covara 0.0.1 → 0.6.0

package/dist/auth/routes.js

@@ -0,0 +1,417 @@
+import { Hono } from "hono";
+import { setCookie, deleteCookie, getCookie } from "hono/cookie";
+import { UnauthorizedError, ValidationError, RateLimitError } from "../resource/error.js";
+import { readJsonBody, getClientIP } from "../server/request.js";
+import { isProduction } from "../server/env.js";
+import { LoginThrottle } from "./login-throttle.js";
+import { createCsrfMiddleware, issueCsrfToken } from "./csrf.js";
+import { issueToken as issueVerificationToken, verifyToken as verifyVerificationToken, } from "./verification.js";
+import { issuePasswordResetToken, verifyPasswordResetToken, hashNewPassword, } from "./password-reset.js";
+import { generateTotpSecret, getTotpUri, verifyTotp, generateBackupCodes, verifyBackupCode, } from "./totp.js";
+import { issueMagicLinkToken, consumeMagicLinkToken } from "./magic-link.js";
+import { enforcePasswordStrength, } from "./password-policy.js";
+const defaultCookieOptions = {
+    httpOnly: true,
+    sameSite: "lax",
+    maxAge: 7 * 24 * 60 * 60 * 1000,
+    path: "/",
+};
+const defaultSerializeUser = (user) => ({
+    id: user.id,
+    email: user.email,
+    name: user.name,
+    image: user.image,
+});
+const toCookieOptions = (options) => ({
+    httpOnly: options?.httpOnly,
+    secure: options?.secure,
+    sameSite: options?.sameSite,
+    path: options?.path,
+    maxAge: options?.maxAge !== undefined ? Math.floor(options.maxAge / 1000) : undefined,
+    expires: options?.expires,
+});
+export const useAuth = (options) => {
+    const { adapter, cookieName = "session", cookieOptions = {}, login, signup, serializeUser = defaultSerializeUser, onLogin, onLogout, onSignup, csrf, throttle, verification, passwordReset, passwordPolicy, mfa, magicLink, } = options;
+    const finalCookieOptions = {
+        ...defaultCookieOptions,
+        secure: isProduction(),
+        ...cookieOptions,
+    };
+    const router = new Hono();
+    const csrfOptions = csrf
+        ? typeof csrf === "object"
+            ? csrf
+            : {}
+        : null;
+    const csrfMiddleware = csrfOptions ? createCsrfMiddleware(csrfOptions) : null;
+    if (csrfMiddleware) {
+        router.use("*", csrfMiddleware);
+    }
+    const throttle$ = throttle
+        ? new LoginThrottle(typeof throttle === "object" ? throttle : {})
+        : null;
+    const completeLogin = async (c, userId) => {
+        if (!adapter.createSession) {
+            throw new Error("Adapter does not support session creation");
+        }
+        const priorSessionId = getCookie(c, cookieName);
+        if (priorSessionId) {
+            await adapter.invalidateSession(priorSessionId);
+        }
+        const session = await adapter.createSession(userId);
+        const authResult = await adapter.validateCredentials({
+            type: "session",
+            sessionId: session.id,
+        });
+        if (!authResult.success || !authResult.user) {
+            return null;
+        }
+        setCookie(c, cookieName, session.id, toCookieOptions({
+            ...finalCookieOptions,
+            expires: session.expiresAt,
+        }));
+        if (csrfOptions) {
+            issueCsrfToken(c, csrfOptions);
+        }
+        await onLogin?.(authResult.user, c);
+        return { user: serializeUser(authResult.user), sessionId: session.id };
+    };
+    const verifyMfaChallenge = async (enrollment, userId, code) => {
+        if (!mfa)
+            return false;
+        if (verifyTotp(enrollment.secret, code, mfa.totp)) {
+            return true;
+        }
+        const hashes = enrollment.backupCodeHashes ?? [];
+        if (hashes.length === 0)
+            return false;
+        const result = await verifyBackupCode(code, hashes);
+        if (result.matched) {
+            await mfa.consumeBackupCode?.(userId, result.index);
+            return true;
+        }
+        return false;
+    };
+    const middleware = async (c, next) => {
+        try {
+            const credentials = adapter.extractCredentials(c);
+            if (!credentials) {
+                return next();
+            }
+            const result = await adapter.validateCredentials(credentials);
+            if (!result.success || !result.user) {
+                return next();
+            }
+            c.set("user", result.user);
+            return next();
+        }
+        catch {
+            return next();
+        }
+    };
+    router.get("/me", async (c) => {
+        try {
+            const credentials = adapter.extractCredentials(c);
+            if (!credentials) {
+                return c.json({ user: null });
+            }
+            const result = await adapter.validateCredentials(credentials);
+            if (!result.success || !result.user) {
+                return c.json({ user: null });
+            }
+            const serialized = serializeUser(result.user);
+            return c.json({ user: serialized, expiresAt: result.expiresAt });
+        }
+        catch {
+            return c.json({ user: null });
+        }
+    });
+    if (login?.validateCredentials) {
+        router.post("/login", async (c) => {
+            const body = (await readJsonBody(c));
+            const { email, password, mfaCode } = body;
+            if (!email || !password) {
+                throw new ValidationError("Email and password are required");
+            }
+            const ip = getClientIP(c);
+            if (throttle$) {
+                const status = await throttle$.check(email, ip);
+                if (status.locked) {
+                    throw new RateLimitError(status.retryAfterSeconds, "Too many login attempts, please try again later");
+                }
+            }
+            const user = await login.validateCredentials(email, password);
+            if (!user) {
+                if (throttle$) {
+                    await throttle$.recordFailure(email, ip);
+                }
+                throw new UnauthorizedError("Invalid email or password");
+            }
+            if (mfa?.requireOnLogin) {
+                const enrollment = await mfa.getEnrollment(user.id);
+                if (enrollment?.enabled) {
+                    if (!mfaCode) {
+                        return c.json({ mfaRequired: true }, 401);
+                    }
+                    const ok = await verifyMfaChallenge(enrollment, user.id, mfaCode);
+                    if (!ok) {
+                        if (throttle$) {
+                            await throttle$.recordFailure(email, ip);
+                        }
+                        throw new UnauthorizedError("Invalid MFA code");
+                    }
+                }
+            }
+            const result = await completeLogin(c, user.id);
+            if (!result) {
+                throw new UnauthorizedError("Failed to create session");
+            }
+            if (throttle$) {
+                await throttle$.reset(email, ip);
+            }
+            return c.json(result);
+        });
+    }
+    if (signup?.createUser) {
+        router.post("/signup", async (c) => {
+            const { email, password, name } = (await readJsonBody(c));
+            if (!email || !password) {
+                throw new ValidationError("Email and password are required");
+            }
+            if (signup.validateEmail) {
+                const isValidEmail = await signup.validateEmail(email);
+                if (!isValidEmail) {
+                    throw new ValidationError("Invalid email format");
+                }
+            }
+            if (passwordPolicy) {
+                enforcePasswordStrength(password, passwordPolicy);
+            }
+            if (signup.validatePassword) {
+                const isValidPassword = await signup.validatePassword(password);
+                if (!isValidPassword) {
+                    throw new ValidationError("Password does not meet requirements");
+                }
+            }
+            const user = await signup.createUser({ email, password, name });
+            if (!adapter.createSession) {
+                throw new Error("Adapter does not support session creation");
+            }
+            const session = await adapter.createSession(user.id);
+            setCookie(c, cookieName, session.id, toCookieOptions({
+                ...finalCookieOptions,
+                expires: session.expiresAt,
+            }));
+            await onSignup?.(user, c);
+            return c.json({ user: { id: user.id, email: user.email, name: user.name } });
+        });
+    }
+    router.post("/logout", async (c) => {
+        try {
+            const credentials = adapter.extractCredentials(c);
+            let user = null;
+            if (credentials) {
+                const result = await adapter.validateCredentials(credentials);
+                if (result.success && result.user) {
+                    user = result.user;
+                }
+                const sessionToken = credentials.sessionId ?? credentials.token;
+                if (sessionToken) {
+                    await adapter.invalidateSession(sessionToken);
+                }
+            }
+            deleteCookie(c, cookieName);
+            deleteCookie(c, "connect.sid");
+            deleteCookie(c, "session");
+            await onLogout?.(user, c);
+            return c.json({ success: true });
+        }
+        catch {
+            deleteCookie(c, cookieName);
+            return c.json({ success: true });
+        }
+    });
+    if (verification) {
+        router.post("/verify/request", async (c) => {
+            const { email } = (await readJsonBody(c));
+            if (!email) {
+                throw new ValidationError("Email is required");
+            }
+            const { token, expiresAt } = await issueVerificationToken(verification.store, email, verification.ttlMs ?? 24 * 60 * 60 * 1000, { hash: verification.hashTokens });
+            await verification.sendToken({ identifier: email, token, expiresAt, c });
+            return c.json({ success: true });
+        });
+        router.post("/verify/confirm", async (c) => {
+            const { email, token } = (await readJsonBody(c));
+            if (!email || !token) {
+                throw new ValidationError("Email and token are required");
+            }
+            const valid = await verifyVerificationToken(verification.store, email, token, {
+                hash: verification.hashTokens,
+            });
+            if (!valid) {
+                throw new ValidationError("Invalid or expired token");
+            }
+            await verification.markVerified(email);
+            return c.json({ success: true });
+        });
+    }
+    if (passwordReset) {
+        router.post("/password/forgot", async (c) => {
+            const { email } = (await readJsonBody(c));
+            if (!email) {
+                throw new ValidationError("Email is required");
+            }
+            const exists = passwordReset.findUserByEmail
+                ? (await passwordReset.findUserByEmail(email)) !== null
+                : true;
+            if (exists) {
+                const { token, expiresAt } = await issuePasswordResetToken(email, {
+                    store: passwordReset.store,
+                    ttlMs: passwordReset.ttlMs,
+                    hashTokens: passwordReset.hashTokens,
+                });
+                await passwordReset.sendToken({ identifier: email, token, expiresAt, c });
+            }
+            return c.json({ success: true });
+        });
+        router.post("/password/reset", async (c) => {
+            const { email, token, password } = (await readJsonBody(c));
+            if (!email || !token || !password) {
+                throw new ValidationError("Email, token and password are required");
+            }
+            if (passwordPolicy) {
+                enforcePasswordStrength(password, passwordPolicy);
+            }
+            const valid = await verifyPasswordResetToken(email, token, {
+                store: passwordReset.store,
+                ttlMs: passwordReset.ttlMs,
+                hashTokens: passwordReset.hashTokens,
+            });
+            if (!valid) {
+                throw new ValidationError("Invalid or expired token");
+            }
+            const passwordHash = await hashNewPassword(password);
+            await passwordReset.resetPassword(email, passwordHash);
+            if (passwordReset.logoutEverywhere && passwordReset.findUserByEmail) {
+                const user = await passwordReset.findUserByEmail(email);
+                if (user && adapter.invalidateUserSessions) {
+                    await adapter.invalidateUserSessions(user.id);
+                }
+            }
+            return c.json({ success: true });
+        });
+    }
+    if (mfa) {
+        const requireCurrentUser = async (c) => {
+            const credentials = adapter.extractCredentials(c);
+            if (credentials) {
+                const result = await adapter.validateCredentials(credentials);
+                if (result.success && result.user) {
+                    return result.user;
+                }
+            }
+            throw new UnauthorizedError("Authentication required");
+        };
+        router.post("/mfa/enroll", async (c) => {
+            const user = await requireCurrentUser(c);
+            const secret = generateTotpSecret();
+            const { codes, hashes } = await generateBackupCodes(mfa.backupCodeCount ?? 10);
+            await mfa.saveEnrollment(user.id, {
+                secret,
+                enabled: false,
+                backupCodeHashes: hashes,
+            });
+            await mfa.saveBackupCodeHashes?.(user.id, hashes);
+            const otpauthUri = getTotpUri({
+                secret,
+                account: user.email ?? user.id,
+                issuer: mfa.issuer,
+                digits: mfa.totp?.digits,
+                step: mfa.totp?.step,
+            });
+            return c.json({ secret, otpauthUri, backupCodes: codes });
+        });
+        router.post("/mfa/enroll/confirm", async (c) => {
+            const user = await requireCurrentUser(c);
+            const { code } = (await readJsonBody(c));
+            if (!code) {
+                throw new ValidationError("Code is required");
+            }
+            const enrollment = await mfa.getEnrollment(user.id);
+            if (!enrollment) {
+                throw new ValidationError("No pending MFA enrollment");
+            }
+            if (!verifyTotp(enrollment.secret, code, mfa.totp)) {
+                throw new ValidationError("Invalid MFA code");
+            }
+            await mfa.saveEnrollment(user.id, { ...enrollment, enabled: true });
+            return c.json({ success: true, enabled: true });
+        });
+        router.post("/mfa/verify", async (c) => {
+            const { email, code } = (await readJsonBody(c));
+            if (!email || !code) {
+                throw new ValidationError("Email and code are required");
+            }
+            const found = await mfa.getUserByEmail(email);
+            const enrollment = found
+                ? found.mfa ?? (await mfa.getEnrollment(found.id))
+                : null;
+            if (!found || !enrollment?.enabled) {
+                throw new UnauthorizedError("Invalid MFA code");
+            }
+            const ok = await verifyMfaChallenge(enrollment, found.id, code);
+            if (!ok) {
+                throw new UnauthorizedError("Invalid MFA code");
+            }
+            const result = await completeLogin(c, found.id);
+            if (!result) {
+                throw new UnauthorizedError("Failed to create session");
+            }
+            return c.json(result);
+        });
+    }
+    if (magicLink) {
+        router.post("/magic-link/request", async (c) => {
+            const { email } = (await readJsonBody(c));
+            if (!email) {
+                throw new ValidationError("Email is required");
+            }
+            const user = await magicLink.findUserByEmail(email);
+            if (user) {
+                const { token, expiresAt } = await issueMagicLinkToken(email, {
+                    store: magicLink.store,
+                    ttlMs: magicLink.ttlMs,
+                    hashTokens: magicLink.hashTokens,
+                });
+                await magicLink.sendLink({ identifier: email, token, expiresAt, c });
+            }
+            return c.json({ success: true });
+        });
+        router.post("/magic-link/verify", async (c) => {
+            const { email, token } = (await readJsonBody(c));
+            if (!email || !token) {
+                throw new ValidationError("Email and token are required");
+            }
+            const valid = await consumeMagicLinkToken(email, token, {
+                store: magicLink.store,
+                hashTokens: magicLink.hashTokens,
+            });
+            if (!valid) {
+                throw new UnauthorizedError("Invalid or expired token");
+            }
+            const user = await magicLink.findUserByEmail(email);
+            if (!user) {
+                throw new UnauthorizedError("Invalid or expired token");
+            }
+            const result = await completeLogin(c, user.id);
+            if (!result) {
+                throw new UnauthorizedError("Failed to create session");
+            }
+            return c.json(result);
+        });
+    }
+    return { router, middleware };
+};
+export const createAuthRoutes = useAuth;
+//# sourceMappingURL=routes.js.map

package/dist/auth/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../src/auth/routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAwC,MAAM,MAAM,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAGjE,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEtF,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,aAAa,EAA6B,MAAM,kBAAkB,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAoB,MAAM,QAAQ,CAAC;AAChF,OAAO,EAEL,UAAU,IAAI,sBAAsB,EACpC,WAAW,IAAI,uBAAuB,GACvC,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,kBAAkB,EAClB,UAAU,EACV,UAAU,EACV,mBAAmB,EACnB,gBAAgB,GAEjB,MAAM,QAAQ,CAAC;AAChB,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAC1E,OAAO,EACL,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAoG3B,MAAM,oBAAoB,GAAG;IAC3B,QAAQ,EAAE,IAAI;IACd,QAAQ,EAAE,KAAc;IACxB,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;IAC/B,IAAI,EAAE,GAAG;CACV,CAAC;AAEF,MAAM,oBAAoB,GAAG,CAAC,IAAiB,EAA2B,EAAE,CAAC,CAAC;IAC5E,EAAE,EAAE,IAAI,CAAC,EAAE;IACX,KAAK,EAAE,IAAI,CAAC,KAAK;IACjB,IAAI,EAAE,IAAI,CAAC,IAAI;IACf,KAAK,EAAE,IAAI,CAAC,KAAK;CAClB,CAAC,CAAC;AAQH,MAAM,eAAe,GAAG,CACtB,OAA6D,EAC9C,EAAE,CAAC,CAAC;IACnB,QAAQ,EAAE,OAAO,EAAE,QAAQ;IAC3B,MAAM,EAAE,OAAO,EAAE,MAAM;IACvB,QAAQ,EAAE,OAAO,EAAE,QAAQ;IAC3B,IAAI,EAAE,OAAO,EAAE,IAAI;IACnB,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;IACrF,OAAO,EAAE,OAAO,EAAE,OAAO;CAC1B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,OAAuB,EAAoB,EAAE;IACnE,MAAM,EACJ,OAAO,EACP,UAAU,GAAG,SAAS,EACtB,aAAa,GAAG,EAAE,EAClB,KAAK,EACL,MAAM,EACN,aAAa,GAAG,oBAAoB,EACpC,OAAO,EACP,QAAQ,EACR,QAAQ,EACR,IAAI,EACJ,QAAQ,EACR,YAAY,EACZ,aAAa,EACb,cAAc,EACd,GAAG,EACH,SAAS,GACV,GAAG,OAAO,CAAC;IAEZ,MAAM,kBAAkB,GAAG;QACzB,GAAG,oBAAoB;QACvB,MAAM,EAAE,YAAY,EAAE;QACtB,GAAG,aAAa;KACjB,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;IAE1B,MAAM,WAAW,GAAuB,IAAI;QAC1C,CAAC,CAAC,OAAO,IAAI,KAAK,QAAQ;YACxB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,EAAE;QACN,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,cAAc,GAAG,WAAW,CAAC,CAAC,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9E,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAClC,CAAC;IAED,MAAM,SAAS,GAAG,QAAQ;QACxB,CAAC,CAAC,IAAI,aAAa,CAAC,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,CAAC,CAAC,IAAI,CAAC;IAET,MAAM,aAAa,GAAG,KAAK,EACzB,CAAU,EACV,MAAc,EACwD,EAAE;QACxE,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,cAAc,GAAG,SAAS,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;QAChD,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,OAAO,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QACpD,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC;YACnD,IAAI,EAAE,SAAS;YACf,SAAS,EAAE,OAAO,CAAC,EAAE;SACtB,CAAC,CAAC;QAEH,IAAI,CAAC,UAAU,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,SAAS,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE,eAAe,CAAC;YACnD,GAAG,kBAAkB;YACrB,OAAO,EAAE,OAAO,CAAC,SAAS;SAC3B,CAAC,CAAC,CAAC;QAEJ,IAAI,WAAW,EAAE,CAAC;YAChB,cAAc,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;QACjC,CAAC;QAED,MAAM,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAEpC,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;IACzE,CAAC,CAAC;IAEF,MAAM,kBAAkB,GAAG,KAAK,EAC9B,UAAyB,EACzB,MAAc,EACd,IAAY,EACM,EAAE;QACpB,IAAI,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC;QACvB,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAClD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,UAAU,CAAC,gBAAgB,IAAI,EAAE,CAAC;QACjD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACtC,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,GAAG,CAAC,iBAAiB,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;YACpD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,MAAM,UAAU,GAAsB,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACtD,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;YAClD,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC;YAC9D,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACpC,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YAED,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YAC3B,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5B,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;YAClD,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAChC,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC;YAC9D,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACpC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAChC,CAAC;YAED,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC9C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAChC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,KAAK,EAAE,mBAAmB,EAAE,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAChC,MAAM,IAAI,GAAG,CAAC,MAAM,YAAY,CAAC,CAAC,CAAC,CAAqC,CAAC;YACzE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;YAE1C,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACxB,MAAM,IAAI,eAAe,CAAC,iCAAiC,CAAC,CAAC;YAC/D,CAAC;YAED,MAAM,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;YAE1B,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBAChD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;oBAClB,MAAM,IAAI,cAAc,CACtB,MAAM,CAAC,iBAAiB,EACxB,iDAAiD,CAClD,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,mBAAmB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YAC9D,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,IAAI,SAAS,EAAE,CAAC;oBACd,MAAM,SAAS,CAAC,aAAa,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBAC3C,CAAC;gBACD,MAAM,IAAI,iBAAiB,CAAC,2BAA2B,CAAC,CAAC;YAC3D,CAAC;YAED,IAAI,GAAG,EAAE,cAAc,EAAE,CAAC;gBACxB,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACpD,IAAI,UAAU,EAAE,OAAO,EAAE,CAAC;oBACxB,IAAI,CAAC,OAAO,EAAE,CAAC;wBACb,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;oBAC5C,CAAC;oBACD,MAAM,EAAE,GAAG,MAAM,kBAAkB,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;oBAClE,IAAI,CAAC,EAAE,EAAE,CAAC;wBACR,IAAI,SAAS,EAAE,CAAC;4BACd,MAAM,SAAS,CAAC,aAAa,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;wBAC3C,CAAC;wBACD,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,CAAC,CAAC;oBAClD,CAAC;gBACH,CAAC;YACH,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,iBAAiB,CAAC,0BAA0B,CAAC,CAAC;YAC1D,CAAC;YAED,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACnC,CAAC;YAED,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,MAAM,EAAE,UAAU,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YACjC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,YAAY,CAAC,CAAC,CAAC,CAAc,CAAC;YAEvE,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACxB,MAAM,IAAI,eAAe,CAAC,iCAAiC,CAAC,CAAC;YAC/D,CAAC;YAED,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;gBACzB,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;gBACvD,IAAI,CAAC,YAAY,EAAE,CAAC;oBAClB,MAAM,IAAI,eAAe,CAAC,sBAAsB,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC;YAED,IAAI,cAAc,EAAE,CAAC;gBACnB,uBAAuB,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;YACpD,CAAC;YAED,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;gBAC5B,MAAM,eAAe,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;gBAChE,IAAI,CAAC,eAAe,EAAE,CAAC;oBACrB,MAAM,IAAI,eAAe,CAAC,qCAAqC,CAAC,CAAC;gBACnE,CAAC;YACH,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YAEhE,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;YAC/D,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAErD,SAAS,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE,eAAe,CAAC;gBACnD,GAAG,kBAAkB;gBACrB,OAAO,EAAE,OAAO,CAAC,SAAS;aAC3B,CAAC,CAAC,CAAC;YAEJ,MAAM,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAE1B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC/E,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjC,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;YAClD,IAAI,IAAI,GAAuB,IAAI,CAAC;YAEpC,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC;gBAC9D,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;oBAClC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;gBACrB,CAAC;gBAED,MAAM,YAAY,GAAG,WAAW,CAAC,SAAS,IAAI,WAAW,CAAC,KAAK,CAAC;gBAChE,IAAI,YAAY,EAAE,CAAC;oBACjB,MAAM,OAAO,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;gBAChD,CAAC;YACH,CAAC;YAED,YAAY,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;YAC5B,YAAY,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;YAC/B,YAAY,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;YAE3B,MAAM,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAE1B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,YAAY,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;YAC5B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACnC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YACzC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,YAAY,CAAC,CAAC,CAAC,CAAc,CAAC;YACvD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,eAAe,CAAC,mBAAmB,CAAC,CAAC;YACjD,CAAC;YAED,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,sBAAsB,CACvD,YAAY,CAAC,KAAK,EAClB,KAAK,EACL,YAAY,CAAC,KAAK,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EACzC,EAAE,IAAI,EAAE,YAAY,CAAC,UAAU,EAAE,CAClC,CAAC;YAEF,MAAM,YAAY,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;YAEzE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YACzC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,YAAY,CAAC,CAAC,CAAC,CAAmC,CAAC;YACnF,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;gBACrB,MAAM,IAAI,eAAe,CAAC,8BAA8B,CAAC,CAAC;YAC5D,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,uBAAuB,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE;gBAC5E,IAAI,EAAE,YAAY,CAAC,UAAU;aAC9B,CAAC,CAAC;YAEH,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,eAAe,CAAC,0BAA0B,CAAC,CAAC;YACxD,CAAC;YAED,MAAM,YAAY,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;YAEvC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAC1C,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,YAAY,CAAC,CAAC,CAAC,CAAc,CAAC;YACvD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,eAAe,CAAC,mBAAmB,CAAC,CAAC;YACjD,CAAC;YAED,MAAM,MAAM,GAAG,aAAa,CAAC,eAAe;gBAC1C,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI;gBACvD,CAAC,CAAC,IAAI,CAAC;YAET,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,uBAAuB,CAAC,KAAK,EAAE;oBAChE,KAAK,EAAE,aAAa,CAAC,KAAK;oBAC1B,KAAK,EAAE,aAAa,CAAC,KAAK;oBAC1B,UAAU,EAAE,aAAa,CAAC,UAAU;iBACrC,CAAC,CAAC;gBACH,MAAM,aAAa,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;YAC5E,CAAC;YAED,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YACzC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,YAAY,CAAC,CAAC,CAAC,CAExD,CAAC;YACF,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAClC,MAAM,IAAI,eAAe,CAAC,wCAAwC,CAAC,CAAC;YACtE,CAAC;YAED,IAAI,cAAc,EAAE,CAAC;gBACnB,uBAAuB,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;YACpD,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,wBAAwB,CAAC,KAAK,EAAE,KAAK,EAAE;gBACzD,KAAK,EAAE,aAAa,CAAC,KAAK;gBAC1B,KAAK,EAAE,aAAa,CAAC,KAAK;gBAC1B,UAAU,EAAE,aAAa,CAAC,UAAU;aACrC,CAAC,CAAC;YAEH,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,eAAe,CAAC,0BAA0B,CAAC,CAAC;YACxD,CAAC;YAED,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;YACrD,MAAM,aAAa,CAAC,aAAa,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;YAEvD,IAAI,aAAa,CAAC,gBAAgB,IAAI,aAAa,CAAC,eAAe,EAAE,CAAC;gBACpE,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;gBACxD,IAAI,IAAI,IAAI,OAAO,CAAC,sBAAsB,EAAE,CAAC;oBAC3C,MAAM,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAChD,CAAC;YACH,CAAC;YAED,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,kBAAkB,GAAG,KAAK,EAAE,CAAU,EAAwB,EAAE;YACpE,MAAM,WAAW,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;YAClD,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC;gBAC9D,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;oBAClC,OAAO,MAAM,CAAC,IAAI,CAAC;gBACrB,CAAC;YACH,CAAC;YACD,MAAM,IAAI,iBAAiB,CAAC,yBAAyB,CAAC,CAAC;QACzD,CAAC,CAAC;QAEF,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YACrC,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,CAAC,CAAC,CAAC;YACzC,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;YACpC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;YAE/E,MAAM,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE;gBAChC,MAAM;gBACN,OAAO,EAAE,KAAK;gBACd,gBAAgB,EAAE,MAAM;aACzB,CAAC,CAAC;YACH,MAAM,GAAG,CAAC,oBAAoB,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAElD,MAAM,UAAU,GAAG,UAAU,CAAC;gBAC5B,MAAM;gBACN,OAAO,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,EAAE;gBAC9B,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM;gBACxB,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI;aACrB,CAAC,CAAC;YAEH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAC7C,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,CAAC,CAAC,CAAC;YACzC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,YAAY,CAAC,CAAC,CAAC,CAAsB,CAAC;YAC9D,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAAC;YAChD,CAAC;YAED,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACpD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,eAAe,CAAC,2BAA2B,CAAC,CAAC;YACzD,CAAC;YAED,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnD,MAAM,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAAC;YAChD,CAAC;YAED,MAAM,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YAEpE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YACrC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,YAAY,CAAC,CAAC,CAAC,CAG7C,CAAC;YACF,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;gBACpB,MAAM,IAAI,eAAe,CAAC,6BAA6B,CAAC,CAAC;YAC3D,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YAC9C,MAAM,UAAU,GAAG,KAAK;gBACtB,CAAC,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBAClD,CAAC,CAAC,IAAI,CAAC;YAET,IAAI,CAAC,KAAK,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC;gBACnC,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,CAAC,CAAC;YAClD,CAAC;YAED,MAAM,EAAE,GAAG,MAAM,kBAAkB,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YAChE,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,CAAC,CAAC;YAClD,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;YAChD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,iBAAiB,CAAC,0BAA0B,CAAC,CAAC;YAC1D,CAAC;YAED,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAC7C,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,YAAY,CAAC,CAAC,CAAC,CAAc,CAAC;YACvD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,eAAe,CAAC,mBAAmB,CAAC,CAAC;YACjD,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YACpD,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,mBAAmB,CAAC,KAAK,EAAE;oBAC5D,KAAK,EAAE,SAAS,CAAC,KAAK;oBACtB,KAAK,EAAE,SAAS,CAAC,KAAK;oBACtB,UAAU,EAAE,SAAS,CAAC,UAAU;iBACjC,CAAC,CAAC;gBACH,MAAM,SAAS,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;YACvE,CAAC;YAED,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAC5C,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,YAAY,CAAC,CAAC,CAAC,CAE9C,CAAC;YACF,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;gBACrB,MAAM,IAAI,eAAe,CAAC,8BAA8B,CAAC,CAAC;YAC5D,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,KAAK,EAAE,KAAK,EAAE;gBACtD,KAAK,EAAE,SAAS,CAAC,KAAK;gBACtB,UAAU,EAAE,SAAS,CAAC,UAAU;aACjC,CAAC,CAAC;YACH,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,iBAAiB,CAAC,0BAA0B,CAAC,CAAC;YAC1D,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YACpD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,iBAAiB,CAAC,0BAA0B,CAAC,CAAC;YAC1D,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,iBAAiB,CAAC,0BAA0B,CAAC,CAAC;YAC1D,CAAC;YAED,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAChC,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAC"}

package/dist/auth/rsql.d.ts

@@ -0,0 +1,33 @@
+import { CompiledScope } from "../resource/types.js";
+declare class ScopeExpression implements CompiledScope {
+    private expression;
+    constructor(expression: string);
+    toString(): string;
+    isEmpty(): boolean;
+    and(other: CompiledScope): CompiledScope;
+    or(other: CompiledScope): CompiledScope;
+}
+export declare const emptyScope: () => CompiledScope;
+export declare const allScope: () => CompiledScope;
+export declare function rsql(strings: TemplateStringsArray, ...values: unknown[]): CompiledScope;
+export declare const eq: (field: string, value: unknown) => CompiledScope;
+export declare const ne: (field: string, value: unknown) => CompiledScope;
+export declare const gt: (field: string, value: unknown) => CompiledScope;
+export declare const gte: (field: string, value: unknown) => CompiledScope;
+export declare const lt: (field: string, value: unknown) => CompiledScope;
+export declare const lte: (field: string, value: unknown) => CompiledScope;
+export declare const inList: (field: string, values: unknown[]) => CompiledScope;
+export declare const notIn: (field: string, values: unknown[]) => CompiledScope;
+export declare const like: (field: string, pattern: string) => CompiledScope;
+export declare const notLike: (field: string, pattern: string) => CompiledScope;
+export declare const isNull: (field: string) => CompiledScope;
+export declare const isNotNull: (field: string) => CompiledScope;
+export declare const and: (...scopes: CompiledScope[]) => CompiledScope;
+export declare const or: (...scopes: CompiledScope[]) => CompiledScope;
+export declare const ownerScope: (userId: string, ownerField?: string) => CompiledScope;
+export declare const publicScope: (publicField?: string) => CompiledScope;
+export declare const ownerOrPublic: (userId: string, ownerField?: string, publicField?: string) => CompiledScope;
+export declare const isCompiledScope: (value: unknown) => value is CompiledScope;
+export declare const scopeFromString: (expression: string) => CompiledScope;
+export { ScopeExpression };
+//# sourceMappingURL=rsql.d.ts.map

package/dist/auth/rsql.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsql.d.ts","sourceRoot":"","sources":["../../src/auth/rsql.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AA+BjD,cAAM,eAAgB,YAAW,aAAa;IAChC,OAAO,CAAC,UAAU;gBAAV,UAAU,EAAE,MAAM;IAEtC,QAAQ,IAAI,MAAM;IAIlB,OAAO,IAAI,OAAO;IAIlB,GAAG,CAAC,KAAK,EAAE,aAAa,GAAG,aAAa;IAMxC,EAAE,CAAC,KAAK,EAAE,aAAa,GAAG,aAAa;CAKxC;AAED,eAAO,MAAM,UAAU,QAAO,aAAwC,CAAC;AAEvE,eAAO,MAAM,QAAQ,QAAO,aAAyC,CAAC;AAEtE,wBAAgB,IAAI,CAClB,OAAO,EAAE,oBAAoB,EAC7B,GAAG,MAAM,EAAE,OAAO,EAAE,GACnB,aAAa,CAWf;AAED,eAAO,MAAM,EAAE,GAAI,OAAO,MAAM,EAAE,OAAO,OAAO,KAAG,aACK,CAAC;AAEzD,eAAO,MAAM,EAAE,GAAI,OAAO,MAAM,EAAE,OAAO,OAAO,KAAG,aACK,CAAC;AAEzD,eAAO,MAAM,EAAE,GAAI,OAAO,MAAM,EAAE,OAAO,OAAO,KAAG,aACO,CAAC;AAE3D,eAAO,MAAM,GAAG,GAAI,OAAO,MAAM,EAAE,OAAO,OAAO,KAAG,aACM,CAAC;AAE3D,eAAO,MAAM,EAAE,GAAI,OAAO,MAAM,EAAE,OAAO,OAAO,KAAG,aACO,CAAC;AAE3D,eAAO,MAAM,GAAG,GAAI,OAAO,MAAM,EAAE,OAAO,OAAO,KAAG,aACM,CAAC;AAE3D,eAAO,MAAM,MAAM,GAAI,OAAO,MAAM,EAAE,QAAQ,OAAO,EAAE,KAAG,aACC,CAAC;AAE5D,eAAO,MAAM,KAAK,GAAI,OAAO,MAAM,EAAE,QAAQ,OAAO,EAAE,KAAG,aACG,CAAC;AAE7D,eAAO,MAAM,IAAI,GAAI,OAAO,MAAM,EAAE,SAAS,MAAM,KAAG,aACI,CAAC;AAE3D,eAAO,MAAM,OAAO,GAAI,OAAO,MAAM,EAAE,SAAS,MAAM,KAAG,aACE,CAAC;AAE5D,eAAO,MAAM,MAAM,GAAI,OAAO,MAAM,KAAG,aACM,CAAC;AAE9C,eAAO,MAAM,SAAS,GAAI,OAAO,MAAM,KAAG,aACI,CAAC;AAE/C,eAAO,MAAM,GAAG,GAAI,GAAG,QAAQ,aAAa,EAAE,KAAG,aAQhD,CAAC;AAEF,eAAO,MAAM,EAAE,GAAI,GAAG,QAAQ,aAAa,EAAE,KAAG,aAQ/C,CAAC;AAEF,eAAO,MAAM,UAAU,GAAI,QAAQ,MAAM,EAAE,mBAAqB,KAAG,aAC3C,CAAC;AAEzB,eAAO,MAAM,WAAW,GAAI,oBAAsB,KAAG,aAC9B,CAAC;AAExB,eAAO,MAAM,aAAa,GACxB,QAAQ,MAAM,EACd,mBAAqB,EACrB,oBAAsB,KACrB,aAC2D,CAAC;AAE/D,eAAO,MAAM,eAAe,GAAI,OAAO,OAAO,KAAG,KAAK,IAAI,aASzD,CAAC;AAEF,eAAO,MAAM,eAAe,GAAI,YAAY,MAAM,KAAG,aACpB,CAAC;AAElC,OAAO,EAAE,eAAe,EAAE,CAAC"}

package/dist/auth/rsql.js

@@ -0,0 +1,102 @@
+const escapeValue = (value) => {
+    if (value === null || value === undefined) {
+        return "null";
+    }
+    if (typeof value === "number") {
+        return String(value);
+    }
+    if (typeof value === "boolean") {
+        return String(value);
+    }
+    if (value instanceof Date) {
+        return `"${value.toISOString()}"`;
+    }
+    if (Array.isArray(value)) {
+        return `(${value.map(escapeValue).join(",")})`;
+    }
+    const str = String(value);
+    const escaped = str
+        .replace(/\\/g, "\\\\")
+        .replace(/"/g, '\\"')
+        .replace(/'/g, "\\'");
+    return `"${escaped}"`;
+};
+class ScopeExpression {
+    constructor(expression) {
+        this.expression = expression;
+    }
+    toString() {
+        return this.expression;
+    }
+    isEmpty() {
+        return this.expression.trim() === "";
+    }
+    and(other) {
+        if (this.isEmpty())
+            return other;
+        if (other.isEmpty())
+            return this;
+        return new ScopeExpression(`(${this.expression});(${other.toString()})`);
+    }
+    or(other) {
+        if (this.isEmpty())
+            return other;
+        if (other.isEmpty())
+            return this;
+        return new ScopeExpression(`(${this.expression}),(${other.toString()})`);
+    }
+}
+export const emptyScope = () => new ScopeExpression("");
+export const allScope = () => new ScopeExpression("*");
+export function rsql(strings, ...values) {
+    let result = "";
+    for (let i = 0; i < strings.length; i++) {
+        result += strings[i];
+        if (i < values.length) {
+            result += escapeValue(values[i]);
+        }
+    }
+    return new ScopeExpression(result.trim());
+}
+export const eq = (field, value) => new ScopeExpression(`${field}==${escapeValue(value)}`);
+export const ne = (field, value) => new ScopeExpression(`${field}!=${escapeValue(value)}`);
+export const gt = (field, value) => new ScopeExpression(`${field}=gt=${escapeValue(value)}`);
+export const gte = (field, value) => new ScopeExpression(`${field}=ge=${escapeValue(value)}`);
+export const lt = (field, value) => new ScopeExpression(`${field}=lt=${escapeValue(value)}`);
+export const lte = (field, value) => new ScopeExpression(`${field}=le=${escapeValue(value)}`);
+export const inList = (field, values) => new ScopeExpression(`${field}=in=${escapeValue(values)}`);
+export const notIn = (field, values) => new ScopeExpression(`${field}=out=${escapeValue(values)}`);
+export const like = (field, pattern) => new ScopeExpression(`${field}%=${escapeValue(pattern)}`);
+export const notLike = (field, pattern) => new ScopeExpression(`${field}!%=${escapeValue(pattern)}`);
+export const isNull = (field) => new ScopeExpression(`${field}=isnull=true`);
+export const isNotNull = (field) => new ScopeExpression(`${field}=isnull=false`);
+export const and = (...scopes) => {
+    const nonEmpty = scopes.filter((s) => !s.isEmpty());
+    if (nonEmpty.length === 0)
+        return emptyScope();
+    if (nonEmpty.length === 1)
+        return nonEmpty[0];
+    return new ScopeExpression(nonEmpty.map((s) => `(${s.toString()})`).join(";"));
+};
+export const or = (...scopes) => {
+    const nonEmpty = scopes.filter((s) => !s.isEmpty());
+    if (nonEmpty.length === 0)
+        return emptyScope();
+    if (nonEmpty.length === 1)
+        return nonEmpty[0];
+    return new ScopeExpression(nonEmpty.map((s) => `(${s.toString()})`).join(","));
+};
+export const ownerScope = (userId, ownerField = "userId") => eq(ownerField, userId);
+export const publicScope = (publicField = "public") => eq(publicField, true);
+export const ownerOrPublic = (userId, ownerField = "userId", publicField = "public") => or(ownerScope(userId, ownerField), publicScope(publicField));
+export const isCompiledScope = (value) => {
+    return (typeof value === "object" &&
+        value !== null &&
+        "toString" in value &&
+        "isEmpty" in value &&
+        "and" in value &&
+        "or" in value);
+};
+export const scopeFromString = (expression) => new ScopeExpression(expression);
+export { ScopeExpression };
+//# sourceMappingURL=rsql.js.map

package/dist/auth/rsql.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsql.js","sourceRoot":"","sources":["../../src/auth/rsql.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,GAAG,CAAC,KAAc,EAAU,EAAE;IAC7C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAED,IAAI,KAAK,YAAY,IAAI,EAAE,CAAC;QAC1B,OAAO,IAAI,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC;IACpC,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACjD,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1B,MAAM,OAAO,GAAG,GAAG;SAChB,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;SACpB,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACxB,OAAO,IAAI,OAAO,GAAG,CAAC;AACxB,CAAC,CAAC;AAEF,MAAM,eAAe;IACnB,YAAoB,UAAkB;QAAlB,eAAU,GAAV,UAAU,CAAQ;IAAG,CAAC;IAE1C,QAAQ;QACN,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;IACvC,CAAC;IAED,GAAG,CAAC,KAAoB;QACtB,IAAI,IAAI,CAAC,OAAO,EAAE;YAAE,OAAO,KAAK,CAAC;QACjC,IAAI,KAAK,CAAC,OAAO,EAAE;YAAE,OAAO,IAAI,CAAC;QACjC,OAAO,IAAI,eAAe,CAAC,IAAI,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC3E,CAAC;IAED,EAAE,CAAC,KAAoB;QACrB,IAAI,IAAI,CAAC,OAAO,EAAE;YAAE,OAAO,KAAK,CAAC;QACjC,IAAI,KAAK,CAAC,OAAO,EAAE;YAAE,OAAO,IAAI,CAAC;QACjC,OAAO,IAAI,eAAe,CAAC,IAAI,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC3E,CAAC;CACF;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,GAAkB,EAAE,CAAC,IAAI,eAAe,CAAC,EAAE,CAAC,CAAC;AAEvE,MAAM,CAAC,MAAM,QAAQ,GAAG,GAAkB,EAAE,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC;AAEtE,MAAM,UAAU,IAAI,CAClB,OAA6B,EAC7B,GAAG,MAAiB;IAEpB,IAAI,MAAM,GAAG,EAAE,CAAC;IAEhB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAED,OAAO,IAAI,eAAe,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,KAAa,EAAE,KAAc,EAAiB,EAAE,CACjE,IAAI,eAAe,CAAC,GAAG,KAAK,KAAK,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAEzD,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,KAAa,EAAE,KAAc,EAAiB,EAAE,CACjE,IAAI,eAAe,CAAC,GAAG,KAAK,KAAK,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAEzD,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,KAAa,EAAE,KAAc,EAAiB,EAAE,CACjE,IAAI,eAAe,CAAC,GAAG,KAAK,OAAO,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAE3D,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,KAAc,EAAiB,EAAE,CAClE,IAAI,eAAe,CAAC,GAAG,KAAK,OAAO,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAE3D,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,KAAa,EAAE,KAAc,EAAiB,EAAE,CACjE,IAAI,eAAe,CAAC,GAAG,KAAK,OAAO,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAE3D,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,KAAc,EAAiB,EAAE,CAClE,IAAI,eAAe,CAAC,GAAG,KAAK,OAAO,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAE3D,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,MAAiB,EAAiB,EAAE,CACxE,IAAI,eAAe,CAAC,GAAG,KAAK,OAAO,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAE5D,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,MAAiB,EAAiB,EAAE,CACvE,IAAI,eAAe,CAAC,GAAG,KAAK,QAAQ,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAE7D,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,OAAe,EAAiB,EAAE,CACpE,IAAI,eAAe,CAAC,GAAG,KAAK,KAAK,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAE3D,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,OAAe,EAAiB,EAAE,CACvE,IAAI,eAAe,CAAC,GAAG,KAAK,MAAM,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAE5D,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,KAAa,EAAiB,EAAE,CACrD,IAAI,eAAe,CAAC,GAAG,KAAK,cAAc,CAAC,CAAC;AAE9C,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,KAAa,EAAiB,EAAE,CACxD,IAAI,eAAe,CAAC,GAAG,KAAK,eAAe,CAAC,CAAC;AAE/C,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,GAAG,MAAuB,EAAiB,EAAE;IAC/D,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IACpD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,UAAU,EAAE,CAAC;IAC/C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC;IAE9C,OAAO,IAAI,eAAe,CACxB,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CACnD,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAuB,EAAiB,EAAE;IAC9D,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IACpD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,UAAU,EAAE,CAAC;IAC/C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC;IAE9C,OAAO,IAAI,eAAe,CACxB,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CACnD,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,MAAc,EAAE,UAAU,GAAG,QAAQ,EAAiB,EAAE,CACjF,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;AAEzB,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,WAAW,GAAG,QAAQ,EAAiB,EAAE,CACnE,EAAE,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;AAExB,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,MAAc,EACd,UAAU,GAAG,QAAQ,EACrB,WAAW,GAAG,QAAQ,EACP,EAAE,CACjB,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;AAE/D,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAc,EAA0B,EAAE;IACxE,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,UAAU,IAAI,KAAK;QACnB,SAAS,IAAI,KAAK;QAClB,KAAK,IAAI,KAAK;QACd,IAAI,IAAI,KAAK,CACd,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,UAAkB,EAAiB,EAAE,CACnE,IAAI,eAAe,CAAC,UAAU,CAAC,CAAC;AAElC,OAAO,EAAE,eAAe,EAAE,CAAC"}

package/dist/auth/scope.d.ts

@@ -0,0 +1,26 @@
+import { ScopeConfig, CompiledScope, UserContext } from "../resource/types.js";
+export type Operation = "read" | "create" | "update" | "delete" | "subscribe";
+export declare class ScopeResolver {
+    private config;
+    private resourceName;
+    constructor(config: ScopeConfig, resourceName: string);
+    isPublic(operation: Operation): boolean;
+    private getScopeFunction;
+    resolve(operation: Operation, user: UserContext | null): Promise<CompiledScope>;
+    canPerform(operation: Operation, user: UserContext | null): Promise<boolean>;
+    requirePermission(operation: Operation, user: UserContext | null): Promise<CompiledScope>;
+}
+export declare const createScopeResolver: (config: ScopeConfig | undefined, resourceName: string) => ScopeResolver;
+export declare const combineScopes: (userScope: CompiledScope, additionalFilter?: string) => string;
+export declare const checkObjectAccess: (resolver: ScopeResolver, operation: Operation, user: UserContext | null, object: Record<string, unknown>, filterCompile: (expr: string) => {
+    execute: (obj: unknown) => boolean;
+}) => Promise<boolean>;
+export declare const scopePatterns: {
+    ownerOnly: (ownerField?: string) => ScopeConfig;
+    publicReadOwnerWrite: (ownerField?: string) => ScopeConfig;
+    ownerOrAdmin: (ownerField: string | undefined, isAdmin: (user: UserContext) => boolean) => ScopeConfig;
+    orgBased: (orgField?: string) => ScopeConfig;
+    authenticatedFullAccess: () => ScopeConfig;
+    fullyPublic: () => ScopeConfig;
+};
+//# sourceMappingURL=scope.d.ts.map

package/dist/auth/scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../../src/auth/scope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAiB,aAAa,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAI1F,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,CAAC;AAE9E,qBAAa,aAAa;IAEtB,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,YAAY;gBADZ,MAAM,EAAE,WAAW,EACnB,YAAY,EAAE,MAAM;IAG9B,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO;IAkBvC,OAAO,CAAC,gBAAgB;IAelB,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC;IAoB/E,UAAU,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IAS5E,iBAAiB,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC;CAWhG;AAED,eAAO,MAAM,mBAAmB,GAC9B,QAAQ,WAAW,GAAG,SAAS,EAC/B,cAAc,MAAM,KACnB,aAEF,CAAC;AAEF,eAAO,MAAM,aAAa,GACxB,WAAW,aAAa,EACxB,mBAAmB,MAAM,KACxB,MAeF,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAC5B,UAAU,aAAa,EACvB,WAAW,SAAS,EACpB,MAAM,WAAW,GAAG,IAAI,EACxB,QAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,eAAe,CAAC,IAAI,EAAE,MAAM,KAAK;IAAE,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAA;CAAE,KACtE,OAAO,CAAC,OAAO,CAiBjB,CAAC;AAEF,eAAO,MAAM,aAAa;wCACY,WAAW;mDAOA,WAAW;4DAkB/C,CAAC,IAAI,EAAE,WAAW,KAAK,OAAO,KACtC,WAAW;qCAU2B,WAAW;mCAYvB,WAAW;uBAOvB,WAAW;CAkB7B,CAAC"}