npm - @webiny/api-headless-cms - Versions diffs - 6.3.0 → 6.4.0-beta.0 - Mend

@webiny/api-headless-cms 6.3.0 → 6.4.0-beta.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1241) hide show

package/crud/AccessControl/AccessControl.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"names":["NotAuthorizedError","AccessControl","constructor","getIdentity","getGroupsPermissions","getModelsPermissions","getEntriesPermissions","listAllGroups","fullAccessPermissions","listAllGroupsCallback","allGroups","canAccessGroup","params","acl","getGroupsAccessControlList","canRead","find","ace","rwd","includes","hasRwd","canAccessNonOwnedGroups","some","canAccessNonOwned","canAccessOnlyOwnedGroups","hasFullAccessToGroups","canAccessOnlyOwned","groupsPermissionsList","groupsPermissions","own","modelGroupCreatedBy","group","createdBy","identity","id","push","groups","Array","isArray","permissions","p","filter","Boolean","name","canAccessModel","getModelsAccessControlList","ensureCanAccessModel","canAccess","modelName","model","canAccessNonOwnedModels","canAccessOnlyOwnedModels","hasFullAccessToModels","i","length","modelsPermissionsList","relatedModelPermissions","_src","getGroup","fullAccess","models","modelCreatedBy","modelId","modelAuthorizationDisabled","canAccessEntry","getEntriesAccessControlList","pw","hasPw","ensureCanAccessEntry","entry","entryId","canAccessNonOwnedEntries","canAccessOnlyOwnedEntries","hasFullAccessToEntries","groupPermissions","relatedModelsPermissions","entriesPermissionsList","relatedEntriesPermissions","groupCreatedBy","entryCreatedBy","authorization","slug"],"sources":["AccessControl.ts"],"sourcesContent":["import type {\n CmsEntry,\n CmsEntryPermission,\n CmsGroup,\n CmsGroupPermission,\n CmsModel,\n CmsModelPermission\n} from \"~/types/index.js\";\nimport type { SecurityIdentity } from \"@webiny/api-core/types/security.js\";\nimport { NotAuthorizedError } from \"~/utils/errors.js\";\n\nexport interface AccessControlParams {\n getIdentity: () => Promise<SecurityIdentity>;\n getGroupsPermissions: () => Promise<CmsGroupPermission[]>;\n getModelsPermissions: () => Promise<CmsModelPermission[]>;\n getEntriesPermissions: () => Promise<CmsEntryPermission[]>;\n listAllGroups: () => Promise<CmsGroup[]>;\n}\n\ninterface GetGroupsAccessControlListParams {\n group?: CmsGroup;\n}\n\ninterface CanAccessGroupParams extends GetGroupsAccessControlListParams {\n rwd?: string;\n}\n\ninterface GetModelsAccessControlListParams {\n model?: CmsModel;\n}\n\ninterface CanAccessModelParams extends GetModelsAccessControlListParams {\n rwd?: string;\n}\n\ninterface GetEntriesAccessControlListParams {\n model: Pick<CmsModel, \"modelId\" \| \"createdBy\" \| \"group\" \| \"authorization\">;\n entry?: Pick<CmsEntry, \"entryId\" \| \"createdBy\">;\n}\n\nexport interface CanAccessEntryParams extends GetEntriesAccessControlListParams {\n rwd?: string;\n pw?: string;\n}\n\ninterface AccessControlEntry {\n rwd: string;\n canAccessNonOwned: boolean;\n canAccessOnlyOwned: boolean;\n}\n\ntype AccessControlList = AccessControlEntry[];\n\ninterface EntriesAccessControlEntry extends AccessControlEntry {\n pw?: string;\n}\n\ntype EntriesAccessControlList = EntriesAccessControlEntry[];\n\ninterface IModelAuthorizationDisabledParams {\n model: Pick<CmsModel, \"authorization\">;\n}\n\nexport class AccessControl {\n private getIdentity: AccessControlParams[\"getIdentity\"];\n private getGroupsPermissions: AccessControlParams[\"getGroupsPermissions\"];\n private getModelsPermissions: AccessControlParams[\"getModelsPermissions\"];\n private getEntriesPermissions: AccessControlParams[\"getEntriesPermissions\"];\n private listAllGroupsCallback: AccessControlParams[\"listAllGroups\"];\n\n private fullAccessPermissions: string[];\n private allGroups: null \| Promise<CmsGroup[]>;\n\n constructor({\n getIdentity,\n getGroupsPermissions,\n getModelsPermissions,\n getEntriesPermissions,\n listAllGroups\n }: AccessControlParams) {\n this.getIdentity = getIdentity;\n this.getGroupsPermissions = getGroupsPermissions;\n this.getModelsPermissions = getModelsPermissions;\n this.getEntriesPermissions = getEntriesPermissions;\n this.fullAccessPermissions = [\"\", \"cms.\"];\n this.listAllGroupsCallback = listAllGroups;\n this.allGroups = null;\n }\n\n /*\n Groups-related methods below. 👇\n * - canAccessGroup\n * - ensureCanAccessGroup\n * - canAccessNonOwnedGroups\n * - canAccessOnlyOwnedGroups\n * - getGroupsAccessControlList\n * - hasFullAccessToGroups\n /\n\n async canAccessGroup(params: CanAccessGroupParams = {}) {\n const acl = await this.getGroupsAccessControlList(params);\n\n const canRead = acl.find(ace => ace.rwd?.includes(\"r\"));\n if (!canRead) {\n return false;\n }\n\n const { rwd } = params;\n if (rwd) {\n const hasRwd = acl.find(ace => ace.rwd.includes(rwd));\n if (!hasRwd) {\n return false;\n }\n }\n\n return true;\n }\n\n private async canAccessNonOwnedGroups(params: GetGroupsAccessControlListParams) {\n const acl = await this.getGroupsAccessControlList(params);\n return acl.some(ace => ace.canAccessNonOwned);\n }\n\n private async canAccessOnlyOwnedGroups(params: GetGroupsAccessControlListParams) {\n const canAccessNonOwned = await this.canAccessNonOwnedGroups(params);\n return !canAccessNonOwned;\n }\n\n private async getGroupsAccessControlList(\n params: GetGroupsAccessControlListParams\n ): Promise<AccessControlList> {\n if (await this.hasFullAccessToGroups()) {\n return [{ rwd: \"rwd\", canAccessNonOwned: true, canAccessOnlyOwned: false }];\n }\n\n const groupsPermissionsList = await this.getGroupsPermissions();\n const acl: AccessControlList = [];\n\n for (const groupsPermissions of groupsPermissionsList) {\n if (groupsPermissions.own) {\n if (\"group\" in params) {\n const modelGroupCreatedBy = params.group?.createdBy;\n if (!modelGroupCreatedBy) {\n continue;\n }\n\n const identity = await this.getIdentity();\n\n if (modelGroupCreatedBy.id !== identity.id) {\n continue;\n }\n }\n\n acl.push({\n rwd: \"rwd\",\n canAccessNonOwned: false,\n canAccessOnlyOwned: true\n });\n }\n\n if (groupsPermissions.groups) {\n if (\"group\" in params) {\n const { group } = params;\n if (!group) {\n continue;\n }\n\n const { groups } = groupsPermissions;\n if (!Array.isArray(groups)) {\n continue;\n }\n\n if (!groups.includes(group.id)) {\n continue;\n }\n }\n }\n\n acl.push({\n rwd: groupsPermissions.rwd as string,\n canAccessNonOwned: true,\n canAccessOnlyOwned: false\n });\n }\n\n return acl;\n }\n\n private async hasFullAccessToGroups() {\n const permissions = await this.getGroupsPermissions();\n return permissions.some(p => this.fullAccessPermissions.filter(Boolean).includes(p.name));\n }\n\n /\n Models-related methods below. 👇\n * - canAccessModel\n * - ensureCanAccessModel\n * - canAccessNonOwnedModels\n * - canAccessOnlyOwnedModels\n * - getModelsAccessControlList\n * - hasFullAccessToModels\n /\n\n async canAccessModel(params: CanAccessModelParams) {\n const acl = await this.getModelsAccessControlList(params);\n\n const canRead = acl.find(ace => ace.rwd.includes(\"r\"));\n if (!canRead) {\n return false;\n }\n\n const { rwd } = params;\n if (rwd) {\n const hasRwd = acl.find(ace => ace.rwd.includes(rwd));\n if (!hasRwd) {\n return false;\n }\n }\n\n return true;\n }\n\n private async ensureCanAccessModel(params: CanAccessModelParams = {}) {\n const canAccess = await this.canAccessModel(params);\n if (canAccess) {\n return;\n }\n\n if (\"model\" in params) {\n let modelName = \"(could not determine name)\";\n if (params.model?.name) {\n modelName = `\"${params.model.name}\"`;\n }\n\n throw new NotAuthorizedError(`Not allowed to access content model ${modelName}.`);\n }\n\n throw new NotAuthorizedError(`Not allowed to access content models.`);\n }\n\n private async canAccessNonOwnedModels(params: GetModelsAccessControlListParams) {\n const acl = await this.getModelsAccessControlList(params);\n return acl.some(ace => ace.canAccessNonOwned);\n }\n\n private async canAccessOnlyOwnedModels(params: GetModelsAccessControlListParams) {\n const canAccessNonOwned = await this.canAccessNonOwnedModels(params);\n return !canAccessNonOwned;\n }\n\n private async getModelsAccessControlList(\n params: GetModelsAccessControlListParams\n ): Promise<AccessControlList> {\n if (await this.hasFullAccessToModels(params)) {\n return [{ rwd: \"rwd\", canAccessNonOwned: true, canAccessOnlyOwned: false }];\n }\n\n const groupsPermissionsList = await this.getGroupsPermissions();\n const acl: AccessControlList = [];\n\n for (let i = 0; i < groupsPermissionsList.length; i++) {\n const groupsPermissions = groupsPermissionsList[i];\n\n const modelsPermissionsList = await this.getModelsPermissions();\n const relatedModelPermissions = modelsPermissionsList.find(\n permissions => permissions._src === groupsPermissions._src\n );\n\n if (!relatedModelPermissions) {\n continue;\n }\n\n if (groupsPermissions.own) {\n if (\"model\" in params) {\n const { model } = params;\n if (!model) {\n continue;\n }\n\n const group = await this.getGroup(model.group);\n if (!group) {\n continue;\n }\n\n const modelGroupCreatedBy = group.createdBy;\n if (!modelGroupCreatedBy) {\n continue;\n }\n\n const identity = await this.getIdentity();\n if (modelGroupCreatedBy.id !== identity.id) {\n continue;\n }\n }\n\n acl.push({\n rwd: \"rwd\",\n canAccessNonOwned: false,\n canAccessOnlyOwned: true\n });\n\n continue;\n }\n\n if (groupsPermissions.groups) {\n if (\"model\" in params) {\n const { model } = params;\n if (!model) {\n continue;\n }\n\n if (!Array.isArray(groupsPermissions.groups)) {\n continue;\n }\n\n if (!groupsPermissions.groups.includes(model.group)) {\n continue;\n }\n }\n }\n\n const fullAccess =\n !relatedModelPermissions.rwd &&\n !relatedModelPermissions.own &&\n !relatedModelPermissions.models;\n\n if (fullAccess) {\n acl.push({\n rwd: \"rwd\",\n canAccessNonOwned: true,\n canAccessOnlyOwned: false\n });\n\n continue;\n }\n\n if (relatedModelPermissions.own) {\n if (\"model\" in params) {\n if (!params.model) {\n continue;\n }\n\n const modelCreatedBy = params.model.createdBy;\n if (!modelCreatedBy) {\n continue;\n }\n\n const identity = await this.getIdentity();\n if (modelCreatedBy.id !== identity.id) {\n continue;\n }\n }\n\n acl.push({\n rwd: \"rwd\",\n canAccessNonOwned: false,\n canAccessOnlyOwned: true\n });\n\n continue;\n }\n\n if (relatedModelPermissions.models) {\n const { models } = relatedModelPermissions;\n if (\"model\" in params) {\n if (!params.model) {\n continue;\n }\n\n if (!Array.isArray(models)) {\n continue;\n }\n\n if (!models.includes(params.model.modelId)) {\n continue;\n }\n }\n }\n\n acl.push({\n rwd: relatedModelPermissions.rwd as string,\n canAccessNonOwned: true,\n canAccessOnlyOwned: false\n });\n }\n\n return acl;\n }\n\n private async hasFullAccessToModels(params: GetModelsAccessControlListParams) {\n const { model } = params;\n if (model) {\n if (this.modelAuthorizationDisabled({ model })) {\n return true;\n }\n }\n\n const permissions = await this.getModelsPermissions();\n return permissions.some(p => this.fullAccessPermissions.filter(Boolean).includes(p.name));\n }\n\n /\n Entries-related methods below. 👇\n * - canAccessEntry\n * - ensureCanAccessEntry\n * - canAccessNonOwnedEntries\n * - canAccessOnlyOwnedEntries\n * - getEntriesAccessControlList\n * - hasFullAccessToEntries\n */\n\n async canAccessEntry(params: CanAccessEntryParams) {\n const acl = await this.getEntriesAccessControlList(params);\n\n const canRead = acl.find(ace => ace.rwd.includes(\"r\"));\n if (!canRead) {\n return false;\n }\n\n const { rwd } = params;\n if (rwd) {\n const hasRwd = acl.find(ace => ace.rwd.includes(rwd));\n if (!hasRwd) {\n return false;\n }\n }\n\n const { pw } = params;\n if (pw) {\n const hasPw = acl.find(ace => ace.pw?.includes(pw));\n if (!hasPw) {\n return false;\n }\n }\n\n return true;\n }\n\n private async ensureCanAccessEntry(params: CanAccessEntryParams) {\n const canAccess = await this.canAccessEntry(params);\n if (!canAccess) {\n if (params.entry) {\n throw new NotAuthorizedError(\n `Not allowed to access entry \"${params.entry.entryId}\".`\n );\n }\n\n throw new NotAuthorizedError(\n `Not allowed to access \"${params.model.modelId}\" entries.`\n );\n }\n }\n\n private async canAccessNonOwnedEntries(params: GetEntriesAccessControlListParams) {\n const acl = await this.getEntriesAccessControlList(params);\n return acl.some(ace => ace.canAccessNonOwned);\n }\n\n async canAccessOnlyOwnedEntries(params: GetEntriesAccessControlListParams) {\n const canAccessNonOwned = await this.canAccessNonOwnedEntries(params);\n return !canAccessNonOwned;\n }\n\n private async getEntriesAccessControlList(\n params: GetEntriesAccessControlListParams\n ): Promise<EntriesAccessControlList> {\n if (await this.hasFullAccessToEntries(params)) {\n return [{ rwd: \"rwd\", pw: \"pu\", canAccessNonOwned: true, canAccessOnlyOwned: false }];\n }\n\n // We need a map of groups slugs to ids, to perform checks on models\n const { model } = params;\n const groupsPermissionsList = await this.getGroupsPermissions();\n const acl: EntriesAccessControlList = [];\n\n for (let i = 0; i < groupsPermissionsList.length; i++) {\n const groupPermissions = groupsPermissionsList[i];\n\n const modelsPermissionsList = await this.getModelsPermissions();\n const relatedModelsPermissions = modelsPermissionsList.find(\n permissions => permissions._src === groupPermissions._src\n );\n\n if (!relatedModelsPermissions) {\n continue;\n }\n\n const entriesPermissionsList = await this.getEntriesPermissions();\n const relatedEntriesPermissions = entriesPermissionsList.find(\n permissions => permissions._src === groupPermissions._src\n );\n\n if (!relatedEntriesPermissions) {\n continue;\n }\n\n if (groupPermissions.own) {\n const group = await this.getGroup(model.group);\n if (!group) {\n continue;\n }\n\n const groupCreatedBy = group.createdBy;\n if (!groupCreatedBy) {\n continue;\n }\n\n const identity = await this.getIdentity();\n if (groupCreatedBy.id !== identity.id) {\n continue;\n }\n\n acl.push({\n rwd: \"rwd\",\n canAccessNonOwned: false,\n canAccessOnlyOwned: true,\n pw: relatedEntriesPermissions.pw\n });\n\n continue;\n }\n\n if (groupPermissions.groups) {\n const { groups } = groupPermissions;\n\n if (!Array.isArray(groups)) {\n continue;\n }\n\n if (!groups.includes(model.group)) {\n continue;\n }\n }\n\n if (relatedModelsPermissions.own) {\n const modelCreatedBy = model.createdBy;\n if (!modelCreatedBy) {\n continue;\n }\n\n const identity = await this.getIdentity();\n if (modelCreatedBy.id !== identity.id) {\n continue;\n }\n\n acl.push({\n rwd: \"rwd\",\n canAccessNonOwned: false,\n canAccessOnlyOwned: true,\n pw: relatedEntriesPermissions.pw\n });\n }\n\n if (relatedModelsPermissions.models) {\n if (!Array.isArray(relatedModelsPermissions.models)) {\n continue;\n }\n\n if (!relatedModelsPermissions.models.includes(model.modelId)) {\n continue;\n }\n }\n\n const fullAccess =\n !relatedEntriesPermissions.rwd &&\n !relatedEntriesPermissions.own &&\n !relatedEntriesPermissions.models;\n\n if (fullAccess) {\n acl.push({\n rwd: \"rwd\",\n canAccessNonOwned: false,\n canAccessOnlyOwned: true,\n pw: \"pu\"\n });\n\n continue;\n }\n\n if (relatedEntriesPermissions.own) {\n if (\"entry\" in params) {\n const entryCreatedBy = params.entry?.createdBy;\n if (!entryCreatedBy) {\n continue;\n }\n\n const identity = await this.getIdentity();\n if (entryCreatedBy.id !== identity.id) {\n continue;\n }\n }\n\n acl.push({\n rwd: relatedEntriesPermissions.rwd,\n canAccessNonOwned: false,\n canAccessOnlyOwned: true,\n pw: relatedEntriesPermissions.pw\n });\n\n continue;\n }\n\n acl.push({\n rwd: relatedEntriesPermissions.rwd,\n canAccessNonOwned: true,\n canAccessOnlyOwned: false,\n pw: relatedEntriesPermissions.pw\n });\n }\n\n return acl;\n }\n\n private async hasFullAccessToEntries(params: GetEntriesAccessControlListParams) {\n if (this.modelAuthorizationDisabled(params)) {\n return true;\n }\n\n const permissions = await this.getEntriesPermissions();\n return permissions.some(p => this.fullAccessPermissions.filter(Boolean).includes(p.name));\n }\n\n private modelAuthorizationDisabled(params: IModelAuthorizationDisabledParams) {\n if (\"authorization\" in params.model) {\n const { authorization } = params.model;\n if (typeof authorization === \"boolean\") {\n return authorization === false;\n }\n\n return authorization?.permissions === false;\n }\n\n return false;\n }\n\n private async listAllGroups(): Promise<CmsGroup[]> {\n if (this.allGroups === null) {\n this.allGroups = this.listAllGroupsCallback();\n }\n\n return this.allGroups;\n }\n\n private async getGroup(slug: string): Promise<CmsGroup \| undefined> {\n const groups = await this.listAllGroups();\n return groups.find(group => group.slug === slug);\n }\n}\n"],"mappings":"AASA,SAASA,kBAAkB;AAsD3B,OAAO,MAAMC,aAAa,CAAC;EAUvBC,WAAWA,CAAC;IACRC,WAAW;IACXC,oBAAoB;IACpBC,oBAAoB;IACpBC,qBAAqB;IACrBC;EACiB,CAAC,EAAE;IACpB,IAAI,CAACJ,WAAW,GAAGA,WAAW;IAC9B,IAAI,CAACC,oBAAoB,GAAGA,oBAAoB;IAChD,IAAI,CAACC,oBAAoB,GAAGA,oBAAoB;IAChD,IAAI,CAACC,qBAAqB,GAAGA,qBAAqB;IAClD,IAAI,CAACE,qBAAqB,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC;IAC3C,IAAI,CAACC,qBAAqB,GAAGF,aAAa;IAC1C,IAAI,CAACG,SAAS,GAAG,IAAI;EACzB;;EAEA;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;EAEI,MAAMC,cAAcA,CAACC,MAA4B,GAAG,CAAC,CAAC,EAAE;IACpD,MAAMC,GAAG,GAAG,MAAM,IAAI,CAACC,0BAA0B,CAACF,MAAM,CAAC;IAEzD,MAAMG,OAAO,GAAGF,GAAG,CAACG,IAAI,CAACC,GAAG,IAAIA,GAAG,CAACC,GAAG,EAAEC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACvD,IAAI,CAACJ,OAAO,EAAE;MACV,OAAO,KAAK;IAChB;IAEA,MAAM;MAAEG;IAAI,CAAC,GAAGN,MAAM;IACtB,IAAIM,GAAG,EAAE;MACL,MAAME,MAAM,GAAGP,GAAG,CAACG,IAAI,CAACC,GAAG,IAAIA,GAAG,CAACC,GAAG,CAACC,QAAQ,CAACD,GAAG,CAAC,CAAC;MACrD,IAAI,CAACE,MAAM,EAAE;QACT,OAAO,KAAK;MAChB;IACJ;IAEA,OAAO,IAAI;EACf;EAEA,MAAcC,uBAAuBA,CAACT,MAAwC,EAAE;IAC5E,MAAMC,GAAG,GAAG,MAAM,IAAI,CAACC,0BAA0B,CAACF,MAAM,CAAC;IACzD,OAAOC,GAAG,CAACS,IAAI,CAACL,GAAG,IAAIA,GAAG,CAACM,iBAAiB,CAAC;EACjD;EAEA,MAAcC,wBAAwBA,CAACZ,MAAwC,EAAE;IAC7E,MAAMW,iBAAiB,GAAG,MAAM,IAAI,CAACF,uBAAuB,CAACT,MAAM,CAAC;IACpE,OAAO,CAACW,iBAAiB;EAC7B;EAEA,MAAcT,0BAA0BA,CACpCF,MAAwC,EACd;IAC1B,IAAI,MAAM,IAAI,CAACa,qBAAqB,CAAC,CAAC,EAAE;MACpC,OAAO,CAAC;QAAEP,GAAG,EAAE,KAAK;QAAEK,iBAAiB,EAAE,IAAI;QAAEG,kBAAkB,EAAE;MAAM,CAAC,CAAC;IAC/E;IAEA,MAAMC,qBAAqB,GAAG,MAAM,IAAI,CAACvB,oBAAoB,CAAC,CAAC;IAC/D,MAAMS,GAAsB,GAAG,EAAE;IAEjC,KAAK,MAAMe,iBAAiB,IAAID,qBAAqB,EAAE;MACnD,IAAIC,iBAAiB,CAACC,GAAG,EAAE;QACvB,IAAI,OAAO,IAAIjB,MAAM,EAAE;UACnB,MAAMkB,mBAAmB,GAAGlB,MAAM,CAACmB,KAAK,EAAEC,SAAS;UACnD,IAAI,CAACF,mBAAmB,EAAE;YACtB;UACJ;UAEA,MAAMG,QAAQ,GAAG,MAAM,IAAI,CAAC9B,WAAW,CAAC,CAAC;UAEzC,IAAI2B,mBAAmB,CAACI,EAAE,KAAKD,QAAQ,CAACC,EAAE,EAAE;YACxC;UACJ;QACJ;QAEArB,GAAG,CAACsB,IAAI,CAAC;UACLjB,GAAG,EAAE,KAAK;UACVK,iBAAiB,EAAE,KAAK;UACxBG,kBAAkB,EAAE;QACxB,CAAC,CAAC;MACN;MAEA,IAAIE,iBAAiB,CAACQ,MAAM,EAAE;QAC1B,IAAI,OAAO,IAAIxB,MAAM,EAAE;UACnB,MAAM;YAAEmB;UAAM,CAAC,GAAGnB,MAAM;UACxB,IAAI,CAACmB,KAAK,EAAE;YACR;UACJ;UAEA,MAAM;YAAEK;UAAO,CAAC,GAAGR,iBAAiB;UACpC,IAAI,CAACS,KAAK,CAACC,OAAO,CAACF,MAAM,CAAC,EAAE;YACxB;UACJ;UAEA,IAAI,CAACA,MAAM,CAACjB,QAAQ,CAACY,KAAK,CAACG,EAAE,CAAC,EAAE;YAC5B;UACJ;QACJ;MACJ;MAEArB,GAAG,CAACsB,IAAI,CAAC;QACLjB,GAAG,EAAEU,iBAAiB,CAACV,GAAa;QACpCK,iBAAiB,EAAE,IAAI;QACvBG,kBAAkB,EAAE;MACxB,CAAC,CAAC;IACN;IAEA,OAAOb,GAAG;EACd;EAEA,MAAcY,qBAAqBA,CAAA,EAAG;IAClC,MAAMc,WAAW,GAAG,MAAM,IAAI,CAACnC,oBAAoB,CAAC,CAAC;IACrD,OAAOmC,WAAW,CAACjB,IAAI,CAACkB,CAAC,IAAI,IAAI,CAAChC,qBAAqB,CAACiC,MAAM,CAACC,OAAO,CAAC,CAACvB,QAAQ,CAACqB,CAAC,CAACG,IAAI,CAAC,CAAC;EAC7F;;EAEA;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;EAEI,MAAMC,cAAcA,CAAChC,MAA4B,EAAE;IAC/C,MAAMC,GAAG,GAAG,MAAM,IAAI,CAACgC,0BAA0B,CAACjC,MAAM,CAAC;IAEzD,MAAMG,OAAO,GAAGF,GAAG,CAACG,IAAI,CAACC,GAAG,IAAIA,GAAG,CAACC,GAAG,CAACC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACtD,IAAI,CAACJ,OAAO,EAAE;MACV,OAAO,KAAK;IAChB;IAEA,MAAM;MAAEG;IAAI,CAAC,GAAGN,MAAM;IACtB,IAAIM,GAAG,EAAE;MACL,MAAME,MAAM,GAAGP,GAAG,CAACG,IAAI,CAACC,GAAG,IAAIA,GAAG,CAACC,GAAG,CAACC,QAAQ,CAACD,GAAG,CAAC,CAAC;MACrD,IAAI,CAACE,MAAM,EAAE;QACT,OAAO,KAAK;MAChB;IACJ;IAEA,OAAO,IAAI;EACf;EAEA,MAAc0B,oBAAoBA,CAAClC,MAA4B,GAAG,CAAC,CAAC,EAAE;IAClE,MAAMmC,SAAS,GAAG,MAAM,IAAI,CAACH,cAAc,CAAChC,MAAM,CAAC;IACnD,IAAImC,SAAS,EAAE;MACX;IACJ;IAEA,IAAI,OAAO,IAAInC,MAAM,EAAE;MACnB,IAAIoC,SAAS,GAAG,4BAA4B;MAC5C,IAAIpC,MAAM,CAACqC,KAAK,EAAEN,IAAI,EAAE;QACpBK,SAAS,GAAG,IAAIpC,MAAM,CAACqC,KAAK,CAACN,IAAI,GAAG;MACxC;MAEA,MAAM,IAAI3C,kBAAkB,CAAC,uCAAuCgD,SAAS,GAAG,CAAC;IACrF;IAEA,MAAM,IAAIhD,kBAAkB,CAAC,uCAAuC,CAAC;EACzE;EAEA,MAAckD,uBAAuBA,CAACtC,MAAwC,EAAE;IAC5E,MAAMC,GAAG,GAAG,MAAM,IAAI,CAACgC,0BAA0B,CAACjC,MAAM,CAAC;IACzD,OAAOC,GAAG,CAACS,IAAI,CAACL,GAAG,IAAIA,GAAG,CAACM,iBAAiB,CAAC;EACjD;EAEA,MAAc4B,wBAAwBA,CAACvC,MAAwC,EAAE;IAC7E,MAAMW,iBAAiB,GAAG,MAAM,IAAI,CAAC2B,uBAAuB,CAACtC,MAAM,CAAC;IACpE,OAAO,CAACW,iBAAiB;EAC7B;EAEA,MAAcsB,0BAA0BA,CACpCjC,MAAwC,EACd;IAC1B,IAAI,MAAM,IAAI,CAACwC,qBAAqB,CAACxC,MAAM,CAAC,EAAE;MAC1C,OAAO,CAAC;QAAEM,GAAG,EAAE,KAAK;QAAEK,iBAAiB,EAAE,IAAI;QAAEG,kBAAkB,EAAE;MAAM,CAAC,CAAC;IAC/E;IAEA,MAAMC,qBAAqB,GAAG,MAAM,IAAI,CAACvB,oBAAoB,CAAC,CAAC;IAC/D,MAAMS,GAAsB,GAAG,EAAE;IAEjC,KAAK,IAAIwC,CAAC,GAAG,CAAC,EAAEA,CAAC,GAAG1B,qBAAqB,CAAC2B,MAAM,EAAED,CAAC,EAAE,EAAE;MACnD,MAAMzB,iBAAiB,GAAGD,qBAAqB,CAAC0B,CAAC,CAAC;MAElD,MAAME,qBAAqB,GAAG,MAAM,IAAI,CAAClD,oBAAoB,CAAC,CAAC;MAC/D,MAAMmD,uBAAuB,GAAGD,qBAAqB,CAACvC,IAAI,CACtDuB,WAAW,IAAIA,WAAW,CAACkB,IAAI,KAAK7B,iBAAiB,CAAC6B,IAC1D,CAAC;MAED,IAAI,CAACD,uBAAuB,EAAE;QAC1B;MACJ;MAEA,IAAI5B,iBAAiB,CAACC,GAAG,EAAE;QACvB,IAAI,OAAO,IAAIjB,MAAM,EAAE;UACnB,MAAM;YAAEqC;UAAM,CAAC,GAAGrC,MAAM;UACxB,IAAI,CAACqC,KAAK,EAAE;YACR;UACJ;UAEA,MAAMlB,KAAK,GAAG,MAAM,IAAI,CAAC2B,QAAQ,CAACT,KAAK,CAAClB,KAAK,CAAC;UAC9C,IAAI,CAACA,KAAK,EAAE;YACR;UACJ;UAEA,MAAMD,mBAAmB,GAAGC,KAAK,CAACC,SAAS;UAC3C,IAAI,CAACF,mBAAmB,EAAE;YACtB;UACJ;UAEA,MAAMG,QAAQ,GAAG,MAAM,IAAI,CAAC9B,WAAW,CAAC,CAAC;UACzC,IAAI2B,mBAAmB,CAACI,EAAE,KAAKD,QAAQ,CAACC,EAAE,EAAE;YACxC;UACJ;QACJ;QAEArB,GAAG,CAACsB,IAAI,CAAC;UACLjB,GAAG,EAAE,KAAK;UACVK,iBAAiB,EAAE,KAAK;UACxBG,kBAAkB,EAAE;QACxB,CAAC,CAAC;QAEF;MACJ;MAEA,IAAIE,iBAAiB,CAACQ,MAAM,EAAE;QAC1B,IAAI,OAAO,IAAIxB,MAAM,EAAE;UACnB,MAAM;YAAEqC;UAAM,CAAC,GAAGrC,MAAM;UACxB,IAAI,CAACqC,KAAK,EAAE;YACR;UACJ;UAEA,IAAI,CAACZ,KAAK,CAACC,OAAO,CAACV,iBAAiB,CAACQ,MAAM,CAAC,EAAE;YAC1C;UACJ;UAEA,IAAI,CAACR,iBAAiB,CAACQ,MAAM,CAACjB,QAAQ,CAAC8B,KAAK,CAAClB,KAAK,CAAC,EAAE;YACjD;UACJ;QACJ;MACJ;MAEA,MAAM4B,UAAU,GACZ,CAACH,uBAAuB,CAACtC,GAAG,IAC5B,CAACsC,uBAAuB,CAAC3B,GAAG,IAC5B,CAAC2B,uBAAuB,CAACI,MAAM;MAEnC,IAAID,UAAU,EAAE;QACZ9C,GAAG,CAACsB,IAAI,CAAC;UACLjB,GAAG,EAAE,KAAK;UACVK,iBAAiB,EAAE,IAAI;UACvBG,kBAAkB,EAAE;QACxB,CAAC,CAAC;QAEF;MACJ;MAEA,IAAI8B,uBAAuB,CAAC3B,GAAG,EAAE;QAC7B,IAAI,OAAO,IAAIjB,MAAM,EAAE;UACnB,IAAI,CAACA,MAAM,CAACqC,KAAK,EAAE;YACf;UACJ;UAEA,MAAMY,cAAc,GAAGjD,MAAM,CAACqC,KAAK,CAACjB,SAAS;UAC7C,IAAI,CAAC6B,cAAc,EAAE;YACjB;UACJ;UAEA,MAAM5B,QAAQ,GAAG,MAAM,IAAI,CAAC9B,WAAW,CAAC,CAAC;UACzC,IAAI0D,cAAc,CAAC3B,EAAE,KAAKD,QAAQ,CAACC,EAAE,EAAE;YACnC;UACJ;QACJ;QAEArB,GAAG,CAACsB,IAAI,CAAC;UACLjB,GAAG,EAAE,KAAK;UACVK,iBAAiB,EAAE,KAAK;UACxBG,kBAAkB,EAAE;QACxB,CAAC,CAAC;QAEF;MACJ;MAEA,IAAI8B,uBAAuB,CAACI,MAAM,EAAE;QAChC,MAAM;UAAEA;QAAO,CAAC,GAAGJ,uBAAuB;QAC1C,IAAI,OAAO,IAAI5C,MAAM,EAAE;UACnB,IAAI,CAACA,MAAM,CAACqC,KAAK,EAAE;YACf;UACJ;UAEA,IAAI,CAACZ,KAAK,CAACC,OAAO,CAACsB,MAAM,CAAC,EAAE;YACxB;UACJ;UAEA,IAAI,CAACA,MAAM,CAACzC,QAAQ,CAACP,MAAM,CAACqC,KAAK,CAACa,OAAO,CAAC,EAAE;YACxC;UACJ;QACJ;MACJ;MAEAjD,GAAG,CAACsB,IAAI,CAAC;QACLjB,GAAG,EAAEsC,uBAAuB,CAACtC,GAAa;QAC1CK,iBAAiB,EAAE,IAAI;QACvBG,kBAAkB,EAAE;MACxB,CAAC,CAAC;IACN;IAEA,OAAOb,GAAG;EACd;EAEA,MAAcuC,qBAAqBA,CAACxC,MAAwC,EAAE;IAC1E,MAAM;MAAEqC;IAAM,CAAC,GAAGrC,MAAM;IACxB,IAAIqC,KAAK,EAAE;MACP,IAAI,IAAI,CAACc,0BAA0B,CAAC;QAAEd;MAAM,CAAC,CAAC,EAAE;QAC5C,OAAO,IAAI;MACf;IACJ;IAEA,MAAMV,WAAW,GAAG,MAAM,IAAI,CAAClC,oBAAoB,CAAC,CAAC;IACrD,OAAOkC,WAAW,CAACjB,IAAI,CAACkB,CAAC,IAAI,IAAI,CAAChC,qBAAqB,CAACiC,MAAM,CAACC,OAAO,CAAC,CAACvB,QAAQ,CAACqB,CAAC,CAACG,IAAI,CAAC,CAAC;EAC7F;;EAEA;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;EAEI,MAAMqB,cAAcA,CAACpD,MAA4B,EAAE;IAC/C,MAAMC,GAAG,GAAG,MAAM,IAAI,CAACoD,2BAA2B,CAACrD,MAAM,CAAC;IAE1D,MAAMG,OAAO,GAAGF,GAAG,CAACG,IAAI,CAACC,GAAG,IAAIA,GAAG,CAACC,GAAG,CAACC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACtD,IAAI,CAACJ,OAAO,EAAE;MACV,OAAO,KAAK;IAChB;IAEA,MAAM;MAAEG;IAAI,CAAC,GAAGN,MAAM;IACtB,IAAIM,GAAG,EAAE;MACL,MAAME,MAAM,GAAGP,GAAG,CAACG,IAAI,CAACC,GAAG,IAAIA,GAAG,CAACC,GAAG,CAACC,QAAQ,CAACD,GAAG,CAAC,CAAC;MACrD,IAAI,CAACE,MAAM,EAAE;QACT,OAAO,KAAK;MAChB;IACJ;IAEA,MAAM;MAAE8C;IAAG,CAAC,GAAGtD,MAAM;IACrB,IAAIsD,EAAE,EAAE;MACJ,MAAMC,KAAK,GAAGtD,GAAG,CAACG,IAAI,CAACC,GAAG,IAAIA,GAAG,CAACiD,EAAE,EAAE/C,QAAQ,CAAC+C,EAAE,CAAC,CAAC;MACnD,IAAI,CAACC,KAAK,EAAE;QACR,OAAO,KAAK;MAChB;IACJ;IAEA,OAAO,IAAI;EACf;EAEA,MAAcC,oBAAoBA,CAACxD,MAA4B,EAAE;IAC7D,MAAMmC,SAAS,GAAG,MAAM,IAAI,CAACiB,cAAc,CAACpD,MAAM,CAAC;IACnD,IAAI,CAACmC,SAAS,EAAE;MACZ,IAAInC,MAAM,CAACyD,KAAK,EAAE;QACd,MAAM,IAAIrE,kBAAkB,CACxB,gCAAgCY,MAAM,CAACyD,KAAK,CAACC,OAAO,IACxD,CAAC;MACL;MAEA,MAAM,IAAItE,kBAAkB,CACxB,0BAA0BY,MAAM,CAACqC,KAAK,CAACa,OAAO,YAClD,CAAC;IACL;EACJ;EAEA,MAAcS,wBAAwBA,CAAC3D,MAAyC,EAAE;IAC9E,MAAMC,GAAG,GAAG,MAAM,IAAI,CAACoD,2BAA2B,CAACrD,MAAM,CAAC;IAC1D,OAAOC,GAAG,CAACS,IAAI,CAACL,GAAG,IAAIA,GAAG,CAACM,iBAAiB,CAAC;EACjD;EAEA,MAAMiD,yBAAyBA,CAAC5D,MAAyC,EAAE;IACvE,MAAMW,iBAAiB,GAAG,MAAM,IAAI,CAACgD,wBAAwB,CAAC3D,MAAM,CAAC;IACrE,OAAO,CAACW,iBAAiB;EAC7B;EAEA,MAAc0C,2BAA2BA,CACrCrD,MAAyC,EACR;IACjC,IAAI,MAAM,IAAI,CAAC6D,sBAAsB,CAAC7D,MAAM,CAAC,EAAE;MAC3C,OAAO,CAAC;QAAEM,GAAG,EAAE,KAAK;QAAEgD,EAAE,EAAE,IAAI;QAAE3C,iBAAiB,EAAE,IAAI;QAAEG,kBAAkB,EAAE;MAAM,CAAC,CAAC;IACzF;;IAEA;IACA,MAAM;MAAEuB;IAAM,CAAC,GAAGrC,MAAM;IACxB,MAAMe,qBAAqB,GAAG,MAAM,IAAI,CAACvB,oBAAoB,CAAC,CAAC;IAC/D,MAAMS,GAA6B,GAAG,EAAE;IAExC,KAAK,IAAIwC,CAAC,GAAG,CAAC,EAAEA,CAAC,GAAG1B,qBAAqB,CAAC2B,MAAM,EAAED,CAAC,EAAE,EAAE;MACnD,MAAMqB,gBAAgB,GAAG/C,qBAAqB,CAAC0B,CAAC,CAAC;MAEjD,MAAME,qBAAqB,GAAG,MAAM,IAAI,CAAClD,oBAAoB,CAAC,CAAC;MAC/D,MAAMsE,wBAAwB,GAAGpB,qBAAqB,CAACvC,IAAI,CACvDuB,WAAW,IAAIA,WAAW,CAACkB,IAAI,KAAKiB,gBAAgB,CAACjB,IACzD,CAAC;MAED,IAAI,CAACkB,wBAAwB,EAAE;QAC3B;MACJ;MAEA,MAAMC,sBAAsB,GAAG,MAAM,IAAI,CAACtE,qBAAqB,CAAC,CAAC;MACjE,MAAMuE,yBAAyB,GAAGD,sBAAsB,CAAC5D,IAAI,CACzDuB,WAAW,IAAIA,WAAW,CAACkB,IAAI,KAAKiB,gBAAgB,CAACjB,IACzD,CAAC;MAED,IAAI,CAACoB,yBAAyB,EAAE;QAC5B;MACJ;MAEA,IAAIH,gBAAgB,CAAC7C,GAAG,EAAE;QACtB,MAAME,KAAK,GAAG,MAAM,IAAI,CAAC2B,QAAQ,CAACT,KAAK,CAAClB,KAAK,CAAC;QAC9C,IAAI,CAACA,KAAK,EAAE;UACR;QACJ;QAEA,MAAM+C,cAAc,GAAG/C,KAAK,CAACC,SAAS;QACtC,IAAI,CAAC8C,cAAc,EAAE;UACjB;QACJ;QAEA,MAAM7C,QAAQ,GAAG,MAAM,IAAI,CAAC9B,WAAW,CAAC,CAAC;QACzC,IAAI2E,cAAc,CAAC5C,EAAE,KAAKD,QAAQ,CAACC,EAAE,EAAE;UACnC;QACJ;QAEArB,GAAG,CAACsB,IAAI,CAAC;UACLjB,GAAG,EAAE,KAAK;UACVK,iBAAiB,EAAE,KAAK;UACxBG,kBAAkB,EAAE,IAAI;UACxBwC,EAAE,EAAEW,yBAAyB,CAACX;QAClC,CAAC,CAAC;QAEF;MACJ;MAEA,IAAIQ,gBAAgB,CAACtC,MAAM,EAAE;QACzB,MAAM;UAAEA;QAAO,CAAC,GAAGsC,gBAAgB;QAEnC,IAAI,CAACrC,KAAK,CAACC,OAAO,CAACF,MAAM,CAAC,EAAE;UACxB;QACJ;QAEA,IAAI,CAACA,MAAM,CAACjB,QAAQ,CAAC8B,KAAK,CAAClB,KAAK,CAAC,EAAE;UAC/B;QACJ;MACJ;MAEA,IAAI4C,wBAAwB,CAAC9C,GAAG,EAAE;QAC9B,MAAMgC,cAAc,GAAGZ,KAAK,CAACjB,SAAS;QACtC,IAAI,CAAC6B,cAAc,EAAE;UACjB;QACJ;QAEA,MAAM5B,QAAQ,GAAG,MAAM,IAAI,CAAC9B,WAAW,CAAC,CAAC;QACzC,IAAI0D,cAAc,CAAC3B,EAAE,KAAKD,QAAQ,CAACC,EAAE,EAAE;UACnC;QACJ;QAEArB,GAAG,CAACsB,IAAI,CAAC;UACLjB,GAAG,EAAE,KAAK;UACVK,iBAAiB,EAAE,KAAK;UACxBG,kBAAkB,EAAE,IAAI;UACxBwC,EAAE,EAAEW,yBAAyB,CAACX;QAClC,CAAC,CAAC;MACN;MAEA,IAAIS,wBAAwB,CAACf,MAAM,EAAE;QACjC,IAAI,CAACvB,KAAK,CAACC,OAAO,CAACqC,wBAAwB,CAACf,MAAM,CAAC,EAAE;UACjD;QACJ;QAEA,IAAI,CAACe,wBAAwB,CAACf,MAAM,CAACzC,QAAQ,CAAC8B,KAAK,CAACa,OAAO,CAAC,EAAE;UAC1D;QACJ;MACJ;MAEA,MAAMH,UAAU,GACZ,CAACkB,yBAAyB,CAAC3D,GAAG,IAC9B,CAAC2D,yBAAyB,CAAChD,GAAG,IAC9B,CAACgD,yBAAyB,CAACjB,MAAM;MAErC,IAAID,UAAU,EAAE;QACZ9C,GAAG,CAACsB,IAAI,CAAC;UACLjB,GAAG,EAAE,KAAK;UACVK,iBAAiB,EAAE,KAAK;UACxBG,kBAAkB,EAAE,IAAI;UACxBwC,EAAE,EAAE;QACR,CAAC,CAAC;QAEF;MACJ;MAEA,IAAIW,yBAAyB,CAAChD,GAAG,EAAE;QAC/B,IAAI,OAAO,IAAIjB,MAAM,EAAE;UACnB,MAAMmE,cAAc,GAAGnE,MAAM,CAACyD,KAAK,EAAErC,SAAS;UAC9C,IAAI,CAAC+C,cAAc,EAAE;YACjB;UACJ;UAEA,MAAM9C,QAAQ,GAAG,MAAM,IAAI,CAAC9B,WAAW,CAAC,CAAC;UACzC,IAAI4E,cAAc,CAAC7C,EAAE,KAAKD,QAAQ,CAACC,EAAE,EAAE;YACnC;UACJ;QACJ;QAEArB,GAAG,CAACsB,IAAI,CAAC;UACLjB,GAAG,EAAE2D,yBAAyB,CAAC3D,GAAG;UAClCK,iBAAiB,EAAE,KAAK;UACxBG,kBAAkB,EAAE,IAAI;UACxBwC,EAAE,EAAEW,yBAAyB,CAACX;QAClC,CAAC,CAAC;QAEF;MACJ;MAEArD,GAAG,CAACsB,IAAI,CAAC;QACLjB,GAAG,EAAE2D,yBAAyB,CAAC3D,GAAG;QAClCK,iBAAiB,EAAE,IAAI;QACvBG,kBAAkB,EAAE,KAAK;QACzBwC,EAAE,EAAEW,yBAAyB,CAACX;MAClC,CAAC,CAAC;IACN;IAEA,OAAOrD,GAAG;EACd;EAEA,MAAc4D,sBAAsBA,CAAC7D,MAAyC,EAAE;IAC5E,IAAI,IAAI,CAACmD,0BAA0B,CAACnD,MAAM,CAAC,EAAE;MACzC,OAAO,IAAI;IACf;IAEA,MAAM2B,WAAW,GAAG,MAAM,IAAI,CAACjC,qBAAqB,CAAC,CAAC;IACtD,OAAOiC,WAAW,CAACjB,IAAI,CAACkB,CAAC,IAAI,IAAI,CAAChC,qBAAqB,CAACiC,MAAM,CAACC,OAAO,CAAC,CAACvB,QAAQ,CAACqB,CAAC,CAACG,IAAI,CAAC,CAAC;EAC7F;EAEQoB,0BAA0BA,CAACnD,MAAyC,EAAE;IAC1E,IAAI,eAAe,IAAIA,MAAM,CAACqC,KAAK,EAAE;MACjC,MAAM;QAAE+B;MAAc,CAAC,GAAGpE,MAAM,CAACqC,KAAK;MACtC,IAAI,OAAO+B,aAAa,KAAK,SAAS,EAAE;QACpC,OAAOA,aAAa,KAAK,KAAK;MAClC;MAEA,OAAOA,aAAa,EAAEzC,WAAW,KAAK,KAAK;IAC/C;IAEA,OAAO,KAAK;EAChB;EAEA,MAAchC,aAAaA,CAAA,EAAwB;IAC/C,IAAI,IAAI,CAACG,SAAS,KAAK,IAAI,EAAE;MACzB,IAAI,CAACA,SAAS,GAAG,IAAI,CAACD,qBAAqB,CAAC,CAAC;IACjD;IAEA,OAAO,IAAI,CAACC,SAAS;EACzB;EAEA,MAAcgD,QAAQA,CAACuB,IAAY,EAAiC;IAChE,MAAM7C,MAAM,GAAG,MAAM,IAAI,CAAC7B,aAAa,CAAC,CAAC;IACzC,OAAO6B,MAAM,CAACpB,IAAI,CAACe,KAAK,IAAIA,KAAK,CAACkD,IAAI,KAAKA,IAAI,CAAC;EACpD;AACJ","ignoreList":[]}
1	+ {"version":3,"file":"crud/AccessControl/AccessControl.js","sources":["../../../src/crud/AccessControl/AccessControl.ts"],"sourcesContent":["import type {\n CmsEntry,\n CmsEntryPermission,\n CmsGroup,\n CmsGroupPermission,\n CmsModel,\n CmsModelPermission\n} from \"~/types/index.js\";\nimport type { SecurityIdentity } from \"@webiny/api-core/types/security.js\";\nimport { NotAuthorizedError } from \"~/utils/errors.js\";\n\nexport interface AccessControlParams {\n getIdentity: () => Promise<SecurityIdentity>;\n getGroupsPermissions: () => Promise<CmsGroupPermission[]>;\n getModelsPermissions: () => Promise<CmsModelPermission[]>;\n getEntriesPermissions: () => Promise<CmsEntryPermission[]>;\n listAllGroups: () => Promise<CmsGroup[]>;\n}\n\ninterface GetGroupsAccessControlListParams {\n group?: CmsGroup;\n}\n\ninterface CanAccessGroupParams extends GetGroupsAccessControlListParams {\n rwd?: string;\n}\n\ninterface GetModelsAccessControlListParams {\n model?: CmsModel;\n}\n\ninterface CanAccessModelParams extends GetModelsAccessControlListParams {\n rwd?: string;\n}\n\ninterface GetEntriesAccessControlListParams {\n model: Pick<CmsModel, \"modelId\" \| \"createdBy\" \| \"group\" \| \"authorization\">;\n entry?: Pick<CmsEntry, \"entryId\" \| \"createdBy\">;\n}\n\nexport interface CanAccessEntryParams extends GetEntriesAccessControlListParams {\n rwd?: string;\n pw?: string;\n}\n\ninterface AccessControlEntry {\n rwd: string;\n canAccessNonOwned: boolean;\n canAccessOnlyOwned: boolean;\n}\n\ntype AccessControlList = AccessControlEntry[];\n\ninterface EntriesAccessControlEntry extends AccessControlEntry {\n pw?: string;\n}\n\ntype EntriesAccessControlList = EntriesAccessControlEntry[];\n\ninterface IModelAuthorizationDisabledParams {\n model: Pick<CmsModel, \"authorization\">;\n}\n\nexport class AccessControl {\n private getIdentity: AccessControlParams[\"getIdentity\"];\n private getGroupsPermissions: AccessControlParams[\"getGroupsPermissions\"];\n private getModelsPermissions: AccessControlParams[\"getModelsPermissions\"];\n private getEntriesPermissions: AccessControlParams[\"getEntriesPermissions\"];\n private listAllGroupsCallback: AccessControlParams[\"listAllGroups\"];\n\n private fullAccessPermissions: string[];\n private allGroups: null \| Promise<CmsGroup[]>;\n\n constructor({\n getIdentity,\n getGroupsPermissions,\n getModelsPermissions,\n getEntriesPermissions,\n listAllGroups\n }: AccessControlParams) {\n this.getIdentity = getIdentity;\n this.getGroupsPermissions = getGroupsPermissions;\n this.getModelsPermissions = getModelsPermissions;\n this.getEntriesPermissions = getEntriesPermissions;\n this.fullAccessPermissions = [\"\", \"cms.\"];\n this.listAllGroupsCallback = listAllGroups;\n this.allGroups = null;\n }\n\n /*\n Groups-related methods below. 👇\n * - canAccessGroup\n * - ensureCanAccessGroup\n * - canAccessNonOwnedGroups\n * - canAccessOnlyOwnedGroups\n * - getGroupsAccessControlList\n * - hasFullAccessToGroups\n /\n\n async canAccessGroup(params: CanAccessGroupParams = {}) {\n const acl = await this.getGroupsAccessControlList(params);\n\n const canRead = acl.find(ace => ace.rwd?.includes(\"r\"));\n if (!canRead) {\n return false;\n }\n\n const { rwd } = params;\n if (rwd) {\n const hasRwd = acl.find(ace => ace.rwd.includes(rwd));\n if (!hasRwd) {\n return false;\n }\n }\n\n return true;\n }\n\n private async canAccessNonOwnedGroups(params: GetGroupsAccessControlListParams) {\n const acl = await this.getGroupsAccessControlList(params);\n return acl.some(ace => ace.canAccessNonOwned);\n }\n\n private async canAccessOnlyOwnedGroups(params: GetGroupsAccessControlListParams) {\n const canAccessNonOwned = await this.canAccessNonOwnedGroups(params);\n return !canAccessNonOwned;\n }\n\n private async getGroupsAccessControlList(\n params: GetGroupsAccessControlListParams\n ): Promise<AccessControlList> {\n if (await this.hasFullAccessToGroups()) {\n return [{ rwd: \"rwd\", canAccessNonOwned: true, canAccessOnlyOwned: false }];\n }\n\n const groupsPermissionsList = await this.getGroupsPermissions();\n const acl: AccessControlList = [];\n\n for (const groupsPermissions of groupsPermissionsList) {\n if (groupsPermissions.own) {\n if (\"group\" in params) {\n const modelGroupCreatedBy = params.group?.createdBy;\n if (!modelGroupCreatedBy) {\n continue;\n }\n\n const identity = await this.getIdentity();\n\n if (modelGroupCreatedBy.id !== identity.id) {\n continue;\n }\n }\n\n acl.push({\n rwd: \"rwd\",\n canAccessNonOwned: false,\n canAccessOnlyOwned: true\n });\n }\n\n if (groupsPermissions.groups) {\n if (\"group\" in params) {\n const { group } = params;\n if (!group) {\n continue;\n }\n\n const { groups } = groupsPermissions;\n if (!Array.isArray(groups)) {\n continue;\n }\n\n if (!groups.includes(group.id)) {\n continue;\n }\n }\n }\n\n acl.push({\n rwd: groupsPermissions.rwd as string,\n canAccessNonOwned: true,\n canAccessOnlyOwned: false\n });\n }\n\n return acl;\n }\n\n private async hasFullAccessToGroups() {\n const permissions = await this.getGroupsPermissions();\n return permissions.some(p => this.fullAccessPermissions.filter(Boolean).includes(p.name));\n }\n\n /\n Models-related methods below. 👇\n * - canAccessModel\n * - ensureCanAccessModel\n * - canAccessNonOwnedModels\n * - canAccessOnlyOwnedModels\n * - getModelsAccessControlList\n * - hasFullAccessToModels\n /\n\n async canAccessModel(params: CanAccessModelParams) {\n const acl = await this.getModelsAccessControlList(params);\n\n const canRead = acl.find(ace => ace.rwd.includes(\"r\"));\n if (!canRead) {\n return false;\n }\n\n const { rwd } = params;\n if (rwd) {\n const hasRwd = acl.find(ace => ace.rwd.includes(rwd));\n if (!hasRwd) {\n return false;\n }\n }\n\n return true;\n }\n\n private async ensureCanAccessModel(params: CanAccessModelParams = {}) {\n const canAccess = await this.canAccessModel(params);\n if (canAccess) {\n return;\n }\n\n if (\"model\" in params) {\n let modelName = \"(could not determine name)\";\n if (params.model?.name) {\n modelName = `\"${params.model.name}\"`;\n }\n\n throw new NotAuthorizedError(`Not allowed to access content model ${modelName}.`);\n }\n\n throw new NotAuthorizedError(`Not allowed to access content models.`);\n }\n\n private async canAccessNonOwnedModels(params: GetModelsAccessControlListParams) {\n const acl = await this.getModelsAccessControlList(params);\n return acl.some(ace => ace.canAccessNonOwned);\n }\n\n private async canAccessOnlyOwnedModels(params: GetModelsAccessControlListParams) {\n const canAccessNonOwned = await this.canAccessNonOwnedModels(params);\n return !canAccessNonOwned;\n }\n\n private async getModelsAccessControlList(\n params: GetModelsAccessControlListParams\n ): Promise<AccessControlList> {\n if (await this.hasFullAccessToModels(params)) {\n return [{ rwd: \"rwd\", canAccessNonOwned: true, canAccessOnlyOwned: false }];\n }\n\n const groupsPermissionsList = await this.getGroupsPermissions();\n const acl: AccessControlList = [];\n\n for (let i = 0; i < groupsPermissionsList.length; i++) {\n const groupsPermissions = groupsPermissionsList[i];\n\n const modelsPermissionsList = await this.getModelsPermissions();\n const relatedModelPermissions = modelsPermissionsList.find(\n permissions => permissions._src === groupsPermissions._src\n );\n\n if (!relatedModelPermissions) {\n continue;\n }\n\n if (groupsPermissions.own) {\n if (\"model\" in params) {\n const { model } = params;\n if (!model) {\n continue;\n }\n\n const group = await this.getGroup(model.group);\n if (!group) {\n continue;\n }\n\n const modelGroupCreatedBy = group.createdBy;\n if (!modelGroupCreatedBy) {\n continue;\n }\n\n const identity = await this.getIdentity();\n if (modelGroupCreatedBy.id !== identity.id) {\n continue;\n }\n }\n\n acl.push({\n rwd: \"rwd\",\n canAccessNonOwned: false,\n canAccessOnlyOwned: true\n });\n\n continue;\n }\n\n if (groupsPermissions.groups) {\n if (\"model\" in params) {\n const { model } = params;\n if (!model) {\n continue;\n }\n\n if (!Array.isArray(groupsPermissions.groups)) {\n continue;\n }\n\n if (!groupsPermissions.groups.includes(model.group)) {\n continue;\n }\n }\n }\n\n const fullAccess =\n !relatedModelPermissions.rwd &&\n !relatedModelPermissions.own &&\n !relatedModelPermissions.models;\n\n if (fullAccess) {\n acl.push({\n rwd: \"rwd\",\n canAccessNonOwned: true,\n canAccessOnlyOwned: false\n });\n\n continue;\n }\n\n if (relatedModelPermissions.own) {\n if (\"model\" in params) {\n if (!params.model) {\n continue;\n }\n\n const modelCreatedBy = params.model.createdBy;\n if (!modelCreatedBy) {\n continue;\n }\n\n const identity = await this.getIdentity();\n if (modelCreatedBy.id !== identity.id) {\n continue;\n }\n }\n\n acl.push({\n rwd: \"rwd\",\n canAccessNonOwned: false,\n canAccessOnlyOwned: true\n });\n\n continue;\n }\n\n if (relatedModelPermissions.models) {\n const { models } = relatedModelPermissions;\n if (\"model\" in params) {\n if (!params.model) {\n continue;\n }\n\n if (!Array.isArray(models)) {\n continue;\n }\n\n if (!models.includes(params.model.modelId)) {\n continue;\n }\n }\n }\n\n acl.push({\n rwd: relatedModelPermissions.rwd as string,\n canAccessNonOwned: true,\n canAccessOnlyOwned: false\n });\n }\n\n return acl;\n }\n\n private async hasFullAccessToModels(params: GetModelsAccessControlListParams) {\n const { model } = params;\n if (model) {\n if (this.modelAuthorizationDisabled({ model })) {\n return true;\n }\n }\n\n const permissions = await this.getModelsPermissions();\n return permissions.some(p => this.fullAccessPermissions.filter(Boolean).includes(p.name));\n }\n\n /\n Entries-related methods below. 👇\n * - canAccessEntry\n * - ensureCanAccessEntry\n * - canAccessNonOwnedEntries\n * - canAccessOnlyOwnedEntries\n * - getEntriesAccessControlList\n * - hasFullAccessToEntries\n */\n\n async canAccessEntry(params: CanAccessEntryParams) {\n const acl = await this.getEntriesAccessControlList(params);\n\n const canRead = acl.find(ace => ace.rwd.includes(\"r\"));\n if (!canRead) {\n return false;\n }\n\n const { rwd } = params;\n if (rwd) {\n const hasRwd = acl.find(ace => ace.rwd.includes(rwd));\n if (!hasRwd) {\n return false;\n }\n }\n\n const { pw } = params;\n if (pw) {\n const hasPw = acl.find(ace => ace.pw?.includes(pw));\n if (!hasPw) {\n return false;\n }\n }\n\n return true;\n }\n\n private async ensureCanAccessEntry(params: CanAccessEntryParams) {\n const canAccess = await this.canAccessEntry(params);\n if (!canAccess) {\n if (params.entry) {\n throw new NotAuthorizedError(\n `Not allowed to access entry \"${params.entry.entryId}\".`\n );\n }\n\n throw new NotAuthorizedError(\n `Not allowed to access \"${params.model.modelId}\" entries.`\n );\n }\n }\n\n private async canAccessNonOwnedEntries(params: GetEntriesAccessControlListParams) {\n const acl = await this.getEntriesAccessControlList(params);\n return acl.some(ace => ace.canAccessNonOwned);\n }\n\n async canAccessOnlyOwnedEntries(params: GetEntriesAccessControlListParams) {\n const canAccessNonOwned = await this.canAccessNonOwnedEntries(params);\n return !canAccessNonOwned;\n }\n\n private async getEntriesAccessControlList(\n params: GetEntriesAccessControlListParams\n ): Promise<EntriesAccessControlList> {\n if (await this.hasFullAccessToEntries(params)) {\n return [{ rwd: \"rwd\", pw: \"pu\", canAccessNonOwned: true, canAccessOnlyOwned: false }];\n }\n\n // We need a map of groups slugs to ids, to perform checks on models\n const { model } = params;\n const groupsPermissionsList = await this.getGroupsPermissions();\n const acl: EntriesAccessControlList = [];\n\n for (let i = 0; i < groupsPermissionsList.length; i++) {\n const groupPermissions = groupsPermissionsList[i];\n\n const modelsPermissionsList = await this.getModelsPermissions();\n const relatedModelsPermissions = modelsPermissionsList.find(\n permissions => permissions._src === groupPermissions._src\n );\n\n if (!relatedModelsPermissions) {\n continue;\n }\n\n const entriesPermissionsList = await this.getEntriesPermissions();\n const relatedEntriesPermissions = entriesPermissionsList.find(\n permissions => permissions._src === groupPermissions._src\n );\n\n if (!relatedEntriesPermissions) {\n continue;\n }\n\n if (groupPermissions.own) {\n const group = await this.getGroup(model.group);\n if (!group) {\n continue;\n }\n\n const groupCreatedBy = group.createdBy;\n if (!groupCreatedBy) {\n continue;\n }\n\n const identity = await this.getIdentity();\n if (groupCreatedBy.id !== identity.id) {\n continue;\n }\n\n acl.push({\n rwd: \"rwd\",\n canAccessNonOwned: false,\n canAccessOnlyOwned: true,\n pw: relatedEntriesPermissions.pw\n });\n\n continue;\n }\n\n if (groupPermissions.groups) {\n const { groups } = groupPermissions;\n\n if (!Array.isArray(groups)) {\n continue;\n }\n\n if (!groups.includes(model.group)) {\n continue;\n }\n }\n\n if (relatedModelsPermissions.own) {\n const modelCreatedBy = model.createdBy;\n if (!modelCreatedBy) {\n continue;\n }\n\n const identity = await this.getIdentity();\n if (modelCreatedBy.id !== identity.id) {\n continue;\n }\n\n acl.push({\n rwd: \"rwd\",\n canAccessNonOwned: false,\n canAccessOnlyOwned: true,\n pw: relatedEntriesPermissions.pw\n });\n }\n\n if (relatedModelsPermissions.models) {\n if (!Array.isArray(relatedModelsPermissions.models)) {\n continue;\n }\n\n if (!relatedModelsPermissions.models.includes(model.modelId)) {\n continue;\n }\n }\n\n const fullAccess =\n !relatedEntriesPermissions.rwd &&\n !relatedEntriesPermissions.own &&\n !relatedEntriesPermissions.models;\n\n if (fullAccess) {\n acl.push({\n rwd: \"rwd\",\n canAccessNonOwned: false,\n canAccessOnlyOwned: true,\n pw: \"pu\"\n });\n\n continue;\n }\n\n if (relatedEntriesPermissions.own) {\n if (\"entry\" in params) {\n const entryCreatedBy = params.entry?.createdBy;\n if (!entryCreatedBy) {\n continue;\n }\n\n const identity = await this.getIdentity();\n if (entryCreatedBy.id !== identity.id) {\n continue;\n }\n }\n\n acl.push({\n rwd: relatedEntriesPermissions.rwd,\n canAccessNonOwned: false,\n canAccessOnlyOwned: true,\n pw: relatedEntriesPermissions.pw\n });\n\n continue;\n }\n\n acl.push({\n rwd: relatedEntriesPermissions.rwd,\n canAccessNonOwned: true,\n canAccessOnlyOwned: false,\n pw: relatedEntriesPermissions.pw\n });\n }\n\n return acl;\n }\n\n private async hasFullAccessToEntries(params: GetEntriesAccessControlListParams) {\n if (this.modelAuthorizationDisabled(params)) {\n return true;\n }\n\n const permissions = await this.getEntriesPermissions();\n return permissions.some(p => this.fullAccessPermissions.filter(Boolean).includes(p.name));\n }\n\n private modelAuthorizationDisabled(params: IModelAuthorizationDisabledParams) {\n if (\"authorization\" in params.model) {\n const { authorization } = params.model;\n if (typeof authorization === \"boolean\") {\n return authorization === false;\n }\n\n return authorization?.permissions === false;\n }\n\n return false;\n }\n\n private async listAllGroups(): Promise<CmsGroup[]> {\n if (this.allGroups === null) {\n this.allGroups = this.listAllGroupsCallback();\n }\n\n return this.allGroups;\n }\n\n private async getGroup(slug: string): Promise<CmsGroup \| undefined> {\n const groups = await this.listAllGroups();\n return groups.find(group => group.slug === slug);\n }\n}\n"],"names":["AccessControl","getIdentity","getGroupsPermissions","getModelsPermissions","getEntriesPermissions","listAllGroups","params","acl","canRead","ace","rwd","hasRwd","canAccessNonOwned","groupsPermissionsList","groupsPermissions","modelGroupCreatedBy","identity","group","groups","Array","permissions","p","Boolean","canAccess","modelName","NotAuthorizedError","i","modelsPermissionsList","relatedModelPermissions","model","fullAccess","modelCreatedBy","models","pw","hasPw","groupPermissions","relatedModelsPermissions","entriesPermissionsList","relatedEntriesPermissions","groupCreatedBy","entryCreatedBy","authorization","slug"],"mappings":";AA+DO,MAAMA;IAUT,YAAY,EACRC,WAAW,EACXC,oBAAoB,EACpBC,oBAAoB,EACpBC,qBAAqB,EACrBC,aAAa,EACK,CAAE;QACpB,IAAI,CAAC,WAAW,GAAGJ;QACnB,IAAI,CAAC,oBAAoB,GAAGC;QAC5B,IAAI,CAAC,oBAAoB,GAAGC;QAC5B,IAAI,CAAC,qBAAqB,GAAGC;QAC7B,IAAI,CAAC,qBAAqB,GAAG;YAAC;YAAK;SAAQ;QAC3C,IAAI,CAAC,qBAAqB,GAAGC;QAC7B,IAAI,CAAC,SAAS,GAAG;IACrB;IAYA,MAAM,eAAeC,SAA+B,CAAC,CAAC,EAAE;QACpD,MAAMC,MAAM,MAAM,IAAI,CAAC,0BAA0B,CAACD;QAElD,MAAME,UAAUD,IAAI,IAAI,CAACE,CAAAA,MAAOA,IAAI,GAAG,EAAE,SAAS;QAClD,IAAI,CAACD,SACD,OAAO;QAGX,MAAM,EAAEE,GAAG,EAAE,GAAGJ;QAChB,IAAII,KAAK;YACL,MAAMC,SAASJ,IAAI,IAAI,CAACE,CAAAA,MAAOA,IAAI,GAAG,CAAC,QAAQ,CAACC;YAChD,IAAI,CAACC,QACD,OAAO;QAEf;QAEA,OAAO;IACX;IAEA,MAAc,wBAAwBL,MAAwC,EAAE;QAC5E,MAAMC,MAAM,MAAM,IAAI,CAAC,0BAA0B,CAACD;QAClD,OAAOC,IAAI,IAAI,CAACE,CAAAA,MAAOA,IAAI,iBAAiB;IAChD;IAEA,MAAc,yBAAyBH,MAAwC,EAAE;QAC7E,MAAMM,oBAAoB,MAAM,IAAI,CAAC,uBAAuB,CAACN;QAC7D,OAAO,CAACM;IACZ;IAEA,MAAc,2BACVN,MAAwC,EACd;QAC1B,IAAI,MAAM,IAAI,CAAC,qBAAqB,IAChC,OAAO;YAAC;gBAAE,KAAK;gBAAO,mBAAmB;gBAAM,oBAAoB;YAAM;SAAE;QAG/E,MAAMO,wBAAwB,MAAM,IAAI,CAAC,oBAAoB;QAC7D,MAAMN,MAAyB,EAAE;QAEjC,KAAK,MAAMO,qBAAqBD,sBAAuB;YACnD,IAAIC,kBAAkB,GAAG,EAAE;gBACvB,IAAI,WAAWR,QAAQ;oBACnB,MAAMS,sBAAsBT,OAAO,KAAK,EAAE;oBAC1C,IAAI,CAACS,qBACD;oBAGJ,MAAMC,WAAW,MAAM,IAAI,CAAC,WAAW;oBAEvC,IAAID,oBAAoB,EAAE,KAAKC,SAAS,EAAE,EACtC;gBAER;gBAEAT,IAAI,IAAI,CAAC;oBACL,KAAK;oBACL,mBAAmB;oBACnB,oBAAoB;gBACxB;YACJ;YAEA,IAAIO,kBAAkB,MAAM,EACxB;gBAAA,IAAI,WAAWR,QAAQ;oBACnB,MAAM,EAAEW,KAAK,EAAE,GAAGX;oBAClB,IAAI,CAACW,OACD;oBAGJ,MAAM,EAAEC,MAAM,EAAE,GAAGJ;oBACnB,IAAI,CAACK,MAAM,OAAO,CAACD,SACf;oBAGJ,IAAI,CAACA,OAAO,QAAQ,CAACD,MAAM,EAAE,GACzB;gBAER;YAAA;YAGJV,IAAI,IAAI,CAAC;gBACL,KAAKO,kBAAkB,GAAG;gBAC1B,mBAAmB;gBACnB,oBAAoB;YACxB;QACJ;QAEA,OAAOP;IACX;IAEA,MAAc,wBAAwB;QAClC,MAAMa,cAAc,MAAM,IAAI,CAAC,oBAAoB;QACnD,OAAOA,YAAY,IAAI,CAACC,CAAAA,IAAK,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAACC,SAAS,QAAQ,CAACD,EAAE,IAAI;IAC3F;IAYA,MAAM,eAAef,MAA4B,EAAE;QAC/C,MAAMC,MAAM,MAAM,IAAI,CAAC,0BAA0B,CAACD;QAElD,MAAME,UAAUD,IAAI,IAAI,CAACE,CAAAA,MAAOA,IAAI,GAAG,CAAC,QAAQ,CAAC;QACjD,IAAI,CAACD,SACD,OAAO;QAGX,MAAM,EAAEE,GAAG,EAAE,GAAGJ;QAChB,IAAII,KAAK;YACL,MAAMC,SAASJ,IAAI,IAAI,CAACE,CAAAA,MAAOA,IAAI,GAAG,CAAC,QAAQ,CAACC;YAChD,IAAI,CAACC,QACD,OAAO;QAEf;QAEA,OAAO;IACX;IAEA,MAAc,qBAAqBL,SAA+B,CAAC,CAAC,EAAE;QAClE,MAAMiB,YAAY,MAAM,IAAI,CAAC,cAAc,CAACjB;QAC5C,IAAIiB,WACA;QAGJ,IAAI,WAAWjB,QAAQ;YACnB,IAAIkB,YAAY;YAChB,IAAIlB,OAAO,KAAK,EAAE,MACdkB,YAAY,CAAC,CAAC,EAAElB,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YAGxC,MAAM,IAAImB,mBAAmB,CAAC,oCAAoC,EAAED,UAAU,CAAC,CAAC;QACpF;QAEA,MAAM,IAAIC,mBAAmB;IACjC;IAEA,MAAc,wBAAwBnB,MAAwC,EAAE;QAC5E,MAAMC,MAAM,MAAM,IAAI,CAAC,0BAA0B,CAACD;QAClD,OAAOC,IAAI,IAAI,CAACE,CAAAA,MAAOA,IAAI,iBAAiB;IAChD;IAEA,MAAc,yBAAyBH,MAAwC,EAAE;QAC7E,MAAMM,oBAAoB,MAAM,IAAI,CAAC,uBAAuB,CAACN;QAC7D,OAAO,CAACM;IACZ;IAEA,MAAc,2BACVN,MAAwC,EACd;QAC1B,IAAI,MAAM,IAAI,CAAC,qBAAqB,CAACA,SACjC,OAAO;YAAC;gBAAE,KAAK;gBAAO,mBAAmB;gBAAM,oBAAoB;YAAM;SAAE;QAG/E,MAAMO,wBAAwB,MAAM,IAAI,CAAC,oBAAoB;QAC7D,MAAMN,MAAyB,EAAE;QAEjC,IAAK,IAAImB,IAAI,GAAGA,IAAIb,sBAAsB,MAAM,EAAEa,IAAK;YACnD,MAAMZ,oBAAoBD,qBAAqB,CAACa,EAAE;YAElD,MAAMC,wBAAwB,MAAM,IAAI,CAAC,oBAAoB;YAC7D,MAAMC,0BAA0BD,sBAAsB,IAAI,CACtDP,CAAAA,cAAeA,YAAY,IAAI,KAAKN,kBAAkB,IAAI;YAG9D,IAAI,CAACc,yBACD;YAGJ,IAAId,kBAAkB,GAAG,EAAE;gBACvB,IAAI,WAAWR,QAAQ;oBACnB,MAAM,EAAEuB,KAAK,EAAE,GAAGvB;oBAClB,IAAI,CAACuB,OACD;oBAGJ,MAAMZ,QAAQ,MAAM,IAAI,CAAC,QAAQ,CAACY,MAAM,KAAK;oBAC7C,IAAI,CAACZ,OACD;oBAGJ,MAAMF,sBAAsBE,MAAM,SAAS;oBAC3C,IAAI,CAACF,qBACD;oBAGJ,MAAMC,WAAW,MAAM,IAAI,CAAC,WAAW;oBACvC,IAAID,oBAAoB,EAAE,KAAKC,SAAS,EAAE,EACtC;gBAER;gBAEAT,IAAI,IAAI,CAAC;oBACL,KAAK;oBACL,mBAAmB;oBACnB,oBAAoB;gBACxB;gBAEA;YACJ;YAEA,IAAIO,kBAAkB,MAAM,EACxB;gBAAA,IAAI,WAAWR,QAAQ;oBACnB,MAAM,EAAEuB,KAAK,EAAE,GAAGvB;oBAClB,IAAI,CAACuB,OACD;oBAGJ,IAAI,CAACV,MAAM,OAAO,CAACL,kBAAkB,MAAM,GACvC;oBAGJ,IAAI,CAACA,kBAAkB,MAAM,CAAC,QAAQ,CAACe,MAAM,KAAK,GAC9C;gBAER;YAAA;YAGJ,MAAMC,aACF,CAACF,wBAAwB,GAAG,IAC5B,CAACA,wBAAwB,GAAG,IAC5B,CAACA,wBAAwB,MAAM;YAEnC,IAAIE,YAAY;gBACZvB,IAAI,IAAI,CAAC;oBACL,KAAK;oBACL,mBAAmB;oBACnB,oBAAoB;gBACxB;gBAEA;YACJ;YAEA,IAAIqB,wBAAwB,GAAG,EAAE;gBAC7B,IAAI,WAAWtB,QAAQ;oBACnB,IAAI,CAACA,OAAO,KAAK,EACb;oBAGJ,MAAMyB,iBAAiBzB,OAAO,KAAK,CAAC,SAAS;oBAC7C,IAAI,CAACyB,gBACD;oBAGJ,MAAMf,WAAW,MAAM,IAAI,CAAC,WAAW;oBACvC,IAAIe,eAAe,EAAE,KAAKf,SAAS,EAAE,EACjC;gBAER;gBAEAT,IAAI,IAAI,CAAC;oBACL,KAAK;oBACL,mBAAmB;oBACnB,oBAAoB;gBACxB;gBAEA;YACJ;YAEA,IAAIqB,wBAAwB,MAAM,EAAE;gBAChC,MAAM,EAAEI,MAAM,EAAE,GAAGJ;gBACnB,IAAI,WAAWtB,QAAQ;oBACnB,IAAI,CAACA,OAAO,KAAK,EACb;oBAGJ,IAAI,CAACa,MAAM,OAAO,CAACa,SACf;oBAGJ,IAAI,CAACA,OAAO,QAAQ,CAAC1B,OAAO,KAAK,CAAC,OAAO,GACrC;gBAER;YACJ;YAEAC,IAAI,IAAI,CAAC;gBACL,KAAKqB,wBAAwB,GAAG;gBAChC,mBAAmB;gBACnB,oBAAoB;YACxB;QACJ;QAEA,OAAOrB;IACX;IAEA,MAAc,sBAAsBD,MAAwC,EAAE;QAC1E,MAAM,EAAEuB,KAAK,EAAE,GAAGvB;QAClB,IAAIuB,OACA;YAAA,IAAI,IAAI,CAAC,0BAA0B,CAAC;gBAAEA;YAAM,IACxC,OAAO;QACX;QAGJ,MAAMT,cAAc,MAAM,IAAI,CAAC,oBAAoB;QACnD,OAAOA,YAAY,IAAI,CAACC,CAAAA,IAAK,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAACC,SAAS,QAAQ,CAACD,EAAE,IAAI;IAC3F;IAYA,MAAM,eAAef,MAA4B,EAAE;QAC/C,MAAMC,MAAM,MAAM,IAAI,CAAC,2BAA2B,CAACD;QAEnD,MAAME,UAAUD,IAAI,IAAI,CAACE,CAAAA,MAAOA,IAAI,GAAG,CAAC,QAAQ,CAAC;QACjD,IAAI,CAACD,SACD,OAAO;QAGX,MAAM,EAAEE,GAAG,EAAE,GAAGJ;QAChB,IAAII,KAAK;YACL,MAAMC,SAASJ,IAAI,IAAI,CAACE,CAAAA,MAAOA,IAAI,GAAG,CAAC,QAAQ,CAACC;YAChD,IAAI,CAACC,QACD,OAAO;QAEf;QAEA,MAAM,EAAEsB,EAAE,EAAE,GAAG3B;QACf,IAAI2B,IAAI;YACJ,MAAMC,QAAQ3B,IAAI,IAAI,CAACE,CAAAA,MAAOA,IAAI,EAAE,EAAE,SAASwB;YAC/C,IAAI,CAACC,OACD,OAAO;QAEf;QAEA,OAAO;IACX;IAEA,MAAc,qBAAqB5B,MAA4B,EAAE;QAC7D,MAAMiB,YAAY,MAAM,IAAI,CAAC,cAAc,CAACjB;QAC5C,IAAI,CAACiB,WAAW;YACZ,IAAIjB,OAAO,KAAK,EACZ,MAAM,IAAImB,mBACN,CAAC,6BAA6B,EAAEnB,OAAO,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YAIhE,MAAM,IAAImB,mBACN,CAAC,uBAAuB,EAAEnB,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;QAElE;IACJ;IAEA,MAAc,yBAAyBA,MAAyC,EAAE;QAC9E,MAAMC,MAAM,MAAM,IAAI,CAAC,2BAA2B,CAACD;QACnD,OAAOC,IAAI,IAAI,CAACE,CAAAA,MAAOA,IAAI,iBAAiB;IAChD;IAEA,MAAM,0BAA0BH,MAAyC,EAAE;QACvE,MAAMM,oBAAoB,MAAM,IAAI,CAAC,wBAAwB,CAACN;QAC9D,OAAO,CAACM;IACZ;IAEA,MAAc,4BACVN,MAAyC,EACR;QACjC,IAAI,MAAM,IAAI,CAAC,sBAAsB,CAACA,SAClC,OAAO;YAAC;gBAAE,KAAK;gBAAO,IAAI;gBAAM,mBAAmB;gBAAM,oBAAoB;YAAM;SAAE;QAIzF,MAAM,EAAEuB,KAAK,EAAE,GAAGvB;QAClB,MAAMO,wBAAwB,MAAM,IAAI,CAAC,oBAAoB;QAC7D,MAAMN,MAAgC,EAAE;QAExC,IAAK,IAAImB,IAAI,GAAGA,IAAIb,sBAAsB,MAAM,EAAEa,IAAK;YACnD,MAAMS,mBAAmBtB,qBAAqB,CAACa,EAAE;YAEjD,MAAMC,wBAAwB,MAAM,IAAI,CAAC,oBAAoB;YAC7D,MAAMS,2BAA2BT,sBAAsB,IAAI,CACvDP,CAAAA,cAAeA,YAAY,IAAI,KAAKe,iBAAiB,IAAI;YAG7D,IAAI,CAACC,0BACD;YAGJ,MAAMC,yBAAyB,MAAM,IAAI,CAAC,qBAAqB;YAC/D,MAAMC,4BAA4BD,uBAAuB,IAAI,CACzDjB,CAAAA,cAAeA,YAAY,IAAI,KAAKe,iBAAiB,IAAI;YAG7D,IAAI,CAACG,2BACD;YAGJ,IAAIH,iBAAiB,GAAG,EAAE;gBACtB,MAAMlB,QAAQ,MAAM,IAAI,CAAC,QAAQ,CAACY,MAAM,KAAK;gBAC7C,IAAI,CAACZ,OACD;gBAGJ,MAAMsB,iBAAiBtB,MAAM,SAAS;gBACtC,IAAI,CAACsB,gBACD;gBAGJ,MAAMvB,WAAW,MAAM,IAAI,CAAC,WAAW;gBACvC,IAAIuB,eAAe,EAAE,KAAKvB,SAAS,EAAE,EACjC;gBAGJT,IAAI,IAAI,CAAC;oBACL,KAAK;oBACL,mBAAmB;oBACnB,oBAAoB;oBACpB,IAAI+B,0BAA0B,EAAE;gBACpC;gBAEA;YACJ;YAEA,IAAIH,iBAAiB,MAAM,EAAE;gBACzB,MAAM,EAAEjB,MAAM,EAAE,GAAGiB;gBAEnB,IAAI,CAAChB,MAAM,OAAO,CAACD,SACf;gBAGJ,IAAI,CAACA,OAAO,QAAQ,CAACW,MAAM,KAAK,GAC5B;YAER;YAEA,IAAIO,yBAAyB,GAAG,EAAE;gBAC9B,MAAML,iBAAiBF,MAAM,SAAS;gBACtC,IAAI,CAACE,gBACD;gBAGJ,MAAMf,WAAW,MAAM,IAAI,CAAC,WAAW;gBACvC,IAAIe,eAAe,EAAE,KAAKf,SAAS,EAAE,EACjC;gBAGJT,IAAI,IAAI,CAAC;oBACL,KAAK;oBACL,mBAAmB;oBACnB,oBAAoB;oBACpB,IAAI+B,0BAA0B,EAAE;gBACpC;YACJ;YAEA,IAAIF,yBAAyB,MAAM,EAAE;gBACjC,IAAI,CAACjB,MAAM,OAAO,CAACiB,yBAAyB,MAAM,GAC9C;gBAGJ,IAAI,CAACA,yBAAyB,MAAM,CAAC,QAAQ,CAACP,MAAM,OAAO,GACvD;YAER;YAEA,MAAMC,aACF,CAACQ,0BAA0B,GAAG,IAC9B,CAACA,0BAA0B,GAAG,IAC9B,CAACA,0BAA0B,MAAM;YAErC,IAAIR,YAAY;gBACZvB,IAAI,IAAI,CAAC;oBACL,KAAK;oBACL,mBAAmB;oBACnB,oBAAoB;oBACpB,IAAI;gBACR;gBAEA;YACJ;YAEA,IAAI+B,0BAA0B,GAAG,EAAE;gBAC/B,IAAI,WAAWhC,QAAQ;oBACnB,MAAMkC,iBAAiBlC,OAAO,KAAK,EAAE;oBACrC,IAAI,CAACkC,gBACD;oBAGJ,MAAMxB,WAAW,MAAM,IAAI,CAAC,WAAW;oBACvC,IAAIwB,eAAe,EAAE,KAAKxB,SAAS,EAAE,EACjC;gBAER;gBAEAT,IAAI,IAAI,CAAC;oBACL,KAAK+B,0BAA0B,GAAG;oBAClC,mBAAmB;oBACnB,oBAAoB;oBACpB,IAAIA,0BAA0B,EAAE;gBACpC;gBAEA;YACJ;YAEA/B,IAAI,IAAI,CAAC;gBACL,KAAK+B,0BAA0B,GAAG;gBAClC,mBAAmB;gBACnB,oBAAoB;gBACpB,IAAIA,0BAA0B,EAAE;YACpC;QACJ;QAEA,OAAO/B;IACX;IAEA,MAAc,uBAAuBD,MAAyC,EAAE;QAC5E,IAAI,IAAI,CAAC,0BAA0B,CAACA,SAChC,OAAO;QAGX,MAAMc,cAAc,MAAM,IAAI,CAAC,qBAAqB;QACpD,OAAOA,YAAY,IAAI,CAACC,CAAAA,IAAK,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAACC,SAAS,QAAQ,CAACD,EAAE,IAAI;IAC3F;IAEQ,2BAA2Bf,MAAyC,EAAE;QAC1E,IAAI,mBAAmBA,OAAO,KAAK,EAAE;YACjC,MAAM,EAAEmC,aAAa,EAAE,GAAGnC,OAAO,KAAK;YACtC,IAAI,AAAyB,aAAzB,OAAOmC,eACP,OAAOA,AAAkB,UAAlBA;YAGX,OAAOA,eAAe,gBAAgB;QAC1C;QAEA,OAAO;IACX;IAEA,MAAc,gBAAqC;QAC/C,IAAI,AAAmB,SAAnB,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,qBAAqB;QAG/C,OAAO,IAAI,CAAC,SAAS;IACzB;IAEA,MAAc,SAASC,IAAY,EAAiC;QAChE,MAAMxB,SAAS,MAAM,IAAI,CAAC,aAAa;QACvC,OAAOA,OAAO,IAAI,CAACD,CAAAA,QAASA,MAAM,IAAI,KAAKyB;IAC/C;AACJ"}