@stigmer/server 3.21.0 → 3.22.1-dev.20260922095755
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/authorization/authorizer.d.ts +4 -8
- package/dist/authorization/authorizer.d.ts.map +1 -1
- package/dist/authorization/authorizer.js +5 -9
- package/dist/authorization/authorizer.js.map +1 -1
- package/dist/authorization/derived-tuples.d.ts.map +1 -1
- package/dist/authorization/derived-tuples.js +10 -25
- package/dist/authorization/derived-tuples.js.map +1 -1
- package/dist/authorization/evaluator.d.ts +13 -8
- package/dist/authorization/evaluator.d.ts.map +1 -1
- package/dist/authorization/evaluator.js +4 -20
- package/dist/authorization/evaluator.js.map +1 -1
- package/dist/authorization/list-read-scope.d.ts.map +1 -1
- package/dist/authorization/list-read-scope.js +24 -20
- package/dist/authorization/list-read-scope.js.map +1 -1
- package/dist/authorization/model/agent.d.ts.map +1 -1
- package/dist/authorization/model/agent.js +4 -5
- package/dist/authorization/model/agent.js.map +1 -1
- package/dist/authorization/model/agent_instance.d.ts.map +1 -1
- package/dist/authorization/model/agent_instance.js +2 -2
- package/dist/authorization/model/agent_instance.js.map +1 -1
- package/dist/authorization/model/mcp_server.d.ts.map +1 -1
- package/dist/authorization/model/mcp_server.js +2 -2
- package/dist/authorization/model/mcp_server.js.map +1 -1
- package/dist/authorization/model/organization.d.ts.map +1 -1
- package/dist/authorization/model/organization.js +2 -0
- package/dist/authorization/model/organization.js.map +1 -1
- package/dist/authorization/model/plugin.d.ts.map +1 -1
- package/dist/authorization/model/plugin.js +3 -4
- package/dist/authorization/model/plugin.js.map +1 -1
- package/dist/authorization/model/rewrite.d.ts +8 -10
- package/dist/authorization/model/rewrite.d.ts.map +1 -1
- package/dist/authorization/model/rewrite.js +0 -3
- package/dist/authorization/model/rewrite.js.map +1 -1
- package/dist/authorization/model/skill.d.ts.map +1 -1
- package/dist/authorization/model/skill.js +2 -2
- package/dist/authorization/model/skill.js.map +1 -1
- package/dist/authorization/model/workflow.d.ts.map +1 -1
- package/dist/authorization/model/workflow.js +2 -2
- package/dist/authorization/model/workflow.js.map +1 -1
- package/dist/authorization/model/workflow_instance.d.ts.map +1 -1
- package/dist/authorization/model/workflow_instance.js +2 -2
- package/dist/authorization/model/workflow_instance.js.map +1 -1
- package/dist/authorization/organization-directory.d.ts.map +1 -1
- package/dist/authorization/organization-directory.js +2 -3
- package/dist/authorization/organization-directory.js.map +1 -1
- package/dist/authorization/store-test-kit.d.ts +0 -6
- package/dist/authorization/store-test-kit.d.ts.map +1 -1
- package/dist/authorization/store-test-kit.js +16 -62
- package/dist/authorization/store-test-kit.js.map +1 -1
- package/dist/authorization/tuples.d.ts +13 -32
- package/dist/authorization/tuples.d.ts.map +1 -1
- package/dist/authorization/tuples.js +3 -11
- package/dist/authorization/tuples.js.map +1 -1
- package/dist/domain/agent/controller.d.ts.map +1 -1
- package/dist/domain/agent/controller.js +6 -4
- package/dist/domain/agent/controller.js.map +1 -1
- package/dist/domain/agentchannel/controller.d.ts.map +1 -1
- package/dist/domain/agentchannel/controller.js +9 -2
- package/dist/domain/agentchannel/controller.js.map +1 -1
- package/dist/domain/agentchannel/steps.d.ts +19 -0
- package/dist/domain/agentchannel/steps.d.ts.map +1 -1
- package/dist/domain/agentchannel/steps.js +32 -0
- package/dist/domain/agentchannel/steps.js.map +1 -1
- package/dist/domain/agentexecution/controller.d.ts.map +1 -1
- package/dist/domain/agentexecution/controller.js +3 -1
- package/dist/domain/agentexecution/controller.js.map +1 -1
- package/dist/domain/agentinstance/controller.d.ts +5 -5
- package/dist/domain/agentinstance/controller.d.ts.map +1 -1
- package/dist/domain/agentinstance/controller.js +9 -5
- package/dist/domain/agentinstance/controller.js.map +1 -1
- package/dist/domain/agentinstance/steps.d.ts +43 -8
- package/dist/domain/agentinstance/steps.d.ts.map +1 -1
- package/dist/domain/agentinstance/steps.js +71 -8
- package/dist/domain/agentinstance/steps.js.map +1 -1
- package/dist/domain/agentshare/constants.d.ts +6 -11
- package/dist/domain/agentshare/constants.d.ts.map +1 -1
- package/dist/domain/agentshare/constants.js +8 -16
- package/dist/domain/agentshare/constants.js.map +1 -1
- package/dist/domain/agentshare/controller.d.ts.map +1 -1
- package/dist/domain/agentshare/controller.js +10 -2
- package/dist/domain/agentshare/controller.js.map +1 -1
- package/dist/domain/agentshare/steps.d.ts +61 -10
- package/dist/domain/agentshare/steps.d.ts.map +1 -1
- package/dist/domain/agentshare/steps.js +121 -117
- package/dist/domain/agentshare/steps.js.map +1 -1
- package/dist/domain/artifact/controller.js +21 -25
- package/dist/domain/artifact/controller.js.map +1 -1
- package/dist/domain/channelapp/controller.d.ts.map +1 -1
- package/dist/domain/channelapp/controller.js +2 -0
- package/dist/domain/channelapp/controller.js.map +1 -1
- package/dist/domain/environment/controller.d.ts.map +1 -1
- package/dist/domain/environment/controller.js +4 -3
- package/dist/domain/environment/controller.js.map +1 -1
- package/dist/domain/executioncontext/controller.d.ts.map +1 -1
- package/dist/domain/executioncontext/controller.js +4 -1
- package/dist/domain/executioncontext/controller.js.map +1 -1
- package/dist/domain/executioncontext/steps.d.ts.map +1 -1
- package/dist/domain/executioncontext/steps.js +2 -1
- package/dist/domain/executioncontext/steps.js.map +1 -1
- package/dist/domain/mcpserver/connect.d.ts.map +1 -1
- package/dist/domain/mcpserver/connect.js +8 -7
- package/dist/domain/mcpserver/connect.js.map +1 -1
- package/dist/domain/mcpserver/controller.d.ts.map +1 -1
- package/dist/domain/mcpserver/controller.js +5 -4
- package/dist/domain/mcpserver/controller.js.map +1 -1
- package/dist/domain/mcpserver/start-connect.d.ts.map +1 -1
- package/dist/domain/mcpserver/start-connect.js +8 -7
- package/dist/domain/mcpserver/start-connect.js.map +1 -1
- package/dist/domain/memory/controller.d.ts.map +1 -1
- package/dist/domain/memory/controller.js +6 -1
- package/dist/domain/memory/controller.js.map +1 -1
- package/dist/domain/memory/steps.d.ts +23 -0
- package/dist/domain/memory/steps.d.ts.map +1 -1
- package/dist/domain/memory/steps.js +35 -0
- package/dist/domain/memory/steps.js.map +1 -1
- package/dist/domain/oauthapp/controller.d.ts.map +1 -1
- package/dist/domain/oauthapp/controller.js +2 -0
- package/dist/domain/oauthapp/controller.js.map +1 -1
- package/dist/domain/plugin/controller.d.ts.map +1 -1
- package/dist/domain/plugin/controller.js +6 -27
- package/dist/domain/plugin/controller.js.map +1 -1
- package/dist/domain/plugin/push.d.ts +7 -5
- package/dist/domain/plugin/push.d.ts.map +1 -1
- package/dist/domain/plugin/push.js +8 -14
- package/dist/domain/plugin/push.js.map +1 -1
- package/dist/domain/schedule/controller.d.ts.map +1 -1
- package/dist/domain/schedule/controller.js +10 -2
- package/dist/domain/schedule/controller.js.map +1 -1
- package/dist/domain/schedule/steps.d.ts +19 -0
- package/dist/domain/schedule/steps.d.ts.map +1 -1
- package/dist/domain/schedule/steps.js +32 -0
- package/dist/domain/schedule/steps.js.map +1 -1
- package/dist/domain/session/controller.d.ts.map +1 -1
- package/dist/domain/session/controller.js +3 -2
- package/dist/domain/session/controller.js.map +1 -1
- package/dist/domain/session/steps.d.ts +8 -9
- package/dist/domain/session/steps.d.ts.map +1 -1
- package/dist/domain/session/steps.js +17 -21
- package/dist/domain/session/steps.js.map +1 -1
- package/dist/domain/skill/controller.d.ts.map +1 -1
- package/dist/domain/skill/controller.js +8 -19
- package/dist/domain/skill/controller.js.map +1 -1
- package/dist/domain/workflow/agent-call-references.d.ts +54 -0
- package/dist/domain/workflow/agent-call-references.d.ts.map +1 -0
- package/dist/domain/workflow/agent-call-references.js +97 -0
- package/dist/domain/workflow/agent-call-references.js.map +1 -0
- package/dist/domain/workflow/controller.d.ts.map +1 -1
- package/dist/domain/workflow/controller.js +44 -113
- package/dist/domain/workflow/controller.js.map +1 -1
- package/dist/domain/workflow/registry/data/task-kind-registry.json +1 -1
- package/dist/domain/workflow/validation/task-config-constraints.d.ts +10 -1
- package/dist/domain/workflow/validation/task-config-constraints.d.ts.map +1 -1
- package/dist/domain/workflow/validation/task-config-constraints.js +3 -2
- package/dist/domain/workflow/validation/task-config-constraints.js.map +1 -1
- package/dist/domain/workflow/version-resolution.d.ts +5 -0
- package/dist/domain/workflow/version-resolution.d.ts.map +1 -0
- package/dist/domain/workflow/version-resolution.js +113 -0
- package/dist/domain/workflow/version-resolution.js.map +1 -0
- package/dist/domain/workflowexecution/controller.d.ts.map +1 -1
- package/dist/domain/workflowexecution/controller.js +4 -2
- package/dist/domain/workflowexecution/controller.js.map +1 -1
- package/dist/domain/workflowinstance/controller.d.ts.map +1 -1
- package/dist/domain/workflowinstance/controller.js +9 -5
- package/dist/domain/workflowinstance/controller.js.map +1 -1
- package/dist/domain/workflowinstance/steps.d.ts +20 -0
- package/dist/domain/workflowinstance/steps.d.ts.map +1 -1
- package/dist/domain/workflowinstance/steps.js +39 -0
- package/dist/domain/workflowinstance/steps.js.map +1 -1
- package/dist/extensions/authorization-queries.d.ts +6 -5
- package/dist/extensions/authorization-queries.d.ts.map +1 -1
- package/dist/extensions/identity.d.ts +19 -0
- package/dist/extensions/identity.d.ts.map +1 -1
- package/dist/extensions/identity.js +22 -3
- package/dist/extensions/identity.js.map +1 -1
- package/dist/extensions/list-read-scope.d.ts +42 -8
- package/dist/extensions/list-read-scope.d.ts.map +1 -1
- package/dist/extensions/list-read-scope.js +13 -2
- package/dist/extensions/list-read-scope.js.map +1 -1
- package/dist/extensions/resource-authorization.d.ts +3 -2
- package/dist/extensions/resource-authorization.d.ts.map +1 -1
- package/dist/index.d.ts +1 -1
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js.map +1 -1
- package/dist/pipeline/apiresource-meta.d.ts +12 -3
- package/dist/pipeline/apiresource-meta.d.ts.map +1 -1
- package/dist/pipeline/apiresource-meta.js +21 -10
- package/dist/pipeline/apiresource-meta.js.map +1 -1
- package/dist/pipeline/steps/authorization-tuples.d.ts +9 -3
- package/dist/pipeline/steps/authorization-tuples.d.ts.map +1 -1
- package/dist/pipeline/steps/authorization-tuples.js +9 -11
- package/dist/pipeline/steps/authorization-tuples.js.map +1 -1
- package/dist/pipeline/steps/authorize-resolved-target.d.ts +88 -0
- package/dist/pipeline/steps/authorize-resolved-target.d.ts.map +1 -0
- package/dist/pipeline/steps/authorize-resolved-target.js +36 -0
- package/dist/pipeline/steps/authorize-resolved-target.js.map +1 -0
- package/dist/pipeline/steps/authorize.d.ts +27 -0
- package/dist/pipeline/steps/authorize.d.ts.map +1 -1
- package/dist/pipeline/steps/authorize.js +49 -10
- package/dist/pipeline/steps/authorize.js.map +1 -1
- package/dist/pipeline/steps/guard-memory-capture.d.ts.map +1 -1
- package/dist/pipeline/steps/guard-memory-capture.js +2 -1
- package/dist/pipeline/steps/guard-memory-capture.js.map +1 -1
- package/dist/pipeline/steps/guard-reserved-labels.d.ts.map +1 -1
- package/dist/pipeline/steps/guard-reserved-labels.js +6 -7
- package/dist/pipeline/steps/guard-reserved-labels.js.map +1 -1
- package/dist/pipeline/steps/helpers.d.ts +9 -5
- package/dist/pipeline/steps/helpers.d.ts.map +1 -1
- package/dist/pipeline/steps/helpers.js +11 -15
- package/dist/pipeline/steps/helpers.js.map +1 -1
- package/dist/pipeline/steps/references.d.ts +178 -20
- package/dist/pipeline/steps/references.d.ts.map +1 -1
- package/dist/pipeline/steps/references.js +344 -43
- package/dist/pipeline/steps/references.js.map +1 -1
- package/dist/pipeline/steps/version-history.d.ts +11 -0
- package/dist/pipeline/steps/version-history.d.ts.map +1 -1
- package/dist/pipeline/steps/version-history.js +26 -0
- package/dist/pipeline/steps/version-history.js.map +1 -1
- package/dist/query/search/controller.js +0 -1
- package/dist/query/search/controller.js.map +1 -1
- package/dist/query/search/criteria.d.ts +1 -5
- package/dist/query/search/criteria.d.ts.map +1 -1
- package/dist/query/search/criteria.js +3 -13
- package/dist/query/search/criteria.js.map +1 -1
- package/dist/query/search/handler.d.ts +5 -4
- package/dist/query/search/handler.d.ts.map +1 -1
- package/dist/query/search/handler.js +7 -6
- package/dist/query/search/handler.js.map +1 -1
- package/dist/query/search/query-store.d.ts.map +1 -1
- package/dist/query/search/query-store.js +0 -2
- package/dist/query/search/query-store.js.map +1 -1
- package/dist/store/interface.d.ts +3 -6
- package/dist/store/interface.d.ts.map +1 -1
- package/dist/store/interface.js.map +1 -1
- package/dist/store/postgres/migrations.d.ts +3 -1
- package/dist/store/postgres/migrations.d.ts.map +1 -1
- package/dist/store/postgres/migrations.js +35 -1
- package/dist/store/postgres/migrations.js.map +1 -1
- package/dist/store/postgres/store.d.ts.map +1 -1
- package/dist/store/postgres/store.js +4 -9
- package/dist/store/postgres/store.js.map +1 -1
- package/dist/store/public-visibility-retired.d.ts +67 -0
- package/dist/store/public-visibility-retired.d.ts.map +1 -0
- package/dist/store/public-visibility-retired.js +55 -0
- package/dist/store/public-visibility-retired.js.map +1 -0
- package/dist/store/sqlite/migrations.d.ts +3 -1
- package/dist/store/sqlite/migrations.d.ts.map +1 -1
- package/dist/store/sqlite/migrations.js +36 -1
- package/dist/store/sqlite/migrations.js.map +1 -1
- package/dist/store/sqlite/store.d.ts.map +1 -1
- package/dist/store/sqlite/store.js +4 -8
- package/dist/store/sqlite/store.js.map +1 -1
- package/package.json +6 -6
- package/src/authorization/README.md +24 -26
- package/src/authorization/__tests__/authorizer.test.ts +10 -9
- package/src/authorization/__tests__/derived-tuples.test.ts +4 -11
- package/src/authorization/__tests__/evaluator.test.ts +14 -73
- package/src/authorization/__tests__/facts.test.ts +2 -2
- package/src/authorization/__tests__/fixtures/fga/blueprint-private-visibility.fga.yaml +6 -98
- package/src/authorization/__tests__/fixtures/fga/default-instance-inheritance.fga.yaml +4 -61
- package/src/authorization/__tests__/fixtures/fga/org-admin-owner-inheritance.fga.yaml +1 -21
- package/src/authorization/__tests__/fixtures/fga/platform-visibility.fga.yaml +1 -25
- package/src/authorization/__tests__/fixtures/fga/workflow-execution-sharing.fga.yaml +1 -3
- package/src/authorization/__tests__/list-read-scope.test.ts +41 -29
- package/src/authorization/__tests__/skip-lane-inventory.test.ts +160 -0
- package/src/authorization/__tests__/store-tests.test.ts +1 -6
- package/src/authorization/__tests__/tuples.test.ts +12 -11
- package/src/authorization/__tests__/wire-permissions.test.ts +5 -5
- package/src/authorization/authorizer.ts +4 -9
- package/src/authorization/derived-tuples.ts +14 -31
- package/src/authorization/evaluator.ts +15 -44
- package/src/authorization/list-read-scope.ts +27 -22
- package/src/authorization/model/__tests__/registry.test.ts +2 -0
- package/src/authorization/model/agent.ts +2 -5
- package/src/authorization/model/agent_instance.ts +0 -2
- package/src/authorization/model/mcp_server.ts +0 -2
- package/src/authorization/model/organization.ts +2 -0
- package/src/authorization/model/plugin.ts +1 -4
- package/src/authorization/model/rewrite.ts +8 -13
- package/src/authorization/model/skill.ts +0 -2
- package/src/authorization/model/workflow.ts +0 -2
- package/src/authorization/model/workflow_instance.ts +0 -2
- package/src/authorization/organization-directory.ts +1 -3
- package/src/authorization/store-test-kit.ts +16 -75
- package/src/authorization/tuples.ts +16 -39
- package/src/domain/agent/__tests__/agent.test.ts +11 -4
- package/src/domain/agent/controller.ts +17 -7
- package/src/domain/agentchannel/__tests__/agentchannel.test.ts +223 -48
- package/src/domain/agentchannel/__tests__/create-authorization.test.ts +58 -0
- package/src/domain/agentchannel/controller.ts +25 -1
- package/src/domain/agentchannel/steps.ts +40 -0
- package/src/domain/agentexecution/controller.ts +6 -1
- package/src/domain/agentinstance/__tests__/create-authorization.composed.test.ts +243 -0
- package/src/domain/agentinstance/__tests__/create-authorization.test.ts +144 -0
- package/src/domain/agentinstance/controller.ts +30 -17
- package/src/domain/agentinstance/steps.ts +82 -8
- package/src/domain/agentshare/__tests__/agentshare.test.ts +196 -172
- package/src/domain/agentshare/__tests__/create-authorization.test.ts +71 -0
- package/src/domain/agentshare/__tests__/member-audience.test.ts +113 -0
- package/src/domain/agentshare/constants.ts +14 -26
- package/src/domain/agentshare/controller.ts +27 -1
- package/src/domain/agentshare/steps.ts +168 -155
- package/src/domain/artifact/controller.ts +18 -22
- package/src/domain/channelapp/controller.ts +10 -0
- package/src/domain/environment/controller.ts +15 -8
- package/src/domain/executioncontext/__tests__/executioncontext.test.ts +1 -0
- package/src/domain/executioncontext/controller.ts +15 -1
- package/src/domain/executioncontext/steps.ts +2 -1
- package/src/domain/mcpserver/__tests__/mcpserver.test.ts +115 -28
- package/src/domain/mcpserver/__tests__/oauth-handshake.test.ts +53 -18
- package/src/domain/mcpserver/connect.ts +11 -10
- package/src/domain/mcpserver/controller.ts +19 -13
- package/src/domain/mcpserver/start-connect.ts +17 -11
- package/src/domain/memory/__tests__/create-authorization.test.ts +59 -0
- package/src/domain/memory/controller.ts +11 -0
- package/src/domain/memory/steps.ts +41 -0
- package/src/domain/oauthapp/controller.ts +10 -0
- package/src/domain/plugin/controller.ts +23 -44
- package/src/domain/plugin/push.ts +8 -16
- package/src/domain/schedule/__tests__/create-authorization.test.ts +58 -0
- package/src/domain/schedule/controller.ts +26 -1
- package/src/domain/schedule/steps.ts +45 -2
- package/src/domain/session/controller.ts +12 -4
- package/src/domain/session/steps.ts +24 -32
- package/src/domain/skill/controller.ts +24 -30
- package/src/domain/workflow/__tests__/agent-call-references.test.ts +222 -0
- package/src/domain/workflow/agent-call-references.ts +157 -0
- package/src/domain/workflow/controller.ts +86 -155
- package/src/domain/workflow/registry/data/task-kind-registry.json +1 -1
- package/src/domain/workflow/validation/task-config-constraints.ts +7 -3
- package/src/domain/workflow/version-resolution.ts +166 -0
- package/src/domain/workflowexecution/controller.ts +7 -2
- package/src/domain/workflowinstance/__tests__/create-authorization.test.ts +109 -0
- package/src/domain/workflowinstance/controller.ts +25 -12
- package/src/domain/workflowinstance/steps.ts +49 -1
- package/src/extensions/__tests__/built-in-authorization-composed.test.ts +32 -19
- package/src/extensions/__tests__/composed-support.ts +38 -4
- package/src/extensions/__tests__/extension-composition.test.ts +4 -4
- package/src/extensions/__tests__/identity.test.ts +44 -1
- package/src/extensions/__tests__/list-read-scope-composed.test.ts +96 -7
- package/src/extensions/__tests__/list-read-scope.test.ts +63 -0
- package/src/extensions/authorization-queries.ts +6 -5
- package/src/extensions/identity.ts +23 -5
- package/src/extensions/list-read-scope.ts +48 -8
- package/src/extensions/resource-authorization.ts +3 -5
- package/src/index.ts +0 -1
- package/src/pipeline/__tests__/supports-visibility.test.ts +112 -0
- package/src/pipeline/apiresource-meta.ts +21 -10
- package/src/pipeline/steps/__tests__/authorization-tuples.test.ts +18 -31
- package/src/pipeline/steps/__tests__/authorize-resolved-target.test.ts +285 -0
- package/src/pipeline/steps/__tests__/references.test.ts +703 -0
- package/src/pipeline/steps/authorization-tuples.ts +9 -11
- package/src/pipeline/steps/authorize-resolved-target.ts +129 -0
- package/src/pipeline/steps/authorize.ts +70 -13
- package/src/pipeline/steps/guard-memory-capture.ts +2 -1
- package/src/pipeline/steps/guard-reserved-labels.ts +6 -9
- package/src/pipeline/steps/helpers.ts +11 -15
- package/src/pipeline/steps/references.ts +578 -70
- package/src/pipeline/steps/version-history.ts +34 -0
- package/src/query/search/__tests__/criteria.test.ts +0 -4
- package/src/query/search/__tests__/query-store.test.ts +11 -40
- package/src/query/search/controller.ts +0 -1
- package/src/query/search/criteria.ts +0 -14
- package/src/query/search/handler.ts +6 -7
- package/src/query/search/query-store.ts +0 -2
- package/src/store/__tests__/public-visibility-retired.test.ts +127 -0
- package/src/store/__tests__/store-contract.ts +6 -51
- package/src/store/interface.ts +3 -6
- package/src/store/postgres/__tests__/migrations.test.ts +187 -6
- package/src/store/postgres/__tests__/store-contract.test.ts +0 -2
- package/src/store/postgres/migrations.ts +48 -1
- package/src/store/postgres/store.ts +4 -11
- package/src/store/public-visibility-retired.ts +119 -0
- package/src/store/sqlite/__tests__/migrations.test.ts +191 -5
- package/src/store/sqlite/migrations.ts +45 -1
- package/src/store/sqlite/store.ts +4 -10
- package/dist/pipeline/steps/visibility-gates.d.ts +0 -27
- package/dist/pipeline/steps/visibility-gates.d.ts.map +0 -1
- package/dist/pipeline/steps/visibility-gates.js +0 -139
- package/dist/pipeline/steps/visibility-gates.js.map +0 -1
- package/src/authorization/__tests__/fixtures/fga/cross-org-share-creation.fga.yaml +0 -98
- package/src/authorization/__tests__/fixtures/fga/public-visibility-setter.fga.yaml +0 -52
- package/src/pipeline/steps/__tests__/visibility-gates.test.ts +0 -187
- package/src/pipeline/steps/visibility-gates.ts +0 -174
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"organization.js","sourceRoot":"","sources":["../../../src/authorization/model/organization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,kBAAkB,EAAE,MAAM,2DAA2D,CAAC;AAE/F,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAE9E,MAAM,CAAC,MAAM,uBAAuB,GAAG,WAAW,CAAC;IACjD,IAAI,EAAE,eAAe,CAAC,YAAY;IAClC,MAAM,EAAE,kBAAkB;IAC1B,MAAM,EAAE,oCAAoC;IAC5C,SAAS,EAAE;QACT,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC/C,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACzE,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC1E,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC3E,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC/C,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,oBAAoB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACzC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,qBAAqB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC1C,CAAC,oBAAoB,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACpE,CAAC,wBAAwB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC9C,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,mBAAmB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACxC,CAAC,gBAAgB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC,6BAA6B,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAClD,CAAC,sBAAsB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC3C,CAAC,4BAA4B,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjD,CAAC,wBAAwB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC7C,CAAC,yBAAyB,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACzE,CAAC,wBAAwB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC7C,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACxC,CAAC,oBAAoB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;KAC1C;CACF,CAAC,CAAC"}
|
|
1
|
+
{"version":3,"file":"organization.js","sourceRoot":"","sources":["../../../src/authorization/model/organization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,kBAAkB,EAAE,MAAM,2DAA2D,CAAC;AAE/F,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAE9E,MAAM,CAAC,MAAM,uBAAuB,GAAG,WAAW,CAAC;IACjD,IAAI,EAAE,eAAe,CAAC,YAAY;IAClC,MAAM,EAAE,kBAAkB;IAC1B,MAAM,EAAE,oCAAoC;IAC5C,SAAS,EAAE;QACT,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC/C,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACzE,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC1E,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC3E,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC/C,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,oBAAoB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACzC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,qBAAqB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC1C,CAAC,oBAAoB,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACpE,CAAC,wBAAwB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC9C,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,mBAAmB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACxC,CAAC,uBAAuB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC,gBAAgB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC,6BAA6B,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAClD,CAAC,sBAAsB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC3C,CAAC,4BAA4B,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjD,CAAC,wBAAwB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC7C,CAAC,yBAAyB,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACzE,CAAC,wBAAwB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC7C,CAAC,2BAA2B,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACjD,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACxC,CAAC,oBAAoB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;KAC1C;CACF,CAAC,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/plugin.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/plugin.ts"],"names":[],"mappings":"AA0BA,eAAO,MAAM,iBAAiB,wCAoC5B,CAAC"}
|
|
@@ -2,8 +2,7 @@
|
|
|
2
2
|
* Transcript of fga/model/agentic/plugin.fga — the unit of install, shaped
|
|
3
3
|
* exactly like a skill: an organization-owned blueprint whose owner is the
|
|
4
4
|
* installer (and, through the organization, its admins), whose viewers are
|
|
5
|
-
* the org's members and viewers
|
|
6
|
-
* platform viewer. Its verbs are the blueprint set: `can_view`, `can_edit`
|
|
5
|
+
* the org's members and viewers and the platform viewer. Its verbs are the blueprint set: `can_view`, `can_edit`
|
|
7
6
|
* (visibility), `can_delete` (uninstall), `can_grant_access`,
|
|
8
7
|
* `can_view_access`; `can_use` is carried as the model's word for
|
|
9
8
|
* "install from" though no wire permission names it yet.
|
|
@@ -14,7 +13,7 @@
|
|
|
14
13
|
*/
|
|
15
14
|
import { PluginSchema } from "@stigmer/protos/ai/stigmer/agentic/plugin/v1/api_pb";
|
|
16
15
|
import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
|
|
17
|
-
import { computed, declareKind, direct, from, objectOf,
|
|
16
|
+
import { computed, declareKind, direct, from, objectOf, union, usersetOf, } from "./rewrite.js";
|
|
18
17
|
export const pluginDeclaration = declareKind({
|
|
19
18
|
kind: ApiResourceKind.plugin,
|
|
20
19
|
schema: PluginSchema,
|
|
@@ -31,7 +30,7 @@ export const pluginDeclaration = declareKind({
|
|
|
31
30
|
],
|
|
32
31
|
[
|
|
33
32
|
"viewer",
|
|
34
|
-
union(direct(objectOf("identity_account"),
|
|
33
|
+
union(direct(objectOf("identity_account"), usersetOf("organization", "member"), usersetOf("organization", "viewer")), computed("owner"), computed("platform_viewer")),
|
|
35
34
|
],
|
|
36
35
|
["can_view", computed("viewer")],
|
|
37
36
|
["can_edit", computed("owner")],
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/authorization/model/plugin.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/authorization/model/plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,EACL,SAAS,GACV,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,iBAAiB,GAAG,WAAW,CAAC;IAC3C,IAAI,EAAE,eAAe,CAAC,MAAM;IAC5B,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,8BAA8B;IACtC,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD;YACE,OAAO;YACP,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EACpC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAC9B;SACF;QACD;YACE,iBAAiB;YACjB,MAAM,CAAC,SAAS,CAAC,mBAAmB,EAAE,eAAe,CAAC,CAAC;SACxD;QACD;YACE,QAAQ;YACR,KAAK,CACH,MAAM,CACJ,QAAQ,CAAC,kBAAkB,CAAC,EAC5B,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EACnC,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,CACpC,EACD,QAAQ,CAAC,OAAO,CAAC,EACjB,QAAQ,CAAC,iBAAiB,CAAC,CAC5B;SACF;QACD,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;CACF,CAAC,CAAC"}
|
|
@@ -6,12 +6,17 @@
|
|
|
6
6
|
* define organization: [organization] → direct(objectOf("organization"))
|
|
7
7
|
* define owner: [identity_account] or admin from organization
|
|
8
8
|
* → union(direct(objectOf("identity_account")), from("admin", "organization"))
|
|
9
|
-
* define viewer: [identity_account,
|
|
10
|
-
*
|
|
11
|
-
* → union(direct(objectOf(...),
|
|
9
|
+
* define viewer: [identity_account, organization#member, organization#viewer]
|
|
10
|
+
* or owner or platform_viewer
|
|
11
|
+
* → union(direct(objectOf(...), usersetOf(...), usersetOf(...)),
|
|
12
12
|
* computed("owner"), computed("platform_viewer"))
|
|
13
13
|
* define can_view: viewer → computed("viewer")
|
|
14
14
|
*
|
|
15
|
+
* A subject type is an object type or a userset; the model admits no
|
|
16
|
+
* wildcard (`type:*`) and declares no condition, so neither has a form
|
|
17
|
+
* here. The day a line needs one, the transcript cannot be written and
|
|
18
|
+
* the gap is a design act.
|
|
19
|
+
*
|
|
15
20
|
* A declaration file (model/<kind>.ts) is a TRANSCRIPT of its `.fga`
|
|
16
21
|
* file: the same relations, in the file's order, each line rewritten in
|
|
17
22
|
* these builders so a reader with the model open sees the same text, and
|
|
@@ -52,12 +57,6 @@ export type SubjectType =
|
|
|
52
57
|
readonly form: "userset";
|
|
53
58
|
readonly type: string;
|
|
54
59
|
readonly relation: string;
|
|
55
|
-
}
|
|
56
|
-
/** `[identity_account:* with allow_public]` — every object of the type, under the condition. */
|
|
57
|
-
| {
|
|
58
|
-
readonly form: "wildcard";
|
|
59
|
-
readonly type: string;
|
|
60
|
-
readonly condition: string;
|
|
61
60
|
};
|
|
62
61
|
export type Rewrite =
|
|
63
62
|
/** `[…]` — the tuples stored on the relation itself, restricted to the listed subject types. */
|
|
@@ -83,7 +82,6 @@ export type Rewrite =
|
|
|
83
82
|
};
|
|
84
83
|
export declare function objectOf(type: string): SubjectType;
|
|
85
84
|
export declare function usersetOf(type: string, relation: string): SubjectType;
|
|
86
|
-
export declare function publicWith(type: string, condition: string): SubjectType;
|
|
87
85
|
export declare function direct(...subjects: ReadonlyArray<SubjectType>): Rewrite;
|
|
88
86
|
export declare function computed(relation: string): Rewrite;
|
|
89
87
|
export declare function from(relation: string, tupleset: string): Rewrite;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"rewrite.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/rewrite.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"rewrite.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/rewrite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAG3H,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAEhE,0DAA0D;AAC1D,MAAM,MAAM,WAAW;AACrB,oEAAoE;AAClE;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AACpD,sFAAsF;GACpF;IACE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEN,MAAM,MAAM,OAAO;AACjB,gGAAgG;AAC9F;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,WAAW,CAAC,CAAA;CAAE;AAC1E,wDAAwD;GACtD;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE;AAC1D,+FAA+F;GAC7F;IACE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AACH,uEAAuE;GACrE;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,CAAA;CAAE,CAAC;AAMzE,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAElD;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,WAAW,CAErE;AAED,wBAAgB,MAAM,CAAC,GAAG,QAAQ,EAAE,aAAa,CAAC,WAAW,CAAC,GAAG,OAAO,CAEvE;AAED,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAElD;AAED,wBAAgB,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEhE;AAED,wBAAgB,KAAK,CAAC,GAAG,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG,OAAO,CAEjE;AAMD;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG,CAC5B,MAAM,EAAE,SAAS,EACjB,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,SAAS,KACd,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;AAEnC,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,qFAAqF;IACrF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4FAA4F;IAC5F,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,+EAA+E;IAC/E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,4DAA4D;IAC5D,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjD,mEAAmE;IACnE,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;CACxD;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7E,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAC9B,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,CAAC,CAC/C,CAAC;CACH;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,oBAAoB,GAAG,eAAe,CAmCxE"}
|
|
@@ -8,9 +8,6 @@ export function objectOf(type) {
|
|
|
8
8
|
export function usersetOf(type, relation) {
|
|
9
9
|
return { form: "userset", type, relation };
|
|
10
10
|
}
|
|
11
|
-
export function publicWith(type, condition) {
|
|
12
|
-
return { form: "wildcard", type, condition };
|
|
13
|
-
}
|
|
14
11
|
export function direct(...subjects) {
|
|
15
12
|
return { node: "this", subjects };
|
|
16
13
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"rewrite.js","sourceRoot":"","sources":["../../../src/authorization/model/rewrite.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"rewrite.js","sourceRoot":"","sources":["../../../src/authorization/model/rewrite.ts"],"names":[],"mappings":"AAgDA,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AA4BlE,8EAA8E;AAC9E,+DAA+D;AAC/D,8EAA8E;AAE9E,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,QAAgB;IACtD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,GAAG,QAAoC;IAC5D,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,QAAgB;IACvC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,QAAgB,EAAE,QAAgB;IACrD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,GAAG,OAA+B;IACtD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACpC,CAAC;AA2CD;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,KAA2B;IACrD,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QAC9C,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,MAAM,eAAe,IAAI,qBAAqB,CAAC,CAAC;QAC3E,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC/B,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,SAAS,EAAE,CAAC;QACxC,KAAK,MAAM,SAAS,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;YACjD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvC,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,MAAM,MAAM,IAAI,WAAW,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,QAAQ,YAAY,IAAI,mBAAmB,CAC7G,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,EAA2B,CAAC;IACnD,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QAC/C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,MAAM,yBAAyB,IAAI,YAAY,IAAI,mBAAmB,CAChF,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI;QACJ,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS;QACT,OAAO;KACR,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,SAAS,eAAe,CACtB,OAAgB;IAEhB,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,MAAM;YACT,OAAO,EAAE,CAAC;QACZ,KAAK,UAAU;YACb,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC5D,KAAK,MAAM;YACT,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC5D,KAAK,OAAO;YACV,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAClD,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,OAAO,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;AACH,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"skill.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/skill.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"skill.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/skill.ts"],"names":[],"mappings":"AAoBA,eAAO,MAAM,gBAAgB,wCAqC3B,CAAC"}
|
|
@@ -7,7 +7,7 @@
|
|
|
7
7
|
*/
|
|
8
8
|
import { SkillSchema } from "@stigmer/protos/ai/stigmer/agentic/skill/v1/api_pb";
|
|
9
9
|
import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
|
|
10
|
-
import { computed, declareKind, direct, from, objectOf,
|
|
10
|
+
import { computed, declareKind, direct, from, objectOf, union, usersetOf, } from "./rewrite.js";
|
|
11
11
|
export const skillDeclaration = declareKind({
|
|
12
12
|
kind: ApiResourceKind.skill,
|
|
13
13
|
schema: SkillSchema,
|
|
@@ -24,7 +24,7 @@ export const skillDeclaration = declareKind({
|
|
|
24
24
|
],
|
|
25
25
|
[
|
|
26
26
|
"viewer",
|
|
27
|
-
union(direct(objectOf("identity_account"),
|
|
27
|
+
union(direct(objectOf("identity_account"), usersetOf("organization", "member"), usersetOf("organization", "viewer")), computed("owner"), computed("platform_viewer")),
|
|
28
28
|
],
|
|
29
29
|
["can_view", computed("viewer")],
|
|
30
30
|
["can_edit", computed("owner")],
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"skill.js","sourceRoot":"","sources":["../../../src/authorization/model/skill.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,
|
|
1
|
+
{"version":3,"file":"skill.js","sourceRoot":"","sources":["../../../src/authorization/model/skill.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,EACL,SAAS,GACV,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,gBAAgB,GAAG,WAAW,CAAC;IAC1C,IAAI,EAAE,eAAe,CAAC,KAAK;IAC3B,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,6BAA6B;IACrC,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD;YACE,OAAO;YACP,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EACpC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAC9B;SACF;QACD;YACE,iBAAiB;YACjB,MAAM,CAAC,SAAS,CAAC,mBAAmB,EAAE,eAAe,CAAC,CAAC;SACxD;QACD;YACE,QAAQ;YACR,KAAK,CACH,MAAM,CACJ,QAAQ,CAAC,kBAAkB,CAAC,EAC5B,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EACnC,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,CACpC,EACD,QAAQ,CAAC,OAAO,CAAC,EACjB,QAAQ,CAAC,iBAAiB,CAAC,CAC5B;SACF;QACD,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;CACF,CAAC,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"workflow.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/workflow.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"workflow.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/workflow.ts"],"names":[],"mappings":"AAoBA,eAAO,MAAM,mBAAmB,wCAqC9B,CAAC"}
|
|
@@ -7,7 +7,7 @@
|
|
|
7
7
|
*/
|
|
8
8
|
import { WorkflowSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/api_pb";
|
|
9
9
|
import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
|
|
10
|
-
import { computed, declareKind, direct, from, objectOf,
|
|
10
|
+
import { computed, declareKind, direct, from, objectOf, union, usersetOf, } from "./rewrite.js";
|
|
11
11
|
export const workflowDeclaration = declareKind({
|
|
12
12
|
kind: ApiResourceKind.workflow,
|
|
13
13
|
schema: WorkflowSchema,
|
|
@@ -24,7 +24,7 @@ export const workflowDeclaration = declareKind({
|
|
|
24
24
|
],
|
|
25
25
|
[
|
|
26
26
|
"viewer",
|
|
27
|
-
union(direct(objectOf("identity_account"),
|
|
27
|
+
union(direct(objectOf("identity_account"), usersetOf("organization", "member"), usersetOf("organization", "viewer")), computed("owner"), computed("platform_viewer")),
|
|
28
28
|
],
|
|
29
29
|
["can_view", computed("viewer")],
|
|
30
30
|
["can_edit", computed("owner")],
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"workflow.js","sourceRoot":"","sources":["../../../src/authorization/model/workflow.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AACvF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,
|
|
1
|
+
{"version":3,"file":"workflow.js","sourceRoot":"","sources":["../../../src/authorization/model/workflow.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AACvF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,EACL,SAAS,GACV,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,mBAAmB,GAAG,WAAW,CAAC;IAC7C,IAAI,EAAE,eAAe,CAAC,QAAQ;IAC9B,MAAM,EAAE,cAAc;IACtB,MAAM,EAAE,gCAAgC;IACxC,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD;YACE,OAAO;YACP,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EACpC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAC9B;SACF;QACD;YACE,iBAAiB;YACjB,MAAM,CAAC,SAAS,CAAC,mBAAmB,EAAE,eAAe,CAAC,CAAC;SACxD;QACD;YACE,QAAQ;YACR,KAAK,CACH,MAAM,CACJ,QAAQ,CAAC,kBAAkB,CAAC,EAC5B,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EACnC,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,CACpC,EACD,QAAQ,CAAC,OAAO,CAAC,EACjB,QAAQ,CAAC,iBAAiB,CAAC,CAC5B;SACF;QACD,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,aAAa,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;CACF,CAAC,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"workflow_instance.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/workflow_instance.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"workflow_instance.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/workflow_instance.ts"],"names":[],"mappings":"AAuEA,eAAO,MAAM,2BAA2B,wCAgDtC,CAAC"}
|
|
@@ -21,7 +21,7 @@ import { WorkflowInstanceSchema } from "@stigmer/protos/ai/stigmer/agentic/workf
|
|
|
21
21
|
import { WorkflowExecutionVisibility } from "@stigmer/protos/ai/stigmer/agentic/workflowinstance/v1/spec_pb";
|
|
22
22
|
import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
|
|
23
23
|
import { defaultOfBlueprint } from "./default-of.js";
|
|
24
|
-
import { computed, declareKind, direct, from, objectOf,
|
|
24
|
+
import { computed, declareKind, direct, from, objectOf, union, usersetOf, } from "./rewrite.js";
|
|
25
25
|
const executionViewer = (object, row) => {
|
|
26
26
|
if (!isMessage(row, WorkflowInstanceSchema)) {
|
|
27
27
|
return Promise.resolve([]);
|
|
@@ -64,7 +64,7 @@ export const workflowInstanceDeclaration = declareKind({
|
|
|
64
64
|
["owner", direct(objectOf("identity_account"))],
|
|
65
65
|
[
|
|
66
66
|
"viewer",
|
|
67
|
-
union(direct(objectOf("identity_account"),
|
|
67
|
+
union(direct(objectOf("identity_account"), usersetOf("organization", "member"), usersetOf("organization", "viewer")), computed("owner"), from("viewer", "default_of")),
|
|
68
68
|
],
|
|
69
69
|
[
|
|
70
70
|
"execution_viewer",
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"workflow_instance.js","sourceRoot":"","sources":["../../../src/authorization/model/workflow_instance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,OAAO,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AACvF,OAAO,EAAE,sBAAsB,EAAE,MAAM,+DAA+D,CAAC;AACvG,OAAO,EAAE,2BAA2B,EAAE,MAAM,gEAAgE,CAAC;AAC7G,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAErD,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,
|
|
1
|
+
{"version":3,"file":"workflow_instance.js","sourceRoot":"","sources":["../../../src/authorization/model/workflow_instance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,OAAO,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AACvF,OAAO,EAAE,sBAAsB,EAAE,MAAM,+DAA+D,CAAC;AACvG,OAAO,EAAE,2BAA2B,EAAE,MAAM,gEAAgE,CAAC;AAC7G,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAErD,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,EACL,SAAS,GACV,MAAM,cAAc,CAAC;AAEtB,MAAM,eAAe,GAAoB,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IACvD,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,sBAAsB,CAAC,EAAE,CAAC;QAC5C,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC;IACD,MAAM,KAAK,GACT,GAAG,CAAC,IAAI,EAAE,mBAAmB,IAAI,2BAA2B,CAAC,WAAW,CAAC;IAC3E,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,2BAA2B,CAAC,YAAY,CAAC,CAAC,CAAC;YAC9C,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;YACpC,OAAO,OAAO,CAAC,OAAO,CACpB,GAAG,KAAK,EAAE;gBACR,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC;oBACE;wBACE,MAAM;wBACN,QAAQ,EAAE,kBAAkB;wBAC5B,OAAO,EAAE;4BACP,IAAI,EAAE,SAAS;4BACf,MAAM,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,GAAG,EAAE;4BACzC,QAAQ,EAAE,QAAQ;yBACnB;qBACF;iBACF,CACN,CAAC;QACJ,CAAC;QACD,KAAK,2BAA2B,CAAC,OAAO,CAAC;QACzC,KAAK,2BAA2B,CAAC,WAAW;YAC1C,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC7B,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,KAAK,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,iCAAiC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,2BAA2B,GAAG,WAAW,CAAC;IACrD,IAAI,EAAE,eAAe,CAAC,iBAAiB;IACvC,MAAM,EAAE,sBAAsB;IAC9B,MAAM,EAAE,yCAAyC;IACjD,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;QAC1C,CAAC,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;QAC5C,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC/C;YACE,QAAQ;YACR,KAAK,CACH,MAAM,CACJ,QAAQ,CAAC,kBAAkB,CAAC,EAC5B,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EACnC,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,CACpC,EACD,QAAQ,CAAC,OAAO,CAAC,EACjB,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAC7B;SACF;QACD;YACE,kBAAkB;YAClB,MAAM,CACJ,QAAQ,CAAC,kBAAkB,CAAC,EAC5B,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EACnC,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,CACpC;SACF;QACD,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,aAAa,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;QACrC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;IACD,OAAO,EAAE;QACP;YACE,YAAY;YACZ,kBAAkB,CAAC;gBACjB,IAAI,EAAE,eAAe,CAAC,QAAQ;gBAC9B,MAAM,EAAE,cAAc;gBACtB,mBAAmB,EAAE,CAAC,QAAQ,EAAE,EAAE,CAChC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,IAAI,EAAE;aAC3C,CAAC;SACH;QACD,CAAC,kBAAkB,EAAE,eAAe,CAAC;KACtC;CACF,CAAC,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"organization-directory.d.ts","sourceRoot":"","sources":["../../src/authorization/organization-directory.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"organization-directory.d.ts","sourceRoot":"","sources":["../../src/authorization/organization-directory.ts"],"names":[],"mappings":"AA0CA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAEnE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAGrF,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAGnD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAGpD,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;CACxB;AAID,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,gCAAgC,GACrC,qBAAqB,CA6CvB"}
|
|
@@ -32,8 +32,7 @@
|
|
|
32
32
|
* annotation, which is why this driver meets that caller at all: a
|
|
33
33
|
* skip lane hands the directory the identity the interceptor stamped,
|
|
34
34
|
* and no Authorize arm ran before it. Every other caller gets the
|
|
35
|
-
* evaluated list.
|
|
36
|
-
* though no organization line admits a wildcard.
|
|
35
|
+
* evaluated list.
|
|
37
36
|
* The controller loads each id it is handed and skips the ones whose row
|
|
38
37
|
* is gone (grants can outlive rows); the source has already loaded the
|
|
39
38
|
* row once for the evaluation — two primary-key reads per organization,
|
|
@@ -72,7 +71,7 @@ export function newBuiltInOrganizationDirectory(deps) {
|
|
|
72
71
|
}
|
|
73
72
|
const visible = [];
|
|
74
73
|
for (const id of candidates) {
|
|
75
|
-
if (await checkRelation({ model, source }, { type: ORGANIZATION, id }, "can_view", person
|
|
74
|
+
if (await checkRelation({ model, source }, { type: ORGANIZATION, id }, "can_view", person)) {
|
|
76
75
|
visible.push(id);
|
|
77
76
|
}
|
|
78
77
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"organization-directory.js","sourceRoot":"","sources":["../../src/authorization/organization-directory.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"organization-directory.js","sourceRoot":"","sources":["../../src/authorization/organization-directory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAKtH,OAAO,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAE/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAS5C,MAAM,YAAY,GAAG,YAAY,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;AAEhE,MAAM,UAAU,+BAA+B,CAC7C,IAAsC;IAEtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC;IACzC,OAAO;QACL,kBAAkB,EAAE,IAAI;QAExB,KAAK,CAAC,qBAAqB,CACzB,MAAsB;YAEtB,IAAI,MAAM,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;gBACtC,OAAO,iBAAiB,CAAC;YAC3B,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC1D,MAAM,MAAM,GAAG,qBAAqB,CAClC;gBACE,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,KAAK;aACN,EACD,MAAM,CACP,CAAC;YACF,iEAAiE;YACjE,kEAAkE;YAClE,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;YACrC,KAAK,MAAM,KAAK,IAAI,MAAM,MAAM,CAAC,YAAY,EAAE,EAAE,CAAC;gBAChD,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;oBACjE,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAClC,CAAC;YACH,CAAC;YACD,MAAM,OAAO,GAAa,EAAE,CAAC;YAC7B,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;gBAC5B,IACE,MAAM,aAAa,CACjB,EAAE,KAAK,EAAE,MAAM,EAAE,EACjB,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,EAC1B,UAAU,EACV,MAAM,CACP,EACD,CAAC;oBACD,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACnB,CAAC;YACH,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC"}
|
|
@@ -1,23 +1,17 @@
|
|
|
1
1
|
import type { Model } from "./model/index.js";
|
|
2
|
-
import type { CheckContext } from "./tuples.js";
|
|
3
2
|
export interface StoreTestTuple {
|
|
4
3
|
readonly user: string;
|
|
5
4
|
readonly relation: string;
|
|
6
5
|
readonly object: string;
|
|
7
|
-
readonly condition?: {
|
|
8
|
-
readonly name: string;
|
|
9
|
-
};
|
|
10
6
|
}
|
|
11
7
|
export interface StoreTestCheck {
|
|
12
8
|
readonly user: string;
|
|
13
9
|
readonly object: string;
|
|
14
|
-
readonly context?: CheckContext;
|
|
15
10
|
readonly assertions: Readonly<Record<string, boolean>>;
|
|
16
11
|
}
|
|
17
12
|
export interface StoreTestListObjects {
|
|
18
13
|
readonly user: string;
|
|
19
14
|
readonly type: string;
|
|
20
|
-
readonly context?: CheckContext;
|
|
21
15
|
readonly assertions: Readonly<Record<string, ReadonlyArray<string>>>;
|
|
22
16
|
}
|
|
23
17
|
export interface StoreTest {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"store-test-kit.d.ts","sourceRoot":"","sources":["../../src/authorization/store-test-kit.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"store-test-kit.d.ts","sourceRoot":"","sources":["../../src/authorization/store-test-kit.ts"],"names":[],"mappings":"AAqDA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAa9C,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACxD;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;CACtE;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IAC9C,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;CAC5D;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IAC/C,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;CAC1C;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,OAAO,EACd,UAAU,EAAE,MAAM,GACjB,iBAAiB,CAgBnB;AAqGD,MAAM,WAAW,aAAa;IAC5B,8EAA8E;IAC9E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACtB;AAED,MAAM,MAAM,mBAAmB,GAC3B,iBAAiB,GACjB,cAAc,GACd,yBAAyB,CAAC;AAE9B,uFAAuF;AACvF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,oEAAoE;IACpE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC,sGAAsG;IACtG,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IAC7C,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;CAChD;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,iBAAiB,EAC3B,KAAK,EAAE,KAAK,GACX,YAAY,CAsEd"}
|
|
@@ -41,14 +41,12 @@
|
|
|
41
41
|
* `skipped` is therefore complete once every case has run; a consumer
|
|
42
42
|
* pins it after the cases, which is the order a test file declares them.
|
|
43
43
|
*
|
|
44
|
-
*
|
|
45
|
-
*
|
|
46
|
-
*
|
|
47
|
-
*
|
|
48
|
-
* that
|
|
49
|
-
*
|
|
50
|
-
* key anywhere is a thrown fault, so a change to the format upstream is
|
|
51
|
-
* loud here rather than half-run.
|
|
44
|
+
* The parser is strict on purpose: an unknown key anywhere is a thrown
|
|
45
|
+
* fault, so a change to the format upstream is loud here rather than
|
|
46
|
+
* half-run. The model declares no condition, so the format's `condition`
|
|
47
|
+
* on a tuple and `context` on a check are among the keys refused: a
|
|
48
|
+
* document that still carries them is written against a model this
|
|
49
|
+
* evaluator does not answer, and saying so beats running it half-blind.
|
|
52
50
|
*/
|
|
53
51
|
import assert from "node:assert/strict";
|
|
54
52
|
import { checkRelation } from "./evaluator.js";
|
|
@@ -72,28 +70,12 @@ export function parseStoreTestDocument(value, sourceName) {
|
|
|
72
70
|
};
|
|
73
71
|
}
|
|
74
72
|
function parseTuple(value, where) {
|
|
75
|
-
const entry = record(value, where, [
|
|
76
|
-
|
|
77
|
-
"relation",
|
|
78
|
-
"object",
|
|
79
|
-
"condition",
|
|
80
|
-
]);
|
|
81
|
-
const tuple = {
|
|
73
|
+
const entry = record(value, where, ["user", "relation", "object"]);
|
|
74
|
+
return {
|
|
82
75
|
user: text(entry["user"], `${where}.user`),
|
|
83
76
|
relation: text(entry["relation"], `${where}.relation`),
|
|
84
77
|
object: text(entry["object"], `${where}.object`),
|
|
85
78
|
};
|
|
86
|
-
if (entry["condition"] === undefined) {
|
|
87
|
-
return tuple;
|
|
88
|
-
}
|
|
89
|
-
const condition = record(entry["condition"], `${where}.condition`, [
|
|
90
|
-
"name",
|
|
91
|
-
"context",
|
|
92
|
-
]);
|
|
93
|
-
return {
|
|
94
|
-
...tuple,
|
|
95
|
-
condition: { name: text(condition["name"], `${where}.condition.name`) },
|
|
96
|
-
};
|
|
97
79
|
}
|
|
98
80
|
function parseTest(value, where) {
|
|
99
81
|
const entry = record(value, where, ["name", "check", "list_objects"]);
|
|
@@ -104,12 +86,7 @@ function parseTest(value, where) {
|
|
|
104
86
|
};
|
|
105
87
|
}
|
|
106
88
|
function parseCheck(value, where) {
|
|
107
|
-
const entry = record(value, where, [
|
|
108
|
-
"user",
|
|
109
|
-
"object",
|
|
110
|
-
"context",
|
|
111
|
-
"assertions",
|
|
112
|
-
]);
|
|
89
|
+
const entry = record(value, where, ["user", "object", "assertions"]);
|
|
113
90
|
const assertions = record(entry["assertions"], `${where}.assertions`);
|
|
114
91
|
const parsed = {};
|
|
115
92
|
for (const [relation, expected] of Object.entries(assertions)) {
|
|
@@ -118,39 +95,25 @@ function parseCheck(value, where) {
|
|
|
118
95
|
}
|
|
119
96
|
parsed[relation] = expected;
|
|
120
97
|
}
|
|
121
|
-
const context = parseContext(entry["context"], `${where}.context`);
|
|
122
98
|
return {
|
|
123
99
|
user: text(entry["user"], `${where}.user`),
|
|
124
100
|
object: text(entry["object"], `${where}.object`),
|
|
125
|
-
...(context === undefined ? {} : { context }),
|
|
126
101
|
assertions: parsed,
|
|
127
102
|
};
|
|
128
103
|
}
|
|
129
104
|
function parseListObjects(value, where) {
|
|
130
|
-
const entry = record(value, where, ["user", "type", "
|
|
105
|
+
const entry = record(value, where, ["user", "type", "assertions"]);
|
|
131
106
|
const assertions = record(entry["assertions"], `${where}.assertions`);
|
|
132
107
|
const parsed = {};
|
|
133
108
|
for (const [relation, expected] of Object.entries(assertions)) {
|
|
134
109
|
parsed[relation] = list(expected, `${where}.assertions.${relation}`).map((item, index) => text(item, `${where}.assertions.${relation}[${index}]`));
|
|
135
110
|
}
|
|
136
|
-
const context = parseContext(entry["context"], `${where}.context`);
|
|
137
111
|
return {
|
|
138
112
|
user: text(entry["user"], `${where}.user`),
|
|
139
113
|
type: text(entry["type"], `${where}.type`),
|
|
140
|
-
...(context === undefined ? {} : { context }),
|
|
141
114
|
assertions: parsed,
|
|
142
115
|
};
|
|
143
116
|
}
|
|
144
|
-
function parseContext(value, where) {
|
|
145
|
-
if (value === undefined) {
|
|
146
|
-
return undefined;
|
|
147
|
-
}
|
|
148
|
-
const entry = record(value, where, ["allow"]);
|
|
149
|
-
if (typeof entry["allow"] !== "boolean") {
|
|
150
|
-
throw new Error(`${where}.allow: expected a boolean`);
|
|
151
|
-
}
|
|
152
|
-
return { allow: entry["allow"] };
|
|
153
|
-
}
|
|
154
117
|
function record(value, where, allowedKeys) {
|
|
155
118
|
if (value === null || typeof value !== "object" || Array.isArray(value)) {
|
|
156
119
|
throw new Error(`${where}: expected a mapping`);
|
|
@@ -180,8 +143,6 @@ function text(value, where) {
|
|
|
180
143
|
}
|
|
181
144
|
return value;
|
|
182
145
|
}
|
|
183
|
-
/** The listing posture, for a check the document leaves without a context (the module header). */
|
|
184
|
-
const CONTEXT_WHEN_ABSENT = { allow: false };
|
|
185
146
|
/**
|
|
186
147
|
* The document's tests as runnable cases over `model`, plus every
|
|
187
148
|
* assertion group the kit does not run.
|
|
@@ -225,10 +186,9 @@ export function storeTestCases(document, model) {
|
|
|
225
186
|
for (const item of runnable) {
|
|
226
187
|
const object = parseObjectRef(item.object);
|
|
227
188
|
const person = personOf(item.user);
|
|
228
|
-
const context = item.context ?? CONTEXT_WHEN_ABSENT;
|
|
229
189
|
for (const [relation, expected] of Object.entries(item.assertions)) {
|
|
230
190
|
const recording = recordUndeclaredTypes(source, model);
|
|
231
|
-
const actual = await checkRelation({ model, source: recording }, object, relation, person
|
|
191
|
+
const actual = await checkRelation({ model, source: recording }, object, relation, person);
|
|
232
192
|
if (recording.reached.size > 0) {
|
|
233
193
|
skipped.push({
|
|
234
194
|
document: document.name,
|
|
@@ -241,7 +201,7 @@ export function storeTestCases(document, model) {
|
|
|
241
201
|
});
|
|
242
202
|
continue;
|
|
243
203
|
}
|
|
244
|
-
assert.equal(actual, expected, `${document.name} :: ${test.name}: ${item.user} ${relation} ${item.object}
|
|
204
|
+
assert.equal(actual, expected, `${document.name} :: ${test.name}: ${item.user} ${relation} ${item.object} expected ${String(expected)}, got ${String(actual)}`);
|
|
245
205
|
}
|
|
246
206
|
}
|
|
247
207
|
},
|
|
@@ -252,10 +212,9 @@ export function storeTestCases(document, model) {
|
|
|
252
212
|
/**
|
|
253
213
|
* A view of `inner` that records, for one walk, every subject type the
|
|
254
214
|
* evaluator read that `model` does not declare. A person
|
|
255
|
-
* (`identity_account:<id
|
|
256
|
-
*
|
|
257
|
-
*
|
|
258
|
-
* type is.
|
|
215
|
+
* (`identity_account:<id>`) is a subject the evaluator compares, never a
|
|
216
|
+
* type it resolves, so it is not a "reach" whatever the model declares; a
|
|
217
|
+
* userset or a parent object of an undeclared type is.
|
|
259
218
|
*/
|
|
260
219
|
function recordUndeclaredTypes(inner, model) {
|
|
261
220
|
const reached = new Set();
|
|
@@ -282,8 +241,6 @@ function resolvedTypeOf(subject) {
|
|
|
282
241
|
: subject.object.type;
|
|
283
242
|
case "userset":
|
|
284
243
|
return subject.object.type;
|
|
285
|
-
case "wildcard":
|
|
286
|
-
return undefined;
|
|
287
244
|
default: {
|
|
288
245
|
const exhaustive = subject;
|
|
289
246
|
throw new Error(`unknown subject form: ${JSON.stringify(exhaustive)}`);
|
|
@@ -291,13 +248,10 @@ function resolvedTypeOf(subject) {
|
|
|
291
248
|
}
|
|
292
249
|
}
|
|
293
250
|
function tupleOf(entry) {
|
|
294
|
-
const subject = parseSubject(entry.user);
|
|
295
251
|
return {
|
|
296
252
|
object: parseObjectRef(entry.object),
|
|
297
253
|
relation: entry.relation,
|
|
298
|
-
subject:
|
|
299
|
-
? { ...subject, condition: entry.condition.name }
|
|
300
|
-
: subject,
|
|
254
|
+
subject: parseSubject(entry.user),
|
|
301
255
|
};
|
|
302
256
|
}
|
|
303
257
|
/** The document's users are plain accounts; a user of another type is a format the kit does not run. */
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"store-test-kit.js","sourceRoot":"","sources":["../../src/authorization/store-test-kit.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"store-test-kit.js","sourceRoot":"","sources":["../../src/authorization/store-test-kit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,OAAO,MAAM,MAAM,oBAAoB,CAAC;AAExC,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAG/C,OAAO,EACL,YAAY,EACZ,sBAAsB,EACtB,cAAc,EACd,YAAY,GACb,MAAM,aAAa,CAAC;AAoCrB;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAc,EACd,UAAkB;IAElB,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE;QACrC,MAAM;QACN,YAAY;QACZ,QAAQ;QACR,OAAO;KACR,CAAC,CAAC;IACH,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,UAAU,QAAQ,CAAC;QAC/C,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,UAAU,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CACzE,UAAU,CAAC,KAAK,EAAE,GAAG,UAAU,YAAY,KAAK,GAAG,CAAC,CACrD;QACD,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,UAAU,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CACtE,SAAS,CAAC,KAAK,EAAE,GAAG,UAAU,WAAW,KAAK,GAAG,CAAC,CACnD;KACF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAAc,EAAE,KAAa;IAC/C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;IACnE,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC;QAC1C,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,GAAG,KAAK,WAAW,CAAC;QACtD,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,GAAG,KAAK,SAAS,CAAC;KACjD,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,KAAc,EAAE,KAAa;IAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC;IACtE,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC;QAC1C,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACxE,UAAU,CAAC,IAAI,EAAE,GAAG,KAAK,UAAU,KAAK,GAAG,CAAC,CAC7C;QACD,YAAY,EAAE,YAAY,CACxB,KAAK,CAAC,cAAc,CAAC,EACrB,GAAG,KAAK,eAAe,CACxB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACpB,gBAAgB,CAAC,IAAI,EAAE,GAAG,KAAK,iBAAiB,KAAK,GAAG,CAAC,CAC1D;KACF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAAc,EAAE,KAAa;IAC/C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,GAAG,KAAK,aAAa,CAAC,CAAC;IACtE,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9D,IAAI,OAAO,QAAQ,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,eAAe,QAAQ,sBAAsB,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;IAC9B,CAAC;IACD,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC;QAC1C,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,GAAG,KAAK,SAAS,CAAC;QAChD,UAAU,EAAE,MAAM;KACnB,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc,EAAE,KAAa;IACrD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;IACnE,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,GAAG,KAAK,aAAa,CAAC,CAAC;IACtE,MAAM,MAAM,GAA0C,EAAE,CAAC;IACzD,KAAK,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9D,MAAM,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,KAAK,eAAe,QAAQ,EAAE,CAAC,CAAC,GAAG,CACtE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,KAAK,eAAe,QAAQ,IAAI,KAAK,GAAG,CAAC,CACzE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC;QAC1C,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC;QAC1C,UAAU,EAAE,MAAM;KACnB,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CACb,KAAc,EACd,KAAa,EACb,WAAmC;IAEnC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,sBAAsB,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,KAAK,GAAG,KAAgC,CAAC;IAC/C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,kBAAkB,GAAG,GAAG,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,IAAI,CAAC,KAAc,EAAE,KAAa;IACzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,mBAAmB,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,KAA+B,CAAC;AACzC,CAAC;AAED,SAAS,YAAY,CAAC,KAAc,EAAE,KAAa;IACjD,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,IAAI,CAAC,KAAc,EAAE,KAAa;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,qBAAqB,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAqCD;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,QAA2B,EAC3B,KAAY;IAEZ,MAAM,MAAM,GAAG,sBAAsB,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IACpE,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,MAAM,KAAK,GAAoB,EAAE,CAAC;IAElC,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAqB,EAAE,CAAC;QACtC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC3C,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;gBAC5C,OAAO,CAAC,IAAI,CAAC;oBACX,QAAQ,EAAE,QAAQ,CAAC,IAAI;oBACvB,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,OAAO,EAAE,IAAI,CAAC,IAAI;oBAClB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,MAAM,EAAE,iBAAiB;iBAC1B,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACrC,OAAO,CAAC,IAAI,CAAC;gBACX,QAAQ,EAAE,QAAQ,CAAC,IAAI;gBACvB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,OAAO,EAAE,IAAI,CAAC,IAAI;gBAClB,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG;gBACxB,MAAM,EAAE,cAAc;aACvB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,SAAS;QACX,CAAC;QACD,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,GAAG,QAAQ,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,EAAE;YACxC,KAAK,CAAC,GAAG;gBACP,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;oBAC5B,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBAC3C,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACnC,KAAK,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;wBACnE,MAAM,SAAS,GAAG,qBAAqB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;wBACvD,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,EAC5B,MAAM,EACN,QAAQ,EACR,MAAM,CACP,CAAC;wBACF,IAAI,SAAS,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;4BAC/B,OAAO,CAAC,IAAI,CAAC;gCACX,QAAQ,EAAE,QAAQ,CAAC,IAAI;gCACvB,IAAI,EAAE,IAAI,CAAC,IAAI;gCACf,OAAO,EAAE,IAAI,CAAC,IAAI;gCAClB,MAAM,EAAE,IAAI,CAAC,MAAM;gCACnB,QAAQ;gCACR,MAAM,EAAE,yBAAyB;gCACjC,KAAK,EAAE,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE;6BACrC,CAAC,CAAC;4BACH,SAAS;wBACX,CAAC;wBACD,MAAM,CAAC,KAAK,CACV,MAAM,EACN,QAAQ,EACR,GAAG,QAAQ,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,QAAQ,IAAI,IAAI,CAAC,MAAM,aAAa,MAAM,CAAC,QAAQ,CAAC,SAAS,MAAM,CAAC,MAAM,CAAC,EAAE,CAChI,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC5B,CAAC;AAOD;;;;;;GAMG;AACH,SAAS,qBAAqB,CAC5B,KAAkB,EAClB,KAAY;IAEZ,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,OAAO;QACL,OAAO;QACP,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ;YAC7B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACtD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC3C,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;oBAC3D,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACpB,CAAC;YACH,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,SAAS,cAAc,CAAC,OAAgB;IACtC,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,QAAQ;YACX,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY;gBACzC,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;QAC1B,KAAK,SAAS;YACZ,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;QAC7B,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,OAAO,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,KAAqB;IACpC,OAAO;QACL,MAAM,EAAE,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC;QACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC;KAClC,CAAC;AACJ,CAAC;AAED,wGAAwG;AACxG,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,MAAM,CAAC,EAAE,KAAK,GAAG,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,uCAAuC,IAAI,GAAG,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AACjE,CAAC"}
|