@synoikia/core 0.7.0 → 0.8.0

package/dist/auth/oidc.js.map

@@ -1 +1 @@
-{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../../src/auth/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AAGzC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAGzD;2FAC2F;AAE3F,MAAM,iBAAiB,GAAG,CAAC;KACxB,MAAM,CAAC;IACN,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/C,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAChD,4EAA4E;IAC5E,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;CAC1C,CAAC;KACD,QAAQ,CAAC,EAAE,CAAC,CAAC;AAEhB,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE;IACf,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,sBAAsB,CAAC;IAClD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAChC,WAAW,EAAE,iBAAiB;IAC9B,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CAC1C,CAAC,CAAC;AAuBH,MAAM,YAAY,GAAG,EAAE,GAAG,MAAM,CAAC;AACjC,MAAM,aAAa,GAAG,CAAC,CAA8B,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;AAE7G,MAAM,SAAU,SAAQ,YAAY;IAClC,YAAY,IAAY,EAAE,OAAe;QACvC,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5B,CAAC;CACF;AAED,MAAM,OAAO,WAAW;IAIH;IACA;IACA;IAEA;IAPX,MAAM,CAA+C;IAE7D,YACmB,EAAM,EACN,GAAc,EACd,QAAgB;IACjC,gEAAgE;IAC/C,gBAAgB,KAAK;QAJrB,OAAE,GAAF,EAAE,CAAI;QACN,QAAG,GAAH,GAAG,CAAW;QACd,aAAQ,GAAR,QAAQ,CAAQ;QAEhB,kBAAa,GAAb,aAAa,CAAQ;IACrC,CAAC;IAEI,GAAG;QACT,OAAO,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IAC7E,CAAC;IAED,WAAW;QACT,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,OAAO;YACL,GAAG,kBAAkB,CAAC,KAAK,CAAC;gBAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE;gBAClC,aAAa,EAAE,GAAG,CAAC,aAAa;gBAChC,KAAK,EAAG,GAAG,CAAC,WAAyC,EAAE,KAAK,IAAI,KAAK;aACtE,CAAC;YACF,eAAe,EAAE,CAAC,CAAC,GAAG,CAAC,eAAe;SACvC,CAAC;IACJ,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,WAAW,EAAE,EAAE,OAAO,KAAK,IAAI,CAAC;IAC9C,CAAC;IAED,kGAAkG;IAClG,cAAc,CAAC,KAA+D,EAAE,QAA6B,EAAE;QAC7G,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,eAAe,CACvB,cAAc,EACd,uBAAuB,EACvB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CACpE,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,CAAC,aAAa,IAAI,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,eAAe,CACvB,iBAAiB,EACjB,uEAAuE,CACxE,CAAC;QACJ,CAAC;QACD,IAAI,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,eAAe,IAAI,IAAI,CAAC;QAC1D,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI;YAAE,eAAe,GAAG,IAAI,CAAC;aACnD,IAAI,KAAK,CAAC,YAAY;YACzB,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,CAAC,aAAa,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAC,CAAC;QACvG,MAAM,MAAM,GAAG;YACb,EAAE,EAAE,CAAC;YACL,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,eAAe;YACf,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;YACjD,aAAa,EAAE,CAAC,CAAC,aAAa;YAC9B,OAAO,EAAE,CAAC,CAAC,OAAO;SACnB,CAAC;QACF,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;YACtG,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,uBAAuB;gBACjC,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,KAAK,CAAC,MAAM;gBACrB,MAAM,EAAE,EAAE,GAAG,CAAC,EAAE,mBAAmB,EAAE,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE;aACxE,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QACxB,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,aAAa;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,EAAE,OAAO;YAAE,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,6BAA6B,CAAC,CAAC;QACvF,MAAM,MAAM,GAAG,GAAG,CAAC,eAAe;YAChC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,aAAa,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YACtG,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,IAAI,MAAM,IAAI,EAAE,EAAE,CAAC;QAC5D,IAAI,IAAI,CAAC,MAAM,EAAE,GAAG,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QACxD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CACjC,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EACnB,GAAG,CAAC,QAAQ,EACZ,MAAM,EACN,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,EACpD,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAC3E,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,mGAAmG;IACnG,KAAK,CAAC,KAAK,CAAC,KAAwF;QAClG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAG,CAAC;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAc;YACvB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ;YACR,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE;YACzB,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE;YACzB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE;YAC7C,YAAY,EAAE,KAAK,CAAC,WAAW;YAC/B,KAAK,EAAE,QAAQ,CAAC,MAAM;YACtB,cAAc,EAAE,MAAM,IAAI,CAAC,0BAA0B,CAAC,QAAQ,CAAC;YAC/D,qBAAqB,EAAE,MAAM;YAC7B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC,CAAC;QACH,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,WAAW,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,YAAY,CAAC,EAAE,CAAC;IAC9F,CAAC;IAED,0GAA0G;IAC1G,KAAK,CAAC,QAAQ,CACZ,WAAgB,EAChB,UAA8B;QAE9B,MAAM,KAAK,GAAG,aAAa,CAAY,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAClE,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,SAAS,CAAC,YAAY,EAAE,+CAA+C,CAAC,CAAC;QAC/F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC1C,IAAI,MAAgC,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE,WAAW,EAAE;gBACpE,gBAAgB,EAAE,KAAK,CAAC,QAAQ;gBAChC,aAAa,EAAE,KAAK,CAAC,KAAK;gBAC1B,aAAa,EAAE,KAAK,CAAC,KAAK;gBAC1B,eAAe,EAAE,IAAI;aACtB,CAAC,CAAC;YACH,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,mBAAmB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5G,CAAC;QACD,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,4CAA4C,CAAC,CAAC;QAC9F,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAG,CAAC;QACrC,MAAM,SAAS,GAAI,MAAkC,CAAC,QAAQ,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QACxF,MAAM,QAAQ,GAAiB;YAC7B,MAAM,EAAE,MAAM,CAAC,GAAG;YAClB,OAAO,EAAE,MAAM,CAAC,GAAG;YACnB,mGAAmG;YACnG,KAAK,EAAE,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;YACpG,QAAQ,EAAE,OAAO,MAAM,CAAC,kBAAkB,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS;YAC/F,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;SAC9D,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;IAED,SAAS,CAAC,QAAsB;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,EAAE,WAAW,CAAC;QAC/C,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,wBAAwB;QAC3E,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5D,IAAI,QAAQ,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QACpH,IAAI,MAAM,CAAC,KAAK,IAAI,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACxE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,0GAA0G;IAC1G,KAAK,CAAC,WAAW,CAAC,KAAkB,EAAE,QAAsB;QAC1D,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/D,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;QACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACpC,IAAI,CAAC,QAAQ,EAAE,aAAa,IAAI,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC;YAAE,OAAO,IAAI,CAAC;QACjF,MAAM,IAAI,GACR,CAAC,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YAC5G,MAAM,CAAC;QACT,IAAI,QAAQ,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC;QACvD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE;YAAE,QAAQ,GAAG,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;QAC3E,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjD,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9D,OAAO,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC/B,CAAC;CACF"}
+{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../../src/auth/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AAGzC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAGzD;2FAC2F;AAE3F,MAAM,iBAAiB,GAAG,CAAC;KACxB,MAAM,CAAC;IACN,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/C,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAChD,4EAA4E;IAC5E,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;CAC1C,CAAC;KACD,QAAQ,CAAC,EAAE,CAAC,CAAC;AAEhB,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE;IACf,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,sBAAsB,CAAC;IAClD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAChC,WAAW,EAAE,iBAAiB;IAC9B,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CAC1C,CAAC,CAAC;AAuBH,MAAM,YAAY,GAAG,EAAE,GAAG,MAAM,CAAC;AACjC,MAAM,aAAa,GAAG,CAAC,CAA8B,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;AAE7G,MAAM,SAAU,SAAQ,YAAY;IAClC,YAAY,IAAY,EAAE,OAAe;QACvC,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5B,CAAC;CACF;AAED,MAAM,OAAO,WAAW;IAIH;IACA;IACA;IAEA;IAPX,MAAM,CAA+C;IAE7D,YACmB,EAAM,EACN,GAAc,EACd,QAAgB;IACjC,gEAAgE;IAC/C,gBAAgB,KAAK;QAJrB,OAAE,GAAF,EAAE,CAAI;QACN,QAAG,GAAH,GAAG,CAAW;QACd,aAAQ,GAAR,QAAQ,CAAQ;QAEhB,kBAAa,GAAb,aAAa,CAAQ;IACrC,CAAC;IAEI,GAAG;QACT,OAAO,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IAC7E,CAAC;IAED,WAAW;QACT,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,OAAO;YACL,GAAG,kBAAkB,CAAC,KAAK,CAAC;gBAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE;gBAClC,aAAa,EAAE,GAAG,CAAC,aAAa;gBAChC,KAAK,EAAG,GAAG,CAAC,WAAyC,EAAE,KAAK,IAAI,KAAK;aACtE,CAAC;YACF,eAAe,EAAE,CAAC,CAAC,GAAG,CAAC,eAAe;SACvC,CAAC;IACJ,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,WAAW,EAAE,EAAE,OAAO,KAAK,IAAI,CAAC;IAC9C,CAAC;IAED,kGAAkG;IAClG,cAAc,CAAC,KAA+D,EAAE,QAA6B,EAAE;QAC7G,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,eAAe,CACvB,cAAc,EACd,uBAAuB,EACvB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CACpE,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,CAAC,aAAa,IAAI,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,eAAe,CACvB,iBAAiB,EACjB,uEAAuE,CACxE,CAAC;QACJ,CAAC;QACD,IAAI,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,eAAe,IAAI,IAAI,CAAC;QAC1D,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI;YAAE,eAAe,GAAG,IAAI,CAAC;aACnD,IAAI,KAAK,CAAC,YAAY;YACzB,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,CAAC,aAAa,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAC,CAAC;QACvG,MAAM,MAAM,GAAG;YACb,EAAE,EAAE,CAAC;YACL,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,eAAe;YACf,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;YACjD,aAAa,EAAE,CAAC,CAAC,aAAa;YAC9B,OAAO,EAAE,CAAC,CAAC,OAAO;SACnB,CAAC;QACF,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;YACtG,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,uBAAuB;gBACjC,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,KAAK,CAAC,MAAM;gBACrB,MAAM,EAAE,EAAE,GAAG,CAAC,EAAE,mBAAmB,EAAE,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE;aACxE,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QACxB,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,aAAa;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,EAAE,OAAO;YAAE,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,6BAA6B,CAAC,CAAC;QACvF,MAAM,MAAM,GAAG,GAAG,CAAC,eAAe;YAChC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,aAAa,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YACtG,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,IAAI,MAAM,IAAI,EAAE,EAAE,CAAC;QAC5D,IAAI,IAAI,CAAC,MAAM,EAAE,GAAG,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QACxD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CACjC,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EACnB,GAAG,CAAC,QAAQ,EACZ,MAAM,EACN,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,EACpD,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAC3E,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,mGAAmG;IACnG,KAAK,CAAC,KAAK,CAAC,KAAwF;QAClG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAG,CAAC;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAc;YACvB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ;YACR,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE;YACzB,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE;YACzB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE;YAC7C,YAAY,EAAE,KAAK,CAAC,WAAW;YAC/B,KAAK,EAAE,QAAQ,CAAC,MAAM;YACtB,cAAc,EAAE,MAAM,IAAI,CAAC,0BAA0B,CAAC,QAAQ,CAAC;YAC/D,qBAAqB,EAAE,MAAM;YAC7B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC,CAAC;QACH,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,WAAW,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,YAAY,CAAC,EAAE,CAAC;IAC9F,CAAC;IAED,0GAA0G;IAC1G,KAAK,CAAC,QAAQ,CACZ,WAAgB,EAChB,UAA8B;QAE9B,MAAM,KAAK,GAAG,aAAa,CAAY,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAClE,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,SAAS,CAAC,YAAY,EAAE,+CAA+C,CAAC,CAAC;QAC/F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC1C,IAAI,MAAgC,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE,WAAW,EAAE;gBACpE,gBAAgB,EAAE,KAAK,CAAC,QAAQ;gBAChC,aAAa,EAAE,KAAK,CAAC,KAAK;gBAC1B,aAAa,EAAE,KAAK,CAAC,KAAK;gBAC1B,eAAe,EAAE,IAAI;aACtB,CAAC,CAAC;YACH,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,mBAAmB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5G,CAAC;QACD,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,4CAA4C,CAAC,CAAC;QAC9F,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAG,CAAC;QACrC,MAAM,SAAS,GAAI,MAAkC,CAAC,QAAQ,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QACxF,MAAM,QAAQ,GAAiB;YAC7B,MAAM,EAAE,MAAM,CAAC,GAAG;YAClB,OAAO,EAAE,MAAM,CAAC,GAAG;YACnB,mGAAmG;YACnG,KAAK,EAAE,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;YACpG,QAAQ,EAAE,OAAO,MAAM,CAAC,kBAAkB,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS;YAC/F,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;SAC9D,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;IAED,SAAS,CAAC,QAAsB;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,EAAE,WAAW,CAAC;QAC/C,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,wBAAwB;QAC3E,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5D,IAAI,QAAQ,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QACpH,IAAI,MAAM,CAAC,KAAK,IAAI,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACxE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,0GAA0G;IAC1G,KAAK,CAAC,WAAW,CAAC,KAAkB,EAAE,QAAsB;QAC1D,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/D,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;QACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACpC,qFAAqF;QACrF,IAAI,CAAC,QAAQ,EAAE,aAAa,IAAI,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE;YAAE,OAAO,IAAI,CAAC;QAC9G,MAAM,IAAI,GACR,CAAC,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YAC5G,MAAM,CAAC;QACT,IAAI,QAAQ,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC;QACvD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE;YAAE,QAAQ,GAAG,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;QAC3E,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC;QAC3D,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9D,OAAO,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC/B,CAAC;CACF"}

package/dist/auth/roles.d.ts

@@ -0,0 +1,43 @@
+import type { Db, DbLike } from '../db/index.js';
+import { roles } from '../db/schema.js';
+/** Roles (design §6.4): the built-in Admin role plus admin-defined ones, each with its endpoints, its
+ * maximum levels (`catalog/role-levels.ts`) and three switches. */
+export type RoleRow = typeof roles.$inferSelect;
+export interface PublicRole {
+    id: string;
+    name: string;
+    isAdmin: boolean;
+    canSetOwnLevels: boolean;
+    canManageOwnRules: boolean;
+    canSeeStatus: boolean;
+}
+export declare const toPublicRole: (r: RoleRow) => PublicRole;
+export declare class RoleService {
+    private readonly db;
+    constructor(db: Db);
+    get(id: string, db?: DbLike): RoleRow;
+    list(): {
+        users: number;
+        instanceIds: string[];
+        isDefault: boolean;
+        id: string;
+        name: string;
+        isAdmin: boolean;
+        canSetOwnLevels: boolean;
+        canManageOwnRules: boolean;
+        canSeeStatus: boolean;
+    }[];
+    create(raw: unknown, actor?: {
+        userId?: string;
+    }): PublicRole;
+    update(id: string, raw: unknown, actor?: {
+        userId?: string;
+    }): PublicRole;
+    remove(id: string, actor?: {
+        userId?: string;
+    }): void;
+    /** Sets the endpoints a role has; levels on a removed endpoint go with it. */
+    setInstances(id: string, instanceIds: string[], actor?: {
+        userId?: string;
+    }): string[];
+}

package/dist/auth/roles.js

@@ -0,0 +1,164 @@
+import { randomUUID } from 'node:crypto';
+import { and, asc, count, eq, inArray } from 'drizzle-orm';
+import { z } from 'zod';
+import { writeAudit } from '../audit.js';
+import { pluginInstances, roleInstances, roleLevels, roles, users } from '../db/schema.js';
+import { ConflictError, NotFoundError, ValidationError } from '../errors.js';
+import { ADMIN_ROLE_ID } from '../gate/access.js';
+import { getSettings } from '../settings.js';
+export const toPublicRole = (r) => ({
+    id: r.id,
+    name: r.name,
+    isAdmin: r.id === ADMIN_ROLE_ID,
+    canSetOwnLevels: r.canSetOwnLevels,
+    canManageOwnRules: r.canManageOwnRules,
+    canSeeStatus: r.canSeeStatus,
+});
+const RoleInput = z.object({
+    name: z.string().trim().min(1).max(64),
+    canSetOwnLevels: z.boolean().default(false),
+    canManageOwnRules: z.boolean().default(false),
+    canSeeStatus: z.boolean().default(false),
+});
+export class RoleService {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    get(id, db = this.db) {
+        const role = db.select().from(roles).where(eq(roles.id, id)).get();
+        if (!role)
+            throw new NotFoundError('role_not_found', 'No such role');
+        return role;
+    }
+    list() {
+        const members = new Map(this.db
+            .select({ roleId: users.roleId, n: count() })
+            .from(users)
+            .groupBy(users.roleId)
+            .all()
+            .map((r) => [r.roleId, r.n]));
+        const endpoints = this.db.select().from(roleInstances).all();
+        const defaultRoleId = getSettings(this.db, 'security').defaultRoleId;
+        return this.db
+            .select()
+            .from(roles)
+            .orderBy(asc(roles.createdAt), asc(roles.name))
+            .all()
+            .map((r) => ({
+            ...toPublicRole(r),
+            users: members.get(r.id) ?? 0,
+            instanceIds: endpoints.filter((e) => e.roleId === r.id).map((e) => e.instanceId),
+            isDefault: r.id === defaultRoleId,
+        }));
+    }
+    create(raw, actor = {}) {
+        const input = RoleInput.parse(raw);
+        const id = randomUUID();
+        this.db.transaction((tx) => {
+            if (tx.select({ id: roles.id }).from(roles).where(eq(roles.name, input.name)).get())
+                throw new ConflictError('role_name_taken', 'A role with that name exists');
+            tx.insert(roles)
+                .values({ id, ...input, createdAt: new Date() })
+                .run();
+            writeAudit(tx, {
+                kind: 'config',
+                decision: 'role_created',
+                actorKind: 'user',
+                actorId: actor.userId,
+                detail: { id, ...input },
+            });
+        });
+        return toPublicRole(this.get(id));
+    }
+    update(id, raw, actor = {}) {
+        const before = this.get(id);
+        if (before.builtIn)
+            throw new ConflictError('built_in_role', 'The Admin role cannot be changed');
+        const input = RoleInput.partial().parse(raw);
+        this.db.transaction((tx) => {
+            if (input.name && input.name !== before.name) {
+                if (tx.select({ id: roles.id }).from(roles).where(eq(roles.name, input.name)).get())
+                    throw new ConflictError('role_name_taken', 'A role with that name exists');
+            }
+            tx.update(roles)
+                .set({ ...input, updatedAt: new Date() })
+                .where(eq(roles.id, id))
+                .run();
+            writeAudit(tx, {
+                kind: 'config',
+                decision: 'role_updated',
+                actorKind: 'user',
+                actorId: actor.userId,
+                detail: { id, before: toPublicRole(before), changes: input },
+            });
+        });
+        return toPublicRole(this.get(id));
+    }
+    remove(id, actor = {}) {
+        const role = this.get(id);
+        if (role.builtIn)
+            throw new ConflictError('built_in_role', 'The Admin role cannot be deleted');
+        if (getSettings(this.db, 'security').defaultRoleId === id)
+            throw new ConflictError('default_role', 'This is the default role for new users; choose another first');
+        this.db.transaction((tx) => {
+            const n = tx.select({ n: count() }).from(users).where(eq(users.roleId, id)).get()?.n ?? 0;
+            if (n > 0)
+                throw new ConflictError('role_in_use', `${n} user(s) have this role; move them first`);
+            tx.delete(roles).where(eq(roles.id, id)).run();
+            writeAudit(tx, {
+                kind: 'config',
+                decision: 'role_deleted',
+                actorKind: 'user',
+                actorId: actor.userId,
+                detail: { id, name: role.name },
+            });
+        });
+    }
+    /** Sets the endpoints a role has; levels on a removed endpoint go with it. */
+    setInstances(id, instanceIds, actor = {}) {
+        const role = this.get(id);
+        if (role.builtIn)
+            throw new ConflictError('built_in_role', 'The Admin role has every endpoint');
+        const wanted = [...new Set(instanceIds)];
+        const known = new Set(wanted.length
+            ? this.db
+                .select({ id: pluginInstances.id })
+                .from(pluginInstances)
+                .where(inArray(pluginInstances.id, wanted))
+                .all()
+                .map((r) => r.id)
+            : []);
+        const unknown = wanted.filter((w) => !known.has(w));
+        if (unknown.length)
+            throw new ValidationError('unknown_instance', `Unknown endpoint(s): ${unknown.join(', ')}`);
+        this.db.transaction((tx) => {
+            const before = tx
+                .select()
+                .from(roleInstances)
+                .where(eq(roleInstances.roleId, id))
+                .all()
+                .map((r) => r.instanceId);
+            const removed = before.filter((b) => !wanted.includes(b));
+            if (removed.length) {
+                tx.delete(roleInstances)
+                    .where(and(eq(roleInstances.roleId, id), inArray(roleInstances.instanceId, removed)))
+                    .run();
+                tx.delete(roleLevels)
+                    .where(and(eq(roleLevels.roleId, id), inArray(roleLevels.instanceId, removed)))
+                    .run();
+            }
+            for (const instanceId of wanted.filter((w) => !before.includes(w)))
+                tx.insert(roleInstances).values({ roleId: id, instanceId }).run();
+            writeAudit(tx, {
+                kind: 'config',
+                decision: 'role_endpoints_changed',
+                actorKind: 'user',
+                actorId: actor.userId,
+                detail: { id, before, after: wanted },
+            });
+        });
+        return wanted;
+    }
+}
+//# sourceMappingURL=roles.js.map

package/dist/auth/roles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.js","sourceRoot":"","sources":["../../src/auth/roles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAC3F,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC7E,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAgB7C,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAU,EAAc,EAAE,CAAC,CAAC;IACvD,EAAE,EAAE,CAAC,CAAC,EAAE;IACR,IAAI,EAAE,CAAC,CAAC,IAAI;IACZ,OAAO,EAAE,CAAC,CAAC,EAAE,KAAK,aAAa;IAC/B,eAAe,EAAE,CAAC,CAAC,eAAe;IAClC,iBAAiB,EAAE,CAAC,CAAC,iBAAiB;IACtC,YAAY,EAAE,CAAC,CAAC,YAAY;CAC7B,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACtC,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC3C,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC7C,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACzC,CAAC,CAAC;AAEH,MAAM,OAAO,WAAW;IACO;IAA7B,YAA6B,EAAM;QAAN,OAAE,GAAF,EAAE,CAAI;IAAG,CAAC;IAEvC,GAAG,CAAC,EAAU,EAAE,KAAa,IAAI,CAAC,EAAE;QAClC,MAAM,IAAI,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QACnE,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,aAAa,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI;QACF,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,IAAI,CAAC,EAAE;aACJ,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;aAC5C,IAAI,CAAC,KAAK,CAAC;aACX,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;aACrB,GAAG,EAAE;aACL,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAC/B,CAAC;QACF,MAAM,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,GAAG,EAAE,CAAC;QAC7D,MAAM,aAAa,GAAG,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,aAAa,CAAC;QACrE,OAAO,IAAI,CAAC,EAAE;aACX,MAAM,EAAE;aACR,IAAI,CAAC,KAAK,CAAC;aACX,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;aAC9C,GAAG,EAAE;aACL,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACX,GAAG,YAAY,CAAC,CAAC,CAAC;YAClB,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC;YAC7B,WAAW,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;YAChF,SAAS,EAAE,CAAC,CAAC,EAAE,KAAK,aAAa;SAClC,CAAC,CAAC,CAAC;IACR,CAAC;IAED,MAAM,CAAC,GAAY,EAAE,QAA6B,EAAE;QAClD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;QACxB,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE;gBACjF,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,8BAA8B,CAAC,CAAC;YAC7E,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;iBACb,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;iBAC/C,GAAG,EAAE,CAAC;YACT,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,cAAc;gBACxB,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,KAAK,CAAC,MAAM;gBACrB,MAAM,EAAE,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE;aACzB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,CAAC,EAAU,EAAE,GAAY,EAAE,QAA6B,EAAE;QAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,aAAa,CAAC,eAAe,EAAE,kCAAkC,CAAC,CAAC;QACjG,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC7C,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE;oBACjF,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,8BAA8B,CAAC,CAAC;YAC/E,CAAC;YACD,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;iBACb,GAAG,CAAC,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;iBACxC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;iBACvB,GAAG,EAAE,CAAC;YACT,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,cAAc;gBACxB,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,KAAK,CAAC,MAAM;gBACrB,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE;aAC7D,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,CAAC,EAAU,EAAE,QAA6B,EAAE;QAChD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1B,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,aAAa,CAAC,eAAe,EAAE,kCAAkC,CAAC,CAAC;QAC/F,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,aAAa,KAAK,EAAE;YACvD,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,8DAA8D,CAAC,CAAC;QAC1G,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;YAC1F,IAAI,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,aAAa,CAAC,aAAa,EAAE,GAAG,CAAC,0CAA0C,CAAC,CAAC;YAClG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YAC/C,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,cAAc;gBACxB,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,KAAK,CAAC,MAAM;gBACrB,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;aAChC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,8EAA8E;IAC9E,YAAY,CAAC,EAAU,EAAE,WAAqB,EAAE,QAA6B,EAAE;QAC7E,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1B,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,aAAa,CAAC,eAAe,EAAE,mCAAmC,CAAC,CAAC;QAChG,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,IAAI,GAAG,CACnB,MAAM,CAAC,MAAM;YACX,CAAC,CAAC,IAAI,CAAC,EAAE;iBACJ,MAAM,CAAC,EAAE,EAAE,EAAE,eAAe,CAAC,EAAE,EAAE,CAAC;iBAClC,IAAI,CAAC,eAAe,CAAC;iBACrB,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;iBAC1C,GAAG,EAAE;iBACL,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,CAAC,CAAC,EAAE,CACP,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,IAAI,OAAO,CAAC,MAAM;YAAE,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAE,wBAAwB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChH,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,MAAM,MAAM,GAAG,EAAE;iBACd,MAAM,EAAE;iBACR,IAAI,CAAC,aAAa,CAAC;iBACnB,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;iBACnC,GAAG,EAAE;iBACL,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;YAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1D,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACnB,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC;qBACrB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;qBACpF,GAAG,EAAE,CAAC;gBACT,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC;qBAClB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;qBAC9E,GAAG,EAAE,CAAC;YACX,CAAC;YACD,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAChE,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;YACpE,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,wBAAwB;gBAClC,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,KAAK,CAAC,MAAM;gBACrB,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;aACtC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/auth/users.d.ts

@@ -1,6 +1,7 @@
 import type { SecretBox } from '../crypto/index.js';
 import type { Db } from '../db/index.js';
 import { users } from '../db/schema.js';
+import type { PublicRole } from './roles.js';
 export type UserRow = typeof users.$inferSelect;
 export interface PublicUser {
     id: string;
@@ -11,25 +12,49 @@ export interface PublicUser {
     disabled: boolean;
     createdAt: Date;
     lastLoginAt: Date | null;
+    role: PublicRole;
 }
-export declare const toPublicUser: (u: UserRow) => PublicUser;
+/** How a user came to exist without an admin creating them (design §6.5). */
+export type RegistrationSource = 'oidc' | 'external' | 'signup';
 export declare class UserService {
     private readonly db;
     private readonly box;
     constructor(db: Db, box: SecretBox);
     count(): number;
     list(): PublicUser[];
+    /** A user's role; a dangling role id (none can be made through the API) reads as no access. */
+    roleOf(u: UserRow): PublicRole;
+    toPublic(u: UserRow): PublicUser;
+    isAdmin(u: UserRow): boolean;
     get(id: string): UserRow;
     byUsername(username: string): UserRow | undefined;
+    /** The user a proxy-named identity is (design §6.2): only one an admin made or that `external` mode
+     * registered, so nobody can claim a proxy identity by signing up or through OIDC first. */
+    byExternalIdentity(identity: string): UserRow | undefined;
+    /** Case-insensitive match. */
+    byUsernameInsensitive(username: string): UserRow | undefined;
     byOidc(issuer: string, subject: string): UserRow | undefined;
     create(input: {
         username: string;
         password?: string;
+        roleId?: string;
     }, actor?: {
         userId?: string;
     }, opts?: {
         onlyIfFirst?: boolean;
+        source?: RegistrationSource;
     }): Promise<PublicUser>;
+    /** Self-registration (design §6.5): only while an admin has set a default role, which the user gets. */
+    register(input: {
+        username: string;
+        password?: string;
+    }, source: RegistrationSource): Promise<PublicUser>;
+    registrationOpen(): boolean;
+    /** Enabled admins other than `except`: someone must always be left to administer the server. */
+    private otherAdmins;
+    setRole(userId: string, roleId: string, actor?: {
+        userId?: string;
+    }): void;
     /** First-run setup: only while no users exist (design §6.1). */
     setupFirstUser(username: string, password: string): Promise<PublicUser>;
     /** `ADMIN_BOOTSTRAP_*`: create the first user on boot if none exist; ignored afterwards. */

package/dist/auth/users.js

@@ -1,19 +1,22 @@
 import { randomUUID } from 'node:crypto';
 import { hash, verify } from '@node-rs/argon2';
-import { and, asc, count, eq } from 'drizzle-orm';
+import { and, asc, count, eq, ne, sql } from 'drizzle-orm';
 import { writeAudit } from '../audit.js';
 import { aad } from '../crypto/index.js';
-import { users } from '../db/schema.js';
+import { roles, users } from '../db/schema.js';
 import { ConflictError, NotFoundError, ValidationError } from '../errors.js';
+import { ADMIN_ROLE_ID } from '../gate/access.js';
+import { getSettings } from '../settings.js';
+import { toPublicRole } from './roles.js';
 import { randomToken, sha256 } from './tokens.js';
 import { generateTotpSecret, otpauthUri, verifyTotp } from './totp.js';
-/** Portal accounts (design §6.1): argon2id passwords, optional TOTP with recovery codes and OIDC link;
- * no roles. */
+/** Portal accounts (design §6.1): argon2id passwords, optional TOTP with recovery codes and OIDC link,
+ * and one role each (design §6.4). */
 // argon2id, m = 64 MiB, t = 3, p = 1 (design §6.1). @node-rs/argon2 defaults to argon2id.
 const ARGON = { memoryCost: 65536, timeCost: 3, parallelism: 1 };
-const USERNAME = /^[a-zA-Z0-9._@-]{2,64}$/;
+const USERNAME = /^[a-zA-Z0-9._@:-]{2,64}$/;
 const RECOVERY_CODES = 10;
-export const toPublicUser = (u) => ({
+const toPublicUser = (u, role) => ({
     id: u.id,
     username: u.username,
     totpEnabled: u.totpEnabled,
@@ -22,6 +25,7 @@ export const toPublicUser = (u) => ({
     disabled: u.disabled,
     createdAt: u.createdAt,
     lastLoginAt: u.lastLoginAt,
+    role,
 });
 function checkPasswordPolicy(password) {
     if (typeof password !== 'string' || password.length < 12) {
@@ -43,7 +47,32 @@ export class UserService {
         return this.db.select({ n: count() }).from(users).get()?.n ?? 0;
     }
     list() {
-        return this.db.select().from(users).orderBy(asc(users.username)).all().map(toPublicUser);
+        return this.db
+            .select()
+            .from(users)
+            .orderBy(asc(users.username))
+            .all()
+            .map((u) => this.toPublic(u));
+    }
+    /** A user's role; a dangling role id (none can be made through the API) reads as no access. */
+    roleOf(u) {
+        const role = this.db.select().from(roles).where(eq(roles.id, u.roleId)).get();
+        return role
+            ? toPublicRole(role)
+            : {
+                id: u.roleId,
+                name: 'Unknown',
+                isAdmin: false,
+                canSetOwnLevels: false,
+                canManageOwnRules: false,
+                canSeeStatus: false,
+            };
+    }
+    toPublic(u) {
+        return toPublicUser(u, this.roleOf(u));
+    }
+    isAdmin(u) {
+        return u.roleId === ADMIN_ROLE_ID;
     }
     get(id) {
         const u = this.db.select().from(users).where(eq(users.id, id)).get();
@@ -54,6 +83,21 @@ export class UserService {
     byUsername(username) {
         return this.db.select().from(users).where(eq(users.username, username)).get();
     }
+    /** The user a proxy-named identity is (design §6.2): only one an admin made or that `external` mode
+     * registered, so nobody can claim a proxy identity by signing up or through OIDC first. */
+    byExternalIdentity(identity) {
+        const found = this.byUsernameInsensitive(identity);
+        return found && (found.registeredVia === null || found.registeredVia === 'external') ? found : undefined;
+    }
+    /** Case-insensitive match. */
+    byUsernameInsensitive(username) {
+        return this.db
+            .select()
+            .from(users)
+            .where(sql `lower(${users.username}) = lower(${username})`)
+            .orderBy(asc(users.createdAt))
+            .get();
+    }
     byOidc(issuer, subject) {
         return this.db
             .select()
@@ -62,11 +106,15 @@ export class UserService {
             .get();
     }
     async create(input, actor = {}, opts = {}) {
+        const roleId = input.roleId ?? ADMIN_ROLE_ID;
+        if (!this.db.select({ id: roles.id }).from(roles).where(eq(roles.id, roleId)).get())
+            throw new ValidationError('unknown_role', 'No such role');
         const username = input.username.trim();
         if (!USERNAME.test(username)) {
             throw new ValidationError('invalid_username', 'Usernames are 2–64 letters, digits, dots, dashes, underscores or @');
         }
-        if (this.byUsername(username))
+        // Unique regardless of case: proxy identities match names that way (design §6.2).
+        if (this.byUsernameInsensitive(username))
             throw new ConflictError('username_taken', 'That username is taken');
         if (input.password !== undefined)
             checkPasswordPolicy(input.password);
@@ -75,24 +123,71 @@ export class UserService {
             username,
             passwordHash: input.password ? await hash(input.password, ARGON) : null,
             createdAt: new Date(),
+            roleId,
+            registeredVia: opts.source ?? null,
         };
         this.db.transaction((tx) => {
             // Re-checked after the (slow) hash, in the same transaction as the insert: of two concurrent
             // first-run setups only one creates a user.
             if (opts.onlyIfFirst && (tx.select({ n: count() }).from(users).get()?.n ?? 0) > 0)
                 throw new ConflictError('setup_done', 'Setup has already been completed');
-            if (tx.select({ id: users.id }).from(users).where(eq(users.username, username)).get())
+            if (tx
+                .select({ id: users.id })
+                .from(users)
+                .where(sql `lower(${users.username}) = lower(${username})`)
+                .get())
                 throw new ConflictError('username_taken', 'That username is taken');
             tx.insert(users).values(row).run();
             writeAudit(tx, {
                 kind: 'auth',
-                decision: 'user_created',
+                decision: opts.source ? 'user_registered' : 'user_created',
                 actorKind: actor.userId ? 'user' : 'system',
                 actorId: actor.userId,
-                detail: { username },
+                detail: { username, roleId, ...(opts.source ? { source: opts.source } : {}) },
+            });
+        });
+        return this.toPublic(this.get(row.id));
+    }
+    /** Self-registration (design §6.5): only while an admin has set a default role, which the user gets. */
+    async register(input, source) {
+        const roleId = getSettings(this.db, 'security').defaultRoleId;
+        if (!roleId)
+            throw new ConflictError('registration_closed', 'This server does not accept new accounts');
+        // `:` names Cloudflare service tokens (`service:<id>`); only the proxy may bring such a name.
+        if (source !== 'external' && input.username.includes(':'))
+            throw new ValidationError('invalid_username', 'Usernames are 2–64 letters, digits, dots, dashes, underscores or @');
+        return this.create({ ...input, roleId }, {}, { source });
+    }
+    registrationOpen() {
+        const roleId = getSettings(this.db, 'security').defaultRoleId;
+        return !!roleId && !!this.db.select({ id: roles.id }).from(roles).where(eq(roles.id, roleId)).get();
+    }
+    /** Enabled admins other than `except`: someone must always be left to administer the server. */
+    otherAdmins(except) {
+        return (this.db
+            .select({ n: count() })
+            .from(users)
+            .where(and(eq(users.roleId, ADMIN_ROLE_ID), eq(users.disabled, false), ne(users.id, except)))
+            .get()?.n ?? 0);
+    }
+    setRole(userId, roleId, actor = {}) {
+        const user = this.get(userId);
+        if (!this.db.select({ id: roles.id }).from(roles).where(eq(roles.id, roleId)).get())
+            throw new ValidationError('unknown_role', 'No such role');
+        if (user.roleId === roleId)
+            return;
+        if (user.roleId === ADMIN_ROLE_ID && !user.disabled && this.otherAdmins(userId) === 0)
+            throw new ConflictError('last_admin', 'You cannot remove the last enabled admin');
+        this.db.transaction((tx) => {
+            tx.update(users).set({ roleId }).where(eq(users.id, userId)).run();
+            writeAudit(tx, {
+                kind: 'auth',
+                decision: 'user_role_changed',
+                actorKind: 'user',
+                actorId: actor.userId,
+                detail: { username: user.username, from: user.roleId, to: roleId },
             });
         });
-        return toPublicUser(this.get(row.id));
     }
     /** First-run setup: only while no users exist (design §6.1). */
     async setupFirstUser(username, password) {
@@ -145,6 +240,8 @@ export class UserService {
             if (active.length === 1 && active[0].id === userId) {
                 throw new ConflictError('last_user', 'You cannot disable the last active user');
             }
+            if (user.roleId === ADMIN_ROLE_ID && !user.disabled && this.otherAdmins(userId) === 0)
+                throw new ConflictError('last_admin', 'You cannot disable the last enabled admin');
         }
         this.db.transaction((tx) => {
             tx.update(users).set({ disabled }).where(eq(users.id, userId)).run();

package/dist/auth/users.js.map

@@ -1 +1 @@
-{"version":3,"file":"users.js","sourceRoot":"","sources":["../../src/auth/users.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AAGzC,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvE;eACe;AAEf,0FAA0F;AAC1F,MAAM,KAAK,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;AACjE,MAAM,QAAQ,GAAG,yBAAyB,CAAC;AAC3C,MAAM,cAAc,GAAG,EAAE,CAAC;AAe1B,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAU,EAAc,EAAE,CAAC,CAAC;IACvD,EAAE,EAAE,CAAC,CAAC,EAAE;IACR,QAAQ,EAAE,CAAC,CAAC,QAAQ;IACpB,WAAW,EAAE,CAAC,CAAC,WAAW;IAC1B,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW;IAC3B,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY;IAC7B,QAAQ,EAAE,CAAC,CAAC,QAAQ;IACpB,SAAS,EAAE,CAAC,CAAC,SAAS;IACtB,WAAW,EAAE,CAAC,CAAC,WAAW;CAC3B,CAAC,CAAC;AAEH,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACzD,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,0CAA0C,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,IAAI;QAAE,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC;AACjG,CAAC;AAED,qGAAqG;AACrG,IAAI,SAAsC,CAAC;AAE3C,MAAM,OAAO,WAAW;IAEH;IACA;IAFnB,YACmB,EAAM,EACN,GAAc;QADd,OAAE,GAAF,EAAE,CAAI;QACN,QAAG,GAAH,GAAG,CAAW;IAC9B,CAAC;IAEJ,KAAK;QACH,OAAO,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IAClE,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC3F,CAAC;IAED,GAAG,CAAC,EAAU;QACZ,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QACrE,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,aAAa,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;QAClE,OAAO,CAAC,CAAC;IACX,CAAC;IAED,UAAU,CAAC,QAAgB;QACzB,OAAO,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IAChF,CAAC;IAED,MAAM,CAAC,MAAc,EAAE,OAAe;QACpC,OAAO,IAAI,CAAC,EAAE;aACX,MAAM,EAAE;aACR,IAAI,CAAC,KAAK,CAAC;aACX,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;aACxE,GAAG,EAAE,CAAC;IACX,CAAC;IAED,KAAK,CAAC,MAAM,CACV,KAA8C,EAC9C,QAA6B,EAAE,EAC/B,OAAkC,EAAE;QAEpC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACvC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,oEAAoE,CACrE,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,aAAa,CAAC,gBAAgB,EAAE,wBAAwB,CAAC,CAAC;QACnG,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;YAAE,mBAAmB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACtE,MAAM,GAAG,GAAG;YACV,EAAE,EAAE,UAAU,EAAE;YAChB,QAAQ;YACR,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;YACvE,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAC;QACF,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,6FAA6F;YAC7F,4CAA4C;YAC5C,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC;gBAC/E,MAAM,IAAI,aAAa,CAAC,YAAY,EAAE,kCAAkC,CAAC,CAAC;YAC5E,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE;gBACnF,MAAM,IAAI,aAAa,CAAC,gBAAgB,EAAE,wBAAwB,CAAC,CAAC;YACtE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACnC,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,cAAc;gBACxB,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;gBAC3C,OAAO,EAAE,KAAK,CAAC,MAAM;gBACrB,MAAM,EAAE,EAAE,QAAQ,EAAE;aACrB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,gEAAgE;IAChE,KAAK,CAAC,cAAc,CAAC,QAAgB,EAAE,QAAgB;QACrD,IAAI,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC;YAAE,MAAM,IAAI,aAAa,CAAC,YAAY,EAAE,kCAAkC,CAAC,CAAC;QAChG,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,4FAA4F;IAC5F,KAAK,CAAC,SAAS,CAAC,QAAiB,EAAE,QAAiB;QAClD,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;YAAE,OAAO,gBAAgB,CAAC;QACpD,IAAI,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QACvC,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,QAAgB,EAAE,QAAgB;QACrD,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,EAAE,YAAY,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACzC,SAAS,KAAK,IAAI,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,CAAC;YACzC,MAAM,MAAM,CAAC,MAAM,SAAS,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;YAC3D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACtF,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc,EAAE,QAAgB,EAAE,OAAuD,EAAE;QAC3G,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC5D,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBAChF,MAAM,IAAI,eAAe,CAAC,gBAAgB,EAAE,+BAA+B,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC;QACD,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAC9B,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YACzE,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,kBAAkB;gBAC5B,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,MAAM;gBAC/B,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;aACpC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,WAAW,CAAC,MAAc,EAAE,QAAiB,EAAE,QAA6B,EAAE;QAC5E,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YACnF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAE,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;gBACpD,MAAM,IAAI,aAAa,CAAC,WAAW,EAAE,yCAAyC,CAAC,CAAC;YAClF,CAAC;QACH,CAAC;QACD,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YACrE,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,cAAc;gBACrD,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,KAAK,CAAC,MAAM;gBACrB,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;aACpC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,SAAS,CAAC,MAAc;QACtB,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IAC3F,CAAC;IAED,oGAAoG;IAE5F,UAAU,CAAC,IAAa;QAC9B,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC;QACrC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC,OAAO,EAAE,iBAAiB,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzG,CAAC;IAED,oFAAoF;IACpF,SAAS,CAAC,MAAc;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,yCAAyC,CAAC,CAAC;QACzG,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;QACpC,IAAI,CAAC,EAAE;aACJ,MAAM,CAAC,KAAK,CAAC;aACb,GAAG,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;aAC7G,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;aAC3B,GAAG,EAAE,CAAC;QACT,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC5D,CAAC;IAED,oGAAoG;IACpG,WAAW,CAAC,MAAc,EAAE,IAAY;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,aAAa,CAAC,kBAAkB,EAAE,6BAA6B,CAAC,CAAC;QAC5G,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACtC,IAAI,IAAI,KAAK,IAAI;YAAE,MAAM,IAAI,eAAe,CAAC,cAAc,EAAE,wBAAwB,CAAC,CAAC;QACvF,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,GAAG,EAAE,CACxD,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAC/D,CAAC;QACF,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;iBACb,GAAG,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;iBACpF,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;iBAC3B,GAAG,EAAE,CAAC;YACT,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,cAAc;gBACxB,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,MAAM;gBACf,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;aACpC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACf,CAAC;IAED,SAAS,CAAC,MAAc,EAAE,QAA6B,EAAE;QACvD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;iBACb,GAAG,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;iBAC7F,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;iBAC3B,GAAG,EAAE,CAAC;YACT,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,YAAY;gBACtB,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,KAAK,CAAC,MAAM,IAAI,MAAM;gBAC/B,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;aACpC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,6GAA6G;IAC7G,cAAc,CAAC,MAAc,EAAE,IAAY;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC/C,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;QACvE,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAChC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QACpF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,mFAAmF;IACnF,kBAAkB,CAAC,MAAc,EAAE,IAAY;QAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7D,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC;YAAE,OAAO,MAAM,CAAC;QACrD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QACjD,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,IAAI,EAAE,CAAC;QAC/C,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC,EAAE;iBACJ,MAAM,CAAC,KAAK,CAAC;iBACb,GAAG,CAAC,EAAE,iBAAiB,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,EAAE,CAAC;iBACjE,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;iBAC3B,GAAG,EAAE,CAAC;YACT,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE;gBAClB,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,oBAAoB;gBAC9B,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,MAAM;gBACf,MAAM,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE;aAC5C,CAAC,CAAC;YACH,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,oGAAoG;IAEpG,QAAQ,CAAC,MAAc,EAAE,MAAc,EAAE,OAAe;QACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC9C,IAAI,QAAQ,IAAI,QAAQ,CAAC,EAAE,KAAK,MAAM;YACpC,MAAM,IAAI,aAAa,CAAC,YAAY,EAAE,yCAAyC,CAAC,CAAC;QACnF,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YACrG,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,aAAa;gBACvB,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,MAAM;gBACf,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;aAC5B,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CAAC,MAAc,EAAE,QAA6B,EAAE;QACxD,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YAChG,UAAU,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,IAAI,MAAM,EAAE,CAAC,CAAC;QAClH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,iBAAiB,CAAC,MAAe;QAC/B,OAAO,IAAI,CAAC,EAAE;aACX,MAAM,EAAE;aACR,IAAI,CAAC,KAAK,CAAC;aACX,GAAG,EAAE;aACL,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;IACpE,CAAC;CACF"}
+{"version":3,"file":"users.js","sourceRoot":"","sources":["../../src/auth/users.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AAGzC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC7E,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1C,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvE;sCACsC;AAEtC,0FAA0F;AAC1F,MAAM,KAAK,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;AACjE,MAAM,QAAQ,GAAG,0BAA0B,CAAC;AAC5C,MAAM,cAAc,GAAG,EAAE,CAAC;AAmB1B,MAAM,YAAY,GAAG,CAAC,CAAU,EAAE,IAAgB,EAAc,EAAE,CAAC,CAAC;IAClE,EAAE,EAAE,CAAC,CAAC,EAAE;IACR,QAAQ,EAAE,CAAC,CAAC,QAAQ;IACpB,WAAW,EAAE,CAAC,CAAC,WAAW;IAC1B,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW;IAC3B,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY;IAC7B,QAAQ,EAAE,CAAC,CAAC,QAAQ;IACpB,SAAS,EAAE,CAAC,CAAC,SAAS;IACtB,WAAW,EAAE,CAAC,CAAC,WAAW;IAC1B,IAAI;CACL,CAAC,CAAC;AAEH,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACzD,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,0CAA0C,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,IAAI;QAAE,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC;AACjG,CAAC;AAED,qGAAqG;AACrG,IAAI,SAAsC,CAAC;AAE3C,MAAM,OAAO,WAAW;IAEH;IACA;IAFnB,YACmB,EAAM,EACN,GAAc;QADd,OAAE,GAAF,EAAE,CAAI;QACN,QAAG,GAAH,GAAG,CAAW;IAC9B,CAAC;IAEJ,KAAK;QACH,OAAO,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IAClE,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,EAAE;aACX,MAAM,EAAE;aACR,IAAI,CAAC,KAAK,CAAC;aACX,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;aAC5B,GAAG,EAAE;aACL,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IAED,+FAA+F;IAC/F,MAAM,CAAC,CAAU;QACf,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QAC9E,OAAO,IAAI;YACT,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC;YACpB,CAAC,CAAC;gBACE,EAAE,EAAE,CAAC,CAAC,MAAM;gBACZ,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,KAAK;gBACd,eAAe,EAAE,KAAK;gBACtB,iBAAiB,EAAE,KAAK;gBACxB,YAAY,EAAE,KAAK;aACpB,CAAC;IACR,CAAC;IAED,QAAQ,CAAC,CAAU;QACjB,OAAO,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,CAAC;IAED,OAAO,CAAC,CAAU;QAChB,OAAO,CAAC,CAAC,MAAM,KAAK,aAAa,CAAC;IACpC,CAAC;IAED,GAAG,CAAC,EAAU;QACZ,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QACrE,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,aAAa,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;QAClE,OAAO,CAAC,CAAC;IACX,CAAC;IAED,UAAU,CAAC,QAAgB;QACzB,OAAO,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IAChF,CAAC;IAED;+FAC2F;IAC3F,kBAAkB,CAAC,QAAgB;QACjC,MAAM,KAAK,GAAG,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACnD,OAAO,KAAK,IAAI,CAAC,KAAK,CAAC,aAAa,KAAK,IAAI,IAAI,KAAK,CAAC,aAAa,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3G,CAAC;IAED,8BAA8B;IAC9B,qBAAqB,CAAC,QAAgB;QACpC,OAAO,IAAI,CAAC,EAAE;aACX,MAAM,EAAE;aACR,IAAI,CAAC,KAAK,CAAC;aACX,KAAK,CAAC,GAAG,CAAA,SAAS,KAAK,CAAC,QAAQ,aAAa,QAAQ,GAAG,CAAC;aACzD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;aAC7B,GAAG,EAAE,CAAC;IACX,CAAC;IAED,MAAM,CAAC,MAAc,EAAE,OAAe;QACpC,OAAO,IAAI,CAAC,EAAE;aACX,MAAM,EAAE;aACR,IAAI,CAAC,KAAK,CAAC;aACX,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;aACxE,GAAG,EAAE,CAAC;IACX,CAAC;IAED,KAAK,CAAC,MAAM,CACV,KAA+D,EAC/D,QAA6B,EAAE,EAC/B,OAA+D,EAAE;QAEjE,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,aAAa,CAAC;QAC7C,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE;YACjF,MAAM,IAAI,eAAe,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACvC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,oEAAoE,CACrE,CAAC;QACJ,CAAC;QACD,kFAAkF;QAClF,IAAI,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,aAAa,CAAC,gBAAgB,EAAE,wBAAwB,CAAC,CAAC;QAC9G,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;YAAE,mBAAmB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACtE,MAAM,GAAG,GAAG;YACV,EAAE,EAAE,UAAU,EAAE;YAChB,QAAQ;YACR,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;YACvE,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,MAAM;YACN,aAAa,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;SACnC,CAAC;QACF,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,6FAA6F;YAC7F,4CAA4C;YAC5C,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC;gBAC/E,MAAM,IAAI,aAAa,CAAC,YAAY,EAAE,kCAAkC,CAAC,CAAC;YAC5E,IACE,EAAE;iBACC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;iBACxB,IAAI,CAAC,KAAK,CAAC;iBACX,KAAK,CAAC,GAAG,CAAA,SAAS,KAAK,CAAC,QAAQ,aAAa,QAAQ,GAAG,CAAC;iBACzD,GAAG,EAAE;gBAER,MAAM,IAAI,aAAa,CAAC,gBAAgB,EAAE,wBAAwB,CAAC,CAAC;YACtE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACnC,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,cAAc;gBAC1D,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;gBAC3C,OAAO,EAAE,KAAK,CAAC,MAAM;gBACrB,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;aAC9E,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACzC,CAAC;IAED,wGAAwG;IACxG,KAAK,CAAC,QAAQ,CAAC,KAA8C,EAAE,MAA0B;QACvF,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,aAAa,CAAC;QAC9D,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,aAAa,CAAC,qBAAqB,EAAE,0CAA0C,CAAC,CAAC;QACxG,8FAA8F;QAC9F,IAAI,MAAM,KAAK,UAAU,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YACvD,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,oEAAoE,CACrE,CAAC;QACJ,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,gBAAgB;QACd,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,aAAa,CAAC;QAC9D,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IACtG,CAAC;IAED,gGAAgG;IACxF,WAAW,CAAC,MAAc;QAChC,OAAO,CACL,IAAI,CAAC,EAAE;aACJ,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;aACtB,IAAI,CAAC,KAAK,CAAC;aACX,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;aAC5F,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,CACjB,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,MAAc,EAAE,MAAc,EAAE,QAA6B,EAAE;QACrE,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE;YACjF,MAAM,IAAI,eAAe,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;QAC5D,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM;YAAE,OAAO;QACnC,IAAI,IAAI,CAAC,MAAM,KAAK,aAAa,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC;YACnF,MAAM,IAAI,aAAa,CAAC,YAAY,EAAE,0CAA0C,CAAC,CAAC;QACpF,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YACnE,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,mBAAmB;gBAC7B,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,KAAK,CAAC,MAAM;gBACrB,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE;aACnE,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,gEAAgE;IAChE,KAAK,CAAC,cAAc,CAAC,QAAgB,EAAE,QAAgB;QACrD,IAAI,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC;YAAE,MAAM,IAAI,aAAa,CAAC,YAAY,EAAE,kCAAkC,CAAC,CAAC;QAChG,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,4FAA4F;IAC5F,KAAK,CAAC,SAAS,CAAC,QAAiB,EAAE,QAAiB;QAClD,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;YAAE,OAAO,gBAAgB,CAAC;QACpD,IAAI,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QACvC,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,QAAgB,EAAE,QAAgB;QACrD,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,EAAE,YAAY,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACzC,SAAS,KAAK,IAAI,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,CAAC;YACzC,MAAM,MAAM,CAAC,MAAM,SAAS,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;YAC3D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACtF,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc,EAAE,QAAgB,EAAE,OAAuD,EAAE;QAC3G,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC5D,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBAChF,MAAM,IAAI,eAAe,CAAC,gBAAgB,EAAE,+BAA+B,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC;QACD,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAC9B,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YACzE,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,kBAAkB;gBAC5B,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,MAAM;gBAC/B,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;aACpC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,WAAW,CAAC,MAAc,EAAE,QAAiB,EAAE,QAA6B,EAAE;QAC5E,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YACnF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAE,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;gBACpD,MAAM,IAAI,aAAa,CAAC,WAAW,EAAE,yCAAyC,CAAC,CAAC;YAClF,CAAC;YACD,IAAI,IAAI,CAAC,MAAM,KAAK,aAAa,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC;gBACnF,MAAM,IAAI,aAAa,CAAC,YAAY,EAAE,2CAA2C,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YACrE,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,cAAc;gBACrD,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,KAAK,CAAC,MAAM;gBACrB,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;aACpC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,SAAS,CAAC,MAAc;QACtB,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IAC3F,CAAC;IAED,oGAAoG;IAE5F,UAAU,CAAC,IAAa;QAC9B,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC;QACrC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC,OAAO,EAAE,iBAAiB,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzG,CAAC;IAED,oFAAoF;IACpF,SAAS,CAAC,MAAc;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,yCAAyC,CAAC,CAAC;QACzG,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;QACpC,IAAI,CAAC,EAAE;aACJ,MAAM,CAAC,KAAK,CAAC;aACb,GAAG,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;aAC7G,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;aAC3B,GAAG,EAAE,CAAC;QACT,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC5D,CAAC;IAED,oGAAoG;IACpG,WAAW,CAAC,MAAc,EAAE,IAAY;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,aAAa,CAAC,kBAAkB,EAAE,6BAA6B,CAAC,CAAC;QAC5G,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACtC,IAAI,IAAI,KAAK,IAAI;YAAE,MAAM,IAAI,eAAe,CAAC,cAAc,EAAE,wBAAwB,CAAC,CAAC;QACvF,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,GAAG,EAAE,CACxD,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAC/D,CAAC;QACF,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;iBACb,GAAG,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;iBACpF,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;iBAC3B,GAAG,EAAE,CAAC;YACT,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,cAAc;gBACxB,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,MAAM;gBACf,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;aACpC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACf,CAAC;IAED,SAAS,CAAC,MAAc,EAAE,QAA6B,EAAE;QACvD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;iBACb,GAAG,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;iBAC7F,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;iBAC3B,GAAG,EAAE,CAAC;YACT,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,YAAY;gBACtB,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,KAAK,CAAC,MAAM,IAAI,MAAM;gBAC/B,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;aACpC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,6GAA6G;IAC7G,cAAc,CAAC,MAAc,EAAE,IAAY;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC/C,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;QACvE,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAChC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QACpF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,mFAAmF;IACnF,kBAAkB,CAAC,MAAc,EAAE,IAAY;QAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7D,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC;YAAE,OAAO,MAAM,CAAC;QACrD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QACjD,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,IAAI,EAAE,CAAC;QAC/C,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC,EAAE;iBACJ,MAAM,CAAC,KAAK,CAAC;iBACb,GAAG,CAAC,EAAE,iBAAiB,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,EAAE,CAAC;iBACjE,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;iBAC3B,GAAG,EAAE,CAAC;YACT,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE;gBAClB,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,oBAAoB;gBAC9B,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,MAAM;gBACf,MAAM,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE;aAC5C,CAAC,CAAC;YACH,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,oGAAoG;IAEpG,QAAQ,CAAC,MAAc,EAAE,MAAc,EAAE,OAAe;QACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC9C,IAAI,QAAQ,IAAI,QAAQ,CAAC,EAAE,KAAK,MAAM;YACpC,MAAM,IAAI,aAAa,CAAC,YAAY,EAAE,yCAAyC,CAAC,CAAC;QACnF,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YACrG,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,aAAa;gBACvB,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,MAAM;gBACf,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;aAC5B,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CAAC,MAAc,EAAE,QAA6B,EAAE;QACxD,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YAChG,UAAU,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,IAAI,MAAM,EAAE,CAAC,CAAC;QAClH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,iBAAiB,CAAC,MAAe;QAC/B,OAAO,IAAI,CAAC,EAAE;aACX,MAAM,EAAE;aACR,IAAI,CAAC,KAAK,CAAC;aACX,GAAG,EAAE;aACL,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;IACpE,CAAC;CACF"}

package/dist/catalog/groups.js

@@ -4,6 +4,7 @@ import { writeAudit } from '../audit.js';
 import { operationGroupAliases, operationGroups, operations, pluginInstances } from '../db/schema.js';
 import { ConflictError, NotFoundError, ValidationError } from '../errors.js';
 import { ACCESS_LEVELS, FULL_ACCESS, allowedLevels, effectiveAccess, isAccessLevel, minLevel } from '../gate/access.js';
+import { loadCaps } from './role-levels.js';
 function assertLevel(level) {
     if (!isAccessLevel(level)) {
         throw new ValidationError('invalid_level', `Level must be one of ${ACCESS_LEVELS.join(', ')}`);
@@ -91,7 +92,7 @@ export function resolveAccess(db, instanceId, key, principal = FULL_ACCESS) {
     if (!op || op.stale)
         return { reachable: false, reason: 'unknown_operation' };
     const group = db.select().from(operationGroups).where(eq(operationGroups.id, op.groupId)).get();
-    return effectiveAccess(accessInput(op), group, principal);
+    return effectiveAccess(accessInput(op), group, principal, loadCaps(db, instanceId, principal)?.(op));
 }
 // ── group level ──────────────────────────────────────────────────────────────────────────────────
 /** Sets a group's level and resets its operations to follow it; raising to `write` acknowledges the