@spinajs/rbac 2.0.522 → 2.0.523

package/lib/mjs/middleware.js

@@ -7,16 +7,15 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-import { Autoinject, DI, Injectable } from '@spinajs/di';
+import { DI, Injectable } from '@spinajs/di';
 import { DeleteQueryBuilder, extractModelDescriptor, InsertQueryBuilder, OrmException, QueryMiddleware, SelectQueryBuilder, UpdateQueryBuilder } from '@spinajs/orm';
 import { AsyncLocalStorage } from 'async_hooks';
-import { RBAC_HOOK_FALLBACK } from './interfaces.js';
-import { AccessControl } from 'accesscontrol';
 import { Forbidden } from '@spinajs/exceptions';
 import { Log, Logger } from '@spinajs/log-common';
+import { DEFAULT_PERMISSION_SCOPE, getOrCreatePolicyMap, ormPermissionModel, OrmPermissionPolicy, PERMISSION_SCOPE_ATTR_PREFIX, policyMapKey } from './orm-permission.js';
+import { effectiveRoles, probeGrant } from './permission-service.js';
 /**
- * Which permission scopes a builder type is checked against, and which per-operation
- * model hook it looks for.
+ * Which permission scopes a builder type is checked against.
  *
  * Keyed on the CONSTRUCTOR, not on `constructor.name`. A name-keyed lookup breaks under
  * minification and silently yields "no mapping" — for a security check that means an
@@ -25,14 +24,13 @@ import { Log, Logger } from '@spinajs/log-common';
  * `InsertQueryBuilder` was missing here while `PERMISSION_SCOPE_TO_QUERY` claimed to
  * support `createOwn`/`createAny`, so the insert branch of the middleware could only ever
  * have thrown a TypeError. The inverse map below is now DERIVED from this one, so the two
- * cannot drift apart again — and the hook name lives here for the same reason, so a hook
- * can never be paired with the wrong builder type.
+ * cannot drift apart again.
  */
 const QUERY_TO_PERMISSION = new Map([
-    [DeleteQueryBuilder, { own: 'deleteOwn', all: 'deleteAny', hook: 'rbacDelete' }],
-    [UpdateQueryBuilder, { own: 'updateOwn', all: 'updateAny', hook: 'rbacUpdate' }],
-    [SelectQueryBuilder, { own: 'readOwn', all: 'readAny', hook: 'rbacRead' }],
-    [InsertQueryBuilder, { own: 'createOwn', all: 'createAny', hook: 'rbacCreate' }],
+    [DeleteQueryBuilder, { own: 'deleteOwn', all: 'deleteAny' }],
+    [UpdateQueryBuilder, { own: 'updateOwn', all: 'updateAny' }],
+    [SelectQueryBuilder, { own: 'readOwn', all: 'readAny' }],
+    [InsertQueryBuilder, { own: 'createOwn', all: 'createAny' }],
 ]);
 /** Derived inverse of {@link QUERY_TO_PERMISSION}. Never hand-maintained. */
 const PERMISSION_SCOPE_TO_QUERY = new Map();
@@ -53,32 +51,60 @@ function permissionsFor(builder) {
     return undefined;
 }
 /**
- * The custom rbac constraint `model` declares for this operation, or `undefined` when it
- * declares none and the caller should fall through to `OwnerField`.
- *
- * Resolution is specific-then-generic: `rbacDelete` beats `rbac` on a delete, and a model
- * declaring only `rbac` keeps its pre-split behaviour on every operation. Statics resolve
- * through the prototype chain, so a subclass inherits whichever hooks it does not override.
- *
- * `allowFallback` is false for INSERT only. `rbac` has always been called on builders that
- * have a WHERE clause, so every implementation in the wild is where-shaped —
- * `ContentEntries.rbac` and `EntriesGroup.rbac` both call `whereExist`, which
- * `InsertQueryBuilder` does not define. Falling back there would turn a silent gap into a
- * crash on every insert for every model already using the feature. Insert-time control is
- * opt-in via an explicit `rbacCreate`.
+ * Steps from `model` up its prototype (class inheritance) chain to `boundModel`, or
+ * `undefined` if `boundModel` is not `model` itself or an ancestor. ES class inheritance
+ * puts the parent constructor at `Object.getPrototypeOf(Child)`, so walking constructors —
+ * not instances — is the correct way to test "is a subclass of".
+ */
+function distanceTo(model, boundModel) {
+    let current = model;
+    for (let distance = 0; current; distance++) {
+        if (current === boundModel) {
+            return distance;
+        }
+        current = Object.getPrototypeOf(current);
+    }
+    return undefined;
+}
+/**
+ * Picks the policy bound to `model` itself or the closest bound ancestor. Two unrelated
+ * models can share one resource+scope key on purpose (CampaignFileAttachment /
+ * ArrowV1CampaignView) — the resource string alone cannot disambiguate them, so every
+ * candidate is checked against `model`'s actual prototype chain. When both an ancestor-bound
+ * and an exact-bound policy are registered, the most-derived (smallest distance) one wins.
  */
-function rbacHook(model, hook, allowFallback) {
-    const statics = model;
-    if (!statics) {
+function selectPolicyClass(candidates, model) {
+    if (!candidates) {
         return undefined;
     }
-    if (typeof statics[hook] === 'function') {
-        return statics[hook];
+    let best;
+    let bestDistance = Infinity;
+    for (const candidate of candidates) {
+        const boundModel = ormPermissionModel(candidate);
+        if (!boundModel) {
+            continue;
+        }
+        const distance = distanceTo(model, boundModel);
+        if (distance !== undefined && distance < bestDistance) {
+            best = candidate;
+            bestDistance = distance;
+        }
     }
-    if (allowFallback && typeof statics[RBAC_HOOK_FALLBACK] === 'function') {
-        return statics[RBAC_HOOK_FALLBACK];
+    return best;
+}
+/** Fallback for models with `@ResourceOwner()` and no registered policy class. */
+class OwnerFieldPolicy extends OrmPermissionPolicy {
+    constructor(ownerField) {
+        super();
+        this.ownerField = ownerField;
+    }
+    scope(query, user) {
+        query.andWhere(this.ownerField, user.PrimaryKeyValue);
+    }
+    async authorizeCreate(query, user) {
+        // Overwrite, never merge: a caller-supplied owner id is exactly the IDOR this closes.
+        query.forceColumn(this.ownerField, user.PrimaryKeyValue);
     }
-    return undefined;
 }
 let RbacModelPermissionMiddleware = class RbacModelPermissionMiddleware extends QueryMiddleware {
     /**
@@ -103,26 +129,31 @@ let RbacModelPermissionMiddleware = class RbacModelPermissionMiddleware extends
         if (!canOwn) {
             throw new Forbidden(`User does not have permission to access ${resource}:${context.action} permission`);
         }
-        /**
-         * Model can take over insert-time ownership itself. No fallback to the generic `rbac`
-         * here — see {@link rbacHook}.
-         *
-         * Awaited: unlike the where-clause hooks, an insert rule usually cannot be decided from
-         * the payload alone — "is this the caller's group?" is a lookup. Dropping the returned
-         * promise would let the row land before the answer came back.
-         */
-        const rbacFunc = rbacHook(builder.Model, context.hook, false);
-        if (rbacFunc) {
-            this.Log.trace(`Applying custom ${context.hook} func for ${resource}`);
-            await rbacFunc.call(builder, context.user);
-            return;
-        }
-        if (!descriptor.OwnerField) {
-            this.Log.error(`Model ${descriptor.Name} does not have OwnerField set, cannot apply :own permission`);
-            throw new OrmException(`Model ${descriptor.Name} does not have OwnerField set, cannot apply :own permission`);
+        const policies = this.policiesFor(context.roles, resource, context.ownScope, descriptor, builder.Model);
+        // A candidate that does not opt into insert control denies by default (see
+        // OrmPermissionPolicy.authorizeCreate). Pre-refactor, a model with no rbacCreate static
+        // but an OwnerField had its owner column stamped and the insert allowed — an unrelated
+        // policy registered only for scope() must not shadow that. Deny-by-default is kept when
+        // there is no OwnerField to fall back to.
+        const createPolicies = policies.map((policy) => {
+            const opensOwnCreate = policy.authorizeCreate !== OrmPermissionPolicy.prototype.authorizeCreate;
+            return !opensOwnCreate && descriptor.OwnerField ? new OwnerFieldPolicy(descriptor.OwnerField) : policy;
+        });
+        // Multiple distinct scopes OR-compose on inserts too: the insert is allowed if ANY
+        // granted role's policy authorizes it. Policies are tried in registration-set order;
+        // when every one denies, the last error propagates.
+        let lastError;
+        for (const policy of createPolicies) {
+            try {
+                this.Log.trace(`Applying authorizeCreate of ${policy.constructor.name} for ${resource}`);
+                await policy.authorizeCreate(builder, context.user);
+                return;
+            }
+            catch (err) {
+                lastError = err;
+            }
         }
-        // Overwrite, never merge: a caller-supplied owner id is exactly the IDOR this closes.
-        builder.forceColumn(descriptor.OwnerField, context.user.PrimaryKeyValue);
+        throw lastError;
     }
     afterQueryCreation(builder) {
         // Insert is handled at execution time; anything else without a WHERE clause to constrain
@@ -143,11 +174,6 @@ let RbacModelPermissionMiddleware = class RbacModelPermissionMiddleware extends
             throw new Forbidden(`User does not have permission to access ${resource}:${context.action} permission`);
         }
         this.Log.trace(`Resource ${resource}:own permission granted`);
-        /**
-         * Model can have a custom rbac permission check, either for this operation
-         * specifically (`rbacRead` / `rbacUpdate` / `rbacDelete`) or generically (`rbac`).
-         */
-        const rbacFunc = rbacHook(builder.Model, context.hook, true);
         /**
          * `relationScope: 'join'` ( @OrmResource options ): when this model is populated as a
          * BelongsTo relation, its :own constraint folded into the parent WHERE would silently
@@ -158,31 +184,79 @@ let RbacModelPermissionMiddleware = class RbacModelPermissionMiddleware extends
          */
         const joinScoped = descriptor.RbacRelationScope === 'join' && builder instanceof SelectQueryBuilder;
         const user = context.user;
-        if (rbacFunc) {
-            this.Log.trace(`Applying custom ${context.hook} func for ${resource}`);
-            if (joinScoped) {
-                builder.whereOnJoin(function () {
-                    rbacFunc.call(builder, user);
-                });
-            }
-            else {
-                rbacFunc.call(builder, user);
+        const policies = this.policiesFor(context.roles, resource, context.ownScope, descriptor, builder.Model);
+        const method = builder instanceof UpdateQueryBuilder ? 'scopeUpdate' : builder instanceof DeleteQueryBuilder ? 'scopeDelete' : 'scopeRead';
+        const apply = (target) => {
+            if (policies.length === 1) {
+                policies[0][method](target, user);
+                return;
             }
-            return;
-        }
-        if (!descriptor.OwnerField) {
-            this.Log.error(`Model ${descriptor.Name} does not have OwnerField set or static rbac function, cannot apply :own permission`);
-            throw new OrmException(`Model ${descriptor.Name} does not have OwnerField set, cannot apply :own permission`);
-        }
-        this.Log.trace(`Applying owner field restriction for ${resource}`);
+            // Distinct scopes across the caller's roles OR-compose: reachable if ANY admits.
+            target.andWhere(function () {
+                for (const policy of policies) {
+                    this.orWhere(function () {
+                        policy[method](this, user);
+                    });
+                }
+            });
+        };
+        this.Log.trace(`Applying ${policies.length} permission ${policies.length === 1 ? 'policy' : 'policies'} (${method}) for ${resource}`);
         if (joinScoped) {
             builder.whereOnJoin(function () {
-                builder.andWhere(descriptor.OwnerField, user.PrimaryKeyValue);
+                apply(builder);
             });
         }
         else {
-            builder.andWhere(descriptor.OwnerField, user.PrimaryKeyValue);
+            apply(builder);
+        }
+    }
+    /**
+     * Policies to apply for this query: one per distinct scope name across the caller's
+     * granted roles. A role without the grant must not contribute a policy — that would
+     * WIDEN the OR-composition in `afterQueryCreation`. Multiple distinct scopes OR-compose
+     * downstream: permissions are additive, a row is reachable if any granted role's policy
+     * admits it.
+     */
+    policiesFor(roles, resource, ownScope, descriptor, model) {
+        const scopeNames = new Set();
+        for (const role of roles) {
+            // role unknown to accesscontrol answers null — contributes no grant, no scope
+            const permission = probeGrant([role], ownScope, resource);
+            if (!permission?.granted) {
+                continue;
+            }
+            const attrs = permission.attributes ?? [];
+            const tokens = attrs.filter((a) => typeof a === 'string' && a.startsWith(PERMISSION_SCOPE_ATTR_PREFIX)).map((a) => a.slice(PERMISSION_SCOPE_ATTR_PREFIX.length));
+            if (tokens.length === 0) {
+                scopeNames.add(DEFAULT_PERMISSION_SCOPE);
+            }
+            else {
+                tokens.forEach((t) => scopeNames.add(t));
+            }
+        }
+        // canOwn was computed over the role union; per-role queries can still all miss when
+        // grants come from odd extension shapes. Degrade to the default scope — resolution
+        // below still fails loud if nothing is registered.
+        if (scopeNames.size === 0) {
+            scopeNames.add(DEFAULT_PERMISSION_SCOPE);
         }
+        const registered = getOrCreatePolicyMap();
+        const policies = [];
+        for (const name of scopeNames) {
+            const candidates = registered.get(policyMapKey(resource, name));
+            const policyClass = selectPolicyClass(candidates, model);
+            if (policyClass) {
+                policies.push(DI.resolve(policyClass));
+                continue;
+            }
+            if (name === DEFAULT_PERMISSION_SCOPE && descriptor.OwnerField) {
+                policies.push(new OwnerFieldPolicy(descriptor.OwnerField));
+                continue;
+            }
+            this.Log.error(`No OrmPermissionPolicy registered for ${descriptor.Name}/${name} and no OwnerField fallback`);
+            throw new OrmException(`no OrmPermissionPolicy registered for model ${descriptor.Name} scope '${name}' and no OwnerField fallback — refusing to run an unscoped :own query`);
+        }
+        return policies;
     }
     /**
      * Everything both hooks need, or `undefined` when this query is not subject to a check.
@@ -230,32 +304,19 @@ let RbacModelPermissionMiddleware = class RbacModelPermissionMiddleware extends
         }
         const ownScope = storage.PermissionScope ?? scopes.own;
         const anyScope = storage.PermissionScope ?? scopes.all;
-        const roles = storage.ActiveRole ? [storage.ActiveRole] : storage.User.Role;
-        let canAny = false;
-        let canOwn = false;
-        try {
-            canAny = this.Ac.can(roles)[anyScope](resource).granted;
-            canOwn = this.Ac.can(roles)[ownScope](resource).granted;
-        }
-        catch (err) {
-            // accesscontrol throws eg. "Role not found" when role has no grants registered
-            // treat as no permission so caller gets Forbidden instead of library error
-            this.Log.trace(`Permission check for roles ${roles} on resource ${resource} failed: ${err.message}, treating as no permission`);
-        }
+        const roles = effectiveRoles(storage.User, storage);
+        const canAny = probeGrant(roles, anyScope, resource)?.granted ?? false;
+        const canOwn = probeGrant(roles, ownScope, resource)?.granted ?? false;
         // 'readOwn' -> 'read'. Keeps the Forbidden message accurate per builder type instead of
         // the old hard-coded ':read', which was wrong for updates and deletes.
         const action = anyScope.replace(/(Any|Own)$/, '');
-        return { descriptor, resource, canOwn, canAny, action, hook: scopes.hook, user: storage.User };
+        return { descriptor, resource, canOwn, canAny, action, user: storage.User, roles, ownScope };
     }
 };
 __decorate([
     Logger('RBAC'),
     __metadata("design:type", Log)
 ], RbacModelPermissionMiddleware.prototype, "Log", void 0);
-__decorate([
-    Autoinject(),
-    __metadata("design:type", AccessControl)
-], RbacModelPermissionMiddleware.prototype, "Ac", void 0);
 RbacModelPermissionMiddleware = __decorate([
     Injectable(QueryMiddleware)
 ], RbacModelPermissionMiddleware);

package/lib/mjs/middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/middleware.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,YAAY,EAAgB,eAAe,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACnL,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAA2D,kBAAkB,EAAgB,MAAM,iBAAiB,CAAC;AAC5H,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAYlD;;;;;;;;;;;;;GAaG;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAwC;IACzE,CAAC,kBAAiD,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IAC/G,CAAC,kBAAiD,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IAC/G,CAAC,kBAAiD,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IACzG,CAAC,kBAAiD,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;CAChH,CAAC,CAAC;AAEH,6EAA6E;AAC7E,MAAM,yBAAyB,GAAG,IAAI,GAAG,EAAoC,CAAC;AAC9E,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,mBAAmB,EAAE,CAAC;IACjD,yBAAyB,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAChD,yBAAyB,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,OAAqB;IAC3C,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,mBAAmB,EAAE,CAAC;QACjD,IAAI,OAAO,YAAY,IAAI,EAAE,CAAC;YAC5B,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,QAAQ,CAAC,KAAc,EAAE,IAAkB,EAAE,aAAsB;IAC1E,MAAM,OAAO,GAAG,KAAmD,CAAC;IAEpE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,UAAU,EAAE,CAAC;QACxC,OAAO,OAAO,CAAC,IAAI,CAAa,CAAC;IACnC,CAAC;IAED,IAAI,aAAa,IAAI,OAAO,OAAO,CAAC,kBAAkB,CAAC,KAAK,UAAU,EAAE,CAAC;QACvE,OAAO,OAAO,CAAC,kBAAkB,CAAa,CAAC;IACjD,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAGM,IAAM,6BAA6B,GAAnC,MAAM,6BAA8B,SAAQ,eAAe;IAQhE;;;;;OAKG;IACH,KAAK,CAAC,oBAAoB,CAAC,OAA0B;QACnD,IAAI,CAAC,CAAC,OAAO,YAAY,kBAAkB,CAAC,EAAE,CAAC;YAC7C,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAEzD,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,QAAQ,gCAAgC,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QAED,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,SAAS,CAAC,2CAA2C,QAAQ,IAAI,OAAO,CAAC,MAAM,aAAa,CAAC,CAAC;QAC1G,CAAC;QAED;;;;;;;WAOG;QACH,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAE9D,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,mBAAmB,OAAO,CAAC,IAAI,aAAa,QAAQ,EAAE,CAAC,CAAC;YACvE,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;YAC3C,OAAO;QACT,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;YAC3B,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,UAAU,CAAC,IAAI,6DAA6D,CAAC,CAAC;YACtG,MAAM,IAAI,YAAY,CAAC,SAAS,UAAU,CAAC,IAAI,6DAA6D,CAAC,CAAC;QAChH,CAAC;QAED,sFAAsF;QACtF,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC3E,CAAC;IAED,kBAAkB,CAAC,OAAqB;QACtC,yFAAyF;QACzF,uDAAuD;QACvD,IAAI,CAAC,CAAC,OAAO,YAAY,kBAAkB,IAAI,OAAO,YAAY,kBAAkB,IAAI,OAAO,YAAY,kBAAkB,CAAC,EAAE,CAAC;YAC/H,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAEzD,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,QAAQ,yBAAyB,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QAED,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,SAAS,CAAC,2CAA2C,QAAQ,IAAI,OAAO,CAAC,MAAM,aAAa,CAAC,CAAC;QAC1G,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,QAAQ,yBAAyB,CAAC,CAAC;QAE9D;;;WAGG;QACH,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAE7D;;;;;;;WAOG;QACH,MAAM,UAAU,GAAG,UAAU,CAAC,iBAAiB,KAAK,MAAM,IAAI,OAAO,YAAY,kBAAkB,CAAC;QACpG,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QAE1B,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,mBAAmB,OAAO,CAAC,IAAI,aAAa,QAAQ,EAAE,CAAC,CAAC;YACvE,IAAI,UAAU,EAAE,CAAC;gBACd,OAA8B,CAAC,WAAW,CAAC;oBAC1C,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBAC/B,CAAC,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC/B,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;YAC3B,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,UAAU,CAAC,IAAI,qFAAqF,CAAC,CAAC;YAC9H,MAAM,IAAI,YAAY,CAAC,SAAS,UAAU,CAAC,IAAI,6DAA6D,CAAC,CAAC;QAChH,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,wCAAwC,QAAQ,EAAE,CAAC,CAAC;QACnE,IAAI,UAAU,EAAE,CAAC;YACd,OAA8B,CAAC,WAAW,CAAC;gBAC1C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YAChE,CAAC,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACO,OAAO,CAAC,OAAqB;QACrC,IAAI,OAAO,iBAAiB,KAAK,UAAU,EAAE,CAAC;YAC5C,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,KAAK,GAAG,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,KAAK,EAAE,QAAQ,EAAmC,CAAC;QAEnE,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,OAAO,CAAC,wBAAwB,EAAE,CAAC;YACrC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,oFAAoF,CAAC,CAAC;YACrG,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,UAAU,GAAG,sBAAsB,CAAC,OAAO,CAAC,KAAK,CAAyB,CAAC;QAEjF,uEAAuE;QACvE,MAAM,QAAQ,GAAG,UAAU,EAAE,YAAY,CAAC;QAC1C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,oFAAoF;YACpF,6EAA6E;YAC7E,mDAAmD;YACnD,MAAM,IAAI,YAAY,CAAC,mDAAmD,OAAO,CAAC,WAAW,CAAC,IAAI,oCAAoC,CAAC,CAAC;QAC1I,CAAC;QAED,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,yBAAyB,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YAExE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,oBAAoB,OAAO,CAAC,eAAe,qDAAqD,CAAC,CAAC;gBAChH,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,IAAI,CAAC,CAAC,OAAO,YAAY,QAAQ,CAAC,EAAE,CAAC;gBACnC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,oBAAoB,OAAO,CAAC,eAAe,8BAA+B,OAAwB,CAAC,WAAW,CAAC,IAAI,uBAAuB,CAAC,CAAC;gBAC1J,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,eAAe,IAAI,MAAM,CAAC,GAAG,CAAC;QACvD,MAAM,QAAQ,GAAG,OAAO,CAAC,eAAe,IAAI,MAAM,CAAC,GAAG,CAAC;QACvD,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QAE5E,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAI,IAAI,CAAC,EAAG,CAAC,GAAG,CAAC,KAAK,CAAS,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC;YAClE,MAAM,GAAI,IAAI,CAAC,EAAG,CAAC,GAAG,CAAC,KAAK,CAAS,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC;QACpE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,+EAA+E;YAC/E,2EAA2E;YAC3E,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,8BAA8B,KAAK,gBAAgB,QAAQ,YAAa,GAAa,CAAC,OAAO,6BAA6B,CAAC,CAAC;QAC7I,CAAC;QAED,wFAAwF;QACxF,uEAAuE;QACvE,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QAElD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IACjG,CAAC;CACF,CAAA;AAzMW;IADT,MAAM,CAAC,MAAM,CAAC;8BACC,GAAG;0DAAC;AAGV;IADT,UAAU,EAAE;8BACE,aAAa;yDAAC;AANlB,6BAA6B;IADzC,UAAU,CAAC,eAAe,CAAC;GACf,6BAA6B,CA4MzC"}
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/middleware.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAS,EAAE,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,kBAAkB,EAA4B,YAAY,EAAgB,eAAe,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAC7M,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAElD,OAAO,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,mBAAmB,EAA4B,4BAA4B,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACpM,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AASrE;;;;;;;;;;;GAWG;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAwC;IACzE,CAAC,kBAAiD,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;IAC3F,CAAC,kBAAiD,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;IAC3F,CAAC,kBAAiD,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;IACvF,CAAC,kBAAiD,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;CAC5F,CAAC,CAAC;AAEH,6EAA6E;AAC7E,MAAM,yBAAyB,GAAG,IAAI,GAAG,EAAoC,CAAC;AAC9E,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,mBAAmB,EAAE,CAAC;IACjD,yBAAyB,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAChD,yBAAyB,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,OAAqB;IAC3C,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,mBAAmB,EAAE,CAAC;QACjD,IAAI,OAAO,YAAY,IAAI,EAAE,CAAC;YAC5B,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CAAC,KAA4C,EAAE,UAAqC;IACrG,IAAI,OAAO,GAAiD,KAAK,CAAC;IAClE,KAAK,IAAI,QAAQ,GAAG,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC;QAC3C,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;YAC3B,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,GAAG,MAAM,CAAC,cAAc,CAAC,OAAO,CAAqC,CAAC;IAC/E,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CAAC,UAAkD,EAAE,KAA4C;IACzH,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,IAA0C,CAAC;IAC/C,IAAI,YAAY,GAAG,QAAQ,CAAC;IAE5B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,UAAU,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC/C,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,GAAG,YAAY,EAAE,CAAC;YACtD,IAAI,GAAG,SAAS,CAAC;YACjB,YAAY,GAAG,QAAQ,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,kFAAkF;AAClF,MAAM,gBAAiB,SAAQ,mBAAmB;IAChD,YAAoB,UAAkB;QACpC,KAAK,EAAE,CAAC;0BADU,UAAU;IAE9B,CAAC;IAEM,KAAK,CAAC,KAAwC,EAAE,IAAU;QAC/D,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACxD,CAAC;IAEM,KAAK,CAAC,eAAe,CAAC,KAAyB,EAAE,IAAU;QAChE,sFAAsF;QACtF,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IAC3D,CAAC;CACF;AAGM,IAAM,6BAA6B,GAAnC,MAAM,6BAA8B,SAAQ,eAAe;IAIhE;;;;;OAKG;IACH,KAAK,CAAC,oBAAoB,CAAC,OAA0B;QACnD,IAAI,CAAC,CAAC,OAAO,YAAY,kBAAkB,CAAC,EAAE,CAAC;YAC7C,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAEzD,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,QAAQ,gCAAgC,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QAED,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,SAAS,CAAC,2CAA2C,QAAQ,IAAI,OAAO,CAAC,MAAM,aAAa,CAAC,CAAC;QAC1G,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAExG,2EAA2E;QAC3E,wFAAwF;QACxF,uFAAuF;QACvF,wFAAwF;QACxF,0CAA0C;QAC1C,MAAM,cAAc,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;YAC7C,MAAM,cAAc,GAAG,MAAM,CAAC,eAAe,KAAK,mBAAmB,CAAC,SAAS,CAAC,eAAe,CAAC;YAChG,OAAO,CAAC,cAAc,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,gBAAgB,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACzG,CAAC,CAAC,CAAC;QAEH,mFAAmF;QACnF,qFAAqF;QACrF,oDAAoD;QACpD,IAAI,SAAkB,CAAC;QACvB,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;YACpC,IAAI,CAAC;gBACH,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,+BAA+B,MAAM,CAAC,WAAW,CAAC,IAAI,QAAQ,QAAQ,EAAE,CAAC,CAAC;gBACzF,MAAM,MAAM,CAAC,eAAe,CAAC,OAA6B,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;gBAC1E,OAAO;YACT,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,SAAS,GAAG,GAAG,CAAC;YAClB,CAAC;QACH,CAAC;QAED,MAAM,SAAS,CAAC;IAClB,CAAC;IAED,kBAAkB,CAAC,OAAqB;QACtC,yFAAyF;QACzF,uDAAuD;QACvD,IAAI,CAAC,CAAC,OAAO,YAAY,kBAAkB,IAAI,OAAO,YAAY,kBAAkB,IAAI,OAAO,YAAY,kBAAkB,CAAC,EAAE,CAAC;YAC/H,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAEzD,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,QAAQ,yBAAyB,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QAED,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,SAAS,CAAC,2CAA2C,QAAQ,IAAI,OAAO,CAAC,MAAM,aAAa,CAAC,CAAC;QAC1G,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,QAAQ,yBAAyB,CAAC,CAAC;QAE9D;;;;;;;WAOG;QACH,MAAM,UAAU,GAAG,UAAU,CAAC,iBAAiB,KAAK,MAAM,IAAI,OAAO,YAAY,kBAAkB,CAAC;QAEpG,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAExG,MAAM,MAAM,GAAG,OAAO,YAAY,kBAAkB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,YAAY,kBAAkB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC;QAE3I,MAAM,KAAK,GAAG,CAAC,MAA8B,EAAE,EAAE;YAC/C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBAClC,OAAO;YACT,CAAC;YACD,iFAAiF;YACjF,MAAM,CAAC,QAAQ,CAAC;gBACd,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;oBAC9B,IAAI,CAAC,OAAO,CAAC;wBACX,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;oBAC7B,CAAC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,QAAQ,CAAC,MAAM,eAAe,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,KAAK,MAAM,SAAS,QAAQ,EAAE,CAAC,CAAC;QAEtI,IAAI,UAAU,EAAE,CAAC;YACd,OAA8B,CAAC,WAAW,CAAC;gBAC1C,KAAK,CAAC,OAA4C,CAAC,CAAC;YACtD,CAAC,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,OAA4C,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACO,WAAW,CAAC,KAAe,EAAE,QAAgB,EAAE,QAAwB,EAAE,UAAgC,EAAE,KAA4C;QAC/J,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QAErC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,8EAA8E;YAC9E,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC1D,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC;gBACzB,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAI,UAAU,CAAC,UAAuB,IAAI,EAAE,CAAC;YAExD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,4BAA4B,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAC,MAAM,CAAC,CAAC,CAAC;YAEjK,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,UAAU,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;YAC3C,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;QAED,oFAAoF;QACpF,mFAAmF;QACnF,mDAAmD;QACnD,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC1B,UAAU,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,UAAU,GAAG,oBAAoB,EAAE,CAAC;QAE1C,MAAM,QAAQ,GAA0B,EAAE,CAAC;QAC3C,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;YAChE,MAAM,WAAW,GAAG,iBAAiB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YACzD,IAAI,WAAW,EAAE,CAAC;gBAChB,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;gBACvC,SAAS;YACX,CAAC;YAED,IAAI,IAAI,KAAK,wBAAwB,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;gBAC/D,QAAQ,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;gBAC3D,SAAS;YACX,CAAC;YAED,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,yCAAyC,UAAU,CAAC,IAAI,IAAI,IAAI,6BAA6B,CAAC,CAAC;YAC9G,MAAM,IAAI,YAAY,CAAC,+CAA+C,UAAU,CAAC,IAAI,WAAW,IAAI,uEAAuE,CAAC,CAAC;QAC/K,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;;OAMG;IACO,OAAO,CAAC,OAAqB;QACrC,IAAI,OAAO,iBAAiB,KAAK,UAAU,EAAE,CAAC;YAC5C,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,KAAK,GAAG,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,KAAK,EAAE,QAAQ,EAAmC,CAAC;QAEnE,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,OAAO,CAAC,wBAAwB,EAAE,CAAC;YACrC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,oFAAoF,CAAC,CAAC;YACrG,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,UAAU,GAAG,sBAAsB,CAAC,OAAO,CAAC,KAAK,CAAyB,CAAC;QAEjF,uEAAuE;QACvE,MAAM,QAAQ,GAAG,UAAU,EAAE,YAAY,CAAC;QAC1C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,oFAAoF;YACpF,6EAA6E;YAC7E,mDAAmD;YACnD,MAAM,IAAI,YAAY,CAAC,mDAAmD,OAAO,CAAC,WAAW,CAAC,IAAI,oCAAoC,CAAC,CAAC;QAC1I,CAAC;QAED,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,yBAAyB,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YAExE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,oBAAoB,OAAO,CAAC,eAAe,qDAAqD,CAAC,CAAC;gBAChH,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,IAAI,CAAC,CAAC,OAAO,YAAY,QAAQ,CAAC,EAAE,CAAC;gBACnC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,oBAAoB,OAAO,CAAC,eAAe,8BAA+B,OAAwB,CAAC,WAAW,CAAC,IAAI,uBAAuB,CAAC,CAAC;gBAC1J,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,eAAe,IAAI,MAAM,CAAC,GAAG,CAAC;QACvD,MAAM,QAAQ,GAAG,OAAO,CAAC,eAAe,IAAI,MAAM,CAAC,GAAG,CAAC;QACvD,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,OAAO,IAAI,KAAK,CAAC;QACvE,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,OAAO,IAAI,KAAK,CAAC;QAEvE,wFAAwF;QACxF,uEAAuE;QACvE,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QAElD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IAC/F,CAAC;CACF,CAAA;AAvPW;IADT,MAAM,CAAC,MAAM,CAAC;8BACC,GAAG;0DAAC;AAFT,6BAA6B;IADzC,UAAU,CAAC,eAAe,CAAC;GACf,6BAA6B,CAyPzC"}

package/lib/mjs/orm-permission.d.ts

@@ -0,0 +1,77 @@
+import { Class } from '@spinajs/di';
+import { InsertQueryBuilder, IWhereBuilder, ModelBase } from '@spinajs/orm';
+import type { User } from './models/User.js';
+export declare const DEFAULT_PERMISSION_SCOPE = "default";
+/**
+ * Attribute prefix marking a named permission scope on a role grant (eg. `'scope:pool'`),
+ * read by `RbacModelPermissionMiddleware.policiesFor()` to pick a non-default
+ * `OrmPermissionPolicy`.
+ *
+ * WARNING: `accesscontrol`'s attribute union across a role and every role it `$extend`s
+ * collapses `['*']` merged with `['scope:x']` down to `['*']` (glob union absorption). A role
+ * granting `read:own: ['scope:pool']` while a role it `$extend`s (or that extends it) grants
+ * the same resource `['*']` silently loses the `scope:pool` token, and resolution falls
+ * through to the DEFAULT policy instead of the named one. This is a known limitation, not
+ * handled by this module — never mix `['*']` and `scope:` attributes for the SAME resource
+ * across an `$extend` chain.
+ */
+export declare const PERMISSION_SCOPE_ATTR_PREFIX = "scope:";
+export declare const ORM_PERMISSION_POLICY_MAP = "__orm_permission_policy__";
+/**
+ * Bound model recorded on a policy class by `@OrmPermission`. Needed because the map is
+ * keyed on the shared resource STRING (minification-safe), which two unrelated models can
+ * legally share for grant purposes — the model recorded here is what lets `policiesFor()`
+ * in middleware.ts pick the right policy for `builder.Model` instead of an arbitrary one.
+ */
+export declare const ORM_PERMISSION_MODEL: unique symbol;
+/**
+ * Keyed on the DECLARED `@OrmResource` string, never on `constructor.name` — grants are
+ * keyed on the same string, so a model's resource name is the single permission identity
+ * everywhere, and models sharing a resource (a view over the base table) share policies.
+ */
+export declare function policyMapKey(resource: string, scope: string): string;
+export declare abstract class OrmPermissionPolicy<M extends ModelBase<unknown> = ModelBase<unknown>> {
+    /**
+     * Default throws so an accidentally inert policy fails loud instead of running an
+     * unscoped query.
+     */
+    scope(_query: IWhereBuilder<M>, _user: User): void;
+    scopeRead(query: IWhereBuilder<M>, user: User): void;
+    scopeUpdate(query: IWhereBuilder<M>, user: User): void;
+    scopeDelete(query: IWhereBuilder<M>, user: User): void;
+    /**
+     * Default denies: a policy that does not opt into insert control must not silently
+     * allow inserts under a `:own` grant. An authorization denial, not a config error, so
+     * `Forbidden` (403) — contrast `scope()`'s default, which stays `OrmException` because an
+     * unimplemented scope is a config bug. Callers with an `OwnerField` never reach this: see
+     * `RbacModelPermissionMiddleware.beforeQueryExecution`'s OwnerField fallback.
+     */
+    authorizeCreate(_query: InsertQueryBuilder, _user: User): Promise<void>;
+}
+export type OrmPermissionPolicyClass = Class<OrmPermissionPolicy>;
+/** The model `@OrmPermission` bound `policy` to, or `undefined` for a policy built by hand
+ * (eg. the `OwnerFieldPolicy` fallback) that never went through the decorator.
+ *
+ * Read as an OWN property: `target[ORM_PERMISSION_MODEL] = model` stamps the constructor
+ * object itself, and ES class inheritance chains constructors ( `Sub.__proto__ === Base` ), so
+ * a plain property read here would let an undecorated `class Sub extends Base {}` silently
+ * inherit `Base`'s bound model instead of having none.
+ */
+export declare function ormPermissionModel(policy: OrmPermissionPolicyClass): Class<ModelBase<unknown>> | undefined;
+/**
+ * The single accessor for the policy map — used by both the registration side
+ * (`OrmPermission`) and the resolution side (`RbacModelPermissionMiddleware.policiesFor`) so
+ * the two can never read/write through differing DI cache accessors and drift apart.
+ */
+export declare function getOrCreatePolicyMap(): Map<string, OrmPermissionPolicyClass[]>;
+/**
+ * Registers `target` as a policy for `model`'s resource + `scope` in the DI hashmap.
+ * Refuses a model without `@OrmResource` (cannot be permission-guarded). The map value is a
+ * LIST: two unrelated models are allowed to share one resource+scope key (the
+ * CampaignFileAttachment / ArrowV1CampaignView shape) — only the same (model, scope) pair
+ * registered twice is a duplicate/config bug.
+ */
+export declare function OrmPermission<M extends ModelBase<unknown>>(model: Class<M>, scope?: string): (target: Class<OrmPermissionPolicy<M>>) => void;
+/** Test helper — wipes all registrations from the DI cache. */
+export declare function clearOrmPermissionRegistry(): void;
+//# sourceMappingURL=orm-permission.d.ts.map

package/lib/mjs/orm-permission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"orm-permission.d.ts","sourceRoot":"","sources":["../../src/orm-permission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAM,MAAM,aAAa,CAAC;AACxC,OAAO,EAA0B,kBAAkB,EAAE,aAAa,EAAE,SAAS,EAAgB,MAAM,cAAc,CAAC;AAGlH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAE7C,eAAO,MAAM,wBAAwB,YAAY,CAAC;AAElD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,4BAA4B,WAAW,CAAC;AACrD,eAAO,MAAM,yBAAyB,8BAA8B,CAAC;AAErE;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,eAAqC,CAAC;AAEvE;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpE;AAED,8BAAsB,mBAAmB,CAAC,CAAC,SAAS,SAAS,CAAC,OAAO,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;IACzF;;;OAGG;IACI,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,GAAG,IAAI,CAExD;IAEM,SAAS,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAE1D;IAEM,WAAW,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAE5D;IAEM,WAAW,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAE5D;IAED;;;;;;OAMG;IACU,eAAe,CAAC,MAAM,EAAE,kBAAkB,EAAE,KAAK,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAEnF;CACF;AAED,MAAM,MAAM,wBAAwB,GAAG,KAAK,CAAC,mBAAmB,CAAC,CAAC;AAElE;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,wBAAwB,GAAG,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,GAAG,SAAS,CAG1G;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,IAAI,GAAG,CAAC,MAAM,EAAE,wBAAwB,EAAE,CAAC,CAO9E;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,SAAS,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,GAAE,MAAiC,YACnG,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,KAAG,IAAI,CAqBrD;AAED,+DAA+D;AAC/D,wBAAgB,0BAA0B,IAAI,IAAI,CAIjD"}

package/lib/mjs/orm-permission.js

@@ -0,0 +1,119 @@
+import { DI } from '@spinajs/di';
+import { extractModelDescriptor, OrmException } from '@spinajs/orm';
+import { Forbidden } from '@spinajs/exceptions';
+export const DEFAULT_PERMISSION_SCOPE = 'default';
+/**
+ * Attribute prefix marking a named permission scope on a role grant (eg. `'scope:pool'`),
+ * read by `RbacModelPermissionMiddleware.policiesFor()` to pick a non-default
+ * `OrmPermissionPolicy`.
+ *
+ * WARNING: `accesscontrol`'s attribute union across a role and every role it `$extend`s
+ * collapses `['*']` merged with `['scope:x']` down to `['*']` (glob union absorption). A role
+ * granting `read:own: ['scope:pool']` while a role it `$extend`s (or that extends it) grants
+ * the same resource `['*']` silently loses the `scope:pool` token, and resolution falls
+ * through to the DEFAULT policy instead of the named one. This is a known limitation, not
+ * handled by this module — never mix `['*']` and `scope:` attributes for the SAME resource
+ * across an `$extend` chain.
+ */
+export const PERMISSION_SCOPE_ATTR_PREFIX = 'scope:';
+export const ORM_PERMISSION_POLICY_MAP = '__orm_permission_policy__';
+/**
+ * Bound model recorded on a policy class by `@OrmPermission`. Needed because the map is
+ * keyed on the shared resource STRING (minification-safe), which two unrelated models can
+ * legally share for grant purposes — the model recorded here is what lets `policiesFor()`
+ * in middleware.ts pick the right policy for `builder.Model` instead of an arbitrary one.
+ */
+export const ORM_PERMISSION_MODEL = Symbol.for('orm-permission-model');
+/**
+ * Keyed on the DECLARED `@OrmResource` string, never on `constructor.name` — grants are
+ * keyed on the same string, so a model's resource name is the single permission identity
+ * everywhere, and models sharing a resource (a view over the base table) share policies.
+ */
+export function policyMapKey(resource, scope) {
+    return `${resource}:${scope}`;
+}
+export class OrmPermissionPolicy {
+    /**
+     * Default throws so an accidentally inert policy fails loud instead of running an
+     * unscoped query.
+     */
+    scope(_query, _user) {
+        throw new OrmException(`${this.constructor.name} defines neither a generic scope() nor a specific hook for this operation`);
+    }
+    scopeRead(query, user) {
+        this.scope(query, user);
+    }
+    scopeUpdate(query, user) {
+        this.scope(query, user);
+    }
+    scopeDelete(query, user) {
+        this.scope(query, user);
+    }
+    /**
+     * Default denies: a policy that does not opt into insert control must not silently
+     * allow inserts under a `:own` grant. An authorization denial, not a config error, so
+     * `Forbidden` (403) — contrast `scope()`'s default, which stays `OrmException` because an
+     * unimplemented scope is a config bug. Callers with an `OwnerField` never reach this: see
+     * `RbacModelPermissionMiddleware.beforeQueryExecution`'s OwnerField fallback.
+     */
+    async authorizeCreate(_query, _user) {
+        throw new Forbidden(`${this.constructor.name} does not implement authorizeCreate — INSERT under :own is not permitted by this policy`);
+    }
+}
+/** The model `@OrmPermission` bound `policy` to, or `undefined` for a policy built by hand
+ * (eg. the `OwnerFieldPolicy` fallback) that never went through the decorator.
+ *
+ * Read as an OWN property: `target[ORM_PERMISSION_MODEL] = model` stamps the constructor
+ * object itself, and ES class inheritance chains constructors ( `Sub.__proto__ === Base` ), so
+ * a plain property read here would let an undecorated `class Sub extends Base {}` silently
+ * inherit `Base`'s bound model instead of having none.
+ */
+export function ormPermissionModel(policy) {
+    const target = policy;
+    return Object.prototype.hasOwnProperty.call(policy, ORM_PERMISSION_MODEL) ? target[ORM_PERMISSION_MODEL] : undefined;
+}
+/**
+ * The single accessor for the policy map — used by both the registration side
+ * (`OrmPermission`) and the resolution side (`RbacModelPermissionMiddleware.policiesFor`) so
+ * the two can never read/write through differing DI cache accessors and drift apart.
+ */
+export function getOrCreatePolicyMap() {
+    if (DI.RootContainer.Cache.has(ORM_PERMISSION_POLICY_MAP)) {
+        return DI.RootContainer.Cache.get(ORM_PERMISSION_POLICY_MAP)[0];
+    }
+    const map = new Map();
+    DI.RootContainer.Cache.add(ORM_PERMISSION_POLICY_MAP, map);
+    return map;
+}
+/**
+ * Registers `target` as a policy for `model`'s resource + `scope` in the DI hashmap.
+ * Refuses a model without `@OrmResource` (cannot be permission-guarded). The map value is a
+ * LIST: two unrelated models are allowed to share one resource+scope key (the
+ * CampaignFileAttachment / ArrowV1CampaignView shape) — only the same (model, scope) pair
+ * registered twice is a duplicate/config bug.
+ */
+export function OrmPermission(model, scope = DEFAULT_PERMISSION_SCOPE) {
+    return (target) => {
+        const descriptor = extractModelDescriptor(model);
+        const resource = descriptor?.RbacResource;
+        if (!resource) {
+            throw new OrmException(`cannot register ${target.name} for ${model.name}: model has no @OrmResource declaration`);
+        }
+        target[ORM_PERMISSION_MODEL] = model;
+        const key = policyMapKey(resource, scope);
+        const map = getOrCreatePolicyMap();
+        const list = map.get(key) ?? [];
+        if (list.some((p) => ormPermissionModel(p) === model)) {
+            throw new OrmException(`duplicate OrmPermission registration for ${model.name}/${scope} (${target.name} already registered for this model+scope)`);
+        }
+        list.push(target);
+        map.set(key, list);
+    };
+}
+/** Test helper — wipes all registrations from the DI cache. */
+export function clearOrmPermissionRegistry() {
+    if (DI.RootContainer.Cache.has(ORM_PERMISSION_POLICY_MAP)) {
+        DI.RootContainer.Cache.remove(ORM_PERMISSION_POLICY_MAP);
+    }
+}
+//# sourceMappingURL=orm-permission.js.map

package/lib/mjs/orm-permission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"orm-permission.js","sourceRoot":"","sources":["../../src/orm-permission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAS,EAAE,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,sBAAsB,EAAgD,YAAY,EAAE,MAAM,cAAc,CAAC;AAClH,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAIhD,MAAM,CAAC,MAAM,wBAAwB,GAAG,SAAS,CAAC;AAElD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,QAAQ,CAAC;AACrD,MAAM,CAAC,MAAM,yBAAyB,GAAG,2BAA2B,CAAC;AAErE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;AAEvE;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,KAAa;IAC1D,OAAO,GAAG,QAAQ,IAAI,KAAK,EAAE,CAAC;AAChC,CAAC;AAED,MAAM,OAAgB,mBAAmB;IACvC;;;OAGG;IACI,KAAK,CAAC,MAAwB,EAAE,KAAW;QAChD,MAAM,IAAI,YAAY,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,2EAA2E,CAAC,CAAC;IAC9H,CAAC;IAEM,SAAS,CAAC,KAAuB,EAAE,IAAU;QAClD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC1B,CAAC;IAEM,WAAW,CAAC,KAAuB,EAAE,IAAU;QACpD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC1B,CAAC;IAEM,WAAW,CAAC,KAAuB,EAAE,IAAU;QACpD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,eAAe,CAAC,MAA0B,EAAE,KAAW;QAClE,MAAM,IAAI,SAAS,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,yFAAyF,CAAC,CAAC;IACzI,CAAC;CACF;AAID;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAgC;IACjE,MAAM,MAAM,GAAG,MAA0E,CAAC;IAC1F,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACvH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB;IAClC,IAAI,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,yBAAyB,CAAC,EAAE,CAAC;QAC1D,OAAO,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAA4C,CAAC;IAC7G,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAsC,CAAC;IAC1D,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;IAC3D,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAA+B,KAAe,EAAE,KAAK,GAAW,wBAAwB;IACnH,OAAO,CAAC,MAAqC,EAAQ,EAAE;QACrD,MAAM,UAAU,GAAG,sBAAsB,CAAC,KAAK,CAAgC,CAAC;QAChF,MAAM,QAAQ,GAAG,UAAU,EAAE,YAAY,CAAC;QAE1C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,YAAY,CAAC,mBAAmB,MAAM,CAAC,IAAI,QAAQ,KAAK,CAAC,IAAI,yCAAyC,CAAC,CAAC;QACpH,CAAC;QAEA,MAA8C,CAAC,oBAAoB,CAAC,GAAG,KAAK,CAAC;QAE9E,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,oBAAoB,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAEhC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,YAAY,CAAC,4CAA4C,KAAK,CAAC,IAAI,IAAI,KAAK,KAAK,MAAM,CAAC,IAAI,2CAA2C,CAAC,CAAC;QACrJ,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,MAA6C,CAAC,CAAC;QACzD,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACrB,CAAC,CAAC;AACJ,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,0BAA0B;IACxC,IAAI,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,yBAAyB,CAAC,EAAE,CAAC;QAC1D,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC"}