void 0 : _a.resources;
+                        if (policyTargetResources) {
+                            const policyMatch = exports.attributesMatch(policyTargetResources, resourceAttributes);
+                            if (policyMatch && policy.rules && policy.rules.length > 0) {
+                                for (let rule of policy.rules) {
+                                    const ruleMatch = exports.attributesMatch((_b = rule === null || rule === void 0 ? void 0 : rule.target) === null || _b === void 0 ? void 0 : _b.resources, resourceAttributes);
+                                    if (ruleMatch) {
+                                        resourcePolicies.policy_sets[0].policies.push(policy);
+                                        break;
+                                    }
+                                }
+                            }
+                        }
+                        else if (policy === null || policy === void 0 ? void 0 : policy.rules) {
+                            // check for rule
+                            for (let rule of policy.rules) {
+                                const ruleMatch = exports.attributesMatch((_c = rule === null || rule === void 0 ? void 0 : rule.target) === null || _c === void 0 ? void 0 : _c.resources, resourceAttributes);
+                                if (ruleMatch) {
+                                    resourcePolicies.policy_sets[0].policies.push(policy);
+                                    break;
+                                }
+                            }
+                        }
+                    }
+                }
+            });
+        }
+        let permissionArguments = yield exports.buildFilterPermissions(resourcePolicies.policy_sets[0], subject, resources, database);
+        if (!permissionArguments && authzEnforced) {
+            const msg = `Access not allowed for request with subject:${subjectID}, ` +
+                `resource:${resourceName}, action:${action}, target_scope:${targetScope}; the response was DENY`;
+            const details = `Subject:${subjectID} does not have access to target scope ${targetScope}}`;
+            logger_1.default.verbose(msg);
+            logger_1.default.verbose('Details:', { details });
+            return { decision: interfaces_1.Decision.DENY, operation_status: exports.generateOperationStatus(Number(config_1.errors.ACTION_NOT_ALLOWED.code), msg) };
+        }
+        if (!permissionArguments && !authzEnforced) {
+            logger_1.default.verbose(`The Access response was DENY for a request from subject:${subjectID}, ` +
+                `resource:${resourceName}, action:${action}, target_scope:${targetScope}, ` +
+                `but since ACS enforcement config is disabled overriding the ACS result`);
+        }
+        if (!_.isArray(permissionArguments.filters)) {
+            permissionArguments.filters = [permissionArguments.filters];
+        }
+        entityFilterMap.push({ resource: resourceName, filters: permissionArguments.filters });
+        if (permissionArguments.custom_queries && permissionArguments.custom_arguments) {
+            customQueryArgs.push({
+                resource: resourceName,
+                custom_queries: permissionArguments.custom_queries,
+                custom_arguments: permissionArguments.custom_arguments
+            });
+        }
+    }
+    return {
+        entityFilterMap, customQueryArgs
+    };
+});
+exports.createEntityFilterMap = createEntityFilterMap;
 //# sourceMappingURL=utils.js.map