@stigmer/server 3.31.0 → 3.32.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/authorization/model/data/authorization-model.json +16 -46
- package/dist/boot/compose.d.ts.map +1 -1
- package/dist/boot/compose.js +3 -0
- package/dist/boot/compose.js.map +1 -1
- package/dist/domain/agentexecution/create-execution-context-step.d.ts +7 -0
- package/dist/domain/agentexecution/create-execution-context-step.d.ts.map +1 -1
- package/dist/domain/agentexecution/create-execution-context-step.js +79 -4
- package/dist/domain/agentexecution/create-execution-context-step.js.map +1 -1
- package/dist/domain/iampolicy/constants.d.ts +11 -1
- package/dist/domain/iampolicy/constants.d.ts.map +1 -1
- package/dist/domain/iampolicy/constants.js +11 -1
- package/dist/domain/iampolicy/constants.js.map +1 -1
- package/dist/domain/iampolicy/controller.d.ts.map +1 -1
- package/dist/domain/iampolicy/controller.js +36 -12
- package/dist/domain/iampolicy/controller.js.map +1 -1
- package/dist/domain/iampolicy/steps.d.ts +98 -0
- package/dist/domain/iampolicy/steps.d.ts.map +1 -1
- package/dist/domain/iampolicy/steps.js +119 -4
- package/dist/domain/iampolicy/steps.js.map +1 -1
- package/dist/domain/platformclient/constants.d.ts +11 -1
- package/dist/domain/platformclient/constants.d.ts.map +1 -1
- package/dist/domain/platformclient/constants.js +11 -1
- package/dist/domain/platformclient/constants.js.map +1 -1
- package/dist/domain/platformclient/verifier.d.ts.map +1 -1
- package/dist/domain/platformclient/verifier.js +7 -2
- package/dist/domain/platformclient/verifier.js.map +1 -1
- package/dist/extensions/identity.d.ts +14 -0
- package/dist/extensions/identity.d.ts.map +1 -1
- package/dist/extensions/identity.js.map +1 -1
- package/dist/index.d.ts +1 -0
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +5 -0
- package/dist/index.js.map +1 -1
- package/dist/pipeline/steps/defaults.d.ts +5 -1
- package/dist/pipeline/steps/defaults.d.ts.map +1 -1
- package/dist/pipeline/steps/defaults.js +6 -1
- package/dist/pipeline/steps/defaults.js.map +1 -1
- package/package.json +6 -6
- package/src/authorization/__tests__/store-tests.test.ts +1 -0
- package/src/authorization/model/data/authorization-model.json +16 -46
- package/src/boot/compose.ts +3 -0
- package/src/domain/agentexecution/__tests__/create-execution-context-step.test.ts +329 -0
- package/src/domain/agentexecution/__tests__/lifecycle.test.ts +7 -0
- package/src/domain/agentexecution/create-execution-context-step.ts +110 -4
- package/src/domain/iampolicy/__tests__/controller.test.ts +99 -3
- package/src/domain/iampolicy/__tests__/steps.test.ts +179 -0
- package/src/domain/iampolicy/constants.ts +15 -1
- package/src/domain/iampolicy/controller.ts +43 -9
- package/src/domain/iampolicy/steps.ts +164 -4
- package/src/domain/platformclient/__tests__/mint.test.ts +7 -1
- package/src/domain/platformclient/__tests__/verifier-and-guard.test.ts +4 -2
- package/src/domain/platformclient/constants.ts +11 -1
- package/src/domain/platformclient/verifier.ts +7 -2
- package/src/extensions/__tests__/role-reconciliation-composed.test.ts +18 -10
- package/src/extensions/identity.ts +14 -0
- package/src/index.ts +5 -0
- package/src/pipeline/__tests__/steps.test.ts +72 -1
- package/src/pipeline/steps/defaults.ts +6 -1
|
@@ -38,7 +38,8 @@
|
|
|
38
38
|
* unknown permission, the unknown principal kind (the resource sentence's
|
|
39
39
|
* shape), the malformed triple, and the four principal refusals a team
|
|
40
40
|
* grantee brought (a person's qualifier, a team's qualifier, a kind no
|
|
41
|
-
* team may be granted, a role a team may not hold)
|
|
41
|
+
* team may be granted, a role a team may not hold), and the two owner
|
|
42
|
+
* refusals (a non-owner touching the owner role, the last owner's removal).
|
|
42
43
|
*/
|
|
43
44
|
import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
|
|
44
45
|
import { kindEnumName } from "../../pipeline/apiresource-meta.js";
|
|
@@ -246,4 +247,13 @@ export function teamRoleNotGrantableMessage(role, kind, grantable) {
|
|
|
246
247
|
export function malformedTripleMessage(field) {
|
|
247
248
|
return `policy ${field} must not contain ':', '#' or '@'`;
|
|
248
249
|
}
|
|
250
|
+
/**
|
|
251
|
+
* Granting, revoking or removing the owner role on an organization without
|
|
252
|
+
* `can_assign_roles` there (PERMISSION_DENIED). An admin grants every role
|
|
253
|
+
* up to admin; only an owner makes, or unmakes, an owner. An edition that
|
|
254
|
+
* serves invitations answers the same sentence for an owner invitation.
|
|
255
|
+
*/
|
|
256
|
+
export const OWNER_ASSIGNMENT_DENIED_MESSAGE = "only an owner of the organization can grant, revoke or remove the owner role";
|
|
257
|
+
/** Revoking or removing the last owner of an organization (FAILED_PRECONDITION). */
|
|
258
|
+
export const LAST_OWNER_MESSAGE = "an organization must keep at least one owner; make another member an owner first";
|
|
249
259
|
//# sourceMappingURL=constants.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/constants.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAMtH,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAE7D,+DAA+D;AAC/D,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEvC;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAAmB,CAAC;AAC1D,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CAAC;AAE3C,6FAA6F;AAC7F,MAAM,CAAC,MAAM,iBAAiB,GAA0B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AASxE,SAAS,cAAc,CAAC,IAAmB;IACzC,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAmB;IACrD,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAC/D,OAAO,GAAG,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,EAAE,IAAI,SAAS,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,EAAE,IAAI,QAAQ,EAAE,CAAC;AAC/G,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAmB;IACtD,MAAM,MAAM,GAA0D;QACpE,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC;QAC9C,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC;QAC1C,CAAC,oBAAoB,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,IAAI,EAAE,CAAC;QACtD,CAAC,eAAe,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC;QAC5C,CAAC,aAAa,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;QACxC,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC;KAC5B,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QACnC,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YACrE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,IAAmB;IAC7C,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,SAAS,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAmC;IAC7D,eAAe,CAAC,KAAK;IACrB,eAAe,CAAC,QAAQ;IACxB,eAAe,CAAC,KAAK;IACrB,eAAe,CAAC,UAAU;IAC1B,eAAe,CAAC,WAAW;IAC3B,eAAe,CAAC,QAAQ;CACzB,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,6BAA6B,CAAC;AAElE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAmC;IACxE,eAAe,CAAC,gBAAgB;IAChC,eAAe,CAAC,IAAI;CACrB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,QAAQ,CAAC;AAE9C,8EAA8E;AAC9E,iEAAiE;AACjE,8EAA8E;AAE9E,2CAA2C;AAC3C,MAAM,UAAU,qBAAqB,CAAC,EAAU;IAC9C,OAAO,yBAAyB,EAAE,EAAE,CAAC;AACvC,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,OAAO,6CAA6C,IAAI,gEAAgE,CAAC;AAC3H,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,uBAAuB,CACrC,IAAY,EACZ,IAAY,EACZ,SAAgC;IAEhC,OAAO,SAAS,IAAI,yCAAyC,IAAI,wBAAwB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AACnH,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,MAAM,+BAA+B,GAC1C,8CAA8C,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAY;IACrD,OAAO,2BAA2B,IAAI,GAAG,CAAC;AAC5C,CAAC;AAED,8EAA8E;AAC9E,oCAAoC;AACpC,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,yCAAyC,GACpD,4EAA4E,CAAC;AAE/E,mGAAmG;AACnG,MAAM,CAAC,MAAM,2CAA2C,GACtD,uEAAuE,CAAC;AAE1E,0FAA0F;AAC1F,MAAM,UAAU,wBAAwB,CAAC,QAAgB;IACvD,OAAO,uBAAuB,QAAQ,GAAG,CAAC;AAC5C,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,2BAA2B,CAAC,IAAY;IACtD,OAAO,4BAA4B,IAAI,GAAG,CAAC;AAC7C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAAY;IACvD,MAAM,SAAS,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,OAAO,mBAAmB,IAAI,2DAA2D,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AACnH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAgB;IACrD,OAAO,6DAA6D,QAAQ,GAAG,CAAC;AAClF,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,OAAO,4CAA4C,qBAAqB,gCAAgC,QAAQ,GAAG,CAAC;AACtH,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,OAAO,qDAAqD,IAAI,IAAI,CAAC;AACvE,CAAC;AAED,gHAAgH;AAChH,MAAM,UAAU,2BAA2B,CACzC,IAAY,EACZ,IAAY,EACZ,SAAgC;IAEhC,OAAO,SAAS,IAAI,mDAAmD,IAAI,8BAA8B,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AACnI,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,OAAO,UAAU,KAAK,mCAAmC,CAAC;AAC5D,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAC1C,8EAA8E,CAAC;AAEjF,oFAAoF;AACpF,MAAM,CAAC,MAAM,kBAAkB,GAC7B,kFAAkF,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/controller.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/controller.ts"],"names":[],"mappings":"AAoGA,OAAO,KAAK,EAAE,aAAa,EAAkB,MAAM,qBAAqB,CAAC;AAqCzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uDAAuD,CAAC;AAE3F,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAEjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAGxE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAC/E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAmB9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAStE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAmB1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAcjD,iHAAiH;AACjH,MAAM,MAAM,iBAAiB,GAAG,gBAAgB,GAAG,aAAa,CAAC;AAEjE,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,4GAA4G;IAC5G,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,sHAAsH;IACtH,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,wFAAwF;IACxF,QAAQ,CAAC,OAAO,EAAE,wBAAwB,GAAG,SAAS,CAAC;IACvD,0GAA0G;IAC1G,QAAQ,CAAC,gBAAgB,EAAE,gBAAgB,GAAG,SAAS,CAAC;IACxD,wFAAwF;IACxF,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC,2FAA2F;IAC3F,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,sEAAsE;AACtE,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,uBAAuB,GAC5B,IAAI,CA2CN"}
|
|
@@ -13,7 +13,9 @@
|
|
|
13
13
|
* in-process RPCs (Q-OR-1), never through an exported constructor.
|
|
14
14
|
*
|
|
15
15
|
* Shape (Q-S5-1). The six command RPCs are pipeline chains, each
|
|
16
|
-
* `Authorize → ValidateProto → <one domain step>` (steps.ts)
|
|
16
|
+
* `Authorize → ValidateProto → <one domain step>` (steps.ts), with the two
|
|
17
|
+
* owner steps before the write on `create`, `delete` and `revokeOrgAccess`
|
|
18
|
+
* (owner is assigned by owners, steps.ts's last section): the write is
|
|
17
19
|
* the grant path's, the annotation drives position 1, and the executor's
|
|
18
20
|
* fault mapping covers a store fault from inside the path. The eight
|
|
19
21
|
* query RPCs are direct handlers over `authorizeDirect` (the cloud's
|
|
@@ -117,7 +119,7 @@ import { AUTHENTICATION_REQUIRED_MESSAGE, AUTHORIZATION_QUERIES_UNIMPLEMENTED_ME
|
|
|
117
119
|
import { newAccountDisplayResolver } from "./display-resolver.js";
|
|
118
120
|
import { permissionByEnumName } from "./permissions.js";
|
|
119
121
|
import { assignableRelations, isAssignableRole, roleInfoFromRelation, } from "./roles.js";
|
|
120
|
-
import { POLICY_RESULT_KEY, newCleanupResourceStep, newGrantStep, newRevokeOrgAccessStep, newRevokeStep, newValidateGrantableRoleStep, } from "./steps.js";
|
|
122
|
+
import { POLICY_RESULT_KEY, newAuthorizeOwnerAssignmentStep, newCleanupResourceStep, newGrantStep, newKeepOneOwnerStep, newRevokeOrgAccessStep, newRevokeStep, newValidateGrantableRoleStep, orgAccessOwnerRoleChange, specOwnerRoleChange, } from "./steps.js";
|
|
121
123
|
import { refsOf, requireKnownPrincipalKind, requireKnownResourceKind, requireWellFormedTriple, } from "./wire-refusals.js";
|
|
122
124
|
/**
|
|
123
125
|
* The Java pre-migration `_self` principal alias — rejected with a
|
|
@@ -139,10 +141,10 @@ export function registerIamPolicyServices(router, deps) {
|
|
|
139
141
|
guardSystemRpc(command.cleanupResourcePolicies, callerIdentityOf(ctx));
|
|
140
142
|
return cleanupResourcePolicies(deps, ref, ctx);
|
|
141
143
|
},
|
|
142
|
-
revokeOrgAccess: (input, ctx) => revokeOrgAccess(deps, command.revokeOrgAccess, input, ctx),
|
|
144
|
+
revokeOrgAccess: (input, ctx) => revokeOrgAccess(deps, command.revokeOrgAccess, input, ctx, true),
|
|
143
145
|
bootstrapRevokeOrgAccess: (input, ctx) => {
|
|
144
146
|
guardSystemRpc(command.bootstrapRevokeOrgAccess, callerIdentityOf(ctx));
|
|
145
|
-
return revokeOrgAccess(deps, command.bootstrapRevokeOrgAccess, input, ctx);
|
|
147
|
+
return revokeOrgAccess(deps, command.bootstrapRevokeOrgAccess, input, ctx, false);
|
|
146
148
|
},
|
|
147
149
|
});
|
|
148
150
|
router.service(IamPolicyQueryController, {
|
|
@@ -175,7 +177,8 @@ function guardSystemRpc(method, caller) {
|
|
|
175
177
|
// ---------------------------------------------------------------------------
|
|
176
178
|
/**
|
|
177
179
|
* `create`: the wire refusal, then Authorize → ValidateProto →
|
|
178
|
-
* ValidateGrantableRole →
|
|
180
|
+
* ValidateGrantableRole → AuthorizeOwnerAssignment →
|
|
181
|
+
* [iam-policy-create:pre-side-effect-gate] → Grant.
|
|
179
182
|
*/
|
|
180
183
|
function createPolicy(deps, spec, ctx) {
|
|
181
184
|
requireWellFormedTriple(spec);
|
|
@@ -183,8 +186,9 @@ function createPolicy(deps, spec, ctx) {
|
|
|
183
186
|
}
|
|
184
187
|
/**
|
|
185
188
|
* The grant chain both `create` and `bootstrapPolicy` run; only the user
|
|
186
|
-
* lane validates the role
|
|
187
|
-
*
|
|
189
|
+
* lane validates the role, asks for an owner's authority when it grants
|
|
190
|
+
* owner, and runs the create gate slot — bootstrap writes structural
|
|
191
|
+
* relations no scope would admit and no edition gates.
|
|
188
192
|
*/
|
|
189
193
|
async function grantThroughChain(deps, method, spec, ctx, validateRole) {
|
|
190
194
|
const reqCtx = new RequestContext(IamPolicySpecSchema, spec, callerIdentityOf(ctx), kindOf(ctx));
|
|
@@ -193,6 +197,7 @@ async function grantThroughChain(deps, method, spec, ctx, validateRole) {
|
|
|
193
197
|
.addStep(newValidateProtoStep());
|
|
194
198
|
if (validateRole) {
|
|
195
199
|
pipeline.addStep(newValidateGrantableRoleStep(deps.grantScope));
|
|
200
|
+
pipeline.addStep(newAuthorizeOwnerAssignmentStep(deps.authorizer, specOwnerRoleChange));
|
|
196
201
|
for (const step of stepsForSlot(deps.gateSteps, "iam-policy-create:pre-side-effect-gate")) {
|
|
197
202
|
pipeline.addStep(step);
|
|
198
203
|
}
|
|
@@ -200,7 +205,11 @@ async function grantThroughChain(deps, method, spec, ctx, validateRole) {
|
|
|
200
205
|
await pipeline.addStep(newGrantStep(deps.grantPath)).build().execute(reqCtx);
|
|
201
206
|
return policyResultOf(reqCtx, method);
|
|
202
207
|
}
|
|
203
|
-
/**
|
|
208
|
+
/**
|
|
209
|
+
* `delete`: the wire refusal, then Authorize → ValidateProto →
|
|
210
|
+
* AuthorizeOwnerAssignment → KeepOneOwner → Revoke; the revoked row, or the
|
|
211
|
+
* default instance.
|
|
212
|
+
*/
|
|
204
213
|
async function deletePolicy(deps, spec, ctx) {
|
|
205
214
|
requireWellFormedTriple(spec);
|
|
206
215
|
const method = IamPolicyCommandController.method.delete;
|
|
@@ -208,17 +217,32 @@ async function deletePolicy(deps, spec, ctx) {
|
|
|
208
217
|
await newPipeline("iampolicy-delete", deps.logger)
|
|
209
218
|
.addStep(newAuthorizeStep(method, deps.authorizer))
|
|
210
219
|
.addStep(newValidateProtoStep())
|
|
220
|
+
.addStep(newAuthorizeOwnerAssignmentStep(deps.authorizer, specOwnerRoleChange))
|
|
221
|
+
.addStep(newKeepOneOwnerStep(deps.policies, specOwnerRoleChange))
|
|
211
222
|
.addStep(newRevokeStep(deps.grantPath))
|
|
212
223
|
.build()
|
|
213
224
|
.execute(reqCtx);
|
|
214
225
|
return policyResultOf(reqCtx, method);
|
|
215
226
|
}
|
|
216
|
-
/**
|
|
217
|
-
|
|
227
|
+
/**
|
|
228
|
+
* `revokeOrgAccess` and its system twin share one chain: Authorize →
|
|
229
|
+
* ValidateProto → RevokeOrgAccess, and on the caller lane
|
|
230
|
+
* AuthorizeOwnerAssignment → KeepOneOwner before the revoke. The twin's
|
|
231
|
+
* platform-pipeline callers hold no organization role, and removing an
|
|
232
|
+
* account is theirs to decide.
|
|
233
|
+
*/
|
|
234
|
+
async function revokeOrgAccess(deps, method, input, ctx, guardOwners) {
|
|
218
235
|
const reqCtx = new RequestContext(RevokeOrgAccessInputSchema, input, callerIdentityOf(ctx), kindOf(ctx));
|
|
219
|
-
|
|
236
|
+
const pipeline = newPipeline(`iampolicy-${method.localName}`, deps.logger)
|
|
220
237
|
.addStep(newAuthorizeStep(method, deps.authorizer))
|
|
221
|
-
.addStep(newValidateProtoStep())
|
|
238
|
+
.addStep(newValidateProtoStep());
|
|
239
|
+
if (guardOwners) {
|
|
240
|
+
const ownerRoleChange = orgAccessOwnerRoleChange(deps.policies);
|
|
241
|
+
pipeline
|
|
242
|
+
.addStep(newAuthorizeOwnerAssignmentStep(deps.authorizer, ownerRoleChange))
|
|
243
|
+
.addStep(newKeepOneOwnerStep(deps.policies, ownerRoleChange));
|
|
244
|
+
}
|
|
245
|
+
await pipeline
|
|
222
246
|
.addStep(newRevokeOrgAccessStep(deps.grantPath))
|
|
223
247
|
.build()
|
|
224
248
|
.execute(reqCtx);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2FG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAErD,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGzD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,MAAM,IAAI,sBAAsB,EAAE,MAAM,0DAA0D,CAAC;AAE5G,OAAO,EAAE,0BAA0B,EAAE,MAAM,wDAAwD,CAAC;AAapG,OAAO,EACL,gCAAgC,EAChC,+BAA+B,EAC/B,8BAA8B,EAC9B,4BAA4B,EAC5B,qBAAqB,EACrB,mCAAmC,EACnC,0BAA0B,GAC3B,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,sDAAsD,CAAC;AAKhG,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAM1E,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAE9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAIxE,OAAO,EACL,cAAc,EACd,YAAY,EACZ,mBAAmB,GACpB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EACL,iCAAiC,EACjC,eAAe,EACf,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAEjE,OAAO,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC/E,OAAO,EACL,+BAA+B,EAC/B,2CAA2C,EAC3C,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAGlE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,YAAY,EACZ,sBAAsB,EACtB,aAAa,EACb,4BAA4B,GAC7B,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,MAAM,EACN,yBAAyB,EACzB,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAwBlC,sEAAsE;AACtE,MAAM,UAAU,yBAAyB,CACvC,MAAqB,EACrB,IAA6B;IAE7B,MAAM,eAAe,GAAG,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,0BAA0B,CAAC,MAAM,CAAC;IAElD,MAAM,CAAC,OAAO,CAAC,0BAA0B,EAAE;QACzC,MAAM,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC;QACpD,MAAM,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC;QACpD,eAAe,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YAC7B,cAAc,CAAC,OAAO,CAAC,eAAe,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/D,OAAO,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,eAAe,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAC5E,CAAC;QACD,uBAAuB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACpC,cAAc,CAAC,OAAO,CAAC,uBAAuB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;YACvE,OAAO,uBAAuB,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACjD,CAAC;QACD,eAAe,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAC9B,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,eAAe,EAAE,KAAK,EAAE,GAAG,CAAC;QAC5D,wBAAwB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACvC,cAAc,CAAC,OAAO,CAAC,wBAAwB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;YACxE,OAAO,eAAe,CACpB,IAAI,EACJ,OAAO,CAAC,wBAAwB,EAChC,KAAK,EACL,GAAG,CACJ,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;IAEH,MAAM,CAAC,OAAO,CAAC,wBAAwB,EAAE;QACvC,GAAG,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC;QACpC,iBAAiB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QACtE,kBAAkB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QACxE,yBAAyB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACxC,yBAAyB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QAC7C,0BAA0B,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACzC,0BAA0B,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QAC9C,6BAA6B,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAC5C,6BAA6B,CAAC,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,GAAG,CAAC;QAClE,yBAAyB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACxC,yBAAyB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QAC7C,kBAAkB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;KACzE,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,GAAmB;IACjC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,MAAkB,EAAE,MAAsB;IAChE,IAAI,wBAAwB,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,OAAO;IACT,CAAC;IACD,MAAM,IAAI,YAAY,CACpB,SAAS,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC,QAAQ,EAClD,IAAI,CAAC,gBAAgB,CACtB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,YAAY,CACnB,IAA6B,EAC7B,IAAmB,EACnB,GAAmB;IAEnB,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO,iBAAiB,CACtB,IAAI,EACJ,0BAA0B,CAAC,MAAM,CAAC,MAAM,EACxC,IAAI,EACJ,GAAG,EACH,IAAI,CACL,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,iBAAiB,CAC9B,IAA6B,EAC7B,MAAkB,EAClB,IAAmB,EACnB,GAAmB,EACnB,YAAqB;IAErB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,mBAAmB,EACnB,IAAI,EACJ,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,QAAQ,GAAG,WAAW,CAC1B,aAAa,MAAM,CAAC,SAAS,EAAE,EAC/B,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;SAClD,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC;IACnC,IAAI,YAAY,EAAE,CAAC;QACjB,QAAQ,CAAC,OAAO,CAAC,4BAA4B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAChE,KAAK,MAAM,IAAI,IAAI,YAAY,CAC7B,IAAI,CAAC,SAAS,EACd,wCAAwC,CACzC,EAAE,CAAC;YACF,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7E,OAAO,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACxC,CAAC;AAED,qHAAqH;AACrH,KAAK,UAAU,YAAY,CACzB,IAA6B,EAC7B,IAAmB,EACnB,GAAmB;IAEnB,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,0BAA0B,CAAC,MAAM,CAAC,MAAM,CAAC;IACxD,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,mBAAmB,EACnB,IAAI,EACJ,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAA6B,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC;SAC3E,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;SAClD,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;SACtC,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACxC,CAAC;AAED,0FAA0F;AAC1F,KAAK,UAAU,eAAe,CAC5B,IAA6B,EAC7B,MAAkB,EAClB,KAA2B,EAC3B,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,0BAA0B,EAC1B,KAAK,EACL,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,aAAa,MAAM,CAAC,SAAS,EAAE,EAC/B,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;SAClD,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;SAC/C,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC;AAC7B,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,IAA6B,EAC7B,GAAmB,EACnB,GAAmB;IAEnB,MAAM,MAAM,GAAG,0BAA0B,CAAC,MAAM,CAAC,uBAAuB,CAAC;IACzE,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,oBAAoB,EACpB,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,mCAAmC,EACnC,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;SAClD,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;SAC/C,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,cAAc,CACrB,MAA4B,EAC5B,MAAkB;IAElB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC7C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,GAAG,MAAM,CAAC,SAAS,sCAAsC,CAAC,EACpE,6BAA6B,CAC9B,CAAC;IACJ,CAAC;IACD,OAAO,MAAmB,CAAC;AAC7B,CAAC;AAED,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E,qEAAqE;AACrE,KAAK,UAAU,GAAG,CAChB,IAA6B,EAC7B,EAAe,EACf,GAAmB;IAEnB,MAAM,MAAM,GAAG,MAAM,IAAI,CACvB,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC,EACtC,2BAA2B,CAC5B,CAAC;IACF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,YAAY,CAAC,qBAAqB,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzE,CAAC;IACD,sEAAsE;IACtE,qEAAqE;IACrE,wDAAwD;IACxD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/C,MAAM,eAAe,CACnB,wBAAwB,CAAC,MAAM,CAAC,GAAG,EACnC,IAAI,CAAC,UAAU,EACf,gBAAgB,CAAC,GAAG,CAAC,EACrB,EAAE,EACF,EAAE,YAAY,EAAE,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,CACzE,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,gFAAgF;AAChF,KAAK,UAAU,iBAAiB,CAC9B,IAA6B,EAC7B,KAA6B,EAC7B,GAAmB;IAEnB,MAAM,MAAM,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG,oBAAoB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,YAAY,CACpB,wBAAwB,CAAC,KAAK,CAAC,QAAQ,CAAC,EACxC,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,YAAY,GAAG,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAE7D,IAAI,KAAK,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,MAAM,CAAC,oBAAoB,EAAE;YAC7C,IAAI,EAAE,YAAY,CAAC,eAAe,CAAC,gBAAgB,CAAC;YACpD,EAAE,EAAE,MAAM,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC;SAC1C,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,CAAC,mBAAmB,EAAE;YACzC,SAAS;YACT,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ;SACT,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACrE,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,0EAA0E;IAC1E,IAAI,CAAC,mBAAmB,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACrD,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,yEAAyE;IACzE,IACE,UAAU,KAAK,aAAa,CAAC,gBAAgB;QAC7C,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC,EACzD,CAAC;QACD,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,qEAAqE;IACrE,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE;QACjE,UAAU;QACV,YAAY;QACZ,UAAU,EAAE,QAAQ,CAAC,EAAE;KACxB,CAAC,CAAC;IACH,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtB,KAAK,OAAO;YACV,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,KAAK,MAAM,CAAC;QACZ,KAAK,WAAW;YACd,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QACzE,KAAK,aAAa;YAChB,MAAM,aAAa,CAAC,QAAQ,CAAC,KAAK,EAAE,iCAAiC,CAAC,CAAC;QACzE,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,QAAQ,CAAC;YACnC,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,oBAAoB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,EAC3D,iCAAiC,CAClC,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,IAA6B,EAC7B,KAA8B,EAC9B,GAAmB;IAEnB,MAAM,MAAM,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5D,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACrE,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,2FAA2F;AAC3F,KAAK,UAAU,yBAAyB,CACtC,IAA6B,EAC7B,KAAqC,EACrC,GAAmB;IAEnB,MAAM,MAAM,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IACrD,yBAAyB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1C,wBAAwB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,eAAe,CAC9C,SAAS,EACT,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,kBAAkB,CACzB,CAAC;IACF,OAAO,MAAM,CAAC,+BAA+B,EAAE;QAC7C,WAAW,EAAE,CAAC,GAAG,WAAW,CAAC;KAC9B,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,0BAA0B,CACvC,IAA6B,EAC7B,KAAsC,EACtC,GAAmB;IAEnB,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5C,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxC,yBAAyB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC/C,MAAM,eAAe,CACnB,wBAAwB,CAAC,MAAM,CAAC,0BAA0B,EAC1D,IAAI,CAAC,UAAU,EACf,gBAAgB,CAAC,GAAG,CAAC,EACrB,KAAK,CACN,CAAC;IACF,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAChD,QAAQ,EACR,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,kBAAkB,CACzB,CAAC;IACF,OAAO,MAAM,CAAC,gCAAgC,EAAE;QAC9C,YAAY,EAAE,CAAC,GAAG,YAAY,CAAC;KAChC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,6BAA6B,CAC1C,IAA6B,EAC7B,eAA6D,EAC7D,KAA8B,EAC9B,GAAmB;IAEnB,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5C,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,eAAe,CACnB,wBAAwB,CAAC,MAAM,CAAC,6BAA6B,EAC7D,IAAI,CAAC,UAAU,EACf,gBAAgB,CAAC,GAAG,CAAC,EACrB,KAAK,CACN,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,IAAI,EAAE;QACpC,MAAM,SAAS,GAAG,MAAM,gBAAgB,CACtC,IAAI,CAAC,QAAQ,EACb,QAAQ,CAAC,IAAI,EACb,QAAQ,CAAC,EAAE,EACX,KAAK,CAAC,gBAAgB,CACvB,CAAC;QACF,OAAO,wBAAwB,CAC7B,IAAI,CAAC,QAAQ,EACb,eAAe,EACf,IAAI,CAAC,gBAAgB,EACrB,SAAS,CACV,CAAC;IACJ,CAAC,EAAE,gCAAgC,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC,mCAAmC,EAAE;QACjD,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC;KACtB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,IAA6B,EAC7B,KAA6B,EAC7B,GAAmB;IAEnB,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9C,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxC,yBAAyB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,eAAe,CACnB,wBAAwB,CAAC,MAAM,CAAC,yBAAyB,EACzD,IAAI,CAAC,UAAU,EACf,gBAAgB,CAAC,GAAG,CAAC,EACrB,KAAK,CACN,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,IAAI,CACrB,GAAG,EAAE,CACH,IAAI,CAAC,QAAQ,CAAC,0BAA0B,CACtC,SAAS,CAAC,IAAI,EACd,SAAS,CAAC,EAAE,EACZ,QAAQ,CAAC,IAAI,EACb,QAAQ,CAAC,EAAE,CACZ,EACH,gCAAgC,CACjC,CAAC;IACF,MAAM,KAAK,GAAG,IAAI;SACf,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;SAC5C,MAAM,CAAC,gBAAgB,CAAC;SACxB,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,4BAA4B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,IAA6B,EAC7B,KAA8B,EAC9B,GAAmB;IAEnB,mEAAmE;IACnE,MAAM,aAAa,GACjB,KAAK,CAAC,aAAa,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC;IAC/D,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,yBAAyB,CAAC,aAAa,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,eAAe,CACnB,wBAAwB,CAAC,MAAM,CAAC,kBAAkB,EAClD,IAAI,CAAC,UAAU,EACf,gBAAgB,CAAC,GAAG,CAAC,EACrB,KAAK,CACN,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,IAAI,CACtB,GAAG,EAAE,CACH,IAAI,CAAC,QAAQ,CAAC,iCAAiC,CAC7C,YAAY,CAAC,eAAe,CAAC,YAAY,CAAC,EAC1C,KAAK,CAAC,KAAK,EACX,aAAa,EACb,mBAAmB,EAAE,CACtB,EACH,4BAA4B,CAC7B,CAAC;IACF,OAAO,MAAM,CAAC,qBAAqB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;AAClD,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,sEAAsE;AACtE,SAAS,oBAAoB,CAAC,MAAsB;IAClD,IAAI,MAAM,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,YAAY,CACpB,+BAA+B,EAC/B,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,iBAAiB,CAC9B,IAA6B,EAC7B,MAAsB;IAEtB,MAAM,OAAO,GAAG,MAAM,IAAI,CACxB,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,EAC7C,wCAAwC,CACzC,CAAC;IACF,OAAO,OAAO,EAAE,QAAQ,EAAE,EAAE,IAAI,MAAM,CAAC,UAAU,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,qBAAqB,CAClC,IAA6B,EAC7B,MAAsB,EACtB,SAAqC;IAErC,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,IAAI,MAAM,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QAC1E,OAAO;IACT,CAAC;IACD,IAAI,SAAS,EAAE,IAAI,KAAK,YAAY,CAAC,eAAe,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,YAAY,CACpB,4DAA4D,EAC5D,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,SAAS,CAAC,EAAE,CAAC;IACjC,IAAI,WAAW,KAAK,EAAE,IAAI,WAAW,KAAK,iBAAiB,EAAE,CAAC;QAC5D,MAAM,IAAI,YAAY,CACpB,QAAQ,iBAAiB,uCAAuC;YAC9D,kDAAkD,EACpD,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,KAAK,CAAC,MAAM,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,YAAY,CACpB,4CAA4C,EAC5C,IAAI,CAAC,gBAAgB,CACtB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,SAAS,kBAAkB,CACzB,IAA6B;IAE7B,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,YAAY,CACpB,2CAA2C,EAC3C,IAAI,CAAC,aAAa,CACnB,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,CAAC;AACtB,CAAC;AAED,yEAAyE;AACzE,SAAS,UAAU,CAAC,GAA+B;IACjD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,sDAAsD,CAAC,EACjE,sDAAsD,CACvD,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iFAAiF;AACjF,SAAS,kBAAkB,CAAC,MAAiC;IAC3D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,mDAAmD,CAAC,EAC9D,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,2FAA2F;AAC3F,SAAS,SAAS,CAAC,MAAiB;IAClC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,aAAa,CACjB,IAAI,KAAK,CACP,UAAU,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,GAAG,4BAA4B,CACjE,EACD,2BAA2B,CAC5B,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,mGAAmG;AACnG,KAAK,UAAU,IAAI,CACjB,SAA2B,EAC3B,OAAe;IAEf,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,EAAE,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;AACH,CAAC"}
|
|
1
|
+
{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6FG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAErD,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGzD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,MAAM,IAAI,sBAAsB,EAAE,MAAM,0DAA0D,CAAC;AAE5G,OAAO,EAAE,0BAA0B,EAAE,MAAM,wDAAwD,CAAC;AAapG,OAAO,EACL,gCAAgC,EAChC,+BAA+B,EAC/B,8BAA8B,EAC9B,4BAA4B,EAC5B,qBAAqB,EACrB,mCAAmC,EACnC,0BAA0B,GAC3B,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,sDAAsD,CAAC;AAKhG,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAM1E,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAE9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAIxE,OAAO,EACL,cAAc,EACd,YAAY,EACZ,mBAAmB,GACpB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EACL,iCAAiC,EACjC,eAAe,EACf,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAEjE,OAAO,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC/E,OAAO,EACL,+BAA+B,EAC/B,2CAA2C,EAC3C,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAGlE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,iBAAiB,EACjB,+BAA+B,EAC/B,sBAAsB,EACtB,YAAY,EACZ,mBAAmB,EACnB,sBAAsB,EACtB,aAAa,EACb,4BAA4B,EAC5B,wBAAwB,EACxB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,MAAM,EACN,yBAAyB,EACzB,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAwBlC,sEAAsE;AACtE,MAAM,UAAU,yBAAyB,CACvC,MAAqB,EACrB,IAA6B;IAE7B,MAAM,eAAe,GAAG,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,0BAA0B,CAAC,MAAM,CAAC;IAElD,MAAM,CAAC,OAAO,CAAC,0BAA0B,EAAE;QACzC,MAAM,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC;QACpD,MAAM,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC;QACpD,eAAe,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YAC7B,cAAc,CAAC,OAAO,CAAC,eAAe,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/D,OAAO,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,eAAe,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAC5E,CAAC;QACD,uBAAuB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACpC,cAAc,CAAC,OAAO,CAAC,uBAAuB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;YACvE,OAAO,uBAAuB,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACjD,CAAC;QACD,eAAe,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAC9B,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,eAAe,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC;QAClE,wBAAwB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACvC,cAAc,CAAC,OAAO,CAAC,wBAAwB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;YACxE,OAAO,eAAe,CACpB,IAAI,EACJ,OAAO,CAAC,wBAAwB,EAChC,KAAK,EACL,GAAG,EACH,KAAK,CACN,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;IAEH,MAAM,CAAC,OAAO,CAAC,wBAAwB,EAAE;QACvC,GAAG,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC;QACpC,iBAAiB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QACtE,kBAAkB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QACxE,yBAAyB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACxC,yBAAyB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QAC7C,0BAA0B,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACzC,0BAA0B,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QAC9C,6BAA6B,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAC5C,6BAA6B,CAAC,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,GAAG,CAAC;QAClE,yBAAyB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACxC,yBAAyB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QAC7C,kBAAkB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;KACzE,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,GAAmB;IACjC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,MAAkB,EAAE,MAAsB;IAChE,IAAI,wBAAwB,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,OAAO;IACT,CAAC;IACD,MAAM,IAAI,YAAY,CACpB,SAAS,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC,QAAQ,EAClD,IAAI,CAAC,gBAAgB,CACtB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;GAIG;AACH,SAAS,YAAY,CACnB,IAA6B,EAC7B,IAAmB,EACnB,GAAmB;IAEnB,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO,iBAAiB,CACtB,IAAI,EACJ,0BAA0B,CAAC,MAAM,CAAC,MAAM,EACxC,IAAI,EACJ,GAAG,EACH,IAAI,CACL,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,iBAAiB,CAC9B,IAA6B,EAC7B,MAAkB,EAClB,IAAmB,EACnB,GAAmB,EACnB,YAAqB;IAErB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,mBAAmB,EACnB,IAAI,EACJ,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,QAAQ,GAAG,WAAW,CAC1B,aAAa,MAAM,CAAC,SAAS,EAAE,EAC/B,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;SAClD,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC;IACnC,IAAI,YAAY,EAAE,CAAC;QACjB,QAAQ,CAAC,OAAO,CAAC,4BAA4B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAChE,QAAQ,CAAC,OAAO,CACd,+BAA+B,CAAC,IAAI,CAAC,UAAU,EAAE,mBAAmB,CAAC,CACtE,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,YAAY,CAC7B,IAAI,CAAC,SAAS,EACd,wCAAwC,CACzC,EAAE,CAAC;YACF,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7E,OAAO,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,YAAY,CACzB,IAA6B,EAC7B,IAAmB,EACnB,GAAmB;IAEnB,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,0BAA0B,CAAC,MAAM,CAAC,MAAM,CAAC;IACxD,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,mBAAmB,EACnB,IAAI,EACJ,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAA6B,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC;SAC3E,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;SAClD,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CACN,+BAA+B,CAAC,IAAI,CAAC,UAAU,EAAE,mBAAmB,CAAC,CACtE;SACA,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;SAChE,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;SACtC,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,eAAe,CAC5B,IAA6B,EAC7B,MAAkB,EAClB,KAA2B,EAC3B,GAAmB,EACnB,WAAoB;IAEpB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,0BAA0B,EAC1B,KAAK,EACL,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,QAAQ,GAAG,WAAW,CAC1B,aAAa,MAAM,CAAC,SAAS,EAAE,EAC/B,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;SAClD,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC;IACnC,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,eAAe,GAAG,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChE,QAAQ;aACL,OAAO,CAAC,+BAA+B,CAAC,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;aAC1E,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,QAAQ;SACX,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;SAC/C,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC;AAC7B,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,IAA6B,EAC7B,GAAmB,EACnB,GAAmB;IAEnB,MAAM,MAAM,GAAG,0BAA0B,CAAC,MAAM,CAAC,uBAAuB,CAAC;IACzE,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,oBAAoB,EACpB,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,mCAAmC,EACnC,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;SAClD,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;SAC/C,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,cAAc,CACrB,MAA4B,EAC5B,MAAkB;IAElB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC7C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,GAAG,MAAM,CAAC,SAAS,sCAAsC,CAAC,EACpE,6BAA6B,CAC9B,CAAC;IACJ,CAAC;IACD,OAAO,MAAmB,CAAC;AAC7B,CAAC;AAED,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E,qEAAqE;AACrE,KAAK,UAAU,GAAG,CAChB,IAA6B,EAC7B,EAAe,EACf,GAAmB;IAEnB,MAAM,MAAM,GAAG,MAAM,IAAI,CACvB,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC,EACtC,2BAA2B,CAC5B,CAAC;IACF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,YAAY,CAAC,qBAAqB,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzE,CAAC;IACD,sEAAsE;IACtE,qEAAqE;IACrE,wDAAwD;IACxD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/C,MAAM,eAAe,CACnB,wBAAwB,CAAC,MAAM,CAAC,GAAG,EACnC,IAAI,CAAC,UAAU,EACf,gBAAgB,CAAC,GAAG,CAAC,EACrB,EAAE,EACF,EAAE,YAAY,EAAE,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,CACzE,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,gFAAgF;AAChF,KAAK,UAAU,iBAAiB,CAC9B,IAA6B,EAC7B,KAA6B,EAC7B,GAAmB;IAEnB,MAAM,MAAM,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG,oBAAoB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,YAAY,CACpB,wBAAwB,CAAC,KAAK,CAAC,QAAQ,CAAC,EACxC,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,YAAY,GAAG,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAE7D,IAAI,KAAK,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,MAAM,CAAC,oBAAoB,EAAE;YAC7C,IAAI,EAAE,YAAY,CAAC,eAAe,CAAC,gBAAgB,CAAC;YACpD,EAAE,EAAE,MAAM,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC;SAC1C,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,CAAC,mBAAmB,EAAE;YACzC,SAAS;YACT,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ;SACT,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACrE,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,0EAA0E;IAC1E,IAAI,CAAC,mBAAmB,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACrD,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,yEAAyE;IACzE,IACE,UAAU,KAAK,aAAa,CAAC,gBAAgB;QAC7C,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC,EACzD,CAAC;QACD,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,qEAAqE;IACrE,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE;QACjE,UAAU;QACV,YAAY;QACZ,UAAU,EAAE,QAAQ,CAAC,EAAE;KACxB,CAAC,CAAC;IACH,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtB,KAAK,OAAO;YACV,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,KAAK,MAAM,CAAC;QACZ,KAAK,WAAW;YACd,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QACzE,KAAK,aAAa;YAChB,MAAM,aAAa,CAAC,QAAQ,CAAC,KAAK,EAAE,iCAAiC,CAAC,CAAC;QACzE,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,QAAQ,CAAC;YACnC,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,oBAAoB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,EAC3D,iCAAiC,CAClC,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,IAA6B,EAC7B,KAA8B,EAC9B,GAAmB;IAEnB,MAAM,MAAM,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5D,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACrE,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,2FAA2F;AAC3F,KAAK,UAAU,yBAAyB,CACtC,IAA6B,EAC7B,KAAqC,EACrC,GAAmB;IAEnB,MAAM,MAAM,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IACrD,yBAAyB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1C,wBAAwB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,eAAe,CAC9C,SAAS,EACT,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,kBAAkB,CACzB,CAAC;IACF,OAAO,MAAM,CAAC,+BAA+B,EAAE;QAC7C,WAAW,EAAE,CAAC,GAAG,WAAW,CAAC;KAC9B,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,0BAA0B,CACvC,IAA6B,EAC7B,KAAsC,EACtC,GAAmB;IAEnB,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5C,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxC,yBAAyB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC/C,MAAM,eAAe,CACnB,wBAAwB,CAAC,MAAM,CAAC,0BAA0B,EAC1D,IAAI,CAAC,UAAU,EACf,gBAAgB,CAAC,GAAG,CAAC,EACrB,KAAK,CACN,CAAC;IACF,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAChD,QAAQ,EACR,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,kBAAkB,CACzB,CAAC;IACF,OAAO,MAAM,CAAC,gCAAgC,EAAE;QAC9C,YAAY,EAAE,CAAC,GAAG,YAAY,CAAC;KAChC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,6BAA6B,CAC1C,IAA6B,EAC7B,eAA6D,EAC7D,KAA8B,EAC9B,GAAmB;IAEnB,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5C,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,eAAe,CACnB,wBAAwB,CAAC,MAAM,CAAC,6BAA6B,EAC7D,IAAI,CAAC,UAAU,EACf,gBAAgB,CAAC,GAAG,CAAC,EACrB,KAAK,CACN,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,IAAI,EAAE;QACpC,MAAM,SAAS,GAAG,MAAM,gBAAgB,CACtC,IAAI,CAAC,QAAQ,EACb,QAAQ,CAAC,IAAI,EACb,QAAQ,CAAC,EAAE,EACX,KAAK,CAAC,gBAAgB,CACvB,CAAC;QACF,OAAO,wBAAwB,CAC7B,IAAI,CAAC,QAAQ,EACb,eAAe,EACf,IAAI,CAAC,gBAAgB,EACrB,SAAS,CACV,CAAC;IACJ,CAAC,EAAE,gCAAgC,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC,mCAAmC,EAAE;QACjD,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC;KACtB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,IAA6B,EAC7B,KAA6B,EAC7B,GAAmB;IAEnB,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9C,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxC,yBAAyB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,eAAe,CACnB,wBAAwB,CAAC,MAAM,CAAC,yBAAyB,EACzD,IAAI,CAAC,UAAU,EACf,gBAAgB,CAAC,GAAG,CAAC,EACrB,KAAK,CACN,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,IAAI,CACrB,GAAG,EAAE,CACH,IAAI,CAAC,QAAQ,CAAC,0BAA0B,CACtC,SAAS,CAAC,IAAI,EACd,SAAS,CAAC,EAAE,EACZ,QAAQ,CAAC,IAAI,EACb,QAAQ,CAAC,EAAE,CACZ,EACH,gCAAgC,CACjC,CAAC;IACF,MAAM,KAAK,GAAG,IAAI;SACf,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;SAC5C,MAAM,CAAC,gBAAgB,CAAC;SACxB,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,4BAA4B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,IAA6B,EAC7B,KAA8B,EAC9B,GAAmB;IAEnB,mEAAmE;IACnE,MAAM,aAAa,GACjB,KAAK,CAAC,aAAa,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC;IAC/D,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,yBAAyB,CAAC,aAAa,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,eAAe,CACnB,wBAAwB,CAAC,MAAM,CAAC,kBAAkB,EAClD,IAAI,CAAC,UAAU,EACf,gBAAgB,CAAC,GAAG,CAAC,EACrB,KAAK,CACN,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,IAAI,CACtB,GAAG,EAAE,CACH,IAAI,CAAC,QAAQ,CAAC,iCAAiC,CAC7C,YAAY,CAAC,eAAe,CAAC,YAAY,CAAC,EAC1C,KAAK,CAAC,KAAK,EACX,aAAa,EACb,mBAAmB,EAAE,CACtB,EACH,4BAA4B,CAC7B,CAAC;IACF,OAAO,MAAM,CAAC,qBAAqB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;AAClD,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,sEAAsE;AACtE,SAAS,oBAAoB,CAAC,MAAsB;IAClD,IAAI,MAAM,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,YAAY,CACpB,+BAA+B,EAC/B,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,iBAAiB,CAC9B,IAA6B,EAC7B,MAAsB;IAEtB,MAAM,OAAO,GAAG,MAAM,IAAI,CACxB,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,EAC7C,wCAAwC,CACzC,CAAC;IACF,OAAO,OAAO,EAAE,QAAQ,EAAE,EAAE,IAAI,MAAM,CAAC,UAAU,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,qBAAqB,CAClC,IAA6B,EAC7B,MAAsB,EACtB,SAAqC;IAErC,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,IAAI,MAAM,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QAC1E,OAAO;IACT,CAAC;IACD,IAAI,SAAS,EAAE,IAAI,KAAK,YAAY,CAAC,eAAe,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,YAAY,CACpB,4DAA4D,EAC5D,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,SAAS,CAAC,EAAE,CAAC;IACjC,IAAI,WAAW,KAAK,EAAE,IAAI,WAAW,KAAK,iBAAiB,EAAE,CAAC;QAC5D,MAAM,IAAI,YAAY,CACpB,QAAQ,iBAAiB,uCAAuC;YAC9D,kDAAkD,EACpD,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,KAAK,CAAC,MAAM,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,YAAY,CACpB,4CAA4C,EAC5C,IAAI,CAAC,gBAAgB,CACtB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,SAAS,kBAAkB,CACzB,IAA6B;IAE7B,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,YAAY,CACpB,2CAA2C,EAC3C,IAAI,CAAC,aAAa,CACnB,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,CAAC;AACtB,CAAC;AAED,yEAAyE;AACzE,SAAS,UAAU,CAAC,GAA+B;IACjD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,sDAAsD,CAAC,EACjE,sDAAsD,CACvD,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iFAAiF;AACjF,SAAS,kBAAkB,CAAC,MAAiC;IAC3D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,mDAAmD,CAAC,EAC9D,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,2FAA2F;AAC3F,SAAS,SAAS,CAAC,MAAiB;IAClC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,aAAa,CACjB,IAAI,KAAK,CACP,UAAU,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,GAAG,4BAA4B,CACjE,EACD,2BAA2B,CAC5B,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,mGAAmG;AACnG,KAAK,UAAU,IAAI,CACjB,SAA2B,EAC3B,OAAe;IAEf,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,EAAE,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;AACH,CAAC"}
|
|
@@ -1,8 +1,93 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* IamPolicy pipeline steps (20260913.01 slice 5; Q-S5-1): the domain-local
|
|
3
|
+
* steps the six command chains splice after the shared `Authorize` and
|
|
4
|
+
* `ValidateProto`. The write itself is never here — every step that writes
|
|
5
|
+
* calls the ONE grant and revoke path (grant-path.ts, which owns the
|
|
6
|
+
* cloud#425 orderings, the by-triple read and the wire refusals) and leaves
|
|
7
|
+
* its answer under POLICY_RESULT_KEY for the handler. The chains are
|
|
8
|
+
* deliberately short: `Authorize → ValidateProto → <one of these>`, with
|
|
9
|
+
* only the owner steps (the last section) before the write on the three
|
|
10
|
+
* caller lanes, so the pipeline executor's fault mapping (a step's ConnectError keeps its code;
|
|
11
|
+
* a raw store fault becomes the sanitized INTERNAL) covers the path's two
|
|
12
|
+
* error shapes with no second idiom in the handlers.
|
|
13
|
+
*
|
|
14
|
+
* ValidateGrantableRole (the `create` chain only; `bootstrapPolicy` is the
|
|
15
|
+
* structural lane and skips it) is the one step with branching logic. It
|
|
16
|
+
* runs BEFORE Grant — the cloud's validate-before-write order, so a held
|
|
17
|
+
* legacy row under a role the kind does not grant is refused rather than
|
|
18
|
+
* answered as a duplicate — and reads, in this order (Q-OR-3 as refined;
|
|
19
|
+
* Q-S3-3):
|
|
20
|
+
* 1. the wire refusals: an unknown resource kind is `Unknown resource
|
|
21
|
+
* kind`, never a role sentence — the second line behind the
|
|
22
|
+
* controller's pre-position-1 refusal (Q-S6-1), kept so the step's
|
|
23
|
+
* own contract holds for whoever splices it;
|
|
24
|
+
* 2. the PROTO (`grantableRolesFor`): a kind that lists no role is
|
|
25
|
+
* system-managed in every edition — the cloud's byte-pinned copy,
|
|
26
|
+
* whatever the composed scope claims;
|
|
27
|
+
* 3. the composed SCOPE: a kind it lists nothing for is a per-resource
|
|
28
|
+
* grant this edition does not serve — UNIMPLEMENTED naming the
|
|
29
|
+
* editions that do;
|
|
30
|
+
* 4. proto ∩ scope, in proto order: the role must be in the
|
|
31
|
+
* intersection — the cloud's second copy listing it. Intersecting is
|
|
32
|
+
* what keeps a scope from WIDENING the contract by accident;
|
|
33
|
+
* 5. the PRINCIPAL (Q-S9-2, 2026-09-14; constants.ts
|
|
34
|
+
* USER_GRANT_PRINCIPAL_KINDS): a person grants roles to people and to
|
|
35
|
+
* teams of people, and to nothing else. A row whose principal is a
|
|
36
|
+
* resource is a structural link (the hierarchy walk's parent edge),
|
|
37
|
+
* which is `bootstrapPolicy`'s to write; through this lane it would
|
|
38
|
+
* let a right on one organization read another's members. Last, so
|
|
39
|
+
* every answer the cloud's create gives today is unchanged and only
|
|
40
|
+
* the row it should never have written is refused. A person names no
|
|
41
|
+
* relation qualifier: `identity_account:<id>#<anything>` names
|
|
42
|
+
* nobody, and OpenFGA would refuse the tuple after the row was
|
|
43
|
+
* written, a grant on paper that is denied in practice.
|
|
44
|
+
*
|
|
45
|
+
* A TEAM principal takes its own list in place of arm 4: the kind's
|
|
46
|
+
* `team_grantable_roles` ∩ scope, never the person list, because a team
|
|
47
|
+
* is granted only what its members could each be granted and never
|
|
48
|
+
* ownership. It must name the team's members (`TEAM_MEMBERS_RELATION`).
|
|
49
|
+
* A kind that lists no team role refuses a team whatever the role, so
|
|
50
|
+
* open source (organization-only scope, and `organization` lists none)
|
|
51
|
+
* grants a team nothing without a branch of its own. Whether the team
|
|
52
|
+
* exists and belongs to the resource's organization needs a read, which
|
|
53
|
+
* this synchronous step does not make: that is the
|
|
54
|
+
* `iam-policy-create:pre-side-effect-gate` slot's, spliced after it.
|
|
55
|
+
*
|
|
56
|
+
* Owner is assigned by owners. Every caller of the member lanes holds
|
|
57
|
+
* `can_grant_access` (admin) already, so an admin grants every role up to
|
|
58
|
+
* admin; a change that touches an organization's `owner` role also needs
|
|
59
|
+
* `can_assign_roles` there, which only its owners hold. Two steps carry it,
|
|
60
|
+
* on the caller lanes only (`create`, `delete`, `revokeOrgAccess`; never
|
|
61
|
+
* the bootstrap twins, whose platform-pipeline callers hold no
|
|
62
|
+
* organization role):
|
|
63
|
+
* - AuthorizeOwnerAssignment asks `can_assign_roles` when the spec grants
|
|
64
|
+
* or revokes `owner` on an organization, or when the account
|
|
65
|
+
* `revokeOrgAccess` removes holds it. It is Authorize's own evaluation
|
|
66
|
+
* (`authorizeResolvedResource`), so the `internal` caller skips it as it
|
|
67
|
+
* skips position 1;
|
|
68
|
+
* - KeepOneOwner refuses a revoke or a removal that would leave the
|
|
69
|
+
* organization with no owner. It is a product rule rather than
|
|
70
|
+
* authorization, so it is its own step. It skips `internal` too. The
|
|
71
|
+
* port has no transaction, so two owners removing each other at the
|
|
72
|
+
* same instant can both pass; each still needed `can_assign_roles`.
|
|
73
|
+
* Both read the organization's owner rows once per request
|
|
74
|
+
* (`organizationOwners`). They do not govern the grants that follow
|
|
75
|
+
* configuration rather than a caller (the organization creator's row, the
|
|
76
|
+
* membership rules, the trusted-local operator), which call the grant path
|
|
77
|
+
* directly, nor an edition's in-process doors that grant a role on a
|
|
78
|
+
* person's behalf (an invitation's redemption, an identity provider's
|
|
79
|
+
* auto-grant), which run as `internal` and hold the same rule at their own
|
|
80
|
+
* sites.
|
|
81
|
+
*/
|
|
82
|
+
import { type DescMessage } from "@bufbuild/protobuf";
|
|
1
83
|
import type { RevokeOrgAccessInputSchema } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/io_pb";
|
|
2
84
|
import type { ApiResourceRefSchema, IamPolicySpecSchema } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/spec_pb";
|
|
85
|
+
import type { Authorizer } from "../../extensions/authorizer.js";
|
|
3
86
|
import type { PolicyGrantScope } from "../../extensions/policy-grant-scope.js";
|
|
4
87
|
import type { PipelineStep } from "../../pipeline/pipeline.js";
|
|
88
|
+
import type { RequestContext } from "../../pipeline/request-context.js";
|
|
5
89
|
import type { IamPolicyGrantPath } from "./grant-path.js";
|
|
90
|
+
import type { IamPolicyStore } from "./store.js";
|
|
6
91
|
/** The row a write chain answers — the granted row, or the revoked row (the default instance when there was none). */
|
|
7
92
|
export declare const POLICY_RESULT_KEY = "policyResult";
|
|
8
93
|
/** The `create` chain's role check; see the module header for the four arms. */
|
|
@@ -15,4 +100,17 @@ export declare function newRevokeStep(grantPath: IamPolicyGrantPath): PipelineSt
|
|
|
15
100
|
export declare function newRevokeOrgAccessStep(grantPath: IamPolicyGrantPath): PipelineStep<typeof RevokeOrgAccessInputSchema>;
|
|
16
101
|
/** Revoke every row naming the ref as resource or principal — the deleted resource's cleanup. */
|
|
17
102
|
export declare function newCleanupResourceStep(grantPath: IamPolicyGrantPath): PipelineStep<typeof ApiResourceRefSchema>;
|
|
103
|
+
/** An organization owner role a request would grant or remove, and whose it is. */
|
|
104
|
+
export interface OwnerRoleChange {
|
|
105
|
+
readonly organizationId: string;
|
|
106
|
+
readonly accountId: string;
|
|
107
|
+
}
|
|
108
|
+
/** `create` and `delete`: the spec names the change; nothing is read. */
|
|
109
|
+
export declare function specOwnerRoleChange(ctx: RequestContext<typeof IamPolicySpecSchema>): Promise<OwnerRoleChange | undefined>;
|
|
110
|
+
/** `revokeOrgAccess`: the removal touches owner exactly when the account holds it. */
|
|
111
|
+
export declare function orgAccessOwnerRoleChange(policies: IamPolicyStore): (ctx: RequestContext<typeof RevokeOrgAccessInputSchema>) => Promise<OwnerRoleChange | undefined>;
|
|
112
|
+
/** A change touching an organization's owner role needs `can_assign_roles` there; see the module header. */
|
|
113
|
+
export declare function newAuthorizeOwnerAssignmentStep<Desc extends DescMessage>(authorizer: Authorizer, ownerRoleChange: (ctx: RequestContext<Desc>) => Promise<OwnerRoleChange | undefined>): PipelineStep<Desc>;
|
|
114
|
+
/** A revoke or removal may not leave the organization with no owner; see the module header. */
|
|
115
|
+
export declare function newKeepOneOwnerStep<Desc extends DescMessage>(policies: IamPolicyStore, ownerRoleChange: (ctx: RequestContext<Desc>) => Promise<OwnerRoleChange | undefined>): PipelineStep<Desc>;
|
|
18
116
|
//# sourceMappingURL=steps.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"steps.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/steps.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"steps.d.ts","sourceRoot":"","sources":["../../../src/domain/iampolicy/steps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgFG;AACH,OAAO,EAAU,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAK9D,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,mDAAmD,CAAC;AACpG,OAAO,KAAK,EAEV,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,qDAAqD,CAAC;AAG7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAM/E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAexE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAMjD,sHAAsH;AACtH,eAAO,MAAM,iBAAiB,iBAAiB,CAAC;AAEhD,gFAAgF;AAChF,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,gBAAgB,GACtB,YAAY,CAAC,OAAO,mBAAmB,CAAC,CA4D1C;AA2CD,mFAAmF;AACnF,wBAAgB,YAAY,CAC1B,SAAS,EAAE,kBAAkB,GAC5B,YAAY,CAAC,OAAO,mBAAmB,CAAC,CAU1C;AAED,oGAAoG;AACpG,wBAAgB,aAAa,CAC3B,SAAS,EAAE,kBAAkB,GAC5B,YAAY,CAAC,OAAO,mBAAmB,CAAC,CAU1C;AAED,4EAA4E;AAC5E,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,kBAAkB,GAC5B,YAAY,CAAC,OAAO,0BAA0B,CAAC,CAYjD;AAED,iGAAiG;AACjG,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,kBAAkB,GAC5B,YAAY,CAAC,OAAO,oBAAoB,CAAC,CAQ3C;AAcD,mFAAmF;AACnF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AA+BD,yEAAyE;AACzE,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,cAAc,CAAC,OAAO,mBAAmB,CAAC,GAC9C,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAStC;AAED,sFAAsF;AACtF,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,cAAc,GACvB,CACD,GAAG,EAAE,cAAc,CAAC,OAAO,0BAA0B,CAAC,KACnD,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAQxC;AAED,4GAA4G;AAC5G,wBAAgB,+BAA+B,CAAC,IAAI,SAAS,WAAW,EACtE,UAAU,EAAE,UAAU,EACtB,eAAe,EAAE,CAAC,GAAG,EAAE,cAAc,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,GACnF,YAAY,CAAC,IAAI,CAAC,CAuBpB;AAED,+FAA+F;AAC/F,wBAAgB,mBAAmB,CAAC,IAAI,SAAS,WAAW,EAC1D,QAAQ,EAAE,cAAc,EACxB,eAAe,EAAE,CAAC,GAAG,EAAE,cAAc,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,GACnF,YAAY,CAAC,IAAI,CAAC,CAiBpB"}
|
|
@@ -5,8 +5,9 @@
|
|
|
5
5
|
* calls the ONE grant and revoke path (grant-path.ts, which owns the
|
|
6
6
|
* cloud#425 orderings, the by-triple read and the wire refusals) and leaves
|
|
7
7
|
* its answer under POLICY_RESULT_KEY for the handler. The chains are
|
|
8
|
-
* deliberately short: `Authorize → ValidateProto → <one of these>`,
|
|
9
|
-
*
|
|
8
|
+
* deliberately short: `Authorize → ValidateProto → <one of these>`, with
|
|
9
|
+
* only the owner steps (the last section) before the write on the three
|
|
10
|
+
* caller lanes, so the pipeline executor's fault mapping (a step's ConnectError keeps its code;
|
|
10
11
|
* a raw store fault becomes the sanitized INTERNAL) covers the path's two
|
|
11
12
|
* error shapes with no second idiom in the handlers.
|
|
12
13
|
*
|
|
@@ -51,14 +52,41 @@
|
|
|
51
52
|
* exists and belongs to the resource's organization needs a read, which
|
|
52
53
|
* this synchronous step does not make: that is the
|
|
53
54
|
* `iam-policy-create:pre-side-effect-gate` slot's, spliced after it.
|
|
55
|
+
*
|
|
56
|
+
* Owner is assigned by owners. Every caller of the member lanes holds
|
|
57
|
+
* `can_grant_access` (admin) already, so an admin grants every role up to
|
|
58
|
+
* admin; a change that touches an organization's `owner` role also needs
|
|
59
|
+
* `can_assign_roles` there, which only its owners hold. Two steps carry it,
|
|
60
|
+
* on the caller lanes only (`create`, `delete`, `revokeOrgAccess`; never
|
|
61
|
+
* the bootstrap twins, whose platform-pipeline callers hold no
|
|
62
|
+
* organization role):
|
|
63
|
+
* - AuthorizeOwnerAssignment asks `can_assign_roles` when the spec grants
|
|
64
|
+
* or revokes `owner` on an organization, or when the account
|
|
65
|
+
* `revokeOrgAccess` removes holds it. It is Authorize's own evaluation
|
|
66
|
+
* (`authorizeResolvedResource`), so the `internal` caller skips it as it
|
|
67
|
+
* skips position 1;
|
|
68
|
+
* - KeepOneOwner refuses a revoke or a removal that would leave the
|
|
69
|
+
* organization with no owner. It is a product rule rather than
|
|
70
|
+
* authorization, so it is its own step. It skips `internal` too. The
|
|
71
|
+
* port has no transaction, so two owners removing each other at the
|
|
72
|
+
* same instant can both pass; each still needed `can_assign_roles`.
|
|
73
|
+
* Both read the organization's owner rows once per request
|
|
74
|
+
* (`organizationOwners`). They do not govern the grants that follow
|
|
75
|
+
* configuration rather than a caller (the organization creator's row, the
|
|
76
|
+
* membership rules, the trusted-local operator), which call the grant path
|
|
77
|
+
* directly, nor an edition's in-process doors that grant a role on a
|
|
78
|
+
* person's behalf (an invitation's redemption, an identity provider's
|
|
79
|
+
* auto-grant), which run as `internal` and hold the same rule at their own
|
|
80
|
+
* sites.
|
|
54
81
|
*/
|
|
55
82
|
import { create } from "@bufbuild/protobuf";
|
|
56
83
|
import { Code, ConnectError } from "@connectrpc/connect";
|
|
57
84
|
import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
|
|
58
85
|
import { IamPolicySchema } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/api_pb";
|
|
59
|
-
import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
|
|
86
|
+
import { IamPermission, IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
|
|
60
87
|
import { grantableRolesFor, kindEnumName, teamGrantableRolesFor, } from "../../pipeline/apiresource-meta.js";
|
|
61
|
-
import {
|
|
88
|
+
import { authorizeResolvedResource } from "../../pipeline/steps/authorize.js";
|
|
89
|
+
import { LAST_OWNER_MESSAGE, OWNER_ASSIGNMENT_DENIED_MESSAGE, PER_RESOURCE_GRANTS_UNIMPLEMENTED_MESSAGE, TEAM_MEMBERS_RELATION, noGrantableRolesMessage, personQualifierMessage, principalNotGrantableMessage, roleNotGrantableMessage, teamNotGrantableMessage, teamQualifierMessage, teamRoleNotGrantableMessage, } from "./constants.js";
|
|
62
90
|
import { requireKnownPrincipalKind, requireKnownResourceKind, } from "./wire-refusals.js";
|
|
63
91
|
/** The row a write chain answers — the granted row, or the revoked row (the default instance when there was none). */
|
|
64
92
|
export const POLICY_RESULT_KEY = "policyResult";
|
|
@@ -156,4 +184,91 @@ export function newCleanupResourceStep(grantPath) {
|
|
|
156
184
|
},
|
|
157
185
|
};
|
|
158
186
|
}
|
|
187
|
+
// ---------------------------------------------------------------------------
|
|
188
|
+
// Owner is assigned by owners (the module header's last section)
|
|
189
|
+
// ---------------------------------------------------------------------------
|
|
190
|
+
/** The wire names the two owner steps compare against. */
|
|
191
|
+
const ORGANIZATION_KIND_NAME = kindEnumName(ApiResourceKind.organization);
|
|
192
|
+
const IDENTITY_ACCOUNT_KIND_NAME = kindEnumName(ApiResourceKind.identity_account);
|
|
193
|
+
const OWNER_RELATION = IamRole[IamRole.owner];
|
|
194
|
+
/** The context key the organization's owner rows are kept under for the rest of the request. */
|
|
195
|
+
const ORGANIZATION_OWNERS_KEY = "organizationOwners";
|
|
196
|
+
/**
|
|
197
|
+
* The ids of the people holding `owner` on the organization, read once per
|
|
198
|
+
* request and shared by both owner steps: the organization's `owner` rows
|
|
199
|
+
* whose principal is a person, the only principal the model admits there.
|
|
200
|
+
*/
|
|
201
|
+
async function organizationOwners(ctx, policies, organizationId) {
|
|
202
|
+
const held = ctx.get(ORGANIZATION_OWNERS_KEY);
|
|
203
|
+
if (held instanceof Set) {
|
|
204
|
+
return held;
|
|
205
|
+
}
|
|
206
|
+
const rows = await policies.findByResourceWithRelations(ORGANIZATION_KIND_NAME, organizationId, [OWNER_RELATION]);
|
|
207
|
+
const owners = new Set(rows
|
|
208
|
+
.map((row) => row.spec?.principal)
|
|
209
|
+
.filter((principal) => principal?.kind === IDENTITY_ACCOUNT_KIND_NAME)
|
|
210
|
+
.map((principal) => principal?.id ?? ""));
|
|
211
|
+
ctx.set(ORGANIZATION_OWNERS_KEY, owners);
|
|
212
|
+
return owners;
|
|
213
|
+
}
|
|
214
|
+
/** `create` and `delete`: the spec names the change; nothing is read. */
|
|
215
|
+
export function specOwnerRoleChange(ctx) {
|
|
216
|
+
const { resource, principal, relation } = ctx.input;
|
|
217
|
+
if (resource?.kind !== ORGANIZATION_KIND_NAME || relation !== OWNER_RELATION) {
|
|
218
|
+
return Promise.resolve(undefined);
|
|
219
|
+
}
|
|
220
|
+
return Promise.resolve({
|
|
221
|
+
organizationId: resource.id,
|
|
222
|
+
accountId: principal?.id ?? "",
|
|
223
|
+
});
|
|
224
|
+
}
|
|
225
|
+
/** `revokeOrgAccess`: the removal touches owner exactly when the account holds it. */
|
|
226
|
+
export function orgAccessOwnerRoleChange(policies) {
|
|
227
|
+
return async (ctx) => {
|
|
228
|
+
const { identityAccountId, organizationId } = ctx.input;
|
|
229
|
+
const owners = await organizationOwners(ctx, policies, organizationId);
|
|
230
|
+
return owners.has(identityAccountId)
|
|
231
|
+
? { organizationId, accountId: identityAccountId }
|
|
232
|
+
: undefined;
|
|
233
|
+
};
|
|
234
|
+
}
|
|
235
|
+
/** A change touching an organization's owner role needs `can_assign_roles` there; see the module header. */
|
|
236
|
+
export function newAuthorizeOwnerAssignmentStep(authorizer, ownerRoleChange) {
|
|
237
|
+
return {
|
|
238
|
+
name: "AuthorizeOwnerAssignment",
|
|
239
|
+
async execute(ctx) {
|
|
240
|
+
if (ctx.callerIdentity.callerClass === "internal") {
|
|
241
|
+
return;
|
|
242
|
+
}
|
|
243
|
+
const change = await ownerRoleChange(ctx);
|
|
244
|
+
if (change === undefined) {
|
|
245
|
+
return;
|
|
246
|
+
}
|
|
247
|
+
await authorizeResolvedResource(authorizer, ctx.callerIdentity, {
|
|
248
|
+
permission: IamPermission.can_assign_roles,
|
|
249
|
+
resourceKind: ApiResourceKind.organization,
|
|
250
|
+
resourceId: change.organizationId,
|
|
251
|
+
}, OWNER_ASSIGNMENT_DENIED_MESSAGE);
|
|
252
|
+
},
|
|
253
|
+
};
|
|
254
|
+
}
|
|
255
|
+
/** A revoke or removal may not leave the organization with no owner; see the module header. */
|
|
256
|
+
export function newKeepOneOwnerStep(policies, ownerRoleChange) {
|
|
257
|
+
return {
|
|
258
|
+
name: "KeepOneOwner",
|
|
259
|
+
async execute(ctx) {
|
|
260
|
+
if (ctx.callerIdentity.callerClass === "internal") {
|
|
261
|
+
return;
|
|
262
|
+
}
|
|
263
|
+
const change = await ownerRoleChange(ctx);
|
|
264
|
+
if (change === undefined) {
|
|
265
|
+
return;
|
|
266
|
+
}
|
|
267
|
+
const owners = await organizationOwners(ctx, policies, change.organizationId);
|
|
268
|
+
if (owners.has(change.accountId) && owners.size === 1) {
|
|
269
|
+
throw new ConnectError(LAST_OWNER_MESSAGE, Code.FailedPrecondition);
|
|
270
|
+
}
|
|
271
|
+
},
|
|
272
|
+
};
|
|
273
|
+
}
|
|
159
274
|
//# sourceMappingURL=steps.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"steps.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/steps.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"steps.js","sourceRoot":"","sources":["../../../src/domain/iampolicy/steps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgFG;AACH,OAAO,EAAE,MAAM,EAAoB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,eAAe,EAAE,MAAM,oDAAoD,CAAC;AAOrF,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AAInF,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,qBAAqB,GACtB,MAAM,oCAAoC,CAAC;AAG5C,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EACL,kBAAkB,EAClB,+BAA+B,EAC/B,yCAAyC,EACzC,qBAAqB,EACrB,uBAAuB,EACvB,sBAAsB,EACtB,4BAA4B,EAC5B,uBAAuB,EACvB,uBAAuB,EACvB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,oBAAoB,CAAC;AAE5B,sHAAsH;AACtH,MAAM,CAAC,MAAM,iBAAiB,GAAG,cAAc,CAAC;AAEhD,gFAAgF;AAChF,MAAM,UAAU,4BAA4B,CAC1C,KAAuB;IAEvB,OAAO;QACL,IAAI,EAAE,uBAAuB;QAC7B,OAAO,CAAC,GAA+C;YACrD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC;YACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC;YAC3C,MAAM,IAAI,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAC;YAChD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,YAAY,CACpB,uBAAuB,CAAC,QAAQ,CAAC,EACjC,IAAI,CAAC,eAAe,CACrB,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;YACnD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,YAAY,CACpB,yCAAyC,EACzC,IAAI,CAAC,aAAa,CACnB,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;YACjC,IAAI,SAAS,EAAE,IAAI,KAAK,cAAc,EAAE,CAAC;gBACvC,gBAAgB,CACd,IAAI,CAAC,QAAQ,EACb,SAAS,CAAC,QAAQ,EAClB,IAAI,EACJ,QAAQ,EACR,MAAM,CACP,CAAC;gBACF,OAAO;YACT,CAAC;YACD,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9D,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC/D,MAAM,IAAI,YAAY,CACpB,uBAAuB,CACrB,IAAI,CAAC,QAAQ,EACb,QAAQ,EACR,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CACvC,EACD,IAAI,CAAC,eAAe,CACrB,CAAC;YACJ,CAAC;YACD,MAAM,iBAAiB,GAAG,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC;YAChD,MAAM,aAAa,GAAG,yBAAyB,CAAC,iBAAiB,CAAC,CAAC;YACnE,IAAI,aAAa,KAAK,eAAe,CAAC,gBAAgB,EAAE,CAAC;gBACvD,MAAM,IAAI,YAAY,CACpB,4BAA4B,CAAC,iBAAiB,CAAC,EAC/C,IAAI,CAAC,eAAe,CACrB,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GAAG,SAAS,EAAE,QAAQ,IAAI,EAAE,CAAC;YAC5C,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;gBACrB,MAAM,IAAI,YAAY,CACpB,sBAAsB,CAAC,SAAS,CAAC,EACjC,IAAI,CAAC,eAAe,CACrB,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,cAAc,GAAG,YAAY,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;AAE1D;;;GAGG;AACH,SAAS,gBAAgB,CACvB,IAAY,EACZ,SAAiB,EACjB,IAAqB,EACrB,QAAgB,EAChB,MAA4B;IAE5B,MAAM,aAAa,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAC7D,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CACd,CAAC;IACF,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,YAAY,CACpB,uBAAuB,CAAC,QAAQ,CAAC,EACjC,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,YAAY,CACpB,2BAA2B,CACzB,IAAI,EACJ,QAAQ,EACR,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CACrC,EACD,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,KAAK,qBAAqB,EAAE,CAAC;QACxC,MAAM,IAAI,YAAY,CACpB,oBAAoB,CAAC,SAAS,CAAC,EAC/B,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,YAAY,CAC1B,SAA6B;IAE7B,OAAO;QACL,IAAI,EAAE,OAAO;QACb,KAAK,CAAC,OAAO,CACX,GAA+C;YAE/C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;YACxE,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QACrC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,aAAa,CAC3B,SAA6B;IAE7B,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,KAAK,CAAC,OAAO,CACX,GAA+C;YAE/C,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACxD,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,OAAO,IAAI,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;QACjE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,sBAAsB,CACpC,SAA6B;IAE7B,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,OAAO,CACL,GAAsD;YAEtD,OAAO,SAAS,CAAC,eAAe,CAC9B,GAAG,CAAC,KAAK,CAAC,iBAAiB,EAC3B,GAAG,CAAC,KAAK,CAAC,cAAc,CACzB,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,sBAAsB,CACpC,SAA6B;IAE7B,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,OAAO,CAAC,GAAgD;YACtD,MAAM,GAAG,GAAmB,GAAG,CAAC,KAAK,CAAC;YACtC,OAAO,SAAS,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,iEAAiE;AACjE,8EAA8E;AAE9E,0DAA0D;AAC1D,MAAM,sBAAsB,GAAG,YAAY,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;AAC1E,MAAM,0BAA0B,GAAG,YAAY,CAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC;AAClF,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAE9C,gGAAgG;AAChG,MAAM,uBAAuB,GAAG,oBAAoB,CAAC;AAQrD;;;;GAIG;AACH,KAAK,UAAU,kBAAkB,CAC/B,GAAyB,EACzB,QAAwB,EACxB,cAAsB;IAEtB,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IAC9C,IAAI,IAAI,YAAY,GAAG,EAAE,CAAC;QACxB,OAAO,IAA2B,CAAC;IACrC,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,2BAA2B,CACrD,sBAAsB,EACtB,cAAc,EACd,CAAC,cAAc,CAAC,CACjB,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,IAAI;SACD,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC;SACjC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,IAAI,KAAK,0BAA0B,CAAC;SACrE,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,CAC3C,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACzC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,mBAAmB,CACjC,GAA+C;IAE/C,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC;IACpD,IAAI,QAAQ,EAAE,IAAI,KAAK,sBAAsB,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;QAC7E,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,OAAO,CAAC,OAAO,CAAC;QACrB,cAAc,EAAE,QAAQ,CAAC,EAAE;QAC3B,SAAS,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE;KAC/B,CAAC,CAAC;AACL,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,wBAAwB,CACtC,QAAwB;IAIxB,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,MAAM,EAAE,iBAAiB,EAAE,cAAc,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC;QACxD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;QACvE,OAAO,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC;YAClC,CAAC,CAAC,EAAE,cAAc,EAAE,SAAS,EAAE,iBAAiB,EAAE;YAClD,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAED,4GAA4G;AAC5G,MAAM,UAAU,+BAA+B,CAC7C,UAAsB,EACtB,eAAoF;IAEpF,OAAO;QACL,IAAI,EAAE,0BAA0B;QAChC,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,IAAI,GAAG,CAAC,cAAc,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;gBAClD,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO;YACT,CAAC;YACD,MAAM,yBAAyB,CAC7B,UAAU,EACV,GAAG,CAAC,cAAc,EAClB;gBACE,UAAU,EAAE,aAAa,CAAC,gBAAgB;gBAC1C,YAAY,EAAE,eAAe,CAAC,YAAY;gBAC1C,UAAU,EAAE,MAAM,CAAC,cAAc;aAClC,EACD,+BAA+B,CAChC,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,mBAAmB,CACjC,QAAwB,EACxB,eAAoF;IAEpF,OAAO;QACL,IAAI,EAAE,cAAc;QACpB,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,IAAI,GAAG,CAAC,cAAc,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;gBAClD,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;YAC9E,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACtD,MAAM,IAAI,YAAY,CAAC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}
|
|
@@ -11,6 +11,11 @@
|
|
|
11
11
|
* sentences open source adds — a server that cannot mint, the guest
|
|
12
12
|
* method's edition refusal, the mismatched-account guard — follow the
|
|
13
13
|
* house style (single-quoted handles).
|
|
14
|
+
*
|
|
15
|
+
* One inherited sentence was changed on purpose: the expired-secret
|
|
16
|
+
* refusal told integrators to rotate, which never helps, because rotating
|
|
17
|
+
* leaves the expiry as it is (steps.ts, newRotateClientCredentialsStep).
|
|
18
|
+
* It now names the one fix and who can apply it (stigmer/stigmer#1254).
|
|
14
19
|
*/
|
|
15
20
|
/** The kind's name as the shared error constructors render it. */
|
|
16
21
|
export declare const PLATFORM_CLIENT_KIND_NAME = "PlatformClient";
|
|
@@ -43,7 +48,12 @@ export type SystemManagedMutation = "updated" | "deleted" | "rotated";
|
|
|
43
48
|
export declare function systemManagedMessage(verb: SystemManagedMutation): string;
|
|
44
49
|
export declare function referenceNotFoundMessage(org: string, slug: string): string;
|
|
45
50
|
export declare const INVALID_CLIENT_CREDENTIALS_MESSAGE = "Invalid client_id or client_secret";
|
|
46
|
-
|
|
51
|
+
/**
|
|
52
|
+
* The mint's refusal for a client whose expires_at has passed. Rotating
|
|
53
|
+
* does not extend the expiry, and both update and rotateSecret need the
|
|
54
|
+
* client's owner (can_edit), so the sentence names the owner's fix.
|
|
55
|
+
*/
|
|
56
|
+
export declare const EXPIRED_CLIENT_SECRET_MESSAGE = "PlatformClient secret has expired. Rotating the secret does not extend it; the client's owner must set a later expires_at or set never_expires.";
|
|
47
57
|
export declare function organizationMismatchMessage(owningOrg: string): string;
|
|
48
58
|
export declare function noAccountMessage(externalUserId: string, org: string): string;
|
|
49
59
|
export declare const OWNER_AUTO_GRANT_MESSAGE = "auto_grant_role cannot be 'owner'; organization ownership must be assigned explicitly.";
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/domain/platformclient/constants.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/domain/platformclient/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,kEAAkE;AAClE,eAAO,MAAM,yBAAyB,mBAAmB,CAAC;AAE1D;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,wBAAwB,CAAC;AAE9D;;;GAGG;AACH,eAAO,MAAM,8BAA8B,EAAE,WAAW,CAAC,MAAM,CAE7D,CAAC;AAEH,8EAA8E;AAC9E,eAAO,MAAM,iBAAiB;;;;;;;CAOpB,CAAC;AAEX,sCAAsC;AACtC,eAAO,MAAM,iBAAiB,WAAW,CAAC;AAE1C,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,2DAA2D;AAC3D,MAAM,MAAM,qBAAqB,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAEtE,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,qBAAqB,GAAG,MAAM,CAExE;AAED,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE1E;AAED,eAAO,MAAM,kCAAkC,uCACT,CAAC;AAEvC;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,oJACyG,CAAC;AAEpJ,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAErE;AAED,wBAAgB,gBAAgB,CAAC,cAAc,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE5E;AAED,eAAO,MAAM,wBAAwB,2FACqD,CAAC;AAE3F,eAAO,MAAM,2BAA2B,mGAC0D,CAAC;AAEnG,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,KAAK,GAAG,gBAAgB,GAC7B,MAAM,CAER;AAED,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,KAAK,GAAG,gBAAgB,EAC9B,KAAK,EAAE,MAAM,GACZ,MAAM,CAER;AAED,wBAAgB,qBAAqB,CACnC,cAAc,EAAE,MAAM,EACtB,GAAG,EAAE,MAAM,GACV,MAAM,CAER;AAED,eAAO,MAAM,uCAAuC,2OACiL,CAAC;AAEtO,eAAO,MAAM,wBAAwB,0FACoD,CAAC;AAE1F,eAAO,MAAM,gCAAgC,oIACsF,CAAC;AAEpI,eAAO,MAAM,6BAA6B,4CACC,CAAC;AAE5C,eAAO,MAAM,sBAAsB,2JACuH,CAAC;AAE3J,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE3D"}
|
|
@@ -11,6 +11,11 @@
|
|
|
11
11
|
* sentences open source adds — a server that cannot mint, the guest
|
|
12
12
|
* method's edition refusal, the mismatched-account guard — follow the
|
|
13
13
|
* house style (single-quoted handles).
|
|
14
|
+
*
|
|
15
|
+
* One inherited sentence was changed on purpose: the expired-secret
|
|
16
|
+
* refusal told integrators to rotate, which never helps, because rotating
|
|
17
|
+
* leaves the expiry as it is (steps.ts, newRotateClientCredentialsStep).
|
|
18
|
+
* It now names the one fix and who can apply it (stigmer/stigmer#1254).
|
|
14
19
|
*/
|
|
15
20
|
/** The kind's name as the shared error constructors render it. */
|
|
16
21
|
export const PLATFORM_CLIENT_KIND_NAME = "PlatformClient";
|
|
@@ -49,7 +54,12 @@ export function referenceNotFoundMessage(org, slug) {
|
|
|
49
54
|
return `PlatformClient '${org}/${slug}' not found`;
|
|
50
55
|
}
|
|
51
56
|
export const INVALID_CLIENT_CREDENTIALS_MESSAGE = "Invalid client_id or client_secret";
|
|
52
|
-
|
|
57
|
+
/**
|
|
58
|
+
* The mint's refusal for a client whose expires_at has passed. Rotating
|
|
59
|
+
* does not extend the expiry, and both update and rotateSecret need the
|
|
60
|
+
* client's owner (can_edit), so the sentence names the owner's fix.
|
|
61
|
+
*/
|
|
62
|
+
export const EXPIRED_CLIENT_SECRET_MESSAGE = "PlatformClient secret has expired. Rotating the secret does not extend it; the client's owner must set a later expires_at or set never_expires.";
|
|
53
63
|
export function organizationMismatchMessage(owningOrg) {
|
|
54
64
|
return `org_id must be empty or the PlatformClient's owning organization ('${owningOrg}'); cross-organization minting is not supported`;
|
|
55
65
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../src/domain/platformclient/constants.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../src/domain/platformclient/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,kEAAkE;AAClE,MAAM,CAAC,MAAM,yBAAyB,GAAG,gBAAgB,CAAC;AAE1D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,qBAAqB,CAAC;AAE9D;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAwB,IAAI,GAAG,CAAC;IACzE,wBAAwB;CACzB,CAAC,CAAC;AAEH,8EAA8E;AAC9E,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,OAAO,EAAE,KAAK;IACd,cAAc,EAAE,aAAa;IAC7B,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,MAAM;IACZ,GAAG,EAAE,KAAK;IACV,gBAAgB,EAAE,oBAAoB;CAC9B,CAAC;AAEX,sCAAsC;AACtC,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AAE1C,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,aAAa,IAAI,sNAAsN,CAAC;AACjP,CAAC;AAKD,MAAM,UAAU,oBAAoB,CAAC,IAA2B;IAC9D,OAAO,wDAAwD,IAAI,EAAE,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,GAAW,EAAE,IAAY;IAChE,OAAO,mBAAmB,GAAG,IAAI,IAAI,aAAa,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,MAAM,kCAAkC,GAC7C,oCAAoC,CAAC;AAEvC;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GACxC,iJAAiJ,CAAC;AAEpJ,MAAM,UAAU,2BAA2B,CAAC,SAAiB;IAC3D,OAAO,sEAAsE,SAAS,iDAAiD,CAAC;AAC1I,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,cAAsB,EAAE,GAAW;IAClE,OAAO,SAAS,cAAc,6CAA6C,GAAG,sFAAsF,CAAC;AACvK,CAAC;AAED,MAAM,CAAC,MAAM,wBAAwB,GACnC,wFAAwF,CAAC;AAE3F,MAAM,CAAC,MAAM,2BAA2B,GACtC,gGAAgG,CAAC;AAEnG,MAAM,UAAU,uBAAuB,CACrC,IAA8B;IAE9B,OAAO,GAAG,IAAI,4BAA4B,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,IAA8B,EAC9B,KAAa;IAEb,OAAO,GAAG,IAAI,kDAAkD,KAAK,EAAE,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,cAAsB,EACtB,GAAW;IAEX,OAAO,SAAS,cAAc,sBAAsB,GAAG,2FAA2F,CAAC;AACrJ,CAAC;AAED,MAAM,CAAC,MAAM,uCAAuC,GAClD,mOAAmO,CAAC;AAEtO,MAAM,CAAC,MAAM,wBAAwB,GACnC,uFAAuF,CAAC;AAE1F,MAAM,CAAC,MAAM,gCAAgC,GAC3C,iIAAiI,CAAC;AAEpI,MAAM,CAAC,MAAM,6BAA6B,GACxC,yCAAyC,CAAC;AAE5C,MAAM,CAAC,MAAM,sBAAsB,GACjC,wJAAwJ,CAAC;AAE3J,MAAM,UAAU,oBAAoB,CAAC,MAAc;IACjD,OAAO,mBAAmB,MAAM,iJAAiJ,CAAC;AACpL,CAAC"}
|