convex-cms 0.0.1

package/dist/component/authorizationHooks.js

@@ -0,0 +1,521 @@
+/**
+ * Authorization Hooks Execution Module
+ *
+ * This module provides the infrastructure for executing authorization hooks
+ * that enable custom permission logic beyond the built-in RBAC system.
+ *
+ * Authorization hooks allow parent applications to:
+ * - Implement custom authorization logic (team-based, subscription-based, etc.)
+ * - Add additional restrictions beyond RBAC
+ * - Override RBAC decisions in special cases
+ * - Log and audit authorization decisions
+ *
+ * Hook execution order:
+ * 1. beforeRbac hook (can reject early or skip RBAC)
+ * 2. Built-in RBAC permission check (if not skipped)
+ * 3. afterRbac hook (additional restrictions)
+ * 4. Operation-specific hook (fine-grained control)
+ * 5. onDeny hook (if denied, can override)
+ *
+ * @example
+ * ```typescript
+ * import { executeAuthorizationHooks } from './authorizationHooks';
+ *
+ * // In a mutation handler
+ * const authResult = await executeAuthorizationHooks({
+ *   hooks: config.authorizationHooks,
+ *   context: {
+ *     operation: 'contentEntries.create',
+ *     userId: args.createdBy,
+ *     role: userRole,
+ *     contentTypeId: args.contentTypeId,
+ *     operationData: args,
+ *   },
+ *   rbacCheck: () => checkPermission({ role: userRole, ... }),
+ *   skipRbac: config.skipRbac,
+ * });
+ *
+ * if (!authResult.allowed) {
+ *   throw new UnauthorizedError(authResult.reason ?? 'Access denied', { ... });
+ * }
+ * ```
+ */
+import { checkPermission, UnauthorizedError, } from "./authorization.js";
+// =============================================================================
+// Helper Functions
+// =============================================================================
+/**
+ * Maps a CMS operation to an RBAC resource and action.
+ */
+export function operationToRbac(operation) {
+    const mapping = {
+        // Content Types
+        "contentTypes.create": { resource: "contentTypes", action: "create" },
+        "contentTypes.update": { resource: "contentTypes", action: "update" },
+        "contentTypes.delete": { resource: "contentTypes", action: "delete" },
+        "contentTypes.read": { resource: "contentTypes", action: "read" },
+        // Content Entries
+        "contentEntries.create": { resource: "contentEntries", action: "create" },
+        "contentEntries.update": { resource: "contentEntries", action: "update" },
+        "contentEntries.delete": { resource: "contentEntries", action: "delete" },
+        "contentEntries.read": { resource: "contentEntries", action: "read" },
+        "contentEntries.publish": { resource: "contentEntries", action: "publish" },
+        "contentEntries.unpublish": { resource: "contentEntries", action: "unpublish" },
+        "contentEntries.restore": { resource: "contentEntries", action: "restore" },
+        "contentEntries.schedule": { resource: "contentEntries", action: "update" }, // Schedule uses update permission
+        // Media Items (unified assets and folders)
+        "mediaItems.create": { resource: "mediaItems", action: "create" },
+        "mediaItems.update": { resource: "mediaItems", action: "update" },
+        "mediaItems.delete": { resource: "mediaItems", action: "delete" },
+        "mediaItems.read": { resource: "mediaItems", action: "read" },
+        "mediaItems.move": { resource: "mediaItems", action: "move" },
+        // Versions
+        "versions.read": { resource: "contentEntries", action: "read" }, // Version read uses entry read
+        "versions.rollback": { resource: "contentEntries", action: "update" }, // Rollback uses entry update
+    };
+    return mapping[operation] ?? null;
+}
+/**
+ * Execute a single authorization hook safely.
+ * Catches errors and converts them to denied results.
+ */
+async function executeHook(hook, context) {
+    if (!hook) {
+        return { allowed: true };
+    }
+    try {
+        const result = await hook(context);
+        return result;
+    }
+    catch (error) {
+        // Hook threw an error - treat as denial
+        const message = error instanceof Error ? error.message : "Authorization hook failed";
+        return {
+            allowed: false,
+            reason: message,
+        };
+    }
+}
+/**
+ * Execute the authorize hook with the extended context that includes the RBAC decision.
+ * This hook receives the default RBAC decision and can override it.
+ */
+async function executeAuthorizeHook(hook, context, defaultDecision) {
+    if (!hook) {
+        // If no authorize hook, return the default decision
+        return {
+            allowed: defaultDecision.allowed,
+            reason: defaultDecision.reason,
+        };
+    }
+    const authorizeContext = {
+        ...context,
+        defaultDecision,
+    };
+    try {
+        const result = await hook(authorizeContext);
+        return result;
+    }
+    catch (error) {
+        // Hook threw an error - treat as denial
+        const message = error instanceof Error ? error.message : "Authorize hook failed";
+        return {
+            allowed: false,
+            reason: message,
+        };
+    }
+}
+// =============================================================================
+// Main Authorization Execution Function
+// =============================================================================
+/**
+ * Execute the full authorization hook chain for an operation.
+ *
+ * This function orchestrates the execution of all authorization hooks and the
+ * built-in RBAC check in the correct order:
+ *
+ * 1. **beforeRbac hook**: Can reject early or skip RBAC
+ * 2. **Built-in RBAC**: Standard role-based permission check
+ * 3. **authorize hook**: Receives RBAC decision, can override allow/deny
+ * 4. **afterRbac hook**: Additional restrictions after authorize passes
+ * 5. **Operation hook**: Operation-specific restrictions
+ * 6. **onDeny hook**: Can override denials
+ *
+ * @param options - Configuration for the authorization execution
+ * @returns AuthorizationResult indicating if the operation is allowed
+ *
+ * @example
+ * ```typescript
+ * const result = await executeAuthorizationHooks({
+ *   hooks: config.authorizationHooks,
+ *   context: {
+ *     operation: 'contentEntries.publish',
+ *     userId: currentUser,
+ *     role: 'editor',
+ *     resourceId: entryId,
+ *     resourceOwnerId: entry.createdBy,
+ *   },
+ *   rbacOptions: {
+ *     role: 'editor',
+ *     resource: 'contentEntries',
+ *     action: 'publish',
+ *     userId: currentUser,
+ *     resourceOwnerId: entry.createdBy,
+ *   },
+ * });
+ *
+ * if (!result.allowed) {
+ *   throw new Error(result.reason ?? 'Operation not allowed');
+ * }
+ * ```
+ */
+export async function executeAuthorizationHooks(options) {
+    const { hooks, context, rbacOptions, skipRbac = false, customRoles } = options;
+    let modifiedData;
+    let rbacResult;
+    let shouldSkipRbac = skipRbac;
+    // -------------------------------------------------------------------------
+    // Step 1: Execute beforeRbac hook
+    // -------------------------------------------------------------------------
+    if (hooks?.beforeRbac) {
+        const beforeResult = await executeHook(hooks.beforeRbac, context);
+        if (!beforeResult.allowed) {
+            // beforeRbac denied - check onDeny hook
+            if (hooks.onDeny) {
+                const denyResult = await executeHook(hooks.onDeny, {
+                    ...context,
+                    operationData: {
+                        ...context.operationData,
+                        deniedBy: "beforeRbac",
+                        reason: beforeResult.reason,
+                    },
+                });
+                if (denyResult.allowed) {
+                    // onDeny overrode the denial
+                    modifiedData = denyResult.modifiedData;
+                }
+                else {
+                    return {
+                        allowed: false,
+                        reason: beforeResult.reason ?? "Denied by beforeRbac hook",
+                        deniedBy: "beforeRbac",
+                    };
+                }
+            }
+            else {
+                return {
+                    allowed: false,
+                    reason: beforeResult.reason ?? "Denied by beforeRbac hook",
+                    deniedBy: "beforeRbac",
+                };
+            }
+        }
+        else {
+            // beforeRbac allowed - check if we should skip RBAC
+            if (beforeResult.skipRbac) {
+                shouldSkipRbac = true;
+            }
+            if (beforeResult.modifiedData) {
+                modifiedData = beforeResult.modifiedData;
+            }
+        }
+    }
+    // -------------------------------------------------------------------------
+    // Step 2: Execute built-in RBAC check (if not skipped)
+    // -------------------------------------------------------------------------
+    let rbacDecision = {
+        allowed: true, // Default if RBAC is skipped
+    };
+    if (!shouldSkipRbac && rbacOptions) {
+        // Add custom roles if provided
+        const rbacOptionsWithRoles = {
+            ...rbacOptions,
+            customRoles: customRoles ?? rbacOptions.customRoles,
+        };
+        rbacResult = checkPermission(rbacOptionsWithRoles);
+        if (rbacResult.allowed) {
+            // Type narrowing: rbacResult is PermissionGranted when allowed is true
+            const grantedResult = rbacResult;
+            rbacDecision = {
+                allowed: true,
+                grantedScope: grantedResult.grantedScope,
+                ownershipVerified: grantedResult.ownershipVerified,
+            };
+        }
+        else {
+            // Type narrowing: rbacResult is PermissionDenied when allowed is false
+            const deniedResult = rbacResult;
+            rbacDecision = {
+                allowed: false,
+                reason: deniedResult.reason,
+                code: deniedResult.code,
+            };
+        }
+    }
+    // -------------------------------------------------------------------------
+    // Step 3: Execute authorize hook (receives RBAC decision)
+    // -------------------------------------------------------------------------
+    // The authorize hook can override the RBAC decision in either direction
+    if (hooks?.authorize) {
+        const authorizeResult = await executeAuthorizeHook(hooks.authorize, {
+            ...context,
+            operationData: {
+                ...context.operationData,
+                ...(modifiedData ?? {}),
+            },
+        }, rbacDecision);
+        if (!authorizeResult.allowed) {
+            // authorize hook denied - check onDeny hook
+            if (hooks.onDeny) {
+                const denyResult = await executeHook(hooks.onDeny, {
+                    ...context,
+                    operationData: {
+                        ...context.operationData,
+                        deniedBy: "authorize",
+                        reason: authorizeResult.reason,
+                        defaultDecision: rbacDecision,
+                    },
+                });
+                if (denyResult.allowed) {
+                    // onDeny overrode the denial
+                    modifiedData = denyResult.modifiedData ?? modifiedData;
+                }
+                else {
+                    return {
+                        allowed: false,
+                        reason: authorizeResult.reason ?? "Denied by authorize hook",
+                        deniedBy: "authorize",
+                        rbacResult,
+                    };
+                }
+            }
+            else {
+                return {
+                    allowed: false,
+                    reason: authorizeResult.reason ?? "Denied by authorize hook",
+                    deniedBy: "authorize",
+                    rbacResult,
+                };
+            }
+        }
+        else if (authorizeResult.modifiedData) {
+            modifiedData = { ...modifiedData, ...authorizeResult.modifiedData };
+        }
+    }
+    else if (!rbacDecision.allowed) {
+        // No authorize hook and RBAC denied - check onDeny hook
+        if (hooks?.onDeny) {
+            const denyResult = await executeHook(hooks.onDeny, {
+                ...context,
+                operationData: {
+                    ...context.operationData,
+                    deniedBy: "rbac",
+                    reason: rbacDecision.reason,
+                    rbacCode: rbacDecision.code,
+                },
+            });
+            if (denyResult.allowed) {
+                // onDeny overrode the denial
+                modifiedData = denyResult.modifiedData ?? modifiedData;
+            }
+            else {
+                return {
+                    allowed: false,
+                    reason: rbacDecision.reason ?? "Denied by RBAC",
+                    deniedBy: "rbac",
+                    rbacResult,
+                };
+            }
+        }
+        else {
+            return {
+                allowed: false,
+                reason: rbacDecision.reason ?? "Denied by RBAC",
+                deniedBy: "rbac",
+                rbacResult,
+            };
+        }
+    }
+    // -------------------------------------------------------------------------
+    // Step 4: Execute afterRbac hook
+    // -------------------------------------------------------------------------
+    if (hooks?.afterRbac) {
+        const afterResult = await executeHook(hooks.afterRbac, {
+            ...context,
+            operationData: {
+                ...context.operationData,
+                ...(modifiedData ?? {}),
+            },
+        });
+        if (!afterResult.allowed) {
+            // afterRbac denied - check onDeny hook
+            if (hooks.onDeny) {
+                const denyResult = await executeHook(hooks.onDeny, {
+                    ...context,
+                    operationData: {
+                        ...context.operationData,
+                        deniedBy: "afterRbac",
+                        reason: afterResult.reason,
+                    },
+                });
+                if (denyResult.allowed) {
+                    // onDeny overrode the denial
+                    modifiedData = denyResult.modifiedData ?? modifiedData;
+                }
+                else {
+                    return {
+                        allowed: false,
+                        reason: afterResult.reason ?? "Denied by afterRbac hook",
+                        deniedBy: "afterRbac",
+                        rbacResult,
+                    };
+                }
+            }
+            else {
+                return {
+                    allowed: false,
+                    reason: afterResult.reason ?? "Denied by afterRbac hook",
+                    deniedBy: "afterRbac",
+                    rbacResult,
+                };
+            }
+        }
+        else if (afterResult.modifiedData) {
+            modifiedData = { ...modifiedData, ...afterResult.modifiedData };
+        }
+    }
+    // -------------------------------------------------------------------------
+    // Step 5: Execute operation-specific hook
+    // -------------------------------------------------------------------------
+    const operationHook = hooks?.operationHooks?.[context.operation];
+    if (operationHook) {
+        const opResult = await executeHook(operationHook, {
+            ...context,
+            operationData: {
+                ...context.operationData,
+                ...(modifiedData ?? {}),
+            },
+        });
+        if (!opResult.allowed) {
+            // Operation hook denied - check onDeny hook
+            if (hooks?.onDeny) {
+                const denyResult = await executeHook(hooks.onDeny, {
+                    ...context,
+                    operationData: {
+                        ...context.operationData,
+                        deniedBy: "operationHook",
+                        reason: opResult.reason,
+                    },
+                });
+                if (denyResult.allowed) {
+                    // onDeny overrode the denial
+                    modifiedData = denyResult.modifiedData ?? modifiedData;
+                }
+                else {
+                    return {
+                        allowed: false,
+                        reason: opResult.reason ?? `Denied by ${context.operation} hook`,
+                        deniedBy: "operationHook",
+                        rbacResult,
+                    };
+                }
+            }
+            else {
+                return {
+                    allowed: false,
+                    reason: opResult.reason ?? `Denied by ${context.operation} hook`,
+                    deniedBy: "operationHook",
+                    rbacResult,
+                };
+            }
+        }
+        else if (opResult.modifiedData) {
+            modifiedData = { ...modifiedData, ...opResult.modifiedData };
+        }
+    }
+    // -------------------------------------------------------------------------
+    // All checks passed
+    // -------------------------------------------------------------------------
+    return {
+        allowed: true,
+        modifiedData,
+        rbacResult,
+    };
+}
+// =============================================================================
+// Convenience Functions
+// =============================================================================
+/**
+ * Create an authorization context for a content entry operation.
+ *
+ * @param operation - The CMS operation being performed
+ * @param userId - The user performing the operation
+ * @param role - The user's CMS role
+ * @param entry - The content entry (if available)
+ * @param contentType - The content type (if available)
+ * @param operationData - Additional operation data (args)
+ * @returns AuthorizationHookContext
+ */
+export function createContentEntryAuthContext(operation, userId, role, entry, contentType, operationData) {
+    return {
+        operation,
+        userId,
+        role,
+        resourceId: entry?._id,
+        resourceOwnerId: entry?.createdBy,
+        contentTypeId: (entry?.contentTypeId ?? contentType?._id),
+        contentTypeName: contentType?.name,
+        operationData,
+    };
+}
+/**
+ * Create RBAC options from an authorization context.
+ *
+ * @param context - The authorization context
+ * @returns PermissionCheckOptions for the RBAC check
+ */
+export function contextToRbacOptions(context) {
+    const rbacMapping = operationToRbac(context.operation);
+    if (!rbacMapping) {
+        return null;
+    }
+    return {
+        userId: context.userId,
+        role: context.role ?? null,
+        resource: rbacMapping.resource,
+        action: rbacMapping.action,
+        resourceOwnerId: context.resourceOwnerId,
+    };
+}
+/**
+ * Execute authorization for an operation and throw if denied.
+ *
+ * This is a convenience wrapper that executes hooks and throws
+ * UnauthorizedError if the operation is not allowed.
+ *
+ * @param options - Authorization execution options
+ * @throws UnauthorizedError if the operation is denied
+ * @returns The authorization result (if allowed)
+ */
+export async function requireAuthorization(options) {
+    const result = await executeAuthorizationHooks(options);
+    if (!result.allowed) {
+        const rbacMapping = operationToRbac(options.context.operation);
+        // Get the error code from RBAC result if available
+        let errorCode = "PERMISSION_DENIED";
+        if (result.rbacResult && !result.rbacResult.allowed) {
+            // Type narrowing: rbacResult is PermissionDenied when allowed is false
+            const deniedRbac = result.rbacResult;
+            errorCode = deniedRbac.code;
+        }
+        throw new UnauthorizedError(result.reason ?? "Operation not allowed", {
+            code: errorCode,
+            resource: rbacMapping?.resource,
+            action: rbacMapping?.action,
+            role: options.context.role ?? undefined,
+            userId: options.context.userId,
+        });
+    }
+    return result;
+}
+//# sourceMappingURL=authorizationHooks.js.map

package/dist/component/authorizationHooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorizationHooks.js","sourceRoot":"","sources":["../../src/component/authorizationHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAUH,OAAO,EACL,eAAe,EAGf,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAkF5B,gFAAgF;AAChF,mBAAmB;AACnB,gFAAgF;AAEhF;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,SAAuB;IACrD,MAAM,OAAO,GAAiE;QAC5E,gBAAgB;QAChB,qBAAqB,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE;QACrE,qBAAqB,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE;QACrE,qBAAqB,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE;QACrE,mBAAmB,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE;QAEjE,kBAAkB;QAClB,uBAAuB,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE;QACzE,uBAAuB,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE;QACzE,uBAAuB,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE;QACzE,qBAAqB,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,EAAE;QACrE,wBAAwB,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,SAAS,EAAE;QAC3E,0BAA0B,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,WAAW,EAAE;QAC/E,wBAAwB,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,SAAS,EAAE;QAC3E,yBAAyB,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,kCAAkC;QAE/G,2CAA2C;QAC3C,mBAAmB,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE;QACjE,mBAAmB,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE;QACjE,mBAAmB,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE;QACjE,iBAAiB,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE;QAC7D,iBAAiB,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE;QAE7D,WAAW;QACX,eAAe,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,+BAA+B;QAChG,mBAAmB,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,6BAA6B;KACrG,CAAC;IAEF,OAAO,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,WAAW,CACxB,IAAqH,EACrH,OAAiC;IAEjC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;QACnC,OAAO,MAA4B,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,wCAAwC;QACxC,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,2BAA2B,CAAC;QACrF,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,OAAO;SAChB,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,oBAAoB,CACjC,IAAiH,EACjH,OAAiC,EACjC,eAAwD;IAExD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,oDAAoD;QACpD,OAAO;YACL,OAAO,EAAE,eAAe,CAAC,OAAO;YAChC,MAAM,EAAE,eAAe,CAAC,MAAM;SAC/B,CAAC;IACJ,CAAC;IAED,MAAM,gBAAgB,GAAyB;QAC7C,GAAG,OAAO;QACV,eAAe;KAChB,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC5C,OAAO,MAA4B,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,wCAAwC;QACxC,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC;QACjF,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,OAAO;SAChB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,wCAAwC;AACxC,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAAoC;IAEpC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,GAAG,KAAK,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IAE/E,IAAI,YAAiD,CAAC;IACtD,IAAI,UAA6C,CAAC;IAClD,IAAI,cAAc,GAAG,QAAQ,CAAC;IAE9B,4EAA4E;IAC5E,kCAAkC;IAClC,4EAA4E;IAC5E,IAAI,KAAK,EAAE,UAAU,EAAE,CAAC;QACtB,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAElE,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;YAC1B,wCAAwC;YACxC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBACjB,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE;oBACjD,GAAG,OAAO;oBACV,aAAa,EAAE;wBACb,GAAG,OAAO,CAAC,aAAa;wBACxB,QAAQ,EAAE,YAAY;wBACtB,MAAM,EAAE,YAAY,CAAC,MAAM;qBAC5B;iBACF,CAAC,CAAC;gBAEH,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;oBACvB,6BAA6B;oBAC7B,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;gBACzC,CAAC;qBAAM,CAAC;oBACN,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,YAAY,CAAC,MAAM,IAAI,2BAA2B;wBAC1D,QAAQ,EAAE,YAAY;qBACvB,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,YAAY,CAAC,MAAM,IAAI,2BAA2B;oBAC1D,QAAQ,EAAE,YAAY;iBACvB,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,oDAAoD;YACpD,IAAI,YAAY,CAAC,QAAQ,EAAE,CAAC;gBAC1B,cAAc,GAAG,IAAI,CAAC;YACxB,CAAC;YACD,IAAI,YAAY,CAAC,YAAY,EAAE,CAAC;gBAC9B,YAAY,GAAG,YAAY,CAAC,YAAY,CAAC;YAC3C,CAAC;QACH,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,uDAAuD;IACvD,4EAA4E;IAC5E,IAAI,YAAY,GAA4C;QAC1D,OAAO,EAAE,IAAI,EAAE,6BAA6B;KAC7C,CAAC;IAEF,IAAI,CAAC,cAAc,IAAI,WAAW,EAAE,CAAC;QACnC,+BAA+B;QAC/B,MAAM,oBAAoB,GAA2B;YACnD,GAAG,WAAW;YACd,WAAW,EAAE,WAAW,IAAI,WAAW,CAAC,WAAW;SACpD,CAAC;QAEF,UAAU,GAAG,eAAe,CAAC,oBAAoB,CAAC,CAAC;QAEnD,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;YACvB,uEAAuE;YACvE,MAAM,aAAa,GAAG,UAIrB,CAAC;YACF,YAAY,GAAG;gBACb,OAAO,EAAE,IAAI;gBACb,YAAY,EAAE,aAAa,CAAC,YAAY;gBACxC,iBAAiB,EAAE,aAAa,CAAC,iBAAiB;aACnD,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,uEAAuE;YACvE,MAAM,YAAY,GAAG,UAA8D,CAAC;YACpF,YAAY,GAAG;gBACb,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,YAAY,CAAC,IAAI;aACxB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,0DAA0D;IAC1D,4EAA4E;IAC5E,wEAAwE;IACxE,IAAI,KAAK,EAAE,SAAS,EAAE,CAAC;QACrB,MAAM,eAAe,GAAG,MAAM,oBAAoB,CAChD,KAAK,CAAC,SAAS,EACf;YACE,GAAG,OAAO;YACV,aAAa,EAAE;gBACb,GAAG,OAAO,CAAC,aAAa;gBACxB,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;aACxB;SACF,EACD,YAAY,CACb,CAAC;QAEF,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;YAC7B,4CAA4C;YAC5C,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBACjB,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE;oBACjD,GAAG,OAAO;oBACV,aAAa,EAAE;wBACb,GAAG,OAAO,CAAC,aAAa;wBACxB,QAAQ,EAAE,WAAW;wBACrB,MAAM,EAAE,eAAe,CAAC,MAAM;wBAC9B,eAAe,EAAE,YAAY;qBAC9B;iBACF,CAAC,CAAC;gBAEH,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;oBACvB,6BAA6B;oBAC7B,YAAY,GAAG,UAAU,CAAC,YAAY,IAAI,YAAY,CAAC;gBACzD,CAAC;qBAAM,CAAC;oBACN,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,eAAe,CAAC,MAAM,IAAI,0BAA0B;wBAC5D,QAAQ,EAAE,WAAW;wBACrB,UAAU;qBACX,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,eAAe,CAAC,MAAM,IAAI,0BAA0B;oBAC5D,QAAQ,EAAE,WAAW;oBACrB,UAAU;iBACX,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,IAAI,eAAe,CAAC,YAAY,EAAE,CAAC;YACxC,YAAY,GAAG,EAAE,GAAG,YAAY,EAAE,GAAG,eAAe,CAAC,YAAY,EAAE,CAAC;QACtE,CAAC;IACH,CAAC;SAAM,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;QACjC,wDAAwD;QACxD,IAAI,KAAK,EAAE,MAAM,EAAE,CAAC;YAClB,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE;gBACjD,GAAG,OAAO;gBACV,aAAa,EAAE;oBACb,GAAG,OAAO,CAAC,aAAa;oBACxB,QAAQ,EAAE,MAAM;oBAChB,MAAM,EAAE,YAAY,CAAC,MAAM;oBAC3B,QAAQ,EAAE,YAAY,CAAC,IAAI;iBAC5B;aACF,CAAC,CAAC;YAEH,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;gBACvB,6BAA6B;gBAC7B,YAAY,GAAG,UAAU,CAAC,YAAY,IAAI,YAAY,CAAC;YACzD,CAAC;iBAAM,CAAC;gBACN,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,YAAY,CAAC,MAAM,IAAI,gBAAgB;oBAC/C,QAAQ,EAAE,MAAM;oBAChB,UAAU;iBACX,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,YAAY,CAAC,MAAM,IAAI,gBAAgB;gBAC/C,QAAQ,EAAE,MAAM;gBAChB,UAAU;aACX,CAAC;QACJ,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,iCAAiC;IACjC,4EAA4E;IAC5E,IAAI,KAAK,EAAE,SAAS,EAAE,CAAC;QACrB,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE;YACrD,GAAG,OAAO;YACV,aAAa,EAAE;gBACb,GAAG,OAAO,CAAC,aAAa;gBACxB,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;aACxB;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;YACzB,uCAAuC;YACvC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBACjB,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE;oBACjD,GAAG,OAAO;oBACV,aAAa,EAAE;wBACb,GAAG,OAAO,CAAC,aAAa;wBACxB,QAAQ,EAAE,WAAW;wBACrB,MAAM,EAAE,WAAW,CAAC,MAAM;qBAC3B;iBACF,CAAC,CAAC;gBAEH,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;oBACvB,6BAA6B;oBAC7B,YAAY,GAAG,UAAU,CAAC,YAAY,IAAI,YAAY,CAAC;gBACzD,CAAC;qBAAM,CAAC;oBACN,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,WAAW,CAAC,MAAM,IAAI,0BAA0B;wBACxD,QAAQ,EAAE,WAAW;wBACrB,UAAU;qBACX,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,WAAW,CAAC,MAAM,IAAI,0BAA0B;oBACxD,QAAQ,EAAE,WAAW;oBACrB,UAAU;iBACX,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;YACpC,YAAY,GAAG,EAAE,GAAG,YAAY,EAAE,GAAG,WAAW,CAAC,YAAY,EAAE,CAAC;QAClE,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,0CAA0C;IAC1C,4EAA4E;IAC5E,MAAM,aAAa,GAAG,KAAK,EAAE,cAAc,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACjE,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,aAAa,EAAE;YAChD,GAAG,OAAO;YACV,aAAa,EAAE;gBACb,GAAG,OAAO,CAAC,aAAa;gBACxB,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;aACxB;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,4CAA4C;YAC5C,IAAI,KAAK,EAAE,MAAM,EAAE,CAAC;gBAClB,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE;oBACjD,GAAG,OAAO;oBACV,aAAa,EAAE;wBACb,GAAG,OAAO,CAAC,aAAa;wBACxB,QAAQ,EAAE,eAAe;wBACzB,MAAM,EAAE,QAAQ,CAAC,MAAM;qBACxB;iBACF,CAAC,CAAC;gBAEH,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;oBACvB,6BAA6B;oBAC7B,YAAY,GAAG,UAAU,CAAC,YAAY,IAAI,YAAY,CAAC;gBACzD,CAAC;qBAAM,CAAC;oBACN,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,aAAa,OAAO,CAAC,SAAS,OAAO;wBAChE,QAAQ,EAAE,eAAe;wBACzB,UAAU;qBACX,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,aAAa,OAAO,CAAC,SAAS,OAAO;oBAChE,QAAQ,EAAE,eAAe;oBACzB,UAAU;iBACX,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;YACjC,YAAY,GAAG,EAAE,GAAG,YAAY,EAAE,GAAG,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,oBAAoB;IACpB,4EAA4E;IAC5E,OAAO;QACL,OAAO,EAAE,IAAI;QACb,YAAY;QACZ,UAAU;KACX,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,wBAAwB;AACxB,gFAAgF;AAEhF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,6BAA6B,CAC3C,SAAuB,EACvB,MAA0B,EAC1B,IAA+B,EAC/B,KAAoE,EACpE,WAA4C,EAC5C,aAAuC;IAEvC,OAAO;QACL,SAAS;QACT,MAAM;QACN,IAAI;QACJ,UAAU,EAAE,KAAK,EAAE,GAAyB;QAC5C,eAAe,EAAE,KAAK,EAAE,SAAS;QACjC,aAAa,EAAE,CAAC,KAAK,EAAE,aAAa,IAAI,WAAW,EAAE,GAAG,CAAuB;QAC/E,eAAe,EAAE,WAAW,EAAE,IAAI;QAClC,aAAa;KACd,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAiC;IAEjC,MAAM,WAAW,GAAG,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACvD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,IAAI;QAC1B,QAAQ,EAAE,WAAW,CAAC,QAAQ;QAC9B,MAAM,EAAE,WAAW,CAAC,MAAM;QAC1B,eAAe,EAAE,OAAO,CAAC,eAAe;KACzC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAoC;IAEpC,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAExD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,WAAW,GAAG,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAE/D,mDAAmD;QACnD,IAAI,SAAS,GAA4E,mBAAmB,CAAC;QAC7G,IAAI,MAAM,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YACpD,uEAAuE;YACvE,MAAM,UAAU,GAAG,MAAM,CAAC,UAA8C,CAAC;YACzE,SAAS,GAAG,UAAU,CAAC,IAAwB,CAAC;QAClD,CAAC;QAED,MAAM,IAAI,iBAAiB,CACzB,MAAM,CAAC,MAAM,IAAI,uBAAuB,EACxC;YACE,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE,WAAW,EAAE,QAAQ;YAC/B,MAAM,EAAE,WAAW,EAAE,MAAM;YAC3B,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,SAAS;YACvC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM;SAC/B,CACF,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}