@webda/core 4.0.0-beta.4 → 4.0.0-beta.6

package/lib/models/permissions.js

@@ -0,0 +1,522 @@
+import { ComparisonExpression, LogicalExpression, QueryValidator } from "@webda/ql";
+import { Model } from "@webda/models";
+import { useLog } from "@webda/workout";
+import { createHash } from "node:crypto";
+import * as WebdaError from "../errors/errors.js";
+import { useModel } from "../application/hooks.js";
+import { useDynamicService, useModelMetadata } from "../core/hooks.js";
+/**
+ * The CryptoService, resolved at call time (a static import would make a cycle through the operations module)
+ * @returns the CryptoService
+ */
+function useCrypto() {
+    return useDynamicService("CryptoService");
+}
+/**
+ * The static `canAct(context, action, object?)` of one model class
+ *
+ * When the class defines none (a plain object in a unit test, a class built without `@webda/models`), the base
+ * {@link Model.canAct} semantics apply: delegate to the instance `canAct(context, action)`, otherwise deny.
+ * @param clazz - the model class
+ * @returns the static check, bound to its class
+ */
+function staticCanActOf(clazz) {
+    if (typeof clazz?.canAct === "function") {
+        return (context, action, target) => clazz.canAct(context, action, target);
+    }
+    return (context, action, target) => Model.canAct(context, action, target);
+}
+/**
+ * The permission check of an object reached through a model class: the one framework entry point
+ *
+ * Stores are polymorphic: an object reached through a model class (the route or query class) may belong to a
+ * subclass with its own policy. The action is then allowed only when BOTH the reached class and the object's own
+ * class allow it, `ReachedModel.canAct(ctx, action, object)` first. When the two are the same class (or there is
+ * no object, as for a static action) the class is asked once.
+ * @param model - the model class the object is reached through, when known
+ * @param object - the object, if any
+ * @returns the check
+ */
+function staticCanAct(model, object) {
+    const own = object !== undefined && object !== null ? object.constructor : undefined;
+    const reached = model ?? own;
+    const classes = [reached];
+    if (typeof model === "function" && own && own !== model && own !== Object) {
+        if (!(object instanceof model)) {
+            // A row of an unrelated class (a misconfigured shared repository): it is not an object of the reached model
+            return () => `not a ${model.name}`;
+        }
+        classes.push(own);
+    }
+    const checks = classes.map(staticCanActOf);
+    if (checks.length === 1) {
+        return checks[0];
+    }
+    return async (context, action, target) => {
+        for (const check of checks) {
+            const allowed = await check(context, action, target);
+            if (allowed !== true) {
+                return allowed;
+            }
+        }
+        return true;
+    };
+}
+/**
+ * Whether a model class defines a static `canAct` of its own (not the base one)
+ * @param model - the model class
+ * @returns true when the static form is overridden
+ */
+export function hasStaticPermissionCheck(model) {
+    return typeof model?.canAct === "function" && model.canAct !== Model.canAct;
+}
+/**
+ * Whether a model class defines a permission check at all: a static `canAct` of its own (not the base one), or an
+ * instance `canAct`. A model with neither is refused on every transport. Subclasses with their own check do not
+ * open a class that has none: an object reached through a class must be allowed by that class too
+ * @param model - the model class
+ * @returns true when the model defines one of the two forms
+ */
+export function hasModelPermissionCheck(model) {
+    return hasStaticPermissionCheck(model) || typeof model?.prototype?.canAct === "function";
+}
+/**
+ * Run a check, turning a thrown error into a refusal: an error must not answer differently from a refusal, or it
+ * would reveal that the object exists (non-HTTP errors are logged at WARN)
+ * @param check - the static canAct
+ * @param context - the caller context
+ * @param action - the action
+ * @param object - the object, if any
+ * @returns true when allowed, otherwise the refusal (a reason string or false)
+ */
+async function askPermission(check, context, action, object) {
+    try {
+        const allowed = await check(context, action, object);
+        if (allowed === true) {
+            return true;
+        }
+        return allowed === false || allowed === undefined || allowed === null ? false : allowed;
+    }
+    catch (err) {
+        if (!(err instanceof WebdaError.HttpError)) {
+            useLog("WARN", `canAct('${action}') failed on ${object?.constructor?.name ?? "model"}`, err);
+        }
+        return err?.message ?? false;
+    }
+}
+/**
+ * Ask the model whether the current caller may perform `action` on an object
+ *
+ * The question goes through the static `canAct(context, action, object)` of the model class (see
+ * {@link Model.canAct}): the base implementation delegates to the object's instance `canAct`, and denies when there
+ * is none. `true` allows; anything else (`false`, a refusal reason string, `undefined`...) refuses, and so does a
+ * `canAct` that throws.
+ *
+ * @param object - the model instance (the new, unsaved object on create)
+ * @param context - the caller context
+ * @param action - the action name ("get", "create", "update", "delete", an action name or "attribute.action")
+ * @param model - the model class (defaults to the object's class)
+ * @returns true when allowed, otherwise the refusal (a reason string or false)
+ */
+export async function getModelPermission(object, context, action, model) {
+    return askPermission(staticCanAct(model, object), context, action, object);
+}
+/**
+ * Whether the current caller may perform `action` on a model instance (see {@link checkModelPermission}); it never
+ * throws
+ * @param object - the model instance
+ * @param context - the caller context
+ * @param action - the action name
+ * @param model - the model class (defaults to the object's class)
+ * @returns true when allowed
+ */
+export async function isModelActionAllowed(object, context, action, model) {
+    return (await getModelPermission(object, context, action, model)) === true;
+}
+/**
+ * Message of the NotFound error for a missing object, also used for an object the caller may not read
+ */
+export const NOT_FOUND_MESSAGE = "Object not found";
+/**
+ * Load an object for an action as the caller: a missing object and an object the caller may not read throw the same
+ * `NotFound("Object not found")`; a readable object whose action is refused throws `Forbidden`
+ * @param model - the model class
+ * @param key - the primary key
+ * @param context - the caller context
+ * @param action - the action ("get" to only read)
+ * @returns the object
+ */
+export async function loadModelForAction(model, key, context, action) {
+    let object;
+    try {
+        object = await model.ref(key).get();
+    }
+    catch {
+        // Repositories throw when the object does not exist
+    }
+    if (!object || object.isDeleted?.()) {
+        throw new WebdaError.NotFound(NOT_FOUND_MESSAGE);
+    }
+    await checkModelPermission(object, context, action, model);
+    return object;
+}
+/**
+ * The parent relation (`ModelParent`) of a model, if any
+ * @param model - the model class
+ * @returns the parent attribute and model identifier
+ */
+export function getParentRelation(model) {
+    try {
+        return useModelMetadata(model)?.Relations?.parent;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * A child can only be attached to a parent the caller may read: a missing parent and an unreadable one throw the same
+ * `NotFound("Object not found")`
+ * @param model - the child model class
+ * @param parentId - the parent primary key
+ * @param context - the caller context
+ */
+export async function checkModelParent(model, parentId, context) {
+    const parent = getParentRelation(model);
+    if (!parent || parentId === undefined || parentId === null || parentId === "") {
+        return;
+    }
+    let parentModel;
+    try {
+        parentModel = useModel(parent.model);
+    }
+    catch {
+        // Unknown parent model: treated as a missing parent
+    }
+    if (!parentModel) {
+        throw new WebdaError.NotFound(NOT_FOUND_MESSAGE);
+    }
+    await loadModelForAction(parentModel, parentId, context, "get");
+}
+/**
+ * When an update moves an object to another parent, the caller must be able to read the new parent
+ * @param model - the model class
+ * @param object - the stored object
+ * @param input - the sanitized update input
+ * @param context - the caller context
+ */
+export async function checkModelReparent(model, object, input, context) {
+    const parent = getParentRelation(model);
+    const value = parent ? input?.[parent.attribute] : undefined;
+    if (value === undefined || value === null || String(value) === String(object?.[parent.attribute] ?? "")) {
+        return;
+    }
+    await checkModelParent(model, value, context);
+}
+/**
+ * Enforce a model's permission for an action on an object: the single check used by every client path (REST, gRPC,
+ * MCP, GraphQL and any transport dispatching operations)
+ *
+ * A caller who may not read the object (`canAct(ctx, "get", object)` refused) gets exactly the error of a missing
+ * object (`NotFound("Object not found")`), whatever the action, so a refusal never reveals that the key exists. A
+ * caller who may read the object but not perform the action gets a `Forbidden`. On `"create"` the object does not
+ * exist yet: a refusal is always a `Forbidden`.
+ *
+ * The refusal reason returned by `canAct` is logged, never sent to the client.
+ *
+ * @param object - the model instance
+ * @param context - the caller context
+ * @param action - the action name
+ * @param model - the model class (defaults to the object's class)
+ * @throws WebdaError.NotFound when the caller may not read the object
+ * @throws WebdaError.Forbidden when the caller may read the object but not perform the action
+ */
+export async function checkModelPermission(object, context, action, model) {
+    const check = staticCanAct(model, object);
+    const allowed = await askPermission(check, context, action, object);
+    if (allowed === true) {
+        return;
+    }
+    useLog("DEBUG", `Permission refused for '${action}' on ${object?.constructor?.name ?? "object"}`, typeof allowed === "string" ? allowed : "");
+    if (action !== "create" && (action === "get" || (await askPermission(check, context, "get", object)) !== true)) {
+        throw new WebdaError.NotFound(NOT_FOUND_MESSAGE);
+    }
+    throw new WebdaError.Forbidden(`Action ${action} not allowed`);
+}
+/**
+ * Enforce a model's permission for a static (class-level) action: `canAct(context, action)` without object
+ *
+ * There is no object to hide, so a refusal is always a `Forbidden`.
+ * @param model - the model class
+ * @param context - the caller context
+ * @param action - the action name
+ * @throws WebdaError.Forbidden when refused
+ */
+export async function checkStaticModelPermission(model, context, action) {
+    const allowed = await askPermission(staticCanAct(model), context, action, undefined);
+    if (allowed === true) {
+        return;
+    }
+    useLog("DEBUG", `Permission refused for static '${action}' on ${model?.name ?? "model"}`, typeof allowed === "string" ? allowed : "");
+    throw new WebdaError.Forbidden(`Action ${action} not allowed`);
+}
+/**
+ * Persist a new object with the repository `create`, which refuses an existing key (atomically in every bundled
+ * repository), instead of `save()`, which upserts
+ * @param object - the new model instance
+ * @returns the object
+ * @throws WebdaError.Conflict when an object with the same primary key exists
+ */
+export async function createModel(object) {
+    try {
+        await object.getRepository().create(object);
+    }
+    catch (err) {
+        if (/^Already exists/.test(`${err?.message}`)) {
+            throw new WebdaError.Conflict("Object already exists");
+        }
+        throw err;
+    }
+    return object;
+}
+/**
+ * AND the model's permission query into a client query
+ *
+ * Both sides are parsed and combined on the expression tree, so a client `OR` keeps its precedence. The client
+ * ORDER BY, LIMIT and OFFSET are kept.
+ *
+ * @param query - the client query
+ * @param permission - the permission query, if any
+ * @returns the query to run
+ * @throws SyntaxError if the client query is invalid
+ */
+export function mergePermissionQuery(query, permission) {
+    if (!permission?.query) {
+        return query;
+    }
+    return new QueryValidator(query ?? "").merge(permission.query, "AND").toString();
+}
+/**
+ * Highest LIMIT a client query can ask for: larger LIMITs are lowered to it
+ */
+export const MAX_QUERY_LIMIT = 1000;
+/**
+ * Rows a permission-filtered query scans to fill one page: ten times the page LIMIT, at least
+ * {@link MIN_SCANNED_ROWS}, at most {@link MAX_SCANNED_ROWS}
+ */
+export const SCAN_FACTOR = 10;
+/**
+ * Lower bound of the scan budget of a permission-filtered page
+ */
+export const MIN_SCANNED_ROWS = 100;
+/**
+ * Absolute bound of the scan budget of a permission-filtered page
+ */
+export const MAX_SCANNED_ROWS = 10000;
+/**
+ * Most store pages read to fill one page, whatever their size
+ */
+export const MAX_REFILL_PAGES = 100;
+/**
+ * Lifetime of a continuation token (one hour): paging has to resume within it
+ */
+export const CONTINUATION_TOKEN_TTL_MS = 60 * 60 * 1000;
+/**
+ * Refuse a client query that reads private (`__`-prefixed) fields, at any depth, in its filter or ORDER BY: a filter
+ * on a private field (a password hash...) would reveal its value through which rows match. The field list of a
+ * SELECT and the targets of an UPDATE SET are checked too.
+ * @param query - the parsed client query
+ * @throws WebdaError.BadRequest when a field path has a `__`-prefixed segment
+ */
+export function assertNoPrivateFields(query) {
+    const isPrivate = (path) => path.some(segment => segment.startsWith("__"));
+    const visit = (expression) => {
+        if (expression instanceof LogicalExpression) {
+            expression.children.forEach(visit);
+        }
+        else if (expression instanceof ComparisonExpression && isPrivate(expression.attribute)) {
+            throw new WebdaError.BadRequest("Private fields cannot be queried");
+        }
+    };
+    visit(query.getExpression());
+    const parsed = query.getQuery();
+    if ([
+        ...(parsed.orderBy ?? []).map(o => o.field),
+        ...(parsed.fields ?? []),
+        ...(parsed.assignments ?? []).map(a => a.field)
+    ]
+        .map(field => field.split("."))
+        .some(isPrivate)) {
+        throw new WebdaError.BadRequest("Private fields cannot be queried");
+    }
+}
+/**
+ * Refuse what the Query operations do not run: DELETE and UPDATE statements, and SELECT field lists
+ *
+ * Statements are parsed by WebdaQL and run by the repositories (`deleteMany`, `updateMany`), never through the
+ * Query operations exposed to clients (REST, gRPC, MCP, GraphQL): those take a filter query only.
+ * @param query - the parsed client query
+ * @throws WebdaError.BadRequest for a DELETE or UPDATE statement, or a SELECT field list
+ */
+export function assertFilterOnly(query) {
+    const { type, fields } = query.getQuery();
+    if (type === "DELETE" || type === "UPDATE") {
+        throw new WebdaError.BadRequest(`${type} statements are not accepted by queries`);
+    }
+    if (fields !== undefined) {
+        throw new WebdaError.BadRequest("SELECT field lists are not accepted by queries");
+    }
+}
+/**
+ * Type tag of a sealed continuation token, so no other ciphertext of the application can be sent as one
+ */
+const TOKEN_TYPE = "webda-query-token";
+/**
+ * @param binding - the token binding
+ * @returns the short hash of the query
+ */
+function queryHash(binding) {
+    return createHash("sha256").update(binding.query).digest("base64url").substring(0, 32);
+}
+/**
+ * Seal a store continuation token: encrypted with the CryptoService (random IV, padded to 64 bytes) so its value
+ * cannot be read, compared or forged by the client; bound to the model, the query and the caller; and expiring
+ * after `ttl` ({@link CONTINUATION_TOKEN_TTL_MS})
+ * @param token - the store token
+ * @param binding - what the token is bound to
+ * @param ttl - lifetime in milliseconds
+ * @returns the opaque token
+ */
+export async function sealContinuationToken(token, binding, ttl = CONTINUATION_TOKEN_TTL_MS) {
+    const payload = {
+        typ: TOKEN_TYPE,
+        t: token,
+        m: binding.model,
+        q: queryHash(binding),
+        u: binding.user,
+        exp: Date.now() + ttl,
+        p: ""
+    };
+    const base = JSON.stringify(payload).length;
+    return useCrypto().encrypt({ ...payload, p: "=".repeat((64 - (base % 64)) % 64) });
+}
+/**
+ * Open a token produced by {@link sealContinuationToken}
+ * @param token - the opaque token
+ * @param binding - what the token must be bound to
+ * @returns the store token
+ * @throws WebdaError.BadRequest when the token was not produced by this application for this model, query and
+ * caller, or has expired
+ */
+export async function unsealContinuationToken(token, binding) {
+    let data;
+    try {
+        data = await useCrypto().decrypt(token);
+    }
+    catch {
+        // Invalid, forged or expired key
+    }
+    if (data?.typ === TOKEN_TYPE &&
+        typeof data.t === "string" &&
+        data.m === binding.model &&
+        data.q === queryHash(binding) &&
+        data.u === binding.user &&
+        typeof data.exp === "number" &&
+        data.exp > Date.now()) {
+        return data.t;
+    }
+    throw new WebdaError.BadRequest("Invalid continuation token");
+}
+/**
+ * @param model - the model class
+ * @returns its identifier, or its class name for classes registered without metadata
+ */
+function modelIdentifier(model) {
+    try {
+        return useModelMetadata(model)?.Identifier ?? model?.name ?? "model";
+    }
+    catch {
+        return model?.name ?? "model";
+    }
+}
+/**
+ * Query a model as the caller
+ *
+ * - the client query may not read private (`__`) fields (400), and its LIMIT is lowered to {@link MAX_QUERY_LIMIT};
+ * - the client query is a filter: DELETE, UPDATE and SELECT field lists are refused (400, {@link assertFilterOnly});
+ * - a model defining neither `canAct` form refuses every row: the store is not asked;
+ * - the model's static `getPermissionQuery(context)` is ANDed into the query;
+ * - every result is checked with the static `canAct(context, "get", row)` and refused ones are dropped. Refused rows
+ *   are replaced by continuing the scan (next store pages, asking only for the missing rows), within a budget of
+ *   `SCAN_FACTOR` x LIMIT rows (between `MIN_SCANNED_ROWS` and `MAX_SCANNED_ROWS`) and {@link MAX_REFILL_PAGES}
+ *   store pages. When the budget is spent, an empty page carries no token;
+ * - the continuation token is sealed ({@link sealContinuationToken}): a store token counting or naming rows
+ *   (Postgres/Firestore offsets, Dynamo keys, memory offsets) would otherwise reveal hidden matches. It is bound to
+ *   the model, the query and the caller, expires after {@link CONTINUATION_TOKEN_TTL_MS}, and is sent back as is in
+ *   `OFFSET`; any other value is a 400.
+ *
+ * @param model - the model class
+ * @param query - the client query
+ * @param context - the caller context
+ * @returns the query results the caller may read
+ */
+export async function queryModelWithPermissions(model, query, context) {
+    const client = new QueryValidator(query ?? "");
+    assertNoPrivateFields(client);
+    assertFilterOnly(client);
+    if (!hasModelPermissionCheck(model)) {
+        // Deny by default: no row can be read, the store is not even asked
+        return { results: [], continuationToken: undefined };
+    }
+    const limit = Math.min(client.getLimit(), MAX_QUERY_LIMIT);
+    const permission = typeof model.getPermissionQuery === "function" ? model.getPermissionQuery(context) : undefined;
+    const merged = new QueryValidator(mergePermissionQuery(query ?? "", permission));
+    // The query without its LIMIT and OFFSET: filter and ORDER BY
+    const orderBy = (merged.getQuery().orderBy ?? []).map(o => `${o.field} ${o.direction}`).join(", ");
+    const base = `${merged.getExpression().toString()}${orderBy ? ` ORDER BY ${orderBy}` : ""}`.trim();
+    const binding = {
+        model: modelIdentifier(model),
+        query: base,
+        user: context.getCurrentUserId() || "anonymous"
+    };
+    let offset = client.getOffset();
+    if (offset) {
+        offset = await unsealContinuationToken(offset, binding);
+    }
+    /**
+     * @param count - the LIMIT
+     * @param token - the store OFFSET
+     * @returns the query to send to the store
+     */
+    const page = (count, token) => new QueryValidator(base).merge(`LIMIT ${count}${token ? ` OFFSET ${JSON.stringify(token)}` : ""}`).toString();
+    const budget = Math.min(Math.max(limit * SCAN_FACTOR, MIN_SCANNED_ROWS), MAX_SCANNED_ROWS);
+    const results = [];
+    let scanned = 0;
+    let pages = 1;
+    let res = await model.query(page(limit, offset));
+    let token;
+    while (true) {
+        const rows = res.results ?? [];
+        scanned += rows.length;
+        // Each row is checked with the queried class and, for a subclass row, its own class too
+        const readable = await Promise.all(rows.map(async (r) => (await askPermission(staticCanAct(model, r), context, "get", r)) === true));
+        results.push(...rows.filter((_r, i) => readable[i]));
+        token = res.continuationToken;
+        if (!token || results.length >= limit) {
+            // Store exhausted, or page full
+            break;
+        }
+        if (scanned >= budget || pages >= MAX_REFILL_PAGES || rows.length === 0) {
+            // Budget spent, or a store that does not progress: a token on an empty page would only reveal hidden matches
+            token = results.length ? token : undefined;
+            break;
+        }
+        // Refill: continue after the last scanned row, asking only for the rows still missing
+        pages++;
+        res = await model.query(page(Math.min(limit - results.length, budget - scanned), token));
+    }
+    return {
+        results,
+        continuationToken: token ? await sealContinuationToken(String(token), binding) : undefined
+    };
+}
+//# sourceMappingURL=permissions.js.map

package/lib/models/permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../src/models/permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,cAAc,EAAmB,MAAM,WAAW,CAAC;AACrG,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,KAAK,UAAU,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAGvE;;;GAGG;AACH,SAAS,SAAS;IAChB,OAAO,iBAAiB,CAAgB,eAAe,CAAC,CAAC;AAC3D,CAAC;AAqBD;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,KAAU;IAChC,IAAI,OAAO,KAAK,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;QACxC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,YAAY,CAAC,KAAU,EAAE,MAAY;IAC5C,MAAM,GAAG,GAAG,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;IACrF,MAAM,OAAO,GAAG,KAAK,IAAI,GAAG,CAAC;IAC7B,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,CAAC;IAC1B,IAAI,OAAO,KAAK,KAAK,UAAU,IAAI,GAAG,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QAC1E,IAAI,CAAC,CAAC,MAAM,YAAY,KAAK,CAAC,EAAE,CAAC;YAC/B,4GAA4G;YAC5G,OAAO,GAAG,EAAE,CAAC,SAAS,KAAK,CAAC,IAAI,EAAE,CAAC;QACrC,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;QACvC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YACrD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,OAAO,OAAO,CAAC;YACjB,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAU;IACjD,OAAO,OAAO,KAAK,EAAE,MAAM,KAAK,UAAU,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC;AAC9E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAU;IAChD,OAAO,wBAAwB,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,KAAK,UAAU,CAAC;AAC3F,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,aAAa,CAC1B,KAAsB,EACtB,OAA0B,EAC1B,MAAc,EACd,MAAY;IAEZ,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACrD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,OAAO,KAAK,KAAK,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC;IAC1F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,CAAC,GAAG,YAAY,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3C,MAAM,CAAC,MAAM,EAAE,WAAW,MAAM,gBAAgB,MAAM,EAAE,WAAW,EAAE,IAAI,IAAI,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;QAC/F,CAAC;QACD,OAAO,GAAG,EAAE,OAAO,IAAI,KAAK,CAAC;IAC/B,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAW,EACX,OAA0B,EAC1B,MAAc,EACd,KAAW;IAEX,OAAO,aAAa,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAW,EACX,OAA0B,EAC1B,MAAc,EACd,KAAW;IAEX,OAAO,CAAC,MAAM,kBAAkB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC;AAC7E,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,kBAAkB,CAAC;AAEpD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAU,EACV,GAAQ,EACR,OAA0B,EAC1B,MAAc;IAEd,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,oDAAoD;IACtD,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,EAAE,EAAE,EAAE,CAAC;QACpC,MAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,oBAAoB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAC3D,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAU;IAC1C,IAAI,CAAC;QACH,OAAO,gBAAgB,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAU,EAAE,QAAa,EAAE,OAA0B;IAC1F,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC9E,OAAO;IACT,CAAC;IACD,IAAI,WAAgB,CAAC;IACrB,IAAI,CAAC;QACH,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,oDAAoD;IACtD,CAAC;IACD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAAU,EAAE,MAAW,EAAE,KAAU,EAAE,OAA0B;IACtG,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QACxG,OAAO;IACT,CAAC;IACD,MAAM,gBAAgB,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAW,EACX,OAA0B,EAC1B,MAAc,EACd,KAAW;IAEX,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACpE,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO;IACT,CAAC;IACD,MAAM,CACJ,OAAO,EACP,2BAA2B,MAAM,QAAQ,MAAM,EAAE,WAAW,EAAE,IAAI,IAAI,QAAQ,EAAE,EAChF,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAC3C,CAAC;IACF,IAAI,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,MAAM,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;QAC/G,MAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,IAAI,UAAU,CAAC,SAAS,CAAC,UAAU,MAAM,cAAc,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAAU,EAAE,OAA0B,EAAE,MAAc;IACrG,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IACrF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO;IACT,CAAC;IACD,MAAM,CACJ,OAAO,EACP,kCAAkC,MAAM,QAAQ,KAAK,EAAE,IAAI,IAAI,OAAO,EAAE,EACxE,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAC3C,CAAC;IACF,MAAM,IAAI,UAAU,CAAC,SAAS,CAAC,UAAU,MAAM,cAAc,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAU,MAAS;IAClD,IAAI,CAAC;QACH,MAAO,MAAc,CAAC,aAAa,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa,EAAE,UAAmC;IACrF,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,cAAc,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC;AACnF,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC;AACpC;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC;AAC9B;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,CAAC;AACpC;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,CAAC;AACtC;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,CAAC;AACpC;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAExD;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAqB;IACzD,MAAM,SAAS,GAAG,CAAC,IAAc,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACrF,MAAM,KAAK,GAAG,CAAC,UAAsB,EAAQ,EAAE;QAC7C,IAAI,UAAU,YAAY,iBAAiB,EAAE,CAAC;YAC5C,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;aAAM,IAAI,UAAU,YAAY,oBAAoB,IAAI,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACzF,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,kCAAkC,CAAC,CAAC;QACtE,CAAC;IACH,CAAC,CAAC;IACF,KAAK,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC;IAC7B,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;IAChC,IACE;QACE,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;QAC3C,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;QACxB,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;KAChD;SACE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;SAC9B,IAAI,CAAC,SAAS,CAAC,EAClB,CAAC;QACD,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,kCAAkC,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAqB;IACpD,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;IAC1C,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC3C,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,IAAI,yCAAyC,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,gDAAgD,CAAC,CAAC;IACpF,CAAC;AACH,CAAC;AAqBD;;GAEG;AACH,MAAM,UAAU,GAAG,mBAAmB,CAAC;AAEvC;;;GAGG;AACH,SAAS,SAAS,CAAC,OAAiC;IAClD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACzF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAa,EACb,OAAiC,EACjC,GAAG,GAAW,yBAAyB;IAEvC,MAAM,OAAO,GAAG;QACd,GAAG,EAAE,UAAU;QACf,CAAC,EAAE,KAAK;QACR,CAAC,EAAE,OAAO,CAAC,KAAK;QAChB,CAAC,EAAE,SAAS,CAAC,OAAO,CAAC;QACrB,CAAC,EAAE,OAAO,CAAC,IAAI;QACf,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG;QACrB,CAAC,EAAE,EAAE;KACN,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;IAC5C,OAAO,SAAS,EAAE,CAAC,OAAO,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;AACrF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAAa,EAAE,OAAiC;IAC5F,IAAI,IAAS,CAAC;IACd,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,iCAAiC;IACnC,CAAC;IACD,IACE,IAAI,EAAE,GAAG,KAAK,UAAU;QACxB,OAAO,IAAI,CAAC,CAAC,KAAK,QAAQ;QAC1B,IAAI,CAAC,CAAC,KAAK,OAAO,CAAC,KAAK;QACxB,IAAI,CAAC,CAAC,KAAK,SAAS,CAAC,OAAO,CAAC;QAC7B,IAAI,CAAC,CAAC,KAAK,OAAO,CAAC,IAAI;QACvB,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ;QAC5B,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EACrB,CAAC;QACD,OAAO,IAAI,CAAC,CAAC,CAAC;IAChB,CAAC;IACD,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,4BAA4B,CAAC,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,KAAU;IACjC,IAAI,CAAC;QACH,OAAO,gBAAgB,CAAC,KAAK,CAAC,EAAE,UAAU,IAAI,KAAK,EAAE,IAAI,IAAI,OAAO,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,EAAE,IAAI,IAAI,OAAO,CAAC;IAChC,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAAU,EACV,KAAa,EACb,OAA0B;IAE1B,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAC/C,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC9B,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACzB,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;QACpC,mEAAmE;QACnE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,iBAAiB,EAAE,SAAS,EAAE,CAAC;IACvD,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,eAAe,CAAC,CAAC;IAC3D,MAAM,UAAU,GACd,OAAO,KAAK,CAAC,kBAAkB,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjG,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,oBAAoB,CAAC,KAAK,IAAI,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;IACjF,8DAA8D;IAC9D,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnG,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,aAAa,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;IACnG,MAAM,OAAO,GAA6B;QACxC,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC;QAC7B,KAAK,EAAE,IAAI;QACX,IAAI,EAAE,OAAO,CAAC,gBAAgB,EAAE,IAAI,WAAW;KAChD,CAAC;IACF,IAAI,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;IAChC,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,GAAG,MAAM,uBAAuB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;IACD;;;;OAIG;IACH,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,KAAc,EAAE,EAAE,CAC7C,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,SAAS,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IAChH,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,WAAW,EAAE,gBAAgB,CAAC,EAAE,gBAAgB,CAAC,CAAC;IAC3F,MAAM,OAAO,GAAQ,EAAE,CAAC;IACxB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,GAAG,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;IACjD,IAAI,KAAyB,CAAC;IAC9B,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;QAC/B,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC;QACvB,wFAAwF;QACxF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAC,CAAC,EAAC,EAAE,CAAC,CAAC,MAAM,aAAa,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAC/F,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrD,KAAK,GAAG,GAAG,CAAC,iBAAiB,CAAC;QAC9B,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC;YACtC,gCAAgC;YAChC,MAAM;QACR,CAAC;QACD,IAAI,OAAO,IAAI,MAAM,IAAI,KAAK,IAAI,gBAAgB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxE,6GAA6G;YAC7G,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;YAC3C,MAAM;QACR,CAAC;QACD,sFAAsF;QACtF,KAAK,EAAE,CAAC;QACR,GAAG,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO;QACL,OAAO;QACP,iBAAiB,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,qBAAqB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;KAC3F,CAAC;AACJ,CAAC"}

package/lib/models/rolemodel.model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rolemodel.model.d.ts","sourceRoot":"","sources":["../../src/models/rolemodel.model.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAIjE,8EAA8E;AAC9E,uBAAe,SAAU,SAAQ,KAAK;IACpC,QAAQ,CAAC,WAAW,IAAI;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAC;IAElD;;;OAGG;IACH,YAAY,IAAI,OAAO,CAEtB;IAED;;;;OAIG;IACG,QAAQ,CAAC,GAAG,EAAE,iBAAiB,gBAYpC;IAED;;;;;OAKG;IACG,MAAM,CAAC,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,CAalF;CACF;AAED,OAAO,EAAE,SAAS,EAAE,CAAC"}
+{"version":3,"file":"rolemodel.model.d.ts","sourceRoot":"","sources":["../../src/models/rolemodel.model.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAGjE,8EAA8E;AAC9E,uBAAe,SAAU,SAAQ,KAAK;IACpC,QAAQ,CAAC,WAAW,IAAI;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAC;IAElD;;;OAGG;IACH,YAAY,IAAI,OAAO,CAEtB;IAED;;;;OAIG;IACG,QAAQ,CAAC,GAAG,EAAE,iBAAiB,gBAYpC;IAED;;;;;OAKG;IACG,MAAM,CAAC,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,CAalF;CACF;AAED,OAAO,EAAE,SAAS,EAAE,CAAC"}

package/lib/models/rolemodel.model.js

@@ -1,6 +1,5 @@
 import { Model } from "@webda/models";
 import * as WebdaError from "../errors/errors.js";
-import { useContext } from "../contexts/execution.js";
 /** Model with role-based access control, mapping actions to required roles */
 class RoleModel extends Model {
     /**
@@ -42,7 +41,7 @@ class RoleModel extends Model {
             }
             return "No permission for this action defined";
         }
-        const roles = await this.getRoles(useContext());
+        const roles = await this.getRoles(context);
         if (roles.indexOf(this.getRolesMap()[action]) >= 0) {
             return true;
         }

package/lib/models/rolemodel.model.js.map

@@ -1 +1 @@
-{"version":3,"file":"rolemodel.model.js","sourceRoot":"","sources":["../../src/models/rolemodel.model.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAEtC,OAAO,KAAK,UAAU,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAEtD,8EAA8E;AAC9E,MAAe,SAAU,SAAQ,KAAK;IAGpC;;;OAGG;IACH,YAAY;QACV,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CAAC,GAAsB;QACnC,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,EAAE,CAAC;YAC5B,MAAM,IAAI,UAAU,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC5C,CAAC;QACD,iCAAiC;QACjC,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,CAAC;YAC3B,OAAO,GAAG,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC;QAChC,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,cAAc,EAAE,CAAC;QACxC,yBAAyB;QACzB,GAAG,CAAC,UAAU,EAAE,CAAC,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QACzC,OAAO,GAAG,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CAAC,OAA0B,EAAE,MAAc;QACrD,sCAAsC;QACtC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;YAChC,IAAI,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;gBACxB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,uCAAuC,CAAC;QACjD,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;QAChD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACnD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,eAAe,CAAC;IACzB,CAAC;CACF;AAED,OAAO,EAAE,SAAS,EAAE,CAAC"}
+{"version":3,"file":"rolemodel.model.js","sourceRoot":"","sources":["../../src/models/rolemodel.model.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAEtC,OAAO,KAAK,UAAU,MAAM,qBAAqB,CAAC;AAElD,8EAA8E;AAC9E,MAAe,SAAU,SAAQ,KAAK;IAGpC;;;OAGG;IACH,YAAY;QACV,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CAAC,GAAsB;QACnC,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,EAAE,CAAC;YAC5B,MAAM,IAAI,UAAU,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC5C,CAAC;QACD,iCAAiC;QACjC,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,CAAC;YAC3B,OAAO,GAAG,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC;QAChC,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,cAAc,EAAE,CAAC;QACxC,yBAAyB;QACzB,GAAG,CAAC,UAAU,EAAE,CAAC,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QACzC,OAAO,GAAG,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CAAC,OAA0B,EAAE,MAAc;QACrD,sCAAsC;QACtC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;YAChC,IAAI,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;gBACxB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,uCAAuC,CAAC;QACjD,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACnD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,eAAe,CAAC;IACzB,CAAC;CACF;AAED,OAAO,EAAE,SAAS,EAAE,CAAC"}

package/lib/models/user.model.d.ts

@@ -86,6 +86,18 @@ export declare class User extends UuidModel {
      * @returns the result string
      */
     getDisplayName(): string;
+    /**
+     * Store filter matching {@link User.canAct}: a caller only finds its own user, so users cannot be enumerated
+     *
+     * Subclasses inherit this filter even when they override `canAct` (it fails closed: it can only hide rows). A
+     * subclass whose `canAct` is more permissive overrides this method (returning `null` disables the store filter).
+     * @param context - the caller context
+     * @returns the permission query
+     */
+    static getPermissionQuery(context?: IOperationContext): null | {
+        partial: boolean;
+        query: string;
+    };
     /**
      * Only the user themselves can act on their own object
      * @param ctx - the operation context

package/lib/models/user.model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.model.d.ts","sourceRoot":"","sources":["../../src/models/user.model.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAsB,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,KAAK,UAAU,EAAE,KAAK,WAAW,EAAE,KAAK,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE1G,MAAM,MAAM,UAAU,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,GAAG;IAC3C,KAAK,EAAE;QAAE,IAAI,EAAE,CAAC,CAAA;KAAE,CAAC;IACnB,MAAM,EAAE;QAAE,IAAI,EAAE,CAAC,CAAA;KAAE,CAAC;CACrB,CAAC;AACF;;;;GAIG;AACH,qBAAa,IAAK,SAAQ,SAAS;IACjC,CAAC,YAAY,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;IACjC;;OAEG;IACH,YAAY,IAAI,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,EAShC;IAED;;OAEG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAC;IAEpB;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,KAAK;IASpB;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,MAAM;IASrB;;;;;OAKG;IACH,MAAM,CAAC,WAAW,CAAC,CAAC,SAAS,UAAU,EAAE,CAAC,SAAS,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC,GAAG,CAAC,CAKhH;IACD;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;;;OAIG;IACH,aAAa,IAAI,GAAG,CAOnB;IAED;;;OAGG;IACH,QAAQ,IAAI,MAAM,GAAG,SAAS,CAE7B;IAED;;;OAGG;IACH,SAAS,IAAI,MAAM,EAAE,CAEpB;IAED;;;OAGG;IACH,QAAQ,IAAI,MAAM,EAAE,CAEnB;IAED;;;OAGG;IACH,cAAc,IAAI,MAAM,CAEvB;IAED;;;;;OAKG;IACG,MAAM,CAAC,GAAG,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,CAK9E;IAED;;;OAGG;IACH,QAAQ,WAEP;IACD,SAAS,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,GAAG,GAAG,IAAI,CAiBhD;CACF"}
+{"version":3,"file":"user.model.d.ts","sourceRoot":"","sources":["../../src/models/user.model.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,OAAO,EAAE,QAAQ,EAAsB,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,KAAK,UAAU,EAAE,KAAK,WAAW,EAAE,KAAK,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE1G,MAAM,MAAM,UAAU,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,GAAG;IAC3C,KAAK,EAAE;QAAE,IAAI,EAAE,CAAC,CAAA;KAAE,CAAC;IACnB,MAAM,EAAE;QAAE,IAAI,EAAE,CAAC,CAAA;KAAE,CAAC;CACrB,CAAC;AACF;;;;GAIG;AACH,qBAAa,IAAK,SAAQ,SAAS;IACjC,CAAC,YAAY,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;IACjC;;OAEG;IACH,YAAY,IAAI,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,EAShC;IAED;;OAEG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAC;IAEpB;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,KAAK;IASpB;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,MAAM;IASrB;;;;;OAKG;IACH,MAAM,CAAC,WAAW,CAAC,CAAC,SAAS,UAAU,EAAE,CAAC,SAAS,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC,GAAG,CAAC,CAKhH;IACD;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;;;OAIG;IACH,aAAa,IAAI,GAAG,CAOnB;IAED;;;OAGG;IACH,QAAQ,IAAI,MAAM,GAAG,SAAS,CAE7B;IAED;;;OAGG;IACH,SAAS,IAAI,MAAM,EAAE,CAEpB;IAED;;;OAGG;IACH,QAAQ,IAAI,MAAM,EAAE,CAEnB;IAED;;;OAGG;IACH,cAAc,IAAI,MAAM,CAEvB;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,iBAAiB,GAAG,IAAI,GAAG;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAMjG;IAED;;;;;OAKG;IACG,MAAM,CAAC,GAAG,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,CAK9E;IAED;;;OAGG;IACH,QAAQ,WAEP;IACD,SAAS,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,GAAG,GAAG,IAAI,CAiBhD;CACF"}

package/lib/models/user.model.js

@@ -1,4 +1,5 @@
 import { WEBDA_STORAGE } from "@webda/models";
+import { bind } from "@webda/ql";
 import { Password, V3_PASSWORD_MAPPED } from "./password.model.js";
 import { UuidModel, WEBDA_EVENTS } from "@webda/models";
 /**
@@ -123,6 +124,21 @@ export class User extends UuidModel {
     getDisplayName() {
         return this.displayName;
     }
+    /**
+     * Store filter matching {@link User.canAct}: a caller only finds its own user, so users cannot be enumerated
+     *
+     * Subclasses inherit this filter even when they override `canAct` (it fails closed: it can only hide rows). A
+     * subclass whose `canAct` is more permissive overrides this method (returning `null` disables the store filter).
+     * @param context - the caller context
+     * @returns the permission query
+     */
+    static getPermissionQuery(context) {
+        if (!context) {
+            return null;
+        }
+        const userId = context.getCurrentUserId();
+        return { query: userId ? bind("uuid = ?", [userId]) : "FALSE", partial: false };
+    }
     /**
      * Only the user themselves can act on their own object
      * @param ctx - the operation context

package/lib/models/user.model.js.map

@@ -1 +1 @@
-{"version":3,"file":"user.model.js","sourceRoot":"","sources":["../../src/models/user.model.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE9C,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAoD,SAAS,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAM1G;;;;GAIG;AACH,MAAM,OAAO,IAAK,SAAQ,SAAS;IACjC,CAAC,YAAY,CAAC,CAAmB;IACjC;;OAEG;IACH,YAAY,IAAqB;QAC/B,KAAK,EAAE,CAAC;QACR,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,IAAI;YAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACvC,+EAA+E;QAC/E,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,YAAY,QAAQ,CAAC,EAAE,CAAC;YACxC,IAAY,CAAC,kBAAkB,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,IAAI,EAAE,EAAE,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAED;;OAEG;IACH,QAAQ,CAAY;IAEpB;;;;OAIG;IACK,MAAM,CAAC,KAAK,CAAC,IAAS;QAC5B,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YAChD,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;YAC3E,OAAO,IAAI,CAAC,UAAU,CAAC;YACvB,OAAO,IAAI,CAAC,qBAAqB,CAAC;QACpC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACK,MAAM,CAAC,MAAM,CAAC,QAAa;QACjC,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,kBAAkB,EAAE;YAClD,KAAK,EAAE,IAAI;YACX,UAAU,EAAE,KAAK;YACjB,YAAY,EAAE,IAAI;YAClB,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,WAAW,CAAoE,IAAS,EAAE,QAAY;QAC3G,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAM,CAAC;QACnE,IAAI,MAAM,KAAK,IAAI;YAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzC,OAAO,MAAM,CAAC;IAChB,CAAC;IACD;;;;OAIG;IACH,WAAW,CAAS;IACpB;;OAEG;IACH,OAAO,CAAU;IACjB;;OAEG;IACH,MAAM,CAAU;IAChB;;OAEG;IACH,KAAK,CAAU;IAEf;;;;OAIG;IACH,aAAa;QACX,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE;YACpB,MAAM,EAAE,IAAI,CAAC,OAAO;YACpB,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE;SACvB,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,QAAQ;QACN,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED;;;OAGG;IACH,SAAS;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;;OAGG;IACH,QAAQ;QACN,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;;OAGG;IACH,cAAc;QACZ,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CAAC,GAAsB,EAAE,MAAc;QACjD,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,GAAG,CAAC,gBAAgB,EAAE,KAAK,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;YACzE,OAAO,4BAA4B,CAAC;QACtC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACH,QAAQ;QACN,OAAO,QAAQ,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC;IACnC,CAAC;IACS,kBAAkB,CAAC,OAAa;QACxC,CAAC;YACC,IAAI,CAAC,GAAQ,IAAI,CAAC,QAAQ,CAAC;YAC3B,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,UAAU,CAAC,KAAK,SAAS,EAAE,CAAC;gBACnF,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;YAC1B,CAAC;YACD,IAAI,CAAC,CAAC,CAAC,YAAY,QAAQ,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,GAAG,IAAI,QAAQ,EAAE,CAAC;gBAC5B,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;oBAClC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBACzB,CAAC;gBACD,CAAC,GAAG,IAAI,CAAC;YACX,CAAC;YACA,CAAS,CAAC,aAAa,CAAC,GAAI,CAAS,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;YAC3D,CAAS,CAAC,aAAa,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;YACpF,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"user.model.js","sourceRoot":"","sources":["../../src/models/user.model.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE9C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAoD,SAAS,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAM1G;;;;GAIG;AACH,MAAM,OAAO,IAAK,SAAQ,SAAS;IACjC,CAAC,YAAY,CAAC,CAAmB;IACjC;;OAEG;IACH,YAAY,IAAqB;QAC/B,KAAK,EAAE,CAAC;QACR,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,IAAI;YAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACvC,+EAA+E;QAC/E,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,YAAY,QAAQ,CAAC,EAAE,CAAC;YACxC,IAAY,CAAC,kBAAkB,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,IAAI,EAAE,EAAE,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAED;;OAEG;IACH,QAAQ,CAAY;IAEpB;;;;OAIG;IACK,MAAM,CAAC,KAAK,CAAC,IAAS;QAC5B,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YAChD,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;YAC3E,OAAO,IAAI,CAAC,UAAU,CAAC;YACvB,OAAO,IAAI,CAAC,qBAAqB,CAAC;QACpC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACK,MAAM,CAAC,MAAM,CAAC,QAAa;QACjC,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,kBAAkB,EAAE;YAClD,KAAK,EAAE,IAAI;YACX,UAAU,EAAE,KAAK;YACjB,YAAY,EAAE,IAAI;YAClB,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,WAAW,CAAoE,IAAS,EAAE,QAAY;QAC3G,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAM,CAAC;QACnE,IAAI,MAAM,KAAK,IAAI;YAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzC,OAAO,MAAM,CAAC;IAChB,CAAC;IACD;;;;OAIG;IACH,WAAW,CAAS;IACpB;;OAEG;IACH,OAAO,CAAU;IACjB;;OAEG;IACH,MAAM,CAAU;IAChB;;OAEG;IACH,KAAK,CAAU;IAEf;;;;OAIG;IACH,aAAa;QACX,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE;YACpB,MAAM,EAAE,IAAI,CAAC,OAAO;YACpB,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE;SACvB,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,QAAQ;QACN,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED;;;OAGG;IACH,SAAS;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;;OAGG;IACH,QAAQ;QACN,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;;OAGG;IACH,cAAc;QACZ,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,kBAAkB,CAAC,OAA2B;QACnD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAClF,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CAAC,GAAsB,EAAE,MAAc;QACjD,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,GAAG,CAAC,gBAAgB,EAAE,KAAK,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;YACzE,OAAO,4BAA4B,CAAC;QACtC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACH,QAAQ;QACN,OAAO,QAAQ,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC;IACnC,CAAC;IACS,kBAAkB,CAAC,OAAa;QACxC,CAAC;YACC,IAAI,CAAC,GAAQ,IAAI,CAAC,QAAQ,CAAC;YAC3B,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,UAAU,CAAC,KAAK,SAAS,EAAE,CAAC;gBACnF,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;YAC1B,CAAC;YACD,IAAI,CAAC,CAAC,CAAC,YAAY,QAAQ,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,GAAG,IAAI,QAAQ,EAAE,CAAC;gBAC5B,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;oBAClC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBACzB,CAAC;gBACD,CAAC,GAAG,IAAI,CAAC;YACX,CAAC;YACA,CAAS,CAAC,aAAa,CAAC,GAAI,CAAS,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;YAC3D,CAAS,CAAC,aAAa,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;YACpF,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;CACF"}