@spinajs/rbac-http-admin 2.0.485 → 2.0.487

package/lib/mjs/interfaces.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interfaces.d.ts","sourceRoot":"","sources":["../../src/interfaces.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAErC;;;;;;;;GAQG;AACH,MAAM,WAAW,gBAAgB;IAC/B,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAEhB,+EAA+E;IAC/E,gBAAgB,EAAE,OAAO,CAAC;IAE1B,gFAAgF;IAChF,iBAAiB,EAAE,OAAO,CAAC;IAE3B;;;;OAIG;IACH,iBAAiB,EAAE,OAAO,CAAC;IAE3B;;;OAGG;IACH,kBAAkB,EAAE,OAAO,CAAC;IAE5B;;;OAGG;IACH,4BAA4B,EAAE,OAAO,CAAC;IAEtC;;;;OAIG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;;;GAYG;AACH,8BAAsB,SAAS;IAC7B;;;;;;OAMG;aACa,oBAAoB,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAEtG;;OAEG;aACa,mBAAmB,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAE3F;;OAEG;aACa,uBAAuB,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAE/G;;;;OAIG;aACa,eAAe,CAAC,KAAK,EAAE,IAAI,GAAG,MAAM,EAAE;CACvD;AAED,uDAAuD;AACvD,MAAM,MAAM,oBAAoB,GAAG,YAAY,GAAG,QAAQ,GAAG,KAAK,CAAC"}

package/lib/mjs/interfaces.js

@@ -0,0 +1,16 @@
+/**
+ * Role and account-state guard for the admin API.
+ *
+ * The checks live here rather than in the controllers because the same rule has
+ * to hold on every path that can change what an account may do: granting a role,
+ * revoking one, rewriting the whole role list through `PATCH /users/:uuid`, and
+ * taking an account out of service. A rule implemented per-controller is a rule
+ * that will be missing from the next controller.
+ *
+ * All methods THROW on refusal ( `Forbidden` / `InvalidArgument`, which the http
+ * error map turns into 403 / 400 ) and return normally when the operation is
+ * allowed.
+ */
+export class RoleGuard {
+}
+//# sourceMappingURL=interfaces.js.map

package/lib/mjs/interfaces.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interfaces.js","sourceRoot":"","sources":["../../src/interfaces.ts"],"names":[],"mappings":"AAiDA;;;;;;;;;;;;GAYG;AACH,MAAM,OAAgB,SAAS;CA0B9B"}

package/lib/mjs/services/RoleGuard.d.ts

@@ -0,0 +1,96 @@
+import { Log } from '@spinajs/log';
+import { AccessControl, User } from '@spinajs/rbac';
+import { AccountDisableAction, IRoleGuardConfig, RoleGuard } from '../interfaces.js';
+/** A resolved grant map: resource -> action -> attribute list. */
+type GrantMap = {
+    [resource: string]: {
+        [action: string]: string[];
+    };
+};
+/**
+ * The shipped {@link RoleGuard}.
+ *
+ * Every check reads its switch from `rbac.admin.roleGuard`, so an application
+ * turns one off in configuration instead of replacing the whole service — and
+ * an application that needs a different rule entirely registers its own class
+ * under {@link RoleGuard} and names it in `rbac.admin.roleGuard.service`.
+ */
+export declare class DefaultRoleGuard extends RoleGuard {
+    protected Log: Log;
+    protected Options: IRoleGuardConfig;
+    protected SystemRole: string;
+    /**
+     * Declared roles, which is NOT the same set as the roles accesscontrol knows
+     * about: a role may be declared for assignment and carry no grants yet.
+     */
+    protected DeclaredRoles: Array<{
+        Name: string;
+    }>;
+    /**
+     * Resolved late, never cached in a field: the container entry is replaced
+     * whenever the rbac bootstrapper runs ( every test case does ), and a guard
+     * holding the stale instance would answer from grants nobody configured.
+     */
+    protected get AC(): AccessControl;
+    assertCanAssignRoles(actor: User, target: User | null, roles: string[]): Promise<void>;
+    assertCanRevokeRole(actor: User, target: User, role: string): Promise<void>;
+    assertCanDisableAccount(actor: User, target: User, action: AccountDisableAction): Promise<void>;
+    assignableRoles(actor: User): string[];
+    /**
+     * A missing actor is a programming error on a route that must be behind
+     * `AuthorizedPolicy` — refused rather than waved through, because every
+     * escalation check below is meaningless without one.
+     */
+    protected assertActor(actor: User): void;
+    protected assertKnownRole(role: string): void;
+    protected assertNotSystemRole(role: string, verb: string): void;
+    protected isSelf(actor: User, target: User): boolean;
+    /**
+     * Throws when `target` is the last account that can still act with `role`.
+     *
+     * Counts accounts that could actually log in — inactive and soft-deleted rows
+     * are not a way back into the installation.
+     */
+    protected assertNotLastHolder(role: string, action: string): Promise<void>;
+    /**
+     * Active accounts holding `role`.
+     *
+     * Counted in the database. This used to narrow with LIKE and finish the job in
+     * memory, because `withRole` compiled to `FIND_IN_SET` — MySQL only — and threw
+     * a driver error on SQLite, turning "is this the last administrator" into a 500
+     * on every deployment that is not MySQL. Set membership is a per-dialect
+     * statement now, so the scope answers everywhere and the workaround is gone.
+     */
+    protected countActiveHolders(role: string): Promise<number>;
+    protected isPrivileged(role: string): boolean;
+    protected rolesWithGrants(): string[];
+    protected allGrants(): GrantMap;
+    /** Grants of one role, with its `$extend` chain resolved. */
+    protected grantsOfRole(role: string): GrantMap;
+    /**
+     * The caller's ceiling: the union of every role they hold.
+     *
+     * Deliberately the union and not the session's active role — an administrator
+     * who can switch to a stronger role could otherwise be blocked from an
+     * operation they can perform by switching first, which teaches people to
+     * switch rather than to stay in the weaker role.
+     */
+    protected grantsOf(actor: User): GrantMap;
+    /**
+     * True when `holder` permits everything `wanted` does.
+     *
+     * Attributes are compared as sets, with `*` covering anything. Negated
+     * attributes ( `!Password` ) are treated as ordinary members: a holder that
+     * lists the same negation still covers, one that does not is reported as not
+     * covering. That errs towards refusing an assignment, which is the safe
+     * direction for a guard.
+     *
+     * `:any` covers the matching `:own`, exactly as accesscontrol resolves them at
+     * enforcement time. Without that an administrator holding `read:any` on users
+     * would be told they cannot hand out a role holding `read:own` — a role
+     * strictly weaker than their own.
+     */
+    protected covers(holder: GrantMap, wanted: GrantMap): boolean;
+}
+export {};
+//# sourceMappingURL=RoleGuard.d.ts.map

package/lib/mjs/services/RoleGuard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RoleGuard.d.ts","sourceRoot":"","sources":["../../../src/services/RoleGuard.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,GAAG,EAAU,MAAM,cAAc,CAAC;AAE3C,OAAO,EAAE,aAAa,EAAE,IAAI,EAAiC,MAAM,eAAe,CAAC;AAGnF,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAErF,kEAAkE;AAClE,KAAK,QAAQ,GAAG;IAAE,CAAC,QAAQ,EAAE,MAAM,GAAG;QAAE,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;KAAE,CAAA;CAAE,CAAC;AAEvE;;;;;;;GAOG;AACH,qBACa,gBAAiB,SAAQ,SAAS;IAE7C,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAGnB,SAAS,CAAC,OAAO,EAAE,gBAAgB,CAAC;IAGpC,SAAS,CAAC,UAAU,EAAE,MAAM,CAAC;IAE7B;;;OAGG;IAEH,SAAS,CAAC,aAAa,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAEjD;;;;OAIG;IACH,SAAS,KAAK,EAAE,IAAI,aAAa,CAEhC;IAEY,oBAAoB,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IA4BtF,mBAAmB,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA2B3E,uBAAuB,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBrG,eAAe,CAAC,KAAK,EAAE,IAAI,GAAG,MAAM,EAAE;IAa7C;;;;OAIG;IACH,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,GAAG,IAAI;IAMxC,SAAS,CAAC,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAY7C,SAAS,CAAC,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAM/D,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAG,OAAO;IAUpD;;;;;OAKG;cACa,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUhF;;;;;;;;OAQG;cACa,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIjE,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAO7C,SAAS,CAAC,eAAe,IAAI,MAAM,EAAE;IASrC,SAAS,CAAC,SAAS,IAAI,QAAQ;IAQ/B,6DAA6D;IAC7D,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ;IAI9C;;;;;;;OAOG;IACH,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,GAAG,QAAQ;IAKzC;;;;;;;;;;;;;OAaG;IACH,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO;CA2B9D"}

package/lib/mjs/services/RoleGuard.js

@@ -0,0 +1,252 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Injectable, DI } from '@spinajs/di';
+import { Config } from '@spinajs/configuration';
+import { Log, Logger } from '@spinajs/log';
+import { Forbidden, InvalidArgument } from '@spinajs/exceptions';
+import { User, _combineGrants, _unwindGrants } from '@spinajs/rbac';
+import _ from 'lodash';
+import { RoleGuard } from '../interfaces.js';
+/**
+ * The shipped {@link RoleGuard}.
+ *
+ * Every check reads its switch from `rbac.admin.roleGuard`, so an application
+ * turns one off in configuration instead of replacing the whole service — and
+ * an application that needs a different rule entirely registers its own class
+ * under {@link RoleGuard} and names it in `rbac.admin.roleGuard.service`.
+ */
+let DefaultRoleGuard = class DefaultRoleGuard extends RoleGuard {
+    /**
+     * Resolved late, never cached in a field: the container entry is replaced
+     * whenever the rbac bootstrapper runs ( every test case does ), and a guard
+     * holding the stale instance would answer from grants nobody configured.
+     */
+    get AC() {
+        return DI.get('AccessControl');
+    }
+    async assertCanAssignRoles(actor, target, roles) {
+        const wanted = _.uniq((roles ?? []).map((r) => String(r ?? '').trim()).filter((r) => r.length > 0));
+        if (wanted.length === 0) {
+            return;
+        }
+        this.assertActor(actor);
+        for (const role of wanted) {
+            this.assertKnownRole(role);
+            this.assertNotSystemRole(role, 'assigned');
+            if (this.Options?.preventEscalation !== false && !this.covers(this.grantsOf(actor), this.grantsOfRole(role))) {
+                throw new Forbidden(`Role '${role}' grants more than the caller holds and cannot be assigned`);
+            }
+        }
+        // The guard passed — the assignment itself is the caller's next step. Logged
+        // with the actor because the rbac events carry the TARGET only, so this line
+        // is the one record of who handed out which role.
+        this.Log.info(`Role assignment allowed`, {
+            Actor: actor?.Uuid,
+            Target: target?.Uuid ?? null,
+            Roles: wanted,
+        });
+    }
+    async assertCanRevokeRole(actor, target, role) {
+        const wanted = String(role ?? '').trim();
+        if (wanted.length === 0) {
+            throw new InvalidArgument('role cannot be empty');
+        }
+        this.assertActor(actor);
+        this.assertKnownRole(wanted);
+        this.assertNotSystemRole(wanted, 'revoked');
+        if (!this.isPrivileged(wanted)) {
+            return;
+        }
+        // Taking a privileged role off YOUR OWN account through the admin API is
+        // almost always a mistake and is never recoverable through the same API —
+        // the request that would put the role back needs the role.
+        if (this.Options?.preventSelfLockout !== false && this.isSelf(actor, target)) {
+            throw new Forbidden(`Cannot revoke your own '${wanted}' role`);
+        }
+        if (this.Options?.preventLastPrivilegedRemoval !== false && target?.Role?.includes(wanted)) {
+            await this.assertNotLastHolder(wanted, `revoke '${wanted}'`);
+        }
+    }
+    async assertCanDisableAccount(actor, target, action) {
+        this.assertActor(actor);
+        if (this.Options?.preventSelfLockout !== false && this.isSelf(actor, target)) {
+            throw new Forbidden(`Cannot ${action} your own account`);
+        }
+        if (this.Options?.preventLastPrivilegedRemoval === false) {
+            return;
+        }
+        for (const role of target?.Role ?? []) {
+            if (this.isPrivileged(role)) {
+                await this.assertNotLastHolder(role, action);
+            }
+        }
+    }
+    assignableRoles(actor) {
+        const all = _.uniq([...(this.DeclaredRoles ?? []).map((r) => r?.Name).filter(Boolean), ...this.rolesWithGrants()]);
+        const withoutSystem = this.Options?.protectSystemRole === false ? all : all.filter((r) => r !== this.SystemRole);
+        if (this.Options?.preventEscalation === false) {
+            return withoutSystem;
+        }
+        const actorGrants = this.grantsOf(actor);
+        return withoutSystem.filter((r) => this.covers(actorGrants, this.grantsOfRole(r)));
+    }
+    /**
+     * A missing actor is a programming error on a route that must be behind
+     * `AuthorizedPolicy` — refused rather than waved through, because every
+     * escalation check below is meaningless without one.
+     */
+    assertActor(actor) {
+        if (!actor) {
+            throw new Forbidden('Role changes require an authenticated caller');
+        }
+    }
+    assertKnownRole(role) {
+        if (this.Options?.requireKnownRole === false) {
+            return;
+        }
+        const known = _.uniq([...(this.DeclaredRoles ?? []).map((r) => r?.Name).filter(Boolean), ...this.rolesWithGrants(), this.SystemRole]);
+        if (!known.includes(role)) {
+            throw new InvalidArgument(`Role '${role}' is not declared in rbac configuration`);
+        }
+    }
+    assertNotSystemRole(role, verb) {
+        if (this.Options?.protectSystemRole !== false && role === this.SystemRole) {
+            throw new Forbidden(`The system role cannot be ${verb} through the API`);
+        }
+    }
+    isSelf(actor, target) {
+        if (!actor || !target) {
+            return false;
+        }
+        // Uuid first: an actor resolved from a session and a target loaded by route
+        // parameter are two different model instances of the same row.
+        return (actor.Uuid && actor.Uuid === target.Uuid) || (!!actor.Id && actor.Id === target.Id);
+    }
+    /**
+     * Throws when `target` is the last account that can still act with `role`.
+     *
+     * Counts accounts that could actually log in — inactive and soft-deleted rows
+     * are not a way back into the installation.
+     */
+    async assertNotLastHolder(role, action) {
+        const holders = await this.countActiveHolders(role);
+        // The target itself is one of them ( it is active and holds the role ), so
+        // one holder means the operation empties the role.
+        if (holders <= 1) {
+            throw new Forbidden(`Cannot ${action}: it would leave no active account holding '${role}'`);
+        }
+    }
+    /**
+     * Active accounts holding `role`.
+     *
+     * Counted in the database. This used to narrow with LIKE and finish the job in
+     * memory, because `withRole` compiled to `FIND_IN_SET` — MySQL only — and threw
+     * a driver error on SQLite, turning "is this the last administrator" into a 500
+     * on every deployment that is not MySQL. Set membership is a per-dialect
+     * statement now, so the scope answers everywhere and the workaround is gone.
+     */
+    async countActiveHolders(role) {
+        return User.query().isActiveUser().withRole([role]).selectCount();
+    }
+    isPrivileged(role) {
+        const resource = this.Options?.privilegedResource ?? 'users';
+        const action = this.Options?.privilegedAction ?? 'update:any';
+        return Boolean(this.grantsOfRole(role)?.[resource]?.[action]);
+    }
+    rolesWithGrants() {
+        try {
+            return this.AC?.getRoles() ?? [];
+        }
+        catch {
+            // accesscontrol throws when no grants were ever set
+            return [];
+        }
+    }
+    allGrants() {
+        try {
+            return (this.AC?.getGrants() ?? {});
+        }
+        catch {
+            return {};
+        }
+    }
+    /** Grants of one role, with its `$extend` chain resolved. */
+    grantsOfRole(role) {
+        return _unwindGrants(role, this.allGrants());
+    }
+    /**
+     * The caller's ceiling: the union of every role they hold.
+     *
+     * Deliberately the union and not the session's active role — an administrator
+     * who can switch to a stronger role could otherwise be blocked from an
+     * operation they can perform by switching first, which teaches people to
+     * switch rather than to stay in the weaker role.
+     */
+    grantsOf(actor) {
+        const grants = this.allGrants();
+        return _combineGrants(...(actor?.Role ?? []).map((r) => _unwindGrants(r, grants)));
+    }
+    /**
+     * True when `holder` permits everything `wanted` does.
+     *
+     * Attributes are compared as sets, with `*` covering anything. Negated
+     * attributes ( `!Password` ) are treated as ordinary members: a holder that
+     * lists the same negation still covers, one that does not is reported as not
+     * covering. That errs towards refusing an assignment, which is the safe
+     * direction for a guard.
+     *
+     * `:any` covers the matching `:own`, exactly as accesscontrol resolves them at
+     * enforcement time. Without that an administrator holding `read:any` on users
+     * would be told they cannot hand out a role holding `read:own` — a role
+     * strictly weaker than their own.
+     */
+    covers(holder, wanted) {
+        for (const [resource, actions] of Object.entries(wanted ?? {})) {
+            const held = holder?.[resource];
+            if (!held) {
+                return false;
+            }
+            for (const [action, attributes] of Object.entries(actions ?? {})) {
+                const heldAttributes = held[action] ?? (action.endsWith(':own') ? held[action.replace(/:own$/, ':any')] : undefined);
+                if (!heldAttributes) {
+                    return false;
+                }
+                if (heldAttributes.includes('*')) {
+                    continue;
+                }
+                if ((attributes ?? []).some((a) => !heldAttributes.includes(a))) {
+                    return false;
+                }
+            }
+        }
+        return true;
+    }
+};
+__decorate([
+    Logger('rbac-admin'),
+    __metadata("design:type", Log)
+], DefaultRoleGuard.prototype, "Log", void 0);
+__decorate([
+    Config('rbac.admin.roleGuard'),
+    __metadata("design:type", Object)
+], DefaultRoleGuard.prototype, "Options", void 0);
+__decorate([
+    Config('rbac.systemRole', { defaultValue: 'system' }),
+    __metadata("design:type", String)
+], DefaultRoleGuard.prototype, "SystemRole", void 0);
+__decorate([
+    Config('rbac.roles', { defaultValue: [] }),
+    __metadata("design:type", Array)
+], DefaultRoleGuard.prototype, "DeclaredRoles", void 0);
+DefaultRoleGuard = __decorate([
+    Injectable(RoleGuard)
+], DefaultRoleGuard);
+export { DefaultRoleGuard };
+//# sourceMappingURL=RoleGuard.js.map

package/lib/mjs/services/RoleGuard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RoleGuard.js","sourceRoot":"","sources":["../../../src/services/RoleGuard.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAiB,IAAI,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACnF,OAAO,CAAC,MAAM,QAAQ,CAAC;AAEvB,OAAO,EAA0C,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAKrF;;;;;;;GAOG;AAEI,IAAM,gBAAgB,GAAtB,MAAM,gBAAiB,SAAQ,SAAS;IAiB7C;;;;OAIG;IACH,IAAc,EAAE;QACd,OAAO,EAAE,CAAC,GAAG,CAAgB,eAAe,CAAE,CAAC;IACjD,CAAC;IAEM,KAAK,CAAC,oBAAoB,CAAC,KAAW,EAAE,MAAmB,EAAE,KAAe;QACjF,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;QAEpG,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAExB,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;YAC1B,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;YAC3B,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAE3C,IAAI,IAAI,CAAC,OAAO,EAAE,iBAAiB,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBAC7G,MAAM,IAAI,SAAS,CAAC,SAAS,IAAI,4DAA4D,CAAC,CAAC;YACjG,CAAC;QACH,CAAC;QAED,6EAA6E;QAC7E,6EAA6E;QAC7E,kDAAkD;QAClD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE;YACvC,KAAK,EAAE,KAAK,EAAE,IAAI;YAClB,MAAM,EAAE,MAAM,EAAE,IAAI,IAAI,IAAI;YAC5B,KAAK,EAAE,MAAM;SACd,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,mBAAmB,CAAC,KAAW,EAAE,MAAY,EAAE,IAAY;QACtE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAEzC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,eAAe,CAAC,sBAAsB,CAAC,CAAC;QACpD,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAE5C,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,OAAO;QACT,CAAC;QAED,yEAAyE;QACzE,0EAA0E;QAC1E,2DAA2D;QAC3D,IAAI,IAAI,CAAC,OAAO,EAAE,kBAAkB,KAAK,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;YAC7E,MAAM,IAAI,SAAS,CAAC,2BAA2B,MAAM,QAAQ,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,4BAA4B,KAAK,KAAK,IAAI,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3F,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,WAAW,MAAM,GAAG,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,uBAAuB,CAAC,KAAW,EAAE,MAAY,EAAE,MAA4B;QAC1F,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAExB,IAAI,IAAI,CAAC,OAAO,EAAE,kBAAkB,KAAK,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;YAC7E,MAAM,IAAI,SAAS,CAAC,UAAU,MAAM,mBAAmB,CAAC,CAAC;QAC3D,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,4BAA4B,KAAK,KAAK,EAAE,CAAC;YACzD,OAAO;QACT,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;YACtC,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5B,MAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;IACH,CAAC;IAEM,eAAe,CAAC,KAAW;QAChC,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC;QAEnH,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,EAAE,iBAAiB,KAAK,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,CAAC;QAEjH,IAAI,IAAI,CAAC,OAAO,EAAE,iBAAiB,KAAK,KAAK,EAAE,CAAC;YAC9C,OAAO,aAAa,CAAC;QACvB,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACzC,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrF,CAAC;IAED;;;;OAIG;IACO,WAAW,CAAC,KAAW;QAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,SAAS,CAAC,8CAA8C,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAES,eAAe,CAAC,IAAY;QACpC,IAAI,IAAI,CAAC,OAAO,EAAE,gBAAgB,KAAK,KAAK,EAAE,CAAC;YAC7C,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC,eAAe,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAEtI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,eAAe,CAAC,SAAS,IAAI,yCAAyC,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAES,mBAAmB,CAAC,IAAY,EAAE,IAAY;QACtD,IAAI,IAAI,CAAC,OAAO,EAAE,iBAAiB,KAAK,KAAK,IAAI,IAAI,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;YAC1E,MAAM,IAAI,SAAS,CAAC,6BAA6B,IAAI,kBAAkB,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAES,MAAM,CAAC,KAAW,EAAE,MAAY;QACxC,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,4EAA4E;QAC5E,+DAA+D;QAC/D,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED;;;;;OAKG;IACO,KAAK,CAAC,mBAAmB,CAAC,IAAY,EAAE,MAAc;QAC9D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAEpD,2EAA2E;QAC3E,mDAAmD;QACnD,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,SAAS,CAAC,UAAU,MAAM,+CAA+C,IAAI,GAAG,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACO,KAAK,CAAC,kBAAkB,CAAC,IAAY;QAC7C,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC,YAAY,EAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACpE,CAAC;IAES,YAAY,CAAC,IAAY;QACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,kBAAkB,IAAI,OAAO,CAAC;QAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,gBAAgB,IAAI,YAAY,CAAC;QAE9D,OAAO,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAChE,CAAC;IAES,eAAe;QACvB,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,oDAAoD;YACpD,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAES,SAAS;QACjB,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAwB,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAc,CAAC;QACxB,CAAC;IACH,CAAC;IAED,6DAA6D;IACnD,YAAY,CAAC,IAAY;QACjC,OAAO,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,EAAS,CAAa,CAAC;IAClE,CAAC;IAED;;;;;;;OAOG;IACO,QAAQ,CAAC,KAAW;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAChC,OAAO,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,MAAa,CAAC,CAAC,CAAa,CAAC;IACxG,CAAC;IAED;;;;;;;;;;;;;OAaG;IACO,MAAM,CAAC,MAAgB,EAAE,MAAgB;QACjD,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC;YAEhC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,KAAK,CAAC;YACf,CAAC;YAED,KAAK,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;gBACjE,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBAErH,IAAI,CAAC,cAAc,EAAE,CAAC;oBACpB,OAAO,KAAK,CAAC;gBACf,CAAC;gBAED,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBACjC,SAAS;gBACX,CAAC;gBAED,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAChE,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AArQW;IADT,MAAM,CAAC,YAAY,CAAC;8BACN,GAAG;6CAAC;AAGT;IADT,MAAM,CAAC,sBAAsB,CAAC;;iDACK;AAG1B;IADT,MAAM,CAAC,iBAAiB,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;;oDACzB;AAOnB;IADT,MAAM,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,EAA6B,EAAE,CAAC;8BAC7C,KAAK;uDAAmB;AAftC,gBAAgB;IAD5B,UAAU,CAAC,SAAS,CAAC;GACT,gBAAgB,CAuQ5B"}