@things-factory/auth-base 10.1.106 → 10.1.111

package/dist-server/service/open-fields.js

@@ -20,6 +20,8 @@ exports.openFields = {
         'Query.passwordRule': "the installation's password policy. The change-password screen needs it before the caller has any privilege — and after a forced reset they may have none",
         'Query.authProviderTypes': "which provider types this build supports. A catalogue, not a tenant's configuration",
         'Query.myAccessRequests': "the caller's own access requests",
+        'Query.mayChangeParentRoles': "whether the caller may give the parent domain's roles here - about the caller only",
+        'Query.accessRequestDeciderCount': 'how many people an access request from the caller would reach - a number, never who',
         'Mutation.requestAccess': 'asked by someone refused for want of a role - a gate here would need the privilege being asked for. The door asks only for the caller and judges again that a role would open it (ADR-0103)',
         'Mutation.withdrawAccessRequest': "withdraws the caller's own pending request and nobody else's"
     }

package/dist-server/service/open-fields.js.map

@@ -1 +1 @@
-{"version":3,"file":"open-fields.js","sourceRoot":"","sources":["../../server/service/open-fields.ts"],"names":[],"mappings":";;;AAEA;;;;;;GAMG;AACU,QAAA,UAAU,GAA0B;IAC/C,QAAQ,EAAE;QACR,wBAAwB,EAAE,2BAA2B;QACrD,eAAe,EAAE,wBAAwB;QACzC,oBAAoB,EAAE,0EAA0E;QAChG,4BAA4B,EAAE,sCAAsC;QACpE,8BAA8B,EAAE,2CAA2C;QAC3E,wCAAwC,EAAE,iCAAiC;QAC3E,4BAA4B,EAAE,qDAAqD;QACnF,oBAAoB,EAClB,2JAA2J;QAC7J,yBAAyB,EAAE,qFAAqF;QAChH,wBAAwB,EAAE,kCAAkC;QAC5D,wBAAwB,EACtB,6LAA6L;QAC/L,gCAAgC,EAAE,8DAA8D;KACjG;CACF,CAAA","sourcesContent":["import type { OpenFieldsDeclaration } from './privilege/open-field-rule.js'\n\n/**\n * auth-base's root fields that declare no `@privilege` — every one of them, and why.\n *\n * There is no `notYetDeclared` here. The twelve that were open without a reason were closed on\n * 2026-09-20 (`c02ee9bdc1`); what is left answers about the caller, or about the installation\n * rather than anybody's data. An addition to this list needs its reason written first.\n */\nexport const openFields: OpenFieldsDeclaration = {\n  byDesign: {\n    'Query.myLoginHistories': \"the caller's own sign-ins\",\n    'Query.myRoles': \"the caller's own roles\",\n    'Query.hasPrivilege': 'whether the caller has one — a gate here would need the answer to itself',\n    'Query.domainsWithPrivilege': 'the domains where the caller has one',\n    'Query.checkUserBelongsDomain': 'whether the caller belongs to this domain',\n    'Query.checkResettablePasswordToDefault': \"about the caller's own password\",\n    'Query.checkDefaultPassword': 'whether the caller is still on the default password',\n    'Query.passwordRule':\n      \"the installation's password policy. The change-password screen needs it before the caller has any privilege — and after a forced reset they may have none\",\n    'Query.authProviderTypes': \"which provider types this build supports. A catalogue, not a tenant's configuration\",\n    'Query.myAccessRequests': \"the caller's own access requests\",\n    'Mutation.requestAccess':\n      'asked by someone refused for want of a role - a gate here would need the privilege being asked for. The door asks only for the caller and judges again that a role would open it (ADR-0103)',\n    'Mutation.withdrawAccessRequest': \"withdraws the caller's own pending request and nobody else's\"\n  }\n}\n"]}
+{"version":3,"file":"open-fields.js","sourceRoot":"","sources":["../../server/service/open-fields.ts"],"names":[],"mappings":";;;AAEA;;;;;;GAMG;AACU,QAAA,UAAU,GAA0B;IAC/C,QAAQ,EAAE;QACR,wBAAwB,EAAE,2BAA2B;QACrD,eAAe,EAAE,wBAAwB;QACzC,oBAAoB,EAAE,0EAA0E;QAChG,4BAA4B,EAAE,sCAAsC;QACpE,8BAA8B,EAAE,2CAA2C;QAC3E,wCAAwC,EAAE,iCAAiC;QAC3E,4BAA4B,EAAE,qDAAqD;QACnF,oBAAoB,EAClB,2JAA2J;QAC7J,yBAAyB,EAAE,qFAAqF;QAChH,wBAAwB,EAAE,kCAAkC;QAC5D,4BAA4B,EAAE,oFAAoF;QAClH,iCAAiC,EAAE,qFAAqF;QACxH,wBAAwB,EACtB,6LAA6L;QAC/L,gCAAgC,EAAE,8DAA8D;KACjG;CACF,CAAA","sourcesContent":["import type { OpenFieldsDeclaration } from './privilege/open-field-rule.js'\n\n/**\n * auth-base's root fields that declare no `@privilege` — every one of them, and why.\n *\n * There is no `notYetDeclared` here. The twelve that were open without a reason were closed on\n * 2026-09-20 (`c02ee9bdc1`); what is left answers about the caller, or about the installation\n * rather than anybody's data. An addition to this list needs its reason written first.\n */\nexport const openFields: OpenFieldsDeclaration = {\n  byDesign: {\n    'Query.myLoginHistories': \"the caller's own sign-ins\",\n    'Query.myRoles': \"the caller's own roles\",\n    'Query.hasPrivilege': 'whether the caller has one — a gate here would need the answer to itself',\n    'Query.domainsWithPrivilege': 'the domains where the caller has one',\n    'Query.checkUserBelongsDomain': 'whether the caller belongs to this domain',\n    'Query.checkResettablePasswordToDefault': \"about the caller's own password\",\n    'Query.checkDefaultPassword': 'whether the caller is still on the default password',\n    'Query.passwordRule':\n      \"the installation's password policy. The change-password screen needs it before the caller has any privilege — and after a forced reset they may have none\",\n    'Query.authProviderTypes': \"which provider types this build supports. A catalogue, not a tenant's configuration\",\n    'Query.myAccessRequests': \"the caller's own access requests\",\n    'Query.mayChangeParentRoles': \"whether the caller may give the parent domain's roles here - about the caller only\",\n    'Query.accessRequestDeciderCount': 'how many people an access request from the caller would reach - a number, never who',\n    'Mutation.requestAccess':\n      'asked by someone refused for want of a role - a gate here would need the privilege being asked for. The door asks only for the caller and judges again that a role would open it (ADR-0103)',\n    'Mutation.withdrawAccessRequest': \"withdraws the caller's own pending request and nobody else's\"\n  }\n}\n"]}

package/dist-server/service/privilege/privilege-directive.js

@@ -185,7 +185,7 @@ const privilegeDirectiveResolver = (schema, options = {}) => {
                      *
                      * 문장 만들기는 `privilege-rejection.ts` 가 소유한다.
                      */
-                    throw (0, privilege_rejection_js_1.privilegeRejection)(context, category, privilege, judgement.because);
+                    throw (0, privilege_rejection_js_1.privilegeRejection)(context, category, privilege, judgement.because, info?.operation?.operation);
                 };
                 /*
                  * ── A subscription is opened by `subscribe`, not `resolve` ────────────
@@ -199,7 +199,7 @@ const privilegeDirectiveResolver = (schema, options = {}) => {
                         const { domain, user, unsafeIP, prohibitedPrivileges } = context.state;
                         const judgement = await (0, check_permission_js_1.judgePermission)({ category, privilege, owner: domainOwnerGranted, super: superUserGranted }, user, domain, unsafeIP, prohibitedPrivileges);
                         if (judgement.permitted === false) {
-                            throw (0, privilege_rejection_js_1.privilegeRejection)(context, category, privilege, judgement.because);
+                            throw (0, privilege_rejection_js_1.privilegeRejection)(context, category, privilege, judgement.because, 'subscription');
                         }
                         return await subscribe.call(this, source, args, context, info);
                     };

package/dist-server/service/privilege/privilege-directive.js.map

@@ -1 +1 @@
-{"version":3,"file":"privilege-directive.js","sourceRoot":"","sources":["../../../server/service/privilege/privilege-directive.ts"],"names":[],"mappings":";;;AAqDA,4CAIC;;AAzDD,qCAA2E;AAC3E,sEAA6B;AAE7B,gDAA0E;AAC1E,6CAA4C;AAE5C,yEAAiE;AACjE,2DAAkE;AAClE,qEAA6D;AAC7D,6DAO6B;AAE7B,OAAO,CAAC,YAAY,CAAC,GAAG,EAAE,CAAA;AAE1B;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,CAAC,oBAAoB,CAAC,GAAG,EAAE,CAAA;AAUlC;;;;GAIG;AACH,SAAgB,gBAAgB,CAAC,QAAgB,EAAE,SAAiB;IAClE,MAAM,GAAG,GAAG,OAAO,CAAC,oBAAoB,CAAqC,CAAA;IAC7E,MAAM,KAAK,GAAG,GAAG,QAAQ,IAAI,SAAS,EAAE,CAAA;IACxC,OAAO,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;AAC5E,CAAC;AAED,MAAM,SAAS,GAAG,WAAW,CAAA;AAE7B;;;;;;;;;;;;;;GAcG;AACU,QAAA,0BAA0B,GAAG,IAAA,qBAAG,EAAA;;;;;;;CAO5C,CAAA;AACD;;;GAGG;AACI,MAAM,0BAA0B,GAAG,CACxC,MAAqB,EACrB,UAAmE,EAAE,EACrE,EAAE;IACF,MAAM,QAAQ,GAAG,IAAA,+BAAU,EAAC,OAAO,CAAC,OAAO,IAAI,IAAA,sCAAiB,GAAE,CAAC,CAAA;IACnE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,IAAA,oCAAe,GAAE,CAAA;IAC9C,MAAM,QAAQ,GAAa,EAAE,CAAA;IAE7B,MAAM,MAAM,GAAG,IAAA,iBAAS,EAAC,MAAM,EAAE;QAC/B,CAAC,kBAAU,CAAC,YAAY,CAAC,EAAE,CAAC,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE;YACtE,MAAM,kBAAkB,GAAG,IAAA,oBAAY,EAAC,MAAM,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;YAE5E,+FAA+F;YAC/F,IAAI,CAAC,kBAAkB,IAAI,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACxD,MAAM,KAAK,GAAG,GAAG,QAAQ,IAAI,SAAS,EAAE,CAAA;gBAExC,OAAO,CAAC,oBAAoB,CAAC,CAAC,KAAK,CAAC,GAAG,IAAI,CAAA;gBAE3C;;;;;mBAKG;gBACH,IAAI,IAAA,oCAAe,EAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,UAAU,EAAE,CAAC;oBACpD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;wBACpB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;oBACtB,CAAC;yBAAM,CAAC;wBACN,cAAc,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;oBACpC,CAAC;gBACH,CAAC;YACH,CAAC;YAED,IAAI,kBAAkB,EAAE,CAAC;gBACvB,MAAM,EAAE,OAAO,GAAG,8BAAoB,EAAE,IAAI,EAAE,GAAG,WAAW,CAAA;gBAE5D,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,MAAM,IAAI,KAAK,CAAC,8EAA8E,SAAS,GAAG,CAAC,CAAA;gBAC7G,CAAC;gBAED,MAAM,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,kBAAkB,CAAA;gBACxF,MAAM,KAAK,GAAG,GAAG,QAAQ,IAAI,SAAS,EAAE,CAAA;gBAExC;;;;;;mBAMG;gBACH,IAAI,CAAC,QAAQ,KAAK,CAAC,SAAS,EAAE,CAAC;oBAC7B,MAAM,IAAI,KAAK,CACb,iBAAiB,KAAK,UAAU,QAAQ,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,8BAA8B,IAAI;wBAC5G,gEAAgE,CACnE,CAAA;gBACH,CAAC;gBAED;;;;;;;;;;;;;;;mBAeG;gBACH,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,IAAI,CAAC,kBAAkB,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACxE,MAAM,IAAI,KAAK,CACb,iBAAiB,KAAK,qBAAqB;wBACzC,mGAAmG;wBACnG,uEAAuE,CAC1E,CAAA;gBACH,CAAC;gBAED;;;;;;;mBAOG;gBACH,IAAI,SAAS,IAAI,CAAC,IAAA,kCAAc,EAAC,SAAS,CAAC,EAAE,CAAC;oBAC5C,MAAM,IAAI,KAAK,CACb,iBAAiB,KAAK,eAAe,SAAS,+CAA+C;wBAC3F,kBAAkB,CAAC,GAAG,IAAA,gCAAY,GAAE,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;wBAC3D,2CAA2C,SAAS,uCAAuC;wBAC3F,oFAAoF,CACvF,CAAA;gBACH,CAAC;gBAED,IAAI,QAAQ,IAAI,SAAS,EAAE,CAAC;oBAC1B,OAAO,CAAC,YAAY,CAAC,CAAC,GAAG,QAAQ,IAAI,SAAS,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;gBAC3E,CAAC;gBAED,sFAAsF;gBACtF,OAAO,CAAC,oBAAoB,CAAC,CAAC,KAAK,CAAC,GAAG;oBACrC,QAAQ,EAAE,QAAQ,IAAI,SAAS;oBAC/B,SAAS,EAAE,SAAS,IAAI,SAAS;oBACjC,KAAK,EAAE,CAAC,CAAC,kBAAkB;oBAC3B,KAAK,EAAE,CAAC,CAAC,gBAAgB;iBACN,CAAA;gBAErB,0BAA0B;gBAC1B,MAAM,mBAAmB,GAAG,WAAW,CAAC,WAAW,IAAI,EAAE,CAAA;gBAEzD,gCAAgC;gBAChC,MAAM,oBAAoB,GACxB,8BAA8B,QAAQ,IAAI,SAAS,EAAE;oBACrD,CAAC,kBAAkB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,CAAC;oBAChD,CAAC,gBAAgB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;gBAEhD,qBAAqB;gBACrB,WAAW,CAAC,WAAW,GAAG,GAAG,mBAAmB,IAAI,oBAAoB,EAAE,CAAC,IAAI,EAAE,CAAA;gBAEjF,WAAW,CAAC,OAAO,GAAG,KAAK,WAAW,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI;oBAC/D,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;oBAEtE,MAAM,SAAS,GAAG,MAAM,IAAA,qCAAe,EACrC;wBACE,QAAQ;wBACR,SAAS;wBACT,KAAK,EAAE,kBAAkB;wBACzB,KAAK,EAAE,gBAAgB;qBACxB,EACD,IAAI,EACJ,MAAM,EACN,QAAQ,EACR,oBAAoB,CACrB,CAAA;oBAED,IAAI,SAAS,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;wBACjC,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;oBAC9D,CAAC;oBAED;;;;;;;uBAOG;oBACH,MAAM,IAAA,2CAAkB,EAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,OAAO,CAAC,CAAA;gBAC3E,CAAC,CAAA;gBAED;;;;;mBAKG;gBACH,IAAI,WAAW,CAAC,SAAS,EAAE,CAAC;oBAC1B,MAAM,SAAS,GAAG,WAAW,CAAC,SAAS,CAAA;oBAEvC,WAAW,CAAC,SAAS,GAAG,KAAK,WAAW,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI;wBACjE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;wBAEtE,MAAM,SAAS,GAAG,MAAM,IAAA,qCAAe,EACrC,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAC3E,IAAI,EACJ,MAAM,EACN,QAAQ,EACR,oBAAoB,CACrB,CAAA;wBAED,IAAI,SAAS,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;4BAClC,MAAM,IAAA,2CAAkB,EAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,OAAO,CAAC,CAAA;wBAC3E,CAAC;wBAED,OAAO,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;oBAChE,CAAC,CAAA;gBACH,CAAC;gBAED,OAAO,WAAW,CAAA;YACpB,CAAC;QACH,CAAC;KACF,CAAC,CAAA;IAEF;;;;OAIG;IACH,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,GAAG,QAAQ,CAAC,MAAM,+EAA+E;YAC/F,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAC9C,iGAAiG;YACjG,+FAA+F;YAC/F,8DAA8D,CACjE,CAAA;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AA1MY,QAAA,0BAA0B,8BA0MtC;AAED;;;;;GAKG;AACH,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAA;AAElC,SAAS,cAAc,CAAC,WAAgB,EAAE,KAAa;IACrD,MAAM,MAAM,GAAG,GAAG,EAAE;QAClB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;YACnB,YAAM,CAAC,KAAK,CACV,GAAG,KAAK,4FAA4F,CACrG,CAAA;QACH,CAAC;QAED,OAAO,IAAI,sBAAY,CAAC,GAAG,KAAK,8CAA8C,EAAE;YAC9E,UAAU,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,6BAA6B,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE;SAC9G,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,WAAW,CAAC,OAAO,GAAG,KAAK,IAAI,EAAE;QAC/B,MAAM,MAAM,EAAE,CAAA;IAChB,CAAC,CAAA;IAED,IAAI,WAAW,CAAC,SAAS,EAAE,CAAC;QAC1B,WAAW,CAAC,SAAS,GAAG,KAAK,IAAI,EAAE;YACjC,MAAM,MAAM,EAAE,CAAA;QAChB,CAAC,CAAA;IACH,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,MAAqB,EAAE,QAAgB;IACzD,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,MAAM,CAAC,eAAe,EAAE,EAAE,MAAM,CAAC,mBAAmB,EAAE,CAAC,CAAC,IAAI,CACzF,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,QAAQ,CAChC,CAAA;AACH,CAAC","sourcesContent":["import { defaultFieldResolver, GraphQLError, GraphQLSchema } from 'graphql'\nimport gql from 'graphql-tag'\n\nimport { getDirective, MapperKind, mapSchema } from '@graphql-tools/utils'\nimport { logger } from '@things-factory/env'\n\nimport { judgePermission } from '../../utils/check-permission.js'\nimport { declaredAxes, isDeclaredAxis } from './privilege-axis.js'\nimport { privilegeRejection } from './privilege-rejection.js'\nimport {\n  coverageOf,\n  DeclaringModule,\n  enforcementMode,\n  EnforcementMode,\n  judgeUndeclared,\n  modulesFromLoader\n} from './open-field-rule.js'\n\nprocess['PRIVILEGES'] = {}\n\n/*\n * ── What each field asks for, by `Type.field` ─────────────────────────────────\n * `PRIVILEGES` above is the list of pairs this installation declares; it cannot answer \"what\n * does `Query.jobOrders` ask for\". Something that reaches a door by another entrance has to ask\n * exactly what the door asks — an AI tool is one (operato-twin ADR-0071 decision 2, ADR-0072\n * decision 5). Without this map each caller copied the pair by hand, and a copy drifts the day\n * the door's declaration changes.\n *\n * Three answers, and they are not the same:\n *   - not in the map      the schema has no such root field. A caller that named it has a typo,\n *                         and reading that as \"open\" is how a gate opens without an error.\n *   - `null`              the field exists and declares nothing. It is open.\n *   - a gate              what `checkPermission` is asked at that field.\n *\n * Every root field is recorded (Query / Mutation / Subscription) so the first two can be told\n * apart; a field of any other type is recorded only when it carries the directive.\n * Kept on `process` for the same reason `PRIVILEGES` is.\n */\nprocess['PRIVILEGE_OF_FIELD'] = {}\n\n/** What `checkPermission` is asked at a field — the same four things the directive passes it. */\nexport interface FieldGate {\n  category?: string\n  privilege?: string\n  owner: boolean\n  super: boolean\n}\n\n/**\n * What the field `Type.field` asks for. Valid once the schema has been built.\n *\n * `known: false` means the schema has no such root field — treat it as a mistake, never as open.\n */\nexport function privilegeOfField(typeName: string, fieldName: string): { known: false } | { known: true; gate: FieldGate | null } {\n  const map = process['PRIVILEGE_OF_FIELD'] as Record<string, FieldGate | null>\n  const where = `${typeName}.${fieldName}`\n  return where in map ? { known: true, gate: map[where] } : { known: false }\n}\n\nconst DIRECTIVE = 'privilege'\n\n/**\n * ⚠ **다음에 목록 인자를 붙이는 사람에게.**\n *\n * 여기 `legacy` 인자가 있었다 — 권한 이름을 옮기는 동안 옛 이름도 받아 주는 별칭이었다.\n * **걷어냈다.** 이 저장소는 대개조 중이고 **호환 계층을 끼우지 않는다**: 이름을 바꾸면 바꾼\n * 것이고, 부여는 관리자가 다시 놓는다. 별칭은 「한동안」이 영원이 되는 길이었다.\n *\n * 곧 필요해지는 목록 인자는 **AND** 다(`docs/design/auth-rebuild.md` §1-(3)): 외부에서\n * 당겨오면서 남의 데이터를 앉히는 호출은 `execute` **와** 그 모듈의 `mutation` 을 **둘 다**\n * 요구해야 한다.\n *\n * 그것을 `privileges: [...]` 처럼 중립적으로 이름 지으면 다음 사람이 「이 중 하나」로 읽고,\n * 그렇게 쓰는 날 게이트가 **오류 없이** 열린다. `requiresAll: [...]` 처럼 **이름이 AND 라고\n * 말하게** 한다.\n */\nexport const privilegeDirectiveTypeDefs = gql`\n  directive @privilege(\n    category: String\n    privilege: String\n    domainOwnerGranted: Boolean\n    superUserGranted: Boolean\n  ) on FIELD_DEFINITION\n`\n/**\n * The server calls this with the merged schema only. `modules` and `mode` are for tests, which\n * have no module walk of their own (`orderedModuleNames` is empty under jest) — see `open-fields.ts`.\n */\nexport const privilegeDirectiveResolver = (\n  schema: GraphQLSchema,\n  options: { modules?: DeclaringModule[]; mode?: EnforcementMode } = {}\n) => {\n  const coverage = coverageOf(options.modules ?? modulesFromLoader())\n  const mode = options.mode ?? enforcementMode()\n  const unlisted: string[] = []\n\n  const mapped = mapSchema(schema, {\n    [MapperKind.OBJECT_FIELD]: (fieldConfig, fieldName, typeName, schema) => {\n      const privilegeDirective = getDirective(schema, fieldConfig, DIRECTIVE)?.[0]\n\n      /* A root field with no directive is recorded as open, so \"open\" and \"no such field\" differ. */\n      if (!privilegeDirective && isRootType(schema, typeName)) {\n        const where = `${typeName}.${fieldName}`\n\n        process['PRIVILEGE_OF_FIELD'][where] = null\n\n        /*\n         * ── The field that arrived without saying anything ───────────────────\n         * Its module opted in (declared `openFields`) and names it in neither list. That is how\n         * `deleteAppBinding` went in, and the whole point of §8 step 1 is that it cannot happen\n         * quietly any more. A field of a module that has not opted in is left exactly as before.\n         */\n        if (judgeUndeclared(where, coverage) === 'unlisted') {\n          if (mode === 'boot') {\n            unlisted.push(where)\n          } else {\n            refuseUnlisted(fieldConfig, where)\n          }\n        }\n      }\n\n      if (privilegeDirective) {\n        const { resolve = defaultFieldResolver, args } = fieldConfig\n\n        if (!args) {\n          throw new Error(`Unexpected Error. args should be defined in @privilege directive for field ${fieldName}.`)\n        }\n\n        const { domainOwnerGranted, superUserGranted, category, privilege } = privilegeDirective\n        const where = `${typeName}.${fieldName}`\n\n        /*\n         * A declaration has to name something.\n         *\n         * `category` and `privilege` are one thing, not two: together they name a row in the\n         * privilege table, and either alone names no row, so `User.hasPrivilege` is never\n         * reached and the field falls back on ownership flags it did not set.\n         */\n        if (!category !== !privilege) {\n          throw new Error(\n            `@privilege on ${where} gives ${category ? 'a category with no privilege' : 'a privilege with no category'}. ` +\n              `The pair names the privilege to look for; one half names none.`\n          )\n        }\n\n        /*\n         * `@privilege()` with nothing in it reads like a gate and guards nothing. Until\n         * 2026-09-15 what it did depended on where the caller sat: `checkPermission` answered\n         * false from a safe address and refused everyone, true from an unsafe one and let\n         * everyone through. Both are false now, so the shape is merely useless rather than\n         * dangerous — and a field that is open should say so by carrying no directive, not by\n         * carrying an empty one.\n         *\n         * It is also the shape someone reaches for wanting \"being signed in is enough\". That\n         * is a real thing to want and this directive does not express it; the answer settled\n         * on 2026-09-15 is a category for the published side of a module, `<module>-published`.\n         *\n         * Throwing stops the boot, which is what §6-2 of docs/design/auth-rebuild.md settled\n         * for a resolver that declares nothing. A decorator that declares nothing is that\n         * same resolver wearing one.\n         */\n        if (!category && !privilege && !domainOwnerGranted && !superUserGranted) {\n          throw new Error(\n            `@privilege on ${where} declares nothing. ` +\n              `Name (category, privilege) for a privilege gate, or domainOwnerGranted / superUserGranted for an ` +\n              `ownership gate. A field open to everyone carries no directive at all.`\n          )\n        }\n\n        /*\n         * The axis has to be one this installation declared.\n         *\n         * Without this, `privilege: \"mutaiton\"` registered a pair nobody would ever be granted\n         * — a gate shut forever, with no error to read. The list is not the framework's: see\n         * `privilege-axis.ts` for why, and for the fact that it must be declared at module\n         * import time rather than on a bootstrap hook.\n         */\n        if (privilege && !isDeclaredAxis(privilege)) {\n          throw new Error(\n            `@privilege on ${where} uses axis \"${privilege}\", which this installation does not declare. ` +\n              `Declared axes: ${[...declaredAxes()].sort().join(', ')}. ` +\n              `Fix the spelling, or call declareAxes(['${privilege}']) at the top level of the module's ` +\n              `server/index.ts — a bootstrap hook runs after the schema is built and is too late.`\n          )\n        }\n\n        if (category && privilege) {\n          process['PRIVILEGES'][`${category} ${privilege}`] = [category, privilege]\n        }\n\n        /* After every refusal above, so a declaration that names nothing never lands here. */\n        process['PRIVILEGE_OF_FIELD'][where] = {\n          category: category || undefined,\n          privilege: privilege || undefined,\n          owner: !!domainOwnerGranted,\n          super: !!superUserGranted\n        } satisfies FieldGate\n\n        // 필드의 기존 description 가져오기\n        const existingDescription = fieldConfig.description || ''\n\n        // 권한 정보를 포함한 새로운 description 생성\n        const privilegeDescription =\n          `\\n\\n🔒 Requires privilege: ${category}:${privilege}` +\n          (domainOwnerGranted ? ', Domain ownership' : '') +\n          (superUserGranted ? ', System ownership' : '')\n\n        // 기존 description과 결합\n        fieldConfig.description = `${existingDescription} ${privilegeDescription}`.trim()\n\n        fieldConfig.resolve = async function (source, args, context, info) {\n          const { domain, user, unsafeIP, prohibitedPrivileges } = context.state\n\n          const judgement = await judgePermission(\n            {\n              category,\n              privilege,\n              owner: domainOwnerGranted,\n              super: superUserGranted\n            },\n            user,\n            domain,\n            unsafeIP,\n            prohibitedPrivileges\n          )\n\n          if (judgement.permitted === true) {\n            return await resolve.call(this, source, args, context, info)\n          }\n\n          /*\n           * 안 열렸으면 **거기서 끝이다.**\n           *\n           * 여기 옛 이름으로 한 번 더 보는 길이 있었다. 그것을 걷어냈다 — 호환 계층을 끼우지\n           * 않는다. 이름을 옮기면 부여도 옮기는 것이고, 그 일은 관리자가 역할 화면에서 한다.\n           *\n           * 문장 만들기는 `privilege-rejection.ts` 가 소유한다.\n           */\n          throw privilegeRejection(context, category, privilege, judgement.because)\n        }\n\n        /*\n         * ── A subscription is opened by `subscribe`, not `resolve` ────────────\n         * Wrapping only `resolve` left a declared subscription connectable by anyone: the stream\n         * opened and every event then failed. It leaked nothing, and it refused nothing either.\n         * The same question is asked where the stream starts.\n         */\n        if (fieldConfig.subscribe) {\n          const subscribe = fieldConfig.subscribe\n\n          fieldConfig.subscribe = async function (source, args, context, info) {\n            const { domain, user, unsafeIP, prohibitedPrivileges } = context.state\n\n            const judgement = await judgePermission(\n              { category, privilege, owner: domainOwnerGranted, super: superUserGranted },\n              user,\n              domain,\n              unsafeIP,\n              prohibitedPrivileges\n            )\n\n            if (judgement.permitted === false) {\n              throw privilegeRejection(context, category, privilege, judgement.because)\n            }\n\n            return await subscribe.call(this, source, args, context, info)\n          }\n        }\n\n        return fieldConfig\n      }\n    }\n  })\n\n  /*\n   * Every unlisted field at once, rather than the first one. The person who meets this has usually\n   * added several resolvers together, and fixing them one boot at a time is how a list gets\n   * abandoned half done.\n   */\n  if (unlisted.length) {\n    throw new Error(\n      `${unlisted.length} field(s) declare no @privilege and are not listed as open by their module:\\n` +\n        unlisted.map(where => `  ${where}`).join('\\n') +\n        `\\n\\nFor each, either give it @privilege(category: …, privilege: …), or name it in the module's ` +\n        `schema.openFields — under byDesign with the reason it is open, or under notYetDeclared if it ` +\n        `is waiting to be closed. See docs/design/auth-rebuild.md §8.`\n    )\n  }\n\n  return mapped\n}\n\n/**\n * Production's answer to an unlisted field: that field refuses, and says so in the log once.\n *\n * The server stays up. What cannot happen is the field answering — it arrived without saying who\n * may call it, and the answer to that is nobody until somebody says.\n */\nconst reported = new Set<string>()\n\nfunction refuseUnlisted(fieldConfig: any, where: string) {\n  const refuse = () => {\n    if (!reported.has(where)) {\n      reported.add(where)\n      logger.error(\n        `${where} declares no @privilege and is not listed in its module's schema.openFields — refusing it.`\n      )\n    }\n\n    return new GraphQLError(`${where} is not available: it declares no privilege.`, {\n      extensions: { code: 'FORBIDDEN', refusal: { code: 'field-declares-no-privilege', params: { field: where } } }\n    })\n  }\n\n  fieldConfig.resolve = async () => {\n    throw refuse()\n  }\n\n  if (fieldConfig.subscribe) {\n    fieldConfig.subscribe = async () => {\n      throw refuse()\n    }\n  }\n}\n\nfunction isRootType(schema: GraphQLSchema, typeName: string): boolean {\n  return [schema.getQueryType(), schema.getMutationType(), schema.getSubscriptionType()].some(\n    root => root?.name === typeName\n  )\n}\n"]}
+{"version":3,"file":"privilege-directive.js","sourceRoot":"","sources":["../../../server/service/privilege/privilege-directive.ts"],"names":[],"mappings":";;;AAqDA,4CAIC;;AAzDD,qCAA2E;AAC3E,sEAA6B;AAE7B,gDAA0E;AAC1E,6CAA4C;AAE5C,yEAAiE;AACjE,2DAAkE;AAClE,qEAA6D;AAC7D,6DAO6B;AAE7B,OAAO,CAAC,YAAY,CAAC,GAAG,EAAE,CAAA;AAE1B;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,CAAC,oBAAoB,CAAC,GAAG,EAAE,CAAA;AAUlC;;;;GAIG;AACH,SAAgB,gBAAgB,CAAC,QAAgB,EAAE,SAAiB;IAClE,MAAM,GAAG,GAAG,OAAO,CAAC,oBAAoB,CAAqC,CAAA;IAC7E,MAAM,KAAK,GAAG,GAAG,QAAQ,IAAI,SAAS,EAAE,CAAA;IACxC,OAAO,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;AAC5E,CAAC;AAED,MAAM,SAAS,GAAG,WAAW,CAAA;AAE7B;;;;;;;;;;;;;;GAcG;AACU,QAAA,0BAA0B,GAAG,IAAA,qBAAG,EAAA;;;;;;;CAO5C,CAAA;AACD;;;GAGG;AACI,MAAM,0BAA0B,GAAG,CACxC,MAAqB,EACrB,UAAmE,EAAE,EACrE,EAAE;IACF,MAAM,QAAQ,GAAG,IAAA,+BAAU,EAAC,OAAO,CAAC,OAAO,IAAI,IAAA,sCAAiB,GAAE,CAAC,CAAA;IACnE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,IAAA,oCAAe,GAAE,CAAA;IAC9C,MAAM,QAAQ,GAAa,EAAE,CAAA;IAE7B,MAAM,MAAM,GAAG,IAAA,iBAAS,EAAC,MAAM,EAAE;QAC/B,CAAC,kBAAU,CAAC,YAAY,CAAC,EAAE,CAAC,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE;YACtE,MAAM,kBAAkB,GAAG,IAAA,oBAAY,EAAC,MAAM,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;YAE5E,+FAA+F;YAC/F,IAAI,CAAC,kBAAkB,IAAI,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACxD,MAAM,KAAK,GAAG,GAAG,QAAQ,IAAI,SAAS,EAAE,CAAA;gBAExC,OAAO,CAAC,oBAAoB,CAAC,CAAC,KAAK,CAAC,GAAG,IAAI,CAAA;gBAE3C;;;;;mBAKG;gBACH,IAAI,IAAA,oCAAe,EAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,UAAU,EAAE,CAAC;oBACpD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;wBACpB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;oBACtB,CAAC;yBAAM,CAAC;wBACN,cAAc,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;oBACpC,CAAC;gBACH,CAAC;YACH,CAAC;YAED,IAAI,kBAAkB,EAAE,CAAC;gBACvB,MAAM,EAAE,OAAO,GAAG,8BAAoB,EAAE,IAAI,EAAE,GAAG,WAAW,CAAA;gBAE5D,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,MAAM,IAAI,KAAK,CAAC,8EAA8E,SAAS,GAAG,CAAC,CAAA;gBAC7G,CAAC;gBAED,MAAM,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,kBAAkB,CAAA;gBACxF,MAAM,KAAK,GAAG,GAAG,QAAQ,IAAI,SAAS,EAAE,CAAA;gBAExC;;;;;;mBAMG;gBACH,IAAI,CAAC,QAAQ,KAAK,CAAC,SAAS,EAAE,CAAC;oBAC7B,MAAM,IAAI,KAAK,CACb,iBAAiB,KAAK,UAAU,QAAQ,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,8BAA8B,IAAI;wBAC5G,gEAAgE,CACnE,CAAA;gBACH,CAAC;gBAED;;;;;;;;;;;;;;;mBAeG;gBACH,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,IAAI,CAAC,kBAAkB,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACxE,MAAM,IAAI,KAAK,CACb,iBAAiB,KAAK,qBAAqB;wBACzC,mGAAmG;wBACnG,uEAAuE,CAC1E,CAAA;gBACH,CAAC;gBAED;;;;;;;mBAOG;gBACH,IAAI,SAAS,IAAI,CAAC,IAAA,kCAAc,EAAC,SAAS,CAAC,EAAE,CAAC;oBAC5C,MAAM,IAAI,KAAK,CACb,iBAAiB,KAAK,eAAe,SAAS,+CAA+C;wBAC3F,kBAAkB,CAAC,GAAG,IAAA,gCAAY,GAAE,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;wBAC3D,2CAA2C,SAAS,uCAAuC;wBAC3F,oFAAoF,CACvF,CAAA;gBACH,CAAC;gBAED,IAAI,QAAQ,IAAI,SAAS,EAAE,CAAC;oBAC1B,OAAO,CAAC,YAAY,CAAC,CAAC,GAAG,QAAQ,IAAI,SAAS,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;gBAC3E,CAAC;gBAED,sFAAsF;gBACtF,OAAO,CAAC,oBAAoB,CAAC,CAAC,KAAK,CAAC,GAAG;oBACrC,QAAQ,EAAE,QAAQ,IAAI,SAAS;oBAC/B,SAAS,EAAE,SAAS,IAAI,SAAS;oBACjC,KAAK,EAAE,CAAC,CAAC,kBAAkB;oBAC3B,KAAK,EAAE,CAAC,CAAC,gBAAgB;iBACN,CAAA;gBAErB,0BAA0B;gBAC1B,MAAM,mBAAmB,GAAG,WAAW,CAAC,WAAW,IAAI,EAAE,CAAA;gBAEzD,gCAAgC;gBAChC,MAAM,oBAAoB,GACxB,8BAA8B,QAAQ,IAAI,SAAS,EAAE;oBACrD,CAAC,kBAAkB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,CAAC;oBAChD,CAAC,gBAAgB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;gBAEhD,qBAAqB;gBACrB,WAAW,CAAC,WAAW,GAAG,GAAG,mBAAmB,IAAI,oBAAoB,EAAE,CAAC,IAAI,EAAE,CAAA;gBAEjF,WAAW,CAAC,OAAO,GAAG,KAAK,WAAW,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI;oBAC/D,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;oBAEtE,MAAM,SAAS,GAAG,MAAM,IAAA,qCAAe,EACrC;wBACE,QAAQ;wBACR,SAAS;wBACT,KAAK,EAAE,kBAAkB;wBACzB,KAAK,EAAE,gBAAgB;qBACxB,EACD,IAAI,EACJ,MAAM,EACN,QAAQ,EACR,oBAAoB,CACrB,CAAA;oBAED,IAAI,SAAS,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;wBACjC,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;oBAC9D,CAAC;oBAED;;;;;;;uBAOG;oBACH,MAAM,IAAA,2CAAkB,EAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,CAAA;gBACvG,CAAC,CAAA;gBAED;;;;;mBAKG;gBACH,IAAI,WAAW,CAAC,SAAS,EAAE,CAAC;oBAC1B,MAAM,SAAS,GAAG,WAAW,CAAC,SAAS,CAAA;oBAEvC,WAAW,CAAC,SAAS,GAAG,KAAK,WAAW,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI;wBACjE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;wBAEtE,MAAM,SAAS,GAAG,MAAM,IAAA,qCAAe,EACrC,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAC3E,IAAI,EACJ,MAAM,EACN,QAAQ,EACR,oBAAoB,CACrB,CAAA;wBAED,IAAI,SAAS,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;4BAClC,MAAM,IAAA,2CAAkB,EAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,OAAO,EAAE,cAAc,CAAC,CAAA;wBAC3F,CAAC;wBAED,OAAO,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;oBAChE,CAAC,CAAA;gBACH,CAAC;gBAED,OAAO,WAAW,CAAA;YACpB,CAAC;QACH,CAAC;KACF,CAAC,CAAA;IAEF;;;;OAIG;IACH,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,GAAG,QAAQ,CAAC,MAAM,+EAA+E;YAC/F,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAC9C,iGAAiG;YACjG,+FAA+F;YAC/F,8DAA8D,CACjE,CAAA;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AA1MY,QAAA,0BAA0B,8BA0MtC;AAED;;;;;GAKG;AACH,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAA;AAElC,SAAS,cAAc,CAAC,WAAgB,EAAE,KAAa;IACrD,MAAM,MAAM,GAAG,GAAG,EAAE;QAClB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;YACnB,YAAM,CAAC,KAAK,CACV,GAAG,KAAK,4FAA4F,CACrG,CAAA;QACH,CAAC;QAED,OAAO,IAAI,sBAAY,CAAC,GAAG,KAAK,8CAA8C,EAAE;YAC9E,UAAU,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,6BAA6B,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE;SAC9G,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,WAAW,CAAC,OAAO,GAAG,KAAK,IAAI,EAAE;QAC/B,MAAM,MAAM,EAAE,CAAA;IAChB,CAAC,CAAA;IAED,IAAI,WAAW,CAAC,SAAS,EAAE,CAAC;QAC1B,WAAW,CAAC,SAAS,GAAG,KAAK,IAAI,EAAE;YACjC,MAAM,MAAM,EAAE,CAAA;QAChB,CAAC,CAAA;IACH,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,MAAqB,EAAE,QAAgB;IACzD,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,MAAM,CAAC,eAAe,EAAE,EAAE,MAAM,CAAC,mBAAmB,EAAE,CAAC,CAAC,IAAI,CACzF,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,QAAQ,CAChC,CAAA;AACH,CAAC","sourcesContent":["import { defaultFieldResolver, GraphQLError, GraphQLSchema } from 'graphql'\nimport gql from 'graphql-tag'\n\nimport { getDirective, MapperKind, mapSchema } from '@graphql-tools/utils'\nimport { logger } from '@things-factory/env'\n\nimport { judgePermission } from '../../utils/check-permission.js'\nimport { declaredAxes, isDeclaredAxis } from './privilege-axis.js'\nimport { privilegeRejection } from './privilege-rejection.js'\nimport {\n  coverageOf,\n  DeclaringModule,\n  enforcementMode,\n  EnforcementMode,\n  judgeUndeclared,\n  modulesFromLoader\n} from './open-field-rule.js'\n\nprocess['PRIVILEGES'] = {}\n\n/*\n * ── What each field asks for, by `Type.field` ─────────────────────────────────\n * `PRIVILEGES` above is the list of pairs this installation declares; it cannot answer \"what\n * does `Query.jobOrders` ask for\". Something that reaches a door by another entrance has to ask\n * exactly what the door asks — an AI tool is one (operato-twin ADR-0071 decision 2, ADR-0072\n * decision 5). Without this map each caller copied the pair by hand, and a copy drifts the day\n * the door's declaration changes.\n *\n * Three answers, and they are not the same:\n *   - not in the map      the schema has no such root field. A caller that named it has a typo,\n *                         and reading that as \"open\" is how a gate opens without an error.\n *   - `null`              the field exists and declares nothing. It is open.\n *   - a gate              what `checkPermission` is asked at that field.\n *\n * Every root field is recorded (Query / Mutation / Subscription) so the first two can be told\n * apart; a field of any other type is recorded only when it carries the directive.\n * Kept on `process` for the same reason `PRIVILEGES` is.\n */\nprocess['PRIVILEGE_OF_FIELD'] = {}\n\n/** What `checkPermission` is asked at a field — the same four things the directive passes it. */\nexport interface FieldGate {\n  category?: string\n  privilege?: string\n  owner: boolean\n  super: boolean\n}\n\n/**\n * What the field `Type.field` asks for. Valid once the schema has been built.\n *\n * `known: false` means the schema has no such root field — treat it as a mistake, never as open.\n */\nexport function privilegeOfField(typeName: string, fieldName: string): { known: false } | { known: true; gate: FieldGate | null } {\n  const map = process['PRIVILEGE_OF_FIELD'] as Record<string, FieldGate | null>\n  const where = `${typeName}.${fieldName}`\n  return where in map ? { known: true, gate: map[where] } : { known: false }\n}\n\nconst DIRECTIVE = 'privilege'\n\n/**\n * ⚠ **다음에 목록 인자를 붙이는 사람에게.**\n *\n * 여기 `legacy` 인자가 있었다 — 권한 이름을 옮기는 동안 옛 이름도 받아 주는 별칭이었다.\n * **걷어냈다.** 이 저장소는 대개조 중이고 **호환 계층을 끼우지 않는다**: 이름을 바꾸면 바꾼\n * 것이고, 부여는 관리자가 다시 놓는다. 별칭은 「한동안」이 영원이 되는 길이었다.\n *\n * 곧 필요해지는 목록 인자는 **AND** 다(`docs/design/auth-rebuild.md` §1-(3)): 외부에서\n * 당겨오면서 남의 데이터를 앉히는 호출은 `execute` **와** 그 모듈의 `mutation` 을 **둘 다**\n * 요구해야 한다.\n *\n * 그것을 `privileges: [...]` 처럼 중립적으로 이름 지으면 다음 사람이 「이 중 하나」로 읽고,\n * 그렇게 쓰는 날 게이트가 **오류 없이** 열린다. `requiresAll: [...]` 처럼 **이름이 AND 라고\n * 말하게** 한다.\n */\nexport const privilegeDirectiveTypeDefs = gql`\n  directive @privilege(\n    category: String\n    privilege: String\n    domainOwnerGranted: Boolean\n    superUserGranted: Boolean\n  ) on FIELD_DEFINITION\n`\n/**\n * The server calls this with the merged schema only. `modules` and `mode` are for tests, which\n * have no module walk of their own (`orderedModuleNames` is empty under jest) — see `open-fields.ts`.\n */\nexport const privilegeDirectiveResolver = (\n  schema: GraphQLSchema,\n  options: { modules?: DeclaringModule[]; mode?: EnforcementMode } = {}\n) => {\n  const coverage = coverageOf(options.modules ?? modulesFromLoader())\n  const mode = options.mode ?? enforcementMode()\n  const unlisted: string[] = []\n\n  const mapped = mapSchema(schema, {\n    [MapperKind.OBJECT_FIELD]: (fieldConfig, fieldName, typeName, schema) => {\n      const privilegeDirective = getDirective(schema, fieldConfig, DIRECTIVE)?.[0]\n\n      /* A root field with no directive is recorded as open, so \"open\" and \"no such field\" differ. */\n      if (!privilegeDirective && isRootType(schema, typeName)) {\n        const where = `${typeName}.${fieldName}`\n\n        process['PRIVILEGE_OF_FIELD'][where] = null\n\n        /*\n         * ── The field that arrived without saying anything ───────────────────\n         * Its module opted in (declared `openFields`) and names it in neither list. That is how\n         * `deleteAppBinding` went in, and the whole point of §8 step 1 is that it cannot happen\n         * quietly any more. A field of a module that has not opted in is left exactly as before.\n         */\n        if (judgeUndeclared(where, coverage) === 'unlisted') {\n          if (mode === 'boot') {\n            unlisted.push(where)\n          } else {\n            refuseUnlisted(fieldConfig, where)\n          }\n        }\n      }\n\n      if (privilegeDirective) {\n        const { resolve = defaultFieldResolver, args } = fieldConfig\n\n        if (!args) {\n          throw new Error(`Unexpected Error. args should be defined in @privilege directive for field ${fieldName}.`)\n        }\n\n        const { domainOwnerGranted, superUserGranted, category, privilege } = privilegeDirective\n        const where = `${typeName}.${fieldName}`\n\n        /*\n         * A declaration has to name something.\n         *\n         * `category` and `privilege` are one thing, not two: together they name a row in the\n         * privilege table, and either alone names no row, so `User.hasPrivilege` is never\n         * reached and the field falls back on ownership flags it did not set.\n         */\n        if (!category !== !privilege) {\n          throw new Error(\n            `@privilege on ${where} gives ${category ? 'a category with no privilege' : 'a privilege with no category'}. ` +\n              `The pair names the privilege to look for; one half names none.`\n          )\n        }\n\n        /*\n         * `@privilege()` with nothing in it reads like a gate and guards nothing. Until\n         * 2026-09-15 what it did depended on where the caller sat: `checkPermission` answered\n         * false from a safe address and refused everyone, true from an unsafe one and let\n         * everyone through. Both are false now, so the shape is merely useless rather than\n         * dangerous — and a field that is open should say so by carrying no directive, not by\n         * carrying an empty one.\n         *\n         * It is also the shape someone reaches for wanting \"being signed in is enough\". That\n         * is a real thing to want and this directive does not express it; the answer settled\n         * on 2026-09-15 is a category for the published side of a module, `<module>-published`.\n         *\n         * Throwing stops the boot, which is what §6-2 of docs/design/auth-rebuild.md settled\n         * for a resolver that declares nothing. A decorator that declares nothing is that\n         * same resolver wearing one.\n         */\n        if (!category && !privilege && !domainOwnerGranted && !superUserGranted) {\n          throw new Error(\n            `@privilege on ${where} declares nothing. ` +\n              `Name (category, privilege) for a privilege gate, or domainOwnerGranted / superUserGranted for an ` +\n              `ownership gate. A field open to everyone carries no directive at all.`\n          )\n        }\n\n        /*\n         * The axis has to be one this installation declared.\n         *\n         * Without this, `privilege: \"mutaiton\"` registered a pair nobody would ever be granted\n         * — a gate shut forever, with no error to read. The list is not the framework's: see\n         * `privilege-axis.ts` for why, and for the fact that it must be declared at module\n         * import time rather than on a bootstrap hook.\n         */\n        if (privilege && !isDeclaredAxis(privilege)) {\n          throw new Error(\n            `@privilege on ${where} uses axis \"${privilege}\", which this installation does not declare. ` +\n              `Declared axes: ${[...declaredAxes()].sort().join(', ')}. ` +\n              `Fix the spelling, or call declareAxes(['${privilege}']) at the top level of the module's ` +\n              `server/index.ts — a bootstrap hook runs after the schema is built and is too late.`\n          )\n        }\n\n        if (category && privilege) {\n          process['PRIVILEGES'][`${category} ${privilege}`] = [category, privilege]\n        }\n\n        /* After every refusal above, so a declaration that names nothing never lands here. */\n        process['PRIVILEGE_OF_FIELD'][where] = {\n          category: category || undefined,\n          privilege: privilege || undefined,\n          owner: !!domainOwnerGranted,\n          super: !!superUserGranted\n        } satisfies FieldGate\n\n        // 필드의 기존 description 가져오기\n        const existingDescription = fieldConfig.description || ''\n\n        // 권한 정보를 포함한 새로운 description 생성\n        const privilegeDescription =\n          `\\n\\n🔒 Requires privilege: ${category}:${privilege}` +\n          (domainOwnerGranted ? ', Domain ownership' : '') +\n          (superUserGranted ? ', System ownership' : '')\n\n        // 기존 description과 결합\n        fieldConfig.description = `${existingDescription} ${privilegeDescription}`.trim()\n\n        fieldConfig.resolve = async function (source, args, context, info) {\n          const { domain, user, unsafeIP, prohibitedPrivileges } = context.state\n\n          const judgement = await judgePermission(\n            {\n              category,\n              privilege,\n              owner: domainOwnerGranted,\n              super: superUserGranted\n            },\n            user,\n            domain,\n            unsafeIP,\n            prohibitedPrivileges\n          )\n\n          if (judgement.permitted === true) {\n            return await resolve.call(this, source, args, context, info)\n          }\n\n          /*\n           * 안 열렸으면 **거기서 끝이다.**\n           *\n           * 여기 옛 이름으로 한 번 더 보는 길이 있었다. 그것을 걷어냈다 — 호환 계층을 끼우지\n           * 않는다. 이름을 옮기면 부여도 옮기는 것이고, 그 일은 관리자가 역할 화면에서 한다.\n           *\n           * 문장 만들기는 `privilege-rejection.ts` 가 소유한다.\n           */\n          throw privilegeRejection(context, category, privilege, judgement.because, info?.operation?.operation)\n        }\n\n        /*\n         * ── A subscription is opened by `subscribe`, not `resolve` ────────────\n         * Wrapping only `resolve` left a declared subscription connectable by anyone: the stream\n         * opened and every event then failed. It leaked nothing, and it refused nothing either.\n         * The same question is asked where the stream starts.\n         */\n        if (fieldConfig.subscribe) {\n          const subscribe = fieldConfig.subscribe\n\n          fieldConfig.subscribe = async function (source, args, context, info) {\n            const { domain, user, unsafeIP, prohibitedPrivileges } = context.state\n\n            const judgement = await judgePermission(\n              { category, privilege, owner: domainOwnerGranted, super: superUserGranted },\n              user,\n              domain,\n              unsafeIP,\n              prohibitedPrivileges\n            )\n\n            if (judgement.permitted === false) {\n              throw privilegeRejection(context, category, privilege, judgement.because, 'subscription')\n            }\n\n            return await subscribe.call(this, source, args, context, info)\n          }\n        }\n\n        return fieldConfig\n      }\n    }\n  })\n\n  /*\n   * Every unlisted field at once, rather than the first one. The person who meets this has usually\n   * added several resolvers together, and fixing them one boot at a time is how a list gets\n   * abandoned half done.\n   */\n  if (unlisted.length) {\n    throw new Error(\n      `${unlisted.length} field(s) declare no @privilege and are not listed as open by their module:\\n` +\n        unlisted.map(where => `  ${where}`).join('\\n') +\n        `\\n\\nFor each, either give it @privilege(category: …, privilege: …), or name it in the module's ` +\n        `schema.openFields — under byDesign with the reason it is open, or under notYetDeclared if it ` +\n        `is waiting to be closed. See docs/design/auth-rebuild.md §8.`\n    )\n  }\n\n  return mapped\n}\n\n/**\n * Production's answer to an unlisted field: that field refuses, and says so in the log once.\n *\n * The server stays up. What cannot happen is the field answering — it arrived without saying who\n * may call it, and the answer to that is nobody until somebody says.\n */\nconst reported = new Set<string>()\n\nfunction refuseUnlisted(fieldConfig: any, where: string) {\n  const refuse = () => {\n    if (!reported.has(where)) {\n      reported.add(where)\n      logger.error(\n        `${where} declares no @privilege and is not listed in its module's schema.openFields — refusing it.`\n      )\n    }\n\n    return new GraphQLError(`${where} is not available: it declares no privilege.`, {\n      extensions: { code: 'FORBIDDEN', refusal: { code: 'field-declares-no-privilege', params: { field: where } } }\n    })\n  }\n\n  fieldConfig.resolve = async () => {\n    throw refuse()\n  }\n\n  if (fieldConfig.subscribe) {\n    fieldConfig.subscribe = async () => {\n      throw refuse()\n    }\n  }\n}\n\nfunction isRootType(schema: GraphQLSchema, typeName: string): boolean {\n  return [schema.getQueryType(), schema.getMutationType(), schema.getSubscriptionType()].some(\n    root => root?.name === typeName\n  )\n}\n"]}

package/dist-server/service/privilege/privilege-rejection.d.ts

@@ -18,4 +18,6 @@ import type { RefusalCause } from '../../utils/check-permission.js';
  *
  * @param context koa 컨텍스트(요청의 언어를 아는 `t` 를 가진다). 없어도 동작한다.
  */
-export declare function privilegeRejection(context: any, category?: string, privilege?: string, because?: RefusalCause): GraphQLError;
+/** Which kind of operation was refused - a screen offers an access request only for a change the person made. */
+export type RefusedOperation = 'query' | 'mutation' | 'subscription';
+export declare function privilegeRejection(context: any, category?: string, privilege?: string, because?: RefusalCause, operation?: RefusedOperation): GraphQLError;

package/dist-server/service/privilege/privilege-rejection.js

@@ -42,15 +42,7 @@ const NAMED = {
     ownership: { key: 'error.x privilege required', fallback: x => `unauthorized! ${x} privilege required` },
     unknown: { key: 'error.x refused for this request', fallback: x => `unauthorized! ${x} is refused for this request` }
 };
-/**
- * 권한 거절 오류. `code: 'FORBIDDEN'` + `requires` + `because` 를 `extensions` 에 담는다.
- *
- * `because` 는 화면이 「권한 요청」을 띄울지 정하는 칸이다 — 역할로 풀리는 것은 `role` 뿐이다.
- * 부르는 쪽이 이유를 모르면(옛 호출) 이름이 있으면 `role`, 없으면 `ownership` 이다 — 지금까지의 뜻 그대로.
- *
- * @param context koa 컨텍스트(요청의 언어를 아는 `t` 를 가진다). 없어도 동작한다.
- */
-function privilegeRejection(context, category, privilege, because) {
+function privilegeRejection(context, category, privilege, because, operation) {
     const named = !!(category && privilege);
     const requires = named ? { category, privilege } : 'ownership';
     const cause = because ?? (named ? 'role' : 'ownership');
@@ -66,6 +58,6 @@ function privilegeRejection(context, category, privilege, because) {
     else {
         message = localized(context, 'error.ownership required', {}, 'unauthorized! domain or system ownership required');
     }
-    return new graphql_1.GraphQLError(message, { extensions: { code: 'FORBIDDEN', requires, because: cause } });
+    return new graphql_1.GraphQLError(message, { extensions: { code: 'FORBIDDEN', requires, because: cause, ...(operation ? { operation } : {}) } });
 }
 //# sourceMappingURL=privilege-rejection.js.map

package/dist-server/service/privilege/privilege-rejection.js.map

@@ -1 +1 @@
-{"version":3,"file":"privilege-rejection.js","sourceRoot":"","sources":["../../../server/service/privilege/privilege-rejection.ts"],"names":[],"mappings":";;AA+DA,gDAsBC;AArFD,qCAAsC;AAEtC;;;;;;;;;;;GAWG;AAEH,6BAA6B;AAC7B,SAAS,SAAS,CAAC,OAAY,EAAE,GAAW,EAAE,MAA8B,EAAE,QAAgB;IAC5F,MAAM,CAAC,GAAG,OAAO,OAAO,EAAE,CAAC,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC7D,IAAI,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAA;IAEvB,IAAI,UAAkB,CAAA;IACtB,IAAI,CAAC;QACH,UAAU,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,mDAAmD;QACnD,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED;;;;OAIG;IACH,OAAO,CAAC,UAAU,IAAI,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAA;AAClE,CAAC;AAYD,0GAA0G;AAC1G,MAAM,KAAK,GAA2E;IACpF,IAAI,EAAE,EAAE,GAAG,EAAE,4BAA4B,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,qBAAqB,EAAE;IACnG,OAAO,EAAE,EAAE,GAAG,EAAE,uCAAuC,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,mCAAmC,EAAE;IAC/H,OAAO,EAAE,EAAE,GAAG,EAAE,sBAAsB,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,uCAAuC,EAAE;IAClH,SAAS,EAAE,EAAE,GAAG,EAAE,4BAA4B,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,qBAAqB,EAAE;IACxG,OAAO,EAAE,EAAE,GAAG,EAAE,kCAAkC,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,8BAA8B,EAAE;CACtH,CAAA;AAED;;;;;;;GAOG;AACH,SAAgB,kBAAkB,CAAC,OAAY,EAAE,QAAiB,EAAE,SAAkB,EAAE,OAAsB;IAC5G,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,SAAS,CAAC,CAAA;IACvC,MAAM,QAAQ,GAAyB,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,WAAW,CAAA;IACpF,MAAM,KAAK,GAAiB,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAA;IAErE,IAAI,OAAe,CAAA;IACnB,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,CAAC,GAAG,GAAG,QAAQ,IAAI,SAAS,EAAE,CAAA;QACpC,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAA;QACvD,OAAO,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;IACvD,CAAC;SAAM,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,GAAG,SAAS,CACjB,OAAO,EACP,+CAA+C,EAC/C,EAAE,EACF,0DAA0D,CAC3D,CAAA;IACH,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,SAAS,CAAC,OAAO,EAAE,0BAA0B,EAAE,EAAE,EAAE,mDAAmD,CAAC,CAAA;IACnH,CAAC;IAED,OAAO,IAAI,sBAAY,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,CAAA;AACnG,CAAC","sourcesContent":["import { GraphQLError } from 'graphql'\n\n/*\n * 권한 거절을 만든다 — **사용자의 말로, 코드와 함께.**\n *\n * ── 왜 따로 있나 ────────────────────────────────────────────────────────────\n * 이 문장은 프레임워크 apollo 링크(`@operato/graphql` 의 ERROR_HANDLER)를 타고 **사용자 얼굴까지** 간다\n * — 자동으로 닫히지 않는 오류 토스트다. 그런데 다른 서버 오류가 모두 `context.t` 로 옮겨진 뒤에도\n * 여기만 영어 한 문장(`Unauthorized! twin:mutation privilege required`)이었다.\n *\n * 지시자 안에 인라인으로 두면 테스트가 닿지 못한다(스키마를 짓고 리졸버를 태워야 한다). 위험한 것은\n * 게이트 판정이 아니라 **문장 만들기**다 — 번역기가 없는 컨텍스트, 키가 없는 언어, 형태에 의존하는\n * 소비처. 그래서 순수 함수로 떼어 둔다.\n */\n\n/** 번역이 없으면 영어 문장을 그대로 쓴다. */\nfunction localized(context: any, key: string, params: Record<string, string>, fallback: string): string {\n  const t = typeof context?.t === 'function' ? context.t : null\n  if (!t) return fallback\n\n  let translated: string\n  try {\n    translated = t(key, params)\n  } catch {\n    /* 번역기가 던지면 오류의 원인이 번역기로 바뀐다 — 거절은 그대로 전달되어야 한다. */\n    return fallback\n  }\n\n  /*\n   * i18next 는 키를 못 찾으면 **키를 그대로 돌려준다.** 그걸 쓰면 사용자가\n   * `error.x privilege required` 를 읽게 되므로 영어 문장으로 되돌린다\n   * (같은 대비를 `privilege-query.ts` 의 description 도 한다).\n   */\n  return !translated || translated === key ? fallback : translated\n}\n\n/**\n * 무엇이 필요했는지 — 화면이 **문장을 다시 파싱하지 않고** 안내를 만들 수 있게 실어 보낸다.\n * 문장 형태에 의존하면 번역하는 순간 깨진다.\n */\nexport type PrivilegeRequirement = { category: string; privilege: string } | 'ownership'\n\n/** Why it was refused - see `RefusalCause` in `utils/check-permission.ts`. Only `role` can be asked for (ADR-0103). */\nexport type { RefusalCause } from '../../utils/check-permission.js'\nimport type { RefusalCause } from '../../utils/check-permission.js'\n\n/** The sentence for a named privilege, by why it was refused. `role` keeps the sentence it always had. */\nconst NAMED: Record<RefusalCause, { key: string; fallback: (x: string) => string }> = {\n  role: { key: 'error.x privilege required', fallback: x => `unauthorized! ${x} privilege required` },\n  address: { key: 'error.x not allowed from this address', fallback: x => `unauthorized! ${x} is not allowed from this address` },\n  license: { key: 'error.x not licensed', fallback: x => `unauthorized! ${x} is not licensed on this installation` },\n  ownership: { key: 'error.x privilege required', fallback: x => `unauthorized! ${x} privilege required` },\n  unknown: { key: 'error.x refused for this request', fallback: x => `unauthorized! ${x} is refused for this request` }\n}\n\n/**\n * 권한 거절 오류. `code: 'FORBIDDEN'` + `requires` + `because` 를 `extensions` 에 담는다.\n *\n * `because` 는 화면이 「권한 요청」을 띄울지 정하는 칸이다 — 역할로 풀리는 것은 `role` 뿐이다.\n * 부르는 쪽이 이유를 모르면(옛 호출) 이름이 있으면 `role`, 없으면 `ownership` 이다 — 지금까지의 뜻 그대로.\n *\n * @param context koa 컨텍스트(요청의 언어를 아는 `t` 를 가진다). 없어도 동작한다.\n */\nexport function privilegeRejection(context: any, category?: string, privilege?: string, because?: RefusalCause): GraphQLError {\n  const named = !!(category && privilege)\n  const requires: PrivilegeRequirement = named ? { category, privilege } : 'ownership'\n  const cause: RefusalCause = because ?? (named ? 'role' : 'ownership')\n\n  let message: string\n  if (named) {\n    const x = `${category}:${privilege}`\n    const { key, fallback } = NAMED[cause] ?? NAMED.unknown\n    message = localized(context, key, { x }, fallback(x))\n  } else if (cause === 'address') {\n    message = localized(\n      context,\n      'error.ownership not allowed from this address',\n      {},\n      'unauthorized! ownership does not count from this address'\n    )\n  } else {\n    message = localized(context, 'error.ownership required', {}, 'unauthorized! domain or system ownership required')\n  }\n\n  return new GraphQLError(message, { extensions: { code: 'FORBIDDEN', requires, because: cause } })\n}\n"]}
+{"version":3,"file":"privilege-rejection.js","sourceRoot":"","sources":["../../../server/service/privilege/privilege-rejection.ts"],"names":[],"mappings":";;AAkEA,gDA4BC;AA9FD,qCAAsC;AAEtC;;;;;;;;;;;GAWG;AAEH,6BAA6B;AAC7B,SAAS,SAAS,CAAC,OAAY,EAAE,GAAW,EAAE,MAA8B,EAAE,QAAgB;IAC5F,MAAM,CAAC,GAAG,OAAO,OAAO,EAAE,CAAC,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC7D,IAAI,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAA;IAEvB,IAAI,UAAkB,CAAA;IACtB,IAAI,CAAC;QACH,UAAU,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,mDAAmD;QACnD,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED;;;;OAIG;IACH,OAAO,CAAC,UAAU,IAAI,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAA;AAClE,CAAC;AAYD,0GAA0G;AAC1G,MAAM,KAAK,GAA2E;IACpF,IAAI,EAAE,EAAE,GAAG,EAAE,4BAA4B,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,qBAAqB,EAAE;IACnG,OAAO,EAAE,EAAE,GAAG,EAAE,uCAAuC,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,mCAAmC,EAAE;IAC/H,OAAO,EAAE,EAAE,GAAG,EAAE,sBAAsB,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,uCAAuC,EAAE;IAClH,SAAS,EAAE,EAAE,GAAG,EAAE,4BAA4B,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,qBAAqB,EAAE;IACxG,OAAO,EAAE,EAAE,GAAG,EAAE,kCAAkC,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,8BAA8B,EAAE;CACtH,CAAA;AAaD,SAAgB,kBAAkB,CAChC,OAAY,EACZ,QAAiB,EACjB,SAAkB,EAClB,OAAsB,EACtB,SAA4B;IAE5B,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,SAAS,CAAC,CAAA;IACvC,MAAM,QAAQ,GAAyB,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,WAAW,CAAA;IACpF,MAAM,KAAK,GAAiB,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAA;IAErE,IAAI,OAAe,CAAA;IACnB,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,CAAC,GAAG,GAAG,QAAQ,IAAI,SAAS,EAAE,CAAA;QACpC,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAA;QACvD,OAAO,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;IACvD,CAAC;SAAM,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,GAAG,SAAS,CACjB,OAAO,EACP,+CAA+C,EAC/C,EAAE,EACF,0DAA0D,CAC3D,CAAA;IACH,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,SAAS,CAAC,OAAO,EAAE,0BAA0B,EAAE,EAAE,EAAE,mDAAmD,CAAC,CAAA;IACnH,CAAC;IAED,OAAO,IAAI,sBAAY,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAA;AACxI,CAAC","sourcesContent":["import { GraphQLError } from 'graphql'\n\n/*\n * 권한 거절을 만든다 — **사용자의 말로, 코드와 함께.**\n *\n * ── 왜 따로 있나 ────────────────────────────────────────────────────────────\n * 이 문장은 프레임워크 apollo 링크(`@operato/graphql` 의 ERROR_HANDLER)를 타고 **사용자 얼굴까지** 간다\n * — 자동으로 닫히지 않는 오류 토스트다. 그런데 다른 서버 오류가 모두 `context.t` 로 옮겨진 뒤에도\n * 여기만 영어 한 문장(`Unauthorized! twin:mutation privilege required`)이었다.\n *\n * 지시자 안에 인라인으로 두면 테스트가 닿지 못한다(스키마를 짓고 리졸버를 태워야 한다). 위험한 것은\n * 게이트 판정이 아니라 **문장 만들기**다 — 번역기가 없는 컨텍스트, 키가 없는 언어, 형태에 의존하는\n * 소비처. 그래서 순수 함수로 떼어 둔다.\n */\n\n/** 번역이 없으면 영어 문장을 그대로 쓴다. */\nfunction localized(context: any, key: string, params: Record<string, string>, fallback: string): string {\n  const t = typeof context?.t === 'function' ? context.t : null\n  if (!t) return fallback\n\n  let translated: string\n  try {\n    translated = t(key, params)\n  } catch {\n    /* 번역기가 던지면 오류의 원인이 번역기로 바뀐다 — 거절은 그대로 전달되어야 한다. */\n    return fallback\n  }\n\n  /*\n   * i18next 는 키를 못 찾으면 **키를 그대로 돌려준다.** 그걸 쓰면 사용자가\n   * `error.x privilege required` 를 읽게 되므로 영어 문장으로 되돌린다\n   * (같은 대비를 `privilege-query.ts` 의 description 도 한다).\n   */\n  return !translated || translated === key ? fallback : translated\n}\n\n/**\n * 무엇이 필요했는지 — 화면이 **문장을 다시 파싱하지 않고** 안내를 만들 수 있게 실어 보낸다.\n * 문장 형태에 의존하면 번역하는 순간 깨진다.\n */\nexport type PrivilegeRequirement = { category: string; privilege: string } | 'ownership'\n\n/** Why it was refused - see `RefusalCause` in `utils/check-permission.ts`. Only `role` can be asked for (ADR-0103). */\nexport type { RefusalCause } from '../../utils/check-permission.js'\nimport type { RefusalCause } from '../../utils/check-permission.js'\n\n/** The sentence for a named privilege, by why it was refused. `role` keeps the sentence it always had. */\nconst NAMED: Record<RefusalCause, { key: string; fallback: (x: string) => string }> = {\n  role: { key: 'error.x privilege required', fallback: x => `unauthorized! ${x} privilege required` },\n  address: { key: 'error.x not allowed from this address', fallback: x => `unauthorized! ${x} is not allowed from this address` },\n  license: { key: 'error.x not licensed', fallback: x => `unauthorized! ${x} is not licensed on this installation` },\n  ownership: { key: 'error.x privilege required', fallback: x => `unauthorized! ${x} privilege required` },\n  unknown: { key: 'error.x refused for this request', fallback: x => `unauthorized! ${x} is refused for this request` }\n}\n\n/**\n * 권한 거절 오류. `code: 'FORBIDDEN'` + `requires` + `because` 를 `extensions` 에 담는다.\n *\n * `because` 는 화면이 「권한 요청」을 띄울지 정하는 칸이다 — 역할로 풀리는 것은 `role` 뿐이다.\n * 부르는 쪽이 이유를 모르면(옛 호출) 이름이 있으면 `role`, 없으면 `ownership` 이다 — 지금까지의 뜻 그대로.\n *\n * @param context koa 컨텍스트(요청의 언어를 아는 `t` 를 가진다). 없어도 동작한다.\n */\n/** Which kind of operation was refused - a screen offers an access request only for a change the person made. */\nexport type RefusedOperation = 'query' | 'mutation' | 'subscription'\n\nexport function privilegeRejection(\n  context: any,\n  category?: string,\n  privilege?: string,\n  because?: RefusalCause,\n  operation?: RefusedOperation\n): GraphQLError {\n  const named = !!(category && privilege)\n  const requires: PrivilegeRequirement = named ? { category, privilege } : 'ownership'\n  const cause: RefusalCause = because ?? (named ? 'role' : 'ownership')\n\n  let message: string\n  if (named) {\n    const x = `${category}:${privilege}`\n    const { key, fallback } = NAMED[cause] ?? NAMED.unknown\n    message = localized(context, key, { x }, fallback(x))\n  } else if (cause === 'address') {\n    message = localized(\n      context,\n      'error.ownership not allowed from this address',\n      {},\n      'unauthorized! ownership does not count from this address'\n    )\n  } else {\n    message = localized(context, 'error.ownership required', {}, 'unauthorized! domain or system ownership required')\n  }\n\n  return new GraphQLError(message, { extensions: { code: 'FORBIDDEN', requires, because: cause, ...(operation ? { operation } : {}) } })\n}\n"]}

package/dist-server/service/role/role-query.d.ts

@@ -5,6 +5,8 @@ import { Role } from './role.js';
 import { RoleList, RolePrivilege, UserRole, RoleBrief } from './role-types.js';
 export declare class RoleQuery {
     role(name: string, context: ResolverContext): Promise<Role>;
+    /** Open by design: whether the caller may give or take the parent domain's roles here - the user screen locks them otherwise. */
+    mayChangeParentRoles(context: ResolverContext): Promise<boolean>;
     roles(params: ListParam, context: ResolverContext): Promise<RoleList>;
     /**
      * 한 역할의 권한 — **전체 목록과 이 역할이 가진 것을 한 번에** 돌려준다.

package/dist-server/service/role/role-query.js

@@ -7,6 +7,7 @@ const type_graphql_1 = require("type-graphql");
 const shell_1 = require("@things-factory/shell");
 const privilege_js_1 = require("../privilege/privilege.js");
 const user_js_1 = require("../user/user.js");
+const assignable_roles_js_1 = require("../../utils/assignable-roles.js");
 const role_js_1 = require("./role.js");
 const role_types_js_1 = require("./role-types.js");
 let RoleQuery = class RoleQuery {
@@ -39,6 +40,10 @@ let RoleQuery = class RoleQuery {
         }
         return await repository.findOneBy({ domain: { id: domain.parentId }, name });
     }
+    /** Open by design: whether the caller may give or take the parent domain's roles here - the user screen locks them otherwise. */
+    async mayChangeParentRoles(context) {
+        return await (0, assignable_roles_js_1.mayChangeParentRoles)(context.state.user, context.state.domain);
+    }
     async roles(params, context) {
         const { domain } = context.state;
         const [items, total] = await (0, shell_1.getQueryBuilderFromListParams)({
@@ -209,6 +214,13 @@ tslib_1.__decorate([
     tslib_1.__metadata("design:paramtypes", [String, Object]),
     tslib_1.__metadata("design:returntype", Promise)
 ], RoleQuery.prototype, "role", null);
+tslib_1.__decorate([
+    (0, type_graphql_1.Query)(returns => Boolean, { description: "Whether the caller may give or take the parent domain's roles from this domain." }),
+    tslib_1.__param(0, (0, type_graphql_1.Ctx)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], RoleQuery.prototype, "mayChangeParentRoles", null);
 tslib_1.__decorate([
     (0, type_graphql_1.Directive)('@privilege(category: "user", privilege: "query", domainOwnerGranted: true, superUserGranted: true)'),
     (0, type_graphql_1.Query)(returns => role_types_js_1.RoleList, { description: 'To fetch multiple users' }),

package/dist-server/service/role/role-query.js.map

@@ -1 +1 @@
-{"version":3,"file":"role-query.js","sourceRoot":"","sources":["../../../server/service/role/role-query.ts"],"names":[],"mappings":";;;;AAAA,qCAA4B;AAC5B,+CAAmG;AAGnG,iDAAuG;AAEvG,4DAAqD;AACrD,6CAAsC;AACtC,uCAAgC;AAChC,mDAA8E;AAGvE,IAAM,SAAS,GAAf,MAAM,SAAS;IACpB;;;;;;;;;;;;;;;;;;;OAmBG;IAGG,AAAN,KAAK,CAAC,IAAI,CAAc,IAAY,EAAS,OAAwB;QACnE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAChC,MAAM,UAAU,GAAG,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAA;QAEtC,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;QAE3E,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC5B,OAAO,GAAG,CAAA;QACZ,CAAC;QAED,OAAO,MAAM,UAAU,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;IAC9E,CAAC;IAIK,AAAN,KAAK,CAAC,KAAK,CAA0B,MAAiB,EAAS,OAAwB;QACrF,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEhC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,IAAA,qCAA6B,EAAC;YACzD,UAAU,EAAE,IAAA,qBAAa,EAAC,cAAI,CAAC;YAC/B,MAAM;YACN,MAAM;YACN,WAAW,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC;SACrC,CAAC,CAAC,eAAe,EAAE,CAAA;QAEpB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;IACzB,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IAGG,AAAN,KAAK,CAAC,cAAc,CAAgB,MAAc,EAAS,OAAwB;QACjF,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEhC,mDAAmD;QACnD,MAAM,IAAI,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,OAAO,CAAC;YAC7C,KAAK,EAAE;gBACL,EAAE,EAAE,MAAM;gBACV,MAAM,EAAE,EAAE,EAAE,EAAE,IAAA,YAAE,EAAC,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE;aACjE;YACD,SAAS,EAAE,CAAC,YAAY,CAAC;SAC1B,CAAC,CAAA;QAEF,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,EAAE,CAAA;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAA;QAEhF,OAAO,CAAC,MAAM,IAAA,qBAAa,EAAC,wBAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3F,EAAE;YACF,IAAI;YACJ,QAAQ;YACR,WAAW;YACX,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;SAC3B,CAAC,CAAC,CAAA;IACL,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IAGG,AAAN,KAAK,CAAC,SAAS,CAAgB,MAAc,EAAS,OAAwB;QAC5E,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEhC,MAAM,IAAI,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QAC/F,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;QAElE,MAAM,KAAK,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,IAAI,CAAC;YAC3C,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAA,YAAE,EAAC,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE;SAC5E,CAAC,CAAA;QAEF,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;IAC1G,CAAC;IAGK,AAAN,KAAK,CAAC,OAAO,CAAQ,OAAwB;QAC3C,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEtC,MAAM,KAAK,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC;aACpC,kBAAkB,CAAC,MAAM,CAAC;aAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;aAC9B,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;aACtC,KAAK,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;aAC/C,QAAQ,CAAC,kCAAkC,EAAE,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;aACzG,MAAM,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;aAChC,OAAO,EAAE,CAAA;QAEZ,OAAO,KAAK,CAAA;IACd,CAAC;IAED;;;;;;;;;;;;OAYG;IAGG,AAAN,KAAK,CAAC,MAAM,CAAS,IAAU;QAC7B,OAAO,MAAM,IAAA,qBAAa,EAAC,cAAM,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;IACrE,CAAC;IAED;;;OAGG;IAGG,AAAN,KAAK,CAAC,KAAK,CAAS,IAAU,EAAS,OAAwB;QAC7D,MAAM,QAAQ,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,OAAO,CAAC;YACjD,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE;YACtB,SAAS,EAAE,CAAC,OAAO,CAAC;SACrB,CAAC,CAAA;QAEF,OAAO,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAA;IAC9B,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IAEG,AAAN,KAAK,CAAC,cAAc,CAAS,IAAU;QACrC,OAAO,MAAM,IAAA,qBAAa,EAAC,wBAAS,CAAC;aAClC,kBAAkB,CAAC,WAAW,CAAC;aAC/B,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC;aACpC,KAAK,CAAC,eAAe,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;aACvC,QAAQ,EAAE,CAAA;IACf,CAAC;IAGK,AAAN,KAAK,CAAC,UAAU,CAAS,IAAU;QACjC,OAAO,CACL,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,OAAO,CAAC;YAChC,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE;YACtB,SAAS,EAAE,CAAC,YAAY,CAAC;SAC1B,CAAC,CACH,CAAC,UAAU,CAAA;IACd,CAAC;IAGK,AAAN,KAAK,CAAC,OAAO,CAAS,IAAU;QAC9B,OAAO,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;IACpE,CAAC;IAGK,AAAN,KAAK,CAAC,OAAO,CAAS,IAAU;QAC9B,OAAO,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;IACpE,CAAC;CACF,CAAA;AAzOY,8BAAS;AAuBd;IAFL,IAAA,wBAAS,EAAC,oGAAoG,CAAC;IAC/G,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,cAAI,EAAE,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;IAC7C,mBAAA,IAAA,kBAAG,EAAC,MAAM,CAAC,CAAA;IAAgB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;qCAW3C;AAIK;IAFL,IAAA,wBAAS,EAAC,oGAAoG,CAAC;IAC/G,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,wBAAQ,EAAE,EAAE,WAAW,EAAE,yBAAyB,EAAE,CAAC;IAC1D,mBAAA,IAAA,mBAAI,EAAC,IAAI,CAAC,EAAE,CAAC,iBAAS,CAAC,CAAA;IAAqB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;6CAAjB,iBAAS;;sCAWrD;AAsBK;IAFL,IAAA,wBAAS,EAAC,oGAAoG,CAAC;IAC/G,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,CAAC,6BAAa,CAAC,EAAE,EAAE,WAAW,EAAE,+BAA+B,EAAE,CAAC;IAC9D,mBAAA,IAAA,kBAAG,EAAC,QAAQ,CAAC,CAAA;IAAkB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;+CAyBzD;AAqBK;IAFL,IAAA,wBAAS,EAAC,oGAAoG,CAAC;IAC/G,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,CAAC,wBAAQ,CAAC,EAAE,EAAE,WAAW,EAAE,0BAA0B,EAAE,CAAC;IACzD,mBAAA,IAAA,kBAAG,EAAC,QAAQ,CAAC,CAAA;IAAkB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;0CAWpD;AAGK;IADL,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,CAAC,yBAAS,CAAC,EAAE,EAAE,WAAW,EAAE,gDAAgD,EAAE,CAAC;IAClF,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;wCAanB;AAiBK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,cAAM,CAAC;IAChB,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAO,cAAI;;uCAE9B;AAQK;IAFL,IAAA,wBAAS,EAAC,oGAAoG,CAAC;IAC/G,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,cAAI,CAAC,CAAC;IACjB,mBAAA,IAAA,mBAAI,GAAE,CAAA;IAAc,mBAAA,IAAA,kBAAG,GAAE,CAAA;;6CAAZ,cAAI;;sCAO7B;AA4BK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,kBAAG,CAAC;IACL,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAO,cAAI;;+CAMtC;AAGK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,wBAAS,CAAC,CAAC;IACjB,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAO,cAAI;;2CAOlC;AAGK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,cAAI,CAAC;IACb,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAO,cAAI;;wCAE/B;AAGK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,cAAI,CAAC;IACb,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAO,cAAI;;wCAE/B;oBAxOU,SAAS;IADrB,IAAA,uBAAQ,EAAC,cAAI,CAAC;GACF,SAAS,CAyOrB","sourcesContent":["import { In } from 'typeorm'\nimport { Arg, Args, Ctx, Directive, FieldResolver, Int, Query, Resolver, Root } from 'type-graphql'\nimport { SelectQueryBuilder } from 'typeorm'\n\nimport { Domain, getQueryBuilderFromListParams, getRepository, ListParam } from '@things-factory/shell'\n\nimport { Privilege } from '../privilege/privilege.js'\nimport { User } from '../user/user.js'\nimport { Role } from './role.js'\nimport { RoleList, RolePrivilege, UserRole, RoleBrief } from './role-types.js'\n\n@Resolver(Role)\nexport class RoleQuery {\n  /*\n   * A role by name, from this domain or the one it inherits from.\n   *\n   * ── Why this is two lookups and not one `In(...)` ───────────────────────\n   * A name can match twice: the four duplicate checks in `role-mutation.ts` ask only about\n   * this domain, so a role may be created with the same name as one that is already visible\n   * through the parent. Measured 2026-09-20 — `createRole` accepts it, and both rows then\n   * come back from every list.\n   *\n   * With `In([own, parent])` there is no `ORDER BY`, so which of the two answered was whatever\n   * the driver returned first. Not wrong on a particular day, just unruled: the same call could\n   * answer the parent's role on one installation and this domain's on another, and a role is\n   * what a privilege check reads.\n   *\n   * This domain's own comes first. Both readings of what a duplicate should mean point the same\n   * way — if the platform ends up forbidding the name, the rows that already exist still have\n   * to resolve somewhere, and if shadowing becomes the official meaning this is what it means.\n   * ⚠ It is **not** a ruling on that (ADR-0062 decision 3, still with the architect). It is the\n   * deterministic reading of either.\n   */\n  @Directive('@privilege(category: \"user\", privilege: \"query\", domainOwnerGranted: true, superUserGranted: true)')\n  @Query(returns => Role, { description: 'To fetch role' })\n  async role(@Arg('name') name: string, @Ctx() context: ResolverContext): Promise<Role> {\n    const { domain } = context.state\n    const repository = getRepository(Role)\n\n    const own = await repository.findOneBy({ domain: { id: domain.id }, name })\n\n    if (own || !domain.parentId) {\n      return own\n    }\n\n    return await repository.findOneBy({ domain: { id: domain.parentId }, name })\n  }\n\n  @Directive('@privilege(category: \"user\", privilege: \"query\", domainOwnerGranted: true, superUserGranted: true)')\n  @Query(returns => RoleList, { description: 'To fetch multiple users' })\n  async roles(@Args(type => ListParam) params: ListParam, @Ctx() context: ResolverContext): Promise<RoleList> {\n    const { domain } = context.state\n\n    const [items, total] = await getQueryBuilderFromListParams({\n      repository: getRepository(Role),\n      params,\n      domain,\n      searchables: ['name', 'description']\n    }).getManyAndCount()\n\n    return { items, total }\n  }\n\n  /**\n   * 한 역할의 권한 — **전체 목록과 이 역할이 가진 것을 한 번에** 돌려준다.\n   *\n   * 권한 편집 화면이 필요한 것은 「무엇이 있나」와 「이 역할이 무엇을 갖나」 둘인데, 그것을\n   * 질의 둘로 가르면 화면이 둘을 짝지어야 하고 그 짝짓기가 역할 **이름**으로 이루어졌다\n   * (옛 `role-privilege-editor` — 같은 이름의 부모 도메인 역할과 헷갈렸다). 여기서 `roleId` 로\n   * 짝지어 주면 화면이 그 일을 안 한다.\n   *\n   * ── 원시 SQL 을 걷어냈다 ────────────────────────────────────────────────────\n   * 셋을 동시에 잃고 있었다.\n   *\n   *  ① `roleId` 를 문자열로 이어 붙였다. `user:query` 를 가진 사람이 임의의 SQL 을 넣을 수 있다.\n   *  ② `CASE WHEN … THEN true` 는 방언이다 — MSSQL 에 boolean 리터럴이 없다. 이 저장소는\n   *     DB 5종을 지원한다.\n   *  ③ 도메인을 안 봤다. 남의 도메인 역할의 `roleId` 로도 답했다.\n   *\n   * 권한 마스터는 전체 배포에 84행 규모(도메인마다 늘지 않는다)이므로 관계를 그대로 읽는다.\n   */\n  @Directive('@privilege(category: \"user\", privilege: \"query\", domainOwnerGranted: true, superUserGranted: true)')\n  @Query(returns => [RolePrivilege], { description: 'To fetch privileges of a role' })\n  async rolePrivileges(@Arg('roleId') roleId: string, @Ctx() context: ResolverContext): Promise<RolePrivilege[]> {\n    const { domain } = context.state\n\n    /* 상속으로 보이는 부모 도메인 역할까지가 범위다 — `role` 질의와 같은 규칙. */\n    const role = await getRepository(Role).findOne({\n      where: {\n        id: roleId,\n        domain: { id: In([domain.id, domain.parentId].filter(Boolean)) }\n      },\n      relations: ['privileges']\n    })\n\n    if (!role) {\n      return []\n    }\n\n    const assigned = new Set((role.privileges || []).map(privilege => privilege.id))\n\n    return (await getRepository(Privilege).find()).map(({ id, name, category, description }) => ({\n      id,\n      name,\n      category,\n      description,\n      assigned: assigned.has(id)\n    }))\n  }\n\n  /**\n   * 한 사람의 역할 — **부여할 수 있는 전체와 이 사람이 가진 것을 한 번에.**\n   *\n   * `rolePrivileges` 와 같은 모양이고, **같은 결함을 갖고 있었다.** 한 자리를 고쳤으면 두 번째\n   * 자리도 재야 한다는 것이 이 파일에서 그대로 났다.\n   *\n   *  ① `UR.users_id` 자리에 `userId` 를 문자열로 이어 붙였다. `user:query` 를 가진\n   *     사람이 임의의 SQL 을 넣을 수 있다.\n   *  ② `CASE WHEN … THEN true` 는 방언이다 — MSSQL 에 boolean 리터럴이 없다(DB 5종 지원).\n   *  ③ `FROM roles` — **도메인을 안 봤다.** 남의 도메인 역할까지 전부 돌려줬다.\n   *\n   * ③ 을 고치면서 범위를 `role`·`rolePrivileges` 와 같게 뒀다 — 내 도메인과 부모 1단.\n   * 그것이 실제로 부여할 수 있는 범위다.\n   *\n   * 지금 이 질의를 부르는 화면은 없다(옛 `user-role-editor` 는 `user(email:)` 로 읽었다).\n   * 그래서 범위를 좁히는 것이 깨뜨릴 소비처가 없다.\n   */\n  @Directive('@privilege(category: \"user\", privilege: \"query\", domainOwnerGranted: true, superUserGranted: true)')\n  @Query(returns => [UserRole], { description: 'To fetch roles of a user' })\n  async userRoles(@Arg('userId') userId: string, @Ctx() context: ResolverContext): Promise<UserRole[]> {\n    const { domain } = context.state\n\n    const user = await getRepository(User).findOne({ where: { id: userId }, relations: ['roles'] })\n    const assigned = new Set((user?.roles || []).map(role => role.id))\n\n    const roles = await getRepository(Role).find({\n      where: { domain: { id: In([domain.id, domain.parentId].filter(Boolean)) } }\n    })\n\n    return roles.map(({ id, name, description }) => ({ id, name, description, assigned: assigned.has(id) }))\n  }\n\n  @Query(returns => [RoleBrief], { description: 'To fetch roles of current user (id, name only)' })\n  async myRoles(@Ctx() context: ResolverContext): Promise<RoleBrief[]> {\n    const { user, domain } = context.state\n\n    const roles = await getRepository(Role)\n      .createQueryBuilder('ROLE')\n      .leftJoin('ROLE.users', 'USER')\n      .leftJoin('ROLE.domain', 'ROLE_DOMAIN')\n      .where('USER.id = :userId', { userId: user.id })\n      .andWhere('ROLE_DOMAIN.id In(:...domainIds)', { domainIds: [domain.id, domain.parentId].filter(Boolean) })\n      .select(['ROLE.id', 'ROLE.name'])\n      .getMany()\n\n    return roles\n  }\n\n  /*\n   * `checkRolePreset` stood here and has been removed. It read `config.get('rolePreset')`\n   * and returned it unchanged, declared as `[Role]`.\n   *\n   * Nothing set that config key and nothing called the query, across every repository on\n   * this machine — and it carried no `@privilege`, so any signed-in user could read\n   * whatever an installation later put there. Empty today, quietly public the day someone\n   * fills it. Role templates (`service/role-template/`) do what this was reaching for, as\n   * a boot registry rather than a config blob.\n   *\n   * auth-base ships to npm, so consumers outside this repository cannot be counted. The\n   * removal is recorded in the changelog — that is the only channel they have.\n   */\n\n  @FieldResolver(type => Domain)\n  async domain(@Root() role: Role) {\n    return await getRepository(Domain).findOneBy({ id: role.domainId })\n  }\n\n  /**\n   * Role의 users 필드를 위한 리졸버\n   * 사용자 조회 권한이 있는 경우에만 접근 가능\n   */\n  @Directive('@privilege(category: \"user\", privilege: \"query\", domainOwnerGranted: true, superUserGranted: true)')\n  @FieldResolver(type => [User])\n  async users(@Root() role: Role, @Ctx() context: ResolverContext) {\n    const roleData = await getRepository(Role).findOne({\n      where: { id: role.id },\n      relations: ['users']\n    })\n\n    return roleData?.users || []\n  }\n\n  /**\n   * 이 역할이 여는 권한이 **몇 개인가.**\n   *\n   * ── 왜 수만 따로 있나 ──────────────────────────────────────────────────────\n   * 목록 화면이 「이 역할이 무엇을 여나」를 말해야 하는데, 그것을 위해 권한 **행**을 받고 있었다.\n   *\n   * ```\n   * [확인함] roles(limit:20) 권한 포함  5,731 bytes · 69ms\n   * [확인함] roles(limit:20) 권한 없이    518 bytes ·  7ms      → 11.1배 · 10배\n   * ```\n   *\n   * 역할 2개에 권한 행 60개를 받아서 화면에는 잘린 코드 용어 셋을 그렸다. 역할 40개 ×\n   * 권한 100개면 한 페이지에 4,000행이다. **`privileges` 필드 리졸버가 역할마다 한 번씩 도는\n   * 것**까지 함께 없어지는 것이 더 큰 쪽이다.\n   *\n   * 그래서 목록은 이 칸을 쓴다 — 행을 안 받고 수를 받는다. 권한을 실제로 고치는 화면은\n   * `rolePrivileges(roleId:)` 로 따로 읽는다(전체 목록 + 이 역할이 가진 것을 한 번에).\n   *\n   * ── 왜 관계를 세지 않고 질의로 세나 ────────────────────────────────────────\n   * `relation(...).loadMany()` 는 행을 다 읽고 길이를 재는 것이라 여기서 고치려는 것을 그대로\n   * 다시 한다. `getCount()` 는 DB 가 센다.\n   *\n   * 조인 테이블의 주인은 `Privilege` 쪽이지만(`privilege.ts:72` 의 `@JoinTable`), 양쪽이 관계를\n   * 선언하고 있으므로 어느 쪽에서 조인해도 같다.\n   */\n  @FieldResolver(type => Int)\n  async privilegeCount(@Root() role: Role): Promise<number> {\n    return await getRepository(Privilege)\n      .createQueryBuilder('PRIVILEGE')\n      .innerJoin('PRIVILEGE.roles', 'ROLE')\n      .where('ROLE.id = :id', { id: role.id })\n      .getCount()\n  }\n\n  @FieldResolver(type => [Privilege])\n  async privileges(@Root() role: Role) {\n    return (\n      await getRepository(Role).findOne({\n        where: { id: role.id },\n        relations: ['privileges']\n      })\n    ).privileges\n  }\n\n  @FieldResolver(type => User)\n  async updater(@Root() role: Role): Promise<User> {\n    return await getRepository(User).findOneBy({ id: role.updaterId })\n  }\n\n  @FieldResolver(type => User)\n  async creator(@Root() role: Role): Promise<User> {\n    return await getRepository(User).findOneBy({ id: role.creatorId })\n  }\n}\n"]}
+{"version":3,"file":"role-query.js","sourceRoot":"","sources":["../../../server/service/role/role-query.ts"],"names":[],"mappings":";;;;AAAA,qCAA4B;AAC5B,+CAAmG;AAGnG,iDAAuG;AAEvG,4DAAqD;AACrD,6CAAsC;AACtC,yEAAsE;AACtE,uCAAgC;AAChC,mDAA8E;AAGvE,IAAM,SAAS,GAAf,MAAM,SAAS;IACpB;;;;;;;;;;;;;;;;;;;OAmBG;IAGG,AAAN,KAAK,CAAC,IAAI,CAAc,IAAY,EAAS,OAAwB;QACnE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAChC,MAAM,UAAU,GAAG,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAA;QAEtC,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;QAE3E,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC5B,OAAO,GAAG,CAAA;QACZ,CAAC;QAED,OAAO,MAAM,UAAU,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;IAC9E,CAAC;IAED,iIAAiI;IAE3H,AAAN,KAAK,CAAC,oBAAoB,CAAQ,OAAwB;QACxD,OAAO,MAAM,IAAA,0CAAoB,EAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAC7E,CAAC;IAIK,AAAN,KAAK,CAAC,KAAK,CAA0B,MAAiB,EAAS,OAAwB;QACrF,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEhC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,IAAA,qCAA6B,EAAC;YACzD,UAAU,EAAE,IAAA,qBAAa,EAAC,cAAI,CAAC;YAC/B,MAAM;YACN,MAAM;YACN,WAAW,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC;SACrC,CAAC,CAAC,eAAe,EAAE,CAAA;QAEpB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;IACzB,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IAGG,AAAN,KAAK,CAAC,cAAc,CAAgB,MAAc,EAAS,OAAwB;QACjF,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEhC,mDAAmD;QACnD,MAAM,IAAI,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,OAAO,CAAC;YAC7C,KAAK,EAAE;gBACL,EAAE,EAAE,MAAM;gBACV,MAAM,EAAE,EAAE,EAAE,EAAE,IAAA,YAAE,EAAC,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE;aACjE;YACD,SAAS,EAAE,CAAC,YAAY,CAAC;SAC1B,CAAC,CAAA;QAEF,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,EAAE,CAAA;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAA;QAEhF,OAAO,CAAC,MAAM,IAAA,qBAAa,EAAC,wBAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3F,EAAE;YACF,IAAI;YACJ,QAAQ;YACR,WAAW;YACX,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;SAC3B,CAAC,CAAC,CAAA;IACL,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IAGG,AAAN,KAAK,CAAC,SAAS,CAAgB,MAAc,EAAS,OAAwB;QAC5E,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEhC,MAAM,IAAI,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QAC/F,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;QAElE,MAAM,KAAK,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,IAAI,CAAC;YAC3C,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAA,YAAE,EAAC,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE;SAC5E,CAAC,CAAA;QAEF,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;IAC1G,CAAC;IAGK,AAAN,KAAK,CAAC,OAAO,CAAQ,OAAwB;QAC3C,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEtC,MAAM,KAAK,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC;aACpC,kBAAkB,CAAC,MAAM,CAAC;aAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;aAC9B,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;aACtC,KAAK,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;aAC/C,QAAQ,CAAC,kCAAkC,EAAE,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;aACzG,MAAM,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;aAChC,OAAO,EAAE,CAAA;QAEZ,OAAO,KAAK,CAAA;IACd,CAAC;IAED;;;;;;;;;;;;OAYG;IAGG,AAAN,KAAK,CAAC,MAAM,CAAS,IAAU;QAC7B,OAAO,MAAM,IAAA,qBAAa,EAAC,cAAM,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;IACrE,CAAC;IAED;;;OAGG;IAGG,AAAN,KAAK,CAAC,KAAK,CAAS,IAAU,EAAS,OAAwB;QAC7D,MAAM,QAAQ,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,OAAO,CAAC;YACjD,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE;YACtB,SAAS,EAAE,CAAC,OAAO,CAAC;SACrB,CAAC,CAAA;QAEF,OAAO,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAA;IAC9B,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IAEG,AAAN,KAAK,CAAC,cAAc,CAAS,IAAU;QACrC,OAAO,MAAM,IAAA,qBAAa,EAAC,wBAAS,CAAC;aAClC,kBAAkB,CAAC,WAAW,CAAC;aAC/B,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC;aACpC,KAAK,CAAC,eAAe,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;aACvC,QAAQ,EAAE,CAAA;IACf,CAAC;IAGK,AAAN,KAAK,CAAC,UAAU,CAAS,IAAU;QACjC,OAAO,CACL,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,OAAO,CAAC;YAChC,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE;YACtB,SAAS,EAAE,CAAC,YAAY,CAAC;SAC1B,CAAC,CACH,CAAC,UAAU,CAAA;IACd,CAAC;IAGK,AAAN,KAAK,CAAC,OAAO,CAAS,IAAU;QAC9B,OAAO,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;IACpE,CAAC;IAGK,AAAN,KAAK,CAAC,OAAO,CAAS,IAAU;QAC9B,OAAO,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;IACpE,CAAC;CACF,CAAA;AA/OY,8BAAS;AAuBd;IAFL,IAAA,wBAAS,EAAC,oGAAoG,CAAC;IAC/G,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,cAAI,EAAE,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;IAC7C,mBAAA,IAAA,kBAAG,EAAC,MAAM,CAAC,CAAA;IAAgB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;qCAW3C;AAIK;IADL,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,iFAAiF,EAAE,CAAC;IAClG,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;qDAEhC;AAIK;IAFL,IAAA,wBAAS,EAAC,oGAAoG,CAAC;IAC/G,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,wBAAQ,EAAE,EAAE,WAAW,EAAE,yBAAyB,EAAE,CAAC;IAC1D,mBAAA,IAAA,mBAAI,EAAC,IAAI,CAAC,EAAE,CAAC,iBAAS,CAAC,CAAA;IAAqB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;6CAAjB,iBAAS;;sCAWrD;AAsBK;IAFL,IAAA,wBAAS,EAAC,oGAAoG,CAAC;IAC/G,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,CAAC,6BAAa,CAAC,EAAE,EAAE,WAAW,EAAE,+BAA+B,EAAE,CAAC;IAC9D,mBAAA,IAAA,kBAAG,EAAC,QAAQ,CAAC,CAAA;IAAkB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;+CAyBzD;AAqBK;IAFL,IAAA,wBAAS,EAAC,oGAAoG,CAAC;IAC/G,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,CAAC,wBAAQ,CAAC,EAAE,EAAE,WAAW,EAAE,0BAA0B,EAAE,CAAC;IACzD,mBAAA,IAAA,kBAAG,EAAC,QAAQ,CAAC,CAAA;IAAkB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;0CAWpD;AAGK;IADL,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,CAAC,yBAAS,CAAC,EAAE,EAAE,WAAW,EAAE,gDAAgD,EAAE,CAAC;IAClF,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;wCAanB;AAiBK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,cAAM,CAAC;IAChB,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAO,cAAI;;uCAE9B;AAQK;IAFL,IAAA,wBAAS,EAAC,oGAAoG,CAAC;IAC/G,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,cAAI,CAAC,CAAC;IACjB,mBAAA,IAAA,mBAAI,GAAE,CAAA;IAAc,mBAAA,IAAA,kBAAG,GAAE,CAAA;;6CAAZ,cAAI;;sCAO7B;AA4BK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,kBAAG,CAAC;IACL,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAO,cAAI;;+CAMtC;AAGK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,wBAAS,CAAC,CAAC;IACjB,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAO,cAAI;;2CAOlC;AAGK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,cAAI,CAAC;IACb,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAO,cAAI;;wCAE/B;AAGK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,cAAI,CAAC;IACb,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAO,cAAI;;wCAE/B;oBA9OU,SAAS;IADrB,IAAA,uBAAQ,EAAC,cAAI,CAAC;GACF,SAAS,CA+OrB","sourcesContent":["import { In } from 'typeorm'\nimport { Arg, Args, Ctx, Directive, FieldResolver, Int, Query, Resolver, Root } from 'type-graphql'\nimport { SelectQueryBuilder } from 'typeorm'\n\nimport { Domain, getQueryBuilderFromListParams, getRepository, ListParam } from '@things-factory/shell'\n\nimport { Privilege } from '../privilege/privilege.js'\nimport { User } from '../user/user.js'\nimport { mayChangeParentRoles } from '../../utils/assignable-roles.js'\nimport { Role } from './role.js'\nimport { RoleList, RolePrivilege, UserRole, RoleBrief } from './role-types.js'\n\n@Resolver(Role)\nexport class RoleQuery {\n  /*\n   * A role by name, from this domain or the one it inherits from.\n   *\n   * ── Why this is two lookups and not one `In(...)` ───────────────────────\n   * A name can match twice: the four duplicate checks in `role-mutation.ts` ask only about\n   * this domain, so a role may be created with the same name as one that is already visible\n   * through the parent. Measured 2026-09-20 — `createRole` accepts it, and both rows then\n   * come back from every list.\n   *\n   * With `In([own, parent])` there is no `ORDER BY`, so which of the two answered was whatever\n   * the driver returned first. Not wrong on a particular day, just unruled: the same call could\n   * answer the parent's role on one installation and this domain's on another, and a role is\n   * what a privilege check reads.\n   *\n   * This domain's own comes first. Both readings of what a duplicate should mean point the same\n   * way — if the platform ends up forbidding the name, the rows that already exist still have\n   * to resolve somewhere, and if shadowing becomes the official meaning this is what it means.\n   * ⚠ It is **not** a ruling on that (ADR-0062 decision 3, still with the architect). It is the\n   * deterministic reading of either.\n   */\n  @Directive('@privilege(category: \"user\", privilege: \"query\", domainOwnerGranted: true, superUserGranted: true)')\n  @Query(returns => Role, { description: 'To fetch role' })\n  async role(@Arg('name') name: string, @Ctx() context: ResolverContext): Promise<Role> {\n    const { domain } = context.state\n    const repository = getRepository(Role)\n\n    const own = await repository.findOneBy({ domain: { id: domain.id }, name })\n\n    if (own || !domain.parentId) {\n      return own\n    }\n\n    return await repository.findOneBy({ domain: { id: domain.parentId }, name })\n  }\n\n  /** Open by design: whether the caller may give or take the parent domain's roles here - the user screen locks them otherwise. */\n  @Query(returns => Boolean, { description: \"Whether the caller may give or take the parent domain's roles from this domain.\" })\n  async mayChangeParentRoles(@Ctx() context: ResolverContext): Promise<boolean> {\n    return await mayChangeParentRoles(context.state.user, context.state.domain)\n  }\n\n  @Directive('@privilege(category: \"user\", privilege: \"query\", domainOwnerGranted: true, superUserGranted: true)')\n  @Query(returns => RoleList, { description: 'To fetch multiple users' })\n  async roles(@Args(type => ListParam) params: ListParam, @Ctx() context: ResolverContext): Promise<RoleList> {\n    const { domain } = context.state\n\n    const [items, total] = await getQueryBuilderFromListParams({\n      repository: getRepository(Role),\n      params,\n      domain,\n      searchables: ['name', 'description']\n    }).getManyAndCount()\n\n    return { items, total }\n  }\n\n  /**\n   * 한 역할의 권한 — **전체 목록과 이 역할이 가진 것을 한 번에** 돌려준다.\n   *\n   * 권한 편집 화면이 필요한 것은 「무엇이 있나」와 「이 역할이 무엇을 갖나」 둘인데, 그것을\n   * 질의 둘로 가르면 화면이 둘을 짝지어야 하고 그 짝짓기가 역할 **이름**으로 이루어졌다\n   * (옛 `role-privilege-editor` — 같은 이름의 부모 도메인 역할과 헷갈렸다). 여기서 `roleId` 로\n   * 짝지어 주면 화면이 그 일을 안 한다.\n   *\n   * ── 원시 SQL 을 걷어냈다 ────────────────────────────────────────────────────\n   * 셋을 동시에 잃고 있었다.\n   *\n   *  ① `roleId` 를 문자열로 이어 붙였다. `user:query` 를 가진 사람이 임의의 SQL 을 넣을 수 있다.\n   *  ② `CASE WHEN … THEN true` 는 방언이다 — MSSQL 에 boolean 리터럴이 없다. 이 저장소는\n   *     DB 5종을 지원한다.\n   *  ③ 도메인을 안 봤다. 남의 도메인 역할의 `roleId` 로도 답했다.\n   *\n   * 권한 마스터는 전체 배포에 84행 규모(도메인마다 늘지 않는다)이므로 관계를 그대로 읽는다.\n   */\n  @Directive('@privilege(category: \"user\", privilege: \"query\", domainOwnerGranted: true, superUserGranted: true)')\n  @Query(returns => [RolePrivilege], { description: 'To fetch privileges of a role' })\n  async rolePrivileges(@Arg('roleId') roleId: string, @Ctx() context: ResolverContext): Promise<RolePrivilege[]> {\n    const { domain } = context.state\n\n    /* 상속으로 보이는 부모 도메인 역할까지가 범위다 — `role` 질의와 같은 규칙. */\n    const role = await getRepository(Role).findOne({\n      where: {\n        id: roleId,\n        domain: { id: In([domain.id, domain.parentId].filter(Boolean)) }\n      },\n      relations: ['privileges']\n    })\n\n    if (!role) {\n      return []\n    }\n\n    const assigned = new Set((role.privileges || []).map(privilege => privilege.id))\n\n    return (await getRepository(Privilege).find()).map(({ id, name, category, description }) => ({\n      id,\n      name,\n      category,\n      description,\n      assigned: assigned.has(id)\n    }))\n  }\n\n  /**\n   * 한 사람의 역할 — **부여할 수 있는 전체와 이 사람이 가진 것을 한 번에.**\n   *\n   * `rolePrivileges` 와 같은 모양이고, **같은 결함을 갖고 있었다.** 한 자리를 고쳤으면 두 번째\n   * 자리도 재야 한다는 것이 이 파일에서 그대로 났다.\n   *\n   *  ① `UR.users_id` 자리에 `userId` 를 문자열로 이어 붙였다. `user:query` 를 가진\n   *     사람이 임의의 SQL 을 넣을 수 있다.\n   *  ② `CASE WHEN … THEN true` 는 방언이다 — MSSQL 에 boolean 리터럴이 없다(DB 5종 지원).\n   *  ③ `FROM roles` — **도메인을 안 봤다.** 남의 도메인 역할까지 전부 돌려줬다.\n   *\n   * ③ 을 고치면서 범위를 `role`·`rolePrivileges` 와 같게 뒀다 — 내 도메인과 부모 1단.\n   * 그것이 실제로 부여할 수 있는 범위다.\n   *\n   * 지금 이 질의를 부르는 화면은 없다(옛 `user-role-editor` 는 `user(email:)` 로 읽었다).\n   * 그래서 범위를 좁히는 것이 깨뜨릴 소비처가 없다.\n   */\n  @Directive('@privilege(category: \"user\", privilege: \"query\", domainOwnerGranted: true, superUserGranted: true)')\n  @Query(returns => [UserRole], { description: 'To fetch roles of a user' })\n  async userRoles(@Arg('userId') userId: string, @Ctx() context: ResolverContext): Promise<UserRole[]> {\n    const { domain } = context.state\n\n    const user = await getRepository(User).findOne({ where: { id: userId }, relations: ['roles'] })\n    const assigned = new Set((user?.roles || []).map(role => role.id))\n\n    const roles = await getRepository(Role).find({\n      where: { domain: { id: In([domain.id, domain.parentId].filter(Boolean)) } }\n    })\n\n    return roles.map(({ id, name, description }) => ({ id, name, description, assigned: assigned.has(id) }))\n  }\n\n  @Query(returns => [RoleBrief], { description: 'To fetch roles of current user (id, name only)' })\n  async myRoles(@Ctx() context: ResolverContext): Promise<RoleBrief[]> {\n    const { user, domain } = context.state\n\n    const roles = await getRepository(Role)\n      .createQueryBuilder('ROLE')\n      .leftJoin('ROLE.users', 'USER')\n      .leftJoin('ROLE.domain', 'ROLE_DOMAIN')\n      .where('USER.id = :userId', { userId: user.id })\n      .andWhere('ROLE_DOMAIN.id In(:...domainIds)', { domainIds: [domain.id, domain.parentId].filter(Boolean) })\n      .select(['ROLE.id', 'ROLE.name'])\n      .getMany()\n\n    return roles\n  }\n\n  /*\n   * `checkRolePreset` stood here and has been removed. It read `config.get('rolePreset')`\n   * and returned it unchanged, declared as `[Role]`.\n   *\n   * Nothing set that config key and nothing called the query, across every repository on\n   * this machine — and it carried no `@privilege`, so any signed-in user could read\n   * whatever an installation later put there. Empty today, quietly public the day someone\n   * fills it. Role templates (`service/role-template/`) do what this was reaching for, as\n   * a boot registry rather than a config blob.\n   *\n   * auth-base ships to npm, so consumers outside this repository cannot be counted. The\n   * removal is recorded in the changelog — that is the only channel they have.\n   */\n\n  @FieldResolver(type => Domain)\n  async domain(@Root() role: Role) {\n    return await getRepository(Domain).findOneBy({ id: role.domainId })\n  }\n\n  /**\n   * Role의 users 필드를 위한 리졸버\n   * 사용자 조회 권한이 있는 경우에만 접근 가능\n   */\n  @Directive('@privilege(category: \"user\", privilege: \"query\", domainOwnerGranted: true, superUserGranted: true)')\n  @FieldResolver(type => [User])\n  async users(@Root() role: Role, @Ctx() context: ResolverContext) {\n    const roleData = await getRepository(Role).findOne({\n      where: { id: role.id },\n      relations: ['users']\n    })\n\n    return roleData?.users || []\n  }\n\n  /**\n   * 이 역할이 여는 권한이 **몇 개인가.**\n   *\n   * ── 왜 수만 따로 있나 ──────────────────────────────────────────────────────\n   * 목록 화면이 「이 역할이 무엇을 여나」를 말해야 하는데, 그것을 위해 권한 **행**을 받고 있었다.\n   *\n   * ```\n   * [확인함] roles(limit:20) 권한 포함  5,731 bytes · 69ms\n   * [확인함] roles(limit:20) 권한 없이    518 bytes ·  7ms      → 11.1배 · 10배\n   * ```\n   *\n   * 역할 2개에 권한 행 60개를 받아서 화면에는 잘린 코드 용어 셋을 그렸다. 역할 40개 ×\n   * 권한 100개면 한 페이지에 4,000행이다. **`privileges` 필드 리졸버가 역할마다 한 번씩 도는\n   * 것**까지 함께 없어지는 것이 더 큰 쪽이다.\n   *\n   * 그래서 목록은 이 칸을 쓴다 — 행을 안 받고 수를 받는다. 권한을 실제로 고치는 화면은\n   * `rolePrivileges(roleId:)` 로 따로 읽는다(전체 목록 + 이 역할이 가진 것을 한 번에).\n   *\n   * ── 왜 관계를 세지 않고 질의로 세나 ────────────────────────────────────────\n   * `relation(...).loadMany()` 는 행을 다 읽고 길이를 재는 것이라 여기서 고치려는 것을 그대로\n   * 다시 한다. `getCount()` 는 DB 가 센다.\n   *\n   * 조인 테이블의 주인은 `Privilege` 쪽이지만(`privilege.ts:72` 의 `@JoinTable`), 양쪽이 관계를\n   * 선언하고 있으므로 어느 쪽에서 조인해도 같다.\n   */\n  @FieldResolver(type => Int)\n  async privilegeCount(@Root() role: Role): Promise<number> {\n    return await getRepository(Privilege)\n      .createQueryBuilder('PRIVILEGE')\n      .innerJoin('PRIVILEGE.roles', 'ROLE')\n      .where('ROLE.id = :id', { id: role.id })\n      .getCount()\n  }\n\n  @FieldResolver(type => [Privilege])\n  async privileges(@Root() role: Role) {\n    return (\n      await getRepository(Role).findOne({\n        where: { id: role.id },\n        relations: ['privileges']\n      })\n    ).privileges\n  }\n\n  @FieldResolver(type => User)\n  async updater(@Root() role: Role): Promise<User> {\n    return await getRepository(User).findOneBy({ id: role.updaterId })\n  }\n\n  @FieldResolver(type => User)\n  async creator(@Root() role: Role): Promise<User> {\n    return await getRepository(User).findOneBy({ id: role.creatorId })\n  }\n}\n"]}

package/dist-server/service/user/index.d.ts

@@ -3,4 +3,4 @@ import { UserQuery } from './user-query.js';
 import { UserMutation } from './user-mutation.js';
 import { DomainQuery } from './domain-query.js';
 export declare const entities: (typeof User)[];
-export declare const resolvers: (typeof UserQuery | typeof UserMutation | typeof DomainQuery)[];
+export declare const resolvers: (typeof UserMutation | typeof UserQuery | typeof DomainQuery)[];

package/dist-server/service/user/user-mutation.js

@@ -344,7 +344,7 @@ let UserMutation = class UserMutation {
             throw new Error(`User is not belongs to current domain`);
         }
         /* Found again in this domain's scope - the ids are the client's (utils/assignable-roles.ts, ADR-0103 decision 2). */
-        const { user: saved } = await (0, assignable_roles_js_1.assignRoles)(user, { add: selectedRoles.map(role => role.id), remove: availableRoles.map(role => role.id) }, domain, tx);
+        const { user: saved } = await (0, assignable_roles_js_1.assignRoles)(user, { add: selectedRoles.map(role => role.id), remove: availableRoles.map(role => role.id) }, domain, tx, context.state.user);
         return saved;
     }
 };

package/dist-server/service/user/user-mutation.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-mutation.js","sourceRoot":"","sources":["../../../server/service/user/user-mutation.ts"],"names":[],"mappings":";;;;AAAA,+CAAqF;AACrF,qDAAqD;AACrD,qCAAsE;AAEtE,6CAA4C;AAC5C,iDAAuF;AAEvF,qEAAmH;AACnH,yEAA6D;AAC7D,yEAA8E;AAC9E,yEAAsF;AACtF,6CAAsC;AACtC,uCAA4C;AAC5C,mDAAoD;AACpD,iEAA+G;AAGxG,IAAM,YAAY,GAAlB,MAAM,YAAY;IAOjB,AAAN,KAAK,CAAC,UAAU,CACqE,IAAa,EACzF,OAAwB;QAE/B,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QACpC,MAAM,EAAE,eAAe,EAAE,GAAG,YAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QAClD,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,IAAI,CAAA;QAChC,MAAM,cAAc,GAAG,IAAA,qBAAa,EAAC,cAAI,EAAE,EAAE,CAAC,CAAA;QAE9C,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAA;QAC/B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;QAEzB,IAAI,MAAM,cAAc,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC;YACzE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,GAAG,uCAAuB,CAAC,CAAC,CAAA;QAChE,CAAC;QAED,IAAI,MAAM,cAAc,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,GAAG,oCAAoB,CAAC,CAAC,CAAA;QAC7D,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,eAAe,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAA;QAC9E,CAAC;QAED,6DAA6D;QAC7D,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,GAAG,gCAAgB,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;QACtF,CAAC;QAED,mDAAmD;QACnD,6CAA6C;QAC7C,0DAA0D;QAE1D,MAAM,IAAI,GAAG,cAAI,CAAC,YAAY,EAAE,CAAA;QAEhC,OAAO,MAAM,cAAc,CAAC,IAAI,CAAC;YAC/B,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI;YAC3B,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI;YAC3B,GAAG,IAAI;YACP,OAAO,EAAE,CAAC,MAAM,CAAC;YACjB,KAAK,EACH,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM;gBAC7B,CAAC,CAAC,MAAM,IAAA,qBAAa,EAAC,cAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC;oBACnC,EAAE,EAAE,IAAA,YAAE,EAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBACvC,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE;iBAC1B,CAAC;gBACJ,CAAC,CAAC,EAAE;YACR,IAAI;YACJ,iBAAiB,EAAE,IAAI,IAAI,EAAE;YAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,cAAI,CAAC,MAAM,CAAC,eAAe,EAAE,IAAI,CAAC;SAChG,CAAC,CAAA;IACJ,CAAC;IAQK,AAAN,KAAK,CAAC,UAAU,CAEd,KAAa,EACsE,KAAgB,EAC5F,OAAwB;QAE/B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,GAAuD,OAAO,CAAC,KAAK,CAAA;QACvG,MAAM,EAAE,GAA6B,IAAA,kDAA4B,EAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QACpF,MAAM,IAAI,GAAS,MAAM,EAAE;aACxB,QAAQ,CAAC,4BAA4B,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;aACpF,iBAAiB,CAAC,YAAY,EAAE,OAAO,CAAC;aACxC,iBAAiB,CAAC,cAAc,EAAE,UAAU,CAAC;aAC7C,MAAM,EAAE,CAAA;QAEX,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,KAAK,CAAC,KAAK,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC;gBAC/C,KAAK,EAAE,EAAE,EAAE,EAAE,IAAA,YAAE,EAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAgB,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;aAC/D,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YACjD,IAAI,CAAC,MAAM,GAAG,oBAAU,CAAC,SAAS,CAAA;QACpC,CAAC;QAED,OAAO,MAAM,IAAA,qBAAa,EAAC,cAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC;YACxC,GAAG,IAAI;YACP,GAAG,KAAK;YACR,OAAO;SACD,CAAC,CAAA;IACX,CAAC;IAQK,AAAN,KAAK,CAAC,kBAAkB,CAEtB,OAAoB,EACb,OAAwB;QAE/B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAC1C,MAAM,QAAQ,GAAG,IAAA,qBAAa,EAAC,cAAI,EAAE,EAAE,CAAC,CAAA;QAExC,IAAI,OAAO,GAAG,EAAE,CAAA;QAChB,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAU,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,CAAA;QACzF,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAU,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,CAAA;QAEzF,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC/C,MAAM,SAAS,GAAG,cAAc,CAAC,CAAC,CAAC,CAAA;gBAEnC,mDAAmD;gBACnD,6CAA6C;gBAC7C,+DAA+D;gBAE/D,MAAM,IAAI,GAAG,cAAI,CAAC,YAAY,EAAE,CAAA;gBAChC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC;oBACjC,GAAI,SAAiB;oBACrB,OAAO,EAAE,CAAC,MAAM,CAAC;oBACjB,IAAI;oBACJ,QAAQ,EAAE,cAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC;oBAC/C,iBAAiB,EAAE,IAAI,IAAI,EAAE;oBAC7B,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE,IAAI;iBACd,CAAC,CAAA;gBAEF,2BAA2B;gBAC3B,WAAW;gBACX,0BAA0B;gBAC1B,cAAc;gBACd,2BAA2B;gBAC3B,cAAc;gBACd,0BAA0B;gBAC1B,2BAA2B;gBAC3B,OAAO;gBACP,eAAe;gBAEf,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YAC1C,CAAC;QACH,CAAC;QAED,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC/C,MAAM,YAAY,GAAG,cAAc,CAAC,CAAC,CAAC,CAAA;gBACtC,mDAAmD;gBACnD,6CAA6C;gBAC7C,kEAAkE;gBAElE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;gBAC/F,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;gBAEnG,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC;oBACjC,GAAG,IAAI;oBACP,GAAI,YAAoB;oBACxB,OAAO;oBACP,QAAQ,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ;oBAC/F,OAAO,EAAE,IAAI;iBACd,CAAC,CAAA;gBAEF,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;oBACzB,SAAQ;gBACV,CAAC;gBAED,mCAAmC;gBACnC,iBAAiB;gBACjB,aAAa;gBACb,IAAI;gBAEJ,6BAA6B;gBAC7B,qCAAqC;gBACrC,wDAAwD;gBACxD,aAAa;gBACb,4BAA4B;gBAC5B,gBAAgB;gBAChB,6BAA6B;gBAC7B,gBAAgB;gBAChB,0BAA0B;gBAC1B,6BAA6B;gBAC7B,SAAS;gBACT,iBAAiB;gBACjB,IAAI;gBAEJ,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YAC1C,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAA;IAChB,CAAC;IAQK,AAAN,KAAK,CAAC,UAAU,CAC2D,QAAgB,EAClF,OAAwB;QAE/B,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAE5B,MAAM,IAAA,2BAAgB,EAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAA;QAExC,OAAO,IAAI,CAAA;IACb,CAAC;IAQK,AAAN,KAAK,CAAC,WAAW,CAC0E,SAAmB,EACrG,OAAwB;QAE/B,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAC5B,MAAM,IAAA,4BAAiB,EAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAA;QAE1C,OAAO,IAAI,CAAA;IACb,CAAC;IAQK,AAAN,KAAK,CAAC,UAAU,CACoE,QAAgB,EAC3F,OAAwB;QAE/B,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QACpC,MAAM,cAAc,GAAG,IAAA,qBAAa,EAAC,cAAI,EAAE,EAAE,CAAC,CAAA;QAE9C,IAAI,OAAO,GAAS,MAAM,cAAc,CAAC,OAAO,CAAC;YAC/C,KAAK,EAAE,EAAE,QAAQ,EAAE;YACnB,SAAS,EAAE,CAAC,SAAS,CAAC;SACvB,CAAC,CAAA;QAEF,IAAI,CAAC,OAAO,IAAI,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5D,OAAO,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC;gBACrC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,QAAQ,CAAC,EAAE;gBACjC,SAAS,EAAE,CAAC,SAAS,CAAC;aACvB,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAA;QACtF,CAAC;QAED,MAAM,eAAe,GAAa,OAAO,CAAC,OAAO,CAAA;QACjD,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,6BAA6B,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;QAC3G,CAAC;QAED,OAAO,CAAC,OAAO,GAAG,CAAC,GAAG,eAAe,EAAE,MAAM,CAAC,CAAA;QAC9C,MAAM,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAElC,OAAO,IAAI,CAAA;IACb,CAAC;IAQK,AAAN,KAAK,CAAC,gBAAgB,CAC8E,QAAgB,EAC3G,OAAwB;QAE/B,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QACpC,MAAM,cAAc,GAAG,IAAA,qBAAa,EAAC,cAAI,EAAE,EAAE,CAAC,CAAA;QAE9C,IAAI,IAAI,GAAS,MAAM,cAAc,CAAC,OAAO,CAAC;YAC5C,KAAK,EAAE,EAAE,QAAQ,EAAE;YACnB,SAAS,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC;SAChC,CAAC,CAAA;QAEF,IAAI,CAAC,IAAI,IAAI,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzD,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC;gBAClC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,QAAQ,CAAC,EAAE;gBACjC,SAAS,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC;aAChC,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAA;QACtF,CAAC;QAED,MAAM,eAAe,GAAW,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,UAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,CAAA;QAC3G,IAAI,eAAe,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;QAC9F,CAAC;QAED,mCAAmC;QACnC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,CAAA;QAEvC,sCAAsC;QACtC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAU,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,EAAE,CAAC,CAAA;QAE3E,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAE/B,OAAO,IAAI,CAAA;IACb,CAAC;IAQK,AAAN,KAAK,CAAC,aAAa,CACgF,QAAgB,EAC1G,OAAwB;QAE/B,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QACjD,MAAM,cAAc,GAAG,IAAA,qBAAa,EAAC,cAAI,EAAE,EAAE,CAAC,CAAA;QAE9C,IAAI,IAAI,GAAS,MAAM,cAAc,CAAC,OAAO,CAAC;YAC5C,KAAK,EAAE,EAAE,QAAQ,EAAE;YACnB,SAAS,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC;SAChC,CAAC,CAAA;QAEF,IAAI,CAAC,IAAI,IAAI,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzD,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC;gBAClC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,QAAQ,CAAC,EAAE;gBACjC,SAAS,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC;aAChC,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAA;QACtF,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,oBAAU,CAAC,SAAS,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAA;QACnF,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;QAC1D,CAAC;QAED,qDAAqD;QACrD,MAAM,sBAAsB,GAAa,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QACrF,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAO,EAAE,EAAE,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YAC5F,MAAM,IAAI,KAAK,CAAC,4FAA4F,CAAC,CAAA;QAC/G,CAAC;QAED,2DAA2D;QAC3D,MAAM,IAAA,2CAAqB,EAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAA;QAEvD,OAAO,IAAI,CAAA;IACb,CAAC;IAQK,AAAN,KAAK,CAAC,YAAY,CACoE,QAAgB,EAC7F,OAAwB;QAE/B,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QACpC,MAAM,cAAc,GAAG,IAAA,qBAAa,EAAC,cAAI,EAAE,EAAE,CAAC,CAAA;QAE9C,IAAI,UAAU,GAAS,MAAM,cAAc,CAAC,OAAO,CAAC;YAClD,KAAK,EAAE,EAAE,QAAQ,EAAE;YACnB,SAAS,EAAE,CAAC,SAAS,CAAC;SACvB,CAAC,CAAA;QAEF,IAAI,CAAC,UAAU,IAAI,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/D,UAAU,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC;gBACxC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,QAAQ,CAAC,EAAE;gBACjC,SAAS,EAAE,CAAC,SAAS,CAAC;aACvB,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAA;QACtF,CAAC;QAED,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,UAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;YACpF,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;QACjD,CAAC;QAED,UAAU,CAAC,SAAS,GAAG,CAAC,CAAA;QACxB,UAAU,CAAC,MAAM,GAAG,oBAAU,CAAC,SAAS,CAAA;QAExC,MAAM,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAErC,OAAO,IAAI,CAAA;IACb,CAAC;IAQK,AAAN,KAAK,CAAC,cAAc,CACoE,QAAgB,EAC/F,OAAwB;QAE/B,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QACpC,MAAM,cAAc,GAAG,IAAA,qBAAa,EAAC,cAAI,EAAE,EAAE,CAAC,CAAA;QAE9C,IAAI,UAAU,GAAS,MAAM,cAAc,CAAC,OAAO,CAAC;YAClD,KAAK,EAAE,EAAE,QAAQ,EAAE;YACnB,SAAS,EAAE,CAAC,SAAS,CAAC;SACvB,CAAC,CAAA;QAEF,IAAI,CAAC,UAAU,IAAI,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/D,UAAU,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC;gBACxC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,QAAQ,CAAC,EAAE;gBACjC,SAAS,EAAE,CAAC,SAAS,CAAC;aACvB,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAA;QACtF,CAAC;QAED,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,UAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;YACpF,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;QACjD,CAAC;QAED,sDAAsD;QACtD,IAAI,UAAU,CAAC,QAAQ,IAAI,OAAO,IAAI,CAAC,MAAM,IAAA,mCAAa,EAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;YACpF,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;QACnD,CAAC;QAED,UAAU,CAAC,MAAM,GAAG,oBAAU,CAAC,QAAQ,CAAA;QAEvC,MAAM,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAErC,OAAO,IAAI,CAAA;IACb,CAAC;IAQK,AAAN,KAAK,CAAC,sBAAsB,CACsE,QAAgB,EACzG,OAAwB;QAE/B,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEpC,MAAM,EAAE,eAAe,EAAE,GAAG,YAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QAClD,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;QAC9C,CAAC;QAED,MAAM,cAAc,GAAG,IAAA,qBAAa,EAAC,cAAI,EAAE,EAAE,CAAC,CAAA;QAE9C,IAAI,UAAU,GAAS,MAAM,cAAc,CAAC,OAAO,CAAC;YAClD,KAAK,EAAE,EAAE,QAAQ,EAAE;YACnB,SAAS,EAAE,CAAC,SAAS,CAAC;SACvB,CAAC,CAAA;QAEF,IAAI,CAAC,UAAU,IAAI,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/D,UAAU,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC;gBACxC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,QAAQ,CAAC,EAAE;gBACjC,SAAS,EAAE,CAAC,SAAS,CAAC;aACvB,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAA;QACtF,CAAC;QAED,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,UAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;YACpF,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;QACjD,CAAC;QAED,UAAU,CAAC,IAAI,GAAG,cAAI,CAAC,YAAY,EAAE,CAAA;QACrC,UAAU,CAAC,QAAQ,GAAG,cAAI,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,IAAI,CAAC,CAAA;QAEnE,MAAM,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAErC,OAAO,IAAI,CAAA;IACb,CAAC;IASK,AAAN,KAAK,CAAC,eAAe,CAC2E,QAAgB,EAE9G,cAA2B,EAE3B,aAA0B,EACnB,OAAwB;QAE/B,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QACpC,MAAM,cAAc,GAAG,IAAA,qBAAa,EAAC,cAAI,EAAE,EAAE,CAAC,CAAA;QAE9C,IAAI,IAAI,GAAS,MAAM,cAAc,CAAC,OAAO,CAAC;YAC5C,KAAK,EAAE,EAAE,QAAQ,EAAE;YACnB,SAAS,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC;SAChC,CAAC,CAAA;QAEF,IAAI,CAAC,IAAI,IAAI,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzD,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC;gBAClC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,QAAQ,CAAC,EAAE;gBACjC,SAAS,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC;aAChC,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAA;QACtF,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;QAC1D,CAAC;QAED,qHAAqH;QACrH,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAA,iCAAW,EACvC,IAAI,EACJ,EAAE,GAAG,EAAE,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EACxF,MAAM,EACN,EAAE,CACH,CAAA;QAED,OAAO,KAAK,CAAA;IACd,CAAC;CACF,CAAA;AAjiBY,oCAAY;AAOjB;IANL,IAAA,wBAAS,EAAC,+EAA+E,CAAC;IAC1F,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,cAAI,EAAE;QACzB,WAAW,EACT,+HAA+H;KAClI,CAAC;IAEC,mBAAA,IAAA,kBAAG,EAAC,MAAM,EAAE,EAAE,WAAW,EAAE,mDAAmD,EAAE,CAAC,CAAA;IACjF,mBAAA,IAAA,kBAAG,GAAE,CAAA;;6CADmF,uBAAO;;8CAkDjG;AAQK;IANL,IAAA,wBAAS,EAAC,+EAA+E,CAAC;IAC1F,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,cAAI,EAAE;QACzB,WAAW,EACT,+HAA+H;KAClI,CAAC;IAEC,mBAAA,IAAA,kBAAG,EAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,qCAAmB,EAAE,EAAE,WAAW,EAAE,0CAA0C,EAAE,CAAC,CAAA;IAEtG,mBAAA,IAAA,kBAAG,EAAC,OAAO,EAAE,EAAE,WAAW,EAAE,kDAAkD,EAAE,CAAC,CAAA;IACjF,mBAAA,IAAA,kBAAG,GAAE,CAAA;;qDADoF,yBAAS;;8CA0BpG;AAQK;IANL,IAAA,wBAAS,EAAC,+EAA+E,CAAC;IAC1F,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,CAAC,cAAI,CAAC,EAAE;QAC3B,WAAW,EACT,kHAAkH;KACrH,CAAC;IAEC,mBAAA,IAAA,kBAAG,EAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,yBAAS,CAAC,EAAE,EAAE,WAAW,EAAE,yDAAyD,EAAE,CAAC,CAAA;IAE/G,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;sDAyFP;AAQK;IANL,IAAA,wBAAS,EAAC,+EAA+E,CAAC;IAC1F,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE;QAC5B,WAAW,EACT,mIAAmI;KACtI,CAAC;IAEC,mBAAA,IAAA,kBAAG,EAAC,UAAU,EAAE,EAAE,WAAW,EAAE,qCAAqC,EAAE,CAAC,CAAA;IACvE,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;8CAOP;AAQK;IANL,IAAA,wBAAS,EAAC,+EAA+E,CAAC;IAC1F,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE;QAC5B,WAAW,EACT,uHAAuH;KAC1H,CAAC;IAEC,mBAAA,IAAA,kBAAG,EAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,kCAAkC,EAAE,CAAC,CAAA;IACvF,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;+CAMP;AAQK;IANL,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,wBAAS,EAAC,+EAA+E,CAAC;IAC1F,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE;QAC5B,WAAW,EACT,uIAAuI;KAC1I,CAAC;IAEC,mBAAA,IAAA,kBAAG,EAAC,UAAU,EAAE,EAAE,WAAW,EAAE,8CAA8C,EAAE,CAAC,CAAA;IAChF,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;8CA8BP;AAQK;IANL,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,wBAAS,EAAC,+EAA+E,CAAC;IAC1F,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE;QAC5B,WAAW,EACT,0IAA0I;KAC7I,CAAC;IAEC,mBAAA,IAAA,kBAAG,EAAC,UAAU,EAAE,EAAE,WAAW,EAAE,8DAA8D,EAAE,CAAC,CAAA;IAChG,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;oDAmCP;AAQK;IANL,IAAA,wBAAS,EAAC,8DAA8D,CAAC;IACzE,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE;QAC5B,WAAW,EACT,+HAA+H;KAClI,CAAC;IAEC,mBAAA,IAAA,kBAAG,EAAC,UAAU,EAAE,EAAE,WAAW,EAAE,6DAA6D,EAAE,CAAC,CAAA;IAC/F,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;iDAuCP;AAQK;IANL,IAAA,wBAAS,EAAC,+EAA+E,CAAC;IAC1F,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE;QAC5B,WAAW,EACT,iHAAiH;KACpH,CAAC;IAEC,mBAAA,IAAA,kBAAG,EAAC,UAAU,EAAE,EAAE,WAAW,EAAE,gDAAgD,EAAE,CAAC,CAAA;IAClF,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;gDA+BP;AAQK;IANL,IAAA,wBAAS,EAAC,+EAA+E,CAAC;IAC1F,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE;QAC5B,WAAW,EACT,sHAAsH;KACzH,CAAC;IAEC,mBAAA,IAAA,kBAAG,EAAC,UAAU,EAAE,EAAE,WAAW,EAAE,kDAAkD,EAAE,CAAC,CAAA;IACpF,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;kDAmCP;AAQK;IANL,IAAA,wBAAS,EAAC,+EAA+E,CAAC;IAC1F,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE;QAC5B,WAAW,EACT,gIAAgI;KACnI,CAAC;IAEC,mBAAA,IAAA,kBAAG,EAAC,UAAU,EAAE,EAAE,WAAW,EAAE,4DAA4D,EAAE,CAAC,CAAA;IAC9F,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;0DAqCP;AASK;IAPL,IAAA,wBAAS,EAAC,+EAA+E,CAAC;IAC1F,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,4BAAa,EAAC,qBAAa,CAAC;IAC5B,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,cAAI,EAAE;QACzB,WAAW,EACT,2GAA2G;KAC9G,CAAC;IAEC,mBAAA,IAAA,kBAAG,EAAC,UAAU,EAAE,EAAE,WAAW,EAAE,0DAA0D,EAAE,CAAC,CAAA;IAC5F,mBAAA,IAAA,kBAAG,EAAC,gBAAgB,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,iBAAS,CAAC,EAAE,EAAE,WAAW,EAAE,qDAAqD,EAAE,CAAC,CAAA;IAElH,mBAAA,IAAA,kBAAG,EAAC,eAAe,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,iBAAS,CAAC,EAAE,EAAE,WAAW,EAAE,+CAA+C,EAAE,CAAC,CAAA;IAE3G,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;mDAkCP;uBAhiBU,YAAY;IADxB,IAAA,uBAAQ,EAAC,cAAI,CAAC;GACF,YAAY,CAiiBxB","sourcesContent":["import { Arg, Ctx, Directive, Mutation, Resolver, UseMiddleware } from 'type-graphql'\nimport { GraphQLEmailAddress } from 'graphql-scalars'\nimport { ILike, In, SelectQueryBuilder, EntityManager } from 'typeorm'\n\nimport { config } from '@things-factory/env'\nimport { Domain, getRepository, ObjectRef, SpeakRefusals } from '@things-factory/shell'\n\nimport { deleteUser as commonDeleteUser, deleteUsers as commonDeleteUsers } from '../../controllers/delete-user.js'\nimport { assignRoles } from '../../utils/assignable-roles.js'\nimport { buildDomainUsersQueryBuilder } from '../../utils/get-domain-users.js'\nimport { isDomainOwner, setPrimaryDomainOwner } from '../../utils/domain-ownership.js'\nimport { Role } from '../role/role.js'\nimport { User, UserStatus } from './user.js'\nimport { NewUser, UserPatch } from './user-types.js'\nimport { USERNAME_ALREADY_EXISTS, EMAIL_ALREADY_EXISTS, USERNAME_INVALID } from '../../constants/error-code.js'\n\n@Resolver(User)\nexport class UserMutation {\n  @Directive('@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true)')\n  @Directive('@transaction')\n  @Mutation(returns => User, {\n    description:\n      'Creates a new user in the system. Use this mutation to register a user with the specified credentials and domain information.'\n  })\n  async createUser(\n    @Arg('user', { description: 'The input object containing new user information.' }) user: NewUser,\n    @Ctx() context: ResolverContext\n  ) {\n    const { domain, tx } = context.state\n    const { defaultPassword } = config.get('password')\n    const { username, email } = user\n    const userRepository = getRepository(User, tx)\n\n    user.username = username.trim()\n    user.email = email.trim()\n\n    if (await userRepository.findOne({ where: { username: user.username } })) {\n      throw new Error(context.t('error.' + USERNAME_ALREADY_EXISTS))\n    }\n\n    if (await userRepository.findOne({ where: { email: ILike(user.email) } })) {\n      throw new Error(context.t('error.' + EMAIL_ALREADY_EXISTS))\n    }\n\n    if (!user.password && !defaultPassword) {\n      throw new Error('initial password or default password should be supported.')\n    }\n\n    // TODO username은 다음 패턴을 따라야 한다. pattern=\"^[A-Za-z0-9._@-]+$\"\n    if (!/^[A-Za-z0-9._@-]+$/.test(user.username)) {\n      throw new Error(context.t('error.' + USERNAME_INVALID, { username: user.username }))\n    }\n\n    // consider if validation password rule is required\n    /* check if password is following the rule */\n    // User.validatePasswordByRule(user.password, context.lng)\n\n    const salt = User.generateSalt()\n\n    return await userRepository.save({\n      creator: context.state.user,\n      updater: context.state.user,\n      ...user,\n      domains: [domain],\n      roles:\n        user.roles && user.roles.length\n          ? await getRepository(Role, tx).findBy({\n              id: In(user.roles.map(role => role.id)),\n              domain: { id: domain.id }\n            })\n          : [],\n      salt,\n      passwordUpdatedAt: new Date(),\n      password: user.password ? User.encode(user.password, salt) : User.encode(defaultPassword, salt)\n    })\n  }\n\n  @Directive('@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true)')\n  @Directive('@transaction')\n  @Mutation(returns => User, {\n    description:\n      'Updates the information of an existing user. Use this mutation to modify user profile details, such as name, email, or roles.'\n  })\n  async updateUser(\n    @Arg('email', type => GraphQLEmailAddress, { description: 'The email address of the user to update.' })\n    email: string,\n    @Arg('patch', { description: 'The patch object containing updated user fields.' }) patch: UserPatch,\n    @Ctx() context: ResolverContext\n  ) {\n    const { domain, user: updater, tx }: { domain: Domain; user: User; tx?: EntityManager } = context.state\n    const qb: SelectQueryBuilder<User> = buildDomainUsersQueryBuilder(domain.id, 'USER')\n    const user: User = await qb\n      .andWhere('LOWER(USER.email) = :email', { email: email?.toLowerCase().trim() || '' })\n      .leftJoinAndSelect('USER.roles', 'ROLES')\n      .leftJoinAndSelect('ROLES.domain', 'R_DOMAIN')\n      .getOne()\n\n    if (patch.roles) {\n      patch.roles = await getRepository(Role, tx).find({\n        where: { id: In(patch.roles.map((r: Partial<Role>) => r.id)) }\n      })\n    }\n\n    if (patch.status && patch.status === 'activated') {\n      user.status = UserStatus.ACTIVATED\n    }\n\n    return await getRepository(User, tx).save({\n      ...user,\n      ...patch,\n      updater\n    } as any)\n  }\n\n  @Directive('@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true)')\n  @Directive('@transaction')\n  @Mutation(returns => [User], {\n    description:\n      'Updates or creates multiple users in a single operation. Use this mutation for batch processing of user records.'\n  })\n  async updateMultipleUser(\n    @Arg('patches', type => [UserPatch], { description: 'An array of patch objects for batch update or creation.' })\n    patches: UserPatch[],\n    @Ctx() context: ResolverContext\n  ) {\n    const { domain, user, tx } = context.state\n    const userRepo = getRepository(User, tx)\n\n    let results = []\n    const _createRecords = patches.filter((patch: any) => patch.cuFlag.toUpperCase() === '+')\n    const _updateRecords = patches.filter((patch: any) => patch.cuFlag.toUpperCase() === 'M')\n\n    if (_createRecords.length > 0) {\n      for (let i = 0; i < _createRecords.length; i++) {\n        const newRecord = _createRecords[i]\n\n        // consider if validation password rule is required\n        /* check if password is following the rule */\n        // User.validatePasswordByRule(newRecord.password, context.lng)\n\n        const salt = User.generateSalt()\n        const result = await userRepo.save({\n          ...(newRecord as any),\n          domains: [domain],\n          salt,\n          password: User.encode(newRecord.password, salt),\n          passwordUpdatedAt: new Date(),\n          creator: user,\n          updater: user\n        })\n\n        // repository api는 작동하지 않음.\n        // await tx\n        //   .createQueryBuilder()\n        //   .insert()\n        //   .into('users_domains')\n        //   .values({\n        //     usersId: result.id,\n        //     domainsId: domain.id\n        //   })\n        //   .execute()\n\n        results.push({ ...result, cuFlag: '+' })\n      }\n    }\n\n    if (_updateRecords.length > 0) {\n      for (let i = 0; i < _updateRecords.length; i++) {\n        const updateRecord = _updateRecords[i]\n        // consider if validation password rule is required\n        /* check if password is following the rule */\n        // User.validatePasswordByRule(updateRecord.password, context.lng)\n\n        const user = await userRepo.findOne({ where: { id: updateRecord.id }, relations: ['domains'] })\n        var domains = user.domains.find(d => d.id === domain.id) ? user.domains : [...user.domains, domain]\n\n        const result = await userRepo.save({\n          ...user,\n          ...(updateRecord as any),\n          domains,\n          password: updateRecord.password ? User.encode(updateRecord.password, user.salt) : user.password,\n          updater: user\n        })\n\n        if (!updateRecord.status) {\n          continue\n        }\n\n        // const domain = await user.domain\n        // if (!domain) {\n        //   continue\n        // }\n\n        // const domainId = domain.id\n        // const domains = await user.domains\n        // if (!domains.find(domain => domain.id == domainId)) {\n        //   await tx\n        //     .createQueryBuilder()\n        //     .insert()\n        //     .into('users_domains')\n        //     .values({\n        //       usersId: user.id,\n        //       domainsId: domain.id\n        //     })\n        //     .execute()\n        // }\n\n        results.push({ ...result, cuFlag: 'M' })\n      }\n    }\n\n    return results\n  }\n\n  @Directive('@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true)')\n  @Directive('@transaction')\n  @Mutation(returns => Boolean, {\n    description:\n      'Deletes a user from the system by their username. Use this mutation to permanently remove a user account and revoke their access.'\n  })\n  async deleteUser(\n    @Arg('username', { description: 'The username of the user to delete.' }) username: string,\n    @Ctx() context: ResolverContext\n  ) {\n    const { tx } = context.state\n\n    await commonDeleteUser({ username }, tx)\n\n    return true\n  }\n\n  @Directive('@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true)')\n  @Directive('@transaction')\n  @Mutation(returns => Boolean, {\n    description:\n      'Deletes multiple users from the system by their usernames. Use this mutation to remove several user accounts at once.'\n  })\n  async deleteUsers(\n    @Arg('usernames', type => [String], { description: 'An array of usernames to delete.' }) usernames: string[],\n    @Ctx() context: ResolverContext\n  ) {\n    const { tx } = context.state\n    await commonDeleteUsers({ usernames }, tx)\n\n    return true\n  }\n\n  @Directive('@transaction')\n  @Directive('@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true)')\n  @Mutation(returns => Boolean, {\n    description:\n      'Invites an existing user to join the current domain. Use this mutation to add a user to a domain if they already exist in the system.'\n  })\n  async inviteUser(\n    @Arg('username', { description: 'The username or email of the user to invite.' }) username: string,\n    @Ctx() context: ResolverContext\n  ): Promise<boolean> {\n    const { domain, tx } = context.state\n    const userRepository = getRepository(User, tx)\n\n    var invitee: User = await userRepository.findOne({\n      where: { username },\n      relations: ['domains']\n    })\n\n    if (!invitee && /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(username)) {\n      invitee = await userRepository.findOne({\n        where: { email: ILike(username) },\n        relations: ['domains']\n      })\n    }\n\n    if (!invitee) {\n      throw new Error(context.t('error.failed to find x', { x: context.t('field.user') }))\n    }\n\n    const existingDomains: Domain[] = invitee.domains\n    if (existingDomains.find((d: Domain) => d.id === domain.id)) {\n      throw new Error(context.t('error.x already exists in y', { x: context.t('field.user'), y: domain.name }))\n    }\n\n    invitee.domains = [...existingDomains, domain]\n    await userRepository.save(invitee)\n\n    return true\n  }\n\n  @Directive('@transaction')\n  @Directive('@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true)')\n  @Mutation(returns => Boolean, {\n    description:\n      \"Removes a user from the current domain. Use this mutation to revoke a user's access to a specific domain without deleting their account.\"\n  })\n  async deleteDomainUser(\n    @Arg('username', { description: 'The username or email of the user to remove from the domain.' }) username: string,\n    @Ctx() context: ResolverContext\n  ): Promise<boolean> {\n    const { tx, domain } = context.state\n    const userRepository = getRepository(User, tx)\n\n    var user: User = await userRepository.findOne({\n      where: { username },\n      relations: ['domains', 'roles']\n    })\n\n    if (!user && /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(username)) {\n      user = await userRepository.findOne({\n        where: { email: ILike(username) },\n        relations: ['domains', 'roles']\n      })\n    }\n\n    if (!user) {\n      throw new Error(context.t('error.failed to find x', { x: context.t('field.user') }))\n    }\n\n    const targetDomainIdx: number = user.domains.findIndex((userDomain: Domain) => userDomain.id === domain.id)\n    if (targetDomainIdx < 0) {\n      throw new Error(context.t('error.x is not a member of y', { x: user.name, y: domain.name }))\n    }\n\n    // Remove domain relation with user\n    user.domains.splice(targetDomainIdx, 1)\n\n    // Remove domain's roles that user has\n    user.roles = user.roles.filter((role: Role) => role.domainId !== domain.id)\n\n    await userRepository.save(user)\n\n    return true\n  }\n\n  @Directive('@privilege(domainOwnerGranted: true, superUserGranted: true)')\n  @Directive('@transaction')\n  @Mutation(returns => Boolean, {\n    description:\n      'Transfers domain ownership to another user. Use this mutation to assign the owner role to a different user within the domain.'\n  })\n  async transferOwner(\n    @Arg('username', { description: 'The username or email of the user to transfer ownership to.' }) username: string,\n    @Ctx() context: ResolverContext\n  ): Promise<boolean> {\n    const { domain, tx, user: actor } = context.state\n    const userRepository = getRepository(User, tx)\n\n    var user: User = await userRepository.findOne({\n      where: { username },\n      relations: ['domains', 'roles']\n    })\n\n    if (!user && /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(username)) {\n      user = await userRepository.findOne({\n        where: { email: ILike(username) },\n        relations: ['domains', 'roles']\n      })\n    }\n\n    if (!user) {\n      throw new Error(context.t('error.failed to find x', { x: context.t('field.user') }))\n    }\n\n    if (user.status !== UserStatus.ACTIVATED) {\n      throw new Error('Only activated users are eligible to receive admin privileges.')\n    }\n\n    if (user.domains.map((d: Domain) => d.id).indexOf(domain.id) < 0) {\n      throw new Error(`User is not belongs to current domain`)\n    }\n\n    /* 역할은 부모 도메인으로부터 상속될 수 있으므로 부여된 상속 역할도 자격으로 인정한다. */\n    const grantableRoleDomainIds: string[] = [domain.id, domain.parentId].filter(Boolean)\n    if (user.roles.filter((r: Role) => grantableRoleDomainIds.includes(r.domainId)).length == 0) {\n      throw new Error(`Only users with at least one role in this domain are eligible to receive admin privileges.`)\n    }\n\n    /* 대표 오너 컬럼과 `DomainOwner` 테이블을 함께 갱신한다 (기존 오너 엔트리는 유지). */\n    await setPrimaryDomainOwner(domain, user.id, actor, tx)\n\n    return true\n  }\n\n  @Directive('@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true)')\n  @Directive('@transaction')\n  @Mutation(returns => Boolean, {\n    description:\n      'Activates a user account in the current domain. Use this mutation to enable a user who was previously inactive.'\n  })\n  async activateUser(\n    @Arg('username', { description: 'The username or email of the user to activate.' }) username: string,\n    @Ctx() context: ResolverContext\n  ): Promise<boolean> {\n    const { tx, domain } = context.state\n    const userRepository = getRepository(User, tx)\n\n    var targetUser: User = await userRepository.findOne({\n      where: { username },\n      relations: ['domains']\n    })\n\n    if (!targetUser && /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(username)) {\n      targetUser = await userRepository.findOne({\n        where: { email: ILike(username) },\n        relations: ['domains']\n      })\n    }\n\n    if (!targetUser) {\n      throw new Error(context.t('error.failed to find x', { x: context.t('field.user') }))\n    }\n\n    if (!targetUser?.domains?.find((userDomain: Domain) => userDomain.id === domain.id)) {\n      throw new Error('User is not belong to domain')\n    }\n\n    targetUser.failCount = 0\n    targetUser.status = UserStatus.ACTIVATED\n\n    await userRepository.save(targetUser)\n\n    return true\n  }\n\n  @Directive('@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true)')\n  @Directive('@transaction')\n  @Mutation(returns => Boolean, {\n    description:\n      'Inactivates a user account in the current domain. Use this mutation to disable a user, making them unable to log in.'\n  })\n  async inactivateUser(\n    @Arg('username', { description: 'The username or email of the user to inactivate.' }) username: string,\n    @Ctx() context: ResolverContext\n  ): Promise<boolean> {\n    const { tx, domain } = context.state\n    const userRepository = getRepository(User, tx)\n\n    var targetUser: User = await userRepository.findOne({\n      where: { username },\n      relations: ['domains']\n    })\n\n    if (!targetUser && /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(username)) {\n      targetUser = await userRepository.findOne({\n        where: { email: ILike(username) },\n        relations: ['domains']\n      })\n    }\n\n    if (!targetUser) {\n      throw new Error(context.t('error.failed to find x', { x: context.t('field.user') }))\n    }\n\n    if (!targetUser?.domains?.find((userDomain: Domain) => userDomain.id === domain.id)) {\n      throw new Error('User is not belong to domain')\n    }\n\n    /* 공동 오너(`DomainOwner` 테이블)도 도메인 관리자이므로 같은 보호를 받는다. */\n    if (targetUser.userType == 'admin' || (await isDomainOwner(domain, targetUser, tx))) {\n      throw new Error('Admin deactivation not allowed')\n    }\n\n    targetUser.status = UserStatus.INACTIVE\n\n    await userRepository.save(targetUser)\n\n    return true\n  }\n\n  @Directive('@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true)')\n  @Directive('@transaction')\n  @Mutation(returns => Boolean, {\n    description:\n      \"Resets a user's password to the default value. Use this mutation to restore access to a user who has forgotten their password.\"\n  })\n  async resetPasswordToDefault(\n    @Arg('username', { description: 'The username or email of the user whose password to reset.' }) username: string,\n    @Ctx() context: ResolverContext\n  ): Promise<boolean> {\n    const { tx, domain } = context.state\n\n    const { defaultPassword } = config.get('password')\n    if (!defaultPassword) {\n      throw new Error('No default password found')\n    }\n\n    const userRepository = getRepository(User, tx)\n\n    var targetUser: User = await userRepository.findOne({\n      where: { username },\n      relations: ['domains']\n    })\n\n    if (!targetUser && /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(username)) {\n      targetUser = await userRepository.findOne({\n        where: { email: ILike(username) },\n        relations: ['domains']\n      })\n    }\n\n    if (!targetUser) {\n      throw new Error(context.t('error.failed to find x', { x: context.t('field.user') }))\n    }\n\n    if (!targetUser?.domains?.find((userDomain: Domain) => userDomain.id === domain.id)) {\n      throw new Error('User is not belong to domain')\n    }\n\n    targetUser.salt = User.generateSalt()\n    targetUser.password = User.encode(defaultPassword, targetUser.salt)\n\n    await userRepository.save(targetUser)\n\n    return true\n  }\n\n  @Directive('@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true)')\n  @Directive('@transaction')\n  @UseMiddleware(SpeakRefusals)\n  @Mutation(returns => User, {\n    description:\n      \"Updates the roles assigned to a user. Use this mutation to change a user's permissions within the domain.\"\n  })\n  async updateUserRoles(\n    @Arg('username', { description: 'The username or email of the user whose roles to update.' }) username: string,\n    @Arg('availableRoles', type => [ObjectRef], { description: 'The list of roles that can be assigned to the user.' })\n    availableRoles: ObjectRef[],\n    @Arg('selectedRoles', type => [ObjectRef], { description: 'The list of roles to be assigned to the user.' })\n    selectedRoles: ObjectRef[],\n    @Ctx() context: ResolverContext\n  ) {\n    const { domain, tx } = context.state\n    const userRepository = getRepository(User, tx)\n\n    var user: User = await userRepository.findOne({\n      where: { username },\n      relations: ['domains', 'roles']\n    })\n\n    if (!user && /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(username)) {\n      user = await userRepository.findOne({\n        where: { email: ILike(username) },\n        relations: ['domains', 'roles']\n      })\n    }\n\n    if (!user) {\n      throw new Error(context.t('error.failed to find x', { x: context.t('field.user') }))\n    }\n\n    if (user.domains.map((d: Domain) => d.id).indexOf(domain.id) < 0) {\n      throw new Error(`User is not belongs to current domain`)\n    }\n\n    /* Found again in this domain's scope - the ids are the client's (utils/assignable-roles.ts, ADR-0103 decision 2). */\n    const { user: saved } = await assignRoles(\n      user,\n      { add: selectedRoles.map(role => role.id), remove: availableRoles.map(role => role.id) },\n      domain,\n      tx\n    )\n\n    return saved\n  }\n}\n"]}
+{"version":3,"file":"user-mutation.js","sourceRoot":"","sources":["../../../server/service/user/user-mutation.ts"],"names":[],"mappings":";;;;AAAA,+CAAqF;AACrF,qDAAqD;AACrD,qCAAsE;AAEtE,6CAA4C;AAC5C,iDAAuF;AAEvF,qEAAmH;AACnH,yEAA6D;AAC7D,yEAA8E;AAC9E,yEAAsF;AACtF,6CAAsC;AACtC,uCAA4C;AAC5C,mDAAoD;AACpD,iEAA+G;AAGxG,IAAM,YAAY,GAAlB,MAAM,YAAY;IAOjB,AAAN,KAAK,CAAC,UAAU,CACqE,IAAa,EACzF,OAAwB;QAE/B,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QACpC,MAAM,EAAE,eAAe,EAAE,GAAG,YAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QAClD,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,IAAI,CAAA;QAChC,MAAM,cAAc,GAAG,IAAA,qBAAa,EAAC,cAAI,EAAE,EAAE,CAAC,CAAA;QAE9C,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAA;QAC/B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;QAEzB,IAAI,MAAM,cAAc,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC;YACzE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,GAAG,uCAAuB,CAAC,CAAC,CAAA;QAChE,CAAC;QAED,IAAI,MAAM,cAAc,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,GAAG,oCAAoB,CAAC,CAAC,CAAA;QAC7D,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,eAAe,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAA;QAC9E,CAAC;QAED,6DAA6D;QAC7D,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,GAAG,gCAAgB,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;QACtF,CAAC;QAED,mDAAmD;QACnD,6CAA6C;QAC7C,0DAA0D;QAE1D,MAAM,IAAI,GAAG,cAAI,CAAC,YAAY,EAAE,CAAA;QAEhC,OAAO,MAAM,cAAc,CAAC,IAAI,CAAC;YAC/B,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI;YAC3B,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI;YAC3B,GAAG,IAAI;YACP,OAAO,EAAE,CAAC,MAAM,CAAC;YACjB,KAAK,EACH,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM;gBAC7B,CAAC,CAAC,MAAM,IAAA,qBAAa,EAAC,cAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC;oBACnC,EAAE,EAAE,IAAA,YAAE,EAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBACvC,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE;iBAC1B,CAAC;gBACJ,CAAC,CAAC,EAAE;YACR,IAAI;YACJ,iBAAiB,EAAE,IAAI,IAAI,EAAE;YAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,cAAI,CAAC,MAAM,CAAC,eAAe,EAAE,IAAI,CAAC;SAChG,CAAC,CAAA;IACJ,CAAC;IAQK,AAAN,KAAK,CAAC,UAAU,CAEd,KAAa,EACsE,KAAgB,EAC5F,OAAwB;QAE/B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,GAAuD,OAAO,CAAC,KAAK,CAAA;QACvG,MAAM,EAAE,GAA6B,IAAA,kDAA4B,EAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QACpF,MAAM,IAAI,GAAS,MAAM,EAAE;aACxB,QAAQ,CAAC,4BAA4B,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;aACpF,iBAAiB,CAAC,YAAY,EAAE,OAAO,CAAC;aACxC,iBAAiB,CAAC,cAAc,EAAE,UAAU,CAAC;aAC7C,MAAM,EAAE,CAAA;QAEX,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,KAAK,CAAC,KAAK,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC;gBAC/C,KAAK,EAAE,EAAE,EAAE,EAAE,IAAA,YAAE,EAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAgB,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;aAC/D,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YACjD,IAAI,CAAC,MAAM,GAAG,oBAAU,CAAC,SAAS,CAAA;QACpC,CAAC;QAED,OAAO,MAAM,IAAA,qBAAa,EAAC,cAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC;YACxC,GAAG,IAAI;YACP,GAAG,KAAK;YACR,OAAO;SACD,CAAC,CAAA;IACX,CAAC;IAQK,AAAN,KAAK,CAAC,kBAAkB,CAEtB,OAAoB,EACb,OAAwB;QAE/B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAC1C,MAAM,QAAQ,GAAG,IAAA,qBAAa,EAAC,cAAI,EAAE,EAAE,CAAC,CAAA;QAExC,IAAI,OAAO,GAAG,EAAE,CAAA;QAChB,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAU,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,CAAA;QACzF,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAU,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,CAAA;QAEzF,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC/C,MAAM,SAAS,GAAG,cAAc,CAAC,CAAC,CAAC,CAAA;gBAEnC,mDAAmD;gBACnD,6CAA6C;gBAC7C,+DAA+D;gBAE/D,MAAM,IAAI,GAAG,cAAI,CAAC,YAAY,EAAE,CAAA;gBAChC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC;oBACjC,GAAI,SAAiB;oBACrB,OAAO,EAAE,CAAC,MAAM,CAAC;oBACjB,IAAI;oBACJ,QAAQ,EAAE,cAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC;oBAC/C,iBAAiB,EAAE,IAAI,IAAI,EAAE;oBAC7B,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE,IAAI;iBACd,CAAC,CAAA;gBAEF,2BAA2B;gBAC3B,WAAW;gBACX,0BAA0B;gBAC1B,cAAc;gBACd,2BAA2B;gBAC3B,cAAc;gBACd,0BAA0B;gBAC1B,2BAA2B;gBAC3B,OAAO;gBACP,eAAe;gBAEf,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YAC1C,CAAC;QACH,CAAC;QAED,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC/C,MAAM,YAAY,GAAG,cAAc,CAAC,CAAC,CAAC,CAAA;gBACtC,mDAAmD;gBACnD,6CAA6C;gBAC7C,kEAAkE;gBAElE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;gBAC/F,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;gBAEnG,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC;oBACjC,GAAG,IAAI;oBACP,GAAI,YAAoB;oBACxB,OAAO;oBACP,QAAQ,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ;oBAC/F,OAAO,EAAE,IAAI;iBACd,CAAC,CAAA;gBAEF,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;oBACzB,SAAQ;gBACV,CAAC;gBAED,mCAAmC;gBACnC,iBAAiB;gBACjB,aAAa;gBACb,IAAI;gBAEJ,6BAA6B;gBAC7B,qCAAqC;gBACrC,wDAAwD;gBACxD,aAAa;gBACb,4BAA4B;gBAC5B,gBAAgB;gBAChB,6BAA6B;gBAC7B,gBAAgB;gBAChB,0BAA0B;gBAC1B,6BAA6B;gBAC7B,SAAS;gBACT,iBAAiB;gBACjB,IAAI;gBAEJ,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YAC1C,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAA;IAChB,CAAC;IAQK,AAAN,KAAK,CAAC,UAAU,CAC2D,QAAgB,EAClF,OAAwB;QAE/B,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAE5B,MAAM,IAAA,2BAAgB,EAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAA;QAExC,OAAO,IAAI,CAAA;IACb,CAAC;IAQK,AAAN,KAAK,CAAC,WAAW,CAC0E,SAAmB,EACrG,OAAwB;QAE/B,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAC5B,MAAM,IAAA,4BAAiB,EAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAA;QAE1C,OAAO,IAAI,CAAA;IACb,CAAC;IAQK,AAAN,KAAK,CAAC,UAAU,CACoE,QAAgB,EAC3F,OAAwB;QAE/B,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QACpC,MAAM,cAAc,GAAG,IAAA,qBAAa,EAAC,cAAI,EAAE,EAAE,CAAC,CAAA;QAE9C,IAAI,OAAO,GAAS,MAAM,cAAc,CAAC,OAAO,CAAC;YAC/C,KAAK,EAAE,EAAE,QAAQ,EAAE;YACnB,SAAS,EAAE,CAAC,SAAS,CAAC;SACvB,CAAC,CAAA;QAEF,IAAI,CAAC,OAAO,IAAI,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5D,OAAO,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC;gBACrC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,QAAQ,CAAC,EAAE;gBACjC,SAAS,EAAE,CAAC,SAAS,CAAC;aACvB,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAA;QACtF,CAAC;QAED,MAAM,eAAe,GAAa,OAAO,CAAC,OAAO,CAAA;QACjD,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,6BAA6B,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;QAC3G,CAAC;QAED,OAAO,CAAC,OAAO,GAAG,CAAC,GAAG,eAAe,EAAE,MAAM,CAAC,CAAA;QAC9C,MAAM,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAElC,OAAO,IAAI,CAAA;IACb,CAAC;IAQK,AAAN,KAAK,CAAC,gBAAgB,CAC8E,QAAgB,EAC3G,OAAwB;QAE/B,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QACpC,MAAM,cAAc,GAAG,IAAA,qBAAa,EAAC,cAAI,EAAE,EAAE,CAAC,CAAA;QAE9C,IAAI,IAAI,GAAS,MAAM,cAAc,CAAC,OAAO,CAAC;YAC5C,KAAK,EAAE,EAAE,QAAQ,EAAE;YACnB,SAAS,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC;SAChC,CAAC,CAAA;QAEF,IAAI,CAAC,IAAI,IAAI,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzD,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC;gBAClC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,QAAQ,CAAC,EAAE;gBACjC,SAAS,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC;aAChC,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAA;QACtF,CAAC;QAED,MAAM,eAAe,GAAW,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,UAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,CAAA;QAC3G,IAAI,eAAe,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;QAC9F,CAAC;QAED,mCAAmC;QACnC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,CAAA;QAEvC,sCAAsC;QACtC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAU,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,EAAE,CAAC,CAAA;QAE3E,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAE/B,OAAO,IAAI,CAAA;IACb,CAAC;IAQK,AAAN,KAAK,CAAC,aAAa,CACgF,QAAgB,EAC1G,OAAwB;QAE/B,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QACjD,MAAM,cAAc,GAAG,IAAA,qBAAa,EAAC,cAAI,EAAE,EAAE,CAAC,CAAA;QAE9C,IAAI,IAAI,GAAS,MAAM,cAAc,CAAC,OAAO,CAAC;YAC5C,KAAK,EAAE,EAAE,QAAQ,EAAE;YACnB,SAAS,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC;SAChC,CAAC,CAAA;QAEF,IAAI,CAAC,IAAI,IAAI,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzD,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC;gBAClC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,QAAQ,CAAC,EAAE;gBACjC,SAAS,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC;aAChC,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAA;QACtF,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,oBAAU,CAAC,SAAS,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAA;QACnF,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;QAC1D,CAAC;QAED,qDAAqD;QACrD,MAAM,sBAAsB,GAAa,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QACrF,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAO,EAAE,EAAE,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YAC5F,MAAM,IAAI,KAAK,CAAC,4FAA4F,CAAC,CAAA;QAC/G,CAAC;QAED,2DAA2D;QAC3D,MAAM,IAAA,2CAAqB,EAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAA;QAEvD,OAAO,IAAI,CAAA;IACb,CAAC;IAQK,AAAN,KAAK,CAAC,YAAY,CACoE,QAAgB,EAC7F,OAAwB;QAE/B,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QACpC,MAAM,cAAc,GAAG,IAAA,qBAAa,EAAC,cAAI,EAAE,EAAE,CAAC,CAAA;QAE9C,IAAI,UAAU,GAAS,MAAM,cAAc,CAAC,OAAO,CAAC;YAClD,KAAK,EAAE,EAAE,QAAQ,EAAE;YACnB,SAAS,EAAE,CAAC,SAAS,CAAC;SACvB,CAAC,CAAA;QAEF,IAAI,CAAC,UAAU,IAAI,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/D,UAAU,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC;gBACxC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,QAAQ,CAAC,EAAE;gBACjC,SAAS,EAAE,CAAC,SAAS,CAAC;aACvB,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAA;QACtF,CAAC;QAED,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,UAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;YACpF,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;QACjD,CAAC;QAED,UAAU,CAAC,SAAS,GAAG,CAAC,CAAA;QACxB,UAAU,CAAC,MAAM,GAAG,oBAAU,CAAC,SAAS,CAAA;QAExC,MAAM,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAErC,OAAO,IAAI,CAAA;IACb,CAAC;IAQK,AAAN,KAAK,CAAC,cAAc,CACoE,QAAgB,EAC/F,OAAwB;QAE/B,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QACpC,MAAM,cAAc,GAAG,IAAA,qBAAa,EAAC,cAAI,EAAE,EAAE,CAAC,CAAA;QAE9C,IAAI,UAAU,GAAS,MAAM,cAAc,CAAC,OAAO,CAAC;YAClD,KAAK,EAAE,EAAE,QAAQ,EAAE;YACnB,SAAS,EAAE,CAAC,SAAS,CAAC;SACvB,CAAC,CAAA;QAEF,IAAI,CAAC,UAAU,IAAI,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/D,UAAU,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC;gBACxC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,QAAQ,CAAC,EAAE;gBACjC,SAAS,EAAE,CAAC,SAAS,CAAC;aACvB,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAA;QACtF,CAAC;QAED,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,UAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;YACpF,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;QACjD,CAAC;QAED,sDAAsD;QACtD,IAAI,UAAU,CAAC,QAAQ,IAAI,OAAO,IAAI,CAAC,MAAM,IAAA,mCAAa,EAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;YACpF,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;QACnD,CAAC;QAED,UAAU,CAAC,MAAM,GAAG,oBAAU,CAAC,QAAQ,CAAA;QAEvC,MAAM,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAErC,OAAO,IAAI,CAAA;IACb,CAAC;IAQK,AAAN,KAAK,CAAC,sBAAsB,CACsE,QAAgB,EACzG,OAAwB;QAE/B,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEpC,MAAM,EAAE,eAAe,EAAE,GAAG,YAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QAClD,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;QAC9C,CAAC;QAED,MAAM,cAAc,GAAG,IAAA,qBAAa,EAAC,cAAI,EAAE,EAAE,CAAC,CAAA;QAE9C,IAAI,UAAU,GAAS,MAAM,cAAc,CAAC,OAAO,CAAC;YAClD,KAAK,EAAE,EAAE,QAAQ,EAAE;YACnB,SAAS,EAAE,CAAC,SAAS,CAAC;SACvB,CAAC,CAAA;QAEF,IAAI,CAAC,UAAU,IAAI,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/D,UAAU,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC;gBACxC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,QAAQ,CAAC,EAAE;gBACjC,SAAS,EAAE,CAAC,SAAS,CAAC;aACvB,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAA;QACtF,CAAC;QAED,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,UAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;YACpF,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;QACjD,CAAC;QAED,UAAU,CAAC,IAAI,GAAG,cAAI,CAAC,YAAY,EAAE,CAAA;QACrC,UAAU,CAAC,QAAQ,GAAG,cAAI,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,IAAI,CAAC,CAAA;QAEnE,MAAM,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAErC,OAAO,IAAI,CAAA;IACb,CAAC;IASK,AAAN,KAAK,CAAC,eAAe,CAC2E,QAAgB,EAE9G,cAA2B,EAE3B,aAA0B,EACnB,OAAwB;QAE/B,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QACpC,MAAM,cAAc,GAAG,IAAA,qBAAa,EAAC,cAAI,EAAE,EAAE,CAAC,CAAA;QAE9C,IAAI,IAAI,GAAS,MAAM,cAAc,CAAC,OAAO,CAAC;YAC5C,KAAK,EAAE,EAAE,QAAQ,EAAE;YACnB,SAAS,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC;SAChC,CAAC,CAAA;QAEF,IAAI,CAAC,IAAI,IAAI,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzD,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC;gBAClC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,QAAQ,CAAC,EAAE;gBACjC,SAAS,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC;aAChC,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAA;QACtF,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;QAC1D,CAAC;QAED,qHAAqH;QACrH,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAA,iCAAW,EACvC,IAAI,EACJ,EAAE,GAAG,EAAE,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EACxF,MAAM,EACN,EAAE,EACF,OAAO,CAAC,KAAK,CAAC,IAAI,CACnB,CAAA;QAED,OAAO,KAAK,CAAA;IACd,CAAC;CACF,CAAA;AAliBY,oCAAY;AAOjB;IANL,IAAA,wBAAS,EAAC,+EAA+E,CAAC;IAC1F,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,cAAI,EAAE;QACzB,WAAW,EACT,+HAA+H;KAClI,CAAC;IAEC,mBAAA,IAAA,kBAAG,EAAC,MAAM,EAAE,EAAE,WAAW,EAAE,mDAAmD,EAAE,CAAC,CAAA;IACjF,mBAAA,IAAA,kBAAG,GAAE,CAAA;;6CADmF,uBAAO;;8CAkDjG;AAQK;IANL,IAAA,wBAAS,EAAC,+EAA+E,CAAC;IAC1F,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,cAAI,EAAE;QACzB,WAAW,EACT,+HAA+H;KAClI,CAAC;IAEC,mBAAA,IAAA,kBAAG,EAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,qCAAmB,EAAE,EAAE,WAAW,EAAE,0CAA0C,EAAE,CAAC,CAAA;IAEtG,mBAAA,IAAA,kBAAG,EAAC,OAAO,EAAE,EAAE,WAAW,EAAE,kDAAkD,EAAE,CAAC,CAAA;IACjF,mBAAA,IAAA,kBAAG,GAAE,CAAA;;qDADoF,yBAAS;;8CA0BpG;AAQK;IANL,IAAA,wBAAS,EAAC,+EAA+E,CAAC;IAC1F,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,CAAC,cAAI,CAAC,EAAE;QAC3B,WAAW,EACT,kHAAkH;KACrH,CAAC;IAEC,mBAAA,IAAA,kBAAG,EAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,yBAAS,CAAC,EAAE,EAAE,WAAW,EAAE,yDAAyD,EAAE,CAAC,CAAA;IAE/G,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;sDAyFP;AAQK;IANL,IAAA,wBAAS,EAAC,+EAA+E,CAAC;IAC1F,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE;QAC5B,WAAW,EACT,mIAAmI;KACtI,CAAC;IAEC,mBAAA,IAAA,kBAAG,EAAC,UAAU,EAAE,EAAE,WAAW,EAAE,qCAAqC,EAAE,CAAC,CAAA;IACvE,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;8CAOP;AAQK;IANL,IAAA,wBAAS,EAAC,+EAA+E,CAAC;IAC1F,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE;QAC5B,WAAW,EACT,uHAAuH;KAC1H,CAAC;IAEC,mBAAA,IAAA,kBAAG,EAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,kCAAkC,EAAE,CAAC,CAAA;IACvF,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;+CAMP;AAQK;IANL,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,wBAAS,EAAC,+EAA+E,CAAC;IAC1F,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE;QAC5B,WAAW,EACT,uIAAuI;KAC1I,CAAC;IAEC,mBAAA,IAAA,kBAAG,EAAC,UAAU,EAAE,EAAE,WAAW,EAAE,8CAA8C,EAAE,CAAC,CAAA;IAChF,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;8CA8BP;AAQK;IANL,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,wBAAS,EAAC,+EAA+E,CAAC;IAC1F,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE;QAC5B,WAAW,EACT,0IAA0I;KAC7I,CAAC;IAEC,mBAAA,IAAA,kBAAG,EAAC,UAAU,EAAE,EAAE,WAAW,EAAE,8DAA8D,EAAE,CAAC,CAAA;IAChG,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;oDAmCP;AAQK;IANL,IAAA,wBAAS,EAAC,8DAA8D,CAAC;IACzE,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE;QAC5B,WAAW,EACT,+HAA+H;KAClI,CAAC;IAEC,mBAAA,IAAA,kBAAG,EAAC,UAAU,EAAE,EAAE,WAAW,EAAE,6DAA6D,EAAE,CAAC,CAAA;IAC/F,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;iDAuCP;AAQK;IANL,IAAA,wBAAS,EAAC,+EAA+E,CAAC;IAC1F,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE;QAC5B,WAAW,EACT,iHAAiH;KACpH,CAAC;IAEC,mBAAA,IAAA,kBAAG,EAAC,UAAU,EAAE,EAAE,WAAW,EAAE,gDAAgD,EAAE,CAAC,CAAA;IAClF,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;gDA+BP;AAQK;IANL,IAAA,wBAAS,EAAC,+EAA+E,CAAC;IAC1F,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE;QAC5B,WAAW,EACT,sHAAsH;KACzH,CAAC;IAEC,mBAAA,IAAA,kBAAG,EAAC,UAAU,EAAE,EAAE,WAAW,EAAE,kDAAkD,EAAE,CAAC,CAAA;IACpF,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;kDAmCP;AAQK;IANL,IAAA,wBAAS,EAAC,+EAA+E,CAAC;IAC1F,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE;QAC5B,WAAW,EACT,gIAAgI;KACnI,CAAC;IAEC,mBAAA,IAAA,kBAAG,EAAC,UAAU,EAAE,EAAE,WAAW,EAAE,4DAA4D,EAAE,CAAC,CAAA;IAC9F,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;0DAqCP;AASK;IAPL,IAAA,wBAAS,EAAC,+EAA+E,CAAC;IAC1F,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,4BAAa,EAAC,qBAAa,CAAC;IAC5B,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,cAAI,EAAE;QACzB,WAAW,EACT,2GAA2G;KAC9G,CAAC;IAEC,mBAAA,IAAA,kBAAG,EAAC,UAAU,EAAE,EAAE,WAAW,EAAE,0DAA0D,EAAE,CAAC,CAAA;IAC5F,mBAAA,IAAA,kBAAG,EAAC,gBAAgB,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,iBAAS,CAAC,EAAE,EAAE,WAAW,EAAE,qDAAqD,EAAE,CAAC,CAAA;IAElH,mBAAA,IAAA,kBAAG,EAAC,eAAe,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,iBAAS,CAAC,EAAE,EAAE,WAAW,EAAE,+CAA+C,EAAE,CAAC,CAAA;IAE3G,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;mDAmCP;uBAjiBU,YAAY;IADxB,IAAA,uBAAQ,EAAC,cAAI,CAAC;GACF,YAAY,CAkiBxB","sourcesContent":["import { Arg, Ctx, Directive, Mutation, Resolver, UseMiddleware } from 'type-graphql'\nimport { GraphQLEmailAddress } from 'graphql-scalars'\nimport { ILike, In, SelectQueryBuilder, EntityManager } from 'typeorm'\n\nimport { config } from '@things-factory/env'\nimport { Domain, getRepository, ObjectRef, SpeakRefusals } from '@things-factory/shell'\n\nimport { deleteUser as commonDeleteUser, deleteUsers as commonDeleteUsers } from '../../controllers/delete-user.js'\nimport { assignRoles } from '../../utils/assignable-roles.js'\nimport { buildDomainUsersQueryBuilder } from '../../utils/get-domain-users.js'\nimport { isDomainOwner, setPrimaryDomainOwner } from '../../utils/domain-ownership.js'\nimport { Role } from '../role/role.js'\nimport { User, UserStatus } from './user.js'\nimport { NewUser, UserPatch } from './user-types.js'\nimport { USERNAME_ALREADY_EXISTS, EMAIL_ALREADY_EXISTS, USERNAME_INVALID } from '../../constants/error-code.js'\n\n@Resolver(User)\nexport class UserMutation {\n  @Directive('@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true)')\n  @Directive('@transaction')\n  @Mutation(returns => User, {\n    description:\n      'Creates a new user in the system. Use this mutation to register a user with the specified credentials and domain information.'\n  })\n  async createUser(\n    @Arg('user', { description: 'The input object containing new user information.' }) user: NewUser,\n    @Ctx() context: ResolverContext\n  ) {\n    const { domain, tx } = context.state\n    const { defaultPassword } = config.get('password')\n    const { username, email } = user\n    const userRepository = getRepository(User, tx)\n\n    user.username = username.trim()\n    user.email = email.trim()\n\n    if (await userRepository.findOne({ where: { username: user.username } })) {\n      throw new Error(context.t('error.' + USERNAME_ALREADY_EXISTS))\n    }\n\n    if (await userRepository.findOne({ where: { email: ILike(user.email) } })) {\n      throw new Error(context.t('error.' + EMAIL_ALREADY_EXISTS))\n    }\n\n    if (!user.password && !defaultPassword) {\n      throw new Error('initial password or default password should be supported.')\n    }\n\n    // TODO username은 다음 패턴을 따라야 한다. pattern=\"^[A-Za-z0-9._@-]+$\"\n    if (!/^[A-Za-z0-9._@-]+$/.test(user.username)) {\n      throw new Error(context.t('error.' + USERNAME_INVALID, { username: user.username }))\n    }\n\n    // consider if validation password rule is required\n    /* check if password is following the rule */\n    // User.validatePasswordByRule(user.password, context.lng)\n\n    const salt = User.generateSalt()\n\n    return await userRepository.save({\n      creator: context.state.user,\n      updater: context.state.user,\n      ...user,\n      domains: [domain],\n      roles:\n        user.roles && user.roles.length\n          ? await getRepository(Role, tx).findBy({\n              id: In(user.roles.map(role => role.id)),\n              domain: { id: domain.id }\n            })\n          : [],\n      salt,\n      passwordUpdatedAt: new Date(),\n      password: user.password ? User.encode(user.password, salt) : User.encode(defaultPassword, salt)\n    })\n  }\n\n  @Directive('@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true)')\n  @Directive('@transaction')\n  @Mutation(returns => User, {\n    description:\n      'Updates the information of an existing user. Use this mutation to modify user profile details, such as name, email, or roles.'\n  })\n  async updateUser(\n    @Arg('email', type => GraphQLEmailAddress, { description: 'The email address of the user to update.' })\n    email: string,\n    @Arg('patch', { description: 'The patch object containing updated user fields.' }) patch: UserPatch,\n    @Ctx() context: ResolverContext\n  ) {\n    const { domain, user: updater, tx }: { domain: Domain; user: User; tx?: EntityManager } = context.state\n    const qb: SelectQueryBuilder<User> = buildDomainUsersQueryBuilder(domain.id, 'USER')\n    const user: User = await qb\n      .andWhere('LOWER(USER.email) = :email', { email: email?.toLowerCase().trim() || '' })\n      .leftJoinAndSelect('USER.roles', 'ROLES')\n      .leftJoinAndSelect('ROLES.domain', 'R_DOMAIN')\n      .getOne()\n\n    if (patch.roles) {\n      patch.roles = await getRepository(Role, tx).find({\n        where: { id: In(patch.roles.map((r: Partial<Role>) => r.id)) }\n      })\n    }\n\n    if (patch.status && patch.status === 'activated') {\n      user.status = UserStatus.ACTIVATED\n    }\n\n    return await getRepository(User, tx).save({\n      ...user,\n      ...patch,\n      updater\n    } as any)\n  }\n\n  @Directive('@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true)')\n  @Directive('@transaction')\n  @Mutation(returns => [User], {\n    description:\n      'Updates or creates multiple users in a single operation. Use this mutation for batch processing of user records.'\n  })\n  async updateMultipleUser(\n    @Arg('patches', type => [UserPatch], { description: 'An array of patch objects for batch update or creation.' })\n    patches: UserPatch[],\n    @Ctx() context: ResolverContext\n  ) {\n    const { domain, user, tx } = context.state\n    const userRepo = getRepository(User, tx)\n\n    let results = []\n    const _createRecords = patches.filter((patch: any) => patch.cuFlag.toUpperCase() === '+')\n    const _updateRecords = patches.filter((patch: any) => patch.cuFlag.toUpperCase() === 'M')\n\n    if (_createRecords.length > 0) {\n      for (let i = 0; i < _createRecords.length; i++) {\n        const newRecord = _createRecords[i]\n\n        // consider if validation password rule is required\n        /* check if password is following the rule */\n        // User.validatePasswordByRule(newRecord.password, context.lng)\n\n        const salt = User.generateSalt()\n        const result = await userRepo.save({\n          ...(newRecord as any),\n          domains: [domain],\n          salt,\n          password: User.encode(newRecord.password, salt),\n          passwordUpdatedAt: new Date(),\n          creator: user,\n          updater: user\n        })\n\n        // repository api는 작동하지 않음.\n        // await tx\n        //   .createQueryBuilder()\n        //   .insert()\n        //   .into('users_domains')\n        //   .values({\n        //     usersId: result.id,\n        //     domainsId: domain.id\n        //   })\n        //   .execute()\n\n        results.push({ ...result, cuFlag: '+' })\n      }\n    }\n\n    if (_updateRecords.length > 0) {\n      for (let i = 0; i < _updateRecords.length; i++) {\n        const updateRecord = _updateRecords[i]\n        // consider if validation password rule is required\n        /* check if password is following the rule */\n        // User.validatePasswordByRule(updateRecord.password, context.lng)\n\n        const user = await userRepo.findOne({ where: { id: updateRecord.id }, relations: ['domains'] })\n        var domains = user.domains.find(d => d.id === domain.id) ? user.domains : [...user.domains, domain]\n\n        const result = await userRepo.save({\n          ...user,\n          ...(updateRecord as any),\n          domains,\n          password: updateRecord.password ? User.encode(updateRecord.password, user.salt) : user.password,\n          updater: user\n        })\n\n        if (!updateRecord.status) {\n          continue\n        }\n\n        // const domain = await user.domain\n        // if (!domain) {\n        //   continue\n        // }\n\n        // const domainId = domain.id\n        // const domains = await user.domains\n        // if (!domains.find(domain => domain.id == domainId)) {\n        //   await tx\n        //     .createQueryBuilder()\n        //     .insert()\n        //     .into('users_domains')\n        //     .values({\n        //       usersId: user.id,\n        //       domainsId: domain.id\n        //     })\n        //     .execute()\n        // }\n\n        results.push({ ...result, cuFlag: 'M' })\n      }\n    }\n\n    return results\n  }\n\n  @Directive('@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true)')\n  @Directive('@transaction')\n  @Mutation(returns => Boolean, {\n    description:\n      'Deletes a user from the system by their username. Use this mutation to permanently remove a user account and revoke their access.'\n  })\n  async deleteUser(\n    @Arg('username', { description: 'The username of the user to delete.' }) username: string,\n    @Ctx() context: ResolverContext\n  ) {\n    const { tx } = context.state\n\n    await commonDeleteUser({ username }, tx)\n\n    return true\n  }\n\n  @Directive('@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true)')\n  @Directive('@transaction')\n  @Mutation(returns => Boolean, {\n    description:\n      'Deletes multiple users from the system by their usernames. Use this mutation to remove several user accounts at once.'\n  })\n  async deleteUsers(\n    @Arg('usernames', type => [String], { description: 'An array of usernames to delete.' }) usernames: string[],\n    @Ctx() context: ResolverContext\n  ) {\n    const { tx } = context.state\n    await commonDeleteUsers({ usernames }, tx)\n\n    return true\n  }\n\n  @Directive('@transaction')\n  @Directive('@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true)')\n  @Mutation(returns => Boolean, {\n    description:\n      'Invites an existing user to join the current domain. Use this mutation to add a user to a domain if they already exist in the system.'\n  })\n  async inviteUser(\n    @Arg('username', { description: 'The username or email of the user to invite.' }) username: string,\n    @Ctx() context: ResolverContext\n  ): Promise<boolean> {\n    const { domain, tx } = context.state\n    const userRepository = getRepository(User, tx)\n\n    var invitee: User = await userRepository.findOne({\n      where: { username },\n      relations: ['domains']\n    })\n\n    if (!invitee && /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(username)) {\n      invitee = await userRepository.findOne({\n        where: { email: ILike(username) },\n        relations: ['domains']\n      })\n    }\n\n    if (!invitee) {\n      throw new Error(context.t('error.failed to find x', { x: context.t('field.user') }))\n    }\n\n    const existingDomains: Domain[] = invitee.domains\n    if (existingDomains.find((d: Domain) => d.id === domain.id)) {\n      throw new Error(context.t('error.x already exists in y', { x: context.t('field.user'), y: domain.name }))\n    }\n\n    invitee.domains = [...existingDomains, domain]\n    await userRepository.save(invitee)\n\n    return true\n  }\n\n  @Directive('@transaction')\n  @Directive('@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true)')\n  @Mutation(returns => Boolean, {\n    description:\n      \"Removes a user from the current domain. Use this mutation to revoke a user's access to a specific domain without deleting their account.\"\n  })\n  async deleteDomainUser(\n    @Arg('username', { description: 'The username or email of the user to remove from the domain.' }) username: string,\n    @Ctx() context: ResolverContext\n  ): Promise<boolean> {\n    const { tx, domain } = context.state\n    const userRepository = getRepository(User, tx)\n\n    var user: User = await userRepository.findOne({\n      where: { username },\n      relations: ['domains', 'roles']\n    })\n\n    if (!user && /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(username)) {\n      user = await userRepository.findOne({\n        where: { email: ILike(username) },\n        relations: ['domains', 'roles']\n      })\n    }\n\n    if (!user) {\n      throw new Error(context.t('error.failed to find x', { x: context.t('field.user') }))\n    }\n\n    const targetDomainIdx: number = user.domains.findIndex((userDomain: Domain) => userDomain.id === domain.id)\n    if (targetDomainIdx < 0) {\n      throw new Error(context.t('error.x is not a member of y', { x: user.name, y: domain.name }))\n    }\n\n    // Remove domain relation with user\n    user.domains.splice(targetDomainIdx, 1)\n\n    // Remove domain's roles that user has\n    user.roles = user.roles.filter((role: Role) => role.domainId !== domain.id)\n\n    await userRepository.save(user)\n\n    return true\n  }\n\n  @Directive('@privilege(domainOwnerGranted: true, superUserGranted: true)')\n  @Directive('@transaction')\n  @Mutation(returns => Boolean, {\n    description:\n      'Transfers domain ownership to another user. Use this mutation to assign the owner role to a different user within the domain.'\n  })\n  async transferOwner(\n    @Arg('username', { description: 'The username or email of the user to transfer ownership to.' }) username: string,\n    @Ctx() context: ResolverContext\n  ): Promise<boolean> {\n    const { domain, tx, user: actor } = context.state\n    const userRepository = getRepository(User, tx)\n\n    var user: User = await userRepository.findOne({\n      where: { username },\n      relations: ['domains', 'roles']\n    })\n\n    if (!user && /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(username)) {\n      user = await userRepository.findOne({\n        where: { email: ILike(username) },\n        relations: ['domains', 'roles']\n      })\n    }\n\n    if (!user) {\n      throw new Error(context.t('error.failed to find x', { x: context.t('field.user') }))\n    }\n\n    if (user.status !== UserStatus.ACTIVATED) {\n      throw new Error('Only activated users are eligible to receive admin privileges.')\n    }\n\n    if (user.domains.map((d: Domain) => d.id).indexOf(domain.id) < 0) {\n      throw new Error(`User is not belongs to current domain`)\n    }\n\n    /* 역할은 부모 도메인으로부터 상속될 수 있으므로 부여된 상속 역할도 자격으로 인정한다. */\n    const grantableRoleDomainIds: string[] = [domain.id, domain.parentId].filter(Boolean)\n    if (user.roles.filter((r: Role) => grantableRoleDomainIds.includes(r.domainId)).length == 0) {\n      throw new Error(`Only users with at least one role in this domain are eligible to receive admin privileges.`)\n    }\n\n    /* 대표 오너 컬럼과 `DomainOwner` 테이블을 함께 갱신한다 (기존 오너 엔트리는 유지). */\n    await setPrimaryDomainOwner(domain, user.id, actor, tx)\n\n    return true\n  }\n\n  @Directive('@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true)')\n  @Directive('@transaction')\n  @Mutation(returns => Boolean, {\n    description:\n      'Activates a user account in the current domain. Use this mutation to enable a user who was previously inactive.'\n  })\n  async activateUser(\n    @Arg('username', { description: 'The username or email of the user to activate.' }) username: string,\n    @Ctx() context: ResolverContext\n  ): Promise<boolean> {\n    const { tx, domain } = context.state\n    const userRepository = getRepository(User, tx)\n\n    var targetUser: User = await userRepository.findOne({\n      where: { username },\n      relations: ['domains']\n    })\n\n    if (!targetUser && /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(username)) {\n      targetUser = await userRepository.findOne({\n        where: { email: ILike(username) },\n        relations: ['domains']\n      })\n    }\n\n    if (!targetUser) {\n      throw new Error(context.t('error.failed to find x', { x: context.t('field.user') }))\n    }\n\n    if (!targetUser?.domains?.find((userDomain: Domain) => userDomain.id === domain.id)) {\n      throw new Error('User is not belong to domain')\n    }\n\n    targetUser.failCount = 0\n    targetUser.status = UserStatus.ACTIVATED\n\n    await userRepository.save(targetUser)\n\n    return true\n  }\n\n  @Directive('@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true)')\n  @Directive('@transaction')\n  @Mutation(returns => Boolean, {\n    description:\n      'Inactivates a user account in the current domain. Use this mutation to disable a user, making them unable to log in.'\n  })\n  async inactivateUser(\n    @Arg('username', { description: 'The username or email of the user to inactivate.' }) username: string,\n    @Ctx() context: ResolverContext\n  ): Promise<boolean> {\n    const { tx, domain } = context.state\n    const userRepository = getRepository(User, tx)\n\n    var targetUser: User = await userRepository.findOne({\n      where: { username },\n      relations: ['domains']\n    })\n\n    if (!targetUser && /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(username)) {\n      targetUser = await userRepository.findOne({\n        where: { email: ILike(username) },\n        relations: ['domains']\n      })\n    }\n\n    if (!targetUser) {\n      throw new Error(context.t('error.failed to find x', { x: context.t('field.user') }))\n    }\n\n    if (!targetUser?.domains?.find((userDomain: Domain) => userDomain.id === domain.id)) {\n      throw new Error('User is not belong to domain')\n    }\n\n    /* 공동 오너(`DomainOwner` 테이블)도 도메인 관리자이므로 같은 보호를 받는다. */\n    if (targetUser.userType == 'admin' || (await isDomainOwner(domain, targetUser, tx))) {\n      throw new Error('Admin deactivation not allowed')\n    }\n\n    targetUser.status = UserStatus.INACTIVE\n\n    await userRepository.save(targetUser)\n\n    return true\n  }\n\n  @Directive('@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true)')\n  @Directive('@transaction')\n  @Mutation(returns => Boolean, {\n    description:\n      \"Resets a user's password to the default value. Use this mutation to restore access to a user who has forgotten their password.\"\n  })\n  async resetPasswordToDefault(\n    @Arg('username', { description: 'The username or email of the user whose password to reset.' }) username: string,\n    @Ctx() context: ResolverContext\n  ): Promise<boolean> {\n    const { tx, domain } = context.state\n\n    const { defaultPassword } = config.get('password')\n    if (!defaultPassword) {\n      throw new Error('No default password found')\n    }\n\n    const userRepository = getRepository(User, tx)\n\n    var targetUser: User = await userRepository.findOne({\n      where: { username },\n      relations: ['domains']\n    })\n\n    if (!targetUser && /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(username)) {\n      targetUser = await userRepository.findOne({\n        where: { email: ILike(username) },\n        relations: ['domains']\n      })\n    }\n\n    if (!targetUser) {\n      throw new Error(context.t('error.failed to find x', { x: context.t('field.user') }))\n    }\n\n    if (!targetUser?.domains?.find((userDomain: Domain) => userDomain.id === domain.id)) {\n      throw new Error('User is not belong to domain')\n    }\n\n    targetUser.salt = User.generateSalt()\n    targetUser.password = User.encode(defaultPassword, targetUser.salt)\n\n    await userRepository.save(targetUser)\n\n    return true\n  }\n\n  @Directive('@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true)')\n  @Directive('@transaction')\n  @UseMiddleware(SpeakRefusals)\n  @Mutation(returns => User, {\n    description:\n      \"Updates the roles assigned to a user. Use this mutation to change a user's permissions within the domain.\"\n  })\n  async updateUserRoles(\n    @Arg('username', { description: 'The username or email of the user whose roles to update.' }) username: string,\n    @Arg('availableRoles', type => [ObjectRef], { description: 'The list of roles that can be assigned to the user.' })\n    availableRoles: ObjectRef[],\n    @Arg('selectedRoles', type => [ObjectRef], { description: 'The list of roles to be assigned to the user.' })\n    selectedRoles: ObjectRef[],\n    @Ctx() context: ResolverContext\n  ) {\n    const { domain, tx } = context.state\n    const userRepository = getRepository(User, tx)\n\n    var user: User = await userRepository.findOne({\n      where: { username },\n      relations: ['domains', 'roles']\n    })\n\n    if (!user && /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(username)) {\n      user = await userRepository.findOne({\n        where: { email: ILike(username) },\n        relations: ['domains', 'roles']\n      })\n    }\n\n    if (!user) {\n      throw new Error(context.t('error.failed to find x', { x: context.t('field.user') }))\n    }\n\n    if (user.domains.map((d: Domain) => d.id).indexOf(domain.id) < 0) {\n      throw new Error(`User is not belongs to current domain`)\n    }\n\n    /* Found again in this domain's scope - the ids are the client's (utils/assignable-roles.ts, ADR-0103 decision 2). */\n    const { user: saved } = await assignRoles(\n      user,\n      { add: selectedRoles.map(role => role.id), remove: availableRoles.map(role => role.id) },\n      domain,\n      tx,\n      context.state.user\n    )\n\n    return saved\n  }\n}\n"]}