@wildo-ai/saas-backend-lib 1.0.1

package/dist/esm/databases/services/__tests__/mock-zod-mongoose-schema-convertor.service.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Vitest-oriented mock Zod → Mongoose convertor for integration tests (`vi.fn` on methods).
+ *
+ * **Naming**: `mock-*.service.ts` — canonical mock module, not a test suite.
+ * Plain `.ts` keeps it barrel-compilable, and Vitest also excludes these files
+ * explicitly as a defensive guard.
+ */
+import 'reflect-metadata';
+import type { Model } from 'mongoose';
+export declare class MockZodToMongooseSchemaConvertorBackendService {
+    private models;
+    convertResourceConfigurationToModel: import("vitest").Mock<[resourceConfig: any, _options?: any], {
+        mainModel: Model<any, {}, {}, {}, any, any>;
+        inheritanceSchemas: any[];
+    }>;
+    getModel(name: string): Model<any> | undefined;
+    reset(): void;
+}
+//# sourceMappingURL=mock-zod-mongoose-schema-convertor.service.d.ts.map

package/dist/esm/databases/services/__tests__/mock-zod-mongoose-schema-convertor.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mock-zod-mongoose-schema-convertor.service.d.ts","sourceRoot":"","sources":["../../../../../src/databases/services/__tests__/mock-zod-mongoose-schema-convertor.service.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC;AAKtC,qBACa,8CAA8C;IACzD,OAAO,CAAC,MAAM,CAAiC;IAE/C,mCAAmC;;;OAWhC;IAEH,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,SAAS;IAI9C,KAAK;CAKN"}

package/dist/esm/databases/services/__tests__/mock-zod-mongoose-schema-convertor.service.js

@@ -0,0 +1,44 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+/**
+ * Vitest-oriented mock Zod → Mongoose convertor for integration tests (`vi.fn` on methods).
+ *
+ * **Naming**: `mock-*.service.ts` — canonical mock module, not a test suite.
+ * Plain `.ts` keeps it barrel-compilable, and Vitest also excludes these files
+ * explicitly as a defensive guard.
+ */
+import 'reflect-metadata';
+import { injectable } from 'inversify';
+import { vi } from 'vitest';
+import { createMockModel } from './mock-mongoose-model.service.js';
+import { resetMockMongoTransactions } from './mock-mongo-transaction-registry.service.js';
+let MockZodToMongooseSchemaConvertorBackendService = class MockZodToMongooseSchemaConvertorBackendService {
+    models = new Map();
+    convertResourceConfigurationToModel = vi.fn((resourceConfig, _options) => {
+        const modelName = resourceConfig.resourceIdentifier;
+        if (!this.models.has(modelName)) {
+            this.models.set(modelName, createMockModel(modelName));
+        }
+        return {
+            mainModel: this.models.get(modelName),
+            inheritanceSchemas: [],
+        };
+    });
+    getModel(name) {
+        return this.models.get(name);
+    }
+    reset() {
+        this.convertResourceConfigurationToModel.mockClear();
+        this.models.clear();
+        resetMockMongoTransactions();
+    }
+};
+MockZodToMongooseSchemaConvertorBackendService = __decorate([
+    injectable()
+], MockZodToMongooseSchemaConvertorBackendService);
+export { MockZodToMongooseSchemaConvertorBackendService };
+//# sourceMappingURL=mock-zod-mongoose-schema-convertor.service.js.map

package/dist/esm/databases/services/__tests__/mock-zod-mongoose-schema-convertor.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mock-zod-mongoose-schema-convertor.service.js","sourceRoot":"","sources":["../../../../../src/databases/services/__tests__/mock-zod-mongoose-schema-convertor.service.ts"],"names":[],"mappings":";;;;;;AAAA;;;;;;GAMG;AACH,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC,OAAO,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AAGhF,IAAM,8CAA8C,GAApD,MAAM,8CAA8C;IACjD,MAAM,GAAG,IAAI,GAAG,EAAsB,CAAC;IAE/C,mCAAmC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,cAAmB,EAAE,QAAc,EAAE,EAAE;QAClF,MAAM,SAAS,GAAG,cAAc,CAAC,kBAAkB,CAAC;QAEpD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;QACzD,CAAC;QAED,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAE;YACtC,kBAAkB,EAAE,EAAE;SACvB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,IAAY;QACnB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK;QACH,IAAI,CAAC,mCAAmC,CAAC,SAAS,EAAE,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACpB,0BAA0B,EAAE,CAAC;IAC/B,CAAC;CACF,CAAA;AAzBY,8CAA8C;IAD1D,UAAU,EAAE;GACA,8CAA8C,CAyB1D"}

package/dist/esm/databases/services/aggregation/aggregation-authorization.backend.service.d.ts

@@ -0,0 +1,74 @@
+/** ──────────────────────────────────────────────────────────────
+ * AggregationAuthorizationBackendService
+ *
+ * Handles authorization for aggregation queries:
+ *   1. LIST role check — user must have LIST permission on main resource
+ *   2. Scope filter injection — ORGANIZATIONS, USER_SELF, APPLICATION
+ *   3. Context filter resolution — parentResource, urlParam, currentUser, currentOrganization
+ *   4. Optional chart-level role narrowing
+ *
+ * Ref: Authorization model → L996-1024
+ * Ref: Scope-based injection → L1004-1007
+ * Ref: Context filter examples → L1053-1074
+ * Ref: Type coercion → L1074
+ * ────────────────────────────────────────────────────────────── */
+import type { LoggerService } from '../../../monitoring/logger/services/logger.service.js';
+import type { ErrorBuilderBackendService } from '../../../errors/services/error-builder.backend.service.js';
+import type { ResourcesRegistryBackendService } from '../../../resources/services/resources-registry.backend.service.js';
+import type { ExecutionContext } from '../../../runtime/models/execution-context.backend.schemas.js';
+import type { AggregationQuery } from '@wildo-ai/saas-models';
+import type { ResourceFilter } from '../../../databases/models/filter.backend.schemas.js';
+/** Input required by the authorization service */
+export interface AggregationAuthorizationInput {
+    query: AggregationQuery;
+    executionContext: ExecutionContext<any>;
+    /** Optional chart-level role restriction (narrows LIST roles) */
+    chartRoles?: string[];
+    /** URL param values (for context filter resolution) */
+    urlParams?: Record<string, string>;
+    /** Parent resource context (for context filter resolution) */
+    parentResource?: Record<string, unknown>;
+}
+/** Output from authorization — the augmented filter to merge into the aggregation */
+export interface AggregationAuthorizationResult {
+    /** Combined filter (static filters + scope filters + context filters) */
+    resolvedFilter: ResourceFilter;
+}
+export declare class AggregationAuthorizationBackendService {
+    private readonly logger;
+    private readonly errorBuilder;
+    private readonly resourceRegistry;
+    constructor(logger: LoggerService, errorBuilder: ErrorBuilderBackendService, resourceRegistry: ResourcesRegistryBackendService);
+    /**
+     * Authorize an aggregation query:
+     *   1. Check user has LIST role on mainResourceType
+     *   2. Inject scope filters based on ResourcePrimaryScope
+     *   3. Resolve context filters
+     *   4. Merge everything into a single filter object
+     */
+    authorize(input: AggregationAuthorizationInput): AggregationAuthorizationResult;
+    private checkListAccess;
+    private injectScopeFilters;
+    private resolveContextFilters;
+    private resolveContextFilterValue;
+    /**
+     * Coerce a resolved value (typically a string from URL params) to the
+     * target field's Zod type: string → as-is, date → Date, number → Number.
+     */
+    private coerceToFieldType;
+    private resolveMainSchema;
+    /**
+     * Extract the allowed role strings from the default LIST operation on a resource config.
+     *
+     * Resource configs expose `operations` as an array of
+     * `{ operationIdentifier: string; isDefault: boolean; roles?: (string|object)[] }`.
+     * We use `any` here because the resource-registry returns a dynamic config object
+     * whose internal shape depends on the app's resource definitions.  The function
+     * is defensive: it gracefully returns `undefined` if the structure doesn't match.
+     */
+    private getListOperationRoles;
+    private getResourceConfigurationOrThrow;
+    private extractUserRolesForScope;
+    private assertContextFilterDoesNotOverrideScopeLock;
+}
+//# sourceMappingURL=aggregation-authorization.backend.service.d.ts.map

package/dist/esm/databases/services/aggregation/aggregation-authorization.backend.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aggregation-authorization.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/databases/services/aggregation/aggregation-authorization.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;oEAaoE;AAKpE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AACnH,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAChI,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAU5G,OAAO,KAAK,EAAE,gBAAgB,EAAiB,MAAM,uBAAuB,CAAC;AAC7E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4DAA4D,CAAC;AAYjG,kDAAkD;AAClD,MAAM,WAAW,6BAA6B;IAC5C,KAAK,EAAE,gBAAgB,CAAC;IACxB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,iEAAiE;IACjE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,8DAA8D;IAC9D,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC1C;AAED,qFAAqF;AACrF,MAAM,WAAW,8BAA8B;IAC7C,yEAAyE;IACzE,cAAc,EAAE,cAAc,CAAC;CAChC;AAOD,qBACa,sCAAsC;IAEZ,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IACzB,OAAO,CAAC,QAAQ,CAAC,gBAAgB;gBAFjC,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EACpC,gBAAgB,EAAE,+BAA+B;IAGxH;;;;;;OAMG;IACH,SAAS,CAAC,KAAK,EAAE,6BAA6B,GAAG,8BAA8B;IAiC/E,OAAO,CAAC,eAAe;IAyDvB,OAAO,CAAC,kBAAkB;IAiE1B,OAAO,CAAC,qBAAqB;IAmE7B,OAAO,CAAC,yBAAyB;IA2BjC;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAuCzB,OAAO,CAAC,iBAAiB;IAWzB;;;;;;;;OAQG;IACH,OAAO,CAAC,qBAAqB;IAiB7B,OAAO,CAAC,+BAA+B;IAgBvC,OAAO,CAAC,wBAAwB;IA0ChC,OAAO,CAAC,2CAA2C;CA8CpD"}

package/dist/esm/databases/services/aggregation/aggregation-authorization.backend.service.js

@@ -0,0 +1,369 @@
+/** ──────────────────────────────────────────────────────────────
+ * AggregationAuthorizationBackendService
+ *
+ * Handles authorization for aggregation queries:
+ *   1. LIST role check — user must have LIST permission on main resource
+ *   2. Scope filter injection — ORGANIZATIONS, USER_SELF, APPLICATION
+ *   3. Context filter resolution — parentResource, urlParam, currentUser, currentOrganization
+ *   4. Optional chart-level role narrowing
+ *
+ * Ref: Authorization model → L996-1024
+ * Ref: Scope-based injection → L1004-1007
+ * Ref: Context filter examples → L1053-1074
+ * Ref: Type coercion → L1074
+ * ────────────────────────────────────────────────────────────── */
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { injectable, inject } from 'inversify';
+import { SAAS_SERVICE_TYPES } from '../../../inject/models/service-types.js';
+import { ErrorType, ErrorCustomMessageReference, CoreResourceOperation, ResourcePrimaryScope, ComparisonOperator, ContextFilterSource, } from '@wildo-ai/saas-models';
+import { getZodObjectShape, unwrapSchema, getZodType } from '@wildo-ai/zod-decorators';
+/** Map ComparisonOperator to MongoDB filter operators */
+const OPERATOR_TO_MONGO = {
+    [ComparisonOperator.EQ]: '$eq',
+    [ComparisonOperator.NE]: '$ne',
+    [ComparisonOperator.GT]: '$gt',
+    [ComparisonOperator.GTE]: '$gte',
+    [ComparisonOperator.LT]: '$lt',
+    [ComparisonOperator.LTE]: '$lte',
+};
+let AggregationAuthorizationBackendService = class AggregationAuthorizationBackendService {
+    logger;
+    errorBuilder;
+    resourceRegistry;
+    constructor(logger, errorBuilder, resourceRegistry) {
+        this.logger = logger;
+        this.errorBuilder = errorBuilder;
+        this.resourceRegistry = resourceRegistry;
+    }
+    /**
+     * Authorize an aggregation query:
+     *   1. Check user has LIST role on mainResourceType
+     *   2. Inject scope filters based on ResourcePrimaryScope
+     *   3. Resolve context filters
+     *   4. Merge everything into a single filter object
+     */
+    authorize(input) {
+        const { query, executionContext, chartRoles, urlParams, parentResource } = input;
+        const resourceConfig = this.getResourceConfigurationOrThrow(query.mainResourceType, executionContext);
+        // 1. Start with static filters from the query
+        const filter = { ...(query.filters || {}) };
+        // 2. Inject scope-based filters before the role check so missing/unknown scope
+        // fails with the real authorization reason instead of a generic role denial.
+        const scopeLocks = this.injectScopeFilters(resourceConfig.resourcePrimaryScope, query.mainResourceType, executionContext, filter);
+        // 3. LIST role check against the active application/org/user scope.
+        this.checkListAccess(query.mainResourceType, resourceConfig, executionContext, chartRoles);
+        // 4. Resolve context filters
+        if (query.contextFilters && query.contextFilters.length > 0) {
+            this.resolveContextFilters(query.contextFilters, query.mainResourceType, executionContext, urlParams || {}, parentResource || {}, filter, scopeLocks);
+        }
+        return { resolvedFilter: filter };
+    }
+    // ── LIST Role Check ────────────────────────────────────────
+    checkListAccess(resourceType, config, executionContext, chartRoles) {
+        // Find the LIST operation's roles
+        const listRoles = this.getListOperationRoles(config);
+        if (!listRoles) {
+            // No LIST operation configured → deny
+            this.logger.warn(`AggregationAuthorization: no LIST operation for '${resourceType}'`);
+            throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, executionContext, {
+                customMessageReference: ErrorCustomMessageReference.AUTHORIZATION,
+                context: { message: `Aggregation requires LIST access on '${resourceType}'.` },
+            });
+        }
+        // If chart restricts roles further, narrow the allowed set
+        const effectiveRoles = chartRoles
+            ? listRoles.filter(r => chartRoles.includes(r))
+            : listRoles;
+        if (effectiveRoles.length === 0) {
+            throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, executionContext, {
+                customMessageReference: ErrorCustomMessageReference.AUTHORIZATION,
+                context: { message: `Aggregation access denied — chart role restriction leaves no allowed roles.` },
+            });
+        }
+        // Check if user's roles include at least one of the effective roles
+        const resourceScope = config.resourcePrimaryScope;
+        const userRoles = this.extractUserRolesForScope(resourceScope, executionContext);
+        const hasAccess = userRoles.some(role => effectiveRoles.includes(role));
+        if (!hasAccess) {
+            this.logger.warn(`AggregationAuthorization: user lacks LIST access on '${resourceType}'. User roles: [${userRoles.join(', ')}], required: [${effectiveRoles.join(', ')}]`);
+            throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, executionContext, {
+                customMessageReference: ErrorCustomMessageReference.AUTHORIZATION,
+                context: { message: `Insufficient permissions to view chart data for '${resourceType}'.` },
+            });
+        }
+    }
+    // ── Scope Filter Injection ─────────────────────────────────
+    injectScopeFilters(scope, resourceType, executionContext, filter) {
+        switch (scope) {
+            case ResourcePrimaryScope.ORGANIZATIONS: {
+                const orgId = executionContext.organizationId;
+                if (!orgId) {
+                    throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, executionContext, {
+                        customMessageReference: ErrorCustomMessageReference.AUTHORIZATION,
+                        context: {
+                            message: `Organization-scoped aggregation on '${resourceType}' requires a resolved organizationId.`,
+                            resourceType,
+                        },
+                    });
+                }
+                // Always enforce scope — override any pre-existing value to prevent bypass
+                filter['organizationId'] = orgId;
+                return [{ field: 'organizationId', value: orgId }];
+            }
+            case ResourcePrimaryScope.USER_SELF: {
+                const userId = executionContext.userId;
+                if (!userId) {
+                    throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, executionContext, {
+                        customMessageReference: ErrorCustomMessageReference.AUTHORIZATION,
+                        context: {
+                            message: `User-scoped aggregation on '${resourceType}' requires a resolved userId.`,
+                            resourceType,
+                        },
+                    });
+                }
+                filter['userId'] = userId;
+                return [{ field: 'userId', value: userId }];
+            }
+            case ResourcePrimaryScope.APPLICATION:
+                // No scope filter needed — admin-level
+                return [];
+            default:
+                throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, executionContext, {
+                    customMessageReference: ErrorCustomMessageReference.AUTHORIZATION,
+                    context: {
+                        message: `Aggregation authorization encountered an unknown primary scope '${scope}' for '${resourceType}'.`,
+                        resourceType,
+                        scope,
+                    },
+                });
+        }
+    }
+    // ── Context Filter Resolution ──────────────────────────────
+    resolveContextFilters(contextFilters, resourceType, executionContext, urlParams, parentResource, filter, scopeLocks) {
+        const schema = this.resolveMainSchema(resourceType);
+        for (const cf of contextFilters) {
+            const resolvedValue = this.resolveContextFilterValue(cf, executionContext, urlParams, parentResource);
+            if (resolvedValue === undefined || resolvedValue === null) {
+                throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, executionContext, {
+                    customMessageReference: ErrorCustomMessageReference.AUTHORIZATION,
+                    context: {
+                        message: `Aggregation context filter for '${cf.field}' on '${resourceType}' requires a resolved value from source '${cf.source}'.`,
+                        resourceType,
+                        field: cf.field,
+                        source: cf.source,
+                        sourceField: cf.sourceField,
+                    },
+                });
+            }
+            // Coerce value to the target field's type
+            const coercedValue = schema
+                ? this.coerceToFieldType(resolvedValue, cf.field, schema)
+                : resolvedValue;
+            // Apply to filter with operator
+            const operator = cf.operator || ComparisonOperator.EQ;
+            this.assertContextFilterDoesNotOverrideScopeLock({
+                resourceType,
+                executionContext,
+                field: cf.field,
+                operator,
+                coercedValue,
+                filter,
+                scopeLocks,
+            });
+            if (operator === ComparisonOperator.EQ) {
+                // Simple equality — direct assignment
+                filter[cf.field] = coercedValue;
+            }
+            else {
+                // Operator-based — use MongoDB-style nested object
+                const mongoOp = OPERATOR_TO_MONGO[operator];
+                if (mongoOp) {
+                    const existing = filter[cf.field];
+                    if (existing && typeof existing === 'object' && !Array.isArray(existing)) {
+                        // Merge with existing operator filters on same field (e.g., gte + lte for date range)
+                        existing[mongoOp] = coercedValue;
+                    }
+                    else {
+                        filter[cf.field] = { [mongoOp]: coercedValue };
+                    }
+                }
+            }
+        }
+    }
+    resolveContextFilterValue(cf, executionContext, urlParams, parentResource) {
+        switch (cf.source) {
+            case ContextFilterSource.CURRENT_USER:
+                return cf.sourceField ? executionContext.initiatorIds?.[cf.sourceField] : executionContext.userId;
+            case ContextFilterSource.CURRENT_ORGANIZATION:
+                return executionContext.organizationId;
+            case ContextFilterSource.URL_PARAM:
+                return urlParams[cf.sourceField ?? cf.field];
+            case ContextFilterSource.PARENT_RESOURCE:
+                return parentResource[cf.sourceField ?? cf.field];
+            default:
+                this.logger.warn(`AggregationAuthorization: unknown context filter source '${cf.source}'`);
+                return undefined;
+        }
+    }
+    // ── Type coercion ──────────────────────────────────────────
+    /**
+     * Coerce a resolved value (typically a string from URL params) to the
+     * target field's Zod type: string → as-is, date → Date, number → Number.
+     */
+    coerceToFieldType(value, fieldName, schema) {
+        const shape = getZodObjectShape(schema);
+        if (!shape || Object.keys(shape).length === 0)
+            return value;
+        const fieldSchema = shape[fieldName];
+        if (!fieldSchema)
+            return value;
+        // Unwrap optional/nullable to find the core type
+        const coreType = unwrapSchema(fieldSchema);
+        const typeName = getZodType(coreType);
+        if (typeof value !== 'string')
+            return value;
+        switch (typeName) {
+            case 'date': {
+                const date = new Date(value);
+                if (isNaN(date.getTime())) {
+                    this.logger.warn(`AggregationAuthorization: invalid date value '${value}' for field '${fieldName}'`);
+                    return value; // Fall back to string — let MongoDB handle it
+                }
+                return date;
+            }
+            case 'number': {
+                const num = Number(value);
+                if (isNaN(num)) {
+                    this.logger.warn(`AggregationAuthorization: invalid number value '${value}' for field '${fieldName}'`);
+                    return value;
+                }
+                return num;
+            }
+            case 'boolean':
+                return value === 'true' || value === '1';
+            default:
+                return value;
+        }
+    }
+    // ── Schema Resolution ──────────────────────────────────────
+    resolveMainSchema(resourceType) {
+        try {
+            const config = this.resourceRegistry.getResourceConfiguration(resourceType);
+            return config.mainSchema;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    // ── Helpers ────────────────────────────────────────────────
+    /**
+     * Extract the allowed role strings from the default LIST operation on a resource config.
+     *
+     * Resource configs expose `operations` as an array of
+     * `{ operationIdentifier: string; isDefault: boolean; roles?: (string|object)[] }`.
+     * We use `any` here because the resource-registry returns a dynamic config object
+     * whose internal shape depends on the app's resource definitions.  The function
+     * is defensive: it gracefully returns `undefined` if the structure doesn't match.
+     */
+    getListOperationRoles(config) {
+        // operations is an array — use .find() to locate the LIST default operation
+        if (!config.operations || !Array.isArray(config.operations))
+            return undefined;
+        const listOp = config.operations.find((op) => op.operationIdentifier === CoreResourceOperation.LIST && op.isDefault);
+        if (!listOp)
+            return undefined;
+        // roles is directly on the operation object
+        if (listOp.roles && Array.isArray(listOp.roles)) {
+            return listOp.roles.map((r) => typeof r === 'string' ? r : String(r));
+        }
+        return undefined;
+    }
+    getResourceConfigurationOrThrow(resourceType, executionContext) {
+        try {
+            return this.resourceRegistry.getResourceConfiguration(resourceType);
+        }
+        catch {
+            this.logger.warn(`AggregationAuthorization: resource '${resourceType}' not found in registry`);
+            throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, executionContext, {
+                customMessageReference: ErrorCustomMessageReference.CONFIGURATION,
+                context: { message: `Resource '${resourceType}' not found.` },
+            });
+        }
+    }
+    extractUserRolesForScope(resourceScope, executionContext) {
+        const roleInfos = executionContext.initiatorRoles;
+        if (!roleInfos || !Array.isArray(roleInfos))
+            return [];
+        const activeOrganizationId = executionContext.organizationId;
+        const activeUserId = executionContext.userId;
+        const roles = [];
+        for (const ri of roleInfos) {
+            if (!ri.roles || !Array.isArray(ri.roles)) {
+                continue;
+            }
+            if (ri.relatedPrimaryScope === ResourcePrimaryScope.APPLICATION) {
+                roles.push(...ri.roles);
+                continue;
+            }
+            if (resourceScope === ResourcePrimaryScope.ORGANIZATIONS
+                && ri.relatedPrimaryScope === ResourcePrimaryScope.ORGANIZATIONS
+                && ri.relatedResourceId === activeOrganizationId) {
+                roles.push(...ri.roles);
+                continue;
+            }
+            if (resourceScope === ResourcePrimaryScope.USER_SELF
+                && ri.relatedPrimaryScope === ResourcePrimaryScope.USER_SELF
+                && ri.relatedResourceId === activeUserId) {
+                roles.push(...ri.roles);
+            }
+        }
+        return roles;
+    }
+    assertContextFilterDoesNotOverrideScopeLock(params) {
+        const scopeLock = params.scopeLocks.find((lock) => lock.field === params.field);
+        if (!scopeLock) {
+            return;
+        }
+        if (params.operator !== ComparisonOperator.EQ || params.coercedValue !== scopeLock.value) {
+            throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, params.executionContext, {
+                customMessageReference: ErrorCustomMessageReference.AUTHORIZATION,
+                context: {
+                    message: `Aggregation context filter on "${params.field}" for "${params.resourceType}" conflicts with the enforced ${params.field} scope.`,
+                    resourceType: params.resourceType,
+                    field: params.field,
+                },
+            });
+        }
+        const existingValue = params.filter[params.field];
+        if (existingValue !== scopeLock.value) {
+            throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, params.executionContext, {
+                customMessageReference: ErrorCustomMessageReference.AUTHORIZATION,
+                context: {
+                    message: `Aggregation context filter on "${params.field}" for "${params.resourceType}" would override the enforced ${params.field} scope.`,
+                    resourceType: params.resourceType,
+                    field: params.field,
+                },
+            });
+        }
+    }
+};
+AggregationAuthorizationBackendService = __decorate([
+    injectable(),
+    __param(0, inject(SAAS_SERVICE_TYPES.Logger)),
+    __param(1, inject(SAAS_SERVICE_TYPES.ErrorBuilderService)),
+    __param(2, inject(SAAS_SERVICE_TYPES.ResourceRegistryService)),
+    __metadata("design:paramtypes", [Function, Function, Function])
+], AggregationAuthorizationBackendService);
+export { AggregationAuthorizationBackendService };
+//# sourceMappingURL=aggregation-authorization.backend.service.js.map

package/dist/esm/databases/services/aggregation/aggregation-authorization.backend.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aggregation-authorization.backend.service.js","sourceRoot":"","sources":["../../../../../src/databases/services/aggregation/aggregation-authorization.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;oEAaoE;;;;;;;;;;;;;AAEpE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAKpF,OAAO,EACL,SAAS,EACT,2BAA2B,EAC3B,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAIvF,yDAAyD;AACzD,MAAM,iBAAiB,GAA2B;IAChD,CAAC,kBAAkB,CAAC,EAAE,CAAC,EAAE,KAAK;IAC9B,CAAC,kBAAkB,CAAC,EAAE,CAAC,EAAE,KAAK;IAC9B,CAAC,kBAAkB,CAAC,EAAE,CAAC,EAAE,KAAK;IAC9B,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,MAAM;IAChC,CAAC,kBAAkB,CAAC,EAAE,CAAC,EAAE,KAAK;IAC9B,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,MAAM;CACjC,CAAC;AA0BK,IAAM,sCAAsC,GAA5C,MAAM,sCAAsC;IAEK;IACa;IACI;IAHvE,YACsD,MAAqB,EACR,YAAwC,EACpC,gBAAiD;QAFlE,WAAM,GAAN,MAAM,CAAe;QACR,iBAAY,GAAZ,YAAY,CAA4B;QACpC,qBAAgB,GAAhB,gBAAgB,CAAiC;IACrH,CAAC;IAEJ;;;;;;OAMG;IACH,SAAS,CAAC,KAAoC;QAC5C,MAAM,EAAE,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,KAAK,CAAC;QAEjF,MAAM,cAAc,GAAG,IAAI,CAAC,+BAA+B,CAAC,KAAK,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;QAEtG,8CAA8C;QAC9C,MAAM,MAAM,GAA4B,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QAErE,+EAA+E;QAC/E,6EAA6E;QAC7E,MAAM,UAAU,GAAG,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAAC,oBAA4C,EAAE,KAAK,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;QAE1J,oEAAoE;QACpE,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,gBAAgB,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAC;QAE3F,6BAA6B;QAC7B,IAAI,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5D,IAAI,CAAC,qBAAqB,CACxB,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,gBAAgB,EACtB,gBAAgB,EAChB,SAAS,IAAI,EAAE,EACf,cAAc,IAAI,EAAE,EACpB,MAAM,EACN,UAAU,CACX,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,cAAc,EAAE,MAAwB,EAAE,CAAC;IACtD,CAAC;IAED,8DAA8D;IAEtD,eAAe,CACrB,YAAoB,EACpB,MAAW,EACX,gBAAuC,EACvC,UAAqB;QAErB,kCAAkC;QAClC,MAAM,SAAS,GAAG,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;QACrD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,sCAAsC;YACtC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oDAAoD,YAAY,GAAG,CAAC,CAAC;YACtF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE,EAAE,OAAO,EAAE,wCAAwC,YAAY,IAAI,EAAE;aAC/E,CACF,CAAC;QACJ,CAAC;QAED,2DAA2D;QAC3D,MAAM,cAAc,GAAG,UAAU;YAC/B,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC/C,CAAC,CAAC,SAAS,CAAC;QAEd,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE,EAAE,OAAO,EAAE,6EAA6E,EAAE;aACpG,CACF,CAAC;QACJ,CAAC;QAED,oEAAoE;QACpE,MAAM,aAAa,GAAG,MAAM,CAAC,oBAA4C,CAAC;QAC1E,MAAM,SAAS,GAAG,IAAI,CAAC,wBAAwB,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;QACjF,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAExE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wDAAwD,YAAY,mBAAmB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC3K,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE,EAAE,OAAO,EAAE,oDAAoD,YAAY,IAAI,EAAE;aAC3F,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,8DAA8D;IAEtD,kBAAkB,CACxB,KAA2B,EAC3B,YAAoB,EACpB,gBAAuC,EACvC,MAA+B;QAE/B,QAAQ,KAAK,EAAE,CAAC;YACd,KAAK,oBAAoB,CAAC,aAAa,CAAC,CAAC,CAAC;gBACxC,MAAM,KAAK,GAAG,gBAAgB,CAAC,cAAc,CAAC;gBAC9C,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;wBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;wBACjE,OAAO,EAAE;4BACP,OAAO,EAAE,uCAAuC,YAAY,uCAAuC;4BACnG,YAAY;yBACb;qBACF,CACF,CAAC;gBACJ,CAAC;gBACD,2EAA2E;gBAC3E,MAAM,CAAC,gBAAgB,CAAC,GAAG,KAAK,CAAC;gBACjC,OAAO,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YACrD,CAAC;YACD,KAAK,oBAAoB,CAAC,SAAS,CAAC,CAAC,CAAC;gBACpC,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC;gBACvC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;wBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;wBACjE,OAAO,EAAE;4BACP,OAAO,EAAE,+BAA+B,YAAY,+BAA+B;4BACnF,YAAY;yBACb;qBACF,CACF,CAAC;gBACJ,CAAC;gBACD,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC;gBAC1B,OAAO,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAC9C,CAAC;YACD,KAAK,oBAAoB,CAAC,WAAW;gBACnC,uCAAuC;gBACvC,OAAO,EAAE,CAAC;YACZ;gBACE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;oBACjE,OAAO,EAAE;wBACP,OAAO,EAAE,mEAAmE,KAAK,UAAU,YAAY,IAAI;wBAC3G,YAAY;wBACZ,KAAK;qBACN;iBACF,CACF,CAAC;QACN,CAAC;IACH,CAAC;IAED,8DAA8D;IAEtD,qBAAqB,CAC3B,cAA+B,EAC/B,YAAoB,EACpB,gBAAuC,EACvC,SAAiC,EACjC,cAAuC,EACvC,MAA+B,EAC/B,UAAiC;QAEjC,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;QAEpD,KAAK,MAAM,EAAE,IAAI,cAAc,EAAE,CAAC;YAChC,MAAM,aAAa,GAAG,IAAI,CAAC,yBAAyB,CAAC,EAAE,EAAE,gBAAgB,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;YACtG,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;gBAC1D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,gBAAgB,EAChB;oBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;oBACjE,OAAO,EAAE;wBACP,OAAO,EAAE,mCAAmC,EAAE,CAAC,KAAK,SAAS,YAAY,4CAA4C,EAAE,CAAC,MAAM,IAAI;wBAClI,YAAY;wBACZ,KAAK,EAAE,EAAE,CAAC,KAAK;wBACf,MAAM,EAAE,EAAE,CAAC,MAAM;wBACjB,WAAW,EAAE,EAAE,CAAC,WAAW;qBAC5B;iBACF,CACF,CAAC;YACJ,CAAC;YAED,0CAA0C;YAC1C,MAAM,YAAY,GAAG,MAAM;gBACzB,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,aAAa,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;gBACzD,CAAC,CAAC,aAAa,CAAC;YAElB,gCAAgC;YAChC,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,IAAI,kBAAkB,CAAC,EAAE,CAAC;YAEtD,IAAI,CAAC,2CAA2C,CAAC;gBAC/C,YAAY;gBACZ,gBAAgB;gBAChB,KAAK,EAAE,EAAE,CAAC,KAAK;gBACf,QAAQ;gBACR,YAAY;gBACZ,MAAM;gBACN,UAAU;aACX,CAAC,CAAC;YAEH,IAAI,QAAQ,KAAK,kBAAkB,CAAC,EAAE,EAAE,CAAC;gBACvC,sCAAsC;gBACtC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,YAAY,CAAC;YAClC,CAAC;iBAAM,CAAC;gBACN,mDAAmD;gBACnD,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;gBAC5C,IAAI,OAAO,EAAE,CAAC;oBACZ,MAAM,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;oBAClC,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;wBACzE,sFAAsF;wBACrF,QAAoC,CAAC,OAAO,CAAC,GAAG,YAAY,CAAC;oBAChE,CAAC;yBAAM,CAAC;wBACN,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC;oBACjD,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAEO,yBAAyB,CAC/B,EAAiB,EACjB,gBAAuC,EACvC,SAAiC,EACjC,cAAuC;QAEvC,QAAQ,EAAE,CAAC,MAAM,EAAE,CAAC;YAClB,KAAK,mBAAmB,CAAC,YAAY;gBACnC,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC,CAAE,gBAAgB,CAAC,YAAoB,EAAE,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC;YAE7G,KAAK,mBAAmB,CAAC,oBAAoB;gBAC3C,OAAO,gBAAgB,CAAC,cAAc,CAAC;YAEzC,KAAK,mBAAmB,CAAC,SAAS;gBAChC,OAAO,SAAS,CAAC,EAAE,CAAC,WAAW,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC;YAE/C,KAAK,mBAAmB,CAAC,eAAe;gBACtC,OAAO,cAAc,CAAC,EAAE,CAAC,WAAW,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC;YAEpD;gBACE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4DAA4D,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;gBAC3F,OAAO,SAAS,CAAC;QACrB,CAAC;IACH,CAAC;IAED,8DAA8D;IAE9D;;;OAGG;IACK,iBAAiB,CAAC,KAAc,EAAE,SAAiB,EAAE,MAAoB;QAC/E,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAE5D,MAAM,WAAW,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;QACrC,IAAI,CAAC,WAAW;YAAE,OAAO,KAAK,CAAC;QAE/B,iDAAiD;QACjD,MAAM,QAAQ,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAEtC,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAE5C,QAAQ,QAAQ,EAAE,CAAC;YACjB,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC7B,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;oBAC1B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iDAAiD,KAAK,gBAAgB,SAAS,GAAG,CAAC,CAAC;oBACrG,OAAO,KAAK,CAAC,CAAC,8CAA8C;gBAC9D,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC1B,IAAI,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;oBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mDAAmD,KAAK,gBAAgB,SAAS,GAAG,CAAC,CAAC;oBACvG,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,OAAO,GAAG,CAAC;YACb,CAAC;YACD,KAAK,SAAS;gBACZ,OAAO,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,GAAG,CAAC;YAC3C;gBACE,OAAO,KAAK,CAAC;QACjB,CAAC;IACH,CAAC;IAED,8DAA8D;IAEtD,iBAAiB,CAAC,YAAoB;QAC5C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;YAC5E,OAAO,MAAM,CAAC,UAA0B,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,8DAA8D;IAE9D;;;;;;;;OAQG;IACK,qBAAqB,CAAC,MAAW;QACvC,4EAA4E;QAC5E,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;YAAE,OAAO,SAAS,CAAC;QAE9E,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CACnC,CAAC,EAAO,EAAE,EAAE,CAAC,EAAE,CAAC,mBAAmB,KAAK,qBAAqB,CAAC,IAAI,IAAI,EAAE,CAAC,SAAS,CACnF,CAAC;QACF,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAE9B,4CAA4C;QAC5C,IAAI,MAAM,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAChD,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7E,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,+BAA+B,CAAC,YAAoB,EAAE,gBAAuC;QACnG,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;QACtE,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uCAAuC,YAAY,yBAAyB,CAAC,CAAC;YAC/F,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,SAAS,EACnB,gBAAgB,EAChB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE,EAAE,OAAO,EAAE,aAAa,YAAY,cAAc,EAAE;aAC9D,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,wBAAwB,CAC9B,aAAmC,EACnC,gBAAuC;QAEvC,MAAM,SAAS,GAAG,gBAAgB,CAAC,cAAc,CAAC;QAClD,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;YAAE,OAAO,EAAE,CAAC;QAEvD,MAAM,oBAAoB,GAAG,gBAAgB,CAAC,cAAc,CAAC;QAC7D,MAAM,YAAY,GAAG,gBAAgB,CAAC,MAAM,CAAC;QAC7C,MAAM,KAAK,GAAa,EAAE,CAAC;QAE3B,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAC,EAAE,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1C,SAAS;YACX,CAAC;YAED,IAAI,EAAE,CAAC,mBAAmB,KAAK,oBAAoB,CAAC,WAAW,EAAE,CAAC;gBAChE,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;gBACxB,SAAS;YACX,CAAC;YAED,IACE,aAAa,KAAK,oBAAoB,CAAC,aAAa;mBACjD,EAAE,CAAC,mBAAmB,KAAK,oBAAoB,CAAC,aAAa;mBAC7D,EAAE,CAAC,iBAAiB,KAAK,oBAAoB,EAChD,CAAC;gBACD,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;gBACxB,SAAS;YACX,CAAC;YAED,IACE,aAAa,KAAK,oBAAoB,CAAC,SAAS;mBAC7C,EAAE,CAAC,mBAAmB,KAAK,oBAAoB,CAAC,SAAS;mBACzD,EAAE,CAAC,iBAAiB,KAAK,YAAY,EACxC,CAAC;gBACD,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,2CAA2C,CAAC,MAQnD;QACC,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC;QAChF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO;QACT,CAAC;QAED,IAAI,MAAM,CAAC,QAAQ,KAAK,kBAAkB,CAAC,EAAE,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,KAAK,EAAE,CAAC;YACzF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,MAAM,CAAC,gBAAgB,EACvB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EAAE,kCAAkC,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,YAAY,iCAAiC,MAAM,CAAC,KAAK,SAAS;oBAC1I,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,KAAK,EAAE,MAAM,CAAC,KAAK;iBACpB;aACF,CACF,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,aAAa,KAAK,SAAS,CAAC,KAAK,EAAE,CAAC;YACtC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,aAAa,EACvB,MAAM,CAAC,gBAAgB,EACvB;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EAAE,kCAAkC,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,YAAY,iCAAiC,MAAM,CAAC,KAAK,SAAS;oBAC1I,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,KAAK,EAAE,MAAM,CAAC,KAAK;iBACpB;aACF,CACF,CAAC;QACJ,CAAC;IACH,CAAC;CAEF,CAAA;AA/bY,sCAAsC;IADlD,UAAU,EAAE;IAGR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAA;;GAJ1C,sCAAsC,CA+blD"}