@webda/core 4.0.0-beta.2 → 4.0.0-beta.4

package/lib/services/audit.model.js

@@ -0,0 +1,432 @@
+import { WEBDA_STORAGE } from "@webda/models";
+import { useCoreEvents } from "../events/events.js";
+import { Service } from "../services/service.js";
+import { ServiceParameters } from "./serviceparameters.js";
+import { CoreModel } from "../models/coremodel.model.js";
+import { escape, parse, QueryValidator } from "@webda/ql";
+import * as WebdaError from "../errors/errors.js";
+import { useApplication, useModel } from "../application/hooks.js";
+import { useModelMetadata } from "../core/hooks.js";
+import { useContext } from "../contexts/execution.js";
+import { hasSchema, registerSchema } from "../schemas/hooks.js";
+import { parseSubjectKey, registerOperation, serializeSubjectKey } from "../core/operations.js";
+/**
+ * Represents a single audit log entry
+ */
+export class AuditEntry extends CoreModel {
+    operationId;
+    success;
+    error;
+    userId;
+    /**
+     * Identifier of the model the operation targeted, e.g. `WebdaSample/Post`
+     */
+    subjectModel;
+    /**
+     * Canonical primary key of the targeted object (see `serializeSubjectKey`)
+     */
+    subjectKey;
+    get timestamp() {
+        return this[WEBDA_STORAGE]["timestamp"];
+    }
+    set timestamp(value) {
+        this[WEBDA_STORAGE]["timestamp"] = value !== undefined && value !== null ? new Date(value) : value;
+    }
+    /** Generated by @webda/content-mapper: include values held in WEBDA_STORAGE. */
+    toJSON() {
+        const parent = super.toJSON ? super.toJSON() : {};
+        const result = parent === this ? {} : parent;
+        for (const key of Object.keys(this)) {
+            result[key] = this[key];
+        }
+        Object.assign(result, this[WEBDA_STORAGE]);
+        return result;
+    }
+}
+/**
+ * Parameters for the AuditService
+ */
+export class AuditServiceParameters extends ServiceParameters {
+    /**
+     * List of operations to include/exclude.
+     * Supports wildcards and negation: ["*", "!User.Delete"]
+     * @default ["*"]
+     */
+    operations;
+    /**
+     * Audit level filter:
+     *  - "all"     — audit everything (default)
+     *  - "write"   — everything except read operations (Get, List, Query)
+     *  - "failure" — only failed operations
+     * @default "all"
+     */
+    level;
+    /**
+     * WebdaQL query evaluated against the session, required for global (`Audit.Query`)
+     * and other-user (`Audit.Actor`) reads, and for the history of an object that no
+     * longer exists. Unset means nobody.
+     * @example "roles CONTAINS 'admin'"
+     */
+    readPermission;
+    /**
+     * Register the `Audit.Subject`, `Audit.Actor` and `Audit.Query` operations, which
+     * the REST/GraphQL transports then expose. Off by default so adding the service
+     * never publishes the audit trail by surprise.
+     * @default false
+     */
+    exposeReadOperations;
+    /**
+     * Parsed exclude list
+     * @SchemaIgnore
+     */
+    excludedOperations;
+    /**
+     * Load parameters and parse include/exclude lists
+     * @param params - the service parameters
+     * @returns this for chaining
+     */
+    load(params = {}) {
+        super.load(params);
+        this.level ??= "all";
+        this.operations ??= ["*"];
+        if (this.operations.some(i => i.startsWith("!"))) {
+            this.excludedOperations = this.operations.filter(i => i.startsWith("!")).map(i => i.substring(1));
+            this.operations = this.operations.filter(i => !i.startsWith("!"));
+            if (this.operations.length === 0) {
+                this.operations = ["*"];
+            }
+        }
+        this.excludedOperations ??= [];
+        return this;
+    }
+    /**
+     * Check if an operation matches a pattern (supports trailing wildcard)
+     * @param operationId - the operation identifier
+     * @param pattern - the pattern to match against
+     * @returns true if the operation matches the pattern
+     */
+    matchesPattern(operationId, pattern) {
+        if (pattern === "*")
+            return true;
+        if (pattern.endsWith(".*")) {
+            return operationId.startsWith(pattern.slice(0, -1));
+        }
+        return operationId === pattern;
+    }
+    /**
+     * Check if an operation is included by this configuration
+     * @param operationId - the operation identifier
+     * @returns true if the operation is included
+     */
+    isIncluded(operationId) {
+        if (this.excludedOperations.some(p => this.matchesPattern(operationId, p))) {
+            return false;
+        }
+        return this.operations.some(p => this.matchesPattern(operationId, p));
+    }
+}
+/**
+ * Read-only operation suffixes excluded from "write" level auditing
+ */
+const READ_SUFFIXES = ["Get", "List", "Query"];
+/**
+ * The audit log's own read operations, treated as reads by the "write" level
+ */
+const AUDIT_READ_OPERATIONS = ["Audit.Subject", "Audit.Actor", "Audit.Query"];
+/**
+ * Page size of the audit read operations
+ */
+const DEFAULT_PAGE_SIZE = 50;
+const MAX_PAGE_SIZE = 200;
+/**
+ * Pagination properties shared by the read operation requests
+ */
+const PAGINATION_PROPERTIES = {
+    limit: { type: "number" },
+    continuationToken: { type: "string" }
+};
+/**
+ * Request schemas of the read operations, registered in resolve()
+ */
+const AUDIT_SCHEMAS = {
+    auditSubjectRequest: {
+        type: "object",
+        properties: { model: { type: "string" }, key: { type: ["string", "number", "object"] }, ...PAGINATION_PROPERTIES },
+        required: ["model", "key"]
+    },
+    auditActorRequest: {
+        type: "object",
+        properties: { userId: { type: "string" }, ...PAGINATION_PROPERTIES }
+    },
+    auditQueryRequest: {
+        type: "object",
+        properties: { q: { type: "string" }, ...PAGINATION_PROPERTIES }
+    }
+};
+/**
+ * @WebdaModda AuditService
+ *
+ * Service that listens to operation success/failure events and records audit entries.
+ * Entries are kept in memory (accessible via getEntries()) and saved through the
+ * AuditEntry repository (the store the AuditEntry model is mapped to, the default
+ * store otherwise).
+ *
+ * With `exposeReadOperations: true` it also registers the read operations
+ * `Audit.Subject` (history of an object), `Audit.Actor` (activity of a user) and
+ * `Audit.Query` (whole log), guarded by the object's `canAct("audit")` or the
+ * `readPermission` parameter.
+ */
+export class AuditService extends Service {
+    /**
+     * In-memory log of audit entries
+     */
+    entries = [];
+    /**
+     * Parsed readPermission
+     */
+    readPermissionQuery;
+    /**
+     * Unsubscribe functions of the core event listeners
+     */
+    unsubscribers = [];
+    /**
+     * Remove the core event listeners
+     */
+    unsubscribe() {
+        for (const off of this.unsubscribers.splice(0)) {
+            off();
+        }
+    }
+    /**
+     * Stop recording audit entries
+     */
+    async stop() {
+        this.unsubscribe();
+        await super.stop();
+    }
+    /**
+     * Subscribe to operation success and failure events for audit logging
+     * @returns this for chaining
+     */
+    resolve() {
+        super.resolve();
+        this.unsubscribe();
+        this.unsubscribers.push(useCoreEvents("Webda.OperationFailure", async (evt) => {
+            await this.addAuditEntry(evt.operationId, evt.context.getCurrentUserId(), evt.error, evt.subject);
+        }), useCoreEvents("Webda.OperationSuccess", async (evt) => {
+            await this.addAuditEntry(evt.operationId, evt.context.getCurrentUserId(), undefined, evt.subject);
+        }));
+        if (this.parameters.exposeReadOperations) {
+            this.registerReadOperations();
+        }
+        return this;
+    }
+    /**
+     * Get all in-memory audit entries
+     * @returns the list of audit entries
+     */
+    getEntries() {
+        return this.entries;
+    }
+    /**
+     * Determine whether the given operation should be audited
+     * based on include/exclude filters and level configuration.
+     * @param operationId - the operation identifier
+     * @param success - whether the operation succeeded
+     * @returns true if this operation should be audited
+     */
+    shouldAudit(operationId, success) {
+        // Check include/exclude filter
+        if (!this.parameters.isIncluded(operationId)) {
+            return false;
+        }
+        // Check level filter
+        const level = this.parameters.level ?? "all";
+        if (level === "failure") {
+            return !success;
+        }
+        if (level === "write") {
+            const suffix = operationId.split(".").pop() ?? "";
+            return !READ_SUFFIXES.includes(suffix) && !AUDIT_READ_OPERATIONS.includes(operationId);
+        }
+        return true;
+    }
+    /**
+     * Create and store an audit entry for the given operation context and optional error
+     * @param operationId - the operation identifier
+     * @param userId - the user identifier (may be undefined for anonymous)
+     * @param err - the error if the operation failed
+     * @param subject - the object the operation targeted, if any
+     */
+    async addAuditEntry(operationId, userId, err, subject) {
+        const success = err === undefined;
+        if (!this.shouldAudit(operationId, success)) {
+            return;
+        }
+        const entry = new AuditEntry();
+        entry.operationId = operationId;
+        entry.success = success;
+        entry.userId = userId;
+        entry.timestamp = new Date();
+        entry.subjectModel = subject?.model;
+        entry.subjectKey = subject?.key;
+        if (err) {
+            entry.error = err.message;
+        }
+        this.entries.push(entry);
+        await entry.save();
+    }
+    /**
+     * Register the request schemas and the Audit.Subject / Audit.Actor / Audit.Query operations
+     */
+    registerReadOperations() {
+        const appSchemas = useApplication().getSchemas();
+        for (const [name, schema] of Object.entries(AUDIT_SCHEMAS)) {
+            if (!hasSchema(name)) {
+                registerSchema(name, schema);
+            }
+            appSchemas[name] ??= schema;
+        }
+        const service = this.getName();
+        registerOperation("Audit.Subject", {
+            service,
+            method: "subjectEntries",
+            input: "auditSubjectRequest",
+            summary: "Audit entries of an object",
+            tags: ["Audit"]
+        });
+        registerOperation("Audit.Actor", {
+            service,
+            method: "actorEntries",
+            input: "auditActorRequest",
+            summary: "Audit entries of a user",
+            tags: ["Audit"]
+        });
+        registerOperation("Audit.Query", {
+            service,
+            method: "queryEntries",
+            input: "auditQueryRequest",
+            summary: "Query the audit log",
+            tags: ["Audit"]
+        });
+    }
+    /**
+     * Check the readPermission query against the current session
+     * @param context - the operation context
+     * @returns true if the session matches readPermission
+     */
+    hasReadPermission(context) {
+        if (!this.parameters.readPermission) {
+            return false;
+        }
+        this.readPermissionQuery ??= new QueryValidator(this.parameters.readPermission);
+        return this.readPermissionQuery.eval(context.getSession() ?? {});
+    }
+    /**
+     * Query the audit entries matching a filter, newest first
+     * @param filter - WebdaQL filter (may be empty)
+     * @param limit - page size, clamped to 1..200 (default 50)
+     * @param continuationToken - token of the previous page
+     * @returns the page of entries
+     */
+    async findEntries(filter, limit, continuationToken) {
+        const pageSize = Math.min(Math.max(Math.floor(Number(limit)) || DEFAULT_PAGE_SIZE, 1), MAX_PAGE_SIZE);
+        let query = `${filter} ORDER BY timestamp DESC LIMIT ${pageSize}`;
+        if (continuationToken) {
+            query += escape([" OFFSET ", ""], [continuationToken]);
+        }
+        const res = await AuditEntry.query(query);
+        return { results: res.results, continuationToken: res.continuationToken || undefined };
+    }
+    /**
+     * Audit entries of one object (`Audit.Subject`)
+     *
+     * Allowed when `subject.canAct(context, "audit")` is true. When the object does not
+     * exist (deleted or never created), `readPermission` is required, otherwise 404.
+     * @param model - model identifier, e.g. `WebdaSample/Post`
+     * @param key - primary key: scalar, object of key fields, or canonical JSON array
+     * @param limit - page size
+     * @param continuationToken - token of the previous page
+     * @returns the page of entries
+     */
+    async subjectEntries(model, key, limit, continuationToken) {
+        const context = useContext();
+        let modelClass;
+        try {
+            modelClass = useModel(model);
+        }
+        catch {
+            throw new WebdaError.NotFound("Object not found");
+        }
+        const modelId = useApplication().getModelId(modelClass);
+        if (!modelId) {
+            throw new WebdaError.NotFound("Object not found");
+        }
+        const pkFields = useModelMetadata(modelClass)?.PrimaryKey ?? ["uuid"];
+        const ref = parseSubjectKey(pkFields, key);
+        if (ref === undefined) {
+            throw new WebdaError.BadRequest("Invalid subject key");
+        }
+        let instance;
+        try {
+            instance = await modelClass.ref(ref).get();
+        }
+        catch {
+            // Repositories throw when the object does not exist
+        }
+        if (instance && !instance.isDeleted?.()) {
+            const allowed = typeof instance.canAct === "function" ? await instance.canAct(context, "audit") : false;
+            if (allowed !== true) {
+                throw new WebdaError.Forbidden(typeof allowed === "string" ? allowed : "Audit not allowed");
+            }
+        }
+        else if (!this.hasReadPermission(context)) {
+            throw new WebdaError.NotFound("Object not found");
+        }
+        return this.findEntries(escape(["subjectModel = ", " AND subjectKey = ", ""], [modelId, serializeSubjectKey(pkFields, ref)]), limit, continuationToken);
+    }
+    /**
+     * Audit entries of one user (`Audit.Actor`)
+     *
+     * A logged-in user can read their own entries; anyone else needs `readPermission`.
+     * @param userId - the user, defaults to the current user
+     * @param limit - page size
+     * @param continuationToken - token of the previous page
+     * @returns the page of entries
+     */
+    async actorEntries(userId, limit, continuationToken) {
+        const context = useContext();
+        const current = context.getCurrentUserId();
+        const target = userId || current;
+        if (!target || (target !== current && !this.hasReadPermission(context))) {
+            throw new WebdaError.Forbidden("Audit not allowed");
+        }
+        return this.findEntries(escape(["userId = ", ""], [target]), limit, continuationToken);
+    }
+    /**
+     * Query the whole audit log (`Audit.Query`), requires `readPermission`
+     *
+     * Only the filter part of `q` is used; ordering and paging are fixed.
+     * @param q - WebdaQL filter over the entry fields
+     * @param limit - page size
+     * @param continuationToken - token of the previous page
+     * @returns the page of entries
+     */
+    async queryEntries(q, limit, continuationToken) {
+        const context = useContext();
+        if (!this.hasReadPermission(context)) {
+            throw new WebdaError.Forbidden("Audit not allowed");
+        }
+        let filter = "";
+        if (q) {
+            try {
+                filter = parse(q).filter.toString();
+            }
+            catch {
+                throw new WebdaError.BadRequest("Query syntax error");
+            }
+        }
+        return this.findEntries(filter, limit, continuationToken);
+    }
+}
+//# sourceMappingURL=audit.model.js.map

package/lib/services/audit.model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.model.js","sourceRoot":"","sources":["../../src/services/audit.model.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAEzD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,KAAK,UAAU,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAEtD,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,mBAAmB,EAAyB,MAAM,uBAAuB,CAAC;AAEvH;;GAEG;AACH,MAAM,OAAO,UAAW,SAAQ,SAAS;IACvC,WAAW,CAAS;IACpB,OAAO,CAAU;IACjB,KAAK,CAAU;IACf,MAAM,CAAU;IAChB;;OAEG;IACH,YAAY,CAAU;IACtB;;OAEG;IACH,UAAU,CAAU;IACpB,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC,WAAW,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,SAAS,CAAC,KAA6B;QACzC,IAAI,CAAC,aAAa,CAAC,CAAC,WAAW,CAAC,GAAG,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAA+B,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC/H,CAAC;IAED,gFAAgF;IAChF,MAAM;QACJ,MAAM,MAAM,GAAS,KAAK,CAAC,MAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,MAAM,MAAM,GAAQ,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;QAClD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,MAAM,CAAC,GAAG,CAAC,GAAI,IAAY,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,MAAM,EAAG,IAAY,CAAC,aAAa,CAAC,CAAC,CAAC;QACpD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,sBAAuB,SAAQ,iBAAiB;IAC3D;;;;OAIG;IACH,UAAU,CAAY;IAEtB;;;;;;OAMG;IACH,KAAK,CAA+B;IAEpC;;;;;OAKG;IACH,cAAc,CAAU;IAExB;;;;;OAKG;IACH,oBAAoB,CAAW;IAE/B;;;OAGG;IACK,kBAAkB,CAAW;IAErC;;;;OAIG;IACH,IAAI,CAAC,MAAM,GAAQ,EAAE;QACnB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC;QACrB,IAAI,CAAC,UAAU,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACjD,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;YAClG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;YAClE,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACjC,IAAI,CAAC,UAAU,GAAG,CAAC,GAAG,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QACD,IAAI,CAAC,kBAAkB,KAAK,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACK,cAAc,CAAC,WAAmB,EAAE,OAAe;QACzD,IAAI,OAAO,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACjC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,OAAO,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,WAAW,KAAK,OAAO,CAAC;IACjC,CAAC;IAED;;;;OAIG;IACH,UAAU,CAAC,WAAmB;QAC5B,IAAI,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;IACxE,CAAC;CACF;AAED;;GAEG;AACH,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAE/C;;GAEG;AACH,MAAM,qBAAqB,GAAG,CAAC,eAAe,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC;AAE9E;;GAEG;AACH,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,aAAa,GAAG,GAAG,CAAC;AAE1B;;GAEG;AACH,MAAM,qBAAqB,GAAgC;IACzD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,iBAAiB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;CACtC,CAAC;AAEF;;GAEG;AACH,MAAM,aAAa,GAAgC;IACjD,mBAAmB,EAAE;QACnB,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,GAAG,qBAAqB,EAAE;QAClH,QAAQ,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC;KAC3B;IACD,iBAAiB,EAAE;QACjB,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,GAAG,qBAAqB,EAAE;KACrE;IACD,iBAAiB,EAAE;QACjB,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,GAAG,qBAAqB,EAAE;KAChE;CACF,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,YAAa,SAAQ,OAA+B;IAC/D;;OAEG;IACO,OAAO,GAAiB,EAAE,CAAC;IAErC;;OAEG;IACO,mBAAmB,CAAkB;IAE/C;;OAEG;IACO,aAAa,GAAmB,EAAE,CAAC;IAE7C;;OAEG;IACO,WAAW;QACnB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,GAAG,EAAE,CAAC;QACR,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,WAAW,EAAE,CAAC;QACnB,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;IACrB,CAAC;IAED;;;OAGG;IACH,OAAO;QACL,KAAK,CAAC,OAAO,EAAE,CAAC;QAChB,IAAI,CAAC,WAAW,EAAE,CAAC;QACnB,IAAI,CAAC,aAAa,CAAC,IAAI,CACrB,aAAa,CAAC,wBAAwB,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE;YAClD,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QACpG,CAAC,CAAC,EACF,aAAa,CAAC,wBAAwB,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE;YAClD,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QACpG,CAAC,CAAC,CACH,CAAC;QACF,IAAI,IAAI,CAAC,UAAU,CAAC,oBAAoB,EAAE,CAAC;YACzC,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAChC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACH,UAAU;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;;;;;OAMG;IACH,WAAW,CAAC,WAAmB,EAAE,OAAgB;QAC/C,+BAA+B;QAC/B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAC7C,OAAO,KAAK,CAAC;QACf,CAAC;QACD,qBAAqB;QACrB,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,KAAK,CAAC;QAC7C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,CAAC,OAAO,CAAC;QAClB,CAAC;QACD,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;YAClD,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACzF,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,aAAa,CAAC,WAAmB,EAAE,MAAe,EAAE,GAAW,EAAE,OAA0B;QAC/F,MAAM,OAAO,GAAG,GAAG,KAAK,SAAS,CAAC;QAClC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,CAAC;YAC5C,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,UAAU,EAAE,CAAC;QAC/B,KAAK,CAAC,WAAW,GAAG,WAAW,CAAC;QAChC,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;QACxB,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;QACtB,KAAK,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;QAC7B,KAAK,CAAC,YAAY,GAAG,OAAO,EAAE,KAAK,CAAC;QACpC,KAAK,CAAC,UAAU,GAAG,OAAO,EAAE,GAAG,CAAC;QAChC,IAAI,GAAG,EAAE,CAAC;YACR,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC;QAC5B,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;IACrB,CAAC;IAED;;OAEG;IACO,sBAAsB;QAC9B,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC,UAAU,EAAE,CAAC;QACjD,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;YAC3D,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC/B,CAAC;YACD,UAAU,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC;QAC9B,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC/B,iBAAiB,CAAC,eAAe,EAAE;YACjC,OAAO;YACP,MAAM,EAAE,gBAAgB;YACxB,KAAK,EAAE,qBAAqB;YAC5B,OAAO,EAAE,4BAA4B;YACrC,IAAI,EAAE,CAAC,OAAO,CAAC;SAChB,CAAC,CAAC;QACH,iBAAiB,CAAC,aAAa,EAAE;YAC/B,OAAO;YACP,MAAM,EAAE,cAAc;YACtB,KAAK,EAAE,mBAAmB;YAC1B,OAAO,EAAE,yBAAyB;YAClC,IAAI,EAAE,CAAC,OAAO,CAAC;SAChB,CAAC,CAAC;QACH,iBAAiB,CAAC,aAAa,EAAE;YAC/B,OAAO;YACP,MAAM,EAAE,cAAc;YACtB,KAAK,EAAE,mBAAmB;YAC1B,OAAO,EAAE,qBAAqB;YAC9B,IAAI,EAAE,CAAC,OAAO,CAAC;SAChB,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,iBAAiB,CAAC,OAAyB;QACzC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,mBAAmB,KAAK,IAAI,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;QAChF,OAAO,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;IACnE,CAAC;IAED;;;;;;OAMG;IACO,KAAK,CAAC,WAAW,CACzB,MAAc,EACd,KAAc,EACd,iBAA0B;QAE1B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,iBAAiB,EAAE,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;QACtG,IAAI,KAAK,GAAG,GAAG,MAAM,kCAAkC,QAAQ,EAAE,CAAC;QAClE,IAAI,iBAAiB,EAAE,CAAC;YACtB,KAAK,IAAI,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1C,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,IAAI,SAAS,EAAE,CAAC;IACzF,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,cAAc,CAAC,KAAa,EAAE,GAAY,EAAE,KAAc,EAAE,iBAA0B;QAC1F,MAAM,OAAO,GAAG,UAAU,EAAoB,CAAC;QAC/C,IAAI,UAAe,CAAC;QACpB,IAAI,CAAC;YACH,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,QAAQ,GAAa,gBAAgB,CAAC,UAAU,CAAC,EAAE,UAAU,IAAI,CAAC,MAAM,CAAC,CAAC;QAChF,MAAM,GAAG,GAAG,eAAe,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC3C,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,QAAa,CAAC;QAClB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,oDAAoD;QACtD,CAAC;QACD,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,EAAE,CAAC;YACxC,MAAM,OAAO,GAAG,OAAO,QAAQ,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YACxG,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,MAAM,IAAI,UAAU,CAAC,SAAS,CAAC,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC;YAC9F,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CACrB,MAAM,CAAC,CAAC,iBAAiB,EAAE,oBAAoB,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,mBAAmB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,EACpG,KAAK,EACL,iBAAiB,CAClB,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,YAAY,CAAC,MAAe,EAAE,KAAc,EAAE,iBAA0B;QAC5E,MAAM,OAAO,GAAG,UAAU,EAAoB,CAAC;QAC/C,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO,CAAC;QACjC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACxE,MAAM,IAAI,UAAU,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,iBAAiB,CAAC,CAAC;IACzF,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,YAAY,CAAC,CAAU,EAAE,KAAc,EAAE,iBAA0B;QACvE,MAAM,OAAO,GAAG,UAAU,EAAoB,CAAC;QAC/C,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,UAAU,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,CAAC,EAAE,CAAC;YACN,IAAI,CAAC;gBACH,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,iBAAiB,CAAC,CAAC;IAC5D,CAAC;CACF"}