@webda/core 4.0.0-beta.4 → 4.0.0-beta.6

package/lib/models/aclmodel.d.ts

@@ -1,14 +1,37 @@
+import type { IOperationContext } from "../contexts/icontext.js";
+/**
+ * Access control entry
+ */
 export type Ace = {
+    /**
+     * Action the entry applies to ("get", "update", "delete", an action name...)
+     */
     action: string;
+    /**
+     * Kind of principal: a user id or a group name
+     */
     type: "GROUP" | "USER";
+    /**
+     * The user id (type USER) or group name (type GROUP) the entry applies to.
+     * An entry without principal matches nobody.
+     */
+    principal?: string;
+    /**
+     * Allow or deny: a matching deny wins over any allow
+     */
     allow: boolean;
 };
 /**
  * Allow to define ACLs for the object
  *
  * It is used as an attribute in the model so
- * you can add it later on to existing models
+ * you can add it later on to existing models; the model delegates its permissions to it:
  *
+ * ```ts
+ * async canAct(context: IOperationContext, action: string) {
+ *   return ResourceAcl.from(this.acl ?? []).canAct(context, action);
+ * }
+ * ```
  */
 export declare class ResourceAcl extends Array<Ace> {
     /**
@@ -22,11 +45,15 @@ export declare class ResourceAcl extends Array<Ace> {
      */
     fromDto(dto: Ace[]): void;
     /**
-     * ACLs for the object
+     * Check the ACL for the current caller, with the same signature as a model `canAct`
+     *
+     * An entry matches when its action is `action` and its principal is the caller id (USER) or one of the caller
+     * groups (GROUP). A matching deny wins, then a matching allow; with no matching entry the action is refused.
+     * Anonymous callers match no entry.
+     * @param context - the caller context
      * @param action - the action to check
-     * @param user - the user object
-     * @returns the result
+     * @returns true or the refusal reason
      */
-    canAct(action: string, user?: any): Promise<string | boolean>;
+    canAct(context: IOperationContext, action: string): Promise<string | boolean>;
 }
 //# sourceMappingURL=aclmodel.d.ts.map

package/lib/models/aclmodel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"aclmodel.d.ts","sourceRoot":"","sources":["../../src/models/aclmodel.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,GAAG,GAAG;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC;IACvB,KAAK,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF;;;;;;GAMG;AACH,qBAAa,WAAY,SAAQ,KAAK,CAAC,GAAG,CAAC;IACzC;;;OAGG;IACH,KAAK,IAAI,GAAG,EAAE,CAEb;IAED;;;OAGG;IACH,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAKxB;IAED;;;;;OAKG;IACG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,CAYlE;CACF"}
+{"version":3,"file":"aclmodel.d.ts","sourceRoot":"","sources":["../../src/models/aclmodel.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEjE;;GAEG;AACH,MAAM,MAAM,GAAG,GAAG;IAChB;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC;IACvB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,KAAK,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,qBAAa,WAAY,SAAQ,KAAK,CAAC,GAAG,CAAC;IACzC;;;OAGG;IACH,KAAK,IAAI,GAAG,EAAE,CAEb;IAED;;;OAGG;IACH,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAKxB;IAED;;;;;;;;;OASG;IACG,MAAM,CAAC,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,CA4BlF;CACF"}

package/lib/models/aclmodel.js

@@ -2,8 +2,13 @@
  * Allow to define ACLs for the object
  *
  * It is used as an attribute in the model so
- * you can add it later on to existing models
+ * you can add it later on to existing models; the model delegates its permissions to it:
  *
+ * ```ts
+ * async canAct(context: IOperationContext, action: string) {
+ *   return ResourceAcl.from(this.acl ?? []).canAct(context, action);
+ * }
+ * ```
  */
 export class ResourceAcl extends Array {
     /**
@@ -24,19 +29,39 @@ export class ResourceAcl extends Array {
         }
     }
     /**
-     * ACLs for the object
+     * Check the ACL for the current caller, with the same signature as a model `canAct`
+     *
+     * An entry matches when its action is `action` and its principal is the caller id (USER) or one of the caller
+     * groups (GROUP). A matching deny wins, then a matching allow; with no matching entry the action is refused.
+     * Anonymous callers match no entry.
+     * @param context - the caller context
      * @param action - the action to check
-     * @param user - the user object
-     * @returns the result
+     * @returns true or the refusal reason
      */
-    async canAct(action, user) {
-        for (const ace of this.filter(a => !a.allow)) {
-            if (ace.action === action) {
+    async canAct(context, action) {
+        const userId = context?.getCurrentUserId();
+        if (!userId) {
+            return "no matching ACE in resource ACL";
+        }
+        const entries = this.filter(a => a.action === action && a.principal);
+        let groups;
+        const matches = async (ace) => {
+            if (ace.type === "USER") {
+                return ace.principal === userId;
+            }
+            if (ace.type === "GROUP") {
+                groups ??= (await context.getCurrentUser())?.getGroups?.() ?? [];
+                return groups.includes(ace.principal);
+            }
+            return false;
+        };
+        for (const ace of entries.filter(a => !a.allow)) {
+            if (await matches(ace)) {
                 return "explicitly denied by resource ACL";
             }
         }
-        for (const ace of this.filter(a => a.allow)) {
-            if (ace.action === action) {
+        for (const ace of entries.filter(a => a.allow)) {
+            if (await matches(ace)) {
                 return true;
             }
         }

package/lib/models/aclmodel.js.map

@@ -1 +1 @@
-{"version":3,"file":"aclmodel.js","sourceRoot":"","sources":["../../src/models/aclmodel.ts"],"names":[],"mappings":"AAMA;;;;;;GAMG;AACH,MAAM,OAAO,WAAY,SAAQ,KAAU;IACzC;;;OAGG;IACH,KAAK;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACH,OAAO,CAAC,GAAU;QAChB,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC;YACtB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,IAAU;QACrC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7C,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC1B,OAAO,mCAAmC,CAAC;YAC7C,CAAC;QACH,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC1B,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,OAAO,iCAAiC,CAAC;IAC3C,CAAC;CACF"}
+{"version":3,"file":"aclmodel.js","sourceRoot":"","sources":["../../src/models/aclmodel.ts"],"names":[],"mappings":"AAyBA;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,WAAY,SAAQ,KAAU;IACzC;;;OAGG;IACH,KAAK;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACH,OAAO,CAAC,GAAU;QAChB,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC;YACtB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,MAAM,CAAC,OAA0B,EAAE,MAAc;QACrD,MAAM,MAAM,GAAG,OAAO,EAAE,gBAAgB,EAAE,CAAC;QAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,iCAAiC,CAAC;QAC3C,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC;QACrE,IAAI,MAA4B,CAAC;QACjC,MAAM,OAAO,GAAG,KAAK,EAAE,GAAQ,EAAoB,EAAE;YACnD,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBACxB,OAAO,GAAG,CAAC,SAAS,KAAK,MAAM,CAAC;YAClC,CAAC;YACD,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBACzB,MAAM,KAAK,CAAC,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC;gBACjE,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACxC,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QACF,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YAChD,IAAI,MAAM,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvB,OAAO,mCAAmC,CAAC;YAC7C,CAAC;QACH,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/C,IAAI,MAAM,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvB,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,OAAO,iCAAiC,CAAC;IAC3C,CAAC;CACF"}

package/lib/models/ownermodel.model.d.ts

@@ -4,8 +4,8 @@ import { IOperationContext } from "../contexts/icontext.js";
 /**
  * Abstract class to define an object with an owner
  *
- * The owner is the user that created the object
- * The owner can be changed by the owner
+ * The owner is the user that created the object, set from the caller on create.
+ * The owner is never taken from client input.
  */
 export declare abstract class AbstractOwnerModel<T extends User> extends UuidModel {
     /**
@@ -23,6 +23,17 @@ export declare abstract class AbstractOwnerModel<T extends User> extends UuidMod
      * @returns
      */
     abstract getOwnerModel(): ModelClass<T>;
+    /**
+     * Attributes never taken from client input by the DomainService (REST, gRPC, MCP) or GraphQL
+     * @returns the attribute names
+     */
+    static getProtectedAttributes(): string[];
+    /**
+     * Called by the DomainService (and GraphQL) on a new object built from client input, before the
+     * `canAct(context, "create")` check and the save: the caller becomes the owner
+     * @param context - the caller context
+     */
+    prepareCreate(context: IOperationContext): void;
     /**
      * Set object owner
      * @param uuid - the unique identifier
@@ -43,7 +54,18 @@ export declare abstract class AbstractOwnerModel<T extends User> extends UuidMod
      */
     canAct(context: IOperationContext, action: string): Promise<string | boolean>;
     /**
-     * Return a query to filter OwnerModel
+     * Whether an action is a binary read (a behavior action of Binary/Binaries): `avatar.download`, `photos.get`...
+     * @param action - the action name
+     * @returns true for the read actions of binary attributes
+     */
+    static isBinaryRead(action: string): boolean;
+    /**
+     * Return a query to filter OwnerModel: the objects of the caller and the public ones
+     *
+     * The user id is bound as an escaped WebdaQL value, it can never change the query structure.
+     *
+     * Subclasses inherit this filter even when they override `canAct` (it fails closed: it can only hide rows). A
+     * subclass whose `canAct` is more permissive overrides this method (returning `null` disables the store filter).
      *
      * @param context - the execution context
      * @returns the result

package/lib/models/ownermodel.model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ownermodel.model.d.ts","sourceRoot":"","sources":["../../src/models/ownermodel.model.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,UAAU,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC3F,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D;;;;;GAKG;AACH,8BAAsB,kBAAkB,CAAC,CAAC,SAAS,IAAI,CAAE,SAAQ,SAAS;IACxE;;OAEG;IACH,IAAI,KAAK,IAAI,SAAS,CAAC,CAAC,CAAC,CAExB;IACD,IAAI,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,EAU7D;IACD;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IAEjB;;;OAGG;IACH,QAAQ,CAAC,aAAa,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAExC;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,IAAI,CAGtC;IAED;;;;;OAKG;IACH,QAAQ,IAAI,SAAS,CAAC,CAAC,CAAC,CAEvB;IAED;;;;;OAKG;IACG,MAAM,CAAC,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,CAalF;IAED;;;;;OAKG;IACH,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,iBAAiB,GAAG,IAAI,GAAG;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAQjG;IAED,gFAAgF;IAChF,MAAM,IAAI,GAAG,CAQZ;CACF;AAED;;GAEG;AACH,qBAAa,UAAW,SAAQ,kBAAkB,CAAC,IAAI,CAAC;IACtD;;;OAGG;IACH,aAAa,IAAI,UAAU,CAAC,IAAI,CAAC,CAEhC;CACF"}
+{"version":3,"file":"ownermodel.model.d.ts","sourceRoot":"","sources":["../../src/models/ownermodel.model.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,UAAU,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC3F,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAG5D;;;;;GAKG;AACH,8BAAsB,kBAAkB,CAAC,CAAC,SAAS,IAAI,CAAE,SAAQ,SAAS;IACxE;;OAEG;IACH,IAAI,KAAK,IAAI,SAAS,CAAC,CAAC,CAAC,CAExB;IACD,IAAI,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,EAU7D;IACD;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IAEjB;;;OAGG;IACH,QAAQ,CAAC,aAAa,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAExC;;;OAGG;IACH,MAAM,CAAC,sBAAsB,IAAI,MAAM,EAAE,CAExC;IAED;;;;OAIG;IACH,aAAa,CAAC,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAQ9C;IAED;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,IAAI,CAGtC;IAED;;;;;OAKG;IACH,QAAQ,IAAI,SAAS,CAAC,CAAC,CAAC,CAEvB;IAED;;;;;OAKG;IACG,MAAM,CAAC,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,CAWlF;IAED;;;;OAIG;IACH,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAE3C;IAED;;;;;;;;;;OAUG;IACH,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,iBAAiB,GAAG,IAAI,GAAG;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CASjG;IAED,gFAAgF;IAChF,MAAM,IAAI,GAAG,CAQZ;CACF;AAED;;GAEG;AACH,qBAAa,UAAW,SAAQ,kBAAkB,CAAC,IAAI,CAAC;IACtD;;;OAGG;IACH,aAAa,IAAI,UAAU,CAAC,IAAI,CAAC,CAEhC;CACF"}

package/lib/models/ownermodel.model.js

@@ -2,11 +2,12 @@ import { WEBDA_STORAGE } from "@webda/models";
 //import { UuidModel } from "./uuid.js";
 import { ModelLink, UuidModel } from "@webda/models";
 import { User } from "./user.model.js";
+import { bind } from "@webda/ql";
 /**
  * Abstract class to define an object with an owner
  *
- * The owner is the user that created the object
- * The owner can be changed by the owner
+ * The owner is the user that created the object, set from the caller on create.
+ * The owner is never taken from client input.
  */
 export class AbstractOwnerModel extends UuidModel {
     /**
@@ -33,6 +34,28 @@ export class AbstractOwnerModel extends UuidModel {
      * @default false
      */
     public;
+    /**
+     * Attributes never taken from client input by the DomainService (REST, gRPC, MCP) or GraphQL
+     * @returns the attribute names
+     */
+    static getProtectedAttributes() {
+        return ["_user"];
+    }
+    /**
+     * Called by the DomainService (and GraphQL) on a new object built from client input, before the
+     * `canAct(context, "create")` check and the save: the caller becomes the owner
+     * @param context - the caller context
+     */
+    prepareCreate(context) {
+        const userId = context?.getCurrentUserId();
+        if (userId) {
+            this.setOwner(userId);
+        }
+        else {
+            // Never keep an owner the caller did not prove
+            this._user = undefined;
+        }
+    }
     /**
      * Set object owner
      * @param uuid - the unique identifier
@@ -57,8 +80,8 @@ export class AbstractOwnerModel extends UuidModel {
      * @returns the result
      */
     async canAct(context, action) {
-        // Object is public
-        if (this.public && (action === "get" || action === "get_binary")) {
+        // Object is public: readable, binaries included (`<attribute>.download`, `.downloadUrl`, `.get`, `.getUrl`)
+        if (this.public && (action === "get" || AbstractOwnerModel.isBinaryRead(action))) {
             return true;
         }
         else if (!context.getCurrentUserId()) {
@@ -67,13 +90,24 @@ export class AbstractOwnerModel extends UuidModel {
         else if (!this.getOwner() && action !== "create") {
             return "Object does not have an owner";
         }
-        if (action === "create") {
-            //this.setOwner(Uuid.parse(ctx.getCurrentUserId(), this.getOwnerModel()));
-        }
+        // On create, the owner was set from the caller by prepareCreate: only the owner may create its objects
         return context.getCurrentUserId() === this.getOwner()?.toString();
     }
     /**
-     * Return a query to filter OwnerModel
+     * Whether an action is a binary read (a behavior action of Binary/Binaries): `avatar.download`, `photos.get`...
+     * @param action - the action name
+     * @returns true for the read actions of binary attributes
+     */
+    static isBinaryRead(action) {
+        return /^[^.]+\.(download|downloadUrl|get|getUrl)$/.test(action);
+    }
+    /**
+     * Return a query to filter OwnerModel: the objects of the caller and the public ones
+     *
+     * The user id is bound as an escaped WebdaQL value, it can never change the query structure.
+     *
+     * Subclasses inherit this filter even when they override `canAct` (it fails closed: it can only hide rows). A
+     * subclass whose `canAct` is more permissive overrides this method (returning `null` disables the store filter).
      *
      * @param context - the execution context
      * @returns the result
@@ -82,8 +116,9 @@ export class AbstractOwnerModel extends UuidModel {
         if (!context) {
             return null;
         }
+        const userId = context.getCurrentUserId();
         return {
-            query: `_user = '${context.getCurrentUserId()}' OR public = TRUE`,
+            query: userId ? bind("_user = ? OR public = TRUE", [userId]) : "public = TRUE",
             partial: false
         };
     }

package/lib/models/ownermodel.model.js.map

@@ -1 +1 @@
-{"version":3,"file":"ownermodel.model.js","sourceRoot":"","sources":["../../src/models/ownermodel.model.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,wCAAwC;AACxC,OAAO,EAAmB,SAAS,EAAuB,SAAS,EAAE,MAAM,eAAe,CAAC;AAC3F,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAGvC;;;;;GAKG;AACH,MAAM,OAAgB,kBAAmC,SAAQ,SAAS;IACxE;;OAEG;IACH,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,KAAK,CAAC,KAAoD;QAC5D,IAAI,KAAK,YAAY,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC;QACvC,CAAC;aAAM,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;YACzB,MAAM,IAAI,GAAiB,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC;YAC/E,IAAI,CAAC,GAAG,CAAC,KAAY,CAAC,CAAC;YACvB,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;QACtC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC;QACvC,CAAC;IACH,CAAC;IACD;;;OAGG;IACH,MAAM,CAAW;IAQjB;;;OAGG;IACH,QAAQ,CAAC,IAAuB;QAC9B,IAAI,CAAC,KAAK,KAAK,IAAI,SAAS,CAAI,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IAED;;;;;OAKG;IACH,QAAQ;QACN,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CAAC,OAA0B,EAAE,MAAc;QACrD,mBAAmB;QACnB,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,YAAY,CAAC,EAAE,CAAC;YACjE,OAAO,IAAI,CAAC;QACd,CAAC;aAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC;YACvC,OAAO,gDAAgD,CAAC;QAC1D,CAAC;aAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACnD,OAAO,+BAA+B,CAAC;QACzC,CAAC;QACD,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACxB,0EAA0E;QAC5E,CAAC;QACD,OAAO,OAAO,CAAC,gBAAgB,EAAE,KAAK,IAAI,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC;IACpE,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,kBAAkB,CAAC,OAA2B;QACnD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO;YACL,KAAK,EAAE,YAAY,OAAO,CAAC,gBAAgB,EAAE,oBAAoB;YACjE,OAAO,EAAE,KAAK;SACf,CAAC;IACJ,CAAC;IAED,gFAAgF;IAChF,MAAM;QACJ,MAAM,MAAM,GAAS,KAAK,CAAC,MAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,MAAM,MAAM,GAAQ,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;QAClD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,MAAM,CAAC,GAAG,CAAC,GAAI,IAAY,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,MAAM,EAAG,IAAY,CAAC,aAAa,CAAC,CAAC,CAAC;QACpD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,UAAW,SAAQ,kBAAwB;IACtD;;;OAGG;IACH,aAAa;QACX,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}
+{"version":3,"file":"ownermodel.model.js","sourceRoot":"","sources":["../../src/models/ownermodel.model.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,wCAAwC;AACxC,OAAO,EAAmB,SAAS,EAAuB,SAAS,EAAE,MAAM,eAAe,CAAC;AAC3F,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAEvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC;;;;;GAKG;AACH,MAAM,OAAgB,kBAAmC,SAAQ,SAAS;IACxE;;OAEG;IACH,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,KAAK,CAAC,KAAoD;QAC5D,IAAI,KAAK,YAAY,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC;QACvC,CAAC;aAAM,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;YACzB,MAAM,IAAI,GAAiB,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC;YAC/E,IAAI,CAAC,GAAG,CAAC,KAAY,CAAC,CAAC;YACvB,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;QACtC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC;QACvC,CAAC;IACH,CAAC;IACD;;;OAGG;IACH,MAAM,CAAW;IAQjB;;;OAGG;IACH,MAAM,CAAC,sBAAsB;QAC3B,OAAO,CAAC,OAAO,CAAC,CAAC;IACnB,CAAC;IAED;;;;OAIG;IACH,aAAa,CAAC,OAA0B;QACtC,MAAM,MAAM,GAAG,OAAO,EAAE,gBAAgB,EAAE,CAAC;QAC3C,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,QAAQ,CAAC,MAAa,CAAC,CAAC;QAC/B,CAAC;aAAM,CAAC;YACN,+CAA+C;YAC/C,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;QACzB,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,QAAQ,CAAC,IAAuB;QAC9B,IAAI,CAAC,KAAK,KAAK,IAAI,SAAS,CAAI,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IAED;;;;;OAKG;IACH,QAAQ;QACN,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CAAC,OAA0B,EAAE,MAAc;QACrD,4GAA4G;QAC5G,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,KAAK,KAAK,IAAI,kBAAkB,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YACjF,OAAO,IAAI,CAAC;QACd,CAAC;aAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC;YACvC,OAAO,gDAAgD,CAAC;QAC1D,CAAC;aAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACnD,OAAO,+BAA+B,CAAC;QACzC,CAAC;QACD,uGAAuG;QACvG,OAAO,OAAO,CAAC,gBAAgB,EAAE,KAAK,IAAI,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC;IACpE,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,YAAY,CAAC,MAAc;QAChC,OAAO,4CAA4C,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnE,CAAC;IAED;;;;;;;;;;OAUG;IACH,MAAM,CAAC,kBAAkB,CAAC,OAA2B;QACnD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC1C,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,4BAA4B,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe;YAC9E,OAAO,EAAE,KAAK;SACf,CAAC;IACJ,CAAC;IAED,gFAAgF;IAChF,MAAM;QACJ,MAAM,MAAM,GAAS,KAAK,CAAC,MAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,MAAM,MAAM,GAAQ,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;QAClD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,MAAM,CAAC,GAAG,CAAC,GAAI,IAAY,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,MAAM,EAAG,IAAY,CAAC,aAAa,CAAC,CAAC,CAAC;QACpD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,UAAW,SAAQ,kBAAwB;IACtD;;;OAGG;IACH,aAAa;QACX,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/lib/models/permissions.d.ts

@@ -0,0 +1,247 @@
+import { QueryValidator } from "@webda/ql";
+import type { IOperationContext } from "../contexts/icontext.js";
+/**
+ * Result of a model's static `getPermissionQuery(context)`
+ */
+export type PermissionQuery = {
+    /**
+     * WebdaQL filter ANDed with the client query (filter only: no ORDER BY, LIMIT or OFFSET)
+     */
+    query: string;
+    /**
+     * The filter only narrows the results: `canAct(context, "get")` decides for each of them
+     */
+    partial: boolean;
+};
+/**
+ * Whether a model class defines a static `canAct` of its own (not the base one)
+ * @param model - the model class
+ * @returns true when the static form is overridden
+ */
+export declare function hasStaticPermissionCheck(model: any): boolean;
+/**
+ * Whether a model class defines a permission check at all: a static `canAct` of its own (not the base one), or an
+ * instance `canAct`. A model with neither is refused on every transport. Subclasses with their own check do not
+ * open a class that has none: an object reached through a class must be allowed by that class too
+ * @param model - the model class
+ * @returns true when the model defines one of the two forms
+ */
+export declare function hasModelPermissionCheck(model: any): boolean;
+/**
+ * Ask the model whether the current caller may perform `action` on an object
+ *
+ * The question goes through the static `canAct(context, action, object)` of the model class (see
+ * {@link Model.canAct}): the base implementation delegates to the object's instance `canAct`, and denies when there
+ * is none. `true` allows; anything else (`false`, a refusal reason string, `undefined`...) refuses, and so does a
+ * `canAct` that throws.
+ *
+ * @param object - the model instance (the new, unsaved object on create)
+ * @param context - the caller context
+ * @param action - the action name ("get", "create", "update", "delete", an action name or "attribute.action")
+ * @param model - the model class (defaults to the object's class)
+ * @returns true when allowed, otherwise the refusal (a reason string or false)
+ */
+export declare function getModelPermission(object: any, context: IOperationContext, action: string, model?: any): Promise<any>;
+/**
+ * Whether the current caller may perform `action` on a model instance (see {@link checkModelPermission}); it never
+ * throws
+ * @param object - the model instance
+ * @param context - the caller context
+ * @param action - the action name
+ * @param model - the model class (defaults to the object's class)
+ * @returns true when allowed
+ */
+export declare function isModelActionAllowed(object: any, context: IOperationContext, action: string, model?: any): Promise<boolean>;
+/**
+ * Message of the NotFound error for a missing object, also used for an object the caller may not read
+ */
+export declare const NOT_FOUND_MESSAGE = "Object not found";
+/**
+ * Load an object for an action as the caller: a missing object and an object the caller may not read throw the same
+ * `NotFound("Object not found")`; a readable object whose action is refused throws `Forbidden`
+ * @param model - the model class
+ * @param key - the primary key
+ * @param context - the caller context
+ * @param action - the action ("get" to only read)
+ * @returns the object
+ */
+export declare function loadModelForAction<T = any>(model: any, key: any, context: IOperationContext, action: string): Promise<T>;
+/**
+ * The parent relation (`ModelParent`) of a model, if any
+ * @param model - the model class
+ * @returns the parent attribute and model identifier
+ */
+export declare function getParentRelation(model: any): {
+    attribute: string;
+    model: string;
+} | undefined;
+/**
+ * A child can only be attached to a parent the caller may read: a missing parent and an unreadable one throw the same
+ * `NotFound("Object not found")`
+ * @param model - the child model class
+ * @param parentId - the parent primary key
+ * @param context - the caller context
+ */
+export declare function checkModelParent(model: any, parentId: any, context: IOperationContext): Promise<void>;
+/**
+ * When an update moves an object to another parent, the caller must be able to read the new parent
+ * @param model - the model class
+ * @param object - the stored object
+ * @param input - the sanitized update input
+ * @param context - the caller context
+ */
+export declare function checkModelReparent(model: any, object: any, input: any, context: IOperationContext): Promise<void>;
+/**
+ * Enforce a model's permission for an action on an object: the single check used by every client path (REST, gRPC,
+ * MCP, GraphQL and any transport dispatching operations)
+ *
+ * A caller who may not read the object (`canAct(ctx, "get", object)` refused) gets exactly the error of a missing
+ * object (`NotFound("Object not found")`), whatever the action, so a refusal never reveals that the key exists. A
+ * caller who may read the object but not perform the action gets a `Forbidden`. On `"create"` the object does not
+ * exist yet: a refusal is always a `Forbidden`.
+ *
+ * The refusal reason returned by `canAct` is logged, never sent to the client.
+ *
+ * @param object - the model instance
+ * @param context - the caller context
+ * @param action - the action name
+ * @param model - the model class (defaults to the object's class)
+ * @throws WebdaError.NotFound when the caller may not read the object
+ * @throws WebdaError.Forbidden when the caller may read the object but not perform the action
+ */
+export declare function checkModelPermission(object: any, context: IOperationContext, action: string, model?: any): Promise<void>;
+/**
+ * Enforce a model's permission for a static (class-level) action: `canAct(context, action)` without object
+ *
+ * There is no object to hide, so a refusal is always a `Forbidden`.
+ * @param model - the model class
+ * @param context - the caller context
+ * @param action - the action name
+ * @throws WebdaError.Forbidden when refused
+ */
+export declare function checkStaticModelPermission(model: any, context: IOperationContext, action: string): Promise<void>;
+/**
+ * Persist a new object with the repository `create`, which refuses an existing key (atomically in every bundled
+ * repository), instead of `save()`, which upserts
+ * @param object - the new model instance
+ * @returns the object
+ * @throws WebdaError.Conflict when an object with the same primary key exists
+ */
+export declare function createModel<T = any>(object: T): Promise<T>;
+/**
+ * AND the model's permission query into a client query
+ *
+ * Both sides are parsed and combined on the expression tree, so a client `OR` keeps its precedence. The client
+ * ORDER BY, LIMIT and OFFSET are kept.
+ *
+ * @param query - the client query
+ * @param permission - the permission query, if any
+ * @returns the query to run
+ * @throws SyntaxError if the client query is invalid
+ */
+export declare function mergePermissionQuery(query: string, permission?: PermissionQuery | null): string;
+/**
+ * Highest LIMIT a client query can ask for: larger LIMITs are lowered to it
+ */
+export declare const MAX_QUERY_LIMIT = 1000;
+/**
+ * Rows a permission-filtered query scans to fill one page: ten times the page LIMIT, at least
+ * {@link MIN_SCANNED_ROWS}, at most {@link MAX_SCANNED_ROWS}
+ */
+export declare const SCAN_FACTOR = 10;
+/**
+ * Lower bound of the scan budget of a permission-filtered page
+ */
+export declare const MIN_SCANNED_ROWS = 100;
+/**
+ * Absolute bound of the scan budget of a permission-filtered page
+ */
+export declare const MAX_SCANNED_ROWS = 10000;
+/**
+ * Most store pages read to fill one page, whatever their size
+ */
+export declare const MAX_REFILL_PAGES = 100;
+/**
+ * Lifetime of a continuation token (one hour): paging has to resume within it
+ */
+export declare const CONTINUATION_TOKEN_TTL_MS: number;
+/**
+ * Refuse a client query that reads private (`__`-prefixed) fields, at any depth, in its filter or ORDER BY: a filter
+ * on a private field (a password hash...) would reveal its value through which rows match. The field list of a
+ * SELECT and the targets of an UPDATE SET are checked too.
+ * @param query - the parsed client query
+ * @throws WebdaError.BadRequest when a field path has a `__`-prefixed segment
+ */
+export declare function assertNoPrivateFields(query: QueryValidator): void;
+/**
+ * Refuse what the Query operations do not run: DELETE and UPDATE statements, and SELECT field lists
+ *
+ * Statements are parsed by WebdaQL and run by the repositories (`deleteMany`, `updateMany`), never through the
+ * Query operations exposed to clients (REST, gRPC, MCP, GraphQL): those take a filter query only.
+ * @param query - the parsed client query
+ * @throws WebdaError.BadRequest for a DELETE or UPDATE statement, or a SELECT field list
+ */
+export declare function assertFilterOnly(query: QueryValidator): void;
+/**
+ * What a continuation token is bound to: it is only accepted back for the same model, the same query (filter and
+ * ORDER BY) and the same caller
+ */
+export type ContinuationTokenBinding = {
+    /**
+     * Model identifier
+     */
+    model: string;
+    /**
+     * The query the token continues: filter and ORDER BY, without LIMIT and OFFSET
+     */
+    query: string;
+    /**
+     * Caller id, "anonymous" when not logged in
+     */
+    user: string;
+};
+/**
+ * Seal a store continuation token: encrypted with the CryptoService (random IV, padded to 64 bytes) so its value
+ * cannot be read, compared or forged by the client; bound to the model, the query and the caller; and expiring
+ * after `ttl` ({@link CONTINUATION_TOKEN_TTL_MS})
+ * @param token - the store token
+ * @param binding - what the token is bound to
+ * @param ttl - lifetime in milliseconds
+ * @returns the opaque token
+ */
+export declare function sealContinuationToken(token: string, binding: ContinuationTokenBinding, ttl?: number): Promise<string>;
+/**
+ * Open a token produced by {@link sealContinuationToken}
+ * @param token - the opaque token
+ * @param binding - what the token must be bound to
+ * @returns the store token
+ * @throws WebdaError.BadRequest when the token was not produced by this application for this model, query and
+ * caller, or has expired
+ */
+export declare function unsealContinuationToken(token: string, binding: ContinuationTokenBinding): Promise<string>;
+/**
+ * Query a model as the caller
+ *
+ * - the client query may not read private (`__`) fields (400), and its LIMIT is lowered to {@link MAX_QUERY_LIMIT};
+ * - the client query is a filter: DELETE, UPDATE and SELECT field lists are refused (400, {@link assertFilterOnly});
+ * - a model defining neither `canAct` form refuses every row: the store is not asked;
+ * - the model's static `getPermissionQuery(context)` is ANDed into the query;
+ * - every result is checked with the static `canAct(context, "get", row)` and refused ones are dropped. Refused rows
+ *   are replaced by continuing the scan (next store pages, asking only for the missing rows), within a budget of
+ *   `SCAN_FACTOR` x LIMIT rows (between `MIN_SCANNED_ROWS` and `MAX_SCANNED_ROWS`) and {@link MAX_REFILL_PAGES}
+ *   store pages. When the budget is spent, an empty page carries no token;
+ * - the continuation token is sealed ({@link sealContinuationToken}): a store token counting or naming rows
+ *   (Postgres/Firestore offsets, Dynamo keys, memory offsets) would otherwise reveal hidden matches. It is bound to
+ *   the model, the query and the caller, expires after {@link CONTINUATION_TOKEN_TTL_MS}, and is sent back as is in
+ *   `OFFSET`; any other value is a 400.
+ *
+ * @param model - the model class
+ * @param query - the client query
+ * @param context - the caller context
+ * @returns the query results the caller may read
+ */
+export declare function queryModelWithPermissions<T = any>(model: any, query: string, context: IOperationContext): Promise<{
+    results: T[];
+    continuationToken?: string;
+}>;
+//# sourceMappingURL=permissions.d.ts.map

package/lib/models/permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../src/models/permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAA2C,cAAc,EAAmB,MAAM,WAAW,CAAC;AAIrG,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAcjE;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AA2DF;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,GAAG,GAAG,OAAO,CAE5D;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,GAAG,GAAG,OAAO,CAE3D;AA+BD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,GAAG,EACX,OAAO,EAAE,iBAAiB,EAC1B,MAAM,EAAE,MAAM,EACd,KAAK,CAAC,EAAE,GAAG,GACV,OAAO,CAAC,GAAG,CAAC,CAEd;AAED;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,GAAG,EACX,OAAO,EAAE,iBAAiB,EAC1B,MAAM,EAAE,MAAM,EACd,KAAK,CAAC,EAAE,GAAG,GACV,OAAO,CAAC,OAAO,CAAC,CAElB;AAED;;GAEG;AACH,eAAO,MAAM,iBAAiB,qBAAqB,CAAC;AAEpD;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,GAAG,GAAG,EAC9C,KAAK,EAAE,GAAG,EACV,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,iBAAiB,EAC1B,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,CAAC,CAYZ;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,GAAG,GAAG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAM9F;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAe3G;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,iBAAiB,iBAOvG;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,GAAG,EACX,OAAO,EAAE,iBAAiB,EAC1B,MAAM,EAAE,MAAM,EACd,KAAK,CAAC,EAAE,GAAG,GACV,OAAO,CAAC,IAAI,CAAC,CAef;AAED;;;;;;;;GAQG;AACH,wBAAsB,0BAA0B,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,iBAWtG;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAAC,CAAC,GAAG,GAAG,EAAE,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAUhE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,eAAe,GAAG,IAAI,GAAG,MAAM,CAK/F;AAED;;GAEG;AACH,eAAO,MAAM,eAAe,OAAO,CAAC;AACpC;;;GAGG;AACH,eAAO,MAAM,WAAW,KAAK,CAAC;AAC9B;;GAEG;AACH,eAAO,MAAM,gBAAgB,MAAM,CAAC;AACpC;;GAEG;AACH,eAAO,MAAM,gBAAgB,QAAQ,CAAC;AACtC;;GAEG;AACH,eAAO,MAAM,gBAAgB,MAAM,CAAC;AACpC;;GAEG;AACH,eAAO,MAAM,yBAAyB,QAAiB,CAAC;AAExD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI,CAsBjE;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI,CAQ5D;AAED;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GAAG;IACrC;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAeF;;;;;;;;GAQG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,wBAAwB,EACjC,GAAG,GAAE,MAAkC,GACtC,OAAO,CAAC,MAAM,CAAC,CAYjB;AAED;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,MAAM,CAAC,CAmB/G;AAcD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,yBAAyB,CAAC,CAAC,GAAG,GAAG,EACrD,KAAK,EAAE,GAAG,EACV,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC;IAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA+DvD"}