omegga 1.5.4 → 1.6.1

package/dist/webserver/backend/scopes.js

@@ -0,0 +1,332 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const ScopeDomain = {
+  Chat: "chat",
+  Player: "player",
+  Plugin: "plugin",
+  Server: "server",
+  User: "user",
+  World: "world",
+  Role: "role",
+  Session: "session"
+};
+const ScopeName = {
+  ChatSend: "chat.send",
+  ChatRecent: "chat.recent",
+  ChatHistory: "chat.history",
+  ChatCalendar: "chat.calendar",
+  PlayerList: "player.list",
+  PlayerGet: "player.get",
+  PlayerBan: "player.ban",
+  PlayerKick: "player.kick",
+  PlayerUnban: "player.unban",
+  PlayerClearBricks: "player.clearBricks",
+  PluginList: "plugin.list",
+  PluginGet: "plugin.get",
+  PluginConfig: "plugin.config",
+  PluginLoad: "plugin.load",
+  PluginUnload: "plugin.unload",
+  PluginToggle: "plugin.toggle",
+  PluginReloadAll: "plugin.reloadAll",
+  ServerStatus: "server.status",
+  ServerStart: "server.start",
+  ServerStop: "server.stop",
+  ServerRestart: "server.restart",
+  ServerUpdateCheck: "server.update.check",
+  ServerUpdateRun: "server.update.run",
+  ServerAutorestartGet: "server.autorestart.get",
+  ServerAutorestartSet: "server.autorestart.set",
+  ServerUtilization: "server.utilization",
+  UserList: "user.list",
+  UserCreate: "user.create",
+  UserPasswd: "user.passwd",
+  UserBan: "user.ban",
+  UserDelete: "user.delete",
+  UserPermissions: "user.permissions",
+  UserGrantRole: "user.grantRole",
+  UserReadMfa: "user.readMfa",
+  UserResetMfa: "user.resetMfa",
+  WorldList: "world.list",
+  WorldActive: "world.active",
+  WorldNext: "world.next",
+  WorldRevisions: "world.revisions",
+  WorldMeta: "world.meta",
+  WorldLoad: "world.load",
+  WorldUse: "world.use",
+  WorldSave: "world.save",
+  WorldCreate: "world.create",
+  RoleList: "role.list",
+  RoleEdit: "role.edit",
+  RoleDefaultPermissions: "role.defaultPermissions",
+  RoleGrantPermission: "role.grantPermission",
+  SessionInfo: "session.info"
+};
+const S = ScopeName;
+const D = ScopeDomain;
+const SCOPES = {
+  // Chat
+  [S.ChatSend]: {
+    description: "Send messages in the dashboard chat widget",
+    readOnly: false,
+    domain: D.Chat
+  },
+  [S.ChatRecent]: {
+    description: "View recent chat on the dashboard",
+    readOnly: true,
+    domain: D.Chat
+  },
+  [S.ChatHistory]: {
+    description: "Browse past chat logs in the history view",
+    readOnly: true,
+    domain: D.Chat
+  },
+  [S.ChatCalendar]: {
+    description: "Navigate chat by date in the history view",
+    readOnly: true,
+    domain: D.Chat
+  },
+  // Player
+  [S.PlayerList]: {
+    description: "View the player list in the players view",
+    readOnly: true,
+    domain: D.Player
+  },
+  [S.PlayerGet]: {
+    description: "Inspect player details and history",
+    readOnly: true,
+    domain: D.Player
+  },
+  [S.PlayerBan]: {
+    description: "Ban players from the player inspector",
+    readOnly: false,
+    domain: D.Player
+  },
+  [S.PlayerKick]: {
+    description: "Kick players from the player inspector",
+    readOnly: false,
+    domain: D.Player
+  },
+  [S.PlayerUnban]: {
+    description: "Unban players from the player inspector",
+    readOnly: false,
+    domain: D.Player
+  },
+  [S.PlayerClearBricks]: {
+    description: "Clear a player's bricks from the player inspector",
+    readOnly: false,
+    domain: D.Player
+  },
+  // Plugin
+  [S.PluginList]: {
+    description: "View installed plugins in the plugins view",
+    readOnly: true,
+    domain: D.Plugin
+  },
+  [S.PluginGet]: {
+    description: "Inspect plugin details and configuration",
+    readOnly: true,
+    domain: D.Plugin
+  },
+  [S.PluginConfig]: {
+    description: "Edit plugin settings in the plugin inspector",
+    readOnly: false,
+    domain: D.Plugin
+  },
+  [S.PluginLoad]: {
+    description: "Load plugins from the plugin inspector",
+    readOnly: false,
+    domain: D.Plugin
+  },
+  [S.PluginUnload]: {
+    description: "Unload plugins from the plugin inspector",
+    readOnly: false,
+    domain: D.Plugin
+  },
+  [S.PluginToggle]: {
+    description: "Enable or disable plugins in the plugins view",
+    readOnly: false,
+    domain: D.Plugin
+  },
+  [S.PluginReloadAll]: {
+    description: "Reload all plugins from the plugins view",
+    readOnly: false,
+    domain: D.Plugin
+  },
+  // Server
+  [S.ServerStatus]: {
+    description: "View server status on the dashboard and server view",
+    readOnly: true,
+    domain: D.Server
+  },
+  [S.ServerStart]: {
+    description: "Start the server from the server view",
+    readOnly: false,
+    domain: D.Server
+  },
+  [S.ServerStop]: {
+    description: "Stop the server from the server view",
+    readOnly: false,
+    domain: D.Server
+  },
+  [S.ServerRestart]: {
+    description: "Restart the server from the server view",
+    readOnly: false,
+    domain: D.Server
+  },
+  [S.ServerUpdateCheck]: {
+    description: "Check for server updates in the server view",
+    readOnly: false,
+    domain: D.Server
+  },
+  [S.ServerUpdateRun]: {
+    description: "Run server updates from the server view",
+    readOnly: false,
+    domain: D.Server
+  },
+  [S.ServerAutorestartGet]: {
+    description: "View auto-restart settings in the server view",
+    readOnly: true,
+    domain: D.Server
+  },
+  [S.ServerAutorestartSet]: {
+    description: "Change auto-restart settings in the server view",
+    readOnly: false,
+    domain: D.Server
+  },
+  [S.ServerUtilization]: {
+    description: "View CPU, memory, and disk usage on the dashboard",
+    readOnly: true,
+    domain: D.Server
+  },
+  // User
+  [S.UserList]: {
+    description: "View web UI user accounts in the users view",
+    readOnly: true,
+    domain: D.User
+  },
+  [S.UserCreate]: {
+    description: "Create new user accounts in the users view",
+    readOnly: false,
+    domain: D.User
+  },
+  [S.UserPasswd]: {
+    description: "Change user passwords in the users view",
+    readOnly: false,
+    domain: D.User
+  },
+  [S.UserBan]: {
+    description: "Disable or re-enable users in the user inspector",
+    readOnly: false,
+    domain: D.User
+  },
+  [S.UserDelete]: {
+    description: "Permanently delete user accounts",
+    readOnly: false,
+    domain: D.User
+  },
+  [S.UserPermissions]: {
+    description: "Edit user permissions in the users view",
+    readOnly: false,
+    domain: D.User
+  },
+  [S.UserGrantRole]: {
+    description: "Assign and revoke roles to/from users",
+    readOnly: false,
+    domain: D.User
+  },
+  [S.UserReadMfa]: {
+    description: "View MFA status of other users in the user inspector",
+    readOnly: true,
+    domain: D.User
+  },
+  [S.UserResetMfa]: {
+    description: "Reset MFA for other users in the user inspector",
+    readOnly: false,
+    domain: D.User
+  },
+  // World
+  [S.WorldList]: {
+    description: "View available worlds in the worlds view",
+    readOnly: true,
+    domain: D.World
+  },
+  [S.WorldActive]: {
+    description: "See which world is currently loaded",
+    readOnly: true,
+    domain: D.World
+  },
+  [S.WorldNext]: {
+    description: "See which world will load next",
+    readOnly: true,
+    domain: D.World
+  },
+  [S.WorldRevisions]: {
+    description: "View world save revisions in the world inspector",
+    readOnly: true,
+    domain: D.World
+  },
+  [S.WorldMeta]: {
+    description: "View world metadata in the world inspector",
+    readOnly: true,
+    domain: D.World
+  },
+  [S.WorldLoad]: {
+    description: "Load worlds from the world inspector",
+    readOnly: false,
+    domain: D.World
+  },
+  [S.WorldUse]: {
+    description: "Set the default world in the worlds view",
+    readOnly: false,
+    domain: D.World
+  },
+  [S.WorldSave]: {
+    description: "Save the current world from the worlds or server view",
+    readOnly: false,
+    domain: D.World
+  },
+  [S.WorldCreate]: {
+    description: "Create new worlds in the worlds view",
+    readOnly: false,
+    domain: D.World
+  },
+  // Role
+  [S.RoleList]: {
+    description: "View roles in the roles view",
+    readOnly: true,
+    domain: D.Role
+  },
+  [S.RoleEdit]: {
+    description: "Create, edit, delete, and reorder roles",
+    readOnly: false,
+    domain: D.Role
+  },
+  [S.RoleDefaultPermissions]: {
+    description: "Edit the default permissions that apply to all users",
+    readOnly: false,
+    domain: D.Role
+  },
+  [S.RoleGrantPermission]: {
+    description: "Add or remove permissions within roles",
+    readOnly: false,
+    domain: D.Role
+  },
+  // Session
+  [S.SessionInfo]: {
+    description: "View session info",
+    readOnly: true,
+    domain: D.Session
+  }
+};
+[
+  ...new Set(Object.values(SCOPES).map((s) => s.domain))
+];
+const SCOPES_BY_DOMAIN = {};
+for (const [scope, info] of Object.entries(SCOPES)) {
+  (SCOPES_BY_DOMAIN[info.domain] ??= []).push(scope);
+}
+exports.SCOPES = SCOPES;
+exports.SCOPES_BY_DOMAIN = SCOPES_BY_DOMAIN;
+exports.ScopeDomain = ScopeDomain;
+exports.ScopeName = ScopeName;
+//# sourceMappingURL=scopes.js.map

package/dist/webserver/backend/scopes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopes.js","sources":["../../../src/webserver/backend/scopes.ts"],"sourcesContent":["export const ScopeDomain = {\n  Chat: 'chat',\n  Player: 'player',\n  Plugin: 'plugin',\n  Server: 'server',\n  User: 'user',\n  World: 'world',\n  Role: 'role',\n  Session: 'session',\n} as const;\n\nexport const ScopeName = {\n  ChatSend: 'chat.send',\n  ChatRecent: 'chat.recent',\n  ChatHistory: 'chat.history',\n  ChatCalendar: 'chat.calendar',\n\n  PlayerList: 'player.list',\n  PlayerGet: 'player.get',\n  PlayerBan: 'player.ban',\n  PlayerKick: 'player.kick',\n  PlayerUnban: 'player.unban',\n  PlayerClearBricks: 'player.clearBricks',\n\n  PluginList: 'plugin.list',\n  PluginGet: 'plugin.get',\n  PluginConfig: 'plugin.config',\n  PluginLoad: 'plugin.load',\n  PluginUnload: 'plugin.unload',\n  PluginToggle: 'plugin.toggle',\n  PluginReloadAll: 'plugin.reloadAll',\n\n  ServerStatus: 'server.status',\n  ServerStart: 'server.start',\n  ServerStop: 'server.stop',\n  ServerRestart: 'server.restart',\n  ServerUpdateCheck: 'server.update.check',\n  ServerUpdateRun: 'server.update.run',\n  ServerAutorestartGet: 'server.autorestart.get',\n  ServerAutorestartSet: 'server.autorestart.set',\n  ServerUtilization: 'server.utilization',\n\n  UserList: 'user.list',\n  UserCreate: 'user.create',\n  UserPasswd: 'user.passwd',\n  UserBan: 'user.ban',\n  UserDelete: 'user.delete',\n  UserPermissions: 'user.permissions',\n  UserGrantRole: 'user.grantRole',\n  UserReadMfa: 'user.readMfa',\n  UserResetMfa: 'user.resetMfa',\n\n  WorldList: 'world.list',\n  WorldActive: 'world.active',\n  WorldNext: 'world.next',\n  WorldRevisions: 'world.revisions',\n  WorldMeta: 'world.meta',\n  WorldLoad: 'world.load',\n  WorldUse: 'world.use',\n  WorldSave: 'world.save',\n  WorldCreate: 'world.create',\n\n  RoleList: 'role.list',\n  RoleEdit: 'role.edit',\n  RoleDefaultPermissions: 'role.defaultPermissions',\n  RoleGrantPermission: 'role.grantPermission',\n\n  SessionInfo: 'session.info',\n} as const;\n\nconst S = ScopeName;\nconst D = ScopeDomain;\n\nexport const SCOPES = {\n  // Chat\n  [S.ChatSend]: {\n    description: 'Send messages in the dashboard chat widget',\n    readOnly: false,\n    domain: D.Chat,\n  },\n  [S.ChatRecent]: {\n    description: 'View recent chat on the dashboard',\n    readOnly: true,\n    domain: D.Chat,\n  },\n  [S.ChatHistory]: {\n    description: 'Browse past chat logs in the history view',\n    readOnly: true,\n    domain: D.Chat,\n  },\n  [S.ChatCalendar]: {\n    description: 'Navigate chat by date in the history view',\n    readOnly: true,\n    domain: D.Chat,\n  },\n\n  // Player\n  [S.PlayerList]: {\n    description: 'View the player list in the players view',\n    readOnly: true,\n    domain: D.Player,\n  },\n  [S.PlayerGet]: {\n    description: 'Inspect player details and history',\n    readOnly: true,\n    domain: D.Player,\n  },\n  [S.PlayerBan]: {\n    description: 'Ban players from the player inspector',\n    readOnly: false,\n    domain: D.Player,\n  },\n  [S.PlayerKick]: {\n    description: 'Kick players from the player inspector',\n    readOnly: false,\n    domain: D.Player,\n  },\n  [S.PlayerUnban]: {\n    description: 'Unban players from the player inspector',\n    readOnly: false,\n    domain: D.Player,\n  },\n  [S.PlayerClearBricks]: {\n    description: \"Clear a player's bricks from the player inspector\",\n    readOnly: false,\n    domain: D.Player,\n  },\n\n  // Plugin\n  [S.PluginList]: {\n    description: 'View installed plugins in the plugins view',\n    readOnly: true,\n    domain: D.Plugin,\n  },\n  [S.PluginGet]: {\n    description: 'Inspect plugin details and configuration',\n    readOnly: true,\n    domain: D.Plugin,\n  },\n  [S.PluginConfig]: {\n    description: 'Edit plugin settings in the plugin inspector',\n    readOnly: false,\n    domain: D.Plugin,\n  },\n  [S.PluginLoad]: {\n    description: 'Load plugins from the plugin inspector',\n    readOnly: false,\n    domain: D.Plugin,\n  },\n  [S.PluginUnload]: {\n    description: 'Unload plugins from the plugin inspector',\n    readOnly: false,\n    domain: D.Plugin,\n  },\n  [S.PluginToggle]: {\n    description: 'Enable or disable plugins in the plugins view',\n    readOnly: false,\n    domain: D.Plugin,\n  },\n  [S.PluginReloadAll]: {\n    description: 'Reload all plugins from the plugins view',\n    readOnly: false,\n    domain: D.Plugin,\n  },\n\n  // Server\n  [S.ServerStatus]: {\n    description: 'View server status on the dashboard and server view',\n    readOnly: true,\n    domain: D.Server,\n  },\n  [S.ServerStart]: {\n    description: 'Start the server from the server view',\n    readOnly: false,\n    domain: D.Server,\n  },\n  [S.ServerStop]: {\n    description: 'Stop the server from the server view',\n    readOnly: false,\n    domain: D.Server,\n  },\n  [S.ServerRestart]: {\n    description: 'Restart the server from the server view',\n    readOnly: false,\n    domain: D.Server,\n  },\n  [S.ServerUpdateCheck]: {\n    description: 'Check for server updates in the server view',\n    readOnly: false,\n    domain: D.Server,\n  },\n  [S.ServerUpdateRun]: {\n    description: 'Run server updates from the server view',\n    readOnly: false,\n    domain: D.Server,\n  },\n  [S.ServerAutorestartGet]: {\n    description: 'View auto-restart settings in the server view',\n    readOnly: true,\n    domain: D.Server,\n  },\n  [S.ServerAutorestartSet]: {\n    description: 'Change auto-restart settings in the server view',\n    readOnly: false,\n    domain: D.Server,\n  },\n  [S.ServerUtilization]: {\n    description: 'View CPU, memory, and disk usage on the dashboard',\n    readOnly: true,\n    domain: D.Server,\n  },\n\n  // User\n  [S.UserList]: {\n    description: 'View web UI user accounts in the users view',\n    readOnly: true,\n    domain: D.User,\n  },\n  [S.UserCreate]: {\n    description: 'Create new user accounts in the users view',\n    readOnly: false,\n    domain: D.User,\n  },\n  [S.UserPasswd]: {\n    description: 'Change user passwords in the users view',\n    readOnly: false,\n    domain: D.User,\n  },\n  [S.UserBan]: {\n    description: 'Disable or re-enable users in the user inspector',\n    readOnly: false,\n    domain: D.User,\n  },\n  [S.UserDelete]: {\n    description: 'Permanently delete user accounts',\n    readOnly: false,\n    domain: D.User,\n  },\n  [S.UserPermissions]: {\n    description: 'Edit user permissions in the users view',\n    readOnly: false,\n    domain: D.User,\n  },\n  [S.UserGrantRole]: {\n    description: 'Assign and revoke roles to/from users',\n    readOnly: false,\n    domain: D.User,\n  },\n  [S.UserReadMfa]: {\n    description: 'View MFA status of other users in the user inspector',\n    readOnly: true,\n    domain: D.User,\n  },\n  [S.UserResetMfa]: {\n    description: 'Reset MFA for other users in the user inspector',\n    readOnly: false,\n    domain: D.User,\n  },\n\n  // World\n  [S.WorldList]: {\n    description: 'View available worlds in the worlds view',\n    readOnly: true,\n    domain: D.World,\n  },\n  [S.WorldActive]: {\n    description: 'See which world is currently loaded',\n    readOnly: true,\n    domain: D.World,\n  },\n  [S.WorldNext]: {\n    description: 'See which world will load next',\n    readOnly: true,\n    domain: D.World,\n  },\n  [S.WorldRevisions]: {\n    description: 'View world save revisions in the world inspector',\n    readOnly: true,\n    domain: D.World,\n  },\n  [S.WorldMeta]: {\n    description: 'View world metadata in the world inspector',\n    readOnly: true,\n    domain: D.World,\n  },\n  [S.WorldLoad]: {\n    description: 'Load worlds from the world inspector',\n    readOnly: false,\n    domain: D.World,\n  },\n  [S.WorldUse]: {\n    description: 'Set the default world in the worlds view',\n    readOnly: false,\n    domain: D.World,\n  },\n  [S.WorldSave]: {\n    description: 'Save the current world from the worlds or server view',\n    readOnly: false,\n    domain: D.World,\n  },\n  [S.WorldCreate]: {\n    description: 'Create new worlds in the worlds view',\n    readOnly: false,\n    domain: D.World,\n  },\n\n  // Role\n  [S.RoleList]: {\n    description: 'View roles in the roles view',\n    readOnly: true,\n    domain: D.Role,\n  },\n  [S.RoleEdit]: {\n    description: 'Create, edit, delete, and reorder roles',\n    readOnly: false,\n    domain: D.Role,\n  },\n  [S.RoleDefaultPermissions]: {\n    description: 'Edit the default permissions that apply to all users',\n    readOnly: false,\n    domain: D.Role,\n  },\n  [S.RoleGrantPermission]: {\n    description: 'Add or remove permissions within roles',\n    readOnly: false,\n    domain: D.Role,\n  },\n\n  // Session\n  [S.SessionInfo]: {\n    description: 'View session info',\n    readOnly: true,\n    domain: D.Session,\n  },\n} as const;\n\nexport type Scope = keyof typeof SCOPES;\n\nexport const DOMAIN_LABELS: Record<string, string> = {\n  [D.Chat]: 'Chat',\n  [D.Player]: 'Player',\n  [D.Plugin]: 'Plugin',\n  [D.Server]: 'Server',\n  [D.User]: 'User',\n  [D.World]: 'World',\n  [D.Role]: 'Role',\n};\n\nexport const DOMAIN_ORDER = [\n  D.Chat,\n  D.Player,\n  D.Plugin,\n  D.Server,\n  D.User,\n  D.World,\n  D.Role,\n] as const;\n\nexport const DOMAINS = [\n  ...new Set(Object.values(SCOPES).map(s => s.domain)),\n] as const;\n\nexport type Domain = (typeof DOMAINS)[number];\n\nexport const SCOPES_BY_DOMAIN: Record<string, Scope[]> = {};\nfor (const [scope, info] of Object.entries(SCOPES)) {\n  (SCOPES_BY_DOMAIN[info.domain] ??= []).push(scope as Scope);\n}\n"],"names":[],"mappings":";;AAAO,MAAM,cAAc;AAAA,EACzB,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,OAAO;AAAA,EACP,MAAM;AAAA,EACN,SAAS;AACX;AAEO,MAAM,YAAY;AAAA,EACvB,UAAU;AAAA,EACV,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,cAAc;AAAA,EAEd,YAAY;AAAA,EACZ,WAAW;AAAA,EACX,WAAW;AAAA,EACX,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,mBAAmB;AAAA,EAEnB,YAAY;AAAA,EACZ,WAAW;AAAA,EACX,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,cAAc;AAAA,EACd,cAAc;AAAA,EACd,iBAAiB;AAAA,EAEjB,cAAc;AAAA,EACd,aAAa;AAAA,EACb,YAAY;AAAA,EACZ,eAAe;AAAA,EACf,mBAAmB;AAAA,EACnB,iBAAiB;AAAA,EACjB,sBAAsB;AAAA,EACtB,sBAAsB;AAAA,EACtB,mBAAmB;AAAA,EAEnB,UAAU;AAAA,EACV,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,SAAS;AAAA,EACT,YAAY;AAAA,EACZ,iBAAiB;AAAA,EACjB,eAAe;AAAA,EACf,aAAa;AAAA,EACb,cAAc;AAAA,EAEd,WAAW;AAAA,EACX,aAAa;AAAA,EACb,WAAW;AAAA,EACX,gBAAgB;AAAA,EAChB,WAAW;AAAA,EACX,WAAW;AAAA,EACX,UAAU;AAAA,EACV,WAAW;AAAA,EACX,aAAa;AAAA,EAEb,UAAU;AAAA,EACV,UAAU;AAAA,EACV,wBAAwB;AAAA,EACxB,qBAAqB;AAAA,EAErB,aAAa;AACf;AAEA,MAAM,IAAI;AACV,MAAM,IAAI;AAEH,MAAM,SAAS;AAAA;AAAA,EAEpB,CAAC,EAAE,QAAQ,GAAG;AAAA,IACZ,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,UAAU,GAAG;AAAA,IACd,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,WAAW,GAAG;AAAA,IACf,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,YAAY,GAAG;AAAA,IAChB,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA;AAAA,EAIZ,CAAC,EAAE,UAAU,GAAG;AAAA,IACd,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,SAAS,GAAG;AAAA,IACb,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,SAAS,GAAG;AAAA,IACb,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,UAAU,GAAG;AAAA,IACd,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,WAAW,GAAG;AAAA,IACf,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,iBAAiB,GAAG;AAAA,IACrB,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA;AAAA,EAIZ,CAAC,EAAE,UAAU,GAAG;AAAA,IACd,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,SAAS,GAAG;AAAA,IACb,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,YAAY,GAAG;AAAA,IAChB,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,UAAU,GAAG;AAAA,IACd,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,YAAY,GAAG;AAAA,IAChB,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,YAAY,GAAG;AAAA,IAChB,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,eAAe,GAAG;AAAA,IACnB,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA;AAAA,EAIZ,CAAC,EAAE,YAAY,GAAG;AAAA,IAChB,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,WAAW,GAAG;AAAA,IACf,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,UAAU,GAAG;AAAA,IACd,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,aAAa,GAAG;AAAA,IACjB,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,iBAAiB,GAAG;AAAA,IACrB,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,eAAe,GAAG;AAAA,IACnB,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,oBAAoB,GAAG;AAAA,IACxB,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,oBAAoB,GAAG;AAAA,IACxB,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,iBAAiB,GAAG;AAAA,IACrB,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA;AAAA,EAIZ,CAAC,EAAE,QAAQ,GAAG;AAAA,IACZ,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,UAAU,GAAG;AAAA,IACd,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,UAAU,GAAG;AAAA,IACd,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,OAAO,GAAG;AAAA,IACX,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,UAAU,GAAG;AAAA,IACd,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,eAAe,GAAG;AAAA,IACnB,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,aAAa,GAAG;AAAA,IACjB,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,WAAW,GAAG;AAAA,IACf,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,YAAY,GAAG;AAAA,IAChB,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA;AAAA,EAIZ,CAAC,EAAE,SAAS,GAAG;AAAA,IACb,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,WAAW,GAAG;AAAA,IACf,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,SAAS,GAAG;AAAA,IACb,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,cAAc,GAAG;AAAA,IAClB,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,SAAS,GAAG;AAAA,IACb,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,SAAS,GAAG;AAAA,IACb,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,QAAQ,GAAG;AAAA,IACZ,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,SAAS,GAAG;AAAA,IACb,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,WAAW,GAAG;AAAA,IACf,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA;AAAA,EAIZ,CAAC,EAAE,QAAQ,GAAG;AAAA,IACZ,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,QAAQ,GAAG;AAAA,IACZ,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,sBAAsB,GAAG;AAAA,IAC1B,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA,EAEZ,CAAC,EAAE,mBAAmB,GAAG;AAAA,IACvB,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAAA;AAAA,EAIZ,CAAC,EAAE,WAAW,GAAG;AAAA,IACf,aAAa;AAAA,IACb,UAAU;AAAA,IACV,QAAQ,EAAE;AAAA,EAAA;AAEd;AAwBuB;AAAA,EACrB,GAAG,IAAI,IAAI,OAAO,OAAO,MAAM,EAAE,IAAI,CAAA,MAAK,EAAE,MAAM,CAAC;AACrD;AAIO,MAAM,mBAA4C,CAAA;AACzD,WAAW,CAAC,OAAO,IAAI,KAAK,OAAO,QAAQ,MAAM,GAAG;AAClD,GAAC,iBAAiB,KAAK,MAAM,MAAM,CAAA,GAAI,KAAK,KAAc;AAC5D;;;;;"}

package/dist/webserver/backend/totp.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const otpauth = require("otpauth");
+const ISSUER = "Omegga";
+const DIGITS = 6;
+const PERIOD = 30;
+const ALGORITHM = "SHA1";
+function makeTOTP(secret, label = "") {
+  return new otpauth.TOTP({
+    issuer: ISSUER,
+    label,
+    algorithm: ALGORITHM,
+    digits: DIGITS,
+    period: PERIOD,
+    secret: otpauth.Secret.fromBase32(secret)
+  });
+}
+function generateSecret() {
+  return new otpauth.Secret().base32;
+}
+function verifyToken(token, secret, window = 1) {
+  if (!/^\d{6}$/.test(token)) return false;
+  const delta = makeTOTP(secret).validate({ token, window });
+  return delta !== null;
+}
+function generateURI(secret, username) {
+  return makeTOTP(secret, username).toString();
+}
+exports.generateSecret = generateSecret;
+exports.generateURI = generateURI;
+exports.verifyToken = verifyToken;
+//# sourceMappingURL=totp.js.map

package/dist/webserver/backend/totp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp.js","sources":["../../../src/webserver/backend/totp.ts"],"sourcesContent":["import { TOTP, Secret } from 'otpauth';\n\nconst ISSUER = 'Omegga';\nconst DIGITS = 6;\nconst PERIOD = 30;\nconst ALGORITHM = 'SHA1';\n\nfunction makeTOTP(secret: string, label = ''): TOTP {\n  return new TOTP({\n    issuer: ISSUER,\n    label,\n    algorithm: ALGORITHM,\n    digits: DIGITS,\n    period: PERIOD,\n    secret: Secret.fromBase32(secret),\n  });\n}\n\nexport function generateSecret(): string {\n  return new Secret().base32;\n}\n\nexport function generateToken(secret: string): string {\n  return makeTOTP(secret).generate();\n}\n\nexport function verifyToken(\n  token: string,\n  secret: string,\n  window = 1,\n): boolean {\n  if (!/^\\d{6}$/.test(token)) return false;\n  const delta = makeTOTP(secret).validate({ token, window });\n  return delta !== null;\n}\n\nexport function generateURI(secret: string, username: string): string {\n  return makeTOTP(secret, username).toString();\n}\n"],"names":["TOTP","Secret"],"mappings":";;;AAEA,MAAM,SAAS;AACf,MAAM,SAAS;AACf,MAAM,SAAS;AACf,MAAM,YAAY;AAElB,SAAS,SAAS,QAAgB,QAAQ,IAAU;AAClD,SAAO,IAAIA,QAAAA,KAAK;AAAA,IACd,QAAQ;AAAA,IACR;AAAA,IACA,WAAW;AAAA,IACX,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQC,QAAAA,OAAO,WAAW,MAAM;AAAA,EAAA,CACjC;AACH;AAEO,SAAS,iBAAyB;AACvC,SAAO,IAAIA,QAAAA,SAAS;AACtB;AAMO,SAAS,YACd,OACA,QACA,SAAS,GACA;AACT,MAAI,CAAC,UAAU,KAAK,KAAK,EAAG,QAAO;AACnC,QAAM,QAAQ,SAAS,MAAM,EAAE,SAAS,EAAE,OAAO,QAAQ;AACzD,SAAO,UAAU;AACnB;AAEO,SAAS,YAAY,QAAgB,UAA0B;AACpE,SAAO,SAAS,QAAQ,QAAQ,EAAE,SAAA;AACpC;;;;"}

package/dist/webserver/backend/trpc.js

@@ -2,6 +2,8 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const logger = require("../../logger.js");
 const server = require("@trpc/server");
+const events = require("./events.js");
+const permissions = require("./permissions.js");
 let _deps = null;
 function setContextDeps(deps) {
   _deps = deps;
@@ -13,7 +15,11 @@ function getContextDeps() {
 async function createContext(opts) {
   const { database } = getContextDeps();
   const req = opts.req;
-  const userId = req.session?.userId;
+  const session = req.session;
+  if (session?.mfaPending) {
+    throw new server.TRPCError({ code: "UNAUTHORIZED" });
+  }
+  const userId = session?.userId;
   const user = await database.findUserById(userId);
   if (!user || user.isBanned) {
     throw new server.TRPCError({ code: "UNAUTHORIZED" });
@@ -23,21 +29,58 @@ async function createContext(opts) {
     { $set: { lastOnline: Date.now() } }
   );
   const usernameText = `[${(user.username || "Admin").brightMagenta}]`;
+  let _userAbort = null;
+  const getUserAbort = () => {
+    if (!_userAbort) {
+      _userAbort = new AbortController();
+      const ac = _userAbort;
+      const onInvalidated = (name) => {
+        if (name === user.username) ac.abort();
+      };
+      events.serverEvents.on("userInvalidated", onInvalidated);
+      ac.signal.addEventListener("abort", () => {
+        events.serverEvents.off("userInvalidated", onInvalidated);
+      });
+    }
+    return _userAbort;
+  };
   return {
     user,
+    req,
+    get userAbort() {
+      return getUserAbort();
+    },
     log: (...args) => logger.default.logp(usernameText, ...args),
     error: (...args) => logger.default.errorp(usernameText, ...args)
   };
 }
-const t = server.initTRPC.context().create();
+const t = server.initTRPC.context().create({
+  errorFormatter({ shape, error, path, ctx }) {
+    const user = ctx?.user?.username || "?";
+    logger.default.errorp(
+      `[${user.brightMagenta}]`,
+      `${error.code} ${path ?? "?"}: ${error.message}`
+    );
+    return shape;
+  }
+});
 const router = t.router;
 t.procedure;
 const mergeRouters = t.mergeRouters;
-const requireScope = (scope) => t.middleware(({ ctx, next }) => {
+const requireScope = (scope) => t.middleware(async ({ ctx, next }) => {
   if (!ctx.user) throw new server.TRPCError({ code: "UNAUTHORIZED" });
+  if (ctx.user.isOwner) return next({ ctx });
+  const { database } = getContextDeps();
+  const rolePermissions = await database.getUserRolePermissions(ctx.user);
+  if (!permissions.userHasScope(ctx.user, scope, rolePermissions)) {
+    throw new server.TRPCError({
+      code: "FORBIDDEN",
+      message: `missing scope: ${scope}`
+    });
+  }
   return next({ ctx });
 });
-const protectedProcedure = (scope) => t.procedure.use(requireScope());
+const protectedProcedure = (scope) => t.procedure.use(requireScope(scope));
 exports.createContext = createContext;
 exports.getContextDeps = getContextDeps;
 exports.mergeRouters = mergeRouters;

package/dist/webserver/backend/trpc.js.map

@@ -1 +1 @@
-{"version":3,"file":"trpc.js","sources":["../../../src/webserver/backend/trpc.ts"],"sourcesContent":["import Logger from '@/logger';\nimport type Omegga from '@omegga/server';\nimport { initTRPC, TRPCError } from '@trpc/server';\nimport type { CreateExpressContextOptions } from '@trpc/server/adapters/express';\nimport type Database from './database';\nimport type { Scope } from './scopes';\nimport type { IStoreUser } from './types';\n\nexport type ContextDeps = {\n  database: Database;\n  omegga: Omegga;\n};\n\nlet _deps: ContextDeps | null = null;\n\nexport function setContextDeps(deps: ContextDeps) {\n  _deps = deps;\n}\n\nexport function getContextDeps(): ContextDeps {\n  if (!_deps) throw new Error('tRPC context deps not initialized');\n  return _deps;\n}\n\nexport type Context = {\n  user: IStoreUser & { _id: string };\n  log: (...args: any[]) => void;\n  error: (...args: any[]) => void;\n};\n\nexport async function createContext(\n  opts: CreateExpressContextOptions,\n): Promise<Context> {\n  const { database } = getContextDeps();\n  const req = opts.req;\n\n  const userId = (req as any).session?.userId;\n  const user = await database.findUserById(userId);\n  if (!user || user.isBanned) {\n    throw new TRPCError({ code: 'UNAUTHORIZED' });\n  }\n\n  // Update lastOnline (migrated from Socket.IO connect handler)\n  await database.stores.users.update<IStoreUser>(\n    { _id: user._id },\n    { $set: { lastOnline: Date.now() } },\n  );\n\n  const usernameText = `[${(user.username || 'Admin').brightMagenta}]`;\n\n  return {\n    user,\n    log: (...args: any[]) => Logger.logp(usernameText, ...args),\n    error: (...args: any[]) => Logger.errorp(usernameText, ...args),\n  };\n}\n\nconst t = initTRPC.context<Context>().create();\n\nexport const router = t.router;\nexport const publicProcedure = t.procedure;\nexport const mergeRouters = t.mergeRouters;\n\nexport const requireScope = (scope: Scope) =>\n  t.middleware(({ ctx, next }) => {\n    if (!ctx.user) throw new TRPCError({ code: 'UNAUTHORIZED' });\n    // TODO: check ctx.user.roles against scope\n    // For now, all authenticated users pass\n    return next({ ctx });\n  });\n\nexport const protectedProcedure = (scope: Scope) =>\n  t.procedure.use(requireScope(scope));\n"],"names":["TRPCError","Logger","initTRPC"],"mappings":";;;;AAaA,IAAI,QAA4B;AAEzB,SAAS,eAAe,MAAmB;AAChD,UAAQ;AACV;AAEO,SAAS,iBAA8B;AAC5C,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,mCAAmC;AAC/D,SAAO;AACT;AAQA,eAAsB,cACpB,MACkB;AAClB,QAAM,EAAE,SAAA,IAAa,eAAA;AACrB,QAAM,MAAM,KAAK;AAEjB,QAAM,SAAU,IAAY,SAAS;AACrC,QAAM,OAAO,MAAM,SAAS,aAAa,MAAM;AAC/C,MAAI,CAAC,QAAQ,KAAK,UAAU;AAC1B,UAAM,IAAIA,OAAAA,UAAU,EAAE,MAAM,gBAAgB;AAAA,EAC9C;AAGA,QAAM,SAAS,OAAO,MAAM;AAAA,IAC1B,EAAE,KAAK,KAAK,IAAA;AAAA,IACZ,EAAE,MAAM,EAAE,YAAY,KAAK,IAAA,IAAM;AAAA,EAAE;AAGrC,QAAM,eAAe,KAAK,KAAK,YAAY,SAAS,aAAa;AAEjE,SAAO;AAAA,IACL;AAAA,IACA,KAAK,IAAI,SAAgBC,OAAAA,QAAO,KAAK,cAAc,GAAG,IAAI;AAAA,IAC1D,OAAO,IAAI,SAAgBA,OAAAA,QAAO,OAAO,cAAc,GAAG,IAAI;AAAA,EAAA;AAElE;AAEA,MAAM,IAAIC,OAAAA,SAAS,QAAA,EAAmB,OAAA;AAE/B,MAAM,SAAS,EAAE;AACO,EAAE;AAC1B,MAAM,eAAe,EAAE;AAEvB,MAAM,eAAe,CAAC,UAC3B,EAAE,WAAW,CAAC,EAAE,KAAK,WAAW;AAC9B,MAAI,CAAC,IAAI,KAAM,OAAM,IAAIF,OAAAA,UAAU,EAAE,MAAM,gBAAgB;AAG3D,SAAO,KAAK,EAAE,KAAK;AACrB,CAAC;AAEI,MAAM,qBAAqB,CAAC,UACjC,EAAE,UAAU,IAAI,aAAkB,CAAC;;;;;;;;"}
+{"version":3,"file":"trpc.js","sources":["../../../src/webserver/backend/trpc.ts"],"sourcesContent":["import Logger from '@/logger';\nimport type Omegga from '@omegga/server';\nimport { initTRPC, TRPCError } from '@trpc/server';\nimport type { CreateExpressContextOptions } from '@trpc/server/adapters/express';\nimport type Database from './database';\nimport { serverEvents } from './events';\nimport { userHasScope } from './permissions';\nimport type { Scope } from './scopes';\nimport type { IStoreUser } from './types';\n\nexport type ContextDeps = {\n  database: Database;\n  omegga: Omegga;\n};\n\nlet _deps: ContextDeps | null = null;\n\nexport function setContextDeps(deps: ContextDeps) {\n  _deps = deps;\n}\n\nexport function getContextDeps(): ContextDeps {\n  if (!_deps) throw new Error('tRPC context deps not initialized');\n  return _deps;\n}\n\nexport type Context = {\n  user: IStoreUser & { _id: string };\n  req: import('express').Request;\n  userAbort: AbortController;\n  log: (...args: any[]) => void;\n  error: (...args: any[]) => void;\n};\n\nexport async function createContext(\n  opts: CreateExpressContextOptions,\n): Promise<Context> {\n  const { database } = getContextDeps();\n  const req = opts.req;\n\n  const session = (req as any).session;\n  if (session?.mfaPending) {\n    throw new TRPCError({ code: 'UNAUTHORIZED' });\n  }\n  const userId = session?.userId;\n  const user = await database.findUserById(userId);\n  if (!user || user.isBanned) {\n    throw new TRPCError({ code: 'UNAUTHORIZED' });\n  }\n\n  // Update lastOnline (migrated from Socket.IO connect handler)\n  await database.stores.users.update<IStoreUser>(\n    { _id: user._id },\n    { $set: { lastOnline: Date.now() } },\n  );\n\n  const usernameText = `[${(user.username || 'Admin').brightMagenta}]`;\n\n  let _userAbort: AbortController | null = null;\n  const getUserAbort = () => {\n    if (!_userAbort) {\n      _userAbort = new AbortController();\n      const ac = _userAbort;\n      const onInvalidated = (name: string) => {\n        if (name === user.username) ac.abort();\n      };\n      serverEvents.on('userInvalidated', onInvalidated);\n      ac.signal.addEventListener('abort', () => {\n        serverEvents.off('userInvalidated', onInvalidated);\n      });\n    }\n    return _userAbort;\n  };\n\n  return {\n    user,\n    req,\n    get userAbort() {\n      return getUserAbort();\n    },\n    log: (...args: any[]) => Logger.logp(usernameText, ...args),\n    error: (...args: any[]) => Logger.errorp(usernameText, ...args),\n  };\n}\n\nconst t = initTRPC.context<Context>().create({\n  errorFormatter({ shape, error, path, ctx }) {\n    const user = (ctx as Context | undefined)?.user?.username || '?';\n    Logger.errorp(\n      `[${user.brightMagenta}]`,\n      `${error.code} ${path ?? '?'}: ${error.message}`,\n    );\n    return shape;\n  },\n});\n\nexport const router = t.router;\nexport const publicProcedure = t.procedure;\nexport const mergeRouters = t.mergeRouters;\n\nexport const requireScope = (scope: Scope) =>\n  t.middleware(async ({ ctx, next }) => {\n    if (!ctx.user) throw new TRPCError({ code: 'UNAUTHORIZED' });\n    if (ctx.user.isOwner) return next({ ctx });\n    const { database } = getContextDeps();\n    const rolePermissions = await database.getUserRolePermissions(ctx.user);\n    if (!userHasScope(ctx.user, scope, rolePermissions)) {\n      throw new TRPCError({\n        code: 'FORBIDDEN',\n        message: `missing scope: ${scope}`,\n      });\n    }\n    return next({ ctx });\n  });\n\nexport const protectedProcedure = (scope: Scope) =>\n  t.procedure.use(requireScope(scope));\n"],"names":["TRPCError","serverEvents","Logger","initTRPC","userHasScope"],"mappings":";;;;;;AAeA,IAAI,QAA4B;AAEzB,SAAS,eAAe,MAAmB;AAChD,UAAQ;AACV;AAEO,SAAS,iBAA8B;AAC5C,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,mCAAmC;AAC/D,SAAO;AACT;AAUA,eAAsB,cACpB,MACkB;AAClB,QAAM,EAAE,SAAA,IAAa,eAAA;AACrB,QAAM,MAAM,KAAK;AAEjB,QAAM,UAAW,IAAY;AAC7B,MAAI,SAAS,YAAY;AACvB,UAAM,IAAIA,OAAAA,UAAU,EAAE,MAAM,gBAAgB;AAAA,EAC9C;AACA,QAAM,SAAS,SAAS;AACxB,QAAM,OAAO,MAAM,SAAS,aAAa,MAAM;AAC/C,MAAI,CAAC,QAAQ,KAAK,UAAU;AAC1B,UAAM,IAAIA,OAAAA,UAAU,EAAE,MAAM,gBAAgB;AAAA,EAC9C;AAGA,QAAM,SAAS,OAAO,MAAM;AAAA,IAC1B,EAAE,KAAK,KAAK,IAAA;AAAA,IACZ,EAAE,MAAM,EAAE,YAAY,KAAK,IAAA,IAAM;AAAA,EAAE;AAGrC,QAAM,eAAe,KAAK,KAAK,YAAY,SAAS,aAAa;AAEjE,MAAI,aAAqC;AACzC,QAAM,eAAe,MAAM;AACzB,QAAI,CAAC,YAAY;AACf,mBAAa,IAAI,gBAAA;AACjB,YAAM,KAAK;AACX,YAAM,gBAAgB,CAAC,SAAiB;AACtC,YAAI,SAAS,KAAK,SAAU,IAAG,MAAA;AAAA,MACjC;AACAC,0BAAa,GAAG,mBAAmB,aAAa;AAChD,SAAG,OAAO,iBAAiB,SAAS,MAAM;AACxCA,4BAAa,IAAI,mBAAmB,aAAa;AAAA,MACnD,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,IAAI,YAAY;AACd,aAAO,aAAA;AAAA,IACT;AAAA,IACA,KAAK,IAAI,SAAgBC,OAAAA,QAAO,KAAK,cAAc,GAAG,IAAI;AAAA,IAC1D,OAAO,IAAI,SAAgBA,OAAAA,QAAO,OAAO,cAAc,GAAG,IAAI;AAAA,EAAA;AAElE;AAEA,MAAM,IAAIC,OAAAA,SAAS,QAAA,EAAmB,OAAO;AAAA,EAC3C,eAAe,EAAE,OAAO,OAAO,MAAM,OAAO;AAC1C,UAAM,OAAQ,KAA6B,MAAM,YAAY;AAC7DD,WAAAA,QAAO;AAAA,MACL,IAAI,KAAK,aAAa;AAAA,MACtB,GAAG,MAAM,IAAI,IAAI,QAAQ,GAAG,KAAK,MAAM,OAAO;AAAA,IAAA;AAEhD,WAAO;AAAA,EACT;AACF,CAAC;AAEM,MAAM,SAAS,EAAE;AACO,EAAE;AAC1B,MAAM,eAAe,EAAE;AAEvB,MAAM,eAAe,CAAC,UAC3B,EAAE,WAAW,OAAO,EAAE,KAAK,WAAW;AACpC,MAAI,CAAC,IAAI,KAAM,OAAM,IAAIF,OAAAA,UAAU,EAAE,MAAM,gBAAgB;AAC3D,MAAI,IAAI,KAAK,gBAAgB,KAAK,EAAE,KAAK;AACzC,QAAM,EAAE,SAAA,IAAa,eAAA;AACrB,QAAM,kBAAkB,MAAM,SAAS,uBAAuB,IAAI,IAAI;AACtE,MAAI,CAACI,YAAAA,aAAa,IAAI,MAAM,OAAO,eAAe,GAAG;AACnD,UAAM,IAAIJ,OAAAA,UAAU;AAAA,MAClB,MAAM;AAAA,MACN,SAAS,kBAAkB,KAAK;AAAA,IAAA,CACjC;AAAA,EACH;AACA,SAAO,KAAK,EAAE,KAAK;AACrB,CAAC;AAEI,MAAM,qBAAqB,CAAC,UACjC,EAAE,UAAU,IAAI,aAAa,KAAK,CAAC;;;;;;;;"}