@spinajs/rbac-http-admin 2.0.485 → 2.0.487

package/lib/mjs/controllers/Users/Roles.js

@@ -10,10 +10,15 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { BaseController, BasePath, Body, Ok, Param, Patch, Policy } from '@spinajs/http';
-import { grant, revoke } from '@spinajs/rbac';
-import { AuthorizedPolicy, Permission, Resource } from "@spinajs/rbac-http";
+import { AutoinjectService } from '@spinajs/configuration';
+import { BaseController, BasePath, Body, Ok, Patch, Policy } from '@spinajs/http';
+import { FromModel } from '@spinajs/orm-http';
+import { grant, revoke, User } from '@spinajs/rbac';
+import { AuthorizedPolicy, Permission, Resource, User as CurrentUser } from '@spinajs/rbac-http';
 import { Schema } from '@spinajs/validation';
+import { RoleGuard } from '../../interfaces.js';
+// Side effect only — see the note in Users.ts.
+import '../../services/RoleGuard.js';
 let RoleDto = class RoleDto {
     constructor(data) {
         Object.assign(this, data);
@@ -30,9 +35,14 @@ RoleDto = __decorate([
     }),
     __metadata("design:paramtypes", [Object])
 ], RoleDto);
+export { RoleDto };
 /**
  * User role management (admin).
  * Grants and revokes RBAC roles for user accounts.
+ *
+ * Both routes run the configured {@link RoleGuard} before touching anything: a
+ * role is the one thing in this API that can grant MORE than the caller has, so
+ * "may update users" is not by itself an answer to "may hand out this role".
  * @tags Admin Users
  */
 let Roles = class Roles extends BaseController {
@@ -42,13 +52,14 @@ let Roles = class Roles extends BaseController {
      * @security cookieAuth
      * @param login User login name
      * @response 200 Role granted successfully
-     * @response 400 Invalid role name
+     * @response 400 Unknown role name
      * @response 401 Unauthorized — valid session required
-     * @response 403 Forbidden — updateAny permission required on users resource
+     * @response 403 Forbidden — updateAny permission required, or the role grants more than the caller holds
      * @response 404 User not found
      */
-    async addRole(login, roleDto) {
-        await grant(login, roleDto.role);
+    async addRole(actor, user, roleDto) {
+        await this.RoleGuard.assertCanAssignRoles(actor, user, [roleDto.role]);
+        await grant(user, roleDto.role);
         return new Ok();
     }
     /**
@@ -57,32 +68,39 @@ let Roles = class Roles extends BaseController {
      * @security cookieAuth
      * @param login User login name
      * @response 200 Role revoked successfully
-     * @response 400 Invalid role name
+     * @response 400 Unknown role name
      * @response 401 Unauthorized — valid session required
-     * @response 403 Forbidden — updateAny permission required on users resource
+     * @response 403 Forbidden — updateAny permission required, or the revocation would lock the caller or the installation out
      * @response 404 User not found
      */
-    async revokeRole(login, roleDto) {
-        await revoke(login, roleDto.role);
+    async revokeRole(actor, user, roleDto) {
+        await this.RoleGuard.assertCanRevokeRole(actor, user, roleDto.role);
+        await revoke(user, roleDto.role);
         return new Ok();
     }
 };
+__decorate([
+    AutoinjectService('rbac.admin.roleGuard'),
+    __metadata("design:type", RoleGuard)
+], Roles.prototype, "RoleGuard", void 0);
 __decorate([
     Patch('add/:login'),
     Permission(['updateAny']),
-    __param(0, Param()),
-    __param(1, Body()),
+    __param(0, CurrentUser()),
+    __param(1, FromModel({ queryField: 'Login', paramField: 'login', include: ['Metadata'] })),
+    __param(2, Body()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String, RoleDto]),
+    __metadata("design:paramtypes", [User, User, RoleDto]),
     __metadata("design:returntype", Promise)
 ], Roles.prototype, "addRole", null);
 __decorate([
     Patch('revoke/:login'),
     Permission(['updateAny']),
-    __param(0, Param()),
-    __param(1, Body()),
+    __param(0, CurrentUser()),
+    __param(1, FromModel({ queryField: 'Login', paramField: 'login', include: ['Metadata'] })),
+    __param(2, Body()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String, RoleDto]),
+    __metadata("design:paramtypes", [User, User, RoleDto]),
     __metadata("design:returntype", Promise)
 ], Roles.prototype, "revokeRole", null);
 Roles = __decorate([

package/lib/mjs/controllers/Users/Roles.js.map

@@ -1 +1 @@
-{"version":3,"file":"Roles.js","sourceRoot":"","sources":["../../../../src/controllers/Users/Roles.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACzF,OAAO,EAAS,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAG7C,IAQM,OAAO,GARb,MAQM,OAAO;IAGT,YAAY,IAAsB;QAC9B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9B,CAAC;CACJ,CAAA;AANK,OAAO;IARZ,MAAM,CAAC;QACJ,IAAI,EAAE,QAAQ;QACd,GAAG,EAAE,sBAAsB;QAC3B,UAAU,EAAE;YACR,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,mCAAmC,EAAE;SAC1G;QACD,QAAQ,EAAE,CAAC,MAAM,CAAC;KACrB,CAAC;;GACI,OAAO,CAMZ;AAGD;;;;GAIG;AAII,IAAM,KAAK,GAAX,MAAM,KAAM,SAAQ,cAAc;IACrC;;;;;;;;;;OAUG;IAGU,AAAN,KAAK,CAAC,OAAO,CAAU,KAAa,EAAU,OAAgB;QACjE,MAAM,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACjC,OAAO,IAAI,EAAE,EAAE,CAAA;IACnB,CAAC;IAED;;;;;;;;;;OAUG;IAGU,AAAN,KAAK,CAAC,UAAU,CAAU,KAAa,EAAU,OAAgB;QACpE,MAAM,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAClC,OAAO,IAAI,EAAE,EAAE,CAAA;IACnB,CAAC;CACJ,CAAA;AAtBgB;IAFZ,KAAK,CAAC,YAAY,CAAC;IACnB,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IACJ,WAAA,KAAK,EAAE,CAAA;IAAiB,WAAA,IAAI,EAAE,CAAA;;6CAAU,OAAO;;oCAGpE;AAeY;IAFZ,KAAK,CAAC,eAAe,CAAC;IACtB,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IACD,WAAA,KAAK,EAAE,CAAA;IAAiB,WAAA,IAAI,EAAE,CAAA;;6CAAU,OAAO;;uCAGvE;AAnCQ,KAAK;IAHjB,QAAQ,CAAC,YAAY,CAAC;IACtB,MAAM,CAAC,gBAAgB,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC;GACL,KAAK,CAoCjB"}
+{"version":3,"file":"Roles.js","sourceRoot":"","sources":["../../../../src/controllers/Users/Roles.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAClF,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,IAAI,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjG,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAE7C,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD,+CAA+C;AAC/C,OAAO,6BAA6B,CAAC;AAU9B,IAAM,OAAO,GAAb,MAAM,OAAO;IAGlB,YAAY,IAAsB;QAChC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC;CACF,CAAA;AANY,OAAO;IARnB,MAAM,CAAC;QACN,IAAI,EAAE,QAAQ;QACd,GAAG,EAAE,sBAAsB;QAC3B,UAAU,EAAE;YACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,mCAAmC,EAAE;SACxG;QACD,QAAQ,EAAE,CAAC,MAAM,CAAC;KACnB,CAAC;;GACW,OAAO,CAMnB;;AAED;;;;;;;;GAQG;AAII,IAAM,KAAK,GAAX,MAAM,KAAM,SAAQ,cAAc;IAIvC;;;;;;;;;;OAUG;IAGU,AAAN,KAAK,CAAC,OAAO,CAAgB,KAAW,EAAkF,IAAU,EAAU,OAAgB;QACnK,MAAM,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACvE,MAAM,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAEhC,OAAO,IAAI,EAAE,EAAE,CAAC;IAClB,CAAC;IAED;;;;;;;;;;OAUG;IAGU,AAAN,KAAK,CAAC,UAAU,CAAgB,KAAW,EAAkF,IAAU,EAAU,OAAgB;QACtK,MAAM,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACpE,MAAM,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAEjC,OAAO,IAAI,EAAE,EAAE,CAAC;IAClB,CAAC;CACF,CAAA;AAzCW;IADT,iBAAiB,CAAC,sBAAsB,CAAC;8BACrB,SAAS;wCAAC;AAelB;IAFZ,KAAK,CAAC,YAAY,CAAC;IACnB,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IACJ,WAAA,WAAW,EAAE,CAAA;IAAe,WAAA,SAAS,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;IAAc,WAAA,IAAI,EAAE,CAAA;;qCAAzG,IAAI,EAAwF,IAAI,EAAmB,OAAO;;oCAKpK;AAeY;IAFZ,KAAK,CAAC,eAAe,CAAC;IACtB,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IACD,WAAA,WAAW,EAAE,CAAA;IAAe,WAAA,SAAS,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;IAAc,WAAA,IAAI,EAAE,CAAA;;qCAAzG,IAAI,EAAwF,IAAI,EAAmB,OAAO;;uCAKvK;AA1CU,KAAK;IAHjB,QAAQ,CAAC,YAAY,CAAC;IACtB,MAAM,CAAC,gBAAgB,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC;GACL,KAAK,CA2CjB"}

package/lib/mjs/controllers/Users/Security.d.ts

@@ -1,22 +1,51 @@
-import { BaseController, Ok } from '@spinajs/http';
+import { BaseController, NotFound, Ok } from '@spinajs/http';
 import { SessionProvider, User } from '@spinajs/rbac';
-declare class ChangePasswordDto {
+import type { ISession } from '@spinajs/rbac';
+import { Log } from '@spinajs/log';
+import { RoleGuard } from '../../interfaces.js';
+import '../../services/RoleGuard.js';
+export declare class ChangePasswordDto {
     password: string;
     confirmPassword: string;
     constructor(data: any);
 }
+export declare class BanUserDto {
+    reason?: string;
+    duration?: number;
+    constructor(data: Partial<BanUserDto>);
+}
+/** One live session of a user, as reported to an administrator. */
+export interface IAdminSessionEntry {
+    /**
+     * Opaque handle for the session, NOT the session id — the id is a working
+     * credential and an admin listing must not hand out the means to
+     * impersonate the accounts it lists.
+     */
+    Handle: string;
+    /** ISO instant the session was opened */
+    Created: string;
+    /** ISO instant the session expires, or null when it never does */
+    Expires: string | null;
+}
 /**
  * User account security management (admin).
- * Administrative controls for user account security: password changes, 2FA reset,
- * account activation/deactivation, and forced session logout.
+ * Administrative controls for user account security: passwords, 2FA, account
+ * activation, bans, login lockouts and live sessions.
+ *
+ * Every route that takes an account out of service goes through the configured
+ * {@link RoleGuard} first — an administrator must not be able to lock themselves,
+ * or the installation, out through this API.
  * @tags Admin Users
  */
 export declare class Security extends BaseController {
+    protected Log: Log;
     protected SessionProvider: SessionProvider;
+    protected RoleGuard: RoleGuard;
     /**
      * Change user password (admin)
      * Sets a new password for the specified user. Both password and confirmPassword must match.
-     * Minimum length is 8 characters.
+     * Minimum length is 8 characters. Every session of that user is destroyed — the credential
+     * they were opened with no longer exists.
      * @security cookieAuth
      * @param user User UUID path parameter
      * @response 200 Password changed successfully
@@ -26,6 +55,31 @@ export declare class Security extends BaseController {
      * @response 404 User not found
      */
     changeUserPassword(user: User, dto: ChangePasswordDto): Promise<Ok<any>>;
+    /**
+     * Send a password reset link (admin)
+     * Issues a single-use reset token into the user's metadata and emits
+     * `UserPasswordChangeRequest` so the application can deliver it. The token itself is never
+     * returned. This is how a freshly created account is handed over to its owner — the
+     * temporary password generated at creation is deliberately discarded.
+     * @security cookieAuth
+     * @param user User UUID path parameter
+     * @response 200 Reset token issued
+     * @response 401 Unauthorized — valid session required
+     * @response 403 Forbidden — updateAny permission required on users resource
+     * @response 404 User not found
+     */
+    requestPasswordReset(user: User): Promise<Ok<any>>;
+    /**
+     * Expire a user password (admin)
+     * Marks the password as expired, which deactivates the account until a new one is set.
+     * @security cookieAuth
+     * @param user User UUID path parameter
+     * @response 200 Password expired
+     * @response 401 Unauthorized — valid session required
+     * @response 403 Forbidden — deleteAny permission required, or refused by the role guard
+     * @response 404 User not found
+     */
+    expireUserPassword(actor: User, user: User): Promise<Ok<any>>;
     /**
      * Reset user two-factor authentication (admin)
      * Clears the TOTP secret and disables 2FA for the specified user.
@@ -38,17 +92,42 @@ export declare class Security extends BaseController {
      * @response 404 User not found
      */
     reset2faToken(user: User): Promise<Ok<any>>;
+    /**
+     * Enable two-factor authentication for a user (admin)
+     * Initializes a TOTP secret for the account. Returns whatever the configured
+     * two-factor provider produces for enrolment (an otpauth url for the default provider) —
+     * deliver it to the user over a channel you trust.
+     * @security cookieAuth
+     * @param user User UUID path parameter
+     * @response 200 2FA enabled
+     * @response 401 Unauthorized — valid session required
+     * @response 403 Forbidden — updateAny permission required on users resource
+     * @response 404 User not found
+     */
+    enable2Fa(user: User): Promise<Ok<unknown>>;
+    /**
+     * Disable two-factor authentication for a user (admin)
+     * Removes the TOTP secret and turns the second factor off for the account.
+     * @security cookieAuth
+     * @param user User UUID path parameter
+     * @response 200 2FA disabled
+     * @response 401 Unauthorized — valid session required
+     * @response 403 Forbidden — updateAny permission required on users resource
+     * @response 404 User not found
+     */
+    disable2Fa(user: User): Promise<Ok<any>>;
     /**
      * Deactivate user account (admin)
-     * Marks the user account as inactive, preventing login without deleting the record.
+     * Marks the user account as inactive and destroys its sessions, preventing login without
+     * deleting the record.
      * @security cookieAuth
      * @param user User UUID path parameter
      * @response 200 Account deactivated successfully
      * @response 401 Unauthorized — valid session required
-     * @response 403 Forbidden — deleteAny permission required on users resource
+     * @response 403 Forbidden — deleteAny permission required, or refused by the role guard
      * @response 404 User not found
      */
-    deactivateUser(user: User): Promise<Ok<any>>;
+    deactivateUser(actor: User, user: User): Promise<Ok<any>>;
     /**
      * Activate user account (admin)
      * Marks a previously deactivated user account as active, restoring login access.
@@ -56,10 +135,71 @@ export declare class Security extends BaseController {
      * @param user User UUID path parameter
      * @response 200 Account activated successfully
      * @response 401 Unauthorized — valid session required
-     * @response 403 Forbidden — deleteAny permission required on users resource
+     * @response 403 Forbidden — updateAny permission required on users resource
      * @response 404 User not found
      */
     activateUser(user: User): Promise<Ok<any>>;
+    /**
+     * Ban a user (admin)
+     * Bans the account for `duration` seconds (24h when omitted), records the reason, and
+     * destroys every session it holds.
+     * @security cookieAuth
+     * @param user User UUID path parameter
+     * @response 200 Account banned
+     * @response 400 Account is already banned
+     * @response 401 Unauthorized — valid session required
+     * @response 403 Forbidden — deleteAny permission required, or refused by the role guard
+     * @response 404 User not found
+     */
+    banUser(actor: User, user: User, dto: BanUserDto): Promise<Ok<any>>;
+    /**
+     * Unban a user (admin)
+     * Clears the ban metadata from the account.
+     * @security cookieAuth
+     * @param user User UUID path parameter
+     * @response 200 Account unbanned
+     * @response 400 Account is not banned
+     * @response 401 Unauthorized — valid session required
+     * @response 403 Forbidden — updateAny permission required on users resource
+     * @response 404 User not found
+     */
+    unbanUser(user: User): Promise<Ok<any>>;
+    /**
+     * Clear a login lockout (admin)
+     * Removes the failed-attempt counter and the lockout window opened by the login throttle,
+     * letting the user try again immediately. Without this the only remedy is waiting out
+     * `rbac.password.lockoutTime`.
+     * @security cookieAuth
+     * @param user User UUID path parameter
+     * @response 200 Lockout cleared
+     * @response 401 Unauthorized — valid session required
+     * @response 403 Forbidden — updateAny permission required on users resource
+     * @response 404 User not found
+     */
+    unlockUser(user: User): Promise<Ok<any>>;
+    /**
+     * List sessions of a user (admin)
+     * Returns every live session of the account, newest first, identified by an opaque handle.
+     * @security cookieAuth
+     * @param user User UUID path parameter
+     * @returns {IAdminSessionEntry[]} Live sessions of the user
+     * @response 401 Unauthorized — valid session required
+     * @response 403 Forbidden — readAny permission required on users resource
+     * @response 404 User not found
+     */
+    listSessions(user: User): Promise<Ok<IAdminSessionEntry[]>>;
+    /**
+     * Revoke one session of a user (admin)
+     * Ends a single session, addressed by the handle returned from the listing.
+     * @security cookieAuth
+     * @param user User UUID path parameter
+     * @param handle Session handle as returned by `GET /users/security/sessions/:user`
+     * @response 200 Session revoked
+     * @response 401 Unauthorized — valid session required
+     * @response 403 Forbidden — updateAny permission required on users resource
+     * @response 404 No such session for this user
+     */
+    revokeSession(user: User, handle: string): Promise<Ok | NotFound>;
     /**
      * Force logout user (admin)
      * Invalidates all active sessions for the specified user, immediately ending any current logins.
@@ -70,7 +210,7 @@ export declare class Security extends BaseController {
      * @response 403 Forbidden — updateAny permission required on users resource
      * @response 404 User not found
      */
-    logoutUser(user: User): Promise<Ok<any>>;
+    logoutUser(user: User): Promise<Ok<null>>;
+    protected toEntry(session: ISession): IAdminSessionEntry;
 }
-export {};
 //# sourceMappingURL=Security.d.ts.map

package/lib/mjs/controllers/Users/Security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Security.d.ts","sourceRoot":"","sources":["../../../../src/controllers/Users/Security.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAuB,EAAE,EAAiB,MAAM,eAAe,CAAC;AAEvF,OAAO,EAA+C,eAAe,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAMnG,cAwBM,iBAAiB;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;gBAEnB,IAAI,EAAE,GAAG;CAGxB;AAGD;;;;;GAKG;AACH,qBAGa,QAAS,SAAQ,cAAc;IAGxC,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAE3C;;;;;;;;;;;OAWG;IAGU,kBAAkB,CAAoC,IAAI,EAAE,IAAI,EAAU,GAAG,EAAE,iBAAiB;IAK7G;;;;;;;;;;OAUG;IAGU,aAAa,CAAoC,IAAI,EAAE,IAAI;IAKxE;;;;;;;;;OASG;IAGU,cAAc,CAAoC,IAAI,EAAE,IAAI;IAKzE;;;;;;;;;OASG;IAGU,YAAY,CAAoC,IAAI,EAAE,IAAI;IAKvE;;;;;;;;;OASG;IAGU,UAAU,CAAoC,IAAI,EAAE,IAAI;CAIxE"}
+{"version":3,"file":"Security.d.ts","sourceRoot":"","sources":["../../../../src/controllers/Users/Security.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAA4B,QAAQ,EAAE,EAAE,EAA8B,MAAM,eAAe,CAAC;AACnH,OAAO,EAAmG,eAAe,EAAS,IAAI,EAAwB,MAAM,eAAe,CAAC;AACpL,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAK9C,OAAO,EAAE,GAAG,EAAU,MAAM,cAAc,CAAC;AAE3C,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAGhD,OAAO,6BAA6B,CAAC;AAErC,qBAwBa,iBAAiB;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;gBAEnB,IAAI,EAAE,GAAG;CAGtB;AAED,qBAQa,UAAU;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;gBAEb,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC;CAGtC;AAED,mEAAmE;AACnE,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;IAEf,yCAAyC;IACzC,OAAO,EAAE,MAAM,CAAC;IAEhB,kEAAkE;IAClE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED;;;;;;;;;GASG;AACH,qBAGa,QAAS,SAAQ,cAAc;IAE1C,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAGnB,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAG3C,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC;IAE/B;;;;;;;;;;;;OAYG;IAGU,kBAAkB,CAA2D,IAAI,EAAE,IAAI,EAAU,GAAG,EAAE,iBAAiB;IAKpI;;;;;;;;;;;;OAYG;IAGU,oBAAoB,CAA2D,IAAI,EAAE,IAAI;IAKtG;;;;;;;;;OASG;IAGU,kBAAkB,CAAgB,KAAK,EAAE,IAAI,EAA4D,IAAI,EAAE,IAAI;IAShI;;;;;;;;;;OAUG;IAGU,aAAa,CAA2D,IAAI,EAAE,IAAI;IAK/F;;;;;;;;;;;OAWG;IAGU,SAAS,CAA2D,IAAI,EAAE,IAAI;IAI3F;;;;;;;;;OASG;IAGU,UAAU,CAA2D,IAAI,EAAE,IAAI;IAK5F;;;;;;;;;;OAUG;IAGU,cAAc,CAAgB,KAAK,EAAE,IAAI,EAA4D,IAAI,EAAE,IAAI;IAO5H;;;;;;;;;OASG;IAGU,YAAY,CAA2D,IAAI,EAAE,IAAI;IAK9F;;;;;;;;;;;OAWG;IAGU,OAAO,CAAgB,KAAK,EAAE,IAAI,EAA4D,IAAI,EAAE,IAAI,EAAU,GAAG,EAAE,UAAU;IAO9I;;;;;;;;;;OAUG;IAGU,SAAS,CAA2D,IAAI,EAAE,IAAI;IAK3F;;;;;;;;;;;OAWG;IAGU,UAAU,CAA2D,IAAI,EAAE,IAAI;IAS5F;;;;;;;;;OASG;IAGU,YAAY,CAAoC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,EAAE,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAQ3G;;;;;;;;;;OAUG;IAGU,aAAa,CAAoC,IAAI,EAAE,IAAI,EAAW,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,GAAG,QAAQ,CAAC;IAiB1H;;;;;;;;;OASG;IAGU,UAAU,CAAoC,IAAI,EAAE,IAAI;IAQrE,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,GAAG,kBAAkB;CAOzD"}