captify 0.1.18 → 0.1.19

package/dist/permissions/services/casbin-dynamodb.adapter.js

@@ -0,0 +1,145 @@
+/**
+ * Custom Casbin DynamoDB Adapter
+ * Implements Casbin's Adapter interface for storing policies in DynamoDB
+ */
+import { policyKeys } from "../../db/schemas/policies.schema";
+import { roleAssignmentKeys } from "../../db/schemas/role-assignments.schema";
+import { DynamoDbInstances } from "../../shared/services/dynamodb";
+import { TABLES } from "../../shared/shared.constants";
+/**
+ * DynamoDB adapter for Casbin policy storage
+ * Loads policies (p) and role assignments (g) from DynamoDB tables
+ */
+export class CasbinDynamoDbAdapter {
+    constructor(options) {
+        var _a, _b;
+        this.tenantId = options.tenantId;
+        this.userCredentials = options.userCredentials;
+        this.db =
+            (_a = options.dynamoDbService) !== null && _a !== void 0 ? _a : DynamoDbInstances.getInstance(TABLES.policies);
+        this.assignmentsDb =
+            (_b = options.assignmentsDbService) !== null && _b !== void 0 ? _b : DynamoDbInstances.getInstance(TABLES.roleAssignments);
+    }
+    /**
+     * Load all enabled policies and role assignments from DynamoDB into the Casbin model
+     */
+    async loadPolicy(model) {
+        // Load p (permission) policies
+        await this.loadPermissionPolicies(model);
+        // Load g (grouping) policies from role assignments
+        await this.loadRoleAssignments(model);
+    }
+    /**
+     * Load permission policies (p rules) from the policies table
+     */
+    async loadPermissionPolicies(model) {
+        const pk = policyKeys.pk(this.tenantId);
+        const result = await this.db.queryItems({
+            KeyConditionExpression: "PK = :pk",
+            FilterExpression: "#status = :enabled",
+            ExpressionAttributeNames: {
+                "#status": "status",
+            },
+            ExpressionAttributeValues: {
+                ":pk": pk,
+                ":enabled": "enabled",
+            },
+        }, { userCredentials: this.userCredentials });
+        const items = (result.Items || []);
+        for (const item of items) {
+            const ptype = item.ptype;
+            // v3 is now an array of actions - create one Casbin rule per action
+            const actions = Array.isArray(item.v3) ? item.v3 : [item.v3];
+            for (const action of actions) {
+                const rule = [];
+                // Build rule array: subject, domain, resource, action, effect
+                if (item.v0)
+                    rule.push(item.v0);
+                if (item.v1)
+                    rule.push(item.v1);
+                if (item.v2)
+                    rule.push(item.v2);
+                if (action)
+                    rule.push(action);
+                if (item.v4)
+                    rule.push(item.v4);
+                this.loadPolicyLine(ptype, rule, model);
+            }
+        }
+    }
+    /**
+     * Load role assignments as g (grouping) policies
+     * Maps Cognito groups to roles: g, groupName, roleName, domain
+     */
+    async loadRoleAssignments(model) {
+        const pk = roleAssignmentKeys.pk(this.tenantId);
+        const result = await this.assignmentsDb.queryItems({
+            KeyConditionExpression: "PK = :pk",
+            ExpressionAttributeValues: {
+                ":pk": pk,
+            },
+        }, { userCredentials: this.userCredentials });
+        const items = (result.Items || []);
+        for (const item of items) {
+            // Create g rule: groupName, roleName, domain
+            // This maps a Cognito group to a role within a domain
+            const domain = `${this.tenantId}:${item.domain}`;
+            const rule = [item.groupName, item.roleName, domain];
+            this.loadPolicyLine("g", rule, model);
+        }
+    }
+    /**
+     * Load a single policy line into the model
+     */
+    loadPolicyLine(ptype, rule, model) {
+        const sec = ptype.charAt(0);
+        const ast = model.model.get(sec);
+        if (!ast)
+            return;
+        const policy = ast.get(ptype);
+        if (!policy)
+            return;
+        policy.policy.push(rule);
+    }
+    /**
+     * Save all policies from the Casbin model to DynamoDB
+     * Note: This is typically not called directly - use addPolicy/removePolicy for incremental updates
+     */
+    async savePolicy(_model) {
+        // For our use case, we manage policies through the PolicyService
+        // which handles DynamoDB operations directly
+        // This method is here for Casbin interface compliance
+        return true;
+    }
+    /**
+     * Add a policy rule to DynamoDB
+     * Note: This is called by Casbin but we manage policies through PolicyService
+     */
+    async addPolicy(_sec, _ptype, _rule) {
+        // Policies are added through PolicyService which handles full metadata
+        // This is a no-op as Casbin calls this during enforcement but we don't
+        // want to duplicate the policy creation logic
+    }
+    /**
+     * Remove a policy rule from DynamoDB
+     * Note: This is called by Casbin but we manage policies through PolicyService
+     */
+    async removePolicy(_sec, _ptype, _rule) {
+        // Policies are removed through PolicyService
+        // This is a no-op for the same reason as addPolicy
+    }
+    /**
+     * Remove policies matching a filter
+     */
+    async removeFilteredPolicy(_sec, _ptype, _fieldIndex, ..._fieldValues) {
+        // Policies are removed through PolicyService
+        // This is a no-op for the same reason as addPolicy
+    }
+}
+/**
+ * Create a new Casbin DynamoDB adapter for a tenant
+ */
+export function createCasbinAdapter(tenantId) {
+    return new CasbinDynamoDbAdapter({ tenantId });
+}
+//# sourceMappingURL=casbin-dynamodb.adapter.js.map

package/dist/permissions/services/casbin-dynamodb.adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"casbin-dynamodb.adapter.js","sourceRoot":"","sources":["../../../lib/permissions/services/casbin-dynamodb.adapter.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAE9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAG9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAGvD;;;GAGG;AACH,MAAM,OAAO,qBAAqB;IAMhC,YAAY,OAAqC;;QAC/C,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;QAC/C,IAAI,CAAC,EAAE;YACL,MAAA,OAAO,CAAC,eAAe,mCACvB,iBAAiB,CAAC,WAAW,CAAsB,MAAM,CAAC,QAAQ,CAAC,CAAC;QACtE,IAAI,CAAC,aAAa;YAChB,MAAA,OAAO,CAAC,oBAAoB,mCAC5B,iBAAiB,CAAC,WAAW,CAA6B,MAAM,CAAC,eAAe,CAAC,CAAC;IACtF,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CAAC,KAAY;QAC3B,+BAA+B;QAC/B,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;QAEzC,mDAAmD;QACnD,MAAM,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,sBAAsB,CAAC,KAAY;QAC/C,MAAM,EAAE,GAAG,UAAU,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAExC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,UAAU,CACrC;YACE,sBAAsB,EAAE,UAAU;YAClC,gBAAgB,EAAE,oBAAoB;YACtC,wBAAwB,EAAE;gBACxB,SAAS,EAAE,QAAQ;aACpB;YACD,yBAAyB,EAAE;gBACzB,KAAK,EAAE,EAAE;gBACT,UAAU,EAAE,SAAS;aACtB;SACF,EACD,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,CAC1C,CAAC;QAEF,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAwC,CAAC;QAE1E,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;YAEzB,oEAAoE;YACpE,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAE7D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,IAAI,GAAa,EAAE,CAAC;gBAE1B,8DAA8D;gBAC9D,IAAI,IAAI,CAAC,EAAE;oBAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAChC,IAAI,IAAI,CAAC,EAAE;oBAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAChC,IAAI,IAAI,CAAC,EAAE;oBAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAChC,IAAI,MAAM;oBAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC9B,IAAI,IAAI,CAAC,EAAE;oBAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAEhC,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,mBAAmB,CAAC,KAAY;QAC5C,MAAM,EAAE,GAAG,kBAAkB,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEhD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAChD;YACE,sBAAsB,EAAE,UAAU;YAClC,yBAAyB,EAAE;gBACzB,KAAK,EAAE,EAAE;aACV;SACF,EACD,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,CAC1C,CAAC;QAEF,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAA+C,CAAC;QAEjF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,6CAA6C;YAC7C,sDAAsD;YACtD,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACjD,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAErD,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAED;;OAEG;IACK,cAAc,CAAC,KAAa,EAAE,IAAc,EAAE,KAAY;QAChE,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEjC,IAAI,CAAC,GAAG;YAAE,OAAO;QAEjB,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,CAAC,MAAM;YAAE,OAAO;QAEpB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,MAAa;QAC5B,iEAAiE;QACjE,6CAA6C;QAC7C,sDAAsD;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,MAAc,EAAE,KAAe;QAC3D,uEAAuE;QACvE,uEAAuE;QACvE,8CAA8C;IAChD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,CAAC,IAAY,EAAE,MAAc,EAAE,KAAe;QAC9D,6CAA6C;QAC7C,mDAAmD;IACrD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,oBAAoB,CACxB,IAAY,EACZ,MAAc,EACd,WAAmB,EACnB,GAAG,YAAsB;QAEzB,6CAA6C;QAC7C,mDAAmD;IACrD,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IAClD,OAAO,IAAI,qBAAqB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;AACjD,CAAC"}

package/dist/permissions/services/index.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Permissions Services
+ * Barrel export for all permission-related services
+ */
+export { CasbinDynamoDbAdapter, createCasbinAdapter } from "./casbin-dynamodb.adapter";
+export { PermissionsService, getPermissionsService } from "./permissions.service";
+export type { PermissionsServiceDeps } from "./permissions.service";
+export { PolicyService, getPolicyService } from "./policy.service";
+export type { PolicyServiceDeps } from "./policy.service";
+export { RoleAssignmentService, getRoleAssignmentService } from "./role-assignment.service";
+export type { RoleAssignmentServiceDeps } from "./role-assignment.service";
+//# sourceMappingURL=index.d.ts.map

package/dist/permissions/services/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../lib/permissions/services/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAGvF,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAClF,YAAY,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAGpE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACnE,YAAY,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAG1D,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAC5F,YAAY,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC"}

package/dist/permissions/services/index.js

@@ -0,0 +1,13 @@
+/**
+ * Permissions Services
+ * Barrel export for all permission-related services
+ */
+// Casbin adapter for DynamoDB
+export { CasbinDynamoDbAdapter, createCasbinAdapter } from "./casbin-dynamodb.adapter";
+// Core permissions enforcement service
+export { PermissionsService, getPermissionsService } from "./permissions.service";
+// Policy CRUD service
+export { PolicyService, getPolicyService } from "./policy.service";
+// Role assignment service
+export { RoleAssignmentService, getRoleAssignmentService } from "./role-assignment.service";
+//# sourceMappingURL=index.js.map

package/dist/permissions/services/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../lib/permissions/services/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,8BAA8B;AAC9B,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAEvF,uCAAuC;AACvC,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAGlF,sBAAsB;AACtB,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAGnE,0BAA0B;AAC1B,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC"}

package/dist/permissions/services/permissions.service.d.ts

@@ -0,0 +1,93 @@
+/**
+ * Permissions Service
+ * Core service for permission enforcement using Casbin
+ */
+import type { EnforceParams } from "../permissions.interfaces";
+import { BaseAwsService } from "../../shared/services/base-aws-service";
+import type { Logger } from "../../shared/services/logger";
+import type { UserAwsCredentials } from "../../shared/services";
+import { Enforcer } from "casbin";
+export interface PermissionsServiceDeps {
+    logger?: Logger;
+}
+/**
+ * Service for permission enforcement using Casbin.
+ * Provides methods to check if a subject has permission to perform
+ * an action on a resource within a domain.
+ *
+ * Uses RBAC with domains model supporting:
+ * - Role-based access control (RBAC)
+ * - Domain/tenant isolation
+ * - Deny-override effect (deny takes precedence)
+ */
+export declare class PermissionsService extends BaseAwsService {
+    constructor(deps?: PermissionsServiceDeps);
+    /**
+     * Check if a subject has permission to perform an action on a resource
+     *
+     * Permission check order:
+     * 1. Direct user-specific policies (subject = userId)
+     * 2. Group-based policies via role assignments (subject's Cognito groups)
+     * 3. Base authenticated role (applies to all logged-in users)
+     *
+     * @param params Enforcement parameters
+     * @returns true if the action is allowed, false otherwise
+     *
+     * @example
+     * ```typescript
+     * const allowed = await permissionsService.enforce({
+     *   subject: 'user-123',
+     *   tenantId: 'tenant-abc',
+     *   resource: 'agents',
+     *   action: 'read',
+     *   groups: ['UserAdmins', 'Developers'],
+     * });
+     * ```
+     */
+    enforce(params: EnforceParams): Promise<boolean>;
+    /**
+     * Check if there are any explicit deny policies for the user or their groups
+     */
+    private hasExplicitDeny;
+    /**
+     * Check multiple permissions at once
+     *
+     * @param params Array of enforcement parameters
+     * @returns Array of boolean results in the same order
+     */
+    enforceMany(params: EnforceParams[]): Promise<boolean[]>;
+    /**
+     * Get the Casbin enforcer for a tenant, creating or refreshing as needed
+     */
+    getEnforcer(tenantId: string, userCredentials?: UserAwsCredentials): Promise<Enforcer>;
+    /**
+     * Force reload of the enforcer for a tenant
+     * Call this after policy changes to ensure they take effect immediately
+     */
+    reloadEnforcer(tenantId: string, userCredentials?: UserAwsCredentials): Promise<void>;
+    /**
+     * Clear all cached enforcers
+     */
+    clearCache(): void;
+    /**
+     * Create a new Casbin enforcer for a tenant
+     */
+    private createEnforcer;
+    /**
+     * Get all roles for a user in a domain
+     */
+    getRolesForUser(userId: string, tenantId: string, logicalDomain?: string, userCredentials?: UserAwsCredentials): Promise<string[]>;
+    /**
+     * Get all users that have a role in a domain
+     */
+    getUsersForRole(role: string, tenantId: string, logicalDomain?: string, userCredentials?: UserAwsCredentials): Promise<string[]>;
+    /**
+     * Check if a user has a role in a domain
+     */
+    hasRoleForUser(userId: string, role: string, tenantId: string, logicalDomain?: string, userCredentials?: UserAwsCredentials): Promise<boolean>;
+}
+/**
+ * Get the singleton PermissionsService instance
+ */
+export declare function getPermissionsService(): PermissionsService;
+//# sourceMappingURL=permissions.service.d.ts.map

package/dist/permissions/services/permissions.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.service.d.ts","sourceRoot":"","sources":["../../../lib/permissions/services/permissions.service.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0CAA0C,CAAC;AAE9E,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AACxE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,8BAA8B,CAAC;AAC3D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAmC,MAAM,QAAQ,CAAC;AAMnE,MAAM,WAAW,sBAAsB;IACrC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAaD;;;;;;;;;GASG;AACH,qBAAa,kBAAmB,SAAQ,cAAc;gBACxC,IAAI,GAAE,sBAA2B;IAI7C;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,OAAO,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC;IAiEtD;;OAEG;YACW,eAAe;IAgE7B;;;;;OAKG;IACG,WAAW,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAI9D;;OAEG;IACG,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,QAAQ,CAAC;IAkB5F;;;OAGG;IACG,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAK3F;;OAEG;IACH,UAAU,IAAI,IAAI;IAIlB;;OAEG;YACW,cAAc;IAgB5B;;OAEG;IACG,eAAe,CACnB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,aAAa,SAAY,EACzB,eAAe,CAAC,EAAE,kBAAkB,GACnC,OAAO,CAAC,MAAM,EAAE,CAAC;IAMpB;;OAEG;IACG,eAAe,CACnB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,aAAa,SAAY,EACzB,eAAe,CAAC,EAAE,kBAAkB,GACnC,OAAO,CAAC,MAAM,EAAE,CAAC;IAMpB;;OAEG;IACG,cAAc,CAClB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,aAAa,SAAY,EACzB,eAAe,CAAC,EAAE,kBAAkB,GACnC,OAAO,CAAC,OAAO,CAAC;CAKpB;AAQD;;GAEG;AACH,wBAAgB,qBAAqB,IAAI,kBAAkB,CAK1D"}

package/dist/permissions/services/permissions.service.js

@@ -0,0 +1,232 @@
+/**
+ * Permissions Service
+ * Core service for permission enforcement using Casbin
+ */
+import { BASE_AUTHENTICATED_ROLE, CASBIN_MODEL, PERMISSIONS_LIMITS, } from "../permissions.constants";
+import { CasbinDynamoDbAdapter } from "./casbin-dynamodb.adapter";
+import { BaseAwsService } from "../../shared/services/base-aws-service";
+import { newEnforcer, newModelFromString } from "casbin";
+// ============================================================================
+// Enforcer Cache
+// ============================================================================
+// Cache enforcers per tenant for performance
+const enforcerCache = new Map();
+// ============================================================================
+// Service
+// ============================================================================
+/**
+ * Service for permission enforcement using Casbin.
+ * Provides methods to check if a subject has permission to perform
+ * an action on a resource within a domain.
+ *
+ * Uses RBAC with domains model supporting:
+ * - Role-based access control (RBAC)
+ * - Domain/tenant isolation
+ * - Deny-override effect (deny takes precedence)
+ */
+export class PermissionsService extends BaseAwsService {
+    constructor(deps = {}) {
+        super({ logger: deps.logger });
+    }
+    /**
+     * Check if a subject has permission to perform an action on a resource
+     *
+     * Permission check order:
+     * 1. Direct user-specific policies (subject = userId)
+     * 2. Group-based policies via role assignments (subject's Cognito groups)
+     * 3. Base authenticated role (applies to all logged-in users)
+     *
+     * @param params Enforcement parameters
+     * @returns true if the action is allowed, false otherwise
+     *
+     * @example
+     * ```typescript
+     * const allowed = await permissionsService.enforce({
+     *   subject: 'user-123',
+     *   tenantId: 'tenant-abc',
+     *   resource: 'agents',
+     *   action: 'read',
+     *   groups: ['UserAdmins', 'Developers'],
+     * });
+     * ```
+     */
+    async enforce(params) {
+        var _a;
+        const { subject, tenantId, resource, action, logicalDomain = "default", groups = [], userCredentials, } = params;
+        const domain = `${tenantId}:${logicalDomain}`;
+        try {
+            const enforcer = await this.getEnforcer(tenantId, userCredentials);
+            // First, check for any DENY policies that apply to this user
+            // Deny policies take precedence over all allow policies (deny-override)
+            const hasDeny = await this.hasExplicitDeny(enforcer, subject, groups, domain, resource, action);
+            if (hasDeny) {
+                return false;
+            }
+            // 1. Check direct subject permission (for user-specific policies)
+            const directResult = await enforcer.enforce(subject, domain, resource, action);
+            if (directResult) {
+                return true;
+            }
+            // 2. Check each group the user belongs to
+            // Role assignments map groups to roles: g, groupName, roleName, domain
+            // The enforcer's g() function resolves groupName -> roleName
+            for (const group of groups) {
+                const groupResult = await enforcer.enforce(group, domain, resource, action);
+                if (groupResult) {
+                    return true;
+                }
+            }
+            // 3. Check base authenticated role (applies to all logged-in users)
+            // This provides default permissions without requiring group assignment
+            const authenticatedResult = await enforcer.enforce(BASE_AUTHENTICATED_ROLE, domain, resource, action);
+            if (authenticatedResult) {
+                return true;
+            }
+            return false;
+        }
+        catch (error) {
+            (_a = this.logger) === null || _a === void 0 ? void 0 : _a.error("Permission enforcement error", { error, params });
+            // Default to deny on error for security
+            return false;
+        }
+    }
+    /**
+     * Check if there are any explicit deny policies for the user or their groups
+     */
+    async hasExplicitDeny(enforcer, subject, groups, domain, resource, action) {
+        // Get all policies and check for deny effect
+        const policies = await enforcer.getPolicy();
+        // Pre-fetch all roles for all groups once to avoid N+1 queries
+        const groupRolesMap = new Map();
+        await Promise.all(groups.map(async (group) => {
+            const roles = await enforcer.getRolesForUser(group, domain);
+            groupRolesMap.set(group, roles);
+        }));
+        // Collect all roles the user has through their groups
+        const allUserRoles = new Set();
+        for (const roles of groupRolesMap.values()) {
+            for (const role of roles) {
+                allUserRoles.add(role);
+            }
+        }
+        // Check each policy for a deny that matches this request
+        for (const policy of policies) {
+            // Policy format: [sub, dom, obj, act, eft]
+            const [polSub, polDom, polObj, polAct, polEft] = policy;
+            // Skip if not a deny policy
+            if (polEft !== "deny")
+                continue;
+            // Skip if domain doesn't match
+            if (polDom !== domain)
+                continue;
+            // Skip if resource doesn't match
+            if (polObj !== resource)
+                continue;
+            // Skip if action doesn't match (consider wildcard)
+            if (polAct !== action && polAct !== "*")
+                continue;
+            // Check if subject matches the user directly
+            if (polSub === subject) {
+                return true;
+            }
+            // Check if subject matches any of the user's groups
+            if (groups.includes(polSub)) {
+                return true;
+            }
+            // Check if subject matches a role assigned to any of the user's groups
+            if (allUserRoles.has(polSub)) {
+                return true;
+            }
+        }
+        return false;
+    }
+    /**
+     * Check multiple permissions at once
+     *
+     * @param params Array of enforcement parameters
+     * @returns Array of boolean results in the same order
+     */
+    async enforceMany(params) {
+        return Promise.all(params.map((p) => this.enforce(p)));
+    }
+    /**
+     * Get the Casbin enforcer for a tenant, creating or refreshing as needed
+     */
+    async getEnforcer(tenantId, userCredentials) {
+        const cached = enforcerCache.get(tenantId);
+        const now = Date.now();
+        // Return cached enforcer if still valid
+        if (cached && now - cached.lastLoaded < PERMISSIONS_LIMITS.ENFORCER_CACHE_TTL_MS) {
+            return cached.enforcer;
+        }
+        // Create new enforcer
+        const enforcer = await this.createEnforcer(tenantId, userCredentials);
+        // Cache it
+        enforcerCache.set(tenantId, { enforcer, lastLoaded: now });
+        return enforcer;
+    }
+    /**
+     * Force reload of the enforcer for a tenant
+     * Call this after policy changes to ensure they take effect immediately
+     */
+    async reloadEnforcer(tenantId, userCredentials) {
+        enforcerCache.delete(tenantId);
+        await this.getEnforcer(tenantId, userCredentials);
+    }
+    /**
+     * Clear all cached enforcers
+     */
+    clearCache() {
+        enforcerCache.clear();
+    }
+    /**
+     * Create a new Casbin enforcer for a tenant
+     */
+    async createEnforcer(tenantId, userCredentials) {
+        // Create model from embedded string constant (works when published as npm package)
+        const model = newModelFromString(CASBIN_MODEL);
+        // Create adapter
+        const adapter = new CasbinDynamoDbAdapter({ tenantId, userCredentials });
+        // Create enforcer with model and adapter
+        const enforcer = await newEnforcer(model, adapter);
+        return enforcer;
+    }
+    /**
+     * Get all roles for a user in a domain
+     */
+    async getRolesForUser(userId, tenantId, logicalDomain = "default", userCredentials) {
+        const domain = `${tenantId}:${logicalDomain}`;
+        const enforcer = await this.getEnforcer(tenantId, userCredentials);
+        return enforcer.getRolesForUser(userId, domain);
+    }
+    /**
+     * Get all users that have a role in a domain
+     */
+    async getUsersForRole(role, tenantId, logicalDomain = "default", userCredentials) {
+        const domain = `${tenantId}:${logicalDomain}`;
+        const enforcer = await this.getEnforcer(tenantId, userCredentials);
+        return enforcer.getUsersForRole(role, domain);
+    }
+    /**
+     * Check if a user has a role in a domain
+     */
+    async hasRoleForUser(userId, role, tenantId, logicalDomain = "default", userCredentials) {
+        const domain = `${tenantId}:${logicalDomain}`;
+        const enforcer = await this.getEnforcer(tenantId, userCredentials);
+        return enforcer.hasRoleForUser(userId, role, domain);
+    }
+}
+// ============================================================================
+// Singleton Instance
+// ============================================================================
+let permissionsServiceInstance = null;
+/**
+ * Get the singleton PermissionsService instance
+ */
+export function getPermissionsService() {
+    if (!permissionsServiceInstance) {
+        permissionsServiceInstance = new PermissionsService();
+    }
+    return permissionsServiceInstance;
+}
+//# sourceMappingURL=permissions.service.js.map

package/dist/permissions/services/permissions.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.service.js","sourceRoot":"","sources":["../../../lib/permissions/services/permissions.service.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,uBAAuB,EACvB,YAAY,EACZ,kBAAkB,GACnB,MAAM,yCAAyC,CAAC;AAEjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,oDAAoD,CAAC;AAC3F,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAGxE,OAAO,EAAY,WAAW,EAAE,kBAAkB,EAAE,MAAM,QAAQ,CAAC;AAUnE,+EAA+E;AAC/E,iBAAiB;AACjB,+EAA+E;AAE/E,6CAA6C;AAC7C,MAAM,aAAa,GAAG,IAAI,GAAG,EAAsD,CAAC;AAEpF,+EAA+E;AAC/E,UAAU;AACV,+EAA+E;AAE/E;;;;;;;;;GASG;AACH,MAAM,OAAO,kBAAmB,SAAQ,cAAc;IACpD,YAAY,OAA+B,EAAE;QAC3C,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,KAAK,CAAC,OAAO,CAAC,MAAqB;;QACjC,MAAM,EACJ,OAAO,EACP,QAAQ,EACR,QAAQ,EACR,MAAM,EACN,aAAa,GAAG,SAAS,EACzB,MAAM,GAAG,EAAE,EACX,eAAe,GAChB,GAAG,MAAM,CAAC;QACX,MAAM,MAAM,GAAG,GAAG,QAAQ,IAAI,aAAa,EAAE,CAAC;QAE9C,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;YAEnE,6DAA6D;YAC7D,wEAAwE;YACxE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CACxC,QAAQ,EACR,OAAO,EACP,MAAM,EACN,MAAM,EACN,QAAQ,EACR,MAAM,CACP,CAAC;YACF,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,KAAK,CAAC;YACf,CAAC;YAED,kEAAkE;YAClE,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC/E,IAAI,YAAY,EAAE,CAAC;gBACjB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,0CAA0C;YAC1C,uEAAuE;YACvE,6DAA6D;YAC7D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAC5E,IAAI,WAAW,EAAE,CAAC;oBAChB,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;YAED,oEAAoE;YACpE,uEAAuE;YACvE,MAAM,mBAAmB,GAAG,MAAM,QAAQ,CAAC,OAAO,CAChD,uBAAuB,EACvB,MAAM,EACN,QAAQ,EACR,MAAM,CACP,CAAC;YACF,IAAI,mBAAmB,EAAE,CAAC;gBACxB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAA,IAAI,CAAC,MAAM,0CAAE,KAAK,CAAC,8BAA8B,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YACtE,wCAAwC;YACxC,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,eAAe,CAC3B,QAAkB,EAClB,OAAe,EACf,MAAgB,EAChB,MAAc,EACd,QAAgB,EAChB,MAAc;QAEd,6CAA6C;QAC7C,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,CAAC;QAE5C,+DAA+D;QAC/D,MAAM,aAAa,GAAG,IAAI,GAAG,EAAoB,CAAC;QAClD,MAAM,OAAO,CAAC,GAAG,CACf,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACzB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC5D,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAClC,CAAC,CAAC,CACH,CAAC;QAEF,sDAAsD;QACtD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;QACvC,KAAK,MAAM,KAAK,IAAI,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC;YAC3C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QAED,yDAAyD;QACzD,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;YAC9B,2CAA2C;YAC3C,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC;YAExD,4BAA4B;YAC5B,IAAI,MAAM,KAAK,MAAM;gBAAE,SAAS;YAEhC,+BAA+B;YAC/B,IAAI,MAAM,KAAK,MAAM;gBAAE,SAAS;YAEhC,iCAAiC;YACjC,IAAI,MAAM,KAAK,QAAQ;gBAAE,SAAS;YAElC,mDAAmD;YACnD,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,GAAG;gBAAE,SAAS;YAElD,6CAA6C;YAC7C,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;gBACvB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,oDAAoD;YACpD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAC;YACd,CAAC;YAED,uEAAuE;YACvE,IAAI,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC7B,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,WAAW,CAAC,MAAuB;QACvC,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,QAAgB,EAAE,eAAoC;QACtE,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,wCAAwC;QACxC,IAAI,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,UAAU,GAAG,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;YACjF,OAAO,MAAM,CAAC,QAAQ,CAAC;QACzB,CAAC;QAED,sBAAsB;QACtB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QAEtE,WAAW;QACX,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAE3D,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,cAAc,CAAC,QAAgB,EAAE,eAAoC;QACzE,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC/B,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IACpD,CAAC;IAED;;OAEG;IACH,UAAU;QACR,aAAa,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,cAAc,CAC1B,QAAgB,EAChB,eAAoC;QAEpC,mFAAmF;QACnF,MAAM,KAAK,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;QAE/C,iBAAiB;QACjB,MAAM,OAAO,GAAG,IAAI,qBAAqB,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC;QAEzE,yCAAyC;QACzC,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAEnD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe,CACnB,MAAc,EACd,QAAgB,EAChB,aAAa,GAAG,SAAS,EACzB,eAAoC;QAEpC,MAAM,MAAM,GAAG,GAAG,QAAQ,IAAI,aAAa,EAAE,CAAC;QAC9C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QACnE,OAAO,QAAQ,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe,CACnB,IAAY,EACZ,QAAgB,EAChB,aAAa,GAAG,SAAS,EACzB,eAAoC;QAEpC,MAAM,MAAM,GAAG,GAAG,QAAQ,IAAI,aAAa,EAAE,CAAC;QAC9C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QACnE,OAAO,QAAQ,CAAC,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAClB,MAAc,EACd,IAAY,EACZ,QAAgB,EAChB,aAAa,GAAG,SAAS,EACzB,eAAoC;QAEpC,MAAM,MAAM,GAAG,GAAG,QAAQ,IAAI,aAAa,EAAE,CAAC;QAC9C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QACnE,OAAO,QAAQ,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACvD,CAAC;CACF;AAED,+EAA+E;AAC/E,qBAAqB;AACrB,+EAA+E;AAE/E,IAAI,0BAA0B,GAA8B,IAAI,CAAC;AAEjE;;GAEG;AACH,MAAM,UAAU,qBAAqB;IACnC,IAAI,CAAC,0BAA0B,EAAE,CAAC;QAChC,0BAA0B,GAAG,IAAI,kBAAkB,EAAE,CAAC;IACxD,CAAC;IACD,OAAO,0BAA0B,CAAC;AACpC,CAAC"}

package/dist/permissions/services/policy.service.d.ts

@@ -0,0 +1,87 @@
+/**
+ * Policy Service
+ * CRUD operations for permission policies
+ */
+import type { PoliciesTableSchema } from "../../db/schemas/policies.schema";
+import type { Policy } from "../permissions.schemas";
+import type { CreatePolicyRequest, UpdatePolicyRequest, ListPoliciesParams, PolicyStatus, PolicyServiceOptions, ListPoliciesResult } from "../permissions.interfaces";
+import type { DynamoDbService } from "../../shared/services/dynamodb";
+import type { Logger } from "../../shared/services/logger";
+import { BaseAwsService } from "../../shared/services/base-aws-service";
+export interface PolicyServiceDeps {
+    logger?: Logger;
+    policiesDb?: DynamoDbService<PoliciesTableSchema>;
+}
+/**
+ * Service for managing permission policies.
+ * Handles CRUD operations for policies stored in DynamoDB.
+ */
+export declare class PolicyService extends BaseAwsService {
+    private policiesDb;
+    constructor(deps?: PolicyServiceDeps);
+    /**
+     * List policies with filtering, sorting, and pagination
+     */
+    list(params: ListPoliciesParams, options: PolicyServiceOptions): Promise<ListPoliciesResult>;
+    /**
+     * Get a policy by ID
+     */
+    get(policyId: string, options: PolicyServiceOptions): Promise<Policy>;
+    /**
+     * Create a new policy
+     */
+    create(data: CreatePolicyRequest, options: PolicyServiceOptions): Promise<Policy>;
+    /**
+     * Update an existing policy
+     */
+    update(policyId: string, data: UpdatePolicyRequest, options: PolicyServiceOptions): Promise<Policy>;
+    /**
+     * Toggle policy status (enable/disable)
+     */
+    toggleStatus(policyId: string, status: PolicyStatus, options: PolicyServiceOptions): Promise<Policy>;
+    /**
+     * Delete a policy
+     * Includes self-lockout protection for permissions:manage policies
+     */
+    delete(policyId: string, options: PolicyServiceOptions): Promise<void>;
+    /**
+     * Bulk delete multiple policies
+     * Uses batch write for efficient deletion and reloads enforcer once at the end
+     */
+    bulkDelete(policyIds: string[], options: PolicyServiceOptions): Promise<{
+        deleted: string[];
+        failed: {
+            policyId: string;
+            error: string;
+        }[];
+    }>;
+    /**
+     * Find a policy by subject, subjectType, and resource
+     * Returns the first matching policy (duplicate check ignores specific actions)
+     */
+    private findPolicy;
+    /**
+     * Check if deleting this policy would lock out the current user from permissions management.
+     *
+     * Returns true (lockout risk) only if:
+     * 1. The policy being deleted grants permissions:delete to the current user
+     * 2. No other policies would grant the user permissions:delete after deletion
+     */
+    private checkSelfLockout;
+    /**
+     * Check if a policy applies to a specific user.
+     *
+     * A policy applies to a user if:
+     * - subjectType is "user" and subject matches the userId
+     * - subjectType is "group" and subject matches one of the user's groups
+     * - subjectType is "role" and the role is assigned to one of the user's groups
+     *   (Note: role resolution requires checking role assignments, which we skip here
+     *   for simplicity - roles are checked via group membership)
+     */
+    private policyAppliesToUser;
+}
+/**
+ * Get the singleton PolicyService instance
+ */
+export declare function getPolicyService(): PolicyService;
+//# sourceMappingURL=policy.service.d.ts.map

package/dist/permissions/services/policy.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.service.d.ts","sourceRoot":"","sources":["../../../lib/permissions/services/policy.service.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uCAAuC,CAAC;AACpE,OAAO,KAAK,EAEV,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,YAAY,EAGZ,oBAAoB,EACpB,kBAAkB,EACnB,MAAM,0CAA0C,CAAC;AAElD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,8BAA8B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AA6BxE,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,eAAe,CAAC,mBAAmB,CAAC,CAAC;CACnD;AAMD;;;GAGG;AACH,qBAAa,aAAc,SAAQ,cAAc;IAC/C,OAAO,CAAC,UAAU,CAAuC;gBAE7C,IAAI,GAAE,iBAAsB;IAMxC;;OAEG;IACG,IAAI,CACR,MAAM,EAAE,kBAAkB,EAC1B,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,kBAAkB,CAAC;IA2F9B;;OAEG;IACG,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,MAAM,CAAC;IAyB3E;;OAEG;IACG,MAAM,CAAC,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,MAAM,CAAC;IA+DvF;;OAEG;IACG,MAAM,CACV,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,mBAAmB,EACzB,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,MAAM,CAAC;IAmElB;;OAEG;IACG,YAAY,CAChB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,MAAM,CAAC;IAmClB;;;OAGG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAqC5E;;;OAGG;IACG,UAAU,CACd,SAAS,EAAE,MAAM,EAAE,EACnB,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,CAAC;IAkEhF;;;OAGG;YACW,UAAU;IAuBxB;;;;;;OAMG;YACW,gBAAgB;IAuD9B;;;;;;;;;OASG;IACH,OAAO,CAAC,mBAAmB;CAkB5B;AAQD;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,aAAa,CAKhD"}