easywork-common-lib 1.0.1022 → 1.0.1024

package/dist/modules/authorization/services/resource-access-filter.service.js

@@ -0,0 +1,406 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ResourceAccessFilterService = void 0;
+const common_1 = require("@nestjs/common");
+let ResourceAccessFilterService = class ResourceAccessFilterService {
+    applyFilters(queryBuilder, context) {
+        const filters = this.buildWhereConditions(context);
+        if (!filters || Object.keys(filters).length === 0) {
+            return queryBuilder;
+        }
+        return this.applyConditionsToQueryBuilder(queryBuilder, filters);
+    }
+    applyConditionsToQueryBuilder(queryBuilder, filters) {
+        Object.entries(filters).forEach(([field, condition]) => {
+            this.applyCondition(queryBuilder, field, condition);
+        });
+        return queryBuilder;
+    }
+    buildWhereConditions(context) {
+        const filters = context.additionalContext?.permissionFilters;
+        if (!filters || Object.keys(filters).length === 0) {
+            return {};
+        }
+        return filters;
+    }
+    applyCondition(queryBuilder, field, condition) {
+        const alias = queryBuilder.alias;
+        if (field === "or" && Array.isArray(condition)) {
+            this.applyOrConditions(queryBuilder, condition);
+            return;
+        }
+        if (field === "and" && Array.isArray(condition)) {
+            this.applyAndConditions(queryBuilder, condition);
+            return;
+        }
+        if (alias === "task" && this.isTaskRelationField(field)) {
+            this.applyTaskRelationCondition(queryBuilder, field, condition);
+            return;
+        }
+        if (typeof condition === "object" && condition !== null) {
+            this.applyObjectCondition(queryBuilder, alias, field, condition);
+        }
+        else {
+            queryBuilder.andWhere(`${alias}.${field} = :${field}`, {
+                [field]: condition,
+            });
+        }
+    }
+    applyOrConditions(queryBuilder, conditions) {
+        if (conditions.length === 0)
+            return;
+        const orConditions = conditions
+            .map((condition, index) => {
+            const subConditions = [];
+            const parameters = {};
+            Object.entries(condition).forEach(([field, value]) => {
+                const paramName = `or_${index}_${field}`;
+                if (queryBuilder.alias === "task" &&
+                    this.isTaskRelationField(field)) {
+                    if (typeof value === "object" &&
+                        value !== null &&
+                        value.contains) {
+                        const tableName = this.getTaskRelationTableName(field);
+                        const containsValue = value.contains;
+                        containsValue.forEach((item, itemIndex) => {
+                            const itemParamName = `${paramName}_contains_${itemIndex}`;
+                            const relationCondition = `EXISTS (
+                  SELECT 1 FROM ${tableName} tr 
+                  WHERE tr."taskId" = task.id AND tr."userId" = :${itemParamName}
+                )`;
+                            subConditions.push(relationCondition);
+                            parameters[itemParamName] = this.extractUserId(item);
+                        });
+                    }
+                    else {
+                        const relationCondition = this.buildTaskRelationCondition(queryBuilder, field, value, paramName);
+                        subConditions.push(relationCondition);
+                    }
+                }
+                else if (typeof value === "object" && value !== null) {
+                    this.buildObjectConditionString(queryBuilder.alias, field, value, paramName, subConditions, parameters);
+                }
+                else {
+                    subConditions.push(`${queryBuilder.alias}.${field} = :${paramName}`);
+                    parameters[paramName] = value;
+                }
+            });
+            queryBuilder.setParameters(parameters);
+            return subConditions.join(" AND ");
+        })
+            .filter((conditionString) => conditionString.trim().length > 0);
+        if (orConditions.length > 0) {
+            queryBuilder.andWhere(`(${orConditions.join(" OR ")})`);
+        }
+    }
+    applyAndConditions(queryBuilder, conditions) {
+        conditions.forEach((condition, index) => {
+            Object.entries(condition).forEach(([field, value]) => {
+                const paramName = `and_${index}_${field}`;
+                if (typeof value === "object" && value !== null) {
+                    this.applyObjectCondition(queryBuilder, queryBuilder.alias, field, value, paramName);
+                }
+                else {
+                    queryBuilder.andWhere(`${queryBuilder.alias}.${field} = :${paramName}`, { [paramName]: value });
+                }
+            });
+        });
+    }
+    applyObjectCondition(queryBuilder, alias, field, condition, paramPrefix) {
+        const baseParamName = paramPrefix || field;
+        if (condition.in && Array.isArray(condition.in)) {
+            queryBuilder.andWhere(`${alias}.${field} IN (:...${baseParamName}_in)`, {
+                [`${baseParamName}_in`]: condition.in,
+            });
+        }
+        else if (condition.notIn && Array.isArray(condition.notIn)) {
+            queryBuilder.andWhere(`${alias}.${field} NOT IN (:...${baseParamName}_notIn)`, {
+                [`${baseParamName}_notIn`]: condition.notIn,
+            });
+        }
+        else if (condition.like) {
+            queryBuilder.andWhere(`${alias}.${field} LIKE :${baseParamName}_like`, {
+                [`${baseParamName}_like`]: `%${condition.like}%`,
+            });
+        }
+        else if (condition.ilike) {
+            queryBuilder.andWhere(`${alias}.${field} ILIKE :${baseParamName}_ilike`, {
+                [`${baseParamName}_ilike`]: `%${condition.ilike}%`,
+            });
+        }
+        else if (condition.gt !== undefined) {
+            queryBuilder.andWhere(`${alias}.${field} > :${baseParamName}_gt`, {
+                [`${baseParamName}_gt`]: condition.gt,
+            });
+        }
+        else if (condition.gte !== undefined) {
+            queryBuilder.andWhere(`${alias}.${field} >= :${baseParamName}_gte`, {
+                [`${baseParamName}_gte`]: condition.gte,
+            });
+        }
+        else if (condition.lt !== undefined) {
+            queryBuilder.andWhere(`${alias}.${field} < :${baseParamName}_lt`, {
+                [`${baseParamName}_lt`]: condition.lt,
+            });
+        }
+        else if (condition.lte !== undefined) {
+            queryBuilder.andWhere(`${alias}.${field} <= :${baseParamName}_lte`, {
+                [`${baseParamName}_lte`]: condition.lte,
+            });
+        }
+        else if (condition.contains && Array.isArray(condition.contains)) {
+            if (alias === "task" && this.isTaskRelationField(field)) {
+                const tableName = this.getTaskRelationTableName(field);
+                condition.contains.forEach((item, index) => {
+                    const cleanItem = this.extractUserId(item);
+                    if (cleanItem) {
+                        const paramName = `${baseParamName}_contains_${index}`;
+                        queryBuilder.andWhere(`EXISTS (
+              SELECT 1 FROM ${tableName} tr 
+              WHERE tr."taskId" = task.id AND tr."userId" = :${paramName}
+            )`, {
+                            [paramName]: cleanItem,
+                        });
+                    }
+                });
+            }
+            else {
+                condition.contains.forEach((item, index) => {
+                    const paramName = `${baseParamName}_contains_${index}`;
+                    queryBuilder.andWhere(`${alias}.${field} @> :${paramName}`, {
+                        [paramName]: JSON.stringify([item]),
+                    });
+                });
+            }
+        }
+        else if (condition.isNull !== undefined) {
+            if (condition.isNull) {
+                queryBuilder.andWhere(`${alias}.${field} IS NULL`);
+            }
+            else {
+                queryBuilder.andWhere(`${alias}.${field} IS NOT NULL`);
+            }
+        }
+    }
+    buildObjectConditionString(alias, field, condition, paramName, conditions, parameters) {
+        if (condition.in &&
+            Array.isArray(condition.in) &&
+            condition.in.length > 0) {
+            conditions.push(`${alias}.${field} IN (:...${paramName}_in)`);
+            parameters[`${paramName}_in`] = condition.in;
+        }
+        else if (condition.notIn &&
+            Array.isArray(condition.notIn) &&
+            condition.notIn.length > 0) {
+            conditions.push(`${alias}.${field} NOT IN (:...${paramName}_notIn)`);
+            parameters[`${paramName}_notIn`] = condition.notIn;
+        }
+        else if (condition.like) {
+            conditions.push(`${alias}.${field} LIKE :${paramName}_like`);
+            parameters[`${paramName}_like`] = `%${condition.like}%`;
+        }
+        else if (condition.ilike) {
+            conditions.push(`${alias}.${field} ILIKE :${paramName}_ilike`);
+            parameters[`${paramName}_ilike`] = `%${condition.ilike}%`;
+        }
+        else if (condition.gt !== undefined) {
+            conditions.push(`${alias}.${field} > :${paramName}_gt`);
+            parameters[`${paramName}_gt`] = condition.gt;
+        }
+        else if (condition.gte !== undefined) {
+            conditions.push(`${alias}.${field} >= :${paramName}_gte`);
+            parameters[`${paramName}_gte`] = condition.gte;
+        }
+        else if (condition.lt !== undefined) {
+            conditions.push(`${alias}.${field} < :${paramName}_lt`);
+            parameters[`${paramName}_lt`] = condition.lt;
+        }
+        else if (condition.lte !== undefined) {
+            conditions.push(`${alias}.${field} <= :${paramName}_lte`);
+            parameters[`${paramName}_lte`] = condition.lte;
+        }
+        else if (condition.contains &&
+            Array.isArray(condition.contains) &&
+            condition.contains.length > 0) {
+            if (alias === "task" && this.isTaskRelationField(field)) {
+                const tableName = this.getTaskRelationTableName(field);
+                condition.contains.forEach((item, index) => {
+                    const cleanItem = this.extractUserId(item);
+                    if (cleanItem) {
+                        const itemParamName = `${paramName}_contains_${index}`;
+                        conditions.push(`EXISTS (
+                SELECT 1 FROM ${tableName} tr 
+                WHERE tr."taskId" = task.id AND tr."userId" = :${itemParamName}
+              )`);
+                        parameters[itemParamName] = cleanItem;
+                    }
+                });
+            }
+            else {
+                condition.contains.forEach((item, index) => {
+                    const itemParamName = `${paramName}_contains_${index}`;
+                    conditions.push(`${alias}.${field} @> :${itemParamName}`);
+                    parameters[itemParamName] = JSON.stringify([item]);
+                });
+            }
+        }
+        else if (condition.isNull !== undefined) {
+            if (condition.isNull) {
+                conditions.push(`${alias}.${field} IS NULL`);
+            }
+            else {
+                conditions.push(`${alias}.${field} IS NOT NULL`);
+            }
+        }
+    }
+    buildAccessConditions(user, additionalFilters) {
+        const conditions = {};
+        const userMaxLevel = Math.min(...user.roles.map((r) => r.level));
+        if (userMaxLevel <= 2) {
+            const groupIds = (user.groups || []).map((g) => g.id);
+            if (groupIds.length > 0) {
+                conditions.groupId = { in: groupIds };
+            }
+        }
+        else {
+            const subGroupIds = (user.subGroups || []).map((sg) => sg.id);
+            const supervisedUserIds = this.getSupervisedUserIds(user);
+            conditions.or = [
+                { createdBy: user.id },
+                { assignedTo: user.id },
+                { observers: { contains: [user.id] } },
+            ];
+            if (supervisedUserIds.length > 0) {
+                conditions.or.push({ createdBy: { in: supervisedUserIds } });
+            }
+            if (subGroupIds.length > 0) {
+                conditions.or.push({ subGroupId: { in: subGroupIds } });
+            }
+        }
+        if (additionalFilters) {
+            Object.assign(conditions, additionalFilters);
+        }
+        return conditions;
+    }
+    getSupervisedUserIds(user) {
+        const supervisedIds = [];
+        if (user.subGroups) {
+            user.subGroups.forEach((sg) => {
+                if (sg.assistants) {
+                    supervisedIds.push(...sg.assistants.map((a) => a.id));
+                }
+            });
+        }
+        return supervisedIds;
+    }
+    isTaskRelationField(field) {
+        const taskRelationFields = ["participants", "responsible", "observers"];
+        return taskRelationFields.includes(field);
+    }
+    applyTaskRelationCondition(queryBuilder, field, condition) {
+        if (typeof condition === "object" &&
+            condition !== null &&
+            condition.contains) {
+            const tableName = this.getTaskRelationTableName(field);
+            condition.contains.forEach((item, index) => {
+                const cleanItem = this.extractUserId(item);
+                if (cleanItem) {
+                    const paramName = `${field}_contains_${index}`;
+                    queryBuilder.andWhere(`EXISTS (
+             SELECT 1 FROM ${tableName} tr 
+             WHERE tr."taskId" = task.id AND tr."userId" = :${paramName}
+           )`, {
+                        [paramName]: cleanItem,
+                    });
+                }
+            });
+        }
+        else {
+            const paramName = `${field}_condition`;
+            const relationCondition = this.buildTaskRelationCondition(queryBuilder, field, condition, paramName);
+            queryBuilder.andWhere(relationCondition);
+        }
+    }
+    buildTaskRelationCondition(queryBuilder, field, condition, paramName) {
+        const tableName = this.getTaskRelationTableName(field);
+        if (Array.isArray(condition)) {
+            const cleanCondition = condition
+                .map((item) => this.extractUserId(item))
+                .filter((id) => id !== null);
+            if (cleanCondition.length === 0) {
+                return "1 = 0";
+            }
+            queryBuilder.setParameter(paramName, cleanCondition);
+            return `EXISTS (
+        SELECT 1 FROM ${tableName} tr 
+        WHERE tr."taskId" = task.id AND tr."userId" IN (:...${paramName})
+      )`;
+        }
+        else if (typeof condition === "object" &&
+            condition !== null &&
+            condition.contains) {
+            const cleanCondition = condition.contains
+                .map((item) => this.extractUserId(item))
+                .filter((id) => id !== null);
+            if (cleanCondition.length === 0) {
+                return "1 = 0";
+            }
+            queryBuilder.setParameter(paramName, cleanCondition);
+            return `EXISTS (
+        SELECT 1 FROM ${tableName} tr 
+        WHERE tr."taskId" = task.id AND tr."userId" IN (:...${paramName})
+      )`;
+        }
+        else {
+            const cleanCondition = this.extractUserId(condition);
+            if (!cleanCondition) {
+                return "1 = 0";
+            }
+            queryBuilder.setParameter(paramName, cleanCondition);
+            return `EXISTS (
+        SELECT 1 FROM ${tableName} tr 
+        WHERE tr."taskId" = task.id AND tr."userId" = :${paramName}
+      )`;
+        }
+    }
+    getTaskRelationTableName(field) {
+        const tableMapping = {
+            participants: "task_participants_user",
+            responsible: "task_responsible_user",
+            observers: "task_observers_user",
+        };
+        return tableMapping[field] || `task_${field}_user`;
+    }
+    extractUserId(item) {
+        if (typeof item === "string") {
+            if (item.match(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i)) {
+                return item;
+            }
+            return null;
+        }
+        if (typeof item === "object" && item !== null) {
+            if (item.id && typeof item.id === "string") {
+                return item.id;
+            }
+            if (item.userId && typeof item.userId === "string") {
+                return item.userId;
+            }
+            if (item.user && item.user.id && typeof item.user.id === "string") {
+                return item.user.id;
+            }
+        }
+        console.warn(`Unable to extract user ID from:`, item);
+        return null;
+    }
+};
+exports.ResourceAccessFilterService = ResourceAccessFilterService;
+exports.ResourceAccessFilterService = ResourceAccessFilterService = __decorate([
+    (0, common_1.Injectable)()
+], ResourceAccessFilterService);
+//# sourceMappingURL=resource-access-filter.service.js.map

package/dist/modules/authorization/services/resource-access-filter.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-access-filter.service.js","sourceRoot":"","sources":["../../../../src/modules/authorization/services/resource-access-filter.service.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAA4C;AAMrC,IAAM,2BAA2B,GAAjC,MAAM,2BAA2B;IACtC,YAAY,CACV,YAAqC,EACrC,OAA8B;QAE9B,MAAM,OAAO,GAAG,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAEnD,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClD,OAAO,YAAY,CAAC;QACtB,CAAC;QAED,OAAO,IAAI,CAAC,6BAA6B,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACnE,CAAC;IAEO,6BAA6B,CACnC,YAAqC,EACrC,OAA4B;QAE5B,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE;YACrD,IAAI,CAAC,cAAc,CAAC,YAAY,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;QAEH,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,oBAAoB,CAAC,OAA8B;QACjD,MAAM,OAAO,GAAG,OAAO,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;QAE7D,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClD,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,cAAc,CACpB,YAAqC,EACrC,KAAa,EACb,SAAc;QAEd,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC;QAEjC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC/C,IAAI,CAAC,iBAAiB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QAED,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC,kBAAkB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QAGD,IAAI,KAAK,KAAK,MAAM,IAAI,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;YACxD,IAAI,CAAC,0BAA0B,CAAC,YAAY,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;YAChE,OAAO;QACT,CAAC;QAGD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACxD,IAAI,CAAC,oBAAoB,CAAC,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QACnE,CAAC;aAAM,CAAC;YAEN,YAAY,CAAC,QAAQ,CAAC,GAAG,KAAK,IAAI,KAAK,OAAO,KAAK,EAAE,EAAE;gBACrD,CAAC,KAAK,CAAC,EAAE,SAAS;aACnB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEO,iBAAiB,CACvB,YAAqC,EACrC,UAAiB;QAEjB,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAEpC,MAAM,YAAY,GAAG,UAAU;aAC5B,GAAG,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE;YACxB,MAAM,aAAa,GAAa,EAAE,CAAC;YACnC,MAAM,UAAU,GAAwB,EAAE,CAAC;YAE3C,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE;gBACnD,MAAM,SAAS,GAAG,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;gBAGzC,IACE,YAAY,CAAC,KAAK,KAAK,MAAM;oBAC7B,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAC/B,CAAC;oBAED,IACE,OAAO,KAAK,KAAK,QAAQ;wBACzB,KAAK,KAAK,IAAI;wBACb,KAAa,CAAC,QAAQ,EACvB,CAAC;wBAED,MAAM,SAAS,GAAG,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;wBACvD,MAAM,aAAa,GAAI,KAAa,CAAC,QAAQ,CAAC;wBAC9C,aAAa,CAAC,OAAO,CAAC,CAAC,IAAS,EAAE,SAAiB,EAAE,EAAE;4BACrD,MAAM,aAAa,GAAG,GAAG,SAAS,aAAa,SAAS,EAAE,CAAC;4BAC3D,MAAM,iBAAiB,GAAG;kCACR,SAAS;mEACwB,aAAa;kBAC9D,CAAC;4BACH,aAAa,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;4BAEtC,UAAU,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;wBACvD,CAAC,CAAC,CAAC;oBACL,CAAC;yBAAM,CAAC;wBAEN,MAAM,iBAAiB,GAAG,IAAI,CAAC,0BAA0B,CACvD,YAAY,EACZ,KAAK,EACL,KAAK,EACL,SAAS,CACV,CAAC;wBACF,aAAa,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;oBACxC,CAAC;gBACH,CAAC;qBAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;oBACvD,IAAI,CAAC,0BAA0B,CAC7B,YAAY,CAAC,KAAK,EAClB,KAAK,EACL,KAAK,EACL,SAAS,EACT,aAAa,EACb,UAAU,CACX,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,aAAa,CAAC,IAAI,CAChB,GAAG,YAAY,CAAC,KAAK,IAAI,KAAK,OAAO,SAAS,EAAE,CACjD,CAAC;oBACF,UAAU,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC;gBAChC,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,YAAY,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;YACvC,OAAO,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC,CAAC;aACD,MAAM,CAAC,CAAC,eAAe,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAElE,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,YAAY,CAAC,QAAQ,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAEO,kBAAkB,CACxB,YAAqC,EACrC,UAAiB;QAEjB,UAAU,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE;YACtC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE;gBACnD,MAAM,SAAS,GAAG,OAAO,KAAK,IAAI,KAAK,EAAE,CAAC;gBAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;oBAChD,IAAI,CAAC,oBAAoB,CACvB,YAAY,EACZ,YAAY,CAAC,KAAK,EAClB,KAAK,EACL,KAAK,EACL,SAAS,CACV,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,YAAY,CAAC,QAAQ,CACnB,GAAG,YAAY,CAAC,KAAK,IAAI,KAAK,OAAO,SAAS,EAAE,EAChD,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CACvB,CAAC;gBACJ,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,oBAAoB,CAC1B,YAAqC,EACrC,KAAa,EACb,KAAa,EACb,SAAc,EACd,WAAoB;QAEpB,MAAM,aAAa,GAAG,WAAW,IAAI,KAAK,CAAC;QAE3C,IAAI,SAAS,CAAC,EAAE,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;YAChD,YAAY,CAAC,QAAQ,CAAC,GAAG,KAAK,IAAI,KAAK,YAAY,aAAa,MAAM,EAAE;gBACtE,CAAC,GAAG,aAAa,KAAK,CAAC,EAAE,SAAS,CAAC,EAAE;aACtC,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,SAAS,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7D,YAAY,CAAC,QAAQ,CACnB,GAAG,KAAK,IAAI,KAAK,gBAAgB,aAAa,SAAS,EACvD;gBACE,CAAC,GAAG,aAAa,QAAQ,CAAC,EAAE,SAAS,CAAC,KAAK;aAC5C,CACF,CAAC;QACJ,CAAC;aAAM,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC;YAC1B,YAAY,CAAC,QAAQ,CAAC,GAAG,KAAK,IAAI,KAAK,UAAU,aAAa,OAAO,EAAE;gBACrE,CAAC,GAAG,aAAa,OAAO,CAAC,EAAE,IAAI,SAAS,CAAC,IAAI,GAAG;aACjD,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC;YAC3B,YAAY,CAAC,QAAQ,CAAC,GAAG,KAAK,IAAI,KAAK,WAAW,aAAa,QAAQ,EAAE;gBACvE,CAAC,GAAG,aAAa,QAAQ,CAAC,EAAE,IAAI,SAAS,CAAC,KAAK,GAAG;aACnD,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,SAAS,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;YACtC,YAAY,CAAC,QAAQ,CAAC,GAAG,KAAK,IAAI,KAAK,OAAO,aAAa,KAAK,EAAE;gBAChE,CAAC,GAAG,aAAa,KAAK,CAAC,EAAE,SAAS,CAAC,EAAE;aACtC,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,SAAS,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YACvC,YAAY,CAAC,QAAQ,CAAC,GAAG,KAAK,IAAI,KAAK,QAAQ,aAAa,MAAM,EAAE;gBAClE,CAAC,GAAG,aAAa,MAAM,CAAC,EAAE,SAAS,CAAC,GAAG;aACxC,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,SAAS,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;YACtC,YAAY,CAAC,QAAQ,CAAC,GAAG,KAAK,IAAI,KAAK,OAAO,aAAa,KAAK,EAAE;gBAChE,CAAC,GAAG,aAAa,KAAK,CAAC,EAAE,SAAS,CAAC,EAAE;aACtC,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,SAAS,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YACvC,YAAY,CAAC,QAAQ,CAAC,GAAG,KAAK,IAAI,KAAK,QAAQ,aAAa,MAAM,EAAE;gBAClE,CAAC,GAAG,aAAa,MAAM,CAAC,EAAE,SAAS,CAAC,GAAG;aACxC,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,SAAS,CAAC,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YAEnE,IAAI,KAAK,KAAK,MAAM,IAAI,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAExD,MAAM,SAAS,GAAG,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;gBACvD,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAS,EAAE,KAAa,EAAE,EAAE;oBACtD,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;oBAC3C,IAAI,SAAS,EAAE,CAAC;wBACd,MAAM,SAAS,GAAG,GAAG,aAAa,aAAa,KAAK,EAAE,CAAC;wBACvD,YAAY,CAAC,QAAQ,CACnB;8BACgB,SAAS;+DACwB,SAAS;cAC1D,EACA;4BACE,CAAC,SAAS,CAAC,EAAE,SAAS;yBACvB,CACF,CAAC;oBACJ,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBAEN,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAS,EAAE,KAAa,EAAE,EAAE;oBACtD,MAAM,SAAS,GAAG,GAAG,aAAa,aAAa,KAAK,EAAE,CAAC;oBACvD,YAAY,CAAC,QAAQ,CAAC,GAAG,KAAK,IAAI,KAAK,QAAQ,SAAS,EAAE,EAAE;wBAC1D,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC;qBACpC,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;aAAM,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC1C,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;gBACrB,YAAY,CAAC,QAAQ,CAAC,GAAG,KAAK,IAAI,KAAK,UAAU,CAAC,CAAC;YACrD,CAAC;iBAAM,CAAC;gBACN,YAAY,CAAC,QAAQ,CAAC,GAAG,KAAK,IAAI,KAAK,cAAc,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;IACH,CAAC;IAEO,0BAA0B,CAChC,KAAa,EACb,KAAa,EACb,SAAc,EACd,SAAiB,EACjB,UAAoB,EACpB,UAA+B;QAE/B,IACE,SAAS,CAAC,EAAE;YACZ,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3B,SAAS,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,EACvB,CAAC;YACD,UAAU,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,KAAK,YAAY,SAAS,MAAM,CAAC,CAAC;YAC9D,UAAU,CAAC,GAAG,SAAS,KAAK,CAAC,GAAG,SAAS,CAAC,EAAE,CAAC;QAC/C,CAAC;aAAM,IACL,SAAS,CAAC,KAAK;YACf,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC;YAC9B,SAAS,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAC1B,CAAC;YACD,UAAU,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,KAAK,gBAAgB,SAAS,SAAS,CAAC,CAAC;YACrE,UAAU,CAAC,GAAG,SAAS,QAAQ,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC;QACrD,CAAC;aAAM,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC;YAC1B,UAAU,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,KAAK,UAAU,SAAS,OAAO,CAAC,CAAC;YAC7D,UAAU,CAAC,GAAG,SAAS,OAAO,CAAC,GAAG,IAAI,SAAS,CAAC,IAAI,GAAG,CAAC;QAC1D,CAAC;aAAM,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC;YAC3B,UAAU,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,KAAK,WAAW,SAAS,QAAQ,CAAC,CAAC;YAC/D,UAAU,CAAC,GAAG,SAAS,QAAQ,CAAC,GAAG,IAAI,SAAS,CAAC,KAAK,GAAG,CAAC;QAC5D,CAAC;aAAM,IAAI,SAAS,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;YACtC,UAAU,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,KAAK,OAAO,SAAS,KAAK,CAAC,CAAC;YACxD,UAAU,CAAC,GAAG,SAAS,KAAK,CAAC,GAAG,SAAS,CAAC,EAAE,CAAC;QAC/C,CAAC;aAAM,IAAI,SAAS,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YACvC,UAAU,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,KAAK,QAAQ,SAAS,MAAM,CAAC,CAAC;YAC1D,UAAU,CAAC,GAAG,SAAS,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC;QACjD,CAAC;aAAM,IAAI,SAAS,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;YACtC,UAAU,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,KAAK,OAAO,SAAS,KAAK,CAAC,CAAC;YACxD,UAAU,CAAC,GAAG,SAAS,KAAK,CAAC,GAAG,SAAS,CAAC,EAAE,CAAC;QAC/C,CAAC;aAAM,IAAI,SAAS,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YACvC,UAAU,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,KAAK,QAAQ,SAAS,MAAM,CAAC,CAAC;YAC1D,UAAU,CAAC,GAAG,SAAS,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC;QACjD,CAAC;aAAM,IACL,SAAS,CAAC,QAAQ;YAClB,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC;YACjC,SAAS,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAC7B,CAAC;YAED,IAAI,KAAK,KAAK,MAAM,IAAI,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAExD,MAAM,SAAS,GAAG,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;gBACvD,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAS,EAAE,KAAa,EAAE,EAAE;oBACtD,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;oBAC3C,IAAI,SAAS,EAAE,CAAC;wBACd,MAAM,aAAa,GAAG,GAAG,SAAS,aAAa,KAAK,EAAE,CAAC;wBACvD,UAAU,CAAC,IAAI,CAAC;gCACI,SAAS;iEACwB,aAAa;gBAC9D,CAAC,CAAC;wBACN,UAAU,CAAC,aAAa,CAAC,GAAG,SAAS,CAAC;oBACxC,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBAEN,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAS,EAAE,KAAa,EAAE,EAAE;oBACtD,MAAM,aAAa,GAAG,GAAG,SAAS,aAAa,KAAK,EAAE,CAAC;oBACvD,UAAU,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,KAAK,QAAQ,aAAa,EAAE,CAAC,CAAC;oBAC1D,UAAU,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;gBACrD,CAAC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;aAAM,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC1C,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;gBACrB,UAAU,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,KAAK,UAAU,CAAC,CAAC;YAC/C,CAAC;iBAAM,CAAC;gBACN,UAAU,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,KAAK,cAAc,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;IACH,CAAC;IAGD,qBAAqB,CACnB,IAAS,EACT,iBAAuC;QAEvC,MAAM,UAAU,GAAwB,EAAE,CAAC;QAG3C,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QAEtE,IAAI,YAAY,IAAI,CAAC,EAAE,CAAC;YAEtB,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC3D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,UAAU,CAAC,OAAO,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;YACxC,CAAC;QACH,CAAC;aAAM,CAAC;YAEN,MAAM,WAAW,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAO,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACnE,MAAM,iBAAiB,GAAG,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;YAE1D,UAAU,CAAC,EAAE,GAAG;gBACd,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE;gBACtB,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,EAAE;gBACvB,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE;aACvC,CAAC;YAEF,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACjC,UAAU,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAC;YAC/D,CAAC;YAED,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,UAAU,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QAGD,IAAI,iBAAiB,EAAE,CAAC;YACtB,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;QAC/C,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAEO,oBAAoB,CAAC,IAAS;QACpC,MAAM,aAAa,GAAa,EAAE,CAAC;QAEnC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,EAAO,EAAE,EAAE;gBACjC,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC;oBAClB,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC7D,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,aAAa,CAAC;IACvB,CAAC;IAKO,mBAAmB,CAAC,KAAa;QACvC,MAAM,kBAAkB,GAAG,CAAC,cAAc,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;QACxE,OAAO,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IAKO,0BAA0B,CAChC,YAAqC,EACrC,KAAa,EACb,SAAc;QAGd,IACE,OAAO,SAAS,KAAK,QAAQ;YAC7B,SAAS,KAAK,IAAI;YAClB,SAAS,CAAC,QAAQ,EAClB,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;YACvD,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAS,EAAE,KAAa,EAAE,EAAE;gBACtD,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;gBAC3C,IAAI,SAAS,EAAE,CAAC;oBACd,MAAM,SAAS,GAAG,GAAG,KAAK,aAAa,KAAK,EAAE,CAAC;oBAC/C,YAAY,CAAC,QAAQ,CACnB;6BACiB,SAAS;8DACwB,SAAS;aAC1D,EACD;wBACE,CAAC,SAAS,CAAC,EAAE,SAAS;qBACvB,CACF,CAAC;gBACJ,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YAEN,MAAM,SAAS,GAAG,GAAG,KAAK,YAAY,CAAC;YACvC,MAAM,iBAAiB,GAAG,IAAI,CAAC,0BAA0B,CACvD,YAAY,EACZ,KAAK,EACL,SAAS,EACT,SAAS,CACV,CAAC;YACF,YAAY,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAKO,0BAA0B,CAChC,YAAqC,EACrC,KAAa,EACb,SAAc,EACd,SAAiB;QAGjB,MAAM,SAAS,GAAG,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAEvD,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAG7B,MAAM,cAAc,GAAG,SAAS;iBAC7B,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;iBACvC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC;YAC/B,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAChC,OAAO,OAAO,CAAC;YACjB,CAAC;YACD,YAAY,CAAC,YAAY,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;YACrD,OAAO;wBACW,SAAS;8DAC6B,SAAS;QAC/D,CAAC;QACL,CAAC;aAAM,IACL,OAAO,SAAS,KAAK,QAAQ;YAC7B,SAAS,KAAK,IAAI;YACjB,SAAiB,CAAC,QAAQ,EAC3B,CAAC;YAGD,MAAM,cAAc,GAAI,SAAiB,CAAC,QAAQ;iBAC/C,GAAG,CAAC,CAAC,IAAS,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;iBAC5C,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC;YAC/B,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAChC,OAAO,OAAO,CAAC;YACjB,CAAC;YACD,YAAY,CAAC,YAAY,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;YACrD,OAAO;wBACW,SAAS;8DAC6B,SAAS;QAC/D,CAAC;QACL,CAAC;aAAM,CAAC;YAGN,MAAM,cAAc,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;YACrD,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,OAAO,OAAO,CAAC;YACjB,CAAC;YACD,YAAY,CAAC,YAAY,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;YACrD,OAAO;wBACW,SAAS;yDACwB,SAAS;QAC1D,CAAC;QACL,CAAC;IACH,CAAC;IAKO,wBAAwB,CAAC,KAAa;QAC5C,MAAM,YAAY,GAAG;YACnB,YAAY,EAAE,wBAAwB;YACtC,WAAW,EAAE,uBAAuB;YACpC,SAAS,EAAE,qBAAqB;SACjC,CAAC;QAEF,OAAO,YAAY,CAAC,KAAK,CAAC,IAAI,QAAQ,KAAK,OAAO,CAAC;IACrD,CAAC;IAKO,aAAa,CAAC,IAAS;QAC7B,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAE7B,IACE,IAAI,CAAC,KAAK,CACR,iEAAiE,CAClE,EACD,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAE9C,IAAI,IAAI,CAAC,EAAE,IAAI,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;gBAC3C,OAAO,IAAI,CAAC,EAAE,CAAC;YACjB,CAAC;YAGD,IAAI,IAAI,CAAC,MAAM,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACnD,OAAO,IAAI,CAAC,MAAM,CAAC;YACrB,CAAC;YAGD,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;gBAClE,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,CAAC;QACH,CAAC;QAGD,OAAO,CAAC,IAAI,CAAC,iCAAiC,EAAE,IAAI,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AAniBY,kEAA2B;sCAA3B,2BAA2B;IADvC,IAAA,mBAAU,GAAE;GACA,2BAA2B,CAmiBvC"}

package/dist/modules/authorization/services/resource-authorization.service.d.ts

@@ -0,0 +1,47 @@
+import { Repository, SelectQueryBuilder } from "typeorm";
+import { PermissionAction, PermissionResult } from "../../../common/";
+import { AuthorizationService } from "./authorization.service";
+import { ResourceAccessFilterService } from "./resource-access-filter.service";
+import { SubGroup, User } from "../../../entities";
+export interface ResourceConfig {
+    name: string;
+    entityName: string;
+    columnMappings: {
+        assignedTo: string;
+        observers: string;
+        createdBy: string;
+        groupId: string;
+        subGroupId?: string;
+        participants?: string;
+        id?: string;
+    };
+    subGroupConfig?: {
+        enabled: boolean;
+        relationField?: string;
+    };
+}
+export declare class ResourceAuthorizationService {
+    private readonly authorizationService;
+    private readonly accessFilter;
+    private readonly logger;
+    constructor(authorizationService: AuthorizationService, accessFilter: ResourceAccessFilterService);
+    applyPermissionFilters<T>(queryBuilder: SelectQueryBuilder<T>, user: User, resourceConfig: ResourceConfig, options?: {
+        getAll?: boolean;
+        assistantIds?: string[];
+        action?: PermissionAction;
+        subGroupRepository?: Repository<SubGroup>;
+    }): Promise<SelectQueryBuilder<T>>;
+    canPerformAction(user: any, action: PermissionAction, resourceConfig: ResourceConfig, targetEntity?: any): Promise<PermissionResult>;
+    validateAccess(user: any, action: PermissionAction, resourceConfig: ResourceConfig, targetEntity: any): Promise<void>;
+    getAssistantIds(user: User, subGroupRepository: Repository<SubGroup>): Promise<string[]>;
+    getSubGroupMembers(user: User, subGroupRepository: Repository<SubGroup>): Promise<string[]>;
+    hasHighLevelPermissions(user: any): boolean;
+    private getUserMaxRoleLevel;
+    canCreate(user: any, resourceConfig: ResourceConfig): Promise<boolean>;
+    canRead(user: any, resourceConfig: ResourceConfig, entity?: any): Promise<boolean>;
+    canUpdate(user: any, resourceConfig: ResourceConfig, entity: any): Promise<boolean>;
+    canDelete(user: any, resourceConfig: ResourceConfig, entity: any): Promise<boolean>;
+    canManage(user: any, resourceConfig: ResourceConfig): Promise<boolean>;
+    canImport(user: any, resourceConfig: ResourceConfig): Promise<boolean>;
+    canExport(user: any, resourceConfig: ResourceConfig): Promise<boolean>;
+}

package/dist/modules/authorization/services/resource-authorization.service.js

@@ -0,0 +1,192 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var ResourceAuthorizationService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ResourceAuthorizationService = void 0;
+const common_1 = require("@nestjs/common");
+const common_2 = require("../../../common/");
+const authorization_service_1 = require("./authorization.service");
+const resource_access_filter_service_1 = require("./resource-access-filter.service");
+let ResourceAuthorizationService = ResourceAuthorizationService_1 = class ResourceAuthorizationService {
+    authorizationService;
+    accessFilter;
+    logger = new common_1.Logger(ResourceAuthorizationService_1.name);
+    constructor(authorizationService, accessFilter) {
+        this.authorizationService = authorizationService;
+        this.accessFilter = accessFilter;
+    }
+    async applyPermissionFilters(queryBuilder, user, resourceConfig, options = {}) {
+        const { getAll = false, assistantIds = [], action = common_2.PermissionAction.READ, subGroupRepository, } = options;
+        try {
+            const userGroupIds = (user.groups || []).map((g) => g.id);
+            let teamMemberIds = assistantIds.length > 0 ? assistantIds : [];
+            if (resourceConfig.subGroupConfig?.enabled &&
+                subGroupRepository &&
+                teamMemberIds.length === 0) {
+                teamMemberIds = await this.getSubGroupMembers(user, subGroupRepository);
+            }
+            const permissionContext = {
+                user,
+                resource: resourceConfig.name,
+                action,
+                additionalContext: {
+                    getAll,
+                    assistantIds,
+                    teamMemberIds,
+                    userMaxRoleLevel: this.getUserMaxRoleLevel(user.roles || []),
+                    userGroupIds,
+                    subGroupRepository,
+                },
+            };
+            const permissionResult = await this.authorizationService.canAccess(permissionContext);
+            if (!permissionResult.allowed) {
+                queryBuilder.where("1 = 0");
+                return queryBuilder;
+            }
+            if (permissionResult.filters &&
+                Object.keys(permissionResult.filters).length > 0) {
+                return this.accessFilter.applyFilters(queryBuilder, {
+                    ...permissionContext,
+                    additionalContext: { permissionFilters: permissionResult.filters },
+                });
+            }
+            return queryBuilder;
+        }
+        catch (error) {
+            this.logger.error(`❌ [ResourceAuth] Error applying ${resourceConfig.name} permission filters: ${error instanceof Error ? error.message : "Unknown error"}`);
+            this.logger.error(`❌ [ResourceAuth] Error stack: ${error instanceof Error ? error.stack : "No stack"}`);
+            queryBuilder.where("1 = 0");
+            return queryBuilder;
+        }
+    }
+    async canPerformAction(user, action, resourceConfig, targetEntity) {
+        const userGroupIds = (user.groups || []).map((g) => g.id);
+        const context = {
+            user,
+            resource: resourceConfig.name,
+            action,
+            targetEntity,
+            additionalContext: {
+                userMaxRoleLevel: this.getUserMaxRoleLevel(user.roles || []),
+                userGroupIds,
+            },
+        };
+        return this.authorizationService.canAccess(context);
+    }
+    async validateAccess(user, action, resourceConfig, targetEntity) {
+        const userGroupIds = (user.groups || []).map((g) => g.id);
+        const context = {
+            user,
+            resource: resourceConfig.name,
+            action,
+            targetEntity,
+            additionalContext: {
+                userGroupIds,
+            },
+        };
+        return this.authorizationService.validateAccess(context);
+    }
+    async getAssistantIds(user, subGroupRepository) {
+        const supervisedSubGroups = await subGroupRepository
+            .createQueryBuilder("sg")
+            .leftJoinAndSelect("sg.assistants", "assistant")
+            .where("sg.supervisor = :userId", { userId: user.id })
+            .getMany();
+        const assistantIds = [];
+        for (const subGroup of supervisedSubGroups) {
+            if (subGroup.assistants && Array.isArray(subGroup.assistants)) {
+                subGroup.assistants.forEach((assistant) => {
+                    if (assistant?.id) {
+                        assistantIds.push(assistant.id);
+                    }
+                });
+            }
+        }
+        const uniqueAssistantIds = Array.from(new Set(assistantIds.filter((id) => id !== null && id !== undefined)));
+        return uniqueAssistantIds;
+    }
+    async getSubGroupMembers(user, subGroupRepository) {
+        const supervisedSubGroups = await subGroupRepository
+            .createQueryBuilder("sg")
+            .leftJoinAndSelect("sg.supervisor", "supervisor")
+            .leftJoinAndSelect("sg.assistants", "assistant")
+            .where("supervisor.id = :userId", { userId: user.id })
+            .getMany();
+        const assistantSubGroups = await subGroupRepository
+            .createQueryBuilder("sg")
+            .leftJoinAndSelect("sg.supervisor", "supervisor")
+            .leftJoinAndSelect("sg.assistants", "assistant")
+            .innerJoin("sg.assistants", "assistantFilter")
+            .where("assistantFilter.id = :userId", { userId: user.id })
+            .getMany();
+        const allSubGroups = [...supervisedSubGroups, ...assistantSubGroups];
+        const uniqueSubGroups = allSubGroups.filter((sg, index, self) => index === self.findIndex((s) => s.id === sg.id));
+        const allMemberIds = [];
+        for (const subGroup of uniqueSubGroups) {
+            if (subGroup.supervisor?.id) {
+                allMemberIds.push(subGroup.supervisor.id);
+            }
+            if (subGroup.assistants && Array.isArray(subGroup.assistants)) {
+                subGroup.assistants.forEach((assistant) => {
+                    if (assistant?.id) {
+                        allMemberIds.push(assistant.id);
+                    }
+                });
+            }
+        }
+        const uniqueMemberIds = Array.from(new Set(allMemberIds.filter((id) => id !== null && id !== undefined)));
+        return uniqueMemberIds;
+    }
+    hasHighLevelPermissions(user) {
+        const userMaxRoleLevel = this.getUserMaxRoleLevel(user.roles || []);
+        return userMaxRoleLevel <= 2;
+    }
+    getUserMaxRoleLevel(roles) {
+        if (!roles || roles.length === 0)
+            return 999;
+        return Math.min(...roles.map((role) => role.level || 999));
+    }
+    async canCreate(user, resourceConfig) {
+        const result = await this.canPerformAction(user, common_2.PermissionAction.CREATE, resourceConfig);
+        return result.allowed;
+    }
+    async canRead(user, resourceConfig, entity) {
+        const result = await this.canPerformAction(user, common_2.PermissionAction.READ, resourceConfig, entity);
+        return result.allowed;
+    }
+    async canUpdate(user, resourceConfig, entity) {
+        const result = await this.canPerformAction(user, common_2.PermissionAction.UPDATE, resourceConfig, entity);
+        return result.allowed;
+    }
+    async canDelete(user, resourceConfig, entity) {
+        const result = await this.canPerformAction(user, common_2.PermissionAction.DELETE, resourceConfig, entity);
+        return result.allowed;
+    }
+    async canManage(user, resourceConfig) {
+        const result = await this.canPerformAction(user, common_2.PermissionAction.MANAGE, resourceConfig);
+        return result.allowed;
+    }
+    async canImport(user, resourceConfig) {
+        const result = await this.canPerformAction(user, common_2.PermissionAction.IMPORT, resourceConfig);
+        return result.allowed;
+    }
+    async canExport(user, resourceConfig) {
+        const result = await this.canPerformAction(user, common_2.PermissionAction.EXPORT, resourceConfig);
+        return result.allowed;
+    }
+};
+exports.ResourceAuthorizationService = ResourceAuthorizationService;
+exports.ResourceAuthorizationService = ResourceAuthorizationService = ResourceAuthorizationService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [authorization_service_1.AuthorizationService,
+        resource_access_filter_service_1.ResourceAccessFilterService])
+], ResourceAuthorizationService);
+//# sourceMappingURL=resource-authorization.service.js.map