@sync-in/server 1.8.0 → 1.9.0

package/server/applications/users/services/users-manager.service.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../backend/src/applications/users/services/users-manager.service.ts"],"sourcesContent":["/*\n * Copyright (C) 2012-2025 Johan Legrand <johan.legrand@sync-in.com>\n * This file is part of Sync-in | The open source file sync and share solution\n * See the LICENSE file for licensing details\n */\n\nimport { MultipartFile } from '@fastify/multipart'\nimport { HttpException, HttpStatus, Injectable, Logger } from '@nestjs/common'\nimport bcrypt from 'bcryptjs'\nimport { WriteStream } from 'fs'\nimport { createWriteStream } from 'node:fs'\nimport path from 'node:path'\nimport { Readable } from 'node:stream'\nimport { pipeline } from 'node:stream/promises'\nimport { AUTH_SCOPE } from '../../../authentication/constants/scope'\nimport { LoginResponseDto } from '../../../authentication/dto/login-response.dto'\nimport { FastifyAuthenticatedRequest } from '../../../authentication/interfaces/auth-request.interface'\nimport { JwtIdentityPayload } from '../../../authentication/interfaces/jwt-payload.interface'\nimport { ACTION } from '../../../common/constants'\nimport { comparePassword, hashPassword } from '../../../common/functions'\nimport { generateAvatar, pngMimeType, svgMimeType } from '../../../common/image'\nimport { createLightSlug, genPassword } from '../../../common/shared'\nimport { configuration, serverConfig } from '../../../configuration/config.environment'\nimport { isPathExists, moveFiles } from '../../files/utils/files'\nimport { NOTIFICATION_APP, NOTIFICATION_APP_EVENT } from '../../notifications/constants/notifications'\nimport { NotificationsManager } from '../../notifications/services/notifications-manager.service'\nimport { MEMBER_TYPE } from '../constants/member'\nimport { USER_GROUP_ROLE, USER_MAX_PASSWORD_ATTEMPTS, USER_ONLINE_STATUS, USER_ROLE } from '../constants/user'\nimport type { UserCreateOrUpdateGroupDto } from '../dto/create-or-update-group.dto'\nimport type { CreateUserDto, UpdateUserDto, UpdateUserFromGroupDto } from '../dto/create-or-update-user.dto'\nimport type { SearchMembersDto } from '../dto/search-members.dto'\nimport type {\n  UserAppPasswordDto,\n  UserLanguageDto,\n  UserNotificationDto,\n  UserStorageIndexingDto,\n  UserUpdatePasswordDto\n} from '../dto/user-properties.dto'\nimport type { GroupBrowse } from '../interfaces/group-browse.interface'\nimport type { GroupMember, GroupWithMembers } from '../interfaces/group-member'\nimport type { GuestUser } from '../interfaces/guest-user.interface'\nimport type { Member } from '../interfaces/member.interface'\nimport type { UserAppPassword, UserSecrets } from '../interfaces/user-secrets.interface'\nimport type { UserOnline } from '../interfaces/websocket.interface'\nimport { UserModel } from '../models/user.model'\nimport type { Group } from '../schemas/group.interface'\nimport type { UserGroup } from '../schemas/user-group.interface'\nimport type { User } from '../schemas/user.interface'\nimport { USER_AVATAR_FILE_NAME, USER_AVATAR_MAX_UPLOAD_SIZE, USER_DEFAULT_AVATAR_FILE_PATH } from '../utils/avatar'\nimport { AdminUsersManager } from './admin-users-manager.service'\nimport { UsersQueries } from './users-queries.service'\n\n@Injectable()\nexport class UsersManager {\n  private readonly logger = new Logger(UsersManager.name)\n\n  constructor(\n    public readonly usersQueries: UsersQueries,\n    private readonly adminUsersManager: AdminUsersManager,\n    private readonly notificationsManager: NotificationsManager\n  ) {}\n\n  async fromUserId(id: number): Promise<UserModel> {\n    const user: User = await this.usersQueries.from(id)\n    return user ? new UserModel(user, true) : null\n  }\n\n  async findUser(loginOrEmail: string, removePassword: false): Promise<UserModel>\n  async findUser(loginOrEmail: string, removePassword?: true): Promise<Omit<UserModel, 'password'>>\n  async findUser(loginOrEmail: string, removePassword: boolean = true): Promise<Omit<UserModel, 'password'>> {\n    const user: User = await this.usersQueries.from(null, loginOrEmail)\n    return user ? new UserModel(user, removePassword) : null\n  }\n\n  async logUser(user: UserModel, password: string, ip: string, scope?: AUTH_SCOPE): Promise<UserModel> {\n    this.validateUserAccess(user, ip)\n    let authSuccess: boolean = await comparePassword(password, user.password)\n    if (!authSuccess && scope) {\n      authSuccess = await this.validateAppPassword(user, password, ip, scope)\n    }\n    this.updateAccesses(user, ip, authSuccess).catch((e: Error) => this.logger.error(`${this.logUser.name} - ${e}`))\n    if (authSuccess) {\n      await user.makePaths()\n      return user\n    }\n    this.logger.warn(`${this.logUser.name} - bad password for *${user.login}*`)\n    return null\n  }\n\n  validateUserAccess(user: UserModel, ip: string) {\n    if (user.role === USER_ROLE.LINK) {\n      this.logger.error(`${this.validateUserAccess.name} - guest link account ${user} is not authorized to login`)\n      throw new HttpException('Account is not allowed', HttpStatus.FORBIDDEN)\n    }\n    if (!user.isActive || user.passwordAttempts >= USER_MAX_PASSWORD_ATTEMPTS) {\n      this.updateAccesses(user, ip, false).catch((e: Error) => this.logger.error(`${this.validateUserAccess.name} - ${e}`))\n      this.logger.error(`${this.validateUserAccess.name} - user account *${user.login}* is locked`)\n      this.notifyAccountLocked(user, ip)\n      throw new HttpException('Account locked', HttpStatus.FORBIDDEN)\n    }\n  }\n\n  async me(authUser: UserModel): Promise<Omit<LoginResponseDto, 'token'>> {\n    const user = await this.fromUserId(authUser.id)\n    if (!user) {\n      this.logger.warn(`User *${authUser.login} (${authUser.id}) not found`)\n      throw new HttpException(`User not found`, HttpStatus.NOT_FOUND)\n    }\n    user.impersonated = !!authUser.impersonatedFromId\n    user.clientId = authUser.clientId\n    return { user: user, server: serverConfig }\n  }\n\n  async compareUserPassword(userId: number, password: string): Promise<boolean> {\n    return this.usersQueries.compareUserPassword(userId, password)\n  }\n\n  async updateLanguage(user: UserModel, userLanguageDto: UserLanguageDto) {\n    if (!userLanguageDto.language) userLanguageDto.language = null\n    if (!(await this.usersQueries.updateUserOrGuest(user.id, userLanguageDto))) {\n      throw new HttpException('Unable to update language', HttpStatus.INTERNAL_SERVER_ERROR)\n    }\n  }\n\n  async updatePassword(user: UserModel, userPasswordDto: UserUpdatePasswordDto) {\n    const r = await this.usersQueries.selectUserProperties(user.id, ['password'])\n    if (!r) {\n      throw new HttpException('Unable to check password', HttpStatus.NOT_FOUND)\n    }\n    if (!(await comparePassword(userPasswordDto.oldPassword, r.password))) {\n      throw new HttpException('Password mismatch', HttpStatus.BAD_REQUEST)\n    }\n    const hash = await bcrypt.hash(userPasswordDto.newPassword, 10)\n    if (!(await this.usersQueries.updateUserOrGuest(user.id, { password: hash }))) {\n      throw new HttpException('Unable to update password', HttpStatus.INTERNAL_SERVER_ERROR)\n    }\n  }\n\n  async updateNotification(user: UserModel, userNotificationDto: UserNotificationDto) {\n    if (!(await this.usersQueries.updateUserOrGuest(user.id, userNotificationDto))) {\n      throw new HttpException('Unable to update notification preference', HttpStatus.INTERNAL_SERVER_ERROR)\n    }\n  }\n\n  async updateStorageIndexing(user: UserModel, userStorageIndexingDto: UserStorageIndexingDto) {\n    if (!(await this.usersQueries.updateUserOrGuest(user.id, userStorageIndexingDto))) {\n      throw new HttpException('Unable to update full-text search preference', HttpStatus.INTERNAL_SERVER_ERROR)\n    }\n  }\n\n  async updateAvatar(req: FastifyAuthenticatedRequest) {\n    const part: MultipartFile = await req.file({ limits: { fileSize: USER_AVATAR_MAX_UPLOAD_SIZE } })\n    if (!part.mimetype.startsWith('image/')) {\n      throw new HttpException('Unsupported file type', HttpStatus.BAD_REQUEST)\n    }\n    const dstPath = path.join(req.user.tmpPath, USER_AVATAR_FILE_NAME)\n    try {\n      await pipeline(part.file, createWriteStream(dstPath))\n    } catch (e) {\n      this.logger.error(`${this.updateAvatar.name} - ${e}`)\n      throw new HttpException('Unable to upload avatar', HttpStatus.INTERNAL_SERVER_ERROR)\n    }\n    if (part.file.truncated) {\n      this.logger.warn(`${this.updateAvatar.name} - image is too large`)\n      throw new HttpException('Image is too large (5MB max)', HttpStatus.PAYLOAD_TOO_LARGE)\n    }\n    try {\n      await moveFiles(dstPath, path.join(req.user.homePath, USER_AVATAR_FILE_NAME), true)\n    } catch (e) {\n      this.logger.error(`${this.updateAvatar.name} - ${e}`)\n      throw new HttpException('Unable to create avatar', HttpStatus.INTERNAL_SERVER_ERROR)\n    }\n  }\n\n  async updateSecrets(userId: number, secrets: UserSecrets) {\n    const userSecrets = await this.usersQueries.getUserSecrets(userId)\n    const updatedSecrets = { ...userSecrets, ...secrets }\n    if (!(await this.usersQueries.updateUserOrGuest(userId, { secrets: updatedSecrets }))) {\n      throw new HttpException('Unable to update secrets', HttpStatus.INTERNAL_SERVER_ERROR)\n    }\n  }\n\n  async updateAccesses(user: UserModel, ip: string, success: boolean, isAuthTwoFa = false) {\n    let passwordAttempts: number\n    if (!isAuthTwoFa && configuration.auth.mfa.totp.enabled && user.twoFaEnabled) {\n      // Do not reset password attempts if the login still requires 2FA validation\n      passwordAttempts = user.passwordAttempts\n    } else {\n      passwordAttempts = success ? 0 : Math.min(user.passwordAttempts + 1, USER_MAX_PASSWORD_ATTEMPTS)\n    }\n    await this.usersQueries.updateUserOrGuest(user.id, {\n      lastAccess: user.currentAccess,\n      currentAccess: new Date(),\n      lastIp: user.currentIp,\n      currentIp: ip,\n      passwordAttempts: passwordAttempts,\n      isActive: user.isActive && passwordAttempts < USER_MAX_PASSWORD_ATTEMPTS\n    })\n  }\n\n  async getAvatar(userLogin: string, generate: true, generateIsNotExists?: boolean): Promise<undefined>\n  async getAvatar(userLogin: string, generate?: false, generateIsNotExists?: boolean): Promise<[path: string, mime: string]>\n  async getAvatar(userLogin: string, generate: boolean = false, generateIsNotExists?: boolean): Promise<[path: string, mime: string]> {\n    const avatarPath = path.join(UserModel.getHomePath(userLogin), USER_AVATAR_FILE_NAME)\n    const avatarExists = await isPathExists(avatarPath)\n    if (!avatarExists && generateIsNotExists) {\n      generate = true\n    }\n    if (!generate) {\n      return [avatarExists ? avatarPath : USER_DEFAULT_AVATAR_FILE_PATH, avatarExists ? pngMimeType : svgMimeType]\n    }\n    if (!(await isPathExists(UserModel.getHomePath(userLogin)))) {\n      throw new HttpException(`Home path for user *${userLogin}* does not exist`, HttpStatus.FORBIDDEN)\n    }\n    const user: Partial<UserModel> = await this.findUser(userLogin)\n    if (!user) {\n      throw new HttpException(`avatar not found`, HttpStatus.NOT_FOUND)\n    }\n    const avatarFile: WriteStream = createWriteStream(avatarPath)\n    const avatarStream = Readable.from(await generateAvatar(user.getInitials()))\n    try {\n      await pipeline(avatarStream, avatarFile)\n    } catch (e) {\n      this.logger.error(`${this.updateAvatar.name} - ${e}`)\n      throw new HttpException('Unable to create avatar', HttpStatus.INTERNAL_SERVER_ERROR)\n    }\n    if (generateIsNotExists) {\n      return [avatarPath, pngMimeType]\n    }\n  }\n\n  async listAppPasswords(user: UserModel): Promise<Omit<UserAppPassword, 'password'>[]> {\n    const secrets = await this.usersQueries.getUserSecrets(user.id)\n    if (Array.isArray(secrets.appPasswords)) {\n      // remove passwords from response\n      return secrets.appPasswords.map(({ password, ...rest }: UserAppPassword) => rest)\n    }\n    return []\n  }\n\n  async generateAppPassword(user: UserModel, userAppPasswordDto: UserAppPasswordDto): Promise<UserAppPassword> {\n    const secrets = await this.usersQueries.getUserSecrets(user.id)\n    const slugName = createLightSlug(userAppPasswordDto.name)\n    if (Array.isArray(secrets.appPasswords) && secrets.appPasswords.find((p: UserAppPassword) => p.name === slugName)) {\n      throw new HttpException('Name already used', HttpStatus.BAD_REQUEST)\n    }\n    secrets.appPasswords = Array.isArray(secrets.appPasswords) ? secrets.appPasswords : []\n    const clearPassword = genPassword(24)\n    const appPassword: UserAppPassword = {\n      name: createLightSlug(userAppPasswordDto.name),\n      app: userAppPasswordDto.app,\n      expiration: userAppPasswordDto.expiration,\n      password: await hashPassword(clearPassword),\n      createdAt: new Date(),\n      currentIp: null,\n      currentAccess: null,\n      lastIp: null,\n      lastAccess: null\n    }\n    secrets.appPasswords.unshift(appPassword)\n    if (!(await this.usersQueries.updateUserOrGuest(user.id, { secrets: secrets }))) {\n      throw new HttpException('Unable to update app passwords', HttpStatus.INTERNAL_SERVER_ERROR)\n    }\n    // return clear password only once\n    return { ...appPassword, password: clearPassword }\n  }\n\n  async deleteAppPassword(user: UserModel, passwordName: string): Promise<void> {\n    const secrets = await this.usersQueries.getUserSecrets(user.id)\n    if (!Array.isArray(secrets.appPasswords) || !secrets.appPasswords.find((p: UserAppPassword) => p.name === passwordName)) {\n      throw new HttpException('App password not found', HttpStatus.NOT_FOUND)\n    }\n    secrets.appPasswords = secrets.appPasswords.filter((p: UserAppPassword) => p.name !== passwordName)\n    if (!(await this.usersQueries.updateUserOrGuest(user.id, { secrets: secrets }))) {\n      throw new HttpException('Unable to delete app password', HttpStatus.INTERNAL_SERVER_ERROR)\n    }\n  }\n\n  async validateAppPassword(user: UserModel, password: string, ip: string, scope: AUTH_SCOPE): Promise<boolean> {\n    if (!scope || !user.haveRole(USER_ROLE.USER)) return false\n    const secrets = await this.usersQueries.getUserSecrets(user.id)\n    if (!Array.isArray(secrets.appPasswords)) return false\n    for (const p of secrets.appPasswords) {\n      if (p.app !== scope) continue\n      const expMs = p.expiration ? new Date(p.expiration) : null\n      if (p.expiration && new Date() > expMs) continue // expired\n      if (await comparePassword(password, p.password)) {\n        p.lastAccess = p.currentAccess\n        p.currentAccess = new Date()\n        p.lastIp = p.currentIp\n        p.currentIp = ip\n        // update accesses\n        this.usersQueries\n          .updateUserOrGuest(user.id, { secrets: secrets })\n          .catch((e: Error) => this.logger.error(`${this.validateAppPassword.name} - ${e}`))\n        return true\n      }\n    }\n    return false\n  }\n\n  setOnlineStatus(user: JwtIdentityPayload, onlineStatus: USER_ONLINE_STATUS) {\n    this.usersQueries.setOnlineStatus(user.id, onlineStatus).catch((e: Error) => this.logger.error(`${this.setOnlineStatus.name} - ${e}`))\n  }\n\n  getOnlineUsers(userIds: number[]): Promise<UserOnline[]> {\n    return this.usersQueries.getOnlineUsers(userIds)\n  }\n\n  async usersWhitelist(userId: number): Promise<number[]> {\n    return this.usersQueries.usersWhitelist(userId)\n  }\n\n  async browseGroups(user: UserModel, name: string): Promise<GroupBrowse> {\n    if (name) {\n      const group: Pick<Group, 'id' | 'name' | 'type'> & { role: UserGroup['role'] } = await this.usersQueries.groupFromName(user.id, name)\n      if (!group) {\n        throw new HttpException('Group not found', HttpStatus.NOT_FOUND)\n      }\n      return { parentGroup: group, members: await this.usersQueries.browseGroupMembers(group.id) }\n    }\n    return { parentGroup: undefined, members: await this.usersQueries.browseRootGroups(user.id) }\n  }\n\n  async getGroup(user: UserModel, groupId: number, withMembers?: true, asAdmin?: boolean): Promise<GroupWithMembers>\n  async getGroup(user: UserModel, groupId: number, withMembers: false, asAdmin?: boolean): Promise<GroupMember>\n  async getGroup(user: UserModel, groupId: number, withMembers = true, asAdmin = false): Promise<GroupMember | GroupWithMembers> {\n    const group = withMembers\n      ? await this.usersQueries.getGroupWithMembers(user.id, groupId, asAdmin)\n      : await this.usersQueries.getGroup(user.id, groupId, asAdmin)\n    if (!group) {\n      throw new HttpException('You are not allowed to do this action', HttpStatus.FORBIDDEN)\n    }\n    return group\n  }\n\n  async createPersonalGroup(user: UserModel, userCreateOrUpdateGroupDto: UserCreateOrUpdateGroupDto): Promise<GroupMember> {\n    if (!userCreateOrUpdateGroupDto.name) {\n      this.logger.error(`${this.createPersonalGroup.name} - missing group name : ${JSON.stringify(userCreateOrUpdateGroupDto)}`)\n      throw new HttpException('Group name is missing', HttpStatus.BAD_REQUEST)\n    }\n    if (await this.usersQueries.checkGroupNameExists(userCreateOrUpdateGroupDto.name)) {\n      throw new HttpException('Name already used', HttpStatus.BAD_REQUEST)\n    }\n    try {\n      const groupId: number = await this.usersQueries.createPersonalGroup(user.id, userCreateOrUpdateGroupDto)\n      this.logger.log(`${this.createPersonalGroup.name} - group (${groupId}) was created : ${JSON.stringify(userCreateOrUpdateGroupDto)}`)\n      // clear user whitelists\n      this.usersQueries.clearWhiteListCaches([user.id])\n      return this.getGroup(user, groupId, false)\n    } catch (e) {\n      this.logger.error(`${this.createPersonalGroup.name} - group was not created : ${JSON.stringify(userCreateOrUpdateGroupDto)} : ${e}`)\n      throw new HttpException('Unable to create group', HttpStatus.INTERNAL_SERVER_ERROR)\n    }\n  }\n\n  async updatePersonalGroup(user: UserModel, groupId: number, userCreateOrUpdateGroupDto: UserCreateOrUpdateGroupDto): Promise<GroupMember> {\n    if (!Object.keys(userCreateOrUpdateGroupDto).length) {\n      throw new HttpException('No changes to update', HttpStatus.BAD_REQUEST)\n    }\n    const currentGroup: GroupMember = await this.getGroup(user, groupId, false, user.isAdmin)\n    if (currentGroup.type !== MEMBER_TYPE.PGROUP) {\n      throw new HttpException('You are not allowed to do this action', HttpStatus.FORBIDDEN)\n    }\n    if (userCreateOrUpdateGroupDto.name && (await this.usersQueries.checkGroupNameExists(userCreateOrUpdateGroupDto.name))) {\n      throw new HttpException('Name already used', HttpStatus.BAD_REQUEST)\n    }\n    try {\n      await this.usersQueries.updateGroup(groupId, userCreateOrUpdateGroupDto)\n    } catch (e) {\n      throw new HttpException(e.message, HttpStatus.INTERNAL_SERVER_ERROR)\n    }\n    return this.getGroup(user, groupId, false, user.isAdmin)\n  }\n\n  async addUsersToGroup(user: UserModel, groupId: number, userIds: number[]): Promise<void> {\n    const currentGroup: GroupWithMembers = await this.getGroup(user, groupId)\n    // only users can be added to users groups\n    // guests and users can be added to personal groups\n    const userWhiteList: number[] = await this.usersQueries.usersWhitelist(\n      user.id,\n      currentGroup.type === MEMBER_TYPE.GROUP ? USER_ROLE.USER : undefined\n    )\n    // ignore user ids that are already group members & filter on user ids allowed to current user\n    userIds = userIds.filter((id) => !currentGroup.members.find((m) => m.id === id)).filter((id) => userWhiteList.indexOf(id) > -1)\n    if (!userIds.length) {\n      throw new HttpException('No users to add to group', HttpStatus.BAD_REQUEST)\n    }\n    return this.usersQueries.updateGroupMembers(groupId, { add: userIds.map((id) => ({ id: id, groupRole: USER_GROUP_ROLE.MEMBER })) })\n  }\n\n  async updateUserFromPersonalGroup(user: UserModel, groupId: number, userId: number, updateUserFromGroupDto: UpdateUserFromGroupDto): Promise<void> {\n    const currentGroup: GroupWithMembers = await this.getGroup(user, groupId)\n    if (currentGroup.type !== MEMBER_TYPE.PGROUP) {\n      throw new HttpException('You are not allowed to do this action', HttpStatus.FORBIDDEN)\n    }\n    const userToUpdate = currentGroup.members.find((m) => m.id === userId)\n    if (!userToUpdate) {\n      throw new HttpException('User was not found', HttpStatus.BAD_REQUEST)\n    }\n    if (userToUpdate.groupRole !== updateUserFromGroupDto.role) {\n      if (userToUpdate.groupRole === USER_GROUP_ROLE.MANAGER) {\n        if (currentGroup.members.filter((m) => m.groupRole === USER_GROUP_ROLE.MANAGER).length === 1) {\n          throw new HttpException('Group must have at least one manager', HttpStatus.BAD_REQUEST)\n        }\n      }\n      return this.adminUsersManager.updateUserFromGroup(groupId, userId, updateUserFromGroupDto)\n    }\n  }\n\n  async removeUserFromGroup(user: UserModel, groupId: number, userId: number): Promise<void> {\n    const currentGroup: GroupWithMembers = await this.getGroup(user, groupId)\n    const userToRemove = currentGroup.members.find((m) => m.id === userId)\n    if (!userToRemove) {\n      throw new HttpException('User was not found', HttpStatus.BAD_REQUEST)\n    }\n    if (userToRemove.groupRole === USER_GROUP_ROLE.MANAGER) {\n      if (currentGroup.type === MEMBER_TYPE.GROUP) {\n        throw new HttpException('You are not allowed to do this action', HttpStatus.FORBIDDEN)\n      }\n      if (currentGroup.members.filter((m) => m.groupRole === USER_GROUP_ROLE.MANAGER).length === 1) {\n        throw new HttpException('Group must have at least one manager', HttpStatus.BAD_REQUEST)\n      }\n    }\n    return this.usersQueries.updateGroupMembers(groupId, { remove: [userId] })\n  }\n\n  async leavePersonalGroup(user: UserModel, groupId: number): Promise<void> {\n    const currentGroup: GroupWithMembers = await this.usersQueries.getGroupWithMembers(user.id, groupId, true)\n    if (!currentGroup || currentGroup.type === MEMBER_TYPE.GROUP) {\n      throw new HttpException('You are not allowed to do this action', HttpStatus.FORBIDDEN)\n    }\n    const userWhoLeaves = currentGroup.members.find((m) => m.id === user.id)\n    if (!userWhoLeaves) {\n      throw new HttpException('User was not found', HttpStatus.BAD_REQUEST)\n    }\n    if (userWhoLeaves.groupRole === USER_GROUP_ROLE.MANAGER) {\n      if (currentGroup.members.filter((m) => m.groupRole === USER_GROUP_ROLE.MANAGER).length === 1) {\n        throw new HttpException('Group must have at least one manager', HttpStatus.BAD_REQUEST)\n      }\n    }\n    try {\n      await this.usersQueries.updateGroupMembers(groupId, { remove: [user.id] })\n      this.logger.log(`${this.leavePersonalGroup.name} - user (${user.id}) has left group (${groupId})`)\n    } catch (e) {\n      this.logger.error(`${this.leavePersonalGroup.name} - user (${user.id}) has not left group (${groupId}) : ${e}`)\n      throw new HttpException(e.message, HttpStatus.INTERNAL_SERVER_ERROR)\n    }\n  }\n\n  async deletePersonalGroup(user: UserModel, groupId: number): Promise<void> {\n    if (!(await this.usersQueries.canDeletePersonalGroup(user.id, groupId))) {\n      throw new HttpException('You are not allowed to do this action', HttpStatus.FORBIDDEN)\n    }\n    if (await this.usersQueries.deletePersonalGroup(groupId)) {\n      this.logger.log(`${this.deletePersonalGroup.name} - group (${groupId}) was deleted`)\n    } else {\n      this.logger.warn(`${this.deletePersonalGroup.name} - group (${groupId}) does not exist`)\n      throw new HttpException('Unable to delete group', HttpStatus.BAD_REQUEST)\n    }\n  }\n\n  listGuests(user: UserModel): Promise<GuestUser[]> {\n    return this.usersQueries.listGuests(null, user.id)\n  }\n\n  async getGuest(user: UserModel, guestId: number): Promise<GuestUser> {\n    const guest: GuestUser = await this.usersQueries.listGuests(guestId, user.id)\n    this.adminUsersManager.checkUser(guest, true)\n    return guest\n  }\n\n  async createGuest(user: UserModel, createGuestDto: CreateUserDto): Promise<GuestUser> {\n    // filter managers that are allowed for current user\n    const userWhiteList = await this.usersQueries.usersWhitelist(user.id, USER_ROLE.USER)\n    createGuestDto.managers = createGuestDto.managers.filter((id) => userWhiteList.indexOf(id) > -1)\n    if (createGuestDto.managers.indexOf(user.id) === -1) {\n      // force user as manager during creation\n      createGuestDto.managers.push(user.id)\n    }\n    // clear user whitelists\n    this.usersQueries.clearWhiteListCaches([user.id])\n    return this.adminUsersManager.createUserOrGuest(createGuestDto, USER_ROLE.GUEST, true)\n  }\n\n  async updateGuest(user: UserModel, guestId: number, updateGuestDto: UpdateUserDto): Promise<GuestUser> {\n    if (!Object.keys(updateGuestDto).length) {\n      throw new HttpException('No changes to update', HttpStatus.BAD_REQUEST)\n    }\n    if (updateGuestDto.managers) {\n      // filter managers that are allowed for current user\n      const userWhiteList = await this.usersQueries.usersWhitelist(user.id, USER_ROLE.USER)\n      updateGuestDto.managers = updateGuestDto.managers.filter((id) => userWhiteList.indexOf(id) > -1)\n      if (!updateGuestDto.managers.length) {\n        throw new HttpException('Guest must have at least one manager', HttpStatus.BAD_REQUEST)\n      }\n    }\n    if (!(await this.usersQueries.isGuestManager(user.id, guestId))) {\n      throw new HttpException('You are not allowed to do this action', HttpStatus.FORBIDDEN)\n    }\n    const guest = await this.adminUsersManager.updateUserOrGuest(guestId, updateGuestDto, USER_ROLE.GUEST)\n    return guest.managers.find((m) => m.id === user.id) ? guest : null\n  }\n\n  async deleteGuest(user: UserModel, guestId: number): Promise<void> {\n    const guest = await this.usersQueries.isGuestManager(user.id, guestId)\n    if (!guest) {\n      throw new HttpException('You are not allowed to do this action', HttpStatus.FORBIDDEN)\n    }\n    // guest has no space but a temporary directory\n    return this.adminUsersManager.deleteUserOrGuest(guest.id, guest.login, { deleteSpace: true, isGuest: true })\n  }\n\n  searchMembers(user: UserModel, searchMembersDto: SearchMembersDto): Promise<Member[]> {\n    return this.usersQueries.searchUsersOrGroups(searchMembersDto, user.id)\n  }\n\n  private notifyAccountLocked(user: UserModel, ip: string) {\n    this.notificationsManager\n      .sendEmailNotification([user], {\n        app: NOTIFICATION_APP.AUTH_LOCKED,\n        event: NOTIFICATION_APP_EVENT.AUTH_LOCKED[ACTION.DELETE],\n        element: null,\n        url: ip\n      })\n      .catch((e: Error) => this.logger.error(`${this.validateUserAccess.name} - ${e}`))\n  }\n}\n"],"names":["UsersManager","fromUserId","id","user","usersQueries","from","UserModel","findUser","loginOrEmail","removePassword","logUser","password","ip","scope","validateUserAccess","authSuccess","comparePassword","validateAppPassword","updateAccesses","catch","e","logger","error","name","makePaths","warn","login","role","USER_ROLE","LINK","HttpException","HttpStatus","FORBIDDEN","isActive","passwordAttempts","USER_MAX_PASSWORD_ATTEMPTS","notifyAccountLocked","me","authUser","NOT_FOUND","impersonated","impersonatedFromId","clientId","server","serverConfig","compareUserPassword","userId","updateLanguage","userLanguageDto","language","updateUserOrGuest","INTERNAL_SERVER_ERROR","updatePassword","userPasswordDto","r","selectUserProperties","oldPassword","BAD_REQUEST","hash","bcrypt","newPassword","updateNotification","userNotificationDto","updateStorageIndexing","userStorageIndexingDto","updateAvatar","req","part","file","limits","fileSize","USER_AVATAR_MAX_UPLOAD_SIZE","mimetype","startsWith","dstPath","path","join","tmpPath","USER_AVATAR_FILE_NAME","pipeline","createWriteStream","truncated","PAYLOAD_TOO_LARGE","moveFiles","homePath","updateSecrets","secrets","userSecrets","getUserSecrets","updatedSecrets","success","isAuthTwoFa","configuration","auth","mfa","totp","enabled","twoFaEnabled","Math","min","lastAccess","currentAccess","Date","lastIp","currentIp","getAvatar","userLogin","generate","generateIsNotExists","avatarPath","getHomePath","avatarExists","isPathExists","USER_DEFAULT_AVATAR_FILE_PATH","pngMimeType","svgMimeType","avatarFile","avatarStream","Readable","generateAvatar","getInitials","listAppPasswords","Array","isArray","appPasswords","map","rest","generateAppPassword","userAppPasswordDto","slugName","createLightSlug","find","p","clearPassword","genPassword","appPassword","app","expiration","hashPassword","createdAt","unshift","deleteAppPassword","passwordName","filter","haveRole","USER","expMs","setOnlineStatus","onlineStatus","getOnlineUsers","userIds","usersWhitelist","browseGroups","group","groupFromName","parentGroup","members","browseGroupMembers","undefined","browseRootGroups","getGroup","groupId","withMembers","asAdmin","getGroupWithMembers","createPersonalGroup","userCreateOrUpdateGroupDto","JSON","stringify","checkGroupNameExists","log","clearWhiteListCaches","updatePersonalGroup","Object","keys","length","currentGroup","isAdmin","type","MEMBER_TYPE","PGROUP","updateGroup","message","addUsersToGroup","userWhiteList","GROUP","m","indexOf","updateGroupMembers","add","groupRole","USER_GROUP_ROLE","MEMBER","updateUserFromPersonalGroup","updateUserFromGroupDto","userToUpdate","MANAGER","adminUsersManager","updateUserFromGroup","removeUserFromGroup","userToRemove","remove","leavePersonalGroup","userWhoLeaves","deletePersonalGroup","canDeletePersonalGroup","listGuests","getGuest","guestId","guest","checkUser","createGuest","createGuestDto","managers","push","createUserOrGuest","GUEST","updateGuest","updateGuestDto","isGuestManager","deleteGuest","deleteUserOrGuest","deleteSpace","isGuest","searchMembers","searchMembersDto","searchUsersOrGroups","notificationsManager","sendEmailNotification","NOTIFICATION_APP","AUTH_LOCKED","event","NOTIFICATION_APP_EVENT","ACTION","DELETE","element","url","Logger"],"mappings":"AAAA;;;;CAIC;;;;+BAiDYA;;;eAAAA;;;wBA9CiD;iEAC3C;wBAEe;iEACjB;4BACQ;0BACA;2BAKF;2BACuB;uBACW;wBACZ;mCACD;uBACJ;+BACiB;6CACpB;wBACT;sBAC+D;2BAiBjE;wBAIwE;0CAChE;qCACL;;;;;;;;;;;;;;;AAGtB,IAAA,AAAMA,eAAN,MAAMA;IASX,MAAMC,WAAWC,EAAU,EAAsB;QAC/C,MAAMC,OAAa,MAAM,IAAI,CAACC,YAAY,CAACC,IAAI,CAACH;QAChD,OAAOC,OAAO,IAAIG,oBAAS,CAACH,MAAM,QAAQ;IAC5C;IAIA,MAAMI,SAASC,YAAoB,EAAEC,iBAA0B,IAAI,EAAwC;QACzG,MAAMN,OAAa,MAAM,IAAI,CAACC,YAAY,CAACC,IAAI,CAAC,MAAMG;QACtD,OAAOL,OAAO,IAAIG,oBAAS,CAACH,MAAMM,kBAAkB;IACtD;IAEA,MAAMC,QAAQP,IAAe,EAAEQ,QAAgB,EAAEC,EAAU,EAAEC,KAAkB,EAAsB;QACnG,IAAI,CAACC,kBAAkB,CAACX,MAAMS;QAC9B,IAAIG,cAAuB,MAAMC,IAAAA,0BAAe,EAACL,UAAUR,KAAKQ,QAAQ;QACxE,IAAI,CAACI,eAAeF,OAAO;YACzBE,cAAc,MAAM,IAAI,CAACE,mBAAmB,CAACd,MAAMQ,UAAUC,IAAIC;QACnE;QACA,IAAI,CAACK,cAAc,CAACf,MAAMS,IAAIG,aAAaI,KAAK,CAAC,CAACC,IAAa,IAAI,CAACC,MAAM,CAACC,KAAK,CAAC,GAAG,IAAI,CAACZ,OAAO,CAACa,IAAI,CAAC,GAAG,EAAEH,GAAG;QAC9G,IAAIL,aAAa;YACf,MAAMZ,KAAKqB,SAAS;YACpB,OAAOrB;QACT;QACA,IAAI,CAACkB,MAAM,CAACI,IAAI,CAAC,GAAG,IAAI,CAACf,OAAO,CAACa,IAAI,CAAC,qBAAqB,EAAEpB,KAAKuB,KAAK,CAAC,CAAC,CAAC;QAC1E,OAAO;IACT;IAEAZ,mBAAmBX,IAAe,EAAES,EAAU,EAAE;QAC9C,IAAIT,KAAKwB,IAAI,KAAKC,eAAS,CAACC,IAAI,EAAE;YAChC,IAAI,CAACR,MAAM,CAACC,KAAK,CAAC,GAAG,IAAI,CAACR,kBAAkB,CAACS,IAAI,CAAC,sBAAsB,EAAEpB,KAAK,2BAA2B,CAAC;YAC3G,MAAM,IAAI2B,qBAAa,CAAC,0BAA0BC,kBAAU,CAACC,SAAS;QACxE;QACA,IAAI,CAAC7B,KAAK8B,QAAQ,IAAI9B,KAAK+B,gBAAgB,IAAIC,gCAA0B,EAAE;YACzE,IAAI,CAACjB,cAAc,CAACf,MAAMS,IAAI,OAAOO,KAAK,CAAC,CAACC,IAAa,IAAI,CAACC,MAAM,CAACC,KAAK,CAAC,GAAG,IAAI,CAACR,kBAAkB,CAACS,IAAI,CAAC,GAAG,EAAEH,GAAG;YACnH,IAAI,CAACC,MAAM,CAACC,KAAK,CAAC,GAAG,IAAI,CAACR,kBAAkB,CAACS,IAAI,CAAC,iBAAiB,EAAEpB,KAAKuB,KAAK,CAAC,WAAW,CAAC;YAC5F,IAAI,CAACU,mBAAmB,CAACjC,MAAMS;YAC/B,MAAM,IAAIkB,qBAAa,CAAC,kBAAkBC,kBAAU,CAACC,SAAS;QAChE;IACF;IAEA,MAAMK,GAAGC,QAAmB,EAA4C;QACtE,MAAMnC,OAAO,MAAM,IAAI,CAACF,UAAU,CAACqC,SAASpC,EAAE;QAC9C,IAAI,CAACC,MAAM;YACT,IAAI,CAACkB,MAAM,CAACI,IAAI,CAAC,CAAC,MAAM,EAAEa,SAASZ,KAAK,CAAC,EAAE,EAAEY,SAASpC,EAAE,CAAC,WAAW,CAAC;YACrE,MAAM,IAAI4B,qBAAa,CAAC,CAAC,cAAc,CAAC,EAAEC,kBAAU,CAACQ,SAAS;QAChE;QACApC,KAAKqC,YAAY,GAAG,CAAC,CAACF,SAASG,kBAAkB;QACjDtC,KAAKuC,QAAQ,GAAGJ,SAASI,QAAQ;QACjC,OAAO;YAAEvC,MAAMA;YAAMwC,QAAQC,+BAAY;QAAC;IAC5C;IAEA,MAAMC,oBAAoBC,MAAc,EAAEnC,QAAgB,EAAoB;QAC5E,OAAO,IAAI,CAACP,YAAY,CAACyC,mBAAmB,CAACC,QAAQnC;IACvD;IAEA,MAAMoC,eAAe5C,IAAe,EAAE6C,eAAgC,EAAE;QACtE,IAAI,CAACA,gBAAgBC,QAAQ,EAAED,gBAAgBC,QAAQ,GAAG;QAC1D,IAAI,CAAE,MAAM,IAAI,CAAC7C,YAAY,CAAC8C,iBAAiB,CAAC/C,KAAKD,EAAE,EAAE8C,kBAAmB;YAC1E,MAAM,IAAIlB,qBAAa,CAAC,6BAA6BC,kBAAU,CAACoB,qBAAqB;QACvF;IACF;IAEA,MAAMC,eAAejD,IAAe,EAAEkD,eAAsC,EAAE;QAC5E,MAAMC,IAAI,MAAM,IAAI,CAAClD,YAAY,CAACmD,oBAAoB,CAACpD,KAAKD,EAAE,EAAE;YAAC;SAAW;QAC5E,IAAI,CAACoD,GAAG;YACN,MAAM,IAAIxB,qBAAa,CAAC,4BAA4BC,kBAAU,CAACQ,SAAS;QAC1E;QACA,IAAI,CAAE,MAAMvB,IAAAA,0BAAe,EAACqC,gBAAgBG,WAAW,EAAEF,EAAE3C,QAAQ,GAAI;YACrE,MAAM,IAAImB,qBAAa,CAAC,qBAAqBC,kBAAU,CAAC0B,WAAW;QACrE;QACA,MAAMC,OAAO,MAAMC,iBAAM,CAACD,IAAI,CAACL,gBAAgBO,WAAW,EAAE;QAC5D,IAAI,CAAE,MAAM,IAAI,CAACxD,YAAY,CAAC8C,iBAAiB,CAAC/C,KAAKD,EAAE,EAAE;YAAES,UAAU+C;QAAK,IAAK;YAC7E,MAAM,IAAI5B,qBAAa,CAAC,6BAA6BC,kBAAU,CAACoB,qBAAqB;QACvF;IACF;IAEA,MAAMU,mBAAmB1D,IAAe,EAAE2D,mBAAwC,EAAE;QAClF,IAAI,CAAE,MAAM,IAAI,CAAC1D,YAAY,CAAC8C,iBAAiB,CAAC/C,KAAKD,EAAE,EAAE4D,sBAAuB;YAC9E,MAAM,IAAIhC,qBAAa,CAAC,4CAA4CC,kBAAU,CAACoB,qBAAqB;QACtG;IACF;IAEA,MAAMY,sBAAsB5D,IAAe,EAAE6D,sBAA8C,EAAE;QAC3F,IAAI,CAAE,MAAM,IAAI,CAAC5D,YAAY,CAAC8C,iBAAiB,CAAC/C,KAAKD,EAAE,EAAE8D,yBAA0B;YACjF,MAAM,IAAIlC,qBAAa,CAAC,gDAAgDC,kBAAU,CAACoB,qBAAqB;QAC1G;IACF;IAEA,MAAMc,aAAaC,GAAgC,EAAE;QACnD,MAAMC,OAAsB,MAAMD,IAAIE,IAAI,CAAC;YAAEC,QAAQ;gBAAEC,UAAUC,mCAA2B;YAAC;QAAE;QAC/F,IAAI,CAACJ,KAAKK,QAAQ,CAACC,UAAU,CAAC,WAAW;YACvC,MAAM,IAAI3C,qBAAa,CAAC,yBAAyBC,kBAAU,CAAC0B,WAAW;QACzE;QACA,MAAMiB,UAAUC,iBAAI,CAACC,IAAI,CAACV,IAAI/D,IAAI,CAAC0E,OAAO,EAAEC,6BAAqB;QACjE,IAAI;YACF,MAAMC,IAAAA,kBAAQ,EAACZ,KAAKC,IAAI,EAAEY,IAAAA,yBAAiB,EAACN;QAC9C,EAAE,OAAOtD,GAAG;YACV,IAAI,CAACC,MAAM,CAACC,KAAK,CAAC,GAAG,IAAI,CAAC2C,YAAY,CAAC1C,IAAI,CAAC,GAAG,EAAEH,GAAG;YACpD,MAAM,IAAIU,qBAAa,CAAC,2BAA2BC,kBAAU,CAACoB,qBAAqB;QACrF;QACA,IAAIgB,KAAKC,IAAI,CAACa,SAAS,EAAE;YACvB,IAAI,CAAC5D,MAAM,CAACI,IAAI,CAAC,GAAG,IAAI,CAACwC,YAAY,CAAC1C,IAAI,CAAC,qBAAqB,CAAC;YACjE,MAAM,IAAIO,qBAAa,CAAC,gCAAgCC,kBAAU,CAACmD,iBAAiB;QACtF;QACA,IAAI;YACF,MAAMC,IAAAA,gBAAS,EAACT,SAASC,iBAAI,CAACC,IAAI,CAACV,IAAI/D,IAAI,CAACiF,QAAQ,EAAEN,6BAAqB,GAAG;QAChF,EAAE,OAAO1D,GAAG;YACV,IAAI,CAACC,MAAM,CAACC,KAAK,CAAC,GAAG,IAAI,CAAC2C,YAAY,CAAC1C,IAAI,CAAC,GAAG,EAAEH,GAAG;YACpD,MAAM,IAAIU,qBAAa,CAAC,2BAA2BC,kBAAU,CAACoB,qBAAqB;QACrF;IACF;IAEA,MAAMkC,cAAcvC,MAAc,EAAEwC,OAAoB,EAAE;QACxD,MAAMC,cAAc,MAAM,IAAI,CAACnF,YAAY,CAACoF,cAAc,CAAC1C;QAC3D,MAAM2C,iBAAiB;YAAE,GAAGF,WAAW;YAAE,GAAGD,OAAO;QAAC;QACpD,IAAI,CAAE,MAAM,IAAI,CAAClF,YAAY,CAAC8C,iBAAiB,CAACJ,QAAQ;YAAEwC,SAASG;QAAe,IAAK;YACrF,MAAM,IAAI3D,qBAAa,CAAC,4BAA4BC,kBAAU,CAACoB,qBAAqB;QACtF;IACF;IAEA,MAAMjC,eAAef,IAAe,EAAES,EAAU,EAAE8E,OAAgB,EAAEC,cAAc,KAAK,EAAE;QACvF,IAAIzD;QACJ,IAAI,CAACyD,eAAeC,gCAAa,CAACC,IAAI,CAACC,GAAG,CAACC,IAAI,CAACC,OAAO,IAAI7F,KAAK8F,YAAY,EAAE;YAC5E,4EAA4E;YAC5E/D,mBAAmB/B,KAAK+B,gBAAgB;QAC1C,OAAO;YACLA,mBAAmBwD,UAAU,IAAIQ,KAAKC,GAAG,CAAChG,KAAK+B,gBAAgB,GAAG,GAAGC,gCAA0B;QACjG;QACA,MAAM,IAAI,CAAC/B,YAAY,CAAC8C,iBAAiB,CAAC/C,KAAKD,EAAE,EAAE;YACjDkG,YAAYjG,KAAKkG,aAAa;YAC9BA,eAAe,IAAIC;YACnBC,QAAQpG,KAAKqG,SAAS;YACtBA,WAAW5F;YACXsB,kBAAkBA;YAClBD,UAAU9B,KAAK8B,QAAQ,IAAIC,mBAAmBC,gCAA0B;QAC1E;IACF;IAIA,MAAMsE,UAAUC,SAAiB,EAAEC,WAAoB,KAAK,EAAEC,mBAA6B,EAAyC;QAClI,MAAMC,aAAalC,iBAAI,CAACC,IAAI,CAACtE,oBAAS,CAACwG,WAAW,CAACJ,YAAY5B,6BAAqB;QACpF,MAAMiC,eAAe,MAAMC,IAAAA,mBAAY,EAACH;QACxC,IAAI,CAACE,gBAAgBH,qBAAqB;YACxCD,WAAW;QACb;QACA,IAAI,CAACA,UAAU;YACb,OAAO;gBAACI,eAAeF,aAAaI,qCAA6B;gBAAEF,eAAeG,kBAAW,GAAGC,kBAAW;aAAC;QAC9G;QACA,IAAI,CAAE,MAAMH,IAAAA,mBAAY,EAAC1G,oBAAS,CAACwG,WAAW,CAACJ,aAAc;YAC3D,MAAM,IAAI5E,qBAAa,CAAC,CAAC,oBAAoB,EAAE4E,UAAU,gBAAgB,CAAC,EAAE3E,kBAAU,CAACC,SAAS;QAClG;QACA,MAAM7B,OAA2B,MAAM,IAAI,CAACI,QAAQ,CAACmG;QACrD,IAAI,CAACvG,MAAM;YACT,MAAM,IAAI2B,qBAAa,CAAC,CAAC,gBAAgB,CAAC,EAAEC,kBAAU,CAACQ,SAAS;QAClE;QACA,MAAM6E,aAA0BpC,IAAAA,yBAAiB,EAAC6B;QAClD,MAAMQ,eAAeC,oBAAQ,CAACjH,IAAI,CAAC,MAAMkH,IAAAA,qBAAc,EAACpH,KAAKqH,WAAW;QACxE,IAAI;YACF,MAAMzC,IAAAA,kBAAQ,EAACsC,cAAcD;QAC/B,EAAE,OAAOhG,GAAG;YACV,IAAI,CAACC,MAAM,CAACC,KAAK,CAAC,GAAG,IAAI,CAAC2C,YAAY,CAAC1C,IAAI,CAAC,GAAG,EAAEH,GAAG;YACpD,MAAM,IAAIU,qBAAa,CAAC,2BAA2BC,kBAAU,CAACoB,qBAAqB;QACrF;QACA,IAAIyD,qBAAqB;YACvB,OAAO;gBAACC;gBAAYK,kBAAW;aAAC;QAClC;IACF;IAEA,MAAMO,iBAAiBtH,IAAe,EAAgD;QACpF,MAAMmF,UAAU,MAAM,IAAI,CAAClF,YAAY,CAACoF,cAAc,CAACrF,KAAKD,EAAE;QAC9D,IAAIwH,MAAMC,OAAO,CAACrC,QAAQsC,YAAY,GAAG;YACvC,iCAAiC;YACjC,OAAOtC,QAAQsC,YAAY,CAACC,GAAG,CAAC,CAAC,EAAElH,QAAQ,EAAE,GAAGmH,MAAuB,GAAKA;QAC9E;QACA,OAAO,EAAE;IACX;IAEA,MAAMC,oBAAoB5H,IAAe,EAAE6H,kBAAsC,EAA4B;QAC3G,MAAM1C,UAAU,MAAM,IAAI,CAAClF,YAAY,CAACoF,cAAc,CAACrF,KAAKD,EAAE;QAC9D,MAAM+H,WAAWC,IAAAA,uBAAe,EAACF,mBAAmBzG,IAAI;QACxD,IAAImG,MAAMC,OAAO,CAACrC,QAAQsC,YAAY,KAAKtC,QAAQsC,YAAY,CAACO,IAAI,CAAC,CAACC,IAAuBA,EAAE7G,IAAI,KAAK0G,WAAW;YACjH,MAAM,IAAInG,qBAAa,CAAC,qBAAqBC,kBAAU,CAAC0B,WAAW;QACrE;QACA6B,QAAQsC,YAAY,GAAGF,MAAMC,OAAO,CAACrC,QAAQsC,YAAY,IAAItC,QAAQsC,YAAY,GAAG,EAAE;QACtF,MAAMS,gBAAgBC,IAAAA,mBAAW,EAAC;QAClC,MAAMC,cAA+B;YACnChH,MAAM2G,IAAAA,uBAAe,EAACF,mBAAmBzG,IAAI;YAC7CiH,KAAKR,mBAAmBQ,GAAG;YAC3BC,YAAYT,mBAAmBS,UAAU;YACzC9H,UAAU,MAAM+H,IAAAA,uBAAY,EAACL;YAC7BM,WAAW,IAAIrC;YACfE,WAAW;YACXH,eAAe;YACfE,QAAQ;YACRH,YAAY;QACd;QACAd,QAAQsC,YAAY,CAACgB,OAAO,CAACL;QAC7B,IAAI,CAAE,MAAM,IAAI,CAACnI,YAAY,CAAC8C,iBAAiB,CAAC/C,KAAKD,EAAE,EAAE;YAAEoF,SAASA;QAAQ,IAAK;YAC/E,MAAM,IAAIxD,qBAAa,CAAC,kCAAkCC,kBAAU,CAACoB,qBAAqB;QAC5F;QACA,kCAAkC;QAClC,OAAO;YAAE,GAAGoF,WAAW;YAAE5H,UAAU0H;QAAc;IACnD;IAEA,MAAMQ,kBAAkB1I,IAAe,EAAE2I,YAAoB,EAAiB;QAC5E,MAAMxD,UAAU,MAAM,IAAI,CAAClF,YAAY,CAACoF,cAAc,CAACrF,KAAKD,EAAE;QAC9D,IAAI,CAACwH,MAAMC,OAAO,CAACrC,QAAQsC,YAAY,KAAK,CAACtC,QAAQsC,YAAY,CAACO,IAAI,CAAC,CAACC,IAAuBA,EAAE7G,IAAI,KAAKuH,eAAe;YACvH,MAAM,IAAIhH,qBAAa,CAAC,0BAA0BC,kBAAU,CAACQ,SAAS;QACxE;QACA+C,QAAQsC,YAAY,GAAGtC,QAAQsC,YAAY,CAACmB,MAAM,CAAC,CAACX,IAAuBA,EAAE7G,IAAI,KAAKuH;QACtF,IAAI,CAAE,MAAM,IAAI,CAAC1I,YAAY,CAAC8C,iBAAiB,CAAC/C,KAAKD,EAAE,EAAE;YAAEoF,SAASA;QAAQ,IAAK;YAC/E,MAAM,IAAIxD,qBAAa,CAAC,iCAAiCC,kBAAU,CAACoB,qBAAqB;QAC3F;IACF;IAEA,MAAMlC,oBAAoBd,IAAe,EAAEQ,QAAgB,EAAEC,EAAU,EAAEC,KAAiB,EAAoB;QAC5G,IAAI,CAACA,SAAS,CAACV,KAAK6I,QAAQ,CAACpH,eAAS,CAACqH,IAAI,GAAG,OAAO;QACrD,MAAM3D,UAAU,MAAM,IAAI,CAAClF,YAAY,CAACoF,cAAc,CAACrF,KAAKD,EAAE;QAC9D,IAAI,CAACwH,MAAMC,OAAO,CAACrC,QAAQsC,YAAY,GAAG,OAAO;QACjD,KAAK,MAAMQ,KAAK9C,QAAQsC,YAAY,CAAE;YACpC,IAAIQ,EAAEI,GAAG,KAAK3H,OAAO;YACrB,MAAMqI,QAAQd,EAAEK,UAAU,GAAG,IAAInC,KAAK8B,EAAEK,UAAU,IAAI;YACtD,IAAIL,EAAEK,UAAU,IAAI,IAAInC,SAAS4C,OAAO,UAAS,UAAU;YAC3D,IAAI,MAAMlI,IAAAA,0BAAe,EAACL,UAAUyH,EAAEzH,QAAQ,GAAG;gBAC/CyH,EAAEhC,UAAU,GAAGgC,EAAE/B,aAAa;gBAC9B+B,EAAE/B,aAAa,GAAG,IAAIC;gBACtB8B,EAAE7B,MAAM,GAAG6B,EAAE5B,SAAS;gBACtB4B,EAAE5B,SAAS,GAAG5F;gBACd,kBAAkB;gBAClB,IAAI,CAACR,YAAY,CACd8C,iBAAiB,CAAC/C,KAAKD,EAAE,EAAE;oBAAEoF,SAASA;gBAAQ,GAC9CnE,KAAK,CAAC,CAACC,IAAa,IAAI,CAACC,MAAM,CAACC,KAAK,CAAC,GAAG,IAAI,CAACL,mBAAmB,CAACM,IAAI,CAAC,GAAG,EAAEH,GAAG;gBAClF,OAAO;YACT;QACF;QACA,OAAO;IACT;IAEA+H,gBAAgBhJ,IAAwB,EAAEiJ,YAAgC,EAAE;QAC1E,IAAI,CAAChJ,YAAY,CAAC+I,eAAe,CAAChJ,KAAKD,EAAE,EAAEkJ,cAAcjI,KAAK,CAAC,CAACC,IAAa,IAAI,CAACC,MAAM,CAACC,KAAK,CAAC,GAAG,IAAI,CAAC6H,eAAe,CAAC5H,IAAI,CAAC,GAAG,EAAEH,GAAG;IACtI;IAEAiI,eAAeC,OAAiB,EAAyB;QACvD,OAAO,IAAI,CAAClJ,YAAY,CAACiJ,cAAc,CAACC;IAC1C;IAEA,MAAMC,eAAezG,MAAc,EAAqB;QACtD,OAAO,IAAI,CAAC1C,YAAY,CAACmJ,cAAc,CAACzG;IAC1C;IAEA,MAAM0G,aAAarJ,IAAe,EAAEoB,IAAY,EAAwB;QACtE,IAAIA,MAAM;YACR,MAAMkI,QAA2E,MAAM,IAAI,CAACrJ,YAAY,CAACsJ,aAAa,CAACvJ,KAAKD,EAAE,EAAEqB;YAChI,IAAI,CAACkI,OAAO;gBACV,MAAM,IAAI3H,qBAAa,CAAC,mBAAmBC,kBAAU,CAACQ,SAAS;YACjE;YACA,OAAO;gBAAEoH,aAAaF;gBAAOG,SAAS,MAAM,IAAI,CAACxJ,YAAY,CAACyJ,kBAAkB,CAACJ,MAAMvJ,EAAE;YAAE;QAC7F;QACA,OAAO;YAAEyJ,aAAaG;YAAWF,SAAS,MAAM,IAAI,CAACxJ,YAAY,CAAC2J,gBAAgB,CAAC5J,KAAKD,EAAE;QAAE;IAC9F;IAIA,MAAM8J,SAAS7J,IAAe,EAAE8J,OAAe,EAAEC,cAAc,IAAI,EAAEC,UAAU,KAAK,EAA2C;QAC7H,MAAMV,QAAQS,cACV,MAAM,IAAI,CAAC9J,YAAY,CAACgK,mBAAmB,CAACjK,KAAKD,EAAE,EAAE+J,SAASE,WAC9D,MAAM,IAAI,CAAC/J,YAAY,CAAC4J,QAAQ,CAAC7J,KAAKD,EAAE,EAAE+J,SAASE;QACvD,IAAI,CAACV,OAAO;YACV,MAAM,IAAI3H,qBAAa,CAAC,yCAAyCC,kBAAU,CAACC,SAAS;QACvF;QACA,OAAOyH;IACT;IAEA,MAAMY,oBAAoBlK,IAAe,EAAEmK,0BAAsD,EAAwB;QACvH,IAAI,CAACA,2BAA2B/I,IAAI,EAAE;YACpC,IAAI,CAACF,MAAM,CAACC,KAAK,CAAC,GAAG,IAAI,CAAC+I,mBAAmB,CAAC9I,IAAI,CAAC,wBAAwB,EAAEgJ,KAAKC,SAAS,CAACF,6BAA6B;YACzH,MAAM,IAAIxI,qBAAa,CAAC,yBAAyBC,kBAAU,CAAC0B,WAAW;QACzE;QACA,IAAI,MAAM,IAAI,CAACrD,YAAY,CAACqK,oBAAoB,CAACH,2BAA2B/I,IAAI,GAAG;YACjF,MAAM,IAAIO,qBAAa,CAAC,qBAAqBC,kBAAU,CAAC0B,WAAW;QACrE;QACA,IAAI;YACF,MAAMwG,UAAkB,MAAM,IAAI,CAAC7J,YAAY,CAACiK,mBAAmB,CAAClK,KAAKD,EAAE,EAAEoK;YAC7E,IAAI,CAACjJ,MAAM,CAACqJ,GAAG,CAAC,GAAG,IAAI,CAACL,mBAAmB,CAAC9I,IAAI,CAAC,UAAU,EAAE0I,QAAQ,gBAAgB,EAAEM,KAAKC,SAAS,CAACF,6BAA6B;YACnI,wBAAwB;YACxB,IAAI,CAAClK,YAAY,CAACuK,oBAAoB,CAAC;gBAACxK,KAAKD,EAAE;aAAC;YAChD,OAAO,IAAI,CAAC8J,QAAQ,CAAC7J,MAAM8J,SAAS;QACtC,EAAE,OAAO7I,GAAG;YACV,IAAI,CAACC,MAAM,CAACC,KAAK,CAAC,GAAG,IAAI,CAAC+I,mBAAmB,CAAC9I,IAAI,CAAC,2BAA2B,EAAEgJ,KAAKC,SAAS,CAACF,4BAA4B,GAAG,EAAElJ,GAAG;YACnI,MAAM,IAAIU,qBAAa,CAAC,0BAA0BC,kBAAU,CAACoB,qBAAqB;QACpF;IACF;IAEA,MAAMyH,oBAAoBzK,IAAe,EAAE8J,OAAe,EAAEK,0BAAsD,EAAwB;QACxI,IAAI,CAACO,OAAOC,IAAI,CAACR,4BAA4BS,MAAM,EAAE;YACnD,MAAM,IAAIjJ,qBAAa,CAAC,wBAAwBC,kBAAU,CAAC0B,WAAW;QACxE;QACA,MAAMuH,eAA4B,MAAM,IAAI,CAAChB,QAAQ,CAAC7J,MAAM8J,SAAS,OAAO9J,KAAK8K,OAAO;QACxF,IAAID,aAAaE,IAAI,KAAKC,mBAAW,CAACC,MAAM,EAAE;YAC5C,MAAM,IAAItJ,qBAAa,CAAC,yCAAyCC,kBAAU,CAACC,SAAS;QACvF;QACA,IAAIsI,2BAA2B/I,IAAI,IAAK,MAAM,IAAI,CAACnB,YAAY,CAACqK,oBAAoB,CAACH,2BAA2B/I,IAAI,GAAI;YACtH,MAAM,IAAIO,qBAAa,CAAC,qBAAqBC,kBAAU,CAAC0B,WAAW;QACrE;QACA,IAAI;YACF,MAAM,IAAI,CAACrD,YAAY,CAACiL,WAAW,CAACpB,SAASK;QAC/C,EAAE,OAAOlJ,GAAG;YACV,MAAM,IAAIU,qBAAa,CAACV,EAAEkK,OAAO,EAAEvJ,kBAAU,CAACoB,qBAAqB;QACrE;QACA,OAAO,IAAI,CAAC6G,QAAQ,CAAC7J,MAAM8J,SAAS,OAAO9J,KAAK8K,OAAO;IACzD;IAEA,MAAMM,gBAAgBpL,IAAe,EAAE8J,OAAe,EAAEX,OAAiB,EAAiB;QACxF,MAAM0B,eAAiC,MAAM,IAAI,CAAChB,QAAQ,CAAC7J,MAAM8J;QACjE,0CAA0C;QAC1C,mDAAmD;QACnD,MAAMuB,gBAA0B,MAAM,IAAI,CAACpL,YAAY,CAACmJ,cAAc,CACpEpJ,KAAKD,EAAE,EACP8K,aAAaE,IAAI,KAAKC,mBAAW,CAACM,KAAK,GAAG7J,eAAS,CAACqH,IAAI,GAAGa;QAE7D,8FAA8F;QAC9FR,UAAUA,QAAQP,MAAM,CAAC,CAAC7I,KAAO,CAAC8K,aAAapB,OAAO,CAACzB,IAAI,CAAC,CAACuD,IAAMA,EAAExL,EAAE,KAAKA,KAAK6I,MAAM,CAAC,CAAC7I,KAAOsL,cAAcG,OAAO,CAACzL,MAAM,CAAC;QAC7H,IAAI,CAACoJ,QAAQyB,MAAM,EAAE;YACnB,MAAM,IAAIjJ,qBAAa,CAAC,4BAA4BC,kBAAU,CAAC0B,WAAW;QAC5E;QACA,OAAO,IAAI,CAACrD,YAAY,CAACwL,kBAAkB,CAAC3B,SAAS;YAAE4B,KAAKvC,QAAQzB,GAAG,CAAC,CAAC3H,KAAQ,CAAA;oBAAEA,IAAIA;oBAAI4L,WAAWC,qBAAe,CAACC,MAAM;gBAAC,CAAA;QAAI;IACnI;IAEA,MAAMC,4BAA4B9L,IAAe,EAAE8J,OAAe,EAAEnH,MAAc,EAAEoJ,sBAA8C,EAAiB;QACjJ,MAAMlB,eAAiC,MAAM,IAAI,CAAChB,QAAQ,CAAC7J,MAAM8J;QACjE,IAAIe,aAAaE,IAAI,KAAKC,mBAAW,CAACC,MAAM,EAAE;YAC5C,MAAM,IAAItJ,qBAAa,CAAC,yCAAyCC,kBAAU,CAACC,SAAS;QACvF;QACA,MAAMmK,eAAenB,aAAapB,OAAO,CAACzB,IAAI,CAAC,CAACuD,IAAMA,EAAExL,EAAE,KAAK4C;QAC/D,IAAI,CAACqJ,cAAc;YACjB,MAAM,IAAIrK,qBAAa,CAAC,sBAAsBC,kBAAU,CAAC0B,WAAW;QACtE;QACA,IAAI0I,aAAaL,SAAS,KAAKI,uBAAuBvK,IAAI,EAAE;YAC1D,IAAIwK,aAAaL,SAAS,KAAKC,qBAAe,CAACK,OAAO,EAAE;gBACtD,IAAIpB,aAAapB,OAAO,CAACb,MAAM,CAAC,CAAC2C,IAAMA,EAAEI,SAAS,KAAKC,qBAAe,CAACK,OAAO,EAAErB,MAAM,KAAK,GAAG;oBAC5F,MAAM,IAAIjJ,qBAAa,CAAC,wCAAwCC,kBAAU,CAAC0B,WAAW;gBACxF;YACF;YACA,OAAO,IAAI,CAAC4I,iBAAiB,CAACC,mBAAmB,CAACrC,SAASnH,QAAQoJ;QACrE;IACF;IAEA,MAAMK,oBAAoBpM,IAAe,EAAE8J,OAAe,EAAEnH,MAAc,EAAiB;QACzF,MAAMkI,eAAiC,MAAM,IAAI,CAAChB,QAAQ,CAAC7J,MAAM8J;QACjE,MAAMuC,eAAexB,aAAapB,OAAO,CAACzB,IAAI,CAAC,CAACuD,IAAMA,EAAExL,EAAE,KAAK4C;QAC/D,IAAI,CAAC0J,cAAc;YACjB,MAAM,IAAI1K,qBAAa,CAAC,sBAAsBC,kBAAU,CAAC0B,WAAW;QACtE;QACA,IAAI+I,aAAaV,SAAS,KAAKC,qBAAe,CAACK,OAAO,EAAE;YACtD,IAAIpB,aAAaE,IAAI,KAAKC,mBAAW,CAACM,KAAK,EAAE;gBAC3C,MAAM,IAAI3J,qBAAa,CAAC,yCAAyCC,kBAAU,CAACC,SAAS;YACvF;YACA,IAAIgJ,aAAapB,OAAO,CAACb,MAAM,CAAC,CAAC2C,IAAMA,EAAEI,SAAS,KAAKC,qBAAe,CAACK,OAAO,EAAErB,MAAM,KAAK,GAAG;gBAC5F,MAAM,IAAIjJ,qBAAa,CAAC,wCAAwCC,kBAAU,CAAC0B,WAAW;YACxF;QACF;QACA,OAAO,IAAI,CAACrD,YAAY,CAACwL,kBAAkB,CAAC3B,SAAS;YAAEwC,QAAQ;gBAAC3J;aAAO;QAAC;IAC1E;IAEA,MAAM4J,mBAAmBvM,IAAe,EAAE8J,OAAe,EAAiB;QACxE,MAAMe,eAAiC,MAAM,IAAI,CAAC5K,YAAY,CAACgK,mBAAmB,CAACjK,KAAKD,EAAE,EAAE+J,SAAS;QACrG,IAAI,CAACe,gBAAgBA,aAAaE,IAAI,KAAKC,mBAAW,CAACM,KAAK,EAAE;YAC5D,MAAM,IAAI3J,qBAAa,CAAC,yCAAyCC,kBAAU,CAACC,SAAS;QACvF;QACA,MAAM2K,gBAAgB3B,aAAapB,OAAO,CAACzB,IAAI,CAAC,CAACuD,IAAMA,EAAExL,EAAE,KAAKC,KAAKD,EAAE;QACvE,IAAI,CAACyM,eAAe;YAClB,MAAM,IAAI7K,qBAAa,CAAC,sBAAsBC,kBAAU,CAAC0B,WAAW;QACtE;QACA,IAAIkJ,cAAcb,SAAS,KAAKC,qBAAe,CAACK,OAAO,EAAE;YACvD,IAAIpB,aAAapB,OAAO,CAACb,MAAM,CAAC,CAAC2C,IAAMA,EAAEI,SAAS,KAAKC,qBAAe,CAACK,OAAO,EAAErB,MAAM,KAAK,GAAG;gBAC5F,MAAM,IAAIjJ,qBAAa,CAAC,wCAAwCC,kBAAU,CAAC0B,WAAW;YACxF;QACF;QACA,IAAI;YACF,MAAM,IAAI,CAACrD,YAAY,CAACwL,kBAAkB,CAAC3B,SAAS;gBAAEwC,QAAQ;oBAACtM,KAAKD,EAAE;iBAAC;YAAC;YACxE,IAAI,CAACmB,MAAM,CAACqJ,GAAG,CAAC,GAAG,IAAI,CAACgC,kBAAkB,CAACnL,IAAI,CAAC,SAAS,EAAEpB,KAAKD,EAAE,CAAC,kBAAkB,EAAE+J,QAAQ,CAAC,CAAC;QACnG,EAAE,OAAO7I,GAAG;YACV,IAAI,CAACC,MAAM,CAACC,KAAK,CAAC,GAAG,IAAI,CAACoL,kBAAkB,CAACnL,IAAI,CAAC,SAAS,EAAEpB,KAAKD,EAAE,CAAC,sBAAsB,EAAE+J,QAAQ,IAAI,EAAE7I,GAAG;YAC9G,MAAM,IAAIU,qBAAa,CAACV,EAAEkK,OAAO,EAAEvJ,kBAAU,CAACoB,qBAAqB;QACrE;IACF;IAEA,MAAMyJ,oBAAoBzM,IAAe,EAAE8J,OAAe,EAAiB;QACzE,IAAI,CAAE,MAAM,IAAI,CAAC7J,YAAY,CAACyM,sBAAsB,CAAC1M,KAAKD,EAAE,EAAE+J,UAAW;YACvE,MAAM,IAAInI,qBAAa,CAAC,yCAAyCC,kBAAU,CAACC,SAAS;QACvF;QACA,IAAI,MAAM,IAAI,CAAC5B,YAAY,CAACwM,mBAAmB,CAAC3C,UAAU;YACxD,IAAI,CAAC5I,MAAM,CAACqJ,GAAG,CAAC,GAAG,IAAI,CAACkC,mBAAmB,CAACrL,IAAI,CAAC,UAAU,EAAE0I,QAAQ,aAAa,CAAC;QACrF,OAAO;YACL,IAAI,CAAC5I,MAAM,CAACI,IAAI,CAAC,GAAG,IAAI,CAACmL,mBAAmB,CAACrL,IAAI,CAAC,UAAU,EAAE0I,QAAQ,gBAAgB,CAAC;YACvF,MAAM,IAAInI,qBAAa,CAAC,0BAA0BC,kBAAU,CAAC0B,WAAW;QAC1E;IACF;IAEAqJ,WAAW3M,IAAe,EAAwB;QAChD,OAAO,IAAI,CAACC,YAAY,CAAC0M,UAAU,CAAC,MAAM3M,KAAKD,EAAE;IACnD;IAEA,MAAM6M,SAAS5M,IAAe,EAAE6M,OAAe,EAAsB;QACnE,MAAMC,QAAmB,MAAM,IAAI,CAAC7M,YAAY,CAAC0M,UAAU,CAACE,SAAS7M,KAAKD,EAAE;QAC5E,IAAI,CAACmM,iBAAiB,CAACa,SAAS,CAACD,OAAO;QACxC,OAAOA;IACT;IAEA,MAAME,YAAYhN,IAAe,EAAEiN,cAA6B,EAAsB;QACpF,oDAAoD;QACpD,MAAM5B,gBAAgB,MAAM,IAAI,CAACpL,YAAY,CAACmJ,cAAc,CAACpJ,KAAKD,EAAE,EAAE0B,eAAS,CAACqH,IAAI;QACpFmE,eAAeC,QAAQ,GAAGD,eAAeC,QAAQ,CAACtE,MAAM,CAAC,CAAC7I,KAAOsL,cAAcG,OAAO,CAACzL,MAAM,CAAC;QAC9F,IAAIkN,eAAeC,QAAQ,CAAC1B,OAAO,CAACxL,KAAKD,EAAE,MAAM,CAAC,GAAG;YACnD,wCAAwC;YACxCkN,eAAeC,QAAQ,CAACC,IAAI,CAACnN,KAAKD,EAAE;QACtC;QACA,wBAAwB;QACxB,IAAI,CAACE,YAAY,CAACuK,oBAAoB,CAAC;YAACxK,KAAKD,EAAE;SAAC;QAChD,OAAO,IAAI,CAACmM,iBAAiB,CAACkB,iBAAiB,CAACH,gBAAgBxL,eAAS,CAAC4L,KAAK,EAAE;IACnF;IAEA,MAAMC,YAAYtN,IAAe,EAAE6M,OAAe,EAAEU,cAA6B,EAAsB;QACrG,IAAI,CAAC7C,OAAOC,IAAI,CAAC4C,gBAAgB3C,MAAM,EAAE;YACvC,MAAM,IAAIjJ,qBAAa,CAAC,wBAAwBC,kBAAU,CAAC0B,WAAW;QACxE;QACA,IAAIiK,eAAeL,QAAQ,EAAE;YAC3B,oDAAoD;YACpD,MAAM7B,gBAAgB,MAAM,IAAI,CAACpL,YAAY,CAACmJ,cAAc,CAACpJ,KAAKD,EAAE,EAAE0B,eAAS,CAACqH,IAAI;YACpFyE,eAAeL,QAAQ,GAAGK,eAAeL,QAAQ,CAACtE,MAAM,CAAC,CAAC7I,KAAOsL,cAAcG,OAAO,CAACzL,MAAM,CAAC;YAC9F,IAAI,CAACwN,eAAeL,QAAQ,CAACtC,MAAM,EAAE;gBACnC,MAAM,IAAIjJ,qBAAa,CAAC,wCAAwCC,kBAAU,CAAC0B,WAAW;YACxF;QACF;QACA,IAAI,CAAE,MAAM,IAAI,CAACrD,YAAY,CAACuN,cAAc,CAACxN,KAAKD,EAAE,EAAE8M,UAAW;YAC/D,MAAM,IAAIlL,qBAAa,CAAC,yCAAyCC,kBAAU,CAACC,SAAS;QACvF;QACA,MAAMiL,QAAQ,MAAM,IAAI,CAACZ,iBAAiB,CAACnJ,iBAAiB,CAAC8J,SAASU,gBAAgB9L,eAAS,CAAC4L,KAAK;QACrG,OAAOP,MAAMI,QAAQ,CAAClF,IAAI,CAAC,CAACuD,IAAMA,EAAExL,EAAE,KAAKC,KAAKD,EAAE,IAAI+M,QAAQ;IAChE;IAEA,MAAMW,YAAYzN,IAAe,EAAE6M,OAAe,EAAiB;QACjE,MAAMC,QAAQ,MAAM,IAAI,CAAC7M,YAAY,CAACuN,cAAc,CAACxN,KAAKD,EAAE,EAAE8M;QAC9D,IAAI,CAACC,OAAO;YACV,MAAM,IAAInL,qBAAa,CAAC,yCAAyCC,kBAAU,CAACC,SAAS;QACvF;QACA,+CAA+C;QAC/C,OAAO,IAAI,CAACqK,iBAAiB,CAACwB,iBAAiB,CAACZ,MAAM/M,EAAE,EAAE+M,MAAMvL,KAAK,EAAE;YAAEoM,aAAa;YAAMC,SAAS;QAAK;IAC5G;IAEAC,cAAc7N,IAAe,EAAE8N,gBAAkC,EAAqB;QACpF,OAAO,IAAI,CAAC7N,YAAY,CAAC8N,mBAAmB,CAACD,kBAAkB9N,KAAKD,EAAE;IACxE;IAEQkC,oBAAoBjC,IAAe,EAAES,EAAU,EAAE;QACvD,IAAI,CAACuN,oBAAoB,CACtBC,qBAAqB,CAAC;YAACjO;SAAK,EAAE;YAC7BqI,KAAK6F,+BAAgB,CAACC,WAAW;YACjCC,OAAOC,qCAAsB,CAACF,WAAW,CAACG,iBAAM,CAACC,MAAM,CAAC;YACxDC,SAAS;YACTC,KAAKhO;QACP,GACCO,KAAK,CAAC,CAACC,IAAa,IAAI,CAACC,MAAM,CAACC,KAAK,CAAC,GAAG,IAAI,CAACR,kBAAkB,CAACS,IAAI,CAAC,GAAG,EAAEH,GAAG;IACnF;IAtdA,YACE,AAAgBhB,YAA0B,EAC1C,AAAiBiM,iBAAoC,EACrD,AAAiB8B,oBAA0C,CAC3D;aAHgB/N,eAAAA;aACCiM,oBAAAA;aACA8B,uBAAAA;aALF9M,SAAS,IAAIwN,cAAM,CAAC7O,aAAauB,IAAI;IAMnD;AAmdL"}
+{"version":3,"sources":["../../../../../backend/src/applications/users/services/users-manager.service.ts"],"sourcesContent":["/*\n * Copyright (C) 2012-2025 Johan Legrand <johan.legrand@sync-in.com>\n * This file is part of Sync-in | The open source file sync and share solution\n * See the LICENSE file for licensing details\n */\n\nimport { MultipartFile } from '@fastify/multipart'\nimport { HttpException, HttpStatus, Injectable, Logger } from '@nestjs/common'\nimport bcrypt from 'bcryptjs'\nimport { WriteStream } from 'fs'\nimport { createWriteStream } from 'node:fs'\nimport path from 'node:path'\nimport { pipeline } from 'node:stream/promises'\nimport { AUTH_SCOPE } from '../../../authentication/constants/scope'\nimport { LoginResponseDto } from '../../../authentication/dto/login-response.dto'\nimport { FastifyAuthenticatedRequest } from '../../../authentication/interfaces/auth-request.interface'\nimport { JwtIdentityPayload } from '../../../authentication/interfaces/jwt-payload.interface'\nimport { ACTION } from '../../../common/constants'\nimport { comparePassword, hashPassword } from '../../../common/functions'\nimport { generateAvatar, pngMimeType, svgMimeType } from '../../../common/image'\nimport { createLightSlug, genPassword } from '../../../common/shared'\nimport { configuration, serverConfig } from '../../../configuration/config.environment'\nimport { isPathExists, moveFiles } from '../../files/utils/files'\nimport { NOTIFICATION_APP, NOTIFICATION_APP_EVENT } from '../../notifications/constants/notifications'\nimport { NotificationsManager } from '../../notifications/services/notifications-manager.service'\nimport { MEMBER_TYPE } from '../constants/member'\nimport { USER_GROUP_ROLE, USER_MAX_PASSWORD_ATTEMPTS, USER_ONLINE_STATUS, USER_ROLE } from '../constants/user'\nimport type { UserCreateOrUpdateGroupDto } from '../dto/create-or-update-group.dto'\nimport type { CreateUserDto, UpdateUserDto, UpdateUserFromGroupDto } from '../dto/create-or-update-user.dto'\nimport type { SearchMembersDto } from '../dto/search-members.dto'\nimport type {\n  UserAppPasswordDto,\n  UserLanguageDto,\n  UserNotificationDto,\n  UserStorageIndexingDto,\n  UserUpdatePasswordDto\n} from '../dto/user-properties.dto'\nimport type { GroupBrowse } from '../interfaces/group-browse.interface'\nimport type { GroupMember, GroupWithMembers } from '../interfaces/group-member'\nimport type { GuestUser } from '../interfaces/guest-user.interface'\nimport type { Member } from '../interfaces/member.interface'\nimport type { UserAppPassword, UserSecrets } from '../interfaces/user-secrets.interface'\nimport type { UserOnline } from '../interfaces/websocket.interface'\nimport { UserModel } from '../models/user.model'\nimport type { Group } from '../schemas/group.interface'\nimport type { UserGroup } from '../schemas/user-group.interface'\nimport type { User } from '../schemas/user.interface'\nimport { USER_AVATAR_FILE_NAME, USER_AVATAR_MAX_UPLOAD_SIZE, USER_DEFAULT_AVATAR_FILE_PATH } from '../utils/avatar'\nimport { AdminUsersManager } from './admin-users-manager.service'\nimport { UsersQueries } from './users-queries.service'\n\n@Injectable()\nexport class UsersManager {\n  private readonly logger = new Logger(UsersManager.name)\n\n  constructor(\n    public readonly usersQueries: UsersQueries,\n    private readonly adminUsersManager: AdminUsersManager,\n    private readonly notificationsManager: NotificationsManager\n  ) {}\n\n  async fromUserId(id: number): Promise<UserModel> {\n    const user: User = await this.usersQueries.from(id)\n    return user ? new UserModel(user, true) : null\n  }\n\n  async findUser(loginOrEmail: string, removePassword: false): Promise<UserModel>\n  async findUser(loginOrEmail: string, removePassword?: true): Promise<Omit<UserModel, 'password'>>\n  async findUser(loginOrEmail: string, removePassword: boolean = true): Promise<Omit<UserModel, 'password'>> {\n    const user: User = await this.usersQueries.from(null, loginOrEmail)\n    return user ? new UserModel(user, removePassword) : null\n  }\n\n  async logUser(user: UserModel, password: string, ip: string, scope?: AUTH_SCOPE): Promise<UserModel> {\n    this.validateUserAccess(user, ip)\n    let authSuccess: boolean = await comparePassword(password, user.password)\n    if (!authSuccess && scope) {\n      authSuccess = await this.validateAppPassword(user, password, ip, scope)\n    }\n    this.updateAccesses(user, ip, authSuccess).catch((e: Error) => this.logger.error(`${this.logUser.name} - ${e}`))\n    if (authSuccess) {\n      await user.makePaths()\n      return user\n    }\n    this.logger.warn(`${this.logUser.name} - bad password for *${user.login}*`)\n    return null\n  }\n\n  validateUserAccess(user: UserModel, ip: string) {\n    if (user.role === USER_ROLE.LINK) {\n      this.logger.error(`${this.validateUserAccess.name} - guest link account ${user} is not authorized to login`)\n      throw new HttpException('Account is not allowed', HttpStatus.FORBIDDEN)\n    }\n    if (!user.isActive || user.passwordAttempts >= USER_MAX_PASSWORD_ATTEMPTS) {\n      this.updateAccesses(user, ip, false).catch((e: Error) => this.logger.error(`${this.validateUserAccess.name} - ${e}`))\n      this.logger.error(`${this.validateUserAccess.name} - user account *${user.login}* is locked`)\n      this.notifyAccountLocked(user, ip)\n      throw new HttpException('Account locked', HttpStatus.FORBIDDEN)\n    }\n  }\n\n  async me(authUser: UserModel): Promise<Omit<LoginResponseDto, 'token'>> {\n    const user = await this.fromUserId(authUser.id)\n    if (!user) {\n      this.logger.warn(`User *${authUser.login} (${authUser.id}) not found`)\n      throw new HttpException(`User not found`, HttpStatus.NOT_FOUND)\n    }\n    user.impersonated = !!authUser.impersonatedFromId\n    user.clientId = authUser.clientId\n    return { user: user, server: serverConfig }\n  }\n\n  async compareUserPassword(userId: number, password: string): Promise<boolean> {\n    return this.usersQueries.compareUserPassword(userId, password)\n  }\n\n  async updateLanguage(user: UserModel, userLanguageDto: UserLanguageDto) {\n    if (!userLanguageDto.language) userLanguageDto.language = null\n    if (!(await this.usersQueries.updateUserOrGuest(user.id, userLanguageDto))) {\n      throw new HttpException('Unable to update language', HttpStatus.INTERNAL_SERVER_ERROR)\n    }\n  }\n\n  async updatePassword(user: UserModel, userPasswordDto: UserUpdatePasswordDto) {\n    const r = await this.usersQueries.selectUserProperties(user.id, ['password'])\n    if (!r) {\n      throw new HttpException('Unable to check password', HttpStatus.NOT_FOUND)\n    }\n    if (!(await comparePassword(userPasswordDto.oldPassword, r.password))) {\n      throw new HttpException('Password mismatch', HttpStatus.BAD_REQUEST)\n    }\n    const hash = await bcrypt.hash(userPasswordDto.newPassword, 10)\n    if (!(await this.usersQueries.updateUserOrGuest(user.id, { password: hash }))) {\n      throw new HttpException('Unable to update password', HttpStatus.INTERNAL_SERVER_ERROR)\n    }\n  }\n\n  async updateNotification(user: UserModel, userNotificationDto: UserNotificationDto) {\n    if (!(await this.usersQueries.updateUserOrGuest(user.id, userNotificationDto))) {\n      throw new HttpException('Unable to update notification preference', HttpStatus.INTERNAL_SERVER_ERROR)\n    }\n  }\n\n  async updateStorageIndexing(user: UserModel, userStorageIndexingDto: UserStorageIndexingDto) {\n    if (!(await this.usersQueries.updateUserOrGuest(user.id, userStorageIndexingDto))) {\n      throw new HttpException('Unable to update full-text search preference', HttpStatus.INTERNAL_SERVER_ERROR)\n    }\n  }\n\n  async updateAvatar(req: FastifyAuthenticatedRequest) {\n    const part: MultipartFile = await req.file({ limits: { fileSize: USER_AVATAR_MAX_UPLOAD_SIZE } })\n    if (!part.mimetype.startsWith('image/')) {\n      throw new HttpException('Unsupported file type', HttpStatus.BAD_REQUEST)\n    }\n    const dstPath = path.join(req.user.tmpPath, USER_AVATAR_FILE_NAME)\n    try {\n      await pipeline(part.file, createWriteStream(dstPath))\n    } catch (e) {\n      this.logger.error(`${this.updateAvatar.name} - ${e}`)\n      throw new HttpException('Unable to upload avatar', HttpStatus.INTERNAL_SERVER_ERROR)\n    }\n    if (part.file.truncated) {\n      this.logger.warn(`${this.updateAvatar.name} - image is too large`)\n      throw new HttpException('Image is too large (5MB max)', HttpStatus.PAYLOAD_TOO_LARGE)\n    }\n    try {\n      await moveFiles(dstPath, path.join(req.user.homePath, USER_AVATAR_FILE_NAME), true)\n    } catch (e) {\n      this.logger.error(`${this.updateAvatar.name} - ${e}`)\n      throw new HttpException('Unable to create avatar', HttpStatus.INTERNAL_SERVER_ERROR)\n    }\n  }\n\n  async updateSecrets(userId: number, secrets: UserSecrets) {\n    const userSecrets = await this.usersQueries.getUserSecrets(userId)\n    const updatedSecrets = { ...userSecrets, ...secrets }\n    if (!(await this.usersQueries.updateUserOrGuest(userId, { secrets: updatedSecrets }))) {\n      throw new HttpException('Unable to update secrets', HttpStatus.INTERNAL_SERVER_ERROR)\n    }\n  }\n\n  async updateAccesses(user: UserModel, ip: string, success: boolean, isAuthTwoFa = false) {\n    let passwordAttempts: number\n    if (!isAuthTwoFa && configuration.auth.mfa.totp.enabled && user.twoFaEnabled) {\n      // Do not reset password attempts if the login still requires 2FA validation\n      passwordAttempts = user.passwordAttempts\n    } else {\n      passwordAttempts = success ? 0 : Math.min(user.passwordAttempts + 1, USER_MAX_PASSWORD_ATTEMPTS)\n    }\n    await this.usersQueries.updateUserOrGuest(user.id, {\n      lastAccess: user.currentAccess,\n      currentAccess: new Date(),\n      lastIp: user.currentIp,\n      currentIp: ip,\n      passwordAttempts: passwordAttempts,\n      isActive: user.isActive && passwordAttempts < USER_MAX_PASSWORD_ATTEMPTS\n    })\n  }\n\n  async getAvatar(userLogin: string, generate: true, generateIsNotExists?: boolean): Promise<undefined>\n  async getAvatar(userLogin: string, generate?: false, generateIsNotExists?: boolean): Promise<[path: string, mime: string]>\n  async getAvatar(userLogin: string, generate: boolean = false, generateIsNotExists?: boolean): Promise<[path: string, mime: string]> {\n    const avatarPath = path.join(UserModel.getHomePath(userLogin), USER_AVATAR_FILE_NAME)\n    const avatarExists = await isPathExists(avatarPath)\n    if (!avatarExists && generateIsNotExists) {\n      generate = true\n    }\n    if (!generate) {\n      return [avatarExists ? avatarPath : USER_DEFAULT_AVATAR_FILE_PATH, avatarExists ? pngMimeType : svgMimeType]\n    }\n    if (!(await isPathExists(UserModel.getHomePath(userLogin)))) {\n      throw new HttpException(`Home path for user *${userLogin}* does not exist`, HttpStatus.FORBIDDEN)\n    }\n    const user: Partial<UserModel> = await this.findUser(userLogin)\n    if (!user) {\n      throw new HttpException(`avatar not found`, HttpStatus.NOT_FOUND)\n    }\n    const avatarFile: WriteStream = createWriteStream(avatarPath)\n    const avatarStream: NodeJS.ReadableStream = await generateAvatar(user.getInitials())\n    try {\n      await pipeline(avatarStream, avatarFile)\n    } catch (e) {\n      this.logger.error(`${this.updateAvatar.name} - ${e}`)\n      throw new HttpException('Unable to create avatar', HttpStatus.INTERNAL_SERVER_ERROR)\n    }\n    if (generateIsNotExists) {\n      return [avatarPath, pngMimeType]\n    }\n  }\n\n  async listAppPasswords(user: UserModel): Promise<Omit<UserAppPassword, 'password'>[]> {\n    const secrets = await this.usersQueries.getUserSecrets(user.id)\n    if (Array.isArray(secrets.appPasswords)) {\n      // remove passwords from response\n      return secrets.appPasswords.map(({ password, ...rest }: UserAppPassword) => rest)\n    }\n    return []\n  }\n\n  async generateAppPassword(user: UserModel, userAppPasswordDto: UserAppPasswordDto): Promise<UserAppPassword> {\n    const secrets = await this.usersQueries.getUserSecrets(user.id)\n    const slugName = createLightSlug(userAppPasswordDto.name)\n    if (Array.isArray(secrets.appPasswords) && secrets.appPasswords.find((p: UserAppPassword) => p.name === slugName)) {\n      throw new HttpException('Name already used', HttpStatus.BAD_REQUEST)\n    }\n    secrets.appPasswords = Array.isArray(secrets.appPasswords) ? secrets.appPasswords : []\n    const clearPassword = genPassword(24)\n    const appPassword: UserAppPassword = {\n      name: createLightSlug(userAppPasswordDto.name),\n      app: userAppPasswordDto.app,\n      expiration: userAppPasswordDto.expiration,\n      password: await hashPassword(clearPassword),\n      createdAt: new Date(),\n      currentIp: null,\n      currentAccess: null,\n      lastIp: null,\n      lastAccess: null\n    }\n    secrets.appPasswords.unshift(appPassword)\n    if (!(await this.usersQueries.updateUserOrGuest(user.id, { secrets: secrets }))) {\n      throw new HttpException('Unable to update app passwords', HttpStatus.INTERNAL_SERVER_ERROR)\n    }\n    // return clear password only once\n    return { ...appPassword, password: clearPassword }\n  }\n\n  async deleteAppPassword(user: UserModel, passwordName: string): Promise<void> {\n    const secrets = await this.usersQueries.getUserSecrets(user.id)\n    if (!Array.isArray(secrets.appPasswords) || !secrets.appPasswords.find((p: UserAppPassword) => p.name === passwordName)) {\n      throw new HttpException('App password not found', HttpStatus.NOT_FOUND)\n    }\n    secrets.appPasswords = secrets.appPasswords.filter((p: UserAppPassword) => p.name !== passwordName)\n    if (!(await this.usersQueries.updateUserOrGuest(user.id, { secrets: secrets }))) {\n      throw new HttpException('Unable to delete app password', HttpStatus.INTERNAL_SERVER_ERROR)\n    }\n  }\n\n  async validateAppPassword(user: UserModel, password: string, ip: string, scope: AUTH_SCOPE): Promise<boolean> {\n    if (!scope || !user.haveRole(USER_ROLE.USER)) return false\n    const secrets = await this.usersQueries.getUserSecrets(user.id)\n    if (!Array.isArray(secrets.appPasswords)) return false\n    for (const p of secrets.appPasswords) {\n      if (p.app !== scope) continue\n      const expMs = p.expiration ? new Date(p.expiration) : null\n      if (p.expiration && new Date() > expMs) continue // expired\n      if (await comparePassword(password, p.password)) {\n        p.lastAccess = p.currentAccess\n        p.currentAccess = new Date()\n        p.lastIp = p.currentIp\n        p.currentIp = ip\n        // update accesses\n        this.usersQueries\n          .updateUserOrGuest(user.id, { secrets: secrets })\n          .catch((e: Error) => this.logger.error(`${this.validateAppPassword.name} - ${e}`))\n        return true\n      }\n    }\n    return false\n  }\n\n  setOnlineStatus(user: JwtIdentityPayload, onlineStatus: USER_ONLINE_STATUS) {\n    this.usersQueries.setOnlineStatus(user.id, onlineStatus).catch((e: Error) => this.logger.error(`${this.setOnlineStatus.name} - ${e}`))\n  }\n\n  getOnlineUsers(userIds: number[]): Promise<UserOnline[]> {\n    return this.usersQueries.getOnlineUsers(userIds)\n  }\n\n  async usersWhitelist(userId: number): Promise<number[]> {\n    return this.usersQueries.usersWhitelist(userId)\n  }\n\n  async browseGroups(user: UserModel, name: string): Promise<GroupBrowse> {\n    if (name) {\n      const group: Pick<Group, 'id' | 'name' | 'type'> & { role: UserGroup['role'] } = await this.usersQueries.groupFromName(user.id, name)\n      if (!group) {\n        throw new HttpException('Group not found', HttpStatus.NOT_FOUND)\n      }\n      return { parentGroup: group, members: await this.usersQueries.browseGroupMembers(group.id) }\n    }\n    return { parentGroup: undefined, members: await this.usersQueries.browseRootGroups(user.id) }\n  }\n\n  async getGroup(user: UserModel, groupId: number, withMembers?: true, asAdmin?: boolean): Promise<GroupWithMembers>\n  async getGroup(user: UserModel, groupId: number, withMembers: false, asAdmin?: boolean): Promise<GroupMember>\n  async getGroup(user: UserModel, groupId: number, withMembers = true, asAdmin = false): Promise<GroupMember | GroupWithMembers> {\n    const group = withMembers\n      ? await this.usersQueries.getGroupWithMembers(user.id, groupId, asAdmin)\n      : await this.usersQueries.getGroup(user.id, groupId, asAdmin)\n    if (!group) {\n      throw new HttpException('You are not allowed to do this action', HttpStatus.FORBIDDEN)\n    }\n    return group\n  }\n\n  async createPersonalGroup(user: UserModel, userCreateOrUpdateGroupDto: UserCreateOrUpdateGroupDto): Promise<GroupMember> {\n    if (!userCreateOrUpdateGroupDto.name) {\n      this.logger.error(`${this.createPersonalGroup.name} - missing group name : ${JSON.stringify(userCreateOrUpdateGroupDto)}`)\n      throw new HttpException('Group name is missing', HttpStatus.BAD_REQUEST)\n    }\n    if (await this.usersQueries.checkGroupNameExists(userCreateOrUpdateGroupDto.name)) {\n      throw new HttpException('Name already used', HttpStatus.BAD_REQUEST)\n    }\n    try {\n      const groupId: number = await this.usersQueries.createPersonalGroup(user.id, userCreateOrUpdateGroupDto)\n      this.logger.log(`${this.createPersonalGroup.name} - group (${groupId}) was created : ${JSON.stringify(userCreateOrUpdateGroupDto)}`)\n      // clear user whitelists\n      this.usersQueries.clearWhiteListCaches([user.id])\n      return this.getGroup(user, groupId, false)\n    } catch (e) {\n      this.logger.error(`${this.createPersonalGroup.name} - group was not created : ${JSON.stringify(userCreateOrUpdateGroupDto)} : ${e}`)\n      throw new HttpException('Unable to create group', HttpStatus.INTERNAL_SERVER_ERROR)\n    }\n  }\n\n  async updatePersonalGroup(user: UserModel, groupId: number, userCreateOrUpdateGroupDto: UserCreateOrUpdateGroupDto): Promise<GroupMember> {\n    if (!Object.keys(userCreateOrUpdateGroupDto).length) {\n      throw new HttpException('No changes to update', HttpStatus.BAD_REQUEST)\n    }\n    const currentGroup: GroupMember = await this.getGroup(user, groupId, false, user.isAdmin)\n    if (currentGroup.type !== MEMBER_TYPE.PGROUP) {\n      throw new HttpException('You are not allowed to do this action', HttpStatus.FORBIDDEN)\n    }\n    if (userCreateOrUpdateGroupDto.name && (await this.usersQueries.checkGroupNameExists(userCreateOrUpdateGroupDto.name))) {\n      throw new HttpException('Name already used', HttpStatus.BAD_REQUEST)\n    }\n    try {\n      await this.usersQueries.updateGroup(groupId, userCreateOrUpdateGroupDto)\n    } catch (e) {\n      throw new HttpException(e.message, HttpStatus.INTERNAL_SERVER_ERROR)\n    }\n    return this.getGroup(user, groupId, false, user.isAdmin)\n  }\n\n  async addUsersToGroup(user: UserModel, groupId: number, userIds: number[]): Promise<void> {\n    const currentGroup: GroupWithMembers = await this.getGroup(user, groupId)\n    // only users can be added to users groups\n    // guests and users can be added to personal groups\n    const userWhiteList: number[] = await this.usersQueries.usersWhitelist(\n      user.id,\n      currentGroup.type === MEMBER_TYPE.GROUP ? USER_ROLE.USER : undefined\n    )\n    // ignore user ids that are already group members & filter on user ids allowed to current user\n    userIds = userIds.filter((id) => !currentGroup.members.find((m) => m.id === id)).filter((id) => userWhiteList.indexOf(id) > -1)\n    if (!userIds.length) {\n      throw new HttpException('No users to add to group', HttpStatus.BAD_REQUEST)\n    }\n    return this.usersQueries.updateGroupMembers(groupId, { add: userIds.map((id) => ({ id: id, groupRole: USER_GROUP_ROLE.MEMBER })) })\n  }\n\n  async updateUserFromPersonalGroup(user: UserModel, groupId: number, userId: number, updateUserFromGroupDto: UpdateUserFromGroupDto): Promise<void> {\n    const currentGroup: GroupWithMembers = await this.getGroup(user, groupId)\n    if (currentGroup.type !== MEMBER_TYPE.PGROUP) {\n      throw new HttpException('You are not allowed to do this action', HttpStatus.FORBIDDEN)\n    }\n    const userToUpdate = currentGroup.members.find((m) => m.id === userId)\n    if (!userToUpdate) {\n      throw new HttpException('User was not found', HttpStatus.BAD_REQUEST)\n    }\n    if (userToUpdate.groupRole !== updateUserFromGroupDto.role) {\n      if (userToUpdate.groupRole === USER_GROUP_ROLE.MANAGER) {\n        if (currentGroup.members.filter((m) => m.groupRole === USER_GROUP_ROLE.MANAGER).length === 1) {\n          throw new HttpException('Group must have at least one manager', HttpStatus.BAD_REQUEST)\n        }\n      }\n      return this.adminUsersManager.updateUserFromGroup(groupId, userId, updateUserFromGroupDto)\n    }\n  }\n\n  async removeUserFromGroup(user: UserModel, groupId: number, userId: number): Promise<void> {\n    const currentGroup: GroupWithMembers = await this.getGroup(user, groupId)\n    const userToRemove = currentGroup.members.find((m) => m.id === userId)\n    if (!userToRemove) {\n      throw new HttpException('User was not found', HttpStatus.BAD_REQUEST)\n    }\n    if (userToRemove.groupRole === USER_GROUP_ROLE.MANAGER) {\n      if (currentGroup.type === MEMBER_TYPE.GROUP) {\n        throw new HttpException('You are not allowed to do this action', HttpStatus.FORBIDDEN)\n      }\n      if (currentGroup.members.filter((m) => m.groupRole === USER_GROUP_ROLE.MANAGER).length === 1) {\n        throw new HttpException('Group must have at least one manager', HttpStatus.BAD_REQUEST)\n      }\n    }\n    return this.usersQueries.updateGroupMembers(groupId, { remove: [userId] })\n  }\n\n  async leavePersonalGroup(user: UserModel, groupId: number): Promise<void> {\n    const currentGroup: GroupWithMembers = await this.usersQueries.getGroupWithMembers(user.id, groupId, true)\n    if (!currentGroup || currentGroup.type === MEMBER_TYPE.GROUP) {\n      throw new HttpException('You are not allowed to do this action', HttpStatus.FORBIDDEN)\n    }\n    const userWhoLeaves = currentGroup.members.find((m) => m.id === user.id)\n    if (!userWhoLeaves) {\n      throw new HttpException('User was not found', HttpStatus.BAD_REQUEST)\n    }\n    if (userWhoLeaves.groupRole === USER_GROUP_ROLE.MANAGER) {\n      if (currentGroup.members.filter((m) => m.groupRole === USER_GROUP_ROLE.MANAGER).length === 1) {\n        throw new HttpException('Group must have at least one manager', HttpStatus.BAD_REQUEST)\n      }\n    }\n    try {\n      await this.usersQueries.updateGroupMembers(groupId, { remove: [user.id] })\n      this.logger.log(`${this.leavePersonalGroup.name} - user (${user.id}) has left group (${groupId})`)\n    } catch (e) {\n      this.logger.error(`${this.leavePersonalGroup.name} - user (${user.id}) has not left group (${groupId}) : ${e}`)\n      throw new HttpException(e.message, HttpStatus.INTERNAL_SERVER_ERROR)\n    }\n  }\n\n  async deletePersonalGroup(user: UserModel, groupId: number): Promise<void> {\n    if (!(await this.usersQueries.canDeletePersonalGroup(user.id, groupId))) {\n      throw new HttpException('You are not allowed to do this action', HttpStatus.FORBIDDEN)\n    }\n    if (await this.usersQueries.deletePersonalGroup(groupId)) {\n      this.logger.log(`${this.deletePersonalGroup.name} - group (${groupId}) was deleted`)\n    } else {\n      this.logger.warn(`${this.deletePersonalGroup.name} - group (${groupId}) does not exist`)\n      throw new HttpException('Unable to delete group', HttpStatus.BAD_REQUEST)\n    }\n  }\n\n  listGuests(user: UserModel): Promise<GuestUser[]> {\n    return this.usersQueries.listGuests(null, user.id)\n  }\n\n  async getGuest(user: UserModel, guestId: number): Promise<GuestUser> {\n    const guest: GuestUser = await this.usersQueries.listGuests(guestId, user.id)\n    this.adminUsersManager.checkUser(guest, true)\n    return guest\n  }\n\n  async createGuest(user: UserModel, createGuestDto: CreateUserDto): Promise<GuestUser> {\n    // filter managers that are allowed for current user\n    const userWhiteList = await this.usersQueries.usersWhitelist(user.id, USER_ROLE.USER)\n    createGuestDto.managers = createGuestDto.managers.filter((id) => userWhiteList.indexOf(id) > -1)\n    if (createGuestDto.managers.indexOf(user.id) === -1) {\n      // force user as manager during creation\n      createGuestDto.managers.push(user.id)\n    }\n    // clear user whitelists\n    this.usersQueries.clearWhiteListCaches([user.id])\n    return this.adminUsersManager.createUserOrGuest(createGuestDto, USER_ROLE.GUEST, true)\n  }\n\n  async updateGuest(user: UserModel, guestId: number, updateGuestDto: UpdateUserDto): Promise<GuestUser> {\n    if (!Object.keys(updateGuestDto).length) {\n      throw new HttpException('No changes to update', HttpStatus.BAD_REQUEST)\n    }\n    if (updateGuestDto.managers) {\n      // filter managers that are allowed for current user\n      const userWhiteList = await this.usersQueries.usersWhitelist(user.id, USER_ROLE.USER)\n      updateGuestDto.managers = updateGuestDto.managers.filter((id) => userWhiteList.indexOf(id) > -1)\n      if (!updateGuestDto.managers.length) {\n        throw new HttpException('Guest must have at least one manager', HttpStatus.BAD_REQUEST)\n      }\n    }\n    if (!(await this.usersQueries.isGuestManager(user.id, guestId))) {\n      throw new HttpException('You are not allowed to do this action', HttpStatus.FORBIDDEN)\n    }\n    const guest = await this.adminUsersManager.updateUserOrGuest(guestId, updateGuestDto, USER_ROLE.GUEST)\n    return guest.managers.find((m) => m.id === user.id) ? guest : null\n  }\n\n  async deleteGuest(user: UserModel, guestId: number): Promise<void> {\n    const guest = await this.usersQueries.isGuestManager(user.id, guestId)\n    if (!guest) {\n      throw new HttpException('You are not allowed to do this action', HttpStatus.FORBIDDEN)\n    }\n    // guest has no space but a temporary directory\n    return this.adminUsersManager.deleteUserOrGuest(guest.id, guest.login, { deleteSpace: true, isGuest: true })\n  }\n\n  searchMembers(user: UserModel, searchMembersDto: SearchMembersDto): Promise<Member[]> {\n    return this.usersQueries.searchUsersOrGroups(searchMembersDto, user.id)\n  }\n\n  private notifyAccountLocked(user: UserModel, ip: string) {\n    this.notificationsManager\n      .sendEmailNotification([user], {\n        app: NOTIFICATION_APP.AUTH_LOCKED,\n        event: NOTIFICATION_APP_EVENT.AUTH_LOCKED[ACTION.DELETE],\n        element: null,\n        url: ip\n      })\n      .catch((e: Error) => this.logger.error(`${this.validateUserAccess.name} - ${e}`))\n  }\n}\n"],"names":["UsersManager","fromUserId","id","user","usersQueries","from","UserModel","findUser","loginOrEmail","removePassword","logUser","password","ip","scope","validateUserAccess","authSuccess","comparePassword","validateAppPassword","updateAccesses","catch","e","logger","error","name","makePaths","warn","login","role","USER_ROLE","LINK","HttpException","HttpStatus","FORBIDDEN","isActive","passwordAttempts","USER_MAX_PASSWORD_ATTEMPTS","notifyAccountLocked","me","authUser","NOT_FOUND","impersonated","impersonatedFromId","clientId","server","serverConfig","compareUserPassword","userId","updateLanguage","userLanguageDto","language","updateUserOrGuest","INTERNAL_SERVER_ERROR","updatePassword","userPasswordDto","r","selectUserProperties","oldPassword","BAD_REQUEST","hash","bcrypt","newPassword","updateNotification","userNotificationDto","updateStorageIndexing","userStorageIndexingDto","updateAvatar","req","part","file","limits","fileSize","USER_AVATAR_MAX_UPLOAD_SIZE","mimetype","startsWith","dstPath","path","join","tmpPath","USER_AVATAR_FILE_NAME","pipeline","createWriteStream","truncated","PAYLOAD_TOO_LARGE","moveFiles","homePath","updateSecrets","secrets","userSecrets","getUserSecrets","updatedSecrets","success","isAuthTwoFa","configuration","auth","mfa","totp","enabled","twoFaEnabled","Math","min","lastAccess","currentAccess","Date","lastIp","currentIp","getAvatar","userLogin","generate","generateIsNotExists","avatarPath","getHomePath","avatarExists","isPathExists","USER_DEFAULT_AVATAR_FILE_PATH","pngMimeType","svgMimeType","avatarFile","avatarStream","generateAvatar","getInitials","listAppPasswords","Array","isArray","appPasswords","map","rest","generateAppPassword","userAppPasswordDto","slugName","createLightSlug","find","p","clearPassword","genPassword","appPassword","app","expiration","hashPassword","createdAt","unshift","deleteAppPassword","passwordName","filter","haveRole","USER","expMs","setOnlineStatus","onlineStatus","getOnlineUsers","userIds","usersWhitelist","browseGroups","group","groupFromName","parentGroup","members","browseGroupMembers","undefined","browseRootGroups","getGroup","groupId","withMembers","asAdmin","getGroupWithMembers","createPersonalGroup","userCreateOrUpdateGroupDto","JSON","stringify","checkGroupNameExists","log","clearWhiteListCaches","updatePersonalGroup","Object","keys","length","currentGroup","isAdmin","type","MEMBER_TYPE","PGROUP","updateGroup","message","addUsersToGroup","userWhiteList","GROUP","m","indexOf","updateGroupMembers","add","groupRole","USER_GROUP_ROLE","MEMBER","updateUserFromPersonalGroup","updateUserFromGroupDto","userToUpdate","MANAGER","adminUsersManager","updateUserFromGroup","removeUserFromGroup","userToRemove","remove","leavePersonalGroup","userWhoLeaves","deletePersonalGroup","canDeletePersonalGroup","listGuests","getGuest","guestId","guest","checkUser","createGuest","createGuestDto","managers","push","createUserOrGuest","GUEST","updateGuest","updateGuestDto","isGuestManager","deleteGuest","deleteUserOrGuest","deleteSpace","isGuest","searchMembers","searchMembersDto","searchUsersOrGroups","notificationsManager","sendEmailNotification","NOTIFICATION_APP","AUTH_LOCKED","event","NOTIFICATION_APP_EVENT","ACTION","DELETE","element","url","Logger"],"mappings":"AAAA;;;;CAIC;;;;+BAgDYA;;;eAAAA;;;wBA7CiD;iEAC3C;wBAEe;iEACjB;0BACQ;2BAKF;2BACuB;uBACW;wBACZ;mCACD;uBACJ;+BACiB;6CACpB;wBACT;sBAC+D;2BAiBjE;wBAIwE;0CAChE;qCACL;;;;;;;;;;;;;;;AAGtB,IAAA,AAAMA,eAAN,MAAMA;IASX,MAAMC,WAAWC,EAAU,EAAsB;QAC/C,MAAMC,OAAa,MAAM,IAAI,CAACC,YAAY,CAACC,IAAI,CAACH;QAChD,OAAOC,OAAO,IAAIG,oBAAS,CAACH,MAAM,QAAQ;IAC5C;IAIA,MAAMI,SAASC,YAAoB,EAAEC,iBAA0B,IAAI,EAAwC;QACzG,MAAMN,OAAa,MAAM,IAAI,CAACC,YAAY,CAACC,IAAI,CAAC,MAAMG;QACtD,OAAOL,OAAO,IAAIG,oBAAS,CAACH,MAAMM,kBAAkB;IACtD;IAEA,MAAMC,QAAQP,IAAe,EAAEQ,QAAgB,EAAEC,EAAU,EAAEC,KAAkB,EAAsB;QACnG,IAAI,CAACC,kBAAkB,CAACX,MAAMS;QAC9B,IAAIG,cAAuB,MAAMC,IAAAA,0BAAe,EAACL,UAAUR,KAAKQ,QAAQ;QACxE,IAAI,CAACI,eAAeF,OAAO;YACzBE,cAAc,MAAM,IAAI,CAACE,mBAAmB,CAACd,MAAMQ,UAAUC,IAAIC;QACnE;QACA,IAAI,CAACK,cAAc,CAACf,MAAMS,IAAIG,aAAaI,KAAK,CAAC,CAACC,IAAa,IAAI,CAACC,MAAM,CAACC,KAAK,CAAC,GAAG,IAAI,CAACZ,OAAO,CAACa,IAAI,CAAC,GAAG,EAAEH,GAAG;QAC9G,IAAIL,aAAa;YACf,MAAMZ,KAAKqB,SAAS;YACpB,OAAOrB;QACT;QACA,IAAI,CAACkB,MAAM,CAACI,IAAI,CAAC,GAAG,IAAI,CAACf,OAAO,CAACa,IAAI,CAAC,qBAAqB,EAAEpB,KAAKuB,KAAK,CAAC,CAAC,CAAC;QAC1E,OAAO;IACT;IAEAZ,mBAAmBX,IAAe,EAAES,EAAU,EAAE;QAC9C,IAAIT,KAAKwB,IAAI,KAAKC,eAAS,CAACC,IAAI,EAAE;YAChC,IAAI,CAACR,MAAM,CAACC,KAAK,CAAC,GAAG,IAAI,CAACR,kBAAkB,CAACS,IAAI,CAAC,sBAAsB,EAAEpB,KAAK,2BAA2B,CAAC;YAC3G,MAAM,IAAI2B,qBAAa,CAAC,0BAA0BC,kBAAU,CAACC,SAAS;QACxE;QACA,IAAI,CAAC7B,KAAK8B,QAAQ,IAAI9B,KAAK+B,gBAAgB,IAAIC,gCAA0B,EAAE;YACzE,IAAI,CAACjB,cAAc,CAACf,MAAMS,IAAI,OAAOO,KAAK,CAAC,CAACC,IAAa,IAAI,CAACC,MAAM,CAACC,KAAK,CAAC,GAAG,IAAI,CAACR,kBAAkB,CAACS,IAAI,CAAC,GAAG,EAAEH,GAAG;YACnH,IAAI,CAACC,MAAM,CAACC,KAAK,CAAC,GAAG,IAAI,CAACR,kBAAkB,CAACS,IAAI,CAAC,iBAAiB,EAAEpB,KAAKuB,KAAK,CAAC,WAAW,CAAC;YAC5F,IAAI,CAACU,mBAAmB,CAACjC,MAAMS;YAC/B,MAAM,IAAIkB,qBAAa,CAAC,kBAAkBC,kBAAU,CAACC,SAAS;QAChE;IACF;IAEA,MAAMK,GAAGC,QAAmB,EAA4C;QACtE,MAAMnC,OAAO,MAAM,IAAI,CAACF,UAAU,CAACqC,SAASpC,EAAE;QAC9C,IAAI,CAACC,MAAM;YACT,IAAI,CAACkB,MAAM,CAACI,IAAI,CAAC,CAAC,MAAM,EAAEa,SAASZ,KAAK,CAAC,EAAE,EAAEY,SAASpC,EAAE,CAAC,WAAW,CAAC;YACrE,MAAM,IAAI4B,qBAAa,CAAC,CAAC,cAAc,CAAC,EAAEC,kBAAU,CAACQ,SAAS;QAChE;QACApC,KAAKqC,YAAY,GAAG,CAAC,CAACF,SAASG,kBAAkB;QACjDtC,KAAKuC,QAAQ,GAAGJ,SAASI,QAAQ;QACjC,OAAO;YAAEvC,MAAMA;YAAMwC,QAAQC,+BAAY;QAAC;IAC5C;IAEA,MAAMC,oBAAoBC,MAAc,EAAEnC,QAAgB,EAAoB;QAC5E,OAAO,IAAI,CAACP,YAAY,CAACyC,mBAAmB,CAACC,QAAQnC;IACvD;IAEA,MAAMoC,eAAe5C,IAAe,EAAE6C,eAAgC,EAAE;QACtE,IAAI,CAACA,gBAAgBC,QAAQ,EAAED,gBAAgBC,QAAQ,GAAG;QAC1D,IAAI,CAAE,MAAM,IAAI,CAAC7C,YAAY,CAAC8C,iBAAiB,CAAC/C,KAAKD,EAAE,EAAE8C,kBAAmB;YAC1E,MAAM,IAAIlB,qBAAa,CAAC,6BAA6BC,kBAAU,CAACoB,qBAAqB;QACvF;IACF;IAEA,MAAMC,eAAejD,IAAe,EAAEkD,eAAsC,EAAE;QAC5E,MAAMC,IAAI,MAAM,IAAI,CAAClD,YAAY,CAACmD,oBAAoB,CAACpD,KAAKD,EAAE,EAAE;YAAC;SAAW;QAC5E,IAAI,CAACoD,GAAG;YACN,MAAM,IAAIxB,qBAAa,CAAC,4BAA4BC,kBAAU,CAACQ,SAAS;QAC1E;QACA,IAAI,CAAE,MAAMvB,IAAAA,0BAAe,EAACqC,gBAAgBG,WAAW,EAAEF,EAAE3C,QAAQ,GAAI;YACrE,MAAM,IAAImB,qBAAa,CAAC,qBAAqBC,kBAAU,CAAC0B,WAAW;QACrE;QACA,MAAMC,OAAO,MAAMC,iBAAM,CAACD,IAAI,CAACL,gBAAgBO,WAAW,EAAE;QAC5D,IAAI,CAAE,MAAM,IAAI,CAACxD,YAAY,CAAC8C,iBAAiB,CAAC/C,KAAKD,EAAE,EAAE;YAAES,UAAU+C;QAAK,IAAK;YAC7E,MAAM,IAAI5B,qBAAa,CAAC,6BAA6BC,kBAAU,CAACoB,qBAAqB;QACvF;IACF;IAEA,MAAMU,mBAAmB1D,IAAe,EAAE2D,mBAAwC,EAAE;QAClF,IAAI,CAAE,MAAM,IAAI,CAAC1D,YAAY,CAAC8C,iBAAiB,CAAC/C,KAAKD,EAAE,EAAE4D,sBAAuB;YAC9E,MAAM,IAAIhC,qBAAa,CAAC,4CAA4CC,kBAAU,CAACoB,qBAAqB;QACtG;IACF;IAEA,MAAMY,sBAAsB5D,IAAe,EAAE6D,sBAA8C,EAAE;QAC3F,IAAI,CAAE,MAAM,IAAI,CAAC5D,YAAY,CAAC8C,iBAAiB,CAAC/C,KAAKD,EAAE,EAAE8D,yBAA0B;YACjF,MAAM,IAAIlC,qBAAa,CAAC,gDAAgDC,kBAAU,CAACoB,qBAAqB;QAC1G;IACF;IAEA,MAAMc,aAAaC,GAAgC,EAAE;QACnD,MAAMC,OAAsB,MAAMD,IAAIE,IAAI,CAAC;YAAEC,QAAQ;gBAAEC,UAAUC,mCAA2B;YAAC;QAAE;QAC/F,IAAI,CAACJ,KAAKK,QAAQ,CAACC,UAAU,CAAC,WAAW;YACvC,MAAM,IAAI3C,qBAAa,CAAC,yBAAyBC,kBAAU,CAAC0B,WAAW;QACzE;QACA,MAAMiB,UAAUC,iBAAI,CAACC,IAAI,CAACV,IAAI/D,IAAI,CAAC0E,OAAO,EAAEC,6BAAqB;QACjE,IAAI;YACF,MAAMC,IAAAA,kBAAQ,EAACZ,KAAKC,IAAI,EAAEY,IAAAA,yBAAiB,EAACN;QAC9C,EAAE,OAAOtD,GAAG;YACV,IAAI,CAACC,MAAM,CAACC,KAAK,CAAC,GAAG,IAAI,CAAC2C,YAAY,CAAC1C,IAAI,CAAC,GAAG,EAAEH,GAAG;YACpD,MAAM,IAAIU,qBAAa,CAAC,2BAA2BC,kBAAU,CAACoB,qBAAqB;QACrF;QACA,IAAIgB,KAAKC,IAAI,CAACa,SAAS,EAAE;YACvB,IAAI,CAAC5D,MAAM,CAACI,IAAI,CAAC,GAAG,IAAI,CAACwC,YAAY,CAAC1C,IAAI,CAAC,qBAAqB,CAAC;YACjE,MAAM,IAAIO,qBAAa,CAAC,gCAAgCC,kBAAU,CAACmD,iBAAiB;QACtF;QACA,IAAI;YACF,MAAMC,IAAAA,gBAAS,EAACT,SAASC,iBAAI,CAACC,IAAI,CAACV,IAAI/D,IAAI,CAACiF,QAAQ,EAAEN,6BAAqB,GAAG;QAChF,EAAE,OAAO1D,GAAG;YACV,IAAI,CAACC,MAAM,CAACC,KAAK,CAAC,GAAG,IAAI,CAAC2C,YAAY,CAAC1C,IAAI,CAAC,GAAG,EAAEH,GAAG;YACpD,MAAM,IAAIU,qBAAa,CAAC,2BAA2BC,kBAAU,CAACoB,qBAAqB;QACrF;IACF;IAEA,MAAMkC,cAAcvC,MAAc,EAAEwC,OAAoB,EAAE;QACxD,MAAMC,cAAc,MAAM,IAAI,CAACnF,YAAY,CAACoF,cAAc,CAAC1C;QAC3D,MAAM2C,iBAAiB;YAAE,GAAGF,WAAW;YAAE,GAAGD,OAAO;QAAC;QACpD,IAAI,CAAE,MAAM,IAAI,CAAClF,YAAY,CAAC8C,iBAAiB,CAACJ,QAAQ;YAAEwC,SAASG;QAAe,IAAK;YACrF,MAAM,IAAI3D,qBAAa,CAAC,4BAA4BC,kBAAU,CAACoB,qBAAqB;QACtF;IACF;IAEA,MAAMjC,eAAef,IAAe,EAAES,EAAU,EAAE8E,OAAgB,EAAEC,cAAc,KAAK,EAAE;QACvF,IAAIzD;QACJ,IAAI,CAACyD,eAAeC,gCAAa,CAACC,IAAI,CAACC,GAAG,CAACC,IAAI,CAACC,OAAO,IAAI7F,KAAK8F,YAAY,EAAE;YAC5E,4EAA4E;YAC5E/D,mBAAmB/B,KAAK+B,gBAAgB;QAC1C,OAAO;YACLA,mBAAmBwD,UAAU,IAAIQ,KAAKC,GAAG,CAAChG,KAAK+B,gBAAgB,GAAG,GAAGC,gCAA0B;QACjG;QACA,MAAM,IAAI,CAAC/B,YAAY,CAAC8C,iBAAiB,CAAC/C,KAAKD,EAAE,EAAE;YACjDkG,YAAYjG,KAAKkG,aAAa;YAC9BA,eAAe,IAAIC;YACnBC,QAAQpG,KAAKqG,SAAS;YACtBA,WAAW5F;YACXsB,kBAAkBA;YAClBD,UAAU9B,KAAK8B,QAAQ,IAAIC,mBAAmBC,gCAA0B;QAC1E;IACF;IAIA,MAAMsE,UAAUC,SAAiB,EAAEC,WAAoB,KAAK,EAAEC,mBAA6B,EAAyC;QAClI,MAAMC,aAAalC,iBAAI,CAACC,IAAI,CAACtE,oBAAS,CAACwG,WAAW,CAACJ,YAAY5B,6BAAqB;QACpF,MAAMiC,eAAe,MAAMC,IAAAA,mBAAY,EAACH;QACxC,IAAI,CAACE,gBAAgBH,qBAAqB;YACxCD,WAAW;QACb;QACA,IAAI,CAACA,UAAU;YACb,OAAO;gBAACI,eAAeF,aAAaI,qCAA6B;gBAAEF,eAAeG,kBAAW,GAAGC,kBAAW;aAAC;QAC9G;QACA,IAAI,CAAE,MAAMH,IAAAA,mBAAY,EAAC1G,oBAAS,CAACwG,WAAW,CAACJ,aAAc;YAC3D,MAAM,IAAI5E,qBAAa,CAAC,CAAC,oBAAoB,EAAE4E,UAAU,gBAAgB,CAAC,EAAE3E,kBAAU,CAACC,SAAS;QAClG;QACA,MAAM7B,OAA2B,MAAM,IAAI,CAACI,QAAQ,CAACmG;QACrD,IAAI,CAACvG,MAAM;YACT,MAAM,IAAI2B,qBAAa,CAAC,CAAC,gBAAgB,CAAC,EAAEC,kBAAU,CAACQ,SAAS;QAClE;QACA,MAAM6E,aAA0BpC,IAAAA,yBAAiB,EAAC6B;QAClD,MAAMQ,eAAsC,MAAMC,IAAAA,qBAAc,EAACnH,KAAKoH,WAAW;QACjF,IAAI;YACF,MAAMxC,IAAAA,kBAAQ,EAACsC,cAAcD;QAC/B,EAAE,OAAOhG,GAAG;YACV,IAAI,CAACC,MAAM,CAACC,KAAK,CAAC,GAAG,IAAI,CAAC2C,YAAY,CAAC1C,IAAI,CAAC,GAAG,EAAEH,GAAG;YACpD,MAAM,IAAIU,qBAAa,CAAC,2BAA2BC,kBAAU,CAACoB,qBAAqB;QACrF;QACA,IAAIyD,qBAAqB;YACvB,OAAO;gBAACC;gBAAYK,kBAAW;aAAC;QAClC;IACF;IAEA,MAAMM,iBAAiBrH,IAAe,EAAgD;QACpF,MAAMmF,UAAU,MAAM,IAAI,CAAClF,YAAY,CAACoF,cAAc,CAACrF,KAAKD,EAAE;QAC9D,IAAIuH,MAAMC,OAAO,CAACpC,QAAQqC,YAAY,GAAG;YACvC,iCAAiC;YACjC,OAAOrC,QAAQqC,YAAY,CAACC,GAAG,CAAC,CAAC,EAAEjH,QAAQ,EAAE,GAAGkH,MAAuB,GAAKA;QAC9E;QACA,OAAO,EAAE;IACX;IAEA,MAAMC,oBAAoB3H,IAAe,EAAE4H,kBAAsC,EAA4B;QAC3G,MAAMzC,UAAU,MAAM,IAAI,CAAClF,YAAY,CAACoF,cAAc,CAACrF,KAAKD,EAAE;QAC9D,MAAM8H,WAAWC,IAAAA,uBAAe,EAACF,mBAAmBxG,IAAI;QACxD,IAAIkG,MAAMC,OAAO,CAACpC,QAAQqC,YAAY,KAAKrC,QAAQqC,YAAY,CAACO,IAAI,CAAC,CAACC,IAAuBA,EAAE5G,IAAI,KAAKyG,WAAW;YACjH,MAAM,IAAIlG,qBAAa,CAAC,qBAAqBC,kBAAU,CAAC0B,WAAW;QACrE;QACA6B,QAAQqC,YAAY,GAAGF,MAAMC,OAAO,CAACpC,QAAQqC,YAAY,IAAIrC,QAAQqC,YAAY,GAAG,EAAE;QACtF,MAAMS,gBAAgBC,IAAAA,mBAAW,EAAC;QAClC,MAAMC,cAA+B;YACnC/G,MAAM0G,IAAAA,uBAAe,EAACF,mBAAmBxG,IAAI;YAC7CgH,KAAKR,mBAAmBQ,GAAG;YAC3BC,YAAYT,mBAAmBS,UAAU;YACzC7H,UAAU,MAAM8H,IAAAA,uBAAY,EAACL;YAC7BM,WAAW,IAAIpC;YACfE,WAAW;YACXH,eAAe;YACfE,QAAQ;YACRH,YAAY;QACd;QACAd,QAAQqC,YAAY,CAACgB,OAAO,CAACL;QAC7B,IAAI,CAAE,MAAM,IAAI,CAAClI,YAAY,CAAC8C,iBAAiB,CAAC/C,KAAKD,EAAE,EAAE;YAAEoF,SAASA;QAAQ,IAAK;YAC/E,MAAM,IAAIxD,qBAAa,CAAC,kCAAkCC,kBAAU,CAACoB,qBAAqB;QAC5F;QACA,kCAAkC;QAClC,OAAO;YAAE,GAAGmF,WAAW;YAAE3H,UAAUyH;QAAc;IACnD;IAEA,MAAMQ,kBAAkBzI,IAAe,EAAE0I,YAAoB,EAAiB;QAC5E,MAAMvD,UAAU,MAAM,IAAI,CAAClF,YAAY,CAACoF,cAAc,CAACrF,KAAKD,EAAE;QAC9D,IAAI,CAACuH,MAAMC,OAAO,CAACpC,QAAQqC,YAAY,KAAK,CAACrC,QAAQqC,YAAY,CAACO,IAAI,CAAC,CAACC,IAAuBA,EAAE5G,IAAI,KAAKsH,eAAe;YACvH,MAAM,IAAI/G,qBAAa,CAAC,0BAA0BC,kBAAU,CAACQ,SAAS;QACxE;QACA+C,QAAQqC,YAAY,GAAGrC,QAAQqC,YAAY,CAACmB,MAAM,CAAC,CAACX,IAAuBA,EAAE5G,IAAI,KAAKsH;QACtF,IAAI,CAAE,MAAM,IAAI,CAACzI,YAAY,CAAC8C,iBAAiB,CAAC/C,KAAKD,EAAE,EAAE;YAAEoF,SAASA;QAAQ,IAAK;YAC/E,MAAM,IAAIxD,qBAAa,CAAC,iCAAiCC,kBAAU,CAACoB,qBAAqB;QAC3F;IACF;IAEA,MAAMlC,oBAAoBd,IAAe,EAAEQ,QAAgB,EAAEC,EAAU,EAAEC,KAAiB,EAAoB;QAC5G,IAAI,CAACA,SAAS,CAACV,KAAK4I,QAAQ,CAACnH,eAAS,CAACoH,IAAI,GAAG,OAAO;QACrD,MAAM1D,UAAU,MAAM,IAAI,CAAClF,YAAY,CAACoF,cAAc,CAACrF,KAAKD,EAAE;QAC9D,IAAI,CAACuH,MAAMC,OAAO,CAACpC,QAAQqC,YAAY,GAAG,OAAO;QACjD,KAAK,MAAMQ,KAAK7C,QAAQqC,YAAY,CAAE;YACpC,IAAIQ,EAAEI,GAAG,KAAK1H,OAAO;YACrB,MAAMoI,QAAQd,EAAEK,UAAU,GAAG,IAAIlC,KAAK6B,EAAEK,UAAU,IAAI;YACtD,IAAIL,EAAEK,UAAU,IAAI,IAAIlC,SAAS2C,OAAO,UAAS,UAAU;YAC3D,IAAI,MAAMjI,IAAAA,0BAAe,EAACL,UAAUwH,EAAExH,QAAQ,GAAG;gBAC/CwH,EAAE/B,UAAU,GAAG+B,EAAE9B,aAAa;gBAC9B8B,EAAE9B,aAAa,GAAG,IAAIC;gBACtB6B,EAAE5B,MAAM,GAAG4B,EAAE3B,SAAS;gBACtB2B,EAAE3B,SAAS,GAAG5F;gBACd,kBAAkB;gBAClB,IAAI,CAACR,YAAY,CACd8C,iBAAiB,CAAC/C,KAAKD,EAAE,EAAE;oBAAEoF,SAASA;gBAAQ,GAC9CnE,KAAK,CAAC,CAACC,IAAa,IAAI,CAACC,MAAM,CAACC,KAAK,CAAC,GAAG,IAAI,CAACL,mBAAmB,CAACM,IAAI,CAAC,GAAG,EAAEH,GAAG;gBAClF,OAAO;YACT;QACF;QACA,OAAO;IACT;IAEA8H,gBAAgB/I,IAAwB,EAAEgJ,YAAgC,EAAE;QAC1E,IAAI,CAAC/I,YAAY,CAAC8I,eAAe,CAAC/I,KAAKD,EAAE,EAAEiJ,cAAchI,KAAK,CAAC,CAACC,IAAa,IAAI,CAACC,MAAM,CAACC,KAAK,CAAC,GAAG,IAAI,CAAC4H,eAAe,CAAC3H,IAAI,CAAC,GAAG,EAAEH,GAAG;IACtI;IAEAgI,eAAeC,OAAiB,EAAyB;QACvD,OAAO,IAAI,CAACjJ,YAAY,CAACgJ,cAAc,CAACC;IAC1C;IAEA,MAAMC,eAAexG,MAAc,EAAqB;QACtD,OAAO,IAAI,CAAC1C,YAAY,CAACkJ,cAAc,CAACxG;IAC1C;IAEA,MAAMyG,aAAapJ,IAAe,EAAEoB,IAAY,EAAwB;QACtE,IAAIA,MAAM;YACR,MAAMiI,QAA2E,MAAM,IAAI,CAACpJ,YAAY,CAACqJ,aAAa,CAACtJ,KAAKD,EAAE,EAAEqB;YAChI,IAAI,CAACiI,OAAO;gBACV,MAAM,IAAI1H,qBAAa,CAAC,mBAAmBC,kBAAU,CAACQ,SAAS;YACjE;YACA,OAAO;gBAAEmH,aAAaF;gBAAOG,SAAS,MAAM,IAAI,CAACvJ,YAAY,CAACwJ,kBAAkB,CAACJ,MAAMtJ,EAAE;YAAE;QAC7F;QACA,OAAO;YAAEwJ,aAAaG;YAAWF,SAAS,MAAM,IAAI,CAACvJ,YAAY,CAAC0J,gBAAgB,CAAC3J,KAAKD,EAAE;QAAE;IAC9F;IAIA,MAAM6J,SAAS5J,IAAe,EAAE6J,OAAe,EAAEC,cAAc,IAAI,EAAEC,UAAU,KAAK,EAA2C;QAC7H,MAAMV,QAAQS,cACV,MAAM,IAAI,CAAC7J,YAAY,CAAC+J,mBAAmB,CAAChK,KAAKD,EAAE,EAAE8J,SAASE,WAC9D,MAAM,IAAI,CAAC9J,YAAY,CAAC2J,QAAQ,CAAC5J,KAAKD,EAAE,EAAE8J,SAASE;QACvD,IAAI,CAACV,OAAO;YACV,MAAM,IAAI1H,qBAAa,CAAC,yCAAyCC,kBAAU,CAACC,SAAS;QACvF;QACA,OAAOwH;IACT;IAEA,MAAMY,oBAAoBjK,IAAe,EAAEkK,0BAAsD,EAAwB;QACvH,IAAI,CAACA,2BAA2B9I,IAAI,EAAE;YACpC,IAAI,CAACF,MAAM,CAACC,KAAK,CAAC,GAAG,IAAI,CAAC8I,mBAAmB,CAAC7I,IAAI,CAAC,wBAAwB,EAAE+I,KAAKC,SAAS,CAACF,6BAA6B;YACzH,MAAM,IAAIvI,qBAAa,CAAC,yBAAyBC,kBAAU,CAAC0B,WAAW;QACzE;QACA,IAAI,MAAM,IAAI,CAACrD,YAAY,CAACoK,oBAAoB,CAACH,2BAA2B9I,IAAI,GAAG;YACjF,MAAM,IAAIO,qBAAa,CAAC,qBAAqBC,kBAAU,CAAC0B,WAAW;QACrE;QACA,IAAI;YACF,MAAMuG,UAAkB,MAAM,IAAI,CAAC5J,YAAY,CAACgK,mBAAmB,CAACjK,KAAKD,EAAE,EAAEmK;YAC7E,IAAI,CAAChJ,MAAM,CAACoJ,GAAG,CAAC,GAAG,IAAI,CAACL,mBAAmB,CAAC7I,IAAI,CAAC,UAAU,EAAEyI,QAAQ,gBAAgB,EAAEM,KAAKC,SAAS,CAACF,6BAA6B;YACnI,wBAAwB;YACxB,IAAI,CAACjK,YAAY,CAACsK,oBAAoB,CAAC;gBAACvK,KAAKD,EAAE;aAAC;YAChD,OAAO,IAAI,CAAC6J,QAAQ,CAAC5J,MAAM6J,SAAS;QACtC,EAAE,OAAO5I,GAAG;YACV,IAAI,CAACC,MAAM,CAACC,KAAK,CAAC,GAAG,IAAI,CAAC8I,mBAAmB,CAAC7I,IAAI,CAAC,2BAA2B,EAAE+I,KAAKC,SAAS,CAACF,4BAA4B,GAAG,EAAEjJ,GAAG;YACnI,MAAM,IAAIU,qBAAa,CAAC,0BAA0BC,kBAAU,CAACoB,qBAAqB;QACpF;IACF;IAEA,MAAMwH,oBAAoBxK,IAAe,EAAE6J,OAAe,EAAEK,0BAAsD,EAAwB;QACxI,IAAI,CAACO,OAAOC,IAAI,CAACR,4BAA4BS,MAAM,EAAE;YACnD,MAAM,IAAIhJ,qBAAa,CAAC,wBAAwBC,kBAAU,CAAC0B,WAAW;QACxE;QACA,MAAMsH,eAA4B,MAAM,IAAI,CAAChB,QAAQ,CAAC5J,MAAM6J,SAAS,OAAO7J,KAAK6K,OAAO;QACxF,IAAID,aAAaE,IAAI,KAAKC,mBAAW,CAACC,MAAM,EAAE;YAC5C,MAAM,IAAIrJ,qBAAa,CAAC,yCAAyCC,kBAAU,CAACC,SAAS;QACvF;QACA,IAAIqI,2BAA2B9I,IAAI,IAAK,MAAM,IAAI,CAACnB,YAAY,CAACoK,oBAAoB,CAACH,2BAA2B9I,IAAI,GAAI;YACtH,MAAM,IAAIO,qBAAa,CAAC,qBAAqBC,kBAAU,CAAC0B,WAAW;QACrE;QACA,IAAI;YACF,MAAM,IAAI,CAACrD,YAAY,CAACgL,WAAW,CAACpB,SAASK;QAC/C,EAAE,OAAOjJ,GAAG;YACV,MAAM,IAAIU,qBAAa,CAACV,EAAEiK,OAAO,EAAEtJ,kBAAU,CAACoB,qBAAqB;QACrE;QACA,OAAO,IAAI,CAAC4G,QAAQ,CAAC5J,MAAM6J,SAAS,OAAO7J,KAAK6K,OAAO;IACzD;IAEA,MAAMM,gBAAgBnL,IAAe,EAAE6J,OAAe,EAAEX,OAAiB,EAAiB;QACxF,MAAM0B,eAAiC,MAAM,IAAI,CAAChB,QAAQ,CAAC5J,MAAM6J;QACjE,0CAA0C;QAC1C,mDAAmD;QACnD,MAAMuB,gBAA0B,MAAM,IAAI,CAACnL,YAAY,CAACkJ,cAAc,CACpEnJ,KAAKD,EAAE,EACP6K,aAAaE,IAAI,KAAKC,mBAAW,CAACM,KAAK,GAAG5J,eAAS,CAACoH,IAAI,GAAGa;QAE7D,8FAA8F;QAC9FR,UAAUA,QAAQP,MAAM,CAAC,CAAC5I,KAAO,CAAC6K,aAAapB,OAAO,CAACzB,IAAI,CAAC,CAACuD,IAAMA,EAAEvL,EAAE,KAAKA,KAAK4I,MAAM,CAAC,CAAC5I,KAAOqL,cAAcG,OAAO,CAACxL,MAAM,CAAC;QAC7H,IAAI,CAACmJ,QAAQyB,MAAM,EAAE;YACnB,MAAM,IAAIhJ,qBAAa,CAAC,4BAA4BC,kBAAU,CAAC0B,WAAW;QAC5E;QACA,OAAO,IAAI,CAACrD,YAAY,CAACuL,kBAAkB,CAAC3B,SAAS;YAAE4B,KAAKvC,QAAQzB,GAAG,CAAC,CAAC1H,KAAQ,CAAA;oBAAEA,IAAIA;oBAAI2L,WAAWC,qBAAe,CAACC,MAAM;gBAAC,CAAA;QAAI;IACnI;IAEA,MAAMC,4BAA4B7L,IAAe,EAAE6J,OAAe,EAAElH,MAAc,EAAEmJ,sBAA8C,EAAiB;QACjJ,MAAMlB,eAAiC,MAAM,IAAI,CAAChB,QAAQ,CAAC5J,MAAM6J;QACjE,IAAIe,aAAaE,IAAI,KAAKC,mBAAW,CAACC,MAAM,EAAE;YAC5C,MAAM,IAAIrJ,qBAAa,CAAC,yCAAyCC,kBAAU,CAACC,SAAS;QACvF;QACA,MAAMkK,eAAenB,aAAapB,OAAO,CAACzB,IAAI,CAAC,CAACuD,IAAMA,EAAEvL,EAAE,KAAK4C;QAC/D,IAAI,CAACoJ,cAAc;YACjB,MAAM,IAAIpK,qBAAa,CAAC,sBAAsBC,kBAAU,CAAC0B,WAAW;QACtE;QACA,IAAIyI,aAAaL,SAAS,KAAKI,uBAAuBtK,IAAI,EAAE;YAC1D,IAAIuK,aAAaL,SAAS,KAAKC,qBAAe,CAACK,OAAO,EAAE;gBACtD,IAAIpB,aAAapB,OAAO,CAACb,MAAM,CAAC,CAAC2C,IAAMA,EAAEI,SAAS,KAAKC,qBAAe,CAACK,OAAO,EAAErB,MAAM,KAAK,GAAG;oBAC5F,MAAM,IAAIhJ,qBAAa,CAAC,wCAAwCC,kBAAU,CAAC0B,WAAW;gBACxF;YACF;YACA,OAAO,IAAI,CAAC2I,iBAAiB,CAACC,mBAAmB,CAACrC,SAASlH,QAAQmJ;QACrE;IACF;IAEA,MAAMK,oBAAoBnM,IAAe,EAAE6J,OAAe,EAAElH,MAAc,EAAiB;QACzF,MAAMiI,eAAiC,MAAM,IAAI,CAAChB,QAAQ,CAAC5J,MAAM6J;QACjE,MAAMuC,eAAexB,aAAapB,OAAO,CAACzB,IAAI,CAAC,CAACuD,IAAMA,EAAEvL,EAAE,KAAK4C;QAC/D,IAAI,CAACyJ,cAAc;YACjB,MAAM,IAAIzK,qBAAa,CAAC,sBAAsBC,kBAAU,CAAC0B,WAAW;QACtE;QACA,IAAI8I,aAAaV,SAAS,KAAKC,qBAAe,CAACK,OAAO,EAAE;YACtD,IAAIpB,aAAaE,IAAI,KAAKC,mBAAW,CAACM,KAAK,EAAE;gBAC3C,MAAM,IAAI1J,qBAAa,CAAC,yCAAyCC,kBAAU,CAACC,SAAS;YACvF;YACA,IAAI+I,aAAapB,OAAO,CAACb,MAAM,CAAC,CAAC2C,IAAMA,EAAEI,SAAS,KAAKC,qBAAe,CAACK,OAAO,EAAErB,MAAM,KAAK,GAAG;gBAC5F,MAAM,IAAIhJ,qBAAa,CAAC,wCAAwCC,kBAAU,CAAC0B,WAAW;YACxF;QACF;QACA,OAAO,IAAI,CAACrD,YAAY,CAACuL,kBAAkB,CAAC3B,SAAS;YAAEwC,QAAQ;gBAAC1J;aAAO;QAAC;IAC1E;IAEA,MAAM2J,mBAAmBtM,IAAe,EAAE6J,OAAe,EAAiB;QACxE,MAAMe,eAAiC,MAAM,IAAI,CAAC3K,YAAY,CAAC+J,mBAAmB,CAAChK,KAAKD,EAAE,EAAE8J,SAAS;QACrG,IAAI,CAACe,gBAAgBA,aAAaE,IAAI,KAAKC,mBAAW,CAACM,KAAK,EAAE;YAC5D,MAAM,IAAI1J,qBAAa,CAAC,yCAAyCC,kBAAU,CAACC,SAAS;QACvF;QACA,MAAM0K,gBAAgB3B,aAAapB,OAAO,CAACzB,IAAI,CAAC,CAACuD,IAAMA,EAAEvL,EAAE,KAAKC,KAAKD,EAAE;QACvE,IAAI,CAACwM,eAAe;YAClB,MAAM,IAAI5K,qBAAa,CAAC,sBAAsBC,kBAAU,CAAC0B,WAAW;QACtE;QACA,IAAIiJ,cAAcb,SAAS,KAAKC,qBAAe,CAACK,OAAO,EAAE;YACvD,IAAIpB,aAAapB,OAAO,CAACb,MAAM,CAAC,CAAC2C,IAAMA,EAAEI,SAAS,KAAKC,qBAAe,CAACK,OAAO,EAAErB,MAAM,KAAK,GAAG;gBAC5F,MAAM,IAAIhJ,qBAAa,CAAC,wCAAwCC,kBAAU,CAAC0B,WAAW;YACxF;QACF;QACA,IAAI;YACF,MAAM,IAAI,CAACrD,YAAY,CAACuL,kBAAkB,CAAC3B,SAAS;gBAAEwC,QAAQ;oBAACrM,KAAKD,EAAE;iBAAC;YAAC;YACxE,IAAI,CAACmB,MAAM,CAACoJ,GAAG,CAAC,GAAG,IAAI,CAACgC,kBAAkB,CAAClL,IAAI,CAAC,SAAS,EAAEpB,KAAKD,EAAE,CAAC,kBAAkB,EAAE8J,QAAQ,CAAC,CAAC;QACnG,EAAE,OAAO5I,GAAG;YACV,IAAI,CAACC,MAAM,CAACC,KAAK,CAAC,GAAG,IAAI,CAACmL,kBAAkB,CAAClL,IAAI,CAAC,SAAS,EAAEpB,KAAKD,EAAE,CAAC,sBAAsB,EAAE8J,QAAQ,IAAI,EAAE5I,GAAG;YAC9G,MAAM,IAAIU,qBAAa,CAACV,EAAEiK,OAAO,EAAEtJ,kBAAU,CAACoB,qBAAqB;QACrE;IACF;IAEA,MAAMwJ,oBAAoBxM,IAAe,EAAE6J,OAAe,EAAiB;QACzE,IAAI,CAAE,MAAM,IAAI,CAAC5J,YAAY,CAACwM,sBAAsB,CAACzM,KAAKD,EAAE,EAAE8J,UAAW;YACvE,MAAM,IAAIlI,qBAAa,CAAC,yCAAyCC,kBAAU,CAACC,SAAS;QACvF;QACA,IAAI,MAAM,IAAI,CAAC5B,YAAY,CAACuM,mBAAmB,CAAC3C,UAAU;YACxD,IAAI,CAAC3I,MAAM,CAACoJ,GAAG,CAAC,GAAG,IAAI,CAACkC,mBAAmB,CAACpL,IAAI,CAAC,UAAU,EAAEyI,QAAQ,aAAa,CAAC;QACrF,OAAO;YACL,IAAI,CAAC3I,MAAM,CAACI,IAAI,CAAC,GAAG,IAAI,CAACkL,mBAAmB,CAACpL,IAAI,CAAC,UAAU,EAAEyI,QAAQ,gBAAgB,CAAC;YACvF,MAAM,IAAIlI,qBAAa,CAAC,0BAA0BC,kBAAU,CAAC0B,WAAW;QAC1E;IACF;IAEAoJ,WAAW1M,IAAe,EAAwB;QAChD,OAAO,IAAI,CAACC,YAAY,CAACyM,UAAU,CAAC,MAAM1M,KAAKD,EAAE;IACnD;IAEA,MAAM4M,SAAS3M,IAAe,EAAE4M,OAAe,EAAsB;QACnE,MAAMC,QAAmB,MAAM,IAAI,CAAC5M,YAAY,CAACyM,UAAU,CAACE,SAAS5M,KAAKD,EAAE;QAC5E,IAAI,CAACkM,iBAAiB,CAACa,SAAS,CAACD,OAAO;QACxC,OAAOA;IACT;IAEA,MAAME,YAAY/M,IAAe,EAAEgN,cAA6B,EAAsB;QACpF,oDAAoD;QACpD,MAAM5B,gBAAgB,MAAM,IAAI,CAACnL,YAAY,CAACkJ,cAAc,CAACnJ,KAAKD,EAAE,EAAE0B,eAAS,CAACoH,IAAI;QACpFmE,eAAeC,QAAQ,GAAGD,eAAeC,QAAQ,CAACtE,MAAM,CAAC,CAAC5I,KAAOqL,cAAcG,OAAO,CAACxL,MAAM,CAAC;QAC9F,IAAIiN,eAAeC,QAAQ,CAAC1B,OAAO,CAACvL,KAAKD,EAAE,MAAM,CAAC,GAAG;YACnD,wCAAwC;YACxCiN,eAAeC,QAAQ,CAACC,IAAI,CAAClN,KAAKD,EAAE;QACtC;QACA,wBAAwB;QACxB,IAAI,CAACE,YAAY,CAACsK,oBAAoB,CAAC;YAACvK,KAAKD,EAAE;SAAC;QAChD,OAAO,IAAI,CAACkM,iBAAiB,CAACkB,iBAAiB,CAACH,gBAAgBvL,eAAS,CAAC2L,KAAK,EAAE;IACnF;IAEA,MAAMC,YAAYrN,IAAe,EAAE4M,OAAe,EAAEU,cAA6B,EAAsB;QACrG,IAAI,CAAC7C,OAAOC,IAAI,CAAC4C,gBAAgB3C,MAAM,EAAE;YACvC,MAAM,IAAIhJ,qBAAa,CAAC,wBAAwBC,kBAAU,CAAC0B,WAAW;QACxE;QACA,IAAIgK,eAAeL,QAAQ,EAAE;YAC3B,oDAAoD;YACpD,MAAM7B,gBAAgB,MAAM,IAAI,CAACnL,YAAY,CAACkJ,cAAc,CAACnJ,KAAKD,EAAE,EAAE0B,eAAS,CAACoH,IAAI;YACpFyE,eAAeL,QAAQ,GAAGK,eAAeL,QAAQ,CAACtE,MAAM,CAAC,CAAC5I,KAAOqL,cAAcG,OAAO,CAACxL,MAAM,CAAC;YAC9F,IAAI,CAACuN,eAAeL,QAAQ,CAACtC,MAAM,EAAE;gBACnC,MAAM,IAAIhJ,qBAAa,CAAC,wCAAwCC,kBAAU,CAAC0B,WAAW;YACxF;QACF;QACA,IAAI,CAAE,MAAM,IAAI,CAACrD,YAAY,CAACsN,cAAc,CAACvN,KAAKD,EAAE,EAAE6M,UAAW;YAC/D,MAAM,IAAIjL,qBAAa,CAAC,yCAAyCC,kBAAU,CAACC,SAAS;QACvF;QACA,MAAMgL,QAAQ,MAAM,IAAI,CAACZ,iBAAiB,CAAClJ,iBAAiB,CAAC6J,SAASU,gBAAgB7L,eAAS,CAAC2L,KAAK;QACrG,OAAOP,MAAMI,QAAQ,CAAClF,IAAI,CAAC,CAACuD,IAAMA,EAAEvL,EAAE,KAAKC,KAAKD,EAAE,IAAI8M,QAAQ;IAChE;IAEA,MAAMW,YAAYxN,IAAe,EAAE4M,OAAe,EAAiB;QACjE,MAAMC,QAAQ,MAAM,IAAI,CAAC5M,YAAY,CAACsN,cAAc,CAACvN,KAAKD,EAAE,EAAE6M;QAC9D,IAAI,CAACC,OAAO;YACV,MAAM,IAAIlL,qBAAa,CAAC,yCAAyCC,kBAAU,CAACC,SAAS;QACvF;QACA,+CAA+C;QAC/C,OAAO,IAAI,CAACoK,iBAAiB,CAACwB,iBAAiB,CAACZ,MAAM9M,EAAE,EAAE8M,MAAMtL,KAAK,EAAE;YAAEmM,aAAa;YAAMC,SAAS;QAAK;IAC5G;IAEAC,cAAc5N,IAAe,EAAE6N,gBAAkC,EAAqB;QACpF,OAAO,IAAI,CAAC5N,YAAY,CAAC6N,mBAAmB,CAACD,kBAAkB7N,KAAKD,EAAE;IACxE;IAEQkC,oBAAoBjC,IAAe,EAAES,EAAU,EAAE;QACvD,IAAI,CAACsN,oBAAoB,CACtBC,qBAAqB,CAAC;YAAChO;SAAK,EAAE;YAC7BoI,KAAK6F,+BAAgB,CAACC,WAAW;YACjCC,OAAOC,qCAAsB,CAACF,WAAW,CAACG,iBAAM,CAACC,MAAM,CAAC;YACxDC,SAAS;YACTC,KAAK/N;QACP,GACCO,KAAK,CAAC,CAACC,IAAa,IAAI,CAACC,MAAM,CAACC,KAAK,CAAC,GAAG,IAAI,CAACR,kBAAkB,CAACS,IAAI,CAAC,GAAG,EAAEH,GAAG;IACnF;IAtdA,YACE,AAAgBhB,YAA0B,EAC1C,AAAiBgM,iBAAoC,EACrD,AAAiB8B,oBAA0C,CAC3D;aAHgB9N,eAAAA;aACCgM,oBAAAA;aACA8B,uBAAAA;aALF7M,SAAS,IAAIuN,cAAM,CAAC5O,aAAauB,IAAI;IAMnD;AAmdL"}

package/server/applications/users/services/users-queries.service.js

@@ -381,83 +381,82 @@ let UsersQueries = class UsersQueries {
     }
     async usersWhitelist(userId, lowerOrEqualUserRole = _user.USER_ROLE.GUEST) {
         /* Get the list of user ids allowed to the current user
-      - all users with no groups (except link users)
-      - all users who are members of the current user's groups (excluding link users and members of isolated groups)
-      - all guests managed by the current user
-      - all managers who manage the current guest
-    */ const usersAlias = (0, _mysqlcore.alias)(_usersschema.users, 'usersAlias');
-        const groupsAlias = (0, _mysqlcore.alias)(_groupsschema.groups, 'groupsAlias');
-        const userIds = (0, _drizzleorm.sql)`
-      WITH RECURSIVE children (id, parentId) AS
-                       (SELECT ${_groupsschema.groups.id},
-                               ${_groupsschema.groups.parentId}
-                        FROM ${_groupsschema.groups}
-                        WHERE (${_groupsschema.groups.id} IN (SELECT ${_usersgroupsschema.usersGroups.groupId}
-                                                FROM ${_usersgroupsschema.usersGroups}
-                                                WHERE ${_usersgroupsschema.usersGroups.userId} = ${userId}
-                                                  AND ${_groupsschema.groups.visibility} != ${_group.GROUP_VISIBILITY.ISOLATED}))
-                        UNION
-                        SELECT ${groupsAlias.id},
-                               ${groupsAlias.parentId}
-                        FROM ${_groupsschema.groups} AS groupsAlias
-                               INNER JOIN children cs ON ${groupsAlias.parentId} = cs.id AND ${groupsAlias.visibility} = ${_drizzleorm.sql.raw(`${_group.GROUP_VISIBILITY.VISIBLE}`)})
-      SELECT JSON_ARRAYAGG(id) AS ids
-      FROM (
-             -- Users from visible child groups
-             SELECT ${_usersschema.users.id} AS id
-             FROM children
-                    INNER JOIN ${_usersgroupsschema.usersGroups} ON ${_usersgroupsschema.usersGroups.groupId} = children.id
-                    INNER JOIN ${_usersschema.users} ON ${_usersgroupsschema.usersGroups.userId} = ${_usersschema.users.id} AND ${_usersschema.users.role} <= ${_drizzleorm.sql.raw(`${lowerOrEqualUserRole}`)}
+       - all users with no groups (except users with a role higher than lowerOrEqualUserRole)
+       - all users who are members of groups visible to the current user
+         (VISIBLE groups for everyone, PRIVATE groups only if the current user is a member, never members of ISOLATED groups)
+       - all guests managed by the current user
+       - all managers who manage the current guest
+    */ const userIds = (0, _drizzleorm.sql)`
+    WITH visible_groups AS (
+      SELECT ${_groupsschema.groups.id} AS id
+      FROM ${_groupsschema.groups}
+      LEFT JOIN ${_usersgroupsschema.usersGroups}
+        ON ${_usersgroupsschema.usersGroups.groupId} = ${_groupsschema.groups.id}
+       AND ${_usersgroupsschema.usersGroups.userId} = ${userId}
+      WHERE
+        ${_groupsschema.groups.visibility} != ${_group.GROUP_VISIBILITY.ISOLATED}
+        AND (
+          ${_groupsschema.groups.visibility} = ${_group.GROUP_VISIBILITY.VISIBLE}
+          OR (
+            ${_groupsschema.groups.visibility} = ${_group.GROUP_VISIBILITY.PRIVATE}
+            AND ${_usersgroupsschema.usersGroups.userId} IS NOT NULL
+          )
+        )
+    )
+    SELECT JSON_ARRAYAGG(id) AS ids
+    FROM (
+      -- 1) Users from groups visible to the current user
+      SELECT ${_usersschema.users.id} AS id
+      FROM ${_usersschema.users}
+      INNER JOIN ${_usersgroupsschema.usersGroups}
+        ON ${_usersgroupsschema.usersGroups.userId} = ${_usersschema.users.id}
+      INNER JOIN visible_groups
+        ON visible_groups.id = ${_usersgroupsschema.usersGroups.groupId}
+      WHERE ${_usersschema.users.role} <= ${_drizzleorm.sql.raw(`${lowerOrEqualUserRole}`)}
 
-             UNION
-             -- Users visible but not assigned to groups
-             SELECT ${usersAlias.id} AS id
-             FROM ${_usersschema.users} AS usersAlias
-                    INNER JOIN ${_usersschema.users} ON ${_usersschema.users.id} = ${usersAlias.id} AND ${_usersschema.users.role} <= ${_drizzleorm.sql.raw(`${lowerOrEqualUserRole}`)}
-             WHERE NOT EXISTS (SELECT ${_usersgroupsschema.usersGroups.userId} FROM ${_usersgroupsschema.usersGroups} WHERE ${_usersgroupsschema.usersGroups.userId} = ${usersAlias.id})
-             UNION
-             -- Users or guests that are manager/managed
-             SELECT CASE
-                      WHEN ${_usersguestsschema.usersGuests.userId} = ${userId} THEN ${_usersguestsschema.usersGuests.guestId}
-                      WHEN ${_usersguestsschema.usersGuests.guestId} = ${userId} THEN ${_usersguestsschema.usersGuests.userId}
-                      END AS id
-             FROM ${_usersguestsschema.usersGuests}
-             WHERE ${_usersguestsschema.usersGuests.userId} = ${userId}
-                OR ${_usersguestsschema.usersGuests.guestId} = ${userId}) AS usersUnion
-    `;
+      UNION
+
+      -- 2) Users with no groups
+      SELECT ${_usersschema.users.id} AS id
+      FROM ${_usersschema.users}
+      WHERE
+        ${_usersschema.users.role} <= ${_drizzleorm.sql.raw(`${lowerOrEqualUserRole}`)}
+        AND NOT EXISTS (
+          SELECT 1
+          FROM ${_usersgroupsschema.usersGroups}
+          WHERE ${_usersgroupsschema.usersGroups.userId} = ${_usersschema.users.id}
+        )
+
+      UNION
+
+      -- 3) Guests managed by the user and managers of the current guest
+      SELECT CASE
+               WHEN ${_usersguestsschema.usersGuests.userId} = ${userId} THEN ${_usersguestsschema.usersGuests.guestId}
+               WHEN ${_usersguestsschema.usersGuests.guestId} = ${userId} THEN ${_usersguestsschema.usersGuests.userId}
+             END AS id
+      FROM ${_usersguestsschema.usersGuests}
+      WHERE ${_usersguestsschema.usersGuests.userId} = ${userId}
+         OR ${_usersguestsschema.usersGuests.guestId} = ${userId}
+    ) AS usersUnion
+  `;
         const [r] = await this.db.execute(userIds);
         return JSON.parse(r[0].ids) || [];
     }
     async groupsWhitelist(userId) {
-        /* Get the list of groups ids allowed to the current user
-      - all parent groups for which the user is a member (includes personal groups, excludes isolated groups)
-      - all subgroups inherited from parent groups
-    */ const groupsAlias = (0, _mysqlcore.alias)(_groupsschema.groups, 'groupsAlias');
-        const groupIds = (0, _drizzleorm.sql)`
-      WITH RECURSIVE children (id, parentId, type) AS
-                       (SELECT ${_groupsschema.groups.id},
-                               ${_groupsschema.groups.parentId},
-                               ${_groupsschema.groups.type}
-                        FROM ${_groupsschema.groups}
-                        WHERE (${_groupsschema.groups.id} IN (SELECT ${_usersgroupsschema.usersGroups.groupId}
-                                                FROM ${_usersgroupsschema.usersGroups}
-                                                WHERE ${_usersgroupsschema.usersGroups.userId} = ${userId}
-                                                  AND ${_groupsschema.groups.visibility} != ${_group.GROUP_VISIBILITY.ISOLATED}))
-                        UNION
-                        SELECT ${groupsAlias.id},
-                               ${groupsAlias.parentId},
-                               ${groupsAlias.type}
-                        FROM ${_groupsschema.groups} AS groupsAlias
-                               INNER JOIN children cs ON ${groupsAlias.parentId} = cs.id AND ${groupsAlias.visibility} = ${_group.GROUP_VISIBILITY.VISIBLE})
-      SELECT JSON_ARRAYAGG(children.id) as ids
-      FROM children
-    `;
-        const [r] = await this.db.execute(groupIds);
+        /* Get the list of group IDs the current user is allowed to see.
+       - A group marked VISIBLE is always included.
+       - A group marked ISOLATED is always excluded.
+       - A PRIVATE group is included only if the user is a direct member of it.
+       - Visibility does not inherit from parent or child groups.
+    */ const q = this.db.select({
+            id: (0, _drizzleorm.sql)`JSON_ARRAYAGG(${_groupsschema.groups.id}) as ids`
+        }).from(_groupsschema.groups).leftJoin(_usersgroupsschema.usersGroups, (0, _drizzleorm.and)((0, _drizzleorm.eq)(_usersgroupsschema.usersGroups.groupId, _groupsschema.groups.id), (0, _drizzleorm.eq)(_usersgroupsschema.usersGroups.userId, userId))).where((0, _drizzleorm.and)((0, _drizzleorm.ne)(_groupsschema.groups.visibility, _group.GROUP_VISIBILITY.ISOLATED), (0, _drizzleorm.or)((0, _drizzleorm.eq)(_groupsschema.groups.visibility, _group.GROUP_VISIBILITY.VISIBLE), (0, _drizzleorm.and)((0, _drizzleorm.eq)(_groupsschema.groups.visibility, _group.GROUP_VISIBILITY.PRIVATE), (0, _drizzleorm.isNotNull)(_usersgroupsschema.usersGroups.userId)))));
+        const [r] = await this.db.execute(q);
         return JSON.parse(r[0].ids) || [];
     }
     clearWhiteListCaches(userIds) {
         if (userIds === '*') {
-            // means all entries
+            // Means all entries
             for (const pattern of [
                 this.cache.genSlugKey(this.constructor.name, this.usersWhitelist.name, userIds),
                 this.cache.genSlugKey(this.constructor.name, this.groupsWhitelist.name, userIds)